{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Noninterference_Base_Refinement\nimports Noninterference_Base\n Noninterference_Base_Alternatives\nbegin\n\n(* we assume the same initial state for both systems *)\nlocale noninterference_refinement = \n abs?: complete_unwinding_system A s0 dom uwr policy out schedDomain +\n conc?: noninterference_system C s0 dom uwr policy out schedDomain\n for A :: \"('a,'s,'e) data_type\"\n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\" \n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\" \n and out :: \"'d \\ 's \\ 'p\" \n and schedDomain :: \"'d\" \n and C :: \"('c,'s,'e) data_type\" +\n assumes refines: \"refines C A\"\n\ncontext noninterference_refinement begin\n\nlemma reachable:\n \"conc.reachable s \\ abs.reachable s\"\n apply(simp add: conc.reachable_def abs.reachable_def)\n using refines by (fastforce simp: refines_def)\n \n\nlemma Step:\n \"conc.Step a \\ abs.Step a\"\n apply(simp add: conc.Step_def abs.Step_def)\n using refines by(fastforce simp: refines_def)\n\nlemma confidentiality_u_refinement_closed:\n \"abs.confidentiality_u \\ conc.confidentiality_u\"\n apply(simp add: abs.confidentiality_u_def) \n apply(subst conc.confidentiality_u_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\nlemma confidentiality_u_weak_refinement_closed:\n \"abs.confidentiality_u_weak \\ conc.confidentiality_u_weak\"\n apply(simp add: abs.confidentiality_u_weak_def) \n apply(subst conc.confidentiality_u_weak_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\nlemma integrity_u_refinement_closed:\n \"abs.integrity_u \\ conc.integrity_u\"\n apply(simp add: abs.integrity_u_def) \n apply(subst conc.integrity_u_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\n\nlemma xources_subset:\n \"abs.confidentiality_u \\ abs.xources as s u \\ conc.xources as s u\"\n apply(induct as arbitrary: s u) \n apply(simp add: abs.xources.xources_Nil conc.xources.xources_Nil)\n apply(simp add: abs.xources.xources_Cons conc.xources.xources_Cons)\n apply(rule conjI)\n apply(rule subsetI)\n apply(rule UnI1)\n apply(blast dest: subsetD[OF Step])\n apply(rule subsetI)\n apply(rule UnI2)\n apply(blast dest: subsetD[OF Step])\n done\n\n\nlemma uwr_equiv:\n \"abs.uwr_equiv s as t bs u \\ conc.uwr_equiv s as t bs u\"\n apply(insert refines)\n apply(fastforce simp: abs.uwr_equiv_def conc.uwr_equiv_def simp: refines_def dest: subsetD)\n done\n\nlemma xNonleakage_gen_refinement_closed:\n \"abs.xNonleakage_gen \\ conc.xNonleakage_gen\"\n apply(frule abs.xNonleakage_gen_confidentiality_u)\n apply(frule xources_subset) \n apply(clarsimp simp: abs.xNonleakage_gen_def conc.xNonleakage_gen_def)\n apply(drule (1) sameFor_subset_dom[OF _ xources_subset])\n apply(blast dest: reachable uwr_equiv)\n done\n\nend\n\n\nlocale complete_noninterference_refinement = noninterference_refinement A s0 dom uwr policy out schedDomain C \n for A :: \"('a,'s,'e) data_type\"\n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\" \n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\" \n and out :: \"'d \\ 's \\ 'p\" \n and schedDomain :: \"'d\" \n and C :: \"('c,'s,'e) data_type\" +\n assumes Step_C: \"Step_system C s0\"\n\nsublocale complete_noninterference_refinement \\ conc: complete_unwinding_system C s0 dom uwr policy out schedDomain\n apply(unfold_locales)\n using Step_C apply(fastforce simp: Step_system_def)\n using Step_C apply(fastforce simp: Step_system_def)\n apply(rule policy_refl)\n done\n\ncontext complete_noninterference_refinement begin\nlemma Noninfluence_strong_uwr_refinement_closed:\n \"abs.Noninfluence_strong_uwr \\\n conc.Noninfluence_strong_uwr\"\n apply(frule abs.Noninfluence_strong_uwr_confidentiality_u_weak)\n apply(drule abs.Noninfluence_strong_uwr_integrity_u)\n apply(drule confidentiality_u_weak_refinement_closed)\n apply(drule integrity_u_refinement_closed)\n apply(blast intro: conc.Noninfluence_strong_uwr)\n done\n\nlemma Nonleakage_gen_refinement_closed:\n \"abs.Nonleakage_gen \\\n conc.Nonleakage_gen\"\n apply(simp add: abs.Nonleakage_gen_equiv_confidentiality_u conc.Nonleakage_gen_equiv_confidentiality_u)\n apply(erule confidentiality_u_refinement_closed)\n done\n\nlemma Noninfluence_strong_quasi_refinement_closed:\n \"\\abs.confidentiality_u_weak; abs.integrity_u;\n output_consistent\\ \\\n conc.Noninfluence_strong\"\n apply(rule conc.Noninfluence_strong)\n apply(erule confidentiality_u_weak_refinement_closed)\n apply assumption\n apply(erule integrity_u_refinement_closed)\n done\n\nlemma Noninfluence_strong_uwr_quasi_refinement_closed:\n \"\\abs.Noninfluence_strong_uwr;\n output_consistent\\ \\\n conc.Noninfluence_strong\"\n apply(rule conc.Noninfluence_strong)\n apply(rule confidentiality_u_weak_refinement_closed)\n apply(erule abs.Noninfluence_strong_uwr_confidentiality_u_weak)\n apply assumption\n apply(rule integrity_u_refinement_closed)\n apply(erule abs.Noninfluence_strong_uwr_integrity_u)\n done\n \nend\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/infoflow/Noninterference_Base_Refinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.29997489744818634}} {"text": "section {* ICTAC 2016 tutorial. Taipei, 24/10/2016 *}\n\ntheory ictac16_tutorial\n imports \"../theories/utp_designs\"\nbegin\n\nsubsection {* Laws of programming *}\n\ntheorem cond_shadow: \"(P \\ b \\ (Q \\ b \\ R)) = (P \\ b \\ R)\" oops\n\ntheorem seqr_assoc: \"(P ;; (Q ;; R)) = ((P ;; Q) ;; R)\" oops\n\ntheorem seqr_left_unit: \"(II ;; P) = P\" oops\n\ntheorem seqr_left_zero: \"(false ;; P) = false\" oops\n\ntheorem cond_seq_left_distr:\n assumes \"out\\ \\ b\"\n shows \"((P \\ b \\ Q) ;; R) = ((P ;; R) \\ b \\ (Q ;; R))\"\n using assms by (rel_simp, blast+)\n\ntheorem assign_twice:\n assumes \"vwb_lens x\" \"x \\ f\"\n shows \"(x := e ;; x := f) = (x := f)\"\n using assms by rel_auto\n\ntheorem assign_commute:\n assumes \"x \\ y\" \"x \\ f\" \"y \\ e\"\n shows \"(x := e ;; y := f) = (y := f ;; x := e)\"\n using assms by (rel_auto, simp_all add: lens_indep_comm)\n\nsubsection {* Design laws *}\n\ntheorem design_false_pre: \"(false \\ P) = true\" by rel_auto\n\ntheorem design_true_left_zero: \"(true ;; (P \\ Q)) = true\"\nproof -\n have \"(true ;; (P \\ Q)) = (\\<^bold>\\ ok\\<^sub>0 \\ true\\\\ok\\<^sub>0\\/$ok\\\\ ;; (P \\ Q)\\\\ok\\<^sub>0\\/$ok\\)\"\n by (subst seqr_middle[of ok], simp_all)\n also have \"... = ((true\\false/$ok\\\\ ;; (P \\ Q)\\false/$ok\\) \\ (true\\true/$ok\\\\ ;; (P \\ Q)\\true/$ok\\))\"\n by (simp add: disj_comm false_alt_def true_alt_def)\n also have \"... = ((true\\false/$ok\\\\ ;; true\\<^sub>h) \\ (true ;; ((P \\ Q)\\true/$ok\\)))\"\n by (subst_tac, rel_auto)\n also have \"... = true\"\n by (subst_tac, simp add: precond_right_unit unrest)\n finally show ?thesis .\nqed\n\ntheorem rdesign_left_unit:\n fixes P Q :: \"'\\ hrel_des\"\n shows \"II\\<^sub>D ;; (P \\\\<^sub>r Q) = (P \\\\<^sub>r Q)\"\nproof -\n -- {* We first expand out the definition of the design identity *}\n have \"II\\<^sub>D ;; (P \\\\<^sub>r Q) = (true \\\\<^sub>r II) ;; (P \\\\<^sub>r Q)\"\n by (simp add: skip_d_def)\n -- {* Next, we apply the design composition law above in a subproof *}\n also have \"... = (true \\ \\ (II ;; (\\ P))) \\\\<^sub>r (II ;; Q)\"\n proof -\n -- {* The assumption of identity is $\\true$ so it is easy to discharge the proviso *}\n have \"out\\ \\ true\"\n by unrest_tac\n -- {* From this we can apply the composition law *}\n thus ?thesis\n using rdesign_composition_cond by blast\n qed\n -- {* Simplification then allows us to remove extraneous terms *}\n also have \"... = (\\ (\\ P)) \\\\<^sub>r Q\"\n by simp\n -- {* Finally, we can show the thesis *}\n finally show ?thesis by simp\nqed\n\nsubsection {* Program example *}\n\nalphabet my_state =\n x :: int\n y :: int\n z :: int\n\nlemma \"(x := 1 ;; x := (&x + 1)) = (x := 2)\"\n oops\n\nlemma \"($x\\ >\\<^sub>u $x \\ $y\\ <\\<^sub>u $y) \\ x, y := &x + 1, &y\"\n oops\n\nlemma \"(x := 1 ;; (y := 7 \\ $x >\\<^sub>u 0 \\ y := 8)) = ((x,y) := (1,7))\"\n oops\n\n(* Need following law: *)\ntheorem ndesign_composition_wp: \"((p1 \\\\<^sub>n Q1) ;; (p2 \\\\<^sub>n Q2)) = ((p1 \\ Q1 wp p2) \\\\<^sub>n (Q1 ;; Q2))\"\n oops\n\nlemma violate_precond:\n \"(true \\\\<^sub>n x := 1) ;; ((&x >\\<^sub>u 1) \\\\<^sub>n y := 2) = \\\\<^sub>D\"\n apply (subst ndesign_composition_wp)\n apply (simp)\n apply (wp_tac)\n apply (subst_tac)\n apply (rel_auto)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/tutorial/ictac16_tutorial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.29973145808773144}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory WhileLoopRules\n imports\n Empty_Fail\n NonDetMonad_Total\n NonDetMonad_Sat\nbegin\n\nsection \"Well-ordered measures\"\n\n(* A version of \"measure\" that takes any wellorder, instead of being fixed to \"nat\". *)\ndefinition measure' :: \"('a \\ 'b::wellorder) => ('a \\ 'a) set\" where\n \"measure' = (\\f. {(a, b). f a < f b})\"\n\nlemma in_measure'[simp, code_unfold]:\n \"((x,y) \\ measure' f) = (f x < f y)\"\n by (simp add:measure'_def)\n\nlemma wf_measure'[iff]:\n \"wf (measure' f)\"\n apply (clarsimp simp: measure'_def)\n apply (insert wf_inv_image [OF wellorder_class.wf, where f=f])\n apply (clarsimp simp: inv_image_def)\n done\n\nlemma wf_wellorder_measure:\n \"wf {(a, b). (M a :: 'a :: wellorder) < M b}\"\n apply (subgoal_tac \"wf (inv_image ({(a, b). a < b}) M)\")\n apply (clarsimp simp: inv_image_def)\n apply (rule wf_inv_image)\n apply (rule wellorder_class.wf)\n done\n\n\nsection \"whileLoop lemmas\"\n\ntext \\\n The following @{const whileLoop} definitions with additional\n invariant/variant annotations allow the user to annotate\n @{const whileLoop} terms with information that can be used\n by automated tools.\n\\\ndefinition whileLoop_inv ::\n \"('a \\ 'b \\ bool) \\ ('a \\ ('b, 'a) nondet_monad) \\ 'a \\ ('a \\ 'b \\ bool) \\\n (('a \\ 'b) \\ 'a \\ 'b) set \\ ('b, 'a) nondet_monad\" where\n \"whileLoop_inv C B x I R \\ whileLoop C B x\"\n\ndefinition whileLoopE_inv ::\n \"('a \\ 'b \\ bool) \\ ('a \\ ('b, 'c + 'a) nondet_monad) \\ 'a \\ ('a \\ 'b \\ bool) \\\n (('a \\ 'b) \\ 'a \\ 'b) set \\ ('b, 'c + 'a) nondet_monad\" where\n \"whileLoopE_inv C B x I R \\ whileLoopE C B x\"\n\nlemma whileLoop_add_inv:\n \"whileLoop B C = (\\x. whileLoop_inv B C x I (measure' M))\"\n by (clarsimp simp: whileLoop_inv_def)\n\nlemma whileLoopE_add_inv:\n \"whileLoopE B C = (\\x. whileLoopE_inv B C x I (measure' M))\"\n by (clarsimp simp: whileLoopE_inv_def)\n\nsubsection \"Simple base rules\"\n\nlemma whileLoop_terminates_unfold:\n \"\\ whileLoop_terminates C B r s; (r', s') \\ fst (B r s); C r s \\ \\\n whileLoop_terminates C B r' s'\"\n by (force elim!: whileLoop_terminates.cases)\n\nlemma snd_whileLoop_first_step: \"\\ \\ snd (whileLoop C B r s); C r s \\ \\ \\ snd (B r s)\"\n apply (subst (asm) whileLoop_unroll)\n apply (clarsimp simp: bind_def condition_def)\n done\n\nlemma snd_whileLoopE_first_step: \"\\ \\ snd (whileLoopE C B r s); C r s \\ \\ \\ snd (B r s)\"\n apply (subgoal_tac \"\\ \\ snd (whileLoopE C B r s); C r s \\ \\ \\ snd ((lift B (Inr r)) s)\")\n apply (clarsimp simp: lift_def)\n apply (unfold whileLoopE_def)\n apply (erule snd_whileLoop_first_step)\n apply clarsimp\n done\n\nlemma snd_whileLoop_unfold:\n \"\\ \\ snd (whileLoop C B r s); C r s; (r', s') \\ fst (B r s) \\ \\ \\ snd (whileLoop C B r' s')\"\n apply (clarsimp simp: whileLoop_def)\n apply (auto elim: whileLoop_results.cases whileLoop_terminates.cases\n intro: whileLoop_results.intros whileLoop_terminates.intros)\n done\n\nlemma snd_whileLoopE_unfold:\n \"\\ \\ snd (whileLoopE C B r s); (Inr r', s') \\ fst (B r s); C r s \\ \\ \\ snd (whileLoopE C B r' s')\"\n unfolding whileLoopE_def\n by (fastforce simp: lift_def dest: snd_whileLoop_unfold)\n\nlemma whileLoop_results_cong [cong]:\n assumes C: \"\\r s. C r s = C' r s\"\n and B:\"\\(r :: 'r) (s :: 's). C' r s \\ B r s = B' r s\"\n shows \"whileLoop_results C B = whileLoop_results C' B'\"\nproof -\n {\n fix x y C B C' B'\n have \"\\ (x, y) \\ whileLoop_results C B;\n \\(r :: 'r) (s :: 's). C r s = C' r s; \\r s. C' r s \\ B r s = B' r s \\\n \\ (x, y) \\ whileLoop_results C' B'\"\n by (induct rule: whileLoop_results.induct) (auto intro: whileLoop_results.intros)\n }\n\n thus ?thesis\n apply -\n apply (rule set_eqI, rule iffI; clarsimp split: prod.splits)\n apply (clarsimp simp: C B)\n apply (clarsimp simp: C [symmetric] B [symmetric])\n done\nqed\n\nlemma whileLoop_terminates_cong [cong]:\n assumes r: \"r = r'\"\n and s: \"s = s'\"\n and C: \"\\r s. C r s = C' r s\"\n and B: \"\\r s. C' r s \\ B r s = B' r s\"\n shows \"whileLoop_terminates C B r s = whileLoop_terminates C' B' r' s'\"\nproof (rule iffI)\n assume T: \"whileLoop_terminates C B r s\"\n show \"whileLoop_terminates C' B' r' s'\"\n apply (insert T r s)\n apply (induct arbitrary: r' s' rule: whileLoop_terminates.induct)\n apply (clarsimp simp: C)\n apply (erule whileLoop_terminates.intros)\n apply (clarsimp simp: C B split: prod.splits)\n apply (rule whileLoop_terminates.intros, assumption)\n apply (clarsimp simp: C B split: prod.splits)\n done\nnext\n assume T: \"whileLoop_terminates C' B' r' s'\"\n show \"whileLoop_terminates C B r s\"\n apply (insert T r s)\n apply (induct arbitrary: r s rule: whileLoop_terminates.induct)\n apply (rule whileLoop_terminates.intros)\n apply (clarsimp simp: C)\n apply (rule whileLoop_terminates.intros, fastforce simp: C)\n apply (clarsimp simp: C B split: prod.splits)\n done\nqed\n\nlemma whileLoop_cong[cong]:\n \"\\ \\r s. C r s = C' r s; \\r s. C r s \\ B r s = B' r s \\ \\ whileLoop C B = whileLoop C' B'\"\n by (clarsimp simp: whileLoop_def)\n\nlemma whileLoopE_cong[cong]:\n \"\\ \\r s. C r s = C' r s ; \\r s. C r s \\ B r s = B' r s \\ \\ whileLoopE C B = whileLoopE C' B'\"\n unfolding whileLoopE_def\n by (rule whileLoop_cong[THEN arg_cong]; clarsimp simp: lift_def throwError_def split: sum.splits)\n\nlemma whileLoop_terminates_wf:\n \"wf {(x, y). C (fst y) (snd y) \\ x \\ fst (B (fst y) (snd y)) \\ whileLoop_terminates C B (fst y) (snd y)}\"\n apply (rule wfI[where A=\"UNIV\" and B=\"{(r, s). whileLoop_terminates C B r s}\"]; clarsimp)\n apply (erule whileLoop_terminates.induct; blast)\n done\n\nsubsection \"Basic induction helper lemmas\"\n\nlemma whileLoop_results_induct_lemma1:\n \"\\ (a, b) \\ whileLoop_results C B; b = Some (x, y) \\ \\ \\ C x y\"\n by (induct rule: whileLoop_results.induct) auto\n\nlemma whileLoop_results_induct_lemma1':\n \"\\ (a, b) \\ whileLoop_results C B; a \\ b \\ \\ \\x. a = Some x \\ C (fst x) (snd x)\"\n by (induct rule: whileLoop_results.induct) auto\n\nlemma whileLoop_results_induct_lemma2 [consumes 1]:\n \"\\ (a, b) \\ whileLoop_results C B;\n a = Some (x :: 'a \\ 'b); b = Some y;\n P x; \\s t. \\ P s; t \\ fst (B (fst s) (snd s)); C (fst s) (snd s) \\ \\ P t \\ \\ P y\"\n apply (induct arbitrary: x y rule: whileLoop_results.induct)\n apply simp\n apply simp\n apply atomize\n apply fastforce\n done\n\nlemma whileLoop_results_induct_lemma3 [consumes 1]:\n assumes result: \"(Some (r, s), Some (r', s')) \\ whileLoop_results C B\"\n and inv_start: \"I r s\"\n and inv_step: \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ I r' s'\"\n shows \"I r' s'\"\n apply (rule whileLoop_results_induct_lemma2 [where P=\"case_prod I\" and y=\"(r', s')\" and x=\"(r, s)\",\n simplified case_prod_unfold, simplified])\n apply (rule result)\n apply simp\n apply simp\n apply fact\n apply (erule (1) inv_step)\n apply clarsimp\n done\n\nsubsection \"Inductive reasoning about whileLoop results\"\n\nlemma in_whileLoop_induct[consumes 1]:\n assumes in_whileLoop: \"(r', s') \\ fst (whileLoop C B r s)\"\n and init_I: \"\\ r s. \\ C r s \\ I r s r s\"\n and step: \"\\r s r' s' r'' s''. \\ C r s; (r', s') \\ fst (B r s);\n (r'', s'') \\ fst (whileLoop C B r' s');\n I r' s' r'' s'' \\ \\ I r s r'' s''\"\n shows \"I r s r' s'\"\nproof cases\n assume \"C r s\"\n\n {\n obtain a where a_def: \"a = Some (r, s)\"\n by blast\n obtain b where b_def: \"b = Some (r', s')\"\n by blast\n\n have \"\\ (a, b) \\ whileLoop_results C B; \\x. a = Some x; \\x. b = Some x \\\n \\ I (fst (the a)) (snd (the a)) (fst (the b)) (snd (the b))\"\n by (induct rule: whileLoop_results.induct)\n (auto simp: init_I whileLoop_def intro: step)\n\n hence \"(Some (r, s), Some (r', s')) \\ whileLoop_results C B \\ I r s r' s'\"\n by (clarsimp simp: a_def b_def)\n }\n\n thus ?thesis\n using in_whileLoop\n by (clarsimp simp: whileLoop_def)\nnext\n assume \"\\ C r s\"\n\n hence \"r' = r \\ s' = s\"\n using in_whileLoop\n by (subst (asm) whileLoop_unroll, clarsimp simp: condition_def return_def)\n\n thus ?thesis\n by (metis init_I \\\\ C r s\\)\nqed\n\nlemma snd_whileLoop_induct [consumes 1]:\n assumes induct: \"snd (whileLoop C B r s)\"\n and terminates: \"\\ whileLoop_terminates C B r s \\ I r s\"\n and init: \"\\ r s. \\ snd (B r s); C r s \\ \\ I r s\"\n and step: \"\\r s r' s' r'' s''. \\ C r s; (r', s') \\ fst (B r s); snd (whileLoop C B r' s');\n I r' s' \\ \\ I r s\"\n shows \"I r s\"\n apply (insert init induct)\n apply atomize\n apply (unfold whileLoop_def)\n apply clarsimp\n apply (erule disjE)\n apply (erule rev_mp)\n apply (induct \"Some (r, s)\" \"None :: ('a \\ 'b) option\" arbitrary: r s rule: whileLoop_results.induct)\n apply clarsimp\n apply clarsimp\n apply (erule (1) step)\n apply (clarsimp simp: whileLoop_def)\n apply clarsimp\n apply (metis terminates)\n done\n\nlemma whileLoop_terminatesE_induct [consumes 1]:\n assumes induct: \"whileLoop_terminatesE C B r s\"\n and init: \"\\r s. \\ C r s \\ I r s\"\n and step: \"\\r s r' s'. \\ C r s; \\(v', s') \\ fst (B r s). case v' of Inl _ \\ True | Inr r' \\ I r' s' \\ \\ I r s\"\n shows \"I r s\"\n apply (insert induct)\n apply (clarsimp simp: whileLoop_terminatesE_def)\n apply (subgoal_tac \"(\\r s. case (Inr r) of Inl x \\ True | Inr x \\ I x s) r s\")\n apply simp\n apply (induction rule: whileLoop_terminates.induct)\n apply (clarsimp split: sum.splits elim!: init)\n apply (clarsimp split: sum.splits)\n apply (rule step)\n apply simp\n apply (force simp: lift_def split: sum.splits)\n done\n\nsubsection \"Direct reasoning about whileLoop components\"\n\nlemma fst_whileLoop_cond_false:\n assumes loop_result: \"(r', s') \\ fst (whileLoop C B r s)\"\n shows \"\\ C r' s'\"\n using loop_result\n by (rule in_whileLoop_induct, auto)\n\nlemma snd_whileLoop:\n assumes init_I: \"I r s\"\n and cond_I: \"C r s\"\n and non_term: \"\\r. \\ \\s. I r s \\ C r s \\ \\ snd (B r s) \\ B r \\\\ \\r' s'. C r' s' \\ I r' s' \\\"\n shows \"snd (whileLoop C B r s)\"\n apply (clarsimp simp: whileLoop_def)\n apply (rotate_tac)\n apply (insert init_I cond_I)\n apply (induct rule: whileLoop_terminates.induct)\n apply clarsimp\n apply (cut_tac r=r in non_term)\n apply (clarsimp simp: exs_valid_def)\n apply (subst (asm) (2) whileLoop_results.simps)\n apply clarsimp\n apply (insert whileLoop_results.simps)\n apply fast\n done\n\nlemma whileLoop_terminates_inv:\n assumes init_I: \"I r s\"\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\\"\n assumes wf_R: \"wf R\"\n shows \"whileLoop_terminates C B r s\"\n apply (insert init_I)\n using wf_R\n apply (induction \"(r, s)\" arbitrary: r s)\n apply atomize\n apply (subst whileLoop_terminates_simps)\n apply clarsimp\n apply (erule use_valid)\n apply (rule hoare_strengthen_post, rule inv)\n apply force\n apply force\n done\n\nlemma not_snd_whileLoop:\n assumes init_I: \"I r s\"\n and inv_holds: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\!\"\n and wf_R: \"wf R\"\n shows \"\\ snd (whileLoop C B r s)\"\nproof -\n {\n fix x y\n have \"\\ (x, y) \\ whileLoop_results C B; x = Some (r, s); y = None \\ \\ False\"\n apply (insert init_I)\n apply (induct arbitrary: r s rule: whileLoop_results.inducts)\n apply simp\n apply simp\n apply (insert snd_validNF [OF inv_holds])[1]\n apply blast\n apply (drule use_validNF [OF _ inv_holds])\n apply simp\n apply clarsimp\n done\n }\n\n also have \"whileLoop_terminates C B r s\"\n apply (rule whileLoop_terminates_inv [where I=I, OF init_I _ wf_R])\n apply (insert inv_holds)\n apply (clarsimp simp: validNF_def)\n done\n\n ultimately show ?thesis\n by (clarsimp simp: whileLoop_def, blast)\nqed\n\nlemma valid_whileLoop:\n assumes first_step: \"\\s. P r s \\ I r s\"\n and inv_step: \"\\r. \\ \\s. I r s \\ C r s \\ B r \\ I \\\"\n and final_step: \"\\r s. \\ I r s; \\ C r s \\ \\ Q r s\"\n shows \"\\ P r \\ whileLoop C B r \\ Q \\\"\nproof -\n {\n fix r' s' s\n assume inv: \"I r s\"\n assume step: \"(r', s') \\ fst (whileLoop C B r s)\"\n\n have \"I r' s'\"\n using step inv\n apply (induct rule: in_whileLoop_induct)\n apply simp\n apply (drule use_valid, rule inv_step, auto)\n done\n }\n\n thus ?thesis\n apply (clarsimp simp: valid_def)\n apply (drule first_step)\n apply (rule final_step, simp)\n apply (metis fst_whileLoop_cond_false)\n done\nqed\n\nlemma whileLoop_wp:\n \"\\ \\r. \\ \\s. I r s \\ C r s \\ B r \\ I \\;\n \\r s. \\ I r s; \\ C r s \\ \\ Q r s \\ \\\n \\ I r \\ whileLoop C B r \\ Q \\\"\n by (rule valid_whileLoop)\n\nlemma whileLoop_wp_inv [wp]:\n \"\\ \\r. \\\\s. I r s \\ C r s\\ B r \\I\\; \\r s. \\I r s; \\ C r s\\ \\ Q r s \\\n \\ \\ I r \\ whileLoop_inv C B r I M \\ Q \\\"\n apply (clarsimp simp: whileLoop_inv_def)\n apply (rule valid_whileLoop [where P=I and I=I], auto)\n done\n\nlemma validE_whileLoopE:\n \"\\\\s. P r s \\ I r s;\n \\r. \\ \\s. I r s \\ C r s \\ B r \\ I \\,\\ A \\;\n \\r s. \\ I r s; \\ C r s \\ \\ Q r s\\ \\\n \\ P r \\ whileLoopE C B r \\ Q \\,\\ A \\\"\n apply (clarsimp simp: whileLoopE_def validE_def)\n apply (rule valid_whileLoop [where I=\"\\r s. (case r of Inl x \\ A x s | Inr x \\ I x s)\"\n and Q=\"\\r s. (case r of Inl x \\ A x s | Inr x \\ Q x s)\"])\n apply atomize\n apply (clarsimp simp: valid_def lift_def split: sum.splits)\n apply (clarsimp simp: valid_def lift_def split: sum.splits)\n apply (clarsimp split: sum.splits)\n done\n\nlemma whileLoopE_wp:\n \"\\ \\r. \\ \\s. I r s \\ C r s \\ B r \\ I \\, \\ A \\;\n \\r s. \\ I r s; \\ C r s \\ \\ Q r s \\ \\\n \\ I r \\ whileLoopE C B r \\ Q \\, \\ A \\\"\n by (rule validE_whileLoopE)\n\nlemma exs_valid_whileLoop:\n assumes init_T: \"\\s. P s \\ T r s\"\n and iter_I: \"\\r s0. \\\\s. T r s \\ C r s \\ s = s0\\ B r \\\\\\r' s'. T r' s' \\ ((r', s'),(r, s0)) \\ R\\\"\n and wf_R: \"wf R\"\n and final_I: \"\\r s. \\ T r s; \\ C r s \\ \\ Q r s\"\n shows \"\\ P \\ whileLoop C B r \\\\ Q \\\"\nproof (clarsimp simp: exs_valid_def Bex_def)\n fix s\n assume \"P s\"\n\n {\n fix x\n have \"T (fst x) (snd x) \\ \\r' s'. (r', s') \\ fst (whileLoop C B (fst x) (snd x)) \\ T r' s'\"\n using wf_R\n apply induction\n apply atomize\n apply (case_tac \"C (fst x) (snd x)\")\n apply (subst whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def' split: prod.splits)\n apply (cut_tac ?s0.0=b and r=a in iter_I)\n apply (clarsimp simp: exs_valid_def)\n apply blast\n apply (subst whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def' return_def)\n done\n }\n\n thus \"\\r' s'. (r', s') \\ fst (whileLoop C B r s) \\ Q r' s'\"\n by (metis \\P s\\ fst_conv init_T snd_conv final_I fst_whileLoop_cond_false)\nqed\n\nlemma empty_fail_whileLoop[empty_fail_cond, intro!, wp]:\n assumes body_empty_fail: \"\\r. empty_fail (B r)\"\n shows \"empty_fail (whileLoop C B r)\"\nproof -\n {\n fix s A\n assume empty: \"fst (whileLoop C B r s) = {}\"\n\n have cond_true: \"\\x s. fst (whileLoop C B x s) = {} \\ C x s\"\n apply (subst (asm) whileLoop_unroll)\n apply (clarsimp simp: condition_def return_def split: if_split_asm)\n done\n\n have \"snd (whileLoop C B r s)\"\n apply (rule snd_whileLoop [where I=\"\\x s. fst (whileLoop C B x s) = {}\"])\n apply fact\n apply (rule cond_true, fact)\n apply (clarsimp simp: exs_valid_def)\n apply (case_tac \"fst (B r s) = {}\")\n apply (metis empty_failD [OF body_empty_fail])\n apply (subst (asm) whileLoop_unroll)\n apply (fastforce simp: condition_def bind_def split_def cond_true)\n done\n }\n\n thus ?thesis\n by (clarsimp simp: empty_fail_def)\nqed\n\nlemma empty_fail_whileLoopE[empty_fail_cond, intro!, wp]:\n assumes \"\\r. empty_fail (B r)\"\n shows \"empty_fail (whileLoopE C B r)\"\n by (clarsimp simp: whileLoopE_def assms)\n\nlemma empty_fail_whileM[empty_fail_cond, intro!, wp]:\n \"\\ empty_fail C; empty_fail B \\ \\ empty_fail (whileM C B)\"\n unfolding whileM_def\n by (wpsimp wp: empty_fail_whileLoop empty_fail_bind)\n\nlemma whileLoop_results_bisim:\n assumes base: \"(a, b) \\ whileLoop_results C B\"\n and vars1: \"Q = (case a of Some (r, s) \\ Some (rt r, st s) | _ \\ None)\"\n and vars2: \"R = (case b of Some (r, s) \\ Some (rt r, st s) | _ \\ None)\"\n and inv_init: \"case a of Some (r, s) \\ I r s | _ \\ True\"\n and inv_step: \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ I r' s'\"\n and cond_match: \"\\r s. I r s \\ C r s = C' (rt r) (st s)\"\n and fail_step: \"\\r s. \\C r s; snd (B r s); I r s\\\n \\ (Some (rt r, st s), None) \\ whileLoop_results C' B'\"\n and refine: \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\\n \\ (rt r', st s') \\ fst (B' (rt r) (st s))\"\n shows \"(Q, R) \\ whileLoop_results C' B'\"\n apply (subst vars1)\n apply (subst vars2)\n apply (insert base inv_init)\n apply (induct rule: whileLoop_results.induct)\n apply clarsimp\n apply (subst (asm) cond_match)\n apply (clarsimp simp: option.splits)\n apply (clarsimp simp: option.splits)\n apply (clarsimp simp: option.splits)\n apply (metis fail_step)\n apply (case_tac z)\n apply (clarsimp simp: option.splits)\n apply (metis cond_match inv_step refine whileLoop_results.intros(3))\n apply (clarsimp simp: option.splits)\n apply (metis cond_match inv_step refine whileLoop_results.intros(3))\n done\n\nlemma whileLoop_terminates_liftE:\n \"whileLoop_terminatesE C (\\r. liftE (B r)) r s = whileLoop_terminates C B r s\"\n apply (subst eq_sym_conv)\n apply (clarsimp simp: whileLoop_terminatesE_def)\n apply (rule iffI)\n apply (erule whileLoop_terminates.induct)\n apply (rule whileLoop_terminates.intros)\n apply clarsimp\n apply (clarsimp simp: split_def)\n apply (rule whileLoop_terminates.intros(2))\n apply clarsimp\n apply (clarsimp simp: liftE_def in_bind return_def lift_def[abs_def]\n bind_def lift_def throwError_def o_def\n split: sum.splits\n cong: sum.case_cong)\n apply (drule (1) bspec)\n apply clarsimp\n apply (subgoal_tac\n \"case Inr r of\n Inl _ \\ True\n | Inr r \\ whileLoop_terminates\n (\\r s. (\\r s. case r of Inl _ \\ False | Inr v \\ C v s) (Inr r) s)\n (\\r. lift (\\r. liftE (B r)) (Inr r) >>= (\\x. return (projr x))) r s\")\n apply (clarsimp simp: liftE_def lift_def)\n apply (erule whileLoop_terminates.induct)\n apply (clarsimp simp: liftE_def lift_def split: sum.splits)\n apply (erule whileLoop_terminates.intros)\n apply (clarsimp simp: liftE_def split: sum.splits)\n apply (clarsimp simp: bind_def return_def split_def lift_def)\n apply (erule whileLoop_terminates.intros)\n apply force\n done\n\nlemma snd_X_return[simp]:\n \"snd ((A >>= (\\a. return (X a))) s) = snd (A s)\"\n by (clarsimp simp: return_def bind_def split_def)\n\nlemma whileLoopE_liftE:\n \"whileLoopE C (\\r. liftE (B r)) r = liftE (whileLoop C B r)\"\n apply (rule ext)\n apply (clarsimp simp: whileLoopE_def)\n apply (rule prod_eqI)\n apply (rule set_eqI, rule iffI)\n apply clarsimp\n apply (clarsimp simp: in_bind whileLoop_def liftE_def)\n apply (rule_tac x=\"b\" in exI)\n apply (rule_tac x=\"projr a\" in exI)\n apply (rule conjI)\n apply (erule whileLoop_results_bisim[where rt=projr\n and st=\"\\x. x\"\n and I=\"\\r s. case r of Inr x \\ True | _ \\ False\"],\n auto intro: whileLoop_results.intros simp: bind_def return_def lift_def split: sum.splits)[1]\n apply (drule whileLoop_results_induct_lemma2[where P=\"\\(r, s). case r of Inr x \\ True | _ \\ False\"])\n apply (rule refl)\n apply (rule refl)\n apply clarsimp\n apply (clarsimp simp: return_def bind_def lift_def split: sum.splits)\n apply (clarsimp simp: return_def bind_def lift_def split: sum.splits)\n apply (clarsimp simp: in_bind whileLoop_def liftE_def)\n apply (erule whileLoop_results_bisim[where rt=Inr and st=\"\\x. x\" and I=\"\\r s. True\"],\n auto intro: whileLoop_results.intros intro!: bexI simp: bind_def return_def lift_def\n split: sum.splits)[1]\n apply (rule iffI)\n apply (clarsimp simp: whileLoop_def liftE_def del: notI)\n apply (erule disjE)\n apply (erule whileLoop_results_bisim[where rt=projr\n and st=\"\\x. x\"\n and I=\"\\r s. case r of Inr x \\ True | _ \\ False\"],\n auto intro: whileLoop_results.intros simp: bind_def return_def lift_def split: sum.splits)[1]\n apply (subst (asm) whileLoop_terminates_liftE [symmetric])\n apply (fastforce simp: whileLoop_def liftE_def whileLoop_terminatesE_def)\n apply (clarsimp simp: whileLoop_def liftE_def del: notI)\n apply (subst (asm) whileLoop_terminates_liftE [symmetric])\n apply (clarsimp simp: whileLoop_def liftE_def whileLoop_terminatesE_def)\n apply (erule disjE)\n apply (erule whileLoop_results_bisim [where rt=Inr and st=\"\\x. x\" and I=\"\\r s. True\"])\n apply (clarsimp split: option.splits)\n apply (clarsimp split: option.splits)\n apply (clarsimp split: option.splits)\n apply (auto intro: whileLoop_results.intros intro!: bexI simp: bind_def return_def lift_def\n split: sum.splits)\n done\n\nlemma validNF_whileLoop:\n assumes pre: \"\\s. P r s \\ I r s\"\n and inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\!\"\n and wf: \"wf R\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\P r\\ whileLoop C B r \\Q\\!\"\n apply rule\n apply (rule valid_whileLoop)\n apply fact\n apply (insert inv, clarsimp simp: validNF_def valid_def split: prod.splits, force)[1]\n apply (metis post_cond)\n apply (unfold no_fail_def)\n apply (intro allI impI)\n apply (rule not_snd_whileLoop [where I=I and R=R])\n apply (auto intro: assms)\n done\n\nlemma validNF_whileLoop_inv [wp]:\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\!\"\n and wf: \"wf R\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoop_inv C B r I R \\Q\\!\"\n apply (clarsimp simp: whileLoop_inv_def)\n apply (rule validNF_whileLoop [where I=I and R=R])\n apply simp\n apply (rule inv)\n apply (rule wf)\n apply (metis post_cond)\n done\n\nlemma validNF_whileLoop_inv_measure [wp]:\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ M r' s' < M r s \\!\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoop_inv C B r I (measure' (\\(r, s). M r s)) \\Q\\!\"\n apply (clarsimp simp: whileLoop_inv_def)\n apply (rule validNF_whileLoop[where R=\"measure' (\\(r, s). M r s)\" and I=I])\n apply simp\n apply clarsimp\n apply (rule inv)\n apply simp\n apply (metis post_cond)\n done\n\nlemma validNF_whileLoop_inv_measure_twosteps:\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ B r \\ \\r' s'. I r' s' \\!\"\n assumes measure: \"\\r m. \\\\s. I r s \\ C r s \\ M r s = m \\ B r \\ \\r' s'. M r' s' < m \\\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoop_inv C B r I (measure' (\\(r, s). M r s)) \\Q\\!\"\n apply (rule validNF_whileLoop_inv_measure)\n apply (rule validNF_weaken_pre)\n apply (rule validNF_post_comb_conj_L)\n apply (rule inv)\n apply (rule measure)\n apply fast\n apply (metis post_cond)\n done\n\nlemma wf_custom_measure:\n \"\\ \\a b. (a, b) \\ R \\ f a < (f :: 'a \\ nat) b \\ \\ wf R\"\n by (metis in_measure wf_def wf_measure)\n\nlemma validNF_whileLoopE:\n assumes pre: \"\\s. P r s \\ I r s\"\n and inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\,\\ E \\!\"\n and wf: \"wf R\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\ P r \\ whileLoopE C B r \\ Q \\,\\ E \\!\"\n apply (unfold validE_NF_alt_def whileLoopE_def)\n apply (rule validNF_whileLoop [where\n I=\"\\r s. case r of Inl x \\ E x s | Inr x \\ I x s\" and\n R=\"{((r', s'), (r, s)). \\x x'. r' = Inl x' \\ r = Inr x} \\\n {((r', s'), (r, s)). \\x x'. r' = Inr x' \\ r = Inr x \\ ((x', s'),(x, s)) \\ R}\"])\n apply (simp add: pre)\n apply (insert inv)[1]\n apply (fastforce simp: lift_def validNF_def valid_def validE_NF_def throwError_def no_fail_def\n return_def validE_def\n split: sum.splits prod.splits)\n apply (rule wf_Un)\n apply (rule wf_custom_measure [where f=\"\\(r, s). case r of Inl _ \\ 0 | _ \\ 1\"])\n apply clarsimp\n apply (insert wf_inv_image [OF wf, where f=\"\\(r, s). (projr r, s)\"])\n apply (drule wf_Int1 [where r'=\"{((r', s'),(r, s)). (\\x. r = Inr x) \\ (\\x. r' = Inr x)}\"])\n apply (erule wf_subset)\n apply (fastforce simp: inv_image_def split: prod.splits sum.splits)\n apply fastforce\n apply (fastforce split: sum.splits intro: post_cond)\n done\n\nlemma validNF_whileLoopE_inv [wp]:\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ ((r', s'), (r, s)) \\ R \\,\\ E \\!\"\n and wf_R: \"wf R\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoopE_inv C B r I R \\Q\\,\\E\\!\"\n apply (clarsimp simp: whileLoopE_inv_def)\n apply (metis validNF_whileLoopE [OF _ inv] post_cond wf_R)\n done\n\nlemma validNF_whileLoopE_inv_measure [wp]:\n assumes inv: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s \\ B r \\ \\r' s'. I r' s' \\ M r' s' < M r s \\, \\ E \\!\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoopE_inv C B r I (measure' (\\(r, s). M r s)) \\Q\\,\\E\\!\"\n apply (rule validNF_whileLoopE_inv)\n apply clarsimp\n apply (rule inv)\n apply clarsimp\n apply (metis post_cond)\n done\n\nlemma validNF_whileLoopE_inv_measure_twosteps:\n assumes inv: \"\\r. \\\\s'. I r s' \\ C r s' \\ B r \\ \\r' s'. I r' s' \\, \\ E \\!\"\n assumes measure: \"\\r m. \\\\s. I r s \\ C r s \\ M r s = m \\ B r \\ \\r' s'. M r' s' < m \\, \\ \\_ _. True \\\"\n and post_cond: \"\\r s. \\I r s; \\ C r s\\ \\ Q r s\"\n shows \"\\I r\\ whileLoopE_inv C B r I (measure' (\\(r, s). M r s)) \\Q\\, \\E\\!\"\n apply (rule validNF_whileLoopE_inv_measure)\n apply (rule validE_NF_weaken_pre)\n apply (rule validE_NF_post_comb_conj_L)\n apply (rule inv)\n apply (rule measure)\n apply fast\n apply (metis post_cond)\n done\n\nlemma whileLoopE_wp_inv [wp]:\n \"\\ \\r. \\\\s. I r s \\ C r s\\ B r \\I\\,\\E\\; \\r s. \\I r s; \\ C r s\\ \\ Q r s \\\n \\ \\ I r \\ whileLoopE_inv C B r I M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: whileLoopE_inv_def)\n apply (rule validE_whileLoopE [where I=I], auto)\n done\n\nsubsection \"Stronger whileLoop rules\"\n\nlemma whileLoop_rule_strong:\n assumes init_U: \"\\ \\s'. s' = s \\ whileLoop C B r \\ \\r s. (r, s) \\ fst Q \\\"\n and path_exists: \"\\r'' s''. \\ (r'', s'') \\ fst Q \\ \\ \\ \\s'. s' = s \\ whileLoop C B r \\\\ \\r s. r = r'' \\ s = s'' \\\"\n and loop_fail: \"snd Q \\ snd (whileLoop C B r s)\"\n and loop_nofail: \"\\ snd Q \\ \\ \\s'. s' = s \\ whileLoop C B r \\ \\_ _. True \\!\"\n shows \"whileLoop C B r s = Q\"\n using assms\n apply atomize\n apply (clarsimp simp: valid_def exs_valid_def validNF_def no_fail_def)\n apply rule\n apply blast\n apply blast\n apply blast\n done\n\nlemma whileLoop_rule_strong_no_fail:\n assumes init_U: \"\\ \\s'. s' = s \\ whileLoop C B r \\ \\r s. (r, s) \\ fst Q \\!\"\n and path_exists: \"\\r'' s''. \\ (r'', s'') \\ fst Q \\ \\ \\ \\s'. s' = s \\ whileLoop C B r \\\\ \\r s. r = r'' \\ s = s'' \\\"\n and loop_no_fail: \"\\ snd Q\"\n shows \"whileLoop C B r s = Q\"\n apply (rule whileLoop_rule_strong)\n apply (metis init_U validNF_valid)\n apply (metis path_exists)\n apply (metis loop_no_fail)\n apply (metis (lifting, no_types) init_U validNF_chain)\n done\n\nsubsection \"Miscellaneous rules\"\n\n(* Failure of one whileLoop implies the failure of another whileloop\n * which will only ever fail more. *)\nlemma snd_whileLoop_subset:\n assumes a_fails: \"snd (whileLoop C A r s)\"\n and b_success_step:\n \"\\r s r' s'. \\ C r s; (r', s') \\ fst (A r s); \\ snd (B r s) \\\n \\ (r', s') \\ fst (B r s)\"\n and b_fail_step: \"\\r s. \\ C r s; snd (A r s) \\ \\ snd (B r s) \"\n shows \"snd (whileLoop C B r s)\"\n apply (insert a_fails)\n apply (induct rule: snd_whileLoop_induct)\n apply (unfold whileLoop_def snd_conv)[1]\n apply (rule disjCI, simp)\n apply rotate_tac\n apply (induct rule: whileLoop_terminates.induct)\n apply (subst (asm) whileLoop_terminates.simps)\n apply simp\n apply (subst (asm) (3) whileLoop_terminates.simps, clarsimp)\n apply (subst whileLoop_results.simps, clarsimp)\n apply (rule classical)\n apply (frule b_success_step, assumption, simp)\n apply (drule (1) bspec)\n apply clarsimp\n apply (frule (1) b_fail_step)\n apply (metis snd_whileLoop_first_step)\n apply (metis b_success_step snd_whileLoop_first_step snd_whileLoop_unfold)\n done\n\n\nsubsection \"Some rules for whileM\"\n\nlemma whileM_wp_gen:\n assumes termin:\"\\s. I False s \\ Q s\"\n assumes [wp]: \"\\I'\\ C \\I\\\"\n assumes [wp]: \"\\I True\\ f \\\\_. I'\\\"\n shows \"\\I'\\ whileM C f \\\\_. Q\\\"\n unfolding whileM_def\n using termin\n by (wpsimp wp: whileLoop_wp[where I=I])\n\nlemma whileM_inv:\n \"\\f \\Q\\; P \\Q\\\\ \\ whileM P f \\Q\\\"\n by (fastforce intro: whileM_wp_gen)\n\nlemmas whileM_post_inv\n = hoare_strengthen_post[where R=\"\\_. Q\" for Q, OF whileM_inv[where P=C for C], rotated -1]\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/WhileLoopRules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.29973145060754935}} {"text": "header {* \\isaheader{Slicing guarantees IFC Noninterference} *}\n\ntheory NonInterferenceIntra imports \n \"../Slicing/StaticIntra/Slice\" \n \"../Slicing/Basic/CFGExit_wf\"\nbegin\n\nsection {* Assumptions of this Approach *}\n\ntext {*\nClassical IFC noninterference, a special case of a noninterference\ndefinition using partial equivalence relations (per)\n\\cite{SabelfeldS:01}, partitions the variables (i.e.\\ locations) into\nsecurity levels. Usually, only levels for secret or high, written\n@{text H}, and public or low, written @{text L}, variables are\nused. Basically, a program that is noninterferent has to fulfil one\nbasic property: executing the program in two different initial states\nthat may differ in the values of their @{text H}-variables yields two\nfinal states that again only differ in the values of their \n@{text H}-variables; thus the values of the @{text H}-variables did not\ninfluence those of the @{text L}-variables.\n\nEvery per-based approach makes certain\nassumptions: (i) all \\mbox{@{text H}-variables} are defined at the\nbeginning of the program, (ii) all @{text L}-variables are observed (or\nused in our terms) at the end and (iii) every variable is either\n@{text H} or @{text L}. This security label is fixed for a variable\nand can not be altered during a program run. Thus, we have to extend \nthe prerequisites of the slicing framework in \\cite{Wasserrab:08} accordingly\nin a new locale:\n\n*}\n\nlocale NonInterferenceIntraGraph = \n BackwardSlice sourcenode targetnode kind valid_edge Entry Def Use state_val \n backward_slice +\n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and backward_slice :: \"'node set \\ 'node set\" \n and Exit :: \"'node\" (\"'('_Exit'_')\") +\n fixes H :: \"'var set\"\n fixes L :: \"'var set\"\n fixes High :: \"'node\" (\"'('_High'_')\")\n fixes Low :: \"'node\" (\"'('_Low'_')\")\n assumes Entry_edge_Exit_or_High:\n \"\\valid_edge a; sourcenode a = (_Entry_)\\ \n \\ targetnode a = (_Exit_) \\ targetnode a = (_High_)\"\n and High_target_Entry_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Entry_) \\ targetnode a = (_High_) \\\n kind a = (\\s. True)\\<^sub>\\\"\n and Entry_predecessor_of_High:\n \"\\valid_edge a; targetnode a = (_High_)\\ \\ sourcenode a = (_Entry_)\"\n and Exit_edge_Entry_or_Low: \"\\valid_edge a; targetnode a = (_Exit_)\\ \n \\ sourcenode a = (_Entry_) \\ sourcenode a = (_Low_)\"\n and Low_source_Exit_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Low_) \\ targetnode a = (_Exit_) \\ \n kind a = (\\s. True)\\<^sub>\\\"\n and Exit_successor_of_Low:\n \"\\valid_edge a; sourcenode a = (_Low_)\\ \\ targetnode a = (_Exit_)\"\n and DefHigh: \"Def (_High_) = H\" \n and UseHigh: \"Use (_High_) = H\"\n and UseLow: \"Use (_Low_) = L\"\n and HighLowDistinct: \"H \\ L = {}\"\n and HighLowUNIV: \"H \\ L = UNIV\"\n\nbegin\n\nlemma Low_neq_Exit: assumes \"L \\ {}\" shows \"(_Low_) \\ (_Exit_)\"\nproof\n assume \"(_Low_) = (_Exit_)\"\n have \"Use (_Exit_) = {}\" by fastforce\n with UseLow `L \\ {}` `(_Low_) = (_Exit_)` show False by simp\nqed\n\nlemma Entry_path_High_path:\n assumes \"(_Entry_) -as\\* n\" and \"inner_node n\"\n obtains a' as' where \"as = a'#as'\" and \"(_High_) -as'\\* n\" \n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from `(_Entry_) -as\\* n` `inner_node n`\n show \"\\a' as'. as = a'#as' \\ (_High_) -as'\\* n \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct n'\\\"(_Entry_)\" as n rule:path.induct)\n case (Cons_path n'' as n' a)\n from `n'' -as\\* n'` `inner_node n'` have \"n'' \\ (_Exit_)\" \n by(fastforce simp:inner_node_def)\n with `valid_edge a` `targetnode a = n''` `sourcenode a = (_Entry_)`\n have \"n'' = (_High_)\" by -(drule Entry_edge_Exit_or_High,auto)\n from High_target_Entry_edge\n obtain a' where \"valid_edge a'\" and \"sourcenode a' = (_Entry_)\"\n and \"targetnode a' = (_High_)\" and \"kind a' = (\\s. True)\\<^sub>\\\"\n by blast\n with `valid_edge a` `sourcenode a = (_Entry_)` `targetnode a = n''`\n `n'' = (_High_)`\n have \"a = a'\" by(auto dest:edge_det)\n with `n'' -as\\* n'` `n'' = (_High_)` `kind a' = (\\s. True)\\<^sub>\\` show ?case by blast\n qed fastforce\nqed\n\n\n\nlemma Exit_path_Low_path:\n assumes \"n -as\\* (_Exit_)\" and \"inner_node n\"\n obtains a' as' where \"as = as'@[a']\" and \"n -as'\\* (_Low_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from `n -as\\* (_Exit_)`\n show \"\\as' a'. as = as'@[a'] \\ n -as'\\* (_Low_) \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct as rule:rev_induct)\n case Nil\n with `inner_node n` show ?case by fastforce\n next\n case (snoc a' as')\n from `n -as'@[a']\\* (_Exit_)`\n have \"n -as'\\* sourcenode a'\" and \"valid_edge a'\" and \"targetnode a' = (_Exit_)\"\n by(auto elim:path_split_snoc)\n { assume \"sourcenode a' = (_Entry_)\"\n with `n -as'\\* sourcenode a'` have \"n = (_Entry_)\"\n by(blast intro!:path_Entry_target)\n with `inner_node n` have False by(simp add:inner_node_def) }\n with `valid_edge a'` `targetnode a' = (_Exit_)` have \"sourcenode a' = (_Low_)\"\n by(blast dest!:Exit_edge_Entry_or_Low)\n from Low_source_Exit_edge\n obtain ax where \"valid_edge ax\" and \"sourcenode ax = (_Low_)\"\n and \"targetnode ax = (_Exit_)\" and \"kind ax = (\\s. True)\\<^sub>\\\"\n by blast\n with `valid_edge a'` `targetnode a' = (_Exit_)` `sourcenode a' = (_Low_)`\n have \"a' = ax\" by(fastforce intro:edge_det)\n with `n -as'\\* sourcenode a'` `sourcenode a' = (_Low_)` `kind ax = (\\s. True)\\<^sub>\\`\n show ?case by blast\n qed\nqed\n\n\nlemma not_Low_High: \"V \\ L \\ V \\ H\"\n using HighLowUNIV\n by fastforce\n\nlemma not_High_Low: \"V \\ H \\ V \\ L\"\n using HighLowUNIV\n by fastforce\n\n\nsection {* Low Equivalence *}\n\ntext {*\nIn classical noninterference, an external observer can only see public values,\nin our case the @{text L}-variables. If two states agree in the values of all \n@{text L}-variables, these states are indistinguishable for him. \n\\emph{Low equivalence} groups those states in an equivalence class using \nthe relation @{text \"\\\\<^sub>L\"}:\n*}\n\ndefinition lowEquivalence :: \"'state \\ 'state \\ bool\" (infixl \"\\\\<^sub>L\" 50)\n where \"s \\\\<^sub>L s' \\ \\V \\ L. state_val s V = state_val s' V\"\n\ntext {* The following lemmas connect low equivalent states with\nrelevant variables as necessary in the correctness proof for slicing. *}\n\nlemma relevant_vars_Entry:\n assumes \"V \\ rv S (_Entry_)\" and \"(_High_) \\ backward_slice S\"\n shows \"V \\ L\"\nproof -\n from `V \\ rv S (_Entry_)` obtain as n' where \"(_Entry_) -as\\* n'\"\n and \"n' \\ backward_slice S\" and \"V \\ Use n'\"\n and \"\\nx \\ set(sourcenodes as). V \\ Def nx\" by(erule rvE)\n from `(_Entry_) -as\\* n'` have \"valid_node n'\" by(rule path_valid_node)\n thus ?thesis\n proof(cases n' rule:valid_node_cases)\n case Entry\n with `V \\ Use n'` have False by(simp add:Entry_empty)\n thus ?thesis by simp\n next\n case Exit\n with `V \\ Use n'` have False by(simp add:Exit_empty)\n thus ?thesis by simp\n next\n case inner\n with `(_Entry_) -as\\* n'` obtain a' as' where \"as = a'#as'\"\n and \"(_High_) -as'\\* n'\" by -(erule Entry_path_High_path)\n from `(_Entry_) -as\\* n'` `as = a'#as'`\n have \"sourcenode a' = (_Entry_)\" by(fastforce elim:path.cases)\n show ?thesis\n proof(cases \"as' = []\")\n case True\n with `(_High_) -as'\\* n'` have \"n' = (_High_)\" by fastforce\n with `n' \\ backward_slice S` `(_High_) \\ backward_slice S`\n have False by simp\n thus ?thesis by simp\n next\n case False\n with `(_High_) -as'\\* n'` have \"hd (sourcenodes as') = (_High_)\"\n by(rule path_sourcenode)\n from False have \"hd (sourcenodes as') \\ set (sourcenodes as')\"\n by(fastforce intro:hd_in_set simp:sourcenodes_def)\n with `as = a'#as'` have \"hd (sourcenodes as') \\ set (sourcenodes as)\"\n by(simp add:sourcenodes_def)\n with `hd (sourcenodes as') = (_High_)` `\\nx \\ set(sourcenodes as). V \\ Def nx`\n have \"V \\ Def (_High_)\" by fastforce\n hence \"V \\ H\" by(simp add:DefHigh)\n thus ?thesis by(rule not_High_Low)\n qed\n qed\nqed\n\n\n\nlemma lowEquivalence_relevant_nodes_Entry:\n assumes \"s \\\\<^sub>L s'\" and \"(_High_) \\ backward_slice S\"\n shows \"\\V \\ rv S (_Entry_). state_val s V = state_val s' V\"\nproof\n fix V assume \"V \\ rv S (_Entry_)\"\n with `(_High_) \\ backward_slice S` have \"V \\ L\" by -(rule relevant_vars_Entry)\n with `s \\\\<^sub>L s'` show \"state_val s V = state_val s' V\" by(simp add:lowEquivalence_def)\nqed\n\n\n\nlemma rv_Low_Use_Low:\n assumes \"(_Low_) \\ S\"\n shows \"\\n -as\\* (_Low_); n -as'\\* (_Low_);\n \\V \\ rv S n. state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s'\\\n \\ \\V \\ Use (_Low_). state_val (transfers (slice_kinds S as) s) V =\n state_val (transfers (slice_kinds S as') s') V\"\nproof(induct n as n\\\"(_Low_)\" arbitrary:as' s s' rule:path.induct)\n case empty_path\n { fix V assume \"V \\ Use (_Low_)\"\n moreover\n from `valid_node (_Low_)` have \"(_Low_) -[]\\* (_Low_)\"\n by(fastforce intro:path.empty_path)\n moreover\n from `valid_node (_Low_)` `(_Low_) \\ S` have \"(_Low_) \\ backward_slice S\"\n by(fastforce intro:refl)\n ultimately have \"V \\ rv S (_Low_)\"\n by(fastforce intro:rvI simp:sourcenodes_def) }\n hence \"\\V \\ Use (_Low_). V \\ rv S (_Low_)\" by simp\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n from `(_Low_) -as'\\* (_Low_)` have \"as' = []\"\n proof(induct n\\\"(_Low_)\" as' n'\\\"(_Low_)\" rule:path.induct)\n case (Cons_path n'' as a)\n from `valid_edge a` `sourcenode a = (_Low_)`\n have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n with `targetnode a = n''` `n'' -as\\* (_Low_)`\n have \"(_Low_) = (_Exit_)\" by -(rule path_Exit_source,fastforce)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?case by simp\n qed simp\n with `\\V \\ Use (_Low_). V \\ rv S (_Low_)` \n `\\V\\rv S (_Low_). state_val s V = state_val s' V`\n show ?thesis by(auto simp:slice_kinds_def)\n qed\nnext\n case (Cons_path n'' as a n)\n note IH = `\\as' s s'. \\n'' -as'\\* (_Low_);\n \\V\\rv S n''. state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s'\\\n \\ \\V\\Use (_Low_). state_val (transfers (slice_kinds S as) s) V =\n state_val (transfers (slice_kinds S as') s') V`\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with `n -as'\\* (_Low_)` have \"n = (_Low_)\" by fastforce\n with `valid_edge a` `sourcenode a = n` have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain ax where \"valid_edge ax\"\n and \"sourcenode ax = (_Low_)\" and \"targetnode ax = (_Exit_)\"\n and \"kind ax = (\\s. True)\\<^sub>\\\" by blast\n from `valid_edge a` `sourcenode a = n` `n = (_Low_)` `targetnode a = (_Exit_)`\n `valid_edge ax` `sourcenode ax = (_Low_)` `targetnode ax = (_Exit_)`\n have \"a = ax\" by(fastforce dest:edge_det)\n with `kind ax = (\\s. True)\\<^sub>\\` have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with `targetnode a = (_Exit_)` `targetnode a = n''` `n'' -as\\* (_Low_)`\n have \"(_Low_) = (_Exit_)\" by -(rule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with `n -as'\\* (_Low_)` have \"n = sourcenode ax\" and \"valid_edge ax\" \n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n show ?thesis\n proof(cases \"targetnode ax = n''\")\n case True\n with `targetnode ax -asx\\* (_Low_)` have \"n'' -asx\\* (_Low_)\" by simp\n from `valid_edge ax` `valid_edge a` `n = sourcenode ax` `sourcenode a = n`\n True `targetnode a = n''` have \"ax = a\" by(fastforce intro:edge_det)\n from `preds (slice_kinds S (a#as)) s` \n have preds1:\"preds (slice_kinds S as) (transfer (slice_kind S a) s)\"\n by(simp add:slice_kinds_def)\n from `preds (slice_kinds S as') s'` Cons `ax = a`\n have preds2:\"preds (slice_kinds S asx) \n (transfer (slice_kind S a) s')\"\n by(simp add:slice_kinds_def)\n from `valid_edge a` `sourcenode a = n` `targetnode a = n''`\n `preds (slice_kinds S (a#as)) s` `preds (slice_kinds S as') s'`\n `ax = a` Cons `\\V\\rv S n. state_val s V = state_val s' V`\n have \"\\V\\rv S n''. state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\"\n by -(rule rv_edge_slice_kinds,auto)\n from IH[OF `n'' -asx\\* (_Low_)` this preds1 preds2] \n Cons `ax = a` show ?thesis by(simp add:slice_kinds_def)\n next\n case False\n with `valid_edge a` `valid_edge ax` `sourcenode a = n` `n = sourcenode ax`\n `targetnode a = n''` `preds (slice_kinds S (a#as)) s`\n `preds (slice_kinds S as') s'` Cons\n `\\V\\rv S n. state_val s V = state_val s' V`\n have False by -(rule rv_branching_edges_slice_kinds_False,auto)\n thus ?thesis by simp\n qed\n qed\n qed\nqed\n\n\nsection {* The Correctness Proofs *}\n\ntext {*\nIn the following, we present two correctness proofs that slicing guarantees\nIFC noninterference. In both theorems, \n@{text \"(_High_) \\ backward_slice S\"}, where @{text \"(_Low_) \\ S\"},\nmakes sure that no high variable (which are all defined in @{text \"(_High_)\"}) \ncan influence a low variable (which are all used in @{text \"(_Low_)\"}).\n\nFirst, a theorem regarding \n@{text \"(_Entry_) -as\\* (_Exit_)\"} paths in the control flow graph (CFG),\nwhich agree to a complete program execution: *}\n\nlemma nonInterference_path_to_Low:\n assumes \"s \\\\<^sub>L s'\" and \"(_High_) \\ backward_slice S\" and \"(_Low_) \\ S\"\n and \"(_Entry_) -as\\* (_Low_)\" and \"preds (kinds as) s\"\n and \"(_Entry_) -as'\\* (_Low_)\" and \"preds (kinds as') s'\"\n shows \"transfers (kinds as) s \\\\<^sub>L transfers (kinds as') s'\"\nproof -\n from `(_Entry_) -as\\* (_Low_)` `preds (kinds as) s` `(_Low_) \\ S`\n obtain asx where \"preds (slice_kinds S asx) s\"\n and \"\\V \\ Use (_Low_). state_val(transfers (slice_kinds S asx) s) V = \n state_val(transfers (kinds as) s) V\"\n and \"slice_edges S as = slice_edges S asx\"\n and \"(_Entry_) -asx\\* (_Low_)\" by(erule fundamental_property_of_static_slicing)\n from `(_Entry_) -as'\\* (_Low_)` `preds (kinds as') s'` `(_Low_) \\ S`\n obtain asx' where \"preds (slice_kinds S asx') s'\"\n and \"\\V \\ Use (_Low_). state_val (transfers (slice_kinds S asx') s') V = \n state_val (transfers (kinds as') s') V\"\n and \"slice_edges S as' = slice_edges S asx'\"\n and \"(_Entry_) -asx'\\* (_Low_)\" by(erule fundamental_property_of_static_slicing)\n from `s \\\\<^sub>L s'` `(_High_) \\ backward_slice S`\n have \"\\V \\ rv S (_Entry_). state_val s V = state_val s' V\" \n by(rule lowEquivalence_relevant_nodes_Entry)\n with `(_Entry_) -asx\\* (_Low_)` `(_Entry_) -asx'\\* (_Low_)` `(_Low_) \\ S`\n `preds (slice_kinds S asx) s` `preds (slice_kinds S asx') s'`\n have \"\\V \\ Use (_Low_). state_val (transfers (slice_kinds S asx) s) V =\n state_val (transfers (slice_kinds S asx') s') V\"\n by -(rule rv_Low_Use_Low,auto)\n with `\\V \\ Use (_Low_). state_val(transfers (slice_kinds S asx) s) V = \n state_val(transfers (kinds as) s) V`\n `\\V \\ Use (_Low_). state_val (transfers (slice_kinds S asx') s') V = \n state_val (transfers (kinds as') s') V`\n show ?thesis by(auto simp:lowEquivalence_def UseLow)\nqed\n\n\ntheorem nonInterference_path:\n assumes \"s \\\\<^sub>L s'\" and \"(_High_) \\ backward_slice S\" and \"(_Low_) \\ S\"\n and \"(_Entry_) -as\\* (_Exit_)\" and \"preds (kinds as) s\"\n and \"(_Entry_) -as'\\* (_Exit_)\" and \"preds (kinds as') s'\"\n shows \"transfers (kinds as) s \\\\<^sub>L transfers (kinds as') s'\"\nproof -\n from `(_Entry_) -as\\* (_Exit_)` obtain x xs where \"as = x#xs\"\n and \"(_Entry_) = sourcenode x\" and \"valid_edge x\" \n and \"targetnode x -xs\\* (_Exit_)\"\n apply(cases \"as = []\")\n apply(simp,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(erule path_split_Cons)\n from `valid_edge x` have \"valid_node (targetnode x)\" by simp\n hence \"inner_node (targetnode x)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with `valid_edge x` have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with `targetnode x -xs\\* (_Exit_)` have \"xs = []\"\n by -(rule path_Exit_source,simp)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from `valid_edge x` `valid_edge z` `(_Entry_) = sourcenode x` \n `sourcenode z = (_Entry_)` Exit `targetnode z = (_Exit_)`\n have \"x = z\" by(fastforce intro:edge_det)\n with `preds (kinds as) s` `as = x#xs` `xs = []` `kind z = (\\s. False)\\<^sub>\\` \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with `targetnode x -xs\\* (_Exit_)` obtain x' xs' where \"xs = xs'@[x']\"\n and \"targetnode x -xs'\\* (_Low_)\" and \"kind x' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with `(_Entry_) = sourcenode x` `valid_edge x`\n have \"(_Entry_) -x#xs'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from `as = x#xs` `xs = xs'@[x']` have \"as = (x#xs')@[x']\" by simp\n with `preds (kinds as) s` have \"preds (kinds (x#xs')) s\"\n by(simp add:kinds_def preds_split)\n from `(_Entry_) -as'\\* (_Exit_)` obtain y ys where \"as' = y#ys\"\n and \"(_Entry_) = sourcenode y\" and \"valid_edge y\" \n and \"targetnode y -ys\\* (_Exit_)\"\n apply(cases \"as' = []\")\n apply(simp,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(erule path_split_Cons)\n from `valid_edge y` have \"valid_node (targetnode y)\" by simp\n hence \"inner_node (targetnode y)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with `valid_edge y` have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with `targetnode y -ys\\* (_Exit_)` have \"ys = []\"\n by -(rule path_Exit_source,simp)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from `valid_edge y` `valid_edge z` `(_Entry_) = sourcenode y` \n `sourcenode z = (_Entry_)` Exit `targetnode z = (_Exit_)`\n have \"y = z\" by(fastforce intro:edge_det)\n with `preds (kinds as') s'` `as' = y#ys` `ys = []` `kind z = (\\s. False)\\<^sub>\\` \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with `targetnode y -ys\\* (_Exit_)` obtain y' ys' where \"ys = ys'@[y']\"\n and \"targetnode y -ys'\\* (_Low_)\" and \"kind y' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with `(_Entry_) = sourcenode y` `valid_edge y`\n have \"(_Entry_) -y#ys'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from `as' = y#ys` `ys = ys'@[y']` have \"as' = (y#ys')@[y']\" by simp\n with `preds (kinds as') s'` have \"preds (kinds (y#ys')) s'\"\n by(simp add:kinds_def preds_split)\n from `s \\\\<^sub>L s'` `(_High_) \\ backward_slice S` `(_Low_) \\ S`\n `(_Entry_) -x#xs'\\* (_Low_)` `preds (kinds (x#xs')) s`\n `(_Entry_) -y#ys'\\* (_Low_)` `preds (kinds (y#ys')) s'`\n have \"transfers (kinds (x#xs')) s \\\\<^sub>L transfers (kinds (y#ys')) s'\"\n by(rule nonInterference_path_to_Low)\n with `as = x#xs` `xs = xs'@[x']` `kind x' = (\\s. True)\\<^sub>\\`\n `as' = y#ys` `ys = ys'@[y']` `kind y' = (\\s. True)\\<^sub>\\`\n show ?thesis by(simp add:kinds_def transfers_split)\nqed\n\n\nend\n\ntext {* The second theorem assumes that we have a operational semantics,\nwhose evaluations are written @{text \"\\c,s\\ \\ \\c',s'\\\"} and which conforms \nto the CFG. The correctness theorem then states that if no high variable\ninfluenced a low variable and the initial states were low equivalent, the\nreulting states are again low equivalent: *}\n\n\nlocale NonInterferenceIntra = \n NonInterferenceIntraGraph sourcenode targetnode kind valid_edge Entry \n Def Use state_val backward_slice Exit H L High Low +\n BackwardSlice_wf sourcenode targetnode kind valid_edge Entry Def Use state_val \n backward_slice sem identifies\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and backward_slice :: \"'node set \\ 'node set\"\n and sem :: \"'com \\ 'state \\ 'com \\ 'state \\ bool\" \n (\"((1\\_,/_\\) \\/ (1\\_,/_\\))\" [0,0,0,0] 81)\n and identifies :: \"'node \\ 'com \\ bool\" (\"_ \\ _\" [51, 0] 80)\n and Exit :: \"'node\" (\"'('_Exit'_')\")\n and H :: \"'var set\" and L :: \"'var set\" \n and High :: \"'node\" (\"'('_High'_')\") and Low :: \"'node\" (\"'('_Low'_')\") +\n fixes final :: \"'com \\ bool\"\n assumes final_edge_Low: \"\\final c; n \\ c\\ \n \\ \\a. valid_edge a \\ sourcenode a = n \\ targetnode a = (_Low_) \\ kind a = \\id\"\nbegin\n\ntext{* The following theorem needs the explicit edge from @{text \"(_High_)\"}\n to @{text n}. An approach using a @{text \"init\"} predicate for initial statements,\n being reachable from @{text \"(_High_)\"} via a @{text \"(\\s. True)\\<^sub>\\\"} edge,\n does not work as the same statement could be identified by several nodes, some\n initial, some not. E.g., in the program \\texttt{while (True) Skip;;Skip}\n two nodes identify this inital statement: the initial node and the node\n within the loop (because of loop unrolling).*}\n\ntheorem nonInterference:\n assumes \"s\\<^sub>1 \\\\<^sub>L s\\<^sub>2\" and \"(_High_) \\ backward_slice S\" and \"(_Low_) \\ S\"\n and \"valid_edge a\" and \"sourcenode a = (_High_)\" and \"targetnode a = n\" \n and \"kind a = (\\s. True)\\<^sub>\\\" and \"n \\ c\" and \"final c'\"\n and \"\\c,s\\<^sub>1\\ \\ \\c',s\\<^sub>1'\\\" and \"\\c,s\\<^sub>2\\ \\ \\c',s\\<^sub>2'\\\"\n shows \"s\\<^sub>1' \\\\<^sub>L s\\<^sub>2'\"\nproof -\n from High_target_Entry_edge obtain ax where \"valid_edge ax\"\n and \"sourcenode ax = (_Entry_)\" and \"targetnode ax = (_High_)\"\n and \"kind ax = (\\s. True)\\<^sub>\\\" by blast\n from `n \\ c` `\\c,s\\<^sub>1\\ \\ \\c',s\\<^sub>1'\\`\n obtain n\\<^sub>1 as\\<^sub>1 where \"n -as\\<^sub>1\\* n\\<^sub>1\" and \"transfers (kinds as\\<^sub>1) s\\<^sub>1 = s\\<^sub>1'\"\n and \"preds (kinds as\\<^sub>1) s\\<^sub>1\" and \"n\\<^sub>1 \\ c'\"\n by(fastforce dest:fundamental_property)\n from `n -as\\<^sub>1\\* n\\<^sub>1` `valid_edge a` `sourcenode a = (_High_)` `targetnode a = n`\n have \"(_High_) -a#as\\<^sub>1\\* n\\<^sub>1\" by(rule Cons_path)\n from `final c'` `n\\<^sub>1 \\ c'`\n obtain a\\<^sub>1 where \"valid_edge a\\<^sub>1\" and \"sourcenode a\\<^sub>1 = n\\<^sub>1\" \n and \"targetnode a\\<^sub>1 = (_Low_)\" and \"kind a\\<^sub>1 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>1 -[a\\<^sub>1]\\* (_Low_)\" by(fastforce intro:path_edge)\n with `(_High_) -a#as\\<^sub>1\\* n\\<^sub>1` have \"(_High_) -(a#as\\<^sub>1)@[a\\<^sub>1]\\* (_Low_)\"\n by(rule path_Append)\n with `valid_edge ax` `sourcenode ax = (_Entry_)` `targetnode ax = (_High_)`\n have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\* (_Low_)\" by -(rule Cons_path)\n from `kind ax = (\\s. True)\\<^sub>\\` `kind a = (\\s. True)\\<^sub>\\` `preds (kinds as\\<^sub>1) s\\<^sub>1`\n `kind a\\<^sub>1 = \\id` have \"preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) s\\<^sub>1\"\n by (simp add:kinds_def preds_split)\n from `n \\ c` `\\c,s\\<^sub>2\\ \\ \\c',s\\<^sub>2'\\`\n obtain n\\<^sub>2 as\\<^sub>2 where \"n -as\\<^sub>2\\* n\\<^sub>2\" and \"transfers (kinds as\\<^sub>2) s\\<^sub>2 = s\\<^sub>2'\"\n and \"preds (kinds as\\<^sub>2) s\\<^sub>2\" and \"n\\<^sub>2 \\ c'\"\n by(fastforce dest:fundamental_property)\n from `n -as\\<^sub>2\\* n\\<^sub>2` `valid_edge a` `sourcenode a = (_High_)` `targetnode a = n`\n have \"(_High_) -a#as\\<^sub>2\\* n\\<^sub>2\" by(rule Cons_path)\n from `final c'` `n\\<^sub>2 \\ c'`\n obtain a\\<^sub>2 where \"valid_edge a\\<^sub>2\" and \"sourcenode a\\<^sub>2 = n\\<^sub>2\" \n and \"targetnode a\\<^sub>2 = (_Low_)\" and \"kind a\\<^sub>2 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>2 -[a\\<^sub>2]\\* (_Low_)\" by(fastforce intro:path_edge)\n with `(_High_) -a#as\\<^sub>2\\* n\\<^sub>2` have \"(_High_) -(a#as\\<^sub>2)@[a\\<^sub>2]\\* (_Low_)\"\n by(rule path_Append)\n with `valid_edge ax` `sourcenode ax = (_Entry_)` `targetnode ax = (_High_)`\n have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\* (_Low_)\" by -(rule Cons_path)\n from `kind ax = (\\s. True)\\<^sub>\\` `kind a = (\\s. True)\\<^sub>\\` `preds (kinds as\\<^sub>2) s\\<^sub>2`\n `kind a\\<^sub>2 = \\id` have \"preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) s\\<^sub>2\"\n by (simp add:kinds_def preds_split)\n from `s\\<^sub>1 \\\\<^sub>L s\\<^sub>2` `(_High_) \\ backward_slice S` `(_Low_) \\ S`\n `(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\* (_Low_)` `preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) s\\<^sub>1`\n `(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\* (_Low_)` `preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) s\\<^sub>2`\n have \"transfers (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) s\\<^sub>1 \\\\<^sub>L \n transfers (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) s\\<^sub>2\"\n by(rule nonInterference_path_to_Low)\n with `kind ax = (\\s. True)\\<^sub>\\` `kind a = (\\s. True)\\<^sub>\\` `kind a\\<^sub>1 = \\id` `kind a\\<^sub>2 = \\id`\n `transfers (kinds as\\<^sub>1) s\\<^sub>1 = s\\<^sub>1'` `transfers (kinds as\\<^sub>2) s\\<^sub>2 = s\\<^sub>2'`\n show ?thesis by(simp add:kinds_def transfers_split)\nqed\n\n\nend\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/InformationFlowSlicing/NonInterferenceIntra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804478040617, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29972492545628154}} {"text": "(* Title: HOL/HOLCF/IOA/RefMappings.thy\n Author: Olaf Müller\n*)\n\nsection \\Refinement Mappings in HOLCF/IOA\\\n\ntheory RefMappings\nimports Traces\nbegin\n\ndefault_sort type\n\ndefinition move :: \"('a, 's) ioa \\ ('a, 's) pairs \\ 's \\ 'a \\ 's \\ bool\"\n where \"move ioa ex s a t \\\n is_exec_frag ioa (s, ex) \\ Finite ex \\\n laststate (s, ex) = t \\\n mk_trace ioa \\ ex = (if a \\ ext ioa then a \\ nil else nil)\"\n\ndefinition is_ref_map :: \"('s1 \\ 's2) \\ ('a, 's1) ioa \\ ('a, 's2) ioa \\ bool\"\n where \"is_ref_map f C A \\\n ((\\s \\ starts_of C. f s \\ starts_of A) \\\n (\\s t a. reachable C s \\ s \\a\\C\\ t \\ (\\ex. move A ex (f s) a (f t))))\"\n\ndefinition is_weak_ref_map :: \"('s1 \\ 's2) \\ ('a, 's1) ioa \\ ('a, 's2) ioa \\ bool\"\n where \"is_weak_ref_map f C A \\\n ((\\s \\ starts_of C. f s \\ starts_of A) \\\n (\\s t a. reachable C s \\ s \\a\\C\\ t \\\n (if a \\ ext C then (f s) \\a\\A\\ (f t) else f s = f t)))\"\n\n\nsubsection \\Transitions and moves\\\n\nlemma transition_is_ex: \"s \\a\\A\\ t \\ \\ex. move A ex s a t\"\n apply (rule_tac x = \" (a, t) \\ nil\" in exI)\n apply (simp add: move_def)\n done\n\nlemma nothing_is_ex: \"a \\ ext A \\ s = t \\ \\ex. move A ex s a t\"\n apply (rule_tac x = \"nil\" in exI)\n apply (simp add: move_def)\n done\n\nlemma ei_transitions_are_ex:\n \"s \\a\\A\\ s' \\ s' \\a'\\A\\ s'' \\ a' \\ ext A \\ \\ex. move A ex s a s''\"\n apply (rule_tac x = \" (a,s') \\ (a',s'') \\nil\" in exI)\n apply (simp add: move_def)\n done\n\nlemma eii_transitions_are_ex:\n \"s1 \\a1\\A\\ s2 \\ s2 \\a2\\A\\ s3 \\ s3 \\a3\\A\\ s4 \\ a2 \\ ext A \\ a3 \\ ext A \\\n \\ex. move A ex s1 a1 s4\"\n apply (rule_tac x = \"(a1, s2) \\ (a2, s3) \\ (a3, s4) \\ nil\" in exI)\n apply (simp add: move_def)\n done\n\n\nsubsection \\\\weak_ref_map\\ and \\ref_map\\\\\n\nlemma weak_ref_map2ref_map: \"ext C = ext A \\ is_weak_ref_map f C A \\ is_ref_map f C A\"\n apply (unfold is_weak_ref_map_def is_ref_map_def)\n apply auto\n apply (case_tac \"a \\ ext A\")\n apply (auto intro: transition_is_ex nothing_is_ex)\n done\n\nlemma imp_conj_lemma: \"(P \\ Q \\ R) \\ P \\ Q \\ R\"\n by blast\n\ndeclare if_split [split del]\ndeclare if_weak_cong [cong del]\n\nlemma rename_through_pmap:\n \"is_weak_ref_map f C A \\ is_weak_ref_map f (rename C g) (rename A g)\"\n apply (simp add: is_weak_ref_map_def)\n apply (rule conjI)\n text \\1: start states\\\n apply (simp add: rename_def rename_set_def starts_of_def)\n text \\1: start states\\\n apply (rule allI)+\n apply (rule imp_conj_lemma)\n apply (simp (no_asm) add: rename_def rename_set_def)\n apply (simp add: externals_def asig_inputs_def asig_outputs_def asig_of_def trans_of_def)\n apply safe\n apply (simplesubst if_split)\n apply (rule conjI)\n apply (rule impI)\n apply (erule disjE)\n apply (erule exE)\n apply (erule conjE)\n text \\\\x\\ is input\\\n apply (drule sym)\n apply (drule sym)\n apply simp\n apply hypsubst+\n apply (frule reachable_rename)\n apply simp\n text \\\\x\\ is output\\\n apply (erule exE)\n apply (erule conjE)\n apply (drule sym)\n apply (drule sym)\n apply simp\n apply hypsubst+\n apply (frule reachable_rename)\n apply simp\n text \\\\x\\ is internal\\\n apply (frule reachable_rename)\n apply auto\n done\n\ndeclare if_split [split]\ndeclare if_weak_cong [cong]\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/RefMappings.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29972491864579504}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ExtraSpecs\n\nimports\n \"CLib.TypHeapLib\"\n\nbegin\n\ndefinition\n \"simple_simpl_refines \\ com com'\n = (\\s. (\\ft. \\ \\ \\com', Normal s\\ \\ Fault ft)\n \\ ((\\xs. \\ \\ \\com, Normal s\\ \\ xs \\ \\ \\ \\com', Normal s\\ \\ xs)\n \\ (\\ terminates \\ com (Normal s) \\ \\ terminates \\ com' (Normal s))))\"\n\nlemma simple_simpl_refines_no_fault_execD:\n \"\\ \\ \\com,Normal s\\ \\ xs\n \\ simple_simpl_refines \\ com com'\n \\ (\\ft. \\ \\ \\ \\com',Normal s\\ \\ Fault ft)\n \\ \\ \\ \\com', Normal s\\ \\ xs\"\n by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_no_fault_terminatesD:\n \"simple_simpl_refines \\ com com'\n \\ (\\ft. \\ \\ \\ \\com',Normal s\\ \\ Fault ft)\n \\ \\ terminates \\ com (Normal s) \\ \\ terminates \\ com' (Normal s)\"\n by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_refl:\n \"simple_simpl_refines \\ com com\"\n by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_from_def_eq:\n \"body \\ body' \\ simple_simpl_refines \\ body' body\"\n (* these are flipped, because the \"implementation\" is on the rhs of\n definitional equalities, but the lhs of refinement thms. *)\n by (simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_trans:\n \"simple_simpl_refines \\ com com' \\ simple_simpl_refines \\ com' com''\n \\ simple_simpl_refines \\ com com''\"\n by (simp add: simple_simpl_refines_def, metis)\n\nlemma simple_simpl_refines_drop_Guard:\n \"simple_simpl_refines \\ com (Guard F G com)\"\n apply (clarsimp simp add: simple_simpl_refines_def)\n apply (case_tac \"s \\ G\")\n apply (auto intro: exec.Guard exec.GuardFault\n elim!: terminates_Normal_elim_cases)\n done\n\nlemma simple_simpl_refines_guarded_Basic_guarded_spec_body:\n \"(\\s s'. (s, s') \\ R \\ (s \\ G \\ (s, f s) \\ R))\n \\ simple_simpl_refines \\ (Guard F' G (Basic f)) (guarded_spec_body F R)\"\n apply (simp add: guarded_spec_body_def simple_simpl_refines_def)\n apply (intro allI, drule_tac x=s in spec)\n apply (erule impCE)\n apply (rule disjI1)\n apply (fastforce intro: exec.GuardFault)\n apply (rule disjI2)\n apply (auto intro!: exec.Guard terminates.Guard\n intro: exec.GuardFault exec.Spec terminates.Basic image_eqI[rotated]\n elim!: exec_Normal_elim_cases terminates_Normal_elim_cases)\n done\n\nlemmas simple_simpl_refines_Basic_guarded_spec_body\n = simple_simpl_refines_trans[OF\n simple_simpl_refines_drop_Guard[where G=UNIV]\n simple_simpl_refines_guarded_Basic_guarded_spec_body\n ]\n\nML \\\nstructure Get_Body_Refines = struct\n\nfun get ctxt name = let\n fun pget sfx = try (Proof_Context.get_thm ctxt o suffix sfx) name\n val eqv = pget \"_body_refines\"\n val def = pget \"_body_def\"\n in case (eqv, def) of\n (SOME eqvt, _) => eqvt\n | (_, SOME deft) => (deft RS @{thm simple_simpl_refines_from_def_eq})\n | _ => raise THM (\"Get_Body_Refines.get: \"\n ^ \"no body_def or body_refines: \" ^ name, 1, [])\n end\n\nend\n\\\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/asmrefine/ExtraSpecs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804196836383, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29972491183530847}} {"text": "(******\nType system for Yul language\nCopyright (C) 2020 Ximeng Li, Ning Han\n\nThis library is free software; you can redistribute it and/or\nmodify it under the terms of the GNU Library General Public\nLicense as published by the Free Software Foundation; either\nversion 2 of the License, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLibrary General Public License for more details.\n******)\n\ntheory \"Typing\"\n\nimports Main LMap Syntax \n\nbegin\n\nfun in_range :: \"int \\ type_name \\ bool\" where\n \"in_range i S256 = (-(2^255) \\ i \\ i < 2^255)\" | \n \"in_range i U256 = (0 \\ i \\ i < 2^256)\" | \n \"in_range i S128 = (-(2^127) \\ i \\ i < 2^127)\" | \n \"in_range i U128 = (0 \\ i \\ i < 2^128)\" | \n \"in_range i S64 = (-(2^63) \\ i \\ i < 2^63)\" | \n \"in_range i U64 = (0 \\ i \\ i < 2^64)\" | \n \"in_range i S32 = (-(2^31) \\ i \\ i < 2^31)\" | \n \"in_range i U32 = (0 \\ i \\ i < 2^32)\" | \n \"in_range i S8 = (-(2^7) \\ i \\ i < 2^7)\" | \n \"in_range i U8 = (0 \\ i \\ i < 2^8)\" | \n \"in_range i Address160 = (0 \\ i \\ i < 2^160)\" | \n \"in_range i _ = False\"\n\n(* the types for variables *)\ndatatype vtype = VType type_name \n\n(* the types for expressions *)\ndatatype etype = DataType \"type_name list\" | StmtType \n\n(* the types for functions *) \ndatatype ftype = FType \"type_name list\" \"type_name list\" \n\n(* typing environments for variables *)\ntype_synonym type_env = \"vtype list_map\" \n\n(* typing environments for functions *)\ntype_synonym ftype_env = \"ftype list_map\"\n\n(* result of typing an expression *)\ndatatype expr_type_res = ETypable etype type_env | EUntypable\n \n\nvalue \"{1::nat, 2, 3} \\ {4, 5} = {}\"\nvalue \"{1::int, 2} \\ {2, 3}\"\n\nvalue \"sum_list [1::nat,2,3]\"\n\nfun size_of_expr :: \"expr \\ nat\" and \n size_of_es :: \"expr list \\ nat\" and \n size_of_blk :: \"block \\ nat\" \n where \n \"size_of_expr (EFunCall f es) = 1 + size_of_es es\" | \n \"size_of_expr (EId x) = 1\" | \n \"size_of_expr (EImLit lit) = 1\" | \n \"size_of_expr (ELit lit) = 1\" | \n \"size_of_expr (EFunDef f pts rts blk) = 1 + size_of_blk blk\" |\n \"size_of_expr (EVarDecl txs e) = 2 + (length txs) + size_of_expr e\" |\n \"size_of_expr (EEmptyVarDecl txs) = 1\" | \n \"size_of_expr (EAssg xs e) = 2 + (length xs) + size_of_expr e\" | \n \"size_of_expr (EIf e blk) = 1 + size_of_expr e + size_of_blk blk\" |\n \"size_of_expr (ECond e blk) = 1 + size_of_expr e + size_of_blk blk\" |\n \"size_of_expr (ESwitch e cases blk_opt) = \n 2 + size_of_expr e + sum_list (map (size_of_blk \\ snd) cases) + \n (case blk_opt of (Some blk0) \\ size_of_blk blk0 | _ \\ 0)\n \" | \n \"size_of_expr (EFor blk1 e blk2 blk) =\n 1 + size_of_blk blk1 + size_of_expr e + size_of_blk blk2 + size_of_blk blk\n \" | \n \"size_of_expr (ERetId xt) = 1\" |\n \"size_of_expr (EImFunCall f es) = 1 + size_of_es es\" | \n \"size_of_expr (EList es) = size_of_es es\" | \n \"size_of_expr EStop = 1\" | \n \"size_of_expr EGasJump = 1\" | \n \"size_of_expr EGasJumpDest = 1\" | \n \"size_of_expr EGasPush = 1\" | \n \"size_of_expr EGasPop = 1\" | \n \"size_of_expr EGasSwap = 1\" | \n\n \"size_of_blk (Blk es) = 1 + size_of_es es\" | \n\n \"size_of_es es = 1 + sum_list (map size_of_expr es)\"\n\n\ndefinition builtin_fte :: ftype_env where \n \"\n builtin_fte = \n [(b_land_id, FType [Bool, Bool] [Bool]), \n (b_lor_id, FType [Bool, Bool] [Bool]), \n (b_lxor_id, FType [Bool, Bool] [Bool]), \n (b_lnot_id, FType [Bool] [Bool]),\n (b_add_id, FType [U256, U256] [U256]),\n (b_sub_id, FType [U256, U256] [U256]),\n (b_mul_id, FType [U256, U256] [U256]),\n (b_div_id, FType [U256, U256] [U256]),\n (b_sdiv_id, FType [S256, S256] [S256]),\n (b_mod_id, FType [U256, U256] [U256]),\n (b_smod_id, FType [S256, S256] [S256]),\n (b_exp_id, FType [U256, U256] [U256]),\n (b_addmod_id, FType [U256, U256, U256] [U256]),\n (b_mulmod_id, FType [U256, U256, U256] [U256]),\n (b_lt_id, FType [U256, U256] [Bool]), \n (b_slt_id, FType [S256, S256] [Bool]), \n (b_gt_id, FType [U256, U256] [Bool]), \n (b_sgt_id, FType [S256, S256] [Bool]),\n (b_eq_id, FType [U256, U256] [Bool]),\n (b_iszero_id, FType [U256] [Bool]),\n (b_not_id, FType [U256] [U256]),\n (b_and_id, FType [U256, U256] [U256]),\n (b_or_id, FType [U256, U256] [U256]),\n (b_xor_id, FType [U256, U256] [U256]),\n (b_shl_id, FType [U256, U256] [U256]),\n (b_shr_id, FType [U256, U256] [U256]),\n (b_sar_id, FType [U256, S256] [U256]),\n\n (b_mstore_id, FType [U256, U256] []),\n (b_mstore8_id, FType [U256, U256] []),\n (b_mload_id, FType [U256] [U256]),\n (b_sstore_id, FType [U256, U256] []),\n (b_sload_id, FType [U256] [U256]),\n (b_msize_id, FType [] [U256]),\n\n (b_call_id, FType [U256, U256, U256, U256, U256, U256, U256] [U256]),\n (b_callcode_id, FType [U256, U256, U256, U256, U256, U256, U256] [U256]),\n (b_delegatecall_id, FType [U256, U256, U256, U256, U256, U256] [U256]),\n (b_return_id, FType [U256, U256] []),\n (b_revert_id, FType [U256, U256] []),\n (b_selfdestruct_id, FType [U256] []),\n (b_log0_id, FType [U256, U256] []),\n (b_log1_id, FType [U256, U256, U256] []),\n (b_log2_id, FType [U256, U256, U256, U256] []),\n (b_log3_id, FType [U256, U256, U256, U256, U256] []),\n (b_log4_id, FType [U256, U256, U256, U256, U256, U256] []),\n (b_stop_id, FType [] []), \n (b_invalid_id, FType [] []), \n\n (b_coinbase_id, FType [] [U256]),\n (b_difficulty_id, FType [] [U256]),\n (b_gaslimit_id, FType [] [U256]),\n (b_number_id, FType [] [U256]),\n (b_timestamp_id, FType [] [U256]),\n (b_origin_id, FType [] [U256]),\n (b_gasprice_id, FType [] [U256]),\n (b_gas_id, FType [] [U256]),\n (b_balance_id, FType [U256] [U256]),\n (b_address_id, FType [] [U256]), \n (b_caller_id, FType [] [U256]),\n (b_callvalue_id, FType [] [U256]),\n (b_calldatasize_id, FType [] [U256]),\n (b_calldatacopy_id, FType [] [U256]),\n (b_calldataload_id, FType [U256] [U256]),\n\n (b_keccak256_id, FType [U256, U256] [U256])\n ]\n \"\n\n(* helper lemma supporting the termination proof for the typing function *)\nlemma in_lst_impl_sz_lt [simp]: \n \"\\ a \\ set es \\ \\ size_of_expr a < Suc (sum_list (map size_of_expr es))\"\nproof(induction es arbitrary: a)\n case Nil\n then show ?case by auto\nnext\n case (Cons a es)\n fix a es aa\n assume H_IH: \"\\a. a \\ set es \\\n size_of_expr a < Suc (sum_list (map size_of_expr es))\"\n assume H_in: \"aa \\ set (a # es)\" \n hence H_or: \"aa = a \\ aa \\ set es\" by auto\n thus \"size_of_expr aa < Suc (sum_list (map size_of_expr (a # es)))\"\n proof\n assume \"aa = a\" thus ?thesis by simp\n next \n assume \"aa \\ set es\" thus ?thesis using H_IH by fastforce\n qed\nqed\n\n(* helper lemma supporting the termination proof for the typing function *)\nlemma in_cases_impl_sz_lt: \n \"\\ ((lit :L tn), b) \\ set cases \\ \n \\ size_of_blk b < Suc (sum_list (map (size_of_blk \\ snd) cases))\"\nproof(induction cases arbitrary: lit tn b)\n case Nil\n then show ?case by auto\nnext\n case (Cons a cases)\n fix a cases lit tn b\n assume H_IH: \n \"\\lit tn b.\n (lit :L tn, b) \\ set cases \\\n size_of_blk b < Suc (sum_list (map (size_of_blk \\ snd) cases))\"\n assume H_case_in_cases: \"(lit :L tn, b) \\ set (a # cases)\"\n hence H_or: \"((lit :L tn), b) = a \\ (lit :L tn, b) \\ set cases\" by auto\n thus \"size_of_blk b < Suc (sum_list (map (size_of_blk \\ snd) (a # cases)))\"\n proof\n assume \"((lit :L tn), b) = a\" \n thus ?thesis by auto\n next\n assume \"(lit :L tn, b) \\ set cases\" \n thus ?thesis using H_IH by fastforce\n qed\nqed\n\n(* obtain information about the types for the user-defined functions for the code *)\nfun get_a_func_types :: \"expr list \\ ftype_env option\" where \n \"get_a_func_types [] = Some []\" |\n \"get_a_func_types ((EFunDef f ptl rtl e) # es') = (\n case (get_a_func_types es') of \n (Some te) \\ \n (case (lm_get te f) of \n (Some tp) \\ None \n | _ \\ (Some (te @ [(f, FType (map snd ptl) (map snd rtl))])))\n | _ \\ None\n )\" | \n \"get_a_func_types (_ # es') = get_a_func_types es'\"\n\ndefinition get_a_func_types_blk :: \"block \\ ftype_env option\" where \n \"get_a_func_types_blk blk = (\n case blk of (Blk es) \\ get_a_func_types es\n )\"\n\nfun ret_or_lit :: \"expr \\ bool\" where\n \"ret_or_lit (ERetId (x, t)) = True\" | \n \"ret_or_lit (EImLit l) = True\" | \n \"ret_or_lit _ = False\" \n\nfun not_elist :: \"expr \\ bool\" where \n \"not_elist (EList _) = False\" | \n \"not_elist _ = True\" \n\n(*\n - The typing of blocks and expressions takes as parameters\n the type environment for the variables that can be used in the current scope, \n the set of variables that additionally exist in outer scopes statically, and \n the type environment for the functions in scope. \n - The variables additionally existing in outer scopes statically \n are those declared in outer scopes of the immediately surrounding function definition. \n These variables cannot be used in the function defined, nor can they be re-declared. \n*)\nfunction (sequential) \n type_es :: \"type_env \\ id0 set \\ ftype_env \\ expr list \\ (bool\\type_env)\" and \n type_b :: \"type_env \\ id0 set \\ ftype_env \\ block \\ bool\" and\n type_e :: \"type_env \\ id0 set \\ ftype_env \\ expr \\ expr_type_res\"\nwhere \n \"type_es vte xs fte es = \n foldl (\\acc e. \n (if (fst acc) then \n (case type_e (snd acc) xs fte e of \n (ETypable StmtType vte') \\ (True, vte') | _ \\ (False, (snd acc))) \n else \n acc)) \n (True, vte) es\" |\n\n \"type_b vte xs fte (Blk es) = (case (type_es vte xs fte es) of (b, vte') \\ b)\" |\n \n \"type_e vte xs fte (EId x) = \n (case (lm_get vte x) of Some (VType tn) \\ ETypable (DataType [tn]) vte | _ \\ EUntypable)\" |\n\n \"type_e vte xs fte (EImLit lit) = (\n case lit of \n (TL :L tn) \\ (if tn = Bool then ETypable (DataType [Bool]) vte else EUntypable)\n | (FL :L tn) \\ (if tn = Bool then ETypable (DataType [Bool]) vte else EUntypable)\n | ((NL i) :L tn) \\ (if (in_range i tn) then (ETypable (DataType [tn]) vte) else EUntypable)\n | ((SL ws) :L _) \\ EUntypable\n )\n \" |\n \"type_e vte xs fte (ELit lit) = (\n case lit of \n (TL :L tn) \\ (if tn = Bool then ETypable (DataType [Bool]) vte else EUntypable)\n | (FL :L tn) \\ (if tn = Bool then ETypable (DataType [Bool]) vte else EUntypable)\n | ((NL i) :L tn) \\ (if (in_range i tn) then (ETypable (DataType [tn]) vte) else EUntypable)\n | ((SL ws) :L _) \\ EUntypable\n )\" |\n \n \"type_e vte xs fte (EFunCall f es) = (\n case (lm_get (fte @ builtin_fte) f) of\n Some (FType ptl rtl) \\ (\n if length ptl = length es then\n (let es_no_elist = (foldl (\\acc e. (acc \\ (not_elist e))) True es) in \n let es_pts = zip es ptl in \n \\ \\ type-check the arguments \\\n let es_res = \n (foldl (\\acc (e, t). \n (if acc then type_e vte xs fte e = ETypable (DataType [t]) vte else False))\n True es_pts) in\n (if es_no_elist \\ es_res then \n (if length rtl = 0 then \n ETypable StmtType vte\n else ETypable (DataType rtl) vte)\n else \n EUntypable\n )) \n else \n EUntypable\n )\n | _ \\ EUntypable\n )\" |\n \\ \\ that f is not in the domain of fte cannot be checked here. this is because the type of\n f might be previously added to fte due to the existence of the function def in a block \\\n \"type_e vte xs fte (EFunDef f pl rl blk) = (\n if (f \\ lm_dom builtin_fte \\ distinct (pl @ rl)) then\n (\n let vte1' = (zip (map fst pl) (map (\\(x,tn). (VType tn)) pl)) ;\n vte2' = (zip (map fst rl) (map (\\(x,tn). (VType tn)) rl)) in \n (\\ \\ids already in the scope cannot be used as formal parameters or return variables\\\n case (get_a_func_types_blk blk) of \n Some fte' \\ (\n if (lm_dom vte \\ xs) \\ (lm_dom vte1' \\ lm_dom vte2') = {}\n \\ (lm_dom builtin_fte \\ lm_dom fte \\ {f}) \\ lm_dom fte' = {} \n \\ (type_b (vte1' @ vte2') (xs \\ lm_dom vte) \n (fte @ fte' @ [(f, FType (map snd pl) (map snd rl))]) blk) \n then \n ETypable StmtType vte\n else \n EUntypable\n ) \n | _ \\ EUntypable\n ))\n else \n EUntypable)\n \" |\n \"type_e vte xs fte (EVarDecl txs e) = (\n if (foldl (\\acc tx. acc \\ (lm_get vte (fst tx)) = None \\ ((fst tx) \\ xs) \n \\ lm_get fte (fst tx) = None) \n True txs) \n \\ distinct (map fst txs) \n then (\n case (type_e vte xs fte e) of \n (ETypable (DataType tns) vte') \\ \n (if length txs = length tns then (\n let txs_tns = zip txs tns in (\n if (foldl (\\acc ((x, tn1), tn2). acc \\ tn1 = tn2) True txs_tns) then (\n let vte'' = vte @ ((zip (map fst txs) (map ((\\tn. (VType tn)) \\ snd) txs)))\n in (ETypable StmtType vte'')\n ) else EUntypable\n )\n ) else \n EUntypable)\n | _ \\ EUntypable\n ) \n else \n EUntypable\n )\n \" | \n \"type_e vte xs fte (EEmptyVarDecl txs) = (\n if (foldl (\\acc tx. acc \\ (lm_get vte (fst tx)) = None \\ ((fst tx) \\ xs) \n \\ lm_get fte (fst tx) = None) \n True txs) \n \\ distinct (map fst txs) \n then (\n let vte' = vte @ (zip (map fst txs) (map (\\(x, tn). (VType tn)) txs)) in \n ETypable StmtType vte'\n )\n else \n EUntypable\n )\n \" | \n \"type_e vte xs0 fte (EAssg xs e) = (\n case (type_e vte xs0 fte e) of\n (ETypable (DataType tns) vte') \\ (\n if length xs = length tns then\n let xs_tns = zip xs tns in (\n if (foldl (\\acc (x, tn). acc \\ (lm_get vte x = Some (VType tn))) True xs_tns)\n \\ distinct xs\n then\n ETypable StmtType vte\n else \n EUntypable\n )\n else \n EUntypable\n )\n | _ \\ EUntypable\n )\n \" | \n \"type_e vte xs fte (EIf e blk) = (\n case (type_e vte xs fte e) of \n (ETypable (DataType [Bool]) vte') \\ (\n if not_elist e then (\n case (get_a_func_types_blk blk) of \n Some fte' \\ \n (if (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte' = {} \n \\ type_b vte xs (fte @ fte') blk \n then (ETypable StmtType vte) \n else EUntypable)\n | _ \\ EUntypable\n ) else\n EUntypable\n ) \n | _ \\ EUntypable\n )\n \" |\n\n \"type_e vte xs fte (ECond e blk) = (\n case (type_e vte xs fte e) of \n (ETypable (DataType [Bool]) vte') \\ (\n if not_elist e then (\n case (get_a_func_types_blk blk) of \n Some fte' \\ \n (if (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte' = {}\n \\ type_b vte xs (fte @ fte') blk then \n (ETypable StmtType vte) \n else \n EUntypable)\n | _ \\ EUntypable\n ) else \n EUntypable\n )\n | _ \\ EUntypable\n )\n \" |\n\n \"type_e vte xs fte (ESwitch e cases blk_opt) = (\n case (type_e vte xs fte e) of \n (ETypable (DataType [tn]) _) \\ (\n if not_elist e then (\n if (foldl \n (\\acc (lit, blk). \n (case (lit) of \n (Literal lkind tn') \\ \n acc \\ tn = tn' \\ (\n case (get_a_func_types_blk blk) of \n Some fte' \\ \n (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte' = {} \n \\ type_b vte xs (fte @ fte') blk\n | _ \\ False\n ))) True cases) \n then \n (\n case blk_opt of \n Some blk \\ (\n case (get_a_func_types_blk blk) of \n Some fte' \\ (\n if (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte' = {} \n \\ type_b vte xs (fte @ fte') blk then \n ETypable StmtType vte\n else \n EUntypable)\n | _ \\ EUntypable\n )\n | None \\ (ETypable StmtType vte)\n )\n else \n EUntypable\n ) else \n EUntypable\n )\n | _ \\ EUntypable\n )\n \" |\n \"type_e vte xs fte (EFor blk1 e blk2 blk) = (\n case blk1 of \n (Blk es1) \\ (\n case get_a_func_types es1 of \\ \\forbit function definition inside the init block\\\n Some [] \\ (\n \\ \\ variables in the outer scope can all be used in blk1 \\\n case (type_es vte xs fte es1) of\n (True, vte') \\ (\n case (type_e vte' xs fte e) of\n ETypable (DataType [Bool]) vte'' \\ (\n if not_elist e then (\n \\ \\variables declared in one of blk and blk2 cannot be used in the other, \n but can be declared in the other\\\n case (get_a_func_types_blk blk2, get_a_func_types_blk blk) of \n (Some fte2', Some fte') \\ (\n if (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte2' = {} \n \\ type_b vte' xs (fte @ fte2') blk2 \n \\ (lm_dom builtin_fte \\ lm_dom fte) \\ lm_dom fte' = {}\n \\ type_b vte' xs (fte @ fte') blk then\n ETypable StmtType vte\n else \n EUntypable)\n | _ \\ EUntypable\n ) else \n EUntypable\n )\n | _ \\ EUntypable\n )\n | _ \\ EUntypable \n )\n | _ \\ EUntypable\n )\n )\n \" | \n \"type_e vte xs fte (ERetId xt) = ETypable (DataType [snd xt]) vte\" |\n \"type_e vte xs fte (EImFunCall f es) = (\n case (lm_get (fte @ builtin_fte) f) of \n Some (FType ptl rtl) \\ (\n if length ptl = length es then\n (let es_no_elist = (foldl (\\acc e. (acc \\ (not_elist e))) True es) in \n let es_pts = zip es ptl in \n \\ \\ type-check the arguments \\\n let es_res = \n (foldl (\\acc (e, t). \n (if acc then type_e vte xs fte e = ETypable (DataType [t]) vte else False))\n True es_pts) in\n (if es_no_elist \\ es_res then \n (if length rtl = 0 then \n ETypable StmtType vte\n else ETypable (DataType rtl) vte)\n else \n EUntypable\n )) \n else \n EUntypable\n )\n | _ \\ EUntypable\n )\" |\n \"type_e vte xs fte (EList es) = (\n let es_ret_lit = (foldl (\\acc e. acc \\ ret_or_lit e) True es) in (\n if es_ret_lit then (\n foldl (\\acc e. (\n case acc of (ETypable (DataType tns) _) \\ (\n case type_e vte xs fte e of \n (ETypable (DataType [tn]) _) \\ ETypable (DataType (tns @ [tn])) vte \n | _ \\ EUntypable) \n | _ \\ EUntypable))\n (ETypable (DataType []) vte) es\n ) else \n EUntypable\n )\n )\" |\n \"type_e vte xs fte STOP = ETypable StmtType vte\" |\n \"type_e vte xs fte EGasJump = ETypable StmtType vte\" |\n \"type_e vte xs fte EGasPush = ETypable StmtType vte\" |\n \"type_e vte xs fte EGasJumpDest = ETypable StmtType vte\" |\n \"type_e vte xs fte EGasPop = ETypable StmtType vte\" |\n \"type_e vte xs fte EGasSwap = ETypable StmtType vte\"\n\n by pat_completeness auto\n\ntermination proof-\n show ?thesis\n apply(relation \n \"measure \n (\\x. (case x of \n (Inl (_::type_env, xs:: id0 set, fte::ftype_env, es::expr list)) \\ size_of_es es\n | (Inr (Inl (vte::type_env, xs:: id0 set, fte::ftype_env, blk::block))) \\ size_of_blk blk\n | (Inr (Inr (vte::type_env, xs:: id0 set, fte::ftype_env, e::expr))) \\ size_of_expr e\n ))\n \")\n apply auto \n apply (simp add: less_SucI set_zip_leftD)\n using in_cases_impl_sz_lt apply fastforce\n by (simp add: less_SucI set_zip_leftD) \nqed\n\nend\n", "meta": {"author": "lixm", "repo": "yul-smallstep", "sha": "f71786f5158e335f7caa3311a4928c3ac97912ee", "save_path": "github-repos/isabelle/lixm-yul-smallstep", "path": "github-repos/isabelle/lixm-yul-smallstep/yul-smallstep-f71786f5158e335f7caa3311a4928c3ac97912ee/Typing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.709019146082187, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.29956387539172197}} {"text": "theory TickTock_ExtChoice\n imports TickTock_Core TickTock_Basic_Ops\nbegin\n\nsubsection {* External Choice *}\n\ndefinition ExtChoiceTT :: \"'e ttobs list set \\ 'e ttobs list set \\ 'e ttobs list set\" (infixl \"\\\\<^sub>C\" 57) where\n \"P \\\\<^sub>C Q = {t. \\ \\\\tocks(UNIV). \\ \\ \\. \n \\ @ \\ \\ P \\ \\ @ \\ \\ Q \\\n (\\\\'\\tocks(UNIV). \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks(UNIV). \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\ X. \\ = [[X]\\<^sub>R] \\ (\\ Y. \\ = [[Y]\\<^sub>R] \\ (\\ e. (e \\ X = (e \\ Y)) \\ (e = Tock)))) \\\n (\\ X. \\ = [[X]\\<^sub>R] \\ (\\ Y. \\ = [[Y]\\<^sub>R] \\ (\\ e. (e \\ X = (e \\ Y)) \\ (e = Tock)))) \\\n (t = \\ @ \\ \\ t = \\ @ \\)}\"\n\ndefinition initially_stable :: \"'e ttprocess \\ bool\" where\n \"initially_stable P = (\\ t\\P. \\ X t'. t = [X]\\<^sub>R # t')\"\n\nlemma left_unstable_ExtChoice_def:\n assumes P_wf: \"\\x\\P. ttWF x\" and Q_wf: \"\\x\\Q. ttWF x\"\n assumes TT0_P: \"TT0 P\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\"\n shows \"\\ initially_stable P \\ P \\\\<^sub>C Q = P \\ {t\\Q. \\t' X. t = [X]\\<^sub>R # t'}\"\n unfolding initially_stable_def ExtChoiceTT_def\nproof auto\n fix \\ \\ \\ t' :: \"'a tttrace\" and X\n assume assm1: \"\\t\\P. \\X t'. t \\ [X]\\<^sub>R # t'\"\n assume assm2: \"\\ \\ tocks UNIV\"\n assume assm3: \"[X]\\<^sub>R # t' \\ P\"\n assume assm4: \"\\ @ \\ \\ P\"\n assume assm5: \"[X]\\<^sub>R # t' \\ Q\"\n assume assm6: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume assm7: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [X]\\<^sub>R # t' \\ \\' \\\\<^sub>C \\\"\n assume assm8: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume assm9: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume assm10: \"\\ @ \\ = [X]\\<^sub>R # t'\"\n\n have \"t' = [] \\ (\\ t''. t' = [Tock]\\<^sub>E # t'')\"\n using assm5 Q_wf by (cases t' rule:ttWF.cases, simp_all add: notin_tocks, (metis ttWF.simps)+)\n then show False\n proof auto\n assume case_assm: \"t' = []\"\n then have \"\\ = [] \\ \\ = [[X]\\<^sub>R]\"\n by (metis Cons_eq_append_conv append_Cons assm1 assm10 assm4 assm9)\n then show False\n using assm3 assm4 case_assm by auto\n next\n fix t''\n assume case_assm: \"t' = [Tock]\\<^sub>E # t''\"\n then obtain \\' where \"\\ = [X]\\<^sub>R # [Tock]\\<^sub>E # \\'\"\n using assm7 tt_prefix_split by (erule_tac x=\"[[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, fastforce, meson subset_UNIV tocks.simps)\n then show False\n using assm1 assm4 by auto\n qed\nnext\n fix x :: \"'a tttrace\"\n assume assm1: \"\\t\\P. \\X t'. t \\ [X]\\<^sub>R # t'\"\n assume assm2: \"x \\ P\"\n\n have 1: \"[] \\ Q\"\n by (simp add: TT0_Q TT0_TT1_empty TT1_Q)\n have 2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C x \\ \\' \\\\<^sub>C []\"\n by (metis append_Cons assm1 assm2 tocks.cases tt_prefix_decompose tt_prefix_refl)\n have 3: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [] \\ \\' \\\\<^sub>C []\"\n by blast\n have 4: \"\\X. x = [[X]\\<^sub>R] \\ (\\Y. [] = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n by (simp add: assm1 assm2)\n have 5: \"\\X. [] = [[X]\\<^sub>R] \\ (\\Y. x = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n by blast\n show \"\\\\\\tocks UNIV. \\\\. \\ @ \\ \\ P \\ (\\\\. \\ @ \\ \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\ (x = \\ @ \\ \\ x = \\ @ \\))\"\n using 1 2 3 4 5 by (rule_tac x=\"[]\" in bexI, auto, insert assm2 tocks.empty_in_tocks, blast+)\nnext\n fix x\n assume assm1: \"\\t\\P. \\X t'. t \\ [X]\\<^sub>R # t'\"\n assume assm2: \"x \\ Q\"\n assume assm3: \"\\t' X. x \\ [X]\\<^sub>R # t'\"\n\n obtain y where y_in_P: \"y \\ P\"\n using TT0_P TT0_def by auto\n have 1: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C y \\ \\' \\\\<^sub>C []\"\n by (metis y_in_P append_Cons assm1 tocks.simps tt_prefix.simps(1) tt_prefix_split)\n have 2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C x \\ \\' \\\\<^sub>C []\"\n by (metis append_Cons assm3 split_tocks_longest tocks.simps)\n have 3: \"\\X. y = [[X]\\<^sub>R] \\ (\\Y. x = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n using assm1 y_in_P by blast\n have 4: \"\\X. x = [[X]\\<^sub>R] \\ (\\Y. y = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n by (simp add: assm3)\n show \"\\\\\\tocks UNIV. \\\\. \\ @ \\ \\ P \\ (\\\\. \\ @ \\ \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\ (x = \\ @ \\ \\ x = \\ @ \\))\"\n using y_in_P 1 2 3 4 by (rule_tac x=\"[]\" in bexI, auto, insert assm2, blast, meson tocks.simps)\nqed\n\nlemma ExtChoiceTT_wf: \"\\ t\\P. ttWF t \\ \\ t\\Q. ttWF t \\ \\ t\\P \\\\<^sub>C Q. ttWF t\"\n unfolding ExtChoiceTT_def by auto\n\nlemma TT0_ExtChoice:\n assumes \"TT P\" \"TT Q\"\n shows \"TT0 (P \\\\<^sub>C Q)\"\n unfolding TT0_def apply auto\n unfolding ExtChoiceTT_def apply auto\n using TT_empty assms(1) assms(2) tocks.empty_in_tocks by fastforce\n\nlemma TT1_ExtChoice:\n assumes \"TT P\" \"TT Q\"\n shows \"TT1 (P \\\\<^sub>C Q)\"\n unfolding TT1_def\nproof auto\n fix \\ \\ :: \"'a ttobs list\"\n assume assm1: \"\\ \\\\<^sub>C \\\"\n assume assm2: \"\\ \\ P \\\\<^sub>C Q\"\n obtain \\2 where \\2_assms: \"\\2 \\\\<^sub>C \\\" \"\\ \\\\<^sub>C \\2\"\n using assm1 tt_prefix_subset_imp_tt_subset_tt_prefix by auto\n from assm2 obtain \\' s t where assm2_assms:\n \"\\'\\tocks UNIV\"\n \"\\' @ s \\ P\"\n \"\\' @ t \\ Q\"\n \"(\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\' @ s \\ \\' \\\\<^sub>C \\')\"\n \"(\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\' @ t \\ \\' \\\\<^sub>C \\')\"\n \"\\X. s = [[X]\\<^sub>R] \\ (\\Y. t = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n \"\\X. t = [[X]\\<^sub>R] \\ (\\Y. s = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n \"\\ = \\' @ t \\ \\ = \\' @ s\"\n unfolding ExtChoiceTT_def by blast\n from assm2_assms(8) have \"\\2 \\ P \\\\<^sub>C Q\"\n proof (auto)\n assume case_assm: \"\\ = \\' @ s\"\n then have \\_in_P: \"\\ \\ P\"\n using assm2_assms(2) by blast\n have \\2_in_P: \"\\2 \\ P\"\n using TT1_def TT_TT1 \\2_assms(1) \\_in_P assms(1) tt_prefix_imp_prefix_subset by blast\n have \"\\2 \\\\<^sub>C \\' \\ (\\ \\2'. \\2 = \\' @ \\2' \\ \\2' \\\\<^sub>C s)\"\n using \\2_assms(1) case_assm tt_prefix_append_split by blast\n then show \"\\2 \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assm2: \"\\2 \\\\<^sub>C \\'\"\n have \\2_in_Q: \"\\2 \\ Q\"\n by (meson TT1_def TT_TT1 assm2_assms(3) assms(2) case_assm2 tt_prefix_concat tt_prefix_imp_prefix_subset)\n obtain \\' where \\'_assms: \"\\' \\ tocks UNIV\" \"\\2 = \\' \\ (\\Y. \\2 = \\' @ [[Y]\\<^sub>R])\"\n using case_assm2 assm2_assms(1) tt_prefix_tocks by blast\n then show \"\\2 \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assm3: \"\\2 = \\'\"\n then show \"\\' \\ P \\\\<^sub>C Q\"\n using \\2_in_P \\2_in_Q case_assm3 \\'_assms(1) unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto)\n apply (rule_tac x=\"[]\" in exI, auto)\n apply (rule_tac x=\"[]\" in exI, auto)\n done\n next\n fix Y\n assume case_assm3: \"\\2 = \\' @ [[Y]\\<^sub>R]\"\n then show \"\\' @ [[Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using \\2_in_P \\2_in_Q \\'_assms(1) unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto)\n by (metis butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n qed\n next\n fix \\2'\n assume case_assm2: \"\\2' \\\\<^sub>C s\"\n assume case_assm3: \"\\2 = \\' @ \\2'\"\n have in_P: \"\\' @ \\2' \\ P\"\n using TT1_def TT_TT1 \\2_assms(1) assm2_assms(2) assms(1) case_assm case_assm3 tt_prefix_imp_prefix_subset by blast\n show \"\\' @ \\2' \\ P \\\\<^sub>C Q\"\n proof (cases \"\\X. \\2' = [[X]\\<^sub>R]\", auto)\n fix X\n assume case_assm4: \"\\2' = [[X]\\<^sub>R]\"\n then have case_assm5: \"s = [[X]\\<^sub>R]\"\n using case_assm2\n proof -\n have \"ttWF s\"\n using TT_wf assm2_assms(1) assm2_assms(2) assms(1) tocks_append_wf2 by fastforce\n then show \"\\2' = [[X]\\<^sub>R] \\ \\2' \\\\<^sub>C s \\ s = [[X]\\<^sub>R]\"\n apply (cases s rule:ttWF.cases, auto, insert assm2_assms(1) assm2_assms(4))\n apply (erule_tac x=\"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, auto simp add: tt_prefix_same_front)\n using tt_prefix_antisym tt_prefix_concat apply blast\n apply (induct \\', auto simp add: tocks.tock_insert_in_tocks)\n by (metis append_Cons subset_UNIV tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n qed\n thm assm2_assms\n then obtain Y where \"t = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using assm2_assms(6) by auto\n then have \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\ Q\"\n proof -\n assume \"t = [[Y]\\<^sub>R]\"\n then have \"\\' @ [[Y]\\<^sub>R] \\ Q\"\n using assm2_assms(3) by auto\n also assume \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n then have \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n using tt_prefix_subset_same_front[where r=\\'] by auto\n then show \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\ Q\"\n using calculation TT1_def TT_TT1 assms(2) by blast\n qed\n then show \"\\' @ [[X]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: assm2_assms(1))\n apply (rule_tac x=\"[[X]\\<^sub>R]\" in exI, insert in_P case_assm4, simp)\n apply (rule_tac x=\"[[{e\\X. e \\ Tock}]\\<^sub>R]\" in exI, insert assm2_assms(4) case_assm5, auto)\n by (metis (no_types, lifting) butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n next\n have \\'_in_Q: \"\\' \\ Q\"\n using TT1_def TT_TT1 assm2_assms(3) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset by blast\n then show \"\\X. \\2' \\ [[X]\\<^sub>R] \\ \\' @ \\2' \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: assm2_assms(1))\n apply (rule_tac x=\"\\2'\" in exI, simp add: in_P)\n apply (rule_tac x=\"[]\" in exI, auto)\n using \\2_assms(1) assm2_assms(4) case_assm case_assm3 tt_prefix_trans by blast\n qed\n qed\n next\n assume case_assm: \"\\ = \\' @ t\"\n then have \\_in_Q: \"\\ \\ Q\"\n using assm2_assms(3) by blast\n have \\2_in_Q: \"\\2 \\ Q\"\n using TT1_def TT_TT1 \\2_assms(1) \\_in_Q assms(2) tt_prefix_imp_prefix_subset by blast\n have \"\\2 \\\\<^sub>C \\' \\ (\\ \\2'. \\2 = \\' @ \\2' \\ \\2' \\\\<^sub>C t)\"\n using \\2_assms(1) case_assm tt_prefix_append_split by blast\n then show \"\\2 \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assm2: \"\\2 \\\\<^sub>C \\'\"\n have \\2_in_P: \"\\2 \\ P\"\n by (meson TT1_def TT_TT1 assm2_assms(2) assms(1) case_assm2 tt_prefix_concat tt_prefix_imp_prefix_subset)\n obtain \\' where \\'_assms: \"\\' \\ tocks UNIV\" \"\\2 = \\' \\ (\\Y. \\2 = \\' @ [[Y]\\<^sub>R])\"\n using case_assm2 assm2_assms(1) tt_prefix_tocks by blast\n then show \"\\2 \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assm3: \"\\2 = \\'\"\n then show \"\\' \\ P \\\\<^sub>C Q\"\n using \\2_in_P \\2_in_Q case_assm3 \\'_assms(1) unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto)\n apply (rule_tac x=\"[]\" in exI, auto)\n apply (rule_tac x=\"[]\" in exI, auto)\n done\n next\n fix Y\n assume case_assm3: \"\\2 = \\' @ [[Y]\\<^sub>R]\"\n then show \"\\' @ [[Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using \\2_in_P \\2_in_Q \\'_assms(1) unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto)\n by (metis butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n qed\n next\n fix \\2'\n assume case_assm2: \"\\2' \\\\<^sub>C t\"\n assume case_assm3: \"\\2 = \\' @ \\2'\"\n have in_Q: \"\\' @ \\2' \\ Q\"\n using \\2_in_Q case_assm3 by blast\n show \"\\' @ \\2' \\ P \\\\<^sub>C Q\"\n proof (cases \"\\X. \\2' = [[X]\\<^sub>R]\", auto)\n fix X\n assume case_assm4: \"\\2' = [[X]\\<^sub>R]\"\n then have case_assm5: \"t = [[X]\\<^sub>R]\"\n using case_assm2\n proof -\n have \"ttWF t\"\n using TT_wf assm2_assms(1) assm2_assms(3) assms(2) tocks_append_wf2 by fastforce\n then show \"\\2' = [[X]\\<^sub>R] \\ \\2' \\\\<^sub>C t \\ t = [[X]\\<^sub>R]\"\n apply (cases t rule:ttWF.cases, auto, insert assm2_assms(1) assm2_assms(5))\n apply (erule_tac x=\"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, auto simp add: tt_prefix_same_front)\n using tt_prefix_antisym tt_prefix_concat apply blast\n apply (induct \\', auto simp add: tocks.tock_insert_in_tocks)\n by (metis append_Cons subset_UNIV tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n qed\n then obtain Y where \"s = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using assm2_assms(7) by auto\n then have \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\ P\"\n proof -\n assume \"s = [[Y]\\<^sub>R]\"\n then have \"\\' @ [[Y]\\<^sub>R] \\ P\"\n using assm2_assms(2) by auto\n also assume \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n then have \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n using tt_prefix_subset_same_front[where r=\\'] by auto\n then show \"\\' @ [[{e\\X. e \\ Tock}]\\<^sub>R] \\ P\"\n using calculation TT1_def TT_TT1 assms(1) by blast\n qed\n then show \"\\' @ [[X]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: assm2_assms(1))\n apply (rule_tac x=\"[[{e\\X. e \\ Tock}]\\<^sub>R]\" in exI, insert assm2_assms(4) case_assm5, auto)\n apply (rule_tac x=\"[[X]\\<^sub>R]\" in exI, insert in_Q case_assm4 assm2_assms(5), auto)\n by (metis (no_types, lifting) butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n next\n have \\'_in_P: \"\\' \\ P\"\n using TT1_def TT_TT1 assm2_assms(2) assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset by blast\n then show \"\\X. \\2' \\ [[X]\\<^sub>R] \\ \\' @ \\2' \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: assm2_assms(1))\n apply (rule_tac x=\"[]\" in exI, auto)\n apply (rule_tac x=\"\\2'\" in exI, simp add: in_Q)\n using \\2_assms(1) assm2_assms(5) case_assm case_assm3 tt_prefix_trans by blast\n qed\n qed\n qed\n then obtain \\2' s2 t2 where \\2_split:\n \"\\2'\\tocks UNIV\"\n \"\\2' @ s2 \\ P\"\n \"\\2' @ t2 \\ Q\"\n \"(\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\2' @ s2 \\ \\' \\\\<^sub>C \\2')\"\n \"(\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\2' @ t2 \\ \\' \\\\<^sub>C \\2')\"\n \"\\X. s2 = [[X]\\<^sub>R] \\ (\\Y. t2 = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n \"\\X. t2 = [[X]\\<^sub>R] \\ (\\Y. s2 = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n \"\\2 = \\2' @ t2 \\ \\2 = \\2' @ s2\"\n unfolding ExtChoiceTT_def by blast\n then show \"\\ \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assm: \"\\2 = \\2' @ t2\"\n have \\_wf: \"ttWF \\\"\n using TT1_def TT_TT1 TT_wf \\2_assms(2) \\2_split(3) assms(2) case_assm tt_subset_imp_prefix_subset by blast\n then obtain \\' \\'' where \\'_\\''_assms:\n \"\\ = \\' @ \\''\"\n \"\\' \\ tocks UNIV\"\n \"\\t\\tocks UNIV. t \\\\<^sub>C \\' @ \\'' \\ t \\\\<^sub>C \\'\"\n by (metis split_tocks_longest)\n then have \\'_\\''_tt_subset: \"\\' \\\\<^sub>C \\2' \\ \\'' \\\\<^sub>C t2\"\n using TT_wf \\_wf \\2_assms(2) \\2_split(1) \\2_split(3) \\2_split(5) assms(2) case_assm tt_subset_longest_tocks by blast\n then have \\'_in_P_Q: \"\\' \\ P \\ \\' \\ Q\"\n by (meson TT_TT1 TT_defs(3) \\2_split(2) \\2_split(3) assms(1) assms(2) tt_prefix_concat tt_prefix_subset_tt_prefix_trans tt_subset_imp_prefix_subset)\n show \"\\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\ X. t2 = [[X]\\<^sub>R]\")\n assume case_assm2: \"\\ X. t2 = [[X]\\<^sub>R]\"\n then obtain X where t2_def: \"t2 = [[X]\\<^sub>R]\"\n by auto\n then have \"\\ Y. Y \\ X \\ \\'' = [[Y]\\<^sub>R]\"\n using \\'_\\''_tt_subset apply (simp, induct \\'' t2 rule:tt_subset.induct, simp_all)\n using tt_subset_same_length by force\n then obtain Y where Y_assms: \"Y \\ X \\ \\'' = [[Y]\\<^sub>R]\"\n by auto\n then obtain Z where Z_assms: \"s2 = [[Z]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Z) \\ e = Tock)\"\n using t2_def \\2_split(7) by blast\n then have \"{e. e \\ Y \\ e \\ Tock} \\ Z\"\n using Y_assms by blast\n then have 1: \"\\' @ [[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\2' @ [[Z]\\<^sub>R]\"\n by (simp add: \\'_\\''_tt_subset tt_subset_combine)\n have 2: \"\\' @ [[Y]\\<^sub>R] \\\\<^sub>C \\2' @ [[X]\\<^sub>R]\"\n using Y_assms \\'_\\''_assms(1) \\2_assms(2) case_assm t2_def by blast\n have 3: \"\\' @ [[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ P\"\n using \"1\" TT1_def TT_TT1 Z_assms \\2_split(2) assms(1) tt_subset_imp_prefix_subset by blast\n have 4: \"\\' @ [[Y]\\<^sub>R] \\ Q\"\n using \"2\" TT1_def TT_TT1 \\2_split(3) assms(2) tt_subset_imp_prefix_subset t2_def by blast\n then show \"\\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_\\''_assms)\n apply (rule_tac x=\"[[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R]\" in exI, auto simp add: 3)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto simp add: 4 Y_assms)\n apply (metis (no_types, lifting) butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n by (simp add: Y_assms \\'_\\''_assms(3))\n next\n assume \"\\X. t2 = [[X]\\<^sub>R]\"\n then have \"\\X. \\'' = [[X]\\<^sub>R]\"\n using \\'_\\''_tt_subset by (auto, cases t2 rule:ttWF.cases, auto)\n then show \"\\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_\\''_assms)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\'_in_P_Q)\n apply (rule_tac x=\"\\''\" in exI, auto)\n using TT1_def TT_TT1 \\'_\\''_assms(1) \\2_assms(2) \\2_split(3) assms(2) case_assm tt_subset_imp_prefix_subset apply blast\n using \\'_\\''_assms(3) by blast\n qed\n next\n assume case_assm: \"\\2 = \\2' @ s2\"\n have \\_wf: \"ttWF \\\"\n by (metis TT_def ExtChoiceTT_wf assm1 assm2 assms(1) assms(2) tt_prefix_subset_ttWF)\n then obtain \\' \\'' where \\'_\\''_assms:\n \"\\ = \\' @ \\''\"\n \"\\' \\ tocks UNIV\"\n \"\\t\\tocks UNIV. t \\\\<^sub>C \\' @ \\'' \\ t \\\\<^sub>C \\'\"\n by (metis split_tocks_longest)\n then have \\'_\\''_tt_subset: \"\\' \\\\<^sub>C \\2' \\ \\'' \\\\<^sub>C s2\"\n using TT_wf \\2_assms(2) \\2_split(1) \\2_split(2) \\2_split(4) \\_wf assms(1) case_assm tt_subset_longest_tocks by blast\n then have \\'_in_P_Q: \"\\' \\ P \\ \\' \\ Q\"\n by (meson TT_TT1 TT_defs(3) \\2_split(2) \\2_split(3) assms(1) assms(2) tt_prefix_concat tt_prefix_subset_tt_prefix_trans tt_subset_imp_prefix_subset)\n show \"\\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\ X. s2 = [[X]\\<^sub>R]\")\n assume case_assm2: \"\\ X. s2 = [[X]\\<^sub>R]\"\n then obtain X where s2_def: \"s2 = [[X]\\<^sub>R]\"\n by auto\n then have \"\\ Y. Y \\ X \\ \\'' = [[Y]\\<^sub>R]\"\n using \\'_\\''_tt_subset apply (simp, induct \\'' s2 rule:tt_subset.induct, simp_all)\n using tt_subset_same_length by force\n then obtain Y where Y_assms: \"Y \\ X \\ \\'' = [[Y]\\<^sub>R]\"\n by auto\n then obtain Z where Z_assms: \"t2 = [[Z]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Z) \\ e = Tock)\"\n using s2_def \\2_split(6) by blast\n then have \"{e. e \\ Y \\ e \\ Tock} \\ Z\"\n using Y_assms by blast\n then have 1: \"\\' @ [[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\2' @ [[Z]\\<^sub>R]\"\n by (simp add: \\'_\\''_tt_subset tt_subset_combine)\n have 2: \"\\' @ [[Y]\\<^sub>R] \\\\<^sub>C \\2' @ [[X]\\<^sub>R]\"\n using Y_assms \\'_\\''_assms(1) \\2_assms(2) case_assm s2_def by blast\n have 3: \"\\' @ [[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n using \"1\" TT1_def TT_TT1 Z_assms \\2_split(3) assms(2) tt_subset_imp_prefix_subset by blast\n have 4: \"\\' @ [[Y]\\<^sub>R] \\ P\"\n using \"2\" TT1_def TT_TT1 \\2_split(2) assms(1) tt_subset_imp_prefix_subset s2_def by blast\n then show \"\\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_\\''_assms)\n apply (rule_tac x=\"[[Y]\\<^sub>R]\" in exI, auto simp add: 4 Y_assms)\n apply (rule_tac x=\"[[{e. e \\ Y \\ e \\ Tock}]\\<^sub>R]\" in exI, auto simp add: 3)\n using Y_assms \\'_\\''_assms(3) apply blast\n by (metis (no_types, lifting) butlast_append butlast_snoc tt_prefix_concat tt_prefix_decompose end_refusal_notin_tocks)\n next\n assume \"\\X. s2 = [[X]\\<^sub>R]\"\n then have \"\\X. \\'' = [[X]\\<^sub>R]\"\n using \\'_\\''_tt_subset by (auto, cases s2 rule:ttWF.cases, auto)\n then show \"\\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_\\''_assms)\n apply (rule_tac x=\"\\''\" in exI, auto)\n using TT1_def TT_TT1 \\'_\\''_assms(1) \\2_assms(2) \\2_split(2) assms(1) case_assm tt_subset_imp_prefix_subset apply blast\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\'_in_P_Q)\n using \\'_\\''_assms(3) by blast\n qed\n qed\nqed\n\nlemma TT2w_ExtChoice:\n assumes \"TT P\" \"TT Q\"\n shows \"TT2w (P \\\\<^sub>C Q)\"\n unfolding TT2w_def\nproof auto\n fix \\ :: \"'a ttobs list\"\n fix X Y :: \"'a ttevent set\"\n assume assm1: \"\\ @ [[X]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n assume assm2: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {}\"\n from assm1 have \"ttWF \\\"\n by (metis TT_def ExtChoiceTT_wf assms(1) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset tt_prefix_subset_ttWF)\n then obtain \\' \\'' where \\_split: \"\\'\\tocks UNIV \\ \\ = \\' @ \\'' \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C \\ \\ t' \\\\<^sub>C \\')\"\n using split_tocks_longest by blast\n have \\'_in_P_Q: \"\\' \\ P \\ \\' \\ Q\"\n using assm1 unfolding ExtChoiceTT_def apply auto\n apply (metis TT1_def TT_TT1 \\_split assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n apply (metis TT1_def TT_TT1 \\_split append.assoc assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n apply (metis TT1_def TT_TT1 \\_split append.assoc assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n by (metis TT1_def TT_TT1 \\_split assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n have set1: \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q}\"\n proof auto\n fix x :: \"'a ttevent\"\n assume \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n then have \"\\ @ [[x]\\<^sub>E] \\ P \\ \\ @ [[x]\\<^sub>E] \\ Q\"\n unfolding ExtChoiceTT_def by auto\n then show \"\\ @ [[x]\\<^sub>E] \\ Q \\ \\ @ [[x]\\<^sub>E] \\ P\"\n by auto\n next\n fix x :: \"'a ttevent\"\n assume \"x \\ Tock\" \"\\ @ [[x]\\<^sub>E] \\ P\"\n then show \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split)\n apply (rule_tac x=\"\\'' @ [[x]\\<^sub>E]\" in exI, simp_all)\n apply (rule_tac x=\"[]\" in exI, simp add: \\'_in_P_Q)\n apply (auto, case_tac \"\\''' \\\\<^sub>C \\' @ \\''\")\n using \\_split apply blast\n by (metis append.assoc append_Cons append_Nil tt_prefix_notfront_is_whole ttevent.exhaust end_event_notin_tocks mid_tick_notin_tocks)\n next\n fix x :: \"'a ttevent\"\n assume \"x \\ Tock\" \"\\ @ [[x]\\<^sub>E] \\ Q\"\n then show \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split)\n apply (rule_tac x=\"[]\" in exI, simp add: \\'_in_P_Q)\n apply (auto, case_tac \"\\''' \\\\<^sub>C \\' @ \\''\")\n using \\_split apply blast\n by (metis append.assoc append_Cons append_Nil tt_prefix_notfront_is_whole ttevent.exhaust end_event_notin_tocks mid_tick_notin_tocks)\n qed\n have set2: \"{e. e = Tock \\ \\'' = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = \n {e. e = Tock \\ \\'' = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\'' = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n proof auto\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\" \"\\'' = []\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n by (simp add: \\_split)\n then obtain r s t where rst_assms: \n \"r \\ tocks UNIV\"\n \"r @ s \\ P\"\n \"r @ t \\ Q\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ s \\ x \\\\<^sub>C r\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ t \\ x \\\\<^sub>C r\"\n \"(\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ s \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ t)\"\n unfolding ExtChoiceTT_def by auto\n have in_tocks: \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then have r_def: \"r = \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_refl rst_assms(4) rst_assms(5) rst_assms(6) self_extension_tt_prefix by fastforce\n then have \"r \\ P \\ r \\ Q\"\n by (smt TT1_def TT_TT1 rst_assms assms(1) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset in_tocks rst_assms(4))\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n by (simp add: r_def \\_split case_assms(2))\n next\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\" \"\\'' = []\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n by (simp add: \\_split)\n then obtain r s t where rst_assms: \n \"r \\ tocks UNIV\"\n \"r @ s \\ P\"\n \"r @ t \\ Q\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ s \\ x \\\\<^sub>C r\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ t \\ x \\\\<^sub>C r\"\n \"(\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ s \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ t)\"\n unfolding ExtChoiceTT_def by auto\n have in_tocks: \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then have r_def: \"r = \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_refl rst_assms(4) rst_assms(5) rst_assms(6) self_extension_tt_prefix by fastforce\n then have \"r \\ P \\ r \\ Q\"\n by (smt TT1_def TT_TT1 rst_assms assms(1) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset in_tocks rst_assms(4))\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n by (simp add: r_def \\_split case_assms(2))\n next\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\" \"\\'' = []\" \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n by (simp add: \\_split)\n also have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in bexI, simp_all)\n apply (rule_tac x=\"[]\" in exI, simp_all add: calculation)\n apply (rule_tac x=\"[]\" in exI, simp_all add: calculation)\n by (simp add: \\_split case_assms(2))\n qed\n have set3: \"{e. e = Tock \\ \\'' \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = \n {e. e = Tock \\ \\'' \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\'' \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n proof auto\n assume \"\\'' \\ []\" \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n unfolding ExtChoiceTT_def by auto\n next\n assume \\''_nonempty: \"\\'' \\ []\"\n assume in_P: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n have full_notin_tocks: \"\\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (metis \\''_nonempty \\_split append.assoc tt_prefix_refl nontocks_append_tocks self_extension_tt_prefix tocks.empty_in_tocks tocks.tock_insert_in_tocks top_greatest)\n have \"\\x\\tocks UNIV. x \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C \\'\"\n proof (auto simp add: \\_split)\n fix x :: \"'a ttobs list\"\n assume x_in_tocks: \"x \\ tocks UNIV\"\n assume \"x \\\\<^sub>C \\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n also have \"\\ y. x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n proof -\n fix y\n show \"x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix.elims(2) tt_prefix_antisym by (induct x y rule:tt_prefix.induct, auto, fastforce)\n qed\n then have \"x \\\\<^sub>C \\' @ \\'' \\ x = \\' @ \\'' @ [[X]\\<^sub>R] \\ x = \\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using calculation by force\n then show \"x \\\\<^sub>C \\'\"\n apply auto\n apply (simp add: \\_split x_in_tocks)\n apply (metis append_assoc end_refusal_notin_tocks x_in_tocks)\n using full_notin_tocks x_in_tocks by blast\n qed\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_split)\n apply (rule_tac x=\"\\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in exI, insert \\_split in_P, auto)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\'_in_P_Q)\n done\n next\n assume \\''_nonempty: \"\\'' \\ []\"\n assume in_Q: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n have full_notin_tocks: \"\\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (metis \\''_nonempty \\_split append.assoc tt_prefix_refl nontocks_append_tocks self_extension_tt_prefix tocks.empty_in_tocks tocks.tock_insert_in_tocks top_greatest)\n have \"\\x\\tocks UNIV. x \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C \\'\"\n proof (auto simp add: \\_split)\n fix x :: \"'a ttobs list\"\n assume x_in_tocks: \"x \\ tocks UNIV\"\n assume \"x \\\\<^sub>C \\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n also have \"\\ y. x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n proof -\n fix y\n show \"x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix.elims(2) tt_prefix_antisym by (induct x y rule:tt_prefix.induct, auto, fastforce)\n qed\n then have \"x \\\\<^sub>C \\' @ \\'' \\ x = \\' @ \\'' @ [[X]\\<^sub>R] \\ x = \\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using calculation by force\n then show \"x \\\\<^sub>C \\'\"\n apply auto\n apply (simp add: \\_split x_in_tocks)\n apply (metis append_assoc end_refusal_notin_tocks x_in_tocks)\n using full_notin_tocks x_in_tocks by blast\n qed\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_split)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\'_in_P_Q)\n apply (insert \\_split in_Q, auto)\n done\n qed\n thm set1 set2 set3\n have in_P_or_Q: \"\\ @ [[X]\\<^sub>R] \\ P \\ \\ @ [[X]\\<^sub>R] \\ Q\"\n using assm1 unfolding ExtChoiceTT_def by auto\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n proof (cases \"\\'' \\ []\", auto)\n assume case_assm: \"\\'' \\ []\"\n have \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\n = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n (is \"?lhs = ?rhs\")\n proof -\n have \"?lhs = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n using set1 by auto\n also have \"... = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n using set3 case_assm by auto\n also have \"... = ?rhs\"\n by auto\n then show \"?lhs = ?rhs\"\n using calculation by auto\n qed\n then have \n \"(Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P})\n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}) = {}\"\n using assm2 inf_sup_distrib1 by auto\n then have \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\n \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n by auto\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\ \\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n using TT2w_def TT_def assms(1) assms(2) in_P_or_Q by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_split)\n apply (rule_tac x=\"\\'' @ [[X \\ Y]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\_split \\'_in_P_Q case_assm)\n apply (metis \\_split append.assoc tt_prefix_notfront_is_whole end_refusal_notin_tocks)\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_split)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\_split \\'_in_P_Q case_assm)\n apply (metis \\_split append.assoc tt_prefix_notfront_is_whole end_refusal_notin_tocks)\n done\n next\n assume case_assm: \"\\'' = []\"\n have \"\\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R]\"\n by (induct \\, auto, case_tac a, auto)\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using TT1_ExtChoice TT1_def assm1 assms(1) assms(2) by blast\n then have \"\\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n by (simp add: \\_split case_assm)\n then have in_P_and_Q: \"\\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\ \\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n unfolding ExtChoiceTT_def\n proof auto\n fix \\ \\ \\ :: \"'a ttobs list\"\n assume case_assm1: \"\\ \\ tocks UNIV\"\n assume case_assm2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume case_assm3: \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] = \\ @ \\\"\n assume case_assm4: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume case_assm5: \"\\ @ \\ \\ Q\"\n have \\_def: \"\\ = \\'\"\n by (metis (no_types, lifting) \\_split butlast_append butlast_snoc case_assm1 case_assm2 case_assm3 tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \\_def: \"\\ = [[{e \\ X. e \\ Tock}]\\<^sub>R]\"\n using case_assm3 by blast\n obtain Y where Y_assms: \"\\ = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using case_assm4 by (erule_tac x=\"{e. e \\ X \\ e \\ Tock}\" in allE, simp add: \\_def, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n by (induct \\', auto, case_tac a, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\ Q\"\n using TT1_def TT_TT1 Y_assms(1) \\_def assms(2) case_assm5 by blast\n then show \"\\ @ \\ \\ Q\"\n by (simp add: case_assm3)\n next\n fix \\ \\ \\ :: \"'a ttobs list\"\n assume case_assm1: \"\\ \\ tocks UNIV\"\n assume case_assm2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume case_assm3: \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] = \\ @ \\\"\n assume case_assm4: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume case_assm5: \"\\ @ \\ \\ P\"\n have \\_def: \"\\ = \\'\"\n by (metis (no_types, lifting) \\_split butlast_append butlast_snoc case_assm1 case_assm2 case_assm3 tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \\_def: \"\\ = [[{e \\ X. e \\ Tock}]\\<^sub>R]\"\n using case_assm3 by blast\n obtain Y where Y_assms: \"\\ = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using case_assm4 by (erule_tac x=\"{e. e \\ X \\ e \\ Tock}\" in allE, simp add: \\_def, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n by (induct \\', auto, case_tac a, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\ P\"\n using TT1_def TT_TT1 Y_assms(1) \\_def assms(1) case_assm5 by blast\n then show \"\\ @ \\ \\ P\"\n by (simp add: case_assm3)\n qed\n have notocks_assm2: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \n \\ {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n using set1 assm2 by blast\n have TT2w_P_Q: \"TT2w P \\ TT2w Q\"\n by (simp add: TT_TT2w assms(1) assms(2))\n then have notock_X_Y_in_P_Q: \"\\ @ [[{e. e \\ X \\ Y \\ e \\ Tock}]\\<^sub>R] \\ P \\ \\ @ [[{e. e \\ X \\ Y \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n unfolding TT2w_def\n proof auto\n assume \"\\\\ X Y. \\ @ [[X]\\<^sub>R] \\ P \\ \n Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\\n \\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ P\"\n using in_P_and_Q notocks_assm2 case_assm \\_split by auto\n also have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] = \\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R]\"\n by auto\n then show \"\\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R] \\ P\"\n using calculation by auto\n next\n assume \"\\\\ X Y. \\ @ [[X]\\<^sub>R] \\ Q \\ \n Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {} \\\n \\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n using in_P_and_Q notocks_assm2 case_assm \\_split by auto\n also have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] = \\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R]\"\n by auto\n then show \"\\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n using calculation by auto\n qed\n have in_P_or_Q: \"\\ @ [[X]\\<^sub>R] \\ P \\ \\ @ [[X]\\<^sub>R] \\ Q\"\n using assm1 unfolding ExtChoiceTT_def by auto\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n proof (cases \"Tock \\ Y\")\n assume case_assm2: \"Tock \\ Y\"\n have assm2_nontock_P: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} = {}\"\n using assm2 set1 by auto\n have assm2_nontock_Q: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} = {}\"\n using assm2 set1 by auto\n have \"{e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {}\"\n using assm2 by auto\n then have \"Tock \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n using case_assm2 by auto\n then have \"Tock \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n using set2 case_assm by auto\n then have \"({e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ {e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ {e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ ({e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q)\"\n by auto\n then have \"(Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q)\"\n using assm2_nontock_P assm2_nontock_Q by (safe, blast+)\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n proof safe\n assume case_assm3: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\"\n assume case_assm4: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using in_P_or_Q\n proof auto\n assume case_assm5: \"\\ @ [[X]\\<^sub>R] \\ P\"\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n using TT2w_P_Q case_assm3 unfolding TT2w_def by auto\n also have \"\\ @ [[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R] \\ Q\"\n using notock_X_Y_in_P_Q by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using calculation apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm5: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n using TT2w_P_Q case_assm4 unfolding TT2w_def by auto\n also have \"\\ @ [[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R] \\ P\"\n using notock_X_Y_in_P_Q by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using calculation apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n next\n assume case_assm3: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n assume case_assm4: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n have TT1_P: \"TT1 P\"\n by (simp add: TT_TT1 assms(1))\n have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_subset_same_front by fastforce\n then have in_P: \"\\ @ [[X]\\<^sub>R] \\ P\"\n using TT1_P case_assm3 unfolding TT1_def by auto \n have ttWFx_P: \"ttWFx P\"\n by (simp add: TT_ttWFx assms(1))\n then have \"Tock \\ X\"\n using ttWFx_def ttWFx_end_tock \\'_in_P_Q \\_split case_assm case_assm3 by force\n then have in_Q: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using assm1 unfolding ExtChoiceTT_def\n proof auto\n fix r s t :: \"'a ttobs list\"\n assume 1: \"r \\ tocks UNIV\"\n assume 2: \"r @ s \\ P\"\n assume 3: \"r @ t \\ Q\"\n assume 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ s \\ \\'' \\\\<^sub>C r\"\n assume 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ t \\ \\'' \\\\<^sub>C r\"\n assume 6: \"\\X. s = [[X]\\<^sub>R] \\ (\\Y. t = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 7: \"\\X. t = [[X]\\<^sub>R] \\ (\\Y. s = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 8: \"\\ @ [[X]\\<^sub>R] = r @ s\"\n assume 9: \"Tock \\ X\"\n have r_is_\\: \"r = \\\"\n by (metis \"1\" \"4\" \"8\" \\_split append.right_neutral butlast_append butlast_snoc case_assm tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \"s = [[X]\\<^sub>R]\"\n using \"8\" by blast\n then obtain Y where Y_assms: \"t = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using \"6\" by auto\n then have \"\\ @ [[Y]\\<^sub>R] \\ Q\"\n using \"3\" r_is_\\ by blast\n also have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[Y]\\<^sub>R]\"\n by (metis \"9\" Y_assms(2) tt_prefix_subset.simps(2) tt_prefix_subset_refl tt_prefix_subset_same_front subsetI)\n then have \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using TT1_def TT_TT1 assms(2) calculation by blast\n then show \"r @ s \\ Q\"\n using \"8\" by auto\n qed\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n using TT2w_P_Q TT2w_def case_assm4 by blast\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm3: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n assume case_assm4: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\"\n have TT1_P: \"TT1 Q\"\n by (simp add: TT_TT1 assms(2))\n have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_subset_same_front by fastforce\n then have in_P: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using TT1_P case_assm3 unfolding TT1_def by auto \n have ttWFx_P: \"ttWFx Q\"\n by (simp add: TT_ttWFx assms(2))\n then have \"Tock \\ X\"\n using ttWFx_def ttWFx_end_tock \\'_in_P_Q \\_split case_assm case_assm3 by force\n then have in_P: \"\\ @ [[X]\\<^sub>R] \\ P\"\n using assm1 unfolding ExtChoiceTT_def\n proof auto\n fix r s t :: \"'a ttobs list\"\n assume 1: \"r \\ tocks UNIV\"\n assume 2: \"r @ s \\ P\"\n assume 3: \"r @ t \\ Q\"\n assume 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ s \\ \\'' \\\\<^sub>C r\"\n assume 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ t \\ \\'' \\\\<^sub>C r\"\n assume 6: \"\\X. s = [[X]\\<^sub>R] \\ (\\Y. t = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 7: \"\\X. t = [[X]\\<^sub>R] \\ (\\Y. s = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 8: \"\\ @ [[X]\\<^sub>R] = r @ t\"\n assume 9: \"Tock \\ X\"\n have r_is_\\: \"r = \\\"\n by (metis \"1\" \"5\" \"8\" \\_split append.right_neutral butlast_append butlast_snoc case_assm tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \"t = [[X]\\<^sub>R]\"\n using \"8\" by blast\n then obtain Y where Y_assms: \"s = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using \"7\" by auto\n then have \"\\ @ [[Y]\\<^sub>R] \\ P\"\n using \"2\" r_is_\\ by blast\n also have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[Y]\\<^sub>R]\"\n by (metis \"9\" Y_assms(2) tt_prefix_subset.simps(2) tt_prefix_subset_refl tt_prefix_subset_same_front subsetI)\n then have \"\\ @ [[X]\\<^sub>R] \\ P\"\n using TT1_def TT_TT1 assms(1) calculation by blast\n then show \"r @ t \\ P\"\n using \"8\" by auto\n qed\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n using TT2w_P_Q TT2w_def case_assm4 by blast\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n next\n assume case_assm2: \"Tock \\ Y\"\n then have \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\n = {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Y \\ e \\ Tock} \\ ({e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q})\"\n using set1 by auto\n also have \"... = ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P}) \\ ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q})\"\n by auto\n also have \"... = ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P}) \n \\ ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q})\"\n by auto\n also have \"... = (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P}) \n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q})\"\n using case_assm2 by auto\n then have assm2_expand: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\n \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n using calculation assm2 by auto\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using in_P_or_Q\n proof auto\n assume case_assm3: \"\\ @ [[X]\\<^sub>R] \\ P\"\n have \"TT2w P\"\n by (simp add: TT2w_P_Q)\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n unfolding TT2w_def using case_assm3 assm2_expand by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm3: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n have \"TT2w Q\"\n by (simp add: TT2w_P_Q)\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n unfolding TT2w_def using case_assm3 assm2_expand by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n qed\n qed\nqed\n\nlemma TT2_ExtChoice:\n assumes \"TT P\" \"TT Q\" \"TT2 P\" \"TT2 Q\"\n shows \"TT2 (P \\\\<^sub>C Q)\"\n unfolding TT2_def\nproof auto\n fix \\ \\ X Y\n assume assm1: \"\\ @ [X]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n assume assm2: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {}\"\n from assm1 have \\_\\_wf: \"ttWF (\\ @ [X]\\<^sub>R # \\)\"\n by (metis TT_def ExtChoiceTT_wf assms(1) assms(2))\n then obtain \\' \\'' where \\_\\_split: \"\\'\\tocks UNIV \\ \\ @ [X]\\<^sub>R # \\ = \\' @ \\'' \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C \\ @ [X]\\<^sub>R # \\ \\ t' \\\\<^sub>C \\')\"\n using split_tocks_longest by blast\n then have \\'_\\''_wf: \"ttWF (\\' @ \\'')\"\n using \\_\\_wf by auto \n have \\'_in_P_Q: \"\\' \\ P \\ \\' \\ Q\"\n using assm1 unfolding ExtChoiceTT_def apply auto\n apply (metis TT1_def TT_TT1 \\_\\_split assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n apply (metis TT1_def TT_TT1 \\_\\_split assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n apply (metis TT1_def TT_TT1 \\_\\_split assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n by (metis TT1_def TT_TT1 \\_\\_split assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n have \\'_cases: \"\\' \\\\<^sub>C \\ \\ (\\ \\'. \\' = \\ @ [X]\\<^sub>R # \\' \\ \\' \\\\<^sub>C \\ \\ \\' \\ [])\"\n using \\_\\_split \\'_\\''_wf \\_\\_wf apply -\n proof (induct \\ \\' rule:ttWF2.induct, auto simp add: notin_tocks tt_prefix_concat)\n fix \\ \\' :: \"'a ttobs list\"\n fix Y\n assume \"[Y]\\<^sub>R # [Tock]\\<^sub>E # \\' \\ tocks UNIV\"\n then have 1: \"\\' \\ tocks UNIV\"\n using tocks.cases by auto\n assume \"\\t'\\tocks UNIV. t' \\\\<^sub>C [Y]\\<^sub>R # [Tock]\\<^sub>E # \\' @ \\'' \\ t' \\\\<^sub>C [Y]\\<^sub>R # [Tock]\\<^sub>E # \\'\"\n then have 2: \"\\t'\\tocks UNIV. t' \\\\<^sub>C \\' @ \\'' \\ t' \\\\<^sub>C \\'\"\n using tocks.simps by (auto, erule_tac x=\"[Y]\\<^sub>R # [Tock]\\<^sub>E # t'\" in ballE, auto, blast)\n assume \"\\' \\ tocks UNIV \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C \\' @ \\'' \\ t' \\\\<^sub>C \\') \\ \\' \\\\<^sub>C \\\"\n then show \"\\' \\\\<^sub>C \\\"\n using 1 2 by blast\n next\n fix Xa \\ \\'\n assume \"[Xa]\\<^sub>R # [Tick]\\<^sub>E # \\ @ [X]\\<^sub>R # \\ = \\' @ \\''\" \"ttWF (\\' @ \\'')\"\n then have \"ttWF ([Xa]\\<^sub>R # [Tick]\\<^sub>E # \\ @ [X]\\<^sub>R # \\)\"\n by auto\n then show \"\\' \\\\<^sub>C [Xa]\\<^sub>R # [Tick]\\<^sub>E # \\\"\n by auto\n next\n fix Xa e \\ \\'\n assume \"[Xa]\\<^sub>R # [Event e]\\<^sub>E # \\ @ [X]\\<^sub>R # \\ = \\' @ \\''\" \"ttWF (\\' @ \\'')\"\n then have \"ttWF ([Xa]\\<^sub>R # [Event e]\\<^sub>E # \\ @ [X]\\<^sub>R # \\)\"\n by auto\n then show \"\\' \\\\<^sub>C [Xa]\\<^sub>R # [Event e]\\<^sub>E # \\\"\n by auto\n next\n fix Xa Y \\ \\'\n assume \"[Xa]\\<^sub>R # [Y]\\<^sub>R # \\ @ [X]\\<^sub>R # \\ = \\' @ \\''\" \"ttWF (\\' @ \\'')\"\n then have \"ttWF ([Xa]\\<^sub>R # [Y]\\<^sub>R # \\ @ [X]\\<^sub>R # \\)\"\n by auto\n then show \"\\' \\\\<^sub>C [Xa]\\<^sub>R # [Y]\\<^sub>R # \\\"\n by auto\n next\n fix x \\ \\'\n assume \"[Tick]\\<^sub>E # x # \\ @ [X]\\<^sub>R # \\ = \\' @ \\''\" \"ttWF (\\' @ \\'')\"\n then have \"ttWF ([Tick]\\<^sub>E # x # \\ @ [X]\\<^sub>R # \\)\"\n by auto\n then show \"\\' \\\\<^sub>C [Tick]\\<^sub>E # x # \\\"\n by auto\n next\n fix \\ \\'\n assume \"[Tock]\\<^sub>E # \\ @ [X]\\<^sub>R # \\ = \\' @ \\''\" \"ttWF (\\' @ \\'')\"\n then have \"ttWF ([Tock]\\<^sub>E # \\ @ [X]\\<^sub>R # \\)\"\n by auto\n then show \"\\' \\\\<^sub>C [Tock]\\<^sub>E # \\\"\n by auto\n qed\n then show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof auto\n assume case_assms: \"\\' \\\\<^sub>C \\\"\n then obtain \\2 where \\2_def: \"\\ = \\' @ \\2\"\n using tt_prefix_decompose by blast\n have set1: \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q}\"\n proof auto\n fix x :: \"'a ttevent\"\n assume \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n then have \"\\ @ [[x]\\<^sub>E] \\ P \\ \\ @ [[x]\\<^sub>E] \\ Q\"\n unfolding ExtChoiceTT_def by auto\n then show \"\\ @ [[x]\\<^sub>E] \\ Q \\ \\ @ [[x]\\<^sub>E] \\ P\"\n by auto\n next\n fix x :: \"'a ttevent\"\n assume \"x \\ Tock\" \"\\ @ [[x]\\<^sub>E] \\ P\"\n then show \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split)\n apply (rule_tac x=\"\\2 @ [[x]\\<^sub>E]\" in exI, simp_all add: \\2_def)\n apply (rule_tac x=\"[]\" in exI, simp add: \\'_in_P_Q)\n by (metis \\2_def \\_\\_split append.assoc tt_prefix_concat tt_prefix_trans tocks_tt_prefix_end_event)\n next\n fix x :: \"'a ttevent\"\n assume \"x \\ Tock\" \"\\ @ [[x]\\<^sub>E] \\ Q\"\n then show \"\\ @ [[x]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split)\n apply (rule_tac x=\"[]\" in exI, simp add: \\'_in_P_Q)\n apply (rule_tac x=\"\\2 @ [[x]\\<^sub>E]\" in exI, simp_all add: \\2_def)\n by (metis \\2_def \\_\\_split append.assoc tt_prefix_concat tt_prefix_trans tocks_tt_prefix_end_event)\n qed\n have set2: \"{e. e = Tock \\ \\2 = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = \n {e. e = Tock \\ \\2 = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\2 = [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n proof auto\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\" \"\\2 = []\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n using \\2_def \\_\\_split by auto\n then obtain r s t where rst_assms: \n \"r \\ tocks UNIV\"\n \"r @ s \\ P\"\n \"r @ t \\ Q\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ s \\ x \\\\<^sub>C r\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ t \\ x \\\\<^sub>C r\"\n \"(\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ s \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ t)\"\n unfolding ExtChoiceTT_def by auto\n have in_tocks: \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_\\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then have r_def: \"r = \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_refl rst_assms(4) rst_assms(5) rst_assms(6) self_extension_tt_prefix by fastforce\n then have \"r \\ P \\ r \\ Q\"\n by (smt TT1_def TT_TT1 rst_assms assms(1) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset in_tocks rst_assms(4))\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n by (simp add: \\2_def case_assms(2) r_def)\n next\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\" \"\\2 = []\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n using \\2_def \\_\\_split by auto\n then obtain r s t where rst_assms: \n \"r \\ tocks UNIV\"\n \"r @ s \\ P\"\n \"r @ t \\ Q\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ s \\ x \\\\<^sub>C r\"\n \"\\x\\tocks UNIV. x \\\\<^sub>C r @ t \\ x \\\\<^sub>C r\"\n \"(\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ s \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] = r @ t)\"\n unfolding ExtChoiceTT_def by auto\n have in_tocks: \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_\\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then have r_def: \"r = \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_refl rst_assms(4) rst_assms(5) rst_assms(6) self_extension_tt_prefix by fastforce\n then have \"r \\ P \\ r \\ Q\"\n by (smt TT1_def TT_TT1 rst_assms assms(1) assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset in_tocks rst_assms(4))\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n by (simp add: \\2_def case_assms(2) r_def)\n next\n assume case_assms: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\" \"\\2 = []\" \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ \\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n using \\2_def \\_\\_split by auto\n also have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (simp add: \\_\\_split tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in bexI, simp_all)\n apply (rule_tac x=\"[]\" in exI, simp_all add: calculation)\n apply (rule_tac x=\"[]\" in exI, simp_all add: calculation)\n using \\2_def \\_\\_split case_assms(2) by auto\n qed\n have set3: \"{e. e = Tock \\ \\2 \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} =\n {e. e = Tock \\ \\2 \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\2 \\ [] \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n proof auto\n assume \"\\2 \\ []\" \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n unfolding ExtChoiceTT_def by auto\n next\n assume \\2_nonempty: \"\\2 \\ []\"\n assume in_P: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n have \\2_notin_tocks: \"\\2 \\ tocks UNIV\"\n proof auto\n assume \"\\2 \\ tocks UNIV\"\n then have \"\\' @ \\2 \\ tocks UNIV\"\n using \\_\\_split tocks_append_tocks by blast\n then have \"\\' @ \\2 \\\\<^sub>C \\'\"\n using \\2_def \\_\\_split tt_prefix_concat by blast\n then have \"\\2 = []\"\n using self_extension_tt_prefix by blast\n then show \"False\"\n using \\2_nonempty by auto\n qed\n have full_notin_tocks: \"\\' @ \\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n using \\2_notin_tocks \\_\\_split tocks_append_nontocks tocks_mid_refusal_front_in_tocks by blast\n have \"\\x\\tocks UNIV. x \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C \\'\"\n proof (auto simp add: \\2_def \\_\\_split)\n fix x :: \"'a ttobs list\"\n assume x_in_tocks: \"x \\ tocks UNIV\"\n assume \"x \\\\<^sub>C \\' @ \\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n also have \"\\ y. x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n proof -\n fix y\n show \"x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix.elims(2) tt_prefix_antisym by (induct x y rule:tt_prefix.induct, auto, fastforce)\n qed\n then have \"x \\\\<^sub>C \\' @ \\2 \\ x = \\' @ \\2 @ [[X]\\<^sub>R] \\ x = \\' @ \\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using calculation by force\n then show \"x \\\\<^sub>C \\'\"\n apply (auto simp add: \\2_def \\_\\_split x_in_tocks)\n using \\2_def \\_\\_split tt_prefix_concat tt_prefix_trans x_in_tocks apply blast\n apply (metis append_assoc end_refusal_notin_tocks x_in_tocks)\n using full_notin_tocks x_in_tocks by blast\n qed\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_\\_split)\n apply (rule_tac x=\"\\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in exI, insert \\2_def \\_\\_split in_P, auto)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\'_in_P_Q)\n done\n next\n assume \\2_nonempty: \"\\2 \\ []\"\n assume in_Q: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n have \\2_notin_tocks: \"\\2 \\ tocks UNIV\"\n proof auto\n assume \"\\2 \\ tocks UNIV\"\n then have \"\\' @ \\2 \\ tocks UNIV\"\n using \\_\\_split tocks_append_tocks by blast\n then have \"\\' @ \\2 \\\\<^sub>C \\'\"\n using \\2_def \\_\\_split tt_prefix_concat by blast\n then have \"\\2 = []\"\n using self_extension_tt_prefix by blast\n then show \"False\"\n using \\2_nonempty by auto\n qed\n then have full_notin_tocks: \"\\' @ \\'' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (metis \\2_def \\_\\_split append.assoc tocks_append_nontocks tocks_mid_refusal_front_in_tocks)\n have \"\\x\\tocks UNIV. x \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C \\'\"\n proof (auto simp add: \\_\\_split \\2_def)\n fix x :: \"'a ttobs list\"\n assume x_in_tocks: \"x \\ tocks UNIV\"\n assume \"x \\\\<^sub>C \\' @ \\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n also have \"\\ y. x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n proof -\n fix y\n show \"x \\\\<^sub>C y @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ x \\\\<^sub>C y \\ x = y @ [[X]\\<^sub>R] \\ x = y @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix.elims(2) tt_prefix_antisym by (induct x y rule:tt_prefix.induct, auto, fastforce)\n qed\n then have \"x \\\\<^sub>C \\' @ \\2 \\ x = \\' @ \\2 @ [[X]\\<^sub>R] \\ x = \\' @ \\2 @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using calculation by force\n then show \"x \\\\<^sub>C \\'\"\n apply auto\n using \\2_def \\_\\_split tt_prefix_concat tt_prefix_trans x_in_tocks apply blast\n apply (metis append_assoc end_refusal_notin_tocks x_in_tocks)\n using \\2_notin_tocks \\_\\_split tocks_append_nontocks tocks_mid_refusal_front_in_tocks x_in_tocks by blast\n qed\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\_\\_split)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\2_def \\'_in_P_Q)\n apply (insert \\2_def \\_\\_split in_Q, auto)\n done\n qed\n thm set1 set2 set3\n have in_P_or_Q: \"\\ @ [X]\\<^sub>R # \\ \\ P \\ \\ @ [X]\\<^sub>R # \\ \\ Q\"\n using assm1 unfolding ExtChoiceTT_def by auto\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\2 \\ []\", auto)\n assume case_assm: \"\\2 \\ []\"\n have full_pretocks: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\2 @ [X \\ Y]\\<^sub>R # \\ \\ \\'' \\\\<^sub>C \\'\"\n proof -\n have \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\2 @ [X]\\<^sub>R # \\ \\ \\'' \\\\<^sub>C \\'\"\n by (simp add: \\2_def \\_\\_split)\n also have \"\\2 @ [X]\\<^sub>R # \\ \\\\<^sub>C \\2 @ [X \\ Y]\\<^sub>R # \\\"\n by (simp add: tt_subset_combine tt_subset_refl)\n then show ?thesis\n using calculation tt_subset_longest_tocks3 by blast\n qed\n have \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\n = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n (is \"?lhs = ?rhs\")\n proof -\n have \"?lhs = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n using set1 by auto\n also have \"... = {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n using set3 case_assm by auto\n also have \"... = ?rhs\"\n by auto\n then show \"?lhs = ?rhs\"\n using calculation by auto\n qed\n then have \n \"(Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P})\n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}) = {}\"\n using assm2 inf_sup_distrib1 by auto\n then have \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\n \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n by auto\n then have \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\ \\ @ [X \\ Y]\\<^sub>R # \\ \\ Q\"\n using assms(3) assms(4) in_P_or_Q unfolding TT2_def by auto\n then show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\2_def \\_\\_split)\n apply (rule_tac x=\"\\2 @ [[X \\ Y]\\<^sub>R] @ \\\" in exI, auto)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\2_def \\_\\_split \\'_in_P_Q case_assm full_pretocks)\n apply (metis Cons_eq_append_conv Nil_is_append_conv case_assm list.simps(3))\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\2_def \\_\\_split)\n apply (rule_tac x=\"[]\" in exI, auto simp add: \\2_def \\_\\_split \\'_in_P_Q case_assm full_pretocks)\n apply (metis Cons_eq_append_conv Nil_is_append_conv case_assm list.simps(3))\n done\n next\n assume case_assm: \"\\2 = []\"\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\ \\ []\", auto)\n assume case_assm2: \"\\ \\ []\"\n have \\_Tock_start: \"\\ \\'. \\ = [Tock]\\<^sub>E # \\'\"\n using assm1 case_assm2 apply (cases \\ rule:ttWF.cases, auto)\n using \\'_\\''_wf \\2_def \\_\\_split case_assm tocks_append_wf2 by force+\n then have False\n using \\_\\_split \\2_def case_assm\n proof auto\n fix \\'\n assume \"\\t'\\tocks UNIV. t' \\\\<^sub>C \\' @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\' \\ t' \\\\<^sub>C \\'\" \"\\' \\ tocks UNIV\"\n then have \"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\\\<^sub>C \\'\"\n by (erule_tac x=\"\\' @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, auto simp add: tt_prefix_same_front tocks.intros tocks_append_tocks)\n then show False\n using self_extension_tt_prefix by blast\n qed\n then show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n by simp\n next\n assume case_assm2: \"\\ = []\" \n have \"\\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R]\"\n by (induct \\, auto, case_tac a, auto)\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using TT1_ExtChoice TT1_def assm1 assms(1) assms(2) case_assm2 by blast\n then have \"\\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using \\2_def \\_\\_split case_assm by auto\n then have in_P_and_Q: \"\\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ P \\ \\' @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n unfolding ExtChoiceTT_def\n proof auto\n fix \\ \\ \\ :: \"'a ttobs list\"\n assume case_assm1: \"\\ \\ tocks UNIV\"\n assume case_assm2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume case_assm3: \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] = \\ @ \\\"\n assume case_assm4: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume case_assm5: \"\\ @ \\ \\ Q\"\n have \\_def: \"\\ = \\'\"\n by (metis (no_types, lifting) \\_\\_split butlast_append butlast_snoc case_assm1 case_assm2 case_assm3 tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \\_def: \"\\ = [[{e \\ X. e \\ Tock}]\\<^sub>R]\"\n using case_assm3 by blast\n obtain Y where Y_assms: \"\\ = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using case_assm4 by (erule_tac x=\"{e. e \\ X \\ e \\ Tock}\" in allE, simp add: \\_def, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n by (induct \\', auto, case_tac a, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\ Q\"\n using TT1_def TT_TT1 Y_assms(1) \\_def assms(2) case_assm5 by blast\n then show \"\\ @ \\ \\ Q\"\n by (simp add: case_assm3)\n next\n fix \\ \\ \\ :: \"'a ttobs list\"\n assume case_assm1: \"\\ \\ tocks UNIV\"\n assume case_assm2: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume case_assm3: \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] = \\ @ \\\"\n assume case_assm4: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume case_assm5: \"\\ @ \\ \\ P\"\n have \\_def: \"\\ = \\'\"\n by (metis (no_types, lifting) \\_\\_split butlast_append butlast_snoc case_assm1 case_assm2 case_assm3 tt_prefix_antisym tt_prefix_concat end_refusal_notin_tocks)\n then have \\_def: \"\\ = [[{e \\ X. e \\ Tock}]\\<^sub>R]\"\n using case_assm3 by blast\n obtain Y where Y_assms: \"\\ = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using case_assm4 by (erule_tac x=\"{e. e \\ X \\ e \\ Tock}\" in allE, simp add: \\_def, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\\\<^sub>C \\' @ [[Y]\\<^sub>R]\"\n by (induct \\', auto, case_tac a, auto)\n then have \"\\' @ [[{e \\ X. e \\ Tock}]\\<^sub>R] \\ P\"\n using TT1_def TT_TT1 Y_assms(1) \\_def assms(1) case_assm5 by blast\n then show \"\\ @ \\ \\ P\"\n by (simp add: case_assm3)\n qed\n have notocks_assm2: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \n \\ {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[{e. e \\ X \\ e \\ Tock}]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n using set1 assm2 by blast\n have TT2w_P_Q: \"TT2w P \\ TT2w Q\"\n by (simp add: TT_TT2w assms(1) assms(2))\n then have notock_X_Y_in_P_Q: \"\\ @ [[{e. e \\ X \\ Y \\ e \\ Tock}]\\<^sub>R] \\ P \\ \\ @ [[{e. e \\ X \\ Y \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n unfolding TT2w_def\n proof auto\n assume \"\\\\ X Y. \\ @ [[X]\\<^sub>R] \\ P \\ \n Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\\n \\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ P\"\n using \\2_def case_assm in_P_and_Q notocks_assm2 by auto\n also have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] = \\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R]\"\n by auto\n then show \"\\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R] \\ P\"\n using calculation by auto\n next\n assume \"\\\\ X Y. \\ @ [[X]\\<^sub>R] \\ Q \\ \n Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {} \\\n \\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n then have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n using \\2_def case_assm in_P_and_Q notocks_assm2 by auto\n also have \"\\ @ [[{e. e \\ X \\ e \\ Tock} \\ {e. e \\ Y \\ e \\ Tock}]\\<^sub>R] = \\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R]\"\n by auto\n then show \"\\ @ [[{e. (e \\ X \\ e \\ Y) \\ e \\ Tock}]\\<^sub>R] \\ Q\"\n using calculation by auto\n qed\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n proof (cases \"Tock \\ Y\")\n assume case_assm3: \"Tock \\ Y\"\n have assm2_nontock_P: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} = {}\"\n using assm2 set1 by auto\n have assm2_nontock_Q: \"{e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q} = {}\"\n using assm2 set1 by auto\n have \"{e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} = {}\"\n using assm2 by auto\n then have \"Tock \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n using case_assm3 by auto\n then have \"Tock \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n using set2 case_assm by auto\n then have \"({e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ {e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ {e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ ({e. e \\ Y \\ e = Tock} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q)\"\n by auto\n then have \"(Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {})\n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {} \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q)\"\n using assm2_nontock_P assm2_nontock_Q by (safe, blast+)\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n proof safe\n assume case_assm4: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\"\n assume case_assm5: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using in_P_or_Q case_assm case_assm2 \\2_def\n proof auto\n assume case_assm6: \"\\' @ [[X]\\<^sub>R] \\ P\"\n then have \"\\' @ [[X \\ Y]\\<^sub>R] \\ P\"\n using TT2w_P_Q case_assm4 \\2_def case_assm unfolding TT2w_def by auto\n also have \"\\' @ [[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R] \\ Q\"\n using notock_X_Y_in_P_Q \\2_def case_assm by auto\n then show \"\\' @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using calculation apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm6: \"\\' @ [[X]\\<^sub>R] \\ Q\"\n then have \"\\' @ [[X \\ Y]\\<^sub>R] \\ Q\"\n using TT2w_P_Q case_assm5 \\2_def case_assm unfolding TT2w_def by auto\n also have \"\\' @ [[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R] \\ P\"\n using notock_X_Y_in_P_Q \\2_def case_assm by auto\n then show \"\\' @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using calculation apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n next\n assume case_assm3: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n assume case_assm4: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n have TT1_P: \"TT1 P\"\n by (simp add: TT_TT1 assms(1))\n have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_subset_same_front by fastforce\n then have in_P: \"\\ @ [[X]\\<^sub>R] \\ P\"\n using TT1_P case_assm3 unfolding TT1_def by auto \n have ttWFx_P: \"ttWFx P\"\n by (simp add: TT_ttWFx assms(1))\n then have \"Tock \\ X\"\n using ttWFx_any_cons_end_tock case_assm3 by blast\n then have in_Q: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using assm1 case_assm2 unfolding ExtChoiceTT_def\n proof auto\n fix r s t :: \"'a ttobs list\"\n assume 1: \"r \\ tocks UNIV\"\n assume 2: \"r @ s \\ P\"\n assume 3: \"r @ t \\ Q\"\n assume 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ s \\ \\'' \\\\<^sub>C r\"\n assume 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ t \\ \\'' \\\\<^sub>C r\"\n assume 6: \"\\X. s = [[X]\\<^sub>R] \\ (\\Y. t = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 7: \"\\X. t = [[X]\\<^sub>R] \\ (\\Y. s = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 8: \"\\ @ [[X]\\<^sub>R] = r @ s\"\n assume 9: \"Tock \\ X\"\n have r_is_\\: \"r = \\\"\n by (metis \"1\" \"4\" \"8\" \\2_def \\_\\_split append_Nil2 case_assm case_assm2 tt_prefix_antisym tt_prefix_concat)\n then have \"s = [[X]\\<^sub>R]\"\n using \"8\" by blast\n then obtain Y where Y_assms: \"t = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using \"6\" by auto\n then have \"\\ @ [[Y]\\<^sub>R] \\ Q\"\n using \"3\" r_is_\\ by blast\n also have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[Y]\\<^sub>R]\"\n by (metis \"9\" Y_assms(2) tt_prefix_subset.simps(2) tt_prefix_subset_refl tt_prefix_subset_same_front subsetI)\n then have \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using TT1_def TT_TT1 assms(2) calculation by blast\n then show \"r @ s \\ Q\"\n using \"8\" by auto\n qed\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n using TT2w_P_Q TT2w_def case_assm4 by blast\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto simp add: \\2_def case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm4: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n assume case_assm5: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\"\n have TT1_Q: \"TT1 Q\"\n by (simp add: TT_TT1 assms(2))\n have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\"\n using tt_prefix_subset_same_front by fastforce\n then have in_Q: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n using TT1_Q TT1_def case_assm4 by blast\n have ttWFx_Q: \"ttWFx Q\"\n by (simp add: TT_ttWFx assms(2))\n then have \"Tock \\ X\"\n using ttWFx_any_cons_end_tock case_assm4 by blast\n then have in_P: \"\\ @ [[X]\\<^sub>R] \\ P\"\n using assm1 case_assm2 unfolding ExtChoiceTT_def\n proof auto\n fix r s t :: \"'a ttobs list\"\n assume 1: \"r \\ tocks UNIV\"\n assume 2: \"r @ s \\ P\"\n assume 3: \"r @ t \\ Q\"\n assume 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ s \\ \\'' \\\\<^sub>C r\"\n assume 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C r @ t \\ \\'' \\\\<^sub>C r\"\n assume 6: \"\\X. s = [[X]\\<^sub>R] \\ (\\Y. t = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 7: \"\\X. t = [[X]\\<^sub>R] \\ (\\Y. s = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 8: \"\\ @ [[X]\\<^sub>R] = r @ t\"\n assume 9: \"Tock \\ X\"\n have r_is_\\: \"r = \\\"\n by (metis \"1\" \"5\" \"8\" \\2_def \\_\\_split append_Nil2 case_assm case_assm2 tt_prefix_antisym tt_prefix_concat)\n then have \"t = [[X]\\<^sub>R]\"\n using \"8\" by blast\n then obtain Y where Y_assms: \"s = [[Y]\\<^sub>R]\" \"\\e. (e \\ X) = (e \\ Y) \\ e = Tock\"\n using \"7\" by auto\n then have \"\\ @ [[Y]\\<^sub>R] \\ P\"\n using \"2\" r_is_\\ by blast\n also have \"\\ @ [[X]\\<^sub>R] \\\\<^sub>C \\ @ [[Y]\\<^sub>R]\"\n by (metis \"9\" Y_assms(2) tt_prefix_subset.simps(2) tt_prefix_subset_refl tt_prefix_subset_same_front subsetI)\n then have \"\\ @ [[X]\\<^sub>R] \\ P\"\n using TT1_def TT_TT1 assms(1) calculation by blast\n then show \"r @ t \\ P\"\n using \"8\" by auto\n qed\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n using TT2w_P_Q TT2w_def case_assm5 by blast\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all add: \\2_def case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n next\n assume case_assm3: \"Tock \\ Y\"\n then have \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\n = {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q}\"\n by auto\n also have \"... = {e. e \\ Y \\ e \\ Tock} \\ ({e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q})\"\n using set1 by auto\n also have \"... = ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P}) \\ ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q})\"\n by auto\n also have \"... = ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P}) \n \\ ({e. e \\ Y \\ e \\ Tock} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q})\"\n by auto\n also have \"... = (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P}) \n \\ (Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q})\"\n using case_assm3 by auto\n then have assm2_expand: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\n \\ Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n using calculation assm2 by auto\n show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n using in_P_or_Q case_assm2\n proof auto\n assume case_assm4: \"\\ @ [[X]\\<^sub>R] \\ P\"\n have \"TT2w P\"\n by (simp add: TT2w_P_Q)\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ P\"\n unfolding TT2w_def using case_assm4 assm2_expand by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all add: \\2_def case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n next\n assume case_assm4: \"\\ @ [[X]\\<^sub>R] \\ Q\"\n have \"TT2w Q\"\n by (simp add: TT2w_P_Q)\n then have \"\\ @ [[X \\ Y]\\<^sub>R] \\ Q\"\n unfolding TT2w_def using case_assm4 assm2_expand by auto\n then show \"\\ @ [[X \\ Y]\\<^sub>R] \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using notock_X_Y_in_P_Q apply auto\n apply (rule_tac x=\"\\'\" in bexI, simp_all add: \\_\\_split case_assm)\n apply (rule_tac x=\"[[{e \\ X \\ Y. e \\ Tock}]\\<^sub>R]\" in exI, auto simp add: \\2_def case_assm)\n apply (rule_tac x=\"[[X \\ Y]\\<^sub>R]\" in exI, simp_all)\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by blast+\n qed\n qed\n qed\n qed\n next\n fix \\'\n assume case_assms: \"\\' = \\ @ [X]\\<^sub>R # \\'\" \"\\' \\ []\" \"\\' \\\\<^sub>C \\\"\n have \\_Tock_in_tocks: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ tocks UNIV\"\n by (metis \\_\\_split case_assms(1) tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks tocks_mid_refusal tocks_mid_refusal_front_in_tocks)\n obtain \\'' where \\'_Tock_start: \"\\' = [Tock]\\<^sub>E # \\''\"\n using case_assms apply (cases \\' rule:ttWF.cases, auto)\n using TT_TTwf TTwf_cons_end_not_refusal_refusal \\'_in_P_Q assms(1) apply blast\n using TT_TTwf TTwf_no_ill_Tock \\'_in_P_Q assms(1) apply blast\n using \\'_\\''_wf \\_Tock_in_tocks tocks_append_wf2 tocks_mid_refusal_front_in_tocks apply fastforce\n using \\'_\\''_wf \\_\\_split ttWF.simps(13) ttWF_prefix_is_ttWF tocks_append_wf2 tocks_mid_refusal_front_in_tocks apply blast\n using \\'_\\''_wf \\_\\_split ttWF.simps(12) ttWF_prefix_is_ttWF tocks_append_wf2 tocks_mid_refusal_front_in_tocks apply (blast, blast)\n using \\'_\\''_wf \\_\\_split ttWF.simps(13) ttWF_prefix_is_ttWF tocks_append_wf2 tocks_mid_refusal_front_in_tocks apply blast+\n done\n then obtain \\''' where \\'''_def: \"\\ = [Tock]\\<^sub>E # \\'' @ \\'''\"\n using case_assms(3) tt_prefix_decompose by fastforce\n then have \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ \\''' \\ P \\\\<^sub>C Q\"\n using assm1 by blast\n then have \\_Tock_in_P_Q: \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P \\ \\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n unfolding ExtChoiceTT_def\n proof auto\n fix \\' \\ \\\n assume 1: \"\\' @ \\ \\ P\"\n assume 2: \"\\' @ \\ \\ Q\"\n assume 3: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume 4: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ \\''' = \\' @ \\\"\n have \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\\\<^sub>C \\'\"\n using 3 4 apply (erule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, simp_all add: \\_Tock_in_tocks)\n by (metis \\_Tock_in_tocks tt_prefix.simps(1) tt_prefix.simps(2) tt_prefix_same_front)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n by (meson \"1\" TT1_def TT_TT1 assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n next\n fix \\' \\ \\\n assume 1: \"\\' @ \\ \\ P\"\n assume 2: \"\\' @ \\ \\ Q\"\n assume 3: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume 4: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ \\''' = \\' @ \\\"\n have \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\\\<^sub>C \\'\"\n using 3 4 apply (erule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, simp_all add: \\_Tock_in_tocks)\n by (metis \\_Tock_in_tocks tt_prefix.simps(1) tt_prefix.simps(2) tt_prefix_same_front)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n by (meson \"2\" TT1_def TT_TT1 assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n next\n fix \\' \\ \\\n assume 1: \"\\' @ \\ \\ P\"\n assume 2: \"\\' @ \\ \\ Q\"\n assume 3: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume 4: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ \\''' = \\' @ \\\"\n have \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\\\<^sub>C \\'\"\n using 3 4 apply (erule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, simp_all add: \\_Tock_in_tocks)\n by (metis \\_Tock_in_tocks tt_prefix.simps(1) tt_prefix.simps(2) tt_prefix_same_front)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ Q\"\n by (meson \"2\" TT1_def TT_TT1 assms(2) tt_prefix_concat tt_prefix_imp_prefix_subset)\n next\n fix \\' \\ \\\n assume 1: \"\\' @ \\ \\ P\"\n assume 2: \"\\' @ \\ \\ Q\"\n assume 3: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume 4: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ \\''' = \\' @ \\\"\n have \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\\\<^sub>C \\'\"\n using 3 4 apply (erule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in ballE, simp_all add: \\_Tock_in_tocks)\n by (metis \\_Tock_in_tocks tt_prefix.simps(1) tt_prefix.simps(2) tt_prefix_same_front)\n then show \"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\ P\"\n by (meson \"1\" TT1_def TT_TT1 assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset)\n qed\n then have set1: \"{e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} =\n {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in bexI, simp_all add: \\_Tock_in_tocks)\n apply (rule_tac x=\"[]\" in exI, simp, rule_tac x=\"[]\" in exI, simp)\n apply (rule_tac x=\"\\ @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in bexI, simp_all add: \\_Tock_in_tocks)\n apply (rule_tac x=\"[]\" in exI, simp, rule_tac x=\"[]\" in exI, simp)\n done\n have set2: \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q} =\n {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q}\"\n unfolding ExtChoiceTT_def apply auto\n apply (rule_tac x=\"\\\" in bexI, rule_tac x=\"[[x]\\<^sub>E]\" in exI, simp, rule_tac x=\"[]\" in exI, simp)\n apply (metis TT1_def TT_TT1 \\'_in_P_Q assms(2) case_assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset tocks_tt_prefix_end_event)\n using \\_\\_split case_assms(1) tocks_mid_refusal_front_in_tocks apply blast\n apply (rule_tac x=\"\\\" in bexI, rule_tac x=\"[]\" in exI, simp)\n apply (metis TT1_def TT_TT1 \\'_in_P_Q assms(1) case_assms(1) tt_prefix_concat tt_prefix_imp_prefix_subset tocks_tt_prefix_end_event)\n by (metis \\_\\_split case_assms(1) tocks_mid_refusal_front_in_tocks)\n have \"{e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\\\<^sub>C Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P \\\\<^sub>C Q} =\n {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}\"\n using set1 set2 by blast\n then have set3: \"Y \\ ({e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q}) = {}\"\n using assm2 by auto\n have P_assm2: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ P \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ P} = {}\"\n using set3 by blast\n have Q_assm2: \"Y \\ {e. e \\ Tock \\ \\ @ [[e]\\<^sub>E] \\ Q \\ e = Tock \\ \\ @ [[X]\\<^sub>R, [e]\\<^sub>E] \\ Q} = {}\"\n using set3 by blast\n have \\'_subset: \"\\ @ [X]\\<^sub>R # \\' \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\'\"\n by (metis tt_subset.simps(2) tt_subset_combine tt_subset_refl inf_sup_absorb inf_sup_ord(2))\n have A: \"\\ @ [X \\ Y]\\<^sub>R # \\' \\ tocks UNIV\"\n by (metis \\'_subset \\_\\_split case_assms(1) tocks_tt_subset2)\n have \\_X_\\'_longest_pretocks: \"\\t'\\tocks UNIV. t' \\\\<^sub>C \\ @ [X]\\<^sub>R # \\ \\ t' \\\\<^sub>C \\ @ [X]\\<^sub>R # \\'\"\n by (metis \\_\\_split case_assms(1))\n then have B: \"\\t'\\tocks UNIV. t' \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\ \\ t' \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\'\"\n using \\'_subset \\'''_def \\'_Tock_start tt_subset_longest_tocks4[where ?s1.0=\"\\ @ [X]\\<^sub>R # \\'\", where s1'=\"\\ @ [X \\ Y]\\<^sub>R # \\'\"] by auto\n have \"\\ @ [X]\\<^sub>R # \\ \\ P \\ \\ @ [X]\\<^sub>R # \\ \\ Q\"\n using assm1 unfolding ExtChoiceTT_def by auto\n then show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof auto\n assume in_P: \"\\ @ [X]\\<^sub>R # \\ \\ P\"\n have 1: \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P\"\n using assms(3) P_assm2 in_P unfolding TT2_def by force\n have 2: \"\\ @ [X \\ Y]\\<^sub>R # \\' \\ Q\"\n using assms(4) Q_assm2 \\'_in_P_Q case_assms unfolding TT2_def by force\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\ Z. \\''' = [[Z]\\<^sub>R]\", auto)\n fix Z\n assume \\'''_is_ref: \"\\''' = [[Z]\\<^sub>R]\"\n then have \"\\ W. \\ @ [X]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ Q \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using assm1 in_P \\'''_def \\'_Tock_start unfolding ExtChoiceTT_def\n proof auto\n fix \\' \\'''' \\ :: \"'a ttobs list\"\n assume 1: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\'''' \\ \\'' \\\\<^sub>C \\'\"\n assume 2: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[Z]\\<^sub>R] = \\' @ \\''''\"\n assume 3: \"\\' \\ tocks UNIV\"\n assume 4: \"\\X. \\'''' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 5: \"\\' @ \\ \\ Q\"\n have \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' \\\\<^sub>C \\'\"\n by (metis 1 2 \\_\\_split \\'''_def \\'''_is_ref \\'_Tock_start case_assms(1) tt_prefix_concat)\n then have \\'_def: \"\\' = \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\''\"\n using \"2\" \"3\" \\_X_\\'_longest_pretocks \\'''_def \\'''_is_ref \\'_Tock_start tt_prefix_antisym tt_prefix_concat by fastforce\n then have \"\\'''' = [[Z]\\<^sub>R]\"\n using \"2\" by auto\n then show \"\\W. \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[W]\\<^sub>R] \\ Q \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using 4 5 \\'_def by auto\n next\n fix \\' \\'''' \\ :: \"'a ttobs list\"\n assume 1: \"\\' @ \\ \\ Q\" \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[Z]\\<^sub>R] = \\' @ \\\"\n then show \"\\W. \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[W]\\<^sub>R] \\ Q \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n by force\n qed\n then obtain W where \"\\ @ [X]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ Q \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n by blast\n then have C: \"\\ @ [X \\ Y]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ Q \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using assms(4) Q_assm2 unfolding TT2_def by auto\n have D: \"\\ t\\tocks UNIV. t \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ t \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\'\"\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by force\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using in_P \\'''_is_ref \\'''_def \\'_Tock_start \\_\\_split case_assms 1 2 A B C D apply auto\n by (rule_tac x=\"\\ @ [X \\ Y]\\<^sub>R # \\'\" in bexI, auto, rule_tac x=\"\\'''\" in exI, auto, rule_tac x=\"[[W]\\<^sub>R]\" in exI, blast)\n next\n show \"\\Z. \\''' \\ [[Z]\\<^sub>R] \\ \\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using in_P \\'''_def \\'_Tock_start \\_\\_split case_assms 1 2 A B apply auto\n by (rule_tac x=\"\\ @ [X \\ Y]\\<^sub>R # \\'\" in bexI, auto, rule_tac x=\"\\'''\" in exI, auto, rule_tac x=\"[]\" in exI, auto)\n qed\n next\n assume in_Q: \"\\ @ [X]\\<^sub>R # \\ \\ Q\"\n have 1: \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ Q\"\n using assms(4) Q_assm2 in_Q unfolding TT2_def by force\n have 2: \"\\ @ [X \\ Y]\\<^sub>R # \\' \\ P\"\n using assms(3) P_assm2 \\'_in_P_Q case_assms unfolding TT2_def by force\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n proof (cases \"\\ Z. \\''' = [[Z]\\<^sub>R]\", auto)\n fix Z\n assume \\'''_is_ref: \"\\''' = [[Z]\\<^sub>R]\"\n then have \"\\ W. \\ @ [X]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ P \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using assm1 in_Q \\'''_def \\'_Tock_start unfolding ExtChoiceTT_def\n proof auto\n fix \\' \\'''' \\ :: \"'a ttobs list\"\n assume 1: \"\\' @ \\'''' \\ P\" \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[Z]\\<^sub>R] = \\' @ \\''''\"\n then show \"\\W. \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[W]\\<^sub>R] \\ P \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n by force\n next\n fix \\' \\'''' \\ :: \"'a ttobs list\"\n assume 1: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume 2: \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[Z]\\<^sub>R] = \\' @ \\\"\n assume 3: \"\\' \\ tocks UNIV\"\n assume 4: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\'''' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume 5: \"\\' @ \\'''' \\ P\"\n have \"\\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' \\\\<^sub>C \\'\"\n by (metis 1 2 \\_\\_split \\'''_def \\'''_is_ref \\'_Tock_start case_assms(1) tt_prefix_concat)\n then have \\'_def: \"\\' = \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\''\"\n using \"2\" \"3\" \\_X_\\'_longest_pretocks \\'''_def \\'''_is_ref \\'_Tock_start tt_prefix_antisym tt_prefix_concat by fastforce\n then have \"\\ = [[Z]\\<^sub>R]\"\n using \"2\" by auto\n then show \"\\W. \\ @ [X]\\<^sub>R # [Tock]\\<^sub>E # \\'' @ [[W]\\<^sub>R] \\ P \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using 4 5 \\'_def by auto\n qed\n then obtain W where \"\\ @ [X]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ P \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n by blast\n then have C: \"\\ @ [X \\ Y]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ P \\ (\\e. (e \\ W) = (e \\ Z) \\ e = Tock)\"\n using assms(3) P_assm2 unfolding TT2_def by auto\n have D: \"\\ t\\tocks UNIV. t \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\' @ [[W]\\<^sub>R] \\ t \\\\<^sub>C \\ @ [X \\ Y]\\<^sub>R # \\'\"\n using tt_prefix_notfront_is_whole end_refusal_notin_tocks by force\n show \"\\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using in_Q \\'''_is_ref \\'''_def \\'_Tock_start \\_\\_split case_assms 1 2 A B C D apply auto\n by (rule_tac x=\"\\ @ [X \\ Y]\\<^sub>R # \\'\" in bexI, auto, rule_tac x=\"[[W]\\<^sub>R]\" in exI, auto)\n next\n show \"\\Z. \\''' \\ [[Z]\\<^sub>R] \\ \\ @ [X \\ Y]\\<^sub>R # \\ \\ P \\\\<^sub>C Q\"\n unfolding ExtChoiceTT_def using in_Q \\'''_def \\'_Tock_start \\_\\_split case_assms 1 2 A B apply auto\n by (rule_tac x=\"\\ @ [X \\ Y]\\<^sub>R # \\'\" in bexI, auto, rule_tac x=\"[]\" in exI, auto)\n qed\n qed\n qed\nqed\n\nlemma ttWFx_ExtChoice: \n assumes \"ttWFx P\" \"ttWFx Q\"\n shows \"ttWFx (P \\\\<^sub>C Q)\"\n using assms unfolding ttWFx_def ExtChoiceTT_def by auto\n\nlemma TT3w_ExtChoice:\n assumes \"TT3w P\" \"TT3w Q\"\n shows \"TT3w (P \\\\<^sub>C Q)\"\n unfolding TT3w_def ExtChoiceTT_def\nproof auto\n fix \\' \\ \\ :: \"'a ttobs list\"\n assume assm1: \"\\' \\ tocks UNIV\"\n assume assm2: \"\\' @ \\ \\ P\"\n assume assm3: \"\\' @ \\ \\ Q\"\n assume assm4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume assm5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume assm6: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume assm7: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n have 1: \"add_Tick_refusal_trace \\' \\ tocks UNIV\"\n using TT3w_def TT3w_tocks assm1 by blast\n have 2: \"add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ P\"\n using assms(1) assm2 unfolding TT3w_def by (erule_tac x=\"\\' @ \\\" in allE, auto simp add: add_Tick_refusal_trace_concat)\n have 3: \"add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ Q\"\n using assms(2) assm3 unfolding TT3w_def by (erule_tac x=\"\\' @ \\\" in allE, auto simp add: add_Tick_refusal_trace_concat)\n have 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ \\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n proof auto\n fix \\''\n assume assms2: \"\\'' \\ tocks UNIV\" \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\\"\n then obtain \\''' where \\'''_assms: \"\\''' \\\\<^sub>C \\'' \\ \\''' \\\\<^sub>C \\' @ \\\"\n by (metis add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset tt_prefix_tt_subset)\n then have \"\\''' \\ tocks UNIV\"\n using assms2(1) tocks_tt_subset1 by blast\n then have \"\\''' \\\\<^sub>C \\'\"\n using \\'''_assms assm4 by blast\n then show \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n by (smt \\'''_assms add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset append_eq_append_conv assms2(2) tt_prefix_concat tt_prefix_split tt_subset_same_length)\n qed\n have 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ \\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n proof auto\n fix \\''\n assume assms2: \"\\'' \\ tocks UNIV\" \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\\"\n then obtain \\''' where \\'''_assms: \"\\''' \\\\<^sub>C \\'' \\ \\''' \\\\<^sub>C \\' @ \\\"\n by (metis add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset tt_prefix_tt_subset)\n then have \"\\''' \\ tocks UNIV\"\n using assms2(1) tocks_tt_subset1 by blast\n then have \"\\''' \\\\<^sub>C \\'\"\n using \\'''_assms assm5 by blast\n then show \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n by (smt \\'''_assms add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset append_eq_append_conv assms2(2) tt_prefix_concat tt_prefix_split tt_subset_same_length)\n qed\n have 6: \"\\X. add_Tick_refusal_trace \\ = [[X]\\<^sub>R] \\ (\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n proof auto\n fix X\n assume \"add_Tick_refusal_trace \\ = [[X]\\<^sub>R]\"\n then obtain X' where X'_assms: \"\\ = [[X']\\<^sub>R] \\ X = X' \\ {Tick}\"\n apply (cases \\ rule:add_Tick_refusal_trace.cases, simp_all)\n using add_Tick_refusal_trace.elims by blast\n then obtain Y' where Y'_assms: \"\\ = [[Y']\\<^sub>R] \\ (\\e. (e \\ X') = (e \\ Y') \\ e = Tock)\"\n using assm6 by blast\n then show \"\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock)\"\n using X'_assms by (rule_tac x=\"Y' \\ {Tick}\" in exI, auto)\n qed\n have 7: \"\\X. add_Tick_refusal_trace \\ = [[X]\\<^sub>R] \\ (\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n proof auto\n fix X\n assume \"add_Tick_refusal_trace \\ = [[X]\\<^sub>R]\"\n then obtain X' where X'_assms: \"\\ = [[X']\\<^sub>R] \\ X = X' \\ {Tick}\"\n apply (cases \\ rule:add_Tick_refusal_trace.cases, simp_all)\n using add_Tick_refusal_trace.elims by blast\n then obtain Y' where Y'_assms: \"\\ = [[Y']\\<^sub>R] \\ (\\e. (e \\ X') = (e \\ Y') \\ e = Tock)\"\n using assm7 by blast\n then show \"\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock)\"\n using X'_assms by (rule_tac x=\"Y' \\ {Tick}\" in exI, auto)\n qed\n show \"\\\\\\tocks UNIV.\n \\\\'. \\ @ \\' \\ P \\\n (\\\\. \\ @ \\ \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\' \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (add_Tick_refusal_trace (\\' @ \\) = \\ @ \\' \\ add_Tick_refusal_trace (\\' @ \\) = \\ @ \\))\"\n using 1 2 3 4 5 6 7 apply (rule_tac x=\"add_Tick_refusal_trace \\'\" in bexI, auto)\n apply (rule_tac x=\"add_Tick_refusal_trace \\\" in exI, auto)\n apply (rule_tac x=\"add_Tick_refusal_trace \\\" in exI, auto)\n by (simp add: add_Tick_refusal_trace_concat)\nnext\n fix \\' \\ \\ :: \"'a ttobs list\"\n assume assm1: \"\\' \\ tocks UNIV\"\n assume assm2: \"\\' @ \\ \\ P\"\n assume assm3: \"\\' @ \\ \\ Q\"\n assume assm4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume assm5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\'\"\n assume assm6: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume assm7: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n have 1: \"add_Tick_refusal_trace \\' \\ tocks UNIV\"\n using TT3w_def TT3w_tocks assm1 by blast\n have 2: \"add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ P\"\n using assms(1) assm2 unfolding TT3w_def by (erule_tac x=\"\\' @ \\\" in allE, auto simp add: add_Tick_refusal_trace_concat)\n have 3: \"add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ Q\"\n using assms(2) assm3 unfolding TT3w_def by (erule_tac x=\"\\' @ \\\" in allE, auto simp add: add_Tick_refusal_trace_concat)\n have 4: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ \\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n proof auto\n fix \\''\n assume assms2: \"\\'' \\ tocks UNIV\" \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\\"\n then obtain \\''' where \\'''_assms: \"\\''' \\\\<^sub>C \\'' \\ \\''' \\\\<^sub>C \\' @ \\\"\n by (metis add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset tt_prefix_tt_subset)\n then have \"\\''' \\ tocks UNIV\"\n using assms2(1) tocks_tt_subset1 by blast\n then have \"\\''' \\\\<^sub>C \\'\"\n using \\'''_assms assm4 by blast\n then show \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n by (smt \\'''_assms add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset append_eq_append_conv assms2(2) tt_prefix_concat tt_prefix_split tt_subset_same_length)\n qed\n have 5: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\ \\ \\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n proof auto\n fix \\''\n assume assms2: \"\\'' \\ tocks UNIV\" \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\' @ add_Tick_refusal_trace \\\"\n then obtain \\''' where \\'''_assms: \"\\''' \\\\<^sub>C \\'' \\ \\''' \\\\<^sub>C \\' @ \\\"\n by (metis add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset tt_prefix_tt_subset)\n then have \"\\''' \\ tocks UNIV\"\n using assms2(1) tocks_tt_subset1 by blast\n then have \"\\''' \\\\<^sub>C \\'\"\n using \\'''_assms assm5 by blast\n then show \"\\'' \\\\<^sub>C add_Tick_refusal_trace \\'\"\n by (smt \\'''_assms add_Tick_refusal_trace_concat add_Tick_refusal_trace_tt_subset append_eq_append_conv assms2(2) tt_prefix_concat tt_prefix_split tt_subset_same_length)\n qed\n have 6: \"\\X. add_Tick_refusal_trace \\ = [[X]\\<^sub>R] \\ (\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n proof auto\n fix X\n assume \"add_Tick_refusal_trace \\ = [[X]\\<^sub>R]\"\n then obtain X' where X'_assms: \"\\ = [[X']\\<^sub>R] \\ X = X' \\ {Tick}\"\n apply (cases \\ rule:add_Tick_refusal_trace.cases, simp_all)\n using add_Tick_refusal_trace.elims by blast\n then obtain Y' where Y'_assms: \"\\ = [[Y']\\<^sub>R] \\ (\\e. (e \\ X') = (e \\ Y') \\ e = Tock)\"\n using assm6 by blast\n then show \"\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock)\"\n using X'_assms by (rule_tac x=\"Y' \\ {Tick}\" in exI, auto)\n qed\n have 7: \"\\X. add_Tick_refusal_trace \\ = [[X]\\<^sub>R] \\ (\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n proof auto\n fix X\n assume \"add_Tick_refusal_trace \\ = [[X]\\<^sub>R]\"\n then obtain X' where X'_assms: \"\\ = [[X']\\<^sub>R] \\ X = X' \\ {Tick}\"\n apply (cases \\ rule:add_Tick_refusal_trace.cases, simp_all)\n using add_Tick_refusal_trace.elims by blast\n then obtain Y' where Y'_assms: \"\\ = [[Y']\\<^sub>R] \\ (\\e. (e \\ X') = (e \\ Y') \\ e = Tock)\"\n using assm7 by blast\n then show \"\\Y. add_Tick_refusal_trace \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock)\"\n using X'_assms by (rule_tac x=\"Y' \\ {Tick}\" in exI, auto)\n qed\n show \"\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\'. \\ @ \\' \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\' \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (add_Tick_refusal_trace (\\' @ \\) = \\ @ \\ \\ add_Tick_refusal_trace (\\' @ \\) = \\ @ \\'))\"\n using 1 2 3 4 5 6 7 apply (rule_tac x=\"add_Tick_refusal_trace \\'\" in bexI, auto)\n apply (rule_tac x=\"add_Tick_refusal_trace \\\" in exI, auto)\n apply (rule_tac x=\"add_Tick_refusal_trace \\\" in exI, auto)\n by (simp add: add_Tick_refusal_trace_concat)\nqed\n\nlemma TT3_ExtChoice: \n assumes \"TT P\" \"TT Q\" \"TT3 P\" \"TT3 Q\"\n shows \"TT3 (P \\\\<^sub>C Q)\"\nproof -\n have \"TT1 (P \\\\<^sub>C Q)\"\n by (simp add: TT1_ExtChoice assms)\n then show ?thesis\n using TT1_TT3w_equiv_TT3 TT3w_ExtChoice TT_def assms by blast\nqed\n\nlemma TT_ExtChoice:\n assumes \"TT P\" \"TT Q\"\n shows \"TT (P \\\\<^sub>C Q)\"\n unfolding TT_def apply auto\n apply (metis TT_def ExtChoiceTT_wf assms(1) assms(2))\n apply (simp add: TT0_ExtChoice assms(1) assms(2))\n apply (simp add: TT1_ExtChoice assms(1) assms(2))\n apply (simp add: TT2w_ExtChoice assms(1) assms(2))\n apply (simp add: ttWFx_ExtChoice TT_ttWFx assms(1) assms(2))\n done\n\nlemma ExtChoice_comm: \"P \\\\<^sub>C Q = Q \\\\<^sub>C P\"\n unfolding ExtChoiceTT_def by auto\n\nlemma ExtChoice_union_dist: \"P \\\\<^sub>C (Q \\ R) = (P \\\\<^sub>C Q) \\ (P \\\\<^sub>C R)\"\n unfolding ExtChoiceTT_def by (safe, blast+)\n\nlemma ExtChoice_subset_union: \"P \\\\<^sub>C Q \\ P \\ Q\"\n unfolding ExtChoiceTT_def by auto\n\nlemma ExtChoice_assoc: \"P \\\\<^sub>C (Q \\\\<^sub>C R) = (P \\\\<^sub>C Q) \\\\<^sub>C R\"\n unfolding ExtChoiceTT_def\nproof (safe, simp_all)\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\ @ \\ \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\' @ \\' \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\'\\tocks UNIV.\n \\\\'. (\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\. \\ @ \\ \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))) \\\n (\\\\. \\' @ \\ \\ R \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\' \\ \\ @ \\ = \\' @ \\))\"\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\\" in exI, auto simp add: in_Q \\_\\_eq_\\'_\\' \\_longest_\\ \\_longest_\\ \\_refusal \\_refusal)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_R \\_eq_\\' \\'_longest_\\')\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal by fastforce\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\ @ \\ \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\' @ \\' \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\'\\tocks UNIV.\n \\\\'. (\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\. \\ @ \\ \\ Q \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))) \\\n (\\\\. \\' @ \\ \\ R \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\' \\ \\ @ \\ = \\' @ \\))\"\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_R \\_eq_\\' \\'_longest_\\')\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\ @ \\ \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\' @ \\' \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\\\tocks UNIV.\n \\\\. (\\\\'\\tocks UNIV.\n \\\\'. \\' @ \\' \\ P \\\n (\\\\. \\' @ \\ \\ Q \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\' \\ \\ @ \\ = \\' @ \\))) \\\n (\\\\. \\ @ \\ \\ R \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))\"\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal apply blast\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_R \\_eq_\\' \\'_longest_\\')\n using \\'_refusal apply blast\n using \\'_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\ @ \\ \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\' @ \\' \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\\\tocks UNIV.\n \\\\. (\\\\'\\tocks UNIV.\n \\\\'. \\' @ \\' \\ P \\\n (\\\\. \\' @ \\ \\ Q \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\' \\ \\ @ \\ = \\' @ \\))) \\\n (\\\\. \\ @ \\ \\ R \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))\"\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_R \\_eq_\\' \\'_longest_\\')\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\' @ \\' \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\ @ \\ \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\. (\\\\'\\tocks UNIV.\n \\\\. \\' @ \\ \\ Q \\\n (\\\\'. \\' @ \\' \\ R \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\ \\ \\ @ \\ = \\' @ \\'))) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))\"\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\'\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n apply (rule_tac x=\"\\\" in exI, auto simp add: \\'_longest_\\')\n using \\_eq_\\' in_R apply blast\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\'_refusal apply blast\n using \\'_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\' @ \\' \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\ @ \\ \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\'\\tocks UNIV.\n \\\\. \\' @ \\ \\ P \\\n (\\\\'. (\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ Q \\\n (\\\\. \\ @ \\ \\ R \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))) \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\ \\ \\ @ \\ = \\' @ \\'))\"\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n apply (rule_tac x=\"\\\" in exI, auto simp add: \\'_longest_\\')\n using \\_eq_\\' in_R apply blast\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\' @ \\' \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\ @ \\ \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\. (\\\\'\\tocks UNIV.\n \\\\. \\' @ \\ \\ Q \\\n (\\\\'. \\' @ \\' \\ R \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\ \\ \\ @ \\ = \\' @ \\'))) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))\"\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\'\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n apply (rule_tac x=\"\\\" in exI, auto simp add: \\'_longest_\\')\n using \\_eq_\\' in_R apply blast\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\'_refusal apply blast\n using \\'_refusal by blast\nnext\n fix \\ \\ \\ \\' \\' \\' :: \"'a tttrace\"\n assume in_P: \"\\' @ \\' \\ P\" and in_Q: \"\\' @ \\' \\ Q\" and in_R: \"\\ @ \\ \\ R\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\'_in_tocks: \"\\' \\ tocks UNIV\"\n assume \\_longest_\\: \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\\"\n assume \\_longest_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\'_longest_\\': \"\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\'\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\'_refusal: \"\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_eq_\\'_\\': \"\\ @ \\ = \\' @ \\'\"\n have \\_eq_\\': \"\\ = \\'\"\n by (metis \\'_in_tocks \\'_longest_\\' \\_\\_eq_\\'_\\' \\_in_tocks \\_longest_\\ tt_prefix_antisym tt_prefix_concat)\n show \"\\\\'\\tocks UNIV.\n \\\\. \\' @ \\ \\ P \\\n (\\\\'. (\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ Q \\\n (\\\\. \\ @ \\ \\ R \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\' @ \\' = \\ @ \\ \\ \\' @ \\' = \\ @ \\))) \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\ \\ \\'' \\\\<^sub>C \\') \\\n (\\\\''\\tocks UNIV. \\'' \\\\<^sub>C \\' @ \\' \\ \\'' \\\\<^sub>C \\') \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\ @ \\ = \\' @ \\ \\ \\ @ \\ = \\' @ \\'))\"\n apply (rule_tac x=\"\\'\" in bexI, auto simp add: \\'_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_P)\n apply (rule_tac x=\"\\\" in exI, auto)\n apply (rule_tac x=\"\\\" in bexI, auto simp add: \\_in_tocks)\n apply (rule_tac x=\"\\'\" in exI, auto simp add: in_Q \\_eq_\\' \\'_longest_\\')\n apply (rule_tac x=\"\\\" in exI, auto simp add: \\'_longest_\\')\n using \\_eq_\\' in_R apply blast\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\_refusal \\'_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\_eq_\\' \\_longest_\\ apply blast\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal apply fastforce\n using \\_\\_eq_\\'_\\' \\_eq_\\' \\'_refusal \\_refusal by fastforce\nqed\n\nlemma ExtChoice_idempotent: \"P \\\\<^sub>C P = P\"\n unfolding ExtChoiceTT_def\nproof auto\n fix x\n assume assm: \"x \\ P\"\n have \"\\s. \\t\\tocks UNIV. x = t @ s \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C x \\ t' \\\\<^sub>C t)\"\n using split_tocks_longest by blast\n then obtain s t where \"t\\tocks UNIV \\ x = t @ s \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C x \\ t' \\\\<^sub>C t)\"\n by auto\n then show \"\\\\\\tocks UNIV.\n \\\\. \\ @ \\ \\ P \\\n (\\\\. \\ @ \\ \\ P \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (x = \\ @ \\ \\ x = \\ @ \\))\"\n by (rule_tac x=t in bexI, auto, rule_tac x=s in exI, auto, insert assm, blast, rule_tac x=s in exI, auto)\nqed\n\nlemma ExtChoice_left_unit:\n assumes \"TT1 P\" \"\\x\\P. ttWF x\"\n shows \"P \\\\<^sub>C STOP\\<^sub>C = P\"\n unfolding ExtChoiceTT_def StopTT_def\nproof auto\n fix \\ \\ \\ :: \"'a tttrace\"\n assume case_assms: \"\\ \\ tocks UNIV\" \"\\ @ \\ \\ P\" \"\\ @ \\ \\ tocks {x. x \\ Tock}\" \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n then have \"\\ = []\"\n using self_extension_tt_prefix tocks_subset tt_prefix_refl by blast\n then show \"\\ @ \\ \\ P\"\n using TT1_TT1w TT1w_prefix_concat_in assms case_assms(2) by auto\nnext\n fix \\ \\ \\ s :: \"'a tttrace\"\n fix X\n assume case_assms: \"\\ \\ tocks UNIV\" \"\\ @ \\ \\ P\" \"s \\ tocks {x. x \\ Tock}\" \"\\ @ \\ = s @ [[X]\\<^sub>R]\" \"Tock \\ X\"\n \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C s @ [[X]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n then have \\_\\_def: \"\\ = s \\ \\ = [[X]\\<^sub>R]\"\n by (metis end_refusal_notin_tocks same_append_eq tocks_subset top_greatest tt_prefix_antisym tt_prefix_concat tt_prefix_notfront_is_whole)\n then obtain Y where Y_assms: \"\\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock)\"\n using case_assms(6) by blast\n then have \"s @ [[Y]\\<^sub>R] \\ P\"\n using \\_\\_def case_assms(2) by blast\n then have \"s @ [[X]\\<^sub>R] \\\\<^sub>C s @ [[Y]\\<^sub>R] \\ s @ [[X]\\<^sub>R] \\ P\"\n using TT1_def assms by blast\n then show \"s @ [[X]\\<^sub>R] \\ P\"\n by (metis Y_assms case_assms(5) subsetI tt_prefix_common_concat tt_prefix_subset.simps(2) tt_prefix_subset_refl)\nnext\n fix x\n assume case_assm: \"x \\ P\"\n then obtain s t where \"t\\tocks {x. x \\ Tock} \\ x = t @ s \\ (\\t'\\tocks UNIV. t' \\\\<^sub>C x \\ t' \\\\<^sub>C t)\"\n by (metis assms(2) ttWF_split_tocks_longest)\n then show \"\\\\\\tocks UNIV.\\\\. \\ @ \\ \\ P \\\n (\\\\. (\\s\\tocks {x. x \\ Tock}. \\ @ \\ = s \\ (\\X. \\ @ \\ = s @ [[X]\\<^sub>R] \\ Tock \\ X)) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\ \n (x = \\ @ \\ \\ x = \\ @ \\))\"\n apply (rule_tac x=t in bexI, auto)\n apply (rule_tac x=s in exI, auto)\n using case_assm apply blast\n apply (rule_tac x=\"case s of [[X]\\<^sub>R] \\ [[{x\\X. x \\ Tock}]\\<^sub>R] | _ \\ []\" in exI, auto)\n apply (rule_tac x=\"t\" in bexI, auto)\n apply (cases s rule:ttWF.cases, auto)\n apply (cases s rule:ttWF.cases, auto)\n using end_refusal_notin_tocks tt_prefix_notfront_is_whole apply blast\n apply (cases s rule:ttWF.cases, auto)\n using tocks_subset by blast\nqed\n\nlemma ExtChoice_right_unit:\n assumes \"TT1 P\" \"\\x\\P. ttWF x\"\n shows \"STOP\\<^sub>C \\\\<^sub>C P = P\"\n by (simp add: ExtChoice_comm ExtChoice_left_unit assms)\n\nlemma ExtChoice_Union_dist1:\n \"X \\ {} \\ P \\\\<^sub>C \\X = \\{R. \\Q. Q \\ X \\ R = P \\\\<^sub>C Q}\"\n unfolding ExtChoiceTT_def by auto\n\nlemma ExtChoice_Union_dist2:\n \"X \\ {} \\ \\X \\\\<^sub>C Q = \\{R. \\P. P \\ X \\ R = P \\\\<^sub>C Q}\"\n unfolding ExtChoiceTT_def by auto\n\nlemma ExtChoice_mono1: \n \"P \\\\<^sub>C Q \\ P \\\\<^sub>C R \\\\<^sub>C Q \\\\<^sub>C R\"\n unfolding RefinesTT_def ExtChoiceTT_def by auto\n\nlemma ExtChoice_mono2: \n \"P \\\\<^sub>C Q \\ R \\\\<^sub>C P \\\\<^sub>C R \\\\<^sub>C Q\"\n unfolding RefinesTT_def ExtChoiceTT_def by auto\n\n\nsubsection \\Replicated External Choice\\\n\ndefinition ReplicatedExtChoiceTT :: \"'e ttprocess set \\ 'e ttprocess\" where\n \"ReplicatedExtChoiceTT Ps = Finite_Set.fold (\\\\<^sub>C) STOP\\<^sub>C Ps\"\n\nabbreviation(input) \"ReplicatedExtChoiceTT'_pat X P f \\ ReplicatedExtChoiceTT { P e |e. f e \\ X}\"\nabbreviation(input) \"ReplicatedExtChoiceTT' X P \\ ReplicatedExtChoiceTT { P e |e. e \\ X}\"\n\nsyntax\n \"_replicated_ext_choice\" :: \"('e \\ pttrn) \\ logic \\ logic \\ logic\" (\"(\\\\<^sub>R (_) \\ _ \\ _)\" [1,0,0] 56)\n\ntranslations\n \"_replicated_ext_choice (f e) X P\" \\ \"CONST ReplicatedExtChoiceTT'_pat X (\\e. P) f\"\n \"_replicated_ext_choice e X P\" \\ \"CONST ReplicatedExtChoiceTT' X (\\e. P)\"\n\nterm \"(\\\\<^sub>R (Event e) \\ X \\ P e) \\\\<^sub>C Q\"\nterm \"(\\\\<^sub>R e \\ X \\ P e) \\\\<^sub>C Q\"\n\nlemma ExtChoice_comp_fun_commute: \"comp_fun_commute (\\\\<^sub>C)\"\n unfolding comp_fun_commute_def by (auto,rule_tac ext, auto, (metis ExtChoice_assoc ExtChoice_comm)+)\n\nlemma ReplicatedExtChoice_empty:\n \"ReplicatedExtChoiceTT {} = STOP\\<^sub>C\"\n unfolding ReplicatedExtChoiceTT_def by auto\n\nlemma ReplicatedExtChoice_singleton:\n assumes \"TT1 P\" \"\\x\\P. ttWF x\"\n shows \"ReplicatedExtChoiceTT {P} = P\"\n unfolding ReplicatedExtChoiceTT_def apply (subst Finite_Set.comp_fun_commute.fold_insert)\n by (simp_all add: ExtChoice_comp_fun_commute ExtChoice_left_unit assms)\n\nlemma ReplicatedExtChoice_insert_notin:\n \"finite Ps \\ P \\ Ps \\ ReplicatedExtChoiceTT (insert P Ps) = P \\\\<^sub>C (ReplicatedExtChoiceTT Ps)\"\n unfolding ReplicatedExtChoiceTT_def \n by (subst Finite_Set.comp_fun_commute.fold_insert, simp_all add: ExtChoice_comp_fun_commute)\n\nlemma ReplicatedExtChoice_insert_idemp:\n \"finite Ps \\ P \\ Ps \\ ReplicatedExtChoiceTT (insert P Ps) = P \\\\<^sub>C (ReplicatedExtChoiceTT Ps)\"\nproof -\n assume assms: \"finite Ps\" \"P \\ Ps\"\n have \"insert P Ps = insert P {x\\Ps. x \\ P}\"\n by auto\n then have \"ReplicatedExtChoiceTT (insert P Ps) = ReplicatedExtChoiceTT (insert P {x\\Ps. x \\ P})\"\n by simp\n also have \"... = P \\\\<^sub>C (ReplicatedExtChoiceTT {x\\Ps. x \\ P})\"\n by (simp add: ReplicatedExtChoice_insert_notin assms(1))\n also have \"... = (P \\\\<^sub>C P) \\\\<^sub>C (ReplicatedExtChoiceTT {x\\Ps. x \\ P})\"\n by (simp add: ExtChoice_idempotent)\n also have \"... = P \\\\<^sub>C (ReplicatedExtChoiceTT Ps)\"\n by (smt ExtChoice_assoc ExtChoice_idempotent assms(2) calculation insert_absorb)\n then show ?thesis\n using calculation by auto\nqed\n\nlemma ReplicatedExtChoice_insert:\n \"finite Ps \\ ReplicatedExtChoiceTT (insert P Ps) = P \\\\<^sub>C (ReplicatedExtChoiceTT Ps)\"\n by (cases \"P \\ Ps\", simp_all add: ReplicatedExtChoice_insert_idemp ReplicatedExtChoice_insert_notin)\n \nlemma ReplicatedExtChoice_pair: \n assumes \"TT1 P\" \"\\x\\P. ttWF x\"\n shows \"ReplicatedExtChoiceTT {P, Q} = P \\\\<^sub>C Q\"\nproof -\n have \"ReplicatedExtChoiceTT {P, Q} = P \\\\<^sub>C (ReplicatedExtChoiceTT {Q})\"\n by (simp add: ReplicatedExtChoice_insert)\n also have \"... = P \\\\<^sub>C Q\"\n by (smt ExtChoice_assoc ExtChoice_comm ReplicatedExtChoice_insert ReplicatedExtChoice_singleton assms finite.emptyI)\n then show ?thesis \n using calculation by auto\nqed\n\nlemma ReplicatedExtChoice_induct:\n \"finite Ps \\ \n (\\P. P \\ Ps \\ Pred P) \\\n Pred (ReplicatedExtChoiceTT {}) \\\n (\\P Ps'. finite Ps' \\ Pred P \\ Pred (ReplicatedExtChoiceTT Ps') \\ Pred (ReplicatedExtChoiceTT (insert P Ps'))) \\\n Pred (ReplicatedExtChoiceTT Ps)\"\n by (rule finite_subset_induct[where F=Ps, where P=\"\\x. Pred (ReplicatedExtChoiceTT x)\", where A=\"{P. Pred P}\"], auto)\n\nlemma ReplicatedExtChoice_wf:\n assumes \"\\P. P\\Ps \\ \\x\\P. ttWF x\" \"finite Ps\"\n shows \"\\x\\ReplicatedExtChoiceTT Ps. ttWF x\"\nproof (insert assms, rule ReplicatedExtChoice_induct, auto)\n fix x :: \"'a tttrace\"\n show \"x \\ ReplicatedExtChoiceTT {} \\ ttWF x\"\n using ReplicatedExtChoice_empty StopTT_wf by blast\nnext\n fix Ps' :: \"'a ttprocess set\"\n fix P :: \"'a ttprocess\"\n fix x :: \"'a tttrace\"\n assume case_assms: \"\\x\\P. ttWF x\" \"\\x\\ReplicatedExtChoiceTT Ps'. ttWF x\" \"finite Ps'\"\n assume \"x \\ ReplicatedExtChoiceTT (insert P Ps')\"\n then have \"x \\ P \\\\<^sub>C ReplicatedExtChoiceTT Ps'\"\n by (simp add: ReplicatedExtChoice_insert case_assms(3))\n then show \"ttWF x\"\n using ExtChoiceTT_wf case_assms(1) case_assms(2) by blast\nqed\n\nlemma TT_ReplicatedExternalChoice:\n assumes \"\\P. P\\Ps \\ TT P \\ TT2 P \\ TT3 P\" \"finite Ps\"\n shows \"TT (ReplicatedExtChoiceTT Ps) \\ TT2 (ReplicatedExtChoiceTT Ps) \\ TT3 (ReplicatedExtChoiceTT Ps)\"\nproof (insert assms, rule ReplicatedExtChoice_induct, auto)\n show \"TT (ReplicatedExtChoiceTT {})\"\n by (simp add: ReplicatedExtChoice_empty TT_Stop)\nnext\n show \"TT2 (ReplicatedExtChoiceTT {})\"\n by (simp add: ReplicatedExtChoice_empty TT2_Stop)\nnext\n show \"TT3 (ReplicatedExtChoiceTT {})\"\n by (simp add: ReplicatedExtChoice_empty TT3_Stop)\nnext\n fix P :: \"'a ttprocess\" and Ps' :: \"'a ttprocess set\"\n show \"TT P \\ TT (ReplicatedExtChoiceTT Ps') \\ TT (ReplicatedExtChoiceTT (insert P Ps'))\"\n by (metis ReplicatedExtChoiceTT_def ReplicatedExtChoice_insert TT_ExtChoice finite_insert fold_infinite)\nnext\n fix P :: \"'a ttprocess\" and Ps' :: \"'a ttprocess set\"\n show \"TT P \\ TT (ReplicatedExtChoiceTT Ps') \\ TT2 P \\ TT2 (ReplicatedExtChoiceTT Ps') \\\n TT2 (ReplicatedExtChoiceTT (insert P Ps'))\"\n by (metis ReplicatedExtChoiceTT_def ReplicatedExtChoice_insert TT2_ExtChoice finite_insert fold_infinite)\nnext\n fix P :: \"'a ttprocess\" and Ps' :: \"'a ttprocess set\"\n show \"TT P \\ TT (ReplicatedExtChoiceTT Ps') \\ TT3 P \\ TT3 (ReplicatedExtChoiceTT Ps') \\\n TT3 (ReplicatedExtChoiceTT (insert P Ps'))\"\n by (metis ReplicatedExtChoiceTT_def ReplicatedExtChoice_insert TT3_ExtChoice finite_insert fold_infinite)\nqed\n\nend\n", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/TickTock/TickTock_ExtChoice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316860482762, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2995436234774605}} {"text": "theory Alternative_Semantics\nimports Semantics\nbegin\n \ncontext begin\n \n(* the first thing (I think) we have to do is alter the Seq rule / merge it with NoMatch.\n Its properties make it hard to work with\\ *)\nprivate inductive iptables_bigstep_ns :: \"'a ruleset \\ ('a, 'p) matcher \\ 'p \\ 'a rule list \\ state \\ state \\ bool\"\n (\"_,_,_\\ \\_, _\\ \\\\<^sub>s _\" [60,60,60,20,98,98] 89)\n for \\ and \\ and p where\nskip: \"\\,\\,p\\ \\[], t\\ \\\\<^sub>s t\" |\naccept: \"matches \\ m p \\ \\,\\,p\\ \\Rule m Accept # rs, Undecided\\ \\\\<^sub>s Decision FinalAllow\" |\ndrop: \"matches \\ m p \\ \\,\\,p\\ \\Rule m Drop # rs, Undecided\\ \\\\<^sub>s Decision FinalDeny\" |\nreject: \"matches \\ m p \\ \\,\\,p\\ \\Rule m Reject # rs, Undecided\\ \\\\<^sub>s Decision FinalDeny\" |\nlog: \"matches \\ m p \\ \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s t \\ \\,\\,p\\ \\Rule m Log # rs, Undecided\\ \\\\<^sub>s t\" |\nempty: \"matches \\ m p \\ \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s t \\ \\,\\,p\\ \\Rule m Empty # rs, Undecided\\ \\\\<^sub>s t\" |\nnms: \"\\ matches \\ m p \\ \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s t \\ \\,\\,p\\ \\Rule m a # rs, Undecided\\ \\\\<^sub>s t\" |\n(*decision: \"\\,\\,p\\ \\rs, Decision X\\ \\\\<^sub>s Decision X\" |*)\ncall_return: \"\\ matches \\ m p; \\ chain = Some (rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2);\n matches \\ m' p; \\,\\,p\\ \\rs\\<^sub>1, Undecided\\ \\\\<^sub>s Undecided; \\,\\,p\\ \\rrs, Undecided\\ \\\\<^sub>s t \\ \\\n \\,\\,p\\ \\Rule m (Call chain) # rrs, Undecided\\ \\\\<^sub>s t\" |\ncall_result: \"\\ matches \\ m p; \\ chain = Some rs; \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s Decision X \\ \\\n \\,\\,p\\ \\Rule m (Call chain) # rrs, Undecided\\ \\\\<^sub>s Decision X\" |\ncall_no_result: \"\\ matches \\ m p; \\ chain = Some rs; \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s Undecided;\n \\,\\,p\\ \\rrs, Undecided\\ \\\\<^sub>s t \\ \\\n \\,\\,p\\ \\Rule m (Call chain) # rrs, Undecided\\ \\\\<^sub>s t\"\n\nprivate lemma a: \"\\,\\,p\\ \\rs, s\\ \\\\<^sub>s t \\ \\,\\,p\\ \\rs, s\\ \\ t\"\n apply(induction rule: iptables_bigstep_ns.induct; (simp add: iptables_bigstep.intros;fail)?)\n apply (meson iptables_bigstep.decision iptables_bigstep.accept seq_cons)\n apply (meson iptables_bigstep.decision iptables_bigstep.drop seq_cons)\n apply (meson iptables_bigstep.decision iptables_bigstep.reject seq_cons)\n apply (meson iptables_bigstep.log seq_cons)\n apply (meson iptables_bigstep.empty seq_cons)\n apply (meson nomatch seq_cons)\n subgoal using iptables_bigstep.call_return seq_cons by fastforce\n apply (meson iptables_bigstep.decision iptables_bigstep.call_result seq_cons)\n apply (meson iptables_bigstep.call_result seq'_cons)\n done\n\nprivate lemma empty_rs_stateD: assumes \"\\,\\,p\\ \\[], s\\ \\\\<^sub>s t\" shows \"t = s\"\n using assms by(cases rule: iptables_bigstep_ns.cases)\nprivate lemma decided: \"\\\\,\\,p\\ \\rs\\<^sub>1, Undecided\\ \\\\<^sub>s Decision X\\ \\ \\,\\,p\\ \\rs\\<^sub>1@rs\\<^sub>2, Undecided\\ \\\\<^sub>s Decision X\"\nproof(induction rs\\<^sub>1)\n case Nil\n then show ?case by (fast dest: empty_rs_stateD)\nnext\n case (Cons a rs\\<^sub>1)\n from Cons.prems show ?case \n by(cases rule: iptables_bigstep_ns.cases; simp add: Cons.IH iptables_bigstep_ns.intros)\nqed\n \nprivate lemma decided_determ: \"\\\\,\\,p\\ \\rs\\<^sub>1, s\\ \\\\<^sub>s t; s = Decision X\\ \\ t = Decision X\"\n by(induction rule: iptables_bigstep_ns.induct; (simp add: iptables_bigstep_ns.intros;fail)?)\n\nprivate lemma seq_ns:\n \"\\\\,\\,p\\ \\rs\\<^sub>1, Undecided\\ \\\\<^sub>s t; \\,\\,p\\ \\rs\\<^sub>2, t\\ \\\\<^sub>s t'\\ \\ \\,\\,p\\ \\rs\\<^sub>1@rs\\<^sub>2, Undecided\\ \\\\<^sub>s t'\"\nproof (cases t, goal_cases)\n case 1\n from 1(1,2) show ?case unfolding 1 proof(induction rs\\<^sub>1)\n case (Cons a rs\\<^sub>3)\n then show ?case\n apply -\n apply(rule iptables_bigstep_ns.cases[OF Cons.prems(1)]; simp add: iptables_bigstep_ns.intros)\n done\n qed simp\nnext\n case (2 X)\n hence \"t' = Decision X\" by (simp add: decided_determ)\n from 2(1) show ?case by (simp add: \"2\"(3) \\t' = Decision X\\ decided)\nqed\n \nprivate lemma b: \"\\,\\,p\\ \\rs, s\\ \\ t \\ s = Undecided \\ \\,\\,p\\ \\rs, s\\ \\\\<^sub>s t\"\n apply(induction rule: iptables_bigstep.induct; (simp add: iptables_bigstep_ns.intros;fail)?)\n apply (metis decided decision seq_ns seq_progress skipD state.exhaust)\n apply(metis call_no_result iptables_bigstep_ns.call_result iptables_bigstep_ns.skip state.exhaust)\n done\n \nprivate inductive iptables_bigstep_nz :: \"'a ruleset \\ ('a, 'p) matcher \\ 'p \\ 'a rule list \\ state \\ bool\"\n (\"_,_,_\\ _ \\\\<^sub>z _\" [60,60,60,20,98] 89)\n for \\ and \\ and p where\nskip: \"\\,\\,p \\ [] \\\\<^sub>z Undecided\" |\naccept: \"matches \\ m p \\ \\,\\,p\\ Rule m Accept # rs \\\\<^sub>z Decision FinalAllow\" |\ndrop: \"matches \\ m p \\ \\,\\,p\\ Rule m Drop # rs \\\\<^sub>z Decision FinalDeny\" |\nreject: \"matches \\ m p \\ \\,\\,p\\ Rule m Reject # rs \\\\<^sub>z Decision FinalDeny\" |\nlog: \"matches \\ m p \\ \\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ Rule m Log # rs \\\\<^sub>z t\" |\nempty: \"matches \\ m p \\ \\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ Rule m Empty # rs \\\\<^sub>z t\" |\nnms: \"\\ matches \\ m p \\ \\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ Rule m a # rs \\\\<^sub>z t\" |\ncall_return: \"\\ matches \\ m p; \\ chain = Some (rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2);\n matches \\ m' p; \\,\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided; \\,\\,p\\ rrs \\\\<^sub>z t \\ \\\n \\,\\,p\\ Rule m (Call chain) # rrs \\\\<^sub>z t\" |\ncall_result: \"\\ matches \\ m p; \\ chain = Some rs; \\,\\,p\\ rs \\\\<^sub>z Decision X \\ \\\n \\,\\,p\\ Rule m (Call chain) # rrs \\\\<^sub>z Decision X\" |\ncall_no_result: \"\\ matches \\ m p; \\ chain = Some rs; \\,\\,p\\ rs \\\\<^sub>z Undecided;\n \\,\\,p\\ rrs \\\\<^sub>z t \\ \\\n \\,\\,p\\ Rule m (Call chain) # rrs \\\\<^sub>z t\"\n\nprivate lemma c: \"\\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ \\rs, Undecided\\ \\\\<^sub>s t\"\n by(induction rule: iptables_bigstep_nz.induct; simp add: iptables_bigstep_ns.intros)\n \nprivate lemma d: \"\\,\\,p\\ \\rs, s\\ \\\\<^sub>s t \\ s = Undecided \\ \\,\\,p\\ rs \\\\<^sub>z t\"\n by(induction rule: iptables_bigstep_ns.induct; simp add: iptables_bigstep_nz.intros)\n \ninductive iptables_bigstep_r :: \"'a ruleset \\ ('a, 'p) matcher \\ 'p \\ 'a rule list \\ state \\ bool\"\n (\"_,_,_\\ _ \\\\<^sub>r _\" [60,60,60,20,98] 89)\n for \\ and \\ and p where\nskip: \"\\,\\,p \\ [] \\\\<^sub>r Undecided\" |\naccept: \"matches \\ m p \\ \\,\\,p\\ Rule m Accept # rs \\\\<^sub>r Decision FinalAllow\" |\ndrop: \"matches \\ m p \\ \\,\\,p\\ Rule m Drop # rs \\\\<^sub>r Decision FinalDeny\" |\nreject: \"matches \\ m p \\ \\,\\,p\\ Rule m Reject # rs \\\\<^sub>r Decision FinalDeny\" |\nreturn: \"matches \\ m p \\ \\,\\,p\\ Rule m Return # rs \\\\<^sub>r Undecided\" |\nlog: \"\\,\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ Rule m Log # rs \\\\<^sub>r t\" |\nempty: \"\\,\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ Rule m Empty # rs \\\\<^sub>r t\" |\nnms: \"\\ matches \\ m p \\ \\,\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ Rule m a # rs \\\\<^sub>r t\" |\ncall_result: \"\\ matches \\ m p; \\ chain = Some rs; \\,\\,p\\ rs \\\\<^sub>r Decision X \\ \\\n \\,\\,p\\ Rule m (Call chain) # rrs \\\\<^sub>r Decision X\" |\ncall_no_result: \"\\ \\ chain = Some rs; \\,\\,p\\ rs \\\\<^sub>r Undecided;\n \\,\\,p\\ rrs \\\\<^sub>r t \\ \\\n \\,\\,p\\ Rule m (Call chain) # rrs \\\\<^sub>r t\"\n\nprivate lemma returning: \"\\\\,\\,p\\ rs\\<^sub>1 \\\\<^sub>r Undecided; matches \\ m' p\\\n \\ \\,\\,p\\ rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2 \\\\<^sub>r Undecided\"\nproof(induction rs\\<^sub>1)\n case Nil\n then show ?case by (simp add: return)\nnext\n case (Cons a rs\\<^sub>3)\n then show ?case by - (rule iptables_bigstep_r.cases[OF Cons.prems(1)]; simp add: iptables_bigstep_r.intros)\nqed\n \nprivate lemma e: \"\\,\\,p\\ rs \\\\<^sub>z t \\ s = Undecided \\ \\,\\,p\\ rs \\\\<^sub>r t\"\n by(induction rule: iptables_bigstep_nz.induct; simp add: iptables_bigstep_r.intros returning)\n \n\ndefinition \"no_call_to c rs \\ (\\r \\ set rs. case get_action r of Call c' \\ c \\ c' | _ \\ True)\"\ndefinition \"all_chains p \\ rs \\ (p rs \\ (\\l rs. \\ l = Some rs \\ p rs))\"\nprivate lemma all_chains_no_call_upd: \"all_chains (no_call_to c) \\ rs \\ (\\(c \\ x)),\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ rs \\\\<^sub>z t\"\nproof (rule iffI, goal_cases)\n case 1\n from 1(2,1) show ?case \n by(induction rule: iptables_bigstep_nz.induct; \n (simp add: iptables_bigstep_nz.intros no_call_to_def all_chains_def split: if_splits;fail)?)\nnext\n case 2\n from 2(2,1) show ?case \n by(induction rule: iptables_bigstep_nz.induct; \n (simp add: iptables_bigstep_nz.intros no_call_to_def all_chains_def split: action.splits;fail)?)\nqed\n\nlemma updated_call: \"\\(c \\ rs),\\,p\\ rs \\\\<^sub>z t \\ matches \\ m p \\ \\(c \\ rs),\\,p\\ [Rule m (Call c)] \\\\<^sub>z t\"\n by(cases t; simp add: iptables_bigstep_nz.call_no_result iptables_bigstep_nz.call_result iptables_bigstep_nz.skip)\n \nprivate lemma shows\n log_nz: \"\\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ Rule m Log # rs \\\\<^sub>z t\"\nand empty_nz: \"\\,\\,p\\ rs \\\\<^sub>z t \\ \\,\\,p\\ Rule m Empty # rs \\\\<^sub>z t\"\n by (meson iptables_bigstep_nz.log iptables_bigstep_nz.empty iptables_bigstep_nz.nms)+\n \nprivate lemma nz_empty_rs_stateD: assumes \"\\,\\,p\\ [] \\\\<^sub>z t\" shows \"t = Undecided\"\n using assms by(cases rule: iptables_bigstep_nz.cases)\n \nprivate lemma upd_callD: \"\\(c \\ rs),\\,p\\ [Rule m (Call c)] \\\\<^sub>z t \\ matches \\ m p \n \\ (\\(c \\ rs),\\,p\\ rs \\\\<^sub>z t \\ (\\rs\\<^sub>1 rs\\<^sub>2 m'. rs = rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2 \\ matches \\ m' p \\ \\(c \\ rs),\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided \\ t = Undecided))\"\n by(subst (asm) iptables_bigstep_nz.simps) (auto dest!: nz_empty_rs_stateD)\n \nprivate lemma partial_fun_upd: \"(f(x \\ y)) x = Some y\" by(fact fun_upd_same)\n \nlemma f: \"\\,\\,p\\ rs \\\\<^sub>r t \\ matches \\ m p \\ all_chains (no_call_to c) \\ rs \\ \n (\\(c \\ rs)),\\,p\\ [Rule m (Call c)] \\\\<^sub>z t\"\nproof(induction rule: iptables_bigstep_r.induct; (simp add: iptables_bigstep_nz.intros;fail)?)\n case (return m rs)\n then show ?case by (metis append_Nil fun_upd_same iptables_bigstep_nz.call_return iptables_bigstep_nz.skip)\nnext\n case (log rs t mx)\n have ac: \"all_chains (no_call_to c) \\ rs\"\n using log(4) by(simp add: all_chains_def no_call_to_def)\n have *: \"\\(c \\ Rule mx Log # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ [Rule m (Call c)] \\\\<^sub>z Undecided\"\n if \"rs = rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2\" \"matches \\ m' p\" \n \"\\(c \\ rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided\"\n for rs\\<^sub>1 rs\\<^sub>2 m'\n proof -\n have ac2: \"all_chains (no_call_to c) \\ rs\\<^sub>1\" using log(4) that\n by(simp add: all_chains_def no_call_to_def)\n hence \"\\(c \\ Rule mx Log # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided\"\n using that(3) unfolding that by(simp add: all_chains_no_call_upd)\n hence \"\\(c \\ Rule mx Log # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ Rule mx Log # rs\\<^sub>1 \\\\<^sub>z Undecided\"\n by (simp add: log_nz)\n thus ?thesis using that(1,2)\n by(elim iptables_bigstep_nz.call_return[where rs\\<^sub>2=rs\\<^sub>2, OF \\matches \\ m p\\, rotated]; simp add: iptables_bigstep_nz.skip)\n qed\n from log(2)[OF log(3) ac] show ?case\n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])\n apply(erule disjE)\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule log_nz)\n apply(simp add: ac all_chains_no_call_upd)\n done\n using * by blast\nnext\n case (empty rs t mx) text\\analogous\\ (*<*)\n have ac: \"all_chains (no_call_to c) \\ rs\"\n using empty(4) by(simp add: all_chains_def no_call_to_def)\n have *: \"\\(c \\ Rule mx Empty # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ [Rule m (Call c)] \\\\<^sub>z Undecided\"\n if \"rs = rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2\" \"matches \\ m' p\" \n \"\\(c \\ rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided\"\n for rs\\<^sub>1 rs\\<^sub>2 m'\n proof -\n have ac2: \"all_chains (no_call_to c) \\ rs\\<^sub>1\" using empty(4) that\n by(simp add: all_chains_def no_call_to_def)\n hence \"\\(c \\ Rule mx Empty # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ rs\\<^sub>1 \\\\<^sub>z Undecided\"\n using that(3) unfolding that by(simp add: all_chains_no_call_upd)\n hence \"\\(c \\ Rule mx Empty # rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2),\\,p\\ Rule mx Empty # rs\\<^sub>1 \\\\<^sub>z Undecided\"\n by (simp add: empty_nz)\n thus ?thesis using that(1,2)\n by(elim iptables_bigstep_nz.call_return[where rs\\<^sub>2=rs\\<^sub>2, OF \\matches \\ m p\\, rotated]; simp add: iptables_bigstep_nz.skip)\n qed\n from empty(2)[OF empty(3) ac] show ?case\n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])\n apply(erule disjE)\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule empty_nz)\n apply(simp add: ac all_chains_no_call_upd)\n done\n using * by blast\n (*>*)\nnext\n case (nms m' rs t a)\n have ac: \"all_chains (no_call_to c) \\ rs\" using nms(5) by(simp add: all_chains_def no_call_to_def)\n from nms.IH[OF nms(4) ac] show ?case\n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])\n apply(erule disjE)\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule iptables_bigstep_nz.nms[OF \\\\ matches \\ m' p\\])\n apply(simp add: ac all_chains_no_call_upd)\n done\n apply safe\n subgoal for rs\\<^sub>1 rs\\<^sub>2 r\n apply(subgoal_tac \"all_chains (no_call_to c) \\ rs\\<^sub>1\") (* Ich kann auch anders. *)\n apply(subst (asm) all_chains_no_call_upd, assumption)\n apply(subst (asm) all_chains_no_call_upd[symmetric], assumption)\n apply(drule iptables_bigstep_nz.nms[where a=a, OF \\\\ matches \\ m' p\\])\n apply(erule (1) iptables_bigstep_nz.call_return[where rs\\<^sub>2=rs\\<^sub>2, OF \\matches \\ m p\\, rotated])\n apply(insert ac; simp add: all_chains_def no_call_to_def iptables_bigstep_nz.skip)+\n done\n done\nnext\n case (call_result m' c' rs X rrs)\n have acrs: \"all_chains (no_call_to c) \\ rs\" using call_result(2,6) by(simp add: all_chains_def no_call_to_def)\n have cc: \"c \\ c'\" (* okay, this one is a bit nifty\\ *) using call_result(6) by(simp add: all_chains_def no_call_to_def)\n have \"\\(c \\ rs),\\,p\\ [Rule m (Call c)] \\\\<^sub>z Decision X\" using call_result.IH call_result.prems(1) acrs by blast\n then show ?case\n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])\n apply(erule disjE)\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule iptables_bigstep_nz.call_result[where rs=rs, OF \\matches \\ m' p\\ ])\n apply(simp add: cc[symmetric] call_result(2);fail)\n apply(simp add: acrs all_chains_no_call_upd;fail)\n done\n apply safe (* oh. Didn't expect that. :) *)\n done\nnext\n case (call_no_result c' rs rrs t m')\n have acrs: \"all_chains (no_call_to c) \\ rs\" using call_no_result(1,7) by(simp add: all_chains_def no_call_to_def)\n have acrrs: \"all_chains (no_call_to c) \\ rrs\" using call_no_result(7) by(simp add: all_chains_def no_call_to_def)\n have acrs1: \"all_chains (no_call_to c) \\ rs\\<^sub>1\" if \"rs = rs\\<^sub>1 @ rs\\<^sub>2\" for rs\\<^sub>1 rs\\<^sub>2\n using acrs that by(simp add: all_chains_def no_call_to_def)\n have acrrs1: \"all_chains (no_call_to c) \\ rs\\<^sub>1\" if \"rrs = rs\\<^sub>1 @ rs\\<^sub>2\" for rs\\<^sub>1 rs\\<^sub>2\n using acrrs that by(simp add: all_chains_def no_call_to_def)\n have cc: \"c \\ c'\" (* okay, this one is a bit nifty\\ *) using call_no_result(7) by(simp add: all_chains_def no_call_to_def)\n have *: \"\\(c \\ rs),\\,p\\ [Rule m (Call c)] \\\\<^sub>z Undecided\" using call_no_result.IH call_no_result.prems(1) acrs by blast\n have **: \"\\(c \\ rrs),\\,p\\ [Rule m (Call c)] \\\\<^sub>z t\" by (simp add: acrrs call_no_result.IH(2) call_no_result.prems(1))\n show ?case proof(cases \\matches \\ m' p\\)\n case True\n from call_no_result(5)[OF \\matches \\ m p\\ acrrs] * show ?thesis\n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])+\n apply(elim disjE) (* 4 sg *)\n apply safe\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule iptables_bigstep_nz.call_no_result[where rs=rs, OF \\matches \\ m' p\\ ])\n apply(simp add: cc[symmetric] call_no_result(1);fail)\n apply(simp add: acrs all_chains_no_call_upd;fail)\n apply(simp add: acrrs all_chains_no_call_upd)\n done\n subgoal for rs\\<^sub>1 rs\\<^sub>2 r\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule call_return[OF \\matches \\ m' p\\])\n apply(simp add: cc[symmetric] call_no_result(1);fail)\n apply(simp;fail)\n apply(simp add: acrs1 all_chains_no_call_upd;fail)\n apply(simp add: acrrs all_chains_no_call_upd)\n done\n subgoal for rs\\<^sub>1 rs\\<^sub>2 r\n apply(rule call_return[where rs\\<^sub>1=\"Rule m' (Call c') # rs\\<^sub>1\", OF \\matches \\ m p\\])\n apply(simp;fail)\n apply(simp;fail)\n apply(rule iptables_bigstep_nz.call_no_result[OF \\matches \\ m' p\\])\n apply(simp add: cc[symmetric] call_no_result(1);fail)\n apply (meson acrs all_chains_no_call_upd)\n apply(subst all_chains_no_call_upd; simp add: acrrs1 all_chains_no_call_upd; fail)\n apply (simp add: iptables_bigstep_nz.skip;fail)\n done\n subgoal for rrs\\<^sub>1 rs\\<^sub>1 rrs\\<^sub>2 rs\\<^sub>2 rr r\n apply(rule call_return[where rs\\<^sub>1=\"Rule m' (Call c') # rrs\\<^sub>1\", OF \\matches \\ m p\\])\n apply(simp;fail)\n apply(simp;fail)\n apply(rule call_return[OF \\matches \\ m' p\\])\n apply(simp add: cc[symmetric] call_no_result(1);fail)\n apply blast\n apply (meson acrs1 all_chains_no_call_upd)\n apply(subst all_chains_no_call_upd; simp add: acrrs1 all_chains_no_call_upd; fail)\n apply (simp add: iptables_bigstep_nz.skip;fail)\n done\n done\n next\n case False\n from iptables_bigstep_nz.nms[OF False] ** show ?thesis \n apply -\n apply(drule upd_callD[OF _ \\matches \\ m p\\])+\n apply(elim disjE)\n subgoal\n apply(rule updated_call[OF _ \\matches \\ m p\\])\n apply(rule iptables_bigstep_nz.nms[OF False])\n apply(simp add: acrrs all_chains_no_call_upd)\n done\n apply safe\n subgoal for rs\\<^sub>1 rs\\<^sub>2 r\n apply(rule call_return[where rs\\<^sub>1=\"Rule m' (Call c') # rs\\<^sub>1\", OF \\matches \\ m p\\])\n apply(simp;fail)\n apply(simp;fail)\n apply(rule iptables_bigstep_nz.nms[OF False])\n apply(subst all_chains_no_call_upd; simp add: acrrs1 all_chains_no_call_upd; fail)\n apply(simp add: iptables_bigstep_nz.skip;fail)\n done\n done\n qed\nqed\n \nlemma r_skip_inv: \"\\,\\,p\\ [] \\\\<^sub>r t \\ t = Undecided\"\n by(subst (asm) iptables_bigstep_r.simps) auto\n \n(* why did I do all this? essentially, because I thought this should be derivable: *)\n\n\n(* we can make the same formulation for the original semantics if we tread a bit more carefully *)\nlemma call_eq: \"\\ c = Some rs \\ matches \\ m p \\ \\r \\ set rs. get_action r \\ Return \\ \\,\\,p\\ \\[Rule m (Call c)],s\\ \\ t \\ \\,\\,p\\ \\rs,s\\ \\ t\"\n apply(rule iffI)\n subgoal\n apply(subst (asm) iptables_bigstep.simps)\n apply (auto)\n apply (simp add: decision)\n apply(erule rules_singleton_rev_E; simp; metis callD in_set_conv_decomp rule.sel(2) skipD)\n done\n by (metis decision iptables_bigstep.call_result iptables_bigstep_deterministic state.exhaust)\n \ntheorem r_eq_orig: \"\\all_chains (no_call_to c) \\ rs; \\ c = Some rs\\ \\\n \\,\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ \\[Rule MatchAny (Call c)], Undecided\\ \\ t\"\n apply(rule iffI)\n subgoal\n apply(drule f[where m=MatchAny, THEN c, THEN a])\n apply(simp;fail)\n apply(simp;fail)\n apply (metis fun_upd_triv)\n done \n subgoal\n apply(subst r_call_eq[where m=MatchAny, symmetric])\n apply(simp;fail)\n apply(simp;fail)\n apply(erule b[THEN d, THEN e, OF _ refl refl refl])\n done\n done\n \nlemma r_no_call: \"\\,\\,p\\ Rule MatchAny (Call c)#rs \\\\<^sub>r t \\ \\ c = None \\ False\"\n by(subst (asm) iptables_bigstep_r.simps) simp\n \nlemma no_call: \"\\,\\,p\\ \\rs, s\\ \\ t \\ rs = [Rule MatchAny (Call c)] \\ s = Undecided \\ \\ c = None \\ False\"\n by (meson b d e r_no_call)\n (*by(induction rule: iptables_bigstep.induct; clarsimp) (metis list_app_singletonE skipD)*)\n\nprivate corollary r_eq_orig': assumes \"\\rs \\ ran \\. no_call_to c rs\"\n shows \"\\,\\,p\\ [Rule MatchAny (Call c)] \\\\<^sub>r t \\ \\,\\,p\\ \\[Rule MatchAny (Call c)], Undecided\\ \\ t\"\n(* if you really like symmetry *)\nproof -\n show ?thesis proof (cases \"\\ c\")\n fix rs\n assume \"\\ c = Some rs\"\n moreover hence \"all_chains (no_call_to c) \\ rs\" using assms by (simp add: all_chains_def ranI)\n ultimately show ?thesis by(simp add: r_call_eq r_eq_orig)\n next\n assume \"\\ c = None\" thus ?thesis using r_no_call no_call by metis\n qed\nqed\n \n(* btw, we can still formulate a seq rules, but we have to tread a bit more carefully *)\nlemma r_tail: assumes \"\\,\\,p\\ rs1 \\\\<^sub>r Decision X\" shows \"\\,\\,p\\ rs1 @ rs2 \\\\<^sub>r Decision X\"\nproof -\n have \"\\,\\,p\\ rs1 \\\\<^sub>r t \\ t = Decision X \\ \\,\\,p\\ rs1 @ rs2 \\\\<^sub>r Decision X\" for t\n by(induction rule: iptables_bigstep_r.induct; simp add: iptables_bigstep_r.intros)\n thus ?thesis using assms by blast\nqed\nlemma r_seq: \"\\,\\,p\\ rs1 \\\\<^sub>r Undecided \\ \\r \\ set rs1. \\(get_action r = Return \\ matches \\ (get_match r) p)\n \\ \\,\\,p\\ rs2 \\\\<^sub>r t \\ \\,\\,p\\ rs1 @ rs2 \\\\<^sub>r t\"\nproof(induction rs1)\n case Nil\n then show ?case by simp\nnext\n case (Cons r rs1)\n have p2: \"\\r\\set rs1. \\ (get_action r = Return \\ matches \\ (get_match r) p)\" \n \"\\(get_action r = Return \\ matches \\ (get_match r) p)\"\n by (simp_all add: Cons.prems(2))\n from Cons.prems(1) p2(2) Cons.IH[OF _ p2(1) Cons.prems(3)] show ?case \n by(cases rule: iptables_bigstep_r.cases; simp add: iptables_bigstep_r.intros)\nqed\n\nlemma r_appendD: \"\\,\\,p\\ rs1 @ rs2 \\\\<^sub>r t \\ \\s. \\,\\,p\\ rs1 \\\\<^sub>r s\"\n proof(induction rs1)\n case (Cons r rs1)\n from Cons.prems Cons.IH show ?case by(cases rule: iptables_bigstep_r.cases) (auto intro: iptables_bigstep_r.intros)\n qed (meson iptables_bigstep_r.skip)\n\ncorollary iptables_bigstep_r_eq: assumes \"\\rs \\ ran \\. no_call_to c rs\" \"A = Accept \\ A = Drop\"\n shows \"\\,\\,p\\ [Rule MatchAny (Call c), Rule MatchAny A] \\\\<^sub>r t \\ \\,\\,p\\ \\[Rule MatchAny (Call c), Rule MatchAny A], Undecided\\ \\ t\"\n(* if you really like the way we do our analyses *)\nproof -\n show ?thesis proof (cases \"\\ c\")\n fix rs\n assume \"\\ c = Some rs\"\n moreover hence \"all_chains (no_call_to c) \\ rs\" using assms by (simp add: all_chains_def ranI)\n show ?thesis\n (* if this proof breaks, don't fix it. say 'meh' and re-prove this as a corollary of r_eq_orig''' with a stronger assumption *)\n apply(rule iffI[rotated])\n apply(erule seqE_cons)\n apply(subst (asm) r_eq_orig'[symmetric])\n apply (simp add: assms(1);fail)\n apply (meson assms(1) b d e r_eq_orig' seq'_cons) (* holy shi\\ *)\n apply(frule r_appendD[of _ _ _ \"[Rule MatchAny (Call c)]\" \"[Rule MatchAny A]\", simplified])\n apply(subst (asm) r_eq_orig')\n apply (simp add: assms(1);fail)\n apply(clarsimp)\n apply(subst (asm) r_eq_orig'[symmetric])\n apply (simp add: assms(1);fail)\n apply(subst (asm)(2) iptables_bigstep_r.simps)\n apply(subst (asm)(1) iptables_bigstep_r.simps)\n apply auto\n apply (metis append_Cons append_Nil assms(1) decision matches.simps(4) r_call_eq r_eq_orig' seq)\n apply (metis \\all_chains (no_call_to c) \\ rs\\ calculation iptables_bigstep_deterministic option.inject r_eq_orig state.distinct(1))\n subgoal using \\all_chains (no_call_to c) \\ rs\\ calculation iptables_bigstep_deterministic r_eq_orig by fastforce\n apply(subst (asm) r_eq_orig[rotated])\n apply(assumption)\n subgoal using \\all_chains (no_call_to c) \\ rs\\ calculation by simp\n apply(erule seq'_cons)\n apply(subst (asm)(1) iptables_bigstep_r.simps) \n apply(insert assms(2); auto simp add: iptables_bigstep.intros)\n done \n next\n assume \"\\ c = None\" thus ?thesis using r_no_call no_call by (metis seqE_cons)\n qed\nqed\n\n(* now, you don't like that no_call_to assumption? this one's for you: *)\nlemma ex_no_call: \"finite S \\ \\c. \\(rs :: 'a rule list) \\ S. no_call_to c rs\"\n(* If you want, you can put in \\ran \\\\ for S. *)\nproof -\n assume fS: \\finite S\\\n def called_c \\ \"\\rs :: 'a rule list. {c. \\m. Rule m (Call c) \\ set rs}\"\n def called_c' \\ \"\\rs :: 'a rule list. set [c. r \\ rs, c \\ (case get_action r of Call c \\ [c] | _ \\ [])]\"\n have cc: \"called_c' rs = called_c rs\" for rs\n unfolding called_c'_def called_c_def\n by(induction rs; simp add: Un_def) (auto; metis rule.collapse) \n have f: \"finite (called_c rs)\" for rs unfolding cc[symmetric] called_c'_def by blast\n have ncc: \"no_call_to c rs \\ c \\ called_c rs\" for c rs \n by(induction rs; auto simp add: no_call_to_def called_c_def split: action.splits) (metis rule.collapse)\n have isu: \"infinite (UNIV :: string set)\" by (simp add: infinite_UNIV_listI)\n have ff: \"finite (\\rs \\ S. called_c rs)\" using f fS by simp\n then obtain c where ne: \"c \\ (\\rs \\ S. called_c rs)\"\n by (blast dest: ex_new_if_finite[OF isu])\n thus ?thesis by(intro exI[where x=c]) (simp add: ncc)\n (* stupid way of proving something, once again\\ *)\nqed\n\nprivate lemma ex_no_call': \"finite (dom \\) \\ \\c. \\ c = None \\ (\\(rs :: 'a rule list) \\ (ran \\). no_call_to c rs)\"\n(* I want a corollary, and I need something a tad stronger\\ *)\nproof -\n have *: \"finite S \\ (dom M) = S \\ \\m. M = map_of m\" for M S\n proof(induction arbitrary: M rule: finite.induct)\n case emptyI\n then show ?case by(intro exI[where x=Nil]) simp\n next\n case (insertI A a)\n show ?case proof(cases \"a \\ A\") (* stupid induction rule *)\n case True\n then show ?thesis using insertI by (simp add: insert_absorb)\n next\n case False\n hence \"dom (M(a := None)) = A\" using insertI.prems by simp\n from insertI.IH[OF this] obtain m where \"M(a := None) = map_of m\" ..\n then show ?thesis \n by(intro exI[where x=\"(a, the (M a)) # m\"]) (simp; metis domIff fun_upd_apply insertCI insertI.prems option.collapse)\n qed\n qed (* hm, thought that would give me what I want\\ *)\n have ran_alt: \"ran f = (the o f) ` dom f\" for f by(auto simp add: ran_def dom_def image_def)\n assume fD: \\finite (dom \\)\\\n hence fS: \\finite (ran \\)\\ by(simp add: ran_alt)\n def called_c \\ \"\\rs :: 'a rule list. {c. \\m. Rule m (Call c) \\ set rs}\"\n def called_c' \\ \"\\rs :: 'a rule list. set [c. r \\ rs, c \\ (case get_action r of Call c \\ [c] | _ \\ [])]\"\n have cc: \"called_c' rs = called_c rs\" for rs\n unfolding called_c'_def called_c_def\n by(induction rs; simp add: Un_def) (auto; metis rule.collapse) \n have f: \"finite (called_c rs)\" for rs unfolding cc[symmetric] called_c'_def by blast\n have ncc: \"no_call_to c rs \\ c \\ called_c rs\" for c rs \n by(induction rs; auto simp add: no_call_to_def called_c_def split: action.splits) (metis rule.collapse) \n have isu: \"infinite (UNIV :: string set)\" by (simp add: infinite_UNIV_listI)\n have ff: \"finite (\\rs \\ ran \\. called_c rs)\" using f fS by simp\n hence fff: \"finite (dom \\ \\ (\\rs \\ ran \\. called_c rs))\" using fD by simp\n then obtain c where ne: \"c \\ (dom \\ \\ (\\rs \\ ran \\. called_c rs))\" thm ex_new_if_finite\n by (metis UNIV_I isu set_eqI)\n thus ?thesis by(fastforce simp add: ncc)\nqed\n \nlemma all_chains_no_call_upd_r: \"all_chains (no_call_to c) \\ rs \\ (\\(c \\ x)),\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ rs \\\\<^sub>r t\"\nproof (rule iffI, goal_cases)\n case 1\n from 1(2,1) show ?case \n by(induction rule: iptables_bigstep_r.induct; \n (simp add: iptables_bigstep_r.intros no_call_to_def all_chains_def split: if_splits;fail)?)\nnext\n case 2\n from 2(2,1) show ?case \n by(induction rule: iptables_bigstep_r.induct; \n (simp add: iptables_bigstep_r.intros no_call_to_def all_chains_def split: action.splits;fail)?)\nqed\n\n(* in a sense, this is code duplication with Ruleset_Update, but it's different enough that I can't use it. *)\nlemma all_chains_no_call_upd_orig: \"all_chains (no_call_to c) \\ rs \\ (\\(c \\ x)),\\,p\\ \\rs,s\\ \\ t \\ \\,\\,p\\ \\rs,s\\ \\ t\"\nproof (rule iffI, goal_cases)\n case 1\n from 1(2,1) show ?case \n by(induction rs s t rule: iptables_bigstep.induct; \n (simp add: iptables_bigstep.intros no_call_to_def all_chains_def split: if_splits;fail)?)\nnext\n case 2\n from 2(2,1) show ?case \n by(induction rule: iptables_bigstep.induct; \n (simp add: iptables_bigstep.intros no_call_to_def all_chains_def split: action.splits;fail)?)\nqed\n \n \ncorollary r_eq_orig''': assumes \"finite (ran \\)\" and \"\\r \\ set rs. get_action r \\ Return\"\n shows \"\\,\\,p\\ rs \\\\<^sub>r t \\ \\,\\,p\\ \\rs, Undecided\\ \\ t\"\nproof -\n from assms have \"finite ({rs} \\ (ran \\))\" by simp\n from ex_no_call[OF this] obtain c where c: \"(\\rs\\ran \\. no_call_to c rs)\" \"no_call_to c rs\" by blast\n hence acnc: \"all_chains (no_call_to c) \\ rs\" unfolding all_chains_def by (simp add: ranI)\n have ranaway: \"\\rs\\ran (\\(c \\ rs)). no_call_to c rs\"\n proof -\n { (* hammer *)\n fix rsa :: \"'a rule list\"\n assume a1: \"rsa \\ ran (\\(c \\ rs))\"\n have \"\\R. rs \\ R \\ Collect (no_call_to c)\"\n using c(2) by force\n then have \"rsa \\ ran (\\(c := None)) \\ Collect (no_call_to c)\"\n using a1 by (metis (no_types) Un_iff Un_insert_left fun_upd_same fun_upd_upd insert_absorb ran_map_upd)\n then have \"no_call_to c rsa\"\n by (metis (no_types) Un_iff c(1) mem_Collect_eq ranI ran_restrictD restrict_complement_singleton_eq)\n }\n thus ?thesis by simp\n qed\n have \"\\(c \\ rs),\\,p\\ rs \\\\<^sub>r t \\ \\(c \\ rs),\\,p\\ \\rs, Undecided\\ \\ t\"\n apply(subst r_call_eq[where c=c and m=MatchAny,symmetric])\n apply(simp;fail)\n apply(simp;fail)\n apply(subst call_eq[where c=c and m=MatchAny,symmetric])\n apply(simp;fail)\n apply(simp;fail)\n apply(simp add: assms;fail)\n apply(rule r_eq_orig')\n apply(fact ranaway)\n done\n thus ?thesis \n apply -\n apply(subst (asm) all_chains_no_call_upd_r[where x=rs, OF acnc])\n apply(subst (asm) all_chains_no_call_upd_orig[where x=rs, OF acnc])\n .\nqed\n\nend\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Alternative_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952052, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.2995037328812037}} {"text": "theory Initialization\nimports UnitPropagate\nbegin\n\n\n(*********************************************************************************)\n(* A D D C L A U S E *)\n(*********************************************************************************)\n\nlemma InvariantsAfterAddClause:\nfixes state::State and clause :: Clause and Vbl :: \"Variable set\"\nassumes\n \"InvariantConsistent (getM state)\"\n \"InvariantUniq (getM state)\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n \"InvariantWatchListsUniq (getWatchList state)\" and\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n \"InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\"\n \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n \"InvariantUniqQ (getQ state)\"\n \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\"\n \"currentLevel (getM state) = 0\"\n \"(getConflictFlag state) \\ (getQ state) = []\"\n \"InvariantVarsM (getM state) F0 Vbl\"\n \"InvariantVarsQ (getQ state) F0 Vbl\"\n \"InvariantVarsF (getF state) F0 Vbl\"\n \"finite Vbl\"\n \"vars clause \\ vars F0\"\nshows\n \"let state' = (addClause clause state) in\n InvariantConsistent (getM state') \\ \n InvariantUniq (getM state') \\ \n InvariantWatchListsContainOnlyClausesFromF (getWatchList state') (getF state') \\ \n InvariantWatchListsUniq (getWatchList state') \\ \n InvariantWatchListsCharacterization (getWatchList state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesEl (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesDiffer (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchCharacterization (getF state') (getWatch1 state') (getWatch2 state') (getM state') \\ \n InvariantConflictFlagCharacterization (getConflictFlag state') (getF state') (getM state') \\ \n InvariantConflictClauseCharacterization (getConflictFlag state') (getConflictClause state') (getF state') (getM state') \\ \n InvariantQCharacterization (getConflictFlag state') (getQ state') (getF state') (getM state') \\ \n InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state')) \\ \n InvariantUniqQ (getQ state') \\ \n InvariantVarsQ (getQ state') F0 Vbl \\ \n InvariantVarsM (getM state') F0 Vbl \\ \n InvariantVarsF (getF state') F0 Vbl \\ \n currentLevel (getM state') = 0 \\ \n ((getConflictFlag state') \\ (getQ state') = [])\n\"\nproof-\n let ?clause' = \"remdups (removeFalseLiterals clause (elements (getM state)))\"\n\n have *: \"\\ l. l el ?clause' \\ \\ literalFalse l (elements (getM state))\"\n unfolding removeFalseLiterals_def\n by auto\n\n have \"vars ?clause' \\ vars clause\"\n using varsSubsetValuation[of \"?clause'\" \"clause\"]\n unfolding removeFalseLiterals_def\n by auto\n hence \"vars ?clause' \\ vars F0\"\n using \\vars clause \\ vars F0\\\n by simp\n\n show ?thesis\n proof (cases \"clauseTrue ?clause' (elements (getM state))\")\n case True\n thus ?thesis\n using assms\n unfolding addClause_def\n by simp\n next\n case False\n show ?thesis\n proof (cases \"?clause' = []\")\n case True\n thus ?thesis\n using assms\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n unfolding addClause_def\n by simp\n next\n case False\n thus ?thesis\n proof (cases \"length ?clause' = 1\")\n case True\n let ?state' = \"assertLiteral (hd ?clause') False state\"\n have \"addClause clause state = exhaustiveUnitPropagate ?state'\"\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\\\ ?clause' = []\\\n using \\length ?clause' = 1\\\n unfolding addClause_def\n by (simp add: Let_def)\n moreover\n from \\?clause' \\ []\\\n have \"hd ?clause' \\ set ?clause'\"\n using hd_in_set[of \"?clause'\"]\n by simp\n with *\n have \"\\ literalFalse (hd ?clause') (elements (getM state))\"\n by simp\n hence \"consistent (elements ((getM state) @ [(hd ?clause', False)]))\"\n using assms\n unfolding InvariantConsistent_def\n using consistentAppendElement[of \"elements (getM state)\" \"hd ?clause'\"]\n by simp\n hence \"consistent (elements (getM ?state'))\"\n using assms\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by simp\n moreover\n from \\\\ clauseTrue ?clause' (elements (getM state))\\\n have \"uniq (elements (getM ?state'))\"\n using assms\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using \\hd ?clause' \\ set ?clause'\\\n unfolding InvariantUniq_def\n by (simp add: uniqAppendIff clauseTrueIffContainsTrueLiteral)\n moreover\n have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state')\" and\n \"InvariantWatchListsUniq (getWatchList ?state')\" and\n \"InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n \"InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\" and\n \"InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n using assms\n using WatchInvariantsAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n moreover\n have \"InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state')\"\n using assms\n using InvariantWatchCharacterizationAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state')\"\n using assms\n using InvariantConflictFlagCharacterizationAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"InvariantConflictClauseCharacterization (getConflictFlag ?state') (getConflictClause ?state') (getF ?state') (getM ?state')\"\n using assms\n using InvariantConflictClauseCharacterizationAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n let ?state'' = \"?state'\\ getM := (getM ?state') @ [(hd ?clause', False)] \\\"\n have \"InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state')\"\n proof (cases \"getConflictFlag state\")\n case True\n hence \"getConflictFlag ?state'\"\n using assms\n using assertLiteralConflictFlagEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n thus ?thesis\n using assms\n unfolding InvariantQCharacterization_def\n by simp\n next\n case False\n with \\(getConflictFlag state) \\ (getQ state) = []\\\n have \"getQ state = []\"\n by simp\n thus ?thesis\n using InvariantQCharacterizationAfterAssertLiteralNotInQ[of \"state\" \"hd ?clause'\" \"False\"]\n using assms\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n qed\n moreover\n have \"InvariantUniqQ (getQ ?state')\"\n using assms\n using InvariantUniqQAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"currentLevel (getM ?state') = 0\"\n using assms\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\\\ ?clause' = []\\\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n unfolding addClause_def\n unfolding currentLevel_def\n by (simp add:Let_def markedElementsAppend)\n moreover\n hence \"InvariantGetReasonIsReason (getReason ?state') (getF ?state') (getM ?state') (set (getQ ?state'))\"\n unfolding InvariantGetReasonIsReason_def\n using elementLevelLeqCurrentLevel[of _ \"getM ?state'\"]\n by auto\n moreover\n have \"var (hd ?clause') \\ vars F0\"\n using \\?clause' \\ []\\\n using hd_in_set[of \"?clause'\"]\n using \\vars ?clause' \\ vars F0\\\n using clauseContainsItsLiteralsVariable[of \"hd ?clause'\" \"?clause'\"]\n by auto\n hence \"InvariantVarsQ (getQ ?state') F0 Vbl\"\n \"InvariantVarsM (getM ?state') F0 Vbl\"\n \"InvariantVarsF (getF ?state') F0 Vbl\"\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\\n using \\InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchListsUniq (getWatchList state)\\\n using \\InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\\\n using \\InvariantVarsF (getF state) F0 Vbl\\\n using \\InvariantVarsM (getM state) F0 Vbl\\\n using \\InvariantVarsQ (getQ state) F0 Vbl\\\n using \\consistent (elements (getM ?state'))\\\n using \\uniq (elements (getM ?state'))\\\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using varsAppendValuation[of \"elements (getM state)\" \"[hd ?clause']\"]\n using InvariantVarsQAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\" \"F0\" \"Vbl\"]\n unfolding InvariantVarsM_def\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n by (auto simp add: Let_def)\n moreover\n have \"exhaustiveUnitPropagate_dom ?state'\"\n using exhaustiveUnitPropagateTermination[of \"?state'\" \"F0\" \"Vbl\"]\n using \\InvariantUniqQ (getQ ?state')\\\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state')\\\n using \\InvariantWatchListsUniq (getWatchList ?state')\\\n using \\InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state')\\\n using \\InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state')\\\n using \\InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state')\\\n using \\consistent (elements (getM ?state'))\\\n using \\uniq (elements (getM ?state'))\\\n using \\finite Vbl\\\n using \\InvariantVarsQ (getQ ?state') F0 Vbl\\\n using \\InvariantVarsM (getM ?state') F0 Vbl\\\n using \\InvariantVarsF (getF ?state') F0 Vbl\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n by simp\n ultimately\n show ?thesis\n using \\exhaustiveUnitPropagate_dom ?state'\\\n using InvariantsAfterExhaustiveUnitPropagate[of \"?state'\"]\n using InvariantConflictClauseCharacterizationAfterExhaustivePropagate[of \"?state'\"]\n using conflictFlagOrQEmptyAfterExhaustiveUnitPropagate[of \"?state'\"]\n using exhaustiveUnitPropagatePreservesCurrentLevel[of \"?state'\"]\n using InvariantGetReasonIsReasonAfterExhaustiveUnitPropagate[of \"?state'\"]\n using assms\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n by (auto simp only:Let_def)\n next\n case False\n thus ?thesis\n proof (cases \"clauseTautology ?clause'\")\n case True\n thus ?thesis\n using assms\n using \\\\ ?clause' = []\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' \\ 1\\\n unfolding addClause_def\n by simp\n next\n case False\n from \\\\ ?clause' = []\\ \\length ?clause' \\ 1\\\n have \"length ?clause' > 1\"\n by (induct (?clause')) auto\n\n hence \"nth ?clause' 0 \\ nth ?clause' 1\"\n using distinct_remdups[of \"?clause'\"]\n using nth_eq_iff_index_eq[of \"?clause'\" \"0\" \"1\"]\n using \\\\ ?clause' = []\\\n by auto\n\n let ?state' = \"let clauseIndex = length (getF state) in\n let state' = state\\ getF := (getF state) @ [?clause']\\ in\n let state'' = setWatch1 clauseIndex (nth ?clause' 0) state' in\n let state''' = setWatch2 clauseIndex (nth ?clause' 1) state'' in\n state'''\"\n\n have \"InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n using \\InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\length ?clause' > 1\\\n using \\?clause' \\ []\\\n using nth_mem[of \"0\" \"?clause'\"]\n using nth_mem[of \"1\" \"?clause'\"]\n unfolding InvariantWatchesEl_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def nth_append)\n moreover\n have \"InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n using \\InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\nth ?clause' 0 \\ nth ?clause' 1\\\n unfolding InvariantWatchesDiffer_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n moreover\n have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state')\"\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\\n unfolding InvariantWatchListsContainOnlyClausesFromF_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add:Let_def) (force)+\n moreover\n have \"InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n using \\InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\\n using \\nth ?clause' 0 \\ nth ?clause' 1\\\n unfolding InvariantWatchListsCharacterization_def\n unfolding InvariantWatchListsContainOnlyClausesFromF_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add:Let_def)\n moreover\n have \"InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state')\"\n proof-\n {\n fix c\n assume \"0 \\ c \\ c < length (getF ?state')\"\n fix www1 www2\n assume \"Some www1 = (getWatch1 ?state' c)\" \"Some www2 = (getWatch2 ?state' c)\"\n have \"watchCharacterizationCondition www1 www2 (getM ?state') (nth (getF ?state') c) \\ \n watchCharacterizationCondition www2 www1 (getM ?state') (nth (getF ?state') c)\"\n proof (cases \"c < length (getF state)\")\n case True\n hence \"(nth (getF ?state') c) = (nth (getF state) c)\"\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def nth_append)\n have \"Some www1 = (getWatch1 state c)\" \"Some www2 = (getWatch2 state c)\"\n using True\n using \\Some www1 = (getWatch1 ?state' c)\\ \\Some www2 = (getWatch2 ?state' c)\\\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n thus ?thesis\n using \\InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\\\n unfolding InvariantWatchCharacterization_def\n using \\(nth (getF ?state') c) = (nth (getF state) c)\\\n using True\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n next\n case False\n with \\0 \\ c \\ c < length (getF ?state')\\\n have \"c = length (getF state)\"\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n from \\InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n obtain w1 w2 \n where \n \"w1 el ?clause'\" \"w2 el ?clause'\"\n \"getWatch1 ?state' (length (getF state)) = Some w1\"\n \"getWatch2 ?state' (length (getF state)) = Some w2\"\n unfolding InvariantWatchesEl_def\n unfolding setWatch2_def\n unfolding setWatch1_def\n by (auto simp add: Let_def)\n hence \"w1 = www1\" and \"w2 = www2\"\n using \\Some www1 = (getWatch1 ?state' c)\\ \\Some www2 = (getWatch2 ?state' c)\\\n using \\c = length (getF state)\\\n by auto\n have \"\\ literalFalse w1 (elements (getM ?state'))\" \n \"\\ literalFalse w2 (elements (getM ?state'))\"\n using \\w1 el ?clause'\\ \\w2 el ?clause'\\\n using *\n unfolding setWatch2_def\n unfolding setWatch1_def\n by (auto simp add: Let_def)\n thus ?thesis\n using \\w1 = www1\\ \\w2 = www2\\\n unfolding watchCharacterizationCondition_def\n unfolding setWatch2_def\n unfolding setWatch1_def\n by (auto simp add: Let_def)\n qed\n } thus ?thesis\n unfolding InvariantWatchCharacterization_def\n by auto\n qed\n moreover \n have \"\\ l. length (getF state) \\ set (getWatchList state l)\"\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\ \n unfolding InvariantWatchListsContainOnlyClausesFromF_def\n by auto\n hence \"InvariantWatchListsUniq (getWatchList ?state')\"\n using \\InvariantWatchListsUniq (getWatchList state)\\\n using \\nth ?clause' 0 \\ nth ?clause' 1\\\n unfolding InvariantWatchListsUniq_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add:Let_def uniqAppendIff)\n moreover\n from * \n have \"\\ clauseFalse ?clause' (elements (getM state))\"\n using \\?clause' \\ []\\\n by (auto simp add: clauseFalseIffAllLiteralsAreFalse)\n hence \"InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state')\"\n using \\InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\\\n unfolding InvariantConflictFlagCharacterization_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def formulaFalseIffContainsFalseClause)\n moreover\n have \"\\ (\\ l. isUnitClause ?clause' l (elements (getM state)))\"\n proof-\n {\n assume \"\\ ?thesis\"\n then obtain l\n where \"isUnitClause ?clause' l (elements (getM state))\"\n by auto\n hence \"l el ?clause'\"\n unfolding isUnitClause_def\n by simp\n have \"\\ l'. l' el ?clause' \\ l \\ l'\"\n proof-\n from \\length ?clause' > 1\\\n obtain a1::Literal and a2::Literal\n where \"a1 el ?clause'\" \"a2 el ?clause'\" \"a1 \\ a2\"\n using lengthGtOneTwoDistinctElements[of \"?clause'\"]\n by (auto simp add: uniqDistinct) (force)\n thus ?thesis\n proof (cases \"a1 = l\")\n case True\n thus ?thesis\n using \\a1 \\ a2\\ \\a2 el ?clause'\\\n by auto\n next\n case False\n thus ?thesis\n using \\a1 el ?clause'\\\n by auto\n qed\n qed\n then obtain l'::Literal\n where \"l \\ l'\" \"l' el ?clause'\"\n by auto\n with * \n have \"\\ literalFalse l' (elements (getM state))\"\n by simp\n hence \"False\"\n using \\isUnitClause ?clause' l (elements (getM state))\\\n using \\l \\ l'\\ \\l' el ?clause'\\\n unfolding isUnitClause_def\n by auto\n } thus ?thesis\n by auto\n qed\n hence \"InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state')\"\n using assms\n unfolding InvariantQCharacterization_def\n unfolding setWatch2_def\n unfolding setWatch1_def\n by (auto simp add: Let_def)\n moreover\n have \"InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state @ [?clause']) (getM state)\"\n proof (cases \"getConflictFlag state\")\n case False\n thus ?thesis\n unfolding InvariantConflictClauseCharacterization_def\n by simp\n next\n case True\n hence \"getConflictClause state < length (getF state)\"\n using \\InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\\\n unfolding InvariantConflictClauseCharacterization_def\n by (auto simp add: Let_def)\n hence \"nth ((getF state) @ [?clause']) (getConflictClause state) = \n nth (getF state) (getConflictClause state)\"\n by (simp add: nth_append)\n thus ?thesis\n using \\InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\\\n unfolding InvariantConflictClauseCharacterization_def\n by (auto simp add: Let_def clauseFalseAppendValuation)\n qed\n moreover\n have \"InvariantGetReasonIsReason (getReason ?state') (getF ?state') (getM ?state') (set (getQ ?state'))\"\n using \\currentLevel (getM state) = 0\\\n using elementLevelLeqCurrentLevel[of _ \"getM state\"]\n unfolding setWatch1_def\n unfolding setWatch2_def\n unfolding InvariantGetReasonIsReason_def\n by (simp add: Let_def)\n moreover\n have \"InvariantVarsF (getF ?state') F0 Vbl\"\n using \\InvariantVarsF (getF state) F0 Vbl\\\n using \\vars ?clause' \\ vars F0\\\n using varsAppendFormulae[of \"getF state\" \"[?clause']\"]\n unfolding setWatch2_def\n unfolding setWatch1_def\n unfolding InvariantVarsF_def\n by (auto simp add: Let_def)\n ultimately\n show ?thesis\n using assms\n using \\length ?clause' > 1\\\n using \\\\ ?clause' = []\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' \\ 1\\\n using \\\\ clauseTautology ?clause'\\\n unfolding addClause_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n qed\n qed\n qed\n qed\nqed\n\n\nlemma InvariantEquivalentZLAfterAddClause:\nfixes Phi :: Formula and clause :: Clause and state :: State and Vbl :: \"Variable set\"\nassumes \n*:\"(getSATFlag state = UNDEF \\ InvariantEquivalentZL (getF state) (getM state) Phi) \\ \n (getSATFlag state = FALSE \\ \\ satisfiable Phi)\"\n \"InvariantConsistent (getM state)\"\n \"InvariantUniq (getM state)\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n \"InvariantWatchListsUniq (getWatchList state)\" and\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n \"InvariantUniqQ (getQ state)\"\n \"(getConflictFlag state) \\ (getQ state) = []\"\n \"currentLevel (getM state) = 0\"\n \"InvariantVarsM (getM state) F0 Vbl\"\n \"InvariantVarsQ (getQ state) F0 Vbl\"\n \"InvariantVarsF (getF state) F0 Vbl\"\n \"finite Vbl\"\n \"vars clause \\ vars F0\"\nshows\n\"let state' = addClause clause state in\n let Phi' = Phi @ [clause] in\n let Phi'' = (if (clauseTautology clause) then Phi else Phi') in\n (getSATFlag state' = UNDEF \\ InvariantEquivalentZL (getF state') (getM state') Phi'') \\ \n (getSATFlag state' = FALSE \\ \\satisfiable Phi'')\"\nproof-\n let ?clause' = \"remdups (removeFalseLiterals clause (elements (getM state)))\"\n\n from \\currentLevel (getM state) = 0\\ \n have \"getM state = prefixToLevel 0 (getM state)\"\n by (rule currentLevelZeroTrailEqualsItsPrefixToLevelZero)\n\n have **: \"\\ l. l el ?clause' \\ \\ literalFalse l (elements (getM state))\"\n unfolding removeFalseLiterals_def\n by auto\n\n have \"vars ?clause' \\ vars clause\"\n using varsSubsetValuation[of \"?clause'\" \"clause\"]\n unfolding removeFalseLiterals_def\n by auto\n hence \"vars ?clause' \\ vars F0\"\n using \\vars clause \\ vars F0\\\n by simp\n\n show ?thesis\n proof (cases \"clauseTrue ?clause' (elements (getM state))\")\n case True\n show ?thesis\n proof-\n from True \n have \"clauseTrue clause (elements (getM state))\"\n using clauseTrueRemoveDuplicateLiterals\n [of \"removeFalseLiterals clause (elements (getM state))\" \"elements (getM state)\"]\n using clauseTrueRemoveFalseLiterals\n [of \"elements (getM state)\" \"clause\"]\n using \\InvariantConsistent (getM state)\\\n unfolding InvariantConsistent_def\n by simp\n show ?thesis\n proof (cases \"getSATFlag state = UNDEF\")\n case True\n thus ?thesis\n using *\n using \\clauseTrue clause (elements (getM state))\\\n using \\getM state = prefixToLevel 0 (getM state)\\\n using satisfiedClauseCanBeRemoved\n [of \"getF state\" \"(elements (prefixToLevel 0 (getM state)))\" \"Phi\" \"clause\"]\n using \\clauseTrue ?clause' (elements (getM state))\\\n unfolding addClause_def\n unfolding InvariantEquivalentZL_def\n by auto\n next\n case False\n thus ?thesis\n using *\n using \\clauseTrue ?clause' (elements (getM state))\\\n using satisfiableAppend[of \"Phi\" \"[clause]\"]\n unfolding addClause_def\n by force\n qed\n qed\n next\n case False\n show ?thesis\n proof (cases \"?clause' = []\")\n case True\n show ?thesis\n proof (cases \"getSATFlag state = UNDEF\")\n case True\n thus ?thesis\n using *\n using falseAndDuplicateLiteralsCanBeRemoved\n [of \"getF state\" \"(elements (prefixToLevel 0 (getM state)))\" \"[]\" \"Phi\" \"clause\"]\n using \\getM state = prefixToLevel 0 (getM state)\\\n using formulaWithEmptyClauseIsUnsatisfiable[of \"(getF state @ val2form (elements (getM state)) @ [[]])\"]\n using satisfiableEquivalent\n using \\?clause' = []\\\n unfolding addClause_def\n unfolding InvariantEquivalentZL_def\n using satisfiableAppendTautology\n by auto\n next\n case False\n thus ?thesis\n using \\?clause' = []\\\n using *\n using satisfiableAppend[of \"Phi\" \"[clause]\"]\n unfolding addClause_def\n by force\n qed\n next\n case False\n thus ?thesis\n proof (cases \"length ?clause' = 1\")\n case True\n from \\length ?clause' = 1\\\n have \"[hd ?clause'] = ?clause'\"\n using lengthOneCharacterisation[of \"?clause'\"]\n by simp\n\n with \\length ?clause' = 1\\\n have \"val2form (elements (getM state)) @ [?clause'] = val2form ((elements (getM state)) @ ?clause')\"\n using val2formAppend[of \"elements (getM state)\" \"?clause'\"]\n using val2formOfSingleLiteralValuation[of \"?clause'\"]\n by auto\n\n let ?state' = \"assertLiteral (hd ?clause') False state\"\n have \"addClause clause state = exhaustiveUnitPropagate ?state'\"\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\\\ ?clause' = []\\\n using \\length ?clause' = 1\\\n unfolding addClause_def\n by (simp add: Let_def)\n moreover\n from \\?clause' \\ []\\\n have \"hd ?clause' \\ set ?clause'\"\n using hd_in_set[of \"?clause'\"]\n by simp\n with **\n have \"\\ literalFalse (hd ?clause') (elements (getM state))\"\n by simp\n hence \"consistent (elements ((getM state) @ [(hd ?clause', False)]))\"\n using assms\n unfolding InvariantConsistent_def\n using consistentAppendElement[of \"elements (getM state)\" \"hd ?clause'\"]\n by simp\n hence \"consistent (elements (getM ?state'))\"\n using assms\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by simp\n moreover\n from \\\\ clauseTrue ?clause' (elements (getM state))\\\n have \"uniq (elements (getM ?state'))\"\n using assms\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using \\hd ?clause' \\ set ?clause'\\\n unfolding InvariantUniq_def\n by (simp add: uniqAppendIff clauseTrueIffContainsTrueLiteral)\n moreover\n have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state')\" and\n \"InvariantWatchListsUniq (getWatchList ?state')\" and\n \"InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n \"InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\" and\n \"InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\"\n using assms\n using WatchInvariantsAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n moreover\n have \"InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state')\"\n using assms\n using InvariantWatchCharacterizationAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state')\"\n using assms\n using InvariantConflictFlagCharacterizationAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state')\"\n proof (cases \"getConflictFlag state\")\n case True\n hence \"getConflictFlag ?state'\"\n using assms\n using assertLiteralConflictFlagEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n thus ?thesis\n using assms\n unfolding InvariantQCharacterization_def\n by simp\n next\n case False\n with \\(getConflictFlag state) \\ (getQ state) = []\\\n have \"getQ state = []\"\n by simp\n thus ?thesis\n using InvariantQCharacterizationAfterAssertLiteralNotInQ[of \"state\" \"hd ?clause'\" \"False\"]\n using assms\n using \\uniq (elements (getM ?state'))\\\n using \\consistent (elements (getM ?state'))\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp add: Let_def)\n qed\n moreover\n have\"InvariantUniqQ (getQ ?state')\"\n using assms\n using InvariantUniqQAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\"]\n by (simp add: Let_def)\n moreover\n have \"currentLevel (getM ?state') = 0\"\n using assms\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\\\ ?clause' = []\\\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n unfolding addClause_def\n unfolding currentLevel_def\n by (simp add:Let_def markedElementsAppend)\n moreover\n have \"var (hd ?clause') \\ vars F0\"\n using \\?clause' \\ []\\\n using hd_in_set[of \"?clause'\"]\n using \\vars ?clause' \\ vars F0\\\n using clauseContainsItsLiteralsVariable[of \"hd ?clause'\" \"?clause'\"]\n by auto\n hence \"InvariantVarsM (getM ?state') F0 Vbl\"\n \"InvariantVarsQ (getQ ?state') F0 Vbl\"\n \"InvariantVarsF (getF ?state') F0 Vbl\"\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\\n using \\InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchListsUniq (getWatchList state)\\\n using \\InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\\\n using \\InvariantVarsF (getF state) F0 Vbl\\\n using \\InvariantVarsM (getM state) F0 Vbl\\\n using \\InvariantVarsQ (getQ state) F0 Vbl\\\n using \\consistent (elements (getM ?state'))\\\n using \\uniq (elements (getM ?state'))\\\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using varsAppendValuation[of \"elements (getM state)\" \"[hd ?clause']\"]\n using InvariantVarsQAfterAssertLiteral[of \"state\" \"hd ?clause'\" \"False\" \"F0\" \"Vbl\"]\n unfolding InvariantVarsM_def\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n by (auto simp add: Let_def)\n moreover\n have \"exhaustiveUnitPropagate_dom ?state'\"\n using exhaustiveUnitPropagateTermination[of \"?state'\" \"F0\" \"Vbl\"]\n using \\InvariantUniqQ (getQ ?state')\\\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state')\\\n using \\InvariantWatchListsUniq (getWatchList ?state')\\\n using \\InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state')\\\n using \\InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state')\\\n using \\InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state')\\\n using \\InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state')\\\n using \\consistent (elements (getM ?state'))\\\n using \\uniq (elements (getM ?state'))\\\n using \\finite Vbl\\\n using \\InvariantVarsM (getM ?state') F0 Vbl\\\n using \\InvariantVarsQ (getQ ?state') F0 Vbl\\\n using \\InvariantVarsF (getF ?state') F0 Vbl\\\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n by simp\n moreover\n have \"\\ clauseTautology clause\"\n proof-\n {\n assume \"\\ ?thesis\"\n then obtain l'\n where \"l' el clause\" \"opposite l' el clause\"\n by (auto simp add: clauseTautologyCharacterization)\n have False\n proof (cases \"l' el ?clause'\")\n case True\n have \"opposite l' el ?clause'\"\n proof-\n {\n assume \"\\ ?thesis\"\n hence \"literalFalse l' (elements (getM state))\"\n using \\l' el clause\\\n using \\opposite l' el clause\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using clauseTrueIffContainsTrueLiteral[of \"?clause'\" \"elements (getM state)\"]\n unfolding removeFalseLiterals_def\n by auto\n hence False\n using \\l' el ?clause'\\\n unfolding removeFalseLiterals_def\n by auto\n } thus ?thesis\n by auto\n qed\n have \"\\ x. x el ?clause' \\ x = l'\"\n using \\l' el ?clause'\\\n using \\length ?clause' = 1\\\n using lengthOneImpliesOnlyElement[of \"?clause'\" \"l'\"]\n by simp\n thus ?thesis\n using \\opposite l' el ?clause'\\\n by auto\n next\n case False\n hence \"literalFalse l' (elements (getM state))\"\n using \\l' el clause\\\n unfolding removeFalseLiterals_def\n by simp\n hence \"\\ literalFalse (opposite l') (elements (getM state))\"\n using \\InvariantConsistent (getM state)\\\n unfolding InvariantConsistent_def\n by (auto simp add: inconsistentCharacterization)\n hence \"opposite l' el ?clause'\"\n using \\opposite l' el clause\\\n unfolding removeFalseLiterals_def\n by auto\n thus ?thesis\n using \\literalFalse l' (elements (getM state))\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n by (simp add: clauseTrueIffContainsTrueLiteral)\n qed\n } thus ?thesis\n by auto\n qed\n moreover\n note clc = calculation\n\n show ?thesis\n proof (cases \"getSATFlag state = UNDEF\")\n case True\n hence \"InvariantEquivalentZL (getF state) (getM state) Phi\"\n using assms\n by simp\n hence \"InvariantEquivalentZL (getF ?state') (getM ?state') (Phi @ [clause])\"\n using *\n using falseAndDuplicateLiteralsCanBeRemoved\n [of \"getF state\" \"(elements (prefixToLevel 0 (getM state)))\" \"[]\" \"Phi\" \"clause\"]\n using \\[hd ?clause'] = ?clause'\\\n using \\getM state = prefixToLevel 0 (getM state)\\\n using \\currentLevel (getM state) = 0\\\n using prefixToLevelAppend[of \"0\" \"getM state\" \"[(hd ?clause', False)]\"]\n using \\InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\\\n using \\InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\\\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using \\val2form (elements (getM state)) @ [?clause'] = val2form ((elements (getM state)) @ ?clause')\\\n using \\\\ ?clause' = []\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' = 1\\\n using \\getSATFlag state = UNDEF\\\n unfolding addClause_def\n unfolding InvariantEquivalentZL_def\n by (simp add: Let_def)\n hence \"let state'' = addClause clause state in\n InvariantEquivalentZL (getF state'') (getM state'') (Phi @ [clause]) \\ \n getSATFlag state'' = getSATFlag state\"\n using clc\n using InvariantEquivalentZLAfterExhaustiveUnitPropagate[of \"?state'\" \"Phi @ [clause]\"]\n using exhaustiveUnitPropagatePreservedVariables[of \"?state'\"]\n using assms\n unfolding InvariantConsistent_def\n unfolding InvariantUniq_def\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n by (auto simp only: Let_def)\n thus ?thesis\n using True\n using \\\\ clauseTautology clause\\\n by (auto simp only: Let_def split: if_split) \n next\n case False\n hence \"getSATFlag state = FALSE\" \"\\ satisfiable Phi\"\n using *\n by auto\n hence \"getSATFlag ?state' = FALSE\"\n using assertLiteralEffect[of \"state\" \"hd ?clause'\" \"False\"]\n using assms\n by simp\n hence \"getSATFlag (exhaustiveUnitPropagate ?state') = FALSE\" \n using clc\n using exhaustiveUnitPropagatePreservedVariables[of \"?state'\"]\n by (auto simp only: Let_def)\n moreover\n have \"\\ satisfiable (Phi @ [clause])\"\n using satisfiableAppend[of \"Phi\" \"[clause]\"]\n using \\\\ satisfiable Phi\\\n by auto\n ultimately\n show ?thesis\n using clc\n using \\\\ clauseTautology clause\\\n by (simp only: Let_def) simp\n qed\n next\n case False\n thus ?thesis\n proof (cases \"clauseTautology ?clause'\")\n case True\n moreover\n hence \"clauseTautology clause\"\n unfolding removeFalseLiterals_def\n by (auto simp add: clauseTautologyCharacterization)\n ultimately\n show ?thesis\n using *\n using \\\\ ?clause' = []\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' \\ 1\\\n using satisfiableAppend[of \"Phi\" \"[clause]\"]\n unfolding addClause_def\n (* Tautology problem *)\n by (auto simp add: Let_def)\n next\n case False\n have \"\\ clauseTautology clause\"\n proof-\n {\n assume \"\\ ?thesis\"\n then obtain l' \n where \"l' el clause\" \"opposite l' el clause\"\n by (auto simp add: clauseTautologyCharacterization)\n have False\n proof (cases \"l' el ?clause'\")\n case True\n hence \"\\ opposite l' el ?clause'\"\n using \\\\ clauseTautology ?clause'\\\n by (auto simp add: clauseTautologyCharacterization)\n hence \"literalFalse (opposite l') (elements (getM state))\"\n using \\opposite l' el clause\\\n unfolding removeFalseLiterals_def\n by auto\n thus ?thesis\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\l' el ?clause'\\\n by (simp add: clauseTrueIffContainsTrueLiteral)\n next\n case False\n hence \"literalFalse l' (elements (getM state))\"\n using \\l' el clause\\\n unfolding removeFalseLiterals_def\n by auto\n hence \"\\ literalFalse (opposite l') (elements (getM state))\"\n using \\InvariantConsistent (getM state)\\\n unfolding InvariantConsistent_def\n by (auto simp add: inconsistentCharacterization)\n hence \"opposite l' el ?clause'\"\n using \\opposite l' el clause\\\n unfolding removeFalseLiterals_def\n by auto\n thus ?thesis\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\literalFalse l' (elements (getM state))\\\n by (simp add: clauseTrueIffContainsTrueLiteral)\n qed\n } thus ?thesis\n by auto\n qed\n show ?thesis\n proof (cases \"getSATFlag state = UNDEF\")\n case True\n show ?thesis\n using *\n using falseAndDuplicateLiteralsCanBeRemoved\n [of \"getF state\" \"(elements (prefixToLevel 0 (getM state)))\" \"[]\" \"Phi\" \"clause\"]\n using \\getM state = prefixToLevel 0 (getM state)\\\n using \\\\ ?clause' = []\\\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' \\ 1\\\n using \\\\ clauseTautology ?clause'\\\n using \\\\ clauseTautology clause\\\n using \\getSATFlag state = UNDEF\\\n unfolding addClause_def\n unfolding InvariantEquivalentZL_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n using clauseOrderIrrelevant[of \"getF state\" \"[?clause']\" \"val2form (elements (getM state))\" \"[]\"]\n using equivalentFormulaeTransitivity[of \n \"getF state @ remdups (removeFalseLiterals clause (elements (getM state))) # val2form (elements (getM state))\" \n \"getF state @ val2form (elements (getM state)) @ [remdups (removeFalseLiterals clause (elements (getM state)))]\"\n \"Phi @ [clause]\"]\n by (auto simp add: Let_def)\n next\n case False\n thus ?thesis\n using *\n using satisfiableAppend[of \"Phi\" \"[clause]\"]\n using \\\\ clauseTrue ?clause' (elements (getM state))\\\n using \\length ?clause' \\ 1\\\n using \\\\ clauseTautology ?clause'\\\n using \\\\ clauseTautology clause\\\n unfolding addClause_def\n unfolding setWatch1_def\n unfolding setWatch2_def\n by (auto simp add: Let_def)\n qed\n qed\n qed\n qed\n qed\nqed\n\n(*********************************************************************************)\n(* I N I T I A L I Z E *)\n(*********************************************************************************)\n\nlemma InvariantsAfterInitializationStep:\nfixes\n state :: State and Phi :: Formula and Vbl::\"Variable set\"\nassumes\n \"InvariantConsistent (getM state)\"\n \"InvariantUniq (getM state)\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n \"InvariantWatchListsUniq (getWatchList state)\" and\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n \"InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\"\n \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\"\n \"InvariantUniqQ (getQ state)\"\n \"(getConflictFlag state) \\ (getQ state) = []\"\n \"currentLevel (getM state) = 0\"\n \"finite Vbl\"\n \"InvariantVarsM (getM state) F0 Vbl\"\n \"InvariantVarsQ (getQ state) F0 Vbl\"\n \"InvariantVarsF (getF state) F0 Vbl\"\n \"state' = initialize Phi state\"\n \"set Phi \\ set F0\"\nshows\n \"InvariantConsistent (getM state') \\ \n InvariantUniq (getM state') \\ \n InvariantWatchListsContainOnlyClausesFromF (getWatchList state') (getF state') \\ \n InvariantWatchListsUniq (getWatchList state') \\ \n InvariantWatchListsCharacterization (getWatchList state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesEl (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesDiffer (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchCharacterization (getF state') (getWatch1 state') (getWatch2 state') (getM state') \\ \n InvariantConflictFlagCharacterization (getConflictFlag state') (getF state') (getM state') \\ \n InvariantConflictClauseCharacterization (getConflictFlag state') (getConflictClause state') (getF state') (getM state') \\ \n InvariantQCharacterization (getConflictFlag state') (getQ state') (getF state') (getM state') \\ \n InvariantUniqQ (getQ state') \\ \n InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state')) \\ \n InvariantVarsM (getM state') F0 Vbl \\ \n InvariantVarsQ (getQ state') F0 Vbl \\ \n InvariantVarsF (getF state') F0 Vbl \\ \n ((getConflictFlag state') \\ (getQ state') = []) \\ \n currentLevel (getM state') = 0\" (is \"?Inv state'\")\nusing assms\nproof (induct Phi arbitrary: state)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons clause Phi')\n let ?state' = \"addClause clause state\"\n have \"?Inv ?state'\"\n using Cons\n using InvariantsAfterAddClause[of \"state\" \"F0\" \"Vbl\" \"clause\"]\n using formulaContainsItsClausesVariables[of \"clause\" \"F0\"]\n by (simp add: Let_def)\n thus ?case\n using Cons(1)[of \"?state'\"] \\finite Vbl\\ Cons(18) Cons(19) Cons(20) Cons(21) Cons(22)\n by (simp add: Let_def)\nqed\n\nlemma InvariantEquivalentZLAfterInitializationStep:\nfixes Phi :: Formula\nassumes\n \"(getSATFlag state = UNDEF \\ InvariantEquivalentZL (getF state) (getM state) (filter (\\ c. \\ clauseTautology c) Phi)) \\ \n (getSATFlag state = FALSE \\ \\ satisfiable (filter (\\ c. \\ clauseTautology c) Phi))\"\n \"InvariantConsistent (getM state)\"\n \"InvariantUniq (getM state)\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n \"InvariantWatchListsUniq (getWatchList state)\" and\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n \"InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\"\n \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n \"InvariantNoDecisionsWhenConflict (getF state) (getM state) (currentLevel (getM state))\"\n \"InvariantNoDecisionsWhenUnit (getF state) (getM state) (currentLevel (getM state))\"\n \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\"\n \"InvariantUniqQ (getQ state)\"\n \"finite Vbl\"\n \"InvariantVarsM (getM state) F0 Vbl\"\n \"InvariantVarsQ (getQ state) F0 Vbl\"\n \"InvariantVarsF (getF state) F0 Vbl\"\n \"(getConflictFlag state) \\ (getQ state) = []\"\n \"currentLevel (getM state) = 0\"\n \"F0 = Phi @ Phi'\"\nshows\n \"let state' = initialize Phi' state in\n (getSATFlag state' = UNDEF \\ InvariantEquivalentZL (getF state') (getM state') (filter (\\ c. \\ clauseTautology c) F0)) \\ \n (getSATFlag state' = FALSE \\ \\satisfiable (filter (\\ c. \\ clauseTautology c) F0))\"\nusing assms\nproof (induct Phi' arbitrary: state Phi)\n case Nil\n thus ?case\n unfolding prefixToLevel_def equivalentFormulae_def\n by simp\nnext\n case (Cons clause Phi'')\n let ?filt = \"\\ F. (filter (\\ c. \\ clauseTautology c) F)\"\n let ?state' = \"addClause clause state\"\n let ?Phi' = \"?filt Phi @ [clause]\"\n let ?Phi'' = \"if clauseTautology clause then ?filt Phi else ?Phi'\"\n from Cons\n have \"getSATFlag ?state' = UNDEF \\ InvariantEquivalentZL (getF ?state') (getM ?state') (?filt ?Phi'') \\ \n getSATFlag ?state' = FALSE \\ \\ satisfiable (?filt ?Phi'')\"\n using formulaContainsItsClausesVariables[of \"clause\" \"F0\"]\n using InvariantEquivalentZLAfterAddClause[of \"state\" \"?filt Phi\" \"F0\" \"Vbl\" \"clause\"]\n by (simp add:Let_def)\n hence \"getSATFlag ?state' = UNDEF \\ InvariantEquivalentZL (getF ?state') (getM ?state') (?filt (Phi @ [clause])) \\\n getSATFlag ?state' = FALSE \\ \\ satisfiable (?filt (Phi @ [clause]))\"\n by auto\n moreover\n from Cons\n have \"InvariantConsistent (getM ?state') \\ \n InvariantUniq (getM ?state') \\ \n InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state') (getF ?state') \\ \n InvariantWatchListsUniq (getWatchList ?state') \\ \n InvariantWatchListsCharacterization (getWatchList ?state') (getWatch1 ?state') (getWatch2 ?state') \\ \n InvariantWatchesEl (getF ?state') (getWatch1 ?state') (getWatch2 ?state') \\ \n InvariantWatchesDiffer (getF ?state') (getWatch1 ?state') (getWatch2 ?state') \\ \n InvariantWatchCharacterization (getF ?state') (getWatch1 ?state') (getWatch2 ?state') (getM ?state') \\ \n InvariantConflictFlagCharacterization (getConflictFlag ?state') (getF ?state') (getM ?state') \\ \n InvariantConflictClauseCharacterization (getConflictFlag ?state') (getConflictClause ?state') (getF ?state') (getM ?state') \\ \n InvariantQCharacterization (getConflictFlag ?state') (getQ ?state') (getF ?state') (getM ?state') \\ \n InvariantGetReasonIsReason (getReason ?state') (getF ?state') (getM ?state') (set (getQ ?state')) \\ \n InvariantUniqQ (getQ ?state') \\ \n InvariantVarsM (getM ?state') F0 Vbl \\ \n InvariantVarsQ (getQ ?state') F0 Vbl \\ \n InvariantVarsF (getF ?state') F0 Vbl \\ \n ((getConflictFlag ?state') \\ (getQ ?state') = []) \\ \n currentLevel (getM ?state') = 0\"\n using formulaContainsItsClausesVariables[of \"clause\" \"F0\"]\n using InvariantsAfterAddClause\n by (simp add: Let_def)\n moreover\n hence \"InvariantNoDecisionsWhenConflict (getF ?state') (getM ?state') (currentLevel (getM ?state'))\"\n \"InvariantNoDecisionsWhenUnit (getF ?state') (getM ?state') (currentLevel (getM ?state'))\"\n unfolding InvariantNoDecisionsWhenConflict_def\n unfolding InvariantNoDecisionsWhenUnit_def\n by auto\n ultimately\n show ?case\n using Cons(1)[of \"?state'\" \"Phi @ [clause]\"] \\finite Vbl\\ Cons(23) Cons(24)\n by (simp add: Let_def)\nqed\n\nlemma InvariantsAfterInitialization:\nshows\n \"let state' = (initialize F0 initialState) in\n InvariantConsistent (getM state') \\ \n InvariantUniq (getM state') \\ \n InvariantWatchListsContainOnlyClausesFromF (getWatchList state') (getF state') \\ \n InvariantWatchListsUniq (getWatchList state') \\ \n InvariantWatchListsCharacterization (getWatchList state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesEl (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchesDiffer (getF state') (getWatch1 state') (getWatch2 state') \\ \n InvariantWatchCharacterization (getF state') (getWatch1 state') (getWatch2 state') (getM state') \\ \n InvariantConflictFlagCharacterization (getConflictFlag state') (getF state') (getM state') \\ \n InvariantConflictClauseCharacterization (getConflictFlag state') (getConflictClause state') (getF state') (getM state') \\ \n InvariantQCharacterization (getConflictFlag state') (getQ state') (getF state') (getM state') \\ \n InvariantNoDecisionsWhenConflict (getF state') (getM state') (currentLevel (getM state')) \\ \n InvariantNoDecisionsWhenUnit (getF state') (getM state') (currentLevel (getM state')) \\ \n InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state')) \\ \n InvariantUniqQ (getQ state') \\ \n InvariantVarsM (getM state') F0 {} \\ \n InvariantVarsQ (getQ state') F0 {} \\ \n InvariantVarsF (getF state') F0 {} \\ \n ((getConflictFlag state') \\ (getQ state') = []) \\ \n currentLevel (getM state') = 0\"\nusing InvariantsAfterInitializationStep[of \"initialState\" \"{}\" \"F0\" \"initialize F0 initialState\" \"F0\"]\nunfolding initialState_def\nunfolding InvariantConsistent_def\nunfolding InvariantUniq_def\nunfolding InvariantWatchListsContainOnlyClausesFromF_def\nunfolding InvariantWatchListsUniq_def\nunfolding InvariantWatchListsCharacterization_def\nunfolding InvariantWatchesEl_def\nunfolding InvariantWatchesDiffer_def\nunfolding InvariantWatchCharacterization_def\nunfolding watchCharacterizationCondition_def\nunfolding InvariantConflictFlagCharacterization_def\nunfolding InvariantConflictClauseCharacterization_def\nunfolding InvariantQCharacterization_def\nunfolding InvariantUniqQ_def\nunfolding InvariantNoDecisionsWhenConflict_def\nunfolding InvariantNoDecisionsWhenUnit_def\nunfolding InvariantGetReasonIsReason_def\nunfolding InvariantVarsM_def\nunfolding InvariantVarsQ_def\nunfolding InvariantVarsF_def\nunfolding currentLevel_def\nby (simp) (force)\n\nlemma InvariantEquivalentZLAfterInitialization:\nfixes F0 :: Formula\nshows\n \"let state' = (initialize F0 initialState) in\n let F0' = (filter (\\ c. \\ clauseTautology c) F0) in\n (getSATFlag state' = UNDEF \\ InvariantEquivalentZL (getF state') (getM state') F0') \\ \n (getSATFlag state' = FALSE \\ \\ satisfiable F0')\"\nusing InvariantEquivalentZLAfterInitializationStep[of \"initialState\" \"[]\" \"{}\" \"F0\" \"F0\"]\nunfolding initialState_def\nunfolding InvariantEquivalentZL_def\nunfolding InvariantConsistent_def\nunfolding InvariantUniq_def\nunfolding InvariantWatchesEl_def\nunfolding InvariantWatchesDiffer_def\nunfolding InvariantWatchListsContainOnlyClausesFromF_def\nunfolding InvariantWatchListsUniq_def\nunfolding InvariantWatchListsCharacterization_def\nunfolding InvariantWatchCharacterization_def\nunfolding InvariantConflictFlagCharacterization_def\nunfolding InvariantConflictClauseCharacterization_def\nunfolding InvariantQCharacterization_def\nunfolding InvariantNoDecisionsWhenConflict_def\nunfolding InvariantNoDecisionsWhenUnit_def\nunfolding InvariantGetReasonIsReason_def\nunfolding InvariantVarsM_def\nunfolding InvariantVarsQ_def\nunfolding InvariantVarsF_def\nunfolding watchCharacterizationCondition_def\nunfolding InvariantUniqQ_def\nunfolding prefixToLevel_def\nunfolding equivalentFormulae_def\nunfolding currentLevel_def\nby (auto simp add: Let_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SATSolverVerification/Initialization.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2995012643237018}} {"text": "theory Monitor\n imports MDL Temporal\nbegin\n\ntype_synonym ('h, 't) time = \"('h \\ 't) option\"\n\ndatatype (dead 'a, dead 't :: timestamp, dead 'h) vydra_aux =\n VYDRA_None\n | VYDRA_Bool bool 'h\n | VYDRA_Atom 'a 'h\n | VYDRA_Neg \"('a, 't, 'h) vydra_aux\"\n | VYDRA_Bin \"bool \\ bool \\ bool\" \"('a, 't, 'h) vydra_aux\" \"('a, 't, 'h) vydra_aux\"\n | VYDRA_Prev \"'t \\\" \"('a, 't, 'h) vydra_aux\" 'h \"('t \\ bool) option\"\n | VYDRA_Next \"'t \\\" \"('a, 't, 'h) vydra_aux\" 'h \"'t option\"\n | VYDRA_Since \"'t \\\" \"('a, 't, 'h) vydra_aux\" \"('a, 't, 'h) vydra_aux\" \"('h, 't) time\" nat nat \"nat option\" \"'t option\"\n | VYDRA_Until \"'t \\\" \"('h, 't) time\" \"('a, 't, 'h) vydra_aux\" \"('a, 't, 'h) vydra_aux\" \"('h, 't) time\" nat \"('t \\ bool \\ bool) option\"\n | VYDRA_MatchP \"'t \\\" \"transition iarray\" nat\n \"(bool iarray, nat set, 't, ('h, 't) time, ('a, 't, 'h) vydra_aux list) window\"\n | VYDRA_MatchF \"'t \\\" \"transition iarray\" nat\n \"(bool iarray, nat set, 't, ('h, 't) time, ('a, 't, 'h) vydra_aux list) window\"\n\ntype_synonym ('a, 't, 'h) vydra = \"nat \\ ('a, 't, 'h) vydra_aux\"\n\nfun msize_vydra :: \"nat \\ ('a, 't :: timestamp, 'h) vydra_aux \\ nat\" where\n \"msize_vydra n VYDRA_None = 0\"\n| \"msize_vydra n (VYDRA_Bool b e) = 0\"\n| \"msize_vydra n (VYDRA_Atom a e) = 0\"\n| \"msize_vydra (Suc n) (VYDRA_Bin f v1 v2) = msize_vydra n v1 + msize_vydra n v2 + 1\"\n| \"msize_vydra (Suc n) (VYDRA_Neg v) = msize_vydra n v + 1\"\n| \"msize_vydra (Suc n) (VYDRA_Prev I v e tb) = msize_vydra n v + 1\"\n| \"msize_vydra (Suc n) (VYDRA_Next I v e to) = msize_vydra n v + 1\"\n| \"msize_vydra (Suc n) (VYDRA_Since I vphi vpsi e cphi cpsi cppsi tppsi) = msize_vydra n vphi + msize_vydra n vpsi + 1\"\n| \"msize_vydra (Suc n) (VYDRA_Until I e vphi vpsi epsi c zo) = msize_vydra n vphi + msize_vydra n vpsi + 1\"\n| \"msize_vydra (Suc n) (VYDRA_MatchP I transs qf w) = size_list (msize_vydra n) (w_si w) + size_list (msize_vydra n) (w_sj w) + 1\"\n| \"msize_vydra (Suc n) (VYDRA_MatchF I transs qf w) = size_list (msize_vydra n) (w_si w) + size_list (msize_vydra n) (w_sj w) + 1\"\n| \"msize_vydra _ _ = 0\"\n\nfun next_vydra :: \"('a, 't :: timestamp, 'h) vydra_aux \\ nat\" where\n \"next_vydra (VYDRA_Next I v e None) = 1\"\n| \"next_vydra _ = 0\"\n\ncontext\n fixes init_hd :: \"'h\"\n and run_hd :: \"'h \\ ('h \\ ('t :: timestamp \\ 'a set)) option\"\nbegin\n\ndefinition t0 :: \"('h, 't) time\" where\n \"t0 = (case run_hd init_hd of None \\ None | Some (e', (t, X)) \\ Some (e', t))\"\n\nfun run_t :: \"('h, 't) time \\ (('h, 't) time \\ 't) option\" where\n \"run_t None = None\"\n| \"run_t (Some (e, t)) = (case run_hd e of None \\ Some (None, t)\n | Some (e', (t', X)) \\ Some (Some (e', t'), t))\"\n\nfun read_t :: \"('h, 't) time \\ 't option\" where\n \"read_t None = None\"\n| \"read_t (Some (e, t)) = Some t\"\n\nlemma run_t_read: \"run_t x = Some (x', t) \\ read_t x = Some t\"\n by (cases x) (auto split: option.splits)\n\nlemma read_t_run: \"read_t x = Some t \\ \\x'. run_t x = Some (x', t)\"\n by (cases x) (auto split: option.splits)\n\nlemma reach_event_t: \"reaches_on run_hd e vs e'' \\ run_hd e = Some (e', (t, X)) \\\n run_hd e'' = Some (e''', (t', X')) \\\n reaches_on run_t (Some (e', t)) (map fst vs) (Some (e''', t'))\"\nproof (induction e vs e'' arbitrary: t' X' e''' rule: reaches_on_rev_induct)\n case (2 s s' v vs s'')\n obtain v_t v_X where v_def: \"v = (v_t, v_X)\"\n by (cases v) auto\n have run_t_s'': \"run_t (Some (s'', v_t)) = Some (Some (e''', t'), v_t)\"\n by (auto simp: 2(5))\n show ?case\n using reaches_on_app[OF 2(3)[OF 2(4) 2(2)[unfolded v_def]] run_t_s'']\n by (auto simp: v_def)\nqed (auto intro: reaches_on.intros)\n\nlemma reach_event_t0_t:\n assumes \"reaches_on run_hd init_hd vs e''\" \"run_hd e'' = Some (e''', (t', X'))\"\n shows \"reaches_on run_t t0 (map fst vs) (Some (e''', t'))\"\nproof -\n have t0_not_None: \"t0 \\ None\"\n apply (rule reaches_on.cases[OF assms(1)])\n using assms(2)\n by (auto simp: t0_def split: option.splits prod.splits)\n then show ?thesis\n using reach_event_t[OF assms(1) _ assms(2)]\n by (auto simp: t0_def split: option.splits)\nqed\n\nlemma reaches_on_run_hd_t:\n assumes \"reaches_on run_hd init_hd vs e\"\n shows \"\\x. reaches_on run_t t0 (map fst vs) x\"\nproof (cases vs rule: rev_cases)\n case (snoc ys y)\n show ?thesis\n using assms\n apply (cases y)\n apply (auto simp: snoc dest!: reaches_on_split_last)\n apply (meson reaches_on_app[OF reach_event_t0_t] read_t.simps(2) read_t_run)\n done\nqed (auto intro: reaches_on.intros)\n\ndefinition \"run_subs run = (\\vs. let vs' = map run vs in\n (if (\\x \\ set vs'. Option.is_none x) then None\n else Some (map (fst \\ the) vs', iarray_of_list (map (snd \\ snd \\ the) vs'))))\"\n\nlemma run_subs_lD: \"run_subs run vs = Some (vs', bs) \\\n length vs' = length vs \\ IArray.length bs = length vs\"\n by (auto simp: run_subs_def Let_def iarray_of_list_def split: option.splits if_splits)\n\nlemma run_subs_vD: \"run_subs run vs = Some (vs', bs) \\ j < length vs \\\n \\vj' tj bj. run (vs ! j) = Some (vj', (tj, bj)) \\ vs' ! j = vj' \\ IArray.sub bs j = bj\"\n apply (cases \"run (vs ! j)\")\n apply (auto simp: Option.is_none_def run_subs_def Let_def iarray_of_list_def\n split: option.splits if_splits)\n by (metis image_eqI nth_mem)\n\nfun msize_fmla :: \"('a, 'b :: timestamp) formula \\ nat\"\n and msize_regex :: \"('a, 'b) regex \\ nat\" where\n \"msize_fmla (Bool b) = 0\"\n| \"msize_fmla (Atom a) = 0\"\n| \"msize_fmla (Neg phi) = Suc (msize_fmla phi)\"\n| \"msize_fmla (Bin f phi psi) = Suc (msize_fmla phi + msize_fmla psi)\"\n| \"msize_fmla (Prev I phi) = Suc (msize_fmla phi)\"\n| \"msize_fmla (Next I phi) = Suc (msize_fmla phi)\"\n| \"msize_fmla (Since phi I psi) = Suc (max (msize_fmla phi) (msize_fmla psi))\"\n| \"msize_fmla (Until phi I psi) = Suc (max (msize_fmla phi) (msize_fmla psi))\"\n| \"msize_fmla (MatchP I r) = Suc (msize_regex r)\"\n| \"msize_fmla (MatchF I r) = Suc (msize_regex r)\"\n| \"msize_regex (Lookahead phi) = msize_fmla phi\"\n| \"msize_regex (Symbol phi) = msize_fmla phi\"\n| \"msize_regex (Plus r s) = max (msize_regex r) (msize_regex s)\"\n| \"msize_regex (Times r s) = max (msize_regex r) (msize_regex s)\"\n| \"msize_regex (Star r) = msize_regex r\"\n\nlemma collect_subfmlas_msize: \"x \\ set (collect_subfmlas r []) \\\n msize_fmla x \\ msize_regex r\"\nproof (induction r)\n case (Lookahead phi)\n then show ?case\n by (auto split: if_splits)\nnext\n case (Symbol phi)\n then show ?case\n by (auto split: if_splits)\nnext\n case (Plus r1 r2)\n then show ?case\n by (auto simp: collect_subfmlas_set[of r2 \"collect_subfmlas r1 []\"])\nnext\n case (Times r1 r2)\n then show ?case\n by (auto simp: collect_subfmlas_set[of r2 \"collect_subfmlas r1 []\"])\nnext\n case (Star r)\n then show ?case\n by fastforce\nqed\n\ndefinition \"until_ready I t c zo = (case (c, zo) of (Suc _, Some (t', b1, b2)) \\ (b2 \\ memL t t' I) \\ \\b1 | _ \\ False)\"\n\ndefinition \"while_since_cond I t = (\\(vpsi, e, cpsi :: nat, cppsi, tppsi). cpsi > 0 \\ memL (the (read_t e)) t I)\"\ndefinition \"while_since_body run =\n (\\(vpsi, e, cpsi :: nat, cppsi, tppsi).\n case run vpsi of Some (vpsi', (t', b')) \\\n Some (vpsi', fst (the (run_t e)), cpsi - 1, if b' then Some cpsi else cppsi, if b' then Some t' else tppsi)\n | _ \\ None\n )\"\n\ndefinition \"while_until_cond I t = (\\(vphi, vpsi, epsi, c, zo). \\until_ready I t c zo \\ (case read_t epsi of Some t' \\ memR t t' I | None \\ False))\"\ndefinition \"while_until_body run =\n (\\(vphi, vpsi, epsi, c, zo). case run_t epsi of Some (epsi', t') \\\n (case run vphi of Some (vphi', (_, b1)) \\\n (case run vpsi of Some (vpsi', (_, b2)) \\ Some (vphi', vpsi', epsi', Suc c, Some (t', b1, b2))\n | _ \\ None)\n | _ \\ None))\"\n\nfunction (sequential) run :: \"nat \\ ('a, 't, 'h) vydra_aux \\ (('a, 't, 'h) vydra_aux \\ ('t \\ bool)) option\" where\n \"run n (VYDRA_None) = None\"\n| \"run n (VYDRA_Bool b e) = (case run_hd e of None \\ None\n | Some (e', (t, _)) \\ Some (VYDRA_Bool b e', (t, b)))\"\n| \"run n (VYDRA_Atom a e) = (case run_hd e of None \\ None\n | Some (e', (t, X)) \\ Some (VYDRA_Atom a e', (t, a \\ X)))\"\n| \"run (Suc n) (VYDRA_Neg v) = (case run n v of None \\ None\n | Some (v', (t, b)) \\ Some (VYDRA_Neg v', (t, \\b)))\"\n| \"run (Suc n) (VYDRA_Bin f vl vr) = (case run n vl of None \\ None\n | Some (vl', (t, bl)) \\ (case run n vr of None \\ None\n | Some (vr', (_, br)) \\ Some (VYDRA_Bin f vl' vr', (t, f bl br))))\"\n| \"run (Suc n) (VYDRA_Prev I v e tb) = (case run_hd e of Some (e', (t, _)) \\\n (let \\ = (case tb of Some (t', b') \\ b' \\ mem t' t I | None \\ False) in\n case run n v of Some (v', _, b') \\ Some (VYDRA_Prev I v' e' (Some (t, b')), (t, \\))\n | None \\ Some (VYDRA_None, (t, \\)))\n | None \\ None)\"\n| \"run (Suc n) (VYDRA_Next I v e to) = (case run_hd e of Some (e', (t, _)) \\\n (case to of None \\\n (case run n v of Some (v', _, _) \\ run (Suc n) (VYDRA_Next I v' e' (Some t))\n | None \\ None)\n | Some t' \\\n (case run n v of Some (v', _, b) \\ Some (VYDRA_Next I v' e' (Some t), (t', b \\ mem t' t I))\n | None \\ if mem t' t I then None else Some (VYDRA_None, (t', False))))\n | None \\ None)\"\n| \"run (Suc n) (VYDRA_Since I vphi vpsi e cphi cpsi cppsi tppsi) = (case run n vphi of\n Some (vphi', (t, b1)) \\\n let cphi = (if b1 then Suc cphi else 0) in\n let cpsi = Suc cpsi in\n let cppsi = map_option Suc cppsi in\n (case while_break (while_since_cond I t) (while_since_body (run n)) (vpsi, e, cpsi, cppsi, tppsi) of Some (vpsi', e', cpsi', cppsi', tppsi') \\\n (let \\ = (case cppsi' of Some k \\ k - 1 \\ cphi \\ memR (the tppsi') t I | _ \\ False) in\n Some (VYDRA_Since I vphi' vpsi' e' cphi cpsi' cppsi' tppsi', (t, \\)))\n | _ \\ None)\n | _ \\ None)\"\n| \"run (Suc n) (VYDRA_Until I e vphi vpsi epsi c zo) = (case run_t e of Some (e', t) \\\n (case while_break (while_until_cond I t) (while_until_body (run n)) (vphi, vpsi, epsi, c, zo) of Some (vphi', vpsi', epsi', c', zo') \\\n if c' = 0 then None else\n (case zo' of Some (t', b1, b2) \\\n (if b2 \\ memL t t' I then Some (VYDRA_Until I e' vphi' vpsi' epsi' (c' - 1) zo', (t, True))\n else if \\b1 then Some (VYDRA_Until I e' vphi' vpsi' epsi' (c' - 1) zo', (t, False))\n else (case read_t epsi' of Some t' \\ Some (VYDRA_Until I e' vphi' vpsi' epsi' (c' - 1) zo', (t, False)) | _ \\ None))\n | _ \\ None)\n | _ \\ None)\n | _ \\ None)\"\n| \"run (Suc n) (VYDRA_MatchP I transs qf w) =\n (case eval_matchP (init_args ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (run_t, read_t) (run_subs (run n))) I w of None \\ None\n | Some ((t, b), w') \\ Some (VYDRA_MatchP I transs qf w', (t, b)))\"\n| \"run (Suc n) (VYDRA_MatchF I transs qf w) =\n (case eval_matchF (init_args ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (run_t, read_t) (run_subs (run n))) I w of None \\ None\n | Some ((t, b), w') \\ Some (VYDRA_MatchF I transs qf w', (t, b)))\"\n| \"run _ _ = undefined\"\n by pat_completeness auto\ntermination\n by (relation \"(\\p. size (fst p)) <*mlex*> (\\p. next_vydra (snd p)) <*mlex*> (\\p. msize_vydra (fst p) (snd p)) <*mlex*> {}\") (auto simp: mlex_prod_def)\n\nlemma wf_since: \"wf {(t, s). while_since_cond I tt s \\ Some t = while_since_body (run n) s}\"\nproof -\n let ?X = \"{(t, s). while_since_cond I tt s \\ Some t = while_since_body (run n) s}\"\n have sub: \"?X \\ measure (\\(vpsi, e, cpsi, cppsi, tppsi). cpsi)\"\n by (auto simp: while_since_cond_def while_since_body_def Let_def split: option.splits)\n then show ?thesis\n using wf_subset[OF wf_measure]\n by auto\nqed\n\ndefinition run_vydra :: \"('a, 't, 'h) vydra \\ (('a, 't, 'h) vydra \\ ('t \\ bool)) option\" where\n \"run_vydra v = (case v of (n, w) \\ map_option (apfst (Pair n)) (run n w))\"\n\nfun sub :: \"nat \\ ('a, 't) formula \\ ('a, 't, 'h) vydra_aux\" where\n \"sub n (Bool b) = VYDRA_Bool b init_hd\"\n| \"sub n (Atom a) = VYDRA_Atom a init_hd\"\n| \"sub (Suc n) (Neg phi) = VYDRA_Neg (sub n phi)\"\n| \"sub (Suc n) (Bin f phi psi) = VYDRA_Bin f (sub n phi) (sub n psi)\"\n| \"sub (Suc n) (Prev I phi) = VYDRA_Prev I (sub n phi) init_hd None\"\n| \"sub (Suc n) (Next I phi) = VYDRA_Next I (sub n phi) init_hd None\"\n| \"sub (Suc n) (Since phi I psi) = VYDRA_Since I (sub n phi) (sub n psi) t0 0 0 None None\"\n| \"sub (Suc n) (Until phi I psi) = VYDRA_Until I t0 (sub n phi) (sub n psi) t0 0 None\"\n| \"sub (Suc n) (MatchP I r) = (let qf = state_cnt r;\n transs = iarray_of_list (build_nfa_impl r (0, qf, [])) in\n VYDRA_MatchP I transs qf (init_window (init_args\n ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (run_t, read_t) (run_subs (run n)))\n t0 (map (sub n) (collect_subfmlas r []))))\"\n| \"sub (Suc n) (MatchF I r) = (let qf = state_cnt r;\n transs = iarray_of_list (build_nfa_impl r (0, qf, [])) in\n VYDRA_MatchF I transs qf (init_window (init_args\n ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (run_t, read_t) (run_subs (run n)))\n t0 (map (sub n) (collect_subfmlas r []))))\"\n| \"sub _ _ = undefined\"\n\ndefinition init_vydra :: \"('a, 't) formula \\ ('a, 't, 'h) vydra\" where\n \"init_vydra \\ = (let n = msize_fmla \\ in (n, sub n \\))\"\n\nend\n\nlocale VYDRA_MDL = MDL \\\n for \\ :: \"('a, 't :: timestamp) trace\" +\n fixes init_hd :: \"'h\"\n and run_hd :: \"'h \\ ('h \\ ('t \\ 'a set)) option\"\n assumes run_hd_sound: \"reaches run_hd init_hd n s \\ run_hd s = Some (s', (t, X)) \\ (t, X) = (\\ \\ n, \\ \\ n)\"\nbegin\n\nlemma reaches_on_run_hd: \"reaches_on run_hd init_hd es s \\ run_hd s = Some (s', (t, X)) \\ t = \\ \\ (length es) \\ X = \\ \\ (length es)\"\n using run_hd_sound\n by (auto dest: reaches_on_n)\n\nabbreviation \"ru_t \\ run_t run_hd\"\nabbreviation \"l_t0 \\ t0 init_hd run_hd\"\nabbreviation \"ru \\ run run_hd\"\nabbreviation \"su \\ sub init_hd run_hd\"\n\nlemma ru_t_event: \"reaches_on ru_t t ts t' \\ t = l_t0 \\ ru_t t' = Some (t'', x) \\\n \\rho e tt. t' = Some (e, tt) \\ reaches_on run_hd init_hd rho e \\ length rho = Suc (length ts) \\\n x = \\ \\ (length ts)\"\nproof (induction t ts t' arbitrary: t'' x rule: reaches_on_rev_induct)\n case (1 s)\n show ?case\n using 1 reaches_on_run_hd[OF reaches_on.intros(1)]\n by (auto simp: t0_def split: option.splits intro!: reaches_on.intros)\nnext\n case (2 s s' v vs s'')\n obtain rho e tt where rho_def: \"s' = Some (e, tt)\" \"reaches_on run_hd init_hd rho e\"\n \"length rho = Suc (length vs)\"\n using 2(3)[OF 2(4,2)]\n by auto\n then show ?case\n using 2(2,5) reaches_on_app[OF rho_def(2)] reaches_on_run_hd[OF rho_def(2)]\n by (fastforce split: option.splits)\nqed\n\nlemma ru_t_tau: \"reaches_on ru_t l_t0 ts t' \\ ru_t t' = Some (t'', x) \\ x = \\ \\ (length ts)\"\n using ru_t_event\n by fastforce\n\nlemma ru_t_Some_tau:\n assumes \"reaches_on ru_t l_t0 ts (Some (e, t))\"\n shows \"t = \\ \\ (length ts)\"\nproof -\n obtain z where z_def: \"ru_t (Some (e, t)) = Some (z, t)\"\n by (cases \"run_hd e\") auto\n show ?thesis\n by (rule ru_t_tau[OF assms z_def])\nqed\n\nlemma ru_t_tau_in:\n assumes \"reaches_on ru_t l_t0 ts t\" \"j < length ts\"\n shows \"ts ! j = \\ \\ j\"\nproof -\n obtain t' where t'_def: \"reaches_on ru_t l_t0 (take j ts) t'\" \"reaches_on ru_t t' (drop j ts) t\"\n using reaches_on_split'[OF assms(1), where ?i=j] assms(2)\n by auto\n have drop: \"drop j ts = ts ! j # tl (drop j ts)\"\n using assms(2)\n by (cases \"drop j ts\") (auto simp add: nth_via_drop)\n obtain t'' where t''_def: \"ru_t t' = Some (t'', ts ! j)\"\n using t'_def(2) assms(2) drop\n by (auto elim: reaches_on.cases)\n show ?thesis\n using ru_t_event[OF t'_def(1) refl t''_def] assms(2)\n by auto\nqed\n\nlemmas run_hd_tau_in = ru_t_tau_in[OF reach_event_t0_t, simplified]\n\nfun last_before :: \"(nat \\ bool) \\ nat \\ nat option\" where\n \"last_before P 0 = None\"\n| \"last_before P (Suc n) = (if P n then Some n else last_before P n)\"\n\nlemma last_before_None: \"last_before P n = None \\ m < n \\ \\P m\"\nproof (induction P n rule: last_before.induct)\n case (2 P n)\n then show ?case\n by (cases \"m = n\") (auto split: if_splits)\nqed (auto split: if_splits)\n\nlemma last_before_Some: \"last_before P n = Some m \\ m < n \\ P m \\ (\\k \\ {m<..P k)\"\n apply (induction P n rule: last_before.induct)\n apply (auto split: if_splits)\n apply (metis greaterThanLessThan_iff less_antisym)\n done\n\ninductive wf_vydra :: \"('a, 't :: timestamp) formula \\ nat \\ nat \\ ('a, 't, 'h) vydra_aux \\ bool\" where\n \"wf_vydra phi i n w \\ ru n w = None \\ wf_vydra (Prev I phi) (Suc i) (Suc n) VYDRA_None\"\n| \"wf_vydra phi i n w \\ ru n w = None \\ wf_vydra (Next I phi) i (Suc n) VYDRA_None\"\n| \"reaches_on run_hd init_hd es sub' \\ length es = i \\ wf_vydra (Bool b) i n (VYDRA_Bool b sub')\"\n| \"reaches_on run_hd init_hd es sub' \\ length es = i \\ wf_vydra (Atom a) i n (VYDRA_Atom a sub')\"\n| \"wf_vydra phi i n v \\ wf_vydra (Neg phi) i (Suc n) (VYDRA_Neg v)\"\n| \"wf_vydra phi i n v \\ wf_vydra psi i n v' \\ wf_vydra (Bin f phi psi) i (Suc n) (VYDRA_Bin f v v')\"\n| \"wf_vydra phi i n v \\ reaches_on run_hd init_hd es sub' \\ length es = i \\\n wf_vydra (Prev I phi) i (Suc n) (VYDRA_Prev I v sub' (case i of 0 \\ None | Suc j \\ Some (\\ \\ j, sat phi j)))\"\n| \"wf_vydra phi i n v \\ reaches_on run_hd init_hd es sub' \\ length es = i \\\n wf_vydra (Next I phi) (i - 1) (Suc n) (VYDRA_Next I v sub' (case i of 0 \\ None | Suc j \\ Some (\\ \\ j)))\"\n| \"wf_vydra phi i n vphi \\ wf_vydra psi j n vpsi \\ j \\ i \\\n reaches_on ru_t l_t0 es sub' \\ length es = j \\ (\\t. t \\ set es \\ memL t (\\ \\ i) I) \\\n cphi = i - (case last_before (\\k. \\sat phi k) i of None \\ 0 | Some k \\ Suc k) \\ cpsi = i - j \\\n cppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (i - k)) \\\n tppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (\\ \\ k)) \\\n wf_vydra (Since phi I psi) i (Suc n) (VYDRA_Since I vphi vpsi sub' cphi cpsi cppsi tppsi)\"\n| \"wf_vydra phi j n vphi \\ wf_vydra psi j n vpsi \\ i \\ j \\\n reaches_on ru_t l_t0 es back \\ length es = i \\\n reaches_on ru_t l_t0 es' front \\ length es' = j \\ (\\t. t \\ set es' \\ memR (\\ \\ i) t I) \\\n c = j - i \\ z = (case j of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k)) \\\n (\\k. k \\ {i.. sat phi k \\ (memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k)) \\\n wf_vydra (Until phi I psi) i (Suc n) (VYDRA_Until I back vphi vpsi front c z)\"\n| \"valid_window_matchP args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w \\\n n \\ msize_regex r \\ qf = state_cnt r \\\n transs = iarray_of_list (build_nfa_impl r (0, qf, [])) \\\n args = init_args ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (ru_t, read_t) (run_subs (ru n)) \\\n wf_vydra (MatchP I r) i (Suc n) (VYDRA_MatchP I transs qf w)\"\n| \"valid_window_matchF args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w \\\n n \\ msize_regex r \\ qf = state_cnt r \\\n transs = iarray_of_list (build_nfa_impl r (0, qf, [])) \\\n args = init_args ({0}, NFA.delta' transs qf, NFA.accept' transs qf)\n (ru_t, read_t) (run_subs (ru n)) \\\n wf_vydra (MatchF I r) i (Suc n) (VYDRA_MatchF I transs qf w)\"\n\nlemma reach_run_subs_len:\n assumes reaches_ons: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) rho vs\"\n shows \"length vs = length (collect_subfmlas r [])\"\n using reaches_ons run_subs_lD\n by (induction \"map (su n) (collect_subfmlas r [])\" rho vs rule: reaches_on_rev_induct) fastforce+\n\nlemma reach_run_subs_run:\n assumes reaches_ons: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) rho vs\"\n and subfmla: \"j < length (collect_subfmlas r [])\" \"phi = collect_subfmlas r [] ! j\"\n shows \"\\rho'. reaches_on (ru n) (su n phi) rho' (vs ! j) \\ length rho' = length rho\"\n using reaches_ons subfmla\nproof (induction \"map (su n) (collect_subfmlas r [])\" rho vs rule: reaches_on_rev_induct)\n case 1\n then show ?case\n by (auto intro: reaches_on.intros)\nnext\n case (2 s' v vs' s'')\n note len_s'_vs = reach_run_subs_len[OF 2(1)]\n obtain rho' where reach_s'_vs: \"reaches_on (ru n) (su n phi) rho' (s' ! j)\"\n \"length rho' = length vs'\"\n using 2(2)[OF 2(4,5)]\n by auto\n note run_subslD = run_subs_lD[OF 2(3)]\n note run_subsvD = run_subs_vD[OF 2(3) 2(4)[unfolded len_s'_vs[symmetric]]]\n obtain vj' tj bj where vj'_def: \"ru n (s' ! j) = Some (vj', tj, bj)\"\n \"s'' ! j = vj'\" \"IArray.sub v j = bj\"\n using run_subsvD by auto\n obtain rho'' where rho''_def: \"reaches_on (ru n) (su n phi) rho'' (s'' ! j)\"\n \"length rho'' = Suc (length vs')\"\n using reaches_on_app[OF reach_s'_vs(1) vj'_def(1)] vj'_def(2) reach_s'_vs(2)\n by auto\n then show ?case\n using conjunct1[OF run_subslD, unfolded len_s'_vs[symmetric]]\n by auto\nqed\n\nlemma IArray_nth_equalityI: \"IArray.length xs = length ys \\\n (\\i. i < IArray.length xs \\ IArray.sub xs i = ys ! i) \\ xs = IArray ys\"\n by (induction xs arbitrary: ys) (auto intro: nth_equalityI)\n\nlemma bs_sat:\n assumes IH: \"\\phi i v v' b. phi \\ set (collect_subfmlas r []) \\ wf_vydra phi i n v \\ ru n v = Some (v', b) \\ snd b = sat phi i\"\n and reaches_ons: \"\\j. j < length (collect_subfmlas r []) \\ wf_vydra (collect_subfmlas r [] ! j) i n (vs ! j)\"\n and run_subs: \"run_subs (ru n) vs = Some (vs', bs)\" \"length vs = length (collect_subfmlas r [])\"\n shows \"bs = iarray_of_list (map (\\phi. sat phi i) (collect_subfmlas r []))\"\nproof -\n have \"\\j. j < length (collect_subfmlas r []) \\\n IArray.sub bs j = sat (collect_subfmlas r [] ! j) i\"\n proof -\n fix j\n assume lassm: \"j < length (collect_subfmlas r [])\"\n define phi where \"phi = collect_subfmlas r [] ! j\"\n have phi_in_set: \"phi \\ set (collect_subfmlas r [])\"\n using lassm\n by (auto simp: phi_def)\n have wf: \"wf_vydra phi i n (vs ! j)\"\n using reaches_ons lassm phi_def\n by metis\n show \"IArray.sub bs j = sat (collect_subfmlas r [] ! j) i\"\n using IH(1)[OF phi_in_set wf] run_subs_vD[OF run_subs(1) lassm[folded run_subs(2)]]\n unfolding phi_def[symmetric]\n by auto\n qed\n moreover have \"length (IArray.list_of bs) = length vs\"\n using run_subs(1)\n by (auto simp: run_subs_def Let_def iarray_of_list_def split: if_splits)\n ultimately show ?thesis\n using run_subs(2)\n by (auto simp: iarray_of_list_def intro!: IArray_nth_equalityI)\nqed\n\nlemma run_induct[case_names Bool Atom Neg Bin Prev Next Since Until MatchP MatchF, consumes 1]:\n fixes phi :: \"('a, 't) formula\"\n assumes \"msize_fmla phi \\ n\" \"(\\b n. P n (Bool b))\" \"(\\a n. P n (Atom a))\"\n \"(\\n phi. msize_fmla phi \\ n \\ P n phi \\ P (Suc n) (Neg phi))\"\n \"(\\n f phi psi. msize_fmla (Bin f phi psi) \\ Suc n \\ P n phi \\ P n psi \\\n P (Suc n) (Bin f phi psi))\"\n \"(\\n I phi. msize_fmla phi \\ n \\ P n phi \\ P (Suc n) (Prev I phi))\"\n \"(\\n I phi. msize_fmla phi \\ n \\ P n phi \\ P (Suc n) (Next I phi))\"\n \"(\\n I phi psi. msize_fmla phi \\ n \\ msize_fmla psi \\ n \\ P n phi \\ P n psi \\ P (Suc n) (Since phi I psi))\"\n \"(\\n I phi psi. msize_fmla phi \\ n \\ msize_fmla psi \\ n \\ P n phi \\ P n psi \\ P (Suc n) (Until phi I psi))\"\n \"(\\n I r. msize_fmla (MatchP I r) \\ Suc n \\ (\\x. msize_fmla x \\ n \\ P n x) \\\n P (Suc n) (MatchP I r))\"\n \"(\\n I r. msize_fmla (MatchF I r) \\ Suc n \\ (\\x. msize_fmla x \\ n \\ P n x) \\\n P (Suc n) (MatchF I r))\"\n shows \"P n phi\"\n using assms(1)\nproof (induction n arbitrary: phi rule: nat_less_induct)\n case (1 n)\n show ?case\n proof (cases n)\n case 0\n show ?thesis\n using 1 assms(2-)\n by (cases phi) (auto simp: 0)\n next\n case (Suc m)\n show ?thesis\n using 1 assms(2-)\n by (cases phi) (auto simp: Suc)\n qed\nqed\n\nlemma wf_vydra_sub: \"msize_fmla \\ \\ n \\ wf_vydra \\ 0 n (su n \\)\"\nproof (induction n \\ rule: run_induct)\n case (Prev n I phi)\n then show ?case\n using wf_vydra.intros(7)[where ?i=0, OF _ reaches_on.intros(1)]\n by auto\nnext\n case (Next n I phi)\n then show ?case\n using wf_vydra.intros(8)[where ?i=0, OF _ reaches_on.intros(1)]\n by auto\nnext\n case (MatchP n I r)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n let ?args = \"init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n show ?case\n using MatchP valid_init_window[of ?args l_t0 \"map (su n) (collect_subfmlas r [])\", simplified]\n by (auto simp: Let_def valid_window_matchP_def split: option.splits intro: reaches_on.intros\n intro!: wf_vydra.intros(11)[where ?xs=\"[]\", OF _ _ refl refl refl])\nnext\n case (MatchF n I r)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n let ?args = \"init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n show ?case\n using MatchF valid_init_window[of ?args l_t0 \"map (su n) (collect_subfmlas r [])\", simplified]\n by (auto simp: Let_def valid_window_matchF_def split: option.splits intro: reaches_on.intros\n intro!: wf_vydra.intros(12)[where ?xs=\"[]\", OF _ _ refl refl refl])\nqed (auto simp: Let_def intro: wf_vydra.intros reaches_on.intros)\n\nlemma ru_t_Some: \"\\e' et. ru_t e = Some (e', et)\" if reaches_Suc_i: \"reaches_on run_hd init_hd fs f\" \"length fs = Suc i\"\n and aux: \"reaches_on ru_t l_t0 es e\" \"length es \\ i\" for es e\nproof -\n obtain fs' ft where ft_def: \"reaches_on ru_t l_t0 (map fst (fs' :: ('t \\ 'a set) list)) (Some (f, ft))\"\n \"map fst fs = map fst fs' @ [ft]\" \"length fs' = i\"\n using reaches_Suc_i\n by (cases fs rule: rev_cases) (auto dest!: reaches_on_split_last reach_event_t0_t)\n show ?thesis\n proof (cases \"length es = i\")\n case True\n have e_def: \"e = Some (f, ft)\"\n using reaches_on_inj[OF aux(1) ft_def(1)]\n by (auto simp: True ft_def(3))\n then show ?thesis\n by (cases \"run_hd f\") (auto simp: e_def)\n next\n case False\n obtain s' s'' where split: \"reaches_on ru_t l_t0 (take (length es) (map fst fs')) s'\"\n \"ru_t s' = Some (s'', map fst fs' ! (length es))\"\n using reaches_on_split[OF ft_def(1), where ?i=\"length es\"] False aux(2)\n by (auto simp: ft_def(3))\n show ?thesis\n using reaches_on_inj[OF aux(1) split(1)] aux(2)\n by (auto simp: ft_def(3) split(2))\n qed\nqed\n\nlemma vydra_sound_aux:\n assumes \"msize_fmla \\ \\ n\" \"wf_vydra \\ i n v\" \"ru n v = Some (v', t, b)\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n shows \"wf_vydra \\ (Suc i) n v' \\ (\\es e. reaches_on run_hd init_hd es e \\ length es = Suc i) \\ t = \\ \\ i \\ b = sat \\ i\"\n using assms\nproof (induction n \\ arbitrary: i v v' t b rule: run_induct)\n case (Bool \\ n)\n then show ?case\n using reaches_on_run_hd reaches_on_app wf_vydra.intros(3)[OF reaches_on_app refl]\n by (fastforce elim!: wf_vydra.cases[of _ _ _ \"v\"] split: option.splits)\nnext\n case (Atom a n)\n then show ?case\n using reaches_on_run_hd reaches_on_app wf_vydra.intros(4)[OF reaches_on_app refl]\n by (fastforce elim!: wf_vydra.cases[of _ _ _ v] split: option.splits)\nnext\n case (Neg n x)\n have IH: \"wf_vydra x i n v \\ ru n v = Some (v', t, b) \\ wf_vydra x (Suc i) n v' \\ (\\es e. reaches_on run_hd init_hd es e \\ length es = Suc i) \\ t = \\ \\ i \\ b = sat x i\" for v v' t b\n using Neg(2,5,6)\n by auto\n show ?case\n apply (rule wf_vydra.cases[OF Neg(3)])\n using Neg(4) IH wf_vydra.intros(5)\n by (fastforce split: option.splits)+\nnext\n case (Bin n f x1 x2)\n have IH1: \"wf_vydra x1 i n v \\ ru n v = Some (v', t, b) \\ wf_vydra x1 (Suc i) n v' \\ (\\es e. reaches_on run_hd init_hd es e \\ length es = Suc i) \\ t = \\ \\ i \\ b = sat x1 i\" for v v' t b\n using Bin(2,6,7)\n by auto\n have IH2: \"wf_vydra x2 i n v \\ ru n v = Some (v', t, b) \\ wf_vydra x2 (Suc i) n v' \\ t = \\ \\ i \\ b = sat x2 i\" for v v' t b\n using Bin(3,6,7)\n by auto\n show ?case\n apply (rule wf_vydra.cases[OF Bin(4)])\n using Bin(5) IH1 IH2 wf_vydra.intros(6)\n by (fastforce split: option.splits)+\nnext\n case (Prev n I phi)\n show ?case\n proof (cases i)\n case 0\n then show ?thesis\n using Prev run_hd_sound[OF reaches.intros(1)] wf_vydra.intros(7)[OF _ reaches_on.intros(2)[OF _ reaches_on.intros(1)], where ?i=\"Suc 0\", simplified]\n by (fastforce split: nat.splits option.splits dest!: reaches_on_NilD elim!: wf_vydra.cases[of _ _ _ v] intro: wf_vydra.intros(1) reaches_on.intros(2)[OF _ reaches_on.intros(1)])\n next\n case (Suc j)\n obtain vphi es sub where v_def: \"v = VYDRA_Prev I vphi sub (Some (\\ \\ j, sat phi j))\"\n \"wf_vydra phi i n vphi\" \"reaches_on run_hd init_hd es sub\" \"length es = i\"\n using Prev(3,4)\n by (auto simp: Suc elim!: wf_vydra.cases[of _ _ _ v])\n obtain sub' X where run_sub: \"run_hd sub = Some (sub', (t, X))\"\n using Prev(4)\n by (auto simp: v_def(1) Let_def split: option.splits)\n note reaches_sub' = reaches_on_app[OF v_def(3) run_sub]\n have t_def: \"t = \\ \\ (Suc j)\"\n using reaches_on_run_hd[OF v_def(3) run_sub]\n by (auto simp: Suc v_def(2,4))\n show ?thesis\n proof (cases \"v' = VYDRA_None\")\n case v'_def: True\n show ?thesis\n using Prev(4) v_def(2) reaches_sub'\n by (auto simp: Suc Let_def v_def(1,4) v'_def run_sub t_def split: option.splits intro: wf_vydra.intros(1))\n next\n case False\n obtain vphi' where ru_vphi: \"ru n vphi = Some (vphi', (\\ \\ i, sat phi i))\"\n using Prev(2)[OF v_def(2)] Prev(4,5,6) False\n by (auto simp: v_def(1) Let_def split: option.splits)\n have wf': \"wf_vydra phi (Suc (Suc j)) n vphi'\"\n using Prev(2)[OF v_def(2) ru_vphi] Prev(5,6)\n by (auto simp: Suc)\n show ?thesis\n using Prev(4) wf_vydra.intros(7)[OF wf' reaches_sub'] reaches_sub'\n by (auto simp: Let_def Suc t_def v_def(1,4) run_sub ru_vphi)\n qed\n qed\nnext\n case (Next n I phi)\n obtain w sub to es where v_def: \"v = VYDRA_Next I w sub to\" \"wf_vydra phi (length es) n w\"\n \"reaches_on run_hd init_hd es sub\" \"length es = (case to of None \\ 0 | _ \\ Suc i)\"\n \"case to of None \\ i = 0 | Some told \\ told = \\ \\ i\"\n using Next(3,4)\n by (auto elim!: wf_vydra.cases[of _ _ _ v] split: option.splits nat.splits)\n obtain sub' tnew X where run_sub: \"run_hd sub = Some (sub', (tnew, X))\"\n using Next(4)\n by (auto simp: v_def(1) split: option.splits)\n have tnew_def: \"tnew = \\ \\ (length es)\"\n using reaches_on_run_hd[OF v_def(3) run_sub]\n by auto\n have aux: ?case if aux_assms: \"wf_vydra phi (Suc i) n w\"\n \"ru (Suc n) (VYDRA_Next I w sub (Some t0)) = Some (v', t, b)\"\n \"reaches_on run_hd init_hd es sub\" \"length es = Suc i\" \"t0 = \\ \\ i\" for w sub t0 es\n using aux_assms(1,2,5) wf_vydra.intros(2)[OF aux_assms(1)]\n Next(2)[where ?i=\"Suc i\" and ?v=\"w\"] Next(5,6) reaches_on_run_hd[OF aux_assms(3)]\n wf_vydra.intros(8)[OF _ reaches_on_app[OF aux_assms(3)], where ?phi=phi and ?i=\"Suc (Suc i)\" and ?n=\"n\"] aux_assms(3)\n by (auto simp: run_sub aux_assms(4,5) split: option.splits if_splits)\n show ?case\n proof (cases to)\n case None\n obtain w' z where w_def: \"ru (Suc n) v = ru (Suc n) (VYDRA_Next I w' sub' (Some tnew))\"\n \"ru n w = Some (w', z)\"\n using Next(4)\n by (cases \"ru n w\") (auto simp: v_def(1) run_sub None split: option.splits)\n have wf: \"wf_vydra phi (Suc i) n w'\"\n using v_def w_def(2) Next(2,5,6)\n by (cases z) (auto simp: None intro: wf_vydra.intros(1))\n show ?thesis\n using aux[OF wf Next(4)[unfolded w_def(1)] reaches_on_app[OF v_def(3) run_sub]] v_def(4,5) tnew_def\n by (auto simp: None)\n next\n case (Some z)\n show ?thesis\n using aux[OF _ _ v_def(3), where ?w=\"w\"] v_def(2,4,5) Next(4)\n by (auto simp: v_def(1) Some simp del: run.simps)\n qed\nnext\n case (Since n I phi psi)\n obtain vphi vpsi e cphi cpsi cppsi tppsi j es where v_def:\n \"v = VYDRA_Since I vphi vpsi e cphi cpsi cppsi tppsi\"\n \"wf_vydra phi i n vphi\" \"wf_vydra psi j n vpsi\" \"j \\ i\"\n \"reaches_on ru_t l_t0 es e\" \"length es = j\" \"\\t. t \\ set es \\ memL t (\\ \\ i) I\"\n \"cphi = i - (case last_before (\\k. \\sat phi k) i of None \\ 0 | Some k \\ Suc k)\" \"cpsi = i - j\"\n \"cppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (i - k))\"\n \"tppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (\\ \\ k))\"\n using Since(5)\n by (auto elim: wf_vydra.cases)\n obtain vphi' b1 where run_vphi: \"ru n vphi = Some (vphi', t, b1)\"\n using Since(6)\n by (auto simp: v_def(1) Let_def split: option.splits)\n obtain fs f where wf_vphi': \"wf_vydra phi (Suc i) n vphi'\"\n and reaches_Suc_i: \"reaches_on run_hd init_hd fs f\" \"length fs = Suc i\"\n and t_def: \"t = \\ \\ i\" and b1_def: \"b1 = sat phi i\"\n using Since(3)[OF v_def(2) run_vphi] Since(7,8)\n by auto\n note ru_t_Some = ru_t_Some[OF reaches_Suc_i]\n define loop_inv where \"loop_inv = (\\(vpsi, e, cpsi :: nat, cppsi, tppsi).\n let j = Suc i - cpsi in cpsi \\ Suc i \\\n wf_vydra psi j n vpsi \\ (\\es. reaches_on ru_t l_t0 es e \\ length es = j \\ (\\t \\ set es. memL t (\\ \\ i) I)) \\\n cppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (Suc i - k)) \\\n tppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (\\ \\ k)))\"\n define loop_init where \"loop_init = (vpsi, e, Suc cpsi, map_option Suc cppsi, tppsi)\"\n obtain vpsi' e' cpsi' cppsi' tppsi' where loop_def: \"while_break (while_since_cond I t) (while_since_body run_hd (ru n)) loop_init =\n Some (vpsi', e', cpsi', cppsi', tppsi')\"\n using Since(6)\n by (auto simp: v_def(1) run_vphi loop_init_def Let_def split: option.splits)\n have j_def: \"j = i - cpsi\"\n using v_def(4,9)\n by auto\n have \"cpsi \\ i\"\n using v_def(9)\n by auto\n then have loop_inv_init: \"loop_inv loop_init\"\n using v_def(3,5,6,7,10,11) last_before_Some\n by (fastforce simp: loop_inv_def loop_init_def Let_def j_def split: option.splits)\n have wf_loop: \"wf {(s', s). loop_inv s \\ while_since_cond I t s \\ Some s' = while_since_body run_hd (ru n) s}\"\n by (auto intro: wf_subset[OF wf_since])\n have step_loop: \"loop_inv s'\" if loop_assms: \"loop_inv s\" \"while_since_cond I t s\" \"while_since_body run_hd (ru n) s = Some s'\" for s s'\n proof -\n obtain vpsi e cpsi cppsi tppsi where s_def: \"s = (vpsi, e, cpsi, cppsi, tppsi)\"\n by (cases s) auto\n define j where \"j = Suc i - cpsi\"\n obtain es where loop_before: \"cpsi \\ Suc i\" \"wf_vydra psi j n vpsi\"\n \"reaches_on ru_t l_t0 es e\" \"length es = j\" \"\\t. t \\ set es \\ memL t (\\ \\ i) I\"\n \"cppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (Suc i - k))\"\n \"tppsi = (case last_before (sat psi) j of None \\ None | Some k \\ Some (\\ \\ k))\"\n using loop_assms(1)\n by (auto simp: s_def j_def loop_inv_def Let_def)\n obtain tt h where tt_def: \"read_t e = Some tt\" \"memL tt t I\" \"e = Some (h, tt)\"\n using ru_t_Some[OF loop_before(3)] loop_before(4) loop_assms(2)\n by (cases e) (fastforce simp: while_since_cond_def s_def j_def split: option.splits)+\n obtain e' where e'_def: \"reaches_on ru_t l_t0 (es @ [tt]) e'\" \"ru_t e = Some (e', tt)\"\n using reaches_on_app[OF loop_before(3)] tt_def(1)\n by (cases \"run_hd h\") (auto simp: tt_def(3))\n obtain vpsi' t' b' where run_vpsi: \"ru n vpsi = Some (vpsi', (t', b'))\"\n using loop_assms(3)\n by (auto simp: while_since_body_def s_def Let_def split: option.splits)\n have wf_psi': \"wf_vydra psi (Suc j) n vpsi'\" and t'_def: \"t' = \\ \\ j\" and b'_def: \"b' = sat psi j\"\n using Since(4)[OF loop_before(2) run_vpsi] Since(7,8)\n by auto\n define j' where j'_def: \"j' = Suc i - (cpsi - Suc 0)\"\n have cpsi_pos: \"cpsi > 0\"\n using loop_assms(2)\n by (auto simp: while_since_cond_def s_def)\n have j'_j: \"j' = Suc j\"\n using loop_before(1) cpsi_pos\n by (auto simp: j'_def j_def)\n define cppsi' where \"cppsi' = (if b' then Some cpsi else cppsi)\"\n define tppsi' where \"tppsi' = (if b' then Some t' else tppsi)\"\n have cppsi': \"cppsi' = (case last_before (sat psi) j' of None \\ None | Some k \\ Some (Suc i - k))\"\n using cpsi_pos loop_before(1)\n by (auto simp: cppsi'_def b'_def j'_j loop_before(6) j_def)\n have tppsi': \"tppsi' = (case last_before (sat psi) j' of None \\ None | Some k \\ Some (\\ \\ k))\"\n by (auto simp: tppsi'_def t'_def b'_def j'_j loop_before(7) split: option.splits)\n have s'_def: \"s' = (vpsi', fst (the (ru_t e)), cpsi - Suc 0, cppsi', tppsi')\"\n using loop_assms(3)\n by (auto simp: while_since_body_def s_def run_vpsi cppsi'_def tppsi'_def)\n show ?thesis\n using loop_before(1,4,5) tt_def(2) wf_psi'[folded j'_j] cppsi' tppsi' e'_def(1)\n by (fastforce simp: loop_inv_def s'_def j'_def[symmetric] e'_def(2) j'_j t_def)\n qed\n have loop: \"loop_inv (vpsi', e', cpsi', cppsi', tppsi')\" \"\\while_since_cond I t (vpsi', e', cpsi', cppsi', tppsi')\"\n using while_break_sound[where ?P=\"loop_inv\" and ?Q=\"\\s. loop_inv s \\ \\while_since_cond I t s\", OF step_loop _ wf_loop loop_inv_init]\n by (auto simp: loop_def)\n define cphi' where \"cphi' = (if b1 then Suc cphi else 0)\"\n have v'_def: \"v' = VYDRA_Since I vphi' vpsi' e' cphi' cpsi' cppsi' tppsi'\"\n and b_def: \"b = (case cppsi' of None \\ False | Some k \\ k - 1 \\ cphi' \\ memR (the tppsi') t I)\"\n using Since(6)\n by (auto simp: v_def(1) run_vphi loop_init_def[symmetric] loop_def cphi'_def Let_def split: option.splits)\n have read_t_e': \"cpsi' > 0 \\ read_t e' = None \\ False\"\n using loop(1) ru_t_Some[where ?e=e'] run_t_read\n by (fastforce simp: loop_inv_def Let_def)\n define j' where \"j' = Suc i - cpsi'\"\n have wf_vpsi': \"wf_vydra psi j' n vpsi'\" and cpsi'_le_Suc_i: \"cpsi' \\ Suc i\"\n and cppsi'_def: \"cppsi' = (case last_before (sat psi) j' of None \\ None | Some k \\ Some (Suc i - k))\"\n and tppsi'_def: \"tppsi' = (case last_before (sat psi) j' of None \\ None | Some k \\ Some (\\ \\ k))\"\n using loop(1)\n by (auto simp: loop_inv_def j'_def[symmetric])\n obtain es' where es'_def: \"reaches_on ru_t l_t0 es' e'\" \"length es' = j'\" \"\\t. t \\ set es' \\ memL t (\\ \\ i) I\"\n using loop(1)\n by (auto simp: loop_inv_def j'_def[symmetric])\n have wf_v': \"wf_vydra (Since phi I psi) (Suc i) (Suc n) v'\"\n and cphi'_sat: \"cphi' = Suc i - (case last_before (\\k. \\sat phi k) (Suc i) of None \\ 0 | Some k \\ Suc k)\"\n using cpsi'_le_Suc_i last_before_Some es'_def(3) memL_mono'[OF _ \\_mono[of i \"Suc i\" \\]]\n by (force simp: v'_def cppsi'_def tppsi'_def j'_def cphi'_def b1_def v_def(8) split: option.splits\n intro!: wf_vydra.intros(9)[OF wf_vphi' wf_vpsi' _ es'_def(1-2)])+\n have \"j' = Suc i \\ \\memL (\\ \\ j') (\\ \\ i) I\"\n using loop(2) j'_def read_t_e' ru_t_tau[OF es'_def(1)] read_t_run[where ?run_hd=run_hd]\n by (fastforce simp: while_since_cond_def es'_def(2) t_def split: option.splits)\n then have tau_k_j': \"k \\ i \\ memL (\\ \\ k) (\\ \\ i) I \\ k < j'\" for k\n using ru_t_tau_in[OF es'_def(1)] es'_def(3) \\_mono[of j' k \\] memL_mono\n by (fastforce simp: es'_def(2) in_set_conv_nth)\n have b_sat: \"b = sat (Since phi I psi) i\"\n proof (rule iffI)\n assume b: \"b\"\n obtain m where m_def: \"last_before (sat psi) j' = Some m\" \"i - m \\ cphi'\" \"memR (\\ \\ m) (\\ \\ i) I\"\n using b\n by (auto simp: b_def t_def cppsi'_def tppsi'_def split: option.splits)\n note aux = last_before_Some[OF m_def(1)]\n have mem: \"mem (\\ \\ m) (\\ \\ i) I\"\n using m_def(3) tau_k_j' aux\n by (auto simp: mem_def j'_def)\n have sat_phi: \"sat phi x\" if \"m < x\" \"x \\ i\" for x\n using m_def(2) that le_neq_implies_less\n by (fastforce simp: cphi'_sat dest: last_before_None last_before_Some split: option.splits if_splits)\n show \"sat (Since phi I psi) i\"\n using aux mem sat_phi\n by (auto simp: j'_def intro!: exI[of _ m])\n next\n assume sat: \"sat (Since phi I psi) i\"\n then obtain k where k_def: \"k \\ i\" \"mem (\\ \\ k) (\\ \\ i) I\" \"sat psi k\" \"\\k'. k < k' \\ k' \\ i \\ sat phi k'\"\n by auto\n have k_j': \"k < j'\"\n using tau_k_j'[OF k_def(1)] k_def(2)\n by (auto simp: mem_def)\n obtain m where m_def: \"last_before (sat psi) j' = Some m\"\n using last_before_None[where ?P=\"sat psi\" and ?n=j' and ?m=k] k_def(3) k_j'\n by (cases \"last_before (sat psi) j'\") auto\n have cppsi'_Some: \"cppsi' = Some (Suc i - m)\"\n by (auto simp: cppsi'_def m_def)\n have tppsi'_Some: \"tppsi' = Some (\\ \\ m)\"\n by (auto simp: tppsi'_def m_def)\n have m_k: \"k \\ m\"\n using last_before_Some[OF m_def] k_def(3) k_j'\n by auto\n have tau_i_m: \"memR (\\ \\ m) (\\ \\ i) I\"\n using \\_mono[OF m_k, where ?s=\\] memR_mono k_def(2)\n by (auto simp: mem_def)\n have \"i - m \\ cphi'\"\n using k_def(1) k_def(4) m_k\n apply (cases \"k = i\")\n apply (auto simp: cphi'_sat b1_def dest!: last_before_Some split: option.splits)\n apply (metis diff_le_mono2 le_neq_implies_less le_trans less_imp_le_nat nat_le_linear)\n done\n then show \"b\"\n using tau_i_m\n by (auto simp: b_def t_def cppsi'_Some tppsi'_Some)\n qed\n show ?case\n using wf_v' reaches_Suc_i\n by (auto simp: t_def b_sat)\nnext\n case (Until n I phi psi)\n obtain \"back\" vphi vpsi front c z es es' j where v_def:\n \"v = VYDRA_Until I back vphi vpsi front c z\"\n \"wf_vydra phi j n vphi\" \"wf_vydra psi j n vpsi\" \"i \\ j\"\n \"reaches_on ru_t l_t0 es back\" \"length es = i\"\n \"reaches_on ru_t l_t0 es' front\" \"length es' = j\" \"\\t. t \\ set es' \\ memR (\\ \\ i) t I\"\n \"c = j - i\" \"z = (case j of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k))\"\n \"\\k. k \\ {i.. sat phi k \\ (memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k)\"\n using Until(5)\n by (auto elim: wf_vydra.cases)\n define loop_init where \"loop_init = (vphi, vpsi, front, c, z)\"\n obtain back' vphi' vpsi' epsi' c' zo' zt zb1 zb2 where run_back: \"ru_t back = Some (back', t)\"\n and loop_def: \"while_break (while_until_cond I t) (while_until_body run_hd (ru n)) loop_init = Some (vphi', vpsi', epsi', c', zo')\"\n and v'_def: \"v' = VYDRA_Until I back' vphi' vpsi' epsi' (c' - 1) zo'\"\n and c'_pos: \"\\c' = 0\"\n and zo'_Some: \"zo' = Some (zt, (zb1, zb2))\"\n and b_def: \"b = (zb2 \\ memL t zt I)\"\n using Until(6)\n apply (auto simp: v_def(1) Let_def loop_init_def[symmetric] split: option.splits nat.splits if_splits)\n done\n define j' where \"j' = i + c'\"\n have j_eq: \"j = i + c\"\n using v_def(4)\n by (auto simp: v_def(10))\n have t_def: \"t = \\ \\ i\"\n using ru_t_tau[OF v_def(5) run_back]\n by (auto simp: v_def(6))\n define loop_inv where \"loop_inv = (\\(vphi, vpsi, epsi, c, zo).\n let j = i + c in\n wf_vydra phi j n vphi \\ wf_vydra psi j n vpsi \\\n (\\gs. reaches_on ru_t l_t0 gs epsi \\ length gs = j \\ (\\t. t \\ set gs \\ memR (\\ \\ i) t I)) \\\n zo = (case j of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k)) \\\n (\\k. k \\ {i.. sat phi k \\ (memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k)))\"\n have loop_inv_init: \"loop_inv loop_init\"\n using v_def(2,3,7,9,12)\n by (auto simp: loop_inv_def loop_init_def j_eq[symmetric] v_def(8,11))\n have loop_step: \"loop_inv s'\" if loop_assms: \"loop_inv s\" \"while_until_cond I t s\" \"while_until_body run_hd (ru n) s = Some s'\" for s s'\n proof -\n obtain vphi_cur vpsi_cur epsi_cur c_cur zo_cur where s_def: \"s = (vphi_cur, vpsi_cur, epsi_cur, c_cur, zo_cur)\"\n by (cases s) auto\n define j_cur where \"j_cur = i + c_cur\"\n obtain epsi'_cur t'_cur vphi'_cur tphi_cur bphi_cur vpsi'_cur tpsi_cur bpsi_cur where\n run_epsi: \"ru_t epsi_cur = Some (epsi'_cur, t'_cur)\"\n and run_vphi: \"ru n vphi_cur = Some (vphi'_cur, (tphi_cur, bphi_cur))\"\n and run_vpsi: \"ru n vpsi_cur = Some (vpsi'_cur, (tpsi_cur, bpsi_cur))\"\n using loop_assms(2,3)\n apply (auto simp: while_until_cond_def while_until_body_def s_def split: option.splits dest: read_t_run[where ?run_hd=run_hd])\n done\n have wf: \"wf_vydra phi j_cur n vphi_cur\" \"wf_vydra psi j_cur n vpsi_cur\"\n and zo_cur_def: \"zo_cur = (case j_cur of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k))\"\n using loop_assms(1)\n by (auto simp: loop_inv_def s_def j_cur_def[symmetric])\n have wf': \"wf_vydra phi (Suc j_cur) n vphi'_cur\" \"tphi_cur = \\ \\ j_cur\" \"bphi_cur = sat phi j_cur\"\n \"wf_vydra psi (Suc j_cur) n vpsi'_cur\" \"tpsi_cur = \\ \\ j_cur\" \"bpsi_cur = sat psi j_cur\"\n using Until(3)[OF wf(1) run_vphi] Until(4)[OF wf(2) run_vpsi] Until(7,8)\n apply (auto)\n done\n have s'_def: \"s' = (vphi'_cur, vpsi'_cur, epsi'_cur, Suc c_cur, Some (t'_cur, (bphi_cur, bpsi_cur)))\"\n using loop_assms(3)\n by (auto simp: while_until_body_def s_def run_epsi run_vphi run_vpsi)\n obtain gs_cur where gs_cur_def: \"reaches_on ru_t l_t0 gs_cur epsi_cur\"\n \"length gs_cur = j_cur\" \"\\t. t \\ set gs_cur \\ memR (\\ \\ i) t I\"\n using loop_assms(1)\n by (auto simp: loop_inv_def s_def j_cur_def[symmetric])\n have t'_cur_def: \"t'_cur = \\ \\ j_cur\"\n using ru_t_tau[OF gs_cur_def(1) run_epsi]\n by (auto simp: gs_cur_def(2))\n have t'_cur_right_I: \"memR t t'_cur I\"\n using loop_assms(2) run_t_read[OF run_epsi]\n by (auto simp: while_until_cond_def s_def)\n have c_cur_zero: \"c_cur = 0 \\ j_cur = i\"\n by (auto simp: j_cur_def)\n have \"k \\ {i.. sat phi k \\ (memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k)\" for k\n using loop_assms(1,2)\n by (cases \"k = j_cur - Suc 0\") (auto simp: while_until_cond_def loop_inv_def j_cur_def[symmetric] zo_cur_def s_def until_ready_def t_def split: nat.splits dest: c_cur_zero)\n then show ?thesis\n using wf' t'_cur_right_I\n using reaches_on_app[OF gs_cur_def(1) run_epsi] gs_cur_def(2,3)\n by (auto simp: loop_inv_def s'_def j_cur_def[symmetric] t_def t'_cur_def intro!: exI[of _ \"gs_cur @ [t'_cur]\"])\n qed\n have wf_loop: \"wf {(s', s). loop_inv s \\ while_until_cond I t s \\ Some s' = while_until_body run_hd (ru n) s}\"\n proof -\n obtain m where m_def: \"\\\\ \\ m \\ \\ \\ i + right I\"\n using ex_lt_\\[where ?x=\"right I\" and ?s=\\] Until(7)\n by auto\n define X where \"X = {(s', s). loop_inv s \\ while_until_cond I t s \\ Some s' = while_until_body run_hd (ru n) s}\"\n have \"memR t (\\ \\ (i + c)) I \\ i + c < m\" for c\n using m_def order_trans[OF \\_mono[where ?i=m and ?j=\"i + c\" and ?s=\\]]\n by (fastforce simp: t_def dest!: memR_dest)\n then have \"X \\ measure (\\(vphi, vpsi, epsi, c, zo). m - c)\"\n by (fastforce simp: X_def while_until_cond_def while_until_body_def loop_inv_def Let_def split: option.splits\n dest!: read_t_run[where ?run_hd=run_hd] dest: ru_t_tau)\n then show ?thesis\n using wf_subset\n by (auto simp: X_def[symmetric])\n qed\n have loop: \"loop_inv (vphi', vpsi', epsi', c', zo')\" \"\\while_until_cond I t (vphi', vpsi', epsi', c', zo')\"\n using while_break_sound[where ?Q=\"\\s. loop_inv s \\ \\while_until_cond I t s\", OF _ _ wf_loop loop_inv_init] loop_step\n by (auto simp: loop_def)\n have tau_right_I: \"k < j' \\ memR (\\ \\ i) (\\ \\ k) I\" for k\n using loop(1) ru_t_tau_in\n by (auto simp: loop_inv_def j'_def[symmetric] in_set_conv_nth)\n have read_t_epsi': \"read_t epsi' = Some et \\ et = \\ \\ j'\" for et\n using loop(1) ru_t_tau\n by (fastforce simp: loop_inv_def Let_def j'_def dest!: read_t_run[where ?run_hd=run_hd])\n have end_cond: \"until_ready I t c' zo' \\ \\(memR (\\ \\ i) (\\ \\ j') I)\"\n unfolding t_def[symmetric]\n using Until(6) c'_pos loop(2)[unfolded while_until_cond_def]\n by (auto simp: until_ready_def v_def(1) run_back loop_init_def[symmetric] loop_def zo'_Some split: if_splits option.splits nat.splits dest: read_t_epsi')\n have Suc_i_le_j': \"Suc i \\ j'\" and c'_j': \"c' - Suc 0 = j' - Suc i\"\n using end_cond c'_pos\n by (auto simp: until_ready_def j'_def split: nat.splits)\n have zo'_def: \"zo' = (case j' of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k))\"\n and sat_phi: \"k \\ {i.. sat phi k\"\n and not_sat_psi: \"k \\ {i.. memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k\" for k\n using loop(1)\n by (auto simp: loop_inv_def j'_def[symmetric])\n have b_sat: \"b = sat (Until phi I psi) i\"\n proof (rule iffI)\n assume b: \"b\"\n have mem: \"mem (\\ \\ i) (\\ \\ (j' - Suc 0)) I\"\n using b zo'_def tau_right_I[where ?k=\"j' - 1\"]\n by (auto simp: mem_def b_def t_def zo'_Some split: nat.splits)\n have sat_psi: \"sat psi (j' - 1)\"\n using b zo'_def\n by (auto simp: b_def zo'_Some split: nat.splits)\n show \"sat (Until phi I psi) i\"\n using Suc_i_le_j' mem sat_psi sat_phi\n by (auto intro!: exI[of _ \"j' - 1\"])\n next\n assume \"sat (Until phi I psi) i\"\n then obtain k where k_def: \"i \\ k\" \"mem (\\ \\ i) (\\ \\ k) I\" \"sat psi k\" \"\\m \\ {i.. {i..k}. memL (\\ \\ i) (\\ \\ m) I \\ sat psi m}\"\n have fin_X: \"finite X\" and X_nonempty: \"X \\ {}\" and k_X: \"k \\ X\"\n using k_def\n by (auto simp: X_def mem_def)\n define km where \"km = Min X\"\n note aux = Min_in[OF fin_X X_nonempty, folded km_def]\n have km_def: \"i \\ km\" \"km \\ k\" \"memL (\\ \\ i) (\\ \\ km) I\" \"sat psi km\" \"\\m \\ {i..m \\ {i.. \\ i) (\\ \\ m) I \\ \\sat psi m\"\n using aux Min_le[OF fin_X, folded km_def] k_def(4)\n by (fastforce simp: X_def)+\n have j'_le_km: \"j' - 1 \\ km\"\n using not_sat_psi[OF _ km_def(3)] km_def(1,4)\n by fastforce\n show \"b\"\n proof (cases \"j' - 1 < km\")\n case True\n have \"until_ready I t c' zo'\"\n using end_cond True km_def(2) k_def(2) memR_mono'[OF _ \\_mono[where ?i=j' and ?j=k and ?s=\\]]\n by (auto simp: mem_def)\n then show ?thesis\n using c'_pos zo'_def km_def(5) Suc_i_le_j' True\n by (auto simp: until_ready_def zo'_Some b_def split: nat.splits)\n next\n case False\n have km_j': \"km = j' - 1\"\n using j'_le_km False\n by auto\n show ?thesis\n using c'_pos zo'_def km_def(3,4)\n by (auto simp: zo'_Some b_def km_j' t_def split: nat.splits)\n qed\n qed\n obtain gs where gs_def: \"reaches_on ru_t l_t0 gs epsi'\" \"length gs = j'\"\n \"\\t. t \\ set gs \\ memR (\\ \\ i) t I\"\n using loop(1)\n by (auto simp: loop_inv_def j'_def[symmetric])\n note aux = \\_mono[where ?s=\\ and ?i=i and ?j=\"Suc i\"]\n have wf_v': \"wf_vydra (Until phi I psi) (Suc i) (Suc n) v'\"\n unfolding v'_def\n apply (rule wf_vydra.intros(10)[where ?j=j' and ?es'=gs])\n using loop(1) reaches_on_app[OF v_def(5) run_back] Suc_i_le_j' c'_j' memL_mono[OF _ aux] memR_mono[OF _ aux] gs_def\n by (auto simp: loop_inv_def j'_def[symmetric] v_def(6,8))\n show ?case\n using wf_v' ru_t_event[OF v_def(5) refl run_back]\n by (auto simp: b_sat v_def(6))\nnext\n case (MatchP n I r)\n have IH: \"x \\ set (collect_subfmlas r []) \\ wf_vydra x j n v \\ ru n v = Some (v', t, b) \\ wf_vydra x (Suc j) n v' \\ t = \\ \\ j \\ b = sat x j\" for x j v v' t b\n using MatchP(2,1,5,6) le_trans[OF collect_subfmlas_msize]\n using bf_collect_subfmlas[where ?r=\"r\" and ?phis=\"[]\"]\n by (fastforce simp: collect_subfmlas_atms[where ?phis=\"[]\", simplified, symmetric])\n have \"reaches_on (ru n) (su n phi) vs v \\ wf_vydra phi (length vs) n v\" if phi: \"phi \\ set (collect_subfmlas r [])\" for phi vs v\n apply (induction vs arbitrary: v rule: rev_induct)\n using MatchP(1) wf_vydra_sub collect_subfmlas_msize[OF phi]\n apply (auto elim!: reaches_on.cases)[1]\n using IH[OF phi]\n apply (fastforce dest!: reaches_on_split_last)\n done\n then have wf: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) bs s \\ j < length (collect_subfmlas r []) \\\n wf_vydra (collect_subfmlas r [] ! j) (length bs) n (s ! j)\" for bs s j\n using reach_run_subs_run\n by (fastforce simp: in_set_conv_nth)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n define args where \"args = init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n interpret MDL_window \\ r l_t0 \"map (su n) (collect_subfmlas r [])\" args\n using bs_sat[where ?r=r and ?n=n, OF _ wf _ reach_run_subs_len[where ?n=n]] IH run_t_read[of run_hd]\n read_t_run[of _ _ run_hd] ru_t_tau MatchP(5) collect_subfmlas_atms[where ?phis=\"[]\"]\n unfolding args_def iarray_of_list_def\n by unfold_locales auto\n obtain w xs where w_def: \"v = VYDRA_MatchP I ?transs ?qf w\"\n \"valid_window_matchP args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w\"\n using MatchP(3,4)\n by (auto simp: args_def elim!: wf_vydra.cases[of _ _ _ v])\n obtain tj' t' sj' bs where somes: \"w_run_t args (w_tj w) = Some (tj', t')\"\n \"w_run_sub args (w_sj w) = Some (sj', bs)\"\n using MatchP(4)\n by (auto simp: w_def(1) adv_end_def args_def Let_def split: option.splits prod.splits)\n obtain w' where w'_def: \"eval_mP I w = Some ((\\ \\ i, sat (MatchP I r) i), w')\"\n \"t' = \\ \\ i\" \"valid_matchP I l_t0 (map (su n) (collect_subfmlas r [])) (xs @ [(t', bs)]) (Suc i) w'\"\n using valid_eval_matchP[OF w_def(2) somes] MatchP(6)\n by auto\n have v'_def: \"v' = VYDRA_MatchP I ?transs ?qf w'\" \"(t, b) = (\\ \\ i, sat (MatchP I r) i)\"\n using MatchP(4)\n by (auto simp: w_def(1) args_def[symmetric] w'_def(1) simp del: eval_matchP.simps init_args.simps)\n have len_xs: \"length xs = i\"\n using w'_def(3)\n by (auto simp: valid_window_matchP_def)\n have \"\\es e. reaches_on run_hd init_hd es e \\ length es = Suc i\"\n using ru_t_event valid_window_matchP_reach_tj[OF w_def(2)] somes(1) len_xs\n by (fastforce simp: args_def)\n then show ?case\n using MatchP(1) v'_def(2) w'_def(3)\n by (auto simp: v'_def(1) args_def[symmetric] simp del: init_args.simps intro!: wf_vydra.intros(11))\nnext\n case (MatchF n I r)\n have IH: \"x \\ set (collect_subfmlas r []) \\ wf_vydra x j n v \\ ru n v = Some (v', t, b) \\ wf_vydra x (Suc j) n v' \\ t = \\ \\ j \\ b = sat x j\" for x j v v' t b\n using MatchF(2,1,5,6) le_trans[OF collect_subfmlas_msize]\n using bf_collect_subfmlas[where ?r=\"r\" and ?phis=\"[]\"]\n by (fastforce simp: collect_subfmlas_atms[where ?phis=\"[]\", simplified, symmetric])\n have \"reaches_on (ru n) (su n phi) vs v \\ wf_vydra phi (length vs) n v\" if phi: \"phi \\ set (collect_subfmlas r [])\" for phi vs v\n apply (induction vs arbitrary: v rule: rev_induct)\n using MatchF(1) wf_vydra_sub collect_subfmlas_msize[OF phi]\n apply (auto elim!: reaches_on.cases)[1]\n using IH[OF phi]\n apply (fastforce dest!: reaches_on_split_last)\n done\n then have wf: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) bs s \\ j < length (collect_subfmlas r []) \\\n wf_vydra (collect_subfmlas r [] ! j) (length bs) n (s ! j)\" for bs s j\n using reach_run_subs_run\n by (fastforce simp: in_set_conv_nth)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n define args where \"args = init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n interpret MDL_window \\ r l_t0 \"map (su n) (collect_subfmlas r [])\" args\n using bs_sat[where ?r=r and ?n=n, OF _ wf _ reach_run_subs_len[where ?n=n]] IH run_t_read[of run_hd]\n read_t_run[of _ _ run_hd] ru_t_tau MatchF(5) collect_subfmlas_atms[where ?phis=\"[]\"]\n unfolding args_def iarray_of_list_def\n by unfold_locales auto\n obtain w xs where w_def: \"v = VYDRA_MatchF I ?transs ?qf w\"\n \"valid_window_matchF args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w\"\n using MatchF(3,4)\n by (auto simp: args_def elim!: wf_vydra.cases[of _ _ _ v])\n obtain w' rho' where w'_def: \"eval_mF I w = Some ((t, b), w')\" \"valid_matchF I l_t0 (map (su n) (collect_subfmlas r [])) rho' (Suc i) w'\" \"t = \\ \\ i\" \"b = sat (MatchF I r) i\"\n using valid_eval_matchF_sound[OF w_def(2)] MatchF(4,5,6)\n by (fastforce simp: w_def(1) args_def[symmetric] simp del: eval_matchF.simps init_args.simps split: option.splits)\n have v'_def: \"v' = VYDRA_MatchF I ?transs ?qf w'\"\n using MatchF(4)\n by (auto simp: w_def(1) args_def[symmetric] w'_def(1) simp del: eval_matchF.simps init_args.simps)\n obtain w_ti' ti where ru_w_ti: \"ru_t (w_ti w) = Some (w_ti', ti)\"\n using MatchF(4) read_t_run\n by (auto simp: w_def(1) args_def split: option.splits)\n have \"\\es e. reaches_on run_hd init_hd es e \\ length es = Suc i\"\n using w_def(2) ru_t_event[OF _ refl ru_w_ti, where ?ts=\"take (w_i w) (map fst xs)\"]\n by (auto simp: valid_window_matchF_def args_def)\n then show ?case\n using MatchF(1) w'_def(2)\n by (auto simp: v'_def(1) args_def[symmetric] w'_def(3,4) simp del: init_args.simps intro!: wf_vydra.intros(12))\nqed\n\nlemma reaches_ons_run_lD: \"reaches_on (run_subs (ru n)) vs ws vs' \\\n length vs = length vs'\"\n by (induction vs ws vs' rule: reaches_on_rev_induct)\n (auto simp: run_subs_def Let_def split: option.splits if_splits)\n\nlemma reaches_ons_run_vD: \"reaches_on (run_subs (ru n)) vs ws vs' \\\n i < length vs \\ (\\ys. reaches_on (ru n) (vs ! i) ys (vs' ! i) \\ length ys = length ws)\"\nproof (induction vs ws vs' rule: reaches_on_rev_induct)\n case (2 s s' bs bss s'')\n obtain ys where ys_def: \"reaches_on (ru n) (s ! i) ys (s' ! i)\"\n \"length s = length s'\" \"length ys = length bss\"\n using reaches_ons_run_lD[OF 2(1)] 2(3)[OF 2(4)]\n by auto\n obtain tb where tb_def: \"ru n (s' ! i) = Some (s'' ! i, tb)\"\n using run_subs_vD[OF 2(2) 2(4)[unfolded ys_def(2)]]\n by auto\n show ?case\n using reaches_on_app[OF ys_def(1) tb_def(1)] ys_def(2,3) tb_def\n by auto\nqed (auto intro: reaches_on.intros)\n\nlemma reaches_ons_runI:\n assumes \"\\phi. phi \\ set (collect_subfmlas r []) \\ \\ws v. reaches_on (ru n) (su n phi) ws v \\ length ws = i\"\n shows \"\\ws v. reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) ws v \\ length ws = i\"\n using assms\nproof (induction i)\n case 0\n show ?case\n by (fastforce intro: reaches_on.intros)\nnext\n case (Suc i)\n have IH': \"\\phi. phi \\ set (collect_subfmlas r []) \\ \\ws v. reaches_on (ru n) (su n phi) ws v \\ length ws = i \\ ru n v \\ None\"\n proof -\n fix phi\n assume lassm: \"phi \\ set (collect_subfmlas r [])\"\n obtain ws v where ws_def: \"reaches_on (ru n) (su n phi) ws v\"\n \"length ws = Suc i\"\n using Suc(2)[OF lassm]\n by auto\n obtain y ys where ws_snoc: \"ws = ys @ [y]\"\n using ws_def(2)\n by (cases ws rule: rev_cases) auto\n show \"\\ws v. reaches_on (ru n) (su n phi) ws v \\ length ws = i \\ ru n v \\ None\"\n using reaches_on_split_last[OF ws_def(1)[unfolded ws_snoc]] ws_def(2) ws_snoc\n by fastforce\n qed\n obtain ws v where ws_def: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) ws v\" \"length ws = i\"\n using Suc(1) IH'\n by blast\n have \"x \\ set v \\ Option.is_none (ru n x) \\ False\" for x\n using ws_def IH'\n by (auto simp: in_set_conv_nth) (metis is_none_code(2) reach_run_subs_len reach_run_subs_run reaches_on_inj)\n then obtain v' tb where v'_def: \"run_subs (ru n) v = Some (v', tb)\"\n by (fastforce simp: run_subs_def Let_def)\n show ?case\n using reaches_on_app[OF ws_def(1) v'_def] ws_def(2)\n by fastforce\nqed\n\nlemma reaches_on_takeWhile: \"reaches_on r s vs s' \\ r s' = Some (s'', v) \\ \\f v \\\n vs' = takeWhile f vs \\\n \\t' t'' v'. reaches_on r s vs' t' \\ r t' = Some (t'', v') \\ \\f v' \\\n reaches_on r t' (drop (length vs') vs) s'\"\n by (induction s vs s' arbitrary: vs' rule: reaches_on.induct) (auto intro: reaches_on.intros)\n\nlemma reaches_on_suffix:\n assumes \"reaches_on r s vs s'\" \"reaches_on r s vs' s''\" \"length vs' \\ length vs\"\n shows \"\\vs''. reaches_on r s'' vs'' s' \\ vs = vs' @ vs''\"\n using reaches_on_split'[where ?i=\"length vs'\", OF assms(1,3)] assms(3) reaches_on_inj[OF assms(2)]\n by (metis add_diff_cancel_right' append_take_drop_id diff_diff_cancel length_append length_drop)\n\nlemma vydra_wf_reaches_on:\n assumes \"\\j v. j < i \\ wf_vydra \\ j n v \\ ru n v = None \\ False\" \"bounded_future_fmla \\\" \"wf_fmla \\\" \"msize_fmla \\ \\ n\"\n shows \"\\vs v. reaches_on (ru n) (su n \\) vs v \\ wf_vydra \\ i n v \\ length vs = i\"\n using assms(1)\nproof (induction i)\n case (Suc i)\n obtain vs v where IH: \"reaches_on (ru n) (su n \\) vs v\" \"wf_vydra \\ i n v\" \"length vs = i\"\n using Suc(1) Suc(2)[OF less_SucI]\n by auto\n show ?case\n using reaches_on_app[OF IH(1)] Suc(2)[OF _ IH(2)] vydra_sound_aux[OF assms(4) IH(2) _ assms(2,3)] IH(3)\n by fastforce\nqed (auto intro: reaches_on.intros wf_vydra_sub[OF assms(4)])\n\nlemma reaches_on_Some:\n assumes \"reaches_on r s vs s'\" \"reaches_on r s vs' s''\" \"length vs < length vs'\"\n shows \"\\s''' x. r s' = Some (s''', x)\"\n using reaches_on_split[OF assms(2,3)] reaches_on_inj[OF assms(1)] assms(3)\n by auto\n\nlemma reaches_on_progress:\n assumes \"reaches_on run_hd init_hd vs e\"\n shows \"progress phi (map fst vs) \\ length vs\"\n using progress_le_ts[of \"map fst vs\" phi] reaches_on_run_hd \\_fin\n by (fastforce dest!: reaches_on_setD[OF assms] reaches_on_split_last)\n\nlemma vydra_complete_aux:\n assumes prefix: \"reaches_on run_hd init_hd vs e\"\n and run: \"wf_vydra \\ i n v\" \"ru n v = None\" \"i < progress \\ (map fst vs)\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n and msize: \"msize_fmla \\ \\ n\"\n shows \"False\"\n using msize run\nproof (induction n \\ arbitrary: i v rule: run_induct)\n case (Bool b n)\n have False if v_def: \"v = VYDRA_Bool b g\" for g\n proof -\n obtain es where g_def: \"reaches_on run_hd init_hd es g\" \"length es = i\"\n using Bool(1)\n by (auto simp: v_def elim: wf_vydra.cases)\n show False\n using Bool(2) reaches_on_Some[OF g_def(1) prefix] Bool(3)\n by (auto simp: v_def g_def(2) split: option.splits)\n qed\n then show False\n using Bool(1)\n by (auto elim!: wf_vydra.cases[of _ _ _ v])\nnext\n case (Atom a n)\n have False if v_def: \"v = VYDRA_Atom a g\" for g\n proof -\n obtain es where g_def: \"reaches_on run_hd init_hd es g\" \"length es = i\"\n using Atom(1)\n by (auto simp: v_def elim: wf_vydra.cases)\n show False\n using Atom(2) reaches_on_Some[OF g_def(1) prefix] Atom(3)\n by (auto simp: v_def g_def(2) split: option.splits)\n qed\n then show False\n using Atom(1)\n by (auto elim!: wf_vydra.cases[of _ _ _ v])\nnext\n case (Neg n phi)\n show ?case\n apply (rule wf_vydra.cases[OF Neg(3)])\n using Neg\n by (fastforce split: option.splits)+\nnext\n case (Bin n f phi psi)\n show ?case\n apply (rule wf_vydra.cases[OF Bin(4)])\n using Bin\n by (fastforce split: option.splits)+\nnext\n case (Prev n I phi)\n show ?case\n proof (cases i)\n case 0\n obtain vphi where v_def: \"v = VYDRA_Prev I vphi init_hd None\"\n using Prev(3)\n by (auto simp: 0 dest: reaches_on_NilD elim!: wf_vydra.cases[of \"Prev I phi\"])\n show ?thesis\n using Prev(4,5) prefix\n by (auto simp: 0 v_def elim: reaches_on.cases split: option.splits)\n next\n case (Suc j)\n show ?thesis\n proof (cases \"v = VYDRA_None\")\n case v_def: True\n obtain w where w_def: \"wf_vydra phi j n w\" \"ru n w = None\"\n using Prev(3)\n by (auto simp: Suc v_def elim!: wf_vydra.cases[of \"Prev I phi\"])\n show ?thesis\n using Prev(2)[OF w_def(1,2)] Prev(5,6,7)\n by (auto simp: Suc)\n next\n case False\n obtain vphi tphi bphi es g where v_def: \"v = VYDRA_Prev I vphi g (Some (tphi, bphi))\"\n \"wf_vydra phi (Suc j) n vphi\" \"reaches_on run_hd init_hd es g\" \"length es = Suc j\"\n using Prev(3) False\n by (auto simp: Suc elim!: wf_vydra.cases[of \"Prev I phi\"])\n show ?thesis\n using Prev(4,5) reaches_on_Some[OF v_def(3) prefix]\n by (auto simp: Let_def Suc v_def(1,4) split: option.splits)\n qed\n qed\nnext\n case (Next n I phi)\n show ?case\n proof (cases \"v = VYDRA_None\")\n case True\n obtain w where w_def: \"wf_vydra phi i n w\" \"ru n w = None\"\n using Next(3)\n by (auto simp: True elim: wf_vydra.cases)\n show ?thesis\n using Next(2)[OF w_def] Next(5,6,7)\n by (auto split: nat.splits)\n next\n case False\n obtain w sub to es where v_def: \"v = VYDRA_Next I w sub to\" \"wf_vydra phi (length es) n w\"\n \"reaches_on run_hd init_hd es sub\" \"length es = (case to of None \\ 0 | _ \\ Suc i)\"\n \"case to of None \\ i = 0 | Some told \\ told = \\ \\ i\"\n using Next(3) False\n by (auto elim!: wf_vydra.cases[of _ _ _ v] split: option.splits nat.splits)\n show ?thesis\n proof (cases to)\n case None\n obtain w' tw' bw' where w'_def: \"ru n w = Some (w', (tw', bw'))\"\n using Next(2)[OF v_def(2)] Next(5,6,7)\n by (fastforce simp: v_def(4) None split: nat.splits)\n have wf: \"wf_vydra phi (Suc (length es)) n w'\"\n using v_def(4,5) vydra_sound_aux[OF Next(1) v_def(2) w'_def] Next(6,7)\n by (auto simp: None)\n show ?thesis\n using Next(2)[OF wf] Next(4,5,6,7) reaches_on_Some[OF v_def(3) prefix]\n reaches_on_Some[OF reaches_on_app[OF v_def(3)] prefix] reaches_on_progress[OF prefix, where ?phi=phi]\n by (cases vs) (fastforce simp: v_def(1,4) w'_def None split: option.splits nat.splits if_splits)+\n next\n case (Some z)\n show ?thesis\n using Next(2)[OF v_def(2)] Next(4,5,6,7) reaches_on_Some[OF v_def(3) prefix] reaches_on_progress[OF prefix, where ?phi=phi]\n by (auto simp: v_def(1,4) Some split: option.splits nat.splits)\n qed\n qed\nnext\n case (Since n I phi psi)\n obtain vphi vpsi g cphi cpsi cppsi tppsi j gs where v_def:\n \"v = VYDRA_Since I vphi vpsi g cphi cpsi cppsi tppsi\"\n \"wf_vydra phi i n vphi\" \"wf_vydra psi j n vpsi\" \"j \\ i\"\n \"reaches_on ru_t l_t0 gs g\" \"length gs = j\" \"cpsi = i - j\"\n using Since(5)\n by (auto elim: wf_vydra.cases)\n obtain vphi' t1 b1 where run_vphi: \"ru n vphi = Some (vphi', t1, b1)\"\n using Since(3)[OF v_def(2)] Since(7,8,9)\n by fastforce\n obtain cs c where wf_vphi': \"wf_vydra phi (Suc i) n vphi'\"\n and reaches_Suc_i: \"reaches_on run_hd init_hd cs c\" \"length cs = Suc i\"\n and t1_def: \"t1 = \\ \\ i\"\n using vydra_sound_aux[OF Since(1) v_def(2) run_vphi] Since(8,9)\n by auto\n note ru_t_Some = ru_t_Some[OF reaches_Suc_i]\n define loop_inv where \"loop_inv = (\\(vpsi, e, cpsi :: nat, cppsi :: nat option, tppsi :: 't option).\n let j = Suc i - cpsi in cpsi \\ Suc i \\ wf_vydra psi j n vpsi \\ (\\es. reaches_on ru_t l_t0 es e \\ length es = j))\"\n define loop_init where \"loop_init = (vpsi, g, Suc cpsi, map_option Suc cppsi, tppsi)\"\n have j_def: \"j = i - cpsi\" and cpsi_i: \"cpsi \\ i\"\n using v_def(4,7)\n by auto\n then have loop_inv_init: \"loop_inv loop_init\"\n using v_def(3,5,6,7) last_before_Some\n by (fastforce simp: loop_inv_def loop_init_def Let_def j_def split: option.splits)\n have wf_loop: \"wf {(s', s). loop_inv s \\ while_since_cond I t1 s \\ Some s' = while_since_body run_hd (ru n) s}\"\n by (auto intro: wf_subset[OF wf_since])\n have step_loop: \"pred_option' loop_inv (while_since_body run_hd (ru n) s)\"\n if loop_assms: \"loop_inv s\" \"while_since_cond I t1 s\" for s\n proof -\n obtain vpsi d cpsi cppsi tppsi where s_def: \"s = (vpsi, d, cpsi, cppsi, tppsi)\"\n by (cases s) auto\n have cpsi_pos: \"cpsi > 0\"\n using loop_assms(2)\n by (auto simp: while_since_cond_def s_def)\n define j where \"j = Suc i - cpsi\"\n have j_i: \"j \\ i\"\n using cpsi_pos\n by (auto simp: j_def)\n obtain ds where loop_before: \"cpsi \\ Suc i\" \"wf_vydra psi j n vpsi\" \"reaches_on ru_t l_t0 ds d\" \"length ds = j\"\n using loop_assms(1)\n by (auto simp: s_def j_def loop_inv_def Let_def)\n obtain h tt where tt_def: \"read_t d = Some tt\" \"d = Some (h, tt)\"\n using ru_t_Some[OF loop_before(3)] loop_before(4) loop_assms(2)\n by (cases d) (fastforce simp: while_since_cond_def s_def j_def split: option.splits)+\n obtain d' where d'_def: \"reaches_on ru_t l_t0 (ds @ [tt]) d'\" \"ru_t d = Some (d', tt)\"\n using reaches_on_app[OF loop_before(3)] tt_def(1)\n by (cases \"run_hd h\") (auto simp: tt_def(2))\n obtain vpsi' tpsi' bpsi' where run_vpsi: \"ru n vpsi = Some (vpsi', (tpsi', bpsi'))\"\n using Since(4) j_i Since(7,8,9) loop_before(2)\n by fastforce\n have wf_psi': \"wf_vydra psi (Suc j) n vpsi'\" and t'_def: \"tpsi' = \\ \\ j\" and b'_def: \"bpsi' = sat psi j\"\n using vydra_sound_aux[OF Since(2) loop_before(2) run_vpsi] Since(8,9)\n by auto\n define j' where j'_def: \"j' = Suc i - (cpsi - Suc 0)\"\n have j'_j: \"j' = Suc j\"\n using loop_before(1) cpsi_pos\n by (auto simp: j'_def j_def)\n show ?thesis\n using wf_psi'(1) loop_before(1,4) d'_def(1)\n by (fastforce simp: while_since_body_def s_def run_vpsi pred_option'_def loop_inv_def j'_def[symmetric] j'_j d'_def(2) t1_def)\n qed\n show ?case\n using while_break_complete[OF step_loop _ wf_loop loop_inv_init, where ?Q=\"\\_. True\"] Since(6)\n by (auto simp: pred_option'_def v_def(1) run_vphi Let_def loop_init_def split: option.splits)\nnext\n case (Until n I phi psi)\n obtain \"back\" vphi vpsi front c z es es' j where v_def:\n \"v = VYDRA_Until I back vphi vpsi front c z\"\n \"wf_vydra phi j n vphi\" \"wf_vydra psi j n vpsi\" \"i \\ j\"\n \"reaches_on ru_t l_t0 es back\" \"length es = i\"\n \"reaches_on ru_t l_t0 es' front\" \"length es' = j\" \"\\t. t \\ set es' \\ memR (\\ \\ i) t I\"\n \"c = j - i\" \"z = (case j of 0 \\ None | Suc k \\ Some (\\ \\ k, sat phi k, sat psi k))\"\n \"\\k. k \\ {i.. sat phi k \\ (memL (\\ \\ i) (\\ \\ k) I \\ \\sat psi k)\"\n using Until(5)\n by (auto simp: elim: wf_vydra.cases)\n have ru_t_Some: \"reaches_on ru_t l_t0 gs g \\ length gs < length vs \\ \\g' gt. ru_t g = Some (g', gt)\" for gs g\n using reaches_on_Some reaches_on_run_hd_t[OF prefix]\n by fastforce\n have vs_tau: \"map fst vs ! k = \\ \\ k\" if k_vs: \"k < length vs\" for k\n using reaches_on_split[OF prefix k_vs] run_hd_sound k_vs\n apply (cases \"vs ! k\")\n apply (auto)\n apply (metis fst_conv length_map nth_map prefix reaches_on_run_hd_t ru_t_tau_in)\n done\n define m where \"m = min (length (map fst vs) - 1) (min (progress phi (map fst vs)) (progress psi (map fst vs)))\"\n have m_vs: \"m < length vs\"\n using Until(7)\n by (cases vs) (auto simp: m_def split: if_splits)\n define A where \"A = {j. 0 \\ j \\ j \\ m \\ memR (map fst vs ! j) (map fst vs ! m) I}\"\n have m_A: \"m \\ A\"\n using memR_tfin_refl[OF \\_fin] vs_tau[OF m_vs]\n by (fastforce simp: A_def)\n then have A_nonempty: \"A \\ {}\"\n by auto\n have A_finite: \"finite A\"\n by (auto simp: A_def)\n have p: \"progress (Until phi I psi) (map fst vs) = Min A\"\n using Until(7)\n unfolding progress.simps m_def[symmetric] Let_def A_def[symmetric]\n by auto\n have i_A: \"i \\ A\"\n using Until(7) A_finite A_nonempty\n by (auto simp del: progress.simps simp: p)\n have i_m: \"i < m\"\n using Until(7) m_A A_finite A_nonempty\n by (auto simp del: progress.simps simp: p)\n have memR_i_m: \"\\memR (map fst vs ! i) (map fst vs ! m) I\"\n using i_A i_m\n by (auto simp: A_def)\n have i_vs: \"i < length vs\"\n using i_m m_vs\n by auto\n have j_m: \"j \\ m\"\n using ru_t_tau_in[OF v_def(7), of m] v_def(9)[of \"\\ \\ m\"] memR_i_m\n unfolding vs_tau[OF i_vs] vs_tau[OF m_vs]\n by (force simp: in_set_conv_nth v_def(8))\n have j_vs: \"j < length vs\"\n using j_m m_vs\n by auto\n obtain back' t where run_back: \"ru_t back = Some (back', t)\" and t_def: \"t = \\ \\ i\"\n using ru_t_Some[OF v_def(5)] v_def(4) j_vs ru_t_tau[OF v_def(5)]\n by (fastforce simp: v_def(6))\n define loop_inv where \"loop_inv = (\\(vphi, vpsi, front, c, z :: ('t \\ bool \\ bool) option).\n let j = i + c in wf_vydra phi j n vphi \\ wf_vydra psi j n vpsi \\ j < length vs \\\n (\\es'. reaches_on ru_t l_t0 es' front \\ length es' = j) \\\n (z = None \\ j = 0))\"\n define loop_init where \"loop_init = (vphi, vpsi, front, c, z)\"\n have j_eq: \"j = i + c\"\n using v_def(4)\n by (auto simp: v_def(10))\n have \"j = 0 \\ c = 0\"\n by (auto simp: j_eq)\n then have loop_inv_init: \"loop_inv loop_init\"\n using v_def(2,3,4,7,8,9,11) j_vs\n by (auto simp: loop_inv_def loop_init_def j_eq[symmetric] split: nat.splits)\n have loop_step: \"pred_option' loop_inv (while_until_body run_hd (ru n) s)\" if loop_assms: \"loop_inv s\" \"while_until_cond I t s\" for s\n proof -\n obtain vphi_cur vpsi_cur epsi_cur c_cur zo_cur where s_def: \"s = (vphi_cur, vpsi_cur, epsi_cur, c_cur, zo_cur)\"\n by (cases s) auto\n define j_cur where \"j_cur = i + c_cur\"\n obtain gs where wf: \"wf_vydra phi j_cur n vphi_cur\" \"wf_vydra psi j_cur n vpsi_cur\"\n and gs_def: \"reaches_on ru_t l_t0 gs epsi_cur\" \"length gs = j_cur\"\n and j_cur_vs: \"j_cur < length vs\"\n using loop_assms(1)\n by (auto simp: loop_inv_def s_def j_cur_def[symmetric])\n obtain epsi'_cur t'_cur where run_epsi: \"ru_t epsi_cur = Some (epsi'_cur, t'_cur)\"\n and t'_cur_def: \"t'_cur = \\ \\ (length gs)\"\n using ru_t_Some[OF gs_def(1)] ru_t_event[OF gs_def(1) refl] j_cur_vs\n by (auto simp: gs_def(2))\n have j_m: \"j_cur < m\"\n using loop_assms(2) memR_i_m memR_mono'[OF _ \\_mono, of _ _ _ _ m]\n unfolding vs_tau[OF i_vs] vs_tau[OF m_vs]\n by (fastforce simp: gs_def(2) while_until_cond_def s_def run_t_read[OF run_epsi] t_def t'_cur_def)\n have j_cur_prog_phi: \"j_cur < progress phi (map fst vs)\"\n using j_m\n by (auto simp: m_def)\n have j_cur_prog_psi: \"j_cur < progress psi (map fst vs)\"\n using j_m\n by (auto simp: m_def)\n obtain vphi'_cur tphi_cur bphi_cur where run_vphi: \"ru n vphi_cur = Some (vphi'_cur, (tphi_cur, bphi_cur))\"\n using Until(3)[OF wf(1) _ j_cur_prog_phi] Until(8,9)\n by fastforce\n obtain vpsi'_cur tpsi_cur bpsi_cur where run_vpsi: \"ru n vpsi_cur = Some (vpsi'_cur, (tpsi_cur, bpsi_cur))\"\n using Until(4)[OF wf(2) _ j_cur_prog_psi] Until(8,9)\n by fastforce\n have wf': \"wf_vydra phi (Suc j_cur) n vphi'_cur\" \"wf_vydra psi (Suc j_cur) n vpsi'_cur\"\n using vydra_sound_aux[OF Until(1) wf(1) run_vphi] vydra_sound_aux[OF Until(2) wf(2) run_vpsi] Until(8,9)\n by auto\n show ?thesis\n using wf' reaches_on_app[OF gs_def(1) run_epsi] gs_def(2) j_m m_vs\n by (auto simp: pred_option'_def while_until_body_def s_def run_epsi run_vphi run_vpsi loop_inv_def j_cur_def[symmetric])\n qed\n have wf_loop: \"wf {(s', s). loop_inv s \\ while_until_cond I t s \\ Some s' = while_until_body run_hd (ru n) s}\"\n proof -\n obtain m where m_def: \"\\\\ \\ m \\ \\ \\ i + right I\"\n using ex_lt_\\[where ?x=\"right I\" and ?s=\\] Until(8)\n by auto\n define X where \"X = {(s', s). loop_inv s \\ while_until_cond I t s \\ Some s' = while_until_body run_hd (ru n) s}\"\n have \"memR t (\\ \\ (i + c)) I \\ i + c < m\" for c\n using m_def order_trans[OF \\_mono[where ?i=m and ?j=\"i + c\" and ?s=\\]]\n by (fastforce simp: t_def dest!: memR_dest)\n then have \"X \\ measure (\\(vphi, vpsi, epsi, c, zo). m - c)\"\n by (fastforce simp: X_def while_until_cond_def while_until_body_def loop_inv_def Let_def split: option.splits\n dest!: read_t_run[where ?run_hd=run_hd] dest: ru_t_tau)\n then show ?thesis\n using wf_subset\n by (auto simp: X_def[symmetric])\n qed\n obtain vphi' vpsi' front' c' z' where loop:\n \"while_break (while_until_cond I t) (while_until_body run_hd (ru n)) loop_init = Some (vphi', vpsi', front', c', z')\"\n \"loop_inv (vphi', vpsi', front', c', z')\" \"\\while_until_cond I t (vphi', vpsi', front', c', z')\"\n using while_break_complete[where ?P=\"loop_inv\", OF loop_step _ wf_loop loop_inv_init]\n by (cases \"while_break (while_until_cond I t) (while_until_body run_hd (ru n)) loop_init\") (force simp: pred_option'_def)+\n define j' where \"j' = i + c'\"\n obtain tf where read_front': \"read_t front' = Some tf\"\n using loop(2)\n by (auto simp: loop_inv_def j'_def[symmetric] dest!: ru_t_Some run_t_read[where ?run_hd=run_hd])\n have tf_fin: \"tf \\ tfin\"\n using loop(2) ru_t_Some[where ?g=front'] ru_t_tau[where ?t'=front'] read_t_run[OF read_front'] \\_fin[where ?\\=\\]\n by (fastforce simp: loop_inv_def j'_def[symmetric])\n have c'_pos: \"c' = 0 \\ False\"\n using loop(2,3) ru_t_tau ru_t_tau[OF reaches_on.intros(1)] read_t_run[OF read_front']\n memR_tfin_refl[OF tf_fin]\n by (fastforce simp: loop_inv_def while_until_cond_def until_ready_def read_front' t_def dest!: reaches_on_NilD)\n have z'_Some: \"z' = None \\ False\"\n using loop(2) c'_pos\n by (auto simp: loop_inv_def j'_def[symmetric])\n show ?case\n using Until(6) c'_pos z'_Some\n by (auto simp: v_def(1) run_back loop_init_def[symmetric] loop(1) read_front' split: if_splits option.splits)\nnext\n case (MatchP n I r)\n have msize_sub: \"\\x. x \\ set (collect_subfmlas r []) \\ msize_fmla x \\ n\"\n using le_trans[OF collect_subfmlas_msize] MatchP(1)\n by auto\n have sound: \"x \\ set (collect_subfmlas r []) \\ wf_vydra x j n v \\ ru n v = Some (v', t, b) \\ wf_vydra x (Suc j) n v' \\ t = \\ \\ j \\ b = sat x j\" for x j v v' t b\n using MatchP vydra_sound_aux[OF msize_sub] le_trans[OF collect_subfmlas_msize]\n using bf_collect_subfmlas[where ?r=\"r\" and ?phis=\"[]\"]\n by (fastforce simp: collect_subfmlas_atms[where ?phis=\"[]\", simplified, symmetric])\n have \"reaches_on (ru n) (su n phi) vs v \\ wf_vydra phi (length vs) n v\" if phi: \"phi \\ set (collect_subfmlas r [])\" for phi vs v\n apply (induction vs arbitrary: v rule: rev_induct)\n using MatchP(1) wf_vydra_sub collect_subfmlas_msize[OF phi]\n apply (auto elim!: reaches_on.cases)[1]\n using sound[OF phi]\n apply (fastforce dest!: reaches_on_split_last)\n done\n then have wf: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) bs s \\ j < length (collect_subfmlas r []) \\\n wf_vydra (collect_subfmlas r [] ! j) (length bs) n (s ! j)\" for bs s j\n using reach_run_subs_run\n by (fastforce simp: in_set_conv_nth)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n define args where \"args = init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n interpret MDL_window \\ r l_t0 \"map (su n) (collect_subfmlas r [])\" args\n using bs_sat[where ?r=r and ?n=n, OF _ wf _ reach_run_subs_len[where ?n=n]] sound run_t_read[of run_hd]\n read_t_run[of _ _ run_hd] ru_t_tau MatchP(5) collect_subfmlas_atms[where ?phis=\"[]\"]\n unfolding args_def iarray_of_list_def\n by unfold_locales auto\n obtain w xs where w_def: \"v = VYDRA_MatchP I ?transs ?qf w\"\n \"valid_window_matchP args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w\"\n using MatchP(3)\n by (auto simp: args_def elim!: wf_vydra.cases)\n note args' = args_def[unfolded init_args.simps, symmetric]\n have run_args: \"w_run_t args = ru_t\" \"w_run_sub args = run_subs (ru n)\"\n by (auto simp: args_def)\n have len_xs: \"length xs = i\"\n using w_def(2)\n by (auto simp: valid_window_matchP_def)\n obtain ej tj where w_tj: \"ru_t (w_tj w) = Some (ej, tj)\"\n using reaches_on_Some[OF valid_window_matchP_reach_tj[OF w_def(2)]] reaches_on_run_hd_t[OF prefix]\n MatchP(5) reaches_on_progress[OF prefix, where ?phi=\"MatchP I r\"]\n by (fastforce simp: run_args len_xs simp del: progress.simps)\n have \"run_subs (ru n) (w_sj w) = None\"\n using valid_eval_matchP[OF w_def(2), unfolded run_args] w_tj MatchP(4,7)\n by (cases \"run_subs (ru n) (w_sj w)\") (auto simp: w_def(1) args' simp del: eval_matchP.simps split: option.splits)\n then obtain j where j_def: \"j < length (w_sj w)\" \"ru n (w_sj w ! j) = None\"\n by (auto simp: run_subs_def Let_def in_set_conv_nth Option.is_none_def split: if_splits)\n have len_w_sj: \"length (w_sj w) = length (collect_subfmlas r [])\"\n using valid_window_matchP_reach_sj[OF w_def(2)] reach_run_subs_len\n by (auto simp: run_args)\n define phi where \"phi = collect_subfmlas r [] ! j\"\n have phi_in_set: \"phi \\ set (collect_subfmlas r [])\"\n using j_def(1)\n by (auto simp: phi_def in_set_conv_nth len_w_sj)\n have wf: \"wf_vydra phi i n (w_sj w ! j)\"\n using valid_window_matchP_reach_sj[OF w_def(2)] wf[folded len_w_sj, OF _ j_def(1)] len_xs\n by (fastforce simp: run_args phi_def)\n have \"i < progress phi (map fst vs)\"\n using MatchP(5) phi_in_set atms_nonempty[of r] atms_finite[of r] collect_subfmlas_atms[of r \"[]\"]\n by auto\n then show ?case\n using MatchP(2)[OF msize_sub[OF phi_in_set] wf j_def(2)] MatchP(6,7) phi_in_set\n bf_collect_subfmlas[where ?r=\"r\" and ?phis=\"[]\"]\n by (auto simp: collect_subfmlas_atms)\nnext\n case (MatchF n I r)\n have subfmla: \"msize_fmla x \\ n\" \"bounded_future_fmla x\" \"wf_fmla x\" if \"x \\ set (collect_subfmlas r [])\" for x\n using that MatchF(1,6,7) le_trans[OF collect_subfmlas_msize] bf_collect_subfmlas[where ?r=\"r\" and ?phis=\"[]\" and ?phi=x]\n collect_subfmlas_atms[where ?phis=\"[]\" and ?r=r]\n by auto\n have sound: \"x \\ set (collect_subfmlas r []) \\ wf_vydra x j n v \\ ru n v = Some (v', t, b) \\ wf_vydra x (Suc j) n v' \\ t = \\ \\ j \\ b = sat x j\" for x j v v' t b\n using MatchF vydra_sound_aux subfmla\n by fastforce\n have \"reaches_on (ru n) (su n phi) vs v \\ wf_vydra phi (length vs) n v\" if phi: \"phi \\ set (collect_subfmlas r [])\" for phi vs v\n apply (induction vs arbitrary: v rule: rev_induct)\n using MatchF(1) wf_vydra_sub subfmla(1)[OF phi] sound[OF phi]\n apply (auto elim!: reaches_on.cases)[1]\n using sound[OF phi]\n apply (fastforce dest!: reaches_on_split_last)\n done\n then have wf: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) bs s \\ j < length (collect_subfmlas r []) \\\n wf_vydra (collect_subfmlas r [] ! j) (length bs) n (s ! j)\" for bs s j\n using reach_run_subs_run\n by (fastforce simp: in_set_conv_nth)\n let ?qf = \"state_cnt r\"\n let ?transs = \"iarray_of_list (build_nfa_impl r (0, ?qf, []))\"\n define args where \"args = init_args ({0}, NFA.delta' ?transs ?qf, NFA.accept' ?transs ?qf) (ru_t, read_t) (run_subs (ru n))\"\n interpret MDL_window \\ r l_t0 \"map (su n) (collect_subfmlas r [])\" args\n using bs_sat[where ?r=r and ?n=n, OF _ wf _ reach_run_subs_len[where ?n=n]] sound run_t_read[of run_hd]\n read_t_run[of _ _ run_hd] ru_t_tau MatchF(5) subfmla\n unfolding args_def iarray_of_list_def\n by unfold_locales auto\n obtain w xs where w_def: \"v = VYDRA_MatchF I ?transs ?qf w\"\n \"valid_window_matchF args I l_t0 (map (su n) (collect_subfmlas r [])) xs i w\"\n using MatchF(3)\n by (auto simp: args_def elim!: wf_vydra.cases)\n note args' = args_def[unfolded init_args.simps, symmetric]\n have run_args: \"w_run_t args = ru_t\" \"w_read_t args = read_t\" \"w_run_sub args = run_subs (ru n)\"\n by (auto simp: args_def)\n have vs_tau: \"map fst vs ! k = \\ \\ k\" if k_vs: \"k < length vs\" for k\n using reaches_on_split[OF prefix k_vs] run_hd_sound k_vs\n apply (cases \"vs ! k\")\n apply (auto)\n apply (metis fst_conv length_map nth_map prefix reaches_on_run_hd_t ru_t_tau_in)\n done\n define m where \"m = min (length (map fst vs) - 1) (Min ((\\f. progress f (map fst vs)) ` atms r))\"\n have m_vs: \"m < length vs\"\n using MatchF(5)\n by (cases vs) (auto simp: m_def split: if_splits)\n define A where \"A = {j. 0 \\ j \\ j \\ m \\ memR (map fst vs ! j) (map fst vs ! m) I}\"\n have m_A: \"m \\ A\"\n using memR_tfin_refl[OF \\_fin] vs_tau[OF m_vs]\n by (fastforce simp: A_def)\n then have A_nonempty: \"A \\ {}\"\n by auto\n have A_finite: \"finite A\"\n by (auto simp: A_def)\n have p: \"progress (MatchF I r) (map fst vs) = Min A\"\n using MatchF(5)\n unfolding progress.simps m_def[symmetric] Let_def A_def[symmetric]\n by auto\n have i_A: \"i \\ A\"\n using MatchF(5) A_finite A_nonempty\n by (auto simp del: progress.simps simp: p)\n have i_m: \"i < m\"\n using MatchF(5) m_A A_finite A_nonempty\n by (auto simp del: progress.simps simp: p)\n have memR_i_m: \"\\memR (map fst vs ! i) (map fst vs ! m) I\"\n using i_A i_m\n by (auto simp: A_def)\n have i_vs: \"i < length vs\"\n using i_m m_vs\n by auto\n obtain ti where read_ti: \"w_read_t args (w_ti w) = Some ti\"\n using w_def(2) reaches_on_Some[where ?r=ru_t and ?s=l_t0 and ?s'=\"w_ti w\"]\n reaches_on_run_hd_t[OF prefix] i_vs run_t_read[where ?t=\"w_ti w\"]\n by (fastforce simp: valid_window_matchF_def run_args)\n have ti_def: \"ti = \\ \\ i\"\n using w_def(2) ru_t_tau read_t_run[OF read_ti]\n by (fastforce simp: valid_window_matchF_def run_args)\n note reach_tj = valid_window_matchF_reach_tj[OF w_def(2), unfolded run_args]\n note reach_sj = valid_window_matchF_reach_sj[OF w_def(2), unfolded run_args]\n have len_xs: \"length xs = w_j w\" and memR_xs: \"\\l. l\\{w_i w.. memR (ts_at xs i) (ts_at xs l) I\"\n and i_def: \"w_i w = i\"\n using w_def(2)\n unfolding valid_window_matchF_def\n by (auto simp: valid_window_matchF_def run_args)\n have j_m: \"w_j w \\ m\"\n using ru_t_tau_in[OF reach_tj, of i] ru_t_tau_in[OF reach_tj, of m] memR_i_m i_m memR_xs[of m]\n unfolding vs_tau[OF i_vs] vs_tau[OF m_vs]\n by (force simp: in_set_conv_nth len_xs ts_at_def i_def)\n obtain tm tm' where tm_def: \"reaches_on ru_t l_t0 (take m (map fst vs)) tm\"\n \"ru_t tm = Some (tm', fst (vs ! m))\"\n using reaches_on_split[where ?i=m] reaches_on_run_hd_t[OF prefix] m_vs\n by fastforce\n have reach_tj_m: \"reaches_on (w_run_t args) (w_tj w) (drop (w_j w) (take m (map fst vs))) tm\"\n using reaches_on_split'[OF tm_def(1), where ?i=\"w_j w\"] reaches_on_inj[OF reach_tj] m_vs j_m\n by (auto simp: len_xs run_args)\n have vs_m: \"fst (vs ! m) = \\ \\ m\"\n using vs_tau[OF m_vs] m_vs\n by auto\n have memR_ti_m: \"\\memR ti (\\ \\ m) I\"\n using memR_i_m\n unfolding vs_tau[OF i_vs] vs_tau[OF m_vs]\n by (auto simp: ti_def)\n have m_prog: \"m \\ progress phi (map fst vs)\" if \"phi \\ set (collect_subfmlas r [])\" for phi\n using collect_subfmlas_atms[where ?r=r and ?phis=\"[]\"] that atms_finite[of r]\n by (auto simp: m_def min.coboundedI2)\n obtain ws s where ws_def: \"reaches_on (run_subs (ru n)) (map (su n) (collect_subfmlas r [])) ws s\" \"length ws = m\"\n using reaches_ons_runI[where ?r=r and ?n=n and ?i=m]\n vydra_wf_reaches_on[where ?i=m and ?n=n] subfmla\n MatchF(2) m_prog\n by fastforce\n have reach_sj_m: \"reaches_on (run_subs (ru n)) (w_sj w) (drop (w_j w) ws) s\"\n using reaches_on_split'[OF ws_def(1), where ?i=\"w_j w\"] reaches_on_inj[OF reach_sj] i_m j_m\n by (auto simp: ws_def(2) len_xs)\n define rho where \"rho = zip (drop (w_j w) (take m (map fst vs))) (drop (w_j w) ws)\"\n have map_fst_rho: \"map fst rho = drop (w_j w) (take m (map fst vs))\"\n and map_snd_rho: \"map snd rho = drop (w_j w) ws\"\n using ws_def(2) j_m m_vs\n by (auto simp: rho_def)\n show False\n using valid_eval_matchF_complete[OF w_def(2) reach_tj_m[folded map_fst_rho] reach_sj_m[folded map_snd_rho run_args] read_ti run_t_read[OF tm_def(2)[folded run_args], unfolded vs_m] memR_ti_m] MatchF(4,7)\n by (auto simp: w_def(1) args_def simp del: eval_matchF.simps)\nqed\n\ndefinition \"ru' \\ = ru (msize_fmla \\)\"\ndefinition \"su' \\ = su (msize_fmla \\) \\\"\n\nlemma vydra_wf:\n assumes \"reaches (ru n) (su n \\) i v\" \"bounded_future_fmla \\\" \"wf_fmla \\\" \"msize_fmla \\ \\ n\"\n shows \"wf_vydra \\ i n v\"\n using assms(1)\nproof (induction i arbitrary: v)\n case 0\n then show ?case\n using wf_vydra_sub[OF assms(4)]\n by (auto elim: reaches.cases)\nnext\n case (Suc i)\n show ?case\n using reaches_Suc_split_last[OF Suc(2)] Suc(1) vydra_sound_aux[OF assms(4) _ _ assms(2,3)]\n by fastforce\nqed\n\nlemma vydra_sound':\n assumes \"reaches (ru' \\) (su' \\) n v\" \"ru' \\ v = Some (v', (t, b))\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n shows \"(t, b) = (\\ \\ n, sat \\ n)\"\n using vydra_sound_aux[OF order.refl vydra_wf[OF assms(1)[unfolded ru'_def su'_def] assms(3,4) order.refl] assms(2)[unfolded ru'_def] assms(3,4)]\n by auto\n\nlemma vydra_complete':\n assumes prefix: \"reaches_on run_hd init_hd vs e\"\n and prog: \"n < progress \\ (map fst vs)\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n shows \"\\v v'. reaches (ru' \\) (su' \\) n v \\ ru' \\ v = Some (v', (\\ \\ n, sat \\ n))\"\nproof -\n have aux: \"False\" if aux_assms: \"j \\ n\" \"wf_vydra \\ j (msize_fmla \\) v\" \"ru (msize_fmla \\) v = None\" for j v\n using vydra_complete_aux[OF prefix aux_assms(2,3) _ prog(2-)] aux_assms(1) prog(1)\n by auto\n obtain ws v where ws_def: \"reaches_on (ru' \\) (su' \\) ws v\" \"wf_vydra \\ n (msize_fmla \\) v\" \"length ws = n\"\n using vydra_wf_reaches_on[OF _ prog(2,3)] aux[OF less_imp_le_nat]\n unfolding ru'_def su'_def\n by blast\n have ru_Some: \"ru' \\ v \\ None\"\n using aux[OF order.refl ws_def(2)]\n by (fastforce simp: ru'_def)\n obtain v' t b where tb_def: \"ru' \\ v = Some (v', (t, b))\"\n using ru_Some\n by auto\n show ?thesis\n using reaches_on_n[OF ws_def(1)] tb_def vydra_sound'[OF reaches_on_n[OF ws_def(1)] tb_def prog(2,3)]\n by (auto simp: ws_def(3))\nqed\n\nlemma map_option_apfst_idle: \"map_option (apfst snd) (map_option (apfst (Pair n)) x) = x\"\n by (cases x) auto\n\nlemma vydra_sound:\n assumes \"reaches (run_vydra run_hd) (init_vydra init_hd run_hd \\) n v\" \"run_vydra run_hd v = Some (v', (t, b))\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n shows \"(t, b) = (\\ \\ n, sat \\ n)\"\nproof -\n have fst_v: \"fst v = msize_fmla \\\"\n by (rule reaches_invar[OF assms(1)]) (auto simp: init_vydra_def run_vydra_def Let_def)\n have \"reaches (ru' \\) (su' \\) n (snd v)\"\n using reaches_cong[OF assms(1), where ?P=\"\\(m, w). m = msize_fmla \\\" and ?g=snd]\n by (auto simp: init_vydra_def run_vydra_def ru'_def su'_def map_option_apfst_idle Let_def simp del: sub.simps)\n then show ?thesis\n using vydra_sound'[OF _ _ assms(3,4)] assms(2) fst_v\n by (auto simp: run_vydra_def ru'_def split: prod.splits)\nqed\n\nlemma vydra_complete:\n assumes prefix: \"reaches_on run_hd init_hd vs e\"\n and prog: \"n < progress \\ (map fst vs)\" \"bounded_future_fmla \\\" \"wf_fmla \\\"\n shows \"\\v v'. reaches (run_vydra run_hd) (init_vydra init_hd run_hd \\) n v \\ run_vydra run_hd v = Some (v', (\\ \\ n, sat \\ n))\"\nproof -\n obtain v v' where wits: \"reaches (ru' \\) (su' \\) n v\" \"ru' \\ v = Some (v', \\ \\ n, sat \\ n)\"\n using vydra_complete'[OF assms]\n by auto\n have reach: \"reaches (run_vydra run_hd) (init_vydra init_hd run_hd \\) n (msize_fmla \\, v)\"\n using reaches_cong[OF wits(1), where ?P=\"\\x. True\" and ?f'=\"run_vydra run_hd\" and ?g=\"Pair (msize_fmla \\)\"]\n by (auto simp: init_vydra_def run_vydra_def ru'_def su'_def Let_def simp del: sub.simps)\n show ?thesis\n apply (rule exI[of _ \"(msize_fmla \\, v)\"])\n apply (rule exI[of _ \"(msize_fmla \\, v')\"])\n apply (auto simp: run_vydra_def wits(2)[unfolded ru'_def] intro: reach)\n done\nqed\n\nend\n\ncontext MDL\nbegin\n\nlemma reach_elem:\n assumes \"reaches (\\i. if P i then Some (Suc i, (\\ \\ i, \\ \\ i)) else None) s n s'\" \"s = 0\"\n shows \"s' = n\"\nproof -\n obtain vs where vs_def: \"reaches_on (\\i. if P i then Some (Suc i, (\\ \\ i, \\ \\ i)) else None) s vs s'\" \"length vs = n\"\n using reaches_on[OF assms(1)]\n by auto\n have \"s' = length vs\"\n using vs_def(1) assms(2)\n by (induction s vs s' rule: reaches_on_rev_induct) (auto split: if_splits)\n then show ?thesis\n using vs_def(2)\n by auto\nqed\n\ninterpretation default_vydra: VYDRA_MDL \\ 0 \"\\i. Some (Suc i, (\\ \\ i, \\ \\ i))\"\n using reach_elem[where ?P=\"\\_. True\"]\n by unfold_locales auto\n\nend\n\nlemma reaches_inj: \"reaches r s i t \\ reaches r s i t' \\ t = t'\"\n using reaches_on_inj reaches_on\n by metis\n\nlemma progress_sound:\n assumes\n \"\\n. n < length ts \\ ts ! n = \\ \\ n\"\n \"\\n. n < length ts \\ \\ \\ n = \\ \\' n\"\n \"\\n. n < length ts \\ \\ \\ n = \\ \\' n\"\n \"n < progress phi ts\"\n \"bounded_future_fmla phi\"\n \"wf_fmla phi\"\n shows \"MDL.sat \\ phi n \\ MDL.sat \\' phi n\"\nproof -\n define run_hd where \"run_hd = (\\i. if i < length ts then Some (Suc i, (\\ \\ i, \\ \\ i)) else None)\"\n interpret vydra: VYDRA_MDL \\ 0 run_hd\n using MDL.reach_elem[where ?P=\"\\i. i < length ts\"]\n by unfold_locales (auto simp: run_hd_def split: if_splits)\n define run_hd' where \"run_hd' = (\\i. if i < length ts then Some (Suc i, (\\ \\' i, \\ \\' i)) else None)\"\n interpret vydra': VYDRA_MDL \\' 0 run_hd'\n using MDL.reach_elem[where ?P=\"\\i. i < length ts\"]\n by unfold_locales (auto simp: run_hd'_def split: if_splits)\n have run_hd_hd': \"run_hd = run_hd'\"\n using assms(1-3)\n by (auto simp: run_hd_def run_hd'_def)\n have reaches_run_hd: \"n \\ length ts \\ reaches_on run_hd 0 (map (\\i. (\\ \\ i, \\ \\ i)) [0..i. (\\ \\ i, \\ \\ i)) [0.. \\ n, vydra.sat phi n)\"\n using vydra.vydra_complete[OF reaches_run_hd[OF order.refl] _ assms(5,6)] assms(4)\n unfolding ts_map[symmetric]\n by blast\n have reaches_run_hd': \"n \\ length ts \\ reaches_on run_hd' 0 (map (\\i. (\\ \\' i, \\ \\' i)) [0..i. (\\ \\' i, \\ \\' i)) [0.. \\' n, vydra'.sat phi n)\"\n using vydra'.vydra_complete[OF reaches_run_hd'[OF order.refl] _ assms(5,6)] assms(4)\n unfolding ts'_map[symmetric]\n by blast\n note v_w = reaches_inj[OF vv_def(1) ww_def(1)[folded run_hd_hd']]\n show ?thesis\n using vv_def(2) ww_def(2)\n by (auto simp: run_hd_hd' v_w)\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/VYDRA_MDL/Monitor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2995012643237018}} {"text": "(*\n * Copyright 2016, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\nsection \\Annotations, assertions and associated operations\\\n\ntheory OG_Annotations\nimports SmallStep\nbegin\n\ntype_synonym 's assn = \"'s set\"\n\ndatatype ('s, dead 'p, dead 'f) ann =\n AnnExpr \"'s assn\" \n | AnnRec \"'s assn\" \"('s, 'p, 'f) ann\"\n | AnnWhile \"'s assn\" \"'s assn\" \"('s, 'p, 'f) ann\"\n | AnnComp \"('s, 'p, 'f) ann\" \"('s, 'p, 'f) ann\"\n | AnnBin \"'s assn\" \"('s, 'p, 'f) ann\" \"('s, 'p, 'f) ann\"\n | AnnPar \"(('s, 'p, 'f) ann \\ 's assn \\ 's assn) list\"\n | AnnCall \"'s assn\" nat\n\ntype_synonym ('s, 'p, 'f) ann_triple = \"('s, 'p, 'f) ann \\ 's assn \\ 's assn\"\n\ntext \\\n The list of \\ann_triple\\ is useful if the code calls the same function multiple times\n and require different annotations for the function body each time.\n\\\ntype_synonym ('s,'p,'f) proc_assns = \"'p \\ (('s, 'p, 'f) ann) list option\"\n\nabbreviation (input) pres:: \"('s, 'p, 'f) ann_triple \\ ('s, 'p, 'f) ann\"\nwhere \"pres a \\ fst a\"\n\nabbreviation (input) postcond :: \"('s, 'p, 'f) ann_triple \\ 's assn\"\nwhere \"postcond a \\ fst (snd a)\"\n\nabbreviation (input) abrcond :: \"('s, 'p, 'f) ann_triple \\ 's assn\"\nwhere \"abrcond a \\ snd (snd a)\"\n\nfun pre :: \"('s, 'p, 'f) ann \\ 's assn\" where\n \"pre (AnnExpr r) = r\" \n| \"pre (AnnRec r e) = r\"\n| \"pre (AnnWhile r i e) = r\"\n| \"pre (AnnComp e\\<^sub>1 e\\<^sub>2) = pre e\\<^sub>1\"\n| \"pre (AnnBin r e\\<^sub>1 e\\<^sub>2) = r\"\n| \"pre (AnnPar as) = \\ (pre ` set (map pres (as)))\"\n| \"pre (AnnCall r n) = r\"\n\nfun pre_par :: \"('s, 'p, 'f) ann \\ bool\" where\n \"pre_par (AnnComp e\\<^sub>1 e\\<^sub>2) = pre_par e\\<^sub>1\"\n| \"pre_par (AnnPar as) = True\"\n| \"pre_par _ = False\"\n\nfun pre_set :: \"('s, 'p, 'f) ann \\ ('s assn) set\" where\n \"pre_set (AnnExpr r) = {r}\"\n| \"pre_set (AnnRec r e) = {r}\"\n| \"pre_set (AnnWhile r i e) = {r}\"\n| \"pre_set (AnnComp e\\<^sub>1 e\\<^sub>2) = pre_set e\\<^sub>1\"\n| \"pre_set (AnnBin r e\\<^sub>1 e\\<^sub>2) = {r}\"\n| \"pre_set (AnnPar as) = \\ (pre_set ` set (map pres (as)))\"\n(*| \"pre_set (AnnPar e\\<^sub>1 e\\<^sub>2) = pre_set (pres e\\<^sub>1) \\ pre_set (pres e\\<^sub>2)\" *)\n| \"pre_set (AnnCall r n) = {r}\"\n\nlemma fst_BNFs[simp]:\n \"a \\ Basic_BNFs.fsts (a,b)\"\n using fsts.intros by auto\n\nlemma \"\\pre_par c \\ pre c \\ pre_set c\"\n by (induct c; simp)\n\nlemma pre_set:\n \"pre c = \\ (pre_set c)\"\n by (induct c; fastforce)\n\nlemma pre_imp_pre_set:\n \"s \\ pre c \\ a \\ pre_set c \\ s \\ a\"\n by (simp add: pre_set)\n\nabbreviation precond :: \"('s, 'p, 'f) ann_triple \\ 's assn\"\nwhere \"precond a \\ pre (fst a)\"\n\nfun strengthen_pre :: \"('s, 'p, 'f) ann \\ 's assn \\ ('s, 'p, 'f) ann\" where\n \"strengthen_pre (AnnExpr r) r' = AnnExpr (r \\ r')\" \n| \"strengthen_pre (AnnRec r e) r' = AnnRec (r \\ r') e\"\n| \"strengthen_pre (AnnWhile r i e) r' = AnnWhile (r \\ r') i e\"\n| \"strengthen_pre (AnnComp e\\<^sub>1 e\\<^sub>2) r' = AnnComp (strengthen_pre e\\<^sub>1 r') e\\<^sub>2\"\n| \"strengthen_pre (AnnBin r e\\<^sub>1 e\\<^sub>2) r' = AnnBin (r \\ r') e\\<^sub>1 e\\<^sub>2\"\n| \"strengthen_pre (AnnPar as) r' = (AnnPar as)\"\n| \"strengthen_pre (AnnCall r n) r' = AnnCall (r \\ r') n\"\n\nfun weaken_pre :: \"('s, 'p, 'f) ann \\ 's assn \\ ('s, 'p, 'f) ann\" where\n \"weaken_pre (AnnExpr r) r' = AnnExpr (r \\ r')\" \n| \"weaken_pre (AnnRec r e) r' = AnnRec (r \\ r') e\"\n| \"weaken_pre (AnnWhile r i e) r' = AnnWhile (r \\ r') i e\"\n| \"weaken_pre (AnnComp e\\<^sub>1 e\\<^sub>2) r' = AnnComp (weaken_pre e\\<^sub>1 r') e\\<^sub>2\"\n| \"weaken_pre (AnnBin r e\\<^sub>1 e\\<^sub>2) r' = AnnBin (r \\ r') e\\<^sub>1 e\\<^sub>2\"\n| \"weaken_pre (AnnPar as) r' = AnnPar as\"\n| \"weaken_pre (AnnCall r n) r' = AnnCall (r \\ r') n\"\n\nlemma weaken_pre_empty[simp]:\n \"weaken_pre r {} = r\"\n by (induct r) auto\n\ntext \\Annotations for call definition (see Language.thy)\\\ndefinition\n ann_call :: \"'s assn \\ 's assn \\ nat \\ 's assn \\'s assn \\ 's assn \\ 's assn \\ ('s,'p,'f) ann\"\nwhere\n \"ann_call init r n restoreq return restorea A \\ \n AnnRec init (AnnComp (AnnComp (AnnComp (AnnExpr init) (AnnCall r n)) (AnnComp (AnnExpr restorea) (AnnExpr A)))\n (AnnRec restoreq (AnnComp (AnnExpr restoreq) (AnnExpr return))))\"\n\n\ninductive ann_matches :: \"('s,'p,'f) body \\ ('s,'p,'f) proc_assns \\ ('s, 'p, 'f) ann \\ ('s, 'p, 'f) com \\ bool\" where\n ann_skip: \"ann_matches \\ \\ (AnnExpr a) Skip\"\n| ann_basic: \"ann_matches \\ \\ (AnnExpr a) (Basic f)\"\n| ann_spec: \"ann_matches \\ \\ (AnnExpr a) (Spec r)\"\n| ann_throw: \"ann_matches \\ \\ (AnnExpr a) (Throw)\"\n| ann_await: \"ann_matches \\ \\ a e \\\n ann_matches \\ \\ (AnnRec r a) (Await b e)\"\n| ann_seq: \"\\ ann_matches \\ \\ a1 p1; ann_matches \\ \\ a2 p2 \\ \\\n ann_matches \\ \\ (AnnComp a1 a2) (Seq p1 p2)\"\n| ann_cond: \"\\ ann_matches \\ \\ a1 c1; ann_matches \\ \\ a2 c2 \\ \\\n ann_matches \\ \\ (AnnBin a a1 a2) (Cond b c1 c2)\"\n| ann_catch: \"\\ ann_matches \\ \\ a1 c1; ann_matches \\ \\ a2 c2 \\ \\\n ann_matches \\ \\ (AnnComp a1 a2) (Catch c1 c2)\"\n| ann_while: \"ann_matches \\ \\ a' e \\\n ann_matches \\ \\ (AnnWhile a i a') (While b e)\"\n| ann_guard: \"\\ ann_matches \\ \\ a' e \\ \\ \n ann_matches \\ \\ (AnnRec a a') (Guard f b e)\"\n| ann_call: \"\\ \\ f = Some as; \\ f = Some b; n < length as;\n ann_matches \\ \\ (as!n) b\\ \\\n ann_matches \\ \\ (AnnCall a n) (Call f)\"\n| ann_dyncom: \"\\s\\r. ann_matches \\ \\ a (c s) \\\n ann_matches \\ \\ (AnnRec r a) (DynCom c)\"\n| ann_parallel: \"\\ length as = length cs;\n \\i \\ (pres (as!i)) (cs!i) \\ \\\n ann_matches \\ \\ (AnnPar as) (Parallel cs)\"\n\nprimrec ann_guards:: \"'s assn \\ ('f \\ 's bexp ) list \\\n ('s,'p,'f) ann \\ ('s,'p,'f) ann\"\nwhere\n \"ann_guards _ [] c = c\" |\n \"ann_guards r (g#gs) c = AnnRec r (ann_guards (r \\ snd g) gs c)\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Complx/OG_Annotations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727232, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2994059834416451}} {"text": "section Occurrences\n\ntext \\This theory contains all of the definitions and laws required for reasoning about\n identifiers that occur in the data structures of the concurrent revisions model.\\\n\ntheory Occurrences\n imports Data\nbegin\n\nsubsection Definitions\n\nsubsubsection \\Revision identifiers\\\n\ndefinition RID\\<^sub>S :: \"('r,'l,'v) store \\ 'r set\" where\n \"RID\\<^sub>S \\ \\ \\ (RID\\<^sub>V ` ran \\)\"\n\ndefinition RID\\<^sub>L :: \"('r,'l,'v) local_state \\ 'r set\" where\n \"RID\\<^sub>L s \\ case s of (\\, \\, e) \\ RID\\<^sub>S \\ \\ RID\\<^sub>S \\ \\ RID\\<^sub>E e\"\n\ndefinition RID\\<^sub>G :: \"('r,'l,'v) global_state \\ 'r set\" where\n \"RID\\<^sub>G s \\ dom s \\ \\ (RID\\<^sub>L ` ran s)\"\n\nsubsubsection \\Location identifiers\\\n\ndefinition LID\\<^sub>S :: \"('r,'l,'v) store \\ 'l set\" where\n \"LID\\<^sub>S \\ \\ dom \\ \\ \\ (LID\\<^sub>V ` ran \\)\"\n\ndefinition LID\\<^sub>L :: \"('r,'l,'v) local_state \\ 'l set\" where\n \"LID\\<^sub>L s \\ case s of (\\, \\, e) \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\ \\ LID\\<^sub>E e\"\n\ndefinition LID\\<^sub>G :: \"('r,'l,'v) global_state \\ 'l set\" where\n \"LID\\<^sub>G s \\ \\ (LID\\<^sub>L ` ran s)\"\n\nsubsection \\Inference rules\\\n\nsubsubsection \\Introduction and elimination rules\\\n\nlemma RID\\<^sub>SI [intro]: \"\\ l = Some v \\ r \\ RID\\<^sub>V v \\ r \\ RID\\<^sub>S \\\"\n by (auto simp add: RID\\<^sub>S_def ran_def)\n\nlemma RID\\<^sub>SE [elim]: \"r \\ RID\\<^sub>S \\ \\ (\\l v. \\ l = Some v \\ r \\ RID\\<^sub>V v \\ P) \\ P\"\n by (auto simp add: RID\\<^sub>S_def ran_def)\n\nlemma RID\\<^sub>LI [intro, consumes 1]:\n assumes \"s = (\\, \\, e)\"\n shows\n \"r \\ RID\\<^sub>S \\ \\ r \\ RID\\<^sub>L s\"\n \"r \\ RID\\<^sub>S \\ \\ r \\ RID\\<^sub>L s\"\n \"r \\ RID\\<^sub>E e \\ r \\ RID\\<^sub>L s\"\n by (auto simp add: RID\\<^sub>L_def assms)\n\nlemma RID\\<^sub>LE [elim]:\n \"\\ r \\ RID\\<^sub>L s; (\\\\ \\ e. s = (\\, \\, e) \\ (r \\ RID\\<^sub>S \\ \\ P) \\ (r \\ RID\\<^sub>S \\ \\ P) \\ (r \\ RID\\<^sub>E e \\ P) \\ P) \\ P \\ \\ P\" \n by (cases s) (auto simp add: RID\\<^sub>L_def)\n\nlemma RID\\<^sub>GI [intro]:\n \"s r = Some v \\ r \\ RID\\<^sub>G s\"\n \"s r' = Some ls \\ r \\ RID\\<^sub>L ls \\ r \\ RID\\<^sub>G s\"\n apply (simp add: RID\\<^sub>G_def domI)\n by (metis (no_types, lifting) RID\\<^sub>G_def UN_I UnI2 ranI)\n\nlemma RID\\<^sub>GE [elim]:\n assumes\n \"r \\ RID\\<^sub>G s\"\n \"r \\ dom s \\ P\"\n \"\\r' ls. s r' = Some ls \\ r \\ RID\\<^sub>L ls \\ P\"\n shows P\n using assms by (auto simp add: RID\\<^sub>G_def ran_def)\n\nlemma LID\\<^sub>SI [intro]:\n \"\\ l = Some v \\ l \\ LID\\<^sub>S \\\"\n \"\\ l' = Some v \\ l \\ LID\\<^sub>V v \\ l \\ LID\\<^sub>S \\\"\n by (auto simp add: LID\\<^sub>S_def ran_def)\n\nlemma LID\\<^sub>SE [elim]:\n assumes \n \"l \\ LID\\<^sub>S \\\"\n \"l \\ dom \\ \\ P\"\n \"\\l' v. \\ l' = Some v \\ l \\ LID\\<^sub>V v \\ P\"\n shows P\n using assms by (auto simp add: LID\\<^sub>S_def ran_def)\n\nlemma LID\\<^sub>LI [intro]:\n assumes \"s = (\\, \\, e)\"\n shows\n \"r \\ LID\\<^sub>S \\ \\ r \\ LID\\<^sub>L s\" \n \"r \\ LID\\<^sub>S \\ \\ r \\ LID\\<^sub>L s\" \n \"r \\ LID\\<^sub>E e \\ r \\ LID\\<^sub>L s\"\n by (auto simp add: LID\\<^sub>L_def assms)\n\nlemma LID\\<^sub>LE [elim]:\n \"\\ l \\ LID\\<^sub>L s; (\\\\ \\ e. s = (\\, \\, e) \\ (l \\ LID\\<^sub>S \\ \\ P) \\ (l \\ LID\\<^sub>S \\ \\ P) \\ (l \\ LID\\<^sub>E e \\ P) \\ P) \\ P \\ \\ P\" \n by (cases s) (auto simp add: LID\\<^sub>L_def)\n\nlemma LID\\<^sub>GI [intro]: \"s r = Some ls \\ l \\ LID\\<^sub>L ls \\ l \\ LID\\<^sub>G s\"\n by (auto simp add: LID\\<^sub>G_def LID\\<^sub>L_def ran_def)\n\nlemma LID\\<^sub>GE [elim]: \"l \\ LID\\<^sub>G s \\ (\\r ls. s r = Some ls \\ l \\ LID\\<^sub>L ls \\ P) \\ P\"\n by (auto simp add: LID\\<^sub>G_def ran_def)\n\nsubsubsection \\Distributive laws\\\n\nlemma ID_distr_completion [simp]: \n \"RID\\<^sub>E (\\[e]) = RID\\<^sub>C \\ \\ RID\\<^sub>E e\"\n \"LID\\<^sub>E (\\[e]) = LID\\<^sub>C \\ \\ LID\\<^sub>E e\"\n by (induct rule: plug.induct) auto\n\nlemma ID_restricted_store_subset_store: \n \"RID\\<^sub>S (\\(l := None)) \\ RID\\<^sub>S \\\"\n \"LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>S \\\"\nproof -\n show \"RID\\<^sub>S (\\(l := None)) \\ RID\\<^sub>S \\\"\n proof (rule subsetI)\n fix r\n assume \"r \\ RID\\<^sub>S (\\(l := None))\"\n then obtain l' v where \"(\\(l := None)) l' = Some v\" and r_v: \"r \\ RID\\<^sub>V v\" by blast\n have \"l' \\ l\" using \\(\\(l := None)) l' = Some v\\ by auto\n hence \"\\ l' = Some v\" using \\(\\(l := None)) l' = Some v\\ by auto\n thus \"r \\ RID\\<^sub>S \\\" using r_v by blast\n qed\nnext\n show \"LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>S \\\"\n proof (rule subsetI)\n fix l'\n assume \"l' \\ LID\\<^sub>S (\\(l := None))\"\n hence \"l' \\ dom (\\(l := None)) \\ (\\l'' v. (\\(l := None)) l'' = Some v \\ l' \\ LID\\<^sub>V v)\" by blast\n thus \"l' \\ LID\\<^sub>S \\\"\n proof (rule disjE)\n assume \"l' \\ dom (\\(l := None))\"\n thus \"l' \\ LID\\<^sub>S \\\" by auto\n next\n assume \"\\l'' v. (\\(l := None)) l'' = Some v \\ l' \\ LID\\<^sub>V v\"\n then obtain l'' v where \"(\\(l := None)) l'' = Some v\" and l'_in_v: \"l' \\ LID\\<^sub>V v\" by blast\n hence \"\\ l'' = Some v\" by (cases \"l = l''\", auto)\n thus \"l' \\ LID\\<^sub>S \\\" using l'_in_v by blast\n qed\n qed\nqed\n\nlemma in_restricted_store_in_unrestricted_store [intro]: \n \"r \\ RID\\<^sub>S (\\(l := None)) \\ r \\ RID\\<^sub>S \\\"\n \"l' \\ LID\\<^sub>S (\\(l := None)) \\ l' \\ LID\\<^sub>S \\\" \n by (meson contra_subsetD ID_restricted_store_subset_store)+\n\nlemma in_restricted_store_in_updated_store [intro]: \n \"r \\ RID\\<^sub>S (\\(l := None)) \\ r \\ RID\\<^sub>S (\\(l \\ v))\" \n \"l' \\ LID\\<^sub>S (\\(l := None)) \\ l' \\ LID\\<^sub>S (\\(l \\ v))\"\nproof -\n assume \"r \\ RID\\<^sub>S (\\(l := None))\"\n hence \"r \\ RID\\<^sub>S (\\ |` (- {l}))\" by (simp add: restrict_complement_singleton_eq)\n hence \"r \\ RID\\<^sub>S (\\(l \\ v) |` (- {l}))\" by simp\n hence \"r \\ RID\\<^sub>S (\\(l := Some v, l := None))\" by (simp add: restrict_complement_singleton_eq)\n thus \"r \\ RID\\<^sub>S (\\(l \\ v))\" by blast\nnext\n assume \"l' \\ LID\\<^sub>S (\\(l := None))\"\n hence \"l' \\ LID\\<^sub>S (\\ |` (- {l}))\" by (simp add: restrict_complement_singleton_eq)\n hence \"l' \\ LID\\<^sub>S (\\(l \\ v) |` (- {l}))\" by simp\n hence \"l' \\ LID\\<^sub>S (\\(l := Some v, l := None))\" by (simp add: restrict_complement_singleton_eq)\n thus \"l' \\ LID\\<^sub>S (\\(l \\ v))\" by blast\nqed\n\nlemma ID_distr_store [simp]:\n \"RID\\<^sub>S (\\(l \\ v)) = RID\\<^sub>S (\\(l := None)) \\ RID\\<^sub>V v\"\n \"LID\\<^sub>S (\\(l \\ v)) = insert l (LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>V v)\"\nproof -\n show \"RID\\<^sub>S (\\(l \\ v)) = RID\\<^sub>S (\\(l := None)) \\ RID\\<^sub>V v\"\n proof (rule set_eqI, rule iffI)\n fix r\n assume \"r \\ RID\\<^sub>S (\\(l \\ v))\"\n then obtain l' v' where \"(\\(l \\ v)) l' = Some v'\" \"r \\ RID\\<^sub>V v'\" by blast\n thus \"r \\ RID\\<^sub>S (\\(l := None)) \\ RID\\<^sub>V v\" by (cases \"l' = l\") auto\n qed auto\nnext\n show \"LID\\<^sub>S (\\(l \\ v)) = insert l (LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>V v)\"\n proof (rule set_eqI, rule iffI)\n fix l'\n assume \"l' \\ LID\\<^sub>S (\\(l \\ v))\"\n hence \"l' \\ dom (\\(l \\ v)) \\ (\\l'' v'. (\\(l \\ v)) l'' = Some v' \\ l' \\ LID\\<^sub>V v')\" by blast\n thus \"l' \\ insert l (LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>V v)\"\n proof (rule disjE)\n assume \"l' \\ dom (\\(l \\ v))\"\n thus \"l' \\ insert l (LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>V v)\" by (cases \"l' = l\") auto\n next\n assume \"\\l'' v'. (\\(l \\ v)) l'' = Some v' \\ l' \\ LID\\<^sub>V v'\"\n then obtain l'' v' where \"(\\(l \\ v)) l'' = Some v'\" \"l' \\ LID\\<^sub>V v'\" by blast\n thus \"l' \\ insert l (LID\\<^sub>S (\\(l := None)) \\ LID\\<^sub>V v)\" by (cases \"l = l''\") auto\n qed\n qed auto\nqed\n\nlemma ID_distr_local [simp]: \n \"LID\\<^sub>L (\\,\\,e) = LID\\<^sub>S \\ \\ LID\\<^sub>S \\ \\ LID\\<^sub>E e\"\n \"RID\\<^sub>L (\\,\\,e) = RID\\<^sub>S \\ \\ RID\\<^sub>S \\ \\ RID\\<^sub>E e\"\n by (simp add: LID\\<^sub>L_def RID\\<^sub>L_def)+\n\nlemma ID_restricted_global_subset_unrestricted:\n \"LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>G s\"\n \"RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>G s\"\nproof -\n show \"LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>G s\"\n proof (rule subsetI)\n fix l\n assume \"l \\ LID\\<^sub>G (s(r := None))\"\n then obtain r'' ls where \"(s(r := None)) r'' = Some ls\" and l_in_ls: \"l \\ LID\\<^sub>L ls\" by blast\n have \"r'' \\ r \" using \\(s(r := None)) r'' = Some ls\\ by auto\n hence \"s r'' = Some ls\" using \\(s(r := None)) r'' = Some ls\\ by auto\n thus \"l \\ LID\\<^sub>G s\" using l_in_ls by blast\n qed\nnext\n show \"RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>G s\"\n proof (rule subsetI)\n fix r'\n assume \"r' \\ RID\\<^sub>G (s(r := None))\"\n hence \"r' \\ dom (s(r := None)) \\ (\\r'' ls. (s(r := None)) r'' = Some ls \\ r' \\ RID\\<^sub>L ls)\" by blast\n thus \"r' \\ RID\\<^sub>G s\"\n proof (rule disjE)\n assume \"\\r'' ls. (s(r := None)) r'' = Some ls \\ r' \\ RID\\<^sub>L ls\"\n then obtain r'' ls where \"(s(r := None)) r'' = Some ls\" and r'_in_ls: \"r' \\ RID\\<^sub>L ls\" by blast\n have neq: \"r'' \\ r\" using \\(s(r := None)) r'' = Some ls\\ by auto\n hence \"s r'' = Some ls\" using \\(s(r := None)) r'' = Some ls\\ by auto\n thus \"r' \\ RID\\<^sub>G s\" using r'_in_ls by blast\n qed auto\n qed\nqed\n\nlemma in_restricted_global_in_unrestricted_global [intro]: \n \"r' \\ RID\\<^sub>G (s(r := None)) \\ r' \\ RID\\<^sub>G s\"\n \"l \\ LID\\<^sub>G (s(r := None)) \\ l \\ LID\\<^sub>G s\"\n by (simp add: ID_restricted_global_subset_unrestricted rev_subsetD)+\n\nlemma in_restricted_global_in_updated_global [intro]: \n \"r' \\ RID\\<^sub>G (s(r := None)) \\ r' \\ RID\\<^sub>G (s(r \\ ls))\" \n \"l \\ LID\\<^sub>G (s(r := None)) \\ l \\ LID\\<^sub>G (s(r \\ ls))\"\nproof -\n assume \"r' \\ RID\\<^sub>G (s(r := None))\"\n hence \"r' \\ RID\\<^sub>G (s |` (- {r}))\" by (simp add: restrict_complement_singleton_eq)\n hence \"r' \\ RID\\<^sub>G (s(r \\ ls) |` (- {r}))\" by simp\n hence \"r' \\ RID\\<^sub>G (s(r := Some ls, r := None))\" by (simp add: restrict_complement_singleton_eq)\n thus \"r' \\ RID\\<^sub>G (s(r \\ ls))\" by blast\nnext\n assume \"l \\ LID\\<^sub>G (s(r := None))\"\n hence \"l \\ LID\\<^sub>G (s |` (- {r}))\" by (simp add: restrict_complement_singleton_eq)\n hence \"l \\ LID\\<^sub>G (s(r \\ ls) |` (- {r}))\" by simp\n hence \"l \\ LID\\<^sub>G (s(r := Some ls, r := None))\" by (simp add: restrict_complement_singleton_eq)\n thus \"l \\ LID\\<^sub>G (s(r \\ ls))\" by blast\nqed\n\nlemma ID_distr_global [simp]:\n \"RID\\<^sub>G (s(r \\ ls)) = insert r (RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>L ls)\"\n \"LID\\<^sub>G (s(r \\ ls)) = LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls\"\nproof -\n show \"LID\\<^sub>G (s(r \\ ls)) = LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls\"\n proof (rule set_eqI)\n fix l\n show \"(l \\ LID\\<^sub>G (s(r \\ ls))) = (l \\ LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls)\"\n proof (rule iffI)\n assume \"l \\ LID\\<^sub>G (s(r \\ ls))\"\n from this obtain r' ls' where \"(s(r \\ ls)) r' = Some ls'\" \"l \\ LID\\<^sub>L ls'\" by auto\n thus \"l \\ LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls\" by (cases \"r = r'\") auto\n qed auto\n qed\n show \"RID\\<^sub>G (s(r \\ ls)) = insert r (RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>L ls)\"\n proof (rule set_eqI)\n fix r'\n show \"(r' \\ RID\\<^sub>G (s(r \\ ls))) = (r' \\ insert r (RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>L ls))\"\n proof (rule iffI, clarsimp)\n assume r'_g: \"r' \\ RID\\<^sub>G (s(r \\ ls))\" and neq: \"r' \\ r\" and r'_l: \"r' \\ RID\\<^sub>L ls\"\n show \"r' \\ RID\\<^sub>G (s(r := None))\"\n proof (rule RID\\<^sub>GE[OF r'_g])\n assume \"r' \\ dom (s(r \\ ls))\"\n thus ?thesis by (simp add: RID\\<^sub>G_def neq)\n next\n fix ls' r''\n assume r'_in_range:\"(s(r \\ ls)) r'' = Some ls'\" \"r' \\ RID\\<^sub>L ls'\"\n thus ?thesis by (cases \"r'' = r\") (use neq r'_l in auto)\n qed\n qed auto\n qed\nqed\n\nlemma restrictions_inwards [simp]:\n \"x \\ x' \\ f(x := Some y, x' := None) = (f(x':= None, x := Some y))\"\n by (rule fun_upd_twist)\n\nsubsubsection \\Miscellaneous laws\\\n\nlemma ID_combination_subset_union [intro]:\n \"RID\\<^sub>S (\\;;\\) \\ RID\\<^sub>S \\ \\ RID\\<^sub>S \\\"\n \"LID\\<^sub>S (\\;;\\) \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\\"\nproof -\n show \"RID\\<^sub>S (\\;;\\) \\ RID\\<^sub>S \\ \\ RID\\<^sub>S \\\"\n proof (rule subsetI)\n fix r\n assume \"r \\ RID\\<^sub>S (\\;;\\)\"\n from this obtain l v where \"(\\;;\\) l = Some v\" and \"r \\ RID\\<^sub>V v\" by blast\n thus \"r \\ RID\\<^sub>S \\ \\ RID\\<^sub>S \\\" by (cases \"l \\ dom \\\") auto\n qed\n show \"LID\\<^sub>S (\\;;\\) \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\\"\n proof (rule subsetI)\n fix l\n assume \"l \\ LID\\<^sub>S (\\;;\\)\"\n hence \"l \\ dom (\\;;\\) \\ (\\l' v. (\\;;\\) l' = Some v \\ l \\ LID\\<^sub>V v)\" by blast\n thus \"l \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\\"\n proof (rule disjE)\n assume \"l \\ dom (\\;;\\)\"\n thus \"l \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\\" by (cases \"l \\ dom \\\") auto\n next \n assume \"\\l' v. (\\;;\\) l' = Some v \\ l \\ LID\\<^sub>V v\"\n from this obtain l' v where \"(\\;;\\) l' = Some v\" \"l \\ LID\\<^sub>V v\" by blast\n thus \"l \\ LID\\<^sub>S \\ \\ LID\\<^sub>S \\\" by (cases \"l' \\ dom \\\") auto\n qed\n qed\nqed\n\nlemma in_combination_in_component [intro]: \n \"r \\ RID\\<^sub>S (\\;;\\) \\ r \\ RID\\<^sub>S \\ \\ r \\ RID\\<^sub>S \\\"\n \"r \\ RID\\<^sub>S (\\;;\\) \\ r \\ RID\\<^sub>S \\ \\ r \\ RID\\<^sub>S \\\"\n \"l \\ LID\\<^sub>S (\\;;\\) \\ l \\ LID\\<^sub>S \\ \\ l \\ LID\\<^sub>S \\\"\n \"l \\ LID\\<^sub>S (\\;;\\) \\ l \\ LID\\<^sub>S \\ \\ l \\ LID\\<^sub>S \\\"\n by (meson Un_iff ID_combination_subset_union subsetCE)+\n\nlemma in_mapped_in_component_of_combination [intro]:\n assumes \n maps_to_v: \"(\\;;\\) l = Some v\" and\n l'_in_v: \"l' \\ LID\\<^sub>V v\"\n shows\n \"l' \\ LID\\<^sub>S \\ \\ l' \\ LID\\<^sub>S \\\"\n \"l' \\ LID\\<^sub>S \\ \\ l' \\ LID\\<^sub>S \\\"\n by (metis LID\\<^sub>SI(2) combine.simps l'_in_v maps_to_v)+\n\nlemma elim_trivial_restriction [simp]: \"l \\ LID\\<^sub>S \\ \\ (\\(l := None)) = \\\" \n by (simp add: LID\\<^sub>S_def domIff fun_upd_idem)\n\nlemma ID_distr_global_conditional:\n \"s r = Some ls \\ RID\\<^sub>G s = insert r (RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>L ls)\"\n \"s r = Some ls \\ LID\\<^sub>G s = LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls\"\nproof -\n assume \"s r = Some ls\"\n hence s_as_upd: \"s = (s(r \\ ls))\" by (simp add: fun_upd_idem)\n show \"RID\\<^sub>G s = insert r (RID\\<^sub>G (s(r := None)) \\ RID\\<^sub>L ls)\" by (subst s_as_upd, simp)\n show \"LID\\<^sub>G s = LID\\<^sub>G (s(r := None)) \\ LID\\<^sub>L ls\" by (subst s_as_upd, simp)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Concurrent_Revisions/Occurrences.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2994059760373658}} {"text": "(*****************************************************************************\n * Clean\n * \n * HOL-TestGen --- theorem-prover based test case generation\n * http://www.brucker.ch/projects/hol-testgen/\n * \n * Copyright (c) 2005-2007 ETH Zurich, Switzerland\n * 2009-2017 Univ. Paris-Sud, France \n * 2009-2012 Achim D. Brucker, Germany\n * 2015-2017 University Sheffield, UK\n * 2018-2019 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\n(*\n * Monads --- a base testing theory for sequential computations.\n * This file is part of HOL-TestGen.\n *)\n\ntheory MonadSE\n imports Main\nbegin\n \nsection\\Definition : Standard State Exception Monads\\\ntext\\State exception monads in our sense are a direct, pure formulation\nof automata with a partial transition function.\\\n\nsubsection\\Definition : Core Types and Operators\\\n\ntype_synonym ('o, '\\) MON\\<^sub>S\\<^sub>E = \"'\\ \\ ('o \\ '\\)\" (* = '\\ \\ ('o \\ '\\)option *) \n \ndefinition bind_SE :: \"('o,'\\)MON\\<^sub>S\\<^sub>E \\ ('o \\ ('o','\\)MON\\<^sub>S\\<^sub>E) \\ ('o','\\)MON\\<^sub>S\\<^sub>E\" \nwhere \"bind_SE f g = (\\\\. case f \\ of None \\ None \n | Some (out, \\') \\ g out \\')\"\n\nnotation bind_SE (\"bind\\<^sub>S\\<^sub>E\")\n\nsyntax (xsymbols)\n \"_bind_SE\" :: \"[pttrn,('o,'\\)MON\\<^sub>S\\<^sub>E,('o','\\)MON\\<^sub>S\\<^sub>E] \\ ('o','\\)MON\\<^sub>S\\<^sub>E\" \n (\"(2 _ \\ _; _)\" [5,8,8]8)\ntranslations \n \"x \\ f; g\" == \"CONST bind_SE f (% x . g)\"\n\ndefinition unit_SE :: \"'o \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\" (\"(result _)\" 8) \nwhere \"unit_SE e = (\\\\. Some(e,\\))\"\nnotation unit_SE (\"unit\\<^sub>S\\<^sub>E\")\n\ntext\\In the following, we prove the required Monad-laws\\\n\nlemma bind_right_unit[simp]: \"(x \\ m; result x) = m\"\n apply (simp add: unit_SE_def bind_SE_def)\n apply (rule ext)\n apply (case_tac \"m \\\", simp_all)\n done\n\nlemma bind_left_unit [simp]: \"(x \\ result c; P x) = P c\"\n by (simp add: unit_SE_def bind_SE_def)\n \nlemma bind_assoc[simp]: \"(y \\ (x \\ m; k x); h y) = (x \\ m; (y \\ k x; h y))\"\n apply (simp add: unit_SE_def bind_SE_def, rule ext)\n apply (case_tac \"m \\\", simp_all)\n apply (case_tac \"a\", simp_all)\n done\n \nsubsection\\Definition : More Operators and their Properties\\\n\ndefinition fail_SE :: \"('o, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"fail_SE = (\\\\. None)\" \nnotation fail_SE (\"fail\\<^sub>S\\<^sub>E\")\n\ndefinition assert_SE :: \"('\\ \\ bool) \\ (bool, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"assert_SE P = (\\\\. if P \\ then Some(True,\\) else None)\"\nnotation assert_SE (\"assert\\<^sub>S\\<^sub>E\")\n\ndefinition assume_SE :: \"('\\ \\ bool) \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"assume_SE P = (\\\\. if \\\\ . P \\ then Some((), SOME \\ . P \\) else None)\"\nnotation assume_SE (\"assume\\<^sub>S\\<^sub>E\")\n\n\nlemma bind_left_fail_SE[simp] : \"(x \\ fail\\<^sub>S\\<^sub>E; P x) = fail\\<^sub>S\\<^sub>E\"\n by (simp add: fail_SE_def bind_SE_def)\n\n\ntext\\We also provide a \"Pipe-free\" - variant of the bind operator.\nJust a \"standard\" programming sequential operator without output frills.\\\n(* TODO: Eliminate/Modify this. Is a consequence of the Monad-Instantiation. *)\n\n\ndefinition bind_SE' :: \"('\\, '\\)MON\\<^sub>S\\<^sub>E \\ ('\\, '\\)MON\\<^sub>S\\<^sub>E \\ ('\\, '\\)MON\\<^sub>S\\<^sub>E\" (infixr \";-\" 60)\nwhere \"f ;- g = (_ \\ f ; g)\"\n\nlemma bind_assoc'[simp]: \"((m;- k);- h ) = (m;- (k;- h))\"\nby(simp add:bind_SE'_def)\n\n\nlemma bind_left_unit' [simp]: \"((result c);- P) = P\"\n by (simp add: bind_SE'_def)\n \n\nlemma bind_left_fail_SE'[simp]: \"(fail\\<^sub>S\\<^sub>E;- P) = fail\\<^sub>S\\<^sub>E\"\n by (simp add: bind_SE'_def)\n\nlemma bind_right_unit'[simp]: \"(m;- (result ())) = m\"\n by (simp add: bind_SE'_def)\n \ntext\\The bind-operator in the state-exception monad yields already\n a semantics for the concept of an input sequence on the meta-level:\\\nlemma syntax_test: \"(o1 \\ f1 ; o2 \\ f2; result (post o1 o2)) = X\"\noops\n \ndefinition yield\\<^sub>C :: \"('a \\ 'b) \\ ('b,'a ) MON\\<^sub>S\\<^sub>E\"\n where \"yield\\<^sub>C f \\ (\\\\. Some(f \\, \\))\"\n\n\ndefinition try_SE :: \"('o,'\\) MON\\<^sub>S\\<^sub>E \\ ('o option,'\\) MON\\<^sub>S\\<^sub>E\" (\"try\\<^sub>S\\<^sub>E\")\nwhere \"try\\<^sub>S\\<^sub>E ioprog = (\\\\. case ioprog \\ of\n None \\ Some(None, \\)\n | Some(outs, \\') \\ Some(Some outs, \\'))\" \ntext\\In contrast, mbind as a failure safe operator can roughly be seen \n as a foldr on bind - try:\n m1 ; try m2 ; try m3; ... Note, that the rough equivalence only holds for\n certain predicates in the sequence - length equivalence modulo None,\n for example. However, if a conditional is added, the equivalence\n can be made precise:\\\n \ntext\\On this basis, a symbolic evaluation scheme can be established\n that reduces mbind-code to try\\_SE\\_code and ite-cascades.\\\n\ndefinition alt_SE :: \"[('o, '\\)MON\\<^sub>S\\<^sub>E, ('o, '\\)MON\\<^sub>S\\<^sub>E] \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\" (infixl \"\\\\<^sub>S\\<^sub>E\" 10)\nwhere \"(f \\\\<^sub>S\\<^sub>E g) = (\\ \\. case f \\ of None \\ g \\\n | Some H \\ Some H)\"\n\ndefinition malt_SE :: \"('o, '\\)MON\\<^sub>S\\<^sub>E list \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"malt_SE S = foldr alt_SE S fail\\<^sub>S\\<^sub>E\"\nnotation malt_SE (\"\\\\<^sub>S\\<^sub>E\")\n\nlemma malt_SE_mt [simp]: \"\\\\<^sub>S\\<^sub>E [] = fail\\<^sub>S\\<^sub>E\"\nby(simp add: malt_SE_def)\n\nlemma malt_SE_cons [simp]: \"\\\\<^sub>S\\<^sub>E (a # S) = (a \\\\<^sub>S\\<^sub>E (\\\\<^sub>S\\<^sub>E S))\"\nby(simp add: malt_SE_def)\n\n\nsubsection\\Definition : Programming Operators and their Properties\\\n\ndefinition \"skip\\<^sub>S\\<^sub>E = unit\\<^sub>S\\<^sub>E ()\"\n\ndefinition if_SE :: \"['\\ \\ bool, ('\\, '\\)MON\\<^sub>S\\<^sub>E, ('\\, '\\)MON\\<^sub>S\\<^sub>E] \\ ('\\, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"if_SE c E F = (\\\\. if c \\ then E \\ else F \\)\" \n\nsyntax (xsymbols)\n \"_if_SE\" :: \"['\\ \\ bool,('o,'\\)MON\\<^sub>S\\<^sub>E,('o','\\)MON\\<^sub>S\\<^sub>E] \\ ('o','\\)MON\\<^sub>S\\<^sub>E\" \n (\"(if\\<^sub>S\\<^sub>E _ then _ else _fi)\" [5,8,8]8)\ntranslations \n \"(if\\<^sub>S\\<^sub>E cond then T1 else T2 fi)\" == \"CONST if_SE cond T1 T2\"\n\n\nsubsection\\Theory of a Monadic While\\\n\ntext\\Prerequisites\\\nfun replicator :: \"[('a, '\\)MON\\<^sub>S\\<^sub>E, nat] \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\" (infixr \"^^^\" 60)\nwhere \"f ^^^ 0 = (result ())\"\n | \"f ^^^ (Suc n) = (f ;- f ^^^ n)\"\n\n\nfun replicator2 :: \"[('a, '\\)MON\\<^sub>S\\<^sub>E, nat, ('b, '\\)MON\\<^sub>S\\<^sub>E] \\ ('b, '\\)MON\\<^sub>S\\<^sub>E\" (infixr \"^:^\" 60)\nwhere \"(f ^:^ 0) M = (M )\"\n | \"(f ^:^ (Suc n)) M = (f ;- ((f ^:^ n) M))\"\n\n\ntext\\First Step : Establishing an embedding between partial functions and relations\\ \n(* plongement *)\ndefinition Mon2Rel :: \"(unit, '\\)MON\\<^sub>S\\<^sub>E \\ ('\\ \\ '\\) set\"\nwhere \"Mon2Rel f = {(x, y). (f x = Some((), y))}\"\n(* ressortir *)\ndefinition Rel2Mon :: \" ('\\ \\ '\\) set \\ (unit, '\\)MON\\<^sub>S\\<^sub>E \"\nwhere \"Rel2Mon S = (\\ \\. if \\\\'. (\\, \\') \\ S then Some((), SOME \\'. (\\, \\') \\ S) else None)\"\n\nlemma Mon2Rel_Rel2Mon_id: assumes det:\"single_valued R\" shows \"(Mon2Rel \\ Rel2Mon) R = R\"\napply (simp add: comp_def Mon2Rel_def Rel2Mon_def,auto)\napply (case_tac \"\\\\'. (a, \\') \\ R\", auto)\napply (subst (2) some_eq_ex) \nusing det[simplified single_valued_def] by auto\n\n\nlemma Rel2Mon_Id: \"(Rel2Mon \\ Mon2Rel) x = x\"\napply (rule ext)\napply (auto simp: comp_def Mon2Rel_def Rel2Mon_def)\napply (erule contrapos_pp, drule HOL.not_sym, simp)\ndone\n\nlemma single_valued_Mon2Rel: \"single_valued (Mon2Rel B)\"\nby (auto simp: single_valued_def Mon2Rel_def)\n\ntext\\Second Step : Proving an induction principle allowing to establish that lfp remains\n deterministic\\ \n\n\n(* A little complete partial order theory due to Tobias Nipkow *)\ndefinition chain :: \"(nat \\ 'a set) \\ bool\" \nwhere \"chain S = (\\i. S i \\ S(Suc i))\"\n\nlemma chain_total: \"chain S ==> S i \\ S j \\ S j \\ S i\"\nby (metis chain_def le_cases lift_Suc_mono_le)\n\ndefinition cont :: \"('a set => 'b set) => bool\" \nwhere \"cont f = (\\S. chain S \\ f(UN n. S n) = (UN n. f(S n)))\"\n\nlemma mono_if_cont: fixes f :: \"'a set \\ 'b set\"\n assumes \"cont f\" shows \"mono f\"\nproof\n fix a b :: \"'a set\" assume \"a \\ b\"\n let ?S = \"\\n::nat. if n=0 then a else b\"\n have \"chain ?S\" using \\a \\ b\\ by(auto simp: chain_def)\n hence \"f(UN n. ?S n) = (UN n. f(?S n))\"\n using assms by (metis cont_def)\n moreover have \"(UN n. ?S n) = b\" using \\a \\ b\\ by (auto split: if_splits)\n moreover have \"(UN n. f(?S n)) = f a \\ f b\" by (auto split: if_splits)\n ultimately show \"f a \\ f b\" by (metis Un_upper1)\nqed\n\nlemma chain_iterates: fixes f :: \"'a set \\ 'a set\"\n assumes \"mono f\" shows \"chain(\\n. (f^^n) {})\"\nproof-\n { fix n have \"(f ^^ n) {} \\ (f ^^ Suc n) {}\" using assms\n by(induction n) (auto simp: mono_def) }\n thus ?thesis by(auto simp: chain_def)\nqed\n\ntheorem lfp_if_cont:\n assumes \"cont f\" shows \"lfp f = (\\n. (f ^^ n) {})\" (is \"_ = ?U\")\nproof\n show \"lfp f \\ ?U\"\n proof (rule lfp_lowerbound)\n have \"f ?U = (UN n. (f^^Suc n){})\"\n using chain_iterates[OF mono_if_cont[OF assms]] assms\n by(simp add: cont_def)\n also have \"\\ = (f^^0){} \\ \\\" by simp\n also have \"\\ = ?U\"\n apply(auto simp del: funpow.simps)\n by (metis empty_iff funpow_0 old.nat.exhaust)\n finally show \"f ?U \\ ?U\" by simp\n qed\nnext\n { fix n p assume \"f p \\ p\"\n have \"(f^^n){} \\ p\"\n proof(induction n)\n case 0 show ?case by simp\n next\n case Suc\n from monoD[OF mono_if_cont[OF assms] Suc] \\f p \\ p\\\n show ?case by simp\n qed\n }\n thus \"?U \\ lfp f\" by(auto simp: lfp_def)\nqed\n\n\nlemma single_valued_UN_chain:\n assumes \"chain S\" \"(!!n. single_valued (S n))\"\n shows \"single_valued(UN n. S n)\"\nproof(auto simp: single_valued_def)\n fix m n x y z assume \"(x, y) \\ S m\" \"(x, z) \\ S n\"\n with chain_total[OF assms(1), of m n] assms(2)\n show \"y = z\" by (auto simp: single_valued_def)\nqed\n\nlemma single_valued_lfp: \nfixes f :: \"('a \\ 'a) set \\ ('a \\ 'a) set\"\nassumes \"cont f\" \"\\r. single_valued r \\ single_valued (f r)\"\nshows \"single_valued(lfp f)\"\nunfolding lfp_if_cont[OF assms(1)]\nproof(rule single_valued_UN_chain[OF chain_iterates[OF mono_if_cont[OF assms(1)]]])\n fix n show \"single_valued ((f ^^ n) {})\"\n by(induction n)(auto simp: assms(2))\nqed\n\n\ntext\\Third Step: Definition of the Monadic While \\ \\\\\ndefinition \\ :: \"['\\ \\ bool,('\\ \\ '\\) set] \\ (('\\ \\ '\\) set \\ ('\\ \\ '\\) set)\" \nwhere \"\\ b cd = (\\cw. {(s,t). if b s then (s, t) \\ cd O cw else s = t})\"\n\n\ndefinition while_SE :: \"['\\ \\ bool, (unit, '\\)MON\\<^sub>S\\<^sub>E] \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"while_SE c B \\ (Rel2Mon(lfp(\\ c (Mon2Rel B))))\"\n\nsyntax (xsymbols)\n \"_while_SE\" :: \"['\\ \\ bool, (unit, '\\)MON\\<^sub>S\\<^sub>E] \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\" \n (\"(while\\<^sub>S\\<^sub>E _ do _ od)\" [8,8]8)\ntranslations \n \"while\\<^sub>S\\<^sub>E c do b od\" == \"CONST while_SE c b\"\n\nlemma cont_\\: \"cont (\\ c b)\"\nby (auto simp: cont_def \\_def)\n\ntext\\The fixpoint theory now allows us to establish that the lfp constructed over\n @{term Mon2Rel} remains deterministic\\\n\ntheorem single_valued_lfp_Mon2Rel: \"single_valued (lfp(\\ c (Mon2Rel B)))\"\napply(rule single_valued_lfp, simp_all add: cont_\\)\napply(auto simp: \\_def single_valued_def)\napply(metis single_valued_Mon2Rel[of \"B\"] single_valued_def)\ndone\n\n\nlemma Rel2Mon_if:\n \"Rel2Mon {(s, t). if b s then (s, t) \\ Mon2Rel c O lfp (\\ b (Mon2Rel c)) else s = t} \\ =\n (if b \\ then Rel2Mon (Mon2Rel c O lfp (\\ b (Mon2Rel c))) \\ else Some ((), \\))\"\nby (simp add: Rel2Mon_def)\n\nlemma Rel2Mon_homomorphism:\n assumes determ_X: \"single_valued X\" and determ_Y: \"single_valued Y\"\n shows \"Rel2Mon (X O Y) = (Rel2Mon X) ;- (Rel2Mon Y)\"\nproof - \n have relational_partial_next_in_O: \"\\x E F. (\\y. (x, y) \\ (E O F)) \\ (\\y. (x, y) \\ E)\" \n by (auto)\n have some_eq_intro: \"\\ X x y . single_valued X \\ (x, y) \\ X \\ (SOME y. (x, y) \\ X) = y\"\n by (auto simp: single_valued_def)\n\n show ?thesis\napply (simp add: Rel2Mon_def bind_SE'_def bind_SE_def)\napply (rule ext, rename_tac \"\\\")\napply (case_tac \" \\ \\'. (\\, \\') \\ X O Y\")\napply (simp only: HOL.if_True)\napply (frule relational_partial_next_in_O)\napply (auto simp: single_valued_relcomp some_eq_intro determ_X determ_Y relcomp.relcompI)\nby blast\nqed\n\n\n\ntext\\Putting everything together, the theory of embedding and the invariance of\n determinism of the while-body, gives us the usual unfold-theorem:\\\ntheorem while_SE_unfold:\n\"(while\\<^sub>S\\<^sub>E b do c od) = (if\\<^sub>S\\<^sub>E b then (c ;- (while\\<^sub>S\\<^sub>E b do c od)) else result () fi)\"\napply (simp add: if_SE_def bind_SE'_def while_SE_def unit_SE_def)\napply (subst lfp_unfold [OF mono_if_cont, OF cont_\\])\napply (rule ext)\napply (subst \\_def)\napply (auto simp: Rel2Mon_if Rel2Mon_homomorphism bind_SE'_def Rel2Mon_Id [simplified comp_def] \n single_valued_Mon2Rel single_valued_lfp_Mon2Rel )\ndone\n \n\nlemma bind_cong : \" f \\ = g \\ \\ (x \\ f ; M x)\\ = (x \\ g ; M x)\\\"\n unfolding bind_SE'_def bind_SE_def by simp\n\nlemma bind'_cong : \" f \\ = g \\ \\ (f ;- M )\\ = (g ;- M )\\\"\n unfolding bind_SE'_def bind_SE_def by simp\n\n \n \nlemma if\\<^sub>S\\<^sub>E_True [simp]: \"(if\\<^sub>S\\<^sub>E (\\ x. True) then c else d fi) = c\" \n apply(rule ext) by (simp add: MonadSE.if_SE_def) \n\nlemma if\\<^sub>S\\<^sub>E_False [simp]: \"(if\\<^sub>S\\<^sub>E (\\ x. False) then c else d fi) = d\" \n apply(rule ext) by (simp add: MonadSE.if_SE_def) \n \n \nlemma if\\<^sub>S\\<^sub>E_cond_cong : \"f \\ = g \\ \\ \n (if\\<^sub>S\\<^sub>E f then c else d fi) \\ = \n (if\\<^sub>S\\<^sub>E g then c else d fi) \\\"\n unfolding if_SE_def by simp\n \nlemma while\\<^sub>S\\<^sub>E_skip[simp] : \"(while\\<^sub>S\\<^sub>E (\\ x. False) do c od) = skip\\<^sub>S\\<^sub>E\" \n apply(rule ext,subst MonadSE.while_SE_unfold)\n by (simp add: MonadSE.if_SE_def skip\\<^sub>S\\<^sub>E_def)\n \n \nend\n ", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Clean/src/MonadSE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.29940597603736574}} {"text": "section \\The Optimized Observing Quorums Model\\\n\ntheory Observing_Quorums_Opt\nimports Observing_Quorums\nbegin\n\nsubsection \\Model definition\\\n(******************************************************************************)\n\nrecord opt_obsv_state = \n next_round :: round \n decisions :: \"(process, val)map\"\n last_obs :: \"(process, val)map\"\n\ncontext mono_quorum\nbegin\n\ndefinition opt_obs_safe where\n \"opt_obs_safe obs_f v \\ \\p. obs_f p \\ {None, Some v}\"\n\ndefinition olv_round where\n \"olv_round r S v r_decisions Ob \\ {(s, s').\n \\ \\guards\\\n r = next_round s\n \\ (S \\ {} \\ opt_obs_safe (last_obs s) v)\n \\ (S \\ Quorum \\ Ob = UNIV)\n \\ d_guard r_decisions (const_map v S)\n \\ (Ob \\ {} \\ S \\ {})\n \\ \\ \\actions\\\n s' = s\\ \n next_round := Suc r\n , decisions := decisions s ++ r_decisions\n , last_obs := last_obs s ++ const_map v Ob\n \\\n }\"\n\ndefinition olv_init where\n \"olv_init = { \\ next_round = 0, decisions = Map.empty, last_obs = Map.empty \\ }\"\n\ndefinition olv_trans :: \"(opt_obsv_state \\ opt_obsv_state) set\" where\n \"olv_trans = (\\r S v D Ob. olv_round r S v D Ob) \\ Id\"\n\ndefinition olv_TS :: \"opt_obsv_state TS\" where\n \"olv_TS = \\ init = olv_init, trans = olv_trans \\\"\n\nlemmas olv_TS_defs = olv_TS_def olv_init_def olv_trans_def\n\nsubsection \\Refinement\\\n(******************************************************************************)\n\ndefinition olv_ref_rel where\n \"olv_ref_rel \\ {(sa, sc).\n next_round sc = v_state.next_round sa\n \\ decisions sc = v_state.decisions sa\n \\ last_obs sc = map_option snd o process_mru (obsv_state.obs sa)\n }\"\n\n\nlemma OV_inv2_finite_map_graph:\n \"s \\ OV_inv2 \\ finite (map_graph (case_prod (obsv_state.obs s)))\"\n apply(rule finite_dom_finite_map_graph)\n apply(rule finite_subset[where B=\"{0..< v_state.next_round s} \\ UNIV\"])\n apply(auto simp add: OV_inv2_def dom_def not_le[symmetric])\n done\n\nlemma OV_inv2_finite_obs_set:\n \"s \\ OV_inv2 \\ finite (vote_set (obsv_state.obs s) Q)\"\n apply(drule OV_inv2_finite_map_graph)\n apply(clarsimp simp add: map_graph_def fun_graph_def vote_set_def)\n apply(erule finite_surj[where f=\"\\((r, a), v). (r, v)\"])\n by(force simp add: image_def) \n\nlemma olv_round_refines:\n \"{olv_ref_rel \\ (OV_inv2 \\ OV_inv3 \\ OV_inv4) \\ UNIV} obsv_round r S v D Ob, olv_round r S v D Ob {>olv_ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs)\n fix sa :: obsv_state and sc sc'\n assume\n ainv: \"sa \\ OV_inv2\" \"sa \\ OV_inv3\" \"sa \\ OV_inv4\"\n and step: \"(sc, sc') \\ olv_round r S v D Ob\"\n and R: \"(sa, sc) \\ olv_ref_rel\"\n\n \\ \\Abstract guard.\\\n have \"S \\ {} \\ obs_safe (v_state.next_round sa) sa v\"\n proof(rule impI, rule ccontr)\n assume S_nonempty: \"S \\ {}\" and no_Q: \"\\ obs_safe (v_state.next_round sa) sa v\"\n from no_Q obtain r_w w where \n r_w: \"r_w < v_state.next_round sa\"\n and all_obs: \"\\p. obsv_state.obs sa r_w p = Some w\"\n and diff: \"w \\ v\" using ainv(3)[THEN OV_inv4D]\n by(simp add: obs_safe_def) (metis)\n from diff step R obtain p where \n p_w: \"S \\ {} \\ (map_option snd \\ process_mru (obsv_state.obs sa)) p \\ Some w\"\n by (simp add: opt_obs_safe_def quorum_for_def olv_round_def olv_ref_rel_def) \n (metis option.distinct(1) option.sel snd_conv)\n from all_obs have nempty: \"vote_set (obsv_state.obs sa) {p} \\ {}\" \n by(auto simp add: vote_set_def)\n then obtain r_w' w' where w': \"process_mru (obsv_state.obs sa) p = Some (r_w', w')\"\n by (simp add: process_mru_def mru_of_set_def) \n (metis option_Max_by_def surj_pair)\n hence max: \"(r_w', w') = Max_by fst (vote_set (obsv_state.obs sa) {p})\"\n by(auto simp add: process_mru_def mru_of_set_def option_Max_by_def)\n hence w'_obs: \"(r_w', w') \\ vote_set (obsv_state.obs sa) {p}\" \n using Max_by_in[OF OV_inv2_finite_obs_set[OF ainv(1), of \"{p}\"] nempty]\n by fastforce\n have \"r_w \\ r_w'\" using all_obs\n apply -\n apply(rule Max_by_ge[OF OV_inv2_finite_obs_set[OF ainv(1), of \"{p}\"], of \"(r_w, w)\" fst, \n simplified max[symmetric], simplified])\n apply(auto simp add: quorum_for_def vote_set_def)\n done\n moreover have \"w' \\ w\" using p_w w' S_nonempty\n by(auto)\n ultimately have \"r_w < r_w'\" using all_obs w'_obs\n apply(elim le_neq_implies_less)\n apply(auto simp add: quorum_for_def vote_set_def)\n done\n thus False using ainv(2)[THEN OV_inv3D] w'_obs all_obs \\w' \\ w\\\n by(fastforce simp add: vote_set_def obs_safe_def)\n qed\n\n \\ \\Action refinement.\\\n moreover have \n \"(map_option snd \\ process_mru (obsv_state.obs sa)) ++ const_map v Ob =\n map_option snd \\ process_mru ((obsv_state.obs sa)(v_state.next_round sa := const_map v Ob))\"\n proof-\n from \\sa \\ OV_inv2\\[THEN OV_inv2D] \n have empty: \"\\r'\\v_state.next_round sa. obsv_state.obs sa r' = Map.empty\"\n by simp\n show ?thesis\n by(auto simp add: map_add_def const_map_def restrict_map_def process_mru_new_votes[OF empty])\n qed\n\n ultimately show \"\\sa'. (sa, sa') \\ obsv_round r S v D Ob \\ (sa', sc') \\ olv_ref_rel\" \n using R step\n by(clarsimp simp add: obsv_round_def olv_round_def olv_ref_rel_def)\n\nqed\n\nlemma OLV_Refines:\n \"PO_refines (olv_ref_rel \\ (OV_inv2 \\ OV_inv3 \\ OV_inv4) \\ UNIV) obsv_TS olv_TS\"\nproof(rule refine_using_invariants)\n show \"init olv_TS \\ olv_ref_rel `` init obsv_TS\"\n by(auto simp add: obsv_TS_defs olv_TS_defs olv_ref_rel_def process_mru_def mru_of_set_def\n vote_set_def option_Max_by_def intro!: ext)\nnext\n show\n \"{olv_ref_rel \\ (OV_inv2 \\ OV_inv3 \\ OV_inv4) \\ UNIV} TS.trans obsv_TS, TS.trans olv_TS {> olv_ref_rel}\"\n by(auto simp add: PO_refines_def obsv_TS_defs olv_TS_defs \n intro!: olv_round_refines)\nqed (auto intro: OV_inv2_inductive OV_inv3_inductive OV_inv4_inductive\n OV_inv2_inductive(1)[THEN subsetD] OV_inv3_inductive(1)[THEN subsetD] \n OV_inv4_inductive(1)[THEN subsetD])\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Consensus_Refined/Observing_Quorums_Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.29940256556230654}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | Februaru 2006 |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_sf_rest\nimports FNF_F_sf_def\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split [split del]\n\n(*****************************************************************\n\n 1. full sequentialization for Depth-restriction (P |. n)\n 2.\n 3.\n\n *****************************************************************)\n\n(*============================================================*\n | |\n | Depth_rest |\n | |\n *============================================================*)\n\n(*============================================================*\n | Pfun P1 P2 |\n *============================================================*)\n\n(*** relation ***)\n\ninductive_set\n fsfF_Depth_rest_rel ::\n \"(('p,'a) proc * nat * ('p,'a) proc) set\"\n\nwhere\nfsfF_Depth_rest_rel_zero:\n \"(P1, 0, SDIV) : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_etc:\n \"P1 ~: fsfF_proc\n ==> (P1, Suc n, P1 |. (Suc n)) : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_int:\n \"[| ALL c. if (c: sumset C1)\n then (Rf1 c, Suc m, SRf c) : fsfF_Depth_rest_rel\n else SRf c = DIV ;\n sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n ((!! :C1 .. Rf1), Suc m, !! c:C1 .. SRf c)\n : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_step:\n \"[| ALL a. if a:A1\n then (Pf1 a, n, SPf a) : fsfF_Depth_rest_rel\n else SPf a = DIV ;\n ALL a:A1. Pf1 a : fsfF_proc ;\n Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==> \n ((? :A1 -> Pf1) [+] Q1, Suc n, (? :A1 -> SPf) [+] Q1) : fsfF_Depth_rest_rel\"\n\n(*** function ***)\n\ndefinition\n fsfF_Depth_rest ::\n \"('p,'a) proc => nat => ('p,'a) proc\" (\"(1_ /|.seq _)\" [84,900] 84)\n where\n fsfF_Depth_rest_def:\n \"P1 |.seq n == THE SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\n\n(****************************************************************\n | uniquness |\n ****************************************************************)\n\nlemma fsfF_Depth_rest_rel_unique_in_lm:\n \"(P1, n, SP1) : fsfF_Depth_rest_rel\n ==> (ALL SP2. ((P1, n, SP2) : fsfF_Depth_rest_rel\n --> SP1 = SP2))\"\napply (rule fsfF_Depth_rest_rel.induct[of P1 n SP1])\napply (simp)\n\n(* zero *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases)\napply (simp_all)\n\n(* etc *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases)\napply (simp_all)\napply (simp add: fsfF_proc_int)\napply (simp add: fsfF_proc_ext)\n\n(* step_int *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset C1a\")\n apply (simp)\n apply (simp)\n\n(* step *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : A1a\")\n apply (simp_all)\ndone\n\n(*-----------------------*\n | unique |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_unique:\n \"[| (P1, n, SP1) : fsfF_Depth_rest_rel;\n (P1, n, SP2) : fsfF_Depth_rest_rel |]\n ==> SP1 = SP2\"\nby (simp add: fsfF_Depth_rest_rel_unique_in_lm)\n\nlemma fsfF_Depth_rest_rel_EX1:\n \"(EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\n = (EX! SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (rule iffI)\n\n apply (erule exE)\n apply (rule_tac a=\"SP\" in ex1I)\n apply (simp)\n apply (simp add: fsfF_Depth_rest_rel_unique)\n\n apply (elim ex1_implies_exE)\n apply (simp)\ndone\n\n(*------------------------------------------------------------*\n | fsfF_Depth_rest_rel (iff) |\n *------------------------------------------------------------*)\n\n(* zero *)\n\nlemma fsfF_Depth_rest_rel_zero_iff:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel\n = (SP = SDIV)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\napply (simp add: fsfF_Depth_rest_rel_zero)\ndone\n\n(* etc *)\n\nlemma fsfF_Depth_rest_rel_etc_iff:\n \"P1 ~: fsfF_proc\n ==> (P1, Suc n, SP) : fsfF_Depth_rest_rel\n = (SP = P1 |. Suc n)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n apply (simp add: fsfF_proc_int)\n apply (simp add: fsfF_proc_ext)\napply (simp add: fsfF_Depth_rest_rel_etc)\ndone\n\n(* int nat *)\n\nlemma fsfF_Depth_rest_rel_int_iff:\n \"[| ALL c. if (c: sumset C1)\n then (Rf1 c, Suc m, SRf c) : fsfF_Depth_rest_rel\n else SRf c = DIV ;\n sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n ((!! :C1 .. Rf1), Suc m, SP) : fsfF_Depth_rest_rel\n = (SP = !! :C1 .. SRf)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset C1a\")\n apply (simp add: fsfF_Depth_rest_rel_unique)\n\n apply (simp)\napply (simp add: fsfF_Depth_rest_rel_int)\ndone\n\n(* step *)\n\nlemma fsfF_Depth_rest_rel_step_iff:\n \"[| ALL a. if a:A1\n then (Pf1 a, n, SPf a) : fsfF_Depth_rest_rel\n else SPf a = DIV ;\n ALL a:A1. Pf1 a : fsfF_proc ;\n Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==> \n ((? :A1 -> Pf1) [+] Q1, Suc n, SP) : fsfF_Depth_rest_rel\n = (SP = (? :A1 -> SPf) [+] Q1)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (simp add: fun_eq_iff)\n apply (intro allI conjI)\n apply (elim conjE)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : A1a\")\n apply (simp add: fsfF_Depth_rest_rel_unique)\n apply (simp)\napply (simp add: fsfF_Depth_rest_rel_step)\ndone\n\n(****************************************************************\n | existency |\n ****************************************************************)\n\n(*** exists ***)\n\nlemma fsfF_Depth_rest_rel_exists_zero:\n \"(EX SP. (P1, 0, SP) : fsfF_Depth_rest_rel)\"\napply (rule_tac x=\"SDIV\" in exI)\napply (simp add: fsfF_Depth_rest_rel.intros)\ndone\n\nlemma fsfF_Depth_rest_rel_exists_notin:\n \"P1 ~: fsfF_proc\n ==> (EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\napply (rule_tac x=\"P1 |. n\" in exI)\napply (simp add: fsfF_Depth_rest_rel.intros)\ndone\n\n(*** in fsfF_proc ***)\n\n(********* P1 and P2 *********)\n\nlemma fsfF_Depth_rest_rel_exists_in:\n \"P1 : fsfF_proc\n ==> ALL n. (EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int nat *)\napply (rule allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\n\napply (erule dist_BALL_conjE)\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"n\" in spec)\napply (elim exE)\napply (rule_tac x=\"!! c:C .. (if (c : sumset C) then f c else DIV)\" in exI)\napply (rule fsfF_Depth_rest_rel.intros)\napply (simp split: if_split)\napply (simp_all)\n\n(* ext *)\napply (rule allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\n\napply (elim exE)\napply (erule dist_BALL_conjE)\n\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"m\" in spec)\napply (elim exE)\napply (rule_tac x=\"? a:A -> (if (a : A) then (f a) else DIV) [+] Q\" in exI)\napply (rule fsfF_Depth_rest_rel.intros)\napply (simp split: if_split)\napply (simp_all)\ndone\n\n(*-----------------------*\n | exists |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_exists:\n \"EX SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\napply (case_tac \"P1 ~: fsfF_proc\")\napply (simp add: fsfF_Depth_rest_rel_exists_notin)\napply (simp add: fsfF_Depth_rest_rel_exists_in)\ndone\n\n(*-----------------------*\n | uniquely exists |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_unique_exists:\n \"EX! SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\napply (simp add: fsfF_Depth_rest_rel_EX1[THEN sym])\napply (simp add: fsfF_Depth_rest_rel_exists)\ndone\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Depth_rest_rel_zero_in:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel ==> SP : fsfF_proc\"\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\ndone\n\nlemma fsfF_Depth_rest_rel_in_lm:\n \"P1 : fsfF_proc ==> \n ALL n SP. (P1, n, SP) : fsfF_Depth_rest_rel --> SP : fsfF_proc\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int nat *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_zero_in)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fsfF_proc.intros)\napply (simp_all)\napply (rule ballI)\napply (drule_tac x=\"c\" in spec)\napply (drule_tac x=\"c\" in bspec, simp)\napply (force)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fsfF_Depth_rest_rel_zero_in)\n\napply (intro impI)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fsfF_proc.intros)\napply (simp_all)\napply (rule ballI)\napply (drule_tac x=\"a\" in spec)\napply (drule_tac x=\"a\" in bspec, simp)\napply (force)\ndone\n\n(*------------------------------------*\n | in |\n *------------------------------------*)\n\nlemma fsfF_Depth_rest_rel_in:\n \"[| P1 : fsfF_proc ; (P1, n, SP) : fsfF_Depth_rest_rel |]\n ==> SP : fsfF_proc\"\napply (insert fsfF_Depth_rest_rel_in_lm[of P1])\napply (blast)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\n(*** relation ***)\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_zero:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel\n ==> P1 |. 0 =F SP\"\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_Zero)\napply (rule cspF_SDIV_eqF)\ndone\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_notin:\n \"[| P1 ~: fsfF_proc ; (P1, n, SP) : fsfF_Depth_rest_rel |]\n ==> P1 |. n =F SP\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\napply (simp add: fsfF_Depth_rest_rel_etc_iff)\ndone\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_in:\n \"P1 : fsfF_proc ==>\n ALL n SP. (P1, n, SP) : fsfF_Depth_rest_rel\n --> P1 |. n =F SP\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\napply (elim conjE)\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (drule_tac x=\"c\" in bspec, simp)\napply (drule_tac x=\"c\" in spec)\napply (simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\n\napply (intro impI)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_decompo)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_step)\n apply (rule cspF_decompo)\n apply (simp)\n apply (simp)\n apply (case_tac \"Q = STOP\")\n apply (simp add: cspF_STOP_Depth_rest)\n apply (simp add: cspF_SKIP_or_DIV_Depth_rest)\ndone\n\n(*------------------------------------*\n | eqF |\n *------------------------------------*)\n\nlemma cspF_fsfF_Depth_rest_rel_eqF:\n \"(P1, n, SP) : fsfF_Depth_rest_rel ==> P1 |. n =F SP\"\napply (case_tac \"P1 ~: fsfF_proc\")\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_notin)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_in)\ndone\n\n(*************************************************************\n relation --> function\n *************************************************************)\n\nlemma fsfF_Depth_rest_in_rel:\n \"(P1, n, P1 |.seq n) : fsfF_Depth_rest_rel\"\napply (simp add: fsfF_Depth_rest_def)\napply (rule theI'\n [of \"(%R. (P1, n, R) : fsfF_Depth_rest_rel)\"])\napply (simp add: fsfF_Depth_rest_rel_unique_exists)\ndone\n\nlemma fsfF_Depth_rest_from_rel:\n \"((P1, n, SP) : fsfF_Depth_rest_rel)\n = (P1 |.seq n = SP)\"\napply (rule iffI)\napply (simp add: fsfF_Depth_rest_def)\napply (simp add: fsfF_Depth_rest_rel_unique_exists the1_equality)\n\napply (drule sym)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemma fsfF_Depth_rest_to_rel:\n \"(P1 |.seq n = SP)\n = ((P1, n, SP) : fsfF_Depth_rest_rel)\"\nby (simp add: fsfF_Depth_rest_from_rel)\n\n(*************************************************************\n function\n *************************************************************)\n\nlemma fsfF_Depth_rest_zero:\n \"P1 |.seq 0 = SDIV\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\ndone\n\nlemma fsfF_Depth_rest_etc:\n \"P1 ~: fsfF_proc\n ==> P1 |.seq (Suc n) = P1 |. (Suc n)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (simp add: fsfF_Depth_rest_rel_etc_iff)\ndone\n\nlemma fsfF_Depth_rest_int:\n \"[| sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n (!! :C1 .. Rf1) |.seq (Suc m) = \n !! c:C1 .. (if c: sumset C1 then (Rf1 c |.seq (Suc m)) else DIV)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (rule fsfF_Depth_rest_rel_int)\napply (simp_all)\napply (simp split: if_split)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemma fsfF_Depth_rest_step:\n \"[| ALL a:A1. Pf1 a : fsfF_proc ; Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==>\n ((? :A1 -> Pf1) [+] Q1) |.seq (Suc n) = \n ((? a:A1 -> (if (a:A1) then (Pf1 a |.seq n) else DIV)) [+] Q1)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (rule fsfF_Depth_rest_rel_step)\napply (simp_all)\napply (simp split: if_split)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemmas fsfF_Depth_rest =\n fsfF_Depth_rest_etc\n fsfF_Depth_rest_int\n fsfF_Depth_rest_step\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Depth_rest_in:\n \"P1 : fsfF_proc\n ==> P1 |.seq n : fsfF_proc\"\napply (rule fsfF_Depth_rest_rel_in[of P1 n])\napply (simp_all add: fsfF_Depth_rest_in_rel)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Depth_rest_eqF:\n \"P1 |. n =F P1 |.seq n\"\napply (rule cspF_fsfF_Depth_rest_rel_eqF)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_sf_rest.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.29940256556230654}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Memcpy\nimports\n \"../../../c-parser/CTranslation\"\n \"../../AutoCorres\"\nbegin\n\nabbreviation \"ADDR_MAX \\ UWORD_MAX TYPE(addr_bitsize)\"\n\n(* Helper for noticing when you accidentally haven't constrained an of_nat *)\nabbreviation \"of_nat_addr \\ of_nat::(nat \\ addr)\"\n\nlemma byte_ptr_guarded:\n \"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc)\n\n(* FIXME: MOVE *)\nlemma ptr_add_coerce: \"ptr_val (((ptr_coerce x)::('a::{c_type}) ptr) +\\<^sub>p a) = (ptr_val x) + (of_int a * of_nat (size_of TYPE('a)))\"\n apply (case_tac x)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n done\n\n(* FIXME: MOVE *)\n(* Casting a valid pointer to char* and incrementing it by a value less than\n * the size of the underlying type does not give us NULL.\n *)\nlemma ptr_contained:\"\\ c_guard (x::('a::c_type) ptr); size_of TYPE('a) = sz;\n 0 \\ i; i < int sz; (y::8 word ptr) = ptr_coerce x\\ \\ c_guard (y +\\<^sub>p i)\"\n apply (rule byte_ptr_guarded)\n unfolding c_guard_def c_null_guard_def ptr_add_def\n apply simp\n apply (clarsimp simp: CTypesDefs.ptr_add_def intvl_def)\n apply (erule allE [where x=\"nat i\"])\n apply (clarsimp simp: nat_less_iff of_nat_nat)\n done\n\ninstall_C_file \"memcpy.c\"\n\n(* FIXME: MOVE *)\nlemma squash_auxupd_id[polish]:\n \"modify (t_hrs_'_update (hrs_htd_update id)) = skip\"\n by (monad_eq simp: skip_def id_def hrs_htd_update_def)\n\nautocorres [no_heap_abs=memcpy memcpy_int] \"memcpy.c\"\n\n(* Dereference a pointer *)\nabbreviation \"deref s x \\ h_val (hrs_mem (t_hrs_' s)) x\"\n\n(* char* cast *)\nabbreviation \"byte_cast x \\ ((ptr_coerce x)::8 word ptr)\"\n\ncontext memcpy begin\n\nlemma memcpy_char:\n \"\\ \\s. c_guard (x::8 word ptr) \\\n c_guard (y::8 word ptr) \\\n unat sz = size_of TYPE(8 word) \\\n P (deref s x) \\\n x \\ y\\\n memcpy' (ptr_coerce y) (ptr_coerce x) sz\n \\\\ _ s. P (deref s y) \\!\"\n (* Evaluate sz *)\n apply clarsimp\n\n unfolding memcpy'_def\n apply (clarsimp simp:skip_def)\n apply wp\n\n (* Unroll the loop twice *)\n apply (subst whileLoop_unroll, wp)\n apply (subst whileLoop_unroll, wp)\n\n (* The remaining loop is never encountered *)\n apply (rule validNF_false_pre)\n apply wp+\n\n (* Finally we're left with the single assignment *)\n apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n apply unat_arith\n done\n\nlemma of_nat_prop_exp: \"n < 32 \\ of_nat (2 ^ n) = 2 ^ (of_nat n)\"\n by clarsimp\n\nlemma memcpy_word:\n \"\\ \\s. c_guard (x::32 word ptr) \\\n c_guard (y::32 word ptr) \\\n unat sz = size_of TYPE(32 word) \\\n P (deref s x) \\\n x \\ y \\\n memcpy' (ptr_coerce y) (ptr_coerce x) sz\n \\ \\_ s. P (deref s y) \\!\"\n apply clarsimp\n unfolding memcpy'_def apply (clarsimp simp:skip_def)\n apply (rule validNF_assume_pre)\n apply (subgoal_tac \"{ptr_val x ..+ unat sz} \\ {ptr_val y ..+ unat sz} = {}\")\n apply (subst whileLoop_add_inv [where\n I=\"\\i s. unat i \\ unat sz \\\n (\\a < i. deref s (byte_cast x +\\<^sub>p uint a) = deref s (byte_cast y +\\<^sub>p uint a)) \\\n P (deref s x)\" and\n M=\"\\(i, s). unat sz - unat i\"])\n apply (wp validNF_whileLoop_inv_measure_twosteps)\n apply clarsimp\n apply (rule conjI, unat_arith)\n apply (rule conjI, clarsimp)\n apply (case_tac \"a = i\")\n apply (clarsimp)\n apply (erule_tac x=i in allE)\n apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n apply (subst h_val_heap_same)\n apply (rule ptr_retyp_h_t_valid)\n apply simp\n apply (rule ptr_retyp_disjoint)\n apply (rule ptr_retyp_h_t_valid)\n apply simp\n apply (clarsimp simp:ptr_add_def intvl_def CTypesDefs.ptr_add_def)\n apply simp\n apply (clarsimp simp: CTypesDefs.ptr_add_def field_of_t_simple)\n apply (drule field_of_t_simple)\n apply clarsimp\n apply simp\n apply (subgoal_tac \"a < i\")\n apply (clarsimp simp:hrs_mem_update)\n apply (subst h_val_heap_update_disjoint)\n\n (* The current goal should be obvious to unat_arith, but for some reason isn't *)\n apply (clarsimp simp:ptr_add_def intvl_def disjoint_iff_not_equal)\n apply (erule_tac x=\"ptr_val x + a\" in allE, clarsimp)\n apply (erule impE)\n apply (rule_tac x=\"unat a\" in exI, clarsimp)\n apply unat_arith\n\n apply (erule_tac x=\"ptr_val y + i\" and\n P=\"\\ya. (\\k. ya = ptr_val y + of_nat k \\ k < 4) \\ ptr_val y + i \\ ya\" in allE, clarsimp)\n apply (erule_tac x=\"unat i\" in allE, clarsimp)\n apply unat_arith\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply (subst h_val_heap_update_disjoint)\n (* Similar goal to the previous irritation, but this time Isabelle decides to play ball *)\n apply (clarsimp simp:ptr_add_def intvl_def ptr_val_def disjoint_iff_not_equal)\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply unat_arith\n\n apply (rule conjI)\n apply (subst hrs_mem_update)+\n apply (subst h_val_heap_update_disjoint)\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply (clarsimp simp:CTypesDefs.ptr_add_def intvl_def)\n apply (erule_tac x=\"ptr_val x + of_nat k\" in allE)\n apply (erule impE)\n apply (rule_tac x=\"k\" in exI)\n apply simp\n apply (erule_tac x=\"ptr_val y + i\" and\n P=\"\\ya. (\\k. ya = ptr_val y + of_nat k \\ k < 4) \\ ptr_val x + of_nat k \\ ya\" in allE)\n apply (erule impE)\n apply (rule_tac x=\"unat i\" in exI)\n apply simp\n apply unat_arith\n apply simp\n apply simp\n\n (* Yet more tedium that unat_arith doesn't like *)\n apply (rule conjI)\n apply (rule byte_ptr_guarded,\n clarsimp simp:CTypesDefs.ptr_add_def c_guard_def c_null_guard_def intvl_def,\n (erule_tac x=\"unat i\" in allE)+,\n clarsimp,\n unat_arith)+\n\n apply wp\n apply unat_arith\n apply clarsimp\n apply (subgoal_tac \"deref sa x = deref sa y\")\n apply clarsimp\n apply (clarsimp simp: h_val_def)[1]\n apply (rule arg_cong[where f=from_bytes])\n apply (subst numeral_eqs(3))+\n apply simp\n apply (rule_tac x=0 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=1 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=2 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=3 in allE, assumption, erule impE, unat_arith)\n apply (simp add:CTypesDefs.ptr_add_def)\n apply (simp add: add.commute from_bytes_eq)\n apply clarsimp\n apply (clarsimp simp:intvl_def disjoint_iff_not_equal)\n apply (drule_tac x=x and y=y and j=\"of_nat k\" and i=\"of_nat ka\" and n=2 in neq_imp_bytes_disjoint)\n apply assumption\n apply (case_tac \"k = 0\", clarsimp) (* insert \"k > 0\" *)\n apply (clarsimp simp:unat_of_nat_len)\n apply (case_tac \"ka = 0\", clarsimp)\n apply (clarsimp simp:unat_of_nat_len)\n apply assumption\n apply clarsimp+\n done\n\ntext {* The bytes at the pointer @{term p} are @{term bs}. *}\ndefinition\n bytes_at :: \"'a globals_scheme \\ 'b::c_type ptr \\ word8 list \\ bool\"\nwhere\n \"bytes_at s p bs \\ length bs = 0 \\\n (length bs \\ ADDR_MAX \\ (\\i \\ {0..(length bs - 1)}. deref s (byte_cast p +\\<^sub>p (of_nat i)) = bs ! i))\"\n\nlemma bytes_at_none[simp]: \"bytes_at s p []\"\n by (clarsimp simp:bytes_at_def)\n\ntext {* The bytes of typed pointer @{term p} are @{term bs}. *}\ndefinition\n bytes_of :: \"'a globals_scheme \\ 'b::c_type ptr \\ word8 list \\ bool\"\nwhere\n \"bytes_of s p bs \\ length bs = size_of TYPE('b) \\ bytes_at s p bs\"\n\ntext {* The bytes at a char pointer are just it dereferenced. *}\nlemma bytes_of_char[simp]: \"bytes_of s (p::8word ptr) bs = (length bs = 1 \\ deref s p = hd bs)\"\n apply (clarsimp simp:bytes_of_def bytes_at_def)\n apply (rule iffI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp+\n apply (rule hd_conv_nth[symmetric])\n apply clarsimp+\n apply (subgoal_tac \"hd bs = bs ! 0\")\n apply simp\n apply (rule hd_conv_nth)\n apply clarsimp\n done\n\ntext {* A pointer does not wrap around memory. *}\ndefinition\n no_wrap :: \"'a::c_type ptr \\ nat \\ bool\"\nwhere\n \"no_wrap p sz \\ 0 \\ {ptr_val p ..+ sz}\"\n\ntext {* Two pointers do not overlap. *}\ndefinition\n no_overlap :: \"'a::c_type ptr \\ 'b::c_type ptr \\ nat \\ bool\"\nwhere\n \"no_overlap p q sz \\ {ptr_val p ..+ sz} \\ {ptr_val q ..+ sz} = {}\"\n\nlemma no_overlap_sym: \"no_overlap x y = no_overlap y x\"\n apply (rule ext)\n apply (clarsimp simp:no_overlap_def)\n by blast\n\n(* FIXME: MOVE *)\nlemma h_val_not_id:\n fixes x :: \"'a::mem_type ptr\"\n and y :: \"'b::mem_type ptr\"\n shows \"{ptr_val x..+size_of TYPE('a)} \\ {ptr_val y..+size_of TYPE('b)} = {}\n \\ h_val (hrs_mem (hrs_mem_update (heap_update x v) s)) y = h_val (hrs_mem s) y\"\n apply (subst hrs_mem_heap_update[symmetric])\n apply (subst h_val_heap_update_disjoint)\n apply blast\n apply clarsimp\n done\n\ndefinition\n update_bytes :: \"'a globals_scheme \\ 'b::mem_type ptr \\ word8 list \\ 'a globals_scheme\"\nwhere\n \"update_bytes s p bs \\ s\\t_hrs_' := hrs_mem_update (heap_update_list (ptr_val p) bs) (t_hrs_' s)\\\"\n\nlemma the_horse_says_neigh: \"(s\\t_hrs_' := x\\ = s\\t_hrs_' := y\\) = (x = y)\"\n by (metis (erased, lifting) globals.cases_scheme globals.select_convs(1) globals.update_convs(1))\n\nlemma upto_singleton[simp]:\"[x..x] = [x]\"\n by (simp add: upto_rec1)\n\nlemma update_bytes_ignore_ptr_coerce[simp]: \"update_bytes s (ptr_coerce p) = update_bytes s p\"\n by (clarsimp simp:update_bytes_def intro!:ext)\n\nlemma hrs_mem_update_commute:\n \"f \\ g = g \\ f \\ hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update g (hrs_mem_update f s)\"\n by (metis (no_types, lifting) comp_eq_elim hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma hrs_mem_update_collapse:\n \"hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update (f \\ g) s\"\n by (metis comp_eq_dest_lhs hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma update_bytes_reorder:\n \"{ptr_val p..+length cs} \\ {ptr_val q..+length bs} = {} \\\n update_bytes (update_bytes s q bs) p cs = update_bytes (update_bytes s p cs) q bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (subst hrs_mem_update_commute)\n apply (clarsimp intro!:ext)\n apply (subst heap_update_list_commute)\n apply clarsimp+\n done\n\nlemma lt_step_down: \"\\(x::nat) < y; x = y - 1 \\ P; x < y - 1 \\ P\\ \\ P\"\n by force\n\n(* XXX: This proof makes me sad. *)\nlemma under_uint_imp_no_overflow: \"x < ADDR_MAX \\ ((of_nat x)::addr) + 1 \\ 0\"\n apply (induct x)\n apply (clarsimp simp:UWORD_MAX_def)+\n apply unat_arith\n apply (clarsimp simp:UWORD_MAX_def)\n apply (cut_tac y=x and z=\"(of_nat (ADDR_MAX - 1))::addr\" in le_unat_uoi)\n apply (clarsimp simp:UWORD_MAX_def)+\n done\n\nlemma heap_update_list_append3:\n \"1 + length ys < 2 ^ word_bits \\\n heap_update_list s (y # ys) hp = heap_update_list s [y] (heap_update_list (s + 1) ys hp)\"\n apply clarsimp\n apply (subst heap_update_list_append2[where xs=\"[y]\", simplified])\n apply clarsimp+\n done\n\nlemma hrs_mem_update_cong': \"f = g \\ hrs_mem_update f s = hrs_mem_update g s\"\n by presburger\n\nlemma update_bytes_append: \"length bs \\ ADDR_MAX \\\n update_bytes s p (b # bs) = update_bytes (update_bytes s p [b]) (byte_cast p +\\<^sub>p 1) bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (subst hrs_mem_update_commute)\n apply (rule ext)+\n apply simp\n apply (case_tac \"xa = ptr_val p\")\n apply (clarsimp simp:fun_upd_def)\n apply (subst heap_update_nmem_same)\n apply (clarsimp simp:intvl_def ptr_add_def)\n apply (subgoal_tac \"k < ADDR_MAX\")\n prefer 2\n apply unat_arith\n apply (drule under_uint_imp_no_overflow)\n apply unat_arith\n apply clarsimp\n apply (subst heap_update_list_update)\n apply simp\n apply (clarsimp simp:fun_upd_def)\n apply (subst hrs_mem_update_collapse)\n apply (rule hrs_mem_update_cong')\n apply (clarsimp simp:ptr_add_def)\n apply (rule ext)\n apply (cut_tac xs=\"[b]\" and ys=bs and s=\"ptr_val p\" and hp=x in heap_update_list_append)\n apply (clarsimp simp:fun_upd_def intro!:ext)\n apply (rule conjI)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (subgoal_tac \"k < ADDR_MAX\")\n prefer 2\n apply unat_arith\n apply (drule under_uint_imp_no_overflow)\n apply unat_arith\n apply clarsimp\n apply clarsimp\n apply (case_tac \"xa \\ {ptr_val p + 1..+length bs}\")\n apply (subst heap_update_mem_same_point)\n apply simp\n apply (subgoal_tac \"addr_card = ADDR_MAX + 1\")\n apply clarsimp\n apply (clarsimp simp:addr_card UWORD_MAX_def)\n apply (subst heap_update_mem_same_point)\n apply simp\n apply (subgoal_tac \"addr_card = ADDR_MAX + 1\")\n apply clarsimp\n apply (clarsimp simp:addr_card UWORD_MAX_def)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply clarsimp+\n done\n\nlemma update_bytes_postpend: \"length bs = x + 1 \\\n update_bytes s p bs = update_bytes (update_bytes s p (take x bs)) (byte_cast p +\\<^sub>p (of_nat x)) [bs ! x]\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (clarsimp simp:ptr_add_def)\n apply (subst heap_update_list_concat_fold_hrs_mem)\n apply clarsimp+\n by (metis append_eq_conv_conj append_self_conv hd_drop_conv_nth2 lessI take_hd_drop)\n\nlemma h_val_not_id_general:\n fixes y :: \"'a::mem_type ptr\"\n shows \"\\i \\ {0..+size_of TYPE('a)}. \\g. f g (ptr_val y + i) = g (ptr_val y + i)\n \\ h_val (hrs_mem (hrs_mem_update f s)) y = h_val (hrs_mem s) y\"\n apply (subst hrs_mem_update)\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (f (hrs_mem s)) (size_of TYPE('a)) (ptr_val y) =\n heap_list (hrs_mem s) (size_of TYPE('a)) (ptr_val y)\")\n apply clarsimp\n apply (cut_tac h=\"f (hrs_mem s)\" and p=\"ptr_val y\" and n=\"size_of TYPE('a)\"\n and h'=\"hrs_mem s\" in heap_list_h_eq2)\n apply (erule_tac x=\"x - ptr_val y\" in ballE)\n apply clarsimp\n apply (clarsimp simp:intvl_def)+\n done\n\nlemma h_val_not_id_list:\n fixes y :: \"'a::mem_type ptr\"\n shows \"{x..+length vs} \\ {ptr_val y..+size_of TYPE('a)} = {}\n \\ h_val (hrs_mem (hrs_mem_update (heap_update_list x vs) s)) y = h_val (hrs_mem s) y\"\n apply (subst h_val_not_id_general)\n apply clarsimp\n apply (metis (erased, hide_lams) disjoint_iff_not_equal heap_update_nmem_same intvlD intvlI\n monoid_add_class.add.left_neutral)\n apply clarsimp\n done\n\nlemma h_val_id_update_bytes:\n fixes q :: \"'a::mem_type ptr\"\n shows \"{ptr_val q..+size_of TYPE('a)} \\ {ptr_val p..+length bs} = {}\n \\ deref (update_bytes s p bs) q = deref s q\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst h_val_not_id_list)\n apply blast\n by simp\n\nlemma bytes_at_len: \"bytes_at s p bs \\ length bs \\ ADDR_MAX\"\n by (clarsimp simp:bytes_at_def, fastforce)\n\n(* Another sad proof. *)\nlemma le_uint_max_imp_id: \"x \\ ADDR_MAX \\ unat ((of_nat x)::addr) = x\"\n apply (induct x)\n apply (clarsimp simp: UWORD_MAX_def)+\n apply unat_arith\n apply clarsimp\n done\n\nlemma update_bytes_id: \"update_bytes s p [] = s\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst heap_update_list_base')\n by (simp add: hrs_mem_update_id3)\n\nlemma a_horse_by_any_other_name: \"t_hrs_'_update f s = s\\t_hrs_' := f (t_hrs_' s)\\\"\n by auto\n\nlemma heap_update_list_singleton: \"heap_update_list p [x] = heap_update (Ptr p) x\"\n apply (rule ext)\n by (metis heap_update_def ptr_val.simps to_bytes_word8)\n\nlemma update_bytes_eq: \"\\s = s'; p = p'; bs = bs'\\ \\ update_bytes s p bs = update_bytes s' p' bs'\"\n by clarsimp\n\ntext {*\n Memcpy does what it says on the box.\n*}\nlemma memcpy_wp':\n fixes src :: \"'a::mem_type ptr\"\n and dst :: \"'b::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ c_guard src \\ c_guard dst \\ sz = of_nat (length bs) \\ bytes_at s src bs \\\n no_wrap src (unat sz) \\ no_wrap dst (unat sz) \\ no_overlap src dst (unat sz)\\\n memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n \\\\r s. r = ptr_coerce dst \\ bytes_at s dst bs \\ s = update_bytes s0 dst bs\\!\"\n apply (rule allI)+\n apply (rule validNF_assume_pre)\n unfolding memcpy'_def\n apply clarsimp\n apply (subst whileLoop_add_inv[where\n I=\"\\i s. unat i \\ unat sz \\\n bytes_at s dst (take (unat i) bs) \\\n bytes_at s src bs \\\n s = update_bytes s0 dst (take (unat i) bs)\" and\n M=\"\\(i, s). unat sz - unat i\"])\n apply wp\n apply clarsimp\n apply (rule conjI)\n apply unat_arith\n apply (rule conjI)\n apply (simp add:bytes_at_def)\n apply (case_tac \"bs = []\")\n apply (rule disjI1)\n apply clarsimp\n apply (rule disjI2)\n apply clarsimp\n apply (rule conjI)\n apply unat_arith\n apply clarsimp\n apply (case_tac \"unat i = ia\")\n apply clarsimp\n apply (subgoal_tac \"int (unat i) = uint i\")\n prefer 2\n apply (subst uint_nat)\n apply simp\n apply simp\n apply (subst h_val_id)\n apply (subst h_val_id_update_bytes)\n apply (clarsimp simp:no_overlap_def ptr_add_def)\n apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\ {ptr_val src..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply unat_arith\n apply (subgoal_tac \"{ptr_val dst..+unat i} \\ {ptr_val dst..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule exI, rule conjI, rule refl)\n apply (simp add: unat_of_nat)\n apply blast\n apply (erule_tac x=\"unat i\" and P=\"\\x. deref s0 (byte_cast src +\\<^sub>p int x) = bs ! x\" in ballE)\n apply clarsimp\n apply (subst nth_take)\n apply unat_arith\n apply simp\n apply (erule disjE)\n apply clarsimp+\n apply (erule disjE)\n apply (subgoal_tac \"length bs \\ 0\")\n prefer 2\n apply clarsimp\n apply (case_tac \"unat i = 0\")\n apply unat_arith\n apply linarith\n apply (subst h_val_not_id)\n apply (clarsimp simp:ptr_add_def intvl_def)\n (* Isabelle, why do you have to make it so hard? *)\n apply (erule_tac P=\"unat (of_nat ia) = ia\" in notE)\n apply (cut_tac y=ia and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (subgoal_tac \"unat ((of_nat ADDR_MAX)::addr) = ADDR_MAX\")\n prefer 2\n apply (simp add: unat_of_nat)\n apply (simp add: unat_of_nat)\n apply clarsimp\n apply clarsimp\n apply (erule_tac x=ia and A=\"{0..min (length bs) (unat i) - Suc 0}\" in ballE)\n apply clarsimp\n apply (subst nth_take, unat_arith)+\n apply simp\n apply clarsimp\n apply unat_arith\n apply (rule conjI)\n apply (clarsimp simp:bytes_at_def)\n apply (subst h_val_not_id)\n apply (clarsimp simp:no_overlap_def)\n apply (subgoal_tac \"ptr_val (byte_cast dst +\\<^sub>p uint i) \\ {ptr_val dst..+unat (of_nat (length bs))}\")\n prefer 2\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply clarsimp\n apply unat_arith\n (* More or less symmetric subgoal *)\n apply (subgoal_tac \"ptr_val (byte_cast src +\\<^sub>p int ia) \\ {ptr_val src..+unat ((of_nat (length bs))::addr)}\")\n prefer 2\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (rule_tac x=ia in exI)\n apply clarsimp\n apply (subgoal_tac \"unat ((of_nat (length bs))::addr) = length bs\")\n apply clarsimp\n apply arith\n apply (cut_tac y=\"length bs\" and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (simp add: unat_of_nat)\n apply arith\n apply (clarsimp simp:intvl_def ptr_add_def)\n apply blast\n apply clarsimp\n apply (rule conjI)\n apply (subst h_val_id_update_bytes)\n apply (clarsimp simp:no_overlap_def ptr_add_def)\n apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\ {ptr_val src..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply unat_arith\n apply (subgoal_tac \"{ptr_val dst..+min (length bs) (unat i)} \\ {ptr_val dst..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=ka in exI)\n apply unat_arith\n apply blast\n apply (subgoal_tac \"deref s0 (byte_cast src +\\<^sub>p uint i) = bs ! (unat i)\")\n apply clarsimp\n apply (subgoal_tac \"update_bytes s0 dst (take (unat (i + 1)) bs) =\n update_bytes (update_bytes s0 dst (take (unat i) bs)) (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n apply clarsimp\n apply (subgoal_tac\n \"\\s'. t_hrs_'_update (hrs_mem_update (heap_update (byte_cast dst +\\<^sub>p uint i) (bs ! unat i))) s' =\n update_bytes s' (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n apply fast\n apply (clarsimp simp:update_bytes_def)\n apply (subst a_horse_by_any_other_name)\n apply (subst the_horse_says_neigh)\n apply (clarsimp simp:ptr_add_def)\n apply (subst heap_update_list_singleton)\n apply simp\n apply (cut_tac s=s0 and p=dst and bs=\"take (unat (i + 1)) bs\" and x=\"unat i\"\n in update_bytes_postpend)\n apply (subgoal_tac \"unat (i + 1) \\ length bs\")\n apply clarsimp\n apply unat_arith\n apply (subgoal_tac \"unat i < length bs\")\n apply unat_arith\n apply (rule unat_less_helper)\n apply simp\n apply clarsimp\n apply (rule update_bytes_eq)\n apply (subgoal_tac \"min (unat i) (unat (i + 1)) = unat i\")\n apply clarsimp\n apply clarsimp\n apply unat_arith\n apply (clarsimp simp:ptr_add_def)\n apply clarsimp\n apply (rule nth_take)\n apply unat_arith\n apply (clarsimp simp:bytes_at_def)\n apply (erule disjE)\n apply clarsimp\n apply clarsimp\n apply (erule_tac x=\"unat i\" in ballE)\n apply (subst (asm) uint_nat[symmetric])\n apply simp\n apply clarsimp\n apply (subgoal_tac \"unat i < length bs\")\n prefer 2\n apply (rule unat_less_helper)\n apply simp\n apply unat_arith\n apply (rule conjI)\n apply unat_arith\n apply (rule conjI)\n apply (rule byte_ptr_guarded)\n apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n apply (erule_tac x=\"unat i\" in allE)\n apply clarsimp\n apply (rule byte_ptr_guarded)\n apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n apply (erule_tac x=\"unat i\" and\n P=\"\\x. ptr_val dst + ((of_nat x)::addr) = 0 \\ \\ x < unat ((of_nat_addr (length bs))::addr)\"\n in allE)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (subgoal_tac \"unat i = length bs\")\n apply clarsimp\n apply (case_tac \"length bs = 0\")\n apply clarsimp\n apply (subgoal_tac \"length bs \\ ADDR_MAX\")\n prefer 2\n apply (clarsimp simp:bytes_at_def)\n (* XXX: We keep introducing this subgoal; we should do it once and for all up top. *)\n apply (subgoal_tac \"unat ((of_nat (length bs))::addr) = length bs\")\n prefer 2\n apply (cut_tac y=\"length bs\" and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (clarsimp simp:UWORD_MAX_def)\n apply clarsimp+\n apply unat_arith\n (* insert a bunch a tedium... *)\n apply (subgoal_tac \"unat i = length bs\")\n prefer 2\n apply (drule bytes_at_len)\n apply (subgoal_tac \"unat (of_nat_addr (length bs)) = length bs\")\n prefer 2\n apply (rule le_uint_max_imp_id)\n apply simp\n apply unat_arith\n apply clarsimp\n apply (simp add:update_bytes_id)\n done\n\nlemma validNF_make_schematic_post':\n \"(\\s0 x. \\ \\s. P s0 x s \\ f \\ \\rv s. Q s0 x rv s \\!) \\\n \\ \\s. \\s0 x. P s0 x s \\ (\\rv s'. Q s0 x rv s' \\ Q' rv s') \\ f \\ Q'\\!\"\n by (auto simp add: valid_def validNF_def no_fail_def split: prod.splits)\n\nlemmas memcpy_wp = memcpy_wp'[THEN validNF_make_schematic_post', simplified]\n\nlemma h_val_not_id_update_bytes:\n fixes q :: \"'a::mem_type ptr\"\n shows \"\\ptr_val p = ptr_val q; length bs = size_of TYPE('a)\\ \\\n deref (update_bytes s p bs) q = from_bytes bs\"\n apply (clarsimp simp:update_bytes_def h_val_def)\n apply (subst hrs_mem_update)\n apply (cut_tac p=\"ptr_val q\" and v=bs and h=\"hrs_mem (t_hrs_' s)\" in heap_list_update)\n apply clarsimp\n apply (metis less_imp_le max_size)\n by clarsimp\n\ntext {*\n Test that we can use memcpy in a compositional proof. The following proof can be done much more\n pleasantly, but we're just trying to check that the memcpy WP lemma is usable.\n TODO: This relies on disabling heap abstraction for the calling function as well. We should be\n able to phrase an exec_concrete WP lemma over memcpy that lets us prove properties about\n heap-abstracted callers. This will need AutoCorres support to connect is_valid_* with\n c_guard/no_overlap/no_wrap.\n*}\n\ndefinition\n memcpy_int_spec :: \"sword32 ptr \\ sword32 ptr \\ bool\"\nwhere\n \"memcpy_int_spec dst src \\\n \\x. \\\\s. deref s src = x \\\n {ptr_val src..+4} \\ {ptr_val dst..+4} = {} \\\n c_guard src \\ c_guard dst \\\n no_wrap src 4 \\ no_wrap dst 4\\\n memcpy_int' dst src\n \\\\_ s. deref s dst = x\\!\"\n\nlemma memcpy_int_wp'[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def\n apply (rule allI)\n unfolding memcpy_int'_def\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=\"[deref s (byte_cast src),\n deref s (byte_cast src +\\<^sub>p 1),\n deref s (byte_cast src +\\<^sub>p 2),\n deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n apply (clarsimp simp:bytes_at_def no_overlap_def UINT_MAX_def)\n apply (rule conjI)\n apply clarsimp\n apply (case_tac \"i = 0\", clarsimp)\n apply (case_tac \"i = 1\", clarsimp)\n apply (case_tac \"i = 2\", clarsimp)\n apply (case_tac \"i = 3\", clarsimp)\n apply clarsimp\n apply clarsimp\n apply (subst h_val_not_id_update_bytes)\n apply clarsimp+\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) =\n deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n prefer 2\n apply (clarsimp simp:h_val_def)\n apply (metis Suc_numeral from_bytes_eq heap_list_rec semiring_norm(2) semiring_norm(8))\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) =\n deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n prefer 2\n apply (clarsimp simp:h_val_def ptr_add_def)\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n apply clarsimp\n apply (simp add: add.commute from_bytes_eq)\n apply clarsimp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) =\n deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n prefer 2\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n apply (metis (no_types, hide_lams) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n done\n\ntext {* memcpying a typed variable is equivalent to assignment. *}\nlemma memcpy_type_wp':\n fixes dst :: \"'a::mem_type ptr\"\n and src :: \"'a::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ c_guard dst \\ c_guard src \\ sz = of_nat (size_of TYPE('a)) \\\n no_overlap dst src (unat sz) \\ no_wrap dst (unat sz) \\ no_wrap src (unat sz) \\\n bytes_of s src bs\\\n memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n \\\\r s. r = ptr_coerce dst \\ bytes_of s dst bs \\ s = update_bytes s0 dst bs\\!\"\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply clarsimp\n apply (subst no_overlap_sym)\n apply (clarsimp simp:bytes_of_def)\n done\n\nlemmas memcpy_type_wp = memcpy_type_wp'[THEN validNF_make_schematic_post', simplified]\n\ntext {* Confirm that we can also prove memcpy_int using the previous generic lemma. *}\nlemma memcpy_int_wp''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def memcpy_int'_def\n apply (rule allI)\n apply (wp memcpy_type_wp)\n (* Remainder mostly clagged from the original proof above. *)\n apply clarsimp\n apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n apply (rule_tac x=\"[deref s (byte_cast src),\n deref s (byte_cast src +\\<^sub>p 1),\n deref s (byte_cast src +\\<^sub>p 2),\n deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n apply (rule conjI)\n apply (clarsimp simp:bytes_of_def bytes_at_def UINT_MAX_def)\n apply (case_tac \"i = 0\", clarsimp)\n apply (case_tac \"i = 1\", clarsimp)\n apply (case_tac \"i = 2\", clarsimp)\n apply (case_tac \"i = 3\", clarsimp)\n apply clarsimp\n apply clarsimp\n apply (subst h_val_not_id_update_bytes, clarsimp+)\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) =\n deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n prefer 2\n apply (clarsimp simp:h_val_def from_bytes_eq)\n apply (subst heap_list_rec[symmetric])\n apply simp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) =\n deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n prefer 2\n apply (clarsimp simp:h_val_def ptr_add_def)\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n apply (clarsimp simp: from_bytes_eq)\n apply (metis add.commute)\n apply clarsimp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) =\n deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n prefer 2\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n apply (metis (no_types, hide_lams) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n done\n\nlemma bytes_of_imp_at[simp]: \"bytes_of s x bs \\ bytes_at s x bs\"\n by (clarsimp simp:bytes_of_def bytes_at_def)\n\nlemma bytes_at_imp_of:\n fixes x :: \"'a::mem_type ptr\"\n shows \"\\bytes_at s x bs; length bs = size_of TYPE('a)\\ \\ bytes_of s x bs\"\n by (clarsimp simp:bytes_of_def bytes_at_def)\n\ntext {*\n Memcpying from a source to a destination via an intermediary does what it should. This is close to\n the desirable property we want for CAmkES systems; i.e. that copying into your IPC buffer on one\n side and then out on the other gives you back what you put in. Note that the type of the\n intermediate pointer is irrelevant and we don't need to assume that the source and final\n destination do not overlap.\n*}\nlemma memcpy_seq:\n fixes x :: \"'a::mem_type ptr\"\n and y :: \"'b::mem_type ptr\"\n and z :: \"'a::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ sz = of_nat (size_of TYPE('a)) \\\n c_guard x \\ c_guard y \\ c_guard z \\\n no_wrap x (unat sz) \\ no_wrap y (unat sz) \\ no_wrap z (unat sz) \\\n no_overlap x y (unat sz) \\ no_overlap y z (unat sz) \\\n bytes_of s x bs\\\n do memcpy' (ptr_coerce y) (ptr_coerce x) sz;\n memcpy' (ptr_coerce z) (ptr_coerce y) sz\n od\n \\\\r s. r = ptr_coerce z \\ bytes_of s z bs\\!\"\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply clarsimp\n apply (rule conjI, clarsimp simp:bytes_of_def)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply (rule conjI, clarsimp simp:bytes_of_def)\n apply clarsimp\n apply (rule bytes_at_imp_of)\n apply (clarsimp simp:bytes_of_def)+\n done\n\nlemma update_ti_eq:\n fixes x :: \"'a::mem_type\"\n and y :: 'a\n shows \"\\length bs = size_of TYPE('a); bs = bs'\\\n \\ update_ti_t (typ_info_t TYPE('a)) bs x = update_ti_t (typ_info_t TYPE('a)) bs' y\"\n by (clarsimp simp:upd)\n\nlemma from_bytes_cong: \"x = y \\ from_bytes x = from_bytes y\"\n by simp\n\ndeclare from_bytes_eq [simp]\n\ntext {*\n If you dereference a pointer, the value you get is the same as the underlying bytes backing that\n memory.\n*}\nlemma val_eq_bytes:\n fixes x :: \"'a::mem_type ptr\"\n shows \"deref s x = from_bytes (map (\\off. deref s (byte_cast x +\\<^sub>p of_nat off)) [0.. f i = (map f [0.. deref (update_bytes s x bs) x = from_bytes bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst hrs_mem_update)\n apply (clarsimp simp:h_val_def)\n apply (subst heap_list_update)\n apply (metis less_imp_le max_size)\n apply clarsimp\n done\n\ntext {*\n The memcpy_int proof can now be completed more elegantly. Note that the body of this proof is more\n generic than the previous attempts and doesn't involve manually reasoning about each byte.\n*}\nlemma memcpy_int_wp'''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def memcpy_int'_def\n apply (rule allI)\n apply (wp memcpy_type_wp)\n apply clarsimp\n apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..n \\ ADDR_MAX; no_wrap x n\\\n \\ bytes_at s x (heap_list (hrs_mem (t_hrs_' s)) n (ptr_val x))\"\n apply (clarsimp simp:bytes_at_def ptr_add_def h_val_def)\n apply (subst heap_list_nth)\n apply unat_arith\n apply clarsimp\n done\n\ntext {*\n A collection of useful type-generic implications for moving from the abstract heap to the concrete\n heap.\n*}\ndefinition\n is_valid_imp_c_guard :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_c_guard is_valid \\ \\s p. is_valid (lift_global_heap s) p \\ c_guard p\"\ndefinition\n is_valid_imp_no_null :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_null is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ 0 \\ {ptr_val p..of_nat (size_of TYPE('b))}\"\ndefinition\n is_valid_imp_no_wrap :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_wrap is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ no_wrap p (size_of TYPE('b))\"\ndefinition\n is_valid_imp_no_overlap :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_overlap is_valid \\\n \\s p q. is_valid (lift_global_heap s) p \\ is_valid (lift_global_heap s) q \\ p \\ q\n \\ no_overlap p q (size_of TYPE('b))\"\ndefinition\n is_valid_imp_heap_ptr_valid :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_heap_ptr_valid is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ heap_ptr_valid (hrs_htd (t_hrs_' s)) p\"\n\ntext {* We can easily discharge these for a given type. *}\nlemma is_valid_w32_imp_c_guard[unfolded is_valid_imp_c_guard_def, simplified]:\n \"is_valid_imp_c_guard is_valid_w32\"\n unfolding is_valid_imp_c_guard_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (rule simple_lift_c_guard, force)\n done\n\nlemma is_valid_w32_imp_no_null[unfolded is_valid_imp_no_null_def, simplified]:\n \"is_valid_imp_no_null is_valid_w32\"\n unfolding is_valid_imp_no_null_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n by force\n\nlemma is_valid_w32_imp_no_wrap[unfolded is_valid_imp_no_wrap_def, simplified]:\n \"is_valid_imp_no_wrap is_valid_w32\"\n unfolding is_valid_imp_no_wrap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n done\n\nlemma is_valid_w32_imp_no_overlap[unfolded is_valid_imp_no_overlap_def, simplified]:\n \"is_valid_imp_no_overlap is_valid_w32\"\n unfolding is_valid_imp_no_overlap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)+\n apply clarsimp\n apply (drule simple_lift_heap_ptr_valid)+\n apply (clarsimp simp:no_overlap_def)\n apply (cut_tac p=p and q=q and d=\"hrs_htd (t_hrs_' s)\" in heap_ptr_valid_neq_disjoint)\n apply clarsimp+\n done\n\nlemma is_valid_w32_imp_heap_ptr_valid[unfolded is_valid_imp_heap_ptr_valid_def, simplified]:\n \"is_valid_imp_heap_ptr_valid is_valid_w32\"\n unfolding is_valid_imp_heap_ptr_valid_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n by (rule simple_lift_heap_ptr_valid, force)\n\ntext {*\n With that support in place, we can now prove a heap-abstracted call to memcpy of a type in a\n reasonably generic way. Note that we leverage the relationship between\n is_valid_*/lift_global_heap/simple_lift to transfer assumptions across the boundary between the\n abstract and concrete heaps.\n*}\nlemma\n fixes dst :: \"32word ptr\"\n and src :: \"32word ptr\"\n shows \"\\s0 x.\n \\\\s. s = s0 \\ is_valid_w32 s dst \\ is_valid_w32 s src \\ sz = of_nat (size_of TYPE(32word)) \\\n heap_w32 s src = x \\ dst \\ src\\\n exec_concrete lift_global_heap (memcpy' (ptr_coerce dst) (ptr_coerce src) sz)\n \\\\r s. r = ptr_coerce dst \\ heap_w32 s dst = x\\!\"\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply (clarsimp simp:is_valid_w32_imp_c_guard\n is_valid_w32_imp_no_wrap\n is_valid_w32_imp_no_overlap)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..s0 x.\n \\\\s. s = s0 \\ is_valid_my_structure_C s dst \\ is_valid_my_structure_C s src \\\n heap_my_structure_C s src = x \\ dst \\ src\\\n memcpy_struct' dst src\n \\\\r s. r = dst \\ heap_my_structure_C s dst = x\\!\"\n apply (rule allI)+\n unfolding memcpy_struct'_def\n apply (wp memcpy_wp)\n apply (clarsimp simp:is_valid_my_structure_imp_c_guard)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0.. rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__4) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583124210895, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.29936462281420934}} {"text": "theory Lifter_idem\n imports \"../Mergeable/Mergeable_Instances\" \"../Mergeable/Mergeable_Oalist\" \"../Mergeable/Mergeable_Roalist\" \"../Mergeable/Mono\"\nbegin\n\n(* When we lift syntaxes we reverse the function arrow *)\ntype_synonym ('a, 'b) syn_lifting = \"('b \\ 'a)\"\n\n(*\ndatatype ('syn, 'a, 'b) lifting =\n LMake (LUpd : \"('syn \\ 'a \\ 'b \\ 'b)\")\n (LOut : \"('syn \\ 'b \\ 'a)\")\n (LBase : \"('syn \\ 'b)\")\n*)\n\n(*\n\"mappable\" typeclass?\n*)\n\n(* need a generic way to talk about things over which LMap makes sense.\n\n*)\n\ndatatype ('syn, 'a, 'b, 'f) lifting =\n LMake (LUpd_Idem : \"('syn \\ 'a \\ 'b \\ 'b)\")\n (LPost : \"('syn \\ 'b \\ 'b)\")\n (LOut : \"('syn \\ 'b \\ 'a)\")\n (LBase : \"('syn \\ 'b)\")\n (LFD : \"'f \\ 'syn \\ 'a \\ 'a\")\n\ntype_synonym ('syn, 'a, 'b) lifting' =\n \"('syn, 'a, 'b, 'syn \\ 'a \\ 'a) lifting\"\n\ndefinition LUpd ::\n \"('syn, 'a, 'b, 'f) lifting \\ 'syn \\ 'a \\ 'b \\ 'b\" where\n\"LUpd l s a b =\n LPost l s (LUpd_Idem l s a b)\"\n\n\ndefinition LMap_Idem ::\n \"('x, 'a, 'b, 'f) lifting \\ 'f \\ ('x \\ 'b \\ 'b)\" where\n\"LMap_Idem l f s b =\n LUpd_Idem l s (LFD l f s (LOut l s b)) b\"\n\ndefinition LMap ::\n \"('x, 'a, 'b, 'f) lifting \\ 'f \\ ('x \\ 'b \\ 'b)\" where\n\"LMap l f s b =\n LUpd l s (LFD l f s (LOut l s b)) b\"\n\n\ndefinition LNew :: \"('syn, 'a, 'b, 'f) lifting \\ 'syn \\ 'a \\ 'b\" where\n\"LNew l s a = LUpd l s a (LBase l s)\"\n\n(* TODO: make sure this is a good idea. *)\ndeclare LNew_def [simp]\ndeclare LMap_def [simp]\ndeclare LMap_Idem_def [simp]\ndeclare LUpd_def [simp]\n\ntype_synonym ('syn, 'b) valid_set =\n\"'syn \\ 'b set\"\n\n(* liftings can have several kinds of validity properties, only some of\n which depend on others.\n*)\n\n(* TODO: for inference purposes we are probably going to\n * still have to use something like our current formulation. *)\n\nclass Okay =\n fixes ok_S :: \"('a) set\"\n\n\ninstantiation md_triv :: (_) Okay\nbegin\ndefinition triv_ok_S : \"(ok_S :: 'a md_triv set) = UNIV\"\ninstance proof\nqed\nend\n\ninstantiation md_prio :: (Okay) Okay\nbegin\ndefinition prio_ok_S : \"(ok_S :: 'a md_prio set) = ({x . \\ px vx . x = mdp vx px \\ px \\ ok_S})\"\ninstance proof qed\nend\n\ninstantiation option :: (Okay) Okay\nbegin\ndefinition option_ok_S : \"(ok_S :: 'a option set) = (Some ` ok_S)\"\ninstance proof qed\nend\n\ninstantiation prod :: (Okay, Okay) Okay\nbegin\ndefinition prod_ok_S : \"(ok_S :: ('a * 'b) set) = { x :: 'a * 'b . \\ a' b' . x = (a', b') \\ a' \\ ok_S \\ b' \\ ok_S}\"\ninstance proof qed\nend\n\ninstantiation oalist :: (linorder, Okay) Okay\nbegin\n\ndefinition oalist_ok_S :\n \"(ok_S :: ('a, 'b) oalist set) = { x :: ('a, 'b) oalist . oalist_all_val (\\ y . y \\ ok_S) x }\"\ninstance proof qed\nend\n\ninstantiation unit :: Okay\nbegin\ndefinition unit_ok_S :\n \"(ok_S :: unit set) = UNIV\"\ninstance proof qed\nend\n\nlocale lifting_valid_weak =\n fixes l :: \"('syn, 'a, 'b :: Pord_Weak, 'f) lifting\"\n fixes S :: \"('syn, 'b) valid_set\"\n assumes put_get : \"\\ s a b . LOut l s (LUpd_Idem l s a b) = a\"\n assumes post_nop : \"\\ s b . LOut l s (LPost l s b) = LOut l s b\"\n assumes put_S : \"\\ s a b . LUpd_Idem l s a b \\ S s\"\n assumes post_S : \"\\ s b . b \\ S s \\ LPost l s b \\ S s\"\n assumes post_geq : \"\\ s b . b <[ LPost l s b\"\n assumes get_put_weak : \"\\ s b . b \\ S s \\ b = LUpd_Idem l s (LOut l s b) b\"\n \n\nlocale lifting_putonly =\n fixes l :: \"('syn, 'a, 'b :: Pord_Weak, 'f) lifting\"\n fixes S :: \"('syn, 'b) valid_set\"\n assumes put_S : \"\\ s a b . LUpd l s a b \\ S s\"\n\n(* TODO reexamine this *)\nlocale lifting_presonly =\n fixes l :: \"('syn, 'a, 'b :: Pord_Weak, 'f) lifting\"\n fixes S :: \"('syn, 'b) valid_set\"\n assumes pres :\n \"\\ v V supr f s . \n v \\ V \\\n V \\ S s \\\n is_sup V supr \\ supr \\ S s \\ is_sup (LMap_Idem l f s ` V) (LMap_Idem l f s supr)\"\n assumes pres_post :\n \"\\ v V supr s .\n v \\ V \\\n V \\ S s \\\n is_sup V supr \\\n supr \\ S s \\\n is_sup (LPost l s ` V) (LPost l s supr)\"\n \n\n(* reduced version of lifting-valid, for use with\n * improper merges (when using merge_l as a tool for combining\n * semantics) *)\nlocale lifting_valid_presonly =\n lifting_putonly + lifting_presonly\n\nlocale lifting_valid = lifting_valid_weak +\n assumes put_put : \"\\ s a1 a2 b . LUpd_Idem l s a1 (LUpd_Idem l s a2 b) = LUpd_Idem l s a1 b\"\n\nlocale lifting_valid_weak_base = lifting_valid_weak +\n assumes base : \"\\ s . LBase l s = \\\"\n\nlocale lifting_valid_base = lifting_valid + lifting_valid_weak_base\n\nlocale lifting_valid_weak_ok = lifting_valid_weak +\n assumes ok_S_valid : \"\\ s . ok_S \\ S s\"\n assumes ok_S_put : \"\\ s a b . b \\ ok_S \\ LUpd_Idem l s a b \\ ok_S\"\n assumes ok_S_post : \"\\ s b . b \\ ok_S \\ LPost l s b \\ ok_S\"\n\nlocale lifting_valid_ok = lifting_valid + lifting_valid_weak_ok\n\nlocale lifting_valid_weak_base_ok = lifting_valid_weak_ok + lifting_valid_weak_base\n\nlocale lifting_valid_base_ok = lifting_valid_ok + lifting_valid_base\n\nlocale lifting_valid_weak_pres = lifting_valid_weak +\n lifting_presonly\n(*\nsublocale lifting_valid_weak_pres \\ lifting_valid_presonly\nproof\n show \"\\s a b. LUpd l s a b \\ S s\"\n using put_S by auto\nnext\n show \"\\v V supr f s.\n v \\ V \\\n V \\ S s \\\n is_sup V supr \\\n supr \\ S s \\\n is_sup (LMap l f s ` V)\n (LMap l f s supr)\"\n using pres \n by auto\nqed\n*)\n\nlocale lifting_valid_pres = lifting_valid + lifting_valid_weak_pres\n\nlocale lifting_valid_weak_base_pres = lifting_valid_weak_pres + lifting_valid_weak_base +\n assumes bot_bad : \"\\ s . \\ \\ S s\"\n\nlocale lifting_valid_base_pres = lifting_valid_pres + lifting_valid_weak_base_pres\n\nlocale lifting_valid_weak_ok_pres = lifting_valid_weak_pres + lifting_valid_weak_ok\n\nlocale lifting_valid_ok_pres = lifting_valid_pres + lifting_valid_ok\n\nlocale lifting_valid_weak_base_ok_pres =\n lifting_valid_weak_base_pres + lifting_valid_weak_base_ok\n\n(* generally we are assuming we won't be using ok and pres separately.\n * we could if we wanted to though. *)\nlocale lifting_valid_base_ok_pres =\n lifting_valid_base_pres + lifting_valid_base_ok\n\n(* orthogonality, used to define merge correctness *)\n(*\nthese were originally pord_weak, but this was\n(i think) insufficient to prove fst_l_ortho;\nthe strengthening to pord shouldn't be an issue though.\n*)\nlocale l_ortho' =\n fixes l1 :: \"('a, 'b1, 'c :: Pord, 'f1) lifting\"\n fixes S1 :: \"'a \\ 'c set\"\n fixes l2 :: \"('a, 'b2, 'c :: Pord, 'f2) lifting\"\n fixes S2 :: \"'a \\ 'c set\"\n\n(* need set membership constraints. *)\nlocale l_ortho =\n l_ortho' +\n\n assumes eq_base : \"\\ s . LBase l1 s = LBase l2 s\"\n assumes compat_idem : \"\\ s a1 a2 b1 b2 supr . \n is_sup {b1, b2} supr \\\n has_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2}\"\n\n assumes compat_post : \"\\ b1 b2 s supr . is_sup {b1, b2} supr \\ has_sup {LPost l1 s b1, LPost l2 s b2}\"\n\n assumes compat_idem_S : \"\\ s a1 a2 b1 b2 supr0 supr . \n is_sup {b1, b2} supr0 \\\n is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr \\\n supr \\ (S1 s \\ S2 s)\"\n\n assumes compat_post_S : \"\\ s b1 b2 supr0 supr .\n is_sup {b1, b2} supr0 \\\n supr0 \\ S1 s \\\n supr0 \\ S2 s \\\n is_sup {LPost l1 s b1, LPost l2 s b2} supr \\\n supr \\ (S1 s \\ S2 s)\"\n\n assumes compat_idem_get1 : \n \"\\ s a1 a2 b1 b2 supr0 supr .\n is_sup {b1, b2} supr0 \\\n is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr \\\n LOut l1 s supr = a1\"\n \n assumes compat_idem_get2 : \"\\ s a1 a2 b1 b2 supr0 supr . \n is_sup {b1, b2} supr0 \\\n is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr \\\n LOut l2 s supr = a2\"\n\n assumes compat_post_get1 : \"\\ s b1 b2 supr0 supr . \n is_sup {b1, b2} supr0 \\\n is_sup {LPost l1 s b1, LPost l2 s b2} supr \\\n LOut l1 s supr = LOut l1 s supr0\"\n \n assumes compat_post_get2 : \"\\ s b1 b2 supr0 supr . \n is_sup {b1, b2} supr0 \\\n is_sup {LPost l1 s b1, LPost l2 s b2} supr \\\n LOut l2 s supr = LOut l2 s supr0\"\n\n assumes put1_S2 : \"\\ s a b . b \\ S2 s \\ LUpd_Idem l1 s a b \\ S2 s\"\n assumes put2_S1 : \"\\ s a b . b \\ S1 s \\ LUpd_Idem l2 s a b \\ S1 s\"\n\n(* TODO: this feels weird*)\nlocale l_ortho_strong = l_ortho +\n assumes compat_put_put :\n \"\\ s x1 x2 y1 y2 b1 b2 supr0 supr1 supr2 supr3.\n is_sup {b1, b2} supr0 \\\n is_sup {LUpd_Idem l1 s y1 b1, LUpd_Idem l2 s y2 b2} supr1 \\\n is_sup {LUpd_Idem l1 s x1 supr1, LUpd_Idem l2 s x2 supr1} supr2 \\\n is_sup {LUpd_Idem l1 s x1 b1, LUpd_Idem l2 s x2 b2} supr3 \\\n supr2 = supr3\"\n\nlemma (in l_ortho) compat :\n fixes s a1 a2 b1 b2 supr\n assumes Supr : \"is_sup {b1, b2} supr\"\n shows \"has_sup {LUpd l1 s a1 b1, LUpd l2 s a2 b2}\"\nproof-\n\n obtain supr' where Supr' : \"is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr'\"\n using compat_idem[OF Supr]\n by(fastforce simp add: has_sup_def)\n\n show \"has_sup {LUpd l1 s a1 b1, LUpd l2 s a2 b2}\"\n using compat_post[OF Supr']\n unfolding LUpd_def\n by(auto)\nqed\n\nlemma (in l_ortho) compat_get1 :\n fixes s a1 a2 b1 b2 supr0 supr\n assumes Supr0 : \"is_sup {b1, b2} supr0\"\n assumes Supr : \"is_sup {LUpd l1 s a1 b1, LUpd l2 s a2 b2} supr\"\n shows \"LOut l1 s supr = a1\"\nproof-\n\n obtain supr' where Supr' : \"is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr'\"\n using compat_idem[OF Supr0]\n by(fastforce simp add: has_sup_def)\n\n have \"LOut l1 s supr' = a1\"\n using compat_idem_get1[OF Supr0 Supr']\n by auto\n\n then show \"LOut l1 s supr = a1\"\n using compat_post_get1[OF Supr'] Supr\n unfolding LUpd_def\n by(auto simp add: LUpd_def)\nqed\n\nlemma (in l_ortho) compat_get2 :\n fixes s a1 a2 b1 b2 supr0 supr\n assumes Supr0 : \"is_sup {b1, b2} supr0\"\n assumes Supr : \"is_sup {LUpd l1 s a1 b1, LUpd l2 s a2 b2} supr\"\n shows \"LOut l2 s supr = a2\"\nproof-\n\n obtain supr' where Supr' : \"is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr'\"\n using compat_idem[OF Supr0]\n by(fastforce simp add: has_sup_def)\n\n have \"LOut l2 s supr' = a2\"\n using compat_idem_get2[OF Supr0 Supr']\n by auto\n\n then show \"LOut l2 s supr = a2\"\n using compat_post_get2[OF Supr'] Supr\n unfolding LUpd_def\n by(auto simp add: LUpd_def)\nqed\n\nlemma (in l_ortho) compat_S :\n fixes s a1 a2 b1 b2 supr0 supr\n assumes Supr0 : \"is_sup {b1, b2} supr0\"\n assumes Supr : \"is_sup {LUpd l1 s a1 b1, LUpd l2 s a2 b2} supr\"\n shows \"supr \\ S1 s \\ S2 s\"\nproof-\n obtain supr' where Supr' : \"is_sup {LUpd_Idem l1 s a1 b1, LUpd_Idem l2 s a2 b2} supr'\"\n using compat_idem[OF Supr0]\n by(fastforce simp add: has_sup_def)\n\n have Supr'_in : \"supr' \\ S1 s\" \"supr' \\ S2 s\"\n using compat_idem_S[OF Supr0 Supr']\n by auto\n\n obtain supr'2 where Supr'2 : \"is_sup {LPost l1 s (LUpd_Idem l1 s a1 b1), LPost l2 s (LUpd_Idem l2 s a2 b2)} supr'2\"\n using compat_post[OF Supr']\n by(fastforce simp add: has_sup_def)\n\n have Supr'2_supr : \"supr'2 = supr\"\n using is_sup_unique[OF Supr[unfolded LUpd_def] Supr'2]\n by simp\n\n show \"supr \\ S1 s \\ S2 s\"\n using compat_post_S[OF Supr' Supr'_in(1) Supr'_in(2) Supr'2]\n unfolding Supr'2_supr\n by auto\nqed\n\nlocale l_ortho_base' =\n fixes l1 :: \"('a, 'b1, 'c :: Pord_Weakb, 'f1) lifting\"\n fixes l2 :: \"('a, 'b2, 'c, 'f2) lifting\"\n\nlocale l_ortho_base = l_ortho + l_ortho_base' +\n assumes compat_bases : \"\\ s . is_sup {LBase l1 s, LBase l2 s} \\\"\n\nlocale l_ortho_ok' =\n fixes l1 :: \"('a, 'b1, 'c :: {Pord_Weakb, Okay}, 'f1) lifting\"\n fixes l2 :: \"('a, 'b2, 'c, 'f2) lifting\"\n\nlocale l_ortho_ok = l_ortho + l_ortho_ok' +\n assumes compat_idem_ok :\n \"\\ s a1 a2 b supr . b \\ ok_S \\ \n is_sup {LUpd_Idem l1 s a1 b, LUpd_Idem l2 s a2 b} supr \\ supr \\ ok_S\"\n assumes compat_post_ok :\n \"\\ s b supr . b \\ ok_S \\\n is_sup {LPost l1 s b, LPost l2 s b} supr \\ supr \\ ok_S\"\n \n\n(* lift_map_s is LMap plus a syntax translation *)\ndefinition lift_map_s ::\n \"('b1 \\ 'a1) \\\n ('a1, 'a2, 'b2 :: Pord, 'f) lifting \\\n 'f \\\n ('b1 \\ 'b2 \\ 'b2)\" where\n\"lift_map_s l' l sem syn st =\n LMap l sem (l' syn) st\"\n\n\n(* commutativity of l_ortho *)\nsublocale l_ortho \\ comm :\n l_ortho l2 S2 l1 S1\nproof\n\n fix s\n show \"LBase l2 s = LBase l1 s\"\n using eq_base by auto\nnext\n\n fix s a1 a2 b1 b2 supr\n\n have Comm : \"{LUpd_Idem l2 s a1 b1, LUpd_Idem l1 s a2 b2} = \n {LUpd_Idem l1 s a2 b2, LUpd_Idem l2 s a1 b1}\"\n by auto\n\n have Comm' : \"{b1, b2} = {b2, b1}\"\n by auto\n\n assume \"is_sup {b1, b2} supr\"\n then have \"has_sup {b2, b1}\" unfolding Comm' by auto\n\n then show \"has_sup\n {LUpd_Idem l2 s a1 b1,\n LUpd_Idem l1 s a2 b2}\"\n using compat_idem[of b2 b1 s a2 a1]\n unfolding Comm\n by auto\n\nnext\n fix s\n fix b1 b2 :: 'c\n\n have Comm : \"{LPost l2 s b1, LPost l1 s b2} = {LPost l1 s b2, LPost l2 s b1}\"\n by auto\n\n have Comm' : \"{b1, b2} = {b2, b1}\"\n by auto\n\n assume Sup : \"has_sup {b1, b2}\"\n\n then show \"has_sup {LPost l2 s b1, LPost l1 s b2}\"\n using compat_post[OF Sup[unfolded Comm']] unfolding Comm \n by auto\nnext\n fix b s a1 a2\n fix b1 b2 supr :: 'c\n\n have Comm' : \"{b1, b2} = {b2, b1}\"\n by auto\n\n have Comm: \"{LUpd_Idem l2 s a1 b1, LUpd_Idem l1 s a2 b2} = {LUpd_Idem l1 s a2 b2, LUpd_Idem l2 s a1 b1}\"\n by auto\n\n assume Sup_b : \"has_sup {b1, b2}\"\n assume Sup : \"is_sup {LUpd_Idem l2 s a1 b1, LUpd_Idem l1 s a2 b2} supr\"\n\n then show \"supr \\ S2 s \\ S1 s\"\n using compat_S[OF Sup_b[unfolded Comm'] Sup[unfolded Comm]]\n by auto\n\nnext\n\n fix s a b\n\n show \"b \\ S1 s \\\n LUpd_Idem l2 s a b \\ S1 s\"\n using put2_S1[of b s a]\n by auto\nnext\n\n fix s a b\n\n show \"b \\ S2 s \\\n LUpd_Idem l1 s a b \\ S2 s\"\n using put1_S2[of b s a]\n by auto\nqed\n\nsublocale l_ortho_base \\ comm :\n l_ortho_base l2 S2 l1 S1\nproof\n fix s\n\n have Comm : \"{LBase l2 s, LBase l1 s} = {LBase l1 s, LBase l2 s}\"\n by auto\n\n show \"is_sup {LBase l2 s, LBase l1 s} \\\"\n using compat_bases unfolding Comm\n by auto\nqed\n\nsublocale l_ortho_ok \\ comm :\n l_ortho_ok l2 S2 l1 S1\nproof\n fix s a1 a2 b supr\n\n assume Sup : \"is_sup {LUpd l2 s a1 b, LUpd l1 s a2 b} supr\"\n\n assume Bok : \"b \\ ok_S\"\n\n have Comm : \"{LUpd l2 s a1 b, LUpd l1 s a2 b} = \n {LUpd l1 s a2 b, LUpd l2 s a1 b}\"\n by auto\n\n show \"supr \\ ok_S\"\n using compat_ok[OF Bok Sup[unfolded Comm]]\n by auto\nqed\n(*\nlemma (in l_ortho) compat'_comm :\n shows \"LUpd l1 s a1 (LUpd l2 s a2 b) = LUpd l2 s a2 (LUpd l1 s a1 b)\"\n using is_sup_unique[OF compat'1 compat'2]\n by auto\n*)\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Lifter/Attic/Lifter_idem_gen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.29908460270624015}} {"text": "theory EinChannel\n\nimports bundle.SB automaton.dAutomaton_causal\n\nbegin\ntext \\You need to set THIS directory as Session-Directory. NOT the root-directory of the repository\\\n\nlemma cempty_empty[simp]: \"cEmpty = {c3}\"\n apply(auto simp add: cEmpty_def)\n apply(insert ctype.elims,auto)\n by (metis channel.exhaust ctype.simps(1) ctype.simps(2) ctype.simps(4) ctype.simps(5) ctype.simps(6)\n empty_not_UNIV image_is_empty sup_eq_bot_iff)\n\ntypedef singleChan = \"{c1}\"\n by blast\n\n\n\nlemma \"Abs_singleChan c1 = undefined\"\n oops\ntext \\Macht nicht wirklich sinn, aber da wir nur den einen Channel haben...\n Normalerweise erstellt der Nutzer hier seine eigenen channels zuerst\\\ninstantiation singleChan::chan\nbegin\ndefinition \"Rep = Rep_singleChan\"\n \n instance\n apply(intro_classes)\n apply(auto simp add: Rep_singleChan_def)\n by (meson Rep_singleChan_inject injI)\n\nend\n\n\n\n\n\n\nsection\\Datatype Konstruktor\\\n\n(* FYI: the old approach from v2 to create the datatype is not really reusable, \n because: \n lift_definition elem_raw_i :: \"int \\ ndaExampleMessage sbElem\" is\n Thats an old \"single-channel\" setter...\n One has to replace the \"ndaExampleMessage\" with a \"chan\"... but which?\n There can only be ONE channel in the replacement! ! !\n But what if the channel-datatype of the component has 2 or more channels?\n*)\n\ntext \\Motivation: I HATE freemarker and other templates. \n And the workflow sucks. The generator people have no idea about isabelle, \n feature-request take FOREVER and then it might not work in every case\\\n\ntext\\Goal: Move the heavy-stuff from the Generator to Isabelle.\n Pretty much every proof should be done in Isabelle, the generator\n can still create datatypes, functions and so on\\\n\ntext\\Implementation: Is using Locales... \\\n\n\ntext \\\\'a\\ should be interpreted as a tuple. The goal of this local is to create a\n bijective mapping from \\'a\\ to \\'cs\\.\n The user can freely choose \\'a\\, hence he will not use the datatype \\M\\. \n for example \\'a = (nat \\ bool)\\ which maps to a bundle with one bool-channel and one nat-channel\\\nlocale sbeGen =\n fixes lConstructor::\"'a::countable \\ 'cs::{chan, finite} \\ M\"\n assumes c_well: \"\\a. \\chIsEmpty TYPE ('cs) \\ sbElem_well (Some (lConstructor a))\"\n and c_inj: \"\\chIsEmpty TYPE ('cs) \\ inj lConstructor\" \n and c_surj: \"\\sbe. \\chIsEmpty TYPE ('cs) \\ sbElem_well (Some sbe) \\ sbe\\range lConstructor\" (* Schöner? *)\n and c_empty: \"\\a b::'a. chIsEmpty TYPE ('cs) \\ a=b\"\nbegin\n\nlift_definition setter::\"'a \\ 'cs\\<^sup>\\\" is \n \"if(chIsEmpty TYPE ('cs)) then (\\_. None) else Some o lConstructor\"\n using c_well sbtypeempty_sbewell by auto\n\ndefinition getter::\"'cs\\<^sup>\\ \\ 'a\" where\n\"getter sbe = (case (Rep_sbElem sbe) of None \\ (SOME x. True) | \n Some f \\ (inv lConstructor) f)\" (* geht was anderes als \"SOME x\"? *)\n\nlemma get_set[simp]: \"getter (setter a) = a\"\n unfolding getter_def\n by (simp add: setter.rep_eq c_inj c_empty)\n\nlemma set_inj: \"inj setter\"\n by (metis get_set injI)\n\nlemma set_surj: \"surj setter\"\n unfolding setter_def\n apply(cases \"\\(chIsEmpty(TYPE('cs)))\")\nproof(simp add: surj_def,auto)\n fix y::\"'cs\\<^sup>\\\"\n assume chnEmpty:\"\\ chIsEmpty TYPE('cs)\"\n obtain f where f_def:\"Rep_sbElem y=(Some f)\"\n using chnEmpty sbtypenotempty_fex by auto\n then obtain x where x_def:\"f = lConstructor x\"\n by (metis c_inj c_surj f_the_inv_into_f sbelemwell2fwell chnEmpty)\n then show \"\\x::'a. y = Abs_sbElem (Some (lConstructor x))\"\n by (metis Rep_sbElem_inverse f_def)\nqed \n\nlemma set_bij: \"bij setter\"\n by (metis bijI inj_onI sbeGen.get_set sbeGen_axioms set_surj)\n\nlemma get_inv_set: \"getter = (inv setter)\"\n by (metis get_set set_surj surj_imp_inv_eq)\n\nlemma set_get[simp]: \"setter (getter sbe) = sbe\"\n apply(simp add: get_inv_set)\n by (meson bij_inv_eq_iff set_bij)\n\nlemma \"getter A = getter B \\ A = B\"\n by (metis set_get)\n\nfixrec setterSB::\"'a stream \\ 'cs\\<^sup>\\\" where\n\"setterSB\\((up\\l)&&ls) = (setter (undiscr l)) \\\\<^sup>\\ (setterSB\\ls)\" \n\nlemma settersb_unfold:\"setterSB\\(\\a \\ s) = (setter a) \\\\<^sup>\\ setterSB\\s\"\n unfolding setterSB_def\n apply(subst fix_eq)\n apply simp \n apply(subgoal_tac \"\\l. \\a \\ s = (up\\l)&&s\")\n apply auto \n apply (metis (no_types, lifting) lshd_updis stream.sel_rews(4) undiscr_Discr up_inject)\n by (metis lscons_conv)\n\nlemma settersb_emptyfix:\"chIsEmpty (TYPE ('cs)) \\ setterSB\\s = \\\"\n by simp\n\nlemma settersb_epsbot:\"setterSB\\\\ = \\\"\n apply(simp add: setterSB_def)\n apply(subst fix_eq)\n by auto\n\n(* TODO : Dokumentireen! *)\ndefinition getterSB::\"'cs\\<^sup>\\ \\ 'a stream\" where\n\"getterSB \\ fix\\(\\ h. sb_case\\(\\sbe. \\ sb. updis (getter sbe) && h\\sb))\"\n\nlemma gettersb_unfold:\"getterSB\\(sbe \\\\<^sup>\\ sb) = \\(getter sbe) \\ getterSB\\sb\"\n unfolding getterSB_def\n apply(subst fix_eq)\n apply simp\n by (simp add: lscons_conv)\n\nlemma gettersb_emptyfix:\"chIsEmpty (TYPE ('cs)) \\ getterSB\\sb = \\(getter (Abs_sbElem None)) \\ getterSB\\sb\"\n by (metis(full_types) gettersb_unfold sbtypeepmpty_sbbot)\n\nlemma gettersb_realboteps:\"\\(chIsEmpty (TYPE ('cs))) \\ getterSB\\\\ = \\\"\n unfolding getterSB_def\n apply(subst fix_eq)\n by (simp add: sb_cases_bot)\n(* TODO: lemma über setterSB und getterSB *)\n\nlemma assumes \"chIsEmpty (TYPE ('cs))\"\n shows \"\\a. (getterSB\\sb) = (sinftimes(\\(a)))\"\n apply(insert assms,subst gettersb_emptyfix,simp) \n using gettersb_emptyfix s2sinftimes by auto\n \n (* TODO; warning entfernen. abbreviation-prioritäten für \\?*)\n\nlemma \"sbLen (setterSB\\s) = #s\"\n oops(* gilt nicht für chIsEmpty *)\n\nlemma \"a \\ getterSB\\(setterSB\\a)\"\n apply(induction a rule: ind)\n apply(auto)\n apply (simp add: gettersb_unfold settersb_unfold)\n by (simp add: monofun_cfun_arg)\n\nlemma getset_eq:\"\\chIsEmpty (TYPE ('cs)) \\ getterSB\\(setterSB\\a) = a\"\n apply(induction a rule: ind)\n apply(auto)\n apply (simp add: gettersb_realboteps settersb_epsbot)\n by (simp add: gettersb_unfold settersb_unfold)\n\nlemma \"setterSB\\(getterSB\\sb) \\ sb\"\n apply(induction sb)\n apply auto\n apply(cases \"chIsEmpty(TYPE('cs))\")\n apply (metis (full_types)minimal sbtypeepmpty_sbbot)\n apply(simp add: sbIsLeast_def)\n oops\n \n\nlemma setget_eq:\"(\\c. #(sb \\<^enum> c) = k) \\setterSB\\(getterSB\\sb) = sb\"\n apply(induction sb arbitrary: k)\n apply auto\n apply(rule adm_imp)\n apply auto \n apply(rule admI)\n defer\n apply(case_tac \"chIsEmpty (TYPE ('cs))\")\n apply (metis (full_types)sbtypeepmpty_sbbot)\n apply(simp add: sbIsLeast_def)\n apply(subgoal_tac \"k = 0\",auto)\n apply (metis gettersb_realboteps sb_eqI sbgetch_bot settersb_epsbot)\n defer\n apply(subst gettersb_unfold)\n apply(subst settersb_unfold,simp)\n apply(subgoal_tac \"\\c. #(sb \\<^enum> c) \\ #(sbe \\\\<^sup>\\ sb \\<^enum> c)\",auto)\n oops (* Nur für gleichlange ströme *)\nend\n\n\n\n\n\n\nlocale sscanlGen =\n fixes da::\"('state::countable, 'in::{chan, finite}, 'out::{chan,finite}, 'initOut::chan) dAutomaton_weak\"\n and fin::\"'a::countable \\ 'in \\ M\" \n and fout::\"'b::countable \\ 'out \\ M\"\n assumes sbegenfin:\"sbeGen fin\"\n and sbegenfout:\"sbeGen fout\"\nbegin\n\nabbreviation \"sscanlTransition \\ (\\ s a. \n let (nextState, nextOut) = dawTransition da s (sbeGen.setter fin a) in\n (nextState, sbeGen.getter fout nextOut)\n)\"\n\nlemma daut2sscanl:\"dawStateSem da state\\(input::'in\\<^sup>\\) = \n sbeGen.setterSB fout\\(sscanlAsnd sscanlTransition state\\(sbeGen.getterSB fin\\input))\"\n sorry\n\nlemma daut2sscnalinit:\"range(Rep::'out \\ channel) = range(Rep::'initOut\\ channel) \\ dawSem da\\input = \n sbeConvert(dawInitOut da) \\\\<^sup>\\ dawStateSem da state\\(input::'in\\<^sup>\\)\"\n sorry\n\n(* TODO: initiale ausgabe ... \"sscanlA\" kann nichts partielles ausgben.\n dh alles oder nichts. Das kann man durch den typ abfangen!\n * weak = \"chIstEmpty\" als assumption (oder besser, dafür eine klasse anlegen)\n * strong = gleicher typ wie ausgabe\n*)\n\nend\n\nlocale smapGen =\n fixes da::\"('state::countable, 'in::{chan, finite}, 'out::{chan,finite}, 'initOut::chan) dAutomaton_weak\"\n and fin::\"'a::countable \\ 'in \\ M\" \n and fout::\"'b::countable \\ 'out \\ M\"\n assumes scscanlgenf:\"sscanlGen fin fout\"\n and singlestate:\"is_singleton(UNIV::'state set)\"\nbegin\n\nabbreviation \"smapTransition \\ (\\a. \n let nextOut = snd(dawTransition da (dawInitState da) (sbeGen.setter fin a)) in\n sbeGen.getter fout nextOut)\"\n\nlemma daut2smap:\"dawStateSem da state\\(input::'in\\<^sup>\\) = \n sbeGen.setterSB fout\\(smap smapTransition\\(sbeGen.getterSB fin\\input))\"\n sorry\n\nend\n\nsublocale smapGen \\ sscanlGen\n by (simp add: scscanlgenf)\n\n\n\n\n\nlocale sumChanSB = (* TODO: anpassen wie oben, z.B. reihenfolge argumente *)\n fixes lConstructor::\" 'a::pcpo \\ 'cs::chan \\ M stream\"\n assumes c_type: \"\\a c. sValues (lConstructor a c) \\ ctype (Rep c)\"\n and c_inj: \"inj lConstructor\"\n and c_surj: \"\\f. sb_well f \\ f\\range lConstructor\" (* Schöner? *)\nbegin\n\nlift_definition setter::\"'a \\ ('cs::chan)\\<^sup>\\\"is\"lConstructor\"\n by (simp add: c_type sb_well_def)\n\ndefinition getter::\"'cs\\<^sup>\\ \\ 'a\" where\n\"getter= (inv lConstructor) o Rep_sb\"\n\nlemma get_set[simp]: \"getter (setter a) = a\"\n unfolding getter_def\n by (simp add: setter.rep_eq c_inj) \n\nlemma set_inj: \"inj setter\"\n by (metis get_set injI)\n\nlemma set_surj: \"surj setter\"\n unfolding setter_def\nproof(simp add: surj_def,auto)\n fix y::\"'cs\\<^sup>\\\"\n obtain f where f_def:\"Rep_sb y=f\"\n by simp\n then obtain x where x_def:\"f = lConstructor x\"\n by (metis c_inj c_surj f_the_inv_into_f sbwell2fwell)\n then show \"\\x::'a. y = Abs_sb (lConstructor x)\" \n by (metis Rep_sb_inverse f_def)\nqed\n\nlemma set_bij: \"bij setter\"\n using bij_betw_def set_inj set_surj by auto\n\nlemma get_inv_set: \"getter = (inv setter)\"\n by (metis get_set set_surj surj_imp_inv_eq)\n\nlemma set_get[simp]: \"setter (getter sbe) = sbe\"\n apply(simp add: get_inv_set)\n by (meson bij_inv_eq_iff set_bij)\n\nlemma \"getter A = getter B \\ A = B\"\n by (metis set_get)\n\nend\n\n\n\nsection \\Beispiel\\\n\ntypedef mymy = \"{c1, c2}\"\n by blast\n\ndefinition \"mymyC1 = Abs_mymy c1\"\ndefinition \"mymyC2 = Abs_mymy c2\"\n\n(* Fuck Yeah, pattern matching! *)\n(* TODO: is it possible to put everything in a \"bundle\"? \n eg. bundleName.c1 = mymyC1\n bundleName.setter = dudu.setter\"\n*)\nfree_constructors mymy for \"mymyC1\" | \"mymyC2\"\n apply auto\n unfolding mymyC1_def mymyC2_def\n apply (metis Rep_mymy Rep_mymy_inverse empty_iff insert_iff)\n by (meson channel.distinct(1) insertI1 insertI2 type_definition.Abs_inject type_definition_mymy)\n\nlemma mymy_rep_range [simp]:\"range Rep_mymy = {c1, c2}\"\n using type_definition.Rep_range type_definition_mymy by blast\n\ninstantiation mymy::chan\nbegin\ndefinition \"Rep = Rep_mymy\" (* TODO: abbreviation oÄ, ich will nicht immer \"Rep_mymy_def\" anwenden *) \n\ninstance\n apply(intro_classes)\n unfolding Rep_mymy_def apply simp\n by (meson Rep_mymy_inject injI)\nend\n\n\n\nlemma myc1_rep [simp]: \"Rep (mymyC1) = c1\"\n unfolding Rep_mymy_def mymyC1_def\n by (simp add: Abs_mymy_inverse)\n\nlemma myc2_rep [simp]: \"Rep (mymyC2) = c2\"\n unfolding Rep_mymy_def mymyC2_def\n by (simp add: Abs_mymy_inverse)\n\n(* :/ Schöner? *)\nfun orderChan::\"('nat::type \\ 'a::type) \\ ('bool::type \\ 'a) \\('nat\\'bool) \\ mymy \\ 'a\" where\n\"orderChan Cc1 Cc2 (port_c1, port_c2) mymyC1 = Cc1 port_c1\" |\n\"orderChan Cc1 Cc2 (port_c1, port_c2) mymyC2 = Cc2 port_c2\"\n\nabbreviation \"buildSBE \\ orderChan \\ \\\" \n\nlemma build_ctype: \"buildSBE a c \\ ctype (Rep c)\"\n by(cases c; cases a; simp)\n\nlemma build_inj: \"inj buildSBE\"\n apply(rule injI)\n apply(case_tac x; case_tac y; simp)\n by (metis M.inject orderChan.simps)\n\nlemma build_range: \"range (\\a. buildSBE a c) = ctype (Rep c)\"\n apply(cases c)\n by(auto simp add: image_iff)\n\nlemma build_surj: assumes \"sbElem_well (Some sbe)\"\n shows \"sbe \\ range buildSBE\"\nproof -\n have ctypewell:\"\\c. sbe c\\ ctype (Rep c)\"\n using assms by auto\n hence \"\\c. sbe c \\ range (\\a. buildSBE a c)\"\n by (simp add: build_range)\n hence \"\\prod. sbe = buildSBE prod\"\n apply(subst fun_eq_iff,auto) (*TODO: shorter proof*)\n proof -\n { fix mm :: \"nat \\ bool \\ mymy\"\n obtain bb :: bool where\n ff1: \"(\\ bb) = (\\x2. \\ x2 \\ sbe mymyC2)\"\n by moura\n then have ff2: bb\n by (metis ctype.simps(2) ctypewell myc2_rep rangeE)\n obtain bba :: bool where\n ff3: \"(\\ bba) = (\\x1. \\ x1 \\ sbe mymyC1)\"\n by moura\n then have bba\n by (metis ctype.simps(1) ctypewell myc1_rep rangeE)\n then have \"\\n b. sbe (mm n b) = buildSBE (n, b) (mm n b)\"\n using ff3 ff2 ff1 by (metis (full_types) mymy.exhaust orderChan.simps(1) orderChan.simps(2)) }\n then show \"\\n b. \\m. sbe m = buildSBE (n, b) m\"\n by metis\n qed\n thus ?thesis\n by auto\nqed\n\ninstance mymy::finite\n sorry\n\ninterpretation dudu: sbeGen \"buildSBE\" (*WTF Nitpick ? ? ?*)\n apply(unfold_locales)\n apply (simp add: build_ctype)\n apply (simp add: build_inj)\n using build_surj sorry\n\nterm \"dudu.setter\"\n\nterm \"curry dudu.setter\" (* If you prefer the \"old way\" *)\n\nlemma \"dudu.getter (dudu.setter (1,True)) = (1,True)\"\n by simp\n\n(*buildSB interpretation*)\n\nabbreviation \"buildSB \\ orderChan (Rep_cfun (smap \\)) (Rep_cfun (smap \\))\" \n\nlemma buildSB_ctype: \"sValues(buildSB a c) \\ ctype (Rep c)\"\n by(cases c; cases a; simp add: sValues_def)\n\nlemma buildSB_inj: \"inj buildSB\"\n apply(rule injI)\n apply(case_tac x; case_tac y; simp)\n apply(auto)\n sorry\n\nlemma buildSB_range: \"(\\a. sValues (buildSB a c)) = ctype (Rep c)\"\n apply(cases c)\n apply auto \n apply (metis (no_types, lifting) in_mono sValues_def smap_sdom_range)\n apply(rule_tac x=\"\\xa\" in exI) \n apply(simp add: sValues_def)\n apply (metis (mono_tags) ctype.simps(2) image_iff range_eqI sValues_def smap_sdom)\n apply(rule_tac x=\"\\xa\" in exI) \n by(simp add: sValues_def)\n\nlemma buildSB_surj: assumes \"sb_well f\"\n shows \"f \\ range buildSB\"\nproof -\n have ctypewell:\"\\c. sValues (f c) \\ ctype (Rep c)\"\n using assms sb_well_def by blast\n hence \"\\c. sValues(f c) \\ range (\\a. buildSBE a c)\"\n by (simp add: build_range)\n hence \"\\prod. f = buildSB prod\"\n apply(subst fun_eq_iff,auto,simp add: sValues_def) (*TODO: shorter proof*)\n sorry\n thus ?thesis\n by auto\nqed\n\n\ninterpretation duda: sumChanSB \"buildSB\"\n apply(unfold_locales)\n apply (simp add: buildSB_ctype)\n apply (simp add: buildSB_inj)\n by (simp add: buildSB_surj)\n\nterm \"duda.setter\"\nterm \"duda.getter\"\n\n\n\n\n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/EinChannel/EinChannel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2990846027062401}} {"text": "theory Pair_Automaton\n imports Tree_Automata_Complement GTT_Compose\nbegin\n\nsubsection \\Pair automaton and anchored GTTs\\\n\ndefinition pair_at_lang :: \"('q, 'f) gtt \\ ('q \\ 'q) fset \\ 'f gterm rel\" where\n \"pair_at_lang \\ Q = {(s, t) | s t p q. q |\\| gta_der (fst \\) s \\ p |\\| gta_der (snd \\) t \\ (q, p) |\\| Q}\"\n\nlemma pair_at_lang_restr_states:\n \"pair_at_lang \\ Q = pair_at_lang \\ (Q |\\| (\\ (fst \\) |\\| \\ (snd \\)))\"\n by (auto simp: pair_at_lang_def gta_der_def) (meson gterm_ta_der_states) \n\nlemma pair_at_langE:\n assumes \"(s, t) \\ pair_at_lang \\ Q\"\n obtains q p where \"(q, p) |\\| Q\" and \"q |\\| gta_der (fst \\) s\" and \"p |\\| gta_der (snd \\) t\"\n using assms by (auto simp: pair_at_lang_def)\n\nlemma pair_at_langI:\n assumes \"q |\\| gta_der (fst \\) s\" \"p |\\| gta_der (snd \\) t\" \"(q, p) |\\| Q\"\n shows \"(s, t) \\ pair_at_lang \\ Q\"\n using assms by (auto simp: pair_at_lang_def)\n\nlemma pair_at_lang_fun_states:\n assumes \"finj_on f (\\ (fst \\))\" and \"finj_on g (\\ (snd \\))\"\n and \"Q |\\| \\ (fst \\) |\\| \\ (snd \\)\"\n shows \"pair_at_lang \\ Q = pair_at_lang (map_prod (fmap_states_ta f) (fmap_states_ta g) \\) (map_prod f g |`| Q)\"\n (is \"?LS = ?RS\")\nproof\n {fix s t assume \"(s, t) \\ ?LS\"\n then have \"(s, t) \\ ?RS\" using ta_der_fmap_states_ta_mono[of f \"fst \\\" s]\n using ta_der_fmap_states_ta_mono[of g \"snd \\\" t]\n by (force simp: gta_der_def map_prod_def image_iff elim!: pair_at_langE split: prod.split intro!: pair_at_langI)}\n then show \"?LS \\ ?RS\" by auto\nnext\n {fix s t assume \"(s, t) \\ ?RS\"\n then obtain p q where rs: \"p |\\| ta_der (fst \\) (term_of_gterm s)\" \"f p |\\| ta_der (fmap_states_ta f (fst \\)) (term_of_gterm s)\" and\n ts: \"q |\\| ta_der (snd \\) (term_of_gterm t)\" \"g q |\\| ta_der (fmap_states_ta g (snd \\)) (term_of_gterm t)\" and\n st: \"(f p, g q) |\\| (map_prod f g |`| Q)\" using assms ta_der_fmap_states_inv[of f \"fst \\\" _ s]\n using ta_der_fmap_states_inv[of g \"snd \\\" _ t]\n by (auto simp: gta_der_def adapt_vars_term_of_gterm elim!: pair_at_langE)\n (metis (no_types, opaque_lifting) fimageE fmap_prod_fimageI ta_der_fmap_states_conv)\n then have \"p |\\| \\ (fst \\)\" \"q |\\| \\ (snd \\)\" by auto\n then have \"(p, q) |\\| Q\" using assms st unfolding fimage_iff fBex_def\n by (auto dest!: fsubsetD simp: finj_on_eq_iff)\n then have \"(s, t) \\ ?LS\" using st rs(1) ts(1) by (auto simp: gta_der_def intro!: pair_at_langI)}\n then show \"?RS \\ ?LS\" by auto\nqed\n\nlemma converse_pair_at_lang:\n \"(pair_at_lang \\ Q)\\ = pair_at_lang (prod.swap \\) (Q|\\|)\"\n by (auto simp: pair_at_lang_def)\n\nlemma pair_at_agtt:\n \"agtt_lang \\ = pair_at_lang \\ (fId_on (gtt_interface \\))\"\n by (auto simp: agtt_lang_def gtt_interface_def pair_at_lang_def gtt_states_def gta_der_def fId_on_iff)\n\ndefinition \\_eps_pair where\n \"\\_eps_pair \\\\<^sub>1 Q\\<^sub>1 \\\\<^sub>2 Q\\<^sub>2 \\ Q\\<^sub>1 |O| \\\\<^sub>\\ (snd \\\\<^sub>1) (fst \\\\<^sub>2) |O| Q\\<^sub>2\"\n\nlemma pair_comp_sound1:\n assumes \"(s, t) \\ pair_at_lang \\\\<^sub>1 Q\\<^sub>1\"\n and \"(t, u) \\ pair_at_lang \\\\<^sub>2 Q\\<^sub>2\"\n shows \"(s, u) \\ pair_at_lang (fst \\\\<^sub>1, snd \\\\<^sub>2) (\\_eps_pair \\\\<^sub>1 Q\\<^sub>1 \\\\<^sub>2 Q\\<^sub>2)\"\nproof -\n from pair_at_langE assms obtain p q q' r where\n wit: \"(p, q) |\\| Q\\<^sub>1\" \"p |\\| gta_der (fst \\\\<^sub>1) s\" \"q |\\| gta_der (snd \\\\<^sub>1) t\"\n \"(q', r) |\\| Q\\<^sub>2\" \"q' |\\| gta_der (fst \\\\<^sub>2) t\" \"r |\\| gta_der (snd \\\\<^sub>2) u\"\n by metis\n from wit(3, 5) have \"(q, q') |\\| \\\\<^sub>\\ (snd \\\\<^sub>1) (fst \\\\<^sub>2)\"\n by (auto simp: \\\\<^sub>\\_def' gta_der_def intro!: exI[of _ \"term_of_gterm t\"])\n then have \"(p, r) |\\| \\_eps_pair \\\\<^sub>1 Q\\<^sub>1 \\\\<^sub>2 Q\\<^sub>2\" using wit(1, 4)\n by (auto simp: \\_eps_pair_def)\n then show ?thesis using wit(2, 6) unfolding pair_at_lang_def\n by auto\nqed\n\nlemma pair_comp_sound2:\n assumes \"(s, u) \\ pair_at_lang (fst \\\\<^sub>1, snd \\\\<^sub>2) (\\_eps_pair \\\\<^sub>1 Q\\<^sub>1 \\\\<^sub>2 Q\\<^sub>2)\"\n shows \"\\ t. (s, t) \\ pair_at_lang \\\\<^sub>1 Q\\<^sub>1 \\ (t, u) \\ pair_at_lang \\\\<^sub>2 Q\\<^sub>2\"\n using assms unfolding pair_at_lang_def \\_eps_pair_def\n by (auto simp: \\\\<^sub>\\_def' gta_der_def) (metis gterm_of_term_inv)\n\nlemma pair_comp_sound:\n \"pair_at_lang \\\\<^sub>1 Q\\<^sub>1 O pair_at_lang \\\\<^sub>2 Q\\<^sub>2 = pair_at_lang (fst \\\\<^sub>1, snd \\\\<^sub>2) (\\_eps_pair \\\\<^sub>1 Q\\<^sub>1 \\\\<^sub>2 Q\\<^sub>2)\"\n by (auto simp: pair_comp_sound1 pair_comp_sound2 relcomp.simps)\n\ninductive_set \\_Atrans_set :: \"('q \\ 'q) fset \\ ('q, 'f) ta \\ ('q, 'f) ta \\ ('q \\ 'q) set\" for Q \\ \\ where\n base [simp]: \"(p, q) |\\| Q \\ (p, q) \\ \\_Atrans_set Q \\ \\\"\n| step [intro]: \"(p, q) \\ \\_Atrans_set Q \\ \\ \\ (q, r) |\\| \\\\<^sub>\\ \\ \\ \\\n (r, v) \\ \\_Atrans_set Q \\ \\ \\ (p, v) \\ \\_Atrans_set Q \\ \\\"\n\nlemma \\_Atrans_set_states:\n \"(p, q) \\ \\_Atrans_set Q \\ \\ \\ (p, q) \\ fset ((fst |`| Q |\\| \\ \\) |\\| (snd |`| Q |\\| \\ \\))\"\n by (induct rule: \\_Atrans_set.induct) (auto simp: fimage_iff fBex_def simp flip: fmember_iff_member_fset)\n\nlemma finite_\\_Atrans_set: \"finite (\\_Atrans_set Q \\ \\)\"\nproof -\n have \"\\_Atrans_set Q \\ \\ \\ fset ((fst |`| Q |\\| \\ \\) |\\| (snd |`| Q |\\| \\ \\))\"\n using \\_Atrans_set_states by auto\n from finite_subset[OF this] show ?thesis by simp\nqed\n\ncontext\nincludes fset.lifting\nbegin\nlift_definition \\_Atrans :: \"('q \\ 'q) fset \\ ('q, 'f) ta \\ ('q, 'f) ta \\ ('q \\ 'q) fset\" is \\_Atrans_set\n by (simp add: finite_\\_Atrans_set)\n\nlemmas \\_Atrans_base [simp] = \\_Atrans_set.base [Transfer.transferred]\nlemmas \\_Atrans_step [intro] = \\_Atrans_set.step [Transfer.transferred]\nlemmas \\_Atrans_cases = \\_Atrans_set.cases[Transfer.transferred]\nlemmas \\_Atrans_induct [consumes 1, case_names base step] = \\_Atrans_set.induct[Transfer.transferred]\nend\n\nabbreviation \"\\_Atrans_gtt \\ Q \\ \\_Atrans Q (fst \\) (snd \\)\"\n\nlemma pair_trancl_sound1:\n assumes \"(s, t) \\ (pair_at_lang \\ Q)\\<^sup>+\"\n shows \"\\ q p. p |\\| gta_der (fst \\) s \\ q |\\| gta_der (snd \\) t \\ (p, q) |\\| \\_Atrans_gtt \\ Q\"\n using assms\nproof (induct)\n case (step t v)\n obtain p q r r' where reach_t: \"r |\\| gta_der (fst \\) t\" \"q |\\| gta_der (snd \\) t\" and\n reach: \"p |\\| gta_der (fst \\) s\" \"r' |\\| gta_der (snd \\) v\" and\n st: \"(p, q) |\\| \\_Atrans_gtt \\ Q\" \"(r, r') |\\| Q\" using step(2, 3)\n by (auto simp: pair_at_lang_def)\n from reach_t have \"(q, r) |\\| \\\\<^sub>\\ (snd \\) (fst \\)\"\n by (auto simp: \\\\<^sub>\\_def' gta_der_def intro: ground_term_of_gterm)\n then have \"(p, r') |\\| \\_Atrans_gtt \\ Q\" using st by auto\n then show ?case using reach reach_t\n by (auto simp: pair_at_lang_def gta_der_def \\\\<^sub>\\_def' intro: ground_term_of_gterm)\nqed (auto simp: pair_at_lang_def intro: \\_Atrans_base)\n\nlemma pair_trancl_sound2:\n assumes \"(p, q) |\\| \\_Atrans_gtt \\ Q\"\n and \"p |\\| gta_der (fst \\) s\" \"q |\\| gta_der (snd \\) t\"\n shows \"(s, t) \\ (pair_at_lang \\ Q)\\<^sup>+\" using assms\nproof (induct arbitrary: s t rule:\\_Atrans_induct)\n case (step p q r v)\n from step(2)[OF step(6)] step(5)[OF _ step(7)] step(3)\n show ?case by (auto simp: gta_der_def \\\\<^sub>\\_def' intro!: ground_term_of_gterm)\n (metis gterm_of_term_inv trancl_trans)\nqed (auto simp: pair_at_lang_def)\n\nlemma pair_trancl_sound:\n \"(pair_at_lang \\ Q)\\<^sup>+ = pair_at_lang \\ (\\_Atrans_gtt \\ Q)\"\n by (auto simp: pair_trancl_sound2 dest: pair_trancl_sound1 elim: pair_at_langE intro: pair_at_langI)\n\nabbreviation \"fst_pair_cl \\ Q \\ TA (rules \\) (eps \\ |\\| (fId_on (\\ \\) |O| Q))\"\ndefinition pair_at_to_agtt :: \"('q, 'f) gtt \\ ('q \\ 'q) fset \\ ('q, 'f) gtt\" where\n \"pair_at_to_agtt \\ Q = (fst_pair_cl (fst \\) Q , TA (rules (snd \\)) (eps (snd \\)))\"\n\nlemma fst_pair_cl_eps:\n assumes \"(p, q) |\\| (eps (fst_pair_cl \\ Q))|\\<^sup>+|\"\n and \"\\ \\ |\\| snd |`| Q = {||}\"\n shows \"(p, q) |\\| (eps \\)|\\<^sup>+| \\ (\\ r. (p = r \\ (p, r) |\\| (eps \\)|\\<^sup>+|) \\ (r, q) |\\| Q)\" using assms\nproof (induct rule: ftrancl_induct)\n case (Step p q r)\n then have y: \"q |\\| \\ \\\" by (auto simp add: eps_trancl_statesD eps_statesD)\n have [simp]: \"(p, q) |\\| Q \\ q |\\| snd |`| Q\" for p q by (auto simp: fimage_iff) force \n then show ?case using Step y\n by auto (simp add: ftrancl_into_trancl)\nqed auto\n\nlemma fst_pair_cl_res_aux:\n assumes \"\\ \\ |\\| snd |`| Q = {||}\"\n and \"q |\\| ta_der (fst_pair_cl \\ Q) (term_of_gterm t)\"\n shows \"\\ p. p |\\| ta_der \\ (term_of_gterm t) \\ (q |\\| \\ \\ \\ (p, q) |\\| Q) \\ (q |\\| \\ \\ \\ p = q)\" using assms\nproof (induct t arbitrary: q)\n case (GFun f ts)\n then obtain qs q' where rule: \"TA_rule f qs q' |\\| rules \\\" \"length qs = length ts\" and\n eps: \"q' = q \\ (q', q) |\\| (eps (fst_pair_cl \\ Q))|\\<^sup>+|\" and\n reach: \"\\ i < length ts. qs ! i |\\| ta_der (fst_pair_cl \\ Q) (term_of_gterm (ts ! i))\"\n by auto\n {fix i assume ass: \"i < length ts\" then have st: \"qs ! i |\\| \\ \\\" using rule\n by (auto simp: rule_statesD)\n then have \"qs ! i |\\| snd |`| Q\" using GFun(2) by auto\n then have \"qs ! i |\\| ta_der \\ (term_of_gterm (ts ! i))\" using reach st ass\n using fst_pair_cl_eps[OF _ GFun(2)] GFun(1)[OF nth_mem[OF ass] GFun(2), of \"qs ! i\"]\n by blast} note IH = this\n show ?case\n proof (cases \"q' = q\")\n case True\n then show ?thesis using rule reach IH\n by (auto dest: rule_statesD intro!: exI[of _ q'] exI[of _ qs])\n next\n case False note nt_eq = this\n then have eps: \"(q', q) |\\| (eps (fst_pair_cl \\ Q))|\\<^sup>+|\" using eps by simp\n from fst_pair_cl_eps[OF this assms(1)] show ?thesis\n using False rule IH\n proof (cases \"q |\\| \\ \\\")\n case True\n from fst_pair_cl_eps[OF eps assms(1)] obtain r where\n \"q' = r \\ (q', r) |\\| (eps \\)|\\<^sup>+|\" \"(r, q) |\\| Q\" using True\n by (auto simp: eps_trancl_statesD)\n then show ?thesis using nt_eq rule IH True\n by (auto simp: fimage_iff eps_trancl_statesD)\n next\n case False\n from fst_pair_cl_eps[OF eps assms(1)] False assms(1)\n have \"(q', q) |\\| (eps \\)|\\<^sup>+|\"\n by (auto simp: fimage_iff) (metis fempty_iff fimage_eqI finterI snd_conv)+\n then show ?thesis using IH rule\n by (intro exI[of _ q]) (auto simp: eps_trancl_statesD)\n qed\n qed\nqed\n\nlemma restr_distjoing:\n assumes \"Q |\\| \\ \\ |\\| \\ \\\"\n and \"\\ \\ |\\| \\ \\ = {||}\"\n shows \"\\ \\ |\\| snd |`| Q = {||}\"\n using assms by auto\n\nlemma pair_at_agtt_conv:\n assumes \"Q |\\| \\ (fst \\) |\\| \\ (snd \\)\" and \"\\ (fst \\) |\\| \\ (snd \\) = {||}\"\n shows \"pair_at_lang \\ Q = agtt_lang (pair_at_to_agtt \\ Q)\" (is \"?LS = ?RS\")\nproof\n let ?TA = \"fst_pair_cl (fst \\) Q\"\n {fix s t assume ls: \"(s, t) \\ ?LS\"\n then obtain q p where w: \"(q, p) |\\| Q\" \"q |\\| gta_der (fst \\) s\" \"p |\\| gta_der (snd \\) t\"\n by (auto elim: pair_at_langE)\n from w(2) have \"q |\\| gta_der ?TA s\" \"q |\\| \\ (fst \\)\"\n using ta_der_mono'[of \"fst \\\" ?TA \"term_of_gterm s\"]\n by (auto simp add: fin_mono ta_subset_def gta_der_def in_mono)\n then have \"(s, t) \\ ?RS\" using w(1, 3)\n by (auto simp: pair_at_to_agtt_def agtt_lang_def gta_der_def ta_der_eps intro!: exI[of _ p])\n (metis fId_onI frelcompI funionI2 ta.sel(2) ta_der_eps)}\n then show \"?LS \\ ?RS\" by auto\nnext\n {fix s t assume ls: \"(s, t) \\ ?RS\"\n then obtain q where w: \"q |\\| ta_der (fst_pair_cl (fst \\) Q) (term_of_gterm s)\"\n \"q |\\| ta_der (snd \\) (term_of_gterm t)\"\n by (auto simp: agtt_lang_def pair_at_to_agtt_def gta_der_def)\n from w(2) have \"q |\\| \\ (snd \\)\" \"q |\\| \\ (fst \\)\" using assms(2)\n by auto\n from fst_pair_cl_res_aux[OF restr_distjoing[OF assms] w(1)] this w(2)\n have \"(s, t) \\ ?LS\" by (auto simp: agtt_lang_def pair_at_to_agtt_def gta_der_def intro: pair_at_langI)}\n then show \"?RS \\ ?LS\" by auto\nqed\n\ndefinition pair_at_to_agtt' where\n \"pair_at_to_agtt' \\ Q = (let \\ = fmap_states_ta Inl (fst \\) in\n let \\ = fmap_states_ta Inr (snd \\) in\n let Q' = Q |\\| (\\ (fst \\) |\\| \\ (snd \\)) in\n pair_at_to_agtt (\\, \\) (map_prod Inl Inr |`| Q'))\"\n\nlemma pair_at_agtt_cost:\n \"pair_at_lang \\ Q = agtt_lang (pair_at_to_agtt' \\ Q)\"\nproof -\n let ?G = \"(fmap_states_ta CInl (fst \\), fmap_states_ta CInr (snd \\))\"\n let ?Q = \"(Q |\\| (\\ (fst \\) |\\| \\ (snd \\)))\"\n let ?Q' = \"map_prod CInl CInr |`| ?Q\"\n have *: \"pair_at_lang \\ Q = pair_at_lang \\ ?Q\"\n using pair_at_lang_restr_states by blast\n have \"pair_at_lang \\ ?Q = pair_at_lang (map_prod (fmap_states_ta CInl) (fmap_states_ta CInr) \\) (map_prod CInl CInr |`| ?Q)\"\n by (intro pair_at_lang_fun_states[where ?\\ = \\ and ?Q = ?Q and ?f = CInl and ?g = CInr])\n (auto simp: finj_CInl_CInr)\n then have **:\"pair_at_lang \\ ?Q = pair_at_lang ?G ?Q'\" by (simp add: map_prod_simp')\n have \"pair_at_lang ?G ?Q' = agtt_lang (pair_at_to_agtt ?G ?Q')\"\n by (intro pair_at_agtt_conv[where ?\\ = ?G]) auto\n then show ?thesis unfolding * ** pair_at_to_agtt'_def Let_def\n by simp\nqed\n\nlemma \\_Atrans_states_stable:\n assumes \"Q |\\| \\ (fst \\) |\\| \\ (snd \\)\"\n shows \"\\_Atrans_gtt \\ Q |\\| \\ (fst \\) |\\| \\ (snd \\)\"\nproof\n fix s assume ass: \"s |\\| \\_Atrans_gtt \\ Q\"\n then obtain t u where s: \"s = (t, u)\" by (cases s) blast\n show \"s |\\| \\ (fst \\) |\\| \\ (snd \\)\" using ass assms unfolding s\n by (induct rule: \\_Atrans_induct) auto\nqed\n\nlemma \\_Atrans_map_prod:\n assumes \"finj_on f (\\ (fst \\))\" and \"finj_on g (\\ (snd \\))\"\n and \"Q |\\| \\ (fst \\) |\\| \\ (snd \\)\"\n shows \"map_prod f g |`| (\\_Atrans_gtt \\ Q) = \\_Atrans_gtt (map_prod (fmap_states_ta f) (fmap_states_ta g) \\) (map_prod f g |`| Q)\"\n (is \"?LS = ?RS\")\nproof -\n {fix p q assume \"(p, q) |\\| \\_Atrans_gtt \\ Q\"\n then have \"(f p, g q) |\\| ?RS\" using assms\n proof (induct rule: \\_Atrans_induct)\n case (step p q r v)\n from step(3, 6, 7) have \"(g q, f r) |\\| \\\\<^sub>\\ (fmap_states_ta g (snd \\)) (fmap_states_ta f (fst \\))\"\n by (auto simp: \\\\<^sub>\\_def' intro!: ground_term_of_gterm)\n (metis ground_term_of_gterm ground_term_to_gtermD ta_der_to_fmap_states_der)\n then show ?case using step by auto\n qed (auto simp add: fmap_prod_fimageI)}\n moreover\n {fix p q assume \"(p, q) |\\| ?RS\"\n then have \"(p, q) |\\| ?LS\" using assms\n proof (induct rule: \\_Atrans_induct)\n case (step p q r v)\n let ?f = \"the_finv_into (\\ (fst \\)) f\" let ?g = \"the_finv_into (\\ (snd \\)) g\"\n have sub: \"\\\\<^sub>\\ (snd \\) (fst \\) |\\| \\ (snd \\) |\\| \\ (fst \\)\"\n using \\\\<^sub>\\_statesD(1, 2) by fastforce\n have s_e: \"(?f p, ?g q) |\\| \\_Atrans_gtt \\ Q\" \"(?f r, ?g v) |\\| \\_Atrans_gtt \\ Q\"\n using step assms(1, 2) fsubsetD[OF \\_Atrans_states_stable[OF assms(3)]]\n using finj_on_eq_iff[OF assms(1)] finj_on_eq_iff\n using the_finv_into_f_f[OF assms(1)] the_finv_into_f_f[OF assms(2)]\n by auto\n from step(3) have \"(?g q, ?f r) |\\| \\\\<^sub>\\ (snd \\) (fst \\)\"\n using step(6-) sub\n using ta_der_fmap_states_conv[OF assms(1)] ta_der_fmap_states_conv[OF assms(2)]\n using the_finv_into_f_f[OF assms(1)] the_finv_into_f_f[OF assms(2)]\n by (auto simp: \\\\<^sub>\\_fmember fimage_iff fBex_def)\n (metis ground_term_of_gterm ground_term_to_gtermD ta_der_fmap_states_inv)\n then have \"(q, r) |\\| map_prod g f |`| \\\\<^sub>\\ (snd \\) (fst \\)\" using step\n using the_finv_into_f_f[OF assms(1)] the_finv_into_f_f[OF assms(2)] sub\n by auto (smt \\\\<^sub>\\_statesD(1, 2) f_the_finv_into_f fmap_prod_fimageI fmap_states)\n then show ?case using s_e assms(1, 2) s_e\n using fsubsetD[OF sub]\n using fsubsetD[OF \\_Atrans_states_stable[OF assms(3)]]\n using \\_Atrans_step[of \"?f p\" \"?g q\" Q \"fst \\\" \"snd \\\" \"?f r\" \"?g v\"]\n using the_finv_into_f_f[OF assms(1)] the_finv_into_f_f[OF assms(2)]\n by (auto simp: fimage_iff fBex_def)\n (smt Pair_inject prod_fun_fimageE step.hyps(2) step.hyps(5) step.prems(3))\n qed auto}\n ultimately show ?thesis by auto\nqed\n\n\\ \\Section: Pair Automaton is closed under Determinization\\\n\ndefinition Q_pow where\n \"Q_pow Q \\\\<^sub>1 \\\\<^sub>2 =\n {|(Wrapp X, Wrapp Y) | X Y p q. X |\\| fPow \\\\<^sub>1 \\ Y |\\| fPow \\\\<^sub>2 \\ p |\\| X \\ q |\\| Y \\ (p, q) |\\| Q|}\"\n\nlemma Q_pow_fmember:\n \"(X, Y) |\\| Q_pow Q \\\\<^sub>1 \\\\<^sub>2 \\ (\\ p q. ex X |\\| fPow \\\\<^sub>1 \\ ex Y |\\| fPow \\\\<^sub>2 \\ p |\\| ex X \\ q |\\| ex Y \\ (p, q) |\\| Q)\"\nproof -\n let ?S = \"{(Wrapp X, Wrapp Y) | X Y p q. X |\\| fPow \\\\<^sub>1 \\ Y |\\| fPow \\\\<^sub>2 \\ p |\\| X \\ q |\\| Y \\ (p, q) |\\| Q}\" \n have \"?S \\ map_prod Wrapp Wrapp ` fset (fPow \\\\<^sub>1 |\\| fPow \\\\<^sub>2)\" by (auto simp flip: fmember_iff_member_fset)\n from finite_subset[OF this] show ?thesis unfolding Q_pow_def\n apply auto apply blast\n by (meson FSet_Lex_Wrapper.exhaust_sel)\nqed\n\nlemma pair_automaton_det_lang_sound_complete:\n \"pair_at_lang \\ Q = pair_at_lang (map_both ps_ta \\) (Q_pow Q (\\ (fst \\)) (\\ (snd \\)))\" (is \"?LS = ?RS\")\nproof -\n {fix s t assume \"(s, t) \\ ?LS\"\n then obtain p q where\n res : \"p |\\| ta_der (fst \\) (term_of_gterm s)\"\n \"q |\\| ta_der (snd \\) (term_of_gterm t)\" \"(p, q) |\\| Q\"\n by (auto simp: pair_at_lang_def gta_der_def)\n from ps_rules_complete[OF this(1)] ps_rules_complete[OF this(2)] this(3)\n have \"(s, t) \\ ?RS\" using fPow_iff ps_ta_states'\n by (auto simp: pair_at_lang_def gta_der_def Q_pow_fmember)\n force}\n moreover\n {fix s t assume \"(s, t) \\ ?RS\" then have \"(s, t) \\ ?LS\"\n using ps_rules_sound\n by (auto simp: pair_at_lang_def gta_der_def ps_ta_def Let_def Q_pow_fmember) blast}\n ultimately show ?thesis by auto\nqed\n\nlemma pair_automaton_complement_sound_complete:\n assumes \"partially_completely_defined_on \\ \\\" and \"partially_completely_defined_on \\ \\\"\n and \"ta_det \\\" and \"ta_det \\\"\n shows \"pair_at_lang (\\, \\) (\\ \\ |\\| \\ \\ |-| Q) = gterms (fset \\) \\ gterms (fset \\) - pair_at_lang (\\, \\) Q\"\n using assms unfolding partially_completely_defined_on_def pair_at_lang_def\n apply (auto simp: gta_der_def)\n apply (metis ta_detE)\n apply fastforce\n done\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regular_Tree_Relations/Pair_Automaton.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.2990846027062401}} {"text": "theory flash21Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_InvVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_InvAck_1_HomeVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_2VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_GetXVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Local_PutXAcksDoneVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_NakVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Nak_HomeVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Remote_GetX_NakVsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv21: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ReplaceHomeVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceShrVldVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ShWbVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_WbVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_GetVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_PutVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_PutXVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_ReplaceVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Remote_GetVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_I )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreVsInv21: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreHomeVsInv21: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv21 iInv1 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash21Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2990784365944514}} {"text": "theory Nielson_VCGi\nimports Nielson_Hoare \"Vars\"\nbegin\n\nsubsection \"Optimized Verification Condition Generator\"\n\ntext\\Annotated commands: commands where loops are annotated with invariants.\\\n\ndatatype acom =\n Askip (\"SKIP\") |\n Aassign vname aexp (\"(_ ::= _)\" [1000, 61] 61) |\n Aseq acom acom (\"_;;/ _\" [60, 61] 60) |\n Aif bexp acom acom (\"(IF _/ THEN _/ ELSE _)\" [0, 0, 61] 61) |\n Aconseq \"assn2*(vname set)\" \"assn2*(vname set)\" \"tbd * (vname set)\" acom\n (\"({_'/_'/_}/ CONSEQ _)\" [0, 0, 0, 61] 61)|\n Awhile \"(assn2*(vname set))*((state\\state)*(tbd*((vname set*(vname \\ vname set)))))\" bexp acom (\"({_}/ WHILE _/ DO _)\" [0, 0, 61] 61)\n \nnotation com.SKIP (\"SKIP\")\n\ntext\\Strip annotations:\\\n\nfun strip :: \"acom \\ com\" where\n \"strip SKIP = SKIP\" |\n \"strip (x ::= a) = (x ::= a)\" |\n \"strip (C\\<^sub>1;; C\\<^sub>2) = (strip C\\<^sub>1;; strip C\\<^sub>2)\" |\n \"strip (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) = (IF b THEN strip C\\<^sub>1 ELSE strip C\\<^sub>2)\" |\n \"strip ({_/_/_} CONSEQ C) = strip C\" |\n \"strip ({_} WHILE b DO C) = (WHILE b DO strip C)\"\n \n \n \ntext \"support of an expression\"\n\ndefinition supportE :: \"((char list \\ nat) \\ (char list \\ int) \\ nat) \\ string set\" where\n \"supportE P = {x. \\l1 l2 s. (\\y. y \\ x \\ l1 y = l2 y) \\ P l1 s \\ P l2 s}\"\n \n \nlemma expr_lupd: \"x \\ supportE Q \\ Q (l(x:=n)) = Q l\"\n by(simp add: supportE_def fun_upd_other fun_eq_iff)\n (metis (no_types, lifting) fun_upd_def)\n\n \nfun varacom :: \"acom \\ lvname set\" where\n \"varacom (C\\<^sub>1;; C\\<^sub>2)= varacom C\\<^sub>1 \\ varacom C\\<^sub>2\"\n| \"varacom (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2)= varacom C\\<^sub>1 \\ varacom C\\<^sub>2\"\n| \"varacom ({(P,_)/(Qannot,_)/_} CONSEQ C)= support P \\ varacom C \\ support Qannot\"\n| \"varacom ({((I,_),(S,(E,Es)))} WHILE b DO C) = support I \\ varacom C \"\n| \"varacom _ = {}\"\n \n \nfun varnewacom :: \"acom \\ lvname set\" where\n \"varnewacom (C\\<^sub>1;; C\\<^sub>2)= varnewacom C\\<^sub>1 \\ varnewacom C\\<^sub>2\"\n| \"varnewacom (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2)= varnewacom C\\<^sub>1 \\ varnewacom C\\<^sub>2\"\n| \"varnewacom ({_/_/_} CONSEQ C)= varnewacom C\"\n| \"varnewacom ({(I,(S,(E,Es)))} WHILE b DO C) = varnewacom C\"\n| \"varnewacom _ = {}\"\n \nlemma finite_varnewacom: \"finite (varnewacom C)\"\n by (induct C) (auto)\n\n\n\nfun wf :: \"acom \\ lvname set \\ bool\" where\n \"wf SKIP _ = True\" |\n \"wf (x ::= a) _ = True\" |\n \"wf (C\\<^sub>1;; C\\<^sub>2) S = (wf C\\<^sub>1 (S \\ varnewacom C\\<^sub>2) \\ wf C\\<^sub>2 S)\" |\n \"wf (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) S = (wf C\\<^sub>1 S \\ wf C\\<^sub>2 S)\" |\n \"wf ({_/(Qannot,_)/_} CONSEQ C) S = (finite (support Qannot) \\ wf C S)\" |\n \"wf ({(_,(_,(_,Es)))} WHILE b DO C) S = ( wf C S)\"\n \ntext\\Weakest precondition from annotated commands:\\\n\nfun preT :: \"acom \\ tbd \\ tbd\" where\n \"preT SKIP e = e\" |\n \"preT (x ::= a) e = (\\s. e(s(x := aval a s)))\" |\n \"preT (C\\<^sub>1;; C\\<^sub>2) e = preT C\\<^sub>1 (preT C\\<^sub>2 e)\" |\n \"preT ({_/_/_} CONSEQ C) e = preT C e\" |\n \"preT (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) e =\n (\\s. if bval b s then preT C\\<^sub>1 e s else preT C\\<^sub>2 e s)\" |\n \"preT ({(_,(S,_))} WHILE b DO C) e = e o S\"\n \n\nlemma preT_constant: \"preT C (%_. a) = (%_. a)\"\n by(induct C, auto)\n\nlemma preT_linear: \"preT C (%s. k * e s) = (%s. k * preT C e s)\"\nby (induct C arbitrary: e, auto)\n \nfun postQ :: \"acom \\ state \\ state\" where (* seems to be forward?! *)\n \"postQ SKIP s = s\" |\n \"postQ (x ::= a) s = s(x := aval a s)\" |\n \"postQ (C\\<^sub>1;; C\\<^sub>2) s = postQ C\\<^sub>2 (postQ C\\<^sub>1 s)\" |\n \"postQ ({_/_/_} CONSEQ C) s = postQ C s\" |\n \"postQ (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) s =\n (if bval b s then postQ C\\<^sub>1 s else postQ C\\<^sub>2 s)\" |\n \"postQ ({(_,(S,_))} WHILE b DO C) s = S s\"\n \n \n \n(* function that, given a Command C and a set of variables \n gives the set of variables, that Es depends on,\n meaning a set S where\n if s1 = s2 on S \\ \\x:Es. postQ C s1 x = postQ C s2 x\n*)\nfun fune :: \"acom \\ vname set \\ vname set\" where\n \"fune SKIP LV = LV\" |\n \"fune (x ::= a) LV = LV \\ vars a\" |\n \"fune (C\\<^sub>1;; C\\<^sub>2) LV = fune C\\<^sub>1 (fune C\\<^sub>2 LV)\" |\n \"fune ({_/_/_} CONSEQ C) LV = fune C LV\" |\n \"fune (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) LV = vars b \\ fune C\\<^sub>1 LV \\ fune C\\<^sub>2 LV\" |\n \"fune ({(_,(S,(E,Es,SS)))} WHILE b DO C) LV = (\\x\\LV. SS x)\"\n \nlemma fune_mono: \"A \\ B \\ fune C A \\ fune C B\"\nproof(induct C arbitrary: A B) \n case (Awhile x1 x2 C)\n obtain a b c d e f where a: \"x1 = (a,b,c,d,e)\" using prod_cases5 by blast\n from Awhile show ?case unfolding a by(auto)\nqed (auto simp add: le_supI1 le_supI2)\n \n \nlemma TQ: \"preT C e s = e (postQ C s)\"\n apply(induct C arbitrary: e s) by (auto) \n\n\n \n \n(* given a state, how often will a While loop be evaluated ? *) \nfunction (domintros) times :: \"state \\ bexp \\ acom \\ nat\" where\n \"times s b C = (if bval b s then Suc (times (postQ C s) b C) else 0)\" \n apply(auto) done\n\nlemma assumes I: \"I z s\" and\n i: \"\\s z. I (Suc z) s \\ bval b s \\ I z (postQ C s)\"\n and ii: \"\\s. I 0 s \\ ~ bval b s\"\nshows times_z: \"times s b C = z\"\nproof - \n have \"I z s \\ times_dom (s, b, C) \\ times s b C = z\"\n proof(induct z arbitrary: s)\n case 0\n have A: \"times_dom (s, b, C)\"\n apply(rule times.domintros)\n apply(simp add: ii[OF 0] ) done\n have B: \"times s b C = 0\"\n using times.psimps[OF A] by(simp add: ii[OF 0])\n \n show ?case using A B by simp\n next\n case (Suc z)\n from i[OF Suc(2)] have bv: \"bval b s\"\n and g: \"I z (postQ C s)\" by simp_all\n from Suc(1)[OF g] have p1: \"times_dom (postQ C s, b, C)\"\n and p2: \"times (postQ C s) b C = z\" by simp_all\n have A: \"times_dom (s, b, C)\" \n apply(rule times.domintros) apply(rule p1) done\n have B: \"times s b C = Suc z\" \n using times.psimps[OF A] bv p2 by simp\n show ?case using A B by simp\n qed\n \n then show \"times s b C = z\" using I by simp\nqed\n\nfun postQz :: \"acom \\ state \\ nat \\ state\" where\n \"postQz C s 0 = s\" |\n \"postQz C s (Suc n) = (postQz C (postQ C s) n)\"\n \nfun preTz :: \"acom \\ tbd \\ nat \\ tbd\" where\n \"preTz C e 0 = e\" |\n \"preTz C e (Suc n) = preT C (preTz C e n)\"\n \n \n \nlemma TzQ: \"preTz C e n s = e (postQz C s n)\"\n by (induct n arbitrary: s, simp_all add: TQ)\n\n\n\ntext\\Weakest precondition from annotated commands:\\\n\n (* if the annotated command contains no loops,\n then the weakest precondition is just some mangled post condition\n in the other case, \n the weakest precondition is essentially the annotated invariant\n of the first while loop, mangled somewhat by the commands\n preceding the loop. *)\n\nfun pre :: \"acom \\ assn2 \\ assn2\" where\n \"pre SKIP Q = Q\" |\n \"pre (x ::= a) Q = (\\l s. Q l (s(x := aval a s)))\" |\n \"pre (C\\<^sub>1;; C\\<^sub>2) Q = pre C\\<^sub>1 (pre C\\<^sub>2 Q)\" |\n \"pre ({(P',Ps)/_/_} CONSEQ C) Q = P'\" |\n \"pre (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) Q =\n (\\l s. if bval b s then pre C\\<^sub>1 Q l s else pre C\\<^sub>2 Q l s)\" |\n \"pre ({((I,Is),(S,(E,Es,SS)))} WHILE b DO C) Q = I\" \n \n \nfun qdeps :: \"acom \\ vname set \\ vname set\" where\n \"qdeps SKIP LV = LV\" |\n \"qdeps (x ::= a) LV = LV \\ vars a\" | \n \"qdeps (C\\<^sub>1;; C\\<^sub>2) LV = qdeps C\\<^sub>1 (qdeps C\\<^sub>2 LV)\" |\n \"qdeps ({(P',Ps)/_/_} CONSEQ C) _ = Ps\" | (* the variables P' depends on *)\n \"qdeps (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) LV = vars b \\ qdeps C\\<^sub>1 LV \\ qdeps C\\<^sub>2 LV\" | \n \"qdeps ({((I,Is),(S,(E,x,Es)))} WHILE b DO C) _ = Is\" (* the variables I depends on *) \n \nlemma qdeps_mono: \"A \\ B \\ qdeps C A \\ qdeps C B\"\n by (induct C arbitrary: A B, auto simp: le_supI1 le_supI2)\n \nlemma supportE_if: \"supportE (\\l s. if b s then A l s else B l s)\n \\ supportE A \\ supportE B\"\n unfolding supportE_def apply(auto)\n by metis+\n\nlemma supportE_preT: \"supportE (%l. preT C (e l)) \\ supportE e\"\nproof(induct C arbitrary: e)\n case (Aif b C1 C2 e)\n show ?case\n apply(simp)\n apply(rule subset_trans[OF supportE_if])\n using Aif by fast\nnext\n case (Awhile A y C e)\n obtain I S E x where A: \"A= (I,S,E,x)\" using prod_cases4 by blast\n show ?case using A apply(simp) unfolding supportE_def\n by blast\nnext\n case (Aseq)\n then show ?case by force\nqed (simp_all add: supportE_def, blast)\n\nlemma supportE_twicepreT: \"supportE (%l. preT C1 (preT C2 (e l))) \\ supportE e\"\n by (rule subset_trans[OF supportE_preT supportE_preT])\n\n\n\nlemma supportE_preTz: \"supportE (%l. preTz C (e l) n) \\ supportE e\"\nproof (induct n) \n case (Suc n)\n show ?case \n apply(simp)\n apply(rule subset_trans[OF supportE_preT]) \n by fact \nqed simp\n\n\nlemma supportE_preTz_Un: (* like in support_wpw_Un *)\n \"supportE (\\l. preTz C (e l) (l x)) \\ insert x (UN n. supportE (\\l. preTz C (e l) n))\"\n apply(auto simp add: supportE_def subset_iff)\n apply metis\n done\n\nlemma support_eq: \"support (\\l s. l x = E l s) \\ supportE E \\ {x}\"\n unfolding support_def supportE_def \n apply(auto)\n apply blast\n by metis\n\n\nlemma support_impl_in: \"G e \\ support (\\l s. H e l s) \\ T\n \\ support (\\l s. G e \\ H e l s) \\ T\"\n unfolding support_def apply(auto)\n apply blast+ done\n\nlemma support_supportE: \"\\P e. support (\\l s. P (e l) s) \\ supportE e\"\n unfolding support_def supportE_def\n apply(rule subsetI)\n apply(simp)\nproof (clarify, goal_cases)\n case (1 P e x l1 l2 s)\n have P: \"\\s. e l1 s = e l2 s \\ e l1 = e l2\" by fast\n show \"\\l1 l2. (\\y. y \\ x \\ l1 y = l2 y) \\ (\\s. e l1 s \\ e l2 s)\"\n apply(rule exI[where x=l1])\n apply(rule exI[where x=l2])\n apply(safe)\n using 1 apply blast\n apply(rule ccontr)\n apply(simp) \n using 1(2) P by force \nqed \n\nlemma support_pre: \"support (pre C Q) \\ support Q \\ varacom C\"\nproof (induct C arbitrary: Q)\n case (Awhile A b C Q)\n obtain I2 S E Es SS where A: \"A= (I2,(S,(E,Es,SS)))\" using prod_cases5 by blast \n obtain I Is where \"I2=(I,Is)\" by fastforce\n note A=this A\n have support_inv: \"\\P. support (\\l s. P s) = {}\"\n unfolding support_def by blast \n show ?case unfolding A by(auto)\nnext\n case (Aseq C1 C2)\n then show ?case by(auto)\nnext\n case (Aif x C1 C2 Q)\n have s1: \"support (\\l s. bval x s \\ pre C1 Q l s) \\ support Q \\ varacom C1\"\n apply(rule subset_trans[OF support_impl]) by(rule Aif)\n have s2: \"support (\\l s. ~ bval x s \\ pre C2 Q l s) \\ support Q \\ varacom C2\"\n apply(rule subset_trans[OF support_impl]) by(rule Aif)\n \n show ?case apply(simp)\n apply(rule subset_trans[OF support_and]) \n using s1 s2 by blast \nnext\n case (Aconseq x1 x2 x3 C)\n obtain a b c d e f where \"x1=(a,b)\" \"x2=(c,d)\" \"x3=(e,f)\" by force\n with Aconseq show ?case by auto \nqed (auto simp add: support_def) \n\nlemma finite_support_pre: \"finite (support Q) \\ finite (varacom C) \\ finite (support (pre C Q))\"\n using finite_subset support_pre finite_UnI by metis \n\n\nfun time :: \"acom \\ tbd\" where\n \"time SKIP = (%s. Suc 0)\" |\n \"time (x ::= a) = (%s. Suc 0)\" |\n \"time (C\\<^sub>1;; C\\<^sub>2) = (%s. time C\\<^sub>1 s + preT C\\<^sub>1 (time C\\<^sub>2) s)\" |\n \"time ({_/_/(e,es)} CONSEQ C) = e\" |\n \"time (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) =\n (\\s. if bval b s then 1 + time C\\<^sub>1 s else 1 + time C\\<^sub>2 s)\" |\n \"time ({(_,(E',(E,x)))} WHILE b DO C) = E\"\n \n \n(* the set of variables, i need to know about, i.e. s1 and s2 have to agree on \n s.th. time C s1 = time C s2 *) \nfun kdeps :: \"acom \\ vname set\" where\n \"kdeps SKIP = {}\" |\n \"kdeps (x ::= a) = {}\" |\n \"kdeps (C\\<^sub>1;; C\\<^sub>2) = kdeps C\\<^sub>1 \\ fune C\\<^sub>1 (kdeps C\\<^sub>2)\" |\n \"kdeps (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) = vars b \\ kdeps C\\<^sub>1 \\ kdeps C\\<^sub>2\" |\n \"kdeps ({(_,(E',(E,Es,SS)))} WHILE b DO C) = Es\" |\n \"kdeps ({_/_/(e,es)} CONSEQ C) = es\" \n \n \nlemma supportE_single: \"supportE (\\l s. P) = {}\" \n unfolding supportE_def by blast\n\n\nlemma supportE_plus: \"supportE (\\l s. e1 l s + e2 l s) \\ supportE e1 \\ supportE e2\" \n unfolding supportE_def apply(auto)\n by metis \n\nlemma supportE_Suc: \"supportE (\\l s. Suc (e1 l s)) = supportE e1\"\n unfolding supportE_def by (auto) \n\n\nlemma supportE_single2: \"supportE (\\l . P) = {}\" \n unfolding supportE_def by blast\n\nlemma supportE_time: \"supportE (\\l. time C) = {}\"\n using supportE_single2 by simp \n\nlemma \"\\s. (\\l. I (l(x:=0)) s) = (\\l. l x = 0 \\ I l s)\"\n apply(auto) \n by (metis fun_upd_triv)\n\nlemma \"\\s. (\\l. I (l(x:=Suc (l x))) s) = (\\l. (\\n. l x = Suc n) \\ I l s)\"\n apply(auto) \nproof (goal_cases)\n case (1 s l n)\n then have \"\\l. I (l(x := Suc (l x))) s\" by simp\n from this[where l=\"l(x:=n)\"]\n have \"I ((l(x:=n))(x := Suc ((l(x:=n)) x))) s\" by simp\n then show ?case using 1(2) apply(simp) \n by (metis fun_upd_triv)\nqed \n\ntext\\Verification condition:\\\n\n \ndefinition funStar where \"funStar f = (%x. {y. (x,y)\\{(x,y). y\\f x}\\<^sup>*})\"\n \nlemma funStart_prop1: \"x \\ (funStar f) x\" unfolding funStar_def by auto\nlemma funStart_prop2: \"f x \\ (funStar f) x\" unfolding funStar_def by auto\n\nfun vc :: \"acom \\ assn2 \\ vname set \\ vname set \\ bool\" where\n \"vc SKIP Q _ _ = True\" |\n \"vc (x ::= a) Q _ _ = True\" |\n \"vc (C\\<^sub>1 ;; C\\<^sub>2) Q LVQ LVE = ((vc C\\<^sub>1 (pre C\\<^sub>2 Q) (qdeps C\\<^sub>2 LVQ) (fune C\\<^sub>2 LVE \\ kdeps C\\<^sub>2)) \\ (vc C\\<^sub>2 Q LVQ LVE) )\" |\n \"vc (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) Q LVQ LVE = (vc C\\<^sub>1 Q LVQ LVE \\ vc C\\<^sub>2 Q LVQ LVE)\" | \n \"vc ({(P',Ps)/(Q,Qs)/(e',es)} CONSEQ C) Q' LVQ LVE = (vc C Q Qs LVE \\ \\evtl \\LV\\ weglassen - glaub eher nicht\\\n \\ (\\s1 s2 l. (\\x\\Ps. s1 x=s2 x) \\ P' l s1 = P' l s2) \\ \\annotation \\Ps\\ (the set of variables \\P'\\ depends on) is correct\\\n \\ (\\s1 s2 l. (\\x\\Qs. s1 x=s2 x) \\ Q l s1 = Q l s2) \\ \\annotation \\Qs\\ (the set of variables \\Q\\ depends on) is correct\\\n \\ (\\s1 s2. (\\x\\es. s1 x=s2 x) \\ e' s1 = e' s2) \\ \\annotation \\es\\ (the set of variables \\e'\\ depends on) is correct\\\n \\ (\\k>0. (\\l s. P' l s \\ time C s \\ k * e' s \\ (\\t. \\l'. (pre C Q) l' s \\ ( Q l' t \\ Q' l t) ))))\" |\n \n \"vc ({((I,Is),(S,(E,es,SS)))} WHILE b DO C) Q LVQ LVE = ((\\s1 s2 l. (\\x\\Is. s1 x = s2 x) \\ I l s1 = I l s2) \\ \\annotation \\Is\\ is correct\\\n \\ (\\y\\LVE \\ LVQ. (let Ss=SS y in (\\s1 s2. (\\x\\Ss. s1 x = s2 x) \\ (S s1) y = (S s2) y))) \\ \\annotation \\SS\\ is correct, for only one step\\\n \\ (\\s1 s2. (\\x\\es. s1 x=s2 x) \\ E s1 = E s2) \\ \\annotation \\es\\ (the set of variables \\E\\ depends on) is correct\\\n \\ (\\l s. (I l s \\ bval b s \\ pre C I l s \\ E s \\ 1 + preT C E s + time C s\n \\ (\\v\\(\\y\\LVE \\ LVQ. (funStar SS) y). (S s) v = (S (postQ C s)) v) ) \\\n (I l s \\ \\ bval b s \\ Q l s \\ E s \\ 1 \\ (\\v\\(\\y\\LVE \\ LVQ. (funStar SS) y). (S s) v = s v)) ) \\\n vc C I Is (es \\ (\\y\\LVE. (funStar SS) y)))\"\n \nsubsubsection \\Soundness:\\\n\nabbreviation \"preSet U C l s == (Ball U (%u. case u of (x,e,v) \\ l x = preT C e s))\"\nabbreviation \"postSet U l s == (Ball U (%u. case u of (x,e,v) \\ l x = e s))\"\n\n\nfun ListUpdate where\n \"ListUpdate f [] l = f\"\n| \"ListUpdate f ((x,e,v)#xs) q = (ListUpdate f xs q)(x:=q e x)\"\n\nlemma allg: \n assumes U2: \"\\l s n x. x\\ fst ` upds \\ A (l(x := n)) = A l\"\n shows\n \"fst ` set xs \\ fst ` upds \\ A (ListUpdate l'' xs q) = A l''\" \nproof (induct xs) \n case (Cons a xs)\n obtain x e v where axe: \"a = (x,e,v)\"\n using prod_cases3 by blast \n have \"A (ListUpdate l'' (a # xs) q) \n = A ((ListUpdate l'' xs q)(x := q e x)) \" unfolding axe by(simp)\n also have\n \"\\ = A (ListUpdate l'' xs q) \"\n apply(rule U2)\n using Cons axe by force\n also have \"\\ = A l'' \"\n using Cons by force\n finally show ?case .\nqed simp \n\nfun ListUpdateE where\n \"ListUpdateE f [] = f\"\n| \"ListUpdateE f ((x,e,v)#xs) = (ListUpdateE f xs )(x:=e)\"\n\nlemma ListUpdate_E: \"ListUpdateE f xs = ListUpdate f xs (%e x. e)\"\n apply(induct xs) apply(simp_all)\n subgoal for a xs apply(cases a) apply(simp) done\n done\nlemma allg_E: fixes A::assn2\n assumes \n \" (\\l s n x. x \\ fst ` upds \\ A (l(x := n)) = A l)\" \"fst ` set xs \\ fst ` upds\"\n shows \"A (ListUpdateE f xs) = A f\"\nproof -\n have \" A (ListUpdate f xs (%e x. e)) = A f\"\n apply(rule allg) \n apply fact+ done\n then show ?thesis by(simp only: ListUpdate_E)\nqed \n\nlemma ListUpdateE_updates: \"distinct (map fst xs) \\ x \\ set xs \\ ListUpdateE l'' xs (fst x) = fst (snd x)\"\nproof (induct xs)\n case Nil\n then show ?case apply(simp) done\nnext\n case (Cons a xs)\n show ?case\n proof (cases \"fst a = fst x\")\n case True\n then obtain y e v where a: \"a=(y,e,v)\"\n using prod_cases3 by blast \n with True have fstx: \"fst x=y\" by simp\n from Cons(2,3) fstx a have a2: \"x=a\"\n by force\n show ?thesis unfolding a2 a by(simp)\n next\n case False\n with Cons(3) have A: \"x\\set xs\" by auto\n then obtain y e v where a: \"a=(y,e,v)\"\n using prod_cases3 by blast \n from Cons(2) have B: \"distinct (map fst xs)\" by simp \n from Cons(1)[OF B A] False\n show ?thesis unfolding a by(simp) \n qed \nqed\n\n\nlemma ListUpdate_updates: \"x \\ fst ` (set xs) \\ ListUpdate l'' xs (%e. l) x = l x\"\nproof(induct xs)\n case Nil\n then show ?case by(simp)\nnext\n case (Cons a xs)\n obtain q p v where axe: \"a = (p,q,v)\"\n using prod_cases3 by blast \n from Cons show ?case unfolding axe\n apply(cases \"x=p\") \n by(simp_all)\nqed\n \nabbreviation \"lesvars xs == fst ` (set xs)\"\n \nfun preList where\n \"preList [] C l s = True\"\n| \"preList ((x,(e,v))#xs) C l s = (l x = preT C e s \\ preList xs C l s)\"\n \n \nlemma preList_Seq: \"preList upds (C1;; C2) l s = preList (map (\\(x, e, v). (x, preT C2 e, fune C2 v)) upds) C1 l s\"\nproof (induct upds)\n case Nil\n then show ?case by simp\nnext\n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a by (simp)\nqed\n\n\n\nlemma preSetpreList: \"preList xs C l s \\ preSet (set xs) C l s\"\nproof (induct xs) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n by(simp)\nqed simp\n\n\n(* surprise. but makes sense, if the clauses are contradictory on the \n left side, so are they on the right side *)\nlemma preSetpreList_eq: \"preList xs C l s = preSet (set xs) C l s\"\nproof (induct xs) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n by(simp)\nqed simp \n\n\nfun postList where\n \"postList [] l s = True\"\n| \"postList ((x,e,v)#xs) l s = (l x = e s \\ postList xs l s)\"\n\nlemma \"postList xs l s = (foldr (\\(x,e,v) acc l s. l x = e s \\ acc l s) xs (%l s. True)) l s\" \napply(induct xs) apply(simp) by (auto) \n \nlemma support_postList: \"support (postList xs) \\ lesvars xs\"\nproof (induct xs) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n apply(simp) apply(rule subset_trans[OF support_and])\n apply(rule Un_least)\n subgoal apply(rule subset_trans[OF support_eq])\n using supportE_twicepreT subset_trans supportE_single2 by simp\n subgoal by(auto)\n done \nqed simp\n \n \n \nlemma postList_preList: \"postList (map (\\(x, e, v). (x, preT C2 e, fune C2 v)) upds) l s = preList upds C2 l s\"\nproof (induct upds) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n by(simp)\nqed simp\n \nlemma postSetpostList: \"postList xs l s \\ postSet (set xs) l s\"\nproof (induct xs) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n by(simp)\nqed simp\n \n\nlemma postListpostSet: \"postSet (set xs) l s \\ postList xs l s\"\nproof (induct xs) \n case (Cons a xs)\n obtain y e v where a: \"a=(y,(e,v))\"\n using prod_cases3 by blast \n from Cons show ?case unfolding a\n by(simp)\nqed simp\n\nlemma postListpostSet2: \" postList xs l s = postSet (set xs) l s \"\n using postListpostSet postSetpostList by metis\n\n\n\nlemma ListAskip: \"preList xs Askip l s = postList xs l s\"\n apply(induct xs)\n apply(simp) by force\n\nlemma SetAskip: \"preSet U Askip l s = postSet U l s\"\nby simp\n\nlemma ListAassign: \"preList upds (Aassign x1 x2) l s = postList upds l (s[x2/x1])\"\n apply(induct upds)\n apply(simp) by force\n\nlemma SetAassign: \"preSet U (Aassign x1 x2) l s = postSet U l (s[x2/x1])\"\nby simp\n\n\nlemma ListAconseq: \"preList upds (Aconseq x1 x2 x3 C) l s = preList upds C l s\"\n apply(induct upds)\n apply(simp) by force\n\nlemma SetAconseq: \"preSet U (Aconseq x1 x2 x3 C) l s = preSet U C l s\"\nby simp\n\nlemma ListAif1: \"bval b s \\ preList upds (IF b THEN C1 ELSE C2) l s = preList upds C1 l s\"\n apply(induct upds)\n apply(simp) by force\nlemma SetAif1: \"bval b s \\ preSet upds (IF b THEN C1 ELSE C2) l s = preSet upds C1 l s\"\n apply(simp) done\nlemma ListAif2: \"~ bval b s \\ preList upds (IF b THEN C1 ELSE C2) l s = preList upds C2 l s\"\n apply(induct upds)\n apply(simp) by force\n\nlemma SetAif2: \"~ bval b s \\ preSet upds (IF b THEN C1 ELSE C2) l s = preSet upds C2 l s\"\n apply(simp) done\n\ndefinition K where \"K C LVQ Q == (\\l s1 s2. s1 = s2 on qdeps C LVQ \\ pre C Q l s1 = pre C Q l s2)\"\n \n\ndefinition K2 where \"K2 C e Es Q == (\\s1 s2. s1 = s2 on fune C Es \\ preT C e s1 = preT C e s2)\"\n \ndefinition K3 where \"K3 upds C Q = (\\(a,b,c)\\set upds. K2 C b c Q)\"\ndefinition K4 where \"K4 upds LV C Q = (K C LV Q \\ K3 upds C Q \\ (\\s1 s2. s1 = s2 on kdeps C \\ time C s1 = time C s2))\"\n\nlemma k4If: \"K4 upds LVQ C1 Q \\ K4 upds LVQ C2 Q \\ K4 upds LVQ (IF b THEN C1 ELSE C2) Q\" \nproof -\n have fl: \"\\A B s1 s2. A \\ B \\ s1 = s2 on B \\ s1 = s2 on A\" by auto\n assume \"K4 upds LVQ C1 Q\" \"K4 upds LVQ C2 Q\"\n then show \"K4 upds LVQ (IF b THEN C1 ELSE C2) Q\"\n unfolding K4_def K_def K3_def K2_def using bval_eq_if_eq_on_vars fl apply auto\n apply blast+ done\nqed\n \n\nsubsubsection \"Soundness\"\n \nlemma vc_sound: \"vc C Q LVQ LVE \\ finite (support Q)\n \\ fst ` (set upds) \\ varacom C = {} \\ distinct (map fst upds)\n \\ finite (varacom C) \n \\ (\\l s1 s2. s1 = s2 on LVQ \\ Q l s1 = Q l s2)\n \\ (\\l s1 s2. s1 = s2 on LVE \\ postList upds l s1 = postList upds l s2)\n \\ (\\(a,b,c)\\set upds. (\\s1 s2. s1 = s2 on c \\ b s1 = b s2)) \\ \\\\c\\ are really the variables \\b\\ depends on\\\n \\ (\\(a,b,c)\\set upds. c) \\ LVE \\ \\in \\LV\\ are all the variables that the expressions in \\upds\\ depend on\\\n \\ \\\\<^sub>1 {%l s. pre C Q l s \\ preList upds C l s} strip C { time C \\ %l s. Q l s \\ postList upds l s}\n \\ ((\\l s. pre C Q l s \\ Q l (postQ C s)) \\ K4 upds LVQ C Q)\"\nproof(induction C arbitrary: Q upds LVE LVQ) \n case (Askip Q upds)\n then show ?case unfolding K4_def K_def K3_def K2_def\n apply(auto)\n apply(rule weaken_post[where Q=\"%l s. Q l s \\ preList upds Askip l s\"])\n apply(simp add: Skip) using ListAskip \n by fast\nnext\n case (Aassign x1 x2 Q upds)\n then show ?case unfolding K_def apply(safe) apply(auto simp add: Assign)[1]\n apply(rule weaken_post[where Q=\"%l s. Q l s \\ postList upds l s\"]) \n apply(simp only: ListAassign)\n apply(rule Assign) apply simp\n apply(simp only: postQ.simps pre.simps) apply(auto) \n unfolding K4_def K2_def K3_def K_def by (auto)\nnext\n case (Aif b C1 C2 Q upds ) \n from Aif(3) have 1: \"vc C1 Q LVQ LVE\" and 2: \"vc C2 Q LVQ LVE\" by auto\n have T: \"\\l s. pre C1 Q l s \\ bval b s \\ Q l (postQ C1 s)\"\n and kT: \"K4 upds LVQ C1 Q\"\n using Aif(1)[OF 1 Aif(4) _ Aif(6)] Aif(5-11) by auto \n have F: \"\\l s. pre C2 Q l s \\ \\ bval b s \\ Q l (postQ C2 s)\"\n and kF: \"K4 upds LVQ C2 Q\"\n using Aif(2)[OF 2 Aif(4) _ Aif(6)] Aif(5-11) by auto\n\n show ?case apply(safe)\n subgoal\n apply(simp)\n apply(rule If2[where e=\"\\a. if bval b a then time C1 a else time C2 a\"])\n subgoal\n apply(simp cong: rev_conj_cong)\n apply(rule ub_cost[where e'=\"time C1\"])\n apply(simp) apply(auto)[1]\n apply(rule strengthen_pre[where P=\"%l s. pre C1 Q l s \\ preList upds C1 l s\"]) \n using ListAif1\n apply fast\n apply(rule Aif(1)[THEN conjunct1])\n using Aif\n apply(auto)\n done\n subgoal \n apply(simp cong: rev_conj_cong)\n apply(rule ub_cost[where e'=\"time C2\"]) (* k=1 and *)\n apply(simp) apply(auto)[1]\n apply(rule strengthen_pre[where P=\"%l s. pre C2 Q l s \\ preList upds C2 l s\"])\n using ListAif2\n apply fast\n apply(rule Aif(2)[THEN conjunct1])\n using Aif\n apply(auto)\n done\n by simp\n using T F kT kF by (auto intro: k4If) \nnext\n case (Aconseq P'2 Qannot2 eannot2 C Q upds) \n obtain P' Ps where [simp]: \"P'2 = (P',Ps)\" by fastforce\n obtain Qannot Q's where [simp]: \"Qannot2 = (Qannot,Q's)\" by fastforce\n obtain eannot es where [simp]: \"eannot2 = (eannot,es)\" by fastforce\n \n have ih0: \"finite (support Qannot)\" using Aconseq(3,6) by simp\n \n from \\vc ({P'2/Qannot2/eannot2} CONSEQ C) Q LVQ LVE\\\n obtain k where k0: \"k>0\" and ih1: \"vc C Qannot Q's LVE\"\n and ih2: \" (\\l s. P' l s \\ time C s \\ k * eannot s \\ (\\t. \\l'. pre C Qannot l' s \\ (Qannot l' t \\ Q l t)))\"\n and pc: \"(\\s1 s2 l. (\\x\\Ps. s1 x=s2 x) \\ P' l s1 = P' l s2)\"\n and qc: \"(\\s1 s2 l. (\\x\\Q's. s1 x=s2 x) \\ Qannot l s1 = Qannot l s2)\"\n and ec: \"(\\s1 s2. (\\x\\es. s1 x=s2 x) \\ eannot s1 = eannot s2)\" \n by auto\n have k: \"\\\\<^sub>1 {\\l s. pre C Qannot l s \\ preList upds C l s} strip C { time C \\ \\l s. Qannot l s \\ postList upds l s}\n \\ ((\\l s. pre C Qannot l s \\ Qannot l (postQ C s)) \\ K4 upds Q's C Qannot)\" \n apply(rule Aconseq(1)) using Aconseq(2-10) by auto \n \n note ih=k[THEN conjunct1] and ihsnd=k[THEN conjunct2]\n\n show ?case apply(simp, safe)\n apply(rule conseq[where e=\"time C\" and P=\"\\l s. pre C Qannot l s \\ preList upds C l s\" and Q=\"%l s. Qannot l s \\ postList upds l s\"])\n prefer 2\n apply(rule ih) \n subgoal apply(rule exI[where x=k])\n proof (safe, goal_cases)\n case (1)\n with k0 show ?case by auto\n next \n case (2 l s)\n then show ?case using ih2 by simp\n next\n case (3 l s t) \n have finupds: \"finite (set upds)\" by simp\n {\n fix l s n x\n assume \"x \\ fst ` (set upds)\"\n then have \"x \\ support (pre C Qannot)\" using Aconseq(4) support_pre by auto\n from assn2_lupd[OF this] have \"pre C Qannot (l(x := n)) = pre C Qannot l\" . \n } note U2=this \n {\n fix l s n x\n assume \"x \\ fst ` (set upds)\"\n then have \"x \\ support Qannot\" using Aconseq(4) by auto\n from assn2_lupd[OF this] have \"Qannot (l(x := n)) = Qannot l\" .\n } note K2=this \n \n from ih2 3(1) have *: \"(\\l'. pre C Qannot l' s \\ (Qannot l' t \\ Q l t))\" by simp\n obtain l' where i': \"pre C Qannot l' s\" and ii': \"(Qannot l' t \\ Q l t)\" \n and lxlx: \"\\x. x\\ fst ` (set upds) \\ l' x = l x\" \n proof (goal_cases)\n case 1\n from * obtain l'' where i': \"pre C Qannot l'' s\" and ii': \"(Qannot l'' t \\ Q l t)\" \n by blast\n \n note allg=allg[where q=\"%e x. l x\"]\n \n have \"pre C Qannot (ListUpdate l'' upds (\\e. l)) = pre C Qannot l'' \"\n apply(rule allg[where ?upds=\"set upds\"]) apply(rule U2) apply fast by fast\n with i' have U: \"pre C Qannot (ListUpdate l'' upds (\\e. l)) s\" by simp\n \n have \"Qannot (ListUpdate l'' upds (\\e. l)) = Qannot l''\"\n apply(rule allg[where ?upds=\"set upds\"]) apply(rule K2) apply fast by fast\n \n then have K: \"(%l' s. Qannot l' t \\ Q l t) (ListUpdate l'' upds (\\e. l)) s = (%l' s. Qannot l' t \\ Q l t) l'' s\"\n by simp\n with ii' have K: \"(Qannot (ListUpdate l'' upds (\\e. l)) t \\ Q l t)\" by simp\n \n {\n fix x\n assume as: \"x \\ fst ` (set upds)\" \n have \"ListUpdate l'' upds (\\e. l) x = l x\"\n apply(rule ListUpdate_updates)\n using as by fast\n } note kla=this \n \n show \"thesis\"\n apply(rule 1)\n apply(fact U)\n apply(fact K)\n apply(fact kla)\n done\n qed \n \n let ?upds' = \"set (map (%(x,e,v). (x,preT C e s,fune C v)) upds)\"\n have \"finite ?upds'\" by simp \n define xs where \"xs = map (%(x,e,v). (x,preT C e s,fune C v)) upds\"\n then have \"set xs= ?upds'\" by simp\n \n have \"pre C Qannot (ListUpdateE l' xs) = pre C Qannot l' \" \n apply(rule allg_E[where ?upds=\"?upds'\"]) apply(rule U2) \n apply force unfolding xs_def by simp\n with i' have U: \"pre C Qannot (ListUpdateE l' xs ) s\" by simp\n \n have \"Qannot (ListUpdateE l' xs) = Qannot l' \"\n apply(rule allg_E[where ?upds=\"?upds'\"]) apply(rule K2) apply force unfolding xs_def by auto\n then have K: \"(%l' s. Qannot l' t \\ Q l t) (ListUpdateE l' xs) s = (%l' s. Qannot l' t \\ Q l t) l' s\"\n by simp\n with ii' have K: \"(Qannot (ListUpdateE l' xs) t \\ Q l t)\" by simp\n \n \n have xs_upds: \"map fst xs = map fst upds\"\n unfolding xs_def by auto\n \n have grr: \"\\x. x \\ ?upds' \\ ListUpdateE l' xs (fst x) = fst (snd x)\" apply(rule ListUpdateE_updates)\n apply(simp only: xs_upds) using Aconseq(5) apply simp\n unfolding xs_def apply(simp) done\n show ?case\n apply(rule exI[where x=\"ListUpdateE l' xs\"]) \n apply(safe)\n subgoal by fact\n subgoal apply(rule preListpreSet) proof (safe,goal_cases)\n case (1 x e v)\n then have \"(x, preT C e s, fune C v) \\ ?upds'\" \n by force\n from grr[OF this, simplified]\n show ?case .\n \n qed \n subgoal using K apply(simp) done (* Qannot must be independent of x *)\n subgoal apply(rule postListpostSet) \n proof (safe, goal_cases)\n case (1 x e v)\n with lxlx[of x] have fF: \"l x = l' x\" \n by force \n \n from postSetpostList[OF 1(2)] have g: \"postSet (set upds) (ListUpdateE l' xs) t\" .\n with 1(3) have A: \"(ListUpdateE l' xs) x = e t\"\n by fast \n from 1(3) grr[of \"(x,preT C e s, fune C v)\"] have B: \"ListUpdateE l' xs x = fst (snd (x, preT C e s, fune C v))\"\n by force\n from A B have X: \"e t = preT C e s\" by fastforce\n from preSetpreList[OF 3(2)] have \"preSet (set upds) ({P'2/Qannot2/eannot2} CONSEQ C) l s\" apply(simp) done\n with 1(3) have Y: \"l x = preT C e s\" apply(simp) by fast\n from X Y show ?case by simp\n qed \n done\n qed\n subgoal using ihsnd ih2 by blast\n subgoal using ihsnd[THEN conjunct2] pc unfolding K4_def K_def apply(auto)\n unfolding K3_def K2_def using ec by auto\n done \nnext\n case (Aseq C1 C2 Q upds)\n \n let ?P = \"(\\l s. pre C1 (pre C2 Q) l s \\ preList upds (C1;;C2) l s )\"\n let ?P' = \"support Q \\ varacom C1 \\ varacom C2 \\ lesvars upds\"\n \n \n have finite_varacom: \"finite (varacom (C1;; C2))\" by fact \n have finite_varacomC2: \"finite (varacom C2)\" \n apply(rule finite_subset[OF _ finite_varacom]) by simp \n \n let ?y = \"SOME x. x \\ ?P'\" \n have sup_L: \"support (preList upds (C1;;C2)) \\ lesvars upds\"\n apply(rule support_preList) done \n \n \n have sup_B: \"support ?P \\ ?P'\" \n apply(rule subset_trans[OF support_and]) using support_pre sup_L by blast \n have fP': \"finite (?P')\" using finite_varacom Aseq(3,4,5) apply simp done\n hence \"\\x. x \\ ?P'\" using infinite_UNIV_listI\n using ex_new_if_finite by metis\n hence ynP': \"?y \\ ?P'\" by (rule someI_ex) \n hence ysupPreC2Q: \"?y \\ support (pre C2 Q)\" and ysupC1: \"?y \\ varacom C1\" using support_pre by auto\n \n from Aseq(5) have \"lesvars upds \\ varacom C2 = {}\" by auto\n \n from Aseq show ?case apply(auto)\n proof (rule Seq, goal_cases)\n case 2 \n show \"\\\\<^sub>1 {(%l s. pre C2 Q l s \\ preList upds C2 l s )} strip C2 { time C2 \\ (%l s. Q l s \\ postList upds l s)}\"\n apply(rule weaken_post[where Q=\"(%l s. Q l s \\ postList upds l s)\"])\n apply(rule 2(2)[THEN conjunct1])\n apply fact\n apply (fact)+ using 2(8) by simp \n next\n case 3\n fix s\n show \"time C1 s + preT C1 (time C2) s \\ time C1 s + preT C1 (time C2) s\"\n by simp\n next\n case 1 \n \n \n from ynP' have yC1: \"?y \\ varacom C1\" by blast\n have xC1: \"lesvars upds \\ varacom C1 = {}\" using Aseq(5) by auto\n from finite_support_pre[OF Aseq(4) finite_varacomC2] \n have G: \"finite (support (pre C2 Q))\" . \n \n let ?upds = \"map (\\a. case a of (x,e,v) \\ (x, preT C2 e, fune C2 v)) upds\"\n let ?upds' = \"(?y,time C2, kdeps C2)#?upds\"\n \n { \n have A: \" lesvars ?upds' = {?y} \\ lesvars upds\" apply simp \n by force\n from Aseq(5) have 2: \"lesvars upds \\ varacom C1 = {}\" by auto\n have \" lesvars ?upds' \\ varacom C1 = {}\"\n unfolding A using ysupC1 2 by blast\n } note klar=this\n \n have t: \"fst \\ (\\(x, e, v). (x, preT C2 e, fune C2 v)) = fst\" by auto\n \n {\n fix a b c X\n assume \"a \\ lesvars X\" \"(a,b,c) \\ set X\" \n then have \"False\" by force\n } note helper=this\n \n have dmap: \"distinct (map fst ?upds')\"\n apply(auto simp add: t)\n subgoal for e apply(rule helper[of ?y upds e]) using ynP' by auto\n subgoal by fact\n done\n note bla1=1(1)[where Q=\"pre C2 Q\" and upds=\"?upds'\", OF 1(10) G klar dmap] \n \n note bla=1(2)[OF 1(11,3), THEN conjunct2, THEN conjunct2] \n from 1(4) have kal: \"lesvars upds \\ varacom C2 = {}\" by auto\n from bla[OF kal Aseq.prems(4,6,7,8,9)] have bla4: \"K4 upds LVQ C2 Q\" by auto\n then have bla: \"K C2 LVQ Q\" unfolding K4_def by auto\n \n have A: \n \"\\\\<^sub>1 {\\l s. pre C1 (pre C2 Q) l s \\ preList ?upds' C1 l s}\n strip C1\n { time C1 \\ \\l s. pre C2 Q l s \\ postList ?upds' l s} \\\n (\\l s. pre C1 (pre C2 Q) l s \\ pre C2 Q l (postQ C1 s)) \\ K4 ?upds' (qdeps C2 LVQ) C1 (pre C2 Q)\"\n apply(rule 1(1)[where Q=\"pre C2 Q\" and upds=\"?upds'\", OF 1(10) G klar dmap]) \n proof (goal_cases)\n case 1 \n then show ?case using bla unfolding K_def by auto\n next\n case 2\n show ?case apply(rule,rule,rule,rule) proof (goal_cases)\n case (1 l s1 s2)\n then show ?case using bla4 using Aseq.prems(9) unfolding K4_def K3_def K2_def\n apply(simp)\n proof (goal_cases)\n case 1\n then have t: \"time C2 s1 = time C2 s2\" by auto\n \n have post: \"postList (map (\\(x, e, v). (x, preT C2 e, fune C2 v)) upds) l s1 = postList (map (\\(x, e, v). (x, preT C2 e, fune C2 v)) upds) l s2\" (is \"?IH upds\")\n using 1 \n proof (induct upds) \n case (Cons a upds)\n then have IH: \"?IH upds\" by auto\n obtain x e v where a: \"a = (x,e,v)\" using prod_cases3 by blast\n from Cons(4) have \"v \\ LVE\" unfolding a by auto\n with Cons(2) have s12v: \"s1 = s2 on fune C2 v\" unfolding a using fune_mono by blast \n with Cons(3) IH a show ?case by auto \n qed auto\n \n from post t show ?case by auto\n qed \n qed\n next\n case 3\n then show ?case using bla4 unfolding K4_def K3_def K2_def by(auto)\n next\n case 4\n then show ?case apply(auto)\n proof (goal_cases)\n case (1 x a aa b)\n with Aseq.prems(9) have \"b \\ LVE\" by auto\n with fune_mono have \"fune C2 b \\ fune C2 LVE\" by auto\n with 1 show ?case by blast\n qed \n qed\n \n show \" \\\\<^sub>1 {\\l s. (pre C1 (pre C2 Q) l s \\ preList upds (C1;; C2) l s) \\ l ?y = preT C1 (time C2) s} strip C1\n { time C1 \\ \\l s. (pre C2 Q l s \\ preList upds C2 l s) \\ time C2 s \\ l ?y}\" \n apply(rule conseq_old)\n prefer 2 \n apply(rule A[THEN conjunct1]) \n apply(auto simp: preList_Seq postList_preList) done \n \n from A[THEN conjunct2, THEN conjunct2] have A1: \"K C1 (qdeps C2 LVQ) (pre C2 Q)\" \n and A2: \"K3 ?upds' C1 (pre C2 Q)\" and A3: \"(\\s1 s2. s1 = s2 on kdeps C1 \\ time C1 s1 = time C1 s2)\" unfolding K4_def by auto\n from bla4 have B1: \"K C2 LVQ Q\" and B2: \"K3 upds C2 Q\" and B3: \"(\\s1 s2. s1 = s2 on kdeps C2 \\ time C2 s1 = time C2 s2)\" unfolding K4_def by auto\n show \"K4 upds LVQ (C1;; C2) Q \" \n unfolding K4_def apply(safe)\n subgoal using A1 B1 unfolding K_def by(simp) \n subgoal using A2 B2 unfolding K3_def K2_def apply(auto) done\n subgoal for s1 s2 using A3 B3 apply auto\n proof (goal_cases)\n case 1\n then have t: \"time C1 s1 = time C1 s2\" by auto\n from A2 have \"\\s1 s2. s1 = s2 on fune C1 (kdeps C2) \\ preT C1 (time C2) s1 = preT C1 (time C2) s2\" unfolding K3_def K2_def by auto\n then have p: \"preT C1 (time C2) s1 = preT C1 (time C2) s2\"\n using 1(1) by simp\n from t p show ?case by auto\n qed\n done\n next \n from ynP' sup_B show \"?y \\ support ?P\" by blast \n have F: \"support (preList upds C2) \\ lesvars upds\" \n apply(rule support_preList) done \n have \"support (\\l s. pre C2 Q l s \\ preList upds C2 l s) \\ ?P'\"\n apply(rule subset_trans[OF support_and]) using F support_pre by blast\n with ynP'\n show \"?y \\ support (\\l s. pre C2 Q l s \\ preList upds C2 l s)\" by blast\n next\n case (6 l s) \n \n \n note bla=6(2)[OF 6(11,3), THEN conjunct2, THEN conjunct2] \n from 6(4) have kal: \"lesvars upds \\ varacom C2 = {}\" by auto\n from bla[OF kal Aseq.prems(4,6,7,8,9)] have bla4: \"K4 upds LVQ C2 Q\" by auto\n then have bla: \"K C2 LVQ Q\" unfolding K4_def by auto\n \n have 11: \"finite (support (pre C2 Q )) \" \n apply(rule finite_subset[OF support_pre])\n using 6(3,4,10) finite_varacomC2 by blast \n have A: \"\\l s. pre C1 (pre C2 Q ) l s \\ pre C2 Q l (postQ C1 s)\"\n apply(rule 6(1)[where upds=\"[]\", THEN conjunct2, THEN conjunct1])\n apply(fact)+ apply(auto) using bla unfolding K_def apply blast+ done \n have B: \"(\\l s. pre C2 Q l s \\ Q l (postQ C2 s))\" \n apply(rule 6(2)[where upds=\"[]\", THEN conjunct2, THEN conjunct1])\n apply(fact)+ apply auto using Aseq.prems(6) by auto \n from A B 6 show ?case by simp \n qed \nnext\n case (Awhile A b C Q upds)\n obtain I2 S E Es SS where aha[simp]: \"A = (I2,(S,(E,Es,SS)))\" using prod_cases5 by blast\n obtain I Is where aha2: \"I2 = (I, Is)\" \n by fastforce\n let ?LV =\"(\\y\\LVE \\ LVQ. (funStar SS) y)\" \n have LVE_LVE: \"LVE \\ (\\y\\LVE. (funStar SS) y)\" using funStart_prop1 by fast\n have LV_LV: \"LVE \\ LVQ \\ ?LV\" using funStart_prop1 by fast\n have LV_LV2: \"(\\y\\LVE \\ LVQ. SS y) \\ ?LV\" using funStart_prop2 by fast\n have LVE_LV2: \"(\\y\\LVE. SS y) \\ (\\y\\LVE. (funStar SS) y)\" using funStart_prop2 by fast\n note aha = aha2 aha \n with aha aha2 \\vc (Awhile A b C) Q LVQ LVE\\ have \"vc (Awhile ((I,Is),S,E,Es,SS) b C) Q LVQ LVE\" apply auto apply fast+ done\n then \n have vc: \"vc C I Is (Es \\ (\\y\\LVE. (funStar SS) y))\" \n and IQ: \"\\l s. (I l s \\ bval b s \\ pre C I l s \\ 1 + preT C E s + time C s \\ E s \\ S s = S (postQ C s) on ?LV)\" and\n pre: \"\\l s. (I l s \\ \\ bval b s \\ Q l s \\ 1 \\ E s \\ S s = s on ?LV)\"\n and Is: \"(\\s1 s2 l. s1 = s2 on Is \\ I l s1 = I l s2)\"\n and Ss: \"(\\y\\LVE \\ LVQ. let Ss = SS y in \\s1 s2. s1 = s2 on Ss \\ S s1 y = S s2 y)\"\n and Es: \"(\\s1 s2. s1 = s2 on Es \\ E s1 = E s2)\" apply simp_all apply auto apply fast+ done\n \n then have pre2: \"\\l s. I l s \\ \\ bval b s \\ Q l s \\ 1 \\ E s \\ S s = s on ?LV\"\n and IQ2: \"\\l s. (I l s \\ bval b s \\ pre C I l s \\ 1 + preT C E s + time C s \\ E s \\ S s = S (postQ C s) on ?LV)\"\n and Ss2: \"\\y s1 s2. s1 = s2 on (\\y\\LVE. SS y) \\ S s1 = S s2 on LVE\"\n by auto\n \n from Ss have Ssc: \"\\c s1 s2. c \\ LVE \\ s1 = s2 on (\\y\\c. SS y) \\ S s1 = S s2 on c\" \n by auto\n \n from IQ have IQ_in: \"\\l s. I l s \\ bval b s \\ S s = S (postQ C s) on ?LV\" by auto\n \n have inv_impl: \"\\l s. I l s \\ bval b s \\ pre C I l s\" using IQ by auto \n \n have yC: \"lesvars upds \\ varacom C = {}\" using Awhile(4) aha by auto\n \n let ?upds = \"map (%(x,e,v). (x, %s. e (S s), \\x\\v. SS x)) upds\"\n let ?INV = \"%l s. I l s \\ postList ?upds l s\" \n \n have \"lesvars upds \\ support I = {}\" using Awhile(4) unfolding aha by auto\n \n let ?P=\"lesvars upds \\ varacom ({A} WHILE b DO C) \"\n let ?z=\"SOME z::lvname. z \\ ?P\"\n have \"finite ?P\" apply(auto simp del: aha) by (fact Awhile(6)) \n hence \"\\z. z\\?P\" using infinite_UNIV_listI\n using ex_new_if_finite by metis\n hence znP: \"?z \\ ?P\" by (rule someI_ex) \n from znP have \n zny: \"?z \\ lesvars upds\"\n and zI: \"?z \\ support I\" \n and blb: \"?z \\ varacom C\" by (simp_all add: aha)\n \n from Awhile(4,6) have 23: \"finite (varacom C)\" \n and 26: \"finite (support I)\" by (auto simp add: finite_subset aha) \n \n have \"\\l s. pre C I l s \\ I l (postQ C s)\"\n apply(rule Awhile(1)[THEN conjunct2, THEN conjunct1])\n apply(fact)+ subgoal using Is apply auto done\n subgoal using Awhile(8) LVE_LVE by (metis subsetD sup.cobounded2)\n apply fact using Awhile(10) LVE_LVE by blast \n hence step: \"\\l s. pre C I l s \\ I l (postQ C s)\" by simp\n \n have fua: \"lesvars ?upds = lesvars upds\"\n by force\n let ?upds' = \"(?z,E,Es) # ?upds\"\n \n show ?case\n proof (safe, goal_cases)\n case (2 l s)\n from 2 have A: \"I l s\" unfolding aha by(simp) \n then have I: \"I l s\" by simp\n \n { fix n\n have \"E s = n \\ I l s \\ Q l (postQ ({A} WHILE b DO C) s)\"\n proof (induct n arbitrary: s l rule: less_induct)\n case (less n)\n then show ?case \n proof (cases \"bval b s\")\n case True\n with less IQ2 have \"pre C I l s\" and S: \"S s = S (postQ C s) on ?LV\" and t: \"1 + preT C E s + time C s \\ E s\" by auto\n with step have I': \"I l (postQ C s)\" and \"1 + E (postQ C s) + time C s \\ E s\" using TQ by auto\n with less have \"E (postQ C s) < n\" by auto \n with less(1) I' have \"Q l (postQ ({A} WHILE b DO C) (postQ C s))\" by auto\n with step show ?thesis using S apply simp using Awhile(7)\n by (metis (no_types, lifting) LV_LV SUP_union contra_subsetD sup.boundedE)\n next\n case False\n with pre2 less(3) have \"Q l s\" \"S s = s on ?LV\" by auto\n then show ?thesis apply simp using Awhile(7)\n by (metis (no_types, lifting) LV_LV SUP_union contra_subsetD sup.boundedE) \n qed\n qed\n }\n with I show \"Q l (postQ ({A} WHILE b DO C) s)\" by simp \n next\n case 1 \n have g: \"\\e. e \\ S = (%s. e (S s)) \" by auto\n \n \n have \"lesvars ?upds' \\ varacom C = {}\"\n using yC blb by(auto)\n \n have z: \"(fst \\ (\\(x, e, v). (x, \\s. e (S s), \\x\\v. SS x))) = fst\" by(auto)\n have \"distinct (map fst ?upds')\"\n using Awhile(5) zny by (auto simp add: z)\n \n have klae: \"\\s1 s2 A B. B \\ A \\ s1 = s2 on A \\ s1 = s2 on B\" by auto\n from Awhile(8) Awhile(9) have gl: \"\\a b c s1 s2. (a,b,c) \\ set upds \\ s1 = s2 on c \\ b s1 = b s2\" \n by fast\n have CombALL: \" \\\\<^sub>1 {\\l s. pre C I l s \\ preList ?upds' C l s}\n strip C\n { time C \\ \\l s. I l s \\ postList ?upds' l s} \\\n(\\l s. pre C I l s \\ I l (postQ C s)) \\ K4 ((SOME z. z \\ lesvars upds \\ varacom ({A} WHILE b DO C), E, Es) # map (\\(x, e, v). (x, \\s. e (S s), \\x\\v. SS x)) upds) Is C I \"\n apply(rule Awhile.IH[where upds=\"?upds'\" ] )\n apply (fact)+ \n \n subgoal apply safe using Is apply blast\n using Is apply blast done\n subgoal\n using Is Es apply auto \n apply(simp_all add: postListpostSet2, safe) \n proof (goal_cases)\n case (1 l s1 s2 x e v)\n from 1(5,6) have i: \"l x = e (S s1)\" by auto\n from Awhile(10) 1(6) have vLC: \"v \\ LVE\" by auto\n have st: \"(\\y\\v. SS y) \\ (\\y\\LVE. SS y)\" using vLC by blast\n also have \"\\ \\ (\\y\\LVE. funStar SS y)\" using LVE_LV2 by blast\n finally have st: \"(\\y\\v. SS y) \\ Es \\ (\\y\\LVE. funStar SS y)\" by blast\n have ii: \"e (S s1) = e (S s2)\"\n apply(rule gl)\n apply fact\n apply(rule Ssc)\n apply fact\n using st 1(3) by blast\n from i ii show ?case by simp \n next\n case (2 l s1 s2 x e v)\n from 2(5,6) have i: \"l x = e (S s2)\" by auto\n from Awhile(10) 2(6) have vLC: \"v \\ LVE\" by auto\n have st: \"(\\y\\v. SS y) \\ (\\y\\LVE. SS y)\" using vLC by blast\n also have \"\\ \\ (\\y\\LVE. funStar SS y)\" using LVE_LV2 by blast\n finally have st: \"(\\y\\v. SS y) \\ Es \\ (\\y\\LVE. funStar SS y)\" by blast\n have ii: \"e (S s1) = e (S s2)\"\n apply(rule gl)\n apply fact\n apply(rule Ssc)\n apply fact\n using st 2(3) by blast\n from i ii show ?case by simp \n qed apply(auto)\n subgoal using Es by auto\n subgoal apply(rule gl) apply(simp) using Ss Awhile(10) by fastforce\n subgoal using Awhile(10) LVE_LV2 by blast \n done\n from this[THEN conjunct2, THEN conjunct2] have\n K: \"K C Is I\" and K3: \"K3 ?upds' C I\" and Kt: \"\\s1 s2. s1 = s2 on kdeps C \\ time C s1 = time C s2\" unfolding K4_def by auto\n show \"K4 upds LVQ ({A} WHILE b DO C) Q\" \n unfolding K4_def apply safe\n subgoal using K unfolding K_def aha using Is by auto \n subgoal using K3 unfolding K3_def K2_def aha apply auto\n subgoal for x e v apply (rule gl) apply simp apply(rule Ssc) using Awhile(10) \n apply fast apply blast done done\n subgoal using Kt Es unfolding aha by auto\n done\n \n show ?case \n \n apply(simp add: aha) \n apply(rule conseq_old[where P=\"?INV\" and e'=E and Q=\"\\l s. ?INV l s \\ ~ bval b s\"])\n defer \n proof (goal_cases)\n case 3\n show ?case apply(rule exI[where x=1]) apply(auto)[1] apply(simp only: postList_preList[symmetric] ) apply (auto)[1]\n by(simp only: g) \n next\n case 2 (* post condition is satisfied after exiting the loop *)\n show ?case\n proof (safe, goal_cases)\n case (1 l s)\n then show ?case using pre by auto\n next\n case (2 l s)\n from Awhile(8) have Aw7: \"\\l s1 s2. s1 = s2 on LVE \\ postList upds l s1 = postList upds l s2\" by auto\n have \"postList (map (\\(x, e, v). (x, \\s. e (S s), \\x\\v. SS x)) upds) l s =\n postList upds l (S s)\" apply(induct upds) apply auto done\n also have \"\\ = postList upds l s\" using Aw7[of \"S s\" s \"l\"] pre2 2 LV_LV\n by fast\n finally show ?case using 2(3) by simp\n qed \n next\n case 1\n show ?case \n proof(rule While, goal_cases)\n case 1 \n \n \n note Comb=CombALL[THEN conjunct1]\n \n show \"\\\\<^sub>1 {\\l s. (I l s \\ postList ?upds l s) \\ bval b s \\ preT C E s = l ?z}\n strip C { time C \\ \\l s. (I l s \\ postList ?upds l s) \\ E s \\ l ?z}\" \n apply(rule conseq_old)\n apply(rule exI[where x=1]) apply(simp)\n prefer 2 \n proof (rule Comb, safe, goal_cases) \n case (2 l s)\n from IQ_in[OF 2(1)] gl Awhile(10,9)\n have y: \"postList ?upds l s = \n preList ?upds C l s\" (is \"?IH upds\")\n proof (induct upds) \n case (Cons a upds')\n obtain y e v where axe: \"a = (y,e,v)\" using prod_cases3 by blast \n have IH: \"?IH upds'\" apply(rule Cons(1))\n using Cons(2-5) by auto\n from Cons(3) axe have ke: \"\\s1 s2. s1 = s2 on v \\ e s1 = e s2\"\n by fastforce\n have vLC: \"v \\ LVE\" using axe Cons(4) by simp\n have step: \"e (S s) = e (S (postQ C s))\" apply(rule ke) using Cons(2) using vLC LV_LV 2(3) \n by blast\n show ?case unfolding axe using IH step apply(simp) \n apply(simp only: TQ) done\n qed simp\n from 2 show ?case by(simp add: y) \n qed (auto simp: inv_impl)\n next \n show \"\\l s. bval b s \\ I l s \\ postList ?upds l s \\ 1 + preT C E s + time C s \\ E s\"\n proof (clarify, goal_cases)\n case (1 l s)\n thus ?case\n using 1 IQ by auto\n qed\n next \n show \"\\l s. ~bval b s \\ I l s \\ postList ?upds l s \\ 1 \\ E s\"\n proof (clarify, goal_cases)\n case (1 l s)\n with pre show ?case by auto\n qed \n next\n have pff: \"?z \\ lesvars ?upds\" apply(simp only: fua) by fact\n have \"support (\\l s. I l s \\ postList ?upds l s) \\ support I \\ support (postList ?upds)\"\n by(rule support_and) \n also\n have \"support (postList ?upds)\n \\ lesvars ?upds\"\n apply(rule support_postList) done \n finally \n have \"support (\\l s. I l s \\ postList ?upds l s) \\ support I \\ lesvars ?upds\"\n by blast \n thus \"?z \\ support (\\l s. I l s \\ postList ?upds l s)\" \n apply(rule contra_subsetD) \n using zI pff by(simp)\n qed\n qed \n \n qed\nqed\n \n\ncorollary vc_sound':\n assumes \"vc C Q Qset {}\" \n \"finite (support Q)\" \"finite (varacom C)\"\n \"\\l s. P l s \\ pre C Q l s\" \n \"\\s1 s2 l. s1 = s2 on Qset \\ Q l s1 = Q l s2\"\n shows \"\\\\<^sub>1 {P} strip C {time C \\ Q}\"\nproof -\n show ?thesis\n apply(rule conseq_old)\n prefer 2 apply(rule vc_sound[where upds=\"[]\", OF assms(1), simplified, OF assms(2-3), THEN conjunct1]) \n using assms(4,5) apply auto \n done \nqed\n\ncorollary vc_sound'':\n assumes \"vc C Q Qset {}\" \n \"finite (support Q)\" \"finite (varacom C)\"\n \" (\\k>0. \\l s. P l s \\ pre C Q l s \\ time C s \\ k * e s)\"\n \"\\s1 s2 l. s1 = s2 on Qset \\ Q l s1 = Q l s2\"\n shows \"\\\\<^sub>1 {P} strip C {e \\ Q}\"\nproof -\n show ?thesis\n apply(rule conseq_old)\n prefer 2 apply(rule vc_sound[where upds=\"[]\", OF assms(1), simplified, OF assms(2-3), THEN conjunct1]) \n using assms(4,5) apply auto \n done \nqed \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Hoare_Time/Nielson_VCGi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593171945417, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2990784298642363}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Bisim_Subst_Pres\n imports Weak_Late_Bisim_Subst Weak_Late_Bisim_Pres\nbegin\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"\\.(P) \\\\<^sup>s \\.(Q)\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.tauPres)\n\nlemma inputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and x :: name\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n\n shows \"a.P \\\\<^sup>s a.Q\"\nproof(auto simp add: substClosed_def)\n fix \\ :: \"(name \\ name) list\"\n {\n fix P Q a x \\\n assume \"P \\\\<^sup>s Q\"\n then have \"P[<\\>] \\\\<^sup>s Q[<\\>]\" by(rule partUnfold)\n then have \"\\y. (P[<\\>])[x::=y] \\ (Q[<\\>])[x::=y]\"\n apply(auto simp add: substClosed_def)\n by(erule_tac x=\"[(x, y)]\" in allE) auto\n moreover assume \"x \\ \\\"\n ultimately have \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" using weakBisimEqvt\n by(force intro: Weak_Late_Bisim_Pres.inputPres)\n }\n note Goal = this\n\n obtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ \\\"\n by(generate_fresh \"name\") auto\n from `P \\\\<^sup>s Q` have \"([(x, y)] \\ P) \\\\<^sup>s ([(x, y)] \\ Q)\" by(rule eqvtI)\n hence \"(a.([(x, y)] \\ P))[<\\>] \\ (a.([(x, y)] \\ Q))[<\\>]\" using `y \\ \\` by(rule Goal)\n moreover from `y \\ P` `y \\ Q` have \"a.P = a.([(x, y)] \\ P)\" and \"a.Q = a.([(x, y)] \\ Q)\"\n by(simp add: pi.alphaInput)+\n\n ultimately show \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" by simp\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"a{b}.P \\\\<^sup>s a{b}.Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.outputPres)\n\n\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"[a\\b]P \\\\<^sup>s [a\\b]Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.matchPres)\n\nlemma mismatchPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"[a\\b]P \\\\<^sup>s [a\\b]Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.mismatchPres)\n\nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"P \\ R \\\\<^sup>s Q \\ R\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.parPres)\n\n\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n \n shows \"<\\x>P \\\\<^sup>s <\\x>Q\"\nproof(auto simp add: substClosed_def)\n fix s::\"(name \\ name) list\"\n\n have Res: \"\\P Q x s. \\P[] \\ Q[]; x \\ s\\ \\ (<\\x>P)[] \\ (<\\x>Q)[]\"\n by(force intro: Weak_Late_Bisim_Pres.resPres)\n\n have \"\\c::name. c \\ (P, Q, s)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshP: \"c \\ P\" and cFreshQ: \"c \\ Q\" and cFreshs: \"c \\ s\"\n by(force simp add: fresh_prod)\n\n from PeqQ have \"P[<([(x, c)] \\ s)>] \\ Q[<([(x, c)] \\ s)>]\" by(simp add: substClosed_def)\n hence \"([(x, c)] \\ P[<([(x, c)] \\ s)>]) \\ ([(x, c)] \\ Q[<([(x, c)] \\ s)>])\" by(rule Weak_Late_Bisim.eqvtI)\n hence \"([(x, c)] \\ P)[] \\ ([(x, c)] \\ Q)[]\" by simp\n hence \"(<\\c>([(x, c)] \\ P))[] \\ (<\\c>([(x, c)] \\ Q))[]\" using cFreshs by(rule Res)\n\n moreover from cFreshP cFreshQ have \"<\\x>P = <\\c>([(x, c)] \\ P)\" and \"<\\x>Q = <\\c>([(x, c)] \\ Q)\"\n by(simp add: alphaRes)+\n\n ultimately show \"(<\\x>P)[] \\ (<\\x>Q)[]\" by simp\nqed\n\n\n\n shows \"!P \\\\<^sup>s !Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Bisim_Pres.bangPres)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Late_Bisim_Subst_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.299044887348973}} {"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Multiplexer_Hoare_Typed\n imports VHDL_Hoare_Typed\nbegin\n\ntext \\Define the new datatype for the all signals occurred in a multiplexer. A multiplexer has three\ninputs: in0, in1, and a selector.\\\n\ndatatype sig = IN0 | IN1 | SEL | OUT\n\n\\ \\We put suffix 2 because it only selects between two inputs\\\ndefinition mux2 :: \"sig conc_stmt\" where\n \"mux2 = process {IN0, IN1, SEL} : Bguarded (Bsig SEL)\n (Bassign_trans OUT (Bsig IN1) 1)\n (Bassign_trans OUT (Bsig IN0) 1)\"\n\nlemma potential_tyenv:\n assumes \"seq_wt \\ (Bguarded (Bsig SEL)\n (Bassign_trans OUT (Bsig IN1) 1)\n (Bassign_trans OUT (Bsig IN0) 1))\"\n shows \"\\ki len. \\ IN0 = Bty \\ \\ IN1 = Bty \\ \\ SEL = Bty \\ \\ OUT = Bty\n \\ \\ IN0 = Lty ki len \\ \\ IN1 = Lty ki len \\ \\ SEL = Bty \\ \\ OUT = Lty ki len\"\nproof (rule seq_wt_cases(3)[OF assms])\n assume \"bexp_wt \\ (Bsig SEL) Bty\"\n assume \"seq_wt \\ (Bassign_trans OUT (Bsig IN1) 1)\"\n assume \"seq_wt \\ (Bassign_trans OUT (Bsig IN0) 1)\"\n have \"\\ SEL = Bty\"\n by (rule bexp_wt_cases_all[OF \\bexp_wt \\ (Bsig SEL) Bty\\]) auto\n have \" bexp_wt \\ (Bsig IN1) (\\ OUT)\"\n using seq_wt_cases(4)[OF \\seq_wt \\ (Bassign_trans OUT (Bsig IN1) 1)\\] by auto\n hence \"\\ IN1 = \\ OUT\"\n by (rule bexp_wt_cases_all) auto\n have \"bexp_wt \\ (Bsig IN0) (\\ OUT)\"\n using seq_wt_cases(4)[OF \\seq_wt \\ (Bassign_trans OUT (Bsig IN0) 1)\\] by auto\n hence \"\\ IN0 = \\ OUT\"\n by (rule bexp_wt_cases_all) auto\n obtain ki len where \"\\ OUT = Bty \\ \\ OUT = Lty ki len\"\n using ty.exhaust by meson\n moreover\n { assume \"\\ OUT = Bty\"\n hence \"\\ IN0 = Bty\"\n by (simp add: \\\\ IN0 = \\ OUT\\)\n moreover have \"\\ IN1 = Bty\"\n using \\\\ IN1 = \\ OUT\\ \\\\ OUT = Bty\\ by auto\n ultimately have ?thesis\n using \\\\ OUT = Bty\\ \\\\ SEL = Bty\\ by blast }\n moreover\n { assume \"\\ OUT = Lty ki len\"\n moreover hence \"\\ IN0 = Lty ki len\" and \"\\ IN1 = Lty ki len\"\n using \\\\ IN0 = \\ OUT\\ \\\\ IN1 = \\ OUT\\ by auto\n ultimately have ?thesis\n using \\\\ SEL = Bty\\ by blast }\n ultimately show ?thesis\n by auto\nqed\n\nabbreviation \"bval_of_wline tw sig t \\ bval_of (wline_of tw sig t)\"\n\nlocale multiplexer_typed = \n fixes \\ :: \"sig tyenv\" and len :: nat and ki :: \"signedness\"\n assumes tyin0: \"\\ IN0 = Lty ki len\" and tyin1: \"\\ IN1 = Lty ki len \" and tysel: \" \\ SEL = Bty\" and tyout: \"\\ OUT = Lty ki len\" \nbegin\n\ndefinition inv :: \"sig assn2\" where\n \"inv \\ \\tw. (wline_of tw OUT (fst tw) = (if bval_of_wline tw SEL (fst tw - 1) then wline_of tw IN1 (fst tw - 1) else wline_of tw IN0 (fst tw - 1)))\"\n\ndefinition inv2 :: \"sig assn2\" where\n \"inv2 \\ (\\tw. disjnt {IN0, IN1, SEL} (event_of tw) \\ (\\i > fst tw. wline_of tw OUT i = wline_of tw OUT (fst tw)))\"\n\nlemma inv_next_time_true:\n fixes tw\n defines \"v \\ eval_world_raw2 tw (Bsig IN1)\"\n assumes \"eval_world_raw2 tw (Bsig SEL) = Bv True\"\n defines \"tw' \\ tw[OUT, 1 :=\\<^sub>2 v]\"\n shows \"inv (fst tw' + 1, snd tw')\"\nproof - \n have bexpIN1: \"bexp_wt \\ (Bsig SEL) (Bty)\" \n using multiplexer_typed_axioms unfolding multiplexer_typed_def by (metis bexp_wt.intros(3))+\n have \"wline_of tw' OUT (fst tw + 1) = v\"\n unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n also have \"... = (if bval_of_wline tw SEL (fst tw) then wline_of tw IN1 (fst tw) else wline_of tw IN0 (fst tw))\"\n using assms(2) unfolding v_def eval_world_raw.simps eval_arith.simps Let_def comp_def by auto\n finally show ?thesis\n unfolding inv_def tw'_def worldline_upd2_def worldline_upd_def by auto\nqed\n\nlemma inv_next_time_false:\n fixes tw\n defines \"v \\ eval_world_raw2 tw (Bsig IN0)\"\n assumes \"eval_world_raw2 tw (Bsig SEL) \\ Bv True\"\n defines \"tw' \\ tw[OUT, 1 :=\\<^sub>2 v]\"\n assumes \"wityping \\ (snd tw)\"\n shows \"inv (fst tw' + 1, snd tw')\"\nproof - \n have bexpIN1: \"bexp_wt \\ (Bsig SEL) (Bty)\" \n using multiplexer_typed_axioms unfolding multiplexer_typed_def by (metis bexp_wt.intros(3))+\n hence \"eval_world_raw2 tw (Bsig SEL) = Bv False\"\n using eval_world_raw_bv[OF bexpIN1 assms(4)] assms(2) by metis\n have \"wline_of tw' OUT (fst tw + 1) = v\"\n unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n also have \"... = (if bval_of_wline tw SEL (fst tw) then wline_of tw IN1 (fst tw) else wline_of tw IN0 (fst tw))\"\n using `eval_world_raw2 tw (Bsig SEL) = Bv False` unfolding v_def eval_world_raw.simps eval_arith.simps Let_def comp_def by auto\n finally show ?thesis\n unfolding inv_def tw'_def worldline_upd2_def worldline_upd_def by auto\nqed\n\nlemma inv2_next_time:\n fixes tw v\n defines \"tw' \\ tw[OUT, 1 :=\\<^sub>2 v]\"\n shows \"inv2 (fst tw' + 1, snd tw')\"\n unfolding inv2_def tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma mult_conc_hoare:\n \"\\tw. inv tw \\ inv2 tw \\ disjnt {IN0, IN1, SEL} (event_of tw) \\ inv (fst tw + 1, snd tw)\"\nproof -\n fix tw\n assume \"inv tw \\ inv2 tw \\ disjnt {IN0, IN1, SEL} (event_of tw)\"\n hence \"inv tw\" and \"inv2 tw\" and \"disjnt {IN0, IN1, SEL} (event_of tw)\"\n by auto\n have \"wline_of tw OUT (fst tw + 1) = wline_of tw OUT (fst tw)\"\n using `inv2 tw` `disjnt {IN0, IN1, SEL} (event_of tw)` unfolding inv2_def by auto \n also have \"... = (if bval_of_wline tw SEL (get_time tw - 1) then wline_of tw IN1 (get_time tw - 1) else wline_of tw IN0 (get_time tw - 1))\"\n using `inv tw` unfolding inv_def by auto\n also have \"... = (if bval_of_wline tw SEL (fst tw) then wline_of tw IN1 (fst tw) else wline_of tw IN0 (fst tw))\"\n using `disjnt {IN0, IN1, SEL} (event_of tw)` unfolding event_of_alt_def \n by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n finally show \"inv (fst tw + 1, snd tw)\"\n unfolding inv_def by auto\nqed\n\nlemma mult_conc_hoare2:\n \"\\tw. inv2 tw \\ disjnt {IN0, IN1, SEL} (event_of tw) \\ inv2 (fst tw + 1, snd tw)\"\n unfolding inv2_def by auto\n\nlemma conc_stmt_wf_mult:\n \"conc_stmt_wf mux2\"\n unfolding mux2_def conc_stmt_wf_def by auto \n\nlemma nonneg_delay_conc_mult:\n \"nonneg_delay_conc mux2\"\n unfolding mux2_def by auto\n\nlemma nonneg_delay_conc_mult':\n \"nonneg_delay_conc ( process {IN0, IN1, SEL} : Bguarded (Bsig SEL) (Bassign_trans OUT (Bsig IN1) 1) (Bassign_trans OUT (Bsig IN0) 1))\"\n using nonneg_delay_conc_mult unfolding mux2_def by auto\n\nlemma well_typed:\n \"seq_wt \\ (Bguarded (Bsig SEL) (Bassign_trans OUT (Bsig IN1) 1) (Bassign_trans OUT (Bsig IN0) 1))\"\n by (metis bexp_wt.intros(3) seq_wt.intros(3) seq_wt.intros(4) tyin0 tyin1 tyout tysel)\n\nlemma conc_wt_mult:\n \"conc_wt \\ mux2\"\n unfolding mux2_def by (meson conc_wt.intros(1) well_typed)\n\nlemma conc_wt_mult':\n \"conc_wt \\ ( process {IN0, IN1, SEL} : Bguarded (Bsig SEL) (Bassign_trans OUT (Bsig IN1) 1) (Bassign_trans OUT (Bsig IN0) 1))\"\n using conc_wt_mult unfolding mux2_def by auto\n\nlemma mult_conc_sim2':\n \"\\ \\\\<^sub>s \\\\tw. inv tw \\ inv2 tw\\ mux2 \\\\tw. inv tw \\ inv2 tw\\\"\n apply (rule While_Suc)\n apply (rule Conseq'[where P=\"wp3_conc \\ mux2 (\\tw. inv (fst tw + 1, snd tw) \\ \n inv2 (fst tw + 1, snd tw))\", rotated])\n apply (rule wp3_conc_is_pre, rule conc_stmt_wf_mult, rule nonneg_delay_conc_mult, rule conc_wt_mult, simp)\n unfolding mux2_def wp3_conc_single'[OF conc_wt_mult' nonneg_delay_conc_mult'] wp3_fun.simps \n using inv_next_time_true inv_next_time_false inv2_next_time mult_conc_hoare mult_conc_hoare2 by presburger\n\ntext \\Initialisation preserves the invariant\\\n\nlemma nonneg_delay_mult:\n \"nonneg_delay ( Bguarded (Bsig SEL) (Bassign_trans OUT (Bsig IN1) 1) (Bassign_trans OUT (Bsig IN0) 1))\"\n using nonneg_delay_conc_mult' by auto\n\nlemma init_sat_nand_inv_comb:\n \"init_sim2_hoare_wt \\ (\\tw. fst tw = 0) mux2 (\\tw. inv tw \\ inv2 tw)\"\n unfolding mux2_def\n apply (rule AssignI_suc, rule SingleI)\n apply (rule Conseq3[where Q=\"\\tw. inv (fst tw + 1, snd tw) \\ inv2 (fst tw + 1, snd tw)\", rotated])\n apply (rule wp3_fun_is_pre[OF well_typed nonneg_delay_mult], simp)\n unfolding wp3_fun.simps using inv_next_time_true inv_next_time_false inv2_next_time by auto\n\nlemma correctness:\n assumes \"sim_fin2 w (i + 1) mux2 tw'\" and \"wityping \\ w\"\n shows \"wline_of tw' OUT (i + 1) = (if bval_of_wline tw' SEL (i) then wline_of tw' IN1 (i) else wline_of tw' IN0 (i))\"\n using grand_correctness[OF assms conc_stmt_wf_mult conc_wt_mult nonneg_delay_conc_mult mult_conc_sim2' init_sat_nand_inv_comb]\n unfolding mux2_def inv_def by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n sim_fin2.cases world_maxtime_lt_fst_tres)\nend\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Multiplexer_Hoare_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118493816807, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.29904487857598316}} {"text": "theory TopoS_Stateful_Policy_impl\nimports TopoS_Composition_Theory_impl TopoS_Stateful_Policy_Algorithm\nbegin\n\nsection\\Stateful Policy -- List Implementaion\\\n\nrecord 'v stateful_list_policy =\n hostsL :: \"'v list\"\n flows_fixL :: \"('v \\'v) list\"\n flows_stateL :: \"('v \\'v) list\"\n\n\ndefinition stateful_list_policy_to_list_graph :: \"'v stateful_list_policy \\ 'v list_graph\" where\n \"stateful_list_policy_to_list_graph \\ = \\ nodesL = hostsL \\, edgesL = (flows_fixL \\) @ [e \\ flows_stateL \\. e \\ set (flows_fixL \\)] @ [e \\ backlinks (flows_stateL \\). e \\ set (flows_fixL \\)] \\\"\n\nlemma stateful_list_policy_to_list_graph_complies:\n \"list_graph_to_graph (stateful_list_policy_to_list_graph \\ hostsL = V, flows_fixL = E\\<^sub>f, flows_stateL = E\\<^sub>\\ \\) = \n stateful_policy_to_network_graph \\ hosts = set V, flows_fix = set E\\<^sub>f, flows_state = set E\\<^sub>\\ \\\"\n by(simp add: stateful_list_policy_to_list_graph_def stateful_policy_to_network_graph_def all_flows_def list_graph_to_graph_def backlinks_correct, blast)\n\nlemma wf_list_graph_stateful_list_policy_to_list_graph: \n \"wf_list_graph G \\ distinct E \\ set E \\ set (edgesL G) \\ wf_list_graph (stateful_list_policy_to_list_graph \\hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = E\\)\"\n apply(simp add: wf_list_graph_def stateful_list_policy_to_list_graph_def)\n apply(rule conjI)\n apply(simp add: backlinks_distinct)\n apply(rule conjI)\n apply(simp add: backlinks_set)\n apply(blast)\n apply(rule conjI)\n apply(simp add: backlinks_set)\n apply(blast)\n apply(simp add: wf_list_graph_axioms_def)\n apply(rule conjI)\n apply(simp add: backlinks_set)\n apply(force)\n apply(simp add: backlinks_set)\n apply(clarsimp)\n apply(erule disjE)\n apply(auto)[1]\n apply(erule disjE)\n apply(auto)[1]\n by force\n \n\n\nsubsection\\Algorithms\\\n\n fun filter_IFS_no_violations_accu :: \"'v list_graph \\ 'v SecurityInvariant list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations_accu G M accu [] = accu\" |\n \"filter_IFS_no_violations_accu G M accu (e#Es) = (if\n all_security_requirements_fulfilled (TopoS_Composition_Theory_impl.get_IFS M) (stateful_list_policy_to_list_graph \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = (e#accu) \\)\n then filter_IFS_no_violations_accu G M (e#accu) Es\n else filter_IFS_no_violations_accu G M accu Es)\"\n definition filter_IFS_no_violations :: \"'v list_graph \\ 'v SecurityInvariant list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations G M = filter_IFS_no_violations_accu G M [] (edgesL G)\"\n\n lemma filter_IFS_no_violations_accu_distinct: \"\\ distinct (Es@accu) \\ \\ distinct (filter_IFS_no_violations_accu G M accu Es)\"\n apply(induction Es arbitrary: accu)\n by(simp_all)\n\n lemma filter_IFS_no_violations_accu_complies:\n \"\\\\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n wf_list_graph G; set Es \\ set (edgesL G); set accu \\ set (edgesL G); distinct (Es@accu) \\ \\\n filter_IFS_no_violations_accu G (get_impl M) accu Es = TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_accu (list_graph_to_graph G) (get_spec M) accu Es\"\n proof(induction Es arbitrary: accu)\n case Nil\n thus ?case by(simp add: get_impl_def get_spec_def)\n next\n case (Cons e Es)\n \\ \\@{thm Cons.IH[OF Cons.prems(1) Cons.prems(2)]}\\\n let ?caseDistinction = \"all_security_requirements_fulfilled (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (stateful_list_policy_to_list_graph \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = (e#accu) \\)\"\n\n from get_IFS_get_ACS_select_simps(2)[OF Cons.prems(1)] have get_impl_zip_simp: \"(get_impl (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory_impl.get_IFS (get_impl M)\" by simp\n \n from get_IFS_get_ACS_select_simps(3)[OF Cons.prems(1)] have get_spec_zip_simp: \"(get_spec (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory.get_IFS (get_spec M)\" by simp\n \n from Cons.prems(3) Cons.prems(4) have \"set (e # accu) \\ set (edgesL G)\" by simp\n from Cons.prems(4) have \"set (accu) \\ set (edgesL G)\" by simp\n from Cons.prems(5) have \"distinct (e # accu)\" by simp\n from Cons.prems(3) have \"set Es \\ set (edgesL G)\" by simp\n from Cons.prems(5) have \"distinct (Es @ accu)\" by simp\n from Cons.prems(5) have \"distinct (Es @ (e # accu))\" by simp\n\n from Cons.prems(2) have validLG: \"wf_list_graph (stateful_list_policy_to_list_graph \\hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = e # accu\\)\"\n apply(rule wf_list_graph_stateful_list_policy_to_list_graph)\n apply(fact \\distinct (e # accu)\\)\n apply(fact \\set (e # accu) \\ set (edgesL G)\\)\n done\n\n\n from get_IFS_get_ACS_select_simps(1)[OF Cons.prems(1)]\n have \"\\ (m_impl, m_spec) \\ set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))). SecurityInvariant_complies_formal_def m_impl m_spec\" .\n from all_security_requirements_fulfilled_complies[OF this] have all_security_requirements_fulfilled_eq_rule: \n \"\\G. wf_list_graph G \\\n TopoS_Composition_Theory_impl.all_security_requirements_fulfilled (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) G =\n TopoS_Composition_Theory.all_security_requirements_fulfilled (TopoS_Composition_Theory.get_IFS (get_spec M)) (list_graph_to_graph G)\"\n by(simp add: get_impl_zip_simp get_spec_zip_simp)\n\n have case_impl_spec: \"?caseDistinction \\ TopoS_Composition_Theory.all_security_requirements_fulfilled (TopoS_Composition_Theory.get_IFS (get_spec M)) (stateful_policy_to_network_graph \\ hosts = set (nodesL G), flows_fix = set (edgesL G), flows_state = set (e#accu) \\)\"\n apply(subst all_security_requirements_fulfilled_eq_rule[OF validLG])\n by(simp add: stateful_list_policy_to_list_graph_complies)\n\n show ?case\n proof(case_tac ?caseDistinction)\n assume cTrue: ?caseDistinction\n \n from cTrue have g1: \"TopoS_Stateful_Policy_impl.filter_IFS_no_violations_accu G (get_impl M) accu (e # Es) = TopoS_Stateful_Policy_impl.filter_IFS_no_violations_accu G (get_impl M) (e # accu) Es\" by simp\n\n from cTrue[simplified case_impl_spec] have g2: \"TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_accu (list_graph_to_graph G) (get_spec M) accu (e # Es) =\n TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_accu (list_graph_to_graph G) (get_spec M) (e#accu)Es\"\n by(simp add: list_graph_to_graph_def)\n\n show ?case\n apply(simp only: g1 g2)\n using Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ set (edgesL G)\\ \\set (e # accu) \\ set (edgesL G)\\ \\distinct (Es @ (e # accu))\\] by simp\n next\n assume cFalse: \"\\ ?caseDistinction\"\n\n from cFalse have g1: \"TopoS_Stateful_Policy_impl.filter_IFS_no_violations_accu G (get_impl M) accu (e # Es) = TopoS_Stateful_Policy_impl.filter_IFS_no_violations_accu G (get_impl M) accu Es\" by simp\n\n from cFalse[simplified case_impl_spec] have g2: \"TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_accu (list_graph_to_graph G) (get_spec M) accu (e # Es) =\n TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_accu (list_graph_to_graph G) (get_spec M) accu Es\"\n by(simp add: list_graph_to_graph_def)\n\n show ?case\n apply(simp only: g1 g2)\n using Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ set (edgesL G)\\ \\set accu \\ set (edgesL G)\\ \\distinct (Es @ accu)\\] by simp\n qed\n qed\n\n\n\n lemma filter_IFS_no_violations_complies:\n \"\\ \\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec; wf_list_graph G \\ \\\n filter_IFS_no_violations G (get_impl M) = TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations (list_graph_to_graph G) (get_spec M) (edgesL G)\"\n apply(unfold filter_IFS_no_violations_def TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations_def) \n apply(rule filter_IFS_no_violations_accu_complies)\n apply(simp_all)\n apply(simp add: wf_list_graph_def)\n done\n\n\n\n\n\n fun filter_compliant_stateful_ACS_accu :: \"'v list_graph \\ 'v SecurityInvariant list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS_accu G M accu [] = accu\" |\n \"filter_compliant_stateful_ACS_accu G M accu (e#Es) = (if\n e \\ set (backlinks (edgesL G)) \\ (\\F \\ set (implc_get_offending_flows (get_ACS M) (stateful_list_policy_to_list_graph \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = (e#accu) \\)). set F \\ set (backlinks (e#accu)))\n then filter_compliant_stateful_ACS_accu G M (e#accu) Es\n else filter_compliant_stateful_ACS_accu G M accu Es)\"\n definition filter_compliant_stateful_ACS :: \"'v list_graph \\ 'v SecurityInvariant list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS G M = filter_compliant_stateful_ACS_accu G M [] (edgesL G)\"\n\n\n lemma filter_compliant_stateful_ACS_accu_complies: \n \"\\\\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n wf_list_graph G; set Es \\ set (edgesL G); set accu \\ set (edgesL G); distinct (Es@accu) \\ \\\n filter_compliant_stateful_ACS_accu G (get_impl M) accu Es = TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_accu (list_graph_to_graph G) (get_spec M) accu Es\"\n proof(induction Es arbitrary: accu)\n case Nil\n thus ?case by(simp add: get_impl_def get_spec_def)\n next\n case (Cons e Es)\n \\ \\@{thm Cons.IH[OF Cons.prems(1) Cons.prems(2)]}\\\n let ?caseDistinction = \"e \\ set (backlinks (edgesL G)) \\ (\\F \\ set (implc_get_offending_flows (get_ACS (get_impl M)) (stateful_list_policy_to_list_graph \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = (e#accu) \\)). set F \\ set (backlinks (e#accu)))\"\n \n have backlinks_simp: \"(e \\ set (backlinks (edgesL G))) \\ (e \\ backflows (set (edgesL G)))\"\n by(simp add: backlinks_correct)\n\n have \"\\ G X. (\\F\\set (implc_get_offending_flows (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) G). set F \\ X) =\n (\\F\\set ` set (implc_get_offending_flows (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) G). F \\ X)\" by blast\n also have \"\\ G X. wf_list_graph G \\ (\\F\\set ` set (implc_get_offending_flows (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) G). F \\ X) =\n (\\F\\get_offending_flows (TopoS_Composition_Theory.get_ACS (get_spec M)) (list_graph_to_graph G). F \\ X)\"\n using implc_get_offending_flows_complies[OF get_IFS_get_ACS_select_simps(4)[OF Cons.prems(1)], simplified get_IFS_get_ACS_select_simps[OF Cons.prems(1)]] by simp\n finally have implc_get_offending_flows_simp_rule: \"\\G X. wf_list_graph G \\ \n (\\F\\set (implc_get_offending_flows (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) G). set F \\ X) = (\\F\\get_offending_flows (TopoS_Composition_Theory.get_ACS (get_spec M)) (list_graph_to_graph G). F \\ X)\" .\n\n\n from Cons.prems(3) Cons.prems(4) have \"set (e # accu) \\ set (edgesL G)\" by simp\n from Cons.prems(4) have \"set (accu) \\ set (edgesL G)\" by simp\n from Cons.prems(5) have \"distinct (e # accu)\" by simp\n from Cons.prems(3) have \"set Es \\ set (edgesL G)\" by simp\n from Cons.prems(5) have \"distinct (Es @ accu)\" by simp\n from Cons.prems(5) have \"distinct (Es @ (e # accu))\" by simp\n from Cons.prems(2) have validLG: \"wf_list_graph (stateful_list_policy_to_list_graph \\hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = e # accu\\)\"\n apply(rule wf_list_graph_stateful_list_policy_to_list_graph)\n apply(fact \\distinct (e # accu)\\)\n apply(fact \\set (e # accu) \\ set (edgesL G)\\)\n done\n\n have \"set (backlinks (e # accu)) = backflows (insert e (set accu))\"\n by(simp add: backlinks_set backflows_def)\n \n \\ \\@{thm implc_get_offending_flows_simp_rule[OF validLG]}\\\n have case_impl_spec: \"?caseDistinction \\ (\n e \\ backflows (set (edgesL G)) \\ (\\F \\ get_offending_flows (TopoS_Composition_Theory.get_ACS (get_spec M)) (stateful_policy_to_network_graph \\ hosts = set (nodesL G), flows_fix = set (edgesL G), flows_state = set (e#accu) \\). F \\ (backflows (set (e#accu)))))\" \n apply(simp add: backlinks_simp)\n apply(simp add: implc_get_offending_flows_simp_rule[OF validLG])\n apply(simp add: stateful_list_policy_to_list_graph_complies)\n by(simp add: \\set (backlinks (e # accu)) = backflows (insert e (set accu))\\)\n \n\n show ?case\n proof(case_tac ?caseDistinction)\n assume cTrue: ?caseDistinction\n \n from cTrue have g1: \"TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS_accu G (get_impl M) accu (e # Es) = TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS_accu G (get_impl M) (e#accu) Es\" by simp\n\n from cTrue[simplified case_impl_spec] have g2: \"TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_accu (list_graph_to_graph G) (get_spec M) accu (e # Es) =\n TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_accu (list_graph_to_graph G) (get_spec M) (e#accu) Es\"\n by(simp add: list_graph_to_graph_def)\n\n show ?case\n apply(simp only: g1 g2)\n using Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ set (edgesL G)\\ \\set (e # accu) \\ set (edgesL G)\\ \\distinct (Es @ (e # accu))\\] by simp\n next\n assume cFalse: \"\\ (?caseDistinction)\"\n\n from cFalse have g1: \"TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS_accu G (get_impl M) accu (e # Es) = TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS_accu G (get_impl M) accu Es\" by force\n\n from cFalse[simplified case_impl_spec] have g2: \"TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_accu (list_graph_to_graph G) (get_spec M) accu (e # Es) =\n TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_accu (list_graph_to_graph G) (get_spec M) accu Es\"\n apply(simp add: list_graph_to_graph_def) by fast\n\n show ?case\n apply(simp only: g1 g2)\n using Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ set (edgesL G)\\ \\set accu \\ set (edgesL G)\\ \\distinct (Es @ accu)\\] by simp\n qed\n qed\n\n\n lemma filter_compliant_stateful_ACS_cont_complies:\n \"\\ \\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec; wf_list_graph G; set Es \\ set (edgesL G); distinct Es \\ \\\n filter_compliant_stateful_ACS_accu G (get_impl M) [] Es = TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS (list_graph_to_graph G) (get_spec M) Es\"\n apply(unfold filter_compliant_stateful_ACS_def TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_def) \n apply(rule filter_compliant_stateful_ACS_accu_complies)\n apply(simp_all)\n done\n\n lemma filter_compliant_stateful_ACS_complies:\n \"\\ \\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec; wf_list_graph G \\ \\\n filter_compliant_stateful_ACS G (get_impl M) = TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS (list_graph_to_graph G) (get_spec M) (edgesL G)\"\n apply(unfold filter_compliant_stateful_ACS_def TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS_def) \n apply(rule filter_compliant_stateful_ACS_accu_complies)\n apply(simp_all)\n apply(simp add: wf_list_graph_def)\n done\n\n\n(*TODO: show wf_stateful_policy and distinctness and wf_list_graph, ...*)\n\n\n definition generate_valid_stateful_policy_IFSACS :: \"'v list_graph \\ 'v SecurityInvariant list \\ 'v stateful_list_policy\" where\n \"generate_valid_stateful_policy_IFSACS G M = (let filterIFS = filter_IFS_no_violations G M in\n (let filterACS = filter_compliant_stateful_ACS_accu G M [] filterIFS in \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = filterACS \\))\"\n\n\n\n fun inefficient_list_intersect :: \"'a list \\ 'a list \\ 'a list\" where\n \"inefficient_list_intersect [] bs = []\" |\n \"inefficient_list_intersect (a#as) bs = (if a \\ set bs then a#(inefficient_list_intersect as bs) else inefficient_list_intersect as bs)\"\n lemma inefficient_list_intersect_correct: \"set (inefficient_list_intersect a b) = (set a) \\ (set b)\"\n apply(induction a)\n by(simp_all)\n\n definition generate_valid_stateful_policy_IFSACS_2 :: \"'v list_graph \\ 'v SecurityInvariant list \\ 'v stateful_list_policy\" where\n \"generate_valid_stateful_policy_IFSACS_2 G M =\n \\ hostsL = nodesL G, flows_fixL = edgesL G, flows_stateL = inefficient_list_intersect (filter_IFS_no_violations G M) (filter_compliant_stateful_ACS G M) \\\"\n\n\n lemma generate_valid_stateful_policy_IFSACS_2_complies: \"\\\\ (m_impl, m_spec) \\ set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n wf_list_graph G;\n valid_reqs (get_spec M);\n TopoS_Composition_Theory.all_security_requirements_fulfilled (get_spec M) (list_graph_to_graph G);\n \\ = (generate_valid_stateful_policy_IFSACS_2 G (get_impl M))\\ \\ \n stateful_policy_compliance \\hosts = set (hostsL \\), flows_fix = set (flows_fixL \\), flows_state = set (flows_stateL \\) \\ (list_graph_to_graph G) (get_spec M)\"\n apply(rule_tac edgesList=\"edgesL G\" in generate_valid_stateful_policy_IFSACS_2_stateful_policy_compliance)\n apply(simp)\n apply (metis wf_list_graph_def wf_list_graph_iff_wf_graph)\n apply(simp)\n apply(simp add: list_graph_to_graph_def)\n apply(simp add: TopoS_Stateful_Policy_Algorithm.generate_valid_stateful_policy_IFSACS_2_def TopoS_Stateful_Policy_impl.generate_valid_stateful_policy_IFSACS_2_def)\n apply(simp add: list_graph_to_graph_def inefficient_list_intersect_correct)\n apply(thin_tac \"\\ = _\")\n apply(frule(1) filter_compliant_stateful_ACS_complies)\n apply(frule(1) filter_IFS_no_violations_complies)\n apply(thin_tac \"_\")\n apply(thin_tac \"_\")\n apply(thin_tac \"_\")\n apply(thin_tac \"_\")\n apply(simp)\n by (metis list_graph_to_graph_def)\n \n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Stateful_Policy_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.29903060995949104}} {"text": "subsection \\Heap Memory Implementations\\\n\ntheory Memory_Heap\n imports State_Heap DP_CRelVH Pair_Memory \"HOL-Eisbach.Eisbach\" \"../Index\"\nbegin\n\ntext \\Move\\\nabbreviation \"result_of c h \\ fst (the (execute c h))\"\nabbreviation \"heap_of c h \\ snd (the (execute c h))\"\n\nlemma map_emptyI:\n \"m \\\\<^sub>m Map.empty\" if \"\\ x. m x = None\"\n using that unfolding map_le_def by auto\n\nlemma result_of_return[simp]:\n \"result_of (Heap_Monad.return x) h = x\"\n by (simp add: execute_simps)\n\nlemma get_result_of_lookup:\n \"result_of (!r) heap = x\" if \"Ref.get heap r = x\"\n using that by (auto simp: execute_simps)\n\ncontext\n fixes size :: nat\n and to_index :: \"('k2 :: heap) \\ nat\"\nbegin\n\ndefinition\n \"mem_empty = (Array.new size (None :: ('v :: heap) option))\"\n\nlemma success_empty[intro]:\n \"success mem_empty heap\"\n unfolding mem_empty_def by (auto intro: success_intros)\n\nlemma length_mem_empty:\n \"Array.length\n (heap_of (mem_empty:: (('b :: heap) option array) Heap) h)\n (result_of (mem_empty :: ('b option array) Heap) h) = size\"\n unfolding mem_empty_def by (auto simp: execute_simps Array.length_alloc)\n\nlemma nth_mem_empty:\n \"result_of\n (Array.nth (result_of (mem_empty :: ('b option array) Heap) h) i)\n (heap_of (mem_empty :: (('b :: heap) option array) Heap) h) = None\" if \"i < size\"\n apply (subst execute_nth(1))\n apply (simp add: length_mem_empty that)\n apply (simp add: execute_simps mem_empty_def Array.get_alloc that)\n done\n\ncontext\n fixes mem :: \"('v :: heap) option array\"\nbegin\n\ndefinition\n \"mem_lookup k = (let i = to_index k in\n if i < size then Array.nth mem i else return None\n )\"\n\ndefinition\n \"mem_update k v = (let i = to_index k in\n if i < size then (Array.upd i (Some v) mem \\ (\\ _. return ()))\n else return ()\n )\n \"\n\ncontext assumes injective: \"injective size to_index\"\nbegin\n\ninterpretation heap_correct \"\\heap. Array.length heap mem = size\" mem_update mem_lookup\n apply standard\n subgoal lookup_inv\n unfolding State_Heap.lift_p_def mem_lookup_def by (simp add: Let_def execute_simps)\n subgoal update_inv\n unfolding State_Heap.lift_p_def mem_update_def by (simp add: Let_def execute_simps)\n subgoal for k heap\n unfolding heap_mem_defs.map_of_heap_def map_le_def mem_lookup_def\n by (auto simp: execute_simps Let_def split: if_split_asm)\n subgoal for heap k\n unfolding heap_mem_defs.map_of_heap_def map_le_def mem_lookup_def mem_update_def\n apply (auto simp: execute_simps Let_def length_def split: if_split_asm)\n apply (subst (asm) nth_list_update_neq)\n using injective[unfolded injective_def] apply auto\n done\n done\n\nlemmas mem_heap_correct = heap_correct_axioms\n\ncontext\n assumes [simp]: \"mem = result_of mem_empty Heap.empty\"\nbegin\n\ninterpretation heap_correct_empty\n \"\\heap. Array.length heap mem = size\" mem_update mem_lookup\n \"heap_of (mem_empty :: 'v option array Heap) Heap.empty\"\n apply standard\n subgoal\n apply (rule map_emptyI)\n unfolding map_of_heap_def mem_lookup_def by (auto simp: Let_def nth_mem_empty)\n subgoal\n by (simp add: length_mem_empty)\n done\n\nlemmas array_heap_emptyI = heap_correct_empty_axioms\n\ncontext\n fixes dp :: \"'k2 \\ 'v\"\nbegin\n\ninterpretation dp_consistency_heap_empty\n \"\\heap. Array.length heap mem = size\" mem_update mem_lookup dp\n \"heap_of (mem_empty :: 'v option array Heap) Heap.empty\"\n by standard\n\nlemmas array_consistentI = dp_consistency_heap_empty_axioms\n\nend\n\nend (* Empty Memory *)\n\nend (* Injectivity *)\n\nend (* Fixed array *)\n\nlemma execute_bind_success':\n assumes \"success f h\" \"execute (f \\ g) h = Some (y, h'')\"\n obtains x h' where \"execute f h = Some (x, h')\" \"execute (g x) h' = Some (y, h'')\"\n using assms by (auto simp: execute_simps elim: successE)\n\nlemma success_bind_I:\n assumes \"success f h\"\n and \"\\ x h'. execute f h = Some (x, h') \\ success (g x) h'\"\n shows \"success (f \\ g) h\"\n by (rule successE[OF assms(1)]) (auto elim: assms(2) intro: success_bind_executeI)\n\ndefinition\n \"alloc_pair a b \\ do {\n r1 \\ ref a;\n r2 \\ ref b;\n return (r1, r2)\n }\"\n\nlemma alloc_pair_alloc:\n \"Ref.get heap' r1 = a\" \"Ref.get heap' r2 = b\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis Ref.get_alloc fst_conv get_alloc_neq next_present present_alloc_neq snd_conv)+\n\nlemma alloc_pairD1:\n \"r =!= r1 \\ r =!= r2 \\ Ref.present heap' r\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Ref.present heap r\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis next_fresh noteq_I Ref.present_alloc snd_conv)+\n\nlemma alloc_pairD2:\n \"r1 =!= r2 \\ Ref.present heap' r2 \\ Ref.present heap' r1\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis next_fresh next_present noteq_I Ref.present_alloc snd_conv)+\n\nlemma alloc_pairD3:\n \"Array.present heap' r\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Array.present heap r\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis array_present_alloc snd_conv)\n\nlemma alloc_pairD4:\n \"Ref.get heap' r = x\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n \"Ref.get heap r = x\" \"Ref.present heap r\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis Ref.not_present_alloc Ref.present_alloc get_alloc_neq noteq_I snd_conv)\n\nlemma alloc_pair_array_get:\n \"Array.get heap' r = x\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Array.get heap r = x\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis array_get_alloc snd_conv)\n\nlemma alloc_pair_array_length:\n \"Array.length heap' r = Array.length heap r\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n using that unfolding alloc_pair_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis Ref.length_alloc snd_conv)\n\nlemma alloc_pair_nth:\n \"result_of (Array.nth r i) heap' = result_of (Array.nth r i) heap\"\n if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n using alloc_pair_array_get[OF that(1) HOL.refl, of r] alloc_pair_array_length[OF that(1), of r]\n by (cases \"(\\h. i < Array.length h r) heap\"; simp add: execute_simps Array.nth_def)\n\nlemma succes_alloc_pair[intro]:\n \"success (alloc_pair a b) heap\"\n unfolding alloc_pair_def by (auto intro: success_intros success_bind_I)\n\ndefinition\n \"init_state_inner k1 k2 m1 m2 \\ do {\n (k_ref1, k_ref2) \\ alloc_pair k1 k2;\n (m_ref1, m_ref2) \\ alloc_pair m1 m2;\n return (k_ref1, k_ref2, m_ref1, m_ref2)\n }\n \"\n\nlemma init_state_inner_alloc:\n assumes\n \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Ref.get heap' k_ref1 = k1\" \"Ref.get heap' k_ref2 = k2\"\n \"Ref.get heap' m_ref1 = m1\" \"Ref.get heap' m_ref2 = m2\"\n using assms unfolding init_state_inner_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n (auto intro: alloc_pair_alloc dest: alloc_pairD2 elim: alloc_pairD4)\n\nlemma init_state_inner_distinct:\n assumes\n \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"m_ref1 =!= m_ref2 \\ m_ref1 =!= k_ref1 \\ m_ref1 =!= k_ref2 \\ m_ref2 =!= k_ref1\n \\ m_ref2 =!= k_ref2 \\ k_ref1 =!= k_ref2\"\n using assms unfolding init_state_inner_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n (blast dest: alloc_pairD1 alloc_pairD2 intro: noteq_sym)+\n\nlemma init_state_inner_present:\n assumes\n \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Ref.present heap' k_ref1\" \"Ref.present heap' k_ref2\"\n \"Ref.present heap' m_ref1\" \"Ref.present heap' m_ref2\"\n using assms unfolding init_state_inner_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n (blast dest: alloc_pairD1 alloc_pairD2)+\n\nlemma inite_state_inner_present':\n assumes\n \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n \"Array.present heap a\"\n shows\n \"Array.present heap' a\"\n using assms unfolding init_state_inner_def\n by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair] alloc_pairD3)\n\nlemma succes_init_state_inner[intro]:\n \"success (init_state_inner k1 k2 m1 m2) heap\"\n unfolding init_state_inner_def by (auto 4 3 intro: success_intros success_bind_I)\n\nlemma init_state_inner_nth:\n \"result_of (Array.nth r i) heap' = result_of (Array.nth r i) heap\"\n if \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((r1, r2), heap')\"\n using that unfolding init_state_inner_def\n by (auto simp: execute_simps alloc_pair_nth elim!: execute_bind_success'[OF succes_alloc_pair])\n\ndefinition\n \"init_state k1 k2 \\ do {\n m1 \\ mem_empty;\n m2 \\ mem_empty;\n init_state_inner k1 k2 m1 m2\n }\"\n\n\n\ndefinition\n \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2 \\\n m_ref1 =!= m_ref2 \\ m_ref1 =!= k_ref1 \\ m_ref1 =!= k_ref2 \\ m_ref2 =!= k_ref1\n \\ m_ref2 =!= k_ref2 \\ k_ref1 =!= k_ref2\n \"\n\nlemma init_state_distinct:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\n using assms unfolding init_state_def inv_distinct_def\n by (elim execute_bind_success'[OF success_empty] init_state_inner_distinct)\n\nlemma init_state_present:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Ref.present heap' k_ref1\" \"Ref.present heap' k_ref2\"\n \"Ref.present heap' m_ref1\" \"Ref.present heap' m_ref2\"\n using assms unfolding init_state_def\n by (auto\n simp: execute_simps elim!: execute_bind_success'[OF success_empty]\n dest: init_state_inner_present\n )\n\nlemma empty_present:\n \"Array.present h' x\" if \"execute mem_empty heap = Some (x, h')\"\n using that unfolding mem_empty_def\n by (auto simp: execute_simps) (metis Array.present_alloc fst_conv snd_conv)\n\nlemma empty_present':\n \"Array.present h' a\" if \"execute mem_empty heap = Some (x, h')\" \"Array.present heap a\"\n using that unfolding mem_empty_def\n by (auto simp: execute_simps Array.present_def Array.alloc_def Array.set_def Let_def)\n\nlemma init_state_present2:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Array.present heap' (Ref.get heap' m_ref1)\" \"Array.present heap' (Ref.get heap' m_ref2)\"\n using assms unfolding init_state_def\n by (auto 4 3\n simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n dest: inite_state_inner_present' empty_present empty_present'\n )\n\nlemma init_state_neq:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Ref.get heap' m_ref1 =!!= Ref.get heap' m_ref2\"\n using assms unfolding init_state_def\n by (auto 4 3\n simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n dest: inite_state_inner_present' empty_present empty_present'\n )\n (metis empty_present execute_new fst_conv mem_empty_def option.inject present_alloc_noteq)\n\nlemma present_alloc_get:\n \"Array.get heap' a = Array.get heap a\"\n if \"Array.alloc xs heap = (a', heap')\" \"Array.present heap a\"\n using that by (auto simp: Array.alloc_def Array.present_def Array.get_def Let_def Array.set_def)\n\nlemma init_state_length:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows\n \"Array.length heap' (Ref.get heap' m_ref1) = size\"\n \"Array.length heap' (Ref.get heap' m_ref2) = size\"\n using assms unfolding init_state_def\n apply (auto\n simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n dest: inite_state_inner_present' empty_present empty_present'\n )\n apply (auto\n simp: execute_simps init_state_inner_def alloc_pair_def mem_empty_def Array.length_def\n elim!: execute_bind_success'[OF success_refI]\n )\n apply (metis\n Array.alloc_def Array.get_set_eq Array.present_alloc array_get_alloc fst_conv length_replicate\n present_alloc_get snd_conv\n )+\n done\n\ncontext\n fixes key1 :: \"'k \\ ('k1 :: heap)\" and key2 :: \"'k \\ 'k2\"\n and m_ref1 m_ref2 :: \"('v :: heap) option array ref\"\n and k_ref1 k_ref2 :: \"('k1 :: heap) ref\"\nbegin\n\ntext \\We assume that look-ups happen on the older row, so this is biased towards the second entry.\\\ndefinition\n \"lookup_pair k = do {\n let k' = key1 k;\n k2 \\ !k_ref2;\n if k' = k2 then\n do {\n m2 \\ !m_ref2;\n mem_lookup m2 (key2 k)\n }\n else\n do {\n k1 \\ !k_ref1;\n if k' = k1 then\n do {\n m1 \\ !m_ref1;\n mem_lookup m1 (key2 k)\n }\n else\n return None\n }\n }\n \"\n\ntext \\We assume that updates happen on the newer row, so this is biased towards the first entry.\\\ndefinition\n \"update_pair k v = do {\n let k' = key1 k;\n k1 \\ !k_ref1;\n if k' = k1 then do {\n m \\ !m_ref1;\n mem_update m (key2 k) v\n }\n else do {\n k2 \\ !k_ref2;\n if k' = k2 then do {\n m \\ !m_ref2;\n mem_update m (key2 k) v\n }\n else do {\n do {\n k1 \\ !k_ref1;\n m \\ mem_empty;\n m1 \\ !m_ref1;\n k_ref2 := k1;\n k_ref1 := k';\n m_ref2 := m1;\n m_ref1 := m\n }\n ;\n m \\ !m_ref1;\n mem_update m (key2 k) v\n }\n }\n }\n \"\n\ndefinition\n \"inv_pair_weak heap = (\n let\n m1 = Ref.get heap m_ref1;\n m2 = Ref.get heap m_ref2\n in Array.length heap m1 = size \\ Array.length heap m2 = size\n \\ Ref.present heap k_ref1 \\ Ref.present heap k_ref2\n \\ Ref.present heap m_ref1 \\ Ref.present heap m_ref2\n \\ Array.present heap m1 \\ Array.present heap m2\n \\ m1 =!!= m2\n )\"\n\n(* TODO: Remove? *)\ndefinition\n \"inv_pair heap \\ inv_pair_weak heap \\ inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\n\nlemma init_state_inv:\n assumes\n \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n shows \"inv_pair_weak heap'\"\n using assms unfolding inv_pair_weak_def Let_def\n by (auto intro:\n init_state_present init_state_present2 init_state_neq init_state_length\n init_state_distinct\n )\n\nlemma inv_pair_lengthD1:\n \"Array.length heap (Ref.get heap m_ref1) = size\" if \"inv_pair_weak heap\"\n using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_lengthD2:\n \"Array.length heap (Ref.get heap m_ref2) = size\" if \"inv_pair_weak heap\"\n using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_presentD:\n \"Array.present heap (Ref.get heap m_ref1)\" \"Array.present heap (Ref.get heap m_ref2)\"\n if \"inv_pair_weak heap\"\n using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_presentD2:\n \"Ref.present heap m_ref1\" \"Ref.present heap m_ref2\"\n \"Ref.present heap k_ref1\" \"Ref.present heap k_ref2\"\n if \"inv_pair_weak heap\"\n using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_not_eqD:\n \"Ref.get heap m_ref1 =!!= Ref.get heap m_ref2\" if \"inv_pair_weak heap\"\n using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\ndefinition \"lookup1 k \\ state_of (do {m \\ !m_ref1; mem_lookup m k})\"\n\ndefinition \"lookup2 k \\ state_of (do {m \\ !m_ref2; mem_lookup m k})\"\n\ndefinition \"update1 k v \\ state_of (do {m \\ !m_ref1; mem_update m k v})\"\n\ndefinition \"update2 k v \\ state_of (do {m \\ !m_ref2; mem_update m k v})\"\n\ndefinition \"move12 k \\ state_of (do {\n k1 \\ !k_ref1;\n m \\ mem_empty;\n m1 \\ !m_ref1;\n k_ref2 := k1;\n k_ref1 := k;\n m_ref2 := m1;\n m_ref1 := m\n })\n \"\n\ndefinition \"get_k1 \\ state_of (!k_ref1)\"\n\ndefinition \"get_k2 \\ state_of (!k_ref2)\"\n\nlemma run_state_state_of[simp]:\n \"State_Monad.run_state (state_of p) m = the (execute p m)\"\n unfolding state_of_def by simp\n\ncontext assumes injective: \"injective size to_index\"\nbegin\n\ncontext\n assumes inv_distinct: \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\nbegin\n\nlemma disjoint[simp]:\n \"m_ref1 =!= m_ref2\" \"m_ref1 =!= k_ref1\" \"m_ref1 =!= k_ref2\"\n \"m_ref2 =!= k_ref1\" \"m_ref2 =!= k_ref2\"\n \"k_ref1 =!= k_ref2\"\n using inv_distinct unfolding inv_distinct_def by auto\n\nlemmas [simp] = disjoint[THEN noteq_sym]\n\n\n\nlemma [simp]:\n \"Ref.get (snd (Array.alloc xs heap)) r = Ref.get heap r\" if \"Ref.present heap r\"\n using that unfolding Array.alloc_def Ref.present_def\n by (simp add: Let_def Ref.get_def Array.set_def)\n\n\n\nlemma alloc_present':\n \"Ref.present (snd (Array.alloc xs heap)) r\" if \"Ref.present heap r\"\n using that unfolding Ref.present_def Array.alloc_def by (simp add: Let_def Array.set_def)\n\nlemma length_get_upd[simp]:\n \"length (Array.get (Array.update a i x heap) r) = length (Array.get heap r)\"\n unfolding Array.get_def Array.update_def Array.set_def by simp\n\nmethod solve1 =\n (frule inv_pair_lengthD1, frule inv_pair_lengthD2, frule inv_pair_not_eqD)?,\n auto split: if_split_asm dest: Array.noteq_sym\n\ninterpretation pair: pair_mem lookup1 lookup2 update1 update2 move12 get_k1 get_k2 inv_pair_weak\n supply [simp] =\n mem_empty_def state_mem_defs.map_of_def map_le_def\n move12_def update1_def update2_def lookup1_def lookup2_def get_k1_def get_k2_def\n mem_update_def mem_lookup_def\n execute_bind_success[OF success_newI] execute_simps Let_def Array.get_alloc length_def\n inv_pair_presentD inv_pair_presentD2\n Memory_Heap.lookup1_def Memory_Heap.lookup2_def Memory_Heap.mem_lookup_def\n apply standard\n apply (solve1; fail)+\n subgoal\n apply (rule lift_pI)\n unfolding inv_pair_weak_def\n apply (auto simp:\n intro: alloc_present alloc_present'\n elim: present_alloc_noteq[THEN Array.noteq_sym]\n )\n done\n apply (rule lift_pI, unfold inv_pair_weak_def, auto split: if_split_asm; fail)+\n apply (solve1; fail)+\n subgoal\n using injective[unfolded injective_def] by - (solve1, subst (asm) nth_list_update_neq, auto)\n subgoal\n using injective[unfolded injective_def] by - (solve1, subst (asm) nth_list_update_neq, auto)\n apply (solve1; fail)+\n done\n\nlemmas mem_correct_pair = pair.mem_correct_pair\n\ndefinition\n \"mem_lookup1 k = do {m \\ !m_ref1; mem_lookup m k}\"\n\ndefinition\n \"mem_lookup2 k = do {m \\ !m_ref2; mem_lookup m k}\"\n\ndefinition \"get_k1' \\ !k_ref1\"\n\ndefinition \"get_k2' \\ !k_ref2\"\n\ndefinition \"update1' k v \\ do {m \\ !m_ref1; mem_update m k v}\"\n\ndefinition \"update2' k v \\ do {m \\ !m_ref2; mem_update m k v}\"\n\ndefinition \"move12' k \\ do {\n k1 \\ !k_ref1;\n m \\ mem_empty;\n m1 \\ !m_ref1;\n k_ref2 := k1;\n k_ref1 := k;\n m_ref2 := m1;\n m_ref1 := m\n }\"\n\ninterpretation heap_mem_defs inv_pair_weak lookup_pair update_pair .\n\nlemma rel_state_ofI:\n \"rel_state (=) (state_of m) m\" if\n \"\\ heap. inv_pair_weak heap \\ success m heap\"\n \"lift_p inv_pair_weak m\"\n using that unfolding rel_state_def\n by (auto split: option.split intro: lift_p_P'' simp: success_def)\n\nlemma inv_pair_iff:\n \"inv_pair_weak = inv_pair\"\n unfolding inv_pair_def using inv_distinct by simp\n\nlemma lift_p_inv_pairI:\n \"State_Heap.lift_p inv_pair m\" if \"State_Heap.lift_p inv_pair_weak m\"\n using that unfolding inv_pair_iff by simp\n\nlemma lift_p_success:\n \"State_Heap.lift_p inv_pair_weak m\"\n if \"DP_CRelVS.lift_p inv_pair_weak (state_of m)\" \"\\ heap. inv_pair_weak heap \\ success m heap\"\n using that\n unfolding lift_p_def DP_CRelVS.lift_p_def\n by (auto simp: success_def split: option.split)\n\nlemma rel_state_ofI2:\n \"rel_state (=) (state_of m) m\" if\n \"\\ heap. inv_pair_weak heap \\ success m heap\"\n \"DP_CRelVS.lift_p inv_pair_weak (state_of m)\"\n using that by (blast intro: rel_state_ofI lift_p_success)\n\ncontext\n includes lifting_syntax\nbegin\n\n\n\nlemma [transfer_rule]:\n \"((=) ===> rel_state (rel_option (=))) lookup1 mem_lookup1\"\n unfolding lookup1_def mem_lookup1_def\n apply (intro rel_funI)\n apply (simp add: option.rel_eq)\n apply (rule rel_state_ofI2)\n subgoal\n by (auto 4 4\n simp: mem_lookup_def inv_pair_lengthD1 execute_simps Let_def\n intro: success_bind_executeI success_returnI Array.success_nthI\n )\n subgoal\n using pair.lookup_inv(1) unfolding lookup1_def .\n done\n\nlemma [transfer_rule]:\n \"((=) ===> rel_state (rel_option (=))) lookup2 mem_lookup2\"\n unfolding lookup2_def mem_lookup2_def\n apply (intro rel_funI)\n apply (simp add: option.rel_eq)\n apply (rule rel_state_ofI2)\n subgoal\n by (auto 4 3\n simp: mem_lookup_def inv_pair_lengthD2 execute_simps Let_def\n intro: success_intros intro!: success_bind_I\n )\n subgoal\n using pair.lookup_inv(2) unfolding lookup2_def .\n done\n\nlemma [transfer_rule]:\n \"rel_state (=) get_k1 get_k1'\"\n unfolding get_k1_def get_k1'_def\n apply (rule rel_state_ofI2)\n subgoal\n by (auto intro: success_lookupI)\n subgoal\n unfolding get_k1_def[symmetric] by (auto dest: pair.get_state(1) intro: lift_pI)\n done\n\nlemma [transfer_rule]:\n \"rel_state (=) get_k2 get_k2'\"\n unfolding get_k2_def get_k2'_def\n apply (rule rel_state_ofI2)\n subgoal\n by (auto intro: success_lookupI)\n subgoal\n unfolding get_k2_def[symmetric] by (auto dest: pair.get_state(2) intro: lift_pI)\n done\n\nlemma [transfer_rule]:\n \"((=) ===> (=) ===> rel_state (=)) update1 update1'\"\n unfolding update1_def update1'_def\n apply (intro rel_funI)\n apply simp\n apply (rule rel_state_ofI2)\n subgoal\n by (auto 4 3\n simp: mem_update_def inv_pair_lengthD1 execute_simps Let_def\n intro: success_intros intro!: success_bind_I\n )\n subgoal\n using pair.update_inv(1) unfolding update1_def .\n done\n\nlemma [transfer_rule]:\n \"((=) ===> (=) ===> rel_state (=)) update2 update2'\"\n unfolding update2_def update2'_def\n apply (intro rel_funI)\n apply simp\n apply (rule rel_state_ofI2)\n subgoal\n by (auto 4 3\n simp: mem_update_def inv_pair_lengthD2 execute_simps Let_def\n intro: success_intros intro!: success_bind_I\n )\n subgoal\n using pair.update_inv(2) unfolding update2_def .\n done\n\nlemma [transfer_rule]:\n \"((=) ===> rel_state (rel_option (=))) lookup1 mem_lookup1\"\n unfolding lookup1_def mem_lookup1_def\n apply (intro rel_funI)\n apply (simp add: option.rel_eq)\n apply (rule rel_state_ofI2)\n subgoal\n by (auto 4 3\n simp: mem_lookup_def inv_pair_lengthD1 execute_simps Let_def\n intro: success_intros intro!: success_bind_I\n )\n subgoal\n using pair.lookup_inv(1) unfolding lookup1_def .\n done\n\nlemma rel_state_lookup:\n \"((=) ===> rel_state (=)) pair.lookup_pair lookup_pair\"\n unfolding pair.lookup_pair_def lookup_pair_def\n unfolding\n mem_lookup1_def[symmetric] mem_lookup2_def[symmetric]\n get_k2_def[symmetric] get_k2'_def[symmetric]\n get_k1_def[symmetric] get_k1'_def[symmetric]\n by transfer_prover\n\nlemma rel_state_update:\n \"((=) ===> (=) ===> rel_state (=)) pair.update_pair update_pair\"\n unfolding pair.update_pair_def update_pair_def\n unfolding move12'_def[symmetric]\n unfolding\n update1'_def[symmetric] update2'_def[symmetric]\n get_k2_def[symmetric] get_k2'_def[symmetric]\n get_k1_def[symmetric] get_k1'_def[symmetric]\n by transfer_prover\n\ninterpretation mem: heap_mem_defs pair.inv_pair lookup_pair update_pair .\n\nlemma inv_pairD:\n \"inv_pair_weak heap\" if \"pair.inv_pair heap\"\n using that unfolding pair.inv_pair_def by (auto simp: Let_def)\n\nlemma mem_rel_state_ofI:\n \"mem.rel_state (=) m' m\" if\n \"rel_state (=) m' m\"\n \"\\ heap. pair.inv_pair heap \\\n (case State_Monad.run_state m' heap of (_, heap) \\ inv_pair_weak heap \\ pair.inv_pair heap)\"\nproof -\n show ?thesis\n apply (rule mem.rel_state_intro)\n subgoal for heap v heap'\n by (auto elim: rel_state_elim[OF that(1)] dest!: inv_pairD)\n subgoal premises prems for heap v heap'\n proof -\n from prems that(1) have \"inv_pair_weak heap'\"\n by (fastforce elim: rel_state_elim dest: inv_pairD)\n with prems show ?thesis\n by (auto dest: that(2))\n qed\n done\nqed\n\nlemma mem_rel_state_ofI':\n \"mem.rel_state (=) m' m\" if\n \"rel_state (=) m' m\"\n \"DP_CRelVS.lift_p pair.inv_pair m'\"\n using that by (auto elim: DP_CRelVS.lift_p_P intro: mem_rel_state_ofI)\n\ncontext\n assumes keys: \"\\k k'. key1 k = key1 k' \\ key2 k = key2 k' \\ k = k'\"\nbegin\n\ninterpretation mem_correct pair.lookup_pair pair.update_pair pair.inv_pair\n by (rule mem_correct_pair[OF keys])\n\nlemma rel_state_lookup':\n \"((=) ===> mem.rel_state (=)) pair.lookup_pair lookup_pair\"\n apply (intro rel_funI)\n apply simp\n apply (rule mem_rel_state_ofI')\n subgoal for x y\n using rel_state_lookup by (rule rel_funD) (rule HOL.refl)\n by (rule lookup_inv)\n\nlemma rel_state_update':\n \"((=) ===> (=) ===> mem.rel_state (=)) pair.update_pair update_pair\"\n apply (intro rel_funI)\n apply simp\n apply (rule mem_rel_state_ofI')\n subgoal for x y a b\n using rel_state_update by (blast dest: rel_funD)\n by (rule update_inv)\n\ninterpretation heap_correct pair.inv_pair update_pair lookup_pair\n by (rule mem.mem_correct_heap_correct[OF _ rel_state_lookup' rel_state_update']) standard\n\nlemmas heap_correct_pairI = heap_correct_axioms \n\n(* TODO: Generalize *)\nlemma mem_rel_state_resultD:\n \"result_of m heap = fst (run_state m' heap)\" if \"mem.rel_state (=) m' m\" \"pair.inv_pair heap\"\n by (metis (mono_tags, lifting) mem.rel_state_elim option.sel that)\n\nlemma map_of_heap_eq:\n \"mem.map_of_heap heap = pair.pair.map_of heap\" if \"pair.inv_pair heap\"\n unfolding mem.map_of_heap_def pair.pair.map_of_def\n using that by (simp add: mem_rel_state_resultD[OF rel_state_lookup'[THEN rel_funD]])\n\ncontext\n fixes k1 k2 heap heap'\n assumes init: \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\nbegin\n\nlemma init_state_empty1:\n \"pair.mem1.map_of heap' k = None\"\n using init\n unfolding pair.mem1.map_of_def lookup1_def mem_lookup_def init_state_def\n by (auto\n simp: init_state_inner_nth init_state_inner_alloc(3) execute_simps Let_def\n elim!: execute_bind_success'[OF success_empty])\n (metis\n Array.present_alloc Memory_Heap.length_mem_empty execute_new execute_nth(1) fst_conv\n length_def mem_empty_def nth_mem_empty option.sel present_alloc_get snd_conv\n )\n\nlemma init_state_empty2:\n \"pair.mem2.map_of heap' k = None\"\n using init\n unfolding pair.mem2.map_of_def lookup2_def mem_lookup_def init_state_def\n by (auto\n simp: execute_simps init_state_inner_nth init_state_inner_alloc(4) Let_def\n elim!: execute_bind_success'[OF success_empty]\n )\n (metis fst_conv nth_mem_empty option.sel snd_conv)\n\nlemma\n shows init_state_k1: \"result_of (!k_ref1) heap' = k1\"\n and init_state_k2: \"result_of (!k_ref2) heap' = k2\"\n using init init_state_inner_alloc\n by (auto simp: execute_simps init_state_def elim!: execute_bind_success'[OF success_empty])\n\ncontext\n assumes neq: \"k1 \\ k2\"\nbegin\n\nlemma init_state_inv':\n \"pair.inv_pair heap'\"\n unfolding pair.inv_pair_def\n apply (auto simp: Let_def)\n subgoal\n using init_state_empty1 by simp\n subgoal\n using init_state_empty2 by simp\n subgoal\n using neq init by (simp add: get_k1_def get_k2_def init_state_k1 init_state_k2)\n subgoal\n by (rule init_state_inv[OF init])\n done\n\nlemma init_state_empty:\n \"pair.pair.map_of heap' \\\\<^sub>m Map.empty\"\n using neq by (intro pair.emptyI init_state_inv' map_emptyI init_state_empty1 init_state_empty2)\n\ninterpretation heap_correct_empty pair.inv_pair update_pair lookup_pair heap'\n apply (rule heap_correct_empty.intro)\n apply (rule heap_correct_pairI)\n apply standard\n subgoal\n by (subst map_of_heap_eq; intro init_state_inv' init_state_empty)\n subgoal\n by (rule init_state_inv')\n done\n\nlemmas heap_correct_empty_pairI = heap_correct_empty_axioms\n\ncontext\n fixes dp :: \"'k \\ 'v\"\nbegin\n\ninterpretation dp_consistency_heap_empty\n pair.inv_pair update_pair lookup_pair dp heap'\n by standard\n\nlemmas consistent_empty_pairI = dp_consistency_heap_empty_axioms\n\nend (* DP *)\n\nend (* Unequal Keys *)\n\nend (* Init State *)\n\nend (* Keys injective *)\n\nend (* Lifting Syntax *)\n\nend (* Disjoint *)\n\nend (* Injectivity *)\n\nend (* Refs *)\n\nend (* Key functions & Size *)\n\nend (* Theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/heap_monad/Memory_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.29892261491139677}} {"text": "(* Title: Xml\n Author: Christian Sternagel\n Author: René Thiemann\n*)\n\nsection \\XML Transformers for Extracting Data from XML Nodes\\\n\ntheory Xmlt\nimports\n Xml\n Certification_Monads.Strict_Sum\n HOL.Rat\nbegin\n\ntype_synonym\n tag = string\n\ntext \\The type of transformers on xml nodes.\\\ntype_synonym\n 'a xmlt = \"xml \\ string +\\<^sub>\\ 'a\"\n\ndefinition map :: \"(xml \\ ('e +\\<^sub>\\ 'a)) \\ xml list \\ 'e +\\<^sub>\\ 'a list\"\nwhere\n [code_unfold]: \"map = map_sum_bot\"\n\nlemma map_mono [partial_function_mono]:\n fixes C :: \"xml \\ ('b \\ ('e +\\<^sub>\\ 'c)) \\ 'e +\\<^sub>\\ 'd\"\n assumes C: \"\\y. y \\ set B \\ mono_sum_bot (C y)\"\n shows \"mono_sum_bot (\\f. map (\\y. C y f) B)\" \n unfolding map_def by (auto intro: partial_function_mono C)\n\nhide_const (open) map\n\nfun \"text\" :: \"tag \\ string xmlt\"\nwhere\n \"text tag (XML n atts [XML_text t]) = \n (if n = tag \\ atts = [] then return t\n else error (concat\n [''could not extract text for '', tag,'' from '', ''\\'', show (XML n atts [XML_text t])]))\"\n| \"text tag xml = error (concat [''could not extract text for '', tag,'' from '', ''\\'', show xml])\"\nhide_const (open) \"text\"\n\ndefinition bool_of_string :: \"string \\ string +\\<^sub>\\ bool\"\nwhere\n \"bool_of_string s =\n (if s = ''true'' then return True\n else if s = ''false'' then return False\n else error (''cannot convert '' @ s @ '' into Boolean''))\"\n\nfun bool :: \"tag \\ bool xmlt\"\nwhere\n \"bool tag node = Xmlt.text tag node \\ bool_of_string\"\nhide_const (open) bool\n\ndefinition fail :: \"tag \\ 'a xmlt\"\nwhere\n \"fail tag xml =\n error (concat\n [''could not transform the following xml element (expected '', tag, '')'', ''\\'', show xml])\"\nhide_const (open) fail\n\ndefinition guard :: \"(xml \\ bool) \\ 'a xmlt \\ 'a xmlt \\ 'a xmlt\"\nwhere\n \"guard p p1 p2 x = (if p x then p1 x else p2 x)\"\nhide_const (open) guard\n\nlemma guard_mono [partial_function_mono]:\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n and p2: \"\\y. mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.guard p (\\y. p1 y g) (\\y. p2 y g) x)\" \n by (cases x) (auto intro!: partial_function_mono p1 p2 simp: Xmlt.guard_def)\n\nfun leaf :: \"tag \\ 'a \\ 'a xmlt\"\nwhere\n \"leaf tag x (XML name atts cs) = \n (if name = tag \\ atts = [] \\ cs = [] then return x \n else Xmlt.fail tag (XML name atts cs))\" |\n \"leaf tag x xml = Xmlt.fail tag xml\"\nhide_const (open) leaf\n\nfun list1element :: \"'a list \\ 'a option\"\nwhere\n \"list1element [x] = Some x\" |\n \"list1element _ = None\"\n\nfun singleton :: \"tag \\ 'a xmlt \\ ('a \\ 'b) \\ 'b xmlt\"\nwhere\n \"singleton tag p1 f xml =\n (case xml of\n XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list1element cs of \n Some (cs1) \\ p1 cs1 \\ return \\ f\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\nhide_const (open) singleton\n\nlemma singleton_mono [partial_function_mono]:\n assumes p: \"\\y. mono_sum_bot (p1 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.singleton t (\\y. p1 y g) f x)\" \n by (cases x, cases \"list1element (Xml.children x)\") (auto intro!: partial_function_mono p)\n\nfun list2elements :: \"'a list \\ ('a \\ 'a) option\"\nwhere\n \"list2elements [x, y] = Some (x, y)\" |\n \"list2elements _ = None\"\n\nfun pair :: \"tag \\ 'a xmlt \\ 'b xmlt \\ ('a \\ 'b \\ 'c) \\ 'c xmlt\"\nwhere\n \"pair tag p1 p2 f xml =\n (case xml of\n XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list2elements cs of \n Some (cs1, cs2) \\\n do {\n a \\ p1 cs1;\n b \\ p2 cs2;\n return (f a b)\n }\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\nhide_const (open) pair\n\nlemma pair_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.pair t (\\y. p1 y g) (\\ y. p2 y g) f x)\"\n using assms\n by (cases x, cases \"list2elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list3elements :: \"'a list \\ ('a \\ 'a \\ 'a) option\"\nwhere\n \"list3elements [x, y, z] = Some (x, y, z)\" |\n \"list3elements _ = None\"\n\nfun triple :: \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ ('a \\ 'b \\ 'c \\ 'd) \\ 'd xmlt\"\nwhere\n \"triple tag p1 p2 p3 f xml = (case xml of XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list3elements cs of \n Some (cs1, cs2, cs3) \\\n do {\n a \\ p1 cs1;\n b \\ p2 cs2;\n c \\ p3 cs3;\n return (f a b c)\n }\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\n\nlemma triple_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n and \"\\y. mono_sum_bot (p3 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.triple t (\\y. p1 y g) (\\ y. p2 y g) (\\ y. p3 y g) f x)\"\n using assms\n by (cases x, cases \"list3elements (Xml.children x)\", auto intro!: partial_function_mono)\n\nfun list4elements :: \"'a list \\ ('a \\ 'a \\ 'a \\ 'a) option\"\nwhere\n \"list4elements [x, y, z, u] = Some (x, y, z, u)\" |\n \"list4elements _ = None\"\n\nfun\n tuple4 ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ 'd xmlt \\ ('a \\ 'b \\ 'c \\ 'd \\ 'e) \\ 'e xmlt\"\nwhere\n \"tuple4 tag p1 p2 p3 p4 f xml =\n (case xml of\n XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list4elements cs of \n Some (cs1, cs2, cs3, cs4) \\\n do {\n a \\ p1 cs1;\n b \\ p2 cs2;\n c \\ p3 cs3;\n d \\ p4 cs4;\n return (f a b c d)\n }\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\n\nlemma tuple4_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n and \"\\y. mono_sum_bot (p3 y)\"\n and\"\\y. mono_sum_bot (p4 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.tuple4 t (\\y. p1 y g) (\\ y. p2 y g) (\\ y. p3 y g) (\\ y. p4 y g) f x)\"\n using assms\n by (cases x, cases \"list4elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list5elements :: \"'a list \\ ('a \\ 'a \\ 'a \\ 'a \\ 'a) option\"\nwhere\n \"list5elements [x, y, z, u, v] = Some (x, y, z, u, v)\" |\n \"list5elements _ = None\"\n\nfun\n tuple5 ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ 'd xmlt \\ 'e xmlt \\\n ('a \\ 'b \\ 'c \\ 'd \\ 'e \\ 'f) \\ 'f xmlt\"\nwhere\n \"tuple5 tag p1 p2 p3 p4 p5 f xml =\n (case xml of\n XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list5elements cs of \n Some (cs1,cs2,cs3,cs4,cs5) \\\n do {\n a \\ p1 cs1;\n b \\ p2 cs2;\n c \\ p3 cs3;\n d \\ p4 cs4;\n e \\ p5 cs5;\n return (f a b c d e)\n }\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\n\nlemma tuple5_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n and \"\\y. mono_sum_bot (p3 y)\"\n and \"\\y. mono_sum_bot (p4 y)\"\n and \"\\y. mono_sum_bot (p5 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.tuple5 t (\\y. p1 y g) (\\ y. p2 y g) (\\ y. p3 y g) (\\ y. p4 y g) (\\ y. p5 y g) f x)\"\n using assms\n by (cases x, cases \"list5elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list6elements :: \"'a list \\ ('a \\ 'a \\ 'a \\ 'a \\ 'a \\ 'a) option\"\nwhere\n \"list6elements [x, y, z, u, v, w] = Some (x, y, z, u, v, w)\" |\n \"list6elements _ = None\"\n\nfun\n tuple6 ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ 'd xmlt \\ 'e xmlt \\ 'f xmlt \\\n ('a \\ 'b \\ 'c \\ 'd \\ 'e \\ 'f \\ 'g) \\ 'g xmlt\"\nwhere\n \"tuple6 tag p1 p2 p3 p4 p5 p6 f xml =\n (case xml of\n XML name atts cs \\\n (if name = tag \\ atts = [] then\n (case list6elements cs of \n Some (cs1,cs2,cs3,cs4,cs5,cs6) \\\n do {\n a \\ p1 cs1;\n b \\ p2 cs2;\n c \\ p3 cs3;\n d \\ p4 cs4;\n e \\ p5 cs5;\n ff \\ p6 cs6;\n return (f a b c d e ff)\n }\n | None \\ Xmlt.fail tag xml)\n else Xmlt.fail tag xml)\n | _ \\ Xmlt.fail tag xml)\"\n\nlemma tuple6_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n and \"\\y. mono_sum_bot (p3 y)\"\n and \"\\y. mono_sum_bot (p4 y)\"\n and \"\\y. mono_sum_bot (p5 y)\"\n and \"\\y. mono_sum_bot (p6 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.tuple6 t (\\y. p1 y g) (\\ y. p2 y g) (\\ y. p3 y g) (\\ y. p4 y g) (\\ y. p5 y g) (\\ y. p6 y g) f x)\"\n using assms\n by (cases x, cases \"list6elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun optional :: \"tag \\ 'a xmlt \\ ('a option \\ 'b) \\ 'b xmlt\"\nwhere\n \"optional tag p1 f (XML name atts cs) =\n (let l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 0 \\ l \\ 1 then do {\n if l = 1 then do {\n x1 \\ p1 (cs ! 0);\n return (f (Some x1))\n } else return (f None)\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"optional tag p1 f xml = Xmlt.fail tag xml\"\n\nlemma optional_mono [partial_function_mono]:\n assumes \"\\y. mono_sum_bot (p1 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.optional t (\\y. p1 y g) f x)\" \n using assms by (cases x) (auto intro!: partial_function_mono)\n\nfun xml1to2elements :: \"string \\ 'a xmlt \\ 'b xmlt \\ ('a \\ 'b option \\ 'c) \\ 'c xmlt\"\nwhere\n \"xml1to2elements tag p1 p2 f (XML name atts cs) = (\n let l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 1 \\ l \\ 2\n then do {\n x1 \\ p1 (cs ! 0);\n (if l = 2\n then do {\n x2 \\ p2 (cs ! 1);\n return (f x1 (Some x2))\n } else return (f x1 None))\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml1to2elements tag p1 p2 f xml = Xmlt.fail tag xml\"\n\nlemma xml1to2elements_mono[partial_function_mono]:\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. xml1to2elements t (\\y. p1 y g) (\\y. p2 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n\ntext \\\n Apply the first transformer to the first child-node, then check the second child-node,\n which is must be a Boolean. If the Boolean is true, then apply the second transformer\n to the last child-node.\n\\\nfun xml2nd_choice :: \"tag \\ 'a xmlt \\ tag \\ 'b xmlt \\ ('a \\ 'b option \\ 'c) \\ 'c xmlt\"\nwhere\n \"xml2nd_choice tag p1 cn p2 f (XML name atts cs) = (\n let l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 2 then do {\n x1 \\ p1 (cs ! 0);\n b \\ Xmlt.bool cn (cs ! 1);\n (if b then do {\n x2 \\ p2 (cs ! (l - 1));\n return (f x1 (Some x2))\n } else return (f x1 None))\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml2nd_choice tag p1 cn p2 f xml = Xmlt.fail tag xml\"\n\nlemma xml2nd_choice_mono [partial_function_mono]:\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. xml2nd_choice t (\\y. p1 y g) h (\\y. p2 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n xml2to3elements ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ ('a \\ 'b \\ 'c option \\ 'd) \\ 'd xmlt\"\nwhere\n \"xml2to3elements tag p1 p2 p3 f (XML name atts cs) = (\n let l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 2 \\ l \\ 3 then do {\n x1 \\ p1 (cs ! 0);\n x2 \\ p2 (cs ! 1);\n (if l = 3 then do {\n x3 \\ p3 (cs ! 2);\n return (f x1 x2 (Some x3))\n } else return (f x1 x2 None))\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml2to3elements tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\nlemma xml2to3elements_mono [partial_function_mono]:\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p2 y)\"\n \"\\y. mono_sum_bot (p3 y)\"\n shows \"mono_sum_bot (\\g. xml2to3elements t (\\y. p1 y g) (\\y. p2 y g) (\\y. p3 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n xml3to4elements ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ 'd xmlt \\ ('a \\ 'b \\ 'c option \\ 'd \\ 'e) \\\n 'e xmlt\"\nwhere\n \"xml3to4elements tag p1 p2 p3 p4 f (XML name atts cs) = (\n let l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 3 \\ l \\ 4 then do {\n x1 \\ p1 (cs ! 0);\n x2 \\ p2 (cs ! 1);\n (if l = 4 then do {\n x3 \\ p3 (cs ! 2);\n x4 \\ p4 (cs ! 3);\n return (f x1 x2 (Some x3) x4)\n } else do {\n x4 \\ p4 (cs ! 2);\n return (f x1 x2 None x4)\n } )\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml3to4elements tag p1 p2 p3 p4 f xml = Xmlt.fail tag xml\"\n\nlemma xml3to4elements_mono [partial_function_mono]:\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p2 y)\"\n \"\\y. mono_sum_bot (p3 y)\"\n \"\\y. mono_sum_bot (p4 y)\"\n shows \"mono_sum_bot (\\g. xml3to4elements t (\\y. p1 y g) (\\y. p2 y g) (\\y. p3 y g) (\\y. p4 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n\nfun many :: \"tag \\ 'a xmlt \\ ('a list \\ 'b) \\ 'b xmlt\"\nwhere\n \"many tag p f (XML name atts cs) =\n (if name = tag \\ atts = [] then (Xmlt.map p cs \\ (return \\ f))\n else Xmlt.fail tag (XML name atts cs))\" |\n \"many tag p f xml = Xmlt.fail tag xml\"\nhide_const (open) many\n\nlemma many_mono [partial_function_mono]:\n fixes p1 :: \"xml \\ ('b \\ (string +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd\"\n assumes \"\\y. y \\ set (Xml.children x) \\ mono_sum_bot (p1 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.many t (\\y. p1 y g) f x)\" \n using assms by (cases x) (auto intro!: partial_function_mono)\n\nfun many1_gen :: \"tag \\ 'a xmlt \\ ('a \\ 'b xmlt) \\ ('a \\ 'b list \\ 'c) \\ 'c xmlt\"\nwhere\n \"many1_gen tag p1 p2 f (XML name atts cs) =\n (if name = tag \\ atts = [] \\ cs \\ [] then\n (case cs of h # t \\ do {\n x \\ p1 h;\n xs \\ Xmlt.map (p2 x) t;\n return (f x xs)\n })\n else Xmlt.fail tag (XML name atts cs))\" |\n \"many1_gen tag p1 p2 f xml = Xmlt.fail tag xml\"\n\n(* TODO \nlemma Xmlt.many1_gen_mono[partial_function_mono]:\n fixes p1 :: \"xml \\ ('b \\ 'c sum_bot) \\ 'd sum_bot\"\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.many1_gen t (\\y. p1 y g) (\\y. p2 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n*)\n\ndefinition many1 :: \"string \\ 'a xmlt \\ 'b xmlt \\ ('a \\ 'b list \\ 'c) \\ 'c xmlt\"\nwhere\n \"many1 tag p1 p2 = Xmlt.many1_gen tag p1 (\\_. p2)\"\nhide_const (open) many1\n\nlemma many1_mono [partial_function_mono]:\n fixes p1 :: \"xml \\ ('b \\ (string +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd\"\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. y \\ set (tl (Xml.children x)) \\ mono_sum_bot (p2 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.many1 t (\\y. p1 y g) (\\y. p2 y g) f x)\" \n unfolding Xmlt.many1_def using assms\n by (cases x, cases \"Xml.children x\") (auto intro!: partial_function_mono)\n\nfun length_ge_2 :: \"'a list \\ bool\"\nwhere \n \"length_ge_2 (_ # _ # _) = True\" |\n \"length_ge_2 _ = False\"\n\nfun many2 :: \"tag \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ ('a \\ 'b \\ 'c list \\ 'd) \\ 'd xmlt\"\nwhere\n \"many2 tag p1 p2 p3 f (XML name atts cs) =\n (if name = tag \\ atts = [] \\ length_ge_2 cs then\n (case cs of cs0 # cs1 # t \\ do {\n x \\ p1 cs0;\n y \\ p2 cs1;\n xs \\ Xmlt.map p3 t;\n return (f x y xs)\n })\n else Xmlt.fail tag (XML name atts cs))\" |\n \"many2 tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\nlemma many2_mono [partial_function_mono]:\n fixes p1 :: \"xml \\ ('b \\ (string +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd\"\n assumes \"\\y. mono_sum_bot (p1 y)\"\n and \"\\y. mono_sum_bot (p2 y)\"\n and \"\\y. mono_sum_bot (p3 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.many2 t (\\y. p1 y g) (\\y. p2 y g) (\\y. p3 y g) f x)\"\n using assms\n by (cases x, cases \"Xml.children x\", (auto intro!: partial_function_mono)[1], cases \"tl (Xml.children x)\", auto intro!: partial_function_mono)\n\nfun\n xml1or2many_elements ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ ('a \\ 'b option \\ 'c list \\ 'd) \\ 'd xmlt\"\nwhere\n \"xml1or2many_elements tag p1 p2 p3 f (XML name atts cs) =\n (if name = tag \\ atts = [] \\ cs \\ [] then\n (case cs of\n cs0 # tt \\\n do { \n x \\ p1 cs0;\n (case tt of\n cs1 # t \\\n do {\n try do {\n y \\ p2 cs1;\n xs \\ Xmlt.map p3 t;\n return (f x (Some y) xs)\n } catch (\\ _. do {\n xs \\ Xmlt.map p3 tt;\n return (f x None xs)\n })\n }\n | [] \\ return (f x None []))}) \n else Xmlt.fail tag (XML name atts cs))\" |\n \"xml1or2many_elements tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\nfun\n xml1many2elements_gen ::\n \"string \\ 'a xmlt \\ ('a \\ 'b xmlt) \\ 'c xmlt \\ 'd xmlt \\\n ('a \\ 'b list \\ 'c \\ 'd \\ 'e) \\ 'e xmlt\"\nwhere\n \"xml1many2elements_gen tag p1 p2 p3 p4 f (XML name atts cs) = (\n let ds = List.rev cs; l = length cs in\n (if name = tag \\ atts = [] \\ l \\ 3 then do {\n x \\ p1 (cs ! 0);\n xs \\ Xmlt.map (p2 x) (tl (take (l - 2) cs));\n y \\ p3 (ds ! 1);\n z \\ p4 (ds ! 0);\n return (f x xs y z)\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml1many2elements_gen tag p1 p2 p3 p4 f xml = Xmlt.fail tag xml\"\n\nlemma xml1many2elements_gen_mono [partial_function_mono]:\n fixes p1 :: \"xml \\ ('b \\ (string +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd\"\n assumes p1: \"\\y. mono_sum_bot (p1 y)\"\n \"\\y. mono_sum_bot (p3 y)\"\n \"\\y. mono_sum_bot (p4 y)\"\n shows \"mono_sum_bot (\\g. xml1many2elements_gen t (\\y. p1 y g) p2 (\\y. p3 y g) (\\y. p4 y g) f x)\" \n by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n xml1many2elements ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ 'd xmlt \\ ('a \\ 'b list \\ 'c \\ 'd \\ 'e) \\\n 'e xmlt\"\nwhere\n \"xml1many2elements tag p1 p2 = xml1many2elements_gen tag p1 (\\_. p2)\"\n\nfun\n xml_many2elements ::\n \"string \\ 'a xmlt \\ 'b xmlt \\ 'c xmlt \\ ('a list \\ 'b \\ 'c \\ 'd) \\ 'd xmlt\"\nwhere\n \"xml_many2elements tag p1 p2 p3 f (XML name atts cs) = (\n let ds = List.rev cs in\n (if name = tag \\ atts = [] \\ length_ge_2 cs then do {\n xs \\ Xmlt.map p1 (List.rev (tl (tl ds)));\n y \\ p2 (ds ! 1);\n z \\ p3 (ds ! 0);\n return (f xs y z)\n } else Xmlt.fail tag (XML name atts cs)))\" |\n \"xml_many2elements tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\ndefinition options :: \"(string \\ 'a xmlt) list \\ 'a xmlt\"\nwhere\n \"options ps x =\n (case map_of ps (Xml.tag x) of \n None \\ error (concat\n [''expected one of: '', concat (map (\\p. fst p @ '' '') ps), ''\\'', ''but found'', ''\\'', show x])\n | Some p \\ p x)\"\nhide_const (open) options\n\nlemma options_mono_gen [partial_function_mono]:\n assumes p: \"\\ k p. (k, p) \\ set ps \\ mono_sum_bot (p x)\"\n shows \"mono_sum_bot (\\ g. Xmlt.options (map (\\ (k, p). (k, (\\ y. p y g))) ps) x)\"\nproof -\n {\n fix g\n have \"(map (\\p. fst p @ '' '') (map (\\(k, p). (k, \\y. p y g)) ps)) = \n map (\\p. fst p @ '' '') ps\"\n by (induct ps) (auto)\n } note id = this\n {\n fix z\n have \"mono_sum_bot\n (\\g. case map_of (map (\\(k, p). (k, \\y. p y g)) ps) (Xml.tag x) of\n None \\ z\n | Some p \\ p x)\"\n using p\n proof (induct ps)\n case Nil\n show ?case by (auto intro: partial_function_mono)\n next\n case (Cons kp ps)\n obtain k p where kp: \"kp = (k,p)\" by force\n note Cons = Cons[unfolded kp]\n from Cons(2) have monop: \"mono_sum_bot (p x)\" and mono: \"\\ k p. (k,p) \\ set ps \\ mono_sum_bot (p x)\" by auto\n show ?case \n proof (cases \"Xml.tag x = k\")\n case True\n thus ?thesis unfolding kp using monop by auto\n next\n case False\n thus ?thesis using Cons(1) mono unfolding kp by auto\n qed\n qed\n } note main = this\n show ?thesis unfolding Xmlt.options_def \n unfolding id\n by (rule main)\nqed\n\n(* instantiate this lemma to have the monotonicity lemmas for lists of variable lengths which\n are then applicable, e.g., for lists of length 3 it would be\n\nmono_sum_bot (p1 x) \\ mono_sum_bot (p2 x) \\ mono_sum_bot (p3 x) \n\\ mono_sum_bot (\\g. Xmlt.options [(k1, \\y. p1 y g), (k2, \\y. p2 y g), (k3, \\y. p3 y g)] x)\n\n*)\nlocal_setup \\fn lthy => \n let\n val N = 30 (* we require monotonicity lemmas for xml-options for lists up to length N *) \n val thy = Proof_Context.theory_of lthy\n val options = @{term \"Xmlt.options :: (string \\ (xml \\ (string +\\<^sub>\\ 'd))) list \\ xml \\ string +\\<^sub>\\ 'd\"}\n val mono_sum_bot = @{term \"mono_sum_bot :: (('a \\ ('b +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd) \\ bool\"}\n val ktyp = @{typ string}\n val x = @{term \"x :: xml\"}\n val y = @{term \"y :: xml\"}\n val g = @{term \"g :: 'a \\ 'b +\\<^sub>\\ 'c\"}\n val ptyp = @{typ \"xml \\ ('a \\ ('b +\\<^sub>\\ 'c)) \\ string +\\<^sub>\\ 'd\"}\n fun k i = Free (\"k\" ^ string_of_int i,ktyp)\n fun p i = Free (\"p\" ^ string_of_int i,ptyp)\n fun prem i = HOLogic.mk_Trueprop (mono_sum_bot $ (p i $ x))\n fun prems n = 1 upto n |> map prem\n fun pair i = HOLogic.mk_prod (k i, lambda y (p i $ y $ g))\n fun pair2 i = HOLogic.mk_prod (k i, p i)\n fun list n = 1 upto n |> map pair |> HOLogic.mk_list @{typ \"(string \\ (xml \\ string +\\<^sub>\\ 'd))\"}\n fun list2 n = 1 upto n |> map pair2 |> HOLogic.mk_list (HOLogic.mk_prodT (ktyp,ptyp))\n fun concl n = HOLogic.mk_Trueprop (mono_sum_bot $ lambda g (options $ (list n) $ x))\n fun xs n = x :: (1 upto n |> map (fn i => [p i, k i]) |> List.concat)\n |> map (fst o dest_Free)\n fun tac n pc =\n let\n val {prems = prems, context = ctxt} = pc\n val mono_thm = Thm.instantiate' \n (map (SOME o Thm.ctyp_of ctxt) [@{typ 'a},@{typ 'b},@{typ 'c},@{typ 'd}]) \n (map (SOME o Thm.cterm_of ctxt) [list2 n,x]) @{thm Xmlt.options_mono_gen}\n in \n Method.insert_tac ctxt (mono_thm :: prems) 1 THEN force_tac ctxt 1\n end\n fun thm n = Goal.prove lthy (xs n) (prems n) (concl n) (tac n)\n val thms = map thm (0 upto N)\n in Local_Theory.note ((@{binding \"options_mono_thms\"}, []), thms) lthy |> snd end\n\\\n\ndeclare Xmlt.options_mono_thms [partial_function_mono]\n\nfun choice :: \"string \\ 'a xmlt list \\ 'a xmlt\"\nwhere\n \"choice e [] x = error (concat [''error in parsing choice for '', e, ''\\'', show x])\" |\n \"choice e (p # ps) x = (try p x catch (\\_. choice e ps x))\"\nhide_const (open) choice\n\nlemma choice_mono_2 [partial_function_mono]:\n assumes p: \"mono_sum_bot (p1 x)\"\n \"mono_sum_bot (p2 x)\"\n shows \"mono_sum_bot (\\ g. Xmlt.choice e [(\\ y. p1 y g), (\\ y. p2 y g)] x)\"\n using p by (auto intro!: partial_function_mono) \n\nlemma choice_mono_3 [partial_function_mono]:\n assumes p: \"mono_sum_bot (p1 x)\"\n \"mono_sum_bot (p2 x)\"\n \"mono_sum_bot (p3 x)\"\n shows \"mono_sum_bot (\\ g. Xmlt.choice e [(\\ y. p1 y g), (\\ y. p2 y g), (\\ y. p3 y g)] x)\"\n using p by (auto intro!: partial_function_mono) \n\nfun change :: \"'a xmlt \\ ('a \\ 'b) \\ 'b xmlt\"\nwhere\n \"change p f x = p x \\ return \\ f\"\nhide_const (open) change\n\nlemma change_mono [partial_function_mono]:\n assumes p: \"\\y. mono_sum_bot (p1 y)\"\n shows \"mono_sum_bot (\\g. Xmlt.change (\\y. p1 y g) f x)\" \n by (cases x, insert p, auto intro!: partial_function_mono)\n\nfun int_of_digit :: \"char \\ string +\\<^sub>\\ int\"\nwhere\n \"int_of_digit x =\n (if x = CHR ''0'' then return 0\n else if x = CHR ''1'' then return 1\n else if x = CHR ''2'' then return 2\n else if x = CHR ''3'' then return 3\n else if x = CHR ''4'' then return 4\n else if x = CHR ''5'' then return 5\n else if x = CHR ''6'' then return 6\n else if x = CHR ''7'' then return 7\n else if x = CHR ''8'' then return 8\n else if x = CHR ''9'' then return 9\n else error (x # '' is not a digit''))\"\n\nfun int_of_string_aux :: \"int \\ string \\ string +\\<^sub>\\ int\"\nwhere\n \"int_of_string_aux n [] = return n\" |\n \"int_of_string_aux n (d # s) = (int_of_digit d \\ (\\m. int_of_string_aux (10 * n + m) s))\"\n\ndefinition int_of_string :: \"string \\ string +\\<^sub>\\ int\"\nwhere\n \"int_of_string s =\n (if s = [] then error ''cannot convert empty string into number'' \n else if take 1 s = ''-'' then int_of_string_aux 0 (tl s) \\ (\\ i. return (0 - i))\n else int_of_string_aux 0 s)\"\n\nhide_const int_of_string_aux\n\nfun int :: \"tag \\ int xmlt\"\nwhere\n \"int tag x = (Xmlt.text tag x \\ int_of_string)\"\nhide_const (open) int\n\nfun nat :: \"tag \\ nat xmlt\"\nwhere\n \"nat tag x = do {\n txt \\ Xmlt.text tag x;\n i \\ int_of_string txt;\n return (Int.nat i)\n }\"\nhide_const (open) nat\n\ndefinition rat :: \"rat xmlt\"\nwhere\n \"rat = Xmlt.options [\n (''integer'', Xmlt.change (Xmlt.int ''integer'') of_int),\n (''rational'',\n Xmlt.pair ''rational'' (Xmlt.int ''numerator'') (Xmlt.int ''denominator'')\n (\\ x y. of_int x / of_int y))]\"\nhide_const (open) rat\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/XML/Xmlt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352405, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.29890452219342434}} {"text": "subsection \\Pure pattern matching rule sets\\\n\ntheory Rewriting_Pterm\nimports Rewriting_Pterm_Elim\nbegin\n\ntype_synonym prule = \"name \\ pterm\"\n\nprimrec prule :: \"prule \\ bool\" where\n\"prule (_, rhs) \\ wellformed rhs \\ closed rhs \\ is_abs rhs\"\n\nlemma pruleI[intro!]: \"wellformed rhs \\ closed rhs \\ is_abs rhs \\ prule (name, rhs)\"\nby simp\n\nlocale prules = constants C_info \"fst |`| rs\" for C_info and rs :: \"prule fset\" +\n assumes all_rules: \"fBall rs prule\"\n assumes fmap: \"is_fmap rs\"\n assumes not_shadows: \"fBall rs (\\(_, rhs). \\ shadows_consts rhs)\"\n assumes welldefined_rs: \"fBall rs (\\(_, rhs). welldefined rhs)\"\n\nsubsubsection \\Rewriting\\\n\ninductive prewrite :: \"prule fset \\ pterm \\ pterm \\ bool\" (\"_/ \\\\<^sub>p/ _ \\/ _\" [50,0,50] 50) for rs where\nstep: \"(name, rhs) |\\| rs \\ rs \\\\<^sub>p Pconst name \\ rhs\" |\nbeta: \"c |\\| cs \\ c \\ t \\ t' \\ rs \\\\<^sub>p Pabs cs $\\<^sub>p t \\ t'\" |\n\"fun\": \"rs \\\\<^sub>p t \\ t' \\ rs \\\\<^sub>p t $\\<^sub>p u \\ t' $\\<^sub>p u\" |\narg: \"rs \\\\<^sub>p u \\ u' \\ rs \\\\<^sub>p t $\\<^sub>p u \\ t $\\<^sub>p u'\"\n\nglobal_interpretation prewrite: rewriting \"prewrite rs\" for rs\nby standard (auto intro: prewrite.intros simp: app_pterm_def)+\n\nabbreviation prewrite_rt :: \"prule fset \\ pterm \\ pterm \\ bool\" (\"_/ \\\\<^sub>p/ _ \\*/ _\" [50,0,50] 50) where\n\"prewrite_rt rs \\ (prewrite rs)\\<^sup>*\\<^sup>*\"\n\nsubsubsection \\Translation from @{typ irule_set} to @{typ \"prule fset\"}\\\n\ndefinition finished :: \"irule_set \\ bool\" where\n\"finished rs = fBall rs (\\(_, irs). arity irs = 0)\"\n\ndefinition translate_rhs :: \"irules \\ pterm\" where\n\"translate_rhs = snd \\ fthe_elem\"\n\ndefinition compile :: \"irule_set \\ prule fset\" where\n\"compile = fimage (map_prod id translate_rhs)\"\n\nlemma compile_heads: \"fst |`| compile rs = fst |`| rs\"\nunfolding compile_def by simp\n\nsubsubsection \\Correctness of translation\\\n\nlemma arity_zero_shape:\n assumes \"arity_compatibles rs\" \"arity rs = 0\" \"is_fmap rs\" \"rs \\ {||}\"\n obtains t where \"rs = {| ([], t) |}\"\nproof -\n from assms obtain ppats prhs where \"(ppats, prhs) |\\| rs\"\n by fast\n\n moreover {\n fix pats rhs\n assume \"(pats, rhs) |\\| rs\"\n with assms have \"length pats = 0\"\n by (metis arity_compatible_length)\n hence \"pats = []\"\n by simp\n }\n note all = this\n\n ultimately have proto: \"([], prhs) |\\| rs\" by auto\n\n have \"fBall rs (\\(pats, rhs). pats = [] \\ rhs = prhs)\"\n proof safe\n fix pats rhs\n assume cur: \"(pats, rhs) |\\| rs\"\n with all show \"pats = []\" .\n with cur have \"([], rhs) |\\| rs\" by auto\n\n with proto show \"rhs = prhs\"\n using assms by (auto dest: is_fmapD)\n qed\n hence \"fBall rs (\\r. r = ([], prhs))\"\n by blast\n with assms have \"rs = {| ([], prhs) |}\"\n by (simp add: singleton_fset_is)\n thus thesis\n by (rule that)\nqed\n\nlemma (in irules) compile_rules:\n assumes \"finished rs\"\n shows \"prules C_info (compile rs)\"\nproof\n show \"is_fmap (compile rs)\"\n using fmap\n unfolding compile_def map_prod_def id_apply\n by (rule is_fmap_image)\nnext\n show \"fdisjnt (fst |`| compile rs) C\"\n unfolding compile_def\n using disjnt by simp\nnext\n have\n \"fBall (compile rs) prule\"\n \"fBall (compile rs) (\\(_, rhs). \\ shadows_consts rhs)\"\n \"fBall (compile rs) (\\(_, rhs). welldefined rhs)\"\n proof (safe del: fsubsetI)\n fix name rhs\n assume \"(name, rhs) |\\| compile rs\" (* FIXME clone of compile_correct *)\n then obtain irs where \"(name, irs) |\\| rs\" \"rhs = translate_rhs irs\"\n unfolding compile_def by force\n hence \"is_fmap irs\" \"irs \\ {||}\" \"arity irs = 0\"\n using assms inner unfolding finished_def by blast+\n moreover have \"arity_compatibles irs\"\n using \\(name, irs) |\\| rs\\ inner by (blast dest: fpairwiseD)\n ultimately obtain u where \"irs = {| ([], u) |}\"\n by (metis arity_zero_shape)\n hence \"rhs = u\" and u: \"([], u) |\\| irs\"\n unfolding \\rhs = _\\ translate_rhs_def by simp+\n hence \"abs_ish [] u\"\n using inner \\(name, irs) |\\| rs\\ by blast\n thus \"is_abs rhs\"\n unfolding abs_ish_def \\rhs = u\\ by simp\n\n show \"wellformed rhs\"\n using u \\(name, irs) |\\| rs\\ inner unfolding \\rhs = u\\\n by blast\n\n have \"closed_except u {||}\"\n using u inner \\(name, irs) |\\| rs\\\n by (metis (mono_tags, lifting) case_prod_conv fbspec freess_empty)\n thus \"closed rhs\"\n unfolding \\rhs = u\\ .\n\n {\n assume \"shadows_consts rhs\"\n hence \"shadows_consts u\"\n unfolding compile_def \\rhs = u\\ by simp\n moreover have \"\\ shadows_consts u\"\n using inner \\([], u) |\\| irs\\ \\(name, irs) |\\| rs\\ by blast\n ultimately show False by blast\n }\n\n have \"welldefined u\"\n using fbspec[OF inner \\(name, irs) |\\| rs\\, simplified] \\([], u) |\\| irs\\\n by blast\n thus \"welldefined rhs\"\n unfolding \\rhs = u\\ compile_def\n by simp\n qed\n thus\n \"fBall (compile rs) prule\"\n \"fBall (compile rs) (\\(_, rhs). \\ pre_constants.shadows_consts C_info (fst |`| compile rs) rhs)\"\n \"fBall (compile rs) (\\(_, rhs). pre_constants.welldefined C_info (fst |`| compile rs) rhs)\"\n unfolding compile_heads by auto\nnext\n show \"distinct all_constructors\"\n by (fact distinct_ctr)\nqed\n\ntheorem (in irules) compile_correct:\n assumes \"compile rs \\\\<^sub>p t \\ t'\" \"finished rs\"\n shows \"rs \\\\<^sub>i t \\ t'\"\nusing assms(1) proof induction\n case (step name rhs)\n then obtain irs where \"rhs = translate_rhs irs\" \"(name, irs) |\\| rs\"\n unfolding compile_def by force\n hence \"arity_compatibles irs\"\n using inner by (blast dest: fpairwiseD)\n\n have \"is_fmap irs\" \"irs \\ {||}\" \"arity irs = 0\"\n using assms inner \\(name, irs) |\\| rs\\ unfolding finished_def by blast+\n then obtain u where \"irs = {| ([], u) |}\"\n using \\arity_compatibles irs\\\n by (metis arity_zero_shape)\n\n show ?case\n unfolding \\rhs = _\\\n apply (rule irewrite.step)\n apply fact\n unfolding \\irs = _\\ translate_rhs_def irewrite_step_def\n by (auto simp: const_term_def)\nqed (auto intro: irewrite.intros)\n\ntheorem (in irules) compile_complete:\n assumes \"rs \\\\<^sub>i t \\ t'\" \"finished rs\"\n shows \"compile rs \\\\<^sub>p t \\ t'\"\nusing assms(1) proof induction\n case (step name irs params rhs t t')\n hence \"arity_compatibles irs\"\n using inner by (blast dest: fpairwiseD)\n\n have \"is_fmap irs\" \"irs \\ {||}\" \"arity irs = 0\"\n using assms inner step unfolding finished_def by blast+\n then obtain u where \"irs = {| ([], u) |}\"\n using \\arity_compatibles irs\\\n by (metis arity_zero_shape)\n with step have \"name, [], u \\\\<^sub>i t \\ t'\"\n by simp\n hence \"t = Pconst name\"\n unfolding irewrite_step_def\n by (cases t) (auto split: if_splits simp: const_term_def)\n hence \"t' = u\"\n using \\name, [], u \\\\<^sub>i t \\ t'\\\n unfolding irewrite_step_def\n by (cases t) (auto split: if_splits simp: const_term_def)\n\n have \"(name, t') |\\| compile rs\"\n unfolding compile_def\n proof\n show \"(name, t') = map_prod id translate_rhs (name, irs)\"\n using \\irs = _\\ \\t' = u\\\n by (simp add: split_beta translate_rhs_def)\n qed fact\n thus ?case\n unfolding \\t = _\\\n by (rule prewrite.step)\nqed (auto intro: prewrite.intros)\n\nexport_code\n compile finished\n checking Scala\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Rewriting/Rewriting_Pterm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.2989045221934243}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Chain\n imports \"HOL-Nominal.Nominal\"\nbegin\n\nlemma pt_set_nil: \n fixes Xs :: \"'a set\"\n assumes pt: \"pt TYPE('a) TYPE ('x)\"\n and at: \"at TYPE('x)\"\n\n shows \"([]::'x prm)\\Xs = Xs\"\nby(auto simp add: perm_set_def pt1[OF pt])\n\nlemma pt_set_append: \n fixes pi1 :: \"'x prm\"\n and pi2 :: \"'x prm\"\n and Xs :: \"'a set\"\n assumes pt: \"pt TYPE('a) TYPE ('x)\"\n and at: \"at TYPE('x)\"\n\n shows \"(pi1@pi2)\\Xs = pi1\\(pi2\\Xs)\"\nby(auto simp add: perm_set_def pt2[OF pt])\n\nlemma pt_set_prm_eq: \n fixes pi1 :: \"'x prm\"\n and pi2 :: \"'x prm\"\n and Xs :: \"'a set\"\n assumes pt: \"pt TYPE('a) TYPE ('x)\"\n and at: \"at TYPE('x)\"\n\n shows \"pi1 \\ pi2 \\ pi1\\Xs = pi2\\Xs\"\nby(auto simp add: perm_set_def pt3[OF pt])\n\nlemma pt_set_inst:\n assumes pt: \"pt TYPE('a) TYPE ('x)\"\n and at: \"at TYPE('x)\"\n\n shows \"pt TYPE('a set) TYPE('x)\"\napply(simp add: pt_def pt_set_nil[OF pt, OF at] pt_set_append[OF pt, OF at])\napply(clarify)\nby(rule pt_set_prm_eq[OF pt, OF at])\n\nlemma pt_ball_eqvt:\n fixes pi :: \"'a prm\"\n and Xs :: \"'b set\"\n and P :: \"'b \\ bool\"\n\n assumes pt: \"pt TYPE('b) TYPE('a)\"\n and at: \"at TYPE('a)\"\n\n shows \"(pi \\ (\\x \\ Xs. P x)) = (\\x \\ (pi \\ Xs). pi \\ P (rev pi \\ x))\"\napply(auto simp add: perm_bool)\napply(drule_tac pi=\"rev pi\" in pt_set_bij2[OF pt, OF at])\napply(simp add: pt_rev_pi[OF pt_set_inst[OF pt, OF at], OF at])\napply(drule_tac pi=\"pi\" in pt_set_bij2[OF pt, OF at])\napply(erule_tac x=\"pi \\ x\" in ballE)\napply(simp add: pt_rev_pi[OF pt, OF at])\nby simp\n\nlemma perm_cart_prod:\n fixes Xs :: \"'b set\"\n and Ys :: \"'c set\"\n and p :: \"'a prm\"\n\n assumes pt1: \"pt TYPE('b) TYPE('a)\"\n and pt2: \"pt TYPE('c) TYPE('a)\"\n and at: \"at TYPE('a)\"\n\n shows \"(p \\ (Xs \\ Ys)) = (((p \\ Xs) \\ (p \\ Ys))::(('b \\ 'c) set))\"\nby(auto simp add: perm_set_def)\n\nlemma supp_member:\n fixes Xs :: \"'b set\"\n and x :: 'a\n\n assumes pt: \"pt TYPE('b) TYPE('a)\"\n and at: \"at TYPE('a)\"\n and fs: \"fs TYPE('b) TYPE('a)\"\n and \"finite Xs\"\n and \"x \\ ((supp Xs)::'a set)\"\n\n obtains X where \"(X::'b) \\ Xs\" and \"x \\ supp X\"\nproof -\n from \\finite Xs\\ \\x \\ supp Xs\\ have \"\\X::'b. (X \\ Xs) \\ (x \\ (supp X))\"\n proof(induct rule: finite_induct)\n case empty\n from \\x \\ ((supp {})::'a set)\\ have False\n by(simp add: supp_set_empty)\n thus ?case by simp\n next\n case(insert y Xs)\n show ?case\n proof(case_tac \"x \\ supp y\")\n assume \"x \\ supp y\"\n thus ?case by force\n next\n assume \"x \\ supp y\"\n with \\x \\ supp(insert y Xs)\\ have \"x \\ supp Xs\"\n by(simp add: supp_fin_insert[OF pt, OF at, OF fs, OF \\finite Xs\\])\n with \\x \\ supp Xs \\ \\X. X \\ Xs \\ x \\ supp X\\\n show ?case by force\n qed\n qed\n with that show ?thesis by blast\nqed\n\nlemma supp_cart_prod_empty[simp]:\n fixes Xs :: \"'b set\"\n\n shows \"supp (Xs \\ {}) = ({}::'a set)\"\n and \"supp ({} \\ Xs) = ({}::'a set)\"\nby(auto simp add: supp_set_empty)\n\nlemma supp_cart_prod:\n fixes Xs :: \"'b set\"\n and Ys :: \"'c set\"\n\n assumes pt1: \"pt TYPE('b) TYPE('a)\"\n and pt2: \"pt TYPE('c) TYPE('a)\"\n and fs1: \"fs TYPE('b) TYPE('a)\"\n and fs2: \"fs TYPE('c) TYPE('a)\"\n and at: \"at TYPE('a)\"\n and f1: \"finite Xs\"\n and f2: \"finite Ys\"\n and a: \"Xs \\ {}\"\n and b: \"Ys \\ {}\"\n\n shows \"((supp (Xs \\ Ys))::'a set) = ((supp Xs) \\ (supp Ys))\"\nproof -\n from f1 f2 have f3: \"finite(Xs \\ Ys)\" by simp\n show ?thesis\n apply(simp add: supp_of_fin_sets[OF pt_prod_inst[OF pt1, OF pt2], OF at, OF fs_prod_inst[OF fs1, OF fs2], OF f3] supp_prod)\n apply(rule equalityI)\n using Union_included_in_supp[OF pt1, OF at, OF fs1, OF f1] Union_included_in_supp[OF pt2, OF at, OF fs2, OF f2]\n apply(force simp add: supp_prod)\n using a b\n apply(auto simp add: supp_prod)\n using supp_member[OF pt1, OF at, OF fs1, OF f1]\n apply blast\n using supp_member[OF pt2, OF at, OF fs2, OF f2]\n by blast\nqed\n\nlemma fresh_cart_prod:\n fixes x :: 'a\n and Xs :: \"'b set\"\n and Ys :: \"'c set\"\n\n assumes pt1: \"pt TYPE('b) TYPE('a)\"\n and pt2: \"pt TYPE('c) TYPE('a)\"\n and fs1: \"fs TYPE('b) TYPE('a)\"\n and fs2: \"fs TYPE('c) TYPE('a)\"\n and at: \"at TYPE('a)\"\n and f1: \"finite Xs\"\n and f2: \"finite Ys\"\n and a: \"Xs \\ {}\"\n and b: \"Ys \\ {}\"\n\n shows \"(x \\ (Xs \\ Ys)) = (x \\ Xs \\ x \\ Ys)\"\nusing assms\nby(simp add: supp_cart_prod fresh_def)\n\nlemma fresh_star_cart_prod:\n fixes Zs :: \"'a set\"\n and xvec :: \"'a list\"\n and Xs :: \"'b set\"\n and Ys :: \"'c set\"\n\n assumes pt1: \"pt TYPE('b) TYPE('a)\"\n and pt2: \"pt TYPE('c) TYPE('a)\"\n and fs1: \"fs TYPE('b) TYPE('a)\"\n and fs2: \"fs TYPE('c) TYPE('a)\"\n and at: \"at TYPE('a)\"\n and f1: \"finite Xs\"\n and f2: \"finite Ys\"\n and a: \"Xs \\ {}\"\n and b: \"Ys \\ {}\"\n\n shows \"(Zs \\* (Xs \\ Ys)) = (Zs \\* Xs \\ Zs \\* Ys)\"\n and \"(xvec \\* (Xs \\ Ys)) = (xvec \\* Xs \\ xvec \\* Ys)\"\nusing assms\nby(force simp add: fresh_cart_prod fresh_star_def)+\n\nlemma permCommute:\n fixes p :: \"'a prm\"\n and q :: \"'a prm\"\n and P :: 'x\n and Xs :: \"'a set\"\n and Ys :: \"'a set\"\n\n assumes pt: \"pt TYPE('x) TYPE('a)\"\n and at: \"at TYPE('a)\"\n and a: \"(set p) \\ Xs \\ Ys\"\n and b: \"Xs \\* q\"\n and c: \"Ys \\* q\"\n\n shows \"p \\ q \\ P = q \\ p \\ P\"\nproof -\n have \"p \\ q \\ P = (p \\ q) \\ p \\ P\"\n by(rule pt_perm_compose[OF pt, OF at])\n moreover from at have \"pt TYPE('a) TYPE('a)\"\n by(rule at_pt_inst)\n hence \"pt TYPE(('a \\ 'a) list) TYPE('a)\"\n by(force intro: pt_prod_inst pt_list_inst)\n hence \"p \\ q = q\" using at a b c\n by(rule pt_freshs_freshs)\n ultimately show ?thesis by simp\nqed\n\n\ndefinition\n distinctPerm :: \"'a prm \\ bool\" where\n \"distinctPerm p \\ distinct((map fst p)@(map snd p))\"\n\nlemma at_set_avoiding_aux':\n fixes Xs::\"'a set\"\n and As::\"'a set\"\n assumes at: \"at TYPE('a)\"\n and a: \"finite Xs\"\n and b: \"Xs \\ As\"\n and c: \"finite As\"\n and d: \"finite ((supp c)::'a set)\"\n shows \"\\(Ys::'a set) (pi::'a prm). Ys\\*c \\ Ys \\ As = {} \\ (pi\\Xs=Ys) \\ \n set pi \\ Xs \\ Ys \\ finite Ys \\ (distinctPerm pi)\"\nusing a b c\nproof (induct)\n case empty\n have \"({}::'a set)\\*c\" by (simp add: fresh_star_def)\n moreover\n have \"({}::'a set) \\ As = {}\" by simp\n moreover\n have \"([]::'a prm)\\{} = ({}::'a set)\"\n by(rule pt1) (metis Nominal.pt_set_inst at at_pt_inst)\n moreover\n have \"set ([]::'a prm) \\ {} \\ {}\" by simp\n moreover \n have \"finite ({}::'a set)\" by simp\n moreover have \"distinctPerm([]::'a prm)\"\n by(simp add: distinctPerm_def)\n ultimately show ?case by blast\nnext\n case (insert x Xs)\n then have ih: \"\\Ys pi. Ys\\*c \\ Ys \\ As = {} \\ pi\\Xs = Ys \\ set pi \\ Xs \\ Ys \\ finite Ys \\ distinctPerm pi\" by simp\n then obtain Ys pi where a1: \"Ys\\*c\" and a2: \"Ys \\ As = {}\" and a3: \"(pi::'a prm)\\Xs = Ys\" and \n a4: \"set pi \\ Xs \\ Ys\" and a5: \"finite Ys\" \n and a6: \"distinctPerm pi\" by blast\n have b: \"x\\Xs\" by fact\n have d1: \"finite As\" by fact\n have d2: \"finite Xs\" by fact\n have d3: \"insert x Xs \\ As\" by fact\n have d4: \"finite((supp pi)::'a set)\"\n by(induct pi)\n (auto simp add: supp_list_nil supp_prod at_fin_set_supp[OF at]\n supp_list_cons at_supp[OF at])\n have \"\\y::'a. y\\(c,x,Ys,As,pi)\" using d d1 a5 d4\n by (rule_tac at_exists_fresh'[OF at])\n (simp add: supp_prod at_supp[OF at] at_fin_set_supp[OF at])\n then obtain y::\"'a\" where e: \"y\\(c,x,Ys,As,pi)\" by blast\n have \"({y}\\Ys)\\*c\" using a1 e by (simp add: fresh_star_def)\n moreover\n have \"({y}\\Ys)\\As = {}\" using a2 d1 e by (simp add: fresh_prod at_fin_set_fresh[OF at])\n moreover\n have \"(((pi\\x,y)#pi)\\(insert x Xs)) = {y}\\Ys\"\n proof -\n have eq: \"[(pi\\x,y)]\\Ys = Ys\" \n proof -\n have \"(pi\\x)\\Ys\" using a3[symmetric] b d2\n by(simp add: pt_fresh_bij[OF pt_set_inst, OF at_pt_inst[OF at], OF at, OF at]\n at_fin_set_fresh[OF at d2])\n moreover\n have \"y\\Ys\" using e by simp\n ultimately show \"[(pi\\x,y)]\\Ys = Ys\" \n by (simp add: pt_fresh_fresh[OF pt_set_inst, OF at_pt_inst[OF at], OF at, OF at])\n qed\n have \"(((pi\\x,y)#pi)\\({x}\\Xs)) = ([(pi\\x,y)]\\(pi\\({x}\\Xs)))\"\n by (simp add: pt2[symmetric, OF pt_set_inst, OF at_pt_inst[OF at], OF at])\n also have \"\\ = {y}\\([(pi\\x,y)]\\(pi\\Xs))\" \n by (simp only: union_eqvt perm_set_def at_calc[OF at])(auto)\n also have \"\\ = {y}\\([(pi\\x,y)]\\Ys)\" using a3 by simp\n also have \"\\ = {y}\\Ys\" using eq by simp\n finally show \"(((pi\\x,y)#pi)\\(insert x Xs)) = {y}\\Ys\" by auto\n qed\n moreover\n have \"pi\\x=x\" using a4 b a2 a3 d3 by (rule_tac at_prm_fresh2[OF at]) (auto)\n then have \"set ((pi\\x,y)#pi) \\ (insert x Xs) \\ ({y}\\Ys)\" using a4 by auto\n moreover \n have \"finite ({y}\\Ys)\" using a5 by simp\n moreover from \\Ys \\ As = {}\\ \\(insert x Xs) \\ As\\ \\finite Ys\\ have \"x \\ Ys\"\n by(auto simp add: fresh_def at_fin_set_supp[OF at])\n with a6 \\pi \\ x = x\\ \\x \\ Xs\\ \\(set pi) \\ Xs \\ Ys\\ e have \"distinctPerm((pi \\ x, y)#pi)\"\n apply(auto simp add: distinctPerm_def fresh_prod at_fresh[OF at])\n proof -\n fix a b\n assume \"b \\ pi\" and \"(a, b) \\ set pi\"\n thus False\n by(induct pi)\n (auto simp add: supp_list_cons supp_prod at_supp[OF at] fresh_list_cons fresh_prod at_fresh[OF at])\n next\n fix a b\n assume \"a \\ pi\" and \"(a, b) \\ set pi\"\n thus False\n by(induct pi)\n (auto simp add: supp_list_cons supp_prod at_supp[OF at] fresh_list_cons fresh_prod at_fresh[OF at])\n qed\n ultimately \n show ?case by blast\nqed\n\nlemma at_set_avoiding:\n fixes Xs::\"'a set\"\n assumes at: \"at TYPE('a)\"\n and a: \"finite Xs\"\n and b: \"finite ((supp c)::'a set)\"\n obtains pi::\"'a prm\" where \"(pi \\ Xs) \\* c\" and \"set pi \\ Xs \\ (pi \\ Xs)\" and \"distinctPerm pi\"\n using a b\n by (frule_tac As=\"Xs\" in at_set_avoiding_aux'[OF at]) auto\n\nlemma pt_swap:\n fixes x :: 'a\n and a :: 'x\n and b :: 'x\n\n assumes pt: \"pt TYPE('a) TYPE('x)\"\n and at: \"at TYPE('x)\"\n\n shows \"[(a, b)] \\ x = [(b, a)] \\ x\"\nproof -\n show ?thesis by(simp add: pt3[OF pt] at_ds5[OF at])\nqed\n\n\natom_decl name\n\nlemma supp_subset:\n fixes Xs :: \"'a::fs_name set\"\n and Ys :: \"'a::fs_name set\"\n\n assumes \"Xs \\ Ys\"\n and \"finite Xs\"\n and \"finite Ys\"\n\n shows \"(supp Xs) \\ ((supp Ys)::name set)\"\nproof(rule subsetI)\n fix x\n assume \"x \\ ((supp Xs)::name set)\"\n with \\finite Xs\\ obtain X where \"X \\ Xs\" and \"x \\ supp X\"\n by(rule supp_member[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\n from \\X \\ Xs\\ \\Xs \\ Ys\\ have \"X \\ Ys\" by auto\n with \\finite Ys\\ \\x \\ supp X\\ show \"x \\ supp Ys\"\n by(induct rule: finite_induct)\n (auto simp add: supp_fin_insert[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\nqed\n\nabbreviation mem_def :: \"'a \\ 'a list \\ bool\" (\"_ mem _\" [80, 80] 80) where\n \"x mem xs \\ x \\ set xs\"\n\nlemma memFresh:\n fixes x :: name\n and p :: \"'a::fs_name\"\n and l :: \"('a::fs_name) list\"\n\n assumes \"x \\ l\"\n and \"p mem l\"\n \n shows \"x \\ p\"\nusing assms\nby(induct l, auto simp add: fresh_list_cons)\n\nlemma memFreshChain:\n fixes xvec :: \"name list\"\n and p :: \"'a::fs_name\"\n and l :: \"'a::fs_name list\"\n and Xs :: \"name set\"\n\n assumes \"p mem l\"\n \n shows \"xvec \\* l \\ xvec \\* p\"\n and \"Xs \\* l \\ Xs \\* p\"\nusing assms\nby(auto simp add: fresh_star_def intro: memFresh)\n\nlemma fresh_star_list_append[simp]:\n fixes A :: \"name list\"\n and B :: \"name list\"\n and C :: \"name list\"\n\n shows \"(A \\* (B @ C)) = ((A \\* B) \\ (A \\* C))\"\nby(auto simp add: fresh_star_def fresh_list_append)\n\nlemma unionSimps[simp]:\n fixes Xs :: \"name set\"\n and Ys :: \"name set\"\n and C :: \"'a::fs_name\"\n\n shows \"((Xs \\ Ys) \\* C) = ((Xs \\* C) \\ (Ys \\* C))\"\nby(auto simp add: fresh_star_def)\n\nlemma substFreshAux[simp]:\n fixes C :: \"'a::fs_name\"\n and xvec :: \"name list\"\n\n shows \"xvec \\* (supp C - set xvec)\"\nby(auto simp add: fresh_star_def fresh_def at_fin_set_supp[OF at_name_inst] fs_name1)\n\nlemma fresh_star_perm_app[simp]:\n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and p :: \"name prm\"\n and C :: \"'d::fs_name\"\n\n shows \"\\Xs \\* p; Xs \\* C\\ \\ Xs \\* (p \\ C)\"\n and \"\\xvec \\* p; xvec \\* C\\ \\ xvec \\* (p \\ C)\"\nby(auto simp add: fresh_star_def fresh_perm_app)\n\nlemma freshSets[simp]:\n fixes x :: name\n and y :: name\n and xvec :: \"name list\"\n and X :: \"name set\"\n and C :: 'a\n\n shows \"([]::name list) \\* C\"\n and \"([]::name list) \\* [y].C\"\n and \"({}::name set) \\* C\"\n and \"({}::name set) \\* [y].C\"\n and \"((x#xvec) \\* C) = (x \\ C \\ xvec \\* C)\"\n and \"((x#xvec) \\* ([y].C)) = (x \\ ([y].C) \\ xvec \\* ([y].C))\"\n and \"((insert x X) \\* C) = (x \\ C \\ X \\* C)\"\n and \"((insert x X) \\* ([y].C)) = (x \\ ([y].C) \\ X \\* ([y].C))\"\nby(auto simp add: fresh_star_def)\n\nlemma freshStarAtom[simp]: \"(xvec::name list) \\* (x::name) = x \\ xvec\"\nby(induct xvec)\n (auto simp add: fresh_list_nil fresh_list_cons fresh_atm)\n\nlemma name_list_set_fresh[simp]:\n fixes xvec :: \"name list\"\n and x :: \"'a::fs_name\"\n\n shows \"(set xvec) \\* x = xvec \\* x\"\nby(auto simp add: fresh_star_def)\n\nlemma name_list_supp:\n fixes xvec :: \"name list\"\n\n shows \"set xvec = supp xvec\"\nproof -\n have \"set xvec = supp(set xvec)\"\n by(simp add: at_fin_set_supp[OF at_name_inst])\n moreover have \"\\ = supp xvec\"\n by(simp add: pt_list_set_supp[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\n ultimately show ?thesis\n by simp\nqed\n\nlemma abs_fresh_list_star:\n fixes xvec :: \"name list\"\n and a :: name\n and P :: \"'a::fs_name\"\n\n shows \"(xvec \\* [a].P) = ((set xvec) - {a}) \\* P\"\nby(induct xvec) (auto simp add: fresh_star_def abs_fresh)\n\nlemma abs_fresh_set_star:\n fixes X :: \"name set\"\n and a :: name\n and P :: \"'a::fs_name\"\n\n shows \"(X \\* [a].P) = (X - {a}) \\* P\"\nby(auto simp add: fresh_star_def abs_fresh)\n\nlemmas abs_fresh_star = abs_fresh_list_star abs_fresh_set_star\n\nlemma abs_fresh_list_star'[simp]:\n fixes xvec :: \"name list\"\n and a :: name\n and P :: \"'a::fs_name\"\n\n assumes \"a \\ xvec\"\n\n shows \"xvec \\* [a].P = xvec \\* P\"\nusing assms\nby(induct xvec) (auto simp add: abs_fresh fresh_list_cons fresh_atm)\n\nlemma freshChainSym[simp]:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n \n shows \"xvec \\* yvec = yvec \\* xvec\"\nby(auto simp add: fresh_star_def fresh_def name_list_supp)\n\nlemmas [eqvt] = perm_cart_prod[OF pt_name_inst, OF pt_name_inst, OF at_name_inst]\n\nlemma name_set_avoiding:\n fixes c :: \"'a::fs_name\"\n and X :: \"name set\"\n \n assumes \"finite X\"\n and \"\\pi::name prm. \\(pi \\ X) \\* c; distinctPerm pi; set pi \\ X \\ (pi \\ X)\\ \\ thesis\"\n\n shows thesis\nusing assms\nby(rule_tac c=c in at_set_avoiding[OF at_name_inst]) (simp_all add: fs_name1)\n\nlemmas simps[simp] = fresh_atm fresh_prod\n pt3[OF pt_name_inst, OF at_ds1, OF at_name_inst]\n pt_fresh_fresh[OF pt_name_inst, OF at_name_inst]\n pt_rev_pi[OF pt_name_inst, OF at_name_inst]\n pt_pi_rev[OF pt_name_inst, OF at_name_inst]\n\nlemmas name_supp_cart_prod = supp_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\nlemmas name_fresh_cart_prod = fresh_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\nlemmas name_fresh_star_cart_prod = fresh_star_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\n\n\nlemmas name_swap_bij[simp] = pt_swap_bij[OF pt_name_inst, OF at_name_inst]\nlemmas name_swap = pt_swap[OF pt_name_inst, OF at_name_inst]\nlemmas name_set_fresh_fresh[simp] = pt_freshs_freshs[OF pt_name_inst, OF at_name_inst]\nlemmas list_fresh[simp] = fresh_list_nil fresh_list_cons fresh_list_append\n\ndefinition eqvt :: \"'a::fs_name set \\ bool\" where\n \"eqvt X \\ \\x \\ X. \\p::name prm. p \\ x \\ X\"\n\nlemma eqvtUnion[intro]:\n fixes Rel :: \"('d::fs_name) set\"\n and Rel' :: \"'d set\"\n\n assumes EqvtRel: \"eqvt Rel\"\n and EqvtRel': \"eqvt Rel'\"\n\n shows \"eqvt (Rel \\ Rel')\"\nusing assms\nby(force simp add: eqvt_def)\n\nlemma eqvtPerm[simp]: \n fixes X :: \"('d::fs_name) set\"\n and x :: name\n and y :: name\n\n assumes \"eqvt X\"\n\n shows \"([(x, y)] \\ X) = X\"\nusing assms\napply(auto simp add: eqvt_def)\napply(erule_tac x=\"[(x, y)] \\ xa\" in ballE)\napply(erule_tac x=\"[(x, y)]\" in allE)\napply simp\napply(drule_tac pi=\"[(x, y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply simp\napply(erule_tac x=xa in ballE)\napply(erule_tac x=\"[(x, y)]\" in allE)\napply(drule_tac pi=\"[(x, y)]\" and x=\"[(x, y)] \\ xa\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply simp\nby simp\n\nlemma eqvtI:\n fixes X :: \"'d::fs_name set\"\n and x :: 'd\n and p :: \"name prm\"\n \n assumes \"eqvt X\"\n and \"x \\ X\"\n \n shows \"(p \\ x) \\ X\"\nusing assms\nby(unfold eqvt_def) auto\n\nlemma fresh_star_list_nil[simp]:\n fixes xvec :: \"name list\"\n and Xs :: \"name set\"\n \n shows \"xvec \\* []\"\n and \"Xs \\* []\"\nby(auto simp add: fresh_star_def)\n\nlemma fresh_star_list_cons[simp]:\n fixes xvec :: \"name list\"\n and Xs :: \"name set\"\n and x :: \"'a::fs_name\"\n and xs :: \"'a list\"\n\n shows \"(xvec \\* (x#xs)) = ((xvec \\* x) \\ xvec \\* xs)\"\n and \"(Xs \\* (x#xs)) = ((Xs \\* x) \\ (Xs \\* xs))\"\nby(auto simp add: fresh_star_def)\n\nlemma freshStarPair[simp]:\n fixes X :: \"name set\"\n and xvec :: \"name list\"\n and x :: \"'a::fs_name\"\n and y :: \"'b::fs_name\"\n\n shows \"(X \\* (x, y)) = (X \\* x \\ X \\* y)\"\n and \"(xvec \\* (x, y)) = (xvec \\* x \\ xvec \\* y)\"\nby(auto simp add: fresh_star_def)\nlemma name_list_avoiding:\n fixes c :: \"'a::fs_name\"\n and xvec :: \"name list\"\n \n assumes \"\\pi::name prm. \\(pi \\ xvec) \\* c; distinctPerm pi; set pi \\ (set xvec) \\ (set (pi \\ xvec))\\ \\ thesis\"\n\n shows thesis\nproof -\n have \"finite(set xvec)\" by simp\n thus ?thesis using assms\n by(rule name_set_avoiding) (auto simp add: eqvts fresh_star_def)\nqed\n\nlemma distinctPermSimps[simp]:\n fixes p :: \"name prm\"\n and a :: name\n and b :: name\n\n shows \"distinctPerm([]::name prm)\"\n and \"(distinctPerm((a, b)#p)) = (distinctPerm p \\ a \\ b \\ a \\ p \\ b \\ p)\"\napply(simp add: distinctPerm_def)\napply(induct p)\napply(unfold distinctPerm_def)\napply(clarsimp)\napply(rule iffI, erule iffE)\nby(clarsimp)+\n\nlemma map_eqvt[eqvt]:\n fixes p :: \"name prm\"\n and lst :: \"'a::pt_name list\"\n\n shows \"(p \\ (map f lst)) = map (p \\ f) (p \\ lst)\"\napply(induct lst, auto) \nby(simp add: pt_fun_app_eq[OF pt_name_inst, OF at_name_inst])\n\nlemma consPerm:\n fixes x :: name\n and y :: name\n and p :: \"name prm\"\n and C :: \"'a::pt_name\"\n\n shows \"((x, y)#p) \\ C = [(x, y)] \\ p \\ C\"\nby(simp add: pt2[OF pt_name_inst, THEN sym])\n\nsimproc_setup consPerm (\"((x, y)#p) \\ C\") = \\\n fn _ => fn _ => fn ct => \n case Thm.term_of ct of \n Const (@{const_name perm}, _ ) $ (Const (@{const_name Cons}, _) $ _ $ p) $ _ =>\n (case p of\n Const (@{const_name Nil}, _) => NONE\n | _ => SOME(mk_meta_eq @{thm consPerm}))\n | _ => NONE\n\\\n\nlemma distinctEqvt[eqvt]:\n fixes p :: \"name prm\"\n and xs :: \"'a::pt_name list\"\n\n shows \"(p \\ (distinct xs)) = distinct (p \\ xs)\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma distinctClosed[simp]:\n fixes p :: \"name prm\"\n and xs :: \"'a::pt_name list\"\n\n shows \"distinct (p \\ xs) = distinct xs\"\napply(induct xs)\napply(auto simp add: eqvts)\napply(drule_tac pi=p in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: eqvts)\napply(drule_tac pi=\"rev p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\nby(simp add: eqvts)\n\nlemma lengthEqvt[eqvt]:\n fixes p :: \"name prm\"\n and xs :: \"'a::pt_name list\"\n \n shows \"p \\ (length xs) = length (p \\ xs)\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma lengthClosed[simp]:\n fixes p :: \"name prm\"\n and xs :: \"'a::pt_name list\"\n \n shows \"length (p \\ xs) = length xs\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma subsetEqvt[eqvt]:\n fixes p :: \"name prm\"\n and S :: \"('a::pt_name) set\"\n and T :: \"('a::pt_name) set\"\n\n shows \"(p \\ (S \\ T)) = ((p \\ S) \\ (p \\ T))\"\nby(rule pt_subseteq_eqvt[OF pt_name_inst, OF at_name_inst])\n\nlemma subsetClosed[simp]:\n fixes p :: \"name prm\"\n and S :: \"('a::pt_name) set\"\n and T :: \"('a::pt_name) set\"\n\n shows \"((p \\ S) \\ (p \\ T)) = (S \\ T)\"\napply auto\napply(drule_tac pi=p in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(insert pt_set_bij[OF pt_name_inst, OF at_name_inst])\napply auto\napply(drule_tac pi=\"rev p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply auto\napply(subgoal_tac \"rev p \\ x \\ T\")\napply auto\napply(drule_tac pi=\"p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply auto\napply(drule_tac pi=\"p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\nby auto\n\n\n\n shows \"(set (p \\ xvec) \\ supp (p \\ P)) = (set xvec \\ supp P)\"\nby(simp add: eqvts[THEN sym])\n\nlemma memEqvt[eqvt]:\n fixes p :: \"name prm\"\n and x :: \"'a::pt_name\"\n and xs :: \"('a::pt_name) list\"\n\n shows \"(p \\ (x mem xs)) = ((p \\ x) mem (p \\ xs))\"\nby(induct xs)\n (auto simp add: pt_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n\nlemma memClosed[simp]:\n fixes p :: \"name prm\"\n and x :: \"'a::pt_name\"\n and xs :: \"('a::pt_name) list\"\n\n shows \"(p \\ x) mem (p \\ xs) = (x mem xs)\"\nproof -\n have \"x mem xs = p \\ (x mem xs)\"\n by(case_tac \"x mem xs\") auto\n thus ?thesis by(simp add: eqvts)\nqed\n\nlemma memClosed'[simp]:\n fixes p :: \"name prm\"\n and x :: \"'a::pt_name\"\n and y :: \"'b::pt_name\"\n and xs :: \"('a \\ 'b) list\" \n\n shows \"((p \\ x, p \\ y) mem (p \\ xs)) = ((x, y) mem xs)\"\napply(subgoal_tac \"((x, y) mem xs) = (p \\ (x, y)) mem (p \\ xs)\")\napply force\nby(force simp del: eqvts)\n\n\nlemma freshPerm:\n fixes x :: name\n and p :: \"name prm\"\n\n assumes \"x \\ p\"\n\n shows \"p \\ x = x\"\nusing assms\napply(rule_tac pt_pi_fresh_fresh[OF pt_name_inst, OF at_name_inst])\nby(induct p, auto simp add: fresh_list_cons fresh_prod)\n\nlemma freshChainPermSimp:\n fixes xvec :: \"name list\"\n and p :: \"name prm\"\n\n assumes \"xvec \\* p\"\n\n shows \"p \\ xvec = xvec\"\n and \"rev p \\ xvec = xvec\"\nusing assms\nby(induct xvec) (auto simp add: freshPerm pt_bij1[OF pt_name_inst, OF at_name_inst, THEN sym])\n\nlemma freshChainAppend[simp]:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and C :: \"'a::fs_name\"\n \n shows \"(xvec@yvec) \\* C = ((xvec \\* C) \\ (yvec \\* C))\"\nby(force simp add: fresh_star_def)\n\nlemma subsetFresh:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and C :: \"'d::fs_name\"\n\n assumes \"set xvec \\ set yvec\"\n and \"yvec \\* C\"\n\n shows \"xvec \\* C\"\nusing assms\nby(auto simp add: fresh_star_def)\n\nlemma distinctPermCancel[simp]:\n fixes p :: \"name prm\"\n and T :: \"'a::pt_name\"\n\n assumes \"distinctPerm p\"\n\n shows \"(p \\ (p \\ T)) = T\"\nusing assms\nproof(induct p)\n case Nil\n show ?case by simp\nnext\n case(Cons a p)\n thus ?case\n proof(case_tac a, auto)\n fix a b\n assume \"(a::name) \\ (p::name prm)\" \"b \\ p\" \"p \\ p \\ T = T\" \"a \\ b\"\n thus \"[(a, b)] \\ p \\ [(a, b)] \\ p \\ T = T\"\n by(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst]) simp\n qed\nqed\n\nfun composePerm :: \"name list \\ name list \\ name prm\"\nwhere\n Base: \"composePerm [] [] = []\"\n| Step: \"composePerm (x#xs) (y#ys) = (x, y)#(composePerm xs ys)\"\n| Empty: \"composePerm _ _= []\"\n\nlemma composePermInduct[consumes 1, case_names cBase cStep]:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and P :: \"name list \\ name list \\ bool\"\n\n assumes L: \"length xvec = length yvec\"\n and rBase: \"P [] []\"\n and rStep: \"\\x xvec y yvec. \\length xvec = length yvec; P xvec yvec\\ \\ P (x # xvec) (y # yvec)\"\n\n shows \"P xvec yvec\"\nusing assms\nby(induct rule: composePerm.induct) auto\n\nlemma composePermEqvt[eqvt]:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n\n shows \"(p \\ (composePerm xvec yvec)) = composePerm (p \\ xvec) (p \\ yvec)\"\nby(induct xvec yvec rule: composePerm.induct) auto\n\nabbreviation\n composePermJudge (\"[_ _] \\\\<^sub>v _\" [80, 80, 80] 80) where \"[xvec yvec] \\\\<^sub>v p \\ (composePerm xvec yvec) \\ p\"\n\nabbreviation\n composePermInvJudge (\"[_ _]\\<^sup>- \\\\<^sub>v _\" [80, 80, 80] 80) where \"[xvec yvec]\\<^sup>- \\\\<^sub>v p \\ (rev (composePerm xvec yvec)) \\ p\"\n\nlemma permChainSimps[simp]:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and perm :: \"name prm\"\n and p :: \"'a::pt_name\"\n\n shows \"((composePerm xvec yvec) @ perm) \\ p = [xvec yvec] \\\\<^sub>v (perm \\ p)\"\nby(simp add: pt2[OF pt_name_inst])\n\nlemma permChainEqvt[eqvt]:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and x :: \"'a::pt_name\"\n\n shows \"(p \\ ([xvec yvec] \\\\<^sub>v x)) = [(p \\ xvec) (p \\ yvec)] \\\\<^sub>v (p \\ x)\"\n and \"(p \\ ([xvec yvec]\\<^sup>- \\\\<^sub>v x)) = [(p \\ xvec) (p \\ yvec)]\\<^sup>- \\\\<^sub>v (p \\ x)\"\nby(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst], simp add: eqvts rev_eqvt)+\n\nlemma permChainBij:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and p :: \"'a::pt_name\"\n and q :: \"'a::pt_name\"\n\n assumes \"length xvec = length yvec\"\n\n shows \"(([xvec yvec] \\\\<^sub>v p) = ([xvec yvec] \\\\<^sub>v q)) = (p = q)\"\n and \"(([xvec yvec]\\<^sup>- \\\\<^sub>v p) = ([xvec yvec]\\<^sup>- \\\\<^sub>v q)) = (p = q)\"\nusing assms\nby(induct rule: composePermInduct)\n (auto simp add: pt_bij[OF pt_name_inst, OF at_name_inst])\n\nlemma permChainAppend:\n fixes xvec1 :: \"name list\"\n and yvec1 :: \"name list\"\n and xvec2 :: \"name list\"\n and yvec2 :: \"name list\"\n and p :: \"'a::pt_name\"\n \n assumes \"length xvec1 = length yvec1\"\n\n shows \"([(xvec1@xvec2) (yvec1@yvec2)] \\\\<^sub>v p) = [xvec1 yvec1] \\\\<^sub>v [xvec2 yvec2] \\\\<^sub>v p\"\n and \"([(xvec1@xvec2) (yvec1@yvec2)]\\<^sup>- \\\\<^sub>v p) = [xvec2 yvec2]\\<^sup>- \\\\<^sub>v [xvec1 yvec1]\\<^sup>- \\\\<^sub>v p\"\nusing assms\nby(induct arbitrary: p rule: composePermInduct, auto) (simp add: pt2[OF pt_name_inst])\n\nlemma calcChainAtom:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and x :: name\n\n assumes \"length xvec = length yvec\"\n and \"x \\ xvec\"\n and \"x \\ yvec\"\n\n shows \"[xvec yvec] \\\\<^sub>v x = x\"\nusing assms\nby(induct rule: composePermInduct, auto)\n\nlemma calcChainAtomRev:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and x :: name\n\n assumes \"length xvec = length yvec\"\n and \"x \\ xvec\"\n and \"x \\ yvec\"\n\n shows \"[xvec yvec]\\<^sup>- \\\\<^sub>v x = x\"\nusing assms\nby(induct rule: composePermInduct, auto)\n (auto simp add: pt2[OF pt_name_inst] fresh_list_cons calc_atm)\n\nlemma permChainFresh[simp]:\n fixes x :: name\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and p :: \"'a::pt_name\"\n\n assumes \"x \\ xvec\"\n and \"x \\ yvec\"\n and \"length xvec = length yvec\"\n\n shows \"x \\ [xvec yvec] \\\\<^sub>v p = x \\ p\"\n and \"x \\ [xvec yvec]\\<^sup>- \\\\<^sub>v p = x \\ p\"\nusing assms\nby(auto simp add: fresh_left calcChainAtomRev calcChainAtom)\n\nlemma chainFreshFresh:\n fixes x :: name\n and y :: name\n and xvec :: \"name list\"\n and p :: \"'a::pt_name\"\n\n assumes \"x \\ xvec\"\n and \"y \\ xvec\"\n\n shows \"xvec \\* ([(x, y)] \\ p) = (xvec \\* p)\"\nusing assms\nby(induct xvec) (auto simp add: fresh_list_cons fresh_left)\n\nlemma permChainFreshFresh:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and p :: \"'a::pt_name\"\n\n assumes \"xvec \\* p\"\n and \"yvec \\* p\"\n and \"length xvec = length yvec\"\n\n shows \"[xvec yvec] \\\\<^sub>v p = p\"\n and \"[xvec yvec]\\<^sup>- \\\\<^sub>v p = p\"\nusing assms\nby(induct rule: composePerm.induct, auto) (simp add: pt2[OF pt_name_inst])\n\nlemma setFresh[simp]:\n fixes x :: name\n and xvec :: \"name list\"\n\n shows \"x \\ set xvec = x \\ xvec\"\nby(simp add: name_list_supp fresh_def)\n \nlemma calcChain:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n \n assumes \"yvec \\* xvec\"\n and \"length xvec = length yvec\"\n and \"distinct xvec\"\n and \"distinct yvec\"\n\n shows \"[xvec yvec] \\\\<^sub>v xvec = yvec\"\nusing assms\nby(induct xvec yvec rule: composePerm.induct, auto)\n (subst consPerm, simp add: calcChainAtom calc_atm name_list_supp fresh_def[symmetric])+\n\nlemma freshChainPerm:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and x :: name\n and C :: \"'a::pt_name\"\n\n assumes \"length xvec = length yvec\"\n and \"yvec \\* C\"\n and \"xvec \\* yvec\"\n and \"x mem xvec\"\n and \"distinct yvec\"\n\n shows \"x \\ [xvec yvec] \\\\<^sub>v C\"\nusing assms\nproof(induct rule: composePermInduct)\n case cBase\n have \"x mem []\" by fact\n hence False by simp\n thus ?case by simp\nnext\n case(cStep x' xvec y yvec)\n have \"(y # yvec) \\* C\" by fact\n hence yFreshC: \"y \\ C\" and yvecFreshp: \"yvec \\* C\" by simp+\n have \"(x' # xvec) \\* (y # yvec)\" by fact\n hence x'ineqy: \"x' \\ y\" and xvecFreshyvec: \"xvec \\* yvec\"\n and x'Freshyvec: \"x' \\ yvec\" and yFreshxvec: \"y \\ xvec\"\n by(auto simp add: fresh_list_cons)\n have \"distinct (y#yvec)\" by fact\n hence yFreshyvec: \"y \\ yvec\" and yvecDist: \"distinct yvec\"\n by simp+\n have L: \"length xvec = length yvec\" by fact\n have \"x \\ [(x', y)] \\ [xvec yvec] \\\\<^sub>v C\"\n proof(case_tac \"x = x'\")\n assume xeqx': \"x = x'\"\n moreover from yFreshxvec yFreshyvec yFreshC L have \"y \\ [xvec yvec] \\\\<^sub>v C\"\n by simp\n hence \"([(x, y)] \\ y) \\ [(x, y)] \\ [xvec yvec] \\\\<^sub>v C\"\n by(rule pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n with x'ineqy xeqx' show ?thesis by(simp add: calc_atm)\n next\n assume xineqx': \"x \\ x'\"\n have \"x mem (x' # xvec)\" by fact\n with xineqx' have xmemxvec: \"x mem xvec\" by simp\n moreover have \"\\yvec \\* C; xvec \\* yvec; x mem xvec; distinct yvec\\ \\ x \\ [xvec yvec] \\\\<^sub>v C\" by fact\n ultimately have \"x \\ [xvec yvec] \\\\<^sub>v C\" using yvecFreshp xvecFreshyvec yvecDist\n by simp\n hence \"([(x', y)] \\ x) \\ [(x', y)] \\ [xvec yvec] \\\\<^sub>v C\"\n by(rule pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n moreover from xmemxvec yFreshxvec have \"x \\ y\"\n by(induct xvec) (auto simp add: fresh_list_cons)\n ultimately show ?thesis using xineqx' x'ineqy by(simp add: calc_atm)\n qed\n thus ?case by simp\nqed\n\nlemma memFreshSimp[simp]:\n fixes y :: name\n and yvec :: \"name list\"\n\n shows \"(\\(y mem yvec)) = y \\ yvec\"\nby(induct yvec)\n (auto simp add: fresh_list_nil fresh_list_cons)\n\nlemma freshChainPerm':\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and p :: \"'a::pt_name\"\n\n assumes \"length xvec = length yvec\"\n and \"yvec \\* p\"\n and \"xvec \\* yvec\"\n and \"distinct yvec\"\n\n shows \"xvec \\* ([xvec yvec] \\\\<^sub>v p)\"\nusing assms\nproof(induct rule: composePermInduct)\n case cBase\n show ?case by simp\nnext\n case(cStep x xvec y yvec)\n have \"(y # yvec) \\* p\" by fact\n hence yFreshp: \"y \\ p\" and yvecFreshp: \"yvec \\* p\"\n by simp+\n moreover have \"(x # xvec) \\* (y # yvec)\" by fact\n hence xineqy: \"x \\ y\" and xvecFreshyvec: \"xvec \\* yvec\"\n and xFreshyvec: \"x \\ yvec\" and yFreshxvec: \"y \\ xvec\"\n by(auto simp add: fresh_list_cons)\n have \"distinct (y # yvec)\" by fact\n hence yFreshyvec: \"y \\ yvec\" and yvecDist: \"distinct yvec\"\n by simp+\n have L: \"length xvec = length yvec\" by fact\n have \"\\yvec \\* p; xvec \\* yvec; distinct yvec\\ \\ xvec \\* ([xvec yvec] \\\\<^sub>v p)\" by fact\n with yvecFreshp xvecFreshyvec yvecDist have IH: \"xvec \\* ([xvec yvec] \\\\<^sub>v p)\" by simp\n show ?case\n proof(auto)\n from L yFreshp yvecFreshp xineqy xvecFreshyvec yvecDist yFreshyvec yFreshxvec xFreshyvec\n have \"x \\ [(x # xvec) (y # yvec)] \\\\<^sub>v p\"\n by(rule_tac freshChainPerm) (auto simp add: fresh_list_cons)\n thus \"x \\ [(x, y)] \\ [xvec yvec] \\\\<^sub>v p\" by simp\n next\n show \"xvec \\* ([(x, y)] \\ [xvec yvec] \\\\<^sub>v p)\"\n proof(case_tac \"x mem xvec\")\n assume \"x mem xvec\"\n with L yvecFreshp xvecFreshyvec yvecDist xFreshyvec\n have\"x \\ [xvec yvec] \\\\<^sub>v p\"\n by(rule_tac freshChainPerm) (auto simp add: fresh_list_cons)\n moreover from yFreshxvec yFreshyvec yFreshp L\n have \"y \\ [xvec yvec] \\\\<^sub>v p\" by simp\n ultimately show ?thesis using IH\n by(subst consPerm) (simp add: perm_fresh_fresh)\n next\n assume \"\\(x mem xvec)\"\n hence xFreshxvec: \"x \\ xvec\" by simp\n from IH have \"([(x, y)] \\ xvec) \\* ([(x, y)] \\ [xvec yvec] \\\\<^sub>v p)\"\n by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with xFreshxvec yFreshxvec show ?thesis by simp\n qed\n qed\nqed\n\nlemma permSym:\n fixes x :: name\n and y :: name\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and p :: \"'a::pt_name\"\n \n assumes \"x \\ xvec\"\n and \"x \\ yvec\"\n and \"y \\ xvec\"\n and \"y \\ yvec\"\n and \"length xvec = length yvec\"\n\n shows \"([(x, y)] \\ [xvec yvec] \\\\<^sub>v p) = [xvec yvec] \\\\<^sub>v [(x, y)] \\ p\"\nusing assms\napply(induct rule: composePerm.induct, auto)\nby(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst]) simp\n\nlemma distinctPermClosed[simp]:\n fixes p :: \"name prm\"\n and q :: \"name prm\"\n\n assumes \"distinctPerm p\"\n\n shows \"distinctPerm(q \\ p)\"\nusing assms\nby(induct p) (auto simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst] dest: pt_bij4[OF pt_name_inst, OF at_name_inst])\n\nlemma freshStarSimps:\n fixes x :: name\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n and C :: \"'a::fs_name\"\n and p :: \"name prm\"\n \n assumes \"set p \\ Xs \\ Ys\"\n and \"Xs \\* x\"\n and \"Ys \\* x\"\n\n shows \"x \\ (p \\ C) = x \\ C\"\nusing assms\nby(subst pt_fresh_bij[OF pt_name_inst, OF at_name_inst, symmetric, of _ C p]) simp\n\nlemma freshStarChainSimps:\n fixes xvec :: \"name list\"\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n and C :: \"'a::fs_name\"\n and p :: \"name prm\"\n\n assumes \"set p \\ Xs \\ Ys\"\n and \"Xs \\* xvec\"\n and \"Ys \\* xvec\"\n\n shows \"xvec \\* (p \\ C) = xvec \\* C\"\nusing assms\nby(induct xvec) (auto simp add: freshStarSimps)\n\nlemma permStarFresh:\n fixes xvec :: \"name list\"\n and p :: \"name prm\"\n and T :: \"'a::pt_name\"\n\n assumes \"xvec \\* p\"\n\n shows \"xvec \\* (p \\ T) = xvec \\* T\"\nusing assms\nby(induct p) (auto simp add: chainFreshFresh)\n\nlemma swapStarFresh:\n fixes x :: name\n and p :: \"name prm\"\n and T :: \"'a::pt_name\"\n\n assumes \"x \\ p\"\n\n shows \"x \\ (p \\ T) = x \\ T\"\nproof -\n from assms have \"[x] \\* (p \\ T) = [x] \\* T\"\n by(rule_tac permStarFresh) auto\n thus ?thesis by simp\nqed\n\nlemmas freshChainSimps = freshStarSimps freshStarChainSimps permStarFresh swapStarFresh chainFreshFresh freshPerm subsetFresh\n\nlemma freshAlphaPerm:\n fixes xvec :: \"name list\"\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n and p :: \"name prm\"\n\n assumes S: \"set p \\ Xs \\ Ys\"\n and \"Xs \\* xvec\"\n and \"Ys \\* xvec\"\n\n shows \"xvec \\* p\"\nusing assms\napply(induct p)\nby auto (simp add: fresh_star_def fresh_def name_list_supp supp_list_nil)+\n\nlemma freshAlphaSwap:\n fixes x :: name\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n and p :: \"name prm\"\n\n assumes S: \"set p \\ Xs \\ Ys\"\n and \"Xs \\* x\"\n and \"Ys \\* x\"\n\n shows \"x \\ p\"\nproof -\n from assms have \"[x] \\* p\" \n apply(rule_tac freshAlphaPerm)\n apply assumption\n by auto\n thus ?thesis by simp\nqed\n\nlemma setToListFresh[simp]:\n fixes xvec :: \"name list\"\n and C :: \"'a::fs_name\"\n and yvec :: \"name list\"\n and Xs :: \"name set\"\n and x :: name\n\n shows \"xvec \\* (set yvec) = xvec \\* yvec\"\n and \"Xs \\* (set yvec) = Xs \\* yvec\"\n and \"x \\ (set yvec) = x \\ yvec\"\n and \"set xvec \\* Xs = xvec \\* Xs\"\nby(auto simp add: fresh_star_def name_list_supp fresh_def fs_name1 at_fin_set_supp[OF at_name_inst])\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Chain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2988502849167261}} {"text": "theory HEAP01Reify\nimports HEAP1 \nbegin \n\n(*========================================================================*)\nsection {* Refinement L0-L1 definitions *}\n(*========================================================================*)\n\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\nsubsubsection {* State reification definitions *}\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\n\ndefinition\n retr0 :: \"F1 \\ F0\"\nwhere\n \"retr0 f1 = locs f1\"\n\ndefinition \n contiguous :: \"nat set \\ bool\"\nwhere\n \"contiguous F \\ \\ m l . nat1 l \\ F = locs_of m l\"\n\ndefinition\n non_abutting :: \"nat set \\ nat set \\ bool\"\nwhere\n \"non_abutting F F' \\ (\\ x \\ F . \\ y \\ F' . x > y+1 \\ y > x + 1)\"\n\nlocale level01_new = level1_new + level0_new\nlocale level01_dispose = level1_dispose + level0_dispose\n\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\nsubsubsection {* VDM auxiliary functions *}\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\n\n(*========================================================================*)\nsection {* VDM proof obligations for L0-L1 refinement *}\n(*========================================================================*)\n\ntext {* Because of the (yet to be resolved) locale dependency/usage, we will\n avoid adding locale-based POs\n *}\n\n(* TODO: PUT in locale? *)\ndefinition\n PO_l01_adequacy :: \"bool\"\nwhere\n \"PO_l01_adequacy \\ (\\ f0 . F0_inv f0 \\ (\\! f1. f0 = retr0 f1 \\ F1_inv f1))\"\n\n(*\nlemma \"PO_l01_adequacy\" \nunfolding PO_l01_adequacy_def\napply auto\nunfolding retr0_def\ndefer\nfind_theorems \"locs _ = locs _\"\noops\n*)\n\n(* TODO: PUT in locale? Do it separate first to avoid confusion of assumptions across 4 locales! *)\ndefinition \n PO_l01_new_widen_pre :: \"bool\"\nwhere\n \"PO_l01_new_widen_pre \\ (\\ f1 s1 . F1_inv f1 \\ nat1 s1 \\ new0_pre (retr0 f1) s1 \\ new1_pre f1 s1)\"\n\ndefinition \n PO_l01_new_narrow_post :: \"bool\"\nwhere\n \"PO_l01_new_narrow_post \\ (\\ f1 f1' s1 r . F1_inv f1 \\ F1_inv f1' \\ nat1 s1 \\ \n new0_pre (retr0 f1) s1 \\ new1_post f1 s1 f1' r \\ new0_post (retr0 f1) s1 (retr0 f1') r)\"\n\ndefinition \n PO_l01_dispose_widen_pre :: \"bool\"\nwhere\n \"PO_l01_dispose_widen_pre \\ (\\ f1 d1 s1 . F1_inv f1 \\ nat1 s1 \\ \n dispose0_pre (retr0 f1) d1 s1 \\ dispose1_pre f1 d1 s1)\"\n\ndefinition \n PO_l01_dispose_narrow_post :: \"bool\"\nwhere\n \"PO_l01_dispose_narrow_post \\ (\\ f1 f1' d1 s1 . F1_inv f1 \\ F1_inv f1' \\ nat1 s1 \\ \n dispose0_pre (retr0 f1) d1 s1 \\ dispose1_post f1 d1 s1 f1' \\ \n dispose0_post (retr0 f1) d1 s1 (retr0 f1'))\"\n\nunused_thms\n\n(*\nlemma (in level1_dispose) \"False\"\nnitpick [show_all]\noops\nlemma (in level1_new) \"False\"\nnitpick [show_all]\noops\n*)\n(* NOTE: Nitpick trick to see if any axiom involved in the locales is inconsistent.\n i.e. if axioms are inconsistent, then we shouldn't be able to find a mode\n for False. If we do, then the axioms are conistent (i.e. it's unprovable \n as it should be).\n *)\nend\n", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/experiments/vdm/Heap/isa/HEAP01Reify.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2988502769805688}} {"text": "(* Title: HOL/Library/DAList_Multiset.thy\n Author: Lukas Bulwahn, TU Muenchen\n*)\n\nsection \\Multisets partially implemented by association lists\\\n\ntheory DAList_Multiset\nimports Multiset DAList\nbegin\n\ntext \\Delete prexisting code equations\\\n\nlemma [code, code del]: \"{#} = {#}\" ..\n\nlemma [code, code del]: \"single = single\" ..\n\nlemma [code, code del]: \"plus = (plus :: 'a multiset \\ _)\" ..\n\nlemma [code, code del]: \"minus = (minus :: 'a multiset \\ _)\" ..\n\nlemma [code, code del]: \"inf = (inf :: 'a multiset \\ _)\" ..\n\nlemma [code, code del]: \"sup = (sup :: 'a multiset \\ _)\" ..\n\nlemma [code, code del]: \"image_mset = image_mset\" ..\n\nlemma [code, code del]: \"Multiset.filter = Multiset.filter\" ..\n\nlemma [code, code del]: \"count = count\" ..\n\nlemma [code, code del]: \"mcard = mcard\" ..\n\nlemma [code, code del]: \"msetsum = msetsum\" ..\n\nlemma [code, code del]: \"msetprod = msetprod\" ..\n\nlemma [code, code del]: \"set_of = set_of\" ..\n\nlemma [code, code del]: \"sorted_list_of_multiset = sorted_list_of_multiset\" ..\n\nlemma [code, code del]: \"ord_multiset_inst.less_eq_multiset = ord_multiset_inst.less_eq_multiset\" ..\n\nlemma [code, code del]: \"ord_multiset_inst.less_multiset = ord_multiset_inst.less_multiset\" ..\n\nlemma [code, code del]: \"equal_multiset_inst.equal_multiset = equal_multiset_inst.equal_multiset\" ..\n\n\ntext \\Raw operations on lists\\\n\ndefinition join_raw ::\n \"('key \\ 'val \\ 'val \\ 'val) \\\n ('key \\ 'val) list \\ ('key \\ 'val) list \\ ('key \\ 'val) list\"\n where \"join_raw f xs ys = foldr (\\(k, v). map_default k v (\\v'. f k (v', v))) ys xs\"\n\nlemma join_raw_Nil [simp]: \"join_raw f xs [] = xs\"\n by (simp add: join_raw_def)\n\nlemma join_raw_Cons [simp]:\n \"join_raw f xs ((k, v) # ys) = map_default k v (\\v'. f k (v', v)) (join_raw f xs ys)\"\n by (simp add: join_raw_def)\n\nlemma map_of_join_raw:\n assumes \"distinct (map fst ys)\"\n shows \"map_of (join_raw f xs ys) x =\n (case map_of xs x of\n None \\ map_of ys x\n | Some v \\ (case map_of ys x of None \\ Some v | Some v' \\ Some (f x (v, v'))))\"\n using assms\n apply (induct ys)\n apply (auto simp add: map_of_map_default split: option.split)\n apply (metis map_of_eq_None_iff option.simps(2) weak_map_of_SomeI)\n apply (metis Some_eq_map_of_iff map_of_eq_None_iff option.simps(2))\n done\n\nlemma distinct_join_raw:\n assumes \"distinct (map fst xs)\"\n shows \"distinct (map fst (join_raw f xs ys))\"\n using assms\nproof (induct ys)\n case Nil\n then show ?case by simp\nnext\n case (Cons y ys)\n then show ?case by (cases y) (simp add: distinct_map_default)\nqed\n\ndefinition \"subtract_entries_raw xs ys = foldr (\\(k, v). AList.map_entry k (\\v'. v' - v)) ys xs\"\n\nlemma map_of_subtract_entries_raw:\n assumes \"distinct (map fst ys)\"\n shows \"map_of (subtract_entries_raw xs ys) x =\n (case map_of xs x of\n None \\ None\n | Some v \\ (case map_of ys x of None \\ Some v | Some v' \\ Some (v - v')))\"\n using assms\n unfolding subtract_entries_raw_def\n apply (induct ys)\n apply auto\n apply (simp split: option.split)\n apply (simp add: map_of_map_entry)\n apply (auto split: option.split)\n apply (metis map_of_eq_None_iff option.simps(3) option.simps(4))\n apply (metis map_of_eq_None_iff option.simps(4) option.simps(5))\n done\n\nlemma distinct_subtract_entries_raw:\n assumes \"distinct (map fst xs)\"\n shows \"distinct (map fst (subtract_entries_raw xs ys))\"\n using assms\n unfolding subtract_entries_raw_def\n by (induct ys) (auto simp add: distinct_map_entry)\n\n\ntext \\Operations on alists with distinct keys\\\n\nlift_definition join :: \"('a \\ 'b \\ 'b \\ 'b) \\ ('a, 'b) alist \\ ('a, 'b) alist \\ ('a, 'b) alist\"\n is join_raw\n by (simp add: distinct_join_raw)\n\nlift_definition subtract_entries :: \"('a, ('b :: minus)) alist \\ ('a, 'b) alist \\ ('a, 'b) alist\"\n is subtract_entries_raw\n by (simp add: distinct_subtract_entries_raw)\n\n\ntext \\Implementing multisets by means of association lists\\\n\ndefinition count_of :: \"('a \\ nat) list \\ 'a \\ nat\"\n where \"count_of xs x = (case map_of xs x of None \\ 0 | Some n \\ n)\"\n\nlemma count_of_multiset: \"count_of xs \\ multiset\"\nproof -\n let ?A = \"{x::'a. 0 < (case map_of xs x of None \\ 0::nat | Some n \\ n)}\"\n have \"?A \\ dom (map_of xs)\"\n proof\n fix x\n assume \"x \\ ?A\"\n then have \"0 < (case map_of xs x of None \\ 0::nat | Some n \\ n)\"\n by simp\n then have \"map_of xs x \\ None\"\n by (cases \"map_of xs x\") auto\n then show \"x \\ dom (map_of xs)\"\n by auto\n qed\n with finite_dom_map_of [of xs] have \"finite ?A\"\n by (auto intro: finite_subset)\n then show ?thesis\n by (simp add: count_of_def fun_eq_iff multiset_def)\nqed\n\nlemma count_simps [simp]:\n \"count_of [] = (\\_. 0)\"\n \"count_of ((x, n) # xs) = (\\y. if x = y then n else count_of xs y)\"\n by (simp_all add: count_of_def fun_eq_iff)\n\nlemma count_of_empty: \"x \\ fst ` set xs \\ count_of xs x = 0\"\n by (induct xs) (simp_all add: count_of_def)\n\nlemma count_of_filter: \"count_of (List.filter (P \\ fst) xs) x = (if P x then count_of xs x else 0)\"\n by (induct xs) auto\n\nlemma count_of_map_default [simp]:\n \"count_of (map_default x b (\\x. x + b) xs) y =\n (if x = y then count_of xs x + b else count_of xs y)\"\n unfolding count_of_def by (simp add: map_of_map_default split: option.split)\n\nlemma count_of_join_raw:\n \"distinct (map fst ys) \\\n count_of xs x + count_of ys x = count_of (join_raw (\\x (x, y). x + y) xs ys) x\"\n unfolding count_of_def by (simp add: map_of_join_raw split: option.split)\n\nlemma count_of_subtract_entries_raw:\n \"distinct (map fst ys) \\\n count_of xs x - count_of ys x = count_of (subtract_entries_raw xs ys) x\"\n unfolding count_of_def by (simp add: map_of_subtract_entries_raw split: option.split)\n\n\ntext \\Code equations for multiset operations\\\n\ndefinition Bag :: \"('a, nat) alist \\ 'a multiset\"\n where \"Bag xs = Abs_multiset (count_of (DAList.impl_of xs))\"\n\ncode_datatype Bag\n\nlemma count_Bag [simp, code]: \"count (Bag xs) = count_of (DAList.impl_of xs)\"\n by (simp add: Bag_def count_of_multiset)\n\nlemma Mempty_Bag [code]: \"{#} = Bag (DAList.empty)\"\n by (simp add: multiset_eq_iff alist.Alist_inverse DAList.empty_def)\n\nlemma single_Bag [code]: \"{#x#} = Bag (DAList.update x 1 DAList.empty)\"\n by (simp add: multiset_eq_iff alist.Alist_inverse update.rep_eq empty.rep_eq)\n\nlemma union_Bag [code]: \"Bag xs + Bag ys = Bag (join (\\x (n1, n2). n1 + n2) xs ys)\"\n by (rule multiset_eqI)\n (simp add: count_of_join_raw alist.Alist_inverse distinct_join_raw join_def)\n\nlemma minus_Bag [code]: \"Bag xs - Bag ys = Bag (subtract_entries xs ys)\"\n by (rule multiset_eqI)\n (simp add: count_of_subtract_entries_raw alist.Alist_inverse\n distinct_subtract_entries_raw subtract_entries_def)\n\nlemma filter_Bag [code]: \"Multiset.filter P (Bag xs) = Bag (DAList.filter (P \\ fst) xs)\"\n by (rule multiset_eqI) (simp add: count_of_filter DAList.filter.rep_eq)\n\n\nlemma mset_eq [code]: \"HOL.equal (m1::'a::equal multiset) m2 \\ m1 \\ m2 \\ m2 \\ m1\"\n by (metis equal_multiset_def eq_iff)\n\ntext \\By default the code for @{text \"<\"} is @{prop\"xs < ys \\ xs \\ ys \\ \\ xs = ys\"}.\nWith equality implemented by @{text\"\\\"}, this leads to three calls of @{text\"\\\"}.\nHere is a more efficient version:\\\nlemma mset_less[code]: \"xs < (ys :: 'a multiset) \\ xs \\ ys \\ \\ ys \\ xs\"\n by (rule less_le_not_le)\n\nlemma mset_less_eq_Bag0:\n \"Bag xs \\ A \\ (\\(x, n) \\ set (DAList.impl_of xs). count_of (DAList.impl_of xs) x \\ count A x)\"\n (is \"?lhs \\ ?rhs\")\nproof\n assume ?lhs\n then show ?rhs by (auto simp add: mset_le_def)\nnext\n assume ?rhs\n show ?lhs\n proof (rule mset_less_eqI)\n fix x\n from \\?rhs\\ have \"count_of (DAList.impl_of xs) x \\ count A x\"\n by (cases \"x \\ fst ` set (DAList.impl_of xs)\") (auto simp add: count_of_empty)\n then show \"count (Bag xs) x \\ count A x\" by (simp add: mset_le_def)\n qed\nqed\n\nlemma mset_less_eq_Bag [code]:\n \"Bag xs \\ (A :: 'a multiset) \\ (\\(x, n) \\ set (DAList.impl_of xs). n \\ count A x)\"\nproof -\n {\n fix x n\n assume \"(x,n) \\ set (DAList.impl_of xs)\"\n then have \"count_of (DAList.impl_of xs) x = n\"\n proof transfer\n fix x n\n fix xs :: \"('a \\ nat) list\"\n show \"(distinct \\ map fst) xs \\ (x, n) \\ set xs \\ count_of xs x = n\"\n proof (induct xs)\n case Nil\n then show ?case by simp\n next\n case (Cons ym ys)\n obtain y m where ym: \"ym = (y,m)\" by force\n note Cons = Cons[unfolded ym]\n show ?case\n proof (cases \"x = y\")\n case False\n with Cons show ?thesis\n unfolding ym by auto\n next\n case True\n with Cons(2-3) have \"m = n\" by force\n with True show ?thesis\n unfolding ym by auto\n qed\n qed\n qed\n }\n then show ?thesis\n unfolding mset_less_eq_Bag0 by auto\nqed\n\ndeclare multiset_inter_def [code]\ndeclare sup_multiset_def [code]\ndeclare multiset_of.simps [code]\n\n\nfun fold_impl :: \"('a \\ nat \\ 'b \\ 'b) \\ 'b \\ ('a \\ nat) list \\ 'b\"\nwhere\n \"fold_impl fn e ((a,n) # ms) = (fold_impl fn ((fn a n) e) ms)\"\n| \"fold_impl fn e [] = e\"\n\ndefinition fold :: \"('a \\ nat \\ 'b \\ 'b) \\ 'b \\ ('a, nat) alist \\ 'b\"\n where \"fold f e al = fold_impl f e (DAList.impl_of al)\"\n\nhide_const (open) fold\n\ncontext comp_fun_commute\nbegin\n\nlemma DAList_Multiset_fold:\n assumes fn: \"\\a n x. fn a n x = (f a ^^ n) x\"\n shows \"Multiset.fold f e (Bag al) = DAList_Multiset.fold fn e al\"\n unfolding DAList_Multiset.fold_def\nproof (induct al)\n fix ys\n let ?inv = \"{xs :: ('a \\ nat) list. (distinct \\ map fst) xs}\"\n note cs[simp del] = count_simps\n have count[simp]: \"\\x. count (Abs_multiset (count_of x)) = count_of x\"\n by (rule Abs_multiset_inverse[OF count_of_multiset])\n assume ys: \"ys \\ ?inv\"\n then show \"Multiset.fold f e (Bag (Alist ys)) = fold_impl fn e (DAList.impl_of (Alist ys))\"\n unfolding Bag_def unfolding Alist_inverse[OF ys]\n proof (induct ys arbitrary: e rule: list.induct)\n case Nil\n show ?case\n by (rule trans[OF arg_cong[of _ \"{#}\" \"Multiset.fold f e\", OF multiset_eqI]])\n (auto, simp add: cs)\n next\n case (Cons pair ys e)\n obtain a n where pair: \"pair = (a,n)\"\n by force\n from fn[of a n] have [simp]: \"fn a n = (f a ^^ n)\"\n by auto\n have inv: \"ys \\ ?inv\"\n using Cons(2) by auto\n note IH = Cons(1)[OF inv]\n def Ys \\ \"Abs_multiset (count_of ys)\"\n have id: \"Abs_multiset (count_of ((a, n) # ys)) = ((op + {# a #}) ^^ n) Ys\"\n unfolding Ys_def\n proof (rule multiset_eqI, unfold count)\n fix c\n show \"count_of ((a, n) # ys) c =\n count ((op + {#a#} ^^ n) (Abs_multiset (count_of ys))) c\" (is \"?l = ?r\")\n proof (cases \"c = a\")\n case False\n then show ?thesis\n unfolding cs by (induct n) auto\n next\n case True\n then have \"?l = n\" by (simp add: cs)\n also have \"n = ?r\" unfolding True\n proof (induct n)\n case 0\n from Cons(2)[unfolded pair] have \"a \\ fst ` set ys\" by auto\n then show ?case by (induct ys) (simp, auto simp: cs)\n next\n case Suc\n then show ?case by simp\n qed\n finally show ?thesis .\n qed\n qed\n show ?case\n unfolding pair\n apply (simp add: IH[symmetric])\n unfolding id Ys_def[symmetric]\n apply (induct n)\n apply (auto simp: fold_mset_fun_left_comm[symmetric])\n done\n qed\nqed\n\nend\n\nlift_definition single_alist_entry :: \"'a \\ 'b \\ ('a, 'b) alist\" is \"\\a b. [(a, b)]\"\n by auto\n\nlemma image_mset_Bag [code]:\n \"image_mset f (Bag ms) =\n DAList_Multiset.fold (\\a n m. Bag (single_alist_entry (f a) n) + m) {#} ms\"\n unfolding image_mset_def\nproof (rule comp_fun_commute.DAList_Multiset_fold, unfold_locales, (auto simp: ac_simps)[1])\n fix a n m\n show \"Bag (single_alist_entry (f a) n) + m = ((op + \\ single \\ f) a ^^ n) m\" (is \"?l = ?r\")\n proof (rule multiset_eqI)\n fix x\n have \"count ?r x = (if x = f a then n + count m x else count m x)\"\n by (induct n) auto\n also have \"\\ = count ?l x\"\n by (simp add: single_alist_entry.rep_eq)\n finally show \"count ?l x = count ?r x\" ..\n qed\nqed\n\nhide_const single_alist_entry\n\n(* we cannot use (\\a n. op + (a * n)) for folding, since * is not defined\n in comm_monoid_add *)\nlemma msetsum_Bag[code]: \"msetsum (Bag ms) = DAList_Multiset.fold (\\a n. ((op + a) ^^ n)) 0 ms\"\n unfolding msetsum.eq_fold\n apply (rule comp_fun_commute.DAList_Multiset_fold)\n apply unfold_locales\n apply (auto simp: ac_simps)\n done\n\n(* we cannot use (\\a n. op * (a ^ n)) for folding, since ^ is not defined\n in comm_monoid_mult *)\nlemma msetprod_Bag[code]: \"msetprod (Bag ms) = DAList_Multiset.fold (\\a n. ((op * a) ^^ n)) 1 ms\"\n unfolding msetprod.eq_fold\n apply (rule comp_fun_commute.DAList_Multiset_fold)\n apply unfold_locales\n apply (auto simp: ac_simps)\n done\n\nlemma mcard_fold: \"mcard A = Multiset.fold (\\_. Suc) 0 A\" (is \"_ = Multiset.fold ?f _ _\")\nproof -\n interpret comp_fun_commute ?f by default auto\n show ?thesis by (induct A) auto\nqed\n\nlemma mcard_Bag[code]: \"mcard (Bag ms) = DAList_Multiset.fold (\\a n. op + n) 0 ms\"\n unfolding mcard_fold\nproof (rule comp_fun_commute.DAList_Multiset_fold, unfold_locales, simp)\n fix a n x\n show \"n + x = (Suc ^^ n) x\"\n by (induct n) auto\nqed\n\n\nlemma set_of_fold: \"set_of A = Multiset.fold insert {} A\" (is \"_ = Multiset.fold ?f _ _\")\nproof -\n interpret comp_fun_commute ?f by default auto\n show ?thesis by (induct A) auto\nqed\n\nlemma set_of_Bag[code]:\n \"set_of (Bag ms) = DAList_Multiset.fold (\\a n. (if n = 0 then (\\m. m) else insert a)) {} ms\"\n unfolding set_of_fold\nproof (rule comp_fun_commute.DAList_Multiset_fold, unfold_locales, (auto simp: ac_simps)[1])\n fix a n x\n show \"(if n = 0 then \\m. m else insert a) x = (insert a ^^ n) x\" (is \"?l n = ?r n\")\n proof (cases n)\n case 0\n then show ?thesis by simp\n next\n case (Suc m)\n then have \"?l n = insert a x\" by simp\n moreover have \"?r n = insert a x\" unfolding Suc by (induct m) auto\n ultimately show ?thesis by auto\n qed\nqed\n\n\ninstantiation multiset :: (exhaustive) exhaustive\nbegin\n\ndefinition exhaustive_multiset ::\n \"('a multiset \\ (bool \\ term list) option) \\ natural \\ (bool \\ term list) option\"\n where \"exhaustive_multiset f i = Quickcheck_Exhaustive.exhaustive (\\xs. f (Bag xs)) i\"\n\ninstance ..\n\nend\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Library/DAList_Multiset.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2988502769805688}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | December 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_step_ext\nimports CSP_F_law_basic CSP_T.CSP_T_law_step_ext\nbegin\n\n(*****************************************************************\n\n 1. step laws\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n (P1 [> P2) |[X]| (Q1 [> Q2)\n *********************************************************)\n\n(* The following law in p.288 does not hold. *)\n(* (P1 [> P2) |[X]| (Q1 [> Q2) *)\n(* =F (P1 |[X]| Q1) [> ((P2 |[X]| (Q1 [> Q2)) |~| ((P1 [> P2) |[X]| Q2)) *)\n(* *)\n(* a counter example: *)\n(* P1 = a -> STOP, P2 = STOP, Q1 = STOP, Q2 = b -> STOP, X = {} *)\n(* where (a ~= b) *)\n(* *)\n(* check the following lemmas *)\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) ~:f \n failures ((a -> STOP [> STOP) |[{}]| (STOP [> (b -> STOP))) M\"\napply (simp add: in_failures in_traces)\napply (intro allI impI)\napply (simp add: par_tr_Ev)\napply (erule disjE)\napply (auto)\ndone\n\nlemma \"(, {(Ev b)}) :f\n failures (((a -> STOP) |[{}]| STOP) [> \n ((STOP |[{}]| (STOP [> (b -> STOP))) |~| \n (((a -> STOP [> STOP) |[X]| (b -> STOP))))) M\"\napply (simp add: in_failures in_traces)\napply (rule disjI1)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (simp)\napply (rule_tac x=\"\" in exI)\napply (simp add: par_tr_nil_right)\ndone\n\n(*********************************************************\n (P [> Q) |[X]| (? :Y -> Rf)\n *********************************************************)\n\n(* The following law in p.289 does not hold. *)\n(* *)\n(* (P [> Q) |[X]| (? :Y -> Rf) =F[M,M] *)\n(* (? x:(Y - X) -> ((P [> Q) |[X]| Rf x)) *)\n(* [+] ((P |[X]| (? :Y -> Rf)) [> (Q |[X]| (? :Y -> Rf))) *)\n(* *)\n(* a counter example: *)\n(* P = STOP, Q = b -> STOP, Y = {a}, Rf = (%x. STOP), X = {} *)\n(* where (a ~= b) *)\n(* *)\n(* check the following lemmas *)\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) ~:f \n failures ((STOP [> (b -> STOP)) |[{}]| (? x:{a} -> STOP)) M\"\napply (simp add: in_failures in_traces)\napply (intro allI impI)\napply (simp add: par_tr_Ev)\napply (erule disjE)\napply (auto)\ndone\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) :f \n failures ((? x:({a} - {}) -> ((STOP [> (b -> STOP)) |[{}]| STOP))\n [+] ((STOP |[{}]| (? x:{a} -> STOP)) \n [> ((b -> STOP) |[{}]| (? x:{a} -> STOP)))) M\"\napply (fold Timeout_def)\napply (simp add: in_failures in_failures_Timeout in_traces)\napply (rule disjI2)\napply (rule disjI2)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (simp)\napply (rule_tac x=\"\" in exI)\napply (simp add: par_tr_nil_left)\ndone\n\n(*********************************************************\n Parallel expansion & distribbution\n *********************************************************)\n\nlemma cspF_Parallel_Timeout_split:\n \"((? :Y -> Pf) [> P) |[X]| ((? :Z -> Qf) [> Q) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| ((? :Z -> Qf) [> Q)) |~|\n (((? :Y -> Pf) [> P) |[X]| Q)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_Timeout_split)\napply (fold Timeout_def)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (force)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n (* main part *)\n\n apply (case_tac \"s = <>\", simp, simp)\n apply (rule disjI2)\n apply (rule disjI2)\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim exE disjE)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (elim conjE disjE)\n\n (* sync *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* left *)\n apply (simp)\n apply (case_tac \"c:Z\")\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* right *)\n apply (simp)\n apply (case_tac \"c:Y\")\n\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* others *)\n\n apply (simp add: in_traces)\n apply (simp add: in_traces)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* main part *)\n\n (* sync *)\n apply (simp add: in_failures_Parallel)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Z\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Z *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Y\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Y *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* others *)\n\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n Parallel expansion & distribbution 2\n *********************************************************)\n\n(*** left ****)\n\nlemma cspF_Parallel_Timeout_input_l: \n \"((? :Y -> Pf) [> P) |[X]| (? :Z -> Qf) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| (? :Z -> Qf))))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_Timeout_input)\napply (fold Timeout_def)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (force)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n apply (simp add: par_tr_nil_right)\n apply (rule disjI2)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (elim conjE)\n apply (simp add: image_iff)\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (simp add: in_traces)\n\n (* main part *)\n\n apply (case_tac \"s = <>\", simp, simp)\n apply (rule disjI2)\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim exE disjE)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (elim conjE disjE)\n\n (* sync *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* left *)\n apply (simp)\n apply (case_tac \"c:Z\")\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* right *)\n apply (simp)\n apply (case_tac \"c:Y\")\n\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* others *)\n\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* main part *)\n\n (* sync *)\n apply (simp add: in_failures_Parallel)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Z\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* a ~: Z *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Y\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* a ~: Y *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* others *)\n\n apply (simp add: in_traces)\ndone\n\n(*** right ****)\n\nlemma cspF_Parallel_Timeout_input_r: \n \"(? :Y -> Pf) |[X]| ((? :Z -> Qf) [> Q) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| ((? x:Y -> Pf x) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n [> ((? :Y -> Pf) |[X]| Q)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Timeout_input_l)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (force)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\n\napply (case_tac \"a : Z & a : Y\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_True)\napply (rule cspF_rw_right)\napply (rule cspF_IF_True)\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_decompo)\napply (rule cspF_commut)\napply (rule cspF_commut)\n\napply (simp (no_asm_simp))\napply (rule cspF_rw_left)\napply (rule cspF_IF_False)\napply (rule cspF_rw_right)\napply (subgoal_tac \"~ (a : Y & a : Z)\")\napply (simp (no_asm_simp))\napply (rule cspF_IF_False)\napply (force)\n\napply (case_tac \"a : Z\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_True)\napply (rule cspF_rw_right)\napply (rule cspF_IF_False)\napply (rule cspF_commut)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_False)\napply (rule cspF_rw_right)\napply (rule cspF_IF_True)\napply (rule cspF_commut)\n\napply (rule cspF_reflex)\napply (rule cspF_commut)\ndone\n\nlemmas cspF_Parallel_Timeout_input\n = cspF_Parallel_Timeout_input_l\n cspF_Parallel_Timeout_input_r\n\n(*** cspF_step_ext ***)\n\nlemmas cspF_step_ext = cspF_Parallel_Timeout_split\n cspF_Parallel_Timeout_input\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_step_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.29875990519376}} {"text": "theory Incredible_Predicate_Tasks\nimports\n Incredible_Completeness\n Incredible_Predicate\n \"HOL-Eisbach.Eisbach\"\nbegin\n\ndeclare One_nat_def [simp del]\n\ncontext ND_Rules_Inst begin\nlemma eff_NatRuleI:\n \"nat_rule rule c ants\n \\ entail = (\\ \\ subst s (freshen a c))\n \\ hyps = ((\\ant. ((\\p. subst s (freshen a p)) |`| a_hyps ant |\\| \\ \\ subst s (freshen a (a_conc ant)))) |`| ants)\n \\ (\\ ant f. ant |\\| ants \\ f |\\| \\ \\ freshenLC a ` (a_fresh ant) \\ lconsts f = {})\n \\ (\\ ant. ant |\\| ants \\ freshenLC a ` (a_fresh ant) \\ subst_lconsts s = {})\n \\ eff (NatRule rule) entail hyps\"\n by (drule eff.intros(2)) simp_all\nend\n\ncontext Abstract_Task begin\nlemma natEff_InstI:\n \"rule = (r,c)\n \\ c \\ set (consequent r)\n \\ antec = f_antecedent r\n \\ natEff_Inst rule c antec\"\n by (metis natEff_Inst.intros)\nend\n\ncontext begin\n\ntext \\A typical task with local constants:: \\\\x. Q x \\ Q x\\\\\n\ntext \\First the task is defined as an @{term Abstract_Task}.\\\n\ninterpretation task: Abstract_Task\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n antecedent\n consequent\n prop_rules\n \"[]\"\n \"[ForallX (imp (Q x) (Q x))]\"\nby unfold_locales auto\n\ntext \\Then we show, that this task has a proof within our formalization of natural deduction\n by giving a concrete proof tree.\\\n\nabbreviation lx :: \"nat\" where \"lx \\ to_nat (1::nat,0::nat)\"\n\nabbreviation base_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"base_tree \\ Node ({|Q (LC lx)|} \\ Q (LC lx), Axiom) {||}\"\n\nabbreviation imp_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"imp_tree \\ Node ({||} \\ imp (Q (LC lx)) (Q (LC lx)), NatRule (impI, imp X Y)) {|base_tree|}\"\n\nabbreviation solution_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"solution_tree \\ Node ({||} \\ ForallX (imp (Q x) (Q x)), NatRule (allI, ForallX (P x))) {|imp_tree|}\"\n\nabbreviation s1 where \"s1 \\ [(12, ([9], imp (Q x) (Q x)))] \"\nabbreviation s2 where \"s2 \\ [(10, ([], Q (LC lx))), (11, ([], Q (LC lx)))] \"\n\nlemma fv_subst_s1[simp]: \"fv_subst s1 = {}\"\n by (simp add: fv_subst_def)\n\nlemma subst1_simps[simp]:\n \"subst s1 (P (LC n)) = imp (Q (LC n)) (Q (LC n))\"\n \"subst s1 (ForallX (P x)) = ForallX (imp (Q x) (Q x))\"\n by simp_all\n\nlemma subst2_simps[simp]:\n \"subst s2 X = Q (LC lx)\" \n \"subst s2 Y = Q (LC lx)\"\n \"subst s2 (imp X Y) = imp (subst s2 X) (subst s2 Y)\"\n by simp_all\n\nlemma substI1: \"ForallX (imp (Q x) (Q x)) = subst s1 (predicate.freshen 1 (ForallX (P x)))\"\n by (auto simp add: predicate.freshen_def Let_def)\n\nlemma substI2: \"imp (Q (LC lx)) (Q (LC lx)) = subst s2 (predicate.freshen 2 (imp X Y))\"\n by (auto simp add: predicate.freshen_def Let_def)\n\ndeclare subst.simps[simp del]\n\nlemma \"task.solved\"\n unfolding task.solved_def\napply clarsimp\napply (rule_tac x=\"{||}\" in exI)\napply clarsimp\napply (rule_tac x=\"solution_tree\" in exI)\napply clarsimp\napply (rule conjI)\n\n apply (rule task.wf)\n apply (solves \\(auto simp add: stream.set_map task.n_rules_def)[1]\\)\n apply clarsimp\n apply (rule task.eff_NatRuleI)\n apply (solves \\rule task.natEff_Inst.intros;simp\\)\n apply clarsimp \n apply (rule conjI)\n apply (solves \\simp\\)\n apply (solves \\rule substI1\\)\n apply (simp add: predicate.f_antecedent_def predicate.freshen_def)\n apply (subst antecedent.sel(2))\n apply (solves \\simp\\)\n apply (solves \\simp\\)\n apply (solves \\simp\\)\n apply simp\n\n apply (rule task.wf)\n apply (solves \\(auto simp add: stream.set_map task.n_rules_def)[1]\\)\n apply clarsimp\n apply (rule task.eff_NatRuleI)\n apply (solves \\rule task.natEff_Inst.intros; simp\\)\n apply clarsimp \n apply (rule conjI)\n apply (solves \\simp\\)\n apply (solves \\rule substI2\\)\n apply (solves \\simp add: predicate.f_antecedent_def predicate.freshen_def\\)\n apply (solves \\simp\\)\n apply (solves \\simp add: predicate.f_antecedent_def\\)\n apply simp\n\n apply (solves \\(auto intro: task.wf intro!: task.eff.intros(1))[1]\\)\napply (solves \\(rule tfinite.intros, simp)+\\)\ndone\n\nabbreviation vertices where \"vertices \\ {|0::nat,1,2 |}\"\nfun nodeOf where \n \"nodeOf n = [Conclusion (ForallX (imp (Q x) (Q x))), \n Rule allI, \n Rule impI] ! n \"\n\nfun inst where \n \"inst n = [[],s1,s2] ! n\"\n\n\ninterpretation task: Vertex_Graph task.nodes task.inPorts task.outPorts vertices nodeOf.\n\nabbreviation e1 :: \"(nat, form, nat) edge'\"\n where \"e1 \\ ((1,Reg (ForallX (P x))), (0,plain_ant (ForallX (imp (Q x) (Q x)))))\"\nabbreviation e2 :: \"(nat, form, nat) edge'\"\n where \"e2 \\ ((2,Reg (imp X Y)), (1,allI_input))\"\nabbreviation e3 :: \"(nat, form, nat) edge'\"\n where \"e3 \\ ((2,Hyp X (impI_input)), (2,impI_input))\"\nabbreviation task_edges :: \"(nat, form, nat) edge' set\" where \"task_edges \\ {e1, e2, e3}\"\n\n\ninterpretation task: Scoped_Graph task.nodes task.inPorts task.outPorts vertices nodeOf task_edges task.hyps\n by standard (auto simp add: predicate.f_consequent_def predicate.f_antecedent_def)\n\ninterpretation task: Instantiation\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n task_edges\n vertices\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n \"id\"\n \"inst\"\nby unfold_locales simp\n\ntext \\Finally we can also show that there is a proof graph for this task.\\\n\ninterpretation Well_Scoped_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\nby standard (auto split: if_splits)\n\nlemma no_path_01[simp]: \"task.path 0 v pth \\ (pth = [] \\ v = 0)\"\n by (cases pth) (auto simp add: task.path_cons_simp)\nlemma no_path_12[simp]: \"\\ task.path 1 2 pth\"\n by (cases pth) (auto simp add: task.path_cons_simp)\n\ninterpretation Acyclic_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\nproof\n fix v pth \n assume \"task.path v v pth\" and \"task.hyps_free pth\"\n thus \"pth = []\"\n by (cases pth) (auto simp add: task.path_cons_simp predicate.f_antecedent_def)\nqed\n\ninterpretation Saturated_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\nby standard\n (auto simp add: predicate.f_consequent_def predicate.f_antecedent_def) \n\ninterpretation Pruned_Port_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\nproof\n fix v\n assume \"v |\\| vertices\"\n hence \"\\ pth. task.path v 0 pth\"\n apply auto\n apply (rule exI[where x = \"[e1]\"], auto simp add: task.path_cons_simp)\n apply (rule exI[where x = \"[e2,e1]\"], auto simp add: task.path_cons_simp)\n done\n moreover\n have \"task.terminal_vertex 0\" by auto\n ultimately\n show \"\\pth v'. task.path v v' pth \\ task.terminal_vertex v'\" by blast\nqed\n\ninterpretation Well_Shaped_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf task_edges\n task.hyps\n..\n\ninterpretation Solution\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n vertices\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n id\n inst\n task_edges\nby standard\n (auto simp add: task.labelAtOut_def task.labelAtIn_def predicate.freshen_def, subst antecedent.sel, simp)\n\ninterpretation Proof_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n id\n inst\n..\n\nlemma path_20:\n assumes \"task.path 2 0 pth\"\n shows \"(1, allI_input) \\ snd ` set pth\"\nproof-\n { fix v\n assume \"task.path v 0 pth\"\n hence \"v = 0 \\ v = 1 \\ (1, allI_input) \\ snd ` set pth\"\n by (induction v \"0::nat\" pth rule: task.path.induct) auto\n }\n from this[OF assms]\n show ?thesis by auto\nqed\n\nlemma scope_21: \"2 \\ task.scope (1, allI_input)\"\n by (auto intro!: task.scope.intros elim: path_20 simp add: task.outPortsRule_def predicate.f_antecedent_def predicate.f_consequent_def)\n\ninterpretation Scoped_Proof_Graph\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n vertices\n task.labelsIn\n task.labelsOut\n id\n inst\n task_edges\n task.local_vars\nby standard (auto simp add: predicate.f_antecedent_def scope_21)\n\ninterpretation Tasked_Proof_Graph\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n antecedent\n consequent\n prop_rules\n \"[]\"\n \"[ForallX (imp (Q x) (Q x))]\"\n vertices\n nodeOf\n task_edges\n id\n inst\nby unfold_locales auto\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Incredible_Proof_Machine/Incredible_Predicate_Tasks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.29875989732867797}} {"text": "(******************************************************************************\n * Clean\n *\n * Copyright (c) 2018-2019 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\n(*\n * Quicksort : all at a glance. \n *\n * Authors : Burkhart Wolff, Frédéric Tuong\n *)\n\nchapter \\ Clean Semantics : A Coding-Concept Example\\\n\ntext\\The following show-case introduces subsequently a non-trivial example involving\nlocal and global variable declarations, declarations of operations with pre-post conditions as\nwell as direct-recursive operations (i.e. C-like functions with side-effects on global and\nlocal variables. \\\n\ntheory Quicksort\n imports Clean.Clean\n Clean.Hoare_Clean\n Clean.Clean_Symbex\nbegin\n\nsection\\The Quicksort Example - At a Glance\\\n\ntext\\ We present the following quicksort algorithm in some conceptual, high-level notation:\n\n\\begin{isar}\nalgorithm (A,i,j) =\n tmp := A[i];\n A[i]:=A[j];\n A[j]:=tmp\n\nalgorithm partition(A, lo, hi) is\n pivot := A[hi]\n i := lo\n for j := lo to hi - 1 do\n if A[j] < pivot then\n swap A[i] with A[j]\n i := i + 1\n swap A[i] with A[hi]\n return i\n\nalgorithm quicksort(A, lo, hi) is\n if lo < hi then\n p := partition(A, lo, hi)\n quicksort(A, lo, p - 1)\n quicksort(A, p + 1, hi)\n\n\\end{isar}\n\\\n\n\nsection\\Clean Encoding of the Global State of Quicksort\\\n\n\nglobal_vars state\n A :: \"int list\"\n\nfunction_spec swap (i::nat,j::nat) \\ \\TODO: the hovering on parameters produces a number of report equal to the number of \\<^ML>\\Proof_Context.add_fixes\\ called in \\<^ML>\\Function_Specification_Parser.checkNsem_function_spec\\\\\npre \"\\i < length A \\ j < length A\\\" \npost \"\\\\res. length A = length(old A) \\ res = ()\\\" \nlocal_vars tmp :: int \ndefines \" \\ tmp := A ! i\\ ;-\n \\ A := list_update A i (A ! j)\\ ;- \n \\ A := list_update A j tmp\\ \" \n\n\nfunction_spec partition (lo::nat, hi::nat) returns nat\npre \"\\lo < length A \\ hi < length A\\\" \npost \"\\\\res::nat. length A = length(old A) \\ res = 3\\\" \nlocal_vars pivot :: int\n i :: nat\n j :: nat\ndefines \" \\pivot := A ! hi \\ ;- \\i := lo \\ ;- \\j := lo \\ ;-\n while\\<^sub>C \\j \\ hi - 1 \\ \n do if\\<^sub>C \\A ! j < pivot\\ \n then call\\<^sub>C swap \\(i , j) \\ ;-\n \\i := i + 1 \\\n else skip\\<^sub>S\\<^sub>E \n fi ;-\n \\j := j + 1 \\ \n od;-\n call\\<^sub>C swap \\(i, j)\\ ;-\n return\\<^bsub>local_partition_state.result_value_update\\<^esub> \\i\\\" \n\nthm partition_core_def\n\n\nrec_function_spec quicksort (lo::nat, hi::nat) returns unit\npre \"\\lo \\ hi \\ hi < length A\\\"\npost \"\\\\res::unit. \\i\\{lo .. hi}. \\j\\{lo .. hi}. i \\ j \\ A!i \\ A!j\\\"\nvariant \"hi - lo\" \nlocal_vars p :: \"nat\" \ndefines \" if\\<^sub>C \\lo < hi\\ \n then (p\\<^sub>t\\<^sub>m\\<^sub>p \\ call\\<^sub>C partition \\(lo, hi)\\ ; assign_local p_update (\\\\. p\\<^sub>t\\<^sub>m\\<^sub>p)) ;-\n call\\<^sub>C quicksort \\(lo, p - 1)\\ ;-\n call\\<^sub>C quicksort \\(lo, p + 1)\\ \n else skip\\<^sub>S\\<^sub>E \n fi\"\n\n\nthm quicksort_core_def\nthm quicksort_def\nthm quicksort_pre_def\nthm quicksort_post_def\n\nsection\\Possible Application Sketch\\\n\nlemma quicksort_correct : \n \"\\\\\\. \\ \\ \\ quicksort_pre (lo, hi)(\\) \\ \\ = \\\\<^sub>p\\<^sub>r\\<^sub>e \\ \n quicksort (lo, hi) \n \\\\r \\. \\ \\ \\ quicksort_post(lo, hi)(\\\\<^sub>p\\<^sub>r\\<^sub>e)(\\)(r) \\\"\n oops\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Clean/examples/Quicksort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.29875989732867786}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\n(*\n Changes since submission on 2009-11-26:\n\n 2009-12-10: OrderedMap, algorithms for iterators, min, max, to_sorted_list\n\n*)\n\nsection {* \\isaheader{Generic Algorithms for Maps} *}\ntheory MapGA\nimports SetIteratorCollectionsGA\nbegin\n\ntext_raw {*\\label{thy:MapGA}*}\n\nrecord ('k,'v,'s) map_basic_ops =\n bmap_op_\\ :: \"('k,'v,'s) map_\\\"\n bmap_op_invar :: \"('k,'v,'s) map_invar\"\n bmap_op_empty :: \"('k,'v,'s) map_empty\"\n bmap_op_lookup :: \"('k,'v,'s) map_lookup\"\n bmap_op_update :: \"('k,'v,'s) map_update\"\n bmap_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n bmap_op_delete :: \"('k,'v,'s) map_delete\"\n bmap_op_list_it :: \"('k,'v,'s) map_list_it\"\n \nrecord ('k,'v,'s) omap_basic_ops = \"('k,'v,'s) map_basic_ops\" +\n bmap_op_ordered_list_it :: \"'s \\ ('k,'v,('k\\'v) list) map_iterator\"\n bmap_op_rev_list_it :: \"'s \\ ('k,'v,('k\\'v) list) map_iterator\"\n\nlocale StdBasicMapDefs = \n poly_map_iteratei_defs \"bmap_op_list_it ops\" \n for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n abbreviation \\ where \"\\ == bmap_op_\\ ops\" \n abbreviation invar where \"invar == bmap_op_invar ops\" \n abbreviation empty where \"empty == bmap_op_empty ops\" \n abbreviation lookup where \"lookup == bmap_op_lookup ops\" \n abbreviation update where \"update == bmap_op_update ops\" \n abbreviation update_dj where \"update_dj == bmap_op_update_dj ops\" \n abbreviation delete where \"delete == bmap_op_delete ops\" \n abbreviation list_it where \"list_it == bmap_op_list_it ops\" \nend\n\nlocale StdBasicOMapDefs = StdBasicMapDefs ops\n + poly_map_iterateoi_defs \"bmap_op_ordered_list_it ops\"\n + poly_map_rev_iterateoi_defs \"bmap_op_rev_list_it ops\"\n for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\n abbreviation ordered_list_it where \"ordered_list_it \n \\ bmap_op_ordered_list_it ops\"\n abbreviation rev_list_it where \"rev_list_it \n \\ bmap_op_rev_list_it ops\"\nend\n\nlocale StdBasicMap = StdBasicMapDefs ops +\n map \\ invar +\n map_empty \\ invar empty +\n map_lookup \\ invar lookup +\n map_update \\ invar update +\n map_update_dj \\ invar update_dj +\n map_delete \\ invar delete +\n poly_map_iteratei \\ invar list_it\n for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n lemmas correct[simp] = empty_correct lookup_correct update_correct \n update_dj_correct delete_correct\nend\n\n\nlocale StdBasicOMap = \n StdBasicOMapDefs ops +\n StdBasicMap ops +\n poly_map_iterateoi \\ invar ordered_list_it +\n poly_map_rev_iterateoi \\ invar rev_list_it\n for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\nend\n\ncontext StdBasicMapDefs begin\n definition \"g_sng k v \\ update k v (empty ())\"\n definition \"g_add m1 m2 \\ iterate m2 (\\(k,v) \\. update k v \\) m1\"\n\n definition \n \"g_sel m P \\ \n iteratei m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \"g_bex m P \\ iteratei m (\\x. \\x) (\\kv \\. P kv) False\"\n definition \"g_ball m P \\ iteratei m id (\\kv \\. P kv) True\"\n\n definition \"g_size m \\ iterate m (\\_. Suc) (0::nat)\"\n definition \"g_size_abort b m \\ iteratei m (\\s. s_. Suc) (0::nat)\"\n\n definition \"g_isEmpty m \\ g_size_abort 1 m = 0\"\n definition \"g_isSng m \\ g_size_abort 2 m = 1\"\n\n definition \"g_to_list m \\ iterate m (op #) []\"\n\n definition \"g_list_to_map l \\ foldl (\\m (k,v). update k v m) (empty ()) \n (rev l)\"\n\n definition \"g_add_dj m1 m2 \\ iterate m2 (\\(k,v) \\. update_dj k v \\) m1\"\n\n definition \"g_restrict P m \\ iterate m \n (\\(k,v) \\. if P (k,v) then update_dj k v \\ else \\) (empty ())\"\n\n definition dflt_ops :: \"('k,'v,'s) map_ops\" \n where [icf_rec_def]:\n \"dflt_ops \\ \n \\ \n map_op_\\ = \\,\n map_op_invar = invar,\n map_op_empty = empty,\n map_op_lookup = lookup,\n map_op_update = update,\n map_op_update_dj = update_dj,\n map_op_delete = delete,\n map_op_list_it = list_it,\n map_op_sng = g_sng,\n map_op_restrict = g_restrict, \n map_op_add = g_add, \n map_op_add_dj = g_add_dj, \n map_op_isEmpty = g_isEmpty, \n map_op_isSng = g_isSng, \n map_op_ball = g_ball, \n map_op_bex = g_bex, \n map_op_size = g_size, \n map_op_size_abort = g_size_abort, \n map_op_sel = g_sel, \n map_op_to_list = g_to_list, \n map_op_to_map = g_list_to_map\n \\\"\n\n local_setup {* Locale_Code.lc_decl_del @{term dflt_ops}*}\n\nend\n\nlemma update_dj_by_update: \n assumes \"map_update \\ invar update\"\n shows \"map_update_dj \\ invar update\"\nproof -\n interpret map_update \\ invar update by fact\n show ?thesis \n apply (unfold_locales)\n apply (auto simp add: update_correct)\n done\nqed\n\nlemma map_iterator_linord_is_it: \n \"map_iterator_linord m it \\ map_iterator m it\"\n unfolding set_iterator_def set_iterator_map_linord_def\n apply (erule set_iterator_genord.set_iterator_weaken_R)\n ..\n\n\n\ncontext StdBasicMap \nbegin\n \n\n lemma g_add_impl: \"map_add \\ invar g_add\"\n proof\n fix m1 m2\n assume \"invar m1\" \"invar m2\"\n\n have A: \"g_add m1 m2 = iterate_add_to_map m1 update (iteratei m2)\"\n unfolding g_add_def iterate_add_to_map_def by simp\n have \"\\ (g_add m1 m2) = \\ m1 ++ \\ m2 \\ invar (g_add m1 m2)\"\n unfolding A\n apply (rule \n iterate_add_to_map_correct[of \\ invar update m1 \"iteratei m2\" \"\\ m2\"])\n apply unfold_locales []\n apply fact\n apply (rule iteratei_correct, fact)\n done\n thus \"\\ (g_add m1 m2) = \\ m1 ++ \\ m2\" \"invar (g_add m1 m2)\" by auto\n qed\n\n lemma g_sel_impl: \"map_sel' \\ invar g_sel\"\n proof -\n have A: \"\\m P. g_sel m P = iterate_sel_no_map (iteratei m) P\"\n unfolding g_sel_def iterate_sel_no_map_def iterate_sel_def by simp\n\n { fix m P\n assume I: \"invar m\"\n note iterate_sel_no_map_correct[OF iteratei_correct[OF I], of P]\n }\n thus ?thesis\n apply unfold_locales\n unfolding A\n apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n apply clarify\n apply (metis option.exhaust prod.exhaust)\n apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n done\n qed\n \n lemma g_bex_impl: \"map_bex \\ invar g_bex\"\n apply unfold_locales\n unfolding g_bex_def\n apply (rule_tac I=\"\\it \\. \\ \\ (\\kv\\it. P kv)\" \n in iteratei_rule_insert_P)\n by (auto simp: map_to_set_def)\n\n \n\n lemma g_size_impl: \"map_size \\ invar g_size\"\n proof \n fix m\n assume I: \"invar m\"\n have A: \"g_size m \\ iterate_size (iteratei m)\"\n unfolding g_size_def iterate_size_def by simp\n \n from iterate_size_correct [OF iteratei_correct[OF I]]\n show \"g_size m = card (dom (\\ m))\"\n unfolding A\n by (simp_all add: card_map_to_set) \n qed \n\n lemma g_size_abort_impl: \"map_size_abort \\ invar g_size_abort\"\n proof \n fix s m\n assume I: \"invar m\"\n have A: \"g_size_abort s m \\ iterate_size_abort (iteratei m) s\"\n unfolding g_size_abort_def iterate_size_abort_def by simp\n \n from iterate_size_abort_correct [OF iteratei_correct[OF I]]\n show \"g_size_abort s m = min s (card (dom (\\ m)))\"\n unfolding A\n by (simp_all add: card_map_to_set) \n qed \n\n lemma g_isEmpty_impl: \"map_isEmpty \\ invar g_isEmpty\"\n proof \n fix m\n assume I: \"invar m\"\n interpret map_size_abort \\ invar g_size_abort by (rule g_size_abort_impl)\n from size_abort_correct[OF I] have \n \"g_size_abort 1 m = min 1 (card (dom (\\ m)))\" .\n thus \"g_isEmpty m = (\\ m = Map.empty)\" unfolding g_isEmpty_def\n by (auto simp: min_def card_0_eq[OF finite] I)\n qed\n\n lemma g_isSng_impl: \"map_isSng \\ invar g_isSng\"\n proof \n fix m\n assume I: \"invar m\"\n interpret map_size_abort \\ invar g_size_abort by (rule g_size_abort_impl)\n from size_abort_correct[OF I] have \n \"g_size_abort 2 m = min 2 (card (dom (\\ m)))\" .\n thus \"g_isSng m = (\\k v. \\ m = [k \\ v])\" unfolding g_isSng_def\n by (auto simp: min_def I card_Suc_eq dom_eq_singleton_conv)\n qed\n \n lemma g_to_list_impl: \"map_to_list \\ invar g_to_list\"\n proof \n fix m \n assume I: \"invar m\"\n\n have A: \"g_to_list m = iterate_to_list (iteratei m)\"\n unfolding g_to_list_def iterate_to_list_def by simp\n\n from iterate_to_list_correct [OF iteratei_correct[OF I]]\n have set_l_eq: \"set (g_to_list m) = map_to_set (\\ m)\" and \n dist_l: \"distinct (g_to_list m)\" unfolding A by simp_all\n\n from dist_l show dist_fst_l: \"distinct (map fst (g_to_list m))\"\n by (simp add: distinct_map set_l_eq map_to_set_def inj_on_def)\n \n from map_of_map_to_set[of \"(g_to_list m)\" \"\\ m\", OF dist_fst_l] set_l_eq\n show \"map_of (g_to_list m) = \\ m\" by simp\n qed\n\n lemma g_list_to_map_impl: \"list_to_map \\ invar g_list_to_map\"\n proof -\n {\n fix m0 l\n assume \"invar m0\"\n hence \"invar (foldl (\\s (k,v). update k v s) m0 l) \\ \n \\ (foldl (\\s (k,v). update k v s) m0 l) = \\ m0 ++ map_of (rev l)\"\n proof (induction l arbitrary: m0)\n case Nil thus ?case by simp\n next\n case (Cons kv l)\n obtain k v where [simp]: \"kv=(k,v)\" by (cases kv) auto\n have \"invar (foldl (\\s (k, v). update k v s) m0 (kv # l))\"\n apply simp\n apply (rule conjunct1[OF Cons.IH])\n apply (simp add: update_correct Cons.prems)\n done\n moreover have \"\\ (foldl (\\s (k, v). update k v s) m0 (kv # l)) =\n \\ m0 ++ map_of (rev (kv # l))\"\n apply simp\n thm trans[OF conjunct2[OF Cons.IH]]\n apply (rule trans[OF conjunct2[OF Cons.IH]])\n apply (auto \n simp: update_correct Cons.prems Map.map_add_def[abs_def]\n split: option.split\n )\n done\n ultimately show ?case\n by simp\n qed\n } thus ?thesis\n apply unfold_locales\n unfolding g_list_to_map_def\n apply (auto simp: empty_correct)\n done\n qed\n\n lemma g_add_dj_impl: \"map_add_dj \\ invar g_add_dj\"\n proof\n fix m1 m2\n assume \"invar m1\" \"invar m2\" and DJ: \"dom (\\ m1) \\ dom (\\ m2) = {}\"\n\n have A: \"g_add_dj m1 m2 = iterate_add_to_map m1 update_dj (iteratei m2)\"\n unfolding g_add_dj_def iterate_add_to_map_def by simp\n have \"\\ (g_add_dj m1 m2) = \\ m1 ++ \\ m2 \\ invar (g_add_dj m1 m2)\"\n unfolding A\n apply (rule \n iterate_add_to_map_dj_correct[\n of \\ invar update_dj m1 \"iteratei m2\" \"\\ m2\"])\n apply unfold_locales []\n apply fact\n apply (rule iteratei_correct, fact)\n using DJ apply (simp add: Int_ac)\n done\n thus \"\\ (g_add_dj m1 m2) = \\ m1 ++ \\ m2\" \"invar (g_add_dj m1 m2)\" by auto\n qed\n \n lemma g_restrict_impl: \"map_restrict \\ invar \\ invar g_restrict\"\n proof \n fix m P\n assume I: \"invar m\"\n\n have AUX: \"\\k v it \\.\n \\it \\ {(k, v). \\ m k = Some v}; \\ m k = Some v; (k, v) \\ it;\n {(k, v). \\ \\ k = Some v} = it \\ Collect P\\\n \\ k \\ dom (\\ \\)\"\n proof (rule ccontr, simp)\n fix k v it \\\n assume \"k\\dom (\\ \\)\" \n then obtain v' where \"\\ \\ k = Some v'\" by auto\n moreover assume \"{(k, v). \\ \\ k = Some v} = it \\ Collect P\"\n ultimately have MEM: \"(k,v')\\it\" by auto\n moreover assume \"it \\ {(k, v). \\ m k = Some v}\" and \"\\ m k = Some v\"\n ultimately have \"v'=v\" by auto\n moreover assume \"(k,v)\\it\"\n moreover note MEM \n ultimately show False by simp\n qed\n\n have \"\\ (g_restrict P m) = \\ m |` {k. \\v. \\ m k = Some v \\ P (k, v)} \\\n invar (g_restrict P m)\"\n unfolding g_restrict_def\n apply (rule_tac I=\"\\it \\. invar \\ \n \\ map_to_set (\\ \\) = it \\ Collect P\"\n in iterate_rule_insert_P)\n apply (auto simp: I empty_correct update_dj_correct map_to_set_def AUX)\n apply (auto split: split_if_asm)\n apply (rule ext)\n apply (auto simp: Map.restrict_map_def)\n apply force\n apply (rule ccontr)\n apply force\n done\n thus \"\\ (g_restrict P m) = \\ m |` {k. \\v. \\ m k = Some v \\ P (k, v)}\"\n \"invar (g_restrict P m)\" by auto\n qed\n\n \n\n\ncontext StdBasicOMapDefs \nbegin\n definition \n \"g_min m P \\ \n iterateoi m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \n \"g_max m P \\ \n rev_iterateoi m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \"g_to_sorted_list m \\ rev_iterateo m (op #) []\"\n definition \"g_to_rev_list m \\ iterateo m (op #) []\"\n\n definition dflt_oops :: \"('k,'v,'s) omap_ops\" \n where [icf_rec_def]:\n \"dflt_oops \\ map_ops.extend dflt_ops\n \\ \n map_op_ordered_list_it = ordered_list_it,\n map_op_rev_list_it = rev_list_it,\n map_op_min = g_min,\n map_op_max = g_max,\n map_op_to_sorted_list = g_to_sorted_list,\n map_op_to_rev_list = g_to_rev_list\n \\\"\n local_setup {* Locale_Code.lc_decl_del @{term dflt_oops}*}\n\nend\n\ncontext StdBasicOMap \nbegin\n lemma g_min_impl: \"map_min \\ invar g_min\"\n proof \n fix m P\n\n assume I: \"invar m\"\n \n from iterateoi_correct[OF I]\n have iti': \"map_iterator_linord (iterateoi m) (\\ m)\" by simp\n note sel_correct = iterate_sel_no_map_map_linord_correct[OF iti', of P]\n\n have A: \"g_min m P = iterate_sel_no_map (iterateoi m) P\"\n unfolding g_min_def iterate_sel_no_map_def iterate_sel_def by simp\n \n { assume \"rel_of (\\ m) P \\ {}\"\n with sel_correct \n show \"g_min m P \\ Some ` rel_of (\\ m) P\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { assume \"rel_of (\\ m) P = {}\" \n with sel_correct show \"g_min m P = None\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { fix k v\n assume \"(k, v) \\ rel_of (\\ m) P\"\n with sel_correct show \"fst (the (g_min m P)) \\ k\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n qed\n\n lemma g_max_impl: \"map_max \\ invar g_max\"\n proof \n fix m P\n\n assume I: \"invar m\"\n \n from rev_iterateoi_correct[OF I]\n have iti': \"map_iterator_rev_linord (rev_iterateoi m) (\\ m)\" by simp\n note sel_correct = iterate_sel_no_map_map_rev_linord_correct[OF iti', of P]\n\n have A: \"g_max m P = iterate_sel_no_map (rev_iterateoi m) P\"\n unfolding g_max_def iterate_sel_no_map_def iterate_sel_def by simp\n \n { assume \"rel_of (\\ m) P \\ {}\"\n with sel_correct \n show \"g_max m P \\ Some ` rel_of (\\ m) P\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { assume \"rel_of (\\ m) P = {}\" \n with sel_correct show \"g_max m P = None\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { fix k v\n assume \"(k, v) \\ rel_of (\\ m) P\"\n with sel_correct show \"fst (the (g_max m P)) \\ k\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n qed\n\n lemma g_to_sorted_list_impl: \"map_to_sorted_list \\ invar g_to_sorted_list\"\n proof \n fix m\n assume I: \"invar m\"\n note iti = rev_iterateoi_correct[OF I]\n from iterate_to_list_map_rev_linord_correct[OF iti]\n show \"sorted (map fst (g_to_sorted_list m))\" \n \"distinct (map fst (g_to_sorted_list m))\"\n \"map_of (g_to_sorted_list m) = \\ m\" \n unfolding g_to_sorted_list_def iterate_to_list_def by simp_all\n qed\n\n lemma g_to_rev_list_impl: \"map_to_rev_list \\ invar g_to_rev_list\"\n proof \n fix m\n assume I: \"invar m\"\n note iti = iterateoi_correct[OF I]\n from iterate_to_list_map_linord_correct[OF iti]\n show \"sorted (rev (map fst (g_to_rev_list m)))\" \n \"distinct (map fst (g_to_rev_list m))\"\n \"map_of (g_to_rev_list m) = \\ m\" \n unfolding g_to_rev_list_def iterate_to_list_def \n by (simp_all add: rev_map)\n qed\n \n lemma dflt_oops_impl: \"StdOMap dflt_oops\"\n proof -\n interpret aux: StdMap dflt_ops by (rule dflt_ops_impl)\n\n show ?thesis\n apply (rule StdOMap_intro)\n apply icf_locales\n apply (simp_all add: icf_rec_unf)\n apply (rule g_min_impl)\n apply (rule g_max_impl)\n apply (rule g_to_sorted_list_impl)\n apply (rule g_to_rev_list_impl)\n done\n qed\n\nend\n\nlocale g_image_filter_defs_loc = \n m1: StdMapDefs ops1 + \n m2: StdMapDefs ops2\n for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n definition \"g_image_filter f m1 \\ m1.iterate m1 (\\kv \\. case f kv of \n None => \\\n | Some (k',v') => m2.update_dj k' v' \\\n ) (m2.empty ())\"\nend\n\nlocale g_image_filter_loc = g_image_filter_defs_loc ops1 ops2 + \n m1: StdMap ops1 + \n m2: StdMap ops2\n for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n lemma g_image_filter_impl: \n \"map_image_filter m1.\\ m1.invar m2.\\ m2.invar g_image_filter\"\n proof \n fix m k' v' and f :: \"('k1 \\ 'v1) \\ ('k2 \\ 'v2) option\"\n assume invar_m: \"m1.invar m\" and\n unique_f: \"transforms_to_unique_keys (m1.\\ m) f\"\n \n have A: \"g_image_filter f m = \n iterate_to_map m2.empty m2.update_dj (\n set_iterator_image_filter f (m1.iteratei m))\" \n unfolding g_image_filter_def iterate_to_map_alt_def \n set_iterator_image_filter_def case_prod_beta\n by simp\n \n from m1.iteratei_correct[OF invar_m] \n have iti_m: \"map_iterator (m1.iteratei m) (m1.\\ m)\" by simp\n\n from unique_f have inj_on_f: \"inj_on f (map_to_set (m1.\\ m) \\ dom f)\"\n unfolding transforms_to_unique_keys_def inj_on_def Ball_def map_to_set_def\n by auto (metis option.inject)\n\n def vP \\ \"\\k v. \\k' v'. m1.\\ m k' = Some v' \\ f (k', v') = Some (k, v)\"\n have vP_intro: \"\\k v. (\\k' v'. m1.\\ m k' = Some v' \n \\ f (k', v') = Some (k, v)) \\ vP k v\"\n unfolding vP_def by simp\n { fix k v\n have \"Eps_Opt (vP k) = Some v \\ vP k v\"\n using unique_f unfolding vP_def transforms_to_unique_keys_def \n apply (rule_tac Eps_Opt_eq_Some)\n apply (metis prod.inject option.inject)\n done\n } note Eps_vP_elim[simp] = this\n have map_intro: \"{y. \\x. x \\ map_to_set (m1.\\ m) \\ f x = Some y} \n = map_to_set (\\k. Eps_Opt (vP k))\"\n by (simp add: map_to_set_def vP_intro set_eq_iff split: prod.splits)\n\n from set_iterator_image_filter_correct [OF iti_m, OF inj_on_f, \n unfolded map_intro] \n have iti_filter: \"map_iterator (set_iterator_image_filter f (m1.iteratei m))\n (\\k. Eps_Opt (vP k))\" by auto\n\n have upd: \"map_update_dj m2.\\ m2.invar m2.update_dj\" by unfold_locales\n have emp: \"map_empty m2.\\ m2.invar m2.empty\" by unfold_locales\n \n from iterate_to_map_correct[OF upd emp iti_filter] show\n \"map_op_invar ops2 (g_image_filter f m) \\\n (map_op_\\ ops2 (g_image_filter f m) k' = Some v') =\n (\\k v. map_op_\\ ops1 m k = Some v \\ f (k, v) = Some (k', v'))\"\n unfolding A vP_def[symmetric]\n by (simp add: vP_intro)\n \n qed\nend\n\nsublocale g_image_filter_loc \n < map_image_filter m1.\\ m1.invar m2.\\ m2.invar g_image_filter\n by (rule g_image_filter_impl)\n\n\nlocale g_value_image_filter_defs_loc = \n m1: StdMapDefs ops1 + \n m2: StdMapDefs ops2\n for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n definition \"g_value_image_filter f m1 \\ m1.iterate m1 (\\(k,v) \\. \n case f k v of \n None => \\\n | Some v' => m2.update_dj k v' \\\n ) (m2.empty ())\"\n \nend\n\n(* TODO: Move to Misc *)\nlemma restrict_map_dom_subset: \"\\ dom m \\ R\\ \\ m|`R = m\"\n apply (rule ext)\n apply (auto simp: restrict_map_def)\n apply (case_tac \"m x\")\n apply auto\n done\n\n\nlocale g_value_image_filter_loc = g_value_image_filter_defs_loc ops1 ops2 + \n m1: StdMap ops1 + \n m2: StdMap ops2\n for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n lemma g_value_image_filter_impl: \n \"map_value_image_filter m1.\\ m1.invar m2.\\ m2.invar g_value_image_filter\"\n apply unfold_locales\n unfolding g_value_image_filter_def\n apply (rule_tac I=\"\\it \\. m2.invar \\ \n \\ m2.\\ \\ = (\\k. Option.bind (map_op_\\ ops1 m k) (f k)) |` it\"\n in m1.old_iterate_rule_insert_P)\n\n apply auto []\n apply (auto simp: m2.empty_correct) []\n defer\n apply simp []\n apply (rule restrict_map_dom_subset)\n apply (auto) []\n apply (case_tac \"m1.\\ m x\")\n apply (auto) [2]\n\n apply (auto split: option.split simp: m2.update_dj_correct intro!: ext)\n apply (auto simp: restrict_map_def)\n done\nend\n\nsublocale g_value_image_filter_loc \n < map_value_image_filter m1.\\ m1.invar m2.\\ m2.invar g_value_image_filter\n by (rule g_value_image_filter_impl)\n\n\nend\n\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/gen_algo/MapGA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.29875988946359583}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_op_rep_par\nimports CSP_F_op_alpha_par CSP_T.CSP_T_op_rep_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*============================================================*\n | |\n | replicated alphabetized parallel |\n | |\n *============================================================*)\n\n(*** Inductive_parallel ***)\n\nlemma in_failures_Inductive_parallel_lm1: \n \"Y Int insert Tick (Ev ` snd a) Un\n Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set PXYs} =\n Union {Ya Int insert Tick (Ev ` X) |X Ya.\n EX P. P = fst a & X = snd a & Ya = Y | ((P, X), Ya) : set PXYs}\"\nby (auto)\n\nlemma in_failures_Inductive_parallel_lm2: \n \"((P, X), Y) : set s ==> X <= Union (snd ` fst ` set s)\"\n apply (auto)\n(* not necessary for Isabelle 2017\napply (rule_tac x=\"((P, X), Y)\" in bexI)\nby (simp_all)\n*)\n done\n\nlemma in_failures_Inductive_parallel_lm3:\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs} <=\n insert Tick (Ev ` Union (snd ` fst ` set zs))\"\napply (rule)\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (elim conjE disjE)\napply (simp)\napply (rule disjI2)\napply (auto)\napply (simp add: image_iff)\napply (rule_tac x=\"((P, X), Y)\" in bexI)\napply (auto)\ndone\n\nlemma in_failures_Inductive_parallel_lm4:\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs} Int\n insert Tick (Ev ` Union (snd ` fst ` set zs))\n = Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs}\"\n apply (rule Int_subset_eq)\n(* for Isabelle 2017 *)\napply (simp add: in_failures_Inductive_parallel_lm3[simplified])\ndone\n\n(* main *)\n\nlemma in_failures_Inductive_parallel_lm:\n \"PXs ~= [] --> (ALL f.\n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M)))))))\"\napply (induct_tac PXs)\n\n(* case 0 *)\n apply (simp)\n\n(* case 1 *)\n apply (case_tac \"list = []\")\n apply (simp)\n apply (intro allI)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures)\n apply (rule iffI)\n (* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (erule disjE)\n\n apply (rule_tac x=\"[(a,Y)]\" in exI)\n apply (simp)\n\n apply (rule conjI)\n apply (simp add: Evset_def pair_eq_decompo)\n apply (fast)\n apply (intro allI impI)\n apply (simp add: pair_eq_decompo)\n\n apply (case_tac \"Tick ~: Z\")\n apply (rule_tac x=\"[(a,Y)]\" in exI)\n apply (simp add: Evset_def pair_eq_decompo)\n(* apply (fast) *)\n (* Tick : Z *)\n apply (rule_tac x=\"[(a,insert Tick Y)]\" in exI)\n apply (simp)\n\n apply (simp add: rest_tr_Tick_sett)\n apply (elim conjE exE)\n apply (simp add: pair_eq_decompo)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_T2_T3, simp)\n apply (simp)\n\n (* <= *)\n apply (elim conjE exE)\n apply (simp)\n apply (subgoal_tac \"EX bb. PXYs=[(a,bb)]\")\n apply (elim conjE exE)\n apply (subgoal_tac \"aa rest-tr {} = <> | aa rest-tr {} = \")\n apply (erule disjE)\n\n (* <> *)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp add: pair_eq_decompo)\n\n (* *)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp add: pair_eq_decompo)\n\n apply (simp add: rest_tr_empty)\n apply (force)\n\n(* step case *)\napply (simp add: in_failures_Alpha_parallel)\napply (intro allI impI)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"(a,Y) # PXYs\" in exI)\n apply (simp add: pair_eq_decompo)\n apply (simp add: in_failures_Inductive_parallel_lm1)\n\n apply (intro allI impI)\n apply (drule_tac x=\"P\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule_tac x=\"Ya\" in spec)\n apply (simp)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n\n apply (rotate_tac -4)\n apply (drule sym)\n(* for Isabelle 2017 *)\n apply (simp add: in_failures_Inductive_parallel_lm2[simplified])\n\n(* <= *)\n apply (simp)\n apply (elim conjE exE)\n\n apply (subgoal_tac \"EX bb zs. PXYs = (a, bb) # zs & map fst zs = list\")\n apply (elim conjE exE)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs}\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n apply (rotate_tac -1)\n apply (drule sym)\n apply (simp)\n (* Isabelle 2017 *)\n apply (simp add: in_failures_Inductive_parallel_lm4[simplified])\n apply (simp add: in_failures_Inductive_parallel_lm1[simplified])\n\n apply (rule_tac x=\"zs\" in exI)\n apply (rotate_tac -1)\n apply (drule sym)\n apply (simp add: in_failures_Inductive_parallel_lm4[simplified])\n\n apply (intro allI impI)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (simp add: in_failures_Inductive_parallel_lm2)\napply (auto)\ndone\n\n(*** remove ALL ***)\n\nlemma in_failures_Inductive_parallel:\n \"PXs ~= [] ==> \n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M))))))\"\nby (simp add: in_failures_Inductive_parallel_lm)\n\n(*** Semantics for replicated alphabetized parallel on F ***)\n\nlemma failures_Inductive_parallel:\n \"PXs ~= []\n ==> failures([||] PXs) M =\n {f. (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M))))))}f\"\napply (simp add: in_failures_Inductive_parallel[THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_failures_Inductive_parallel:\n \"[| PXs ~= [] ; (t,X) :f failures([||] PXs) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` set PXs))\"\nby (simp add: in_failures_Inductive_parallel)\n\n(*---------------------------------------------------------*\n | another expression of Inductive_parallel_eval |\n *---------------------------------------------------------*)\n\nlemma in_failures_Inductive_parallel_nth:\n \"PXs ~= [] ==> \n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX Ys. length PXs = length Ys &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {((Ys!i) Int insert Tick (Ev ` (snd (PXs!i))))|i. i < length PXs} &\n (ALL i. i < length PXs --> ((u rest-tr (snd (PXs!i))), Ys!i) :f \n failures(fst (PXs!i)) M))))))\"\napply (simp add: in_failures_Inductive_parallel)\napply (simp add: set_nth)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"map snd PXYs\" in exI)\n apply (simp)\n apply (rotate_tac 3)\n apply (drule sym)\n apply (simp)\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n\n apply (rule equalityI)\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"map snd PXYs ! i Int\n insert Tick (Ev ` snd (map fst PXYs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"map snd PXYs ! i Int\n insert Tick (Ev ` snd (map fst PXYs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\n \"(snd (PXYs ! i)) Int insert Tick (Ev ` snd (fst (PXYs ! i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (fst (PXYs ! i))\" in exI)\n apply (rule_tac x=\"snd (PXYs ! i)\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\n \"(snd (PXYs ! i)) Int insert Tick (Ev ` snd (fst (PXYs ! i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (fst (PXYs ! i))\" in exI)\n apply (rule_tac x=\"snd (PXYs ! i)\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (intro allI impI)\n apply (drule_tac x=\"fst (fst (PXYs ! i))\" in spec)\n apply (drule_tac x=\"snd (fst (PXYs ! i))\" in spec)\n apply (drule_tac x=\"snd (PXYs ! i)\" in spec)\n apply (simp)\n apply (fast)\n\n (* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"zip PXs Ys\" in exI)\n apply (simp add: map_fst_zip_eq)\n\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n\n apply (rule equalityI)\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (PXs ! i)\" in exI)\n apply (rule_tac x=\"Ys ! i\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (PXs ! i)\" in exI)\n apply (rule_tac x=\"Ys ! i\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (drule_tac x=\"i\" in spec)\n apply (simp add: pair_eq_decompo)\ndone\n\n(*============================================================*\n | |\n | indexed alphabetized parallel |\n | |\n *============================================================*)\n\n(*** failures Inductive_parallel ***)\n\nlemma in_failures_Rep_parallel_lm1:\n \"[| Is isListOf I ; length Ys = length Is |] ==>\n Union {(Ys ! i Int insert Tick (Ev ` snd (map PXf Is ! i))) |i. i < length Ys} =\n Union {(Ys ! (THE n. Is ! n = i & n < length Is) Int\n insert Tick (Ev ` snd (PXf i))) | i. i : I}\"\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\n \"Ys ! (THE n. Is ! n = (Is ! i) & n < length Is) Int\n insert Tick (Ev ` snd (PXf (Is ! i)))\" in exI)\n apply (simp add: isListOf_THE_nth)\n apply (rule_tac x=\"(Is ! i)\" in exI)\n apply (simp add: isListOf_THE_nth)\n apply (simp add: isListOf_nth_in_index)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE, simp)\n apply (simp add: isListOf_THE_nth)\n apply (rule_tac x=\n \"Ys ! n Int insert Tick (Ev ` snd (PXf (Is ! n)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp)\ndone\n\nlemma in_failures_Rep_parallel_lm2:\n \"Is isListOf I ==>\n Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I} =\n Union {(map Yf Is ! i Int insert Tick (Ev ` snd (map PXf Is ! i))) |i. i < length Is}\"\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\n \"map Yf Is ! n Int insert Tick (Ev ` snd (map PXf Is ! n))\" in exI)\n apply (simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x= \"Yf (Is!i) Int insert Tick (Ev ` snd (PXf (Is!i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"(Is!i)\" in exI)\n apply (simp add: isListOf_nth_in_index)\ndone\n\nlemma in_failures_Rep_parallel:\n \"[| I ~= {} ; finite I |]\n ==> (f :f failures ([||]:I PXf) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` PXf ` I)) & \n (EX Z. f = (u, Z) &\n (EX Yf. \n (Z Int insert Tick (Ev ` Union (snd ` PXf ` I))\n = Union {((Yf i) Int insert Tick (Ev ` (snd (PXf i))))|i. i : I} &\n (ALL i:I. ((u rest-tr (snd (PXf i))), Yf i) :f failures(fst (PXf i)) M))))))\"\napply (simp add: Rep_parallel_def)\napply (subgoal_tac \"EX Is. Is isListOf I\")\napply (elim conjE exE)\napply (subgoal_tac \"(map PXf (SOME Is. Is isListOf I)) ~= []\")\napply (simp add: in_failures_Inductive_parallel_nth)\napply (rule someI2)\n apply (simp)\n apply (rule iffI)\n\n (* => *)\n apply (elim conjE exE)\n apply (rename_tac Is' Is u Z Ys)\n apply (rule_tac x=\"u\" in exI)\n apply (simp add: isListOf_set_eq)\n apply (rule_tac x= \"(%i. (Ys!(THE n. (Is!n) = i & n failures ([||]:I PXf) M =\n {f. (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` PXf ` I)) & \n (EX Z. f = (u, Z) &\n (EX Yf. \n (Z Int insert Tick (Ev ` Union (snd ` PXf ` I))\n = Union {((Yf i) Int insert Tick (Ev ` (snd (PXf i))))|i. i : I} &\n (ALL i:I. ((u rest-tr (snd (PXf i))), Yf i) :f failures(fst (PXf i)) M))))))}f\"\n(* for Isabelle 2017 *)\n apply (simp add: in_failures_Rep_parallel[simplified, THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_failures_Rep_parallel:\n \"[| I ~= {} ; finite I ; (t,X) :f failures([||]:I PXf) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` PXf ` I))\"\nby (simp add: in_failures_Rep_parallel)\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_op_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.29875988946359566}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: Closure.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Experiments with Closures\"\n\ntheory Closure\nimports \"../Hoare\"\nbegin\n\n\ndefinition\n\"callClosure upd cl = Seq (Basic (upd (fst cl))) (Call (snd cl))\"\n\n\ndefinition\n\"dynCallClosure init upd cl return c =\n DynCom (\\s. call (upd (fst (cl s)) \\ init) (snd (cl s)) return c)\"\n\n\n\n\n\nlemma dynCallClosure_sound:\nassumes adapt: \n \"P \\ {s. \\P' Q' A'. \\n. \\,\\\\n:\\<^bsub>/F \\<^esub> P' (callClosure upd (cl s)) Q',A' \\\n init s \\ P' \\ \n (\\t \\ Q'. return s t \\ R s t) \\\n (\\t \\ A'. return s t \\ A)}\"\nassumes res: \"\\s t n. \\,\\\\n:\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows\n\"\\,\\\\n:\\<^bsub>/F \\<^esub>P (dynCallClosure init upd cl return c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n assume exec: \"\\\\ \\dynCallClosure init upd cl return c,Normal s\\ =n\\ t\" \n from execn.Basic [where f=\"(upd (fst (cl s)))\" and s=\"(init s)\"]\n have exec_upd: \"\\\\\\Basic (upd (fst (cl s))),Normal (init s)\\ =n\\ \n Normal (((upd (fst (cl s))) \\ init) s)\"\n by auto\n assume P: \"s \\ P\"\n from P adapt obtain P' Q' A'\n where \n valid: \"\\n. \\,\\\\n:\\<^bsub>/F \\<^esub> P' (callClosure upd (cl s)) Q',A'\" and\n init_P': \"init s \\ P'\" and\n R: \"(\\t \\ Q'. return s t \\ R s t)\" and\n A: \"(\\t \\ A'. return s t \\ A)\"\n by auto\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec [simplified dynCallClosure_def]\n have exec_call:\n \"\\\\\\call (upd (fst (cl s)) \\ init) (snd (cl s)) return c,Normal s\\ =n\\ t\"\n by cases\n then\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: execn_call_Normal_elim)\n fix bdy m t'\n assume bdy: \"\\ (snd (cl s)) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal ((upd (fst (cl s)) \\ init) s)\\ =m\\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ =Suc m\\ t\"\n assume n: \"n = Suc m\"\n have \"\\\\\\Basic init,Normal s\\ =m\\ Normal (init s)\" \n by (rule execn.Basic)\n from bdy exec_body \n have exec_callC:\n \"\\\\\\Call (snd (cl s)),Normal ((upd (fst (cl s)) \\ init) s)\\ =Suc m\\ Normal t'\"\n by (rule execn.Call)\n from execn.Seq [OF exec_upd [simplified n]exec_callC]\n have exec_closure: \"\\\\ \\callClosure upd (cl s),Normal (init s)\\ =n\\ Normal t'\"\n by (simp add: callClosure_def n)\n from cnvalidD [OF valid [rule_format] ctxt exec_closure init_P']\n have \"t' \\ Q'\"\n by auto\n with R have \"return s t' \\ R s t'\"\n by auto\n from cnvalidD [OF res [rule_format] ctxt exec_c [simplified n[symmetric]] this\n t_notin_F]\n show ?thesis\n by auto\n next\n fix bdy m t'\n assume bdy: \"\\ (snd (cl s)) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal ((upd (fst (cl s)) \\ init) s)\\ =m\\ Abrupt t'\" \n assume t: \"t=Abrupt (return s t')\"\n assume n: \"n = Suc m\"\n from bdy exec_body \n have exec_callC:\n \"\\\\\\Call (snd (cl s)),Normal ((upd (fst (cl s)) \\ init) s)\\ =Suc m\\ Abrupt t'\"\n by (rule execn.Call)\n from execn.Seq [OF exec_upd [simplified n] exec_callC]\n have exec_closure: \"\\\\ \\callClosure upd (cl s),Normal (init s)\\ =n\\ Abrupt t'\"\n by (simp add: callClosure_def n)\n\n from cnvalidD [OF valid [rule_format] ctxt exec_closure init_P']\n have \"t' \\ A'\"\n by auto\n with A have \"return s t' \\ A\"\n by auto\n with t show ?thesis\n by auto\n next\n fix bdy m f\n assume bdy: \"\\ (snd (cl s)) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal ((upd (fst (cl s)) \\ init) s)\\ =m\\ Fault f\" \n assume t: \"t=Fault f\"\n assume n: \"n = Suc m\"\n from bdy exec_body \n have exec_callC:\n \"\\\\\\Call (snd (cl s)),Normal ((upd (fst (cl s)) \\ init) s)\\ =Suc m\\ Fault f\"\n by (rule execn.Call)\n from execn.Seq [OF exec_upd [simplified n] exec_callC]\n have exec_closure: \"\\\\ \\callClosure upd (cl s),Normal (init s)\\ =n\\ Fault f\"\n by (simp add: callClosure_def n)\n from cnvalidD [OF valid [rule_format] ctxt exec_closure init_P'] t_notin_F t\n have False\n by auto\n thus ?thesis ..\n next\n fix bdy m \n assume bdy: \"\\ (snd (cl s)) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal ((upd (fst (cl s)) \\ init) s)\\ =m\\ Stuck\" \n assume t: \"t=Stuck\"\n assume n: \"n = Suc m\"\n from execn.Basic [where f=\"(upd (fst (cl s)))\" and s=\"(init s)\"]\n have exec_upd: \"\\\\\\Basic (upd (fst (cl s))),Normal (init s)\\ =Suc m\\ \n Normal (((upd (fst (cl s))) \\ init) s)\"\n by auto\n from bdy exec_body \n have exec_callC:\n \"\\\\\\Call (snd (cl s)),Normal ((upd (fst (cl s)) \\ init) s)\\ =Suc m\\ Stuck\"\n by (rule execn.Call)\n from execn.Seq [OF exec_upd [simplified n] exec_callC]\n have exec_closure: \"\\\\ \\callClosure upd (cl s),Normal (init s)\\ =n\\ Stuck\"\n by (simp add: callClosure_def n)\n from cnvalidD [OF valid [rule_format] ctxt exec_closure init_P'] t_notin_F t\n have False\n by auto\n thus ?thesis ..\n next\n fix m\n assume no_bdy: \"\\ (snd (cl s)) = None\"\n assume t: \"t=Stuck\"\n assume n: \"n = Suc m\"\n from no_bdy \n have exec_callC:\n \"\\\\\\Call (snd (cl s)),Normal ((upd (fst (cl s)) \\ init) s)\\ =Suc m\\ Stuck\"\n by (rule execn.CallUndefined)\n from execn.Seq [OF exec_upd [simplified n]exec_callC]\n have exec_closure: \"\\\\ \\callClosure upd (cl s),Normal (init s)\\ =n\\ Stuck\"\n by (simp add: callClosure_def n)\n from cnvalidD [OF valid [rule_format] ctxt exec_closure init_P'] t_notin_F t\n have False\n by auto\n thus ?thesis ..\n qed\nqed\n\n \nlemma dynCallClosure:\nassumes adapt: \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F \\<^esub> P' (callClosure upd (cl s)) Q',A' \\\n init s \\ P' \\ \n (\\t \\ Q'. return s t \\ R s t) \\\n (\\t \\ A'. return s t \\ A)}\"\nassumes res: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows\n\"\\,\\\\\\<^bsub>/F \\<^esub>P (dynCallClosure init upd cl return c) Q,A\"\n apply (rule hoare_complete')\n apply (rule allI)\n apply (rule dynCallClosure_sound [where R=R])\n using adapt\n apply (blast intro: hoare_cnvalid)\n using res\n apply (blast intro: hoare_cnvalid)\n done\n\n\n\nlemma dynCallClosureFix:\nassumes adapt: \"P \\ {s. \\Z. cl'=cl s \\ \n init s \\ P' Z \\ \n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\nassumes res: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F \\<^esub> (P' Z) (callClosure upd cl') (Q' Z),(A' Z)\"\nshows\n\"\\,\\\\\\<^bsub>/F \\<^esub>P (dynCallClosure init upd cl return c) Q,A\"\n apply (rule dynCallClosure [OF _ res])\n using adapt spec\n apply clarsimp\n apply (drule (1) in_subsetD)\n apply clarsimp\n apply (rule_tac x=\"P' Z\" in exI)\n apply (rule_tac x=\"Q' Z\" in exI)\n apply (rule_tac x=\"A' Z\" in exI)\n apply blast\n done\n\n\nlemma conseq_extract_pre:\n \"\\\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> ({s}) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoarep.Conseq)\n apply clarify\n apply (rule_tac x=\"{s}\" in exI) \n apply (rule_tac x=\"Q\" in exI) \n apply (rule_tac x=\"A\" in exI) \n by simp\n\n\n\nlemma app_closure_sound:\n assumes adapt: \"P \\ {s. \\P' Q' A'. \\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P' (callClosure upd (e',p)) Q',A' \\\n upd x s \\ P' \\ Q' \\ Q \\ A' \\ A}\"\n assumes ap: \"upd e = upd e' \\ upd x\" \n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P (callClosure upd (e,p)) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n assume exec_e: \"\\\\ \\callClosure upd (e, p),Normal s\\ =n\\ t\" \n assume P: \"s \\ P\" \n assume t: \"t \\ Fault ` F\"\n from P adapt obtain P' Q' A'\n where \n valid: \"\\n. \\,\\\\n:\\<^bsub>/F \\<^esub> P' (callClosure upd (e',p)) Q',A'\" and\n init_P': \"upd x s \\ P'\" and\n Q: \"Q' \\ Q\" and\n A: \"A' \\ A\"\n by auto\n from exec_e [simplified callClosure_def] obtain s'\n where\n exec_e: \"\\\\ \\Basic (upd (fst (e, p))),Normal s\\ =n\\ s'\"and\n exec_p: \"\\\\ \\Call (snd (e, p)),s'\\ =n\\ t\"\n by cases\n from exec_e [simplified]\n have s': \"s'=Normal (upd e s)\"\n by cases simp\n from ap obtain s'' where\n s'': \"upd x s = s''\" and upd_e': \"upd e' s''=upd e s\" \n by auto\n from ap s' execn.Basic [where f=\"(upd (fst (e', p)))\" and s=\"upd x s\" and \\=\\]\n have exec_e': \"\\\\ \\Basic (upd (fst (e', p))),Normal (upd x s)\\ =n\\ s'\"\n by simp\n with exec_p\n have \"\\\\ \\callClosure upd (e', p),Normal (upd x s)\\ =n\\ t\"\n by (auto simp add: callClosure_def intro: execn.Seq)\n from cnvalidD [OF valid [rule_format] ctxt this init_P'] t Q A\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nqed\n\nlemma app_closure:\n assumes adapt: \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' (callClosure upd (e',p)) Q',A' \\\n upd x s \\ P' \\ Q' \\ Q \\ A' \\ A}\"\n assumes ap: \"upd e = upd e' \\ upd x\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (callClosure upd (e,p)) Q,A\"\n apply (rule hoare_complete')\n apply (rule allI)\n apply (rule app_closure_sound [where x=x and e'=e', OF _ ap])\n using adapt\n apply (blast intro: hoare_cnvalid)\n done\n\nlemma app_closure_spec:\n assumes adapt: \"P \\ {s. \\Z. upd x s \\ P' Z \\ Q' Z \\ Q \\ A' Z \\ A}\"\n assumes ap: \"upd e = upd e' \\ upd x\" \n assumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (callClosure upd (e',p)) (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (callClosure upd (e,p)) Q,A\"\n apply (rule app_closure [OF _ ap])\n apply clarsimp\n using adapt spec\n apply -\n apply (drule (1) in_subsetD)\n apply clarsimp\n apply (rule_tac x=\"P' Z\" in exI)\n apply (rule_tac x=\"Q' Z\" in exI)\n apply (rule_tac x=\"A' Z\" in exI)\n apply blast\n done\n\ntext {* Implementation of closures as association lists. *}\n\ndefinition \"gen_upd var es s = foldl (\\s (x,i). the (var x) i s) s es\"\ndefinition \"ap es c \\ (es@fst c,snd c)\"\n\nlemma gen_upd_app: \"\\es'. gen_upd var (es@es') = gen_upd var es' \\ gen_upd var es\"\n apply (induct es)\n apply (rule ext)\n apply (simp add: gen_upd_def)\n apply (rule ext)\n apply (simp add: gen_upd_def)\n done\n\nlemma gen_upd_ap:\n \"gen_upd var (fst (ap es (es',p))) = gen_upd var es' \\ gen_upd var es\"\n by (simp add: gen_upd_app ap_def)\n\nlemma ap_closure:\n assumes adapt: \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' (callClosure (gen_upd var) c) Q',A' \\\n gen_upd var es s \\ P' \\ Q' \\ Q \\ A' \\ A}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (callClosure (gen_upd var) (ap es c)) Q,A\"\nproof -\n obtain es' p where c: \"c=(es',p)\"\n by (cases c) \n have \"gen_upd var (fst (ap es (es',p))) = gen_upd var es' \\ gen_upd var es\"\n by (simp add: gen_upd_ap)\n from app_closure [OF adapt [simplified c] this]\n show ?thesis\n by (simp add: c ap_def)\nqed\n\n\nlemma ap_closure_spec:\n assumes adapt: \"P \\ {s. \\Z. gen_upd var es s \\ P' Z \\ Q' Z \\ Q \\ A' Z \\ A}\"\n assumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (callClosure (gen_upd var) c) (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (callClosure (gen_upd var) (ap es c)) Q,A\"\nproof -\n obtain es' p where c: \"c=(es',p)\"\n by (cases c) \n have \"gen_upd var (fst (ap es (es',p))) = gen_upd var es' \\ gen_upd var es\"\n by (simp add: gen_upd_ap)\n from app_closure_spec [OF adapt [simplified c] this spec [simplified c]]\n show ?thesis\n by (simp add: c ap_def)\nqed\n\nend", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/Closure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5039061705290806, "lm_q1q2_score": 0.2986483567833459}} {"text": "header {* Tagging of Terms *}\ntheory Autoref_Tagging\nimports \"../Lib/Refine_Lib\" \nbegin\ntext {*\n We provide a mechanism to tag terms, that supports relator annotations,\n and introduces tags to protect operations, function applications, and \n abstractions from automatic beta and eta conversions.\n*}\n\n\nML {*\n structure Autoref_Tag_Defs = Named_Thms (\n val name = @{binding autoref_tag_defs}\n val description = \"Autoref: Definitions of internal tags\"\n )\n*}\nsetup Autoref_Tag_Defs.setup\n\n\ntext {* General protection tag *}\ndefinition PROTECT where [simp, autoref_tag_defs]: \"PROTECT x \\ x\"\n\ntext {* General annotation tag *}\ntypedecl annot\ndefinition ANNOT :: \"'a \\ annot \\ 'a\" \n where [simp, autoref_tag_defs]: \"ANNOT x a \\ x\"\n\ntext {* Operation-tag, Autoref does not look beyond this *}\ndefinition OP where [simp, autoref_tag_defs]: \"OP x \\ x\"\n\ntext {* Protected function application *}\ndefinition APP (infixl \"$\" 900) where [simp, autoref_tag_defs]: \"f$a \\ f a\"\n\ntext {* Protected abstraction *}\nabbreviation ABS :: \"('a\\'b)\\'a\\'b\" (binder \"\\''\" 10)\n where \"ABS f \\ PROTECT (\\x. PROTECT (f x))\"\n\n\nlemma ABS_beta: \"(\\'x. f x)$x \\ f x\" by simp\nlemma ABS_eta: \"\\'x. (f$x) \\ f\" by simp\n\ntext {* This tag is used to highlight failures during operation \n identification *}\ndefinition \"ID_FAIL x \\ x\"\nnotation (output) ID_FAIL (\"FAIL *** _ ***\")\n\n\ntext {* Relator annotation *}\nconsts rel_annot :: \"('c\\'a) set \\ annot\"\nabbreviation rel_ANNOT :: \"'a \\ ('c \\ 'a) set \\ 'a\" (infix \":::\" 10)\n where \"t:::R \\ ANNOT t (rel_annot R)\"\n\nlemma rel_ANNOT_eq: \"t \\ t:::R\" by simp\n\ntext {* Indirect annotation *}\ntypedecl rel_name\nconsts ind_annot :: \"rel_name \\ annot\"\nabbreviation ind_ANNOT :: \"'a \\ rel_name \\ 'a\" (infix \"::#\" 10)\n where \"t::#s \\ ANNOT t (ind_annot s)\"\n\n\n\n\n\nML {*\n signature AUTOREF_TAGGING = sig\n val term_of_tagged: term -> term\n val is_valid_tagged: term -> bool\n\n val mk_APP: term -> term -> term\n val mk_OP: term -> term\n val lambda': string * typ -> term -> term\n\n val list_APP: term * term list -> term\n val strip_app: term -> term * term list\n\n val untag_conv: Proof.context -> conv\n\n val mk_APP_conv: conv\n val mk_OP_conv: conv\n val mk_ABS_conv: Proof.context -> conv\n val mk_ANNOT_conv: cterm -> conv\n val mk_rel_ANNOT_conv: cterm -> conv\n\n val ABS_beta_conv: Proof.context -> conv\n\n val rhs_conv: (Proof.context -> conv) -> Proof.context -> conv\n end\n\n\n structure Autoref_Tagging :AUTOREF_TAGGING = struct\n fun term_of_tagged (Free v) = Free v\n | term_of_tagged (Var v) = Var v\n | term_of_tagged (Bound i) = Bound i\n | term_of_tagged @{mpat \"OP ?t\"} = t\n | term_of_tagged @{mpat \"ANNOT ?t _\"} = term_of_tagged t\n | term_of_tagged @{mpat \"?f$?x\"} = term_of_tagged f $ term_of_tagged x\n | term_of_tagged @{mpat \"PROTECT (\\x. PROTECT ?t)\"} \n = Abs (x,x_T,term_of_tagged t)\n | term_of_tagged @{mpat (typs) \"PROTECT (PROTECT::?'v_T\\_)\"} \n = Abs (\"x\",T,Bound 0)\n | term_of_tagged t = raise TERM (\"term_of_tagged\",[t])\n\n fun is_valid_tagged (Free _) = true\n | is_valid_tagged (Var _) = true\n | is_valid_tagged (Bound _) = true\n | is_valid_tagged @{mpat \"OP _\"} = true\n | is_valid_tagged @{mpat \"ANNOT ?t _\"} = is_valid_tagged t\n | is_valid_tagged @{mpat \"?f$?x\"} \n = is_valid_tagged f andalso is_valid_tagged x\n | is_valid_tagged @{mpat \"PROTECT (\\_. PROTECT ?t)\"} = is_valid_tagged t\n | is_valid_tagged @{mpat \"PROTECT PROTECT\"} = true\n | is_valid_tagged _ = false\n\n fun mk_APP f x = let\n val fT = fastype_of f\n val xT = fastype_of x\n val rT = range_type fT\n in\n Const (@{const_name APP},fT --> xT --> rT)$f$x\n end;\n\n fun mk_OP x = let \n val T = fastype_of x \n in \n Const(@{const_name OP},T-->T)$x\n end\n\n fun lambda' (name,T) t = let\n val tT = fastype_of t\n val t' = Const (@{const_name PROTECT},tT --> tT)$\n abstract_over (Free (name,T), t)\n val t' = \n Const (@{const_name PROTECT},(T --> tT) --> T --> tT)$Abs (name,T,t')\n in\n t'\n end\n\n val list_APP = Library.foldl (uncurry mk_APP)\n\n (* f$x1$...$xn goes to (f,[x1,...,xn]*)\n fun strip_app t = let\n fun strip_app_aux @{mpat \"?f$?x\"} args = strip_app_aux f (x::args)\n | strip_app_aux t args = (t,args)\n in strip_app_aux t [] end\n \n fun untag_conv ctxt = Raw_Simplifier.rewrite ctxt\n true (Autoref_Tag_Defs.get ctxt)\n\n fun ABS_beta_conv ctxt = Raw_Simplifier.rewrite ctxt\n true @{thms ABS_beta}\n \n val mk_PROTECT_conv = Conv.rewr_conv @{thm PROTECT_def[symmetric]}\n val mk_APP_conv = Conv.rewr_conv @{thm APP_def[symmetric]}\n val mk_OP_conv = Conv.rewr_conv @{thm OP_def[symmetric]}\n fun mk_ABS_conv ctxt = Conv.abs_conv (K mk_PROTECT_conv) ctxt\n then_conv mk_PROTECT_conv\n\n fun mk_ANNOT_conv a ct = let\n val Tt = ctyp_of_term ct\n\n val thm = Drule.instantiate' [SOME Tt] [SOME ct,SOME a] \n @{thm ANNOT_def[symmetric]}\n in\n thm\n end\n\n fun mk_rel_ANNOT_conv a ct = let\n val thy = theory_of_cterm ct\n val T = ctyp_of_term a |> typ_of\n val (Tc,Ta) = HOLogic.dest_setT T \n |> HOLogic.dest_prodT \n |> pairself (ctyp_of thy)\n val thm = Drule.instantiate' [SOME Ta, SOME Tc] [SOME ct,SOME a] \n @{thm rel_ANNOT_eq}\n in\n thm\n end\n\n (* Convert right hand side of refinement statement *)\n fun rhs_conv conv ctxt ct = let \n open Conv Refine_Util \n in\n case Logic.strip_imp_concl (term_of ct) of\n @{mpat \"Trueprop ((_,_)\\_)\"} =>\n HOL_concl_conv (fn ctxt => (arg1_conv (arg_conv (conv ctxt)))) ctxt ct\n | _ => raise CTERM (\"rhs_conv\",[ct])\n end\n end\n\n*}\n\nML_val {*\n Autoref_Tagging.mk_ANNOT_conv @{cterm \"bar::annot\"} @{cterm \"foo::'a::type\"};\n*}\n\nML_val {*\n Autoref_Tagging.mk_rel_ANNOT_conv \n @{cterm \"bar::('c\\'a) set\"} @{cterm \"foo::'a::type\"}\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Automatic_Refinement/Tool/Autoref_Tagging.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29864835678334584}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n Compatibility theory to recreate syntax for NICTA developments.\n*)\n\ntheory NICTACompat\nimports\n \"~~/src/HOL/Word/WordBitwise\"\n SignedWords\n NICTATools\nbegin\n\n(* all theories should import from NICTACompat rather than any ancestors *)\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n wordNOT :: \"'a::len0 word \\ 'a word\" (\"~~ _\" [70] 71)\nwhere\n \"~~ x == NOT x\"\n\nabbreviation\n wordAND :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"&&\" 64)\nwhere\n \"a && b == a AND b\"\n\nabbreviation\n wordOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"||\" 59)\nwhere\n \"a || b == a OR b\"\n\nabbreviation\n wordXOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"xor\" 59)\nwhere\n \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n by word_bitwise\n\n(* print words in hex *)\n(* mostly clagged from Num.thy *)\ntyped_print_translation {*\nlet\n fun dest_num (Const (@{const_syntax Num.Bit0}, _) $ n) = 2 * dest_num n\n | dest_num (Const (@{const_syntax Num.Bit1}, _) $ n) = 2 * dest_num n + 1\n | dest_num (Const (@{const_syntax Num.One}, _)) = 1;\n\n fun dest_bin_hex_str tm =\n let\n val num = dest_num tm;\n val pre = if num < 10 then \"\" else \"0x\"\n in\n pre ^ (Int.fmt StringCvt.HEX num)\n end;\n\n fun num_tr' sign ctxt T [n] =\n let\n val k = dest_bin_hex_str n;\n val t' = Syntax.const @{syntax_const \"_Numeral\"} $\n Syntax.free (sign ^ k);\n in\n case T of\n Type (@{type_name fun}, [_, T' as Type(\"Word.word\",_)]) =>\n if not (Config.get ctxt show_types) andalso can Term.dest_Type T'\n then t'\n else Syntax.const @{syntax_const \"_constrain\"} $ t' $\n Syntax_Phases.term_of_typ ctxt T'\n | T' => if T' = dummyT then t' else raise Match\n end;\nin [(@{const_syntax numeral}, num_tr' \"\")] end\n*}\n\nlemma neg_num_bintr:\n \"(- numeral x :: 'a::len word) =\n word_of_int (bintrunc (len_of TYPE('a)) (-numeral x))\"\n by (simp only: word_ubin.Abs_norm word_neg_numeral_alt)\n\n(* normalise word numerals to the interval [0..2^len_of 'a) *)\nML {*\n fun is_refl (Const (@{const_name Pure.eq}, _) $ x $ y) = (x = y)\n | is_refl _ = false;\n\n fun typ_size_of t = Word_Lib.dest_wordT (type_of (term_of t));\n\n fun num_len (Const (@{const_name Num.Bit0}, _) $ n) = num_len n + 1\n | num_len (Const (@{const_name Num.Bit1}, _) $ n) = num_len n + 1\n | num_len (Const (@{const_name Num.One}, _)) = 1\n | num_len (Const (@{const_name numeral}, _) $ t) = num_len t\n | num_len (Const (@{const_name uminus}, _) $ t) = num_len t\n | num_len t = raise TERM (\"num_len\", [t])\n\n fun unsigned_norm is_neg _ ctxt ct =\n (if is_neg orelse num_len (term_of ct) > typ_size_of ct then let\n val btr = if is_neg\n then @{thm neg_num_bintr} else @{thm num_abs_bintr}\n val th = [Thm.reflexive ct, mk_eq btr] MRS transitive_thm\n\n (* will work in context of theory Word as well *)\n val ss = simpset_of (@{context} addsimps @{thms bintrunc_numeral})\n val cnv = simplify (put_simpset ss ctxt) th\n in if is_refl (prop_of cnv) then NONE else SOME cnv end\n else NONE)\n handle TERM (\"num_len\", _) => NONE\n | TYPE (\"dest_binT\", _, _) => NONE\n*}\n\nsimproc_setup\n unsigned_norm (\"numeral n::'a::len word\") = {* unsigned_norm false *}\n\nsimproc_setup\n unsigned_norm_neg0 (\"-numeral (num.Bit0 num)::'a::len word\") = {* unsigned_norm true *}\n\nsimproc_setup\n unsigned_norm_neg1 (\"-numeral (num.Bit1 num)::'a::len word\") = {* unsigned_norm true *}\n\nlemma minus_one_norm:\n \"(-1 :: ('a :: len) word)\n = of_nat (2 ^ len_of TYPE('a) - 1)\"\n by (simp add:of_nat_diff)\nlemma \"f (7 :: 2 word) = f 3\"\n apply simp\n done\n\n\n\nlemma \"f -2 = f (22 :: 3 word)\"\n apply simp\n done\n\nlemma \"f -1 = f (13 :: 'a::len word)\"\n (* apply simp *)\n oops\n\nlemma \"f -2 = f (8589934590 :: word32)\"\n using [[simp_trace]]\n apply simp\n done\n\nlemma \"(-1 :: 2 word) = 3\"\n apply simp\n done\n\nlemma \"f -1 = f (15 :: 4 word)\"\n apply (simp add: minus_one_norm)\n done\n\nlemma \"f -1 = f (7 :: 3 word)\"\n apply (simp add: minus_one_norm)\n done\n\nlemma \"f -1 = f (0xFFFF :: 16 word)\"\n by (simp add: minus_one_norm)\n\nlemma bin_nth_minus_Bit0[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n, simp_all)\n\nlemma bin_nth_minus_Bit1[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n, simp_all)\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/lib/NICTACompat.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.29864835678334584}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Sim_Pres\n imports Weak_Early_Sim\nbegin\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"\\.(P) \\ \\.(Q)\"\nproof(induct rule: simCases)\n case(Bound Q' a x)\n have \"\\.(Q) \\a<\\x> \\ Q'\" by fact\n hence False by(induct rule: tauCases', auto)\n thus ?case by simp\nnext\n case(Free Q' \\)\n have \"\\.(Q) \\(\\ \\ Q')\" by fact\n thus ?case\n proof(induct rule: tauCases', auto simp only: pi.inject residual.inject)\n have \"\\.(P) \\\\<^sup>^ \\ \\ P\" by(rule Tau)\n with PRelQ show \"\\P'. \\.(P) \\\\<^sup>^\\ \\ P' \\ (P', Q) \\ Rel\" by blast\n qed\nqed\n\nlemma inputPres:\n fixes P :: pi\n and x :: name\n and Q :: pi\n and a :: name\n and Rel :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"\\y. (P[x::=y], Q[x::=y]) \\ Rel\"\n and Eqvt: \"eqvt Rel\"\n\n shows \"a.P \\ a.Q\"\nusing Eqvt\nproof(induct rule: simCasesCont[where C=\"(x, a, P, Q)\"])\n case(Bound b y Q')\n from `y \\ (x, a, P, Q)` have \"y \\ x\" \"y \\ a\" \"y \\ P\" \"y \\ Q\" by simp+\n from `a.Q \\b<\\y> \\ Q'` `y \\ a` `y \\ x` `y \\ Q` show ?case\n by(erule_tac inputCases') auto\nnext\n case(Free \\ Q')\n from `a.Q \\ \\ \\ Q'`\n show ?case\n proof(induct rule: inputCases)\n case(cInput u)\n have \"a.P \\\\<^sup>^(a) \\ P[x::=u]\"\n by(rule Input)\n moreover from PRelQ have \"(P[x::=u], Q[x::=u]) \\ Rel\" by auto\n ultimately show ?case by blast\n qed\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n and Rel :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"a{b}.P \\ a{b}.Q\"\nproof(induct rule: simCases)\n case(Bound Q' c x)\n have \"a{b}.Q \\c<\\x> \\ Q'\" by fact\n hence False by(induct rule: outputCases', auto)\n thus ?case by simp\nnext\n case(Free Q' \\)\n have \"a{b}.Q \\\\ \\ Q'\" by fact\n thus \"\\P'. a{b}.P \\\\<^sup>^ \\ \\ P' \\ (P', Q') \\ Rel\"\n proof(induct rule: outputCases', auto simp add: pi.inject residual.inject)\n have \"a{b}.P \\\\<^sup>^ a[b] \\ P\" by(rule Output)\n with PRelQ show \"\\P'. a{b}.P \\\\<^sup>^ a[b] \\ P' \\ (P', Q) \\ Rel\" by blast\n qed\nqed\n\n\n\n assumes PSimQ: \"P \\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n and RelStay: \"\\R S c. (R, S) \\ Rel \\ ([c\\c]R, S) \\ Rel\"\n\n shows \"[a\\b]P \\ [a\\b]Q\"\nproof(induct rule: simCases)\n case(Bound Q' c x)\n have \"x \\ [a\\b]P\" by fact\n hence xFreshP: \"(x::name) \\ P\" by simp\n have \"[a\\b]Q \\c<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: matchCases)\n case Match\n have \"Q \\c<\\x> \\ Q'\" by fact\n with PSimQ xFreshP obtain P' where PTrans: \"P \\c<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have \"[a\\a]P \\c<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Match)\n moreover from P'RelQ' RelRel' have \"(P', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nnext\n case(Free Q' \\)\n have \"[a\\b]Q \\\\ \\ Q'\" by fact\n thus ?case\n proof(induct rule: matchCases)\n case Match\n have \"Q \\ \\ \\ Q'\" by fact\n with PSimQ obtain P' where \"P \\\\<^sup>^\\ \\ P'\" and \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n thus ?case\n proof(induct rule: transitionCases)\n case Step\n have \"P \\\\ \\ P'\" by fact\n hence \"[a\\a]P \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Match)\n with RelRel' `(P', Q') \\ Rel` show ?case by(force simp add: weakFreeTransition_def)\n next\n case Stay\n have \"[a\\a]P \\\\<^sup>^\\ \\ [a\\a]P\" by(simp add: weakFreeTransition_def)\n moreover from `(P, Q') \\ Rel` have \"([a\\a]P, Q') \\ Rel\" by(blast intro: RelStay)\n ultimately show ?case using RelRel' by blast\n qed\n qed\nqed\n\nlemma mismatchPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n\n assumes PSimQ: \"P \\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n and RelStay: \"\\R S c d. \\(R, S) \\ Rel; c \\ d\\ \\ ([c\\d]R, S) \\ Rel\"\n\n shows \"[a\\b]P \\ [a\\b]Q\"\nproof(induct rule: simCases)\n case(Bound Q' c x)\n have \"x \\ [a\\b]P\" by fact\n hence xFreshP: \"(x::name) \\ P\" by simp\n have \"[a\\b]Q \\c<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: mismatchCases)\n case Mismatch\n have aineqb: \"a \\ b\" by fact\n have \"Q \\c<\\x> \\ Q'\" by fact\n with PSimQ xFreshP obtain P' where PTrans: \"P \\c<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans aineqb have \"[a\\b]P \\c<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n moreover from P'RelQ' RelRel' have \"(P', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nnext\n case(Free Q' \\)\n have \"[a\\b]Q \\\\ \\ Q'\" by fact\n thus ?case\n proof(induct rule: mismatchCases)\n case Mismatch\n have aineqb: \"a \\ b\" by fact\n have \"Q \\ \\ \\ Q'\" by fact\n with PSimQ obtain P' where \"P \\\\<^sup>^\\ \\ P'\" and \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n thus ?case\n proof(induct rule: transitionCases)\n case Step\n have \"P \\\\ \\ P'\" by fact\n hence \"[a\\b]P \\\\ \\ P'\" using aineqb by(rule Weak_Early_Step_Semantics.Mismatch)\n with RelRel' `(P', Q') \\ Rel` show ?case by(force simp add: weakFreeTransition_def)\n next\n case Stay\n have \"[a\\b]P \\\\<^sup>^\\ \\ [a\\b]P\" by(simp add: weakFreeTransition_def)\n moreover from `(P, Q') \\ Rel` aineqb have \"([a\\b]P, Q') \\ Rel\" by(blast intro: RelStay)\n ultimately show ?case using RelRel' by blast\n qed\n qed\nqed\n\nlemma parCompose:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n and S :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n and Rel'' :: \"(pi \\ pi) set\"\n \n assumes PSimQ: \"P \\ Q\"\n and RSimT: \"R \\ S\"\n and PRelQ: \"(P, Q) \\ Rel\"\n and RRel'T: \"(R, S) \\ Rel'\"\n and Par: \"\\P' Q' R' S'. \\(P', Q') \\ Rel; (R', S') \\ Rel'\\ \\ (P' \\ R', Q' \\ S') \\ Rel''\"\n and Res: \"\\T U x. (T, U) \\ Rel'' \\ (<\\x>T, <\\x>U) \\ Rel''\"\n\n shows \"P \\ R \\ Q \\ S\"\nproof -\n show ?thesis\n proof(induct rule: simCases)\n case(Bound Q' a x)\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n have \"Q \\ S \\a<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: parCasesB)\n case(cPar1 Q')\n have QTrans: \"Q \\ a<\\x> \\ Q'\" and xFreshT: \"x \\ S\" by fact+\n from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans xFreshR have \"P \\ R \\a<\\x> \\ (P' \\ R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' RRel'T have \"(P' \\ R, Q' \\ S) \\ Rel''\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cPar2 S')\n have STrans: \"S \\ a<\\x> \\ S'\" and xFreshQ: \"x \\ Q\" by fact+\n from xFreshR RSimT STrans obtain R' where RTrans:\"R \\a<\\x> \\ R'\"\n and R'Rel'T': \"(R', S') \\ Rel'\"\n by(blast dest: simE)\n from RTrans xFreshP xFreshR have ParTrans: \"P \\ R \\a<\\x> \\ (P \\ R')\"\n by(blast intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'Rel'T' have \"(P \\ R', Q \\ S') \\ Rel''\" by(rule Par)\n ultimately show ?case by blast\n qed\n next\n case(Free QT' \\)\n have \"Q \\ S \\ \\ \\ QT'\" by fact\n thus ?case\n proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n case(cPar1 Q')\n have \"Q \\ \\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\\\<^sup>^ \\ \\ P'\" and PRel: \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have Trans: \"P \\ R \\\\<^sup>^ \\ \\ P' \\ R\" by(rule Weak_Early_Semantics.Par1F)\n moreover from PRel RRel'T have \"(P' \\ R, Q' \\ S) \\ Rel''\" by(blast intro: Par)\n ultimately show ?case by blast\n next\n case(cPar2 S')\n have \"S \\ \\ \\ S'\" by fact\n with RSimT obtain R' where RTrans: \"R \\\\<^sup>^ \\ \\ R'\" and RRel: \"(R', S') \\ Rel'\"\n by(blast dest: simE)\n from RTrans have Trans: \"P \\ R \\\\<^sup>^ \\ \\ P \\ R'\" by(rule Weak_Early_Semantics.Par2F)\n moreover from PRelQ RRel have \"(P \\ R', Q \\ S') \\ Rel''\" by(blast intro: Par)\n ultimately show ?case by blast\n next\n case(cComm1 Q' S' a b)\n have QTrans: \"Q \\ a \\ Q'\" and STrans: \"S \\ a[b] \\ S'\" by fact+\n\n from PSimQ QTrans obtain P' where PTrans: \"P \\a \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from RSimT STrans obtain R' where RTrans: \"R \\a[b] \\ R'\"\n and RRel: \"(R', S') \\ Rel'\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from PTrans RTrans have \"P \\ R \\\\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n hence \"P \\ R \\\\<^sup>^\\ \\ P' \\ R'\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n\n moreover from P'RelQ' RRel have \"(P' \\ R', Q' \\ S') \\ Rel''\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cComm2 Q' S' a b)\n have QTrans: \"Q \\a[b] \\ Q'\" and STrans: \"S \\a \\ S'\" by fact+\n \n from PSimQ QTrans obtain P' where PTrans: \"P \\a[b] \\ P'\"\n and PRel: \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from RSimT STrans obtain R' where RTrans: \"R \\a \\ R'\"\n and R'Rel'T': \"(R', S') \\ Rel'\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from PTrans RTrans have \"P \\ R \\\\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n hence \"P \\ R \\\\<^sup>^\\ \\ P' \\ R'\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n moreover from PRel R'Rel'T' have \"(P' \\ R', Q' \\ S') \\ Rel''\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cClose1 Q' S' a x)\n have QTrans: \"Q \\a \\ Q'\" and STrans: \"S \\a<\\x> \\ S'\" by fact+\n have \"x \\ (P, R)\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by(simp add: fresh_prod)+\n \n from PSimQ QTrans obtain P' where PTrans: \"P \\a \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from RSimT STrans xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\" \n and R'Rel'T': \"(R', S') \\ Rel'\"\n by(blast dest: simE)\n \n from PTrans RTrans xFreshP have Trans: \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close1)\n hence \"P \\ R \\\\<^sup>^\\ \\ <\\x>(P' \\ R')\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n moreover from P'RelQ' R'Rel'T' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ S')) \\ Rel''\"\n by(blast intro: Par Res)\n ultimately show ?case by blast\n next\n case(cClose2 Q' S' a x)\n have QTrans: \"Q \\a<\\x> \\ Q'\" and STrans: \"S \\a \\ S'\" by fact+\n have \"x \\ (P, R)\" by fact\n hence xFreshR: \"x \\ R\" and xFreshP: \"x \\ P\" by(simp add: fresh_prod)+\n\n from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from RSimT STrans obtain R' where RTrans: \"R \\a \\ R'\"\n and R'Rel'T': \"(R', S') \\ Rel'\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n from PTrans RTrans xFreshR have Trans: \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close2)\n hence \"P \\ R \\\\<^sup>^\\ \\ <\\x>(P' \\ R')\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n moreover from P'RelQ' R'Rel'T' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ S')) \\ Rel''\"\n by(blast intro: Par Res)\n ultimately show ?case by blast\n qed\n qed\nqed\n\nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n and a :: name\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n \n assumes PSimQ: \"P \\ Q\"\n and PRelQ: \"(P, Q) \\ Rel\"\n and Par: \"\\S T U. (S, T) \\ Rel \\ (S \\ U, T \\ U) \\ Rel'\"\n and Res: \"\\S T x. (S, T) \\ Rel' \\ (<\\x>S, <\\x>T) \\ Rel'\"\n\n shows \"P \\ R \\ Q \\ R\"\nproof -\n note PSimQ \n moreover have RSimR: \"R \\ R\" by(auto intro: reflexive)\n moreover note PRelQ moreover have \"(R, R) \\ Id\" by auto\n moreover from Par have \"\\P Q R T. \\(P, Q) \\ Rel; (R, T) \\ Id\\ \\ (P \\ R, Q \\ T) \\ Rel'\"\n by auto\n ultimately show ?thesis using Res by(rule parCompose)\nqed\n\n\n\n assumes PSimQ: \"P \\ Q\"\n and ResRel: \"\\R S y. (R, S) \\ Rel \\ (<\\y>R, <\\y>S) \\ Rel'\"\n and RelRel': \"Rel \\ Rel'\"\n and EqvtRel: \"eqvt Rel\"\n and EqvtRel': \"eqvt Rel'\"\n\n shows \"<\\x>P \\ <\\x>Q\"\nproof -\n from EqvtRel' show ?thesis\n proof(induct rule: simCasesCont[where C=\"(P, x)\"])\n case(Bound a y Q')\n have Trans: \"<\\x>Q \\a<\\y> \\ Q'\" by fact\n have \"y \\ (P, x)\" by fact\n hence yineqx: \"y \\ x\" and yFreshP: \"y \\ P\" by(simp add: fresh_prod)+\n from Trans yineqx show ?case\n proof(induct rule: resCasesB)\n case(Open Q')\n have QTrans: \"Q \\a[x] \\ Q'\" and aineqx: \"a \\ x\" by fact+\n\n from PSimQ QTrans obtain P' where PTrans: \"P \\\\<^sup>^a[x] \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from PTrans aineqx have \"<\\x>P \\a<\\x> \\ P'\" \n by(force intro: Weak_Early_Step_Semantics.Open simp add: weakFreeTransition_def)\n with `y \\ P` `y \\ x` have \"<\\x>P \\a<\\y> \\ ([(y, x)] \\ P')\"\n by(force intro: weakTransitionAlpha simp add: abs_fresh name_swap)\n moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\ P', [(y, x)] \\ Q') \\ Rel'\"\n by(blast intro: eqvtRelI)\n ultimately show ?case by blast\n next\n case(Res Q')\n have QTrans: \"Q \\a<\\y> \\ Q'\" and xineqa: \"x \\ a\" by fact+\n\n from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\a<\\y> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans xineqa yineqx yFreshP have ResTrans: \"<\\x>P \\a<\\y> \\ (<\\x>P')\"\n by(blast intro: Weak_Early_Step_Semantics.ResB)\n moreover from P'RelQ' have \"((<\\x>P'), (<\\x>Q')) \\ Rel'\"\n by(rule ResRel)\n ultimately show ?case by blast\n qed\n next\n case(Free \\ Q')\n have QTrans: \"<\\x>Q \\ \\ \\ Q'\" by fact\n have \"\\c::name. c \\ (P, Q, Q', \\)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshQ: \"c \\ Q\" and cFreshAlpha: \"c \\ \\\" and cFreshQ': \"c \\ Q'\" and cFreshP: \"c \\ P\"\n by(force simp add: fresh_prod)\n from cFreshP have \"<\\x>P = <\\c>([(x, c)] \\ P)\" by(simp add: alphaRes)\n moreover have \"\\P'.<\\c>([(x, c)] \\ P) \\\\<^sup>^ \\ \\ P' \\ (P', Q') \\ Rel'\"\n proof -\n from QTrans cFreshQ have \"<\\c>([(x, c)] \\ Q) \\\\ \\ Q'\" by(simp add: alphaRes)\n moreover have \"c \\ \\\" by(rule cFreshAlpha)\n moreover from PSimQ EqvtRel have \"([(x, c)] \\ P) \\ ([(x, c)] \\ Q)\"\n by(blast intro: eqvtI)\n ultimately show ?thesis\n apply(induct rule: resCasesF, auto simp add: residual.inject pi.inject name_abs_eq)\n by(blast intro: ResF ResRel dest: simE)\n qed\n\n ultimately show ?case by force\n qed\nqed\n\nlemma resChainI:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and lst :: \"name list\"\n\n assumes eqvtRel: \"eqvt Rel\"\n and Res: \"\\R S y. (R, S) \\ Rel \\ (<\\y>R, <\\y>S) \\ Rel\"\n and PRelQ: \"P \\ Q\"\n\n shows \"(resChain lst) P \\ (resChain lst) Q\"\nproof -\n show ?thesis\n proof(induct lst) (* Base case *)\n from PRelQ show \"resChain [] P \\ resChain [] Q\" by simp\n next (* Inductive step *)\n fix a lst\n assume IH: \"(resChain lst P) \\ (resChain lst Q)\"\n moreover from Res have \"\\P Q a. (P, Q) \\ Rel \\ (<\\a>P, <\\a>Q) \\ Rel\"\n by simp\n moreover have \"Rel \\ Rel\" by simp\n ultimately have \"<\\a>(resChain lst P) \\ <\\a>(resChain lst Q)\" using eqvtRel\n by(rule_tac resPres)\n thus \"resChain (a # lst) P \\ resChain (a # lst) Q\"\n by simp\n qed\nqed\n\n\n\n and ParComp: \"\\R S T U. \\(R, S) \\ Rel; (T, U) \\ Rel'\\ \\ (R \\ T, S \\ U) \\ Rel'\"\n and Res: \"\\R S x. (R, S) \\ Rel' \\ (<\\x>R, <\\x>S) \\ Rel'\"\n\n and RelStay: \"\\R S. (R \\ !R, S) \\ Rel' \\ (!R, S) \\ Rel'\"\n and BangRelRel': \"(bangRel Rel) \\ Rel'\"\n and eqvtRel': \"eqvt Rel'\"\n\n shows \"!P \\ !Q\"\nproof -\n let ?Sim = \"\\P Rs. (\\a x Q'. Rs = a<\\x> \\ Q' \\ x \\ P \\ (\\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel')) \\\n (\\\\ Q'. Rs = \\ \\ Q' \\ (\\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel'))\"\n {\n fix Rs P\n assume \"!Q \\ Rs\" and \"(P, !Q) \\ bangRel Rel\"\n hence \"?Sim P Rs\" using PRelQ\n proof(nominal_induct avoiding: P rule: bangInduct)\n case(Par1B a x Q')\n have QTrans: \"Q \\a<\\x> \\ Q'\" and xFreshQ: \"x \\ Q\" by fact+\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact+\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelT: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n from PRelQ have PSimQ: \"P \\ Q\" by(rule Sim)\n from `x \\ P` `x \\ Q` show ?case\n proof(auto simp add: residual.inject alpha' name_fresh_fresh)\n from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans xFreshR have \"P \\ R \\a<\\x>\\ (P' \\ R)\"\n by(rule Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' RBangRelT BangRelRel' have \"(P' \\ R, Q' \\ !Q) \\ Rel'\"\n by(blast intro: Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\a<\\x> \\ P' \\ (P', Q' \\ !Q) \\ Rel'\" by blast\n next\n fix y\n assume \"(y::name) \\ Q'\" and \"y \\ P\" and \"y \\ R\"\n from QTrans `y \\ Q'` have \"Q \\a<\\y> \\ ([(x, y)] \\ Q')\" by(simp add: alphaBoundOutput)\n with PSimQ `y \\ P` obtain P' where PTrans: \"P \\a<\\y> \\ P'\"\n and P'RelQ': \"(P', [(x, y)] \\ Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans `y \\ R` have \"P \\ R \\a<\\y>\\ (P' \\ R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' RBangRelT BangRelRel' have \"(P' \\ R, ([(y, x)] \\ Q') \\ !Q) \\ Rel'\"\n by(fastforce intro: Rel.BRPar simp add: name_swap) \n ultimately show \"\\P'. P \\ R \\a<\\y> \\ P' \\ (P', ([(y, x)] \\ Q') \\ !Q) \\ Rel'\" by blast\n qed\n qed\n next\n case(Par1F \\ Q' P)\n have QTrans: \"Q \\\\ \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\\\<^sup>^\\ \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n\n from PTrans have \"P \\ R \\\\<^sup>^\\ \\ P' \\ R\" by(rule Weak_Early_Semantics.Par1F)\n moreover from P'RelQ' RBangRelQ have \"(P' \\ R, Q' \\ !Q) \\ bangRel Rel\"\n by(rule Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\\\<^sup>^\\ \\ P' \\ (P', Q' \\ !Q) \\ Rel'\" using BangRelRel' by blast\n qed\n qed\n next\n case(Par2B a x Q' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (a<\\x> \\ Q')\" by simp\n have xFreshQ: \"x \\ Q\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact+\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case using `x \\ Q`\n proof(auto simp add: residual.inject alpha' name_fresh_fresh)\n from IH RBangRelQ have \"?Sim R (a<\\x> \\ Q')\" by blast\n with xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\" and R'BangRelQ': \"(R', Q') \\ Rel'\"\n by(blast dest: simE)\n from RTrans xFreshP have \"P \\ R \\a<\\x> \\ (P \\ R')\"\n by(auto intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'BangRelQ' have \"(P \\ R', Q \\ Q') \\ Rel'\"\n by(rule ParComp)\n ultimately show \"\\P'. P \\ R \\a<\\x> \\ P' \\ (P', Q \\ Q') \\ Rel'\" by blast\n next\n fix y\n assume \"(y::name) \\ Q'\" and \"y \\ R\" and \"y \\ P\"\n from IH RBangRelQ have \"?Sim R (a<\\x> \\ Q')\" by blast\n with `y \\ Q'` have \"?Sim R (a<\\y> \\ ([(x, y)] \\ Q'))\" by(simp add: alphaBoundOutput)\n with `y \\ R`obtain R' where RTrans: \"R \\a<\\y> \\ R'\" and R'BangRelQ': \"(R', [(x, y)] \\ Q') \\ Rel'\"\n by(blast dest: simE)\n from RTrans `y \\ P` have \"P \\ R \\a<\\y> \\ (P \\ R')\"\n by(auto intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'BangRelQ' have \"(P \\ R', Q \\ ([(y, x)] \\ Q')) \\ Rel'\"\n by(fastforce intro: ParComp simp add: name_swap)\n ultimately show \"\\P'. P \\ R \\a<\\y> \\ P' \\ (P', Q \\ ([(y, x)] \\ Q')) \\ Rel'\" by blast\n qed\n qed\n next\n case(Par2F \\ Q' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (\\ \\ Q')\" by simp\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from RBangRelQ have \"?Sim R (\\ \\ Q')\" by(rule IH)\n then obtain R' where RTrans: \"R \\\\<^sup>^\\ \\ R'\" and R'RelQ': \"(R', Q') \\ Rel'\"\n by(blast dest: simE)\n from RTrans have \"P \\ R \\\\<^sup>^\\ \\ P \\ R'\" by(rule Weak_Early_Semantics.Par2F)\n moreover from PRelQ R'RelQ' have \"(P \\ R', Q \\ Q') \\ Rel'\" by(rule ParComp)\n ultimately show \"\\P'. P \\ R \\\\<^sup>^\\ \\ P' \\ (P', Q \\ Q') \\ Rel'\" by blast\n qed\n qed\n next\n case(Comm1 a Q' b Q'' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (a[b] \\ Q'')\" by simp\n have QTrans: \"Q \\ a \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n\n from RBangRelQ have \"?Sim R (a[b] \\ Q'')\" by(rule IH)\n then obtain R' where RTrans: \"R \\a[b] \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ Rel'\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n from PTrans RTrans have \"P \\ R \\\\ \\ (P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Comm1)\n hence \"P \\ R \\\\<^sub>\\ P' \\ R'\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n moreover from P'RelQ' R'RelQ'' have \"(P' \\ R', Q' \\ Q'') \\ Rel'\"\n by(rule ParComp)\n ultimately show \"\\P'. (P \\ R, P') \\ {(P, P'). P \\ \\ \\ P'}\\<^sup>* \\ (P', Q' \\ Q'') \\ Rel'\"\n by auto\n qed\n qed\n next\n case(Comm2 a b Q' Q'' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (a \\ Q'')\" by simp\n have QTrans: \"Q \\a[b] \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a[b] \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n\n from RBangRelQ have \"?Sim R (a \\ Q'')\" by(rule IH)\n then obtain R' where RTrans: \"R \\a \\ R'\" and R'BangRelQ'': \"(R', Q'') \\ Rel'\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from PTrans RTrans have \"P \\ R \\\\ \\ (P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Comm2)\n hence \"P \\ R \\\\<^sub>\\ P' \\ R'\" \n by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n moreover from P'RelQ' R'BangRelQ'' have \"(P' \\ R', Q' \\ Q'') \\ Rel'\"\n by(rule ParComp)\n ultimately show \"\\P'. (P \\ R, P') \\ {(P, P'). P \\ \\ \\ P'}\\<^sup>* \\ (P', Q' \\ Q'') \\ Rel'\" by auto\n qed\n qed\n next\n case(Close1 a x Q' Q'' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (a<\\x> \\ Q'')\" by simp\n have QTrans: \"Q \\ a \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact+\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshR: \"x \\ R\" and xFreshP: \"x \\ P\" by simp+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(fastforce dest: simE simp add: weakFreeTransition_def)\n \n from RBangRelQ have \"?Sim R (a<\\x> \\ Q'') \" by(rule IH)\n with xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ Rel'\"\n by(blast dest: simE)\n \n from PTrans RTrans xFreshP have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close1)\n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ Rel'\"\n by(force intro: ParComp Res)\n ultimately show \"\\P'. (P \\ R, P') \\ {(P, P'). P \\ \\ \\ P'}\\<^sup>* \\ (P', <\\x>(Q' \\ Q'')) \\ Rel'\" by auto\n qed\n qed\n next\n case(Close2 a x Q' Q'' P)\n hence IH: \"\\P. (P, !Q) \\ bangRel Rel \\ ?Sim P (a \\ Q'')\" by simp\n have QTrans: \"Q \\ a<\\x> \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact+\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n\n from RBangRelQ have \"?Sim R (a \\ Q'')\" by(rule IH)\n with xFreshR obtain R' where RTrans: \"R \\a \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ Rel'\"\n by(fastforce simp add: weakFreeTransition_def)\n from PTrans RTrans xFreshR have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close2)\n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ Rel'\"\n by(force intro: ParComp Res)\n ultimately show \"\\P'. (P \\ R, P') \\ {(P, P'). P \\ \\ \\ P'}\\<^sup>* \\ (P', <\\x>(Q' \\ Q'')) \\ Rel'\" by auto\n qed\n qed\n next\n case(Bang Rs)\n hence IH: \"\\P. (P, Q \\ !Q) \\ bangRel Rel \\ ?Sim P Rs\" by simp\n have \"(P, !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRBangCases)\n case(BRBang P)\n have PRelQ: \"(P, Q) \\ Rel\" by fact\n hence \"(!P, !Q) \\ bangRel Rel\" by(rule Rel.BRBang)\n with PRelQ have \"(P \\ !P, Q \\ !Q) \\ bangRel Rel\" by(rule Rel.BRPar)\n hence IH: \"?Sim (P \\ !P) Rs\" by(rule IH)\n show ?case\n proof(intro conjI allI impI)\n fix Q' a x\n assume \"Rs = a<\\x> \\ Q'\" and \"x \\ !P\"\n then obtain P' where PTrans: \"(P \\ !P) \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel'\" using IH\n by(auto simp add: residual.inject)\n from PTrans have \"!P \\a<\\x> \\ P'\"\n by(force intro: Weak_Early_Step_Semantics.Bang simp add: weakFreeTransition_def)\n with P'RelQ' show \"\\P'. !P \\a<\\x> \\ P' \\ (P', Q') \\ Rel'\" by blast\n next\n fix Q' \\\n assume \"Rs = \\ \\ Q'\"\n then obtain P' where PTrans: \"(P \\ !P) \\\\<^sup>^\\ \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel'\" using IH\n by auto\n from PTrans show \"\\P'. !P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel'\" using P'RelQ'\n proof(induct rule: transitionCases)\n case Step\n have \"P \\ !P \\\\ \\ P'\" by fact\n hence \"!P \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Bang)\n with P'RelQ' show ?case by(force simp add: weakFreeTransition_def)\n next\n case Stay\n have \"!P \\\\<^sup>^\\ \\ !P\" by(simp add: weakFreeTransition_def)\n moreover assume \"(P \\ !P, Q') \\ Rel'\"\n hence \"(!P, Q') \\ Rel'\" by(blast intro: RelStay)\n ultimately show ?case by blast\n qed\n qed\n qed\n qed\n }\n moreover from PRelQ have \"(!P, !Q) \\ bangRel Rel\" by(rule Rel.BRBang)\n ultimately show ?thesis by(auto simp add: weakSimulation_def)\nqed\n\nlemma bangRelSim:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel'l :: \"(pi \\ pi) set\"\n\n assumes PBangRelQ: \"(P, Q) \\ bangRel Rel\"\n and Sim: \"\\R S. (R, S) \\ Rel \\ R \\ S\"\n\n and ParComp: \"\\R S T U. \\(R, S) \\ Rel; (T, U) \\ Rel'\\ \\ (R \\ T, S \\ U) \\ Rel'\"\n and Res: \"\\R S x. (R, S) \\ Rel' \\ (<\\x>R, <\\x>S) \\ Rel'\"\n\n and RelStay: \"\\R S. (R \\ !R, S) \\ Rel' \\ (!R, S) \\ Rel'\"\n and BangRelRel': \"(bangRel Rel) \\ Rel'\"\n and eqvtRel': \"eqvt Rel'\"\n and Eqvt: \"eqvt Rel\"\n\n shows \"P \\ Q\"\nproof -\n from PBangRelQ show ?thesis\n proof(induct rule: bangRel.induct)\n case(BRBang P Q)\n have PRelQ: \"(P, Q) \\ Rel\" by fact\n thus ?case using ParComp Res BangRelRel' eqvtRel' Eqvt RelStay Sim\n by(rule_tac bangPres)\n next\n case(BRPar P Q R T) \n have \"(P, Q) \\ Rel\" by fact\n moreover hence \"P \\ Q\" by(rule Sim)\n moreover have \"R \\ T\" by fact\n moreover have \"(R, T) \\ bangRel Rel\" by fact\n ultimately show ?case using ParComp eqvtRel' Res Eqvt BangRelRel'\n by(blast intro: parCompose)\n next\n case(BRRes P Q x)\n have \"P \\ Q\" by fact\n thus ?case using BangRelRel' eqvtRel' Res by(blast intro: resPres)\n qed\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Early_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2986483495324735}} {"text": "section {* Operational Semantics *}\n\ntheory RG_Tran\nimports RG_Com\nbegin\n\nsubsection {* Semantics of Component Programs *}\n\nsubsubsection {* Environment transitions *}\n\ntype_synonym 'a conf = \"(('a com) option) \\ 'a\"\n\ninductive_set\n etran :: \"('a conf \\ 'a conf) set\" \n and etran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -e\\ _\" [81,81] 80)\nwhere\n \"P -e\\ Q \\ (P,Q) \\ etran\"\n| Env: \"(P, s) -e\\ (P, t)\"\n\nlemma etranE: \"c -e\\ c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule etran.cases, blast)\n\nsubsubsection {* Component transitions *}\n\ninductive_set\n ctran :: \"('a conf \\ 'a conf) set\"\n and ctran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c\\ _\" [81,81] 80)\n and ctrans :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c*\\ _\" [81,81] 80)\nwhere\n \"P -c\\ Q \\ (P,Q) \\ ctran\"\n| \"P -c*\\ Q \\ (P,Q) \\ ctran^*\"\n\n| Basic: \"(Some(Basic f), s) -c\\ (None, f s)\"\n\n| Seq1: \"(Some P0, s) -c\\ (None, t) \\ (Some(Seq P0 P1), s) -c\\ (Some P1, t)\"\n\n| Seq2: \"(Some P0, s) -c\\ (Some P2, t) \\ (Some(Seq P0 P1), s) -c\\ (Some(Seq P2 P1), t)\"\n\n| CondT: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P1, s)\"\n| CondF: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P2, s)\"\n\n| WhileF: \"s\\b \\ (Some(While b P), s) -c\\ (None, s)\"\n| WhileT: \"s\\b \\ (Some(While b P), s) -c\\ (Some(Seq P (While b P)), s)\"\n\n| Await: \"\\s\\b; (Some P, s) -c*\\ (None, t)\\ \\ (Some(Await b P), s) -c\\ (None, t)\" \n\nmonos \"rtrancl_mono\"\n\nsubsection {* Semantics of Parallel Programs *}\n\ntype_synonym 'a par_conf = \"('a par_com) \\ 'a\"\n\ninductive_set\n par_etran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_etran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pe\\ _\" [81,81] 80)\nwhere\n \"P -pe\\ Q \\ (P,Q) \\ par_etran\"\n| ParEnv: \"(Ps, s) -pe\\ (Ps, t)\"\n\ninductive_set\n par_ctran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_ctran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pc\\ _\" [81,81] 80)\nwhere\n \"P -pc\\ Q \\ (P,Q) \\ par_ctran\"\n| ParComp: \"\\i (r, t)\\ \\ (Ps, s) -pc\\ (Ps[i:=r], t)\"\n\nlemma par_ctranE: \"c -pc\\ c' \\\n (\\i Ps s r t. c = (Ps, s) \\ c' = (Ps[i := r], t) \\ i < length Ps \\\n (Ps ! i, s) -c\\ (r, t) \\ P) \\ P\"\n by (induct c, induct c', erule par_ctran.cases, blast)\n\nsubsection {* Computations *}\n\nsubsubsection {* Sequential computations *}\n\ntype_synonym 'a confs = \"'a conf list\"\n\ninductive_set cptn :: \"'a confs set\"\nwhere\n CptnOne: \"[(P,s)] \\ cptn\"\n| CptnEnv: \"(P, t)#xs \\ cptn \\ (P,s)#(P,t)#xs \\ cptn\"\n| CptnComp: \"\\(P,s) -c\\ (Q,t); (Q, t)#xs \\ cptn \\ \\ (P,s)#(Q,t)#xs \\ cptn\"\n\ndefinition cp :: \"('a com) option \\ 'a \\ ('a confs) set\" where\n \"cp P s \\ {l. l!0=(P,s) \\ l \\ cptn}\" \n\nsubsubsection {* Parallel computations *}\n\ntype_synonym 'a par_confs = \"'a par_conf list\"\n\ninductive_set par_cptn :: \"'a par_confs set\"\nwhere\n ParCptnOne: \"[(P,s)] \\ par_cptn\"\n| ParCptnEnv: \"(P,t)#xs \\ par_cptn \\ (P,s)#(P,t)#xs \\ par_cptn\"\n| ParCptnComp: \"\\ (P,s) -pc\\ (Q,t); (Q,t)#xs \\ par_cptn \\ \\ (P,s)#(Q,t)#xs \\ par_cptn\"\n\ndefinition par_cp :: \"'a par_com \\ 'a \\ ('a par_confs) set\" where\n \"par_cp P s \\ {l. l!0=(P,s) \\ l \\ par_cptn}\" \n\nsubsection{* Modular Definition of Computation *}\n\ndefinition lift :: \"'a com \\ 'a conf \\ 'a conf\" where\n \"lift Q \\ \\(P, s). (if P=None then (Some Q,s) else (Some(Seq (the P) Q), s))\"\n\ninductive_set cptn_mod :: \"('a confs) set\"\nwhere\n CptnModOne: \"[(P, s)] \\ cptn_mod\"\n| CptnModEnv: \"(P, t)#xs \\ cptn_mod \\ (P, s)#(P, t)#xs \\ cptn_mod\"\n| CptnModNone: \"\\(Some P, s) -c\\ (None, t); (None, t)#xs \\ cptn_mod \\ \\ (Some P,s)#(None, t)#xs \\cptn_mod\"\n| CptnModCondT: \"\\(Some P0, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P0, s)#ys \\ cptn_mod\"\n| CptnModCondF: \"\\(Some P1, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P1, s)#ys \\ cptn_mod\"\n| CptnModSeq1: \"\\(Some P0, s)#xs \\ cptn_mod; zs=map (lift P1) xs \\\n \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n| CptnModSeq2: \n \"\\(Some P0, s)#xs \\ cptn_mod; fst(last ((Some P0, s)#xs)) = None; \n (Some P1, snd(last ((Some P0, s)#xs)))#ys \\ cptn_mod; \n zs=(map (lift P1) xs)@ys \\ \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n\n| CptnModWhile1: \n \"\\ (Some P, s)#xs \\ cptn_mod; s \\ b; zs=map (lift (While b P)) xs \\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n| CptnModWhile2: \n \"\\ (Some P, s)#xs \\ cptn_mod; fst(last ((Some P, s)#xs))=None; s \\ b; \n zs=(map (lift (While b P)) xs)@ys; \n (Some(While b P), snd(last ((Some P, s)#xs)))#ys \\ cptn_mod\\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n\nsubsection {* Equivalence of Both Definitions.*}\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n by (induct xs) auto\n\nlemma div_seq [rule_format]: \"list \\ cptn_mod \\\n (\\s P Q zs. list=(Some (Seq P Q), s)#zs \\\n (\\xs. (Some P, s)#xs \\ cptn_mod \\ (zs=(map (lift Q) xs) \\\n ( fst(((Some P, s)#xs)!length xs)=None \\ \n (\\ys. (Some Q, snd(((Some P, s)#xs)!length xs))#ys \\ cptn_mod \n \\ zs=(map (lift (Q)) xs)@ys)))))\"\napply(erule cptn_mod.induct)\napply simp_all\n apply clarify\n apply(force intro:CptnModOne)\n apply clarify\n apply(erule_tac x=Pa in allE)\n apply(erule_tac x=Q in allE)\n apply simp\n apply clarify\n apply(erule disjE)\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply clarify\n apply(erule CptnModEnv)\n apply(rule disjI1)\n apply(simp add:lift_def)\n apply clarify\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply(erule CptnModEnv)\n apply(rule disjI2)\n apply(rule conjI)\n apply(case_tac xsa,simp,simp)\n apply(rule_tac x=\"ys\" in exI)\n apply(rule conjI)\n apply simp\n apply(simp add:lift_def)\n apply clarify\n apply(erule ctran.cases,simp_all)\n apply clarify\n apply(rule_tac x=\"xs\" in exI)\n apply simp\n apply clarify\napply(rule_tac x=\"xs\" in exI)\napply(simp add: last_length)\ndone\n\nlemma cptn_onlyif_cptn_mod_aux [rule_format]:\n \"\\s Q t xs.((Some a, s), Q, t) \\ ctran \\ (Q, t) # xs \\ cptn_mod \n \\ (Some a, s) # (Q, t) # xs \\ cptn_mod\"\napply(induct a)\napply simp_all\n--{* basic *}\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,rule Basic,simp)\napply clarify\napply(erule ctran.cases,simp_all)\n--{* Seq1 *}\napply(rule_tac xs=\"[(None,ta)]\" in CptnModSeq2)\n apply(erule CptnModNone)\n apply(rule CptnModOne)\n apply simp\napply simp\napply(simp add:lift_def)\n--{* Seq2 *}\napply(erule_tac x=sa in allE)\napply(erule_tac x=\"Some P2\" in allE)\napply(erule allE,erule impE, assumption)\napply(drule div_seq,simp)\napply clarify\napply(erule disjE)\n apply clarify\n apply(erule allE,erule impE, assumption)\n apply(erule_tac CptnModSeq1)\n apply(simp add:lift_def)\napply clarify \napply(erule allE,erule impE, assumption)\napply(erule_tac CptnModSeq2)\n apply (simp add:last_length)\n apply (simp add:last_length)\napply(simp add:lift_def)\n--{* Cond *}\napply clarify\napply(erule ctran.cases,simp_all)\napply(force elim: CptnModCondT)\napply(force elim: CptnModCondF)\n--{* While *}\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule WhileF,simp)\napply(drule div_seq,force)\napply clarify\napply (erule disjE)\n apply(force elim:CptnModWhile1)\napply clarify\napply(force simp add:last_length elim:CptnModWhile2)\n--{* await *}\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule Await,simp+)\ndone\n\nlemma cptn_onlyif_cptn_mod [rule_format]: \"c \\ cptn \\ c \\ cptn_mod\"\napply(erule cptn.induct)\n apply(rule CptnModOne)\n apply(erule CptnModEnv)\napply(case_tac P)\n apply simp\n apply(erule ctran.cases,simp_all)\napply(force elim:cptn_onlyif_cptn_mod_aux)\ndone\n\nlemma lift_is_cptn: \"c\\cptn \\ map (lift P) c \\ cptn\"\napply(erule cptn.induct)\n apply(force simp add:lift_def CptnOne)\n apply(force intro:CptnEnv simp add:lift_def)\napply(force simp add:lift_def intro:CptnComp Seq2 Seq1 elim:ctran.cases)\ndone\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\b a. b#c1\\cptn \\ a#c2\\cptn \\ (b#c1)!length c1=a \\ b#c1@c2\\cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\n apply(force intro:CptnEnv)\napply(force elim:CptnComp)\ndone\n\nlemma last_lift: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=None\\ \n \\ fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=(Some P)\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\ \\P a \\ P (x!(length x - (Suc 0)))\" \n by (induct x) simp_all\n\nlemma last_fst_esp: \n \"fst(((Some a,s)#xs)!(length xs))=None \\ fst(xs!(length xs - (Suc 0)))=None\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\[] \\ \n snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma Cons_lift: \"(Some (Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((Some P, s) # xs)\"\n by (simp add:lift_def)\n\nlemma Cons_lift_append: \n \"(Some (Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((Some P, s) # xs)@ ys \"\n by (simp add:lift_def)\n\nlemma lift_nth: \"i map (lift Q) xs ! i = lift Q (xs! i)\"\n by (simp add:lift_def)\n\nlemma snd_lift: \"i< length xs \\ snd(lift Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_def)\n\nlemma cptn_if_cptn_mod: \"c \\ cptn_mod \\ c \\ cptn\"\napply(erule cptn_mod.induct)\n apply(rule CptnOne)\n apply(erule CptnEnv)\n apply(erule CptnComp,simp)\n apply(rule CptnComp)\n apply(erule CondT,simp)\n apply(rule CptnComp)\n apply(erule CondF,simp)\n--{* Seq1 *}\napply(erule cptn.cases,simp_all)\n apply(rule CptnOne)\n apply clarify\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply(rule CptnEnv,simp)\napply clarify\napply(simp add:lift_def)\napply(rule conjI)\n apply clarify\n apply(rule CptnComp)\n apply(rule Seq1,simp)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\napply clarify\napply(rule CptnComp)\n apply(rule Seq2,simp)\napply(drule_tac P=P1 in lift_is_cptn)\napply(simp add:lift_def)\n--{* Seq2 *}\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: split_if_asm)\napply(frule_tac P=P1 in last_lift)\n apply(rule last_fst_esp)\n apply (simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\n--{* While1 *}\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(drule_tac P=\"While b P\" in lift_is_cptn)\napply(simp add:lift_def)\n--{* While2 *}\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=\"While b P\" in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: split_if_asm)\napply(frule_tac P=\"While b P\" in last_lift)\n apply(rule last_fst_esp,simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\ndone\n\ntheorem cptn_iff_cptn_mod: \"(c \\ cptn) = (c \\ cptn_mod)\"\napply(rule iffI)\n apply(erule cptn_onlyif_cptn_mod)\napply(erule cptn_if_cptn_mod)\ndone\n\nsection {* Validity of Correctness Formulas*}\n\nsubsection {* Validity for Component Programs. *}\n\ntype_synonym 'a rgformula =\n \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set\"\n\ndefinition assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a confs) set\" where\n \"assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -e\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a confs) set\" where\n \"comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -c\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (fst (last c) = None \\ snd (last c) \\ post)}\"\n\ndefinition com_validity :: \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set \\ bool\" \n (\"\\ _ sat [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ P sat [pre, rely, guar, post] \\ \n \\s. cp (Some P) s \\ assum(pre, rely) \\ comm(guar, post)\"\n\nsubsection {* Validity for Parallel Programs. *}\n\ndefinition All_None :: \"(('a com) option) list \\ bool\" where\n \"All_None xs \\ \\c\\set xs. c=None\"\n\ndefinition par_assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a par_confs) set\" where\n \"par_assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -pe\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition par_comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a par_confs) set\" where\n \"par_comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -pc\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (All_None (fst (last c)) \\ snd( last c) \\ post)}\"\n\ndefinition par_com_validity :: \"'a par_com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \n\\ 'a set \\ bool\" (\"\\ _ SAT [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ Ps SAT [pre, rely, guar, post] \\ \n \\s. par_cp Ps s \\ par_assum(pre, rely) \\ par_comm(guar, post)\"\n\nsubsection {* Compositionality of the Semantics *}\n\nsubsubsection {* Definition of the conjoin operator *}\n\ndefinition same_length :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"same_length c clist \\ (\\i ('a confs) list \\ bool\" where\n \"same_state c clist \\ (\\i j ('a confs) list \\ bool\" where\n \"same_program c clist \\ (\\jx. fst(nth x j)) clist)\"\n\ndefinition compat_label :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"compat_label c clist \\ (\\j. Suc j \n (c!j -pc\\ c!Suc j \\ (\\i (clist!i)! Suc j \\ \n (\\li \\ (clist!l)!j -e\\ (clist!l)! Suc j))) \\ \n (c!j -pe\\ c!Suc j \\ (\\i (clist!i)! Suc j)))\"\n\ndefinition conjoin :: \"'a par_confs \\ ('a confs) list \\ bool\" (\"_ \\ _\" [65,65] 64) where\n \"c \\ clist \\ (same_length c clist) \\ (same_state c clist) \\ (same_program c clist) \\ (compat_label c clist)\"\n\nsubsubsection {* Some previous lemmas *}\n\nlemma list_eq_if [rule_format]: \n \"\\ys. xs=ys \\ (length xs = length ys) \\ (\\i (\\i ys!0=a; ys\\[] \\ \\ ys=(a#(tl ys))\"\n by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\[] \\ ys!0=a \\ P ys \\ P (a#(tl ys))\"\n by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) \\ P ys\"\n by (induct ys) simp_all\n\nlemma seq_not_eq1: \"Seq c1 c2\\c1\"\n by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\c2\"\n by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\c1\"\n by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\c2\"\n by (induct c2) auto\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\n\nlemma prog_not_eq_in_ctran_aux:\n assumes c: \"(P,s) -c\\ (Q,t)\"\n shows \"P\\Q\" using c\n by (induct x1 \\ \"(P,s)\" x2 \\ \"(Q,t)\" arbitrary: P s Q t) auto\n\nlemma prog_not_eq_in_ctran [simp]: \"\\ (P,s) -c\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_ctran_aux)\napply simp\ndone\n\nlemma prog_not_eq_in_par_ctran_aux [rule_format]: \"(P,s) -pc\\ (Q,t) \\ (P\\Q)\"\napply(erule par_ctran.induct)\napply(drule prog_not_eq_in_ctran_aux)\napply clarify\napply(drule list_eq_if)\n apply simp_all\napply force\ndone\n\nlemma prog_not_eq_in_par_ctran [simp]: \"\\ (P,s) -pc\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_par_ctran_aux)\napply simp\ndone\n\nlemma tl_in_cptn: \"\\ a#xs \\cptn; xs\\[] \\ \\ xs\\cptn\"\n by (force elim: cptn.cases)\n\nlemma tl_zero[rule_format]: \n \"P (ys!Suc j) \\ Suc j ys\\[] \\ P (tl(ys)!j)\"\n by (induct ys) simp_all\n\nsubsection {* The Semantics is Compositional *}\n\nlemma aux_if [rule_format]: \n \"\\xs s clist. (length clist = length xs \\ (\\i cptn) \n \\ ((xs, s)#ys \\ map (\\i. (fst i,s)#snd i) (zip xs clist)) \n \\ (xs, s)#ys \\ par_cptn)\"\napply(induct ys)\n apply(clarify)\n apply(rule ParCptnOne)\napply(clarify)\napply(simp add:conjoin_def compat_label_def)\napply clarify\napply(erule_tac x=\"0\" and P=\"\\j. ?H j \\ (?P j \\ ?Q j)\" in all_dupE,simp)\napply(erule disjE)\n--{* first step is a Component step *}\n apply clarify \n apply simp\n apply(subgoal_tac \"a=(xs[i:=(fst(clist!i!0))])\")\n apply(subgoal_tac \"b=snd(clist!i!0)\",simp)\n prefer 2\n apply(simp add: same_state_def)\n apply(erule_tac x=i in allE,erule impE,assumption, \n erule_tac x=1 and P=\"\\j. (?H j) \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n prefer 2\n apply(simp add:same_program_def)\n apply(erule_tac x=1 and P=\"\\j. ?H j \\ (fst (?s j))=(?t j)\" in allE,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(rule ParCptnComp)\n apply(erule ParComp,simp)\n--{* applying the induction hypothesis *}\n apply(erule_tac x=\"xs[i := fst (clist ! i ! 0)]\" in allE)\n apply(erule_tac x=\"snd (clist ! i ! 0)\" in allE)\n apply(erule mp)\n apply(rule_tac x=\"map tl clist\" in exI,simp)\n apply(rule conjI,clarify)\n apply(case_tac \"i=ia\",simp)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply simp\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_state_def)\n apply(erule_tac x=ia in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_length_def same_state_def)\n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. ?H j \\ (fst (?s j))=(?t j)\" in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\n apply(rule allI,rule impI)\n apply(erule_tac x=\"Suc j\" and P=\"\\j. ?H j \\ (?I j \\ ?J j)\" in allE,simp)\n apply(erule disjE) \n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(case_tac \"i=ia\",simp)\n apply(rule conjI)\n apply(force simp add: length_Suc_conv)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE,erule impE,assumption)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE,erule impE,assumption)\n apply simp\n apply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=l in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. (?H j) \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply force\n apply simp\n apply(rule tl_zero)\n apply(erule tl_zero)\n apply force\n apply force\n apply force\n apply force\n apply(rule conjI,simp)\n apply(rule nth_tl_if)\n apply force\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule tl_zero)\n apply force\n apply force\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply simp\n apply(erule_tac P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE,erule impE,assumption,erule impE,assumption)\n apply(erule tl_zero,force)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE,erule impE, assumption,simp)\n apply(erule etranE,simp)\n apply(rule tl_zero)\n apply force\n apply force\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply(rule disjI2)\n apply(case_tac j,simp)\n apply clarify\n apply(rule tl_zero)\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ ?I j\\etran\" in allE,erule impE, assumption)\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE,erule impE, assumption,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply simp\n apply clarify\n apply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n--{* first step is an environmental step *}\napply clarify\napply(erule par_etran.cases)\napply simp\napply(rule ParCptnEnv)\napply(erule_tac x=\"Ps\" in allE)\napply(erule_tac x=\"t\" in allE)\napply(erule mp)\napply(rule_tac x=\"map tl clist\" in exI,simp)\napply(rule conjI)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (?I ?s j) \\ cptn\" in allE,simp)\n apply(erule cptn.cases)\n apply(simp add:same_length_def)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply(simp add:same_state_def)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ ?J j \\etran\" in allE,simp)\n apply(erule etranE,simp)\napply(simp add:same_state_def same_length_def)\napply(rule conjI,clarify)\n apply(case_tac j,simp,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(rule tl_zero)\n apply(simp)\n apply force\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply simp\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. ?H j \\ (fst (?s j))=(?t j)\" in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\napply(rule allI,rule impI)\napply(erule_tac x=\"Suc j\" and P=\"\\j. ?H j \\ (?I j \\ ?J j)\" in allE,simp)\napply(erule disjE) \n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\i. ?H i \\ ?J i \\etran\" in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. (?H j) \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply simp\n apply(erule tl_zero,force) \n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply clarify\n apply(erule_tac x=l and P=\"\\i. ?H i \\ ?J i \\etran\" in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. (?H j) \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply simp\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\napply(rule disjI2)\napply simp\napply clarify\napply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=i and P=\"\\i. ?H i \\ ?J i \\etran\" in allE, erule impE, assumption)\n apply(erule_tac x=i and P=\"\\i. ?H i \\ ?J i \\etran\" in allE, erule impE, assumption)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\napply simp\napply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply force\napply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\ndone\n\nlemma aux_onlyif [rule_format]: \"\\xs s. (xs, s)#ys \\ par_cptn \\ \n (\\clist. (length clist = length xs) \\ \n (xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist) \\ \n (\\i cptn))\"\napply(induct ys)\n apply(clarify)\n apply(rule_tac x=\"map (\\i. []) [0..j. (P!j, t)#(clist!j)) [0..j. (Ps!j, ta)#(clist!j)) [0..j. ?H j \\ (?I j \\ cptn)\" in allE,simp)\n apply simp\n apply(erule_tac x=ia in allE)\n apply(rule CptnEnv,simp)\napply(simp add:conjoin_def)\napply (rule conjI)\n apply(simp add:same_length_def)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(case_tac j, simp, simp (no_asm_simp))\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp,simp)\n apply simp\n apply(rule nth_equalityI,simp,simp)\n apply(erule_tac x=nat and P=\"\\j. ?H j \\ (fst (?a j))=((?b j))\" in allE)\n apply(case_tac nat)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(simp add:compat_label_def)\napply clarify\napply(case_tac j)\n apply(rule conjI,simp)\n apply(erule ParComp,assumption)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply clarify\n apply(rule Env)\napply simp\napply(erule_tac x=nat and P=\"\\j. ?H j \\ (?P j \\ ?Q j)\" in allE,simp)\napply(erule disjE)\n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(rule conjI)\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(case_tac \"l=ia\",simp,simp)\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply simp\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\napply clarify\napply(erule_tac x=ia and P=\"\\j. ?H j \\ (?P j)\\etran\" in allE, erule impE, assumption)\napply(case_tac \"i=ia\",simp,simp)\ndone\n\nlemma one_iff_aux: \"xs\\[] \\ (\\ys. ((xs, s)#ys \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist)) \\ \n (\\i cptn))) = \n (par_cp (xs) s = {c. \\clist. (length clist)=(length xs) \\\n (\\i cp(xs!i) s) \\ c \\ clist})\" \napply (rule iffI)\n apply(rule subset_antisym)\n apply(rule subsetI) \n apply(clarify)\n apply(simp add:par_cp_def cp_def)\n apply(case_tac x)\n apply(force elim:par_cptn.cases)\n apply simp\n apply(rename_tac a list)\n apply(erule_tac x=\"list\" in allE)\n apply clarify\n apply simp\n apply(rule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in exI,simp)\n apply(rule subsetI) \n apply(clarify)\n apply(case_tac x)\n apply(erule_tac x=0 in allE)\n apply(simp add:cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule cptn.cases,force,force,force)\n apply(simp add:par_cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule_tac x=0 and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in all_dupE)\n apply(subgoal_tac \"a = xs\")\n apply(subgoal_tac \"b = s\",simp)\n prefer 3\n apply(erule_tac x=0 and P=\"\\j. ?H j \\ (fst (?s j))=((?t j))\" in allE)\n apply (simp add:cp_def)\n apply(rule nth_equalityI,simp,simp)\n prefer 2\n apply(erule_tac x=0 in allE)\n apply (simp add:cp_def)\n apply(erule_tac x=0 and P=\"\\j. ?H j \\ (\\i. ?T i \\ (snd (?d j i))=(snd (?e j i)))\" in allE,simp)\n apply(erule_tac x=0 and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(erule_tac x=list in allE)\n apply(rule_tac x=\"map tl clist\" in exI,simp) \n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"0\" and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc nat\" and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply clarify\n apply simp\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(thin_tac \"?H = (\\i. ?J i)\")\n apply(rule conjI)\n apply clarify\n apply(erule_tac x=j in allE,erule impE, assumption,erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(case_tac j,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l in allE)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply clarify\n apply(simp add:cp_def)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply simp\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp)\n apply(rule nth_tl_if,simp,simp)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (?P j)\\etran\" in allE, erule impE, assumption,simp)\n apply(simp add:cp_def)\n apply clarify\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply force\n apply force\napply clarify\napply(rule iffI)\n apply(simp add:par_cp_def)\n apply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply simp\n apply clarify\n apply(rule_tac x=\"map tl clist\" in exI)\n apply simp\n apply (rule conjI)\n apply(simp add:conjoin_def cp_def)\n apply(rule conjI)\n apply clarify\n apply(unfold same_length_def)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,simp)\n apply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=j and P=\"\\j. ?H j \\ (snd (?d j))=(snd (?e j))\" in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j,simp)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(simp add:compat_label_def)\n apply(rule allI,rule impI)\n apply(erule_tac x=j in allE,erule impE, assumption)\n apply(erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. ?H j \\ ?I j \\ ?J j\" in allE)\n apply(erule_tac x=l and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply(erule_tac x=l in allE,simp)\n apply(rule disjI2)\n apply clarify\n apply(rule tl_zero)\n apply(case_tac j,simp,simp)\n apply(rule tl_zero,force) \n apply force\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. ?H j \\ (length (?s j) = ?t)\" in allE,force)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(rule nth_tl_if)\n apply(simp add:conjoin_def)\n apply clarify\n apply(simp add:same_length_def)\n apply(erule_tac x=i in allE,simp)\n apply simp\n apply simp\n apply simp\napply clarify\napply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply(simp add:par_cp_def)\napply simp\napply(erule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in allE)\napply simp\napply clarify\napply(simp add:cp_def)\ndone\n\ntheorem one: \"xs\\[] \\ \n par_cp xs s = {c. \\clist. (length clist)=(length xs) \\ \n (\\i cp(xs!i) s) \\ c \\ clist}\"\napply(frule one_iff_aux)\napply(drule sym)\napply(erule iffD2)\napply clarify\napply(rule iffI)\n apply(erule aux_onlyif)\napply clarify\napply(force intro:aux_if)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Hoare_Parallel/RG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647394, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29864834953247343}} {"text": "(* Title: HOL/MicroJava/BV/JVM.thy\n\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nheader {* \\isaheader{LBV for the JVM}\\label{sec:JVM} *}\n\ntheory LBVJVM\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\ mname \\ ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"jvm_prog \\ nat \\ nat \\ nat \\ ty\\<^sub>i' err list \\ bool\"\nwhere\n \"check_cert P mxs mxl n cert \\ check_types P mxs mxl cert \\ size cert = n+1 \\\n (\\i Err) \\ cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\ nat \\ nat \\ ty \\ ex_table \\ \n ty\\<^sub>i' err list \\ instr list \\ ty\\<^sub>i' err \\ ty\\<^sub>i' err\"\nwhere\n \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\\n wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\ cname \\ ty list \\ ty \\ nat \\ nat \\ \n ex_table \\ ty\\<^sub>i' err list \\ instr list \\ bool\"\nwhere\n \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\\n check_cert P mxs (1+size Ts+mxl\\<^sub>0) (size ins) cert \\\n 0 < size ins \\ \n (let start = Some ([],(OK (Class C))#((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n result = lbvjvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n in result \\ Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\ prog_cert \\ bool\"\nwhere\n \"wt_jvm_prog_lbv P cert \\\n wf_prog (\\P C (mn,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,b,et)). wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) b) P\"\n\ndefinition mk_cert :: \"jvm_prog \\ nat \\ ty \\ ex_table \\ instr list \n \\ ty\\<^sub>m \\ ty\\<^sub>i' err list\"\nwhere\n \"mk_cert P mxs T\\<^sub>r et bs phi \\ make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\ ty\\<^sub>P \\ prog_cert\"\nwhere\n \"prg_cert P phi C mn \\ let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)) = method P C mn\n in mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n \nlemma check_certD [intro?]:\n \"check_cert P mxs mxl n cert \\ cert_ok cert n Err (OK None) (states P mxs mxl)\"\n by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n shows \"\\\\s \\ list (size is) A. wt_step r Err step \\s \\ OK first \\\\<^sub>r \\s!0\"\n(*<*)\nproof -\n from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n moreover have \"Err \\ A\" by (simp add: JVM_states_unfold)\n moreover have \"bottom r (OK None)\" \n by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n moreover have \"OK None \\ A\" by (simp add: JVM_states_unfold)\n moreover note bounded_step\n moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n by (unfold wt_lbv_def) (auto dest: check_certD)\n moreover note exec_pres_type\n moreover\n from lbv \n have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\ Err\"\n by (simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric]) \n moreover note first_in_A\n moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n shows \"\\\\s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n(*<*)\nproof -\n from lbv have l: \"is \\ []\" by (simp add: wt_lbv_def)\n moreover\n from wf lbv C Ts obtain \\s where \n list: \"\\s \\ list (size is) A\" and\n step: \"wt_step r Err step \\s\" and \n start: \"OK first \\\\<^sub>r \\s!0\" \n by (blast dest: wt_lbv_wt_step)\n from list have [simp]: \"size \\s = size is\" by simp\n have \"size (map ok_val \\s) = size is\" by simp \n moreover from l have 0: \"0 < size \\s\" by simp\n with step obtain \\s0 where \"\\s!0 = OK \\s0\"\n by (unfold wt_step_def) blast\n with start 0 have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\s)\"\n by (simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def) \n moreover {\n from list have \"check_types P mxs mxl \\s\" by (simp add: check_types_def)\n also from step have \"\\x \\ set \\s. x \\ Err\" \n by (auto simp add: all_set_conv_all_nth wt_step_def) \n hence [symmetric]: \"map OK (map ok_val \\s) = \\s\"\n by (auto intro!: map_idI)\n finally have \"check_types P mxs mxl (map OK (map ok_val \\s))\" .\n }\n moreover { \n note bounded_step\n moreover from list have \"set \\s \\ A\" by simp\n moreover from step have \"wt_err_step (sup_state_opt P) step \\s\"\n by (simp add: wt_err_step_def JVM_le_Err_conv)\n ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\s)\"\n by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n } \n ultimately have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\s)\"\n by (simp add: wt_method_def2 check_types_def del: map_map)\n thus ?thesis ..\nqed\n(*>*)\n\n \nlemma (in start_context) wt_method_wt_lbv:\n assumes wt: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\" \n defines [simp]: \"cert \\ mk_cert P mxs T\\<^sub>r xt is \\s\"\n \n shows \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n let ?\\s = \"map OK \\s\"\n let ?cert = \"make_cert step ?\\s (OK None)\"\n\n from wt obtain \n 0: \"0 < size is\" and\n size: \"size is = size ?\\s\" and\n ck_types: \"check_types P mxs mxl ?\\s\" and\n wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\s\" and\n app_eff: \"wt_app_eff (sup_state_opt P) app eff \\s\"\n by (force simp add: wt_method_def2 check_types_def) \n \n from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n moreover have \"Err \\ A\" by (simp add: JVM_states_unfold)\n moreover have \"bottom r (OK None)\" \n by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n moreover have \"OK None \\ A\" by (simp add: JVM_states_unfold)\n moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n hence \"mono r step (size ?\\s) A\" by (simp add: size)\n moreover from exec_pres_type \n have \"pres_type step (size ?\\s) A\" by (simp add: size) \n moreover\n from ck_types have \\s_in_A: \"set ?\\s \\ A\" by (simp add: check_types_def)\n hence \"\\pc. pc < size ?\\s \\ ?\\s!pc \\ A \\ ?\\s!pc \\ Err\" by auto\n moreover from bounded_step \n have \"bounded step (size ?\\s)\" by (simp add: size)\n moreover have \"OK None \\ Err\" by simp\n moreover from bounded_step size \\s_in_A app_eff\n have \"wt_err_step (sup_state_opt P) step ?\\s\"\n by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def) \n hence \"wt_step r Err step ?\\s\"\n by (simp add: wt_err_step_def JVM_le_Err_conv)\n moreover\n from 0 size have \"0 < size \\s\" by auto\n hence \"?\\s!0 = OK (\\s!0)\" by simp\n with wt_start have \"OK first \\\\<^sub>r ?\\s!0\"\n by (clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n moreover note first_in_A\n moreover have \"OK first \\ Err\" by simp\n moreover note size \n ultimately\n have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\ Err\"\n by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n moreover from 0 size have \"\\s \\ []\" by auto\n moreover from ck_types have \"check_types P mxs mxl ?cert\"\n by (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n moreover note 0 size\n ultimately show ?thesis \n by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n check_cert_def make_cert_def nth_append)\nqed \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n \"wt_jvm_prog_lbv P Cert \\ wf_jvm_prog P\"\n(*<*)\nproof - \n let ?\\ = \"\\C mn. let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C mn in \n SOME \\s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n \n assume wt: \"wt_jvm_prog_lbv P Cert\"\n hence \"wf_jvm_prog\\<^bsub>?\\\\<^esub> P\"\n apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) \n apply (erule wf_prog_lift)\n apply (auto dest!: start_context.wt_lbv_wt_method [OF start_context.intro] \n intro: someI)\n apply (erule sees_method_is_class)\n done\n thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n assumes wt: \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\" \n shows \"wt_jvm_prog_lbv P (prg_cert P \\)\"\n(*<*)\n using wt\n apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)\n apply (erule wf_prog_lift)\n apply (auto simp add: prg_cert_def \n intro!: start_context.wt_method_wt_lbv start_context.intro)\n apply (erule sees_method_is_class) \n done\n(*>*)\n\nend \n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.29864584808453953}} {"text": "theory IOTickTock_Prefix\n imports IOTickTock_Core\nbegin\n\ndefinition PrefixIOTT :: \"'e \\ 'e set \\ 'e ttprocess \\ 'e ttprocess\" (infixr \"\\\\<^sub>C\\<^bsup>_\\<^esup>\" 61) where\n \"PrefixIOTT e Outs P = \n {t. \\ s\\tocks({x. x \\ Tock \\ x \\ Event e}). e \\ Outs \\ (t = s \\ (\\ X. Tock \\ X \\ Event e \\ X \\ t = s @ [[X]\\<^sub>R]))}\n \\ {t. \\ s\\tocks({x. x \\ Tock \\ x \\ Event e}). e \\ Outs \\ (t = s \\ (\\ \\\\P. t = s @ [[Event e]\\<^sub>E] @ \\))}\n \\ {t. ((\\ \\\\P. t = [[Event e]\\<^sub>E] @ \\) \\ t = []) \\ e \\ Outs}\"\n\nlemma PrefixIOTT_input_eq_PrefixTT:\n \"e \\ Outs \\ (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P) = (e \\\\<^sub>C P)\"\n unfolding PrefixTT_def PrefixIOTT_def by auto\n\nlemma \"\\x\\P. ttWF x \\ \\ x \\ e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P. ttWF x\"\nproof (cases \"e \\ Outs\")\n assume \"e \\ Outs\"\n then show \"\\x\\P. ttWF x \\ \\x\\e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P. ttWF x\"\n unfolding PrefixIOTT_def by auto\nnext\n assume \"e \\ Outs\"\n then show \"\\x\\P. ttWF x \\ \\x\\e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P. ttWF x\"\n by (simp add: PrefixIOTT_input_eq_PrefixTT PrefixTT_wf)\nqed\n\nlemma TT0_PrefixIOTT:\n \"TT0 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\nproof (cases \"e \\ Outs\")\n assume \"e \\ Outs\"\n then show \"TT0 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n unfolding PrefixIOTT_def TT0_def by auto\nnext\n assume \"e \\ Outs\"\n then show \"TT0 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n using PrefixIOTT_input_eq_PrefixTT PrefixTT_def TT0_def tocks.empty_in_tocks by fastforce\nqed\n\nlemma TT1_PrefixIOTT:\n \"TT1 P \\ TT1 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\nproof (cases \"e \\ Outs\")\n assume \"e \\ Outs\"\n then show \"TT1 P \\ TT1 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n unfolding PrefixIOTT_def TT1_def apply auto\n apply (metis add_Tick_refusal_trace.cases tt_prefix_subset.simps(3) tt_prefix_subset.simps(5))\n using tt_prefix_subset.elims(2) by blast\nnext\n assume \"e \\ Outs\"\n then show \"TT1 P \\ TT1 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n by (simp add: PrefixIOTT_input_eq_PrefixTT TT1_Prefix)\nqed\n\nlemma TT2_PrefixIOTT:\n assumes \"TT0 P\" \"TT1 P\" \"TT2 P\"\n shows \"TT2 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\nproof (cases \"e \\ Outs\")\n assume \"e \\ Outs\"\n then show \"TT2 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n unfolding PrefixIOTT_def TT2_def\n proof auto\n fix \\ \\ X Y \\'\n assume case_assms: \"Y \\ {ea. ea \\ Tock \\ (\\\\\\P. \\ @ [[ea]\\<^sub>E] = [Event e]\\<^sub>E # \\) \n \\ ea = Tock \\ (\\\\\\P. \\ @ [[X]\\<^sub>R, [ea]\\<^sub>E] = [Event e]\\<^sub>E # \\)} = {}\"\n \"\\' \\ P\" \"\\ @ [X]\\<^sub>R # \\ = [Event e]\\<^sub>E # \\'\"\n obtain \\' where \\'_def: \"\\ = [Event e]\\<^sub>E # \\'\"\n using case_assms(3) by (induct \\ rule:ttWF.induct, auto)\n have \"\\' @ [X \\ Y]\\<^sub>R # \\ \\ P\"\n using \\'_def case_assms assms unfolding TT2_def by auto\n then show \"\\\\'\\P. \\ @ [X \\ Y]\\<^sub>R # \\ = [Event e]\\<^sub>E # \\'\"\n by (simp add: \\'_def)\n qed\nnext\n assume \"e \\ Outs\"\n then show \"TT2 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n using assms by (simp add: PrefixIOTT_input_eq_PrefixTT TT2_Prefix)\nqed\n\nlemma TT3_PrefixIOTT:\n assumes \"TT1 P\" \"TT3 P\"\n shows \"TT3 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\nproof (cases \"e \\ Outs\")\n assume \"e \\ Outs\"\n then show \"TT3 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n unfolding PrefixIOTT_def TT3_def \n proof auto\n fix \\ \\ X \\'\n assume case_assms: \"e \\ Outs\" \"\\' \\ P\" \"\\ @ [X]\\<^sub>R # \\ = [Event e]\\<^sub>E # \\'\"\n obtain \\' where \\'_def: \"\\ = [Event e]\\<^sub>E # \\'\"\n using case_assms(3) by (induct \\ rule:ttWF.induct, auto)\n have \"\\' @ [insert Tick X]\\<^sub>R # \\ \\ P\"\n using \\'_def case_assms assms unfolding TT3_def by auto\n then show \"\\\\'\\P. \\ @ [insert Tick X]\\<^sub>R # \\ = [Event e]\\<^sub>E # \\'\"\n by (simp add: \\'_def)\n qed\nnext\n assume \"e \\ Outs\"\n then show \"TT3 (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n by (simp add: PrefixIOTT_input_eq_PrefixTT TT3_Prefix assms)\nqed\n\nlemma IOTT0_PrefixIOTT:\n \"IOTT0 Outs P \\ IOTT0 Outs (e \\\\<^sub>C\\<^bsup>Outs\\<^esup> P)\"\n unfolding IOTT0_def PrefixIOTT_def\nproof auto\n fix s\n assume case_assms: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\" \"e \\ Outs\"\n then have \"IOTT0_trace Outs s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n apply - apply (induct s rule:tocks.induct, auto)\n using tocks.empty_in_tocks apply blast\n using tocks.simps by fastforce\n then show \"\\sa\\tocks {x. x \\ Tock \\ x \\ Event e}.\n IOTT0_trace Outs s \\ sa \\ (\\\\\\P. IOTT0_trace Outs s \\ sa @ [Event e]\\<^sub>E # \\) \\\n \\sa\\tocks {x. x \\ Tock \\ x \\ Event e}. \\X. Tock \\ X \\ Event e \\ X \\ IOTT0_trace Outs s = sa @ [[X]\\<^sub>R]\"\n by auto\nnext\n fix s X\n assume case_assms: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\" \"e \\ Outs\" \"Tock \\ X\" \"Event e \\ X\"\n then have \"IOTT0_trace Outs s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n apply - apply (induct s rule:tocks.induct, auto)\n using tocks.empty_in_tocks apply blast\n using tocks.simps by fastforce\n then show \"\\sa\\tocks {x. x \\ Tock \\ x \\ Event e}.\n \\Xa. Tock \\ Xa \\ Event e \\ Xa \\ IOTT0_trace Outs (s @ [[X]\\<^sub>R]) = sa @ [[Xa]\\<^sub>R]\"\n apply (rule_tac x=\"IOTT0_trace Outs s\" in bexI, simp_all)\n by (rule_tac x=\"X \\ Event ` Outs\" in exI, auto simp add: case_assms IOTT0_trace_append_refusal)\nnext\n fix s\n assume case_assms: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\" \"e \\ Outs\"\n then have \"IOTT0_trace Outs s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n apply - apply (induct s rule:tocks.induct, auto)\n using tocks.empty_in_tocks apply blast\n using tocks.simps by fastforce\n then show \"\\sa\\tocks {x. x \\ Tock \\ x \\ Event e}.\n IOTT0_trace Outs s \\ sa \\ (\\\\\\P. IOTT0_trace Outs s \\ sa @ [Event e]\\<^sub>E # \\) \\\n \\sa\\tocks {x. x \\ Tock \\ x \\ Event e}. \\X. Tock \\ X \\ Event e \\ X \\ IOTT0_trace Outs s = sa @ [[X]\\<^sub>R]\"\n by auto\nnext\n fix s \\\n assume case_assms: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\" \"e \\ Outs\" \"\\ \\ P\" \n \"\\x. x \\ P \\ IOTT0_trace Outs x \\ P\" \n then have \"IOTT0_trace Outs s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n apply - apply (induct s rule:tocks.induct, auto)\n using tocks.empty_in_tocks apply blast\n using tocks.simps by fastforce\n also have \"IOTT0_trace Outs \\ \\ P\"\n using case_assms(3) case_assms(4) by blast\n then show \"\\sa\\tocks {x. x \\ Tock \\ x \\ Event e}. IOTT0_trace Outs (s @ [Event e]\\<^sub>E # \\) \\ sa \\\n (\\\\'\\P. IOTT0_trace Outs (s @ [Event e]\\<^sub>E # \\) \\ sa @ [Event e]\\<^sub>E # \\') \\\n \\sa\\tocks {x. x \\ Tock \\ x \\ Event e}.\n \\X. Tock \\ X \\ Event e \\ X \\ IOTT0_trace Outs (s @ [Event e]\\<^sub>E # \\) = sa @ [[X]\\<^sub>R]\"\n using calculation apply (erule_tac x=\"IOTT0_trace Outs s\" in ballE, auto)\n by (erule_tac x=\"IOTT0_trace Outs \\\" in ballE, auto simp add: IOTT0_trace_append)\nqed\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/IOTickTock/IOTickTock_Prefix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.29864584808453953}} {"text": "section {* Constant Time (inductive) *}\n\ntheory Wasm_Constant_Time_Ind imports Wasm_Secret begin\n\ndefinition config_actions :: \"[s, v list, e list, nat, action list] \\ bool\" (\"p'_actions \\_;_;_\\ _ _\" 60) where\n \"config_actions s vs es i as \\ (\\s' vs' es'. \\s;vs;es\\ as^^\\_i \\s';vs';es'\\)\"\n\ndefinition config_trace_set_ind :: \"[(s \\ v list \\ e list), nat] \\ (action list) set\" where\n \"config_trace_set_ind \\ \\(s,vs,es) i. Collect (config_actions s vs es i)\"\n\nlemma config_actions_indistinguishable_secrets_ind:\n assumes \"(p_actions \\s;vs;es\\ i as)\"\n \"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"\\as'. (p_actions \\s';vs';es'\\ i as') \\ list_all2 action_indistinguishable as as'\"\n using assms(1,3) config_indistinguishable_trace_noninterference[OF _ assms(2)]\n config_indistinguishable_imp_config_typing[OF _ assms(2)]\n unfolding config_actions_def\n by blast\n\nlemma config_actions_indistinguishable_secrets_abs_ind:\n assumes \"(p_actions \\s;vs;es\\ i as)\"\n \"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"\\as'. (p_actions \\s';vs';es'\\ i as') \\ ($\\ as) = ($\\ as')\"\n using Quotient3_observation config_actions_indistinguishable_secrets_ind[OF assms]\n unfolding Quotient3_def\n by metis\n\nlemma config_trace_set_ind_indistinguishable_secrets_ind:\n assumes \"as \\ (config_trace_set_ind (s,vs,es) i)\"\n \"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"\\as' \\ (config_trace_set_ind (s',vs',es') i). list_all2 action_indistinguishable as as'\"\nproof -\n have \"(p_actions \\s;vs;es\\ i as)\"\n using assms(1)\n unfolding config_trace_set_ind_def\n by fastforce\n then obtain as' where \"(p_actions \\s';vs';es'\\ i as') \\ list_all2 action_indistinguishable as as'\"\n using config_actions_indistinguishable_secrets_ind[OF _ assms(2,3)]\n by fastforce\n thus ?thesis\n unfolding config_trace_set_ind_def\n by fastforce\nqed\n\nlemma config_actions_indistinguishable_secrets_abs_set_ind:\n assumes \"t \\ (image abs_obs (config_trace_set_ind (s,vs,es) i))\"\n \"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"t \\ (image abs_obs (config_trace_set_ind (s',vs',es') i))\"\nproof -\n obtain as where \"(p_actions \\s;vs;es\\ i as) \\ ($\\ as) = t\"\n using assms(1)\n unfolding config_trace_set_ind_def\n by fastforce\n then obtain as' where \"(p_actions \\s';vs';es'\\ i as') \\ ($\\ as') = t\"\n using config_actions_indistinguishable_secrets_abs_ind[OF _ assms(2)] assms(3)\n by fastforce\n thus ?thesis\n unfolding config_trace_set_ind_def\n by fastforce\nqed\n\nlemma config_actions_indistinguishable_secrets_abs_set_equiv_ind:\n assumes \"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"(image abs_obs (config_trace_set_ind (s,vs,es) i)) = (image abs_obs (config_trace_set_ind (s',vs',es') i))\"\n using config_actions_indistinguishable_secrets_abs_set_ind[OF _ assms(1,2)]\n config_indistinguishable_imp_config_typing[OF assms(2,1)]\n config_actions_indistinguishable_secrets_abs_set_ind[OF _ config_indistinguishable_symm[OF assms(1)]]\n by fastforce\n\nlift_definition config_obs_set_ind :: \"((s \\ v list \\ e list) \\ nat) \\ observation set\" is \"(\\(c,i). (config_trace_set_ind c i))\" .\n\nlift_definition config_untrusted_quot_obs_set_ind :: \"config_untrusted_quot \\ observation set\" is \"(\\c. config_obs_set_ind c)\"\nproof -\n fix prod1 prod2\n assume assms:\"prod1 \\_cp prod2\"\n show \"config_obs_set_ind prod1 = config_obs_set_ind prod2\"\n proof (cases prod1; cases prod2)\n fix c1 i1 c2 i2\n assume prod_assms:\"prod1 = (c1,i1)\" \"prod2 = (c2,i2)\"\n show ?thesis\n proof (cases c1; cases c2)\n fix s vs es s' vs' es'\n assume config_assms:\"c1 = (s,vs,es)\" \"c2 = (s',vs',es')\"\n obtain ts where ts_def:\"(s,vs,es) \\_c (s',vs',es')\"\n \"\\_i1 s;vs;es : (Untrusted,ts)\"\n \"i1 = i2\"\n using assms prod_assms config_assms\n unfolding config_untrusted_equiv_def\n by fastforce\n thus ?thesis\n using assms prod_assms config_assms config_actions_indistinguishable_secrets_abs_set_equiv_ind\n unfolding config_obs_set_ind_def\n by simp\n qed\n qed\nqed\n\ndefinition constant_time_ind :: \"((s \\ v list \\ e list) \\ nat) \\ bool\" where\n \"constant_time_ind = (\\(c, i). \\c'. (c \\_c c') \\ ((config_obs_set_ind (c,i)) = (config_obs_set_ind (c',i))))\"\n\ntheorem config_untrusted_constant_time_ind:\n assumes \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"constant_time_ind ((s,vs,es),i)\"\n using config_actions_indistinguishable_secrets_abs_set_equiv_ind assms\n unfolding constant_time_ind_def config_obs_set_ind_def\n by simp\n\nlift_definition config_untrusted_quot_constant_time_ind :: \"config_untrusted_quot \\ bool\" is constant_time_ind\nproof -\n fix prod1 prod2\n assume assms:\"prod1 \\_cp prod2\"\n show \"constant_time_ind prod1 = constant_time_ind prod2\"\n proof (cases prod1; cases prod2)\n fix c i c' i'\n assume local_assms:\"prod1 = (c,i)\" \"prod2 = (c',i')\"\n show ?thesis\n proof (cases c; cases c')\n fix s vs es s' vs' es'\n assume inner_assms:\"c = (s,vs,es)\" \"c' = (s',vs',es')\"\n thus ?thesis\n using assms local_assms config_untrusted_constant_time_ind\n unfolding config_untrusted_equiv_def\n by (simp del: config_indistinguishable.simps) (metis config_indistinguishable_imp_config_typing)\n qed\n qed\nqed\n \nlemma config_untrusted_quot_constant_time_trivial_ind:\n \"config_untrusted_quot_constant_time_ind = (\\x. True)\"\n using config_untrusted_constant_time_ind rep_config_untrusted_quot_typing\n unfolding config_untrusted_quot_constant_time_ind.rep_eq\n by (metis prod.exhaust)\n\ndefinition \"trace_set_equiv = rel_set (list_all2 action_indistinguishable)\"\n\ndefinition constant_time_traces_ind :: \"((s \\ v list \\ e list) \\ nat) \\ bool\" where\n \"constant_time_traces_ind = (\\(c, i). \\c'. (c \\_c c') \\ trace_set_equiv (config_trace_set_ind c i) (config_trace_set_ind c' i))\"\n\nlemma config_untrusted_constant_time_traces:\n assumes \"\\_i s;vs;es : (Untrusted,ts)\"\n shows \"constant_time_traces_ind ((s,vs,es),i)\"\n using assms\n unfolding trace_set_equiv_def rel_set_def constant_time_traces_ind_def\n apply (simp del: config_indistinguishable.simps)\n apply (metis config_indistinguishable_imp_config_typing config_indistinguishable_symm config_trace_set_ind_indistinguishable_secrets_ind observation.abs_eq_iff)\n done\nend", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/Wasm_Constant_Time_Ind.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2986340653246728}} {"text": "section \\Array-Blocks --- Reasoning Setup\\\ntheory Sep_Array_Block_RS\nimports \"../basic/LLVM_Basic_Main\" Sep_Block_Allocator_RS\nbegin\n\ntype_synonym 'aval ablock = \"nat \\ 'aval\"\n\ninstantiation baddr :: (this_addr) addr_algebra begin\n definition \"abase \\ \\BADDR i va \\ va=this_addr\"\n definition \"(~\\<^sub>a) \\ \\BADDR i1 va1 \\ \\BADDR i2 va2 \\ va1=this_addr \\ va2=this_addr\"\n definition \"(-\\<^sub>a) \\ \\BADDR i1 va1 \\ \\BADDR i2 va2 \\ i1 - i2\"\n definition \"(+\\<^sub>a) \\ \\BADDR i va \\ \\j. BADDR (i+j) va\"\n\n lemma abase_baddr_simp[simp]: \"abase (BADDR i va) \\ va=this_addr\"\n by (simp add: abase_baddr_def)\n lemma acompat_baddr_simp[simp]: \"BADDR i1 va1 ~\\<^sub>a BADDR i2 va2 \\ va1=this_addr \\ va2=this_addr\"\n by (simp add: acompat_baddr_def)\n lemma adiff_baddr_simp[simp]: \"BADDR i1 va1 -\\<^sub>a BADDR i2 va2 = i1 - i2\"\n by (simp add: adiff_baddr_def)\n lemma aidx_baddr_simp[simp]: \"BADDR i va +\\<^sub>a j = BADDR (i+j) va\"\n by (simp add: aidx_baddr_def)\n \n instance\n apply standard\n apply (intro part_equivpI sympI transpI)\n apply (auto \n simp: abase_baddr_def acompat_baddr_def adiff_baddr_def aidx_baddr_def\n split: baddr.splits)\n done\n\nend\n\n\nlocale array_block2 = array_block1 static_err mem_err vload vstore vgep\n for static_err :: 'err\n and mem_err :: 'err\n and vload :: \"'vaddr::this_addr \\ ('val,_,'val,'err) M\"\n and vstore :: \"'val \\ 'vaddr \\ (unit,_,'val,'err) M\"\n and vgep :: \"'vaddr \\ 'vidx \\ ('vaddr,_,'val,'err) M\"\n \n+ fixes \\v :: \"'val \\ 'aval::unique_zero_sep_algebra\"\n and vpto :: \"'val \\ 'vaddr \\ 'aval \\ bool\"\n and vcomplete :: \"'aval \\ bool\"\n \n assumes vload_rule: \"htriple \\v (vpto x va) (vload va) (\\r. \\(r=x) ** vpto x va)\" \n and vstore_rule: \"htriple \\v (vpto xx va) (vstore x va) (\\_. vpto x va)\"\n and vpto_notZ: \"\\x a. \\vpto x a 0\"\n and vcompleteD: \"\\v v'. \\vcomplete v; v##v'\\ \\ v'=0\"\n and vpto_this: \"\\v av. vpto v this_addr av \\ av = \\v v\"\n and \\v_complete: \"\\v. vcomplete (\\v v)\"\n \n \nbegin\n\n (*\n lemma is_arr_baddr_idx[simp]: \"is_arr_baddr (idx_baddr a i) \\ is_arr_baddr a\"\n by (auto simp: is_arr_baddr_def idx_baddr_def split: baddr.splits)\n \n lemma idx_baddr_add[simp]: \"idx_baddr (idx_baddr a i) j = idx_baddr a (i+j)\"\n by (auto simp: idx_baddr_def split: prod.splits baddr.splits)\n \n definition \"idx_ptr \\ \\RP_ADDR (ADDR bi ba) \\ \\i. RP_ADDR (ADDR bi (idx_baddr ba i)) | RP_NULL \\ \\i. RP_NULL\"\n *)\n \n (* TODO: Rename to is_block_ptr! *) \n definition is_block_ptr :: \"'vaddr baddr addr rptr \\ bool\" \n where \"is_block_ptr \\ \\RP_ADDR (ADDR bi ba) \\ ba=this_addr | _ \\ False\"\n \n \n (*definition \"is_arr_ptr \\ \\RP_ADDR (ADDR bi ba) \\ is_arr_baddr ba | _ \\ False\"*)\n \n (* \n lemma is_arr_ptr_simps[simp]:\n \"is_arr_ptr (RP_ADDR (ADDR bi ba)) = is_arr_baddr ba\" \n \"is_arr_ptr RP_NULL \\ False\"\n by (auto simp: is_arr_ptr_def)\n *)\n\n \n lemma is_block_ptr_simps[simp]:\n \"\\is_block_ptr RP_NULL\"\n \"is_block_ptr (RP_ADDR (ADDR bi ba)) \\ ba=this_addr\"\n by (auto simp: is_block_ptr_def)\n \n lemma block_ptr_imp_abase[simp, intro]: \"is_block_ptr p \\ abase p\" \n by (auto simp: is_block_ptr_def this_addr_baddr_def split: rptr.splits addr.splits)\n \n \n (*\n \n lemma idx_ptr_add[simp]: \"idx_ptr (idx_ptr a i) j = idx_ptr a (i+j)\"\n by (auto simp: idx_ptr_def split: rptr.splits addr.splits)\n \n lemma is_arr_ptr_idx[simp]: \"is_arr_ptr (idx_ptr p i) \\ is_arr_ptr p\"\n by (cases p) (auto simp: idx_ptr_def is_arr_ptr_def split: rptr.splits addr.splits)\n *) \n \n lemma \\v_notZ[simp]: \"\\v v \\ 0\" \n using vpto_notZ vpto_this by fastforce \n \n definition \"\\ \\ list\\ \\v\"\n\n definition pto :: \"'val \\ 'vaddr baddr \\ 'aval ablock \\ bool\"\n where \"pto \\ \\x. \\BADDR i va \\ \\s. \\v. i\\0 \\ s=0(nat i:=v) \\ vpto x va v\"\n \n definition tag_of :: \"'val block \\ int\" where \"tag_of \\ int o length\"\n \n definition \"is_complete_tag ablk n \\ 0\\n \\ (\\i. (ablk i \\ 0 \\ i (\\i. ablk i \\ 0 \\ vcomplete (ablk i)))\"\n \n \n definition \"array_lifter i \\ idx_lifter (\\_. ()) \\v i\"\n \n lemma array_lifter_simps[simp]: \n \"sep_lifter.\\s (array_lifter i) = \\v\" \n \"sep_lifter.\\b (array_lifter i) = \\\" \n \"sep_lifter.L (array_lifter i) = idx\\<^sub>L i\"\n unfolding array_lifter_def \\_def by auto\n \n interpretation array_lifter: sep_lifter \"array_lifter i\" for i\n unfolding array_lifter_def by simp\n\n lemma pto_is_lift: \"pto x = (\\BADDR i va \\ (\\(i\\0) ** array_lifter.lift_assn (nat i) (vpto x va)))\" \n unfolding array_lifter.lift_assn_def\n apply (rule ext)\n apply (clarsimp simp: array_lifter_def pto_def split: baddr.splits)\n apply (intro ext)\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n by (metis fun_upd_triv fun_upd_upd)\n \n lemma lift_is_pto: \"i\\0 \\ array_lifter.lift_assn (nat i) (vpto x va) = pto x (BADDR i va)\" \n by (simp add: pto_is_lift sep_algebra_simps pred_lift_extract_simps)\n \n declare vpto_notZ[simp] \n \n \n lemma load_rule: \"htriple \\ (pto x va) (load va) (\\r. \\(r=x) ** pto x va)\"\n unfolding load_def\n supply pto_is_lift[simp]\n apply (cases va; clarsimp simp: htriple_extract_pre_pure sep_algebra_simps)\n using array_lifter.lift_operation[simplified, OF _ vload_rule, simplified] \n .\n \n lemma store_rule: \"htriple \\ (pto xx va) (store x va) (\\_. pto x va)\"\n unfolding store_def\n supply pto_is_lift[simp]\n apply (cases va; clarsimp simp: htriple_extract_pre_pure sep_algebra_simps)\n using array_lifter.lift_operation[simplified, OF _ vstore_rule, simplified] \n .\n \n \n lemma load_pres_tag: \"wlp (load a) (\\_ s'. tag_of s' = tag_of s) s\"\n unfolding load_def \n apply (auto simp: wlp_def run_simps tag_of_def split: prod.splits option.splits baddr.splits)\n apply (rule mwp_trivI)\n by auto\n\n lemma store_pres_tag: \"wlp (store a x) (\\_ s'. tag_of s' = tag_of s) s\"\n unfolding store_def \n apply (auto simp: wlp_def run_simps tag_of_def split: prod.splits option.splits baddr.splits)\n apply (rule mwp_trivI)\n by auto\n \n lemma complete_tag: \n \"\\is_complete_tag ablock (tag_of cblock); ablock ## f; \\ cblock = ablock + f\\ \\ f = 0\" \n apply (auto simp: is_complete_tag_def tag_of_def)\n by (smt \\_def disjoint_zero_sym list\\_in_range sep_add_disj_eq sep_disj_fun_def sep_disj_zero unique_zero vcompleteD)\n \n (* TODO: Move *)\n lemma Z_upd_eq_Z_iff[simp]: \"0(i:=x) = 0 \\ x=0\" by (auto simp: fun_eq_iff)\n \n lemma pto_notZ: \"\\ pto x a 0\"\n apply (cases a)\n apply (auto simp: pto_def sep_algebra_simps)\n done\n \n lemma checked_idx_baddr_rule: \"abase a \n \\ htriple \\ (pto xx (a +\\<^sub>a i)) (checked_idx_baddr a i) (\\r. \\(r=a +\\<^sub>a i) ** pto xx (a +\\<^sub>a i))\"\n apply (rule htripleI')\n unfolding checked_idx_baddr_def check_addr_def pto_is_lift\n apply (clarsimp simp: pred_lift_extract_simps split: baddr.splits)\n apply (frule (1) array_lifter.infer_pre_get_with_frame, simp, simp)\n apply (force simp: wp_def run_simps aidx_baddr_def abase_baddr_def sep_algebra_simps split: prod.splits baddr.splits)\n done\n \n\n sublocale ba: block_allocator2 static_err mem_err load store check_addr \\ pto tag_of is_complete_tag\n apply unfold_locales\n apply (rule load_rule)\n apply (rule store_rule)\n apply (rule load_pres_tag)\n apply (rule store_pres_tag)\n apply (rule complete_tag; assumption)\n apply (rule pto_notZ)\n done\n \n \n lemma list\\_rep_nn: \"list\\ \\v (replicate n v) n = 0\"\n by (auto simp: list\\_def)\n \n \n lemma pto_this_exact: \"pto x (BADDR i this_addr) = (\\(i\\0) ** EXACT (0(nat i:=\\v x)))\" \n by (auto simp: pto_def vpto_this pred_lift_extract_simps del: ext intro!: ext)\n\n lemma ba_pto_this_exact: \n \"\\is_block_ptr p; i\\0\\ \n \\ ba.pto x (p +\\<^sub>a i) = EXACT (0(rptr_the_block_index p := (0(nat i:=\\v x),0)))\" \n apply (auto \n simp: ba.pto_def aidx_baddr_def pto_this_exact this_addr_baddr_def \n simp: pred_lift_extract_simps is_block_ptr_def\n split: rptr.splits addr.splits baddr.splits)\n done\n \n lemma lift_pto_exact: \"i\\0 \\ ba.block_lifter.lift_assn bi (pto v (this_addr +\\<^sub>a i)) = EXACT (0(bi := (0(nat i:=\\v v),0)))\" \n apply (auto \n simp: aidx_baddr_def pto_this_exact this_addr_baddr_def \n simp: pred_lift_extract_simps is_block_ptr_def\n split: rptr.splits addr.splits baddr.splits)\n done\n \n\n (* TODO: Move *) \n lemma atLeast_lessThan_plus1: \n \"l\\v \\ {l..<1+v::int} = insert v {l..v \\ {l..*i\\{0..*i\\{0.. (init v n)) p = (\\(is_block_ptr p) ** (\\*i\\{0..a i)))\"\n proof -\n have ba_block_alt_aux: \"(\\*i\\{0..v v), 0)))) = EXACT (0(x1 := (list\\ \\v (replicate n v), 0)))\"\n for x1::nat\n apply (induction n)\n supply replicate_Suc_conv_snoc[simp] replicate_Suc[simp del]\n subgoal by (auto simp: sep_algebra_simps del: ext intro!: ext)\n subgoal\n apply simp\n by (auto \n simp: list\\_snoc sep_algebra_simps sep_disj_fun_def atLeast0_lessThan_Suc atLeast_lessThan_plus1 sep_conj_def list\\_rep_nn\n cong del: if_cong \n del: ext intro!: ext)\n done\n \n have foo: \"\\P=Q; Q \\ X=Y\\ \\ (\\P**X) = (\\Q**Y)\" for P Q X Y by auto\n have [simp]: \"(\\*x\\{0..a x))))) \n = (\\*x\\{0..v v), 0))))\" for x1 \n apply (rule sep_set_img_cong)\n apply (auto simp: lift_pto_exact)\n done\n \n note [simp del] = ba.pto_addr_eq \n \n show ?thesis\n unfolding init_def ba.block_def\n by (auto \n split: rptr.splits addr.splits \n simp: sep_algebra_simps\n simp: \\_def ba_block_alt_aux \n intro!: foo\n )\n qed \n\n \n lemma ba_block_exs_alt_aux: \n assumes \"n\\0\"\n shows \"(\\*i\\{0..a i)))))) \n = (EXS xs. \\(int (length xs) = n) ** EXACT (0(bi := (list\\ \\v xs, 0))))\" \n using assms\n proof (induction n rule: int_induct[where k=0])\n case base\n then show ?case by (auto simp: sep_algebra_simps pred_lift_extract_simps del: ext intro!: ext)\n next\n case (step1 n)\n\n \n \n note [simp] = \\0\\n\\\n note IH = step1.IH[simplified]\n\n have [simp]: \"n+1\\0\" using \\0\\n\\ by linarith\n \n note replicate_Suc_conv_snoc[simp] replicate_Suc[simp del]\n show ?case\n apply (simp add: atLeast_lessThan_plus1)\n apply (simp add: IH)\n apply (rule ext)\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps sep_disj_fun_def sep_conj_def list\\_at_len lift_pto_exact)\n subgoal for x xs\n apply (rule exI[where x=\"xs@[x]\"])\n apply (auto del: ext intro!: ext simp: list\\_snoc sep_algebra_simps list\\_at_len\n simp: this_addr_baddr_def pto_this_exact\n )\n done\n subgoal for xs\n apply (rule exI[where x=\"last xs\"])\n apply (rule exI[where x=\"butlast xs\"]; simp)\n apply (cases xs rule: rev_cases)\n apply (auto simp: list\\_gt_len sep_algebra_simps list\\_snoc del: ext intro!: ext)\n done\n done\n next \n case (step2 n) thus ?case by (auto) \n qed \n \n lemma ba_block_exs_alt: \n \"\\is_block_ptr p; n\\0\\ \\ (\\*i\\{0..a i)) = (EXS blk. \\(int (length blk) = n) ** ba.block (\\ blk) p)\"\n unfolding init_def ba.block_def\n supply [simp del] = ba.pto_addr_eq\n apply (cases p rule: ba.rptr_cases.cases; simp)\n apply (rule ext)\n apply (auto \n split: rptr.splits addr.splits \n simp: sep_algebra_simps pred_lift_extract_simps \\_def ba_block_exs_alt_aux\n )\n done\n \n lemma tag_of_init[simp]: \"tag_of (init v n) = int n\" by (auto simp: tag_of_def init_def)\n\n lemma ba_allocn_rule: \"htriple ba.\\ \\ (ba_allocn v n) (\\r. (\\*i\\{0..a i)) ** ba.tag (int n) r ** \\(abase r))\"\n unfolding ba_allocn_def\n apply (rule cons_rule[OF ba.alloc_rule])\n apply simp\n apply (simp add: ba_block_alt sep_algebra_simps pred_lift_extract_simps)\n done\n\n (* TODO: Move to gen_wp locale *) \n lemma wp_cons: \"wp c Q s \\ (\\x s. Q x s \\ Q' x s) \\ wp c Q' s\" \n by (simp add: wp_monoI)\n \n lemma blk_complete_tag[simp]: \"is_complete_tag (\\ blk) (int (length blk))\" \n by (auto simp: is_complete_tag_def \\_def list\\_def \\v_complete)\n\n (* TODO: is_base_ptr: This logic is already encoded in ba.tag! Try to get rid of is_base_ptr! *) \n lemma ba_tag_extr_baseptr: \"ba.tag n p = (\\(is_block_ptr p \\ 0\\n) ** ba.tag n p)\" \n apply (rule ext)\n apply (auto simp: ba.tag_def sep_algebra_simps pred_lift_extract_simps split: addr.splits rptr.splits)\n apply (auto simp: tag_of_def)\n done\n \n lemma ba_freen_rule: \"htriple ba.\\ ((\\*i\\{0..ai)) \\* ba.tag n p) (ba.free p) (\\_. \\)\"\n apply (subst ba_tag_extr_baseptr)\n apply (rule htripleI')\n apply (clarsimp simp: sep_algebra_simps pred_lift_extract_simps)\n apply (simp add: ba_block_exs_alt)\n apply (clarsimp simp: sep_algebra_simps pred_lift_extract_simps)\n \n subgoal for pp s f blk\n supply R = ba.free_rule[of \"\\ blk\" p \"int (length blk)\"]\n apply (rule R[THEN htripleD', THEN wp_cons])\n apply assumption+\n apply (simp add: sep_algebra_simps)\n apply (simp add: sep_algebra_simps)\n done\n done\n \n lemma checked_idx_baddr_pres_tag: \"wlp (checked_idx_baddr (BADDR a b) i) (\\_ s'. tag_of s' = tag_of sa) sa\" \n by (auto simp: wlp_def checked_idx_baddr_def check_addr_def run_simps split: prod.splits baddr.splits)\n \n (* TODO: Move *) \n lemma return_rule: \"htriple \\ P (return x) (\\r. \\(r=x)**P)\" for \\\n by vcg\n \n (* TODO: Move *) \n lemma wlp_return[simp]: \"wlp (return x) Q s = Q x s\"\n by (auto simp: wlp_def run_simps)\n \n lemma checked_idx_ptr_rule: \"abase p \n \\ htriple ba.\\ (ba.pto xx (p +\\<^sub>a i)) (checked_idx_ptr p i) (\\r. \\(r=p +\\<^sub>a i) ** ba.pto xx (p +\\<^sub>a i))\"\n unfolding checked_idx_ptr_def\n apply (cases p rule: ba.rptr_cases.cases; simp add: zoom_bind)\n supply [vcg_rules] = ba.block_lifter.lift_operation[simplified, OF _ _ checked_idx_baddr_rule]\n supply [vcg_rules] = ba.block_lifter.lift_operation[simplified, OF _ _ return_rule]\n supply [simp] = pto_notZ checked_idx_baddr_pres_tag abase_baddr_def\n supply [named_ss fri_prepare_simps] = aidx_baddr_simp\n supply [split] = baddr.splits\n apply vcg\n done\n \nend\n \nend\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/vcg/Sep_Array_Block_RS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.29863406532467274}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"32-Bit Machine Word Setup\"\n\ntheory Machine_Word_32\n imports Machine_Word_32_Basics More_Word Bit_Shifts_Infix_Syntax Rsplit\nbegin\n\ncontext\n includes bit_operations_syntax\nbegin\n\ntype_synonym machine_word = \\machine_word_len word\\\n\nlemma word_bits_len_of:\n \\LENGTH(machine_word_len) = word_bits\\\n by (simp add: word_bits_conv)\n\nlemma word_bits_size:\n \"size (w :: machine_word) = word_bits\"\n by (simp add: word_bits_def word_size)\n\nlemma word_bits_word_size_conv:\n \\word_bits = word_size * 8\\\n by (simp add: word_bits_def word_size_def)\n\nlemma word_size_word_size_bits:\n \\word_size = (2 :: 'a :: semiring_1) ^ word_size_bits\\\n by (simp add: word_size_def word_size_bits_def)\n\nlemma lt_word_bits_lt_pow:\n \"sz < word_bits \\ sz < 2 ^ word_bits\"\n by (simp add: word_bits_conv)\n\nlemma if_then_1_else_0:\n \"((if P then 1 else 0) = (0 :: machine_word)) = (\\ P)\"\n by simp\n\nlemma if_then_0_else_1:\n \"((if P then 0 else 1) = (0 :: machine_word)) = (P)\"\n by simp\n\nlemmas if_then_simps = if_then_0_else_1 if_then_1_else_0\n\nlemma bool_mask [simp]:\n \\0 < x AND 1 \\ x AND 1 = 1\\ for x :: machine_word\n by (rule bool_mask') auto\n\nlemma in_16_range:\n \"0 \\ S \\ r \\ (\\x. r + x * (16 :: machine_word)) ` S\"\n \"n - 1 \\ S \\ (r + (16 * n - 16)) \\ (\\x :: machine_word. r + x * 16) ` S\"\n by (clarsimp simp: image_def elim!: bexI[rotated])+\n\nlemma le_step_down_word_3:\n fixes x :: machine_word\n shows \"\\x \\ y; x \\ y\\ \\ x \\ y - 1\"\n by (fact le_step_down_word_2)\n\nlemma shiftr_1:\n \"(x::machine_word) >> 1 = 0 \\ x < 2\"\n apply transfer\n apply (simp add: take_bit_drop_bit)\n apply (simp add: drop_bit_Suc)\n done\n\nlemma Suc_unat_mask_div:\n \"Suc (unat (mask sz div word_size :: machine_word)) = 2 ^ (min sz word_bits - word_size_bits)\"\n by (simp add: word_size_word_size_bits unat_drop_bit_eq unat_mask_eq drop_bit_mask_eq Suc_mask_eq_exp\n flip: drop_bit_eq_div word_bits_conv)\n\nlemma ucast_not_helper:\n fixes a::\"8 word\"\n assumes a: \"a \\ 0xFF\"\n shows \"ucast a \\ (0xFF::machine_word)\"\nproof\n assume \"ucast a = (0xFF::machine_word)\"\n also\n have \"(0xFF::machine_word) = ucast (0xFF::8 word)\" by simp\n finally\n show False using a\n apply -\n apply (drule up_ucast_inj, simp)\n apply simp\n done\nqed\n\nlemma unat_less_2p_word_bits:\n \"unat (x :: machine_word) < 2 ^ word_bits\"\n apply (simp only: word_bits_def)\n apply (rule unat_lt2p)\n done\n\nlemma unat_less_word_bits:\n fixes y :: machine_word\n shows \"x < unat y \\ x < 2 ^ word_bits\"\n unfolding word_bits_def\n by (rule order_less_trans [OF _ unat_lt2p])\n\nlemma unat_mask_2_less_4:\n \"unat (p AND mask 2 :: machine_word) < 4\"\n by (rule unat_less_helper) (simp only: take_bit_eq_mod word_mod_less_divisor flip: take_bit_eq_mask, simp add: word_mod_less_divisor)\n\nlemma unat_mult_simple:\n \\unat (x * y) = unat x * unat y\\\n if \\unat x * unat y < 2 ^ LENGTH(machine_word_len)\\\n for x y :: machine_word\n using that by (simp flip: unat_mult_lem)\n\nlemma upto_2_helper:\n \"{0..<2 :: machine_word} = {0, 1}\"\n by (safe; simp) unat_arith\n\nlemma word_ge_min:\n \\- (2 ^ (word_bits - 1)) \\ sint x\\ for x :: machine_word\n using sint_ge [of x] by (simp add: word_bits_def)\n\nlemma word_rsplit_0:\n \"word_rsplit (0 :: machine_word) = replicate (word_bits div 8) (0 :: 8 word)\"\n by (simp add: word_rsplit_def bin_rsplit_def word_bits_def word_size_def Cons_replicate_eq)\n\nlemma x_less_2_0_1:\n fixes x :: machine_word\n shows \"x < 2 \\ x = 0 \\ x = 1\"\n by (rule x_less_2_0_1') auto\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Word_Lib/Machine_Word_32.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984445, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.29863405886382904}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nsection {* \\isaheader{Map Implementation by Associative Lists} *}\ntheory ListMapImpl\nimports \n \"../spec/MapSpec\" \n \"../../Lib/Assoc_List\" \n \"../gen_algo/MapGA\"\nbegin\ntext_raw {*\\label{thy:ListMapImpl}*}\n\n(*@impl Map\n @type 'a lm\n @abbrv lm,l\n Maps implemented by associative lists. If you need efficient \n @{text \"insert_dj\"} operation, you should use list sets with explicit \n invariants (lmi).\n*)\n\ntype_synonym ('k,'v) lm = \"('k,'v) assoc_list\"\n\ndefinition [icf_rec_def]: \"lm_basic_ops \\ \\\n bmap_op_\\ = Assoc_List.lookup,\n bmap_op_invar = \\_. True,\n bmap_op_empty = (\\_::unit. Assoc_List.empty),\n bmap_op_lookup = (\\k m. Assoc_List.lookup m k),\n bmap_op_update = Assoc_List.update,\n bmap_op_update_dj = Assoc_List.update,\n bmap_op_delete = Assoc_List.delete,\n bmap_op_list_it = Assoc_List.iteratei\n\\\"\n\nsetup Locale_Code.open_block\ninterpretation lm_basic: StdBasicMapDefs lm_basic_ops .\ninterpretation lm_basic: StdBasicMap lm_basic_ops\n apply unfold_locales\n apply (simp_all add: icf_rec_unf \n Assoc_List.lookup_empty' Assoc_List.iteratei_correct)\n done\nsetup Locale_Code.close_block\n\ndefinition [icf_rec_def]: \"lm_ops \\ lm_basic.dflt_ops\"\nsetup Locale_Code.open_block\ninterpretation lm: StdMapDefs lm_ops .\ninterpretation lm: StdMap lm_ops \n unfolding lm_ops_def\n by (rule lm_basic.dflt_ops_impl)\ninterpretation lm: StdMap_no_invar lm_ops \n by unfold_locales (simp add: icf_rec_unf)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"lm\"*}\n\nlemma pi_lm[proper_it]: \n \"proper_it' Assoc_List.iteratei Assoc_List.iteratei\"\n unfolding Assoc_List.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm: proper_it_loc Assoc_List.iteratei Assoc_List.iteratei\n apply unfold_locales\n apply (rule pi_lm)\n done\n\nlemma pi_lm'[proper_it]: \n \"proper_it' lm.iteratei lm.iteratei\"\n unfolding lm.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm': proper_it_loc lm.iteratei lm.iteratei\n apply unfold_locales\n apply (rule pi_lm')\n done\n\n\ntext {* Code generator test *}\ndefinition \"test_codegen \\ (\n lm.add ,\n lm.add_dj ,\n lm.ball ,\n lm.bex ,\n lm.delete ,\n lm.empty ,\n lm.isEmpty ,\n lm.isSng ,\n lm.iterate ,\n lm.iteratei ,\n lm.list_it ,\n lm.lookup ,\n lm.restrict ,\n lm.sel ,\n lm.size ,\n lm.size_abort ,\n lm.sng ,\n lm.to_list ,\n lm.to_map ,\n lm.update ,\n lm.update_dj)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/impl/ListMapImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.29863342676099575}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Addr_Type\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\ntype_synonym addr_bitsize = \"32\"\ntype_synonym addr = \"addr_bitsize word\"\ndefinition addr_bitsize :: nat where \"addr_bitsize \\ 32\"\ndefinition addr_align :: nat where \"addr_align \\ 2\"\ndeclare addr_align_def[simp]\n\ndefinition addr_card :: nat where\n \"addr_card \\ card (UNIV::addr set)\"\n\n\n\ndeclare addr_bitsize_def[simp]\n\nlemma addr_card:\n \"addr_card = 2^addr_bitsize\"\n by (simp add: addr_card_def card_word)\n\nlemma len_of_addr_card:\n \"2 ^ len_of TYPE(addr_bitsize) = addr_card\"\n by (simp add: addr_card)\n\nlemma of_nat_addr_card [simp]:\n \"of_nat addr_card = (0::addr)\"\n by (simp add: addr_card)\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/umm_heap/ARM_HYP/Addr_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2985276726576629}} {"text": "theory AltDropEnv\n imports WTLemma\nbegin\n \n\n (*\nlemma var_value_prim1: \"\\ v \\ NoRef; var_val_type v tau tau_x \\ \\ req_type tau \\ Prim\" \n apply (case_tac v)\n apply (auto)\n apply (case_tac tau_x)\n apply (auto)\n apply (case_tac tau_x)\n apply (auto)\n done\n\nlemma var_value_unlim: \"\\ v \\ NoRef; var_val_type v tau tau_x \\ \\ req_type tau_x = Ref\" \n apply (case_tac v)\n apply (auto)\n apply (case_tac tau_x)\n apply (auto)\n apply (case_tac tau_x)\n apply (auto)\n done *)\n \n (* - requirements dropping (reduces requirements to pass into lambdas) *)\n \ndefinition drop_use_env where\n \"drop_use_env r_s = (\\ x. if r_s x = OwnPerm then UsePerm else r_s x)\" \n\nlemma self_drop_leq_use_env: \"leq_use_env (drop_use_env r_x) r_x\" \n apply (simp add: leq_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma drop_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\ leq_use_env (drop_use_env r_x) r_s\" \n apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_drop_leq_use_env)\n done \n \nlemma dist_drop_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\ leq_use_env (drop_use_env r_x) (drop_use_env r_s)\" \n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: drop_use_env_def)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done \n \nlemma weak_drop_use_env: \"\\ weak_use_env r_s \\ \\ drop_use_env r_s = r_s\"\n apply (case_tac \"\\ x. drop_use_env r_s x = r_s x\")\n apply (auto)\n apply (simp add: drop_use_env_def)\n apply (simp add: weak_use_env_def)\n done \n \nlemma drop_weak_use_env: \"weak_use_env (drop_use_env r_s)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: drop_use_env_def)\n done \n\nlemma dist_drop_comp_use_env: \"drop_use_env (comp_use_env r_sa r_sb) = comp_use_env (drop_use_env r_sa) (drop_use_env r_sb)\" \n apply (case_tac \"\\ x. drop_use_env (comp_use_env r_sa r_sb) x = comp_use_env (drop_use_env r_sa) (drop_use_env r_sb) x\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (case_tac \"r_sa x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n done\n \nlemma dom_lift_comp_use_env: \"\\ r = OwnPerm \\ \\ comp_use_env r_s (lift_use_env r_s r) = comp_use_env (drop_use_env r_s) (lift_use_env r_s r)\" \n apply (case_tac \"\\ x. comp_use_env r_s (lift_use_env r_s r) x = comp_use_env (drop_use_env r_s) (lift_use_env r_s r) x\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \nlemma drop_lift_leq_use_env: \"leq_use_env (drop_use_env (lift_use_env r_s r)) (lift_use_env (drop_use_env r_s) r)\" \n apply (simp add: drop_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n\nlemma rhs_drop_leq_use_env: \"\\ weak_use_env r_x; leq_use_env r_x r_s \\ \\ leq_use_env r_x (drop_use_env r_s)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done \n \nlemma diff_drop_use_env: \"drop_use_env (diff_use_env r_s r_ex) = diff_use_env (drop_use_env r_s) r_ex\"\n apply (case_tac \"\\ x. drop_use_env (diff_use_env r_s r_ex) x = diff_use_env (drop_use_env r_s) r_ex x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \n\nlemma dist_drop_diff_use_env: \"diff_use_env (drop_use_env r_s) r_x = drop_use_env (diff_use_env r_s r_x)\" \n apply (case_tac \"\\ x. diff_use_env (drop_use_env r_s) r_x x = drop_use_env (diff_use_env r_s r_x) x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (case_tac \"r_s x = OwnPerm\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \n\nlemma wtsdr_weak_use_env: \"\\ leq_use_env r_s (diff_use_env r_s r_x); leq_use_env r_x r_s \\ \\ weak_use_env r_x\" \n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \n \nlemma wt_sexp_drop_all: \"\\ well_typed env rx e tau rx rx'; req_type tau \\ Aff; is_sexp e \\ \\\n well_typed env (drop_use_env rx) e tau (drop_use_env rx) (drop_use_env rx')\" \n apply (induct e arbitrary: env tau rx rx')\n apply (auto)\n (* const + op cases *)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n (* var case p1.\n - say that x was non-affine, but was owned by an affine data structure. in this case, the permissions we receive cannot be reduced.\n *)\n apply (case_tac x)\n apply (auto)\n apply (rule_tac ereq_leq_use_envx)\n apply (cut_tac r_x=\"ereq_use_env (Loc x22) tau_x\" and r_s=\"rx\" and x=\"Loc x22\" in spec_leq_perm)\n apply (simp)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (simp add: end_req_perm_def)\n (* var case p2 *)\n apply (cut_tac r_s=\"rx\" and r_x=\"comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex\" in wtsdr_weak_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (case_tac tau)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac r_sa=\"ereq_use_env (owner_name x) tau_x\" in weak_comp_use_env2)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac r_sb=\"r_ex\" in weak_comp_use_env1)\n apply (case_tac tau)\n apply (auto)\n (* pair case *)\n apply (case_tac \"r = OwnPerm\")\n apply (auto)\n apply (case_tac \"max_aff (req_type t1) (req_type t2) = Aff\")\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"req_type t1 = Aff\")\n apply (auto)\n apply (case_tac \"req_type t2 = Aff\")\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (case_tac \"lift_use_env rx2 r \\ rx2 \\ lift_use_env rx1 r \\ rx1\")\n apply (case_tac r)\n apply (auto)\n(*\n apply (case_tac \"\\ (req_type t1 \\ Aff \\ req_type t2 \\ Aff)\")\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (auto)*)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (cut_tac e=\"e1\" in value_is_sexp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"rx\" and r_c=\"r_s2\" and ?r_s2.0=\"rx\" and e=\"e1\" and tau=\"t1\" and rx=\"rx1\" in well_typed_decr_end_perm)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2\" and r_sa=\"rx\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sc=\"rx\" and r_sb=\"diff_use_env r_s3 r_ex\" and r_sa=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (case_tac \"lift_use_env (drop_use_env rx2) r \\ drop_use_env rx2\")\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"lift_use_env (drop_use_env rx1) r \\ drop_use_env rx1\")\n apply (case_tac r)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (auto)\n apply (cut_tac e=\"e2\" in value_is_sexp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"rx\" and r_c=\"r_s3\" and ?r_s2.0=\"rx\" and e=\"e2\" and tau=\"t2\" and rx=\"rx2\" in well_typed_decr_end_perm)\n apply (rule_tac ?r_s1.0=\"r_s2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"rx2\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) r_ex)\" and s=\"diff_use_env (drop_use_env (comp_use_env rx1 rx2)) r_ex\" in subst)\n apply (rule_tac dist_drop_diff_use_env)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (simp add: dist_drop_comp_use_env)\n apply (rule_tac id_leq_use_env)\n (* lam case *)\n apply (simp add: aff_use_env_def)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (auto)\n apply (case_tac a)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (auto)\n apply (case_tac a)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)\n (* app case. e1 *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n (* app case. e2, lambda unrolling *)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and r_c=\"rx\" and ?r_s1.0=\"r_s2\" and ?r_s2.0=\"rx\" and e=\"e2\" and tau=\"t1\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (rule_tac r_c=\"r_s3\" in well_typed_decr_end_perm)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - prove that e2 is an s-expression *)\n apply (case_tac \"\\ is_sexp e2\")\n apply (cut_tac ?e1.0=\"e1\" and ?e2.0=\"e2\" in e2_sexp)\n apply (simp_all)\n (* - prove that t1 is unlim *)\n apply (case_tac \"\\ req_type t1 \\ Aff\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n (* app case. tau primitive case (only happens for fixed point w/ primitive fun) *)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n apply (auto)\n apply (case_tac t)\n apply (auto)\n apply (case_tac \"\\ weak_use_env empty_use_env\")\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (auto)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n (* non prim case. *)\n (* - prove weakness of rx1 + rx2 + r_ex *)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in wtsdr_weak_use_env)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp_all)\n (* - r not ownership *)\n apply (case_tac \"r = OwnPerm\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n (* - final manipulation *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in leq_weak_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n(*\n apply (simp add: drop_use_env_def)\n apply (case_tac r)\n apply (auto)*)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac \"lift_use_env (drop_use_env rx2) r \\ drop_use_env rx2\")\n apply (case_tac r)\n apply (auto)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac r_sa=\"comp_use_env rx1 (lift_use_env rx2 r)\" in weak_comp_use_env2)\n apply (auto)\n apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in trans_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_drop_leq_use_env)\n done \n \nlemma wt_sexp_drop_req: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau \\ Aff; (*\\ aff_fun_ty tau;*) is_sexp e \\ \\\n well_typed env r_s1 e tau r_s2 (drop_use_env rx)\"\n apply (induct e arbitrary: r_s1 r_s2 tau rx)\n apply (auto)\n (* const + op cases *)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n (* var case. *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac weak_ereq_use_env)\n apply (simp add: unlim_def)\n apply (case_tac x)\n apply (auto)\n (* pair case. *)\n apply (case_tac \"r = OwnPerm\")\n apply (auto)\n apply (case_tac \"max_aff (req_type t1) (req_type t2) = Aff\")\n apply (case_tac r)\n apply (auto)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (case_tac \"req_type t1 = Aff\")\n apply (auto)\n apply (cut_tac e=\"e1\" in value_is_sexp)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (auto)\n apply (case_tac \"req_type t2 = Aff\")\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (cut_tac e=\"e2\" in value_is_sexp)\n apply (auto)\n apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (case_tac \"lift_use_env (drop_use_env rx1) r \\ drop_use_env rx1\")\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"lift_use_env (drop_use_env rx2) r \\ drop_use_env rx2\")\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac drop_leq_use_env)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac drop_leq_use_env)\n apply (rule_tac self_lift_leq_use_env)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (simp add: aff_use_env_def)\n apply (case_tac a)\n apply (auto)\n apply (simp add: null_use_env_def)\n apply (simp add: weak_use_env_def)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (case_tac \"req_type (FunTy t1 tau r a) = Aff\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n apply (case_tac \"\\ is_sexp e1\")\n apply (case_tac e1)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (case_tac \"req_type t1 = Aff\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n apply (case_tac \"\\ is_sexp e2\")\n apply (case_tac \"is_value e2\")\n apply (cut_tac e=\"e2\" in value_is_sexp)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (case_tac e2)\n apply (auto)\n apply (cut_tac r_xa=\"drop_use_env rx1\" and r_xb=\"lift_use_env (drop_use_env rx2) r\" and r_s=\"comp_use_env rx1 (lift_use_env rx2 r)\" in dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"req_type tau = Prim\")\n apply (simp add: app_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n done\n \n (* ####### primitive lemmas *)\n \nlemma wt_sexp_no_all: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau = Prim; is_sexp e \\ \\ well_typed env empty_use_env e tau empty_use_env empty_use_env\" \n apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n (* const + op case *) \n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n (* var case *)\n apply (case_tac x)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n (* pair case *)\n apply (case_tac \"r \\ NoPerm\")\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (case_tac \"req_type t2\")\n apply (auto)\n apply (case_tac \"req_type t2\")\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (cut_tac e=\"e1\" in value_is_sexp)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (cut_tac e=\"e2\" in value_is_sexp)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac disj_empty_use_env1)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (simp add: leq_use_env_def)\n apply (simp add: aff_use_env_def)\n apply (simp add: null_use_env_def)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp add: leq_use_env_def)\n apply (simp add: aff_use_env_def)\n apply (simp add: null_use_env_def)\n (* app case. since tau is primitive, the only possible const is the fix point *)\n apply (case_tac e1)\n apply (auto)\n apply (case_tac \"x1 \\ FixConst\")\n apply (case_tac x1)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n (* - with that in mind, we fill in the rest *)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (case_tac \"\\ is_sexp e2\")\n apply (case_tac e2)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (rule_tac leq_empty_use_env)\n done\n \nlemma wt_sexp_no_req: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau = Prim; is_sexp e \\ \\ well_typed env r_s1 e tau r_s2 empty_use_env\" \n apply (rule_tac r_c=\"r_s1\" in well_typed_decr_end_perm)\n apply (rule_tac r_s=\"empty_use_env\" in well_typed_incr_simul_perm)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac wt_sexp_no_all)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n done \n \n \nfun drop_use_env_dep where\n \"drop_use_env_dep r_s OwnPerm = r_s\"\n| \"drop_use_env_dep r_s UsePerm = drop_use_env r_s\"\n| \"drop_use_env_dep r_s NoPerm = empty_use_env\" \n \nlemma wt_sexp_drop_dep_req: \"\\ well_typed env r_s1 e tau r_s2 rx; is_sexp e; safe_type_x tau r \\ \\ well_typed env r_s1 e tau r_s2 (drop_use_env_dep rx r)\" \n apply (case_tac r)\n apply (auto)\n apply (rule_tac wt_sexp_no_req)\n apply (auto)\n apply (rule_tac wt_sexp_drop_req)\n apply (auto)\n apply (simp add: unlim_def)\n done\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/AltDropEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2985276657427354}} {"text": "theory ExtraLemmas\nimports AutoCorres\nbegin\n\nlemma shiftr1_is_div_2': \"shiftr1 (x :: ('a :: len) word) = x div 2\"\napply (simp only: shiftr1_unfold)\nusing shiftr1_is_div_2 by auto\n\nlemma shiftr2_is_div_4:\nassumes \"2 < len_of TYPE('a)\"\nshows \"(x :: ('a :: len) word) >> 2 = x div 4\"\nproof -\n from assms have \"x >> 2 = x div 2 ^ 2\" by (simp add: shiftr_div_2n_w word_size)\n thus ?thesis by auto\nqed\n\nlemma shiftr3_is_div_8:\nassumes \"3 < len_of TYPE('a)\"\nshows \"(x :: ('a :: len) word) >> 3 = x div 8\"\nproof -\n from assms have \"x >> 3 = x div 2 ^ 3\" by (simp add: shiftr_div_2n_w word_size)\n thus ?thesis by auto\nqed\n\nlemma array_addrs_ptr_add[intro]: \"0 \\ i \\ i < int n \\ p +\\<^sub>p i \\ set (array_addrs p n)\"\napply (simp add: set_array_addrs)\napply (rule_tac x=\"nat i\" in exI)\napply simp\ndone\n\nlemma array_addrs_ptr_ex[dest]:\n \"q \\ set (array_addrs p n)\\ \\i. q = p +\\<^sub>p (int i) \\ i < n\"\nby (simp add: set_array_addrs)\n\nlemma ptr_val_inject: \"(p :: 'a ptr) = q \\ ptr_val p = ptr_val q\"\nby auto\n\nlemma ptr_arith_index: \"0 \\ i \\ 0 \\ k\n \\ nat i * size_of TYPE('a :: wf_type) < 2 ^ len_of TYPE(32)\n \\ nat k * size_of TYPE('a :: wf_type) < 2 ^ len_of TYPE(32)\n \\ ((p :: 'a ptr) +\\<^sub>p i = p +\\<^sub>p k) = (i = k)\"\nunfolding ptr_add_def\nproof auto\n fix i k :: int\n assume size_i: \"nat i * size_of TYPE('a) < 4294967296\" and \"0 \\ i\"\n and size_k: \"nat k * size_of TYPE('a) < 4294967296\" and \"0 \\ k\"\n and eq: \"of_int i * of_nat (size_of TYPE('a)) = (of_int k * of_nat (size_of TYPE('a)) :: 32 word)\"\n hence \"(of_nat (nat i) :: 32 word) * of_nat (size_of TYPE('a))\n = of_nat (nat k) * of_nat (size_of TYPE('a))\" by simp\n hence \"(of_nat (nat i * size_of TYPE('a)) :: 32 word) = of_nat (nat k * size_of TYPE('a))\"\n (is \"of_nat ?L = of_nat ?R\") by simp\n moreover have \"((of_nat ?L :: 32 word) = of_nat ?R) = (?L = ?R)\"\n using size_i and size_k by (fastforce intro!: Word_Lemmas.of_nat_inj)\n ultimately have \"?L = ?R\" by auto\n thus \"i = k\" using not_gr0 sz_nzero\n by (metis \\0 \\ i\\ \\0 \\ k\\ int_nat_eq mult.commute mult_cancel1)\nqed\n\nlemma hoare_post_imp: \"\\r s. Q r s \\ R r s \\ \\P\\ m \\Q\\ \\ \\P\\ m \\R\\\"\nunfolding valid_def by blast\n\nlemma size_of_le_n[dest]: \"size_of TYPE('a :: wf_type) \\ unat (n :: ('b :: len) word) \\ 0 < n\"\nproof -\n fix n :: \"'b word\"\n assume \"size_of TYPE('a) \\ unat n\"\n moreover have \"0 < size_of TYPE('a)\" using sz_nzero by auto\n ultimately have \"0 < unat n\" by linarith \n thus \"0 < n\" using word_of_nat_less by force\nqed\n\nlemma ptr_less_simp : \"a < b = (ptr_val a < ptr_val b)\" \n by (simp add: ptr_less_def ptr_less_def')\nlemma ptr_le_simp : \"a \\ b = (ptr_val a \\ ptr_val b)\" \n by (simp add: ptr_le_def ptr_le_def')\nlemmas ptr_comp_simps = ptr_less_simp and ptr_le_simp \nend", "meta": {"author": "CriticalTechnologiesInc", "repo": "SableModel", "sha": "a452a2b5e3636b612a4d04cfb6e2ab1c1a132639", "save_path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel", "path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel/SableModel-a452a2b5e3636b612a4d04cfb6e2ab1c1a132639/lib/ExtraLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.29852766574273537}} {"text": "(*\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n \n *)\n\ntheory BitVector_Rewriting\n imports reassembly_rewriting.Take_Bits_Rewriting reassembly_manual_execution.BitVectors\nbegin\n\n\nsubsection \\Logical Operators\\\n\nlemma bv_to_bool_bool_to_bv:\n shows \"bv_to_bool (bool_to_bv b) = b\"\n by (cases b,auto simp add: bv_to_bool_def)\n \nlemma snd_bool_to_bv:\n shows \"snd (bool_to_bv b) = 1\"\n by (cases b,auto)\n\nlemma bv_to_bool_True:\n shows \"bv_to_bool (1, 1) = True\"\n by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_True_Suc0:\n shows \"bv_to_bool (1, Suc 0) = True\"\n by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False:\n shows \"bv_to_bool (0, 1) = False\"\n by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False_Suc0:\n shows \"bv_to_bool (0, Suc 0) = False\"\n by (auto simp add: bv_to_bool_def)\n\n\nlemma bool_to_bv_eq:\n shows \"bool_to_bv b = (x, Suc 0) \\ (x \\ {0,1} \\ ((x = 1) \\ b))\"\n by (cases b,auto)\n\nlemma bv_NOT_bool_to_bv:\n shows \"bv_NOT (bool_to_bv b) = bool_to_bv (\\b)\"\n by (cases b, auto simp add: max_word_def) \n\n\n\nsubsection \\Concatenation and slicing\\\n\n\n\nlemmas bv_slice_simps[simp] =\n bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" \"numeral s\"]\n bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 0]\n bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 1]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 0 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 0 0]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 0 1]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 1 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 1 0]\n bv_slice.simps[of \"numeral h\" \"numeral l\" 1 1]\n bv_slice.simps[of \"numeral h\" 0 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 0 \"numeral w\" 0]\n bv_slice.simps[of \"numeral h\" 0 \"numeral w\" 1]\n bv_slice.simps[of \"numeral h\" 0 0 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 0 0 0]\n bv_slice.simps[of \"numeral h\" 0 0 1]\n bv_slice.simps[of \"numeral h\" 0 1 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 0 1 0]\n bv_slice.simps[of \"numeral h\" 0 1 1]\n bv_slice.simps[of \"numeral h\" 1 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 1 \"numeral w\" 0]\n bv_slice.simps[of \"numeral h\" 1 \"numeral w\" 1]\n bv_slice.simps[of \"numeral h\" 1 0 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 1 0 0]\n bv_slice.simps[of \"numeral h\" 1 0 1]\n bv_slice.simps[of \"numeral h\" 1 1 \"numeral s\"]\n bv_slice.simps[of \"numeral h\" 1 1 0]\n bv_slice.simps[of \"numeral h\" 1 1 1]\n bv_slice.simps[of 0 \"numeral l\" \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 0 \"numeral l\" \"numeral w\" 0]\n bv_slice.simps[of 0 \"numeral l\" \"numeral w\" 1]\n bv_slice.simps[of 0 \"numeral l\" 0 \"numeral s\"]\n bv_slice.simps[of 0 \"numeral l\" 0 0]\n bv_slice.simps[of 0 \"numeral l\" 0 1]\n bv_slice.simps[of 0 \"numeral l\" 1 \"numeral s\"]\n bv_slice.simps[of 0 \"numeral l\" 1 0]\n bv_slice.simps[of 0 \"numeral l\" 1 1]\n bv_slice.simps[of 0 0 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 0 0 \"numeral w\" 0]\n bv_slice.simps[of 0 0 \"numeral w\" 1]\n bv_slice.simps[of 0 0 0 \"numeral s\"]\n bv_slice.simps[of 0 0 0 0]\n bv_slice.simps[of 0 0 0 1]\n bv_slice.simps[of 0 0 1 \"numeral s\"]\n bv_slice.simps[of 0 0 1 0]\n bv_slice.simps[of 0 0 1 1]\n bv_slice.simps[of 0 1 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 0 1 \"numeral w\" 0]\n bv_slice.simps[of 0 1 \"numeral w\" 1]\n bv_slice.simps[of 0 1 0 \"numeral s\"]\n bv_slice.simps[of 0 1 0 0]\n bv_slice.simps[of 0 1 0 1]\n bv_slice.simps[of 0 1 1 \"numeral s\"]\n bv_slice.simps[of 0 1 1 0]\n bv_slice.simps[of 0 1 1 1]\n bv_slice.simps[of 1 \"numeral l\" \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 1 \"numeral l\" \"numeral w\" 0]\n bv_slice.simps[of 1 \"numeral l\" \"numeral w\" 1]\n bv_slice.simps[of 1 \"numeral l\" 0 \"numeral s\"]\n bv_slice.simps[of 1 \"numeral l\" 0 0]\n bv_slice.simps[of 1 \"numeral l\" 0 1]\n bv_slice.simps[of 1 \"numeral l\" 1 \"numeral s\"]\n bv_slice.simps[of 1 \"numeral l\" 1 0]\n bv_slice.simps[of 1 \"numeral l\" 1 1]\n bv_slice.simps[of 1 0 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 1 0 \"numeral w\" 0]\n bv_slice.simps[of 1 0 \"numeral w\" 1]\n bv_slice.simps[of 1 0 0 \"numeral s\"]\n bv_slice.simps[of 1 0 0 0]\n bv_slice.simps[of 1 0 0 1]\n bv_slice.simps[of 1 0 1 \"numeral s\"]\n bv_slice.simps[of 1 0 1 0]\n bv_slice.simps[of 1 0 1 1]\n bv_slice.simps[of 1 1 \"numeral w\" \"numeral s\"]\n bv_slice.simps[of 1 1 \"numeral w\" 0]\n bv_slice.simps[of 1 1 \"numeral w\" 1]\n bv_slice.simps[of 1 1 0 \"numeral s\"]\n bv_slice.simps[of 1 1 0 0]\n bv_slice.simps[of 1 1 0 1]\n bv_slice.simps[of 1 1 1 \"numeral s\"]\n bv_slice.simps[of 1 1 1 0]\n bv_slice.simps[of 1 1 1 1]\n for h l w s\n\nlemmas bv_cat_simps[simp] =\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 0]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 1]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0 0]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0 1]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1 0]\n bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1 1]\n bv_cat.simps[of \"numeral w0\" 0 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 0 \"numeral w1\" 0]\n bv_cat.simps[of \"numeral w0\" 0 \"numeral w1\" 1]\n bv_cat.simps[of \"numeral w0\" 0 0 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 0 0 0]\n bv_cat.simps[of \"numeral w0\" 0 0 1]\n bv_cat.simps[of \"numeral w0\" 0 1 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 0 1 0]\n bv_cat.simps[of \"numeral w0\" 0 1 1]\n bv_cat.simps[of \"numeral w0\" 1 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 1 \"numeral w1\" 0]\n bv_cat.simps[of \"numeral w0\" 1 \"numeral w1\" 1]\n bv_cat.simps[of \"numeral w0\" 1 0 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 1 0 0]\n bv_cat.simps[of \"numeral w0\" 1 0 1]\n bv_cat.simps[of \"numeral w0\" 1 1 \"numeral s1\"]\n bv_cat.simps[of \"numeral w0\" 1 1 0]\n bv_cat.simps[of \"numeral w0\" 1 1 1]\n bv_cat.simps[of 0 \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 0 \"numeral s0\" \"numeral w1\" 0]\n bv_cat.simps[of 0 \"numeral s0\" \"numeral w1\" 1]\n bv_cat.simps[of 0 \"numeral s0\" 0 \"numeral s1\"]\n bv_cat.simps[of 0 \"numeral s0\" 0 0]\n bv_cat.simps[of 0 \"numeral s0\" 0 1]\n bv_cat.simps[of 0 \"numeral s0\" 1 \"numeral s1\"]\n bv_cat.simps[of 0 \"numeral s0\" 1 0]\n bv_cat.simps[of 0 \"numeral s0\" 1 1]\n bv_cat.simps[of 0 0 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 0 0 \"numeral w1\" 0]\n bv_cat.simps[of 0 0 \"numeral w1\" 1]\n bv_cat.simps[of 0 0 0 \"numeral s1\"]\n bv_cat.simps[of 0 0 0 0]\n bv_cat.simps[of 0 0 0 1]\n bv_cat.simps[of 0 0 1 \"numeral s1\"]\n bv_cat.simps[of 0 0 1 0]\n bv_cat.simps[of 0 0 1 1]\n bv_cat.simps[of 0 1 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 0 1 \"numeral w1\" 0]\n bv_cat.simps[of 0 1 \"numeral w1\" 1]\n bv_cat.simps[of 0 1 0 \"numeral s1\"]\n bv_cat.simps[of 0 1 0 0]\n bv_cat.simps[of 0 1 0 1]\n bv_cat.simps[of 0 1 1 \"numeral s1\"]\n bv_cat.simps[of 0 1 1 0]\n bv_cat.simps[of 0 1 1 1]\n bv_cat.simps[of 1 \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 1 \"numeral s0\" \"numeral w1\" 0]\n bv_cat.simps[of 1 \"numeral s0\" \"numeral w1\" 1]\n bv_cat.simps[of 1 \"numeral s0\" 0 \"numeral s1\"]\n bv_cat.simps[of 1 \"numeral s0\" 0 0]\n bv_cat.simps[of 1 \"numeral s0\" 0 1]\n bv_cat.simps[of 1 \"numeral s0\" 1 \"numeral s1\"]\n bv_cat.simps[of 1 \"numeral s0\" 1 0]\n bv_cat.simps[of 1 \"numeral s0\" 1 1]\n bv_cat.simps[of 1 0 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 1 0 \"numeral w1\" 0]\n bv_cat.simps[of 1 0 \"numeral w1\" 1]\n bv_cat.simps[of 1 0 0 \"numeral s1\"]\n bv_cat.simps[of 1 0 0 0]\n bv_cat.simps[of 1 0 0 1]\n bv_cat.simps[of 1 0 1 \"numeral s1\"]\n bv_cat.simps[of 1 0 1 0]\n bv_cat.simps[of 1 0 1 1]\n bv_cat.simps[of 1 1 \"numeral w1\" \"numeral s1\"]\n bv_cat.simps[of 1 1 \"numeral w1\" 0]\n bv_cat.simps[of 1 1 \"numeral w1\" 1]\n bv_cat.simps[of 1 1 0 \"numeral s1\"]\n bv_cat.simps[of 1 1 0 0]\n bv_cat.simps[of 1 1 0 1]\n bv_cat.simps[of 1 1 1 \"numeral s1\"]\n bv_cat.simps[of 1 1 1 0]\n bv_cat.simps[of 1 1 1 1]\n for w0 s0 w1 s1\n\nlemma size_bv_cat:\n shows \"snd (bv_cat a b) = snd a + snd b\"\n by (cases a,cases b,auto simp add: bv_cat.simps)\n\nlemma size_bv_slice:\n shows \"snd (bv_slice h l a) = h + 1 - l\"\n by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_cat_prepend_0:\n fixes a :: \"'a::len word\"\n assumes \"s < LENGTH('a)\"\n shows \"bv_cat (0, s') (a,s) = (if s = 0 then 0 else \\s-1,0\\a,s + s')\"\nproof(cases \"s = 0\")\n case True\n thus ?thesis\n by (auto simp add: bv_cat.simps)\nnext\n case False\n {\n fix b :: \"'a::len word\"\n assume b: \"b=0\"\n {\n fix n::nat\n assume n: \"n < LENGTH('a)\" \n {\n fix x h l :: nat\n {\n fix m :: nat\n assume m: \"m < LENGTH('a)\"\n hence \"\\ b !! (LENGTH('a) - 1 - m)\"\n using b\n by auto\n hence \"\\ to_bl b ! m\"\n using m\n by (auto simp add: unfold_test_bit split: if_split_asm)\n }\n hence \"\\((\\h,l\\b)::'a::len word) !! x\"\n apply (cases \"x < LENGTH('a)\";cases \"h < LENGTH('a)\")\n apply (auto simp add: test_bit_of_take_bits)[1]\n using b apply simp\n by (auto simp add: take_bits_def test_bit_bl word_size rev_nth word_rep_drop min_def nth_append)\n }\n note 1 = this\n have \"(fst (bv_cat (b, s') (a,s))) !! n= ((\\s-1,0\\a):: 'a::len word)!!n\"\n using assms n 1 False\n apply (auto split: if_split_asm simp add: test_bit_of_take_bits bv_cat.simps word_ao_nth nth_shiftl)\n using b nth_0 by blast\n }\n hence \"(fst (bv_cat (b, s') (a,s))) = ((\\s-1,0\\a):: 'a::len word)\"\n and \"(snd (bv_cat (b, s') (a,s))) = (s+s')\"\n apply (intro word_eqI)\n by (auto simp add: word_size bv_cat.simps)+\n }\n thus ?thesis\n using False\n apply auto\n by (metis prod.exhaust_sel)\nqed\n\n\n\n\n\nlemma test_bit_of_bv_cat:\n fixes a b :: \"'a ::len0 word \\ nat\"\n assumes \"snd a \\ LENGTH('a)\"\n and \"snd b \\ LENGTH('a)\"\n and \"i < LENGTH('a)\"\n shows \"fst (bv_cat a b) !! i = (if i \\ snd b then (fst a) !! (i - snd b) else (fst b) !! i)\"\n using assms\n by (cases a, cases b,auto simp add: bv_cat.simps test_bit_of_take_bits word_ao_nth nth_shiftl word_size split: if_split_asm)\n\nlemma test_bit_of_bv_slice:\n assumes \"h < \\\"\n shows \"fst (bv_slice h l a) !! n = (if n < Suc h - l then fst a!!(l+n) else False)\"\n using assms\n apply (cases a, cases \"n < \\\",auto simp add: bv_slice.simps test_bit_of_take_bits)\n by (simp add: word_size test_bit_bin')\n\n\n\nlemma bv_slice_bv_cat:\nassumes \"h < \\\"\n and \"snd a \\ \\\"\n and \"snd b \\ \\\"\n shows \"bv_slice h l (bv_cat a b) =\n (if h \\ snd b then\n (if l \\ snd b then\n bv_slice (h - snd b) (l - snd b) a\n else\n bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\n else\n (if l \\ snd b then\n (0,0)\n else\n bv_slice h l b))\"\nproof(cases \"h \\ snd b\")\n case True\n note h = this\n show ?thesis\n proof(cases \"l \\ snd b\")\n case True\n {\n fix i :: nat\n assume \"i < \\\"\n hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice (h - snd b) (l - snd b) a) !! i\"\n using h True assms\n by (auto simp add: bv_cat.simps test_bit_of_bv_slice nth_ucast test_bit_of_bv_cat split: if_split_asm)\n }\n hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice (h - snd b) (l - snd b) a)\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n moreover\n have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice (h - snd b) (l - snd b) a)\"\n using True h\n by (cases a, cases b,auto simp add: size_bv_slice)\n ultimately\n show ?thesis\n using True h\n apply (auto)\n by (metis prod.exhaust_sel)\n next\n case False\n {\n fix i :: nat\n assume \"i < \\\"\n hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b)) !! i\"\n using h False assms\n apply (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat word_ao_nth nth_shiftl size_bv_slice split: if_split_asm)\n by (simp add: Groups.add_ac(2))+\n }\n hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n moreover\n have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n using False h\n by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n ultimately\n show ?thesis\n using False h\n apply (auto)\n by (metis prod.exhaust_sel)\n qed\nnext\n case False\n note h = this\n show ?thesis\n proof(cases \"l \\ snd b\")\n case True\n {\n fix i :: nat\n assume \"i < \\\"\n hence \"fst (bv_slice h l (bv_cat a b)) !! i = (0::longword) !! i\"\n using h True assms\n by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n }\n hence \"fst (bv_slice h l (bv_cat a b)) = 0\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n moreover\n have \"snd (bv_slice h l (bv_cat a b)) = 0\"\n using True h\n by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n ultimately\n show ?thesis\n using True h\n apply (auto)\n by (metis prod.exhaust_sel)\n next\n case False\n {\n fix i :: nat\n assume \"i < \\\"\n hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice h l b) !! i\"\n using h False assms\n by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n }\n hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice h l b)\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n moreover\n have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice h l b)\"\n using False h\n by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n ultimately\n show ?thesis\n using False h\n apply (auto)\n by (metis prod.exhaust_sel)\n qed\nqed\n\n\n\ndefinition \"bv_cat' \\ bv_cat\"\nlemma take_bits_bv_cat:\n fixes a b :: \"'b ::len0 word \\ nat\"\n assumes \"h < LENGTH('b)\"\n and \"snd a \\ LENGTH('b)\"\n and \"snd b \\ LENGTH('b)\"\n shows \"((\\h,l\\ (fst (bv_cat a b)))::'a::len0 word) =\n (if h \\ snd b then\n (if l \\ snd b then\n \\h - snd b,l - snd b\\fst a\n else\n ((\\h,l\\ (fst (bv_cat' a b)))::'a::len0 word))\n else\n (if l \\ snd b then\n 0\n else\n \\h,l\\ (fst b)))\"\nproof(cases \"h \\ snd b\")\n case True\n note h = this\n show ?thesis\n proof(cases \"l \\ snd b\")\n case True\n {\n fix i :: nat\n assume \"i < LENGTH('a)\"\n hence \"((\\h,l\\ (fst (bv_cat a b)))::'a::len0 word) !! i = ((\\h - snd b,l - snd b\\fst a)::'a::len0 word) !! i\"\n using h True assms\n by (auto simp add: bv_cat.simps test_bit_of_take_bits nth_ucast test_bit_of_bv_cat split: if_split_asm)\n }\n hence \"((\\h,l\\ (fst (bv_cat a b)))::'a::len0 word) = ((\\h - snd b,l - snd b\\fst a)::'a::len0 word)\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n thus ?thesis\n using True h\n by auto\n next\n case False\n thus ?thesis\n using h\n by (auto simp add: bv_cat'_def)\n qed\nnext\n case False\n note h = this\n show ?thesis\n proof(cases \"l \\ snd b\")\n case True\n {\n fix i :: nat\n assume \"i < LENGTH('a)\"\n hence \"((\\h,l\\ (fst (bv_cat a b)))::'a::len0 word) !! i = (0::'a::len0 word) !! i\"\n using h True assms\n by (auto simp add: bv_cat.simps nth_ucast test_bit_of_take_bits test_bit_of_bv_cat split: if_split_asm)\n }\n thus ?thesis\n using True h\n apply (auto)\n apply (intro word_eqI)\n by (auto simp add: word_size)\n next\n case False\n {\n fix i :: nat\n assume \"i < LENGTH('a)\"\n hence \"((\\h,l\\ (fst (bv_cat a b)))::'a::len0 word) !! i = (\\h,l\\ (fst b)::'a::len0 word) !! i\"\n using h False assms\n by (auto simp add: bv_cat.simps nth_ucast test_bit_of_take_bits test_bit_of_bv_cat split: if_split_asm)\n\n }\n thus ?thesis\n using False h\n apply (auto)\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\nqed\n\n\nlemma take_bits_bv_slice:\n assumes \"h < \\\"\n and \"h' < \\\"\n shows \"\\h,l\\fst (bv_slice h' l' a) = \\(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\fst a\"\n using assms\n by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_slice_take_bits:\n assumes \"h < \\\"\n and \"h' < LENGTH('a)\"\n fixes a ::\"'a::len0 word\"\n shows \"bv_slice h l (\\h',l'\\a, s) = (\\(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\a, h + 1 - l)\"\n using assms\n by (auto simp add: bv_slice.simps)\n\nlemma bv_slice_bit32:\n fixes a :: longword\n assumes \"s \\ 32\"\n shows \"bv_slice 31 0 (a,s) = (ucast ((\\31,0\\a)::32 word), 32)\"\n using assms\n by (auto simp add: bv_slice.simps)\n\n\n \nlemma bv_slice_nth_bit:\n assumes \"h < \\\"\n shows \"bv_slice h h a = bool_to_bv (fst a !! h)\"\nproof-\n {\n fix i :: nat\n assume \"i < \\\"\n hence \"((\\h,h\\(fst a))::longword) !! i = (if fst a !! h then 1::longword else 0) !! i\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n }\n hence \"((\\h,h\\(fst a))::longword) = (if fst a !! h then 1::longword else 0)\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n thus ?thesis\n by (cases a;auto simp add: bv_slice.simps)\nqed\n\n\n\nsubsection \\Arithmetic\\\n\nlemma BV_Add_bit64:\n fixes a b :: longword\n shows \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (ucast (((\\63,0\\a)::64 word) + \\63,0\\b), 64)\"\nproof-\n have \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (\\63,0\\(a + b), 64)\"\n by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n also have \"... = (ucast ((\\63,0\\(a + b))::64 word), 64)\"\n by (subst ucast_take_bits,simp,simp,simp)\n also have \"... = (ucast (((\\63,0\\a)::64 word) + \\63,0\\b), 64)\"\n by (subst take_bits_plus,simp,simp,simp)\n finally\n show ?thesis\n by auto\nqed\n\nlemma BV_Add_bit33:\n fixes a b :: longword\n shows \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (ucast (((\\32,0\\a)::33 word) + \\32,0\\b), 33)\"\nproof-\n have \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (\\32,0\\(a + b), 33)\"\n by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n also have \"... = (ucast ((\\32,0\\(a + b))::33 word), 33)\"\n by (subst ucast_take_bits,simp,simp,simp)\n also have \"... = (ucast (((\\32,0\\a)::33 word) + \\32,0\\b), 33)\"\n by (subst take_bits_plus,simp,simp,simp)\n finally\n show ?thesis\n by auto\nqed\n\nlemma BV_Add_bit65:\n fixes a b :: longword\n shows \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (ucast (((\\64,0\\a)::65 word) + \\64,0\\b), 65)\"\nproof-\n have \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (\\64,0\\(a + b), 65)\"\n by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n also have \"... = (ucast ((\\64,0\\(a + b))::65 word), 65)\"\n by (subst ucast_take_bits,simp,simp,simp)\n also have \"... = (ucast (((\\64,0\\a)::65 word) + \\64,0\\b), 65)\"\n by (subst take_bits_plus,simp,simp,simp)\n finally\n show ?thesis\n by auto\nqed\n\nsubsection \\Floating Point operations\\\n\ncontext abstract_float\nbegin\n\n\nlemma BV_Plus_bit64:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a, 64) fplus\\<^sup>b\\<^sup>v (\\63,0\\b, 64) = (\\63,0\\(a +\\<^sup>f b), 64)\"\n by (auto simp add: exec_BV_Plus_Double_def)\n\nlemma BV_Plus_bit64_numeral:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a, 64) fplus\\<^sup>b\\<^sup>v (numeral n, 64) = (\\63,0\\(a +\\<^sup>f \\63,0\\((numeral n)::longword)), 64)\"\n by (auto simp add: exec_BV_Plus_Double_def)\n\nlemma BV_Sub_bit64:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a, 64) fsub\\<^sup>b\\<^sup>v (\\63,0\\b, 64) = (\\63,0\\(a -\\<^sup>f b), 64)\"\n by (auto simp add: exec_BV_Sub_Double_def)\n\nlemma BV_Sub_bit64_numeral:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a, 64) fsub\\<^sup>b\\<^sup>v (numeral n, 64) = (\\63,0\\(a -\\<^sup>f \\63,0\\((numeral n)::longword)), 64)\"\n by (auto simp add: exec_BV_Sub_Double_def)\n\nlemma BV_Mult_bit64:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a, 64) fmult\\<^sup>b\\<^sup>v (\\63,0\\b, 64) = (\\63,0\\(a *\\<^sup>f b), 64)\"\n by (auto simp add: exec_BV_Mul_Double_def)\n\nlemma BV_Mult_bit64_numeral_r:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a, 64) fmult\\<^sup>b\\<^sup>v (numeral n, 64) = (\\63,0\\(a *\\<^sup>f \\63,0\\((numeral n)::longword)), 64)\"\n by (auto simp add: exec_BV_Mul_Double_def)\nlemma BV_Mult_bit64_numeral_l:\n fixes a :: \"64 word\"\n shows \"(numeral n, 64) fmult\\<^sup>b\\<^sup>v (\\63,0\\a, 64) = (\\63,0\\(\\63,0\\((numeral n)::longword) *\\<^sup>f a), 64)\"\n by (auto simp add: exec_BV_Mul_Double_def)\nlemma BV_Mult_bit64_0_l:\n fixes a :: \"64 word\"\n shows \"(0, 64) fmult\\<^sup>b\\<^sup>v (\\63,0\\a, 64) = (\\63,0\\(0\\<^sup>+ *\\<^sup>f a), 64)\"\n by (auto simp add: exec_BV_Mul_Double_def plus_zero_def)\nlemma BV_Mult_bit64_0_r:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a, 64) fmult\\<^sup>b\\<^sup>v (0, 64) = (\\63,0\\(a *\\<^sup>f 0\\<^sup>+), 64)\"\n by (auto simp add: exec_BV_Mul_Double_def plus_zero_def)\n\n\nlemma BV_Div_bit64:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a, 64) fdiv\\<^sup>b\\<^sup>v (\\63,0\\b, 64) = (\\63,0\\(a div\\<^sup>f b), 64)\"\n by (auto simp add: exec_BV_Div_Double_def)\n\nlemma BV_Div_bit64_numeral: \n fixes a :: \"64 word\"\n shows \"(\\63,0\\a, 64) fdiv\\<^sup>b\\<^sup>v (numeral n, 64) = (\\63,0\\(a div\\<^sup>f \\63,0\\((numeral n)::longword)), 64)\"\n by (auto simp add: exec_BV_Div_Double_def)\n\nend\n\n\n\nsubsection \\Simplification rules\\\n\n\nlemmas (in abstract_float) bit_vector_simps =\n bv_slice_bv_cat take_bits_bv_slice bv_slice_take_bits take_bits_bv_cat bv_slice_bit32\n bv_cat_prepend_0 size_bv_cat size_bv_slice\n bv_to_bool_bool_to_bv snd_bool_to_bv\n bv_to_bool_True bv_to_bool_True_Suc0\n bv_to_bool_False bv_to_bool_False_Suc0\n BV_Add_bit65 BV_Add_bit64 BV_Add_bit33\n BV_Plus_bit64 BV_Plus_bit64_numeral\n BV_Sub_bit64 BV_Sub_bit64_numeral\n BV_Mult_bit64 BV_Mult_bit64_numeral_r BV_Mult_bit64_numeral_l BV_Mult_bit64_0_l BV_Mult_bit64_0_r\n BV_Div_bit64 BV_Div_bit64_numeral\n bv_slice_bit32\n bv_NOT.simps\n bv_NOT_bool_to_bv bool_to_bv_eq bv_slice_nth_bit\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/current_work/isabelle/BitVector_Rewriting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.29847092614800336}} {"text": "theory flash105Bra imports flash105Rev\n \n begin\nlemma onInv105:\n\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" and \n\n b1:\"r \\ rules N\" and b2:\"invf=inv105 iInv1 iInv2 \"\n shows \"invHoldForRule' s invf r (invariants N)\" \n proof - \nhave c1:\"ex1P N (% iRule1 . r=NI_Local_GetX_PutX1 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_GetX iRule1 )\\ex1P N (% iRule1 . r=NI_Replace iRule1 )\\ex0P N ( r=NI_ShWb N )\\ex0P N ( r=PI_Local_GetX_GetX2 )\\ex0P N ( r=NI_Local_PutXAcksDone )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX7 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak2 iRule1 )\\ex0P N ( r=NI_ReplaceHomeShrVld )\\ex1P N (% iRule1 . r=NI_Remote_Put iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX5 N iRule1 )\\ex0P N ( r=NI_Wb )\\ex1P N (% iRule1 . r=NI_Local_Get_Get iRule1 )\\ex0P N ( r=PI_Local_Replace )\\ex1P N (% iRule1 . r=NI_ReplaceShrVld iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX8 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_InvAck_2 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Nak2 iRule1 iRule2 )\\ex1P N (% iRule1 . r=PI_Remote_Replace iRule1 )\\ex0P N ( r=NI_Nak_Home )\\ex1P N (% iRule1 . r=NI_Local_Get_Put2 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_InvAck_1 iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX11 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX6 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Put2 iRule1 iRule2 )\\ex0P N ( r=PI_Local_Get_Put )\\ex0P N ( r=PI_Local_GetX_PutX1 N )\\ex1P N (% iRule1 . r=NI_InvAck_1_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak2 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX10_home N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_Get iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak3 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX10 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX2 N iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Put1 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_PutX iRule1 )\\ex1P N (% iRule1 . r=Store iRule1 )\\ex0P N ( r=NI_FAck )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX3 N iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX3 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_PutX iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX8_home N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put1 N iRule1 )\\ex0P N ( r=PI_Local_GetX_GetX1 )\\ex0P N ( r=StoreHome )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_Nak iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Inv iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_PutX iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX4 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX4 N iRule1 )\\ex1P N (% iRule1 . r=NI_Nak iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX2 N )\\ex0P N ( r=NI_Local_Put )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak1 iRule1 )\\ex0P N ( r=NI_Nak_Clear )\\ex0P N ( r=PI_Local_PutX )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak3 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_GetX_Nak_Home iRule1 )\\ex0P N ( r=PI_Local_Get_Get )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX9 N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_GetX iRule1 )\\ex0P N ( r=NI_ReplaceHome )\\ex1P N (% iRule1 . r=NI_Remote_GetX_PutX_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put3 iRule1 )\" \n\n apply(cut_tac b1)\n apply auto\n done moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_GetXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ShWb N )\n\"\n \n from c1 have c2:\" r= NI_ShWb N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_ShWb N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ShWbVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX2 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_PutXAcksDone )\n\"\n \n from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutXAcksDoneVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX7 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX7 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX7VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHomeShrVld )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeShrVldVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Put iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Put iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX5 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX5 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX5VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Wb )\n\"\n \n from c1 have c2:\" r= NI_Wb \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Wb ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_WbVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_GetVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Replace )\n\"\n \n from c1 have c2:\" r= PI_Local_Replace \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_ReplaceVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_ReplaceShrVld iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_ReplaceShrVld iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceShrVldVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX8 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX8 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Nak2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Nak2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_ReplaceVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Home )\n\"\n \n from c1 have c2:\" r= NI_Nak_Home \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_HomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_InvAck_1 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_InvAck_1 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX11 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX11 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX11VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX6 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX6 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX6VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Put2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Put2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Put )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_PutVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX1 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_1_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_1_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1_HomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX10_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX10_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10_homeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak3VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX10 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX10 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Put1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Put1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= Store iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= Store iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (Store iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis StoreVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_FAck )\n\"\n \n from c1 have c2:\" r= NI_FAck \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_FAck ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_FAckVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX3 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX3 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX3VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX3 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX3VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_PutX iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_PutX iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX8_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX8_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8_homeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX1 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= StoreHome )\n\"\n \n from c1 have c2:\" r= StoreHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (StoreHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis StoreHomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_Nak iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_Nak iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_NakVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Inv iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Inv iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_PutXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX4 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX4VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX4 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX4 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX4VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Nak iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Nak iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_NakVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX2 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX2VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_Put )\n\"\n \n from c1 have c2:\" r= NI_Local_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak1VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Clear )\n\"\n \n from c1 have c2:\" r= NI_Nak_Clear \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_ClearVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_PutX )\n\"\n \n from c1 have c2:\" r= PI_Local_PutX \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_PutXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak3VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_Nak_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_Nak_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_Nak_HomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Get )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Get \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_GetVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX9 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX9 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX9VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetXVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHome )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_PutX_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_PutX_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutX_HomeVsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put3VsInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n by blast \n qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash105Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757645879592642, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.29846697668568545}} {"text": "theory Combine_Opt\n imports \n \"../Combine\"\n \"Balance_Opt_LR\"\nbegin\n\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\n\npartial_function (M) combine_opt ::\n \"('ki, 'vi) rbti \\ ('ki, 'vi) rbti \\ ('ki, 'vi) rbti llM\" where\n \"combine_opt l_p r_p = do {\n if l_p = null then return r_p\n else if r_p = null then return l_p\n else do {\n l \\ ll_load l_p;\n r \\ ll_load r_p;\n if rbt_node.color l = rbt_node.color r\n then do {\n combined_p \\ combine_opt (rbt_node.right l) (rbt_node.left r);\n is_red_b \\ ll_is_red_br combined_p;\n if is_red_b = ll_True then\n do {\n combined \\ ll_load combined_p;\n case combined of (RBT_NODE cc cl ck cv cr) \\\n do {\n set_right_p cl l_p;\n set_left_p cr r_p;\n ll_store (RBT_NODE cc l_p ck cv r_p) combined_p;\n return combined_p\n }\n }\n else do {\n set_left_p combined_p r_p;\n if rbt_node.color l = 0\n then do {\n set_right_p r_p l_p;\n return l_p\n }\n else do {\n set_right_p r_p l_p;\n balance_left_opt l_p\n }\n }\n }\n else if (rbt_node.color r = 0)\n then do {\n combined_p \\ combine_opt l_p (rbt_node.left r);\n set_left_p combined_p r_p;\n return r_p\n }\n else do { \n combined_p \\ combine_opt (rbt_node.right l) r_p;\n set_right_p combined_p l_p;\n return l_p\n }\n }\n }\"\n\n\nlemma combine_opt_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn l li ** rbt_assn r ri)\n (combine_opt li ri)\n (\\x. rbt_assn (rbt_combine l r) x)\n\"\nproof(induction l r arbitrary: li ri rule: RBT_Impl.combine.induct)\n case (1 x)\n then show ?case \n apply (subst combine_opt.simps)\n apply vcg\n done\nnext\n case (2 v va vb vc vd)\n then show ?case \n apply (subst combine_opt.simps)\n apply vcg\n done\nnext\n case (3 a k x b c s y d)\n note [vcg_rules] = 3\n show ?case\n apply (subst combine_opt.simps)\n apply vcg\n apply (cases \"rbt_combine b c\")\n apply (auto split: color.splits)\n apply vcg\n done\nnext\n case (4 a k x b c s y d)\n note [vcg_rules] = 4\n show ?case\n apply (subst combine_opt.simps)\n apply vcg\n apply (cases \"rbt_combine b c\")\n apply (auto split: color.splits)\n apply vcg\n done\nnext\n case (5 va vb vc vd b k x c)\n note [vcg_rules] = 5\n show ?case\n apply (subst combine_opt.simps)\n apply vcg\n done\nnext\n case (6 a k x b va vb vc vd)\n note [vcg_rules] = 6\n show ?case\n apply (subst combine_opt.simps)\n apply vcg\n done\nqed\n\n\nlemmas [llvm_code] = combine_opt.simps\n\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Delete/Alloc_Optimized/Combine_Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.29839804190599606}} {"text": "theory CoCallImplTTreeSafe\nimports CoCallImplTTree CoCallAnalysisSpec TTreeAnalysisSpec\nbegin\n\nlemma valid_lists_many_calls:\n assumes \"\\ one_call_in_path x p\"\n assumes \"p \\ valid_lists S G\"\n shows \"x--x \\ G\"\nusing assms(2,1)\nproof(induction rule:valid_lists.induct[case_names Nil Cons])\n case Nil thus ?case by simp\nnext\n case (Cons xs x')\n show ?case\n proof(cases \"one_call_in_path x xs\")\n case False\n from Cons.IH[OF this]\n show ?thesis.\n next\n case True\n with \\\\ one_call_in_path x (x' # xs)\\\n have [simp]: \"x' = x\" by (auto split: if_splits)\n\n have \"x \\ set xs\"\n proof(rule ccontr)\n assume \"x \\ set xs\"\n hence \"no_call_in_path x xs\" by (metis no_call_in_path_set_conv)\n hence \"one_call_in_path x (x # xs)\" by simp\n with Cons show False by simp\n qed\n with \\set xs \\ ccNeighbors x' G\\\n have \"x \\ ccNeighbors x G\" by auto\n thus ?thesis by simp\n qed\nqed\n\ncontext CoCallArityEdom\nbegin\n lemma carrier_Fexp': \"carrier (Texp e\\a) \\ fv e\"\n unfolding Texp_simp carrier_ccTTree\n by (rule Aexp_edom)\n\nend\n\n\ncontext CoCallAritySafe\nbegin\n\nlemma carrier_AnalBinds_below:\n \"carrier ((Texp.AnalBinds \\\\(Aheap \\ e\\a)) x) \\ edom ((ABinds \\)\\(Aheap \\ e\\a))\"\nby (auto simp add: Texp.AnalBinds_lookup Texp_def split: option.splits \n elim!: subsetD[OF edom_mono[OF monofun_cfun_fun[OF ABind_below_ABinds]]])\n\nsublocale TTreeAnalysisCarrier Texp\n apply standard\n unfolding Texp_simp carrier_ccTTree\n apply standard\n done\n\nsublocale TTreeAnalysisSafe Texp\nproof\n fix x e a\n\n from edom_mono[OF Aexp_App]\n have \"{x} \\ edom (Aexp e\\(inc\\a)) \\ edom (Aexp (App e x)\\a)\" by auto\n moreover\n {\n have \"ccApprox (many_calls x \\\\ ccTTree (edom (Aexp e\\(inc\\a))) (ccExp e\\(inc\\a))) \n = cc_restr (edom (Aexp e\\(inc\\a))) (ccExp e\\(inc\\a)) \\ ccProd {x} (insert x (edom (Aexp e\\(inc\\a))))\"\n by (simp add: ccApprox_both ccProd_insert2[where S' = \"edom e\" for e])\n also\n have \"edom (Aexp e\\(inc\\a)) \\ fv e\"\n by (rule Aexp_edom)\n also(below_trans[OF eq_imp_below join_mono[OF below_refl ccProd_mono2[OF insert_mono] ]])\n have \"cc_restr (edom (Aexp e\\(inc\\a))) (ccExp e\\(inc\\a)) \\ ccExp e\\(inc\\a)\"\n by (rule cc_restr_below_arg)\n also\n have \"ccExp e\\(inc\\a) \\ ccProd {x} (insert x (fv e)) \\ ccExp (App e x)\\a\" \n by (rule ccExp_App)\n finally\n have \"ccApprox (many_calls x \\\\ ccTTree (edom (Aexp e\\(inc\\a))) (ccExp e\\(inc\\a))) \\ ccExp (App e x)\\a\" by this simp_all\n }\n ultimately\n show \"many_calls x \\\\ Texp e\\(inc\\a) \\ Texp (App e x)\\a\"\n unfolding Texp_simp by (auto intro!: below_ccTTreeI)\nnext\n fix y e n\n show \"without y (Texp e\\(pred\\n)) \\ Texp (Lam [y]. e)\\n\"\n unfolding Texp_simp\n by (auto dest: subsetD[OF Aexp_edom]\n intro!: below_ccTTreeI below_trans[OF _ ccExp_Lam] cc_restr_mono1 subsetD[OF edom_mono[OF Aexp_Lam]])\nnext\n fix e y x a\n\n from edom_mono[OF Aexp_subst]\n have *: \"edom (Aexp e[y::=x]\\a) \\ insert x (edom (Aexp e\\a) - {y})\" by simp\n\n have \"Texp e[y::=x]\\a = ccTTree (edom (Aexp e[y::=x]\\a)) (ccExp e[y::=x]\\a)\"\n unfolding Texp_simp..\n also have \"\\ \\ ccTTree (insert x (edom (Aexp e\\a) - {y})) (ccExp e[y::=x]\\a)\"\n by (rule ccTTree_mono1[OF *])\n also have \"\\ \\ many_calls x \\\\ without x (\\)\"\n by (rule paths_many_calls_subset)\n also have \"without x (ccTTree (insert x (edom (Aexp e\\a) - {y})) (ccExp e[y::=x]\\a))\n = ccTTree (edom (Aexp e\\a) - {y} - {x}) (ccExp e[y::=x]\\a)\"\n by simp\n also have \"\\ \\ ccTTree (edom (Aexp e\\a) - {y} - {x}) (ccExp e\\a)\"\n by (rule ccTTree_cong_below[OF ccExp_subst]) auto\n also have \"\\ = without y (ccTTree (edom (Aexp e\\a) - {x}) (ccExp e\\a))\"\n by simp (metis Diff_insert Diff_insert2)\n also have \"ccTTree (edom (Aexp e\\a) - {x}) (ccExp e\\a) \\ ccTTree (edom (Aexp e\\a)) (ccExp e\\a)\"\n by (rule ccTTree_mono1) auto\n also have \"\\ = Texp e\\a\"\n unfolding Texp_simp..\n finally\n show \"Texp e[y::=x]\\a \\ many_calls x \\\\ without y (Texp e\\a)\"\n by this simp_all\nnext\n fix v a\n have \"up\\a \\ (Aexp (Var v)\\a) v\" by (rule Aexp_Var)\n hence \"v \\ edom (Aexp (Var v)\\a)\" by (auto simp add: edom_def)\n thus \"single v \\ Texp (Var v)\\a\"\n unfolding Texp_simp\n by (auto intro: below_ccTTreeI)\nnext\n fix scrut e1 a e2\n have \"ccTTree (edom (Aexp e1\\a)) (ccExp e1\\a) \\\\ ccTTree (edom (Aexp e2\\a)) (ccExp e2\\a)\n \\ ccTTree (edom (Aexp e1\\a) \\ edom (Aexp e2\\a)) (ccExp e1\\a \\ ccExp e2\\a)\"\n by (rule either_ccTTree)\n note both_mono2'[OF this]\n also\n have \"ccTTree (edom (Aexp scrut\\0)) (ccExp scrut\\0) \\\\ ccTTree (edom (Aexp e1\\a) \\ edom (Aexp e2\\a)) (ccExp e1\\a \\ ccExp e2\\a)\n \\ ccTTree (edom (Aexp scrut\\0) \\ (edom (Aexp e1\\a) \\ edom (Aexp e2\\a))) (ccExp scrut\\0 \\ (ccExp e1\\a \\ ccExp e2\\a) \\ ccProd (edom (Aexp scrut\\0)) (edom (Aexp e1\\a) \\ edom (Aexp e2\\a)))\"\n by (rule interleave_ccTTree)\n also\n have \"edom (Aexp scrut\\0) \\ (edom (Aexp e1\\a) \\ edom (Aexp e2\\a)) = edom (Aexp scrut\\0 \\ Aexp e1\\a \\ Aexp e2\\a)\" by auto\n also\n have \"Aexp scrut\\0 \\ Aexp e1\\a \\ Aexp e2\\a \\ Aexp (scrut ? e1 : e2)\\a\"\n by (rule Aexp_IfThenElse)\n also\n have \"ccExp scrut\\0 \\ (ccExp e1\\a \\ ccExp e2\\a) \\ ccProd (edom (Aexp scrut\\0)) (edom (Aexp e1\\a) \\ edom (Aexp e2\\a)) \\\n ccExp (scrut ? e1 : e2)\\a\"\n by (rule ccExp_IfThenElse)\n \n show \"Texp scrut\\0 \\\\ (Texp e1\\a \\\\ Texp e2\\a) \\ Texp (scrut ? e1 : e2)\\a\"\n unfolding Texp_simp\n by (auto simp add: ccApprox_both join_below_iff below_trans[OF _ join_above2]\n intro!: below_ccTTreeI below_trans[OF cc_restr_below_arg]\n below_trans[OF _ ccExp_IfThenElse] subsetD[OF edom_mono[OF Aexp_IfThenElse]])\nnext\n fix e\n assume \"isVal e\"\n hence [simp]: \"ccExp e\\0 = ccSquare (fv e)\" by (rule ccExp_pap)\n thus \"repeatable (Texp e\\0)\"\n unfolding Texp_simp by (auto intro: repeatable_ccTTree_ccSquare[OF Aexp_edom])\nqed\n\ndefinition Theap :: \"heap \\ exp \\ Arity \\ var ttree\"\n where \"Theap \\ e = (\\ a. if nonrec \\ then ccTTree (edom (Aheap \\ e\\a)) (ccExp e\\a) else ttree_restr (edom (Aheap \\ e\\a)) anything)\"\n\nlemma Theap_simp: \"Theap \\ e\\a = (if nonrec \\ then ccTTree (edom (Aheap \\ e\\a)) (ccExp e\\a) else ttree_restr (edom (Aheap \\ e\\a)) anything)\"\n unfolding Theap_def by simp\n\nlemma carrier_Fheap':\"carrier (Theap \\ e\\a) = edom (Aheap \\ e\\a)\"\n unfolding Theap_simp carrier_ccTTree by simp\n\nsublocale TTreeAnalysisCardinalityHeap Texp Aexp Aheap Theap\nproof\n fix \\ e a\n show \"carrier (Theap \\ e\\a) = edom (Aheap \\ e\\a)\"\n by (rule carrier_Fheap')\nnext\n fix x \\ p e a\n assume \"x \\ thunks \\\"\n \n assume \"\\ one_call_in_path x p\"\n hence \"x \\ set p\" by (rule more_than_one_setD)\n \n assume \"p \\ paths (Theap \\ e\\a)\" with \\x \\ set p\\\n have \"x \\ carrier (Theap \\ e\\a)\" by (auto simp add: Union_paths_carrier[symmetric])\n hence \"x \\ edom (Aheap \\ e\\a)\"\n unfolding Theap_simp by (auto split: if_splits)\n \n show \"(Aheap \\ e\\a) x = up\\0\"\n proof(cases \"nonrec \\\")\n case False\n from False \\x \\ thunks \\\\ \\x \\ edom (Aheap \\ e\\a)\\\n show ?thesis by (rule aHeap_thunks_rec)\n next\n case True\n with \\p \\ paths (Theap \\ e\\a)\\\n have \"p \\ valid_lists (edom (Aheap \\ e\\a)) (ccExp e\\a)\" by (simp add: Theap_simp)\n\n with \\\\ one_call_in_path x p\\\n have \"x--x\\ (ccExp e\\a)\" by (rule valid_lists_many_calls)\n \n from True \\x \\ thunks \\\\ this\n show ?thesis by (rule aHeap_thunks_nonrec)\n qed\nnext\n fix \\ e a\n\n have carrier: \"carrier (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ edom (Aheap \\ e\\a) \\ edom (Aexp (Let \\ e)\\a)\"\n proof(rule carrier_substitute_below)\n from edom_mono[OF Aexp_Let[of \\ e a]]\n show \"carrier (Texp e\\a) \\ edom (Aheap \\ e\\a) \\ edom (Aexp (Let \\ e)\\a)\" by (simp add: Texp_def)\n next\n fix x\n assume \"x \\ edom (Aheap \\ e\\a) \\ edom (Aexp (Let \\ e)\\a)\"\n hence \"x \\ edom (Aheap \\ e\\a) \\ x : (edom (Aexp (Let \\ e)\\a))\" by simp\n thus \"carrier ((Texp.AnalBinds \\\\(Aheap \\ e\\a)) x) \\ edom (Aheap \\ e\\a) \\ edom (Aexp (Let \\ e)\\a)\"\n proof\n assume \"x \\ edom (Aheap \\ e\\a)\"\n \n have \"carrier ((Texp.AnalBinds \\\\(Aheap \\ e\\a)) x) \\ edom (ABinds \\\\(Aheap \\ e\\a))\"\n by (rule carrier_AnalBinds_below)\n also have \"\\ \\ edom (Aheap \\ e\\a \\ Aexp (Terms.Let \\ e)\\a)\"\n using edom_mono[OF Aexp_Let[of \\ e a]] by simp\n finally show ?thesis by simp\n next\n assume \"x \\ edom (Aexp (Terms.Let \\ e)\\a)\"\n hence \"x \\ domA \\\" by (auto dest: subsetD[OF Aexp_edom])\n hence \"(Texp.AnalBinds \\\\(Aheap \\ e\\a)) x = \\\"\n by (rule Texp.AnalBinds_not_there)\n thus ?thesis by simp\n qed\n qed\n\n show \"ttree_restr (- domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ Texp (Let \\ e)\\a\"\n proof (rule below_trans[OF _ eq_imp_below[OF Texp_simp[symmetric]]], rule below_ccTTreeI)\n have \"carrier (ttree_restr (- domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)))\n = carrier (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) - domA \\\" by auto\n also note carrier\n also have \"edom (Aheap \\ e\\a) \\ edom (Aexp (Terms.Let \\ e)\\a) - domA \\ = edom (Aexp (Let \\ e)\\a)\"\n by (auto dest: subsetD[OF edom_Aheap] subsetD[OF Aexp_edom])\n finally\n show \"carrier (ttree_restr (- domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\)(Texp e\\a)))\n \\ edom (Aexp (Terms.Let \\ e)\\a)\" by this auto\n next\n let ?x = \"ccApprox (ttree_restr (- domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)))\"\n \n have \"?x = cc_restr (- domA \\) ?x\" by simp\n also have \"\\ \\ cc_restr (- domA \\) (ccHeap \\ e\\a)\"\n proof(rule cc_restr_mono2[OF wild_recursion_thunked])\n have \"ccExp e\\a \\ ccHeap \\ e\\a\" by (rule ccHeap_Exp)\n thus \"ccApprox (Texp e\\a) \\ ccHeap \\ e\\a\"\n by (auto simp add: Texp_simp intro: below_trans[OF cc_restr_below_arg])\n next\n fix x\n assume \"x \\ domA \\\"\n thus \"(Texp.AnalBinds \\\\(Aheap \\ e\\a)) x = empty\"\n by (metis Texp.AnalBinds_not_there empty_is_bottom)\n next\n fix x\n assume \"x \\ domA \\\"\n then obtain e' where e': \"map_of \\ x = Some e'\" by (metis domA_map_of_Some_the)\n \n show \"ccApprox ((Texp.AnalBinds \\\\(Aheap \\ e\\a)) x) \\ ccHeap \\ e\\a\"\n proof(cases \"(Aheap \\ e\\a) x\")\n case bottom thus ?thesis using e' by (simp add: Texp.AnalBinds_lookup)\n next\n case (up a')\n with e'\n have \"ccExp e'\\a' \\ ccHeap \\ e\\a\" by (rule ccHeap_Heap)\n thus ?thesis using up e'\n by (auto simp add: Texp.AnalBinds_lookup Texp_simp intro: below_trans[OF cc_restr_below_arg])\n qed\n\n show \"ccProd (ccNeighbors x (ccHeap \\ e\\a)- {x} \\ thunks \\) (carrier ((Texp.AnalBinds \\\\(Aheap \\ e\\a)) x)) \\ ccHeap \\ e\\a\"\n proof(cases \"(Aheap \\ e\\a) x\")\n case bottom thus ?thesis using e' by (simp add: Texp.AnalBinds_lookup)\n next\n case (up a')\n have subset: \"(carrier (fup\\(Texp e')\\((Aheap \\ e\\a) x))) \\ fv e'\"\n using up e' by (auto simp add: Texp.AnalBinds_lookup carrier_Fexp dest!: subsetD[OF Aexp_edom])\n \n from e' up\n have \"ccProd (fv e') (ccNeighbors x (ccHeap \\ e\\a) - {x} \\ thunks \\) \\ ccHeap \\ e\\a\"\n by (rule ccHeap_Extra_Edges)\n then\n show ?thesis using e'\n by (simp add: Texp.AnalBinds_lookup Texp_simp ccProd_comm below_trans[OF ccProd_mono2[OF subset]])\n qed\n qed\n also have \"\\ \\ ccExp (Let \\ e)\\a\"\n by (rule ccExp_Let)\n finally\n show \"ccApprox (ttree_restr (- domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)))\n \\ ccExp (Terms.Let \\ e)\\a\" by this simp_all\n qed\n\n note carrier\n hence \"carrier (substitute (ExpAnalysis.AnalBinds Texp \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ edom (Aheap \\ e\\a) \\ - domA \\\"\n by (rule order_trans) (auto dest: subsetD[OF Aexp_edom])\n hence \"ttree_restr (domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a))\n = ttree_restr (edom (Aheap \\ e\\a)) (ttree_restr (domA \\) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)))\"\n by -(rule ttree_restr_noop[symmetric], auto)\n also\n have \"\\ = ttree_restr (edom (Aheap \\ e\\a)) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a))\"\n by (simp add: inf.absorb2[OF edom_Aheap ])\n also\n have \"\\ \\ Theap \\ e \\a\"\n proof(cases \"nonrec \\\")\n case False\n have \"ttree_restr (edom (Aheap \\ e\\a)) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a))\n \\ ttree_restr (edom (Aheap \\ e\\a)) anything\"\n by (rule ttree_restr_mono) simp\n also have \"\\ = Theap \\ e\\a\"\n by (simp add: Theap_simp False)\n finally show ?thesis.\n next\n case [simp]: True\n\n from True\n have \"ttree_restr (edom (Aheap \\ e\\a)) (substitute (Texp.AnalBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a))\n = ttree_restr (edom (Aheap \\ e\\a)) (Texp e\\a)\"\n by (rule nonrecE) (rule ttree_rest_substitute, auto simp add: carrier_Fexp fv_def fresh_def dest!: subsetD[OF edom_Aheap] subsetD[OF Aexp_edom])\n also have \"\\ = ccTTree (edom (Aexp e\\a) \\ edom (Aheap \\ e\\a)) (ccExp e\\a)\"\n by (simp add: Texp_simp)\n also have \"\\ \\ ccTTree (edom (Aexp e\\a) \\ domA \\) (ccExp e\\a)\"\n by (rule ccTTree_mono1[OF Int_mono[OF order_refl edom_Aheap]])\n also have \"\\ \\ ccTTree (edom (Aheap \\ e\\a)) (ccExp e\\a)\"\n by (rule ccTTree_mono1[OF edom_mono[OF Aheap_nonrec[OF True], simplified]])\n also have \"\\ \\ Theap \\ e\\a\"\n by (simp add: Theap_simp)\n finally\n show ?thesis by this simp_all\n qed\n finally\n show \"ttree_restr (domA \\) (substitute (ExpAnalysis.AnalBinds Texp \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ Theap \\ e\\a\".\n\nqed\nend\n\n(* TODO: Unused stuff from here, mostly about singles. Might be useful later. *)\n\n\nlemma paths_singles: \"xs \\ paths (singles S) \\ (\\x \\ S. one_call_in_path x xs)\"\n by transfer (auto simp add: one_call_in_path_filter_conv)\n\nlemma paths_singles': \"xs \\ paths (singles S) \\ (\\x \\ (set xs \\ S). one_call_in_path x xs)\"\n apply transfer\n apply (auto simp add: one_call_in_path_filter_conv)\n apply (erule_tac x = x in ballE)\n apply auto\n by (metis (poly_guards_query) filter_empty_conv le0 length_0_conv)\n\nlemma both_below_singles1:\n assumes \"t \\ singles S\"\n assumes \"carrier t' \\ S = {}\"\n shows \"t \\\\ t' \\ singles S\"\nproof (rule ttree_belowI)\n fix xs\n assume \"xs \\ paths (t \\\\ t')\"\n then obtain ys zs where \"ys \\ paths t\" and \"zs \\ paths t'\" and \"xs \\ ys \\ zs\" by (auto simp add: paths_both)\n with assms \n have \"ys \\ paths (singles S)\" and \"set zs \\ S = {}\"\n by (metis below_ttree.rep_eq contra_subsetD paths.rep_eq, auto simp add: Union_paths_carrier[symmetric])\n with \\xs \\ ys \\ zs\\\n show \"xs \\ paths (singles S)\"\n by (induction) (auto simp add: paths_singles no_call_in_path_set_conv interleave_set dest: more_than_one_setD split: if_splits)\nqed\n\n\nlemma paths_ttree_restr_singles: \"xs \\ paths (ttree_restr S' (singles S)) \\ set xs \\ S' \\ (\\x \\ S. one_call_in_path x xs)\"\nproof\n show \"xs \\ paths (ttree_restr S' (singles S)) \\ set xs \\ S' \\ (\\x \\ S. one_call_in_path x xs)\"\n by (auto simp add: filter_paths_conv_free_restr[symmetric] paths_singles)\nnext\n assume *: \"set xs \\ S' \\ (\\x\\S. one_call_in_path x xs)\"\n hence \"set xs \\ S'\" by auto\n hence [simp]: \"filter (\\ x'. x' \\ S') xs = xs\" by (auto simp add: filter_id_conv)\n \n from *\n have \"xs \\ paths (singles S)\"\n by (auto simp add: paths_singles')\n hence \"filter (\\ x'. x' \\ S') xs \\ filter (\\x'. x' \\ S') ` paths (singles S)\"\n by (rule imageI)\n thus \"xs \\ paths (ttree_restr S' (singles S))\"\n by (auto simp add: filter_paths_conv_free_restr[symmetric] )\nqed\n\n\n\n(* TODO: unused *)\nlemma substitute_not_carrier:\n assumes \"x \\ carrier t\"\n assumes \"\\ x'. x \\ carrier (f x')\"\n shows \"x \\ carrier (substitute f T t)\"\nproof-\n have \"ttree_restr ({x}) (substitute f T t) = ttree_restr ({x}) t\"\n proof(rule ttree_rest_substitute)\n fix x'\n from \\x \\ carrier (f x')\\\n show \"carrier (f x') \\ {x} = {}\" by auto\n qed\n hence \"x \\ carrier (ttree_restr ({x}) (substitute f T t)) \\ x \\ carrier (ttree_restr ({x}) t)\" by metis\n with assms(1)\n show ?thesis by simp\nqed\n\n(* TODO: unused *)\nlemma substitute_below_singlesI:\n assumes \"t \\ singles S\"\n assumes \"\\ x. carrier (f x) \\ S = {}\"\n shows \"substitute f T t \\ singles S\"\nproof(rule ttree_belowI)\n fix xs\n assume \"xs \\ paths (substitute f T t)\"\n thus \"xs \\ paths (singles S)\"\n using assms\n proof(induction f T t xs arbitrary: S rule: substitute_induct)\n case Nil\n thus ?case by simp\n next\n case (Cons f T t x xs)\n\n from \\x#xs \\ _\\\n have xs: \"xs \\ paths (substitute (f_nxt f T x) T (nxt t x \\\\ f x))\" by auto\n moreover\n\n from \\t \\ singles S\\\n have \"nxt t x \\ singles S\" \n by (metis \"TTree-HOLCF.nxt_mono\" below_trans nxt_singles_below_singles)\n from this \\carrier (f x) \\ S = {}\\\n have \"nxt t x \\\\ f x \\ singles S\"\n by (rule both_below_singles1)\n moreover\n { fix x'\n from \\carrier (f x') \\ S = {}\\\n have \"carrier (f_nxt f T x x') \\ S = {}\"\n by (auto simp add: f_nxt_def)\n }\n ultimately\n have IH: \"xs \\ paths (singles S)\"\n by (rule Cons.IH) \n \n show ?case\n proof(cases \"x \\ S\")\n case True\n with \\carrier (f x) \\ S = {}\\\n have \"x \\ carrier (f x)\" by auto\n moreover\n from \\t \\ singles S\\\n have \"nxt t x \\ nxt (singles S) x\" by (rule nxt_mono)\n hence \"carrier (nxt t x) \\ carrier (nxt (singles S) x)\" by (rule carrier_mono)\n from subsetD[OF this] True\n have \"x \\ carrier (nxt t x)\" by auto\n ultimately\n have \"x \\ carrier (nxt t x \\\\ f x)\" by simp\n hence \"x \\ carrier (substitute (f_nxt f T x) T (nxt t x \\\\ f x))\"\n proof(rule substitute_not_carrier)\n fix x' \n from \\carrier (f x') \\ S = {}\\ \\x \\ S\\\n show \"x \\ carrier (f_nxt f T x x')\" by (auto simp add: f_nxt_def)\n qed\n with xs\n have \"x \\ set xs\" by (auto simp add: Union_paths_carrier[symmetric])\n with IH\n have \"xs \\ paths (without x (singles S))\" by (rule paths_withoutI)\n thus ?thesis using True by (simp add: Cons_path)\n next\n case False\n with IH\n show ?thesis by (simp add: Cons_path)\n qed\n qed\nqed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CoCallImplTTreeSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.29827248129282985}} {"text": "section \\Implementation of Relabel-to-Front\\\ntheory Relabel_To_Front_Impl\nimports\n Relabel_To_Front\n Prpu_Common_Impl\nbegin\n \n \nsubsection \\Basic Operations\\ \n \ncontext Network_Impl\nbegin\n \nsubsubsection \\Neighbor Lists\\\ndefinition n_init :: \"(node \\ node list) \\ (node \\ node list) nres\" \n where \"n_init am \\ return (am( s := [], t := []) )\"\n \ndefinition n_at_end :: \"(node \\ node list) \\ node \\ bool nres\" \n where \"n_at_end n u \\ do {\n assert (u\\V-{s,t});\n return (n u = [])\n }\"\n \ndefinition n_get_hd :: \"(node \\ node list) \\ node \\ node nres\" \n where \"n_get_hd n u \\ do {\n assert (u\\V-{s,t} \\ n u \\ []);\n return (hd (n u))\n }\"\n\ndefinition n_move_next \n :: \"(node \\ node list) \\ node \\ (node \\ node list) nres\"\n where \"n_move_next n u \\ do {\n assert (u\\V-{s,t} \\ n u \\ []);\n return (n (u := tl (n u)))\n }\"\n \ndefinition n_reset \n :: \"(node \\ node list) \\ (node \\ node list) \\ node \n \\ (node \\ node list) nres\"\n where \"n_reset am n u \\ do {\n assert (u\\V-{s,t});\n return (n (u := am u))\n }\"\n \nlemma n_init_refine[refine2]: \n assumes AM: \"is_adj_map am\" \n shows \"n_init am \n \\ (spec c. (c, rtf_init_n) \\ (nat_rel \\ \\nat_rel\\list_set_rel))\"\nproof -\n have[simp]: \"am v = []\" if \"v\\V\" for v\n proof -\n from that have \"adjacent_nodes v = {}\" \n unfolding adjacent_nodes_def using E_ss_VxV by auto\n thus ?thesis using am_to_adj_nodes_refine[OF AM] \n by (auto simp: list_set_rel_def in_br_conv)\n qed\n show ?thesis \n unfolding n_init_def rtf_init_n_def \n by (auto \n simp: pw_le_iff refine_pw_simps list_set_autoref_empty \n simp: am_to_adj_nodes_refine[OF AM])\nqed \n \nsubsection \\Refinement to Basic Operations\\ \n \nsubsubsection \\Discharge\\ \ndefinition \"discharge2 am x cf l n u \\ do { \n assert (u \\ V);\n monadic_WHILEIT (\\_. True) \n (\\((x,cf),l,n). do { xu \\ x_get x u; return (xu \\ 0) } ) \n (\\((x,cf),l,n). do {\n at_end \\ n_at_end n u;\n if at_end then do {\n l \\ relabel2 am cf l u;\n n \\ n_reset am n u;\n return ((x,cf),l,n)\n } else do {\n v \\ n_get_hd n u;\n cfuv \\ cf_get cf (u,v);\n lu \\ l_get l u;\n lv \\ l_get l v;\n if (cfuv \\ 0 \\ lu = lv + 1) then do {\n (x,cf) \\ push2 x cf (u,v);\n return ((x,cf),l,n)\n } else do {\n n \\ n_move_next n u;\n return ((x,cf),l,n)\n }\n }\n }) ((x,cf),l,n)\n}\"\n\nlemma discharge_structure_refine_aux:\n assumes SR: \"(ni,n)\\nat_rel \\ \\nat_rel\\list_set_rel\"\n assumes SU: \"(ui,u)\\Id\" \n assumes fNR: \"fNi \\ \\R fN\"\n assumes UIV: \"u\\V-{s,t}\" \n assumes fSR: \"\\v vi vs. \\ \n (vi,v)\\Id; v\\n u; ni u = v#vs; (v#vs,n u)\\\\nat_rel\\list_set_rel \n \\ \\ fSi vi \\ \\R (fS v)\"\n shows\n \"( do {\n at_end \\ n_at_end ni ui;\n if at_end then fNi\n else do {\n v \\ n_get_hd ni ui;\n fSi v\n }\n } ) \\ \\R (\n\n do {\n v \\ select v. v\\n u;\n case v of\n None \\ fN\n | Some v \\ fS v\n })\" (is \"?lhs \\\\R ?rhs\")\n unfolding n_at_end_def n_get_hd_def\n apply (simp only: nres_monad_laws) \n apply (cases \"ni u\")\n subgoal\n using fun_relD[OF SR SU] SU UIV fNR\n by (auto simp: list_set_rel_def in_br_conv pw_le_iff refine_pw_simps)\n \n subgoal for v vs\n using fun_relD[OF SR SU] SU UIV\n using fSR[OF IdI[of v], of vs] \n apply (clarsimp \n simp: list_set_rel_def in_br_conv pw_le_iff refine_pw_simps \n split: option.splits)\n by fastforce \n done \n \nlemma xf_rel_RELATES[refine_dref_RELATES]: \"RELATES xf_rel\" \n by (auto simp: RELATES_def)\n \nlemma discharge2_refine[refine]: \n assumes A: \"((x,cf),f) \\ xf_rel\"\n assumes AM: \"(am,adjacent_nodes)\\nat_rel\\\\nat_rel\\list_set_rel\"\n assumes [simplified,simp]: \"(li,l)\\Id\" \"(ui,u)\\Id\"\n assumes NR: \"(ni,n)\\nat_rel \\ \\nat_rel\\list_set_rel\" \n shows \"discharge2 am x cf li ni ui \n \\ \\(xf_rel \\\\<^sub>r Id \\\\<^sub>r (nat_rel \\ \\nat_rel\\list_set_rel)) (discharge f l n u)\" \n unfolding discharge2_def discharge_def\n apply (rewrite in \"monadic_WHILEIT _ _ \\ _\" vcg_intro_frame) \n apply refine_rcg \n apply (vc_solve simp: A NR)\n subgoal by (simp add: xf_rel_def x_get_def) \n subgoal for f l n x cf ni \n apply (subst vcg_rem_frame)\n unfolding n_reset_def cf_get_def l_get_def n_move_next_def \n apply (simp only: nres_monad_laws) \n apply (rule discharge_structure_refine_aux; (refine_vcg AM)?; (assumption)?) \n apply (vc_solve simp: fun_relD fun_relD[OF AM]) \n subgoal for v vs unfolding xf_rel_def Graph.E_def by auto\n subgoal for v vs by (auto simp: list_set_rel_def in_br_conv) \n done\n done\n \nsubsubsection \\ Initialization of Queue \\\n \nlemma V_is_adj_nodes: \"V = { v . adjacent_nodes v \\ {} }\"\n unfolding V_def adjacent_nodes_def by auto\n \ndefinition \"init_CQ am \\ do {\n let cardV=0;\n let Q=[];\n nfoldli [0.._. True) (\\v (cardV,Q). do {\n assert (v am_is_in_V am v;\n if inV then do {\n let cardV = cardV + 1;\n if v\\s \\ v\\t then\n return (cardV,v#Q)\n else \n return (cardV,Q)\n } else\n return (cardV,Q)\n }) (cardV,Q)\n}\" \n\nlemma init_CQ_correct[THEN order_trans, refine_vcg]:\n assumes AM: \"is_adj_map am\" \n shows \"init_CQ am \\ SPEC (\\(C,Q). C = card V \\ distinct Q \\ set Q = V-{s,t})\"\n unfolding init_CQ_def \n apply (refine_vcg \n nfoldli_rule[where \n I=\"\\l1 _ (C,Q). \n C = card (V\\set l1) \\ distinct Q \\ set Q = (V\\set l1)-{s,t} \"]\n ) \n apply (clarsimp_all simp: am_to_adj_nodes_refine[OF AM])\n using V_ss by (auto simp: upt_eq_lel_conv Int_absorb2)\n \nsubsubsection \\Main Algorithm\\ \n \ndefinition \"relabel_to_front2 am \\ do {\n (cardV, L_right) \\ init_CQ am;\n\n xcf \\ pp_init_xcf2 am;\n l \\ l_init cardV;\n n \\ n_init am;\n\n let L_left=[];\n\n ((x,cf),l,n,L_left,L_right) \\ while\\<^sub>T \n (\\((x,cf),l,n,L_left,L_right). L_right \\ []) \n (\\((x,cf),l,n,L_left,L_right). do {\n assert (L_right \\ []);\n let u = hd L_right;\n old_lu \\ l_get l u;\n \n ((x,cf),l,n) \\ discharge2 am x cf l n u;\n \n lu \\ l_get l u;\n if (lu \\ old_lu) then do {\n \\ \\Move \\u\\ to front of \\l\\, and restart scanning \\L\\. The cost for\\\n \\ \\\\rev_append\\ is amortized by going to next node in \\L\\\\\n let (L_left,L_right) = ([u],rev_append L_left (tl L_right));\n return ((x,cf),l,n,L_left,L_right)\n } else do {\n \\ \\Goto next node in \\L\\\\\n let (L_left,L_right) = (u#L_left, tl L_right);\n return ((x,cf),l,n,L_left,L_right)\n }\n \n }) (xcf,l,n,L_left,L_right);\n\n return cf\n}\"\n \n \nlemma relabel_to_front2_refine[refine]: \n assumes AM: \"is_adj_map am\" \n shows \"relabel_to_front2 am \n \\ \\(br (flow_of_cf) (RPreGraph c s t)) relabel_to_front\"\nproof -\n define s_rel \n :: \"( _ \\ (\n capacity_impl flow \n \\ (nat\\nat) \n \\ (node\\node set) \n \\ node list \n \\ node list)) set\"\n where \"s_rel \\ \n xf_rel \n \\\\<^sub>r Id \n \\\\<^sub>r (nat_rel \\ \\nat_rel\\list_set_rel) \n \\\\<^sub>r br rev (\\_. True) \n \\\\<^sub>r Id\"\n \n have [refine_dref_RELATES]: \"RELATES s_rel\" unfolding RELATES_def ..\n \n {\n fix f l n\n assume \"neighbor_invar c s t f l n\"\n then interpret neighbor_invar c s t f l n . \n have G1: \"flow_of_cf cf = f\" by (rule fo_rg_inv)\n have G2: \"RPreGraph c s t cf\" by (rule is_RPreGraph)\n note G1 G2 \n } note AUX1=this \n \n have AUXR: \"do {\n (cardV, L_right) \\ init_CQ am;\n xcf \\ pp_init_xcf2 am;\n l \\ l_init cardV;\n n \\ n_init am;\n Fi L_right xcf l n\n }\n \\ \\R (do {\n L_right \\ spec l. distinct l \\ set l = V - {s, t};\n F L_right\n })\n \" \n if \"\\L_right xcf n. \n \\ (xcf,pp_init_f)\\xf_rel; (n,rtf_init_n) \\ nat_rel \\ \\nat_rel\\list_set_rel \\\n \\ Fi L_right xcf pp_init_l n \\ \\R (F L_right)\"\n for Fi F R\n unfolding l_init_def\n apply (rule refine2specI)\n supply pp_init_xcf2_refine\n [OF AM, unfolded conc_fun_RETURN, THEN order_trans, refine_vcg] \n supply n_init_refine[OF AM,THEN order_trans, refine_vcg] \n apply (refine_vcg AM V_ss)\n apply clarsimp \n subgoal for L_right x cf n\n using that[of \"(x,cf)\" n L_right]\n unfolding pp_init_l_def \n by (clarsimp simp: pw_le_iff refine_pw_simps; meson) \n done \n show ?thesis\n unfolding relabel_to_front2_def relabel_to_front_def Let_def l_get_def\n apply (simp only: nres_monad_laws) \n apply (rule AUXR) \n apply (refine_rcg)\n apply refine_dref_type\n unfolding s_rel_def\n apply (vc_solve \n simp: in_br_conv rev_append_eq xf_rel_def AUX1 fun_relD \n simp: am_to_adj_nodes_refine[OF AM])\n done \nqed \n \n \nsubsection \\Refinement to Efficient Data Structures\\ \n \ncontext includes Network_Impl_Sepref_Register \nbegin \n sepref_register n_init \n sepref_register n_at_end\n sepref_register n_get_hd\n sepref_register n_move_next\n sepref_register n_reset\n sepref_register discharge2\n sepref_register \"init_CQ\"\n sepref_register relabel_to_front2\nend \n \nsubsubsection \\Neighbor Lists by Array of Lists\\ \ndefinition \"n_assn \\ is_nf N ([]::nat list)\" \n \ndefinition (in -) \"n_init_impl s t am \\ do {\n n \\ array_copy am;\n n \\ Array.upd s [] n;\n n \\ Array.upd t [] n;\n return n\n}\" \n \nlemma [sepref_fr_rules]: \n \"(n_init_impl s t,PR_CONST n_init) \\ am_assn\\<^sup>k \\\\<^sub>a n_assn\" \n apply sepref_to_hoare\n unfolding am_assn_def n_assn_def n_init_impl_def n_init_def\n by (sep_auto) \n \ndefinition (in -) \"n_at_end_impl n u \\ do {\n nu \\ Array.nth n u;\n return (is_Nil nu)\n}\"\n \nlemma [sepref_fr_rules]: \n \"(uncurry n_at_end_impl, uncurry (PR_CONST n_at_end)) \n \\ n_assn\\<^sup>k *\\<^sub>a node_assn\\<^sup>k \\\\<^sub>a bool_assn\" \n apply sepref_to_hoare unfolding n_at_end_impl_def n_at_end_def n_assn_def\n by (sep_auto simp: refine_pw_simps split: list.split)\n \ndefinition (in -) \"n_get_hd_impl n u \\ do {\n nu \\ Array.nth n u;\n return (hd nu)\n}\" \nlemma [sepref_fr_rules]: \n \"(uncurry n_get_hd_impl, uncurry (PR_CONST n_get_hd)) \n \\ n_assn\\<^sup>k *\\<^sub>a node_assn\\<^sup>k \\\\<^sub>a node_assn\" \n apply sepref_to_hoare unfolding n_get_hd_impl_def n_get_hd_def n_assn_def\n by (sep_auto simp: refine_pw_simps)\n \ndefinition (in -) \"n_move_next_impl n u \\ do {\n nu \\ Array.nth n u;\n n \\ Array.upd u (tl nu) n;\n return n\n}\" \nlemma [sepref_fr_rules]: \n \"(uncurry n_move_next_impl, uncurry (PR_CONST n_move_next)) \n \\ n_assn\\<^sup>d *\\<^sub>a node_assn\\<^sup>k \\\\<^sub>a n_assn\" \n apply sepref_to_hoare \n unfolding n_move_next_impl_def n_move_next_def n_assn_def\n by (sep_auto simp: refine_pw_simps)\n \ndefinition (in -) \"n_reset_impl am n u \\ do {\n nu \\ Array.nth am u;\n n \\ Array.upd u nu n;\n return n\n}\"\nlemma [sepref_fr_rules]: \n \"(uncurry2 n_reset_impl, uncurry2 (PR_CONST n_reset)) \n \\ am_assn\\<^sup>k *\\<^sub>a n_assn\\<^sup>d *\\<^sub>a node_assn\\<^sup>k \\\\<^sub>a n_assn\" \n apply sepref_to_hoare \n unfolding n_reset_impl_def n_reset_def n_assn_def am_assn_def\n by (sep_auto simp: refine_pw_simps)\n \nsubsubsection \\Discharge\\ \nsepref_thm discharge_impl is \"uncurry5 (PR_CONST discharge2)\" \n :: \"am_assn\\<^sup>k *\\<^sub>a x_assn\\<^sup>d *\\<^sub>a cf_assn\\<^sup>d *\\<^sub>a l_assn\\<^sup>d *\\<^sub>a n_assn\\<^sup>d *\\<^sub>a node_assn\\<^sup>k \n \\\\<^sub>a (x_assn \\\\<^sub>a cf_assn) \\\\<^sub>a l_assn \\\\<^sub>a n_assn\" \n unfolding discharge2_def PR_CONST_def\n by sepref \nconcrete_definition (in -) discharge_impl \n uses Network_Impl.discharge_impl.refine_raw is \"(uncurry5 ?f,_)\\_\"\nlemmas [sepref_fr_rules] = discharge_impl.refine[OF Network_Impl_axioms] \n\nsubsubsection \\Initialization of Queue\\ \n \nsepref_thm init_CQ_impl is \"(PR_CONST init_CQ)\" \n :: \"am_assn\\<^sup>k \\\\<^sub>a nat_assn \\\\<^sub>a list_assn nat_assn\"\n unfolding init_CQ_def PR_CONST_def\n apply (rewrite HOL_list.fold_custom_empty)\n by sepref\nconcrete_definition (in -) init_CQ_impl \n uses Network_Impl.init_CQ_impl.refine_raw is \"(?f,_)\\_\"\nlemmas [sepref_fr_rules] = init_CQ_impl.refine[OF Network_Impl_axioms] \n \nsubsubsection \\Main Algorithm\\ \nsepref_thm relabel_to_front_impl is \n \"(PR_CONST relabel_to_front2)\" :: \"am_assn\\<^sup>k \\\\<^sub>a cf_assn\" \n unfolding relabel_to_front2_def PR_CONST_def\n supply [[goals_limit = 1]] \n apply (rewrite in \"Let [] _\" HOL_list.fold_custom_empty)\n apply (rewrite in \"[_]\" HOL_list.fold_custom_empty)\n by sepref \nconcrete_definition (in -) relabel_to_front_impl \n uses Network_Impl.relabel_to_front_impl.refine_raw is \"(?f,_)\\_\"\nlemmas [sepref_fr_rules] = relabel_to_front_impl.refine[OF Network_Impl_axioms]\n \nend \\ \\Network Implementation Locale\\ \n \nexport_code relabel_to_front_impl checking SML_imp\n \nsubsection \\Combination with Network Checker and Correctness\\ \ncontext Network_Impl begin\n \n theorem relabel_to_front_impl_correct[sep_heap_rules]: \n assumes AM: \"is_adj_map am\"\n shows \"\n \n relabel_to_front_impl c s t N ami\n <\\cfi. \\\\<^sub>Acf. cf_assn cf cfi \n * \\(isMaxFlow (flow_of_cf cf) \\ RGraph_Impl c s t N cf)>\\<^sub>t\"\n proof -\n note relabel_to_front2_refine[OF AM] \n also note relabel_to_front_correct\n finally have R1: \n \"relabel_to_front2 am \n \\ \\ (br flow_of_cf (RPreGraph c s t)) (SPEC isMaxFlow)\" . \n\n have [simp]: \"nofail (\\R (RES X))\" for R X by (auto simp: refine_pw_simps)\n \n note R2 = relabel_to_front_impl.refine[\n OF Network_Impl_axioms, to_hnr, unfolded autoref_tag_defs]\n note R3 = hn_refine_ref[OF R1 R2, of ami] \n note R4 = R3[unfolded hn_ctxt_def pure_def, THEN hn_refineD, simplified]\n\n note RGII = rgraph_and_network_impl_imp_rgraph_impl[OF \n RPreGraph.maxflow_imp_rgraph\n Network_Impl_axioms\n ] \n \n show ?thesis \n by (sep_auto heap: R4 simp: pw_le_iff refine_pw_simps in_br_conv RGII)\n qed\nend \n\ndefinition \"relabel_to_front_impl_tab_am c s t N am \\ do {\n ami \\ Array.make N am; \\ \\TODO/DUP: Called \\init_ps\\ in Edmonds-Karp impl\\\n relabel_to_front_impl c s t N ami\n}\" \n \ntheorem relabel_to_front_impl_tab_am_correct[sep_heap_rules]: \n assumes NW: \"Network c s t\"\n assumes VN: \"Graph.V c \\ {0.. \n relabel_to_front_impl_tab_am c s t N am\n <\\cfi. \\\\<^sub>Acf. \n asmtx_assn N id_assn cf cfi \n * \\(Network.isMaxFlow c s t (Network.flow_of_cf c cf)\n \\ RGraph_Impl c s t N cf\n )>\\<^sub>t\"\nproof -\n interpret Network c s t by fact\n interpret Network_Impl c s t N using VN by unfold_locales \n \n from ABS_PS have [simp]: \"am u = []\" if \"u\\N\" for u\n unfolding is_adj_map_def\n using E_ss_VxV VN that \n apply (subgoal_tac \"u\\V\") \n by (auto simp del: inV_less_N)\n \n show ?thesis\n unfolding relabel_to_front_impl_tab_am_def \n apply vcg\n apply (rule \n Hoare_Triple.cons_rule[OF _ _ relabel_to_front_impl_correct[OF ABS_PS]])\n subgoal unfolding am_assn_def is_nf_def by sep_auto\n subgoal unfolding cf_assn_def by sep_auto\n done \nqed \n \ndefinition \"relabel_to_front el s t \\ do {\n case prepareNet el s t of\n None \\ return None\n | Some (c,am,N) \\ do {\n cf \\ relabel_to_front_impl_tab_am c s t N am;\n return (Some (c,am,N,cf))\n }\n}\"\nexport_code relabel_to_front checking SML_imp\n\ntext \\\n Main correctness statement:\n \\<^item> If \\relabel_to_front\\ returns \\None\\, the edge list was invalid or described \n an invalid network. \n \\<^item> If it returns \\Some (c,am,N,cfi)\\, then the edge list is valid and describes\n a valid network. Moreover, \\cfi\\ is an integer square matrix of \n dimension \\N\\, which describes a valid residual graph in the network, whose\n corresponding flow is maximal. Finally, \\am\\ is a valid adjacency map of the\n graph, and the nodes of the graph are integers less than \\N\\.\n\\ \ntheorem relabel_to_front_correct:\n \"\n relabel_to_front el s t\n <\\\n None \\ \\(\\ln_invar el \\ \\Network (ln_\\ el) s t)\n | Some (c,am,N,cfi) \\ \n \\(c = ln_\\ el \\ ln_invar el) \n * (\\\\<^sub>Acf. asmtx_assn N int_assn cf cfi\n * \\(RGraph_Impl c s t N cf \n \\ Network.isMaxFlow c s t (Network.flow_of_cf c cf))) \n * \\(Graph.is_adj_map c am)\n >\\<^sub>t\n \"\n unfolding relabel_to_front_def\n using prepareNet_correct[of el s t]\n by (sep_auto simp: ln_rel_def in_br_conv)\n \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Prpu_Maxflow/Relabel_To_Front_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.29827247364548753}} {"text": "(* Title: HOL/Auth/n_mutualEx.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx imports n_mutualEx_lemma_invs_on_rules n_mutualEx_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\ f. f \\ (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\ f ini s. f \\ (invariants N) --> ini \\ {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n fix f ini s\n assume b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n have b4: \"formEval (andList (allInitSpecs N)) s\"\n apply (cut_tac b2 b3, simp) done\n show \"formEval f s\"\n apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\ f r s. f \\ invariants N --> r \\ rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n fix f r s\n assume b1: \"f \\ invariants N\" and b2: \"r \\ rules N\"\n show \"invHoldForRule s f r (invariants N)\"\n apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\n apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.29827247364548753}} {"text": "\\<^marker>\\creator Bernhard Pöttinger\\\n\nchapter \\Footprints of Modifications to Flow Graphs\\\ntheory Flow_Footprint\nimports Flow_Base Flow_Extensions\nbegin\n\nparagraph \\Summary\\\ntext \\A theoretical result on the footprint of flow interfaces.\\\ntext \\@{cite \\def. 7\\ krishna19b}\\\n\nparagraph \\Major Definitions\\\ntext \\\\<^item> @{text flow_footprint}\n\\<^item> @{text the_flow_footprint}\\\n\nparagraph \\Major Theorems\\\ntext \\\\<^item> @{cite \\lem. 4\\ krishna19b}\n\\<^item> flow footprints are unique\\\n\nsection \\Flow Footprints\\\n\ndefinition flow_footprint where\n \"flow_footprint \\ \\h h' h1'.\n (\\h1 h2. h = h1 + h2 \\ h' = h1' + h2 \\ int_fg h1 = int_fg h1' \\\n (\\h1''. (\\h1 h2. h = h1 + h2 \\ h' = h1'' + h2 \\ int_fg h1 = int_fg h1'')\n \\ (dom_fg h1' \\ dom_fg h1'')))\"\n\ndefinition \"the_flow_footprint \\ \\h h'. (THE h1'. flow_footprint h h' h1')\"\n\ntext \\\nThe proof structure of @{text in_footprint_iff_changed}@{cite \\lem. 4\\ krishna19b} is:\n@{text in_footprint_iff_changed}\n- ==> @{text in_footprint_iff_changed1}\n- <== @{text in_footprint_iff_changed2}\n\\\n\nlemma in_footprint_iff_changed1:\n assumes \"int_fg h = int_fg h'\" \"h \\ bot\" \"h' \\ bot\" \"n \\ dom_fg h\" \"flow_footprint h h' h1'\"\n \"fg {n} (edge_fg h) (flow_fg h) \\ fg {n} (edge_fg h') (flow_fg h')\"\n shows \"n \\ dom_fg h1'\"\nproof -\n have *: \"flow_fg h n \\ flow_fg h' n \\ edge_fg h n \\ edge_fg h' n\"\n proof (rule ccontr, goal_cases)\n case 1\n then have *: \"flow_fg h n = flow_fg h' n\" \"edge_fg h n = edge_fg h' n\" by auto\n have \"fg {n} (edge_fg h) (flow_fg h) = fg {n} (edge_fg h') (flow_fg h')\"\n apply (rule fg_cong) using assms * by auto\n then show ?case using assms by simp\n qed\n\n obtain h1 h2 where **: \"h = h1 + h2\" \"h' = h1' + h2\" \"int_fg h1 = int_fg h1'\"\n \"\\h1''. (\\h1 h2. h = h1 + h2 \\ h' = h1'' + h2 \\ int_fg h1 = int_fg h1'')\n \\ (dom_fg h1' \\ dom_fg h1'')\"\n using assms unfolding flow_footprint_def by blast\n\n have \"n \\ dom_fg h2\"\n proof\n assume AA: \"n \\ dom_fg h2\"\n consider (a) \"flow_fg h n \\ flow_fg h' n\" | (b) \"edge_fg h n \\ edge_fg h' n\"\n using * by blast\n then show False\n proof cases\n case a\n moreover have \"flow_fg h n = flow_fg h' n\"\n using ** AA assms flow_fg_plus_fg_on2[of h1 h2] flow_fg_plus_fg_on2[of h1' h2]\n by simp\n ultimately show ?thesis\n by simp\n next\n case b\n moreover have \"edge_fg h n = edge_fg h' n\"\n using ** AA assms edge_fg_plus_fg_on2[of h1 h2] edge_fg_plus_fg_on2[of h1' h2]\n by simp\n ultimately show ?thesis\n by simp\n qed\n qed\n moreover have \"dom_fg h = dom_fg h1 \\ dom_fg h2\" \"dom_fg h1 \\ dom_fg h2 = {}\"\n using assms ** by auto\n ultimately have \"n \\ dom_fg h1\"\n using assms by simp\n then show ?thesis\n using assms **\n by (metis dom_fi_int_fg)\nqed\n\nlemma in_footprint_iff_changed2:\n assumes \"int_fg h = int_fg h'\" \"h \\ bot\" \"h' \\ bot\" \"n \\ dom_fg h\" \"flow_footprint h h' h1'\"\n \"n \\ dom_fg h1'\"\n shows \"fg {n} (edge_fg h) (flow_fg h) \\ fg {n} (edge_fg h') (flow_fg h')\"\nproof\n (* proof by contradiction: we construct a \"smaller\" h1' which can not exist due to minimality\n of h1'. The false assumption fg {n} ... = fg {n} ... implies that we can move n\n from h1' to h2. *)\n\n let ?h = \"fg {n} (edge_fg h) (flow_fg h)\"\n let ?h' = \"fg {n} (edge_fg h') (flow_fg h')\"\n\n (* first show that ?h is valid in order to access its components*)\n obtain g1 g2 where J: \"h = g1 + g2 \\ dom_fg g1 = {n} \\ dom_fg g2 = dom_fg h - {n} \\\n edge_fg h = edge_fg g1 on {n} \\ edge_fg h = edge_fg g2 on dom_fg h - {n} \\\n flow_fg h = flow_fg g1 on {n} \\ flow_fg h = flow_fg g2 on dom_fg h - {n}\"\n \"g1 \\ bot\" \"g2 \\ bot\"\n using split_fg[of h \"{n}\" \"dom_fg h - {n}\"] assms by blast\n\n have \"g1 = fg (dom_fg g1) (edge_fg g1) (flow_fg g1)\" by (simp add: J(2))\n have \"?h = fg (dom_fg g1) (edge_fg g1) (flow_fg g1)\"\n apply (rule fg_cong) using J \\g1 \\ bot\\ by auto\n then have \"?h \\ bot\" using \\g1 \\ bot\\ by simp\n (* then we can show that the assumption that we obtain from our proof by contradiction\n implies equality of edge and flow on n *)\n moreover assume AA: \"?h = ?h'\"\n ultimately have EE: \"edge_fg h n = edge_fg h' n\" \"flow_fg h n = flow_fg h' n\"\n using fg_eqD[of ?h ?h']\n apply (metis edge_fg_fg singletonI)\n using fg_eqD[of ?h ?h'] \n by (metis AA \\fg {n} (edge_fg h) (flow_fg h) \\ bot\\ flow_fg_fg singletonI)\n\n (* unfold the flow footprint assumption *)\n obtain h1 h2 where **: \"h = h1 + h2\" \"h' = h1' + h2\" \"int_fg h1 = int_fg h1'\"\n \"\\h1''. (\\h1 h2. h = h1 + h2 \\ h' = h1'' + h2 \\ int_fg h1 = int_fg h1'')\n \\ (dom_fg h1' \\ dom_fg h1'')\"\n using assms unfolding flow_footprint_def by blast\n\n (* some observations *)\n have X: \"dom_fg h1 = dom_fg h1'\"\n using ** dom_fi_int_fg[of h1] dom_fi_int_fg[of h1']\n by simp\n\n have \"dom_fg h = (dom_fg h1 - {n}) \\ (dom_fg h2 \\ {n})\"\n \"(dom_fg h1 - {n}) \\ (dom_fg h2 \\ {n}) = {}\"\n using ** plus_fg_dom_un assms plus_fg_dom_disj by blast+\n\n (* fact 1: split h into hh1 and hh2 such that n is now part of hh2 instead of hh1 *)\n then obtain hh1 hh2 where C: \"h = hh1 + hh2\" \"dom_fg hh1 = dom_fg h1 - {n}\"\n \"dom_fg hh2 = dom_fg h2 \\ {n}\"\n \"edge_fg h = edge_fg hh2 on dom_fg h2 \\ {n}\" \"flow_fg h = flow_fg hh2 on dom_fg h2 \\ {n}\"\n \"edge_fg h = edge_fg hh1 on dom_fg h1 - {n}\" \"flow_fg h = flow_fg hh1 on dom_fg h1 - {n}\"\n using split_fg[of h \"dom_fg h1 - {n}\" \"dom_fg h2 \\ {n}\"] assms\n by auto\n\n have \"dom_fg h' = (dom_fg h1 - {n}) \\ (dom_fg h2 \\ {n})\"\n \"(dom_fg h1 - {n}) \\ (dom_fg h2 \\ {n}) = {}\"\n using X ** plus_fg_dom_un assms plus_fg_dom_disj by blast+\n\n (* fact 2: split h' into hh1' and hh2' such that n is now part of hh2 instead of hh1' *)\n then obtain hh1' hh2' where D: \"h' = hh1' + hh2'\" \"dom_fg hh1' = dom_fg h1 - {n}\"\n \"dom_fg hh2' = dom_fg h2 \\ {n}\"\n \"edge_fg h' = edge_fg hh2' on dom_fg h2 \\ {n}\" \"flow_fg h' = flow_fg hh2' on dom_fg h2 \\ {n}\"\n \"edge_fg h' = edge_fg hh1' on dom_fg h1 - {n}\" \"flow_fg h' = flow_fg hh1' on dom_fg h1 - {n}\"\n using split_fg[of h' \"dom_fg h1 - {n}\" \"dom_fg h2 \\ {n}\"] assms\n by auto\n\n have E0: \"edge_fg h' = edge_fg h2 on (dom_fg h2)\" \"edge_fg h = edge_fg h2 on (dom_fg h2)\"\n \"flow_fg h' = flow_fg h2 on (dom_fg h2)\" \"flow_fg h = flow_fg h2 on (dom_fg h2)\"\n using ** assms edge_fg_plus_fg_on2 flow_fg_plus_fg_on2 by blast+\n\n (* notice that h = h1 + h2 and h' = h1' + h2 imply hh2 = hh2' *)\n have E1: \"hh2 = hh2'\"\n apply (rule fg_eqI)\n using C D EE apply auto[1]\n using D(1) assms(3) plus_fg_ops_exist apply blast\n using C D EE E0 by auto\n then have E2: \"int_fg hh2 = int_fg hh2'\"\n by simp\n\n have \"int_fg hh1 + int_fg hh2 = int_fg h\"\n by (simp add: C(1) int_fg_fi_hom)\n also have \"... = int_fg h'\"\n using assms by simp\n also have \"... = int_fg hh1' + int_fg hh2'\"\n by (simp add: D(1) int_fg_fi_hom)\n (* fact 3: interface have to be equal *)\n finally have E2: \"int_fg hh1 = int_fg hh1'\"\n using E2 plus_fi_cancel_left[of \"int_fg hh1\" \"int_fg hh2\"] int_fg_fi_hom[of hh1 hh2] assms C\n by simp\n\n (* we collected all facts 1-3 that are required to contradict minimality of h1' *)\n have \"h = hh1 + hh2\" \"h' = hh1' + hh2\" \"int_fg hh1 = int_fg hh1'\" \"dom_fg hh1' \\ dom_fg h1'\"\n using E1 E2 C D ** X assms by auto\n then show False\n using ** by blast\nqed\n\ntext \\@{cite \\lem. 4\\ krishna19b}\\\n\nlemma in_footprint_iff_changed:\n assumes \"int_fg h = int_fg h'\" \"h \\ bot\" \"h' \\ bot\"\n \"n \\ dom_fg h\" \"flow_footprint h h' h1'\"\n shows \"n \\ dom_fg h1' \\\n fg {n} (edge_fg h) (flow_fg h) \\ fg {n} (edge_fg h') (flow_fg h')\"\n using assms in_footprint_iff_changed1 in_footprint_iff_changed2 by metis\n\ntext \\Additionally show that flow footprints are unique:\\\n\nlemma flow_footprint_unique:\n assumes \"flow_footprint h h' h1'\" \"flow_footprint h h' h1''\" \"h \\ bot\" \"h' \\ bot\"\n shows \"h1' = h1''\"\nproof -\n obtain h11 h12 where *: \"h = h11 + h12\" \"h' = h1' + h12\" \"int_fg h11 = int_fg h1'\"\n using assms unfolding flow_footprint_def by blast\n\n obtain h21 h22 where **: \"h = h21 + h22\" \"h' = h1'' + h22\" \"int_fg h21 = int_fg h1''\"\n using assms unfolding flow_footprint_def by blast\n\n have nbot2: \"h12 \\ bot\" \"h22 \\ bot\" using * ** plus_fg_ops_exist assms by auto\n\n let ?h12 = \"fg (dom_fg h12) (edge_fg h12) (flow_fg h12)\"\n let ?h22 = \"fg (dom_fg h22) (edge_fg h22) (flow_fg h22)\"\n\n have \"int_fg (h11 + h12) = int_fg h11 + int_fg h12\" using int_fg_fi_hom by metis\n also have \"... = int_fg h1' + int_fg h12\" using * by simp\n also have \"... = int_fg (h1' + h12)\" using int_fg_fi_hom by metis\n finally have inbot: \"int_fg (h1' + h12) \\ bot\" \"int_fg h = int_fg h'\" using assms * by auto\n\n let ?X = \"{n . n \\ dom_fg h \\ fg {n} (edge_fg h) (flow_fg h) \\ fg {n} (edge_fg h') (flow_fg h')}\"\n\n have BLA: \"\\x. x \\ dom_fg h1' \\ x \\ dom_fg h\"\n using assms * plus_fg_dom_un[of h1' h12]\n by (metis Diff_insert_absorb dom_fg_plus_fg_subs1 dom_fi_int_fg subset_Diff_insert)\n\n have dom1: \"dom_fg h1' = ?X\"\n using BLA apply auto\n using in_footprint_iff_changed2[OF inbot(2)] assms inbot BLA apply blast\n using * inbot in_footprint_iff_changed1[OF inbot(2) \\h \\ bot\\ \\h' \\ bot\\] assms by blast\n\n have BLA: \"\\x. x \\ dom_fg h1'' \\ x \\ dom_fg h\"\n using assms * ** plus_fg_dom_un[of h1'' h22]\n by (metis Diff_insert_absorb dom_fg_plus_fg_subs1 dom_fi_int_fg subset_Diff_insert)\n\n have dom2: \"dom_fg h1'' = ?X\"\n using BLA apply auto\n using in_footprint_iff_changed2[OF inbot(2)] assms inbot BLA apply blast\n using * inbot in_footprint_iff_changed1[OF inbot(2) \\h \\ bot\\ \\h' \\ bot\\] assms by blast\n\n have dom: \"dom_fg h1' = dom_fg h1''\" using dom1 dom2 by simp\n then have \"dom_fg h12 = dom_fg h' - dom_fg h1'\" using assms plus_fg_dom_un[of h1' h12]\n plus_fg_dom_disj[of h1' h12] assms * by blast\n moreover have \"dom_fg h22 = dom_fg h' - dom_fg h1''\" using assms plus_fg_dom_un[of h1'' h22]\n plus_fg_dom_disj[of h1'' h22] assms ** \\dom_fg h1' = dom_fg h1''\\ ** by blast\n ultimately have dom: \"dom_fg h12 = dom_fg h22\" using dom by simp\n\n have X1: \"edge_fg h = edge_fg h12 on dom_fg h12\" using edge_fg_plus_fg_on2 * assms by auto\n have X2: \"edge_fg h = edge_fg h22 on dom_fg h22\" using edge_fg_plus_fg_on2 ** assms by auto\n have X3: \"flow_fg h = flow_fg h12 on dom_fg h12\" using flow_fg_plus_fg_on2 * assms by auto\n have X4: \"flow_fg h = flow_fg h22 on dom_fg h22\" using flow_fg_plus_fg_on2 ** assms by auto\n\n have \"?h12 = ?h22\"\n apply (rule fg_cong)\n using dom X1 X2 X3 X4 by auto\n then have \"h12 = h22\"\n using nbot2 by auto\n then have \"h1' + h12 = h1'' + h12\" using * ** by simp\n then show \"h1' = h1''\" using plus_fg_cancel_right assms * by blast\nqed\n\nend\n", "meta": {"author": "bpoettinger", "repo": "Flow", "sha": "c95ea5f88a0a3d39e44421e0cc36139a3c3687de", "save_path": "github-repos/isabelle/bpoettinger-Flow", "path": "github-repos/isabelle/bpoettinger-Flow/Flow-c95ea5f88a0a3d39e44421e0cc36139a3c3687de/Flow_Footprint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.29827247364548753}} {"text": "(*\n *\n * Copyright 2017, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(DATA61_GPL)\n *)\n\n(*\n Test proofs for corres methods. Builds on AInvs image.\n*)\n\ntheory Corres_Test\nimports \"../proof/refine/ARM/VSpace_R\" Corres_Method\nbegin\n\nchapter \\The Corres Method\\\n\nsection \\Introduction\\\n\ntext \\The @{method corres} method tries to do for corres-style refinement proofs what\n@{method wp} did for hoare logic proofs. The intention is to automate the application\nof corres calculational rules, so that the bulk of the manual proof is now handling\na verification condition. In general refinement proofs are difficult to automate, so here we\nexploit the fact that in l4v the abstract and executable specifications tend to be structurally\nsimilar. Corres proofs are based on the @{const corres_underlying} constant, which takes a number\nof parameters that allow it to be specialized for different flavours of refinement.\n\nA corres statement has the following form: @{term \"corres_underlying sr nf nf' r P P' f f'\"}, where\n@{term sr} is a state-relation, @{term nf} and @{term nf'} refer to whether or not the left and\nright hand functions may fail, @{term r} is a return value relation between the functions, @{term P}\nand @{term P'} are preconditions for the functions @{term f} and @{term f'} respectively. Informally\nthe statement says that: under the given preconditions, for every execution of @{term f'} there exists\nan execution of @{term f} that is related by the given state relation @{term sr} and return-value\nrelation @{term r}.\n\nIf the left and right side of a corres statement share similar structure, we can \"unzip\" the function\ninto one corres obligation for each atomic function. This is done through the application of\n @{thm corres_split}.\n\\\n\nthm corres_split[no_vars]\n\ntext \\Briefly this states that: given a corres goal proving refinement between @{term \"a >>= b\"} and\n @{term \"c >>= d\"}, we can decompose this into a proof showing refinement between @{term a} and\n@{term c}, and between @{term a} and @{term c}. Additionally @{term a} and @{term c} must establish\nappropriate postconditions to satisfy the obligations of proving refinement between @{term b} and @{term d}.\n\nThe first subgoal that is produced has an important characteristic: the preconditions for each\nside may only discuss the return value of its respective side. This means that rules such as\n@{term \"corres_underlying sr nf nf' r (\\s. x = x') (\\_. True) (f x) (f' x')\"} will not apply to a goal\n if @{term x} and @{term x'} are variables generated by applying @{thm corres_split} (i.e. the\nreturn values of functions).\n\nThis means that any such conditions must instead be phrased as an assumption to the rule, and our rule must be\nrephrased as follows:\n @{term \"x = x' \\ corres_underlying sr nf nf' r (\\_. True) (\\_. True) (f x) (f' x')\"}.\nThe result is that we must solve @{term \"x = x'\"} immediately after applying our rule. While this\nis not a major concern for a manual proof, it proves to be a significant obstacle if we're trying\nto focus on automating the \"corres\" part of the refinement.\n\\\n\nsection \\corres_underlyingK and corres_rv\\\n\ntext \\To remedy this situation, we augment the @{const corres_underlying} definition to include\nyet another flag: a single boolean. This new constant: @{const corres_underlyingK},\nwill form the basis of the calculus for our corres method.\\\n\nthm corres_underlyingK_def[no_vars]\n\ntext \\The boolean in @{const corres_underlyingK} can be thought of as a stateless precondition. It\nis used to propagate additional proof obligations for rules that either do not need to discuss\neither the left or right hand state, or must discuss bound variables from both sides.\\\n\nthm corresK_split[no_vars]\n\ntext \\In this split rule for @{const corres_underlyingK} we see that the additional precondition @{term F'}\nmay discuss both @{term rv} and @{term rv'}. To show that this condition is satisified, however,\nwe can't use hoare logic and instead need a new definition: @{const corres_rv}.\\\n\nthm corres_rv_def_I_know_what_I'm_doing[no_vars]\n\ntext \\This is a weaker form of @{const corres_underlying} that is only interested in the return value\nof the functions. In essence, it states the given functions will establish @{term Q} after executing,\nassuming the given return-value relation @{term r} holds, along with the given stateless precondition\n@{term F} and left/right preconditions @{term P} and @{term P'}.\n\nThe assumption in general is that corres_rv rules should never be written, instead corres_rv obligations\nshould be propagated into either the stateless precondition (@{term F} from @{term corres_underlyingK}),\nthe left precondition (@{term P}) or the right precondition @{term P'}. This is implicitly handled\nby @{method corres_rv} (called from @{method corres}) by applying one of the following rules to each conjunct:\\\n\nthm corres_rv_defer\nthm corres_rv_wp_left\nthm corres_rv_wp_right\n\ntext \\If none of these rules can be safely applied, then @{method corres_rv} will leave the\n obligation untouched. The user can manually apply one of them if desired, but this is liable to\n create unsolvable proof obligations. In the worst case, the user may manually solve the goal in-place.\\\n\nthm corres_rv_proveT[no_vars]\n\nsection \\The corres method\\\n\ntext \\The core algorithm of the corres method is simple:\n 1) start by applying any necessary weakening rules to ensure the goal has schematic preconditions\n 2) apply a known @{thm corres} or @{thm corresK} rule (see next section)\n 3) if unsuccessful, apply a split rule (i.e. @{thm corresK_split}) and go to 2\n\nImportantly, @{method corres} will not split a goal if it ultimately is not able to apply at least\none @{thm corres} or @{thm corresK} rule.\n\\\n\nsubsection \\The corres and corresK named_theorems\\\n\ntext \\To address the fact that existing refinement rules are phrased as @{const corres_underlying}\nand not @{const corres_underlyingK} there are two different named_theorems that are used for different\nkind of rules @{thm corres} and @{thm corresK}. A @{thm corres} rule is understood to be phrased\nwith @{const corres_underlying} and may have additional assumptions. These assumptions will be\npropagated through the additional @{term F} flag in @{const corres_underlyingK}, rather than presented\nas proof obligations immediately. A @{thm corresK} rule is understood to be phrased with\n@{const corres_underlyingK}, and is meant for calculational rules which may have proper assumptions that\nshould not be propagated.\n\\\nthm corresK\nthm corres\n\nsubsection \\The corresc method\\\n\ntext \\Similar to @{method wpc}, @{method corresc} can handle case statements in @{const corres_underlyingK}\nproof goals. Importantly, however, it is split into two sub-methods @{method corresc_left} and\n@{method corresc_right}, which perform case-splitting on each side respectively. The combined method\n@{method corresc}, however, attempts to discharge the contradictions that arise from the quadratic\nblowup of a case analysis on both the left and right sides.\\\n\nsubsection \\corres_concrete_r, corres_concrete_rE\\\n\ntext \\Some @{thm corresK} rules should only be applied if certain variables are concrete\n(i.e. not schematic) in the goal. These are classified separately with the named_theorems\n@{thm corres_concrete_r} and @{thm corres_concrete_rER}. The first\nindicates that the return value relation of the goal must be concrete, the second indicates that\nonly the left side of the error relation must be concrete.\\\n\nthm corres_concrete_r\nthm corres_concrete_rER\n\nsubsection \\The corres_search method\\\n\ntext \\The purpose of @{method corres_search} is to address cases where there is non-trivial control flow.\nIn particular: in the case where there is an \"if\" statement or either side needs to be symbolically\nexecuted. The core idea is that corres_search should be provided with a \"search\" rule that acts\nas an anchoring point. Symbolic execution and control flow is decomposed until either the given\nrule is successfully applied or all search branches are exhausted.\\\n\nsubsubsection \\Symbolic Execution\\\n\ntext \\Symbolic execution is handled by two named theorems:\n @{thm corres_symb_exec_ls} and @{thm corres_symb_exec_rs}, which perform symbolic execution on\nthe left and right hand sides of a corres goal.\\\n\nthm corres_symb_exec_ls\nthm corres_symb_exec_rs\n\ntext \\A function may be symbolically executed if it does not modify the state, i.e. its only purpose\nis to compute some value and return it. After being symbolically executed,\nthis value can only be discussed by the precondition of the associated side or the stateless\nprecondition of corresK. The resulting @{const corres_rv} goal has @{const corres_noop} as the\nfunction on the alternate side. This gives @{method corres_rv} a hint that the resulting obligation\nshould be aggressively re-written into a hoare triple over @{term m} if it can't be propagated\nback statelessly safely.\n\\\n\n\nsection \\Demo\\\n\n\ncontext begin interpretation Arch .\n\n(* VSpace_R *)\n\n\nlemmas load_hw_asid_corres_args[corres] =\n load_hw_asid_corres[@lift_corres_args]\n\nlemmas invalidate_asid_corres_args[corres] =\n invalidate_asid_corres[@lift_corres_args]\n\nlemmas invalidate_hw_asid_entry_corres_args[corres] =\n invalidate_hw_asid_entry_corres[@lift_corres_args]\n\nlemma invalidate_asid_entry_corres:\n \"corres dc (valid_arch_objs and valid_asid_map\n and K (asid \\ mask asid_bits \\ asid \\ 0)\n and vspace_at_asid asid pd and valid_vs_lookup\n and unique_table_refs o caps_of_state\n and valid_global_objs and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (invalidate_asid_entry asid) (invalidateASIDEntry asid)\"\n apply (simp add: invalidate_asid_entry_def invalidateASIDEntry_def)\n apply_debug (trace) (* apply_trace between steps *)\n (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n corres (* weaken precondition *)\n continue (* split *)\n continue (* solve load_hw_asid *)\n continue (* split *)\n continue (* apply corres_when *)\n continue (* trivial simplification *)\n continue (* invalidate _hw_asid_entry *)\n finish (* invalidate_asid *)\n\n apply (corressimp wp: load_hw_asid_wp)+\n apply clarsimp\n apply (fastforce simp: pd_at_asid_uniq)\n done\n\n\ncrunch typ_at'[wp]: invalidateASIDEntry, flushSpace \"typ_at' T t\"\ncrunch pspace_aligned'[wp]: invalidateASIDEntry \"pspace_aligned'\"\ncrunch pspace_distinct'[wp]: invalidateASIDEntry \"pspace_distinct'\"\ncrunch ksCurThread[wp]: invalidateASIDEntry, flushSpace \"\\s. P (ksCurThread s)\"\ncrunch obj_at'[wp]: invalidateASIDEntry, flushSpace \"obj_at' P p\"\n\nlemmas flush_space_corres_args[corres] =\n flush_space_corres[@lift_corres_args]\n\nlemmas invalidate_asid_entry_corres_args[corres] =\n invalidate_asid_entry_corres[@lift_corres_args]\n\n\nlemma corres_inst_eq_ext:\n \"(\\x. corres_inst_eq (f x) (f' x)) \\ corres_inst_eq f f'\"\n by (auto simp add: corres_inst_eq_def)\n\nlemma delete_asid_corresb:\n notes [corres] = corres_gets_asid gct_corres set_asid_pool_corres and\n [@lift_corres_args, corres] = get_asid_pool_corres_inv'\n invalidate_asid_entry_corres\n set_vm_root_corres\n notes [wp] = set_asid_pool_asid_map_unmap set_asid_pool_vs_lookup_unmap'\n set_asid_pool_arch_objs_unmap'\n invalidate_asid_entry_invalidates\n getASID_wp\n shows\n \"corres dc\n (invs and valid_etcbs and K (asid \\ mask asid_bits \\ asid \\ 0))\n (pspace_aligned' and pspace_distinct' and no_0_obj'\n and valid_arch_state' and cur_tcb')\n (delete_asid asid pd) (deleteASID asid pd)\"\n apply (simp add: delete_asid_def deleteASID_def)\n apply_debug (trace) (* apply_trace between steps *)\n (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n corres (* weaken precondition *)\n continue (* split *)\n continue (* gets rule *)\n continue (* corresc *)\n continue (* return rule *)\n continue (* split *)\n continue (* function application *)\n continue (* liftM rule *)\n continue (* get_asid_pool_corres_inv' *)\n continue (* function application *)\n continue (* function application *)\n continue (* corresK_when *)\n continue (* split *)\n continue (* flush_space_corres *)\n continue (* K_bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* invalidate_asid_entry_corres *)\n continue (* K_bind *)\n continue (* return bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* backtracking *)\n continue (* split *)\n continue (* function application *)\n continue (* set_asid_pool_corres *)\n continue (* K_bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* gct_corres *)\n continue (* set_vm_root_corres *)\n finish (* backtracking? *)\n apply (corressimp simp: mask_asid_low_bits_ucast_ucast\n | fold cur_tcb_def | wps)+\n apply (frule arm_asid_table_related,clarsimp)\n apply (rule conjI)\n apply (intro impI allI)\n apply (rule conjI)\n apply (safe; assumption?)\n apply (rule ext)\n apply (fastforce simp: inv_def dest: ucast_ucast_eq)\n apply (rule context_conjI)\n apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n apply (intro allI impI)\n apply (subgoal_tac \"vspace_at_asid asid pd s\")\n prefer 2\n apply (simp add: vspace_at_asid_def)\n apply (rule vs_lookupI)\n apply (simp add: vs_asid_refs_def)\n apply (rule image_eqI[OF refl])\n apply (rule graph_ofI)\n apply fastforce\n apply (rule r_into_rtrancl)\n apply simp\n apply (rule vs_lookup1I [OF _ _ refl], assumption)\n apply (simp add: vs_refs_def)\n apply (rule image_eqI[rotated], erule graph_ofI)\n apply (simp add: mask_asid_low_bits_ucast_ucast)\n prefer 2\n apply (intro allI impI context_conjI; assumption?)\n apply (rule aligned_distinct_relation_asid_pool_atI'; fastforce?)\n apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n apply (simp add: cur_tcb'_def)\n apply (safe; assumption?)\n apply (erule ko_at_weakenE)\n apply (clarsimp simp: graph_of_def)\n apply (fastforce split: if_split_asm)\n apply (frule invs_arch_objs)\n apply (drule (2) valid_arch_objsD)\n apply (erule ranE)\n apply (fastforce split: if_split_asm)\n apply (erule ko_at_weakenE)\n apply (clarsimp simp: graph_of_def)\n apply (fastforce split: if_split_asm)\n done\n\nlemma cte_wp_at_ex:\n \"cte_wp_at (\\_. True) p s \\ (\\cap. cte_wp_at (op = cap) p s)\"\n by (simp add: cte_wp_at_def)\n\nlemma set_vm_root_for_flush_corres:\n notes [corres] = gct_corres getSlotCap_corres\n shows\n \"corres (op =)\n (cur_tcb and vspace_at_asid asid pd\n and K (asid \\ 0 \\ asid \\ mask asid_bits)\n and valid_asid_map and valid_vs_lookup\n and valid_arch_objs and valid_global_objs\n and unique_table_refs o caps_of_state\n and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (set_vm_root_for_flush pd asid)\n (setVMRootForFlush pd asid)\"\n apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n apply corres\n apply_debug (trace) (tags \"corres_search\")\n (corres_search search: arm_context_switch_corres)\n continue (* step left *)\n continue (* if rule *)\n continue (* failed corres on first subgoal, trying next *)\n continue (* fail corres on last subgoal, trying reverse if rule *)\n continue (* can't make corres progress here, trying other goal *)\n finish (* successful goal discharged by corres *)\n\n apply (corressimp wp: get_cap_wp getSlotCap_wp)+\n apply (rule context_conjI)\n subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n apply (rule context_conjI)\n subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n apply (rule conjI)\n subgoal by (fastforce simp: isCap_simps)\n apply (drule cte_wp_at_ex)\n apply clarsimp\n apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n apply (drule cte_wp_at_norm')\n apply clarsimp\n apply (rule_tac x=\"cteCap cte\" in exI)\n apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n done\n\ntext \\Note we can wrap it all up in corressimp\\\n\nlemma set_vm_root_for_flush_corres':\n notes [corres] = gct_corres getSlotCap_corres\n shows\n \"corres (op =)\n (cur_tcb and vspace_at_asid asid pd\n and K (asid \\ 0 \\ asid \\ mask asid_bits)\n and valid_asid_map and valid_vs_lookup\n and valid_arch_objs and valid_global_objs\n and unique_table_refs o caps_of_state\n and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (set_vm_root_for_flush pd asid)\n (setVMRootForFlush pd asid)\"\n apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n apply (corressimp search: arm_context_switch_corres\n wp: get_cap_wp getSlotCap_wp\n simp: isCap_simps)\n apply (rule context_conjI)\n subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n apply (rule context_conjI)\n subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n apply (rule conjI)\n subgoal by (fastforce)\n apply (drule cte_wp_at_ex)\n apply clarsimp\n apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n apply (drule cte_wp_at_norm')\n apply clarsimp\n apply (rule_tac x=\"cteCap cte\" in exI)\n apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n done\n\nend\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/Corres_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.5698526514141572, "lm_q1q2_score": 0.29827247364548753}} {"text": "\ntheory mutualEx\n imports ECMP\nbegin\n\ndefinition I :: \"scalrValueType\" where [simp]:\n \"I \\ enum ''state'' ''I''\"\n\ndefinition T :: \"scalrValueType\" where [simp]:\n \"T \\ enum ''state'' ''T''\"\n\ndefinition C :: \"scalrValueType\" where [simp]:\n \"C \\ enum ''state'' ''C''\"\n\ndefinition E :: \"scalrValueType\" where [simp]:\n \"E \\ enum ''state'' ''E''\"\n\ndefinition true :: \"scalrValueType\" where [simp]:\n \"true \\ boolV True\"\n\ndefinition false :: \"scalrValueType\" where [simp]:\n \"false \\ boolV False\"\n\nprimrec env :: \"nat => envType\" where\n\"env N (Ident n) = (if Ident n = Ident ''x'' then\n boolType\nelse\n anyType\n)\"|\n\"env N (Para n i) = (if Para n i = Para ''n'' i \\ (i \\ N) then\n enumType\nelse\n anyType\n)\"|\n\"env N dontCareVar = anyType\"\n\nlemma env_simp : \n \"[|i <= N|] ==> env N (Para ''n'' i) = enumType\"\n \n\n\" env N (Ident ''x'') = boolType\"\n \n\n\"[|i > N|] ==> env N (Para n i) = anyType\"\n \n \n apply(auto ) \n \ndone\n\ndefinition initSpec0 :: \"nat \\ formula\" where [simp]:\n \"initSpec0 N \\ (\\\\<^sub>fi. IVar (Para ''n'' i) =\\<^sub>f Const I) N\"\n\nlemma symPreds0 [intro]: \n \" symPredSet' N {initSpec0 N}\"\n unfolding initSpec0_def apply(rule symPredSetForall)\nunfolding symParamForm_def apply(auto ) \n \ndone\n\nlemma deriveFormInitSpec0 [intro]: \n \"[|f : {initSpec0 N}|] ==> deriveForm (env N) f\"\n apply(auto ) \n \ndone\n\ndefinition initSpec1 :: \"formula\" where [simp]:\n \"initSpec1 \\ IVar (Ident ''x'') =\\<^sub>f Const true\"\n\nlemma symPreds1 [intro]: \n \" symPredSet' N {initSpec1}\"\n apply(auto ) \n \ndone\n\nlemma deriveFormInitSpec1 [intro]: \n \"[|f : {initSpec1}|] ==> deriveForm (env N) f\"\n apply(auto ) \n \ndone\n\ndefinition allInitSpecs :: \"nat \\ formula set\" where [simp]:\n \"allInitSpecs N \\ {initSpec0 N} \\ {initSpec1}\"\n\nlemma symPreds [intro]: \n \" symPredSet' N (allInitSpecs N)\"\n unfolding allInitSpecs_def apply(rule symPredsUnion)\n apply(blast )\n\n apply(blast )\n\ndone\n\nlemma deriveFormAllInitSpec : \n \"[|f : allInitSpecs N|] ==> deriveForm (env N) f\"\n using deriveFormInitSpec0 deriveFormInitSpec1 apply(auto simp del: initSpec0_def initSpec1_def) \n \ndone\n\ndefinition Try :: \"nat \\ rule\" where\n \"Try i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const I\n \\\n assign (Para ''n'' i, Const T)\"\n\nlemma symTry : \n \" symParamRule N Try\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Try i)\"\n \n \n unfolding Try_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Trys :: \"nat \\ rule set\" where\n \"Trys N \\ oneParamCons N Try\"\n\ndefinition Crit :: \"nat \\ rule\" where\n \"Crit i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const T \\\\<^sub>f\n IVar (Ident ''x'') =\\<^sub>f Const true\n \\\n assign (Para ''n'' i, Const C) ||\n assign (Ident ''x'', Const false)\"\n\nlemma symCrit : \n \" symParamRule N Crit\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Crit i)\"\n \n \n unfolding Crit_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Crits :: \"nat \\ rule set\" where\n \"Crits N \\ oneParamCons N Crit\"\n\ndefinition Exit :: \"nat \\ rule\" where\n \"Exit i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const C\n \\\n assign (Para ''n'' i, Const E)\"\n\nlemma symExit : \n \" symParamRule N Exit\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Exit i)\"\n \n \n unfolding Exit_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Exits :: \"nat \\ rule set\" where\n \"Exits N \\ oneParamCons N Exit\"\n\ndefinition Idle :: \"nat \\ rule\" where\n \"Idle i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const E\n \\\n assign (Para ''n'' i, Const I) ||\n assign (Ident ''x'', Const true)\"\n\nlemma symIdle : \n \" symParamRule N Idle\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Idle i)\"\n \n \n unfolding Idle_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Idles :: \"nat \\ rule set\" where\n \"Idles N \\ oneParamCons N Idle\"\n\ndefinition mutualEx :: \"nat \\ nat \\ nat \\ formula\" where\n \"mutualEx N i j \\ \\\\<^sub>f Const (index i) =\\<^sub>f Const (index j) \\\\<^sub>f\n IVar (Para ''n'' i) =\\<^sub>f Const C \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const C\"\n\ndefinition ABS_Crit :: \"rule\" where\n \"ABS_Crit \\ \n IVar (Ident ''x'') =\\<^sub>f Const true\n \\\n assign (Ident ''x'', Const false)\"\n\ndefinition ABS_Crits :: \"rule set\" where\n \"ABS_Crits \\ {ABS_Crit}\"\n\ndefinition ABS_Idle :: \"nat \\ rule\" where\n \"ABS_Idle N \\ \n (\\\\<^sub>fj. \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const C \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const E) N\n \\\n assign (Ident ''x'', Const true)\"\n\ndefinition ABS_Idles :: \"nat \\ rule set\" where\n \"ABS_Idles N \\ {ABS_Idle N}\"\n\ndefinition Lemma_1 :: \"nat \\ nat \\ nat \\ formula\" where\n \"Lemma_1 N p i \\ IVar (Para ''n'' i) =\\<^sub>f Const E \\\\<^sub>f\n forallFormExcl (\\j. \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const C \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const E) i N\"\n\ndefinition rules :: \"nat \\ rule set\" where\n \"rules N = (Trys N \\ (Crits N \\ (Exits N \\ Idles N)))\"\n\nlemma deriveAll : \n \"[|r : Trys N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Crits N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Exits N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Idles N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : ABS_Crits|] ==> deriveRule (env N) r\"\n \n\n\"[|r : ABS_Idles N|] ==> deriveRule (env N) r\"\n \n \n unfolding deriveRule_def deriveForm_def deriveStmt_def Trys_def Try_def Crits_def Crit_def Exits_def Exit_def Idles_def Idle_def ABS_Crits_def ABS_Crit_def ABS_Idles_def ABS_Idle_def apply(auto ) \n \ndone\n\nlemma symProtAll : \n \" symProtRules' N (Trys N)\"\n \n\n\" symProtRules' N (Crits N)\"\n \n\n\" symProtRules' N (Exits N)\"\n \n\n\" symProtRules' N (Idles N)\"\n \n \n using symTry(1) Trys_def symParaRuleInfSymRuleSet symParaRuleInfSymRuleSet2 apply(auto )[1] \n \n using symCrit(1) Crits_def symParaRuleInfSymRuleSet symParaRuleInfSymRuleSet2 apply(auto )[1] \n \n using symExit(1) Exits_def symParaRuleInfSymRuleSet symParaRuleInfSymRuleSet2 apply(auto )[1] \n \n using symIdle(1) Idles_def symParaRuleInfSymRuleSet symParaRuleInfSymRuleSet2 apply(auto )[1] \n \ndone\n\nlemma symmutualEx : \n \" symParamForm2 N (mutualEx N)\"\n unfolding mutualEx_def apply(auto ) \n \n apply(intro symParamForm2Imply symParamFormForallExcl2 )\n\nunfolding symParamForm2_def apply(auto ) \n \ndone\n\nlemma symLemma_1 : \n \" symParamForm2 N (Lemma_1 N)\"\n unfolding Lemma_1_def apply(auto ) \n \n apply(intro symParamForm2Imply symParamFormForallExcl2 )\n\nunfolding symParamForm2_def apply(auto ) \n \ndone\n\ndefinition lemmasFor_Try :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Try N = []\"\n\ndefinition Try_ref :: \"nat \\ rule\" where\n \"Try_ref i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const I\n \\\n assign (Para ''n'' i, Const T)\"\n\nlemma symTry_ref : \n \" symParamRule N Try_ref\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Try_ref i)\"\n \n \n unfolding Try_ref_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Try_refs :: \"nat \\ rule set\" where\n \"Try_refs N \\ oneParamCons N Try_ref\"\n\nlemma Try_strengthen : \n \" strengthenRuleByFrmL2 (map2' (lemmasFor_Try N) j i) (Try i) = Try_ref i\"\n unfolding lemmasFor_Try_def Try_def Try_ref_def apply(auto ) \n \ndone\n\nlemma abs_Try_ref : \n \"[|M <= N;i <= M|] ==> absTransfRule (env N) M (Try_ref i) = Try_ref i\"\n \n\n\"[|M <= N;i > M|] ==> absTransfRule (env N) M (Try_ref i) = skipRule\"\n \n \n unfolding Try_ref_def Try_ref_def skipRule_def apply(auto simp add: Let_def ) \n \ndone\n\ndefinition lemmasFor_Crit :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Crit N = []\"\n\ndefinition Crit_ref :: \"nat \\ rule\" where\n \"Crit_ref i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const T \\\\<^sub>f\n IVar (Ident ''x'') =\\<^sub>f Const true\n \\\n assign (Para ''n'' i, Const C) ||\n assign (Ident ''x'', Const false)\"\n\nlemma symCrit_ref : \n \" symParamRule N Crit_ref\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Crit_ref i)\"\n \n \n unfolding Crit_ref_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Crit_refs :: \"nat \\ rule set\" where\n \"Crit_refs N \\ oneParamCons N Crit_ref\"\n\nlemma Crit_strengthen : \n \" strengthenRuleByFrmL2 (map2' (lemmasFor_Crit N) j i) (Crit i) = Crit_ref i\"\n unfolding lemmasFor_Crit_def Crit_def Crit_ref_def apply(auto ) \n \ndone\n\nlemma abs_Crit_ref : \n \"[|M <= N;i <= M|] ==> absTransfRule (env N) M (Crit_ref i) = Crit_ref i\"\n \n\n\"[|M <= N;i > M|] ==> absTransfRule (env N) M (Crit_ref i) = ABS_Crit\"\n \n \n unfolding Crit_ref_def Crit_ref_def ABS_Crit_def apply(auto simp add: Let_def ) \n \ndone\n\ndefinition lemmasFor_Exit :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Exit N = []\"\n\ndefinition Exit_ref :: \"nat \\ rule\" where\n \"Exit_ref i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const C\n \\\n assign (Para ''n'' i, Const E)\"\n\nlemma symExit_ref : \n \" symParamRule N Exit_ref\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Exit_ref i)\"\n \n \n unfolding Exit_ref_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Exit_refs :: \"nat \\ rule set\" where\n \"Exit_refs N \\ oneParamCons N Exit_ref\"\n\nlemma Exit_strengthen : \n \" strengthenRuleByFrmL2 (map2' (lemmasFor_Exit N) j i) (Exit i) = Exit_ref i\"\n unfolding lemmasFor_Exit_def Exit_def Exit_ref_def apply(auto ) \n \ndone\n\nlemma abs_Exit_ref : \n \"[|M <= N;i <= M|] ==> absTransfRule (env N) M (Exit_ref i) = Exit_ref i\"\n \n\n\"[|M <= N;i > M|] ==> absTransfRule (env N) M (Exit_ref i) = skipRule\"\n \n \n unfolding Exit_ref_def Exit_ref_def skipRule_def apply(auto simp add: Let_def ) \n \ndone\n\ndefinition lemmasFor_Idle :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Idle N = [Lemma_1 N]\"\n\ndefinition Idle_ref :: \"nat \\ nat \\ rule\" where\n \"Idle_ref N i \\ \n IVar (Para ''n'' i) =\\<^sub>f Const E \\\\<^sub>f\n forallFormExcl (\\j. \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const C \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const E) i N\n \\\n assign (Para ''n'' i, Const I) ||\n assign (Ident ''x'', Const true)\"\n\nlemma symIdle_ref : \n \" symParamRule N (Idle_ref N)\"\n \n\n\"[|i <= N|] ==> wellFormedRule (env N) N (Idle_ref N i)\"\n \n \n unfolding Idle_ref_def apply(auto intro!: symParamRuleI2 symParamRuleI symParamFormAnd symParamFormForall symParamFormForallExcl symParamFormImply symParamStatementParallel symParamStatementForall symParamStatementForallExcl symParamStatementIte ) \n \nunfolding symParamForm_def symParamStatement_def symParamForm2_def symParamStatement2_def mutualDiffVars_def equivForm_def apply(auto ) \n \ndone\n\ndefinition Idle_refs :: \"nat \\ rule set\" where\n \"Idle_refs N \\ oneParamCons N (Idle_ref N)\"\n\nlemma Idle_strengthen : \n \" strengthenRuleByFrmL2 (map2' (lemmasFor_Idle N) j i) (Idle i) = Idle_ref N i\"\n unfolding lemmasFor_Idle_def Lemma_1_def Idle_def Idle_ref_def apply(auto ) \n \ndone\n\nlemma abs_Idle_ref : \n \"[|M <= N;i <= M|] ==> absTransfRule (env N) M (Idle_ref N i) = Idle_ref M i\"\n \n\n\"[|M <= N;i > M|] ==> absTransfRule (env N) M (Idle_ref N i) = ABS_Idle M\"\n \n \n unfolding Idle_ref_def Idle_ref_def ABS_Idle_def apply(auto simp add: Let_def ) \n \ndone\n\ndefinition InvS :: \"nat \\ (((nat \\ nat \\ formula) list) list)\" where\n \"InvS N = [lemmasFor_Try N, lemmasFor_Crit N, lemmasFor_Exit N, lemmasFor_Idle N]\"\n\ndefinition rule_refs :: \"nat \\ rule set\" where\n \"rule_refs N = (Try_refs N \\ (Crit_refs N \\ (Exit_refs N \\ Idle_refs N)))\"\n\nlemma TryStrengthRel : \n \" strengthenRel (Trys N) (set (InvS N)) (Try_refs N) N\"\n unfolding Trys_def Try_refs_def apply(rule_tac ?lemmasFor_r=\"lemmasFor_Try\" in strengthenExt1)\n using Try_strengthen apply(presburger )\n\nunfolding InvS_def apply(auto ) \n \ndone\n\nlemma CritStrengthRel : \n \" strengthenRel (Crits N) (set (InvS N)) (Crit_refs N) N\"\n unfolding Crits_def Crit_refs_def apply(rule_tac ?lemmasFor_r=\"lemmasFor_Crit\" in strengthenExt1)\n using Crit_strengthen apply(presburger )\n\nunfolding InvS_def apply(auto ) \n \ndone\n\nlemma ExitStrengthRel : \n \" strengthenRel (Exits N) (set (InvS N)) (Exit_refs N) N\"\n unfolding Exits_def Exit_refs_def apply(rule_tac ?lemmasFor_r=\"lemmasFor_Exit\" in strengthenExt1)\n using Exit_strengthen apply(presburger )\n\nunfolding InvS_def apply(auto ) \n \ndone\n\nlemma IdleStrengthRel : \n \" strengthenRel (Idles N) (set (InvS N)) (Idle_refs N) N\"\n unfolding Idles_def Idle_refs_def apply(rule_tac ?lemmasFor_r=\"lemmasFor_Idle\" in strengthenExt1)\n using Idle_strengthen apply(presburger )\n\nunfolding InvS_def apply(auto ) \n \ndone\n\nlemma deriveAllRef : \n \"[|r : Try_refs N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Crit_refs N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Exit_refs N|] ==> deriveRule (env N) r\"\n \n\n\"[|r : Idle_refs N|] ==> deriveRule (env N) r\"\n \n \n unfolding deriveRule_def deriveForm_def deriveStmt_def Try_refs_def Try_ref_def Crit_refs_def Crit_ref_def Exit_refs_def Exit_ref_def Idle_refs_def Idle_ref_def apply(auto ) \n \ndone\n\nlemma symProtAllRef : \n \" symProtRules' N (Try_refs N)\"\n \n\n\" symProtRules' N (Crit_refs N)\"\n \n\n\" symProtRules' N (Exit_refs N)\"\n \n\n\" symProtRules' N (Idle_refs N)\"\n \n \n using symTry_ref(1) Try_refs_def symCrit_ref(1) Crit_refs_def symExit_ref(1) Exit_refs_def symIdle_ref(1) Idle_refs_def symParaRuleInfSymRuleSet symParaRuleInfSymRuleSet2 apply(auto ) \n \ndone\n\nlemma StrengthRelRules2Rule_refs : \n \" strengthenRel (rules N) (set (InvS N)) (rule_refs N) N\"\n unfolding rules_def rule_refs_def apply(rule strenRelUnion)\n apply(blast intro: TryStrengthRel )\n\n apply(rule strenRelUnion)\n apply(blast intro: CritStrengthRel )\n\n apply(rule strenRelUnion)\n apply(blast intro: ExitStrengthRel )\n\n apply(blast intro: IdleStrengthRel )\n\ndone\n\nlemma Abs_Try_refs : \n \"[|M < N|] ==> (absTransfRule (env N) M ` Try_refs N) = (Try_refs M Un {skipRule})\"\n unfolding Try_refs_def apply(rule absGen)\n using abs_Try_ref apply(auto ) \n \ndone\n\nlemma Abs_Crit_refs : \n \"[|M < N|] ==> (absTransfRule (env N) M ` Crit_refs N) = (Crit_refs M Un ABS_Crits)\"\n unfolding Crit_refs_def ABS_Crits_def apply(rule absGen)\n using abs_Crit_ref apply(auto ) \n \ndone\n\nlemma Abs_Exit_refs : \n \"[|M < N|] ==> (absTransfRule (env N) M ` Exit_refs N) = (Exit_refs M Un {skipRule})\"\n unfolding Exit_refs_def apply(rule absGen)\n using abs_Exit_ref apply(auto ) \n \ndone\n\nlemma Abs_Idle_refs : \n \"[|M < N|] ==> (absTransfRule (env N) M ` Idle_refs N) = (Idle_refs M Un ABS_Idles M)\"\n unfolding Idle_refs_def ABS_Idles_def apply(rule absGen)\n using abs_Idle_ref apply(auto ) \n \ndone\n\ndefinition ABS_rules :: \"nat \\ rule set\" where [simp]:\n \"ABS_rules N = (Try_refs N \\ (Crit_refs N \\ (ABS_Crits \\ (Exit_refs N \\ (Idle_refs N \\ (ABS_Idles N \\ {skipRule}))))))\"\n\ndefinition ABS_rules' :: \"nat \\ rule set\" where [simp]:\n \"ABS_rules' N = ((Try_refs N \\ {skipRule}) \\ ((Crit_refs N \\ ABS_Crits) \\ ((Exit_refs N \\ {skipRule}) \\ (Idle_refs N \\ ABS_Idles N))))\"\n\nlemma ABS_rules_eq_rules' : \n \" ABS_rules M = ABS_rules' M\"\n apply(auto ) \n \ndone\n\nlemma ABS_all : \n \"[|M < N|] ==> (absTransfRule (env N) M ` rule_refs N) = ABS_rules M\"\n apply(subst ABS_rules_eq_rules' )\n\nunfolding rule_refs_def ABS_rules'_def apply(intro image_UnI )\n\n apply(auto simp add: Abs_Try_refs Abs_Crit_refs Abs_Exit_refs Abs_Idle_refs ) \n \ndone\n\ndefinition Lemma_1' :: \"nat \\ nat \\ nat \\ formula\" where\n \"Lemma_1' N i j \\ \\\\<^sub>f Const (index i) =\\<^sub>f Const (index j) \\\\<^sub>f\n IVar (Para ''n'' i) =\\<^sub>f Const E \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const C \\\\<^sub>f\n \\\\<^sub>f IVar (Para ''n'' j) =\\<^sub>f Const E\"\n\nlemma absTransfLemma_1' : \n \"[|M < N;M = 1;l <= 1|] ==> absTransfForm (env N) M (Lemma_1' N 0 l) = Lemma_1' N 0 l\"\n unfolding Lemma_1'_def apply(auto ) \n \ndone\n\nlemma strengthenVsObsLemma_1 : \n \" strengthenVsObs (Lemma_1 N) (Lemma_1' N) N\"\n unfolding Lemma_1_def Lemma_1'_def apply(rule strengthenVsObsDiff)\nunfolding symParamForm_def apply(auto ) \n \ndone\n\nlemma SafeAndderiveFormLemma_1' : \n \"[|M < N;M = 1;l <= M;k <= M|] ==> safeForm (env N) M (Lemma_1' N k l) & deriveForm (env N) (Lemma_1' N k l)\"\n unfolding Lemma_1'_def apply(auto ) \n \ndone\n\nlemma symInvs : \n \" symParamForm2 N (Lemma_1' N)\"\n \n \n unfolding Lemma_1'_def apply(auto ) \n \nsubgoal apply(intro symParamForm2Imply symParamFormForallExcl2 )\n \n unfolding symParamForm2_def apply(auto ) \n done\n\ndone\n\ndefinition lemmasFor_Try' :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Try' N = []\"\n\nlemma strengthenVsObsLs_lemmasFor_Try : \n \" strengthenVsObsLs (lemmasFor_Try N) (lemmasFor_Try' N) N\"\n unfolding strengthenVsObsLs_def lemmasFor_Try_def lemmasFor_Try'_def apply(auto ) \n \ndone\n\nlemma lemmaTry_fitEnv : \n \"[|formEval (pre r) s;fitEnv s (env N);r : Try_refs N|] ==> fitEnv (trans1 (act r) s) (env N)\"\n unfolding Try_refs_def Try_ref_def apply(auto ) \n \ndone\n\ndefinition lemmasFor_Crit' :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Crit' N = []\"\n\nlemma strengthenVsObsLs_lemmasFor_Crit : \n \" strengthenVsObsLs (lemmasFor_Crit N) (lemmasFor_Crit' N) N\"\n unfolding strengthenVsObsLs_def lemmasFor_Crit_def lemmasFor_Crit'_def apply(auto ) \n \ndone\n\nlemma lemmaCrit_fitEnv : \n \"[|formEval (pre r) s;fitEnv s (env N);r : Crit_refs N|] ==> fitEnv (trans1 (act r) s) (env N)\"\n unfolding Crit_refs_def Crit_ref_def apply(auto ) \n \ndone\n\ndefinition lemmasFor_Exit' :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Exit' N = []\"\n\nlemma strengthenVsObsLs_lemmasFor_Exit : \n \" strengthenVsObsLs (lemmasFor_Exit N) (lemmasFor_Exit' N) N\"\n unfolding strengthenVsObsLs_def lemmasFor_Exit_def lemmasFor_Exit'_def apply(auto ) \n \ndone\n\nlemma lemmaExit_fitEnv : \n \"[|formEval (pre r) s;fitEnv s (env N);r : Exit_refs N|] ==> fitEnv (trans1 (act r) s) (env N)\"\n unfolding Exit_refs_def Exit_ref_def apply(auto ) \n \ndone\n\ndefinition lemmasFor_Idle' :: \"nat \\ ((nat \\ nat \\ formula) list)\" where\n \"lemmasFor_Idle' N = [Lemma_1' N]\"\n\nlemma strengthenVsObsLs_lemmasFor_Idle : \n \" strengthenVsObsLs (lemmasFor_Idle N) (lemmasFor_Idle' N) N\"\n unfolding strengthenVsObsLs_def lemmasFor_Idle_def lemmasFor_Idle'_def apply(auto intro: strengthenVsObsLemma_1 ) \n \ndone\n\nlemma lemmaIdle_fitEnv : \n \"[|formEval (pre r) s;fitEnv s (env N);r : Idle_refs N|] ==> fitEnv (trans1 (act r) s) (env N)\"\n unfolding Idle_refs_def Idle_ref_def apply(auto ) \n \ndone\n\ndefinition InvS' :: \"nat \\ (((nat \\ nat \\ formula) list) list)\" where\n \"InvS' N = [lemmasFor_Try' N, lemmasFor_Crit' N, lemmasFor_Exit' N, lemmasFor_Idle' N]\"\n\nlemma wellFormedRule_refs : \n \"[|r : rule_refs N|] ==> wellFormedRule (env N) N r\"\n apply(auto simp add: rule_refs_def Try_refs_def Crit_refs_def Exit_refs_def Idle_refs_def symTry_ref symCrit_ref symExit_ref symIdle_ref ) \n \ndone\n\nlemma SafeAndderiveAll : \n \"[|M < N;M = 1;l <= M;k <= M;pinvL : set (InvS' N);pf : set pinvL|] ==> safeForm (env N) M (pf k l) & deriveForm (env N) (pf k l)\"\n unfolding InvS'_def lemmasFor_Try'_def lemmasFor_Crit'_def lemmasFor_Exit'_def lemmasFor_Idle'_def using SafeAndderiveFormLemma_1' apply(auto ) \n \ndone\n\nlemma rulesIsSym : \n \" symProtRules' N (rules N)\"\n unfolding rules_def apply(rule symProtRulesUnion, blast intro:symProtAll)+\nunfolding rules_def apply(blast intro: symProtAll )\n\ndone\n\nlemma rule_refsIsSym : \n \" symProtRules' N (rule_refs N)\"\n unfolding rule_refs_def apply(rule symProtRulesUnion, blast intro:symProtAllRef)+\nunfolding rule_refs_def apply(blast intro: symProtAllRef )\n\ndone\n\nlemma rule_refsWellTyped : \n \"[|r : rule_refs N|] ==> deriveRule (env N) r\"\n unfolding rule_refs_def using deriveAllRef apply(auto ) \n \ndone\n\nlemma ReachStafitEnv : \n \"[|reachableUpTo (allInitSpecs N) (rule_refs N) k s|] ==> fitEnv s (env N)\"\n apply(erule invIntro1)\nsubgoal for s0\n unfolding fitEnv_def apply(rule allI)\n apply(rule impI)\n apply(case_tac \"v\")\n \n subgoal for v x1\n apply(case_tac \"x1 = ''x''\")\n \n apply(subgoal_tac \"formEval (initSpec1) s0\")\n \n apply(auto )[1] \n \n apply(auto )[1] \n \n apply(auto ) \n done\n \n subgoal for v x21 x22\n apply(case_tac \"x21 = ''n''\")\n \n apply(subgoal_tac \"formEval (initSpec0 N) s0\")\n \n apply(auto )[1] \n \n apply(auto )[1] \n \n apply(auto ) \n done\n \n apply(auto ) \n done\n\nsubgoal for r sk\n unfolding rule_refs_def apply(auto intro: Un_iff lemmaTry_fitEnv lemmaCrit_fitEnv lemmaExit_fitEnv lemmaIdle_fitEnv ) \n done\n\ndone\n\nlemma absProtSim : \n \"[|M < N;M = 1;isProtObsInvSet (ABS_rules M) (absTransfForm (env N) M ` allInitSpecs N) (set (InvS' N)) M (env N)|] ==> isParamProtInvSet (rules N) (allInitSpecs N) (set (InvS N)) N\"\n apply(rule_tac ?rs2.0 = \"rule_refs N\" and env=\"env N\" and S=\"set (InvS N)\" and S'=\"set (InvS' N)\" and M=M and absRules=\"ABS_rules M\" in CMP)\nsubgoal for r\n using wellFormedRule_refs apply(auto ) \n done\n\nsubgoal unfolding InvS'_def lemmasFor_Try'_def lemmasFor_Crit'_def lemmasFor_Exit'_def lemmasFor_Idle'_def using symInvs apply(auto ) \n done\n\nsubgoal using rulesIsSym apply(auto ) \n done\n\nsubgoal using symPreds apply(auto ) \n done\n\nsubgoal apply(auto ) \n done\n\nsubgoal apply(auto ) \n done\n\nsubgoal using SafeAndderiveAll apply(auto ) \n done\n\nsubgoal using StrengthRelRules2Rule_refs apply(auto ) \n done\n\nsubgoal using rule_refsIsSym apply(auto ) \n done\n\nsubgoal using rule_refsWellTyped apply(auto ) \n done\n\nsubgoal apply(auto ) \n done\n\nsubgoal using ReachStafitEnv apply(auto ) \n done\n\nsubgoal unfolding InvS_def InvS'_def apply(auto ) \n \n subgoal using strengthenVsObsLs_lemmasFor_Try apply(auto ) \n done\n \n subgoal using strengthenVsObsLs_lemmasFor_Crit apply(auto ) \n done\n \n subgoal using strengthenVsObsLs_lemmasFor_Exit apply(auto ) \n done\n \n subgoal using strengthenVsObsLs_lemmasFor_Idle apply(auto ) \n done\n done\n\n apply(rule equivRuleSetReflex)\n using ABS_all apply(auto ) \n \ndone\n\nend\n", "meta": {"author": "forSubmission238", "repo": "autoCMP", "sha": "5d8dfa67306904b61a1cb92777edb311c68bd53b", "save_path": "github-repos/isabelle/forSubmission238-autoCMP", "path": "github-repos/isabelle/forSubmission238-autoCMP/autoCMP-5d8dfa67306904b61a1cb92777edb311c68bd53b/mutualEx/mutualEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2982165731323127}} {"text": "section \\Operation Identification Phase\\\ntheory Sepref_Id_Op\nimports \n Main \n Automatic_Refinement.Refine_Lib\n Automatic_Refinement.Autoref_Tagging\n \"Lib/Named_Theorems_Rev\"\nbegin\n\ntext \\\n The operation identification phase is adapted from the Autoref tool.\n The basic idea is to have a type system, which works on so called \n interface types (also called conceptual types). Each conceptual type\n denotes an abstract data type, e.g., set, map, priority queue.\n \n Each abstract operation, which must be a constant applied to its arguments,\n is assigned a conceptual type. Additionally, there is a set of \n {\\emph pattern rewrite rules},\n which are applied to subterms before type inference takes place, and \n which may be backtracked over. \n This way, encodings of abstract operations in Isabelle/HOL, like \n @{term [source] \"\\_. None\"} for the empty map, \n or @{term [source] \"fun_upd m k (Some v)\"} for map update, can be rewritten\n to abstract operations, and get properly typed.\n\\\n\nsubsection \"Proper Protection of Term\"\ntext \\ The following constants are meant to encode abstraction and \n application as proper HOL-constants, and thus avoid strange effects with\n HOL's higher-order unification heuristics and automatic \n beta and eta-contraction.\n\n The first step of operation identification is to protect the term\n by replacing all function applications and abstractions be \n the constants defined below.\n\\\n\ndefinition [simp]: \"PROTECT2 x (y::prop) \\ x\"\nconsts DUMMY :: \"prop\"\n\nabbreviation PROTECT2_syn (\"'(#_#')\") where \"PROTECT2_syn t \\ PROTECT2 t DUMMY\"\n\nabbreviation (input)ABS2 :: \"('a\\'b)\\'a\\'b\" (binder \"\\\\<^sub>2\" 10)\n where \"ABS2 f \\ (\\x. PROTECT2 (f x) DUMMY)\"\n\nlemma beta: \"(\\\\<^sub>2x. f x)$x \\ f x\" by simp\n\ntext \\\n Another version of @{const \"APP\"}. Treated like @{const APP} by our tool.\n Required to avoid infinite pattern rewriting in some cases, e.g., map-lookup.\n\\\n\ndefinition APP' (infixl \"$''\" 900) where [simp, autoref_tag_defs]: \"f$'a \\ f a\"\n\ntext \\\n Sometimes, whole terms should be protected from being processed by our tool.\n For example, our tool should not look into numerals. For this reason,\n the \\PR_CONST\\ tag indicates terms that our tool shall handle as\n atomic constants, an never look into them.\n\n The special form \\UNPROTECT\\ can be used inside pattern rewrite rules.\n It has the effect to revert the protection from its argument, and then wrap\n it into a \\PR_CONST\\.\n\\\ndefinition [simp, autoref_tag_defs]: \"PR_CONST x \\ x\" \\ \\Tag to protect constant\\\ndefinition [simp, autoref_tag_defs]: \"UNPROTECT x \\ x\" \\ \\Gets \n converted to @{term PR_CONST}, after unprotecting its content\\\n\n\nsubsection \\Operation Identification\\\n\ntext \\ Indicator predicate for conceptual typing of a constant \\\ndefinition intf_type :: \"'a \\ 'b itself \\ bool\" (infix \"::\\<^sub>i\" 10) where\n [simp]: \"c::\\<^sub>iI \\ True\"\n\nlemma itypeI: \"c::\\<^sub>iI\" by simp\nlemma itypeI': \"intf_type c TYPE('T)\" by (rule itypeI)\n\nlemma itype_self: \"(c::'a) ::\\<^sub>i TYPE('a)\" by simp\n\ndefinition CTYPE_ANNOT :: \"'b \\ 'a itself \\ 'b\" (infix \":::\\<^sub>i\" 10) where\n [simp]: \"c:::\\<^sub>iI \\ c\"\n\ntext \\ Wrapper predicate for an conceptual type inference \\\ndefinition ID :: \"'a \\ 'a \\ 'c itself \\ bool\" \n where [simp]: \"ID t t' T \\ t=t'\"\n\nsubsubsection \\Conceptual Typing Rules\\\n\nlemma ID_unfold_vars: \"ID x y T \\ x\\y\" by simp\nlemma ID_PR_CONST_trigger: \"ID (PR_CONST x) y T \\ ID (PR_CONST x) y T\" .\n\nlemma pat_rule:\n \"\\ p\\p'; ID p' t' T \\ \\ ID p t' T\" by simp\n\nlemma app_rule:\n \"\\ ID f f' TYPE('a\\'b); ID x x' TYPE('a)\\ \\ ID (f$x) (f'$x') TYPE('b)\"\n by simp\n\nlemma app'_rule:\n \"\\ ID f f' TYPE('a\\'b); ID x x' TYPE('a)\\ \\ ID (f$'x) (f'$x') TYPE('b)\"\n by simp\n\nlemma abs_rule:\n \"\\ \\x x'. ID x x' TYPE('a) \\ ID (t x) (t' x x') TYPE('b) \\ \\\n ID (\\\\<^sub>2x. t x) (\\\\<^sub>2x'. t' x' x') TYPE('a\\'b)\"\n by simp\n\nlemma id_rule: \"c::\\<^sub>iI \\ ID c c I\" by simp\n\nlemma annot_rule: \"ID t t' I \\ ID (t:::\\<^sub>iI) t' I\"\n by simp\n\nlemma fallback_rule:\n \"ID (c::'a) c TYPE('c)\"\n by simp\n\nlemma unprotect_rl1: \"ID (PR_CONST x) t T \\ ID (UNPROTECT x) t T\"\n by simp\n\nsubsection \\ ML-Level code \\\nML \\\ninfix 0 THEN_ELSE_COMB'\n\nsignature ID_OP_TACTICAL = sig\n val SOLVE_FWD: tactic' -> tactic'\n val DF_SOLVE_FWD: bool -> tactic' -> tactic'\nend\n\nstructure Id_Op_Tactical :ID_OP_TACTICAL = struct\n\n fun SOLVE_FWD tac i st = SOLVED' (\n tac \n THEN_ALL_NEW_FWD (SOLVE_FWD tac)) i st\n\n\n (* Search for solution with DFS-strategy. If dbg-flag is given,\n return sequence of stuck states if no solution is found.\n *)\n fun DF_SOLVE_FWD dbg tac = let\n val stuck_list_ref = Unsynchronized.ref []\n\n fun stuck_tac _ st = if dbg then (\n stuck_list_ref := st :: !stuck_list_ref;\n Seq.empty\n ) else Seq.empty\n\n fun rec_tac i st = (\n (tac THEN_ALL_NEW_FWD (SOLVED' rec_tac))\n ORELSE' stuck_tac\n ) i st\n\n fun fail_tac _ _ = if dbg then\n Seq.of_list (rev (!stuck_list_ref))\n else Seq.empty\n in\n rec_tac ORELSE' fail_tac \n end\n\nend\n\\\n\n\nnamed_theorems_rev id_rules \"Operation identification rules\"\nnamed_theorems_rev pat_rules \"Operation pattern rules\"\nnamed_theorems_rev def_pat_rules \"Definite operation pattern rules (not backtracked over)\"\n\n\n\nML \\\n\n structure Id_Op = struct\n\n fun id_a_conv cnv ct = case Thm.term_of ct of\n @{mpat \"ID _ _ _\"} => Conv.fun_conv (Conv.fun_conv (Conv.arg_conv cnv)) ct\n | _ => raise CTERM(\"id_a_conv\",[ct])\n\n fun \n protect env (@{mpat \"?t:::\\<^sub>i?I\"}) = let\n val t = protect env t\n in \n @{mk_term env: \"?t:::\\<^sub>i?I\"}\n end\n | protect _ (t as @{mpat \"PR_CONST _\"}) = t\n | protect env (t1$t2) = let\n val t1 = protect env t1\n val t2 = protect env t2\n in\n @{mk_term env: \"?t1.0 $ ?t2.0\"}\n end\n | protect env (Abs (x,T,t)) = let\n val t = protect (T::env) t\n in\n @{mk_term env: \"\\v_x::?'v_T. PROTECT2 ?t DUMMY\"}\n end\n | protect _ t = t\n\n fun protect_conv ctxt = Refine_Util.f_tac_conv ctxt\n (protect []) \n (simp_tac \n (put_simpset HOL_basic_ss ctxt addsimps @{thms PROTECT2_def APP_def}) 1)\n\n fun unprotect_conv ctxt\n = Simplifier.rewrite (put_simpset HOL_basic_ss ctxt \n addsimps @{thms PROTECT2_def APP_def})\n\n fun do_unprotect_tac ctxt =\n resolve_tac ctxt @{thms unprotect_rl1} THEN'\n CONVERSION (Refine_Util.HOL_concl_conv (fn ctxt => id_a_conv (unprotect_conv ctxt)) ctxt)\n\n val cfg_id_debug = \n Attrib.setup_config_bool @{binding id_debug} (K false)\n\n val cfg_id_trace_fallback = \n Attrib.setup_config_bool @{binding id_trace_fallback} (K false)\n\n fun dest_id_rl thm = case Thm.concl_of thm of\n @{mpat (typs) \"Trueprop (?c::\\<^sub>iTYPE(?'v_T))\"} => (c,T)\n | _ => raise THM(\"dest_id_rl\",~1,[thm])\n\n \n val add_id_rule = snd oo Thm.proof_attributes [Named_Theorems_Rev.add @{named_theorems_rev id_rules}]\n\n datatype id_tac_mode = Init | Step | Normal | Solve\n\n fun id_tac ss ctxt = let\n open Id_Op_Tactical\n val certT = Thm.ctyp_of ctxt\n val cert = Thm.cterm_of ctxt\n\n val thy = Proof_Context.theory_of ctxt\n\n val id_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev id_rules}\n val pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev pat_rules}\n val def_pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev def_pat_rules}\n\n val rl_net = Tactic.build_net (\n (pat_rules |> map (fn thm => thm RS @{thm pat_rule})) \n @ @{thms annot_rule app_rule app'_rule abs_rule} \n @ (id_rules |> map (fn thm => thm RS @{thm id_rule}))\n )\n\n val def_rl_net = Tactic.build_net (\n (def_pat_rules |> map (fn thm => thm RS @{thm pat_rule}))\n ) \n\n val id_pr_const_rename_tac = \n resolve_tac ctxt @{thms ID_PR_CONST_trigger} THEN'\n Subgoal.FOCUS (fn { context=ctxt, prems, ... } => \n let\n fun is_ID @{mpat \"Trueprop (ID _ _ _)\"} = true | is_ID _ = false\n val prems = filter (Thm.prop_of #> is_ID) prems\n val eqs = map (fn thm => thm RS @{thm ID_unfold_vars}) prems\n val conv = Conv.rewrs_conv eqs\n val conv = fn ctxt => (Conv.top_sweep_conv (K conv) ctxt)\n val conv = fn ctxt => Conv.fun2_conv (Conv.arg_conv (conv ctxt))\n val conv = Refine_Util.HOL_concl_conv conv ctxt\n in CONVERSION conv 1 end \n ) ctxt THEN'\n resolve_tac ctxt @{thms id_rule} THEN'\n resolve_tac ctxt id_rules \n\n val ityping = id_rules \n |> map dest_id_rl\n |> filter (is_Const o #1)\n |> map (apfst (#1 o dest_Const))\n |> Symtab.make_list\n\n val has_type = Symtab.defined ityping\n\n fun mk_fallback name cT =\n case try (Sign.the_const_constraint thy) name of\n SOME T => try (Thm.instantiate' \n [SOME (certT cT), SOME (certT T)] [SOME (cert (Const (name,cT)))])\n @{thm fallback_rule} \n | NONE => NONE\n\n fun trace_fallback thm = \n Config.get ctxt cfg_id_trace_fallback \n andalso let \n open Pretty\n val p = block [str \"ID_OP: Applying fallback rule: \", Thm.pretty_thm ctxt thm]\n in \n string_of p |> tracing; \n false\n end \n\n val fallback_tac = CONVERSION Thm.eta_conversion THEN' IF_EXGOAL (fn i => fn st =>\n case Logic.concl_of_goal (Thm.prop_of st) i of\n @{mpat \"Trueprop (ID (mpaq_STRUCT (mpaq_Const ?name ?cT)) _ _)\"} => (\n if not (has_type name) then \n case mk_fallback name cT of\n SOME thm => (trace_fallback thm; resolve_tac ctxt [thm] i st)\n | NONE => Seq.empty \n else Seq.empty\n )\n | _ => Seq.empty)\n\n val init_tac = CONVERSION (\n Refine_Util.HOL_concl_conv (fn ctxt => (id_a_conv (protect_conv ctxt))) \n ctxt\n )\n\n val step_tac = (FIRST' [\n assume_tac ctxt, \n eresolve_tac ctxt @{thms id_rule},\n resolve_from_net_tac ctxt def_rl_net, \n resolve_from_net_tac ctxt rl_net, \n id_pr_const_rename_tac,\n do_unprotect_tac ctxt, \n fallback_tac])\n\n val solve_tac = DF_SOLVE_FWD (Config.get ctxt cfg_id_debug) step_tac \n\n in\n case ss of\n Init => init_tac \n | Step => step_tac \n | Normal => init_tac THEN' solve_tac\n | Solve => solve_tac\n\n end\n\n end\n\n\\\n\nsubsection \\Default Setup\\\n\nsubsubsection \\Numerals\\ \nlemma pat_numeral[def_pat_rules]: \"numeral$x \\ UNPROTECT (numeral$x)\" by simp\n\nlemma id_nat_const[id_rules]: \"(PR_CONST (a::nat)) ::\\<^sub>i TYPE(nat)\" by simp\nlemma id_int_const[id_rules]: \"(PR_CONST (a::int)) ::\\<^sub>i TYPE(int)\" by simp\n\n(*subsection \\Example\\\nschematic_lemma \n \"ID (\\a b. (b(1::int\\2::nat) |`(-{3})) a, Map.empty, \\a. case a of None \\ Some a | Some _ \\ None) (?c) (?T::?'d itself)\"\n (*\"TERM (?c,?T)\"*)\n using [[id_debug]]\n apply (tactic {* Id_Op.id_tac Id_Op.Normal @{context} 1 *}) \n done\n*)\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Sepref_Id_Op.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2980381721884717}} {"text": "theory spatial\nimports Main\nbegin\n\ndeclare [[ smt_timeout = 20 ]]\n\nabbreviation reflexive\n where \"reflexive \\ \\ R. \\ r. R r r\"\nabbreviation transitive\n where \"transitive \\ \\ R. \\ x. \\ y. \\ z. R x y \\ R y z \\ R x z\"\nabbreviation symmetric\n where \"symmetric \\ \\ R. \\ x. \\ y. R x y \\ R y x\"\n\n\n(*The mutually recursive datatypes of processes and names*)\ndatatype P = Null (\"\\<^bold>0\")\n | Input n n P (\"_\\_._.\" 80)\n | Lift n P (\"_\\_\\\" 80)\n | Drop n (\"\\_`\" 80)\n | Par P P (infixl \"\\\" 75) \n and n = Quote P (\"`_\\\")\ntermination\n apply size_change\n proof - qed\n\n(*Syntactic sugar for output on a channel*)\nabbreviation Output :: \"n \\ n \\ P\" (\"_[[_]]\")\n where \"Output x y \\ x\\\\y`\\\"\n\nvalue \"a[[b]]\"\nvalue \"zero \\ zero.\\<^bold>0\"\nvalue \"\\<^bold>0\\\\<^bold>0\"\nvalue \"\\zero`\"\nvalue \"zero\\\\<^bold>0\\\"\nvalue \"(c\\d.(e))\"\n\n\nfun newName :: \"nat \\ n\"\n where \"newName 0 = `\\<^bold>0\\\"\n |\"newName (Suc n) = `(Output (newName n) (newName n))\\\"\n\nabbreviation zero :: n\n where \"zero \\ `\\<^bold>0\\\"\nabbreviation one :: n\n where \"one \\ newName 1\"\nabbreviation two :: n\n where \"two \\ newName 2\"\nabbreviation three :: n\n where \"three \\ newName 3\"\nabbreviation four :: n\n where \"four \\ newName 4\"\n\nabbreviation Zero :: P\n where \"Zero \\ Null\"\nabbreviation One :: P\n where \"One \\ \\one`\"\nabbreviation Two :: P\n where \"Two \\ \\two`\"\nabbreviation Three :: P\n where \"Three \\ \\three`\"\nabbreviation Four :: P\n where \"Four \\ \\four`\" \n\nvalue \"zero \\ zero.\\<^bold>0.\"\nvalue \"\\<^bold>0\\\\<^bold>0\"\nvalue \"\\zero`\"\nvalue \"zero\\\\<^bold>0\\\"\nvalue \"(c\\d.(e).)\"\n\nfun getList :: \"P \\ P list\"\nwhere\n \"getList \\<^bold>0 = []\"\n |\"getList (a\\b) = ((getList a)@(getList b))\"\n |\"getList a = [a]\"\n\n(*\nfun la :: \"P \\ P\"\nwhere\n \"la (a\\(b\\c)) = ((la (a\\b))\\(la c))\"\n |\"la a = a\"\n\nvalue \"la (Null \\ (Null \\ (Null \\ (Null \\ Null))))\"\nvalue \"la ((Null \\ Null) \\ (Null \\ (Null \\ Null)))\"\n*)\n\nfunction congru :: \"P \\ P \\ bool\" (infixl \"=C\" 42)\n and eq2 :: \"P list \\ P list \\ P list \\ bool\"\nwhere\n \"congru (a\\b) (c\\d) = (eq2 (getList (a\\b)) (getList (c\\d)) [])\"\n |\"congru (x\\y.(a).) (xx\\yy.(b).) = ((a =C b) \\ (x=xx) \\ (y = yy))\"\n |\"congru (x\\a\\) (y\\b\\) = ((a =C b) \\ (x = y))\"\n |\"congru (\\a`) (\\b`) = (a = b)\"\n |\"congru Null Null = True\"\n |\"congru (a\\b) Null = ((a =C Null)\\(b =C Null))\"\n |\"congru Null (a\\b) = ((a =C Null)\\(b =C Null))\"\n |\"congru (a\\b) (c\\d.(e).) = (eq2 (getList (a\\b)) ((c\\d.(e).)#[]) [])\"\n |\"congru (c\\d.(e).) (a\\b) = (eq2 (getList (a\\b)) ((c\\d.(e).)#[]) [])\"\n |\"congru (a\\b) (c\\d\\) = (eq2 (getList (a\\b)) ((c\\d\\)#[]) [])\"\n |\"congru (c\\d\\) (a\\b) = (eq2 (getList (a\\b)) ((c\\d\\)#[]) [])\"\n |\"congru (a\\b) (\\c`) = (eq2 (getList (a\\b)) ((\\c`)#[]) [])\"\n |\"congru (\\c`) (a\\b) = (eq2 (getList (a\\b)) ((\\c`)#[]) [])\"\n\n (* for f*cks sake, why cant I have some statement for remaining cases? *)\n |\"congru (\\a`) Null = False\"\n |\"congru Null (\\b`) = False\"\n |\"congru (\\a`) (_\\_._.) = False\"\n |\"congru (_\\_._.) (\\b`) = False\"\n |\"congru (\\a`) (_\\_\\) = False\"\n |\"congru (_\\_\\) (\\b`) = False\"\n |\"congru (_\\_\\) Null = False\"\n |\"congru Null (_\\_\\) = False\"\n |\"congru (_\\_\\) (_\\_._.) = False\"\n |\"congru (_\\_._.) (_\\_\\) = False\"\n |\"congru (_\\_._.) Null = False\"\n |\"congru Null (_\\_._.) = False\"\n\n |\"eq2 [] [] [] = True\"\n |\"eq2 (x#xs) [] [] = False\"\n |\"eq2 [] [] (a#as) = False\"\n |\"eq2 (x#xs) [] (b#bs) = False\"\n |\"eq2 [] (b#bs) _ = False\"\n |\"eq2 (x#xs) (y#ys) zs = (if (x =C y) then (eq2 xs (zs@ys) []) else (eq2 (x#xs) ys (y#zs)))\"\nby (auto, pat_completeness)\n\n(* \n in order to proof the termination I'd need to find a measure function\n the bad part is that i need to prove the termination of this counting function as well\n *)\n\nabbreviation maxl where \"maxl \\ \\l. foldl (\\a.\\b. (max a b)) 0 l\"\n\nfun sdepth :: \"P \\ nat\" where\n \"sdepth Null = 0\"\n | \"sdepth (x \\ y . P.) = 1 + sdepth P\"\n | \"sdepth (x \\ P \\) = 1 + sdepth P\"\n | \"sdepth (P \\ Q) = 1 + (max (sdepth P) (sdepth Q))\"\n | \"sdepth (\\x`) = 0\"\n\nfun di::\"nat \\ nat\" where \n \"di 0 = 0\"\n| \"di (Suc(Suc v)) = (Suc (di v))\"\n\n\nabbreviation llength where \"llength \\ \\x::P list. (di ((length x)*(length x + 1)))\"\n\n\nfunction\n depth :: \"P \\ nat\"\nwhere\n \"depth \\<^bold>0 = 0\"\n | \"depth (x \\ y . P.) = 1 + depth P\"\n | \"depth (x \\ P \\) = 1 + depth P\"\n | \"depth (P \\ Q) = 1 + (maxl (map depth (getList (P\\Q)))) + llength (getList (P\\Q))\"\n | \"depth (\\x`) = 0\"\napply auto\napply pat_completeness\ndone\ntermination\napply (relation \"measure (\\x.(sdepth x))\")\napply auto\n(*proof -\n fix P Q x\n assume \"x\\ set (getList P)\"\n show \"sdepth x < Suc (max (sdepth P) (sdepth Q))\"\n (* damn it, so close *)*)\nsorry\n\ntermination congru\n(* cannot come up with a good measuring function without *)\napply (relation \"measure (\n\\x. case x of \n Inl (a,b) \n \\ (Max({depth a, depth b})) \n| Inr (a,b,c) \n \\ max (maxl (map depth (a))) (maxl (map depth (b@c))) )\")\napply auto\nsorry\n\n\nvalue \"(( \\<^bold>0 \\ (n\\<^sub>1\\\\<^bold>0 \\ \\<^bold>0\\)) =C (n\\<^sub>1\\\\<^bold>0\\))\"\n\n\n\n(*\ntheorem eqReflexive:\n assumes \"reflexive congru\"\n shows \"reflexive eq\"\nproof \n fix r\n show \"eq r r\"\n proof (induction r)\n show \"eq [] []\" by simp\n next\n fix a r\n assume eqr: \"eq r r\"\n show \"eq (a#r) (a#r)\"\n proof auto\n assume \"a =C a\"\n show \"eq2 r r []\" using eqr by auto\n next\n assume na: \"\\ a =C a\"\n show \"eq2 (a#r) r [a]\"\n proof -\n (* assume req: \"reflexive eq\"\n from this req have \"reflexive congru\" by (meson assms eq.elims(2) eq2.simps(4) eq2.simps(6))*)\n from assms have \"a =C a\" by simp\n from this na show \"eq2 (a#r) r [a]\" by simp (* i want to prove this through contradiction *)\n qed\n qed\n qed \nqed\n\nlemma \"getList r = getList r\" by simp\n*)\n\n(*\nlemma listtocongru:\n assumes \"eq2 (getList a) (getList a) []\"\n shows \"a =C a\"\n apply (induction a)\n apply auto\n proof -\n fix a1 a2\n assume \"a1 =C a1\" and \"a2 =C a2\"\n show \"eq2 (getList a1 @ getList a2) (getList a1 @ getList a2) []\"\n apply (induction a1)\n apply auto \nsorry\n*)\n\n(*\nlemma congrutolist:\n assumes \"a =C a\"\n shows \"eq2 (getList a) (getList a) []\"\n apply (induction a)\n apply auto\n apply (simp add: listtocongru)\n apply (simp add: listtocongru) \n proof -\n fix a1 a2\n assume h1: \"eq2 (getList a1) (getList a1) []\"\n assume h2: \"eq2 (getList a2) (getList a2) []\"\n show \"eq2 (getList a1 @ getList a2) (getList a1 @ getList a2) []\"\n apply (induction a1)\n apply auto\n apply (simp add: h1 h2)\n apply (simp add: h1 h2)\n proof (rule ccontr)\n fix x1 x2a a1\n assume \"eq2 (getList a1 @ getList a2) (getList a1 @ getList a2) []\"\n assume \"\\ a1 =C a1\"\n from assms have \"a1 =C a1\"\n\nsorry\n\nlemma partolist:\n assumes \"a =C a\" and \"b =C b\"\n shows \"eq2 ((getList a)@(getList b)) ((getList a)@(getList b)) []\"\nsorry\n*)\n(*\n proof (auto, induction r1)\n show \"eq2 (getList \\<^bold>0 @ getList r2) (getList \\<^bold>0 @ getList r2) []\"\n apply auto\n apply (simp add: congrutolist b)\n done\n next\n fix x1 x2a::n\n fix P2:: \"n \\ bool\"\n assume \"P2 x1\"\n assume \"P2 x2a\"\n assume \"eq2 (getList r1 @ getList r2) (getList r1 @ getList r2) []\" \n show \"eq2 (getList (x1\\x2a.(r1)) @ getList r2) (getList (x1\\x2a.(r1)) @ getList r2) []\"\n proof -\n*)\n\n\n(*\ntheorem asdadsds:\n assumes \"\\ a. a =C a\"\n shows \"eq (getList a) (getList a)\"\n apply auto\n apply (induction a)\n apply auto\n apply (simp add: listtocongru)\n apply (simp add: listtocongru) \n proof -\n fix a1 a2\n assume h1: \"eq2 (getList a1) (getList a1) []\"\n assume h2: \"eq2 (getList a2) (getList a2) []\"\n show \"eq2 (getList a1 @ getList a2) (getList a1 @ getList a2) []\"\n apply (induction a1)\n apply auto\n apply (simp add: h1 h2)\n apply (simp add: h1 h2)\n proof (rule ccontr)\n fix x1 x2a a1\n assume \"eq2 (getList a1 @ getList a2) (getList a1 @ getList a2) []\"\n assume \"\\ a1 =C a1\"\n from assms have \"a1 =C a1\"\n sledgehammer\n*)\n(*\ntheorem congruReflexive:\n shows \"reflexive congru\"\n and \"\\b::P. eq2 (getList b) (getList b) []\"\nproof auto\n fix r\n fix b::P\n show \"r =C r\" \"eq2 (getList r) (getList r) []\"\n apply (induct r)\n apply auto\n proof -\n show \"Null =C Null\" by simp\n next\n fix x1 x2a r2\n assume \"r2 =C r2\"\n show \"(Input x1 x2a r2 =C Input x1 x2a r2)\" by (simp add: \\r2 =C r2\\)\n next\n fix x1 r2\n assume a:\"r2 =C r2\"\n show \"(x1\\r2\\) =C (x1\\r2\\)\" by (simp add: a)\n next\n fix x\n show \"\\x` =C \\x`\" by simp\n next\n fix r1 r2\n assume a: \"r1 =C r1\" and b: \"r2 =C r2\"\n show \"(r1\\r2) =C (r1\\r2)\"\n apply auto\n apply (simp add: a b partolist)\n done\n next\n (* I have no idea what I have to show here!? *)\n fix r2\n fix P2::\"n \\ bool\"\n assume \"r2 =C r2\"\n show \"P2 `r2\\\"\n sorry\n next\n qed\nqed\n*)\n\n\ntheorem congruReflexive:\n shows \"reflexive congru\"\nsorry\n\ntheorem congruTransitive:\n shows \"transitive congru\"\nsorry\n\ntheorem congruSymmetric:\n shows \"symmetric congru\"\nsorry\n\ntheorem eqReflexive:\n shows \"\\ a b. (eq2 a a [])\"\nsorry\n\ntheorem eqSymmetric:\n shows \"\\ a b. (eq2 a b [] \\ eq2 b a [])\"\nsorry\n\ntheorem eqTransitive:\n shows \"\\ a b c. (((eq2 a b []) \\ (eq2 b c [])) \\ (eq2 a c []))\"\nsorry\n\ntheorem parAssoc:\n shows \"((a\\b)\\c) =C (a\\(b\\c))\"\nsorry\n\ntheorem parKommutative:\n shows \"a\\b =C b\\a\"\nsorry\n\ntheorem zeroLeft:\n shows \"(Null \\ a) =C a\"\nsorry\n\ntheorem zeroRight:\n shows \"(a \\ Null) =C a\"\nsorry\n\ntheorem someshit:\nshows \"(((zero\\zero.\\<^bold>0.) \\ \\<^bold>0) \\ (zero\\zero.\\<^bold>0.)) =C (((zero\\zero.\\<^bold>0.) \\ (zero\\zero.\\<^bold>0.)) \\ \\<^bold>0)\"\nby simp\n\nvalue \"getList ((a \\ b) \\ c)\"\nvalue \"(((zero\\zero.\\<^bold>0.) \\ \\<^bold>0) \\ (zero\\zero.\\<^bold>0.)) =C (((zero\\zero.\\<^bold>0.) \\ (zero\\zero.\\<^bold>0.)) \\ \\<^bold>0)\"\n\n\n(*Name equivalence*)\nfun name_equivalence :: \"n \\ n \\ bool\" (infix \"=N\" 52)\n where \n \"zero =N `Input x y P\\ = False\"\n | \"zero =N `Lift _ _\\ = False\"\n | \"zero =N `Par P Q\\ = (Null =C (P\\Q))\"\n | \"zero =N `\\a`\\ = (zero =N a)\"\n | \"zero =N zero = True\"\n\n | \"((`(Input x y P)\\) =N `Input p q Q\\) = ((Input x y P) =C (Input p q Q))\"\n | \"((`(Input x y P)\\) =N `Lift _ _\\) = False\"\n | \"((`(Input x y P)\\) =N `Par _ _\\) = False\"\n | \"((`(Input x y P)\\) =N zero) = False\"\n | \"((`(Input x y P)\\) =N `\\a`\\) = (`(Input x y P)\\ =N a)\"\n\n | \"((`Lift x P\\) =N `Lift y Q\\) = (Lift x P =C Lift y Q)\"\n | \"((`Lift x P\\) =N `Input _ _ _\\) = False\"\n | \"((`Lift x P\\) =N `Par _ _\\) = False\"\n | \"((`Lift x P\\) =N zero) = False\"\n | \"((`Lift x P\\) =N `\\a`\\) = (`(Lift x P)\\ =N a)\"\n\n | \"((`P\\Q\\) =N (`A\\B\\)) = ((P\\Q) =C (A\\B))\"\n | \"((`P\\Q\\) =N (`Lift _ _\\)) = False\"\n | \"((`P\\Q\\) =N (`Input _ _ _\\)) = False\"\n | \"((`P\\Q\\) =N zero) = ((P\\Q) =C Null)\"\n | \"((`P\\Q\\) =N (`\\a`\\)) = (`(P\\Q)\\ =N a)\"\n\n | \"`\\a`\\ =N `Input x y P\\ = (a =N `Input x y P\\)\"\n | \"`\\a`\\ =N `Lift x P\\ = (a =N `Lift x P\\)\"\n | \"`\\a`\\ =N `Par P Q\\ = (a =N `Par P Q\\)\"\n | \"`\\a`\\ =N `\\b`\\ = (a =N b)\"\n | \"`\\a`\\ =N zero = (a =N zero)\"\n\n\nvalue \"`\\zero`\\ =N zero\"\nvalue \"`\\`\\zero`\\`\\ =N zero\"\nvalue \"newName 3 =N three\"\nvalue \"newName 3 =N zero\"\nvalue \"three =N newName 3\"\nvalue \"`((One\\Two)\\(Three\\Four))\\Null\\ =N `((One\\Three)\\(Two\\Four))\\\"\n\ntheorem name_equivalence_reflexive:\n shows \"reflexive name_equivalence\"\napply auto\nproof -\n fix r\n show \"r =N r\"\n using congruReflexive by (induction r rule: name_equivalence.induct, auto)\nqed\n\ntheorem name_equivalence_symmetric:\n assumes \"x =N y\"\n shows \"y =N x\"\nusing assms congruSymmetric eqSymmetric by (induct x rule: name_equivalence.induct, auto)\n\ntheorem name_equivalence_transitive:\n assumes \"a =N b\" and \"b =N c\"\n shows \"a =N c\"\n(* I dont know how to make an induction argument here which runs over all three variables *)\n(*\nusing assms apply (induct a c rule: name_equivalence.induct)\napply auto\napply (simp add: assms congruTransitive eqTransitive)\n*)\nsorry\n\n\nvalue \"`p \\ (\\<^bold>0 \\ q)\\ =N `q \\ p\\\"\n\ntheorem testNameEQ1:\n shows \"`p \\ (\\<^bold>0 \\ q)\\ =N `q \\ p\\\"\nusing parKommutative by auto\n\n(*Gives the set of free names in a process*)\nfun free :: \"P \\ n set\" where\n \"free \\<^bold>0 = {}\"\n | \"free (x \\ y . P.) = {x} \\ (free(P) - {y})\"\n | \"free (x \\ P \\) = {x} \\ free P\"\n | \"free (P \\ Q) = free P \\ free Q\"\n | \"free (\\x`) = {x}\"\n\n(*Gives the set of bound names in a process*)\nfun bound :: \"P \\ n set\" where\n \"bound \\<^bold>0 = {}\"\n | \"bound (x \\ y . P.) = {y} \\ bound(P)\"\n | \"bound (x \\ P \\) = bound P\"\n | \"bound (P \\ Q) = bound P \\ bound Q\"\n | \"bound (\\x`) = {}\"\n\n(*Names occurring in a process*)\nfun names :: \"P \\ n set\"\n where \"names P = free(P) \\ bound(P)\"\n\n(*quote depth*)\nfunction n_depth :: \"n \\ nat\" (\"#\" 60) \n and P_depth :: \"P \\ nat\" (\"#\" 60)\n where\n \"n_depth `P\\ = 1 + (P_depth P)\"\n | \"P_depth P = (if (names P \\ {}) then Max({ ( n_depth x ) | x. x \\ (names P)}) else 0)\"\n apply pat_completeness\n apply blast\n apply simp\n by blast\ntermination\n sorry (*Even without termination proof, we can use the n_depth/P_depth function*)\n\nvalue \"P_depth (\\zero`)\"\n\n\n(*substitution*)\n(*Takes a process, specifies the names to be substituted and returns a process*)\n\nabbreviation sn :: \"n \\ n \\ n \\ n\" where\n \"sn x q p \\ (if (x =N p) then q else x)\" \n\nvalue \"(sn zero zero zero)\"\nvalue \"newName (Max ({(n_depth zero), 0::nat}))\"\n\n(*with z = (newName (P_depth(R)))*)\nabbreviation genz\n where \"genz \\ \\ q::n. \\ p::n. \\ R::P. newName (Max({(n_depth(q)), (P_depth(R)), (n_depth(p)) }))\"\n \n(* syntactic substitution *)\nfunction s :: \"P \\ n \\ n \\ P\" (\"(_) {_\\_}\" 52)\nwhere \"(\\<^bold>0){_\\_} = \\<^bold>0\"\n | \"(R \\ S){q\\p} = ((R){q\\p}) \\ ((S){q\\p})\" \n | \"( x \\ y . R.){q\\p} = ((sn x q p) \\ (genz q p R) . ((R {(genz q p R)\\y}){q\\p}).)\" \n | \"(x \\ R \\) {q\\p} = ((sn x q p) \\R{q\\p}\\)\"\n | \"(\\x`){q\\p} = (if (x =N p) then \\q` else \\x`)\"\napply pat_completeness by auto\ntermination\napply (relation \"measure (\\(p,x,y). (P_depth p))\", auto)\n\n(* see http://isabelle.in.tum.de/doc/functions.pdf *)\n sorry (*induction measure on n_depth*)\n \n(* semantic substitution *)\nfunction ss :: \"P \\ n \\ n \\ P\" (\"(_) s{_\\_}\" 52)\nwhere \"(\\<^bold>0)s{_\\_} = \\<^bold>0\"\n | \"(R \\ S) s{q\\p} = ((R) s{q\\p}) \\ ((S) s{q\\p})\" \n | \"( x \\ y . R.) s{q\\p} = ((sn x q p) \\ (genz q p R) . ((R {(genz q p R)\\y}) s{q\\p}).)\" \n | \"(x \\ R \\) s{q\\p} = ((sn x q p) \\R s{q\\p}\\)\"\n | \"(\\x`) s{`q\\\\p} = (if (x =N p) then q else \\x`)\" (* semantic substitution *)\napply pat_completeness by auto\ntermination\napply (relation \"measure (\\(p,x,y). (P_depth p))\", auto)\n\n(* see http://isabelle.in.tum.de/doc/functions.pdf *)\n sorry (*induction measure on n_depth*)\n\nvalue \"\\<^bold>0{zero\\zero}\"\nvalue \"(zero \\ zero . Zero){two \\ zero}\"\nvalue \"(\\<^bold>0 \\ (\\zero`)) { (newName 2) \\ zero }\"\n\n(*\n 2.6 Dynamic quote: an example\n*)\n\nvalue \"zero\\zero[[three]]\\{two\\three}\"\nvalue \"(zero\\zero[[three]]\\{two\\three}) = (zero\\zero[[two]]\\)\"\n\nvalue \"zero[[`zero[[three]]\\]]{two\\three}\"\nvalue \"zero[[`zero[[three]]\\]]{two\\three} = (zero[[`zero[[three]]\\]])\"\n\n(* Operational Semantics *)\n\nfun toPar:: \"P list \\ P\" where\n \"toPar [] = Null\"\n |\"toPar (x#[]) = x\"\n |\"toPar (x#y#xs) = (x \\ (toPar (y#xs)))\"\n\n\n\nfun syncable:: \"P \\ P \\ bool\" where\n \"syncable (Lift x Q) (Input y z P) = (x =N z)\"\n |\"syncable (Input y z P) (Lift x Q) = (x =N z)\"\n |\"syncable (Lift y P) (Lift x Q) = False\"\n |\"syncable (Input y z P) (Input a b Q) = False\"\n |\"syncable _ (vc \\ vd) = False\"\n |\"syncable (vc \\ vd) _ = False\"\n |\"syncable (\\v`) _ = False\"\n |\"syncable _ (\\v`) = False\"\n |\"syncable Null _ = False\"\n |\"syncable _ Null = False\"\n\nfun sync:: \"P \\ P \\ P\" where\n \"sync (Lift x Q) (Input y z P) = (P s{`Q\\\\y})\"\n |\"sync (Input y z P) (Lift x Q) = (P s{`Q\\\\y})\"\n\nfunction fineRun:: \"P list \\ P list \\ P list \\ P list\" where\n \"fineRun [] [] [] = []\"\n |\"fineRun (x#[]) [] [] = (x#[])\"\n |\"fineRun (x#y#xs) [] zs = (fineRun (y#xs) (x#[]) zs)\"\n |\"fineRun [] (y#ys) (z#[]) = (z#y#ys)\"\n |\"fineRun [] (y#ys) (z#zs) = (fineRun zs (z#y#ys) [])\"\n |\"fineRun (x#xs) (y#ys) zs = (if (syncable x y) then ((sync x y)#xs@ys@zs) else (fineRun (xs) (y#ys) (x#zs)))\"\napply auto\nsorry\ntermination\nsorry\n\nfun step:: \"P \\ P\" where\n \"step P = toPar( fineRun (getList P) [] [])\"\n\n\nabbreviation replication where \"replication \\ (\\y.\\(P,x).(x\\((y\\x.(x[[y]]\\\\y`).)\\P)\\\\(y \\ x.(x[[y]]\\\\y`).)))(`zero[[zero]]\\)\"\nabbreviation xx where \"xx \\ zero\"\nabbreviation yy where \"yy \\ `xx[[xx]]\\\"\n\nvalue \"(replication (two, zero))\"\nvalue \"step (replication (two, zero))\"\nvalue \"step(step (replication (two, zero)))\"\nvalue \"step(step(step (replication (two, zero))))\"\nvalue \"step(step(step(step (replication (two, zero)))))\"\n\n\nlemma False\nsledgehammer\n(*theory is consistent, yay*)\noops\n\nsection\\Alpha equivalence\\\ntext\\Alpha equivalence equates processes that only differ by their bound variables. In our calculus,\nthe bound variables are the names to which we bound input values. As an example we would want the \nfollowing terms to be alpha-equal: \\\n\n(*\ntheorem alphaEq: \nshows \"zero \\ zero . Zero \\\\ one \\ zero . Zero\"\nsorry\n*)\n\nend", "meta": {"author": "MrChico", "repo": "CompMeta", "sha": "6ea156d26df6feaac10d652a3743252f7112655a", "save_path": "github-repos/isabelle/MrChico-CompMeta", "path": "github-repos/isabelle/MrChico-CompMeta/CompMeta-6ea156d26df6feaac10d652a3743252f7112655a/proj/spatial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.29803816461509924}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ArraysMemInstance\nimports Arrays CompoundCTypes\nbegin\n\nprimrec\n array_tag_n :: \"nat \\ ('a::c_type,'b::finite) array typ_info\"\nwhere\n atn_base:\n \"array_tag_n 0 = ((empty_typ_info (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @\n nat_to_bin_string (CARD('b::finite))))::('a::c_type,'b) array\n typ_info)\"\n| atn_rec:\n \"array_tag_n (Suc n) = ((ti_typ_combine TYPE('a::c_type)\n (\\x. index x n) (\\x f. update f n x) (replicate n CHR ''1'')\n (array_tag_n n))::('a,'b::finite) array typ_info)\"\n\ndefinition\n array_tag :: \"('a::c_type,'b::finite) array itself \\ ('a,'b) array typ_info\" where\n \"array_tag t \\ array_tag_n (CARD('b))\"\n\ninstantiation array :: (c_type,finite) c_type\nbegin\ninstance ..\nend\n\noverloading typ_info_array \\ typ_info_t begin\ndefinition\n typ_info_array: \"typ_info_array (w::('a::c_type,'b::finite) array itself) \\ array_tag w\"\nend\n\nlemma field_names_array_tag_length [rule_format]:\n \"x \\ set (field_names_list (array_tag_n n)) \\ length x < n\"\napply(induct_tac n)\n apply simp\napply clarsimp\ndone\n\nlemma replicate_mem_field_names_array_tag [simp]:\n \"replicate n x \\ set (field_names_list (array_tag_n n))\"\napply clarsimp\napply(drule field_names_array_tag_length)\napply simp\ndone\n\nlemma aggregate_array_tag [simp]:\n \"aggregate (array_tag_n n)\"\napply(case_tac n)\n apply simp+\ndone\n\nlemma wf_desc_array_tag [simp]:\n \"wf_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp+\napply(erule wf_desc_ti_typ_combine)\napply simp\ndone\n\nlemma wf_size_desc_array_tag [simp, rule_format]:\n \"0 < n \\ wf_size_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct n)\n apply simp+\napply(case_tac \"n=0\")\n apply simp\napply(rule wf_size_desc_ti_typ_combine)\napply simp\ndone\n\nlemma g_ind_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n g_ind (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule g_ind_ti_typ_combine)\n apply clarsimp+\ndone\n\nlemma fc_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n fu_commutes (update_ti_t ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fc_ti_typ_combine)\n apply(clarsimp simp: fg_cons_def)\n apply clarsimp+\ndone\n\nlemma f_ind_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n f_ind (\\x. index x m) (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule f_ind_ti_typ_combine)\n apply clarsimp\napply simp\ndone\n\nlemma fa_fu_g_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n fa_ind (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fa_ind_ti_typ_combine)\napply clarsimp+\ndone\n\nlemma wf_fdp_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\\n wf_lf (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule wf_lf_ti_typ_combine)\n apply simp+\ndone\n\nlemma upd_local_update [simp]:\n \"upd_local (\\x f. update f n x)\"\napply(auto simp: upd_local_def)\napply(subst cart_eq)\napply clarsimp\napply(subst (asm) cart_eq)\napply(drule_tac x=i in spec)\napply clarsimp\napply(case_tac \"i=n\")\n apply simp+\ndone\n\nlemma fu_eq_mask_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\ (\\m. (\\k v. k < CARD('b) \\\n index ((m v)::('a,'b) array) k = (if n \\ k then\n index (undefined::('a::mem_type,'b::finite) array) k\n else index v k)) \\ fu_eq_mask (array_tag_n n) m)\"\napply(induct n)\n apply clarsimp\n apply(rule fu_eq_mask_empty_typ_info)\n apply clarsimp\n apply(subst cart_eq)\n apply simp\napply clarsimp\napply(rule fu_eq_mask_ti_typ_combine)\n apply(drule_tac x=\"\\v. update (m v) n (index undefined n)\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(drule_tac x=k in spec)\n apply clarsimp\n apply(case_tac \"k=n\")\n apply simp\n apply clarsimp\n apply(subgoal_tac \"\\v bs. m (update v n bs) = update (m v) n bs\")\n apply clarsimp+\n apply(subst cart_eq)\n apply clarsimp\n apply(drule_tac x=i in spec)\n apply clarsimp\n apply(case_tac \"i=n\")\n apply clarsimp+\n apply(frule_tac x=\"update v n bs\" in spec)\n apply(drule_tac x=\"v\" in spec)\n apply clarsimp\n apply(case_tac \"Suc n \\ i\")\n apply clarsimp+\n apply(clarsimp simp: fg_cons_def)\n apply(clarsimp)\n apply simp\ndone\n\nlemma size_td_array_tag [simp]:\n \"size_td (((array_tag_n n)::('a,'b::finite) array typ_info)) =\n n * size_of TYPE('a::c_type)\"\napply(induct_tac n)\n apply simp\napply simp\napply(simp add: size_td_lt_ti_typ_combine size_of_def)\ndone\n\nlemma align_td_array_tag [rule_format]:\n \"0 < n \\ align_td ((array_tag_n n)::('a,'b::finite) array typ_info) = (align_td (typ_info_t (TYPE('a::c_type))))\"\napply(induct_tac n)\n apply simp\napply(clarsimp simp: ti_typ_combine_def Let_def)\napply(case_tac \"n = 0\")\n apply(clarsimp simp: align_of_def max_def)+\ndone\n\nlemma align_field_array [simp]:\n \"align_field ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply(erule align_field_ti_typ_combine)\napply simp\napply(rule dvd_mult)\napply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp add: align_of_def)\napply(rule align_size_of)\ndone\n\ninstantiation array :: (mem_type,finite) mem_type_sans_size\nbegin\n\ninstance\napply intro_classes\n apply(simp_all add: typ_info_array array_tag_def size_of_def\n norm_bytes_def)\n\n apply clarsimp\n apply(rule fu_eq_mask)\n apply(simp add: size_of_def)\n apply(rule fu_eq_mask_array_tag)\n apply simp+\n\napply(clarsimp simp: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp\napply(rule dvd_trans)\n apply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp only: align_of_def)\n apply(rule align_size_of)\napply(simp add: size_of_def)\ndone\n\nend\n\ndeclare atn_base [simp del]\ndeclare atn_rec [simp del]\n\nlemma size_of_array [simp]:\n \"size_of TYPE(('a,'b::finite) array) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma size_td_array:\n \"size_td (typ_info_t TYPE(('a,'b::finite) array)) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma align_td_array:\n \"2^align_td (typ_info_t TYPE(('a,'b::finite) array)) = align_of TYPE('a::c_type)\"\napply(simp add: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp+\ndone\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass oneMB_size = mem_type +\n assumes oneMB_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 19\"\n\nclass fourthousand_count = finite +\n assumes fourthousand_count_ax: \"CARD ('a) <= 2 ^ 13\"\n\ninstantiation array :: (oneMB_size, fourthousand_count) mem_type\nbegin\n\ninstance\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ (addr_bitsize - 19) * 2 ^ 19\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 19\"])\n apply (rule mult_less_mono2)\n apply (rule oneMB_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule le_trans[where j = \"2 ^ 13\"])\n apply (rule fourthousand_count_ax)\n apply simp\n apply simp\napply (simp add: addr_card)\ndone\n\nend\n\nclass twoToSix_size = oneMB_size +\n assumes twoToSix_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstantiation array :: (twoToSix_size, fourthousand_count) oneMB_size\nbegin\n\ninstance\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule fourthousand_count_ax)\n apply (rule twoToSix_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\nend\n\ninstantiation word :: (len8) oneMB_size\nbegin\ninstance\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\nend\n\ninstantiation word :: (len8) twoToSix_size\nbegin\ninstance\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\nend\n\ninstantiation ptr :: (c_type) oneMB_size\nbegin\ninstance\napply intro_classes\napply (simp add: size_of_def)\ndone\nend\n\ninstantiation ptr :: (c_type) twoToSix_size\nbegin\ninstance\napply intro_classes\napply (simp add: size_of_def)\ndone\nend\n\nclass lt12 = finite +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 +\n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstantiation bit0 :: (lt12) fourthousand_count\nbegin\ninstance\n by (intro_classes, insert lt12_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt12) fourthousand_count\nbegin\ninstance\n by (intro_classes, insert lt12_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt11) lt12\nbegin\ninstance\n by (intro_classes, insert lt11_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt11) lt12\nbegin\ninstance\n by (intro_classes, insert lt11_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt10) lt11\nbegin\ninstance\n by (intro_classes, insert lt10_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt10) lt11\nbegin\ninstance\n by (intro_classes, insert lt10_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt9) lt10\nbegin\ninstance\n by (intro_classes, insert lt9_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt9) lt10\nbegin\ninstance\n by (intro_classes, insert lt9_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt8) lt9\nbegin\ninstance\n by (intro_classes, insert lt8_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt8) lt9\nbegin\ninstance\n by (intro_classes, insert lt8_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt7) lt8\nbegin\ninstance\n by (intro_classes, insert lt7_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt7) lt8\nbegin\ninstance\n by (intro_classes, insert lt7_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt6) lt7\nbegin\ninstance\n by (intro_classes, insert lt6_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt6) lt7\nbegin\ninstance\n by (intro_classes, insert lt6_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt5) lt6\nbegin\ninstance\n by (intro_classes, insert lt5_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt5) lt6\nbegin\ninstance\n by (intro_classes, insert lt5_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt4) lt5\nbegin\ninstance\n by (intro_classes, insert lt4_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt4) lt5\nbegin\ninstance\n by (intro_classes, insert lt4_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt3) lt4\nbegin\ninstance\n by (intro_classes, insert lt3_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt3) lt4\nbegin\ninstance\n by (intro_classes, insert lt3_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt2) lt3\nbegin\ninstance\n by (intro_classes, insert lt2_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt2) lt3\nbegin\ninstance\n by (intro_classes, insert lt2_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt1) lt2\nbegin\ninstance\n by (intro_classes, insert lt1_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt1) lt2\nbegin\ninstance\n by (intro_classes, insert lt1_ax[where 'a = 'a], simp)\nend\n\ninstantiation num1 :: lt1\nbegin\ninstance\n by (intro_classes, simp_all)\nend\n\n(* don't understand why this also seems to be necessary *)\ninstantiation num1 :: fourthousand_count\nbegin\ninstance\n by (intro_classes, simp)\nend\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n fourthousand_count *)\ndatatype ty8192 = ty8192 \"8192\"\n\nlemma univ8192: \"(UNIV::ty8192 set) = image ty8192 (UNIV::8192 set)\"\napply (simp add: set_eq_iff image_iff)\napply (rule_tac allI)\napply (rule_tac ty8192.induct)\napply simp\ndone\n\ninstance \"ty8192\" :: finite\napply intro_classes\napply (simp add: univ8192)\ndone\n\nlemma card8192[simp]: \"CARD(ty8192) = CARD(8192)\"\napply (simp add: univ8192 card_image inj_on_def)\ndone\n\ninstance \"ty8192\" :: fourthousand_count\nby intro_classes simp\n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/umm_heap/ArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.29803816461509924}} {"text": "(*<*)\n\n(* Author: Kyndylan Nienhuis *)\n\ntheory CheriAltDefs\n\nimports \n \"Preamble\"\n \"L3Lemmas\"\n \"CHERI-p256.CHERI_Monadic_p256\"\nbegin\n\n(*>*)\nsection \\Alternative definitions\\\n\ntext \\In this theory we give an alternative definition for all CHERI instructions and auxiliary\nfunctions. Each alternative definition is equivalent to the original definition. The first\ntransformation is that we remove all occurrences of @{const extend_state}. We achieve this by\nsubstituting the value of the extra state components in the places where they are used. To cover\nfor-loops, we define a new variant that carries a value to the next iteration. The second\ntransformation is that we merge accessing or updating sub-components of the state into one step.\\\n\nsection \\Preamble\\\n\ntext \\The following is conceptually part of the theory Preamble, but could not be inserted there\nbecause Preamble.thy cannot have a reference to CHERI.\\\n\nsubsection \\Distributive laws\\\n\ntext \\We collect the distributive laws of the types of cases that are used in the model.\\\n\nlemmas case_distrib = \n Option.option.case_distrib\n List.list.case_distrib\n Product_Type.prod.case_distrib\n bool.case_distrib\n DataType.case_distrib\n ShadowMem.case_distrib\n ShadowTags.case_distrib\n RegSet.case_distrib\n CmpType.case_distrib\n Branch.case_distrib\n CP.case_distrib\n Store.case_distrib\n Load.case_distrib\n Trap.case_distrib\n Shift.case_distrib\n MultDiv.case_distrib\n ArithR.case_distrib\n ArithI.case_distrib\n CGet.case_distrib\n CSet.case_distrib\n CCheck.case_distrib\n CHERICOP2.case_distrib\n COP2.case_distrib\n CHERISWC2.case_distrib\n SWC2.case_distrib\n CHERILWC2.case_distrib\n LWC2.case_distrib\n CHERILDC2.case_distrib\n LDC2.case_distrib\n CHERISDC2.case_distrib\n SDC2.case_distrib\n instruction.case_distrib\n\nlemmas case_distrib_cancel [simp] = \n case_distrib[where h=\"\\_. _\", THEN sym]\n\nlemmas if_distrib_h = \n if_distrib[where f=h] for h\n\nlemma let_distrib:\n shows \"h (let x = y in f x) = (let x = y in h (f x))\"\nby simp\n\nlemmas all_distrib = \n if_distrib_h\n let_distrib\n case_distrib\n\nlemmas ValuePart_cases [ValueAndStatePart_simp] =\n all_distrib[where h=\"\\x. ValuePart x _\"]\n\nlemmas StatePart_cases [ValueAndStatePart_simp] =\n all_distrib[where h=\"\\x. StatePart x _\"]\n\nsubsection \\Split laws\\\n\nlemmas case_split = \n Option.option.split\n List.list.split\n Product_Type.prod.split\n bool.split\n DataType.split\n ShadowMem.split\n ShadowTags.split\n RegSet.split\n CmpType.split\n Branch.split\n CP.split\n Store.split\n Load.split\n Trap.split\n Shift.split\n MultDiv.split\n ArithR.split\n ArithI.split\n CGet.split\n CSet.split\n CCheck.split\n CHERICOP2.split\n COP2.split\n CHERISWC2.split\n SWC2.split\n CHERILWC2.split\n LWC2.split\n CHERILDC2.split\n LDC2.split\n CHERISDC2.split\n SDC2.split\n instruction.split\n\nlemma let_split:\n fixes P\n shows \"P (let x = y in f x) = (\\x. x = y \\ P (f x))\"\nby simp\n\nlemmas all_split = \n if_splits(1)\n let_split\n case_split\n \n(*\n(* I tried to get the above lemmas for free using one of the following existing lemmas. *)\n\nthm instruction.case_distrib\nthm instruction.induct\nthm instruction.exhaust\nthm instruction.split\n\n(* However, xxx.split doesn't work, because I can't get rid of the conjunction. *)\nlemmas foo_split = \n instruction.split[where P=\"isInvariant _\", THEN sym, THEN iffD1, OF conjI, OF allI, OF impI]\n\n(* But I could use split, and also add conjI, allI and impI to the method *)\nlemmas foo_split2 = \n instruction.split[where P=\"isInvariant _\", THEN sym, THEN iffD1]\n\n(* xxx.exhaust doesn't work, because I can't bind P and y to something that shares a variable. *)\nlemmas foo_exhaust = \n instruction.exhaust[where P=\"isInvariant _ _\" and y=\"_\"]\n\n(* xxx.induct does work, but takes much too long to process, and I still need to state the case. *)\nlemmas foo_induct = \n instruction.induct[where P=\"\\ins. isInvariant _ \n (case ins of ArithI x \\ _ x\n | ArithR x \\ _ x\n | BREAK \\ _\n | Branch x \\ _ x\n | CACHE x \\ _ x\n | COP1 x \\ _ x\n | COP2 x \\ _ x\n | CP x \\ _ x\n | ERET \\ _ \n | LDC2 x \\ _ x\n | LWC2 x \\ _ x\n | Load x \\ _ x\n | MultDiv x \\ _ x\n | RDHWR x \\ _ x\n | ReservedInstruction \\ _\n | SDC2 x \\ _ x\n | SWC2 x \\ _ x\n | SYNC x \\ _ x\n | SYSCALL \\ _ \n | Shift x \\ _ x\n | Store x \\ _ x\n | TLBP \\ _\n | TLBR \\ _ \n | TLBWI \\ _\n | TLBWR \\ _\n | Trap x \\ _ x\n | Unpredictable \\ _\n | WAIT \\ _)\"]\n\n(* xxx.case_distrib doesn't work, because it doesn't get rid of the case in the assumption. *)\nlemmas foo_case_distrib =\n instruction.case_distrib[where h=\"isInvariant _\", THEN sym, THEN iffD1]\n*)\n\nsubsection \\Congruences\\\n\nlemmas weak_cong = \n if_weak_cong\n option.case_cong_weak\n list.case_cong_weak\n prod.case_cong_weak\n DataType.case_cong_weak\n ShadowMem.case_cong_weak\n ShadowTags.case_cong_weak\n RegSet.case_cong_weak\n CmpType.case_cong_weak\n Branch.case_cong_weak\n CP.case_cong_weak\n Store.case_cong_weak\n Load.case_cong_weak\n Trap.case_cong_weak\n Shift.case_cong_weak\n MultDiv.case_cong_weak\n ArithR.case_cong_weak\n ArithI.case_cong_weak\n CGet.case_cong_weak\n CSet.case_cong_weak\n CCheck.case_cong_weak\n CHERICOP2.case_cong_weak\n COP2.case_cong_weak\n CHERISWC2.case_cong_weak\n SWC2.case_cong_weak\n CHERILWC2.case_cong_weak\n LWC2.case_cong_weak\n CHERILDC2.case_cong_weak\n LDC2.case_cong_weak\n CHERISDC2.case_cong_weak\n SDC2.case_cong_weak\n instruction.case_cong_weak\n\nlemmas cong =\n if_cong\n option.case_cong\n list.case_cong\n prod.case_cong\n DataType.case_cong\n ShadowMem.case_cong\n ShadowTags.case_cong\n RegSet.case_cong\n CmpType.case_cong\n Branch.case_cong\n CP.case_cong\n Store.case_cong\n Load.case_cong\n Trap.case_cong\n Shift.case_cong\n MultDiv.case_cong\n ArithR.case_cong\n ArithI.case_cong\n CGet.case_cong\n CSet.case_cong\n CCheck.case_cong\n CHERICOP2.case_cong\n COP2.case_cong\n CHERISWC2.case_cong\n SWC2.case_cong\n CHERILWC2.case_cong\n LWC2.case_cong\n CHERILDC2.case_cong\n LDC2.case_cong\n CHERISDC2.case_cong\n SDC2.case_cong\n instruction.case_cong \n\nsubsection \\Strong congruence simplifier\\\n\ntext \\We remove \\if_splits\\ from the split rules of the simplifier (to avoid an explosion of the\nstate). That means that some obvious simplifications are not done anymore, so we add these manually.\nWe do not like negations and disjunctions in our generated definitions, so we only add the following\nlemmas to \\alt_def_simp\\.\\\n\nlemma if_bool_simps2 [alt_def_simp]:\n shows \"(if b then x else False) = (b \\ x)\"\n and \"(if b then x else True) = (b \\ x)\"\nby simp_all\n\nmethod strong_cong_simp uses add del = \n (simp \n add: add\n del: del\n split del: if_splits(1)\n cong del: weak_cong\n cong add: cong)\n\nmethod strong_cong_simp_all uses add del = \n (simp_all\n add: add\n del: del\n split del: if_splits(1)\n cong del: weak_cong\n cong add: cong)\n\nsubsection \\Simple version of @{method auto}\\\n\ntext \\In some rare cases @{method auto} gets stuck, but the proof is too difficult for @{method\nsimp}. The following method could help in that case: it invokes the simplifier and does some simple\nelimination and introduction, but nothing fancy. Sometimes @{method auto} is quicker than this\nmethod and sometimes the other way around. The proof method does not introduce any new\nuninstantiated variables.\\\n\nmethod simple_auto uses simp intro elim =\n (strong_cong_simp add: simp |\n elim conjE exE elim | \n intro conjI impI allI intro);\n (simple_auto simp: simp intro: intro elim: elim)?\n\nsection \\Removing extend-state\\\n\nsubsection \\foreach-loop that returns a value\\\n\ntext \\The expression inside a @{term foreach_loop} cannot use the result of the previous\niteration. We define a new variant of the loop where this is possible.\\\n\nfun foreach_loop_agg :: \"'a list \\ 'b \\ ('a \\ 'b \\ 's \\ 'b \\ 's) \\\n 's \\ 'b \\ 's\" where\n \"foreach_loop_agg [] b _ = return b\" |\n \"foreach_loop_agg (h#t) b f = bind (f h b) (\\b. foreach_loop_agg t b f)\"\n\nlemma foreach_loop_agg_return [simp]:\n shows \"foreach_loop_agg l b (\\a v. return (x a v)) = \n return (fold x l b)\"\nby (induct l arbitrary: b) simp_all\n\nlemma fold_id [simp]:\n shows \"fold (\\_ v. v) l = (\\v. v)\"\nby (induct l) simp_all\n\nlemma foreach_loop_agg_bind_return_constant [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\_. return b)) =\n bind (foreach_loop (l, (\\a. (f a b)))) (\\_. return b)\"\nby (induct l) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_bind_return_constant [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. bind (g a b c) (\\_. return b))) =\n bind (foreach_loop (l, (\\a. bind (f a b) (\\c. (g a b c) )))) (\\_. return b)\"\nby (induct l) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_bind_bind_return_constant [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. bind (g a b c) (\\d. bind (h a b c d) (\\_. return b)))) =\n bind (foreach_loop (l, (\\a. bind (f a b) (\\c. bind (g a b c) (\\d. h a b c d))))) (\\_. return b)\"\nby (induct l) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_return_left [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. return (fst b, x a b c))) =\n bind (foreach_loop_agg l (snd b) (\\a b2. \n bind (f a (fst b, b2)) (\\c. return (x a (fst b, b2) c))))\n (\\b2. return (fst b, b2))\"\nby (induct l arbitrary: b) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_return_right [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. return (x a b c, snd b))) =\n bind (foreach_loop_agg l (fst b) (\\a b2. \n bind (f a (b2, snd b)) (\\c. return (x a (b2, snd b) c))))\n (\\b2. return (b2, snd b))\"\nby (induct l arbitrary: b) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_bind_return_left [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. bind (g a b c) (\\d. return (fst b, x a b c d)))) =\n bind (foreach_loop_agg l (snd b) (\\a b2. \n bind (f a (fst b, b2)) (\\c. bind (g a (fst b, b2) c) (\\d. return (x a (fst b, b2) c d)))))\n (\\b2. return (fst b, b2))\"\nby (induct l arbitrary: b) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_bind_bind_return_right [simp]:\n shows \"foreach_loop_agg l b (\\a b. bind (f a b) (\\c. bind (g a b c) (\\d. return (x a b c d, snd b)))) =\n bind (foreach_loop_agg l (fst b) (\\a b2. \n bind (f a (b2, snd b)) (\\c. bind (g a (b2, snd b) c) (\\d. return (x a (b2, snd b) c d)))))\n (\\b2. return (b2, snd b))\"\nby (induct l arbitrary: b) (simp_all add: bind_associativity)\n\nlemma foreach_loop_agg_read_state [simp]:\n shows \"foreach_loop_agg l b (\\a v. read_state (f a v)) = \n read_state (\\s. fold (\\a v. f a v s) l b)\"\nproof (induct l arbitrary: b)\n case (Cons h t)\n hence \"foreach_loop_agg (h # t) b (\\a v. read_state (f a v)) =\n bind (read_state (f h b)) (\\b. read_state (\\s. fold (\\a v. f a v s) t b))\"\n by simp\n also have \"... = read_state (\\s. fold (\\a v. f a v s) (h # t) b)\"\n unfolding monad_def by simp\n finally show ?case .\nqed simp\n\nlemma foreach_loop_agg_bind_read_state_return [simp]:\n shows \"foreach_loop_agg l b (\\a v. bind (read_state (f a v)) (\\b. return (x a v b))) = \n read_state (\\s. fold (\\a v. x a v (f a v s)) l b)\" (is \"?l = ?r\")\nproof -\n have \"bind (read_state (f a v)) (\\b. return (x a v b)) = read_state (\\s. x a v (f a v s))\" for a v\n unfolding monad_def Let_def by simp\n hence \"?l = foreach_loop_agg l b (\\a v. read_state (\\s. x a v (f a v s)))\" by simp\n also have \"... = read_state (\\s. fold (\\a v. x a v (f a v s)) l b)\" by simp\n finally show ?thesis .\nqed\n\nlemma StatePart_foreach_loop_agg:\n assumes \"\\a a' v v' s. ValuePart (m a v) (StatePart (m a' v') s) = ValuePart (m a v) s\"\n shows \"ValuePart (foreach_loop_agg l v m) = \n (\\s. fold (\\a v. ValuePart (m a v) s) l v)\"\nusing assms\nby (induct l arbitrary: v)\n (auto simp add: ValuePart_bind)\n\nsubsection \\Extend state\\\n\ntext \\To simplify @{term extend_state} in the general case, we (temporarily) introduce two new\nfunctions, namely @{term extend_before} and @{term extend_after}. Then we add rewrite rules that\neliminate those as well.\\\n\ndefinition extend_before :: \"'v \\ ('v \\ 's \\ 'a \\ 'v \\ 's) \\ 's \\ ('a \\ 'v) \\ 's\" where\n \"extend_before v m = (\\s. let (a, s') = m (v, s) in ((a, fst s'), snd s'))\"\n\ndefinition extend_after :: \"'v \\ ('s \\ 'a \\ 's) \\ 's \\ ('a \\ 'v) \\ 's\" where\n \"extend_after v m = bind m (\\a. return (a, v))\" \n\ntext \\We always expand the definition of @{term extend_after}; we only defined it to state the\nsimplifications of @{term extend_before} more elegantly. (In previous versions we did not always\nexpand the definition and ran into problems because the simplification rules were not confluent.\\\n\ndeclare extend_after_def [alt_def_simp]\n\nsubsection \\Extend-state bind\\\n\nlemma extend_state_bind [alt_def_simp]:\n shows \"extend_state v (bind m n) = \n bind (extend_before v m) (\\(a, v). extend_state v (n a))\" (is \"?l = ?r\")\nproof (intro ext)\n fix s\n show \"?l s = ?r s\"\n unfolding extend_before_def monad_def\n by (cases \"m (v, s)\") auto\nqed\n\nlemma extend_before_bind [alt_def_simp]:\n shows \"extend_before v (bind m n) = \n bind (extend_before v m) (\\(a, v). extend_before v (n a))\" (is \"?l = ?r\")\nproof (intro ext)\n fix s\n show \"?l s = ?r s\"\n unfolding extend_before_def monad_def\n by (cases \"m (v, s)\") auto\nqed\n\nsubsection \\Extend-state return\\\n\ntext \\There already is a simplification in L3_Lib for @{term \"extend_state v (return x)\"}\\\n\nlemma extend_before_return [alt_def_simp]:\n shows \"extend_before v (return x) = extend_after v (return x)\"\nunfolding extend_before_def extend_after_def monad_def\nby auto\n\nsubsection \\Extend-state read-state\\\n\nlemma extend_state_read_state [alt_def_simp]:\n shows \"extend_state v (read_state f) = read_state (\\s. f (v, s))\"\nunfolding monad_def\nby simp\n\nlemma extend_before_read_state [alt_def_simp]:\n shows \"extend_before v (read_state f) = \n extend_after v (read_state (\\s. f (v, s)))\"\nunfolding extend_before_def extend_after_def monad_def\nby auto\n\nsubsection \\Extend-state update-state\\\n\nlemma extend_state_update_state [alt_def_simp]:\n shows \"extend_state v (update_state f) = update_state (\\s. snd (f (v, s)))\"\nunfolding monad_def\nby simp\n\ntext \\The general case above for @{term \"extend_before v (update_state f)\"} is quite complicated,\nand in the exported Isabelle/HOL only two variations appear, so we only add the specialised\nlemmas to the simplification set.\\\n\nlemma extend_before_update_state:\n shows \"extend_before v (update_state f) = \n bind (read_state (\\s. fst (f (v, s)))) \n (\\v'. extend_after v' (update_state (\\s. snd (f (v, s))))) \"\nunfolding extend_before_def extend_after_def monad_def\nby simp\n\nlemma extend_before_update_state_1 [alt_def_simp]:\n shows \"extend_before v (update_state (\\s. (fst s, f s))) = \n extend_after v (update_state (\\s. f (v, s)))\"\nunfolding extend_before_update_state\nby simp\n\nlemma extend_before_update_state_2 [alt_def_simp]:\n shows \"extend_before v (update_state (\\s. (x, snd s))) = \n extend_after x (return ())\"\nunfolding extend_before_update_state\nby simp\n\nsubsection \\Extend-state trim-state\\\n\ntext \\There already is a simplification in L3_Lib for @{term \"extend_state v (trim_state m)\"}.\\\n\nlemma extend_before_trim_state [alt_def_simp]:\n shows \"extend_before v (trim_state m) = extend_after v m\"\n (is \"?l = ?r\")\nproof\n fix s\n show \"?l s = ?r s\"\n unfolding extend_before_def extend_after_def monad_def\n by (cases \"m s\") auto\nqed\n\nsubsection \\Extend-state foreach-loop\\\n\nlemma extend_state_foreach_loop [alt_def_simp]:\n shows \"extend_state v (foreach_loop (l, m)) = \n bind (foreach_loop_agg l v (\\a v. bind (extend_before v (m a)) (\\(_, v). return v)))\n (\\_. return ())\"\nproof (induct l arbitrary: v)\n case Nil\n thus ?case \n by simp\nnext\n case (Cons h t)\n thus ?case\n by (simp add: extend_state_bind case_prod_unfold bind_associativity) \nqed\n\nlemma extend_before_foreach_loop [alt_def_simp]:\n shows \"extend_before v (foreach_loop (l, m)) = \n bind (foreach_loop_agg l v (\\a v. bind (extend_before v (m a)) (\\(_, v). return v)))\n (\\v. extend_after v (return ()))\"\nproof (induct l arbitrary: v)\n case Nil\n thus ?case \n by (simp add: extend_before_return extend_after_def)\nnext\n case (Cons h t)\n thus ?case\n by (simp add: extend_before_bind case_prod_unfold bind_associativity) \nqed\n\nsubsection \\Extend-state foreach-loop-agg\\\n\nlemma extend_state_foreach_loop_agg [alt_def_simp]:\n shows \"extend_state v2 (foreach_loop_agg l v1 f) = \n bind (foreach_loop_agg l (v1, v2) (\\a v. extend_before (snd v) (f a (fst v))))\n (\\v. return (fst v))\"\nproof (induct l arbitrary: v1 v2)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons h t)\n thus ?case\n by (simp add: extend_state_bind case_prod_unfold bind_associativity) \nqed\n\nlemma extend_before_foreach_loop_agg [alt_def_simp]:\n shows \"extend_before v2 (foreach_loop_agg l v1 f) = \n foreach_loop_agg l (v1, v2) (\\a v. extend_before (snd v) (f a (fst v)))\"\nproof (induct l arbitrary: v1 v2)\n case Nil\n thus ?case\n by (simp add: extend_before_return extend_after_def)\nnext\n case (Cons h t)\n thus ?case\n by (simp add: extend_before_bind case_prod_unfold) \nqed\n\nsubsection \\Extend-state distributive cases\\\n\nlemmas extend_state_case [alt_def_simp] = \n all_distrib[where h=\"extend_state _\"]\n\nlemmas extend_before_case [alt_def_simp] = \n all_distrib[where h=\"extend_before _\"]\n\nsection \\Contracting reads and updates\\\n\nlemma bind_arg_cong:\n assumes \"bind m n = k\"\n shows \"bind m (\\a. bind (n a) l) = bind k l\"\nusing assms \nby (simp add: bind_associativity[THEN sym])\n\nlemma contract_read:\n shows \"bind (read_state getParent) (\\a. return (sub a)) = \n read_state (\\s. sub (getParent s))\" (is \"?T1\")\n and \"bind (read_state getParent) (\\a. bind (return (sub a)) m) = \n bind (read_state (\\s. sub (getParent s))) m\" (is \"?T2\")\nproof -\n show ?T1\n unfolding monad_def Let_def\n by simp\n from bind_arg_cong[OF this]\n show ?T2 .\nqed\n\nlemma contract_update:\n shows \"bind (read_state getParent) \n (\\v'. update_state (setParent (sub_update (\\_. f (sub v')) v'))) = \n bind (read_state (\\s. sub (getParent s))) \n (\\v. update_state (\\s. setParent (sub_update (\\_. f v) (getParent s)) s))\" \n (is \"?T1\")\n and \"bind (read_state getParent) \n (\\v'. bind (update_state (setParent (sub_update (\\_. f (sub v')) v'))) m) = \n bind (read_state (\\s. sub (getParent s))) \n (\\v. bind (update_state (\\s. setParent (sub_update (\\_. f v) (getParent s)) s)) m)\" \n (is \"?T2\")\nproof -\n show ?T1\n unfolding monad_def Let_def\n by simp\n from bind_arg_cong[OF this]\n show ?T2 by (simp add: bind_associativity)\nqed\n\nlemma contract_update_constant:\n shows \"bind (read_state getParent) \n (\\v'. update_state (setParent (sub_update (\\_. x) v'))) = \n update_state (\\s. setParent (sub_update (\\_. x) (getParent s)) s)\" (is \"?T1\")\n and \"bind (read_state getParent) \n (\\v'. bind (update_state (setParent (sub_update (\\_. x) v'))) m) = \n bind (update_state (\\s. setParent (sub_update (\\_. x) (getParent s)) s)) m\" (is \"?T2\")\nproof -\n show ?T1\n unfolding monad_def Let_def\n by simp\n from bind_arg_cong[OF this]\n show ?T2 .\nqed\n\nsubsection \\Simplifying nested updates\\\n\n(* Code generation - start - state component updates *)\n\nlemma state_component_update_simps [simp]:\n shows \"BranchDelayPCC_update (\\_. f_BranchDelayPCC (BranchDelayPCC s)) s = \n BranchDelayPCC_update (f_BranchDelayPCC) s\"\n and \"BranchToPCC_update (\\_. f_BranchToPCC (BranchToPCC s)) s = \n BranchToPCC_update (f_BranchToPCC) s\"\n and \"JTAG_UART_update (\\_. f_JTAG_UART (JTAG_UART s)) s = \n JTAG_UART_update (f_JTAG_UART) s\"\n and \"PIC_base_address_update (\\_. f_PIC_base_address (PIC_base_address s)) s = \n PIC_base_address_update (f_PIC_base_address) s\"\n and \"PIC_config_regs_update (\\_. f_PIC_config_regs (PIC_config_regs s)) s = \n PIC_config_regs_update (f_PIC_config_regs) s\"\n and \"PIC_external_intrs_update (\\_. f_PIC_external_intrs (PIC_external_intrs s)) s = \n PIC_external_intrs_update (f_PIC_external_intrs) s\"\n and \"PIC_ip_bits_update (\\_. f_PIC_ip_bits (PIC_ip_bits s)) s = \n PIC_ip_bits_update (f_PIC_ip_bits) s\"\n and \"UNPREDICTABLE_HI_update (\\_. f_UNPREDICTABLE_HI (UNPREDICTABLE_HI s)) s = \n UNPREDICTABLE_HI_update (f_UNPREDICTABLE_HI) s\"\n and \"UNPREDICTABLE_LO_update (\\_. f_UNPREDICTABLE_LO (UNPREDICTABLE_LO s)) s = \n UNPREDICTABLE_LO_update (f_UNPREDICTABLE_LO) s\"\n and \"UNPREDICTABLE_TLB_update (\\_. f_UNPREDICTABLE_TLB (UNPREDICTABLE_TLB s)) s = \n UNPREDICTABLE_TLB_update (f_UNPREDICTABLE_TLB) s\"\n and \"all_BranchDelayPCC_update (\\_. f_all_BranchDelayPCC (all_BranchDelayPCC s)) s = \n all_BranchDelayPCC_update (f_all_BranchDelayPCC) s\"\n and \"all_BranchToPCC_update (\\_. f_all_BranchToPCC (all_BranchToPCC s)) s = \n all_BranchToPCC_update (f_all_BranchToPCC) s\"\n and \"all_TLB_assoc_update (\\_. f_all_TLB_assoc (all_TLB_assoc s)) s = \n all_TLB_assoc_update (f_all_TLB_assoc) s\"\n and \"all_TLB_direct_update (\\_. f_all_TLB_direct (all_TLB_direct s)) s = \n all_TLB_direct_update (f_all_TLB_direct) s\"\n and \"all_capcause_update (\\_. f_all_capcause (all_capcause s)) s = \n all_capcause_update (f_all_capcause) s\"\n and \"all_capr_update (\\_. f_all_capr (all_capr s)) s = \n all_capr_update (f_all_capr) s\"\n and \"all_gpr_update (\\_. f_all_gpr (all_gpr s)) s = \n all_gpr_update (f_all_gpr) s\"\n and \"all_pcc_update (\\_. f_all_pcc (all_pcc s)) s = \n all_pcc_update (f_all_pcc) s\"\n and \"all_scapr_update (\\_. f_all_scapr (all_scapr s)) s = \n all_scapr_update (f_all_scapr) s\"\n and \"all_state_update (\\_. f_all_state (all_state s)) s = \n all_state_update (f_all_state) s\"\n and \"c_TLB_assoc_update (\\_. f_c_TLB_assoc (c_TLB_assoc s)) s = \n c_TLB_assoc_update (f_c_TLB_assoc) s\"\n and \"c_TLB_direct_update (\\_. f_c_TLB_direct (c_TLB_direct s)) s = \n c_TLB_direct_update (f_c_TLB_direct) s\"\n and \"c_capr_update (\\_. f_c_capr (c_capr s)) s = \n c_capr_update (f_c_capr) s\"\n and \"c_gpr_update (\\_. f_c_gpr (c_gpr s)) s = \n c_gpr_update (f_c_gpr) s\"\n and \"c_pcc_update (\\_. f_c_pcc (c_pcc s)) s = \n c_pcc_update (f_c_pcc) s\"\n and \"c_scapr_update (\\_. f_c_scapr (c_scapr s)) s = \n c_scapr_update (f_c_scapr) s\"\n and \"c_state_update (\\_. f_c_state (c_state s)) s = \n c_state_update (f_c_state) s\"\n and \"c_state_update (c_BranchDelay_update (\\_. f_c_BranchDelay (c_BranchDelay (c_state s)))) s = \n c_state_update (c_BranchDelay_update (f_c_BranchDelay)) s\"\n and \"c_state_update (c_BranchTo_update (\\_. f_c_BranchTo (c_BranchTo (c_state s)))) s = \n c_state_update (c_BranchTo_update (f_c_BranchTo)) s\"\n and \"c_state_update (c_CP0_update (\\_. f_c_CP0 (c_CP0 (c_state s)))) s = \n c_state_update (c_CP0_update (f_c_CP0)) s\"\n and \"c_state_update (c_CP0_update (BadInstr_update (\\_. f_BadInstr (BadInstr (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (BadInstr_update (f_BadInstr))) s\"\n and \"c_state_update (c_CP0_update (BadInstrP_update (\\_. f_BadInstrP (BadInstrP (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (BadInstrP_update (f_BadInstrP))) s\"\n and \"c_state_update (c_CP0_update (BadVAddr_update (\\_. f_BadVAddr (BadVAddr (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (BadVAddr_update (f_BadVAddr))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (\\_. f_Cause (Cause (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Cause_update (f_Cause))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (BD_update (\\_. f_BD (BD (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (BD_update (f_BD)))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (CE_update (\\_. f_CE (CE (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (CE_update (f_CE)))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (CauseRegister.ExcCode_update (\\_. f_CauseRegisterExcCode (CauseRegister.ExcCode (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (CauseRegister.ExcCode_update (f_CauseRegisterExcCode)))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (IP_update (\\_. f_IP (IP (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (IP_update (f_IP)))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (TI_update (\\_. f_TI (TI (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (TI_update (f_TI)))) s\"\n and \"c_state_update (c_CP0_update (Cause_update (causeregister'rst_update (\\_. f_causeregister'rst (causeregister'rst (Cause (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Cause_update (causeregister'rst_update (f_causeregister'rst)))) s\"\n and \"c_state_update (c_CP0_update (Compare_update (\\_. f_Compare (Compare (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Compare_update (f_Compare))) s\"\n and \"c_state_update (c_CP0_update (Config_update (\\_. f_Config (Config (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Config_update (f_Config))) s\"\n and \"c_state_update (c_CP0_update (Config_update (AR_update (\\_. f_AR (AR (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (AR_update (f_AR)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (AT_update (\\_. f_AT (AT (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (AT_update (f_AT)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (BE_update (\\_. f_BE (BE (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (BE_update (f_BE)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (K0_update (\\_. f_K0 (K0 (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (K0_update (f_K0)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (ConfigRegister.M_update (\\_. f_ConfigRegisterM (ConfigRegister.M (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (ConfigRegister.M_update (f_ConfigRegisterM)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (ConfigRegister.MT_update (\\_. f_ConfigRegisterMT (ConfigRegister.MT (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (ConfigRegister.MT_update (f_ConfigRegisterMT)))) s\"\n and \"c_state_update (c_CP0_update (Config_update (configregister'rst_update (\\_. f_configregister'rst (configregister'rst (Config (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Config_update (configregister'rst_update (f_configregister'rst)))) s\"\n and \"c_state_update (c_CP0_update (Config1_update (\\_. f_Config1 (Config1 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Config1_update (f_Config1))) s\"\n and \"c_state_update (c_CP0_update (Config2_update (\\_. f_Config2 (Config2 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Config2_update (f_Config2))) s\"\n and \"c_state_update (c_CP0_update (Config3_update (\\_. f_Config3 (Config3 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Config3_update (f_Config3))) s\"\n and \"c_state_update (c_CP0_update (Config6_update (\\_. f_Config6 (Config6 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Config6_update (f_Config6))) s\"\n and \"c_state_update (c_CP0_update (Context_update (\\_. f_Context (Context (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Context_update (f_Context))) s\"\n and \"c_state_update (c_CP0_update (Context_update (Context.BadVPN2_update (\\_. f_ContextBadVPN2 (Context.BadVPN2 (Context (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Context_update (Context.BadVPN2_update (f_ContextBadVPN2)))) s\"\n and \"c_state_update (c_CP0_update (Context_update (Context.PTEBase_update (\\_. f_ContextPTEBase (Context.PTEBase (Context (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Context_update (Context.PTEBase_update (f_ContextPTEBase)))) s\"\n and \"c_state_update (c_CP0_update (Context_update (context'rst_update (\\_. f_context'rst (context'rst (Context (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Context_update (context'rst_update (f_context'rst)))) s\"\n and \"c_state_update (c_CP0_update (Count_update (\\_. f_Count (Count (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Count_update (f_Count))) s\"\n and \"c_state_update (c_CP0_update (Debug_update (\\_. f_Debug (Debug (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Debug_update (f_Debug))) s\"\n and \"c_state_update (c_CP0_update (EPC_update (\\_. f_EPC (EPC (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (EPC_update (f_EPC))) s\"\n and \"c_state_update (c_CP0_update (EntryHi_update (\\_. f_EntryHi (EntryHi (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (EntryHi_update (f_EntryHi))) s\"\n and \"c_state_update (c_CP0_update (EntryHi_update (EntryHi.ASID_update (\\_. f_EntryHiASID (EntryHi.ASID (EntryHi (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (EntryHi_update (EntryHi.ASID_update (f_EntryHiASID)))) s\"\n and \"c_state_update (c_CP0_update (EntryHi_update (EntryHi.R_update (\\_. f_EntryHiR (EntryHi.R (EntryHi (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (EntryHi_update (EntryHi.R_update (f_EntryHiR)))) s\"\n and \"c_state_update (c_CP0_update (EntryHi_update (EntryHi.VPN2_update (\\_. f_EntryHiVPN2 (EntryHi.VPN2 (EntryHi (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (EntryHi_update (EntryHi.VPN2_update (f_EntryHiVPN2)))) s\"\n and \"c_state_update (c_CP0_update (EntryHi_update (entryhi'rst_update (\\_. f_entryhi'rst (entryhi'rst (EntryHi (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (EntryHi_update (entryhi'rst_update (f_entryhi'rst)))) s\"\n and \"c_state_update (c_CP0_update (EntryLo0_update (\\_. f_EntryLo0 (EntryLo0 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (EntryLo0_update (f_EntryLo0))) s\"\n and \"c_state_update (c_CP0_update (EntryLo1_update (\\_. f_EntryLo1 (EntryLo1 (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (EntryLo1_update (f_EntryLo1))) s\"\n and \"c_state_update (c_CP0_update (ErrCtl_update (\\_. f_ErrCtl (ErrCtl (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (ErrCtl_update (f_ErrCtl))) s\"\n and \"c_state_update (c_CP0_update (ErrorEPC_update (\\_. f_ErrorEPC (ErrorEPC (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (ErrorEPC_update (f_ErrorEPC))) s\"\n and \"c_state_update (c_CP0_update (HWREna_update (\\_. f_HWREna (HWREna (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (HWREna_update (f_HWREna))) s\"\n and \"c_state_update (c_CP0_update (Index_update (\\_. f_Index (Index (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Index_update (f_Index))) s\"\n and \"c_state_update (c_CP0_update (LLAddr_update (\\_. f_LLAddr (LLAddr (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (LLAddr_update (f_LLAddr))) s\"\n and \"c_state_update (c_CP0_update (PRId_update (\\_. f_PRId (PRId (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (PRId_update (f_PRId))) s\"\n and \"c_state_update (c_CP0_update (PageMask_update (\\_. f_PageMask (PageMask (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (PageMask_update (f_PageMask))) s\"\n and \"c_state_update (c_CP0_update (Random_update (\\_. f_Random (Random (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Random_update (f_Random))) s\"\n and \"c_state_update (c_CP0_update (Random_update (Random.Random_update (\\_. f_RandomRandom (Random.Random (Random (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Random_update (Random.Random_update (f_RandomRandom)))) s\"\n and \"c_state_update (c_CP0_update (Random_update (random'rst_update (\\_. f_random'rst (random'rst (Random (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Random_update (random'rst_update (f_random'rst)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (\\_. f_Status (Status (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Status_update (f_Status))) s\"\n and \"c_state_update (c_CP0_update (Status_update (BEV_update (\\_. f_BEV (BEV (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (BEV_update (f_BEV)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (CU0_update (\\_. f_CU0 (CU0 (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (CU0_update (f_CU0)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (CU1_update (\\_. f_CU1 (CU1 (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (CU1_update (f_CU1)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (CU2_update (\\_. f_CU2 (CU2 (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (CU2_update (f_CU2)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (CU3_update (\\_. f_CU3 (CU3 (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (CU3_update (f_CU3)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (ERL_update (\\_. f_ERL (ERL (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (ERL_update (f_ERL)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (EXL_update (\\_. f_EXL (EXL (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (EXL_update (f_EXL)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (FR_update (\\_. f_FR (FR (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (FR_update (f_FR)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (IE_update (\\_. f_IE (IE (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (IE_update (f_IE)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (IM_update (\\_. f_IM (IM (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (IM_update (f_IM)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (KSU_update (\\_. f_KSU (KSU (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (KSU_update (f_KSU)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (KX_update (\\_. f_KX (KX (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (KX_update (f_KX)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (StatusRegister.RE_update (\\_. f_StatusRegisterRE (StatusRegister.RE (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (StatusRegister.RE_update (f_StatusRegisterRE)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (SX_update (\\_. f_SX (SX (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (SX_update (f_SX)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (UX_update (\\_. f_UX (UX (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (UX_update (f_UX)))) s\"\n and \"c_state_update (c_CP0_update (Status_update (statusregister'rst_update (\\_. f_statusregister'rst (statusregister'rst (Status (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Status_update (statusregister'rst_update (f_statusregister'rst)))) s\"\n and \"c_state_update (c_CP0_update (UsrLocal_update (\\_. f_UsrLocal (UsrLocal (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (UsrLocal_update (f_UsrLocal))) s\"\n and \"c_state_update (c_CP0_update (Wired_update (\\_. f_Wired (Wired (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (Wired_update (f_Wired))) s\"\n and \"c_state_update (c_CP0_update (Wired_update (Wired.Wired_update (\\_. f_WiredWired (Wired.Wired (Wired (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Wired_update (Wired.Wired_update (f_WiredWired)))) s\"\n and \"c_state_update (c_CP0_update (Wired_update (wired'rst_update (\\_. f_wired'rst (wired'rst (Wired (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (Wired_update (wired'rst_update (f_wired'rst)))) s\"\n and \"c_state_update (c_CP0_update (XContext_update (\\_. f_XContext (XContext (c_CP0 (c_state s)))))) s = \n c_state_update (c_CP0_update (XContext_update (f_XContext))) s\"\n and \"c_state_update (c_CP0_update (XContext_update (XContext.BadVPN2_update (\\_. f_XContextBadVPN2 (XContext.BadVPN2 (XContext (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (XContext_update (XContext.BadVPN2_update (f_XContextBadVPN2)))) s\"\n and \"c_state_update (c_CP0_update (XContext_update (XContext.PTEBase_update (\\_. f_XContextPTEBase (XContext.PTEBase (XContext (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (XContext_update (XContext.PTEBase_update (f_XContextPTEBase)))) s\"\n and \"c_state_update (c_CP0_update (XContext_update (XContext.R_update (\\_. f_XContextR (XContext.R (XContext (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (XContext_update (XContext.R_update (f_XContextR)))) s\"\n and \"c_state_update (c_CP0_update (XContext_update (xcontext'rst_update (\\_. f_xcontext'rst (xcontext'rst (XContext (c_CP0 (c_state s)))))))) s = \n c_state_update (c_CP0_update (XContext_update (xcontext'rst_update (f_xcontext'rst)))) s\"\n and \"c_state_update (c_CoreStats_update (\\_. f_c_CoreStats (c_CoreStats (c_state s)))) s = \n c_state_update (c_CoreStats_update (f_c_CoreStats)) s\"\n and \"c_state_update (c_CoreStats_update (branch_not_taken_update (\\_. f_branch_not_taken (branch_not_taken (c_CoreStats (c_state s)))))) s = \n c_state_update (c_CoreStats_update (branch_not_taken_update (f_branch_not_taken))) s\"\n and \"c_state_update (c_CoreStats_update (branch_taken_update (\\_. f_branch_taken (branch_taken (c_CoreStats (c_state s)))))) s = \n c_state_update (c_CoreStats_update (branch_taken_update (f_branch_taken))) s\"\n and \"c_state_update (c_LLbit_update (\\_. f_c_LLbit (c_LLbit (c_state s)))) s = \n c_state_update (c_LLbit_update (f_c_LLbit)) s\"\n and \"c_state_update (c_PC_update (\\_. f_c_PC (c_PC (c_state s)))) s = \n c_state_update (c_PC_update (f_c_PC)) s\"\n and \"c_state_update (c_exceptionSignalled_update (\\_. f_c_exceptionSignalled (c_exceptionSignalled (c_state s)))) s = \n c_state_update (c_exceptionSignalled_update (f_c_exceptionSignalled)) s\"\n and \"c_state_update (c_hi_update (\\_. f_c_hi (c_hi (c_state s)))) s = \n c_state_update (c_hi_update (f_c_hi)) s\"\n and \"c_state_update (c_lo_update (\\_. f_c_lo (c_lo (c_state s)))) s = \n c_state_update (c_lo_update (f_c_lo)) s\"\n and \"capcause_update (\\_. f_capcause (capcause s)) s = \n capcause_update (f_capcause) s\"\n and \"csv_stats_header_done_update (\\_. f_csv_stats_header_done (csv_stats_header_done s)) s = \n csv_stats_header_done_update (f_csv_stats_header_done) s\"\n and \"currentInst_update (\\_. f_currentInst (currentInst s)) s = \n currentInst_update (f_currentInst) s\"\n and \"done_update (\\_. f_done (done s)) s = \n done_update (f_done) s\"\n and \"dynamicMemStats_update (\\_. f_dynamicMemStats (dynamicMemStats s)) s = \n dynamicMemStats_update (f_dynamicMemStats) s\"\n and \"dynamic_shadow_16K_TAGS_update (\\_. f_dynamic_shadow_16K_TAGS (dynamic_shadow_16K_TAGS s)) s = \n dynamic_shadow_16K_TAGS_update (f_dynamic_shadow_16K_TAGS) s\"\n and \"dynamic_shadow_4K_MEM_update (\\_. f_dynamic_shadow_4K_MEM (dynamic_shadow_4K_MEM s)) s = \n dynamic_shadow_4K_MEM_update (f_dynamic_shadow_4K_MEM) s\"\n and \"dynamic_shadow_4K_TAGS_update (\\_. f_dynamic_shadow_4K_TAGS (dynamic_shadow_4K_TAGS s)) s = \n dynamic_shadow_4K_TAGS_update (f_dynamic_shadow_4K_TAGS) s\"\n and \"dynamic_shadow_MEM_update (\\_. f_dynamic_shadow_MEM (dynamic_shadow_MEM s)) s = \n dynamic_shadow_MEM_update (f_dynamic_shadow_MEM) s\"\n and \"dynamic_shadow_TAGS_update (\\_. f_dynamic_shadow_TAGS (dynamic_shadow_TAGS s)) s = \n dynamic_shadow_TAGS_update (f_dynamic_shadow_TAGS) s\"\n and \"exception_update (\\_. f_exception (exception s)) s = \n exception_update (f_exception) s\"\n and \"hasCP1_update (\\_. f_hasCP1 (hasCP1 s)) s = \n hasCP1_update (f_hasCP1) s\"\n and \"hasCP2_update (\\_. f_hasCP2 (hasCP2 s)) s = \n hasCP2_update (f_hasCP2) s\"\n and \"instCnt_update (\\_. f_instCnt (instCnt s)) s = \n instCnt_update (f_instCnt) s\"\n and \"lastInst_update (\\_. f_lastInst (lastInst s)) s = \n lastInst_update (f_lastInst) s\"\n and \"log_update (\\_. f_log (log s)) s = \n log_update (f_log) s\"\n and \"memAccessStats_update (\\_. f_memAccessStats (memAccessStats s)) s = \n memAccessStats_update (f_memAccessStats) s\"\n and \"print_update (\\_. f_print (print s)) s = \n print_update (f_print) s\"\n and \"procID_update (\\_. f_procID (procID s)) s = \n procID_update (f_procID) s\"\n and \"staticMemStats_update (\\_. f_staticMemStats (staticMemStats s)) s = \n staticMemStats_update (f_staticMemStats) s\"\n and \"static_shadow_16K_TAGS_update (\\_. f_static_shadow_16K_TAGS (static_shadow_16K_TAGS s)) s = \n static_shadow_16K_TAGS_update (f_static_shadow_16K_TAGS) s\"\n and \"static_shadow_4K_MEM_update (\\_. f_static_shadow_4K_MEM (static_shadow_4K_MEM s)) s = \n static_shadow_4K_MEM_update (f_static_shadow_4K_MEM) s\"\n and \"static_shadow_4K_TAGS_update (\\_. f_static_shadow_4K_TAGS (static_shadow_4K_TAGS s)) s = \n static_shadow_4K_TAGS_update (f_static_shadow_4K_TAGS) s\"\n and \"static_shadow_MEM_update (\\_. f_static_shadow_MEM (static_shadow_MEM s)) s = \n static_shadow_MEM_update (f_static_shadow_MEM) s\"\n and \"static_shadow_TAGS_update (\\_. f_static_shadow_TAGS (static_shadow_TAGS s)) s = \n static_shadow_TAGS_update (f_static_shadow_TAGS) s\"\n and \"the_MEM_update (\\_. f_the_MEM (the_MEM s)) s = \n the_MEM_update (f_the_MEM) s\"\n and \"totalCore_update (\\_. f_totalCore (totalCore s)) s = \n totalCore_update (f_totalCore) s\"\n and \"trace_level_update (\\_. f_trace_level (trace_level s)) s = \n trace_level_update (f_trace_level) s\"\n and \"unknown_counters_update (\\_. f_unknown_counters (unknown_counters s)) s = \n unknown_counters_update (f_unknown_counters) s\"\n and \"watchOOBCap_update (\\_. f_watchOOBCap (watchOOBCap s)) s = \n watchOOBCap_update (f_watchOOBCap) s\"\n and \"watchPaddr_update (\\_. f_watchPaddr (watchPaddr s)) s = \n watchPaddr_update (f_watchPaddr) s\"\n and \"watcher_update (\\_. f_watcher (watcher s)) s = \n watcher_update (f_watcher) s\"\nby simp_all\n\n(* Code generation - end *)\n\n(* Code generation - start - contracting reads and updates *)\n\nsubsection \\@{const c_BranchDelay}\\\n\nabbreviation getBranchDelay where\n \"getBranchDelay \\ (\\s. c_BranchDelay (c_state s))\"\n\nlemma BranchDelay_alt [alt_def_simp]:\n shows \"BranchDelay = read_state getBranchDelay\"\nunfolding BranchDelay_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_BranchDelay [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_BranchDelay]\n\nabbreviation setBranchDelay where\n \"setBranchDelay v \\ c_state_update (c_BranchDelay_update (\\_. v))\"\n\nlemma write'BranchDelay_alt [alt_def_simp]:\n shows \"write'BranchDelay = (\\v. update_state (setBranchDelay v))\"\nunfolding write'BranchDelay_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_BranchDelay [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_BranchDelay_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_BranchDelay\n and sub_update=c_BranchDelay_update]\n\nsubsection \\@{const c_BranchTo}\\\n\nabbreviation getBranchTo where\n \"getBranchTo \\ (\\s. c_BranchTo (c_state s))\"\n\nlemma BranchTo_alt [alt_def_simp]:\n shows \"BranchTo = read_state getBranchTo\"\nunfolding BranchTo_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_BranchTo [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_BranchTo]\n\nabbreviation setBranchTo where\n \"setBranchTo v \\ c_state_update (c_BranchTo_update (\\_. v))\"\n\nlemma write'BranchTo_alt [alt_def_simp]:\n shows \"write'BranchTo = (\\v. update_state (setBranchTo v))\"\nunfolding write'BranchTo_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_BranchTo [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_BranchTo_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_BranchTo\n and sub_update=c_BranchTo_update]\n\nsubsection \\@{const c_CP0}\\\n\nabbreviation getCP0 where\n \"getCP0 \\ (\\s. c_CP0 (c_state s))\"\n\nlemma CP0_alt [alt_def_simp]:\n shows \"CP0 = read_state getCP0\"\nunfolding CP0_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_CP0 [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_CP0]\n\nabbreviation setCP0 where\n \"setCP0 v \\ c_state_update (c_CP0_update (\\_. v))\"\n\nlemma write'CP0_alt [alt_def_simp]:\n shows \"write'CP0 = (\\v. update_state (setCP0 v))\"\nunfolding write'CP0_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_CP0 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_CP0_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_CP0\n and sub_update=c_CP0_update]\n\nsubsection \\@{const BadInstr}\\\n\nabbreviation getCP0BadInstr where\n \"getCP0BadInstr \\ (\\s. BadInstr (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0BadInstr [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=BadInstr]\n\nabbreviation setCP0BadInstr where\n \"setCP0BadInstr v \\ c_state_update (c_CP0_update (BadInstr_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0BadInstr [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=BadInstr_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=BadInstr\n and sub_update=BadInstr_update]\n\nsubsection \\@{const BadInstrP}\\\n\nabbreviation getCP0BadInstrP where\n \"getCP0BadInstrP \\ (\\s. BadInstrP (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0BadInstrP [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=BadInstrP]\n\nabbreviation setCP0BadInstrP where\n \"setCP0BadInstrP v \\ c_state_update (c_CP0_update (BadInstrP_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0BadInstrP [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=BadInstrP_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=BadInstrP\n and sub_update=BadInstrP_update]\n\nsubsection \\@{const BadVAddr}\\\n\nabbreviation getCP0BadVAddr where\n \"getCP0BadVAddr \\ (\\s. BadVAddr (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0BadVAddr [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=BadVAddr]\n\nabbreviation setCP0BadVAddr where\n \"setCP0BadVAddr v \\ c_state_update (c_CP0_update (BadVAddr_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0BadVAddr [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=BadVAddr_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=BadVAddr\n and sub_update=BadVAddr_update]\n\nsubsection \\@{const Cause}\\\n\nabbreviation getCP0Cause where\n \"getCP0Cause \\ (\\s. Cause (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Cause [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Cause]\n\nabbreviation setCP0Cause where\n \"setCP0Cause v \\ c_state_update (c_CP0_update (Cause_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Cause [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Cause_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Cause\n and sub_update=Cause_update]\n\nsubsection \\@{const BD}\\\n\nabbreviation getCP0CauseBD where\n \"getCP0CauseBD \\ (\\s. BD (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseBD [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=BD]\n\nabbreviation setCP0CauseBD where\n \"setCP0CauseBD v \\ c_state_update (c_CP0_update (Cause_update (BD_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseBD [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=BD_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=BD\n and sub_update=BD_update]\n\nsubsection \\@{const CE}\\\n\nabbreviation getCP0CauseCE where\n \"getCP0CauseCE \\ (\\s. CE (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseCE [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=CE]\n\nabbreviation setCP0CauseCE where\n \"setCP0CauseCE v \\ c_state_update (c_CP0_update (Cause_update (CE_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseCE [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=CE_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=CE\n and sub_update=CE_update]\n\nsubsection \\@{const CauseRegister.ExcCode}\\\n\nabbreviation getCP0CauseExcCode where\n \"getCP0CauseExcCode \\ (\\s. CauseRegister.ExcCode (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseExcCode [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=CauseRegister.ExcCode]\n\nabbreviation setCP0CauseExcCode where\n \"setCP0CauseExcCode v \\ c_state_update (c_CP0_update (Cause_update (CauseRegister.ExcCode_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseExcCode [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=CauseRegister.ExcCode_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=CauseRegister.ExcCode\n and sub_update=CauseRegister.ExcCode_update]\n\nsubsection \\@{const IP}\\\n\nabbreviation getCP0CauseIP where\n \"getCP0CauseIP \\ (\\s. IP (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseIP [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=IP]\n\nabbreviation setCP0CauseIP where\n \"setCP0CauseIP v \\ c_state_update (c_CP0_update (Cause_update (IP_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseIP [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=IP_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=IP\n and sub_update=IP_update]\n\nsubsection \\@{const TI}\\\n\nabbreviation getCP0CauseTI where\n \"getCP0CauseTI \\ (\\s. TI (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseTI [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=TI]\n\nabbreviation setCP0CauseTI where\n \"setCP0CauseTI v \\ c_state_update (c_CP0_update (Cause_update (TI_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseTI [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=TI_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=TI\n and sub_update=TI_update]\n\nsubsection \\@{const causeregister'rst}\\\n\nabbreviation getCP0CauseCauseregister'rst where\n \"getCP0CauseCauseregister'rst \\ (\\s. causeregister'rst (Cause (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Cause_CP0CauseCauseregister'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Cause and sub=causeregister'rst]\n\nabbreviation setCP0CauseCauseregister'rst where\n \"setCP0CauseCauseregister'rst v \\ c_state_update (c_CP0_update (Cause_update (causeregister'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0CauseCauseregister'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Cause\n and setParent=setCP0Cause\n and sub_update=causeregister'rst_update]\n contract_update[where getParent=getCP0Cause \n and setParent=setCP0Cause\n and sub=causeregister'rst\n and sub_update=causeregister'rst_update]\n\nsubsection \\@{const Compare}\\\n\nabbreviation getCP0Compare where\n \"getCP0Compare \\ (\\s. Compare (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Compare [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Compare]\n\nabbreviation setCP0Compare where\n \"setCP0Compare v \\ c_state_update (c_CP0_update (Compare_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Compare [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Compare_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Compare\n and sub_update=Compare_update]\n\nsubsection \\@{const Config}\\\n\nabbreviation getCP0Config where\n \"getCP0Config \\ (\\s. Config (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Config [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Config]\n\nabbreviation setCP0Config where\n \"setCP0Config v \\ c_state_update (c_CP0_update (Config_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Config [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Config_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Config\n and sub_update=Config_update]\n\nsubsection \\@{const AR}\\\n\nabbreviation getCP0ConfigAR where\n \"getCP0ConfigAR \\ (\\s. AR (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigAR [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=AR]\n\nabbreviation setCP0ConfigAR where\n \"setCP0ConfigAR v \\ c_state_update (c_CP0_update (Config_update (AR_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigAR [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=AR_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=AR\n and sub_update=AR_update]\n\nsubsection \\@{const AT}\\\n\nabbreviation getCP0ConfigAT where\n \"getCP0ConfigAT \\ (\\s. AT (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigAT [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=AT]\n\nabbreviation setCP0ConfigAT where\n \"setCP0ConfigAT v \\ c_state_update (c_CP0_update (Config_update (AT_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigAT [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=AT_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=AT\n and sub_update=AT_update]\n\nsubsection \\@{const BE}\\\n\nabbreviation getCP0ConfigBE where\n \"getCP0ConfigBE \\ (\\s. BE (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigBE [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=BE]\n\nabbreviation setCP0ConfigBE where\n \"setCP0ConfigBE v \\ c_state_update (c_CP0_update (Config_update (BE_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigBE [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=BE_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=BE\n and sub_update=BE_update]\n\nsubsection \\@{const K0}\\\n\nabbreviation getCP0ConfigK0 where\n \"getCP0ConfigK0 \\ (\\s. K0 (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigK0 [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=K0]\n\nabbreviation setCP0ConfigK0 where\n \"setCP0ConfigK0 v \\ c_state_update (c_CP0_update (Config_update (K0_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigK0 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=K0_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=K0\n and sub_update=K0_update]\n\nsubsection \\@{const ConfigRegister.M}\\\n\nabbreviation getCP0ConfigM where\n \"getCP0ConfigM \\ (\\s. ConfigRegister.M (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigM [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=ConfigRegister.M]\n\nabbreviation setCP0ConfigM where\n \"setCP0ConfigM v \\ c_state_update (c_CP0_update (Config_update (ConfigRegister.M_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigM [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=ConfigRegister.M_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=ConfigRegister.M\n and sub_update=ConfigRegister.M_update]\n\nsubsection \\@{const ConfigRegister.MT}\\\n\nabbreviation getCP0ConfigMT where\n \"getCP0ConfigMT \\ (\\s. ConfigRegister.MT (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigMT [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=ConfigRegister.MT]\n\nabbreviation setCP0ConfigMT where\n \"setCP0ConfigMT v \\ c_state_update (c_CP0_update (Config_update (ConfigRegister.MT_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigMT [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=ConfigRegister.MT_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=ConfigRegister.MT\n and sub_update=ConfigRegister.MT_update]\n\nsubsection \\@{const configregister'rst}\\\n\nabbreviation getCP0ConfigConfigregister'rst where\n \"getCP0ConfigConfigregister'rst \\ (\\s. configregister'rst (Config (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Config_CP0ConfigConfigregister'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Config and sub=configregister'rst]\n\nabbreviation setCP0ConfigConfigregister'rst where\n \"setCP0ConfigConfigregister'rst v \\ c_state_update (c_CP0_update (Config_update (configregister'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ConfigConfigregister'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Config\n and setParent=setCP0Config\n and sub_update=configregister'rst_update]\n contract_update[where getParent=getCP0Config \n and setParent=setCP0Config\n and sub=configregister'rst\n and sub_update=configregister'rst_update]\n\nsubsection \\@{const Config1}\\\n\nabbreviation getCP0Config1 where\n \"getCP0Config1 \\ (\\s. Config1 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Config1 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Config1]\n\nabbreviation setCP0Config1 where\n \"setCP0Config1 v \\ c_state_update (c_CP0_update (Config1_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Config1 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Config1_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Config1\n and sub_update=Config1_update]\n\nsubsection \\@{const Config2}\\\n\nabbreviation getCP0Config2 where\n \"getCP0Config2 \\ (\\s. Config2 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Config2 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Config2]\n\nabbreviation setCP0Config2 where\n \"setCP0Config2 v \\ c_state_update (c_CP0_update (Config2_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Config2 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Config2_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Config2\n and sub_update=Config2_update]\n\nsubsection \\@{const Config3}\\\n\nabbreviation getCP0Config3 where\n \"getCP0Config3 \\ (\\s. Config3 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Config3 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Config3]\n\nabbreviation setCP0Config3 where\n \"setCP0Config3 v \\ c_state_update (c_CP0_update (Config3_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Config3 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Config3_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Config3\n and sub_update=Config3_update]\n\nsubsection \\@{const Config6}\\\n\nabbreviation getCP0Config6 where\n \"getCP0Config6 \\ (\\s. Config6 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Config6 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Config6]\n\nabbreviation setCP0Config6 where\n \"setCP0Config6 v \\ c_state_update (c_CP0_update (Config6_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Config6 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Config6_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Config6\n and sub_update=Config6_update]\n\nsubsection \\@{const Context}\\\n\nabbreviation getCP0Context where\n \"getCP0Context \\ (\\s. Context (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Context [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Context]\n\nabbreviation setCP0Context where\n \"setCP0Context v \\ c_state_update (c_CP0_update (Context_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Context [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Context_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Context\n and sub_update=Context_update]\n\nsubsection \\@{const Context.BadVPN2}\\\n\nabbreviation getCP0ContextBadVPN2 where\n \"getCP0ContextBadVPN2 \\ (\\s. Context.BadVPN2 (Context (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Context_CP0ContextBadVPN2 [alt_def_simp] = \n contract_read[where getParent=getCP0Context and sub=Context.BadVPN2]\n\nabbreviation setCP0ContextBadVPN2 where\n \"setCP0ContextBadVPN2 v \\ c_state_update (c_CP0_update (Context_update (Context.BadVPN2_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ContextBadVPN2 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Context\n and setParent=setCP0Context\n and sub_update=Context.BadVPN2_update]\n contract_update[where getParent=getCP0Context \n and setParent=setCP0Context\n and sub=Context.BadVPN2\n and sub_update=Context.BadVPN2_update]\n\nsubsection \\@{const Context.PTEBase}\\\n\nabbreviation getCP0ContextPTEBase where\n \"getCP0ContextPTEBase \\ (\\s. Context.PTEBase (Context (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Context_CP0ContextPTEBase [alt_def_simp] = \n contract_read[where getParent=getCP0Context and sub=Context.PTEBase]\n\nabbreviation setCP0ContextPTEBase where\n \"setCP0ContextPTEBase v \\ c_state_update (c_CP0_update (Context_update (Context.PTEBase_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ContextPTEBase [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Context\n and setParent=setCP0Context\n and sub_update=Context.PTEBase_update]\n contract_update[where getParent=getCP0Context \n and setParent=setCP0Context\n and sub=Context.PTEBase\n and sub_update=Context.PTEBase_update]\n\nsubsection \\@{const context'rst}\\\n\nabbreviation getCP0ContextContext'rst where\n \"getCP0ContextContext'rst \\ (\\s. context'rst (Context (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Context_CP0ContextContext'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Context and sub=context'rst]\n\nabbreviation setCP0ContextContext'rst where\n \"setCP0ContextContext'rst v \\ c_state_update (c_CP0_update (Context_update (context'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0ContextContext'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Context\n and setParent=setCP0Context\n and sub_update=context'rst_update]\n contract_update[where getParent=getCP0Context \n and setParent=setCP0Context\n and sub=context'rst\n and sub_update=context'rst_update]\n\nsubsection \\@{const Count}\\\n\nabbreviation getCP0Count where\n \"getCP0Count \\ (\\s. Count (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Count [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Count]\n\nabbreviation setCP0Count where\n \"setCP0Count v \\ c_state_update (c_CP0_update (Count_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Count [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Count_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Count\n and sub_update=Count_update]\n\nsubsection \\@{const Debug}\\\n\nabbreviation getCP0Debug where\n \"getCP0Debug \\ (\\s. Debug (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Debug [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Debug]\n\nabbreviation setCP0Debug where\n \"setCP0Debug v \\ c_state_update (c_CP0_update (Debug_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Debug [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Debug_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Debug\n and sub_update=Debug_update]\n\nsubsection \\@{const EPC}\\\n\nabbreviation getCP0EPC where\n \"getCP0EPC \\ (\\s. EPC (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0EPC [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=EPC]\n\nabbreviation setCP0EPC where\n \"setCP0EPC v \\ c_state_update (c_CP0_update (EPC_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0EPC [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=EPC_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=EPC\n and sub_update=EPC_update]\n\nsubsection \\@{const EntryHi}\\\n\nabbreviation getCP0EntryHi where\n \"getCP0EntryHi \\ (\\s. EntryHi (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0EntryHi [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=EntryHi]\n\nabbreviation setCP0EntryHi where\n \"setCP0EntryHi v \\ c_state_update (c_CP0_update (EntryHi_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0EntryHi [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=EntryHi_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=EntryHi\n and sub_update=EntryHi_update]\n\nsubsection \\@{const EntryHi.ASID}\\\n\nabbreviation getCP0EntryHiASID where\n \"getCP0EntryHiASID \\ (\\s. EntryHi.ASID (EntryHi (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0EntryHi_CP0EntryHiASID [alt_def_simp] = \n contract_read[where getParent=getCP0EntryHi and sub=EntryHi.ASID]\n\nabbreviation setCP0EntryHiASID where\n \"setCP0EntryHiASID v \\ c_state_update (c_CP0_update (EntryHi_update (EntryHi.ASID_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0EntryHiASID [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0EntryHi\n and setParent=setCP0EntryHi\n and sub_update=EntryHi.ASID_update]\n contract_update[where getParent=getCP0EntryHi \n and setParent=setCP0EntryHi\n and sub=EntryHi.ASID\n and sub_update=EntryHi.ASID_update]\n\nsubsection \\@{const EntryHi.R}\\\n\nabbreviation getCP0EntryHiR where\n \"getCP0EntryHiR \\ (\\s. EntryHi.R (EntryHi (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0EntryHi_CP0EntryHiR [alt_def_simp] = \n contract_read[where getParent=getCP0EntryHi and sub=EntryHi.R]\n\nabbreviation setCP0EntryHiR where\n \"setCP0EntryHiR v \\ c_state_update (c_CP0_update (EntryHi_update (EntryHi.R_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0EntryHiR [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0EntryHi\n and setParent=setCP0EntryHi\n and sub_update=EntryHi.R_update]\n contract_update[where getParent=getCP0EntryHi \n and setParent=setCP0EntryHi\n and sub=EntryHi.R\n and sub_update=EntryHi.R_update]\n\nsubsection \\@{const EntryHi.VPN2}\\\n\nabbreviation getCP0EntryHiVPN2 where\n \"getCP0EntryHiVPN2 \\ (\\s. EntryHi.VPN2 (EntryHi (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0EntryHi_CP0EntryHiVPN2 [alt_def_simp] = \n contract_read[where getParent=getCP0EntryHi and sub=EntryHi.VPN2]\n\nabbreviation setCP0EntryHiVPN2 where\n \"setCP0EntryHiVPN2 v \\ c_state_update (c_CP0_update (EntryHi_update (EntryHi.VPN2_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0EntryHiVPN2 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0EntryHi\n and setParent=setCP0EntryHi\n and sub_update=EntryHi.VPN2_update]\n contract_update[where getParent=getCP0EntryHi \n and setParent=setCP0EntryHi\n and sub=EntryHi.VPN2\n and sub_update=EntryHi.VPN2_update]\n\nsubsection \\@{const entryhi'rst}\\\n\nabbreviation getCP0EntryHiEntryhi'rst where\n \"getCP0EntryHiEntryhi'rst \\ (\\s. entryhi'rst (EntryHi (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0EntryHi_CP0EntryHiEntryhi'rst [alt_def_simp] = \n contract_read[where getParent=getCP0EntryHi and sub=entryhi'rst]\n\nabbreviation setCP0EntryHiEntryhi'rst where\n \"setCP0EntryHiEntryhi'rst v \\ c_state_update (c_CP0_update (EntryHi_update (entryhi'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0EntryHiEntryhi'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0EntryHi\n and setParent=setCP0EntryHi\n and sub_update=entryhi'rst_update]\n contract_update[where getParent=getCP0EntryHi \n and setParent=setCP0EntryHi\n and sub=entryhi'rst\n and sub_update=entryhi'rst_update]\n\nsubsection \\@{const EntryLo0}\\\n\nabbreviation getCP0EntryLo0 where\n \"getCP0EntryLo0 \\ (\\s. EntryLo0 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0EntryLo0 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=EntryLo0]\n\nabbreviation setCP0EntryLo0 where\n \"setCP0EntryLo0 v \\ c_state_update (c_CP0_update (EntryLo0_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0EntryLo0 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=EntryLo0_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=EntryLo0\n and sub_update=EntryLo0_update]\n\nsubsection \\@{const EntryLo1}\\\n\nabbreviation getCP0EntryLo1 where\n \"getCP0EntryLo1 \\ (\\s. EntryLo1 (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0EntryLo1 [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=EntryLo1]\n\nabbreviation setCP0EntryLo1 where\n \"setCP0EntryLo1 v \\ c_state_update (c_CP0_update (EntryLo1_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0EntryLo1 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=EntryLo1_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=EntryLo1\n and sub_update=EntryLo1_update]\n\nsubsection \\@{const ErrCtl}\\\n\nabbreviation getCP0ErrCtl where\n \"getCP0ErrCtl \\ (\\s. ErrCtl (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0ErrCtl [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=ErrCtl]\n\nabbreviation setCP0ErrCtl where\n \"setCP0ErrCtl v \\ c_state_update (c_CP0_update (ErrCtl_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0ErrCtl [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=ErrCtl_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=ErrCtl\n and sub_update=ErrCtl_update]\n\nsubsection \\@{const ErrorEPC}\\\n\nabbreviation getCP0ErrorEPC where\n \"getCP0ErrorEPC \\ (\\s. ErrorEPC (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0ErrorEPC [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=ErrorEPC]\n\nabbreviation setCP0ErrorEPC where\n \"setCP0ErrorEPC v \\ c_state_update (c_CP0_update (ErrorEPC_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0ErrorEPC [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=ErrorEPC_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=ErrorEPC\n and sub_update=ErrorEPC_update]\n\nsubsection \\@{const HWREna}\\\n\nabbreviation getCP0HWREna where\n \"getCP0HWREna \\ (\\s. HWREna (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0HWREna [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=HWREna]\n\nabbreviation setCP0HWREna where\n \"setCP0HWREna v \\ c_state_update (c_CP0_update (HWREna_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0HWREna [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=HWREna_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=HWREna\n and sub_update=HWREna_update]\n\nsubsection \\@{const Index}\\\n\nabbreviation getCP0Index where\n \"getCP0Index \\ (\\s. Index (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Index [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Index]\n\nabbreviation setCP0Index where\n \"setCP0Index v \\ c_state_update (c_CP0_update (Index_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Index [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Index_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Index\n and sub_update=Index_update]\n\nsubsection \\@{const LLAddr}\\\n\nabbreviation getCP0LLAddr where\n \"getCP0LLAddr \\ (\\s. LLAddr (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0LLAddr [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=LLAddr]\n\nabbreviation setCP0LLAddr where\n \"setCP0LLAddr v \\ c_state_update (c_CP0_update (LLAddr_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0LLAddr [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=LLAddr_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=LLAddr\n and sub_update=LLAddr_update]\n\nsubsection \\@{const PRId}\\\n\nabbreviation getCP0PRId where\n \"getCP0PRId \\ (\\s. PRId (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0PRId [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=PRId]\n\nabbreviation setCP0PRId where\n \"setCP0PRId v \\ c_state_update (c_CP0_update (PRId_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0PRId [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=PRId_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=PRId\n and sub_update=PRId_update]\n\nsubsection \\@{const PageMask}\\\n\nabbreviation getCP0PageMask where\n \"getCP0PageMask \\ (\\s. PageMask (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0PageMask [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=PageMask]\n\nabbreviation setCP0PageMask where\n \"setCP0PageMask v \\ c_state_update (c_CP0_update (PageMask_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0PageMask [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=PageMask_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=PageMask\n and sub_update=PageMask_update]\n\nsubsection \\@{const Random}\\\n\nabbreviation getCP0Random where\n \"getCP0Random \\ (\\s. Random (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Random [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Random]\n\nabbreviation setCP0Random where\n \"setCP0Random v \\ c_state_update (c_CP0_update (Random_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Random [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Random_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Random\n and sub_update=Random_update]\n\nsubsection \\@{const Random.Random}\\\n\nabbreviation getCP0RandomRandom where\n \"getCP0RandomRandom \\ (\\s. Random.Random (Random (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Random_CP0RandomRandom [alt_def_simp] = \n contract_read[where getParent=getCP0Random and sub=Random.Random]\n\nabbreviation setCP0RandomRandom where\n \"setCP0RandomRandom v \\ c_state_update (c_CP0_update (Random_update (Random.Random_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0RandomRandom [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Random\n and setParent=setCP0Random\n and sub_update=Random.Random_update]\n contract_update[where getParent=getCP0Random \n and setParent=setCP0Random\n and sub=Random.Random\n and sub_update=Random.Random_update]\n\nsubsection \\@{const random'rst}\\\n\nabbreviation getCP0RandomRandom'rst where\n \"getCP0RandomRandom'rst \\ (\\s. random'rst (Random (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Random_CP0RandomRandom'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Random and sub=random'rst]\n\nabbreviation setCP0RandomRandom'rst where\n \"setCP0RandomRandom'rst v \\ c_state_update (c_CP0_update (Random_update (random'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0RandomRandom'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Random\n and setParent=setCP0Random\n and sub_update=random'rst_update]\n contract_update[where getParent=getCP0Random \n and setParent=setCP0Random\n and sub=random'rst\n and sub_update=random'rst_update]\n\nsubsection \\@{const Status}\\\n\nabbreviation getCP0Status where\n \"getCP0Status \\ (\\s. Status (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Status [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Status]\n\nabbreviation setCP0Status where\n \"setCP0Status v \\ c_state_update (c_CP0_update (Status_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Status [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Status_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Status\n and sub_update=Status_update]\n\nsubsection \\@{const BEV}\\\n\nabbreviation getCP0StatusBEV where\n \"getCP0StatusBEV \\ (\\s. BEV (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusBEV [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=BEV]\n\nabbreviation setCP0StatusBEV where\n \"setCP0StatusBEV v \\ c_state_update (c_CP0_update (Status_update (BEV_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusBEV [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=BEV_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=BEV\n and sub_update=BEV_update]\n\nsubsection \\@{const CU0}\\\n\nabbreviation getCP0StatusCU0 where\n \"getCP0StatusCU0 \\ (\\s. CU0 (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusCU0 [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=CU0]\n\nabbreviation setCP0StatusCU0 where\n \"setCP0StatusCU0 v \\ c_state_update (c_CP0_update (Status_update (CU0_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusCU0 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=CU0_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=CU0\n and sub_update=CU0_update]\n\nsubsection \\@{const CU1}\\\n\nabbreviation getCP0StatusCU1 where\n \"getCP0StatusCU1 \\ (\\s. CU1 (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusCU1 [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=CU1]\n\nabbreviation setCP0StatusCU1 where\n \"setCP0StatusCU1 v \\ c_state_update (c_CP0_update (Status_update (CU1_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusCU1 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=CU1_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=CU1\n and sub_update=CU1_update]\n\nsubsection \\@{const CU2}\\\n\nabbreviation getCP0StatusCU2 where\n \"getCP0StatusCU2 \\ (\\s. CU2 (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusCU2 [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=CU2]\n\nabbreviation setCP0StatusCU2 where\n \"setCP0StatusCU2 v \\ c_state_update (c_CP0_update (Status_update (CU2_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusCU2 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=CU2_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=CU2\n and sub_update=CU2_update]\n\nsubsection \\@{const CU3}\\\n\nabbreviation getCP0StatusCU3 where\n \"getCP0StatusCU3 \\ (\\s. CU3 (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusCU3 [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=CU3]\n\nabbreviation setCP0StatusCU3 where\n \"setCP0StatusCU3 v \\ c_state_update (c_CP0_update (Status_update (CU3_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusCU3 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=CU3_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=CU3\n and sub_update=CU3_update]\n\nsubsection \\@{const ERL}\\\n\nabbreviation getCP0StatusERL where\n \"getCP0StatusERL \\ (\\s. ERL (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusERL [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=ERL]\n\nabbreviation setCP0StatusERL where\n \"setCP0StatusERL v \\ c_state_update (c_CP0_update (Status_update (ERL_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusERL [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=ERL_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=ERL\n and sub_update=ERL_update]\n\nsubsection \\@{const EXL}\\\n\nabbreviation getCP0StatusEXL where\n \"getCP0StatusEXL \\ (\\s. EXL (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusEXL [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=EXL]\n\nabbreviation setCP0StatusEXL where\n \"setCP0StatusEXL v \\ c_state_update (c_CP0_update (Status_update (EXL_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusEXL [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=EXL_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=EXL\n and sub_update=EXL_update]\n\nsubsection \\@{const FR}\\\n\nabbreviation getCP0StatusFR where\n \"getCP0StatusFR \\ (\\s. FR (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusFR [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=FR]\n\nabbreviation setCP0StatusFR where\n \"setCP0StatusFR v \\ c_state_update (c_CP0_update (Status_update (FR_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusFR [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=FR_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=FR\n and sub_update=FR_update]\n\nsubsection \\@{const IE}\\\n\nabbreviation getCP0StatusIE where\n \"getCP0StatusIE \\ (\\s. IE (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusIE [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=IE]\n\nabbreviation setCP0StatusIE where\n \"setCP0StatusIE v \\ c_state_update (c_CP0_update (Status_update (IE_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusIE [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=IE_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=IE\n and sub_update=IE_update]\n\nsubsection \\@{const IM}\\\n\nabbreviation getCP0StatusIM where\n \"getCP0StatusIM \\ (\\s. IM (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusIM [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=IM]\n\nabbreviation setCP0StatusIM where\n \"setCP0StatusIM v \\ c_state_update (c_CP0_update (Status_update (IM_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusIM [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=IM_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=IM\n and sub_update=IM_update]\n\nsubsection \\@{const KSU}\\\n\nabbreviation getCP0StatusKSU where\n \"getCP0StatusKSU \\ (\\s. KSU (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusKSU [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=KSU]\n\nabbreviation setCP0StatusKSU where\n \"setCP0StatusKSU v \\ c_state_update (c_CP0_update (Status_update (KSU_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusKSU [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=KSU_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=KSU\n and sub_update=KSU_update]\n\nsubsection \\@{const KX}\\\n\nabbreviation getCP0StatusKX where\n \"getCP0StatusKX \\ (\\s. KX (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusKX [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=KX]\n\nabbreviation setCP0StatusKX where\n \"setCP0StatusKX v \\ c_state_update (c_CP0_update (Status_update (KX_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusKX [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=KX_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=KX\n and sub_update=KX_update]\n\nsubsection \\@{const StatusRegister.RE}\\\n\nabbreviation getCP0StatusRE where\n \"getCP0StatusRE \\ (\\s. StatusRegister.RE (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusRE [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=StatusRegister.RE]\n\nabbreviation setCP0StatusRE where\n \"setCP0StatusRE v \\ c_state_update (c_CP0_update (Status_update (StatusRegister.RE_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusRE [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=StatusRegister.RE_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=StatusRegister.RE\n and sub_update=StatusRegister.RE_update]\n\nsubsection \\@{const SX}\\\n\nabbreviation getCP0StatusSX where\n \"getCP0StatusSX \\ (\\s. SX (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusSX [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=SX]\n\nabbreviation setCP0StatusSX where\n \"setCP0StatusSX v \\ c_state_update (c_CP0_update (Status_update (SX_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusSX [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=SX_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=SX\n and sub_update=SX_update]\n\nsubsection \\@{const UX}\\\n\nabbreviation getCP0StatusUX where\n \"getCP0StatusUX \\ (\\s. UX (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusUX [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=UX]\n\nabbreviation setCP0StatusUX where\n \"setCP0StatusUX v \\ c_state_update (c_CP0_update (Status_update (UX_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusUX [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=UX_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=UX\n and sub_update=UX_update]\n\nsubsection \\@{const statusregister'rst}\\\n\nabbreviation getCP0StatusStatusregister'rst where\n \"getCP0StatusStatusregister'rst \\ (\\s. statusregister'rst (Status (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Status_CP0StatusStatusregister'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Status and sub=statusregister'rst]\n\nabbreviation setCP0StatusStatusregister'rst where\n \"setCP0StatusStatusregister'rst v \\ c_state_update (c_CP0_update (Status_update (statusregister'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0StatusStatusregister'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Status\n and setParent=setCP0Status\n and sub_update=statusregister'rst_update]\n contract_update[where getParent=getCP0Status \n and setParent=setCP0Status\n and sub=statusregister'rst\n and sub_update=statusregister'rst_update]\n\nsubsection \\@{const UsrLocal}\\\n\nabbreviation getCP0UsrLocal where\n \"getCP0UsrLocal \\ (\\s. UsrLocal (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0UsrLocal [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=UsrLocal]\n\nabbreviation setCP0UsrLocal where\n \"setCP0UsrLocal v \\ c_state_update (c_CP0_update (UsrLocal_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0UsrLocal [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=UsrLocal_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=UsrLocal\n and sub_update=UsrLocal_update]\n\nsubsection \\@{const Wired}\\\n\nabbreviation getCP0Wired where\n \"getCP0Wired \\ (\\s. Wired (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0Wired [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=Wired]\n\nabbreviation setCP0Wired where\n \"setCP0Wired v \\ c_state_update (c_CP0_update (Wired_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0Wired [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=Wired_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=Wired\n and sub_update=Wired_update]\n\nsubsection \\@{const Wired.Wired}\\\n\nabbreviation getCP0WiredWired where\n \"getCP0WiredWired \\ (\\s. Wired.Wired (Wired (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Wired_CP0WiredWired [alt_def_simp] = \n contract_read[where getParent=getCP0Wired and sub=Wired.Wired]\n\nabbreviation setCP0WiredWired where\n \"setCP0WiredWired v \\ c_state_update (c_CP0_update (Wired_update (Wired.Wired_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0WiredWired [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Wired\n and setParent=setCP0Wired\n and sub_update=Wired.Wired_update]\n contract_update[where getParent=getCP0Wired \n and setParent=setCP0Wired\n and sub=Wired.Wired\n and sub_update=Wired.Wired_update]\n\nsubsection \\@{const wired'rst}\\\n\nabbreviation getCP0WiredWired'rst where\n \"getCP0WiredWired'rst \\ (\\s. wired'rst (Wired (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0Wired_CP0WiredWired'rst [alt_def_simp] = \n contract_read[where getParent=getCP0Wired and sub=wired'rst]\n\nabbreviation setCP0WiredWired'rst where\n \"setCP0WiredWired'rst v \\ c_state_update (c_CP0_update (Wired_update (wired'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0WiredWired'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0Wired\n and setParent=setCP0Wired\n and sub_update=wired'rst_update]\n contract_update[where getParent=getCP0Wired \n and setParent=setCP0Wired\n and sub=wired'rst\n and sub_update=wired'rst_update]\n\nsubsection \\@{const XContext}\\\n\nabbreviation getCP0XContext where\n \"getCP0XContext \\ (\\s. XContext (c_CP0 (c_state s)))\"\n\nlemmas contract_getCP0_CP0XContext [alt_def_simp] = \n contract_read[where getParent=getCP0 and sub=XContext]\n\nabbreviation setCP0XContext where\n \"setCP0XContext v \\ c_state_update (c_CP0_update (XContext_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CP0XContext [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0\n and setParent=setCP0\n and sub_update=XContext_update]\n contract_update[where getParent=getCP0 \n and setParent=setCP0\n and sub=XContext\n and sub_update=XContext_update]\n\nsubsection \\@{const XContext.BadVPN2}\\\n\nabbreviation getCP0XContextBadVPN2 where\n \"getCP0XContextBadVPN2 \\ (\\s. XContext.BadVPN2 (XContext (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0XContext_CP0XContextBadVPN2 [alt_def_simp] = \n contract_read[where getParent=getCP0XContext and sub=XContext.BadVPN2]\n\nabbreviation setCP0XContextBadVPN2 where\n \"setCP0XContextBadVPN2 v \\ c_state_update (c_CP0_update (XContext_update (XContext.BadVPN2_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0XContextBadVPN2 [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0XContext\n and setParent=setCP0XContext\n and sub_update=XContext.BadVPN2_update]\n contract_update[where getParent=getCP0XContext \n and setParent=setCP0XContext\n and sub=XContext.BadVPN2\n and sub_update=XContext.BadVPN2_update]\n\nsubsection \\@{const XContext.PTEBase}\\\n\nabbreviation getCP0XContextPTEBase where\n \"getCP0XContextPTEBase \\ (\\s. XContext.PTEBase (XContext (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0XContext_CP0XContextPTEBase [alt_def_simp] = \n contract_read[where getParent=getCP0XContext and sub=XContext.PTEBase]\n\nabbreviation setCP0XContextPTEBase where\n \"setCP0XContextPTEBase v \\ c_state_update (c_CP0_update (XContext_update (XContext.PTEBase_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0XContextPTEBase [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0XContext\n and setParent=setCP0XContext\n and sub_update=XContext.PTEBase_update]\n contract_update[where getParent=getCP0XContext \n and setParent=setCP0XContext\n and sub=XContext.PTEBase\n and sub_update=XContext.PTEBase_update]\n\nsubsection \\@{const XContext.R}\\\n\nabbreviation getCP0XContextR where\n \"getCP0XContextR \\ (\\s. XContext.R (XContext (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0XContext_CP0XContextR [alt_def_simp] = \n contract_read[where getParent=getCP0XContext and sub=XContext.R]\n\nabbreviation setCP0XContextR where\n \"setCP0XContextR v \\ c_state_update (c_CP0_update (XContext_update (XContext.R_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0XContextR [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0XContext\n and setParent=setCP0XContext\n and sub_update=XContext.R_update]\n contract_update[where getParent=getCP0XContext \n and setParent=setCP0XContext\n and sub=XContext.R\n and sub_update=XContext.R_update]\n\nsubsection \\@{const xcontext'rst}\\\n\nabbreviation getCP0XContextXcontext'rst where\n \"getCP0XContextXcontext'rst \\ (\\s. xcontext'rst (XContext (c_CP0 (c_state s))))\"\n\nlemmas contract_getCP0XContext_CP0XContextXcontext'rst [alt_def_simp] = \n contract_read[where getParent=getCP0XContext and sub=xcontext'rst]\n\nabbreviation setCP0XContextXcontext'rst where\n \"setCP0XContextXcontext'rst v \\ c_state_update (c_CP0_update (XContext_update (xcontext'rst_update (\\_. v))))\"\n\nlemmas contract_c_state_update_CP0XContextXcontext'rst [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCP0XContext\n and setParent=setCP0XContext\n and sub_update=xcontext'rst_update]\n contract_update[where getParent=getCP0XContext \n and setParent=setCP0XContext\n and sub=xcontext'rst\n and sub_update=xcontext'rst_update]\n\nsubsection \\@{const c_CoreStats}\\\n\nabbreviation getCoreStats where\n \"getCoreStats \\ (\\s. c_CoreStats (c_state s))\"\n\nlemma coreStats_alt [alt_def_simp]:\n shows \"coreStats = read_state getCoreStats\"\nunfolding coreStats_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_CoreStats [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_CoreStats]\n\nabbreviation setCoreStats where\n \"setCoreStats v \\ c_state_update (c_CoreStats_update (\\_. v))\"\n\nlemma write'coreStats_alt [alt_def_simp]:\n shows \"write'coreStats = (\\v. update_state (setCoreStats v))\"\nunfolding write'coreStats_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_CoreStats [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_CoreStats_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_CoreStats\n and sub_update=c_CoreStats_update]\n\nsubsection \\@{const branch_not_taken}\\\n\nabbreviation getCoreStatsBranch_not_taken where\n \"getCoreStatsBranch_not_taken \\ (\\s. branch_not_taken (c_CoreStats (c_state s)))\"\n\nlemmas contract_getCoreStats_CoreStatsBranch_not_taken [alt_def_simp] = \n contract_read[where getParent=getCoreStats and sub=branch_not_taken]\n\nabbreviation setCoreStatsBranch_not_taken where\n \"setCoreStatsBranch_not_taken v \\ c_state_update (c_CoreStats_update (branch_not_taken_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CoreStatsBranch_not_taken [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCoreStats\n and setParent=setCoreStats\n and sub_update=branch_not_taken_update]\n contract_update[where getParent=getCoreStats \n and setParent=setCoreStats\n and sub=branch_not_taken\n and sub_update=branch_not_taken_update]\n\nsubsection \\@{const branch_taken}\\\n\nabbreviation getCoreStatsBranch_taken where\n \"getCoreStatsBranch_taken \\ (\\s. branch_taken (c_CoreStats (c_state s)))\"\n\nlemmas contract_getCoreStats_CoreStatsBranch_taken [alt_def_simp] = \n contract_read[where getParent=getCoreStats and sub=branch_taken]\n\nabbreviation setCoreStatsBranch_taken where\n \"setCoreStatsBranch_taken v \\ c_state_update (c_CoreStats_update (branch_taken_update (\\_. v)))\"\n\nlemmas contract_c_state_update_CoreStatsBranch_taken [simplified, alt_def_simp] = \n contract_update_constant[where getParent=getCoreStats\n and setParent=setCoreStats\n and sub_update=branch_taken_update]\n contract_update[where getParent=getCoreStats \n and setParent=setCoreStats\n and sub=branch_taken\n and sub_update=branch_taken_update]\n\nsubsection \\@{const c_LLbit}\\\n\nabbreviation getLLbit where\n \"getLLbit \\ (\\s. c_LLbit (c_state s))\"\n\nlemma LLbit_alt [alt_def_simp]:\n shows \"LLbit = read_state getLLbit\"\nunfolding LLbit_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_LLbit [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_LLbit]\n\nabbreviation setLLbit where\n \"setLLbit v \\ c_state_update (c_LLbit_update (\\_. v))\"\n\nlemma write'LLbit_alt [alt_def_simp]:\n shows \"write'LLbit = (\\v. update_state (setLLbit v))\"\nunfolding write'LLbit_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_LLbit [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_LLbit_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_LLbit\n and sub_update=c_LLbit_update]\n\nsubsection \\@{const c_PC}\\\n\nabbreviation getPC where\n \"getPC \\ (\\s. c_PC (c_state s))\"\n\nlemma PC_alt [alt_def_simp]:\n shows \"PC = read_state getPC\"\nunfolding PC_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_PC [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_PC]\n\nabbreviation setPC where\n \"setPC v \\ c_state_update (c_PC_update (\\_. v))\"\n\nlemma write'PC_alt [alt_def_simp]:\n shows \"write'PC = (\\v. update_state (setPC v))\"\nunfolding write'PC_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_PC [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_PC_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_PC\n and sub_update=c_PC_update]\n\nsubsection \\@{const c_exceptionSignalled}\\\n\nabbreviation getExceptionSignalled where\n \"getExceptionSignalled \\ (\\s. c_exceptionSignalled (c_state s))\"\n\nlemma exceptionSignalled_alt [alt_def_simp]:\n shows \"exceptionSignalled = read_state getExceptionSignalled\"\nunfolding exceptionSignalled_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_ExceptionSignalled [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_exceptionSignalled]\n\nabbreviation setExceptionSignalled where\n \"setExceptionSignalled v \\ c_state_update (c_exceptionSignalled_update (\\_. v))\"\n\nlemma write'exceptionSignalled_alt [alt_def_simp]:\n shows \"write'exceptionSignalled = (\\v. update_state (setExceptionSignalled v))\"\nunfolding write'exceptionSignalled_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_ExceptionSignalled [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_exceptionSignalled_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_exceptionSignalled\n and sub_update=c_exceptionSignalled_update]\n\nsubsection \\@{const c_hi}\\\n\nabbreviation getHi where\n \"getHi \\ (\\s. c_hi (c_state s))\"\n\nlemma hi_alt [alt_def_simp]:\n shows \"hi = read_state getHi\"\nunfolding hi_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_Hi [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_hi]\n\nabbreviation setHi where\n \"setHi v \\ c_state_update (c_hi_update (\\_. v))\"\n\nlemma write'hi_alt [alt_def_simp]:\n shows \"write'hi = (\\v. update_state (setHi v))\"\nunfolding write'hi_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_Hi [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_hi_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_hi\n and sub_update=c_hi_update]\n\nsubsection \\@{const c_lo}\\\n\nabbreviation getLo where\n \"getLo \\ (\\s. c_lo (c_state s))\"\n\nlemma lo_alt [alt_def_simp]:\n shows \"lo = read_state getLo\"\nunfolding lo_def\nunfolding monad_def Let_def\nby simp\n\nlemmas contract_c_state_Lo [alt_def_simp] = \n contract_read[where getParent=c_state and sub=c_lo]\n\nabbreviation setLo where\n \"setLo v \\ c_state_update (c_lo_update (\\_. v))\"\n\nlemma write'lo_alt [alt_def_simp]:\n shows \"write'lo = (\\v. update_state (setLo v))\"\nunfolding write'lo_def\nunfolding monad_def Let_def\nby (intro ext) simp\n\nlemmas contract_c_state_update_Lo [simplified, alt_def_simp] = \n contract_update_constant[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub_update=c_lo_update]\n contract_update[where getParent=c_state \n and setParent=\"\\v. c_state_update (\\_. v)\"\n and sub=c_lo\n and sub_update=c_lo_update]\n\n(* Code generation - end *)\n\nsection \\Rewriting the structure of functions\\\n\nsubsection \\Associativity\\\n\ndeclare bind_associativity [alt_def_simp]\n\nsubsection \\Distributive lemmas\\\n\nlemmas case_return_return [alt_def_simp] =\n all_distrib[where h=\"\\x. return x\", THEN sym]\n\nlemmas pair_cases_distrib [alt_def_simp] = \n all_distrib[where h=\"\\x. (x, _)\", THEN sym]\n all_distrib[where h=\"\\x. (_, x)\", THEN sym]\n\nlemma if_bind_return_return [alt_def_simp]:\n shows \"(if b then bind m (\\_. return x) else return x) = \n bind (if b then m else return ()) (\\_. return x)\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_return_bind_return [alt_def_simp]:\n shows \"(if b then return x else bind m (\\_. return x)) = \n bind (if b then return () else m) (\\_. return x)\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_bind_return_bind_return [alt_def_simp]:\n shows \"(if b then bind m (\\v. return (x v)) else bind n (\\v. return (x v))) = \n bind (if b then m else n) (\\v. return (x v))\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_bind_bind_return_return [alt_def_simp]:\n shows \"(if b then bind m (\\a. bind (n a) (\\_. return x)) else return x) = \n bind (if b then bind m (\\a. n a) else return ()) (\\_. return x)\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_return_bind_bind_return [alt_def_simp]:\n shows \"(if b then return x else bind m (\\a. bind (n a) (\\_. return x))) = \n bind (if b then return () else bind m (\\a. n a)) (\\_. return x)\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_return_return_pair_left [alt_def_simp]:\n shows \"(if b then return (x, y) else return (x, z)) = \n bind (if b then return y else return z) (\\a. return (x, a))\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_return_return_pair_right [alt_def_simp]:\n shows \"(if b then return (x, z) else return (y, z)) = \n bind (if b then return x else return y) (\\a. return (a, z))\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_bind_return_return_pair_left [alt_def_simp]:\n shows \"(if b then bind m (\\a. return (x, y a)) else return (x, z)) = \n bind (if b then bind m (\\a. return (y a)) else return z) (\\a. return (x, a))\"\nunfolding monad_def Let_def\nby simp\n\nlemma if_bind_return_return_pair_right [alt_def_simp]:\n shows \"(if b then bind m (\\a. return (x a, z)) else return (y, z)) = \n bind (if b then bind m (\\a. return (x a)) else return y) (\\a. return (a, z))\"\nunfolding monad_def Let_def\nby simp\n\nlemma prod_bind_left [alt_def_simp]:\n shows \"case x of (y, z) \\ bind (m y z) n = \n bind (case x of (y, z) \\ m y z) n\" \nby (cases x) auto \n\nlemma prod_bind_right [alt_def_simp]:\n shows \"case x of (y, z) \\ bind m (n y z) = \n bind m (\\a. case x of (y, z) \\ n y z a)\" \nby (cases x) auto \n\nlemma let_bind_left [alt_def_simp]:\n shows \"(let x = y in bind (m x) n) =\n bind (let x = y in m x) n\"\nby simp\n\nlemma let_bind_right [alt_def_simp]:\n shows \"(let x = y in bind m (n x)) =\n bind m (\\a. let x = y in n x a)\"\nby simp\n\nsubsection \\Changing the order\\\n\ntext \\The following lemmas are tailored to the generated CHERI definition and not of general\ninterest.\\\n\nlemma swap_CP0_return [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (return x) (k a)) = \n bind (return x) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\ntext \\The following lemma was included by mistake, and turned out crucial for generating the\nalternative definition of @{const Fetch}. Together with \\swap_c_state_CP0\\ it should loop, but for\nsome reason the simplifier does not loop when both these lemmas are used together.\\\n\nlemma swap_CP0_read_state [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (read_state f) (k a)) = \n bind (read_state f) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_PC [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (read_state getPC) (k a)) = \n bind (read_state getPC) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_currentInst [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (read_state currentInst) (k a)) = \n bind (read_state currentInst) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_if_return_read_state_return [alt_def_simp]:\n shows \"bind (read_state getCP0) \n (\\a. bind (if b then return x else bind (read_state f) (\\a. return (g a))) \n (k a)) = \n bind (if b then return x else bind (read_state f) (\\a. return (g a))) \n (\\b. bind (read_state getCP0) \n (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_PCC [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind PCC (k a)) = \n bind PCC (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding PCC_def\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_CAPR [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (CAPR cd) (k a)) = \n bind (CAPR cd) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding CAPR_def\nunfolding monad_def Let_def\nby simp\n\nlemma swap_CP0_next_unknown [alt_def_simp]:\n shows \"bind (read_state getCP0) (\\a. bind (next_unknown v) (k a)) = \n bind (next_unknown v) (\\b. bind (read_state getCP0) (\\a. k a b))\"\nunfolding next_unknown_def\nunfolding monad_def Let_def\nby simp\n\nlemma swap_c_state_return [alt_def_simp]:\n shows \"bind (read_state c_state) (\\a. bind (return x) (k a)) = \n bind (return x) (\\b. bind (read_state c_state) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nlemma swap_c_state_CP0 [alt_def_simp]:\n shows \"bind (read_state c_state) (\\a. bind (read_state getCP0) (k a)) = \n bind (read_state getCP0) (\\b. bind (read_state c_state) (\\a. k a b))\"\nunfolding monad_def Let_def\nby simp\n\nsubsection \\Manual contractions\\\n\nlemmas contract_c_state_update_CP0CauseIP_2 [alt_def_simp] =\n contract_c_state_update_CP0Cause(3-4)\n [where f=\"\\cause. cause\\IP := _ (IP cause)\\\"]\n\nlemmas contract_c_state_update_CP0EntryLo0_2 [alt_def_simp] =\n contract_c_state_update_CP0EntryLo0(3-4)\n [where f=\"\\x. _ (x, _)\"]\n\nlemmas contract_c_state_update_CP0EntryLo1_2 [alt_def_simp] =\n contract_c_state_update_CP0EntryLo1(3-4)\n [where f=\"\\x. _ (x, _)\"]\n\nlemmas contract_c_state_update_CP0EntryHi_2 [alt_def_simp] =\n contract_c_state_update_CP0EntryHi(3-4)\n [where f=\"\\x. _ (x, _)\"]\n\nlemmas contract_c_state_update_CP0Status_2 [alt_def_simp] =\n contract_c_state_update_CP0Status(3-4)\n [where f=\"\\x. _ (x, _)\"]\n\nsubsection \\Removing @{const return}\\\n\ntext \\We later remove the lemma \\bind_left_identity\\ from the proof method, to avoid the proof\nmethod to simplify away \\return (X a)\\ where \\X\\ is a state component. In the following cases it is\nstill fine to simplify away \\return\\. \\\n\nnamed_theorems bind_left_identity_specific\n\nthm bind_left_identity\n\nlemmas bind_left_identity_unit [bind_left_identity_specific] =\n bind_left_identity[where a=\"()\"]\n\nlemmas bind_left_identity_fst [bind_left_identity_specific] =\n bind_left_identity[where a=\"fst _\"]\n\nlemmas bind_left_identity_snd [bind_left_identity_specific] =\n bind_left_identity[where a=\"snd _\"]\n\nlemmas bind_left_identity_pair [bind_left_identity_specific] =\n bind_left_identity[where a=\"(_,_)\"]\n\nlemmas bind_left_identity_not [bind_left_identity_specific] =\n bind_left_identity[where a=\"\\ _\"]\n\nlemmas bind_left_identity_eq [bind_left_identity_specific] =\n bind_left_identity[where a=\"_ = _\"]\n\nlemmas bind_left_identity_plus [bind_left_identity_specific] =\n bind_left_identity[where a=\"_ + _\"]\n\nlemmas bind_left_identity_minus [bind_left_identity_specific] =\n bind_left_identity[where a=\"_ - _\"]\n\nlemmas bind_left_identity_BadInstr [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\BadInstr := _\\\"]\n\nlemmas bind_left_identity_BadInstrP [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\BadInstrP := _\\\"]\n\nlemmas bind_left_identity_BadVAddr [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\BadVAddr := _\\\"]\n\nlemmas bind_left_identity_EPC [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\EPC := _\\\"]\n\nlemmas bind_left_identity_c_CP0 [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\c_CP0 := _\\\"]\n\nlemmas bind_left_identity_Count [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\Count := _\\\"]\n\nlemmas bind_left_identity_Cause [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\Cause := _\\\"]\n\nlemmas bind_left_identity_CauseIP [bind_left_identity_specific] =\n bind_left_identity[where a=\"Cause _\\IP := _\\\"]\n\nlemmas bind_left_identity_Random [bind_left_identity_specific] =\n bind_left_identity[where a=\"_\\CP0.Random := _\\\"]\n\nlemmas bind_left_identity_RandomRandom [bind_left_identity_specific] =\n bind_left_identity[where a=\"CP0.Random _\\Random.Random := _\\\"]\n\nlemmas bind_left_identity_word_bit_field_insert [bind_left_identity_specific] =\n bind_left_identity[where a=\"word_bit_field_insert _ _ _ _\"]\n\nsection \\Alternative definitions\\\n\nmethod compute_alt_def_pass_1 uses simp del =\n -- \\In the first pass we only simplify some occurrences of @{const return}.\\\n (strong_cong_simp \n add: bind_left_identity_specific alt_def_simp simp\n del: bind_left_identity alt_def_simp_del del)\n\nmethod compute_alt_def_pass_2 uses simp del =\n -- \\In the second pass we simplify all occurrences of @{const return}.\\\n (strong_cong_simp \n add: alt_def_simp simp\n del: alt_def_simp_del del)\n\nmethod compute_alt_def uses simp del =\n -- \\Applying \\trans\\ allows us to simplify schematic goals twice.\\\n (rule trans),\n (compute_alt_def_pass_1 simp: simp del: del),\n (compute_alt_def_pass_2 simp: simp del: del)\n\n(* Code generation - start - alternative definitions *)\n\n(* Code generation - prefix - raise'exception *)\n\ntext \\The function @{const raise'exception} can have any type @{typ \"state \\ 'a \\ state\"}. When\n@{const raise'exception} is used in other functions, we do not know which type they use, which makes\nit hard to state assumptions about that use of @{const raise'exception}.\n\nTo circumvent that, we replace @{const raise'exception} with another version that only updates the\nstate, and a @{term \"return undefined\"}. We give this other version the same name, which means that\nin the rest of the development it seems that @{const raise'exception} has always been of type @{typ\n\"state \\ unit \\ state\"}.\\\n\ndefinition raise'exception :: \"exception \\ state \\ unit \\ state\" where\n \"raise'exception \\ \\e. bind (read_state exception) \n (\\v. if v = NoException \n then update_state (exception_update (\\_. e)) \n else return ())\"\n\nlemma raise'exception_simp [alt_def_simp]:\n shows \"CHERI_Monadic_p256.raise'exception = \n (\\ex. bind (raise'exception ex)\n (\\_. return undefined))\"\nunfolding CHERI_Monadic_p256.raise'exception_def\n raise'exception_def\nby (simp add: bind_associativity)\n\n(* Code generation - end prefix *)\n\nschematic_goal raise'exception_alt_def:\n shows \"raise'exception = ?x\"\nunfolding raise'exception_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal println_alt_def [simp]:\n shows \"println = ?x\"\nunfolding println_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal clear_watcher_alt_def [simp]:\n shows \"clear_watcher = ?x\"\nunfolding clear_watcher_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal clear_logs_alt_def [simp]:\n shows \"clear_logs = ?x\"\nunfolding clear_logs_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PIC_update_alt_def:\n shows \"PIC_update = ?x\"\nunfolding PIC_update_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PIC_initialise_alt_def:\n shows \"PIC_initialise = ?x\"\nunfolding PIC_initialise_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PIC_load_alt_def:\n shows \"PIC_load = ?x\"\nunfolding PIC_load_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PIC_store_alt_def:\n shows \"PIC_store = ?x\"\nunfolding PIC_store_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_update_interrupt_bit_alt_def:\n shows \"JTAG_UART_update_interrupt_bit = ?x\"\nunfolding JTAG_UART_update_interrupt_bit_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_load_alt_def:\n shows \"JTAG_UART_load = ?x\"\nunfolding JTAG_UART_load_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_input_alt_def:\n shows \"JTAG_UART_input = ?x\"\nunfolding JTAG_UART_input_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_store_alt_def:\n shows \"JTAG_UART_store = ?x\"\nunfolding JTAG_UART_store_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_output_alt_def:\n shows \"JTAG_UART_output = ?x\"\nunfolding JTAG_UART_output_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal JTAG_UART_initialise_alt_def:\n shows \"JTAG_UART_initialise = ?x\"\nunfolding JTAG_UART_initialise_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal gpr_alt_def:\n shows \"gpr = ?x\"\nunfolding gpr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'gpr_alt_def:\n shows \"write'gpr = ?x\"\nunfolding write'gpr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal GPR_alt_def:\n shows \"GPR = ?x\"\nunfolding GPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'GPR_alt_def:\n shows \"write'GPR = ?x\"\nunfolding write'GPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal UserMode_alt_def:\n shows \"UserMode = ?x\"\nunfolding UserMode_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SupervisorMode_alt_def:\n shows \"SupervisorMode = ?x\"\nunfolding SupervisorMode_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal KernelMode_alt_def:\n shows \"KernelMode = ?x\"\nunfolding KernelMode_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal BigEndianMem_alt_def:\n shows \"BigEndianMem = ?x\"\nunfolding BigEndianMem_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal ReverseEndian_alt_def:\n shows \"ReverseEndian = ?x\"\nunfolding ReverseEndian_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal BigEndianCPU_alt_def:\n shows \"BigEndianCPU = ?x\"\nunfolding BigEndianCPU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal CheckBranch_alt_def:\n shows \"CheckBranch = ?x\"\nunfolding CheckBranch_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal BranchNotTaken_alt_def:\n shows \"BranchNotTaken = ?x\"\nunfolding BranchNotTaken_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal BranchLikelyNotTaken_alt_def:\n shows \"BranchLikelyNotTaken = ?x\"\nunfolding BranchLikelyNotTaken_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dumpRegs_alt_def [simp]:\n shows \"dumpRegs = ?x\"\nunfolding dumpRegs_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal initCoreStats_alt_def:\n shows \"initCoreStats = ?x\"\nunfolding initCoreStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal printCoreStats_alt_def:\n shows \"printCoreStats = ?x\"\nunfolding printCoreStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal next_unknown_alt_def:\n shows \"next_unknown = ?x\"\nunfolding next_unknown_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dumpCRegs_alt_def [simp]:\n shows \"dumpCRegs = ?x\"\nunfolding dumpCRegs_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PCC_alt_def:\n shows \"PCC = ?x\"\nunfolding PCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'PCC_alt_def:\n shows \"write'PCC = ?x\"\nunfolding write'PCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal CAPR_alt_def:\n shows \"CAPR = ?x\"\nunfolding CAPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'CAPR_alt_def:\n shows \"write'CAPR = ?x\"\nunfolding write'CAPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SCAPR_alt_def:\n shows \"SCAPR = ?x\"\nunfolding SCAPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'SCAPR_alt_def:\n shows \"write'SCAPR = ?x\"\nunfolding write'SCAPR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal RCC_alt_def [simp]:\n shows \"RCC = ?x\"\nunfolding RCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'RCC_alt_def [simp]:\n shows \"write'RCC = ?x\"\nunfolding write'RCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal IDC_alt_def [simp]:\n shows \"IDC = ?x\"\nunfolding IDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'IDC_alt_def [simp]:\n shows \"write'IDC = ?x\"\nunfolding write'IDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal DDC_alt_def [simp]:\n shows \"DDC = ?x\"\nunfolding DDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'DDC_alt_def [simp]:\n shows \"write'DDC = ?x\"\nunfolding write'DDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal TLSC_alt_def [simp]:\n shows \"TLSC = ?x\"\nunfolding TLSC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'TLSC_alt_def [simp]:\n shows \"write'TLSC = ?x\"\nunfolding write'TLSC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal PTLSC_alt_def [simp]:\n shows \"PTLSC = ?x\"\nunfolding PTLSC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'PTLSC_alt_def [simp]:\n shows \"write'PTLSC = ?x\"\nunfolding write'PTLSC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal KR1C_alt_def [simp]:\n shows \"KR1C = ?x\"\nunfolding KR1C_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'KR1C_alt_def [simp]:\n shows \"write'KR1C = ?x\"\nunfolding write'KR1C_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal KR2C_alt_def [simp]:\n shows \"KR2C = ?x\"\nunfolding KR2C_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'KR2C_alt_def [simp]:\n shows \"write'KR2C = ?x\"\nunfolding write'KR2C_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal KCC_alt_def [simp]:\n shows \"KCC = ?x\"\nunfolding KCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'KCC_alt_def [simp]:\n shows \"write'KCC = ?x\"\nunfolding write'KCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal KDC_alt_def [simp]:\n shows \"KDC = ?x\"\nunfolding KDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'KDC_alt_def [simp]:\n shows \"write'KDC = ?x\"\nunfolding write'KDC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal EPCC_alt_def [simp]:\n shows \"EPCC = ?x\"\nunfolding EPCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'EPCC_alt_def [simp]:\n shows \"write'EPCC = ?x\"\nunfolding write'EPCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalException_alt_def:\n shows \"SignalException = ?x\"\nunfolding SignalException_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalCP2UnusableException_alt_def:\n shows \"SignalCP2UnusableException = ?x\"\nunfolding SignalCP2UnusableException_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalCapException_internal_alt_def:\n shows \"SignalCapException_internal = ?x\"\nunfolding SignalCapException_internal_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalCapException_alt_def:\n shows \"SignalCapException = ?x\"\nunfolding SignalCapException_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalCapException_noReg_alt_def:\n shows \"SignalCapException_noReg = ?x\"\nunfolding SignalCapException_noReg_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ERET_alt_def:\n shows \"dfn'ERET = ?x\"\nunfolding dfn'ERET_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal TLB_direct_alt_def:\n shows \"TLB_direct = ?x\"\nunfolding TLB_direct_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'TLB_direct_alt_def:\n shows \"write'TLB_direct = ?x\"\nunfolding write'TLB_direct_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal TLB_assoc_alt_def:\n shows \"TLB_assoc = ?x\"\nunfolding TLB_assoc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'TLB_assoc_alt_def:\n shows \"write'TLB_assoc = ?x\"\nunfolding write'TLB_assoc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal LookupTLB_alt_def:\n shows \"LookupTLB = ?x\"\nunfolding LookupTLB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalTLBException_internal_alt_def:\n shows \"SignalTLBException_internal = ?x\"\nunfolding SignalTLBException_internal_def\nunfolding Let_def\nby compute_alt_def\n\n(* Code generation - override - SignalTLBException *)\n\ntext \\Like @{const raise'exception}, @{const SignalTLBException}\n\n can have any type @{typ \"state \\ 'a \\ state\"}. For the same reason as for @{const raise'exception}\n we provide a different definition of @{const SignalTLBException} that always returns @{typ unit}.\\\n\ndefinition SignalTLBException where\n \"SignalTLBException \\ \n \\v. case v of (v1, v2) \\ \n bind (SignalTLBException_internal v2) (\\_. SignalException v1)\"\n\nlemma bind_bind_return:\n shows \"bind (bind m (\\v. return (x v))) n =\n bind m (\\v. n (x v))\" \nunfolding bind_associativity\nby simp\n\nlemma SignalTLBException_simp [alt_def_simp]:\n shows \"CHERI_Monadic_p256.SignalTLBException = \n (\\ex. bind (SignalTLBException ex) \n (\\_. bind (next_unknown ''tlb-translation'')\n (\\v. return (undefined v))))\"\nunfolding Let_def\n SignalTLBException_def\n CHERI_Monadic_p256.SignalTLBException_def\nby (auto simp: bind_associativity)\n\nschematic_goal SignalTLBException_alt_def:\n shows \"SignalTLBException = ?x\"\nunfolding SignalTLBException_def\nunfolding CHERI_Monadic_p256.SignalTLBException_def Let_def\nby compute_alt_def\n\n(* Code generation - end override *)\n\nschematic_goal CheckSegment_alt_def:\n shows \"CheckSegment = ?x\"\nunfolding CheckSegment_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal check_cca_alt_def:\n shows \"check_cca = ?x\"\nunfolding check_cca_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal TLB_next_random_alt_def:\n shows \"TLB_next_random = ?x\"\nunfolding TLB_next_random_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal AddressTranslation_alt_def:\n shows \"AddressTranslation = ?x\"\nunfolding AddressTranslation_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal CP0TLBEntry_alt_def:\n shows \"CP0TLBEntry = ?x\"\nunfolding CP0TLBEntry_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal SignalTLBCapException_alt_def:\n shows \"SignalTLBCapException = ?x\"\nunfolding SignalTLBCapException_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal printMemStats_alt_def:\n shows \"printMemStats = ?x\"\nunfolding printMemStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal initMemStats_alt_def:\n shows \"initMemStats = ?x\"\nunfolding initMemStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_data_reads_updt_alt_def:\n shows \"stats_data_reads_updt = ?x\"\nunfolding stats_data_reads_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_data_writes_updt_alt_def:\n shows \"stats_data_writes_updt = ?x\"\nunfolding stats_data_writes_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_inst_reads_updt_alt_def:\n shows \"stats_inst_reads_updt = ?x\"\nunfolding stats_inst_reads_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_valid_cap_reads_updt_alt_def:\n shows \"stats_valid_cap_reads_updt = ?x\"\nunfolding stats_valid_cap_reads_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_valid_cap_writes_updt_alt_def:\n shows \"stats_valid_cap_writes_updt = ?x\"\nunfolding stats_valid_cap_writes_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_invalid_cap_reads_updt_alt_def:\n shows \"stats_invalid_cap_reads_updt = ?x\"\nunfolding stats_invalid_cap_reads_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal stats_invalid_cap_writes_updt_alt_def:\n shows \"stats_invalid_cap_writes_updt = ?x\"\nunfolding stats_invalid_cap_writes_updt_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal MEM_alt_def:\n shows \"MEM = ?x\"\nunfolding MEM_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'MEM_alt_def:\n shows \"write'MEM = ?x\"\nunfolding write'MEM_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal InitMEM_alt_def:\n shows \"InitMEM = ?x\"\nunfolding InitMEM_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal ReadData_alt_def:\n shows \"ReadData = ?x\"\nunfolding ReadData_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal WriteData_alt_def:\n shows \"WriteData = ?x\"\nunfolding WriteData_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal ReadInst_alt_def:\n shows \"ReadInst = ?x\"\nunfolding ReadInst_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal ReadCap_alt_def:\n shows \"ReadCap = ?x\"\nunfolding ReadCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal WriteCap_alt_def:\n shows \"WriteCap = ?x\"\nunfolding WriteCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal AdjustEndian_alt_def:\n shows \"AdjustEndian = ?x\"\nunfolding AdjustEndian_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal initMemAccessStats_alt_def:\n shows \"initMemAccessStats = ?x\"\nunfolding initMemAccessStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal printMemAccessStats_alt_def:\n shows \"printMemAccessStats = ?x\"\nunfolding printMemAccessStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal watchForLoad_alt_def [simp]:\n shows \"watchForLoad = ?x\"\nunfolding watchForLoad_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal watchForCapLoad_alt_def [simp]:\n shows \"watchForCapLoad = ?x\"\nunfolding watchForCapLoad_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal watchForStore_alt_def [simp]:\n shows \"watchForStore = ?x\"\nunfolding watchForStore_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal watchForCapStore_alt_def [simp]:\n shows \"watchForCapStore = ?x\"\nunfolding watchForCapStore_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal getVirtualAddress_alt_def:\n shows \"getVirtualAddress = ?x\"\nunfolding getVirtualAddress_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal LoadMemoryCap_alt_def:\n shows \"LoadMemoryCap = ?x\"\nunfolding LoadMemoryCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal LoadMemory_alt_def:\n shows \"LoadMemory = ?x\"\nunfolding LoadMemory_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal LoadCap_alt_def:\n shows \"LoadCap = ?x\"\nunfolding LoadCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal StoreMemoryCap_alt_def:\n shows \"StoreMemoryCap = ?x\"\nunfolding StoreMemoryCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal StoreMemory_alt_def:\n shows \"StoreMemory = ?x\"\nunfolding StoreMemory_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal StoreCap_alt_def:\n shows \"StoreCap = ?x\"\nunfolding StoreCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal Fetch_alt_def:\n shows \"Fetch = ?x\"\nunfolding Fetch_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal CP0R_alt_def:\n shows \"CP0R = ?x\"\nunfolding CP0R_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'CP0R_alt_def:\n shows \"write'CP0R = ?x\"\nunfolding write'CP0R_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal resetStats_alt_def:\n shows \"resetStats = ?x\"\nunfolding resetStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dumpStats_alt_def [simp]:\n shows \"dumpStats = ?x\"\nunfolding dumpStats_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal HI_alt_def:\n shows \"HI = ?x\"\nunfolding HI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'HI_alt_def:\n shows \"write'HI = ?x\"\nunfolding write'HI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal LO_alt_def:\n shows \"LO = ?x\"\nunfolding LO_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal write'LO_alt_def:\n shows \"write'LO = ?x\"\nunfolding write'LO_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal mtc_alt_def:\n shows \"mtc = ?x\"\nunfolding mtc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dmtc_alt_def:\n shows \"dmtc = ?x\"\nunfolding dmtc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal mfc_alt_def:\n shows \"mfc = ?x\"\nunfolding mfc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dmfc_alt_def:\n shows \"dmfc = ?x\"\nunfolding dmfc_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ADDI_alt_def:\n shows \"dfn'ADDI = ?x\"\nunfolding dfn'ADDI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ADDIU_alt_def:\n shows \"dfn'ADDIU = ?x\"\nunfolding dfn'ADDIU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DADDI_alt_def:\n shows \"dfn'DADDI = ?x\"\nunfolding dfn'DADDI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DADDIU_alt_def:\n shows \"dfn'DADDIU = ?x\"\nunfolding dfn'DADDIU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLTI_alt_def:\n shows \"dfn'SLTI = ?x\"\nunfolding dfn'SLTI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLTIU_alt_def:\n shows \"dfn'SLTIU = ?x\"\nunfolding dfn'SLTIU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ANDI_alt_def:\n shows \"dfn'ANDI = ?x\"\nunfolding dfn'ANDI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ORI_alt_def:\n shows \"dfn'ORI = ?x\"\nunfolding dfn'ORI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'XORI_alt_def:\n shows \"dfn'XORI = ?x\"\nunfolding dfn'XORI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LUI_alt_def:\n shows \"dfn'LUI = ?x\"\nunfolding dfn'LUI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ADD_alt_def:\n shows \"dfn'ADD = ?x\"\nunfolding dfn'ADD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ADDU_alt_def:\n shows \"dfn'ADDU = ?x\"\nunfolding dfn'ADDU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SUB_alt_def:\n shows \"dfn'SUB = ?x\"\nunfolding dfn'SUB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SUBU_alt_def:\n shows \"dfn'SUBU = ?x\"\nunfolding dfn'SUBU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DADD_alt_def:\n shows \"dfn'DADD = ?x\"\nunfolding dfn'DADD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DADDU_alt_def:\n shows \"dfn'DADDU = ?x\"\nunfolding dfn'DADDU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSUB_alt_def:\n shows \"dfn'DSUB = ?x\"\nunfolding dfn'DSUB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSUBU_alt_def:\n shows \"dfn'DSUBU = ?x\"\nunfolding dfn'DSUBU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLT_alt_def:\n shows \"dfn'SLT = ?x\"\nunfolding dfn'SLT_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLTU_alt_def:\n shows \"dfn'SLTU = ?x\"\nunfolding dfn'SLTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'AND_alt_def:\n shows \"dfn'AND = ?x\"\nunfolding dfn'AND_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'OR_alt_def:\n shows \"dfn'OR = ?x\"\nunfolding dfn'OR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'XOR_alt_def:\n shows \"dfn'XOR = ?x\"\nunfolding dfn'XOR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'NOR_alt_def:\n shows \"dfn'NOR = ?x\"\nunfolding dfn'NOR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MOVN_alt_def:\n shows \"dfn'MOVN = ?x\"\nunfolding dfn'MOVN_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MOVZ_alt_def:\n shows \"dfn'MOVZ = ?x\"\nunfolding dfn'MOVZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MADD_alt_def:\n shows \"dfn'MADD = ?x\"\nunfolding dfn'MADD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MADDU_alt_def:\n shows \"dfn'MADDU = ?x\"\nunfolding dfn'MADDU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MSUB_alt_def:\n shows \"dfn'MSUB = ?x\"\nunfolding dfn'MSUB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MSUBU_alt_def:\n shows \"dfn'MSUBU = ?x\"\nunfolding dfn'MSUBU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MUL_alt_def:\n shows \"dfn'MUL = ?x\"\nunfolding dfn'MUL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MULT_alt_def:\n shows \"dfn'MULT = ?x\"\nunfolding dfn'MULT_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MULTU_alt_def:\n shows \"dfn'MULTU = ?x\"\nunfolding dfn'MULTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DMULT_alt_def:\n shows \"dfn'DMULT = ?x\"\nunfolding dfn'DMULT_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DMULTU_alt_def:\n shows \"dfn'DMULTU = ?x\"\nunfolding dfn'DMULTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DIV_alt_def:\n shows \"dfn'DIV = ?x\"\nunfolding dfn'DIV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DIVU_alt_def:\n shows \"dfn'DIVU = ?x\"\nunfolding dfn'DIVU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DDIV_alt_def:\n shows \"dfn'DDIV = ?x\"\nunfolding dfn'DDIV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DDIVU_alt_def:\n shows \"dfn'DDIVU = ?x\"\nunfolding dfn'DDIVU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MFHI_alt_def:\n shows \"dfn'MFHI = ?x\"\nunfolding dfn'MFHI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MFLO_alt_def:\n shows \"dfn'MFLO = ?x\"\nunfolding dfn'MFLO_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MTHI_alt_def:\n shows \"dfn'MTHI = ?x\"\nunfolding dfn'MTHI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MTLO_alt_def:\n shows \"dfn'MTLO = ?x\"\nunfolding dfn'MTLO_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLL_alt_def:\n shows \"dfn'SLL = ?x\"\nunfolding dfn'SLL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SRL_alt_def:\n shows \"dfn'SRL = ?x\"\nunfolding dfn'SRL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SRA_alt_def:\n shows \"dfn'SRA = ?x\"\nunfolding dfn'SRA_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SLLV_alt_def:\n shows \"dfn'SLLV = ?x\"\nunfolding dfn'SLLV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SRLV_alt_def:\n shows \"dfn'SRLV = ?x\"\nunfolding dfn'SRLV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SRAV_alt_def:\n shows \"dfn'SRAV = ?x\"\nunfolding dfn'SRAV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSLL_alt_def:\n shows \"dfn'DSLL = ?x\"\nunfolding dfn'DSLL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRL_alt_def:\n shows \"dfn'DSRL = ?x\"\nunfolding dfn'DSRL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRA_alt_def:\n shows \"dfn'DSRA = ?x\"\nunfolding dfn'DSRA_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSLLV_alt_def:\n shows \"dfn'DSLLV = ?x\"\nunfolding dfn'DSLLV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRLV_alt_def:\n shows \"dfn'DSRLV = ?x\"\nunfolding dfn'DSRLV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRAV_alt_def:\n shows \"dfn'DSRAV = ?x\"\nunfolding dfn'DSRAV_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSLL32_alt_def:\n shows \"dfn'DSLL32 = ?x\"\nunfolding dfn'DSLL32_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRL32_alt_def:\n shows \"dfn'DSRL32 = ?x\"\nunfolding dfn'DSRL32_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DSRA32_alt_def:\n shows \"dfn'DSRA32 = ?x\"\nunfolding dfn'DSRA32_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TGE_alt_def:\n shows \"dfn'TGE = ?x\"\nunfolding dfn'TGE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TGEU_alt_def:\n shows \"dfn'TGEU = ?x\"\nunfolding dfn'TGEU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLT_alt_def:\n shows \"dfn'TLT = ?x\"\nunfolding dfn'TLT_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLTU_alt_def:\n shows \"dfn'TLTU = ?x\"\nunfolding dfn'TLTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TEQ_alt_def:\n shows \"dfn'TEQ = ?x\"\nunfolding dfn'TEQ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TNE_alt_def:\n shows \"dfn'TNE = ?x\"\nunfolding dfn'TNE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TGEI_alt_def:\n shows \"dfn'TGEI = ?x\"\nunfolding dfn'TGEI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TGEIU_alt_def:\n shows \"dfn'TGEIU = ?x\"\nunfolding dfn'TGEIU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLTI_alt_def:\n shows \"dfn'TLTI = ?x\"\nunfolding dfn'TLTI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLTIU_alt_def:\n shows \"dfn'TLTIU = ?x\"\nunfolding dfn'TLTIU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TEQI_alt_def:\n shows \"dfn'TEQI = ?x\"\nunfolding dfn'TEQI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TNEI_alt_def:\n shows \"dfn'TNEI = ?x\"\nunfolding dfn'TNEI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal loadByte_alt_def:\n shows \"loadByte = ?x\"\nunfolding loadByte_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal loadHalf_alt_def:\n shows \"loadHalf = ?x\"\nunfolding loadHalf_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal loadWord_alt_def:\n shows \"loadWord = ?x\"\nunfolding loadWord_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal loadDoubleword_alt_def:\n shows \"loadDoubleword = ?x\"\nunfolding loadDoubleword_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LB_alt_def:\n shows \"dfn'LB = ?x\"\nunfolding dfn'LB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LBU_alt_def:\n shows \"dfn'LBU = ?x\"\nunfolding dfn'LBU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LH_alt_def:\n shows \"dfn'LH = ?x\"\nunfolding dfn'LH_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LHU_alt_def:\n shows \"dfn'LHU = ?x\"\nunfolding dfn'LHU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LW_alt_def:\n shows \"dfn'LW = ?x\"\nunfolding dfn'LW_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LWU_alt_def:\n shows \"dfn'LWU = ?x\"\nunfolding dfn'LWU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LL_alt_def:\n shows \"dfn'LL = ?x\"\nunfolding dfn'LL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LD_alt_def:\n shows \"dfn'LD = ?x\"\nunfolding dfn'LD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LLD_alt_def:\n shows \"dfn'LLD = ?x\"\nunfolding dfn'LLD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LWL_alt_def:\n shows \"dfn'LWL = ?x\"\nunfolding dfn'LWL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LWR_alt_def:\n shows \"dfn'LWR = ?x\"\nunfolding dfn'LWR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LDL_alt_def:\n shows \"dfn'LDL = ?x\"\nunfolding dfn'LDL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'LDR_alt_def:\n shows \"dfn'LDR = ?x\"\nunfolding dfn'LDR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SB_alt_def:\n shows \"dfn'SB = ?x\"\nunfolding dfn'SB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SH_alt_def:\n shows \"dfn'SH = ?x\"\nunfolding dfn'SH_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal storeWord_alt_def:\n shows \"storeWord = ?x\"\nunfolding storeWord_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal storeDoubleword_alt_def:\n shows \"storeDoubleword = ?x\"\nunfolding storeDoubleword_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SW_alt_def:\n shows \"dfn'SW = ?x\"\nunfolding dfn'SW_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SD_alt_def:\n shows \"dfn'SD = ?x\"\nunfolding dfn'SD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SC_alt_def:\n shows \"dfn'SC = ?x\"\nunfolding dfn'SC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SCD_alt_def:\n shows \"dfn'SCD = ?x\"\nunfolding dfn'SCD_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SWL_alt_def:\n shows \"dfn'SWL = ?x\"\nunfolding dfn'SWL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SWR_alt_def:\n shows \"dfn'SWR = ?x\"\nunfolding dfn'SWR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SDL_alt_def:\n shows \"dfn'SDL = ?x\"\nunfolding dfn'SDL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SDR_alt_def:\n shows \"dfn'SDR = ?x\"\nunfolding dfn'SDR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BREAK_alt_def:\n shows \"dfn'BREAK = ?x\"\nunfolding dfn'BREAK_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'SYSCALL_alt_def:\n shows \"dfn'SYSCALL = ?x\"\nunfolding dfn'SYSCALL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MTC0_alt_def:\n shows \"dfn'MTC0 = ?x\"\nunfolding dfn'MTC0_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DMTC0_alt_def:\n shows \"dfn'DMTC0 = ?x\"\nunfolding dfn'DMTC0_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'MFC0_alt_def:\n shows \"dfn'MFC0 = ?x\"\nunfolding dfn'MFC0_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DMFC0_alt_def:\n shows \"dfn'DMFC0 = ?x\"\nunfolding dfn'DMFC0_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'J_alt_def:\n shows \"dfn'J = ?x\"\nunfolding dfn'J_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'JAL_alt_def:\n shows \"dfn'JAL = ?x\"\nunfolding dfn'JAL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'JALR_alt_def:\n shows \"dfn'JALR = ?x\"\nunfolding dfn'JALR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'JR_alt_def:\n shows \"dfn'JR = ?x\"\nunfolding dfn'JR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BEQ_alt_def:\n shows \"dfn'BEQ = ?x\"\nunfolding dfn'BEQ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BNE_alt_def:\n shows \"dfn'BNE = ?x\"\nunfolding dfn'BNE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLEZ_alt_def:\n shows \"dfn'BLEZ = ?x\"\nunfolding dfn'BLEZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGTZ_alt_def:\n shows \"dfn'BGTZ = ?x\"\nunfolding dfn'BGTZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLTZ_alt_def:\n shows \"dfn'BLTZ = ?x\"\nunfolding dfn'BLTZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGEZ_alt_def:\n shows \"dfn'BGEZ = ?x\"\nunfolding dfn'BGEZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLTZAL_alt_def:\n shows \"dfn'BLTZAL = ?x\"\nunfolding dfn'BLTZAL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGEZAL_alt_def:\n shows \"dfn'BGEZAL = ?x\"\nunfolding dfn'BGEZAL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BEQL_alt_def:\n shows \"dfn'BEQL = ?x\"\nunfolding dfn'BEQL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BNEL_alt_def:\n shows \"dfn'BNEL = ?x\"\nunfolding dfn'BNEL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLEZL_alt_def:\n shows \"dfn'BLEZL = ?x\"\nunfolding dfn'BLEZL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGTZL_alt_def:\n shows \"dfn'BGTZL = ?x\"\nunfolding dfn'BGTZL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLTZL_alt_def:\n shows \"dfn'BLTZL = ?x\"\nunfolding dfn'BLTZL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGEZL_alt_def:\n shows \"dfn'BGEZL = ?x\"\nunfolding dfn'BGEZL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BLTZALL_alt_def:\n shows \"dfn'BLTZALL = ?x\"\nunfolding dfn'BLTZALL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'BGEZALL_alt_def:\n shows \"dfn'BGEZALL = ?x\"\nunfolding dfn'BGEZALL_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'RDHWR_alt_def:\n shows \"dfn'RDHWR = ?x\"\nunfolding dfn'RDHWR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CACHE_alt_def:\n shows \"dfn'CACHE = ?x\"\nunfolding dfn'CACHE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ReservedInstruction_alt_def:\n shows \"dfn'ReservedInstruction = ?x\"\nunfolding dfn'ReservedInstruction_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'Unpredictable_alt_def:\n shows \"dfn'Unpredictable = ?x\"\nunfolding dfn'Unpredictable_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLBP_alt_def:\n shows \"dfn'TLBP = ?x\"\nunfolding dfn'TLBP_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLBR_alt_def:\n shows \"dfn'TLBR = ?x\"\nunfolding dfn'TLBR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLBWI_alt_def:\n shows \"dfn'TLBWI = ?x\"\nunfolding dfn'TLBWI_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'TLBWR_alt_def:\n shows \"dfn'TLBWR = ?x\"\nunfolding dfn'TLBWR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'COP1_alt_def:\n shows \"dfn'COP1 = ?x\"\nunfolding dfn'COP1_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal watchOOB_alt_def [simp]:\n shows \"watchOOB = ?x\"\nunfolding watchOOB_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'DumpCapReg_alt_def [simp]:\n shows \"dfn'DumpCapReg = ?x\"\nunfolding dfn'DumpCapReg_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetBase_alt_def:\n shows \"dfn'CGetBase = ?x\"\nunfolding dfn'CGetBase_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetOffset_alt_def:\n shows \"dfn'CGetOffset = ?x\"\nunfolding dfn'CGetOffset_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetLen_alt_def:\n shows \"dfn'CGetLen = ?x\"\nunfolding dfn'CGetLen_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetTag_alt_def:\n shows \"dfn'CGetTag = ?x\"\nunfolding dfn'CGetTag_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetSealed_alt_def:\n shows \"dfn'CGetSealed = ?x\"\nunfolding dfn'CGetSealed_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetPerm_alt_def:\n shows \"dfn'CGetPerm = ?x\"\nunfolding dfn'CGetPerm_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetType_alt_def:\n shows \"dfn'CGetType = ?x\"\nunfolding dfn'CGetType_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetAddr_alt_def:\n shows \"dfn'CGetAddr = ?x\"\nunfolding dfn'CGetAddr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetPCC_alt_def:\n shows \"dfn'CGetPCC = ?x\"\nunfolding dfn'CGetPCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetPCCSetOffset_alt_def:\n shows \"dfn'CGetPCCSetOffset = ?x\"\nunfolding dfn'CGetPCCSetOffset_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CGetCause_alt_def:\n shows \"dfn'CGetCause = ?x\"\nunfolding dfn'CGetCause_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSetCause_alt_def:\n shows \"dfn'CSetCause = ?x\"\nunfolding dfn'CSetCause_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CIncOffset_alt_def:\n shows \"dfn'CIncOffset = ?x\"\nunfolding dfn'CIncOffset_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CIncOffsetImmediate_alt_def:\n shows \"dfn'CIncOffsetImmediate = ?x\"\nunfolding dfn'CIncOffsetImmediate_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSetBounds_alt_def:\n shows \"dfn'CSetBounds = ?x\"\nunfolding dfn'CSetBounds_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSetBoundsExact_alt_def:\n shows \"dfn'CSetBoundsExact = ?x\"\nunfolding dfn'CSetBoundsExact_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSetBoundsImmediate_alt_def:\n shows \"dfn'CSetBoundsImmediate = ?x\"\nunfolding dfn'CSetBoundsImmediate_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal ClearRegs_alt_def:\n shows \"ClearRegs = ?x\"\nunfolding ClearRegs_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ClearLo_alt_def:\n shows \"dfn'ClearLo = ?x\"\nunfolding dfn'ClearLo_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'ClearHi_alt_def:\n shows \"dfn'ClearHi = ?x\"\nunfolding dfn'ClearHi_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CClearLo_alt_def:\n shows \"dfn'CClearLo = ?x\"\nunfolding dfn'CClearLo_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CClearHi_alt_def:\n shows \"dfn'CClearHi = ?x\"\nunfolding dfn'CClearHi_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CClearTag_alt_def:\n shows \"dfn'CClearTag = ?x\"\nunfolding dfn'CClearTag_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CAndPerm_alt_def:\n shows \"dfn'CAndPerm = ?x\"\nunfolding dfn'CAndPerm_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSetOffset_alt_def:\n shows \"dfn'CSetOffset = ?x\"\nunfolding dfn'CSetOffset_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSub_alt_def:\n shows \"dfn'CSub = ?x\"\nunfolding dfn'CSub_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CCheckPerm_alt_def:\n shows \"dfn'CCheckPerm = ?x\"\nunfolding dfn'CCheckPerm_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CCheckType_alt_def:\n shows \"dfn'CCheckType = ?x\"\nunfolding dfn'CCheckType_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CFromPtr_alt_def:\n shows \"dfn'CFromPtr = ?x\"\nunfolding dfn'CFromPtr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CToPtr_alt_def:\n shows \"dfn'CToPtr = ?x\"\nunfolding dfn'CToPtr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal CPtrCmp_alt_def:\n shows \"CPtrCmp = ?x\"\nunfolding CPtrCmp_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CEQ_alt_def:\n shows \"dfn'CEQ = ?x\"\nunfolding dfn'CEQ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CNE_alt_def:\n shows \"dfn'CNE = ?x\"\nunfolding dfn'CNE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLT_alt_def:\n shows \"dfn'CLT = ?x\"\nunfolding dfn'CLT_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLE_alt_def:\n shows \"dfn'CLE = ?x\"\nunfolding dfn'CLE_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLTU_alt_def:\n shows \"dfn'CLTU = ?x\"\nunfolding dfn'CLTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLEU_alt_def:\n shows \"dfn'CLEU = ?x\"\nunfolding dfn'CLEU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CEXEQ_alt_def:\n shows \"dfn'CEXEQ = ?x\"\nunfolding dfn'CEXEQ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CNEXEQ_alt_def:\n shows \"dfn'CNEXEQ = ?x\"\nunfolding dfn'CNEXEQ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CBTU_alt_def:\n shows \"dfn'CBTU = ?x\"\nunfolding dfn'CBTU_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CBTS_alt_def:\n shows \"dfn'CBTS = ?x\"\nunfolding dfn'CBTS_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CBEZ_alt_def:\n shows \"dfn'CBEZ = ?x\"\nunfolding dfn'CBEZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CBNZ_alt_def:\n shows \"dfn'CBNZ = ?x\"\nunfolding dfn'CBNZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSC_alt_def:\n shows \"dfn'CSC = ?x\"\nunfolding dfn'CSC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLC_alt_def:\n shows \"dfn'CLC = ?x\"\nunfolding dfn'CLC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLoad_alt_def:\n shows \"dfn'CLoad = ?x\"\nunfolding dfn'CLoad_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal store_alt_def:\n shows \"store = ?x\"\nunfolding store_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CStore_alt_def:\n shows \"dfn'CStore = ?x\"\nunfolding dfn'CStore_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLLC_alt_def:\n shows \"dfn'CLLC = ?x\"\nunfolding dfn'CLLC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CLLx_alt_def:\n shows \"dfn'CLLx = ?x\"\nunfolding dfn'CLLx_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSCC_alt_def:\n shows \"dfn'CSCC = ?x\"\nunfolding dfn'CSCC_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSCx_alt_def:\n shows \"dfn'CSCx = ?x\"\nunfolding dfn'CSCx_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CMOVN_alt_def:\n shows \"dfn'CMOVN = ?x\"\nunfolding dfn'CMOVN_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CMOVZ_alt_def:\n shows \"dfn'CMOVZ = ?x\"\nunfolding dfn'CMOVZ_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CMove_alt_def:\n shows \"dfn'CMove = ?x\"\nunfolding dfn'CMove_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CTestSubset_alt_def:\n shows \"dfn'CTestSubset = ?x\"\nunfolding dfn'CTestSubset_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CBuildCap_alt_def:\n shows \"dfn'CBuildCap = ?x\"\nunfolding dfn'CBuildCap_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CCopyType_alt_def:\n shows \"dfn'CCopyType = ?x\"\nunfolding dfn'CCopyType_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CJR_alt_def:\n shows \"dfn'CJR = ?x\"\nunfolding dfn'CJR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CJALR_alt_def:\n shows \"dfn'CJALR = ?x\"\nunfolding dfn'CJALR_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CSeal_alt_def:\n shows \"dfn'CSeal = ?x\"\nunfolding dfn'CSeal_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CUnseal_alt_def:\n shows \"dfn'CUnseal = ?x\"\nunfolding dfn'CUnseal_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CCall_alt_def:\n shows \"dfn'CCall = ?x\"\nunfolding dfn'CCall_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CCallFast_alt_def:\n shows \"dfn'CCallFast = ?x\"\nunfolding dfn'CCallFast_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal special_register_accessible_alt_def:\n shows \"special_register_accessible = ?x\"\nunfolding special_register_accessible_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CReadHwr_alt_def:\n shows \"dfn'CReadHwr = ?x\"\nunfolding dfn'CReadHwr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CWriteHwr_alt_def:\n shows \"dfn'CWriteHwr = ?x\"\nunfolding dfn'CWriteHwr_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'CReturn_alt_def:\n shows \"dfn'CReturn = ?x\"\nunfolding dfn'CReturn_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal dfn'UnknownCapInstruction_alt_def:\n shows \"dfn'UnknownCapInstruction = ?x\"\nunfolding dfn'UnknownCapInstruction_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal log_instruction_alt_def:\n shows \"log_instruction = ?x\"\nunfolding log_instruction_def\nunfolding Let_def\nby compute_alt_def\n\nschematic_goal Run_alt_def:\n shows \"Run = ?x\"\nunfolding Run_def\nunfolding Let_def\nby compute_alt_def\n\n(* Code generation - override - Next *)\n\nschematic_goal Next_alt_def_aux:\n shows \"Next = ?x\"\nunfolding Next_def\nunfolding Let_def\nby compute_alt_def\n\ndefinition TakeBranch :: \"state \\ unit \\ state\" where\n \"TakeBranch \\\n bind (read_state getBranchDelay)\n (\\v. bind (read_state getBranchTo)\n (\\a. bind (read_state BranchDelayPCC)\n (\\aa. bind (read_state BranchToPCC)\n (\\aaa. (case v of None \\ \n (case a of None \\ \n (case aa of None \\ \n (case aaa of None \\ \n bind (read_state getExceptionSignalled)\n (\\v. if \\ v \n then bind (read_state getPC)\n (\\v. update_state (setPC (v + 4)))\n else return ())\n | Some a \\ \n bind (update_state (BranchDelayPCC_update (\\_. Some a)))\n (\\_. bind (update_state (BranchToPCC_update Map.empty))\n (\\_. bind (read_state getPC) \n (\\v. update_state (setPC (v + 4))))))\n | Some (addr, cap) \\ \n (case aaa of None \\\n bind (update_state (BranchDelayPCC_update Map.empty)) \n (\\_. bind (update_state (setPC addr)) \n (\\_. write'PCC cap))\n | Some aa \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch'')))\n | Some addr \\ \n (case aa of None \\ \n (case aaa of None \\ \n bind (update_state (setBranchDelay (Some addr)))\n (\\_. bind (update_state (setBranchTo None)) \n (\\_. bind (read_state getPC) \n (\\v. update_state (setPC (v + 4)))))\n | Some a \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch''))\n | Some ab \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch'')))\n | Some addr \\ \n (case a of None \\ \n (case aa of None \\ \n (case aaa of None \\ \n bind (update_state (setBranchDelay None)) \n (\\_. update_state (setPC addr))\n | Some a \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch''))\n | Some ab \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch''))\n | Some ab \\ \n raise'exception (UNPREDICTABLE ''Branch follows branch'')))))))\" \n\nlemma Next_alt_def:\n shows \"Next =\n bind (update_state (currentInst_update Map.empty))\n (\\_. bind Fetch \n (\\v. bind (update_state (currentInst_update (\\_. v)))\n (\\_. bind (read_state currentInst)\n (\\v. bind (case v of None \\ return () | Some w \\ Run (Decode w))\n (\\_. bind TakeBranch\n (\\_. bind (update_state (setExceptionSignalled False))\n (\\_. bind (read_state getCP0Count) \n (\\b. bind (update_state (setCP0Count (b + 1)))\n (\\_. bind (read_state currentInst) \n (\\v. update_state (lastInst_update (\\_. v))))))))))))\"\nunfolding Next_alt_def_aux TakeBranch_def\nby (simp add: bind_associativity)\n\n(* Code generation - end override *)\n\n(* Code generation - end *)\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/core/CheriAltDefs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.29803816461509924}} {"text": "section \\State monad transformer\\\n\ntheory State_Transformer\nimports Monad_Zero_Plus\nbegin\n\ntext \\\n This version has non-lifted product, and a non-lifted function space.\n\\\n\ntycondef 'a\\('f::\"functor\", 's) stateT =\n StateT (runStateT :: \"'s \\ ('a \\ 's)\\'f\")\n\nlemma coerce_stateT_abs [simp]: \"coerce\\(stateT_abs\\x) = stateT_abs\\(coerce\\x)\"\napply (simp add: stateT_abs_def coerce_def)\napply (simp add: emb_prj_emb prj_emb_prj DEFL_eq_stateT)\ndone\n\nlemma coerce_StateT [simp]: \"coerce\\(StateT\\k) = StateT\\(coerce\\k)\"\nunfolding StateT_def by simp\n\nlemma stateT_cases [case_names StateT]:\n obtains k where \"y = StateT\\k\"\nproof\n show \"y = StateT\\(runStateT\\y)\"\n by (cases y, simp_all)\nqed\n\nlemma stateT_induct [case_names StateT]:\n fixes P :: \"'a\\('f::functor,'s) stateT \\ bool\"\n assumes \"\\k. P (StateT\\k)\"\n shows \"P y\"\nby (cases y rule: stateT_cases, simp add: assms)\n\nlemma stateT_eqI:\n \"(\\s. runStateT\\a\\s = runStateT\\b\\s) \\ a = b\"\napply (cases a rule: stateT_cases)\napply (cases b rule: stateT_cases)\napply (simp add: cfun_eq_iff)\ndone\n\nlemma runStateT_coerce [simp]:\n \"runStateT\\(coerce\\k)\\s = coerce\\(runStateT\\k\\s)\"\nby (induct k rule: stateT_induct, simp)\n\nsubsection \\Functor class instance\\\n\nlemma fmapU_StateT [simp]:\n \"fmapU\\f\\(StateT\\k) =\n StateT\\(\\ s. fmap\\(\\(x, s'). (f\\x, s'))\\(k\\s))\"\nunfolding fmapU_stateT_def stateT_map_def StateT_def\nby (subst fix_eq, simp add: cfun_map_def csplit_def prod_map_def)\n\nlemma runStateT_fmapU [simp]:\n \"runStateT\\(fmapU\\f\\m)\\s =\n fmap\\(\\(x, s'). (f\\x, s'))\\(runStateT\\m\\s)\"\nby (cases m rule: stateT_cases, simp)\n\ninstantiation stateT :: (\"functor\", \"domain\") \"functor\"\nbegin\n\ninstance\napply standard\napply (induct_tac xs rule: stateT_induct)\napply (simp_all add: fmap_fmap ID_def csplit_def)\ndone\n\nend\n\nsubsection \\Monad class instance\\\n\ninstantiation stateT :: (monad, \"domain\") monad\nbegin\n\ndefinition returnU_stateT_def:\n \"returnU = (\\ x. StateT\\(\\ s. return\\(x, s)))\"\n\ndefinition bindU_stateT_def:\n \"bindU = (\\ m k. StateT\\(\\ s. runStateT\\m\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s')))\"\n\nlemma bindU_stateT_StateT [simp]:\n \"bindU\\(StateT\\f)\\k =\n StateT\\(\\ s. f\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s'))\"\nunfolding bindU_stateT_def by simp\n\nlemma runStateT_bindU [simp]:\n \"runStateT\\(bindU\\m\\k)\\s = runStateT\\m\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s')\"\nunfolding bindU_stateT_def by simp\n\ninstance proof\n fix f :: \"udom \\ udom\" and r :: \"udom\\('a,'b) stateT\"\n show \"fmapU\\f\\r = bindU\\r\\(\\ x. returnU\\(f\\x))\"\n by (rule stateT_eqI)\n (simp add: returnU_stateT_def monad_fmap prod_map_def csplit_def)\nnext\n fix f :: \"udom \\ udom\\('a,'b) stateT\" and x :: \"udom\"\n show \"bindU\\(returnU\\x)\\f = f\\x\"\n by (rule stateT_eqI)\n (simp add: returnU_stateT_def eta_cfun)\nnext\n fix r :: \"udom\\('a,'b) stateT\" and f g :: \"udom \\ udom\\('a,'b) stateT\"\n show \"bindU\\(bindU\\r\\f)\\g = bindU\\r\\(\\ x. bindU\\(f\\x)\\g)\"\n by (rule stateT_eqI)\n (simp add: bind_bind csplit_def)\nqed\n\nend\n\nsubsection \\Monad zero instance\\\n\ninstantiation stateT :: (monad_zero, \"domain\") monad_zero\nbegin\n\ndefinition zeroU_stateT_def:\n \"zeroU = StateT\\(\\ s. mzero)\"\n\nlemma runStateT_zeroU [simp]:\n \"runStateT\\zeroU\\s = mzero\"\nunfolding zeroU_stateT_def by simp\n\ninstance proof\n fix k :: \"udom \\ udom\\('a,'b) stateT\"\n show \"bindU\\zeroU\\k = zeroU\"\n by (rule stateT_eqI, simp add: bind_mzero)\nqed\n\nend\n\nsubsection \\Monad plus instance\\\n\ninstantiation stateT :: (monad_plus, \"domain\") monad_plus\nbegin\n\ndefinition plusU_stateT_def:\n \"plusU = (\\ a b. StateT\\(\\ s. mplus\\(runStateT\\a\\s)\\(runStateT\\b\\s)))\"\n\nlemma runStateT_plusU [simp]:\n \"runStateT\\(plusU\\a\\b)\\s =\n mplus\\(runStateT\\a\\s)\\(runStateT\\b\\s)\"\nunfolding plusU_stateT_def by simp\n\ninstance proof\n fix a b :: \"udom\\('a, 'b) stateT\" and k :: \"udom \\ udom\\('a, 'b) stateT\"\n show \"bindU\\(plusU\\a\\b)\\k = plusU\\(bindU\\a\\k)\\(bindU\\b\\k)\"\n by (rule stateT_eqI, simp add: bind_mplus)\nnext\n fix a b c :: \"udom\\('a, 'b) stateT\"\n show \"plusU\\(plusU\\a\\b)\\c = plusU\\a\\(plusU\\b\\c)\"\n by (rule stateT_eqI, simp add: mplus_assoc)\nqed\n\nend\n\nsubsection \\Monad zero plus instance\\\n\ninstance stateT :: (monad_zero_plus, \"domain\") monad_zero_plus\nproof\n fix m :: \"udom\\('a, 'b) stateT\"\n show \"plusU\\zeroU\\m = m\"\n by (rule stateT_eqI, simp add: mplus_mzero_left)\nnext\n fix m :: \"udom\\('a, 'b) stateT\"\n show \"plusU\\m\\zeroU = m\"\n by (rule stateT_eqI, simp add: mplus_mzero_right)\nqed\n\nsubsection \\Transfer properties to polymorphic versions\\\n\nlemma coerce_csplit [coerce_simp]:\n shows \"coerce\\(csplit\\f\\p) = csplit\\(\\ x y. coerce\\(f\\x\\y))\\p\"\nunfolding csplit_def by simp\n\nlemma csplit_coerce [coerce_simp]:\n fixes p :: \"'a \\ 'b\"\n shows \"csplit\\f\\(COERCE('a \\ 'b, 'c \\ 'd)\\p) =\n csplit\\(\\ x y. f\\(COERCE('a, 'c)\\x)\\(COERCE('b, 'd)\\y))\\p\"\nunfolding coerce_prod csplit_def prod_map_def by simp\n\nlemma fmap_stateT_simps [simp]:\n \"fmap\\f\\(StateT\\m :: 'a\\('f::functor,'s) stateT) =\n StateT\\(\\ s. fmap\\(\\ (x, s'). (f\\x, s'))\\(m\\s))\"\nunfolding fmap_def [where 'f=\"('f, 's) stateT\"]\nby (simp add: coerce_simp eta_cfun)\n\nlemma runStateT_fmap [simp]:\n \"runStateT\\(fmap\\f\\m)\\s = fmap\\(\\ (x, s'). (f\\x, s'))\\(runStateT\\m\\s)\"\nby (induct m rule: stateT_induct, simp)\n\nlemma return_stateT_def:\n \"(return :: _ \\ 'a\\('m::monad, 's) stateT) =\n (\\ x. StateT\\(\\ s. return\\(x, s)))\"\nunfolding return_def [where 'm=\"('m, 's) stateT\"] returnU_stateT_def\nby (simp add: coerce_simp)\n\nlemma bind_stateT_def:\n \"bind = (\\ m k. StateT\\(\\ s. runStateT\\m\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s')))\"\napply (subst bind_def, subst bindU_stateT_def)\napply (simp add: coerce_simp)\napply (simp add: coerce_idem domain_defl_simps monofun_cfun)\napply (simp add: eta_cfun)\ndone\n\ntext \"TODO: add \\coerce_idem\\ to \\coerce_simps\\, along\\010with monotonicity rules for DEFL.\"\n\nlemma bind_stateT_simps [simp]:\n \"bind\\(StateT\\m :: 'a\\('m::monad,'s) stateT)\\k =\n StateT\\(\\ s. m\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s'))\"\nunfolding bind_stateT_def by simp\n\nlemma runStateT_bind [simp]:\n \"runStateT\\(m \\ k)\\s = runStateT\\m\\s \\ (\\ (x, s'). runStateT\\(k\\x)\\s')\"\nunfolding bind_stateT_def by simp\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Tycon/State_Transformer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.29803816461509924}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx_lemma_inv__2_on_rules imports n_mutualEx_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n shows \"invHoldForRule Interp s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n }\n\n ultimately show \"invHoldForRule Interp s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2980059114002438}} {"text": "theory Deadlock_Checking\n imports Deadlock_Impl Uppaal_Networks.UPPAAL_Model_Checking\nbegin\n\nparagraph \\Standard Deadlock Checker Implementation\\\ncontext Reachability_Problem_Impl\nbegin\n\ndefinition deadlock_checker where\n \"deadlock_checker \\\n let\n key = return \\ fst;\n sub = subsumes_impl;\n copy = state_copy_impl;\n start = a\\<^sub>0_impl;\n final = (\\_. return False);\n succs = succs_impl;\n empty = emptiness_check_impl;\n P = check_deadlock_neg_impl;\n trace = tracei\n in do {\n r1 \\ is_start_in_states_impl;\n if r1 then do {\n r2 \\ check_passed_impl succs start final sub empty key copy trace P;\n return r2\n }\n else return True\n }\n \"\n\ninterpretation ta_bisim: Bisimulation_Invariant\n \"(\\(l, u) (l', u'). conv_A A \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). conv_A A \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). l' = l \\ (\\ c. c \\ clk_set (conv_A A) \\ u c = u' c))\"\n \"(\\_. True)\" \"(\\_. True)\"\n by (rule ta_bisimulation[of \"conv_A A\"])\n\nlemma deadlock_zero_clock_val_iff:\n \"(\\u\\<^sub>0. (\\c\\{1..n}. u\\<^sub>0 c = 0) \\ deadlock (l\\<^sub>0, u\\<^sub>0)) \\ deadlock (l\\<^sub>0, \\_. 0)\"\n apply safe\n subgoal for u\n using clocks_I[of \"\\_. 0\" u] by (subst ta_bisim.deadlock_iff; simp)\n by auto\n\ncontext\n assumes F_fun_False: \"\\x. F_fun x = False\" and F_False: \"F = (\\_. False)\"\nbegin\nlemma F_impl_is_False:\n \"F_impl = (\\_. return False)\"\n unfolding F_impl_def F_fun_False by simp\n\nlemma deadlock_checker_correct:\n \"(uncurry0 deadlock_checker, uncurry0 (Refine_Basic.RETURN (deadlock (l\\<^sub>0, \\_. 0))))\n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\n unfolding\n deadlock_checker_def Let_def F_impl_is_False[symmetric]\n check_passed_impl_start_def[symmetric] deadlock_zero_clock_val_iff[symmetric]\n using check_passed_impl_start_hnr[OF F_False] .\n\nlemmas deadlock_checker_hoare = deadlock_checker_correct[to_hnr, unfolded hn_refine_def, simplified]\n\nend\n\nend\n\n\ncontext UPPAAL_Reachability_Problem_precompiled'\nbegin\n\ntext \\\n \\<^item> @{term equiv.defs.states'}\n \\<^item> @{term EA} is @{term equiv.state_ta},\n the state automaton constructed from UPPAAL network (\\equiv\\/\\N\\)\n \\<^item> @{term A} is @{term equiv.defs.prod_ta},\n the product automaton constructed from UPPAAL network (\\equiv\\/\\N\\)\n\\\n\ncontext\n fixes \\\n assumes formula_is_false: \"formula = formula.EX (and \\ (not \\))\"\nbegin\n\nlemma F_is_FalseI:\n shows \"PR_CONST (\\(x, y). F x y) = (\\_. False)\"\n unfolding F_def by (subst formula_is_false) auto\n\nlemma final_fun_is_False:\n \"final_fun a = False\"\n unfolding final_fun_def by (subst formula_is_false) auto\n\nlemmas deadlock_checker_hoare = impl.deadlock_checker_hoare[\n OF final_fun_is_False F_is_FalseI, folded deadlock_start_iff has_deadlock_def]\n\nend\n\nschematic_goal deadlock_checker_alt_def:\n \"impl.deadlock_checker \\ ?impl\"\n unfolding impl.deadlock_checker_def impl.succs_impl_def\n unfolding impl.E_op''_impl_def impl.abstr_repair_impl_def impl.abstra_repair_impl_def\n unfolding\n impl.start_inv_check_impl_def impl.unbounded_dbm_impl_def\n impl.unbounded_dbm'_def unbounded_dbm_def\n unfolding k_impl_alt_def\n unfolding impl.check_deadlock_neg_impl_def impl.check_deadlock_impl_def\n unfolding impl.is_start_in_states_impl_def\n apply (abstract_let k_i ceiling)\n apply (abstract_let \"inv_fun :: (_ \\ int list \\ _)\" inv)\n apply (abstract_let \"trans_fun\" trans)\n unfolding impl.init_dbm_impl_def impl.a\\<^sub>0_impl_def\n unfolding impl.F_impl_def\n unfolding impl.subsumes_impl_def\n unfolding impl.emptiness_check_impl_def\n unfolding impl.state_copy_impl_def\n by (rule Pure.reflexive)\n\nschematic_goal deadlock_checker_alt_def_refined:\n \"impl.deadlock_checker \\ ?impl\"\n unfolding deadlock_checker_alt_def\n unfolding fw_impl'_int\n unfolding inv_fun_def trans_fun_def trans_s_fun_def trans_i_fun_def\n unfolding trans_i_from_impl\n unfolding runf_impl runt_impl check_g_impl pairs_by_action_impl check_pred_impl\n apply (abstract_let \"IArray (map IArray inv)\" inv_array)\n apply (abstract_let \"IArray (map IArray trans_out_map)\" trans_out)\n apply (abstract_let \"IArray (map IArray trans_in_map)\" trans_in)\n apply (abstract_let \"IArray (map IArray trans_i_map)\" trans_internal)\n apply (abstract_let \"IArray bounds\" bounds_array)\n apply (abstract_let PF PF)\n apply (abstract_let PT PT)\n unfolding PF_alt_def PT_alt_def\n apply (abstract_let PROG' PROG')\n unfolding PROG'_def\n apply (abstract_let \"length prog\" len_prog)\n apply (abstract_let \"IArray (map (map_option stripf) prog)\" prog_f)\n apply (abstract_let \"IArray (map (map_option stript) prog)\" prog_t)\n apply (abstract_let \"IArray prog\" prog_array)\n unfolding all_actions_by_state_impl\n apply (abstract_let \"[0..0 num_actions\n \\\n if UPPAAL_Reachability_Problem_precompiled'\n num_processes num_clocks max_steps I T prog bounds program s\\<^sub>0 num_actions clock_ceiling\n then\n deadlock_checker\n num_processes num_clocks max_steps I T prog bounds program s\\<^sub>0 num_actions clock_ceiling\n \\ (\\x. return (Some x))\n else return None\"\n\ntheorem deadlock_check:\n \"\n precond_dc p m k max_steps I T prog bounds P s\\<^sub>0 na\n <\\ Some r \\ \\(\n UPPAAL_Reachability_Problem_precompiled' p m max_steps I T prog bounds P s\\<^sub>0 na k \\\n r = has_deadlock (conv (N p I P T prog bounds)) max_steps (repeat 0 p, s\\<^sub>0, \\_ . 0))\n | None \\ \\(\\ UPPAAL_Reachability_Problem_precompiled' p m max_steps I T prog bounds P s\\<^sub>0 na k)\n >\\<^sub>t\"\nproof -\n define A where \"A \\ conv (N p I P T prog bounds)\"\n note [sep_heap_rules] = UPPAAL_Reachability_Problem_precompiled'.deadlock_checker_hoare[\n OF _ HOL.refl,\n of p m max_steps I T prog bounds P s\\<^sub>0 na k,\n unfolded UPPAAL_Reachability_Problem_precompiled_defs.init_def,\n folded A_def\n ]\n show ?thesis\n unfolding A_def[symmetric] precond_dc_def\n by (sep_auto simp:\n deadlock_checker.refine[symmetric] UPPAAL_Reachability_Problem_precompiled_defs.init_def \n mod_star_conv has_deadlock_def)\nqed\n\nexport_code precond_dc checking SML\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Deadlock/Deadlock_Checking.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.29800591140024374}} {"text": "theory VCG_Check\n \nimports Logic\n \n\nbegin \n\n\n(* theorems for the checking the correctness of vcg *)\n\n\nlemma write_consistent_defined_address:\n \"\\ \\ \\s. aval lval s = Some vp \\ aval rval s = Some v \\ Addr vp \\ incon_set s \\\n ptable_lift_m (heap s) (root s) (mode s) (Addr vp) = Some pp \\ lval ::= rval \\\\s. heap s pp = Some v \\\"\n by vcgm\n \n(* successful memory writes to inconsistent address after flushing, in Kernel Mode *) \n\n\n\n\n\n\n\nlemma [simp]:\n \"aval e s = Some v \\ aval e (s\\incon_set := {}\\) = Some v \"\n by (induct e arbitrary: v; clarsimp split: option.splits; fastforce)\n\n\nlemma [simp]:\n \"aval e s = Some v \\ aval e (s\\incon_set := {}, ptable_snapshot := \\a. ({}, \\v. Fault) \\) = Some v \"\n by (induct e arbitrary: v; clarsimp split: option.splits; fastforce)\n\n\n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Logic/VCG_Check.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419704455589, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.2979381071064309}} {"text": "theory Diff_Arr_Safe\n imports Diff_Arr\nbegin\n\ncontext\nbegin\n\nqualified definition lookup where\n \"lookup arr i = do {\n len \\ Diff_Arr.length arr;\n if i < len\n then Diff_Arr.lookup arr i\n else return (undefined(i - len))\n }\"\n\nqualified definition update where\n \"update arr i v = do {\n len \\ Diff_Arr.length arr;\n if i < len\n then Diff_Arr.update arr i v \n else return arr\n }\"\n\nqualified definition update_tailrec where\n \"update_tailrec arr i v = do {\n len \\ Diff_Arr.length arr;\n if i < len\n then Diff_Arr.update_tailrec arr i v \n else return arr\n }\"\n\nlemma nth_undefined: \"i \\ length xs \\ xs ! i = undefined(i - length xs)\"\n unfolding List.nth_def\n by(induction xs arbitrary: i)(auto split: nat.split)\n\nlemma lookup_safe [sep_heap_rules]: \"\n (t \\ xs \\ a)> \n lookup a i \n <\\r. master_assn t * \\(r = xs!i)>\"\n unfolding lookup_def\n apply sep_auto\n using length \n apply sep_auto\n apply sep_auto\n using lookup\n by(sep_auto simp: nth_undefined[of xs i])+\n\nlemma update_safe [sep_heap_rules]: \"\n (t \\ xs \\ diff_arr)> \n update diff_arr i v\n <\\diff_arr. \\\\<^sub>At'. master_assn t' * \n \\((\\xs' diff_arr'. t \\ xs' \\ diff_arr' \\ t' \\ xs' \\ diff_arr') \n \\ (t' \\ xs[i := v] \\ diff_arr))>\"\n unfolding update_def\n apply sep_auto\n apply(rule fi_rule[OF length, where F = emp])\n apply sep_auto+\n apply(rule cons_post_rule)\n apply(rule fi_rule[OF update, where F = emp])\n by sep_auto+\n\nlemma update_tailrec_safe [sep_heap_rules]: \"\n (t \\ xs \\ diff_arr)> \n update_tailrec diff_arr i v\n <\\diff_arr. \\\\<^sub>At'. master_assn t' * \n \\((\\xs' diff_arr'. t \\ xs' \\ diff_arr' \\ t' \\ xs' \\ diff_arr') \n \\ (t' \\ xs[i := v] \\ diff_arr))>\"\n unfolding update_tailrec_def\n apply sep_auto\n apply(rule fi_rule[OF length, where F = emp])\n apply sep_auto+\n apply(rule cons_post_rule)\n apply(rule fi_rule[OF update_tailrec, where F = emp])\n by sep_auto+\n\nend\n\nend\n", "meta": {"author": "balazstothofficial", "repo": "arrays-in-isabelle", "sha": "9d5dd28b0b3d245dae534d546879045a54b4244f", "save_path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle", "path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle/arrays-in-isabelle-9d5dd28b0b3d245dae534d546879045a54b4244f/Diff_Arr_Safe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29793630045720265}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory PackedTypes\nimports CProof\nbegin\n\nsection \\Underlying definitions for the class axioms\\\n\ntext \\field_access / field_update is the identity for packed types\\\n\ndefinition fa_fu_idem :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext \\field_access is independent of the underlying bytes\\\n\ndefinition fa_heap_indep :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection \\Lemmas about td_fafu_idem\\\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: if_split_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover\n have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover\n have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have updeq:\n \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n by (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n using mlt nlex xln lbs lbs' wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply (cases p')\n apply (simp split: if_split_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using \\field_lookup_list (p' # ts') f 0 = Some (s, n)\\ by (simp split: option.splits)\nqed (clarsimp split: if_split_asm)+\n\nsubsection \\td_fa_hi\\\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"(@)\"])\n apply (erule Cons_typ_desc.hyps; simp)\n apply (erule Cons_typ_desc.hyps; simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection \\Simp rules for deriving packed props from the type combinators\\\n\nsubsection \\td_fafu_idem\\\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fafu_idem_list_append)\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\\n field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply (rule iffI)\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self; simp)\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\\n fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\ td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\\n td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def)\n (simp add: td_fafu_idem_ti_typ_combine)\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp: typ_info_array array_tag_def fa_fu_idem_def td_fafu_idem_array_n)\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection \\td_fa_hi\\\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append)\n\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm\n have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def Let_def using tda tds\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append td_fa_hi_adjust_ti[OF fg wf_fd])\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def td_fa_hi_ti_typ_combine)\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def td_fa_hi_array_n)\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection \\The type class and simp sets\\\n\ntext \\Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity\\\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n \\ \\Axioms\\\n td_fafu_idem\n \\ \\Combinators\\\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n \\ \\Constructors\\\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n \\ \\Axioms\\\n td_fa_hi\n \\ \\Combinators\\\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n \\ \\Constructors\\\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection \\Instances\\\n\ntext \\Words (of multiple of 8 size) are packed\\\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n by (intro_classes; rule td_fafu_idem_word td_fa_hi_word)\nend\n\ntext \\Pointers are always packed\\\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n by (intro_classes; simp add: fa_fu_idem_def word_rsplit_rcat_size word_size fa_heap_indep_def)\nend\n\ntext \\Arrays of packed types are in turn packed\\\n\nclass array_outer_packed = packed_type + array_outer_max_size\nclass array_inner_packed = array_outer_packed + array_inner_max_size\n\ninstance word :: (len8)array_outer_packed ..\ninstance word :: (len8)array_inner_packed ..\n\ninstance array :: (array_outer_packed, array_max_count) packed_type\n by (intro_classes; simp add: td_fafu_idem_intro_simps td_fa_hi_intro_simps)\n\ninstance array :: (array_inner_packed, array_max_count) array_outer_packed ..\n\nsection \\Theorems about packed types\\\n\nsubsection \\td_fa_hi\\\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows \"heap_update p v (heap_update p u h) = heap_update p v h\"\n unfolding heap_update_def\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: heap_update_mem_same_point)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence, simp)\n prefer 2\n apply(rule refl)\n apply(simp)\n apply(simp add: heap_update_nmem_same)\n done\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp) =\n hrs_mem_update (heap_update p v) hp\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection \\td_fafu_idem\\\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right; assumption?)\n apply (rule of_nat_mono_maybe_le; simp)\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def\n by (rule heap_independence; simp add: lbs size_of_def)\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n show ?case\n proof (cases n')\n case 0 thus ?thesis using \\Suc m' < n'\\ by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using \\Suc m' < n'\\ by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(addr_bitsize)\"\n by (metis len_of_addr_card max_size)\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: addr_bitsize word) = n\" using szn szb\n by (metis le_unat_uoi nat_less_le unat_of_nat_len)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n by (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n by (metis c_guard_no_wrap ptr_val.ptr_val_def std)\n\n have szt': \"size_td t < 2 ^ len_of TYPE(addr_bitsize)\"\n by (metis len_of_addr_card max_size std)\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n from xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n by (rule intvl_le_lower)\n next\n from szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: addr_bitsize word)\"\n by (metis One_nat_def of_nat_mono_maybe_le b0 less_imp_diff_less nat_le_Suc_less)\n with al show \"ptr_val p \\ ptr_val p + of_nat n\"\n by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n by (metis uofn word_le_nat_alt)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n by (metis (no_types) add.assoc intvl_less_upper)\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n by (metis add_diff_cancel_left' intvl_le_lower word_diff_ls(4))\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: addr_bitsize word) = n + size_td t - 1\"\n using t0 order_le_less_trans [OF szt1 szb]\n by (metis Nat.add_diff_assoc One_nat_def Suc_leI of_nat_add unat_of_nat_len)\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n by (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n by simp\n\n show \"td_fafu_idem t\"\n by (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n by (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n by (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n by (metis ofn unat_sub uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n by simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n (update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n have \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n proof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n by (subst add.commute, rule intvl_less_upper)\n show \"ptr_val p \\ x\" using xin al szb\n by (rule intvl_le_lower)\n qed\n thus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n by (metis (no_types) One_nat_def Suc_leI le_m1_iff_lt of_nat_1 of_nat_diff of_nat_mono_maybe\n semiring_1_class.of_nat_0 size_of_def unat_less_helper)\n\n show \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n using intvl_cut by auto\n\n show \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n (* clag *)\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n by (subst heap_list_nth, rule unx) simp\n\n thus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n unfolding h_val_def\n by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nsubsection \\Proof automation for packed types\\\n\ndefinition td_packed :: \"'a field_desc typ_desc \\ nat \\ nat \\ bool\"\n where \"td_packed t sz al \\\n td_fafu_idem t \\ td_fa_hi t \\ aggregate t \\ size_td t = sz \\ align_td t = al\"\n\nlemma packed_type_class_intro:\n \"td_packed (typ_info_t TYPE('a::mem_type)) s a\n \\ OFCLASS('a::mem_type, packed_type_class)\"\n by standard (simp_all add: td_packed_def)\n\nlemma td_packed_final_pad:\n \"\\td_packed t s a; 2 ^ a dvd s\\ \\ td_packed (final_pad t) s a\"\n by (simp add: padup_dvd [symmetric] td_packed_def final_pad_def)\n\nlemma td_packed_ti_typ_combine:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_combine TYPE('b) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)))\n (max a (align_td (typ_info_t TYPE('b))))\"\n unfolding td_packed_def\n apply safe\n apply (rule td_fafu_idem_ti_typ_combine; assumption?)\n apply (rule td_fafu_idem)\n apply (rule td_fa_hi_ti_typ_combine; assumption?)\n apply (rule td_fa_hi)\n apply simp\n apply (simp only: size_td_lt_ti_typ_combine)\n apply (simp only: align_of_ti_typ_combine)\n done\n\nlemma td_packed_ti_typ_pad_combine:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_pad_combine TYPE('b) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)))\n (max a (align_td (typ_info_t TYPE('b))))\"\n apply (subgoal_tac \"padup (align_of TYPE('b)) (size_td td) = 0\")\n apply (simp add: ti_typ_pad_combine_def Let_def td_packed_ti_typ_combine)\n apply (simp add: align_of_def padup_dvd td_packed_def)\n done\n\nlemma td_packed_ti_typ_combine_array:\n \"\\td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu\\\n \\ td_packed\n (ti_typ_combine TYPE('b ['n :: finite]) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)) * CARD('n))\n (max a (align_td (typ_info_t TYPE('b))))\"\n by (clarsimp simp: ti_typ_combine_def td_packed_def\n packed_type_intro_simps td_fafu_idem_extend_ti\n td_fa_hi_extend_ti td_fa_hi_adjust_ti\n size_td_extend_ti size_of_def\n td_fafu_idem_adjust_ti)\n\nlemma td_packed_ti_typ_pad_combine_array:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_pad_combine TYPE('b ['n :: finite]) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)) * CARD('n))\n (max a (align_td (typ_info_t TYPE('b))))\"\n apply (subgoal_tac \"padup (align_of TYPE('b['n])) (size_td td) = 0\")\n apply (simp add: ti_typ_pad_combine_def Let_def)\n apply (simp add: td_packed_ti_typ_combine_array)\n apply (simp add: align_of_def padup_dvd td_packed_def align_td_array)\n done\n\nlemma td_packed_empty_typ_info:\n \"td_packed (empty_typ_info fn) 0 0\"\n apply (unfold td_packed_def, safe)\n apply (rule td_fafu_idem_empty_typ_info)\n apply (rule td_fa_hi_empty_typ_info)\n apply (rule aggregate_empty_typ_info)\n apply (rule size_td_empty_typ_info)\n apply (rule align_of_empty_typ_info)\n done\n\nlemmas td_packed_intros =\n td_packed_final_pad\n td_packed_empty_typ_info\n td_packed_ti_typ_combine\n td_packed_ti_typ_pad_combine\n td_packed_ti_typ_combine_array\n td_packed_ti_typ_pad_combine_array\n\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2978326219727093}} {"text": "theory WTLemma\n imports GenSubEnv WellTypedExp PermEnvMisc AltNormEnv \nbegin\n \n (* \n ####################################\n P2. general well-typed lemmas\n ####################################\n *)\n\nlemma well_typed_perm_leq: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_use_env r_s2 r_s1\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n done\n\nlemma well_typed_perm_leqx: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_use_env rx r_s2\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* if case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n done\n\nlemma well_typed_spec_perm_leq: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_perm (r_s2 x) (r_s1 x)\"\n apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" in well_typed_perm_leq)\n apply (auto)\n apply (simp add: leq_use_env_def)\n done \n \n (* \n ####################################\n P3. well-typed free var lemmas\n ####################################\n *)\n \nlemma well_typed_fv_env_use: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e \\ \\ env (Var x) \\ None\"\n (*apply (simp add: env_gen_use_def)*)\n apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"\\ y. add_env env (Var x1a) t1 (Var x) = Some y\")\n apply (simp add: add_env_def)\n apply (auto)\n done\n \nlemma well_typed_rv_env_use: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ ref_vars e \\ \\ env (Loc x) \\ None\"\n (*apply (simp add: env_gen_use_def)*)\n apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"\\ y. add_env env (Var x1a) t1 (Loc x) = Some y\")\n apply (simp add: add_env_def)\n apply (auto)\n done \n\nlemma well_typed_no_npv_use: \"\\ well_typed env r_s1 e tau r_s2 rx; r_s1 x = NoPerm \\ \\ x \\ non_prim_vars env e\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const + op case *)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n (* var case. *)\n apply (cut_tac r_x=\"ereq_use_env (owner_name xa) tau_x\" and r_s=\"r_s1\" in leq_use_none)\n apply (auto)\n apply (case_tac \"x \\ owner_name xa\")\n apply (simp add: non_prim_vars_def)\n apply (case_tac xa)\n apply (auto)\n apply (cut_tac x=\"x\" and tau=\"tau_x\" in ereq_use_none)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n (* pair case 1 *)\n apply (case_tac \"x \\ res_vars (PairExp e1 e2)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* pair case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* if case 1 *)\n apply (case_tac \"x \\ res_vars (IfExp e1 e2 e3)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e1\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* if case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e2\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* if case 3 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e3\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* lambda case *)\n apply (case_tac \"x \\ Var x1a\")\n apply (auto)\n apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (auto)\n apply (cut_tac r_s=\"rxa\" and y=\"Var x1a\" and r=\"r\" and x=\"x\" in add_use_none_rev)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars (add_env env (Var x1a) t1) e\")\n apply (simp add: non_prim_vars_def)\n apply (case_tac \"\\ non_prim_entry (add_env env (Var x1a) t1) x\")\n apply (simp add: non_prim_entry_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* app case 1 *)\n apply (case_tac \"x \\ res_vars (AppExp e1 e2)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e1\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* app case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e2\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n done\n \nlemma well_typed_aff_fv_own: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ res_vars e; env x = Some t; req_type t = Aff \\ \\ r_s1 x = OwnPerm\" \n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"ereq_use_env x t x \\ OwnPerm\")\n apply (simp add: ereq_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (simp add: one_use_env_def)\n apply (cut_tac r_x=\"ereq_use_env x t\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (auto)\n (* pair case 2 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* if case 2 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* if case 3 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* lambda case *)\n apply (rule_tac r_x=\"rxa\" in leq_use_own)\n apply (auto)\n apply (case_tac \"\\ add_use_env rxa (Var x1a) r x = OwnPerm\")\n apply (auto)\n apply (case_tac \"\\ add_env env (Var x1a) t1 x = Some t\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n (* app case *)\n apply (rule_tac r_x = \"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n done\n\n \n (* \n ####################################\n P4. well-typed manipulation for type environments\n ####################################\n *)\n\nlemma well_typed_add_vars: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e \\ \\ well_typed (add_env env (Var x) t) r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: add_env_def)\n apply (case_tac xa)\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac xa)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto) \n (* lambda case 1 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (case_tac \"x = x1a\")\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Var x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n apply (auto)\n (* lambda case 2 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n\nlemma well_typed_rem_vars: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e \\ \\ well_typed (rem_env env (Var x)) r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: rem_env_def)\n apply (case_tac xa)\n apply (auto)\n apply (simp add: rem_env_def)\n apply (case_tac xa)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lambda case 1 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (case_tac \"x = x1a\")\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t1\" in partial_add_rem_env)\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"Var x1a\" and t=\"t1\" in almost_comm_add_rem_env)\n apply (auto)\n (* lambda case 2 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t1\" in partial_add_rem_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n \nlemma well_typed_add_vars2: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ ref_vars e \\ \\ well_typed (add_env env (Loc x) t) r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: add_env_def)\n apply (case_tac xa)\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac xa)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto) \n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Loc x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n\nlemma well_typed_add_vars_rev: \"\\ well_typed (add_env env (Var x) t) r_s1 e tau r_s2 rx; x \\ free_vars e \\ \\ well_typed env r_s1 e tau r_s2 rx\"\n apply (cut_tac env=\"add_env env (Var x) t\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_vars)\n apply (auto)\n apply (case_tac \"env (Var x) = None\")\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" in cancel_rem_add_env)\n apply (auto)\n apply (rule_tac t=\"well_typed env r_s1 e tau r_s2 rx\" and s=\"well_typed (add_env (rem_env env (Var x)) (Var x) y) r_s1 e tau r_s2 rx\" in subst)\n apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"y\" in cancel_add_rem_env)\n apply (auto)\n apply (rule_tac well_typed_add_vars)\n apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"t\" in partial_rem_add_env)\n apply (auto)\n done\n\nlemma well_typed_contain_env: \"\\ contain_env env env'; well_typed env' r_s1 e tau r_s2 rx \\ \\ well_typed env r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env env' r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"res_name x\" in allE)\n apply (auto)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"owner_name x\" in allE)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac r_s=\"env\" and r_x=\"env'\" and x=\"Var x1a\" and t=\"t1\" in dist_add_contain_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done\n \n (* \n ####################################\n P5. well-typed manipulation for start permissions\n ####################################\n *) \n \nlemma well_typed_comp_start_perm: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (comp_use_env r_s1 r_ex) e tau r_s2 rx\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const, op, var case 1 *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* var case 2 *)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done\n \nlemma well_typed_comp_start_perm2: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (comp_use_env r_ex r_s1) e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_start_perm)\n apply (auto)\n done \n \nlemma well_typed_incr_start_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_s1 r_c \\ \\ well_typed env r_c e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_c\" and r_x=\"r_s1\" in cancel_comp_use_env2)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and r_ex=\"r_c\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" in well_typed_comp_start_perm2)\n apply (auto)\n done\n \n (* \n ####################################\n P6. well-typed manipulation for sweeping changes\n ####################################\n *) \n \n (* - diff perm lemmas *)\n \nlemma wtdp_start_perm_req: \"\\ y \\ own_env_vars r_x; leq_use_env (req_use_env y tau) r_s1 \\\n \\ leq_use_env (req_use_env y tau) (diff_use_env r_s1 r_x)\" \n apply (rule_tac r_s=\"r_s1\" in req_leq_use_env)\n apply (simp)\n apply (cut_tac r_s=\"r_s1\" and x=\"y\" and r_x=\"r_x\" in diff_use_eq)\n apply (auto)\n apply (simp add: own_env_vars_def)\n done\n\nlemma weak_diff_req_use_env: \"weak_use_env (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n apply (simp add: diff_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (auto)\n apply (case_tac \"req_use_env x tau xa\")\n apply (auto)\n done\n \nlemma wtdp_disj_req_use_env2: \"\\ r_x x \\ OwnPerm \\ \\ disj_use_env r_x (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n apply (cut_tac x=\"x\" and tau=\"tau\" in weak_diff_req_use_env)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"req_use_env x tau\" in leq_use_none)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac req_use_none_alt)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (simp add: weak_use_env_def)\n done\n \nlemma wtdp_end_req: \"\\ non_prim_vars env e \\ own_env_vars r_x = {}; x \\ res_vars e; env x = Some tau;\n r_x x = OwnPerm \\ \\ end_req_perm tau = NoPerm\" \n apply (case_tac \"x \\ non_prim_vars env e\")\n apply (simp add: own_env_vars_def)\n apply (auto)\n apply (case_tac \"req_type tau \\ Prim\")\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (simp add: end_req_perm_def)\n done\n \nlemma well_typed_diff_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; non_prim_vars env e \\ own_env_vars r_x = {} \\ \\\n well_typed env (diff_use_env r_s1 r_x) e tau (diff_use_env r_s2 r_x) (diff_use_env rx r_x)\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx r_x)\n apply (auto)\n (* const case *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* op case *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* var case p1. manipulation to show that x1a exists in r_s2 *)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp)\n apply (simp add: ereq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name x\" in wtdp_end_req)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n (* var case p2 *)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_pull_comp_use_env)\n apply (cut_tac r_ex=\"r_ex\" and r_x=\"r_x\" in sum_comp_diff_use_env)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - use disjointess of r_x from (req x tau) to remove - r_x *)\n apply (rule_tac disj_diff_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env1)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name x\" in wtdp_end_req)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env2)\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: one_use_env_def)\n (* - through a slightly more involved process we can also remove it from the left *)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env (ereq_use_env (owner_name x) tau_x) (ereq_use_env (owner_name x) tau_x)) r_ex\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac lhs_ddl_use_env)\n apply (rule_tac comm_disj_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env1)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name x\" in wtdp_end_req)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env2)\n apply (auto)\n apply (simp add: one_use_env_def)\n (* pair case *)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (*apply (rule_tac aff_diff_use_env)\n apply (simp)*)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n apply (rule_tac t=\"diff_use_env (diff_use_env r_s3 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s3 r_ex) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env) \n apply (simp add: pair_req_def)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (simp add: dist_diff_comp_use_env)\n apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_x)\n (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"diff_use_env rx' r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e3 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (simp add: dist_diff_comp_use_env)\n (* lambda case *)\n apply (rule_tac x=\"diff_use_env rxa r_x\" in exI)\n apply (auto)\n apply (rule_tac x=\"diff_use_env r_end (rem_use_env r_x (Var x1a))\" in exI)\n apply (rule_tac x=\"diff_use_env r_s' (rem_use_env r_x (Var x1a))\" in exI)\n apply (cut_tac r_s=\"rxa\" and x=\"Var x1a\" and r=\"r\" and r_x=\"r_x\" in diff_add_rem_use_env)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars (add_env env (Var x1a) t1) e \\ own_env_vars (rem_use_env r_x (Var x1a)) = {}\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (simp add: own_env_vars_def)\n apply (case_tac \"x = Var x1a\")\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac aff_diff_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n (* - proving bounds *)\n apply (rule_tac t=\"diff_use_env (diff_use_env r_s1 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s1 r_ex) r_x\" in subst)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"diff_use_env (diff_use_env rxa r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env rxa r_ex) r_x\" in subst)\n apply (cut_tac r_s=\"rxa\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* - reusable substitutions *)\n apply (case_tac \"\\ lift_use_env (diff_use_env rx2 r_x) r = diff_use_env (lift_use_env rx2 r) r_x\")\n apply (cut_tac r_s=\"rx2\" and r=\"r\" and r_x=\"r_x\" in lift_diff_use_env)\n apply (simp)\n (* - last instantiation *)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n (* - prove the bound for r_s2 *)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove lift safety *)\n (* - prove rx1 + rx2 is subtractable *)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n (* - prove disjointedness *)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove r_ex bound *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove the bound for rx *)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env rx2 r_x)\" and s=\"diff_use_env (comp_use_env rx1 rx2) r_x\" in subst)\n apply (simp add: dist_diff_comp_use_env) \n apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env (lift_use_env rx2 r) r_x)\" and\n s=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in subst)\n apply (simp add: dist_diff_comp_use_env)\n apply (rule_tac t=\"comp_use_env (diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x) (diff_use_env r_ex r_x)\" and\n s=\"diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n apply (simp add: dist_diff_comp_use_env)\n apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) r_x) (diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x)\" and\n s=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n done \n \nlemma well_typed_disj_diff_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; mini_disj_use_env r_ex r_s1 \\ \\\n well_typed env (diff_use_env r_s1 r_ex) e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\" \n apply (rule_tac well_typed_diff_perms)\n apply (simp)\n apply (auto)\n apply (case_tac \"r_s1 x = NoPerm\")\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"x\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: own_env_vars_def)\n apply (simp add: mini_disj_use_env_def)\n done \n\nlemma well_typed_rem_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e \\ \\\n well_typed env (rem_use_env r_s1 x) e tau (rem_use_env r_s2 x) (rem_use_env rx x)\" \n apply (cut_tac r_s=\"r_s1\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (simp add: one_use_env_def)\n apply (simp add: own_env_vars_def)\n apply (case_tac \"x = xa\")\n apply (auto)\n done\n\nlemma well_typed_add_perms_rev: \"\\ well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r') (add_use_env rx x r3);\n r_s1 x = NoPerm; r_s2 x = NoPerm; rx x = NoPerm; x \\ non_prim_vars env e \\ \\ well_typed env r_s1 e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r'\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r3\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"add_use_env r_s1 x r\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"add_use_env r_s2 x r'\" and rx=\"add_use_env rx x r3\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n done\n\nlemma wtapr_ex: \"\\leq_use_env rxa (add_use_env r_s1 x r);\n leq_use_env r_s2 (diff_use_env (add_use_env r_s1 x r) r_ex); leq_use_env rx r_s2; leq_use_env r_ex (add_use_env r_s1 x r);\n leq_use_env (diff_use_env rxa r_ex) rx\\\n \\ \\r_ex. leq_use_env (rem_use_env r_s2 x) (diff_use_env r_s1 r_ex) \\\n leq_use_env (rem_use_env rx x) (rem_use_env r_s2 x) \\\n leq_use_env r_ex r_s1 \\ leq_use_env (diff_use_env (rem_use_env rxa x) r_ex) (rem_use_env rx x)\" \n apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n apply (auto)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (rule_tac r_sb=\"add_use_env (diff_use_env r_s1 r_ex) x r\" in trans_leq_use_env)\n apply (rule_tac dist_add_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 x r) r_ex\" in trans_leq_use_env)\n apply (rule_tac add_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"diff_use_env (rem_use_env rxa x) (rem_use_env r_ex x)\" and s=\"rem_use_env (diff_use_env rxa r_ex) x\" in subst)\n apply (rule_tac dist_diff_rem_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp) \n done\n\nlemma wtapr_helper: \"\\\\env r_s1 tau r_s2 rx.\n \\well_typed env (add_use_env r_s1 (Var x1a) r) e tau r_s2 rx; Var x1a \\ res_vars e\\\n \\ well_typed env r_s1 e tau (rem_use_env r_s2 (Var x1a)) (rem_use_env rx (Var x1a));\n well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) ra) e t2 r_s' r_end; aff_use_env rxa a;\n leq_use_env rxa (add_use_env r_s1 (Var x1a) r); leq_use_env r_s2 (diff_use_env (add_use_env r_s1 (Var x1a) r) r_ex); leq_use_env rx r_s2;\n leq_use_env r_ex (add_use_env r_s1 (Var x1a) r); leq_use_env (diff_use_env rxa r_ex) rx; x = Var x1a\\\n \\ \\rxa. (\\r_end r_s'. well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) ra) e t2 r_s' r_end) \\\n aff_use_env rxa a \\\n leq_use_env rxa r_s1 \\\n (\\r_ex. leq_use_env (rem_use_env r_s2 (Var x1a)) (diff_use_env r_s1 r_ex) \\\n leq_use_env (rem_use_env rx (Var x1a)) (rem_use_env r_s2 (Var x1a)) \\\n leq_use_env r_ex r_s1 \\ leq_use_env (diff_use_env rxa r_ex) (rem_use_env rx (Var x1a)))\"\n apply (rule_tac x=\"rem_use_env rxa x\" in exI)\n apply (auto)\n apply (rule_tac t=\"add_use_env (rem_use_env rxa (Var x1a)) (Var x1a) ra\" and s=\"add_use_env rxa (Var x1a) ra\" in subst)\n apply (rule_tac partial_add_rem_use_env)\n apply (auto)\n apply (rule_tac aff_rem_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (simp)\n apply (rule_tac wtapr_ex)\n apply (auto)\n done\n \nlemma well_typed_add_perms_rev2: \"\\ well_typed env (add_use_env r_s1 x r) e tau r_s2 rx; x \\ res_vars e \\ \\\n well_typed env r_s1 e tau (rem_use_env r_s2 x) (rem_use_env rx x)\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const + op cases *)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (auto)\n apply (rule_tac dist_rem_leq_use_env)\n apply (auto)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (auto)\n apply (rule_tac dist_rem_leq_use_env)\n apply (auto)\n (* var cases *)\n apply (rule_tac r_sb=\"rem_use_env (ereq_use_env (owner_name xa) tau_x) x\" in trans_leq_use_env)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_rem_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (case_tac xa)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n apply (auto)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (rule_tac r_sb=\"add_use_env (diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name xa) tau_x) r_ex)) x r\" in trans_leq_use_env)\n apply (rule_tac dist_add_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 x r) (comp_use_env (ereq_use_env (owner_name xa) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac add_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"rem_use_env (diff_use_env (ereq_use_env (owner_name xa) tau_x) (comp_use_env (ereq_use_env (owner_name xa) tau_x) r_ex)) x\" in trans_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (simp add: dist_diff_rem_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac rhs_rem_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (case_tac xa)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (simp add: dist_rem_comp_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n (* pair case *)\n apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n apply (rule_tac x=\"rem_use_env r_s3 x\" in exI)\n apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n apply (auto)\n apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n apply (auto)\n apply (rule_tac well_typed_rem_perms)\n apply (simp_all)\n apply (simp add: non_prim_vars_def)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)(*\n apply (rule_tac safe_lift_rem_use_env)\n apply (simp)\n apply (rule_tac safe_lift_rem_use_env)\n apply (simp)*)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac r_s=\"lift_use_env rx1 ra\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 ra\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n apply (auto)\n apply (rule_tac t=\"diff_use_env (rem_use_env r_s3 x) (rem_use_env r_ex x)\" and s=\"rem_use_env (diff_use_env r_s3 r_ex) x\" in subst)\n apply (rule_tac dist_diff_rem_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (auto)\n apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac r_sb=\"rem_use_env (diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex) x\" in trans_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (simp add: dist_diff_rem_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp add: dist_rem_comp_use_env)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac id_leq_use_env)\n (* if case *)\n apply (rule_tac x=\"rem_use_env rx' x\" in exI)\n apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n apply (auto)\n apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n apply (auto)\n apply (rule_tac well_typed_rem_perms)\n apply (simp)\n apply (simp add: non_prim_vars_def)\n apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n apply (auto)\n apply (rule_tac well_typed_rem_perms)\n apply (simp)\n apply (simp add: non_prim_vars_def)\n apply (simp add: dist_rem_comp_use_env)\n (* lam case 1. x \\ x1a *)\n apply (case_tac \"x \\ Var x1a\")\n apply (auto)\n apply (rule_tac x=\"rem_use_env rxa x\" in exI)\n apply (auto)\n apply (rule_tac t=\"add_use_env (rem_use_env rxa x) (Var x1a) ra\" and s=\"rem_use_env (add_use_env rxa (Var x1a) ra) x\" in subst)\n apply (rule_tac almost_comm_rem_add_use_env)\n apply (auto)\n apply (rule_tac x=\"rem_use_env r_end x\" in exI)\n apply (rule_tac x=\"rem_use_env r_s' x\" in exI)\n apply (rule_tac well_typed_rem_perms)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (rule_tac aff_rem_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (simp) \n apply (rule_tac wtapr_ex)\n apply (auto)\n (* lam case 1b / 2. x = x1a *)\n apply (rule_tac wtapr_helper)\n apply (auto)\n apply (rule_tac wtapr_helper)\n apply (auto)\n (* app case. *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n apply (auto)\n apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n apply (rule_tac x=\"rem_use_env r_s3 x\" in exI)\n apply (auto)\n apply (rule_tac well_typed_rem_perms)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rem_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) x\" in trans_leq_use_env)\n apply (simp add: dist_diff_rem_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (simp add: dist_rem_comp_use_env)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)(*\n apply (rule_tac safe_lift_rem_use_env)\n apply (simp)*)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac r_sb=\"rem_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) x\" in trans_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (simp add: dist_rem_comp_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: lift_rem_use_env)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 ra\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac self_rem_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (simp)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac r_sb=\"rem_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) x\" in trans_leq_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp)\n apply (simp add: dist_diff_rem_use_env)\n apply (simp add: lift_rem_use_env)\n apply (simp add: dist_rem_comp_use_env)\n apply (rule_tac id_leq_use_env)\n done \n \n (* \n ####################################\n P7. well-typed manipulation for permission changes\n ####################################\n *) \n\nlemma well_typed_comp_perms_gen: \"\\ well_typed env r_s1 e tau r_s2 rx; mini_disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* op case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* var case *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permission bounds check *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n (* - second half of end permission bounds check *)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* - various bounds checks *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sa=\"r_s1\" and r_sb=\"r_s2a\" and r_sc=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permissions bounds check *)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* - second half of end permissions bounds check *)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n (* - final bounds checks *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done \n \nlemma well_typed_comp_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n apply (rule_tac well_typed_comp_perms_gen)\n apply (simp)\n apply (simp add: disj_use_env_def)\n done\n\nlemma well_typed_comp_perms2: \"\\ well_typed env r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_ex r_s1) e tau (comp_use_env r_ex r_s2) rx\" \n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env) \n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s2\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (auto)\n done \n \nlemma well_typed_add_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e; r = OwnPerm; rx x = NoPerm \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in ignore_rem_use_env)\n apply (simp)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n apply (rule_tac disj_one_use_env)\n apply (simp add: rem_use_env_def)\n done \n \nlemma well_typed_incr_simul_perm: \"\\ leq_use_env r_s r_c; well_typed env r_s e tau r_s rx \\ \\ well_typed env r_c e tau r_c rx\"\n apply (rule_tac t=\"r_c\" and s=\"comp_use_env r_s (diff_use_env r_c r_s)\" in subst)\n apply (rule_tac msum_diff_comp_use_env)\n apply (simp)\n apply (rule_tac well_typed_comp_perms_gen)\n apply (simp)\n apply (rule_tac mini_disj_diff_use_env)\n done \n \nlemma well_typed_lift_perms: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) rx\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx) \n apply (auto)\n (* const + op cases *)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* var cases *)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n done \n \n (* \n ####################################\n P8. well-typed manipulation for end permissions\n ####################################\n *) \n \nlemma wtdep_diff_use_env: \"\\ leq_use_env r_x (diff_use_env r_s r_xa) \\ \\ diff_use_env r_x r_ex = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa)\" \n apply (case_tac \"\\ x. diff_use_env r_x r_ex x = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa) x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n\nlemma wtdep_strong_use_vars: \"\\ well_typed env (diff_use_env r_s1 r_x) e tau r_s2 rx; strong_use_env r_x \\ \\ non_prim_vars env e \\ own_env_vars r_x = {}\" \n apply (auto)\n apply (case_tac \"r_x x \\ NoPerm\")\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (cut_tac r_s=\"r_s1\" and r_ex=\"r_x\" and x=\"x\" in diff_use_none_ex)\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and env=\"env\" and ?r_s1.0=\"diff_use_env r_s1 r_x\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: own_env_vars_def)\n done\n \n \nlemma well_typed_break: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env r_s1 e tau (norm_use_env r_s1 r_s2) rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const case *)\n apply (rule_tac self_norm_leq_use_env)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n (* op case *)\n apply (rule_tac self_norm_leq_use_env)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac diff_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (* pair case *)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac spec_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (auto)\n (* - common substitution *)\n apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s2\" in well_typed_perm_leq)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s2\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s2\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (simp)\n (* - rx1 *)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - rx2 *)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e3\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac diff_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s3\" in well_typed_perm_leq)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (simp)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac spec_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n done\n \n (* when we perform substitution, we need to be able to stop \"requiring\" permissions. the\n intuition behind this lemma is that we no longer need a permission if we simply remove it from\n the list of permissions in the environment. *) \n\nlemma well_typed_diff_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s1 \\ \\\n well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n apply (auto)\n (* const case + op case are trivial since they never require permissions *)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* var case *)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e1\" and ?r_s2.0=\"r_s2a\" in well_typed_break)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in ex_norm_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - setup r_s2 \\ r_s1 - r_exa *)\n apply (cut_tac r_sc=\"r_s2\" and r_sb=\"r_s2a\" and r_sa=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - prelim for both inductions *)\n apply (case_tac \"diff_use_env r_s2 (comp_use_env (diff_use_env r_ex r_exa) r_exa) \\ diff_use_env (diff_use_env r_s2 (diff_use_env r_ex r_exa)) r_exa\")\n apply (cut_tac r_s=\"r_s2\" and r_x=\"diff_use_env r_ex r_exa\" and r_ex=\"r_exa\" in diff_comp_use_env)\n apply (auto)\n apply (cut_tac r_sc=\"diff_use_env r_ex r_exa\" and r_sb=\"r_ex\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n (* - first induction *)\n apply (rule_tac x=\"diff_use_env r_s1 r_exa\" in exI)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx1 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac t=\"diff_use_env rx1 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx1 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n apply (rule_tac diff_comp_use_env)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e2\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - lemma to prove non-prim x is not in e2 *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" and e=\"e2\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - second induction *)\n apply (rule_tac x=\"diff_use_env rx2 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (cut_tac r_x=\"rx2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac t=\"diff_use_env rx2 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx2 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n apply (rule_tac diff_comp_use_env)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e3\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - lemma to prove non-prim x is not in e3 *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" and e=\"e3\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - final equality *)\n apply (simp add: dist_diff_comp_use_env)\n (* the lambda case allows us to select any r_s2 + rx as long as they match. *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s1 r_exa) r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n done\n\nlemma well_typed_rem_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; r_s1 x = OwnPerm \\ \\ well_typed env r_s1 e tau (rem_use_env r_s2 x) (rem_use_env rx x)\" \n apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n done \n \nlemma well_typed_decr_end_perm: \"\\ well_typed env r_s1 e tau r_c rx; leq_use_env r_s2 r_c; leq_use_env rx r_s2 \\ \\ well_typed env r_s1 e tau r_s2 rx\" \n apply (induction e arbitrary: env r_s1 tau rx)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx1\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx2\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n done\n \nlemma well_typed_diff_decr_end_perm: \"\\ well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex');\n leq_use_env r_ex' r_ex; leq_use_env r_ex r_s1 \\ \\ \n well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n apply (case_tac \"well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex) =\n well_typed env r_s1 e tau (diff_use_env (diff_use_env r_s2 r_ex) r_ex) (diff_use_env (diff_use_env rx r_ex') r_ex)\")\n apply (simp)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n apply (cut_tac r_s=\"r_s2\" and r_x=\"r_ex\" in double_diff_use_env)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex'\" and r_c=\"r_ex\" in cancel_diff_use_env)\n apply (auto)\n done \n\nlemma well_typed_diff_decr_end_perm_gen: \"\\ well_typed env r_s1 e tau (diff_use_env r_s2 r_exb) (diff_use_env rx r_exb);\n leq_use_env r_exb r_exa; leq_use_env r_exa r_s1 \\ \\ well_typed env r_s1 e tau (diff_use_env r_s2 r_exa) (diff_use_env rx r_exa)\" \n apply (cut_tac r_s=\"r_s2\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n done \n \n (* \n ####################################\n P9. well-typed manipulation for requirements\n ####################################\n *)\n\nlemma well_typed_comp_req1: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\ \\\n well_typed env r_s1 e tau r_s2 (comp_use_env r_ex rx)\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n apply (auto)\n (* const + op case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* var cases *)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_ex rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac assoc_comp_use_env)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n done\n \nlemma well_typed_comp_req2: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\ \\\n well_typed env r_s1 e tau r_s2 (comp_use_env rx r_ex)\"\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_req1)\n apply (auto)\n done\n\nlemma well_typed_incr_req: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env rx rc; leq_use_env rc r_s2 \\ \\ well_typed env r_s1 e tau r_s2 rc\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rc\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"rx1\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"rc\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"rx2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (case_tac \"\\ x. rc x = comp_use_env rc rc x\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (case_tac \"rc x\")\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n done \n\nlemma well_typed_simul_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_c r_s2;\n leq_use_env rc r_c; leq_use_env rx rc \\ \\ well_typed env r_s1 e tau r_c rc\"\n apply (rule_tac rx=\"rx\" in well_typed_incr_req)\n apply (rule_tac r_c=\"r_s2\" in well_typed_decr_end_perm)\n apply (auto)\n apply (rule_tac r_sb=\"rc\" in trans_leq_use_env)\n apply (auto)\n done \n \n \nlemma well_typed_add_permsx: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) (add_use_env rx x r)\" \n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env) \n apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env) \n apply (simp)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (cut_tac r_s=\"rem_use_env rx x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (rule_tac well_typed_comp_req2)\n apply (rule_tac well_typed_comp_perms)\n apply (rule_tac well_typed_rem_perms)\n apply (auto)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rem_use_env_def)\n apply (rule_tac self_comp_leq_use_env2)\n done\n \n (* \n ####################################\n P10. well-typed manipulation involving lifts\n ####################################\n *) \n\nlemma well_typed_lift_req: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env (lift_use_env rx r) r_s2 \\ \\ well_typed env r_s1 e tau r_s2 (lift_use_env rx r)\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"lift_use_env rx1 r\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"lift_use_env rx1 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (auto)\n apply (rule_tac x=\"lift_use_env rx2 r\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"lift_use_env rx2 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (auto)\n apply (rule_tac lift_comp_use_env)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (auto)\n done \n \nlemma well_typed_lift_all_perms: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) (lift_use_env rx r)\"\n apply (rule_tac well_typed_lift_req)\n apply (rule_tac well_typed_lift_perms)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n done\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/WTLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2978326155932026}} {"text": "(* Title: HOL/Auth/n_germanSymIndex.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex imports n_germanSymIndex_lemma_invs_on_rules n_germanSymIndex_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\ f. f \\ (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\ f ini s. f \\ (invariants N) --> ini \\ {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n fix f ini s\n assume b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n have b4: \"formEval (andList (allInitSpecs N)) s\"\n apply (cut_tac b2 b3, simp) done\n show \"formEval f s\"\n apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\ f r s. f \\ invariants N --> r \\ rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n fix f r s\n assume b1: \"f \\ invariants N\" and b2: \"r \\ rules N\"\n show \"invHoldForRule s f r (invariants N)\"\n apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\n apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.29776811152754046}} {"text": "(*\n * Copyright 2017, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n\n * @TAG(DATA61_BSD)\n *)\n\ntheory OG_More\n\nimports\n \"../lib/Hoare_Parallel/OG_Tactics\"\n \"../lib/Hoare_Parallel/Quote_Antiquote\"\n\nbegin\n\nfun add_inv_assn_com :: \"'a assn \\ 'a ann_com \\ 'a ann_com\" where\n \"add_inv_assn_com I (AnnBasic(x, r) f) = (AnnBasic (x, r\\I) f)\"\n| \"add_inv_assn_com I (AnnSeq c1 c2) = (AnnSeq (add_inv_assn_com I c1) (add_inv_assn_com I c2))\"\n| \"add_inv_assn_com I (AnnCond1(x, r) bb c1 c2) = (AnnCond1 (x, r\\I) bb (add_inv_assn_com I c1) (add_inv_assn_com I c2))\" \n| \"add_inv_assn_com I (AnnCond2(x, r) bb c) = (AnnCond2 (x, r\\I) bb (add_inv_assn_com I c))\"\n| \"add_inv_assn_com I (AnnWhile(x, r) bb (y, i) c) = (AnnWhile (x, r\\I) bb (y, i\\I) (add_inv_assn_com I c))\"\n| \"add_inv_assn_com I (AnnAwait(x, r) bb c) = (AnnAwait (x, r\\I) bb c)\"\n\ndefinition add_inv_aux:: \"'a assn \\ ('a ann_com option \\ 'a assn) \\ ('a ann_com option \\ 'a assn)\"\nwhere\n\" add_inv_aux I p \\\n case p of\n (Some ac, aa) \\ (Some (add_inv_assn_com I ac), aa\\I)\n |(None, aa) \\ (None, aa\\I)\"\n \nprimrec add_inv_com :: \"'a assn \\ 'a com \\ 'a com\" where \n \"add_inv_com I (Parallel Ts) = (Parallel (map (add_inv_aux I) Ts))\" \n| \"add_inv_com I (Basic f) = (Basic f)\" \n| \"add_inv_com I (Seq c1 c2) = (Seq (add_inv_com I c1) (add_inv_com I c2))\" \n| \"add_inv_com I (Cond bb c1 c2) = (Cond bb (add_inv_com I c1) (add_inv_com I c2))\"\n| \"add_inv_com I (While bb i c) = (While bb i (add_inv_com I c))\"\n\n(* FIXME: check if other similar lemmas are redundant*)\nlemma pre_add_inv_assn_com:\n \" pre (add_inv_assn_com I cc) = pre cc \\ I\"\n apply (induct cc, simp_all)\n by (clarsimp split: prod.splits)+\n \nlemma pre_add_inv_aux:\n \"\\cc q. c= (Some cc, q) \\\n pre (the (OG_Hoare.com (add_inv_aux I c))) =\n pre (the (OG_Hoare.com c)) \\ I\"\n unfolding add_inv_aux_def\n apply (clarsimp split: prod.splits option.splits simp: pre_add_inv_assn_com)\n done\n\nlemma post_add_inv_aux:\n \"OG_Hoare.post (add_inv_aux I c) = OG_Hoare.post c \\ I\"\n by (clarsimp simp: add_inv_aux_def \n split: prod.splits option.splits)\n \nlemma atomics_add_assn_com:\n \"(atomics (add_inv_assn_com I c)) \n = {(r,a). \\ rr. (rr, a) \\ atomics c \\ r=rr\\I }\"\n by (induct c, auto)\n \nlemma assertions_add_assn_com:\n \"(assertions (add_inv_assn_com I c)) \n = {r. \\ rr. rr \\ assertions c \\ r=rr\\I }\"\n apply (induct c arbitrary: I rule: add_inv_assn_com.induct, simp_all)\n apply auto [1] \n apply blast\n apply blast\n apply blast\n done\n\nlemma assertions_add_invs_assn_com:\n \"assertions (add_inv_assn_com I a) = (\\A. A\\I)`(assertions a)\"\n by (induction a, simp_all, (clarsimp|blast)+)\n\nlemma pre_add_inv_aux_inter: \n \"pre (the (OG_Hoare.com (add_inv_aux (I1\\I2) c))) =\n pre (the (OG_Hoare.com (add_inv_aux I1 c))) \\ \n pre (the (OG_Hoare.com (add_inv_aux I2 c)))\"\n apply (simp add:add_inv_aux_def)\n apply (case_tac c)\n apply clarsimp\n apply (case_tac a)\n apply clarsimp\n apply clarsimp\n apply (auto simp:pre_add_inv_assn_com)\n done\n\nlemma add_inv_aux_D:\n \"add_inv_aux I t = (Some c, q) \\ \n \\ ac aa. t = (Some ac, aa) \\ q = aa\\I \\ add_inv_assn_com I ac=c\"\n by (simp add: add_inv_aux_def split: option.splits prod.splits) \n\nlemma com_add_inv_aux:\n \"(OG_Hoare.com (add_inv_aux I p)) = \n (case p of \n (Some ac, aa) \\ (Some (add_inv_assn_com I ac)) \n | (None, _) \\ None)\"\n by (clarsimp simp: add_inv_aux_def split: prod.splits option.splits)\n\nlemma add_inv_assn_com_idempotent:\n \"add_inv_assn_com I (add_inv_assn_com I c) = add_inv_assn_com I c\"\n by (induct c, simp_all, auto)\n\ndefinition\n oghoare_inv :: \"'a assn \\ 'a assn \\ 'a assn \\ 'a com \\ 'a assn \\ bool\" (\"(_ \\-\\<^sub>i _//_//_//_)\" [55,90,90,55,90] 50)\nwhere\n \"I' \\-\\<^sub>i I p c q \\ I' \\- p (add_inv_com I c) (q(*\\I*))\"\n\nabbreviation\n oghoare_inv' :: \"'a assn \\ 'a assn \\ 'a com \\ 'a assn \\ bool\" (\"(\\-\\<^sub>i _//_//_//_)\" [90,90,55,90] 50)\nwhere\n \"\\-\\<^sub>i I p c q \\ UNIV \\-\\<^sub>i I p c q\"\n\n\nprimrec add_await_ann_com :: \"'a bexp \\ 'a ann_com \\ 'a ann_com\" where\n \"add_await_ann_com P (AnnBasic r f) = (AnnAwait r P (Basic f))\"\n| \"add_await_ann_com P (AnnSeq c1 c2) = (AnnSeq (add_await_ann_com P c1) (add_await_ann_com P c2))\"\n| \"add_await_ann_com P (AnnCond1 r bb c1 c2) = (AnnCond1 r bb (add_await_ann_com P c1) (add_await_ann_com P c2))\"\n| \"add_await_ann_com P (AnnCond2 r bb c) = (AnnCond2 r bb (add_await_ann_com P c))\"\n| \"add_await_ann_com P (AnnWhile r bb i c) = (AnnWhile r bb i (add_await_ann_com P c))\"\n| \"add_await_ann_com P (AnnAwait r bb c) = (AnnAwait r (bb\\P) c)\"\n\ndefinition add_await_aux:: \"'a bexp \\ ('a ann_com option \\ 'a assn) \\ ('a ann_com option \\ 'a assn)\"\nwhere\n \"add_await_aux P p \\\n case p of\n (Some ac, aa) \\ (Some (add_await_ann_com P ac), aa)\n |(None, aa) \\ (None, aa)\"\n\nfun add_await_com :: \"'a bexp \\ 'a com \\ 'a com\" where\n \"add_await_com P (Parallel Ts) = (Parallel (map (add_await_aux P) Ts))\"\n| \"add_await_com P c = c\"\n\n\n\n(*Checks whether two programs are the same up to cruft*)\nfun same_ann_program_assn_com :: \"'a ann_com \\ 'a ann_com \\ bool\" where\n \"same_ann_program_assn_com (AnnBasic (_, r) f) (AnnBasic(_, r') f') = (r = r' \\ f = f')\"\n| \"same_ann_program_assn_com (AnnSeq c1 c2) (AnnSeq c1' c2') = (same_ann_program_assn_com c1 c1' \\ same_ann_program_assn_com c2 c2')\"\n| \"same_ann_program_assn_com (AnnCond1(_, r) bb c1 c2) (AnnCond1(_, r') bb' c1' c2') = (r = r' \\ bb = bb' \\ same_ann_program_assn_com c1 c1' \\ same_ann_program_assn_com c2 c2')\" \n| \"same_ann_program_assn_com (AnnCond2(_, r) bb c) (AnnCond2(_, r') bb' c') = (r = r' \\ bb = bb' \\ same_ann_program_assn_com c c')\"\n| \"same_ann_program_assn_com (AnnWhile(_, r) bb (y, i) c) (AnnWhile(_, r') bb' (_, i') c') = (r = r' \\ bb = bb' \\ i = i' \\ same_ann_program_assn_com c c')\"\n| \"same_ann_program_assn_com (AnnAwait(_, r) bb c) (AnnAwait(_, r') bb' c') = (r = r' \\ bb = bb' \\ c = c')\"\n| \"same_ann_program_assn_com _ _ = False\"\n\nfun same_ann_prog_aux:: \"('a ann_com option \\ 'a assn) \\ ('a ann_com option \\ 'a assn) \\ bool\" where\n \"same_ann_prog_aux (Some ac, aa) (Some ac', aa') = (same_ann_program_assn_com ac ac' \\ aa = aa')\"\n| \"same_ann_prog_aux (None, aa) (None, aa') = (aa = aa')\"\n| \"same_ann_prog_aux _ _ = False\"\n\nfun same_ann_prog_com :: \"'a com \\ 'a com \\ bool\" where \n \"same_ann_prog_com (Parallel Ts) (Parallel Ts') = (length Ts = length Ts' \\ list_all (\\(c, c'). same_ann_prog_aux c c') (zip Ts Ts'))\" \n| \"same_ann_prog_com (Basic f) (Basic f') = (f = f')\" \n| \"same_ann_prog_com (Seq c1 c2) (Seq c1' c2') = (same_ann_prog_com c1 c1' \\ same_ann_prog_com c2 c2')\" \n| \"same_ann_prog_com (Cond bb c1 c2) (Cond bb' c1' c2') = (bb = bb' \\ same_ann_prog_com c1 c1' \\ same_ann_prog_com c2 c2')\"\n| \"same_ann_prog_com (While bb i c) (While bb' i' c') = (bb = bb' \\ i = i' \\ same_ann_prog_com c c')\"\n| \"same_ann_prog_com _ _ = False\"\n\n(*Combines two programs that are assumed to be the same up to cruft.\n If either program marks an annotation as cruft then the resulting\n annotation is marked as cruft.*)\nfun combine_pres_assn_com :: \"'a ann_com \\ 'a ann_com \\ 'a ann_com\" where\n \"combine_pres_assn_com (AnnBasic (x, r) f) (AnnBasic(y, r') f') = (AnnBasic (x \\ y, r) f)\"\n| \"combine_pres_assn_com (AnnSeq c1 c2) (AnnSeq c1' c2') = (AnnSeq (combine_pres_assn_com c1 c1') (combine_pres_assn_com c2 c2'))\"\n| \"combine_pres_assn_com (AnnCond1(x, r) bb c1 c2) (AnnCond1(y, r') bb' c1' c2') = (AnnCond1 (x \\ y, r) bb (combine_pres_assn_com c1 c1') (combine_pres_assn_com c2 c2'))\" \n| \"combine_pres_assn_com (AnnCond2(x, r) bb c) (AnnCond2(y, r') bb' c') = (AnnCond2 (x \\ y, r) bb (combine_pres_assn_com c c'))\"\n| \"combine_pres_assn_com (AnnWhile(x, r) bb (y, i) c) (AnnWhile(x', r') bb' (y', i') c') = (AnnWhile (x \\ x', r) bb (y \\ y', i) (combine_pres_assn_com c c'))\"\n| \"combine_pres_assn_com (AnnAwait(x, r) bb c) (AnnAwait(y, r') bb' c') = (AnnAwait (x \\ y, r) bb c)\"\n\nfun combine_pres_aux:: \"('a ann_com option \\ 'a assn) \\ ('a ann_com option \\ 'a assn) \\ ('a ann_com option \\ 'a assn)\" where\n \"combine_pres_aux (Some ac, aa) (Some ac', aa') = (Some (combine_pres_assn_com ac ac'), aa)\"\n| \"combine_pres_aux (None, aa) (None, aa') = (None, aa)\"\n\nfun combine_pres_com :: \"'a com \\ 'a com \\ 'a com\" where \n \"combine_pres_com (Parallel Ts) (Parallel Ts') = (Parallel (map (\\(c, c'). combine_pres_aux c c') (zip Ts Ts')))\"\n| \"combine_pres_com (Basic f) (Basic f') = (Basic f)\" \n| \"combine_pres_com (Seq c1 c2) (Seq c1' c2') = (Seq (combine_pres_com c1 c1') (combine_pres_com c2 c2'))\"\n| \"combine_pres_com (Cond bb c1 c2) (Cond bb' c1' c2') = (Cond bb (combine_pres_com c1 c1') (combine_pres_com c2 c2'))\"\n| \"combine_pres_com (While bb i c) (While bb' i' c') = (While bb i (combine_pres_com c c'))\"\n\nlemma Parallel'[rule_format]:\n \"I \\- p c q \\ c = Parallel Ts\n \\ p \\ ((\\i\\{i. i -I)\n \\ (\\i\\{i. i q\n \\ [\\] I Ts \\ interfree I Ts\"\n apply (induct rule: oghoare_induct, (rule TrueI)+)\n by (auto simp: map_ann_hoare_def)\n\nlemma Basic'[rule_format]:\n \"I \\- p c q \\ c = Basic f \\ p \\ {s. f s \\ q}\"\n apply (induct rule: oghoare_induct, (rule TrueI)+)\n apply (auto intro: Conseq dest: subsetD)\n done\n\nlemma Seq'[rule_format]:\n \"I \\- p c q \\ c = Seq c1 c2 \\ (\\r. I \\- p c1 r \\ I \\- r c2 q)\"\n apply (induct rule: oghoare_induct, (rule TrueI)+)\n apply (auto intro: Conseq)\n done\n\nlemma Cond'[rule_format]:\n \"I \\- p c q \\ c = Cond b c1 c2 \\ I \\- (p \\ b) c1 q \\ I \\- (p \\ -b) c2 q\"\n apply (induct rule: oghoare_induct, (rule TrueI)+)\n apply simp_all\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (erule Conseq[rotated])\n apply clarsimp\n apply blast\n apply (erule Conseq[rotated])\n apply clarsimp\n apply blast\n done\n\nlemma While'[rule_format]:\n \"I \\- p c q \\ c = While b i c1 \\ (\\p'. p \\ p' \\ p' \\ -b \\ q \\ I \\- (p' \\ b) c1 p')\"\n apply (induct rule: oghoare_induct, (rule TrueI)+)\n apply (simp_all)\n apply force\n apply clarsimp\n by (meson subset_trans)\n \nlemma AnnBasic'[rule_format]:\n \"I \\ c q \\ c = AnnBasic (b,r) f \\ r \\ I \\ {s. f s \\ q \\ - I}\"\n by (induct rule: ann_hoare_induct, auto) \n \nlemma AnnSeq'[rule_format]:\n \"I \\ c q \\ c = AnnSeq c0 c1 \\ I \\ c0 (pre c1) \\ I \\ c1 q \"\n apply (induct rule: ann_hoare_induct, simp_all)\n apply (auto intro: AnnConseq)\n done \n\nlemma AnnCond1'[rule_format]:\n \"I \\ c q \\ c = AnnCond1 (x,r) b c1 c2 \\ \n r \\ b \\ I \\ pre c1 \\ I \\ c1 q \\ r \\ -b \\ I \\ pre c2 \\ I \\ c2 q\"\n apply (induct rule: ann_hoare_induct, simp_all)\n apply (auto intro: AnnConseq)\n done \n \nlemma AnnCond2'[rule_format]:\n \"I \\ c q \\ c = AnnCond2 (x,r) b c1 \\ \n r \\ b \\ I \\ pre c1 \\ I \\ c1 q \\ r \\ -b \\ I \\ q \"\n apply (induct rule: ann_hoare_induct, simp_all)\n apply (auto intro: AnnConseq)\n done \n \nlemma AnnWhile'[rule_format]:\n \"I \\ c q \\ c = AnnWhile (x,r) b (y,i) c1 \\ \n r \\ I \\ i \\ i \\ b \\ I \\ pre c1 \\ I \\ c1 i \\ i \\ -b \\ I \\ q\"\n apply (induct rule: ann_hoare_induct, simp_all)\n apply (auto intro: AnnConseq)\n done \n \nlemma AnnAwait'[rule_format]:\n \"I \\ c q \\ c = AnnAwait (x,r) b c1 \\ \n atom_com c1 \\ UNIV \\- (r \\ b \\ I) c1 (q \\ -I)\"\n apply (induct rule: ann_hoare_induct, simp_all)\n apply (auto intro: AnnConseq Conseq)\n done\n\nlemma parallel_conseq_combine_aux':\n \"\\same_ann_program_assn_com ac ac'; x \\ pre ac; x \\ pre ac'\\\n \\ x \\ pre (combine_pres_assn_com ac ac')\"\n by (induct ac ac' rule: combine_pres_assn_com.induct) auto\n\nlemma parallel_conseq_combine_aux:\n \"\\\\n p'; p \\ p'';\n p' \\ (\\ i\\{i. i -I;\n p'' \\ (\\ i\\{i. i -I\\\n \\ p \\ (\\i\\\\\\op < (length (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts')))\\.\n pre (the (OG_Hoare.com (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts') ! i)))) \\ -I\"\n by (fastforce elim: same_ann_prog_aux.elims dest: parallel_conseq_combine_aux')\n \nlemma inter_helper: \n \"\\x\\q' \\ q''. x \\ q \\ x \\ q' \\ x \\ q'' \\ x \\ q\"\n by blast\n\n\nlemma parallel_conseq_combine:\n \"\\I \\- p'\n Parallel Ts\n q';\n I \\- p''\n Parallel Ts'\n q'';\n length Ts = length Ts'; list_all (\\(x, y). same_ann_prog_aux x y) (zip Ts Ts'); p \\ p';\n p \\ p''; q' \\ q'' \\ q;\n I \\- ((\\ i\\{i. i(x, y). combine_pres_aux x y) (zip Ts Ts'))}.\n pre (the (OG_Hoare.com (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts') ! i)))) \\ -I)\n Parallel (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts'))\n (\\ i\\{i. i(x, y). combine_pres_aux x y) (zip Ts Ts'))}.\n OG_Hoare.post (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts') ! i))\\\n \\ I \\- p\n Parallel (map (\\(x, y). combine_pres_aux x y) (zip Ts Ts'))\n q\"\n apply (drule Parallel', fastforce)\n apply (drule Parallel', fastforce)\n apply (clarsimp simp: list_all_length)\n apply (rule ParallelConseqRule)\n apply (erule (4) parallel_conseq_combine_aux)\n apply (erule Conseq[rotated])\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: subset_eq)\n by (erule inter_helper; (erule bspec, fastforce elim: same_ann_prog_aux.elims))\n\nlemma cruft_compose:\n assumes valid': \"I \\- p' c' q'\"\n and valid'': \"I \\- p'' c'' q''\"\n and same: \"same_ann_prog_com c' c''\"\n and combine: \"c = combine_pres_com c' c''\"\n and conseq: \"p \\ p' \\ p''\\ q' \\ q'' \\ q\"j\n shows \"I \\- p c q\"\nusing assms\nproof (induct c' c'' arbitrary: p p' p'' c q q' q'' rule: same_ann_prog_com.induct)\n case 1 then show ?case\n apply clarsimp\n apply (frule Parallel', fastforce)\n apply (erule (6) parallel_conseq_combine)\n apply (drule Parallel', fastforce)\n apply (rule ParallelRule)\napply clarsimp\n apply (clarsimp simp: map_ann_hoare_def)\n oops (*\nnext\n case 2 then show ?case\n apply clarsimp\n apply (drule Basic', fastforce)\n apply (drule Basic', fastforce)\n apply (rule BasicRule)\n apply force\n done\nnext\n case 3 then show ?case\n apply clarsimp\n apply (drule Seq', fastforce)\n apply (drule Seq', fastforce)\n apply clarsimp\n apply (rule_tac r=\"r \\ ra\" in SeqRule)\n apply force\n apply (rule 3(2), force+)\n done\nnext\n case 4 then show ?case\n apply clarsimp\n apply (drule Cond', fastforce)\n apply (drule Cond', fastforce)\n apply clarsimp\n apply (rule Conseq[OF _ Cond subset_refl])\n apply force\n apply (rule 4(1), force+)[1]\n apply (rule 4(2), force+)[1]\n done\nnext\n case 5 then show ?case\n apply clarsimp\n apply (drule While', fastforce)\n apply (drule While', fastforce)\n apply clarsimp\n apply (rule_tac p=\"p' \\ p'aa\" in Conseq[OF _ While _])\n apply force\n apply (rule 5(1), force+)[1]\n apply force\n done\nnext\nqed simp_all*)\n\nend\n", "meta": {"author": "echronos", "repo": "echronos-proofs", "sha": "5983821e591c6878f1fe96aa831e11c5c97ce385", "save_path": "github-repos/isabelle/echronos-echronos-proofs", "path": "github-repos/isabelle/echronos-echronos-proofs/echronos-proofs-5983821e591c6878f1fe96aa831e11c5c97ce385/verif/OG_More.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2977681115275404}} {"text": "(* Title: Jinja/Compiler/TypeComp.thy\n\n Author: Tobias Nipkow\n Copyright TUM 2003\n*)\n\nsection \\Preservation of Well-Typedness\\\n\ntheory TypeComp\nimports Compiler \"../BV/BVSpec\"\nbegin\n\n(*<*)\ndeclare nth_append[simp]\n(*>*)\n\nlocale TC0 =\n fixes P :: \"J\\<^sub>1_prog\" and mxl :: nat\nbegin\n\ndefinition \"ty E e = (THE T. P,E \\\\<^sub>1 e :: T)\"\n\ndefinition \"ty\\<^sub>l E A' = map (\\i. if i \\ A' \\ i < size E then OK(E!i) else Err) [0..i' ST E A = (case A of None \\ None | \\A'\\ \\ Some(ST, ty\\<^sub>l E A'))\"\n\ndefinition \"after E A ST e = ty\\<^sub>i' (ty E e # ST) E (A \\ \\ e)\"\n\nend\n\nlemma (in TC0) ty_def2 [simp]: \"P,E \\\\<^sub>1 e :: T \\ ty E e = T\"\n(*<*)\napply (unfold ty_def)\napply(blast intro: the_equality WT\\<^sub>1_unique)\ndone\n(*>*)\n\nlemma (in TC0) [simp]: \"ty\\<^sub>i' ST E None = None\"\n(*<*)by (simp add: ty\\<^sub>i'_def)(*>*)\n\nlemma (in TC0) ty\\<^sub>l_app_diff[simp]:\n \"ty\\<^sub>l (E@[T]) (A - {size E}) = ty\\<^sub>l E A\"\n(*<*)by(auto simp add:ty\\<^sub>l_def hyperset_defs)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_app_diff[simp]:\n \"ty\\<^sub>i' ST (E @ [T]) (A \\ size E) = ty\\<^sub>i' ST E A\"\n(*<*)by(auto simp add:ty\\<^sub>i'_def hyperset_defs)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_antimono:\n \"A \\ A' \\ P \\ ty\\<^sub>l E A' [\\\\<^sub>\\] ty\\<^sub>l E A\"\n(*<*)by(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_antimono:\n \"A \\ A' \\ P \\ ty\\<^sub>i' ST E \\A'\\ \\' ty\\<^sub>i' ST E \\A\\\"\n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_env_antimono:\n \"P \\ ty\\<^sub>l (E@[T]) A [\\\\<^sub>\\] ty\\<^sub>l E A\" \n(*<*)by(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_env_antimono:\n \"P \\ ty\\<^sub>i' ST (E@[T]) A \\' ty\\<^sub>i' ST E A\" \n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_incr:\n \"P \\ ty\\<^sub>i' ST (E @ [T]) \\insert (size E) A\\ \\' ty\\<^sub>i' ST E \\A\\\"\n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_incr:\n \"P \\ ty\\<^sub>l (E @ [T]) (insert (size E) A) [\\\\<^sub>\\] ty\\<^sub>l E A\"\n(*<*)by(auto simp: hyperset_defs ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_in_types:\n \"set E \\ types P \\ ty\\<^sub>l E A \\ list mxl (err (types P))\"\n(*<*)by(auto simp add:ty\\<^sub>l_def intro!:listI dest!: nth_mem)(*>*)\n\nlocale TC1 = TC0\nbegin\n\nprimrec compT :: \"ty list \\ nat hyperset \\ ty list \\ expr\\<^sub>1 \\ ty\\<^sub>i' list\" and\n compTs :: \"ty list \\ nat hyperset \\ ty list \\ expr\\<^sub>1 list \\ ty\\<^sub>i' list\" where\n\"compT E A ST (new C) = []\"\n| \"compT E A ST (Cast C e) = \n compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (Val v) = []\"\n| \"compT E A ST (e\\<^sub>1 \\bop\\ e\\<^sub>2) =\n (let ST\\<^sub>1 = ty E e\\<^sub>1#ST; A\\<^sub>1 = A \\ \\ e\\<^sub>1 in\n compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n compT E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2 @ [after E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2])\"\n| \"compT E A ST (Var i) = []\"\n| \"compT E A ST (i := e) = compT E A ST e @\n [after E A ST e, ty\\<^sub>i' ST E (A \\ \\ e \\ \\{i}\\)]\"\n| \"compT E A ST (e\\F{D}) = \n compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e\\<^sub>1\\F{D} := e\\<^sub>2) =\n (let ST\\<^sub>1 = ty E e\\<^sub>1#ST; A\\<^sub>1 = A \\ \\ e\\<^sub>1; A\\<^sub>2 = A\\<^sub>1 \\ \\ e\\<^sub>2 in\n compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n compT E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2 @ [after E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2] @\n [ty\\<^sub>i' ST E A\\<^sub>2])\"\n| \"compT E A ST {i:T; e} = compT (E@[T]) (A\\i) ST e\"\n| \"compT E A ST (e\\<^sub>1;;e\\<^sub>2) =\n (let A\\<^sub>1 = A \\ \\ e\\<^sub>1 in\n compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1, ty\\<^sub>i' ST E A\\<^sub>1] @\n compT E A\\<^sub>1 ST e\\<^sub>2)\"\n| \"compT E A ST (if (e) e\\<^sub>1 else e\\<^sub>2) =\n (let A\\<^sub>0 = A \\ \\ e; \\ = ty\\<^sub>i' ST E A\\<^sub>0 in\n compT E A ST e @ [after E A ST e, \\] @\n compT E A\\<^sub>0 ST e\\<^sub>1 @ [after E A\\<^sub>0 ST e\\<^sub>1, \\] @\n compT E A\\<^sub>0 ST e\\<^sub>2)\"\n| \"compT E A ST (while (e) c) =\n (let A\\<^sub>0 = A \\ \\ e; A\\<^sub>1 = A\\<^sub>0 \\ \\ c; \\ = ty\\<^sub>i' ST E A\\<^sub>0 in\n compT E A ST e @ [after E A ST e, \\] @\n compT E A\\<^sub>0 ST c @ [after E A\\<^sub>0 ST c, ty\\<^sub>i' ST E A\\<^sub>1, ty\\<^sub>i' ST E A\\<^sub>0])\"\n| \"compT E A ST (throw e) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e\\M(es)) =\n compT E A ST e @ [after E A ST e] @\n compTs E (A \\ \\ e) (ty E e # ST) es\"\n| \"compT E A ST (try e\\<^sub>1 catch(C i) e\\<^sub>2) =\n compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n [ty\\<^sub>i' (Class C#ST) E A, ty\\<^sub>i' ST (E@[Class C]) (A \\ \\{i}\\)] @\n compT (E@[Class C]) (A \\ \\{i}\\) ST e\\<^sub>2\"\n| \"compTs E A ST [] = []\"\n| \"compTs E A ST (e#es) = compT E A ST e @ [after E A ST e] @\n compTs E (A \\ (\\ e)) (ty E e # ST) es\"\n\ndefinition compT\\<^sub>a :: \"ty list \\ nat hyperset \\ ty list \\ expr\\<^sub>1 \\ ty\\<^sub>i' list\" where\n \"compT\\<^sub>a E A ST e = compT E A ST e @ [after E A ST e]\"\n\nend\n\nlemma compE\\<^sub>2_not_Nil[simp]: \"compE\\<^sub>2 e \\ []\"\n(*<*)by(induct e) auto(*>*)\n\nlemma (in TC1) compT_sizes[simp]:\nshows \"\\E A ST. size(compT E A ST e) = size(compE\\<^sub>2 e) - 1\"\nand \"\\E A ST. size(compTs E A ST es) = size(compEs\\<^sub>2 es)\"\n(*<*)\napply(induct e and es rule: compE\\<^sub>2.induct compEs\\<^sub>2.induct)\napply(auto split:bop.splits nat_diff_split)\ndone\n(*>*)\n\n\nlemma (in TC1) [simp]: \"\\ST E. \\\\\\ \\ set (compT E None ST e)\"\nand [simp]: \"\\ST E. \\\\\\ \\ set (compTs E None ST es)\"\n(*<*)by(induct e and es rule: compT.induct compTs.induct) (simp_all add:after_def)(*>*)\n\n\nlemma (in TC0) pair_eq_ty\\<^sub>i'_conv:\n \"(\\(ST, LT)\\ = ty\\<^sub>i' ST\\<^sub>0 E A) =\n (case A of None \\ False | Some A \\ (ST = ST\\<^sub>0 \\ LT = ty\\<^sub>l E A))\"\n(*<*)by(simp add:ty\\<^sub>i'_def)(*>*)\n\n\nlemma (in TC0) pair_conv_ty\\<^sub>i':\n \"\\(ST, ty\\<^sub>l E A)\\ = ty\\<^sub>i' ST E \\A\\\"\n(*<*)by(simp add:ty\\<^sub>i'_def)(*>*)\n\n(*<*)\ndeclare (in TC0)\n ty\\<^sub>i'_antimono [intro!] after_def[simp]\n pair_conv_ty\\<^sub>i'[simp] pair_eq_ty\\<^sub>i'_conv[simp]\n(*>*)\n\n\nlemma (in TC1) compT_LT_prefix:\n \"\\E A ST\\<^sub>0. \\ \\(ST,LT)\\ \\ set(compT E A ST\\<^sub>0 e); \\ e (size E) \\\n \\ P \\ \\(ST,LT)\\ \\' ty\\<^sub>i' ST E A\"\nand\n \"\\E A ST\\<^sub>0. \\ \\(ST,LT)\\ \\ set(compTs E A ST\\<^sub>0 es); \\s es (size E) \\\n \\ P \\ \\(ST,LT)\\ \\' ty\\<^sub>i' ST E A\"\n(*<*)\nproof(induct e and es rule: compT.induct compTs.induct)\n case FAss thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case BinOp thus ?case\n by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans split:bop.splits)\nnext\n case Seq thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case While thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case Cond thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case Block thus ?case\n by(force simp add:hyperset_defs ty\\<^sub>i'_def simp del:pair_conv_ty\\<^sub>i'\n elim!:sup_state_opt_trans)\nnext\n case Call thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case Cons_exp thus ?case\n by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n case TryCatch thus ?case\n by(fastforce simp:hyperset_defs intro!:(* ty\\<^sub>i'_env_antimono *) ty\\<^sub>i'_incr\n elim!:sup_state_opt_trans)\nqed (auto simp:hyperset_defs)\n\ndeclare (in TC0)\n ty\\<^sub>i'_antimono [rule del] after_def[simp del]\n pair_conv_ty\\<^sub>i'[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n(*>*)\n\n\n\n\nlemma (in TC0) after_in_states:\n \"\\ wf_prog p P; P,E \\\\<^sub>1 e :: T; set E \\ types P; set ST \\ types P;\n size ST + max_stack e \\ mxs \\\n \\ OK (after E A ST e) \\ states P mxs mxl\"\n(*<*)\napply(subgoal_tac \"size ST + 1 \\ mxs\")\n apply(simp add: after_def ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\n apply(blast intro!:listI WT\\<^sub>1_is_type)\nusing max_stack1[of e] apply simp\ndone\n(*>*)\n\n\nlemma (in TC0) OK_ty\\<^sub>i'_in_statesI[simp]:\n \"\\ set E \\ types P; set ST \\ types P; size ST \\ mxs \\\n \\ OK (ty\\<^sub>i' ST E A) \\ states P mxs mxl\"\n(*<*)\napply(simp add:ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\napply(blast intro!:listI)\ndone\n(*>*)\n\n\nlemma is_class_type_aux: \"is_class P C \\ is_type P (Class C)\"\n(*<*)by(simp)(*>*)\n\n(*<*)\ndeclare is_type_simps[simp del] subsetI[rule del]\n(*>*)\n\ntheorem (in TC1) compT_states:\nassumes wf: \"wf_prog p P\"\nshows \"\\E T A ST.\n \\ P,E \\\\<^sub>1 e :: T; set E \\ types P; set ST \\ types P;\n size ST + max_stack e \\ mxs; size E + max_vars e \\ mxl \\\n \\ OK ` set(compT E A ST e) \\ states P mxs mxl\"\n(*<*)(is \"\\E T A ST. PROP ?P e E T A ST\")(*>*)\n\nand \"\\E Ts A ST.\n \\ P,E \\\\<^sub>1 es[::]Ts; set E \\ types P; set ST \\ types P;\n size ST + max_stacks es \\ mxs; size E + max_varss es \\ mxl \\\n \\ OK ` set(compTs E A ST es) \\ states P mxs mxl\"\n(*<*)(is \"\\E Ts A ST. PROP ?Ps es E Ts A ST\")\nproof(induct e and es rule: compT.induct compTs.induct)\n case new thus ?case by(simp)\nnext\n case (Cast C e) thus ?case by (auto simp:after_in_states[OF wf])\nnext\n case Val thus ?case by(simp)\nnext\n case Var thus ?case by(simp)\nnext\n case LAss thus ?case by(auto simp:after_in_states[OF wf])\nnext\n case FAcc thus ?case by(auto simp:after_in_states[OF wf])\nnext\n case FAss thus ?case\n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case Seq thus ?case\n by(auto simp:image_Un after_in_states[OF wf])\nnext\n case BinOp thus ?case\n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case Cond thus ?case\n by(force simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case While thus ?case\n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case Block thus ?case by(auto)\nnext\n case (TryCatch e\\<^sub>1 C i e\\<^sub>2)\n moreover have \"size ST + 1 \\ mxs\" using TryCatch.prems max_stack1[of e\\<^sub>1] by auto\n ultimately show ?case \n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf]\n is_class_type_aux)\nnext\n case Nil_exp thus ?case by simp\nnext\n case Cons_exp thus ?case\n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case throw thus ?case\n by(auto simp: WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n case Call thus ?case\n by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nqed\n\ndeclare is_type_simps[simp] subsetI[intro!]\n(*>*)\n\n\ndefinition shift :: \"nat \\ ex_table \\ ex_table\"\nwhere\n \"shift n xt \\ map (\\(from,to,C,handler,depth). (from+n,to+n,C,handler+n,depth)) xt\"\n\n\n\n\nlemma [simp]: \"shift n [] = []\"\n(*<*)by(simp add:shift_def)(*>*)\n\nlemma [simp]: \"shift n (xt\\<^sub>1 @ xt\\<^sub>2) = shift n xt\\<^sub>1 @ shift n xt\\<^sub>2\"\n(*<*)by(simp add:shift_def)(*>*)\n\nlemma [simp]: \"shift m (shift n xt) = shift (m+n) xt\"\n(*<*)by(induct xt)(auto simp:shift_def)(*>*)\n\nlemma [simp]: \"pcs (shift n xt) = {pc+n|pc. pc \\ pcs xt}\"\n(*<*)\napply(auto simp:shift_def pcs_def)\napply(rule_tac x = \"x-n\" in exI)\napply (force split:nat_diff_split)\ndone\n(*>*)\n\n\nlemma shift_compxE\\<^sub>2:\nshows \"\\pc pc' d. shift pc (compxE\\<^sub>2 e pc' d) = compxE\\<^sub>2 e (pc' + pc) d\"\nand \"\\pc pc' d. shift pc (compxEs\\<^sub>2 es pc' d) = compxEs\\<^sub>2 es (pc' + pc) d\"\n(*<*)\napply(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\napply(auto simp:shift_def ac_simps)\ndone\n(*>*)\n\n\nlemma compxE\\<^sub>2_size_convs[simp]:\nshows \"n \\ 0 \\ compxE\\<^sub>2 e n d = shift n (compxE\\<^sub>2 e 0 d)\"\nand \"n \\ 0 \\ compxEs\\<^sub>2 es n d = shift n (compxEs\\<^sub>2 es 0 d)\"\n(*<*)by(simp_all add:shift_compxE\\<^sub>2)(*>*)\n\nlocale TC2 = TC1 +\n fixes T\\<^sub>r :: ty and mxs :: pc\nbegin\n\ndefinition\n wt_instrs :: \"instr list \\ ex_table \\ ty\\<^sub>i' list \\ bool\"\n (\"(\\ _, _ /[::]/ _)\" [0,0,51] 50) where\n \"\\ is,xt [::] \\s \\ size is < size \\s \\ pcs xt \\ {0..\n (\\pc< size is. P,T\\<^sub>r,mxs,size \\s,xt \\ is!pc,pc :: \\s)\"\n\nend\n\nnotation TC2.wt_instrs (\"(_,_,_ \\/ _, _ /[::]/ _)\" [50,50,50,50,50,51] 50)\n\n(*<*)\nlemmas (in TC2) wt_defs =\n wt_instrs_def wt_instr_def app_def eff_def norm_eff_def\n(*>*)\n\nlemma (in TC2) [simp]: \"\\s \\ [] \\ \\ [],[] [::] \\s\"\n(*<*) by (simp add: wt_defs) (*>*)\n\nlemma [simp]: \"eff i P pc et None = []\"\n(*<*)by (simp add: Effect.eff_def)(*>*)\n\n(*<*)\ndeclare split_comp_eq[simp del]\n(*>*)\n\nlemma wt_instr_appR:\n \"\\ P,T,m,mpc,xt \\ is!pc,pc :: \\s;\n pc < size is; size is < size \\s; mpc \\ size \\s; mpc \\ mpc' \\\n \\ P,T,m,mpc',xt \\ is!pc,pc :: \\s@\\s'\"\n(*<*)by (fastforce simp:wt_instr_def app_def)(*>*)\n\n\nlemma relevant_entries_shift [simp]:\n \"relevant_entries P i (pc+n) (shift n xt) = shift n (relevant_entries P i pc xt)\"\n(*<*)\n apply (induct xt)\n apply (unfold relevant_entries_def shift_def)\n apply simp\n apply (auto simp add: is_relevant_entry_def)\n done\n(*>*)\n\n\nlemma [simp]:\n \"xcpt_eff i P (pc+n) \\ (shift n xt) =\n map (\\(pc,\\). (pc + n, \\)) (xcpt_eff i P pc \\ xt)\"\n(*<*)\napply(simp add: xcpt_eff_def)\napply(cases \\)\napply(auto simp add: shift_def)\ndone\n(*>*)\n\n\nlemma [simp]:\n \"app\\<^sub>i (i, P, pc, m, T, \\) \\\n eff i P (pc+n) (shift n xt) (Some \\) =\n map (\\(pc,\\). (pc+n,\\)) (eff i P pc xt (Some \\))\"\n(*<*)\napply(simp add:eff_def norm_eff_def)\napply(cases \"i\",auto)\ndone\n(*>*)\n\n\nlemma [simp]:\n \"xcpt_app i P (pc+n) mxs (shift n xt) \\ = xcpt_app i P pc mxs xt \\\"\n(*<*)by (simp add: xcpt_app_def) (auto simp add: shift_def)(*>*)\n\n\nlemma wt_instr_appL:\n \"\\ P,T,m,mpc,xt \\ i,pc :: \\s; pc < size \\s; mpc \\ size \\s \\\n \\ P,T,m,mpc + size \\s',shift (size \\s') xt \\ i,pc+size \\s' :: \\s'@\\s\"\n(*<*)\napply(auto simp:wt_instr_def app_def)\nprefer 2 apply(fast)\nprefer 2 apply(fast)\napply(cases \"i\",auto)\ndone\n(*>*)\n\n\nlemma wt_instr_Cons:\n \"\\ P,T,m,mpc - 1,[] \\ i,pc - 1 :: \\s;\n 0 < pc; 0 < mpc; pc < size \\s + 1; mpc \\ size \\s + 1 \\\n \\ P,T,m,mpc,[] \\ i,pc :: \\#\\s\"\n(*<*)\napply(drule wt_instr_appL[where \\s' = \"[\\]\"])\napply arith\napply arith\napply (simp split:nat_diff_split_asm)\ndone\n(*>*)\n\n\nlemma wt_instr_append:\n \"\\ P,T,m,mpc - size \\s',[] \\ i,pc - size \\s' :: \\s;\n size \\s' \\ pc; size \\s' \\ mpc; pc < size \\s + size \\s'; mpc \\ size \\s + size \\s' \\\n \\ P,T,m,mpc,[] \\ i,pc :: \\s'@\\s\"\n(*<*)\napply(drule wt_instr_appL[where \\s' = \\s'])\napply arith\napply arith\napply (simp split:nat_diff_split_asm)\ndone\n(*>*)\n\n\nlemma xcpt_app_pcs:\n \"pc \\ pcs xt \\ xcpt_app i P pc mxs xt \\\"\n(*<*)\nby (auto simp add: xcpt_app_def relevant_entries_def is_relevant_entry_def pcs_def)\n(*>*)\n\n\nlemma xcpt_eff_pcs:\n \"pc \\ pcs xt \\ xcpt_eff i P pc \\ xt = []\"\n(*<*)\nby (cases \\)\n (auto simp add: is_relevant_entry_def xcpt_eff_def relevant_entries_def pcs_def\n intro!: filter_False)\n(*>*)\n\n\nlemma pcs_shift:\n \"pc < n \\ pc \\ pcs (shift n xt)\" \n(*<*)by (auto simp add: shift_def pcs_def)(*>*)\n\n\nlemma wt_instr_appRx:\n \"\\ P,T,m,mpc,xt \\ is!pc,pc :: \\s; pc < size is; size is < size \\s; mpc \\ size \\s \\\n \\ P,T,m,mpc,xt @ shift (size is) xt' \\ is!pc,pc :: \\s\"\n(*<*)by (auto simp:wt_instr_def eff_def app_def xcpt_app_pcs xcpt_eff_pcs)(*>*)\n\n\nlemma wt_instr_appLx: \n \"\\ P,T,m,mpc,xt \\ i,pc :: \\s; pc \\ pcs xt' \\\n \\ P,T,m,mpc,xt'@xt \\ i,pc :: \\s\"\n(*<*)by (auto simp:wt_instr_def app_def eff_def xcpt_app_pcs xcpt_eff_pcs)(*>*)\n\n\nlemma (in TC2) wt_instrs_extR:\n \"\\ is,xt [::] \\s \\ \\ is,xt [::] \\s @ \\s'\"\n(*<*)by(auto simp add:wt_instrs_def wt_instr_appR)(*>*)\n\n\nlemma (in TC2) wt_instrs_ext:\n \"\\ \\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1@\\s\\<^sub>2; \\ is\\<^sub>2,xt\\<^sub>2 [::] \\s\\<^sub>2; size \\s\\<^sub>1 = size is\\<^sub>1 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\s\\<^sub>1@\\s\\<^sub>2\"\n(*<*)\napply(clarsimp simp:wt_instrs_def)\napply(rule conjI, fastforce)\napply(rule conjI, fastforce)\napply clarsimp\napply(rule conjI, fastforce simp:wt_instr_appRx)\napply clarsimp\napply(erule_tac x = \"pc - size is\\<^sub>1\" in allE)+\napply(thin_tac \"P \\ Q\" for P Q)\napply(erule impE, arith) \napply(drule_tac \\s' = \"\\s\\<^sub>1\" in wt_instr_appL)\n apply arith\n apply simp\napply(fastforce simp add:add.commute intro!: wt_instr_appLx)\ndone\n(*>*)\n\ncorollary (in TC2) wt_instrs_ext2:\n \"\\ \\ is\\<^sub>2,xt\\<^sub>2 [::] \\s\\<^sub>2; \\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1@\\s\\<^sub>2; size \\s\\<^sub>1 = size is\\<^sub>1 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\s\\<^sub>1@\\s\\<^sub>2\"\n(*<*)by(rule wt_instrs_ext)(*>*)\n\n\ncorollary (in TC2) wt_instrs_ext_prefix [trans]:\n \"\\ \\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1@\\s\\<^sub>2; \\ is\\<^sub>2,xt\\<^sub>2 [::] \\s\\<^sub>3;\n size \\s\\<^sub>1 = size is\\<^sub>1; prefix \\s\\<^sub>3 \\s\\<^sub>2 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\s\\<^sub>1@\\s\\<^sub>2\"\n(*<*)by(bestsimp simp:prefix_def elim: wt_instrs_ext dest:wt_instrs_extR)(*>*)\n\n\ncorollary (in TC2) wt_instrs_app:\n assumes is\\<^sub>1: \"\\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1@[\\]\"\n assumes is\\<^sub>2: \"\\ is\\<^sub>2,xt\\<^sub>2 [::] \\#\\s\\<^sub>2\"\n assumes s: \"size \\s\\<^sub>1 = size is\\<^sub>1\"\n shows \"\\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\s\\<^sub>1@\\#\\s\\<^sub>2\"\n(*<*)\nproof -\n from is\\<^sub>1 have \"\\ is\\<^sub>1,xt\\<^sub>1 [::] (\\s\\<^sub>1@[\\])@\\s\\<^sub>2\"\n by (rule wt_instrs_extR)\n hence \"\\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1@\\#\\s\\<^sub>2\" by simp\n from this is\\<^sub>2 s show ?thesis by (rule wt_instrs_ext) \nqed\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_app_last[trans]:\n \"\\ \\ is\\<^sub>2,xt\\<^sub>2 [::] \\#\\s\\<^sub>2; \\ is\\<^sub>1,xt\\<^sub>1 [::] \\s\\<^sub>1;\n last \\s\\<^sub>1 = \\; size \\s\\<^sub>1 = size is\\<^sub>1+1 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\s\\<^sub>1@\\s\\<^sub>2\"\n(*<*)\napply(cases \\s\\<^sub>1 rule:rev_cases)\n apply simp\napply(simp add:wt_instrs_app)\ndone\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_append_last[trans]:\n \"\\ \\ is,xt [::] \\s; P,T\\<^sub>r,mxs,mpc,[] \\ i,pc :: \\s;\n pc = size is; mpc = size \\s; size is + 1 < size \\s \\\n \\ \\ is@[i],xt [::] \\s\"\n(*<*)\napply(clarsimp simp add:wt_instrs_def)\napply(rule conjI, fastforce)\napply(fastforce intro!:wt_instr_appLx[where xt = \"[]\",simplified]\n dest!:less_antisym)\ndone\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_app2:\n \"\\ \\ is\\<^sub>2,xt\\<^sub>2 [::] \\'#\\s\\<^sub>2; \\ is\\<^sub>1,xt\\<^sub>1 [::] \\#\\s\\<^sub>1@[\\'];\n xt' = xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2; size \\s\\<^sub>1+1 = size is\\<^sub>1 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2,xt' [::] \\#\\s\\<^sub>1@\\'#\\s\\<^sub>2\"\n(*<*)using wt_instrs_app[where ?\\s\\<^sub>1.0 = \"\\ # \\s\\<^sub>1\"] by simp (*>*)\n\n\ncorollary (in TC2) wt_instrs_app2_simp[trans,simp]:\n \"\\ \\ is\\<^sub>2,xt\\<^sub>2 [::] \\'#\\s\\<^sub>2; \\ is\\<^sub>1,xt\\<^sub>1 [::] \\#\\s\\<^sub>1@[\\']; size \\s\\<^sub>1+1 = size is\\<^sub>1 \\\n \\ \\ is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\#\\s\\<^sub>1@\\'#\\s\\<^sub>2\"\n(*<*)using wt_instrs_app[where ?\\s\\<^sub>1.0 = \"\\ # \\s\\<^sub>1\"] by simp(*>*)\n\n\ncorollary (in TC2) wt_instrs_Cons[simp]:\n \"\\ \\s \\ []; \\ [i],[] [::] [\\,\\']; \\ is,xt [::] \\'#\\s \\\n \\ \\ i#is,shift 1 xt [::] \\#\\'#\\s\"\n(*<*)\nusing wt_instrs_app2[where ?is\\<^sub>1.0 = \"[i]\" and ?\\s\\<^sub>1.0 = \"[]\" and ?is\\<^sub>2.0 = \"is\"\n and ?xt\\<^sub>1.0 = \"[]\"]\nby simp\n\n\ncorollary (in TC2) wt_instrs_Cons2[trans]:\n assumes \\s: \"\\ is,xt [::] \\s\"\n assumes i: \"P,T\\<^sub>r,mxs,mpc,[] \\ i,0 :: \\#\\s\"\n assumes mpc: \"mpc = size \\s + 1\"\n shows \"\\ i#is,shift 1 xt [::] \\#\\s\"\n(*<*)\nproof -\n from \\s have \"\\s \\ []\" by (auto simp: wt_instrs_def)\n with mpc i have \"\\ [i],[] [::] [\\]@\\s\" by (simp add: wt_instrs_def)\n with \\s show ?thesis by (fastforce dest: wt_instrs_ext)\nqed\n(*>*)\n\n\nlemma (in TC2) wt_instrs_last_incr[trans]:\n \"\\ \\ is,xt [::] \\s@[\\]; P \\ \\ \\' \\' \\ \\ \\ is,xt [::] \\s@[\\']\"\n(*<*)\napply(clarsimp simp add:wt_instrs_def wt_instr_def)\napply(rule conjI)\napply(fastforce)\napply(clarsimp)\napply(rename_tac pc' tau')\napply(erule allE, erule (1) impE)\napply(clarsimp)\napply(drule (1) bspec)\napply(clarsimp)\napply(subgoal_tac \"pc' = size \\s\")\nprefer 2\napply(clarsimp simp:app_def)\napply(drule (1) bspec)\napply(clarsimp)\napply(auto elim!:sup_state_opt_trans)\ndone\n(*>*)\n\n\nlemma [iff]: \"xcpt_app i P pc mxs [] \\\"\n(*<*)by (simp add: xcpt_app_def relevant_entries_def)(*>*)\n\n\nlemma [simp]: \"xcpt_eff i P pc \\ [] = []\"\n(*<*)by (simp add: xcpt_eff_def relevant_entries_def)(*>*)\n\n\nlemma (in TC2) wt_New:\n \"\\ is_class P C; size ST < mxs \\ \\\n \\ [New C],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (Class C#ST) E A]\"\n(*<*)by(simp add:wt_defs ty\\<^sub>i'_def)(*>*)\n\n\nlemma (in TC2) wt_Cast:\n \"is_class P C \\\n \\ [Checkcast C],[] [::] [ty\\<^sub>i' (Class D # ST) E A, ty\\<^sub>i' (Class C # ST) E A]\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Push:\n \"\\ size ST < mxs; typeof v = Some T \\\n \\ \\ [Push v],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (T#ST) E A]\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Pop:\n \"\\ [Pop],[] [::] (ty\\<^sub>i' (T#ST) E A # ty\\<^sub>i' ST E A # \\s)\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_CmpEq:\n \"\\ P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1\\\n \\ \\ [CmpEq],[] [::] [ty\\<^sub>i' (T\\<^sub>2 # T\\<^sub>1 # ST) E A, ty\\<^sub>i' (Boolean # ST) E A]\"\n(*<*) by(auto simp:ty\\<^sub>i'_def wt_defs elim!: refTE not_refTE) (*>*)\n\n\nlemma (in TC2) wt_IAdd:\n \"\\ [IAdd],[] [::] [ty\\<^sub>i' (Integer#Integer#ST) E A, ty\\<^sub>i' (Integer#ST) E A]\"\n(*<*)by(simp add:ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Load:\n \"\\ size ST < mxs; size E \\ mxl; i \\\\ A; i < size E \\\n \\ \\ [Load i],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (E!i # ST) E A]\"\n(*<*)by(auto simp add:ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def hyperset_defs)(*>*)\n\n\nlemma (in TC2) wt_Store:\n \"\\ P \\ T \\ E!i; i < size E; size E \\ mxl \\ \\\n \\ [Store i],[] [::] [ty\\<^sub>i' (T#ST) E A, ty\\<^sub>i' ST E (\\{i}\\ \\ A)]\"\n(*<*)\nby(auto simp:hyperset_defs nth_list_update ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def\n intro:list_all2_all_nthI)\n(*>*)\n\n\nlemma (in TC2) wt_Get:\n \"\\ P \\ C sees F:T in D \\ \\\n \\ [Getfield F D],[] [::] [ty\\<^sub>i' (Class C # ST) E A, ty\\<^sub>i' (T # ST) E A]\"\n(*<*)by(auto simp: ty\\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above)(*>*)\n\n\nlemma (in TC2) wt_Put:\n \"\\ P \\ C sees F:T in D; P \\ T' \\ T \\ \\\n \\ [Putfield F D],[] [::] [ty\\<^sub>i' (T' # Class C # ST) E A, ty\\<^sub>i' ST E A]\"\n(*<*)by(auto intro: sees_field_idemp sees_field_decl_above simp: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Throw:\n \"\\ [Throw],[] [::] [ty\\<^sub>i' (Class C # ST) E A, \\']\"\n(*<*)by(auto simp: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_IfFalse:\n \"\\ 2 \\ i; nat i < size \\s + 2; P \\ ty\\<^sub>i' ST E A \\' \\s ! nat(i - 2) \\\n \\ \\ [IfFalse i],[] [::] ty\\<^sub>i' (Boolean # ST) E A # ty\\<^sub>i' ST E A # \\s\"\n(*<*)\nby(simp add: ty\\<^sub>i'_def wt_defs eval_nat_numeral nat_diff_distrib)\n(*>*)\n\n\nlemma wt_Goto:\n \"\\ 0 \\ int pc + i; nat (int pc + i) < size \\s; size \\s \\ mpc;\n P \\ \\s!pc \\' \\s ! nat (int pc + i) \\\n \\ P,T,mxs,mpc,[] \\ Goto i,pc :: \\s\"\n(*<*)by(clarsimp simp add: TC2.wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Invoke:\n \"\\ size es = size Ts'; P \\ C sees M: Ts\\T = m in D; P \\ Ts' [\\] Ts \\\n \\ \\ [Invoke M (size es)],[] [::] [ty\\<^sub>i' (rev Ts' @ Class C # ST) E A, ty\\<^sub>i' (T#ST) E A]\"\n(*<*)by(fastforce simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\ncorollary (in TC2) wt_instrs_app3[simp]:\n \"\\ \\ is\\<^sub>2,[] [::] (\\' # \\s\\<^sub>2); \\ is\\<^sub>1,xt\\<^sub>1 [::] \\ # \\s\\<^sub>1 @ [\\']; size \\s\\<^sub>1+1 = size is\\<^sub>1\\\n \\ \\ (is\\<^sub>1 @ is\\<^sub>2),xt\\<^sub>1 [::] \\ # \\s\\<^sub>1 @ \\' # \\s\\<^sub>2\"\n(*<*)using wt_instrs_app2[where ?xt\\<^sub>2.0 = \"[]\"] by (simp add:shift_def)(*>*)\n\n\ncorollary (in TC2) wt_instrs_Cons3[simp]:\n \"\\ \\s \\ []; \\ [i],[] [::] [\\,\\']; \\ is,[] [::] \\'#\\s \\\n \\ \\ (i # is),[] [::] \\ # \\' # \\s\"\n(*<*)\nusing wt_instrs_Cons[where ?xt = \"[]\"]\nby (simp add:shift_def)\n\n(*<*)\ndeclare nth_append[simp del]\ndeclare [[simproc del: list_to_set_comprehension]]\n(*>*)\n\nlemma (in TC2) wt_instrs_xapp[trans]:\n \"\\ \\ is\\<^sub>1 @ is\\<^sub>2, xt [::] \\s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\s\\<^sub>2;\n \\\\ \\ set \\s\\<^sub>1. \\ST' LT'. \\ = Some(ST',LT') \\ \n size ST \\ size ST' \\ P \\ Some (drop (size ST' - size ST) ST',LT') \\' ty\\<^sub>i' ST E A;\n size is\\<^sub>1 = size \\s\\<^sub>1; is_class P C; size ST < mxs \\ \\\n \\ is\\<^sub>1 @ is\\<^sub>2, xt @ [(0,size is\\<^sub>1 - 1,C,size is\\<^sub>1,size ST)] [::] \\s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\s\\<^sub>2\"\n(*<*)\napply(simp add:wt_instrs_def)\napply(rule conjI)\n apply(clarsimp)\n apply arith\napply clarsimp\napply(erule allE, erule (1) impE)\napply(clarsimp simp add: wt_instr_def app_def eff_def)\napply(rule conjI)\n apply (thin_tac \"\\x\\ A \\ B. P x\" for A B P)\n apply (thin_tac \"\\x\\ A \\ B. P x\" for A B P)\n apply (clarsimp simp add: xcpt_app_def relevant_entries_def)\n apply (simp add: nth_append is_relevant_entry_def split!: if_splits)\n apply (drule_tac x=\"\\s\\<^sub>1!pc\" in bspec)\n apply (blast intro: nth_mem) \n apply fastforce\napply (rule conjI)\n apply clarsimp\n apply (erule disjE, blast)\n apply (erule disjE, blast)\n apply (clarsimp simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)\napply clarsimp\napply (erule disjE, blast)\napply (erule disjE, blast)\napply (clarsimp simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)\napply (simp add: nth_append is_relevant_entry_def split: if_split_asm)\n apply (drule_tac x = \"\\s\\<^sub>1!pc\" in bspec)\n apply (blast intro: nth_mem) \n apply (fastforce simp add: ty\\<^sub>i'_def)\ndone\n\ndeclare [[simproc add: list_to_set_comprehension]]\ndeclare nth_append[simp]\n(*>*)\n\nlemma drop_Cons_Suc:\n \"\\xs. drop n xs = y#ys \\ drop (Suc n) xs = ys\"\n apply (induct n)\n apply simp\n apply (simp add: drop_Suc)\n done\n\nlemma drop_mess:\n \"\\Suc (length xs\\<^sub>0) \\ length xs; drop (length xs - Suc (length xs\\<^sub>0)) xs = x # xs\\<^sub>0\\ \n \\ drop (length xs - length xs\\<^sub>0) xs = xs\\<^sub>0\"\napply (cases xs)\n apply simp\napply (simp add: Suc_diff_le)\napply (case_tac \"length list - length xs\\<^sub>0\")\n apply simp\napply (simp add: drop_Cons_Suc)\ndone\n\n(*<*)\ndeclare (in TC0)\n after_def[simp] pair_eq_ty\\<^sub>i'_conv[simp]\n(*>*)\n\nlemma (in TC1) compT_ST_prefix:\n \"\\E A ST\\<^sub>0. \\(ST,LT)\\ \\ set(compT E A ST\\<^sub>0 e) \\ \n size ST\\<^sub>0 \\ size ST \\ drop (size ST - size ST\\<^sub>0) ST = ST\\<^sub>0\"\nand\n \"\\E A ST\\<^sub>0. \\(ST,LT)\\ \\ set(compTs E A ST\\<^sub>0 es) \\ \n size ST\\<^sub>0 \\ size ST \\ drop (size ST - size ST\\<^sub>0) ST = ST\\<^sub>0\"\n(*<*)\nproof(induct e and es rule: compT.induct compTs.induct)\n case (FAss e\\<^sub>1 F D e\\<^sub>2)\n moreover {\n let ?ST\\<^sub>0 = \"ty E e\\<^sub>1 # ST\\<^sub>0\"\n fix A assume \"\\(ST, LT)\\ \\ set (compT E A ?ST\\<^sub>0 e\\<^sub>2)\"\n with FAss\n have \"length ?ST\\<^sub>0 \\ length ST \\ drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n hence ?case by (clarsimp simp add: drop_mess)\n }\n ultimately show ?case by auto\nnext\n case TryCatch thus ?case by auto\nnext\n case Block thus ?case by auto\nnext\n case Seq thus ?case by auto\nnext\n case While thus ?case by auto\nnext\n case Cond thus ?case by auto\nnext\n case (Call e M es)\n moreover {\n let ?ST\\<^sub>0 = \"ty E e # ST\\<^sub>0\"\n fix A assume \"\\(ST, LT)\\ \\ set (compTs E A ?ST\\<^sub>0 es)\"\n with Call\n have \"length ?ST\\<^sub>0 \\ length ST \\ drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n hence ?case by (clarsimp simp add: drop_mess)\n }\n ultimately show ?case by auto\nnext\n case (Cons_exp e es)\n moreover {\n let ?ST\\<^sub>0 = \"ty E e # ST\\<^sub>0\"\n fix A assume \"\\(ST, LT)\\ \\ set (compTs E A ?ST\\<^sub>0 es)\"\n with Cons_exp\n have \"length ?ST\\<^sub>0 \\ length ST \\ drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n hence ?case by (clarsimp simp add: drop_mess)\n }\n ultimately show ?case by auto\nnext\n case (BinOp e\\<^sub>1 bop e\\<^sub>2)\n moreover {\n let ?ST\\<^sub>0 = \"ty E e\\<^sub>1 # ST\\<^sub>0\"\n fix A assume \"\\(ST, LT)\\ \\ set (compT E A ?ST\\<^sub>0 e\\<^sub>2)\"\n with BinOp \n have \"length ?ST\\<^sub>0 \\ length ST \\ drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n hence ?case by (clarsimp simp add: drop_mess)\n }\n ultimately show ?case by auto\nnext\n case new thus ?case by auto\nnext\n case Val thus ?case by auto \nnext\n case Cast thus ?case by auto\nnext\n case Var thus ?case by auto\nnext\n case LAss thus ?case by auto\nnext\n case throw thus ?case by auto\nnext\n case FAcc thus ?case by auto\nnext\n case Nil_exp thus ?case by auto\nqed \n\ndeclare (in TC0) \n after_def[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n(*>*)\n\n(* FIXME *)\nlemma fun_of_simp [simp]: \"fun_of S x y = ((x,y) \\ S)\" \n(*<*) by (simp add: fun_of_def)(*>*)\n\ntheorem (in TC2) compT_wt_instrs: \"\\E T A ST.\n \\ P,E \\\\<^sub>1 e :: T; \\ e A; \\ e (size E); \n size ST + max_stack e \\ mxs; size E + max_vars e \\ mxl \\\n \\ \\ compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::]\n ty\\<^sub>i' ST E A # compT E A ST e @ [after E A ST e]\"\n(*<*)(is \"\\E T A ST. PROP ?P e E T A ST\")(*>*)\n\nand \"\\E Ts A ST.\n \\ P,E \\\\<^sub>1 es[::]Ts; \\s es A; \\s es (size E); \n size ST + max_stacks es \\ mxs; size E + max_varss es \\ mxl \\\n \\ let \\s = ty\\<^sub>i' ST E A # compTs E A ST es in\n \\ compEs\\<^sub>2 es,compxEs\\<^sub>2 es 0 (size ST) [::] \\s \\\n last \\s = ty\\<^sub>i' (rev Ts @ ST) E (A \\ \\s es)\"\n(*<*)\n(is \"\\E Ts A ST. PROP ?Ps es E Ts A ST\")\nproof(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\n case (TryCatch e\\<^sub>1 C i e\\<^sub>2)\n hence [simp]: \"i = size E\" by simp\n have wt\\<^sub>1: \"P,E \\\\<^sub>1 e\\<^sub>1 :: T\" and wt\\<^sub>2: \"P,E@[Class C] \\\\<^sub>1 e\\<^sub>2 :: T\"\n and \"class\": \"is_class P C\" using TryCatch by auto\n let ?A\\<^sub>1 = \"A \\ \\ e\\<^sub>1\" let ?A\\<^sub>i = \"A \\ \\{i}\\\" let ?E\\<^sub>i = \"E @ [Class C]\"\n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n let ?\\\\<^sub>1 = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>1\" let ?\\\\<^sub>2 = \"ty\\<^sub>i' (Class C#ST) E A\"\n let ?\\\\<^sub>3 = \"ty\\<^sub>i' ST ?E\\<^sub>i ?A\\<^sub>i\" let ?\\s\\<^sub>2 = \"compT ?E\\<^sub>i ?A\\<^sub>i ST e\\<^sub>2\"\n let ?\\\\<^sub>2' = \"ty\\<^sub>i' (T#ST) ?E\\<^sub>i (?A\\<^sub>i \\ \\ e\\<^sub>2)\"\n let ?\\' = \"ty\\<^sub>i' (T#ST) E (A \\ \\ e\\<^sub>1 \\ (\\ e\\<^sub>2 \\ i))\"\n let ?go = \"Goto (int(size(compE\\<^sub>2 e\\<^sub>2)) + 2)\"\n have \"PROP ?P e\\<^sub>2 ?E\\<^sub>i T ?A\\<^sub>i ST\" by fact\n hence \"\\ compE\\<^sub>2 e\\<^sub>2,compxE\\<^sub>2 e\\<^sub>2 0 (size ST) [::] (?\\\\<^sub>3 # ?\\s\\<^sub>2) @ [?\\\\<^sub>2']\"\n using TryCatch.prems by(auto simp:after_def)\n also have \"?A\\<^sub>i \\ \\ e\\<^sub>2 = (A \\ \\ e\\<^sub>2) \\ \\{size E}\\\"\n by(fastforce simp:hyperset_defs)\n also have \"P \\ ty\\<^sub>i' (T#ST) ?E\\<^sub>i \\ \\' ty\\<^sub>i' (T#ST) E (A \\ \\ e\\<^sub>2)\"\n by(simp add:hyperset_defs ty\\<^sub>l_incr ty\\<^sub>i'_def)\n also have \"P \\ \\ \\' ty\\<^sub>i' (T#ST) E (A \\ \\ e\\<^sub>1 \\ (\\ e\\<^sub>2 \\ i))\"\n by(auto intro!: ty\\<^sub>l_antimono simp:hyperset_defs ty\\<^sub>i'_def)\n also have \"(?\\\\<^sub>3 # ?\\s\\<^sub>2) @ [?\\'] = ?\\\\<^sub>3 # ?\\s\\<^sub>2 @ [?\\']\" by simp\n also have \"\\ [Store i],[] [::] ?\\\\<^sub>2 # [] @ [?\\\\<^sub>3]\"\n using TryCatch.prems\n by(auto simp:nth_list_update wt_defs ty\\<^sub>i'_def ty\\<^sub>l_def\n list_all2_conv_all_nth hyperset_defs)\n also have \"[] @ (?\\\\<^sub>3 # ?\\s\\<^sub>2 @ [?\\']) = (?\\\\<^sub>3 # ?\\s\\<^sub>2 @ [?\\'])\" by simp\n also have \"P,T\\<^sub>r,mxs,size(compE\\<^sub>2 e\\<^sub>2)+3,[] \\ ?go,0 :: ?\\\\<^sub>1#?\\\\<^sub>2#?\\\\<^sub>3#?\\s\\<^sub>2 @ [?\\']\"\n by (auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs nth_Cons nat_add_distrib\n fun_of_def intro: ty\\<^sub>l_antimono list_all2_refl split:nat.split)\n also have \"\\ compE\\<^sub>2 e\\<^sub>1,compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\ # ?\\s\\<^sub>1 @ [?\\\\<^sub>1]\"\n using TryCatch by(auto simp:after_def)\n also have \"?\\ # ?\\s\\<^sub>1 @ ?\\\\<^sub>1 # ?\\\\<^sub>2 # ?\\\\<^sub>3 # ?\\s\\<^sub>2 @ [?\\'] =\n (?\\ # ?\\s\\<^sub>1 @ [?\\\\<^sub>1]) @ ?\\\\<^sub>2 # ?\\\\<^sub>3 # ?\\s\\<^sub>2 @ [?\\']\" by simp\n also have \"compE\\<^sub>2 e\\<^sub>1 @ ?go # [Store i] @ compE\\<^sub>2 e\\<^sub>2 =\n (compE\\<^sub>2 e\\<^sub>1 @ [?go]) @ (Store i # compE\\<^sub>2 e\\<^sub>2)\" by simp\n also \n let \"?Q \\\" = \"\\ST' LT'. \\ = \\(ST', LT')\\ \\ \n size ST \\ size ST' \\ P \\ Some (drop (size ST' - size ST) ST',LT') \\' ty\\<^sub>i' ST E A\"\n {\n have \"?Q (ty\\<^sub>i' ST E A)\" by (clarsimp simp add: ty\\<^sub>i'_def)\n moreover have \"?Q (ty\\<^sub>i' (T # ST) E ?A\\<^sub>1)\" \n by (fastforce simp add: ty\\<^sub>i'_def hyperset_defs intro!: ty\\<^sub>l_antimono)\n moreover have \"\\\\. \\ \\ set (compT E A ST e\\<^sub>1) \\ ?Q \\\" using TryCatch.prems\n by clarsimp (frule compT_ST_prefix,\n fastforce dest!: compT_LT_prefix simp add: ty\\<^sub>i'_def)\n ultimately\n have \"\\\\\\set (ty\\<^sub>i' ST E A # compT E A ST e\\<^sub>1 @ [ty\\<^sub>i' (T # ST) E ?A\\<^sub>1]). ?Q \\\" \n by auto\n }\n also from TryCatch.prems max_stack1[of e\\<^sub>1] have \"size ST + 1 \\ mxs\" by auto\n ultimately show ?case using wt\\<^sub>1 wt\\<^sub>2 TryCatch.prems \"class\"\n by (simp add:after_def)\nnext\n case new thus ?case by(auto simp add:after_def wt_New)\nnext\n case (BinOp e\\<^sub>1 bop e\\<^sub>2) \n let ?op = \"case bop of Eq \\ [CmpEq] | Add \\ [IAdd]\"\n have T: \"P,E \\\\<^sub>1 e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\" by fact\n then obtain T\\<^sub>1 T\\<^sub>2 where T\\<^sub>1: \"P,E \\\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1\" and T\\<^sub>2: \"P,E \\\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2\" and \n bopT: \"case bop of Eq \\ (P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1) \\ T = Boolean \n | Add \\ T\\<^sub>1 = Integer \\ T\\<^sub>2 = Integer \\ T = Integer\" by auto\n let ?A\\<^sub>1 = \"A \\ \\ e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\ \\ e\\<^sub>2\"\n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n let ?\\\\<^sub>1 = \"ty\\<^sub>i' (T\\<^sub>1#ST) E ?A\\<^sub>1\" let ?\\s\\<^sub>2 = \"compT E ?A\\<^sub>1 (T\\<^sub>1#ST) e\\<^sub>2\"\n let ?\\\\<^sub>2 = \"ty\\<^sub>i' (T\\<^sub>2#T\\<^sub>1#ST) E ?A\\<^sub>2\" let ?\\' = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>2\"\n from bopT have \"\\ ?op,[] [::] [?\\\\<^sub>2,?\\']\" \n by (cases bop) (auto simp add: wt_CmpEq wt_IAdd)\n also have \"PROP ?P e\\<^sub>2 E T\\<^sub>2 ?A\\<^sub>1 (T\\<^sub>1#ST)\" by fact\n with BinOp.prems T\\<^sub>2 \n have \"\\ compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size (T\\<^sub>1#ST)) [::] ?\\\\<^sub>1#?\\s\\<^sub>2@[?\\\\<^sub>2]\" \n by (auto simp: after_def)\n also from BinOp T\\<^sub>1 have \"\\ compE\\<^sub>2 e\\<^sub>1, compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\#?\\s\\<^sub>1@[?\\\\<^sub>1]\" \n by (auto simp: after_def)\n finally show ?case using T T\\<^sub>1 T\\<^sub>2 by (simp add: after_def hyperUn_assoc)\nnext\n case (Cons_exp e es)\n have \"P,E \\\\<^sub>1 e # es [::] Ts\" by fact\n then obtain T\\<^sub>e Ts' where \n T\\<^sub>e: \"P,E \\\\<^sub>1 e :: T\\<^sub>e\" and Ts': \"P,E \\\\<^sub>1 es [::] Ts'\" and\n Ts: \"Ts = T\\<^sub>e#Ts'\" by auto\n let ?A\\<^sub>e = \"A \\ \\ e\" \n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>e = \"compT E A ST e\" \n let ?\\\\<^sub>e = \"ty\\<^sub>i' (T\\<^sub>e#ST) E ?A\\<^sub>e\" let ?\\s' = \"compTs E ?A\\<^sub>e (T\\<^sub>e#ST) es\"\n let ?\\s = \"?\\ # ?\\s\\<^sub>e @ (?\\\\<^sub>e # ?\\s')\"\n have Ps: \"PROP ?Ps es E Ts' ?A\\<^sub>e (T\\<^sub>e#ST)\" by fact\n with Cons_exp.prems T\\<^sub>e Ts'\n have \"\\ compEs\\<^sub>2 es, compxEs\\<^sub>2 es 0 (size (T\\<^sub>e#ST)) [::] ?\\\\<^sub>e#?\\s'\" by (simp add: after_def)\n also from Cons_exp T\\<^sub>e have \"\\ compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::] ?\\#?\\s\\<^sub>e@[?\\\\<^sub>e]\" \n by (auto simp: after_def)\n moreover\n from Ps Cons_exp.prems T\\<^sub>e Ts' Ts\n have \"last ?\\s = ty\\<^sub>i' (rev Ts@ST) E (?A\\<^sub>e \\ \\s es)\" by simp\n ultimately show ?case using T\\<^sub>e by (simp add: after_def hyperUn_assoc)\nnext\n case (FAss e\\<^sub>1 F D e\\<^sub>2)\n hence Void: \"P,E \\\\<^sub>1 e\\<^sub>1\\F{D} := e\\<^sub>2 :: Void\" by auto\n then obtain C T T' where \n C: \"P,E \\\\<^sub>1 e\\<^sub>1 :: Class C\" and sees: \"P \\ C sees F:T in D\" and\n T': \"P,E \\\\<^sub>1 e\\<^sub>2 :: T'\" and T'_T: \"P \\ T' \\ T\" by auto\n let ?A\\<^sub>1 = \"A \\ \\ e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\ \\ e\\<^sub>2\" \n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n let ?\\\\<^sub>1 = \"ty\\<^sub>i' (Class C#ST) E ?A\\<^sub>1\" let ?\\s\\<^sub>2 = \"compT E ?A\\<^sub>1 (Class C#ST) e\\<^sub>2\"\n let ?\\\\<^sub>2 = \"ty\\<^sub>i' (T'#Class C#ST) E ?A\\<^sub>2\" let ?\\\\<^sub>3 = \"ty\\<^sub>i' ST E ?A\\<^sub>2\"\n let ?\\' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>2\"\n from FAss.prems sees T'_T \n have \"\\ [Putfield F D,Push Unit],[] [::] [?\\\\<^sub>2,?\\\\<^sub>3,?\\']\"\n by (fastforce simp add: wt_Push wt_Put)\n also have \"PROP ?P e\\<^sub>2 E T' ?A\\<^sub>1 (Class C#ST)\" by fact\n with FAss.prems T' \n have \"\\ compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size ST+1) [::] ?\\\\<^sub>1#?\\s\\<^sub>2@[?\\\\<^sub>2]\"\n by (auto simp add: after_def hyperUn_assoc) \n also from FAss C have \"\\ compE\\<^sub>2 e\\<^sub>1, compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\#?\\s\\<^sub>1@[?\\\\<^sub>1]\" \n by (auto simp add: after_def)\n finally show ?case using Void C T' by (simp add: after_def hyperUn_assoc) \nnext\n case Val thus ?case by(auto simp:after_def wt_Push)\nnext\n case Cast thus ?case by (auto simp:after_def wt_Cast)\nnext\n case (Block i T\\<^sub>i e)\n let ?\\s = \"ty\\<^sub>i' ST E A # compT (E @ [T\\<^sub>i]) (A\\i) ST e\"\n have IH: \"PROP ?P e (E@[T\\<^sub>i]) T (A\\i) ST\" by fact\n hence \"\\ compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::]\n ?\\s @ [ty\\<^sub>i' (T#ST) (E@[T\\<^sub>i]) (A\\(size E) \\ \\ e)]\"\n using Block.prems by (auto simp add: after_def)\n also have \"P \\ ty\\<^sub>i' (T # ST) (E@[T\\<^sub>i]) (A \\ size E \\ \\ e) \\'\n ty\\<^sub>i' (T # ST) (E@[T\\<^sub>i]) ((A \\ \\ e) \\ size E)\"\n by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n also have \"\\ = ty\\<^sub>i' (T # ST) E (A \\ \\ e)\" by simp\n also have \"P \\ \\ \\' ty\\<^sub>i' (T # ST) E (A \\ (\\ e \\ i))\"\n by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n finally show ?case using Block.prems by(simp add: after_def)\nnext\n case Var thus ?case by(auto simp:after_def wt_Load)\nnext\n case FAcc thus ?case by(auto simp:after_def wt_Get)\nnext\n case (LAss i e) thus ?case using max_stack1[of e]\n by(auto simp: hyper_insert_comm after_def wt_Store wt_Push)\nnext\n case Nil_exp thus ?case by auto\nnext\n case throw thus ?case by(auto simp add: after_def wt_Throw)\nnext\n case (While e c)\n obtain Tc where wte: \"P,E \\\\<^sub>1 e :: Boolean\" and wtc: \"P,E \\\\<^sub>1 c :: Tc\"\n and [simp]: \"T = Void\" using While by auto\n have [simp]: \"ty E (while (e) c) = Void\" using While by simp\n let ?A\\<^sub>0 = \"A \\ \\ e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\ \\ c\"\n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>e = \"compT E A ST e\"\n let ?\\\\<^sub>e = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\" let ?\\\\<^sub>1 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\"\n let ?\\s\\<^sub>c = \"compT E ?A\\<^sub>0 ST c\" let ?\\\\<^sub>c = \"ty\\<^sub>i' (Tc#ST) E ?A\\<^sub>1\"\n let ?\\\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>1\" let ?\\' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>0\"\n let ?\\s = \"(?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e]) @ ?\\\\<^sub>1 # ?\\s\\<^sub>c @ [?\\\\<^sub>c, ?\\\\<^sub>2, ?\\\\<^sub>1, ?\\']\"\n have \"\\ [],[] [::] [] @ ?\\s\" by(simp add:wt_instrs_def)\n also\n have \"PROP ?P e E Boolean A ST\" by fact\n hence \"\\ compE\\<^sub>2 e,compxE\\<^sub>2 e 0 (size ST) [::] ?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e]\"\n using While.prems by (auto simp:after_def)\n also\n have \"[] @ ?\\s = (?\\ # ?\\s\\<^sub>e) @ ?\\\\<^sub>e # ?\\\\<^sub>1 # ?\\s\\<^sub>c @ [?\\\\<^sub>c,?\\\\<^sub>2,?\\\\<^sub>1,?\\']\" by simp\n also\n let ?n\\<^sub>e = \"size(compE\\<^sub>2 e)\" let ?n\\<^sub>c = \"size(compE\\<^sub>2 c)\"\n let ?if = \"IfFalse (int ?n\\<^sub>c + 3)\"\n have \"\\ [?if],[] [::] ?\\\\<^sub>e # ?\\\\<^sub>1 # ?\\s\\<^sub>c @ [?\\\\<^sub>c, ?\\\\<^sub>2, ?\\\\<^sub>1, ?\\']\"\n by(simp add: wt_instr_Cons wt_instr_append wt_IfFalse\n nat_add_distrib split: nat_diff_split)\n also\n have \"(?\\ # ?\\s\\<^sub>e) @ (?\\\\<^sub>e # ?\\\\<^sub>1 # ?\\s\\<^sub>c @ [?\\\\<^sub>c, ?\\\\<^sub>2, ?\\\\<^sub>1, ?\\']) = ?\\s\" by simp\n also\n have \"PROP ?P c E Tc ?A\\<^sub>0 ST\" by fact\n hence \"\\ compE\\<^sub>2 c,compxE\\<^sub>2 c 0 (size ST) [::] ?\\\\<^sub>1 # ?\\s\\<^sub>c @ [?\\\\<^sub>c]\"\n using While.prems wtc by (auto simp:after_def)\n also have \"?\\s = (?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e,?\\\\<^sub>1] @ ?\\s\\<^sub>c) @ [?\\\\<^sub>c,?\\\\<^sub>2,?\\\\<^sub>1,?\\']\" by simp\n also have \"\\ [Pop],[] [::] [?\\\\<^sub>c, ?\\\\<^sub>2]\" by(simp add:wt_Pop)\n also have \"(?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e,?\\\\<^sub>1] @ ?\\s\\<^sub>c) @ [?\\\\<^sub>c,?\\\\<^sub>2,?\\\\<^sub>1,?\\'] = ?\\s\" by simp\n also let ?go = \"Goto (-int(?n\\<^sub>c+?n\\<^sub>e+2))\"\n have \"P \\ ?\\\\<^sub>2 \\' ?\\\" by(fastforce intro: ty\\<^sub>i'_antimono simp: hyperset_defs)\n hence \"P,T\\<^sub>r,mxs,size ?\\s,[] \\ ?go,?n\\<^sub>e+?n\\<^sub>c+2 :: ?\\s\"\n by(simp add: wt_Goto split: nat_diff_split)\n also have \"?\\s = (?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e,?\\\\<^sub>1] @ ?\\s\\<^sub>c @ [?\\\\<^sub>c, ?\\\\<^sub>2]) @ [?\\\\<^sub>1, ?\\']\"\n by simp\n also have \"\\ [Push Unit],[] [::] [?\\\\<^sub>1,?\\']\"\n using While.prems max_stack1[of c] by(auto simp add:wt_Push)\n finally show ?case using wtc wte\n by (simp add:after_def)\nnext\n case (Cond e e\\<^sub>1 e\\<^sub>2)\n obtain T\\<^sub>1 T\\<^sub>2 where wte: \"P,E \\\\<^sub>1 e :: Boolean\"\n and wt\\<^sub>1: \"P,E \\\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1\" and wt\\<^sub>2: \"P,E \\\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2\"\n and sub\\<^sub>1: \"P \\ T\\<^sub>1 \\ T\" and sub\\<^sub>2: \"P \\ T\\<^sub>2 \\ T\"\n using Cond by auto\n have [simp]: \"ty E (if (e) e\\<^sub>1 else e\\<^sub>2) = T\" using Cond by simp\n let ?A\\<^sub>0 = \"A \\ \\ e\" let ?A\\<^sub>2 = \"?A\\<^sub>0 \\ \\ e\\<^sub>2\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\ \\ e\\<^sub>1\"\n let ?A' = \"?A\\<^sub>0 \\ \\ e\\<^sub>1 \\ \\ e\\<^sub>2\"\n let ?\\\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\" let ?\\' = \"ty\\<^sub>i' (T#ST) E ?A'\"\n let ?\\s\\<^sub>2 = \"compT E ?A\\<^sub>0 ST e\\<^sub>2\"\n have \"PROP ?P e\\<^sub>2 E T\\<^sub>2 ?A\\<^sub>0 ST\" by fact\n hence \"\\ compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size ST) [::] (?\\\\<^sub>2#?\\s\\<^sub>2) @ [ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2]\"\n using Cond.prems wt\\<^sub>2 by(auto simp add:after_def)\n also have \"P \\ ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2 \\' ?\\'\" using sub\\<^sub>2\n by(auto simp add: hyperset_defs ty\\<^sub>i'_def intro!: ty\\<^sub>l_antimono)\n also\n let ?\\\\<^sub>3 = \"ty\\<^sub>i' (T\\<^sub>1 # ST) E ?A\\<^sub>1\"\n let ?g\\<^sub>2 = \"Goto(int (size (compE\\<^sub>2 e\\<^sub>2) + 1))\"\n from sub\\<^sub>1 have \"P,T\\<^sub>r,mxs,size(compE\\<^sub>2 e\\<^sub>2)+2,[] \\ ?g\\<^sub>2,0 :: ?\\\\<^sub>3#(?\\\\<^sub>2#?\\s\\<^sub>2)@[?\\']\"\n by(auto simp: hyperset_defs wt_defs nth_Cons ty\\<^sub>i'_def\n split:nat.split intro!: ty\\<^sub>l_antimono)\n also\n let ?\\s\\<^sub>1 = \"compT E ?A\\<^sub>0 ST e\\<^sub>1\"\n have \"PROP ?P e\\<^sub>1 E T\\<^sub>1 ?A\\<^sub>0 ST\" by fact\n hence \"\\ compE\\<^sub>2 e\\<^sub>1,compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\\\<^sub>2 # ?\\s\\<^sub>1 @ [?\\\\<^sub>3]\"\n using Cond.prems wt\\<^sub>1 by(auto simp add:after_def)\n also\n let ?\\s\\<^sub>1\\<^sub>2 = \"?\\\\<^sub>2 # ?\\s\\<^sub>1 @ ?\\\\<^sub>3 # (?\\\\<^sub>2 # ?\\s\\<^sub>2) @ [?\\']\"\n let ?\\\\<^sub>1 = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\"\n let ?g\\<^sub>1 = \"IfFalse(int (size (compE\\<^sub>2 e\\<^sub>1) + 2))\"\n let ?code = \"compE\\<^sub>2 e\\<^sub>1 @ ?g\\<^sub>2 # compE\\<^sub>2 e\\<^sub>2\"\n have \"\\ [?g\\<^sub>1],[] [::] [?\\\\<^sub>1] @ ?\\s\\<^sub>1\\<^sub>2\"\n by(simp add: wt_IfFalse nat_add_distrib split:nat_diff_split)\n also (wt_instrs_ext2) have \"[?\\\\<^sub>1] @ ?\\s\\<^sub>1\\<^sub>2 = ?\\\\<^sub>1 # ?\\s\\<^sub>1\\<^sub>2\" by simp also\n let ?\\ = \"ty\\<^sub>i' ST E A\"\n have \"PROP ?P e E Boolean A ST\" by fact\n hence \"\\ compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::] ?\\ # compT E A ST e @ [?\\\\<^sub>1]\"\n using Cond.prems wte by(auto simp add:after_def)\n finally show ?case using wte wt\\<^sub>1 wt\\<^sub>2 by(simp add:after_def hyperUn_assoc)\nnext\n case (Call e M es)\n obtain C D Ts m Ts' where C: \"P,E \\\\<^sub>1 e :: Class C\"\n and \"method\": \"P \\ C sees M:Ts \\ T = m in D\"\n and wtes: \"P,E \\\\<^sub>1 es [::] Ts'\" and subs: \"P \\ Ts' [\\] Ts\"\n using Call.prems by auto\n from wtes have same_size: \"size es = size Ts'\" by(rule WTs\\<^sub>1_same_size)\n let ?A\\<^sub>0 = \"A \\ \\ e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\ \\s es\"\n let ?\\ = \"ty\\<^sub>i' ST E A\" let ?\\s\\<^sub>e = \"compT E A ST e\"\n let ?\\\\<^sub>e = \"ty\\<^sub>i' (Class C # ST) E ?A\\<^sub>0\"\n let ?\\s\\<^sub>e\\<^sub>s = \"compTs E ?A\\<^sub>0 (Class C # ST) es\"\n let ?\\\\<^sub>1 = \"ty\\<^sub>i' (rev Ts' @ Class C # ST) E ?A\\<^sub>1\"\n let ?\\' = \"ty\\<^sub>i' (T # ST) E ?A\\<^sub>1\"\n have \"\\ [Invoke M (size es)],[] [::] [?\\\\<^sub>1,?\\']\"\n by(rule wt_Invoke[OF same_size \"method\" subs])\n also\n have \"PROP ?Ps es E Ts' ?A\\<^sub>0 (Class C # ST)\" by fact\n hence \"\\ compEs\\<^sub>2 es,compxEs\\<^sub>2 es 0 (size ST+1) [::] ?\\\\<^sub>e # ?\\s\\<^sub>e\\<^sub>s\"\n \"last (?\\\\<^sub>e # ?\\s\\<^sub>e\\<^sub>s) = ?\\\\<^sub>1\"\n using Call.prems wtes by(auto simp add:after_def)\n also have \"(?\\\\<^sub>e # ?\\s\\<^sub>e\\<^sub>s) @ [?\\'] = ?\\\\<^sub>e # ?\\s\\<^sub>e\\<^sub>s @ [?\\']\" by simp\n also have \"\\ compE\\<^sub>2 e,compxE\\<^sub>2 e 0 (size ST) [::] ?\\ # ?\\s\\<^sub>e @ [?\\\\<^sub>e]\"\n using Call C by(auto simp add:after_def)\n finally show ?case using Call.prems C by(simp add:after_def hyperUn_assoc)\nnext\n case Seq thus ?case\n by(auto simp:after_def)\n (fastforce simp:wt_Push wt_Pop hyperUn_assoc\n intro:wt_instrs_app2 wt_instrs_Cons)\nqed\n(*>*)\n\n\nlemma [simp]: \"types (compP f P) = types P\"\n(*<*)by auto(*>*)\n\nlemma [simp]: \"states (compP f P) mxs mxl = states P mxs mxl\"\n(*<*)by (simp add: JVM_states_unfold)(*>*)\n\nlemma [simp]: \"app\\<^sub>i (i, compP f P, pc, mpc, T, \\) = app\\<^sub>i (i, P, pc, mpc, T, \\)\"\n(*<*)\n apply (cases \\) \n apply (cases i)\n apply auto\n apply (fastforce dest!: sees_method_compPD)\n apply (force dest: sees_method_compP)\n done\n(*>*)\n \nlemma [simp]: \"is_relevant_entry (compP f P) i = is_relevant_entry P i\"\n(*<*)\n apply (rule ext)+\n apply (unfold is_relevant_entry_def)\n apply (cases i)\n apply auto\n done\n(*>*)\n\nlemma [simp]: \"relevant_entries (compP f P) i pc xt = relevant_entries P i pc xt\"\n(*<*) by (simp add: relevant_entries_def)(*>*)\n\nlemma [simp]: \"app i (compP f P) mpc T pc mxl xt \\ = app i P mpc T pc mxl xt \\\"\n(*<*)\n apply (simp add: app_def xcpt_app_def eff_def xcpt_eff_def norm_eff_def)\n apply (fastforce simp add: image_def)\n done\n(*>*)\n\nlemma [simp]: \"app i P mpc T pc mxl xt \\ \\ eff i (compP f P) pc xt \\ = eff i P pc xt \\\"\n(*<*)\n apply (clarsimp simp add: eff_def norm_eff_def xcpt_eff_def app_def)\n apply (cases i)\n apply auto\n done\n(*>*)\n\nlemma [simp]: \"subtype (compP f P) = subtype P\"\n(*<*)\n apply (rule ext)+\n apply (simp)\n done\n(*>*)\n \nlemma [simp]: \"compP f P \\ \\ \\' \\' = P \\ \\ \\' \\'\"\n(*<*) by (simp add: sup_state_opt_def sup_state_def sup_ty_opt_def)(*>*)\n\nlemma [simp]: \"compP f P,T,mpc,mxl,xt \\ i,pc :: \\s = P,T,mpc,mxl,xt \\ i,pc :: \\s\"\n(*<*)by (simp add: wt_instr_def cong: conj_cong)(*>*)\n\ndeclare TC1.compT_sizes[simp] TC0.ty_def2[simp]\n\ncontext TC2\nbegin\n\nlemma compT_method:\n fixes e and A and C and Ts and mxl\\<^sub>0\n defines [simp]: \"E \\ Class C # Ts\"\n and [simp]: \"A \\ \\{..size Ts}\\\"\n and [simp]: \"A' \\ A \\ \\ e\"\n and [simp]: \"mxl\\<^sub>0 \\ max_vars e\"\n assumes mxs: \"max_stack e = mxs\"\n and mxl: \"Suc (length Ts + max_vars e) = mxl\"\n assumes assm: \"wf_prog p P\" \"P,E \\\\<^sub>1 e :: T\" \"\\ e A\" \"\\ e (size E)\"\n \"set E \\ types P\" \"P \\ T \\ T\\<^sub>r\"\n shows \"wt_method (compP\\<^sub>2 P) C Ts T\\<^sub>r mxs mxl\\<^sub>0 (compE\\<^sub>2 e @ [Return])\n (compxE\\<^sub>2 e 0 0) (ty\\<^sub>i' [] E A # compT\\<^sub>a E A [] e)\"\n(*<*)\nusing assms apply (simp add: wt_method_def compT\\<^sub>a_def after_def mxl)\napply (rule conjI)\napply (simp add: check_types_def OK_ty\\<^sub>i'_in_statesI)\napply (rule conjI)\napply (drule (1) WT\\<^sub>1_is_type)\napply simp\napply (insert max_stack1 [of e])\napply (rule OK_ty\\<^sub>i'_in_statesI) apply (simp_all add: mxs)[3]\napply (erule compT_states(1))\napply assumption\napply (simp_all add: mxs mxl)[4]\napply (rule conjI)\napply (auto simp add: wt_start_def ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth\n nth_Cons mxl split: nat.split dest: less_antisym)[1]\napply (frule (1) TC2.compT_wt_instrs [of P _ _ _ _ \"[]\" \"max_stack e\" \"Suc (length Ts + max_vars e)\" T\\<^sub>r])\napply simp_all\napply (clarsimp simp: after_def)\napply hypsubst_thin\napply (rule conjI)\napply (clarsimp simp: wt_instrs_def after_def mxl mxs)\napply clarsimp\napply (drule (1) less_antisym)\napply (clarsimp simp: wt_defs xcpt_app_pcs xcpt_eff_pcs ty\\<^sub>i'_def)\ndone\n(*>*)\n\nend\n\ndefinition compTP :: \"J\\<^sub>1_prog \\ ty\\<^sub>P\" where\n \"compTP P C M = (\n let (D,Ts,T,e) = method P C M;\n E = Class C # Ts;\n A = \\{..size Ts}\\;\n mxl = 1 + size Ts + max_vars e\n in (TC0.ty\\<^sub>i' mxl [] E A # TC1.compT\\<^sub>a P mxl E A [] e))\"\n\ntheorem wt_compP\\<^sub>2:\n \"wf_J\\<^sub>1_prog P \\ wf_jvm_prog (compP\\<^sub>2 P)\"\n(*<*)\n apply (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def)\n apply(rule_tac x = \"compTP P\" in exI)\n apply (rule wf_prog_compPI)\n prefer 2 apply assumption\n apply (clarsimp simp add: wf_mdecl_def)\n apply (simp add: compTP_def)\n apply (rule TC2.compT_method [simplified])\n apply (rule refl)\n apply (rule refl)\n apply assumption\n apply assumption\n apply assumption\n apply assumption\n apply (drule (1) sees_wf_mdecl)\n apply (simp add: wf_mdecl_def)\n apply (blast intro: sees_method_is_class)\n apply assumption\n done\n(*>*)\n\ntheorem wt_J2JVM:\n \"wf_J_prog P \\ wf_jvm_prog (J2JVM P)\"\n(*<*)\napply(simp only:o_def J2JVM_def)\napply(blast intro:wt_compP\\<^sub>2 compP\\<^sub>1_pres_wf)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Compiler/TypeComp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2977582243230572}} {"text": "(* *********************************************************************\n\n Theory Prelims.thy is part of a framework for modelling,\n verification and transformation of concurrent imperative\n programs. Copyright (c) 2021 M. Bortin\n\n The framework is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n For more details see the license agreement (LICENSE) you should have\n received along with the framework.\n \n ******************************************************************* *)\n\ntheory Prelims\nimports Main\nbegin\n\nlemma choice' :\n\"\\f. \\x. P x (f x) \\ \\x. \\y. P x y\"\nby force\n\nlemma choice'' :\n\"\\i. P i \\ (\\j. Q i j) \\ \\\\. \\i. P i \\ Q i (\\ i)\"\n by(rule choice, fast)\n\n\n\nlemma least_ix :\n\"P (j :: nat) \\\n \\i\\j. P i \\ (\\k P k)\" \n apply(rule_tac x=\"LEAST j. P j\" in exI)\n apply(rule conjI)\n apply(erule Least_le)\n apply(rule conjI)\n apply(erule LeastI)\n apply clarify\n apply(drule not_less_Least)\n by clarify\n\n\nlemma Int_Image :\n\"(R \\ S) `` A \\ (R `` A) \\ (S `` A)\"\n apply clarify\n apply simp\n apply(rule conjI)\n apply(erule ImageI, assumption)+\n done\n\nlemma Int_Image_singleton_sub :\n\"(R `` {a}) \\ (S `` {a}) \\ (R \\ S) `` {a}\"\n by blast\n\nlemma Int_Image_singleton :\n\"(R \\ S) `` {a} = (R `` {a}) \\ (S `` {a})\"\n apply(rule equalityI)\n apply(rule Int_Image)\n by(rule Int_Image_singleton_sub)\n\n\nlemma pred_less :\n\"(0::nat) < x \\ x - 1 < x\"\n by simp\n\n\n \nlemma inj_on_imp_surj :\n\"inj_on \\ A \\\n finite A \\\n \\a\\A. \\ a \\ A \\\n \\b\\A. \\a\\A. \\ a = b\"\n apply clarsimp\n apply(rule ccontr, simp)\n apply(subgoal_tac \"\\ ` A \\ A\")\n apply(frule psubset_card_mono, assumption)\n apply(drule card_image)\n apply simp\n apply(rule psubsetI)\n apply fastforce\n apply(rule notI)\n apply(drule equalityD2)\n apply(drule subsetD, assumption)\n apply fastforce\n done\n \n \n\ncorollary inj_on_surj_set_intv :\n\"inj_on \\ {0..<(n :: nat)} \\\n \\i i < n \\\n \\ji i = j\"\n apply(drule inj_on_imp_surj, simp, simp)\n by fastforce\n\n\nlemma mem_nth :\n\"x \\ set xs \\ \\i set(zip xs zs) \\ \n \\i b = zs!i\"\n apply(induct zs arbitrary: a b xs)\n apply simp\n apply(case_tac xs, simp)\n apply clarsimp\n apply(erule disjE, clarsimp)\n apply(rule_tac x=0 in exI, simp)\n by fastforce\n\n\nlemma map_zip_aux :\n\"\\sq \\ set sqs. length sq = n \\ length ps = length sqs \\\n map (\\x. (case x of (x, sq) \\ sq @ [x]) ! n) (zip ps sqs) = ps\"\n apply(induct ps arbitrary: sqs)\n apply simp\n apply clarsimp\n apply(case_tac sqs, simp)\n apply clarsimp\n done\n\nlemma map_zip_aux2 :\n\"\\sq \\ set sqs. length sq = n \\ m < n \\ length ps = length sqs \\\n map ((\\x. x ! m) \\ (\\(x, sq). sq @ [x])) (zip ps sqs) = map (\\x. x ! m) sqs\"\n apply(induct ps arbitrary: sqs)\n apply simp\n apply clarsimp\n apply(case_tac sqs, simp)\n apply clarsimp\n apply(subst nth_append, simp)\n done\n\n\n\n\nend", "meta": {"author": "maksym-bortin", "repo": "a_framework", "sha": "df46703505efafcf1087d4461e93e502d94712ab", "save_path": "github-repos/isabelle/maksym-bortin-a_framework", "path": "github-repos/isabelle/maksym-bortin-a_framework/a_framework-df46703505efafcf1087d4461e93e502d94712ab/Prelims.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.29774973445369884}} {"text": "(* File: Drop_And Pass_Compatibility.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nchapter \\Compositional Structures\\\n\nsection \\Drop And Pass Compatibility\\\n\ntheory Drop_And_Pass_Compatibility\n imports \"Basic_Modules/Drop_Module\"\n \"Basic_Modules/Pass_Module\"\nbegin\n\ntext\n\\This is a collection of properties about the interplay and compatibility\nof both the drop module and the pass module.\\\n\nsubsection \\Properties\\\n\ntheorem drop_zero_mod_rej_zero[simp]:\n assumes order: \"linear_order r\"\n shows \"rejects 0 (drop_module 0 r)\"\n unfolding rejects_def\nproof (safe)\n show \"electoral_module (drop_module 0 r)\"\n using order\n by simp\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n vs:: \"'a Pair_Vectors\"\n assume\n card_pos: \"0 \\ card A\" and\n finite_A: \"finite A\" and\n prof_A: \"profile A p\"\n have f1: \"connex UNIV r\"\n using assms lin_ord_imp_connex\n by auto\n obtain aa :: \"('a \\ bool) \\ 'a\" where\n f2:\n \"\\p. (Collect p = {} \\ (\\a. \\ p a)) \\\n (Collect p \\ {} \\ p (aa p))\"\n by moura\n have f3: \"\\a. (a::'a) \\ {}\"\n using empty_iff\n by simp\n have connex:\n \"connex A (limit A r)\"\n using f1 limit_presv_connex subset_UNIV\n by metis\n have\n \"\\A a. A \\ {} \\ (a::'a) \\ A\"\n by simp\n hence f4:\n \"\\a Aa.\n \\ connex Aa (limit A r) \\ a \\ Aa \\ a \\ A \\\n \\ card (above (limit A r) a) \\ 0\"\n using above_connex above_presv_limit card_eq_0_iff\n finite_A finite_subset le_0_eq order\n by (metis (no_types))\n have \"{a \\ A. card(above (limit A r) a) \\ 0} = {}\"\n using connex f4\n by auto\n hence \"card {a \\ A. card(above (limit A r) a) \\ 0} = 0\"\n using card.empty\n by (metis (full_types))\n thus \"card (reject (drop_module 0 r) A p vs) = 0\"\n by simp\nqed\n\n(*\n The drop module rejects n alternatives (if there are n alternatives).\n NOTE: The induction proof is still missing. Following is the proof for n=2.\n*)\ntheorem drop_two_mod_rej_two[simp]:\n assumes order: \"linear_order r\"\n shows \"rejects 2 (drop_module 2 r)\"\nproof -\n have rej_drop_eq_def_pass:\n \"reject (drop_module 2 r) = defer (pass_module 2 r)\"\n by simp\n thus ?thesis\n proof -\n obtain\n AA :: \"('a Electoral_Module) \\ nat \\ 'a set\" and\n rrs :: \"('a Electoral_Module) \\ nat \\ 'a Profile\" and\n vvs :: \"('a Electoral_Module) \\ nat \\ 'a Pair_Vectors\" where\n \"\\x0 x1. (\\v2 v3 v4. (x1 \\ card v2 \\ finite_profile v2 v3 \\ vector_pair v2 v4) \\\n card (reject x0 v2 v3 v4) \\ x1) =\n ((x1 \\ card (AA x0 x1) \\ finite_profile (AA x0 x1) (rrs x0 x1) \\\n vector_pair (AA x0 x1) (vvs x0 x1)) \\\n card (reject x0 (AA x0 x1) (rrs x0 x1) (vvs x0 x1)) \\ x1)\"\n by moura\n hence\n \"\\n f. (\\ rejects n f \\ electoral_module f \\\n (\\A rs vs. (\\ n \\ card A \\ infinite A \\ \\ profile A rs \\ \\ vector_pair A vs) \\\n card (reject f A rs vs) = n)) \\\n (rejects n f \\ \\ electoral_module f \\ (n \\ card (AA f n) \\\n finite_profile (AA f n) (rrs f n) \\ vector_pair (AA f n) (vvs f n)) \\\n card (reject f (AA f n) (rrs f n) (vvs f n)) \\ n)\"\n using rejects_def\n by fastforce\n hence f1:\n \"\\n f. (\\ rejects n f \\ electoral_module f \\\n (\\A rs vs. \\ n \\ card A \\ infinite A \\ \\ profile A rs \\ \\ vector_pair A vs \\\n card (reject f A rs vs) = n)) \\\n (rejects n f \\ \\ electoral_module f \\ n \\ card (AA f n) \\\n finite (AA f n) \\ profile (AA f n) (rrs f n) \\ \n vector_pair (AA f n) (vvs f n) \\\n card (reject f (AA f n) (rrs f n) (vvs f n)) \\ n)\" \n by presburger\n have\n \"\\ 2 \\ card (AA (drop_module 2 r) 2) \\\n infinite (AA (drop_module 2 r) 2) \\\n \\ profile (AA (drop_module 2 r) 2) (rrs (drop_module 2 r) 2) \\\n \\ vector_pair (AA (drop_module 2 r) 2) (vvs (drop_module 2 r) 2) \\\n card (reject (drop_module 2 r) (AA (drop_module 2 r) 2)\n (rrs (drop_module 2 r) 2) (vvs (drop_module 2 r) 2)) = 2\"\n using rej_drop_eq_def_pass defers_def order\n pass_two_mod_def_two\n by (metis (no_types))\n thus ?thesis\n using f1 drop_mod_sound order\n by blast\n qed\nqed\n\n(*The pass and drop module are (disjoint-)compatible.*)\ntheorem drop_pass_disj_compat[simp]:\n assumes order: \"linear_order r\"\n shows \"disjoint_compatibility (drop_module n r) (pass_module n r)\"\n unfolding disjoint_compatibility_def\nproof (safe)\n show \"electoral_module (drop_module n r)\"\n using order\n by simp\nnext\n show \"electoral_module (pass_module n r)\"\n using order\n by simp\nnext\n\n fix\n S :: \"'a set\"\n assume\n fin: \"finite S\"\n obtain\n p :: \"'a Profile\"\n where \"finite_profile S p\" \n using empty_iff empty_set fin profile_set\n by metis\n show \"\\A\\S. (\\a\\A. indep_of_alt (drop_module n r) S a \\\n (\\p vs. finite_profile S p \\ vector_pair S vs \\ a \\ reject (drop_module n r) S p vs)) \\\n (\\a\\S - A.\n indep_of_alt (pass_module n r) S a \\\n (\\p vs. finite_profile S p \\ vector_pair S vs \\ a \\ reject (pass_module n r) S p vs))\"\n proof\n have same_A:\n \"\\p q. (finite_profile S p \\ finite_profile S q) \\\n reject (drop_module n r) S p vs =\n reject (drop_module n r) S q vs\"\n by auto\n let ?A = \"reject (drop_module n r) S p vs\"\n have \"?A \\ S\"\n by auto\n moreover have\n \"(\\a \\ ?A. indep_of_alt (drop_module n r) S a)\"\n using order\n by (simp add: indep_of_alt_def)\n moreover have\n \"\\a \\ ?A. \\p vs. finite_profile S p \\ finite_pair_vectors S vs \\\n a \\ reject (drop_module n r) S p vs\"\n by auto\n moreover have\n \"(\\a \\ S-?A. indep_of_alt (pass_module n r) S a)\"\n using order\n by (simp add: indep_of_alt_def)\n moreover have\n \"\\a \\ S-?A. \\p vs. finite_profile S p \\ finite_pair_vectors S vs \\\n a \\ reject (pass_module n r) S p vs\"\n by auto\n ultimately show\n \"?A \\ S \\\n (\\a \\ ?A. indep_of_alt (drop_module n r) S a \\\n (\\p vs. finite_profile S p \\ vector_pair S vs \\\n a \\ reject (drop_module n r) S p vs)) \\\n (\\a \\ S-?A. indep_of_alt (pass_module n r) S a \\\n (\\p vs. finite_profile S p \\ vector_pair S vs \\\n a \\ reject (pass_module n r) S p vs))\"\n by simp\n qed\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master/theories/Compositional_Structures/Drop_And_Pass_Compatibility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.29774973445369884}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory SerialS\nimports\n PleSle\nbegin \ntype_synonym U8 = \"8 word\"\ntype_synonym U16 = \"16 word\"\ntype_synonym U32 = \"32 word\"\ntype_synonym U64 = \"64 word\"\n\nlemma sle32_length:\n \"length (sle32 x) = 4\"\n by (simp add: sle32_def length_word_rsplit_exp_size' word_size)\n\nlemma ple32_word_rcat_eq1:\n \"ple32 (sle32 x @ xs) 0 = x\"\n apply (simp only: ple32_def unat_0)\n apply (subst drop_0)\n apply (cut_tac x=x in sle32_length)\n apply (simp add: sle32_def word_rcat_rsplit)\n done\n \nlemma ple32_word_rcat_eq2:\n \"length ys = (unat n) \\ ple32 (ys @ sle32 x @ xs) n = x\"\n by (simp add: ple32_def ple32_word_rcat_eq1[simplified ple32_def, simplified])\n\nlemmas ple32_word_rcat_eq = ple32_word_rcat_eq1 ple32_word_rcat_eq2\n\nlemma sle64_length:\n \"length (sle64 x) = 8\"\n by (simp add: sle64_def length_word_rsplit_exp_size' word_size)\n \nlemma ple64_word_rcat_eq1:\n \"ple64 (sle64 x @ xs) 0 = x\"\n apply (simp only: ple64_def unat_0)\n apply (subst drop_0)\n apply (cut_tac x=x in sle64_length)\n apply (simp add: sle64_def word_rcat_rsplit)\n done\n \nlemma ple64_word_rcat_eq2:\n \"length ys = (unat n) \\ ple64 (ys @ sle64 x @ xs) n = x\"\n by (simp add: ple64_def ple64_word_rcat_eq1[simplified ple64_def, simplified])\n\nlemmas ple64_word_rcat_eq = ple64_word_rcat_eq1 ple64_word_rcat_eq2\n\ndefinition pObjDel :: \"U8 list \\ U32 \\ U64 ObjDel\"\nwhere\n \"pObjDel data' offs' \\ ObjDel.make (ple64 data' offs') \\ \\id\\\n \\ \\End 4 bytes\\\"\n \ndefinition sObjDel :: \"ObjDel\\<^sub>T \\ U8 list\"\nwhere\n \"sObjDel odel \\ (sle64 $ ObjDel.id\\<^sub>f odel)\" (* id *) (* End 8 bytes *)\n\nlemma objDel_inverse:\n \"pObjDel (sObjDel odel) 0 = odel\"\n apply(simp add: pObjDel_def sObjDel_def)\n apply(simp add: ObjDel.defs)\n using ple64_word_rcat_eq[where xs=Nil]\n by simp\n\ndefinition pObjData :: \"U8 list \\ U32 \\ U32 \\ ObjData\\<^sub>T\"\nwhere\n \"pObjData data offs olen \\\n ObjData.make (ple64 data offs) \\ \\ id \\\n (WordArrayT.make $ slice (unat (offs + 8)) (unat (offs + 8) + unat (olen - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize)) data)\"\n\ndefinition sObjData :: \"ObjData\\<^sub>T \\ U32 \\ U8 list\"\nwhere\n \"sObjData odata len \\ (sle64 $ ObjData.id\\<^sub>f odata) @ take (unat len) (\\wa (ObjData.odata\\<^sub>f odata))\"\n\nlemma length_sle32: \n \"length ((sle32 (x::U32))::U8 list) = 4\"\nby (simp add: Word.length_word_rsplit_exp_size' Word.word_size sle32_def )\n\nlemma length_sle64: \n \"length ((sle64 (x::U64))::U8 list) = 8\"\nby (simp add: Word.length_word_rsplit_exp_size' Word.word_size sle64_def )\n\nlemma objData_inverse:\n \"unat (len - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize) = length (\\wa (odata\\<^sub>f odata)) \\\n len - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize < len \\\n pObjData (sObjData odata len) 0 len = odata\"\n apply(simp add: pObjData_def)\n apply(simp add: sObjData_def)\n apply(simp add: ObjData.defs)\n apply(simp add: ple64_word_rcat_eq length_sle64 slice_def)\n apply (subgoal_tac \"unat len \\ length (\\wa (odata\\<^sub>f odata)) \")\n apply (simp add: wordarray_make')\n apply unat_arith\n done\n\ndefinition\n pu8 :: \"U8 list \\ U32 \\ U8\"\nwhere\n \"pu8 xs offs = word_rcat (slice (unat offs) (unat offs+1) xs)\"\n \ndefinition pObjDentry :: \"U8 list \\ U32 \\ ObjDentry\\<^sub>T\"\nwhere\n \"pObjDentry data offs \\\n let nlen = ple16 data (offs+6)\n in ObjDentry.make\n (ple32 data (offs+0)) \\ \\ ino \\\n (pu8 data (offs+4)) \\ \\ dtype \\\n \\ \\ 1 byte padding \\\n nlen \\ \\ nlen \\\n (WordArrayT.make $ slice (unat (offs+ 8)) (unat (offs + 8) + unat nlen) data) \\ \\ name \\\"\n\ndefinition pArrObjDentry :: \"U8 list \\ U32 \\ U32 \\ (ObjDentry\\<^sub>T Array \\ 32 word \\ 32 word list)\"\nwhere\n \"pArrObjDentry data offs nb_dentry =\n (case (fold \n (\\_ (xs,doffs,offslist).\n let dentry = pObjDentry data doffs ;\n newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n in (xs@[Option.Some dentry], newoffs, offslist@ [newoffs])) [0.. (ArrayT.make (xs@ [Option.None ()]), doffs, offslist))\"\n\ndefinition pObjDentarr :: \"U8 list \\ U32 \\ U32 \\ ObjDentarr\\<^sub>T\"\nwhere\n\"pObjDentarr data offs olen \\\n let nb_dentry = ple32 data (offs+8)\n in ObjDentarr.make\n (ple64 data offs) \\ \\ id \\\n (nb_dentry) \\ \\ nb_dentry \\\n (prod.fst (pArrObjDentry (take (unat (offs+olen-bilbyFsObjHeaderSize)) data) (offs+bilbyFsObjDentarrHeaderSize) nb_dentry))\n \"\n\ndefinition pObjDentarrSize :: \"U8 list \\ U32 \\ U32 \\ U32\"\nwhere\n\"pObjDentarrSize data offs olen \\\n let nb_dentry = ple32 data (offs+8)\n in (prod.fst (prod.snd (pArrObjDentry (take (unat (offs+olen-bilbyFsObjHeaderSize)) data) (offs+bilbyFsObjDentarrHeaderSize) nb_dentry)))\n \"\n\ndefinition pObjSuper :: \"U8 list \\ U32 \\ ObjSuper\\<^sub>T\"\nwhere\n \"pObjSuper data offs \\\n ObjSuper.make\n (ple32 data offs) \\ \\ nb_eb \\\n (ple32 data (offs+4)) \\ \\ eb_size \\\n (ple32 data (offs+8)) \\ \\ io_size \\\n (ple32 data (offs+12)) \\ \\ nb_reserved_gc \\\n (ple32 data (offs+16)) \\ \\ nb_reserved_del \\\n (ple32 data (offs+20)) \\ \\ cur_eb \\\n (ple32 data (offs+24)) \\ \\ cur_offs \\\n (ple32 data (offs+28)) \\ \\ last_inum \\\n (ple64 data (offs+32)) \\ \\ next_sqnum \\\n \"\n\n(* TODO: we do not have pObjSumEntry . Probably we need it.*)\ndefinition sObjSumEntry :: \"ObjSumEntry\\<^sub>T \\ U8 list\"\nwhere\n \"sObjSumEntry ose \\ \n (sle64 $ ObjSumEntry.id\\<^sub>f ose)\n @ (sle64 $ ObjSumEntry.sqnum\\<^sub>f ose)\n @ (sle32 $ ObjSumEntry.len\\<^sub>f ose)\n @ (sle32 $ ObjSumEntry.del_flags_and_offs\\<^sub>f ose)\n @ (sle16 $ ObjSumEntry.count\\<^sub>f ose)\"\n\nconsts sObjSuper :: \"ObjSuper\\<^sub>T \\ U8 list\" \n\ntype_synonym Buffer\\<^sub>T = \"(U8 WordArray, U32) Buffer\"\n\ndefinition bounded :: \"Buffer\\<^sub>T \\ U8 list\"\nwhere\n \"bounded buf = take (unat (bound\\<^sub>f buf)) (WordArrayT.\\wa (data\\<^sub>f buf))\"\n\ndefinition wellformed_buf :: \"Buffer\\<^sub>T \\ bool\"\nwhere\n \"wellformed_buf buf \\ unat (bound\\<^sub>f buf) \\ List.length (\\wa (Buffer.data\\<^sub>f buf))\"\n\nlemma elem_take_n:\n \"i (take n xs ! i) = xs ! i\"\n by simp\n\nlemma deserialise_le32_bounded_ret:\nassumes bounded:\n \"bbuf = bounded buf\"\nassumes valid_offs:\n \"unat offs + 3 < length (bounded buf)\"\nshows\n \"deserialise_le32 (buf, offs) = ple32 bbuf offs\"\napply (simp add: bounded)\nusing valid_offs\n apply (subgoal_tac \"(\\i\\{0..3}. unat (offs+i) < length (bounded buf))\")\n prefer 2\n apply unat_arith\n apply (simp add: bounded_def)\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple32_def \n deserialise_le32_def)\n apply (subgoal_tac \"\\j\\{1..3}. (unat (offs + j) > 0)\")\n prefer 2\n apply clarsimp\n apply (drule_tac x=j in bspec, simp)\n apply unat_arith\n apply (subst take_drop_decomp, (simp+))+\n apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n apply simp\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=4], simp add: word_size)\n apply simp\n apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n \nlemma deserialise_le64_bounded_ret:\nassumes bounded:\n \"bbuf = bounded buf\"\nassumes valid_offs:\n \"unat offs + 7 < length (bounded buf)\"\nshows\n \"deserialise_le64 (buf, offs) = ple64 bbuf offs\"\napply (simp add: bounded)\nusing valid_offs\n apply (subgoal_tac \"(\\i\\{0..7}. unat (offs+i) < length (bounded buf))\")\n prefer 2\n apply unat_arith\n apply (simp add: bounded_def)\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple64_def \n deserialise_le64_def)\n apply (subgoal_tac \"\\j\\{1..7}. (unat (offs + j) > 0)\")\n prefer 2\n apply clarsimp\n apply (drule_tac x=j in bspec, simp)\n apply unat_arith\n (* feel free to improve this apply script..*)\n apply (subst take_drop_decomp, (simp+))+\n apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n apply simp\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=8], simp add: word_size)\n apply simp\n apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n\n\ndefinition buf_unchanged :: \"Buffer\\<^sub>T \\ Buffer\\<^sub>T \\ U32 \\ U32 \\ bool\"\nwhere\n \"buf_unchanged newbuf oldbuf offs' l \\ take (unat offs') (\\wa (data\\<^sub>f newbuf)) = take (unat offs') (\\wa (data\\<^sub>f oldbuf)) \\\n drop (unat offs' + unat l) (\\wa (data\\<^sub>f newbuf)) = drop (unat offs' + unat l) (\\wa (data\\<^sub>f oldbuf)) \\\n bound\\<^sub>f newbuf = bound\\<^sub>f oldbuf\"\n\nlemma bounded_le_length:\n \"(length $ bounded x) \\ length (\\wa $ data\\<^sub>f x)\"\n by (simp add: bounded_def)\n\nlemmas serialise_le64_simps = ArrA.make_def ElemA.make_def ElemAO.make_def ArrayUseValueP.defs\n setu8_def[unfolded sanitizers] wordarray_make bounded_def\n serialise_u8_def[unfolded tuple_simps sanitizers]\n\n(*\nlemma serialise_le64_ret:\nassumes valid_offs:\n \"unat offs + 7 < length (bounded buf)\"\nassumes ret:\n \"P (buf\\data\\<^sub>f := WordArrayT.make (\\wa (data\\<^sub>f buf)[\n unat offs := u64_to_u8 v,\n unat (offs+1) := u64_to_u8 (v >> 8),\n unat (offs+2) := u64_to_u8 (v >> 16),\n unat (offs+3) := u64_to_u8 (v >> 24),\n unat (offs+4) := u64_to_u8 (v >> 32),\n unat (offs+5) := u64_to_u8 (v >> 40),\n unat (offs+6) := u64_to_u8 (v >> 48),\n unat (offs+7) := u64_to_u8 (v >> 56)])\\)\"\nnotes wa_modify_ret = wordarray_modify_ret[rotated - 1, simplified Let_def ArrayUseValueP.defs ArrA.defs]\nshows\n \"P (serialise_le64 (buf, offs, v))\"\n unfolding serialise_le64_def[unfolded tuple_simps sanitizers]\n apply (simp add: serialise_le64_simps Let_def)\n apply (rule wa_modify_ret[where index=\"offs\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+1\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+2\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+3\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+4\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+5\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+6\"], simp add: serialise_le64_simps)\n apply (rule wa_modify_ret[where index=\"offs+7\"], simp add: serialise_le64_simps)\n using ret apply simp\n using valid_offs \n apply ((simp add: serialise_le64_simps) , unat_arith?)+\n done\n*)\n\nlemma take_irrelevance:\n \"P (xs!(unat (x + y))) \\ unat (x + y) < unat z \\\n P ((take (unat z) xs)!(unat (x + y)))\" \n by auto\n\nlemma unat_space:\nassumes \"unat (x + y) < z\"\nand \"unat (x + y) > unat x\"\nand \"y' \\ y\"\nshows \"unat (x + y') < z\"\nproof -\n have \"\\x\\<^sub>1. unat (x + y) \\ x\\<^sub>1 \\ \\ z \\ x\\<^sub>1\"\n using assms(1) by fastforce\n thus ?thesis using assms\n by (metis antisym_conv leI less_not_sym word_le_nat_alt word_plus_mono_right)\nqed\n\nlemma ple32_ret:\n assumes 1:\"unat offs < unat (offs + 3)\"\n assumes 2:\"unat (offs + 3) < (length $ bounded buf)\"\n assumes 3:\"P(ple32 (bounded buf) offs)\"\n shows \"P (deserialise_le32 (buf, offs))\"\n proof -\n from 1 2 have 4:\"unat offs + 3 < (length $ bounded buf)\" by (unat_arith, auto?)\n show ?thesis\n apply(subst deserialise_le32_bounded_ret)\n apply simp\n using 1 2 apply unat_arith\n apply auto[1]\n using 1 2 apply unat_arith\n using 3 apply auto\n done\n qed\n\nlemma ple64_ret:\n assumes 1:\"unat offs < unat (offs + 7)\"\n assumes 2:\"unat (offs + 7) < (length $ bounded buf)\"\n assumes 3:\"P (ple64 (bounded buf) offs)\"\n shows \"P (deserialise_le64 (buf, offs))\"\n proof -\n from 1 2 have 4:\"unat offs + 7 < (length $ bounded buf)\" by (unat_arith, auto?)\n show ?thesis\n apply(subst deserialise_le64_bounded_ret)\n apply simp\n using 1 2 apply unat_arith\n apply auto[1]\n using 1 2 apply unat_arith\n using 3 apply auto\n done\n qed\n\nlemma offs_le:\n assumes \"offs < offs+n\"\n assumes \"unat (offs + n) \\ ntake\"\n shows \"unat offs < ntake\"\n using assms by unat_arith\n\nlemma word_add_eq_unat:\n assumes \"(offs::('a::len word)) < offs + n\"\n assumes \"i < n\"\n shows \"unat (offs + i) = unat offs + unat i\"\nusing assms by unat_arith\n\nlemma ple16_eq_slice2:\n assumes \"offs < offs + 2\" \n assumes \"unat offs + 2 \\ length xs\"\n shows \"ple16 xs offs = ple16 (slice (unat offs) (unat offs + 2) xs) 0\"\n using assms by (simp add: slice_def ple16_def drop_take word_add_eq_unat)\n\nlemma ple32_eq_slice4:\n assumes \"offs < offs + 4\" \n assumes \"unat offs + 4 \\ length xs\"\n shows \"ple32 xs offs = ple32 (slice (unat offs) (unat offs + 4) xs) 0\"\n using assms by (simp add: slice_def ple32_def drop_take word_add_eq_unat)\n\nlemma ple64_eq_slice8:\n assumes \"offs < offs + 8\" \n assumes \"unat offs + 8 \\ length xs\"\n shows \"ple64 xs offs = ple64 (slice (unat offs) (unat offs + 8) xs) 0\"\n using assms by (simp add: slice_def ple64_def drop_take word_add_eq_unat)\n\ndefinition pObjInode :: \"U8 list \\ U32 \\ ObjInode\\<^sub>T\"\nwhere\n \"pObjInode data offs \\\n ObjInode.make\n (((ple64 data offs) AND (NOT (bilbyFsOidMaskAll OR ucast word32Max))) OR bilbyFsOidMaskInode) \\ \\ id \\\n (ple64 data (offs+8)) \\ \\ size \\\n (ple64 data (offs+16)) \\ \\ atime \\\n (ple64 data (offs+24)) \\ \\ ctime \\\n (ple64 data (offs+32)) \\ \\ mtime \\\n (ple32 data (offs+40)) \\ \\ nlink \\\n (ple32 data (offs+44)) \\ \\ uid \\\n (ple32 data (offs+48)) \\ \\ gid \\\n (ple32 data (offs+52)) \\ \\ mode \\\n (ple32 data (offs+56)) \\ \\ flags \\\n \\ \\ End 60 bytes \\\"\n\ndefinition sObjInode :: \"ObjInode\\<^sub>T \\ U8 list\"\nwhere\n \"sObjInode odata \\ \n (sle64 $ ObjInode.id\\<^sub>f odata) \n @ (sle64 $ ObjInode.size\\<^sub>f odata) \n @ (sle64 $ ObjInode.atime_sec\\<^sub>f odata)\n @ (sle64 $ ObjInode.ctime_sec\\<^sub>f odata)\n @ (sle64 $ ObjInode.mtime_sec\\<^sub>f odata)\n @ (sle32 $ ObjInode.nlink\\<^sub>f odata)\n @ (sle32 $ ObjInode.uid\\<^sub>f odata)\n @ (sle32 $ ObjInode.gid\\<^sub>f odata)\n @ (sle32 $ ObjInode.mode\\<^sub>f odata)\n @ (sle32 $ ObjInode.flags\\<^sub>f odata) \\ \\ End 60 bytes \\\"\n\ndefinition pObjHeader :: \"U8 list \\ U32 \\ Obj\\<^sub>T\"\nwhere\n \"pObjHeader data offs \\\n Obj.make\n (ple32 data offs) \\ \\ magic \\\n (ple32 data (offs+4)) \\ \\ crc \\\n (ple64 data (offs+8)) \\ \\ sqnum \\\n (offs) \\ \\ offs not stored on medium \\ \\ \\ changed back to offs, otherwise this doesnt correspond to the code\\\n (ple32 data (offs+16)) \\ \\ len \\\n \\ \\ 2 padding bytes \\\n (data!unat (offs+22)) \\ \\ trans \\\n (data!unat (offs+23)) \\ \\ otype \\\n undefined \\ \\ ounion \\\n \\ \\ End 24 bytes \\\"\n\ndefinition sObjHeader :: \"Obj\\<^sub>T \\ U8 list\"\nwhere\n \"sObjHeader obj \\\n (sle32 $ Obj.magic\\<^sub>f obj)\n @ (sle32 $ Obj.crc\\<^sub>f obj)\n @ (sle64 $ Obj.sqnum\\<^sub>f obj)\n @ (sle32 $ Obj.len\\<^sub>f obj)\n @ [bilbyFsPadByte]\n @ [bilbyFsPadByte]\n @ [Obj.trans\\<^sub>f obj]\n @ [Obj.otype\\<^sub>f obj] \\ \\ End 24 bytes \\\"\n\nlemma ObjHeader_inverse:\n \"pObjHeader (sObjHeader obj@xs) 0 = (obj\\ Obj.ounion\\<^sub>f := undefined, Obj.offs\\<^sub>f := 0 \\) \"\n apply(clarsimp simp: pObjHeader_def sObjHeader_def)\n apply(clarsimp simp: Obj.defs)\n apply(clarsimp simp: ple32_word_rcat_eq length_sle32 length_sle64)\n apply(clarsimp simp: bilbyFsObjHeaderSize_def bilbyFsPadByte_def)\n proof -\n let ?magic = \"sle32 (magic\\<^sub>f obj)\"\n let ?crc = \"sle32 (crc\\<^sub>f obj)\"\n let ?sqnum = \"sle64 (Obj.sqnum\\<^sub>f obj)\"\n let ?len = \"sle32 (Obj.len\\<^sub>f obj)\"\n let ?tail = \"0x42 # 0x42 # trans\\<^sub>f obj # otype\\<^sub>f obj # xs\"\n\n have append_assoc_intro : \"\\P ys1 ys2 xs. \n P ((ys1 @ ys2) @ xs) \\ P (ys1 @ (ys2 @ xs))\" by auto\n\n have sqnum: \"ple64 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 8 = (Obj.sqnum\\<^sub>f obj)\"\n apply(rule append_assoc_intro)\n apply(rule ple64_word_rcat_eq)\n apply(subst List.length_append)\n using length_sle32 by auto\n\n have len: \"ple32 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 16 = Obj.len\\<^sub>f obj\"\n apply(rule append_assoc_intro[of _ \"?magic\"])\n apply(rule append_assoc_intro[of _ \"?magic @ ?crc\"])\n apply(rule append_assoc_intro[of _ \"?magic @ ?crc @ ?sqnum\"])\n apply(rule ple32_word_rcat_eq)\n using length_sle32 length_sle64 by auto\n\n have trans:\"(?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 22 = Obj.trans\\<^sub>f obj\"\n proof -\n have \"length (?magic @ ?crc @ ?sqnum @ ?len @ (66::8 word) # [66::8 word]) = 22\"\n using length_sle32 length_sle64 by simp\n from this show ?thesis\n by (metis (erased, hide_lams) append_Cons append_Nil append_assoc nth_append_length)\n qed\n\n have otype:\"(?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 23 = Obj.otype\\<^sub>f obj\"\n proof -\n have \"length (?magic @ ?crc @ ?sqnum @ ?len @ (66::8 word) # (66::8 word) # [trans\\<^sub>f obj]) = 23\"\n using length_sle32 length_sle64 by simp\n from this show ?thesis\n by (metis (erased, hide_lams) append_Cons append_Nil append_assoc nth_append_length)\n qed\n\n from sqnum len trans otype\n show \n \"\\magic\\<^sub>f = magic\\<^sub>f obj, crc\\<^sub>f = crc\\<^sub>f obj,\n sqnum\\<^sub>f = ple64 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 8,\n offs\\<^sub>f = 0,\n len\\<^sub>f = ple32 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 16,\n trans\\<^sub>f = (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 22,\n otype\\<^sub>f = (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 23,\n ounion\\<^sub>f = undefined\\ = obj\\ounion\\<^sub>f := undefined, Obj.offs\\<^sub>f := 0\\\"\n by auto\n qed\n\nlemmas pObjHeader_simp =\n pObjHeader_def Let_def Obj.make_def bilbyFsObjHeaderSize_def\n\ndefinition is_valid_ObjHeader :: \"Obj\\<^sub>T \\ U8 list \\ bool\"\nwhere\n \"is_valid_ObjHeader obj data \\\n magic\\<^sub>f obj = bilbyFsMagic \\\n (unat $ Obj.len\\<^sub>f obj) \\ length data \\\n trans\\<^sub>f obj \\ {bilbyFsTransIn, bilbyFsTransCommit} \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj)\"\n\nlemma is_len_and_type_ok_hdr_szD:\n \"is_len_and_type_ok (otype, olen) \\ bilbyFsObjHeaderSize \\ olen\"\n by (auto simp add: \n is_len_and_type_ok_def[unfolded sanitizers tuple_simps] \n bilbyFsObjHeaderSize_def\n prod.case_eq_if split: if_splits)\n unat_arith+\n\nlemma is_valid_ObjHeader_len_facts:\n \"is_valid_ObjHeader obj data \\ unat bilbyFsObjHeaderSize \\ length data \\\n bilbyFsObjHeaderSize \\ Obj.len\\<^sub>f obj\"\n apply (clarsimp simp: is_valid_ObjHeader_def)\n apply (drule is_len_and_type_ok_hdr_szD)\n apply unat_arith\n done\n\n\nlemmas otype_simps =\n bilbyFsObjTypeInode_def\n bilbyFsObjTypeData_def\n bilbyFsObjTypeDentarr_def\n bilbyFsObjTypeDel_def\n bilbyFsObjTypePad_def\n bilbyFsObjTypeSuper_def\n bilbyFsObjTypeSum_def\n\nlemma is_len_and_type_ok_otype_valD:\n \"is_len_and_type_ok (otype, olen) \\ otype \\ {bilbyFsObjTypeInode,bilbyFsObjTypeData,bilbyFsObjTypeDentarr,bilbyFsObjTypeDel,bilbyFsObjTypePad,bilbyFsObjTypeSuper,bilbyFsObjTypeSum} \"\n by (auto simp add: \n is_len_and_type_ok_def[unfolded sanitizers tuple_simps] \n otype_simps split: if_splits)\n\ndefinition is_valid_Obj :: \"Obj\\<^sub>T \\ bool\"\nwhere\n \"is_valid_Obj obj \\ \n if otype\\<^sub>f obj = bilbyFsObjTypePad then \\v. ounion\\<^sub>f obj = TObjPad v else\n if otype\\<^sub>f obj = bilbyFsObjTypeInode then \\v. ounion\\<^sub>f obj = TObjInode v else\n if otype\\<^sub>f obj = bilbyFsObjTypeData then \\v. ounion\\<^sub>f obj = TObjData v else\n if otype\\<^sub>f obj = bilbyFsObjTypeDentarr then \\v. ounion\\<^sub>f obj = TObjDentarr v else\n if otype\\<^sub>f obj = bilbyFsObjTypeDel then \\v. ounion\\<^sub>f obj = TObjDel v else\n True\"\n\n\nlemma is_valid_ObjHeader_len:\n \"is_valid_ObjHeader obj data \\ bilbyFsObjHeaderSize \\ Obj.len\\<^sub>f obj\"\n apply (clarsimp simp add: is_valid_ObjHeader_def)\n apply (erule is_len_and_type_ok_hdr_szD)\n done\n\nlemma is_valid_ObjHeader_len_unat:\n \"is_valid_ObjHeader obj data \\ unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f obj)\"\n by (drule is_valid_ObjHeader_len) unat_arith\n\nlemma is_valid_ObjHeader_buf_len:\n \"is_valid_ObjHeader obj data \\\n (unat $ Obj.len\\<^sub>f obj) \\ length data \\\n unat bilbyFsObjHeaderSize \\ length data\"\n apply (clarsimp simp add: is_valid_ObjHeader_def)\n apply (drule is_len_and_type_ok_hdr_szD)\n apply unat_arith\n done\n\ndefinition sObjPad :: \"U32 \\ U8 list\"\nwhere\n \"sObjPad olen \\ replicate (unat (olen - bilbyFsObjHeaderSize)) bilbyFsPadByte\"\n\nconsts pObjSummary :: \"U8 list \\ U32 \\ ObjSummary\\<^sub>T\"\nconsts pObjPad :: \"U8 list \\ U32 \\ unit\"\n\ndefinition pObjUnion :: \"U8 list \\ U8 \\ U32 \\ U32 \\ ObjUnion\\<^sub>T\"\nwhere\n \"pObjUnion data otype olen offs \\\n if otype = bilbyFsObjTypePad then\n TObjPad ()\n else if otype = bilbyFsObjTypeData then\n TObjData (pObjData data offs olen)\n else if otype = bilbyFsObjTypeInode then\n TObjInode (pObjInode data offs)\n else if otype = bilbyFsObjTypeDentarr then\n TObjDentarr (pObjDentarr data offs olen)\n else if otype = bilbyFsObjTypeDel then\n TObjDel (pObjDel data offs)\n else if otype = bilbyFsObjTypeSuper then\n TObjSuper (pObjSuper data offs)\n else \\ \\if otype = bilbyFsObjTypeSum then\n TObjSummary (pObjSummary data offs) \\ \\ \\ see comments in: serial.cogent for deserialise_ObjUnion:\\\n TObjPad ()\"\n\ndefinition pObj :: \"U8 list \\ U32 \\ Obj\\<^sub>T\"\nwhere\n \"pObj data offs \\\n let obj = pObjHeader data offs\n in obj \\ounion\\<^sub>f:= pObjUnion (take (unat offs + unat (Obj.len\\<^sub>f obj)) data) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj) (offs+bilbyFsObjHeaderSize)\\\"\n\ntext \\ This could be implemented in Cogent instead \\\ndefinition serialise_size_summary_Obj :: \"ObjSummary\\<^sub>T \\ U32\"\nwhere\n \"serialise_size_summary_Obj summary \\\n bilbyFsObjHeaderSize + serialise_size_ObjSummary (nb_sum_entry\\<^sub>f summary)\"\n\ndefinition os_sum_sz :: \"OstoreState\\<^sub>T \\ U32\"\nwhere\n \"os_sum_sz ostore_st \\ serialise_size_summary_Obj (summary\\<^sub>f ostore_st)\"\n\ndefinition bilbyFsMinObjSize :: U32\nwhere\n \"bilbyFsMinObjSize \\ bilbyFsObjHeaderSize + 8\"\n\nlemma deserialise_u8_ret:\nassumes wf: \"wellformed_buf buf\"\nassumes valid_offs:\n \"offs < bound\\<^sub>f buf\"\nshows\n \"deserialise_u8 (buf, offs) = (\\wa $ data\\<^sub>f buf) ! (unat offs)\"\nusing valid_offs wordarray_get_ret[where arr=\"data\\<^sub>f buf\" and index=offs]\n wf[simplified wellformed_buf_def]\n apply (simp add: deserialise_u8_def)\n apply (erule meta_impE)\n apply unat_arith\n apply simp\n done\n\nlemmas objheaders_simps = bilbyFsMagic_def\n bilbyFsObjTypeInode_def bilbyFsObjTypeData_def\n bilbyFsObjTypeDentarr_def bilbyFsObjTypeDel_def bilbyFsObjTypePad_def\n bilbyFsObjTypeSuper_def bilbyFsObjTypeSum_def\n bilbyFsTransIn_def bilbyFsTransCommit_def is_valid_ObjHeader_def pObjHeader_def\n Obj.make_def \n\nlemma deserialise_ObjHeader_ret:\n assumes wf: \"wellformed_buf buf\"\n assumes bound: \"offs + bilbyFsObjHeaderSize \\ bound\\<^sub>f buf\"\n assumes no_of: \"offs < offs + bilbyFsObjHeaderSize\"\n assumes err: \"\\obj. P (obj, Error eInval)\"\n assumes suc:\n \"\\obj offs'. \\ is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) ;\n \\v. obj\\ounion\\<^sub>f:=v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs;\n offs' = offs + bilbyFsObjHeaderSize;\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf;\n offs < offs + Obj.len\\<^sub>f obj\\ \\ \n P (obj, Success (offs'))\"\n notes bilbyFsObjHeaderSize_def[simp]\n shows \"P (deserialise_ObjHeader (buf, offs, obj))\"\nproof -\n have des_u8: \n \"deserialise_u8 (buf, offs + 23) = (\\wa $ data\\<^sub>f buf) ! unat (offs + 23)\" \n \"deserialise_u8 (buf, offs + 22) = (\\wa $ data\\<^sub>f buf) ! unat (offs + 22)\"\n using bound no_of\n by - ((subst deserialise_u8_ret[OF wf]), (unat_arith, simp+))+\n\n have des_le64:\n \"deserialise_le64 (buf, offs + 8) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 8))\"\n apply (rule ple64_ret)\n using no_of\n apply (simp add: )\n apply (simp add: unat_arith_simps, unat_arith)\n using bound wf no_of\n apply (simp add: bounded_def wellformed_buf_def unat_arith_simps)\n apply unat_arith\n apply (simp add: bounded_def)\n apply (subst ple64_take)\n using bound no_of\n apply (simp add: bounded_def unat_arith_simps)\n apply unat_arith\n using wf bound no_of\n apply (simp add: wellformed_buf_def unat_arith_simps)\n apply unat_arith\n apply simp\n done\n\n have des_le32:\n \"deserialise_le32 (buf, offs) = (ple32 (\\wa $ data\\<^sub>f buf) offs)\" \n \"deserialise_le32 (buf, offs+4) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 4))\" \n \"deserialise_le32 (buf, offs+16) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 16))\"\nML_prf \\\nfun solve_deserialise_le32 ctxt = \n let \n val add_simp = Simplifier.add_simp;\n fun add_simps ctxt [] = ctxt\n | add_simps ctxt (thm::thms) = add_simps (add_simp thm ctxt) thms;\n val simp = Simplifier.asm_full_simp_tac;\n val unat = (unat_arith_tac ctxt 1);\n\n val ple32 = Method.rule_tac ctxt @{thms ple32_ret} [] 1;\n val wf_bounded_unat = @{thms wellformed_buf_def bounded_def unat_arith_simps};\n val simp_wf_bounded_unat = simp (add_simps ctxt wf_bounded_unat) 1;\n val simp_bounded = simp (add_simp @{thm bounded_def} ctxt) 1;\n val ple32_take = Method.rule_tac ctxt @{thms ple32_take} [] 1;\n val simp_unat_plus = REPEAT_DETERM_N 2 ( simp_wf_bounded_unat THEN unat);\n in\n DETERM (ple32 THEN simp_unat_plus )\n THEN (simp_bounded THEN ple32_take THEN simp_unat_plus)\n end\n\\\n using wf bound no_of\n by - (tactic \\ solve_deserialise_le32 @{context} \\)+\n show ?thesis\n unfolding deserialise_ObjHeader_def[unfolded tuple_simps sanitizers]\n apply (clarsimp simp:Let_def err[simplified eInval_def])\n apply (frule is_len_and_type_ok_hdr_szD)\n apply (rule suc)\n apply (clarsimp simp: objheaders_simps buf_simps des_le32 des_u8 )\n apply (subgoal_tac \"\\v. ple32 (\\wa (data\\<^sub>f buf)) (offs + 0x10) = v\")\n prefer 2\n apply clarsimp\n apply (erule exE, simp add: bounded_def)\n using bound no_of wf apply (simp add: wellformed_buf_def)\n apply (rule conjI)\n apply unat_arith\n apply (unat_arith)\n apply (rule_tac x=undefined in exI) \n apply (simp add: pObjHeader_def Obj.defs buf_simps des_le32 des_u8 des_le64)\n apply (simp)\n apply (simp, unat_arith)+\n done\nqed\n\ndefinition\n sObjUnion :: \"ObjUnion\\<^sub>T \\ U8 \\ U32 \\ U8 list\"\nwhere\n \"sObjUnion (ou::ObjUnion\\<^sub>T) (otype::U8) (olen::U32) \\ \n case ou of\n TObjDentarr odent \\ undefined \\ \\ TODO: no dentarr support for now \\\n | TObjInode oinod \\ sObjInode oinod\n | TObjData odata \\ sObjData odata olen\n | TObjDel odel \\ sObjDel odel\n | TObjSuper osup \\ sObjSuper osup\n | TObjSummary g \\ undefined \\ \\ TODO: sObjSummary is undefined\\\n | TObjPad opad \\ sObjPad olen\"\n\nlemmas bilbyFsObjTypes = \n bilbyFsObjTypePad_def\n bilbyFsObjTypeInode_def\n bilbyFsObjTypeData_def\n bilbyFsObjTypeDentarr_def\n bilbyFsObjTypeDel_def\n bilbyFsObjTypeSuper_def\n bilbyFsObjTypeSum_def\n\nlemma ObjUnion_inverse:\n \"\\v. ounion = TObjPad v \\ otype = bilbyFsObjTypePad \\\n pObjUnion (sObjUnion ounion otype olen @ xs) otype olen 0 = ounion\"\n by (simp add: sObjUnion_def pObjUnion_def )\n\nlemma length_sObjUnion:\n \"\\v. ounion = TObjPad v \\ otype = bilbyFsObjTypePad \\\n olen \\ bilbyFsObjHeaderSize \\\n length (sObjUnion ounion otype olen) = unat olen - unat bilbyFsObjHeaderSize\"\n apply (simp add: sObjUnion_def sObjPad_def )\n apply unat_arith\n done\n\n\ndefinition sObj :: \"Obj\\<^sub>T \\ U8 list\"\nwhere\n \"sObj obj \\ sObjHeader obj @ sObjUnion (ounion\\<^sub>f obj) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj)\"\n\nlemma length_sObjHeader:\n \"length (sObjHeader obj) = unat bilbyFsObjHeaderSize\"\n by (simp add: sObjHeader_def length_sle32 length_sle64 bilbyFsObjHeaderSize_def)\n \nlemma length_sObj:\n \"Obj.len\\<^sub>f obj \\ bilbyFsObjHeaderSize \\\n otype\\<^sub>f obj = bilbyFsObjTypePad \\ \n is_valid_Obj obj \\\n length (sObj obj) = unat (Obj.len\\<^sub>f obj)\"\n apply (clarsimp simp add: is_valid_Obj_def split:if_splits)\n apply (drule (2) length_sObjUnion)\n apply (simp add: sObj_def length_sObjHeader word_le_nat_alt)\n done\n\nlemma Obj_inverse:\n \"otype\\<^sub>f obj = bilbyFsObjTypePad \\\n is_valid_Obj obj \\\n Obj.offs\\<^sub>f obj = 0 \\\n pObj (sObj obj @ xs) 0 = obj\"\n unfolding pObj_def sObj_def Let_def\n apply (simp add: ObjHeader_inverse)\n apply (clarsimp simp: is_valid_Obj_def)\n apply (frule (1) ObjUnion_inverse)\n apply (simp add: pObjUnion_def sObjHeader_def word_le_nat_alt length_sObjHeader)\n done\n\nlemma buf_sub_slice_len_simplified:\n \"length v1 = unat j \\ unat (offs :: 32 word) < length (\\wa (data\\<^sub>f buf)) \\\n unat (offs + j) \\ length (\\wa (data\\<^sub>f buf)) \\\n unat offs < unat (offs + j) \\\n length (take (unat offs) (\\wa (data\\<^sub>f buf)) @\n v1 @\n drop (unat (offs + j)) (\\wa (data\\<^sub>f buf))) = length (\\wa (data\\<^sub>f buf))\"\n by simp unat_arith\n \nlemma buf_sub_slice_absorb:\n assumes len1: \"length v1 = unat j\"\n and len2: \"length v2 = unat (k-j)\"\n and j_less: \"j \\ k\"\n and j_nz: \"j > 0\"\n and no_of: \"unat offs < unat (offs + k)\"\n and len_ge: \"unat (offs + k) \\ length (\\wa (data\\<^sub>f buf))\"\n shows \"(buf_sub_slice (buf \\data\\<^sub>f := WordArrayT.make\n (buf_sub_slice buf offs (offs + j) v1)\\)\n (offs + j) (offs + k)\n v2) =\n buf_sub_slice buf offs (offs + k) (v1 @ v2)\"\n proof -\n have j_sub: \"unat (offs + j) - unat offs = unat j\"\n using no_of j_less by unat_arith\n have j_max: \"unat (offs + j) \\ unat offs\"\n using no_of j_less by unat_arith\n have k_j_sub: \"unat (offs + k) - unat (offs + j) = unat (k - j)\"\n using no_of j_less by unat_arith\n have k_sub: \"(unat (offs + k) - unat offs) = unat k\"\n using no_of by unat_arith\n have k_max: \"(unat (offs + k)) \\ (unat offs)\"\n using no_of by unat_arith\n have k_j_max: \"(unat (offs + k)) \\ (unat (offs + j))\"\n using no_of j_less by unat_arith\n have xx: \"\\x v. data\\<^sub>f (x\\data\\<^sub>f := v\\) = v\"\n by simp\n have len_ge': \" unat offs < length (\\wa (data\\<^sub>f buf))\"\n using len_ge no_of by unat_arith\n have len_ge'': \" unat (offs + j) \\ length (\\wa (data\\<^sub>f buf))\"\n using len_ge no_of j_less by unat_arith\n have no_of': \"unat offs < unat (offs + j)\"\n using no_of j_less j_nz by unat_arith\n have len_app: \"length (v1 @ v2) = unat k\"\n using len1 len2 j_less by unat_arith\n have take_prefix: \"(take (unat (offs + j))\n (take (unat offs) (\\wa (data\\<^sub>f buf)) @\n v1 @ drop (unat (offs + j)) (\\wa (data\\<^sub>f buf)))) \n = take (unat offs) (\\wa (data\\<^sub>f buf)) @\n v1\" \n using len1 no_of' len_ge' j_sub by simp\n have drop_prefix: \"drop (unat (offs + k))\n (take (unat offs) (\\wa (data\\<^sub>f buf)) @\n v1 @ drop (unat (offs + j)) (\\wa (data\\<^sub>f buf))) \n = drop (unat (offs + k))(\\wa (data\\<^sub>f buf))\"\n apply (subgoal_tac \"(unat k - unat j + unat (offs + j)) = unat (offs + k)\")\n prefer 2\n using no_of j_less apply unat_arith\n using len1 len_ge' k_sub j_less no_of apply simp\n by unat_arith\n thus ?thesis\n unfolding buf_sub_slice_def \n using j_sub j_max k_j_sub k_sub k_max k_j_max apply (simp only: max_absorb1)\n using len1\n apply (subst take_append[where n=\"unat j\"])+\n apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n using len2 apply (subst take_append[where n=\"unat (k-j)\"])+\n apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n using len_app apply (subst take_append[where n=\"unat k\"])\n apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n using len1 k_j_sub apply (simp only:)\n apply (simp only: xx wordarray_make fun_app_def)\n using len1 len2 len_app apply (simp only: take_all[where n=\"unat j\"]\n take_all[where n=\"unat k\"]\n take_all[where n=\"unat (k-j)\"])\n using len1 len_ge len_ge' len_ge'' no_of' len_app no_of\n by (simp add: buf_sub_slice_len_simplified take_prefix drop_prefix)\n qed\n\n\nlemma serialise_u8_ret':\n notes wa_modify_ret = wordarray_modify_ret[rotated - 1, simplified Let_def ArrayUseValueP.defs]\n assumes no_of: \"offs < offs + 1\"\n and len_ge: \"unat offs + 1 \\ length (\\wa (data\\<^sub>f buf))\"\n shows \"serialise_u8 (buf, offs, v) = \n buf \\data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + 1) [v])\\\"\n proof -\n have offs_sub: \"(unat (offs + 1) - unat offs) = 1\" using no_of by unat_arith\n have no_of_unat: \" unat offs < unat (offs + 1)\" using no_of by (simp add: word_less_nat_alt)\n show ?thesis\n unfolding serialise_u8_def[unfolded sanitizers]\n using no_of len_ge\n apply simp\n apply (rule wa_modify_ret[where index=\"offs\" and varr=\"(data\\<^sub>f buf)\" and modifier=\"setu8\"])\n prefer 2\n apply (unat_arith)\n apply (simp_all add:ArrA.defs ElemAO.defs ElemA.defs\n setu8_def[unfolded tuple_simps sanitizers] wordarray_make buf_simps\n min_absorb1 min_absorb2)\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n apply (simp only: list_eq_iff_nth_eq)\n apply (clarsimp simp: buf_sub_slice_length)\n apply (simp add: buf_sub_slice_def min_absorb1 min_absorb2)\n apply (case_tac \"i=unat offs\")\n apply (simp only: append_assoc[symmetric] nth_append)\n apply (simp add: min_absorb1 min_absorb2)\n apply unat_arith\n apply (case_tac \"i < unat offs\")\n apply (simp add: min_absorb1 offs_sub max_absorb1 no_of no_of_unat nth_append)\n apply (simp add: min_absorb1 offs_sub max_absorb1)\n apply (subgoal_tac \"(max (unat (offs + 1)) (unat offs)) = unat (offs + 1)\")\n prefer 2\n using no_of_unat apply auto[1]\n apply (clarsimp simp add: nth_append nth_Cons split: nat.splits)\n apply (subst nth_drop)\n apply unat_arith\n apply (subgoal_tac \"unat (offs + 1) = unat offs + 1\")\n prefer 2\n using no_of_unat offs_sub apply simp\n apply simp\n apply (subgoal_tac \"i = Suc (unat offs + x2)\")\n apply simp\n apply unat_arith\n done\nqed\n\nlemma serialise_ObjHeader_ret:\n assumes no_overflow: \"offs \\ offs + bilbyFsObjHeaderSize\"\n and is_valid_obj: \"is_valid_ObjHeader obj (drop (unat offs) (\\wa (data\\<^sub>f buf)))\"\n and suc: \"\\buf' offs'. \n offs' = offs + bilbyFsObjHeaderSize \\\n buf' = buf\\data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs +bilbyFsObjHeaderSize) (sObjHeader obj))\\ \\\n P (buf', offs')\"\n shows\n \"P (serialise_ObjHeader (buf, offs, obj))\" \n proof -\n have offs_le_length: \"unat offs \\ length (\\wa (data\\<^sub>f buf))\"\n using is_valid_ObjHeader_len_facts[OF is_valid_obj]\n by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n have offs_sub_le: \"(unat (offs + bilbyFsObjHeaderSize) - unat offs) \\ (length (\\wa (data\\<^sub>f buf)) - unat offs)\"\n using is_valid_obj is_valid_ObjHeader_len_facts[OF is_valid_obj]\n by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n have offs_len_sub_eq: \"unat (offs + bilbyFsObjHeaderSize) - unat offs = unat (bilbyFsObjHeaderSize)\"\n using no_overflow by unat_arith\n have offs_obj_len_le_length: \"unat (offs + bilbyFsObjHeaderSize) \\ length (\\wa (data\\<^sub>f buf))\"\n using is_valid_obj offs_sub_le is_valid_ObjHeader_len_facts[OF is_valid_obj]\n by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n have offs_obj_len_le_length': \"(unat (offs + bilbyFsObjHeaderSize) -\n (unat offs + unat bilbyFsObjHeaderSize)) \\ (length (\\wa (data\\<^sub>f buf)) -\n (unat offs + unat bilbyFsObjHeaderSize))\"\n using offs_obj_len_le_length by unat_arith \n have offs_plus_eq: \" (unat (offs + bilbyFsObjHeaderSize) = (unat offs + unat bilbyFsObjHeaderSize))\"\n using no_overflow by unat_arith\n show ?thesis\n unfolding serialise_ObjHeader_def[unfolded sanitizers tuple_simps]\n apply (simp add: Let_def)\n apply (rule suc)\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply (simp add: buf_sub_slice_def wordarray_make)\n apply (simp add: min_absorb1 offs_le_length offs_sub_le)\n apply (simp add: offs_len_sub_eq length_sObjHeader\n offs_obj_len_le_length' offs_plus_eq)\n using no_overflow apply (simp add: word_le_nat_alt max_absorb1 bilbyFsObjHeaderSize_def)\n using no_overflow offs_obj_len_le_length apply (simp add: bilbyFsObjHeaderSize_def)\n apply (subst serialise_le32_ret[where v=\"magic\\<^sub>f obj\"])\n apply ((unat_arith, auto)+)[2]\n apply (subst serialise_le32_ret[where v=\"crc\\<^sub>f obj\"])\n apply ((unat_arith, auto)+)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=8])\n apply (subst buf_sub_slice_absorb[where offs=offs and j=4 and k=8, simplified])\n apply (simp add: length_sle32)+\n apply unat_arith \n apply auto[1]\n apply unat_arith \n apply auto[1]\n apply (subst serialise_le64_ret)\n apply (unat_arith, auto)[1]\n\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply simp\n apply (subst add.commute[where a=\"0x10\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2]\n apply (subst serialise_le32_ret)\n apply ((unat_arith, auto)+)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=\"0x14\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2]\n apply (subst serialise_u8_ret'[where offs=\"offs + 0x14\"])\n apply (unat_arith, auto)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=\"0x15\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2]\n apply (subst serialise_u8_ret'[where offs=\"offs + 0x15\"])\n apply (unat_arith, auto)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=\"0x16\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2] \n apply (subst serialise_u8_ret'[where offs=\"offs + 0x16\"])\n apply (unat_arith, auto)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=\"0x17\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2] \n apply (subst serialise_u8_ret'[where offs=\"offs + 0x17\"])\n apply (unat_arith, auto)[1]\n apply (simp add: buf_sub_slice_length wordarray_make)\n apply (unat_arith, auto)[1]\n apply (simp)\n apply (subst add.commute[where a=\"0x18\"])\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sle32 length_sle64)+\n apply ((unat_arith, auto)+)[2]\n \n apply (simp add: sObjHeader_def bilbyFsPadByte_def)\n apply (unfold buf_sub_slice_def)\n apply (simp add: offs_len_sub_eq[unfolded bilbyFsObjHeaderSize_def, simplified])\n apply (simp add: length_sle32 length_sle64)\n apply (subgoal_tac \"(length (\\wa (data\\<^sub>f buf)) - unat offs) \\ 24\")\n prefer 2\n using offs_len_sub_eq bilbyFsObjHeaderSize_def apply (unat_arith, auto)[1]\n apply simp\n apply (subgoal_tac \"(unat (offs + 0x18)) > (unat offs)\")\n prefer 2\n using no_overflow apply (unat_arith, auto)[1]\n apply (simp add: max_absorb1)\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n apply simp\n by (subst take_all, \n ( simp add: length_sle32 length_sle64 | (unat_arith, auto)[1] )+\n )+\nqed\n \nlemmas ObjUnion_splits = ObjUnion.splits\n\nlemma take_drop_decomp:\"x \\ a \\ take (x - a) (drop a xs) @ drop x xs = drop a xs\"\n by (metis drop_take drop_take_drop)\n\nlemma serialise_ObjPad_ret:\n assumes no_overflow: \"offs \\ offs + (olen - bilbyFsObjHeaderSize)\"\n and no_underflow: \"olen - bilbyFsObjHeaderSize \\ 0\"\n and bound: \"offs+ (olen - bilbyFsObjHeaderSize) \\ bound\\<^sub>f buf \\ unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf))\" \n and suc: \"\\buf' offs'. \n offs' = offs + olen - bilbyFsObjHeaderSize \\\n buf' = buf\\data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + (olen - bilbyFsObjHeaderSize)) (sObjPad olen))\\ \\\n P (buf', offs')\"\n shows\n \"P (serialise_ObjPad (buf, offs, olen))\"\n proof -\n \n have offs_le_bound: \"offs \\ bound\\<^sub>f buf\"\n using bound no_overflow by unat_arith\n have sub1: \"(unat (olen - 0x18)) \\ (unat (bound\\<^sub>f buf) - unat offs)\"\n using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n by unat_arith\n have sub2: \"(unat (offs + (olen - 0x18)) - unat offs) = unat (olen - 0x18)\"\n using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n by unat_arith (* takes ages *)\n have sub3: \"unat (olen - 0x18) \\ (length (\\wa (data\\<^sub>f buf)) - unat offs)\"\n using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n by unat_arith\n have sub4: \"(unat (offs + (olen - 0x18)) - (unat offs + unat (olen - 0x18))) = 0\"\n using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n by unat_arith\n have sub5: \"(unat offs +\n (unat (olen - 0x18) + length (\\wa (data\\<^sub>f buf))) -\n unat (offs + (olen - 0x18))) = length (\\wa (data\\<^sub>f buf))\"\n using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n by unat_arith\n have no_of_unat: \"unat offs \\ (unat (offs + (olen - 0x18)))\"\n using no_overflow no_underflow by (simp add: bilbyFsObjHeaderSize_def word_le_nat_alt)\n have assoc: \"(unat (offs + (olen - 0x18))) = unat offs + unat (olen - 0x18)\"\n using no_overflow no_underflow by (simp add: bilbyFsObjHeaderSize_def) unat_arith\n show ?thesis\n unfolding serialise_ObjPad_def[unfolded sanitizers tuple_simps]\n apply (simp add: Let_def split: ObjUnion_splits)\n apply (rule suc)\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply (subst buf_memset_eq)\n using bound apply simp\n using no_overflow apply (simp add: bilbyFsObjHeaderSize_def)\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n using bound offs_le_bound apply (clarsimp simp: buf_sub_slice_def bilbyFsObjHeaderSize_def)\n apply (simp add: sObjPad_def bilbyFsPadByte_def buf_simps\n min_absorb1 min_absorb2 word_le_nat_alt sub1 sub2 sub3 sub4 sub5\n bilbyFsObjHeaderSize_def no_of_unat max_absorb1 assoc)\n \n apply (subst take_drop_decomp)\n using no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n apply simp\n done\n qed\n \nlemma serialise_ObjUnion_ret:\n assumes no_overflow: \"offs \\ offs + (olen - bilbyFsObjHeaderSize)\"\n and otype: \"otype = bilbyFsObjTypePad\"\n and ounion: \"\\v. ounion = TObjPad v\"\n and olen: \" 0 \\ olen - bilbyFsObjHeaderSize\"\n and bound: \"offs + (olen - bilbyFsObjHeaderSize) \\ bound\\<^sub>f buf \\ unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf))\" \n and suc: \"\\buf' offs'. \n offs' = offs + olen - bilbyFsObjHeaderSize \\\n buf' = buf\\data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + (olen - bilbyFsObjHeaderSize)) (sObjUnion ounion otype olen))\\ \\\n P (buf', offs')\"\n shows\n \"P (serialise_ObjUnion (buf, offs, ounion, olen))\"\n unfolding serialise_ObjUnion_def[unfolded sanitizers tuple_simps]\n using ounion apply (simp add: Let_def split: ObjUnion_splits)\n apply (rule serialise_ObjPad_ret)\n using no_overflow apply simp\n using olen apply simp\n using bound apply simp\n apply (rule suc, simp)\n apply (simp add: sObjUnion_def)\n done\n\nlemma data\\<^sub>f_of_data\\<^sub>f_update:\n \"data\\<^sub>f (x\\data\\<^sub>f := v\\) = v\"\n by simp\n\nlemma serialise_Obj_ret:\n assumes no_overflow: \"offs \\ offs + Obj.len\\<^sub>f obj\"\n and is_valid_obj: \"is_valid_ObjHeader obj (drop (unat offs) (\\wa (data\\<^sub>f buf)))\"\n and otype: \"otype\\<^sub>f obj = bilbyFsObjTypePad\"\n and ounion: \"\\v. ounion\\<^sub>f obj = TObjPad v\"\n and bound: \" offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf))\"\n and suc: \"\\buf'. \n buf' = buf\\data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + Obj.len\\<^sub>f obj) (sObj obj))\\ \\\n P (buf', offs + Obj.len\\<^sub>f obj)\"\n shows\n \"P (serialise_Obj (buf, offs, obj))\"\n unfolding serialise_Obj_def[unfolded tuple_simps sanitizers]\n apply (simp add: Let_def)\n apply (rule serialise_ObjHeader_ret)\n using no_overflow is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n apply (frule is_len_and_type_ok_hdr_szD, simp add: bilbyFsObjHeaderSize_def)\n apply unat_arith\n using is_valid_obj apply assumption\n apply simp\n apply (rule serialise_ObjUnion_ret)\n using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def )\n apply (frule is_len_and_type_ok_hdr_szD)\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply unat_arith\n apply (rule otype)\n using ounion apply simp\n using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n using bound apply (simp add: wordarray_make buf_sub_slice_length)\n apply simp\n apply (rule suc)\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n apply (thin_tac x for x)+\n apply (subst buf_sub_slice_absorb)\n apply (simp add: length_sObjHeader)\n apply (subst length_sObjUnion[OF ounion otype])\n using is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def is_len_and_type_ok_hdr_szD)\n using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def unat_plus_simple)\n apply (drule is_len_and_type_ok_hdr_szD)\n apply (unat_arith)\n apply (simp add: is_len_and_type_ok_hdr_szD)\n apply(simp add: bilbyFsObjHeaderSize_def)\n using no_overflow is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n apply (simp add: is_len_and_type_ok_def otype otype_simps)\n apply (unat_arith)\n using bound is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def)\n apply unat_arith\n apply (simp add: sObj_def)\n done\n\nlemma binNot_NOT: \"binNot (x::64 word) = NOT x\"\n unfolding binNot_def[unfolded Let_def]\n by (rule subst[where s=\"-1\"], fastforce, fastforce)\n\nlemma deserialise_ObjDel_ret:\n assumes bound: \"unat offs + 8 \\ length (\\wa $ data\\<^sub>f buf)\"\n assumes err: \"P (Error (eInval, ex))\"\n assumes offs: \"offs < offs + 8\"\n assumes suc:\n \"\\obj offs'. \\ \n obj = pObjDel (\\wa $ data\\<^sub>f buf) offs;\n ObjDel.id\\<^sub>f obj AND NOT bilbyFsOidMaskAll \\ \n { bilbyFsOidMaskData, bilbyFsOidMaskInode,bilbyFsOidMaskDentarr};\n offs' = offs + 8\\ \\ \n P (Success (ex, obj, offs'))\"\n shows \"P (deserialise_ObjDel (ex, buf, offs))\"\nproof - \n have des_le64: \"deserialise_le64 (buf, offs) = ple64 (\\wa $ data\\<^sub>f buf) offs\"\n using bound offs\n by (fastforce intro!: deserialise_le64_ret simp: unat_arith_simps)\n show ?thesis\n unfolding deserialise_ObjDel_def[unfolded tuple_simps sanitizers] \n apply (clarsimp simp: Let_def err[simplified eInval_def])\n by (fastforce\n intro: suc\n simp: Let_def binNot_NOT bilbyFsOidMaskData_def des_le64 bilbyFsOidMaskAll_def\n bilbyFsOidMaskInode_def bilbyFsOidMaskDentarr_def pObjDel_def ObjDel.make_def)\nqed\n\nlemma deserialise_ObjInode_ret:\n assumes bound: \"unat offs + 60 \\ length (\\wa $ data\\<^sub>f buf)\"\n assumes offs: \"offs < offs + 60\"\n assumes err: \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex oi offs'. \\ \n oi = pObjInode (\\wa (data\\<^sub>f buf)) offs;\n offs' = offs + 60\\ \\ \n P (Success (ex, oi, offs'))\"\n shows \"P (deserialise_ObjInode (ex, buf, offs))\"\nproof -\n have des_le64:\n \"deserialise_le64 (buf, offs) = (ple64 (\\wa $ data\\<^sub>f buf) offs)\"\n \"deserialise_le64 (buf, offs + 8) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 8))\"\n \"deserialise_le64 (buf, offs + 16) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 16))\"\n \"deserialise_le64 (buf, offs + 24) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 24))\"\n \"deserialise_le64 (buf, offs + 32) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 32))\"\n using bound offs\n by - (simp,rule deserialise_le64_ret[simplified];\n (simp add: unat_arith_simps, unat_arith?))+\n have des_le32:\n \"deserialise_le32 (buf, offs + 40) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 40))\"\n \"deserialise_le32 (buf, offs + 44) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 44))\"\n \"deserialise_le32 (buf, offs + 48) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 48))\"\n \"deserialise_le32 (buf, offs + 52) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 52))\"\n \"deserialise_le32 (buf, offs + 56) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 56))\"\n using bound offs\n by - (simp,rule deserialise_le32_ret[simplified];\n (simp add: unat_arith_simps, unat_arith?))+\n\n show ?thesis\n unfolding deserialise_ObjInode_def[unfolded tuple_simps sanitizers] \n by (fastforce \n intro: suc err\n split: Result.split\n simp: eInval_def eNoMem_def binNot_NOT Let_def bilbyFsOidMaskAll_def des_le32\n bilbyFsOidMaskInode_def word32Max_def pObjInode_def ObjInode.make_def des_le64)\nqed\n\nlemma deserialise_ObjSuper_ret:\n assumes bound: \"unat offs + 40 \\ length (\\wa $ data\\<^sub>f buf)\"\n assumes offs: \"offs \\ offs + 40\" (* added by Yutaka on 11th.*)\n assumes err: \"\\ex. P (Error (eNoMem, ex))\"\n assumes suc:\n \"\\ex osup offs'. \\ \n osup = pObjSuper (\\wa (data\\<^sub>f buf)) offs;\n offs' = offs + 40\\ \\ \n P (Success (ex, osup, offs'))\"\n shows \"P (deserialise_ObjSuper (ex, buf, offs))\"\nproof -\n have des_le64:\n \"deserialise_le64 (buf, offs + 32) = (ple64 (\\wa $ data\\<^sub>f buf) (offs + 32))\"\n using bound offs\n by - (simp,rule deserialise_le64_ret[simplified];\n (simp add: unat_arith_simps, unat_arith?))\n have des_le32:\n \"deserialise_le32 (buf, offs) = (ple32 (\\wa $ data\\<^sub>f buf) offs)\"\n \"deserialise_le32 (buf, offs + 4) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 4))\"\n \"deserialise_le32 (buf, offs + 8) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 8))\"\n \"deserialise_le32 (buf, offs + 12) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 12))\"\n \"deserialise_le32 (buf, offs + 16) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 16))\"\n \"deserialise_le32 (buf, offs + 20) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 20))\"\n \"deserialise_le32 (buf, offs + 24) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 24))\"\n \"deserialise_le32 (buf, offs + 28) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 28))\"\n using bound offs\n by - (simp,rule deserialise_le32_ret[simplified];\n (simp add: unat_arith_simps, unat_arith?))+\n\n show ?thesis\n unfolding deserialise_ObjSuper_def[unfolded tuple_simps sanitizers] \n by (fastforce \n intro: suc err[unfolded eNoMem_def] \n split: Result.split \n simp: pObjSuper_def ObjSuper.make_def des_le32 des_le64)\nqed\n\nlemma slice_Cons_helper:\n \"i < length xs \\\n xs \\ [] \\\n drop i xs = \n (xs ! i) # drop ( (i + 1)) xs\" \n apply (cases xs, simp_all)\n by (metis (no_types, hide_lams) drop_Suc_Cons Cons_nth_drop_Suc length_Cons)\n\nlemma slice_singleton:\n \"f < length xs \\ slice f (Suc f) xs = [xs ! f]\"\n unfolding slice_def by (simp add:drop_take list_eq_iff_nth_eq)\n\nlemma take_n_minus_1_append:\n \"0 xs \\ [] \\ n \\ length xs \\\n take (n - Suc 0) xs @ [xs ! (n - Suc 0)] = take n xs\"\n apply (simp only: list_eq_iff_nth_eq)\n apply clarsimp\n apply (case_tac \"(length xs) < (n - Suc 0)\")\n apply (clarsimp simp add: min_absorb2)+\n by (metis One_nat_def Suc_pred' elem_take_n le0 le_less_trans diff_le_self\n less_not_refl linorder_neqE_nat diff_Suc_less take_Suc_conv_app_nth)\n\nlemma take_n_minus_1_append_eq:\n \"v = xs ! (unat (n - 1)) \\ unat n \\ length xs \\ n> 0 \\\n take (unat ((n::U32) - 1)) xs @ [v] = take (unat n) xs\"\n apply (simp add: list_eq_iff_nth_eq min_absorb2 unat_arith_simps)\n apply clarsimp\n apply (subst take_n_minus_1_append)\n apply simp+\n apply (case_tac xs, simp_all)\n done\n\nlemma slice_n_minus_1_append_last:\n \"unat acc + unat n \\ length xs \\\n (n::U32) > 0 \\\n acc \\ acc + n \\\n slice (unat acc) (unat acc + unat (n - 1)) xs @\n [xs ! unat (acc + (n - 1))] =\n slice (unat acc) (unat acc + unat n) xs\"\n apply (simp add: slice_def list_eq_iff_nth_eq)\n apply (subgoal_tac \"(length xs) \\ (unat acc + unat (n - 1))\")\n prefer 2\n apply unat_arith\n apply (rule conjI)\n apply (simp add: min_absorb1 min_absorb2)\n apply (clarsimp simp: drop_take min_absorb1 min_absorb2 )\n apply (subst take_n_minus_1_append_eq)\n apply simp\n apply (rule arg_cong[where f=\"nth xs\"]) \n apply unat_arith (* takes long *)\n apply simp+\n done\n\nlemma map_deserialise_waU8_map_eq_slice_apply:\n assumes nonempty: \"xs \\ []\"\n assumes \"length xs = unat (n:: 32 word)\"\n assumes n_gr_0: \"n > 0\"\n assumes no_overflow: \"acc \\ acc + n\"\n assumes bound: \"unat acc + length xs \\ length (\\wa d)\"\n shows \"\n (mapAccumObs 0 (length xs) deserialise_waU8_map xs acc d) =\n (FunBucket.slice (unat acc) (unat acc + (length xs)) (\\wa d), acc + n)\"\n using assms\n apply (clarsimp simp: mapAccumObs_def ElemAO.make_def\n deserialise_waU8_map_def[unfolded tuple_simps sanitizers] slice_def[where frm=0])\n apply (induct \"xs\" arbitrary: n rule: rev_nonempty_induct)\n apply (drule sym, simp add: slice_singleton wordarray_get_ret unat_arith_simps)\n apply (drule_tac x=\"n - 1\" in meta_spec)\n apply (erule meta_impE)\n apply unat_arith\n apply (erule meta_impE)\n apply (subgoal_tac \"unat n \\ 2\")\n apply unat_arith\n apply (case_tac xs, simp, simp)\n apply (erule meta_impE)\n apply unat_arith\n apply (erule meta_impE)\n apply unat_arith\n apply (simp add: prod.case_eq_if)\n apply (rule wordarray_get_ret')\n apply unat_arith (* takes a while *)\n apply (simp only: slice_n_minus_1_append_last)\n done\n\nlemma map_deserialise_waU8_map_eq_slice:\n assumes n_gr_0: \"n > 0\"\n assumes no_overflow: \"acc \\ acc + n\"\n assumes bound: \"unat acc + unat n \\ length (\\wa d)\"\n assumes \"length xs = unat (n:: 32 word)\"\n shows \"\n prod.fst (mapAccumObs 0 (unat n) deserialise_waU8_map xs acc d) =\n (FunBucket.slice (unat acc) (unat acc + unat n ) (\\wa d))\"\n using map_deserialise_waU8_map_eq_slice_apply[THEN arg_cong[where f=prod.fst]]\n assms\n\n by (subgoal_tac \"xs \\ []\") (fastforce simp: unat_arith_simps)+\n\nlemma deserialise_wordarray_U8_ret:\n assumes err: \"\\ex. P (Error (eNoMem, ex))\"\n assumes suc: \n \"\\ex wa. \n offs \\ offs + len \\ unat offs + unat len \\ length (\\wa $ data\\<^sub>f buf) \\ \n wa = WordArrayT.make (slice (unat offs) (unat offs + unat len) (\\wa (data\\<^sub>f buf))) \\ \n P (Success (ex, wa))\"\n shows \"P (deserialise_wordarray_U8 (ex, buf, offs, len))\"\n unfolding deserialise_wordarray_U8_def[unfolded tuple_simps sanitizers] \n apply (simp add: Let_def)\n apply (rule wordarray_create_ret)\n apply simp\n apply (simp add: err[unfolded eNoMem_def])\n apply (rename_tac ex' wa)\n apply simp\n apply (rule wordarray_copy_ret)\n apply (simp add:Let_def prod.case_eq_if)\n apply (rule suc)\n apply clarsimp\n done\n\nlemma deserialise_ObjData_ret:\n assumes offs_no_of: \"offs \\ offs + (olen - bilbyFsObjHeaderSize)\"\n assumes buf_len: \"unat (offs + (olen - bilbyFsObjHeaderSize)) \\ length (\\wa (data\\<^sub>f buf))\"\n assumes olen: \"is_len_and_type_ok (bilbyFsObjTypeData, olen)\"\n assumes err: \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex od offs' . \\\n ObjData.id\\<^sub>f od AND NOT bilbyFsOidMaskAll OR bilbyFsOidMaskData = ObjData.id\\<^sub>f od;\n od = pObjData (\\wa (data\\<^sub>f buf)) offs olen;\n offs' = offs + olen - bilbyFsObjHeaderSize\\ \\ \n P (Success (ex, od, offs'))\"\n shows \"P (deserialise_ObjData (ex, buf, offs, olen))\"\n proof -\n\n have hdr_le_olen: \"bilbyFsObjDataHeaderSize \\ (olen - bilbyFsObjHeaderSize)\"\n using olen\n by (simp add: is_len_and_type_ok_def[unfolded sanitizers tuple_simps] otype_simps\n bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def) unat_arith\n\n have offs_pl_hdr_le_offs_pl_olen:\n \"offs + bilbyFsObjDataHeaderSize \\ offs + (olen - bilbyFsObjHeaderSize)\"\n using hdr_le_olen offs_no_of\n by (simp add: bilbyFsObjDataHeaderSize_def bilbyFsObjHeaderSize_def word_plus_mono_right)\n\n\n have offs_pl_hdr_no_of:\n \"offs < offs + bilbyFsObjDataHeaderSize\"\n using offs_no_of hdr_le_olen\n by (simp add: bilbyFsObjDataHeaderSize_def bilbyFsObjHeaderSize_def)\n unat_arith\n\n have offs_pl_hdr_le_buf_len:\n \"unat offs + unat bilbyFsObjDataHeaderSize \\ length (\\wa (data\\<^sub>f buf))\"\n using buf_len hdr_le_olen offs_pl_hdr_no_of offs_pl_hdr_le_offs_pl_olen\n by (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n unat_arith\n\n have unat_offs_pl_olen_etc_eq: \"unat (offs + (olen - bilbyFsObjHeaderSize)) = unat (offs + 8) + unat (0xFFFFFFE0 + olen)\"\n using olen hdr_le_olen offs_pl_hdr_no_of offs_pl_hdr_le_offs_pl_olen\n apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n apply (simp add: is_len_and_type_ok_def[unfolded sanitizers tuple_simps] otype_simps bilbyFsObjHeaderSize_def)\n apply (subgoal_tac \"unat (offs + (olen - 0x18)) = unat (offs + 8) + unat (olen - 0x18 - 8)\")\n apply unat_arith\n apply (simp add: unat_arith_simps)\n apply unat_arith\n done\n\n show ?thesis\n unfolding deserialise_ObjData_def[unfolded tuple_simps sanitizers] \n apply (clarsimp simp: Let_def err[unfolded eNoMem_def eInval_def] binNot_NOT)\n apply (rule deserialise_wordarray_U8_ret)\n apply (simp add: err)\n apply (erule impE)\n using offs_pl_hdr_no_of apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def add.commute add.assoc)\n apply (subgoal_tac \"olen + 0xFFFFFFE8 = olen - 0x18\") (* Oh! Beloved words <3 *)\n prefer 2\n apply simp\n apply (simp only:)\n apply simp\n using offs_pl_hdr_le_offs_pl_olen apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def )\n apply simp\n apply (rule suc)\n apply simp\n apply (simp add: bilbyFsOidMaskAll_def bilbyFsOidMaskData_def\n pObjData_def ObjData.make_def bilbyFsObjHeaderSize_def)\n apply (simp add: Let_def pObjData_def ObjData.make_def bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n apply (subst deserialise_le64_ret)\n using offs_pl_hdr_le_buf_len[simplified bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def]\n apply (simp add:)\n using offs_pl_hdr_no_of\n apply (simp add: bilbyFsObjDataHeaderSize_def)\n apply (erule impE)\n using buf_len unat_offs_pl_olen_etc_eq\n apply simp\n apply simp\n apply (simp add: bilbyFsObjHeaderSize_def)\n done\nqed\n\nlemma deserialise_ObjPad_ret:\n assumes err: \"P (Error (eInval, ex))\"\n assumes suc: \"\\ out offs' .\n \\ olen - bilbyFsObjHeaderSize \\ olen ; \n out=(); \n offs' = offs + (olen - bilbyFsObjHeaderSize) \\ \\ \n P (Success (ex, out, offs'))\"\n shows \"P (deserialise_ObjPad (ex, buf, offs, olen))\"\n unfolding deserialise_ObjPad_def[unfolded tuple_simps sanitizers]\n by (auto simp: Let_def err[unfolded eInval_def] suc[unfolded bilbyFsObjHeaderSize_def] split: Result.split)\n\nlemma no_offs_overflow:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes offs_bound: \"offs \\ (bound\\<^sub>f buf)\"\n assumes \"n < bilbyFsMaxEbSize\"\n assumes \"m < bilbyFsMaxEbSize\"\n shows \"offs + n \\ offs + n + m\"\n using assms\n by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma no_offs_overflow_le:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes offs_bound: \"offs \\ (bound\\<^sub>f buf)\"\n assumes \"n < bilbyFsMaxEbSize\"\n assumes \"m < bilbyFsMaxEbSize\"\n assumes \"m > 0\"\n shows \"offs + n < offs + n + m\"\n using assms\n by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma conc_offs_no_of:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes offs_bound: \"offs \\ (bound\\<^sub>f buf)\"\n assumes \"m < bilbyFsMaxEbSize\"\n assumes \"m > 0\"\n shows \"offs < offs + m\"\n using assms\n by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma slice_take:\n \"m \\ l \\ \n slice n m (take l xs) = slice n m xs\"\n by (simp add: slice_def)\n\nlemma deserialise_pu8_ret:\nassumes valid_offs:\n \"unat offs + 1 < length (\\wa $ data\\<^sub>f buf)\"\nassumes no_of:\n \"offs < offs + 1\"\nshows\n \"deserialise_u8 (buf, offs) = (pu8 (\\wa $ data\\<^sub>f buf) offs)\"\nproof -\n from no_of have no_of': \"offs \\ offs + 1\" by simp\n hence offs_pl_1: \"unat (offs + 1) = unat offs + 1\" by (simp add: unat_plus_simple)\n show ?thesis\nusing valid_offs\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"]\n deserialise_u8_def pu8_def)\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=1], simp add: word_size)\n apply (simp)\n apply (simp add: slice_def)\n apply (simp add: ucast_def)\n apply (subst Cons_nth_drop_Suc[symmetric])\n apply simp\n apply simp\n done\nqed\n\nlemma pu8_take:\n assumes offs:\"offs < offs+1\"\n assumes ntake:\"unat (offs + 1) \\ ntake\"\n shows \"pu8 (take ntake ys) offs = pu8 ys offs\"\n apply (simp add: pu8_def)\n apply (rule arg_cong[where f=\"word_rcat\"])\n apply (rule slice_take)\n using ntake offs by unat_arith\n\nlemma deserialise_ObjDentry_ret:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_buf_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes err:\n \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex dentry offs'. \\\n unat offs + 8 + unat (wordarray_length (name\\<^sub>f dentry)) \\ unat (bound\\<^sub>f buf);\n wordarray_length (name\\<^sub>f dentry) \\ bilbyFsMaxNameLen + 1;\n offs + 8 + wordarray_length (name\\<^sub>f dentry) \\ end_offs ;\n dentry = pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs ;\n offs' = offs + 8 + wordarray_length (name\\<^sub>f dentry);\n offs' \\ (bound\\<^sub>f buf)\n \\ \\\n P (Success (ex, dentry, offs'))\"\n shows \"P (deserialise_ObjDentry (ex, buf, offs, end_offs))\"\nproof -\n {\n fix ex' dentry offs'\n assume des_suc: \"unat offs + 8 \\ unat (bound\\<^sub>f buf)\"\n\n then have offs_ok:\"\\n\\{0..7}. unat (offs + n) < length (\\wa $ data\\<^sub>f buf)\"\n proof -\n from wellformed_buf[unfolded wellformed_buf_def] des_suc\n have \"unat offs + 8 \\ length (\\wa $ data\\<^sub>f buf)\"\n by unat_arith\n\n thus ?thesis\n by unat_arith\n qed\n\n from des_suc have deserialises:\n \"deserialise_le32 (buf, offs) = (ple32 (\\wa $ data\\<^sub>f buf) offs)\"\n \"deserialise_u8 (buf, offs + 4) = (pu8 (\\wa $ data\\<^sub>f buf) (offs + 4))\"\n \"deserialise_le16 (buf, offs + 6) = (ple16 (\\wa $ data\\<^sub>f buf) (offs + 6))\"\n apply clarsimp\n apply(rule deserialise_le32_ret[simplified])\n using assms[simplified bilbyFsMaxEbSize_def wellformed_buf_def]\n apply unat_arith \n using assms[simplified bilbyFsMaxEbSize_def ]\n apply unat_arith\n apply (subst deserialise_pu8_ret)\n using offs_ok des_suc wellformed_buf\n apply (simp add: wellformed_buf_def, unat_arith)\n using des_suc\n apply unat_arith\n apply simp+\n apply(rule deserialise_le16_ret[simplified])\n using offs_ok des_suc wellformed_buf apply (simp add: wellformed_buf_def, unat_arith)\n using des_suc\n apply unat_arith\n done\n }\n note deserialises = this\n\n have offs_le_bound: \"offs \\ bound\\<^sub>f buf\"\n using off_less_end_offs bound by simp\n\n have const_offs_no_of: \"\\n. n < bilbyFsMaxEbSize \\ 0 < n \\ offs < offs + n\"\n apply (rule conc_offs_no_of[OF wellformed_buf no_buf_overflow, unfolded bilbyFsMaxEbSize_def, simplified])\n using offs_le_bound by (simp add:bilbyFsMaxEbSize_def)+\n note no_of_8 = no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=8 and n=0, unfolded bilbyFsMaxEbSize_def, simplified, simplified unat_plus_simple]\n show ?thesis\n unfolding deserialise_ObjDentry_def[simplified tuple_simps sanitizers]\n apply (clarsimp simp: Let_def err[unfolded eNoMem_def eInval_def])\n apply (subst (asm) not_less)+\n apply (rule deserialise_wordarray_U8_ret)\n apply (clarsimp simp add: err)\n apply(clarsimp simp add: err eNoMem_def Let_def prod.case_eq_if split: Result.splits)\n apply (erule impE)\n apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow])\n using off_less_end_offs bound apply fastforce\n apply (simp add: bilbyFsMaxEbSize_def)+\n apply unat_arith\n apply (subgoal_tac \"unat offs + unat (8::32word) + unat (ucast (deserialise_le16 (buf, offs + 6))) \\ unat end_offs\")\n prefer 2\n apply (subst add.assoc)\n apply (subst unat_plus_simple[THEN iffD1, symmetric])\n apply (simp add: unat_arith_simps)\n apply (subst unat_plus_simple[THEN iffD1, symmetric])\n apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow, where n=0, simplified])\n using off_less_end_offs bound apply fastforce\n apply (simp add: bilbyFsMaxEbSize_def)+\n apply (simp add: unat_arith_simps)\n apply (simp add: word_le_nat_alt[symmetric] add.assoc)\n apply (erule impE)\n using bound wellformed_buf[unfolded wellformed_buf_def] \n apply (simp add: unat_arith_simps)\n apply unat_arith\n apply (subgoal_tac \"unat offs + 8 \\ unat (bound\\<^sub>f buf)\")\n prefer 2 \n apply (subst unat_plus_simple[THEN iffD1, symmetric, \n where y=\"8::32word\", simplified])\n apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow, \n where n=0, simplified])\n using off_less_end_offs bound apply fastforce\n apply (simp add: bilbyFsMaxEbSize_def)+ \n apply (subst word_le_nat_alt[symmetric])\n apply (cut_tac no_offs_overflow[OF wellformed_buf no_buf_overflow, \n where offs=offs and n=8 and m=\"ucast (deserialise_le16 (buf, offs + 6))\"])\n using off_less_end_offs bound apply (simp_all add: bilbyFsMaxEbSize_def)\n apply unat_arith\n apply (simp add: deserialises) \n apply (subgoal_tac \"wordarray_length (WordArrayT.make\n (FunBucket.slice (unat (offs + 8)) \n (unat (offs + 8) + unat (ucast (ple16 (\\wa (data\\<^sub>f buf)) (offs + 6)) :: 32 word))\n (\\wa (data\\<^sub>f buf)))) \\ ucast (ple16 (\\wa (data\\<^sub>f buf)) (offs + 6))\")\n prefer 2\n apply (subst wordarray_length_ofnat)\n apply (simp add: wordarray_length_ret)\n apply (subst wordarray_make)\n apply (simp add: slice_length)\n apply (subst min_absorb1) \n prefer 3\n using wellformed_buf[unfolded wellformed_buf_def] no_buf_overflow[unfolded bilbyFsMaxEbSize_def]\n apply (simp add: unat_arith_simps)\n apply (subgoal_tac \n \"unat (ucast (ple16 (\\wa (data\\<^sub>f buf)) (offs + 6)) :: 32 word) = \n unat (ple16 (\\wa (data\\<^sub>f buf)) (offs + 6))\")\n prefer 2 \n apply (fastforce intro: uint_up_ucast simp: eq_nat_nat_iff unat_def is_up)\n apply (rule suc)\n apply (simp_all add: Let_def pObjDentry_def ObjDentry.make_def bilbyFsMaxNameLen_def)\n using bound apply unat_arith\n using wellformed_buf[unfolded wellformed_buf_def] no_buf_overflow[unfolded bilbyFsMaxEbSize_def]\n apply (simp add: unat_arith_simps)\n apply (simp add: ple16_take ple32_take const_offs_no_of bilbyFsMaxEbSize_def plus_no_overflow_unat_lift[OF const_offs_no_of[unfolded bilbyFsMaxEbSize_def, simplified]])\n apply (subst ple16_take)\n apply (rule no_offs_overflow_le[OF wellformed_buf no_buf_overflow offs_le_bound])\n apply (simp add: bilbyFsMaxEbSize_def)+\n using no_of_8\n apply (simp add: add.commute)\n apply (subst ple16_take)\n apply (rule no_offs_overflow_le[OF wellformed_buf no_buf_overflow offs_le_bound])\n apply (simp add: bilbyFsMaxEbSize_def)+\n using no_of_8\n apply (simp add: add.commute)\n apply (subst pu8_take)\n using no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=5 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=4 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n apply (simp add: add.commute unat_plus_simple)\n apply unat_arith\n using no_of_8\n no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=5 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n apply (fastforce simp add: unat_plus_simple add.commute)\n apply (subst ObjDentry.surjective, simp)\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (rule slice_take[symmetric], simp)\n apply (rule word_unat.Rep_eqD)\n apply (simp add: wordarray_length_ret wordarray_make length_slice)\n using no_of_8 wellformed_buf\n apply (simp add: wellformed_buf_def)\n apply unat_arith\n using wellformed_buf[unfolded wellformed_buf_def] no_buf_overflow[unfolded bilbyFsMaxEbSize_def]\n apply (simp add: unat_arith_simps)\n done\nqed\n\nlemma loop_deserialise_ObjDentry_ret:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_buf_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes st_offs: \"st_offs \\ offs\"\n shows \"case loop_deserialise_ObjDentry (OptElemAO.make dentry (ex, offs) (buf, end_offs)) of\n Break (none, e, ex) \\ none= Option.None () \\ e = eInval \n | Iterate (optdentry, ex, offs') \\\n \\dentry. optdentry = Option.Some dentry \\\n unat offs + 8 + unat (wordarray_length (name\\<^sub>f dentry)) \\ unat (bound\\<^sub>f buf) \\\n wordarray_length (name\\<^sub>f dentry) \\ bilbyFsMaxNameLen + 1 \\\n offs + 8 + wordarray_length (name\\<^sub>f dentry) \\ end_offs \\\n dentry = pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs \\\n offs' = offs + 8 + wordarray_length (name\\<^sub>f dentry) \\\n offs' \\ (bound\\<^sub>f buf)\"\n unfolding loop_deserialise_ObjDentry_def[unfolded tuple_simps sanitizers]\n apply (clarsimp simp: Let_def OptElemAO.make_def)\n apply (rule deserialise_ObjDentry_ret[OF assms(1-4)])\n by (clarsimp simp: eInval_def)+\n\nlemma slice_Cons:\n \"frm < length xs \\ frm < to\n \\ slice frm to xs = xs ! frm # slice (Suc frm) to xs\"\n apply (simp add: slice_def)\n apply (subst slice_Cons_helper[where i=frm], simp_all)\n apply clarsimp\n done\n\nlemma slice_list_update:\n \"n < length xs\n \\ slice i j (xs[n := x]) = (if n < i then slice i j xs\n else if n \\ j then slice i j xs\n else (slice i j xs)[n - i := x])\"\n by (simp add: slice_def drop_list_update take_list_update)\n\nlemma mapAccumObsOpt_step:\n assumes frm: \"frm < to\" \"frm < length xs\"\n shows \"mapAccumObsOpt frm to fn xs vacc obs =\n (case fn (OptElemAO.make (xs ! frm) vacc obs)\n of Iterate (oelem, acc) \\ \n mapAccumObsOpt (Suc frm) to fn (xs [frm := oelem]) acc obs\n | Break (oelem, d) \\ Break (xs [frm := oelem], d))\"\nproof -\n let ?folder = \"(\\elem. case_LoopResult (\\(ys, d). Break (ys @ [elem], d))\n (\\(ys, acc).\n case fn (OptElemAO.make elem acc obs) of\n Break (oelem, d) \\ Break (ys @ [oelem], d)\n | Iterate (oelem, acc) \\ Iterate (ys @ [oelem], acc)))\"\n\n { fix xs ys d\n have fold_break: \"fold ?folder xs (Break (ys, d))\n = Break (ys @ xs, d)\"\n by (induct xs arbitrary: ys d, simp_all)\n }\n note fold_break = this\n\n have fold_iterate_Cons: \"\\xs. \\y ys acc. fold ?folder xs (Iterate (y # ys, acc))\n = (case (fold ?folder xs (Iterate (ys, acc)))\n of Iterate (zs, acc) \\ Iterate (y # zs, acc)\n | Break (zs, d) \\ Break (y # zs, d))\"\n apply (induct_tac xs, simp_all)\n apply clarsimp\n apply (case_tac \"fn (OptElemAO.make a acc obs)\")\n apply (clarsimp simp add: fold_break)\n apply clarsimp\n done\n\n from frm have drop_helper: \"\\x xs. drop (to - frm) (x # xs) = drop (to - Suc frm) xs\"\n apply (cases \"to - frm\", simp_all)\n apply (cases to, simp_all)\n apply (cases frm, simp_all)\n apply (metis Suc_diff_Suc Suc_inject)\n done\n\n show ?thesis using frm\n apply (simp add: mapAccumObsOpt_def)\n apply (simp add: slice_Cons)\n apply (cases \"fn (OptElemAO.make (xs ! frm) vacc obs)\")\n apply (clarsimp simp: fold_break)\n apply (simp add: slice_def upd_conv_take_nth_drop max_absorb2)\n apply (subst append_take_drop_id\n [where xs=\"drop (Suc frm) xs\" and n=\"to -frm - 1\", \n simplified take_drop, symmetric])\n apply simp\n apply (clarsimp simp: mapAccumObsOpt_def slice_list_update take_list_update)\n apply (simp add: fold_iterate_Cons)\n apply (simp split: LoopResult.split)\n apply (clarsimp simp: slice_def upd_conv_take_nth_drop min_absorb2 max_absorb2\n drop_helper)\n done\n qed\n\nlemma mapAccumObsOpt_n_n:\n \"mapAccumObsOpt n n fn xs vacc obs = Iterate (xs, vacc)\"\n by (clarsimp simp: mapAccumObsOpt_def slice_n_n)\n\nlemma mapAccumObsOpt_frm_eq_len:\n \"frm = length xs \\ mapAccumObsOpt frm to fn xs vacc obs = Iterate (xs @ [], vacc)\"\n by (clarsimp simp: mapAccumObsOpt_def slice_def)\n\nlemma snd_fold_simp:\n \"prod.snd (fold (\\_ (a, b). (f a b, f' b)) xs (a,b)) =\n fold (\\_ b. f' b) xs b\"\n by (induct xs arbitrary: a b, simp_all) \n\nlemma fst_fold_append_simp:\n \"prod.fst (fold (\\_ (xs, n). (xs @ [f n], f' n)) ls (f n' # xs, f' n)) = \n f n' # prod.fst (fold (\\_ (xs, n). (xs @ [f n], f' n)) ls (xs, f' n)) \"\n by (induct ls arbitrary: n xs, simp_all)\n\nlemma snd_snd_fold_simp:\n \"(prod.snd (fold (\\_ (xs, doffs, offslist). (f xs doffs, f' doffs, f'' doffs offslist)) ls (xs, n, offslist))) =\n fold (\\_ (doffs, offslist). (f' doffs, f'' doffs offslist)) ls (n, offslist)\" \n by (induct ls arbitrary: xs n offslist, simp_all) \n\nlemma snd_fold_append_gen_simp:\n \"prod.snd (fold (\\_ (x, xs). (f' x, xs @ [f x])) ls (x, xs @ ys)) =\n xs @ prod.snd (fold (\\_ (x, xs). (f' x, xs @ [f x])) ls (x, ys))\"\n by (induct ls arbitrary: x ys, simp_all)\n\nlemma snd_fold_append_simp:\n \"prod.snd (fold (\\_ (x, xs). (f' x, xs @ [f x])) ls (x, xs)) =\n xs @ prod.snd (fold (\\_ (x, xs). (f' x, xs @ [f x])) ls (x, []))\"\n using snd_fold_append_gen_simp[where ys=Nil, simplified] .\n\nlemma fst_fold_triple_simp:\n \"prod.fst (fold (\\_ (a, b, c). (f a b, f' b, f'' b c)) ns (a, b, c)) =\n prod.fst (fold (\\_ (a, b). (f a b, f' b)) ns (a, b))\"\n by (induct ns arbitrary: a b c, simp_all)\n\nlemma fst_snd_fold_triple_simp:\n \"prod.fst (prod.snd (fold (\\_ (a, b, c). (f a b, f' b, f'' b c)) ns (a, b, c))) =\n prod.snd (fold (\\_ (a, b). (f a b, f' b)) ns (a, b))\"\n by (induct ns arbitrary: a b c, simp_all)\n\ndefinition dentarr_offs_list_drop :: \"U8 list \\ U32 \\ nat list \\ U32 \\ (32 word list)\"\nwhere\n \"dentarr_offs_list_drop data ost entriesno offs =\n prod.snd (fold (\\_ (doffs, offslist).\n let dentry = pObjDentry (drop (unat offs) data) (doffs - offs);\n newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n in (newoffs, offslist @ [newoffs]))\n entriesno (ost, []))\n\"\ndefinition\n dentarr_offs_list_drop_end_offs_pred\nwhere\n \"dentarr_offs_list_drop_end_offs_pred data ost entriesno offs end_offs \\\n \\v\\set (dentarr_offs_list_drop data ost entriesno offs).\n v \\ end_offs\"\n\ndefinition\n \"dentarr_offs_list data ost entriesno \\ \n (prod.snd (fold (\\_ (doffs, offslist).\n let dentry = pObjDentry data doffs;\n newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n in (newoffs, offslist @ [newoffs]))\n entriesno (ost, [])))\"\n\ndefinition\n dentarr_offs_list_end_offs_pred\nwhere\n \"dentarr_offs_list_end_offs_pred data ost entriesno end_offs \\\n \\v\\set (dentarr_offs_list data ost entriesno).\n v \\ end_offs\"\n\ndefinition\n dentarr_otype_end_offs_pred\nwhere\n \"dentarr_otype_end_offs_pred otype data offs end_offs \\\n (otype = bilbyFsObjTypeDentarr \\\n (let nbentry = ple32 data (offs + 8)\n in dentarr_offs_list_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0..\n (otype = bilbyFsObjTypeDentarr \\\n (let nbentry = ple32 data (offs+8)\n in dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize)\n [0..\n (otype = bilbyFsObjTypeDentarr \\\n (let nbentry = ple32 data (offs+8)\n in dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize)\n [0.. length xs\"\n assumes \"offs + 4 < end_offs\"\n shows \"ple32 xs offs = ple32 (slice (unat offs) (unat end_offs) xs) 0\"\n using assms \n apply (simp add: slice_def ple32_def drop_take word_add_eq_unat)\n apply (drule less_to_le, simp add: unat_plus_simple word_less_nat_alt)\n done\n\nlemma split_upt_on_l_n:\n \"n < m \\ l \\ n \\ [l ..< m] = [l ..< n] @ [n] @ [Suc n ..< m]\"\n apply (subst upt_add_eq_append')\n apply simp+\n apply (simp add: upt_conv_Cons)\n done\n\nlemma unat_plus_simple_imp:\n \"x \\ (x::'a::len word) + y \\ (unat (x + y) = unat x + unat y)\"\n by (simp add: unat_plus_simple)\n\nlemma pObjDentry_drop_eq:\n assumes offs_le_ost: \"offs \\ ost\"\n and ost_no_of8: \" ost < ost + 8\"\n and ost_le_offs_olen: \" ost \\ end_offs\"\n and offs_olen_ys: \"unat end_offs \\ length ys\"\n and ys_le_max: \" length ys \\ unat bilbyFsMaxEbSize\"\n and end_offs: \"end_offs_nat = unat end_offs\"\n shows \" pObjDentry (take end_offs_nat ys) ost = pObjDentry (drop (unat offs) (take end_offs_nat ys)) (ost - offs)\"\nproof -\n have ost_4_nat: \"unat (ost + 4) = unat ost + 4\"\n using ost_no_of8 by (simp add: unat_arith_simps) unat_arith\n\n have ost_le_max: \"ost \\ bilbyFsMaxEbSize\" using ys_le_max offs_olen_ys ost_le_offs_olen\n by unat_arith\n\n hence offs_le_max: \"offs \\ bilbyFsMaxEbSize\"\n using offs_le_ost by unat_arith\n\n\n have ost_minus_offs_bound: \"ost - offs \\ bilbyFsMaxEbSize\"\n using offs_le_ost ost_le_max\n by unat_arith\n\n have ost_no_ofs: \"ost < ost + 4\" \"ost < ost + 6\" using ost_no_of8\n by (clarsimp simp add: unat_arith_simps , unat_arith)+\n\n hence ost_offs_x: \"unat (ost - offs + 4) = unat ost - unat offs + 4\"\n \"unat (ost - offs + 6) = unat ost - unat offs + 6\"\n \"unat (ost - offs + 8) = unat ost - unat offs + 8\"\n using offs_le_ost offs_le_ost[simplified word_le_nat_alt] ost_4_nat \n ost_minus_offs_bound\n apply (simp_all add: bilbyFsMaxEbSize_def)\n apply ((drule plus_no_overflow_unat_lift)+, \n (subst unat_plus_simple_imp,\n simp only: word_le_nat_alt, unat_arith,subst unat_sub, simp+))\n\n apply ((drule plus_no_overflow_unat_lift)+, \n (subst unat_plus_simple_imp,\n simp only: word_le_nat_alt, unat_arith,subst unat_sub, simp+))\n\n apply ((drule plus_no_overflow_unat_lift)+)\n apply (subst unat_plus_simple_imp)\n apply (simp only: word_le_nat_alt word_less_nat_alt)\n using offs_le_max[simplified bilbyFsMaxEbSize_def word_le_nat_alt]\n ost_no_of8\n\n apply (simp only:unat_arith_simps)\n apply unat_arith\n apply (subst unat_sub, simp+)\n done\n\n have offs_cancel: \"(unat ost - unat offs + 4 + unat offs) = unat ost + 4\" \n \"(unat ost - unat offs + 6 + unat offs) = unat ost + 6\"\n \"(unat ost - unat offs + 8 + unat offs) = unat ost + 8\"\n using offs_le_ost[simplified word_less_nat_alt] by unat_arith+\n\n have ple16_eq: \"ple16 (take end_offs_nat ys) (ost + 6) = ple16 (drop (unat offs) (take end_offs_nat ys)) (ost - offs + 6)\"\n apply (simp add: ple16_def)\n apply (rule arg_cong[where f=word_rcat])\n apply (rule arg_cong[where f=rev])\n apply (rule arg_cong[where f=\"take 2\"])\n apply (fastforce simp add: ost_offs_x offs_cancel less_to_le[OF ost_no_ofs(2), simplified unat_plus_simple])\n done\n\n have offs_cancel': \"\\v. unat ost - unat offs + 8 + unat v + unat offs = unat ost + 8 + unat v\"\n using offs_le_ost[simplified word_less_nat_alt]\n by unat_arith\n\n show ?thesis\n apply (simp add: pObjDentry_def Let_def ObjDentry.make_def)\n apply (rule conjI)\n apply (simp add: ple32_def)\n apply (rule arg_cong[where f=word_rcat])\n apply (rule arg_cong[where f=rev])\n apply (rule arg_cong[where f=\"take 4\"])\n apply (subst unat_sub[OF offs_le_ost])\n using offs_le_ost\n apply (subst add_diff_assoc2, fastforce simp: word_le_nat_alt)\n apply fastforce\n apply (rule conjI)\n apply (simp add: pu8_def )\n apply (rule arg_cong[where f=word_rcat])\n apply (simp only: slice_def drop_take fun_app_def)\n using ost_offs_x ost_4_nat\n apply simp\n apply (simp add: take_drop offs_cancel)\n apply (subst add.commute, fastforce simp only: offs_cancel)\n apply (simp add: ple16_eq )\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (subgoal_tac \"\\v. ple16 (drop (unat offs) (take (unat offs + unat (Obj.len\\<^sub>f obj)) ys)) (ost - offs + 6) = v\")\n apply (erule exE)\n apply (simp only: ost_offs_x less_to_le[OF ost_no_of8, simplified unat_plus_simple])\n apply (simp add: slice_def take_drop )\n apply (simp add: offs_cancel offs_cancel')+\n done\nqed\n\nlemma wa_length_ObjDentry_name_le:\n \"unat (wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry xs ost))) \\ length xs\"\n by (simp add: pObjDentry_def Let_def ObjDentry.make_def wordarray_make wordarray_length_ret slice_def)\n\nlemma wa_length_ObjDentry_name_le_len:\n \"unat (wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry xs ost))) \\ unat (ple16 xs (ost + 6))\"\n by (simp add: pObjDentry_def Let_def ObjDentry.make_def wordarray_make wordarray_length_ret slice_def)\n\nlemma dentarr_end_offs_list_induct_helper:\n assumes diff: \"Suc diff = unat to - frm\"\n and ih: \"dentarr_offs_list_end_offs_pred (take (unat end_offs) (\\wa (data\\<^sub>f buf))) (offs + 8 +\n wordarray_length\n (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs)))\n [Suc frm..f (pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs))\n \\ end_offs\"\n shows\n \"dentarr_offs_list_end_offs_pred (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs [frm..\n length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize \\\n offs + 8 + wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs)) \\ bound\\<^sub>f buf \\\n offs \\ bilbyFsMaxEbSize \\\n offs < offs + 8\"\n apply (simp add: bilbyFsMaxEbSize_def)\n using wa_length_ObjDentry_name_le[where xs=\"(take (unat end_offs) (\\wa (data\\<^sub>f buf)))\" and ost=offs]\n apply (clarsimp simp add: wellformed_buf_def)\n apply (simp add: unat_arith_simps)\ndone\n\nlemma mapAccumObsOpt_loop_deserialise_ObjDentry_ret:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_buf_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes frm: \"frm \\ unat (to::word32)\" \"unat to \\ length ys\" \n assumes st_offs: \"st_offs \\ offs\"\n shows \n \"let list_spec = \n case (fold (\\_ (xs, doffs, offslist).\n let dentry = pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) doffs ;\n newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n in (xs@[Option.Some dentry], \n newoffs, offslist @ [newoffs])) \n [frm.. ((take frm ys) @ xs @ (drop (unat to) ys), offs);\n data = take (unat end_offs) (\\wa (data\\<^sub>f buf)) in\n (case mapAccumObsOpt frm (unat to) loop_deserialise_ObjDentry \n ys (ex, offs) (buf, end_offs) of\n Break (ys, d, ex) \\ \n d \\ {eInval, eNoMem}\n | Iterate (ys, ex, offs') \\ \n \n (ys, ex, offs') = (prod.fst list_spec, ex, prod.fst (prod.snd list_spec)) \\\n offs' \\ end_offs \\\n dentarr_offs_list_end_offs_pred data offs [frm..\n dentarr_offs_list_drop_end_offs_pred data offs [frm.. bilbyFsMaxEbSize\"\n using rest by (simp add: unat_arith_simps wellformed_buf_def) \n\n hence offs_pl_8: \"offs < offs + 8\"\n by (simp add: bilbyFsMaxEbSize_def unat_arith_simps)\n\n have offs_pl_8_pl_name:\n \"offs + 8 \\ offs + 8 + wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs))\"\n using wa_length_ObjDentry_name_le[where xs=\"take (unat end_offs) (\\wa (data\\<^sub>f buf))\" and ost=offs] rest offs_le_max\n less_to_le[OF offs_pl_8]\n by (simp add: wellformed_buf_def bilbyFsMaxEbSize_def unat_arith_simps)\n\n have pObjDentry_eq: \n \"pObjDentry (drop (unat st_offs) (take (unat end_offs) (\\wa (data\\<^sub>f buf)))) (offs - st_offs) = pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs\"\n using rest offs_pl_8 by (fastforce intro: pObjDentry_drop_eq[symmetric,where end_offs=end_offs and offs=st_offs]\n simp add: wellformed_buf_def word_le_nat_alt)\n \n from rest show ?case\n apply (subst mapAccumObsOpt_step, simp, simp)\n apply (clarsimp simp: Let_def split: LoopResult.split)\n apply (rule conjI)\n using loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound , \n where dentry=\"ys ! frm\" and ex = ex and offs=offs]\n apply fastforce\n apply clarsimp\n apply (rename_tac elem ex' offs')\n apply (cut_tac \n frm=\"Suc frm\" and \n ys= \"ys[frm := elem]\" and \n ex =ex' and offs = offs' in IH[OF _ wellformed_buf no_buf_overflow bound], simp_all)\n apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound ,\n where dentry=\"ys ! frm\" and ex = ex and offs=offs and st_offs=st_offs], simp_all)\n apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound ,\n where dentry=\"ys ! frm\" and ex = ex and offs=offs and st_offs=st_offs], simp_all)\n apply clarsimp\n using offs_pl_8_pl_name less_to_le[OF offs_pl_8]\n apply (fastforce simp add: unat_plus_simple word_le_nat_alt)\n apply (clarsimp simp: Let_def)\n apply (rule conjI)\n apply fastforce\n apply (clarsimp simp: Let_def)\n apply (rename_tac ex'')\n apply (thin_tac \"mapAccumObsOpt _ _ _ _ _ _ = _\")\n apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound, \n where dentry=\"ys ! frm\" and ex = ex and offs=offs], simp_all)\n\n apply (clarsimp simp: Let_def fst_fold_triple_simp fst_snd_fold_triple_simp prod.case_eq_if)\n apply (rule conjI)\n apply (simp add: upt_conv_Cons[where i = frm])\n apply (subst take_Suc_conv_app_nth, simp)\n apply (simp add: take_list_update prod.case_eq_if snd_fold_simp)\n apply (subst fst_fold_append_simp[where xs=\"[]\", simplified, symmetric]) \n apply fastforce\n\n apply (rule conjI)\n apply (simp add: snd_fold_simp)\n apply (case_tac \"[frm..f (pObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs))\")\n apply simp\n\n apply (simp add: dentarr_offs_list_drop_def)\n apply (subst (asm) split_upt_on_l_n[where l=frm and n=frm, simplified], fastforce)\n apply (simp add: Let_def)\n apply (subst (asm) snd_fold_append_simp[where xs=\"[_]\"])\n apply (erule_tac x=\"offs' \" in ballE, fastforce)\n apply (fastforce simp add: pObjDentry_eq)\n done\nqed \n\nlemma replicate_simp:\n \"replicate (unat to + 1 - unat to) (Option.None ()) = [Option.None ()]\"\n by (simp add: unat_arith_simps)\n\nlemma mapAccumObsOpt_loop_deserialise_ObjDentry_array_ret:\n assumes wellformed_buf: \"wellformed_buf buf\"\n assumes no_buf_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes st_offs: \"st_offs \\ offs\"\n shows\n \"let data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n arr_spec = pArrObjDentry data offs to in \n (case mapAccumObsOpt 0 (unat to) loop_deserialise_ObjDentry \n (replicate (unat to + 1) (Option.None ())) (ex, offs) (buf, end_offs) of\n LoopResult.Break (ys, d, ex) \\ \n d \\ {eInval, eNoMem}\n | LoopResult.Iterate (ys, ex, offs') \\ \n (ys, ex, offs') = (\\a (prod.fst arr_spec), ex, prod.fst (prod.snd arr_spec)) \\ \n offs' \\ end_offs \\\n dentarr_offs_list_end_offs_pred data offs [0..\n dentarr_offs_list_drop_end_offs_pred data offs [0..wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes st_offs: \"st_offs \\ offs\"\n shows \"case array_map (ArrayMapP.make (ArrayT.make (replicate (unat to + 1) (Option.None ())))\n 0 to loop_deserialise_ObjDentry (ex, offs) (buf, end_offs)) of\n LoopResult.Break (arr, err, ex) \\ err \\ {eInval, eNoMem}\n | LoopResult.Iterate (arr, ex', offs') \\\n let data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n (parr, poffs, poffslist) = pArrObjDentry data offs to;\n ostlist = pArrObjDentry data offs to\n in\n arr = parr \\ offs' = poffs \\\n offs' \\ end_offs \\\n dentarr_offs_list_end_offs_pred data offs [0..\n dentarr_offs_list_drop_end_offs_pred data offs [0..wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"end_offs \\ bound\\<^sub>f buf\"\n assumes off_less_end_offs: \"offs \\ end_offs\"\n assumes st_offs: \"st_offs \\ offs\"\n assumes offs_pl_8_no_of: \"offs \\ offs + 8\"\n assumes offs_pl_8_le_end_offs: \"offs + 8 \\ end_offs\"\n assumes err: \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex arr offs' offslist data.\n \\ (arr, offs',offslist) = (pArrObjDentry (take (unat end_offs) (\\wa (data\\<^sub>f buf))) offs nb_dentry);\n offs' \\ end_offs;\n data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n dentarr_offs_list_end_offs_pred data offs [0.. \\\n P (Success (ex, arr, offs'))\"\n shows \"P (deserialise_Array_ObjDentry (ex, buf, offs, nb_dentry, end_offs))\"\n unfolding deserialise_Array_ObjDentry_def[unfolded tuple_simps sanitizers]\n apply (simp add: Let_def)\n apply (rule array_create_ret)\n apply (simp add: err[unfolded eNoMem_def])\n apply (rename_tac ex' arr a)\n apply (subgoal_tac \"unat nb_dentry + 1 = unat (nb_dentry+1) \")\n apply (clarsimp simp: prod.case_eq_if id_def Let_def split: LoopResult.splits)\n apply (subgoal_tac \"a = ArrayT.make (replicate (unat (nb_dentry + 1)) (Option.None ()))\", simp)\n apply (cut_tac ex=ex' in array_map_loop_deserialise_ObjDentry_ret[simplified ArrayMapP.defs, OF assms(1-5), where to = nb_dentry])\n apply (clarsimp simp: Let_def err split: LoopResult.splits)\n apply (rename_tac offslist a ex'' offs')\n apply (rule suc)\n apply simp+ \n apply (metis array_make')\n apply unat_arith\n done\n\n\nlemma word_add_diff_assoc:\n \"(a::'a:: len0 word) + b - c = a + (b - c)\"\n by simp\n\nmethod offs_olen_of_solver =\n (((drule less_to_le)?, simp add: word_add_diff_assoc unat_plus_simple),\n (simp only: unat_arith_simps)?, simp? ; unat_arith)\n\nlemma deserialise_ObjDentarr_ret:\n assumes wf: \"wellformed_buf buf\"\n assumes buf_len: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes err: \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes offs_bound: \"offs + olen - bilbyFsObjHeaderSize \\ (bound\\<^sub>f buf)\"\n assumes offs_olen: \"offs < offs + olen - bilbyFsObjHeaderSize\"\n assumes olen: \"bilbyFsObjHeaderSize + bilbyFsObjDentarrHeaderSize + bilbyFsObjDentryHeaderSize \\ olen\"\n assumes st_offs: \"st_offs \\ offs\"\n assumes suc:\n \"\\ex dentarr offs'. \\\n dentarr = pObjDentarr (\\wa (data\\<^sub>f buf)) offs olen;\n offs' = pObjDentarrSize (\\wa (data\\<^sub>f buf)) offs olen;\n let end_offs = offs + olen - bilbyFsObjHeaderSize;\n data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n nb_dentry = ple32 (\\wa (data\\<^sub>f buf)) (offs+8) in\n dentarr_offs_list_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0..\n dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0.. offs + olen - bilbyFsObjHeaderSize\n \\ \\\n P (Success (ex, dentarr, offs'))\"\n notes bilbyFsObjDentarrHeaderSize_def[simp] bilbyFsObjHeaderSize_def[simp]\n bilbyFsObjDentryHeaderSize_def[simp]\n shows \"P (deserialise_ObjDentarr (ex, buf, offs, olen))\"\n proof -\n\n have offs_no_of: \"offs < offs + bilbyFsObjDentarrHeaderSize\"\n using olen and offs_olen by simp unat_arith\n\n have bound_max: \"bound\\<^sub>f buf \\ bilbyFsMaxEbSize\"\n using wf and buf_len by (simp add: wellformed_buf_def) unat_arith\n\n have offs_bound': \"offs < bilbyFsMaxEbSize\"\n using offs_bound offs_olen bound_max offs_no_of by simp\n\n have offs_hdr_no_of: \"offs < offs + bilbyFsObjDentarrHeaderSize\"\n using offs_bound' by (simp add: bilbyFsMaxEbSize_def unat_arith_simps)\n\n have offs_pl_hdr_le_len: \"unat offs + unat bilbyFsObjDentarrHeaderSize \\ length (\\wa $ data\\<^sub>f buf)\"\n using offs_bound wf offs_no_of offs_olen olen\n by (simp add: wellformed_buf_def) unat_arith\n have deserialises:\n \"deserialise_le32 (buf, offs + 8) = (ple32 (\\wa $ data\\<^sub>f buf) (offs + 8))\"\n \"deserialise_le64 (buf, offs) = (ple64 (\\wa $ data\\<^sub>f buf) offs)\"\n using offs_pl_hdr_le_len apply (clarsimp simp:)\n apply (rule deserialise_le32_ret[simplified])\n using offs_hdr_no_of apply unat_arith\n using offs_hdr_no_of apply (simp add: unat_arith_simps)\n apply unat_arith\n\n using offs_pl_hdr_le_len apply (clarsimp)\n apply (rule deserialise_le64_ret[simplified])\n using offs_hdr_no_of apply unat_arith\n using offs_hdr_no_of apply (simp add: unat_arith_simps)\n apply unat_arith\n done\n show ?thesis\n unfolding deserialise_ObjDentarr_def[unfolded tuple_simps sanitizers]\n apply (clarsimp simp: Let_def err[unfolded eInval_def])\n apply (subgoal_tac \"\\v. olen - bilbyFsObjHeaderSize = v \\ bilbyFsObjDentarrHeaderSize + bilbyFsObjDentryHeaderSize \\ v\")\n apply (erule exE)\n apply (erule conjE)\n apply (rule deserialise_Array_ObjDentry_ret[OF assms(1,2), where st_offs=st_offs,\n simplified])\n using offs_bound apply simp\n subgoal using offs_olen olen by - offs_olen_of_solver\n subgoal for v\n using st_offs offs_olen by - offs_olen_of_solver\n subgoal for v\n using offs_olen by - offs_olen_of_solver\n subgoal for v\n using offs_olen by (simp add: word_add_diff_assoc add.commute)\n (rule word_plus_mono_right; simp)\n subgoal for v _ e by (fastforce intro: err)\n subgoal for v ex arr offs' offslist\n apply (case_tac \"Result.Success (ex, arr, offs')\", simp_all)\n apply (clarsimp simp: Let_def err[unfolded eNoMem_def] split: Result.split)\n apply (rule suc)\n subgoal\n apply (simp add: pObjDentarr_def Let_def)\n apply (subst ObjDentarr.surjective, simp add: ObjDentarr.make_def deserialises prod_eq_iff)\n done\n subgoal by (clarsimp simp add: prod_eq_iff pObjDentarrSize_def deserialises)\n subgoal by (simp add: Let_def deserialises)\n subgoal by simp\n done\n subgoal using olen by (simp) unat_arith\n done\nqed\n\nlemmas pObjUnion_def' = \n pObjUnion_def[unfolded otype_simps, simplified]\n\nlemmas len_otype_ok = is_len_and_type_ok_def[unfolded sanitizers tuple_simps]\n\nlemma olen_bound_trivial:\n \" 0x28 \\ (olen::U32) \\\n offs + olen - 0x18 \\ bound\\<^sub>f buf \\\n offs \\ offs + olen - 0x18 \\ offs + 0x10 \\ bound\\<^sub>f buf\"\n by unat_arith\n\nlemma offs_trivial:\n \"(offs::U32) \\ offs + olen - 0x18 \\\n 0x28 \\ olen \\\n offs < offs + 0x10\"\n by unat_arith\n\nlemma unat_obj_len_minus_hdrsz:\n assumes len_otype_rel: \"bilbyFsObjHeaderSize \\ olen\"\n assumes offs_no_of: \"offs \\ offs + olen - bilbyFsObjHeaderSize\"\nshows\n \"unat (offs + olen - bilbyFsObjHeaderSize) = unat offs + unat olen - unat bilbyFsObjHeaderSize\"\n using assms\n by (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc unat_plus_simple) (simp add: unat_arith_simps)\n \n\nlemma deserialise_ObjUnion_ret:\n assumes wf: \"wellformed_buf buf\"\n assumes no_buf_overflow: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"offs + olen - bilbyFsObjHeaderSize \\ bound\\<^sub>f buf\"\n assumes len_otype_rel: \"is_len_and_type_ok (otype, olen)\"\n assumes offs_no_of: \"offs \\ offs + olen - bilbyFsObjHeaderSize\"\n assumes offs_no_underflow: \"offs - bilbyFsObjHeaderSize \\ offs\"\n assumes err:\n \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex ounion offs'. ounion = pObjUnion (\\ \\take (unat (offs + olen))\\ (\\wa (data\\<^sub>f buf))) otype olen offs \\\n offs' \\ (offs + olen - bilbyFsObjHeaderSize) \\\n let end_offs = offs + olen - bilbyFsObjHeaderSize;\n data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n nb_dentry = ple32 (\\wa (data\\<^sub>f buf)) (offs+8) in\n dentarr_otype_end_offs_pred otype data offs end_offs \\\n dentarr_otype_drop_end_offs_st_pred otype data offs (offs - bilbyFsObjHeaderSize) end_offs \n \\\n P (Success (ex, ounion, offs'))\"\n notes suc_simps = len_otype_ok Let_def pObjUnion_def' suc add.commute bilbyFsObjHeaderSize_def\n otype_simps dentarr_end_offs_simps dentarr_drop_end_offs_simps\n shows \"P (deserialise_ObjUnion (ex, buf, offs, (otype, olen)))\"\n unfolding deserialise_ObjUnion_def[unfolded tuple_simps, simplified sanitizers]\n using is_len_and_type_ok_hdr_szD[OF len_otype_rel] \n apply (clarsimp simp: Let_def)\n apply (rule conjI)\n apply clarsimp\n apply (rule deserialise_ObjSuper_ret, simp)\n using len_otype_rel offs_no_of bound wf\n apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n apply unat_arith\n using len_otype_rel offs_no_of bound wf\n apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n apply unat_arith\n apply (simp add: err)\n\n using len_otype_rel\n apply (simp add: suc_simps)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (rule deserialise_ObjDel_ret, simp)\n using len_otype_rel offs_no_of bound wf\n apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n apply unat_arith\n apply (simp add: err)\n using len_otype_rel offs_no_of bound wf\n apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n apply unat_arith\n using len_otype_rel\n apply (simp add: suc_simps)\n\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (rule deserialise_ObjDentarr_ret[OF wf no_buf_overflow, where st_offs =\"offs - bilbyFsObjHeaderSize\"])\n apply (simp add: err)\n using bound offs_no_of len_otype_rel \n apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n using offs_no_of len_otype_rel \n apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def )\n apply (simp add: word_add_diff_assoc unat_plus_simple word_less_nat_alt )\n apply unat_arith\n using len_otype_rel\n apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def bilbyFsObjDentryHeaderSize_def bilbyFsObjDentarrHeaderSize_def)\n using offs_no_underflow apply simp\n apply (simp add: suc pObjUnion_def' )\n apply (rule suc)\n apply (clarsimp simp add: pObjUnion_def')+\n apply (simp add: dentarr_otype_drop_end_offs_st_pred_def dentarr_otype_end_offs_pred_def dentarr_otype_drop_end_offs_pred_def\n bilbyFsObjTypeDentarr_def Let_def)\n apply clarsimp\n apply (subgoal_tac \"ple32 (take (unat (offs + olen - bilbyFsObjHeaderSize)) (\\wa (data\\<^sub>f buf))) (offs + 8) = ple32 (\\wa (data\\<^sub>f buf)) (offs + 8)\")\n apply simp\n apply (subgoal_tac \"\\v. olen - bilbyFsObjHeaderSize = v\")\n apply (erule exE)\n apply (subst ple32_take)\n(* *)\n using len_otype_rel \n apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def)\n using offs_no_of apply (simp add: word_add_diff_assoc bilbyFsObjHeaderSize_def)\n apply (simp add: word_add_diff_assoc unat_plus_simple word_less_nat_alt word_le_nat_alt add.commute)\n apply (subst (asm) add.commute)\n using offs_no_of apply (simp add: bilbyFsObjHeaderSize_def) apply (simp add: word_add_diff_assoc word_le_nat_alt)\n apply (simp only: unat_arith_simps)\n apply unat_arith\n apply (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc)\n using offs_no_of \n apply (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc word_less_nat_alt add.commute)\n apply (subst (asm) add.commute, simp add: unat_plus_simple)\n using offs_no_of apply (simp add: bilbyFsObjHeaderSize_def)\n apply (simp add: word_add_diff_assoc)\n using len_otype_rel\n apply (simp add: len_otype_ok)\n apply (subgoal_tac \"offs \\ offs + 0xC\")\n apply (simp add: unat_plus_simple add.commute, simp only: word_le_nat_alt)\n apply unat_arith\n apply (simp add: unat_plus_simple add.commute, simp only: word_le_nat_alt)\n apply unat_arith\n(* *)\n apply simp\n apply (fastforce)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (rule deserialise_ObjData_ret[OF ])\n using offs_no_of \n apply (simp only: diff_conv_add_uminus)\n apply (simp only: add.assoc)\n using bound wf offs_no_of apply (simp add: bilbyFsObjHeaderSize_def\n wellformed_buf_def diff_conv_add_uminus add.assoc)\n apply unat_arith\n using len_otype_rel apply (simp add: otype_simps)\n apply (simp add: err)\n apply simp\n apply (simp add: suc_simps)\n\n apply (clarsimp)\n apply (rule conjI)\n apply clarsimp\n apply (rule deserialise_ObjInode_ret)\n using len_otype_rel offs_no_of bound\n bound wf offs_no_of\n apply (simp add: bilbyFsObjHeaderSize_def wellformed_buf_def )\n using len_otype_rel apply (simp add: otype_simps len_otype_ok)\n apply unat_arith\n using len_otype_rel apply (simp add: otype_simps len_otype_ok)\n using offs_no_of\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply unat_arith\n apply (simp add: err)\n using len_otype_rel apply (simp add: otype_simps len_otype_ok)\n apply (simp add: suc_simps)\n apply clarsimp\n apply (rule deserialise_ObjPad_ret)\n apply (simp add:err) \n apply (simp add: suc_simps add_diff_eq)+\n done\n\nlemma pObjDel_take:\n \"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n otype\\<^sub>f obj = 3 \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\n pObjDel (\\wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n pObjDel (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n apply (simp add: pObjDel_def)\n apply (frule is_valid_ObjHeader_buf_len, clarify)\n apply (subst ple64_take, (simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)\n apply simp\ndone\n\nlemma pObjSuper_take:\n \"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n otype\\<^sub>f obj = 4 \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\n pObjSuper (\\wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n pObjSuper (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n apply (simp add: pObjSuper_def)\n apply (frule is_valid_ObjHeader_buf_len, clarify)\n apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])\n apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply simp\n done\n\nlemma pObjInode_take:\n \"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n otype\\<^sub>f obj = 0 \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\n pObjInode (\\wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n pObjInode (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n apply (simp add: pObjInode_def)\n apply (frule is_valid_ObjHeader_buf_len, clarify)\n apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply simp\n done\n\nlemma pObjDentarr_take:\n \"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n otype\\<^sub>f obj = 2 \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\n pObjDentarr (\\wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj) =\n pObjDentarr (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj)\"\n apply (simp add: pObjDentarr_def)\n apply (frule is_valid_ObjHeader_buf_len, clarify)\n apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply (simp add: Let_def) \n done\n\n\nlemma pObjData_take:\n\"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n otype\\<^sub>f obj = 1 \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\npObjData (\\wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj) =\n pObjData (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\n (Obj.len\\<^sub>f obj)\"\n apply (simp add: pObjData_def)\n apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n apply (simp add: otype_simps len_otype_ok)\n apply (subst slice_take)\n apply (frule is_valid_ObjHeader_len)\n apply (subgoal_tac \" unat (Obj.len\\<^sub>f obj - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize) = unat (Obj.len\\<^sub>f obj) - unat bilbyFsObjHeaderSize - unat bilbyFsObjDataHeaderSize\")\n apply (subgoal_tac \"unat (offs + Obj.len\\<^sub>f obj) = unat offs + unat ( Obj.len\\<^sub>f obj)\")\n apply simp\n apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n apply unat_arith\n apply (simp add: word_less_nat_alt unat_plus_simple[symmetric], unat_arith)\n apply (subst unat_sub, simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def, unat_arith)+\n apply simp+\n done\n\nlemma pObjUnion_take:\n \"is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (bounded buf) \\\n offs + Obj.len\\<^sub>f obj \\ bound\\<^sub>f buf \\\n is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\\n offs < offs + Obj.len\\<^sub>f obj \\\n \\v. obj\\ounion\\<^sub>f := v\\ = pObjHeader (\\wa (data\\<^sub>f buf)) offs \\\n pObjUnion (\\wa (data\\<^sub>f buf)) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj) (offs + bilbyFsObjHeaderSize) = \n pObjUnion (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj) (offs + bilbyFsObjHeaderSize)\"\n apply (simp add: pObjUnion_def')\n apply (case_tac \"otype\\<^sub>f obj = 0\")\n apply (simp add: pObjInode_take)\n apply (case_tac \"otype\\<^sub>f obj = 1\")\n apply (simp add: pObjData_take)\n apply (case_tac \"otype\\<^sub>f obj = 2\")\n apply (simp add: pObjDentarr_take)\n apply (case_tac \"otype\\<^sub>f obj = 3\")\n apply (simp add: pObjDel_take)\n apply (case_tac \"otype\\<^sub>f obj = 4\")\n apply (simp add: pObjSuper_take)\n apply simp\n done\n\nlemmas Obj_ext_eq_expand = trans[OF _ Obj.ext_inject,\n OF arg_cong2[where f=\"(=)\"], OF refl Obj.surjective]\n\nlemma deserialise_Obj_ret:\n assumes wf: \"wellformed_buf buf\"\n assumes buf_len: \"length (\\wa $ data\\<^sub>f buf) \\ unat bilbyFsMaxEbSize\"\n assumes bound: \"offs + bilbyFsObjHeaderSize \\ bound\\<^sub>f buf\"\n assumes no_of: \"offs < offs + bilbyFsObjHeaderSize\"\n assumes err: \"\\ex e. e \\ {eInval, eNoMem} \\ P (Error (e, ex))\"\n assumes suc:\n \"\\ex obj offs'. \\ \n is_valid_ObjHeader (pObjHeader (\\wa (data\\<^sub>f buf)) offs) (\\wa (data\\<^sub>f buf)) ;\n\n let end_offs = offs + (Obj.len\\<^sub>f obj);\n data = take (unat end_offs) (\\wa (data\\<^sub>f buf));\n nb_dentry = ple32 (\\wa (data\\<^sub>f buf)) (offs+8) in\n dentarr_otype_end_offs_pred (Obj.otype\\<^sub>f obj) data (offs + bilbyFsObjHeaderSize) end_offs \\\n dentarr_otype_drop_end_offs_st_pred (Obj.otype\\<^sub>f obj) data (offs + bilbyFsObjHeaderSize) offs end_offs;\n obj = pObj (\\wa (data\\<^sub>f buf)) offs;\n offs' \\ offs + Obj.len\\<^sub>f obj \\ \\ \n\n P (Success (ex, obj, offs'))\"\n notes bilbyFsObjHeaderSize_def[simp]\n shows \"P (deserialise_Obj (ex, buf, offs))\"\n unfolding deserialise_Obj_def[unfolded tuple_simps sanitizers]\n apply (clarsimp simp: err eNoMem_def split: Result.split)\n apply (rule deserialise_ObjHeader_ret[OF wf bound no_of])\n apply (simp add: err)\n apply simp\n apply (rule deserialise_ObjUnion_ret[OF wf buf_len])\n apply (simp)\n apply (clarsimp, drule sym[where t=\"pObjHeader (\\wa (data\\<^sub>f buf)) offs\"])\n apply (clarsimp simp add: is_valid_ObjHeader_def)\n apply simp\n apply (drule is_valid_ObjHeader_len)\n apply (clarsimp, drule sym[where t=\"pObjHeader (\\wa (data\\<^sub>f buf)) offs\"])\n apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n using no_of bound\n apply simp\n apply (simp only: word_le_nat_alt plus_no_overflow_unat_lift)\n apply (drule is_valid_ObjHeader_len)\n apply (clarsimp, drule sym[where t=\"pObjHeader (\\wa (data\\<^sub>f buf)) offs\"])\n apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n apply (clarsimp simp add: )\n apply unat_arith\n apply (simp add: err)\n\n apply simp\n apply (rule suc)\n apply (clarsimp simp add: is_valid_ObjHeader_def bounded_def)\n apply simp\n apply (clarsimp simp add: pObj_def Let_def)\n apply (drule sym[where t=\"pObjHeader (\\wa (data\\<^sub>f buf)) offs\"])\n apply (subst pObjUnion_take[simplified], (fastforce simp add: is_valid_ObjHeader_def)+)\n apply (rename_tac obj offs' v)\n apply (subgoal_tac \"pObjUnion (take (unat (offs + Obj.len\\<^sub>f obj)) (\\wa (data\\<^sub>f buf))) (otype\\<^sub>f obj)\n (Obj.len\\<^sub>f obj) (offs + 0x18) = pObjUnion\n (take (unat offs + unat (Obj.len\\<^sub>f (pObjHeader (\\wa (data\\<^sub>f buf)) offs))) (\\wa (data\\<^sub>f buf)))\n (otype\\<^sub>f (pObjHeader (\\wa (data\\<^sub>f buf)) offs))\n (Obj.len\\<^sub>f (pObjHeader (\\wa (data\\<^sub>f buf)) offs)) (offs + 0x18)\")\n apply simp\n apply (case_tac \"pObjHeader (\\wa (data\\<^sub>f buf)) offs\", case_tac obj, simp)\n apply (case_tac \"pObjHeader (\\wa (data\\<^sub>f buf)) offs\", case_tac obj, simp)\n apply (simp add: plus_no_overflow_unat_lift)+\n done\n\nlemma pObjHeader_take:\n \"is_valid_ObjHeader (pObjHeader xs (ObjAddr.offs\\<^sub>f oaddr)) xs \\\nis_obj_addr_consistent (pObj (take (unat (ObjAddr.offs\\<^sub>f oaddr) + unat (ObjAddr.len\\<^sub>f oaddr)) xs)\n (ObjAddr.offs\\<^sub>f oaddr)) oaddr \\\n ObjAddr.offs\\<^sub>f oaddr < ObjAddr.offs\\<^sub>f oaddr + bilbyFsObjHeaderSize \\\n bilbyFsObjHeaderSize \\ ObjAddr.len\\<^sub>f oaddr \\\n pObjHeader xs (ObjAddr.offs\\<^sub>f oaddr) = pObjHeader (take (unat (ObjAddr.offs\\<^sub>f oaddr) + unat (ObjAddr.len\\<^sub>f oaddr)) xs) (ObjAddr.offs\\<^sub>f oaddr)\"\n\n apply (simp add: pObjHeader_def)\n apply (subst ple32_take, ((simp add: bilbyFsObjHeaderSize_def, unat_arith, fastforce? )[2])+)+\n apply (subst ple64_take, ((simp add: bilbyFsObjHeaderSize_def, unat_arith, fastforce? )[2])+)+\n apply (subst nth_take, (simp add: bilbyFsObjHeaderSize_def, unat_arith))+\n apply (rule refl)\ndone\n\nend\n\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/spec/SerialS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2976840443461467}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Memset\nimports \"../../AutoCorres\"\nbegin\n\ninstall_C_file \"memset.c\"\n\nautocorres [\n heap_abs_syntax,\n no_heap_abs=memset,\n no_signed_word_abs=memset,\n unsigned_word_abs=memset] \"memset.c\"\n\nlemma c_guard_word8_ptr [simp]:\n \"c_guard (x :: word8 ptr) = (x \\ NULL)\"\n apply (clarsimp simp: c_guard_def ptr_aligned_def c_null_guard_def)\n apply (metis Ptr_ptr_val first_in_intvl intvl_Suc not_less_eq ptr_val.ptr_val_def)\n done\n\nlemma to_bytes_word8 [simp]: \"to_bytes (a :: word8) x = [a]\"\n by (clarsimp simp: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma heap_update_list_id [simp]:\n \"heap_update_list x [] = (\\x. x)\"\n apply (rule ext)\n apply simp\n done\n\nlemma heap_update_heap_update_list:\n \"\\ ptr_val p = q + (of_nat (length l)); Suc (length l) < addr_card \\ \\\n heap_update (p :: word8 ptr) v (heap_update_list q l s) = (heap_update_list q (l @ [v]) s)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def unat_of_nat\n addr_card word_bits_def fun_upd_def)\n apply (subst heap_update_list_value, clarsimp simp: addr_card)\n apply safe\n apply (subst if_P)\n apply (fastforce intro: intvlI)\n apply (clarsimp simp: unat_of_nat word_bits_def)\n apply (subst (1 2) heap_update_list_value,\n simp add: addr_card,\n simp add: addr_card)\n apply (case_tac \"x \\ {q..+length l}\")\n apply (subst if_P, simp)\n apply (subst if_P)\n apply clarsimp\n apply (metis (full_types) intvlD intvlI less_SucI)\n apply (subst nth_append, clarsimp)\n apply (metis (hide_lams, no_types) add_diff_cancel2 intvlD le_unat_uoi less_or_eq_imp_le not_le)\n apply clarsimp\n apply (metis intvlD intvlI less_antisym)\n done\n\nlemma (in memset) memset:\n \"\\s\\<^sub>0. \\ \\s. s = s\\<^sub>0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update (\n heap_update_list (ptr_val p) (replicate n (scast c)))) s\\<^sub>0 \\!\"\nproof -\n {\n fix s0\n have \"\\ \\s. s = s0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update\n (heap_update_list (ptr_val p) (replicate n (scast c)))) s0 \\!\"\n apply (rule validNF_assume_pre)\n apply (unfold memset'_def)\n apply (subst whileLoop_add_inv [where M=\"\\((d', n'), _). n'\"\n and I=\"\\(d', n') s.\n n' \\ n \\\n (n' \\ n \\ d' = ptr_coerce p +\\<^sub>p int (n - n')) \\\n (n' \\ n \\ s = t_hrs_'_update\n (hrs_mem_update (heap_update_list (ptr_val p) (replicate (n - n') (scast c)))) s0)\"])\n apply wp\n apply (clarsimp simp:)\n apply (intro conjI impI)\n apply arith\n apply (clarsimp simp: ptr_add_def)\n apply (rule globals.fold_congs, simp, simp)\n apply (clarsimp simp: hrs_mem_update_def)\n apply (subst heap_update_heap_update_list)\n apply (clarsimp simp: ptr_add_def)\n apply (clarsimp)\n apply arith\n apply (metis diff_Suc_diff_eq2 diff_diff_left minus_nat.diff_0 replicate_Suc_append)\n apply (clarsimp simp: ptr_add_def)\n apply (metis (hide_lams, no_types) add_less_cancel_right add.left_neutral intvl_inter_le le0 le_add_diff_inverse of_nat_diff semiring_1_class.of_nat_0)\n apply clarsimp\n apply (clarsimp simp: hrs_mem_update_def)\n done\n }\n\n thus ?thesis\n by simp\nqed\n\nlemma word_rsplit_sword_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize signed word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma word_rsplit_word_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma heap_update_zero_node [simplified]:\n \"heap_update_list p (replicate (size_of TYPE(node_C)) 0) = heap_update (Ptr p) (node_C NULL 0)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def to_bytes_def)\n apply (subst packed_type_access_ti, simp)\n apply (clarsimp simp: access_ti\\<^sub>0_def)\n apply (clarsimp simp: to_bytes_def to_bytes_p_def node_C_tag_def node_C_typ_tag)\n apply (subst final_pad_def)\n apply (clarsimp simp: typ_info_word size_td_lt_ti_typ_pad_combine Let_def padup_def)\n apply (clarsimp simp: ti_typ_pad_combine_def)\n apply (clarsimp simp: ti_typ_combine_def empty_typ_info_def typ_info_ptr typ_info_word)\n done\n\nlemma (in memset) is_valid_node_C_non_NULL [simp]:\n \"is_valid_node_C (lift_global_heap s) p \\ 0 \\ {ptr_val p ..+ size_of TYPE(node_C)}\"\n by (auto simp: lift_global_heap_def c_guard_def c_null_guard_def dest: simple_lift_c_guard)\n\nlemma (in memset) zero_node:\n \"\\s\\<^sub>0. \\ \\s. is_valid_node_C s p \\ s = s\\<^sub>0\\ zero_node' p \\ \\rv s. s = s\\<^sub>0[p := (node_C NULL 0) ] \\! \"\n apply (clarsimp simp: zero_node'_def)\n apply (wp add: memset [THEN validNF_make_schematic_post, simplified])\n apply (fastforce dest: simple_lift_c_guard is_valid_node_C_non_NULL\n simp: addr_card lift_global_heap_def heap_update_zero_node\n memset.update_node_def typ_simple_heap_simps fun_upd_def)\n done\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/autocorres/tests/examples/Memset.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2976840443461467}} {"text": "header {* \\isaheader{Static backward slice} *}\n\ntheory Slice imports SCDObservable Distance begin\n\ncontext SDG begin\n\nsubsection {* Preliminary definitions on the parameter nodes for defining\n sliced call and return edges *}\n\nfun csppa :: \"'node \\ 'node SDG_node set \\ nat \\ \n ((('var \\ 'val) \\ 'val option) list) \\ ((('var \\ 'val) \\ 'val option) list)\"\n where \"csppa m S x [] = []\"\n | \"csppa m S x (f#fs) = \n (if Formal_in(m,x) \\ S then empty else f)#csppa m S (Suc x) fs\"\n\ndefinition cspp :: \"'node \\ 'node SDG_node set \\ \n ((('var \\ 'val) \\ 'val option) list) \\ ((('var \\ 'val) \\ 'val option) list)\"\n where \"cspp m S fs \\ csppa m S 0 fs\"\n\n\n\nlemma [simp]: \"length (cspp m S fs) = length fs\"\nby(simp add:cspp_def)\n\nlemma csppa_Formal_in_notin_slice: \n \"\\x < length fs; Formal_in(m,x + i) \\ S\\\n \\ (csppa m S i fs)!x = empty\"\nby(induct fs arbitrary:i x,auto simp:nth_Cons')\n\nlemma csppa_Formal_in_in_slice: \n \"\\x < length fs; Formal_in(m,x + i) \\ S\\\n \\ (csppa m S i fs)!x = fs!x\"\nby(induct fs arbitrary:i x,auto simp:nth_Cons')\n\n\ndefinition map_merge :: \"('var \\ 'val) \\ ('var \\ 'val) \\ (nat \\ bool) \\ \n 'var list \\ ('var \\ 'val)\"\nwhere \"map_merge f g Q xs \\ (\\V. if (\\i. i < length xs \\ xs!i = V \\ Q i) then g V \n else f V)\"\n\n\ndefinition rspp :: \"'node \\ 'node SDG_node set \\ 'var list \\ \n ('var \\ 'val) \\ ('var \\ 'val) \\ ('var \\ 'val)\"\nwhere \"rspp m S xs f g \\ map_merge f (empty(ParamDefs m [:=] map g xs))\n (\\i. Actual_out(m,i) \\ S) (ParamDefs m)\"\n\n\nlemma rspp_Actual_out_in_slice:\n assumes \"x < length (ParamDefs (targetnode a))\" and \"valid_edge a\"\n and \"length (ParamDefs (targetnode a)) = length xs\" \n and \"Actual_out (targetnode a,x) \\ S\"\n shows \"(rspp (targetnode a) S xs f g) ((ParamDefs (targetnode a))!x) = g(xs!x)\"\nproof -\n from `valid_edge a` have \"distinct(ParamDefs (targetnode a))\"\n by(rule distinct_ParamDefs)\n from `x < length (ParamDefs (targetnode a))` \n `length (ParamDefs (targetnode a)) = length xs`\n `distinct(ParamDefs (targetnode a))`\n have \"(empty(ParamDefs (targetnode a) [:=] map g xs))\n ((ParamDefs (targetnode a))!x) = (map g xs)!x\"\n by(fastforce intro:fun_upds_nth)\n with `Actual_out(targetnode a,x) \\ S` `x < length (ParamDefs (targetnode a))`\n `length (ParamDefs (targetnode a)) = length xs` show ?thesis\n by(fastforce simp:rspp_def map_merge_def)\nqed\n\nlemma rspp_Actual_out_notin_slice:\n assumes \"x < length (ParamDefs (targetnode a))\" and \"valid_edge a\"\n and \"length (ParamDefs (targetnode a)) = length xs\" \n and \"Actual_out((targetnode a),x) \\ S\"\n shows \"(rspp (targetnode a) S xs f g) ((ParamDefs (targetnode a))!x) = \n f((ParamDefs (targetnode a))!x)\"\nproof -\n from `valid_edge a` have \"distinct(ParamDefs (targetnode a))\"\n by(rule distinct_ParamDefs)\n from `x < length (ParamDefs (targetnode a))` \n `length (ParamDefs (targetnode a)) = length xs`\n `distinct(ParamDefs (targetnode a))`\n have \"(empty(ParamDefs (targetnode a) [:=] map g xs))\n ((ParamDefs (targetnode a))!x) = (map g xs)!x\"\n by(fastforce intro:fun_upds_nth)\n with `Actual_out((targetnode a),x) \\ S` `distinct(ParamDefs (targetnode a))` \n `x < length (ParamDefs (targetnode a))`\n show ?thesis by(fastforce simp:rspp_def map_merge_def nth_eq_iff_index_eq)\nqed\n\n\nsubsection {* Defining the sliced edge kinds *}\n\nprimrec slice_kind_aux :: \"'node \\ 'node \\ 'node SDG_node set \\ \n ('var,'val,'ret,'pname) edge_kind \\ ('var,'val,'ret,'pname) edge_kind\"\nwhere \"slice_kind_aux m m' S \\f = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then \\f else \\id)\"\n | \"slice_kind_aux m m' S (Q)\\<^sub>\\ = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then (Q)\\<^sub>\\ else\n (if obs_intra m \\S\\\\<^bsub>CFG\\<^esub> = {} then \n (let mex = (THE mex. method_exit mex \\ get_proc m = get_proc mex) in\n (if (\\x. distance m' mex x \\ distance m mex (x + 1) \\\n (m' = (SOME mx'. \\a'. m = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) \n then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\))\n else (let mx = THE mx. mx \\ obs_intra m \\S\\\\<^bsub>CFG\\<^esub> in \n (if (\\x. distance m' mx x \\ distance m mx (x + 1) \\\n (m' = (SOME mx'. \\a'. m = sourcenode a' \\ \n distance (targetnode a') mx x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) \n then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\))))\"\n | \"slice_kind_aux m m' S (Q:r\\\\<^bsub>p\\<^esub>fs) = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then (Q:r\\\\<^bsub>p\\<^esub>(cspp m' S fs))\n else ((\\cf. False):r\\\\<^bsub>p\\<^esub>fs))\"\n | \"slice_kind_aux m m' S (Q\\\\<^bsub>p\\<^esub>f) = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then \n (let outs = THE outs. \\ins. (p,ins,outs) \\ set procs in\n (Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp m' S outs cf' cf)))\n else ((\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')))\"\n\ndefinition slice_kind :: \"'node SDG_node set \\ 'edge \\ \n ('var,'val,'ret,'pname) edge_kind\"\n where \"slice_kind S a \\ \n slice_kind_aux (sourcenode a) (targetnode a) (HRB_slice S) (kind a)\"\n\ndefinition slice_kinds :: \"'node SDG_node set \\ 'edge list \\ \n ('var,'val,'ret,'pname) edge_kind list\"\n where \"slice_kinds S as \\ map (slice_kind S) as\"\n\n\n\nlemma slice_intra_kind_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; intra_kind (kind a)\\ \n \\ slice_kind S a = kind a\"\nby(fastforce simp:intra_kind_def slice_kind_def)\n\n\nlemma slice_kind_Upd:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = \\f\\ \\ slice_kind S a = \\id\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Pred_empty_obs_nearer_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and \"distance (targetnode a) mex x\" and \"distance (sourcenode a) mex (x + 1)\"\n and \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\` \n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}`\n have \"slice_kind S a = \n (if (\\x. distance (targetnode a) mex x \\ distance (sourcenode a) mex (x + 1) \\\n (targetnode a = (SOME mx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\ valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\)\"\n by(simp add:slice_kind_def Let_def)\n with `distance (targetnode a) mex x` `distance (sourcenode a) mex (x + 1)`\n `targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')`\n show ?thesis by fastforce\nqed\n\n\nlemma slice_kind_Pred_empty_obs_nearer_not_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and \"distance (targetnode a) mex x\" and \"distance (sourcenode a) mex (x + 1)\"\n and \"targetnode a \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\` \n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}`\n have \"slice_kind S a = \n (if (\\x. distance (targetnode a) mex x \\ distance (sourcenode a) mex (x + 1) \\\n (targetnode a = (SOME mx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\ valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\)\"\n by(simp add:slice_kind_def Let_def)\n with `distance (targetnode a) mex x` `distance (sourcenode a) mex (x + 1)`\n `targetnode a \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')`\n show ?thesis by(auto dest:distance_det)\nqed\n\n\nlemma slice_kind_Pred_empty_obs_not_nearer:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and dist:\"distance (sourcenode a) mex (x + 1)\" \"\\ distance (targetnode a) mex x\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n moreover\n from dist have \"\\ (\\x. distance (targetnode a) mex x \\ \n distance (sourcenode a) mex (x + 1))\"\n by(fastforce dest:distance_det)\n ultimately show ?thesis using assms by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_nearer_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n and \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n have \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n with assms show ?thesis by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_nearer_not_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n and \"targetnode a \\ (SOME nx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = nx')\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n have \"m = (THE m. m \\ obs_intra (sourcenode a) (\\HRB_slice S\\\\<^bsub>CFG\\<^esub>))\"\n by(rule obs_intra_the_element[THEN sym])\n with assms show ?thesis by(auto dest:distance_det simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_not_nearer:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and in_obs:\"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and dist:\"distance (sourcenode a) m (x + 1)\" \n \"\\ distance (targetnode a) m x\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from in_obs have the:\"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n from dist have \"\\ (\\x. distance (targetnode a) m x \\ \n distance (sourcenode a) m (x + 1))\"\n by(fastforce dest:distance_det)\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\` in_obs the show ?thesis\n by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma kind_Predicate_notin_slice_slice_kind_Predicate:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"valid_edge a\" and \"kind a = (Q)\\<^sub>\\\"\n obtains Q' where \"slice_kind S a = (Q')\\<^sub>\\\" and \"Q' = (\\s. False) \\ Q' = (\\s. True)\"\nproof(atomize_elim)\n show \"\\Q'. slice_kind S a = (Q')\\<^sub>\\ \\ (Q' = (\\s. False) \\ Q' = (\\s. True))\"\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n from `valid_edge a` have \"valid_node (sourcenode a)\" by simp\n then obtain as where \"sourcenode a -as\\\\<^sub>\\* (_Exit_)\" by(fastforce dest:Exit_path)\n then obtain as' mex where \"sourcenode a -as'\\\\<^sub>\\* mex\" and \"method_exit mex\" \n by -(erule valid_Exit_path_intra_path)\n from `sourcenode a -as'\\\\<^sub>\\* mex` have \"get_proc (sourcenode a) = get_proc mex\"\n by(rule intra_path_get_procs)\n show ?thesis\n proof(cases \"\\x. distance (targetnode a) mex x \\ \n distance (sourcenode a) mex (x + 1)\")\n case True\n then obtain x where \"distance (targetnode a) mex x\" \n and \"distance (sourcenode a) mex (x + 1)\" by blast\n show ?thesis\n proof(cases \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\")\n case True\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\`\n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}`\n `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n `distance (targetnode a) mex x` `distance (sourcenode a) mex (x + 1)`\n have \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n by(rule slice_kind_Pred_empty_obs_nearer_SOME)\n thus ?thesis by simp\n next\n case False\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\`\n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}`\n `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n `distance (targetnode a) mex x` `distance (sourcenode a) mex (x + 1)`\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_Pred_empty_obs_nearer_not_SOME)\n thus ?thesis by simp\n qed\n next\n case False\n from `method_exit mex` `get_proc (sourcenode a) = get_proc mex`\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\`\n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}` False\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(auto simp:slice_kind_def Let_def)\n thus ?thesis by simp\n qed\n next\n case False\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by blast\n show ?thesis\n proof(cases \"\\x. distance (targetnode a) m x \\ \n distance (sourcenode a) m (x + 1)\")\n case True\n then obtain x where \"distance (targetnode a) m x\" \n and \"distance (sourcenode a) m (x + 1)\" by blast\n show ?thesis\n proof(cases \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\")\n case True\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\`\n `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n `distance (targetnode a) m x` `distance (sourcenode a) m (x + 1)`\n have \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n by(rule slice_kind_Pred_obs_nearer_SOME)\n thus ?thesis by simp\n next\n case False\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\`\n `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n `distance (targetnode a) m x` `distance (sourcenode a) m (x + 1)`\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_Pred_obs_nearer_not_SOME)\n thus ?thesis by simp\n qed\n next\n case False\n from `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n have \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = (Q)\\<^sub>\\` False\n `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(auto simp:slice_kind_def Let_def)\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma slice_kind_Call:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \n \\ slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Call_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \n \\ slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Call_in_slice_Formal_in_not:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\" \n shows \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>replicate (length fs) empty\"\nproof -\n from `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs`\n have \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(simp add:slice_kind_def)\n from `\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S`\n have \"cspp (targetnode a) (HRB_slice S) fs = replicate (length fs) empty\"\n by(fastforce intro:nth_equalityI csppa_Formal_in_notin_slice simp:cspp_def)\n with `slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)`\n show ?thesis by simp\nqed\n\n\nlemma slice_kind_Call_in_slice_Formal_in_also:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\" \n shows \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>fs\"\nproof -\n from `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs`\n have \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(simp add:slice_kind_def)\n from `\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S`\n have \"cspp (targetnode a) (HRB_slice S) fs = fs\"\n by(fastforce intro:nth_equalityI csppa_Formal_in_in_slice simp:cspp_def)\n with `slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)`\n show ?thesis by simp\nqed\n\n\nlemma slice_kind_Call_intra_notin_slice:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"valid_edge a\" \n and \"intra_kind (kind a)\" and \"valid_edge a'\" and \"kind a' = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"sourcenode a' = sourcenode a\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from `valid_edge a'` `kind a' = Q:r\\\\<^bsub>p\\<^esub>fs` obtain a'' \n where \"a'' \\ get_return_edges a'\"\n by(fastforce dest:get_return_edge_call)\n with `valid_edge a'` obtain ax where \"valid_edge ax\" \n and \"sourcenode ax = sourcenode a'\" and \" targetnode ax = targetnode a''\"\n and \"kind ax = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n from `valid_edge a'` `kind a' = Q:r\\\\<^bsub>p\\<^esub>fs`\n have \"\\!a''. valid_edge a'' \\ sourcenode a'' = sourcenode a' \\ \n intra_kind(kind a'')\"\n by(rule call_only_one_intra_edge)\n with `valid_edge a` `sourcenode a' = sourcenode a` `intra_kind (kind a)`\n have all:\"\\a''. valid_edge a'' \\ sourcenode a'' = sourcenode a' \\ \n intra_kind(kind a'') \\ a'' = a\" by fastforce\n with `valid_edge ax` `sourcenode ax = sourcenode a'` `kind ax = (\\cf. False)\\<^sub>\\`\n have [simp]:\"ax = a\" by(fastforce simp:intra_kind_def)\n show ?thesis\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n from `valid_edge a` have \"valid_node (sourcenode a)\" by simp\n then obtain asx where \"sourcenode a -asx\\\\<^sub>\\* (_Exit_)\" by(fastforce dest:Exit_path)\n then obtain as pex where \"sourcenode a-as\\\\<^sub>\\* pex\" and \"method_exit pex\"\n by -(erule valid_Exit_path_intra_path)\n from `sourcenode a-as\\\\<^sub>\\* pex` have \"get_proc (sourcenode a) = get_proc pex\"\n by(rule intra_path_get_procs)\n from `sourcenode a-as\\\\<^sub>\\* pex` obtain x where \"distance (sourcenode a) pex x\"\n and \"x \\ length as\" by(erule every_path_distance)\n from `method_exit pex` have \"sourcenode a \\ pex\"\n proof(rule method_exit_cases)\n assume \"pex = (_Exit_)\"\n show ?thesis\n proof\n assume \"sourcenode a = pex\"\n with `pex = (_Exit_)` have \"sourcenode a = (_Exit_)\" by simp\n with `valid_edge a` show False by(rule Exit_source)\n qed\n next\n fix ax Qx px fx \n assume \"pex = sourcenode ax\" and \"valid_edge ax\" and \"kind ax = Qx\\\\<^bsub>px\\<^esub>fx\"\n hence \"\\a'. valid_edge a' \\ sourcenode a' = sourcenode ax \\ \n (\\Qx' fx'. kind a' = Qx'\\\\<^bsub>px\\<^esub>fx')\" by -(rule return_edges_only)\n with `valid_edge a` `intra_kind (kind a)` `pex = sourcenode ax`\n show ?thesis by(fastforce simp:intra_kind_def)\n qed\n have \"x \\ 0\"\n proof\n assume \"x = 0\"\n with `distance (sourcenode a) pex x` have \"sourcenode a = pex\"\n by(fastforce elim:distance.cases simp:intra_path_def)\n with `sourcenode a \\ pex` show False by simp\n qed\n with `distance (sourcenode a) pex x` obtain ax' where \"valid_edge ax'\"\n and \"sourcenode a = sourcenode ax'\" and \"intra_kind(kind ax')\"\n and \"distance (targetnode ax') pex (x - 1)\"\n and Some:\"targetnode ax' = (SOME nx. \\a'. sourcenode ax' = sourcenode a' \\ \n distance (targetnode a') pex (x - 1) \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = nx)\"\n by(erule distance_successor_distance)\n from `valid_edge ax'` `sourcenode a = sourcenode ax'` `intra_kind(kind ax')`\n `sourcenode a' = sourcenode a` all\n have [simp]:\"ax' = a\" by fastforce\n from `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind ax = (\\cf. False)\\<^sub>\\`\n True `method_exit pex` `get_proc (sourcenode a) = get_proc pex` `x \\ 0`\n `distance (targetnode ax') pex (x - 1)` `distance (sourcenode a) pex x` Some\n show ?thesis by(fastforce elim:slice_kind_Pred_empty_obs_nearer_SOME)\n next\n case False\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by fastforce\n then obtain as where \"sourcenode a-as\\\\<^sub>\\* m\" and \"m \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n by -(erule obs_intraE)\n from `sourcenode a-as\\\\<^sub>\\* m` obtain x where \"distance (sourcenode a) m x\"\n and \"x \\ length as\" by(erule every_path_distance)\n from `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `m \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n have \"sourcenode a \\ m\" by fastforce\n have \"x \\ 0\"\n proof\n assume \"x = 0\"\n with `distance (sourcenode a) m x` have \"sourcenode a = m\"\n by(fastforce elim:distance.cases simp:intra_path_def)\n with `sourcenode a \\ m` show False by simp\n qed\n with `distance (sourcenode a) m x` obtain ax' where \"valid_edge ax'\"\n and \"sourcenode a = sourcenode ax'\" and \"intra_kind(kind ax')\"\n and \"distance (targetnode ax') m (x - 1)\"\n and Some:\"targetnode ax' = (SOME nx. \\a'. sourcenode ax' = sourcenode a' \\ \n distance (targetnode a') m (x - 1) \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = nx)\"\n by(erule distance_successor_distance)\n from `valid_edge ax'` `sourcenode a = sourcenode ax'` `intra_kind(kind ax')`\n `sourcenode a' = sourcenode a` all\n have [simp]:\"ax' = a\" by fastforce\n from `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind ax = (\\cf. False)\\<^sub>\\`\n `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `x \\ 0`\n `distance (targetnode ax') m (x - 1)` `distance (sourcenode a) m x` Some\n show ?thesis by(fastforce elim:slice_kind_Pred_obs_nearer_SOME)\n qed\nqed\n\n\nlemma slice_kind_Return:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q\\\\<^bsub>p\\<^esub>f\\\n \\ slice_kind S a = (\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Return_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; valid_edge a; kind a = Q\\\\<^bsub>p\\<^esub>f; \n (p,ins,outs) \\ set procs\\\n \\ slice_kind S a = Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp (targetnode a) (HRB_slice S) outs cf' cf)\"\nby(simp add:slice_kind_def,unfold formal_out_THE,simp)\n\n\nlemma length_transfer_kind_slice_kind:\n assumes \"valid_edge a\" and \"length s\\<^sub>1 = length s\\<^sub>2\"\n and \"transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\" and \"transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\"\n shows \"length s\\<^sub>1' = length s\\<^sub>2'\"\nproof(cases \"kind a\" rule:edge_kind_cases)\n case Intra\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with Intra assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_intra_kind_in_slice simp:intra_kind_def)+\n next\n case False\n with Intra assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Upd \n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)+\n qed\nnext\n case (Call Q r p fs)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with Call assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Call_in_slice)+\n next\n case False\n with Call assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Call)+\n qed\nnext\n case (Return Q p f)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n from Return `valid_edge a` obtain a' Q' r fs \n where \"valid_edge a'\" and \"kind a' = Q':r\\\\<^bsub>p\\<^esub>fs\"\n by -(drule return_needs_call,auto)\n then obtain ins outs where \"(p,ins,outs) \\ set procs\"\n by(fastforce dest!:callee_in_procs)\n with True `valid_edge a` Return assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Return_in_slice split:list.split)+\n next \n case False\n with Return assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Return split:list.split)+\n qed\nqed\n\n\nsubsection {* The sliced graph of a deterministic CFG is still deterministic *} \n\nlemma only_one_SOME_edge:\n assumes \"valid_edge a\" and \"intra_kind(kind a)\" and \"distance (targetnode a) mex x\"\n shows \"\\!a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\nproof(rule ex_ex1I)\n show \"\\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n proof -\n have \"(\\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')) =\n (\\n'. \\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\ targetnode a' = n')\"\n apply(unfold some_eq_ex[of \"\\n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n'\"])\n by simp\n also have \"\\\" \n using `valid_edge a` `intra_kind(kind a)` `distance (targetnode a) mex x` \n by blast\n finally show ?thesis .\n qed\nnext\n fix a' ax\n assume \"sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n and \"sourcenode a = sourcenode ax \\ distance (targetnode ax) mex x \\\n valid_edge ax \\ intra_kind(kind ax) \\\n targetnode ax = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n thus \"a' = ax\" by(fastforce intro!:edge_det)\nqed\n\n\nlemma slice_kind_only_one_True_edge:\n assumes \"sourcenode a = sourcenode a'\" and \"targetnode a \\ targetnode a'\" \n and \"valid_edge a\" and \"valid_edge a'\" and \"intra_kind (kind a)\" \n and \"intra_kind (kind a')\" and \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n shows \"slice_kind S a' = (\\s. False)\\<^sub>\\\"\nproof -\n from assms obtain Q Q' where \"kind a = (Q)\\<^sub>\\\"\n and \"kind a' = (Q')\\<^sub>\\\" and det:\"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\n by(auto dest:deterministic)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with `slice_kind S a = (\\s. True)\\<^sub>\\` `kind a = (Q)\\<^sub>\\` have \"Q = (\\s. True)\"\n by(simp add:slice_kind_def Let_def)\n with det have \"Q' = (\\s. False)\" by(simp add:fun_eq_iff)\n with True `kind a' = (Q')\\<^sub>\\` `sourcenode a = sourcenode a'` show ?thesis\n by(simp add:slice_kind_def Let_def)\n next\n case False\n hence \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by simp\n thus ?thesis\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `slice_kind S a = (\\s. True)\\<^sub>\\`\n `kind a = (Q)\\<^sub>\\`\n obtain mex x where mex:\"mex = (THE mex. method_exit mex \\ \n get_proc (sourcenode a) = get_proc mex)\"\n and dist:\"distance (targetnode a) mex x\" \"distance (sourcenode a) mex (x + 1)\"\n and target:\"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(auto simp:slice_kind_def Let_def fun_eq_iff split:split_if_asm)\n from `valid_edge a` `intra_kind (kind a)` `distance (targetnode a) mex x`\n have ex1:\"\\!a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\ \n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(rule only_one_SOME_edge)\n have \"targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n proof(rule ccontr)\n assume \"\\ targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n hence \"targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by simp\n with ex1 target `sourcenode a = sourcenode a'` `valid_edge a` `valid_edge a'`\n `intra_kind(kind a)` `intra_kind(kind a')` `distance (targetnode a) mex x`\n have \"a = a'\" by fastforce\n with `targetnode a \\ targetnode a'` show False by simp\n qed\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` True `kind a' = (Q')\\<^sub>\\`\n `sourcenode a = sourcenode a'` mex dist\n show ?thesis by(auto dest:distance_det \n simp:slice_kind_def Let_def fun_eq_iff split:split_if_asm)\n next\n case False\n hence \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> \\ {}\" .\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by auto\n hence \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(auto dest:obs_intra_the_element)\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` \n `obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> \\ {}` \n `slice_kind S a = (\\s. True)\\<^sub>\\` `kind a = (Q)\\<^sub>\\`\n obtain x x' where \"distance (targetnode a) m x\" \n \"distance (sourcenode a) m (x + 1)\"\n and target:\"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(auto simp:slice_kind_def Let_def fun_eq_iff split:split_if_asm)\n show ?thesis\n proof(cases \"distance (targetnode a') m x\")\n case False\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` `kind a' = (Q')\\<^sub>\\`\n `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n `distance (targetnode a) m x` `distance (sourcenode a) m (x + 1)`\n `sourcenode a = sourcenode a'` show ?thesis\n by(fastforce intro:slice_kind_Pred_obs_not_nearer)\n next\n case True\n from `valid_edge a` `intra_kind(kind a)` `distance (targetnode a) m x`\n `distance (sourcenode a) m (x + 1)`\n have ex1:\"\\!a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\ valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = (SOME nx. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = nx)\"\n by -(rule only_one_SOME_dist_edge)\n have \"targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = n')\"\n proof(rule ccontr)\n assume \"\\ targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n hence \"targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by simp\n with ex1 target `sourcenode a = sourcenode a'` \n `valid_edge a` `valid_edge a'` `intra_kind(kind a)` `intra_kind(kind a')`\n `distance (targetnode a) m x` `distance (sourcenode a) m (x + 1)`\n have \"a = a'\" by auto\n with `targetnode a \\ targetnode a'` show False by simp\n qed\n with `sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>` \n `kind a' = (Q')\\<^sub>\\` `m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>`\n `distance (targetnode a) m x` `distance (sourcenode a) m (x + 1)`\n True `sourcenode a = sourcenode a'` show ?thesis\n by(fastforce intro:slice_kind_Pred_obs_nearer_not_SOME)\n qed\n qed\n qed\nqed\n\n\nlemma slice_deterministic:\n assumes \"valid_edge a\" and \"valid_edge a'\"\n and \"intra_kind (kind a)\" and \"intra_kind (kind a')\"\n and \"sourcenode a = sourcenode a'\" and \"targetnode a \\ targetnode a'\"\n obtains Q Q' where \"slice_kind S a = (Q)\\<^sub>\\\" and \"slice_kind S a' = (Q')\\<^sub>\\\"\n and \"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\nproof(atomize_elim)\n from assms obtain Q Q' \n where \"kind a = (Q)\\<^sub>\\\" and \"kind a' = (Q')\\<^sub>\\\" \n and det:\"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\n by(auto dest:deterministic)\n show \"\\Q Q'. slice_kind S a = (Q)\\<^sub>\\ \\ slice_kind S a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with `kind a = (Q)\\<^sub>\\` have \"slice_kind S a = (Q)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n from True `kind a' = (Q')\\<^sub>\\` `sourcenode a = sourcenode a'`\n have \"slice_kind S a' = (Q')\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n with `slice_kind S a = (Q)\\<^sub>\\` det show ?thesis by blast\n next\n case False\n with `kind a = (Q)\\<^sub>\\` \n have \"slice_kind S a = (\\s. True)\\<^sub>\\ \\ slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n thus ?thesis\n proof\n assume true:\"slice_kind S a = (\\s. True)\\<^sub>\\\"\n with `sourcenode a = sourcenode a'` `targetnode a \\ targetnode a'`\n `valid_edge a` `valid_edge a'` `intra_kind (kind a)` `intra_kind (kind a')`\n have \"slice_kind S a' = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_only_one_True_edge)\n with true show ?thesis by simp\n next\n assume false:\"slice_kind S a = (\\s. False)\\<^sub>\\\"\n from False `kind a' = (Q')\\<^sub>\\` `sourcenode a = sourcenode a'`\n have \"slice_kind S a' = (\\s. True)\\<^sub>\\ \\ slice_kind S a' = (\\s. False)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n with false show ?thesis by auto\n qed\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/StaticInter/Slice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.29746326499071896}} {"text": "section \\Postdomination\\\n\ntheory Postdomination imports CFGExit begin\n\nsubsection \\Standard Postdomination\\\n\nlocale Postdomination = CFGExit sourcenode targetnode kind valid_edge Entry Exit \n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Exit :: \"'node\" (\"'('_Exit'_')\") +\n assumes Entry_path:\"valid_node n \\ \\as. (_Entry_) -as\\* n\"\n and Exit_path:\"valid_node n \\ \\as. n -as\\* (_Exit_)\"\n\nbegin\n\ndefinition postdominate :: \"'node \\ 'node \\ bool\" (\"_ postdominates _\" [51,0])\nwhere postdominate_def:\"n' postdominates n \\ \n (valid_node n \\ valid_node n' \\\n ((\\as. n -as\\* (_Exit_) \\ n' \\ set (sourcenodes as))))\"\n\n\nlemma postdominate_implies_path: \n assumes \"n' postdominates n\" obtains as where \"n -as\\* n'\"\nproof(atomize_elim)\n from \\n' postdominates n\\ have \"valid_node n\"\n and all:\"\\as. n -as\\* (_Exit_) \\ n' \\ set(sourcenodes as)\"\n by(auto simp:postdominate_def)\n from \\valid_node n\\ obtain as where \"n -as\\* (_Exit_)\" by(auto dest:Exit_path)\n with all have \"n' \\ set(sourcenodes as)\" by simp\n then obtain ns ns' where \"sourcenodes as = ns@n'#ns'\" by(auto dest:split_list)\n then obtain as' a as'' where \"sourcenodes as' = ns\" \n and \"sourcenode a = n'\" and \"as = as'@a#as''\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from \\n -as\\* (_Exit_)\\ \\as = as'@a#as''\\ have \"n -as'\\* sourcenode a\"\n by(fastforce dest:path_split)\n with \\sourcenode a = n'\\ show \"\\as. n -as\\* n'\" by blast\nqed\n\n\n\nlemma postdominate_refl:\n assumes valid:\"valid_node n\" and notExit:\"n \\ (_Exit_)\"\n shows \"n postdominates n\"\nusing valid\nproof(induct rule:valid_node_cases)\n case Entry\n { fix as assume path:\"(_Entry_) -as\\* (_Exit_)\"\n hence notempty:\"as \\ []\" \n apply - apply(erule path.cases)\n by (drule sym,simp,drule Exit_noteq_Entry,auto)\n with path have \"hd (sourcenodes as) = (_Entry_)\" \n by(fastforce intro:path_sourcenode)\n with notempty have \"(_Entry_) \\ set (sourcenodes as)\"\n by(fastforce intro:hd_in_set simp:sourcenodes_def) }\n with Entry show ?thesis by(simp add:postdominate_def)\nnext\n case Exit\n with notExit have False by simp\n thus ?thesis by simp\nnext\n case inner\n show ?thesis\n proof(cases \"\\as. n -as\\* (_Exit_)\")\n case True\n { fix as' assume path':\"n -as'\\* (_Exit_)\"\n with inner have notempty:\"as' \\ []\"\n by(cases as',auto elim!:path.cases simp:inner_node_def)\n with path' inner have hd:\"hd (sourcenodes as') = n\"\n by -(rule path_sourcenode)\n from notempty have \"sourcenodes as' \\ []\" by(simp add:sourcenodes_def)\n with hd[THEN sym] have \"n \\ set (sourcenodes as')\" by simp }\n hence \"\\as. n -as\\* (_Exit_) \\ n \\ set (sourcenodes as)\" by simp\n with True inner show ?thesis by(simp add:postdominate_def inner_is_valid)\n next\n case False\n with inner show ?thesis by(simp add:postdominate_def inner_is_valid)\n qed\nqed\n\n\nlemma postdominate_trans:\n assumes pd1:\"n'' postdominates n\" and pd2:\"n' postdominates n''\"\n shows \"n' postdominates n\"\nproof -\n from pd1 pd2 have valid:\"valid_node n\" and valid':\"valid_node n'\"\n by(simp_all add:postdominate_def)\n { fix as assume path:\"n -as\\* (_Exit_)\"\n with pd1 have \"n'' \\ set (sourcenodes as)\" by(simp add:postdominate_def)\n then obtain ns' ns'' where \"sourcenodes as = ns'@n''#ns''\"\n by(auto dest:split_list)\n then obtain as' as'' a\n where as'':\"sourcenodes as'' = ns''\" and as:\"as=as'@a#as''\"\n and source:\"sourcenode a = n''\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from as path have \"n -as'@a#as''\\* (_Exit_)\" by simp\n with source have path':\"n'' -a#as''\\* (_Exit_)\"\n by(fastforce dest:path_split_second)\n with pd2 have \"n' \\ set(sourcenodes (a#as''))\"\n by(auto simp:postdominate_def)\n with as have \"n' \\ set(sourcenodes as)\" by(auto simp:sourcenodes_def) }\n with valid valid' show ?thesis by(simp add:postdominate_def)\nqed\n\n\nlemma postdominate_antisym:\n assumes pd1:\"n' postdominates n\" and pd2:\"n postdominates n'\"\n shows \"n = n'\"\nproof -\n from pd1 have valid:\"valid_node n\" and valid':\"valid_node n'\" \n by(auto simp:postdominate_def)\n from valid obtain as where path1:\"n -as\\* (_Exit_)\" by(fastforce dest:Exit_path)\n from valid' obtain as' where path2:\"n' -as'\\* (_Exit_)\" by(fastforce dest:Exit_path)\n from pd1 path1 have \"\\nx \\ set(sourcenodes as). nx = n'\"\n by(simp add:postdominate_def)\n then obtain ns ns' where sources:\"sourcenodes as = ns@n'#ns'\"\n and all:\"\\nx \\ set ns'. nx \\ n'\"\n by(fastforce elim!: rightmost_element_property)\n from sources obtain asx a asx' where ns':\"ns' = sourcenodes asx'\"\n and as:\"as = asx@a#asx'\" and source:\"sourcenode a = n'\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from path1 as have \"n -asx@a#asx'\\* (_Exit_)\" by simp\n with source have \"n' -a#asx'\\* (_Exit_)\" by(fastforce dest:path_split_second)\n with pd2 have \"n \\ set(sourcenodes (a#asx'))\" by(simp add:postdominate_def)\n with source have \"n = n' \\ n \\ set(sourcenodes asx')\" by(simp add:sourcenodes_def)\n thus ?thesis\n proof\n assume \"n = n'\" thus ?thesis .\n next\n assume \"n \\ set(sourcenodes asx')\"\n then obtain nsx' nsx'' where \"sourcenodes asx' = nsx'@n#nsx''\"\n by(auto dest:split_list)\n then obtain asi asi' a' where asx':\"asx' = asi@a'#asi'\"\n and source':\"sourcenode a' = n\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n with path1 as have \"n -(asx@a#asi)@a'#asi'\\* (_Exit_)\" by simp\n with source' have \"n -a'#asi'\\* (_Exit_)\" by(fastforce dest:path_split_second)\n with pd1 have \"n' \\ set(sourcenodes (a'#asi'))\" by(auto simp:postdominate_def)\n with source' have \"n' = n \\ n' \\ set(sourcenodes asi')\"\n by(simp add:sourcenodes_def)\n thus ?thesis\n proof\n assume \"n' = n\" thus ?thesis by(rule sym)\n next\n assume \"n' \\ set(sourcenodes asi')\"\n with asx' ns' have \"n' \\ set ns'\" by(simp add:sourcenodes_def)\n with all have False by blast\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma postdominate_path_branch:\n assumes \"n -as\\* n''\" and \"n' postdominates n''\" and \"\\ n' postdominates n\" \n obtains a as' as'' where \"as = as'@a#as''\" and \"valid_edge a\"\n and \"\\ n' postdominates (sourcenode a)\" and \"n' postdominates (targetnode a)\"\nproof(atomize_elim)\n from assms\n show \"\\as' a as''. as = as'@a#as'' \\ valid_edge a \\ \n \\ n' postdominates (sourcenode a) \\ n' postdominates (targetnode a)\"\n proof(induct rule:path.induct)\n case (Cons_path n'' as nx a n)\n note IH = \\\\n' postdominates nx; \\ n' postdominates n''\\\n \\ \\as' a as''. as = as'@a#as'' \\ valid_edge a \\\n \\ n' postdominates sourcenode a \\ n' postdominates targetnode a\\\n show ?case\n proof(cases \"n' postdominates n''\")\n case True\n with \\\\ n' postdominates n\\ \\sourcenode a = n\\ \\targetnode a = n''\\ \n \\valid_edge a\\\n show ?thesis by blast\n next\n case False\n from IH[OF \\n' postdominates nx\\ this] show ?thesis\n by clarsimp(rule_tac x=\"a#as'\" in exI,clarsimp)\n qed\n qed simp\nqed\n\n\nlemma Exit_no_postdominator:\n \"(_Exit_) postdominates n \\ False\"\nby(fastforce dest:Exit_path simp:postdominate_def)\n\n\nlemma postdominate_path_targetnode:\n assumes \"n' postdominates n\" and \"n -as\\* n''\" and \"n' \\ set(sourcenodes as)\"\n shows \"n' postdominates n''\"\nproof -\n from \\n' postdominates n\\ have \"valid_node n\" and \"valid_node n'\"\n and all:\"\\as''. n -as''\\* (_Exit_) \\ n' \\ set(sourcenodes as'')\"\n by(simp_all add:postdominate_def)\n from \\n -as\\* n''\\ have \"valid_node n''\" by(fastforce dest:path_valid_node)\n have \"\\as''. n'' -as''\\* (_Exit_) \\ n' \\ set(sourcenodes as'')\"\n proof(rule ccontr)\n assume \"\\ (\\as''. n'' -as''\\* (_Exit_) \\ n' \\ set (sourcenodes as''))\"\n then obtain as'' where \"n'' -as''\\* (_Exit_)\"\n and \"n' \\ set (sourcenodes as'')\" by blast\n from \\n -as\\* n''\\ \\n'' -as''\\* (_Exit_)\\ have \"n -as@as''\\* (_Exit_)\" \n by(rule path_Append)\n with \\n' \\ set(sourcenodes as)\\ \\n' \\ set (sourcenodes as'')\\\n have \"n' \\ set (sourcenodes (as@as''))\"\n by(simp add:sourcenodes_def)\n with \\n -as@as''\\* (_Exit_)\\ \\n' postdominates n\\ show False\n by(simp add:postdominate_def)\n qed\n with \\valid_node n'\\ \\valid_node n''\\ show ?thesis by(simp add:postdominate_def)\nqed\n\n\nlemma not_postdominate_source_not_postdominate_target:\n assumes \"\\ n postdominates (sourcenode a)\" and \"valid_node n\" and \"valid_edge a\"\n obtains ax where \"sourcenode a = sourcenode ax\" and \"valid_edge ax\"\n and \"\\ n postdominates targetnode ax\"\nproof(atomize_elim)\n show \"\\ax. sourcenode a = sourcenode ax \\ valid_edge ax \\ \n \\ n postdominates targetnode ax\"\n proof -\n from assms obtain asx \n where \"sourcenode a -asx\\* (_Exit_)\"\n and \"n \\ set(sourcenodes asx)\" by(auto simp:postdominate_def)\n from \\sourcenode a -asx\\* (_Exit_)\\ \\valid_edge a\\ \n obtain ax asx' where [simp]:\"asx = ax#asx'\"\n apply - apply(erule path.cases)\n apply(drule_tac s=\"(_Exit_)\" in sym)\n apply simp\n apply(drule Exit_source)\n by simp_all\n with \\sourcenode a -asx\\* (_Exit_)\\ have \"sourcenode a -[]@ax#asx'\\* (_Exit_)\"\n by simp\n hence \"valid_edge ax\" and \"sourcenode a = sourcenode ax\"\n and \"targetnode ax -asx'\\* (_Exit_)\"\n by(fastforce dest:path_split)+\n with \\n \\ set(sourcenodes asx)\\ have \"\\ n postdominates targetnode ax\"\n by(fastforce simp:postdominate_def sourcenodes_def)\n with \\sourcenode a = sourcenode ax\\ \\valid_edge ax\\ show ?thesis by blast\n qed\nqed\n\n\nlemma inner_node_Entry_edge:\n assumes \"inner_node n\" \n obtains a where \"valid_edge a\" and \"inner_node (targetnode a)\"\n and \"sourcenode a = (_Entry_)\"\nproof(atomize_elim)\n from \\inner_node n\\ have \"valid_node n\" by(rule inner_is_valid)\n then obtain as where \"(_Entry_) -as\\* n\" by(fastforce dest:Entry_path)\n show \"\\a. valid_edge a \\ inner_node (targetnode a) \\ sourcenode a = (_Entry_)\"\n proof(cases \"as = []\")\n case True\n with \\inner_node n\\ \\(_Entry_) -as\\* n\\ have False \n by(fastforce simp:inner_node_def)\n thus ?thesis by simp\n next\n case False\n with \\(_Entry_) -as\\* n\\ obtain a' as' where \"as = a'#as'\"\n and \"(_Entry_) = sourcenode a'\" and \"valid_edge a'\" \n and \"targetnode a' -as'\\* n\" \n by -(erule path_split_Cons)\n from \\valid_edge a'\\ have \"valid_node (targetnode a')\" by simp\n thus ?thesis\n proof(cases \"targetnode a'\" rule:valid_node_cases)\n case Entry\n from \\valid_edge a'\\ this have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with \\targetnode a' -as'\\* n\\ \\inner_node n\\\n have False by simp (drule path_Exit_source,auto simp:inner_node_def)\n thus ?thesis by simp\n next\n case inner\n with \\valid_edge a'\\ \\(_Entry_) = sourcenode a'\\ show ?thesis by simp blast\n qed\n qed\nqed\n\n\nlemma inner_node_Exit_edge:\n assumes \"inner_node n\" \n obtains a where \"valid_edge a\" and \"inner_node (sourcenode a)\"\n and \"targetnode a = (_Exit_)\"\nproof(atomize_elim)\n from \\inner_node n\\ have \"valid_node n\" by(rule inner_is_valid)\n then obtain as where \"n -as\\* (_Exit_)\" by(fastforce dest:Exit_path)\n show \"\\a. valid_edge a \\ inner_node (sourcenode a) \\ targetnode a = (_Exit_)\"\n proof(cases \"as = []\")\n case True\n with \\inner_node n\\ \\n -as\\* (_Exit_)\\ have False by fastforce\n thus ?thesis by simp\n next\n case False\n with \\n -as\\* (_Exit_)\\ obtain a' as' where \"as = as'@[a']\" \n and \"n -as'\\* sourcenode a'\" and \"valid_edge a'\" \n and \"(_Exit_) = targetnode a'\" by -(erule path_split_snoc)\n from \\valid_edge a'\\ have \"valid_node (sourcenode a')\" by simp\n thus ?thesis\n proof(cases \"sourcenode a'\" rule:valid_node_cases)\n case Entry\n with \\n -as'\\* sourcenode a'\\ \\inner_node n\\\n have False by simp (drule path_Entry_target,auto simp:inner_node_def)\n thus ?thesis by simp\n next\n case Exit\n from \\valid_edge a'\\ this have False by(rule Exit_source)\n thus ?thesis by simp\n next\n case inner\n with \\valid_edge a'\\ \\(_Exit_) = targetnode a'\\ show ?thesis by simp blast\n qed\n qed\nqed\n\n\n\n\nend\n\nsubsection \\Strong Postdomination\\\n\n\nlocale StrongPostdomination = \n Postdomination sourcenode targetnode kind valid_edge Entry Exit \n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Exit :: \"'node\" (\"'('_Exit'_')\") +\n assumes successor_set_finite: \"valid_node n \\ \n finite {n'. \\a'. valid_edge a' \\ sourcenode a' = n \\ targetnode a' = n'}\"\n\nbegin\n\ndefinition strong_postdominate :: \"'node \\ 'node \\ bool\" \n(\"_ strongly-postdominates _\" [51,0])\nwhere strong_postdominate_def:\"n' strongly-postdominates n \\\n (n' postdominates n \\ \n (\\k \\ 1. \\as nx. n -as\\* nx \\ \n length as \\ k \\ n' \\ set(sourcenodes as)))\"\n\n\nlemma strong_postdominate_prop_smaller_path:\n assumes all:\"\\as nx. n -as\\* nx \\ length as \\ k \\ n' \\ set(sourcenodes as)\"\n and \"n -as\\* n''\" and \"length as \\ k\"\n obtains as' as'' where \"n -as'\\* n'\" and \"length as' < k\" and \"n' -as''\\* n''\"\n and \"as = as'@as''\"\nproof(atomize_elim)\n show \"\\as' as''. n -as'\\* n' \\ length as' < k \\ n' -as''\\* n'' \\ as = as'@as''\"\n proof(rule ccontr)\n assume \"\\ (\\as' as''. n -as'\\* n' \\ length as' < k \\ n' -as''\\* n'' \\ \n as = as'@as'')\"\n hence all':\"\\as' as''. n -as'\\* n' \\ n' -as''\\* n'' \\ as = as'@as'' \n \\ length as' \\ k\" by fastforce\n from all \\n -as\\* n''\\ \\length as \\ k\\ have \"\\nx \\ set(sourcenodes as). nx = n'\"\n by fastforce\n then obtain ns ns' where \"sourcenodes as = ns@n'#ns'\"\n and \"\\nx \\ set ns. nx \\ n'\"\n by(fastforce elim!:split_list_first_propE)\n then obtain asx a asx' where [simp]:\"ns = sourcenodes asx\"\n and [simp]:\"as = asx@a#asx'\" and \"sourcenode a = n'\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from \\n -as\\* n''\\ have \"n -asx@a#asx'\\* n''\" by simp\n with \\sourcenode a = n'\\ have \"n -asx\\* n'\" and \"valid_edge a\"\n and \"targetnode a -asx'\\* n''\" by(fastforce dest:path_split)+\n with \\sourcenode a = n'\\ have \"n' -a#asx'\\* n''\" by(fastforce intro:Cons_path)\n with \\n -asx\\* n'\\ all' have \"length asx \\ k\" by simp\n with \\n -asx\\* n'\\ all have \"n' \\ set(sourcenodes asx)\" by fastforce\n with \\\\nx \\ set ns. nx \\ n'\\ show False by fastforce\n qed\nqed\n\n\n\nlemma strong_postdominate_refl:\n assumes \"valid_node n\" and \"n \\ (_Exit_)\"\n shows \"n strongly-postdominates n\"\nproof -\n from assms have \"n postdominates n\" by(rule postdominate_refl)\n { fix as nx assume \"n -as\\* nx\" and \"length as \\ 1\"\n then obtain a' as' where [simp]:\"as = a'#as'\" by(cases as) auto\n with \\n -as\\* nx\\ have \"n -[]@a'#as'\\* nx\" by simp\n hence \"n = sourcenode a'\" by(fastforce dest:path_split)\n hence \"n \\ set(sourcenodes as)\" by(simp add:sourcenodes_def) }\n hence \"\\as nx. n -as\\* nx \\ length as \\ 1 \\ n \\ set(sourcenodes as)\"\n by auto\n hence \"\\k \\ 1. \\as nx. n -as\\* nx \\ length as \\ k \\ n \\ set(sourcenodes as)\"\n by blast\n with \\n postdominates n\\ show ?thesis by(simp add:strong_postdominate_def)\nqed\n\n\nlemma strong_postdominate_trans:\n assumes \"n'' strongly-postdominates n\" and \"n' strongly-postdominates n''\"\n shows \"n' strongly-postdominates n\"\nproof -\n from \\n'' strongly-postdominates n\\ have \"n'' postdominates n\"\n and paths1:\"\\k \\ 1. \\as nx. n -as\\* nx \\ length as \\ k \n \\ n'' \\ set(sourcenodes as)\"\n by(auto simp only:strong_postdominate_def)\n from paths1 obtain k1 \n where all1:\"\\as nx. n -as\\* nx \\ length as \\ k1 \\ n'' \\ set(sourcenodes as)\"\n and \"k1 \\ 1\" by blast\n from \\n' strongly-postdominates n''\\ have \"n' postdominates n''\"\n and paths2:\"\\k \\ 1. \\as nx. n'' -as\\* nx \\ length as \\ k \n \\ n' \\ set(sourcenodes as)\"\n by(auto simp only:strong_postdominate_def)\n from paths2 obtain k2 \n where all2:\"\\as nx. n'' -as\\* nx \\ length as \\ k2 \\ n' \\ set(sourcenodes as)\"\n and \"k2 \\ 1\" by blast\n from \\n'' postdominates n\\ \\n' postdominates n''\\ \n have \"n' postdominates n\" by(rule postdominate_trans)\n { fix as nx assume \"n -as\\* nx\" and \"length as \\ k1 + k2\"\n hence \"length as \\ k1\" by fastforce\n with \\n -as\\* nx\\ all1 obtain asx asx' where \"n -asx\\* n''\"\n and \"length asx < k1\" and \"n'' -asx'\\* nx\"\n and [simp]:\"as = asx@asx'\" by -(erule strong_postdominate_prop_smaller_path)\n with \\length as \\ k1 + k2\\ have \"length asx' \\ k2\" by fastforce\n with \\n'' -asx'\\* nx\\ all2 have \"n' \\ set(sourcenodes asx')\" by fastforce\n hence \"n' \\ set(sourcenodes as)\" by(simp add:sourcenodes_def) }\n with \\k1 \\ 1\\ \\k2 \\ 1\\ have \"\\k \\ 1. \\as nx. n -as\\* nx \\ length as \\ k \n \\ n' \\ set(sourcenodes as)\"\n by(rule_tac x=\"k1 + k2\" in exI,auto)\n with \\n' postdominates n\\ show ?thesis by(simp add:strong_postdominate_def)\nqed\n\n\nlemma strong_postdominate_antisym:\n \"\\n' strongly-postdominates n; n strongly-postdominates n'\\ \\ n = n'\"\nby(fastforce intro:postdominate_antisym simp:strong_postdominate_def)\n\n\nlemma strong_postdominate_path_branch:\n assumes \"n -as\\* n''\" and \"n' strongly-postdominates n''\" \n and \"\\ n' strongly-postdominates n\"\n obtains a as' as'' where \"as = as'@a#as''\" and \"valid_edge a\"\n and \"\\ n' strongly-postdominates (sourcenode a)\" \n and \"n' strongly-postdominates (targetnode a)\"\nproof(atomize_elim)\n from assms\n show \"\\as' a as''. as = as'@a#as'' \\ valid_edge a \\ \n \\ n' strongly-postdominates (sourcenode a) \\ \n n' strongly-postdominates (targetnode a)\"\n proof(induct rule:path.induct)\n case (Cons_path n'' as nx a n)\n note IH = \\\\n' strongly-postdominates nx; \\ n' strongly-postdominates n''\\\n \\ \\as' a as''. as = as'@a#as'' \\ valid_edge a \\\n \\ n' strongly-postdominates sourcenode a \\ \n n' strongly-postdominates targetnode a\\\n show ?case\n proof(cases \"n' strongly-postdominates n''\")\n case True\n with \\\\ n' strongly-postdominates n\\ \\sourcenode a = n\\ \\targetnode a = n''\\\n \\valid_edge a\\\n show ?thesis by blast\n next\n case False\n from IH[OF \\n' strongly-postdominates nx\\ this] show ?thesis\n by clarsimp(rule_tac x=\"a#as'\" in exI,clarsimp)\n qed\n qed simp\nqed\n\n\nlemma Exit_no_strong_postdominator:\n \"\\(_Exit_) strongly-postdominates n; n -as\\* (_Exit_)\\ \\ False\"\nby(fastforce intro:Exit_no_postdominator path_valid_node simp:strong_postdominate_def)\n\n\nlemma strong_postdominate_path_targetnode:\n assumes \"n' strongly-postdominates n\" and \"n -as\\* n''\"\n and \"n' \\ set(sourcenodes as)\"\n shows \"n' strongly-postdominates n''\"\nproof -\n from \\n' strongly-postdominates n\\ have \"n' postdominates n\"\n and \"\\k \\ 1. \\as nx. n -as\\* nx \\ length as \\ k \n \\ n' \\ set(sourcenodes as)\"\n by(auto simp only:strong_postdominate_def)\n then obtain k where \"k \\ 1\"\n and paths:\"\\as nx. n -as\\* nx \\ length as \\ k \n \\ n' \\ set(sourcenodes as)\" by auto\n from \\n' postdominates n\\ \\n -as\\* n''\\ \\n' \\ set(sourcenodes as)\\\n have \"n' postdominates n''\"\n by(rule postdominate_path_targetnode)\n { fix as' nx assume \"n'' -as'\\* nx\" and \"length as' \\ k\"\n with \\n -as\\* n''\\ have \"n -as@as'\\* nx\" and \"length (as@as') \\ k\"\n by(auto intro:path_Append)\n with paths have \"n' \\ set(sourcenodes (as@as'))\" by fastforce\n with \\n' \\ set(sourcenodes as)\\ have \"n' \\ set(sourcenodes as')\"\n by(fastforce simp:sourcenodes_def) }\n with \\k \\ 1\\ have \"\\k \\ 1. \\as' nx. n'' -as'\\* nx \\ length as' \\ k \n \\ n' \\ set(sourcenodes as')\" by auto\n with \\n' postdominates n''\\ show ?thesis by(simp add:strong_postdominate_def)\nqed\n\n\nlemma not_strong_postdominate_successor_set:\n assumes \"\\ n strongly-postdominates (sourcenode a)\" and \"valid_node n\"\n and \"valid_edge a\"\n and all:\"\\nx \\ N. \\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\\n targetnode a' = nx \\ n strongly-postdominates nx\"\n obtains a' where \"valid_edge a'\" and \"sourcenode a' = sourcenode a\"\n and \"targetnode a' \\ N\"\nproof(atomize_elim)\n show \"\\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ targetnode a' \\ N\"\n proof(cases \"n postdominates (sourcenode a)\")\n case False\n with \\valid_edge a\\ \\valid_node n\\\n obtain a' where [simp]:\"sourcenode a = sourcenode a'\"\n and \"valid_edge a'\" and \"\\ n postdominates targetnode a'\"\n by -(erule not_postdominate_source_not_postdominate_target)\n with all have \"targetnode a' \\ N\" by(auto simp:strong_postdominate_def)\n with \\valid_edge a'\\ show ?thesis by simp blast\n next\n case True\n let ?M = \"{n'. \\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n targetnode a' = n'}\"\n let ?M' = \"{n'. \\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n targetnode a' = n' \\ n strongly-postdominates n'}\"\n let ?N' = \"(\\n'. SOME i. i \\ 1 \\ \n (\\as nx. n' -as\\* nx \\ length as \\ i \n \\ n \\ set(sourcenodes as))) ` N\"\n obtain k where [simp]:\"k = Max ?N'\" by simp\n have eq:\"{x \\ ?M. (\\n'. n strongly-postdominates n') x} = ?M'\" by auto\n from \\valid_edge a\\ have \"finite ?M\" by(simp add:successor_set_finite)\n hence \"finite {x \\ ?M. (\\n'. n strongly-postdominates n') x}\" by fastforce\n with eq have \"finite ?M'\" by simp\n from all have \"N \\ ?M'\" by auto\n with \\finite ?M'\\ have \"finite N\" by(auto intro:finite_subset)\n hence \"finite ?N'\" by fastforce\n show ?thesis\n proof(rule ccontr)\n assume \"\\ (\\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n targetnode a' \\ N)\"\n hence allImp:\"\\a'. valid_edge a' \\ sourcenode a' = sourcenode a\n \\ targetnode a' \\ N\" by blast\n from True \\\\ n strongly-postdominates (sourcenode a)\\\n have allPaths:\"\\k \\ 1. \\as nx. sourcenode a -as\\* nx \\ length as \\ k \n \\ n \\ set(sourcenodes as)\" by(auto simp:strong_postdominate_def)\n then obtain as nx where \"sourcenode a -as\\* nx\"\n and \"length as \\ k + 1\" and \"n \\ set(sourcenodes as)\"\n by (erule_tac x=\"k + 1\" in allE) auto\n then obtain ax as' where [simp]:\"as = ax#as'\" and \"valid_edge ax\"\n and \"sourcenode ax = sourcenode a\" and \"targetnode ax -as'\\* nx\"\n by -(erule path.cases,auto)\n with allImp have \"targetnode ax \\ N\" by fastforce\n with all have \"n strongly-postdominates (targetnode ax)\"\n by auto\n then obtain k' where k':\"k' = (SOME i. i \\ 1 \\\n (\\as nx. targetnode ax -as\\* nx \\ length as \\ i \n \\ n \\ set(sourcenodes as)))\" by simp\n with \\n strongly-postdominates (targetnode ax)\\\n have \"k' \\ 1 \\ (\\as nx. targetnode ax -as\\* nx \\ length as \\ k'\n \\ n \\ set(sourcenodes as))\"\n by(auto elim!:someI_ex simp:strong_postdominate_def)\n hence \"k' \\ 1\"\n and spdAll:\"\\as nx. targetnode ax -as\\* nx \\ length as \\ k'\n \\ n \\ set(sourcenodes as)\"\n by simp_all\n from \\targetnode ax \\ N\\ k' have \"k' \\ ?N'\" by blast\n with \\targetnode ax \\ N\\ have \"?N' \\ {}\" by auto\n with \\k' \\ ?N'\\ have \"k' \\ Max ?N'\" using \\finite ?N'\\ by(fastforce intro:Max_ge)\n hence \"k' \\ k\" by simp\n with \\targetnode ax -as'\\* nx\\ \\length as \\ k + 1\\ spdAll \n have \"n \\ set(sourcenodes as')\"\n by fastforce\n with \\n \\ set(sourcenodes as)\\ show False by(simp add:sourcenodes_def)\n qed\n qed\nqed\n\n\n\nlemma not_strong_postdominate_predecessor_successor:\n assumes \"\\ n strongly-postdominates (sourcenode a)\"\n and \"valid_node n\" and \"valid_edge a\"\n obtains a' where \"valid_edge a'\" and \"sourcenode a' = sourcenode a\"\n and \"\\ n strongly-postdominates (targetnode a')\"\nproof(atomize_elim)\n show \"\\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n \\ n strongly-postdominates (targetnode a')\"\n proof(rule ccontr)\n assume \"\\ (\\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\\n \\ n strongly-postdominates targetnode a')\"\n hence all:\"\\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n n strongly-postdominates (targetnode a')\" by auto\n let ?N = \"{n'. \\a'. sourcenode a' = sourcenode a \\ valid_edge a' \\ \n targetnode a' = n'}\"\n from all have \"\\nx \\ ?N. \\a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n targetnode a' = nx \\ n strongly-postdominates nx\"\n by auto\n with assms obtain a' where \"valid_edge a'\" \n and \"sourcenode a' = sourcenode a\" and \"targetnode a' \\ ?N\"\n by(erule not_strong_postdominate_successor_set)\n thus False by auto\n qed\nqed\n\n\nend\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/Basic/Postdomination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2974624438485457}} {"text": "header {* Syntax tree helpers *}\n\ntheory CPSUtils\nimports CPSScheme\nbegin\n\ntext {*\nThis theory defines the sets @{text \"lambdas p\"}, @{text \"calls p\"}, @{text \"calls p\"}, @{text \"vars p\"}, @{text \"labels p\"} and @{text \"prims p\"} as the subexpressions of the program @{text \"p\"}. Finiteness is shown for each of these sets, and some rules about how these sets relate. All these rules are proven more or less the same ways, which is very inelegant due to the nesting of the type and the shape of the derived induction rule.\n\nIt would be much nicer to start with these rules and define the set inductively. Unfortunately, that approach would make it very hard to show the finiteness of the sets in question.\n*}\n\n\nfun lambdas :: \"lambda \\ lambda set\"\nand lambdasC :: \"call \\ lambda set\"\nand lambdasV :: \"val \\ lambda set\"\nwhere \"lambdas (Lambda l vs c) = ({Lambda l vs c} \\ lambdasC c)\"\n | \"lambdasC (App l d ds) = lambdasV d \\ (UNION (set ds) lambdasV)\"\n | \"lambdasC (Let l binds c') = (UNION (set binds) (\\(_,l). lambdas l)\n \\ lambdasC c')\"\n | \"lambdasV (L l) = lambdas l\"\n | \"lambdasV _ = {}\"\n\n\nfun calls :: \"lambda \\ call set\"\nand callsC :: \"call \\ call set\"\nand callsV :: \"val \\ call set\"\nwhere \"calls (Lambda l vs c) = callsC c\"\n | \"callsC (App l d ds) = {App l d ds} \\ callsV d \\ (UNION (set ds) callsV)\"\n | \"callsC (Let l binds c') = {Let l binds c'}\n \\ (UNION (set binds) (\\(_,l). calls l)\n \\ callsC c')\"\n | \"callsV (L l) = calls l\"\n | \"callsV _ = {}\"\n\nlemma finite_lambdas[simp]: \"finite (lambdas l)\" and \"finite (lambdasC c)\" \"finite (lambdasV v)\"\nby (induct rule: lambdas_lambdasC_lambdasV.induct, auto)\n\nlemma finite_calls[simp]: \"finite (calls l)\" and \"finite (callsC c)\" \"finite (callsV v)\"\nby (induct rule: calls_callsC_callsV.induct, auto)\n\nfun vars :: \"lambda \\ var set\"\nand varsC :: \"call \\ var set\"\nand varsV :: \"val \\ var set\"\nwhere \"vars (Lambda _ vs c) = set vs \\ varsC c\"\n | \"varsC (App _ a as) = varsV a \\ UNION (set as) varsV\"\n | \"varsC (Let _ binds c') = UNION (set binds) (\\(v,l). {v} \\ vars l) \\ varsC c'\"\n | \"varsV (L l) = vars l\"\n | \"varsV (R _ v) = {v}\"\n | \"varsV _ = {}\"\n\n\n\nfun label :: \"lambda + call \\ label\"\nwhere \"label (Inl (Lambda l _ _)) = l\"\n | \"label (Inr (App l _ _)) = l\"\n | \"label (Inr (Let l _ _)) = l\"\n\nfun labels :: \"lambda \\ label set\"\nand labelsC :: \"call \\ label set\"\nand labelsV :: \"val \\ label set\"\nwhere \"labels (Lambda l vs c) = {l} \\ labelsC c\"\n | \"labelsC (App l a as) = {l} \\ labelsV a \\ UNION (set as) labelsV\"\n | \"labelsC (Let l binds c') = {l} \\ UNION (set binds) (\\(v,l). labels l) \\ labelsC c'\"\n | \"labelsV (L l) = labels l\"\n | \"labelsV (R l _) = {l}\"\n | \"labelsV _ = {}\"\n\nlemma finite_labels[simp]: \"finite (labels l)\" and \"finite (labelsC c)\" \"finite (labelsV v)\"\nby (induct rule: labels_labelsC_labelsV.induct, auto)\n\nfun prims :: \"lambda \\ prim set\"\nand primsC :: \"call \\ prim set\"\nand primsV :: \"val \\ prim set\"\nwhere \"prims (Lambda _ vs c) = primsC c\"\n | \"primsC (App _ a as) = primsV a \\ UNION (set as) primsV\"\n | \"primsC (Let _ binds c') = UNION (set binds) (\\(_,l). prims l) \\ primsC c'\"\n | \"primsV (L l) = prims l\"\n | \"primsV (R l v) = {}\"\n | \"primsV (P prim) = {prim}\"\n | \"primsV (C l v) = {}\"\n\nlemma finite_prims[simp]: \"finite (prims l)\" and \"finite (primsC c)\" \"finite (primsV v)\"\nby (induct rule: labels_labelsC_labelsV.induct, auto)\n\nfun vals :: \"lambda \\ val set\"\nand valsC :: \"call \\ val set\"\nand valsV :: \"val \\ val set\"\nwhere \"vals (Lambda _ vs c) = valsC c\"\n | \"valsC (App _ a as) = valsV a \\ UNION (set as) valsV\"\n | \"valsC (Let _ binds c') = UNION (set binds) (\\(_,l). vals l) \\ valsC c'\"\n | \"valsV (L l) = {L l} \\ vals l\"\n | \"valsV (R l v) = {R l v}\"\n | \"valsV (P prim) = {P prim}\"\n | \"valsV (C l v) = {C l v}\"\n\nlemma\n fixes list2 :: \"(var \\ lambda) list\" and t :: \"var\\lambda\"\n shows lambdas1: \"Lambda l vs c \\ lambdas x \\ c \\ calls x\"\n and \"Lambda l vs c \\ lambdasC y \\ c \\ callsC y\"\n and \"Lambda l vs c \\ lambdasV z \\ c \\ callsV z\"\n and \"\\z\\ set list. Lambda l vs c \\ lambdasV z \\ c \\ callsV z\"\n and \"\\x\\ set list2. Lambda l vs c \\ lambdas (snd x) \\ c \\ calls (snd x)\"\n and \"Lambda l vs c \\ lambdas (snd t) \\ c \\ calls (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac c, auto)[1]\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows lambdas2: \"Lambda l vs c \\ lambdas x \\ l \\ labels x\"\n and \"Lambda l vs c \\ lambdasC y \\ l \\ labelsC y\"\n and \"Lambda l vs c \\ lambdasV z \\ l \\ labelsV z\"\n and \"\\z\\ set list. Lambda l vs c \\ lambdasV z \\ l \\ labelsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Lambda l vs c \\ lambdas (snd x) \\ l \\ labels (snd x)\"\n and \"Lambda l vs c \\ lambdas (snd (t:: var\\lambda)) \\ l \\ labels (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows lambdas3: \"Lambda l vs c \\ lambdas x \\ set vs \\ vars x\"\n and \"Lambda l vs c \\ lambdasC y \\ set vs \\ varsC y\"\n and \"Lambda l vs c \\ lambdasV z \\ set vs \\ varsV z\"\n and \"\\z\\ set list. Lambda l vs c \\ lambdasV z \\ set vs \\ varsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Lambda l vs c \\ lambdas (snd x) \\ set vs \\ vars (snd x)\"\n and \"Lambda l vs c \\ lambdas (snd (t:: var\\lambda)) \\ set vs \\ vars (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((aa, ba), bb)\" in ballE)\napply (rule_tac x=\"((aa, ba), bb)\" in bexI, auto)\ndone\n\nlemma \n shows app1: \"App l d ds \\ calls x \\ d \\ vals x\"\n and \"App l d ds \\ callsC y \\ d \\ valsC y\"\n and \"App l d ds \\ callsV z \\ d \\ valsV z\"\n and \"\\z\\ set list. App l d ds \\ callsV z \\ d \\ valsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . App l d ds \\ calls (snd x) \\ d \\ vals (snd x)\"\n and \"App l d ds \\ calls (snd (t:: var\\lambda)) \\ d \\ vals (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac d, auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows app2: \"App l d ds \\ calls x \\ set ds \\ vals x\"\n and \"App l d ds \\ callsC y \\ set ds \\ valsC y\"\n and \"App l d ds \\ callsV z \\ set ds \\ valsV z\"\n and \"\\z\\ set list. App l d ds \\ callsV z \\ set ds \\ valsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . App l d ds \\ calls (snd x) \\ set ds \\ vals (snd x)\"\n and \"App l d ds \\ calls (snd (t:: var\\lambda)) \\ set ds \\ vals (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac x, auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows let1: \"Let l binds c' \\ calls x \\ l \\ labels x\"\n and \"Let l binds c' \\ callsC y \\ l \\ labelsC y\"\n and \"Let l binds c' \\ callsV z \\ l \\ labelsV z\"\n and \"\\z\\ set list. Let l binds c' \\ callsV z \\ l \\ labelsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Let l binds c' \\ calls (snd x) \\ l \\ labels (snd x)\"\n and \"Let l binds c' \\ calls (snd (t:: var\\lambda)) \\ l \\ labels (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows let2: \"Let l binds c' \\ calls x \\ c' \\ calls x\"\n and \"Let l binds c' \\ callsC y \\ c' \\ callsC y\"\n and \"Let l binds c' \\ callsV z \\ c' \\ callsV z\"\n and \"\\z\\ set list. Let l binds c' \\ callsV z \\ c' \\ callsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Let l binds c' \\ calls (snd x) \\ c' \\ calls (snd x)\"\n and \"Let l binds c' \\ calls (snd (t:: var\\lambda)) \\ c' \\ calls (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac c', auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n shows let3: \"Let l binds c' \\ calls x \\ fst ` set binds \\ vars x\"\n and \"Let l binds c' \\ callsC y \\ fst ` set binds \\ varsC y\"\n and \"Let l binds c' \\ callsV z \\ fst ` set binds \\ varsV z\"\n and \"\\z\\ set list. Let l binds c' \\ callsV z \\ fst ` set binds \\ varsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Let l binds c' \\ calls (snd x) \\ fst ` set binds \\ vars (snd x)\"\n and \"Let l binds c' \\ calls (snd (t:: var\\lambda)) \\ fst ` set binds \\ vars (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((ab, bc), bd)\" in ballE)\napply (rule_tac x=\"((ab, bc), bd)\" in bexI, auto)\ndone\n\nlemma\n shows let4: \"Let l binds c' \\ calls x \\ snd ` set binds \\ lambdas x\"\n and \"Let l binds c' \\ callsC y \\ snd ` set binds \\ lambdasC y\"\n and \"Let l binds c' \\ callsV z \\ snd ` set binds \\ lambdasV z\"\n and \"\\z\\ set list. Let l binds c' \\ callsV z \\ snd ` set binds \\ lambdasV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . Let l binds c' \\ calls (snd x) \\ snd ` set binds \\ lambdas (snd x)\"\n and \"Let l binds c' \\ calls (snd (t:: var\\lambda)) \\ snd ` set binds \\ lambdas (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\napply (case_tac ba, auto)\napply (erule_tac x=\"((aa, bb), bc)\" in ballE)\napply (rule_tac x=\"((aa, bb), bc)\" in bexI, auto)\ndone\n\nlemma\nshows vals1: \"P prim \\ vals p \\ prim \\ prims p\"\n and \"P prim \\ valsC y \\ prim \\ primsC y\"\n and \"P prim \\ valsV z \\ prim \\ primsV z\"\n and \"\\z\\ set list. P prim \\ valsV z \\ prim \\ primsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . P prim \\ vals (snd x) \\ prim \\ prims (snd x)\"\n and \"P prim \\ vals (snd (t:: var\\lambda)) \\ prim \\ prims (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma\nshows vals2: \"R l var \\ vals p \\ var \\ vars p\"\n and \"R l var \\ valsC y \\ var \\ varsC y\"\n and \"R l var \\ valsV z \\ var \\ varsV z\"\n and \"\\z\\ set list. R l var \\ valsV z \\ var \\ varsV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . R l var \\ vals (snd x) \\ var \\ vars (snd x)\"\n and \"R l var \\ vals (snd (t:: var\\lambda)) \\ var \\ vars (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma\nshows vals3: \"L l \\ vals p \\ l \\ lambdas p\"\n and \"L l \\ valsC y \\ l \\ lambdasC y\"\n and \"L l \\ valsV z \\ l \\ lambdasV z\"\n and \"\\z\\ set list. L l \\ valsV z \\ l \\ lambdasV z\"\n and \"\\x\\ set (list2 :: (var \\ lambda) list) . L l \\ vals (snd x) \\ l \\ lambdas (snd x)\"\n and \"L l \\ vals (snd (t:: var\\lambda)) \\ l \\ lambdas (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\napply (case_tac l, auto)\ndone\n\n\ndefinition nList :: \"'a set => nat => 'a list set\"\nwhere \"nList A n \\ {l. set l \\ A \\ length l = n}\"\n\n\n\ndefinition NList :: \"'a set => nat set => 'a list set\"\nwhere \"NList A N \\ \\ n \\ N. nList A n\"\n\nlemma finite_Nlist[intro]:\n \"\\ finite A; finite N \\ \\ finite (NList A N)\"\nunfolding NList_def using assms by auto\n\ndefinition call_list_lengths\n where \"call_list_lengths p = {0,1,2,3} \\ (\\c. case c of (App _ _ ds) \\ length ds | _ \\ 0) ` calls p\"\n\nlemma finite_call_list_lengths[simp]: \"finite (call_list_lengths p)\"\n unfolding call_list_lengths_def by auto\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Shivers-CFA/CPSUtils.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.29746244384854564}} {"text": "theory Arl_Ext\n imports\n \"../Setup\"\n \"../Separation_Logic_Solver/Methods\"\n \"../Bool_Assn_Setup\"\n\n \"Isabelle_LLVM.LLVM_DS_All\"\nbegin\n\n\nhide_const Proto_EOArray.list_assn\n\n\ndefinition arl_elem_assn_ex ::\n \"('a, 'b) dr_assn \\ 'a list \\ 'b list \\ ('b::llvm_rep, 'l::len2) array_list \\ nat set \\ ll_assn\" where \n \"arl_elem_assn_ex A xs xsi arl ex \\ \\arl_assn xsi arl ** \\(list_assn A (idxe_map xsi |` ex)) xs xsi\"\n\n\nabbreviation \"arl_elem_assn A xs arl \\ (EXS xsi. arl_elem_assn_ex A xs xsi arl {})\"\n\n\nlemma \n frame_assumption_rule_dyn :\n \"\\P = Q; PS -- Pr \\ QS -- Qr\\ \\ P ** PS -- Pr \\ Q ** QS -- Qr\"\n \"\\P = Q; \\ -- Pr \\ QS -- Qr\\ \\ P -- Pr \\ Q ** QS -- Qr\"\n \"\\P = Q; \\ -- Pr \\ \\ -- Qr\\ \\ P -- Pr \\ Q -- Qr\"\n apply (simp_all add: conj_entails_mono sep_conj_left_commute sep_conj_commute) \n \n oops\n \n\nlemma entails_refl_dyn:\n \"\\P = Q; PS \\ QS \\ \\ P ** PS \\ Q ** QS\"\n \"\\P = Q; \\ \\ QS\\ \\ P \\ Q ** QS\"\n \"\\P = Q; \\ \\ \\\\ \\ P \\ Q\"\n apply (auto intro: conj_entails_mono)[1]\n apply (simp, isep_assumption, simp)\n apply simp\n done\n\n\nlemma arl_elem_assn_def':\n \"arl_elem_assn A xs xsi = (EXS l. \\arl_assn l xsi ** \\(list_assn A (Map.empty)) xs l)\"\n unfolding arl_elem_assn_ex_def\n by simp\n\n\nlemma is_pure_pureI:\n \"is_pure A \\ pure_part (\\A x y) \\ \\ \\ \\A x y\"\n by (simp add: extract_pure_assn pure_true_conv)\n\n\nlemma pure_pure_asm_prefixI:\n \"\\\\<^sub>passn x y \\ \\ \\ \\assn x y\"\n by (metis (full_types) dr_assn_pure_asm_prefix_def entails_refl extract_pure_assn pure_true_conv)\n\n\nlemma snat_assn_le_iso [simp]:\n \"\\\\\\<^sub>psnat.assn x xi; \\\\<^sub>psnat.assn y yi\\ \\ xi < yi \\ x < y\"\n unfolding snat.assn_def \n by (auto simp add: snat_eq_unat_aux2 unat_mono word_less_nat_alt)\n\n\nlemmas la_ired_extract[isep_red] = la_red_extract[simplified PRECOND_def SOLVE_AUTO_def]\n\nlemma la_ired_join[isep_red]:\n \"R i = None \\ i x=xs!i \\ y=ys!i \n \\ is_sep_red \\ \\ (\\A x y ** \\(list_assn A (R(i\\ys!i))) xs ys) (\\(list_assn A R) xs ys)\"\n apply (rule is_sep_redI)\n subgoal premises prems\n apply (isep_drule drule: prems(2))\n apply (isep_drule drule: list_assn_join)\n using prems apply auto\n apply (simp add: fun_upd_idem)\n done\n done\n\n\n\nlemma arl_mems_len_rule [vcg_rules]:\n \"\n llvm_htriple\n (arl_elem_assn_ex A xs xsi arl ex)\n (arl_len arl)\n (\\len. \\snat.assn (length xs) len ** arl_elem_assn_ex A xs xsi arl ex)\n\"\n unfolding arl_elem_assn_ex_def\n apply vcg\n apply vcg_compat\n apply isep_extract_pure\n apply (isep_rule rule: pure_pure_asm_prefixI, (auto dest: list_assn_pure_partD)[1])\n apply sep\n done\n\n\n\nlemma arl_mems_nth_rule [vcg_rules]:\n\"\n llvm_htriple\n (arl_elem_assn_ex A xs xsi arl ex ** \\snat.assn i ii ** \\(i < length xs) ** \\(i \\ ex))\n (arl_nth arl ii)\n (\\elem. arl_elem_assn_ex A xs xsi arl (ex \\ {i}) ** \\A (xs ! i) elem ** \\(elem = xsi ! i))\n\"\n unfolding arl_elem_assn_ex_def\n apply vcg\n apply vcg_compat\n apply (sep | find_sep)+\n apply ((auto dest!: list_assn_pure_partD))\n unfolding idxe_map_def\n by (simp add: restrict_map_insert)\n\n\n\n\nunbundle monad_syntax_M \n\n\ndefinition [llvm_inline]: \"llc_for_range l h c s \\ doM {\n (_,s) \\ llc_while (\\(i,s). ll_cmp (i(i,s). doM { \n s\\c i s; \n i \\ ll_add i 1; \n Mreturn (i,s)}\n ) (l,s);\n Mreturn s\n}\"\n\n\nlemma llc_for_range_rule:\n assumes [vcg_rules]:\n \"\\i ii si.\n llvm_htriple \n (\\snat.assn i ii ** \\\\<^sub>d(lo\\i \\ isi. I (i+1) si)\"\n shows \n \"llvm_htriple\n (\\snat.assn lo loi ** \\snat.assn hi hii ** \\(lo\\hi) ** I lo si)\n (llc_for_range loi hii c si)\n (\\si. I hi si)\"\n unfolding llc_for_range_def\n apply (rewrite at 1 to \"signed_nat 1\" signed_nat_def[symmetric])\n apply (rewrite annotate_llc_while[where \n I=\"\\(ii,si) t. EXS i. \\snat.assn i ii ** \\(lo\\i \\ i\\hi) ** \\\\<^sub>!(t=hi-i) ** I i si\" \n and R=\"measure id\"])\n apply vcg_monadify\n apply vcg'\n done\n\n\ndefinition [llvm_code]:\n \"arl_mems_free mem_free arl =\n do {\n len \\ arl_len arl;\n llc_for_range 0 len \n (\\i x.\n do {\n mem \\ arl_nth arl i;\n mem_free mem;\n return 0\n }\n )\n (0::1 word);\n arl_free arl\n }\"\n\n\ndefinition \"loop_inv A xs xsi arl i si \\ arl_elem_assn_ex A xs xsi arl {0.. \\arl_assn xsi arl\"\n unfolding arl_elem_assn_ex_def\n apply isep_assumption\n apply isep_extract_pure\n apply (isep_drule drule: list_assn_free_none)\n apply (auto dest: list_assn_pure_partD)\n done\n\n\n(*\n uint\n unat\n sint\n snat\n*)\n\n\n(*uint \\ unat*)\nlemma \"uint c1 = a1 \\ unat c1 = nat a1\" by auto\n\n(*uint \\ sint*)\nlemma uint_sint_pos: \n \"\\uint c1 = a1; a1 < 2^(word_len c1 - 1)\\ \\ sint c1 = a1\"\n by (simp add: sint_eq_uint_2pl uint_power_lower word_less_def)\n\nlemma uint_sint_neg:\n \"\\uint c1 = a1; a1 \\ 2^(word_len c1 - 1)\\ \\ sint c1 = a1 - 2^(word_len c1)\"\n using word_sint_msb_eq word_size msb_uint_big by (metis (full_types))\n\n(*uint \\ snat*)\nlemma uint_snat_pos:\n \"\\uint c1 = a1; a1 < 2^(word_len c1 - 1)\\ \\ snat c1 = nat a1\"\n by (simp add: snat_eq_unat_aux1 unat_def)\n\nlemma uint_snat_neg:\n \"\\uint c1 = a1; a1 \\ 2^(word_len c1 - 1)\\ \\ snat c1 = 0\"\n unfolding snat_def\n apply (auto simp add: uint_sint_neg)\n using less_le_not_le by blast\n\n\n\n\n(*unat \\ uint*)\nlemma \"unat c1 = a1 \\ uint c1 = int a1\" by auto\n\n(*unat \\ snat*)\nlemma \"\\unat c1 = a1; a1 < 2^(word_len c1 - 1)\\ \\ snat c1 = a1\" using snat_eq_unat by blast \nlemma \"\\unat c1 = a1; a1 \\ 2^(word_len c1 - 1)\\ \\ snat c1 = 0\"\nproof -\n assume \"unat c1 = a1\" \"a1 \\ 2^(word_len c1 - 1)\" \n\n hence \"msb c1\" using msb_unat_big by blast\n hence \"sint c1 < 0\" using word_msb_sint by blast\n\n thus \"snat c1 = 0\" by (simp add: snat_def)\nqed\n\n\n(*unat \\ sint*)\n\n\nlemma \"uint c1 = a1 \\ unat c1 = nat a1\" by auto (*uint \\ unat*)\n\n\n\nlemma \"snat c1 = a1 \\ \\msb c1 \\ sint c1 = int a1\"\n by (simp add: sint_eq_uint snat_eq_unat(2) snat_invar_def uint_nat)\nlemma \"\\snat c1 = a1; msb c1\\ \\ a1 = 0\"\n unfolding snat_def using word_msb_sint by force\n\n\n\nlemma arl_mems_free_rule:\n assumes\n mem_free_rule:\n \"\\el eli.\n llvm_htriple\n (\\A el eli)\n (mem_free eli)\n (\\_. \\)\n \"\n shows\n \"\n llvm_htriple\n (arl_elem_assn_ex A xs xsi arl {})\n (arl_mems_free mem_free arl)\n (\\_. \\)\n \"\n unfolding arl_mems_free_def\n supply llc_for_range_rule[where I=\"loop_inv A xs xsi arl\", vcg_rules]\n apply vcg\n apply vcg_rl\n unfolding loop_inv_def apply vcg_solve (*pre cond*)\n subgoal for asf r sa i ii si (*step*)\n supply mem_free_rule[vcg_rules]\n apply vcg\n apply (simp only: atLeast0_lessThan_Suc)\n apply vcg_solve\n done\n subgoal (*after loop*)\n apply vcg_solve\n unfolding arl_elem_assn_ex_def\n apply vcg\n apply vcg_compat\n apply isep_extract_pure\n apply (isep_drule drule: list_assn_free_none)\n apply (auto dest: list_assn_pure_partD)\n done\n done\n\n \nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Example/Arl_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2974624364249895}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_law_step\nimports CSP_T_traces\nbegin\n\n(*****************************************************************\n\n 1. step laws\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n stop expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_STOP_step: \"STOP =T[M1,M2] ? :{} -> Pf\"\napply (simp add: cspT_semantics)\napply (simp add: traces_iff)\ndone\n\n(* to avoide producing free variables (Pf) in tactics *)\n\nlemma cspT_STOP_step_DIV: \"STOP =T[M1,M2] ? x:{} -> DIV\"\napply (simp add: cspT_semantics)\napply (simp add: traces_iff)\ndone\n\n(*********************************************************\n Act_prefix expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Act_prefix_step: \"a -> P =T[M,M] ? x:{a} -> P\"\napply (simp add: cspT_semantics)\napply (simp add: traces_iff)\ndone\n\n(*********************************************************\n Ext choice expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Ext_choice_step:\n \"(? :X -> Pf) [+] (? :Y -> Qf) =T[M,M]\n ? x:(X Un Y) -> \n (IF (x : X & x : Y) THEN (Pf x |~| Qf x)\n ELSE IF (x : X) THEN Pf x\n ELSE Qf x)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (case_tac \"a : Y\")\n apply (simp_all add: in_traces)\n\n apply (case_tac \"a : X\")\n apply (simp_all add: in_traces)\ndone\n\n(*********************************************************\n Parallel expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Parallel_step: \n \"(? :Y -> Pf) |[X]| (? :Z -> Qf) =T[M,M]\n ? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ? x:Z -> Qf x)\n |~| (? x:Y -> Pf x |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ? x:Z -> Qf x)\n ELSE (? x:Y -> Pf x |[X]| Qf x)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"t\" in spec)\n apply (elim disjE conjE exE)\n\n (* <> *)\n apply (simp)\n\n (* [Tick]t *)\n apply (simp add: in_traces)\n\n (* [Ev .]t *)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n\n (* 1 *)\n apply (simp)\n\n (* 2 *)\n apply (simp add: par_tr_head)\n apply (elim conjE exE)\n apply (case_tac \"a : Y\")\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n (* a ~: Y *)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n\n (* 3 *)\n apply (simp add: par_tr_head)\n apply (elim conjE exE)\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n (* a ~: Z *)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n (* 4 *)\n apply (simp add: par_tr_head)\n apply (elim disjE conjE exE)\n\n (* 4-1 *)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n (* 4-2 *)\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp)\n (* a ~: Z *)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp)\n\n (* 4-3 *)\n apply (simp)\n apply (case_tac \"a : Y\")\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n (* a ~: Y *)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n(* <= *)\n apply (rule)+\n apply (drule_tac x=\"t\" in spec)\n apply (elim disjE conjE exE)\n\n (* <> *)\n apply (simp)\n\n (* [Tick]t *)\n apply (simp add: in_traces)\n\n (* [Ev .]t *)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n\n (* 1 *)\n apply (simp add: in_traces)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* 2 *)\n apply (simp add: in_traces)\n apply (case_tac \"a : Z\")\n apply (simp add: in_traces)\n apply (erule disjE)\n\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (elim conjE exE)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* 3 *)\n apply (simp add: in_traces)\n apply (elim conjE exE)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n apply (case_tac \"a : Y\")\n\n apply (simp add: in_traces)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n (* *)\n apply (elim conjE exE)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n apply (elim conjE exE)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\ndone\n\n(*********************************************************\n Hide expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Hiding_step: \n \"(? :Y -> Pf) -- X =T[M,M]\n IF (Y Int X = {}) THEN (? x:Y -> (Pf x -- X))\n ELSE ((? x:(Y-X) -> (Pf x -- X)) \n [> (! x:(Y Int X) .. (Pf x -- X)))\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n\n apply (case_tac \"Y Int X = {}\")\n apply (simp)\n apply (case_tac \"a : X\", fast)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n\n (* Y Int X ~= {} *)\n apply (simp)\n apply (case_tac \"a : X\")\n apply (simp)\n apply (fast)\n (* a ~: X *)\n apply (simp)\n apply (fast)\n\n (* <= *)\n apply (rule)\n apply (case_tac \"Y Int X = {}\")\n apply (simp add: in_traces)\n apply (erule disjE, simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (elim conjE exE)\n apply (case_tac \"a : X\", fast)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (simp)\n\n (* Y Int X = {} *)\n apply (simp add: in_traces)\n apply (erule disjE, simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (erule disjE)\n (* a~:X *)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (simp)\n (* a:X *)\n apply (erule disjE, simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (elim conjE exE bexE)\n apply (rule_tac x=\" ^^^ s\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n Renaming expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Renaming_step:\n \"(? :X -> Pf) [[r]] =T[M,M]\n ? y:(r `` X) -> (! x:{x. x:X & (x,y):r} .. (Pf x)[[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n (* 1 *)\n apply (simp)\n\n (* 2 *)\n apply (rule disjI2)\n apply (simp add: ren_tr_decompo)\n apply (elim conjE exE)\n apply (rule_tac x=\"b\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp)\n apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (erule disjE, simp)\n apply (elim disjE conjE exE)\n apply (simp add: Image_iff)\n apply (erule bexE)\n apply (rule_tac x=\"\" in exI)\n apply (simp)\n (* *)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n Sequential composition expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Seq_compo_step: \n \"(? :X -> Pf) ;; Q =T[M,M] ? x:X -> (Pf x ;; Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n (* 1 *)\n apply (fast)\n\n (* 2 *)\n apply (insert trace_last_nil_or_unnil)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE, simp)\n apply (elim conjE exE, simp)\n apply (simp add: appt_assoc_sym)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sb ^^^ ta\" in exI)\n apply (simp add: appt_assoc)\n apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (erule disjE, simp)\n apply (rule disjI1)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n apply (elim disjE conjE exE)\n\n (* 1 *)\n apply (rule disjI1)\n apply (rule_tac x=\" ^^^ sa\" in exI, simp)\n\n (* 2 *)\n apply (rule disjI2)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: appt_assoc)\ndone\n\n(*********************************************************\n Depth_rest expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Depth_rest_step:\n \"(? :X -> Pf) |. (Suc n) =T[M,M] ? x:X -> (Pf x |. n)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\ndone\n\n(*********************************************************)\n\nlemmas cspT_step = cspT_STOP_step cspT_Act_prefix_step \n cspT_Ext_choice_step cspT_Parallel_step\n cspT_Hiding_step cspT_Renaming_step\n cspT_Seq_compo_step cspT_Depth_rest_step\n\nlemmas cspT_light_step = cspT_STOP_step cspT_Act_prefix_step \n\nlemmas cspT_step_rw = cspT_STOP_step_DIV cspT_Act_prefix_step \n cspT_Ext_choice_step cspT_Parallel_step\n cspT_Hiding_step cspT_Renaming_step\n cspT_Seq_compo_step cspT_Depth_rest_step\n\nlemmas cspT_light_step_rw = cspT_STOP_step_DIV cspT_Act_prefix_step \n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_step.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6039318479832804, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2972480903613057}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2015-2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Typing_Result.thy\n Author: Andreas Viktor Hess, DTU\n*)\n\nsection \\The Typing Result\\\ntext \\\\label{sec:Typing-Result}\\\n\ntheory Typing_Result\nimports Typed_Model\nbegin\n\nsubsection \\The Typing Result for the Composition-Only Intruder\\\ncontext typed_model\nbegin\n\nsubsubsection \\Well-typedness and Type-Flaw Resistance Preservation\\\ncontext\nbegin\n\nprivate lemma LI_preserves_tfr_stp_all_single:\n assumes \"(S,\\) \\ (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n shows \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\"\nusing assms\nproof (induction rule: LI_rel.induct)\n case (Compose S X f S' \\)\n hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" by simp_all\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (map Send X)\" by (induct X) auto\n ultimately show ?case by simp\nnext\n case (Unify S f Y \\ X S' \\)\n hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\" by simp\n\n have \"fv\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S') \\ bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n using Unify.prems(1) by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n moreover have \"fv (Fun f X) \\ fv\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S')\" by auto\n moreover have \"fv (Fun f Y) \\ fv\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S')\"\n using Unify.hyps(2) fv_subset_if_in_strand_ik'[of \"Fun f Y\" S] by force\n ultimately have bvars_disj:\n \"bvars\\<^sub>s\\<^sub>t (S@S') \\ fv (Fun f X) = {}\" \"bvars\\<^sub>s\\<^sub>t (S@S') \\ fv (Fun f Y) = {}\"\n by blast+\n\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" using Unify.prems(5) by simp\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\"\n proof -\n obtain x where \"x \\ set S\" \"Fun f Y \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\"\n using Unify.hyps(2) Unify.prems(5) by force+\n thus ?thesis using wf_trm_subterm by auto\n qed\n moreover have\n \"Fun f X \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\" \"Fun f Y \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n using SMP_append[of S \"Send (Fun f X)#S'\"] SMP_Cons[of \"Send (Fun f X)\" S']\n SMP_ikI[OF Unify.hyps(2)]\n by auto\n hence \"\\ (Fun f X) = \\ (Fun f Y)\"\n using Unify.prems(4) mgu_gives_MGU[OF Unify.hyps(3)[symmetric]]\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric]] by metis\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\]\n by (metis wf_trm_subst_range_iff)\n moreover have \"bvars\\<^sub>s\\<^sub>t (S@S') \\ range_vars \\ = {}\"\n using mgu_vars_bounded[OF Unify.hyps(3)[symmetric]] bvars_disj by fast\n ultimately show ?case using tfr_stp_all_wt_subst_apply[OF \\list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\\] by metis\nnext\n case (Equality S \\ t t' a S' \\)\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\" \"\\ t = \\ t'\"\n using tfr_stp_all_same_type[of S a t t' S']\n tfr_stp_all_split(5)[of S _ S']\n MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n Equality.prems(3)\n by blast+\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" using Equality.prems(5) by auto\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric]]\n by metis\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\]\n by (metis wf_trm_subst_range_iff)\n moreover have \"fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S') \\ bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S') = {}\"\n using Equality.prems(1) by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n hence \"bvars\\<^sub>s\\<^sub>t (S@S') \\ fv t = {}\" \"bvars\\<^sub>s\\<^sub>t (S@S') \\ fv t' = {}\" by auto\n hence \"bvars\\<^sub>s\\<^sub>t (S@S') \\ range_vars \\ = {}\"\n using mgu_vars_bounded[OF Equality.hyps(2)[symmetric]] by fast\n ultimately show ?case using tfr_stp_all_wt_subst_apply[OF \\list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\\] by metis\nqed\n\nprivate lemma LI_in_SMP_subset_single:\n assumes \"(S,\\) \\ (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n and \"trms\\<^sub>s\\<^sub>t S \\ SMP M\"\n shows \"trms\\<^sub>s\\<^sub>t S' \\ SMP M\"\nusing assms\nproof (induction rule: LI_rel.induct)\n case (Compose S X f S' \\)\n hence \"SMP (trms\\<^sub>s\\<^sub>t [Send (Fun f X)]) \\ SMP M\"\n proof -\n have \"SMP (trms\\<^sub>s\\<^sub>t [Send (Fun f X)]) \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n using trms\\<^sub>s\\<^sub>t_append SMP_mono by auto\n thus ?thesis\n using SMP_union[of \"trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S')\" M]\n SMP_subset_union_eq[OF Compose.prems(6)]\n by auto\n qed\n thus ?case using Compose.prems(6) by auto\nnext\n case (Unify S f Y \\ X S' \\)\n have \"Fun f X \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\" by auto\n moreover have \"MGU \\ (Fun f X) (Fun f Y)\"\n by (metis mgu_gives_MGU[OF Unify.hyps(3)[symmetric]])\n moreover have\n \"\\x. x \\ set S \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\"\n using Unify.prems(4) by force+\n moreover have \"Fun f Y \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n by (meson SMP_ikI Unify.hyps(2) contra_subsetD ik_append_subset(1))\n ultimately have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\" \"\\ (Fun f X) = \\ (Fun f Y)\"\n using ik\\<^sub>s\\<^sub>t_subterm_exD[OF \\Fun f Y \\ ik\\<^sub>s\\<^sub>t S\\] \\tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\\\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (metis (full_types) SMP_wf_trm Unify.prems(4), blast)\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" by (metis mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\])\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\] by simp\n ultimately have \"trms\\<^sub>s\\<^sub>t ((S@Send (Fun f X)#S') \\\\<^sub>s\\<^sub>t \\) \\ SMP M\"\n using SMP.Substitution Unify.prems(6) wt_subst_SMP_subset by metis\n thus ?case by auto\nnext\n case (Equality S \\ t t' a S' \\)\n hence \"\\ t = \\ t'\"\n using tfr_stp_all_same_type MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n by metis\n moreover have \"t \\ SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\" \"t' \\ SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n using Equality.prems(1) by auto\n moreover have \"MGU \\ t t'\" using mgu_gives_MGU[OF Equality.hyps(2)[symmetric]] by metis\n moreover have \"\\x. x \\ set S \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\"\n using Equality.prems(4) by force+\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" by (metis mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\])\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\] by simp\n ultimately have \"trms\\<^sub>s\\<^sub>t ((S@Equality a t t'#S') \\\\<^sub>s\\<^sub>t \\) \\ SMP M\"\n using SMP.Substitution Equality.prems wt_subst_SMP_subset by metis\n thus ?case by auto\nqed\n\nprivate lemma LI_preserves_tfr_single:\n assumes \"(S,\\) \\ (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S') \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\"\nusing assms\nproof (induction rule: LI_rel.induct)\n case (Compose S X f S' \\)\n let ?SMPmap = \"SMP (trms\\<^sub>s\\<^sub>t (S@map Send X@S')) - (Var`\\)\"\n have \"?SMPmap \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S')) - (Var`\\)\"\n using SMP_fun_map_snd_subset[of X f]\n SMP_append[of \"map Send X\" S'] SMP_Cons[of \"Send (Fun f X)\" S']\n SMP_append[of S \"Send (Fun f X)#S'\"] SMP_append[of S \"map Send X@S'\"]\n by auto\n hence \"\\s \\ ?SMPmap. \\t \\ ?SMPmap. (\\\\. Unifier \\ s t) \\ \\ s = \\ t\"\n using Compose unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson subsetCE)\n thus ?case\n using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Compose[OF Compose.hyps]], of S']\n Compose.prems(5)\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nnext\n case (Unify S f Y \\ X S' \\)\n let ?SMP\\ = \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\)) - (Var`\\)\"\n\n have \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\)) \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n proof\n fix s assume \"s \\ SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\))\" thus \"s \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n using LI_in_SMP_subset_single[\n OF LI_rel.Unify[OF Unify.hyps] Unify.prems(1,2,4,5,6)\n MP_subset_SMP(2)[of \"S@Send (Fun f X)#S'\"]]\n by (metis SMP_union SMP_subset_union_eq Un_iff)\n qed\n hence \"\\s \\ ?SMP\\. \\t \\ ?SMP\\. (\\\\. Unifier \\ s t) \\ \\ s = \\ t\"\n using Unify.prems(4) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson Diff_iff subsetCE)\n thus ?case\n using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Unify[OF Unify.hyps]], of S']\n Unify.prems(5)\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nnext\n case (Equality S \\ t t' a S' \\)\n let ?SMP\\ = \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\)) - (Var`\\)\"\n\n have \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\)) \\ SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n proof\n fix s assume \"s \\ SMP (trms\\<^sub>s\\<^sub>t (S@S' \\\\<^sub>s\\<^sub>t \\))\" thus \"s \\ SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n using LI_in_SMP_subset_single[\n OF LI_rel.Equality[OF Equality.hyps] Equality.prems(1,2,4,5,6)\n MP_subset_SMP(2)[of \"S@Equality a t t'#S'\"]]\n by (metis SMP_union SMP_subset_union_eq Un_iff)\n qed\n hence \"\\s \\ ?SMP\\. \\t \\ ?SMP\\. (\\\\. Unifier \\ s t) \\ \\ s = \\ t\"\n using Equality.prems unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson Diff_iff subsetCE)\n thus ?case\n using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Equality[OF Equality.hyps]], of _ S']\n Equality.prems\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nqed\n\nprivate lemma LI_preserves_welltypedness_single:\n assumes \"(S,\\) \\ (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\' \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\')\"\nusing assms\nproof (induction rule: LI_rel.induct)\n case (Unify S f Y \\ X S' \\)\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" using Unify.prems(5) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by simp\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\"\n proof -\n obtain x where \"x \\ set S\" \"Fun f Y \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\"\n using Unify.hyps(2) Unify.prems(5) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by force\n thus ?thesis using wf_trm_subterm by auto\n qed\n moreover have\n \"Fun f X \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\" \"Fun f Y \\ SMP (trms\\<^sub>s\\<^sub>t (S@Send (Fun f X)#S'))\"\n using SMP_append[of S \"Send (Fun f X)#S'\"] SMP_Cons[of \"Send (Fun f X)\" S']\n SMP_ikI[OF Unify.hyps(2)]\n by auto\n hence \"\\ (Fun f X) = \\ (Fun f Y)\"\n using Unify.prems(4) mgu_gives_MGU[OF Unify.hyps(3)[symmetric]]\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric]] by metis\n\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (meson mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\]\n wf_trm_subst_range_iff)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\"\n using wf_trm_subst_range_iff wf_trm_subst \\wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\\\n unfolding subst_compose_def\n by (metis (no_types, lifting))\n thus ?case by (metis wt_subst_compose[OF \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\])\nnext\n case (Equality S \\ t t' a S' \\)\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" using Equality.prems(5) by simp_all\n moreover have \"\\ t = \\ t'\"\n using \\list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@Equality a t t'#S')\\\n MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n by auto\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric]] by metis\n\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (meson mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\] wf_trm_subst_range_iff)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\"\n using wf_trm_subst_range_iff wf_trm_subst \\wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\\\n unfolding subst_compose_def\n by (metis (no_types, lifting))\n thus ?case by (metis wt_subst_compose[OF \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\])\nqed metis\n\nlemma LI_preserves_welltypedness:\n assumes \"(S,\\) \\\\<^sup>* (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\'\" (is \"?A \\'\")\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\')\" (is \"?B \\'\")\nproof -\n have \"?A \\' \\ ?B \\'\" using assms\n proof (induction S \\ rule: converse_rtrancl_induct2)\n case (step S1 \\1 S2 \\2)\n hence \"?A \\2 \\ ?B \\2\" using LI_preserves_welltypedness_single by presburger\n moreover have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S2 \\2\"\n by (fact LI_preserves_wellformedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems(1)])\n moreover have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S2)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S2)\"\n using LI_preserves_tfr_single[OF step.hyps(1)] step.prems by presburger+\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S2\"\n using LI_preserves_tfr_stp_all_single[OF step.hyps(1)] step.prems by fastforce\n ultimately show ?case using step.IH by presburger\n qed simp\n thus \"?A \\'\" \"?B \\'\" by simp_all\nqed\n\nlemma LI_preserves_tfr:\n assumes \"(S,\\) \\\\<^sup>* (S',\\')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S')\" (is \"?A S'\")\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\" (is \"?B S'\")\n and \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" (is \"?C S'\")\nproof -\n have \"?A S' \\ ?B S' \\ ?C S'\" using assms\n proof (induction S \\ rule: converse_rtrancl_induct2)\n case (step S1 \\1 S2 \\2)\n have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S2 \\2\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S2)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S2)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S2\"\n using LI_preserves_wellformedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems(1)]\n LI_preserves_tfr_single[OF step.hyps(1) step.prems(1,2)]\n LI_preserves_tfr_stp_all_single[OF step.hyps(1) step.prems(1,2)]\n step.prems(3,4,5,6)\n by metis+\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\2\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\2)\"\n using LI_preserves_welltypedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems]\n by simp_all\n ultimately show ?case using step.IH by presburger\n qed blast\n thus \"?A S'\" \"?B S'\" \"?C S'\" by simp_all\nqed\nend\n\nsubsubsection \\Simple Constraints are Well-typed Satisfiable\\\ntext \\Proving the existence of a well-typed interpretation\\\ncontext\nbegin\nlemma wt_interpretation_exists:\n obtains \\::\"('fun,'var) subst\"\n where \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"subst_range \\ \\ public_ground_wf_terms\"\nproof\n define \\ where \"\\ = (\\x. (SOME t. \\ (Var x) = \\ t \\ public_ground_wf_term t))\"\n\n { fix x t assume \"\\ x = t\"\n hence \"\\ (Var x) = \\ t \\ public_ground_wf_term t\"\n using someI_ex[of \"\\t. \\ (Var x) = \\ t \\ public_ground_wf_term t\",\n OF type_pgwt_inhabited[of \"Var x\"]]\n unfolding \\_def wf\\<^sub>t\\<^sub>r\\<^sub>m_def by simp\n } hence props: \"\\ v = t \\ \\ (Var v) = \\ t \\ public_ground_wf_term t\" for v t by metis\n\n have \"\\ v \\ Var v\" for v using props pgwt_ground by (simp add: empty_fv_not_var)\n hence \"subst_domain \\ = UNIV\" by auto\n moreover have \"ground (subst_range \\)\" by (simp add: props pgwt_ground)\n ultimately show \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" by metis\n show \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def using props by simp\n show \"subst_range \\ \\ public_ground_wf_terms\" by (auto simp add: props)\nqed\n\nlemma wt_grounding_subst_exists:\n \"\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}\"\nproof -\n obtain \\ where \\: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"subst_range \\ \\ public_ground_wf_terms\"\n using wt_interpretation_exists by blast\n show ?thesis using pgwt_wellformed interpretation_grounds[OF \\(1)] \\(2,3) by blast\nqed\n\nprivate fun fresh_pgwt::\"'fun set \\ ('fun,'atom) term_type \\ ('fun,'var) term\" where\n \"fresh_pgwt S (TAtom a) =\n Fun (SOME c. c \\ S \\ \\ (Fun c []) = TAtom a \\ public c) []\"\n| \"fresh_pgwt S (TComp f T) = Fun f (map (fresh_pgwt S) T)\"\n\nprivate lemma fresh_pgwt_same_type:\n assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"\\ (fresh_pgwt S (\\ t)) = \\ t\"\nproof -\n let ?P = \"\\\\::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\ \\ (\\f T. TComp f T \\ \\ \\ 0 < arity f)\"\n { fix \\ assume \"?P \\\" hence \"\\ (fresh_pgwt S \\) = \\\"\n proof (induction \\)\n case (Var a)\n let ?P = \"\\c. c \\ S \\ \\ (Fun c []) = Var a \\ public c\"\n let ?Q = \"\\c. \\ (Fun c []) = Var a \\ public c\"\n have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n hence \"infinite {c. ?P c}\"\n using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]]\n by metis\n hence \"\\c. ?P c\" using not_finite_existsD by blast\n thus ?case using someI_ex[of ?P] by auto\n next\n case (Fun f T)\n have f: \"0 < arity f\" using Fun.prems fun_type_inv by auto\n have \"\\t. t \\ set T \\ ?P t\"\n using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n by metis\n hence \"\\t. t \\ set T \\ \\ (fresh_pgwt S t) = t\" using Fun.prems Fun.IH by auto\n hence \"map \\ (map (fresh_pgwt S) T) = T\" by (induct T) auto\n thus ?case using fun_type[OF f] by simp\n qed\n } thus ?thesis using assms(1) \\_wf'[OF assms(2)] \\_wf(1) by auto\nqed\n\nprivate lemma fresh_pgwt_empty_synth:\n assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"{} \\\\<^sub>c fresh_pgwt S (\\ t)\"\nproof -\n let ?P = \"\\\\::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\ \\ (\\f T. TComp f T \\ \\ \\ 0 < arity f)\"\n { fix \\ assume \"?P \\\" hence \"{} \\\\<^sub>c fresh_pgwt S \\\"\n proof (induction \\)\n case (Var a)\n let ?P = \"\\c. c \\ S \\ \\ (Fun c []) = Var a \\ public c\"\n let ?Q = \"\\c. \\ (Fun c []) = Var a \\ public c\"\n have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n hence \"infinite {c. ?P c}\"\n using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]]\n by metis\n hence \"\\c. ?P c\" using not_finite_existsD by blast\n thus ?case\n using someI_ex[of ?P] intruder_synth.ComposeC[of \"[]\" _ \"{}\"] const_type_inv\n by auto\n next\n case (Fun f T)\n have f: \"0 < arity f\" \"length T = arity f\" \"public f\"\n using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n have \"\\t. t \\ set T \\ ?P t\"\n using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n by metis\n hence \"\\t. t \\ set T \\ {} \\\\<^sub>c fresh_pgwt S t\" using Fun.prems Fun.IH by auto\n moreover have \"length (map (fresh_pgwt S) T) = arity f\" using f(2) by auto\n ultimately show ?case using intruder_synth.ComposeC[of \"map (fresh_pgwt S) T\" f] f by auto\n qed\n } thus ?thesis using assms(1) \\_wf'[OF assms(2)] \\_wf(1) by auto\nqed\n\nprivate lemma fresh_pgwt_has_fresh_const:\n assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n obtains c where \"Fun c [] \\ fresh_pgwt S (\\ t)\" \"c \\ S\"\nproof -\n let ?P = \"\\\\::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\ \\ (\\f T. TComp f T \\ \\ \\ 0 < arity f)\"\n { fix \\ assume \"?P \\\" hence \"\\c. Fun c [] \\ fresh_pgwt S \\ \\ c \\ S\"\n proof (induction \\)\n case (Var a)\n let ?P = \"\\c. c \\ S \\ \\ (Fun c []) = Var a \\ public c\"\n let ?Q = \"\\c. \\ (Fun c []) = Var a \\ public c\"\n have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n hence \"infinite {c. ?P c}\"\n using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]]\n by metis\n hence \"\\c. ?P c\" using not_finite_existsD by blast\n thus ?case using someI_ex[of ?P] by auto\n next\n case (Fun f T)\n have f: \"0 < arity f\" \"length T = arity f\" \"public f\" \"T \\ []\"\n using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n obtain t' where t': \"t' \\ set T\" by (meson all_not_in_conv f(4) set_empty)\n have \"\\t. t \\ set T \\ ?P t\"\n using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n by metis\n hence \"\\t. t \\ set T \\ \\c. Fun c [] \\ fresh_pgwt S t \\ c \\ S\"\n using Fun.prems Fun.IH by auto\n then obtain c where c: \"Fun c [] \\ fresh_pgwt S t'\" \"c \\ S\" using t' by metis\n thus ?case using t' by auto\n qed\n } thus ?thesis using that assms \\_wf'[OF assms(2)] \\_wf(1) by blast\nqed\n\nprivate lemma fresh_pgwt_subterm_fresh:\n assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"funs_term s \\ S\"\n shows \"s \\ subterms (fresh_pgwt S (\\ t))\"\nproof -\n let ?P = \"\\\\::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\ \\ (\\f T. TComp f T \\ \\ \\ 0 < arity f)\"\n { fix \\ assume \"?P \\\" hence \"s \\ subterms (fresh_pgwt S \\)\"\n proof (induction \\)\n case (Var a)\n let ?P = \"\\c. c \\ S \\ \\ (Fun c []) = Var a \\ public c\"\n let ?Q = \"\\c. \\ (Fun c []) = Var a \\ public c\"\n have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n hence \"infinite {c. ?P c}\"\n using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]]\n by metis\n hence \"\\c. ?P c\" using not_finite_existsD by blast\n thus ?case using someI_ex[of ?P] assms(4) by auto\n next\n case (Fun f T)\n have f: \"0 < arity f\" \"length T = arity f\" \"public f\"\n using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n have \"\\t. t \\ set T \\ ?P t\"\n using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n by metis\n hence \"\\t. t \\ set T \\ s \\ subterms (fresh_pgwt S t)\" using Fun.prems Fun.IH by auto\n moreover have \"s \\ fresh_pgwt S (Fun f T)\"\n proof -\n obtain c where c: \"Fun c [] \\ fresh_pgwt S (Fun f T)\" \"c \\ S\"\n using fresh_pgwt_has_fresh_const[OF assms(1)] type_wfttype_inhabited Fun.prems\n by metis\n hence \"\\Fun c [] \\ s\" using assms(4) subtermeq_imp_funs_term_subset by force\n thus ?thesis using c(1) by auto\n qed\n ultimately show ?case by auto\n qed\n } thus ?thesis using assms(1) \\_wf'[OF assms(2)] \\_wf(1) by auto\nqed\n\nprivate lemma wt_fresh_pgwt_term_exists:\n assumes \"finite T\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s T\"\n obtains t where \"\\ t = \\ s\" \"{} \\\\<^sub>c t\" \"\\s \\ T. \\u \\ subterms s. u \\ subterms t\"\nproof -\n have finite_S: \"finite (\\(funs_term ` T))\" using assms(1) by auto\n\n have 1: \"\\ (fresh_pgwt (\\(funs_term ` T)) (\\ s)) = \\ s\"\n using fresh_pgwt_same_type[OF finite_S assms(2)] by auto\n\n have 2: \"{} \\\\<^sub>c fresh_pgwt (\\(funs_term ` T)) (\\ s)\"\n using fresh_pgwt_empty_synth[OF finite_S assms(2)] by auto\n\n have 3: \"\\v \\ T. \\u \\ subterms v. u \\ subterms (fresh_pgwt (\\(funs_term ` T)) (\\ s))\"\n using fresh_pgwt_subterm_fresh[OF finite_S assms(2)] assms(3)\n wf_trm_subtermeq subtermeq_imp_funs_term_subset\n by force\n\n show ?thesis by (rule that[OF 1 2 3])\nqed\n\nlemma wt_bij_finite_subst_exists:\n assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s T\"\n shows \"\\\\::('fun,'var) subst.\n subst_domain \\ = S\n \\ bij_betw \\ (subst_domain \\) (subst_range \\)\n \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ {t. {} \\\\<^sub>c t} - T\n \\ (\\s \\ subst_range \\. \\u \\ subst_range \\. (\\v. v \\ s \\ v \\ u) \\ s = u)\n \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\n \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nusing assms\nproof (induction rule: finite_induct)\n case empty\n have \"subst_domain Var = {}\"\n \"bij_betw Var (subst_domain Var) (subst_range Var)\"\n \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range Var) \\ {t. {} \\\\<^sub>c t} - T\"\n \"\\s \\ subst_range Var. \\u \\ subst_range Var. (\\v. v \\ s \\ v \\ u) \\ s = u\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\"\n unfolding bij_betw_def\n by auto\n thus ?case by (force simp add: subst_domain_def)\nnext\n case (insert x S)\n then obtain \\ where \\:\n \"subst_domain \\ = S\" \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ {t. {} \\\\<^sub>c t} - T\"\n \"\\s \\ subst_range \\. \\u \\ subst_range \\. (\\v. v \\ s \\ v \\ u) \\ s = u\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (auto simp del: subst_range.simps)\n\n have *: \"finite (T \\ subst_range \\)\"\n using insert.prems(1) insert.hyps(1) \\(1) by simp\n have **: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Var x)\" by simp\n have ***: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (T \\ subst_range \\)\" using assms(3) \\(6) by blast\n obtain t where t:\n \"\\ t = \\ (Var x)\" \"{} \\\\<^sub>c t\"\n \"\\s \\ T \\ subst_range \\. \\u \\ subterms s. u \\ subterms t\"\n using wt_fresh_pgwt_term_exists[OF * ** ***] by auto\n\n obtain \\ where \\: \"\\ \\ \\y. if x = y then t else \\ y\" by simp\n\n have t_ground: \"fv t = {}\" using t(2) pgwt_ground[of t] pgwt_is_empty_synth[of t] by auto\n hence x_dom: \"x \\ subst_domain \\\" \"x \\ subst_domain \\\" using insert.hyps(2) \\(1) \\ by auto\n moreover have \"subst_range \\ \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\)\" by auto\n hence ground_imgs: \"ground (subst_range \\)\"\n using \\(3) pgwt_ground pgwt_is_empty_synth\n by force\n ultimately have x_img: \"\\ x \\ subst_range \\\"\n using ground_subst_dom_iff_img\n by (auto simp add: subst_domain_def)\n\n have \"ground (insert t (subst_range \\))\"\n using ground_imgs x_dom t_ground\n by auto\n have \\_dom: \"subst_domain \\ = insert x (subst_domain \\)\"\n using \\ t_ground by (auto simp add: subst_domain_def)\n have \\_img: \"subst_range \\ = insert t (subst_range \\)\"\n proof\n show \"subst_range \\ \\ insert t (subst_range \\)\"\n proof\n fix t' assume \"t' \\ subst_range \\\"\n then obtain y where \"y \\ subst_domain \\\" \"t' = \\ y\" by auto\n thus \"t' \\ insert t (subst_range \\)\" using \\ by (auto simp add: subst_domain_def)\n qed\n show \"insert t (subst_range \\) \\ subst_range \\\"\n proof\n fix t' assume t': \"t' \\ insert t (subst_range \\)\"\n hence \"fv t' = {}\" using ground_imgs x_img t_ground by auto\n hence \"t' \\ Var x\" by auto\n show \"t' \\ subst_range \\\"\n proof (cases \"t' = t\")\n case False\n hence \"t' \\ subst_range \\\" using t' by auto\n then obtain y where \"\\ y \\ subst_range \\\" \"t' = \\ y\" by auto\n hence \"y \\ subst_domain \\\" \"t' \\ Var y\"\n using ground_subst_dom_iff_img[OF ground_imgs(1)]\n by (auto simp add: subst_domain_def simp del: subst_range.simps)\n hence \"x \\ y\" using x_dom by auto\n hence \"\\ y = \\ y\" unfolding \\ by auto\n thus ?thesis using \\t' \\ Var y\\ \\t' = \\ y\\ subst_imgI[of \\ y] by auto\n qed (metis subst_imgI \\ \\t' \\ Var x\\)\n qed\n qed\n hence \\_ground_img: \"ground (subst_range \\)\"\n using ground_imgs t_ground\n by auto\n\n have \"subst_domain \\ = insert x S\" using \\_dom \\(1) by auto\n moreover have \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n proof (intro bij_betwI')\n fix y z assume *: \"y \\ subst_domain \\\" \"z \\ subst_domain \\\"\n hence \"fv (\\ y) = {}\" \"fv (\\ z) = {}\" using \\_ground_img by auto\n { assume \"\\ y = \\ z\" hence \"y = z\"\n proof (cases \"\\ y \\ subst_range \\ \\ \\ z \\ subst_range \\\")\n case True\n hence **: \"y \\ subst_domain \\\" \"z \\ subst_domain \\\"\n using \\ \\_dom True * t(3) by (metis Un_iff term.order_refl insertE)+\n hence \"y \\ x\" \"z \\ x\" using x_dom by auto\n hence \"\\ y = \\ y\" \"\\ z = \\ z\" using \\ by auto\n thus ?thesis using \\\\ y = \\ z\\ \\(2) ** unfolding bij_betw_def inj_on_def by auto\n qed (metis \\ * \\\\ y = \\ z\\ \\_dom ground_imgs(1) ground_subst_dom_iff_img insertE)\n }\n thus \"(\\ y = \\ z) = (y = z)\" by auto\n next\n fix y assume \"y \\ subst_domain \\\" thus \"\\ y \\ subst_range \\\" by auto\n next\n fix t assume \"t \\ subst_range \\\" thus \"\\z \\ subst_domain \\. t = \\ z\" by auto\n qed\n moreover have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ {t. {} \\\\<^sub>c t} - T\"\n proof -\n { fix s assume \"s \\ t\"\n hence \"s \\ {t. {} \\\\<^sub>c t} - T\"\n using t(2,3)\n by (metis Diff_eq_empty_iff Diff_iff Un_upper1 term.order_refl\n deduct_synth_subterm mem_Collect_eq)\n } thus ?thesis using \\(3) \\ \\_img by auto\n qed\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using \\ t(1) \\(5) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using \\ \\(6) t(2) pgwt_is_empty_synth pgwt_wellformed\n wf_trm_subst_range_iff[of \\] wf_trm_subst_range_iff[of \\]\n by metis\n moreover have \"\\s\\subst_range \\. \\u\\subst_range \\. (\\v. v \\ s \\ v \\ u) \\ s = u\"\n using \\(4) \\_img t(3) by (auto simp del: subst_range.simps)\n ultimately show ?case by blast\nqed\n\nprivate lemma wt_bij_finite_tatom_subst_exists_single:\n assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\"\n and \"\\x. x \\ S \\ \\ (Var x) = TAtom a\"\n shows \"\\\\::('fun,'var) subst. subst_domain \\ = S\n \\ bij_betw \\ (subst_domain \\) (subst_range \\)\n \\ subst_range \\ \\ ((\\c. Fun c []) ` {c. \\ (Fun c []) = TAtom a \\\n public c \\ arity c = 0}) - T\n \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\n \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nproof -\n let ?U = \"{c. \\ (Fun c []) = TAtom a \\ public c \\ arity c = 0}\"\n\n obtain \\ where \\:\n \"subst_domain \\ = S\" \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n \"subst_range \\ \\ ((\\c. Fun c []) ` ?U) - T\"\n using bij_finite_const_subst_exists'[OF assms(1,2) infinite_typed_consts'[of a]]\n by auto\n\n { fix x assume \"x \\ subst_domain \\\" hence \"\\ (Var x) = \\ (\\ x)\" by auto }\n moreover\n { fix x assume \"x \\ subst_domain \\\"\n hence \"\\c \\ ?U. \\ x = Fun c [] \\ arity c = 0\" using \\ by auto\n hence \"\\ (\\ x) = TAtom a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" using assms(3) const_type wf_trmI[of \"[]\"] by auto\n hence \"\\ (Var x) = \\ (\\ x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" using assms(3) \\(1) by force+\n }\n ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using wf_trm_subst_range_iff[of \\]\n unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def\n by force+\n thus ?thesis using \\ by auto\nqed\n\nlemma wt_bij_finite_tatom_subst_exists:\n assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\"\n and \"\\x. x \\ S \\ \\a. \\ (Var x) = TAtom a\"\n shows \"\\\\::('fun,'var) subst. subst_domain \\ = S\n \\ bij_betw \\ (subst_domain \\) (subst_range \\)\n \\ subst_range \\ \\ ((\\c. Fun c []) ` \\\\<^sub>p\\<^sub>u\\<^sub>b) - T\n \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\n \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nusing assms\nproof (induction rule: finite_induct)\n case empty\n have \"subst_domain Var = {}\"\n \"bij_betw Var (subst_domain Var) (subst_range Var)\"\n \"subst_range Var \\ ((\\c. Fun c []) ` \\\\<^sub>p\\<^sub>u\\<^sub>b) - T\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\"\n unfolding bij_betw_def\n by auto\n thus ?case by (auto simp add: subst_domain_def)\nnext\n case (insert x S)\n then obtain a where a: \"\\ (Var x) = TAtom a\" by fastforce\n\n from insert obtain \\ where \\:\n \"subst_domain \\ = S\" \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n \"subst_range \\ \\ ((\\c. Fun c []) ` \\\\<^sub>p\\<^sub>u\\<^sub>b) - T\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by auto\n\n let ?S' = \"{y \\ S. \\ (Var y) = TAtom a}\"\n let ?T' = \"T \\ subst_range \\\"\n\n have *: \"finite (insert x ?S')\" using insert by simp\n have **: \"finite ?T'\" using insert.prems(1) insert.hyps(1) \\(1) by simp\n have ***: \"\\y. y \\ insert x ?S' \\ \\ (Var y) = TAtom a\" using a by auto\n\n obtain \\ where \\:\n \"subst_domain \\ = insert x ?S'\" \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n \"subst_range \\ \\ ((\\c. Fun c []) ` \\\\<^sub>p\\<^sub>u\\<^sub>b) - ?T'\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using wt_bij_finite_tatom_subst_exists_single[OF * ** ***] const_type_inv[of _ \"[]\" a]\n by blast\n\n obtain \\ where \\: \"\\ \\ \\y. if x = y then \\ y else \\ y\" by simp\n\n have x_dom: \"x \\ subst_domain \\\" \"x \\ subst_domain \\\" \"x \\ subst_domain \\\"\n using insert.hyps(2) \\(1) \\(1) \\ by (auto simp add: subst_domain_def)\n moreover have ground_imgs: \"ground (subst_range \\)\" \"ground (subst_range \\)\"\n using pgwt_ground \\(3) \\(3) by auto\n ultimately have x_img: \"\\ x \\ subst_range \\\" \"\\ x \\ subst_range \\\"\n using ground_subst_dom_iff_img by (auto simp add: subst_domain_def)\n\n have \"ground (insert (\\ x) (subst_range \\))\" using ground_imgs x_dom by auto\n have \\_dom: \"subst_domain \\ = insert x (subst_domain \\)\"\n using \\(1) \\ by (auto simp add: subst_domain_def)\n have \\_img: \"subst_range \\ = insert (\\ x) (subst_range \\)\"\n proof\n show \"subst_range \\ \\ insert (\\ x) (subst_range \\)\"\n proof\n fix t assume \"t \\ subst_range \\\"\n then obtain y where \"y \\ subst_domain \\\" \"t = \\ y\" by auto\n thus \"t \\ insert (\\ x) (subst_range \\)\" using \\ by (auto simp add: subst_domain_def)\n qed\n show \"insert (\\ x) (subst_range \\) \\ subst_range \\\"\n proof\n fix t assume t: \"t \\ insert (\\ x) (subst_range \\)\"\n hence \"fv t = {}\" using ground_imgs x_img(2) by auto\n hence \"t \\ Var x\" by auto\n show \"t \\ subst_range \\\"\n proof (cases \"t = \\ x\")\n case True thus ?thesis using subst_imgI \\ \\t \\ Var x\\ by metis\n next\n case False\n hence \"t \\ subst_range \\\" using t by auto\n then obtain y where \"\\ y \\ subst_range \\\" \"t = \\ y\" by auto\n hence \"y \\ subst_domain \\\" \"t \\ Var y\"\n using ground_subst_dom_iff_img[OF ground_imgs(1)]\n by (auto simp add: subst_domain_def simp del: subst_range.simps)\n hence \"x \\ y\" using x_dom by auto\n hence \"\\ y = \\ y\" unfolding \\ by auto\n thus ?thesis using \\t \\ Var y\\ \\t = \\ y\\ subst_imgI[of \\ y] by auto\n qed\n qed\n qed\n hence \\_ground_img: \"ground (subst_range \\)\" using ground_imgs x_img by auto\n\n have \"subst_domain \\ = insert x S\" using \\_dom \\(1) by auto\n moreover have \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n proof (intro bij_betwI')\n fix y z assume *: \"y \\ subst_domain \\\" \"z \\ subst_domain \\\"\n hence \"fv (\\ y) = {}\" \"fv (\\ z) = {}\" using \\_ground_img by auto\n { assume \"\\ y = \\ z\" hence \"y = z\"\n proof (cases \"\\ y \\ subst_range \\ \\ \\ z \\ subst_range \\\")\n case True\n hence **: \"y \\ subst_domain \\\" \"z \\ subst_domain \\\"\n using \\ \\_dom x_img(2) \\(3) True\n by (metis (no_types) *(1) DiffE Un_upper2 insertE subsetCE,\n metis (no_types) *(2) DiffE Un_upper2 insertE subsetCE)\n hence \"y \\ x\" \"z \\ x\" using x_dom by auto\n hence \"\\ y = \\ y\" \"\\ z = \\ z\" using \\ by auto\n thus ?thesis using \\\\ y = \\ z\\ \\(2) ** unfolding bij_betw_def inj_on_def by auto\n qed (metis \\ * \\\\ y = \\ z\\ \\_dom ground_imgs(1) ground_subst_dom_iff_img insertE)\n }\n thus \"(\\ y = \\ z) = (y = z)\" by auto\n next\n fix y assume \"y \\ subst_domain \\\" thus \"\\ y \\ subst_range \\\" by auto\n next\n fix t assume \"t \\ subst_range \\\" thus \"\\z \\ subst_domain \\. t = \\ z\" by auto\n qed\n moreover have \"subst_range \\ \\ (\\c. Fun c []) ` \\\\<^sub>p\\<^sub>u\\<^sub>b - T\"\n using \\(3) \\(3) \\ by (auto simp add: subst_domain_def)\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using \\(4) \\(4) \\ unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using \\ \\(5) \\(5) wf_trm_subst_range_iff[of \\]\n wf_trm_subst_range_iff[of \\] wf_trm_subst_range_iff[of \\]\n by presburger\n ultimately show ?case by blast\nqed\n\ntheorem wt_sat_if_simple:\n assumes \"simple S\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n and \\': \"\\X F. Inequality X F \\ set S \\ ineq_model \\' X F\"\n \"ground (subst_range \\')\"\n \"subst_domain \\' = {x \\ vars\\<^sub>s\\<^sub>t S. \\X F. Inequality X F \\ set S \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X}\"\n and tfr_stp_all: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"\\\\. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ (\\ \\\\<^sub>c \\S, \\\\) \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nproof -\n from \\wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\\ have \"wf\\<^sub>s\\<^sub>t {} S\" \"subst_idem \\\" and S_\\_disj: \"\\v \\ vars\\<^sub>s\\<^sub>t S. \\ v = Var v\"\n using subst_idemI[of \\] unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by force+\n\n obtain \\::\"('fun,'var) subst\"\n where \\: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"subst_range \\ \\ public_ground_wf_terms\"\n using wt_interpretation_exists by blast\n hence \\_deduct: \"\\x M. M \\\\<^sub>c \\ x\" and \\_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using pgwt_deducible pgwt_wellformed by fastforce+\n\n let ?P = \"\\\\ X. subst_domain \\ = set X \\ ground (subst_range \\)\"\n let ?Sineqsvars = \"{x \\ vars\\<^sub>s\\<^sub>t S. \\X F. Inequality X F \\ set S \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ x \\ set X}\"\n let ?Strms = \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\"\n\n have finite_vars: \"finite ?Sineqsvars\" \"finite ?Strms\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ?Strms\"\n using wf_trm_subtermeq assms(5) by fastforce+\n\n define Q1 where \"Q1 = (\\(F::(('fun,'var) term \\ ('fun,'var) term) list) X.\n \\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\a. \\ (Var x) = TAtom a)\"\n\n define Q2 where \"Q2 = (\\(F::(('fun,'var) term \\ ('fun,'var) term) list) X.\n \\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))\"\n\n define Q1' where \"Q1' = (\\(t::('fun,'var) term) (t'::('fun,'var) term) X.\n \\x \\ (fv t \\ fv t') - set X. \\a. \\ (Var x) = TAtom a)\"\n\n define Q2' where \"Q2' = (\\(t::('fun,'var) term) (t'::('fun,'var) term) X.\n \\f T. Fun f T \\ subterms t \\ subterms t' \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))\"\n\n have ex_P: \"\\X. \\\\. ?P \\ X\" using interpretation_subst_exists' by blast\n\n have tfr_ineq: \"\\X F. Inequality X F \\ set S \\ Q1 F X \\ Q2 F X\"\n using tfr_stp_all Q1_def Q2_def tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of S] by blast\n\n have S_fv_bvars_disj: \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S = {}\" using \\wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\\ unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by metis\n hence ineqs_vars_not_bound: \"\\X F x. Inequality X F \\ set S \\ x \\ ?Sineqsvars \\ x \\ set X\"\n using strand_fv_bvars_disjoint_unfold by blast\n\n have \\_vars_S_bvars_disj: \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n when \"Inequality X F \\ set S\" for F X\n using wf_constr_bvars_disj[OF \\wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\\]\n strand_fv_bvars_disjointD(1)[OF S_fv_bvars_disj that]\n by blast\n\n obtain \\::\"('fun,'var) subst\"\n where \\_fv_dom: \"subst_domain \\ = ?Sineqsvars\"\n and \\_subterm_inj: \"subterm_inj_on \\ (subst_domain \\)\"\n and \\_fresh_pub_img: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ {t. {} \\\\<^sub>c t} - ?Strms\"\n and \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \\_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using wt_bij_finite_subst_exists[OF finite_vars]\n subst_inj_on_is_bij_betw subterm_inj_on_alt_def'\n by moura\n\n have \\_bij_dom_img: \"bij_betw \\ (subst_domain \\) (subst_range \\)\"\n by (metis \\_subterm_inj subst_inj_on_is_bij_betw subterm_inj_on_alt_def)\n\n have \"finite (subst_domain \\)\" by(metis \\_fv_dom finite_vars(1))\n hence \\_finite_img: \"finite (subst_range \\)\" using \\_bij_dom_img bij_betw_finite by blast\n\n have \\_img_subterms: \"\\s \\ subst_range \\. \\u \\ subst_range \\. (\\v. v \\ s \\ v \\ u) \\ s = u\"\n by (metis \\_subterm_inj subterm_inj_on_alt_def')\n\n have \"subst_range \\ \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\)\" by auto\n hence \"subst_range \\ \\ public_ground_wf_terms - ?Strms\"\n and \\_pgwt_img:\n \"subst_range \\ \\ public_ground_wf_terms\"\n \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ public_ground_wf_terms\"\n using \\_fresh_pub_img pgwt_is_empty_synth by blast+\n\n have \\_img_ground: \"ground (subst_range \\)\"\n using \\_pgwt_img pgwt_ground by auto\n hence \\_inj: \"inj \\\"\n using \\_bij_dom_img subst_inj_is_bij_betw_dom_img_if_ground_img by auto\n\n have \\_ineqs_fv_dom: \"\\X F. Inequality X F \\ set S \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\ subst_domain \\\"\n using \\_fv_dom by fastforce\n\n have \\_dom_bvars_disj: \"\\X F. Inequality X F \\ set S \\ subst_domain \\ \\ set X = {}\"\n using ineqs_vars_not_bound \\_fv_dom by fastforce\n\n have \\'1: \"\\X F \\. Inequality X F \\ set S \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\ subst_domain \\'\"\n using \\'(3) ineqs_vars_not_bound by fastforce\n\n have \\'2: \"\\X F. Inequality X F \\ set S \\ subst_domain \\' \\ set X = {}\"\n using \\'(3) ineqs_vars_not_bound by blast\n\n have doms_eq: \"subst_domain \\' = subst_domain \\\" using \\'(3) \\_fv_dom by simp\n\n have \\_ineqs_neq: \"ineq_model \\ X F\" when \"Inequality X F \\ set S\" for X F\n proof -\n obtain a::\"'fun\" where a: \"a \\ \\(funs_term ` subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\))\"\n using exists_fun_notin_funs_terms[OF subterms_union_finite[OF \\_finite_img]]\n by moura\n hence a': \"\\T. Fun a T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\)\"\n \"\\S. Fun a [] \\ set (Fun a []#S)\" \"Fun a [] \\ Var ` set X\"\n by (meson a UN_I term.set_intros(1), auto)\n\n define t where \"t \\ Fun a (Fun a []#map fst F)\"\n define t' where \"t' \\ Fun a (Fun a []#map snd F)\"\n\n note F_in = that\n\n have t_fv: \"fv t \\ fv t' \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\"\n unfolding t_def t'_def by force\n\n have t_subterms: \"subterms t \\ subterms t' \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ {t, t', Fun a []}\"\n unfolding t_def t'_def by force\n\n have \"t \\ \\ \\ \\ \\ t' \\ \\ \\ \\\" when \"?P \\ X\" for \\\n proof -\n have tfr_assms: \"Q1 F X \\ Q2 F X\" using tfr_ineq F_in by metis\n\n have \"Q1 F X \\ \\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\c. \\ x = Fun c []\"\n proof\n fix x assume \"Q1 F X\" and x: \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X\"\n then obtain a where \"\\ (Var x) = TAtom a\" unfolding Q1_def by moura\n hence a: \"\\ (\\ x) = TAtom a\" using \\_wt unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by simp\n\n have \"x \\ subst_domain \\\" using \\_ineqs_fv_dom x F_in by auto\n then obtain f T where fT: \"\\ x = Fun f T\" by (meson \\_img_ground ground_img_obtain_fun)\n hence \"T = []\" using \\_wf_trm a TAtom_term_cases by fastforce\n thus \"\\c. \\ x = Fun c []\" using fT by metis\n qed\n hence 1: \"Q1 F X \\ \\x \\ (fv t \\ fv t') - set X. \\c. \\ x = Fun c []\"\n using t_fv by auto\n\n have 2: \"\\Q1 F X \\ Q2 F X\" by (metis tfr_assms)\n\n have 3: \"subst_domain \\ \\ set X = {}\" using \\_dom_bvars_disj F_in by auto\n\n have 4: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ (subterms t \\ subterms t') = {}\"\n proof -\n define M1 where \"M1 \\ {t, t', Fun a []}\"\n define M2 where \"M2 \\ ?Strms\"\n\n have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ M2\"\n using F_in unfolding M2_def by force\n moreover have \"subterms t \\ subterms t' \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ M1\"\n using t_subterms unfolding M1_def by blast\n ultimately have *: \"subterms t \\ subterms t' \\ M2 \\ M1\"\n by auto\n\n have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ M1 = {}\"\n \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\) \\ M2 = {}\"\n using a' \\_fresh_pub_img\n unfolding t_def t'_def M1_def M2_def\n by blast+\n thus ?thesis using * by blast\n qed\n\n have 5: \"(fv t \\ fv t') - subst_domain \\ \\ set X\"\n using \\_ineqs_fv_dom[OF F_in] t_fv\n by auto\n\n have 6: \"\\\\. ?P \\ X \\ t \\ \\ \\ \\' \\ t' \\ \\ \\ \\'\"\n by (metis t_def t'_def \\'(1) F_in ineq_model_singleE ineq_model_single_iff)\n\n have 7: \"fv t \\ fv t' - set X \\ subst_domain \\'\" using \\'1 F_in t_fv by force\n\n have 8: \"subst_domain \\' \\ set X = {}\" using \\'2 F_in by auto\n\n have 9: \"Q1' t t' X\" when \"Q1 F X\"\n using that t_fv\n unfolding Q1_def Q1'_def t_def t'_def\n by blast\n\n have 10: \"Q2' t t' X\" when \"Q2 F X\" unfolding Q2'_def\n proof (intro allI impI)\n fix f T assume \"Fun f T \\ subterms t \\ subterms t'\"\n moreover {\n assume \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F)\"\n hence \"T = [] \\ (\\s\\set T. s \\ Var ` set X)\" by (metis Q2_def that)\n } moreover {\n assume \"Fun f T = t\" hence \"T = [] \\ (\\s\\set T. s \\ Var ` set X)\"\n unfolding t_def using a'(2,3) by simp\n } moreover {\n assume \"Fun f T = t'\" hence \"T = [] \\ (\\s\\set T. s \\ Var ` set X)\"\n unfolding t'_def using a'(2,3) by simp\n } moreover {\n assume \"Fun f T = Fun a []\" hence \"T = [] \\ (\\s\\set T. s \\ Var ` set X)\" by simp\n } ultimately show \"T = [] \\ (\\s\\set T. s \\ Var ` set X)\" using t_subterms by blast\n qed\n\n note 11 = \\_subterm_inj \\_img_ground 3 4 5\n\n note 12 = 6 7 8 \\'(2) doms_eq\n\n show \"t \\ \\ \\ \\ \\ t' \\ \\ \\ \\\"\n using 1 2 9 10 that sat_ineq_subterm_inj_subst[OF 11 _ 12]\n unfolding Q1'_def Q2'_def by metis\n qed\n thus ?thesis by (metis t_def t'_def ineq_model_singleI ineq_model_single_iff)\n qed\n\n have \\_ineqs_fv_dom': \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\ subst_domain \\\"\n when \"Inequality X F \\ set S\" and \"?P \\ X\" for F \\ X\n using \\_ineqs_fv_dom[OF that(1)]\n proof (induction F)\n case (Cons g G)\n obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n hence \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (g#G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) = fv (t \\ \\) \\ fv (t' \\ \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (g#G) = fv t \\ fv t' \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\n by (simp_all add: subst_apply_pairs_def)\n moreover have \"fv (t \\ \\) = fv t - subst_domain \\\" \"fv (t' \\ \\) = fv t' - subst_domain \\\"\n using g that(2) by (simp_all add: subst_fv_unfold_ground_img range_vars_alt_def)\n moreover have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\ subst_domain \\\" using Cons by auto\n ultimately show ?case using Cons.prems that(2) by auto\n qed (simp add: subst_apply_pairs_def)\n\n have \\_ineqs_ground: \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) = {}\"\n when \"Inequality X F \\ set S\" and \"?P \\ X\" for F \\ X\n using \\_ineqs_fv_dom'[OF that]\n proof (induction F)\n case (Cons g G)\n obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n hence \"fv (t \\ \\) \\ subst_domain \\\" \"fv (t' \\ \\) \\ subst_domain \\\"\n using Cons.prems by (auto simp add: subst_apply_pairs_def)\n hence \"fv (t \\ \\ \\ \\) = {}\" \"fv (t' \\ \\ \\ \\) = {}\"\n using subst_fv_dom_ground_if_ground_img[OF _ \\_img_ground] by metis+\n thus ?case using g Cons by (auto simp add: subst_apply_pairs_def)\n qed (simp add: subst_apply_pairs_def)\n\n from \\_pgwt_img \\_ineqs_neq have \\_deduct: \"M \\\\<^sub>c \\ x\" when \"x \\ subst_domain \\\" for x M\n using that pgwt_deducible by fastforce\n\n { fix M::\"('fun,'var) terms\"\n have \"\\M; S\\\\<^sub>c (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using \\wf\\<^sub>s\\<^sub>t {} S\\ \\simple S\\ S_\\_disj \\_ineqs_neq \\_ineqs_fv_dom' \\_vars_S_bvars_disj\n proof (induction S arbitrary: M rule: wf\\<^sub>s\\<^sub>t_simple_induct)\n case (ConsSnd v S)\n hence S_sat: \"\\M; S\\\\<^sub>c (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" and \"\\ v = Var v\" by auto\n hence \"\\M. M \\\\<^sub>c Var v \\ (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using \\_deduct \\_deduct\n by (metis ideduct_synth_subst_apply subst_apply_term.simps(1)\n subst_subst_compose trm_subst_ident')\n thus ?case using strand_sem_append(1)[OF S_sat] by (metis strand_sem_c.simps(1,2))\n next\n case (ConsIneq X F S)\n have dom_disj: \"subst_domain \\ \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F = {}\"\n using ConsIneq.prems(1) subst_dom_vars_in_subst\n by force\n hence *: \"F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\ = F\" by blast\n\n have **: \"ineq_model \\ X F\" by (meson ConsIneq.prems(2) in_set_conv_decomp)\n\n have \"\\x. x \\ vars\\<^sub>s\\<^sub>t S \\ x \\ vars\\<^sub>s\\<^sub>t (S@[Inequality X F])\"\n \"\\x. x \\ set S \\ x \\ set (S@[Inequality X F])\" by auto\n hence IH: \"\\M; S\\\\<^sub>c (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" by (metis ConsIneq.IH ConsIneq.prems(1,2,3,4))\n\n have \"ineq_model (\\ \\\\<^sub>s \\) X F\"\n proof -\n have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\ subst_domain \\\" when \"?P \\ X\" for \\\n using ConsIneq.prems(3)[OF _ that] by simp\n hence \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\ subst_domain \\\"\n using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst_subset ex_P\n by (metis Diff_subset_conv Un_commute)\n thus ?thesis by (metis ineq_model_ground_subst[OF _ \\_img_ground **])\n qed\n hence \"ineq_model (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) X F\"\n using * ineq_model_subst' subst_compose_assoc ConsIneq.prems(4)\n by (metis UnCI list.set_intros(1) set_append)\n thus ?case using IH by (auto simp add: ineq_model_def)\n qed auto\n }\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n by (metis wt_subst_compose \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\,\n metis assms(4) \\_wf_trm \\_wf_trm wf_trm_subst subst_img_comp_subset')\n ultimately show ?thesis\n using interpretation_comp(1)[OF \\interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\, of \"\\ \\\\<^sub>s \\\"]\n subst_idem_support[OF \\subst_idem \\\\, of \"\\ \\\\<^sub>s \\\"] subst_compose_assoc\n unfolding constr_sem_c_def by metis\nqed\nend\n\n\nsubsubsection \\Theorem: Type-flaw resistant constraints are well-typed satisfiable (composition-only)\\\ntext \\\n There exists well-typed models of satisfiable type-flaw resistant constraints in the\n semantics where the intruder is limited to composition only (i.e., he cannot perform\n decomposition/analysis of deducible messages).\n\\\ntheorem wt_attack_if_tfr_attack:\n assumes \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"\\ \\\\<^sub>c \\S, \\\\\"\n and \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"tfr\\<^sub>s\\<^sub>t S\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n obtains \\\\<^sub>\\ where \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\"\n and \"\\\\<^sub>\\ \\\\<^sub>c \\S, \\\\\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\nproof -\n have tfr: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using assms(5,6) unfolding tfr\\<^sub>s\\<^sub>t_def by metis+\n obtain S' \\' where *: \"simple S'\" \"(S,\\) \\\\<^sup>* (S',\\')\" \"\\{}; S'\\\\<^sub>c \\\"\n using LI_completeness[OF assms(3,2)] unfolding constr_sem_c_def\n by (meson term.order_refl)\n have **: \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S' \\'\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\'\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\')\"\n using LI_preserves_welltypedness[OF *(2) assms(3,4,7) tfr]\n LI_preserves_wellformedness[OF *(2) assms(3)]\n LI_preserves_tfr[OF *(2) assms(3,4,7) tfr]\n by metis+\n\n define A where \"A \\ {x \\ vars\\<^sub>s\\<^sub>t S'. \\X F. Inequality X F \\ set S' \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ x \\ set X}\"\n define B where \"B \\ UNIV - A\"\n\n let ?\\ = \"rm_vars B \\\"\n\n have gr\\: \"ground (subst_range \\)\" \"ground (subst_range ?\\)\"\n using assms(1) rm_vars_img_subset[of B \\] by (auto simp add: subst_domain_def)\n\n { fix X F\n assume \"Inequality X F \\ set S'\"\n hence *: \"ineq_model \\ X F\"\n using strand_sem_c_imp_ineq_model[OF *(3)]\n by (auto simp del: subst_range.simps)\n hence \"ineq_model ?\\ X F\"\n proof -\n { fix \\\n assume 1: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n and 2: \"list_ex (\\f. fst f \\ \\ \\\\<^sub>s \\ \\ snd f \\ \\ \\\\<^sub>s \\) F\"\n have \"list_ex (\\f. fst f \\ \\ \\\\<^sub>s rm_vars B \\ \\ snd f \\ \\ \\\\<^sub>s rm_vars B \\) F\" using 2\n proof (induction F)\n case (Cons g G)\n obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n thus ?case\n using Cons Unifier_ground_rm_vars[OF gr\\(1), of \"t \\ \\\" B \"t' \\ \\\"]\n by auto\n qed simp\n } thus ?thesis using * unfolding ineq_model_def by simp\n qed\n } moreover have \"subst_domain \\ = UNIV\" using assms(1) by metis\n hence \"subst_domain ?\\ = A\" using rm_vars_dom[of B \\] B_def by blast\n ultimately obtain \\\\<^sub>\\ where\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"\\\\<^sub>\\ \\\\<^sub>c \\S', \\'\\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\n using wt_sat_if_simple[OF *(1) **(1,2,5,4) _ gr\\(2) _ **(3)] A_def\n by (auto simp del: subst_range.simps)\n thus ?thesis using that LI_soundness[OF assms(3) *(2)] by metis\nqed\n\ntext \\\n Contra-positive version: if a type-flaw resistant constraint does not have a well-typed model\n then it is unsatisfiable\n\\\ncorollary secure_if_wt_secure:\n assumes \"\\(\\\\\\<^sub>\\. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\ \\ (\\\\<^sub>\\ \\\\<^sub>c \\S, \\\\) \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\)\"\n and \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"tfr\\<^sub>s\\<^sub>t S\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"\\(\\\\. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ (\\ \\\\<^sub>c \\S, \\\\))\"\nusing wt_attack_if_tfr_attack[OF _ _ assms(2,3,4,5,6)] assms(1) by metis\n\nend\n\n\nsubsection \\Lifting the Composition-Only Typing Result to the Full Intruder Model\\\ncontext typed_model\nbegin\n\nsubsubsection \\Analysis Invariance\\\ndefinition (in typed_model) Ana_invar_subst where\n \"Ana_invar_subst \\ \\\n (\\f T K M \\. Fun f T \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\n Ana (Fun f T) = (K, M) \\ Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\))\"\n\nlemma (in typed_model) Ana_invar_subst_subset:\n assumes \"Ana_invar_subst M\" \"N \\ M\"\n shows \"Ana_invar_subst N\"\nusing assms unfolding Ana_invar_subst_def by blast\n\nlemma (in typed_model) Ana_invar_substD:\n assumes \"Ana_invar_subst \\\"\n and \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"Ana (Fun f T) = (K, M)\"\n shows \"Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\nusing assms Ana_invar_subst_def by blast\n\nend\n\n\nsubsubsection \\Preliminary Definitions\\\ntext \\Strands extended with \"decomposition steps\"\\\ndatatype (funs\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p: 'a, vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p: 'b) extstrand_step =\n Step \"('a,'b) strand_step\"\n| Decomp \"('a,'b) term\"\n\ncontext typed_model\nbegin\n\ncontext\nbegin\nprivate fun trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p where\n \"trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p (Step x) = trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n| \"trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p (Decomp t) = {t}\"\n\nprivate abbreviation trms\\<^sub>e\\<^sub>s\\<^sub>t where \"trms\\<^sub>e\\<^sub>s\\<^sub>t S \\ \\(trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ` set S)\"\n\nprivate type_synonym ('a,'b) extstrand = \"('a,'b) extstrand_step list\"\nprivate type_synonym ('a,'b) extstrands = \"('a,'b) extstrand set\"\n\nprivate definition decomp::\"('fun,'var) term \\ ('fun,'var) strand\" where\n \"decomp t \\ (case (Ana t) of (K,T) \\ send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive T)\"\n\nprivate fun to_st where\n \"to_st [] = []\"\n| \"to_st (Step x#S) = x#(to_st S)\"\n| \"to_st (Decomp t#S) = (decomp t)@(to_st S)\"\n\nprivate fun to_est where\n \"to_est [] = []\"\n| \"to_est (x#S) = Step x#to_est S\"\n\nprivate abbreviation \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"wf\\<^sub>e\\<^sub>s\\<^sub>t V A \\ wf\\<^sub>s\\<^sub>t V (to_st A)\"\nprivate abbreviation \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"vars\\<^sub>e\\<^sub>s\\<^sub>t A \\ vars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A \\ wfrestrictedvars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"bvars\\<^sub>e\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ fv\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"funs\\<^sub>e\\<^sub>s\\<^sub>t A \\ funs\\<^sub>s\\<^sub>t (to_st A)\"\n\nprivate definition wf\\<^sub>s\\<^sub>t\\<^sub>s'::\"('fun,'var) strands \\ ('fun,'var) extstrand \\ bool\" where\n \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\ \\ (\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\) (dual\\<^sub>s\\<^sub>t S)) \\\n (\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}) \\\n (\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\ = {}) \\\n (\\S \\ \\. fv\\<^sub>s\\<^sub>t (to_st \\) \\ bvars\\<^sub>s\\<^sub>t S = {})\"\n\nprivate definition wf\\<^sub>s\\<^sub>t\\<^sub>s::\"('fun,'var) strands \\ bool\" where\n \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\ \\ (\\S \\ \\. wf\\<^sub>s\\<^sub>t {} (dual\\<^sub>s\\<^sub>t S)) \\ (\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {})\"\n\nprivate inductive well_analyzed::\"('fun,'var) extstrand \\ bool\" where\n Nil[simp]: \"well_analyzed []\"\n| Step: \"well_analyzed A \\ well_analyzed (A@[Step x])\"\n| Decomp: \"\\well_analyzed A; t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) - (Var ` \\)\\\n \\ well_analyzed (A@[Decomp t])\"\n\nprivate fun subst_apply_extstrandstep (infix \"\\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p\" 51) where\n \"subst_apply_extstrandstep (Step x) \\ = Step (x \\\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n| \"subst_apply_extstrandstep (Decomp t) \\ = Decomp (t \\ \\)\"\n\nprivate lemma subst_apply_extstrandstep'_simps[simp]:\n \"(Step (send\\t\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\ = Step (send\\t \\ \\\\\\<^sub>s\\<^sub>t)\"\n \"(Step (receive\\t\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\ = Step (receive\\t \\ \\\\\\<^sub>s\\<^sub>t)\"\n \"(Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\ = Step (\\a: (t \\ \\) \\ (t' \\ \\)\\\\<^sub>s\\<^sub>t)\"\n \"(Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\ = Step (\\X\\\\\\: (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\\\\<^sub>s\\<^sub>t)\"\nby simp_all\n\nprivate lemma vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p_subst_apply_simps[simp]:\n \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (send\\t\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (receive\\t\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (t' \\ \\)\"\n \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)) \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\) = set X \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\nby auto\n\nprivate definition subst_apply_extstrand (infix \"\\\\<^sub>e\\<^sub>s\\<^sub>t\" 51) where \"S \\\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ map (\\x. x \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\) S\"\n\nprivate abbreviation update\\<^sub>s\\<^sub>t::\"('fun,'var) strands \\ ('fun,'var) strand \\ ('fun,'var) strands\"\nwhere\n \"update\\<^sub>s\\<^sub>t \\ S \\ (case S of Nil \\ \\ - {S} | Cons _ S' \\ insert S' (\\ - {S}))\"\n\nprivate inductive_set decomps\\<^sub>e\\<^sub>s\\<^sub>t::\n \"('fun,'var) terms \\ ('fun,'var) terms \\ ('fun,'var) subst \\ ('fun,'var) extstrands\"\n(* \\: intruder knowledge\n \\: additional messages\n*)\nfor \\ and \\ and \\ where\n Nil: \"[] \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ \\\"\n| Decomp: \"\\\\ \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ \\; Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\ \\ \\);\n Ana (Fun f T) = (K,M); M \\ [];\n (\\ \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c Fun f T \\ \\;\n \\k. k \\ set K \\ (\\ \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\\\n \\ \\@[Decomp (Fun f T)] \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ \\\"\n\nprivate fun decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t::\"('fun,'var) extstrand \\ ('fun,'var) extstrand\" where\n \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [] = []\"\n| \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (Decomp t#S) = decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S\"\n| \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (Step x#S) = Step x#(decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S)\"\n\nprivate inductive sem\\<^sub>e\\<^sub>s\\<^sub>t_d::\"('fun,'var) terms \\ ('fun,'var) subst \\ ('fun,'var) extstrand \\ bool\"\nwhere\n Nil[simp]: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ []\"\n| Send: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ S \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (S@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\n| Receive: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ S \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (S@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\"\n| Equality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ S \\ t \\ \\ = t' \\ \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (S@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\"\n| Inequality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ S\n \\ ineq_model \\ X F\n \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (S@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\"\n| Decompose: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ S \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\ \\ Ana t = (K, M)\n \\ (\\k. k \\ set K \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ k \\ \\) \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (S@[Decomp t])\"\n\nprivate inductive sem\\<^sub>e\\<^sub>s\\<^sub>t_c::\"('fun,'var) terms \\ ('fun,'var) subst \\ ('fun,'var) extstrand \\ bool\"\nwhere\n Nil[simp]: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ []\"\n| Send: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ S \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (S@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\n| Receive: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ S \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (S@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\"\n| Equality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ S \\ t \\ \\ = t' \\ \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (S@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\"\n| Inequality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ S\n \\ ineq_model \\ X F\n \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (S@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\"\n| Decompose: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ S \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\ \\ Ana t = (K, M)\n \\ (\\k. k \\ set K \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\ M\\<^sub>0) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\) \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (S@[Decomp t])\"\n\n\nsubsubsection \\Preliminary Lemmata\\\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s':\n \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\ = wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ []\"\nby (simp add: wf\\<^sub>s\\<^sub>t\\<^sub>s_def wf\\<^sub>s\\<^sub>t\\<^sub>s'_def)\n\nprivate lemma decomp_ik:\n assumes \"Ana t = (K,M)\"\n shows \"ik\\<^sub>s\\<^sub>t (decomp t) = set M\"\nusing ik_rcv_map[of _ M] ik_rcv_map'[of _ M]\nby (auto simp add: decomp_def inv_def assms)\n\nprivate lemma decomp_assignment_rhs_empty:\n assumes \"Ana t = (K,M)\"\n shows \"assignment_rhs\\<^sub>s\\<^sub>t (decomp t) = {}\"\nby (auto simp add: decomp_def inv_def assms)\n\nprivate lemma decomp_tfr\\<^sub>s\\<^sub>t\\<^sub>p:\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (decomp t)\"\nby (auto simp add: decomp_def list_all_def)\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI:\n \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction A rule: to_st.induct)\n case (2 x S) thus ?case by (cases x) auto\nnext\n case (3 t' A)\n obtain K M where Ana: \"Ana t' = (K,M)\" by (metis surj_pair)\n show ?case using 3 decomp_ik[OF Ana] Ana_subterm[OF Ana] by auto\nqed simp\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI:\n \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\ t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction A rule: to_st.induct)\n case (2 x S) thus ?case\n proof (cases x)\n case (Equality ac t t') thus ?thesis using 2 by (cases ac) auto\n qed auto\nnext\n case (3 t' A)\n obtain K M where Ana: \"Ana t' = (K,M)\" by (metis surj_pair)\n show ?case\n using 3 decomp_ik[OF Ana] decomp_assignment_rhs_empty[OF Ana] Ana_subterm[OF Ana]\n by auto\nqed simp\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_subtermsI:\n assumes \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n shows \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof -\n obtain t' where \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A\" \"t \\ t'\" using trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI assms by auto\n thus ?thesis by (meson contra_subsetD in_subterms_subset_Union trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI)\nqed\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>tD:\n assumes \"t \\ trms\\<^sub>e\\<^sub>s\\<^sub>t A\"\n shows \"t \\ trms\\<^sub>s\\<^sub>t (to_st A)\"\nusing assms\nproof (induction A)\n case (Cons a A)\n obtain K M where Ana: \"Ana t = (K,M)\" by (metis surj_pair)\n hence \"t \\ trms\\<^sub>s\\<^sub>t (decomp t)\" unfolding decomp_def by force\n thus ?case using Cons.IH Cons.prems by (cases a) auto\nqed simp\n\nprivate lemma subst_apply_extstrand_nil[simp]:\n \"[] \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = []\"\nby (simp add: subst_apply_extstrand_def)\n\nprivate lemma subst_apply_extstrand_singleton[simp]:\n \"[Step (receive\\t\\\\<^sub>s\\<^sub>t)] \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = [Step (Receive (t \\ \\))]\"\n \"[Step (send\\t\\\\<^sub>s\\<^sub>t)] \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = [Step (Send (t \\ \\))]\"\n \"[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)] \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = [Step (Equality a (t \\ \\) (t' \\ \\))]\"\n \"[Decomp t] \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = [Decomp (t \\ \\)]\"\nunfolding subst_apply_extstrand_def by auto\n\nprivate lemma extstrand_subst_hom:\n \"(S@S') \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = (S \\\\<^sub>e\\<^sub>s\\<^sub>t \\)@(S' \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\" \"(x#S) \\\\<^sub>e\\<^sub>s\\<^sub>t \\ = (x \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\)#(S \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\nunfolding subst_apply_extstrand_def by auto\n\nprivate lemma decomp_vars:\n \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"vars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"bvars\\<^sub>s\\<^sub>t (decomp t) = {}\"\n \"fv\\<^sub>s\\<^sub>t (decomp t) = fv t\"\nproof -\n obtain K M where Ana: \"Ana t = (K,M)\" by (metis surj_pair)\n hence \"decomp t = send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive M\"\n unfolding decomp_def by simp\n moreover have \"\\(set (map fv K)) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set K)\" \"\\(set (map fv M)) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" by auto\n moreover have \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\ fv t\" \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set M) \\ fv t\"\n using Ana_subterm[OF Ana(1)] Ana_keys_fv[OF Ana(1)]\n by (simp_all add: UN_least psubsetD subtermeq_vars_subset)\n ultimately show\n \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"vars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"bvars\\<^sub>s\\<^sub>t (decomp t) = {}\"\n \"fv\\<^sub>s\\<^sub>t (decomp t) = fv t\"\n by auto\nqed\n\nprivate lemma bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (x#X) = bvars\\<^sub>e\\<^sub>s\\<^sub>t [x] \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t X\"\nby (cases x) auto\n\nprivate lemma bvars\\<^sub>e\\<^sub>s\\<^sub>t_append: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t B\"\nproof (induction A)\n case (Cons x A) thus ?case using bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x \"A@B\"] bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x A] by force\nqed simp\n\nprivate lemma fv\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (x#X) = fv\\<^sub>e\\<^sub>s\\<^sub>t [x] \\ fv\\<^sub>e\\<^sub>s\\<^sub>t X\"\nby (cases x) auto\n\nprivate lemma fv\\<^sub>e\\<^sub>s\\<^sub>t_append: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ fv\\<^sub>e\\<^sub>s\\<^sub>t B\"\nproof (induction A)\n case (Cons x A) thus ?case using fv\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x \"A@B\"] fv\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x A] by auto\nqed simp\n\nprivate lemma bvars_decomp: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (Decomp t#A) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nusing bvars\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_vars(3) by fastforce+\n\nprivate lemma bvars_decomp_rm: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nusing bvars_decomp by (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) simp_all+\n\nprivate lemma fv_decomp_rm: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto\n\nprivate lemma ik_assignment_rhs_decomp_fv:\n assumes \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n shows \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nproof -\n have \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ fv t\" using fv\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_vars by simp\n moreover have \"fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\ fv\\<^sub>e\\<^sub>s\\<^sub>t A\" by force\n moreover have \"fv t \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using fv_subset_subterms[OF assms(1)] by simp\n ultimately show ?thesis by blast\nqed\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_subset:\n \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto+\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t:\n \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A = wfrestrictedvars\\<^sub>s\\<^sub>t (to_st A)\"\nby simp\n\nprivate lemma decomp_set_unfold:\n assumes \"Ana t = (K, M)\"\n shows \"set (decomp t) = {send\\t\\\\<^sub>s\\<^sub>t} \\ (Send ` set K) \\ (Receive ` set M)\"\nusing assms unfolding decomp_def by auto\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_finite: \"finite (ik\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nby (rule finite_ik\\<^sub>s\\<^sub>t)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_finite: \"finite (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nby (rule finite_assignment_rhs\\<^sub>s\\<^sub>t)\n\nprivate lemma to_est_append: \"to_est (A@B) = to_est A@to_est B\"\nby (induct A rule: to_est.induct) auto\n\nprivate lemma to_st_to_est_inv: \"to_st (to_est A) = A\"\nby (induct A rule: to_est.induct) auto\n\nprivate lemma to_st_append: \"to_st (A@B) = (to_st A)@(to_st B)\"\nby (induct A rule: to_st.induct) auto\n\nprivate lemma to_st_cons: \"to_st (a#B) = (to_st [a])@(to_st B)\"\nusing to_st_append[of \"[a]\" B] by simp\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split:\n \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (x#S) = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t [x] \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S\"\n \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (S@S') = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S'\"\nusing to_st_cons[of x S] to_st_append[of S S'] by auto\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_append: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t B\"\nby (metis ik_append to_st_append)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append:\n \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t B\"\nby (metis assignment_rhs_append to_st_append)\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A) = ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (metis ik_append to_st_cons)\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst:\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (B \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t B \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\nby (metis ik\\<^sub>e\\<^sub>s\\<^sub>t_append extstrand_subst_hom(1), simp add: image_Un to_st_append)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst:\n \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (B \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t B \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\nby (metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append extstrand_subst_hom(1), use assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append in blast)\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_cons_subst:\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = ik\\<^sub>e\\<^sub>s\\<^sub>t ([a \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\]) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\nby (metis ik\\<^sub>e\\<^sub>s\\<^sub>t_cons extstrand_subst_hom(2), metis image_Un ik\\<^sub>e\\<^sub>s\\<^sub>t_cons)\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append: \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (S@S') = (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S)@(decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S')\"\nby (induct S rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_single[simp]:\n \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Step (send\\t\\\\<^sub>s\\<^sub>t)] = [Step (send\\t\\\\<^sub>s\\<^sub>t)]\"\n \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Step (receive\\t\\\\<^sub>s\\<^sub>t)] = [Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Decomp t] = []\"\nby auto\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t S\"\nproof (induction S rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (3 x S) thus ?case by (cases x) auto\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset: \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\ \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\"\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp D f T K M')\n have \"ik\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\ subterms (Fun f T)\"\n \"ik\\<^sub>s\\<^sub>t (decomp (Fun f T)) = ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n using decomp_ik[OF Decomp.hyps(3)] Ana_subterm[OF Decomp.hyps(3)]\n by auto\n hence \"ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f T)]) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\"\n using in_subterms_subset_Union[OF Decomp.hyps(2)]\n by blast\n thus ?case using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f T)]\"] using Decomp.IH by auto\nqed simp\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_empty: \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\ \\ decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t D = []\"\nby (induct D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct) (auto simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append)\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_append:\n assumes \"A \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\\" \"B \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\\"\n shows \"A@B \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\\"\nusing assms(2)\nproof (induction B rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case Nil show ?case using assms(1) by simp\nnext\n case (Decomp B f X K T)\n hence \"S \\ ik\\<^sub>e\\<^sub>s\\<^sub>t B \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ S \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n thus ?case\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF Decomp.IH(1) Decomp.hyps(2,3,4)]\n ideduct_synth_mono[OF Decomp.hyps(5)]\n ideduct_synth_mono[OF Decomp.hyps(6)]\n by auto\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_subterms:\n assumes \"A' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\"\n shows \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A') \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\"\nusing assms\nproof (induction A' rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp D f X K T)\n hence \"Fun f X \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\" by auto\n hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (set X) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\"\n using in_subterms_subset_Union[of \"Fun f X\" \"M \\ N\"] params_subterms_Union[of X f]\n by blast\n moreover have \"ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f X)]) = set T\" using Decomp.hyps(3) decomp_ik by simp\n hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f X)])) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set X)\"\n using Ana_fun_subterm[OF Decomp.hyps(3)] by auto\n ultimately show ?case\n using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f X)]\"] Decomp.IH\n by auto\nqed simp\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_assignment_rhs_empty:\n assumes \"A' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\"\n shows \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A' = {}\"\nusing assms\nby (induction A' rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n (simp_all add: decomp_assignment_rhs_empty assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_finite_ik_append:\n assumes \"finite M\" \"M \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\"\n shows \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. ik\\<^sub>e\\<^sub>s\\<^sub>t D = (\\m \\ M. ik\\<^sub>e\\<^sub>s\\<^sub>t m)\"\nusing assms\nproof (induction M rule: finite_induct)\n case empty\n moreover have \"[] \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" \"ik\\<^sub>s\\<^sub>t (to_st []) = {}\" using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil by auto\n ultimately show ?case by blast\nnext\n case (insert m M)\n then obtain D where \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t D = (\\m\\M. ik\\<^sub>s\\<^sub>t (to_st m))\" by moura\n moreover have \"m \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" using insert.prems(1) by blast\n ultimately show ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[of D A N \\ m] ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D m] by blast\nqed\n\nprivate lemma decomp_snd_exists[simp]: \"\\D. decomp t = send\\t\\\\<^sub>s\\<^sub>t#D\"\nby (metis (mono_tags, lifting) decomp_def prod.case surj_pair)\n\nprivate lemma decomp_nonnil[simp]: \"decomp t \\ []\"\nusing decomp_snd_exists[of t] by fastforce\n\nprivate lemma to_st_nil_inv[dest]: \"to_st A = [] \\ A = []\"\nby (induct A rule: to_st.induct) auto\n\nprivate lemma well_analyzedD:\n assumes \"well_analyzed A\" \"Decomp t \\ set A\"\n shows \"\\f T. t = Fun f T\"\nusing assms\nproof (induction A rule: well_analyzed.induct)\n case (Decomp A t')\n hence \"\\f T. t' = Fun f T\" by (cases t') auto\n moreover have \"Decomp t \\ set A \\ t = t'\" using Decomp by auto\n ultimately show ?case using Decomp.IH by auto\nqed auto\n\nprivate lemma well_analyzed_inv:\n assumes \"well_analyzed (A@[Decomp t])\"\n shows \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) - (Var ` \\)\"\nusing assms well_analyzed.cases[of \"A@[Decomp t]\"] by fastforce\n\nprivate lemma well_analyzed_split_left_single: \"well_analyzed (A@[a]) \\ well_analyzed A\"\nby (induction \"A@[a]\" rule: well_analyzed.induct) auto\n\nprivate lemma well_analyzed_split_left: \"well_analyzed (A@B) \\ well_analyzed A\"\nproof (induction B rule: List.rev_induct)\n case (snoc b B) thus ?case using well_analyzed_split_left_single[of \"A@B\" b] by simp\nqed simp\n\nprivate lemma well_analyzed_append:\n assumes \"well_analyzed A\" \"well_analyzed B\"\n shows \"well_analyzed (A@B)\"\nusing assms(2,1)\nproof (induction B rule: well_analyzed.induct)\n case (Step B x) show ?case using well_analyzed.Step[OF Step.IH[OF Step.prems]] by simp\nnext\n case (Decomp B t) thus ?case\n using well_analyzed.Decomp[OF Decomp.IH[OF Decomp.prems]] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n by auto\nqed simp_all\n\nprivate lemma well_analyzed_singleton:\n \"well_analyzed [Step (send\\t\\\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n \"well_analyzed [Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"\n \"\\well_analyzed [Decomp t]\"\nproof -\n show \"well_analyzed [Step (send\\t\\\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n \"well_analyzed [Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"\n using well_analyzed.Step[OF well_analyzed.Nil]\n by simp_all\n\n show \"\\well_analyzed [Decomp t]\" using well_analyzed.cases[of \"[Decomp t]\"] by auto\nqed\n\nprivate lemma well_analyzed_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_fv: \"well_analyzed A \\ fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) = fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nproof\n assume \"well_analyzed A\" thus \"fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n proof (induction A rule: well_analyzed.induct)\n case Decomp thus ?case using ik_assignment_rhs_decomp_fv decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n next\n case (Step A x)\n have \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Step x]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ fv\\<^sub>s\\<^sub>t\\<^sub>p x\"\n \"fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (A@[Step x])) = fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ fv\\<^sub>s\\<^sub>t\\<^sub>p x\"\n using fv\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n thus ?case using Step by auto\n qed simp\nqed (rule fv_decomp_rm)\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_split_left: assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (\\@\\')\" shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ \\\"\nusing assms sem\\<^sub>e\\<^sub>s\\<^sub>t_d.cases by (induction \\' rule: List.rev_induct) fastforce+\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ \\ = \\M\\<^sub>0; to_st \\\\\\<^sub>d' \\\"\nproof\n show \"\\M\\<^sub>0; to_st \\\\\\<^sub>d' \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ \\\"\n proof (induction \\ arbitrary: M\\<^sub>0 rule: List.rev_induct)\n case Nil show ?case using to_st_nil_inv by simp\n next\n case (snoc a \\)\n hence IH: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ \\\" and *: \"\\ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0; to_st [a]\\\\<^sub>d' \\\"\n using to_st_append by (auto simp add: sup.commute)\n thus ?case using snoc\n proof (cases a)\n case (Step b) thus ?thesis\n proof (cases b)\n case (Send t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Send[OF IH] * Step by auto\n next\n case (Receive t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Receive[OF IH] Step by auto\n next\n case (Equality a t t') thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Equality[OF IH] * Step by auto\n next\n case (Inequality X F) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Inequality[OF IH] * Step by auto\n qed\n next\n case (Decomp t)\n obtain K M where Ana: \"Ana t = (K,M)\" by moura\n have \"to_st [a] = decomp t\" using Decomp by auto\n hence \"to_st [a] = send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive M\"\n using Ana unfolding decomp_def by auto\n hence **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\" and \"\\ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0; map Send K\\\\<^sub>d' \\\"\n using * by auto\n hence \"\\k. k \\ set K \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ k \\ \\\"\n using *\n by (metis (full_types) strand_sem_d.simps(2) strand_sem_eq_defs(2) strand_sem_Send_split(2))\n thus ?thesis using Decomp sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Decompose[OF IH ** Ana] by metis\n qed\n qed\n\n show \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ \\ \\ \\M\\<^sub>0; to_st \\\\\\<^sub>d' \\\"\n proof (induction rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_d.induct)\n case Nil thus ?case by simp\n next\n case (Send M\\<^sub>0 \\ \\ t) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[send\\t\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (send\\t\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Receive M\\<^sub>0 \\ \\ t) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[receive\\t\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Equality M\\<^sub>0 \\ \\ t t' a) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Inequality M\\<^sub>0 \\ \\ X F) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Decompose M\\<^sub>0 \\ \\ t K M)\n have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); decomp t\\\\<^sub>d' \\\"\n proof -\n have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); [send\\t\\\\<^sub>s\\<^sub>t]\\\\<^sub>d' \\\"\n using Decompose.hyps(2) by (auto simp add: sup.commute)\n moreover have \"\\k. k \\ set K \\ M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ k \\ \\\"\n using Decompose by (metis sup.commute)\n hence \"\\k. k \\ set K \\ \\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); [Send k]\\\\<^sub>d' \\\" by auto\n hence \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); map Send K\\\\<^sub>d' \\\"\n using strand_sem_Send_map(2)[of K, of \"M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \\] strand_sem_eq_defs(2)\n by auto\n moreover have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); map Receive M\\\\<^sub>d' \\\"\n by (metis strand_sem_Receive_map(2) strand_sem_eq_defs(2))\n ultimately have\n \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive M\\\\<^sub>d' \\\"\n by auto\n thus ?thesis using Decompose.hyps(3) unfolding decomp_def by auto\n qed\n hence \"\\M\\<^sub>0; to_st \\@decomp t\\\\<^sub>d' \\\"\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"decomp t\"] Decompose.IH\n by simp\n thus ?case using to_st_append[of \\ \"[Decomp t]\"] by simp\n qed\nqed\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ \\ = \\M\\<^sub>0; to_st \\\\\\<^sub>c' \\\"\nproof\n show \"\\M\\<^sub>0; to_st \\\\\\<^sub>c' \\ \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ \\\"\n proof (induction \\ arbitrary: M\\<^sub>0 rule: List.rev_induct)\n case Nil show ?case using to_st_nil_inv by simp\n next\n case (snoc a \\)\n hence IH: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ \\\" and *: \"\\ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0; to_st [a]\\\\<^sub>c' \\\"\n using to_st_append\n by (auto simp add: sup.commute)\n thus ?case using snoc\n proof (cases a)\n case (Step b) thus ?thesis\n proof (cases b)\n case (Send t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Send[OF IH] * Step by auto\n next\n case (Receive t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Receive[OF IH] Step by auto\n next\n case (Equality t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Equality[OF IH] * Step by auto\n next\n case (Inequality t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Inequality[OF IH] * Step by auto\n qed\n next\n case (Decomp t)\n obtain K M where Ana: \"Ana t = (K,M)\" by moura\n have \"to_st [a] = decomp t\" using Decomp by auto\n hence \"to_st [a] = send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive M\"\n using Ana unfolding decomp_def by auto\n hence **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\\" and \"\\ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0; map Send K\\\\<^sub>c' \\\"\n using * by auto\n hence \"\\k. k \\ set K \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\"\n using * strand_sem_Send_split(1) strand_sem_eq_defs(1)\n by auto\n thus ?thesis using Decomp sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF IH ** Ana] by metis\n qed\n qed\n\n show \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ \\ \\ \\M\\<^sub>0; to_st \\\\\\<^sub>c' \\\"\n proof (induction rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n case Nil thus ?case by simp\n next\n case (Send M\\<^sub>0 \\ \\ t) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[send\\t\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (send\\t\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Receive M\\<^sub>0 \\ \\ t) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[receive\\t\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Equality M\\<^sub>0 \\ \\ t t' a) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\"]\n by (simp add: sup.commute)\n next\n case (Inequality M\\<^sub>0 \\ \\ X F) thus ?case\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\"]\n to_st_append[of \\ \"[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"]\n by (auto simp add: sup.commute)\n next\n case (Decompose M\\<^sub>0 \\ \\ t K M)\n have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); decomp t\\\\<^sub>c' \\\"\n proof -\n have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); [send\\t\\\\<^sub>s\\<^sub>t]\\\\<^sub>c' \\\"\n using Decompose.hyps(2) by (auto simp add: sup.commute)\n moreover have \"\\k. k \\ set K \\ M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\"\n using Decompose by (metis sup.commute)\n hence \"\\k. k \\ set K \\ \\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); [Send k]\\\\<^sub>c' \\\" by auto\n hence \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); map Send K\\\\<^sub>c' \\\"\n using strand_sem_Send_map(1)[of K, of \"M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \\]\n strand_sem_eq_defs(1)\n by auto\n moreover have \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); map Receive M\\\\<^sub>c' \\\"\n by (metis strand_sem_Receive_map(1) strand_sem_eq_defs(1))\n ultimately have\n \"\\M\\<^sub>0 \\ ik\\<^sub>s\\<^sub>t (to_st \\); send\\t\\\\<^sub>s\\<^sub>t#map Send K@map Receive M\\\\<^sub>c' \\\"\n by auto\n thus ?thesis using Decompose.hyps(3) unfolding decomp_def by auto\n qed\n hence \"\\M\\<^sub>0; to_st \\@decomp t\\\\<^sub>c' \\\"\n using strand_sem_append'[of M\\<^sub>0 \"to_st \\\" \\ \"decomp t\"] Decompose.IH\n by simp\n thus ?case using to_st_append[of \\ \"[Decomp t]\"] by simp\n qed\nqed\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct_aux:\n assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ A\" \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n shows \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t\"\nusing assms\nproof (induction M\\<^sub>0 \\ A arbitrary: t rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n case (Send M\\<^sub>0 \\ A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n case (Receive M\\<^sub>0 \\ A t')\n hence \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence IH: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t\" using Receive.IH by auto\n show ?case using ideduct_mono[OF IH] decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n case (Equality M\\<^sub>0 \\ A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n case (Inequality M\\<^sub>0 \\ A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n case (Decompose M\\<^sub>0 \\ A t' K M t)\n have *: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t' \\ \\\" using Decompose.hyps(2)\n proof (induction rule: intruder_synth_induct)\n case (AxiomC t'')\n moreover {\n assume \"t'' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t'' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n hence ?case using Decompose.IH by auto\n }\n ultimately show ?case by force\n qed simp\n\n { fix k assume \"k \\ set K\"\n hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\" using Decompose.hyps by auto\n hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ k \\ \\\"\n proof (induction rule: intruder_synth_induct)\n case (AxiomC t'')\n moreover {\n assume \"t'' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t'' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n hence ?case using Decompose.IH by auto\n }\n ultimately show ?case by force\n qed simp\n }\n hence **: \"\\k. k \\ set (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ k\" by auto\n\n show ?case\n proof (cases \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\")\n case True thus ?thesis using Decompose.IH Decompose.prems(2) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n next\n case False\n hence \"t \\ ik\\<^sub>s\\<^sub>t (decomp t') \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" using Decompose.prems(1) ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence ***: \"t \\ set (M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\" using Decompose.hyps(3) decomp_ik by auto\n hence \"M \\ []\" by auto\n hence ****: \"Ana (t' \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\" using Ana_subst[OF Decompose.hyps(3)] by auto\n\n have \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t\" by (rule intruder_deduct.Decompose[OF * **** ** ***])\n thus ?thesis using ideduct_mono decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n qed\nqed simp\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct:\n assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ A\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t\"\n shows \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t\"\nusing assms(2)\nproof (induction t rule: intruder_synth_induct)\n case (AxiomC t)\n hence \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ M\\<^sub>0 \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by auto\n moreover {\n assume \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n hence ?case using ideduct_mono[OF intruder_deduct.Axiom] by auto\n }\n moreover {\n assume \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n hence ?case using sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct_aux[OF assms(1)] by auto\n }\n ultimately show ?case by auto\nqed simp\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_if_sem\\<^sub>e\\<^sub>s\\<^sub>t_c: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ A \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\ (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction M\\<^sub>0 \\ A rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n case (Send M\\<^sub>0 \\ A t)\n thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Send[OF Send.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct by auto\nnext\n case (Receive t) thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Receive by auto\nnext\n case (Equality M\\<^sub>0 \\ A t)\n thus ?case\n using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Equality[OF Equality.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct\n by auto\nnext\n case (Inequality M\\<^sub>0 \\ A t)\n thus ?case\n using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Inequality[OF Inequality.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct\n by auto\nnext\n case Decompose thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nqed auto\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomps\\<^sub>e\\<^sub>s\\<^sub>t_append:\n assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ A\" \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\) \\\"\n shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (A@D)\"\nusing assms(2,1)\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp D f T K M)\n hence *: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (A @ D)\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\ {} \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c Fun f T \\ \\\"\n \"\\k. k \\ set K \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (A @ D) \\ {} \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\"\n using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n show ?case using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF *(1,2) Decomp.hyps(3) *(3)] by simp\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_wf:\n assumes \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t V A\"\n shows \"wf\\<^sub>e\\<^sub>s\\<^sub>t V (A@D)\"\nusing assms\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp D f T K M)\n have \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using decomp_vars fv_subset_subterms[OF Decomp.hyps(2)] by fast\n hence \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\n using ik\\<^sub>s\\<^sub>t_assignment_rhs\\<^sub>s\\<^sub>t_wfrestrictedvars_subset[of \"to_st A\"] by blast\n hence \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\ wfrestrictedvars\\<^sub>s\\<^sub>t (to_st (A@D)) \\ V\"\n using to_st_append[of A D] strand_vars_split(2)[of \"to_st A\" \"to_st D\"]\n by (metis le_supI1)\n thus ?case\n using wf_append_suffix[OF Decomp.IH[OF Decomp.prems], of \"decomp (Fun f T)\"]\n to_st_append[of \"A@D\" \"[Decomp (Fun f T)]\"]\n by auto\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_model_c:\n assumes \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ A\"\n shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\ (A@D)\"\nusing assms\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp D f T K M) show ?case\n using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF Decomp.IH[OF Decomp.prems] _ Decomp.hyps(3)]\n Decomp.hyps(5,6) ideduct_synth_mono ik\\<^sub>e\\<^sub>s\\<^sub>t_append\n by (metis (mono_tags, lifting) List.append_assoc image_Un sup_ge1)\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_aux:\n assumes \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ t\" \"\\(M \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\\\<^sub>c t)\"\n obtains D' where\n \"D@D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\\\<^sub>c t\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\"\nproof -\n have \"\\D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>c t\" using assms(2)\n proof (induction t rule: intruder_deduct_induct)\n case (Compose X f)\n from Compose.IH have \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\. \\x \\ set X. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\\\<^sub>c x\"\n proof (induction X)\n case (Cons t X)\n then obtain D' D'' where\n D': \"D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>c t\" and\n D'': \"D'' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"\\x \\ set X. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\\\<^sub>c x\"\n by moura\n hence \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c t\" \"\\x \\ set X. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c x\"\n by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n thus ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] by (metis set_ConsD)\n qed (auto intro: decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil)\n thus ?case using intruder_synth.ComposeC[OF Compose.hyps(1,2)] by metis\n next\n case (Decompose t K T t\\<^sub>i)\n have \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\. \\k \\ set K. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\\\<^sub>c k\" using Decompose.IH\n proof (induction K)\n case (Cons t X)\n then obtain D' D'' where\n D': \"D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>c t\" and\n D'': \"D'' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"\\x \\ set X. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\\\<^sub>c x\"\n using assms(1) by moura\n hence \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c t\" \"\\x \\ set X. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c x\"\n by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n thus ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] by auto\n qed auto\n then obtain D' where D': \"D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"\\k. k \\ set K \\ M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>c k\" by metis\n obtain D'' where D'': \"D'' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\\\<^sub>c t\" by (metis Decompose.IH(1))\n obtain f X where fX: \"t = Fun f X\" \"t\\<^sub>i \\ set X\"\n using Decompose.hyps(2,4) by (cases t) (auto dest: Ana_fun_subterm)\n\n from decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] D'(2) D''(2) have *:\n \"D'@D'' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\" \"\\k. k \\ set K \\ M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c k\"\n \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>c t\"\n by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n hence **: \"\\k. k \\ set K \\ M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\"\n using ideduct_synth_subst by auto\n\n have \"t\\<^sub>i \\ ik\\<^sub>s\\<^sub>t (decomp t)\" using Decompose.hyps(2,4) ik_rcv_map unfolding decomp_def by auto\n with *(3) fX(1) Decompose.hyps(2) show ?case\n proof (induction t rule: intruder_synth_induct)\n case (AxiomC t)\n hence t_in_subterms: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\ N)\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset[OF *(1)] subset_subterms_Union\n by auto\n have \"M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\\"\n using ideduct_synth_subst[OF intruder_synth.AxiomC[OF AxiomC.hyps(1)]] by metis\n moreover have \"T \\ []\" using decomp_ik[OF \\Ana t = (K,T)\\] \\t\\<^sub>i \\ ik\\<^sub>s\\<^sub>t (decomp t)\\ by auto\n ultimately have \"D'@D''@[Decomp (Fun f X)] \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\\"\n using AxiomC decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF *(1) _ _ _ _ **] subset_subterms_Union t_in_subterms\n by (simp add: subset_eq)\n moreover have \"decomp t = to_st [Decomp (Fun f X)]\" using AxiomC.prems(1,2) by auto\n ultimately show ?case\n by (metis AxiomC.prems(3) UnCI intruder_synth.AxiomC ik\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n qed (auto intro!: fX(2) *(1))\n qed (fastforce intro: intruder_synth.AxiomC assms(1))\n hence \"\\D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\. M \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\\\<^sub>c t\"\n by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n thus thesis using that[OF decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF assms(1)]] assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by moura\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_max_exist:\n assumes \"finite A\" \"finite N\"\n shows \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. \\D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\nproof -\n let ?IK = \"\\M. \\D \\ M. ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n have \"?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\) \\ (\\t \\ A \\ N. subterms t)\" by (auto dest!: decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset)\n hence \"finite (?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\))\"\n using subterms_union_finite[OF assms(1)] subterms_union_finite[OF assms(2)] infinite_super\n by auto\n then obtain M where M: \"finite M\" \"M \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" \"?IK M = ?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\)\"\n using finite_subset_Union by moura\n show ?thesis using decomps\\<^sub>e\\<^sub>s\\<^sub>t_finite_ik_append[OF M(1,2)] M(3) by auto\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist:\n assumes \"finite A\" \"finite N\"\n shows \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. \\t. A \\ t \\ A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\\\<^sub>c t\"\nproof (rule ccontr)\n assume neg: \"\\(\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. \\t. A \\ t \\ A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\\\<^sub>c t)\"\n\n obtain D where D: \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" \"\\D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\. ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_max_exist[OF assms] by moura\n then obtain t where t: \"A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ t\" \"\\(A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\\\<^sub>c t)\"\n using neg by (fastforce intro: ideduct_mono)\n\n obtain D' where D':\n \"D@D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\\" \"A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\\\<^sub>c t\"\n \"A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\"\n by (metis decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_aux t D(1))\n hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\" using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n moreover have \"ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D\" using D(2) D'(1) by auto\n ultimately show False by simp\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst:\n assumes \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\"\n and \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ A\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} A\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n and \"well_analyzed A\"\n shows \"\\D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\. ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\\"\nproof -\n have ik_eq: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" using assms(5,6)\n proof (induction A rule: List.rev_induct)\n case (snoc a A)\n hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using Ana_invar_subst_subset[OF snoc.prems(1)] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n unfolding Ana_invar_subst_def by simp\n with snoc have IH:\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a] \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t ([a] \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using well_analyzed_split_left[OF snoc.prems(2)]\n by (auto simp add: to_st_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst)\n\n have \"ik\\<^sub>e\\<^sub>s\\<^sub>t [a \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\] = ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n proof (cases a)\n case (Step b) thus ?thesis by (cases b) auto\n next\n case (Decomp t)\n then obtain f T where t: \"t = Fun f T\" using well_analyzedD[OF snoc.prems(2)] by force\n obtain K M where Ana_t: \"Ana (Fun f T) = (K,M)\" by (metis surj_pair)\n moreover have \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a])))\"\n using t Decomp snoc.prems(2)\n by (auto dest: well_analyzed_inv simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n hence \"Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\n using Ana_t snoc.prems(1)\n unfolding Ana_invar_subst_def by blast\n ultimately show ?thesis using Decomp t by (auto simp add: decomp_ik)\n qed\n thus ?case using IH unfolding subst_apply_extstrand_def by simp\n qed simp\n moreover have assignment_rhs_eq: \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using assms(5,6)\n proof (induction A rule: List.rev_induct)\n case (snoc a A)\n hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using Ana_invar_subst_subset[OF snoc.prems(1)] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n unfolding Ana_invar_subst_def by simp\n hence \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using snoc.IH well_analyzed_split_left[OF snoc.prems(2)]\n by simp\n hence IH:\n \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a] \\\\<^sub>e\\<^sub>s\\<^sub>t \\) = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t ([a] \\\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a] \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n by (metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(1), metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\n\n have \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a \\\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\] = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n proof (cases a)\n case (Step b) thus ?thesis by (cases b) auto\n next\n case (Decomp t)\n then obtain f T where t: \"t = Fun f T\" using well_analyzedD[OF snoc.prems(2)] by force\n obtain K M where Ana_t: \"Ana (Fun f T) = (K,M)\" by (metis surj_pair)\n moreover have \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a])))\"\n using t Decomp snoc.prems(2)\n by (auto dest: well_analyzed_inv simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n hence \"Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\n using Ana_t snoc.prems(1) unfolding Ana_invar_subst_def by blast\n ultimately show ?thesis using Decomp t by (auto simp add: decomp_assignment_rhs_empty)\n qed\n thus ?case using IH unfolding subst_apply_extstrand_def by simp\n qed simp\n ultimately obtain D where D:\n \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) Var\"\n \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\\\<^sub>c t \\ \\\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist[OF ik\\<^sub>e\\<^sub>s\\<^sub>t_finite assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_finite, of \"A \\\\<^sub>e\\<^sub>s\\<^sub>t \\\" \"A \\\\<^sub>e\\<^sub>s\\<^sub>t \\\"]\n ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append assms(1)\n by force\n\n let ?P = \"\\D D'. \\t. (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\\\<^sub>c t \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t\"\n\n have \"\\D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\. ?P D D'\" using D(1)\n proof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case Nil\n have \"ik\\<^sub>e\\<^sub>s\\<^sub>t [] = ik\\<^sub>e\\<^sub>s\\<^sub>t [] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by auto\n thus ?case by (metis decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil)\n next\n case (Decomp D f T K M)\n obtain D' where D': \"D' \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\" \"?P D D'\"\n using Decomp.IH by auto\n hence IH: \"\\k. k \\ set K \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c k\"\n \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c Fun f T\"\n using Decomp.hyps(5,6) by auto\n\n have D'_ik: \"ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset[OF D'(1)] by (metis subst_all_mono, metis)\n\n show ?case using IH(2,1) Decomp.hyps(2,3,4)\n proof (induction \"Fun f T\" arbitrary: f T K M rule: intruder_synth_induct)\n case (AxiomC f T)\n then obtain s where s: \"s \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D'\" \"Fun f T = s \\ \\\" using AxiomC.prems by blast\n hence fT_s_in: \"Fun f T \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using AxiomC D'_ik subset_subterms_Union[of \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A\"]\n subst_all_mono[OF subset_subterms_Union, of \\]\n by (metis (no_types) Un_iff image_eqI subset_Un_eq, metis (no_types) Un_iff subset_Un_eq)\n obtain Ks Ms where Ana_s: \"Ana s = (Ks,Ms)\" by moura\n\n have AD'_props: \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} (A@D')\" \"\\{}; to_st (A@D')\\\\<^sub>c \\\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_model_c[OF D'(1) assms(2)]\n decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_wf[OF D'(1) assms(3)]\n sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st strand_sem_eq_defs(1)\n by auto\n\n show ?case\n proof (cases s)\n case (Var x)\n \\ \\In this case \\\\ x\\ (is a subterm of something that) was derived from an\n \"earlier intruder knowledge\" because \\A\\ is well-formed and has \\\\\\ as a model.\n So either the intruder composed \\Fun f T\\ himself (making \\Decomp (Fun f T)\\\n unnecessary) or \\Fun f T\\ is an instance of something else in the intruder\n knowledge (in which case the \"something\" can be used in place of \\Fun f T\\)\\\n hence \"Var x \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')\" \"\\ x = Fun f T\" using s ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n\n show ?thesis\n proof (cases \"\\m \\ set M. ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c m\")\n case True\n \\ \\All terms acquired by decomposing \\Fun f T\\ are already derivable.\n Hence there is no need to consider decomposition of \\Fun f T\\ at all.\\\n have *: \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ set M\"\n using decomp_ik[OF \\Ana (Fun f T) = (K,M)\\] ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f T)]\"]\n by auto\n\n { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ set M \\\\<^sub>c t'\"\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\"\n proof (induction t' rule: intruder_synth_induct)\n case (AxiomC t') thus ?case\n proof\n assume \"t' \\ set M\"\n moreover have \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by auto\n ultimately show ?case using True by auto\n qed (metis D'(2) intruder_synth.AxiomC)\n qed auto\n }\n thus ?thesis using D'(1) * by metis\n next\n case False\n \\ \\Some term acquired by decomposition of \\Fun f T\\ cannot be derived in \\\\\\<^sub>c\\.\n \\Fun f T\\ must therefore be an instance of something else in the intruder knowledge,\n because of well-formedness.\\\n then obtain t\\<^sub>i where t\\<^sub>i: \"t\\<^sub>i \\ set T\" \"\\ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D') \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t\\<^sub>i\"\n using Ana_fun_subterm[OF \\Ana (Fun f T) = (K,M)\\] by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n obtain S where fS:\n \"Fun f S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')) \\\n Fun f S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@D'))\"\n \"\\ x = Fun f S \\ \\\"\n using strand_sem_wf_ik_or_assignment_rhs_fun_subterm[\n OF AD'_props \\Var x \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')\\ _ t\\<^sub>i \\interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\]\n \\\\ x = Fun f T\\\n by moura\n hence fS_in: \"Fun f S \\ \\ \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n \"Fun f S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using imageI[OF s(1), of \"\\x. x \\ \\\"] Var\n ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of A D'] assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append[of A D']\n decomps\\<^sub>e\\<^sub>s\\<^sub>t_subterms[OF D'(1)] decomps\\<^sub>e\\<^sub>s\\<^sub>t_assignment_rhs_empty[OF D'(1)]\n by auto\n obtain KS MS where Ana_fS: \"Ana (Fun f S) = (KS, MS)\" by moura\n hence \"K = KS \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\" \"M = MS \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\"\n using Ana_invar_substD[OF assms(5) fS_in(2)]\n s(2) fS(2) \\s = Var x\\ \\Ana (Fun f T) = (K,M)\\\n by simp_all\n hence \"MS \\ []\" using \\M \\ []\\ by simp\n have \"\\k. k \\ set KS \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c k \\ \\\"\n using AxiomC.prems(1) \\K = KS \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\\ by (simp add: image_Un)\n hence D'': \"D'@[Decomp (Fun f S)] \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF D'(1) fS_in(2) Ana_fS \\MS \\ []\\] AxiomC.prems(1)\n intruder_synth.AxiomC[OF fS_in(1)]\n by simp\n moreover {\n fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\\\<^sub>c t'\"\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun f S)]) \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\"\n proof (induction t' rule: intruder_synth_induct)\n case (AxiomC t')\n hence \"t' \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n by (simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n thus ?case\n proof\n assume \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n hence \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using decomp_ik \\Ana (Fun f T) = (K,M)\\ \\Ana (Fun f S) = (KS,MS)\\ \\M = MS \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\\\n by simp\n thus ?case\n using ideduct_synth_mono[\n OF intruder_synth.AxiomC[of t' \"ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"],\n of \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun f S)]) \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"]\n by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n next\n assume \"t' \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\"\n by (metis D'(2) intruder_synth.AxiomC)\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\"\n by (simp add: ideduct_synth_mono)\n thus ?case\n using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D' \"[Decomp (Fun f S)]\"]\n image_Un[of \"\\x. x \\ \\\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t D'\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)]\"]\n by (simp add: sup_aci(2))\n qed\n qed auto\n }\n ultimately show ?thesis using D'' by auto\n qed\n next\n case (Fun g S) \\ \\Hence \\Decomp (Fun f T)\\ can be substituted for \\Decomp (Fun g S)\\\\\n hence KM: \"K = Ks \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\" \"M = Ms \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\" \"set K = set Ks \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"set M = set Ms \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using fT_s_in(2) \\Ana (Fun f T) = (K,M)\\ Ana_s s(2)\n Ana_invar_substD[OF assms(5), of g S]\n by auto\n hence Ms_nonempty: \"Ms \\ []\" using \\M \\ []\\ by auto\n { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\\\<^sub>c t'\"\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun g S)]) \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\" using AxiomC\n proof (induction t' rule: intruder_synth_induct)\n case (AxiomC t')\n hence \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ t' \\ set M\"\n by (simp add: decomp_ik ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n thus ?case\n proof (elim disjE)\n assume \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n hence *: \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\" using D'(2) by simp\n show ?case by (auto intro: ideduct_synth_mono[OF *] simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\n next\n assume \"t' \\ set M\"\n hence \"t' \\ ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun g S)] \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using KM(2) Fun decomp_ik[OF Ana_s] by auto\n thus ?case by (simp add: image_Un ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n qed (simp add: ideduct_synth_mono[OF intruder_synth.AxiomC])\n qed auto\n }\n thus ?thesis\n using s Fun Ana_s AxiomC.prems(1) KM(3) fT_s_in\n decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF D'(1) _ _ Ms_nonempty, of g S Ks]\n by (metis AxiomC.hyps image_Un image_eqI intruder_synth.AxiomC)\n qed\n next\n case (ComposeC T f)\n have *: \"\\m. m \\ set M \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c m\"\n using Ana_fun_subterm[OF \\Ana (Fun f T) = (K, M)\\] ComposeC.hyps(3)\n by auto\n\n have **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) = ik\\<^sub>e\\<^sub>s\\<^sub>t D \\ set M\"\n using decomp_ik[OF \\Ana (Fun f T) = (K, M)\\] ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n\n { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\\\<^sub>c t'\"\n hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>c t'\"\n by (induct rule: intruder_synth_induct) (auto simp add: D'(2) * **)\n }\n thus ?case using D'(1) by auto\n qed\n qed\n thus ?thesis using D(2) assms(1) by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_nil: assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\ []) \\\"\nusing assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_snd:\n assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"send\\t\\\\<^sub>s\\<^sub>t#S \\ \\\"\n shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S)) (\\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n let ?S = \"send\\t\\\\<^sub>s\\<^sub>t#S\"\n let ?A = \"\\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n\n have \\: \"\\S'. S' \\ update\\<^sub>s\\<^sub>t \\ ?S \\ S' = S \\ S' \\ \\\" by auto\n\n have 1: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n ultimately have 3: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis wf_vars_mono)\n\n have 4: \"\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\)\n\n have \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. \\S' \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\)\n\n have \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t ?S = {}\"\n using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\" \"\\S' \\ \\. fv t \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n using to_st_append by fastforce+\n\n have *: \"\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n hence \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\)\n\n have **: \"\\S \\ \\. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_rcv:\n assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\\"\n shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S)) (\\@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n let ?S = \"receive\\t\\\\<^sub>s\\<^sub>t#S\"\n let ?A = \"\\@[Step (send\\t\\\\<^sub>s\\<^sub>t)]\"\n\n have \\: \"\\S'. S' \\ update\\<^sub>s\\<^sub>t \\ ?S \\ S' = S \\ S' \\ \\\" by auto\n\n have 1: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n ultimately have 3: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis wf_vars_mono)\n\n have 4: \"\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\)\n\n have \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. \\S' \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\)\n\n have \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t ?S = {}\"\n using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\" \"\\S' \\ \\. fv t \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n using to_st_append by fastforce+\n\n have *: \"\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n hence \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\)\n\n have **: \"\\S \\ \\. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_eq:\n assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\\"\n shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S)) (\\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n let ?S = \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S\"\n let ?A = \"\\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\"\n\n have \\: \"\\S'. S' \\ update\\<^sub>s\\<^sub>t \\ ?S \\ S' = S \\ S' \\ \\\" by auto\n\n have 1: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n moreover have 2:\n \"a = Assign \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t \\ fv t'\"\n \"a = Check \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n ultimately have 3: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\"\n by (cases a) (metis wf_vars_mono, metis)\n\n have 4: \"\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by (cases a) auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\)\n\n have \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. \\S' \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\)\n\n have \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t ?S = {}\"\n using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ fv t \\ fv t'\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\"\n \"\\S' \\ \\. fv t \\ bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\S' \\ \\. fv t' \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n using to_st_append by fastforce+\n\n have *: \"\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n hence \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\)\n\n have **: \"\\S \\ \\. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_ineq:\n assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\\"\n shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S)) (\\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n let ?S = \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S\"\n let ?A = \"\\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"\n\n have \\: \"\\S'. S' \\ update\\<^sub>s\\<^sub>t \\ ?S \\ S' = S \\ S' \\ \\\" by auto\n\n have 1: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n ultimately have 3: \"\\S \\ \\. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by metis\n\n have 4: \"\\S \\ \\. \\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\)\n\n have \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. \\S' \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\)\n\n have \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\S' \\ \\. fv\\<^sub>s\\<^sub>t S' \\ bvars\\<^sub>s\\<^sub>t ?S = {}\"\n using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n moreover have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\ fv\\<^sub>s\\<^sub>t (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t # S)\" by auto\n ultimately have 5:\n \"\\S' \\ \\. (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X) \\ bvars\\<^sub>s\\<^sub>t S' = {}\"\n \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = set X \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\"\n \"\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ set X = {}\"\n using to_st_append\n by (blast, force, force, force)\n\n have *: \"\\S \\ \\. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using 5(3,4) assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by blast\n hence \"fv\\<^sub>s\\<^sub>t ?S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n hence \"fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\)\n\n have **: \"\\S \\ \\. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using 5(1,2) assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by auto\n thus \"\\S \\ update\\<^sub>s\\<^sub>t \\ ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq:\n assumes \"x#S \\ \\\"\n shows \"\\(trms\\<^sub>s\\<^sub>t ` update\\<^sub>s\\<^sub>t \\ (x#S)) \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x = \\(trms\\<^sub>s\\<^sub>t ` \\)\" (is \"?A = ?B\")\nproof\n show \"?B \\ ?A\"\n proof\n have \"trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ trms\\<^sub>s\\<^sub>t (x#S)\" by auto\n hence \"\\t'. t' \\ ?B \\ t' \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ t' \\ ?A\" by simp\n moreover {\n fix t' assume t': \"t' \\ ?B\" \"t' \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n then obtain S' where S': \"t' \\ trms\\<^sub>s\\<^sub>t S'\" \"S' \\ \\\" by auto\n hence \"S' = x#S \\ S' \\ update\\<^sub>s\\<^sub>t \\ (x#S)\" by auto\n moreover {\n assume \"S' = x#S\"\n hence \"t' \\ trms\\<^sub>s\\<^sub>t S\" using S' t' by simp\n hence \"t' \\ ?A\" by auto\n }\n ultimately have \"t' \\ ?A\" using t' S' by auto\n }\n ultimately show \"\\t'. t' \\ ?B \\ t' \\ ?A\" by metis\n qed\n\n show \"?A \\ ?B\"\n proof\n have \"\\t'. t' \\ ?A \\ t' \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ ?B\"\n using assms by force+\n moreover {\n fix t' assume t': \"t' \\ ?A\" \"t' \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n then obtain S' where \"t' \\ trms\\<^sub>s\\<^sub>t S'\" \"S' \\ update\\<^sub>s\\<^sub>t \\ (x#S)\" by auto\n hence \"S' = S \\ S' \\ \\\" by auto\n moreover have \"trms\\<^sub>s\\<^sub>t S \\ ?B\" using assms trms\\<^sub>s\\<^sub>t_cons[of x S] by blast\n ultimately have \"t' \\ ?B\" using t' by fastforce\n }\n ultimately show \"\\t'. t' \\ ?A \\ t' \\ ?B\" by blast\n qed\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_snd:\n assumes \"send\\t\\\\<^sub>s\\<^sub>t#S \\ \\\" \"\\' = update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S)\" \"\\' = \\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) = (\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\nproof -\n have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ {t}\" \"\\(trms\\<^sub>s\\<^sub>t ` \\') \\ {t} = \\(trms\\<^sub>s\\<^sub>t ` \\)\"\n using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n thus ?thesis\n by (metis (no_types, lifting) Un_insert_left Un_insert_right sup_bot.right_neutral)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_rcv:\n assumes \"receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\\" \"\\' = update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S)\" \"\\' = \\@[Step (send\\t\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) = (\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\nproof -\n have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ {t}\" \"\\(trms\\<^sub>s\\<^sub>t ` \\') \\ {t} = \\(trms\\<^sub>s\\<^sub>t ` \\)\"\n using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n thus ?thesis\n by (metis (no_types, lifting) Un_insert_left Un_insert_right sup_bot.right_neutral)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_eq:\n assumes \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\\" \"\\' = update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S)\" \"\\' = \\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) = (\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\nproof -\n have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ {t,t'}\" \"\\(trms\\<^sub>s\\<^sub>t ` \\') \\ {t,t'} = \\(trms\\<^sub>s\\<^sub>t ` \\)\"\n using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n thus ?thesis\n by (metis (no_types, lifting) Un_insert_left Un_insert_right sup_bot.right_neutral)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_ineq:\n assumes \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\\" \"\\' = update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S)\" \"\\' = \\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) = (\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\nproof -\n have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\" \"\\(trms\\<^sub>s\\<^sub>t ` \\') \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F = \\(trms\\<^sub>s\\<^sub>t ` \\)\"\n using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n thus ?thesis by (simp add: Un_commute sup_left_commute)\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset:\n assumes \"x#S \\ \\\"\n shows \"\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\ (x#S))) \\ \\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)\" (is ?A)\n \"\\(assignment_rhs\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\ (x#S))) \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)\" (is ?B)\nproof -\n { fix t assume \"t \\ \\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\ (x#S)))\"\n then obtain S' where S': \"S' \\ update\\<^sub>s\\<^sub>t \\ (x#S)\" \"t \\ ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t S')\" by auto\n\n have *: \"ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t S) \\ ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t (x#S))\"\n using ik_append[of \"dual\\<^sub>s\\<^sub>t [x]\" \"dual\\<^sub>s\\<^sub>t S\"] dual\\<^sub>s\\<^sub>t_append[of \"[x]\" S]\n by auto\n\n hence \"t \\ \\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)\"\n proof (cases \"S' = S\")\n case True thus ?thesis using * assms S' by auto\n next\n case False thus ?thesis using S' by auto\n qed\n }\n moreover\n { fix t assume \"t \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\ (x#S)))\"\n then obtain S' where S': \"S' \\ update\\<^sub>s\\<^sub>t \\ (x#S)\" \"t \\ assignment_rhs\\<^sub>s\\<^sub>t S'\" by auto\n\n have \"assignment_rhs\\<^sub>s\\<^sub>t S \\ assignment_rhs\\<^sub>s\\<^sub>t (x#S)\"\n using assignment_rhs_append[of \"[x]\" S] by simp\n hence \"t \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)\"\n using assms S' by (cases \"S' = S\") auto\n }\n ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_snd:\n assumes \"send\\t\\\\<^sub>s\\<^sub>t#S \\ \\\"\n \"\\' = update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S)\"\n \"\\' = \\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?A)\n \"(\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?B)\nproof -\n { fix t' assume t'_in: \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ {t}\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n moreover have \"t \\ \\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)\" using assms(1) by force\n ultimately have \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n moreover\n { fix t' assume t'_in: \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_rcv:\n assumes \"receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\\"\n \"\\' = update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S)\"\n \"\\' = \\@[Step (send\\t\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?A)\n \"(\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?B)\nproof -\n { fix t' assume t'_in: \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n moreover\n { fix t' assume t'_in: \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_eq:\n assumes \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\\"\n \"\\' = update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S)\"\n \"\\' = \\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?A)\n \"(\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?B)\nproof -\n have 1: \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n when \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n for t'\n proof -\n have \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" using that assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n thus ?thesis using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n qed\n\n have 2: \"t'' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n when \"t'' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\')\" \"a = Assign\"\n for t''\n proof -\n have \"t'' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\) \\ {t'}\"\n using that assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n moreover have \"t' \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)\" using assms(1) that by force\n ultimately show ?thesis using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) that by auto\n qed\n\n have 3: \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\' = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\\" (is ?C)\n \"(\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\))\" (is ?D)\n when \"a = Check\"\n proof -\n show ?C using that assms(2,3) by (simp add: assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n show ?D using assms(1,2,3) ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset(2) by auto\n qed\n\n show ?A using 1 2 by (metis subsetI)\n show ?B using 1 2 3 by (cases a) blast+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_ineq:\n assumes \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\\"\n \"\\' = update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S)\"\n \"\\' = \\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\"\n shows \"(\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?A)\n \"(\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\') \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\" (is ?B)\nproof -\n { fix t' assume t'_in: \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\')) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence \"t' \\ (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\)) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n moreover\n { fix t' assume t'_in: \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\')) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n hence \"t' \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\)) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\"\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n }\n ultimately show ?A ?B by (metis subsetI)+\nqed\n\n\nsubsubsection \\Transition Systems Definitions\\\ninductive pts_symbolic::\n \"(('fun,'var) strands \\ ('fun,'var) strand) \\\n (('fun,'var) strands \\ ('fun,'var) strand) \\ bool\"\n(infix \"\\\\<^sup>\\\" 50) where\n Nil[simp]: \"[] \\ \\ \\ (\\,\\) \\\\<^sup>\\ (update\\<^sub>s\\<^sub>t \\ [],\\)\"\n| Send[simp]: \"send\\t\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\ (update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S),\\@[receive\\t\\\\<^sub>s\\<^sub>t])\"\n| Receive[simp]: \"receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\ (update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S),\\@[send\\t\\\\<^sub>s\\<^sub>t])\"\n| Equality[simp]: \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\ (update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S),\\@[\\a: t \\ t'\\\\<^sub>s\\<^sub>t])\"\n| Inequality[simp]: \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\ (update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S),\\@[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t])\"\n\nprivate inductive pts_symbolic_c::\n \"(('fun,'var) strands \\ ('fun,'var) extstrand) \\\n (('fun,'var) strands \\ ('fun,'var) extstrand) \\ bool\"\n(infix \"\\\\<^sup>\\\\<^sub>c\" 50) where\n Nil[simp]: \"[] \\ \\ \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (update\\<^sub>s\\<^sub>t \\ [],\\)\"\n| Send[simp]: \"send\\t\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S),\\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\"\n| Receive[simp]: \"receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S),\\@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\n| Equality[simp]: \"\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S),\\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\"\n| Inequality[simp]: \"\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\ \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S),\\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\"\n| Decompose[simp]: \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)\n \\ (\\,\\) \\\\<^sup>\\\\<^sub>c (\\,\\@[Decomp (Fun f T)])\"\n\nabbreviation pts_symbolic_rtrancl (infix \"\\\\<^sup>\\\\<^sup>*\" 50) where \"a \\\\<^sup>\\\\<^sup>* b \\ pts_symbolic\\<^sup>*\\<^sup>* a b\"\nprivate abbreviation pts_symbolic_c_rtrancl (infix \"\\\\<^sup>\\\\<^sub>c\\<^sup>*\" 50) where \"a \\\\<^sup>\\\\<^sub>c\\<^sup>* b \\ pts_symbolic_c\\<^sup>*\\<^sup>* a b\"\n\nlemma pts_symbolic_induct[consumes 1, case_names Nil Send Receive Equality Inequality]:\n assumes \"(\\,\\) \\\\<^sup>\\ (\\',\\')\"\n and \"\\[] \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ []; \\' = \\\\ \\ P\"\n and \"\\t S. \\send\\t\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S); \\' = \\@[receive\\t\\\\<^sub>s\\<^sub>t]\\ \\ P\"\n and \"\\t S. \\receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S); \\' = \\@[send\\t\\\\<^sub>s\\<^sub>t]\\ \\ P\"\n and \"\\a t t' S. \\\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S); \\' = \\@[\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\\ \\ P\"\n and \"\\X F S. \\\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S); \\' = \\@[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\\ \\ P\"\n shows \"P\"\napply (rule pts_symbolic.cases[OF assms(1)])\nusing assms(2,3,4,5,6) by simp_all\n\nprivate lemma pts_symbolic_c_induct[consumes 1, case_names Nil Send Receive Equality Inequality Decompose]:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c (\\',\\')\"\n and \"\\[] \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ []; \\' = \\\\ \\ P\"\n and \"\\t S. \\send\\t\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (send\\t\\\\<^sub>s\\<^sub>t#S); \\' = \\@[Step (receive\\t\\\\<^sub>s\\<^sub>t)]\\ \\ P\"\n and \"\\t S. \\receive\\t\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (receive\\t\\\\<^sub>s\\<^sub>t#S); \\' = \\@[Step (send\\t\\\\<^sub>s\\<^sub>t)]\\ \\ P\"\n and \"\\a t t' S. \\\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S); \\' = \\@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)]\\ \\ P\"\n and \"\\X F S. \\\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S \\ \\; \\' = update\\<^sub>s\\<^sub>t \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S); \\' = \\@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)]\\ \\ P\"\n and \"\\f T. \\Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\); \\' = \\; \\' = \\@[Decomp (Fun f T)]\\ \\ P\"\n shows \"P\"\napply (rule pts_symbolic_c.cases[OF assms(1)])\nusing assms(2,3,4,5,6,7) by simp_all\n\nprivate lemma pts_symbolic_c_preserves_wf_prot:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\"\n shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\' \\'\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Decompose\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\1\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n using bvars_decomp ik_assignment_rhs_decomp_fv by metis+\n thus ?case using Decompose unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\n by (metis wf_vars_mono wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2))\n qed (metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_nil, metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_snd,\n metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_rcv, metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_eq,\n metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_ineq)\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_wf_is:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"wf\\<^sub>s\\<^sub>t V (to_st \\)\"\n shows \"wf\\<^sub>s\\<^sub>t V (to_st \\')\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n hence \"(\\, \\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\2, \\2)\" by auto\n hence *: \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\1 \\1\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\2 \\2\"\n using pts_symbolic_c_preserves_wf_prot[OF _ step.prems(1)] step.hyps(1)\n by auto\n\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Nil thus ?case by auto\n next\n case (Send t S)\n hence \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\1) (receive\\t\\\\<^sub>s\\<^sub>t#(dual\\<^sub>s\\<^sub>t S))\"\n using *(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fastforce\n hence \"fv t \\ wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\1) \\ V\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t by auto\n thus ?case using Send wf_rcv_append''' to_st_append by simp\n next\n case (Receive t) thus ?case using wf_snd_append to_st_append by simp\n next\n case (Equality a t t' S)\n hence \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\1) (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#(dual\\<^sub>s\\<^sub>t S))\"\n using *(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fastforce\n hence \"fv t' \\ wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\1) \\ V\" when \"a = Assign\"\n using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t that by auto\n thus ?case using Equality wf_eq_append''' to_st_append by (cases a) auto\n next\n case (Inequality t t' S) thus ?case using wf_ineq_append'' to_st_append by simp\n next\n case (Decompose f T)\n hence \"fv (Fun f T) \\ wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n by (metis fv_subterms_set fv_subset subset_trans\n ik\\<^sub>s\\<^sub>t_assignment_rhs\\<^sub>s\\<^sub>t_wfrestrictedvars_subset)\n hence \"vars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\ wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\1) \\ V\"\n using decomp_vars[of \"Fun f T\"] wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t[of \\1] by auto\n thus ?case\n using to_st_append[of \\1 \"[Decomp (Fun f T)]\"]\n wf_append_suffix[OF Decompose.prems] Decompose.hyps(3)\n by (metis append_Nil2 decomp_vars(1,2) to_st.simps(1,3))\n qed\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>e\\<^sub>t:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\"\n and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\))\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\(trms\\<^sub>s\\<^sub>t ` \\)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\))\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\')) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\(trms\\<^sub>s\\<^sub>t ` \\')) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\'))\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Nil\n hence \"\\(trms\\<^sub>s\\<^sub>t ` \\1) = \\(trms\\<^sub>s\\<^sub>t ` \\2)\" by force\n thus ?case using Nil by metis\n next\n case (Decompose f T)\n obtain t where t: \"t \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1\" \"Fun f T \\ t\"\n using Decompose.hyps(1) by auto\n have t_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using Decompose.prems wf_trm_subterm[of _ t]\n trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI[OF t(1)]\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def\n by (metis UN_E Un_iff)\n have \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1)\" using trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI t by auto\n hence \"Fun f T \\ SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n by (metis (no_types) SMP.MP SMP.Subterm UN_E t(2))\n hence \"{Fun f T} \\ SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1)\" using SMP.Subterm[of \"Fun f T\"] by auto\n moreover have \"trms\\<^sub>e\\<^sub>s\\<^sub>t \\2 = insert (Fun f T) (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n using Decompose.hyps(3) by auto\n ultimately have *: \"SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1) = SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\2)\"\n using SMP_subset_union_eq[of \"{Fun f T}\"]\n by (simp add: Un_commute)\n hence \"SMP ((\\(trms\\<^sub>s\\<^sub>t ` \\1)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\1)) = SMP ((\\(trms\\<^sub>s\\<^sub>t ` \\2)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\2))\"\n using Decompose.hyps(2) SMP_union by auto\n moreover have \"\\t \\ trms\\<^sub>e\\<^sub>s\\<^sub>t \\1. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n using Decompose.prems wf_trm_subterm t(2) t_wf unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by auto\n hence \"\\t \\ trms\\<^sub>e\\<^sub>s\\<^sub>t \\2. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by (metis * SMP.MP SMP_wf_trm)\n hence \"\\t \\ (\\(trms\\<^sub>s\\<^sub>t ` \\2)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\2). wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using Decompose.prems Decompose.hyps(2) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by force\n ultimately show ?thesis using Decompose.prems unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by presburger\n qed (metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_snd, metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_rcv,\n metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_eq, metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_ineq)\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>t\\<^sub>p:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"\\S \\ \\ \\ {to_st \\}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n shows \"\\S \\ \\' \\ {to_st \\'}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Nil\n have 1: \"\\S \\ {to_st \\2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Nil by simp\n have 2: \"\\2 = \\1 - {[]}\" \"\\S \\ \\1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Nil by simp_all\n have \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n proof\n fix S assume \"S \\ \\2\"\n hence \"S \\ \\1\" using 2(1) by simp\n thus \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using 2(2) by simp\n qed\n thus ?case using 1 by auto\n next\n case (Send t S)\n have 1: \"\\S \\ {to_st \\2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Send by (simp add: to_st_append)\n have 2: \"\\2 = insert S (\\1 - {send\\t\\\\<^sub>s\\<^sub>t#S})\" \"\\S \\ \\1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Send by simp_all\n have 3: \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n proof\n fix S' assume \"S' \\ \\2\"\n hence \"S' \\ \\1 \\ S' = S\" using 2(1) by auto\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Send.hyps 2(2) by auto\n ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 2(2) by blast\n qed\n thus ?case using 1 by auto\n next\n case (Receive t S)\n have 1: \"\\S \\ {to_st \\2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Receive by (simp add: to_st_append)\n have 2: \"\\2 = insert S (\\1 - {receive\\t\\\\<^sub>s\\<^sub>t#S})\" \"\\S \\ \\1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using Receive by simp_all\n have 3: \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n proof\n fix S' assume \"S' \\ \\2\"\n hence \"S' \\ \\1 \\ S' = S\" using 2(1) by auto\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Receive.hyps 2(2) by auto\n ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 2(2) by blast\n qed\n show ?case using 1 3 by auto\n next\n case (Equality a t t' S)\n have 1: \"to_st \\2 = to_st \\1@[\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\1)\"\n using Equality by (simp_all add: to_st_append)\n have 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p [\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\" using Equality by fastforce\n have 3: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\2)\"\n using tfr_stp_all_append[of \"to_st \\1\" \"[\\a: t \\ t'\\\\<^sub>s\\<^sub>t]\"] 1 2 by metis\n hence 4: \"\\S \\ {to_st \\2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Equality by simp\n have 5: \"\\2 = insert S (\\1 - {\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S})\" \"\\S \\ \\1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using Equality by simp_all\n have 6: \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n proof\n fix S' assume \"S' \\ \\2\"\n hence \"S' \\ \\1 \\ S' = S\" using 5(1) by auto\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Equality.hyps 5(2) by auto\n ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 5(2) by blast\n qed\n thus ?case using 4 by auto\n next\n case (Inequality X F S)\n have 1: \"to_st \\2 = to_st \\1@[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\1)\"\n using Inequality by (simp_all add: to_st_append)\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S)\" using Inequality(1,4) by blast\n hence 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p [\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\" by simp\n have 3: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\2)\"\n using tfr_stp_all_append[of \"to_st \\1\" \"[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\"] 1 2 by metis\n hence 4: \"\\S \\ {to_st \\2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Inequality by simp\n have 5: \"\\2 = insert S (\\1 - {\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S})\" \"\\S \\ \\1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using Inequality by simp_all\n have 6: \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n proof\n fix S' assume \"S' \\ \\2\"\n hence \"S' \\ \\1 \\ S' = S\" using 5(1) by auto\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Inequality.hyps 5(2) by auto\n ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 5(2) by blast\n qed\n thus ?case using 4 by auto\n next\n case (Decompose f T)\n hence 1: \"\\S \\ \\2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" by blast\n have 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\1)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st [Decomp (Fun f T)])\"\n using Decompose.prems decomp_tfr\\<^sub>s\\<^sub>t\\<^sub>p by auto\n hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\1@to_st [Decomp (Fun f T)])\" by auto\n hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\2)\"\n using Decompose.hyps(3) to_st_append[of \\1 \"[Decomp (Fun f T)]\"]\n by auto\n thus ?case using 1 by blast\n qed\nqed\n\nprivate lemma pts_symbolic_c_preserves_well_analyzed:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"well_analyzed \\\"\n shows \"well_analyzed \\'\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Receive thus ?case by (metis well_analyzed_singleton(1) well_analyzed_append)\n next\n case Send thus ?case by (metis well_analyzed_singleton(2) well_analyzed_append)\n next\n case Equality thus ?case by (metis well_analyzed_singleton(3) well_analyzed_append)\n next\n case Inequality thus ?case by (metis well_analyzed_singleton(4) well_analyzed_append)\n next\n case (Decompose f T)\n hence \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1) - (Var`\\)\" by auto\n thus ?case by (metis well_analyzed.Decomp Decompose.prems Decompose.hyps(3))\n qed simp\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_Ana_invar_subst:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\"\n and \"Ana_invar_subst (\n (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\)) \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\)))\"\n shows \"Ana_invar_subst (\n (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\') \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\')) \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\') \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\')))\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n from step.hyps(2) step.IH[OF step.prems] show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Nil\n hence \"\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\1) = \\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\2)\"\n \"\\(assignment_rhs\\<^sub>s\\<^sub>t ` \\1) = \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\2)\"\n by force+\n thus ?case using Nil by metis\n next\n case Send show ?case\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_snd[OF Send.hyps]\n Ana_invar_subst_subset[OF Send.prems]\n by (metis Un_mono)\n next\n case Receive show ?case\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_rcv[OF Receive.hyps]\n Ana_invar_subst_subset[OF Receive.prems]\n by (metis Un_mono)\n next\n case Equality show ?case\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_eq[OF Equality.hyps]\n Ana_invar_subst_subset[OF Equality.prems]\n by (metis Un_mono)\n next\n case Inequality show ?case\n using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_ineq[OF Inequality.hyps]\n Ana_invar_subst_subset[OF Inequality.prems]\n by (metis Un_mono)\n next\n case (Decompose f T)\n let ?X = \"\\(assignment_rhs\\<^sub>s\\<^sub>t`\\2) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\2\"\n let ?Y = \"\\(assignment_rhs\\<^sub>s\\<^sub>t`\\1) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n obtain K M where Ana: \"Ana (Fun f T) = (K,M)\" by moura\n hence *: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\2 = ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ set M\" \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\2 = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n using ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_ik\n decomp_assignment_rhs_empty Decompose.hyps(3)\n by auto\n { fix g S assume \"Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`\\2) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\2 \\ ?X)\"\n hence \"Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\1) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ set M \\ ?X)\"\n using * Decompose.hyps(2) by auto\n hence \"Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\1))\n \\ Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1)\n \\ Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)\n \\ Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\(assignment_rhs\\<^sub>s\\<^sub>t`\\1))\n \\ Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n using Decompose * Ana_fun_subterm[OF Ana] by auto\n moreover have \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n using trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_subtermsI Decompose.hyps(1) by auto\n hence \"subterms (Fun f T) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n by (metis in_subterms_subset_Union)\n hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"\n by (meson Un_upper2 Ana_subterm[OF Ana] subterms_subset_set psubsetE subset_trans)\n ultimately have \"Fun g S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\1) \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ ?Y)\"\n by auto\n }\n thus ?case using Decompose unfolding Ana_invar_subst_def by metis\n qed\nqed\n\nprivate lemma pts_symbolic_c_preserves_constr_disj_vars:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\" \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\ \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\ = {}\"\n shows \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\' \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\' = {}\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2)\n have *: \"\\S. S \\ \\1 \\ fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1 = {}\" \"\\S. S \\ \\1 \\ fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ bvars\\<^sub>s\\<^sub>t S = {}\"\n using pts_symbolic_c_preserves_wf_prot[OF step.hyps(1) step.prems(1)]\n unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n from step.hyps(2) step.IH[OF step.prems]\n show ?case\n proof (induction rule: pts_symbolic_c_induct)\n case Nil thus ?case by auto\n next\n case (Send t S)\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ fv t\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n \"fv\\<^sub>s\\<^sub>t (send\\t\\\\<^sub>s\\<^sub>t#S) = fv t \\ fv\\<^sub>s\\<^sub>t S\"\n using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by simp+\n thus ?case using *(1)[OF Send(1)] Send(4) by auto\n next\n case (Receive t S)\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ fv t\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n \"fv\\<^sub>s\\<^sub>t (receive\\t\\\\<^sub>s\\<^sub>t#S) = fv t \\ fv\\<^sub>s\\<^sub>t S\"\n using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by simp+\n thus ?case using *(1)[OF Receive(1)] Receive(4) by auto\n next\n case (Equality a t t' S)\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ fv t \\ fv t'\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1\"\n \"fv\\<^sub>s\\<^sub>t (\\a: t \\ t'\\\\<^sub>s\\<^sub>t#S) = fv t \\ fv t' \\ fv\\<^sub>s\\<^sub>t S\"\n using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by fastforce+\n thus ?case using *(1)[OF Equality(1)] Equality(4) by auto\n next\n case (Inequality X F S)\n hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ set X\"\n \"fv\\<^sub>s\\<^sub>t (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t#S) = (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X) \\ fv\\<^sub>s\\<^sub>t S\"\n using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append strand_vars_split(3)[of \"[\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\" S]\n by auto+\n moreover have \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\1 \\ set X = {}\" using *(2)[OF Inequality(1)] by auto\n ultimately show ?case using *(1)[OF Inequality(1)] Inequality(4) by auto\n next\n case (Decompose f T)\n thus ?case\n using Decompose(3,4) bvars_decomp ik_assignment_rhs_decomp_fv[OF Decompose(1)] by auto\n qed\nqed\n\n\nsubsubsection \\Theorem: The Typing Result Lifted to the Transition System Level\\\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_decomp_rm:\n assumes \"well_analyzed A\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' S (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\" shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' S A\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n show \"\\S\\S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A) (dual\\<^sub>s\\<^sub>t S)\"\n by (metis (no_types) assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_subset\n wf_vars_mono le_iff_sup)\n\n show \"\\Sa\\S. \\S'\\S. fv\\<^sub>s\\<^sub>t Sa \\ bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def)\n\n show \"\\S\\S. fv\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t A = {}\" by (metis assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def bvars_decomp_rm)\n\n show \"\\S\\S. fv\\<^sub>e\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>t S = {}\" by (metis assms wf\\<^sub>s\\<^sub>t\\<^sub>s'_def well_analyzed_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_fv)\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_pts_symbolic_c:\n assumes \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\"\n shows \"(S,A) \\\\<^sup>\\\\<^sub>c\\<^sup>* (S,A@D)\"\nusing assms(1)\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n case (Decomp B f X K T)\n have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\\n subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B))\"\n using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of A B] assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append[of A B]\n by auto\n hence \"Fun f X \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\ assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B))\" using Decomp.hyps by auto\n hence \"(S,A@B) \\\\<^sup>\\\\<^sub>c (S,A@B@[Decomp (Fun f X)])\"\n using pts_symbolic_c.Decompose[of f X \"A@B\"]\n by simp\n thus ?case\n using Decomp.IH rtrancl_into_rtrancl\n rtranclp_rtrancl_eq[of pts_symbolic_c \"(S,A)\" \"(S,A@B)\"]\n by auto\nqed simp\n\nprivate lemma pts_symbolic_to_pts_symbolic_c:\n assumes \"(\\,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)) \\\\<^sup>\\\\<^sup>* (\\',\\')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\ (to_est \\')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ \\\\<^sub>d\"\n and wf: \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\\\<^sub>d\"\n and tar: \"Ana_invar_subst ((\\(ik\\<^sub>s\\<^sub>t` dual\\<^sub>s\\<^sub>t` \\) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d))\n \\ (\\(assignment_rhs\\<^sub>s\\<^sub>t` \\) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)))\"\n and wa: \"well_analyzed \\\\<^sub>d\"\n and \\: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"\\\\\\<^sub>d'. \\' = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d') \\ (\\,\\\\<^sub>d) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\\\<^sub>d') \\ sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ \\\\<^sub>d'\"\nusing assms(1,2)\nproof (induction rule: rtranclp_induct2)\n case refl thus ?case using assms by auto\nnext\n case (step \\1 \\1 \\2 \\2)\n have \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\ (to_est \\1)\" using step.hyps(2) step.prems\n by (induct rule: pts_symbolic_induct, metis, (metis sem\\<^sub>e\\<^sub>s\\<^sub>t_d_split_left to_est_append)+)\n then obtain \\1d where\n \\1d: \"\\1 = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1d)\" \"(\\, \\\\<^sub>d) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\1, \\1d)\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ \\1d\"\n using step.IH by moura\n\n show ?case using step.hyps(2)\n proof (induction rule: pts_symbolic_induct)\n case Nil\n hence \"(\\, \\\\<^sub>d) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\2, \\1d)\" using \\1d pts_symbolic_c.Nil[OF Nil.hyps(1), of \\1d] by simp\n thus ?case using \\1d Nil by auto\n next\n case (Send t S)\n hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (\\1d@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Receive[OF \\1d(3)] by simp\n moreover have \"(\\1, \\1d) \\\\<^sup>\\\\<^sub>c (\\2, \\1d@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])\"\n using Send.hyps(2) pts_symbolic_c.Send[OF Send.hyps(1), of \\1d] by simp\n moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\1d@[Step (receive\\t\\\\<^sub>s\\<^sub>t)])) = \\2\"\n using Send.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\1d(1) by (simp add: to_st_append)\n ultimately show ?case using \\1d(2) by auto\n next\n case (Equality a t t' S)\n hence \"t \\ \\ = t' \\ \\\"\n using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\ \"to_est \\2\"]\n to_st_append to_est_append to_st_to_est_inv\n by auto\n hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (\\1d@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Equality[OF \\1d(3)] by simp\n moreover have \"(\\1, \\1d) \\\\<^sup>\\\\<^sub>c (\\2, \\1d@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])\"\n using Equality.hyps(2) pts_symbolic_c.Equality[OF Equality.hyps(1), of \\1d] by simp\n moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\1d@[Step (\\a: t \\ t'\\\\<^sub>s\\<^sub>t)])) = \\2\"\n using Equality.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\1d(1) by (simp add: to_st_append)\n ultimately show ?case using \\1d(2) by auto\n next\n case (Inequality X F S)\n hence \"ineq_model \\ X F\"\n using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\ \"to_est \\2\"]\n to_st_append to_est_append to_st_to_est_inv\n by auto\n hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (\\1d@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Inequality[OF \\1d(3)] by simp\n moreover have \"(\\1, \\1d) \\\\<^sup>\\\\<^sub>c (\\2, \\1d@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])\"\n using Inequality.hyps(2) pts_symbolic_c.Inequality[OF Inequality.hyps(1), of \\1d] by simp\n moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\1d@[Step (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t)])) = \\2\"\n using Inequality.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\1d(1) by (simp add: to_st_append)\n ultimately show ?case using \\1d(2) by auto\n next\n case (Receive t S)\n hence \"ik\\<^sub>s\\<^sub>t \\1 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\"\n using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\ \"to_est \\2\"]\n strand_sem_split(4)[of \"{}\" \\1 \"[send\\t\\\\<^sub>s\\<^sub>t]\" \\]\n to_st_append to_est_append to_st_to_est_inv\n by auto\n moreover have \"ik\\<^sub>s\\<^sub>t \\1 \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ ik\\<^sub>e\\<^sub>s\\<^sub>t \\1d \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" using \\1d(1) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset by auto\n ultimately have *: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\1d \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\" using ideduct_mono by auto\n\n have \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\ \\\\<^sub>d\" by (rule wf\\<^sub>s\\<^sub>t\\<^sub>s'_decomp_rm[OF wa assms(4)])\n hence **: \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\1d\" by (rule pts_symbolic_c_preserves_wf_is[OF \\1d(2) _ assms(5)])\n\n have \"Ana_invar_subst (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`\\1) \\ (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1d) \\\n (\\(assignment_rhs\\<^sub>s\\<^sub>t`\\1) \\ (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1d)))\"\n using tar \\1d(2) pts_symbolic_c_preserves_Ana_invar_subst by metis\n hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1d)\" \"Ana_invar_subst (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1d)\"\n using Ana_invar_subst_subset by blast+\n moreover have \"well_analyzed \\1d\"\n using pts_symbolic_c_preserves_well_analyzed[OF \\1d(2) wa] by metis\n ultimately obtain D where D:\n \"D \\ decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\1d) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\1d) \\\"\n \"ik\\<^sub>e\\<^sub>s\\<^sub>t (\\1d@D) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>c t \\ \\\"\n using decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst[OF * \\1d(3) ** assms(8)] unfolding Ana_invar_subst_def by auto\n\n have \"(\\, \\\\<^sub>d) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\1, \\1d@D)\" using \\1d(2) decomps\\<^sub>e\\<^sub>s\\<^sub>t_pts_symbolic_c[OF D(1), of \\1] by auto\n hence \"(\\, \\\\<^sub>d) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\2, \\1d@D@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\n using Receive(2) pts_symbolic_c.Receive[OF Receive.hyps(1), of \"\\1d@D\"] by auto\n moreover have \"\\2 = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\1d@D@[Step (send\\t\\\\<^sub>s\\<^sub>t)]))\"\n using Receive.hyps(3) \\1d(1) decomps\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_empty[OF D(1)]\n decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append\n by auto\n moreover have \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ (\\1d@D@[Step (send\\t\\\\<^sub>s\\<^sub>t)])\"\n using D(2) sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Send[OF sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF \\1d(3) D(1)]] by simp\n ultimately show ?case by auto\n qed\nqed\n\nprivate lemma pts_symbolic_c_to_pts_symbolic:\n assumes \"(\\,\\) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\',\\')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\ \\'\"\n shows \"(\\,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\)) \\\\<^sup>\\\\<^sup>* (\\',to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\'))\"\n \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\ (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\')\"\nproof -\n show \"(\\,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\)) \\\\<^sup>\\\\<^sup>* (\\',to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\'))\" using assms(1)\n proof (induction rule: rtranclp_induct2)\n case (step \\1 \\1 \\2 \\2) show ?case using step.hyps(2,1) step.IH\n proof (induction rule: pts_symbolic_c_induct)\n case Nil thus ?case\n using pts_symbolic.Nil[OF Nil.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"] by simp\n next\n case (Send t S) thus ?case\n using pts_symbolic.Send[OF Send.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"]\n by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n next\n case (Receive t S) thus ?case\n using pts_symbolic.Receive[OF Receive.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"]\n by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n next\n case (Equality a t t' S) thus ?case\n using pts_symbolic.Equality[OF Equality.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"]\n by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n next\n case (Inequality t t' S) thus ?case\n using pts_symbolic.Inequality[OF Inequality.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\1)\"]\n by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n next\n case (Decompose t) thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by simp\n qed\n qed simp\nqed (rule sem\\<^sub>e\\<^sub>s\\<^sub>t_d_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_if_sem\\<^sub>e\\<^sub>s\\<^sub>t_c[OF assms(2)])\n\nprivate lemma pts_symbolic_to_pts_symbolic_c_from_initial:\n assumes \"(\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sup>* (\\,\\)\" \"\\ \\ \\\\\\\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\\\<^sub>0 []\"\n and \"Ana_invar_subst (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\\\<^sub>0) \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\\\<^sub>0))\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"\\\\\\<^sub>d. \\ = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d) \\ (\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\,\\\\<^sub>d) \\ (\\ \\\\<^sub>c \\to_st \\\\<^sub>d\\)\"\nusing assms pts_symbolic_to_pts_symbolic_c[of \\\\<^sub>0 \"[]\" \\ \\ \\]\n sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st[of \"{}\" \\] sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\]\n to_st_to_est_inv[of \\] strand_sem_eq_defs\nby (auto simp add: constr_sem_c_def constr_sem_d_def simp del: subst_range.simps)\n\nprivate lemma pts_symbolic_c_to_pts_symbolic_from_initial:\n assumes \"(\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\,\\)\" \"\\ \\\\<^sub>c \\to_st \\\\\"\n shows \"(\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sup>* (\\,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\))\" \"\\ \\ \\to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\)\\\"\nusing assms pts_symbolic_c_to_pts_symbolic[of \\\\<^sub>0 \"[]\" \\ \\ \\]\n sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st[of \"{}\" \\] sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\] strand_sem_eq_defs\nby (auto simp add: constr_sem_c_def constr_sem_d_def)\n\nprivate lemma to_st_trms_wf:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t (to_st A))\"\nusing assms\nproof (induction A)\n case (Cons x A)\n hence IH: \"\\t \\ trms\\<^sub>s\\<^sub>t (to_st A). wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by auto\n with Cons show ?case\n proof (cases x)\n case (Decomp t)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Cons.prems by auto\n obtain K T where Ana_t: \"Ana t = (K,T)\" by moura\n hence \"trms\\<^sub>s\\<^sub>t (decomp t) \\ {t} \\ set K \\ set T\" using decomp_set_unfold[OF Ana_t] by force\n moreover have \"\\t \\ set T. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Ana_subterm[OF Ana_t] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ wf_trm_subterm by auto\n ultimately have \"\\t \\ trms\\<^sub>s\\<^sub>t (decomp t). wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Ana_keys_wf'[OF Ana_t] \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ by auto\n thus ?thesis using IH Decomp by auto\n qed auto\nqed simp\n\nprivate lemma to_st_trms_SMP_subset: \"trms\\<^sub>s\\<^sub>t (to_st A) \\ SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof\n fix t assume \"t \\ trms\\<^sub>s\\<^sub>t (to_st A)\" thus \"t \\ SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n proof (induction A)\n case (Cons x A)\n hence *: \"t \\ trms\\<^sub>s\\<^sub>t (to_st [x]) \\ trms\\<^sub>s\\<^sub>t (to_st A)\" using to_st_append[of \"[x]\" A] by auto\n have **: \"trms\\<^sub>s\\<^sub>t (to_st A) \\ trms\\<^sub>s\\<^sub>t (to_st (x#A))\" \"trms\\<^sub>e\\<^sub>s\\<^sub>t A \\ trms\\<^sub>e\\<^sub>s\\<^sub>t (x#A)\"\n using to_st_append[of \"[x]\" A] by auto\n show ?case\n proof (cases \"t \\ trms\\<^sub>s\\<^sub>t (to_st A)\")\n case True thus ?thesis using Cons.IH SMP_mono[OF **(2)] by auto\n next\n case False\n hence ***: \"t \\ trms\\<^sub>s\\<^sub>t (to_st [x])\" using * by auto\n thus ?thesis\n proof (cases x)\n case (Decomp t')\n hence ****: \"t \\ trms\\<^sub>s\\<^sub>t (decomp t')\" \"t' \\ trms\\<^sub>e\\<^sub>s\\<^sub>t (x#A)\" using *** by auto\n obtain K T where Ana_t': \"Ana t' = (K,T)\" by moura\n hence \"t \\ {t'} \\ set K \\ set T\" using decomp_set_unfold[OF Ana_t'] ****(1) by force\n moreover\n { assume \"t = t'\" hence ?thesis using SMP.MP[OF ****(2)] by simp }\n moreover\n { assume \"t \\ set K\" hence ?thesis using SMP.Ana[OF SMP.MP[OF ****(2)] Ana_t'] by auto }\n moreover\n { assume \"t \\ set T\" \"t \\ t'\"\n hence \"t \\ t'\" using Ana_subterm[OF Ana_t'] by blast\n hence ?thesis using SMP.Subterm[OF SMP.MP[OF ****(2)]] by auto\n }\n ultimately show ?thesis using Decomp by auto\n qed auto\n qed\n qed simp\nqed\n\nprivate lemma to_st_trms_tfr\\<^sub>s\\<^sub>e\\<^sub>t:\n assumes \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st A))\"\nproof -\n have *: \"trms\\<^sub>s\\<^sub>t (to_st A) \\ SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n using to_st_trms_wf to_st_trms_SMP_subset assms unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by auto\n have \"trms\\<^sub>s\\<^sub>t (to_st A) = trms\\<^sub>s\\<^sub>t (to_st A) \\ trms\\<^sub>e\\<^sub>s\\<^sub>t A\" by (blast dest!: trms\\<^sub>e\\<^sub>s\\<^sub>tD)\n hence \"SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A) = SMP (trms\\<^sub>s\\<^sub>t (to_st A))\" using SMP_subset_union_eq[OF *] by auto\n thus ?thesis using * assms unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by presburger\nqed\n\ntheorem wt_attack_if_tfr_attack_pts:\n assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\\\<^sub>0\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0))\" \"\\S \\ \\\\<^sub>0. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n and \"Ana_invar_subst (\\(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\\\<^sub>0) \\ \\(assignment_rhs\\<^sub>s\\<^sub>t ` \\\\<^sub>0))\"\n and \"(\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sup>* (\\,\\)\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"\\ \\ \\\\, Var\\\"\n shows \"\\\\\\<^sub>\\. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\ \\ (\\\\<^sub>\\ \\ \\\\, Var\\) \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\nproof -\n have \"(\\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t []) = \\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0)\" \"to_st [] = []\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p []\"\n using assms by simp_all\n hence *: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t []))\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\(trms\\<^sub>s\\<^sub>t ` \\\\<^sub>0)) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t []))\"\n \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\\\<^sub>0 []\" \"\\S \\ \\\\<^sub>0 \\ {to_st []}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using assms wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s' by (metis, metis, metis, simp)\n\n obtain \\\\<^sub>d where \\\\<^sub>d: \"\\ = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)\" \"(\\\\<^sub>0,[]) \\\\<^sup>\\\\<^sub>c\\<^sup>* (\\,\\\\<^sub>d)\" \"\\ \\\\<^sub>c \\to_st \\\\<^sub>d\\\"\n using pts_symbolic_to_pts_symbolic_c_from_initial assms *(3) by metis\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\(trms\\<^sub>s\\<^sub>t ` \\) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\(trms\\<^sub>s\\<^sub>t ` \\) \\ (trms\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d))\"\n using pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>e\\<^sub>t[OF _ *(1,2)] by blast+\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d)\"\n unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (metis DiffE DiffI SMP_union UnCI, metis UnCI)\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st \\\\<^sub>d))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t (to_st \\\\<^sub>d))\"\n by (metis to_st_trms_tfr\\<^sub>s\\<^sub>e\\<^sub>t, metis to_st_trms_wf)\n moreover have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r (to_st \\\\<^sub>d) Var\"\n proof -\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" \"subst_domain Var \\ vars\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d = {}\"\n \"range_vars Var \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d = {}\"\n by (simp_all add: range_vars_alt_def)\n moreover have \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\\\<^sub>d\"\n using pts_symbolic_c_preserves_wf_is[OF \\\\<^sub>d(2) *(3), of \"{}\"]\n by auto\n moreover have \"fv\\<^sub>s\\<^sub>t (to_st \\\\<^sub>d) \\ bvars\\<^sub>e\\<^sub>s\\<^sub>t \\\\<^sub>d = {}\"\n using pts_symbolic_c_preserves_constr_disj_vars[OF \\\\<^sub>d(2)] assms(1) wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s'\n by fastforce\n ultimately show ?thesis unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by simp\n qed\n moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\\\<^sub>d)\"\n using pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>t\\<^sub>p[OF \\\\<^sub>d(2) *(4)] by blast\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" by simp_all\n ultimately obtain \\\\<^sub>\\ where \\\\<^sub>\\:\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"\\\\<^sub>\\ \\\\<^sub>c \\to_st \\\\<^sub>d, Var\\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\n using wt_attack_if_tfr_attack[OF assms(7) \\\\<^sub>d(3)]\n \\tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st \\\\<^sub>d))\\ \\list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\\\<^sub>d)\\\n unfolding tfr\\<^sub>s\\<^sub>t_def by metis\n hence \"\\\\<^sub>\\ \\ \\\\, Var\\\" using pts_symbolic_c_to_pts_symbolic_from_initial \\\\<^sub>d by metis\n thus ?thesis using \\\\<^sub>\\(1,3,4) by metis\nqed\n\n\nsubsubsection \\Corollary: The Typing Result on the Level of Constraints\\\ntext \\There exists well-typed models of satisfiable type-flaw resistant constraints\\\ncorollary wt_attack_if_tfr_attack_d:\n assumes \"wf\\<^sub>s\\<^sub>t {} \\\" \"fv\\<^sub>s\\<^sub>t \\ \\ bvars\\<^sub>s\\<^sub>t \\ = {}\" \"tfr\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t \\)\"\n and \"Ana_invar_subst (ik\\<^sub>s\\<^sub>t \\ \\ assignment_rhs\\<^sub>s\\<^sub>t \\)\"\n and \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"\\ \\ \\\\\\\"\n shows \"\\\\\\<^sub>\\. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\ \\ (\\\\<^sub>\\ \\ \\\\\\) \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\nproof -\n { fix S A have \"({S},A) \\\\<^sup>\\\\<^sup>* ({},A@dual\\<^sub>s\\<^sub>t S)\"\n proof (induction S arbitrary: A)\n case Nil thus ?case using pts_symbolic.Nil[of \"{[]}\"] by auto\n next\n case (Cons x S)\n hence \"({S}, A@dual\\<^sub>s\\<^sub>t [x]) \\\\<^sup>\\\\<^sup>* ({}, A@dual\\<^sub>s\\<^sub>t (x#S))\"\n by (metis dual\\<^sub>s\\<^sub>t_append List.append_assoc List.append_Nil List.append_Cons)\n moreover have \"({x#S}, A) \\\\<^sup>\\ ({S}, A@dual\\<^sub>s\\<^sub>t [x])\"\n using pts_symbolic.Send[of _ S \"{x#S}\"] pts_symbolic.Receive[of _ S \"{x#S}\"]\n pts_symbolic.Equality[of _ _ _ S \"{x#S}\"] pts_symbolic.Inequality[of _ _ S \"{x#S}\"]\n by (cases x) auto\n ultimately show ?case by simp\n qed\n }\n hence 0: \"({dual\\<^sub>s\\<^sub>t \\},[]) \\\\<^sup>\\\\<^sup>* ({},\\)\" using dual\\<^sub>s\\<^sub>t_self_inverse by (metis List.append_Nil)\n\n have \"fv\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\) \\ bvars\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\) = {}\" using assms(2) dual\\<^sub>s\\<^sub>t_fv dual\\<^sub>s\\<^sub>t_bvars by metis+\n hence 1: \"wf\\<^sub>s\\<^sub>t\\<^sub>s {dual\\<^sub>s\\<^sub>t \\}\" using assms(1,2) dual\\<^sub>s\\<^sub>t_self_inverse[of \\] unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s_def by auto\n\n have \"\\(trms\\<^sub>s\\<^sub>t ` {\\}) = trms\\<^sub>s\\<^sub>t \\\" \"\\(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\}) = trms\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\)\" by auto\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\(trms\\<^sub>s\\<^sub>t ` {\\}))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\(trms\\<^sub>s\\<^sub>t ` {\\}))\"\n \"(\\(trms\\<^sub>s\\<^sub>t ` {\\})) = \\(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\})\"\n using assms(3,4) unfolding tfr\\<^sub>s\\<^sub>t_def\n by (metis, metis, metis dual\\<^sub>s\\<^sub>t_trms_eq)\n hence 2: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\}))\" and 3: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\}))\" by metis+\n\n have 4: \"\\S \\ {dual\\<^sub>s\\<^sub>t \\}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n using dual\\<^sub>s\\<^sub>t_tfr\\<^sub>s\\<^sub>t\\<^sub>p assms(3) unfolding tfr\\<^sub>s\\<^sub>t_def by blast\n\n have \"assignment_rhs\\<^sub>s\\<^sub>t \\ = assignment_rhs\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\)\"\n by (induct \\ rule: assignment_rhs\\<^sub>s\\<^sub>t.induct) auto\n hence 5: \"Ana_invar_subst (\\(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`{dual\\<^sub>s\\<^sub>t \\}) \\ \\(assignment_rhs\\<^sub>s\\<^sub>t`{dual\\<^sub>s\\<^sub>t \\}))\"\n using assms(5) dual\\<^sub>s\\<^sub>t_self_inverse[of \\] by auto\n\n show ?thesis by (rule wt_attack_if_tfr_attack_pts[OF 1 2 3 4 5 0 assms(6,7)])\nqed\n\nend\n\nend\n\nend\n\n", "meta": {"author": "logicalhacking", "repo": "Stateful_Protocol_Composition_and_Typing", "sha": "34755583e50bc8a2e3eb0f91350c0b8510422a16", "save_path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing", "path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing/Stateful_Protocol_Composition_and_Typing-34755583e50bc8a2e3eb0f91350c0b8510422a16/Stateful_Protocol_Composition_and_Typing/Typing_Result.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.29724808334402086}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory IndirectCalls\n\nimports\n \"PrettyProgs\"\n\nbegin\n\ndefinition\n lookup_proc :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ 'proc_id\"\nwhere\n \"lookup_proc symtab naming x\n = (THE pid. naming pid \\ None \\ symtab (the (naming pid)) = x)\"\n\ndefinition\n lookup_proc_safe :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ bool\"\nwhere\n \"lookup_proc_safe symtab naming x\n = (card {pid. naming pid \\ None \\ symtab (the (naming pid)) = x} = 1)\"\n\ndefinition\n procs_consistent :: \"(string \\ 'proc_addr) \\ ('proc_nm \\ string)\n \\ bool\"\nwhere\n \"procs_consistent symtab naming\n = (finite (dom naming)\n \\ (\\x y nm nm'. naming x = Some nm \\ naming y = Some nm'\n \\ symtab nm = symtab nm'\n \\ x = y))\"\n\nlemma procs_consistent_eq:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc symtab naming addr = proc\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_def)\n apply (rule the_equality)\n apply clarsimp\n apply clarsimp\n done\n\nlemma procs_consistent_safe:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc_safe symtab naming addr\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_safe_def)\n apply (rule trans, rule arg_cong[where f=card and y=\"{proc}\"])\n apply auto\n done\n\nlemma hoare_indirect_call_procs_consistent:\n \"\\ naming proc = Some nm; \n \\ \\ P (call initf proc ret c) Q, A \\\n \\ \\ \\ ({s. procs_consistent symtab naming \\ x_fn s = symtab nm} \\ P)\n (dynCall initf (\\s. lookup_proc symtab naming (x_fn s))\n ret c) Q, A\"\n apply (rule hoare_complete, drule hoare_sound)\n apply (clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n apply (erule exec_dynCall_Normal_elim)\n apply (simp add: procs_consistent_eq)\n apply blast\n done\n\nend\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/IndirectCalls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.29712130790785707}} {"text": " (*-------------------------------------------*\n | DFP package |\n | June 2005 |\n | December 2005 (modified) |\n | |\n | DFP on CSP-Prover ver.3.0 |\n | September 2006 (modified) |\n | April 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory DFP_Deadlock\nimports DFP_Network\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = []t) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n definitions\n *********************************************************)\n\ndefinition\n DeadlockFree :: \"'a event set => ('p,'a) proc => bool\" \n (\"(0[_]-DeadlockFree _)\" [0,55] 55)\n where\n DeadlockFree_def : \n \"[X]-DeadlockFree P == (ALL s. (Tick ~: sett(s)) --> (s,X) ~:f failures P MF)\"\n\n (* R is deadlock free with respect to X, thus\n R can always perform an event in X at least *)\n\ndefinition \n DeadlockFreeNetwork :: \"('i,'p,'a) Network => bool\" \n where\n DeadlockFreeNetwork_def : \n \"DeadlockFreeNetwork V == \n [Ev ` (ALP V)]-DeadlockFree PAR V\"\n\n\n(*** UNIV deadlockfree ***)\n\nsyntax\n \"@isDeadlockFree\" :: \"('p,'a) proc => bool\" \n (\"_ isDeadlockFree\" [1000] 1000)\n\ntranslations\n \"P isDeadlockFree\" == \"[(CONST UNIV)]-DeadlockFree P\"\n\ndefinition\n isDeadlockStateOf :: \n \"('i,'a) net_state => ('i,'a) NetworkF => bool\"\n (\"(0_ isDeadlockStateOf _)\" [55,55] 55)\n where\n isDeadlockStateOf_def : \n \"sigma isDeadlockStateOf VF == \n sigma isStateOf VF & \n Union {((snd sigma) i) |i. i : fst VF}\n = Ev ` (ALP VF)\"\n\n(*********************************************************\n isDeadlockStateOf subset alpha\n *********************************************************)\n\nlemma isDeadlockStateOf_subset_alpha1:\n \"[| (I, FXf) isFailureOf (I, PXf) ; \n (t, Yf) isDeadlockStateOf (I, FXf) ;\n i : I ; e : Yf i|]\n ==> e : (Ev ` (snd (PXf i)))\"\napply (simp add: isDeadlockStateOf_def)\napply (auto simp add: isStateOf_subset_alpha)\ndone\n\nlemma isDeadlockStateOf_subset_alpha2:\n \"[| (I, FXf) isFailureOf (I, PXf) ; \n (t, Yf) isDeadlockStateOf (I, FXf) ;\n i : I ; e : Yf i|]\n ==> e : (Ev ` (snd (FXf i)))\"\napply (simp add: isDeadlockStateOf_def)\napply (auto simp add: isStateOf_subset_alpha)\ndone\n\nlemmas isDeadlockStateOf_subset_alpha = isDeadlockStateOf_subset_alpha1\n isDeadlockStateOf_subset_alpha2\n\n(*********************************************************\n Deadlock and Deadlock freedom\n *********************************************************)\n\n(*** Existency ***)\n\nlemma DeadlockState_notDeadlockFree_only_if_lmEX_lm:\n \"[| ALL s Y.\n (s, Y) : fst (FXf i) -->\n (s, Y) :f failures (fst (PXf i)) MF & Y <= Ev ` snd (FXf i);\n (s rest-tr snd (FXf i), Z) : fst (FXf i);\n Yf i Int Ev ` snd (FXf i) <= Z |]\n ==> (s rest-tr snd (FXf i),\n SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\n : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i)\n <= (SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i)) &\n (SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\n <= Ev ` snd (FXf i)\"\napply (rule someI2[of\n\"(%Z. (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\" Z])\napply (rule conjI)\napply (simp)\napply (simp)\napply (simp)\ndone\n\nlemma DeadlockState_notDeadlockFree_only_if_lmEX:\n \"[| (I, FXf) isFailureOf (I, PXf) ;\n ALL i:I. (s rest-tr (snd (PXf i)), Yf i)\n :f failures (fst (PXf i)) MF |]\n ==>\n EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Zf i &\n Zf i <= Ev ` snd (FXf i)\"\n apply (rule_tac x=\n \"(%i. (SOME Z. (s rest-tr (snd (FXf i)), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z &\n Z <= Ev ` snd (FXf i)))\" in exI)\napply (intro ballI impI)\napply (simp add: isFailureOf_def)\napply (drule_tac x=\"i\" in bspec, simp)\napply (drule_tac x=\"i\" in bspec, simp)\napply (simp add: subseteqEX_restRefusal_iff)\napply (elim conjE exE)\napply (rotate_tac -2)\n\napply (drule_tac x=\"s rest-tr snd (FXf i)\" in spec)\napply (drule_tac x=\"Yf i\" in spec)\napply (simp)\napply (elim conjE exE)\napply (rule DeadlockState_notDeadlockFree_only_if_lmEX_lm)\napply (simp_all)\napply (force)\ndone\n\n(* only if part *)\n \nlemma DeadlockState_notDeadlockFree_only_if:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;\n ~ DeadlockFreeNetwork (I,PXf) |]\n ==> (EX sigma. (sigma isDeadlockStateOf (I,FXf)))\"\napply (simp add: DeadlockFreeNetwork_def)\napply (simp add: DeadlockFree_def)\napply (simp add: isDeadlockStateOf_def)\napply (subgoal_tac \"Union (snd ` PXf ` I) = {a. EX i:I. a : snd (FXf i)}\")\n (* ... sub 1 *)\n\n apply (elim conjE exE)\n apply (simp add: PAR_def)\n apply (simp add: in_failures_par)\n apply (elim conjE exE)\n\n apply (subgoal_tac \n \"EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) : fst (FXf i) & \n ((Yf i) Int (Ev ` snd (FXf i))) <= Zf i &\n Zf i <= (Ev ` snd (FXf i))\")\n (* ... sub 2 *)\n apply (elim conjE exE)\n\n apply (rule_tac x=\"s\" in exI)\n apply (rule_tac x=\"Zf\" in exI)\n apply (rule conjI)\n\n apply (simp add: isStateOf_def)\n apply (simp add: ALP_def)\n apply (simp add: subset_insert)\n\n (* set *)\n apply (simp add: ALP_def)\n apply (simp add: isFailureOf_def)\n apply (simp add: Int_insert_eq)\n apply (rule)\n (* <= *)\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (rotate_tac 1)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE)\n\n apply (rule rev_subsetD)\n apply (simp)\n apply (simp)\n apply (rule order_trans)\n apply (simp)\n\n apply (rule)\n apply (simp add: image_iff)\n apply (elim conjE bexE)\n apply (simp)\n apply (rule_tac x=\"i\" in bexI)\n apply (simp)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE bexE exE)\n apply (simp)\n apply (rule_tac x=\"Zf i\" in exI)\n apply (rule conjI)\n apply (fast)\n\n apply (elim conjE disjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp)\n apply (subgoal_tac \n \"Tick : Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I}\")\n apply (rotate_tac 5)\n apply (drule sym)\n apply (simp add: image_iff)\n apply (simp)\n apply (rule_tac x=\"Yf i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n\n apply (rotate_tac -5)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE disjE)\n apply (rule subsetD)\n apply (simp)\n apply (fast)\n\n (* sub 2 *)\n apply (simp add: DeadlockState_notDeadlockFree_only_if_lmEX)\n\n(* sub 1 *)\napply (simp add: isFailureOf_def)\napply (auto)\ndone\n\n(*** if part ***)\n\nlemma DeadlockState_notDeadlockFree_if:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;\n EX sigma. (sigma isDeadlockStateOf (I,FXf)) |]\n ==> ~ DeadlockFreeNetwork (I,PXf)\"\napply (simp add: DeadlockFreeNetwork_def)\napply (simp add: DeadlockFree_def)\napply (simp add: isDeadlockStateOf_def)\n\napply (elim conjE exE)\napply (simp add: PAR_def)\n\napply (rule_tac x=\"a\" in exI)\napply (simp add: in_failures_par)\napply (simp add: isStateOf_def ALP_def)\n\napply (elim conjE exE)\napply (rule conjI)\napply (fast)\napply (rule conjI)\n\napply (rule order_trans)\napply (simp)\napply (simp add: isFailureOf_def)\napply (fast)\n\napply (rule_tac x=\"b\" in exI)\napply (rename_tac s Ys)\napply (drule sym)\napply (simp)\napply (subgoal_tac \"Union (snd ` PXf ` I) = {a. EX i:I. a : snd (PXf i)}\")\napply (simp add: Int_insert_eq)\napply (rule conjI)\n apply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n apply (subgoal_tac \"x : Ev ` {a. EX i:I. a : snd (FXf i)}\")\n\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"Ys ia Int insert Tick (Ev ` snd (PXf ia))\" in exI)\n apply (rule conjI)\n apply (fast)\n\n apply (simp)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (simp add: isFailureOf_same_alpha)\n apply (blast)\n\n apply (simp (no_asm) add: image_iff)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp add: isFailureOf_def)\n apply (force)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp add: image_iff)\n apply (elim disjE conjE exE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (force)\n\n apply (elim conjE bexE)\n apply (rule_tac x=\"xb\" in exI, simp)\n apply (rule_tac x=\"i\" in bexI)\n apply (simp)\n apply (simp)\n\napply (intro ballI)\napply (simp add: isFailureOf_def)\napply (simp add: subseteqEX_restRefusal_iff)\n\napply (auto)\ndone\n\n(*** iff ***)\n\nlemma DeadlockState_notDeadlockFree:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n ==> (~ DeadlockFreeNetwork (I,PXf)) = \n (EX sigma. (sigma isDeadlockStateOf (I,FXf)))\"\napply (rule)\napply (rule DeadlockState_notDeadlockFree_only_if, simp_all)\napply (simp add: DeadlockState_notDeadlockFree_if)\ndone\n\n(*** DeadlockFree ***)\n\nlemma DeadlockFree_notDeadlockState:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n ==> DeadlockFreeNetwork (I,PXf) = \n (ALL sigma. ~(sigma isDeadlockStateOf (I,FXf)))\"\napply (rule iffI)\napply (rotate_tac -1)\napply (erule contrapos_pp)\napply (simp add: DeadlockState_notDeadlockFree)\napply (rotate_tac -1)\napply (erule contrapos_pp)\napply (simp add: DeadlockState_notDeadlockFree)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/DFP/DFP_Deadlock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.29712130790785707}} {"text": "(* Title: JinjaDCI/Compiler/J1.thy\n Author: Tobias Nipkow, Susannah Mansky\n Copyright 2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory Compiler/J1.thy by Tobias Nipkow\n*)\n\nchapter \\ Compilation \\label{cha:comp} \\\n\nsection \\ An Intermediate Language \\\n\ntheory J1 imports \"../J/BigStep\" begin\n\ntype_synonym expr\\<^sub>1 = \"nat exp\"\ntype_synonym J\\<^sub>1_prog = \"expr\\<^sub>1 prog\"\ntype_synonym state\\<^sub>1 = \"heap \\ (val list) \\ sheap\"\n\ndefinition hp\\<^sub>1 :: \"state\\<^sub>1 \\ heap\"\nwhere\n \"hp\\<^sub>1 \\ fst\"\ndefinition lcl\\<^sub>1 :: \"state\\<^sub>1 \\ val list\"\nwhere\n \"lcl\\<^sub>1 \\ fst \\ snd\"\ndefinition shp\\<^sub>1 :: \"state\\<^sub>1 \\ sheap\"\nwhere\n \"shp\\<^sub>1 \\ snd \\ snd\"\n\n(*<*)\ndeclare hp\\<^sub>1_def[simp] lcl\\<^sub>1_def[simp] shp\\<^sub>1_def[simp]\n(*>*)\n\nprimrec\n max_vars :: \"'a exp \\ nat\"\n and max_varss :: \"'a exp list \\ nat\"\nwhere\n \"max_vars(new C) = 0\"\n| \"max_vars(Cast C e) = max_vars e\"\n| \"max_vars(Val v) = 0\"\n| \"max_vars(e\\<^sub>1 \\bop\\ e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(Var V) = 0\"\n| \"max_vars(V:=e) = max_vars e\"\n| \"max_vars(e\\F{D}) = max_vars e\"\n| \"max_vars(C\\\\<^sub>sF{D}) = 0\"\n| \"max_vars(FAss e\\<^sub>1 F D e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(SFAss C F D e\\<^sub>2) = max_vars e\\<^sub>2\"\n| \"max_vars(e\\M(es)) = max (max_vars e) (max_varss es)\"\n| \"max_vars(C\\\\<^sub>sM(es)) = max_varss es\"\n| \"max_vars({V:T; e}) = max_vars e + 1\"\n| \"max_vars(e\\<^sub>1;;e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(if (e) e\\<^sub>1 else e\\<^sub>2) =\n max (max_vars e) (max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2))\"\n| \"max_vars(while (b) e) = max (max_vars b) (max_vars e)\"\n| \"max_vars(throw e) = max_vars e\"\n| \"max_vars(try e\\<^sub>1 catch(C V) e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2 + 1)\"\n| \"max_vars(INIT C (Cs,b) \\ e) = max_vars e\"\n| \"max_vars(RI(C,e);Cs \\ e') = max (max_vars e) (max_vars e')\"\n\n| \"max_varss [] = 0\"\n| \"max_varss (e#es) = max (max_vars e) (max_varss es)\"\n\ninductive\n eval\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) \\/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n and evals\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) [\\]/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n for P :: J\\<^sub>1_prog\nwhere\n\n New\\<^sub>1:\n \"\\ sh C = Some (sfs, Done); new_Addr h = Some a;\n P \\ C has_fields FDTs; h' = h(a\\blank P C) \\\n \\ P \\\\<^sub>1 \\new C,(h,l,sh)\\ \\ \\addr a,(h',l,sh)\\\"\n| NewFail\\<^sub>1:\n \"\\ sh C = Some (sfs, Done); new_Addr h = None \\ \\\n P \\\\<^sub>1 \\new C, (h,l,sh)\\ \\ \\THROW OutOfMemory,(h,l,sh)\\\"\n| NewInit\\<^sub>1:\n \"\\ \\sfs. sh C = Some (sfs, Done); P \\\\<^sub>1 \\INIT C ([C],False) \\ unit,(h,l,sh)\\ \\ \\Val v',(h',l',sh')\\;\n new_Addr h' = Some a; P \\ C has_fields FDTs; h'' = h'(a\\blank P C) \\\n \\ P \\\\<^sub>1 \\new C,(h,l,sh)\\ \\ \\addr a,(h'',l',sh')\\\"\n| NewInitOOM\\<^sub>1:\n \"\\ \\sfs. sh C = Some (sfs, Done); P \\\\<^sub>1 \\INIT C ([C],False) \\ unit,(h,l,sh)\\ \\ \\Val v',(h',l',sh')\\;\n new_Addr h' = None; is_class P C \\\n \\ P \\\\<^sub>1 \\new C,(h,l,sh)\\ \\ \\THROW OutOfMemory,(h',l',sh')\\\"\n| NewInitThrow\\<^sub>1:\n \"\\ \\sfs. sh C = Some (sfs, Done); P \\\\<^sub>1 \\INIT C ([C],False) \\ unit,(h,l,sh)\\ \\ \\throw a,s'\\;\n is_class P C \\\n \\ P \\\\<^sub>1 \\new C,(h,l,sh)\\ \\ \\throw a,s'\\\"\n\n| Cast\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l,sh)\\; h a = Some(D,fs); P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\addr a,(h,l,sh)\\\"\n| CastNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\\"\n| CastFail\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l,sh)\\; h a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\THROW ClassCast,(h,l,sh)\\\"\n| CastThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Val\\<^sub>1:\n \"P \\\\<^sub>1 \\Val v,s\\ \\ \\Val v,s\\\"\n\n| BinOp\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v\\<^sub>2,s\\<^sub>2\\; binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>2\\\"\n| BinOpThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n| BinOpThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>2\\\"\n\n| Var\\<^sub>1:\n \"\\ ls!i = v; i < size ls \\ \\\n P \\\\<^sub>1 \\Var i,(h,ls,sh)\\ \\ \\Val v,(h,ls,sh)\\\"\n\n| LAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,(h,ls,sh)\\; i < size ls; ls' = ls[i := v] \\\n \\ P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\unit,(h,ls',sh)\\\"\n| LAssThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAcc\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,ls,sh)\\; h a = Some(C,fs);\n P \\ C has F,NonStatic:t in D;\n fs(F,D) = Some v \\\n \\ P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\Val v,(h,ls,sh)\\\"\n| FAccNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| FAccThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| FAccNone\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,ls,sh)\\; h a = Some(C,fs);\n \\(\\b t. P \\ C has F,b:t in D) \\\n \\ P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\THROW NoSuchFieldError,(h,ls,sh)\\\"\n| FAccStatic\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,ls,sh)\\; h a = Some(C,fs);\n P \\ C has F,Static:t in D \\\n \\ P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\THROW IncompatibleClassChangeError,(h,ls,sh)\\\"\n\n| SFAcc\\<^sub>1:\n \"\\ P \\ C has F,Static:t in D;\n sh D = Some (sfs,Done);\n sfs F = Some v \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D},(h,ls,sh)\\ \\ \\Val v,(h,ls,sh)\\\"\n| SFAccInit\\<^sub>1:\n \"\\ P \\ C has F,Static:t in D;\n \\sfs. sh D = Some (sfs,Done); P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h,ls,sh)\\ \\ \\Val v',(h',ls',sh')\\;\n sh' D = Some (sfs,i);\n sfs F = Some v \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D},(h,ls,sh)\\ \\ \\Val v,(h',ls',sh')\\\"\n| SFAccInitThrow\\<^sub>1:\n \"\\ P \\ C has F,Static:t in D;\n \\sfs. sh D = Some (sfs,Done); P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h,ls,sh)\\ \\ \\throw a,s'\\ \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D},(h,ls,sh)\\ \\ \\throw a,s'\\\"\n| SFAccNone\\<^sub>1:\n \"\\ \\(\\b t. P \\ C has F,b:t in D) \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D},s\\ \\ \\THROW NoSuchFieldError,s\\\"\n| SFAccNonStatic\\<^sub>1:\n \"\\ P \\ C has F,NonStatic:t in D \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D},s\\ \\ \\THROW IncompatibleClassChangeError,s\\\"\n\n\n| FAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C has F,NonStatic:t in D;\n fs' = fs((F,D)\\v); h\\<^sub>2' = h\\<^sub>2(a\\(C,fs')) \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h\\<^sub>2',l\\<^sub>2,sh\\<^sub>2)\\\"\n| FAssNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,s\\<^sub>2\\ \\ \\\n P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| FAssThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| FAssThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n| FAssNone\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); \\(\\b t. P \\ C has F,b:t in D) \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NoSuchFieldError,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\\"\n| FAssStatic\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C has F,Static:t in D \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW IncompatibleClassChangeError,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\\"\n\n| SFAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1)\\;\n P \\ C has F,Static:t in D;\n sh\\<^sub>1 D = Some(sfs,Done); sfs' = sfs(F\\v); sh\\<^sub>1' = sh\\<^sub>1(D\\(sfs',Done)) \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1')\\\"\n| SFAssInit\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1)\\;\n P \\ C has F,Static:t in D;\n \\sfs. sh\\<^sub>1 D = Some(sfs,Done); P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1)\\ \\ \\Val v',(h',l',sh')\\;\n sh' D = Some(sfs,i);\n sfs' = sfs(F\\v); sh'' = sh'(D\\(sfs',i)) \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h',l',sh'')\\\"\n| SFAssInitThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1)\\;\n P \\ C has F,Static:t in D;\n \\sfs. sh\\<^sub>1 D = Some(sfs,Done); P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h\\<^sub>1,l\\<^sub>1,sh\\<^sub>1)\\ \\ \\throw a,s'\\ \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw a,s'\\\"\n| SFAssThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n| SFAssNone\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\;\n \\(\\b t. P \\ C has F,b:t in D) \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NoSuchFieldError,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\\"\n| SFAssNonStatic\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\;\n P \\ C has F,NonStatic:t in D \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW IncompatibleClassChangeError,(h\\<^sub>2,l\\<^sub>2,sh\\<^sub>2)\\\"\n\n| CallObjThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| CallNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| Call\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C sees M,NonStatic:Ts\\T = body in D;\n size vs = size Ts; ls\\<^sub>2' = (Addr a) # vs @ replicate (max_vars body) undefined;\n P \\\\<^sub>1 \\body,(h\\<^sub>2,ls\\<^sub>2',sh\\<^sub>2)\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>3,sh\\<^sub>3)\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>2,sh\\<^sub>3)\\\"\n| CallParamsThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\;\n es' = map Val vs @ throw ex # es\\<^sub>2 \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n| CallNone\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\ps,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); \\(\\b Ts T body D. P \\ C sees M,b:Ts\\T = body in D) \\\n \\ P \\\\<^sub>1 \\e\\M(ps),s\\<^sub>0\\ \\ \\THROW NoSuchMethodError,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\\"\n| CallStatic\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\ps,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C sees M,Static:Ts\\T = body in D \\\n \\ P \\\\<^sub>1 \\e\\M(ps),s\\<^sub>0\\ \\ \\THROW IncompatibleClassChangeError,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\\"\n\n| SCallParamsThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\es,s\\<^sub>0\\ [\\] \\es',s\\<^sub>2\\; es' = map Val vs @ throw ex # es\\<^sub>2 \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(es),s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n| SCallNone\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\ps,s\\<^sub>0\\ [\\] \\map Val vs,s\\<^sub>2\\;\n \\(\\b Ts T body D. P \\ C sees M,b:Ts\\T = body in D) \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(ps),s\\<^sub>0\\ \\ \\THROW NoSuchMethodError,s\\<^sub>2\\\"\n| SCallNonStatic\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\ps,s\\<^sub>0\\ [\\] \\map Val vs,s\\<^sub>2\\;\n P \\ C sees M,NonStatic:Ts\\T = body in D \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(ps),s\\<^sub>0\\ \\ \\THROW IncompatibleClassChangeError,s\\<^sub>2\\\"\n| SCallInitThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\ps,s\\<^sub>0\\ [\\] \\map Val vs,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\;\n P \\ C sees M,Static:Ts\\T = body in D;\n \\sfs. sh\\<^sub>1 D = Some(sfs,Done); M \\ clinit;\n P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\ \\ \\throw a,s'\\ \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(ps),s\\<^sub>0\\ \\ \\throw a,s'\\\"\n| SCallInit\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\ps,s\\<^sub>0\\ [\\] \\map Val vs,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\;\n P \\ C sees M,Static:Ts\\T = body in D;\n \\sfs. sh\\<^sub>1 D = Some(sfs,Done); M \\ clinit;\n P \\\\<^sub>1 \\INIT D ([D],False) \\ unit,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\ \\ \\Val v',(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\;\n size vs = size Ts; ls\\<^sub>2' = vs @ replicate (max_vars body) undefined;\n P \\\\<^sub>1 \\body,(h\\<^sub>2,ls\\<^sub>2',sh\\<^sub>2)\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>3,sh\\<^sub>3)\\ \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(ps),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>2,sh\\<^sub>3)\\\"\n| SCall\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\ps,s\\<^sub>0\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\;\n P \\ C sees M,Static:Ts\\T = body in D;\n sh\\<^sub>2 D = Some(sfs,Done) \\ (M = clinit \\ sh\\<^sub>2 D = \\(sfs, Processing)\\);\n size vs = size Ts; ls\\<^sub>2' = vs @ replicate (max_vars body) undefined;\n P \\\\<^sub>1 \\body,(h\\<^sub>2,ls\\<^sub>2',sh\\<^sub>2)\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>3,sh\\<^sub>3)\\ \\\n \\ P \\\\<^sub>1 \\C\\\\<^sub>sM(ps),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>2,sh\\<^sub>3)\\\"\n\n| Block\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\ \\ P \\\\<^sub>1 \\Block i T e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\\"\n\n| Seq\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e\\<^sub>2,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n| SeqThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n\n| CondT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondF\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| WhileF\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\unit,s\\<^sub>1\\\"\n| WhileT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\Val v\\<^sub>1,s\\<^sub>2\\;\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>2\\ \\ \\e\\<^sub>3,s\\<^sub>3\\ \\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>3,s\\<^sub>3\\\"\n| WhileCondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| WhileBodyThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\\\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| Throw\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\Throw a,s\\<^sub>1\\\"\n| ThrowNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| ThrowThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Try\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\\"\n| TryCatch\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\;\n h\\<^sub>1 a = Some(D,fs); P \\ D \\\\<^sup>* C; i < length ls\\<^sub>1;\n P \\\\<^sub>1 \\e\\<^sub>2,(h\\<^sub>1,ls\\<^sub>1[i:=Addr a],sh\\<^sub>1)\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\ \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2,sh\\<^sub>2)\\\"\n| TryThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\; h\\<^sub>1 a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\\"\n\n| Nil\\<^sub>1:\n \"P \\\\<^sub>1 \\[],s\\ [\\] \\[],s\\\"\n\n| Cons\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\Val v # es',s\\<^sub>2\\\"\n| ConsThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\throw e' # es, s\\<^sub>1\\\"\n\n\\ \\ init rules \\\n\n| InitFinal\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\ \\ \\e',s'\\ \\ P \\\\<^sub>1 \\INIT C (Nil,b) \\ e,s\\ \\ \\e',s'\\\"\n| InitNone\\<^sub>1:\n \"\\ sh C = None; P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh(C \\ (sblank P C, Prepared)))\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitDone\\<^sub>1:\n \"\\ sh C = Some(sfs,Done); P \\\\<^sub>1 \\INIT C' (Cs,True) \\ e,(h,l,sh)\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitProcessing\\<^sub>1:\n \"\\ sh C = Some(sfs,Processing); P \\\\<^sub>1 \\INIT C' (Cs,True) \\ e,(h,l,sh)\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitError\\<^sub>1:\n \"\\ sh C = Some(sfs,Error);\n P \\\\<^sub>1 \\RI (C, THROW NoClassDefFoundError);Cs \\ e,(h,l,sh)\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitObject\\<^sub>1:\n \"\\ sh C = Some(sfs,Prepared);\n C = Object;\n sh' = sh(C \\ (sfs,Processing));\n P \\\\<^sub>1 \\INIT C' (C#Cs,True) \\ e,(h,l,sh')\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitNonObject\\<^sub>1:\n \"\\ sh C = Some(sfs,Prepared);\n C \\ Object;\n class P C = Some (D,r);\n sh' = sh(C \\ (sfs,Processing));\n P \\\\<^sub>1 \\INIT C' (D#C#Cs,False) \\ e,(h,l,sh')\\ \\ \\e',s'\\ \\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,False) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n| InitRInit\\<^sub>1:\n \"P \\\\<^sub>1 \\RI (C,C\\\\<^sub>sclinit([]));Cs \\ e,(h,l,sh)\\ \\ \\e',s'\\\n \\ P \\\\<^sub>1 \\INIT C' (C#Cs,True) \\ e,(h,l,sh)\\ \\ \\e',s'\\\"\n\n| RInit\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\ \\ \\Val v, (h',l',sh')\\;\n sh' C = Some(sfs, i); sh'' = sh'(C \\ (sfs, Done));\n C' = last(C#Cs);\n P \\\\<^sub>1 \\INIT C' (Cs,True) \\ e', (h',l',sh'')\\ \\ \\e\\<^sub>1,s\\<^sub>1\\ \\\n \\ P \\\\<^sub>1 \\RI (C,e);Cs \\ e',s\\ \\ \\e\\<^sub>1,s\\<^sub>1\\\"\n| RInitInitFail\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\ \\ \\throw a, (h',l',sh')\\;\n sh' C = Some(sfs, i); sh'' = sh'(C \\ (sfs, Error));\n P \\\\<^sub>1 \\RI (D,throw a);Cs \\ e', (h',l',sh'')\\ \\ \\e\\<^sub>1,s\\<^sub>1\\ \\\n \\ P \\\\<^sub>1 \\RI (C,e);D#Cs \\ e',s\\ \\ \\e\\<^sub>1,s\\<^sub>1\\\"\n| RInitFailFinal\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\ \\ \\throw a, (h',l',sh')\\;\n sh' C = Some(sfs, i); sh'' = sh'(C \\ (sfs, Error)) \\\n \\ P \\\\<^sub>1 \\RI (C,e);Nil \\ e',s\\ \\ \\throw a, (h',l',sh'')\\\"\n\n\n(*<*)\nlemmas eval\\<^sub>1_evals\\<^sub>1_induct = eval\\<^sub>1_evals\\<^sub>1.induct [split_format (complete)]\n and eval\\<^sub>1_evals\\<^sub>1_inducts = eval\\<^sub>1_evals\\<^sub>1.inducts [split_format (complete)]\n(*>*)\n\n\ninductive_cases eval\\<^sub>1_cases [cases set]:\n \"P \\\\<^sub>1 \\new C,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\Cast C e,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\Val v,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\Var v,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\V:=e,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\e\\F{D},s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\C\\\\<^sub>sF{D},s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\C\\\\<^sub>sF{D}:=e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\e\\M(es),s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\C\\\\<^sub>sM(es),s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\{V:T;e\\<^sub>1},s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\e\\<^sub>1;;e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\while (b) c,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\throw e,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\INIT C (Cs,b) \\ e,s\\ \\ \\e',s'\\\"\n \"P \\\\<^sub>1 \\RI (C,e);Cs \\ e\\<^sub>0,s\\ \\ \\e',s'\\\"\n \ninductive_cases evals\\<^sub>1_cases [cases set]:\n \"P \\\\<^sub>1 \\[],s\\ [\\] \\e',s'\\\"\n \"P \\\\<^sub>1 \\e#es,s\\ [\\] \\e',s'\\\"\n(*>*) \n\n\nlemma eval\\<^sub>1_final: \"P \\\\<^sub>1 \\e,s\\ \\ \\e',s'\\ \\ final e'\"\n and evals\\<^sub>1_final: \"P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ finals es'\"\n(*<*)by(induct rule:eval\\<^sub>1_evals\\<^sub>1.inducts, simp_all)(*>*)\n\n\nlemma eval\\<^sub>1_final_same:\nassumes eval: \"P \\\\<^sub>1 \\e,s\\ \\ \\e',s'\\\" shows \"final e \\ e = e' \\ s = s'\"\n(*<*)\nproof(erule finalE)\n fix v assume Val: \"e = Val v\"\n then show ?thesis using eval eval\\<^sub>1_cases(3) by blast\nnext\n fix a assume \"e = Throw a\"\n then show ?thesis using eval\n by (metis eval\\<^sub>1_cases(3,17) exp.distinct(101) exp.inject(3) val.distinct(13))\nqed\n(*>*)\n\nsubsection \"Property preservation\"\n\nlemma eval\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\e\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\nand evals\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\es\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\ [\\] \\es\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\n(*<*)by (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts, simp_all)(*>*)\n\n\nlemma evals\\<^sub>1_preserves_elen:\n \"\\es' s s'. P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ length es = length es'\"\n(*<*)by(induct es type:list) (auto elim:evals\\<^sub>1.cases)(*>*)\n\n\nlemma clinit\\<^sub>1_loc_pres:\n \"P \\\\<^sub>1 \\C\\<^sub>0\\\\<^sub>sclinit([]),(h,l,sh)\\ \\ \\e',(h',l',sh')\\ \\ l = l'\"\n by(auto elim!: eval\\<^sub>1_cases(12) evals\\<^sub>1_cases(1))\n\nlemma\nshows init\\<^sub>1_ri\\<^sub>1_same_loc: \"P \\\\<^sub>1 \\e,(h,l,sh)\\ \\ \\e',(h',l',sh')\\\n \\ (\\C Cs b M a. e = INIT C (Cs,b) \\ unit \\ e = C\\\\<^sub>sM([]) \\ e = RI (C,Throw a) ; Cs \\ unit\n \\ e = RI (C,C\\\\<^sub>sclinit([])) ; Cs \\ unit\n \\ l = l')\"\n and \"P \\\\<^sub>1 \\es,(h,l,sh)\\ [\\] \\es',(h',l',sh')\\ \\ True\"\nproof(induct rule: eval\\<^sub>1_evals\\<^sub>1_inducts)\n case (RInitInitFail\\<^sub>1 e h l sh a')\n then show ?case using eval\\<^sub>1_final[of _ _ _ \"throw a'\"]\n by(fastforce dest: eval\\<^sub>1_final_same[of _ \"Throw a\"])\nnext\n case RInitFailFinal\\<^sub>1 then show ?case by(auto dest: eval\\<^sub>1_final_same)\nqed(auto dest: evals\\<^sub>1_cases eval\\<^sub>1_cases(17) eval\\<^sub>1_final_same)\n\nlemma init\\<^sub>1_same_loc: \"P \\\\<^sub>1 \\INIT C (Cs,b) \\ unit,(h,l,sh)\\ \\ \\e',(h',l',sh')\\ \\ l = l'\"\n by(simp add: init\\<^sub>1_ri\\<^sub>1_same_loc)\n\n\ntheorem eval\\<^sub>1_hext: \"P \\\\<^sub>1 \\e,(h,l,sh)\\ \\ \\e',(h',l',sh')\\ \\ h \\ h'\"\nand evals\\<^sub>1_hext: \"P \\\\<^sub>1 \\es,(h,l,sh)\\ [\\] \\es',(h',l',sh')\\ \\ h \\ h'\"\n(*<*)\nproof (induct rule: eval\\<^sub>1_evals\\<^sub>1_inducts)\n case New\\<^sub>1 thus ?case\n by(fastforce intro!: hext_new intro:LeastI simp:new_Addr_def\n split:if_split_asm simp del:fun_upd_apply)\nnext\n case NewInit\\<^sub>1 thus ?case\n by (meson hext_new hext_trans new_Addr_SomeD)\nnext\n case FAss\\<^sub>1 thus ?case\n by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply\n elim!: hext_trans)\nqed (auto elim!: hext_trans)\n(*>*)\n\nsubsection \"Initialization\"\n\nlemma rinit\\<^sub>1_throw:\n \"P\\<^sub>1 \\\\<^sub>1 \\RI (D,Throw xa) ; Cs \\ e,(h, l, sh)\\ \\ \\e',(h', l', sh')\\\n \\ e' = Throw xa\"\nproof(induct Cs arbitrary: D h l sh h' l' sh')\n case Nil then show ?case\n proof(rule eval\\<^sub>1_cases(20)) qed(auto elim: eval\\<^sub>1_cases)\nnext\n case (Cons C Cs) show ?case using Cons.prems\n proof(induct rule: eval\\<^sub>1_cases(20))\n case RInit\\<^sub>1: 1\n then show ?case using Cons.hyps by(auto elim: eval\\<^sub>1_cases)\n next\n case RInitInitFail\\<^sub>1: 2\n then show ?case using Cons.hyps eval\\<^sub>1_final_same final_def by blast\n next\n case RInitFailFinal\\<^sub>1: 3 then show ?case by simp\n qed\nqed\n\nlemma rinit\\<^sub>1_throwE:\n\"P \\\\<^sub>1 \\RI (C,throw e) ; Cs \\ e\\<^sub>0,s\\ \\ \\e',s'\\\n \\ \\a s\\<^sub>t. e' = throw a \\ P \\\\<^sub>1 \\throw e,s\\ \\ \\throw a,s\\<^sub>t\\\"\nproof(induct Cs arbitrary: C e s)\n case Nil\n then show ?case\n proof(rule eval\\<^sub>1_cases(20)) \\ \\ RI \\\n fix v h' l' sh' assume \"P \\\\<^sub>1 \\throw e,s\\ \\ \\Val v,(h', l', sh')\\\"\n then show ?case using eval\\<^sub>1_cases(17) by blast\n qed(auto)\nnext\n case (Cons C' Cs')\n show ?case using Cons.prems(1)\n proof(rule eval\\<^sub>1_cases(20)) \\ \\ RI \\\n fix v h' l' sh' assume \"P \\\\<^sub>1 \\throw e,s\\ \\ \\Val v,(h', l', sh')\\\"\n then show ?case using eval\\<^sub>1_cases(17) by blast\n next\n fix a h' l' sh' sfs i D Cs''\n assume e''step: \"P \\\\<^sub>1 \\throw e,s\\ \\ \\throw a,(h', l', sh')\\\"\n and shC: \"sh' C = \\(sfs, i)\\\"\n and riD: \"P \\\\<^sub>1 \\RI (D,throw a) ; Cs'' \\ e\\<^sub>0,(h', l', sh'(C \\ (sfs, Error)))\\ \\ \\e',s'\\\"\n and \"C' # Cs' = D # Cs''\"\n then show ?thesis using Cons.hyps eval\\<^sub>1_final eval\\<^sub>1_final_same by blast\n qed(simp)\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Compiler/J1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863695, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.29699858374447985}} {"text": "theory Pid_Scheduler\nimports Gen_Scheduler_Refine Partial_Order_Reduction.Transition_System_Extensions\nbegin\n\n lemma system_complete_language_eq_lsystem_accept:\n fixes ex en init int\n defines \"S \\ \\ g_V = UNIV, g_E = rel_of_enex (en, ex), g_V0 = {init}, sa_L = int \\\"\n assumes \"sa S\"\n shows \"snth ` transition_system_complete.language ex (\\ a p. a \\ en p) (\\ p. p = init) int = {w. sa.accept S w}\"\n proof -\n interpret jsys?: transition_system_complete ex \"\\ a p. a \\ en p\" \"\\ p. p = init\" int by this\n interpret psys?: sa S by fact\n show ?thesis\n unfolding jsys.language_def\n unfolding psys.accept_def\n proof safe\n fix p w\n assume 1: \"run w init\"\n show \"\\ r. is_run r \\ snth (smap int (init ## trace w init)) = L \\ r\"\n unfolding is_run_def ipath_def\n unfolding S_def graph_rec.simps sa_rec.simps\n unfolding rel_of_enex_def Let_def prod.case\n proof (intro allI exI conjI)\n fix i\n show \"(init ## trace w init) !! 0 \\ {init}\" by simp\n show \"snth (smap int (init ## trace w init)) = int \\ snth (init ## trace w init)\"\n by (metis (full_types) fun_comp_eq_conv smap_alt)\n have 10: \"w = stake i w @- [w !! i] @- sdrop (Suc i) w\" using id_stake_snth_sdrop by auto\n have 20: \"run (stake i w @- [w !! i] @- sdrop (Suc i) w) init\" using 1 10 by simp\n have 1: \"w !! i \\ en (target (stake i w) init)\" using 20 by auto\n have 2: \"ex (w !! i) (target (stake i w) init) = target (stake (Suc i) w) init\"\n using 20 unfolding stake_Suc by auto\n show \"((init ## trace w init) !! i, (init ## trace w init) !! Suc i) \\\n {(s, ex a s) |s a. a \\ en s}\" using 1 2 by force\n qed\n next\n fix r\n assume 1: \"is_run r\"\n obtain w where 2: \"r 0 = init\" \"\\ i. w i \\ en (r i)\" \"\\ i. r (Suc i) = ex (w i) (r i)\"\n using 1\n unfolding is_run_def ipath_def\n unfolding S_def graph_rec.simps\n unfolding rel_of_enex_def Let_def prod.case\n by simp metis\n have 3: \"L \\ r = snth (smap int (smap r nats))\" unfolding assms(1) by auto\n have 4: \"(init ## trace (smap w nats) init) !! i = smap r nats !! i\" for i\n using 2 by (induct i) (auto)\n have 5: \"smap r nats = init ## trace (smap w nats) init\" using eqI_snth 4 by metis\n have 6: \"target (stake k (smap w nats)) init = smap r nats !! k\" for k\n unfolding sscan_scons_snth 5 by rule\n have 7: \"run (smap w nats) init\" using 2(2) 6 by (auto intro: snth_run)\n show \"L \\ r \\ (!!) ` {smap int (p ## trace w p) |p w. p = init \\ run w p}\"\n unfolding 3 using 5 7 by force\n qed\n qed\n\n (* TODO: Move *) \n lemma prod_splitE:\n assumes \"\\a b. p=(a,b) \\ P a b\"\n obtains a b where \"p=(a,b)\" \"P a b\"\n using assms\n by (cases p) auto\n\n lemma sngp_sym_conv: \"(\\p. p=x) = (=) x\" by auto \n\n\n lemma in_multiset_of_conv_nth: \"x \\# mset l \\ (\\i (\\i m' = mset l - {#x#})\"\n by (metis add_diff_cancel_left' in_multiset_of_conv_nth \n insert_DiffM multi_member_this)\n\n \n type_synonym pid = nat\n record ('c,'ls,'gs) pid_global_config =\n processes :: \"('c,'ls) local_config list\" \n state :: 'gs\n\n definition pidgc_\\ \n :: \"('c,'ls,'gs) pid_global_config \\ ('c,'ls,'gs) global_config\" where\n \"pidgc_\\ pgc \\ \\ \n global_config.processes = mset (pid_global_config.processes pgc),\n global_config.state = pid_global_config.state pgc\n \\\"\n\n abbreviation pid_valid :: \"('c,'ls,'gs) pid_global_config \\ pid \\ bool\" \n where\n \"pid_valid gc pid \\ pid < length (pid_global_config.processes gc)\"\n \n abbreviation \"lc_of_pid gc pid \n \\ pid_global_config.processes gc ! pid\"\n \n abbreviation \"cmd_of_pid gc pid \n \\ local_config.command (lc_of_pid gc pid)\"\n \n abbreviation \"ls_of_pid gc pid \n \\ local_config.state (lc_of_pid gc pid)\"\n\n\n context Gen_Scheduler'\n begin\n\n definition pid_gstep_succ \n :: \"('c,'ls,'gs) pid_global_config \\ ('c,'ls,'gs) pid_global_config set\" \n where\n \"pid_gstep_succ gc \\ do {\n \\ \\ Select process \\\n let lcs = pid_global_config.processes gc;\n pid \\ {0.. \\ Focus state \\\n let gs = pid_global_config.state gc;\n let ls = local_config.state lc;\n \n \\ \\ Select action \\\n let cmd = local_config.command lc;\n (a,cmd') \\ {(a,cmd'). cstep cmd a cmd'};\n \n if en (ls,gs) a then {do { \n \\ \\ Execute \\\n let (ls,gs) = ex (ls,gs) a;\n \\ \\ Unfocus state. \\\n let lc = \\ local_config.command = cmd', local_config.state = ls\\;\n \\ \n pid_global_config.processes = lcs[pid:=lc],\n pid_global_config.state = gs \n \\\n }}\n else {}\n }\"\n\n lemma pid_gstep_succE:\n assumes \"gc' \\ pid_gstep_succ gc\"\n obtains pid a c' ls' gs' where\n \"pid_valid gc pid\"\n \"cstep (cmd_of_pid gc pid) a c'\"\n \"en (ls_of_pid gc pid, pid_global_config.state gc) a\"\n \"ex (ls_of_pid gc pid, pid_global_config.state gc) a = (ls',gs')\"\n \"gc' = \\ \n pid_global_config.processes = (pid_global_config.processes gc)\n [pid := \n \\ local_config.command = c', local_config.state = ls'\\\n ],\n pid_global_config.state = gs'\\\"\n using assms\n unfolding pid_gstep_succ_def\n by (auto \n split: if_split_asm prod.splits \n elim!: prod_splitE\n simp: all_conj_distrib)\n\n lemma pid_gstep_succI:\n assumes\n \"pid_valid gc pid\"\n \"cstep (cmd_of_pid gc pid) a c'\"\n \"en (ls_of_pid gc pid, pid_global_config.state gc) a\"\n \"ex (ls_of_pid gc pid, pid_global_config.state gc) a = (ls',gs')\"\n shows \"\n \\ \n pid_global_config.processes = (pid_global_config.processes gc)\n [pid := \n \\ local_config.command = c', local_config.state = ls'\\\n ],\n pid_global_config.state = gs'\n \\ \\ pid_gstep_succ gc\"\n using assms\n unfolding pid_gstep_succ_def\n by fastforce\n\n lemma pid_gc_state_eq: \n \"pid_global_config.state pgc = global_config.state (pidgc_\\ pgc)\"\n unfolding pidgc_\\_def by auto \n \n lemma pid_gc_proc_eq:\n assumes \"pid_valid gc pid\" \n shows \"\n global_config.processes (pidgc_\\ gc) \n = {#lc_of_pid gc pid#} \n + (global_config.processes (pidgc_\\ gc) - {#lc_of_pid gc pid#})\"\n using assms\n by (auto simp: pidgc_\\_def multiset_of_em_conv_nth)\n\n\n lemma pid_gstep_correct: \n \"gstep_succ (pidgc_\\ pgc) = pidgc_\\`pid_gstep_succ pgc\"\n apply safe\n apply (erule gstep_succE)\n apply (clarsimp simp: pidgc_\\_def multiset_of_em_conv_nth)\n apply (frule (3) pid_gstep_succI)\n apply (erule image_eqI[rotated])\n apply (auto simp: pidgc_\\_def mset_update add_ac union_mset_add_mset_right) []\n\n apply (erule pid_gstep_succE)\n apply (clarsimp simp: pidgc_\\_def mset_update)\n apply (simp add: pid_gc_state_eq)\n apply (frule (2) gstep_succI[rotated])\n apply (rule pid_gc_proc_eq, assumption)\n apply (auto simp: add_ac pidgc_\\_def union_mset_add_mset_left) []\n done\n\n abbreviation \"pid_gstep \\ rel_of_succ pid_gstep_succ\"\n definition \"pid_step \\ stutter_extend_edges UNIV pid_gstep\"\n\nend\n\nlocale Pid_Gen_Scheduler_linit = \n Gen_Scheduler'_linit cstep en ex init label\n for cstep :: \"'c \\ 'a \\ 'c \\ bool\"\n and en :: \"('ls\\'gs) \\ 'a \\ bool\"\n and ex :: \"('ls\\'gs) \\ 'a \\ ('ls\\'gs)\"\n and init :: \"('c,'ls,'gs) global_config set\"\n and label :: \"('c,'ls,'gs) global_config \\ 'l\" +\n fixes pid_init :: \"('c,'ls,'gs) pid_global_config\"\n and pid_label :: \"('c,'ls,'gs) pid_global_config \\ 'l\"\n assumes pid_init_eq: \"gc \\ init \\ (gc=pidgc_\\ pid_init)\"\n assumes pid_label_eq: \"label (pidgc_\\ pgc) = pid_label pgc\"\nbegin\n\n definition pid_system_automaton' :: \"(('c,'ls,'gs) pid_global_config, 'l) sa_rec\"\n where \"pid_system_automaton' \\\n \\ g_V = UNIV, g_E = pid_gstep, g_V0 = {pid_init}, sa_L = pid_label \\\"\n\n lemma pid_system_automaton'_simps[simp]:\n \"g_V pid_system_automaton' = UNIV\"\n \"g_E pid_system_automaton' = pid_gstep\"\n \"g_V0 pid_system_automaton' = {pid_init}\"\n \"sa_L pid_system_automaton' = pid_label\"\n unfolding pid_system_automaton'_def by auto\n\n definition pid_system_automaton :: \"(('c,'ls,'gs) pid_global_config, 'l) sa_rec\"\n where \"pid_system_automaton \\\n \\ g_V = UNIV, g_E = pid_step, g_V0 = {pid_init}, sa_L = pid_label \\\"\n\n lemma pid_system_automaton_simps[simp]:\n \"g_V pid_system_automaton = UNIV\"\n \"g_E pid_system_automaton = pid_step\"\n \"g_V0 pid_system_automaton = {pid_init}\"\n \"sa_L pid_system_automaton = pid_label\"\n unfolding pid_system_automaton_def by auto\n\n lemma pid_system_automaton_alt_def: \"pid_system_automaton = stutter_extend pid_system_automaton'\"\n unfolding pid_step_def pid_system_automaton'_def pid_system_automaton_def stutter_extend_def\n by simp\n\n sublocale pid': sa pid_system_automaton' by unfold_locales auto\n sublocale pid: sa pid_system_automaton\n unfolding pid_system_automaton_alt_def using pid'.stutter_extend_sa by this\n\n sublocale bisim: lbisimulation \"br pidgc_\\ (\\_. True)\" pid_system_automaton system_automaton\n proof -\n interpret bisim: lbisimulation \"br pidgc_\\ (\\_. True)\" pid_system_automaton' system_automaton'\n apply unfold_locales\n apply (auto simp: build_rel_def pid_init_eq pid_gstep_correct pid_label_eq)\n done\n interpret bisim: lbisimulation \"br pidgc_\\ (\\_. True)\" pid_system_automaton system_automaton\n unfolding system_automaton_alt_def pid_system_automaton_alt_def\n using bisim.lstutter_extend by this\n show \"lbisimulation (br pidgc_\\ (\\ _. True)) pid_system_automaton system_automaton\"\n by unfold_locales\n qed\n\n lemma pid_accept_eq: \"pid.accept = sa.accept\" by (rule bisim.accept_bisim)\n\n lemma pid_run_conv: \"sa.g.is_run r \\ (\\r'. r=pidgc_\\ o r' \\ pid.g.is_run r')\"\n by (rule bisim.br_run_conv[OF refl]) \n\n lemma pid_run_sim: \"pid.g.is_run r \\ sa.g.is_run (pidgc_\\ o r)\"\n by (rule bisim.s1.br_run_sim[OF refl])\n\nsection \"Global Actions\"\n\ntext \\\n A global action consists of a PID and a control flow graph edge\n\\\ntype_synonym (in -) ('c,'a) global_action = \"pid \\ 'c \\ 'a \\ 'c\"\n\n\nabbreviation (in -) \"fs_of_pid gc pid \\ (ls_of_pid gc pid,pid_global_config.state gc)\"\n\n definition ga_gen \n :: \"('c,'ls,'gs) pid_global_config \\ ('c,'a) global_action set\"\n where\n \"ga_gen gc \\ { (pid,c,a,c') .\n cstep c a c' \n \\ pid_valid gc pid \n \\ c=cmd_of_pid gc pid\n \\ en (fs_of_pid gc pid) a }\"\n\n definition ga_gex\n :: \"('c,'a) global_action \\ ('c,'ls,'gs) pid_global_config \\ ('c,'ls,'gs) pid_global_config\"\n where\n \"ga_gex ga gc \\ let \n (pid,c,a,c') = ga;\n fs = fs_of_pid gc pid;\n (ls',gs') = ex fs a;\n gc' = \\ \n pid_global_config.processes = (pid_global_config.processes gc)\n [pid := \n \\ local_config.command = c', local_config.state = ls'\\\n ],\n pid_global_config.state = gs'\\\n in\n gc'\"\n\n definition \"ga_gstep \\ rel_of_enex (ga_gen,ga_gex)\"\n definition \"ga_en \\ stutter_extend_en ga_gen\"\n definition \"ga_ex \\ stutter_extend_ex ga_gex\"\n definition \"ga_step \\ stutter_extend_edges UNIV ga_gstep\"\n lemma ga_step_alt: \"ga_step = rel_of_enex (ga_en,ga_ex)\"\n unfolding ga_step_def ga_gstep_def ga_en_def ga_ex_def\n by (auto simp: stutter_extend_pred_of_enex_conv)\n\n lemma some_ga_en_eq: \n \"Some a \\ ga_en gc \\ a \\ ga_gen gc\"\n by (auto simp: ga_en_def)\n lemma some_ga_ex_eq: \n \"ga_ex (Some a) gc = ga_gex a gc\"\n \"ga_ex \\ Some = ga_gex\"\n by (auto simp: ga_ex_def intro!: ext)\n lemma none_ga_en_eq: \"None \\ ga_en gc \\ ga_gen gc = {}\"\n by (auto simp: ga_en_def stutter_extend_en_def)\n lemma ga_ex_none[simp]: \"ga_ex None = id\" \n by (auto simp: ga_ex_def)\n\n lemma ga_gstep_eq: \"ga_gstep = pid_gstep\"\n apply safe\n apply (auto \n simp: ga_gstep_def ga_gen_def ga_gex_def \n split: prod.splits elim!: prod_splitE\n intro: pid_gstep_succI) []\n \n apply (fastforce \n simp: pred_of_succ_def ga_gstep_def ga_gen_def ga_gex_def\n split: prod.splits\n elim!: pid_gstep_succE)\n done\n\n lemma ga_step_eq: \"ga_step = pid_step\" \n unfolding ga_step_def pid_step_def ga_gstep_eq by rule\n\n definition ga_automaton :: \"(('c,'ls,'gs) pid_global_config, 'l) sa_rec\"\n where \"ga_automaton \\ \\ g_V = UNIV, g_E = ga_step, g_V0 = {pid_init}, sa_L = pid_label \\\"\n\n lemma ga_automaton_simps[simp]:\n \"g_V ga_automaton = UNIV\"\n \"g_E ga_automaton = ga_step\"\n \"g_V0 ga_automaton = {pid_init}\"\n \"sa_L ga_automaton = pid_label\"\n unfolding ga_automaton_def by simp+\n\n lemma ga_pid_system_automaton: \"ga_automaton = pid_system_automaton\"\n unfolding ga_automaton_def pid_system_automaton_def ga_step_eq by rule\n\n sublocale jsys: transition_system ga_ex \"\\ a p. a \\ ga_en p\" .\n sublocale ga: sa ga_automaton unfolding ga_pid_system_automaton by unfold_locales\n\n sublocale ga_bisim: lbisimulation Id ga_automaton pid_system_automaton\n unfolding ga_pid_system_automaton by auto\n\n lemma ga_accept_eq: \"ga.accept = sa.accept\" \n by (simp add: ga_bisim.accept_bisim pid_accept_eq) \n\n lemma ga_run_eq: \"pid.g.is_run r = ga.is_run r\"\n using ga_bisim.br_run_conv[of id \"\\_. True\" r]\n by (auto simp: build_rel_def[abs_def])\n\n sublocale jsys: transition_system_initial ga_ex \"\\ a p. a \\ ga_en p\" \"\\ p. p = pid_init\" . \n\n lemma reachable_alt: \"jsys.nodes = ga.E\\<^sup>* `` ga.V0\"\n proof safe\n fix gc\n assume \"gc \\ jsys.nodes\"\n thus \"gc \\ ga.E\\<^sup>* `` ga.V0\"\n unfolding ga_automaton_def ga_step_alt rel_of_enex_def\n by (induct, auto intro: rtrancl_into_rtrancl)\n next\n fix gc gc'\n assume \"(gc, gc') \\ ga.E\\<^sup>*\" \"gc \\ ga.V0\"\n thus \"gc' \\ jsys.nodes\" unfolding ga_automaton_def ga_step_alt by induct auto\n qed\n\n lemma rtrancl_step_exec_word_conv: \n \"(gc, gc') \\ ga_step\\<^sup>* \\ (\\w. jsys.path w gc \\ gc' = jsys.target w gc)\"\n proof safe\n assume \"(gc, gc') \\ ga_step\\<^sup>*\"\n thus \"\\ w. jsys.path w gc \\ gc' = jsys.target w gc\"\n apply induction\n apply force\n apply (force simp: ga_step_alt pred_of_enex_def)\n done\n next\n fix w\n assume \"jsys.path w gc\"\n thus \"(gc, jsys.target w gc) \\ ga_step\\<^sup>*\"\n apply induction\n apply (auto simp: ga_step_alt rel_of_enex_def\n intro: converse_rtrancl_into_rtrancl)\n done\n qed\n\n sublocale jsys: transition_system_complete ga_ex \"\\ a p. a \\ ga_en p\" \"\\ p. p = pid_init\" pid_label .\n\n lemma accept_eq_lang: \"snth ` jsys.language = Collect sa.accept\"\n unfolding ga_accept_eq[symmetric]\n unfolding ga_automaton_def\n unfolding ga_step_alt\n apply (rule system_complete_language_eq_lsystem_accept)\n unfolding ga_step_alt[symmetric]\n unfolding ga_automaton_def[symmetric]\n by unfold_locales\n\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/Pid_Scheduler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341027751814, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2969368009092318}} {"text": "(* Title: HOL/HOLCF/IOA/meta_theory/CompoExecs.thy\n Author: Olaf Müller\n*)\n\nsection {* Compositionality on Execution level *}\n\ntheory CompoExecs\nimports Traces\nbegin\n\ndefinition\n ProjA2 :: \"('a,'s * 't)pairs -> ('a,'s)pairs\" where\n \"ProjA2 = Map (%x.(fst x,fst(snd x)))\"\n\ndefinition\n ProjA :: \"('a,'s * 't)execution => ('a,'s)execution\" where\n \"ProjA ex = (fst (fst ex), ProjA2$(snd ex))\"\n\ndefinition\n ProjB2 :: \"('a,'s * 't)pairs -> ('a,'t)pairs\" where\n \"ProjB2 = Map (%x.(fst x,snd(snd x)))\"\n\ndefinition\n ProjB :: \"('a,'s * 't)execution => ('a,'t)execution\" where\n \"ProjB ex = (snd (fst ex), ProjB2$(snd ex))\"\n\ndefinition\n Filter_ex2 :: \"'a signature => ('a,'s)pairs -> ('a,'s)pairs\" where\n \"Filter_ex2 sig = Filter (%x. fst x:actions sig)\"\n\ndefinition\n Filter_ex :: \"'a signature => ('a,'s)execution => ('a,'s)execution\" where\n \"Filter_ex sig ex = (fst ex,Filter_ex2 sig$(snd ex))\"\n\ndefinition\n stutter2 :: \"'a signature => ('a,'s)pairs -> ('s => tr)\" where\n \"stutter2 sig = (fix$(LAM h ex. (%s. case ex of\n nil => TT\n | x##xs => (flift1\n (%p.(If Def ((fst p)~:actions sig)\n then Def (s=(snd p))\n else TT)\n andalso (h$xs) (snd p))\n $x)\n )))\"\n\ndefinition\n stutter :: \"'a signature => ('a,'s)execution => bool\" where\n \"stutter sig ex = ((stutter2 sig$(snd ex)) (fst ex) ~= FF)\"\n\ndefinition\n par_execs :: \"[('a,'s)execution_module,('a,'t)execution_module] => ('a,'s*'t)execution_module\" where\n \"par_execs ExecsA ExecsB =\n (let exA = fst ExecsA; sigA = snd ExecsA;\n exB = fst ExecsB; sigB = snd ExecsB\n in\n ( {ex. Filter_ex sigA (ProjA ex) : exA}\n Int {ex. Filter_ex sigB (ProjB ex) : exB}\n Int {ex. stutter sigA (ProjA ex)}\n Int {ex. stutter sigB (ProjB ex)}\n Int {ex. Forall (%x. fst x:(actions sigA Un actions sigB)) (snd ex)},\n asig_comp sigA sigB))\"\n\n\nlemmas [simp del] = split_paired_All\n\n\nsection \"recursive equations of operators\"\n\n\n(* ---------------------------------------------------------------- *)\n(* ProjA2 *)\n(* ---------------------------------------------------------------- *)\n\n\nlemma ProjA2_UU: \"ProjA2$UU = UU\"\napply (simp add: ProjA2_def)\ndone\n\nlemma ProjA2_nil: \"ProjA2$nil = nil\"\napply (simp add: ProjA2_def)\ndone\n\nlemma ProjA2_cons: \"ProjA2$((a,t)>>xs) = (a,fst t) >> ProjA2$xs\"\napply (simp add: ProjA2_def)\ndone\n\n\n(* ---------------------------------------------------------------- *)\n(* ProjB2 *)\n(* ---------------------------------------------------------------- *)\n\n\nlemma ProjB2_UU: \"ProjB2$UU = UU\"\napply (simp add: ProjB2_def)\ndone\n\nlemma ProjB2_nil: \"ProjB2$nil = nil\"\napply (simp add: ProjB2_def)\ndone\n\nlemma ProjB2_cons: \"ProjB2$((a,t)>>xs) = (a,snd t) >> ProjB2$xs\"\napply (simp add: ProjB2_def)\ndone\n\n\n\n(* ---------------------------------------------------------------- *)\n(* Filter_ex2 *)\n(* ---------------------------------------------------------------- *)\n\n\nlemma Filter_ex2_UU: \"Filter_ex2 sig$UU=UU\"\napply (simp add: Filter_ex2_def)\ndone\n\nlemma Filter_ex2_nil: \"Filter_ex2 sig$nil=nil\"\napply (simp add: Filter_ex2_def)\ndone\n\nlemma Filter_ex2_cons: \"Filter_ex2 sig$(at >> xs) =\n (if (fst at:actions sig)\n then at >> (Filter_ex2 sig$xs)\n else Filter_ex2 sig$xs)\"\n\napply (simp add: Filter_ex2_def)\ndone\n\n\n(* ---------------------------------------------------------------- *)\n(* stutter2 *)\n(* ---------------------------------------------------------------- *)\n\n\nlemma stutter2_unfold: \"stutter2 sig = (LAM ex. (%s. case ex of\n nil => TT\n | x##xs => (flift1\n (%p.(If Def ((fst p)~:actions sig)\n then Def (s=(snd p))\n else TT)\n andalso (stutter2 sig$xs) (snd p))\n $x)\n ))\"\napply (rule trans)\napply (rule fix_eq2)\napply (simp only: stutter2_def)\napply (rule beta_cfun)\napply (simp add: flift1_def)\ndone\n\nlemma stutter2_UU: \"(stutter2 sig$UU) s=UU\"\napply (subst stutter2_unfold)\napply simp\ndone\n\nlemma stutter2_nil: \"(stutter2 sig$nil) s = TT\"\napply (subst stutter2_unfold)\napply simp\ndone\n\nlemma stutter2_cons: \"(stutter2 sig$(at>>xs)) s =\n ((if (fst at)~:actions sig then Def (s=snd at) else TT)\n andalso (stutter2 sig$xs) (snd at))\"\napply (rule trans)\napply (subst stutter2_unfold)\napply (simp add: Consq_def flift1_def If_and_if)\napply simp\ndone\n\n\ndeclare stutter2_UU [simp] stutter2_nil [simp] stutter2_cons [simp]\n\n\n(* ---------------------------------------------------------------- *)\n(* stutter *)\n(* ---------------------------------------------------------------- *)\n\nlemma stutter_UU: \"stutter sig (s, UU)\"\napply (simp add: stutter_def)\ndone\n\nlemma stutter_nil: \"stutter sig (s, nil)\"\napply (simp add: stutter_def)\ndone\n\nlemma stutter_cons: \"stutter sig (s, (a,t)>>ex) =\n ((a~:actions sig --> (s=t)) & stutter sig (t,ex))\"\napply (simp add: stutter_def)\ndone\n\n(* ----------------------------------------------------------------------------------- *)\n\ndeclare stutter2_UU [simp del] stutter2_nil [simp del] stutter2_cons [simp del]\n\nlemmas compoex_simps = ProjA2_UU ProjA2_nil ProjA2_cons\n ProjB2_UU ProjB2_nil ProjB2_cons\n Filter_ex2_UU Filter_ex2_nil Filter_ex2_cons\n stutter_UU stutter_nil stutter_cons\n\ndeclare compoex_simps [simp]\n\n\n\n(* ------------------------------------------------------------------ *)\n(* The following lemmata aim for *)\n(* COMPOSITIONALITY on EXECUTION Level *)\n(* ------------------------------------------------------------------ *)\n\n\n(* --------------------------------------------------------------------- *)\n(* Lemma_1_1a : is_ex_fr propagates from A||B to Projections A and B *)\n(* --------------------------------------------------------------------- *)\n\nlemma lemma_1_1a: \"!s. is_exec_frag (A||B) (s,xs)\n --> is_exec_frag A (fst s, Filter_ex2 (asig_of A)$(ProjA2$xs)) &\n is_exec_frag B (snd s, Filter_ex2 (asig_of B)$(ProjB2$xs))\"\n\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm is_exec_frag_def}] 1 *})\n(* main case *)\napply (auto simp add: trans_of_defs2)\ndone\n\n\n(* --------------------------------------------------------------------- *)\n(* Lemma_1_1b : is_ex_fr (A||B) implies stuttering on Projections *)\n(* --------------------------------------------------------------------- *)\n\nlemma lemma_1_1b: \"!s. is_exec_frag (A||B) (s,xs)\n --> stutter (asig_of A) (fst s,ProjA2$xs) &\n stutter (asig_of B) (snd s,ProjB2$xs)\"\n\napply (tactic {* pair_induct_tac @{context} \"xs\"\n [@{thm stutter_def}, @{thm is_exec_frag_def}] 1 *})\n(* main case *)\napply (auto simp add: trans_of_defs2)\ndone\n\n\n(* --------------------------------------------------------------------- *)\n(* Lemma_1_1c : Executions of A||B have only A- or B-actions *)\n(* --------------------------------------------------------------------- *)\n\nlemma lemma_1_1c: \"!s. (is_exec_frag (A||B) (s,xs)\n --> Forall (%x. fst x:act (A||B)) xs)\"\n\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm Forall_def}, @{thm sforall_def},\n @{thm is_exec_frag_def}] 1 *})\n(* main case *)\napply auto\napply (simp add: trans_of_defs2 actions_asig_comp asig_of_par)\ndone\n\n\n(* ----------------------------------------------------------------------- *)\n(* Lemma_1_2 : ex A, exB, stuttering and forall a:A|B implies ex (A||B) *)\n(* ----------------------------------------------------------------------- *)\n\nlemma lemma_1_2:\n\"!s. is_exec_frag A (fst s,Filter_ex2 (asig_of A)$(ProjA2$xs)) &\n is_exec_frag B (snd s,Filter_ex2 (asig_of B)$(ProjB2$xs)) &\n stutter (asig_of A) (fst s,(ProjA2$xs)) &\n stutter (asig_of B) (snd s,(ProjB2$xs)) &\n Forall (%x. fst x:act (A||B)) xs\n --> is_exec_frag (A||B) (s,xs)\"\n\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm Forall_def}, @{thm sforall_def},\n @{thm is_exec_frag_def}, @{thm stutter_def}] 1 *})\napply (auto simp add: trans_of_defs1 actions_asig_comp asig_of_par)\ndone\n\n\nsubsection {* COMPOSITIONALITY on EXECUTION Level -- Main Theorem *}\n\nlemma compositionality_ex:\n\"(ex:executions(A||B)) =\n (Filter_ex (asig_of A) (ProjA ex) : executions A &\n Filter_ex (asig_of B) (ProjB ex) : executions B &\n stutter (asig_of A) (ProjA ex) & stutter (asig_of B) (ProjB ex) &\n Forall (%x. fst x:act (A||B)) (snd ex))\"\n\napply (simp (no_asm) add: executions_def ProjB_def Filter_ex_def ProjA_def starts_of_par)\napply (tactic {* pair_tac @{context} \"ex\" 1 *})\napply (rule iffI)\n(* ==> *)\napply (erule conjE)+\napply (simp add: lemma_1_1a lemma_1_1b lemma_1_1c)\n(* <== *)\napply (erule conjE)+\napply (simp add: lemma_1_2)\ndone\n\n\nsubsection {* COMPOSITIONALITY on EXECUTION Level -- for Modules *}\n\nlemma compositionality_ex_modules:\n \"Execs (A||B) = par_execs (Execs A) (Execs B)\"\napply (unfold Execs_def par_execs_def)\napply (simp add: asig_of_par)\napply (rule set_eqI)\napply (simp add: compositionality_ex actions_of_par)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/meta_theory/CompoExecs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.296936787932826}} {"text": "theory Extra14\n imports ExtraInv VCTheoryLemmas\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\\n (toEnv (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value))\"\n\ntheorem extra14: \"VC14 extraInv env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \"\n apply(simp only: VC14_def extraInv_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n subgoal\n apply((drule conjE[of _ _ ?thesis])+)\n defer\n apply assumption+\n subgoal premises prems\n apply(rule conjI)\n using prems(1-7) prems(8) apply simp\n apply(rule conjI)\n using prems(1-7) prems(9) apply simp\n apply(rule conjI)\n using prems(10) apply -[1]\n apply(rule allI)\n subgoal for s1\n apply(cases \"s1 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n apply(rule impI)\n apply(drule allE[of _ s0])\n prefer 2\n apply assumption\n apply(drule impE)\n prefer 3\n apply assumption\n using prems(1-7) substate_refl apply simp\n apply(drule exE)\n prefer 2\n apply assumption\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s2 s3\n apply(rule exI[of _ s2])\n apply(rule exI[of _ s3])\n apply(rule cut_rl[of \"s2 \\ s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"])\n apply auto[1]\n apply(rule cut_rl[of \"s2 \\ s0 \\ substate s0 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\"])\n using substate_trans substate_antisym apply blast\n using prems(1-7) substate_refl apply simp\n by (metis substate_antisym toEnvNum_id)\n using prems(1-7) by simp\n apply(rule conjI)\n using prems(11) apply -[1]\n apply(rule allI)\n subgoal for s3\n apply(cases \"s3 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n apply(rule impI)\n apply(drule allE[of _ s0])\n prefer 2\n apply assumption\n using prems(1-7) substate_refl toEnvP_ltime apply simp\n apply (metis One_nat_def Suc_less_eq2 diff_Suc_1)\n using prems(1-7) by simp\n apply(rule conjI)\n using prems(1-7) prems(12) apply simp\n apply(rule conjI)\n using prems(1-7) prems(13) apply simp\n apply(rule conjI)\n using prems(1-7) prems(14) apply simp\n apply(rule conjI)\n using prems(1-7) prems(15) apply simp\n apply(rule conjI)\n using prems(1-7) prems(16) apply simp\n apply(rule conjI)\n using prems(1-7) prems(17) apply simp\n apply(rule conjI)\n using prems(1-7) prems(18) apply simp\n apply(rule conjI)\n using prems(1-7) prems(19) apply simp\n apply(rule conjI)\n using prems(1-7) prems(20) apply simp\n apply(rule conjI)\n using prems(1-7) prems(21) apply simp\n apply(rule conjI)\n using prems(1-7) prems(22) substate_refl apply simp\n apply(rule conjI)\n using prems(1-7) prems(23) apply simp\n using prems(1-7) prems(24) by simp\n done\n done\n\nend \n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Extra14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2968387951411703}} {"text": " (*-------------------------------------------*\n | The Dining Mathematicians in CSP-Prover |\n | August 2004 |\n | December 2004 (modified) |\n | November 2005 (modified) |\n | March 2007 (modified) |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory DM2_para\nimports DM1_Imp_def\nbegin\n\n(*****************************************************************\n\n 1. expands parallel operators in Imp\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*** TH0 VAR step 1 ***)\n\nlemma TH0_VAR: \n \"(($TH0) |[CH0]| ($(VAR n)))\n =F (? x:insert (RD0 n) (insert (RD1 n) (range WR1)) \n -> IF (x : (range RD0) | x : (range WR0))\n THEN IF EVEN (getInt x) \n THEN (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)))\n ELSE (($TH0) |[CH0]| ($(VAR (getInt x)))))\"\napply (cspF_simp unfold_Imp_rules3)+\napply (cspF_step_left)+\napply (case_tac \"EVEN n\")\napply (auto)\napply (cspF_simp fold_Imp_rules3)+\ndone\n\nlemmas TH0_VAR_simp = TH0_VAR[simplified]\nlemmas unfold_Imp_rules4 = unfold_Imp_rules3 TH0_VAR_simp\nlemmas fold_Imp_rules4 = fold_Imp_rules3 TH0_VAR_simp[THEN cspF_sym]\n\n(*** TH0 VAR TH1 step 1 ***)\n\nlemma TH0_VAR_TH1:\n \"(($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n =F\n ? x:{(RD0 n), (RD1 n)} \n -> IF (x = RD0 n)\n THEN IF EVEN n\n THEN (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| ($TH1))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| ($TH1))\n ELSE IF ODD n\n THEN (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Eat1 -> ($(EAT1 n)))\n ELSE (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules4)\napply (cspF_step_left)\napply (case_tac \"EVEN n\")\napply (auto)\napply (cspF_simp fold_Imp_rules4)+\ndone\n\nlemmas TH0_VAR_TH1_simp = TH0_VAR_TH1[simplified]\nlemmas unfold_Imp_rules5 = unfold_Imp_rules4 TH0_VAR_TH1_simp\nlemmas fold_Imp_rules5 = fold_Imp_rules4 TH0_VAR_TH1_simp[THEN cspF_sym]\n\n(*** Eat0 VAR step 2 ***)\n\nlemma Eat0_VAR: \n \" (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)))\n =F\n ? x:insert Eat0 (insert (RD1 n) (range WR1))\n -> IF (x = Eat0) \n THEN (($(EAT0 n)) |[CH0]| ($(VAR n)))\n ELSE IF (x = RD1 n) \n THEN (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)))\n ELSE (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR (getInt x))))\"\napply (cspF_simp unfold_Imp_rules5)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules5)+\ndone\n\nlemmas Eat0_VAR_simp = Eat0_VAR[simplified]\nlemmas unfold_Imp_rules6 = unfold_Imp_rules5 Eat0_VAR_simp\nlemmas fold_Imp_rules6 = fold_Imp_rules5 Eat0_VAR_simp[THEN cspF_sym]\n\n(*** Back0 VAR step 2 ***)\n\nlemma Back0_VAR: \n \" (Back0 -> ($TH0) |[CH0]| ($(VAR n)))\n =F\n ? x:insert Back0 (insert (RD1 n) (range WR1))\n -> IF (x = Back0) \n THEN (($TH0) |[CH0]| ($(VAR n)))\n ELSE IF (x = RD1 n)\n THEN (Back0 -> ($TH0) |[CH0]| ($(VAR n)))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR (getInt x))))\"\napply (cspF_simp unfold_Imp_rules6)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules6)+\ndone\n\nlemmas Back0_VAR_simp = Back0_VAR[simplified]\nlemmas unfold_Imp_rules7 = unfold_Imp_rules6 Back0_VAR_simp\nlemmas fold_Imp_rules7 = fold_Imp_rules6 Back0_VAR_simp[THEN cspF_sym]\n\n(*** Eat0 VAR TH1 step 2 ***)\n\nlemma Eat0_VAR_TH1: \n \"EVEN n ==>\n (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n =F\n ? x:{Eat0, (RD1 n)} \n -> IF (x = Eat0)\n THEN (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n ELSE (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules7)\napply (cspF_step_left)\napply (auto)\napply (cspF_simp fold_Imp_rules7)+\ndone\n\nlemmas Eat0_VAR_TH1_simp = Eat0_VAR_TH1[simplified]\nlemmas unfold_Imp_rules8 = unfold_Imp_rules7 Eat0_VAR_TH1_simp\nlemmas fold_Imp_rules8 = fold_Imp_rules7 Eat0_VAR_TH1_simp[THEN cspF_sym]\n\n(****************************)\n(*** Back0 VAR TH1 step 2 ***)\n\nlemma Back0_VAR_TH1: \n \" (Back0 -> ($TH0) |[CH0]| ($(VAR n))\n |[CH1]| ($TH1))\n =F\n ? x:{Back0, (RD1 n)} \n -> IF (x = Back0)\n THEN (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n ELSE IF ODD n \n THEN (Back0 -> ($TH0) |[CH0]| ($(VAR n))\n |[CH1]| Eat1 -> ($(EAT1 n)))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n))\n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules8)\napply (cspF_step_left)\napply (case_tac \"EVEN n\")\napply (auto)\napply (cspF_simp fold_Imp_rules8)+\ndone\n\nlemmas Back0_VAR_TH1_simp = Back0_VAR_TH1[simplified]\nlemmas unfold_Imp_rules9 = unfold_Imp_rules8 Back0_VAR_TH1_simp\nlemmas fold_Imp_rules9 = fold_Imp_rules8 Back0_VAR_TH1_simp[THEN cspF_sym]\n\n(*** TH0 VAR Eat1 step 2 ***)\n\nlemma TH0_VAR_Eat1: \n \"ODD n ==>\n (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Eat1 -> ($(EAT1 n)))\n =F\n ? x:{Eat1, (RD0 n)} \n -> IF (x = Eat1)\n THEN (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n))) \n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Eat1 -> ($(EAT1 n)))\"\napply (cspF_simp unfold_Imp_rules9)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules9)+\ndone\n\nlemmas TH0_VAR_Eat1_simp = TH0_VAR_Eat1[simplified]\nlemmas unfold_Imp_rules10 = unfold_Imp_rules9 TH0_VAR_Eat1_simp\nlemmas fold_Imp_rules10 = fold_Imp_rules9 TH0_VAR_Eat1_simp[THEN cspF_sym]\n\n(****************************)\n(*** TH0 VAR Back1 step 2 ***)\n\nlemma TH0_VAR_Back1: \n \" (($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n =F\n ? x:{Back1, (RD0 n)}\n -> IF (x = Back1)\n THEN (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n ELSE IF EVEN n \n THEN (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1)) \n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules10)\napply (cspF_step_left)+\napply (case_tac \"EVEN n\")\napply (auto)\napply (cspF_simp fold_Imp_rules10)+\ndone\n\nlemmas TH0_VAR_Back1_simp = TH0_VAR_Back1[simplified]\nlemmas unfold_Imp_rules11 = unfold_Imp_rules10 TH0_VAR_Back1_simp\nlemmas fold_Imp_rules11 = fold_Imp_rules10 TH0_VAR_Back1_simp[THEN cspF_sym]\n\n(*** EAT0 VAR step 3 ***)\n\nlemma EAT0_VAR: \n \" (($(EAT0 n)) |[CH0]| ($(VAR n)))\n =F\n ? x:insert End0 (insert (RD1 n) (range WR1))\n -> IF (x = End0) \n THEN (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)))\n ELSE IF (x = RD1 n) \n THEN (($(EAT0 n)) |[CH0]| ($(VAR n)))\n ELSE (($(EAT0 n)) |[CH0]| ($(VAR (getInt x))))\"\napply (cspF_simp unfold_Imp_rules11)\napply (cspF_step_left)+\napply (case_tac \"EVEN n\")\napply (auto)\napply (cspF_simp fold_Imp_rules11)+\ndone\n\nlemmas EAT0_VAR_simp = EAT0_VAR[simplified]\nlemmas unfold_Imp_rules12 = unfold_Imp_rules11 EAT0_VAR_simp\nlemmas fold_Imp_rules12 = fold_Imp_rules11 EAT0_VAR_simp[THEN cspF_sym]\n\n(*** EAT0 VAR TH1 step 3 ***)\n\nlemma EAT0_VAR_TH1: \n \"EVEN n ==>\n (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n =F\n ? x:{End0, (RD1 n)} \n -> IF (x = End0)\n THEN (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| ($TH1))\n ELSE (($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules12)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules12)+\ndone\n\nlemmas EAT0_VAR_TH1_simp = EAT0_VAR_TH1[simplified]\nlemmas unfold_Imp_rules13 = unfold_Imp_rules12 EAT0_VAR_TH1_simp\nlemmas fold_Imp_rules13 = fold_Imp_rules12 EAT0_VAR_TH1_simp[THEN cspF_sym]\n\n(*** Eat0 VAR Back1 step 3 ***)\n\nlemma Eat0_VAR_Back1:\n \"EVEN n ==>\n (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\n =F\n ? x:{Eat0, Back1} \n -> IF (x = Eat0)\n THEN (($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\n ELSE (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) \n |[CH1]| ($TH1))\"\napply (cspF_simp unfold_Imp_rules13)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules13)+\ndone\n\nlemmas Eat0_VAR_Back1_simp = Eat0_VAR_Back1[simplified]\nlemmas unfold_Imp_rules14 = unfold_Imp_rules13 Eat0_VAR_Back1_simp\nlemmas fold_Imp_rules14 = fold_Imp_rules13 Eat0_VAR_Back1_simp[THEN cspF_sym]\n\n(*** TH0 VAR EAT1 step 3 ***)\n\nlemma TH0_VAR_EAT1: \n \"ODD n ==>\n (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n =F\n ? x:{End1, (RD0 n)} \n -> IF (x = End1)\n THEN (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| ($(EAT1 n)))\"\napply (cspF_simp unfold_Imp_rules14)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules14)+\ndone\n\nlemmas TH0_VAR_EAT1_simp = TH0_VAR_EAT1[simplified]\nlemmas unfold_Imp_rules15 = unfold_Imp_rules14 TH0_VAR_EAT1_simp\nlemmas fold_Imp_rules15 = fold_Imp_rules14 TH0_VAR_EAT1_simp[THEN cspF_sym]\n\n(*** Back0 VAR Eat1 step 3 ***)\n\nlemma Back0_VAR_Eat1: \n \"ODD n ==>\n (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Eat1 -> ($(EAT1 n)))\n =F\n ? x:{Eat1, Back0} \n -> IF (x = Eat1)\n THEN (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| ($(EAT1 n)))\n ELSE (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Eat1 -> ($(EAT1 n)))\"\napply (cspF_simp unfold_Imp_rules15)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules15)+\ndone\n\nlemmas Back0_VAR_Eat1_simp = Back0_VAR_Eat1[simplified]\nlemmas unfold_Imp_rules16 = unfold_Imp_rules15 Back0_VAR_Eat1_simp\nlemmas fold_Imp_rules16 = fold_Imp_rules15 Back0_VAR_Eat1_simp[THEN cspF_sym]\n\n(*** Back0 VAR Back1 step 3 ***)\n\nlemma Back0_VAR_Back1: \n \" (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n =F\n ? x:{Back0, Back1} \n -> IF (x = Back0)\n THEN (($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\"\napply (cspF_simp unfold_Imp_rules16)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules16)+\ndone\n\nlemmas Back0_VAR_Back1_simp = Back0_VAR_Back1[simplified]\nlemmas unfold_Imp_rules17 = unfold_Imp_rules16 Back0_VAR_Back1_simp\nlemmas fold_Imp_rules17 = fold_Imp_rules16 Back0_VAR_Back1_simp[THEN cspF_sym]\n\n(*** WR0 VAR step 4 ***)\n\nlemma WR0_VAR: \n \" (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)))\n =F\n ? x:insert (WR0 (n div 2)) (insert (RD1 n) (range WR1))\n -> IF (x = WR0 (n div 2))\n THEN (($TH0) |[CH0]| ($(VAR (n div 2))))\n ELSE IF (x = RD1 n)\n THEN (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)))\n ELSE (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR (getInt x))))\"\napply (cspF_simp unfold_Imp_rules17)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules17)+\ndone\n\nlemmas WR0_VAR_simp = WR0_VAR[simplified]\nlemmas unfold_Imp_rules18 = unfold_Imp_rules17 WR0_VAR_simp\nlemmas fold_Imp_rules18 = fold_Imp_rules17 WR0_VAR_simp[THEN cspF_sym]\n\n(*** WR0 VAR TH1 step 4 ***)\n\nlemma WR0_VAR_TH1: \n \"EVEN n ==>\n (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n =F\n ? x:{(WR0 (n div 2)), (RD1 n)}\n -> IF (x = WR0 (n div 2))\n THEN (($TH0) |[CH0]| ($(VAR (n div 2))) |[CH1]| ($TH1))\n ELSE (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules18)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules18)+\ndone\n\nlemmas WR0_VAR_TH1_simp = WR0_VAR_TH1[simplified]\nlemmas unfold_Imp_rules19 = unfold_Imp_rules18 WR0_VAR_TH1_simp\nlemmas fold_Imp_rules19 = fold_Imp_rules18 WR0_VAR_TH1_simp[THEN cspF_sym]\n\n(*** EAT0 VAR Back1 step 4 ***)\n\nlemma EAT0_VAR_Back1: \n \"EVEN n ==>\n (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n =F\n ? x:{End0, Back1} \n -> IF (x = End0)\n THEN (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| Back1 -> ($TH1))\n ELSE (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\"\napply (cspF_simp unfold_Imp_rules19)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules19)+\ndone\n\nlemmas EAT0_VAR_Back1_simp = EAT0_VAR_Back1[simplified]\nlemmas unfold_Imp_rules20 = unfold_Imp_rules19 EAT0_VAR_Back1_simp\nlemmas fold_Imp_rules20 = fold_Imp_rules19 EAT0_VAR_Back1_simp[THEN cspF_sym]\n\n(*** TH0 VAR EAT1 step 4 ***)\n\nlemma TH0_VAR_WR1: \n \"ODD n ==>\n (($TH0) |[CH0]| ($(VAR n)) |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n =F\n ? x:{(WR1 (3 * n + 1)), (RD0 n)} \n -> IF (x = WR1 (3 * n + 1))\n THEN (($TH0) |[CH0]| ($(VAR (3 * n + 1))) |[CH1]| ($TH1))\n ELSE (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| WR1 (3 * n + 1) -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules20)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules20)+\ndone\n\nlemmas TH0_VAR_WR1_simp = TH0_VAR_WR1[simplified]\nlemmas unfold_Imp_rules21 = unfold_Imp_rules20 TH0_VAR_WR1_simp\nlemmas fold_Imp_rules21 = fold_Imp_rules20 TH0_VAR_WR1_simp[THEN cspF_sym]\n\n(*** Back0 VAR EAT1 step 4 ***)\n\nlemma Back0_VAR_EAT1: \n \"ODD n ==>\n (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n =F\n ? x:{End1, Back0} \n -> IF (x = End1)\n THEN (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n ELSE (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\"\napply (cspF_simp unfold_Imp_rules21)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules21)+\ndone\n\nlemmas Back0_VAR_EAT1_simp = Back0_VAR_EAT1[simplified]\nlemmas unfold_Imp_rules22 = unfold_Imp_rules21 Back0_VAR_EAT1_simp\nlemmas fold_Imp_rules22 = fold_Imp_rules21 Back0_VAR_EAT1_simp[THEN cspF_sym]\n\n(*** WR0 VAR Back1 step 5 ***)\n\nlemma WR0_VAR_Back1: \n \"EVEN n ==>\n (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n =F\n ? x:{(WR0 (n div 2)), Back1}\n -> IF (x = WR0 (n div 2))\n THEN (($TH0) |[CH0]| ($(VAR (n div 2))) \n |[CH1]| Back1 -> ($TH1))\n ELSE (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| ($TH1))\"\napply (cspF_simp unfold_Imp_rules22)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules22)+\ndone\n\nlemmas WR0_VAR_Back1_simp = WR0_VAR_Back1[simplified]\nlemmas unfold_Imp_rules23 = unfold_Imp_rules22 WR0_VAR_Back1_simp\nlemmas fold_Imp_rules23 = fold_Imp_rules22 WR0_VAR_Back1_simp[THEN cspF_sym]\n\n(*** Back0 VAR WR1 step 5 ***)\n\nlemma Back0_VAR_WR1: \n \"ODD n ==>\n (Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n =F\n ? x:{(WR1 (3 * n + 1)), Back0} \n -> IF (x = WR1 (3 * n + 1))\n THEN (Back0 -> ($TH0) |[CH0]| ($(VAR (3 * n + 1))) \n |[CH1]| ($TH1))\n ELSE (($TH0) |[CH0]| ($(VAR n)) \n |[CH1]| WR1 (3 * n + 1) -> ($TH1))\"\napply (cspF_simp unfold_Imp_rules23)\napply (cspF_step_left)+\napply (auto)\napply (cspF_simp fold_Imp_rules23)+\ndone\n\nlemmas Back0_VAR_WR1_simp = Back0_VAR_WR1[simplified]\nlemmas unfold_Imp_rules24 = unfold_Imp_rules23 Back0_VAR_WR1_simp\nlemmas fold_Imp_rules24 = fold_Imp_rules23 Back0_VAR_WR1_simp[THEN cspF_sym]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/DM/DM2_para.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710233, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2968387890352327}} {"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\Cones and cocones\\\ntheory CZH_ECAT_Cone\n imports \n CZH_ECAT_NTCF\n CZH_ECAT_Hom\n CZH_ECAT_FUNCT\nbegin\n\n\n\nsubsection\\Cone and cocone\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\\nIn the context of this work, the concept of a cone corresponds to that of a cone\nto the base of a functor from a vertex, as defined in Chapter III-4 in\n\\<^cite>\\\"mac_lane_categories_2010\"\\; the concept of a cocone corresponds to that\nof a cone from the base of a functor to a vertex, as defined in Chapter III-3\nin \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\nlocale is_cat_cone = is_ntcf \\ \\ \\ \\cf_const \\ \\ c\\ \\ \\ for \\ c \\ \\ \\ \\ +\n assumes cat_cone_obj[cat_cs_intros]: \"c \\\\<^sub>\\ \\\\Obj\\\"\n\nsyntax \"_is_cat_cone\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"\\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_cone \\ c \\ \\ \\ \\\"\n\nlocale is_cat_cocone = is_ntcf \\ \\ \\ \\ \\cf_const \\ \\ c\\ \\ for \\ c \\ \\ \\ \\ +\n assumes cat_cocone_obj[cat_cs_intros]: \"c \\\\<^sub>\\ \\\\Obj\\\"\n\nsyntax \"_is_cat_cocone\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_cocone \\ c \\ \\ \\ \\\"\n\n\ntext\\Rules.\\\n\nlemma (in is_cat_cone) is_cat_cone_axioms'[cat_cs_intros]:\n assumes \"\\' = \\\" and \"c' = c\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"\\ : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_cone_axioms)\n\nmk_ide rf is_cat_cone_def[unfolded is_cat_cone_axioms_def]\n |intro is_cat_coneI|\n |dest is_cat_coneD[dest!]|\n |elim is_cat_coneE[elim!]|\n\nlemma (in is_cat_cone) is_cat_coneD'[cat_cs_intros]:\n assumes \"c' = cf_const \\ \\ c\"\n shows \"\\ : c' \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n unfolding assms by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\nlemma (in is_cat_cocone) is_cat_cocone_axioms'[cat_cs_intros]:\n assumes \"\\' = \\\" and \"c' = c\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"\\ : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_cocone_axioms)\n\nmk_ide rf is_cat_cocone_def[unfolded is_cat_cocone_axioms_def]\n |intro is_cat_coconeI|\n |dest is_cat_coconeD[dest!]|\n |elim is_cat_coconeE[elim!]|\n\nlemma (in is_cat_cocone) is_cat_coconeD'[cat_cs_intros]:\n assumes \"c' = cf_const \\ \\ c\"\n shows \"\\ : \\ \\\\<^sub>C\\<^sub>F c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n unfolding assms by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n\ntext\\Duality.\\\n\nlemma (in is_cat_cone) is_cat_cocone_op:\n \"op_ntcf \\ : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (intro is_cat_coconeI)\n (\n cs_concl cs_shallow \n cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros\n )+\n\nlemma (in is_cat_cone) is_cat_cocone_op'[cat_op_intros]:\n assumes \"\\' = \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\" and \"\\' = op_cf \\\"\n shows \"op_ntcf \\ : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_cocone_op)\n\nlemmas [cat_op_intros] = is_cat_cone.is_cat_cocone_op'\n\nlemma (in is_cat_cocone) is_cat_cone_op:\n \"op_ntcf \\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (intro is_cat_coneI)\n (\n cs_concl cs_shallow \n cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros\n )\n\nlemma (in is_cat_cocone) is_cat_cone_op'[cat_op_intros]:\n assumes \"\\' = \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\" and \"\\' = op_cf \\\"\n shows \"op_ntcf \\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_cone_op)\n\nlemmas [cat_op_intros] = is_cat_cocone.is_cat_cone_op'\n\n\ntext\\Elementary properties.\\\n\nlemma (in is_cat_cone) cat_cone_LArr_app_is_arr: \n assumes \"j \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\NTMap\\\\j\\ : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\j\\\"\nproof-\n from assms have [simp]: \"cf_const \\ \\ c\\ObjMap\\\\j\\ = c\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n from ntcf_NTMap_is_arr[OF assms] show ?thesis by simp \nqed\n\nlemma (in is_cat_cone) cat_cone_LArr_app_is_arr'[cat_cs_intros]: \n assumes \"j \\\\<^sub>\\ \\\\Obj\\\" and \"\\j = \\\\ObjMap\\\\j\\\"\n shows \"\\\\NTMap\\\\j\\ : c \\\\<^bsub>\\\\<^esub> \\j\"\n using assms(1) unfolding assms(2) by (rule cat_cone_LArr_app_is_arr)\n\nlemmas [cat_cs_intros] = is_cat_cone.cat_cone_LArr_app_is_arr'\n\nlemma (in is_cat_cocone) cat_cocone_LArr_app_is_arr: \n assumes \"j \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\NTMap\\\\j\\ : \\\\ObjMap\\\\j\\ \\\\<^bsub>\\\\<^esub> c\"\nproof-\n from assms have [simp]: \"cf_const \\ \\ c\\ObjMap\\\\j\\ = c\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n from ntcf_NTMap_is_arr[OF assms] show ?thesis by simp \nqed\n\nlemma (in is_cat_cocone) cat_cocone_LArr_app_is_arr'[cat_cs_intros]: \n assumes \"j \\\\<^sub>\\ \\\\Obj\\\" and \"\\j = \\\\ObjMap\\\\j\\\"\n shows \"\\\\NTMap\\\\j\\ : \\j \\\\<^bsub>\\\\<^esub> c\"\n using assms(1) unfolding assms(2) by (rule cat_cocone_LArr_app_is_arr)\n\nlemmas [cat_cs_intros] = is_cat_cocone.cat_cocone_LArr_app_is_arr'\n\nlemma (in is_cat_cone) cat_cone_Comp_commute[cat_cs_simps]:\n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\ = \\\\NTMap\\\\b\\\"\n using ntcf_Comp_commute[symmetric, OF assms] assms \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\nthm (*not ca_cs_simps*) is_cat_cone.cat_cone_Comp_commute\n\nlemma (in is_cat_cocone) cat_cocone_Comp_commute[cat_cs_simps]:\n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\NTMap\\\\a\\\"\n using ntcf_Comp_commute[OF assms] assms \n by\n (\n cs_prems \n cs_simp: cat_cs_simps dghm_const_ArrMap_app cs_intro: cat_cs_intros\n )\n\nthm (*not ca_cs_simps*) is_cat_cocone.cat_cocone_Comp_commute\n\n\ntext\\Utilities/helper lemmas.\\\n\nlemma (in is_cat_cone) helper_cat_cone_ntcf_vcomp_Comp:\n assumes \"\\' : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f' : c' \\\\<^bsub>\\\\<^esub> c\" \n and \"\\' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\" \n and \"j \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\nproof-\n from assms(3) have \"\\'\\NTMap\\\\j\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\\\j\\\"\n by simp\n from this assms(1,2,4) show \"\\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\nqed\n\nlemma (in is_cat_cone) helper_cat_cone_Comp_ntcf_vcomp:\n assumes \"\\' : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f' : c' \\\\<^bsub>\\\\<^esub> c\" \n and \"\\j. j \\\\<^sub>\\ \\\\Obj\\ \\ \\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\" \n shows \"\\' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\nproof-\n interpret \\': is_cat_cone \\ c' \\ \\ \\ \\' by (rule assms(1))\n show ?thesis\n proof(rule ntcf_eqI[OF \\'.is_ntcf_axioms])\n from assms(2) show \n \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f' : cf_const \\ \\ c' \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n show \"\\'\\NTMap\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\\"\n proof(rule vsv_eqI, unfold cat_cs_simps)\n show \"vsv ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\)\"\n by (cs_concl cs_intro: cat_cs_intros)\n from assms show \"\\\\Obj\\ = \\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\)\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n fix j assume prems': \"j \\\\<^sub>\\ \\\\Obj\\\"\n with assms(1,2) show \"\\'\\NTMap\\\\j\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\\\j\\\"\n by (cs_concl cs_simp: cat_cs_simps assms(3) cs_intro: cat_cs_intros)\n qed auto\n qed simp_all\nqed\n\nlemma (in is_cat_cone) helper_cat_cone_Comp_ntcf_vcomp_iff:\n assumes \"\\' : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"f' : c' \\\\<^bsub>\\\\<^esub> c \\ \\' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f' \\\n f' : c' \\\\<^bsub>\\\\<^esub> c \\ (\\j\\\\<^sub>\\\\\\Obj\\. \\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f')\"\n using \n helper_cat_cone_ntcf_vcomp_Comp[OF assms]\n helper_cat_cone_Comp_ntcf_vcomp[OF assms]\n by (intro iffI; elim conjE; intro conjI) metis+\n\nlemma (in is_cat_cocone) helper_cat_cocone_ntcf_vcomp_Comp:\n assumes \"\\' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f' : c \\\\<^bsub>\\\\<^esub> c'\" \n and \"\\' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\" \n and \"j \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\j\\\"\nproof-\n interpret \\': is_cat_cocone \\ c' \\ \\ \\ \\' by (rule assms(1))\n from assms(3) have \"op_ntcf \\' = op_ntcf (ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\)\" by simp\n from this assms(2) have op_\\':\n \"op_ntcf \\' = op_ntcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros)\n have \"\\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> f'\"\n by \n (\n rule is_cat_cone.helper_cat_cone_ntcf_vcomp_Comp[\n OF is_cat_cone_op \\'.is_cat_cone_op, \n unfolded cat_op_simps, \n OF assms(2) op_\\' assms(4)\n ]\n )\n from this assms(2,4) show \"\\'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\j\\\"\n by \n (\n cs_prems cs_shallow \n cs_simp: cat_cs_simps cat_op_simps cs_intro: cat_cs_intros\n )\nqed\n\nlemma (in is_cat_cocone) helper_cat_cocone_Comp_ntcf_vcomp:\n assumes \"\\' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f' : c \\\\<^bsub>\\\\<^esub> c'\" \n and \"\\j. j \\\\<^sub>\\ \\\\Obj\\ \\ \\'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\j\\\" \n shows \"\\' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\nproof-\n interpret \\': is_cat_cocone \\ c' \\ \\ \\ \\' by (rule assms(1))\n from assms(2) have \\'j: \"\\'\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> f'\"\n if \"j \\\\<^sub>\\ \\\\Obj\\\" for j\n using that\n unfolding assms(3)[OF that] \n by \n (\n cs_concl cs_shallow \n cs_simp: cat_op_simps cat_cs_simps cs_intro: cat_cs_intros\n )\n have op_\\': \n \"op_ntcf \\' = op_ntcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n by \n (\n rule is_cat_cone.helper_cat_cone_Comp_ntcf_vcomp[\n OF is_cat_cone_op \\'.is_cat_cone_op,\n unfolded cat_op_simps, \n OF assms(2) \\'j, \n simplified\n ]\n )\n from assms(2) show \"\\' = (ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\)\"\n by \n (\n cs_concl \n cs_simp: \n cat_op_simps op_\\' eq_op_ntcf_iff[symmetric, OF \\'.is_ntcf_axioms]\n cs_intro: cat_cs_intros\n )\nqed\n\nlemma (in is_cat_cocone) helper_cat_cocone_Comp_ntcf_vcomp_iff:\n assumes \"\\' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"f' : c \\\\<^bsub>\\\\<^esub> c' \\ \\' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\n f' : c \\\\<^bsub>\\\\<^esub> c' \\ (\\j\\\\<^sub>\\\\\\Obj\\. \\'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\j\\)\"\n using \n helper_cat_cocone_ntcf_vcomp_Comp[OF assms]\n helper_cat_cocone_Comp_ntcf_vcomp[OF assms]\n by (intro iffI; elim conjE; intro conjI) metis+\n\n\nsubsubsection\\Vertical composition of a natural transformation and a cone\\\n\nlemma ntcf_vcomp_is_cat_cone[cat_cs_intros]:\n assumes \"\\ : \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by \n (\n intro is_cat_coneI ntcf_vcomp_is_ntcf, rule assms(1); \n rule is_cat_coneD[OF assms(2)]\n )\n\n\nsubsubsection\\\nComposition of a functor and a cone, composition of a functor and a cocone\n\\\n\nlemma cf_ntcf_comp_cf_cat_cone: \n assumes \"\\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\c\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_cat_cone \\ c \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n by (intro is_cat_coneI)\n (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros )+\nqed\n\nlemma cf_ntcf_comp_cf_cat_cone'[cat_cs_intros]: \n assumes \"\\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"c' = \\\\ObjMap\\\\c\\\"\n and \"\\\\ = \\ \\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3,4) by (rule cf_ntcf_comp_cf_cat_cone)\n\nlemma cf_ntcf_comp_cf_cat_cocone:\n assumes \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>C\\<^sub>F \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\\\ObjMap\\\\c\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_cat_cocone \\ c \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n by\n (\n rule is_cat_cone.is_cat_cocone_op\n [\n OF cf_ntcf_comp_cf_cat_cone[\n OF \\.is_cat_cone_op \\.is_functor_op, unfolded cat_op_simps\n ], \n unfolded cat_op_simps\n ]\n )\nqed\n\nlemma cf_ntcf_comp_cf_cat_cocone'[cat_cs_intros]: \n assumes \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"c' = \\\\ObjMap\\\\c\\\"\n and \"\\\\ = \\ \\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3,4) by (rule cf_ntcf_comp_cf_cat_cocone)\n\n\nsubsubsection\\Cones, cocones and constant natural transformations\\\n\nlemma ntcf_vcomp_ntcf_const_is_cat_cone:\n assumes \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_cat_cone \\ b \\ \\ \\ \\ by (rule assms(1))\n from assms(2) show ?thesis\n by (intro is_cat_coneI) (cs_concl cs_intro: cat_cs_intros)\nqed\n\nlemma ntcf_vcomp_ntcf_const_is_cat_cone'[cat_cs_intros]:\n assumes \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ = ntcf_const \\ \\ f\"\n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,3) unfolding assms(2) by (rule ntcf_vcomp_ntcf_const_is_cat_cone)\n\nlemma ntcf_vcomp_ntcf_const_is_cat_cocone:\n assumes \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e a : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e b : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_cat_cocone \\ a \\ \\ \\ \\ by (rule assms(1))\n from is_cat_cone.is_cat_cocone_op\n [\n OF ntcf_vcomp_ntcf_const_is_cat_cone[\n OF \\.is_cat_cone_op, unfolded cat_op_simps, OF assms(2)\n ],\n unfolded cat_op_simps, \n folded op_ntcf_ntcf_const\n ]\n assms(2)\n show ?thesis\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros)\nqed\n\nlemma ntcf_vcomp_ntcf_const_is_cat_cocone'[cat_cs_intros]:\n assumes \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e a : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ = ntcf_const \\ \\ f\"\n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e b : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,3) \n unfolding assms(2)\n by (rule ntcf_vcomp_ntcf_const_is_cat_cocone)\n\nlemma ntcf_vcomp_ntcf_const_CId: \n assumes \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\CId\\\\b\\) = \\\"\nproof-\n\n interpret \\: is_cat_cone \\ b \\ \\ \\ \\ by (rule assms) \n\n show ?thesis\n proof(rule ntcf_eqI)\n\n from \\.cat_cone_obj show lhs_is_ntcf: \n \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\CId\\\\b\\) :\n cf_const \\ \\ b \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n then have dom_lhs: \n \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\CId\\\\b\\))\\NTMap\\) = \\\\Obj\\\"\n by (simp add: cat_cs_simps)\n\n from \\.cat_cone_obj show \"\\ : cf_const \\ \\ b \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n then have dom_rhs: \"\\\\<^sub>\\ (\\\\NTMap\\) = \\\\Obj\\\"\n by (simp add: cat_cs_simps)\n\n show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\CId\\\\b\\))\\NTMap\\ = \\\\NTMap\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n fix a assume prems: \"a \\\\<^sub>\\ \\\\Obj\\\"\n from prems \\.cat_cone_obj show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\CId\\\\b\\))\\NTMap\\\\a\\ = \\\\NTMap\\\\a\\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n qed (use lhs_is_ntcf in \\cs_concl cs_intro: cat_cs_intros\\)+\n\n qed simp_all\n\nqed\n\nlemma ntcf_vcomp_ntcf_const_CId'[cat_cs_simps]: \n assumes \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\' = \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\'\\CId\\\\b\\) = \\\"\n using assms(1) unfolding assms(2) by (rule ntcf_vcomp_ntcf_const_CId)\n\n\n\nsubsection\\Cone and cocone functors\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\See Chapter V-1 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cf_Cone :: \"V \\ V \\ V \\ V\"\n where \"cf_Cone \\ \\ \\ = \n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ (\\\\HomDom\\) (\\\\HomCod\\)(-,cf_map \\) \\\\<^sub>C\\<^sub>F\n op_cf (\\\\<^sub>C\\<^sub>F \\ (\\\\HomDom\\) (\\\\HomCod\\))\"\n\ndefinition cf_Cocone :: \"V \\ V \\ V \\ V\"\n where \"cf_Cocone \\ \\ \\ =\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ (\\\\HomDom\\) (\\\\HomCod\\)(cf_map \\,-) \\\\<^sub>C\\<^sub>F\n (\\\\<^sub>C\\<^sub>F \\ (\\\\HomDom\\) (\\\\HomCod\\))\"\n\n\ntext\\An alternative form of the definition.\\\n\ncontext is_functor\nbegin\n\nlemma cf_Cone_def': \n \"cf_Cone \\ \\ \\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ \\ \\(-,cf_map \\) \\\\<^sub>C\\<^sub>F op_cf (\\\\<^sub>C\\<^sub>F \\ \\ \\)\"\n unfolding cf_Cone_def cat_cs_simps by simp\n\nlemma cf_Cocone_def': \n \"cf_Cocone \\ \\ \\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ \\ \\(cf_map \\,-) \\\\<^sub>C\\<^sub>F (\\\\<^sub>C\\<^sub>F \\ \\ \\)\"\n unfolding cf_Cocone_def cat_cs_simps by simp\n\nend\n\n\nsubsubsection\\Object map\\\n\nlemma (in is_functor) cf_Cone_ObjMap_vsv[cat_cs_intros]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" \n shows \"vsv (cf_Cone \\ \\ \\\\ObjMap\\)\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_Cone_ObjMap_vsv\n\nlemma (in is_functor) cf_Cocone_ObjMap_vsv[cat_cs_intros]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" \n shows \"vsv (cf_Cocone \\ \\ \\\\ObjMap\\)\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_Cocone_ObjMap_vsv\n\nlemma (in is_functor) cf_Cone_ObjMap_vdomain[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (cf_Cone \\ \\ \\\\ObjMap\\) = \\\\Obj\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms show ?thesis\n unfolding cf_Cone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cone_ObjMap_vdomain\n\nlemma (in is_functor) cf_Cocone_ObjMap_vdomain[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (cf_Cocone \\ \\ \\\\ObjMap\\) = \\\\Obj\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cocone_ObjMap_vdomain\n\nlemma (in is_functor) cf_Cone_ObjMap_app[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"cf_Cone \\ \\ \\\\ObjMap\\\\b\\ =\n Hom (cat_FUNCT \\ \\ \\) (cf_map (cf_const \\ \\ b)) (cf_map \\)\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2,3) show ?thesis\n unfolding cf_Cone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cone_ObjMap_app\n\nlemma (in is_functor) cf_Cocone_ObjMap_app[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"cf_Cocone \\ \\ \\\\ObjMap\\\\b\\ =\n Hom (cat_FUNCT \\ \\ \\) (cf_map \\) (cf_map (cf_const \\ \\ b))\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2,3) show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cocone_ObjMap_app\n\n\nsubsubsection\\Arrow map\\\n\nlemma (in is_functor) cf_Cone_ArrMap_vsv[cat_cs_intros]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" \n shows \"vsv (cf_Cone \\ \\ \\\\ArrMap\\)\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cone_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_Cone_ArrMap_vsv\n\nlemma (in is_functor) cf_Cocone_ArrMap_vsv[cat_cs_intros]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" \n shows \"vsv (cf_Cocone \\ \\ \\\\ArrMap\\)\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_Cocone_ArrMap_vsv\n\nlemma (in is_functor) cf_Cone_ArrMap_vdomain[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (cf_Cone \\ \\ \\\\ArrMap\\) = \\\\Arr\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cone_ArrMap_vdomain\n\nlemma (in is_functor) cf_Cocone_ArrMap_vdomain[cat_cs_simps]:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (cf_Cocone \\ \\ \\\\ArrMap\\) = \\\\Arr\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2) show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cocone_ArrMap_vdomain\n\nlemma (in is_functor) cf_Cone_ArrMap_app[cat_cs_simps]:\n assumes \"\\ \\\"\n and \"\\ \\\\<^sub>\\ \\\" \n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"cf_Cone \\ \\ \\\\ArrMap\\\\f\\ = cf_hom\n (cat_FUNCT \\ \\ \\)\n [ntcf_arrow (ntcf_const \\ \\ f), cat_FUNCT \\ \\ \\\\CId\\\\cf_map \\\\]\\<^sub>\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2,3) show ?thesis\n unfolding cf_Cone_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cone_ArrMap_app\n\nlemma (in is_functor) cf_Cocone_ArrMap_app[cat_cs_simps]:\n assumes \"\\ \\\"\n and \"\\ \\\\<^sub>\\ \\\" \n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"cf_Cocone \\ \\ \\\\ArrMap\\\\f\\ = cf_hom\n (cat_FUNCT \\ \\ \\)\n [cat_FUNCT \\ \\ \\\\CId\\\\cf_map \\\\, ntcf_arrow (ntcf_const \\ \\ f)]\\<^sub>\\\"\nproof-\n from assms interpret \\: \\ \\ by simp \n from assms interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n from assms(2,3) show ?thesis\n unfolding cf_Cocone_def'\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_FUNCT_components(1) cat_op_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros cat_op_intros\n )\nqed\n\nlemmas [cat_cs_simps] = is_functor.cf_Cocone_ArrMap_app\n\n\nsubsubsection\\The cone functor is a functor\\\n\nlemma (in is_functor) tm_cf_cf_Cone_is_functor_if_ge_Limit:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\"\n shows \"cf_Cone \\ \\ \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof-\n from assms interpret FUNCT: category \\ \\cat_FUNCT \\ \\ \\\\\n by\n (\n cs_concl cs_intro:\n cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from assms interpret op_\\: \n is_functor \\ \\op_cat \\\\ \\op_cat (cat_FUNCT \\ \\ \\)\\ \\op_cf (\\\\<^sub>C\\<^sub>F \\ \\ \\)\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n have \"Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ \\ \\(-,cf_map \\) :\n op_cat (cat_FUNCT \\ \\ \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n then show \"cf_Cone \\ \\ \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n unfolding cf_Cone_def' by (cs_concl cs_intro: cat_cs_intros)\nqed\n\nlemma (in is_functor) tm_cf_cf_Cocone_is_functor_if_ge_Limit:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\"\n shows \"cf_Cocone \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof-\n from assms interpret Funct: category \\ \\cat_FUNCT \\ \\ \\\\\n by\n (\n cs_concl cs_intro:\n cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from assms interpret op_\\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)+\n have \"Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>cat_FUNCT \\ \\ \\(cf_map \\,-) :\n cat_FUNCT \\ \\ \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n then show \"cf_Cocone \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n unfolding cf_Cocone_def' by (cs_concl cs_intro: cat_cs_intros)\nqed\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Elementary_Categories/czh_ecategories/CZH_ECAT_Cone.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.29680407630919603}} {"text": "(*\nCopyright 2018\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*)\ntheory Abstract_System\n imports SE_Monad\nbegin\n\nlocale det_system =\n fixes step :: \"(unit,'s) se\"\n fixes halted :: \"'s \\ bool\"\nbegin\n\n definition \"step_rel s s' \\\n case s of\n None \\ False\n | Some s \\ \\halted s \\ map_option snd (step s) = s'\"\n\n fun terminated where\n \"terminated (Some s) = halted s\"\n | \"terminated None = True \"\n\n lemma terminated_no_step[simp, intro]: \"terminated s \\ \\step_rel s s'\"\n by (auto simp: step_rel_def split: option.splits)\n\n lemma terminated_no_step': \"terminated s \\ (\\s'. \\step_rel s s')\"\n by (cases s; auto simp: step_rel_def split: option.splits)\n\n definition \"is_result s s' \\ step_rel\\<^sup>*\\<^sup>* (Some s) s' \\ terminated s'\"\n\n lemma is_result_1_step_eq: \"\\halted s \\ step s = Some ((),sh) \\ is_result s s' \\ is_result sh s'\"\n apply (rule iffI)\n subgoal\n unfolding is_result_def step_rel_def\n by (auto split: option.splits elim: converse_rtranclpE)\n subgoal\n unfolding is_result_def\n apply simp\n apply (rule converse_rtranclp_into_rtranclp)\n apply (auto simp: step_rel_def) []\n by simp\n done\n\n lemma result_determ: \"is_result s s' \\ is_result s s'' \\ s'=s''\"\n unfolding is_result_def\n apply safe\n apply (induction rule: converse_rtranclp_induct)\n apply (erule converse_rtranclpE; auto; fail)\n\n apply (erule converse_rtranclpE[of _ _ s'']; clarsimp)\n apply (auto simp: step_rel_def split: option.splits; fail)\n done\n\n definition \"yields' s \\ if \\s'. is_result s s' then Some (THE s'. is_result s s') else None\"\n\n lemma yields_eq_Some_conv: \"yields' s = Some s' \\ is_result s s'\"\n unfolding yields'_def using result_determ\n by (auto simp: theI2)\n\n lemma yields_eq_None_conv: \"yields' s = None \\ (\\s'. is_result s s')\"\n unfolding yields'_def by auto\n\n lemma halted_res[simp]: \"halted s \\ is_result s (Some s)\"\n by (auto simp: is_result_def)\n\n lemma exec1_None_res[simp]: \"\\step s = None; \\ halted s\\ \\ is_result s None\"\n by (auto simp: is_result_def step_rel_def r_into_rtranclp)\n\n lemma yields_unfold: \"yields' s = (\n if halted s then\n Some (Some s)\n else\n case step s of\n Some (_,s') \\ yields' s'\n | None \\ Some None\n )\"\n apply (clarsimp split: option.splits simp: yields_eq_Some_conv yields_eq_None_conv)\n subgoal for s'\n apply (cases \"yields' s\"; cases \"yields' s'\"; simp only:)\n apply (auto\n split: option.splits\n simp: yields_eq_Some_conv yields_eq_None_conv is_result_1_step_eq result_determ\n )+\n done\n done\n\n lemma yields'_simps[simp]:\n \"halted s \\ yields' s = Some (Some s)\"\n \"\\halted s \\ step s = Some ((),s') \\ yields' s = yields' s'\"\n \"\\halted s \\ step s = None \\ yields' s = Some None\"\n by (subst yields_unfold; auto split: option.splits)+\n\n\n definition \"is_invar \\ \\ \\s. \\ s \\ \\halted s \\ wps step (\\_. \\) s\"\n definition \"is_weak_invar \\ \\ \\s s'. \\ s \\ \\halted s \\ step s = Some ((),s') \\ \\ s'\"\n\n lemma is_invar_step: \"is_invar \\ \\ \\ s \\ step_rel (Some s) so' \\ \\s'. so'=Some s' \\ \\ s'\"\n by (auto simp: is_invar_def wps_def step_rel_def split: option.splits)\n\n lemma is_weak_invar_step: \"is_weak_invar \\ \\ \\ s \\ step_rel (Some s) (Some s') \\ \\ s'\"\n by (auto simp: is_weak_invar_def wps_def step_rel_def split: option.splits)\n\n lemma is_invar_exec:\n assumes \"is_invar \\\"\n assumes \"\\ s\"\n assumes \"step_rel\\<^sup>*\\<^sup>* (Some s) so'\"\n shows \"\\s'. so'=Some s' \\ \\ s'\"\n using assms(3,2)\n apply (induction a\\\"Some s\" arbitrary: s rule: converse_rtranclp_induct)\n subgoal by simp\n apply (drule (1) is_invar_step[OF \\is_invar \\\\])\n by auto\n\n lemma step_rel_rtrancl_None_eq[simp]: \"step_rel\\<^sup>*\\<^sup>* None s \\ s=None\"\n using converse_rtranclpE by fastforce\n\n lemma is_weak_invar_exec:\n assumes \"is_weak_invar \\\"\n assumes \"\\ s\"\n assumes \"step_rel\\<^sup>*\\<^sup>* (Some s) (Some s')\"\n shows \"\\ s'\"\n using assms(3,2)\n apply (induction a\\\"Some s\" arbitrary: s rule: converse_rtranclp_induct)\n subgoal by simp\n subgoal for z s\n apply (cases z; simp)\n apply (drule (1) is_weak_invar_step[OF \\is_weak_invar \\\\])\n by auto\n done\n\n lemma is_invar_yields:\n assumes \"is_invar \\\"\n assumes \"\\ s\"\n assumes \"yields' s = Some so'\"\n shows \"\\s'. so'=Some s' \\ halted s' \\ \\ s'\"\n using assms\n apply (auto simp: yields_eq_Some_conv is_result_def is_invar_exec)\n using is_invar_exec terminated.simps(1) by blast\n\n lemma is_weak_invar_yields:\n assumes \"is_weak_invar \\\"\n assumes \"\\ s\"\n assumes \"yields' s = Some (Some s')\"\n shows \"\\ s'\"\n using assms\n by (auto simp: yields_eq_Some_conv is_result_def is_weak_invar_exec)\n\n\n\n\n lemma is_invarI:\n assumes \"\\s. \\ \\ s; \\halted s \\ \\ wps step (\\_. \\) s\"\n shows \"is_invar \\\"\n using assms\n unfolding is_invar_def by blast\n\n lemma is_weak_invarI:\n assumes \"\\s s'. \\ \\ s; \\halted s; step s = Some ((),s') \\ \\ \\ s'\"\n shows \"is_weak_invar \\\"\n using assms\n unfolding is_weak_invar_def by blast\n\n lemma app_weak_invar:\n assumes \"is_weak_invar \\'\"\n assumes \"\\halted s\" \"\\' s\"\n assumes \"wps step (\\_ s'. \\' s' \\ \\ s') s\"\n shows \"wps step (\\_. \\) s\"\n using assms unfolding is_weak_invar_def wps_def\n by (auto split: option.splits)\n\n lemma is_weak_invarD:\n assumes \"is_weak_invar \\\"\n assumes \"\\ s\" \"\\halted s\"\n assumes \"step s = Some ((),s')\"\n shows \"\\ s'\"\n using assms\n by (auto simp: is_weak_invar_def)\n\n\nend\n\nlocale std_invar_system = det_system step halted for step :: \"(unit,'s) se\" and halted +\n fixes stdI :: \"'s \\ bool\"\n assumes stdI: \"is_weak_invar stdI\"\nbegin\n definition \"is_std_invar \\ \\ is_invar (\\s. stdI s \\ \\ s)\"\n\n lemma is_std_invarI:\n assumes \"\\s. \\ \\ s; stdI s; \\halted s \\ \\ wps step (\\_ s'. stdI s' \\ \\ s') s\"\n shows \"is_std_invar \\\"\n unfolding is_std_invar_def\n apply (rule is_invarI)\n apply (rule app_weak_invar[OF stdI]; simp)\n using assms by blast\n\n definition \"htriple P Q \\ \\s. stdI s \\ P s \\ (case yields' s of\n None \\ True\n | Some None \\ False\n | Some (Some s') \\ Q s'\n )\"\n\n lemma htripleI:\n assumes \"\\s so'. \\ stdI s; P s; yields' s = Some so' \\ \\ \\s'. so' = Some s' \\ (stdI s' \\ Q s')\"\n shows \"local.htriple P Q\"\n using assms unfolding htriple_def\n using local.is_weak_invar_yields local.stdI\n by (fastforce split: option.split)\n\nend\n\n\nlocale floyd_system = std_invar_system step halted stdI for step :: \"(unit,'s) se\" and halted stdI +\n fixes \\ :: \"'s \\ bool\"\nbegin\n definition \"has_invar s \\ halted s \\ \\ s \\ None\"\n\n lemma has_invar_simps[simp]:\n \"\\ s = Some x \\ has_invar s\"\n \"\\ s = None \\ has_invar s = halted s\"\n by (auto simp: has_invar_def)\n\n sublocale isys: det_system step has_invar .\n\n\n definition \"invar s \\\n case isys.yields' s of\n None \\ False\n | Some so' \\ (case so' of None \\ False | Some s' \\ \\ s' = Some True)\n \"\n\n lemma invar_unfold:\n \"invar s = (case \\ s of Some b \\ b | None \\ (\\halted s \\ wps (step) (\\_. invar) s))\"\n unfolding invar_def wps_def\n apply (subst isys.yields_unfold)\n by (auto split: option.splits)\n\n\n \n\n\n lemma invar_imp_\\_true: \"invar s \\ has_invar s \\ \\ s = Some True\"\n unfolding invar_def by (auto split: option.splits)\n\n lemma invarI:\n assumes \"\\s. \\ \\ s = Some True; stdI s; \\halted s \\ \\ wps step (\\_ s'. stdI s' \\ invar s') s\"\n shows \"is_std_invar invar\"\n proof (rule is_std_invarI)\n fix s\n assume \"invar s\" \"\\halted s\" \"stdI s\"\n\n from \\invar s\\ consider (HAS_INVAR) \"\\ s = Some True\" | (NO_INVAR) \"\\ s = None\"\n using has_invar_def invar_imp_\\_true by blast\n then show \"wps step (\\_ s'. stdI s' \\ invar s') s\" proof cases\n case HAS_INVAR\n then show ?thesis\n using \\\\ halted s\\ \\stdI s\\ assms by blast\n next\n case NO_INVAR\n hence \"\\has_invar s\" using \\\\ halted s\\ by (auto simp: has_invar_def)\n then show ?thesis\n using \\invar s\\ invar_step wps_mono by fastforce\n qed\n qed\n\n\n lemma halted_invar_conv:\n assumes [simp]: \"halted s\"\n shows \"invar s \\ \\ s = Some True\"\n by (subst invar_unfold) (auto split: option.split)\n\n lemma std_invar_yields:\n assumes \"is_std_invar invar\"\n assumes \"stdI s\" \"invar s\" \"yields' s = Some so'\"\n shows \"\\s'. so' = Some s' \\ halted s' \\ stdI s' \\ \\ s' = Some True\"\n proof -\n from assms(1) have \"is_invar (\\s. stdI s \\ invar s)\" by (simp add: is_std_invar_def)\n note X1 = is_invar_yields[OF this]\n\n from assms(2-) X1 obtain s' where X2: \"so' = Some s'\" \"halted s'\" \"stdI s'\" \"invar s'\"\n by auto\n with halted_invar_conv have \"\\ s' = Some True\" by blast\n with X2 show ?thesis by blast\n qed\n\nend\n\n\n\nlocale cfg_system = std_invar_system step halted stdI for step :: \"(unit,'s) se\" and halted stdI +\n fixes location :: \"'s \\ 'loc\"\nbegin\n definition linvar :: \"('loc \\ ('s \\ bool) option) \\ 's \\ bool option\" where\n \"linvar \\ s \\\n case \\ (location s) of\n None \\ None\n | Some \\ \\ Some (\\ s)\"\n\n sublocale floyd: floyd_system step halted stdI \"linvar \\\" for \\ by standard\n\n definition \"floyd_vcs \\' \\ \\\n \\\\ s. \\' (location s) = Some \\ \\ \\ s \\ stdI s \\ \\halted s \\ wps step (\\_ s'. stdI s' \\ floyd.invar \\ s') s\"\n\n lemma floyd_vcs_emptyI:\n \"floyd_vcs Map.empty \\\"\n by (auto simp: floyd_vcs_def)\n\n lemma floyd_vcs_updI:\n assumes \"floyd_vcs \\' \\\"\n assumes \"\\s. \\ location s = l; \\ s; stdI s; \\halted s \\ \\ wps step (\\_ s'. stdI s' \\ floyd.invar \\ s') s\"\n shows \"floyd_vcs (\\'(l\\\\)) \\\"\n using assms\n by (auto simp: floyd_vcs_def)\n\n lemmas floyd_vcsI = floyd_vcs_emptyI floyd_vcs_updI\n\n lemma linvar_conv:\n \"linvar \\ s = None \\ \\ (location s) = None\"\n \"linvar \\ s = Some b \\ (\\\\. \\ (location s) = Some \\ \\ b=\\ s)\"\n by (auto simp: linvar_def split: option.splits)\n\n lemma floyd_invarI: \"floyd_vcs \\ \\ \\ is_std_invar (floyd.invar \\)\"\n apply (rule floyd.invarI)\n unfolding floyd_vcs_def\n by (auto simp: linvar_conv)\n\n lemma linvar_unfoldI:\n assumes \"case \\ (location s) of\n None \\ \\halted s \\ wps step (\\_. floyd.invar \\) s\n | Some \\ \\ \\ s\"\n shows \"floyd.invar \\ s\"\n apply (subst floyd.invar_unfold)\n using assms\n by (auto simp: linvar_conv split: option.split)\n\n\n lemma floyd_htripleI:\n assumes \"\\s. P s \\ floyd.invar \\ s\" \\ \\Precondition implies invariant\\\n assumes \"is_std_invar (floyd.invar \\)\" \\ \\Invariant\\\n assumes \"\\s \\. \\ halted s; stdI s; \\ (location s) = Some \\; \\ s \\ \\ Q s\" \\ \\On termination, invariant implies postcondition\\\n shows \"local.htriple P Q\"\n apply (rule htripleI)\n subgoal for s so'\n using floyd.std_invar_yields[OF assms(2), of s so']\n apply (clarsimp simp: linvar_conv)\n using assms(1,3) by blast\n done\n\n\nend\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/old_work/isabelle/Monads/Abstract_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.2968040682220356}} {"text": "(* Title: HOL/Record.thy\n Author: Wolfgang Naraschewski, TU Muenchen\n Author: Markus Wenzel, TU Muenchen\n Author: Norbert Schirmer, TU Muenchen\n Author: Thomas Sewell, NICTA\n Author: Florian Haftmann, TU Muenchen\n*)\n\nsection \\Extensible records with structural subtyping\\\n\ntheory Record\nimports Quickcheck_Exhaustive\nkeywords\n \"record\" :: thy_defn and\n \"print_record\" :: diag\nbegin\n\nsubsection \\Introduction\\\n\ntext \\\n Records are isomorphic to compound tuple types. To implement\n efficient records, we make this isomorphism explicit. Consider the\n record access/update simplification \\alpha (beta_update f\n rec) = alpha rec\\ for distinct fields alpha and beta of some record\n rec with n fields. There are \\n ^ 2\\ such theorems, which\n prohibits storage of all of them for large n. The rules can be\n proved on the fly by case decomposition and simplification in O(n)\n time. By creating O(n) isomorphic-tuple types while defining the\n record, however, we can prove the access/update simplification in\n \\O(log(n)^2)\\ time.\n\n The O(n) cost of case decomposition is not because O(n) steps are\n taken, but rather because the resulting rule must contain O(n) new\n variables and an O(n) size concrete record construction. To sidestep\n this cost, we would like to avoid case decomposition in proving\n access/update theorems.\n\n Record types are defined as isomorphic to tuple types. For instance,\n a record type with fields \\'a\\, \\'b\\, \\'c\\\n and \\'d\\ might be introduced as isomorphic to \\'a \\\n ('b \\ ('c \\ 'd))\\. If we balance the tuple tree to \\('a \\\n 'b) \\ ('c \\ 'd)\\ then accessors can be defined by converting to the\n underlying type then using O(log(n)) fst or snd operations.\n Updators can be defined similarly, if we introduce a \\fst_update\\ and \\snd_update\\ function. Furthermore, we can\n prove the access/update theorem in O(log(n)) steps by using simple\n rewrites on fst, snd, \\fst_update\\ and \\snd_update\\.\n\n The catch is that, although O(log(n)) steps were taken, the\n underlying type we converted to is a tuple tree of size\n O(n). Processing this term type wastes performance. We avoid this\n for large n by taking each subtree of size K and defining a new type\n isomorphic to that tuple subtree. A record can now be defined as\n isomorphic to a tuple tree of these O(n/K) new types, or, if \\n > K*K\\, we can repeat the process, until the record can be\n defined in terms of a tuple tree of complexity less than the\n constant K.\n\n If we prove the access/update theorem on this type with the\n analogous steps to the tuple tree, we consume \\O(log(n)^2)\\\n time as the intermediate terms are \\O(log(n))\\ in size and\n the types needed have size bounded by K. To enable this analogous\n traversal, we define the functions seen below: \\iso_tuple_fst\\, \\iso_tuple_snd\\, \\iso_tuple_fst_update\\\n and \\iso_tuple_snd_update\\. These functions generalise tuple\n operations by taking a parameter that encapsulates a tuple\n isomorphism. The rewrites needed on these functions now need an\n additional assumption which is that the isomorphism works.\n\n These rewrites are typically used in a structured way. They are here\n presented as the introduction rule \\isomorphic_tuple.intros\\\n rather than as a rewrite rule set. The introduction form is an\n optimisation, as net matching can be performed at one term location\n for each step rather than the simplifier searching the term for\n possible pattern matches. The rule set is used as it is viewed\n outside the locale, with the locale assumption (that the isomorphism\n is valid) left as a rule assumption. All rules are structured to aid\n net matching, using either a point-free form or an encapsulating\n predicate.\n\\\n\nsubsection \\Operators and lemmas for types isomorphic to tuples\\\n\ndatatype (dead 'a, dead 'b, dead 'c) tuple_isomorphism =\n Tuple_Isomorphism \"'a \\ 'b \\ 'c\" \"'b \\ 'c \\ 'a\"\n\nprimrec\n repr :: \"('a, 'b, 'c) tuple_isomorphism \\ 'a \\ 'b \\ 'c\" where\n \"repr (Tuple_Isomorphism r a) = r\"\n\nprimrec\n abst :: \"('a, 'b, 'c) tuple_isomorphism \\ 'b \\ 'c \\ 'a\" where\n \"abst (Tuple_Isomorphism r a) = a\"\n\ndefinition\n iso_tuple_fst :: \"('a, 'b, 'c) tuple_isomorphism \\ 'a \\ 'b\" where\n \"iso_tuple_fst isom = fst \\ repr isom\"\n\ndefinition\n iso_tuple_snd :: \"('a, 'b, 'c) tuple_isomorphism \\ 'a \\ 'c\" where\n \"iso_tuple_snd isom = snd \\ repr isom\"\n\ndefinition\n iso_tuple_fst_update ::\n \"('a, 'b, 'c) tuple_isomorphism \\ ('b \\ 'b) \\ ('a \\ 'a)\" where\n \"iso_tuple_fst_update isom f = abst isom \\ apfst f \\ repr isom\"\n\ndefinition\n iso_tuple_snd_update ::\n \"('a, 'b, 'c) tuple_isomorphism \\ ('c \\ 'c) \\ ('a \\ 'a)\" where\n \"iso_tuple_snd_update isom f = abst isom \\ apsnd f \\ repr isom\"\n\ndefinition\n iso_tuple_cons ::\n \"('a, 'b, 'c) tuple_isomorphism \\ 'b \\ 'c \\ 'a\" where\n \"iso_tuple_cons isom = curry (abst isom)\"\n\n\nsubsection \\Logical infrastructure for records\\\n\ndefinition\n iso_tuple_surjective_proof_assist :: \"'a \\ 'b \\ ('a \\ 'b) \\ bool\" where\n \"iso_tuple_surjective_proof_assist x y f \\ f x = y\"\n\ndefinition\n iso_tuple_update_accessor_cong_assist ::\n \"(('b \\ 'b) \\ ('a \\ 'a)) \\ ('a \\ 'b) \\ bool\" where\n \"iso_tuple_update_accessor_cong_assist upd ac \\\n (\\f v. upd (\\x. f (ac v)) v = upd f v) \\ (\\v. upd id v = v)\"\n\ndefinition\n iso_tuple_update_accessor_eq_assist ::\n \"(('b \\ 'b) \\ ('a \\ 'a)) \\ ('a \\ 'b) \\ 'a \\ ('b \\ 'b) \\ 'a \\ 'b \\ bool\" where\n \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\\n upd f v = v' \\ ac v = x \\ iso_tuple_update_accessor_cong_assist upd ac\"\n\nlemma update_accessor_congruence_foldE:\n assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n and r: \"r = r'\" and v: \"ac r' = v'\"\n and f: \"\\v. v' = v \\ f v = f' v\"\n shows \"upd f r = upd f' r'\"\n using uac r v [symmetric]\n apply (subgoal_tac \"upd (\\x. f (ac r')) r' = upd (\\x. f' (ac r')) r'\")\n apply (simp add: iso_tuple_update_accessor_cong_assist_def)\n apply (simp add: f)\n done\n\nlemma update_accessor_congruence_unfoldE:\n \"iso_tuple_update_accessor_cong_assist upd ac \\\n r = r' \\ ac r' = v' \\ (\\v. v = v' \\ f v = f' v) \\\n upd f r = upd f' r'\"\n apply (erule(2) update_accessor_congruence_foldE)\n apply simp\n done\n\nlemma iso_tuple_update_accessor_cong_assist_id:\n \"iso_tuple_update_accessor_cong_assist upd ac \\ upd id = id\"\n by rule (simp add: iso_tuple_update_accessor_cong_assist_def)\n\nlemma update_accessor_noopE:\n assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n and ac: \"f (ac x) = ac x\"\n shows \"upd f x = x\"\n using uac\n by (simp add: ac iso_tuple_update_accessor_cong_assist_id [OF uac, unfolded id_def]\n cong: update_accessor_congruence_unfoldE [OF uac])\n\nlemma update_accessor_noop_compE:\n assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n and ac: \"f (ac x) = ac x\"\n shows \"upd (g \\ f) x = upd g x\"\n by (simp add: ac cong: update_accessor_congruence_unfoldE[OF uac])\n\nlemma update_accessor_cong_assist_idI:\n \"iso_tuple_update_accessor_cong_assist id id\"\n by (simp add: iso_tuple_update_accessor_cong_assist_def)\n\nlemma update_accessor_cong_assist_triv:\n \"iso_tuple_update_accessor_cong_assist upd ac \\\n iso_tuple_update_accessor_cong_assist upd ac\"\n by assumption\n\nlemma update_accessor_accessor_eqE:\n \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\ ac v = x\"\n by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma update_accessor_updator_eqE:\n \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\ upd f v = v'\"\n by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma iso_tuple_update_accessor_eq_assist_idI:\n \"v' = f v \\ iso_tuple_update_accessor_eq_assist id id v f v' v\"\n by (simp add: iso_tuple_update_accessor_eq_assist_def update_accessor_cong_assist_idI)\n\nlemma iso_tuple_update_accessor_eq_assist_triv:\n \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\\n iso_tuple_update_accessor_eq_assist upd ac v f v' x\"\n by assumption\n\nlemma iso_tuple_update_accessor_cong_from_eq:\n \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\\n iso_tuple_update_accessor_cong_assist upd ac\"\n by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma iso_tuple_surjective_proof_assistI:\n \"f x = y \\ iso_tuple_surjective_proof_assist x y f\"\n by (simp add: iso_tuple_surjective_proof_assist_def)\n\nlemma iso_tuple_surjective_proof_assist_idE:\n \"iso_tuple_surjective_proof_assist x y id \\ x = y\"\n by (simp add: iso_tuple_surjective_proof_assist_def)\n\nlocale isomorphic_tuple =\n fixes isom :: \"('a, 'b, 'c) tuple_isomorphism\"\n assumes repr_inv: \"\\x. abst isom (repr isom x) = x\"\n and abst_inv: \"\\y. repr isom (abst isom y) = y\"\nbegin\n\nlemma repr_inj: \"repr isom x = repr isom y \\ x = y\"\n by (auto dest: arg_cong [of \"repr isom x\" \"repr isom y\" \"abst isom\"]\n simp add: repr_inv)\n\nlemma abst_inj: \"abst isom x = abst isom y \\ x = y\"\n by (auto dest: arg_cong [of \"abst isom x\" \"abst isom y\" \"repr isom\"]\n simp add: abst_inv)\n\nlemmas simps = Let_def repr_inv abst_inv repr_inj abst_inj\n\nlemma iso_tuple_access_update_fst_fst:\n \"f \\ h g = j \\ f \\\n (f \\ iso_tuple_fst isom) \\ (iso_tuple_fst_update isom \\ h) g =\n j \\ (f \\ iso_tuple_fst isom)\"\n by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_fst_def simps\n fun_eq_iff)\n\nlemma iso_tuple_access_update_snd_snd:\n \"f \\ h g = j \\ f \\\n (f \\ iso_tuple_snd isom) \\ (iso_tuple_snd_update isom \\ h) g =\n j \\ (f \\ iso_tuple_snd isom)\"\n by (clarsimp simp: iso_tuple_snd_update_def iso_tuple_snd_def simps\n fun_eq_iff)\n\nlemma iso_tuple_access_update_fst_snd:\n \"(f \\ iso_tuple_fst isom) \\ (iso_tuple_snd_update isom \\ h) g =\n id \\ (f \\ iso_tuple_fst isom)\"\n by (clarsimp simp: iso_tuple_snd_update_def iso_tuple_fst_def simps\n fun_eq_iff)\n\nlemma iso_tuple_access_update_snd_fst:\n \"(f \\ iso_tuple_snd isom) \\ (iso_tuple_fst_update isom \\ h) g =\n id \\ (f \\ iso_tuple_snd isom)\"\n by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_def simps\n fun_eq_iff)\n\nlemma iso_tuple_update_swap_fst_fst:\n \"h f \\ j g = j g \\ h f \\\n (iso_tuple_fst_update isom \\ h) f \\ (iso_tuple_fst_update isom \\ j) g =\n (iso_tuple_fst_update isom \\ j) g \\ (iso_tuple_fst_update isom \\ h) f\"\n by (clarsimp simp: iso_tuple_fst_update_def simps apfst_compose fun_eq_iff)\n\nlemma iso_tuple_update_swap_snd_snd:\n \"h f \\ j g = j g \\ h f \\\n (iso_tuple_snd_update isom \\ h) f \\ (iso_tuple_snd_update isom \\ j) g =\n (iso_tuple_snd_update isom \\ j) g \\ (iso_tuple_snd_update isom \\ h) f\"\n by (clarsimp simp: iso_tuple_snd_update_def simps apsnd_compose fun_eq_iff)\n\nlemma iso_tuple_update_swap_fst_snd:\n \"(iso_tuple_snd_update isom \\ h) f \\ (iso_tuple_fst_update isom \\ j) g =\n (iso_tuple_fst_update isom \\ j) g \\ (iso_tuple_snd_update isom \\ h) f\"\n by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_update_def\n simps fun_eq_iff)\n\nlemma iso_tuple_update_swap_snd_fst:\n \"(iso_tuple_fst_update isom \\ h) f \\ (iso_tuple_snd_update isom \\ j) g =\n (iso_tuple_snd_update isom \\ j) g \\ (iso_tuple_fst_update isom \\ h) f\"\n by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_update_def simps\n fun_eq_iff)\n\nlemma iso_tuple_update_compose_fst_fst:\n \"h f \\ j g = k (f \\ g) \\\n (iso_tuple_fst_update isom \\ h) f \\ (iso_tuple_fst_update isom \\ j) g =\n (iso_tuple_fst_update isom \\ k) (f \\ g)\"\n by (clarsimp simp: iso_tuple_fst_update_def simps apfst_compose fun_eq_iff)\n\nlemma iso_tuple_update_compose_snd_snd:\n \"h f \\ j g = k (f \\ g) \\\n (iso_tuple_snd_update isom \\ h) f \\ (iso_tuple_snd_update isom \\ j) g =\n (iso_tuple_snd_update isom \\ k) (f \\ g)\"\n by (clarsimp simp: iso_tuple_snd_update_def simps apsnd_compose fun_eq_iff)\n\nlemma iso_tuple_surjective_proof_assist_step:\n \"iso_tuple_surjective_proof_assist v a (iso_tuple_fst isom \\ f) \\\n iso_tuple_surjective_proof_assist v b (iso_tuple_snd isom \\ f) \\\n iso_tuple_surjective_proof_assist v (iso_tuple_cons isom a b) f\"\n by (clarsimp simp: iso_tuple_surjective_proof_assist_def simps\n iso_tuple_fst_def iso_tuple_snd_def iso_tuple_cons_def)\n\nlemma iso_tuple_fst_update_accessor_cong_assist:\n assumes \"iso_tuple_update_accessor_cong_assist f g\"\n shows \"iso_tuple_update_accessor_cong_assist\n (iso_tuple_fst_update isom \\ f) (g \\ iso_tuple_fst isom)\"\nproof -\n from assms have \"f id = id\"\n by (rule iso_tuple_update_accessor_cong_assist_id)\n with assms show ?thesis\n by (clarsimp simp: iso_tuple_update_accessor_cong_assist_def simps\n iso_tuple_fst_update_def iso_tuple_fst_def)\nqed\n\nlemma iso_tuple_snd_update_accessor_cong_assist:\n assumes \"iso_tuple_update_accessor_cong_assist f g\"\n shows \"iso_tuple_update_accessor_cong_assist\n (iso_tuple_snd_update isom \\ f) (g \\ iso_tuple_snd isom)\"\nproof -\n from assms have \"f id = id\"\n by (rule iso_tuple_update_accessor_cong_assist_id)\n with assms show ?thesis\n by (clarsimp simp: iso_tuple_update_accessor_cong_assist_def simps\n iso_tuple_snd_update_def iso_tuple_snd_def)\nqed\n\nlemma iso_tuple_fst_update_accessor_eq_assist:\n assumes \"iso_tuple_update_accessor_eq_assist f g a u a' v\"\n shows \"iso_tuple_update_accessor_eq_assist\n (iso_tuple_fst_update isom \\ f) (g \\ iso_tuple_fst isom)\n (iso_tuple_cons isom a b) u (iso_tuple_cons isom a' b) v\"\nproof -\n from assms have \"f id = id\"\n by (auto simp add: iso_tuple_update_accessor_eq_assist_def\n intro: iso_tuple_update_accessor_cong_assist_id)\n with assms show ?thesis\n by (clarsimp simp: iso_tuple_update_accessor_eq_assist_def\n iso_tuple_fst_update_def iso_tuple_fst_def\n iso_tuple_update_accessor_cong_assist_def iso_tuple_cons_def simps)\nqed\n\nlemma iso_tuple_snd_update_accessor_eq_assist:\n assumes \"iso_tuple_update_accessor_eq_assist f g b u b' v\"\n shows \"iso_tuple_update_accessor_eq_assist\n (iso_tuple_snd_update isom \\ f) (g \\ iso_tuple_snd isom)\n (iso_tuple_cons isom a b) u (iso_tuple_cons isom a b') v\"\nproof -\n from assms have \"f id = id\"\n by (auto simp add: iso_tuple_update_accessor_eq_assist_def\n intro: iso_tuple_update_accessor_cong_assist_id)\n with assms show ?thesis\n by (clarsimp simp: iso_tuple_update_accessor_eq_assist_def\n iso_tuple_snd_update_def iso_tuple_snd_def\n iso_tuple_update_accessor_cong_assist_def iso_tuple_cons_def simps)\nqed\n\nlemma iso_tuple_cons_conj_eqI:\n \"a = c \\ b = d \\ P \\ Q \\\n iso_tuple_cons isom a b = iso_tuple_cons isom c d \\ P \\ Q\"\n by (clarsimp simp: iso_tuple_cons_def simps)\n\nlemmas intros =\n iso_tuple_access_update_fst_fst\n iso_tuple_access_update_snd_snd\n iso_tuple_access_update_fst_snd\n iso_tuple_access_update_snd_fst\n iso_tuple_update_swap_fst_fst\n iso_tuple_update_swap_snd_snd\n iso_tuple_update_swap_fst_snd\n iso_tuple_update_swap_snd_fst\n iso_tuple_update_compose_fst_fst\n iso_tuple_update_compose_snd_snd\n iso_tuple_surjective_proof_assist_step\n iso_tuple_fst_update_accessor_eq_assist\n iso_tuple_snd_update_accessor_eq_assist\n iso_tuple_fst_update_accessor_cong_assist\n iso_tuple_snd_update_accessor_cong_assist\n iso_tuple_cons_conj_eqI\n\nend\n\nlemma isomorphic_tuple_intro:\n fixes repr abst\n assumes repr_inj: \"\\x y. repr x = repr y \\ x = y\"\n and abst_inv: \"\\z. repr (abst z) = z\"\n and v: \"v \\ Tuple_Isomorphism repr abst\"\n shows \"isomorphic_tuple v\"\nproof\n fix x have \"repr (abst (repr x)) = repr x\"\n by (simp add: abst_inv)\n then show \"Record.abst v (Record.repr v x) = x\"\n by (simp add: v repr_inj)\nnext\n fix y\n show \"Record.repr v (Record.abst v y) = y\"\n by (simp add: v) (fact abst_inv)\nqed\n\ndefinition\n \"tuple_iso_tuple \\ Tuple_Isomorphism id id\"\n\nlemma tuple_iso_tuple:\n \"isomorphic_tuple tuple_iso_tuple\"\n by (simp add: isomorphic_tuple_intro [OF _ _ reflexive] tuple_iso_tuple_def)\n\nlemma refl_conj_eq: \"Q = R \\ P \\ Q \\ P \\ R\"\n by simp\n\nlemma iso_tuple_UNIV_I: \"x \\ UNIV \\ True\"\n by simp\n\nlemma iso_tuple_True_simp: \"(True \\ PROP P) \\ PROP P\"\n by simp\n\nlemma prop_subst: \"s = t \\ PROP P t \\ PROP P s\"\n by simp\n\nlemma K_record_comp: \"(\\x. c) \\ f = (\\x. c)\"\n by (simp add: comp_def)\n\n\nsubsection \\Concrete record syntax\\\n\nnonterminal\n ident and\n field_type and\n field_types and\n field and\n fields and\n field_update and\n field_updates\n\nsyntax\n \"_constify\" :: \"id => ident\" (\"_\")\n \"_constify\" :: \"longid => ident\" (\"_\")\n\n \"_field_type\" :: \"ident => type => field_type\" (\"(2_ ::/ _)\")\n \"\" :: \"field_type => field_types\" (\"_\")\n \"_field_types\" :: \"field_type => field_types => field_types\" (\"_,/ _\")\n \"_record_type\" :: \"field_types => type\" (\"(3\\_\\)\")\n \"_record_type_scheme\" :: \"field_types => type => type\" (\"(3\\_,/ (2\\ ::/ _)\\)\")\n\n \"_field\" :: \"ident => 'a => field\" (\"(2_ =/ _)\")\n \"\" :: \"field => fields\" (\"_\")\n \"_fields\" :: \"field => fields => fields\" (\"_,/ _\")\n \"_record\" :: \"fields => 'a\" (\"(3\\_\\)\")\n \"_record_scheme\" :: \"fields => 'a => 'a\" (\"(3\\_,/ (2\\ =/ _)\\)\")\n\n \"_field_update\" :: \"ident => 'a => field_update\" (\"(2_ :=/ _)\")\n \"\" :: \"field_update => field_updates\" (\"_\")\n \"_field_updates\" :: \"field_update => field_updates => field_updates\" (\"_,/ _\")\n \"_record_update\" :: \"'a => field_updates => 'b\" (\"_/(3\\_\\)\" [900, 0] 900)\n\nsyntax (ASCII)\n \"_record_type\" :: \"field_types => type\" (\"(3'(| _ |'))\")\n \"_record_type_scheme\" :: \"field_types => type => type\" (\"(3'(| _,/ (2... ::/ _) |'))\")\n \"_record\" :: \"fields => 'a\" (\"(3'(| _ |'))\")\n \"_record_scheme\" :: \"fields => 'a => 'a\" (\"(3'(| _,/ (2... =/ _) |'))\")\n \"_record_update\" :: \"'a => field_updates => 'b\" (\"_/(3'(| _ |'))\" [900, 0] 900)\n\n\nsubsection \\Record package\\\n\nML_file \\Tools/record.ML\\\n\nhide_const (open) Tuple_Isomorphism repr abst iso_tuple_fst iso_tuple_snd\n iso_tuple_fst_update iso_tuple_snd_update iso_tuple_cons\n iso_tuple_surjective_proof_assist iso_tuple_update_accessor_cong_assist\n iso_tuple_update_accessor_eq_assist tuple_iso_tuple\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Record.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.29676813936535956}} {"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\Natural transformation of a semifunctor\\\ntheory CZH_SMC_NTSMCF\n imports \n CZH_SMC_Semifunctor\n CZH_DG_TDGHM\nbegin\n\n\n\nsubsection\\Background\\\n\nnamed_theorems ntsmcf_cs_simps\nnamed_theorems ntsmcf_cs_intros\n\nlemmas [smc_cs_simps] = dg_shared_cs_simps\nlemmas [smc_cs_intros] = dg_shared_cs_intros\n\n\nsubsubsection\\Slicing\\\n\ndefinition ntsmcf_tdghm :: \"V \\ V\"\n where \"ntsmcf_tdghm \\ = \n [\n \\\\NTMap\\, \n smcf_dghm (\\\\NTDom\\),\n smcf_dghm (\\\\NTCod\\),\n smc_dg (\\\\NTDGDom\\),\n smc_dg (\\\\NTDGCod\\)\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma ntsmcf_tdghm_components:\n shows [slicing_simps]: \"ntsmcf_tdghm \\\\NTMap\\ = \\\\NTMap\\\"\n and [slicing_commute]: \"ntsmcf_tdghm \\\\NTDom\\ = smcf_dghm (\\\\NTDom\\)\"\n and [slicing_commute]: \"ntsmcf_tdghm \\\\NTCod\\ = smcf_dghm (\\\\NTCod\\)\"\n and [slicing_commute]: \"ntsmcf_tdghm \\\\NTDGDom\\ = smc_dg (\\\\NTDGDom\\)\"\n and [slicing_commute]: \"ntsmcf_tdghm \\\\NTDGCod\\ = smc_dg (\\\\NTDGCod\\)\"\n unfolding ntsmcf_tdghm_def nt_field_simps by (auto simp: nat_omega_simps)\n\n\n\nsubsection\\Definition and elementary properties\\\n\n\ntext\\\nA natural transformation of semifunctors, as presented in this work,\nis a generalization of the concept of a natural transformation, as presented in\nChapter I-4 in \\<^cite>\\\"mac_lane_categories_2010\"\\, to semicategories and\nsemifunctors.\n\\\n\nlocale is_ntsmcf = \n \\ \\ + \n vfsequence \\ + \n NTDom: is_semifunctor \\ \\ \\ \\ + \n NTCod: is_semifunctor \\ \\ \\ \\\n for \\ \\ \\ \\ \\ \\ +\n assumes ntsmcf_length[smc_cs_simps]: \"vcard \\ = 5\\<^sub>\\\" \n and ntsmcf_is_tdghm[slicing_intros]: \"ntsmcf_tdghm \\ :\n smcf_dghm \\ \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M smcf_dghm \\ : smc_dg \\ \\\\\\<^sub>D\\<^sub>G\\<^bsub>\\\\<^esub> smc_dg \\\"\n and ntsmcf_NTDom[smc_cs_simps]: \"\\\\NTDom\\ = \\\"\n and ntsmcf_NTCod[smc_cs_simps]: \"\\\\NTCod\\ = \\\"\n and ntsmcf_NTDGDom[smc_cs_simps]: \"\\\\NTDGDom\\ = \\\"\n and ntsmcf_NTDGCod[smc_cs_simps]: \"\\\\NTDGCod\\ = \\\"\n and ntsmcf_Comp_commute[smc_cs_intros]: \"f : a \\\\<^bsub>\\\\<^esub> b \\\n \\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\" \n\nsyntax \"_is_ntsmcf\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F _ :/ _ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_ntsmcf \\ \\ \\ \\ \\ \\\"\n\nabbreviation all_ntsmcfs :: \"V \\ V\"\n where \"all_ntsmcfs \\ \\ set {\\. \\\\ \\ \\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\n\nabbreviation ntsmcfs :: \"V \\ V \\ V \\ V\"\n where \"ntsmcfs \\ \\ \\ \\ set {\\. \\\\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\n\nabbreviation these_ntsmcfs :: \"V \\ V \\ V \\ V \\ V \\ V\"\n where \"these_ntsmcfs \\ \\ \\ \\ \\ \\ set {\\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\n\nlemmas [smc_cs_simps] =\n is_ntsmcf.ntsmcf_length\n is_ntsmcf.ntsmcf_NTDom\n is_ntsmcf.ntsmcf_NTCod\n is_ntsmcf.ntsmcf_NTDGDom\n is_ntsmcf.ntsmcf_NTDGCod\n is_ntsmcf.ntsmcf_Comp_commute\n\nlemmas [smc_cs_intros] = is_ntsmcf.ntsmcf_Comp_commute\n\nlemma (in is_ntsmcf) ntsmcf_is_tdghm':\n assumes \"\\' = smcf_dghm \\\"\n and \"\\' = smcf_dghm \\\"\n and \"\\' = smc_dg \\\"\n and \"\\' = smc_dg \\\"\n shows \"ntsmcf_tdghm \\ : \\' \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M \\' : \\' \\\\\\<^sub>D\\<^sub>G\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms(1-4) by (rule ntsmcf_is_tdghm)\n\nlemmas [slicing_intros] = is_ntsmcf.ntsmcf_is_tdghm'\n\n\ntext\\Rules.\\\n\nlemma (in is_ntsmcf) is_ntsmcf_axioms'[smc_cs_intros]:\n assumes \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\' \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_ntsmcf_axioms)\n\nmk_ide rf is_ntsmcf_def[unfolded is_ntsmcf_axioms_def]\n |intro is_ntsmcfI|\n |dest is_ntsmcfD[dest]|\n |elim is_ntsmcfE[elim]|\n\nlemmas [smc_cs_intros] = \n is_ntsmcfD(3,4)\n\nlemma is_ntsmcfI':\n assumes \"\\ \\\"\n and \"vfsequence \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"vcard \\ = 5\\<^sub>\\\"\n and \"\\\\NTDom\\ = \\\"\n and \"\\\\NTCod\\ = \\\"\n and \"\\\\NTDGDom\\ = \\\"\n and \"\\\\NTDGCod\\ = \\\"\n and \"vsv (\\\\NTMap\\)\"\n and \"\\\\<^sub>\\ (\\\\NTMap\\) = \\\\Obj\\\"\n and \"\\a. a \\\\<^sub>\\ \\\\Obj\\ \\ \\\\NTMap\\\\a\\ : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"\\a b f. f : a \\\\<^bsub>\\\\<^esub> b \\\n \\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\"\n shows \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (intro is_ntsmcfI is_tdghmI, unfold ntsmcf_tdghm_components slicing_simps)\n (\n simp_all add: \n assms nat_omega_simps \n ntsmcf_tdghm_def \n is_semifunctorD(6)[OF assms(3)] \n is_semifunctorD(6)[OF assms(4)]\n )\n\nlemma is_ntsmcfD':\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\"\n and \"vfsequence \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"vcard \\ = 5\\<^sub>\\\"\n and \"\\\\NTDom\\ = \\\"\n and \"\\\\NTCod\\ = \\\"\n and \"\\\\NTDGDom\\ = \\\"\n and \"\\\\NTDGCod\\ = \\\"\n and \"vsv (\\\\NTMap\\)\"\n and \"\\\\<^sub>\\ (\\\\NTMap\\) = \\\\Obj\\\"\n and \"\\a. a \\\\<^sub>\\ \\\\Obj\\ \\ \\\\NTMap\\\\a\\ : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"\\a b f. f : a \\\\<^bsub>\\\\<^esub> b \\\n \\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\"\n by \n (\n simp_all add: \n is_ntsmcfD(2-11)[OF assms] \n is_tdghmD[OF is_ntsmcfD(6)[OF assms], unfolded slicing_simps]\n )\n\nlemma is_ntsmcfE':\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains \"\\ \\\"\n and \"vfsequence \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"vcard \\ = 5\\<^sub>\\\"\n and \"\\\\NTDom\\ = \\\"\n and \"\\\\NTCod\\ = \\\"\n and \"\\\\NTDGDom\\ = \\\"\n and \"\\\\NTDGCod\\ = \\\"\n and \"vsv (\\\\NTMap\\)\"\n and \"\\\\<^sub>\\ (\\\\NTMap\\) = \\\\Obj\\\"\n and \"\\a. a \\\\<^sub>\\ \\\\Obj\\ \\ \\\\NTMap\\\\a\\ : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"\\a b f. f : a \\\\<^bsub>\\\\<^esub> b \\\n \\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\"\n using assms by (simp add: is_ntsmcfD')\n\n\ntext\\Slicing.\\\n\ncontext is_ntsmcf\nbegin\n\ninterpretation tdghm: is_tdghm \n \\ \\smc_dg \\\\ \\smc_dg \\\\ \\smcf_dghm \\\\ \\smcf_dghm \\\\ \\ntsmcf_tdghm \\\\\n by (rule ntsmcf_is_tdghm)\n\nlemmas_with [unfolded slicing_simps]:\n ntsmcf_NTMap_vsv = tdghm.tdghm_NTMap_vsv\n and ntsmcf_NTMap_vdomain[smc_cs_simps] = tdghm.tdghm_NTMap_vdomain\n and ntsmcf_NTMap_is_arr = tdghm.tdghm_NTMap_is_arr\n and ntsmcf_NTMap_is_arr'[smc_cs_intros] = tdghm.tdghm_NTMap_is_arr'\n\nsublocale NTMap: vsv \\\\\\NTMap\\\\\n rewrites \"\\\\<^sub>\\ (\\\\NTMap\\) = \\\\Obj\\\"\n by (rule ntsmcf_NTMap_vsv) (simp add: smc_cs_simps)\n\nlemmas_with [unfolded slicing_simps]:\n ntsmcf_NTMap_app_in_Arr[smc_cs_intros] = tdghm.tdghm_NTMap_app_in_Arr\n and ntsmcf_NTMap_vrange_vifunion = tdghm.tdghm_NTMap_vrange_vifunion\n and ntsmcf_NTMap_vrange = tdghm.tdghm_NTMap_vrange\n and ntsmcf_NTMap_vsubset_Vset = tdghm.tdghm_NTMap_vsubset_Vset\n and ntsmcf_NTMap_in_Vset = tdghm.tdghm_NTMap_in_Vset\n and ntsmcf_is_tdghm_if_ge_Limit = tdghm.tdghm_is_tdghm_if_ge_Limit\n\nend\n\nlemmas [smc_cs_intros] = is_ntsmcf.ntsmcf_NTMap_is_arr'\n\nlemma (in is_ntsmcf) ntsmcf_Comp_commute':\n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\" and \"g : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n shows \n \"\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g) =\n (\\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\) \\\\<^sub>A\\<^bsub>\\\\<^esub> g\"\n using assms\n by \n (\n cs_concl cs_shallow\n cs_simp: ntsmcf_Comp_commute semicategory.smc_Comp_assoc[symmetric] \n cs_intro: smc_cs_intros\n )\n\nlemma (in is_ntsmcf) ntsmcf_Comp_commute'':\n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\" and \"g : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n shows \n \"\\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\NTMap\\\\a\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g) =\n (\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\) \\\\<^sub>A\\<^bsub>\\\\<^esub> g\"\n using assms\n by \n (\n cs_concl \n cs_simp: ntsmcf_Comp_commute semicategory.smc_Comp_assoc[symmetric] \n cs_intro: smc_cs_intros\n )\n\n\ntext\\Elementary properties.\\\n\nlemma ntsmcf_eqI:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\' : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\' \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n and \"\\\\NTMap\\ = \\'\\NTMap\\\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n shows \"\\ = \\'\"\nproof-\n interpret L: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret R: is_ntsmcf \\ \\' \\' \\' \\' \\' by (rule assms(2))\n show ?thesis\n proof(rule vsv_eqI)\n have dom: \"\\\\<^sub>\\ \\ = 5\\<^sub>\\\" \n by (cs_concl cs_shallow cs_simp: smc_cs_simps V_cs_simps)\n show \"\\\\<^sub>\\ \\ = \\\\<^sub>\\ \\'\" \n by (cs_concl cs_shallow cs_simp: smc_cs_simps V_cs_simps)\n from assms(4-7) have sup: \n \"\\\\NTDom\\ = \\'\\NTDom\\\" \"\\\\NTCod\\ = \\'\\NTCod\\\" \n \"\\\\NTDGDom\\ = \\'\\NTDGDom\\\" \"\\\\NTDGCod\\ = \\'\\NTDGCod\\\" \n by (simp_all add: smc_cs_simps)\n show \"a \\\\<^sub>\\ \\\\<^sub>\\ \\ \\ \\\\a\\ = \\'\\a\\\" for a \n by (unfold dom, elim_in_numeral, insert assms(3) sup)\n (auto simp: nt_field_simps)\n qed auto\nqed\n\nlemma ntsmcf_tdghm_eqI:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\' : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\' \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n and \"\\ = \\'\"\n and \"ntsmcf_tdghm \\ = ntsmcf_tdghm \\'\"\n shows \"\\ = \\'\"\nproof(rule ntsmcf_eqI[of \\])\n from assms(7) have \"ntsmcf_tdghm \\\\NTMap\\ = ntsmcf_tdghm \\'\\NTMap\\\" by simp\n then show \"\\\\NTMap\\ = \\'\\NTMap\\\" unfolding slicing_simps by simp_all\n from assms(3-6) show \"\\ = \\'\" \"\\ = \\'\" \"\\ = \\'\" \"\\ = \\'\" by simp_all\nqed (simp_all add: assms(1,2))\n\nlemma (in is_ntsmcf) ntsmcf_def:\n \"\\ = [\\\\NTMap\\, \\\\NTDom\\, \\\\NTCod\\, \\\\NTDGDom\\, \\\\NTDGCod\\]\\<^sub>\\\"\nproof(rule vsv_eqI)\n have dom_lhs: \"\\\\<^sub>\\ \\ = 5\\<^sub>\\\" \n by (cs_concl cs_shallow cs_simp: smc_cs_simps V_cs_simps)\n have dom_rhs:\n \"\\\\<^sub>\\ [\\\\NTMap\\, \\\\NTDGDom\\, \\\\NTDGCod\\, \\\\NTDom\\, \\\\NTCod\\]\\<^sub>\\ = 5\\<^sub>\\\"\n by (simp add: nat_omega_simps)\n then show \"\\\\<^sub>\\ \\ = \\\\<^sub>\\ [\\\\NTMap\\, \\\\NTDom\\, \\\\NTCod\\, \\\\NTDGDom\\, \\\\NTDGCod\\]\\<^sub>\\\"\n unfolding dom_lhs dom_rhs by (simp add: nat_omega_simps)\n show \"a \\\\<^sub>\\ \\\\<^sub>\\ \\ \\\n \\\\a\\ = [\\\\NTMap\\, \\\\NTDom\\, \\\\NTCod\\, \\\\NTDGDom\\, \\\\NTDGCod\\]\\<^sub>\\\\a\\\" \n for a\n by (unfold dom_lhs, elim_in_numeral, unfold nt_field_simps)\n (simp_all add: nat_omega_simps)\nqed (auto simp: vsv_axioms)\n\n\ntext\\Size.\\\n\nlemma (in is_ntsmcf) ntsmcf_in_Vset: \n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\"\n shows \"\\ \\\\<^sub>\\ Vset \\\"\nproof-\n interpret \\: \\ \\ by (rule assms(1))\n note [smc_cs_intros] = \n ntsmcf_NTMap_in_Vset\n NTDom.smcf_in_Vset\n NTCod.smcf_in_Vset\n NTDom.HomDom.smc_in_Vset\n NTDom.HomCod.smc_in_Vset\n from assms(2) show ?thesis\n by (subst ntsmcf_def) \n (\n cs_concl cs_shallow \n cs_simp: smc_cs_simps cs_intro: smc_cs_intros V_cs_intros\n )\nqed\n\nlemma (in is_ntsmcf) ntsmcf_is_ntsmcf_if_ge_Limit:\n assumes \"\\ \\\" and \"\\ \\\\<^sub>\\ \\\"\n shows \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_ntsmcfI )\n show \"ntsmcf_tdghm \\ :\n smcf_dghm \\ \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M smcf_dghm \\ : smc_dg \\ \\\\\\<^sub>D\\<^sub>G\\<^bsub>\\\\<^esub> smc_dg \\\"\n by (rule is_tdghm.tdghm_is_tdghm_if_ge_Limit[OF ntsmcf_is_tdghm assms])\n show \"\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\"\n if \"f : a \\\\<^bsub>\\\\<^esub> b\" for f a b\n by \n (\n use that in \n \\cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros\\\n )+\nqed \n (\n cs_concl cs_shallow\n cs_simp: smc_cs_simps \n cs_intro:\n smc_cs_intros\n V_cs_intros\n assms \n NTDom.smcf_is_semifunctor_if_ge_Limit\n NTCod.smcf_is_semifunctor_if_ge_Limit\n )+\n\nlemma small_all_ntsmcfs[simp]: \n \"small {\\. \\\\ \\ \\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\nproof(cases \\\\ \\\\)\n case True\n from is_ntsmcf.ntsmcf_in_Vset show ?thesis\n by (intro down[of _ \\Vset (\\ + \\)\\]) \n (auto simp: True \\.\\_Limit_\\\\ \\.\\_\\_\\\\ \\.intro \\.\\_\\_\\\\)\nnext\n case False\n then have \"{\\. \\\\ \\ \\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\} = {}\" by auto\n then show ?thesis by simp\nqed\n\nlemma small_ntsmcfs[simp]: \"small {\\. \\\\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\n by (rule down[of _ \\set {\\. \\\\ \\ \\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\\])\n auto\n\nlemma small_these_ntcfs[simp]: \"small {\\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\"\n by (rule down[of _ \\set {\\. \\\\ \\ \\ \\. \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\}\\]) \n auto\n\n\ntext\\Further elementary results.\\\n\nlemma these_ntsmcfs_iff(*not simp*): \n \"\\ \\\\<^sub>\\ these_ntsmcfs \\ \\ \\ \\ \\ \\ \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by auto\n\n\n\nsubsection\\Opposite natural transformation of semifunctors\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\See section 1.5 in \\<^cite>\\\"bodo_categories_1970\"\\.\\\n\ndefinition op_ntsmcf :: \"V \\ V\"\n where \"op_ntsmcf \\ =\n [\n \\\\NTMap\\,\n op_smcf (\\\\NTCod\\),\n op_smcf (\\\\NTDom\\),\n op_smc (\\\\NTDGDom\\),\n op_smc (\\\\NTDGCod\\)\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma op_ntsmcf_components[smc_op_simps]:\n shows \"op_ntsmcf \\\\NTMap\\ = \\\\NTMap\\\"\n and \"op_ntsmcf \\\\NTDom\\ = op_smcf (\\\\NTCod\\)\"\n and \"op_ntsmcf \\\\NTCod\\ = op_smcf (\\\\NTDom\\)\"\n and \"op_ntsmcf \\\\NTDGDom\\ = op_smc (\\\\NTDGDom\\)\"\n and \"op_ntsmcf \\\\NTDGCod\\ = op_smc (\\\\NTDGCod\\)\"\n unfolding op_ntsmcf_def nt_field_simps by (auto simp: nat_omega_simps)\n\n\ntext\\Slicing.\\\n\nlemma op_tdghm_ntsmcf_tdghm[slicing_commute]: \n \"op_tdghm (ntsmcf_tdghm \\) = ntsmcf_tdghm (op_ntsmcf \\)\"\nproof(rule vsv_eqI)\n have dom_lhs: \"\\\\<^sub>\\ (op_tdghm (ntsmcf_tdghm \\)) = 5\\<^sub>\\\"\n unfolding op_tdghm_def by (auto simp: nat_omega_simps)\n have dom_rhs: \"\\\\<^sub>\\ (ntsmcf_tdghm (op_ntsmcf \\)) = 5\\<^sub>\\\"\n unfolding ntsmcf_tdghm_def by (auto simp: nat_omega_simps)\n show \"\\\\<^sub>\\ (op_tdghm (ntsmcf_tdghm \\)) = \\\\<^sub>\\ (ntsmcf_tdghm (op_ntsmcf \\))\"\n unfolding dom_lhs dom_rhs by simp\n show \"a \\\\<^sub>\\ \\\\<^sub>\\ (op_tdghm (ntsmcf_tdghm \\)) \\ \n op_tdghm (ntsmcf_tdghm \\)\\a\\ = ntsmcf_tdghm (op_ntsmcf \\)\\a\\\"\n for a\n by\n (\n unfold dom_lhs,\n elim_in_numeral,\n unfold ntsmcf_tdghm_def op_ntsmcf_def op_tdghm_def nt_field_simps\n )\n (auto simp: nat_omega_simps slicing_commute[symmetric])\nqed (auto simp: ntsmcf_tdghm_def op_tdghm_def)\n\n\nsubsubsection\\Further properties\\\n\nlemma (in is_ntsmcf) is_ntsmcf_op: \n \"op_ntsmcf \\ : op_smcf \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ : op_smc \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> op_smc \\\"\nproof(rule is_ntsmcfI, unfold smc_op_simps)\n show \"vfsequence (op_ntsmcf \\)\" by (simp add: op_ntsmcf_def)\n show \"vcard (op_ntsmcf \\) = 5\\<^sub>\\\" by (simp add: op_ntsmcf_def nat_omega_simps)\n fix f a b assume \"f : b \\\\<^bsub>\\\\<^esub> a\"\n with is_ntsmcf_axioms show \n \"\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>op_smc \\\\<^esub> \\\\ArrMap\\\\f\\ =\n \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>op_smc \\\\<^esub> \\\\NTMap\\\\a\\\"\n by (cs_concl cs_simp: smc_cs_simps smc_op_simps cs_intro: smc_cs_intros)\nqed\n (\n insert is_ntsmcf_axioms,\n (\n cs_concl cs_shallow \n cs_simp: smc_cs_simps slicing_commute[symmetric]\n cs_intro: smc_cs_intros smc_op_intros dg_op_intros slicing_intros\n )+\n )\n\nlemma (in is_ntsmcf) is_ntsmcf_op'[smc_op_intros]: \n assumes \"\\' = op_smcf \\\"\n and \"\\' = op_smcf \\\"\n and \"\\' = op_smc \\\"\n and \"\\' = op_smc \\\"\n shows \"op_ntsmcf \\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\' \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_ntsmcf_op)\n\nlemmas [smc_op_intros] = is_ntsmcf.is_ntsmcf_op'\n\nlemma (in is_ntsmcf) ntsmcf_op_ntsmcf_op_ntsmcf[smc_op_simps]: \n \"op_ntsmcf (op_ntsmcf \\) = \\\"\nproof(rule ntsmcf_eqI[of \\ \\ \\ \\ \\ _ \\ \\ \\ \\], unfold smc_op_simps)\n interpret op: \n is_ntsmcf \\ \\op_smc \\\\ \\op_smc \\\\ \\op_smcf \\\\ \\op_smcf \\\\ \\op_ntsmcf \\\\\n by (rule is_ntsmcf_op)\n from op.is_ntsmcf_op show \n \"op_ntsmcf (op_ntsmcf \\) : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (simp add: smc_op_simps)\nqed (auto simp: smc_cs_intros)\n\nlemmas ntsmcf_op_ntsmcf_op_ntsmcf[smc_op_simps] =\n is_ntsmcf.ntsmcf_op_ntsmcf_op_ntsmcf\n\nlemma eq_op_ntsmcf_iff: \n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\' : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\' \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n shows \"op_ntsmcf \\ = op_ntsmcf \\' \\ \\ = \\'\"\nproof\n interpret L: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret R: is_ntsmcf \\ \\' \\' \\' \\' \\' by (rule assms(2))\n assume prems: \"op_ntsmcf \\ = op_ntsmcf \\'\"\n show \"\\ = \\'\"\n proof(rule ntsmcf_eqI[OF assms])\n from prems L.ntsmcf_op_ntsmcf_op_ntsmcf R.ntsmcf_op_ntsmcf_op_ntsmcf show \n \"\\\\NTMap\\ = \\'\\NTMap\\\"\n by metis+\n from prems L.ntsmcf_op_ntsmcf_op_ntsmcf R.ntsmcf_op_ntsmcf_op_ntsmcf \n have \"\\\\NTDom\\ = \\'\\NTDom\\\" \n and \"\\\\NTCod\\ = \\'\\NTCod\\\" \n and \"\\\\NTDGDom\\ = \\'\\NTDGDom\\\" \n and \"\\\\NTDGCod\\ = \\'\\NTDGCod\\\" \n by metis+\n then show \"\\ = \\'\" \"\\ = \\'\" \"\\ = \\'\" \"\\ = \\'\" by (auto simp: smc_cs_simps)\n qed\nqed auto\n\n\n\nsubsection\\Vertical composition of natural transformations\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\See Chapter II-4 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition ntsmcf_vcomp :: \"V \\ V \\ V\" (infixl \\\\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\ 55)\n where \"ntsmcf_vcomp \\ \\ = \n [\n (\\a\\\\<^sub>\\\\\\NTDGDom\\\\Obj\\. (\\\\NTMap\\\\a\\) \\\\<^sub>A\\<^bsub>\\\\NTDGCod\\\\<^esub> (\\\\NTMap\\\\a\\)),\n \\\\NTDom\\,\n \\\\NTCod\\,\n \\\\NTDGDom\\,\n \\\\NTDGCod\\\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma ntsmcf_vcomp_components:\n shows\n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\ =\n (\\a\\\\<^sub>\\\\\\NTDGDom\\\\Obj\\. (\\\\NTMap\\\\a\\) \\\\<^sub>A\\<^bsub>\\\\NTDGCod\\\\<^esub> (\\\\NTMap\\\\a\\))\"\n and [dg_shared_cs_simps, smc_cs_simps]: \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDom\\ = \\\\NTDom\\\" \n and [dg_shared_cs_simps, smc_cs_simps]: \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTCod\\ = \\\\NTCod\\\"\n and [dg_shared_cs_simps, smc_cs_simps]: \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDGDom\\ = \\\\NTDGDom\\\"\n and [dg_shared_cs_simps, smc_cs_simps]: \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDGCod\\ = \\\\NTDGCod\\\"\n unfolding nt_field_simps ntsmcf_vcomp_def by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\Natural transformation map\\\n\nlemma ntsmcf_vcomp_NTMap_vsv[dg_shared_cs_intros, smc_cs_intros]: \n \"vsv ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n unfolding ntsmcf_vcomp_components by simp\n\nlemma ntsmcf_vcomp_NTMap_vdomain[smc_cs_simps]:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) = \\\\Obj\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ using assms by auto\n show ?thesis unfolding ntsmcf_vcomp_components by (simp add: smc_cs_simps)\nqed\n\nlemma ntsmcf_vcomp_NTMap_app[smc_cs_simps]:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n shows \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ = \\\\NTMap\\\\a\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ using assms by auto\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ using assms by auto\n from assms show ?thesis \n unfolding ntsmcf_vcomp_components by (simp add: smc_cs_simps)\nqed\n\nlemma ntsmcf_vcomp_NTMap_vrange:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) \\\\<^sub>\\ \\\\Arr\\\"\n unfolding ntsmcf_vcomp_components\nproof(rule vrange_VLambda_vsubset)\n fix x assume prems: \"x \\\\<^sub>\\ \\\\NTDGDom\\\\Obj\\\"\n from prems assms show \"\\\\NTMap\\\\x\\ \\\\<^sub>A\\<^bsub>\\\\NTDGCod\\\\<^esub> \\\\NTMap\\\\x\\ \\\\<^sub>\\ \\\\Arr\\\"\n by (cs_prems cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\nqed\n\n\nsubsubsection\\Further properties\\\n\nlemma ntsmcf_vcomp_composable_commute[smc_cs_simps]:\n \\\\See Chapter II-4 in \\cite{mac_lane_categories_2010}).\\\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \n \"(\\\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\b\\) \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \n \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\NTMap\\\\a\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\a\\)\"\n (is \\(?MC \\\\<^sub>A\\<^bsub>\\\\<^esub> ?NC) \\\\<^sub>A\\<^bsub>\\\\<^esub> ?R = ?T \\\\<^sub>A\\<^bsub>\\\\<^esub> (?MD \\\\<^sub>A\\<^bsub>\\\\<^esub> ?ND)\\)\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1)) \n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n from assms show ?thesis\n by (intro \\.NTDom.HomCod.smc_pattern_rectangle_left)\n (cs_concl cs_intro: smc_cs_intros cs_simp: \\.ntsmcf_Comp_commute)\nqed \n\nlemma ntsmcf_vcomp_is_ntsmcf[smc_cs_intros]:\n \\\\See Chapter II-4 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n show ?thesis \n proof(intro is_ntsmcfI')\n show \"vfsequence (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\" by (simp add: ntsmcf_vcomp_def)\n show \"vcard (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = 5\\<^sub>\\\"\n by (auto simp: nat_omega_simps ntsmcf_vcomp_def)\n show \"vsv ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n unfolding ntsmcf_vcomp_components by simp\n from assms show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n if \"a \\\\<^sub>\\ \\\\Obj\\\" for a\n by \n (\n use that in \n \\cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros\\\n )\n fix f a b assume \"f : a \\\\<^bsub>\\\\<^esub> b\"\n with assms show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ =\n \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n by \n (\n cs_concl \n cs_simp: smc_cs_simps is_ntsmcf.ntsmcf_Comp_commute' \n cs_intro: smc_cs_intros\n )\n qed (use assms in \\auto simp: smc_cs_simps ntsmcf_vcomp_NTMap_vrange\\)\nqed\n\nlemma ntsmcf_vcomp_assoc[smc_cs_simps]: \n \\\\See Chapter II-4 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(3))\n show ?thesis\n proof(rule ntsmcf_eqI[of \\])\n show \"((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\"\n proof(rule vsv_eqI)\n fix a assume \"a \\\\<^sub>\\ \\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n then have \"a \\\\<^sub>\\ \\\\Obj\\\" \n unfolding ntsmcf_vcomp_components by (simp add: smc_cs_simps)\n with assms show \n \"((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ =\n (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (simp_all add: ntsmcf_vcomp_components)\n qed (auto intro: smc_cs_intros)\nqed\n\n\nsubsubsection\\\nOpposite of the vertical composition of natural transformations\nof semifunctors\n\\\n\nlemma op_ntsmcf_ntsmcf_vcomp[smc_op_simps]: \n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ using assms(1) by auto\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ using assms(2) by auto\n show ?thesis\n proof(rule ntsmcf_eqI[of \\]; (intro symmetric)?)\n show \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\ = \n (op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\)\\NTMap\\\"\n proof(rule vsv_eqI)\n fix a assume \"a \\\\<^sub>\\ \\\\<^sub>\\ (op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n then have a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n unfolding smc_op_simps ntsmcf_vcomp_NTMap_vdomain[OF assms(2)] by simp\n with \n \\.NTDom.HomCod.op_smc_Comp \n \\.ntsmcf_NTMap_is_arr[OF a]\n \\.ntsmcf_NTMap_is_arr[OF a] \n show \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ =\n (op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\)\\NTMap\\\\a\\\"\n unfolding smc_op_simps ntsmcf_vcomp_components \n by (simp add: smc_cs_simps)\n qed (simp_all add: smc_op_simps smc_cs_simps ntsmcf_vcomp_components(1))\n qed (auto intro: smc_cs_intros smc_op_intros)\nqed\n\n\n\nsubsection\\Horizontal composition of natural transformations\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\See Chapter II-5 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition ntsmcf_hcomp :: \"V \\ V \\ V\" (infixl \\\\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\ 55)\n where \"ntsmcf_hcomp \\ \\ =\n [\n (\n \\a\\\\<^sub>\\\\\\NTDGDom\\\\Obj\\.\n (\n \\\\NTCod\\\\ArrMap\\\\\\\\NTMap\\\\a\\\\ \\\\<^sub>A\\<^bsub>\\\\NTDGCod\\\\<^esub> \n \\\\NTMap\\\\\\\\NTDom\\\\ObjMap\\\\a\\\\\n )\n ),\n (\\\\NTDom\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\NTDom\\),\n (\\\\NTCod\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\NTCod\\),\n (\\\\NTDGDom\\),\n (\\\\NTDGCod\\)\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\ \n\nlemma ntsmcf_hcomp_components:\n shows \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\ = \n (\n \\a\\\\<^sub>\\\\\\NTDGDom\\\\Obj\\.\n (\n \\\\NTCod\\\\ArrMap\\\\\\\\NTMap\\\\a\\\\ \\\\<^sub>A\\<^bsub>\\\\NTDGCod\\\\<^esub> \n \\\\NTMap\\\\\\\\NTDom\\\\ObjMap\\\\a\\\\\n )\n )\"\n and [dg_shared_cs_simps, smc_cs_simps]:\n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDom\\ = \\\\NTDom\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\NTDom\\\" \n and [dg_shared_cs_simps, smc_cs_simps]:\n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTCod\\ = \\\\NTCod\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\NTCod\\\"\n and [dg_shared_cs_simps, smc_cs_simps]: \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDGDom\\ = \\\\NTDGDom\\\"\n and [dg_shared_cs_simps, smc_cs_simps]:\n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTDGCod\\ = \\\\NTDGCod\\\"\n unfolding nt_field_simps ntsmcf_hcomp_def by (auto simp: nat_omega_simps)\n\n\nsubsubsection\\Natural transformation map\\\n\nlemma ntsmcf_hcomp_NTMap_vsv[smc_cs_intros]: \"vsv ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n unfolding ntsmcf_hcomp_components by auto\n\nlemma ntsmcf_hcomp_NTMap_vdomain[smc_cs_simps]: \n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) = \\\\Obj\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n show ?thesis unfolding ntsmcf_hcomp_components by (simp add: smc_cs_simps)\nqed\n\nlemma ntsmcf_hcomp_NTMap_app[smc_cs_simps]:\n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n shows \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ = \n \\'\\ArrMap\\\\\\\\NTMap\\\\a\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\\\\\ObjMap\\\\a\\\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n from assms(3) show ?thesis \n unfolding ntsmcf_hcomp_components by (simp add: smc_cs_simps)\nqed\n\nlemma ntsmcf_hcomp_NTMap_vrange:\n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) \\\\<^sub>\\ \\\\Arr\\\"\nproof\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n fix f assume \"f \\\\<^sub>\\ \\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\)\"\n with ntsmcf_hcomp_NTMap_vdomain obtain a \n where a: \"a \\\\<^sub>\\ \\\\Obj\\\" and f_def: \"f = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n unfolding ntsmcf_hcomp_components by (force simp: smc_cs_simps)\n have \\a: \"\\\\ObjMap\\\\a\\ \\\\<^sub>\\ \\\\Obj\\\" \n by (simp add: \\.NTDom.smcf_ObjMap_app_in_HomCod_Obj a)\n from \\.ntsmcf_NTMap_is_arr[OF a] have \"\\'\\ArrMap\\\\\\\\NTMap\\\\a\\\\ :\n \\'\\ObjMap\\\\\\\\ObjMap\\\\a\\\\ \\\\<^bsub>\\\\<^esub> \\'\\ObjMap\\\\\\\\ObjMap\\\\a\\\\\"\n by (force intro: smc_cs_intros)\n then have \"\\'\\ArrMap\\\\\\\\NTMap\\\\a\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\\\\\ObjMap\\\\a\\\\ \\\\<^sub>\\ \\\\Arr\\\"\n by \n (\n meson \n \\.ntsmcf_NTMap_is_arr[OF \\a] \n \\.NTDom.HomCod.smc_is_arrE \n \\.NTDom.HomCod.smc_Comp_is_arr\n )\n with a show \"f \\\\<^sub>\\ \\\\Arr\\\" \n unfolding f_def ntsmcf_hcomp_components by (simp add: smc_cs_simps)\nqed\n\n\nsubsubsection\\Further properties\\\n\nlemma ntsmcf_hcomp_composable_commute:\n \\\\See Chapter II-5 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"f : a \\\\<^bsub>\\\\<^esub> b\" \n shows \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ = \n (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n from assms(3) have [simp]: \"b \\\\<^sub>\\ \\\\Obj\\\" and a: \"a \\\\<^sub>\\ \\\\Obj\\\" by auto\n from \\.is_ntsmcf_axioms \\.is_ntsmcf_axioms have \\\\b: \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ =\n (\\'\\ArrMap\\\\\\\\NTMap\\\\b\\\\) \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\NTMap\\\\\\\\ObjMap\\\\b\\\\)\"\n by (auto simp: smc_cs_simps)\n let ?\\'\\f = \\\\'\\ArrMap\\\\\\\\ArrMap\\\\f\\\\\\\n from a \\.is_ntsmcf_axioms \\.is_ntsmcf_axioms have \\\\a: \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ =\n \\'\\ArrMap\\\\\\\\NTMap\\\\a\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\\\\\ObjMap\\\\a\\\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps)+\n note \\.NTCod.smcf_ArrMap_Comp[smc_cs_simps del]\n from assms show ?thesis\n unfolding \\\\b \\\\a \n by (intro \\.NTDom.HomCod.smc_pattern_rectangle_left)\n (\n cs_concl \n cs_simp: smc_cs_simps is_semifunctor.smcf_ArrMap_Comp[symmetric] \n cs_intro: smc_cs_intros\n )+\nqed\n\nlemma ntsmcf_hcomp_is_ntsmcf:\n \\\\See Chapter II-5 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n proof(intro is_ntsmcfI', unfold ntsmcf_hcomp_components(3,4)) \n show \"vfsequence (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\" unfolding ntsmcf_hcomp_def by auto\n show \"vcard (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = 5\\<^sub>\\\"\n unfolding ntsmcf_hcomp_def by (simp add: nat_omega_simps)\n from assms show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ : \n (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\a\\\"\n if \"a \\\\<^sub>\\ \\\\Obj\\\" for a\n by \n (\n use that in \n \\cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros\\\n )\n fix f a b assume \"f : a \\\\<^bsub>\\\\<^esub> b\"\n with ntsmcf_hcomp_composable_commute[OF assms] \n show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ = \n (\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n by auto\n qed (auto simp: ntsmcf_hcomp_components(1) smc_cs_simps intro: smc_cs_intros)\nqed\n\nlemma ntsmcf_hcomp_is_ntsmcf'[smc_cs_intros]:\n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ = \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n and \"\\' = \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3,4) by (rule ntsmcf_hcomp_is_ntsmcf)\n\nlemma ntsmcf_hcomp_assoc[smc_cs_simps]: \n \\\\See Chapter II-5 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\'' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\'' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\" \n and \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\
\\'' \\'' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(2))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(3))\n interpret \\\\: is_ntsmcf \\ \\ \\
\\\\'' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\'\\ \\\\'' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\'\\ \\\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \n by (auto intro: smc_cs_intros)\n interpret \\\\: is_ntsmcf \\ \\ \\ \\\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \\\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \\\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \n by (auto intro: smc_cs_intros)\n note smcf_axioms =\n \\.NTDom.is_semifunctor_axioms \n \\.NTCod.is_semifunctor_axioms \n \\.NTDom.is_semifunctor_axioms \n \\.NTCod.is_semifunctor_axioms \n \\.NTDom.is_semifunctor_axioms \n \\.NTCod.is_semifunctor_axioms \n show ?thesis\n proof(rule ntsmcf_eqI)\n from assms show \n \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n (\\'' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\') \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\'' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\') \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n by (auto intro: smc_cs_intros)\n from \\\\.is_ntsmcf_axioms \\.is_ntsmcf_axioms have dom_lhs:\n \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) = \\\\Obj\\\"\n by (simp add: smc_cs_simps)\n from \\\\.is_ntsmcf_axioms \\.is_ntsmcf_axioms have dom_rhs: \n \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\) = \\\\Obj\\\"\n by (simp add: smc_cs_simps)\n show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n fix a assume \"a \\\\<^sub>\\ \\\\Obj\\\"\n with assms show\n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\ =\n (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (simp_all add: ntsmcf_hcomp_components)\n qed \n (\n insert smcf_axioms, \n auto simp: smcf_comp_assoc intro!: smc_cs_intros\n )\nqed\n\n\nsubsubsection\\Opposite of the horizontal composition of the \nnatural transformation of semifunctors\\\n\nlemma op_ntsmcf_ntsmcf_hcomp[smc_op_simps]: \n assumes \"\\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\' \\' \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n have op_\\: \"op_ntsmcf \\ :\n op_smcf \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\' : op_smc \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> op_smc \\\"\n and op_\\: \"op_ntsmcf \\ :\n op_smcf \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ : op_smc \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> op_smc \\\" \n by \n (\n cs_concl cs_shallow \n cs_simp: smc_op_simps cs_intro: smc_cs_intros smc_op_intros\n )\n show ?thesis\n proof(rule sym, rule ntsmcf_eqI, unfold smc_op_simps slicing_simps)\n show \n \"op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\ :\n op_smcf \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ :\n op_smc \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> op_smc \\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: smc_op_simps cs_intro: smc_cs_intros smc_op_intros\n )\n show \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n op_smcf \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\ :\n op_smc \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> op_smc \\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: smc_op_simps cs_intro: smc_cs_intros smc_op_intros\n )\n show \"(op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\)\\NTMap\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\"\n proof\n (\n rule vsv_eqI, \n unfold \n ntsmcf_hcomp_NTMap_vdomain[OF assms(2)]\n ntsmcf_hcomp_NTMap_vdomain[OF op_\\]\n smc_op_simps\n )\n fix a assume \"a \\\\<^sub>\\ \\\\Obj\\\"\n with assms show \n \"(op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\)\\NTMap\\\\a\\ = (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: smc_cs_simps smc_op_simps \n cs_intro: smc_cs_intros smc_op_intros\n )\n qed (auto simp: ntsmcf_hcomp_components)\n qed simp_all\nqed \n\n\n\nsubsection\\Interchange law\\\n\nlemma ntsmcf_comp_interchange_law:\n \\\\See Chapter II-5 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"((\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\') \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)) =\n (\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n interpret \\': is_ntsmcf \\ \\ \\ \\' \\' \\' by (rule assms(3))\n interpret \\': is_ntsmcf \\ \\ \\ \\' \\' \\' by (rule assms(4))\n interpret \\'\\: \n is_ntsmcf \\ \\ \\ \\\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \\\\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \\\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \n by (auto intro: smc_cs_intros)\n interpret \\\\: is_ntsmcf \\ \\ \\ \\ \\ \\\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\\ \n by (auto intro: smc_cs_intros)\n show ?thesis\n proof(rule ntsmcf_eqI[of \\])\n show \n \"(\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\ =\n (\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\"\n proof\n (\n rule vsv_eqI,\n unfold \n ntsmcf_vcomp_NTMap_vdomain[OF \\'\\.is_ntsmcf_axioms]\n ntsmcf_hcomp_NTMap_vdomain[OF \\\\.is_ntsmcf_axioms]\n )\n fix a assume \"a \\\\<^sub>\\ \\\\Obj\\\"\n with assms show\n \"(\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\ =\n ((\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\' \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\\"\n by\n (\n cs_concl \n cs_simp: smc_cs_simps is_ntsmcf.ntsmcf_Comp_commute' \n cs_intro: smc_cs_intros\n )\n qed (auto intro: smc_cs_intros)\n qed (auto intro: smc_cs_intros)\nqed\n\n\n\nsubsection\\\nComposition of a natural transformation of semifunctors and a semifunctor\n\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\nabbreviation (input) ntsmcf_smcf_comp :: \"V \\ V \\ V\" (infixl \"\\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\" 55)\n where \"ntsmcf_smcf_comp \\ tdghm_dghm_comp\"\n\n\ntext\\Slicing.\\\n\nlemma ntsmcf_tdghm_ntsmcf_smcf_comp[slicing_commute]: \n \"ntsmcf_tdghm \\ \\\\<^sub>T\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M\\<^sub>-\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M smcf_dghm \\ = ntsmcf_tdghm (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\n unfolding \n tdghm_dghm_comp_def \n dghm_comp_def \n ntsmcf_tdghm_def \n smcf_dghm_def \n smc_dg_def\n dg_field_simps\n dghm_field_simps \n nt_field_simps \n by (simp add: nat_omega_simps) (*slow*)\n\n\nsubsubsection\\Natural transformation map\\\n\nmk_VLambda (in is_semifunctor) \n tdghm_dghm_comp_components(1)[where \\=\\, unfolded smcf_HomDom]\n |vdomain ntsmcf_smcf_comp_NTMap_vdomain[smc_cs_simps]|\n |app ntsmcf_smcf_comp_NTMap_app[smc_cs_simps]|\n\nlemmas [smc_cs_simps] = \n is_semifunctor.ntsmcf_smcf_comp_NTMap_vdomain\n is_semifunctor.ntsmcf_smcf_comp_NTMap_app\n\nlemma ntsmcf_smcf_comp_NTMap_vrange: \n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) \\\\<^sub>\\ \\\\Arr\\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(2))\n show ?thesis \n unfolding tdghm_dghm_comp_components \n by (auto simp: smc_cs_simps intro: smc_cs_intros)\nqed\n\n\nsubsubsection\\\nOpposite of the composition of a natural transformation of \nsemifunctors and a semifunctor\n\\\n\nlemma op_ntsmcf_ntsmcf_smcf_comp[smc_op_simps]: \n \"op_ntsmcf (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = op_ntsmcf \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_smcf \\\"\n unfolding \n tdghm_dghm_comp_def \n dghm_comp_def \n op_ntsmcf_def \n op_smcf_def \n op_smc_def\n dg_field_simps\n dghm_field_simps\n nt_field_simps\n by (simp add: nat_omega_simps) (*slow*)\n\n\nsubsubsection\\\nComposition of a natural transformation of semifunctors and a \nsemifunctors is a natural transformation of semifunctors\n\\\n\nlemma ntsmcf_smcf_comp_is_ntsmcf[intro]:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n proof(rule is_ntsmcfI)\n show \"vfsequence (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\n unfolding tdghm_dghm_comp_def by (simp add: nat_omega_simps)\n from assms show \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: smc_cs_intros)\n from assms show \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n by (cs_concl cs_intro: smc_cs_intros)\n show \"vcard (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = 5\\<^sub>\\\"\n unfolding tdghm_dghm_comp_def by (simp add: nat_omega_simps)\n from assms show \n \"ntsmcf_tdghm (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n smcf_dghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M smcf_dghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n smc_dg \\ \\\\\\<^sub>D\\<^sub>G\\<^bsub>\\\\<^esub> smc_dg \\\"\n by \n (\n cs_concl \n cs_simp: slicing_commute[symmetric] \n cs_intro: slicing_intros dg_cs_intros\n )\n show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ =\n (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n if \"f : a \\\\<^bsub>\\\\<^esub> b\" for a b f\n using that by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (auto simp: smc_cs_simps)\nqed\n\nlemma ntsmcf_smcf_comp_is_semifunctor'[smc_cs_intros]:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n and \"\\' = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3,4) ..\n\n\nsubsubsection\\Further properties\\\n\nlemma ntsmcf_smcf_comp_ntsmcf_smcf_comp_assoc:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\" \n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\
\\ \\' \\ by (rule assms(1))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(3))\n show ?thesis \n proof(rule ntsmcf_tdghm_eqI)\n from assms show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n from assms show \n \"ntsmcf_tdghm ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) =\n ntsmcf_tdghm (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\"\n by \n (\n cs_concl \n cs_simp: slicing_commute[symmetric] \n cs_intro: slicing_intros tdghm_dghm_comp_tdghm_dghm_comp_assoc\n )\n qed simp_all\nqed\n\nlemma (in is_ntsmcf) ntsmcf_ntsmcf_smcf_comp_smcf_id[smc_cs_simps]:\n \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F smcf_id \\ = \\\"\nproof(rule ntsmcf_tdghm_eqI)\n show \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F smcf_id \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \"ntsmcf_tdghm (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F smcf_id \\) = ntsmcf_tdghm \\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: slicing_simps slicing_commute[symmetric] \n cs_intro: smc_cs_intros slicing_intros dg_cs_simps\n )\nqed simp_all\n\nlemmas [smc_cs_simps] = is_ntsmcf.ntsmcf_ntsmcf_smcf_comp_smcf_id\n\nlemma ntsmcf_vcomp_ntsmcf_smcf_comp[smc_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = \n (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\nproof(rule ntsmcf_eqI)\n from assms show \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_intro: smc_cs_intros)\n from assms show \"\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) : \n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_intro: smc_cs_intros)\n from assms have dom_lhs: \n \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\) = \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n from assms have dom_rhs: \"\\\\<^sub>\\ ((\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) = \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\ = \n (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n fix a assume \"a \\\\<^sub>\\ \\\\Obj\\\"\n with assms show \n \"(\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\ =\n (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (cs_concl cs_shallow cs_intro: smc_cs_intros)+\nqed simp_all\n\n\n\nsubsection\\\nComposition of a semifunctor and a natural transformation of semifunctors\n\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\nabbreviation (input) smcf_ntsmcf_comp :: \"V \\ V \\ V\" (infixl \"\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\" 55)\n where \"smcf_ntsmcf_comp \\ dghm_tdghm_comp\"\n\n\ntext\\Slicing.\\\n\nlemma ntsmcf_tdghm_smcf_ntsmcf_comp[slicing_commute]: \n \"smcf_dghm \\ \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M\\<^sub>-\\<^sub>T\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M ntsmcf_tdghm \\ = ntsmcf_tdghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\n unfolding \n dghm_tdghm_comp_def \n dghm_comp_def \n ntsmcf_tdghm_def \n smcf_dghm_def \n smc_dg_def\n dg_field_simps\n dghm_field_simps \n nt_field_simps \n by (simp add: nat_omega_simps) (*slow*)\n\n\nsubsubsection\\Natural transformation map\\\n\nmk_VLambda (in is_ntsmcf) \n dghm_tdghm_comp_components(1)[where \\=\\, unfolded ntsmcf_NTDGDom]\n |vdomain smcf_ntsmcf_comp_NTMap_vdomain[smc_cs_simps]|\n |app smcf_ntsmcf_comp_NTMap_app[smc_cs_simps]|\n\nlemmas [smc_cs_simps] = \n is_ntsmcf.smcf_ntsmcf_comp_NTMap_vdomain\n is_ntsmcf.smcf_ntsmcf_comp_NTMap_app\n\nlemma smcf_ntsmcf_comp_NTMap_vrange: \n assumes \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ ((\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\) \\\\<^sub>\\ \\\\Arr\\\"\nproof-\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n show ?thesis \n unfolding dghm_tdghm_comp_components \n by (auto simp: smc_cs_simps intro: smc_cs_intros)\nqed\n\n\nsubsubsection\\\nOpposite of the composition of a semifunctor\nand a natural transformation of semifunctors \n\\\n\nlemma op_ntsmcf_smcf_ntsmcf_comp[smc_op_simps]: \n \"op_ntsmcf (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = op_smcf \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F op_ntsmcf \\\"\n unfolding \n dghm_tdghm_comp_def\n dghm_comp_def\n op_ntsmcf_def\n op_smcf_def\n op_smc_def\n dg_field_simps\n dghm_field_simps\n nt_field_simps\n by (simp add: nat_omega_simps) (*slow*)\n\n\nsubsubsection\\\nComposition of a semifunctor and a natural transformation of\nsemifunctors is a natural transformation of semifunctors\n\\\n\nlemma smcf_ntsmcf_comp_is_ntsmcf[intro]:\n assumes \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n proof(rule is_ntsmcfI)\n show \"vfsequence (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\" unfolding dghm_tdghm_comp_def by simp\n from assms show \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: smc_cs_intros)\n from assms show \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: smc_cs_intros)\n show \"vcard (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = 5\\<^sub>\\\"\n unfolding dghm_tdghm_comp_def by (simp add: nat_omega_simps)\n from assms show \"ntsmcf_tdghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n smcf_dghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M smcf_dghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n smc_dg \\ \\\\\\<^sub>D\\<^sub>G\\<^bsub>\\\\<^esub> smc_dg \\\"\n by \n (\n cs_concl \n cs_simp: slicing_commute[symmetric] \n cs_intro: dg_cs_intros slicing_intros\n )\n have [smc_cs_simps]: \n \"\\\\ArrMap\\\\\\\\NTMap\\\\b\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\\\\\ArrMap\\\\f\\\\ =\n \\\\ArrMap\\\\\\\\ArrMap\\\\f\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\\\\\NTMap\\\\a\\\\\"\n if \"f : a \\\\<^bsub>\\\\<^esub> b\" for a b f\n using assms that \n by \n (\n cs_concl \n cs_simp:\n is_ntsmcf.ntsmcf_Comp_commute \n is_semifunctor.smcf_ArrMap_Comp[symmetric]\n cs_intro: smc_cs_intros\n )\n from assms show \n \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ =\n (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\\NTMap\\\\a\\\"\n if \"f : a \\\\<^bsub>\\\\<^esub> b\" for a b f\n using assms that\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (auto simp: smc_cs_simps)\nqed\n\nlemma smcf_ntsmcf_comp_is_semifunctor'[smc_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n and \"\\' = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\' \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3,4) ..\n\n\nsubsubsection\\Further properties\\\n\nlemma smcf_comp_smcf_ntsmcf_comp_assoc:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n shows \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof(rule ntsmcf_tdghm_eqI)\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\' \\ by (rule assms(1))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_semifunctor \\ \\ \\
\\ by (rule assms(3))\n from assms show \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ :\n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n from assms show \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) :\n \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\' : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n from assms show \n \"ntsmcf_tdghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) =\n ntsmcf_tdghm (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\"\n by\n (\n cs_concl \n cs_simp: slicing_commute[symmetric] \n cs_intro: slicing_intros dghm_comp_dghm_tdghm_comp_assoc\n )\nqed simp_all\n\nlemma (in is_ntsmcf) ntsmcf_smcf_ntsmcf_comp_smcf_id[smc_cs_simps]:\n \"smcf_id \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\\"\nproof(rule ntsmcf_tdghm_eqI)\n show \"smcf_id \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n show \"ntsmcf_tdghm (dghm_id \\ \\\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M\\<^sub>-\\<^sub>T\\<^sub>D\\<^sub>G\\<^sub>H\\<^sub>M \\) = ntsmcf_tdghm \\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: slicing_simps slicing_commute[symmetric] \n cs_intro: smc_cs_intros slicing_intros dg_cs_simps\n )\nqed simp_all\n\nlemmas [smc_cs_simps] = is_ntsmcf.ntsmcf_smcf_ntsmcf_comp_smcf_id\n\nlemma smcf_ntsmcf_comp_ntsmcf_smcf_comp_assoc:\n assumes \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n and \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_semifunctor \\ \\ \\
\\ by (rule assms(2))\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(3))\n show ?thesis\n by (rule ntsmcf_tdghm_eqI)\n (\n use assms in\n \\\n cs_concl \n cs_simp: smc_cs_simps slicing_commute[symmetric]\n cs_intro:\n smc_cs_intros\n slicing_intros\n dghm_tdghm_comp_tdghm_dghm_comp_assoc\n \\\n )+\nqed\n\nlemma smcf_ntsmcf_comp_ntsmcf_vcomp: \n assumes \"\\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) =\n (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\nproof-\n interpret \\: is_semifunctor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_ntsmcf \\ \\ \\ \\ \\ \\ by (rule assms(3))\n show \n \"\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\) = \\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\)\"\n proof(rule ntsmcf_eqI)\n have dom_lhs: \"\\\\<^sub>\\ ((\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\) = \\\\Obj\\\"\n unfolding dghm_tdghm_comp_components smc_cs_simps by simp\n have dom_rhs: \n \"\\\\<^sub>\\ ((\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\) = \\\\Obj\\\"\n unfolding ntsmcf_vcomp_components smc_cs_simps by simp\n show\n \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\ =\n (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs smc_cs_simps)\n fix a assume \"a \\\\<^sub>\\ \\\\Obj\\\"\n then show \n \"(\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\ =\n (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F (\\ \\\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>S\\<^sub>M\\<^sub>C\\<^sub>F \\))\\NTMap\\\\a\\\"\n by (cs_concl cs_shallow cs_simp: smc_cs_simps cs_intro: smc_cs_intros)\n qed (cs_concl cs_shallow cs_intro: smc_cs_intros)+\n qed (cs_concl cs_shallow cs_intro: smc_cs_intros)+\nqed\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Foundations/czh_semicategories/CZH_SMC_NTSMCF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073802837477, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.2967681391597427}} {"text": "section \\ Imperative Programming in Designs \\\n\ntheory utp_des_prog\n imports utp_des_tactics\nbegin\n\nsubsection \\ Assignment \\\n\ndefinition assigns_d :: \"'\\ usubst \\ '\\ hrel_des\" (\"\\_\\\\<^sub>D\") where \n[upred_defs]: \"assigns_d \\ = (true \\\\<^sub>r assigns_r \\)\"\n\nsyntax\n \"_assignmentd\" :: \"svids \\ uexprs \\ logic\" (infixr \":=\\<^sub>D\" 62)\n\ntranslations\n \"_assignmentd xs vs\" => \"CONST assigns_d (_mk_usubst (id\\<^sub>s) xs vs)\"\n \"_assignmentd x v\" <= \"CONST assigns_d (CONST subst_upd (id\\<^sub>s) x v)\"\n \"_assignmentd x v\" <= \"_assignmentd (_spvar x) v\"\n \"x,y :=\\<^sub>D u,v\" <= \"CONST assigns_d (CONST subst_upd (CONST subst_upd (id\\<^sub>s) (CONST pr_var x) u) (CONST pr_var y) v)\"\n\nlemma assigns_d_is_H1_H2 [closure]: \"\\\\\\\\<^sub>D is \\<^bold>H\"\n by (simp add: assigns_d_def rdesign_is_H1_H2)\n\nlemma assigns_d_H1_H3 [closure]: \"\\\\\\\\<^sub>D is \\<^bold>N\"\n by (metis H1_rdesign H3_ndesign Healthy_def' aext_true assigns_d_def ndesign_def)\n\ntext \\ Designs are closed under substitutions on state variables only (via lifting) \\\n\nlemma state_subst_H1_H2_closed [closure]: \n \"P is \\<^bold>H \\ \\\\ \\\\<^sub>s \\\\<^sub>D\\\\<^sub>s \\ P is \\<^bold>H\"\n by (metis H1_H2_eq_rdesign Healthy_if rdesign_is_H1_H2 state_subst_design)\n\nlemma assigns_d_ndes_def [ndes_simp]:\n \"\\\\\\\\<^sub>D = (true \\\\<^sub>n \\\\\\\\<^sub>a)\"\n by (rel_auto)\n \nlemma assigns_d_id [simp]: \"\\id\\<^sub>s\\\\<^sub>D = II\\<^sub>D\"\n by (rel_auto)\n\nlemma assign_d_left_comp:\n \"(\\f\\\\<^sub>D ;; (P \\\\<^sub>r Q)) = (\\f\\\\<^sub>s \\ P \\\\<^sub>r \\f\\\\<^sub>s \\ Q)\"\n by (simp add: assigns_d_def rdesign_composition assigns_r_comp subst_not)\n\nlemma assign_d_right_comp:\n \"((P \\\\<^sub>r Q) ;; \\f\\\\<^sub>D) = ((\\ ((\\ P) ;; true)) \\\\<^sub>r (Q ;; \\f\\\\<^sub>a))\"\n by (simp add: assigns_d_def rdesign_composition)\n\nlemma assigns_d_comp:\n \"(\\f\\\\<^sub>D ;; \\g\\\\<^sub>D) = \\g \\\\<^sub>s f\\\\<^sub>D\"\n by (simp add: assigns_d_def rdesign_composition assigns_comp)\n\nlemma assigns_d_comp_ext:\n assumes \"P is \\<^bold>H\"\n shows \"(\\\\\\\\<^sub>D ;; P) = \\\\ \\\\<^sub>s \\\\<^sub>D\\\\<^sub>s \\ P\"\nproof -\n have \"\\\\\\\\<^sub>D ;; P = \\\\\\\\<^sub>D ;; (pre\\<^sub>D(P) \\\\<^sub>r post\\<^sub>D(P))\"\n by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n also have \"... = \\\\\\\\<^sub>s \\ pre\\<^sub>D(P) \\\\<^sub>r \\\\\\\\<^sub>s \\ post\\<^sub>D(P)\"\n by (simp add: assign_d_left_comp)\n also have \"... = \\\\ \\\\<^sub>s \\\\<^sub>D\\\\<^sub>s \\ (pre\\<^sub>D(P) \\\\<^sub>r post\\<^sub>D(P))\"\n by (rel_auto)\n also have \"... = \\\\ \\\\<^sub>s \\\\<^sub>D\\\\<^sub>s \\ P\"\n by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n finally show ?thesis by (simp_all add: closure assms)\nqed\n\ntext \\ Normal designs are closed under substitutions on state variables only \\\n\nlemma state_subst_H1_H3_closed [closure]: \n \"P is \\<^bold>N \\ \\\\ \\\\<^sub>s \\\\<^sub>D\\\\<^sub>s \\ P is \\<^bold>N\"\n by (metis H1_H2_eq_rdesign H1_H3_impl_H2 Healthy_if assign_d_left_comp assigns_d_H1_H3 seq_r_H1_H3_closed state_subst_design)\n\nlemma H4_assigns_d: \"\\\\\\\\<^sub>D is H4\"\nproof -\n have \"(\\\\\\\\<^sub>D ;; (false \\\\<^sub>r true\\<^sub>h)) = (false \\\\<^sub>r true)\"\n by (simp add: assigns_d_def rdesign_composition assigns_r_feasible)\n moreover have \"... = true\"\n by (rel_auto)\n ultimately show ?thesis\n using is_H4_alt_def by auto\nqed\n\nsubsection \\ Guarded Commands \\\n\ndefinition GrdCommD :: \"'\\ upred \\ ('\\, '\\) rel_des \\ ('\\, '\\) rel_des\" where\n[upred_defs]: \"GrdCommD b P = P \\ b \\\\<^sub>D \\\\<^sub>D\"\n\nsyntax \"_GrdCommD\" :: \"logic \\ logic \\ logic\" (\"_ \\\\<^sub>D _\" [60, 61] 61)\ntranslations \"_GrdCommD b P\" == \"CONST GrdCommD b P\"\n\nlemma GrdCommD_ndes_simp [ndes_simp]:\n \"b \\\\<^sub>D (p\\<^sub>1 \\\\<^sub>n P\\<^sub>2) = ((b \\ p\\<^sub>1) \\\\<^sub>n (\\b\\\\<^sub>< \\ P\\<^sub>2))\"\n by (rel_auto)\n\nlemma GrdCommD_H1_H3_closed [closure]: \"P is \\<^bold>N \\ b \\\\<^sub>D P is \\<^bold>N\"\n by (simp add: GrdCommD_def closure)\n\nlemma GrdCommD_true [simp]: \"true \\\\<^sub>D P = P\"\n by (rel_auto)\n \nlemma GrdCommD_false [simp]: \"false \\\\<^sub>D P = \\\\<^sub>D\"\n by (rel_auto)\n \nlemma GrdCommD_abort [simp]: \"b \\\\<^sub>D true = ((\\ b) \\\\<^sub>n false)\"\n by (rel_auto)\n\nsubsection \\ Frames and Extensions \\\n \ndefinition des_frame :: \"('\\ \\ '\\) \\ '\\ hrel_des \\ '\\ hrel_des\" where\n[upred_defs]: \"des_frame x P = frame (ok +\\<^sub>L x ;\\<^sub>L \\\\<^sub>D) P\"\n\ndefinition des_frame_ext :: \"('\\ \\ '\\) \\ '\\ hrel_des \\ '\\ hrel_des\" where\n[upred_defs]: \"des_frame_ext a P = des_frame a (rel_aext P (lmap\\<^sub>D a))\"\n\nsyntax\n \"_des_frame\" :: \"salpha \\ logic \\ logic\" (\"_:[_]\\<^sub>D\" [99,0] 100)\n \"_des_frame_ext\" :: \"salpha \\ logic \\ logic\" (\"_:[_]\\<^sub>D\\<^sup>+\" [99,0] 100)\n\ntranslations\n \"_des_frame x P\" => \"CONST des_frame x P\"\n \"_des_frame (_salphaset (_salphamk x)) P\" <= \"CONST des_frame x P\"\n \"_des_frame_ext x P\" => \"CONST des_frame_ext x P\"\n \"_des_frame_ext (_salphaset (_salphamk x)) P\" <= \"CONST des_frame_ext x P\"\n\nlemma lmapD_rel_aext_ndes [ndes_simp]:\n \"(p \\\\<^sub>n Q) \\\\<^sub>r lmap\\<^sub>D[a] = (p \\\\<^sub>p a \\\\<^sub>n Q \\\\<^sub>r a)\"\n by (rel_auto)\n\nsubsection \\ Alternation \\\n \nconsts\n ualtern :: \"'a set \\ ('a \\ 'p) \\ ('a \\ 'r) \\ 'r \\ 'r\"\n ualtern_list :: \"('a \\ 'r) list \\ 'r \\ 'r\"\n \ndefinition AlternateD :: \"'a set \\ ('a \\ '\\ upred) \\ ('a \\ ('\\, '\\) rel_des) \\ ('\\, '\\) rel_des \\ ('\\, '\\) rel_des\" where\n[upred_defs, ndes_simp]:\n\"AlternateD A g P Q = (\\ i\\A \\ g(i) \\\\<^sub>D P(i)) \\ ((\\ i\\A \\ \\ g(i)) \\\\<^sub>D Q)\"\n\ntext \\ This lemma shows that our generalised alternation is the same operator as Marcel Oliveira's\n definition of alternation when the else branch is abort. \\\n\nlemma AlternateD_abort_alternate:\n assumes \"\\ i. P(i) is \\<^bold>N\"\n shows\n \"AlternateD A g P \\\\<^sub>D = \n ((\\ i\\A \\ g(i)) \\ (\\ i\\A \\ g(i) \\ \\pre\\<^sub>D(P i)\\\\<^sub><)) \\\\<^sub>n (\\ i\\A \\ \\g(i)\\\\<^sub>< \\ post\\<^sub>D(P i))\"\nproof (cases \"A = {}\")\n case False\n have \"AlternateD A g P \\\\<^sub>D = \n (\\ i\\A \\ g(i) \\\\<^sub>D (\\pre\\<^sub>D(P i)\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P i))) \\ ((\\ i\\A \\ \\ g(i)) \\\\<^sub>D (false \\\\<^sub>n true))\"\n by (simp add: AlternateD_def ndesign_form bot_d_ndes_def assms)\n also have \"... = ((\\ i\\A \\ g(i)) \\ (\\ i\\A \\ g(i) \\ \\pre\\<^sub>D(P i)\\\\<^sub><)) \\\\<^sub>n (\\ i\\A \\ \\g(i)\\\\<^sub>< \\ post\\<^sub>D(P i))\"\n by (simp add: ndes_simp False, rel_auto)\n finally show ?thesis by simp\nnext\n case True\n thus ?thesis\n by (simp add: AlternateD_def, rel_auto)\nqed\n \ndefinition AlternateD_list :: \"('\\ upred \\ ('\\, '\\) rel_des) list \\ ('\\, '\\) rel_des \\ ('\\, '\\) rel_des\" where \n[upred_defs, ndes_simp]:\n\"AlternateD_list xs P = \n AlternateD {0.. i. map fst xs ! i) (\\ i. map snd xs ! i) P\"\n\nadhoc_overloading\n ualtern AlternateD and\n ualtern_list AlternateD_list\n\nnonterminal gcomm and gcomms\n \nsyntax\n \"_altind_els\" :: \"pttrn \\ logic \\ logic \\ logic \\ logic \\ logic\" (\"if _\\_ \\ _ \\ _ else _ fi\")\n \"_altind\" :: \"pttrn \\ logic \\ logic \\ logic \\ logic\" (\"if _\\_ \\ _ \\ _ fi\")\n \"_gcomm\" :: \"logic \\ logic \\ gcomm\" (\"_ \\ _\" [60, 60] 61)\n \"_gcomm_nil\" :: \"gcomm \\ gcomms\" (\"_\")\n \"_gcomm_cons\" :: \"gcomm \\ gcomms \\ gcomms\" (\"_ |/ _\" [60, 61] 61)\n \"_gcomm_show\" :: \"logic \\ logic\"\n \"_altgcomm_els\" :: \"gcomms \\ logic \\ logic\" (\"if/ _ /else _ /fi\")\n \"_altgcomm\" :: \"gcomms \\ logic\" (\"if/ _ /fi\")\n\ntranslations\n \"_altind_els x A g P Q\" => \"CONST ualtern A (\\ x. g) (\\ x. P) Q\"\n \"_altind_els x A g P Q\" <= \"CONST ualtern A (\\ x. g) (\\ x'. P) Q\"\n \"_altind x A g P\" => \"CONST ualtern A (\\ x. g) (\\ x. P) (CONST Orderings.top)\"\n \"_altind x A g P\" <= \"CONST ualtern A (\\ x. g) (\\ x'. P) (CONST Orderings.top)\"\n \"_altgcomm cs\" => \"CONST ualtern_list cs (CONST Orderings.top)\"\n \"_altgcomm (_gcomm_show cs)\" <= \"CONST ualtern_list cs (CONST Orderings.top)\"\n \"_altgcomm_els cs P\" => \"CONST ualtern_list cs P\"\n \"_altgcomm_els (_gcomm_show cs) P\" <= \"CONST ualtern_list cs P\"\n\n \"_gcomm g P\" => \"(g, P)\"\n \"_gcomm g P\" <= \"_gcomm_show (g, P)\"\n \"_gcomm_cons c cs\" => \"c # cs\"\n \"_gcomm_cons (_gcomm_show c) (_gcomm_show (d # cs))\" <= \"_gcomm_show (c # d # cs)\"\n \"_gcomm_nil c\" => \"[c]\"\n \"_gcomm_nil (_gcomm_show c)\" <= \"_gcomm_show [c]\"\n\nlemma AlternateD_H1_H3_closed [closure]: \n assumes \"\\ i. i \\ A \\ P i is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if i\\A \\ g(i) \\ P(i) else Q fi is \\<^bold>N\"\nproof (cases \"A = {}\")\n case True\n then show ?thesis\n by (simp add: AlternateD_def closure false_upred_def assms)\nnext\n case False\n then show ?thesis\n by (simp add: AlternateD_def closure assms)\nqed\n \nlemma AltD_ndes_simp [ndes_simp]: \n \"if i\\A \\ g(i) \\ (P\\<^sub>1(i) \\\\<^sub>n P\\<^sub>2(i)) else Q\\<^sub>1 \\\\<^sub>n Q\\<^sub>2 fi \n = ((\\ i \\ A \\ g i \\ P\\<^sub>1 i) \\ ((\\ i \\ A \\ \\ g i) \\ Q\\<^sub>1)) \\\\<^sub>n\n ((\\ i \\ A \\ \\g i\\\\<^sub>< \\ P\\<^sub>2 i) \\ (\\ i \\ A \\ \\ \\g i\\\\<^sub><) \\ Q\\<^sub>2)\"\nproof (cases \"A = {}\")\n case True\n then show ?thesis by (simp add: AlternateD_def)\nnext\n case False\n then show ?thesis\n by (simp add: ndes_simp, rel_auto)\nqed\n\ndeclare UINF_upto_expand_first [ndes_simp]\ndeclare UINF_Suc_shift [ndes_simp]\ndeclare USUP_upto_expand_first [ndes_simp]\ndeclare USUP_Suc_shift [ndes_simp]\ndeclare true_upred_def [THEN sym, ndes_simp]\n \nlemma AlternateD_mono_refine:\n assumes \"\\ i. P i \\ Q i\" \"R \\ S\"\n shows \"(if i\\A \\ g(i) \\ P(i) else R fi) \\ (if i\\A \\ g(i) \\ Q(i) else S fi)\"\n using assms by (rel_auto, meson)\n \nlemma Monotonic_AlternateD [closure]:\n \"\\ \\ i. Monotonic (F i); Monotonic G \\ \\ Monotonic (\\ X. if i\\A \\ g(i) \\ F i X else G(X) fi)\" \n by (rel_auto, meson)\n\nlemma AlternateD_eq:\n assumes \"A = B\" \"\\ i. i\\A \\ g(i) = h(i)\" \"\\ i. i\\A \\ P(i) = Q(i)\" \"R = S\"\n shows \"if i\\A \\ g(i) \\ P(i) else R fi = if i\\B \\ h(i) \\ Q(i) else S fi\"\n by (insert assms, rel_blast)\n\nlemma AlternateD_empty:\n \"if i\\{} \\ g(i) \\ P(i) else Q fi = Q\"\n by (rel_auto)\n \nlemma AlternateD_true_singleton:\n assumes \"P is \\<^bold>N\"\n shows \"if true \\ P fi = P\"\n by (ndes_eq cls: assms)\n\nlemma AlernateD_no_ind:\n assumes \"A \\ {}\" \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if i\\A \\ b \\ P else Q fi = if b \\ P else Q fi\"\n by (ndes_eq cls: assms)\n\nlemma AlernateD_singleton:\n assumes \"P k is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if i\\{k} \\ b(i) \\ P(i) else Q fi = if b(k) \\ P(k) else Q fi\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = if i\\{k} \\ b(k) \\ P(k) else Q fi\"\n by (auto intro: AlternateD_eq simp add: assms ndesign_form)\n also have \"... = ?rhs\"\n by (simp add: AlernateD_no_ind assms closure)\n finally show ?thesis .\nqed\n\nlemma AlternateD_commute:\n assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if g\\<^sub>1 \\ P | g\\<^sub>2 \\ Q fi = if g\\<^sub>2 \\ Q | g\\<^sub>1 \\ P fi\"\n by (ndes_eq cls:assms)\n\nlemma AlternateD_dcond:\n assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if g \\ P else Q fi = P \\ g \\\\<^sub>D Q\"\n by (ndes_eq cls:assms)\n\nlemma AlternateD_cover:\n assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if g \\ P else Q fi = if g \\ P | (\\ g) \\ Q fi\"\n by (ndes_eq cls: assms)\n\nlemma UINF_ndes_expand:\n assumes \"\\ i. i\\A \\ P(i) is \\<^bold>N\"\n shows \"(\\ i \\ A \\ \\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) = (\\ i \\ A \\ P(i))\"\n by (rule UINF_cong, simp add: assms ndesign_form)\n\nlemma USUP_ndes_expand:\n assumes \"\\ i. i\\A \\ P(i) is \\<^bold>N\"\n shows \"(\\ i \\ A \\ \\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) = (\\ i \\ A \\ P(i))\"\n by (rule USUP_cong, simp add: assms ndesign_form)\n \nlemma AlternateD_ndes_expand:\n assumes \"\\ i. i\\A \\ P(i) is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if i\\A \\ g(i) \\ P(i) else Q fi =\n if i\\A \\ g(i) \\ (\\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) else \\pre\\<^sub>D(Q)\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(Q) fi\"\n apply (simp add: AlternateD_def)\n apply (subst UINF_ndes_expand[THEN sym])\n apply (simp add: assms closure)\n apply (ndes_simp cls: assms)\n apply (rel_auto)\n done\n\nlemma AlternateD_ndes_expand':\n assumes \"\\ i. i\\A \\ P(i) is \\<^bold>N\"\n shows \"if i\\A \\ g(i) \\ P(i) fi = if i\\A \\ g(i) \\ (\\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) fi\"\n apply (simp add: AlternateD_def)\n apply (subst UINF_ndes_expand[THEN sym])\n apply (simp add: assms closure)\n apply (ndes_simp cls: assms)\n apply (rel_auto)\n done\n\nlemma ndesign_ind_form:\n assumes \"\\ i. P(i) is \\<^bold>N\"\n shows \"(\\ i. \\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) = P\"\n by (simp add: assms ndesign_form)\n \nlemma AlternateD_insert:\n assumes \"\\ i. i\\(insert x A) \\ P(i) is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"if i\\(insert x A) \\ g(i) \\ P(i) else Q fi = \n if g(x) \\ P(x) | \n (\\ i\\A \\ g(i)) \\ if i\\A \\ g(i) \\ P(i) fi \n else Q \n fi\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = if i\\(insert x A) \\ g(i) \\ (\\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i))) else (\\pre\\<^sub>D(Q)\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(Q)) fi\"\n using AlternateD_ndes_expand assms(1) assms(2) by blast\n also \n have \"... =\n if g(x) \\ (\\pre\\<^sub>D(P(x))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(x))) | \n (\\ i\\A \\ g(i)) \\ if i\\A \\ g(i) \\ \\pre\\<^sub>D(P(i))\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P(i)) fi \n else \\pre\\<^sub>D(Q)\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(Q)\n fi\"\n by (ndes_simp cls:assms, rel_auto)\n also have \"... = ?rhs\"\n by (simp add: AlternateD_ndes_expand' ndesign_form assms)\n finally show ?thesis .\nqed\n \nsubsection \\ Iteration \\\n\ntheorem ndesign_iteration_wlp [ndes_simp]:\n \"(p \\\\<^sub>n Q) ;; (p \\\\<^sub>n Q) \\<^bold>^ n = ((\\ i\\{0..n} \\ (Q \\<^bold>^ i) wlp p) \\\\<^sub>n Q \\<^bold>^ Suc n)\"\nproof (induct n)\n case 0\n then show ?case by (rel_auto)\nnext\n case (Suc n) note hyp = this\n have \"(p \\\\<^sub>n Q) ;; (p \\\\<^sub>n Q) \\<^bold>^ Suc n = (p \\\\<^sub>n Q) ;; (p \\\\<^sub>n Q) ;; (p \\\\<^sub>n Q) \\<^bold>^ n\"\n by (simp add: upred_semiring.power_Suc)\n also have \"... = (p \\\\<^sub>n Q) ;; ((\\ i \\ {0..n} \\ Q \\<^bold>^ i wlp p) \\\\<^sub>n Q \\<^bold>^ Suc n)\"\n by (simp add: hyp)\n also have \"... = (p \\ Q wlp (\\ i \\ {0..n} \\ Q \\<^bold>^ i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (simp add: upred_semiring.power_Suc ndesign_composition_wp seqr_assoc)\n also have \"... = (p \\ U(\\ i \\ {0..\\n\\}. Q \\<^bold>^ Suc i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (simp add: upred_semiring.power_Suc wp, rel_simp)\n also have \"... = (p \\ (\\ i \\ {0..n}. Q \\<^bold>^ Suc i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (rel_auto)\n also have \"... = (p \\ (\\ i \\ {1..Suc n}. Q \\<^bold>^ i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (metis (no_types, lifting) One_nat_def image_Suc_atLeastAtMost image_cong image_image) \n also have \"... = (Q \\<^bold>^ 0 wlp p \\ (\\ i \\ {1..Suc n}. Q \\<^bold>^ i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (simp add: wp)\n also have \"... = ((\\ i \\ {0..Suc n}. Q \\<^bold>^ i wlp p)) \\\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n by (simp add: atMost_Suc_eq_insert_0 atLeast0AtMost conj_upred_def image_Suc_atMost) \n also have \"... = (\\ i \\ {0..Suc n} \\ Q \\<^bold>^ i wlp p) \\\\<^sub>n Q \\<^bold>^ Suc (Suc n)\"\n by (simp add: upred_semiring.power_Suc USUP_as_Inf_image upred_semiring.mult_assoc)\n finally show ?case .\nqed\n\ntext \\ Overloadable Syntax \\\n \nconsts\n uiterate :: \"'a set \\ ('a \\ 'p) \\ ('a \\ 'r) \\ 'r\"\n uiterate_list :: \"('a \\ 'r) list \\ 'r\"\n\nsyntax\n \"_iterind\" :: \"pttrn \\ logic \\ logic \\ logic \\ logic\" (\"do _\\_ \\ _ \\ _ od\")\n \"_itergcomm\" :: \"gcomms \\ logic\" (\"do _ od\")\n \ntranslations\n \"_iterind x A g P\" => \"CONST uiterate A (\\ x. g) (\\ x. P)\"\n \"_iterind x A g P\" <= \"CONST uiterate A (\\ x. g) (\\ x'. P)\"\n \"_itergcomm cs\" => \"CONST uiterate_list cs\"\n \"_itergcomm (_gcomm_show cs)\" <= \"CONST uiterate_list cs\"\n \ndefinition IterateD :: \"'a set \\ ('a \\ '\\ upred) \\ ('a \\ '\\ hrel_des) \\ '\\ hrel_des\" where\n[upred_defs, ndes_simp]:\n\"IterateD A g P = (\\\\<^sub>N X \\ if i\\A \\ g(i) \\ P(i) ;; X else II\\<^sub>D fi)\"\n\ndefinition IterateD_list :: \"('\\ upred \\ '\\ hrel_des) list \\ '\\ hrel_des\" where \n[upred_defs, ndes_simp]:\n\"IterateD_list xs = IterateD {0.. i. fst (nth xs i)) (\\ i. snd (nth xs i))\"\n\nadhoc_overloading\n uiterate IterateD and\n uiterate_list IterateD_list\n \nlemma IterateD_H1_H3_closed [closure]: \n assumes \"\\ i. i \\ A \\ P i is \\<^bold>N\"\n shows \"do i\\A \\ g(i) \\ P(i) od is \\<^bold>N\"\nproof (cases \"A = {}\")\n case True\n then show ?thesis\n by (simp add: IterateD_def closure assms)\nnext\n case False\n then show ?thesis\n by (simp add: IterateD_def closure assms)\nqed\n\nlemma IterateD_empty:\n \"do i\\{} \\ g(i) \\ P(i) od = II\\<^sub>D\"\n by (simp add: IterateD_def AlternateD_empty ndes_theory.LFP_const skip_d_is_H1_H3)\n\nlemma IterateD_list_single_expand:\n \"do b \\ P od = (\\<^bold>\\\\<^bsub>NDES\\<^esub> X \\ if b \\ P ;; X else II\\<^sub>D fi)\"\noops\n \nlemma IterateD_singleton:\n assumes \"P is \\<^bold>N\"\n shows \"do b \\ P od = do i\\{0} \\ b \\ P od\"\n apply (simp add: IterateD_list_def IterateD_def AlernateD_singleton assms)\n apply (subst AlernateD_singleton)\n apply (simp)\n apply (rel_auto)\noops\n\nlemma IterateD_mono_refine:\n assumes \n \"\\ i. P i is \\<^bold>N\" \"\\ i. Q i is \\<^bold>N\"\n \"\\ i. P i \\ Q i\"\n shows \"(do i\\A \\ g(i) \\ P(i) od) \\ (do i\\A \\ g(i) \\ Q(i) od)\"\n apply (simp add: IterateD_def ndes_theory.utp_lfp_def)\n apply (subst ndes_theory.utp_lfp_def)\n apply (simp_all add: closure assms)\n apply (subst ndes_theory.utp_lfp_def)\n apply (simp_all add: closure assms)\n apply (rule gfp_mono)\n apply (rule AlternateD_mono_refine)\n apply (simp_all add: closure seqr_mono assms)\ndone\n\nlemma IterateD_single_refine:\n assumes \n \"P is \\<^bold>N\" \"Q is \\<^bold>N\" \"P \\ Q\"\n shows \"(do g \\ P od) \\ (do g \\ Q od)\"\noops\n \nlemma IterateD_refine_intro:\n fixes V :: \"(nat, 'a) uexpr\"\n assumes \"vwb_lens w\"\n shows\n \"I \\\\<^sub>n (w:[\\I \\ \\ (\\ i\\A \\ g(i))\\\\<^sub>>]) \\ \n do i\\A \\ g(i) \\ (I \\ g(i)) \\\\<^sub>n (w:[\\I\\\\<^sub>> \\ \\V\\\\<^sub>> <\\<^sub>u \\V\\\\<^sub><]) od\"\nproof (cases \"A = {}\")\n case True\n with assms show ?thesis\n by (simp add: IterateD_empty, rel_auto)\nnext\n case False\n then show ?thesis\n using assms\n apply (simp add: IterateD_def)\n apply (rule ndesign_mu_wf_refine_intro[where e=V and R=\"{(x, y). x < y}\"])\n apply (simp_all add: wf closure)\n apply (simp add: ndes_simp unrest)\n apply (rule ndesign_refine_intro)\n apply (rel_auto)\n apply (rel_auto)\n apply (metis mwb_lens.put_put vwb_lens_mwb)\n done\nqed\n \nlemma IterateD_single_refine_intro:\n fixes V :: \"(nat, 'a) uexpr\"\n assumes \"vwb_lens w\"\n shows\n \"I \\\\<^sub>n (w:[\\I \\ \\ g\\\\<^sub>>]) \\ \n do g \\ ((I \\ g) \\\\<^sub>n (w:[\\I\\\\<^sub>> \\ \\V\\\\<^sub>> <\\<^sub>u \\V\\\\<^sub><])) od\"\n apply (rule order_trans)\n defer\n apply (rule IterateD_refine_intro[of w \"{0}\" \"\\ i. g\" I V, simplified, OF assms(1)])\n oops\n\nsubsection \\ Let and Local Variables \\\n \ndefinition LetD :: \"('a, '\\) uexpr \\ ('a \\ '\\ hrel_des) \\ '\\ hrel_des\" where\n[upred_defs]: \"LetD v P = (P x)\\x \\ \\v\\\\<^sub>D\\<^sub><\\\"\n\nsyntax\n \"_LetD\" :: \"[letbinds, 'a] \\ 'a\" (\"(let\\<^sub>D (_)/ in (_))\" [0, 10] 10)\n\ntranslations\n \"_LetD (_binds b bs) e\" \\ \"_LetD b (_LetD bs e)\"\n \"let\\<^sub>D x = a in e\" \\ \"CONST LetD a (\\x. e)\"\n\nlemma LetD_ndes_simp [ndes_simp]: \n \"LetD v (\\ x. p(x) \\\\<^sub>n Q(x)) = (p(x)\\x \\ v\\) \\\\<^sub>n (Q(x)\\x \\ \\v\\\\<^sub><\\)\"\n by (rel_auto)\n \nlemma LetD_H1_H3_closed [closure]:\n \"\\ \\ x. P(x) is \\<^bold>N \\ \\ LetD v P is \\<^bold>N\"\n by (rel_auto)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/designs/utp_des_prog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2967681312105448}} {"text": "theory Term5\nimports \"../Nominal2_Atoms\" \"../Nominal2_Eqvt\" \"../Nominal2_Supp\" \"../Abs\" \"../Perm\" \"../Fv\" \"../Rsp\"\nbegin\n\natom_decl name\n\ndatatype rtrm5 =\n rVr5 \"name\"\n| rAp5 \"rtrm5\" \"rtrm5\"\n| rLt5 \"rlts\" \"rtrm5\" --\"bind (bv5 lts) in (rtrm5)\"\nand rlts =\n rLnil\n| rLcons \"name\" \"rtrm5\" \"rlts\"\n\nprimrec\n rbv5\nwhere\n \"rbv5 rLnil = {}\"\n| \"rbv5 (rLcons n t ltl) = {atom n} \\ (rbv5 ltl)\"\n\n\nsetup {* snd o define_raw_perms (Datatype.the_info @{theory} \"Term5.rtrm5\") 2 *}\nprint_theorems\n\nlocal_setup {* snd o define_fv_alpha (Datatype.the_info @{theory} \"Term5.rtrm5\")\n [[[], [], [(SOME (@{term rbv5}, true), 0, 1)]], [[], []]] [(@{term rbv5}, 1, [[], [(0,NONE), (2,SOME @{term rbv5})]])] *}\nprint_theorems\n\nnotation\n alpha_rtrm5 (\"_ \\5 _\" [100, 100] 100) and\n alpha_rlts (\"_ \\l _\" [100, 100] 100)\nthm alpha_rtrm5_alpha_rlts_alpha_rbv5.intros\n\nlocal_setup {* (fn ctxt => snd (Local_Theory.note ((@{binding alpha5_inj}, []), (build_rel_inj @{thms alpha_rtrm5_alpha_rlts_alpha_rbv5.intros} @{thms rtrm5.distinct rtrm5.inject rlts.distinct rlts.inject} @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} ctxt)) ctxt)) *}\nthm alpha5_inj\n\nlemma rbv5_eqvt[eqvt]:\n \"pi \\ (rbv5 x) = rbv5 (pi \\ x)\"\n apply (induct x)\n apply (simp_all add: eqvts atom_eqvt)\n done\n\nlemma fv_rtrm5_rlts_eqvt[eqvt]:\n \"pi \\ (fv_rtrm5 x) = fv_rtrm5 (pi \\ x)\"\n \"pi \\ (fv_rlts l) = fv_rlts (pi \\ l)\"\n apply (induct x and l)\n apply (simp_all add: eqvts atom_eqvt)\n done\n\n(*lemma alpha5_eqvt:\n \"(xa \\5 y \\ (p \\ xa) \\5 (p \\ y)) \\\n (xb \\l ya \\ (p \\ xb) \\l (p \\ ya)) \\\n (alpha_rbv5 b c \\ alpha_rbv5 (p \\ b) (p \\ c))\"\napply (tactic {* alpha_eqvt_tac @{thm alpha_rtrm5_alpha_rlts_alpha_rbv5.induct} @{thms alpha5_inj permute_rtrm5_permute_rlts.simps} @{context} 1 *})\ndone*)\n\nlocal_setup {*\n(fn ctxt => snd (Local_Theory.note ((@{binding alpha5_eqvt}, []),\nbuild_alpha_eqvts [@{term alpha_rtrm5}, @{term alpha_rlts}, @{term alpha_rbv5}] (fn _ => alpha_eqvt_tac @{thm alpha_rtrm5_alpha_rlts_alpha_rbv5.induct} @{thms alpha5_inj permute_rtrm5_permute_rlts.simps} ctxt 1) ctxt) ctxt)) *}\nprint_theorems\n\nlemma alpha5_reflp:\n\"y \\5 y \\ (x \\l x \\ alpha_rbv5 x x)\"\napply (rule rtrm5_rlts.induct)\napply (simp_all add: alpha5_inj)\napply (rule_tac x=\"0::perm\" in exI)\napply (simp add: eqvts alpha_gen fresh_star_def fresh_zero_perm)\ndone\n\nlemma alpha5_symp:\n\"(a \\5 b \\ b \\5 a) \\\n(x \\l y \\ y \\l x) \\\n(alpha_rbv5 x y \\ alpha_rbv5 y x)\"\napply (rule alpha_rtrm5_alpha_rlts_alpha_rbv5.induct)\napply (simp_all add: alpha5_inj)\napply (erule exE)\napply (rule_tac x=\"-pi\" in exI)\napply (rule alpha_gen_sym)\napply (simp_all add: alphas)\napply (case_tac x)\napply (case_tac y)\napply (simp add: alpha5_eqvt)\napply clarify\napply simp\ndone\n\nlemma alpha5_symp1:\n\"(a \\5 b \\ b \\5 a) \\\n(x \\l y \\ y \\l x) \\\n(alpha_rbv5 x y \\ alpha_rbv5 y x)\"\napply (rule alpha_rtrm5_alpha_rlts_alpha_rbv5.induct)\napply (simp_all add: alpha5_inj)\napply (erule exE)\napply (rule_tac x=\"- pi\" in exI)\napply (simp add: alpha_gen)\n apply(simp add: fresh_star_def fresh_minus_perm)\napply clarify\napply (rule conjI)\napply (rotate_tac 3)\napply (frule_tac p=\"- pi\" in alpha5_eqvt(2))\napply simp\napply (rule conjI)\napply (rotate_tac 5)\napply (frule_tac p=\"- pi\" in alpha5_eqvt(1))\napply simp\napply (rotate_tac 6)\napply simp\napply (drule_tac p1=\"- pi\" in permute_eq_iff[symmetric,THEN iffD1])\napply (simp)\ndone\n\nthm alpha_gen_sym[no_vars]\nthm alpha_gen_compose_sym[no_vars]\n\nlemma tt: \n \"\\R (- p \\ x) y \\ R (p \\ y) x; (bs, x) \\gen R f (- p) (cs, y)\\ \\ (cs, y) \\gen R f p (bs, x)\"\n unfolding alphas\n unfolding fresh_star_def\n by (auto simp add: fresh_minus_perm)\n\nlemma alpha5_symp2:\n shows \"a \\5 b \\ b \\5 a\"\n and \"x \\l y \\ y \\l x\"\n and \"alpha_rbv5 x y \\ alpha_rbv5 y x\"\napply(induct rule: alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts)\n(* non-binding case *)\napply(simp add: alpha5_inj)\n(* non-binding case *)\napply(simp add: alpha5_inj)\n(* binding case *)\napply(simp add: alpha5_inj)\napply(erule exE)\napply(rule_tac x=\"- pi\" in exI)\napply(rule tt)\napply(simp add: alphas)\napply(erule conjE)+\napply(drule_tac p=\"- pi\" in alpha5_eqvt(2))\napply(drule_tac p=\"- pi\" in alpha5_eqvt(2))\napply(drule_tac p=\"- pi\" in alpha5_eqvt(1))\napply(drule_tac p=\"- pi\" in alpha5_eqvt(1))\napply(simp)\napply(simp add: alphas)\napply(erule conjE)+\napply metis\n(* non-binding case *)\napply(simp add: alpha5_inj)\n(* non-binding case *)\napply(simp add: alpha5_inj)\n(* non-binding case *)\napply(simp add: alpha5_inj)\n(* non-binding case *)\napply(simp add: alpha5_inj)\ndone\n\nlemma alpha5_transp:\n\"(a \\5 b \\ (\\c. b \\5 c \\ a \\5 c)) \\\n(x \\l y \\ (\\z. y \\l z \\ x \\l z)) \\\n(alpha_rbv5 k l \\ (\\m. alpha_rbv5 l m \\ alpha_rbv5 k m))\"\n(*apply (tactic {* transp_tac @{context} @{thm alpha_rtrm5_alpha_rlts_alpha_rbv5.induct} @{thms alpha5_inj} @{thms rtrm5.distinct rtrm5.inject rlts.distinct rlts.inject} [] @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{thms alpha5_eqvt} 1 *})*)\napply (rule alpha_rtrm5_alpha_rlts_alpha_rbv5.induct)\napply (rule_tac [!] allI)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\ndefer\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* eetac @{thm exi_sum} @{context} 1 *})\n(* HERE *)\n(*\napply(rule alpha_gen_trans)\nthm alpha_gen_trans\ndefer\napply (simp add: alpha_gen)\napply clarify\napply(simp add: fresh_star_plus)\napply (rule conjI)\napply (erule_tac x=\"- pi \\ rltsaa\" in allE)\napply (rotate_tac 5)\napply (drule_tac p=\"- pi\" in alpha5_eqvt(2))\napply simp\napply (drule_tac p=\"pi\" in alpha5_eqvt(2))\napply simp\napply (erule_tac x=\"- pi \\ rtrm5aa\" in allE)\napply (rotate_tac 7)\napply (drule_tac p=\"- pi\" in alpha5_eqvt(1))\napply simp\napply (rotate_tac 3)\napply (drule_tac p=\"pi\" in alpha5_eqvt(1))\napply simp\ndone\n*)\nsorry\n\nlemma alpha5_equivp:\n \"equivp alpha_rtrm5\"\n \"equivp alpha_rlts\"\n unfolding equivp_reflp_symp_transp reflp_def symp_def transp_def\n apply (simp_all only: alpha5_reflp)\n apply (meson alpha5_symp alpha5_transp)\n apply (meson alpha5_symp alpha5_transp)\n done\n\nquotient_type\n trm5 = rtrm5 / alpha_rtrm5\nand\n lts = rlts / alpha_rlts\n by (auto intro: alpha5_equivp)\n\nlocal_setup {*\n(fn ctxt => ctxt\n |> snd o (Quotient_Def.quotient_lift_const (\"Vr5\", @{term rVr5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Ap5\", @{term rAp5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lt5\", @{term rLt5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lnil\", @{term rLnil}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lcons\", @{term rLcons}))\n |> snd o (Quotient_Def.quotient_lift_const (\"fv_trm5\", @{term fv_rtrm5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"fv_lts\", @{term fv_rlts}))\n |> snd o (Quotient_Def.quotient_lift_const (\"bv5\", @{term rbv5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"alpha_bv5\", @{term alpha_rbv5})))\n*}\nprint_theorems\n\nlemma alpha5_rfv:\n \"(t \\5 s \\ fv_rtrm5 t = fv_rtrm5 s)\"\n \"(l \\l m \\ fv_rlts l = fv_rlts m)\"\n \"(alpha_rbv5 b c \\ True)\"\n apply(induct rule: alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts)\n apply(simp_all add: eqvts)\n apply(simp add: alpha_gen)\n apply(clarify)\n apply blast\ndone\n\nlemma bv_list_rsp:\n shows \"x \\l y \\ rbv5 x = rbv5 y\"\n apply(induct rule: alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts(2))\n apply(simp_all)\n apply(clarify)\n apply simp\n done\n\nlocal_setup {* snd o Local_Theory.note ((@{binding alpha_dis}, []), (flat (map (distinct_rel @{context} @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases}) [(@{thms rtrm5.distinct}, @{term alpha_rtrm5}), (@{thms rlts.distinct}, @{term alpha_rlts}), (@{thms rlts.distinct}, @{term alpha_rbv5})]))) *}\nprint_theorems\n\nlocal_setup {* snd o Local_Theory.note ((@{binding alpha_bn_rsp}, []), prove_alpha_bn_rsp [@{term alpha_rtrm5}, @{term alpha_rlts}] @{thms alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts} @{thms rtrm5.exhaust rlts.exhaust} @{thms alpha5_inj alpha_dis} @{thms alpha5_equivp} @{context} (@{term alpha_rbv5}, 1)) *}\nthm alpha_bn_rsp\n\nlemma [quot_respect]:\n \"(alpha_rlts ===> op =) fv_rlts fv_rlts\"\n \"(alpha_rtrm5 ===> op =) fv_rtrm5 fv_rtrm5\"\n \"(alpha_rlts ===> op =) rbv5 rbv5\"\n \"(op = ===> alpha_rtrm5) rVr5 rVr5\"\n \"(alpha_rtrm5 ===> alpha_rtrm5 ===> alpha_rtrm5) rAp5 rAp5\"\n \"(alpha_rlts ===> alpha_rtrm5 ===> alpha_rtrm5) rLt5 rLt5\"\n \"(op = ===> alpha_rtrm5 ===> alpha_rlts ===> alpha_rlts) rLcons rLcons\"\n \"(op = ===> alpha_rtrm5 ===> alpha_rtrm5) permute permute\"\n \"(op = ===> alpha_rlts ===> alpha_rlts) permute permute\"\n \"(alpha_rlts ===> alpha_rlts ===> op =) alpha_rbv5 alpha_rbv5\"\n apply (simp_all add: alpha5_inj alpha5_rfv alpha5_eqvt bv_list_rsp alpha_bn_rsp)\n apply (clarify)\n apply (rule_tac x=\"0\" in exI)\n apply (simp add: fresh_star_def fresh_zero_perm alpha_gen alpha5_rfv)\ndone\n\n\nlemma\n shows \"(alpha_rlts ===> op =) rbv5 rbv5\"\n by (simp add: bv_list_rsp)\n\nlemmas trm5_lts_inducts = rtrm5_rlts.inducts[quot_lifted]\n\ninstantiation trm5 and lts :: pt\nbegin\n\nquotient_definition\n \"permute_trm5 :: perm \\ trm5 \\ trm5\"\nis\n \"permute :: perm \\ rtrm5 \\ rtrm5\"\n\nquotient_definition\n \"permute_lts :: perm \\ lts \\ lts\"\nis\n \"permute :: perm \\ rlts \\ rlts\"\n\ninstance by default\n (simp_all add: permute_rtrm5_permute_rlts_zero[quot_lifted] permute_rtrm5_permute_rlts_append[quot_lifted])\n\nend\n\nlemmas permute_trm5_lts = permute_rtrm5_permute_rlts.simps[quot_lifted]\nlemmas bv5[simp] = rbv5.simps[quot_lifted]\nlemmas fv_trm5_lts[simp] = fv_rtrm5_fv_rlts.simps[quot_lifted]\nlemmas alpha5_INJ = alpha5_inj[unfolded alpha_gen2, unfolded alpha_gen, quot_lifted, folded alpha_gen2, folded alpha_gen]\nlemmas alpha5_DIS = alpha_dis[quot_lifted]\n\nend\n", "meta": {"author": "goodlyrottenapple", "repo": "Nominal2-Isabelle", "sha": "214274ed6db74c19b8694fc5c8dd9cafa13b056a", "save_path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle", "path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle/Nominal2-Isabelle-214274ed6db74c19b8694fc5c8dd9cafa13b056a/Nominal/Manual/Term5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.29676813121054474}} {"text": "section\\Auxiliary renamings for Separation\\\ntheory Separation_Rename\n imports\n Interface\nbegin\n\nno_notation Aleph (\\\\_\\ [90] 90)\n\nlemmas apply_fun = apply_iff[THEN iffD1]\n\nlemma nth_concat : \"[p,t] \\ list(A) \\ env\\ list(A) \\ nth(1 +\\<^sub>\\ length(env),[p]@ env @ [t]) = t\"\n by(auto simp add:nth_append)\n\nlemma nth_concat2 : \"env\\ list(A) \\ nth(length(env),env @ [p,t]) = p\"\n by(auto simp add:nth_append)\n\nlemma nth_concat3 : \"env\\ list(A) \\ u = nth(succ(length(env)), env @ [pi, u])\"\n by(auto simp add:nth_append)\n\ndefinition\n sep_var :: \"i \\ i\" where\n \"sep_var(n) \\ {\\0,1\\,\\1,3\\,\\2,4\\,\\3,5\\,\\4,0\\,\\5+\\<^sub>\\n,6\\,\\6+\\<^sub>\\n,2\\}\"\n\ndefinition\n sep_env :: \"i \\ i\" where\n \"sep_env(n) \\ \\ i \\ (5+\\<^sub>\\n)-5 . i+\\<^sub>\\2\"\n\ndefinition weak :: \"[i, i] \\ i\" where\n \"weak(n,m) \\ {i+\\<^sub>\\m . i \\ n}\"\n\nlemma weakD :\n assumes \"n \\ nat\" \"k\\nat\" \"x \\ weak(n,k)\"\n shows \"\\ i \\ n . x = i+\\<^sub>\\k\"\n using assms unfolding weak_def by blast\n\nlemma weak_equal :\n assumes \"n\\nat\" \"m\\nat\"\n shows \"weak(n,m) = (m+\\<^sub>\\n) - m\"\nproof -\n have \"weak(n,m)\\(m+\\<^sub>\\n)-m\"\n proof(intro subsetI)\n fix x\n assume \"x\\weak(n,m)\"\n with assms\n obtain i where\n \"i\\n\" \"x=i+\\<^sub>\\m\"\n using weakD by blast\n then\n have \"m\\i+\\<^sub>\\m\" \"im\\nat\\ \\n\\nat\\ ltI[OF \\i\\n\\] by simp_all\n then\n have \"\\i+\\<^sub>\\mn\\nat\\ \\i\\n\\] \\m\\nat\\ by simp\n with \\x=i+\\<^sub>\\m\\\n have \"x\\m\"\n using ltI \\m\\nat\\ by auto\n moreover\n from assms \\x=i+\\<^sub>\\m\\ \\i\n have \"x\\n\"\n using add_lt_mono1[OF \\i \\n\\nat\\] by simp\n ultimately\n show \"x\\(m+\\<^sub>\\n)-m\"\n using ltD DiffI by simp\n qed\n moreover\n have \"(m+\\<^sub>\\n)-m\\weak(n,m)\"\n proof (intro subsetI)\n fix x\n assume \"x\\(m+\\<^sub>\\n)-m\"\n then\n have \"x\\m+\\<^sub>\\n\" \"x\\m\"\n using DiffD1[of x \"n+\\<^sub>\\m\" m] DiffD2[of x \"n+\\<^sub>\\m\" m] by simp_all\n then\n have \"x\\n\" \"x\\nat\"\n using ltI in_n_in_nat[OF add_type[of m n]] by simp_all\n then\n obtain i where\n \"m+\\<^sub>\\n = succ(x+\\<^sub>\\i)\"\n using less_iff_succ_add[OF \\x\\nat\\,of \"m+\\<^sub>\\n\"] add_type by auto\n then\n have \"x+\\<^sub>\\i\\n\" using succ_le_iff by simp\n with \\x\\m\\\n have \"\\xm\\nat\\ \\x\\nat\\\n have \"m\\x\" using not_lt_iff_le by simp\n with \\x\\n\\ \\n\\nat\\\n have \"x-\\<^sub>\\m\\n-\\<^sub>\\m\"\n using diff_mono[OF \\x\\nat\\ _ \\m\\nat\\] by simp\n have \"m+\\<^sub>\\n-\\<^sub>\\m = n\" using diff_cancel2 \\m\\nat\\ \\n\\nat\\ by simp\n with \\x-\\<^sub>\\m\\n-\\<^sub>\\m\\ \\x\\nat\\\n have \"x-\\<^sub>\\m \\ n\" \"x=x-\\<^sub>\\m+\\<^sub>\\m\"\n using ltD add_diff_inverse2[OF \\m\\x\\] by simp_all\n then\n show \"x\\weak(n,m)\"\n unfolding weak_def by auto\n qed\n ultimately\n show ?thesis by auto\nqed\n\nlemma weak_zero:\n shows \"weak(0,n) = 0\"\n unfolding weak_def by simp\n\nlemma weakening_diff :\n assumes \"n \\ nat\"\n shows \"weak(n,7) - weak(n,5) \\ {5+\\<^sub>\\n, 6+\\<^sub>\\n}\"\n unfolding weak_def using assms\nproof(auto)\n {\n fix i\n assume \"i\\n\" \"succ(succ(natify(i)))\\n\" \"\\w\\n. succ(succ(natify(i))) \\ natify(w)\"\n then\n have \"in\\nat\\ by simp\n from \\n\\nat\\ \\i\\n\\ \\succ(succ(natify(i)))\\n\\\n have \"i\\nat\" \"succ(succ(i))\\n\" using in_n_in_nat by simp_all\n from \\i\n have \"succ(i)\\n\" using succ_leI by simp\n with \\n\\nat\\\n consider (a) \"succ(i) = n\" | (b) \"succ(i) < n\"\n using leD by auto\n then have \"succ(i) = n\"\n proof cases\n case a\n then show ?thesis .\n next\n case b\n then\n have \"succ(succ(i))\\n\" using succ_leI by simp\n with \\n\\nat\\\n consider (a) \"succ(succ(i)) = n\" | (b) \"succ(succ(i)) < n\"\n using leD by auto\n then have \"succ(i) = n\"\n proof cases\n case a\n with \\succ(succ(i))\\n\\ show ?thesis by blast\n next\n case b\n then\n have \"succ(succ(i))\\n\" using ltD by simp\n with \\i\\nat\\\n have \"succ(succ(natify(i))) \\ natify(succ(succ(i)))\"\n using \\\\w\\n. succ(succ(natify(i))) \\ natify(w)\\ by auto\n then\n have \"False\" using \\i\\nat\\ by auto\n then show ?thesis by blast\n qed\n then show ?thesis .\n qed\n with \\i\\nat\\ have \"succ(natify(i)) = n\" by simp\n }\n then\n show \"n \\ nat \\\n succ(succ(natify(y))) \\ n \\\n \\x\\n. succ(succ(natify(y))) \\ natify(x) \\\n y \\ n \\ succ(natify(y)) = n\" for y\n by blast\nqed\n\nlemma in_add_del :\n assumes \"x\\j+\\<^sub>\\n\" \"n\\nat\" \"j\\nat\"\n shows \"x < j \\ x \\ weak(n,j)\"\nproof (cases \"xnat\" \"j+\\<^sub>\\n\\nat\"\n using in_n_in_nat[OF _ \\x\\j+\\<^sub>\\n\\] assms by simp_all\n then\n have \"j \\ x\" \"x < j+\\<^sub>\\n\"\n using not_lt_iff_le False \\j\\nat\\ \\n\\nat\\ ltI[OF \\x\\j+\\<^sub>\\n\\] by auto\n then\n have \"x-\\<^sub>\\j < (j +\\<^sub>\\ n) -\\<^sub>\\ j\" \"x = j +\\<^sub>\\ (x -\\<^sub>\\j)\"\n using diff_mono \\x\\nat\\ \\j+\\<^sub>\\n\\nat\\ \\j\\nat\\ \\n\\nat\\\n add_diff_inverse[OF \\j\\x\\] by simp_all\n then\n have \"x-\\<^sub>\\j < n\" \"x = (x -\\<^sub>\\j ) +\\<^sub>\\ j\"\n using diff_add_inverse \\n\\nat\\ add_commute by simp_all\n then\n have \"x-\\<^sub>\\j \\n\" using ltD by simp\n then\n have \"x \\ weak(n,j)\"\n unfolding weak_def\n using \\x= (x-\\<^sub>\\j) +\\<^sub>\\j\\ RepFunI[OF \\x-\\<^sub>\\j\\n\\] add_commute by force\n then show ?thesis ..\nqed\n\n\nlemma sep_env_action:\n assumes\n \"[t,p,u,P,leq,o,pi] \\ list(M)\"\n \"env \\ list(M)\"\n shows \"\\ i . i \\ weak(length(env),5) \\\n nth(sep_env(length(env))`i,[t,p,u,P,leq,o,pi]@env) = nth(i,[p,P,leq,o,t] @ env @ [pi,u])\"\nproof -\n from assms\n have A: \"5+\\<^sub>\\length(env)\\nat\" \"[p, P, leq, o, t] \\list(M)\"\n by simp_all\n let ?f=\"sep_env(length(env))\"\n have EQ: \"weak(length(env),5) = 5+\\<^sub>\\length(env) - 5\"\n using weak_equal length_type[OF \\env\\list(M)\\] by simp\n let ?tgt=\"[t,p,u,P,leq,o,pi]@env\"\n let ?src=\"[p,P,leq,o,t] @ env @ [pi,u]\"\n have \"nth(?f`i,[t,p,u,P,leq,o,pi]@env) = nth(i,[p,P,leq,o,t] @ env @ [pi,u])\"\n if \"i \\ (5+\\<^sub>\\length(env)-5)\" for i\n proof -\n from that\n have 2: \"i \\ 5+\\<^sub>\\length(env)\" \"i \\ 5\" \"i \\ nat\" \"i-\\<^sub>\\5\\nat\" \"i+\\<^sub>\\2\\nat\"\n using in_n_in_nat[OF \\5+\\<^sub>\\length(env)\\nat\\] by simp_all\n then\n have 3: \"\\ i < 5\" using ltD by force\n then\n have \"5 \\ i\" \"2 \\ 5\"\n using not_lt_iff_le \\i\\nat\\ by simp_all\n then have \"2 \\ i\" using le_trans[OF \\2\\5\\] by simp\n from A \\i \\ 5+\\<^sub>\\length(env)\\\n have \"i < 5+\\<^sub>\\length(env)\" using ltI by simp\n with \\i\\nat\\ \\2\\i\\ A\n have C:\"i+\\<^sub>\\2 < 7+\\<^sub>\\length(env)\" by simp\n with that\n have B: \"?f`i = i+\\<^sub>\\2\" unfolding sep_env_def by simp\n from 3 assms(1) \\i\\nat\\\n have \"\\ i+\\<^sub>\\2 < 7\" using not_lt_iff_le add_le_mono by simp\n from \\i < 5+\\<^sub>\\length(env)\\ 3 \\i\\nat\\\n have \"i-\\<^sub>\\5 < 5+\\<^sub>\\length(env) -\\<^sub>\\ 5\"\n using diff_mono[of i \"5+\\<^sub>\\length(env)\" 5,OF _ _ _ \\i < 5+\\<^sub>\\length(env)\\]\n not_lt_iff_le[THEN iffD1] by force\n with assms(2)\n have \"i-\\<^sub>\\5 < length(env)\" using diff_add_inverse length_type by simp\n have \"nth(i,?src) =nth(i-\\<^sub>\\5,env@[pi,u])\"\n using nth_append[OF A(2) \\i\\nat\\] 3 by simp\n also\n have \"... = nth(i-\\<^sub>\\5, env)\"\n using nth_append[OF \\env \\list(M)\\ \\i-\\<^sub>\\5\\nat\\] \\i-\\<^sub>\\5 < length(env)\\ by simp\n also\n have \"... = nth(i+\\<^sub>\\2, ?tgt)\"\n using nth_append[OF assms(1) \\i+\\<^sub>\\2\\nat\\] \\\\ i+\\<^sub>\\2 <7\\ by simp\n ultimately\n have \"nth(i,?src) = nth(?f`i,?tgt)\"\n using B by simp\n then show ?thesis using that by simp\n qed\n then show ?thesis using EQ by force\nqed\n\nlemma sep_env_type :\n assumes \"n \\ nat\"\n shows \"sep_env(n) : (5+\\<^sub>\\n)-5 \\ (7+\\<^sub>\\n)-7\"\nproof -\n let ?h=\"sep_env(n)\"\n from \\n\\nat\\\n have \"(5+\\<^sub>\\n)+\\<^sub>\\2 = 7+\\<^sub>\\n\" \"7+\\<^sub>\\n\\nat\" \"5+\\<^sub>\\n\\nat\" by simp_all\n have\n D: \"sep_env(n)`x \\ (7+\\<^sub>\\n)-7\" if \"x \\ (5+\\<^sub>\\n)-5\" for x\n proof -\n from \\x\\5+\\<^sub>\\n-5\\\n have \"?h`x = x+\\<^sub>\\2\" \"x<5+\\<^sub>\\n\" \"x\\nat\"\n unfolding sep_env_def using ltI in_n_in_nat[OF \\5+\\<^sub>\\n\\nat\\] by simp_all\n then\n have \"x+\\<^sub>\\2 < 7+\\<^sub>\\n\" by simp\n then\n have \"x+\\<^sub>\\2 \\ 7+\\<^sub>\\n\" using ltD by simp\n from \\x\\5+\\<^sub>\\n-5\\\n have \"x\\5\" by simp\n then have \"\\x<5\" using ltD by blast\n then have \"5\\x\" using not_lt_iff_le \\x\\nat\\ by simp\n then have \"7\\x+\\<^sub>\\2\" using add_le_mono \\x\\nat\\ by simp\n then have \"\\x+\\<^sub>\\2<7\" using not_lt_iff_le \\x\\nat\\ by simp\n then have \"x+\\<^sub>\\2 \\ 7\" using ltI \\x\\nat\\ by force\n with \\x+\\<^sub>\\2 \\ 7+\\<^sub>\\n\\ show ?thesis using \\?h`x = x+\\<^sub>\\2\\ DiffI by simp\n qed\n then show ?thesis unfolding sep_env_def using lam_type by simp\nqed\n\nlemma sep_var_fin_type :\n assumes \"n \\ nat\"\n shows \"sep_var(n) : 7+\\<^sub>\\n -||> 7+\\<^sub>\\n\"\n unfolding sep_var_def\n using consI ltD emptyI by force\n\nlemma sep_var_domain :\n assumes \"n \\ nat\"\n shows \"domain(sep_var(n)) = 7+\\<^sub>\\n - weak(n,5)\"\nproof -\n let ?A=\"weak(n,5)\"\n have A:\"domain(sep_var(n)) \\ (7+\\<^sub>\\n)\"\n unfolding sep_var_def\n by(auto simp add: le_natE)\n have C: \"x=5+\\<^sub>\\n \\ x=6+\\<^sub>\\n \\ x \\ 4\" if \"x\\domain(sep_var(n))\" for x\n using that unfolding sep_var_def by auto\n have D : \"x\\7\" if \"x\\7+\\<^sub>\\n\" for x\n using that \\n\\nat\\ ltI by simp\n have \"\\ 5+\\<^sub>\\n < 5+\\<^sub>\\n\" using \\n\\nat\\ lt_irrefl[of _ False] by force\n have \"\\ 6+\\<^sub>\\n < 5+\\<^sub>\\n\" using \\n\\nat\\ by force\n have R: \"x < 5+\\<^sub>\\n\" if \"x\\?A\" for x\n proof -\n from that\n obtain i where\n \"i\\i\"\n unfolding weak_def\n using ltI \\n\\nat\\ RepFun_iff by force\n with \\n\\nat\\\n have \"5+\\<^sub>\\i < 5+\\<^sub>\\n\" using add_lt_mono2 by simp\n with \\x=5+\\<^sub>\\i\\\n show \"x < 5+\\<^sub>\\n\" by simp\n qed\n then\n have 1:\"x\\?A\" if \"\\x <5+\\<^sub>\\n\" for x using that by blast\n have \"5+\\<^sub>\\n \\ ?A\" \"6+\\<^sub>\\n\\?A\"\n proof -\n show \"5+\\<^sub>\\n \\ ?A\" using 1 \\\\5+\\<^sub>\\n<5+\\<^sub>\\n\\ by blast\n with 1 show \"6+\\<^sub>\\n \\ ?A\" using \\\\6+\\<^sub>\\n<5+\\<^sub>\\n\\ by blast\n qed\n then\n have E:\"x\\?A\" if \"x\\domain(sep_var(n))\" for x\n unfolding weak_def\n using C that by force\n then\n have F: \"domain(sep_var(n)) \\ 7+\\<^sub>\\n - ?A\" using A by auto\n from assms\n have \"x<7 \\ x\\weak(n,7)\" if \"x\\7+\\<^sub>\\n\" for x\n using in_add_del[OF \\x\\7+\\<^sub>\\n\\] by simp\n moreover\n {\n fix x\n assume asm:\"x\\7+\\<^sub>\\n\" \"x\\?A\" \"x\\weak(n,7)\"\n then\n have \"x\\domain(sep_var(n))\"\n proof -\n from \\n\\nat\\\n have \"weak(n,7)-weak(n,5)\\{n+\\<^sub>\\5,n+\\<^sub>\\6}\"\n using weakening_diff by simp\n with \\x\\?A\\ asm\n have \"x\\{n+\\<^sub>\\5,n+\\<^sub>\\6}\" using subsetD DiffI by blast\n then\n show ?thesis unfolding sep_var_def by simp\n qed\n }\n moreover\n {\n fix x\n assume asm:\"x\\7+\\<^sub>\\n\" \"x\\?A\" \"x<7\"\n then have \"x\\domain(sep_var(n))\"\n proof (cases \"2 \\ n\")\n case True\n moreover\n have \"0n\\nat\\ \\2\\n\\] lt_imp_0_lt by auto\n ultimately\n have \"x<5\"\n using \\x<7\\ \\x\\?A\\ \\n\\nat\\ in_n_in_nat\n unfolding weak_def\n by (clarsimp simp add:not_lt_iff_le, auto simp add:lt_def)\n then\n show ?thesis unfolding sep_var_def\n by (clarsimp simp add:not_lt_iff_le, auto simp add:lt_def)\n next\n case False\n then\n show ?thesis\n proof (cases \"n=0\")\n case True\n then show ?thesis\n unfolding sep_var_def using ltD asm \\n\\nat\\ by auto\n next\n case False\n then\n have \"n < 2\" using \\n\\nat\\ not_lt_iff_le \\\\ 2 \\ n\\ by force\n then\n have \"\\ n <1\" using \\n\\0\\ by simp\n then\n have \"n=1\" using not_lt_iff_le \\n<2\\ le_iff by auto\n then show ?thesis\n using \\x\\?A\\\n unfolding weak_def sep_var_def\n using ltD asm \\n\\nat\\ by force\n qed\n qed\n }\n ultimately\n have \"w\\domain(sep_var(n))\" if \"w\\ 7+\\<^sub>\\n - ?A\" for w\n using that by blast\n then\n have \"7+\\<^sub>\\n - ?A \\ domain(sep_var(n))\" by blast\n with F\n show ?thesis by auto\nqed\n\nlemma sep_var_type :\n assumes \"n \\ nat\"\n shows \"sep_var(n) : (7+\\<^sub>\\n)-weak(n,5) \\ 7+\\<^sub>\\n\"\n using FiniteFun_is_fun[OF sep_var_fin_type[OF \\n\\nat\\]]\n sep_var_domain[OF \\n\\nat\\] by simp\n\nlemma sep_var_action :\n assumes\n \"[t,p,u,P,leq,o,pi] \\ list(M)\"\n \"env \\ list(M)\"\n shows \"\\ i . i \\ (7+\\<^sub>\\length(env)) - weak(length(env),5) \\\n nth(sep_var(length(env))`i,[t,p,u,P,leq,o,pi]@env) = nth(i,[p,P,leq,o,t] @ env @ [pi,u])\"\n using assms\nproof (subst sep_var_domain[OF length_type[OF \\env\\list(M)\\],symmetric],auto)\n fix i y\n assume \"\\i, y\\ \\ sep_var(length(env))\"\n with assms\n show \"nth(sep_var(length(env)) ` i,\n Cons(t, Cons(p, Cons(u, Cons(P, Cons(leq, Cons(o, Cons(pi, env)))))))) =\n nth(i, Cons(p, Cons(P, Cons(leq, Cons(o, Cons(t, env @ [pi, u]))))))\"\n using apply_fun[OF sep_var_type] assms\n unfolding sep_var_def\n using nth_concat2[OF \\env\\list(M)\\] nth_concat3[OF \\env\\list(M)\\,symmetric]\n by force\nqed\n\ndefinition\n rensep :: \"i \\ i\" where\n \"rensep(n) \\ union_fun(sep_var(n),sep_env(n),7+\\<^sub>\\n-weak(n,5),weak(n,5))\"\n\nlemma rensep_aux :\n assumes \"n\\nat\"\n shows \"(7+\\<^sub>\\n-weak(n,5)) \\ weak(n,5) = 7+\\<^sub>\\n\" \"7+\\<^sub>\\n \\ ( 7 +\\<^sub>\\ n - 7) = 7+\\<^sub>\\n\"\nproof -\n from \\n\\nat\\\n have \"weak(n,5) = n+\\<^sub>\\5-5\"\n using weak_equal by simp\n with \\n\\nat\\\n show \"(7+\\<^sub>\\n-weak(n,5)) \\ weak(n,5) = 7+\\<^sub>\\n\" \"7+\\<^sub>\\n \\ ( 7 +\\<^sub>\\ n - 7) = 7+\\<^sub>\\n\"\n using Diff_partition le_imp_subset by auto\nqed\n\nlemma rensep_type :\n assumes \"n\\nat\"\n shows \"rensep(n) \\ 7+\\<^sub>\\n \\ 7+\\<^sub>\\n\"\nproof -\n from \\n\\nat\\\n have \"rensep(n) \\ (7+\\<^sub>\\n-weak(n,5)) \\ weak(n,5) \\ 7+\\<^sub>\\n \\ (7+\\<^sub>\\n - 7)\"\n unfolding rensep_def\n using union_fun_type sep_var_type \\n\\nat\\ sep_env_type weak_equal\n by force\n then\n show ?thesis using rensep_aux \\n\\nat\\ by auto\nqed\n\nlemma rensep_action :\n assumes \"[t,p,u,P,leq,o,pi] @ env \\ list(M)\"\n shows \"\\ i . i < 7+\\<^sub>\\length(env) \\ nth(rensep(length(env))`i,[t,p,u,P,leq,o,pi]@env) = nth(i,[p,P,leq,o,t] @ env @ [pi,u])\"\nproof -\n let ?tgt=\"[t,p,u,P,leq,o,pi]@env\"\n let ?src=\"[p,P,leq,o,t] @ env @ [pi,u]\"\n let ?m=\"7 +\\<^sub>\\ length(env) - weak(length(env),5)\"\n let ?p=\"weak(length(env),5)\"\n let ?f=\"sep_var(length(env))\"\n let ?g=\"sep_env(length(env))\"\n let ?n=\"length(env)\"\n from assms\n have 1 : \"[t,p,u,P,leq,o,pi] \\ list(M)\" \" env \\ list(M)\"\n \"?src \\ list(M)\" \"?tgt \\ list(M)\"\n \"7+\\<^sub>\\?n = (7+\\<^sub>\\?n-weak(?n,5)) \\ weak(?n,5)\"\n \" length(?src) = (7+\\<^sub>\\?n-weak(?n,5)) \\ weak(?n,5)\"\n using Diff_partition le_imp_subset rensep_aux by auto\n then\n have \"nth(i, ?src) = nth(union_fun(?f, ?g, ?m, ?p) ` i, ?tgt)\" if \"i < 7+\\<^sub>\\length(env)\" for i\n proof -\n from \\i<7+\\<^sub>\\?n\\\n have \"i \\ (7+\\<^sub>\\?n-weak(?n,5)) \\ weak(?n,5)\"\n using ltD by simp\n then show ?thesis\n unfolding rensep_def using\n union_fun_action[OF \\?src\\list(M)\\ \\?tgt\\list(M)\\ \\length(?src) = (7+\\<^sub>\\?n-weak(?n,5)) \\ weak(?n,5)\\\n sep_var_action[OF \\[t,p,u,P,leq,o,pi] \\ list(M)\\ \\env\\list(M)\\]\n sep_env_action[OF \\[t,p,u,P,leq,o,pi] \\ list(M)\\ \\env\\list(M)\\]\n ] that\n by simp\n qed\n then show ?thesis unfolding rensep_def by simp\nqed\n\ndefinition sep_ren :: \"[i,i] \\ i\" where\n \"sep_ren(n,\\) \\ ren(\\)`(7+\\<^sub>\\n)`(7+\\<^sub>\\n)`rensep(n)\"\n\nlemma arity_rensep: assumes \"\\\\formula\" \"env \\ list(M)\"\n \"arity(\\) \\ 7+\\<^sub>\\length(env)\"\nshows \"arity(sep_ren(length(env),\\)) \\ 7+\\<^sub>\\length(env)\"\n unfolding sep_ren_def\n using arity_ren rensep_type assms\n by simp\n\nlemma type_rensep [TC]:\n assumes \"\\\\formula\" \"env\\list(M)\"\n shows \"sep_ren(length(env),\\) \\ formula\"\n unfolding sep_ren_def\n using ren_tc rensep_type assms\n by simp\n\nlemma sepren_action:\n assumes \"arity(\\) \\ 7 +\\<^sub>\\ length(env)\"\n \"[t,p,u,P,leq,o,pi] \\ list(M)\"\n \"env\\list(M)\"\n \"\\\\formula\"\n shows \"sats(M, sep_ren(length(env),\\),[t,p,u,P,leq,o,pi] @ env) \\ sats(M, \\,[p,P,leq,o,t] @ env @ [pi,u])\"\nproof -\n from assms\n have 1: \"[t, p, u, P, leq, o, pi] @ env \\ list(M)\"\n by simp_all\n then\n have 2: \"[p,P,leq,o,t] @ env @ [pi,u] \\ list(M)\"\n using app_type by simp\n show ?thesis\n unfolding sep_ren_def\n using sats_iff_sats_ren[OF \\\\\\formula\\\n add_type[of 7 \"length(env)\"]\n add_type[of 7 \"length(env)\"]\n 2 1\n rensep_type[OF length_type[OF \\env\\list(M)\\]]\n \\arity(\\) \\ 7 +\\<^sub>\\ length(env)\\]\n rensep_action[OF 1,rule_format,symmetric]\n by simp\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Independence_CH/Separation_Rename.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29674486675141715}} {"text": "\\<^marker>\\creator \"Alexander Krauss\"\\\n\\<^marker>\\creator \"Kevin Kappelmann\"\\\nsection \\Soft types for HOL\\\ntheory Soft_Types_HOL\n imports\n HOL.HOL\n Implicit_Arguments\n \"HOL-Eisbach.Eisbach\"\n keywords\n \"opaque\" :: thy_decl and\n \"soft_type_translation\" :: thy_goal_stmt and\n \"print_opaque_terms\" \"print_types\" :: diag\nbegin\n\ntext \\This theory introduces a generic notion of soft types based on HOL\npredicates. It contains the basic definitions and technical tool setup.\\\n\ntext \\Remove conflicting HOL-specific syntax.\\\n\nbundle HOL_ascii_syntax\nbegin\nnotation (ASCII)\n Not (\"~ _\" [40] 40) and\n conj (infixr \"&\" 35) and\n disj (infixr \"|\" 30) and\n implies (infixr \"-->\" 25) and\n not_equal (infixl \"~=\" 50)\nsyntax \"_Let\" :: \"[letbinds, 'a] \\ 'a\" (\"(let (_)/ in (_))\" 10)\nend\nbundle no_HOL_ascii_syntax\nbegin\nno_notation (ASCII)\n Not (\"~ _\" [40] 40) and\n conj (infixr \"&\" 35) and\n disj (infixr \"|\" 30) and\n implies (infixr \"-->\" 25) and\n not_equal (infixl \"~=\" 50)\nno_syntax \"_Let\" :: \"[letbinds, 'a] \\ 'a\" (\"(let (_)/ in (_))\" 10)\nend\n\nunbundle no_HOL_ascii_syntax\n\n\nsubsection \\Basic type judgments\\\n\ntext \\Soft types are \"just\" predicates wrapped up in a constructor.\\\n\ntypedecl 'a type\n\naxiomatization\n type :: \\('a \\ bool) \\ 'a type\\ and\n adj :: \\('a \\ bool) \\ 'a type \\ 'a type\\ and\n has_type :: \\'a \\ 'a type \\ bool\\\nwhere\n meaning_of_adj: \"has_type x (adj P T) \\ P x \\ has_type x T\" and\n meaning_of_type: \"has_type x (type P) \\ P x\"\n\nbundle soft_type_base_syntax\nbegin notation adj (infixr \"\\\" \\\\\\\\ 56) and has_type (infix \":\" 45) end\nbundle no_soft_type_base_syntax\nbegin no_notation adj (infixr \"\\\" \\\\\\\\ 56) and has_type (infix \":\" 45) end\n\nunbundle soft_type_base_syntax\n\nabbreviation (input) \"type_pred T x \\ x : T\"\n\nlemma has_typeI: \"P x \\ x : type P\"\n unfolding meaning_of_type by assumption\n\nlemma has_typeD: \"x : type P \\ P x\"\n unfolding meaning_of_type by assumption\n\nlemma has_typeE:\n assumes \"x : type P\"\n obtains \"P x\"\n using assms unfolding meaning_of_type by auto\n\nlemma has_adjI: \"\\P x; x : T\\ \\ x : P \\ T\"\n unfolding meaning_of_adj by auto\n\nlemma\n has_adjD1: \"x : P \\ T \\ P x\" and\n has_adjD2: \"x : P \\ T \\ x : T\"\n unfolding meaning_of_adj by auto\n\nlemma has_adjE:\n \"\\x: P \\ T; \\P x; x : T\\ \\ Q\\ \\ Q\"\n unfolding meaning_of_adj by auto\n\n\nsubsection \\Type-Bounded quantifiers\\\n\ndefinition tball :: \"'a type \\ ('a \\ bool) \\ bool\"\n where \"tball A P \\ (\\x. x : A \\ P x)\"\n\ndefinition tbex :: \"'a type \\ ('a \\ bool) \\ bool\"\n where \"tbex A P \\ (\\x. x : A \\ P x)\"\n\nbundle soft_types_bounded_quantifiers_syntax\nbegin\nsyntax\n \"_tball\" :: \\[idts, 'a type, bool] \\ bool\\ (\"(2\\_ : _./ _)\" 10)\n \"_tball2\" :: \\[idts, 'a type, bool] \\ bool\\\n \"_tbex\" :: \\[idts, 'a type, bool] \\ bool\\ (\"(2\\_ : _./ _)\" 10)\n \"_tbex2\" :: \\[idts, 'a type, bool] \\ bool\\\nend\nbundle no_soft_types_bounded_quantifiers_syntax\nbegin\nno_syntax\n \"_tball\" :: \\[idts, 'a type, bool] \\ bool\\ (\"(2\\_ : _./ _)\" 10)\n \"_tball2\" :: \\[idts, 'a type, bool] \\ bool\\\n \"_tbex\" :: \\[idts, 'a type, bool] \\ bool\\ (\"(2\\_ : _./ _)\" 10)\n \"_tbex2\" :: \\[idts, 'a type, bool] \\ bool\\\nend\nunbundle soft_types_bounded_quantifiers_syntax\n\ntranslations\n \"\\x xs : A. P\" \\ \"CONST tball A (\\x. _tball2 xs A P)\"\n \"_tball2 x A P\" \\ \"\\x : A. P\"\n \"\\x : A. P\" \\ \"CONST tball A (\\x. P)\"\n\n \"\\x xs : A. P\" \\ \"CONST tbex A (\\x. _tbex2 xs A P)\"\n \"_tbex2 x A P\" \\ \"\\x : A. P\"\n \"\\x : A. P\" \\ \"CONST tbex A (\\x. P)\"\n\n\ntext\\Setup of one point rules.\\\n\nsimproc_setup defined_bex (\"\\x : A. P x \\ Q x\") =\n \\fn _ => Quantifier1.rearrange_Bex\n (fn ctxt => unfold_tac ctxt @{thms tbex_def})\\\n\nsimproc_setup defined_ball (\"\\x : A. P x \\ Q x\") =\n \\fn _ => Quantifier1.rearrange_Ball\n (fn ctxt => unfold_tac ctxt @{thms tball_def})\\\n\nlemma tballI [intro!]: \"(\\x. x : A \\ P x) \\ \\x : A. P x\"\n unfolding tball_def by auto\n\nlemma tballE [elim!]:\n assumes \"\\x : A. P x\"\n obtains \"\\x. x : A \\ P x\"\n using assms unfolding tball_def by auto\n\nlemma tballD [elim]: \"\\\\x : A. P x; x : A\\ \\ P x\"\n unfolding tball_def by auto\n\nlemma tball_iff_ex_has_type [simp]: \"(\\x : A. P) \\ ((\\x. x : A) \\ P)\"\n by (simp add: tball_def)\n\nlemma tball_cong [cong]:\n \"\\A = A'; \\x. x : A' \\ P x \\ P' x\\ \\ (\\x : A. P x) \\ (\\x : A'. P' x)\"\n by (simp add: tball_def)\n\nlemma tball_or_iff_tball_or [simp]: \"(\\x : A. P x \\ Q) \\ ((\\x : A. P x) \\ Q)\"\n by auto\n\nlemma tball_or_iff_or_tball [simp]: \"(\\x : A. P \\ Q x) \\ (P \\ (\\x : A. Q x))\"\n by auto\n\nlemma tball_imp_iff_imp_tball [simp]: \"(\\x : A. P \\ Q x) \\ (P \\ (\\x : A. Q x))\"\n by auto\n\nlemma atomize_tball: \"(\\x. x : A \\ P x) \\ Trueprop (\\x : A. P x)\"\n by (simp only: tball_def atomize_all atomize_imp)\n\ndeclare atomize_tball[symmetric, rulify]\ndeclare atomize_tball[symmetric, defn]\n\nlemma tbexI [intro]: \"\\x : A; P x\\ \\ \\x : A. P x\"\n unfolding tbex_def by auto\n\nlemma tbexE [elim!]:\n assumes \"\\x : A. P x\"\n obtains x where \"x : A\" and \"P x\"\n using assms unfolding tbex_def by auto\n\nlemma tbex_iff_ex_and [simp]: \"(\\x : A. P) \\ ((\\x. x : A) \\ P)\"\n unfolding tbex_def by simp\n\nlemma tbex_cong [cong]:\n \"\\A = A'; \\x. x : A' \\ P x \\ P' x\\ \\ (\\x : A. P x) \\ (\\x : A'. P' x)\"\n unfolding tbex_def by (simp cong: conj_cong)\n\nlemma tbex_and_iff_tbex_and [simp]: \"(\\x : A. P x \\ Q) \\ ((\\x : A. P x) \\ Q)\"\n by auto\n\nlemma tbex_and_iff_or_tbex [simp]: \"(\\x : A. P \\ Q x) \\ (P \\ (\\x : A. Q x))\"\n by auto\n\nlemma tball_imp_iff_tbex_imp [simp]: \"(\\x : A. P x \\ Q) \\ ((\\x : A. P x) \\ Q)\"\n by auto\n\nlemma not_tball_iff_tbex_not [simp]: \"(\\(\\x : A. P x)) \\ (\\x : A. \\P x)\"\n by auto\n\nlemma not_tbex_iff_tball_not [simp]: \"(\\(\\x : A. P x)) \\ (\\x : A. \\P x)\"\n by auto\n\n\nsubsection \\Low-level soft type methods\\\n\n(*FUTURE: Dedicated keyword setup for soft type declarations should go here*)\n\ntext \\Unfold all type information to work only in the underlying theory:\\\n\nnamed_theorems typedef \\\\soft type definitions\\\nnamed_theorems type_intro \\\\soft type introduction rules\\\n (*FUTURE: This should be kept for typechecking, so only introduction rules\n whose premises and conclusion are type judgments should be declared*)\n\nmethod unfold_types =\n (rule type_intro\n |simp_all only: typedef meaning_of_type meaning_of_adj tball_def tbex_def)+\n\n\nsubsection \\Dependent Function/Pi-Types (\\-Types)\\\n\ntext \\Dependent function soft type for HOL lambda terms.\\\n\ndefinition Dep_fun_type :: \"'a type \\ ('a \\ 'b type) \\ ('a \\ 'b) type\"\n where [typedef]: \"Dep_fun_type A B \\ type (\\f. \\x : A. f x : B x)\"\n\nabbreviation \"Fun_type A B \\ Dep_fun_type A (\\_. B)\"\n\nbundle soft_types_functions_syntax\nbegin\nsyntax\n \"_functions_telescope\" :: \"logic \\ logic \\ logic\" (infixr \"\\\" 50)\nend\nbundle no_soft_types_functions_syntax\nbegin\nno_syntax\n \"_functions_telescope\" :: \"logic \\ logic \\ logic\" (infixr \"\\\" 50)\nend\nunbundle soft_types_functions_syntax\n\ntranslations\n \"(x y : A) \\ B\" \\ \"(x : A)(y : A) \\ B\"\n \"(x : A) args \\ B\" \\ \"(x : A) \\ args \\ B\"\n \"(x : A) \\ B\" \\ \"CONST Dep_fun_type A (\\x. B)\"\n \"A \\ B\" \\ \"CONST Fun_type A B\"\n\nlemma Dep_fun_typeI [type_intro]:\n \"(\\x. x : A \\ f x : B x) \\ f : (x : A) \\ B x\"\n unfolding Dep_fun_type_def meaning_of_type by auto\n\nlemma Dep_fun_typeE:\n \"\\f : (x : A) \\ B x; x : A\\ \\ f x : B x\"\n unfolding Dep_fun_type_def meaning_of_type by auto\n\nlemma Dep_fun_contravariant_dom:\n \"\\f : (x : A) \\ B x; \\x. x : A' \\ x : A\\ \\ f : (x : A') \\ B x\"\n unfolding Dep_fun_type_def meaning_of_type by auto\n\nlemma Dep_fun_covariant_codom:\n assumes \"f : (x : A) \\ B x\"\n and \"\\x. x : A \\ f x : B x \\ f x : B' x\"\n shows \"f : (x : A) \\ B' x\"\n using assms unfolding Dep_fun_type_def meaning_of_type by auto\n\n\nsubsection \\Intersection and Union Types\\\n\ndefinition [typedef]: \"Int_type A B \\ type (\\x. x : A \\ x : B)\"\n\nbundle soft_type_Int_type_syntax\nbegin notation Int_type (infixl \"&\" 55) end\nbundle no_soft_type_Int_type_syntax\nbegin no_notation Int_type (infixl \"&\" 55) end\n\nunbundle soft_type_Int_type_syntax\n\nlemma\n Int_typeI [type_intro]: \"x : A \\ x : B \\ x : A & B\" and\n Int_typeD1: \"x : A & B \\ x : A\" and\n Int_typeD2: \"x : A & B \\ x : B\" and\n Int_type_covariant_left: \"x : A & B \\ (x : A \\ x : A') \\ x : A' & B\" and\n Int_type_covariant_right: \"x : A & B \\ (x : B \\ x : B') \\ x : A & B'\"\n by unfold_types\n\nlemma Int_typeE:\n assumes \"x : A & B\"\n obtains \"x : A\" \"x : B\"\n using assms unfolding Int_type_def by unfold_types\n\ndefinition [typedef]: \"Union_type A B \\ type (\\x. x : A \\ x : B)\"\n\nbundle soft_type_Union_type_syntax\nbegin notation Union_type (infixl \"\\\" 55) end\nbundle no_soft_type_Union_type_syntax\nbegin no_notation Union_type (infixl \"\\\" 55) end\n\nunbundle soft_type_Union_type_syntax\n\nlemma\n Union_type_leftI: \"x : A \\ x : A \\ B\" and\n Union_type_rightI: \"x : B \\ x : A \\ B\" and\n Union_typeD: \"x : A \\ B \\ x : A \\ x : B\" and\n Union_type_covariant_left: \"x : A \\ B \\ (x : A \\ x : A') \\ x : A' \\ B\" and\n Union_type_covariant_right: \"x : A \\ B \\ (x : B \\ x : B') \\ x : A \\ B'\"\n by unfold_types auto\n\nlemma Union_typeE:\n assumes \"x : A \\ B\"\n obtains (left) \"x : A\" | (right) \"x : B\"\n using assms by (auto dest: Union_typeD)\n\nsubsection \\The Any type\\\n\ntext \\Used, for example, to reflect rigid types back into the soft type system.\\\n\ndefinition Any_type :: \"'a type\" (\"Any\")\n where [typedef]: \"Any \\ type (\\_. True)\"\n\nlemma Any_typeI [type_intro]: \"x : Any\"\n by unfold_types\n\nabbreviation Bool_type :: \"bool type\" (\"Bool\")\n where \"Bool \\ Any\"\n\nlemma tball_Any_iff_ball [simp]: \"(\\x : Any. P x) \\ (\\x. P x)\"\n by (auto intro: Any_typeI)\n\nlemma tbex_Any_iff_ex [simp]: \"(\\x : Any. P x) \\ (\\x. P x)\"\n by (auto intro: Any_typeI)\n\n\nsubsection \\Type annotations\\\n\ndefinition with_type :: \"'a \\ 'a type \\ 'a\"\n where \"with_type x A \\ x\"\n\nbundle soft_type_with_type_syntax\nbegin notation with_type (infixl \":>\" 50) end\nbundle no_soft_type_with_type_syntax\nbegin no_notation with_type (infixl \":>\" 50) end\n\nunbundle soft_type_with_type_syntax\n\ntext \\\n\\<^term>\\x :> A\\ annotates \\<^term>\\x\\ with type \\<^term>\\A\\, and is used by automated\ntools to represent additional typing information in a term.\n\\\n\n\nsubsection \\Tooling and automation\\\n\ndeclare atomize_conjL [symmetric, rulify]\n \\\\Used in normalization of type judgments.\\\n\nnamed_theorems type_simp \\\\For type elaboration\\\nnamed_theorems type_instance \\\\For type class reasoning\\\n\n\nnamed_theorems derivation_rules\nnamed_theorems backderivation_rules\n(* named_theorems subtype_rules *) \\\\Unused, for now\\\n\ntext \\\n@{thm derivation_rules}, @{thm backderivation_rules} \\(*and @{thm subtype_rules}*)\\\nshould only be inspected and not assigned to directly; use the \\derive\\,\n\\backward_derive\\ \\(*and \\subtype\\*)\\ attributes instead.\n\\\n\n(* Enable this when debugging exceptions:\ndeclare [[ML_debugger, ML_exception_debugger]]\n*)\n\nML_file \\soft_type.ML\\\nML_file \\soft_type_context.ML\\\nML_file \\derivation.ML\\\n\nsubsubsection \\Type derivation\\\n\nmethod_setup raw_discharge_type =\n \\Scan.optional (Scan.lift (Args.add -- Args.colon) |-- Scan.repeat Args.term) []\n >> (fn add_tms => fn ctxt => SIMPLE_METHOD (\n HEADGOAL (Derivation.raw_discharge_type_tac [] add_tms ctxt)))\\\n\nmethod_setup discharge_types =\n \\Scan.optional (Scan.lift (Args.add -- Args.colon) |-- Scan.repeat Args.term) []\n >> (fn add_tms => fn ctxt => SIMPLE_METHOD (\n REPEAT1 (CHANGED (ALLGOALS (TRY o (\n Derivation.full_discharge_types_tac [] add_tms ctxt))))))\\\n\nML \\\nval soft_type_simp_solver =\n let\n fun solver ctxt i =\n (if Config.get ctxt Derivation.debug\n then print_tac ctxt (\"type derivation called on subgoal \" ^ string_of_int i)\n else all_tac)\n THEN\n (SUBGOAL (fn (_, j) =>\n Derivation.full_discharge_types_tac (Simplifier.prems_of ctxt) [] ctxt j)) i\n in\n map_theory_simpset (fn ctxt => ctxt\n addSolver (mk_solver \"discharge_types\" solver))\n end\n\\\n\nsetup \\soft_type_simp_solver\\\n\nML_file \\unification.ML\\\nML_file \\type_classes.ML\\\nML_file \\elaboration.ML\\\nML_file \\isar_integration.ML\\\n\nsetup \\Isar_Integration.setup\\\n\ndeclare with_type_def [type_simp]\n\n\nsubsection \\Basic declarations\\\n\ndeclare Any_typeI [type]\ndeclare Dep_fun_typeI [backward_derive]\ndeclare Dep_fun_typeE [derive]\n\nlemma eq_type [type]: \"(=) : A \\ A \\ Bool\"\n by discharge_types\n\nlemma imp_type [type]: \"(\\) : Bool \\ Bool \\ Bool\"\n by discharge_types\n\nlemma const_fun_type [derive]: \"c : C \\ (\\a. c) : A \\ C\"\n by discharge_types\n\nlemma id_type [type]: \"(\\x. x) : A \\ A\"\n by discharge_types\n\nlemma if_type [type]: \"If : Bool \\ A \\ A \\ A\"\n by unfold_types auto\n\n\nend\n", "meta": {"author": "kappelmann", "repo": "Isabelle-Set", "sha": "2ac3e1cb6bf847d413f06978b7c82e4d0c103477", "save_path": "github-repos/isabelle/kappelmann-Isabelle-Set", "path": "github-repos/isabelle/kappelmann-Isabelle-Set/Isabelle-Set-2ac3e1cb6bf847d413f06978b7c82e4d0c103477/Soft_Types/Soft_Types_HOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.29674486675141715}} {"text": "theory WordArrayMono\n imports \n WordArrayValue\n Cogent.Mono\n MonoHelper\nbegin\n\nsection \"Word Array Methods\"\n\nsubsection \"wordarray_length\"\n\nlemma (in WordArrayValue) vwa_length_monoexpr_correct:\n \"\\v v'.\n vwa_length (rename_val rename' (monoval v)) v'\n \\ \\v''. v' = rename_val rename' (monoval v'') \\ vwa_length v v''\"\n apply (clarsimp simp: vwa_length_def)\n apply (case_tac v; clarsimp)\n done\n\nsubsection \"wordarray_get\"\n\nlemma (in WordArrayValue) vwa_get_monoexpr_correct:\n \"\\v v'.\n vwa_get (rename_val rename' (monoval v)) v'\n \\ \\v''. v' = rename_val rename' (monoval v'') \\ vwa_get v v''\"\n apply (clarsimp simp: vwa_get_def)\n apply (case_tac v; clarsimp)\n apply (rename_tac z za zb)\n apply (case_tac z; clarsimp)\n apply (case_tac za; clarsimp)\n apply (clarsimp split: if_splits)\n apply (rule_tac x = \"xs ! unat i\" in exI)\n apply (clarsimp simp: no_vfuns_rename_monoval)\n apply fastforce\n apply (rule_tac x = zb in exI)\n apply (clarsimp simp: no_vfuns_rename_monoval)\n apply (rule exI, rule exI, rule_tac x = i in exI, intro exI conjI impI; simp?)\n apply (clarsimp simp: rename_monoval_no_vfuns)\n done\n\nsubsection \"wordarray_put\"\n\nlemma (in WordArrayValue) vwa_put_monoexpr_correct:\n \"\\v v'.\n vwa_put (rename_val rename' (monoval v)) v'\n \\ \\v''. v' = rename_val rename' (monoval v'') \\ vwa_put v v''\"\n apply (clarsimp simp: vwa_put_def)\n apply (case_tac v; clarsimp)\n apply (rename_tac z za zb)\n apply (case_tac z; clarsimp)\n apply (case_tac za; clarsimp)\n apply (clarsimp simp: rename_monoval_no_vfuns[THEN no_vfuns_rename_monoval] rename_monoval_no_vfuns)\n done\n\nsubsection \"wordarray_get_opt\"\n\nlemma (in WordArrayValue) vwa_get_opt_monoexpr_correct:\n \"\\v v'.\n vwa_get_opt (rename_val rename' (monoval v)) v'\n \\ \\v''. v' = rename_val rename' (monoval v'') \\ vwa_get_opt v v''\"\n apply (clarsimp simp: vwa_get_opt_def)\n apply (case_tac v; clarsimp)\n apply (rename_tac v' t xs i z za)\n apply (case_tac z; clarsimp)\n apply (case_tac za; clarsimp)\n apply (clarsimp split: if_splits)\n apply (rule_tac x = \" VSum ''Something'' (xs ! unat i)\" in exI)\n apply (clarsimp simp: no_vfuns_rename_monoval)\n apply fastforce\n apply (rule_tac x = \"VSum ''Nothing'' VUnit\" in exI)\n apply (clarsimp simp: no_vfuns_rename_monoval)\n apply (rule exI, rule exI, rule_tac x = i in exI, intro exI conjI impI; simp?)\n done\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/WordArrayMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2967118427008688}} {"text": "theory Impl_List_Playground_ChairNetwork\nimports \"../TopoS_Impl\"\nbegin\n\n\ntext\\An example of our chair network [simplified]\\\n\ntext\\Our access control view on the network\\\n definition ChairNetwork_empty :: \"string list_graph\" where\n \"ChairNetwork_empty \\ \\ nodesL = [''WebSrv'', ''FilesSrv'', ''PrinterBW'',\n ''PrinterColor'', ''Students'',\n ''Employees'', ''EReachable'',\n ''Internet''],\n edgesL = [] \\\"\n \n lemma \"wf_list_graph ChairNetwork_empty\" by eval\n\n\nsubsection\\Our security requirements\\\n subsubsection\\We have a server with confidential data\\\n definition ConfidentialChairData::\"(string SecurityInvariant)\" where\n \"ConfidentialChairData \\ new_configured_list_SecurityInvariant SINVAR_BLPtrusted_impl.SINVAR_LIB_BLPtrusted \\ \n node_properties = [''FilesSrv'' \\ \\ security_level = 1, trusted = False \\,\n ''Employees'' \\ \\ security_level = 0, trusted = True \\,\n ''EReachable'' \\ \\ security_level = 0, trusted = True \\]\n \\ ''confidential data''\"\n\n\n (*\n subsubsection{*We have a hierarchical printing policy*}\n definition \"PrintingHierarchy_nodes=[''Employees''\\ DN (''ColorPrinting''--Leaf, 0),\n ''PrinterColor''\\ DN (''ColorPrinting''--''Printer''--Leaf, 0),\n ''Students''\\ DN (''ColorPrinting''--''BwPrinting''--Leaf, 0),\n ''PrinterBW''\\ DN (''ColorPrinting''--''BwPrinting''--''Printer''--Leaf, 0)]\"\n definition \"PrintingHierarchy_tree=Department ''ColorPrinting'' [\n Department ''Printer'' [], \n Department ''BwPrinting'' [\n Department ''Printer'' []]]\"\n definition PrintingHierarchy::\"string SecurityInvariant\" where\n \"PrintingHierarchy \\ new_configured_list_SecurityInvariant SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\ \n node_properties = PrintingHierarchy_nodes\n \\\" *)\n subsubsection\\The color printer is only accessibly by employees, The black.white printer by employees and students\\\n definition \"PrintingACL \\ new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\ \n node_properties = [''PrinterColor'' \\ Master [''Employees'', ''EReachable''],\n ''PrinterBW'' \\ Master [''Employees'', ''EReachable'', ''Students''],\n ''Employees'' \\ Care,\n ''EReachable'' \\ Care,\n ''Students'' \\ Care]\n \\ ''printing ACL''\"\n\n subsubsection\\Printers are information sinks\\\n definition \"PrintingSink \\ new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\ \n node_properties = [''PrinterColor'' \\ Sink,\n ''PrinterBW'' \\ Sink]\n \\ ''printing sink''\"\n\n\n\n subsubsection\\Students may access each other but are not accessible from the outside\\\n definition \"StudentSubnet \\ new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\ \n node_properties = [''Students'' \\ Member, ''Employees'' \\ Member, ''EReachable'' \\ InboundGateway]\n \\ ''student subnet''\"\n\n\n subsubsection\\The files server is only accessibly by employees\\\n definition \"FilesSrvACL \\ new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\ \n node_properties = [''FilesSrv'' \\ Master [''Employees'', ''EReachable''],\n ''Employees'' \\ Care,\n ''EReachable'' \\ Care]\n \\ ''file srv acl''\"\n\n\n subsubsection\\emplyees are reachable from the Internet\\\n (*nothing to do here*)\n\nlemma \"implc_sinvar ConfidentialChairData ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingACL ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingSink ChairNetwork_empty\" by eval\nlemma \"implc_sinvar StudentSubnet ChairNetwork_empty\" by eval\nlemma \"implc_sinvar FilesSrvACL ChairNetwork_empty\" by eval\n\ndefinition \"ChairSecurityRequirements = [ConfidentialChairData, PrintingACL, PrintingSink, StudentSubnet, FilesSrvACL]\"\n\nvalue \"implc_get_offending_flows ChairSecurityRequirements ChairNetwork_empty\"\nvalue \"generate_valid_topology ChairSecurityRequirements ChairNetwork_empty\"\n\nvalue \"List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty)\"\n\ndefinition \"ChairNetwork = generate_valid_topology ChairSecurityRequirements \n \\nodesL = nodesL ChairNetwork_empty, edgesL = List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty) \\\"\n\nlemma \"all_security_requirements_fulfilled ChairSecurityRequirements ChairNetwork\" by eval\n\nvalue \"ChairNetwork\"\n\nML_val\\\nvisualize_graph @{context} @{term \"ChairSecurityRequirements\"} @{term \"ChairNetwork\"};\n\\\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Examples/Impl_List_Playground_ChairNetwork.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.29671183576223376}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory longlong\nimports \"CParser.CTranslation\"\nbegin\n\nexternal_file \"longlong.c\"\ninstall_C_file \"longlong.c\"\n\nML \\NameGeneration.return_var_name (Absyn.Signed Absyn.LongLong)\\\n\ncontext longlong\nbegin\n\nthm f_body_def\nthm shifts1_body_def\nthm shifts2_body_def\n\nlemma \"(ucast :: 16 word \\ 8 word) 32768 = 0\"\n by simp\n\nlemma \"(scast :: 16 word \\ 8 word) 32768 = 0\"\n by simp\n\nlemma \"(scast :: 16 word \\ 8 word) 65535 = 255\"\n by simp\n\nlemma \"(ucast :: 16 word \\ 8 word) 65535 = 255\"\n by simp\n\nlemma \"(ucast :: 16 word \\ 8 word) 32767 = 255\" by simp\nlemma \"(scast :: 16 word \\ 8 word) 32767 = 255\" by simp\n\nlemma \"(scast :: 8 word \\ 16 word) 255 = 65535\" by simp\nlemma \"(ucast :: 8 word \\ 16 word) 255 = 255\" by simp\n\nlemma g_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL callg() \\ \\ret__int = 0 \\\"\n by vcg (simp add: mask_def)\n\nthm literals_body_def\n\nlemma literals_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL literals() \\ \\ret__int = 31 \\\"\n by vcg simp\n\nend (* context *)\n\nend (* theory *)\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/testfiles/longlong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.2966962823991477}} {"text": "theory Test_Asm_Sem\nimports\n Lense_Knowledge_Base\n \"HOL-Word.Word\"\n \"More_Eisbach_Tools\"\n Abstract_System\n \"HOL-Library.Rewrite\"\nbegin\n\n section \\Syntax\\\n\n type_synonym val64 = \"64 word\"\n (*type_synonym byte = \"8 word\"*)\n\n datatype rname = RAX_REG | RBX_REG | RCX_REG | RDX_REG | RIP_REG\n datatype fname = Z_FLAG\n\n datatype instr =\n LOAD rname rname (* LOAD dst:reg src:reg dst = [src] *)\n | STORE rname rname (* STORE dst:reg src:reg [dst] = src *)\n | LOADI rname val64\n | MOV rname rname\n | ADD rname rname rname\n | CMP rname rname\n | JMP val64\n | JE val64\n | HLT (* Defined termination of program *)\n\n section \\Semantics\\\n\n\n datatype state = STATE\n (regs: \"rname \\ val64\")\n (mem: \"val64 \\ val64\")\n (flags: \"fname \\ bool\")\n (instrs: \"instr list\")\n (halted: bool)\n\n define_lenses state\n\n lemma pre_state_lenses[simp]:\n \"pre_get regs\\<^sub>L s\"\n \"pre_get mem\\<^sub>L s\"\n \"pre_get flags\\<^sub>L s\"\n \"pre_get instrs\\<^sub>L s\"\n \"pre_get halted\\<^sub>L s\"\n unfolding regs\\<^sub>L_def mem\\<^sub>L_def flags\\<^sub>L_def instrs\\<^sub>L_def halted\\<^sub>L_def\n by (auto split: state.splits)\n\n lemma state\\<^sub>L_indeps[simp]:\n \"regs\\<^sub>L \\ mem\\<^sub>L\"\n \"regs\\<^sub>L \\ flags\\<^sub>L\"\n \"regs\\<^sub>L \\ instrs\\<^sub>L\"\n \"regs\\<^sub>L \\ halted\\<^sub>L\"\n\n \"mem\\<^sub>L \\ flags\\<^sub>L\"\n \"mem\\<^sub>L \\ instrs\\<^sub>L\"\n \"mem\\<^sub>L \\ halted\\<^sub>L\"\n\n \"flags\\<^sub>L \\ instrs\\<^sub>L\"\n \"flags\\<^sub>L \\ halted\\<^sub>L\"\n\n \"instrs\\<^sub>L \\ halted\\<^sub>L\"\n by (unfold_locales; unfold regs\\<^sub>L_def mem\\<^sub>L_def flags\\<^sub>L_def instrs\\<^sub>L_def halted\\<^sub>L_def; auto split: state.split)+\n\n lemmas [simp] = state\\<^sub>L_indeps[THEN lens_indep_sym]\n\n\n\n definition \"reg\\<^sub>L r \\ regs\\<^sub>L (r)\\<^sub>L\" (* TODO: Attribute [lens] to auto-prove and register \"lens x\" lemma! *)\n definition \"flag\\<^sub>L r \\ flags\\<^sub>L (r)\\<^sub>L\"\n\n lemma lens_reg\\<^sub>L[simp]: \"hlens (reg\\<^sub>L r)\" by (simp add: reg\\<^sub>L_def)\n lemma pre_reg\\<^sub>L[simp]: \"pre_get (reg\\<^sub>L r) s\" by (simp add: reg\\<^sub>L_def)\n lemma lens_flag\\<^sub>L[simp]: \"hlens (flag\\<^sub>L r)\" by (simp add: flag\\<^sub>L_def)\n lemma pre_flag\\<^sub>L[simp]: \"pre_get (flag\\<^sub>L r) s\" by (simp add: flag\\<^sub>L_def)\n\n fun exec_instr :: \"instr \\ (unit, state) se\" where\n \"exec_instr (LOAD dst src) = doE {\n addr \\ use (reg\\<^sub>L src);\n val \\ use (mem\\<^sub>L (addr)\\<^sub>L);\n reg\\<^sub>L dst ::= val\n }\"\n | \"exec_instr (STORE dst src) = doE {\n addr \\ use (reg\\<^sub>L dst);\n val \\ use (reg\\<^sub>L src);\n mem\\<^sub>L (addr)\\<^sub>L ::= val\n }\"\n | \"exec_instr (LOADI dst val) = doE {\n reg\\<^sub>L dst ::= val\n }\"\n | \"exec_instr (MOV dst src) = doE {\n reg\\<^sub>L dst ::^= use (reg\\<^sub>L src)\n }\"\n | \"exec_instr (ADD dst src1 src2) = doE {\n v1 \\ use (reg\\<^sub>L src1);\n v2 \\ use (reg\\<^sub>L src2);\n let v = v1+v2;\n reg\\<^sub>L dst ::= v;\n flag\\<^sub>L Z_FLAG ::= (v=0)\n }\"\n | \"exec_instr (CMP src1 src2) = doE {\n v1 \\ use (reg\\<^sub>L src1);\n v2 \\ use (reg\\<^sub>L src2);\n flag\\<^sub>L Z_FLAG ::= (v1 = v2)\n }\"\n | \"exec_instr (JMP tgt) = doE {\n reg\\<^sub>L RIP_REG ::= tgt\n }\"\n | \"exec_instr (JE tgt) = doE {\n zf \\ use (flag\\<^sub>L Z_FLAG);\n if zf then\n reg\\<^sub>L RIP_REG ::= tgt\n else sreturn ()\n }\"\n | \"exec_instr HLT = doE { halted\\<^sub>L ::= True }\"\n\n\n definition \"fetch_instr \\ doE {\n ip \\ use (reg\\<^sub>L RIP_REG);\n use (instrs\\<^sub>L[unat ip]\\<^sub>L)\n }\"\n\n definition step :: \"(unit, state) se\" where\n \"step \\ doE {\n instr \\ fetch_instr;\n reg\\<^sub>L RIP_REG %= op+1;\n exec_instr instr\n }\"\n\n\n global_interpretation det_system step halted\n defines yields = yields' .\n\n declare yields_unfold[code]\n\n definition \"execute \\ doE {\n s \\ sget;\n s \\ lift (yields s);\n case s of None \\ sfail | Some s \\ sput s\n }\"\n\n\n definition zero_state :: state where\n \"zero_state \\ (STATE\n (\\_. 0)\n (\\_. 0)\n (\\_. False)\n ([])\n False\n )\"\n\n\n section \\Execution Example\\\n\n\n definition \"pow_prog \\ [\n(*0*) LOADI RCX_REG 0,\n(*1*) LOADI RAX_REG 1,\n(*2*) LOADI RBX_REG 1,\n(*3*) CMP RCX_REG RDX_REG,\n(*4*) JE 8,\n(*5*) ADD RAX_REG RAX_REG RAX_REG,\n(*6*) ADD RCX_REG RCX_REG RBX_REG,\n(*7*) JMP 3,\n(*8*) HLT\n(*9*)\n ]\"\n\n value \"(doE {\n reg\\<^sub>L RDX_REG ::= 5;\n instrs\\<^sub>L ::= pow_prog;\n execute;\n use (reg\\<^sub>L RAX_REG)\n })\n zero_state\"\n\n\n\nsection \\Verification\\\n\n\ndefinition wf_state :: \"state \\ bool\"\n where \"wf_state _ \\ True\" (* Can be used to add additional constraints to state *)\n\nlemma wf_state_weak_invar: \"is_weak_invar wf_state\"\n apply (rule is_weak_invarI)\n by (simp add: wf_state_def)\n\nhide_fact (open) wf_state_def (* Once wf_state is established as invariant,\n we should not need it any more! -- At least for now, when it is True.\n Thus, wf_state is just a dummy to show that additional invariant kbxfer works!\n*)\n\n\nlemma [DEL_KBXFER_simps]:\n assumes \"KBXFER R s s'\"\n shows\n \"wf_state s = DEL_TAG (wf_state s)\"\n by (auto simp: DEL_TAG_def)\n\n\ninterpretation std_invar_system step halted wf_state\n apply standard\n by (rule wf_state_weak_invar)\n\n\n\n\ndefinition \"location \\ get' (reg\\<^sub>L RIP_REG)\"\n\ninterpretation cfg_system step halted wf_state location by standard\n\ntype_synonym floyd_invar = \"val64 \\ (state \\ bool)\"\n\nthm floyd_invarI floyd_vcsI\n\n\n\nlemma reg\\<^sub>L_indep[simp]: \"r\\r' \\ reg\\<^sub>L r \\ reg\\<^sub>L r'\"\n unfolding reg\\<^sub>L_def\n by (simp add: lens_indep_left_comp)\n\nlemma flag\\<^sub>L_indep[simp]: \"r\\r' \\ flag\\<^sub>L r \\ flag\\<^sub>L r'\"\n unfolding flag\\<^sub>L_def\n by (simp add: lens_indep_left_comp)\n\nlemma flag_regL_indep[simp, THEN lens_indep_sym, simp]:\n \"flag\\<^sub>L f \\ reg\\<^sub>L r\"\n unfolding reg\\<^sub>L_def flag\\<^sub>L_def\n by (simp add: lens_indep_extend2)\n\nlemma flag\\<^sub>L_more_indep[simp, THEN lens_indep_sym, simp]:\n \"flag\\<^sub>L f \\ mem\\<^sub>L\"\n \"flag\\<^sub>L f \\ instrs\\<^sub>L\"\n \"flag\\<^sub>L f \\ halted\\<^sub>L\"\n unfolding flag\\<^sub>L_def\n by (simp_all add: lens_indep_left_ext)\n\nlemma reg\\<^sub>L_more_indep[simp, THEN lens_indep_sym, simp]:\n \"reg\\<^sub>L f \\ mem\\<^sub>L\"\n \"reg\\<^sub>L f \\ instrs\\<^sub>L\"\n \"reg\\<^sub>L f \\ halted\\<^sub>L\"\n unfolding reg\\<^sub>L_def\n by (simp_all add: lens_indep_left_ext)\n\n\nabbreviation \"REG r \\ VAL (reg\\<^sub>L r)\"\nabbreviation \"RAX \\ REG RAX_REG\"\nabbreviation \"RBX \\ REG RBX_REG\"\nabbreviation \"RCX \\ REG RCX_REG\"\nabbreviation \"RDX \\ REG RDX_REG\"\nabbreviation \"RIP \\ REG RIP_REG\"\nabbreviation \"FLAG f \\ VAL (flag\\<^sub>L f)\"\nabbreviation \"ZFLAG \\ FLAG Z_FLAG\"\nabbreviation \"PROG \\ VAL instrs\\<^sub>L\"\n\n\ntext \\Use to convert location into value for RIP\\\nlemma location_eq_conv: \"location s = i \\ RIP i s\"\n unfolding VAL_def by (auto simp: location_def)\n\nlemma halted_eq_conv:\n \"halted s \\ VAL halted\\<^sub>L True s\"\n \"\\VAL halted\\<^sub>L True s \\ VAL halted\\<^sub>L False s\"\n \"VAL halted\\<^sub>L True s \\ \\VAL halted\\<^sub>L False s\"\n unfolding VAL_def\n by auto (auto simp: halted\\<^sub>L_def split: state.splits)\n\nlemmas prep_precond_conv = location_eq_conv halted_eq_conv\n\nlemma location_conv[simp]: \"RIP i s \\ location s = i\"\n by (auto simp: location_def)\n\n\n\n\nlemma wps_fetch_instr_eq[wps_iffs]:\n assumes \"RIP i s\" \"PROG \\ s\"\n assumes \"unat i < length \\\"\n shows \"wps fetch_instr Q s \\ Q (\\ ! unat i) s\"\n unfolding fetch_instr_def\n using assms\n by (simp add: wps_eqs wps_use_eq)\n\n\nlemma wps_stepI[wps_intros]:\n assumes \"RIP i s\" \"PROG \\ s\"\n assumes \"unat i < length \\\"\n assumes \"\\s'. \\KBXFER (ltrans (reg\\<^sub>L RIP_REG)) s s'; RIP (1 + i) s'\\ \\ wps (exec_instr (\\ ! unat i)) Q s'\"\n shows \"wps step Q s\"\n unfolding step_def\n apply (rule wps_rls | fact)+\n done\n\n\nlemma wps_CMPI[wps_intros]:\n assumes \"REG r1 x1 s\" \"REG r2 x2 s\"\n assumes \"\\s'. \\KBXFER (ltrans (flag\\<^sub>L Z_FLAG)) s s'; ZFLAG (x1 = x2) s'\\ \\ Q () s'\"\n shows \"wps (exec_instr (CMP r1 r2)) Q s\"\n apply (simp)\n apply (intro wps_rls)\n apply (fact|simp)+\n done\n\n\nlemma wps_JEI[wps_intros]:\n assumes \"ZFLAG z s\"\n assumes \"\\s'. \\z; KBXFER (ltrans (reg\\<^sub>L RIP_REG)) s s'; RIP tgt s'\\ \\ Q () s'\"\n assumes \"\\ z \\ Q () s\"\n shows \"wps (exec_instr (JE tgt)) Q s\"\n apply (simp)\n apply (intro wps_rls)\n apply (fact|simp)+\n done\n\nlemma wps_JMPI[wps_intros]:\n assumes \"\\s'. \\KBXFER (ltrans (reg\\<^sub>L RIP_REG)) s s'; RIP tgt s'\\ \\ Q () s'\"\n shows \"wps (exec_instr (JMP tgt)) Q s\"\n apply (simp)\n apply (intro wps_rls)\n apply (fact|simp)+\n done\n\n\nlemma wps_HLTI[wps_intros]:\n assumes \"\\s'. \\KBXFER (ltrans halted\\<^sub>L) s s'; VAL halted\\<^sub>L True s'\\ \\ Q () s'\"\n shows \"wps (exec_instr HLT) Q s\"\n apply (simp)\n apply (intro wps_rls)\n apply (fact|simp)+\n done\n\nlemma wps_ADDI[wps_intros]:\n assumes \"REG r2 x2 s\" \"REG r3 x3 s\"\n assumes \"\\s'a. \\REG r1 (x2 + x3) s'a; ZFLAG (x2 + x3 = 0) s'a;\n KBXFER (ltrans (reg\\<^sub>L r1) OO ltrans (flag\\<^sub>L Z_FLAG)) s s'a\\\n \\ Q () s'a\"\n shows \"wps (exec_instr (ADD r1 r2 r3)) Q s\"\n apply (simp add: Let_def)\n apply (rule wps_rls | fact | kbxfer')+\n apply kbxfer_trans\n by fact\n\nlemma wps_LOADI[wps_intros]:\n assumes \"\\s'. \\KBXFER (ltrans (reg\\<^sub>L r)) s s'; REG r i s'\\ \\ Q () s'\"\n shows \"wps (exec_instr (LOADI r i)) Q s\"\n apply (simp)\n apply (intro wps_rls)\n apply (fact|simp)+\n done\n\n\n\ndeclare exec_instr.simps[simp del]\n\n\nsection \\Verification Example\\\n\n\nlemma nat_to_numeral1:\n \"Suc 0 = Numeral1\"\n \"Suc (numeral n) = numeral (Num.inc n)\"\n by (auto simp: add_One)\n\nlemmas nat_to_numeral = nat_to_numeral1 Num.inc.simps\n\n\nschematic_goal [simplified nat_to_numeral, simp]: \"length pow_prog = ?l\"\n unfolding pow_prog_def by simp\n\nschematic_goal [simplified,simp]:\n \"pow_prog ! 0 = ?c0\"\n \"pow_prog ! 1 = ?c1\"\n \"pow_prog ! 2 = ?c2\"\n \"pow_prog ! 3 = ?c3\"\n \"pow_prog ! 4 = ?c4\"\n \"pow_prog ! 5 = ?c5\"\n \"pow_prog ! 6 = ?c6\"\n \"pow_prog ! 7 = ?c7\"\n \"pow_prog ! 8 = ?c8\"\n unfolding pow_prog_def by auto\n\n\nprop \"RDX p s \\ VAL (mem\\<^sub>L((p + 0))\\<^sub>L) x0 s \\ VAL (mem\\<^sub>L((p + 1))\\<^sub>L) x1 s\"\n\ndefinition pp_\\ :: \"_ \\ floyd_invar\" where \"pp_\\ rdx\\<^sub>0 \\ [\n 0 \\ (\\s. VAL halted\\<^sub>L False s \\ PROG pow_prog s \\ RDX rdx\\<^sub>0 s),\n 3 \\ (\\s. \\rax rbx rcx hlt. RAX rax s \\ RBX rbx s \\ RCX rcx s \\ RDX rdx\\<^sub>0 s\n \\ VAL halted\\<^sub>L hlt s \\ \\hlt \\ PROG pow_prog s\n \\ rbx = 1 \\ rax = 2 ^ unat rcx \\ rcx \\ rdx\\<^sub>0),\n 9 \\ (\\s. \\rax hlt. RAX rax s \\ RDX rdx\\<^sub>0 s\n \\ VAL halted\\<^sub>L hlt s \\ hlt \\ PROG pow_prog s\n \\ rax = 2 ^ unat rdx\\<^sub>0\n )\n]\"\n\nschematic_goal [simplified,simp]:\n \"pp_\\ rdx\\<^sub>0 0 = ?p0\"\n \"pp_\\ rdx\\<^sub>0 3 = ?p3\"\n \"pp_\\ rdx\\<^sub>0 9 = ?p9\"\n \"i\\{0,3,9} \\ pp_\\ rdx\\<^sub>0 i = None\"\n unfolding pp_\\_def by auto\n\nlemma incr_aux1:\n fixes a b :: \"'a::len word\"\n shows \"a \\ b \\ a \\ b \\ unat (a+1) = Suc (unat a)\"\n by (smt Suc_eq_plus1 add.commute inc_i inc_le le_less not_less unatSuc unat_1 unat_plus_simple)\n\nlemma incr_aux2:\n fixes a b :: \"'a::len word\"\n shows \"a \\ b \\ a \\ b \\ a+1\\b\"\n by (simp add: inc_le)\n\n(* TODO: Move this VCG to more generic place! Currently placed here for quick experiments. *)\nmethod vcg_clarify = (intro impI conjI)?, (((rule exI, rule conjI, assumption)+ | (simp add: prep_precond_conv))+)?\nmethod vcg_step_aux = (rule wps_rls linvar_unfoldI, (assumption+)?); kbxfer?\nmethod vcg_step = vcg_clarify, vcg_step_aux\nmethod vcg = (vcg_step+, vcg_clarify)\n\n\nlemma pp_std_invar: \"is_std_invar (floyd.invar (pp_\\ rdx\\<^sub>0))\"\n apply (rule floyd_invarI)\n apply (rewrite at \"floyd_vcs \\ _\" pp_\\_def)\n apply (intro floyd_vcsI; (clarsimp simp: prep_precond_conv)?)\n\n subgoal for s by vcg\n\n subgoal for s\n apply vcg\n apply (elim_determ thin_rl[of \"VAL _ _ _\"])\n apply (auto simp: incr_aux1 inc_le) []\n done\n done\n\n\n\ntheorem pow_prog_correct: \"htriple\n (\\s. RIP 0 s \\ PROG pow_prog s \\ VAL halted\\<^sub>L False s \\ RDX n s)\n (\\s. RAX (2^unat n) s)\"\n apply (rule floyd_htripleI[where \\ = \"pp_\\ n\"], clarify)\n subgoal by vcg\n subgoal by (rule pp_std_invar)\n subgoal for s \\\n unfolding pp_\\_def\n by (clarsimp split: if_splits simp: prep_precond_conv)\n done\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Monads/Test_Asm_Sem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.2966962823991477}} {"text": "(* Title: The Standard Redundancy Criterion\n Author: Jasmin Blanchette , 2014, 2017\n Author: Dmitriy Traytel , 2014\n Author: Anders Schlichtkrull , 2017\n Maintainer: Anders Schlichtkrull \n*)\n\nsection \\The Standard Redundancy Criterion\\\n\ntheory Standard_Redundancy\n imports Proving_Process\nbegin\n\ntext \\\nThis material is based on Section 4.2.2 (``The Standard Redundancy Criterion'') of Bachmair and\nGanzinger's chapter.\n\\\n\nlocale standard_redundancy_criterion =\n inference_system \\ for \\ :: \"('a :: wellorder) inference set\"\nbegin\n\ndefinition redundant_infer :: \"'a clause set \\ 'a inference \\ bool\" where\n \"redundant_infer N \\ \\\n (\\DD. set_mset DD \\ N \\ (\\I. I \\m DD + side_prems_of \\ \\ I \\ concl_of \\)\n \\ (\\D. D \\# DD \\ D < main_prem_of \\))\"\n\ndefinition Rf :: \"'a clause set \\ 'a clause set\" where\n \"Rf N = {C. \\DD. set_mset DD \\ N \\ (\\I. I \\m DD \\ I \\ C) \\ (\\D. D \\# DD \\ D < C)}\"\n\ndefinition Ri :: \"'a clause set \\ 'a inference set\" where\n \"Ri N = {\\ \\ \\. redundant_infer N \\}\"\n\nlemma tautology_Rf:\n assumes \"Pos A \\# C\"\n assumes \"Neg A \\# C\"\n shows \"C \\ Rf N\"\nproof -\n have \"set_mset {#} \\ N \\ (\\I. I \\m {#} \\ I \\ C) \\ (\\D. D \\# {#} \\ D < C)\"\n using assms by auto\n then show \"C \\ Rf N\"\n unfolding Rf_def by blast\nqed\n\nlemma tautology_redundant_infer:\n assumes\n pos: \"Pos A \\# concl_of \\\" and\n neg: \"Neg A \\# concl_of \\\"\n shows \"redundant_infer N \\\"\n by (metis empty_iff empty_subsetI neg pos pos_neg_in_imp_true redundant_infer_def set_mset_empty)\n\nlemma contradiction_Rf: \"{#} \\ N \\ Rf N = UNIV - {{#}}\"\n unfolding Rf_def by force\n\ntext \\\nThe following results correspond to Lemma 4.5. The lemma \\wlog_non_Rf\\ generalizes the core of\nthe argument.\n\\\n\nlemma Rf_mono: \"N \\ N' \\ Rf N \\ Rf N'\"\n unfolding Rf_def by auto\n\nlemma wlog_non_Rf:\n assumes ex: \"\\DD. set_mset DD \\ N \\ (\\I. I \\m DD + CC \\ I \\ E) \\ (\\D'. D' \\# DD \\ D' < D)\"\n shows \"\\DD. set_mset DD \\ N - Rf N \\ (\\I. I \\m DD + CC \\ I \\ E) \\ (\\D'. D' \\# DD \\ D' < D)\"\nproof -\n from ex obtain DD0 where\n dd0: \"DD0 \\ {DD. set_mset DD \\ N \\ (\\I. I \\m DD + CC \\ I \\ E) \\ (\\D'. D' \\# DD \\ D' < D)}\"\n by blast\n have \"\\DD. set_mset DD \\ N \\ (\\I. I \\m DD + CC \\ I \\ E) \\ (\\D'. D' \\# DD \\ D' < D) \\\n (\\DD'. set_mset DD' \\ N \\ (\\I. I \\m DD' + CC \\ I \\ E) \\ (\\D'. D' \\# DD' \\ D' < D) \\\n DD \\ DD')\"\n using wf_eq_minimal[THEN iffD1, rule_format, OF wf_less_multiset dd0]\n unfolding not_le[symmetric] by blast\n then obtain DD where\n dd_subs_n: \"set_mset DD \\ N\" and\n ddcc_imp_e: \"\\I. I \\m DD + CC \\ I \\ E\" and\n dd_lt_d: \"\\D'. D' \\# DD \\ D' < D\" and\n d_min: \"\\DD'. set_mset DD' \\ N \\ (\\I. I \\m DD' + CC \\ I \\ E) \\ (\\D'. D' \\# DD' \\ D' < D) \\\n DD \\ DD'\"\n by blast\n\n have \"\\Da. Da \\# DD \\ Da \\ Rf N\"\n proof clarify\n fix Da\n assume\n da_in_dd: \"Da \\# DD\" and\n da_rf: \"Da \\ Rf N\"\n\n from da_rf obtain DD' where\n dd'_subs_n: \"set_mset DD' \\ N\" and\n dd'_imp_da: \"\\I. I \\m DD' \\ I \\ Da\" and\n dd'_lt_da: \"\\D'. D' \\# DD' \\ D' < Da\"\n unfolding Rf_def by blast\n\n define DDa where\n \"DDa = DD - {#Da#} + DD'\"\n\n have \"set_mset DDa \\ N\"\n unfolding DDa_def using dd_subs_n dd'_subs_n\n by (meson contra_subsetD in_diffD subsetI union_iff)\n moreover have \"\\I. I \\m DDa + CC \\ I \\ E\"\n using dd'_imp_da ddcc_imp_e da_in_dd unfolding DDa_def true_cls_mset_def\n by (metis in_remove1_mset_neq union_iff)\n moreover have \"\\D'. D' \\# DDa \\ D' < D\"\n using dd_lt_d dd'_lt_da da_in_dd unfolding DDa_def\n by (metis insert_DiffM2 order.strict_trans union_iff)\n moreover have \"DDa < DD\"\n unfolding DDa_def\n by (meson da_in_dd dd'_lt_da mset_lt_single_right_iff single_subset_iff union_le_diff_plus)\n ultimately show False\n using d_min unfolding less_eq_multiset_def by (auto intro!: antisym)\n qed\n then show ?thesis\n using dd_subs_n ddcc_imp_e dd_lt_d by auto\nqed\n\nlemma Rf_imp_ex_non_Rf:\n assumes \"C \\ Rf N\"\n shows \"\\CC. set_mset CC \\ N - Rf N \\ (\\I. I \\m CC \\ I \\ C) \\ (\\C'. C' \\# CC \\ C' < C)\"\n using assms by (auto simp: Rf_def intro: wlog_non_Rf[of _ \"{#}\", simplified])\n\nlemma Rf_subs_Rf_diff_Rf: \"Rf N \\ Rf (N - Rf N)\"\nproof\n fix C\n assume c_rf: \"C \\ Rf N\"\n then obtain CC where\n cc_subs: \"set_mset CC \\ N - Rf N\" and\n cc_imp_c: \"\\I. I \\m CC \\ I \\ C\" and\n cc_lt_c: \"\\C'. C' \\# CC \\ C' < C\"\n using Rf_imp_ex_non_Rf by blast\n have \"\\D. D \\# CC \\ D \\ Rf N\"\n using cc_subs by (simp add: subset_iff)\n then have cc_nr:\n \"\\C DD. C \\# CC \\ set_mset DD \\ N \\ \\I. I \\m DD \\ I \\ C \\ \\D. D \\# DD \\ \\ D < C\"\n unfolding Rf_def by auto metis\n have \"set_mset CC \\ N\"\n using cc_subs by auto\n then have \"set_mset CC \\\n N - {C. \\DD. set_mset DD \\ N \\ (\\I. I \\m DD \\ I \\ C) \\ (\\D. D \\# DD \\ D < C)}\"\n using cc_nr by blast\n then show \"C \\ Rf (N - Rf N)\"\n using cc_imp_c cc_lt_c unfolding Rf_def by auto\nqed\n\nlemma Rf_eq_Rf_diff_Rf: \"Rf N = Rf (N - Rf N)\"\n by (metis Diff_subset Rf_mono Rf_subs_Rf_diff_Rf subset_antisym)\n\ntext \\\nThe following results correspond to Lemma 4.6.\n\\\n\nlemma Ri_mono: \"N \\ N' \\ Ri N \\ Ri N'\"\n unfolding Ri_def redundant_infer_def by auto\n\nlemma Ri_subs_Ri_diff_Rf: \"Ri N \\ Ri (N - Rf N)\"\nproof\n fix \\\n assume \\_ri: \"\\ \\ Ri N\"\n then obtain CC D E where \\: \"\\ = Infer CC D E\"\n by (cases \\)\n have cc: \"CC = side_prems_of \\\" and d: \"D = main_prem_of \\\" and e: \"E = concl_of \\\"\n unfolding \\ by simp_all\n obtain DD where\n \"set_mset DD \\ N\" and \"\\I. I \\m DD + CC \\ I \\ E\" and \"\\C. C \\# DD \\ C < D\"\n using \\_ri unfolding Ri_def redundant_infer_def cc d e by blast\n then obtain DD' where\n \"set_mset DD' \\ N - Rf N\" and \"\\I. I \\m DD' + CC \\ I \\ E\" and \"\\D'. D' \\# DD' \\ D' < D\"\n using wlog_non_Rf by atomize_elim blast\n then show \"\\ \\ Ri (N - Rf N)\"\n using \\_ri unfolding Ri_def redundant_infer_def d cc e by blast\nqed\n\nlemma Ri_eq_Ri_diff_Rf: \"Ri N = Ri (N - Rf N)\"\n by (metis Diff_subset Ri_mono Ri_subs_Ri_diff_Rf subset_antisym)\n\nlemma Ri_subset_\\: \"Ri N \\ \\\"\n unfolding Ri_def by blast\n\nlemma Rf_indep: \"N' \\ Rf N \\ Rf N \\ Rf (N - N')\"\n by (metis Diff_cancel Diff_eq_empty_iff Diff_mono Rf_eq_Rf_diff_Rf Rf_mono)\n\nlemma Ri_indep: \"N' \\ Rf N \\ Ri N \\ Ri (N - N')\"\n by (metis Diff_mono Ri_eq_Ri_diff_Rf Ri_mono order_refl)\n\nlemma Rf_model:\n assumes \"I \\s N - Rf N\"\n shows \"I \\s N\"\nproof -\n have \"I \\s Rf (N - Rf N)\"\n unfolding true_clss_def\n by (subst Rf_def, simp add: true_cls_mset_def, metis assms subset_eq true_clss_def)\n then have \"I \\s Rf N\"\n using Rf_subs_Rf_diff_Rf true_clss_mono by blast\n then show ?thesis\n using assms by (metis Un_Diff_cancel true_clss_union)\nqed\n\nlemma Rf_sat: \"satisfiable (N - Rf N) \\ satisfiable N\"\n by (metis Rf_model)\n\ntext \\\nThe following corresponds to Theorem 4.7:\n\\\n\nsublocale redundancy_criterion \\ Rf Ri\n by unfold_locales (rule Ri_subset_\\, (elim Rf_mono Ri_mono Rf_indep Ri_indep Rf_sat)+)\n\nend\n\nlocale standard_redundancy_criterion_reductive =\n standard_redundancy_criterion + reductive_inference_system\nbegin\n\ntext \\\nThe following corresponds to Theorem 4.8:\n\\\n\nlemma Ri_effective:\n assumes\n in_\\: \"\\ \\ \\\" and\n concl_of_in_n_un_rf_n: \"concl_of \\ \\ N \\ Rf N\"\n shows \"\\ \\ Ri N\"\nproof -\n obtain CC D E where\n \\: \"\\ = Infer CC D E\"\n by (cases \\)\n then have cc: \"CC = side_prems_of \\\" and d: \"D = main_prem_of \\\" and e: \"E = concl_of \\\"\n unfolding \\ by simp_all\n note e_in_n_un_rf_n = concl_of_in_n_un_rf_n[folded e]\n\n {\n assume \"E \\ N\"\n moreover have \"E < D\"\n using \\_reductive e d in_\\ by auto\n ultimately have\n \"set_mset {#E#} \\ N\" and \"\\I. I \\m {#E#} + CC \\ I \\ E\" and \"\\D'. D' \\# {#E#} \\ D' < D\"\n by simp_all\n then have \"redundant_infer N \\\"\n using redundant_infer_def cc d e by blast\n }\n moreover\n {\n assume \"E \\ Rf N\"\n then obtain DD where\n dd_sset: \"set_mset DD \\ N\" and\n dd_imp_e: \"\\I. I \\m DD \\ I \\ E\" and\n dd_lt_e: \"\\C'. C' \\# DD \\ C' < E\"\n unfolding Rf_def by blast\n from dd_lt_e have \"\\Da. Da \\# DD \\ Da < D\"\n using d e in_\\ \\_reductive less_trans by blast\n then have \"redundant_infer N \\\"\n using redundant_infer_def dd_sset dd_imp_e cc d e by blast\n }\n ultimately show \"\\ \\ Ri N\"\n using in_\\ e_in_n_un_rf_n unfolding Ri_def by blast\nqed\n\nsublocale effective_redundancy_criterion \\ Rf Ri\n unfolding effective_redundancy_criterion_def\n by (intro conjI redundancy_criterion_axioms, unfold_locales, rule Ri_effective)\n\nlemma contradiction_Rf: \"{#} \\ N \\ Ri N = \\\"\n unfolding Ri_def redundant_infer_def using \\_reductive le_multiset_empty_right\n by (force intro: exI[of _ \"{#{#}#}\"] le_multiset_empty_left)\n\nend\n\nlocale standard_redundancy_criterion_counterex_reducing =\n standard_redundancy_criterion + counterex_reducing_inference_system\nbegin\n\ntext \\\nThe following result corresponds to Theorem 4.9.\n\\\n\nlemma saturated_upto_complete_if:\n assumes\n satur: \"saturated_upto N\" and\n unsat: \"\\ satisfiable N\"\n shows \"{#} \\ N\"\nproof (rule ccontr)\n assume ec_ni_n: \"{#} \\ N\"\n\n define M where\n \"M = N - Rf N\"\n\n have ec_ni_m: \"{#} \\ M\"\n unfolding M_def using ec_ni_n by fast\n\n have \"I_of M \\s M\"\n proof (rule ccontr)\n assume \"\\ I_of M \\s M\"\n then obtain D where\n d_in_m: \"D \\ M\" and\n d_cex: \"\\ I_of M \\ D\" and\n d_min: \"\\C. C \\ M \\ C < D \\ I_of M \\ C\"\n using ex_min_counterex by meson\n then obtain \\ CC E where\n \\: \"\\ = Infer CC D E\" and\n cc_subs_m: \"set_mset CC \\ M\" and\n cc_true: \"I_of M \\m CC\" and\n \\_in: \"\\ \\ \\\" and\n e_cex: \"\\ I_of M \\ E\" and\n e_lt_d: \"E < D\"\n using \\_counterex_reducing[OF ec_ni_m] not_less by metis\n have cc: \"CC = side_prems_of \\\" and d: \"D = main_prem_of \\\" and e: \"E = concl_of \\\"\n unfolding \\ by simp_all\n have \"\\ \\ Ri N\"\n by (rule subsetD[OF satur[unfolded saturated_upto_def inferences_from_def infer_from_def]])\n (simp add: \\_in d_in_m cc_subs_m cc[symmetric] d[symmetric] M_def[symmetric])\n then have \"\\ \\ Ri M\"\n unfolding M_def using Ri_indep by fast\n then obtain DD where\n dd_subs_m: \"set_mset DD \\ M\" and\n dd_cc_imp_d: \"\\I. I \\m DD + CC \\ I \\ E\" and\n dd_lt_d: \"\\C. C \\# DD \\ C < D\"\n unfolding Ri_def redundant_infer_def cc d e by blast\n from dd_subs_m dd_lt_d have \"I_of M \\m DD\"\n using d_min unfolding true_cls_mset_def by (metis contra_subsetD)\n then have \"I_of M \\ E\"\n using dd_cc_imp_d cc_true by auto\n then show False\n using e_cex by auto\n qed\n then have \"I_of M \\s N\"\n using M_def Rf_model by blast\n then show False\n using unsat by blast\nqed\n\ntheorem saturated_upto_complete:\n assumes \"saturated_upto N\"\n shows \"\\ satisfiable N \\ {#} \\ N\"\n using assms saturated_upto_complete_if true_clss_def by auto\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Ordered_Resolution_Prover/Standard_Redundancy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.29669627452019137}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\n(*\n Changes since submission on 2009-11-26:\n\n 2009-12-10: OrderedMap, algorithms for iterators, min, max, to_sorted_list\n\n*)\n\nheader {* \\isaheader{Generic Algorithms for Maps} *}\ntheory MapGA\nimports SetIteratorCollectionsGA\nbegin\n\ntext_raw {*\\label{thy:MapGA}*}\n\nrecord ('k,'v,'s) map_basic_ops =\n bmap_op_\\ :: \"('k,'v,'s) map_\\\"\n bmap_op_invar :: \"('k,'v,'s) map_invar\"\n bmap_op_empty :: \"('k,'v,'s) map_empty\"\n bmap_op_lookup :: \"('k,'v,'s) map_lookup\"\n bmap_op_update :: \"('k,'v,'s) map_update\"\n bmap_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n bmap_op_delete :: \"('k,'v,'s) map_delete\"\n bmap_op_list_it :: \"('k,'v,'s) map_list_it\"\n \nrecord ('k,'v,'s) omap_basic_ops = \"('k,'v,'s) map_basic_ops\" +\n bmap_op_ordered_list_it :: \"'s \\ ('k,'v,('k\\'v) list) map_iterator\"\n bmap_op_rev_list_it :: \"'s \\ ('k,'v,('k\\'v) list) map_iterator\"\n\nlocale StdBasicMapDefs = \n poly_map_iteratei_defs \"bmap_op_list_it ops\" \n for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n abbreviation \\ where \"\\ == bmap_op_\\ ops\" \n abbreviation invar where \"invar == bmap_op_invar ops\" \n abbreviation empty where \"empty == bmap_op_empty ops\" \n abbreviation lookup where \"lookup == bmap_op_lookup ops\" \n abbreviation update where \"update == bmap_op_update ops\" \n abbreviation update_dj where \"update_dj == bmap_op_update_dj ops\" \n abbreviation delete where \"delete == bmap_op_delete ops\" \n abbreviation list_it where \"list_it == bmap_op_list_it ops\" \nend\n\nlocale StdBasicOMapDefs = StdBasicMapDefs ops\n + poly_map_iterateoi_defs \"bmap_op_ordered_list_it ops\"\n + poly_map_rev_iterateoi_defs \"bmap_op_rev_list_it ops\"\n for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\n abbreviation ordered_list_it where \"ordered_list_it \n \\ bmap_op_ordered_list_it ops\"\n abbreviation rev_list_it where \"rev_list_it \n \\ bmap_op_rev_list_it ops\"\nend\n\nlocale StdBasicMap = StdBasicMapDefs ops +\n map \\ invar +\n map_empty \\ invar empty +\n map_lookup \\ invar lookup +\n map_update \\ invar update +\n map_update_dj \\ invar update_dj +\n map_delete \\ invar delete +\n poly_map_iteratei \\ invar list_it\n for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n lemmas correct[simp] = empty_correct lookup_correct update_correct \n update_dj_correct delete_correct\nend\n\n\nlocale StdBasicOMap = \n StdBasicOMapDefs ops +\n StdBasicMap ops +\n poly_map_iterateoi \\ invar ordered_list_it +\n poly_map_rev_iterateoi \\ invar rev_list_it\n for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\nend\n\ncontext StdBasicMapDefs begin\n definition \"g_sng k v \\ update k v (empty ())\"\n definition \"g_add m1 m2 \\ iterate m2 (\\(k,v) \\. update k v \\) m1\"\n\n definition \n \"g_sel m P \\ \n iteratei m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \"g_bex m P \\ iteratei m (\\x. \\x) (\\kv \\. P kv) False\"\n definition \"g_ball m P \\ iteratei m id (\\kv \\. P kv) True\"\n\n definition \"g_size m \\ iterate m (\\_. Suc) (0::nat)\"\n definition \"g_size_abort b m \\ iteratei m (\\s. s_. Suc) (0::nat)\"\n\n definition \"g_isEmpty m \\ g_size_abort 1 m = 0\"\n definition \"g_isSng m \\ g_size_abort 2 m = 1\"\n\n definition \"g_to_list m \\ iterate m (op #) []\"\n\n definition \"g_list_to_map l \\ foldl (\\m (k,v). update k v m) (empty ()) \n (rev l)\"\n\n definition \"g_add_dj m1 m2 \\ iterate m2 (\\(k,v) \\. update_dj k v \\) m1\"\n\n definition \"g_restrict P m \\ iterate m \n (\\(k,v) \\. if P (k,v) then update_dj k v \\ else \\) (empty ())\"\n\n definition dflt_ops :: \"('k,'v,'s) map_ops\" \n where [icf_rec_def]:\n \"dflt_ops \\ \n \\ \n map_op_\\ = \\,\n map_op_invar = invar,\n map_op_empty = empty,\n map_op_lookup = lookup,\n map_op_update = update,\n map_op_update_dj = update_dj,\n map_op_delete = delete,\n map_op_list_it = list_it,\n map_op_sng = g_sng,\n map_op_restrict = g_restrict, \n map_op_add = g_add, \n map_op_add_dj = g_add_dj, \n map_op_isEmpty = g_isEmpty, \n map_op_isSng = g_isSng, \n map_op_ball = g_ball, \n map_op_bex = g_bex, \n map_op_size = g_size, \n map_op_size_abort = g_size_abort, \n map_op_sel = g_sel, \n map_op_to_list = g_to_list, \n map_op_to_map = g_list_to_map\n \\\"\n\n local_setup {* Locale_Code.lc_decl_del @{term dflt_ops}*}\n\nend\n\nlemma update_dj_by_update: \n assumes \"map_update \\ invar update\"\n shows \"map_update_dj \\ invar update\"\nproof -\n interpret map_update \\ invar update by fact\n show ?thesis \n apply (unfold_locales)\n apply (auto simp add: update_correct)\n done\nqed\n\nlemma map_iterator_linord_is_it: \n \"map_iterator_linord m it \\ map_iterator m it\"\n unfolding set_iterator_def set_iterator_map_linord_def\n apply (erule set_iterator_genord.set_iterator_weaken_R)\n ..\n\n\n\ncontext StdBasicMap \nbegin\n \n\n lemma g_add_impl: \"map_add \\ invar g_add\"\n proof\n fix m1 m2\n assume \"invar m1\" \"invar m2\"\n\n have A: \"g_add m1 m2 = iterate_add_to_map m1 update (iteratei m2)\"\n unfolding g_add_def iterate_add_to_map_def by simp\n have \"\\ (g_add m1 m2) = \\ m1 ++ \\ m2 \\ invar (g_add m1 m2)\"\n unfolding A\n apply (rule \n iterate_add_to_map_correct[of \\ invar update m1 \"iteratei m2\" \"\\ m2\"])\n apply unfold_locales []\n apply fact\n apply (rule iteratei_correct, fact)\n done\n thus \"\\ (g_add m1 m2) = \\ m1 ++ \\ m2\" \"invar (g_add m1 m2)\" by auto\n qed\n\n lemma g_sel_impl: \"map_sel' \\ invar g_sel\"\n proof -\n have A: \"\\m P. g_sel m P = iterate_sel_no_map (iteratei m) P\"\n unfolding g_sel_def iterate_sel_no_map_def iterate_sel_def by simp\n\n { fix m P\n assume I: \"invar m\"\n note iterate_sel_no_map_correct[OF iteratei_correct[OF I], of P]\n }\n thus ?thesis\n apply unfold_locales\n unfolding A\n apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n apply clarify\n apply (metis option.exhaust PairE)\n apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n done\n qed\n \n lemma g_bex_impl: \"map_bex \\ invar g_bex\"\n apply unfold_locales\n unfolding g_bex_def\n apply (rule_tac I=\"\\it \\. \\ \\ (\\kv\\it. P kv)\" \n in iteratei_rule_insert_P)\n by (auto simp: map_to_set_def)\n\n \n\n lemma g_size_impl: \"map_size \\ invar g_size\"\n proof \n fix m\n assume I: \"invar m\"\n have A: \"g_size m \\ iterate_size (iteratei m)\"\n unfolding g_size_def iterate_size_def by simp\n \n from iterate_size_correct [OF iteratei_correct[OF I]]\n show \"g_size m = card (dom (\\ m))\"\n unfolding A\n by (simp_all add: card_map_to_set) \n qed \n\n lemma g_size_abort_impl: \"map_size_abort \\ invar g_size_abort\"\n proof \n fix s m\n assume I: \"invar m\"\n have A: \"g_size_abort s m \\ iterate_size_abort (iteratei m) s\"\n unfolding g_size_abort_def iterate_size_abort_def by simp\n \n from iterate_size_abort_correct [OF iteratei_correct[OF I]]\n show \"g_size_abort s m = min s (card (dom (\\ m)))\"\n unfolding A\n by (simp_all add: card_map_to_set) \n qed \n\n lemma g_isEmpty_impl: \"map_isEmpty \\ invar g_isEmpty\"\n proof \n fix m\n assume I: \"invar m\"\n interpret map_size_abort \\ invar g_size_abort by (rule g_size_abort_impl)\n from size_abort_correct[OF I] have \n \"g_size_abort 1 m = min 1 (card (dom (\\ m)))\" .\n thus \"g_isEmpty m = (\\ m = Map.empty)\" unfolding g_isEmpty_def\n by (auto simp: min_def card_0_eq[OF finite] I)\n qed\n\n lemma g_isSng_impl: \"map_isSng \\ invar g_isSng\"\n proof \n fix m\n assume I: \"invar m\"\n interpret map_size_abort \\ invar g_size_abort by (rule g_size_abort_impl)\n from size_abort_correct[OF I] have \n \"g_size_abort 2 m = min 2 (card (dom (\\ m)))\" .\n thus \"g_isSng m = (\\k v. \\ m = [k \\ v])\" unfolding g_isSng_def\n by (auto simp: min_def I card_Suc_eq dom_eq_singleton_conv)\n qed\n \n lemma g_to_list_impl: \"map_to_list \\ invar g_to_list\"\n proof \n fix m \n assume I: \"invar m\"\n\n have A: \"g_to_list m = iterate_to_list (iteratei m)\"\n unfolding g_to_list_def iterate_to_list_def by simp\n\n from iterate_to_list_correct [OF iteratei_correct[OF I]]\n have set_l_eq: \"set (g_to_list m) = map_to_set (\\ m)\" and \n dist_l: \"distinct (g_to_list m)\" unfolding A by simp_all\n\n from dist_l show dist_fst_l: \"distinct (map fst (g_to_list m))\"\n by (simp add: distinct_map set_l_eq map_to_set_def inj_on_def)\n \n from map_of_map_to_set[of \"(g_to_list m)\" \"\\ m\", OF dist_fst_l] set_l_eq\n show \"map_of (g_to_list m) = \\ m\" by simp\n qed\n\n lemma g_list_to_map_impl: \"list_to_map \\ invar g_list_to_map\"\n proof -\n {\n fix m0 l\n assume \"invar m0\"\n hence \"invar (foldl (\\s (k,v). update k v s) m0 l) \\ \n \\ (foldl (\\s (k,v). update k v s) m0 l) = \\ m0 ++ map_of (rev l)\"\n proof (induction l arbitrary: m0)\n case Nil thus ?case by simp\n next\n case (Cons kv l)\n obtain k v where [simp]: \"kv=(k,v)\" by (cases kv) auto\n have \"invar (foldl (\\s (k, v). update k v s) m0 (kv # l))\"\n apply simp\n apply (rule conjunct1[OF Cons.IH])\n apply (simp add: update_correct Cons.prems)\n done\n moreover have \"\\ (foldl (\\s (k, v). update k v s) m0 (kv # l)) =\n \\ m0 ++ map_of (rev (kv # l))\"\n apply simp\n thm trans[OF conjunct2[OF Cons.IH]]\n apply (rule trans[OF conjunct2[OF Cons.IH]])\n apply (auto \n simp: update_correct Cons.prems Map.map_add_def[abs_def]\n split: option.split\n )\n done\n ultimately show ?case\n by simp\n qed\n } thus ?thesis\n apply unfold_locales\n unfolding g_list_to_map_def\n apply (auto simp: empty_correct)\n done\n qed\n\n lemma g_add_dj_impl: \"map_add_dj \\ invar g_add_dj\"\n proof\n fix m1 m2\n assume \"invar m1\" \"invar m2\" and DJ: \"dom (\\ m1) \\ dom (\\ m2) = {}\"\n\n have A: \"g_add_dj m1 m2 = iterate_add_to_map m1 update_dj (iteratei m2)\"\n unfolding g_add_dj_def iterate_add_to_map_def by simp\n have \"\\ (g_add_dj m1 m2) = \\ m1 ++ \\ m2 \\ invar (g_add_dj m1 m2)\"\n unfolding A\n apply (rule \n iterate_add_to_map_dj_correct[\n of \\ invar update_dj m1 \"iteratei m2\" \"\\ m2\"])\n apply unfold_locales []\n apply fact\n apply (rule iteratei_correct, fact)\n using DJ apply (simp add: Int_ac)\n done\n thus \"\\ (g_add_dj m1 m2) = \\ m1 ++ \\ m2\" \"invar (g_add_dj m1 m2)\" by auto\n qed\n \n lemma g_restrict_impl: \"map_restrict \\ invar \\ invar g_restrict\"\n proof \n fix m P\n assume I: \"invar m\"\n\n have AUX: \"\\k v it \\.\n \\it \\ {(k, v). \\ m k = Some v}; \\ m k = Some v; (k, v) \\ it;\n {(k, v). \\ \\ k = Some v} = it \\ Collect P\\\n \\ k \\ dom (\\ \\)\"\n proof (rule ccontr, simp)\n fix k v it \\\n assume \"k\\dom (\\ \\)\" \n then obtain v' where \"\\ \\ k = Some v'\" by auto\n moreover assume \"{(k, v). \\ \\ k = Some v} = it \\ Collect P\"\n ultimately have MEM: \"(k,v')\\it\" by auto\n moreover assume \"it \\ {(k, v). \\ m k = Some v}\" and \"\\ m k = Some v\"\n ultimately have \"v'=v\" by auto\n moreover assume \"(k,v)\\it\"\n moreover note MEM \n ultimately show False by simp\n qed\n\n have \"\\ (g_restrict P m) = \\ m |` {k. \\v. \\ m k = Some v \\ P (k, v)} \\\n invar (g_restrict P m)\"\n unfolding g_restrict_def\n apply (rule_tac I=\"\\it \\. invar \\ \n \\ map_to_set (\\ \\) = it \\ Collect P\"\n in iterate_rule_insert_P)\n apply (auto simp: I empty_correct update_dj_correct map_to_set_def AUX)\n apply (auto split: split_if_asm)\n apply (rule ext)\n apply (auto simp: Map.restrict_map_def)\n apply force\n apply (rule ccontr)\n apply force\n done\n thus \"\\ (g_restrict P m) = \\ m |` {k. \\v. \\ m k = Some v \\ P (k, v)}\"\n \"invar (g_restrict P m)\" by auto\n qed\n\n \n\n\ncontext StdBasicOMapDefs \nbegin\n definition \n \"g_min m P \\ \n iterateoi m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \n \"g_max m P \\ \n rev_iterateoi m (\\\\. \\ = None) (\\x \\. if P x then Some x else None) None\"\n\n definition \"g_to_sorted_list m \\ rev_iterateo m (op #) []\"\n definition \"g_to_rev_list m \\ iterateo m (op #) []\"\n\n definition dflt_oops :: \"('k,'v,'s) omap_ops\" \n where [icf_rec_def]:\n \"dflt_oops \\ map_ops.extend dflt_ops\n \\ \n map_op_ordered_list_it = ordered_list_it,\n map_op_rev_list_it = rev_list_it,\n map_op_min = g_min,\n map_op_max = g_max,\n map_op_to_sorted_list = g_to_sorted_list,\n map_op_to_rev_list = g_to_rev_list\n \\\"\n local_setup {* Locale_Code.lc_decl_del @{term dflt_oops}*}\n\nend\n\ncontext StdBasicOMap \nbegin\n lemma g_min_impl: \"map_min \\ invar g_min\"\n proof \n fix m P\n\n assume I: \"invar m\"\n \n from iterateoi_correct[OF I]\n have iti': \"map_iterator_linord (iterateoi m) (\\ m)\" by simp\n note sel_correct = iterate_sel_no_map_map_linord_correct[OF iti', of P]\n\n have A: \"g_min m P = iterate_sel_no_map (iterateoi m) P\"\n unfolding g_min_def iterate_sel_no_map_def iterate_sel_def by simp\n \n { assume \"rel_of (\\ m) P \\ {}\"\n with sel_correct \n show \"g_min m P \\ Some ` rel_of (\\ m) P\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { assume \"rel_of (\\ m) P = {}\" \n with sel_correct show \"g_min m P = None\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { fix k v\n assume \"(k, v) \\ rel_of (\\ m) P\"\n with sel_correct show \"fst (the (g_min m P)) \\ k\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n qed\n\n lemma g_max_impl: \"map_max \\ invar g_max\"\n proof \n fix m P\n\n assume I: \"invar m\"\n \n from rev_iterateoi_correct[OF I]\n have iti': \"map_iterator_rev_linord (rev_iterateoi m) (\\ m)\" by simp\n note sel_correct = iterate_sel_no_map_map_rev_linord_correct[OF iti', of P]\n\n have A: \"g_max m P = iterate_sel_no_map (rev_iterateoi m) P\"\n unfolding g_max_def iterate_sel_no_map_def iterate_sel_def by simp\n \n { assume \"rel_of (\\ m) P \\ {}\"\n with sel_correct \n show \"g_max m P \\ Some ` rel_of (\\ m) P\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { assume \"rel_of (\\ m) P = {}\" \n with sel_correct show \"g_max m P = None\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n\n { fix k v\n assume \"(k, v) \\ rel_of (\\ m) P\"\n with sel_correct show \"fst (the (g_max m P)) \\ k\"\n unfolding A\n by (auto simp add: image_iff rel_of_def)\n }\n qed\n\n lemma g_to_sorted_list_impl: \"map_to_sorted_list \\ invar g_to_sorted_list\"\n proof \n fix m\n assume I: \"invar m\"\n note iti = rev_iterateoi_correct[OF I]\n from iterate_to_list_map_rev_linord_correct[OF iti]\n show \"sorted (map fst (g_to_sorted_list m))\" \n \"distinct (map fst (g_to_sorted_list m))\"\n \"map_of (g_to_sorted_list m) = \\ m\" \n unfolding g_to_sorted_list_def iterate_to_list_def by simp_all\n qed\n\n lemma g_to_rev_list_impl: \"map_to_rev_list \\ invar g_to_rev_list\"\n proof \n fix m\n assume I: \"invar m\"\n note iti = iterateoi_correct[OF I]\n from iterate_to_list_map_linord_correct[OF iti]\n show \"sorted (rev (map fst (g_to_rev_list m)))\" \n \"distinct (map fst (g_to_rev_list m))\"\n \"map_of (g_to_rev_list m) = \\ m\" \n unfolding g_to_rev_list_def iterate_to_list_def \n by (simp_all add: rev_map)\n qed\n \n lemma dflt_oops_impl: \"StdOMap dflt_oops\"\n proof -\n interpret aux!: StdMap dflt_ops by (rule dflt_ops_impl)\n\n show ?thesis\n apply (rule StdOMap_intro)\n apply icf_locales\n apply (simp_all add: icf_rec_unf)\n apply (rule g_min_impl)\n apply (rule g_max_impl)\n apply (rule g_to_sorted_list_impl)\n apply (rule g_to_rev_list_impl)\n done\n qed\n\nend\n\nlocale g_image_filter_defs_loc = \n m1!: StdMapDefs ops1 + \n m2!: StdMapDefs ops2\n for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n definition \"g_image_filter f m1 \\ m1.iterate m1 (\\kv \\. case f kv of \n None => \\\n | Some (k',v') => m2.update_dj k' v' \\\n ) (m2.empty ())\"\nend\n\nlocale g_image_filter_loc = g_image_filter_defs_loc ops1 ops2 + \n m1!: StdMap ops1 + \n m2!: StdMap ops2\n for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n lemma g_image_filter_impl: \n \"map_image_filter m1.\\ m1.invar m2.\\ m2.invar g_image_filter\"\n proof \n fix m k' v' and f :: \"('k1 \\ 'v1) \\ ('k2 \\ 'v2) option\"\n assume invar_m: \"m1.invar m\" and\n unique_f: \"transforms_to_unique_keys (m1.\\ m) f\"\n \n have A: \"g_image_filter f m = \n iterate_to_map m2.empty m2.update_dj (\n set_iterator_image_filter f (m1.iteratei m))\" \n unfolding g_image_filter_def iterate_to_map_alt_def \n set_iterator_image_filter_def case_prod_beta\n by simp\n \n from m1.iteratei_correct[OF invar_m] \n have iti_m: \"map_iterator (m1.iteratei m) (m1.\\ m)\" by simp\n\n from unique_f have inj_on_f: \"inj_on f (map_to_set (m1.\\ m) \\ dom f)\"\n unfolding transforms_to_unique_keys_def inj_on_def Ball_def map_to_set_def\n by auto (metis option.inject)\n\n def vP \\ \"\\k v. \\k' v'. m1.\\ m k' = Some v' \\ f (k', v') = Some (k, v)\"\n have vP_intro: \"\\k v. (\\k' v'. m1.\\ m k' = Some v' \n \\ f (k', v') = Some (k, v)) \\ vP k v\"\n unfolding vP_def by simp\n { fix k v\n have \"Eps_Opt (vP k) = Some v \\ vP k v\"\n using unique_f unfolding vP_def transforms_to_unique_keys_def \n apply (rule_tac Eps_Opt_eq_Some)\n apply (metis Pair_eq option.inject)\n done\n } note Eps_vP_elim[simp] = this\n have map_intro: \"{y. \\x. x \\ map_to_set (m1.\\ m) \\ f x = Some y} \n = map_to_set (\\k. Eps_Opt (vP k))\"\n by (simp add: map_to_set_def vP_intro set_eq_iff split: prod.splits)\n\n from set_iterator_image_filter_correct [OF iti_m, OF inj_on_f, \n unfolded map_intro] \n have iti_filter: \"map_iterator (set_iterator_image_filter f (m1.iteratei m))\n (\\k. Eps_Opt (vP k))\" by auto\n\n have upd: \"map_update_dj m2.\\ m2.invar m2.update_dj\" by unfold_locales\n have emp: \"map_empty m2.\\ m2.invar m2.empty\" by unfold_locales\n \n from iterate_to_map_correct[OF upd emp iti_filter] show\n \"map_op_invar ops2 (g_image_filter f m) \\\n (map_op_\\ ops2 (g_image_filter f m) k' = Some v') =\n (\\k v. map_op_\\ ops1 m k = Some v \\ f (k, v) = Some (k', v'))\"\n unfolding A vP_def[symmetric]\n by (simp add: vP_intro)\n \n qed\nend\n\nsublocale g_image_filter_loc \n < map_image_filter m1.\\ m1.invar m2.\\ m2.invar g_image_filter\n by (rule g_image_filter_impl)\n\n\nlocale g_value_image_filter_defs_loc = \n m1!: StdMapDefs ops1 + \n m2!: StdMapDefs ops2\n for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n definition \"g_value_image_filter f m1 \\ m1.iterate m1 (\\(k,v) \\. \n case f k v of \n None => \\\n | Some v' => m2.update_dj k v' \\\n ) (m2.empty ())\"\n \nend\n\n(* TODO: Move to Misc *)\nlemma restrict_map_dom_subset: \"\\ dom m \\ R\\ \\ m|`R = m\"\n apply (rule ext)\n apply (auto simp: restrict_map_def)\n apply (case_tac \"m x\")\n apply auto\n done\n\n\nlocale g_value_image_filter_loc = g_value_image_filter_defs_loc ops1 ops2 + \n m1!: StdMap ops1 + \n m2!: StdMap ops2\n for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n lemma g_value_image_filter_impl: \n \"map_value_image_filter m1.\\ m1.invar m2.\\ m2.invar g_value_image_filter\"\n apply unfold_locales\n unfolding g_value_image_filter_def\n apply (rule_tac I=\"\\it \\. m2.invar \\ \n \\ m2.\\ \\ = (\\k. Option.bind (map_op_\\ ops1 m k) (f k)) |` it\"\n in m1.old_iterate_rule_insert_P)\n\n apply auto []\n apply (auto simp: m2.empty_correct) []\n defer\n apply simp []\n apply (rule restrict_map_dom_subset)\n apply (auto) []\n apply (case_tac \"m1.\\ m x\")\n apply (auto) [2]\n\n apply (auto split: option.split simp: m2.update_dj_correct intro!: ext)\n apply (auto simp: restrict_map_def)\n done\nend\n\nsublocale g_value_image_filter_loc \n < map_value_image_filter m1.\\ m1.invar m2.\\ m2.invar g_value_image_filter\n by (rule g_value_image_filter_impl)\n\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/gen_algo/MapGA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2966962745201913}} {"text": "section \\Syntactic Criteria\\\ntheory Syntactic_Criteria\n imports Compositionality\nbegin\n\ncontext PL_Indis\nbegin\n\nlemma proper_intros[intro]:\n \"proper Done\"\n \"proper (Atm atm)\"\n \"proper c1 \\ proper c2 \\ proper (Seq c1 c2)\"\n \"proper c1 \\ proper c2 \\ proper (Ch ch c1 c2)\"\n \"proper c \\ proper (While tst c)\"\n \"properL cs \\ proper (Par cs)\"\n \"properL cs \\ proper (ParT cs)\"\n \"(\\c. c \\ set cs \\ proper c) \\ cs \\ [] \\ properL cs\"\n by auto\n\nlemma discr:\n \"discr Done\"\n \"presAtm atm \\ discr (Atm atm)\"\n \"discr c1 \\ discr c2 \\ discr (Seq c1 c2)\"\n \"discr c1 \\ discr c2 \\ discr (Ch ch c1 c2)\"\n \"discr c \\ discr (While tst c)\"\n \"properL cs \\ (\\c. c \\ set cs \\ discr c) \\ discr (Par cs)\"\n \"properL cs \\ (\\c. c \\ set cs \\ discr c) \\ discr (ParT cs)\"\n by (auto intro!: discr_Par discr_ParT)\n\nlemma siso:\n \"compatAtm atm \\ siso (Atm atm)\"\n \"siso c1 \\ siso c2 \\ siso (Seq c1 c2)\"\n \"compatCh ch \\ siso c1 \\ siso c2 \\ siso (Ch ch c1 c2)\"\n \"compatTst tst \\ siso c \\ siso (While tst c)\"\n \"properL cs \\ (\\c. c \\ set cs \\ siso c) \\ siso (Par cs)\"\n \"properL cs \\ (\\c. c \\ set cs \\ siso c) \\ siso (ParT cs)\"\n by (auto intro!: siso_Par siso_ParT)\n\nlemma Sbis:\n \"compatAtm atm \\ Atm atm \\s Atm atm\"\n \"siso c1 \\ c2 \\s c2 \\ Seq c1 c2 \\s Seq c1 c2\"\n \"proper c1 \\ proper c2 \\ c1 \\s c1 \\ discr c2 \\ Seq c1 c2 \\s Seq c1 c2\"\n \"compatCh ch \\ c1 \\s c1 \\ c2 \\s c2 \\ Ch ch c1 c2 \\s Ch ch c1 c2\"\n \"properL cs \\ (\\c. c \\ set cs \\ c \\s c) \\ Par cs \\s Par cs\"\n by (auto intro!: Par_Sbis)\n\nlemma ZObis:\n \"compatAtm atm \\ Atm atm \\01 Atm atm\"\n \"siso c1 \\ c2 \\01 c2 \\ Seq c1 c2 \\01 Seq c1 c2\"\n \"proper c1 \\ proper c2 \\ c1 \\01 c1 \\ discr c2 \\ Seq c1 c2 \\01 Seq c1 c2\"\n \"compatCh ch \\ c1 \\01 c1 \\ c2 \\01 c2 \\ Ch ch c1 c2 \\01 Ch ch c1 c2\"\n \"properL cs \\ (\\c. c \\ set cs \\ c \\s c) \\ ParT cs \\01 ParT cs\"\n by (auto intro!: ParT_ZObis)\n\nlemma discr_imp_Sbis: \"proper c \\ discr c \\ c \\s c\"\n by auto\n\nlemma siso_imp_Sbis: \"siso c \\ c \\s c\"\n by auto\n\nlemma Sbis_imp_ZObis: \"c \\s c \\ c \\01 c\"\n by auto\n\n\n(* The syntactic predicates: SC_\\ corresponds to the paper's overlined \\: *) \n\nfun SC_discr where\n \"SC_discr Done \\ True\"\n| \"SC_discr (Atm atm) \\ presAtm atm\"\n| \"SC_discr (Seq c1 c2) \\ SC_discr c1 \\ SC_discr c2\"\n| \"SC_discr (Ch ch c1 c2) \\ SC_discr c1 \\ SC_discr c2\"\n| \"SC_discr (While tst c) \\ SC_discr c\"\n| \"SC_discr (ParT cs) \\ (\\c\\set cs. SC_discr c)\"\n| \"SC_discr (Par cs) \\ (\\c\\set cs. SC_discr c)\"\n\ntheorem SC_discr_discr[intro]: \"proper c \\ SC_discr c \\ discr c\"\n by (induct c) (auto intro!: discr)\n\nfun SC_siso where\n \"SC_siso Done \\ True\"\n| \"SC_siso (Atm atm) \\ compatAtm atm\"\n| \"SC_siso (Seq c1 c2) \\ SC_siso c1 \\ SC_siso c2\"\n| \"SC_siso (Ch ch c1 c2) \\ compatCh ch \\ SC_siso c1 \\ SC_siso c2\"\n| \"SC_siso (While tst c) \\ compatTst tst \\ SC_siso c\"\n| \"SC_siso (Par cs) \\ (\\c\\set cs. SC_siso c)\"\n| \"SC_siso (ParT cs) \\ (\\c\\set cs. SC_siso c)\"\n\ntheorem SC_siso_siso[intro]: \"proper c \\ SC_siso c \\ siso c\"\n by (induct c) (auto intro!: siso)\n\nfun SC_Sbis where\n \"SC_Sbis Done \\ True\"\n| \"SC_Sbis (Atm atm) \\ compatAtm atm\"\n| \"SC_Sbis (Seq c1 c2) \\ (SC_siso c1 \\ SC_Sbis c2) \\\n (SC_Sbis c1 \\ SC_discr c2) \\\n SC_discr (Seq c1 c2) \\ SC_siso (Seq c1 c2)\"\n| \"SC_Sbis (Ch ch c1 c2) \\ (if compatCh ch\n then SC_Sbis c1 \\ SC_Sbis c2\n else (SC_discr (Ch ch c1 c2) \\ SC_siso (Ch ch c1 c2)))\"\n| \"SC_Sbis (While tst c) \\ SC_discr (While tst c) \\ SC_siso (While tst c)\"\n| \"SC_Sbis (Par cs) \\ (\\c\\set cs. SC_Sbis c)\"\n| \"SC_Sbis (ParT cs) \\ SC_siso (ParT cs) \\ SC_discr (ParT cs)\"\n\ntheorem SC_siso_SCbis[intro]: \"SC_siso c \\ SC_Sbis c\"\n by (induct c) auto\n\ntheorem SC_discr_SCbis[intro]: \"SC_discr c \\ SC_Sbis c\"\n by (induct c) auto\n\ndeclare SC_siso.simps[simp del]\n\ndeclare SC_discr.simps[simp del]\n\ntheorem SC_Sbis_Sbis[intro]: \"proper c \\ SC_Sbis c \\ c \\s c\"\n by (induct c)\n (auto intro: Sbis discr_imp_Sbis siso_imp_Sbis\n split: if_split_asm)\n\nfun SC_ZObis where\n \"SC_ZObis Done \\ True\"\n| \"SC_ZObis (Atm atm) \\ compatAtm atm\"\n| \"SC_ZObis (Seq c1 c2) \\ (SC_siso c1 \\ SC_ZObis c2) \\\n (SC_ZObis c1 \\ SC_discr c2) \\\n SC_Sbis (Seq c1 c2)\"\n| \"SC_ZObis (Ch ch c1 c2) \\ (if compatCh ch\n then SC_ZObis c1 \\ SC_ZObis c2\n else SC_Sbis (Ch ch c1 c2))\"\n| \"SC_ZObis (While tst c) \\ SC_Sbis (While tst c)\"\n| \"SC_ZObis (Par cs) \\ SC_Sbis (Par cs)\"\n| \"SC_ZObis (ParT cs) \\ (\\c\\set cs. SC_Sbis c)\"\n\ntheorem SC_Sbis_SC_ZObis[intro]: \"SC_Sbis c \\ SC_ZObis c\"\n by (induct c) (auto simp: SC_siso.simps SC_discr.simps)\n\ndeclare SC_Sbis.simps[simp del]\n\ntheorem SC_ZObis_ZObis: \"proper c \\ SC_ZObis c \\ c \\01 c\"\n apply (induct c)\n apply (auto intro: Sbis_imp_ZObis ZObis split: if_split_asm)\n apply (auto intro!: ZObis(5))\n done\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Probabilistic_Noninterference/Syntactic_Criteria.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.2966962745201913}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory spec_annotated_fn\nimports \"../CTranslation\"\nbegin\n\ndeclare sep_conj_ac [simp add]\n\ninstall_C_file \"spec_annotated_fn.c\"\n\n\nprint_locale spec_annotated_fn_global_addresses\nprint_locale Square_spec\n\nthm Square_spec_def\n\ncontext spec_annotated_fn_global_addresses\nbegin\n\nthm Square_body_def\nthm Square_impl\nthm Square_spec_def\nthm \\_def\n\nend\n\nlemma (in Square_spec) foo:\n shows \"\\ \\ \\ T \\ \\ret__unsigned :== CALL Square(4) \\ \\ret__unsigned = 16 \\ \"\napply vcg\napply simp\ndone\n\nlemma (in spec_annotated_fn_global_addresses)\nshows \"\\n. \\ \\ \\ \\n = n \\ \\ret__unsigned :== PROC Square(\\n)\n \\\\ret__unsigned = n * n \\\"\napply vcg\ndone\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/testfiles/spec_annotated_fn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.2966962745201913}} {"text": "chapter \\Generated by Lem from \\list.lem\\.\\\n\ntheory \"Lem_list\" \n\nimports\n Main\n \"Lem_bool\"\n \"Lem_maybe\"\n \"Lem_basic_classes\"\n \"Lem_function\"\n \"Lem_tuple\"\n \"Lem_num\"\n \"Lem\"\n\nbegin \n\n \n\n(*open import Bool Maybe Basic_classes Function Tuple Num*)\n\n(*open import {coq} `Coq.Lists.List`*)\n(*open import {isabelle} `$LIB_DIR/Lem`*)\n(*open import {hol} `lemTheory` `listTheory` `rich_listTheory` `sortingTheory`*)\n\n(* ========================================================================== *)\n(* Basic list functions *)\n(* ========================================================================== *)\n\n(* The type of lists as well as list literals like [], [1;2], ... are hardcoded. \n Thus, we can directly dive into derived definitions. *)\n\n\n(* ----------------------- *)\n(* cons *)\n(* ----------------------- *)\n\n(*val :: : forall 'a. 'a -> list 'a -> list 'a*)\n\n\n(* ----------------------- *)\n(* Emptyness check *)\n(* ----------------------- *)\n\n(*val null : forall 'a. list 'a -> bool*)\n(*let null l= match l with [] -> true | _ -> false end*)\n\n(* ----------------------- *)\n(* Length *)\n(* ----------------------- *)\n\n(*val length : forall 'a. list 'a -> nat*)\n(*let rec length l=\n match l with\n | [] -> 0\n | x :: xs -> (Instance_Num_NumAdd_nat.+) (length xs) 1\n end*)\n\n(* ----------------------- *)\n(* Equality *)\n(* ----------------------- *)\n\n(*val listEqual : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\n(*val listEqualBy : forall 'a. ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\n\nfun listEqualBy :: \"('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" listEqualBy eq ([]) ([]) = ( True )\"\n|\" listEqualBy eq ([]) (_ # _) = ( False )\"\n|\" listEqualBy eq (_ # _) ([]) = ( False )\"\n|\" listEqualBy eq (x # xs) (y # ys) = ( (eq x y \\ listEqualBy eq xs ys))\"\n\n\n\n(* ----------------------- *)\n(* compare *)\n(* ----------------------- *)\n\n(*val lexicographicCompare : forall 'a. Ord 'a => list 'a -> list 'a -> ordering*)\n(*val lexicographicCompareBy : forall 'a. ('a -> 'a -> ordering) -> list 'a -> list 'a -> ordering*)\n\nfun lexicographicCompareBy :: \"('a \\ 'a \\ ordering)\\ 'a list \\ 'a list \\ ordering \" where \n \" lexicographicCompareBy cmp ([]) ([]) = ( EQ )\"\n|\" lexicographicCompareBy cmp ([]) (_ # _) = ( LT )\"\n|\" lexicographicCompareBy cmp (_ # _) ([]) = ( GT )\"\n|\" lexicographicCompareBy cmp (x # xs) (y # ys) = ( (\n (case cmp x y of \n LT => LT\n | GT => GT\n | EQ => lexicographicCompareBy cmp xs ys\n )\n ))\"\n\n\n(*val lexicographicLess : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessBy less1 less_eq1 ([]) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 (x # xs) (y # ys) = ( ((less1 x y) \\ ((less_eq1 x y) \\ (lexicographicLessBy less1 less_eq1 xs ys))))\"\n\n\n(*val lexicographicLessEq : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessEqBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessEqBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessEqBy less1 less_eq1 ([]) ([]) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessEqBy less1 less_eq1 (x # xs) (y # ys) = ( (less1 x y \\ (less_eq1 x y \\ lexicographicLessEqBy less1 less_eq1 xs ys)))\"\n\n\n\ndefinition instance_Basic_classes_Ord_list_dict :: \" 'a Ord_class \\('a list)Ord_class \" where \n \" instance_Basic_classes_Ord_list_dict dict_Basic_classes_Ord_a = ((|\n\n compare_method = (lexicographicCompareBy \n (compare_method dict_Basic_classes_Ord_a)),\n\n isLess_method = (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isLessEqual_method = (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isGreater_method = (\\ x y. (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x)),\n\n isGreaterEqual_method = (\\ x y. (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x))|) )\"\n\n\n\n(* ----------------------- *)\n(* Append *)\n(* ----------------------- *)\n\n(*val ++ : forall 'a. list 'a -> list 'a -> list 'a*) (* originally append *)\n(*let rec ++ xs ys= match xs with\n | [] -> ys\n | x :: xs' -> x :: (xs' ++ ys)\n end*)\n\n(* ----------------------- *)\n(* snoc *)\n(* ----------------------- *)\n\n(*val snoc : forall 'a. 'a -> list 'a -> list 'a*)\n(*let snoc e l= l ++ [e]*)\n\n\n(* ----------------------- *)\n(* Reverse *)\n(* ----------------------- *)\n\n(* First lets define the function [reverse_append], which is\n closely related to reverse. [reverse_append l1 l2] appends the list [l2] to the reverse of [l1].\n This can be implemented more efficienctly than appending and is\n used to implement reverse. *)\n\n(*val reverseAppend : forall 'a. list 'a -> list 'a -> list 'a*) (* originally named rev_append *)\n(*let rec reverseAppend l1 l2= match l1 with \n | [] -> l2\n | x :: xs -> reverseAppend xs (x :: l2)\n end*)\n\n(* Reversing a list *)\n(*val reverse : forall 'a. list 'a -> list 'a*) (* originally named rev *)\n(*let reverse l= reverseAppend l []*)\n\n(* ----------------------- *)\n(* Map *)\n(* ----------------------- *)\n\n(*val map_tr : forall 'a 'b. list 'b -> ('a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) map_tr :: \" 'b list \\('a \\ 'b)\\ 'a list \\ 'b list \" where \n \" map_tr rev_acc f ([]) = ( List.rev rev_acc )\"\n|\" map_tr rev_acc f (x # xs) = ( map_tr ((f x) # rev_acc) f xs )\" \nby pat_completeness auto\n\n\n(* taken from: https://blogs.janestreet.com/optimizing-list-map/ *)\n(*val count_map : forall 'a 'b. ('a -> 'b) -> list 'a -> nat -> list 'b*)\nfunction (sequential,domintros) count_map :: \"('a \\ 'b)\\ 'a list \\ nat \\ 'b list \" where \n \" count_map f ([]) ctr = ( [])\"\n|\" count_map f (hd1 # tl1) ctr = ( f hd1 # \n (if ctr <( 5000 :: nat) then count_map f tl1 (ctr +( 1 :: nat)) \n else map_tr [] f tl1))\" \nby pat_completeness auto\n\n \n(*val map : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n(*let map f l= count_map f l 0*)\n\n(* ----------------------- *)\n(* Reverse Map *)\n(* ----------------------- *)\n\n(*val reverseMap : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n\n\n(* ========================================================================== *)\n(* Folding *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* fold left *)\n(* ----------------------- *)\n\n(*val foldl : forall 'a 'b. ('a -> 'b -> 'a) -> 'a -> list 'b -> 'a*) (* originally foldl *)\n\n(*let rec foldl f b l= match l with\n | [] -> b\n | x :: xs -> foldl f (f b x) xs\nend*)\n\n\n(* ----------------------- *)\n(* fold right *)\n(* ----------------------- *)\n\n(*val foldr : forall 'a 'b. ('a -> 'b -> 'b) -> 'b -> list 'a -> 'b*) (* originally foldr with different argument order *)\n(*let rec foldr f b l= match l with\n | [] -> b\n | x :: xs -> f x (foldr f b xs)\nend*)\n\n\n(* ----------------------- *)\n(* concatenating lists *)\n(* ----------------------- *)\n\n(*val concat : forall 'a. list (list 'a) -> list 'a*) (* before also called flatten *)\n(*let concat= foldr (++) []*)\n\n\n(* -------------------------- *)\n(* concatenating with mapping *)\n(* -------------------------- *)\n\n(*val concatMap : forall 'a 'b. ('a -> list 'b) -> list 'a -> list 'b*)\n\n\n(* ------------------------- *)\n(* universal qualification *)\n(* ------------------------- *)\n\n(*val all : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally for_all *)\n(*let all P l= foldl (fun r e -> P e && r) true l*)\n\n\n\n(* ------------------------- *)\n(* existential qualification *)\n(* ------------------------- *)\n\n(*val any : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally exist *)\n(*let any P l= foldl (fun r e -> P e || r) false l*)\n\n\n(* ------------------------- *)\n(* dest_init *)\n(* ------------------------- *)\n\n(* get the initial part and the last element of the list in a safe way *)\n\n(*val dest_init : forall 'a. list 'a -> maybe (list 'a * 'a)*) \n\nfun dest_init_aux :: \" 'a list \\ 'a \\ 'a list \\ 'a list*'a \" where \n \" dest_init_aux rev_init last_elem_seen ([]) = ( (List.rev rev_init, last_elem_seen))\"\n|\" dest_init_aux rev_init last_elem_seen (x # xs) = ( dest_init_aux (last_elem_seen # rev_init) x xs )\"\n\n\nfun dest_init :: \" 'a list \\('a list*'a)option \" where \n \" dest_init ([]) = ( None )\"\n|\" dest_init (x # xs) = ( Some (dest_init_aux [] x xs))\"\n\n\n\n(* ========================================================================== *)\n(* Indexing lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* index / nth with maybe *)\n(* ------------------------- *)\n\n(*val index : forall 'a. list 'a -> nat -> maybe 'a*)\n\n(*let rec index l n= match l with \n | [] -> Nothing\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then Just x else index xs ((Instance_Num_NumMinus_nat.-)n 1)\nend*)\n\n(* ------------------------- *)\n(* findIndices *)\n(* ------------------------- *)\n\n(* [findIndices P l] returns the indices of all elements of list [l] that satisfy predicate [P]. \n Counting starts with 0, the result list is sorted ascendingly *)\n(*val findIndices : forall 'a. ('a -> bool) -> list 'a -> list nat*)\n\nfun findIndices_aux :: \" nat \\('a \\ bool)\\ 'a list \\(nat)list \" where \n \" findIndices_aux (i::nat) P ([]) = ( [])\"\n|\" findIndices_aux (i::nat) P (x # xs) = ( if P x then i # findIndices_aux (i +( 1 :: nat)) P xs else findIndices_aux (i +( 1 :: nat)) P xs )\"\n\n(*let findIndices P l= findIndices_aux 0 P l*)\n\n\n\n(* ------------------------- *)\n(* findIndex *)\n(* ------------------------- *)\n\n(* findIndex returns the first index of a list that satisfies a given predicate. *)\n(*val findIndex : forall 'a. ('a -> bool) -> list 'a -> maybe nat*)\n(*let findIndex P l= match findIndices P l with\n | [] -> Nothing\n | x :: _ -> Just x\nend*)\n\n(* ------------------------- *)\n(* elemIndices *)\n(* ------------------------- *)\n\n(*val elemIndices : forall 'a. Eq 'a => 'a -> list 'a -> list nat*)\n\n(* ------------------------- *)\n(* elemIndex *)\n(* ------------------------- *)\n\n(*val elemIndex : forall 'a. Eq 'a => 'a -> list 'a -> maybe nat*)\n\n\n(* ========================================================================== *)\n(* Creating lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* genlist *)\n(* ------------------------- *)\n\n(* [genlist f n] generates the list [f 0; f 1; ... (f (n-1))] *)\n(*val genlist : forall 'a. (nat -> 'a) -> nat -> list 'a*)\n\n\n(*let rec genlist f n=\n match n with\n | 0 -> []\n | n' + 1 -> snoc (f n') (genlist f n')\n end*)\n\n\n(* ------------------------- *)\n(* replicate *)\n(* ------------------------- *)\n\n(*val replicate : forall 'a. nat -> 'a -> list 'a*)\n(*let rec replicate n x=\n match n with\n | 0 -> []\n | n' + 1 -> x :: replicate n' x\n end*)\n\n\n(* ========================================================================== *)\n(* Sublists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* splitAt *)\n(* ------------------------- *)\n\n(* [splitAt n xs] returns a tuple (xs1, xs2), with append xs1 xs2 = xs and \n length xs1 = n. If there are not enough elements \n in [xs], the original list and the empty one are returned. *)\n(*val splitAtAcc : forall 'a. list 'a -> nat -> list 'a -> (list 'a * list 'a)*)\nfunction (sequential,domintros) splitAtAcc :: \" 'a list \\ nat \\ 'a list \\ 'a list*'a list \" where \n \" splitAtAcc revAcc n l = ( \n (case l of\n [] => (List.rev revAcc, [])\n | x # xs => if n \\( 0 :: nat) then (List.rev revAcc, l) else splitAtAcc (x # revAcc) (n-( 1 :: nat)) xs\n ))\" \nby pat_completeness auto\n\n\n(*val splitAt : forall 'a. nat -> list 'a -> (list 'a * list 'a)*)\n(*let rec splitAt n l= \n splitAtAcc [] n l*)\n\n\n(* ------------------------- *)\n(* take *)\n(* ------------------------- *)\n\n(* take n xs returns the prefix of xs of length n, or xs itself if n > length xs *)\n(*val take : forall 'a. nat -> list 'a -> list 'a*)\n(*let take n l= fst (splitAt n l)*)\n\n(* ------------------------- *)\n(* drop *)\n(* ------------------------- *)\n\n(* [drop n xs] drops the first [n] elements of [xs]. It returns the empty list, if [n] > [length xs]. *)\n(*val drop : forall 'a. nat -> list 'a -> list 'a*)\n(*let drop n l= snd (splitAt n l)*)\n\n(* ------------------------------------ *)\n(* splitWhile, takeWhile, and dropWhile *)\n(* ------------------------------------ *)\n\n(*val splitWhile_tr : forall 'a. ('a -> bool) -> list 'a -> list 'a -> (list 'a * list 'a)*)\nfun splitWhile_tr :: \"('a \\ bool)\\ 'a list \\ 'a list \\ 'a list*'a list \" where \n \" splitWhile_tr p ([]) acc1 = (\n (List.rev acc1, []))\"\n|\" splitWhile_tr p (x # xs) acc1 = (\n if p x then\n splitWhile_tr p xs (x # acc1)\n else\n (List.rev acc1, (x # xs)))\"\n\n\n(*val splitWhile : forall 'a. ('a -> bool) -> list 'a -> (list 'a * list 'a)*)\ndefinition splitWhile :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" splitWhile p xs = ( splitWhile_tr p xs [])\"\n\n\n(* [takeWhile p xs] takes the first elements of [xs] that satisfy [p]. *)\n(*val takeWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\ndefinition takeWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" takeWhile p l = ( fst (splitWhile p l))\"\n\n\n(* [dropWhile p xs] drops the first elements of [xs] that satisfy [p]. *)\n(*val dropWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\ndefinition dropWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" dropWhile p l = ( snd (splitWhile p l))\"\n\n\n(* ------------------------- *)\n(* isPrefixOf *)\n(* ------------------------- *)\n\n(*val isPrefixOf : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\nfun isPrefixOf :: \" 'a list \\ 'a list \\ bool \" where \n \" isPrefixOf ([]) _ = ( True )\"\n|\" isPrefixOf (_ # _) ([]) = ( False )\"\n|\" isPrefixOf (x # xs) (y # ys) = ( (x = y) \\ isPrefixOf xs ys )\"\n\n\n(* ------------------------- *)\n(* update *)\n(* ------------------------- *)\n(*val update : forall 'a. list 'a -> nat -> 'a -> list 'a*)\n(*let rec update l n e= \n match l with\n | [] -> []\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then e :: xs else x :: (update xs ((Instance_Num_NumMinus_nat.-) n 1) e)\nend*)\n\n\n\n(* ========================================================================== *)\n(* Searching lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* Membership test *)\n(* ------------------------- *)\n\n(* The membership test, one of the basic list functions, is actually tricky for\n Lem, because it is tricky, which equality to use. From Lem`s point of \n perspective, we want to use the equality provided by the equality type - class.\n This allows for example to check whether a set is in a list of sets.\n\n However, in order to use the equality type class, elem essentially becomes\n existential quantification over lists. For types, which implement semantic\n equality (=) with syntactic equality, this is overly complicated. In\n our theorem prover backend, we would end up with overly complicated, harder\n to read definitions and some of the automation would be harder to apply.\n Moreover, nearly all the old Lem generated code would change and require \n (hopefully minor) adaptions of proofs.\n\n For now, we ignore this problem and just demand, that all instances of\n the equality type class do the right thing for the theorem prover backends. \n*)\n\n(*val elem : forall 'a. Eq 'a => 'a -> list 'a -> bool*)\n(*val elemBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> bool*)\n\ndefinition elemBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ bool \" where \n \" elemBy eq e l = ( ((\\ x \\ (set l). (eq e) x)))\"\n\n(*let elem= elemBy (=)*)\n\n(* ------------------------- *)\n(* Find *)\n(* ------------------------- *)\n(*val find : forall 'a. ('a -> bool) -> list 'a -> maybe 'a*) (* previously not of maybe type *)\n(*let rec find P l= match l with \n | [] -> Nothing\n | x :: xs -> if P x then Just x else find P xs\nend*)\n\n\n(* ----------------------------- *)\n(* Lookup in an associative list *)\n(* ----------------------------- *)\n(*val lookup : forall 'a 'b. Eq 'a => 'a -> list ('a * 'b) -> maybe 'b*)\n(*val lookupBy : forall 'a 'b. ('a -> 'a -> bool) -> 'a -> list ('a * 'b) -> maybe 'b*)\n\n(* DPM: eta-expansion for Coq backend type-inference. *)\ndefinition lookupBy :: \"('a \\ 'a \\ bool)\\ 'a \\('a*'b)list \\ 'b option \" where \n \" lookupBy eq k m = ( map_option (\\ x . snd x) (List.find ( \\x . \n (case x of (k', _) => eq k k' )) m))\"\n\n\n(* ------------------------- *)\n(* filter *)\n(* ------------------------- *)\n(*val filter : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\n(*let rec filter P l= match l with\n | [] -> []\n | x :: xs -> if (P x) then x :: (filter P xs) else filter P xs\n end*)\n\n\n(* ------------------------- *)\n(* partition *)\n(* ------------------------- *)\n(*val partition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\n(*let partition P l= (filter P l, filter (fun x -> not (P x)) l)*)\n\n(*val reversePartition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\ndefinition reversePartition :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" reversePartition P l = ( List.partition P (List.rev l))\"\n\n\n\n(* ------------------------- *)\n(* delete first element *)\n(* with certain property *)\n(* ------------------------- *)\n\n(*val deleteFirst : forall 'a. ('a -> bool) -> list 'a -> maybe (list 'a)*) \n(*let rec deleteFirst P l= match l with\n | [] -> Nothing\n | x :: xs -> if (P x) then Just xs else Maybe.map (fun xs' -> x :: xs') (deleteFirst P xs)\n end*)\n\n\n(*val delete : forall 'a. Eq 'a => 'a -> list 'a -> list 'a*)\n(*val deleteBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> list 'a*)\n\ndefinition deleteBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ 'a list \" where \n \" deleteBy eq x l = ( case_option l id (delete_first (eq x) l))\"\n\n\n\n(* ========================================================================== *)\n(* Zipping and unzipping lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* zip *)\n(* ------------------------- *)\n\n(* zip takes two lists and returns a list of corresponding pairs. If one input list is short, excess elements of the longer list are discarded. *)\n(*val zip : forall 'a 'b. list 'a -> list 'b -> list ('a * 'b)*) (* before combine *)\n(*let rec zip l1 l2= match (l1, l2) with\n | (x :: xs, y :: ys) -> (x, y) :: zip xs ys\n | _ -> []\nend*)\n\n(* ------------------------- *)\n(* unzip *)\n(* ------------------------- *)\n\n(*val unzip: forall 'a 'b. list ('a * 'b) -> (list 'a * list 'b)*)\n(*let rec unzip l= match l with\n | [] -> ([], [])\n | (x, y) :: xys -> let (xs, ys) = unzip xys in (x :: xs, y :: ys)\nend*)\n\n(* ------------------------- *)\n(* distinct elements *)\n(* ------------------------- *)\n\n(*val allDistinct : forall 'a. Eq 'a => list 'a -> bool*)\nfun allDistinct :: \" 'a list \\ bool \" where \n \" allDistinct ([]) = ( True )\"\n|\" allDistinct (x # l') = ( \\ (Set.member x (set l')) \\ allDistinct l' )\"\n\n\n(* some more useful functions *)\n(*val mapMaybe : forall 'a 'b. ('a -> maybe 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapMaybe :: \"('a \\ 'b option)\\ 'a list \\ 'b list \" where \n \" mapMaybe f ([]) = ( [])\"\n|\" mapMaybe f (x # xs) = (\n (case f x of\n None => mapMaybe f xs\n | Some y => y # (mapMaybe f xs)\n ))\" \nby pat_completeness auto\n\n\n(*val mapi : forall 'a 'b. (nat -> 'a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapiAux :: \"(nat \\ 'b \\ 'a)\\ nat \\ 'b list \\ 'a list \" where \n \" mapiAux f (n :: nat) ([]) = ( [])\"\n|\" mapiAux f (n :: nat) (x # xs) = ( (f n x) # mapiAux f (n +( 1 :: nat)) xs )\" \nby pat_completeness auto\n\ndefinition mapi :: \"(nat \\ 'a \\ 'b)\\ 'a list \\ 'b list \" where \n \" mapi f l = ( mapiAux f(( 0 :: nat)) l )\"\n\n\n(*val deletes: forall 'a. Eq 'a => list 'a -> list 'a -> list 'a*)\ndefinition deletes :: \" 'a list \\ 'a list \\ 'a list \" where \n \" deletes xs ys = (\n List.foldl ((\\ x y. remove1 y x)) xs ys )\"\n\n\n(* ========================================================================== *)\n(* Comments (not clean yet, please ignore the rest of the file) *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* skipped from Haskell Lib*)\n(* ----------------------- \n\nintersperse :: a -> [a] -> [a]\nintercalate :: [a] -> [[a]] -> [a]\ntranspose :: [[a]] -> [[a]]\nsubsequences :: [a] -> [[a]]\npermutations :: [a] -> [[a]]\nfoldl` :: (a -> b -> a) -> a -> [b] -> aSource\nfoldl1` :: (a -> a -> a) -> [a] -> aSource\n\nand\nor\nsum\nproduct\nmaximum\nminimum\nscanl\nscanr\nscanl1\nscanr1\nAccumulating maps\n\nmapAccumL :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\nmapAccumR :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\n\niterate :: (a -> a) -> a -> [a]\nrepeat :: a -> [a]\ncycle :: [a] -> [a]\nunfoldr\n\n\ntakeWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhileEnd :: (a -> Bool) -> [a] -> [a]Source\nspan :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak p is equivalent to span (not . p).\nstripPrefix :: Eq a => [a] -> [a] -> Maybe [a]Source\ngroup :: Eq a => [a] -> [[a]]Source\ninits :: [a] -> [[a]]Source\ntails :: [a] -> [[a]]Source\n\n\nisPrefixOf :: Eq a => [a] -> [a] -> BoolSource\nisSuffixOf :: Eq a => [a] -> [a] -> BoolSource\nisInfixOf :: Eq a => [a] -> [a] -> BoolSource\n\n\n\nnotElem :: Eq a => a -> [a] -> BoolSource\n\nzip3 :: [a] -> [b] -> [c] -> [(a, b, c)]Source\nzip4 :: [a] -> [b] -> [c] -> [d] -> [(a, b, c, d)]Source\nzip5 :: [a] -> [b] -> [c] -> [d] -> [e] -> [(a, b, c, d, e)]Source\nzip6 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [(a, b, c, d, e, f)]Source\nzip7 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [(a, b, c, d, e, f, g)]Source\n\nzipWith :: (a -> b -> c) -> [a] -> [b] -> [c]Source\nzipWith3 :: (a -> b -> c -> d) -> [a] -> [b] -> [c] -> [d]Source\nzipWith4 :: (a -> b -> c -> d -> e) -> [a] -> [b] -> [c] -> [d] -> [e]Source\nzipWith5 :: (a -> b -> c -> d -> e -> f) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f]Source\nzipWith6 :: (a -> b -> c -> d -> e -> f -> g) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g]Source\nzipWith7 :: (a -> b -> c -> d -> e -> f -> g -> h) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [h]Source\n\n\nunzip3 :: [(a, b, c)] -> ([a], [b], [c])Source\nunzip4 :: [(a, b, c, d)] -> ([a], [b], [c], [d])Source\nunzip5 :: [(a, b, c, d, e)] -> ([a], [b], [c], [d], [e])Source\nunzip6 :: [(a, b, c, d, e, f)] -> ([a], [b], [c], [d], [e], [f])Source\nunzip7 :: [(a, b, c, d, e, f, g)] -> ([a], [b], [c], [d], [e], [f], [g])Source\n\n\nlines :: String -> [String]Source\nwords :: String -> [String]Source\nunlines :: [String] -> StringSource\nunwords :: [String] -> StringSource\nnub :: Eq a => [a] -> [a]Source\ndelete :: Eq a => a -> [a] -> [a]Source\n\n() :: Eq a => [a] -> [a] -> [a]Source\nunion :: Eq a => [a] -> [a] -> [a]Source\nintersect :: Eq a => [a] -> [a] -> [a]Source\nsort :: Ord a => [a] -> [a]Source\ninsert :: Ord a => a -> [a] -> [a]Source\n\n\nnubBy :: (a -> a -> Bool) -> [a] -> [a]Source\ndeleteBy :: (a -> a -> Bool) -> a -> [a] -> [a]Source\ndeleteFirstsBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nunionBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nintersectBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\ngroupBy :: (a -> a -> Bool) -> [a] -> [[a]]Source\nsortBy :: (a -> a -> Ordering) -> [a] -> [a]Source\ninsertBy :: (a -> a -> Ordering) -> a -> [a] -> [a]Source\nmaximumBy :: (a -> a -> Ordering) -> [a] -> aSource\nminimumBy :: (a -> a -> Ordering) -> [a] -> aSource\ngenericLength :: Num i => [b] -> iSource\ngenericTake :: Integral i => i -> [a] -> [a]Source\ngenericDrop :: Integral i => i -> [a] -> [a]Source\ngenericSplitAt :: Integral i => i -> [b] -> ([b], [b])Source\ngenericIndex :: Integral a => [b] -> a -> bSource\ngenericReplicate :: Integral i => i -> a -> [a]Source\n\n\n*)\n\n\n(* ----------------------- *)\n(* skipped from Lem Lib *)\n(* ----------------------- \n\n\nval for_all2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval exists2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c \nval rev_map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c\nval fold_left2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'a) -> 'a -> list 'b -> list 'c -> 'a\nval fold_right2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'c) -> list 'a -> list 'b -> 'c -> 'c\n\n\n(* now maybe result and called lookup *)\nval assoc : forall 'a 'b. 'a -> list ('a * 'b) -> 'b\nlet inline {ocaml} assoc = Ocaml.List.assoc\n\n\nval mem_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> bool\nval remove_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> list ('a * 'b)\n\n\n\nval stable_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\nval fast_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\n\nval merge : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a -> list 'a\nval intersect : forall 'a. list 'a -> list 'a -> list 'a\n\n\n*)\n\n(*val catMaybes : forall 'a. list (maybe 'a) -> list 'a*)\nfunction (sequential,domintros) catMaybes :: \"('a option)list \\ 'a list \" where \n \" catMaybes ([]) = (\n [])\"\n|\" catMaybes (None # xs') = (\n catMaybes xs' )\"\n|\" catMaybes (Some x # xs') = (\n x # catMaybes xs' )\" \nby pat_completeness auto\n\nend\n", "meta": {"author": "rems-project", "repo": "sail", "sha": "853740ebd169dc81065c8cd076c335a7dea7fdc7", "save_path": "github-repos/isabelle/rems-project-sail", "path": "github-repos/isabelle/rems-project-sail/sail-853740ebd169dc81065c8cd076c335a7dea7fdc7/snapshots/isabelle/lib/lem/Lem_list.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.554470450236115, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2966962666412349}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__4_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx_lemma_inv__4_on_rules imports n_mutualEx_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n shows \"invHoldForRule Interp s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__4) done\n }\n\n ultimately show \"invHoldForRule Interp s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2964600627612183}} {"text": "(* Title: Generative_Probabilistic_Value.thy\n Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory Generative_Probabilistic_Value imports\n Resumption\n Generat\n \"HOL-Types_To_Sets.Types_To_Sets\"\nbegin\n\nhide_const (open) Done\n\nsubsection \\Type definition\\\n\ncontext notes [[bnf_internals]] begin\n\ncodatatype (results'_gpv: 'a, outs'_gpv: 'out, 'in) gpv\n = GPV (the_gpv: \"('a, 'out, 'in \\ ('a, 'out, 'in) gpv) generat spmf\")\n\nend\n\ndeclare gpv.rel_eq [relator_eq]\n\ntext \\Reactive values are like generative, except that they take an input first.\\\n\ntype_synonym ('a, 'out, 'in) rpv = \"'in \\ ('a, 'out, 'in) gpv\"\nprint_translation \\ \\pretty printing for @{typ \"('a, 'out, 'in) rpv\"}\\ \\\n let\n fun tr' [in1, Const (@{type_syntax gpv}, _) $ a $ out $ in2] =\n if in1 = in2 then Syntax.const @{type_syntax rpv} $ a $ out $ in1\n else raise Match;\n in [(@{type_syntax \"fun\"}, K tr')]\n end\n\\\ntyp \"('a, 'out, 'in) rpv\"\ntext \\\n Effectively, @{typ \"('a, 'out, 'in) gpv\"} and @{typ \"('a, 'out, 'in) rpv\"} are mutually recursive.\n\\\n\nlemma eq_GPV_iff: \"f = GPV g \\ the_gpv f = g\"\nby(cases f) auto\n\ndeclare gpv.set[simp del]\n\ndeclare gpv.set_map[simp]\n\nlemma rel_gpv_def':\n \"rel_gpv A B gpv gpv' \\\n (\\gpv''. (\\(x, y) \\ results'_gpv gpv''. A x y) \\ (\\(x, y) \\ outs'_gpv gpv''. B x y) \\\n map_gpv fst fst gpv'' = gpv \\ map_gpv snd snd gpv'' = gpv')\"\nunfolding rel_gpv_def by(auto simp add: BNF_Def.Grp_def)\n\ndefinition results'_rpv :: \"('a, 'out, 'in) rpv \\ 'a set\"\nwhere \"results'_rpv rpv = range rpv \\ results'_gpv\"\n\ndefinition outs'_rpv :: \"('a, 'out, 'in) rpv \\ 'out set\"\nwhere \"outs'_rpv rpv = range rpv \\ outs'_gpv\"\n\nabbreviation rel_rpv\n :: \"('a \\ 'b \\ bool) \\ ('out \\ 'out' \\ bool)\n \\ ('in \\ ('a, 'out, 'in) gpv) \\ ('in \\ ('b, 'out', 'in) gpv) \\ bool\"\nwhere \"rel_rpv A B \\ rel_fun (=) (rel_gpv A B)\"\n\nlemma in_results'_rpv [iff]: \"x \\ results'_rpv rpv \\ (\\input. x \\ results'_gpv (rpv input))\"\nby(simp add: results'_rpv_def)\n\nlemma in_outs_rpv [iff]: \"out \\ outs'_rpv rpv \\ (\\input. out \\ outs'_gpv (rpv input))\"\nby(simp add: outs'_rpv_def)\n\nlemma results'_GPV [simp]:\n \"results'_gpv (GPV r) =\n (set_spmf r \\ generat_pures) \\ \n ((set_spmf r \\ generat_conts) \\ results'_rpv)\"\nby(auto simp add: gpv.set bind_UNION set_spmf_def)\n\nlemma outs'_GPV [simp]:\n \"outs'_gpv (GPV r) =\n (set_spmf r \\ generat_outs) \\ \n ((set_spmf r \\ generat_conts) \\ outs'_rpv)\"\nby(auto simp add: gpv.set bind_UNION set_spmf_def)\n\nlemma outs'_gpv_unfold:\n \"outs'_gpv r =\n (set_spmf (the_gpv r) \\ generat_outs) \\ \n ((set_spmf (the_gpv r) \\ generat_conts) \\ outs'_rpv)\"\nby(cases r) simp\n\nlemma outs'_gpv_induct [consumes 1, case_names Out Cont, induct set: outs'_gpv]:\n assumes x: \"x \\ outs'_gpv gpv\"\n and Out: \"\\generat gpv. \\ generat \\ set_spmf (the_gpv gpv); x \\ generat_outs generat \\ \\ P gpv\"\n and Cont: \"\\generat gpv c input.\n \\ generat \\ set_spmf (the_gpv gpv); c \\ generat_conts generat; x \\ outs'_gpv (c input); P (c input) \\ \\ P gpv\"\n shows \"P gpv\"\nusing x\napply(induction y\\\"x\" gpv)\n apply(rule Out, simp add: in_set_spmf, simp)\napply(erule imageE, rule Cont, simp add: in_set_spmf, simp, simp, simp)\n.\n\nlemma outs'_gpv_cases [consumes 1, case_names Out Cont, cases set: outs'_gpv]:\n assumes \"x \\ outs'_gpv gpv\"\n obtains (Out) generat where \"generat \\ set_spmf (the_gpv gpv)\" \"x \\ generat_outs generat\"\n | (Cont) generat c input where \"generat \\ set_spmf (the_gpv gpv)\" \"c \\ generat_conts generat\" \"x \\ outs'_gpv (c input)\"\nusing assms by cases(auto simp add: in_set_spmf)\n\nlemma outs'_gpvI [intro?]:\n shows outs'_gpv_Out: \"\\ generat \\ set_spmf (the_gpv gpv); x \\ generat_outs generat \\ \\ x \\ outs'_gpv gpv\"\n and outs'_gpv_Cont: \"\\ generat \\ set_spmf (the_gpv gpv); c \\ generat_conts generat; x \\ outs'_gpv (c input) \\ \\ x \\ outs'_gpv gpv\"\nby(auto intro: gpv.set_sel simp add: in_set_spmf)\n\nlemma results'_gpv_induct [consumes 1, case_names Pure Cont, induct set: results'_gpv]:\n assumes x: \"x \\ results'_gpv gpv\"\n and Pure: \"\\generat gpv. \\ generat \\ set_spmf (the_gpv gpv); x \\ generat_pures generat \\ \\ P gpv\"\n and Cont: \"\\generat gpv c input.\n \\ generat \\ set_spmf (the_gpv gpv); c \\ generat_conts generat; x \\ results'_gpv (c input); P (c input) \\ \\ P gpv\"\n shows \"P gpv\"\nusing x\napply(induction y\\\"x\" gpv)\n apply(rule Pure; simp add: in_set_spmf)\napply(erule imageE, rule Cont, simp add: in_set_spmf, simp, simp, simp)\n.\n\nlemma results'_gpv_cases [consumes 1, case_names Pure Cont, cases set: results'_gpv]:\n assumes \"x \\ results'_gpv gpv\"\n obtains (Pure) generat where \"generat \\ set_spmf (the_gpv gpv)\" \"x \\ generat_pures generat\"\n | (Cont) generat c input where \"generat \\ set_spmf (the_gpv gpv)\" \"c \\ generat_conts generat\" \"x \\ results'_gpv (c input)\"\nusing assms by cases(auto simp add: in_set_spmf)\n\nlemma results'_gpvI [intro?]:\n shows results'_gpv_Pure: \"\\ generat \\ set_spmf (the_gpv gpv); x \\ generat_pures generat \\ \\ x \\ results'_gpv gpv\"\n and results'_gpv_Cont: \"\\ generat \\ set_spmf (the_gpv gpv); c \\ generat_conts generat; x \\ results'_gpv (c input) \\ \\ x \\ results'_gpv gpv\"\nby(auto intro: gpv.set_sel simp add: in_set_spmf)\n\nlemma left_unique_rel_gpv [transfer_rule]:\n \"\\ left_unique A; left_unique B \\ \\ left_unique (rel_gpv A B)\"\nunfolding left_unique_alt_def gpv.rel_conversep[symmetric] gpv.rel_compp[symmetric]\nby(subst gpv.rel_eq[symmetric])(rule gpv.rel_mono)\n\nlemma right_unique_rel_gpv [transfer_rule]:\n \"\\ right_unique A; right_unique B \\ \\ right_unique (rel_gpv A B)\"\nunfolding right_unique_alt_def gpv.rel_conversep[symmetric] gpv.rel_compp[symmetric]\nby(subst gpv.rel_eq[symmetric])(rule gpv.rel_mono)\n\nlemma bi_unique_rel_gpv [transfer_rule]:\n \"\\ bi_unique A; bi_unique B \\ \\ bi_unique (rel_gpv A B)\"\nunfolding bi_unique_alt_def by(simp add: left_unique_rel_gpv right_unique_rel_gpv)\n\nlemma left_total_rel_gpv [transfer_rule]:\n \"\\ left_total A; left_total B \\ \\ left_total (rel_gpv A B)\"\nunfolding left_total_alt_def gpv.rel_conversep[symmetric] gpv.rel_compp[symmetric]\nby(subst gpv.rel_eq[symmetric])(rule gpv.rel_mono)\n\nlemma right_total_rel_gpv [transfer_rule]:\n \"\\ right_total A; right_total B \\ \\ right_total (rel_gpv A B)\"\nunfolding right_total_alt_def gpv.rel_conversep[symmetric] gpv.rel_compp[symmetric]\nby(subst gpv.rel_eq[symmetric])(rule gpv.rel_mono)\n\nlemma bi_total_rel_gpv [transfer_rule]: \"\\ bi_total A; bi_total B \\ \\ bi_total (rel_gpv A B)\"\nunfolding bi_total_alt_def by(simp add: left_total_rel_gpv right_total_rel_gpv)\n\ndeclare gpv.map_transfer[transfer_rule]\n\nlemma if_distrib_map_gpv [if_distribs]:\n \"map_gpv f g (if b then gpv else gpv') = (if b then map_gpv f g gpv else map_gpv f g gpv')\"\nby simp\n\nlemma gpv_pred_mono_strong:\n \"\\ pred_gpv P Q x; \\a. \\ a \\ results'_gpv x; P a \\ \\ P' a; \\b. \\ b \\ outs'_gpv x; Q b \\ \\ Q' b \\ \\ pred_gpv P' Q' x\"\nby(simp add: pred_gpv_def)\n\nlemma pred_gpv_top [simp]:\n \"pred_gpv (\\_. True) (\\_. True) = (\\_. True)\"\nby(simp add: pred_gpv_def)\n\nlemma pred_gpv_conj [simp]:\n shows pred_gpv_conj1: \"\\P Q R. pred_gpv (\\x. P x \\ Q x) R = (\\x. pred_gpv P R x \\ pred_gpv Q R x)\"\n and pred_gpv_conj2: \"\\P Q R. pred_gpv P (\\x. Q x \\ R x) = (\\x. pred_gpv P Q x \\ pred_gpv P R x)\"\nby(auto simp add: pred_gpv_def)\n\nlemma rel_gpv_restrict_relp1I [intro?]:\n \"\\ rel_gpv R R' x y; pred_gpv P P' x; pred_gpv Q Q' y \\ \\ rel_gpv (R \\ P \\ Q) (R' \\ P' \\ Q') x y\"\nby(erule gpv.rel_mono_strong)(simp_all add: pred_gpv_def)\n\nlemma rel_gpv_restrict_relpE [elim?]:\n assumes \"rel_gpv (R \\ P \\ Q) (R' \\ P' \\ Q') x y\"\n obtains \"rel_gpv R R' x y\" \"pred_gpv P P' x\" \"pred_gpv Q Q' y\"\nproof\n show \"rel_gpv R R' x y\" using assms by(auto elim!: gpv.rel_mono_strong)\n have \"pred_gpv (Domainp (R \\ P \\ Q)) (Domainp (R' \\ P' \\ Q')) x\" using assms by(fold gpv.Domainp_rel) blast\n then show \"pred_gpv P P' x\" by(rule gpv_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)+\n have \"pred_gpv (Domainp (R \\ P \\ Q)\\\\) (Domainp (R' \\ P' \\ Q')\\\\) y\" using assms\n by(fold gpv.Domainp_rel)(auto simp only: gpv.rel_conversep Domainp_conversep)\n then show \"pred_gpv Q Q' y\" by(rule gpv_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma gpv_pred_map [simp]: \"pred_gpv P Q (map_gpv f g gpv) = pred_gpv (P \\ f) (Q \\ g) gpv\"\nby(simp add: pred_gpv_def)\n\nsubsection \\Generalised mapper and relator\\\n\ncontext includes lifting_syntax begin\n\nprimcorec map_gpv' :: \"('a \\ 'b) \\ ('out \\ 'out') \\ ('ret' \\ 'ret) \\ ('a, 'out, 'ret) gpv \\ ('b, 'out', 'ret') gpv\"\nwhere\n \"map_gpv' f g h gpv = \n GPV (map_spmf (map_generat f g ((\\) (map_gpv' f g h))) (map_spmf (map_generat id id (map_fun h id)) (the_gpv gpv)))\"\n\ndeclare map_gpv'.sel [simp del]\n\nlemma map_gpv'_sel [simp]:\n \"the_gpv (map_gpv' f g h gpv) = map_spmf (map_generat f g (h ---> map_gpv' f g h)) (the_gpv gpv)\"\nby(simp add: map_gpv'.sel spmf.map_comp o_def generat.map_comp map_fun_def[abs_def])\n\nlemma map_gpv'_GPV [simp]:\n \"map_gpv' f g h (GPV p) = GPV (map_spmf (map_generat f g (h ---> map_gpv' f g h)) p)\"\nby(rule gpv.expand) simp\n\nlemma map_gpv'_id: \"map_gpv' id id id = id\"\napply(rule ext)\napply(coinduction)\napply(auto simp add: spmf_rel_map generat.rel_map rel_fun_def intro!: rel_spmf_reflI generat.rel_refl)\ndone\n\nlemma map_gpv'_comp: \"map_gpv' f g h (map_gpv' f' g' h' gpv) = map_gpv' (f \\ f') (g \\ g') (h' \\ h) gpv\"\nby(coinduction arbitrary: gpv)(auto simp add: spmf.map_comp spmf_rel_map generat.rel_map rel_fun_def intro!: rel_spmf_reflI generat.rel_refl)\n\nfunctor gpv: map_gpv' by(simp_all add: map_gpv'_comp map_gpv'_id o_def) \n\nlemma map_gpv_conv_map_gpv': \"map_gpv f g = map_gpv' f g id\"\napply(rule ext)\napply(coinduction)\napply(auto simp add: gpv.map_sel spmf_rel_map generat.rel_map rel_fun_def intro!: generat.rel_refl_strong rel_spmf_reflI)\ndone\n\ncoinductive rel_gpv'' :: \"('a \\ 'b \\ bool) \\ ('out \\ 'out' \\ bool) \\ ('ret \\ 'ret' \\ bool) \\ ('a, 'out, 'ret) gpv \\ ('b, 'out', 'ret') gpv \\ bool\"\n for A C R\nwhere\n \"rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R)) (the_gpv gpv) (the_gpv gpv')\n \\ rel_gpv'' A C R gpv gpv'\"\n\nlemma rel_gpv''_coinduct [consumes 1, case_names rel_gpv'', coinduct pred: rel_gpv'']:\n \"\\X gpv gpv';\n \\gpv gpv'. X gpv gpv'\n \\ rel_spmf (rel_generat A C (R ===> (\\gpv gpv'. X gpv gpv' \\ rel_gpv'' A C R gpv gpv')))\n (the_gpv gpv) (the_gpv gpv') \\\n \\ rel_gpv'' A C R gpv gpv'\"\nby(erule rel_gpv''.coinduct) blast\n\nlemma rel_gpv''D:\n \"rel_gpv'' A C R gpv gpv' \n \\ rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R)) (the_gpv gpv) (the_gpv gpv')\"\nby(simp add: rel_gpv''.simps)\n\nlemma rel_gpv''_GPV [simp]:\n \"rel_gpv'' A C R (GPV p) (GPV q) \\\n rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R)) p q\"\nby(simp add: rel_gpv''.simps)\n\nlemma rel_gpv_conv_rel_gpv'': \"rel_gpv A C = rel_gpv'' A C (=)\"\nproof(rule ext iffI)+\n show \"rel_gpv A C gpv gpv'\" if \"rel_gpv'' A C (=) gpv gpv'\" for gpv :: \"('a, 'b, 'c) gpv\" and gpv' :: \"('d, 'e, 'c) gpv\"\n using that by(coinduct)(blast dest: rel_gpv''D)\n show \"rel_gpv'' A C (=) gpv gpv'\" if \"rel_gpv A C gpv gpv'\" for gpv :: \"('a, 'b, 'c) gpv\" and gpv' :: \"('d, 'e, 'c) gpv\"\n using that by(coinduct)(auto elim!: gpv.rel_cases rel_spmf_mono generat.rel_mono_strong rel_fun_mono)\nqed\n\nlemma rel_gpv''_eq (* [relator_eq] do not use this attribute unless all transfer rules for gpv have been changed to rel_gvp'' *):\n \"rel_gpv'' (=) (=) (=) = (=)\"\nby(simp add: rel_gpv_conv_rel_gpv''[symmetric] gpv.rel_eq)\n\nlemma rel_gpv''_mono:\n assumes \"A \\ A'\" \"C \\ C'\" \"R' \\ R\"\n shows \"rel_gpv'' A C R \\ rel_gpv'' A' C' R'\"\nproof\n show \"rel_gpv'' A' C' R' gpv gpv'\" if \"rel_gpv'' A C R gpv gpv'\" for gpv gpv' using that\n by(coinduct)(auto dest: rel_gpv''D elim!: rel_spmf_mono generat.rel_mono_strong rel_fun_mono intro: assms[THEN predicate2D])\nqed\n\nlemma rel_gpv''_conversep: \"rel_gpv'' A\\\\ C\\\\ R\\\\ = (rel_gpv'' A C R)\\\\\"\nproof(intro ext iffI; simp)\n show \"rel_gpv'' A C R gpv gpv'\" if \"rel_gpv'' A\\\\ C\\\\ R\\\\ gpv' gpv\"\n for A :: \"'a1 \\ 'a2 \\ bool\" and C :: \"'c1 \\ 'c2 \\ bool\" and R :: \"'r1 \\ 'r2 \\ bool\" and gpv gpv'\n using that apply(coinduct)\n apply(drule rel_gpv''D)\n apply(rewrite in \\ conversep_iff[symmetric])\n apply(subst spmf_rel_conversep[symmetric])\n apply(erule rel_spmf_mono)\n apply(subst generat.rel_conversep[symmetric])\n apply(erule generat.rel_mono_strong)\n apply(auto simp add: rel_fun_def conversep_iff[abs_def])\n done\n from this[of \"A\\\\\" \"C\\\\\" \"R\\\\\"]\n show \"rel_gpv'' A\\\\ C\\\\ R\\\\ gpv' gpv\" if \"rel_gpv'' A C R gpv gpv'\" for gpv gpv' using that by simp\nqed\n\n\nlemma rel_gpv''_pos_distr:\n \"rel_gpv'' A C R OO rel_gpv'' A' C' R' \\ rel_gpv'' (A OO A') (C OO C') (R OO R')\"\nproof(rule predicate2I; erule relcomppE)\n show \"rel_gpv'' (A OO A') (C OO C') (R OO R') gpv gpv''\"\n if \"rel_gpv'' A C R gpv gpv'\" \"rel_gpv'' A' C' R' gpv' gpv''\"\n for gpv gpv' gpv'' using that\n apply(coinduction arbitrary: gpv gpv' gpv'')\n apply(drule rel_gpv''D)+\n apply(drule (1) rel_spmf_pos_distr[THEN predicate2D, OF relcomppI])\n apply(erule spmf_rel_mono_strong)\n apply(subst (asm) generat.rel_compp[symmetric])\n apply(erule generat.rel_mono_strong, assumption, assumption)\n apply(drule pos_fun_distr[THEN predicate2D])\n apply(auto simp add: rel_fun_def)\n done\nqed\n\nlemma left_unique_rel_gpv'':\n \"\\ left_unique A; left_unique C; left_total R \\ \\ left_unique (rel_gpv'' A C R)\"\nunfolding left_unique_alt_def left_total_alt_def rel_gpv''_conversep[symmetric]\napply(subst rel_gpv''_eq[symmetric])\napply(rule order_trans[OF rel_gpv''_pos_distr])\napply(erule (2) rel_gpv''_mono)\ndone\n\nlemma right_unique_rel_gpv'':\n \"\\ right_unique A; right_unique C; right_total R \\ \\ right_unique (rel_gpv'' A C R)\"\nunfolding right_unique_alt_def right_total_alt_def rel_gpv''_conversep[symmetric]\napply(subst rel_gpv''_eq[symmetric])\napply(rule order_trans[OF rel_gpv''_pos_distr])\napply(erule (2) rel_gpv''_mono)\ndone\n\nlemma bi_unique_rel_gpv'' [transfer_rule]:\n \"\\ bi_unique A; bi_unique C; bi_total R \\ \\ bi_unique (rel_gpv'' A C R)\"\nunfolding bi_unique_alt_def bi_total_alt_def by(blast intro: left_unique_rel_gpv'' right_unique_rel_gpv'')\n\nlemma rel_gpv''_neg_distr:\n assumes R: \"left_unique R\" \"right_total R\"\n and R': \"right_unique R'\" \"left_total R'\"\n shows \"rel_gpv'' (A OO A') (C OO C') (R OO R') \\ rel_gpv'' A C R OO rel_gpv'' A' C' R'\"\nproof(rule predicate2I relcomppI)+\n fix gpv gpv''\n assume *: \"rel_gpv'' (A OO A') (C OO C') (R OO R') gpv gpv''\"\n let ?P_spmf = \"\\gpv gpv'' pq. \n (\\(generat, generat'') \\ set_spmf pq. rel_generat (A OO A') (C OO C') (R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) generat generat'') \\\n map_spmf fst pq = the_gpv gpv \\\n map_spmf snd pq = the_gpv gpv''\"\n define pq where \"pq gpv gpv'' = Eps (?P_spmf gpv gpv'')\" for gpv gpv''\n let ?P_generat = \"\\generat generat'' gg'. \n (\\(a, a'') \\ generat_pures gg'. (A OO A') a a'') \\ (\\(out, out'') \\ generat_outs gg'. (C OO C') out out'') \\ (\\(c, c'')\\generat_conts gg'. (R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) c c'') \\\n map_generat fst fst fst gg' = generat \\ \n map_generat snd snd snd gg' = generat''\"\n define gg' where \"gg' generat generat'' = Eps (?P_generat generat generat'')\" for generat generat''\n define middle where \"middle \\ corec_gpv (\\(gpv, gpv''). \n map_spmf (\\(generat, generat''). \n map_generat (\\(a, a''). SOME a'. A a a' \\ A' a' a'') (\\(out, out''). SOME out'. C out out' \\ C' out' out'')\n (\\(rpv, rpv'') input. Inr (rpv (THE x. R x input), rpv'' (THE z. R' input z))) (gg' generat generat'')\n ) (pq gpv gpv''))\"\n have sel_middle:\n \"the_gpv (middle (gpv, gpv'')) = map_spmf (\\(generat, generat''). map_generat\n (\\(a, a''). SOME a'. A a a' \\ A' a' a'')\n (\\(out, out''). SOME out'. C out out' \\ C' out' out'')\n (\\(rpv, rpv'') xa. middle (rpv (THE x. R x xa), rpv'' (THE x''. R' xa x'')))\n (gg' generat generat''))\n (pq gpv gpv'')\"\n for gpv gpv'' unfolding middle_def by(simp add: spmf.map_comp split_def o_def generat.map_comp)\n from * show \"rel_gpv'' A C R gpv (middle (gpv, gpv''))\"\n proof(coinduction arbitrary: gpv gpv'')\n case (rel_gpv'' gpv gpv'')\n let ?X = \"\\gpv gpv'. (\\gpv''. gpv' = middle (gpv, gpv'') \\ rel_gpv'' (A OO A') (C OO C') (R OO R') gpv gpv'') \\ rel_gpv'' A C R gpv gpv'\"\n from rel_gpv''D[OF rel_gpv''] have \"Ex (?P_spmf gpv gpv'')\" by(auto simp add: rel_spmf_simps)\n hence pq: \"?P_spmf gpv gpv'' (pq gpv gpv'')\" unfolding pq_def by(rule someI_ex)\n hence \"rel_spmf (\\generat (generat', generat''). generat = generat')\\\\ (pq gpv gpv'') (the_gpv gpv)\"\n by(fold spmf_rel_eq)(auto simp add: spmf_rel_map split_def elim: rel_spmf_mono)\n then show ?case\n proof(clarsimp simp add: sel_middle spmf_rel_conversep spmf_rel_map generat.rel_map prod.case_distrib[where h=\"A _\"] prod.case_distrib[where h=\"C _\"] prod.case_distrib[where h=\"rel_fun _ _ _\"] elim!: rel_spmf_mono_strong)\n fix generat generat''\n assume \"(generat, generat'') \\ set_spmf (pq gpv gpv'')\"\n with pq have \"rel_generat (A OO A') (C OO C') (R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) generat generat''\"\n by blast\n hence \"Ex (?P_generat generat generat'')\" by(auto simp add: Grp_def generat.rel_compp_Grp)\n hence gg': \"?P_generat generat generat'' (gg' generat generat'')\" unfolding gg'_def by(rule someI_ex)\n hence \"rel_generat (\\a aa''. a = fst aa'')\\\\ (\\out outout''. out = fst outout'')\\\\ (\\rpv rpvrpv''. rpv = fst rpvrpv'')\\\\ (gg' generat generat'') generat\"\n by(fold generat.rel_eq)(auto simp add: generat.rel_map elim!: generat.rel_mono_strong)\n then show \"rel_generat (\\a (aa, a''). A a (SOME a'. A aa a' \\ A' a' a''))\n (\\out (outt, out''). C out (SOME out'. C outt out' \\ C' out' out''))\n (\\rpv (rpvv, rpv''). (R ===> ?X) rpv (\\y. middle (rpvv (THE x. R x y), rpv'' (THE z. R' y z))))\n generat (gg' generat generat'')\"\n unfolding generat.rel_conversep conversep_iff apply(rule generat.rel_mono_strong)\n proof(safe, simp_all)\n fix a a''\n assume \"(a, a'') \\ generat_pures (gg' generat generat'')\"\n with gg' have \"\\a'. A a a' \\ A' a' a''\" by blast\n from someI_ex[OF this] show \"A a (SOME a'. A a a' \\ A' a' a'')\" ..\n next\n fix out out''\n assume \"(out, out'') \\ generat_outs (gg' generat generat'')\"\n with gg' have \"\\out'. C out out' \\ C' out' out''\" by blast\n from someI_ex[OF this] show \"C out (SOME out'. C out out' \\ C' out' out'')\" ..\n next\n fix rpv rpv''\n assume \"(rpv, rpv'') \\ generat_conts (gg' generat generat'')\"\n with gg' have *: \"(R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) rpv rpv''\" by blast\n show \"(R ===> ?X) rpv (\\y. middle (rpv (THE x. R x y), rpv'' (THE z. R' y z)))\"\n proof(rule rel_funI)\n fix x y\n assume xy: \"R x y\"\n from R' obtain z where yz: \"R' y z\" by(blast elim: left_totalE)\n with xy have \"(R OO R') x z\" by blast\n with * have \"rel_gpv'' (A OO A') (C OO C') (R OO R') (rpv x) (rpv'' z)\" by(rule rel_funD)\n moreover have \"(THE x. R x y) = x\" using xy\n by(rule the_equality)(blast dest: left_uniqueD[OF R(1) xy])\n moreover have \"(THE z. R' y z) = z\" using yz\n by(rule the_equality)(blast dest: right_uniqueD[OF R'(1) yz])\n ultimately show \"?X (rpv x) (middle (rpv (THE x. R x y), rpv'' (THE z. R' y z)))\" by blast\n qed\n qed\n qed\n qed\n from * show \"rel_gpv'' A' C' R' (middle (gpv, gpv'')) gpv''\"\n proof(coinduction arbitrary: gpv gpv'')\n case (rel_gpv'' gpv gpv'')\n let ?X = \"\\gpv' gpv''. (\\gpv. gpv' = middle (gpv, gpv'') \\ rel_gpv'' (A OO A') (C OO C') (R OO R') gpv gpv'') \\ rel_gpv'' A' C' R' gpv' gpv''\"\n from rel_gpv''D[OF rel_gpv''] have \"Ex (?P_spmf gpv gpv'')\" by(auto simp add: rel_spmf_simps)\n hence pq: \"?P_spmf gpv gpv'' (pq gpv gpv'')\" unfolding pq_def by(rule someI_ex)\n hence \"rel_spmf (\\(generat', generat'') generat. generat = generat'') (pq gpv gpv'') (the_gpv gpv'')\"\n by(fold spmf_rel_eq)(auto simp add: spmf_rel_map split_def elim: rel_spmf_mono)\n then show ?case\n proof(clarsimp simp add: sel_middle spmf_rel_conversep spmf_rel_map generat.rel_map prod.case_distrib[where h=\"A'\"] prod.case_distrib[where h=\"C'\"] prod.case_distrib[where h=\"rel_fun _ _\"] elim!: rel_spmf_mono_strong)\n fix generat generat''\n assume \"(generat, generat'') \\ set_spmf (pq gpv gpv'')\"\n with pq have \"rel_generat (A OO A') (C OO C') (R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) generat generat''\"\n by blast\n hence \"Ex (?P_generat generat generat'')\" by(auto simp add: Grp_def generat.rel_compp_Grp)\n hence gg': \"?P_generat generat generat'' (gg' generat generat'')\" unfolding gg'_def by(rule someI_ex)\n hence \"rel_generat (\\aa'' a. a = snd aa'') (\\outout'' out. out = snd outout'') (\\rpvrpv'' rpv. rpv = snd rpvrpv'') (gg' generat generat'') generat''\"\n by(fold generat.rel_eq)(auto simp add: generat.rel_map elim!: generat.rel_mono_strong)\n then show \"rel_generat (\\(a, aa'') a''. A' (SOME a'. A a a' \\ A' a' aa'') a'')\n (\\(out, outt'') out''. C' (SOME out'. C out out' \\ C' out' outt'') out'')\n (\\(rpv, rpvv'') rpv''. (R' ===> ?X) (\\y. middle (rpv (THE x. R x y), rpvv'' (THE z. R' y z))) rpv'')\n (gg' generat generat'') generat''\"\n apply(rule generat.rel_mono_strong)\n proof(safe, simp_all)\n fix a a''\n assume \"(a, a'') \\ generat_pures (gg' generat generat'')\"\n with gg' have \"\\a'. A a a' \\ A' a' a''\" by blast\n from someI_ex[OF this] show \"A' (SOME a'. A a a' \\ A' a' a'') a''\" ..\n next\n fix out out''\n assume \"(out, out'') \\ generat_outs (gg' generat generat'')\"\n with gg' have \"\\out'. C out out' \\ C' out' out''\" by blast\n from someI_ex[OF this] show \"C' (SOME out'. C out out' \\ C' out' out'') out''\" ..\n next\n fix rpv rpv''\n assume \"(rpv, rpv'') \\ generat_conts (gg' generat generat'')\"\n with gg' have *: \"(R OO R' ===> rel_gpv'' (A OO A') (C OO C') (R OO R')) rpv rpv''\" by blast\n show \"(R' ===> ?X) (\\y. middle (rpv (THE x. R x y), rpv'' (THE z. R' y z))) rpv''\"\n proof(rule rel_funI)\n fix y z\n assume yz: \"R' y z\"\n from R obtain x where xy: \"R x y\" by(blast elim: right_totalE)\n with yz have \"(R OO R') x z\" by blast\n with * have \"rel_gpv'' (A OO A') (C OO C') (R OO R') (rpv x) (rpv'' z)\" by(rule rel_funD)\n moreover have \"(THE x. R x y) = x\" using xy\n by(rule the_equality)(blast dest: left_uniqueD[OF R(1) xy])\n moreover have \"(THE z. R' y z) = z\" using yz\n by(rule the_equality)(blast dest: right_uniqueD[OF R'(1) yz])\n ultimately show \"?X (middle (rpv (THE x. R x y), rpv'' (THE z. R' y z))) (rpv'' z)\" by blast\n qed\n qed\n qed\n qed\nqed\n\nlemma left_total_rel_gpv':\n \"\\ left_total A; left_total C; left_unique R; right_total R \\ \\ left_total (rel_gpv'' A C R)\"\nunfolding left_unique_alt_def left_total_alt_def rel_gpv''_conversep[symmetric]\napply(subst rel_gpv''_eq[symmetric])\napply(rule order_trans[rotated])\napply(rule rel_gpv''_neg_distr; simp add: left_unique_alt_def)\napply(rule rel_gpv''_mono; assumption)\ndone\n\nlemma right_total_rel_gpv':\n \"\\ right_total A; right_total C; right_unique R; left_total R \\ \\ right_total (rel_gpv'' A C R)\"\nunfolding right_unique_alt_def right_total_alt_def rel_gpv''_conversep[symmetric]\napply(subst rel_gpv''_eq[symmetric])\napply(rule order_trans[rotated])\napply(rule rel_gpv''_neg_distr; simp add: right_unique_alt_def)\napply(rule rel_gpv''_mono; assumption)\ndone\n\nlemma bi_total_rel_gpv' [transfer_rule]:\n \"\\ bi_total A; bi_total C; bi_unique R; bi_total R \\ \\ bi_total (rel_gpv'' A C R)\"\nunfolding bi_total_alt_def bi_unique_alt_def by(blast intro: left_total_rel_gpv' right_total_rel_gpv')\n\nlemma rel_fun_conversep_grp_grp:\n \"rel_fun (conversep (BNF_Def.Grp UNIV f)) (BNF_Def.Grp B g) = BNF_Def.Grp {x. (x \\ f) ` UNIV \\ B} (map_fun f g)\"\nunfolding rel_fun_def Grp_def simp_thms fun_eq_iff conversep_iff by auto\n\nlemma Quotient_gpv:\n assumes Q1: \"Quotient R1 Abs1 Rep1 T1\"\n and Q2: \"Quotient R2 Abs2 Rep2 T2\"\n and Q3: \"Quotient R3 Abs3 Rep3 T3\"\n shows \"Quotient (rel_gpv'' R1 R2 R3) (map_gpv' Abs1 Abs2 Rep3) (map_gpv' Rep1 Rep2 Abs3) (rel_gpv'' T1 T2 T3)\"\n (is \"Quotient ?R ?abs ?rep ?T\")\nunfolding Quotient_alt_def2\nproof(intro conjI strip iffI; (elim conjE exE)?)\n note [simp] = spmf_rel_map generat.rel_map\n and [elim!] = rel_spmf_mono generat.rel_mono_strong\n and [rule del] = rel_funI and [intro!] = rel_funI\n have Abs1 [simp]: \"Abs1 x = y\" if \"T1 x y\" for x y using Q1 that by(simp add: Quotient_alt_def)\n have Abs2 [simp]: \"Abs2 x = y\" if \"T2 x y\" for x y using Q2 that by(simp add: Quotient_alt_def)\n have Abs3 [simp]: \"Abs3 x = y\" if \"T3 x y\" for x y using Q3 that by(simp add: Quotient_alt_def)\n have Rep1: \"T1 (Rep1 x) x\" for x using Q1 by(simp add: Quotient_alt_def)\n have Rep2: \"T2 (Rep2 x) x\" for x using Q2 by(simp add: Quotient_alt_def)\n have Rep3: \"T3 (Rep3 x) x\" for x using Q3 by(simp add: Quotient_alt_def)\n have T1: \"T1 x (Abs1 y)\" if \"R1 x y\" for x y using Q1 that by(simp add: Quotient_alt_def2)\n have T2: \"T2 x (Abs2 y)\" if \"R2 x y\" for x y using Q2 that by(simp add: Quotient_alt_def2)\n have T1': \"T1 x (Abs1 y)\" if \"R1 y x\" for x y using Q1 that by(simp add: Quotient_alt_def2)\n have T2': \"T2 x (Abs2 y)\" if \"R2 y x\" for x y using Q2 that by(simp add: Quotient_alt_def2)\n have R3: \"R3 x (Rep3 y)\" if \"T3 x y\" for x y using Q3 that by(simp add: Quotient_alt_def2 Abs3[OF Rep3])\n have R3': \"R3 (Rep3 y) x\" if \"T3 x y\" for x y using Q3 that by(simp add: Quotient_alt_def2 Abs3[OF Rep3])\n have r1: \"R1 = T1 OO T1\\\\\" using Q1 by(simp add: Quotient_alt_def4)\n have r2: \"R2 = T2 OO T2\\\\\" using Q2 by(simp add: Quotient_alt_def4)\n have r3: \"R3 = T3 OO T3\\\\\" using Q3 by(simp add: Quotient_alt_def4)\n show abs: \"?abs gpv = gpv'\" if \"?T gpv gpv'\" for gpv gpv' using that\n by(coinduction arbitrary: gpv gpv')(drule rel_gpv''D; auto 4 4 intro: Rep3 dest: rel_funD)\n show \"?T (?rep gpv) gpv\" for gpv\n by(coinduction arbitrary: gpv)(auto simp add: Rep1 Rep2 intro!: rel_spmf_reflI generat.rel_refl_strong)\n show \"?T gpv (?abs gpv')\" if \"?R gpv gpv'\" for gpv gpv' using that\n by(coinduction arbitrary: gpv gpv')(drule rel_gpv''D; auto 4 3 simp add: T1 T2 intro!: R3 dest: rel_funD)\n show \"?T gpv (?abs gpv')\" if \"?R gpv' gpv\" for gpv gpv'\n proof -\n from that have \"rel_gpv'' R1\\\\ R2\\\\ R3\\\\ gpv gpv'\" unfolding rel_gpv''_conversep by simp\n then show ?thesis\n by(coinduction arbitrary: gpv gpv')(drule rel_gpv''D; auto 4 3 simp add: T1' T2' intro!: R3' dest: rel_funD)\n qed\n show \"?R gpv gpv'\" if \"?T gpv (?abs gpv')\" \"?T gpv' (?abs gpv)\" for gpv gpv'\n proof -\n from that[THEN abs] have \"?abs gpv' = ?abs gpv\" by simp\n with that have \"(?T OO ?T\\\\) gpv gpv'\" by auto\n hence \"rel_gpv'' (T1 OO T1\\\\) (T2 OO T2\\\\) (T3 OO T3\\\\) gpv gpv'\"\n unfolding rel_gpv''_conversep[symmetric]\n by(rule rel_gpv''_pos_distr[THEN predicate2D])\n thus ?thesis by(simp add: r1 r2 r3)\n qed\nqed\n\nlemma rel_gpv''_Grp: (* does not hold! *)\n \"rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\\\ = \n BNF_Def.Grp {x. results'_gpv x \\ A \\ outs'_gpv x \\ B} (map_gpv' f g h)\"\n (is \"?lhs = ?rhs\")\nproof(intro ext GrpI iffI CollectI conjI subsetI)\n fix gpv gpv'\n assume *: \"?lhs gpv gpv'\"\n then show \"map_gpv' f g h gpv = gpv'\"\n apply(coinduction arbitrary: gpv gpv')\n apply(drule rel_gpv''D)\n apply(auto 4 5 simp add: spmf_rel_map generat.rel_map elim!: rel_spmf_mono generat.rel_mono_strong GrpE intro!: GrpI dest: rel_funD)\n done\n show \"x \\ A\" if \"x \\ results'_gpv gpv\" for x using that *\n proof(induction arbitrary: gpv')\n case (Pure generat gpv)\n have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\\\ ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\\\))) (the_gpv gpv)\"\n using Pure.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n with Pure.hyps show ?case by(simp add: generat.Domainp_rel pred_spmf_def pred_generat_def Domainp_Grp)\n next\n case (Cont generat gpv c input)\n have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\\\ ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\\\))) (the_gpv gpv)\"\n using Cont.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n with Cont.hyps show ?case apply(clarsimp simp add: generat.Domainp_rel pred_spmf_def pred_generat_def)\n apply(drule (1) bspec)+\n apply clarsimp\n apply(drule rel_funD)\n prefer 2\n apply(erule Cont.IH)\n apply(simp add: Grp_def)\n oops\n\n\nlemma the_gpv_parametric':\n \"(rel_gpv'' A C R ===> rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R))) the_gpv the_gpv\"\nby(rule rel_funI)(auto elim: rel_gpv''.cases)\n\nlemma GPV_parametric':\n \"(rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R)) ===> rel_gpv'' A C R) GPV GPV\"\nby(rule rel_funI)(auto)\n\nlemma corec_gpv_parametric':\n \"((S ===> rel_spmf (rel_generat A C (R ===> rel_sum (rel_gpv'' A C R) S))) ===> S ===> rel_gpv'' A C R)\n corec_gpv corec_gpv\"\nproof(rule rel_funI)+\n fix f g s1 s2\n assume fg: \"(S ===> rel_spmf (rel_generat A C (R ===> rel_sum (rel_gpv'' A C R) S))) f g\"\n and s: \"S s1 s2\"\n from s show \"rel_gpv'' A C R (corec_gpv f s1) (corec_gpv g s2)\"\n apply(coinduction arbitrary: s1 s2)\n apply(drule fg[THEN rel_funD])\n apply(simp add: spmf_rel_map)\n apply(erule rel_spmf_mono)\n apply(simp add: generat.rel_map)\n apply(erule generat.rel_mono_strong; clarsimp simp add: o_def)\n apply(rule rel_funI)\n apply(drule (1) rel_funD)\n apply(auto 4 3 elim!: rel_sum.cases)\n done\nqed\n\nlemma map_gpv'_parametric [transfer_rule]:\n \"((A ===> A') ===> (C ===> C') ===> (R' ===> R) ===> rel_gpv'' A C R ===> rel_gpv'' A' C' R') map_gpv' map_gpv'\"\n unfolding map_gpv'_def\n supply corec_gpv_parametric'[transfer_rule] the_gpv_parametric'[transfer_rule]\n by(transfer_prover)\n\nlemma map_gpv_parametric': \"((A ===> A') ===> (C ===> C') ===> rel_gpv'' A C R ===> rel_gpv'' A' C' R) map_gpv map_gpv\"\n unfolding map_gpv_conv_map_gpv'[abs_def] by transfer_prover\n\nend\n\nsubsection \\Simple, derived operations\\\n\nprimcorec Done :: \"'a \\ ('a, 'out, 'in) gpv\"\nwhere \"the_gpv (Done a) = return_spmf (Pure a)\"\n\nprimcorec Pause :: \"'out \\ ('in \\ ('a, 'out, 'in) gpv) \\ ('a, 'out, 'in) gpv\"\nwhere \"the_gpv (Pause out c) = return_spmf (IO out c)\"\n\nprimcorec lift_spmf :: \"'a spmf \\ ('a, 'out, 'in) gpv\"\nwhere \"the_gpv (lift_spmf p) = map_spmf Pure p\"\n\ndefinition Fail :: \"('a, 'out, 'in) gpv\"\nwhere \"Fail = GPV (return_pmf None)\"\n\ndefinition React :: \"('in \\ 'out \\ ('a, 'out, 'in) rpv) \\ ('a, 'out, 'in) rpv\"\nwhere \"React f input = case_prod Pause (f input)\"\n\ndefinition rFail :: \"('a, 'out, 'in) rpv\"\nwhere \"rFail = (\\_. Fail)\"\n\nlemma Done_inject [simp]: \"Done x = Done y \\ x = y\"\nby(simp add: Done.ctr)\n\nlemma Pause_inject [simp]: \"Pause out c = Pause out' c' \\ out = out' \\ c = c'\"\nby(simp add: Pause.ctr)\n\n\n\nlemma outs'_gpv_Done [simp]: \"outs'_gpv (Done x) = {}\"\nby(auto elim: outs'_gpv_cases)\n\nlemma results'_gpv_Done [simp]: \"results'_gpv (Done x) = {x}\"\nby(auto intro: results'_gpvI elim: results'_gpv_cases)\n\nlemma pred_gpv_Done [simp]: \"pred_gpv P Q (Done x) = P x\"\nby(simp add: pred_gpv_def)\n\nlemma outs'_gpv_Pause [simp]: \"outs'_gpv (Pause out c) = insert out (\\input. outs'_gpv (c input))\"\nby(auto 4 4 intro: outs'_gpvI elim: outs'_gpv_cases)\n\nlemma results'_gpv_Pause [simp]: \"results'_gpv (Pause out rpv) = results'_rpv rpv\"\nby(auto 4 4 intro: results'_gpvI elim: results'_gpv_cases)\n\nlemma pred_gpv_Pause [simp]: \"pred_gpv P Q (Pause x c) = (Q x \\ All (pred_gpv P Q \\ c))\"\nby(auto simp add: pred_gpv_def o_def)\n\nlemma lift_spmf_return [simp]: \"lift_spmf (return_spmf x) = Done x\"\nby(simp add: lift_spmf.ctr Done.ctr)\n\nlemma lift_spmf_None [simp]: \"lift_spmf (return_pmf None) = Fail\"\nby(rule gpv.expand)(simp add: Fail_def)\n\nlemma the_gpv_lift_spmf [simp]: \"the_gpv (lift_spmf r) = map_spmf Pure r\"\nby(simp)\n\nlemma outs'_gpv_lift_spmf [simp]: \"outs'_gpv (lift_spmf p) = {}\"\nby(auto 4 3 elim: outs'_gpv_cases)\n\nlemma results'_gpv_lift_spmf [simp]: \"results'_gpv (lift_spmf p) = set_spmf p\"\nby(auto 4 3 elim: results'_gpv_cases intro: results'_gpvI)\n\nlemma pred_gpv_lift_spmf [simp]: \"pred_gpv P Q (lift_spmf p) = pred_spmf P p\"\nby(simp add: pred_gpv_def pred_spmf_def)\n\nlemma lift_spmf_inject [simp]: \"lift_spmf p = lift_spmf q \\ p = q\"\nby(auto simp add: lift_spmf.code dest!: pmf.inj_map_strong[rotated] option.inj_map_strong[rotated])\n\nlemma map_lift_spmf: \"map_gpv f g (lift_spmf p) = lift_spmf (map_spmf f p)\"\nby(rule gpv.expand)(simp add: gpv.map_sel spmf.map_comp o_def)\n\nlemma lift_map_spmf: \"lift_spmf (map_spmf f p) = map_gpv f id (lift_spmf p)\"\nby(rule gpv.expand)(simp add: gpv.map_sel spmf.map_comp o_def)\n\nlemma [simp]:\n shows Fail_neq_Pause: \"Fail \\ Pause out c\"\n and Pause_neq_Fail: \"Pause out c \\ Fail\"\n and Fail_neq_Done: \"Fail \\ Done x\"\n and Done_neq_Fail: \"Done x \\ Fail\"\nby(simp_all add: Fail_def Pause.ctr Done.ctr)\n\ntext \\Add @{typ unit} closure to circumvent SML value restriction\\\n\ndefinition Fail' :: \"unit \\ ('a, 'out, 'in) gpv\"\nwhere [code del]: \"Fail' _ = Fail\"\n\nlemma Fail_code [code_unfold]: \"Fail = Fail' ()\"\nby(simp add: Fail'_def)\n\nlemma Fail'_code [code]:\n \"Fail' x = GPV (return_pmf None)\"\nby(simp add: Fail'_def Fail_def)\n\nlemma Fail_sel [simp]:\n \"the_gpv Fail = return_pmf None\"\nby(simp add: Fail_def)\n\nlemma Fail_eq_GPV_iff [simp]: \"Fail = GPV f \\ f = return_pmf None\"\nby(auto simp add: Fail_def)\n\nlemma outs'_gpv_Fail [simp]: \"outs'_gpv Fail = {}\"\nby(auto elim: outs'_gpv_cases)\n\nlemma results'_gpv_Fail [simp]: \"results'_gpv Fail = {}\"\nby(auto elim: results'_gpv_cases)\n\nlemma pred_gpv_Fail [simp]: \"pred_gpv P Q Fail\"\nby(simp add: pred_gpv_def)\n\nlemma React_inject [iff]: \"React f = React f' \\ f = f'\"\nby(auto simp add: React_def fun_eq_iff split_def intro: prod.expand)\n\nlemma React_apply [simp]: \"f input = (out, c) \\ React f input = Pause out c\"\nby(simp add: React_def)\n\nlemma rFail_apply [simp]: \"rFail input = Fail\"\nby(simp add: rFail_def)\n\nlemma [simp]:\n shows rFail_neq_React: \"rFail \\ React f\"\n and React_neq_rFail: \"React f \\ rFail\"\nby(simp_all add: React_def fun_eq_iff split_beta)\n\nlemma rel_gpv_FailI [simp]: \"rel_gpv A C Fail Fail\"\nby(subst gpv.rel_sel) simp\n\nlemma rel_gpv_Done [iff]: \"rel_gpv A C (Done x) (Done y) \\ A x y\"\nby(subst gpv.rel_sel) simp\n\nlemma rel_gpv''_Done [iff]: \"rel_gpv'' A C R (Done x) (Done y) \\ A x y\"\nby(subst rel_gpv''.simps) simp\n\nlemma rel_gpv_Pause [iff]:\n \"rel_gpv A C (Pause out c) (Pause out' c') \\ C out out' \\ (\\x. rel_gpv A C (c x) (c' x))\"\nby(subst gpv.rel_sel)(simp add: rel_fun_def)\n\nlemma rel_gpv''_Pause [iff]:\n \"rel_gpv'' A C R (Pause out c) (Pause out' c') \\ C out out' \\ (\\x x'. R x x' \\ rel_gpv'' A C R (c x) (c' x'))\"\nby(subst rel_gpv''.simps)(simp add: rel_fun_def)\n\nlemma rel_gpv_lift_spmf [iff]: \"rel_gpv A C (lift_spmf p) (lift_spmf q) \\ rel_spmf A p q\"\nby(subst gpv.rel_sel)(simp add: spmf_rel_map)\n\nlemma rel_gpv''_lift_spmf [iff]:\n \"rel_gpv'' A C R (lift_spmf p) (lift_spmf q) \\ rel_spmf A p q\"\nby(subst rel_gpv''.simps)(simp add: spmf_rel_map)\n\ncontext includes lifting_syntax begin\nlemmas Fail_parametric [transfer_rule] = rel_gpv_FailI\n\nlemma Fail_parametric' [simp]: \"rel_gpv'' A C R Fail Fail\"\nunfolding Fail_def by simp\n\nlemma Done_parametric [transfer_rule]: \"(A ===> rel_gpv A C) Done Done\"\nby(rule rel_funI) simp\n\nlemma Done_parametric': \"(A ===> rel_gpv'' A C R) Done Done\"\nby(rule rel_funI) simp\n\nlemma Pause_parametric [transfer_rule]:\n \"(C ===> ((=) ===> rel_gpv A C) ===> rel_gpv A C) Pause Pause\"\nby(simp add: rel_fun_def)\n\nlemma Pause_parametric':\n \"(C ===> (R ===> rel_gpv'' A C R) ===> rel_gpv'' A C R) Pause Pause\"\nby(simp add: rel_fun_def)\n\nlemma lift_spmf_parametric [transfer_rule]:\n \"(rel_spmf A ===> rel_gpv A C) lift_spmf lift_spmf\"\nby(simp add: rel_fun_def)\n\nlemma lift_spmf_parametric':\n \"(rel_spmf A ===> rel_gpv'' A C R) lift_spmf lift_spmf\"\nby(simp add: rel_fun_def)\nend\n\nlemma map_gpv_Done [simp]: \"map_gpv f g (Done x) = Done (f x)\"\nby(simp add: Done.code)\n\nlemma map_gpv'_Done [simp]: \"map_gpv' f g h (Done x) = Done (f x)\"\nby(simp add: Done.code)\n\nlemma map_gpv_Pause [simp]: \"map_gpv f g (Pause x c) = Pause (g x) (map_gpv f g \\ c)\"\nby(simp add: Pause.code)\n\nlemma map_gpv'_Pause [simp]: \"map_gpv' f g h (Pause x c) = Pause (g x) (map_gpv' f g h \\ c \\ h)\"\nby(simp add: Pause.code map_fun_def)\n\nlemma map_gpv_Fail [simp]: \"map_gpv f g Fail = Fail\"\nby(simp add: Fail_def)\n\nlemma map_gpv'_Fail [simp]: \"map_gpv' f g h Fail = Fail\"\nby(simp add: Fail_def)\n\nsubsection \\Monad structure\\\n\nprimcorec bind_gpv :: \"('a, 'out, 'in) gpv \\ ('a \\ ('b, 'out, 'in) gpv) \\ ('b, 'out, 'in) gpv\"\nwhere\n \"the_gpv (bind_gpv r f) =\n map_spmf (map_generat id id ((\\) (case_sum id (\\r. bind_gpv r f))))\n (the_gpv r \\\n (case_generat\n (\\x. map_spmf (map_generat id id ((\\) Inl)) (the_gpv (f x)))\n (\\out c. return_spmf (IO out (\\input. Inr (c input))))))\"\n\ndeclare bind_gpv.sel [simp del]\n\nadhoc_overloading Monad_Syntax.bind bind_gpv\n\nlemma bind_gpv_unfold [code]:\n \"r \\ f = GPV (\n do {\n generat \\ the_gpv r;\n case generat of Pure x \\ the_gpv (f x)\n | IO out c \\ return_spmf (IO out (\\input. c input \\ f))\n })\"\nunfolding bind_gpv_def\napply(rule gpv.expand)\napply(simp add: map_spmf_bind_spmf)\napply(rule arg_cong[where f=\"bind_spmf (the_gpv r)\"])\napply(auto split: generat.split simp add: map_spmf_bind_spmf fun_eq_iff spmf.map_comp o_def generat.map_comp id_def[symmetric] generat.map_id pmf.map_id option.map_id)\ndone\n\nlemma bind_gpv_code_cong: \"f = f' \\ bind_gpv f g = bind_gpv f' g\" by simp\nsetup \\Code_Simp.map_ss (Simplifier.add_cong @{thm bind_gpv_code_cong})\\\n\nlemma bind_gpv_sel:\n \"the_gpv (r \\ f) =\n do {\n generat \\ the_gpv r;\n case generat of Pure x \\ the_gpv (f x)\n | IO out c \\ return_spmf (IO out (\\input. bind_gpv (c input) f))\n }\"\nby(subst bind_gpv_unfold) simp\n\nlemma bind_gpv_sel' [simp]:\n \"the_gpv (r \\ f) =\n do {\n generat \\ the_gpv r;\n if is_Pure generat then the_gpv (f (result generat))\n else return_spmf (IO (output generat) (\\input. bind_gpv (continuation generat input) f))\n }\"\nunfolding bind_gpv_sel\nby(rule arg_cong[where f=\"bind_spmf (the_gpv r)\"])(simp add: fun_eq_iff split: generat.split)\n\nlemma Done_bind_gpv [simp]: \"Done a \\ f = f a\"\nby(rule gpv.expand)(simp)\n\nlemma bind_gpv_Done [simp]: \"f \\ Done = f\"\nproof(coinduction arbitrary: f rule: gpv.coinduct)\n case (Eq_gpv f)\n have *: \"the_gpv f \\ (case_generat (\\x. return_spmf (Pure x)) (\\out c. return_spmf (IO out (\\input. Inr (c input))))) =\n map_spmf (map_generat id id ((\\) Inr)) (bind_spmf (the_gpv f) return_spmf)\"\n unfolding map_spmf_bind_spmf\n by(rule arg_cong2[where f=bind_spmf])(auto simp add: fun_eq_iff split: generat.split)\n show ?case\n by(auto simp add: * bind_gpv.simps pmf.rel_map option.rel_map[abs_def] generat.rel_map[abs_def] simp del: bind_gpv_sel' intro!: rel_generatI rel_spmf_reflI)\nqed\n\nlemma if_distrib_bind_gpv2 [if_distribs]:\n \"bind_gpv gpv (\\y. if b then f y else g y) = (if b then bind_gpv gpv f else bind_gpv gpv g)\"\nby simp\n\nlemma lift_spmf_bind: \"lift_spmf r \\ f = GPV (r \\ the_gpv \\ f)\"\nby(coinduction arbitrary: r f rule: gpv.coinduct_strong)(auto simp add: bind_map_spmf o_def intro: rel_pmf_reflI rel_optionI rel_generatI)\n\nlemma the_gpv_bind_gpv_lift_spmf [simp]:\n \"the_gpv (bind_gpv (lift_spmf p) f) = bind_spmf p (the_gpv \\ f)\"\nby(simp add: bind_map_spmf o_def)\n\nlemma lift_spmf_bind_spmf: \"lift_spmf (p \\ f) = lift_spmf p \\ (\\x. lift_spmf (f x))\"\nby(rule gpv.expand)(simp add: lift_spmf_bind o_def map_spmf_bind_spmf)\n\nlemma lift_bind_spmf: \"lift_spmf (bind_spmf p f) = bind_gpv (lift_spmf p) (lift_spmf \\ f)\"\nby(rule gpv.expand)(simp add: bind_map_spmf map_spmf_bind_spmf o_def)\n\nlemma GPV_bind:\n \"GPV f \\ g = \n GPV (f \\ (\\generat. case generat of Pure x \\ the_gpv (g x) | IO out c \\ return_spmf (IO out (\\input. c input \\ g))))\"\nby(subst bind_gpv_unfold) simp\n\nlemma GPV_bind':\n \"GPV f \\ g = GPV (f \\ (\\generat. if is_Pure generat then the_gpv (g (result generat)) else return_spmf (IO (output generat) (\\input. continuation generat input \\ g))))\"\nunfolding GPV_bind gpv.inject\nby(rule arg_cong[where f=\"bind_spmf f\"])(simp add: fun_eq_iff split: generat.split)\n\nlemma bind_gpv_assoc:\n fixes f :: \"('a, 'out, 'in) gpv\"\n shows \"(f \\ g) \\ h = f \\ (\\x. g x \\ h)\"\nproof(coinduction arbitrary: f g h rule: gpv.coinduct_strong)\n case (Eq_gpv f g h)\n show ?case\n apply(simp cong del: if_weak_cong)\n apply(rule rel_spmf_bindI[where R=\"(=)\"])\n apply(simp add: option.rel_eq pmf.rel_eq)\n apply(fastforce intro: rel_pmf_return_pmfI rel_generatI rel_spmf_reflI)\n done\nqed\n\nlemma map_gpv_bind_gpv: \"map_gpv f g (bind_gpv gpv h) = bind_gpv (map_gpv id g gpv) (\\x. map_gpv f g (h x))\"\napply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\napply(simp add: bind_gpv.sel gpv.map_sel spmf_rel_map generat.rel_map o_def bind_map_spmf del: bind_gpv_sel')\napply(rule rel_spmf_bind_reflI)\napply(auto simp add: spmf_rel_map generat.rel_map split: generat.split del: rel_funI intro!: rel_spmf_reflI generat.rel_refl rel_funI)\ndone\n\nlemma map_gpv_id_bind_gpv: \"map_gpv f id (bind_gpv gpv g) = bind_gpv gpv (map_gpv f id \\ g)\"\nby(simp add: map_gpv_bind_gpv gpv.map_id o_def)\n\nlemma map_gpv_conv_bind:\n \"map_gpv f (\\x. x) x = bind_gpv x (\\x. Done (f x))\"\nusing map_gpv_bind_gpv[of f \"\\x. x\" x Done] by(simp add: id_def[symmetric] gpv.map_id)\n\nlemma bind_map_gpv: \"bind_gpv (map_gpv f id gpv) g = bind_gpv gpv (g \\ f)\"\nby(simp add: map_gpv_conv_bind id_def bind_gpv_assoc o_def)\n\nlemma outs_bind_gpv:\n \"outs'_gpv (bind_gpv x f) = outs'_gpv x \\ (\\x \\ results'_gpv x. outs'_gpv (f x))\"\n (is \"?lhs = ?rhs\")\nproof(rule Set.set_eqI iffI)+\n fix out\n assume \"out \\ ?lhs\"\n then show \"out \\ ?rhs\"\n proof(induction g\\\"x \\ f\" arbitrary: x)\n case (Out generat)\n then obtain generat' where *: \"generat' \\ set_spmf (the_gpv x)\"\n and **: \"generat \\ set_spmf (if is_Pure generat' then the_gpv (f (result generat'))\n else return_spmf (IO (output generat') (\\input. continuation generat' input \\ f)))\"\n by(auto)\n show ?case\n proof(cases \"is_Pure generat'\")\n case True\n then have \"out \\ outs'_gpv (f (result generat'))\" using Out(2) ** by(auto intro: outs'_gpvI)\n moreover have \"result generat' \\ results'_gpv x\" using * True\n by(auto intro: results'_gpvI generat.set_sel)\n ultimately show ?thesis by blast\n next\n case False\n hence \"out \\ outs'_gpv x\" using * ** Out(2) by(auto intro: outs'_gpvI generat.set_sel)\n thus ?thesis by blast\n qed\n next\n case (Cont generat c input)\n then obtain generat' where *: \"generat' \\ set_spmf (the_gpv x)\"\n and **: \"generat \\ set_spmf (if is_Pure generat' then the_gpv (f (generat.result generat'))\n else return_spmf (IO (generat.output generat') (\\input. continuation generat' input \\ f)))\"\n by(auto)\n show ?case\n proof(cases \"is_Pure generat'\")\n case True\n then have \"out \\ outs'_gpv (f (result generat'))\" using Cont(2-3) ** by(auto intro: outs'_gpvI)\n moreover have \"result generat' \\ results'_gpv x\" using * True\n by(auto intro: results'_gpvI generat.set_sel)\n ultimately show ?thesis by blast\n next\n case False\n then have generat: \"generat = IO (output generat') (\\input. continuation generat' input \\ f)\"\n using ** by simp\n with Cont(2) have \"c input = continuation generat' input \\ f\" by auto\n hence \"out \\ outs'_gpv (continuation generat' input) \\ (\\x\\results'_gpv (continuation generat' input). outs'_gpv (f x))\"\n by(rule Cont)\n thus ?thesis\n proof\n assume \"out \\ outs'_gpv (continuation generat' input)\"\n with * ** False have \"out \\ outs'_gpv x\" by(auto intro: outs'_gpvI generat.set_sel)\n thus ?thesis ..\n next\n assume \"out \\ (\\x\\results'_gpv (continuation generat' input). outs'_gpv (f x))\"\n then obtain y where \"y \\ results'_gpv (continuation generat' input)\" \"out \\ outs'_gpv (f y)\" ..\n from \\y \\ _\\ * ** False have \"y \\ results'_gpv x\" \n by(auto intro: results'_gpvI generat.set_sel)\n with \\out \\ outs'_gpv (f y)\\ show ?thesis by blast\n qed\n qed\n qed\nnext\n fix out\n assume \"out \\ ?rhs\"\n then show \"out \\ ?lhs\"\n proof\n assume \"out \\ outs'_gpv x\"\n thus ?thesis\n proof(induction)\n case (Out generat gpv)\n then show ?case\n by(cases generat)(fastforce intro: outs'_gpvI rev_bexI)+\n next\n case (Cont generat gpv gpv')\n then show ?case\n by(cases generat)(auto 4 4 intro: outs'_gpvI rev_bexI simp add: in_set_spmf set_pmf_bind_spmf simp del: set_bind_spmf)\n qed\n next\n assume \"out \\ (\\x\\results'_gpv x. outs'_gpv (f x))\"\n then obtain y where \"y \\ results'_gpv x\" \"out \\ outs'_gpv (f y)\" ..\n from \\y \\ _\\ show ?thesis\n proof(induction)\n case (Pure generat gpv)\n thus ?case using \\out \\ outs'_gpv _\\\n by(cases generat)(auto 4 5 intro: outs'_gpvI rev_bexI elim: outs'_gpv_cases)\n next\n case (Cont generat gpv gpv')\n thus ?case\n by(cases generat)(auto 4 4 simp add: in_set_spmf simp add: set_pmf_bind_spmf intro: outs'_gpvI rev_bexI simp del: set_bind_spmf)\n qed\n qed\nqed\n\nlemma bind_gpv_Fail [simp]: \"Fail \\ f = Fail\"\nby(subst bind_gpv_unfold)(simp add: Fail_def)\n\nlemma bind_gpv_eq_Fail:\n \"bind_gpv gpv f = Fail \\ (\\x\\set_spmf (the_gpv gpv). is_Pure x) \\ (\\x\\results'_gpv gpv. f x = Fail)\"\n (is \"?lhs = ?rhs\")\nproof(intro iffI conjI strip)\n show ?lhs if ?rhs using that\n by(intro gpv.expand)(auto 4 4 simp add: bind_eq_return_pmf_None intro: results'_gpv_Pure generat.set_sel dest: bspec)\n\n assume ?lhs\n hence *: \"the_gpv (bind_gpv gpv f) = return_pmf None\" by simp\n from * show \"is_Pure x\" if \"x \\ set_spmf (the_gpv gpv)\" for x using that\n by(simp add: bind_eq_return_pmf_None split: if_split_asm)\n show \"f x = Fail\" if \"x \\ results'_gpv gpv\" for x using that *\n by(cases)(auto 4 3 simp add: bind_eq_return_pmf_None elim!: generat.set_cases intro: gpv.expand dest: bspec)\nqed\n\ncontext includes lifting_syntax begin\n\nlemma bind_gpv_parametric [transfer_rule]:\n \"(rel_gpv A C ===> (A ===> rel_gpv B C) ===> rel_gpv B C) bind_gpv bind_gpv\"\nunfolding bind_gpv_def by transfer_prover\n\nlemma bind_gpv_parametric':\n \"(rel_gpv'' A C R ===> (A ===> rel_gpv'' B C R) ===> rel_gpv'' B C R) bind_gpv bind_gpv\"\nunfolding bind_gpv_def supply corec_gpv_parametric'[transfer_rule] the_gpv_parametric'[transfer_rule]\nby(transfer_prover)\n\nend\n\nlemma monad_gpv [locale_witness]: \"monad Done bind_gpv\"\nby(unfold_locales)(simp_all add: bind_gpv_assoc)\n\nlemma monad_fail_gpv [locale_witness]: \"monad_fail Done bind_gpv Fail\"\nby unfold_locales auto\n\nlemma rel_gpv_bindI:\n \"\\ rel_gpv A C gpv gpv'; \\x y. A x y \\ rel_gpv B C (f x) (g y) \\\n \\ rel_gpv B C (bind_gpv gpv f) (bind_gpv gpv' g)\"\nby(fact bind_gpv_parametric[THEN rel_funD, THEN rel_funD, OF _ rel_funI])\n\nlemma bind_gpv_cong:\n \"\\ gpv = gpv'; \\x. x \\ results'_gpv gpv' \\ f x = g x \\ \\ bind_gpv gpv f = bind_gpv gpv' g\"\napply(subst gpv.rel_eq[symmetric])\napply(rule rel_gpv_bindI[where A=\"eq_onp (\\x. x \\ results'_gpv gpv')\"])\n apply(subst (asm) gpv.rel_eq[symmetric])\n apply(erule gpv.rel_mono_strong)\n apply(simp add: eq_onp_def)\n apply simp\napply(clarsimp simp add: gpv.rel_eq eq_onp_def)\ndone\n\ndefinition bind_rpv :: \"('a, 'in, 'out) rpv \\ ('a \\ ('b, 'in, 'out) gpv) \\ ('b, 'in, 'out) rpv\"\nwhere \"bind_rpv rpv f = (\\input. bind_gpv (rpv input) f)\"\n\nlemma bind_rpv_apply [simp]: \"bind_rpv rpv f input = bind_gpv (rpv input) f\"\nby(simp add: bind_rpv_def fun_eq_iff)\n\nadhoc_overloading Monad_Syntax.bind bind_rpv\n\nlemma bind_rpv_code_cong: \"rpv = rpv' \\ bind_rpv rpv f = bind_rpv rpv' f\" by simp\nsetup \\Code_Simp.map_ss (Simplifier.add_cong @{thm bind_rpv_code_cong})\\\n\nlemma bind_rpv_rDone [simp]: \"bind_rpv rpv Done = rpv\"\nby(simp add: bind_rpv_def)\n\nlemma bind_gpv_Pause [simp]: \"bind_gpv (Pause out rpv) f = Pause out (bind_rpv rpv f)\"\nby(rule gpv.expand)(simp add: fun_eq_iff)\n\nlemma bind_rpv_React [simp]: \"bind_rpv (React f) g = React (apsnd (\\rpv. bind_rpv rpv g) \\ f)\"\nby(simp add: React_def split_beta fun_eq_iff)\n\nlemma bind_rpv_assoc: \"bind_rpv (bind_rpv rpv f) g = bind_rpv rpv ((\\gpv. bind_gpv gpv g) \\ f)\"\nby(simp add: fun_eq_iff bind_gpv_assoc o_def)\n\nlemma bind_rpv_Done [simp]: \"bind_rpv Done f = f\"\nby(simp add: bind_rpv_def)\n\nlemma results'_rpv_Done [simp]: \"results'_rpv Done = UNIV\"\nby(auto simp add: results'_rpv_def)\n\n\nsubsection \\ Embedding @{typ \"'a spmf\"} as a monad \\\n\nlemma neg_fun_distr3:\n includes lifting_syntax\n assumes 1: \"left_unique R\" \"right_total R\"\n assumes 2: \"right_unique S\" \"left_total S\"\n shows \"(R OO R' ===> S OO S') \\ ((R ===> S) OO (R' ===> S'))\"\nusing functional_relation[OF 2] functional_converse_relation[OF 1]\nunfolding rel_fun_def OO_def\napply clarify\napply (subst all_comm)\napply (subst all_conj_distrib[symmetric])\napply (intro choice)\nby metis\n\nlocale spmf_to_gpv begin\n\ntext \\\n The lifting package cannot handle free term variables in the merging of transfer rules,\n so for the embedding we define a specialised relator \\rel_gpv'\\\n which acts only on the returned values.\n\\\n\ndefinition rel_gpv' :: \"('a \\ 'b \\ bool) \\ ('a, 'out, 'in) gpv \\ ('b, 'out, 'in) gpv \\ bool\"\nwhere \"rel_gpv' A = rel_gpv A (=)\"\n\nlemma rel_gpv'_eq [relator_eq]: \"rel_gpv' (=) = (=)\"\nunfolding rel_gpv'_def gpv.rel_eq ..\n\nlemma rel_gpv'_mono [relator_mono]: \"A \\ B \\ rel_gpv' A \\ rel_gpv' B\"\nunfolding rel_gpv'_def by(rule gpv.rel_mono; simp)\n\nlemma rel_gpv'_distr [relator_distr]: \"rel_gpv' A OO rel_gpv' B = rel_gpv' (A OO B)\"\nunfolding rel_gpv'_def by (metis OO_eq gpv.rel_compp) \n\nlemma left_unique_rel_gpv' [transfer_rule]: \"left_unique A \\ left_unique (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: left_unique_rel_gpv left_unique_eq)\n\nlemma right_unique_rel_gpv' [transfer_rule]: \"right_unique A \\ right_unique (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: right_unique_rel_gpv right_unique_eq)\n\nlemma bi_unique_rel_gpv' [transfer_rule]: \"bi_unique A \\ bi_unique (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: bi_unique_rel_gpv bi_unique_eq)\n\nlemma left_total_rel_gpv' [transfer_rule]: \"left_total A \\ left_total (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: left_total_rel_gpv left_total_eq)\n\nlemma right_total_rel_gpv' [transfer_rule]: \"right_total A \\ right_total (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: right_total_rel_gpv right_total_eq)\n\nlemma bi_total_rel_gpv' [transfer_rule]: \"bi_total A \\ bi_total (rel_gpv' A)\"\nunfolding rel_gpv'_def by(simp add: bi_total_rel_gpv bi_total_eq)\n\n\ntext \\\n We cannot use \\setup_lifting\\ because @{typ \"('a, 'out, 'in) gpv\"} contains\n type variables which do not appear in @{typ \"'a spmf\"}.\n\\\n\ndefinition cr_spmf_gpv :: \"'a spmf \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere \"cr_spmf_gpv p gpv \\ gpv = lift_spmf p\"\n\ndefinition spmf_of_gpv :: \"('a, 'out, 'in) gpv \\ 'a spmf\"\nwhere \"spmf_of_gpv gpv = (THE p. gpv = lift_spmf p)\"\n\nlemma spmf_of_gpv_lift_spmf [simp]: \"spmf_of_gpv (lift_spmf p) = p\"\nunfolding spmf_of_gpv_def by auto\n\nlemma rel_spmf_setD2:\n \"\\ rel_spmf A p q; y \\ set_spmf q \\ \\ \\x\\set_spmf p. A x y\"\nby(erule rel_spmfE) force\n\nlemma rel_gpv_lift_spmf1: \"rel_gpv A B (lift_spmf p) gpv \\ (\\q. gpv = lift_spmf q \\ rel_spmf A p q)\"\napply(subst gpv.rel_sel)\napply(simp add: spmf_rel_map rel_generat_Pure1)\napply safe\n apply(rule exI[where x=\"map_spmf result (the_gpv gpv)\"])\n apply(clarsimp simp add: spmf_rel_map)\n apply(rule conjI)\n apply(rule gpv.expand)\n apply(simp add: spmf.map_comp)\n apply(subst map_spmf_cong[OF refl, where g=id])\n apply(drule (1) rel_spmf_setD2)\n apply clarsimp\n apply simp\n apply(erule rel_spmf_mono)\n apply clarsimp\napply(clarsimp simp add: spmf_rel_map)\ndone\n\nlemma rel_gpv_lift_spmf2: \"rel_gpv A B gpv (lift_spmf q) \\ (\\p. gpv = lift_spmf p \\ rel_spmf A p q)\"\nby(subst gpv.rel_flip[symmetric])(simp add: rel_gpv_lift_spmf1 pmf.rel_flip option.rel_conversep)\n\ndefinition pcr_spmf_gpv :: \"('a \\ 'b \\ bool) \\ 'a spmf \\ ('b, 'out, 'in) gpv \\ bool\"\nwhere \"pcr_spmf_gpv A = cr_spmf_gpv OO rel_gpv A (=)\"\n\nlemma pcr_cr_eq_spmf_gpv: \"pcr_spmf_gpv (=) = cr_spmf_gpv\"\nby(simp add: pcr_spmf_gpv_def gpv.rel_eq OO_eq)\n\nlemma left_unique_cr_spmf_gpv: \"left_unique cr_spmf_gpv\"\nby(rule left_uniqueI)(simp add: cr_spmf_gpv_def)\n\nlemma left_unique_pcr_spmf_gpv [transfer_rule]:\n \"left_unique A \\ left_unique (pcr_spmf_gpv A)\"\nunfolding pcr_spmf_gpv_def by(intro left_unique_OO left_unique_cr_spmf_gpv left_unique_rel_gpv left_unique_eq)\n\nlemma right_unique_cr_spmf_gpv: \"right_unique cr_spmf_gpv\"\nby(rule right_uniqueI)(simp add: cr_spmf_gpv_def)\n\nlemma right_unique_pcr_spmf_gpv [transfer_rule]:\n \"right_unique A \\ right_unique (pcr_spmf_gpv A)\"\nunfolding pcr_spmf_gpv_def by(intro right_unique_OO right_unique_cr_spmf_gpv right_unique_rel_gpv right_unique_eq)\n\nlemma bi_unique_cr_spmf_gpv: \"bi_unique cr_spmf_gpv\"\nby(simp add: bi_unique_alt_def left_unique_cr_spmf_gpv right_unique_cr_spmf_gpv)\n\nlemma bi_unique_pcr_spmf_gpv [transfer_rule]: \"bi_unique A \\ bi_unique (pcr_spmf_gpv A)\"\nby(simp add: bi_unique_alt_def left_unique_pcr_spmf_gpv right_unique_pcr_spmf_gpv)\n\nlemma left_total_cr_spmf_gpv: \"left_total cr_spmf_gpv\"\nby(rule left_totalI)(simp add: cr_spmf_gpv_def)\n\nlemma left_total_pcr_spmf_gpv [transfer_rule]: \"left_total A ==> left_total (pcr_spmf_gpv A)\"\nunfolding pcr_spmf_gpv_def by(intro left_total_OO left_total_cr_spmf_gpv left_total_rel_gpv left_total_eq)\n\ncontext includes lifting_syntax begin\n\nlemma return_spmf_gpv_transfer':\n \"((=) ===> cr_spmf_gpv) return_spmf Done\"\nby(rule rel_funI)(simp add: cr_spmf_gpv_def)\n\nlemma return_spmf_gpv_transfer [transfer_rule]:\n \"(A ===> pcr_spmf_gpv A) return_spmf Done\"\nunfolding pcr_spmf_gpv_def\napply(rewrite in \"(\\ ===> _) _ _\" eq_OO[symmetric])\napply(rule pos_fun_distr[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\napply(rule relcomppI)\n apply(rule return_spmf_gpv_transfer')\napply transfer_prover\ndone\n\nlemma bind_spmf_gpv_transfer':\n \"(cr_spmf_gpv ===> ((=) ===> cr_spmf_gpv) ===> cr_spmf_gpv) bind_spmf bind_gpv\"\napply(clarsimp simp add: rel_fun_def cr_spmf_gpv_def)\napply(rule gpv.expand)\napply(simp add: bind_map_spmf map_spmf_bind_spmf o_def)\ndone\n\nlemma bind_spmf_gpv_transfer [transfer_rule]:\n \"(pcr_spmf_gpv A ===> (A ===> pcr_spmf_gpv B) ===> pcr_spmf_gpv B) bind_spmf bind_gpv\"\nunfolding pcr_spmf_gpv_def\napply(rewrite in \"(_ ===> (\\ ===> _) ===> _) _ _\" eq_OO[symmetric])\napply(rule fun_mono[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\n apply(rule order.refl)\n apply(rule fun_mono)\n apply(rule neg_fun_distr3[OF left_unique_eq right_total_eq right_unique_cr_spmf_gpv left_total_cr_spmf_gpv])\n apply(rule order.refl)\napply(rule fun_mono[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\n apply(rule order.refl)\n apply(rule pos_fun_distr)\napply(rule pos_fun_distr[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\napply(rule relcomppI)\n apply(rule bind_spmf_gpv_transfer')\napply transfer_prover\ndone\n\nlemma lift_spmf_gpv_transfer':\n \"((=) ===> cr_spmf_gpv) (\\x. x) lift_spmf\"\nby(simp add: rel_fun_def cr_spmf_gpv_def)\n\nlemma lift_spmf_gpv_transfer [transfer_rule]:\n \"(rel_spmf A ===> pcr_spmf_gpv A) (\\x. x) lift_spmf\"\nunfolding pcr_spmf_gpv_def\napply(rewrite in \"(\\ ===> _) _ _\" eq_OO[symmetric])\napply(rule pos_fun_distr[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\napply(rule relcomppI)\n apply(rule lift_spmf_gpv_transfer')\napply transfer_prover\ndone\n\nlemma fail_spmf_gpv_transfer': \"cr_spmf_gpv (return_pmf None) Fail\"\nby(simp add: cr_spmf_gpv_def)\n\nlemma fail_spmf_gpv_transfer [transfer_rule]: \"pcr_spmf_gpv A (return_pmf None) Fail\"\nunfolding pcr_spmf_gpv_def\napply(rule relcomppI)\n apply(rule fail_spmf_gpv_transfer')\napply transfer_prover\ndone\n\nlemma map_spmf_gpv_transfer':\n \"((=) ===> R ===> cr_spmf_gpv ===> cr_spmf_gpv) (\\f g. map_spmf f) map_gpv\"\nby(simp add: rel_fun_def cr_spmf_gpv_def map_lift_spmf)\n\nlemma map_spmf_gpv_transfer [transfer_rule]:\n \"((A ===> B) ===> R ===> pcr_spmf_gpv A ===> pcr_spmf_gpv B) (\\f g. map_spmf f) map_gpv\"\nunfolding pcr_spmf_gpv_def\napply(rewrite in \"((\\ ===> _) ===> _) _ _\" eq_OO[symmetric])\napply(rewrite in \"((_ ===> \\) ===> _) _ _\" eq_OO[symmetric])\napply(rewrite in \"(_ ===> \\ ===> _) _ _\" OO_eq[symmetric])\napply(rule fun_mono[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\n apply(rule neg_fun_distr3[OF left_unique_eq right_total_eq right_unique_eq left_total_eq])\n apply(rule fun_mono[OF order.refl])\n apply(rule pos_fun_distr)\napply(rule fun_mono[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\n apply(rule order.refl)\n apply(rule pos_fun_distr)\napply(rule pos_fun_distr[THEN le_funD, THEN le_funD, THEN le_boolD, THEN mp])\napply(rule relcomppI)\n apply(unfold rel_fun_eq)\n apply(rule map_spmf_gpv_transfer')\napply(unfold rel_fun_eq[symmetric])\napply transfer_prover\ndone\n\nend\n\nend\n\nsubsection \\ Embedding @{typ \"'a option\"} as a monad \\\n\nlocale option_to_gpv begin\n\ninterpretation option_to_spmf .\ninterpretation spmf_to_gpv .\n\ndefinition cr_option_gpv :: \"'a option \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere \"cr_option_gpv x gpv \\ gpv = (lift_spmf \\ return_pmf) x\"\n\nlemma cr_option_gpv_conv_OO:\n \"cr_option_gpv = cr_spmf_option\\\\ OO cr_spmf_gpv\"\nby(simp add: fun_eq_iff relcompp.simps cr_option_gpv_def cr_spmf_gpv_def cr_spmf_option_def)\n\ncontext includes lifting_syntax begin\n\ntext \\These transfer rules should follow from merging the transfer rules, but this has not yet been implemented.\\\n\nlemma return_option_gpv_transfer [transfer_rule]:\n \"((=) ===> cr_option_gpv) Some Done\"\nby(simp add: cr_option_gpv_def rel_fun_def)\n\nlemma bind_option_gpv_transfer [transfer_rule]:\n \"(cr_option_gpv ===> ((=) ===> cr_option_gpv) ===> cr_option_gpv) Option.bind bind_gpv\"\napply(clarsimp simp add: cr_option_gpv_def rel_fun_def)\nsubgoal for x f g by(cases x; simp)\ndone\n\nlemma fail_option_gpv_transfer [transfer_rule]: \"cr_option_gpv None Fail\"\nby(simp add: cr_option_gpv_def)\n\nlemma map_option_gpv_transfer [transfer_rule]:\n \"((=) ===> R ===> cr_option_gpv ===> cr_option_gpv) (\\f g. map_option f) map_gpv\"\nunfolding rel_fun_eq by(simp add: rel_fun_def cr_option_gpv_def map_lift_spmf)\n\nend\n\nend\n\nlocale option_le_gpv begin\n\ninterpretation option_le_spmf .\ninterpretation spmf_to_gpv .\n\ndefinition cr_option_le_gpv :: \"'a option \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere \"cr_option_le_gpv x gpv \\ gpv = (lift_spmf \\ return_pmf) x \\ x = None\"\n\ncontext includes lifting_syntax begin\n\nlemma return_option_le_gpv_transfer [transfer_rule]:\n \"((=) ===> cr_option_le_gpv) Some Done\"\nby(simp add: cr_option_le_gpv_def rel_fun_def)\n\nlemma bind_option_gpv_transfer [transfer_rule]:\n \"(cr_option_le_gpv ===> ((=) ===> cr_option_le_gpv) ===> cr_option_le_gpv) Option.bind bind_gpv\"\napply(clarsimp simp add: cr_option_le_gpv_def rel_fun_def bind_eq_Some_conv)\nsubgoal for f g x y by(erule allE[where x=y]) auto\ndone\n\nlemma fail_option_gpv_transfer [transfer_rule]:\n \"cr_option_le_gpv None Fail\"\nby(simp add: cr_option_le_gpv_def)\n\nlemma map_option_gpv_transfer [transfer_rule]:\n \"(((=) ===> (=)) ===> cr_option_le_gpv ===> cr_option_le_gpv) map_option (\\f. map_gpv f id)\"\nunfolding rel_fun_eq by(simp add: rel_fun_def cr_option_le_gpv_def map_lift_spmf)\n\nend\n\nend\n\nsubsection \\Embedding resumptions\\\n\nprimcorec lift_resumption :: \"('a, 'out, 'in) resumption \\ ('a, 'out, 'in) gpv\"\nwhere\n \"the_gpv (lift_resumption r) = \n (case r of resumption.Done None \\ return_pmf None\n | resumption.Done (Some x') => return_spmf (Pure x')\n | resumption.Pause out c => map_spmf (map_generat id id ((\\) lift_resumption)) (return_spmf (IO out c)))\"\n\nlemma the_gpv_lift_resumption:\n \"the_gpv (lift_resumption r) = \n (if is_Done r then if Option.is_none (resumption.result r) then return_pmf None else return_spmf (Pure (the (resumption.result r)))\n else return_spmf (IO (resumption.output r) (lift_resumption \\ resume r)))\"\nby(simp split: option.split resumption.split)\n\ndeclare lift_resumption.simps [simp del]\n\nlemma lift_resumption_Done [code]:\n \"lift_resumption (resumption.Done x) = (case x of None \\ Fail | Some x' \\ Done x')\"\nby(rule gpv.expand)(simp add: the_gpv_lift_resumption split: option.split)\n\nlemma lift_resumption_DONE [simp]:\n \"lift_resumption (DONE x) = Done x\"\nby(simp add: DONE_def lift_resumption_Done)\n\nlemma lift_resumption_ABORT [simp]:\n \"lift_resumption ABORT = Fail\"\nby(simp add: ABORT_def lift_resumption_Done)\n\nlemma lift_resumption_Pause [simp, code]:\n \"lift_resumption (resumption.Pause out c) = Pause out (lift_resumption \\ c)\"\nby(rule gpv.expand)(simp add: the_gpv_lift_resumption)\n\nlemma lift_resumption_Done_Some [simp]: \"lift_resumption (resumption.Done (Some x)) = Done x\"\nusing lift_resumption_DONE unfolding DONE_def by simp\n\nlemma results'_gpv_lift_resumption [simp]:\n \"results'_gpv (lift_resumption r) = results r\" (is \"?lhs = ?rhs\")\nproof(rule set_eqI iffI)+\n show \"x \\ ?rhs\" if \"x \\ ?lhs\" for x using that\n by(induction gpv\\\"lift_resumption r\" arbitrary: r)\n (auto intro: resumption.set_sel simp add: lift_resumption.sel split: resumption.split_asm option.split_asm)\n show \"x \\ ?lhs\" if \"x \\ ?rhs\" for x using that by induction(auto simp add: lift_resumption.sel)\nqed\n\nlemma outs'_gpv_lift_resumption [simp]:\n \"outs'_gpv (lift_resumption r) = outputs r\" (is \"?lhs = ?rhs\")\nproof(rule set_eqI iffI)+\n show \"x \\ ?rhs\" if \"x \\ ?lhs\" for x using that\n by(induction gpv\\\"lift_resumption r\" arbitrary: r)\n (auto simp add: lift_resumption.sel split: resumption.split_asm option.split_asm)\n show \"x \\ ?lhs\" if \"x \\ ?rhs\" for x using that by induction auto\nqed\n\nlemma pred_gpv_lift_resumption [simp]:\n \"\\A. pred_gpv A C (lift_resumption r) = pred_resumption A C r\"\nby(simp add: pred_gpv_def pred_resumption_def)\n\nlemma lift_resumption_bind: \"lift_resumption (r \\ f) = lift_resumption r \\ lift_resumption \\ f\"\nby(coinduction arbitrary: r rule: gpv.coinduct_strong)\n (auto simp add: lift_resumption.sel Done_bind split: resumption.split option.split del: rel_funI intro!: rel_funI)\n\nsubsection \\Assertions\\\n\ndefinition assert_gpv :: \"bool \\ (unit, 'out, 'in) gpv\"\nwhere \"assert_gpv b = (if b then Done () else Fail)\"\n\nlemma assert_gpv_simps [simp]:\n \"assert_gpv True = Done ()\"\n \"assert_gpv False = Fail\"\nby(simp_all add: assert_gpv_def)\n\nlemma [simp]:\n shows assert_gpv_eq_Done: \"assert_gpv b = Done x \\ b\"\n and Done_eq_assert_gpv: \"Done x = assert_gpv b \\ b\"\n and Pause_neq_assert_gpv: \"Pause out rpv \\ assert_gpv b\"\n and assert_gpv_neq_Pause: \"assert_gpv b \\ Pause out rpv\"\n and assert_gpv_eq_Fail: \"assert_gpv b = Fail \\ \\ b\"\n and Fail_eq_assert_gpv: \"Fail = assert_gpv b \\ \\ b\"\nby(simp_all add: assert_gpv_def)\n\nlemma assert_gpv_inject [simp]: \"assert_gpv b = assert_gpv b' \\ b = b'\"\nby(simp add: assert_gpv_def)\n\nlemma assert_gpv_sel [simp]:\n \"the_gpv (assert_gpv b) = map_spmf Pure (assert_spmf b)\"\nby(simp add: assert_gpv_def)\n\nlemma the_gpv_bind_assert [simp]:\n \"the_gpv (bind_gpv (assert_gpv b) f) =\n bind_spmf (assert_spmf b) (the_gpv \\ f)\"\nby(cases b) simp_all\n\nlemma pred_gpv_assert [simp]: \"pred_gpv P Q (assert_gpv b) = (b \\ P ())\"\nby(cases b) simp_all\n\nprimcorec try_gpv :: \"('a, 'call, 'ret) gpv \\ ('a, 'call, 'ret) gpv \\ ('a, 'call, 'ret) gpv\" (\"TRY _ ELSE _\" [0,60] 59)\nwhere\n \"the_gpv (TRY gpv ELSE gpv') = \n map_spmf (map_generat id id (\\c input. case c input of Inl gpv \\ try_gpv gpv gpv' | Inr gpv' \\ gpv'))\n (try_spmf (map_spmf (map_generat id id (map_fun id Inl)) (the_gpv gpv))\n (map_spmf (map_generat id id (map_fun id Inr)) (the_gpv gpv')))\"\n\nlemma try_gpv_sel:\n \"the_gpv (TRY gpv ELSE gpv') =\n TRY map_spmf (map_generat id id (\\c input. TRY c input ELSE gpv')) (the_gpv gpv) ELSE the_gpv gpv'\"\nby(simp add: try_gpv_def map_try_spmf spmf.map_comp o_def generat.map_comp generat.map_ident id_def)\n\nlemma try_gpv_Done [simp]: \"TRY Done x ELSE gpv' = Done x\"\nby(rule gpv.expand)(simp)\n\nlemma try_gpv_Fail [simp]: \"TRY Fail ELSE gpv' = gpv'\"\nby(rule gpv.expand)(simp add: spmf.map_comp o_def generat.map_comp generat.map_ident)\n\nlemma try_gpv_Pause [simp]: \"TRY Pause out c ELSE gpv' = Pause out (\\input. TRY c input ELSE gpv')\"\nby(rule gpv.expand) simp\n\nlemma try_gpv_Fail2 [simp]: \"TRY gpv ELSE Fail = gpv\"\nby(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\n (auto simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI generat.rel_refl)\n\nlemma lift_try_spmf: \"lift_spmf (TRY p ELSE q) = TRY lift_spmf p ELSE lift_spmf q\" \nby(rule gpv.expand)(simp add: map_try_spmf spmf.map_comp o_def)\n\nlemma try_assert_gpv: \"TRY assert_gpv b ELSE gpv' = (if b then Done () else gpv')\"\nby(simp)\n\ncontext includes lifting_syntax begin\nlemma try_gpv_parametric [transfer_rule]:\n \"(rel_gpv A C ===> rel_gpv A C ===> rel_gpv A C) try_gpv try_gpv\"\nunfolding try_gpv_def by transfer_prover\n\nlemma try_gpv_parametric':\n \"(rel_gpv'' A C R ===> rel_gpv'' A C R ===> rel_gpv'' A C R) try_gpv try_gpv\"\nunfolding try_gpv_def\nsupply corec_gpv_parametric'[transfer_rule] the_gpv_parametric'[transfer_rule]\nby transfer_prover\nend\n\nlemma map_try_gpv: \"map_gpv f g (TRY gpv ELSE gpv') = TRY map_gpv f g gpv ELSE map_gpv f g gpv'\"\nby(simp add: gpv.rel_map try_gpv_parametric[THEN rel_funD, THEN rel_funD] gpv.rel_refl gpv.rel_eq[symmetric])\n\nlemma map'_try_gpv: \"map_gpv' f g h (TRY gpv ELSE gpv') = TRY map_gpv' f g h gpv ELSE map_gpv' f g h gpv'\"\nby(coinduction arbitrary: gpv rule: gpv.coinduct_strong)(auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI generat.rel_refl rel_funI rel_spmf_try_spmf)\n \n\nlemma try_bind_assert_gpv:\n \"TRY (assert_gpv b \\ f) ELSE gpv = (if b then TRY (f ()) ELSE gpv else gpv)\"\nby(simp)\n\n\n\nsubsection \\Order for @{typ \"('a, 'out, 'in) gpv\"}\\\n\ncoinductive ord_gpv :: \"('a, 'out, 'in) gpv \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere\n \"ord_spmf (rel_generat (=) (=) (rel_fun (=) ord_gpv)) f g \\ ord_gpv (GPV f) (GPV g)\"\n\ninductive_simps ord_gpv_simps [simp]:\n \"ord_gpv (GPV f) (GPV g)\"\n\nlemma ord_gpv_coinduct [consumes 1, case_names ord_gpv, coinduct pred: ord_gpv]:\n assumes \"X f g\"\n and step: \"\\f g. X f g \\ ord_spmf (rel_generat (=) (=) (rel_fun (=) X)) (the_gpv f) (the_gpv g)\"\n shows \"ord_gpv f g\"\nusing \\X f g\\\nby(coinduct)(auto dest: step simp add: eq_GPV_iff intro: ord_spmf_mono rel_generat_mono rel_fun_mono)\n\nlemma ord_gpv_the_gpvD:\n \"ord_gpv f g \\ ord_spmf (rel_generat (=) (=) (rel_fun (=) ord_gpv)) (the_gpv f) (the_gpv g)\"\nby(erule ord_gpv.cases) simp\n\nlemma reflp_equality: \"reflp (=)\"\nby(simp add: reflp_def)\n\nlemma ord_gpv_reflI [simp]: \"ord_gpv f f\"\nby(coinduction arbitrary: f)(auto intro: ord_spmf_reflI simp add: rel_generat_same rel_fun_def)\n\nlemma reflp_ord_gpv: \"reflp ord_gpv\"\nby(rule reflpI)(rule ord_gpv_reflI)\n\nlemma ord_gpv_trans:\n assumes \"ord_gpv f g\" \"ord_gpv g h\"\n shows \"ord_gpv f h\"\nusing assms\nproof(coinduction arbitrary: f g h)\n case (ord_gpv f g h)\n have *: \"ord_spmf (rel_generat (=) (=) (rel_fun (=) (\\f h. \\g. ord_gpv f g \\ ord_gpv g h))) (the_gpv f) (the_gpv h) =\n ord_spmf (rel_generat ((=) OO (=)) ((=) OO (=)) (rel_fun (=) (ord_gpv OO ord_gpv))) (the_gpv f) (the_gpv h)\"\n by(simp add: relcompp.simps[abs_def])\n then show ?case using ord_gpv\n by(auto elim!: ord_gpv.cases simp add: generat.rel_compp ord_spmf_compp fun.rel_compp)\nqed\n\nlemma ord_gpv_compp: \"(ord_gpv OO ord_gpv) = ord_gpv\"\nby(auto simp add: fun_eq_iff intro: ord_gpv_trans)\n\nlemma transp_ord_gpv [simp]: \"transp ord_gpv\"\nby(blast intro: transpI ord_gpv_trans)\n\nlemma ord_gpv_antisym:\n \"\\ ord_gpv f g; ord_gpv g f \\ \\ f = g\"\nproof(coinduction arbitrary: f g)\n case (Eq_gpv f g)\n let ?R = \"rel_generat (=) (=) (rel_fun (=) ord_gpv)\"\n from \\ord_gpv f g\\ have \"ord_spmf ?R (the_gpv f) (the_gpv g)\" by cases simp\n moreover\n from \\ord_gpv g f\\ have \"ord_spmf ?R (the_gpv g) (the_gpv f)\" by cases simp\n ultimately have \"rel_spmf (inf ?R ?R\\\\) (the_gpv f) (the_gpv g)\"\n by(rule rel_spmf_inf)(auto 4 3 intro: transp_rel_generatI transp_ord_gpv reflp_ord_gpv reflp_equality reflp_fun1 is_equality_eq transp_rel_fun)\n also have \"inf ?R ?R\\\\ = rel_generat (inf (=) (=)) (inf (=) (=)) (rel_fun (=) (inf ord_gpv ord_gpv\\\\))\"\n unfolding rel_generat_inf[symmetric] rel_fun_inf[symmetric]\n by(simp add: generat.rel_conversep[symmetric] fun.rel_conversep)\n finally show ?case by(simp add: inf_fun_def)\nqed\n\nlemma RFail_least [simp]: \"ord_gpv Fail f\"\nby(coinduction arbitrary: f)(simp add: eq_GPV_iff)\n\nsubsection \\Bounds on interaction\\\n\ncontext\n fixes \"consider\" :: \"'out \\ bool\"\n notes monotone_SUP[partial_function_mono] [[function_internals]]\nbegin\ndeclaration \\Partial_Function.init \"lfp_strong\" @{term lfp.fixp_fun} @{term lfp.mono_body}\n @{thm lfp.fixp_rule_uc} @{thm lfp.fixp_induct_strong2_uc} NONE\\\n\npartial_function (lfp_strong) interaction_bound :: \"('a, 'out, 'in) gpv \\ enat\"\nwhere\n \"interaction_bound gpv =\n (SUP generat\\set_spmf (the_gpv gpv). case generat of Pure _ \\ 0 \n | IO out c \\ if consider out then eSuc (SUP input. interaction_bound (c input)) else (SUP input. interaction_bound (c input)))\"\n\nlemma interaction_bound_fixp_induct [case_names adm bottom step]:\n \"\\ ccpo.admissible (fun_lub Sup) (fun_ord (\\)) P;\n P (\\_. 0);\n \\interaction_bound'. \n \\ P interaction_bound'; \n \\gpv. interaction_bound' gpv \\ interaction_bound gpv;\n \\gpv. interaction_bound' gpv \\ (SUP generat\\set_spmf (the_gpv gpv). case generat of Pure _ \\ 0 \n | IO out c \\ if consider out then eSuc (SUP input. interaction_bound' (c input)) else (SUP input. interaction_bound' (c input)))\n \\\n \\ P (\\gpv. \\generat\\set_spmf (the_gpv gpv). case generat of Pure x \\ 0\n | IO out c \\ if consider out then eSuc (\\input. interaction_bound' (c input)) else (\\input. interaction_bound' (c input))) \\\n \\ P interaction_bound\"\nby(erule interaction_bound.fixp_induct)(simp_all add: bot_enat_def fun_ord_def)\n\nlemma interaction_bound_IO:\n \"IO out c \\ set_spmf (the_gpv gpv)\n \\ (if consider out then eSuc (interaction_bound (c input)) else interaction_bound (c input)) \\ interaction_bound gpv\"\nby(rewrite in \"_ \\ \\\" interaction_bound.simps)(auto intro!: SUP_upper2)\n\nlemma interaction_bound_IO_consider:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); consider out \\\n \\ eSuc (interaction_bound (c input)) \\ interaction_bound gpv\"\nby(drule interaction_bound_IO) simp\n\nlemma interaction_bound_IO_ignore:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); \\ consider out \\\n \\ interaction_bound (c input) \\ interaction_bound gpv\"\nby(drule interaction_bound_IO) simp\n\nlemma interaction_bound_Done [simp]: \"interaction_bound (Done x) = 0\"\nby(simp add: interaction_bound.simps)\n\nlemma interaction_bound_Fail [simp]: \"interaction_bound Fail = 0\"\nby(simp add: interaction_bound.simps bot_enat_def)\n\nlemma interaction_bound_Pause [simp]:\n \"interaction_bound (Pause out c) = \n (if consider out then eSuc (SUP input. interaction_bound (c input)) else (SUP input. interaction_bound (c input)))\"\nby(simp add: interaction_bound.simps)\n\nlemma interaction_bound_lift_spmf [simp]: \"interaction_bound (lift_spmf p) = 0\"\nby(simp add: interaction_bound.simps SUP_constant bot_enat_def)\n\nlemma interaction_bound_assert_gpv [simp]: \"interaction_bound (assert_gpv b) = 0\"\nby(cases b) simp_all\n\nlemma interaction_bound_bind_step:\n assumes IH: \"\\p. interaction_bound' (p \\ f) \\ interaction_bound p + (\\x\\results'_gpv p. interaction_bound' (f x))\"\n and unfold: \"\\gpv. interaction_bound' gpv \\ (\\generat\\set_spmf (the_gpv gpv). case generat of Pure x \\ 0\n | IO out c \\ if consider out then eSuc (\\input. interaction_bound' (c input)) else \\input. interaction_bound' (c input))\"\n shows \"(\\generat\\set_spmf (the_gpv (p \\ f)).\n case generat of Pure x \\ 0\n | IO out c \\\n if consider out then eSuc (\\input. interaction_bound' (c input))\n else \\input. interaction_bound' (c input))\n \\ interaction_bound p +\n (\\x\\results'_gpv p.\n \\generat\\set_spmf (the_gpv (f x)).\n case generat of Pure x \\ 0\n | IO out c \\\n if consider out then eSuc (\\input. interaction_bound' (c input))\n else \\input. interaction_bound' (c input))\"\n (is \"(SUP generat'\\?bind. ?g generat') \\ ?p + ?f\")\nproof(rule SUP_least)\n fix generat'\n assume \"generat' \\ ?bind\"\n then obtain generat where generat: \"generat \\ set_spmf (the_gpv p)\"\n and *: \"case generat of Pure x \\ generat' \\ set_spmf (the_gpv (f x)) \n | IO out c \\ generat' = IO out (\\input. c input \\ f)\"\n by(clarsimp simp add: bind_gpv.sel simp del: bind_gpv_sel')\n (clarsimp split: generat.split_asm simp add: generat.map_comp o_def generat.map_id[unfolded id_def])\n show \"?g generat' \\ ?p + ?f\"\n proof(cases generat)\n case (Pure x)\n have \"?g generat' \\ (SUP generat'\\set_spmf (the_gpv (f x)). (case generat' of Pure x \\ 0 | IO out c \\ if consider out then eSuc (\\input. interaction_bound' (c input)) else \\input. interaction_bound' (c input)))\"\n using * Pure by(auto intro: SUP_upper)\n also have \"\\ \\ 0 + ?f\" using generat Pure\n by(auto 4 3 intro: SUP_upper results'_gpv_Pure)\n also have \"\\ \\ ?p + ?f\" by simp\n finally show ?thesis .\n next\n case (IO out c)\n with * have \"?g generat' = (if consider out then eSuc (SUP input. interaction_bound' (c input \\ f)) else (SUP input. interaction_bound' (c input \\ f)))\" by simp\n also have \"\\ \\ (if consider out then eSuc (SUP input. interaction_bound (c input) + (\\x\\results'_gpv (c input). interaction_bound' (f x))) else (SUP input. interaction_bound (c input) + (\\x\\results'_gpv (c input). interaction_bound' (f x))))\"\n by(auto intro: SUP_mono IH)\n also have \"\\ \\ (case IO out c of Pure (x :: 'a) \\ 0 | IO out c \\ if consider out then eSuc (SUP input. interaction_bound (c input)) else (SUP input. interaction_bound (c input))) + (SUP input. SUP x\\results'_gpv (c input). interaction_bound' (f x))\"\n by(simp add: iadd_Suc SUP_le_iff)(meson SUP_upper2 UNIV_I add_mono order_refl)\n also have \"\\ \\ ?p + ?f\"\n apply(rewrite in \"_ \\ \\\" interaction_bound.simps)\n apply(rule add_mono SUP_least SUP_upper generat[unfolded IO])+\n apply(rule order_trans[OF unfold])\n apply(auto 4 3 intro: results'_gpv_Cont[OF generat] SUP_upper simp add: IO)\n done\n finally show ?thesis .\n qed\nqed\n\nlemma interaction_bound_bind:\n defines \"ib1 \\ interaction_bound\"\n shows \"interaction_bound (p \\ f) \\ ib1 p + (SUP x\\results'_gpv p. interaction_bound (f x))\"\nproof(induction arbitrary: p rule: interaction_bound_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step interaction_bound') then show ?case unfolding ib1_def by -(rule interaction_bound_bind_step)\nqed\n\nlemma interaction_bound_bind_lift_spmf [simp]:\n \"interaction_bound (lift_spmf p \\ f) = (SUP x\\set_spmf p. interaction_bound (f x))\"\nby(subst (1 2) interaction_bound.simps)(simp add: bind_UNION SUP_UNION)\n\nend\n\nabbreviation interaction_any_bound :: \"('a, 'out, 'in) gpv \\ enat\"\nwhere \"interaction_any_bound \\ interaction_bound (\\_. True)\"\n\nlemma interaction_any_bound_coinduct [consumes 1, case_names interaction_bound]:\n assumes X: \"X gpv n\"\n and *: \"\\gpv n out c input. \\ X gpv n; IO out c \\ set_spmf (the_gpv gpv) \\ \n \\ \\n'. (X (c input) n' \\ interaction_any_bound (c input) \\ n') \\ eSuc n' \\ n\"\n shows \"interaction_any_bound gpv \\ n\"\nusing X\nproof(induction arbitrary: gpv n rule: interaction_bound_fixp_induct)\n case adm show ?case by(intro cont_intro)\n case bottom show ?case by simp\nnext\n case (step interaction_bound')\n { fix out c\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n from *[OF step.prems IO] obtain n' where n: \"n = eSuc n'\"\n by(cases n rule: co.enat.exhaust) auto\n moreover \n { fix input\n have \"\\n''. (X (c input) n'' \\ interaction_any_bound (c input) \\ n'') \\ eSuc n'' \\ n\"\n using step.prems IO \\n = eSuc n'\\ by(auto 4 3 dest: *)\n then have \"interaction_bound' (c input) \\ n'\" using n\n by(auto dest: step.IH intro: step.hyps[THEN order_trans] elim!: order_trans simp add: neq_zero_conv_eSuc) }\n ultimately have \"eSuc (\\input. interaction_bound' (c input)) \\ n\"\n by(auto intro: SUP_least) }\n then show ?case by(auto intro!: SUP_least split: generat.split)\nqed\n\ncontext includes lifting_syntax begin\nlemma interaction_bound_parametric':\n assumes [transfer_rule]: \"bi_total R\"\n shows \"((C ===> (=)) ===> rel_gpv'' A C R ===> (=)) interaction_bound interaction_bound\"\nunfolding interaction_bound_def[abs_def]\napply(rule rel_funI)\napply(rule fixp_lfp_parametric_eq[OF interaction_bound.mono interaction_bound.mono])\nsubgoal premises [transfer_rule]\n supply the_gpv_parametric'[transfer_rule] rel_gpv''_eq[relator_eq]\n by transfer_prover\ndone\n\nlemma interaction_bound_parametric [transfer_rule]:\n \"((C ===> (=)) ===> rel_gpv A C ===> (=)) interaction_bound interaction_bound\"\nunfolding rel_gpv_conv_rel_gpv'' by(rule interaction_bound_parametric')(rule bi_total_eq)\nend\n\ntext \\\n There is no nice @{const interaction_bound} equation for @{const bind_gpv}, as it computes\n an exact bound, but we only need an upper bound.\n As @{typ enat} is hard to work with (and @{term \\} does not constrain a gpv in any way),\n we work with @{typ nat}.\n\\\n\ninductive interaction_bounded_by :: \"('out \\ bool) \\ ('a, 'out, 'in) gpv \\ enat \\ bool\"\nfor \"consider\" gpv n where\n interaction_bounded_by: \"\\ interaction_bound consider gpv \\ n \\ \\ interaction_bounded_by consider gpv n\"\n\nlemmas interaction_bounded_byI = interaction_bounded_by\nhide_fact (open) interaction_bounded_by\n\ncontext includes lifting_syntax begin\nlemma interaction_bounded_by_parametric [transfer_rule]:\n \"((C ===> (=)) ===> rel_gpv A C ===> (=) ===> (=)) interaction_bounded_by interaction_bounded_by\"\nunfolding interaction_bounded_by.simps[abs_def] by transfer_prover\n\nlemma interaction_bounded_by_parametric':\n notes interaction_bound_parametric'[transfer_rule]\n assumes [transfer_rule]: \"bi_total R\"\n shows \"((C ===> (=)) ===> rel_gpv'' A C R ===> (=) ===> (=)) \n interaction_bounded_by interaction_bounded_by\"\nunfolding interaction_bounded_by.simps[abs_def] by transfer_prover\nend\n\nlemma interaction_bounded_by_mono:\n \"\\ interaction_bounded_by consider gpv n; n \\ m \\ \\ interaction_bounded_by consider gpv m\"\nunfolding interaction_bounded_by.simps by(erule order_trans) simp\n\nlemma interaction_bounded_by_contD:\n \"\\ interaction_bounded_by consider gpv n; IO out c \\ set_spmf (the_gpv gpv); consider out \\\n \\ n > 0 \\ interaction_bounded_by consider (c input) (n - 1)\"\nunfolding interaction_bounded_by.simps\nby(subst (asm) interaction_bound.simps)(auto simp add: SUP_le_iff eSuc_le_iff enat_eSuc_iff dest!: bspec)\n\nlemma interaction_bounded_by_contD_ignore:\n \"\\ interaction_bounded_by consider gpv n; IO out c \\ set_spmf (the_gpv gpv) \\\n \\ interaction_bounded_by consider (c input) n\"\nunfolding interaction_bounded_by.simps\nby(subst (asm) interaction_bound.simps)(auto 4 4 simp add: SUP_le_iff eSuc_le_iff enat_eSuc_iff dest!: bspec split: if_split_asm elim: order_trans)\n\nlemma interaction_bounded_byI_epred:\n assumes \"\\out c. \\ IO out c \\ set_spmf (the_gpv gpv); consider out \\ \\ n \\ 0 \\ (\\input. interaction_bounded_by consider (c input) (n - 1))\"\n and \"\\out c input. \\ IO out c \\ set_spmf (the_gpv gpv); \\ consider out \\ \\ interaction_bounded_by consider (c input) n\"\n shows \"interaction_bounded_by consider gpv n\"\nunfolding interaction_bounded_by.simps\nby(subst interaction_bound.simps)(auto 4 5 intro!: SUP_least split: generat.split dest: assms simp add: eSuc_le_iff enat_eSuc_iff gr0_conv_Suc neq_zero_conv_eSuc interaction_bounded_by.simps)\n\nlemma interaction_bounded_by_IO:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); interaction_bounded_by consider gpv n; consider out \\\n \\ n \\ 0 \\ interaction_bounded_by consider (c input) (n - 1)\"\nby(drule interaction_bound_IO[where input=input and ?consider=\"consider\"])(auto simp add: interaction_bounded_by.simps epred_conv_minus eSuc_le_iff enat_eSuc_iff)\n\nlemma interaction_bounded_by_0: \"interaction_bounded_by consider gpv 0 \\ interaction_bound consider gpv = 0\"\nby(simp add: interaction_bounded_by.simps zero_enat_def[symmetric])\n\nabbreviation interaction_bounded_by' :: \"('out \\ bool) \\ ('a, 'out, 'in) gpv \\ nat \\ bool\"\nwhere \"interaction_bounded_by' consider gpv n \\ interaction_bounded_by consider gpv (enat n)\"\n\nnamed_theorems interaction_bound\n\nlemmas interaction_bounded_by_start = interaction_bounded_by_mono\n\nmethod interaction_bound_start = (rule interaction_bounded_by_start)\nmethod interaction_bound_step uses add simp =\n ((match conclusion in \"interaction_bounded_by _ _ _\" \\ fail \\ _ \\ \\solves \\clarsimp simp add: simp\\\\) | rule add interaction_bound)\nmethod interaction_bound_rec uses add simp = \n (interaction_bound_step add: add simp: simp; (interaction_bound_rec add: add simp: simp)?)\nmethod interaction_bound uses add simp =\n ((* use in *) interaction_bound_start, interaction_bound_rec add: add simp: simp)\n\nlemma interaction_bounded_by_Done [simp]: \"interaction_bounded_by consider (Done x) n\"\nby(simp add: interaction_bounded_by.simps)\n\nlemma interaction_bounded_by_DoneI [interaction_bound]:\n \"interaction_bounded_by consider (Done x) 0\"\nby simp\n\nlemma interaction_bounded_by_Fail [simp]: \"interaction_bounded_by consider Fail n\"\nby(simp add: interaction_bounded_by.simps)\n\nlemma interaction_bounded_by_FailI [interaction_bound]: \"interaction_bounded_by consider Fail 0\"\nby simp\n\nlemma interaction_bounded_by_lift_spmf [simp]: \"interaction_bounded_by consider (lift_spmf p) n\"\nby(simp add: interaction_bounded_by.simps)\n\nlemma interaction_bounded_by_lift_spmfI [interaction_bound]:\n \"interaction_bounded_by consider (lift_spmf p) 0\"\nby simp\n\nlemma interaction_bounded_by_assert_gpv [simp]: \"interaction_bounded_by consider (assert_gpv b) n\"\nby(cases b) simp_all\n\nlemma interaction_bounded_by_assert_gpvI [interaction_bound]:\n \"interaction_bounded_by consider (assert_gpv b) 0\"\nby simp\n\nlemma interaction_bounded_by_Pause [simp]:\n \"interaction_bounded_by consider (Pause out c) n \\ \n (if consider out then 0 < n \\ (\\input. interaction_bounded_by consider (c input) (n - 1)) else (\\input. interaction_bounded_by consider (c input) n))\"\nby(cases n rule: co.enat.exhaust)\n (auto 4 3 simp add: interaction_bounded_by.simps eSuc_le_iff enat_eSuc_iff gr0_conv_Suc intro: SUP_least dest: order_trans[OF SUP_upper, rotated])\n\nlemma interaction_bounded_by_PauseI [interaction_bound]:\n \"(\\input. interaction_bounded_by consider (c input) (n input))\n \\ interaction_bounded_by consider (Pause out c) (if consider out then 1 + (SUP input. n input) else (SUP input. n input))\"\nby(auto simp add: iadd_is_0 enat_add_sub_same intro: interaction_bounded_by_mono SUP_upper)\n\nlemma interaction_bounded_by_bindI [interaction_bound]:\n \"\\ interaction_bounded_by consider gpv n; \\x. x \\ results'_gpv gpv \\ interaction_bounded_by consider (f x) (m x) \\\n \\ interaction_bounded_by consider (gpv \\ f) (n + (SUP x\\results'_gpv gpv. m x))\"\nunfolding interaction_bounded_by.simps plus_enat_simps(1)[symmetric]\nby(rule interaction_bound_bind[THEN order_trans])(auto intro: add_mono SUP_mono)\n\nlemma interaction_bounded_by_bind_PauseI [interaction_bound]:\n \"(\\input. interaction_bounded_by consider (c input \\ f) (n input))\n \\ interaction_bounded_by consider (Pause out c \\ f) (if consider out then SUP input. n input + 1 else SUP input. n input)\"\nby(auto 4 3 simp add: interaction_bounded_by.simps SUP_enat_add_left eSuc_plus_1 intro: SUP_least SUP_upper2)\n\nlemma interaction_bounded_by_bind_lift_spmf [simp]:\n \"interaction_bounded_by consider (lift_spmf p \\ f) n \\ (\\x\\set_spmf p. interaction_bounded_by consider (f x) n)\"\nby(simp add: interaction_bounded_by.simps SUP_le_iff)\n\nlemma interaction_bounded_by_bind_lift_spmfI [interaction_bound]:\n \"(\\x. x \\ set_spmf p \\ interaction_bounded_by consider (f x) (n x))\n \\ interaction_bounded_by consider (lift_spmf p \\ f) (SUP x\\set_spmf p. n x)\"\nby(auto intro: interaction_bounded_by_mono SUP_upper)\n\nlemma interaction_bounded_by_bind_DoneI [interaction_bound]:\n \"interaction_bounded_by consider (f x) n \\ interaction_bounded_by consider (Done x \\ f) n\"\nby(simp)\n\nlemma interaction_bounded_by_if [interaction_bound]:\n \"\\ b \\ interaction_bounded_by consider gpv1 n; \\ b \\ interaction_bounded_by consider gpv2 m \\\n \\ interaction_bounded_by consider (if b then gpv1 else gpv2) (if b then n else m)\"\nby(auto 4 3 simp add: max_def not_le elim: interaction_bounded_by_mono)\n\nlemma interaction_bounded_by_case_bool [interaction_bound]:\n \"\\ b \\ interaction_bounded_by consider t bt; \\ b \\ interaction_bounded_by consider f bf \\\n \\ interaction_bounded_by consider (case_bool t f b) (if b then bt else bf)\"\nby(cases b)(auto)\n\nlemma interaction_bounded_by_case_sum [interaction_bound]:\n \"\\ \\y. x = Inl y \\ interaction_bounded_by consider (l y) (bl y);\n \\y. x = Inr y \\ interaction_bounded_by consider (r y) (br y) \\\n \\ interaction_bounded_by consider (case_sum l r x) (case_sum bl br x)\"\nby(cases x)(auto)\n\nlemma interaction_bounded_by_case_prod [interaction_bound]:\n \"(\\a b. x = (a, b) \\ interaction_bounded_by consider (f a b) (n a b))\n \\ interaction_bounded_by consider (case_prod f x) (case_prod n x)\"\nby(simp split: prod.split)\n\nlemma interaction_bounded_by_let [interaction_bound]: \\ \\This rule unfolds let's\\\n \"interaction_bounded_by consider (f t) m \\ interaction_bounded_by consider (Let t f) m\"\nby(simp add: Let_def)\n\nlemma interaction_bounded_by_map_gpv_id [interaction_bound]:\n assumes [interaction_bound]: \"interaction_bounded_by P gpv n\"\n shows \"interaction_bounded_by P (map_gpv f id gpv) n\"\nunfolding id_def map_gpv_conv_bind by interaction_bound simp\n\nabbreviation interaction_any_bounded_by :: \"('a, 'out, 'in) gpv \\ enat \\ bool\"\nwhere \"interaction_any_bounded_by \\ interaction_bounded_by (\\_. True)\"\n\nsubsection \\Typing\\\n\nsubsubsection \\Interface between gpvs and rpvs / callees\\\n\nlemma is_empty_parametric [transfer_rule]: \"rel_fun (rel_set A) (=) Set.is_empty Set.is_empty\" (* Move *)\nby(auto simp add: rel_fun_def Set.is_empty_def dest: rel_setD1 rel_setD2)\n\ntypedef ('call, 'ret) \\ = \"UNIV :: ('call \\ 'ret set) set\" ..\n\nsetup_lifting type_definition_\\\n\nlemma outs_\\_tparametric:\n includes lifting_syntax \n assumes [transfer_rule]: \"bi_total A\"\n shows \"((A ===> rel_set B) ===> rel_set A) (\\resps. {out. resps out \\ {}}) (\\resps. {out. resps out \\ {}})\"\n by(fold Set.is_empty_def) transfer_prover\n\nlift_definition outs_\\ :: \"('call, 'ret) \\ \\ 'call set\" is \"\\resps. {out. resps out \\ {}}\" parametric outs_\\_tparametric .\nlift_definition responses_\\ :: \"('call, 'ret) \\ \\ 'call \\ 'ret set\" is \"\\x. x\" parametric id_transfer[unfolded id_def] .\n\nlift_definition rel_\\ :: \"('call \\ 'call' \\ bool) \\ ('ret \\ 'ret' \\ bool) \\ ('call, 'ret) \\ \\ ('call', 'ret') \\ \\ bool\"\nis \"\\C R resp1 resp2. rel_set C {out. resp1 out \\ {}} {out. resp2 out \\ {}} \\ rel_fun C (rel_set R) resp1 resp2\"\n.\n\nlemma rel_\\I [intro?]:\n \"\\ rel_set C (outs_\\ \\1) (outs_\\ \\2); \\x y. C x y \\ rel_set R (responses_\\ \\1 x) (responses_\\ \\2 y) \\\n \\ rel_\\ C R \\1 \\2\"\nby transfer(auto simp add: rel_fun_def)\n\nlemma rel_\\_eq [relator_eq]: \"rel_\\ (=) (=) = (=)\"\nunfolding fun_eq_iff by transfer(auto simp add: relator_eq)\n\nlemma rel_\\_conversep [simp]: \"rel_\\ C\\\\ R\\\\ = (rel_\\ C R)\\\\\"\nunfolding fun_eq_iff conversep_iff\napply transfer\napply(rewrite in \"rel_fun \\\" conversep_iff[symmetric])\napply(rewrite in \"rel_set \\\" conversep_iff[symmetric])\napply(rewrite in \"rel_fun _ \\\" conversep_iff[symmetric])\napply(simp del: conversep_iff add: rel_fun_conversep)\napply(simp)\ndone\n\nlemma rel_\\_conversep1_eq [simp]: \"rel_\\ C\\\\ (=) = (rel_\\ C (=))\\\\\"\nby(rewrite in \"\\ = _\" conversep_eq[symmetric])(simp del: conversep_eq)\n\nlemma rel_\\_conversep2_eq [simp]: \"rel_\\ (=) R\\\\ = (rel_\\ (=) R)\\\\\"\nby(rewrite in \"\\ = _\" conversep_eq[symmetric])(simp del: conversep_eq)\n\nlemma responses_\\_empty_iff: \"responses_\\ \\ out = {} \\ out \\ outs_\\ \\\"\nincluding \\.lifting by transfer auto\n\nlemma in_outs_\\_iff_responses_\\: \"out \\ outs_\\ \\ \\ responses_\\ \\ out \\ {}\"\nby(simp add: responses_\\_empty_iff)\n\nlift_definition \\_full :: \"('call, 'ret) \\\" is \"\\_. UNIV\" .\n\nlemma \\_full_sel [simp]:\n shows outs_\\_full: \"outs_\\ \\_full = UNIV\"\n and responses_\\_full: \"responses_\\ \\_full x = UNIV\"\nby(transfer; simp; fail)+\n\ncontext includes lifting_syntax begin\nlemma outs_\\_parametric [transfer_rule]: \"(rel_\\ C R ===> rel_set C) outs_\\ outs_\\\"\nunfolding rel_fun_def by transfer simp\n\nlemma responses_\\_parametric [transfer_rule]: \n \"(rel_\\ C R ===> C ===> rel_set R) responses_\\ responses_\\\"\nunfolding rel_fun_def by transfer(auto dest: rel_funD)\n\nend\n\ndefinition \\_trivial :: \"('out, 'in) \\ \\ bool\"\nwhere \"\\_trivial \\ \\ outs_\\ \\ = UNIV\"\n\nlemma \\_trivialI [intro?]: \"(\\x. x \\ outs_\\ \\) \\ \\_trivial \\\"\nby(auto simp add: \\_trivial_def)\n\nlemma \\_trivialD: \"\\_trivial \\ \\ outs_\\ \\ = UNIV\"\nby(simp add: \\_trivial_def)\n\nlemma \\_trivial_\\_full [simp]: \"\\_trivial \\_full\"\nby(simp add: \\_trivial_def)\n\nlifting_update \\.lifting\nlifting_forget \\.lifting\n\n\ncontext begin\nqualified inductive resultsp_gpv :: \"('out, 'in) \\ \\ 'a \\ ('a, 'out, 'in) gpv \\ bool\"\n for \\ x\nwhere\n Pure: \"Pure x \\ set_spmf (the_gpv gpv) \\ resultsp_gpv \\ x gpv\"\n| IO:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out; resultsp_gpv \\ x (c input) \\\n \\ resultsp_gpv \\ x gpv\"\n\ndefinition results_gpv :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ 'a set\"\nwhere \"results_gpv \\ gpv \\ {x. resultsp_gpv \\ x gpv}\"\n\nlemma resultsp_gpv_results_gpv_eq [pred_set_conv]: \"resultsp_gpv \\ x gpv \\ x \\ results_gpv \\ gpv\"\nby(simp add: results_gpv_def)\n\ncontext begin\nlocal_setup \\Local_Theory.map_background_naming (Name_Space.mandatory_path \"results_gpv\")\\\n\nlemmas intros [intro?] = resultsp_gpv.intros[to_set]\n and Pure = Pure[to_set]\n and IO = IO[to_set]\n and induct [consumes 1, case_names Pure IO, induct set: results_gpv] = resultsp_gpv.induct[to_set]\n and cases [consumes 1, case_names Pure IO, cases set: results_gpv] = resultsp_gpv.cases[to_set]\n and simps = resultsp_gpv.simps[to_set]\nend\n\ninductive_simps results_gpv_GPV [to_set, simp]: \"resultsp_gpv \\ x (GPV gpv)\"\n\nend\n\nlemma results_gpv_Done [iff]: \"results_gpv \\ (Done x) = {x}\"\nby(auto simp add: Done.ctr)\n\nlemma results_gpv_Fail [iff]: \"results_gpv \\ Fail = {}\"\nby(auto simp add: Fail_def)\n\nlemma results_gpv_Pause [simp]:\n \"results_gpv \\ (Pause out c) = (\\input\\responses_\\ \\ out. results_gpv \\ (c input))\"\nby(auto simp add: Pause.ctr)\n\nlemma results_gpv_lift_spmf [iff]: \"results_gpv \\ (lift_spmf p) = set_spmf p\"\nby(auto simp add: lift_spmf.ctr)\n\nlemma results_gpv_assert_gpv [simp]: \"results_gpv \\ (assert_gpv b) = (if b then {()} else {})\"\nby auto\n\nlemma results_gpv_bind_gpv [simp]:\n \"results_gpv \\ (gpv \\ f) = (\\x\\results_gpv \\ gpv. results_gpv \\ (f x))\"\n (is \"?lhs = ?rhs\")\nproof(intro set_eqI iffI)\n fix x\n assume \"x \\ ?lhs\"\n then show \"x \\ ?rhs\"\n proof(induction gpv'\\\"gpv \\ f\" arbitrary: gpv)\n case Pure thus ?case\n by(auto 4 3 split: if_split_asm intro: results_gpv.intros rev_bexI)\n next\n case (IO out c input)\n from \\IO out c \\ _\\\n obtain generat where generat: \"generat \\ set_spmf (the_gpv gpv)\"\n and *: \"IO out c \\ set_spmf (if is_Pure generat then the_gpv (f (result generat))\n else return_spmf (IO (output generat) (\\input. continuation generat input \\ f)))\"\n by(auto)\n thus ?case\n proof(cases generat)\n case (Pure y)\n with generat have \"y \\ results_gpv \\ gpv\" by(auto intro: results_gpv.intros)\n thus ?thesis using * Pure \\input \\ responses_\\ \\ out\\ \\x \\ results_gpv \\ (c input)\\\n by(auto intro: results_gpv.IO)\n next\n case (IO out' c')\n hence [simp]: \"out' = out\"\n and c: \"\\input. c input = bind_gpv (c' input) f\" using * by simp_all\n from IO.hyps(4)[OF c] obtain y where y: \"y \\ results_gpv \\ (c' input)\"\n and \"x \\ results_gpv \\ (f y)\" by blast\n from y IO generat have \"y \\ results_gpv \\ gpv\" using \\input \\ responses_\\ \\ out\\\n by(auto intro: results_gpv.IO)\n with \\x \\ results_gpv \\ (f y)\\ show ?thesis by blast\n qed\n qed\nnext\n fix x\n assume \"x \\ ?rhs\"\n then obtain y where y: \"y \\ results_gpv \\ gpv\"\n and x: \"x \\ results_gpv \\ (f y)\" by blast\n from y show \"x \\ ?lhs\"\n proof(induction)\n case (Pure gpv)\n with x show ?case\n by cases(auto 4 4 intro: results_gpv.intros rev_bexI)\n qed(auto 4 4 intro: rev_bexI results_gpv.IO)\nqed\n\nlemma results_gpv_\\_full: \"results_gpv \\_full = results'_gpv\"\nproof(intro ext set_eqI iffI)\n show \"x \\ results'_gpv gpv\" if \"x \\ results_gpv \\_full gpv\" for x gpv\n using that by induction(auto intro: results'_gpvI)\n show \"x \\ results_gpv \\_full gpv\" if \"x \\ results'_gpv gpv\" for x gpv\n using that by induction(auto intro: results_gpv.intros elim!: generat.set_cases)\nqed\n\nlemma results'_bind_gpv [simp]:\n \"results'_gpv (bind_gpv gpv f) = (\\x\\results'_gpv gpv. results'_gpv (f x))\"\nunfolding results_gpv_\\_full[symmetric] by simp\n\nlemma results_gpv_map_gpv_id [simp]: \"results_gpv \\ (map_gpv f id gpv) = f ` results_gpv \\ gpv\"\n by(auto simp add: map_gpv_conv_bind id_def)\n\nlemma results_gpv_map_gpv_id' [simp]: \"results_gpv \\ (map_gpv f (\\x. x) gpv) = f ` results_gpv \\ gpv\"\n by(auto simp add: map_gpv_conv_bind id_def)\n\nlemma pred_gpv_bind [simp]: \"pred_gpv P Q (bind_gpv gpv f) = pred_gpv (pred_gpv P Q \\ f) Q gpv\"\nby(auto simp add: pred_gpv_def outs_bind_gpv)\n\nlemma results'_gpv_bind_option [simp]:\n \"results'_gpv (monad.bind_option Fail x f) = (\\y\\set_option x. results'_gpv (f y))\"\nby(cases x) simp_all\n\nlemma bind_gpv_bind_option_assoc:\n \"bind_gpv (monad.bind_option Fail x f) g = monad.bind_option Fail x (\\x. bind_gpv (f x) g)\"\nby(cases x) simp_all\n\nsubsubsection \\Type judgements\\\n\ncoinductive WT_gpv :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ bool\" (\"((_)/ \\g (_) \\)\" [100, 0] 99)\n for \\\nwhere\n \"(\\out c. IO out c \\ set_spmf gpv \\ out \\ outs_\\ \\ \\ (\\input\\responses_\\ \\ out. \\ \\g c input \\))\n \\ \\ \\g GPV gpv \\\"\n\nlemma WT_gpv_coinduct [consumes 1, case_names WT_gpv, case_conclusion WT_gpv out cont, coinduct pred: WT_gpv]:\n assumes *: \"X gpv\"\n and step: \"\\gpv out c.\n \\ X gpv; IO out c \\ set_spmf (the_gpv gpv) \\\n \\ out \\ outs_\\ \\ \\ (\\input \\ responses_\\ \\ out. X (c input) \\ \\ \\g c input \\)\"\n shows \"\\ \\g gpv \\\"\nusing * by(coinduct)(auto dest: step simp add: eq_GPV_iff)\n\nlemma WT_gpv_simps:\n \"\\ \\g GPV gpv \\ \\\n (\\out c. IO out c \\ set_spmf gpv \\ out \\ outs_\\ \\ \\ (\\input\\responses_\\ \\ out. \\ \\g c input \\))\"\nby(subst WT_gpv.simps) simp\n\nlemma WT_gpvI:\n \"(\\out c. IO out c \\ set_spmf (the_gpv gpv) \\ out \\ outs_\\ \\ \\ (\\input\\responses_\\ \\ out. \\ \\g c input \\))\n \\ \\ \\g gpv \\\"\nby(cases gpv)(simp add: WT_gpv_simps)\n\nlemma WT_gpvD:\n assumes \"\\ \\g gpv \\\"\n shows WT_gpv_OutD: \"IO out c \\ set_spmf (the_gpv gpv) \\ out \\ outs_\\ \\\"\n and WT_gpv_ContD: \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\ \\ \\ \\g c input \\\"\nusing assms by(cases, fastforce)+\n\nlemma WT_gpv_mono:\n assumes WT: \"\\1 \\g gpv \\\"\n and outs: \"outs_\\ \\1 \\ outs_\\ \\2\"\n and responses: \"\\x. x \\ outs_\\ \\1 \\ responses_\\ \\2 x \\ responses_\\ \\1 x\"\n shows \"\\2 \\g gpv \\\"\nusing WT\nproof coinduct\n case (WT_gpv gpv out c)\n with outs show ?case by(auto 6 4 dest: responses WT_gpvD)\nqed\n\nlemma WT_gpv_Done [iff]: \"\\ \\g Done x \\\"\nby(rule WT_gpvI) simp_all\n\nlemma WT_gpv_Fail [iff]: \"\\ \\g Fail \\\"\nby(rule WT_gpvI) simp_all\n\nlemma WT_gpv_PauseI: \n \"\\ out \\ outs_\\ \\; \\input. input \\ responses_\\ \\ out \\ \\ \\g c input \\ \\\n \\ \\ \\g Pause out c \\\"\nby(rule WT_gpvI) simp_all\n\nlemma WT_gpv_Pause [iff]:\n \"\\ \\g Pause out c \\ \\ out \\ outs_\\ \\ \\ (\\input \\ responses_\\ \\ out. \\ \\g c input \\)\"\nby(auto intro: WT_gpv_PauseI dest: WT_gpvD)\n\nlemma WT_gpv_bindI:\n \"\\ \\ \\g gpv \\; \\x. x \\ results_gpv \\ gpv \\ \\ \\g f x \\ \\\n \\ \\ \\g gpv \\ f \\\"\nproof(coinduction arbitrary: gpv)\n case [rule_format]: (WT_gpv out c gpv)\n from \\IO out c \\ _\\\n obtain generat where generat: \"generat \\ set_spmf (the_gpv gpv)\"\n and *: \"IO out c \\ set_spmf (if is_Pure generat then the_gpv (f (result generat))\n else return_spmf (IO (output generat) (\\input. continuation generat input \\ f)))\"\n by(auto)\n show ?case\n proof(cases generat)\n case (Pure y)\n with generat have \"y \\ results_gpv \\ gpv\" by(auto intro: results_gpv.Pure)\n hence \"\\ \\g f y \\\" by(rule WT_gpv)\n with * Pure show ?thesis by(auto dest: WT_gpvD) \n next\n case (IO out' c')\n hence [simp]: \"out' = out\"\n and c: \"\\input. c input = bind_gpv (c' input) f\" using * by simp_all\n from generat IO have **: \"IO out c' \\ set_spmf (the_gpv gpv)\" by simp\n with \\\\ \\g gpv \\\\ have ?out by(auto dest: WT_gpvD)\n moreover {\n fix input\n assume input: \"input \\ responses_\\ \\ out\"\n with \\\\ \\g gpv \\\\ ** have \"\\ \\g c' input \\\" by(rule WT_gpvD)\n moreover {\n fix y\n assume \"y \\ results_gpv \\ (c' input)\"\n with ** input have \"y \\ results_gpv \\ gpv\" by(rule results_gpv.IO)\n hence \"\\ \\g f y \\\" by(rule WT_gpv) }\n moreover note calculation }\n hence ?cont using c by blast\n ultimately show ?thesis ..\n qed\nqed\n\nlemma WT_gpv_bindD2:\n assumes WT: \"\\ \\g gpv \\ f \\\"\n and x: \"x \\ results_gpv \\ gpv\"\n shows \"\\ \\g f x \\\"\nusing x WT\nproof induction\n case (Pure gpv)\n show ?case\n proof(rule WT_gpvI)\n fix out c\n assume \"IO out c \\ set_spmf (the_gpv (f x))\"\n with Pure have \"IO out c \\ set_spmf (the_gpv (gpv \\ f))\" by(auto intro: rev_bexI)\n with \\\\ \\g gpv \\ f \\\\ show \"out \\ outs_\\ \\ \\ (\\input\\responses_\\ \\ out. \\ \\g c input \\)\"\n by(auto dest: WT_gpvD simp del: set_bind_spmf)\n qed\nnext\n case (IO out c gpv input)\n from \\IO out c \\ _\\\n have \"IO out (\\input. bind_gpv (c input) f) \\ set_spmf (the_gpv (gpv \\ f))\"\n by(auto intro: rev_bexI)\n with IO.prems have \"\\ \\g c input \\ f \\\" using \\input \\ _\\ by(rule WT_gpv_ContD)\n thus ?case by(rule IO.IH)\nqed\n\nlemma WT_gpv_bindD1: \"\\ \\g gpv \\ f \\ \\ \\ \\g gpv \\\"\nproof(coinduction arbitrary: gpv)\n case (WT_gpv out c gpv)\n from \\IO out c \\ _\\\n have \"IO out (\\input. bind_gpv (c input) f) \\ set_spmf (the_gpv (gpv \\ f))\"\n by(auto intro: rev_bexI)\n with \\\\ \\g gpv \\ f \\\\ show ?case\n by(auto simp del: bind_gpv_sel' dest: WT_gpvD)\nqed\n\nlemma WT_gpv_bind [simp]: \"\\ \\g gpv \\ f \\ \\ \\ \\g gpv \\ \\ (\\x\\results_gpv \\ gpv. \\ \\g f x \\)\"\nby(blast intro: WT_gpv_bindI dest: WT_gpv_bindD1 WT_gpv_bindD2)\n\nlemma WT_gpv_full [simp, intro!]: \"\\_full \\g gpv \\\"\nby(coinduction arbitrary: gpv)(auto)\n\nlemma WT_gpv_lift_spmf [simp, intro!]: \"\\ \\g lift_spmf p \\\"\nby(rule WT_gpvI) auto\n\nlemma WT_gpv_coinduct_bind [consumes 1, case_names WT_gpv, case_conclusion WT_gpv out cont]:\n assumes *: \"X gpv\"\n and step: \"\\gpv out c. \\ X gpv; IO out c \\ set_spmf (the_gpv gpv) \\\n \\ out \\ outs_\\ \\ \\ (\\input\\responses_\\ \\ out.\n X (c input) \\\n \\ \\g c input \\ \\\n (\\(gpv' :: ('b, 'call, 'ret) gpv) f. c input = gpv' \\ f \\ \\ \\g gpv' \\ \\ (\\x\\results_gpv \\ gpv'. X (f x))))\"\n shows \"\\ \\g gpv \\\"\nproof -\n fix x\n define gpv' :: \"('b, 'call, 'ret) gpv\" and f :: \"'b \\ ('a, 'call, 'ret) gpv\"\n where \"gpv' = Done x\" and \"f = (\\_. gpv)\"\n with * have \"\\ \\g gpv' \\\" and \"\\x. x \\ results_gpv \\ gpv' \\ X (f x)\" by simp_all\n then have \"\\ \\g gpv' \\ f \\\"\n proof(coinduction arbitrary: gpv' f rule: WT_gpv_coinduct)\n case [rule_format]: (WT_gpv out c gpv')\n from \\IO out c \\ _\\\n obtain generat where generat: \"generat \\ set_spmf (the_gpv gpv')\"\n and *: \"IO out c \\ set_spmf (if is_Pure generat\n then the_gpv (f (result generat))\n else return_spmf (IO (output generat) (\\input. continuation generat input \\ f)))\"\n by(clarsimp)\n show ?case\n proof(cases generat)\n case (Pure x)\n from Pure * have IO: \"IO out c \\ set_spmf (the_gpv (f x))\" by simp\n from generat Pure have \"x \\ results_gpv \\ gpv'\" by (simp add: results_gpv.Pure)\n then have \"X (f x)\" by(rule WT_gpv)\n from step[OF this IO] show ?thesis by(auto 4 4 intro: exI[where x=\"Done _\"])\n next\n case (IO out' c')\n with * have [simp]: \"out' = out\"\n and c: \"c = (\\input. c' input \\ f)\" by simp_all\n from IO generat have IO: \"IO out c' \\ set_spmf (the_gpv gpv')\" by simp\n then have \"\\input. input \\ responses_\\ \\ out \\ results_gpv \\ (c' input) \\ results_gpv \\ gpv'\"\n by(auto intro: results_gpv.IO)\n with WT_gpvD[OF \\\\ \\g gpv' \\\\ IO] show ?thesis unfolding c using WT_gpv(2) by blast\n qed\n qed\n then show ?thesis unfolding gpv'_def f_def by simp\nqed\n\nlemma \\_trivial_WT_gpvD [simp]: \"\\_trivial \\ \\ \\ \\g gpv \\\"\nusing WT_gpv_full by(rule WT_gpv_mono)(simp_all add: \\_trivial_def)\n\nlemma \\_trivial_WT_gpvI: \n assumes \"\\gpv :: ('a, 'out, 'in) gpv. \\ \\g gpv \\\"\n shows \"\\_trivial \\\"\nproof\n fix x\n have \"\\ \\g Pause x (\\_. Fail :: ('a, 'out, 'in) gpv) \\\" by(rule assms)\n thus \"x \\ outs_\\ \\\" by(simp)\nqed\n\nsubsection \\Sub-gpvs\\\n\ncontext begin\nqualified inductive sub_gpvsp :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ ('a, 'out, 'in) gpv \\ bool\"\n for \\ x\nwhere\n base:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out; x = c input \\ \n \\ sub_gpvsp \\ x gpv\"\n| cont: \n \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out; sub_gpvsp \\ x (c input) \\\n \\ sub_gpvsp \\ x gpv\"\n\nqualified lemma sub_gpvsp_base:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\ \n \\ sub_gpvsp \\ (c input) gpv\"\nby(rule base) simp_all\n\ndefinition sub_gpvs :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ ('a, 'out, 'in) gpv set\"\nwhere \"sub_gpvs \\ gpv \\ {x. sub_gpvsp \\ x gpv}\"\n\nlemma sub_gpvsp_sub_gpvs_eq [pred_set_conv]: \"sub_gpvsp \\ x gpv \\ x \\ sub_gpvs \\ gpv\"\nby(simp add: sub_gpvs_def)\n\ncontext begin\nlocal_setup \\Local_Theory.map_background_naming (Name_Space.mandatory_path \"sub_gpvs\")\\\n\nlemmas intros [intro?] = sub_gpvsp.intros[to_set]\n and base = sub_gpvsp_base[to_set]\n and cont = cont[to_set]\n and induct [consumes 1, case_names Pure IO, induct set: sub_gpvs] = sub_gpvsp.induct[to_set]\n and cases [consumes 1, case_names Pure IO, cases set: sub_gpvs] = sub_gpvsp.cases[to_set]\n and simps = sub_gpvsp.simps[to_set]\nend\nend\n\nlemma WT_sub_gpvsD:\n assumes \"\\ \\g gpv \\\" and \"gpv' \\ sub_gpvs \\ gpv\"\n shows \"\\ \\g gpv' \\\"\nusing assms(2,1) by(induction)(auto dest: WT_gpvD)\n\nlemma WT_sub_gpvsI:\n \"\\ \\out c. IO out c \\ set_spmf (the_gpv gpv) \\ out \\ outs_\\ \\; \n \\gpv'. gpv' \\ sub_gpvs \\ gpv \\ \\ \\g gpv' \\ \\\n \\ \\ \\g gpv \\\"\nby(rule WT_gpvI)(auto intro: sub_gpvs.base)\n\nsubsection \\Losslessness\\\n\ntext \\A gpv is lossless iff we are guaranteed to get a result after a finite number of interactions\n that respect the interface. It is colossless if the interactions may go on for ever, but there is\n no non-termination.\\\n\ntext \\ We define both notions of losslessness simultaneously by mimicking what the (co)inductive\n package would do internally. Thus, we get a constant which is parametrised by the choice of the\n fixpoint, i.e., for non-recursive gpvs, we can state and prove both versions of losslessness\n in one go.\\\n\ncontext\n fixes co :: bool and \\ :: \"('out, 'in) \\\"\n and F :: \"(('a, 'out, 'in) gpv \\ bool) \\ (('a, 'out, 'in) gpv \\ bool)\"\n and co' :: bool\n defines \"F \\ \\gen_lossless_gpv gpv. \\pa. gpv = GPV pa \\ \n lossless_spmf pa \\ (\\out c input. IO out c \\ set_spmf pa \\ input \\ responses_\\ \\ out \\ gen_lossless_gpv (c input))\"\n and \"co' \\ co\" \\ \\We use a copy of @{term co} such that we can do case distinctions on @{term co'} without\n the simplifier rewriting the @{term co} in the local abbreviations for the constants.\\\nbegin\n\nlemma gen_lossless_gpv_mono: \"mono F\"\nunfolding F_def\napply(rule monoI le_funI le_boolI')+\napply(tactic \\REPEAT (resolve_tac @{context} (Inductive.get_monos @{context}) 1)\\)\napply(erule le_funE)\napply(erule le_boolD)\ndone\n\ndefinition gen_lossless_gpv :: \"('a, 'out, 'in) gpv \\ bool\"\nwhere \"gen_lossless_gpv = (if co' then gfp else lfp) F\"\n\nlemma gen_lossless_gpv_unfold: \"gen_lossless_gpv = F gen_lossless_gpv\"\nby(simp add: gen_lossless_gpv_def gfp_unfold[OF gen_lossless_gpv_mono, symmetric] lfp_unfold[OF gen_lossless_gpv_mono, symmetric])\n\nlemma gen_lossless_gpv_True: \"co' = True \\ gen_lossless_gpv \\ gfp F\"\n and gen_lossless_gpv_False: \"co' = False \\ gen_lossless_gpv \\ lfp F\"\nby(simp_all add: gen_lossless_gpv_def)\n\nlemma gen_lossless_gpv_cases [elim?, cases pred]:\n assumes \"gen_lossless_gpv gpv\"\n obtains (gen_lossless_gpv) p where \"gpv = GPV p\" \"lossless_spmf p\" \n \"\\out c input. \\IO out c \\ set_spmf p; input \\ responses_\\ \\ out\\ \\ gen_lossless_gpv (c input)\"\nproof -\n from assms show ?thesis\n by(rewrite in asm gen_lossless_gpv_unfold)(auto simp add: F_def intro: that)\nqed\n\nlemma gen_lossless_gpvD:\n assumes \"gen_lossless_gpv gpv\"\n shows gen_lossless_gpv_lossless_spmfD: \"lossless_spmf (the_gpv gpv)\"\n and gen_lossless_gpv_continuationD:\n \"\\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\ \\ gen_lossless_gpv (c input)\"\nusing assms by(auto elim: gen_lossless_gpv_cases)\n\nlemma gen_lossless_gpv_intros:\n \"\\ lossless_spmf p;\n \\out c input. \\IO out c \\ set_spmf p; input \\ responses_\\ \\ out \\ \\ gen_lossless_gpv (c input) \\\n \\ gen_lossless_gpv (GPV p)\"\nby(rewrite gen_lossless_gpv_unfold)(simp add: F_def)\n\nlemma gen_lossless_gpvI [intro?]:\n \"\\ lossless_spmf (the_gpv gpv);\n \\out c input. \\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\\n \\ gen_lossless_gpv (c input) \\\n \\ gen_lossless_gpv gpv\"\nby(cases gpv)(auto intro: gen_lossless_gpv_intros)\n\nlemma gen_lossless_gpv_simps:\n \"gen_lossless_gpv gpv \\\n (\\p. gpv = GPV p \\ lossless_spmf p \\ (\\out c input.\n IO out c \\ set_spmf p \\ input \\ responses_\\ \\ out \\ gen_lossless_gpv (c input)))\"\nby(rewrite gen_lossless_gpv_unfold)(simp add: F_def)\n\nlemma gen_lossless_gpv_Done [iff]: \"gen_lossless_gpv (Done x)\"\nby(rule gen_lossless_gpvI) auto\n\nlemma gen_lossless_gpv_Fail [iff]: \"\\ gen_lossless_gpv Fail\"\nby(auto dest: gen_lossless_gpvD)\n\nlemma gen_lossless_gpv_Pause [simp]:\n \"gen_lossless_gpv (Pause out c) \\ (\\input \\ responses_\\ \\ out. gen_lossless_gpv (c input))\"\nby(auto dest: gen_lossless_gpvD intro: gen_lossless_gpvI)\n\nlemma gen_lossless_gpv_lift_spmf [iff]: \"gen_lossless_gpv (lift_spmf p) \\ lossless_spmf p\"\nby(auto dest: gen_lossless_gpvD intro: gen_lossless_gpvI)\n\nend\n\nlemma gen_lossless_gpv_assert_gpv [iff]: \"gen_lossless_gpv co \\ (assert_gpv b) \\ b\"\nby(cases b) simp_all\n\nabbreviation lossless_gpv :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere \"lossless_gpv \\ gen_lossless_gpv False\"\n\nabbreviation colossless_gpv :: \"('out, 'in) \\ \\ ('a, 'out, 'in) gpv \\ bool\"\nwhere \"colossless_gpv \\ gen_lossless_gpv True\"\n\nlemma lossless_gpv_induct [consumes 1, case_names lossless_gpv, induct pred]:\n assumes *: \"lossless_gpv \\ gpv\"\n and step: \"\\p. \\ lossless_spmf p;\n \\out c input. \\IO out c \\ set_spmf p; input \\ responses_\\ \\ out\\ \\ lossless_gpv \\ (c input);\n \\out c input. \\IO out c \\ set_spmf p; input \\ responses_\\ \\ out\\ \\ P (c input) \\\n \\ P (GPV p)\"\n shows \"P gpv\"\nproof -\n have \"lossless_gpv \\ \\ P\"\n by(rule def_lfp_induct[OF gen_lossless_gpv_False gen_lossless_gpv_mono])(auto intro!: le_funI step)\n then show ?thesis using * by auto\nqed\n\nlemma colossless_gpv_coinduct \n [consumes 1, case_names colossless_gpv, case_conclusion colossless_gpv lossless_spmf continuation, coinduct pred]:\n assumes *: \"X gpv\"\n and step: \"\\gpv. X gpv \\ lossless_spmf (the_gpv gpv) \\ (\\out c input. \n IO out c \\ set_spmf (the_gpv gpv) \\ input \\ responses_\\ \\ out \\ X (c input) \\ colossless_gpv \\ (c input))\"\n shows \"colossless_gpv \\ gpv\"\nproof -\n have \"X \\ colossless_gpv \\\"\n by(rule def_coinduct[OF gen_lossless_gpv_True gen_lossless_gpv_mono])\n (auto 4 4 intro!: le_funI dest!: step intro: exI[where x=\"the_gpv _\"])\n then show ?thesis using * by auto\nqed\n\nlemmas lossless_gpvI = gen_lossless_gpvI[where co=False]\n and lossless_gpvD = gen_lossless_gpvD[where co=False]\n and lossless_gpv_lossless_spmfD = gen_lossless_gpv_lossless_spmfD[where co=False]\n and lossless_gpv_continuationD = gen_lossless_gpv_continuationD[where co=False]\n\nlemmas colossless_gpvI = gen_lossless_gpvI[where co=True]\n and colossless_gpvD = gen_lossless_gpvD[where co=True]\n and colossless_gpv_lossless_spmfD = gen_lossless_gpv_lossless_spmfD[where co=True]\n and colossless_gpv_continuationD = gen_lossless_gpv_continuationD[where co=True]\n\nlemma gen_lossless_bind_gpvI:\n assumes \"gen_lossless_gpv co \\ gpv\" \"\\x. x \\ results_gpv \\ gpv \\ gen_lossless_gpv co \\ (f x)\"\n shows \"gen_lossless_gpv co \\ (gpv \\ f)\"\nproof(cases co)\n case False\n hence eq: \"co = False\" by simp\n show ?thesis using assms unfolding eq\n proof(induction)\n case (lossless_gpv p)\n { fix x\n assume \"Pure x \\ set_spmf p\"\n hence \"x \\ results_gpv \\ (GPV p)\" by simp\n hence \"lossless_gpv \\ (f x)\" by(rule lossless_gpv.prems) }\n with \\lossless_spmf p\\ show ?case unfolding GPV_bind\n apply(intro gen_lossless_gpv_intros)\n apply(fastforce dest: lossless_gpvD split: generat.split)\n apply(clarsimp; split generat.split_asm)\n apply(auto dest: lossless_gpvD intro!: lossless_gpv)\n done\n qed\nnext\n case True\n hence eq: \"co = True\" by simp\n show ?thesis using assms unfolding eq\n proof(coinduction arbitrary: gpv rule: colossless_gpv_coinduct)\n case * [rule_format]: (colossless_gpv gpv)\n from *(1) have ?lossless_spmf \n by(auto 4 3 dest: colossless_gpv_lossless_spmfD elim!: is_PureE intro: *(2)[THEN colossless_gpv_lossless_spmfD] results_gpv.Pure)\n moreover have ?continuation\n proof(intro strip)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv (gpv \\ f))\"\n and input: \"input \\ responses_\\ \\ out\"\n from IO obtain generat where generat: \"generat \\ set_spmf (the_gpv gpv)\"\n and IO: \"IO out c \\ set_spmf (if is_Pure generat then the_gpv (f (result generat))\n else return_spmf (IO (output generat) (\\input. continuation generat input \\ f)))\"\n by(auto)\n show \"(\\gpv. c input = gpv \\ f \\ colossless_gpv \\ gpv \\ (\\x. x \\ results_gpv \\ gpv \\ colossless_gpv \\ (f x))) \\\n colossless_gpv \\ (c input)\"\n proof(cases generat)\n case (Pure x)\n hence \"x \\ results_gpv \\ gpv\" using generat by(auto intro: results_gpv.Pure)\n from *(2)[OF this] have \"colossless_gpv \\ (c input)\"\n using IO Pure input by(auto intro: colossless_gpv_continuationD)\n thus ?thesis ..\n next\n case **: (IO out' c')\n with input generat IO have \"colossless_gpv \\ (f x)\" if \"x \\ results_gpv \\ (c' input)\" for x\n using that by(auto intro: * results_gpv.IO)\n then show ?thesis using IO input ** *(1) generat by(auto dest: colossless_gpv_continuationD)\n qed\n qed\n ultimately show ?case ..\n qed\nqed\n\nlemmas lossless_bind_gpvI = gen_lossless_bind_gpvI[where co=False]\n and colossless_bind_gpvI = gen_lossless_bind_gpvI[where co=True]\n\nlemma gen_lossless_bind_gpvD1: \n assumes \"gen_lossless_gpv co \\ (gpv \\ f)\"\n shows \"gen_lossless_gpv co \\ gpv\"\nproof(cases co)\n case False\n hence eq: \"co = False\" by simp\n show ?thesis using assms unfolding eq\n proof(induction gpv'\\\"gpv \\ f\" arbitrary: gpv)\n case (lossless_gpv p)\n obtain p' where gpv: \"gpv = GPV p'\" by(cases gpv)\n from lossless_gpv.hyps gpv have \"lossless_spmf p'\" by(simp add: GPV_bind)\n then show ?case unfolding gpv\n proof(rule gen_lossless_gpv_intros)\n fix out c input\n assume \"IO out c \\ set_spmf p'\" \"input \\ responses_\\ \\ out\"\n hence \"IO out (\\input. c input \\ f) \\ set_spmf p\" using lossless_gpv.hyps gpv\n by(auto simp add: GPV_bind intro: rev_bexI)\n thus \"lossless_gpv \\ (c input)\" using \\input \\ _\\ by(rule lossless_gpv.hyps) simp\n qed\n qed\nnext\n case True\n hence eq: \"co = True\" by simp\n show ?thesis using assms unfolding eq\n by(coinduction arbitrary: gpv)(auto 4 3 intro: rev_bexI elim!: colossless_gpv_continuationD dest: colossless_gpv_lossless_spmfD)\nqed\n\nlemmas lossless_bind_gpvD1 = gen_lossless_bind_gpvD1[where co=False]\n and colossless_bind_gpvD1 = gen_lossless_bind_gpvD1[where co=True]\n\nlemma gen_lossless_bind_gpvD2:\n assumes \"gen_lossless_gpv co \\ (gpv \\ f)\"\n and \"x \\ results_gpv \\ gpv\"\n shows \"gen_lossless_gpv co \\ (f x)\"\nusing assms(2,1)\nproof(induction)\n case (Pure gpv)\n thus ?case\n by -(rule gen_lossless_gpvI, auto 4 4 dest: gen_lossless_gpvD intro: rev_bexI)\nqed(auto 4 4 dest: gen_lossless_gpvD intro: rev_bexI)\n\nlemmas lossless_bind_gpvD2 = gen_lossless_bind_gpvD2[where co=False]\n and colossless_bind_gpvD2 = gen_lossless_bind_gpvD2[where co=True]\n\nlemma gen_lossless_bind_gpv [simp]:\n \"gen_lossless_gpv co \\ (gpv \\ f) \\ gen_lossless_gpv co \\ gpv \\ (\\x\\results_gpv \\ gpv. gen_lossless_gpv co \\ (f x))\"\nby(blast intro: gen_lossless_bind_gpvI dest: gen_lossless_bind_gpvD1 gen_lossless_bind_gpvD2)\n\nlemmas lossless_bind_gpv = gen_lossless_bind_gpv[where co=False]\n and colossless_bind_gpv = gen_lossless_bind_gpv[where co=True]\n\ncontext includes lifting_syntax begin\n\nlemma rel_gpv''_lossless_gpvD1:\n assumes rel: \"rel_gpv'' A C R gpv gpv'\"\n and gpv: \"lossless_gpv \\ gpv\"\n and [transfer_rule]: \"rel_\\ C R \\ \\'\"\n shows \"lossless_gpv \\' gpv'\"\nusing gpv rel\nproof(induction arbitrary: gpv')\n case (lossless_gpv p)\n from lossless_gpv.prems obtain q where q: \"gpv' = GPV q\"\n and [transfer_rule]: \"rel_spmf (rel_generat A C (R ===> rel_gpv'' A C R)) p q\"\n by(cases gpv') auto\n show ?case\n proof(rule lossless_gpvI)\n have \"lossless_spmf p = lossless_spmf q\" by transfer_prover\n with lossless_gpv.hyps(1) q show \"lossless_spmf (the_gpv gpv')\" by simp\n\n fix out' c' input'\n assume IO': \"IO out' c' \\ set_spmf (the_gpv gpv')\"\n and input': \"input' \\ responses_\\ \\' out'\"\n have \"rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf p) (set_spmf q)\"\n by transfer_prover\n with IO' q obtain out c where IO: \"IO out c \\ set_spmf p\"\n and [transfer_rule]: \"C out out'\" \"(R ===> rel_gpv'' A C R) c c'\"\n by(auto dest!: rel_setD2 elim: generat.rel_cases)\n have \"rel_set R (responses_\\ \\ out) (responses_\\ \\' out')\" by transfer_prover\n moreover\n from this[THEN rel_setD2, OF input'] obtain input\n where [transfer_rule]: \"R input input'\" and input: \"input \\ responses_\\ \\ out\" by blast\n have \"rel_gpv'' A C R (c input) (c' input')\" by transfer_prover\n ultimately show \"lossless_gpv \\' (c' input')\" using input IO by(auto intro: lossless_gpv.IH)\n qed\nqed\n\nlemma rel_gpv''_lossless_gpvD2:\n \"\\ rel_gpv'' A C R gpv gpv'; lossless_gpv \\' gpv'; rel_\\ C R \\ \\' \\\n \\ lossless_gpv \\ gpv\"\nusing rel_gpv''_lossless_gpvD1[of \"A\\\\\" \"C\\\\\" \"R\\\\\" gpv' gpv \\' \\]\nby(simp add: rel_gpv''_conversep prod.rel_conversep rel_fun_eq_conversep)\n\nlemma rel_gpv_lossless_gpvD1:\n \"\\ rel_gpv A C gpv gpv'; lossless_gpv \\ gpv; rel_\\ C (=) \\ \\' \\ \\ lossless_gpv \\' gpv'\"\nusing rel_gpv''_lossless_gpvD1[of A C \"(=)\" gpv gpv' \\ \\'] by(simp add: rel_gpv_conv_rel_gpv'')\n\nlemma rel_gpv_lossless_gpvD2:\n \"\\ rel_gpv A C gpv gpv'; lossless_gpv \\' gpv'; rel_\\ C (=) \\ \\' \\\n \\ lossless_gpv \\ gpv\"\nusing rel_gpv_lossless_gpvD1[of \"A\\\\\" \"C\\\\\" gpv' gpv \\' \\]\nby(simp add: gpv.rel_conversep prod.rel_conversep rel_fun_eq_conversep)\n\nlemma rel_gpv''_colossless_gpvD1:\n assumes rel: \"rel_gpv'' A C R gpv gpv'\"\n and gpv: \"colossless_gpv \\ gpv\"\n and [transfer_rule]: \"rel_\\ C R \\ \\'\"\n shows \"colossless_gpv \\' gpv'\"\nusing gpv rel\nproof(coinduction arbitrary: gpv gpv')\n case (colossless_gpv gpv gpv')\n note [transfer_rule] = \\rel_gpv'' A C R gpv gpv'\\ the_gpv_parametric'\n and co = \\colossless_gpv \\ gpv\\\n have \"lossless_spmf (the_gpv gpv) = lossless_spmf (the_gpv gpv')\" by transfer_prover\n with co have \"?lossless_spmf\" by(auto dest: colossless_gpv_lossless_spmfD)\n moreover have \"?continuation\"\n proof(intro strip disjI1)\n fix out' c' input'\n assume IO': \"IO out' c' \\ set_spmf (the_gpv gpv')\"\n and input': \"input' \\ responses_\\ \\' out'\"\n have \"rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))\"\n by transfer_prover\n with IO' obtain out c where IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n and [transfer_rule]: \"C out out'\" \"(R ===> rel_gpv'' A C R) c c'\"\n by(auto dest!: rel_setD2 elim: generat.rel_cases)\n have \"rel_set R (responses_\\ \\ out) (responses_\\ \\' out')\" by transfer_prover\n moreover \n from this[THEN rel_setD2, OF input'] obtain input\n where [transfer_rule]: \"R input input'\" and input: \"input \\ responses_\\ \\ out\" by blast\n have \"rel_gpv'' A C R (c input) (c' input')\" by transfer_prover\n ultimately show \"\\gpv gpv'. c' input' = gpv' \\ colossless_gpv \\ gpv \\ rel_gpv'' A C R gpv gpv'\"\n using input IO co by(auto dest: colossless_gpv_continuationD)\n qed\n ultimately show ?case ..\nqed\n\nlemma rel_gpv''_colossless_gpvD2:\n \"\\ rel_gpv'' A C R gpv gpv'; colossless_gpv \\' gpv'; rel_\\ C R \\ \\' \\\n \\ colossless_gpv \\ gpv\"\nusing rel_gpv''_colossless_gpvD1[of \"A\\\\\" \"C\\\\\" \"R\\\\\" gpv' gpv \\' \\]\nby(simp add: rel_gpv''_conversep prod.rel_conversep rel_fun_eq_conversep)\n\nlemma rel_gpv_colossless_gpvD1:\n \"\\ rel_gpv A C gpv gpv'; colossless_gpv \\ gpv; rel_\\ C (=) \\ \\' \\ \\ colossless_gpv \\' gpv'\"\nusing rel_gpv''_colossless_gpvD1[of A C \"(=)\" gpv gpv' \\ \\'] by(simp add: rel_gpv_conv_rel_gpv'')\n\nlemma rel_gpv_colossless_gpvD2:\n \"\\ rel_gpv A C gpv gpv'; colossless_gpv \\' gpv'; rel_\\ C (=) \\ \\' \\\n \\ colossless_gpv \\ gpv\"\nusing rel_gpv_colossless_gpvD1[of \"A\\\\\" \"C\\\\\" gpv' gpv \\' \\]\nby(simp add: gpv.rel_conversep prod.rel_conversep rel_fun_eq_conversep)\n\nlemma gen_lossless_gpv_parametric':\n \"((=) ===> rel_\\ C R ===> rel_gpv'' A C R ===> (=))\n gen_lossless_gpv gen_lossless_gpv\"\nproof(rule rel_funI; hypsubst)\n show \"(rel_\\ C R ===> rel_gpv'' A C R ===> (=)) (gen_lossless_gpv b) (gen_lossless_gpv b)\" for b\n by(cases b)(auto intro!: rel_funI dest: rel_gpv''_colossless_gpvD1 rel_gpv''_colossless_gpvD2 rel_gpv''_lossless_gpvD1 rel_gpv''_lossless_gpvD2)\nqed\n\nlemma gen_lossless_gpv_parametric [transfer_rule]:\n \"((=) ===> rel_\\ C (=) ===> rel_gpv A C ===> (=))\n gen_lossless_gpv gen_lossless_gpv\"\nproof(rule rel_funI; hypsubst)\n show \"(rel_\\ C (=) ===> rel_gpv A C ===> (=)) (gen_lossless_gpv b) (gen_lossless_gpv b)\" for b\n by(cases b)(auto intro!: rel_funI dest: rel_gpv_colossless_gpvD1 rel_gpv_colossless_gpvD2 rel_gpv_lossless_gpvD1 rel_gpv_lossless_gpvD2)\nqed\n\nend\n\nlemma gen_lossless_gpv_map_full [simp]:\n \"gen_lossless_gpv b \\_full (map_gpv f g gpv) = gen_lossless_gpv b \\_full gpv\"\n (is \"?lhs = ?rhs\")\nproof(cases \"b = True\")\n case True\n show \"?lhs = ?rhs\"\n proof\n show ?rhs if ?lhs using that unfolding True\n by(coinduction arbitrary: gpv)(auto 4 3 dest: colossless_gpvD simp add: gpv.map_sel intro!: rev_image_eqI)\n show ?lhs if ?rhs using that unfolding True\n by(coinduction arbitrary: gpv)(auto 4 4 dest: colossless_gpvD simp add: gpv.map_sel intro!: rev_image_eqI)\n qed\nnext\n case False\n hence False: \"b = False\" by simp\n show \"?lhs = ?rhs\"\n proof\n show ?rhs if ?lhs using that unfolding False\n apply(induction gpv'\\\"map_gpv f g gpv\" arbitrary: gpv)\n subgoal for p gpv by(cases gpv)(rule lossless_gpvI; fastforce intro: rev_image_eqI)\n done\n show ?lhs if ?rhs using that unfolding False\n by induction(auto 4 4 intro: lossless_gpvI)\n qed\nqed\n\nlemma gen_lossless_gpv_map_id [simp]:\n \"gen_lossless_gpv b \\ (map_gpv f id gpv) = gen_lossless_gpv b \\ gpv\"\n using gen_lossless_gpv_parametric[of \"BNF_Def.Grp UNIV id\" \"BNF_Def.Grp UNIV f\"] unfolding gpv.rel_Grp\n by(simp add: rel_fun_def eq_alt[symmetric] rel_\\_eq)(auto simp add: Grp_def)\n\nlemma results_gpv_try_gpv [simp]:\n \"results_gpv \\ (TRY gpv ELSE gpv') = \n results_gpv \\ gpv \\ (if colossless_gpv \\ gpv then {} else results_gpv \\ gpv')\"\n (is \"?lhs = ?rhs\")\nproof(intro set_eqI iffI)\n show \"x \\ ?rhs\" if \"x \\ ?lhs\" for x using that\n proof(induction gpv''\\\"try_gpv gpv gpv'\" arbitrary: gpv)\n case Pure thus ?case\n by(auto split: if_split_asm intro: results_gpv.Pure dest: colossless_gpv_lossless_spmfD)\n next\n case (IO out c input)\n then show ?case\n apply(auto dest: colossless_gpv_lossless_spmfD split: if_split_asm)\n apply(force intro: results_gpv.IO dest: colossless_gpv_continuationD split: if_split_asm)+\n done\n qed\nnext\n fix x\n assume \"x \\ ?rhs\"\n then consider (left) \"x \\ results_gpv \\ gpv\" | (right) \"\\ colossless_gpv \\ gpv\" \"x \\ results_gpv \\ gpv'\"\n by(auto split: if_split_asm)\n thus \"x \\ ?lhs\"\n proof cases\n case left\n thus ?thesis \n by(induction)(auto 4 4 intro: results_gpv.intros rev_image_eqI split del: if_split)\n next\n case right\n from right(1) show ?thesis\n proof(rule contrapos_np)\n assume \"x \\ ?lhs\"\n with right(2) show \"colossless_gpv \\ gpv\"\n proof(coinduction arbitrary: gpv)\n case (colossless_gpv gpv)\n then have ?lossless_spmf\n apply(rewrite in asm try_gpv.code)\n apply(rule ccontr)\n apply(erule results_gpv.cases)\n apply(fastforce simp add: image_Un image_image generat.map_comp o_def)+\n done\n moreover have \"?continuation\" using colossless_gpv\n by(auto 4 4 split del: if_split simp add: image_Un image_image generat.map_comp o_def intro: rev_image_eqI results_gpv.IO)\n ultimately show ?case ..\n qed\n qed\n qed\nqed\n\nlemma results'_gpv_try_gpv [simp]:\n \"results'_gpv (TRY gpv ELSE gpv') = \n results'_gpv gpv \\ (if colossless_gpv \\_full gpv then {} else results'_gpv gpv')\"\nby(simp add: results_gpv_\\_full[symmetric])\n\nlemma outs'_gpv_try_gpv [simp]:\n \"outs'_gpv (TRY gpv ELSE gpv') =\n outs'_gpv gpv \\ (if colossless_gpv \\_full gpv then {} else outs'_gpv gpv')\"\n (is \"?lhs = ?rhs\")\nproof(intro set_eqI iffI)\n show \"x \\ ?rhs\" if \"x \\ ?lhs\" for x using that\n proof(induction gpv''\\\"try_gpv gpv gpv'\" arbitrary: gpv)\n case Out thus ?case\n by(auto 4 3 simp add: generat.map_comp o_def elim!: generat.set_cases(2) intro: outs'_gpv_Out split: if_split_asm dest: colossless_gpv_lossless_spmfD)\n next\n case (Cont generat c input)\n then show ?case\n apply(auto dest: colossless_gpv_lossless_spmfD split: if_split_asm elim!: generat.set_cases(3))\n apply(auto 4 3 dest: colossless_gpv_continuationD split: if_split_asm intro: outs'_gpv_Cont elim!: meta_allE meta_impE[OF _ refl])+\n done\n qed\nnext\n fix x\n assume \"x \\ ?rhs\"\n then consider (left) \"x \\ outs'_gpv gpv\" | (right) \"\\ colossless_gpv \\_full gpv\" \"x \\ outs'_gpv gpv'\"\n by(auto split: if_split_asm)\n thus \"x \\ ?lhs\"\n proof cases\n case left\n thus ?thesis \n by(induction)(auto elim!: generat.set_cases(2,3) intro: outs'_gpvI intro!: rev_image_eqI split del: if_split simp add: image_Un image_image generat.map_comp o_def)\n next\n case right\n from right(1) show ?thesis\n proof(rule contrapos_np)\n assume \"x \\ ?lhs\"\n with right(2) show \"colossless_gpv \\_full gpv\"\n proof(coinduction arbitrary: gpv)\n case (colossless_gpv gpv)\n then have ?lossless_spmf\n apply(rewrite in asm try_gpv.code)\n apply(erule contrapos_np)\n apply(erule gpv.set_cases)\n apply(auto 4 3 simp add: image_Un image_image generat.map_comp o_def generat.set_map in_set_spmf[symmetric] bind_UNION generat.map_id[unfolded id_def] elim!: generat.set_cases)\n done\n moreover have \"?continuation\" using colossless_gpv\n by(auto simp add: image_Un image_image generat.map_comp o_def split del: if_split intro!: rev_image_eqI intro: outs'_gpv_Cont)\n ultimately show ?case ..\n qed\n qed\n qed\nqed\n\nlemma pred_gpv_try [simp]:\n \"pred_gpv P Q (try_gpv gpv gpv') = (pred_gpv P Q gpv \\ (\\ colossless_gpv \\_full gpv \\ pred_gpv P Q gpv'))\"\nby(auto simp add: pred_gpv_def)\n\nlemma lossless_WT_gpv_induct [consumes 2, case_names lossless_gpv]:\n assumes lossless: \"lossless_gpv \\ gpv\"\n and WT: \"\\ \\g gpv \\\"\n and step: \"\\p. \\\n lossless_spmf p;\n \\out c. IO out c \\ set_spmf p \\ out \\ outs_\\ \\;\n \\out c input. \\IO out c \\ set_spmf p; out \\ outs_\\ \\ \\ input \\ responses_\\ \\ out\\ \\ lossless_gpv \\ (c input);\n \\out c input. \\IO out c \\ set_spmf p; out \\ outs_\\ \\ \\ input \\ responses_\\ \\ out\\ \\ \\ \\g c input \\;\n \\out c input. \\IO out c \\ set_spmf p; out \\ outs_\\ \\ \\ input \\ responses_\\ \\ out\\ \\ P (c input)\\\n \\ P (GPV p)\"\n shows \"P gpv\"\nusing lossless WT\napply(induction)\napply(erule step)\napply(auto elim: WT_gpvD simp add: WT_gpv_simps)\ndone\n\nlemma lossless_gpv_induct_strong [consumes 1, case_names lossless_gpv]:\n assumes gpv: \"lossless_gpv \\ gpv\"\n and step:\n \"\\p. \\ lossless_spmf p;\n \\gpv. gpv \\ sub_gpvs \\ (GPV p) \\ lossless_gpv \\ gpv;\n \\gpv. gpv \\ sub_gpvs \\ (GPV p) \\ P gpv \\\n \\ P (GPV p)\"\n shows \"P gpv\"\nproof -\n define gpv' where \"gpv' = gpv\"\n then have \"gpv' \\ insert gpv (sub_gpvs \\ gpv)\" by simp\n with gpv have \"lossless_gpv \\ gpv' \\ P gpv'\"\n proof(induction arbitrary: gpv')\n case (lossless_gpv p)\n from \\gpv' \\ insert (GPV p) _\\ show ?case\n proof(rule insertE)\n assume \"gpv' = GPV p\"\n moreover have \"lossless_gpv \\ (GPV p)\"\n by(auto 4 3 intro: lossless_gpvI lossless_gpv.hyps)\n moreover have \"P (GPV p)\" using lossless_gpv.hyps(1)\n by(rule step)(fastforce elim: sub_gpvs.cases lossless_gpv.IH[THEN conjunct1] lossless_gpv.IH[THEN conjunct2])+\n ultimately show ?case by simp\n qed(fastforce elim: sub_gpvs.cases lossless_gpv.IH[THEN conjunct1] lossless_gpv.IH[THEN conjunct2])\n qed\n thus ?thesis by(simp add: gpv'_def)\nqed\n\nlemma lossless_sub_gpvsI:\n assumes spmf: \"lossless_spmf (the_gpv gpv)\"\n and sub: \"\\gpv'. gpv' \\ sub_gpvs \\ gpv \\ lossless_gpv \\ gpv'\"\n shows \"lossless_gpv \\ gpv\"\nusing spmf by(rule lossless_gpvI)(rule sub[OF sub_gpvs.base])\n\nlemma lossless_sub_gpvsD:\n assumes \"lossless_gpv \\ gpv\" \"gpv' \\ sub_gpvs \\ gpv\"\n shows \"lossless_gpv \\ gpv'\"\nusing assms(2,1) by(induction)(auto dest: lossless_gpvD)\n\nlemma lossless_WT_gpv_induct_strong [consumes 2, case_names lossless_gpv]:\n assumes lossless: \"lossless_gpv \\ gpv\"\n and WT: \"\\ \\g gpv \\\"\n and step: \"\\p. \\ lossless_spmf p;\n \\out c. IO out c \\ set_spmf p \\ out \\ outs_\\ \\;\n \\gpv. gpv \\ sub_gpvs \\ (GPV p) \\ lossless_gpv \\ gpv;\n \\gpv. gpv \\ sub_gpvs \\ (GPV p) \\ \\ \\g gpv \\;\n \\gpv. gpv \\ sub_gpvs \\ (GPV p) \\ P gpv \\\n \\ P (GPV p)\"\n shows \"P gpv\"\nusing lossless WT\napply(induction rule: lossless_gpv_induct_strong)\napply(erule step)\napply(auto elim: WT_gpvD dest: WT_sub_gpvsD)\ndone\n\nlemma try_gpv_gen_lossless: \\ \\TODO: generalise to arbitrary typings ?\\\n \"gen_lossless_gpv b \\_full gpv \\ (TRY gpv ELSE gpv') = gpv\"\nproof(coinduction arbitrary: gpv)\n case (Eq_gpv gpv)\n from Eq_gpv[THEN gen_lossless_gpv_lossless_spmfD]\n have eq: \"the_gpv gpv = (TRY the_gpv gpv ELSE the_gpv gpv')\" by(simp)\n show ?case\n by(subst eq)(auto simp add: spmf_rel_map generat.rel_map[abs_def] intro!: rel_spmf_try_spmf rel_spmf_reflI rel_generat_reflI elim!: generat.set_cases gen_lossless_gpv_continuationD[OF Eq_gpv] simp add: Eq_gpv[THEN gen_lossless_gpv_lossless_spmfD])\nqed\n\n\\ \\We instantiate the parameter @{term b} such that it can be used as a conditional simp rule.\\\nlemmas try_gpv_lossless [simp] = try_gpv_gen_lossless[where b=False]\n and try_gpv_colossless [simp] = try_gpv_gen_lossless[where b=True]\n\nlemma try_gpv_bind_gen_lossless: \\ \\TODO: generalise to arbitrary typings?\\\n \"gen_lossless_gpv b \\_full gpv \\ TRY bind_gpv gpv f ELSE gpv' = bind_gpv gpv (\\x. TRY f x ELSE gpv')\"\nproof(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\n case (Eq_gpv gpv)\n note [simp] = spmf_rel_map generat.rel_map map_spmf_bind_spmf\n and [intro!] = rel_spmf_reflI rel_generat_reflI rel_funI\n show ?case using gen_lossless_gpvD[OF Eq_gpv]\n by(auto 4 3 simp del: bind_gpv_sel' simp add: bind_gpv.sel try_spmf_bind_spmf_lossless split: generat.split intro!: rel_spmf_bind_reflI rel_spmf_try_spmf)\nqed\n\n\\ \\We instantiate the parameter @{term b} such that it can be used as a conditional simp rule.\\\nlemmas try_gpv_bind_lossless = try_gpv_bind_gen_lossless[where b=False]\n and try_gpv_bind_colossless = try_gpv_bind_gen_lossless[where b=True]\n\nlemma try_gpv_cong:\n \"\\ gpv = gpv''; \\ colossless_gpv \\_full gpv'' \\ gpv' = gpv''' \\\n \\ try_gpv gpv gpv' = try_gpv gpv'' gpv'''\"\nby(cases \"colossless_gpv \\_full gpv''\") simp_all\n\n(* lemma try_gpv_bind_colossless2:\n \"colossless_gpv \\_full gpv' \\ try_gpv (bind_gpv gpv f) gpv' = try_gpv (bind_gpv gpv (\\x. try_gpv (f x) gpv')) gpv'\"\napply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\napply(simp add: spmf_rel_map bind_gpv_sel del: bind_gpv_sel')\napply(rule rel_spmf_try_spmf)\n apply(simp add: spmf_rel_map)\n apply(rule rel_spmf_bind_reflI)\n apply(simp split: generat.split)\n apply(rule conjI; clarsimp)\n apply(simp add: spmf_rel_map generat.map_comp o_def generat.rel_map rel_fun_def)\n apply(subst map_try_spmf[symmetric])\n *)\n\nsubsection \\Sequencing with failure handling included\\\n\ndefinition catch_gpv :: \"('a, 'out, 'in) gpv \\ ('a option, 'out, 'in) gpv\"\nwhere \"catch_gpv gpv = TRY map_gpv Some id gpv ELSE Done None\"\n\nlemma catch_gpv_Done [simp]: \"catch_gpv (Done x) = Done (Some x)\"\nby(simp add: catch_gpv_def)\n\nlemma catch_gpv_Fail [simp]: \"catch_gpv Fail = Done None\"\nby(simp add: catch_gpv_def)\n\nlemma catch_gpv_Pause [simp]: \"catch_gpv (Pause out rpv) = Pause out (\\input. catch_gpv (rpv input))\"\nby(simp add: catch_gpv_def)\n\nlemma catch_gpv_lift_spmf [simp]: \"catch_gpv (lift_spmf p) = lift_spmf (spmf_of_pmf p)\"\nby(rule gpv.expand)(auto simp add: catch_gpv_def spmf_of_pmf_def map_lift_spmf try_spmf_def o_def map_pmf_def bind_assoc_pmf bind_return_pmf intro!: bind_pmf_cong[OF refl] split: option.split)\n\nlemma catch_gpv_assert [simp]: \"catch_gpv (assert_gpv b) = Done (assert_option b)\"\nby(cases b) simp_all\n\nlemma catch_gpv_sel [simp]:\n \"the_gpv (catch_gpv gpv) = \n TRY map_spmf (map_generat Some id (\\rpv input. catch_gpv (rpv input))) (the_gpv gpv)\n ELSE return_spmf (Pure None)\"\nby(simp add: catch_gpv_def gpv.map_sel spmf.map_comp o_def generat.map_comp map_try_spmf id_def)\n\nlemma catch_gpv_bind_gpv: \"catch_gpv (bind_gpv gpv f) = bind_gpv (catch_gpv gpv) (\\x. case x of None \\ Done None | Some x' \\ catch_gpv (f x'))\"\n using [[show_variants]]\n apply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\n apply(clarsimp simp add: map_bind_pmf bind_gpv.sel spmf.map_comp o_def[abs_def] map_bind_spmf generat.map_comp simp del: bind_gpv_sel')\n apply(subst bind_spmf_def)\n apply(subst try_spmf_bind_pmf)\n apply(subst (2) try_spmf_def)\n apply(subst bind_spmf_pmf_assoc)\n apply(simp add: bind_map_pmf)\n apply(rule rel_pmf_bind_reflI)\n apply(auto split!: option.split generat.split simp add: spmf_rel_map spmf.map_comp o_def generat.map_comp id_def[symmetric] generat.map_id rel_spmf_reflI generat.rel_refl refl rel_fun_def)\n done\n\ncontext includes lifting_syntax begin\nlemma catch_gpv_parametric [transfer_rule]:\n \"(rel_gpv A C ===> rel_gpv (rel_option A) C) catch_gpv catch_gpv\"\nunfolding catch_gpv_def by transfer_prover\n\nlemma catch_gpv_parametric':\n notes [transfer_rule] = try_gpv_parametric' map_gpv_parametric' Done_parametric'\n shows \"(rel_gpv'' A C R ===> rel_gpv'' (rel_option A) C R) catch_gpv catch_gpv\"\nunfolding catch_gpv_def by transfer_prover\nend\n\nlemma catch_gpv_map': \"catch_gpv (map_gpv' f g h gpv) = map_gpv' (map_option f) g h (catch_gpv gpv)\"\nby(simp add: catch_gpv_def map'_try_gpv map_gpv_conv_map_gpv' map_gpv'_comp o_def)\n\nlemma catch_gpv_map: \"catch_gpv (map_gpv f g gpv) = map_gpv (map_option f) g (catch_gpv gpv)\"\n by(simp add: map_gpv_conv_map_gpv' catch_gpv_map')\n\nlemma colossless_gpv_catch_gpv [simp]: \"colossless_gpv \\_full (catch_gpv gpv)\"\nby(coinduction arbitrary: gpv) auto\n\nlemma colosless_gpv_catch_gpv_conv_map:\n \"colossless_gpv \\_full gpv \\ catch_gpv gpv = map_gpv Some id gpv\"\n apply(coinduction arbitrary: gpv)\n apply(frule colossless_gpv_lossless_spmfD)\n apply(auto simp add: spmf_rel_map gpv.map_sel generat.rel_map intro!: rel_spmf_reflI generat.rel_refl_strong rel_funI elim!: colossless_gpv_continuationD generat.set_cases)\n done\n\nlemma catch_gpv_catch_gpv [simp]: \"catch_gpv (catch_gpv gpv) = map_gpv Some id (catch_gpv gpv)\"\n by(simp add: colosless_gpv_catch_gpv_conv_map)\n\nlemma case_map_resumption: (* Move to Resumption *)\n \"case_resumption done pause (map_resumption f g r) = \n case_resumption (done \\ map_option f) (\\out c. pause (g out) (map_resumption f g \\ c)) r\" \nby(cases r) simp_all\n\nlemma catch_gpv_lift_resumption [simp]: \"catch_gpv (lift_resumption r) = lift_resumption (map_resumption Some id r)\"\n apply(coinduction arbitrary: r)\n apply(auto simp add: lift_resumption.sel case_map_resumption split: resumption.split option.split)\n oops (* TODO: We'd need a catch_resumption for this *)\n\nlemma results_gpv_catch_gpv:\n \"results_gpv \\ (catch_gpv gpv) = Some ` results_gpv \\ gpv \\ (if colossless_gpv \\ gpv then {} else {None})\"\n by(simp add: catch_gpv_def)\n\nlemma Some_in_results_gpv_catch_gpv [simp]:\n \"Some x \\ results_gpv \\ (catch_gpv gpv) \\ x \\ results_gpv \\ gpv\"\n by(auto simp add: results_gpv_catch_gpv)\n\nlemma None_in_results_gpv_catch_gpv [simp]:\n \"None \\ results_gpv \\ (catch_gpv gpv) \\ \\ colossless_gpv \\ gpv\"\n by(auto simp add: results_gpv_catch_gpv)\n\nlemma results'_gpv_catch_gpv:\n \"results'_gpv (catch_gpv gpv) = Some ` results'_gpv gpv \\ (if colossless_gpv \\_full gpv then {} else {None})\"\n by(simp add: results_gpv_\\_full[symmetric] results_gpv_catch_gpv)\n\nlemma Some_in_results'_gpv_catch_gpv [simp]:\n \"Some x \\ results'_gpv (catch_gpv gpv) \\ x \\ results'_gpv gpv\"\n by(simp add: results_gpv_\\_full[symmetric])\n\nlemma None_in_results'_gpv_catch_gpv [simp]:\n \"None \\ results'_gpv (catch_gpv gpv) \\ \\ colossless_gpv \\_full gpv\"\n by(simp add: results_gpv_\\_full[symmetric])\n\nlemma results'_gpv_catch_gpvE:\n assumes \"x \\ results'_gpv (catch_gpv gpv)\"\n obtains (Some) x'\n where \"x = Some x'\" \"x' \\ results'_gpv gpv\"\n | (colossless) \"x = None\" \"\\ colossless_gpv \\_full gpv\"\n using assms by(auto simp add: results'_gpv_catch_gpv split: if_split_asm)\n\nlemma outs'_gpv_catch_gpv [simp]: \"outs'_gpv (catch_gpv gpv) = outs'_gpv gpv\"\n by(simp add: catch_gpv_def)\n\nlemma pred_gpv_catch_gpv [simp]: \"pred_gpv (pred_option P) Q (catch_gpv gpv) = pred_gpv P Q gpv\"\n by(simp add: pred_gpv_def results'_gpv_catch_gpv)\n\nabbreviation bind_gpv' :: \"('a, 'call, 'ret) gpv \\ ('a option \\ ('b, 'call, 'ret) gpv) \\ ('b, 'call, 'ret) gpv\"\nwhere \"bind_gpv' gpv \\ bind_gpv (catch_gpv gpv)\"\n\n(* lemma bind_gpv'_sel [simp]:\n \"the_gpv (bind_gpv' gpv f) =\n bind_pmf (the_gpv gpv) (\\x. case x of\n None \\ the_gpv (f None)\n | Some (Pure x) \\ the_gpv (f (Some x))\n | Some (IO out rpv) \\ return_spmf (IO out (\\input. bind_gpv' (rpv input) f)))\"\nby(auto simp add: bind_gpv'_def bind_map_spmf try_spmf_def bind_spmf_pmf_assoc bind_map_pmf gpv.map_sel intro!: bind_pmf_cong[OF refl] split: option.split generat.split)\n *)\n \nlemma bind_gpv'_assoc [simp]: \"bind_gpv' (bind_gpv' gpv f) g = bind_gpv' gpv (\\x. bind_gpv' (f x) g)\"\nby(simp add: catch_gpv_bind_gpv bind_map_gpv o_def bind_gpv_assoc)\n\nlemma bind_gpv'_bind_gpv: \"bind_gpv' (bind_gpv gpv f) g = bind_gpv' gpv (case_option (g None) (\\y. bind_gpv' (f y) g))\"\n by(clarsimp simp add: catch_gpv_bind_gpv bind_gpv_assoc intro!: bind_gpv_cong[OF refl] split: option.split)\n\nlemma bind_gpv'_cong:\n \"\\ gpv = gpv'; \\x. x \\ Some ` results'_gpv gpv' \\ (\\ colossless_gpv \\_full gpv \\ x = None) \\ f x = f' x \\\n \\ bind_gpv' gpv f = bind_gpv' gpv' f'\"\nby(auto elim: results'_gpv_catch_gpvE split: if_split_asm intro!: bind_gpv_cong[OF refl])\n\nlemma bind_gpv'_cong2:\n \"\\ gpv = gpv'; \\x. x \\ results'_gpv gpv' \\ f (Some x) = f' (Some x); \\ colossless_gpv \\_full gpv \\ f None = f' None \\\n \\ bind_gpv' gpv f = bind_gpv' gpv' f'\"\nby(rule bind_gpv'_cong) auto\n\nsubsection \\Inlining\\\n\nlemma gpv_coinduct_bind [consumes 1, case_names Eq_gpv]:\n fixes gpv gpv' :: \"('a, 'call, 'ret) gpv\"\n assumes *: \"R gpv gpv'\"\n and step: \"\\gpv gpv'. R gpv gpv' \n \\ rel_spmf (rel_generat (=) (=) (rel_fun (=) (\\gpv gpv'. R gpv gpv' \\ gpv = gpv' \\ \n (\\gpv2 :: ('b, 'call, 'ret) gpv. \\gpv2' :: ('c, 'call, 'ret) gpv. \\f f'. gpv = bind_gpv gpv2 f \\ gpv' = bind_gpv gpv2' f' \\ \n rel_gpv (\\x y. R (f x) (f' y)) (=) gpv2 gpv2'))))\n (the_gpv gpv) (the_gpv gpv')\"\n shows \"gpv = gpv'\"\nproof -\n fix x y\n define gpv1 :: \"('b, 'call, 'ret) gpv\"\n and f :: \"'b \\ ('a, 'call, 'ret) gpv\"\n and gpv1' :: \"('c, 'call, 'ret) gpv\"\n and f' :: \"'c \\ ('a, 'call, 'ret) gpv\"\n where \"gpv1 = Done x\"\n and \"f = (\\_. gpv)\"\n and \"gpv1' = Done y\"\n and \"f' = (\\_. gpv')\"\n from * have \"rel_gpv (\\x y. R (f x) (f' y)) (=) gpv1 gpv1'\"\n by(simp add: gpv1_def gpv1'_def f_def f'_def)\n then have \"gpv1 \\ f = gpv1' \\ f'\"\n proof(coinduction arbitrary: gpv1 gpv1' f f' rule: gpv.coinduct_strong)\n case (Eq_gpv gpv1 gpv1' f f')\n from Eq_gpv[simplified gpv.rel_sel] show ?case unfolding bind_gpv.sel spmf_rel_map\n apply(rule rel_spmf_bindI)\n subgoal for generat generat'\n apply(cases generat generat' rule: generat.exhaust[case_product generat.exhaust]; clarsimp simp add: o_def spmf_rel_map generat.rel_map)\n subgoal premises Pure for x y\n using step[OF \\R (f x) (f' y)\\] apply -\n apply(assumption | rule rel_spmf_mono rel_generat_mono rel_fun_mono refl)+\n apply(fastforce intro: exI[where x=\"Done _\"])+\n done\n subgoal by(fastforce simp add: rel_fun_def)\n done\n done\n qed\n thus ?thesis by(simp add: gpv1_def gpv1'_def f_def f'_def)\nqed\n\ntext \\\n Inlining one gpv into another. This may throw out arbitrarily many\n interactions between the two gpvs if the inlined one does not call its callee.\n So we define it as the coiteration of a least-fixpoint search operator.\n\\\n\ncontext\n fixes callee :: \"'s \\ 'call \\ ('ret \\ 's, 'call', 'ret') gpv\"\n notes [[function_internals]]\nbegin\n\npartial_function (spmf) inline1\n :: \"('a, 'call, 'ret) gpv \\ 's\n \\ ('a \\ 's + 'call' \\ ('ret \\ 's, 'call', 'ret') rpv \\ ('a, 'call, 'ret) rpv) spmf\"\nwhere\n \"inline1 gpv s =\n the_gpv gpv \\\n case_generat (\\x. return_spmf (Inl (x, s)))\n (\\out rpv. the_gpv (callee s out) \\\n case_generat (\\(x, y). inline1 (rpv x) y)\n (\\out rpv'. return_spmf (Inr (out, rpv', rpv))))\"\n\nlemma inline1_unfold:\n \"inline1 gpv s =\n the_gpv gpv \\\n case_generat (\\x. return_spmf (Inl (x, s)))\n (\\out rpv. the_gpv (callee s out) \\\n case_generat (\\(x, y). inline1 (rpv x) y)\n (\\out rpv'. return_spmf (Inr (out, rpv', rpv))))\"\nby(fact inline1.simps)\n\nlemma inline1_fixp_induct [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\inline1'. P (\\gpv s. inline1' (gpv, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\inline1'. P inline1' \\ P (\\gpv s. the_gpv gpv \\ case_generat (\\x. return_spmf (Inl (x, s))) (\\out rpv. the_gpv (callee s out) \\ case_generat (\\(x, y). inline1' (rpv x) y) (\\out rpv'. return_spmf (Inr (out, rpv', rpv)))))\"\n shows \"P inline1\"\nusing assms by(rule inline1.fixp_induct[unfolded curry_conv[abs_def]])\n\nlemma inline1_fixp_induct_strong [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\inline1'. P (\\gpv s. inline1' (gpv, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\inline1'. \\ \\gpv s. ord_spmf (=) (inline1' gpv s) (inline1 gpv s); P inline1' \\\n \\ P (\\gpv s. the_gpv gpv \\ case_generat (\\x. return_spmf (Inl (x, s))) (\\out rpv. the_gpv (callee s out) \\ case_generat (\\(x, y). inline1' (rpv x) y) (\\out rpv'. return_spmf (Inr (out, rpv', rpv)))))\"\n shows \"P inline1\"\nusing assms by(rule spmf.fixp_strong_induct_uc[where P=\"\\f. P (curry f)\" and U=case_prod and C=curry, OF inline1.mono inline1_def, simplified curry_case_prod, simplified curry_conv[abs_def] fun_ord_def split_paired_All prod.case case_prod_eta, OF refl]) blast+\n\nlemma inline1_fixp_induct_strong2 [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\inline1'. P (\\gpv s. inline1' (gpv, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\inline1'. \n \\ \\gpv s. ord_spmf (=) (inline1' gpv s) (inline1 gpv s); \n \\gpv s. ord_spmf (=) (inline1' gpv s) (the_gpv gpv \\ case_generat (\\x. return_spmf (Inl (x, s))) (\\out rpv. the_gpv (callee s out) \\ case_generat (\\(x, y). inline1' (rpv x) y) (\\out rpv'. return_spmf (Inr (out, rpv', rpv)))));\n P inline1' \\\n \\ P (\\gpv s. the_gpv gpv \\ case_generat (\\x. return_spmf (Inl (x, s))) (\\out rpv. the_gpv (callee s out) \\ case_generat (\\(x, y). inline1' (rpv x) y) (\\out rpv'. return_spmf (Inr (out, rpv', rpv)))))\"\n shows \"P inline1\"\nusing assms\nby(rule spmf.fixp_induct_strong2_uc[where P=\"\\f. P (curry f)\" and U=case_prod and C=curry, OF inline1.mono inline1_def, simplified curry_case_prod, simplified curry_conv[abs_def] fun_ord_def split_paired_All prod.case case_prod_eta, OF refl]) blast+\n\ntext \\\n Iterate @{const inline1} over all interactions. We'd like to use @{const bind_gpv} before\n the recursive call, but primcorec does not support this. So we emulate @{const bind_gpv}\n by effectively defining two mutually recursive functions (sum type in the argument)\n where the second is exactly @{const bind_gpv} specialised to call \\inline\\ in the bind.\n\\\n\nprimcorec inline_aux\n :: \"('a, 'call, 'ret) gpv \\ 's + ('ret \\ ('a, 'call, 'ret) gpv) \\ ('ret \\ 's, 'call', 'ret') gpv\n \\ ('a \\ 's, 'call', 'ret') gpv\"\nwhere\n \"\\state. the_gpv (inline_aux state) =\n (case state of Inl (c, s) \\ map_spmf (\\result. \n case result of Inl (x, s) \\ Pure (x, s)\n | Inr (out, oracle, rpv) \\ IO out (\\input. inline_aux (Inr (rpv, oracle input)))) (inline1 c s)\n | Inr (rpv, c) \\ \n map_spmf (\\result. \n case result of Inl (Inl (x, s)) \\ Pure (x, s)\n | Inl (Inr (out, oracle, rpv)) \\ IO out (\\input. inline_aux (Inr (rpv, oracle input)))\n | Inr (out, c) \\ IO out (\\input. inline_aux (Inr (rpv, c input))))\n (bind_spmf (the_gpv c) (\\generat. case generat of Pure (x, s') \\ (map_spmf Inl (inline1 (rpv x) s'))\n | IO out c \\ return_spmf (Inr (out, c)))\n ))\"\n\ndeclare inline_aux.simps[simp del]\n\ndefinition inline :: \"('a, 'call, 'ret) gpv \\ 's \\ ('a \\ 's, 'call', 'ret') gpv\"\nwhere \"inline c s = inline_aux (Inl (c, s))\"\n\nlemma inline_aux_Inr:\n \"inline_aux (Inr (rpv, oracl)) = bind_gpv oracl (\\(x, s). inline (rpv x) s)\"\nunfolding inline_def\napply(coinduction arbitrary: oracl rule: gpv.coinduct_strong)\napply(simp add: inline_aux.sel bind_gpv.sel spmf_rel_map del: bind_gpv_sel')\napply(rule rel_spmf_bindI[where R=\"(=)\"])\napply(auto simp add: spmf_rel_map inline_aux.sel rel_spmf_reflI generat.rel_map generat.rel_refl rel_fun_def split: generat.split)\ndone\n\nlemma inline_sel:\n \"the_gpv (inline c s) = \n map_spmf (\\result. case result of Inl xs \\ Pure xs\n | Inr (out, oracle, rpv) \\ IO out (\\input. bind_gpv (oracle input) (\\(x, s'). inline (rpv x) s'))) (inline1 c s)\"\nby(simp add: inline_def inline_aux.sel inline_aux_Inr cong del: sum.case_cong)\n\nlemma inline1_Fail [simp]: \"inline1 Fail s = return_pmf None\"\nby(rewrite inline1.simps) simp\n\nlemma inline_Fail [simp]: \"inline Fail s = Fail\"\nby(rule gpv.expand)(simp add: inline_sel)\n\nlemma inline1_Done [simp]: \"inline1 (Done x) s = return_spmf (Inl (x, s))\"\nby(rewrite inline1.simps) simp\n\nlemma inline_Done [simp]: \"inline (Done x) s = Done (x, s)\"\nby(rule gpv.expand)(simp add: inline_sel)\n\nlemma inline1_lift_spmf [simp]: \"inline1 (lift_spmf p) s = map_spmf (\\x. Inl (x, s)) p\"\nby(rewrite inline1.simps)(simp add: bind_map_spmf o_def map_spmf_conv_bind_spmf)\n\nlemma inline_lift_spmf [simp]: \"inline (lift_spmf p) s = lift_spmf (map_spmf (\\x. (x, s)) p)\"\nby(rule gpv.expand)(simp add: inline_sel spmf.map_comp o_def)\n\nlemma inline1_Pause:\n \"inline1 (Pause out c) s = \n the_gpv (callee s out) \\ (\\react. case react of Pure (x, s') \\ inline1 (c x) s' | IO out' c' \\ return_spmf (Inr (out', c', c)))\"\nby(rewrite inline1.simps) simp\n\nlemma inline_Pause [simp]:\n \"inline (Pause out c) s = callee s out \\ (\\(x, s'). inline (c x) s')\"\nby(rule gpv.expand)(auto simp add: inline_sel inline1_Pause map_spmf_bind_spmf bind_gpv.sel o_def[abs_def] spmf.map_comp generat.map_comp id_def generat.map_id[unfolded id_def] simp del: bind_gpv_sel' intro!: bind_spmf_cong[OF refl] split: generat.split)\n\nlemma inline1_bind_gpv:\n fixes gpv f s\n defines [simp]: \"inline11 \\ inline1\" and [simp]: \"inline12 \\ inline1\" and [simp]: \"inline13 \\ inline1\"\n shows \"inline11 (bind_gpv gpv f) s = bind_spmf (inline12 gpv s) \n (\\res. case res of Inl (x, s') \\ inline13 (f x) s' | Inr (out, rpv', rpv) \\ return_spmf (Inr (out, rpv', bind_rpv rpv f)))\"\n (is \"?lhs = ?rhs\")\nproof(rule spmf.leq_antisym)\n note [intro!] = ord_spmf_bind_reflI and [split] = generat.split\n show \"ord_spmf (=) ?lhs ?rhs\" unfolding inline11_def\n proof(induction arbitrary: gpv s f rule: inline1_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step inline1')\n show ?case unfolding inline12_def\n apply(rewrite inline1.simps; clarsimp simp add: bind_rpv_def)\n apply(rule conjI; clarsimp)\n subgoal premises Pure for x\n apply(rewrite inline1.simps; clarsimp)\n subgoal for out c ret s' using step.IH[of \"Done x\" \"\\_. c ret\" s'] by simp\n done\n subgoal for out c ret s' using step.IH[of \"c ret\" f s'] by(simp cong del: sum.case_cong_weak)\n done\n qed\n show \"ord_spmf (=) ?rhs ?lhs\" unfolding inline12_def\n proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step inline1')\n show ?case unfolding inline11_def\n apply(rewrite inline1.simps; clarsimp simp add: bind_rpv_def)\n apply(rule conjI; clarsimp)\n subgoal by(rewrite inline1.simps; simp)\n subgoal for out c ret s' using step.IH[of \"c ret\" s'] by(simp cong del: sum.case_cong_weak)\n done\n qed\nqed\n\nlemma inline_bind_gpv [simp]:\n \"inline (bind_gpv gpv f) s = bind_gpv (inline gpv s) (\\(x, s'). inline (f x) s')\"\napply(coinduction arbitrary: gpv s rule: gpv_coinduct_bind)\napply(clarsimp simp add: map_spmf_bind_spmf o_def[abs_def] bind_gpv.sel inline_sel bind_map_spmf inline1_bind_gpv simp del: bind_gpv_sel' intro!: rel_spmf_bind_reflI split: generat.split)\napply(rule conjI)\n subgoal by(auto split: sum.split_asm simp add: spmf_rel_map spmf.map_comp o_def generat.map_comp generat.map_id[unfolded id_def] spmf.map_id[unfolded id_def] inline_sel intro!: rel_spmf_reflI generat.rel_refl fun.rel_refl)\nby(auto split: sum.split_asm simp add: bind_gpv_assoc split_def intro!: gpv.rel_refl exI disjI2 rel_funI)\n\nend\n\nlemma set_inline1_lift_spmf1: \"set_spmf (inline1 (\\s x. lift_spmf (p s x)) gpv s) \\ range Inl\"\napply(induction arbitrary: gpv s rule: inline1_fixp_induct)\nsubgoal by(rule cont_intro ccpo_class.admissible_leI)+\napply(auto simp add: o_def bind_UNION split: generat.split_asm)+\ndone\n\nlemma in_set_inline1_lift_spmf1: \"y \\ set_spmf (inline1 (\\s x. lift_spmf (p s x)) gpv s) \\ \\r s'. y = Inl (r, s')\"\nby(drule set_inline1_lift_spmf1[THEN subsetD]) auto\n\nlemma inline_lift_spmf1:\n fixes p defines \"callee \\ \\s c. lift_spmf (p s c)\"\n shows \"inline callee gpv s = lift_spmf (map_spmf projl (inline1 callee gpv s))\"\nby(rule gpv.expand)(auto simp add: inline_sel spmf.map_comp callee_def intro!: map_spmf_cong[OF refl] dest: in_set_inline1_lift_spmf1)\n\ncontext includes lifting_syntax begin\nlemma inline1_parametric':\n \"((S ===> C ===> rel_gpv'' (rel_prod R S) C' R') ===> rel_gpv'' A C R ===> S\n ===> rel_spmf (rel_sum (rel_prod A S) (rel_prod C' (rel_prod (R' ===> rel_gpv'' (rel_prod R S) C' R') (R ===> rel_gpv'' A C R)))))\n inline1 inline1\"\n (is \"(_ ===> ?R) _ _\")\nproof(rule rel_funI)\n note [transfer_rule] = the_gpv_parametric'\n show \"?R (inline1 callee) (inline1 callee')\" \n if [transfer_rule]: \"(S ===> C ===> rel_gpv'' (rel_prod R S) C' R') callee callee'\"\n for callee callee'\n unfolding inline1_def\n by(unfold rel_fun_curry case_prod_curry)(rule fixp_spmf_parametric[OF inline1.mono inline1.mono]; transfer_prover)\nqed\n\nlemma inline1_parametric [transfer_rule]:\n \"((S ===> C ===> rel_gpv (rel_prod (=) S) C') ===> rel_gpv A C ===> S\n ===> rel_spmf (rel_sum (rel_prod A S) (rel_prod C' (rel_prod (rel_rpv (rel_prod (=) S) C') (rel_rpv A C)))))\n inline1 inline1\"\nunfolding rel_gpv_conv_rel_gpv'' by(rule inline1_parametric')\n\nlemma inline_parametric':\n notes [transfer_rule] = inline1_parametric' the_gpv_parametric' corec_gpv_parametric'\n shows \"((S ===> C ===> rel_gpv'' (rel_prod R S) C' R') ===> rel_gpv'' A C R ===> S ===> rel_gpv'' (rel_prod A S) C' R')\n inline inline\"\nunfolding inline_def[abs_def] inline_aux_def\n(* apply transfer_prover raises loose bound variable *)\napply(rule rel_funI)+\nsubgoal premises [transfer_rule] by transfer_prover\ndone\n\nlemma inline_parametric [transfer_rule]:\n \"((S ===> C ===> rel_gpv (rel_prod (=) S) C') ===> rel_gpv A C ===> S ===> rel_gpv (rel_prod A S) C')\n inline inline\"\nunfolding rel_gpv_conv_rel_gpv'' by(rule inline_parametric')\nend\n\n\ntext \\Associativity rule for @{const inline}\\\n\ncontext\n fixes callee1 :: \"'s1 \\ 'c1 \\ ('r1 \\ 's1, 'c, 'r) gpv\"\n and callee2 :: \"'s2 \\ 'c2 \\ ('r2 \\ 's2, 'c1, 'r1) gpv\"\nbegin\n\npartial_function (spmf) inline2 :: \"('a, 'c2, 'r2) gpv \\ 's2 \\ 's1\n \\ ('a \\ ('s2 \\ 's1) + 'c \\ ('r1 \\ 's1, 'c, 'r) rpv \\ ('r2 \\ 's2, 'c1, 'r1) rpv \\ ('a, 'c2, 'r2) rpv) spmf\"\nwhere\n \"inline2 gpv s2 s1 =\n bind_spmf (the_gpv gpv)\n (case_generat (\\x. return_spmf (Inl (x, s2, s1)))\n (\\out rpv. bind_spmf (inline1 callee1 (callee2 s2 out) s1)\n (case_sum (\\((r2, s2), s1). inline2 (rpv r2) s2 s1)\n (\\(x, rpv'', rpv'). return_spmf (Inr (x, rpv'', rpv', rpv))))))\"\n\nlemma inline2_fixp_induct [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\inline2. P (\\gpv s2 s1. inline2 ((gpv, s2), s1)))\"\n and \"P (\\_ _ _. return_pmf None)\"\n and \"\\inline2'. P inline2' \\\n P (\\gpv s2 s1. bind_spmf (the_gpv gpv) (\\generat. case generat of\n Pure x \\ return_spmf (Inl (x, s2, s1))\n | IO out rpv \\ bind_spmf (inline1 callee1 (callee2 s2 out) s1) (\\lr. case lr of\n Inl ((r2, s2), c) \\ inline2' (rpv r2) s2 c\n | Inr (x, rpv'', rpv') \\ return_spmf (Inr (x, rpv'', rpv', rpv)))))\"\n shows \"P inline2\"\nusing assms unfolding split_def by(rule inline2.fixp_induct[unfolded curry_conv[abs_def] split_def])\n\nlemma inline1_inline_conv_inline2:\n fixes gpv' :: \"('r2 \\ 's2, 'c1, 'r1) gpv\"\n shows \"inline1 callee1 (inline callee2 gpv s2) s1 = \n map_spmf (map_sum (\\(x, (s2, s1)). ((x, s2), s1))\n (\\(x, rpv'', rpv', rpv). (x, rpv'', \\r1. rpv' r1 \\ (\\(r2, s2). inline callee2 (rpv r2) s2))))\n (inline2 gpv s2 s1)\"\n (is \"?lhs = ?rhs\")\nproof(rule spmf.leq_antisym)\n define inline1_1 :: \"('s1 \\ 'c1 \\ ('r1 \\ 's1, 'c, 'r) gpv) \\ ('r2 \\ 's2, 'c1, 'r1) gpv \\ 's1 \\ _\"\n where \"inline1_1 = inline1\"\n have \"ord_spmf (=) ?lhs ?rhs\"\n \\ \\We need in the inductive step that the approximation behaves well with @{const bind_gpv}\n because of @{thm [source] inline_aux_Inr}. So we have to thread it through the induction\n and do one half of the proof from @{thm [source] inline1_bind_gpv} again. We cannot inline\n @{thm [source] inline1_bind_gpv} in this proof here because the types are too specific.\\\n and \"ord_spmf (=) (inline1 callee1 (gpv' \\ f) s1') \n (do {\n res \\ inline1_1 callee1 gpv' s1';\n case res of Inl (x, s') \\ inline1 callee1 (f x) s'\n | Inr (out, rpv', rpv) \\ return_spmf (Inr (out, rpv', rpv \\ f))\n })\" for gpv' and f :: \"_ \\ ('a \\ 's2, 'c1, 'r1) gpv\" and s1'\n proof(induction arbitrary: gpv s2 s1 gpv' f s1' rule: inline1_fixp_induct_strong2)\n case adm thus ?case\n apply(rule cont_intro)+\n subgoal for a b c d by(cases d; clarsimp)\n done\n\n case (step inline1')\n note step_IH = step.IH[unfolded inline1_1_def] and step_hyps = step.hyps[unfolded inline1_1_def]\n { case 1\n have inline1: \"ord_spmf (=)\n (inline1 callee2 gpv s2 \\ (\\lr. case lr of Inl as2 \\ return_spmf (Inl (as2, s1))\n | Inr (out1, rpv', rpv) \\ the_gpv (callee1 s1 out1) \\ (\\generat. case generat of\n Pure (r1, s1) \\ inline1' (bind_gpv (rpv' r1) (\\(r2, s2). inline callee2 (rpv r2) s2)) s1\n | IO out rpv'' \\ return_spmf (Inr (out, rpv'', \\r1. bind_gpv (rpv' r1) (\\(r2, s2). inline callee2 (rpv r2) s2)) ))))\n (the_gpv gpv \\ (\\generat. case generat of Pure x \\ return_spmf (Inl ((x, s2), s1))\n | IO out2 rpv \\ inline1_1 callee1 (callee2 s2 out2) s1 \\ (\\lr. case lr of\n Inl ((r2, s2), s1) \\\n map_spmf (map_sum (\\(x, s2, s1). ((x, s2), s1)) (\\(x, rpv'', rpv', rpv). (x, rpv'', \\r1. bind_gpv (rpv' r1) (\\(r2, s2). inline callee2 (rpv r2) s2))))\n (inline2 (rpv r2) s2 s1)\n | Inr (out, rpv'', rpv') \\\n return_spmf (Inr (out, rpv'', \\r1. bind_gpv (rpv' r1) (\\(r2, s2). inline callee2 (rpv r2) s2))))))\"\n proof(induction arbitrary: gpv s2 s1 rule: inline1_fixp_induct)\n case step2: (step inline1'')\n note step2_IH = step2.IH[unfolded inline1_1_def]\n\n show ?case unfolding inline1_1_def\n apply(rewrite in \"ord_spmf _ _ \\\" inline1.simps)\n apply(clarsimp intro!: ord_spmf_bind_reflI split: generat.split)\n apply(rule conjI)\n subgoal by(rewrite in \"ord_spmf _ _ \\\" inline2.simps)(clarsimp simp add: map_spmf_bind_spmf o_def split: generat.split sum.split intro!: ord_spmf_bind_reflI spmf.leq_trans[OF step2_IH])\n subgoal by(clarsimp intro!: ord_spmf_bind_reflI step_IH[THEN spmf.leq_trans] split: generat.split sum.split simp add: bind_rpv_def)\n done\n qed simp_all\n show ?case\n apply(rewrite in \"ord_spmf _ \\ _\" inline_sel)\n apply(rewrite in \"ord_spmf _ _ \\\" inline2.simps)\n apply(clarsimp simp add: map_spmf_bind_spmf bind_map_spmf o_def intro!: ord_spmf_bind_reflI split: generat.split)\n apply(rule spmf.leq_trans[OF spmf.leq_trans, OF _ inline1])\n apply(auto intro!: ord_spmf_bind_reflI split: sum.split generat.split simp add: inline1_1_def map_spmf_bind_spmf)\n done }\n { case 2\n show ?case unfolding inline1_1_def\n by(rewrite inline1.simps)(auto simp del: bind_gpv_sel' simp add: bind_gpv.sel map_spmf_bind_spmf bind_map_spmf o_def bind_rpv_def intro!: ord_spmf_bind_reflI step_IH(2)[THEN spmf.leq_trans] step_hyps(2) split: generat.split sum.split) }\n qed simp_all\n thus \"ord_spmf (=) ?lhs ?rhs\" by -\n\n show \"ord_spmf (=) ?rhs ?lhs\"\n proof(induction arbitrary: gpv s2 s1 rule: inline2_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step inline2')\n show ?case\n apply(rewrite in \"ord_spmf _ _ \\\" inline1.simps)\n apply(rewrite inline_sel)\n apply(rewrite in \"ord_spmf _ \\ _\" inline1.simps)\n apply(rewrite in \"ord_spmf _ _ \\\" inline1.simps)\n apply(clarsimp simp add: map_spmf_bind_spmf bind_map_spmf intro!: ord_spmf_bind_reflI split: generat.split)\n apply(rule conjI)\n subgoal\n apply clarsimp\n apply(rule step.IH[THEN spmf.leq_trans])\n apply(rewrite in \"ord_spmf _ \\ _\" inline1.simps)\n apply(rewrite inline_sel)\n apply(simp add: bind_map_spmf)\n done\n subgoal by(clarsimp intro!: ord_spmf_bind_reflI split: generat.split sum.split simp add: o_def inline1_bind_gpv bind_rpv_def step.IH)\n done\n qed\nqed\n\nlemma inline1_inline_conv_inline2':\n \"inline1 (\\(s2, s1) c2. map_gpv (\\((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1) =\n map_spmf (map_sum id (\\(x, rpv'', rpv', rpv). (x, \\r. bind_gpv (rpv'' r)\n (\\(r1, s1). map_gpv (\\((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv)))\n (inline2 gpv s2 s1)\"\n (is \"?lhs = ?rhs\")\nproof(rule spmf.leq_antisym)\n show \"ord_spmf (=) ?lhs ?rhs\"\n proof(induction arbitrary: gpv s2 s1 rule: inline1_fixp_induct)\n case (step inline1') show ?case\n by(rewrite inline2.simps)(auto simp add: map_spmf_bind_spmf o_def inline_sel gpv.map_sel bind_map_spmf id_def[symmetric] gpv.map_id map_gpv_bind_gpv split_def intro!: ord_spmf_bind_reflI step.IH[THEN spmf.leq_trans] split: generat.split sum.split)\n qed simp_all\n show \"ord_spmf (=) ?rhs ?lhs\"\n proof(induction arbitrary: gpv s2 s1 rule: inline2_fixp_induct)\n case (step inline2')\n show ?case\n apply(rewrite in \"ord_spmf _ _ \\\" inline1.simps)\n apply(clarsimp simp add: map_spmf_bind_spmf bind_rpv_def o_def gpv.map_sel bind_map_spmf inline_sel map_gpv_bind_gpv id_def[symmetric] gpv.map_id split_def split: generat.split sum.split intro!: ord_spmf_bind_reflI)\n apply(rule spmf.leq_trans[OF spmf.leq_trans, OF _ step.IH])\n apply(auto simp add: split_def id_def[symmetric] intro!: ord_spmf_reflI)\n done\n qed simp_all\nqed\n\nlemma inline_assoc:\n \"inline callee1 (inline callee2 gpv s2) s1 =\n map_gpv (\\(r, s2, s1). ((r, s2), s1)) id (inline (\\(s2, s1) c2. map_gpv (\\((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))\"\nproof(coinduction arbitrary: s2 s1 gpv rule: gpv_coinduct_bind[where ?'b = \"('r2 \\ 's2) \\ 's1\" and ?'c = \"('r2 \\ 's2) \\ 's1\"])\n case (Eq_gpv s2 s1 gpv)\n have \"\\gpv2 gpv2' (f :: ('r2 \\ 's2) \\ 's1 \\ _) (f' :: ('r2 \\ 's2) \\ 's1 \\ _).\n bind_gpv (bind_gpv (rpv'' r) (\\(r1, s1). inline callee1 (rpv' r1) s1)) (\\((r2, s2), s1). inline callee1 (inline callee2 (rpv r2) s2) s1) = gpv2 \\ f \\\n bind_gpv (bind_gpv (rpv'' r) (\\(r1, s1). inline callee1 (rpv' r1) s1)) (\\((r2, s2), s1). map_gpv (\\(r, s2, y). ((r, s2), y)) id (inline (\\(s2, s1) c2. map_gpv (\\((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) (rpv r2) (s2, s1))) = gpv2' \\ f' \\\n rel_gpv (\\x y. \\s2 s1 gpv. f x = inline callee1 (inline callee2 gpv s2) s1 \\\n f' y = map_gpv (\\(r, s2, y). ((r, s2), y)) id (inline (\\(s2, s1) c2. map_gpv (\\((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1)))\n (=) gpv2 gpv2'\" \n for rpv'' :: \"('r1 \\ 's1, 'c, 'r) rpv\" and rpv' :: \"('r2 \\ 's2, 'c1, 'r1) rpv\" and rpv :: \"('a, 'c2, 'r2) rpv\" and r :: 'r\n by(auto intro!: exI gpv.rel_refl)\n then show ?case\n apply(subst inline_sel)\n apply(subst gpv.map_sel)\n apply(subst inline_sel)\n apply(subst inline1_inline_conv_inline2)\n apply(subst inline1_inline_conv_inline2')\n apply(unfold spmf.map_comp o_def case_sum_map_sum spmf_rel_map generat.rel_map)\n apply(rule rel_spmf_reflI)\n subgoal for lr by(cases lr)(auto del: disjCI intro!: rel_funI disjI2 simp add: split_def map_gpv_conv_bind[folded id_def] bind_gpv_assoc)\n done\nqed\n\nend\n\nlemma set_inline2_lift_spmf1: \"set_spmf (inline2 (\\s x. lift_spmf (p s x)) callee gpv s s') \\ range Inl\"\napply(induction arbitrary: gpv s s' rule: inline2_fixp_induct)\nsubgoal by(rule cont_intro ccpo_class.admissible_leI)+\napply(auto simp add: o_def bind_UNION split: generat.split_asm sum.split_asm dest!: in_set_inline1_lift_spmf1)\napply blast\ndone\n\nlemma in_set_inline2_lift_spmf1: \"y \\ set_spmf (inline2 (\\s x. lift_spmf (p s x)) callee gpv s s') \\ \\r s s'. y = Inl (r, s, s')\"\nby(drule set_inline2_lift_spmf1[THEN subsetD]) auto\n\ncontext\n fixes consider' :: \"'call \\ bool\" \n and \"consider\" :: \"'call' \\ bool\" \n and callee :: \"'s \\ 'call \\ ('ret \\ 's, 'call', 'ret') gpv\" \n notes [[function_internals]]\nbegin\n\nprivate partial_function (spmf) inline1'\n :: \"('a, 'call, 'ret) gpv \\ 's\n \\ ('a \\ 's + 'call \\ 'call' \\ ('ret \\ 's, 'call', 'ret') rpv \\ ('a, 'call, 'ret) rpv) spmf\"\nwhere\n \"inline1' gpv s =\n the_gpv gpv \\\n case_generat (\\x. return_spmf (Inl (x, s)))\n (\\out rpv. the_gpv (callee s out) \\\n case_generat (\\(x, y). inline1' (rpv x) y)\n (\\out' rpv'. return_spmf (Inr (out, out', rpv', rpv))))\"\n\nprivate lemma inline1'_fixp_induct [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\inline1'. P (\\gpv s. inline1' (gpv, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\inline1'. P inline1' \\ P (\\gpv s. the_gpv gpv \\ case_generat (\\x. return_spmf (Inl (x, s))) (\\out rpv. the_gpv (callee s out) \\ case_generat (\\(x, y). inline1' (rpv x) y) (\\out' rpv'. return_spmf (Inr (out, out', rpv', rpv)))))\"\n shows \"P inline1'\"\nusing assms by(rule inline1'.fixp_induct[unfolded curry_conv[abs_def]])\n\nprivate lemma inline1_conv_inline1': \"inline1 callee gpv s = map_spmf (map_sum id snd) (inline1' gpv s)\"\nproof(induction arbitrary: gpv s rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf inline1.mono inline1'.mono inline1_def inline1'_def, unfolded lub_spmf_empty, case_names adm bottom step])\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step inline1 inline1')\n thus ?case by(clarsimp simp add: map_spmf_bind_spmf o_def intro!: bind_spmf_cong[OF refl] split: generat.split)\nqed\n\ncontext\n fixes q :: \"enat\" \n assumes q: \"\\s x. consider' x \\ interaction_bound consider (callee s x) \\ q\"\n and ignore: \"\\s x. \\ consider' x \\ interaction_bound consider (callee s x) = 0\"\nbegin\n\nprivate lemma interaction_bound_inline1'_aux:\n \"interaction_bound consider' gpv \\ p\n \\ set_spmf (inline1' gpv s) \\ {Inr (out', out, c', rpv) | out' out c' rpv. \n if consider' out'\n then (\\input. (if consider out then eSuc (interaction_bound consider (c' input)) else interaction_bound consider (c' input)) \\ q) \\ \n (\\x. eSuc (interaction_bound consider' (rpv x)) \\ p)\n else \\ consider out \\ (\\input. interaction_bound consider (c' input) = 0) \\ (\\x. interaction_bound consider' (rpv x) \\ p)}\n \\ range Inl\"\nproof(induction arbitrary: gpv s rule: inline1'_fixp_induct)\n { case adm show ?case by(rule cont_intro ccpo_class.admissible_leI)+ }\n { case bottom show ?case by simp }\n case (step inline1')\n have *: \"interaction_bound consider' (c input) \\ p\" if \"IO out c \\ set_spmf (the_gpv gpv)\" for out c input\n by(cases \"consider' out\")(auto intro: interaction_bound_IO_consider[OF that, THEN order_trans, THEN order_trans[OF ile_eSuc]] interaction_bound_IO_ignore[OF that, THEN order_trans] step.prems)\n have **: \"if consider' out'\n then (\\input. (if consider out then eSuc (interaction_bound consider (c input)) else interaction_bound consider (c input)) \\ q) \\\n (\\x. eSuc (interaction_bound consider' (rpv x)) \\ p)\n else \\ consider out \\ (\\input. interaction_bound consider (c input) = 0) \\ (\\x. interaction_bound consider' (rpv x) \\ p)\"\n if \"IO out' rpv \\ set_spmf (the_gpv gpv)\" \"IO out c \\ set_spmf (the_gpv (callee s out'))\"\n for out' rpv out c\n proof(cases \"consider' out'\")\n case True\n then show ?thesis using that q\n by(auto split del: if_split intro!: interaction_bound_IO[THEN order_trans] interaction_bound_IO_consider[THEN order_trans] step.prems)\n next\n case False\n have \"\\ consider out\" \"interaction_bound consider (c input) = 0\" for input\n using interaction_bound_IO[OF that(2), of \"consider\" input] ignore[OF False, of s]\n by(auto split: if_split_asm)\n then show ?thesis using False that\n by(auto split del: if_split intro: interaction_bound_IO_ignore[THEN order_trans] step.prems)\n qed\n show ?case\n by(auto 6 4 simp add: bind_UNION del: subsetI intro!: UN_least intro: step.IH * ** split: generat.split split del: if_split)\nqed\n\nlemma interaction_bound_inline1':\n \"\\ Inr (out', out, c', rpv) \\ set_spmf (inline1' gpv s); interaction_bound consider' gpv \\ p \\\n \\ if consider' out' then\n (if consider out then eSuc (interaction_bound consider (c' input)) else interaction_bound consider (c' input)) \\ q \\ \n eSuc (interaction_bound consider' (rpv x)) \\ p\n else \\ consider out \\ interaction_bound consider (c' input) = 0 \\ interaction_bound consider' (rpv x) \\ p\"\nusing interaction_bound_inline1'_aux[where gpv=gpv and p=p and s=s] by(auto split: if_split_asm)\n\nend\n\nlemma interaction_bounded_by_inline1:\n \"\\ Inr (out', out, c', rpv) \\ set_spmf (inline1' gpv s); \n interaction_bounded_by consider' gpv p;\n \\s x. consider' x \\ interaction_bounded_by consider (callee s x) q; \n \\s x. \\ consider' x \\ interaction_bounded_by consider (callee s x) 0 \\\n \\ if consider' out' then\n (if consider out then q \\ 0 \\ interaction_bounded_by consider (c' input) (q - 1) else interaction_bounded_by consider (c' input) q) \\\n p \\ 0 \\ interaction_bounded_by consider' (rpv x) (p - 1)\n else \\ consider out \\ interaction_bounded_by consider (c' input) 0 \\ interaction_bounded_by consider' (rpv x) p\"\nunfolding interaction_bounded_by_0 unfolding interaction_bounded_by.simps\napply(drule (1) interaction_bound_inline1'[where input=input and x=x, rotated 2], assumption, assumption)\napply(cases p q rule: co.enat.exhaust[case_product co.enat.exhaust])\napply(simp_all add: zero_enat_def[symmetric] eSuc_enat[symmetric] split: if_split_asm)\ndone\n\ndeclare enat_0_iff [simp]\n\nlemma interaction_bounded_by_inline [interaction_bound]:\n assumes p: \"interaction_bounded_by consider' gpv p\"\n and q: \"\\s x. consider' x \\ interaction_bounded_by consider (callee s x) q\"\n and ignore: \"\\s x. \\ consider' x \\ interaction_bounded_by consider (callee s x) 0\"\n shows \"interaction_bounded_by consider (inline callee gpv s) (p * q)\"\nproof\n have \"interaction_bounded_by consider' gpv p \\ interaction_bound consider (inline callee gpv s) \\ p * q\"\n and \"interaction_bound consider (bind_gpv gpv' f) \\ interaction_bound consider gpv' + (SUP x\\results'_gpv gpv'. interaction_bound consider (f x))\"\n for gpv' and f :: \"'ret \\ 's \\ ('a \\ 's, 'call', 'ret') gpv\"\n proof(induction arbitrary: gpv s p gpv' f rule: interaction_bound_fixp_induct)\n case adm show ?case by simp\n case bottom case 1 show ?case by simp\n case (step interaction_bound') case step: 1\n show ?case (is \"(SUP generat\\?inline. ?lhs generat) \\ ?rhs\")\n proof(rule SUP_least)\n fix generat\n assume \"generat \\ ?inline\"\n then consider (Pure) ret s' where \"generat = Pure (ret, s')\"\n and \"Inl (ret, s') \\ set_spmf (inline1 callee gpv s)\"\n | (IO) out c rpv where \"generat = IO out (\\input. bind_gpv (c input) (\\(ret, s'). inline callee (rpv ret) s'))\"\n and \"Inr (out, c, rpv) \\ set_spmf (inline1 callee gpv s)\"\n by(clarsimp simp add: inline_sel split: sum.split_asm)\n then show \"?lhs generat \\ ?rhs\"\n proof(cases)\n case Pure thus ?thesis by simp\n next\n case IO\n from IO(2) obtain out' where out': \"Inr (out', out, c, rpv) \\ set_spmf (inline1' gpv s)\"\n by(auto simp add: inline1_conv_inline1' Inr_eq_map_sum_iff)\n show ?thesis\n proof(cases \"consider' out'\")\n case True\n with interaction_bounded_by_inline1[OF out' step.prems q ignore]\n have p: \"p \\ 0\" and rpv: \"\\x. interaction_bounded_by consider' (rpv x) (p - 1)\"\n and c: \"\\input. if consider out then q \\ 0 \\ interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q\"\n by auto\n\n have \"?lhs generat \\ (if consider out then 1 else 0) + (SUP input. interaction_bound' (bind_gpv (c input) (\\(ret, s'). inline callee (rpv ret) s')))\"\n (is \"_ \\ _ + ?sup\")\n using IO(1) by(auto simp add: plus_1_eSuc)\n also have \"?sup \\ (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \\ results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))\"\n unfolding split_def by(rule SUP_mono)(blast intro: step.IH)\n also have \"\\ \\ (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \\ results'_gpv (c input). (p - 1) * q))\"\n using rpv by(auto intro!: SUP_mono rev_bexI add_mono step.IH)\n also have \"\\ \\ (SUP input. interaction_bound consider (c input) + (p - 1) * q)\"\n apply(auto simp add: SUP_constant bot_enat_def intro!: SUP_mono)\n apply(metis add.right_neutral add_mono i0_lb order_refl)+\n done\n also have \"\\ \\ (SUP input :: 'ret'. (if consider out then q - 1 else q) + (p - 1) * q)\"\n apply(rule SUP_mono rev_bexI UNIV_I add_mono)+\n using c\n apply(auto simp add: interaction_bounded_by.simps)\n done\n also have \"\\ = (if consider out then q - 1 else q) + (p - 1) * q\"\n by(simp add: SUP_constant)\n finally show ?thesis\n apply(rule order_trans)\n prefer 5\n using p c\n apply(cases p; cases q)\n apply(auto simp add: one_enat_def algebra_simps Suc_leI)\n done\n next\n case False\n with interaction_bounded_by_inline1[OF out' step.prems q ignore]\n have out: \"\\ consider out\" and zero: \"\\input. interaction_bounded_by consider (c input) 0\"\n and rpv: \"\\x. interaction_bounded_by consider' (rpv x) p\" by auto\n have \"?lhs generat \\ (SUP input. interaction_bound' (bind_gpv (c input) (\\(ret, s'). inline callee (rpv ret) s')))\"\n using IO(1) out by auto\n also have \"\\ \\ (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \\ results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))\"\n unfolding split_def by(rule SUP_mono)(blast intro: step.IH)\n also have \"\\ \\ (SUP input. (SUP (ret, s') \\ results'_gpv (c input). p * q))\"\n using rpv zero by(auto intro!: SUP_mono rev_bexI add_mono step.IH simp add: interaction_bounded_by_0)\n also have \"\\ \\ (SUP input :: 'ret'. p * q)\"\n by(rule SUP_mono rev_bexI)+(auto simp add: SUP_constant)\n also have \"\\ = p * q\" by(simp add: SUP_constant)\n finally show ?thesis .\n qed\n qed\n qed\n next\n case bottom case 2 show ?case by simp\n case step case 2 show ?case using step by -(rule interaction_bound_bind_step)\n qed\n then show \"interaction_bound consider (inline callee gpv s) \\ p * q\" using p by -\nqed\n\nend\n\nlemma interaction_bounded_by_inline_invariant: (* TODO: augment with types *)\n includes lifting_syntax\n fixes consider' :: \"'call \\ bool\" \n and \"consider\" :: \"'call' \\ bool\" \n and callee :: \"'s \\ 'call \\ ('ret \\ 's, 'call', 'ret') gpv\" \n and gpv :: \"('a, 'call, 'ret) gpv\"\n assumes p: \"interaction_bounded_by consider' gpv p\"\n and q: \"\\s x. \\ I s; consider' x \\ \\ interaction_bounded_by consider (callee s x) q\"\n and ignore: \"\\s x. \\ I s; \\ consider' x \\ \\ interaction_bounded_by consider (callee s x) 0\"\n and I: \"I s\"\n and invariant: \"\\s x y s'. \\ (y, s') \\ results'_gpv (callee s x); I s \\ \\ I s'\"\n shows \"interaction_bounded_by consider (inline callee gpv s) (p * q)\"\nproof -\n { assume \"\\(Rep :: 's' \\ 's) Abs. type_definition Rep Abs {s. I s}\"\n then obtain Rep :: \"'s' \\ 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n then interpret td: type_definition Rep Abs \"{s. I s}\" .\n define cr where \"cr x y \\ x = Rep y\" for x y\n have [transfer_rule]: \"bi_unique cr\" \"right_total cr\"\n using td cr_def[abs_def] by(rule typedef_bi_unique typedef_right_total)+\n have [transfer_domain_rule]: \"Domainp cr = I\"\n using type_definition_Domainp[OF td cr_def[abs_def]] by simp\n\n define callee' where \"callee' = (Rep ---> id ---> map_gpv (map_prod id Abs) id) callee\"\n have [transfer_rule]: \"(cr ===> (=) ===> rel_gpv (rel_prod (=) cr) (=)) callee callee'\"\n by(auto simp add: callee'_def rel_fun_def cr_def gpv.rel_map prod.rel_map td.Abs_inverse intro!: gpv.rel_refl_strong intro: td.Rep[simplified] dest: invariant)\n\n define s' where \"s' = Abs s\"\n have [transfer_rule]: \"cr s s'\" using I by(simp add: cr_def s'_def td.Abs_inverse)\n\n note p moreover\n have \"consider' x \\ interaction_bounded_by consider (callee' s x) q\" for s x\n by(transfer fixing: \"consider\" consider' q)(clarsimp simp add: q)\n moreover have \"\\ consider' x \\ interaction_bounded_by consider (callee' s x) 0\" for s x\n by(transfer fixing: \"consider\" consider')(clarsimp simp add: ignore)\n ultimately have \"interaction_bounded_by consider (inline callee' gpv s') (p * q)\" \n by(rule interaction_bounded_by_inline)\n then have \"interaction_bounded_by consider (inline callee gpv s) (p * q)\" by transfer }\n from this[cancel_type_definition] I show ?thesis by blast\nqed\n\ncontext\n fixes \\ :: \"('call, 'ret) \\\"\n and \\' :: \"('call', 'ret') \\\"\n and callee :: \"'s \\ 'call \\ ('ret \\ 's, 'call', 'ret') gpv\"\n assumes results: \"\\s x. x \\ outs_\\ \\ \\ results_gpv \\' (callee s x) \\ responses_\\ \\ x \\ UNIV\"\nbegin\n\nlemma inline1_in_sub_gpvs_callee:\n assumes \"Inr (out, callee', rpv') \\ set_spmf (inline1 callee gpv s)\"\n and WT: \"\\ \\g gpv \\\"\n shows \"\\call\\outs_\\ \\. \\s. \\x \\ responses_\\ \\' out. callee' x \\ sub_gpvs \\' (callee s call)\"\nproof -\n from WT\n have \"set_spmf (inline1 callee gpv s) \\ {Inr (out, callee', rpv') | out callee' rpv'.\n \\call\\outs_\\ \\. \\s. \\x \\ responses_\\ \\' out. callee' x \\ sub_gpvs \\' (callee s call)} \\ range Inl\"\n (is \"?concl (inline1 callee) gpv s\")\n proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n case bottom show ?case by simp\n case (step inline1')\n { fix out c\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" \n from step.prems IO have out: \"out \\ outs_\\ \\\" by(rule WT_gpvD)\n { fix x s'\n assume Pure: \"Pure (x, s') \\ set_spmf (the_gpv (callee s out))\"\n then have \"(x, s') \\ results_gpv \\' (callee s out)\" by(rule results_gpv.Pure)\n with out have \"x \\ responses_\\ \\ out\" by(auto dest: results)\n with step.prems IO have \"\\ \\g c x \\\" by(rule WT_gpvD)\n hence \"?concl inline1' (c x) s'\" by(rule step.IH)\n } moreover {\n fix out' c'\n assume \"IO out' c' \\ set_spmf (the_gpv (callee s out))\"\n hence \"\\x\\responses_\\ \\' out'. c' x \\ sub_gpvs \\' (callee s out)\"\n by(auto intro: sub_gpvs.base)\n then have \"\\call\\outs_\\ \\. \\s. \\x\\responses_\\ \\' out'. c' x \\ sub_gpvs \\' (callee s call)\"\n using out by blast\n } moreover note calculation }\n then show ?case using step.prems\n by(auto del: subsetI simp add: bind_UNION intro!: UN_least split: generat.split)\n qed\n thus ?thesis using assms by fastforce\nqed\n\nlemma inline1_in_sub_gpvs:\n assumes \"Inr (out, callee', rpv') \\ set_spmf (inline1 callee gpv s)\"\n and \"(x, s') \\ results_gpv \\' (callee' input)\"\n and \"input \\ responses_\\ \\' out\"\n and \"\\ \\g gpv \\\"\n shows \"rpv' x \\ sub_gpvs \\ gpv\"\nproof -\n from \\\\ \\g gpv \\\\\n have \"set_spmf (inline1 callee gpv s) \\ {Inr (out, callee', rpv') | out callee' rpv'.\n \\input \\ responses_\\ \\' out. \\(x, s')\\results_gpv \\' (callee' input). rpv' x \\ sub_gpvs \\ gpv}\n \\ range Inl\" (is \"?concl (inline1 callee) gpv s\" is \"_ \\ ?rhs gpv s\")\n proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n case bottom show ?case by simp\n next\n case (step inline1')\n { fix out c\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" \n from step.prems IO have out: \"out \\ outs_\\ \\\" by(rule WT_gpvD)\n { fix x s'\n assume Pure: \"Pure (x, s') \\ set_spmf (the_gpv (callee s out))\"\n then have \"(x, s') \\ results_gpv \\' (callee s out)\" by(rule results_gpv.Pure)\n with out have \"x \\ responses_\\ \\ out\" by(auto dest: results)\n with step.prems IO have \"\\ \\g c x \\\" by(rule WT_gpvD)\n hence \"?concl inline1' (c x) s'\" by(rule step.IH)\n also have \"\\ \\ ?rhs gpv s'\" using IO Pure\n by(fastforce intro: sub_gpvs.cont dest: WT_gpv_OutD[OF step.prems] results[THEN subsetD, OF _ results_gpv.Pure])\n finally have \"set_spmf (inline1' (c x) s') \\ \\\" .\n } moreover {\n fix out' c' input x s'\n assume \"IO out' c' \\ set_spmf (the_gpv (callee s out))\"\n and \"input \\ responses_\\ \\' out'\" and \"(x, s') \\ results_gpv \\' (c' input)\"\n then have \"c x \\ sub_gpvs \\ gpv\" using IO\n by(auto intro!: sub_gpvs.base dest: WT_gpv_OutD[OF step.prems] results[THEN subsetD, OF _ results_gpv.IO])\n } moreover note calculation }\n then show ?case\n by(auto simp add: bind_UNION intro!: UN_least split: generat.split del: subsetI)\n qed\n with assms show ?thesis by fastforce\nqed\n\ncontext\n assumes WT: \"\\x s. x \\ outs_\\ \\ \\ \\' \\g callee s x \\\"\nbegin\n\nlemma WT_gpv_inline1:\n assumes \"Inr (out, rpv, rpv') \\ set_spmf (inline1 callee gpv s)\"\n and \"\\ \\g gpv \\\"\n shows \"out \\ outs_\\ \\'\" (is \"?thesis1\")\n and \"input \\ responses_\\ \\' out \\ \\' \\g rpv input \\\" (is \"PROP ?thesis2\")\n and \"\\ input \\ responses_\\ \\' out; (x, s') \\ results_gpv \\' (rpv input) \\ \\ \\ \\g rpv' x \\\" (is \"PROP ?thesis3\")\nproof -\n from \\\\ \\g gpv \\\\\n have \"set_spmf (inline1 callee gpv s) \\ {Inr (out, rpv, rpv') | out rpv rpv'. out \\ outs_\\ \\'} \\ range Inl\"\n proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n { case adm show ?case by(intro cont_intro ccpo_class.admissible_leI) }\n { case bottom show ?case by simp }\n case (step inline1')\n { fix out c\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" \n from step.prems IO have out: \"out \\ outs_\\ \\\" by(rule WT_gpvD)\n { fix x s'\n assume Pure: \"Pure (x, s') \\ set_spmf (the_gpv (callee s out))\"\n then have \"(x, s') \\ results_gpv \\' (callee s out)\" by(rule results_gpv.Pure)\n with out have \"x \\ responses_\\ \\ out\" by(auto dest: results)\n with step.prems IO have \"\\ \\g c x \\\" by(rule WT_gpvD)\n } moreover {\n fix out' c'\n from out have \"\\' \\g callee s out \\\" by(rule WT)\n moreover assume \"IO out' c' \\ set_spmf (the_gpv (callee s out))\"\n ultimately have \"out' \\ outs_\\ \\'\" by(rule WT_gpvD) \n } moreover note calculation }\n then show ?case \n by(auto del: subsetI simp add: bind_UNION intro!: UN_least split: generat.split intro!: step.IH[THEN order_trans])\n qed\n then show ?thesis1 using assms by auto\n\n assume \"input \\ responses_\\ \\' out\"\n with inline1_in_sub_gpvs_callee[OF \\Inr _ \\ _\\] \\\\ \\g gpv \\\\\n obtain out' s where \"out' \\ outs_\\ \\\" \n and *: \"rpv input \\ sub_gpvs \\' (callee s out')\" by auto\n from \\out' \\ _\\ have \"\\' \\g callee s out' \\\" by(rule WT)\n then show \"\\' \\g rpv input \\\" using * by(rule WT_sub_gpvsD)\n\n assume \"(x, s') \\ results_gpv \\' (rpv input)\"\n with \\Inr _ \\ _\\ have \"rpv' x \\ sub_gpvs \\ gpv\"\n using \\input \\ _\\ \\\\ \\g gpv \\\\ by(rule inline1_in_sub_gpvs)\n with \\\\ \\g gpv \\\\ show \"\\ \\g rpv' x \\\" by(rule WT_sub_gpvsD)\nqed\n\nlemma WT_gpv_inline:\n assumes \"\\ \\g gpv \\\"\n shows \"\\' \\g inline callee gpv s \\\"\nusing assms\nproof(coinduction arbitrary: gpv s rule: WT_gpv_coinduct_bind)\n case (WT_gpv out c gpv)\n from \\IO out c \\ _\\ obtain callee' rpv'\n where Inr: \"Inr (out, callee', rpv') \\ set_spmf (inline1 callee gpv s)\"\n and c: \"c = (\\input. callee' input \\ (\\(x, s). inline callee (rpv' x) s))\"\n by(clarsimp simp add: inline_sel split: sum.split_asm)\n from Inr \\\\ \\g gpv \\\\ have ?out by(rule WT_gpv_inline1)\n moreover have \"?cont TYPE('ret \\ 's)\" (is \"\\input\\_. _ \\ _ \\ ?case' input\")\n proof(rule ballI disjI2)+\n fix input\n assume \"input \\ responses_\\ \\' out\"\n with Inr \\\\ \\g gpv \\ \\have \"\\' \\g callee' input \\\"\n and \"\\x s'. (x, s') \\ results_gpv \\' (callee' input) \\ \\ \\g rpv' x \\\"\n by(blast intro: WT_gpv_inline1)+\n then show \"?case' input\" by(subst c)(auto 4 4)\n qed\n ultimately show \"?case TYPE('ret \\ 's)\" ..\nqed\n\nend\n\ncontext\n fixes gpv :: \"('a, 'call, 'ret) gpv\"\n assumes gpv: \"lossless_gpv \\ gpv\" \"\\ \\g gpv \\\"\nbegin\n\nlemma lossless_spmf_inline1:\n assumes lossless: \"\\s x. x \\ outs_\\ \\ \\ lossless_spmf (the_gpv (callee s x))\"\n shows \"lossless_spmf (inline1 callee gpv s)\"\nusing gpv\nproof(induction arbitrary: s rule: lossless_WT_gpv_induct)\n case (lossless_gpv p)\n show ?case using \\lossless_spmf p\\\n apply(subst inline1_unfold)\n apply(auto split: generat.split intro: lossless lossless_gpv.hyps dest: results[THEN subsetD, rotated, OF results_gpv.Pure] intro: lossless_gpv.IH)\n done\nqed\n\nlemma lossless_gpv_inline1:\n assumes *: \"Inr (out, rpv, rpv') \\ set_spmf (inline1 callee gpv s)\"\n and **: \"input \\ responses_\\ \\' out\"\n and lossless: \"\\s x. x \\ outs_\\ \\ \\ lossless_gpv \\' (callee s x)\"\n shows \"lossless_gpv \\' (rpv input)\"\nproof -\n from inline1_in_sub_gpvs_callee[OF * gpv(2)] **\n obtain out' s where \"out' \\ outs_\\ \\\" and ***: \"rpv input \\ sub_gpvs \\' (callee s out')\" by blast\n from \\out' \\ _\\ have \"lossless_gpv \\' (callee s out')\" by(rule lossless)\n thus ?thesis using *** by(rule lossless_sub_gpvsD)\nqed\n\nlemma lossless_results_inline1:\n assumes \"Inr (out, rpv, rpv') \\ set_spmf (inline1 callee gpv s)\"\n and \"(x, s') \\ results_gpv \\' (rpv input)\"\n and \"input \\ responses_\\ \\' out\"\n shows \"lossless_gpv \\ (rpv' x)\"\nproof -\n from assms gpv(2) have \"rpv' x \\ sub_gpvs \\ gpv\" by(rule inline1_in_sub_gpvs)\n with gpv(1) show \"lossless_gpv \\ (rpv' x)\" by(rule lossless_sub_gpvsD)\nqed\n\nend\n\nlemmas lossless_inline1[rotated 2] = lossless_spmf_inline1 lossless_gpv_inline1 lossless_results_inline1\n\nlemma lossless_inline[rotated]:\n fixes gpv :: \"('a, 'call, 'ret) gpv\"\n assumes gpv: \"lossless_gpv \\ gpv\" \"\\ \\g gpv \\\"\n and lossless: \"\\s x. x \\ outs_\\ \\ \\ lossless_gpv \\' (callee s x)\"\n shows \"lossless_gpv \\' (inline callee gpv s)\"\nusing gpv\nproof(induction arbitrary: s rule: lossless_WT_gpv_induct_strong)\n case (lossless_gpv p)\n have lp: \"lossless_gpv \\ (GPV p)\" by(rule lossless_sub_gpvsI)(auto intro: lossless_gpv.hyps)\n moreover have wp: \"\\ \\g GPV p \\\" by(rule WT_sub_gpvsI)(auto intro: lossless_gpv.hyps)\n ultimately have \"lossless_spmf (the_gpv (inline callee (GPV p) s))\"\n by(auto simp add: inline_sel intro: lossless_spmf_inline1 lossless_gpv_lossless_spmfD[OF lossless])\n moreover {\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv (inline callee (GPV p) s))\"\n and \"input \\ responses_\\ \\' out\"\n from IO obtain callee' rpv\n where Inr: \"Inr (out, callee', rpv) \\ set_spmf (inline1 callee (GPV p) s)\"\n and c: \"c = (\\input. callee' input \\ (\\(x, y). inline callee (rpv x) y))\"\n by(clarsimp simp add: inline_sel split: sum.split_asm)\n from Inr \\input \\ _\\ lossless lp wp have \"lossless_gpv \\' (callee' input)\" by(rule lossless_inline1)\n moreover {\n fix x s'\n assume \"(x, s') \\ results_gpv \\' (callee' input)\"\n with Inr have \"rpv x \\ sub_gpvs \\ (GPV p)\" using \\input \\ _\\ wp by(rule inline1_in_sub_gpvs)\n hence \"lossless_gpv \\' (inline callee (rpv x) s')\" by(rule lossless_gpv.IH)\n } ultimately have \"lossless_gpv \\' (c input)\" unfolding c by clarsimp\n } ultimately show ?case by(rule lossless_gpvI)\nqed\n\nend\n\ndefinition id_oracle :: \"'s \\ 'call \\ ('ret \\ 's, 'call, 'ret) gpv\"\nwhere \"id_oracle s x = Pause x (\\x. Done (x, s))\"\n\nlemma inline1_id_oracle:\n \"inline1 id_oracle gpv s =\n map_spmf (\\generat. case generat of Pure x \\ Inl (x, s) | IO out c \\ Inr (out, \\x. Done (x, s), c)) (the_gpv gpv)\"\nby(subst inline1.simps)(auto simp add: id_oracle_def map_spmf_conv_bind_spmf intro!: bind_spmf_cong split: generat.split)\n\nlemma inline_id_oracle [simp]: \"inline id_oracle gpv s = map_gpv (\\x. (x, s)) id gpv\"\nby(coinduction arbitrary: gpv s)(auto 4 3 simp add: inline_sel inline1_id_oracle spmf_rel_map gpv.map_sel o_def generat.rel_map intro!: rel_spmf_reflI rel_funI split: generat.split)\n\nsubsection \\Running GPVs\\\n\ntype_synonym ('call, 'ret, 's) callee = \"'s \\ 'call \\ ('ret \\ 's) spmf\"\n\ncontext fixes callee :: \"('call, 'ret, 's) callee\" notes [[function_internals]] begin\n\npartial_function (spmf) exec_gpv :: \"('a, 'call, 'ret) gpv \\ 's \\ ('a \\ 's) spmf\"\nwhere\n \"exec_gpv c s =\n the_gpv c \\\n case_generat (\\x. return_spmf (x, s))\n (\\out c. callee s out \\ (\\(x, y). exec_gpv (c x) y))\"\n\nabbreviation run_gpv :: \"('a, 'call, 'ret) gpv \\ 's \\ 'a spmf\"\nwhere \"run_gpv gpv s \\ map_spmf fst (exec_gpv gpv s)\"\n\nlemma exec_gpv_fixp_induct [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\f. P (\\c s. f (c, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\exec_gpv. P exec_gpv \\ \n P (\\c s. the_gpv c \\ case_generat (\\x. return_spmf (x, s)) (\\out c. callee s out \\ (\\(x, y). exec_gpv (c x) y)))\"\n shows \"P exec_gpv\"\nusing assms(1)\nby(rule exec_gpv.fixp_induct[unfolded curry_conv[abs_def]])(simp_all add: assms(2-))\n\nlemma exec_gpv_fixp_induct_strong [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\f. P (\\c s. f (c, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\exec_gpv'. \\ \\c s. ord_spmf (=) (exec_gpv' c s) (exec_gpv c s); P exec_gpv' \\\n \\ P (\\c s. the_gpv c \\ case_generat (\\x. return_spmf (x, s)) (\\out c. callee s out \\ (\\(x, y). exec_gpv' (c x) y)))\"\n shows \"P exec_gpv\"\nusing assms\nby(rule spmf.fixp_strong_induct_uc[where P=\"\\f. P (curry f)\" and U=case_prod and C=curry, OF exec_gpv.mono exec_gpv_def, simplified curry_case_prod, simplified curry_conv[abs_def] fun_ord_def split_paired_All prod.case case_prod_eta, OF refl]) blast\n\nlemma exec_gpv_fixp_induct_strong2 [case_names adm bottom step]:\n assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\f. P (\\c s. f (c, s)))\"\n and \"P (\\_ _. return_pmf None)\"\n and \"\\exec_gpv'.\n \\ \\c s. ord_spmf (=) (exec_gpv' c s) (exec_gpv c s); \n \\c s. ord_spmf (=) (exec_gpv' c s) (the_gpv c \\ case_generat (\\x. return_spmf (x, s)) (\\out c. callee s out \\ (\\(x, y). exec_gpv' (c x) y)));\n P exec_gpv' \\\n \\ P (\\c s. the_gpv c \\ case_generat (\\x. return_spmf (x, s)) (\\out c. callee s out \\ (\\(x, y). exec_gpv' (c x) y)))\"\n shows \"P exec_gpv\"\nusing assms\nby(rule spmf.fixp_induct_strong2_uc[where P=\"\\f. P (curry f)\" and U=case_prod and C=curry, OF exec_gpv.mono exec_gpv_def, simplified curry_case_prod, simplified curry_conv[abs_def] fun_ord_def split_paired_All prod.case case_prod_eta, OF refl]) blast+\n\nend\n\nlemma exec_gpv_conv_inline1:\n \"exec_gpv callee gpv s = map_spmf projl (inline1 (\\s c. lift_spmf (callee s c) :: (_, unit, unit) gpv) gpv s)\"\nby(induction arbitrary: gpv s rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf exec_gpv.mono inline1.mono exec_gpv_def inline1_def, unfolded lub_spmf_empty, case_names adm bottom step])\n (auto simp add: map_spmf_bind_spmf o_def spmf.map_comp bind_map_spmf split_def intro!: bind_spmf_cong[OF refl] split: generat.split)\n\nlemma exec_gpv_simps:\n \"exec_gpv callee gpv s =\n the_gpv gpv \\\n case_generat (\\x. return_spmf (x, s))\n (\\out rpv. callee s out \\ (\\(x, y). exec_gpv callee (rpv x) y))\"\nby(fact exec_gpv.simps)\n\nlemma exec_gpv_lift_spmf [simp]:\n \"exec_gpv callee (lift_spmf p) s = bind_spmf p (\\x. return_spmf (x, s))\"\nby(simp add: exec_gpv_conv_inline1 spmf.map_comp o_def map_spmf_conv_bind_spmf)\n\nlemma exec_gpv_Done [simp]: \"exec_gpv callee (Done x) s = return_spmf (x, s)\"\nby(simp add: exec_gpv_conv_inline1)\n\nlemma exec_gpv_Fail [simp]: \"exec_gpv callee Fail s = return_pmf None\"\nby(simp add: exec_gpv_conv_inline1)\n\nlemma if_distrib_exec_gpv [if_distribs]:\n \"exec_gpv callee (if b then x else y) s = (if b then exec_gpv callee x s else exec_gpv callee y s)\"\nby simp\n\nlemmas exec_gpv_fixp_parallel_induct [case_names adm bottom step] =\n parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf exec_gpv.mono exec_gpv.mono exec_gpv_def exec_gpv_def, unfolded lub_spmf_empty]\n\ncontext includes lifting_syntax begin\n\nlemma exec_gpv_parametric':\n \"((S ===> CALL ===> rel_spmf (rel_prod R S)) ===> rel_gpv'' A CALL R ===> S ===> rel_spmf (rel_prod A S))\n exec_gpv exec_gpv\"\napply(rule rel_funI)+\napply(unfold spmf_rel_map exec_gpv_conv_inline1)\napply(rule rel_spmf_mono_strong)\n apply(erule inline1_parametric'[THEN rel_funD, THEN rel_funD, THEN rel_funD, rotated])\n prefer 3\n apply(drule in_set_inline1_lift_spmf1)+\n apply fastforce\n subgoal by simp\nsubgoal premises [transfer_rule]\n supply lift_spmf_parametric'[transfer_rule] by transfer_prover\ndone\n\nlemma exec_gpv_parametric [transfer_rule]:\n \"((S ===> CALL ===> rel_spmf (rel_prod ((=) :: 'ret \\ _) S)) ===> rel_gpv A CALL ===> S ===> rel_spmf (rel_prod A S))\n exec_gpv exec_gpv\"\nunfolding rel_gpv_conv_rel_gpv'' by(rule exec_gpv_parametric')\n\nend\n\nlemma exec_gpv_bind: \"exec_gpv callee (c \\ f) s = exec_gpv callee c s \\ (\\(x, s') \\ exec_gpv callee (f x) s')\"\nby(auto simp add: exec_gpv_conv_inline1 inline1_bind_gpv map_spmf_bind_spmf o_def bind_map_spmf intro!: bind_spmf_cong[OF refl] dest: in_set_inline1_lift_spmf1)\n\nlemma exec_gpv_map_gpv_id:\n \"exec_gpv oracle (map_gpv f id gpv) \\ = map_spmf (apfst f) (exec_gpv oracle gpv \\)\"\nproof(rule sym)\n define gpv' where \"gpv' = map_gpv f id gpv\"\n have [transfer_rule]: \"rel_gpv (\\x y. y = f x) (=) gpv gpv'\"\n unfolding gpv'_def by(simp add: gpv.rel_map gpv.rel_refl)\n have \"rel_spmf (rel_prod (\\x y. y = f x) (=)) (exec_gpv oracle gpv \\) (exec_gpv oracle gpv' \\)\"\n by transfer_prover\n thus \"map_spmf (apfst f) (exec_gpv oracle gpv \\) = exec_gpv oracle (map_gpv f id gpv) \\\"\n unfolding spmf_rel_eq[symmetric] gpv'_def spmf_rel_map by(rule rel_spmf_mono) clarsimp\nqed\n\nlemma exec_gpv_Pause [simp]:\n \"exec_gpv callee (Pause out f) s = callee s out \\ (\\(x, s'). exec_gpv callee (f x) s')\"\nby(simp add: inline1_Pause map_spmf_bind_spmf bind_map_spmf o_def exec_gpv_conv_inline1 split_def)\n\nlemma exec_gpv_bind_lift_spmf:\n \"exec_gpv callee (bind_gpv (lift_spmf p) f) s = bind_spmf p (\\x. exec_gpv callee (f x) s)\"\nby(simp add: exec_gpv_bind)\n\nlemma exec_gpv_bind_option [simp]:\n \"exec_gpv oracle (monad.bind_option Fail x f) s = monad.bind_option (return_pmf None) x (\\a. exec_gpv oracle (f a) s)\"\nby(cases x) simp_all\n\nlemma pred_spmf_exec_gpv:\n \\ \\We don't get an equivalence here because states are threaded through in @{const exec_gpv}.\\\n \"\\ pred_gpv A C gpv; pred_fun S (pred_fun C (pred_spmf (pred_prod (\\_. True) S))) callee; S s \\\n \\ pred_spmf (pred_prod A S) (exec_gpv callee gpv s)\"\nusing exec_gpv_parametric[of \"eq_onp S\" \"eq_onp C\" \"eq_onp A\", folded eq_onp_True]\napply(unfold prod.rel_eq_onp option.rel_eq_onp pmf.rel_eq_onp gpv.rel_eq_onp)\napply(drule rel_funD[where x=callee and y=callee])\n subgoal\n apply(rule rel_fun_mono[where X=\"eq_onp S\"])\n apply(rule rel_fun_eq_onpI)\n apply(unfold eq_onp_same_args)\n apply assumption\n apply simp\n apply(erule rel_fun_eq_onpI)\n done\napply(auto dest!: rel_funD simp add: eq_onp_def)\ndone\n\nlemma exec_gpv_inline:\n fixes callee :: \"('c, 'r, 's) callee\"\n and gpv :: \"'s' \\ 'c' \\ ('r' \\ 's', 'c, 'r) gpv\"\n shows \"exec_gpv callee (inline gpv c' s') s =\n map_spmf (\\(x, s', s). ((x, s'), s)) (exec_gpv (\\(s', s) y. map_spmf (\\((x, s'), s). (x, s', s)) (exec_gpv callee (gpv s' y) s)) c' (s', s))\"\n (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = map_spmf projl (map_spmf (map_sum (\\(x, s2, y). ((x, s2), y))\n (\\(x, rpv'' :: ('r \\ 's, unit, unit) rpv, rpv', rpv). (x, rpv'', \\r1. bind_gpv (rpv' r1) (\\(r2, y). inline gpv (rpv r2) y))))\n (inline2 (\\s c. lift_spmf (callee s c)) gpv c' s' s))\"\n unfolding exec_gpv_conv_inline1 by(simp add: inline1_inline_conv_inline2)\n also have \"\\ = map_spmf (\\(x, s', s). ((x, s'), s)) (map_spmf projl (map_spmf (map_sum id\n (\\(x, rpv'' :: ('r \\ 's, unit, unit) rpv, rpv', rpv). (x, \\r. bind_gpv (rpv'' r) (\\(r1, s1). map_gpv (\\((r2, s2), s1). (r2, s2, s1)) id (inline (\\s c. lift_spmf (callee s c)) (rpv' r1) s1)), rpv)))\n (inline2 (\\s c. lift_spmf (callee s c)) gpv c' s' s)))\"\n unfolding spmf.map_comp by(rule map_spmf_cong[OF refl])(auto dest!: in_set_inline2_lift_spmf1)\n also have \"\\ = ?rhs\" unfolding exec_gpv_conv_inline1\n by(subst inline1_inline_conv_inline2'[symmetric])(simp add: spmf.map_comp split_def inline_lift_spmf1 map_lift_spmf)\n finally show ?thesis .\nqed\n\nlemma ord_spmf_exec_gpv:\n assumes callee: \"\\s x. ord_spmf (=) (callee1 s x) (callee2 s x)\"\n shows \"ord_spmf (=) (exec_gpv callee1 gpv s) (exec_gpv callee2 gpv s)\"\nproof(induction arbitrary: gpv s rule: exec_gpv_fixp_parallel_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\nnext\n case (step exec_gpv1 exec_gpv2)\n show ?case using step.prems\n by(clarsimp intro!: ord_spmf_bind_reflI ord_spmf_bindI[OF assms] step.IH split!: generat.split)\nqed\n\ncontext fixes callee :: \"('call, 'ret, 's) callee\" notes [[function_internals]] begin\n\npartial_function (spmf) execp_resumption :: \"('a, 'call, 'ret) resumption \\ 's \\ ('a \\ 's) spmf\"\nwhere\n \"execp_resumption r s = (case r of resumption.Done x \\ return_pmf (map_option (\\a. (a, s)) x)\n | resumption.Pause out c \\ bind_spmf (callee s out) (\\(input, s'). execp_resumption (c input) s'))\"\n\nsimps_of_case execp_resumption_simps [simp]: execp_resumption.simps\n\nlemma execp_resumption_ABORT [simp]: \"execp_resumption ABORT s = return_pmf None\"\nby(simp add: ABORT_def)\n\nlemma execp_resumption_DONE [simp]: \"execp_resumption (DONE x) s = return_spmf (x, s)\"\nby(simp add: DONE_def)\n\nlemma exec_gpv_lift_resumption: \"exec_gpv callee (lift_resumption r) s = execp_resumption r s\"\nproof(induction arbitrary: r s rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf exec_gpv.mono execp_resumption.mono exec_gpv_def execp_resumption_def, case_names adm bot step])\n case adm show ?case by(simp)\n case bot thus ?case by simp\n case (step exec_gpv' execp_resumption')\n show ?case\n by(auto split: resumption.split option.split simp add: lift_resumption.sel intro: bind_spmf_cong step)\nqed\n\nlemma mcont2mcont_execp_resumption [THEN spmf.mcont2mcont, cont_intro, simp]:\n shows mcont_execp_resumption:\n \"mcont resumption_lub resumption_ord lub_spmf (ord_spmf (=)) (\\r. execp_resumption r s)\"\nproof -\n have \"mcont (prod_lub resumption_lub the_Sup) (rel_prod resumption_ord (=)) lub_spmf (ord_spmf (=)) (case_prod execp_resumption)\"\n proof(rule ccpo.fixp_preserves_mcont2[OF ccpo_spmf execp_resumption.mono execp_resumption_def])\n fix execp_resumption' :: \"('b, 'call, 'ret) resumption \\ 's \\ ('b \\ 's) spmf\"\n assume *: \"mcont (prod_lub resumption_lub the_Sup) (rel_prod resumption_ord (=)) lub_spmf (ord_spmf (=)) (\\(r, s). execp_resumption' r s)\"\n have [THEN spmf.mcont2mcont, cont_intro, simp]: \"mcont resumption_lub resumption_ord lub_spmf (ord_spmf (=)) (\\r. execp_resumption' r s)\" \n for s using * by simp\n have \"mcont resumption_lub resumption_ord lub_spmf (ord_spmf (=))\n (\\r. case r of resumption.Done x \\ return_pmf (map_option (\\a. (a, s)) x)\n | resumption.Pause out c \\ bind_spmf (callee s out) (\\(input, s'). execp_resumption' (c input) s'))\"\n for s by(rule mcont_case_resumption)(auto simp add: ccpo_spmf intro!: mcont_bind_spmf)\n thus \"mcont (prod_lub resumption_lub the_Sup) (rel_prod resumption_ord (=)) lub_spmf (ord_spmf (=))\n (\\(r, s). case r of resumption.Done x \\ return_pmf (map_option (\\a. (a, s)) x)\n | resumption.Pause out c \\ bind_spmf (callee s out) (\\(input, s'). execp_resumption' (c input) s'))\"\n by simp\n qed\n thus ?thesis by auto\nqed\n\n\nlemma execp_resumption_bind [simp]:\n \"execp_resumption (r \\ f) s = execp_resumption r s \\ (\\(x, s'). execp_resumption (f x) s')\"\nby(simp add: exec_gpv_lift_resumption[symmetric] lift_resumption_bind exec_gpv_bind)\n\nlemma pred_spmf_execp_resumption:\n \"\\A. \\ pred_resumption A C r; pred_fun S (pred_fun C (pred_spmf (pred_prod (\\_. True) S))) callee; S s \\\n \\ pred_spmf (pred_prod A S) (execp_resumption r s)\"\nunfolding exec_gpv_lift_resumption[symmetric]\nby(rule pred_spmf_exec_gpv) simp_all\n\nend\n\ninductive WT_callee :: \"('call, 'ret) \\ \\ ('call \\ ('ret \\ 's) spmf) \\ bool\" (\"(_) \\c/ (_) \\\" [100, 0] 99)\n for \\ callee\nwhere\n WT_callee:\n \"\\ \\call ret s. \\ call \\ outs_\\ \\; (ret, s) \\ set_spmf (callee call) \\ \\ ret \\ responses_\\ \\ call \\\n \\ \\ \\c callee \\\"\n\nlemmas WT_calleeI = WT_callee\nhide_fact WT_callee\n\nlemma WT_calleeD: \"\\ \\ \\c callee \\; (ret, s) \\ set_spmf (callee out); out \\ outs_\\ \\ \\ \\ ret \\ responses_\\ \\ out\"\nby(rule WT_callee.cases)\n\nlemma WT_callee_full [intro!, simp]: \"\\_full \\c callee \\\"\nby(rule WT_calleeI) simp\n\nlemma WT_callee_parametric [transfer_rule]:\n includes lifting_syntax \n assumes [transfer_rule]: \"bi_unique R\"\n shows \"(rel_\\ C R ===> (C ===> rel_spmf (rel_prod R S)) ===> (=)) WT_callee WT_callee\"\nproof -\n have *: \"WT_callee = (\\\\ callee. \\call\\ outs_\\ \\. \\(ret, s) \\ set_spmf (callee call). ret \\ responses_\\ \\ call)\"\n unfolding WT_callee.simps by blast\n show ?thesis unfolding * by transfer_prover\nqed\n\nlocale callee_invariant_on_base =\n fixes callee :: \"'s \\ 'a \\ ('b \\ 's) spmf\"\n and I :: \"'s \\ bool\"\n and \\ :: \"('a, 'b) \\\"\n\nlocale callee_invariant_on = callee_invariant_on_base callee I \\\n for callee :: \"'s \\ 'a \\ ('b \\ 's) spmf\"\n and I :: \"'s \\ bool\"\n and \\ :: \"('a, 'b) \\\"\n +\n assumes callee_invariant: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; x \\ outs_\\ \\ \\ \\ I s'\"\n and WT_callee: \"\\s. I s \\ \\ \\c callee s \\\"\nbegin\n\nlemma callee_invariant': \"\\ (y, s') \\ set_spmf (callee s x); I s; x \\ outs_\\ \\ \\ \\ I s' \\ y \\ responses_\\ \\ x\"\nby(auto dest: WT_calleeD[OF WT_callee] callee_invariant)\n\nlemma exec_gpv_invariant':\n \"\\ I s; \\ \\g gpv \\ \\ \\ set_spmf (exec_gpv callee gpv s) \\ {(x, s'). I s'}\"\nproof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct)\n case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n case bottom show ?case by simp\n case step show ?case using step.prems\n by(auto simp add: bind_UNION intro!: UN_least step.IH del: subsetI split: generat.split dest!: callee_invariant' elim: WT_gpvD)\nqed\n\nlemma exec_gpv_invariant:\n \"\\ (x, s') \\ set_spmf (exec_gpv callee gpv s); I s; \\ \\g gpv \\ \\ \\ I s'\"\nby(drule exec_gpv_invariant') blast+\n\nlemma interaction_bounded_by_exec_gpv_count':\n fixes count\n assumes bound: \"interaction_bounded_by consider gpv n\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; consider x; x \\ outs_\\ \\ \\ \\ count s' \\ eSuc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and WT: \"\\ \\g gpv \\\"\n and I: \"I s\"\n shows \"set_spmf (exec_gpv callee gpv s) \\ {(x, s'). count s' \\ n + count s}\"\nusing bound I WT\nproof(induction arbitrary: gpv s n rule: exec_gpv_fixp_induct)\n case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n case bottom show ?case by simp\n case (step exec_gpv')\n have \"set_spmf (exec_gpv' (c input) s') \\ {(x, s''). count s'' \\ n + count s}\"\n if out: \"IO out c \\ set_spmf (the_gpv gpv)\"\n and input: \"(input, s') \\ set_spmf (callee s out)\"\n and X: \"out \\ outs_\\ \\\"\n for out c input s'\n proof(cases \"consider out\")\n case True\n with step.prems out have \"n > 0\"\n and bound': \"interaction_bounded_by consider (c input) (n - 1)\"\n by(auto dest: interaction_bounded_by_contD)\n note bound'\n moreover from input \\I s\\ X have \"I s'\" by(rule callee_invariant)\n moreover have \"\\ \\g c input \\\" using step.prems(3) out WT_calleeD[OF WT_callee input]\n by(rule WT_gpvD)(rule step.prems X)+\n ultimately have \"set_spmf (exec_gpv' (c input) s') \\ {(x, s''). count s'' \\ n - 1 + count s'}\" \n by(rule step.IH)\n also have \"\\ \\ {(x, s''). count s'' \\ n + count s}\" using \\n > 0\\ count[OF input \\I s\\ True X] \n by(cases n rule: co.enat.exhaust)(auto, metis add_left_mono_trans eSuc_plus iadd_Suc_right)\n finally show ?thesis .\n next\n case False\n from step.prems out this have bound': \"interaction_bounded_by consider (c input) n\"\n by(auto dest: interaction_bounded_by_contD_ignore)\n from input \\I s\\ X have \"I s'\" by(rule callee_invariant)\n note bound'\n moreover from input \\I s\\ X have \"I s'\" by(rule callee_invariant)\n moreover have \"\\ \\g c input \\\" using step.prems(3) out WT_calleeD[OF WT_callee input]\n by(rule WT_gpvD)(rule step.prems X)+\n ultimately have \"set_spmf (exec_gpv' (c input) s') \\ {(x, s''). count s'' \\ n + count s'}\"\n by(rule step.IH)\n also have \"\\ \\ {(x, s''). count s'' \\ n + count s}\"\n using ignore[OF input \\I s\\ False X] by(auto elim: order_trans)\n finally show ?thesis .\n qed\n then show ?case using step.prems(3)\n by(auto 4 3 simp add: bind_UNION del: subsetI intro!: UN_least split: generat.split dest: WT_gpvD)\nqed\n\nlemma interaction_bounded_by_exec_gpv_count:\n fixes count\n assumes bound: \"interaction_bounded_by consider gpv n\"\n and xs': \"(x, s') \\ set_spmf (exec_gpv callee gpv s)\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; consider x; x \\ outs_\\ \\ \\ \\ count s' \\ eSuc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and WT: \"\\ \\g gpv \\\"\n and I: \"I s\"\n shows \"count s' \\ n + count s\"\nusing bound count ignore WT I \nby(rule interaction_bounded_by_exec_gpv_count'[THEN subsetD, OF _ _ _ _ _ xs', unfolded mem_Collect_eq prod.case])\n\nlemma interaction_bounded_by'_exec_gpv_count:\n fixes count\n assumes bound: \"interaction_bounded_by' consider gpv n\"\n and xs': \"(x, s') \\ set_spmf (exec_gpv callee gpv s)\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; consider x; x \\ outs_\\ \\ \\ \\ count s' \\ Suc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and outs: \"\\ \\g gpv \\\"\n and I: \"I s\"\n shows \"count s' \\ n + count s\"\nusing interaction_bounded_by_exec_gpv_count[OF bound xs', of count] count ignore outs I\nby(simp add: eSuc_enat)\n\nlemma pred_spmf_calleeI: \"\\ I s; x \\ outs_\\ \\ \\ \\ pred_spmf (pred_prod (\\_. True) I) (callee s x)\"\nby(auto simp add: pred_spmf_def dest: callee_invariant)\n\nlemma lossless_exec_gpv:\n assumes gpv: \"lossless_gpv \\ gpv\"\n and callee: \"\\s out. \\ out \\ outs_\\ \\; I s \\ \\ lossless_spmf (callee s out)\"\n and WT_gpv: \"\\ \\g gpv \\\"\n and I: \"I s\"\n shows \"lossless_spmf (exec_gpv callee gpv s)\"\nusing gpv WT_gpv I\nproof(induction arbitrary: s rule: lossless_WT_gpv_induct)\n case (lossless_gpv gpv)\n show ?case using lossless_gpv.hyps lossless_gpv.prems\n by(subst exec_gpv.simps)(fastforce split: generat.split simp add: callee intro!: lossless_gpv.IH intro: WT_calleeD[OF WT_callee] elim!: callee_invariant)\nqed\n\nlemma in_set_spmf_exec_gpv_into_results_gpv:\n assumes *: \"(x, s') \\ set_spmf (exec_gpv callee gpv s)\"\n and WT_gpv : \"\\ \\g gpv \\\"\n and I: \"I s\"\n shows \"x \\ results_gpv \\ gpv\"\nproof -\n have \"set_spmf (exec_gpv callee gpv s) \\ results_gpv \\ gpv \\ UNIV\"\n using WT_gpv I\n proof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct)\n { case adm show ?case by(intro cont_intro ccpo_class.admissible_leI) }\n { case bottom show ?case by simp }\n case (step exec_gpv')\n { fix out c ret s'\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n and ret: \"(ret, s') \\ set_spmf (callee s out)\"\n from step.prems(1) IO have \"out \\ outs_\\ \\\" by(rule WT_gpvD)\n with WT_callee[OF \\I s\\] ret have \"ret \\ responses_\\ \\ out\" by(rule WT_calleeD)\n with step.prems(1) IO have \"\\ \\g c ret \\\" by(rule WT_gpvD)\n moreover from ret \\I s\\ \\out \\ outs_\\ \\\\ have \"I s'\" by(rule callee_invariant)\n ultimately have \"set_spmf (exec_gpv' (c ret) s') \\ results_gpv \\ (c ret) \\ UNIV\"\n by(rule step.IH)\n also have \"\\ \\ results_gpv \\ gpv \\ UNIV\" using IO \\ret \\ _\\\n by(auto intro: results_gpv.IO)\n finally have \"set_spmf (exec_gpv' (c ret) s') \\ results_gpv \\ gpv \\ UNIV\" . }\n then show ?case using step.prems\n by(auto simp add: bind_UNION intro!: UN_least del: subsetI split: generat.split intro: results_gpv.Pure)\n qed\n thus \"x \\ results_gpv \\ gpv\" using * by blast+\nqed\n\nend\n\nlemma callee_invariant_on_alt_def:\n \"callee_invariant_on = (\\callee I \\.\n (\\s \\ Collect I. \\x \\ outs_\\ \\. \\(y, s') \\ set_spmf (callee s x). I s') \\\n (\\s \\ Collect I. \\ \\c callee s \\))\"\nunfolding callee_invariant_on_def by blast\n\nlemma callee_invariant_on_parametric [transfer_rule]: includes lifting_syntax\n assumes [transfer_rule]: \"bi_unique R\" \"bi_total S\"\n shows \"((S ===> C ===> rel_spmf (rel_prod R S)) ===> (S ===> (=)) ===> rel_\\ C R ===> (=))\n callee_invariant_on callee_invariant_on\"\nunfolding callee_invariant_on_alt_def by transfer_prover\n\nlemma callee_invariant_on_cong:\n \"\\ I = I'; outs_\\ \\ = outs_\\ \\'; \n \\s x. \\ I' s; x \\ outs_\\ \\' \\ \\ set_spmf (callee s x) \\ responses_\\ \\ x \\ Collect I' \\ set_spmf (callee' s x) \\ responses_\\ \\' x \\ Collect I' \\\n \\ callee_invariant_on callee I \\ = callee_invariant_on callee' I' \\'\"\nunfolding callee_invariant_on_def WT_callee.simps\nby safe((erule meta_allE)+, (erule (1) meta_impE)+, force)+ \n\nabbreviation callee_invariant :: \"('s \\ 'a \\ ('b \\ 's) spmf) \\ ('s \\ bool) \\ bool\"\nwhere \"callee_invariant callee I \\ callee_invariant_on callee I \\_full\"\n\ninterpretation oi_True: callee_invariant_on callee \"\\_. True\" \\_full for callee\nby unfold_locales (simp_all)\n\nlemma callee_invariant_on_return_spmf [simp]:\n \"callee_invariant_on (\\s x. return_spmf (f s x)) I \\ \\ (\\s. \\x\\outs_\\ \\. I s \\ I (snd (f s x)) \\ fst (f s x) \\ responses_\\ \\ x)\"\nby(auto simp add: callee_invariant_on_def split_pairs WT_callee.simps)\n\nlemma callee_invariant_return_spmf [simp]:\n \"callee_invariant (\\s x. return_spmf (f s x)) I \\ (\\s x. I s \\ I (snd (f s x)))\"\nby(auto simp add: callee_invariant_on_def split_pairs)\n\nlemma callee_invariant_restrict_relp:\n includes lifting_syntax\n assumes \"(S ===> C ===> rel_spmf (rel_prod R S)) callee1 callee2\"\n and \"callee_invariant callee1 I1\"\n and \"callee_invariant callee2 I2\"\n shows \"((S \\ I1 \\ I2) ===> C ===> rel_spmf (rel_prod R (S \\ I1 \\ I2))) callee1 callee2\"\nproof -\n interpret ci1: callee_invariant_on callee1 I1 \\_full by fact\n interpret ci2: callee_invariant_on callee2 I2 \\_full by fact\n show ?thesis using assms(1)\n by(intro rel_funI)(auto simp add: restrict_rel_prod2 intro!: rel_spmf_restrict_relpI intro: ci1.pred_spmf_calleeI ci2.pred_spmf_calleeI dest: rel_funD rel_setD1 rel_setD2)\nqed\n\nlemma callee_invariant_on_True [simp]: \"callee_invariant_on callee (\\_. True) \\ \\ (\\s. \\ \\c callee s \\)\"\nby(simp add: callee_invariant_on_def)\n\nlemma lossless_exec_gpv:\n \"\\ lossless_gpv \\ gpv; \\s out. out \\ outs_\\ \\ \\ lossless_spmf (callee s out);\n \\ \\g gpv \\; \\s. \\ \\c callee s \\ \\\n \\ lossless_spmf (exec_gpv callee gpv s)\"\nby(rule callee_invariant_on.lossless_exec_gpv; simp)\n\nlemma in_set_spmf_exec_gpv_into_results'_gpv:\n assumes *: \"(x, s') \\ set_spmf (exec_gpv callee gpv s)\"\n shows \"x \\ results'_gpv gpv\"\nusing oi_True.in_set_spmf_exec_gpv_into_results_gpv[OF *] by(simp add: results_gpv_\\_full)\n\n\ncontext fixes \\ :: \"('out, 'in) \\\" begin\n\nprimcorec restrict_gpv :: \"('a, 'out, 'in) gpv \\ ('a, 'out, 'in) gpv\"\nwhere\n \"restrict_gpv gpv = GPV (\n map_pmf (case_option None (case_generat (Some \\ Pure) \n (\\out c. if out \\ outs_\\ \\ then Some (IO out (\\input. if input \\ responses_\\ \\ out then restrict_gpv (c input) else Fail))\n else None)))\n (the_gpv gpv))\" \n\nlemma restrict_gpv_Done [simp]: \"restrict_gpv (Done x) = Done x\"\nby(rule gpv.expand)(simp)\n\nlemma restrict_gpv_Fail [simp]: \"restrict_gpv Fail = Fail\"\nby(rule gpv.expand)(simp)\n\nlemma restrict_gpv_Pause [simp]: \"restrict_gpv (Pause out c) = (if out \\ outs_\\ \\ then Pause out (\\input. if input \\ responses_\\ \\ out then restrict_gpv (c input) else Fail) else Fail)\"\nby(rule gpv.expand)(simp)\n\nlemma restrict_gpv_bind [simp]: \"restrict_gpv (bind_gpv gpv f) = bind_gpv (restrict_gpv gpv) (\\x. restrict_gpv (f x))\"\napply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\napply(auto 4 3 simp del: bind_gpv_sel' simp add: bind_gpv.sel bind_spmf_def pmf.rel_map bind_map_pmf rel_fun_def intro!: rel_pmf_bind_reflI rel_pmf_reflI split!: option.split generat.split split: if_split_asm)\ndone\n\nlemma WT_restrict_gpv [simp]: \"\\ \\g restrict_gpv gpv \\\"\napply(coinduction arbitrary: gpv)\napply(clarsimp split: option.split_asm)\napply(split generat.split_asm; auto split: if_split_asm)\ndone\n\nlemma exec_gpv_restrict_gpv:\n assumes \"\\ \\g gpv \\\" and WT_callee: \"\\s. \\ \\c callee s \\\"\n shows \"exec_gpv callee (restrict_gpv gpv) s = exec_gpv callee gpv s\"\nusing assms(1)\nproof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step exec_gpv') show ?case \n by(auto 4 3 simp add: bind_spmf_def bind_map_pmf in_set_spmf[symmetric] WT_gpv_OutD[OF step.prems] WT_calleeD[OF WT_callee] intro!: bind_pmf_cong[OF refl] step.IH split!: option.split generat.split intro: WT_gpv_ContD[OF step.prems])\nqed\n\nlemma in_outs'_restrict_gpvD: \"x \\ outs'_gpv (restrict_gpv gpv) \\ x \\ outs_\\ \\\"\napply(induction gpv'\\\"restrict_gpv gpv\" arbitrary: gpv rule: outs'_gpv_induct)\napply(clarsimp split: option.split_asm; split generat.split_asm; clarsimp split: if_split_asm)+\ndone\n\nlemma outs'_restrict_gpv: \"outs'_gpv (restrict_gpv gpv) \\ outs_\\ \\\" by(blast intro: in_outs'_restrict_gpvD)\n\nlemma lossless_restrict_gpvI: \"\\ lossless_gpv \\ gpv; \\ \\g gpv \\ \\ \\ lossless_gpv \\ (restrict_gpv gpv)\"\napply(induction rule: lossless_gpv_induct)\napply(rule lossless_gpvI)\nsubgoal by(clarsimp simp add: lossless_map_pmf lossless_iff_set_pmf_None in_set_spmf[symmetric] WT_gpv_OutD split: option.split_asm generat.split_asm if_split_asm)\nsubgoal by(clarsimp split: option.split_asm; split generat.split_asm; force simp add: fun_eq_iff in_set_spmf[symmetric] split: if_split_asm intro: WT_gpv_ContD)\ndone\n\nlemma lossless_restrict_gpvD: \"\\ lossless_gpv \\ (restrict_gpv gpv); \\ \\g gpv \\ \\ \\ lossless_gpv \\ gpv\"\nproof(induction gpv'\\\"restrict_gpv gpv\" arbitrary: gpv rule: lossless_gpv_induct)\n case (lossless_gpv p)\n from lossless_gpv.hyps(4) have p: \"p = the_gpv (restrict_gpv gpv)\" by(cases \"restrict_gpv gpv\") simp\n show ?case\n proof(rule lossless_gpvI) \n from lossless_gpv.hyps(1) show \"lossless_spmf (the_gpv gpv)\"\n by(auto simp add: p lossless_iff_set_pmf_None intro: rev_image_eqI)\n\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" and input: \"input \\ responses_\\ \\ out\"\n from lossless_gpv.prems(1) IO have out: \"out \\ outs_\\ \\\" by(rule WT_gpv_OutD)\n hence \"IO out (\\input. if input \\ responses_\\ \\ out then restrict_gpv (c input) else Fail) \\ set_spmf p\" using IO\n by(auto simp add: p in_set_spmf intro: rev_bexI)\n from lossless_gpv.hyps(3)[OF this input, of \"c input\"] WT_gpvD[OF lossless_gpv.prems IO] input\n show \"lossless_gpv \\ (c input)\" by simp\n qed\nqed\n \nlemma colossless_restrict_gpvD:\n \"\\ colossless_gpv \\ (restrict_gpv gpv); \\ \\g gpv \\ \\ \\ colossless_gpv \\ gpv\"\nproof(coinduction arbitrary: gpv)\n case (colossless_gpv gpv)\n have ?lossless_spmf using colossless_gpv(1)[THEN colossless_gpv_lossless_spmfD]\n by(auto simp add: lossless_iff_set_pmf_None intro: rev_image_eqI)\n moreover have ?continuation\n proof(intro strip disjI1)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" and input: \"input \\ responses_\\ \\ out\"\n from colossless_gpv(2) IO have out: \"out \\ outs_\\ \\\" by(rule WT_gpv_OutD)\n hence \"IO out (\\input. if input \\ responses_\\ \\ out then restrict_gpv (c input) else Fail) \\ set_spmf (the_gpv (restrict_gpv gpv))\"\n using IO by(auto simp add: in_set_spmf intro: rev_bexI)\n from colossless_gpv_continuationD[OF colossless_gpv(1) this input] input WT_gpv_ContD[OF colossless_gpv(2) IO input]\n show \"\\gpv. c input = gpv \\ colossless_gpv \\ (restrict_gpv gpv) \\ \\ \\g gpv \\\" by simp\n qed\n ultimately show ?case ..\nqed\n\nlemma colossless_restrict_gpvI:\n \"\\ colossless_gpv \\ gpv; \\ \\g gpv \\ \\ \\ colossless_gpv \\ (restrict_gpv gpv)\"\nproof(coinduction arbitrary: gpv)\n case (colossless_gpv gpv)\n have ?lossless_spmf using colossless_gpv(1)[THEN colossless_gpv_lossless_spmfD]\n by(auto simp add: lossless_iff_set_pmf_None in_set_spmf[symmetric] split: option.split_asm generat.split_asm if_split_asm dest: WT_gpv_OutD[OF colossless_gpv(2)])\n moreover have ?continuation\n proof(intro strip disjI1)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv (restrict_gpv gpv))\" and input: \"input \\ responses_\\ \\ out\"\n then obtain c' where out: \"out \\ outs_\\ \\\"\n and c: \"c = (\\input. if input \\ responses_\\ \\ out then restrict_gpv (c' input) else Fail)\"\n and IO': \"IO out c' \\ set_spmf (the_gpv gpv)\"\n by(clarsimp split: option.split_asm; split generat.split_asm; clarsimp simp add: in_set_spmf split: if_split_asm)\n with input WT_gpv_ContD[OF colossless_gpv(2) IO' input] colossless_gpv_continuationD[OF colossless_gpv(1) IO' input]\n show \"\\gpv. c input = restrict_gpv gpv \\ colossless_gpv \\ gpv \\ \\ \\g gpv \\\" by(auto)\n qed\n ultimately show ?case ..\nqed\n\nlemma gen_colossless_restrict_gpv [simp]:\n \"\\ \\g gpv \\ \\ gen_lossless_gpv b \\ (restrict_gpv gpv) \\ gen_lossless_gpv b \\ gpv\"\nby(cases b)(auto intro: lossless_restrict_gpvI lossless_restrict_gpvD colossless_restrict_gpvI colossless_restrict_gpvD)\n\nlemma interaction_bound_restrict_gpv:\n \"interaction_bound consider (restrict_gpv gpv) \\ interaction_bound consider gpv\"\nproof(induction arbitrary: gpv rule: interaction_bound_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step interaction_bound')\n show ?case using step.hyps(1)[of Fail]\n by(fastforce simp add: SUP_UNION set_spmf_def bind_UNION intro: SUP_mono rev_bexI step.IH split: option.split generat.split)\nqed\n\nlemma interaction_bounded_by_restrict_gpvI [interaction_bound, simp]:\n \"interaction_bounded_by consider gpv n \\ interaction_bounded_by consider (restrict_gpv gpv) n\"\nusing interaction_bound_restrict_gpv[of \"consider\" gpv] by(simp add: interaction_bounded_by.simps)\n\nend\n\nlemma restrict_gpv_parametric':\n includes lifting_syntax\n notes [transfer_rule] = the_gpv_parametric' Fail_parametric' corec_gpv_parametric'\n assumes [transfer_rule]: \"bi_unique C\" \"bi_unique R\"\n shows \"(rel_\\ C R ===> rel_gpv'' A C R ===> rel_gpv'' A C R) restrict_gpv restrict_gpv\"\nunfolding restrict_gpv_def by transfer_prover\n\nlemma restrict_gpv_parametric [transfer_rule]: includes lifting_syntax shows \n \"bi_unique C \\ (rel_\\ C (=) ===> rel_gpv A C ===> rel_gpv A C) restrict_gpv restrict_gpv\"\nusing restrict_gpv_parametric'[of C \"(=)\" A]\nby(simp add: bi_unique_eq rel_gpv_conv_rel_gpv'')\n\nlemma map_restrict_gpv: \"map_gpv f id (restrict_gpv \\ gpv) = restrict_gpv \\ (map_gpv f id gpv)\"\n for gpv :: \"('a, 'out, 'ret) gpv\"\nusing restrict_gpv_parametric[of \"BNF_Def.Grp UNIV (id :: 'out \\ 'out)\" \"BNF_Def.Grp UNIV f\", where ?'c='ret]\nunfolding gpv.rel_Grp by(simp add: eq_alt[symmetric] rel_\\_eq rel_fun_def bi_unique_eq)(simp add: Grp_def)\n\nlemma (in callee_invariant_on) exec_gpv_restrict_gpv_invariant:\n assumes \"\\ \\g gpv \\\" and \"I s\"\n shows \"exec_gpv callee (restrict_gpv \\ gpv) s = exec_gpv callee gpv s\"\nusing assms\nproof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step exec_gpv') show ?case using step.prems(2)\n by(auto 4 3 simp add: bind_spmf_def bind_map_pmf in_set_spmf[symmetric] WT_gpv_OutD[OF step.prems(1)] WT_calleeD[OF WT_callee[OF step.prems(2)]] intro!: bind_pmf_cong[OF refl] step.IH split!: option.split generat.split intro: WT_gpv_ContD[OF step.prems(1)] callee_invariant)\nqed\n\ncontext fixes \\ :: \"('out, 'in) \\\" begin\n\ninductive finite_gpv :: \"('a, 'out, 'in) gpv \\ bool\"\nwhere\n finite_gpvI: \n \"(\\out c input. \\ IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\ \\ finite_gpv (c input)) \\ finite_gpv gpv\"\n\nlemmas finite_gpv_induct[consumes 1, case_names finite_gpv, induct pred] = finite_gpv.induct\n\nlemma finite_gpvD: \"\\ finite_gpv gpv; IO out c \\ set_spmf (the_gpv gpv); input \\ responses_\\ \\ out \\ \\ finite_gpv (c input)\"\nby(auto elim: finite_gpv.cases)\n\nlemma finite_gpv_Fail [simp]: \"finite_gpv Fail\"\nby(auto intro: finite_gpvI)\n\nlemma finite_gpv_Done [simp]: \"finite_gpv (Done x)\"\nby(auto intro: finite_gpvI)\n\nlemma finite_gpv_Pause [simp]: \"finite_gpv (Pause x c) \\ (\\input \\ responses_\\ \\ x. finite_gpv (c input))\"\nby(auto dest: finite_gpvD intro: finite_gpvI)\n\nlemma finite_gpv_lift_spmf [simp]: \"finite_gpv (lift_spmf p)\"\nby(auto intro: finite_gpvI)\n\nlemma finite_gpv_bind [simp]:\n \"finite_gpv (gpv \\ f) \\ finite_gpv gpv \\ (\\x\\results_gpv \\ gpv. finite_gpv (f x))\"\n (is \"?lhs = ?rhs\")\nproof(intro iffI conjI ballI; (elim conjE)?)\n show \"finite_gpv gpv\" if \"?lhs\" using that\n proof(induction gpv'\\\"gpv \\ f\" arbitrary: gpv)\n case finite_gpv\n show ?case\n proof(rule finite_gpvI)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n and input: \"input \\ responses_\\ \\ out\"\n have \"IO out (\\input. c input \\ f) \\ set_spmf (the_gpv (gpv \\ f))\"\n using IO by(auto intro: rev_bexI)\n thus \"finite_gpv (c input)\" using input by(rule finite_gpv.hyps) simp\n qed\n qed\n show \"finite_gpv (f x)\" if \"x \\ results_gpv \\ gpv\" ?lhs for x using that\n proof(induction)\n case (Pure gpv)\n show ?case\n proof\n fix out c input\n assume \"IO out c \\ set_spmf (the_gpv (f x))\" \"input \\ responses_\\ \\ out\"\n with Pure have \"IO out c \\ set_spmf (the_gpv (gpv \\ f))\" by(auto intro: rev_bexI)\n with Pure.prems show \"finite_gpv (c input)\" by(rule finite_gpvD) fact\n qed\n next\n case (IO out c gpv input)\n with IO.hyps have \"IO out (\\input. c input \\ f) \\ set_spmf (the_gpv (gpv \\ f))\"\n by(auto intro: rev_bexI)\n with IO.prems have \"finite_gpv (c input \\ f)\" using IO.hyps(2) by(rule finite_gpvD)\n thus ?case by(rule IO.IH)\n qed\n show ?lhs if \"finite_gpv gpv\" \"\\x\\results_gpv \\ gpv. finite_gpv (f x)\" using that\n proof induction\n case (finite_gpv gpv)\n show ?case\n proof(rule finite_gpvI)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv (gpv \\ f))\" and input: \"input \\ responses_\\ \\ out\"\n then obtain generat where generat: \"generat \\ set_spmf (the_gpv gpv)\"\n and IO: \"IO out c \\ set_spmf (if is_Pure generat then the_gpv (f (result generat)) else\n return_spmf (IO (output generat) (\\input. continuation generat input \\ f)))\"\n by(auto)\n show \"finite_gpv (c input)\"\n proof(cases generat)\n case (Pure x)\n with generat IO have \"x \\ results_gpv \\ gpv\" \"IO out c \\ set_spmf (the_gpv (f x))\"\n by(auto intro: results_gpv.Pure)\n thus ?thesis using finite_gpv.prems input by(auto dest: finite_gpvD)\n next\n case *: (IO out' c')\n with IO generat finite_gpv.prems input show ?thesis\n by(auto 4 4 intro: finite_gpv.IH results_gpv.IO)\n qed\n qed\n qed\nqed\n\nend\n\ncontext includes lifting_syntax begin\n\nlemma finite_gpv_rel''D1:\n assumes \"rel_gpv'' A C R gpv gpv'\" and \"finite_gpv \\ gpv\" and \\: \"rel_\\ C R \\ \\'\"\n shows \"finite_gpv \\' gpv'\"\nusing assms(2,1)\nproof(induction arbitrary: gpv')\n case (finite_gpv gpv)\n note finite_gpv.prems[transfer_rule]\n show ?case\n proof(rule finite_gpvI)\n fix out' c' input'\n assume IO: \"IO out' c' \\ set_spmf (the_gpv gpv')\" and input': \"input' \\ responses_\\ \\' out'\"\n have \"rel_set (rel_generat A C (R ===> (rel_gpv'' A C R))) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))\"\n supply the_gpv_parametric'[transfer_rule] by transfer_prover\n with IO input' responses_\\_parametric[THEN rel_funD, OF \\] obtain out c input\n where \"IO out c \\ set_spmf (the_gpv gpv)\" \"input \\ responses_\\ \\ out\" \"rel_gpv'' A C R (c input) (c' input')\"\n by(auto 4 3 dest!: rel_setD2 elim!: generat.rel_cases dest: rel_funD)\n then show \"finite_gpv \\' (c' input')\" by(rule finite_gpv.IH)\n qed\nqed\n\nlemma finite_gpv_relD1: \"\\ rel_gpv A C gpv gpv'; finite_gpv \\ gpv; rel_\\ C (=) \\ \\ \\ \\ finite_gpv \\ gpv'\"\nusing finite_gpv_rel''D1[of A C \"(=)\" gpv gpv' \\ \\] by(simp add: rel_gpv_conv_rel_gpv'')\n\nlemma finite_gpv_rel''D2: \"\\ rel_gpv'' A C R gpv gpv'; finite_gpv \\ gpv'; rel_\\ C R \\' \\ \\ \\ finite_gpv \\' gpv\"\nusing finite_gpv_rel''D1[of \"A\\\\\" \"C\\\\\" \"R\\\\\" gpv' gpv \\ \\'] by(simp add: rel_gpv''_conversep)\n\nlemma finite_gpv_relD2: \"\\ rel_gpv A C gpv gpv'; finite_gpv \\ gpv'; rel_\\ C (=) \\ \\ \\ \\ finite_gpv \\ gpv\"\nusing finite_gpv_rel''D2[of A C \"(=)\" gpv gpv' \\ \\] by(simp add: rel_gpv_conv_rel_gpv'')\n\nlemma finite_gpv_parametric': \"(rel_\\ C R ===> rel_gpv'' A C R ===> (=)) finite_gpv finite_gpv\"\nby(blast dest: finite_gpv_rel''D2 finite_gpv_rel''D1)\n\nlemma finite_gpv_parametric [transfer_rule]: \"(rel_\\ C (=) ===> rel_gpv A C ===> (=)) finite_gpv finite_gpv\"\nusing finite_gpv_parametric'[of C \"(=)\" A] by(simp add: rel_gpv_conv_rel_gpv'')\n\nend\n\nlemma finite_gpv_map [simp]: \"finite_gpv \\ (map_gpv f id gpv) = finite_gpv \\ gpv\"\nusing finite_gpv_parametric[of \"BNF_Def.Grp UNIV id\" \"BNF_Def.Grp UNIV f\"]\nunfolding gpv.rel_Grp by(auto simp add: rel_fun_def BNF_Def.Grp_def eq_commute rel_\\_eq)\n\nlemma finite_gpv_assert [simp]: \"finite_gpv \\ (assert_gpv b)\"\nby(cases b) simp_all\n\nlemma finite_gpv_try [simp]:\n \"finite_gpv \\ (TRY gpv ELSE gpv') \\ finite_gpv \\ gpv \\ (colossless_gpv \\ gpv \\ finite_gpv \\ gpv')\"\n (is \"?lhs = _\")\nproof(intro iffI conjI; (elim conjE disjE)?)\n show 1: \"finite_gpv \\ gpv\" if ?lhs using that\n proof(induction gpv''\\\"TRY gpv ELSE gpv'\" arbitrary: gpv)\n case (finite_gpv gpv)\n show ?case\n proof(rule finite_gpvI)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" and input: \"input \\ responses_\\ \\ out\"\n from IO have \"IO out (\\input. TRY c input ELSE gpv') \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\"\n by(auto simp add: image_image generat.map_comp o_def intro: rev_image_eqI)\n thus \"finite_gpv \\ (c input)\" using input by(rule finite_gpv.hyps) simp\n qed\n qed\n have \"finite_gpv \\ gpv'\" if \"?lhs\" \"\\ colossless_gpv \\ gpv\" using that\n proof(induction gpv''\\\"TRY gpv ELSE gpv'\" arbitrary: gpv)\n case (finite_gpv gpv)\n show ?case\n proof(cases \"lossless_spmf (the_gpv gpv)\")\n case True\n have \"\\out c input. IO out c \\ set_spmf (the_gpv gpv) \\ input \\ responses_\\ \\ out \\ \\ colossless_gpv \\ (c input)\"\n using finite_gpv.prems by(rule contrapos_np)(auto intro: colossless_gpvI simp add: True)\n then obtain out c input where IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n and co': \"\\ colossless_gpv \\ (c input)\" \n and input: \"input \\ responses_\\ \\ out\" by blast\n from IO have \"IO out (\\input. TRY c input ELSE gpv') \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\"\n by(auto simp add: image_image generat.map_comp o_def intro: rev_image_eqI)\n with co' show ?thesis using input by(blast intro: finite_gpv.hyps(2))\n next\n case False\n show ?thesis\n proof(rule finite_gpvI)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv')\" and input: \"input \\ responses_\\ \\ out\"\n from IO False have \"IO out c \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\" by(auto intro: rev_image_eqI)\n then show \"finite_gpv \\ (c input)\" using input by(rule finite_gpv.hyps)\n qed\n qed\n qed\n then show \"colossless_gpv \\ gpv \\ finite_gpv \\ gpv'\" if ?lhs using that by blast\n \n show ?lhs if \"finite_gpv \\ gpv\" \"finite_gpv \\ gpv'\" using that(1)\n proof induction\n case (finite_gpv gpv)\n show ?case\n proof\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\"\n and input: \"input \\ responses_\\ \\ out\"\n then consider (gpv) c' where \"IO out c' \\ set_spmf (the_gpv gpv)\" \"c = (\\input. TRY c' input ELSE gpv')\"\n | (gpv') \"IO out c \\ set_spmf (the_gpv gpv')\" by(auto split: if_split_asm)\n then show \"finite_gpv \\ (c input)\" using input\n by cases(auto intro: finite_gpv.IH finite_gpvD[OF that(2)])\n qed\n qed\n show ?lhs if \"finite_gpv \\ gpv\" \"colossless_gpv \\ gpv\" using that\n proof induction\n case (finite_gpv gpv)\n show ?case\n by(rule finite_gpvI)(use finite_gpv.prems in \\fastforce split: if_split_asm dest: colossless_gpvD intro: finite_gpv.IH\\)\n qed\nqed\n\nlemma lossless_gpv_conv_finite:\n \"lossless_gpv \\ gpv \\ finite_gpv \\ gpv \\ colossless_gpv \\ gpv\"\n (is \"?loss \\ ?fin \\ ?co\")\nproof(intro iffI conjI; (elim conjE)?)\n show ?fin if ?loss using that by induction(auto intro: finite_gpvI)\n show ?co if ?loss using that by induction(auto intro: colossless_gpvI)\n show ?loss if ?fin ?co using that\n proof induction\n case (finite_gpv gpv)\n from finite_gpv.prems finite_gpv.IH show ?case\n by cases(auto intro: lossless_gpvI)\n qed\nqed\n\nlemma colossless_gpv_try [simp]:\n \"colossless_gpv \\ (TRY gpv ELSE gpv') \\ colossless_gpv \\ gpv \\ colossless_gpv \\ gpv'\"\n (is \"?lhs \\ ?gpv \\ ?gpv'\")\nproof(intro iffI disjCI; (elim disjE)?)\n show \"?gpv\" if ?lhs \"\\ ?gpv'\" using that(1)\n proof(coinduction arbitrary: gpv)\n case (colossless_gpv gpv)\n have ?lossless_spmf\n proof(rule ccontr)\n assume loss: \"\\ ?lossless_spmf\"\n with colossless_gpv_lossless_spmfD[OF colossless_gpv(1)]\n have gpv': \"lossless_spmf (the_gpv gpv')\" by auto\n have \"\\out c input. IO out c \\ set_spmf (the_gpv gpv') \\ input \\ responses_\\ \\ out \\ \\ colossless_gpv \\ (c input)\"\n using that(2) by(rule contrapos_np)(auto intro: colossless_gpvI gpv')\n then obtain out c input\n where IO: \"IO out c \\ set_spmf (the_gpv gpv')\"\n and co': \"\\ colossless_gpv \\ (c input)\" \n and input: \"input \\ responses_\\ \\ out\" by blast\n from IO loss have \"IO out c \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\"\n by(auto intro: rev_image_eqI)\n with colossless_gpv(1) have \"colossless_gpv \\ (c input)\" using input\n by(rule colossless_gpv_continuationD)\n with co' show False by contradiction\n qed\n moreover have ?continuation\n proof(intro strip disjI1; simp)\n fix out c input\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\" and input: \"input \\ responses_\\ \\ out\"\n hence \"IO out (\\input. TRY c input ELSE gpv') \\ set_spmf (the_gpv (TRY gpv ELSE gpv'))\"\n by(auto intro: rev_image_eqI)\n with colossless_gpv show \"colossless_gpv \\ (TRY c input ELSE gpv')\"\n by(rule colossless_gpv_continuationD)(simp add: input)\n qed\n ultimately show ?case ..\n qed\n show ?lhs if ?gpv'\n proof(coinduction arbitrary: gpv)\n case colossless_gpv\n show ?case using colossless_gpvD[OF that] by(auto 4 3)\n qed\n show ?lhs if ?gpv using that\n proof(coinduction arbitrary: gpv)\n case colossless_gpv\n show ?case using colossless_gpvD[OF colossless_gpv] by(auto 4 3)\n qed\nqed\n\nlemma lossless_gpv_try [simp]:\n \"lossless_gpv \\ (TRY gpv ELSE gpv') \\ \n finite_gpv \\ gpv \\ (lossless_gpv \\ gpv \\ lossless_gpv \\ gpv')\"\nby(auto simp add: lossless_gpv_conv_finite)\n\nlemma interaction_any_bounded_by_imp_finite:\n assumes \"interaction_any_bounded_by gpv (enat n)\"\n shows \"finite_gpv \\_full gpv\"\nusing assms \nproof(induction n arbitrary: gpv)\n case 0\n then show ?case by(auto intro: finite_gpv.intros dest: interaction_bounded_by_contD simp add: zero_enat_def[symmetric])\nnext\n case (Suc n)\n from Suc.prems show ?case unfolding eSuc_enat[symmetric]\n by(auto 4 4 intro: finite_gpv.intros Suc.IH dest: interaction_bounded_by_contD)\nqed\n\nlemma finite_restrict_gpvI [simp]: \"finite_gpv \\' gpv \\ finite_gpv \\' (restrict_gpv \\ gpv)\"\nby(induction rule: finite_gpv_induct)(rule finite_gpvI; clarsimp split: option.split_asm; split generat.split_asm; clarsimp split: if_split_asm simp add: in_set_spmf)\n\nlemma interaction_bounded_by_exec_gpv_bad_count:\n fixes count and bad and n :: enat and k :: real\n assumes bound: \"interaction_bounded_by consider gpv n\"\n and good: \"\\ bad s\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); consider x; x \\ outs_\\ \\ \\ \\ count s' \\ Suc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and bad: \"\\s' x. \\ \\ bad s'; count s' < n + count s; consider x; x \\ outs_\\ \\ \\ \\ spmf (map_spmf (bad \\ snd) (callee s' x)) True \\ k\"\n and \"consider\": \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); \\ bad s; bad s'; x \\ outs_\\ \\ \\ \\ consider x\"\n and k_nonneg: \"k \\ 0\"\n and WT_gpv: \"\\ \\g gpv \\\"\n and WT_callee: \"\\s. \\ \\c callee s \\\"\n shows \"spmf (map_spmf (bad \\ snd) (exec_gpv callee gpv s)) True \\ ennreal k * n\"\nusing bound good bad WT_gpv\nproof(induction arbitrary: gpv s n rule: exec_gpv_fixp_induct)\n case adm show ?case by(rule cont_intro ccpo_class.admissible_leI)+\n case bottom show ?case using k_nonneg by(simp add: zero_ereal_def[symmetric])\nnext\n case (step exec_gpv')\n let ?M = \"restrict_space (measure_spmf (the_gpv gpv)) {IO out c|out c. True}\"\n have \"ennreal (spmf (map_spmf (bad \\ snd) (bind_spmf (the_gpv gpv) (case_generat (\\x. return_spmf (x, s)) (\\out c. bind_spmf (callee s out) (\\(x, y). exec_gpv' (c x) y))))) True) =\n ennreal (spmf (bind_spmf (the_gpv gpv) (\\generat. case generat of Pure x \\ return_spmf (bad s) |\n IO out rpv \\ bind_spmf (callee s out) (\\(x, s'). map_spmf (bad \\ snd) (exec_gpv' (rpv x) s')))) True)\"\n (is \"_ = ennreal (spmf (bind_spmf _ (case_generat _ ?io)) _)\")\n by(simp add: map_spmf_bind_spmf o_def generat.case_distrib[where h=\"map_spmf _\"] split_def cong del: generat.case_cong_weak)\n also have \"\\ = \\\\<^sup>+ generat. \\\\<^sup>+ (x, s'). spmf (map_spmf (bad \\ snd) (exec_gpv' (continuation generat x) s')) True \\measure_spmf (callee s (output generat)) \\?M\"\n using step.prems(2) by(auto simp add: ennreal_spmf_bind nn_integral_restrict_space intro!: nn_integral_cong split: generat.split)\n also have \"\\ \\ \\\\<^sup>+ generat. \\\\<^sup>+ (x, s'). (if bad s' then 1 else ennreal k * (if consider (output generat) then n - 1 else n)) \\measure_spmf (callee s (output generat)) \\?M\"\n proof(clarsimp intro!: nn_integral_mono_AE simp add: AE_restrict_space_iff split del: if_split cong del: if_cong)\n show \"ennreal (spmf (map_spmf (bad \\ snd) (exec_gpv' (rpv ret) s')) True)\n \\ (if bad s' then 1 else ennreal k * ennreal_of_enat (if consider out then n - 1 else n))\"\n if IO: \"IO out rpv \\ set_spmf (the_gpv gpv)\"\n and call: \"(ret, s') \\ set_spmf (callee s out)\"\n for out rpv ret s'\n proof(cases \"bad s'\")\n case True\n then show ?thesis by(simp add: pmf_le_1)\n next\n case False\n let ?n' = \"if consider out then n - 1 else n\"\n have out: \"out \\ outs_\\ \\\" using IO step.prems(4) by(simp add: WT_gpv_OutD)\n have bound': \"interaction_bounded_by consider (rpv ret) ?n'\"\n using interaction_bounded_by_contD[OF step.prems(1) IO]\n interaction_bounded_by_contD_ignore[OF step.prems(1) IO] by(auto)\n have \"ret \\ responses_\\ \\ out\" using WT_callee call out by(rule WT_calleeD)\n with step.prems(4) IO have WT': \"\\ \\g rpv ret \\\" by(rule WT_gpv_ContD)\n have bad': \"spmf (map_pmf (map_option (bad \\ snd)) (callee s'' x)) True \\ k\"\n if \"\\ bad s''\" and count': \"count s'' < ?n' + count s'\" and \"consider x\" and \"x \\ outs_\\ \\\"\n for s'' x using \\\\ bad s''\\ _ \\consider x\\ \\x \\ outs_\\ \\\\\n proof(rule step.prems)\n show \"count s'' < n + count s\"\n proof(cases \"consider out\")\n case True\n with count[OF call True out] count' interaction_bounded_by_contD[OF step.prems(1) IO, of undefined]\n show ?thesis by(cases n)(auto simp add: one_enat_def)\n next\n case False\n with ignore[OF call _ out] count' show ?thesis by(cases n)auto\n qed\n qed\n from step.IH[OF bound' False this] False WT' show ?thesis by(auto simp add: o_def)\n qed\n qed\n also have \"\\ = \\\\<^sup>+ generat. \\\\<^sup>+ b. indicator {True} b + ennreal k * (if consider (output generat) then n - 1 else n) * indicator {False} b \\measure_spmf (map_spmf (bad \\ snd) (callee s (output generat))) \\?M\"\n (is \"_ = \\\\<^sup>+ generat. \\\\<^sup>+ _. _ \\?O' generat \\_\")\n by(auto intro!: nn_integral_cong)\n also have \"\\ = \\\\<^sup>+ generat. (\\\\<^sup>+ b. indicator {True} b \\?O' generat) + ennreal k * (if consider (output generat) then n - 1 else n) * \\\\<^sup>+ b. indicator {False} b \\?O' generat \\?M\"\n by(subst nn_integral_add)(simp_all add: k_nonneg nn_integral_cmult o_def)\n also have \"\\ = \\\\<^sup>+ generat. ennreal (spmf (map_spmf (bad \\ snd) (callee s (output generat))) True) + ennreal k * (if consider (output generat) then n - 1 else n) * spmf (map_spmf (bad \\ snd) (callee s (output generat))) False \\?M\"\n by(simp del: nn_integral_map_spmf add: emeasure_spmf_single ereal_of_enat_mult)\n also have \"\\ \\ \\\\<^sup>+ generat. ennreal k * n \\?M\"\n proof(intro nn_integral_mono_AE, clarsimp intro!: nn_integral_mono_AE simp add: AE_restrict_space_iff not_is_Pure_conv split del: if_split)\n fix out c\n assume IO: \"IO out c \\ set_spmf (the_gpv gpv)\"\n with step.prems(4) have out: \"out \\ outs_\\ \\\" by(rule WT_gpv_OutD)\n show \"spmf (map_spmf (bad \\ snd) (callee s out)) True +\n ennreal k * (if consider out then n - 1 else n) * spmf (map_spmf (bad \\ snd) (callee s out)) False\n \\ ennreal k * n\"\n proof(cases \"consider out\")\n case True\n with IO have \"n > 0\" using interaction_bounded_by_contD[OF step.prems(1)] by(blast dest: interaction_bounded_by_contD)\n have \"spmf (map_spmf (bad \\ snd) (callee s out)) True \\ k\" (is \"?o True \\ _\")\n using \\\\ bad s\\ True \\n > 0\\ out by(intro step.prems)(simp)\n hence \"ennreal (?o True) \\ k\" using k_nonneg by(simp del: o_apply)\n hence \"?o True + ennreal k * (n - 1) * ?o False \\ ennreal k + ennreal k * (n - 1) * ennreal 1\"\n by(rule add_mono)(rule mult_left_mono, simp_all add: pmf_le_1 k_nonneg)\n also have \"\\ \\ ennreal k * n\" using \\n > 0\\\n by(cases n)(auto simp add: zero_enat_def ennreal_top_mult gr0_conv_Suc eSuc_enat[symmetric] field_simps)\n finally show ?thesis using True by(simp del: o_apply add: ereal_of_enat_mult)\n next\n case False\n hence \"spmf (map_spmf (bad \\ snd) (callee s out)) True = 0\" using \\\\ bad s\\ out\n unfolding spmf_eq_0_set_spmf by(auto dest: \"consider\")\n with False k_nonneg pmf_le_1[of \"map_spmf (bad \\ snd) (callee s out)\" \"Some False\"]\n show ?thesis by(simp add: mult_left_mono[THEN order_trans, where ?b1=1])\n qed\n qed\n also have \"\\ \\ ennreal k * n\"\n by(simp add: k_nonneg emeasure_restrict_space measure_spmf.emeasure_eq_measure space_restrict_space measure_spmf.subprob_measure_le_1 mult_left_mono[THEN order_trans, where ?b1=1])\n finally show ?case by(simp del: o_apply)\nqed\n\ncontext callee_invariant_on begin\n\nlemma interaction_bounded_by_exec_gpv_bad_count:\n includes lifting_syntax\n fixes count and bad and n :: enat\n assumes bound: \"interaction_bounded_by consider gpv n\"\n and I: \"I s\"\n and good: \"\\ bad s\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; consider x; x \\ outs_\\ \\ \\ \\ count s' \\ Suc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and bad: \"\\s' x. \\ I s'; \\ bad s'; count s' < n + count s; consider x; x \\ outs_\\ \\ \\ \\ spmf (map_spmf (bad \\ snd) (callee s' x)) True \\ k\"\n and \"consider\": \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ bad s; bad s'; x \\ outs_\\ \\ \\ \\ consider x\"\n and k_nonneg: \"k \\ 0\"\n and WT_gpv: \"\\ \\g gpv \\\"\n shows \"spmf (map_spmf (bad \\ snd) (exec_gpv callee gpv s)) True \\ ennreal k * n\"\nproof -\n { assume \"\\(Rep :: 's' \\ 's) Abs. type_definition Rep Abs {s. I s}\"\n then obtain Rep :: \"'s' \\ 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n then interpret td: type_definition Rep Abs \"{s. I s}\" .\n define cr where \"cr \\ \\x y. x = Rep y\"\n have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n \n let ?C = \"eq_onp (\\x. x \\ outs_\\ \\)\"\n\n define callee' where \"callee' \\ (Rep ---> id ---> map_spmf (map_prod id Abs)) callee\"\n have [transfer_rule]: \"(cr ===> ?C ===> rel_spmf (rel_prod (=) cr)) callee callee'\"\n by(auto simp add: callee'_def rel_fun_def cr_def spmf_rel_map prod.rel_map td.Abs_inverse eq_onp_def intro!: rel_spmf_reflI intro: td.Rep[simplified] dest: callee_invariant)\n define s' where \"s' \\ Abs s\"\n have [transfer_rule]: \"cr s s'\" using I by(simp add: cr_def s'_def td.Abs_inverse)\n define bad' where \"bad' \\ (Rep ---> id) bad\"\n have [transfer_rule]: \"(cr ===> (=)) bad bad'\" by(simp add: rel_fun_def bad'_def cr_def)\n define count' where \"count' \\ (Rep ---> id) count\"\n have [transfer_rule]: \"(cr ===> (=)) count count'\" by(simp add: rel_fun_def count'_def cr_def)\n\n have [transfer_rule]: \"(?C ===> (=)) consider consider\" by(simp add: eq_onp_def rel_fun_def)\n have [transfer_rule]: \"rel_\\ ?C (=) \\ \\\"\n by(rule rel_\\I)(auto simp add: rel_set_eq set_relator_eq_onp eq_onp_same_args dest: eq_onp_to_eq)\n note [transfer_rule] = bi_unique_eq_onp bi_unique_eq\n\n define gpv' where \"gpv' \\ restrict_gpv \\ gpv\"\n have [transfer_rule]: \"rel_gpv (=) ?C gpv' gpv'\"\n by(fold eq_onp_top_eq_eq)(auto simp add: gpv.rel_eq_onp eq_onp_same_args pred_gpv_def gpv'_def dest: in_outs'_restrict_gpvD)\n\n have \"interaction_bounded_by consider gpv' n\" using bound by(simp add: gpv'_def)\n moreover have \"\\ bad' s'\" using good by transfer\n moreover have [rule_format, rotated]:\n \"\\s y s'. \\x \\ outs_\\ \\. (y, s') \\ set_spmf (callee' s x) \\ consider x \\ count' s' \\ Suc (count' s)\"\n by(transfer fixing: \"consider\")(blast intro: count)\n moreover have [rule_format, rotated]:\n \"\\s y s'. \\x \\ outs_\\ \\. (y, s') \\ set_spmf (callee' s x) \\ \\ consider x \\ count' s' \\ count' s\"\n by(transfer fixing: \"consider\")(blast intro: ignore)\n moreover have [rule_format, rotated]: \n \"\\s''. \\x \\ outs_\\ \\. \\ bad' s'' \\ count' s'' < n + count' s' \\ consider x \\ spmf (map_spmf (bad' \\ snd) (callee' s'' x)) True \\ k\"\n by(transfer fixing: \"consider\" k n)(blast intro: bad)\n moreover have [rule_format, rotated]: \n \"\\s y s'. \\x \\ outs_\\ \\. (y, s') \\ set_spmf (callee' s x) \\ \\ bad' s \\ bad' s' \\ consider x\"\n by(transfer fixing: \"consider\")(blast intro: \"consider\")\n moreover note k_nonneg\n moreover have \"\\ \\g gpv' \\\" by(simp add: gpv'_def)\n moreover have \"\\s. \\ \\c callee' s \\\" by transfer(rule WT_callee)\n ultimately have **: \"spmf (map_spmf (bad' \\ snd) (exec_gpv callee' gpv' s')) True \\ ennreal k * n\"\n by(rule interaction_bounded_by_exec_gpv_bad_count)\n have [transfer_rule]: \"((=) ===> ?C ===> rel_spmf (rel_prod (=) (=))) callee callee\"\n by(simp add: rel_fun_def eq_onp_def prod.rel_eq)\n have \"spmf (map_spmf (bad \\ snd) (exec_gpv callee gpv' s)) True \\ ennreal k * n\" using **\n by(transfer)\n also have \"exec_gpv callee gpv' s = exec_gpv callee gpv s\"\n unfolding gpv'_def using WT_gpv I by(rule exec_gpv_restrict_gpv_invariant)\n finally have ?thesis . }\n from this[cancel_type_definition] I show ?thesis by blast\nqed\n\nlemma interaction_bounded_by'_exec_gpv_bad_count:\n fixes count and bad and n :: nat\n assumes bound: \"interaction_bounded_by' consider gpv n\"\n and I: \"I s\"\n and good: \"\\ bad s\"\n and count: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; consider x; x \\ outs_\\ \\ \\ \\ count s' \\ Suc (count s)\"\n and ignore: \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ consider x; x \\ outs_\\ \\ \\ \\ count s' \\ count s\"\n and bad: \"\\s' x. \\ I s'; \\ bad s'; count s' < n + count s; consider x; x \\ outs_\\ \\ \\ \\ spmf (map_spmf (bad \\ snd) (callee s' x)) True \\ k\"\n and \"consider\": \"\\s x y s'. \\ (y, s') \\ set_spmf (callee s x); I s; \\ bad s; bad s'; x \\ outs_\\ \\ \\ \\ consider x\"\n and k_nonneg: \"k \\ 0\"\n and WT_gpv: \"\\ \\g gpv \\\"\n shows \"spmf (map_spmf (bad \\ snd) (exec_gpv callee gpv s)) True \\ k * n\"\napply(subst ennreal_le_iff[symmetric], simp_all add: k_nonneg ennreal_mult ennreal_real_conv_ennreal_of_enat del: ennreal_of_enat_enat ennreal_le_iff)\napply(rule interaction_bounded_by_exec_gpv_bad_count[OF bound I _ count ignore bad \"consider\" k_nonneg WT_gpv, OF good])\napply simp_all\ndone\n\nlemma interaction_bounded_by_exec_gpv_bad:\n assumes \"interaction_any_bounded_by gpv n\"\n and \"I s\" \"\\ bad s\"\n and bad: \"\\s x. \\ I s; \\ bad s; x \\ outs_\\ \\ \\ \\ spmf (map_spmf (bad \\ snd) (callee s x)) True \\ k\"\n and k_nonneg: \"0 \\ k\"\n and WT_gpv: \"\\ \\g gpv \\\"\n shows \"spmf (map_spmf (bad \\ snd) (exec_gpv callee gpv s)) True \\ k * n\"\nusing interaction_bounded_by_exec_gpv_bad_count[where bad=bad, OF assms(1) assms(2-3), where ?count = \"\\_. 0\", OF _ _ bad _ k_nonneg] k_nonneg WT_gpv\nby(simp add: ennreal_real_conv_ennreal_of_enat[symmetric] ennreal_mult[symmetric] del: ennreal_of_enat_enat)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CryptHOL/Generative_Probabilistic_Value.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.29644496632486816}} {"text": "theory ArityAnalysisAbinds\nimports ArityAnalysisSig\nbegin\n\ncontext ArityAnalysis\nbegin\n\nsubsubsection {* Lifting arity analysis to recursive groups *}\n\ndefinition ABind :: \"var \\ exp \\ (AEnv \\ AEnv)\"\n where \"ABind v e = (\\ ae. fup\\(Aexp e)\\(ae v))\"\n\nlemma ABind_eq[simp]: \"ABind v e \\ ae = \\\\<^sup>\\\\<^bsub>ae v\\<^esub> e\"\n unfolding ABind_def by (simp add: cont_fun)\n\nfun ABinds :: \"heap \\ (AEnv \\ AEnv)\"\n where \"ABinds [] = \\\"\n | \"ABinds ((v,e)#binds) = ABind v e \\ ABinds (delete v binds)\"\n\nlemma ABinds_strict[simp]: \"ABinds \\\\\\=\\\"\n by (induct \\ rule: ABinds.induct) auto\n\nlemma Abinds_reorder1: \"map_of \\ v = Some e \\ ABinds \\ = ABind v e \\ ABinds (delete v \\)\"\n by (induction \\ rule: ABinds.induct) (auto simp add: delete_twist)\n\nlemma ABind_below_ABinds: \"map_of \\ v = Some e \\ ABind v e \\ ABinds \\\"\n by (metis \"HOLCF-Join-Classes.join_above1\" ArityAnalysis.Abinds_reorder1)\n\nlemma Abinds_reorder: \"map_of \\ = map_of \\ \\ ABinds \\ = ABinds \\\"\nproof (induction \\ arbitrary: \\ rule: ABinds.induct)\n case 1 thus ?case by simp\nnext\n case (2 v e \\ \\)\n from `map_of ((v, e) # \\) = map_of \\`\n have \"(map_of ((v, e) # \\))(v := None) = (map_of \\)(v := None)\" by simp\n hence \"map_of (delete v \\) = map_of (delete v \\)\" unfolding delete_set_none by simp\n hence \"ABinds (delete v \\) = ABinds (delete v \\)\" by (rule 2)\n moreover\n from `map_of ((v, e) # \\) = map_of \\`\n have \"map_of \\ v = Some e\" by (metis map_of_Cons_code(2))\n hence \"ABinds \\ = ABind v e \\ ABinds (delete v \\)\" by (rule Abinds_reorder1)\n ultimately\n show ?case by auto\nqed\n\n(*\nlemma ABinds_above_arg: \"ae \\ ABinds \\ \\ ae\"\nproof (induction rule:ABinds.induct)\n show \"\\ \\ ABinds []\\ae\" by auto\nnext\n fix v e \\\n assume assm: \"ae \\ ABinds (delete v \\)\\ae\"\n also have \"\\ \\ ABinds ((v, e) # \\)\\ae\" by auto\n finally show \"ae \\ ABinds ((v, e) # \\)\\ae\" by this simp\nqed\n*)\n\nlemma Abinds_env_cong: \"(\\ x. x\\domA \\ \\ ae x = ae' x) \\ ABinds \\\\ae = ABinds \\\\ae'\"\n by (induct \\ rule: ABinds.induct) auto\n\nlemma Abinds_env_restr_cong: \" ae f|` domA \\ = ae' f|` domA \\ \\ ABinds \\\\ae = ABinds \\\\ae'\"\n by (rule Abinds_env_cong) (metis env_restr_eqD)\n\nlemma ABinds_env_restr[simp]: \"ABinds \\\\(ae f|` domA \\) = ABinds \\\\ae\"\n by (rule Abinds_env_restr_cong) simp\n\nlemma Abinds_join_fresh: \"ae' ` (domA \\) \\ {\\} \\ ABinds \\\\(ae \\ ae') = (ABinds \\\\ae)\"\n by (rule Abinds_env_cong) auto\n\nlemma ABinds_delete_bot: \"ae x = \\ \\ ABinds (delete x \\)\\ae = ABinds \\\\ae\"\n by (induction \\ rule: ABinds.induct) (auto simp add: delete_twist)\n\nlemma ABinds_restr_fresh:\n assumes \"atom ` S \\* \\\"\n shows \"ABinds \\\\ae f|` (- S) = ABinds \\\\(ae f|` (- S)) f|` (- S)\"\n using assms\n apply (induction \\ rule:ABinds.induct)\n apply simp\n apply (auto simp del: fun_meet_simp simp add: env_restr_join fresh_star_Pair fresh_star_Cons fresh_star_delete)\n apply (subst lookup_env_restr)\n apply (metis (no_types, hide_lams) ComplI fresh_at_base(2) fresh_star_def imageI)\n apply simp\n done\n\nlemma ABinds_restr:\n assumes \"domA \\ \\ S\"\n shows \"ABinds \\\\ae f|` S = ABinds \\\\(ae f|` S) f|` S\"\n using assms\n by (induction \\ rule:ABinds.induct) (fastforce simp del: fun_meet_simp simp add: env_restr_join)+\n\nlemma ABinds_restr_subst:\n assumes \"\\ x' e a. (x',e) \\ set \\ \\ Aexp e[x::=y]\\a f|` S = Aexp e\\a f|` S\"\n assumes \"x \\ S\"\n assumes \"y \\ S\"\n assumes \"domA \\ \\ S\"\n shows \"ABinds \\[x::h=y]\\ae f|` S = ABinds \\\\(ae f|` S) f|` S\"\n using assms\n apply (induction \\ rule:ABinds.induct)\n apply (auto simp del: fun_meet_simp join_comm simp add: env_restr_join)\n apply (rule arg_cong2[where f = join])\n apply (case_tac \"ae v\")\n apply (auto dest: set_mp[OF set_delete_subset])\n done\n\nlemma Abinds_append_disjoint: \"domA \\ \\ domA \\ = {} \\ ABinds (\\ @ \\)\\ae = ABinds \\\\ae \\ ABinds \\\\ae\"\nproof (induct \\ rule: ABinds.induct)\n case 1 thus ?case by simp\nnext\n case (2 v e \\)\n from 2(2)\n have \"v \\ domA \\\" and \"domA (delete v \\) \\ domA \\ = {}\" by auto\n from 2(1)[OF this(2)]\n have \"ABinds (delete v \\ @ \\)\\ae = ABinds (delete v \\)\\ae \\ ABinds \\\\ae\".\n moreover\n have \"delete v \\ = \\\" by (metis `v \\ domA \\` delete_not_domA)\n ultimately\n show \" ABinds (((v, e) # \\) @ \\)\\ae = ABinds ((v, e) # \\)\\ae \\ ABinds \\\\ae\"\n by auto\nqed\n\nlemma ABinds_restr_subset: \"S \\ S' \\ ABinds (restrictA S \\)\\ae \\ ABinds (restrictA S' \\)\\ae\"\n by (induct \\ rule: ABinds.induct)\n (auto simp add: join_below_iff restr_delete_twist intro: below_trans[OF _ join_above2])\n\nlemma ABinds_restrict_edom: \"ABinds (restrictA (edom ae) \\)\\ae = ABinds \\\\ae\"\n by (induct \\ rule: ABinds.induct) (auto simp add: edom_def restr_delete_twist)\n \nlemma ABinds_restrict_below: \"ABinds (restrictA S \\)\\ae \\ ABinds \\\\ae\"\n by (induct \\ rule: ABinds.induct)\n (auto simp add: join_below_iff restr_delete_twist intro: below_trans[OF _ join_above2] simp del: fun_meet_simp join_comm)\n\nlemma ABinds_delete_below: \"ABinds (delete x \\)\\ae \\ ABinds \\\\ae\"\n by (induct \\ rule: ABinds.induct)\n (auto simp add: join_below_iff delete_twist[where x = x] elim: below_trans simp del: fun_meet_simp)\nend\n\nlemma ABind_eqvt[eqvt]: \"\\ \\ (ArityAnalysis.ABind Aexp v e) = ArityAnalysis.ABind (\\ \\ Aexp) (\\ \\ v) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding ArityAnalysis.ABind_eq\n by perm_simp rule\n\nlemma ABinds_eqvt[eqvt]: \"\\ \\ (ArityAnalysis.ABinds Aexp \\) = ArityAnalysis.ABinds (\\ \\ Aexp) (\\ \\ \\)\"\n apply (rule cfun_eqvtI)\n apply (induction \\ rule: ArityAnalysis.ABinds.induct)\n apply (simp add: ArityAnalysis.ABinds.simps)\n apply (simp add: ArityAnalysis.ABinds.simps)\n apply perm_simp\n apply simp\n done\n\nlemma Abinds_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ aexp1 e = aexp2 e) ; heap1 = heap2 \\\n \\ ArityAnalysis.ABinds aexp1 heap1 = ArityAnalysis.ABinds aexp2 heap2\" \nproof (induction heap1 arbitrary:heap2 rule:ArityAnalysis.ABinds.induct)\n case 1\n thus ?case by (auto simp add: ArityAnalysis.ABinds.simps)\nnext\n case prems: (2 v e as heap2)\n have \"snd ` set (delete v as) \\ snd ` set as\" by (rule dom_delete_subset)\n also have \"\\ \\ snd `set ((v, e) # as)\" by auto\n also note prems(3)\n finally\n have \"(\\e. e \\ snd ` set (delete v as) \\ aexp1 e = aexp2 e)\" by -(rule prems, auto)\n from prems prems(1)[OF this refl] show ?case\n by (auto simp add: ArityAnalysis.ABinds.simps ArityAnalysis.ABind_def)\nqed\n\ncontext EdomArityAnalysis\nbegin\n lemma fup_Aexp_lookup_fresh: \"atom v \\ e \\ (fup\\(Aexp e)\\a) v = \\\"\n by (cases a) auto\n \n lemma edom_AnalBinds: \"edom (ABinds \\\\ae) \\ fv \\\"\n by (induction \\ rule: ABinds.induct)\n (auto simp del: fun_meet_simp dest: set_mp[OF fup_Aexp_edom] dest: set_mp[OF fv_delete_subset])\nend \n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/ArityAnalysisAbinds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2964449579727892}} {"text": "header {* \\isaheader{Generic Map Algorithms} *}\ntheory Gen_Map\nimports \"../Intf/Intf_Map\" \"../../Iterator/Iterator\"\nbegin\n lemma map_to_set_distinct_conv:\n assumes \"distinct tsl'\" and \"map_to_set m' = set tsl'\"\n shows \"distinct (map fst tsl')\"\n apply (rule ccontr)\n apply (drule not_distinct_decomp)\n using assms\n apply (clarsimp elim!: map_eq_concE)\n by (metis (hide_lams, no_types) insert_iff map_to_set_inj)\n\n\n (* TODO: Make foldli explicit, such that it is seen by \n iterator-optimizations! cf Gen_Set for how to do this! *)\n lemma foldli_add: \"det_fold_map X \n (\\_. True) (\\(k,v) m. op_map_update k v m) m (op ++ m)\"\n proof\n case (goal1 l) thus ?case\n apply (induct l arbitrary: m) \n apply (auto simp: map_of_distinct_upd[symmetric])\n done\n qed\n\n definition gen_add\n :: \"('s2 \\ _) \\ ('k \\ 'v \\ 's1 \\ 's1) \\ 's1 \\ 's2 \\ 's1\"\n where \n \"gen_add it upd A B \\ it B (\\_. True) (\\(k,v) m. upd k v m) A\"\n\n lemma gen_add[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes UPD: \"GEN_OP ins op_map_update (Rk\\Rv\\\\Rk,Rv\\Rs1\\\\Rk,Rv\\Rs1)\"\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rs2 tsl)\"\n shows \"(gen_add (foldli o tsl) ins,op ++) \n \\ (\\Rk,Rv\\Rs1) \\ (\\Rk,Rv\\Rs2) \\ (\\Rk,Rv\\Rs1)\"\n apply (intro fun_relI)\n unfolding gen_add_def comp_def\n apply (rule det_fold_map[OF foldli_add IT[unfolded autoref_tag_defs]])\n apply (parametricity add: UPD[unfolded autoref_tag_defs])+\n done\n\n lemma foldli_restrict: \"det_fold_map X (\\_. True) \n (\\(k,v) m. if P (k,v) then op_map_update k v m else m) Map.empty\n (op_map_restrict P )\" (is \"det_fold_map _ _ ?f _ _\")\n proof -\n {\n fix l m\n have \"distinct (map fst l) \\\n foldli l (\\_. True) ?f m = m ++ op_map_restrict P (map_of l)\"\n proof (induction l arbitrary: m) \n case Nil thus ?case by simp\n next\n case (Cons kv l)\n obtain k v where [simp]: \"kv = (k,v)\" by fastforce\n from Cons.prems have \n DL: \"distinct (map fst l)\" and KNI: \"k \\ set (map fst l)\" \n by auto\n\n show ?case proof (cases \"P (k,v)\")\n case True[simp] \n have \"foldli (kv#l) (\\_. True) ?f m = foldli l (\\_. True) ?f (m(k\\v))\"\n by simp\n also from Cons.IH[OF DL] have \n \"\\ = m(k\\v) ++ op_map_restrict P (map_of l)\" .\n also have \"\\ = m ++ op_map_restrict P (map_of (kv#l))\"\n using KNI\n by (auto\n split: option.splits\n intro!: ext \n simp: Map.restrict_map_def Map.map_add_def\n simp: map_of_eq_None_iff[symmetric])\n finally show ?thesis .\n next\n case False[simp] \n have \"foldli (kv#l) (\\_. True) ?f m = foldli l (\\_. True) ?f m\"\n by simp\n also from Cons.IH[OF DL] have \n \"\\ = m ++ op_map_restrict P (map_of l)\" .\n also have \"\\ = m ++ op_map_restrict P (map_of (kv#l))\"\n using KNI\n by (auto \n intro!: ext\n simp: Map.restrict_map_def Map.map_add_def\n simp: map_of_eq_None_iff[symmetric]\n )\n finally show ?thesis .\n qed\n qed\n } \n from this[of _ Map.empty] show ?thesis\n by (auto intro!: det_fold_mapI)\n qed\n\n definition gen_restrict :: \"('s1 \\ _) \\ _\"\n where \"gen_restrict it upd emp P m \n \\ it m (\\_. True) (\\(k,v) m. if P (k,v) then upd k v m else m) emp\"\n\n lemma gen_restrict[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rs1 tsl)\"\n assumes INS: \n \"GEN_OP upd op_map_update (Rk\\Rv\\\\Rk,Rv\\Rs2\\\\Rk,Rv\\Rs2)\"\n assumes EMPTY: \n \"GEN_OP emp Map.empty (\\Rk,Rv\\Rs2)\"\n shows \"(gen_restrict (foldli o tsl) upd emp,op_map_restrict) \n \\ (\\Rk,Rv\\prod_rel \\ Id) \\ (\\Rk,Rv\\Rs1) \\ (\\Rk,Rv\\Rs2)\"\n apply (intro fun_relI)\n unfolding gen_restrict_def comp_def\n apply (rule det_fold_map[OF foldli_restrict IT[unfolded autoref_tag_defs]])\n using INS EMPTY unfolding autoref_tag_defs\n apply (parametricity)+\n done\n\n lemma fold_map_of: \n \"fold (\\(k,v) s. op_map_update k v s) (rev l) Map.empty = map_of l\"\n proof -\n {\n fix m\n have \"fold (\\(k,v) s. s(k\\v)) (rev l) m = m ++ map_of l\"\n apply (induct l arbitrary: m)\n apply auto\n done\n } thus ?thesis by simp\n qed\n\n definition gen_map_of :: \"'m \\ ('k\\'v\\'m\\'m) \\ _\" where \n \"gen_map_of emp upd l \\ fold (\\(k,v) s. upd k v s) (rev l) emp\"\n\n\n lemma gen_map_of[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes UPD: \"GEN_OP upd op_map_update (Rk\\Rv\\\\Rk,Rv\\Rm\\\\Rk,Rv\\Rm)\"\n assumes EMPTY: \"GEN_OP emp Map.empty (\\Rk,Rv\\Rm)\"\n shows \"(gen_map_of emp upd,map_of) \\ \\\\Rk,Rv\\prod_rel\\list_rel \\ \\Rk,Rv\\Rm\"\n using assms\n apply (intro fun_relI)\n unfolding gen_map_of_def[abs_def]\n unfolding autoref_tag_defs\n apply (subst fold_map_of[symmetric])\n apply parametricity\n done\n\n lemma foldli_ball_aux: \n \"distinct (map fst l) \\ foldli l (\\x. x) (\\x _. P x) b \n \\ b \\ op_map_ball (map_of l) P\"\n apply (induct l arbitrary: b)\n apply simp\n apply (force simp: map_to_set_map_of image_def)\n done\n \n lemma foldli_ball: \n \"det_fold_map X (\\x. x) (\\x _. P x) True (\\m. op_map_ball m P)\"\n apply rule\n using foldli_ball_aux[where b=True] by auto\n \n definition gen_ball :: \"('m \\ _) \\ _\" where\n \"gen_ball it m P \\ it m (\\x. x) (\\x _. P x) True\"\n\n lemma gen_ball[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_ball (foldli o tsl),op_map_ball) \n \\ \\Rk,Rv\\Rm \\ (\\Rk,Rv\\prod_rel \\ Id) \\ Id\"\n apply (intro fun_relI)\n unfolding gen_ball_def comp_def\n apply (rule det_fold_map[OF foldli_ball IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n\n lemma foldli_bex_aux: \n \"distinct (map fst l) \\ foldli l (\\x. \\x) (\\x _. P x) b \n \\ b \\ op_map_bex (map_of l) P\"\n apply (induct l arbitrary: b)\n apply simp\n apply (force simp: map_to_set_map_of image_def)\n done\n \n lemma foldli_bex: \n \"det_fold_map X (\\x. \\x) (\\x _. P x) False (\\m. op_map_bex m P)\"\n apply rule\n using foldli_bex_aux[where b=False] by auto\n\n definition gen_bex :: \"('m \\ _) \\ _\" where\n \"gen_bex it m P \\ it m (\\x. \\x) (\\x _. P x) False\"\n\n lemma gen_bex[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_bex (foldli o tsl),op_map_bex) \n \\ \\Rk,Rv\\Rm \\ (\\Rk,Rv\\prod_rel \\ Id) \\ Id\"\n apply (intro fun_relI)\n unfolding gen_bex_def comp_def\n apply (rule det_fold_map[OF foldli_bex IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n\n lemma ball_isEmpty: \"op_map_isEmpty m = op_map_ball m (\\_. False)\"\n apply (auto intro!: ext)\n by (metis map_to_set_simps(7) option.exhaust)\n\n definition \"gen_isEmpty ball m \\ ball m (\\_. False)\"\n\n lemma gen_isEmpty[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes BALL: \n \"GEN_OP ball op_map_ball (\\Rk,Rv\\Rm\\(\\Rk,Rv\\prod_rel\\Id) \\ Id)\"\n shows \"(gen_isEmpty ball,op_map_isEmpty) \n \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_isEmpty_def using assms\n unfolding autoref_tag_defs\n apply -\n apply (subst ball_isEmpty)\n apply parametricity+\n done\n \n lemma foldli_size_aux: \"distinct (map fst l) \n \\ foldli l (\\_. True) (\\_ n. Suc n) n = n + op_map_size (map_of l)\"\n apply (induct l arbitrary: n)\n apply (auto simp: dom_map_of_conv_image_fst)\n done\n\n lemma foldli_size: \"det_fold_map X (\\_. True) (\\_ n. Suc n) 0 op_map_size\"\n apply rule\n using foldli_size_aux[where n=0] by simp\n\n definition gen_size :: \"('m \\ _) \\ _\"\n where \"gen_size it m \\ it m (\\_. True) (\\_ n. Suc n) 0\"\n\n lemma gen_size[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_size (foldli o tsl),op_map_size) \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_size_def comp_def\n apply (rule det_fold_map[OF foldli_size IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n \n lemma foldli_size_abort_aux:\n \"\\n0\\m; distinct (map fst l)\\ \\ \n foldli l (\\n. n_ n. Suc n) n0 = min m (n0 + card (dom (map_of l)))\"\n apply (induct l arbitrary: n0)\n apply (auto simp: dom_map_of_conv_image_fst)\n done\n\n lemma foldli_size_abort: \n \"det_fold_map X (\\n. n_ n. Suc n) 0 (op_map_size_abort m)\"\n apply rule\n using foldli_size_abort_aux[where ?n0.0=0]\n by simp\n\n definition gen_size_abort :: \"('s \\ _) \\ _\" where\n \"gen_size_abort it m s \\ it s (\\n. n_ n. Suc n) 0\"\n\n lemma gen_size_abort[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_size_abort (foldli o tsl),op_map_size_abort) \n \\ Id \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_size_abort_def comp_def\n apply (rule det_fold_map[OF foldli_size_abort \n IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n \n lemma size_abort_isSng: \"op_map_isSng s \\ op_map_size_abort 2 s = 1\"\n by (auto simp: dom_eq_singleton_conv min_def dest!: card_eq_SucD)\n\n definition gen_isSng :: \"(nat \\ 's \\ nat) \\ _\" where\n \"gen_isSng sizea s \\ sizea 2 s = 1\"\n\n lemma gen_isSng[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes \"GEN_OP sizea op_map_size_abort (Id \\ (\\Rk,Rv\\Rm) \\ Id)\"\n shows \"(gen_isSng sizea,op_map_isSng) \n \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_isSng_def using assms\n unfolding autoref_tag_defs\n apply -\n apply (subst size_abort_isSng)\n apply parametricity\n done\n\n\n (* TODO: Also do sel! *)\n\n lemma foldli_pick:\n assumes \"l\\[]\" \n obtains k v where \"(k,v)\\set l\" \n and \"(foldli l (case_option True (\\_. False)) (\\x _. Some x) None) \n = Some (k,v)\"\n using assms by (cases l) auto\n\n definition gen_pick where\n \"gen_pick it s \\ \n (the (it s (case_option True (\\_. False)) (\\x _. Some x) None))\"\n\n\n\ncontext begin interpretation autoref_syn .\n\n lemma gen_pick[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm it)\"\n assumes SV: \"PREFER single_valued Rk\" \"PREFER single_valued Rv\"\n assumes NE: \"SIDE_PRECOND (m'\\Map.empty)\"\n assumes SREF: \"(m,m')\\\\Rk,Rv\\Rm\"\n shows \"(RETURN (gen_pick (\\x. foldli (it x)) m), \n (OP op_map_pick ::: \\Rk,Rv\\Rm\\\\Rk\\\\<^sub>rRv\\nres_rel)$m')\\\\Rk\\\\<^sub>rRv\\nres_rel\"\n proof -\n thm is_map_to_list_def is_map_to_sorted_listE\n\n obtain tsl' where\n [param]: \"(it m,tsl') \\ \\Rk\\\\<^sub>rRv\\list_rel\" \n and IT': \"RETURN tsl' \\ it_to_sorted_list (\\_ _. True) (map_to_set m')\"\n using IT[unfolded autoref_tag_defs is_map_to_list_def] SREF\n by (auto intro: is_map_to_sorted_listE)\n\n from IT' NE have \"tsl'\\[]\" and [simp]: \"m'=map_of tsl'\" \n and DIS': \"distinct (map fst tsl')\"\n unfolding it_to_sorted_list_def \n apply simp_all\n apply (metis empty_set map_to_set_empty_iff(1))\n apply (metis map_of_map_to_set map_to_set_distinct_conv)\n apply (metis map_to_set_distinct_conv)\n done\n\n then obtain k v where \"m' k = Some v\" and\n \"(foldli tsl' (case_option True (\\_. False)) (\\x _. Some x) None) \n = Some (k,v)\"\n (is \"?fld = _\")\n by (cases rule: foldli_pick) auto\n moreover \n have \"(RETURN (gen_pick (\\x. foldli (it x)) m), RETURN (the ?fld)) \n \\ \\Rk\\\\<^sub>rRv\\nres_rel\"\n unfolding gen_pick_def\n using SV[unfolded autoref_tag_defs]\n apply (parametricity add: the_paramR)\n apply tagged_solver\n using `?fld = Some (k,v)`\n by simp\n ultimately show ?thesis\n apply (simp add: nres_rel_def)\n apply (erule ref_two_step)\n by simp\n qed\nend\n\n\n definition \"gen_map_pick_remove pick del m \\ do {\n (k,v)\\pick m;\n let m = del k m;\n RETURN ((k,v),m)\n }\"\n \ncontext begin interpretation autoref_syn .\n lemma gen_map_pick_remove\n [unfolded gen_map_pick_remove_def, autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes SV: \n \"PREFER single_valued Rk\" \"PREFER single_valued Rv\"\n \"PREFER single_valued (\\Rk,Rv\\Rm)\"\n assumes PICK: \"SIDE_GEN_OP (\n (pick m, \n (OP op_map_pick ::: \\Rk,Rv\\Rm \\ \\Rk\\\\<^sub>rRv\\nres_rel)$m') \\\n \\Rk\\\\<^sub>rRv\\nres_rel)\"\n assumes DEL: \"GEN_OP del op_map_delete (Rk \\ \\Rk,Rv\\Rm \\ \\Rk,Rv\\Rm)\"\n assumes [param]: \"(m,m')\\\\Rk,Rv\\Rm\"\n shows \"(gen_map_pick_remove pick del m, \n (OP op_map_pick_remove \n ::: \\Rk,Rv\\Rm \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel)$m')\n \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel\"\n proof -\n note [param] = \n PICK[unfolded autoref_tag_defs] \n DEL[unfolded autoref_tag_defs]\n\n note [relator_props] = SV[unfolded autoref_tag_defs]\n\n have \"(gen_map_pick_remove pick del m, \n do { \n (k,v)\\op_map_pick m';\n let m' = op_map_delete k m';\n RETURN ((k,v),m')\n }) \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel\" (is \"(_,?h):_\")\n unfolding gen_map_pick_remove_def[abs_def]\n apply parametricity\n apply tagged_solver\n done\n also have \"?h = op_map_pick_remove m'\"\n by (auto simp add: pw_eq_iff refine_pw_simps)\n finally show ?thesis by simp\n qed\nend\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/GenCF/Gen/Gen_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621764862150636, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.29644495023666845}} {"text": "(*<*)\ntheory RCLogicL\n imports RCLogic WellformedL\nbegin\n (*>*)\n\nhide_const Syntax.dom\n\nchapter \\Refinement Constraint Logic Lemmas\\\n\nsection \\Lemmas\\\n\nlemma wfI_domi:\n assumes \"\\ ; \\ \\ i\"\n shows \"fst ` toSet \\ \\ dom i\"\n using wfI_def toSet.simps assms by fastforce\n\nlemma wfI_lookup:\n fixes G::\\ and b::b\n assumes \"Some (b,c) = lookup G x\" and \"P ; G \\ i\" and \"Some s = i x\" and \"P ; B \\\\<^sub>w\\<^sub>f G\"\n shows \"P \\ s : b\"\nproof -\n have \"(x,b,c) \\ toSet G\" using lookup.simps assms\n using lookup_in_g by blast\n then obtain s' where *:\"Some s' = i x \\ wfRCV P s' b\" using wfI_def assms by auto\n hence \"s' = s\" using assms by (metis option.inject)\n thus ?thesis using * by auto\nqed\n\nlemma wfI_restrict_weakening:\n assumes \"wfI \\ \\' i'\" and \"i = restrict_map i' (fst `toSet \\)\" and \"toSet \\ \\ toSet \\'\"\n shows \"\\ ; \\ \\ i\"\nproof -\n { fix x\n assume \"x \\ toSet \\\"\n have \"case x of (x, b, c) \\ \\s. Some s = i x \\ \\ \\ s : b\" using assms wfI_def\n proof -\n have \"case x of (x, b, c) \\ \\s. Some s = i' x \\ \\ \\ s : b\"\n using \\x \\ toSet \\\\ assms wfI_def by auto\n then have \"\\s. Some s = i (fst x) \\ wfRCV \\ s (fst (snd x))\"\n by (simp add: \\x \\ toSet \\\\ assms(2) case_prod_unfold)\n then show ?thesis\n by (simp add: case_prod_unfold)\n qed\n }\n thus ?thesis using wfI_def assms by auto\nqed\n\nlemma wfI_suffix:\n fixes G::\\\n assumes \"wfI P (G'@G) i\" and \"P ; B \\\\<^sub>w\\<^sub>f G\"\n shows \"P ; G \\ i\"\n using wfI_def append_g.simps assms toSet.simps by simp\n\nlemma wfI_replace_inside:\n assumes \"wfI \\ (\\' @ (x, b, c) #\\<^sub>\\ \\) i\"\n shows \"wfI \\ (\\' @ (x, b, c') #\\<^sub>\\ \\) i\"\n using wfI_def toSet_splitP assms by simp\n\nsection \\Existence of evaluation\\\n\nlemma eval_l_base:\n \"\\ \\ \\ l \\ : (base_for_lit l)\"\n apply(nominal_induct l rule:l.strong_induct)\n using wfRCV.intros eval_l.simps base_for_lit.simps by auto+\n\nlemma obtain_fresh_bv_dclist:\n fixes tm::\"'a::fs\"\n assumes \"(dc, \\ x : b | c \\) \\ set dclist\" \n obtains bv1::bv and dclist1 x1 b1 c1 where \"AF_typedef_poly tyid bv dclist = AF_typedef_poly tyid bv1 dclist1 \n \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist1 \\ atom bv1 \\ tm\" \nproof - \n obtain bv1 dclist1 where \"AF_typedef_poly tyid bv dclist = AF_typedef_poly tyid bv1 dclist1 \\ atom bv1 \\ tm\" \n using obtain_fresh_bv by metis\n moreover hence \"[[atom bv]]lst. dclist = [[atom bv1]]lst. dclist1\" using type_def.eq_iff by metis\n moreover then obtain x1 b1 c1 where \"(dc, \\ x1 : b1 | c1 \\) \\ set dclist1\" using td_lookup_eq_iff assms by metis\n ultimately show ?thesis using that by blast\nqed\n\nlemma obtain_fresh_bv_dclist_b_iff:\n fixes tm::\"'a::fs\"\n assumes \"(dc, \\ x : b | c \\) \\ set dclist\" and \"AF_typedef_poly tyid bv dclist \\ set P\" and \"\\\\<^sub>w\\<^sub>f P\"\n obtains bv1::bv and dclist1 x1 b1 c1 where \"AF_typedef_poly tyid bv dclist = AF_typedef_poly tyid bv1 dclist1 \n \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist1 \\ atom bv1 \\ tm \\ b[bv::=b']\\<^sub>b\\<^sub>b=b1[bv1::=b']\\<^sub>b\\<^sub>b\" \nproof - \n obtain bv1 dclist1 x1 b1 c1 where *:\"AF_typedef_poly tyid bv dclist = AF_typedef_poly tyid bv1 dclist1 \\ atom bv1 \\ tm\n \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist1\" using obtain_fresh_bv_dclist assms by metis\n\n hence \"AF_typedef_poly tyid bv1 dclist1 \\ set P\" using assms by metis\n\n hence \"b[bv::=b']\\<^sub>b\\<^sub>b = b1[bv1::=b']\\<^sub>b\\<^sub>b\" \n using wfTh_typedef_poly_b_eq_iff[OF assms(2) assms(1) _ _ assms(3),of bv1 dclist1 x1 b1 c1 b'] * by metis\n\n from this that show ?thesis using * by metis \nqed\n\nlemma eval_v_exist:\n fixes \\::\\ and v::v and b::b\n assumes \"P ; \\ \\ i\" and \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\"\n shows \"\\s. i \\ v \\ ~ s \\ P \\ s : b \"\n using assms proof(nominal_induct v arbitrary: b rule:v.strong_induct)\n case (V_lit x)\n then show ?case using eval_l_base eval_v.intros eval_l.simps wfV_elims rcl_val.supp pure_supp by metis\nnext\n case (V_var x)\n then obtain c where *:\"Some (b,c) = lookup \\ x\" using wfV_elims by metis\n hence \"x \\ fst ` toSet \\\" using lookup_x by blast\n hence \"x \\ dom i\" using wfI_domi using assms by blast\n then obtain s where \"i x = Some s\" by auto\n moreover hence \"P \\ s : b\" using wfRCV.intros wfI_lookup * V_var\n by (metis wfV_wf)\n\n ultimately show ?case using eval_v.intros rcl_val.supp b.supp by metis\nnext\n case (V_pair v1 v2)\n then obtain b1 and b2 where *:\"P ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : b1 \\ P ; B ; \\ \\\\<^sub>w\\<^sub>f v2 : b2 \\ b = B_pair b1 b2\" using wfV_elims by metis\n then obtain s1 and s2 where \"eval_v i v1 s1 \\ wfRCV P s1 b1 \\ eval_v i v2 s2 \\ wfRCV P s2 b2\" using V_pair by metis\n thus ?case using eval_v.intros wfRCV.intros * by metis\nnext\n case (V_cons tyid dc v)\n then obtain s and b'::b and dclist and x::x and c::c where \"(wfV P B \\ v b') \\ i \\ v \\ ~ s \\ P \\ s : b' \\ b = B_id tyid \\\n AF_typedef tyid dclist \\ set P \\ (dc, \\ x : b' | c \\) \\ set dclist\" using wfV_elims(4) by metis\n then show ?case using eval_v.intros(4) wfRCV.intros(5) V_cons by metis\nnext\n case (V_consp tyid dc b' v)\n\n obtain b'a::b and bv and dclist and x::x and c::c where *:\"(wfV P B \\ v b'a[bv::=b']\\<^sub>b\\<^sub>b) \\ b = B_app tyid b' \\\n AF_typedef_poly tyid bv dclist \\ set P \\ (dc, \\ x : b'a | c \\) \\ set dclist \\ \n atom bv \\ (P, B_app tyid b',B) \" using wf_strong_elim(1)[OF V_consp(3)] by metis\n\n then obtain s where **:\"i \\ v \\ ~ s \\ P \\ s : b'a[bv::=b']\\<^sub>b\\<^sub>b\" using V_consp by auto\n\n have \" \\\\<^sub>w\\<^sub>f P\" using wfX_wfY V_consp by metis\n then obtain bv1::bv and dclist1 x1 b1 c1 where 3:\"AF_typedef_poly tyid bv dclist = AF_typedef_poly tyid bv1 dclist1 \n \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist1 \\ atom bv1 \\ (P, SConsp tyid dc b' s, B_app tyid b')\n \\ b'a[bv::=b']\\<^sub>b\\<^sub>b = b1[bv1::=b']\\<^sub>b\\<^sub>b\" \n using * obtain_fresh_bv_dclist_b_iff by blast\n\n have \" i \\ V_consp tyid dc b' v \\ ~ SConsp tyid dc b' s\" using eval_v.intros by (simp add: \"**\")\n\n moreover have \" P \\ SConsp tyid dc b' s : B_app tyid b'\" proof\n show \\AF_typedef_poly tyid bv1 dclist1 \\ set P\\ using 3 * by metis\n show \\(dc, \\ x1 : b1 | c1 \\) \\ set dclist1\\ using 3 by auto \n thus \\atom bv1 \\ (P, SConsp tyid dc b' s, B_app tyid b')\\ using * 3 fresh_prodN by metis\n show \\ P \\ s : b1[bv1::=b']\\<^sub>b\\<^sub>b\\ using 3 ** by auto\n qed\n\n ultimately show ?case using eval_v.intros wfRCV.intros V_consp * by auto\nqed\n\nlemma eval_v_uniqueness:\n fixes v::v\n assumes \"i \\ v \\ ~ s\" and \"i \\ v \\ ~ s'\"\n shows \"s=s'\"\n using assms proof(nominal_induct v arbitrary: s s' rule:v.strong_induct)\n case (V_lit x)\n then show ?case using eval_v_elims eval_l.simps by metis\nnext\n case (V_var x)\n then show ?case using eval_v_elims by (metis option.inject)\nnext\n case (V_pair v1 v2)\n obtain s1 and s2 where s:\"i \\ v1 \\ ~ s1 \\ i \\ v2 \\ ~ s2 \\ s = SPair s1 s2\" using eval_v_elims V_pair by metis\n obtain s1' and s2' where s':\"i \\ v1 \\ ~ s1' \\ i \\ v2 \\ ~ s2' \\ s' = SPair s1' s2'\" using eval_v_elims V_pair by metis\n then show ?case using eval_v_elims using V_pair s s' by auto\nnext\n case (V_cons tyid dc v1)\n obtain sv1 where 1:\"i \\ v1 \\ ~ sv1 \\ s = SCons tyid dc sv1\" using eval_v_elims V_cons by metis\n moreover obtain sv2 where 2:\"i \\ v1 \\ ~ sv2 \\ s' = SCons tyid dc sv2\" using eval_v_elims V_cons by metis\n ultimately have \"sv1 = sv2\" using V_cons by auto\n then show ?case using 1 2 by auto \nnext\n case (V_consp tyid dc b v1)\n then show ?case using eval_v_elims by metis\n\nqed\n\nlemma eval_v_base:\n fixes \\::\\ and v::v and b::b\n assumes \"P ; \\ \\ i\" and \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\" and \"i \\ v \\ ~ s\"\n shows \"P \\ s : b\"\n using eval_v_exist eval_v_uniqueness assms by metis\n\nlemma eval_e_uniqueness:\n fixes e::ce\n assumes \"i \\ e \\ ~ s\" and \"i \\ e \\ ~ s'\"\n shows \"s=s'\"\n using assms proof(nominal_induct e arbitrary: s s' rule:ce.strong_induct)\n case (CE_val x)\n then show ?case using eval_v_uniqueness eval_e_elims by metis\nnext\n case (CE_op opp x1 x2)\n consider \"opp = Plus\" | \"opp = LEq\" | \"opp = Eq\" using opp.exhaust by metis\n thus ?case proof(cases)\n case 1\n hence a1:\"eval_e i (CE_op Plus x1 x2) s\" and a2:\"eval_e i (CE_op Plus x1 x2) s'\" using CE_op by auto\n then show ?thesis using eval_e_elims(2)[OF a1] eval_e_elims(2)[OF a2]\n CE_op eval_e_plusI \n by (metis rcl_val.eq_iff(2))\n next\n case 2\n hence a1:\"eval_e i (CE_op LEq x1 x2) s\" and a2:\"eval_e i (CE_op LEq x1 x2) s'\" using CE_op by auto\n then show ?thesis using eval_v_uniqueness eval_e_elims(3)[OF a1] eval_e_elims(3)[OF a2]\n CE_op eval_e_plusI \n by (metis rcl_val.eq_iff(2))\n next\n case 3\n hence a1:\"eval_e i (CE_op Eq x1 x2) s\" and a2:\"eval_e i (CE_op Eq x1 x2) s'\" using CE_op by auto\n then show ?thesis using eval_v_uniqueness eval_e_elims(4)[OF a1] eval_e_elims(4)[OF a2]\n CE_op eval_e_plusI \n by (metis rcl_val.eq_iff(2))\n qed\nnext\n case (CE_concat x1 x2)\n hence a1:\"eval_e i (CE_concat x1 x2) s\" and a2:\"eval_e i (CE_concat x1 x2) s'\" using CE_concat by auto\n show ?case using eval_e_elims(7)[OF a1] eval_e_elims(7)[OF a2] CE_concat eval_e_concatI rcl_val.eq_iff \n proof -\n assume \"\\P. (\\bv1 bv2. \\s' = SBitvec (bv1 @ bv2); i \\ x1 \\ ~ SBitvec bv1 ; i \\ x2 \\ ~ SBitvec bv2 \\ \\ P) \\ P\"\n obtain bbs :: \"bit list\" and bbsa :: \"bit list\" where\n \"i \\ x2 \\ ~ SBitvec bbs \\ i \\ x1 \\ ~ SBitvec bbsa \\ SBitvec (bbsa @ bbs) = s'\"\n by (metis \\\\P. (\\bv1 bv2. \\s' = SBitvec (bv1 @ bv2); i \\ x1 \\ ~ SBitvec bv1 ; i \\ x2 \\ ~ SBitvec bv2 \\ \\ P) \\ P\\) (* 93 ms *)\n then have \"s' = s\"\n by (metis (no_types) \\\\P. (\\bv1 bv2. \\s = SBitvec (bv1 @ bv2); i \\ x1 \\ ~ SBitvec bv1 ; i \\ x2 \\ ~ SBitvec bv2 \\ \\ P) \\ P\\ \\\\s' s. \\i \\ x1 \\ ~ s ; i \\ x1 \\ ~ s' \\ \\ s = s'\\ \\\\s' s. \\i \\ x2 \\ ~ s ; i \\ x2 \\ ~ s' \\ \\ s = s'\\ rcl_val.eq_iff(1)) (* 125 ms *)\n then show ?thesis\n by metis (* 0.0 ms *)\n qed\nnext\n case (CE_fst x)\n then show ?case using eval_v_uniqueness by (meson eval_e_elims rcl_val.eq_iff)\nnext\n case (CE_snd x)\n then show ?case using eval_v_uniqueness by (meson eval_e_elims rcl_val.eq_iff)\nnext\n case (CE_len x)\n then show ?case using eval_e_elims rcl_val.eq_iff \n proof -\n obtain bbs :: \"rcl_val \\ ce \\ (x \\ rcl_val option) \\ bit list\" where\n \"\\x0 x1 x2. (\\v3. x0 = SNum (int (length v3)) \\ x2 \\ x1 \\ ~ SBitvec v3 ) = (x0 = SNum (int (length (bbs x0 x1 x2))) \\ x2 \\ x1 \\ ~ SBitvec (bbs x0 x1 x2) )\"\n by moura (* 0.0 ms *)\n then have \"\\f c r. \\ f \\ [| c |]\\<^sup>c\\<^sup>e \\ ~ r \\ r = SNum (int (length (bbs r c f))) \\ f \\ c \\ ~ SBitvec (bbs r c f)\"\n by (meson eval_e_elims(8)) (* 46 ms *)\n then show ?thesis\n by (metis (no_types) CE_len.hyps CE_len.prems(1) CE_len.prems(2) rcl_val.eq_iff(1)) (* 31 ms *)\n qed\n\nqed\n\nlemma wfV_eval_bitvec:\n fixes v::v\n assumes \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v : B_bitvec\" and \"P ; \\ \\ i\"\n shows \"\\bv. eval_v i v (SBitvec bv)\"\nproof -\n obtain s where \"i \\ v \\ ~ s \\ wfRCV P s B_bitvec\" using eval_v_exist assms by metis\n moreover then obtain bv where \"s = SBitvec bv\" using wfRCV_elims(1)[of P s] by metis\n ultimately show ?thesis by metis\nqed\n\nlemma wfV_eval_pair:\n fixes v::v\n assumes \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v : B_pair b1 b2\" and \"P ; \\ \\ i\"\n shows \"\\s1 s2. eval_v i v (SPair s1 s2)\"\nproof -\n obtain s where \"i \\ v \\ ~ s \\ wfRCV P s (B_pair b1 b2)\" using eval_v_exist assms by metis\n moreover then obtain s1 and s2 where \"s = SPair s1 s2\" using wfRCV_elims(2)[of P s] by metis\n ultimately show ?thesis by metis\nqed\n\nlemma wfV_eval_int:\n fixes v::v\n assumes \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v : B_int\" and \"P ; \\ \\ i\"\n shows \"\\n. eval_v i v (SNum n)\"\nproof -\n obtain s where \"i \\ v \\ ~ s \\ wfRCV P s (B_int)\" using eval_v_exist assms by metis\n moreover then obtain n where \"s = SNum n\" using wfRCV_elims(3)[of P s] by metis\n ultimately show ?thesis by metis\nqed\n\ntext \\Well sorted value with a well sorted valuation evaluates\\\nlemma wfI_wfV_eval_v:\n fixes v::v and b::b\n assumes \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\" and \"wfI \\ \\ i\"\n shows \"\\s. i \\ v \\ ~ s \\ \\ \\ s : b\"\n using eval_v_exist assms by auto\n\nlemma wfI_wfCE_eval_e:\n fixes e::ce and b::b\n assumes \"wfCE P B G e b\" and \"P ; G \\ i\" \n shows \"\\s. i \\ e \\ ~ s \\ P \\ s : b\"\n using assms proof(nominal_induct e arbitrary: b rule: ce.strong_induct)\n case (CE_val v)\n obtain s where \"i \\ v \\ ~ s \\ P \\ s : b\" using wfI_wfV_eval_v[of P B G v b i] assms wfCE_elims(1) [of P B G v b] CE_val by auto\n then show ?case using CE_val eval_e.intros(1)[of i v s ] by auto\nnext\n case (CE_op opp v1 v2)\n\n consider \"opp =Plus\" | \"opp=LEq\" | \"opp=Eq\" using opp.exhaust by auto\n\n thus ?case proof(cases)\n case 1\n hence \"wfCE P B G v1 B_int \\ wfCE P B G v2 B_int\" using wfCE_elims(2) CE_op\n\n by blast\n then obtain s1 and s2 where *: \"eval_e i v1 s1 \\ wfRCV P s1 B_int \\ eval_e i v2 s2 \\ wfRCV P s2 B_int\"\n using wfI_wfV_eval_v CE_op by metis\n then obtain n1 and n2 where **:\"s2=SNum n2 \\ s1 = SNum n1\" using wfRCV_elims by meson\n hence \"eval_e i (CE_op Plus v1 v2) (SNum (n1+n2))\" using eval_e_plusI * ** by simp\n moreover have \"wfRCV P (SNum (n1+n2)) B_int\" using wfRCV.intros by auto\n ultimately show ?thesis using 1\n using CE_op.prems(1) wfCE_elims(2) by blast\n next\n case 2\n hence \"wfCE P B G v1 B_int \\ wfCE P B G v2 B_int\" using wfCE_elims(3) CE_op\n by blast\n then obtain s1 and s2 where *: \"eval_e i v1 s1 \\ wfRCV P s1 B_int \\ eval_e i v2 s2 \\ wfRCV P s2 B_int\"\n using wfI_wfV_eval_v CE_op by metis\n then obtain n1 and n2 where **:\"s2=SNum n2 \\ s1 = SNum n1\" using wfRCV_elims by meson\n hence \"eval_e i (CE_op LEq v1 v2) (SBool (n1 \\ n2))\" using eval_e_leqI * ** by simp\n moreover have \"wfRCV P (SBool (n1\\n2)) B_bool\" using wfRCV.intros by auto\n ultimately show ?thesis using 2\n using CE_op.prems wfCE_elims by metis\n next\n case 3\n then obtain b2 where \"wfCE P B G v1 b2 \\ wfCE P B G v2 b2\" using wfCE_elims(9) CE_op\n by blast\n then obtain s1 and s2 where *: \"eval_e i v1 s1 \\ wfRCV P s1 b2 \\ eval_e i v2 s2 \\ wfRCV P s2 b2\"\n using wfI_wfV_eval_v CE_op by metis\n hence \"eval_e i (CE_op Eq v1 v2) (SBool (s1 = s2))\" using eval_e_leqI * \n by (simp add: eval_e_eqI)\n moreover have \"wfRCV P (SBool (s1 = s2)) B_bool\" using wfRCV.intros by auto\n ultimately show ?thesis using 3\n using CE_op.prems wfCE_elims by metis\n qed\nnext\n case (CE_concat v1 v2)\n then obtain s1 and s2 where *:\"b = B_bitvec \\ eval_e i v1 s1 \\ eval_e i v2 s2 \\\n wfRCV P s1 B_bitvec \\ wfRCV P s2 B_bitvec\" using \n CE_concat \n by (meson wfCE_elims(6))\n thus ?case using eval_e_concatI wfRCV.intros(1) wfRCV_elims \n proof -\n obtain bbs :: \"type_def list \\ rcl_val \\ bit list\" where\n \"\\ts s. \\ ts \\ s : B_bitvec \\ s = SBitvec (bbs ts s)\"\n using wfRCV_elims(1) by moura (* 156 ms *)\n then show ?thesis\n by (metis (no_types) \"local.*\" wfRCV_BBitvecI eval_e_concatI) (* 78 ms *)\n qed\nnext\n case (CE_fst v1)\n thus ?case using eval_e_fstI wfRCV.intros wfCE_elims wfI_wfV_eval_v\n by (metis wfRCV_elims(2) rcl_val.eq_iff(4))\nnext\n case (CE_snd v1)\n thus ?case using eval_e_sndI wfRCV.intros wfCE_elims wfI_wfV_eval_v\n by (metis wfRCV_elims(2) rcl_val.eq_iff(4))\nnext\n case (CE_len x)\n thus ?case using eval_e_lenI wfRCV.intros wfCE_elims wfI_wfV_eval_v wfV_eval_bitvec \n by (metis wfRCV_elims(1))\nqed\n\nlemma eval_e_exist:\n fixes \\::\\ and e::ce\n assumes \"P ; \\ \\ i\" and \"P ; B ; \\ \\\\<^sub>w\\<^sub>f e : b\"\n shows \"\\s. i \\ e \\ ~ s\"\n using assms proof(nominal_induct e arbitrary: b rule:ce.strong_induct)\n case (CE_val v)\n then show ?case using eval_v_exist wfCE_elims eval_e.intros by metis\nnext\n case (CE_op op v1 v2)\n\n show ?case proof(rule opp.exhaust)\n assume \\op = Plus\\\n hence \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : B_int \\ P ; B ; \\ \\\\<^sub>w\\<^sub>f v2 : B_int \\ b = B_int\" using wfCE_elims CE_op by metis\n then obtain n1 and n2 where \"eval_e i v1 (SNum n1) \\ eval_e i v2 (SNum n2)\" using CE_op eval_v_exist wfV_eval_int \n by (metis wfI_wfCE_eval_e wfRCV_elims(3))\n then show \\\\a. eval_e i (CE_op op v1 v2) a\\ using eval_e_plusI[of i v1 _ v2] \\op=Plus\\ by auto\n next\n assume \\op = LEq\\\n hence \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : B_int \\ P ; B ; \\ \\\\<^sub>w\\<^sub>f v2 : B_int \\ b = B_bool\" using wfCE_elims CE_op by metis\n then obtain n1 and n2 where \"eval_e i v1 (SNum n1) \\ eval_e i v2 (SNum n2)\" using CE_op eval_v_exist wfV_eval_int \n by (metis wfI_wfCE_eval_e wfRCV_elims(3))\n then show \\\\a. eval_e i (CE_op op v1 v2) a\\ using eval_e_leqI[of i v1 _ v2] eval_v_exist \\op=LEq\\ CE_op by auto\n next\n assume \\op = Eq\\\n then obtain b1 where \"P ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : b1 \\ P ; B ; \\ \\\\<^sub>w\\<^sub>f v2 : b1 \\ b = B_bool\" using wfCE_elims CE_op by metis\n then obtain s1 and s2 where \"eval_e i v1 s1 \\ eval_e i v2 s2\" using CE_op eval_v_exist wfV_eval_int \n by (metis wfI_wfCE_eval_e wfRCV_elims(3))\n then show \\\\a. eval_e i (CE_op op v1 v2) a\\ using eval_e_eqI[of i v1 _ v2] eval_v_exist \\op=Eq\\ CE_op by auto\n qed\nnext\n case (CE_concat v1 v2)\n then obtain bv1 and bv2 where \"eval_e i v1 (SBitvec bv1) \\ eval_e i v2 (SBitvec bv2)\"\n using wfV_eval_bitvec wfCE_elims(6) \n by (meson eval_e_elims(7) wfI_wfCE_eval_e)\n then show ?case using eval_e.intros by metis\nnext\n case (CE_fst ce)\n then obtain b2 where b:\"P ; B ; \\ \\\\<^sub>w\\<^sub>f ce : B_pair b b2\" using wfCE_elims by metis\n then obtain s where s:\"i \\ ce \\ ~ s\" using CE_fst by auto\n then obtain s1 and s2 where \"s = (SPair s1 s2)\" using eval_e_elims(4) CE_fst wfI_wfCE_eval_e[of P B \\ ce \"B_pair b b2\" i,OF b] wfRCV_elims(2)[of P s b b2] \n by (metis eval_e_uniqueness)\n then show ?case using s eval_e.intros by metis\nnext\n case (CE_snd ce)\n then obtain b1 where b:\"P ; B ; \\ \\\\<^sub>w\\<^sub>f ce : B_pair b1 b\" using wfCE_elims by metis\n then obtain s where s:\"i \\ ce \\ ~ s\" using CE_snd by auto\n then obtain s1 and s2 where \"s = (SPair s1 s2)\" \n using eval_e_elims(5) CE_snd wfI_wfCE_eval_e[of P B \\ ce \"B_pair b1 b\" i,OF b] wfRCV_elims(2)[of P s b b1] \n eval_e_uniqueness \n by (metis wfRCV_elims(2))\n then show ?case using s eval_e.intros by metis\nnext\n case (CE_len v1)\n then obtain bv1 where \"eval_e i v1 (SBitvec bv1)\"\n using wfV_eval_bitvec CE_len wfCE_elims eval_e_uniqueness \n by (metis eval_e_elims(7) wfCE_concatI wfI_wfCE_eval_e)\n then show ?case using eval_e.intros by metis\nqed\n\nlemma eval_c_exist:\n fixes \\::\\ and c::c\n assumes \"P ; \\ \\ i\" and \"P ; B ; \\ \\\\<^sub>w\\<^sub>f c\"\n shows \"\\s. i \\ c \\ ~ s\"\n using assms proof(nominal_induct c rule: c.strong_induct)\n case C_true\n then show ?case using eval_c.intros wfC_elims by metis\nnext\n case C_false\n then show ?case using eval_c.intros wfC_elims by metis\nnext\n case (C_conj c1 c2)\n then show ?case using eval_c.intros wfC_elims by metis\nnext\n case (C_disj x1 x2)\n then show ?case using eval_c.intros wfC_elims by metis\nnext\n case (C_not x)\n then show ?case using eval_c.intros wfC_elims by metis\nnext\n case (C_imp x1 x2)\n then show ?case using eval_c.intros eval_e_exist wfC_elims by metis\nnext\n case (C_eq x1 x2)\n then show ?case using eval_c.intros eval_e_exist wfC_elims by metis\nqed\n\nlemma eval_c_uniqueness:\n fixes c::c\n assumes \"i \\ c \\ ~ s\" and \"i \\ c \\ ~ s'\"\n shows \"s=s'\"\n using assms proof(nominal_induct c arbitrary: s s' rule:c.strong_induct)\n case C_true\n then show ?case using eval_c_elims by metis\nnext\n case C_false\n then show ?case using eval_c_elims by metis\nnext\n case (C_conj x1 x2)\n then show ?case using eval_c_elims(3) by (metis (full_types))\nnext\n case (C_disj x1 x2)\n then show ?case using eval_c_elims(4) by (metis (full_types))\nnext\n case (C_not x)\n then show ?case using eval_c_elims(6) by (metis (full_types))\nnext\n case (C_imp x1 x2)\n then show ?case using eval_c_elims(5) by (metis (full_types))\nnext\n case (C_eq x1 x2)\n then show ?case using eval_e_uniqueness eval_c_elims(7) by metis\nqed\n\nlemma wfI_wfC_eval_c:\n fixes c::c\n assumes \"wfC P B G c\" and \"P ; G \\ i\"\n shows \"\\s. i \\ c \\ ~ s\"\n using assms proof(nominal_induct c rule: c.strong_induct)\nqed(metis wfC_elims wfI_wfCE_eval_e eval_c.intros)+\n\nsection \\Satisfiability\\\n\nlemma satis_reflI:\n fixes c::c\n assumes \"i \\ ((x, b, c) #\\<^sub>\\ G)\"\n shows \"i \\ c\"\n using assms by auto\n\nlemma is_satis_mp:\n fixes c1::c and c2::c\n assumes \"i \\ (c1 IMP c2)\" and \"i \\ c1\"\n shows \"i \\ c2\"\n using assms proof -\n have \"eval_c i (c1 IMP c2) True\" using is_satis.simps using assms by blast\n then obtain b1 and b2 where \"True = (b1 \\ b2) \\ eval_c i c1 b1 \\ eval_c i c2 b2\"\n using eval_c_elims(5) by metis\n moreover have \"eval_c i c1 True\" using is_satis.simps using assms by blast\n moreover have \"b1 = True\" using calculation eval_c_uniqueness by blast\n ultimately have \"eval_c i c2 True\" by auto\n thus ?thesis using is_satis.intros by auto\nqed\n\nlemma is_satis_imp:\n fixes c1::c and c2::c\n assumes \"i \\ c1 \\ i \\ c2\" and \"i \\ c1 \\ ~ b1\" and \"i \\ c2 \\ ~ b2\"\n shows \"i \\ (c1 IMP c2)\"\nproof(cases b1)\n case True\n hence \"i \\ c2\" using assms is_satis.simps by simp\n hence \"b2 = True\" using is_satis.simps assms\n using eval_c_uniqueness by blast\n then show ?thesis using eval_c_impI is_satis.simps assms by force\nnext\n case False\n then show ?thesis using assms eval_c_impI is_satis.simps by metis\nqed\n\nlemma is_satis_iff:\n \"i \\ G = (\\x b c. (x,b,c) \\ toSet G \\ i \\ c)\"\n by(induct G,auto)\n\nlemma is_satis_g_append:\n \"i \\ (G1@G2) = (i \\ G1 \\ i \\ G2)\"\n using is_satis_g.simps is_satis_iff by auto\n\nsection \\Substitution for Evaluation\\\n\nlemma eval_v_i_upd:\n fixes v::v\n assumes \"atom x \\ v\" and \"i \\ v \\ ~ s'\"\n shows \"eval_v ((i ( x \\s))) v s' \"\n using assms proof(nominal_induct v arbitrary: s' rule:v.strong_induct)\n case (V_lit x)\n then show ?case by (metis eval_v_elims(1) eval_v_litI)\nnext\n case (V_var y)\n then obtain s where *: \"Some s = i y \\ s=s'\" using eval_v_elims by metis\n moreover have \"x \\ y\" using \\atom x \\ V_var y\\ v.supp by simp\n ultimately have \"(i ( x \\s)) y = Some s\"\n by (simp add: \\Some s = i y \\ s = s'\\)\n then show ?case using eval_v_varI * \\x \\ y\\\n by (simp add: eval_v.eval_v_varI)\nnext\n case (V_pair v1 v2)\n hence \"atom x \\ v1 \\ atom x \\ v2\" using v.supp by simp\n moreover obtain s1 and s2 where *: \"eval_v i v1 s1 \\ eval_v i v2 s2 \\ s' = SPair s1 s2\" using eval_v_elims V_pair by metis\n ultimately have \"eval_v ((i ( x \\s))) v1 s1 \\ eval_v ((i ( x \\s))) v2 s2\" using V_pair by blast\n thus ?case using eval_v_pairI * by meson\nnext\n case (V_cons tyid dc v1)\n hence \"atom x \\ v1\" using v.supp by simp\n moreover obtain s1 where *: \"eval_v i v1 s1 \\ s' = SCons tyid dc s1\" using eval_v_elims V_cons by metis\n ultimately have \"eval_v ((i ( x \\s))) v1 s1\" using V_cons by blast\n thus ?case using eval_v_consI * by meson\nnext\n case (V_consp tyid dc b1 v1)\n\n hence \"atom x \\ v1\" using v.supp by simp\n moreover obtain s1 where *: \"eval_v i v1 s1 \\ s' = SConsp tyid dc b1 s1\" using eval_v_elims V_consp by metis\n ultimately have \"eval_v ((i ( x \\s))) v1 s1\" using V_consp by blast\n thus ?case using eval_v_conspI * by meson\nqed\n\nlemma eval_e_i_upd:\n fixes e::ce\n assumes \"i \\ e \\ ~ s'\" and \"atom x \\ e\"\n shows \" (i ( x \\s)) \\ e \\ ~ s'\"\n using assms apply(induct rule: eval_e.induct) using eval_v_i_upd eval_e_elims\n by (meson ce.fresh eval_e.intros)+\n\nlemma eval_c_i_upd:\n fixes c::c\n assumes \"i \\ c \\ ~ s'\" and \"atom x \\ c\"\n shows \"((i ( x \\s))) \\ c \\ ~ s' \"\n using assms proof(induct rule:eval_c.induct)\n case (eval_c_eqI i e1 sv1 e2 sv2)\n then show ?case using RCLogic.eval_c_eqI eval_e_i_upd c.fresh by metis\nqed(simp add: eval_c.intros)+\n\nlemma subst_v_eval_v[simp]:\n fixes v::v and v'::v\n assumes \"i \\ v \\ ~ s\" and \"i \\ (v'[x::=v]\\<^sub>v\\<^sub>v) \\ ~ s'\"\n shows \"(i ( x \\ s )) \\ v' \\ ~ s'\"\n using assms proof(nominal_induct v' arbitrary: s' rule:v.strong_induct)\n case (V_lit x)\n then show ?case using subst_vv.simps\n by (metis eval_v_elims(1) eval_v_litI)\nnext\n case (V_var x')\n then show ?case proof(cases \"x=x'\")\n case True\n hence \"(V_var x')[x::=v]\\<^sub>v\\<^sub>v = v\" using subst_vv.simps by auto\n then show ?thesis using V_var eval_v_elims eval_v_varI eval_v_uniqueness True\n by (simp add: eval_v.eval_v_varI)\n next\n case False\n hence \"atom x \\ (V_var x')\" by simp\n then show ?thesis using eval_v_i_upd False V_var by fastforce\n qed\nnext\n case (V_pair v1 v2)\n then obtain s1 and s2 where *:\"eval_v i (v1[x::=v]\\<^sub>v\\<^sub>v) s1 \\ eval_v i (v2[x::=v]\\<^sub>v\\<^sub>v) s2 \\ s' = SPair s1 s2\" using V_pair eval_v_elims subst_vv.simps by metis\n hence \"(i ( x \\ s )) \\ v1 \\ ~ s1 \\ (i ( x \\ s )) \\ v2 \\ ~ s2\" using V_pair by metis\n thus ?case using eval_v_pairI subst_vv.simps * V_pair by metis\nnext\n case (V_cons tyid dc v1)\n then obtain s1 where \"eval_v i (v1[x::=v]\\<^sub>v\\<^sub>v) s1\" using eval_v_elims subst_vv.simps by metis\n thus ?case using eval_v_consI V_cons\n by (metis eval_v_elims subst_vv.simps)\nnext\n case (V_consp tyid dc b1 v1)\n\n then obtain s1 where *:\"eval_v i (v1[x::=v]\\<^sub>v\\<^sub>v) s1 \\ s' = SConsp tyid dc b1 s1\" using eval_v_elims subst_vv.simps by metis\n hence \"i ( x \\ s ) \\ v1 \\ ~ s1\" using V_consp by metis\n thus ?case using * eval_v_conspI by metis \nqed\n\nlemma subst_e_eval_v[simp]:\n fixes y::x and e::ce and v::v and e'::ce\n assumes \"i \\ e' \\ ~ s'\" and \"e'=(e[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v)\" and \"i \\ v \\ ~ s\"\n shows \"(i ( y \\ s )) \\ e \\ ~ s'\"\n using assms proof(induct arbitrary: e rule: eval_e.induct)\n case (eval_e_valI i v1 sv)\n then obtain v1' where *:\"e = CE_val v1' \\ v1 = v1'[y::=v]\\<^sub>v\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_v i (v1'[y::=v]\\<^sub>v\\<^sub>v) sv\" using eval_e_valI by simp\n hence \"eval_v (i ( y \\ s )) v1' sv\" using subst_v_eval_v eval_e_valI by simp\n then show ?case using RCLogic.eval_e_valI * by meson\nnext\n case (eval_e_plusI i v1 n1 v2 n2)\n then obtain v1' and v2' where *:\"e = CE_op Plus v1' v2' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v \\ v2 = v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SNum n1) \\ eval_e i (v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SNum n2)\" using eval_e_plusI by simp\n hence \"eval_e (i ( y \\ s )) v1' (SNum n1) \\ eval_e (i ( y \\ s )) v2' (SNum n2)\" using subst_v_eval_v eval_e_plusI \n using \"local.*\" by blast\n then show ?case using RCLogic.eval_e_plusI * by meson\nnext\n case (eval_e_leqI i v1 n1 v2 n2)\n then obtain v1' and v2' where *:\"e = CE_op LEq v1' v2' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v \\ v2 = v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SNum n1) \\ eval_e i (v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SNum n2)\" using eval_e_leqI by simp\n hence \"eval_e (i ( y \\ s )) v1' (SNum n1) \\ eval_e (i ( y \\ s )) v2' (SNum n2)\" using subst_v_eval_v eval_e_leqI \n using * by blast\n then show ?case using RCLogic.eval_e_leqI * by meson\nnext\n case (eval_e_eqI i v1 n1 v2 n2)\n then obtain v1' and v2' where *:\"e = CE_op Eq v1' v2' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v \\ v2 = v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) n1 \\ eval_e i (v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) n2\" using eval_e_eqI by simp\n hence \"eval_e (i ( y \\ s )) v1' n1 \\ eval_e (i ( y \\ s )) v2' n2\" using subst_v_eval_v eval_e_eqI \n using * by blast\n then show ?case using RCLogic.eval_e_eqI * by meson\nnext\n case (eval_e_fstI i v1 s1 s2)\n then obtain v1' and v2' where *:\"e = CE_fst v1' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SPair s1 s2)\" using eval_e_fstI by simp\n hence \"eval_e (i ( y \\ s )) v1' (SPair s1 s2)\" using eval_e_fstI * by metis\n then show ?case using RCLogic.eval_e_fstI * by meson\nnext\n case (eval_e_sndI i v1 s1 s2)\n then obtain v1' and v2' where *:\"e = CE_snd v1' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SPair s1 s2)\" using eval_e_sndI by simp\n hence \"eval_e (i ( y \\ s )) v1' (SPair s1 s2)\" using subst_v_eval_v eval_e_sndI * by blast\n then show ?case using RCLogic.eval_e_sndI * by meson\nnext\n case (eval_e_concatI i v1 bv1 v2 bv2)\n then obtain v1' and v2' where *:\"e = CE_concat v1' v2' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v \\ v2 = v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SBitvec bv1) \\ eval_e i (v2'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SBitvec bv2)\" using eval_e_concatI by simp\n moreover hence \"eval_e (i ( y \\ s )) v1' (SBitvec bv1) \\ eval_e (i ( y \\ s )) v2' (SBitvec bv2)\" \n using subst_v_eval_v eval_e_concatI * by blast\n ultimately show ?case using RCLogic.eval_e_concatI * eval_v_uniqueness by (metis eval_e_concatI.hyps(1))\nnext\n case (eval_e_lenI i v1 bv)\n then obtain v1' where *:\"e = CE_len v1' \\ v1 = v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v\"\n using assms by(nominal_induct e rule:ce.strong_induct,simp+)\n hence \"eval_e i (v1'[y::=v]\\<^sub>c\\<^sub>e\\<^sub>v) (SBitvec bv)\" using eval_e_lenI by simp\n hence \"eval_e (i ( y \\ s )) v1' (SBitvec bv)\" using subst_v_eval_v eval_e_lenI * by blast\n then show ?case using RCLogic.eval_e_lenI * by meson\nqed\n\nlemma subst_c_eval_v[simp]:\n fixes v::v and c :: c\n assumes \"i \\ v \\ ~ s\" and \"i \\ c[x::=v]\\<^sub>c\\<^sub>v \\ ~ s1\" and\n \"(i ( x \\ s)) \\ c \\ ~ s2\"\n shows \"s1 = s2\"\n using assms proof(nominal_induct c arbitrary: s1 s2 rule: c.strong_induct)\n case C_true\n hence \"s1 = True \\ s2 = True\" using eval_c_elims subst_cv.simps by auto\n then show ?case by auto\nnext\n case C_false\n hence \"s1 = False \\ s2 = False\" using eval_c_elims subst_cv.simps by metis\n then show ?case by auto\nnext\n case (C_conj c1 c2)\n hence *:\"eval_c i (c1[x::=v]\\<^sub>c\\<^sub>v AND c2[x::=v]\\<^sub>c\\<^sub>v) s1\" using subst_cv.simps by auto\n then obtain s11 and s12 where \"(s1 = (s11 \\ s12)) \\ eval_c i c1[x::=v]\\<^sub>c\\<^sub>v s11 \\ eval_c i c2[x::=v]\\<^sub>c\\<^sub>v s12\" using\n eval_c_elims(3) by metis\n moreover obtain s21 and s22 where \"eval_c (i ( x \\ s)) c1 s21 \\ eval_c (i ( x \\ s)) c2 s22 \\ (s2 = (s21 \\ s22))\" using\n eval_c_elims(3) C_conj by metis\n ultimately show ?case using C_conj by (meson eval_c_elims)\nnext\n case (C_disj c1 c2)\n hence *:\"eval_c i (c1[x::=v]\\<^sub>c\\<^sub>v OR c2[x::=v]\\<^sub>c\\<^sub>v) s1\" using subst_cv.simps by auto\n then obtain s11 and s12 where \"(s1 = (s11 \\ s12)) \\ eval_c i c1[x::=v]\\<^sub>c\\<^sub>v s11 \\ eval_c i c2[x::=v]\\<^sub>c\\<^sub>v s12\" using\n eval_c_elims(4) by metis\n moreover obtain s21 and s22 where \"eval_c (i ( x \\ s)) c1 s21 \\ eval_c (i ( x \\ s)) c2 s22 \\ (s2 = (s21 \\ s22))\" using\n eval_c_elims(4) C_disj by metis\n ultimately show ?case using C_disj by (meson eval_c_elims)\nnext\n case (C_not c1)\n then obtain s11 where \"(s1 = (\\ s11)) \\ eval_c i c1[x::=v]\\<^sub>c\\<^sub>v s11\" using\n eval_c_elims(6) by (metis subst_cv.simps(7))\n moreover obtain s21 where \"eval_c (i ( x \\ s)) c1 s21 \\ (s2 = (\\s21))\" using\n eval_c_elims(6) C_not by metis\n ultimately show ?case using C_not by (meson eval_c_elims)\nnext\n case (C_imp c1 c2)\n hence *:\"eval_c i (c1[x::=v]\\<^sub>c\\<^sub>v IMP c2[x::=v]\\<^sub>c\\<^sub>v) s1\" using subst_cv.simps by auto\n then obtain s11 and s12 where \"(s1 = (s11 \\ s12)) \\ eval_c i c1[x::=v]\\<^sub>c\\<^sub>v s11 \\ eval_c i c2[x::=v]\\<^sub>c\\<^sub>v s12\" using\n eval_c_elims(5) by metis\n moreover obtain s21 and s22 where \"eval_c (i ( x \\ s)) c1 s21 \\ eval_c (i ( x \\ s)) c2 s22 \\ (s2 = (s21 \\ s22))\" using\n eval_c_elims(5) C_imp by metis\n ultimately show ?case using C_imp by (meson eval_c_elims)\nnext\n case (C_eq e1 e2)\n hence *:\"eval_c i (e1[x::=v]\\<^sub>c\\<^sub>e\\<^sub>v == e2[x::=v]\\<^sub>c\\<^sub>e\\<^sub>v) s1\" using subst_cv.simps by auto\n then obtain s11 and s12 where \"(s1 = (s11 = s12)) \\ eval_e i (e1[x::=v]\\<^sub>c\\<^sub>e\\<^sub>v) s11 \\ eval_e i (e2[x::=v]\\<^sub>c\\<^sub>e\\<^sub>v) s12\" using\n eval_c_elims(7) by metis\n moreover obtain s21 and s22 where \"eval_e (i ( x \\ s)) e1 s21 \\ eval_e (i ( x \\ s)) e2 s22 \\ (s2 = (s21 = s22))\" using\n eval_c_elims(7) C_eq by metis\n ultimately show ?case using C_eq subst_e_eval_v by (metis eval_e_uniqueness)\nqed\n\nlemma wfI_upd:\n assumes \"wfI \\ \\ i\" and \"wfRCV \\ s b\" and \"wfG \\ B ((x, b, c) #\\<^sub>\\ \\)\"\n shows \"wfI \\ ((x, b, c) #\\<^sub>\\ \\) (i(x \\ s))\"\nproof(subst wfI_def,rule)\n fix xa\n assume as:\"xa \\ toSet ((x, b, c) #\\<^sub>\\ \\)\"\n\n then obtain x1::x and b1::b and c1::c where xa: \"xa = (x1,b1,c1)\" using toSet.simps\n using prod_cases3 by blast\n\n have \"\\sa. Some sa = (i(x \\ s)) x1 \\ wfRCV \\ sa b1\" proof(cases \"x=x1\")\n case True\n hence \"b=b1\" using as xa wfG_unique assms by metis\n hence \"Some s = (i(x \\ s)) x1 \\ wfRCV \\ s b1\" using assms True by simp\n then show ?thesis by auto\n next\n case False\n hence \"(x1,b1,c1) \\ toSet \\\" using xa as by auto\n then obtain sa where \"Some sa = i x1 \\ wfRCV \\ sa b1\" using assms wfI_def as xa by auto\n hence \"Some sa = (i(x \\ s)) x1 \\ wfRCV \\ sa b1\" using False by auto\n then show ?thesis by auto\n qed\n\n thus \"case xa of (xa, ba, ca) \\ \\sa. Some sa = (i(x \\ s)) xa \\ wfRCV \\ sa ba\" using xa by auto\nqed\n\nlemma wfI_upd_full:\n fixes v::v\n assumes \"wfI \\ G i\" and \"G = ((\\'[x::=v]\\<^sub>\\\\<^sub>v)@\\)\" and \"wfRCV \\ s b\" and \"wfG \\ B (\\'@((x,b,c)#\\<^sub>\\\\))\" and \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\"\n shows \"wfI \\ (\\'@((x,b,c)#\\<^sub>\\\\)) (i(x \\ s))\"\nproof(subst wfI_def,rule)\n fix xa\n assume as:\"xa \\ toSet (\\'@((x,b,c)#\\<^sub>\\\\))\"\n\n then obtain x1::x and b1::b and c1::c where xa: \"xa = (x1,b1,c1)\" using toSet.simps\n using prod_cases3 by blast\n\n have \"\\sa. Some sa = (i(x \\ s)) x1 \\ wfRCV \\ sa b1\"\n proof(cases \"x=x1\")\n case True\n hence \"b=b1\" using as xa wfG_unique_full assms by metis\n hence \"Some s = (i(x \\ s)) x1 \\ wfRCV \\ s b1\" using assms True by simp\n then show ?thesis by auto\n next\n case False\n hence \"(x1,b1,c1) \\ toSet (\\'@\\)\" using as xa by auto\n then obtain c1' where \"(x1,b1,c1') \\ toSet (\\'[x::=v]\\<^sub>\\\\<^sub>v@\\)\" using xa as wfG_member_subst assms False by metis\n then obtain sa where \"Some sa = i x1 \\ wfRCV \\ sa b1\" using assms wfI_def as xa by blast\n hence \"Some sa = (i(x \\ s)) x1 \\ wfRCV \\ sa b1\" using False by auto\n then show ?thesis by auto\n qed\n\n thus \"case xa of (xa, ba, ca) \\ \\sa. Some sa = (i(x \\ s)) xa \\ wfRCV \\ sa ba\" using xa by auto\nqed\n\nlemma subst_c_satis[simp]:\n fixes v::v\n assumes \"i \\ v \\ ~ s\" and \"wfC \\ B ((x,b,c')#\\<^sub>\\\\) c\" and \"wfI \\ \\ i\" and \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\"\n shows \"i \\ (c[x::=v]\\<^sub>c\\<^sub>v) \\ (i ( x \\ s)) \\ c\"\nproof -\n have \"wfI \\ ((x, b, c') #\\<^sub>\\ \\) (i(x \\ s))\" using wfI_upd assms wfC_wf eval_v_base by blast\n then obtain s1 where s1:\"eval_c (i(x \\ s)) c s1\" using eval_c_exist[of \\ \"((x,b,c')#\\<^sub>\\\\)\" \"(i ( x \\ s))\" B c ] assms by auto\n\n have \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f c[x::=v]\\<^sub>c\\<^sub>v\" using wf_subst1(2)[OF assms(2) _ assms(4) , of GNil x ] subst_gv.simps by simp\n then obtain s2 where s2:\"eval_c i c[x::=v]\\<^sub>c\\<^sub>v s2\" using eval_c_exist[of \\ \"\\\" \"i\" B \"c[x::=v]\\<^sub>c\\<^sub>v\" ] assms by auto\n\n show ?thesis using s1 s2 subst_c_eval_v[OF assms(1) s2 s1] is_satis.cases\n using eval_c_uniqueness is_satis.simps by auto\nqed\n\ntext \\ Key theorem telling us we can replace a substitution with an update to the valuation \\\nlemma subst_c_satis_full:\n fixes v::v and \\'::\\\n assumes \"i \\ v \\ ~ s\" and \"wfC \\ B (\\'@((x,b,c')#\\<^sub>\\\\)) c\" and \"wfI \\ ((\\'[x::=v]\\<^sub>\\\\<^sub>v)@\\) i\" and \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f v : b\"\n shows \"i \\ (c[x::=v]\\<^sub>c\\<^sub>v) \\ (i ( x \\ s)) \\ c\"\nproof -\n have \"wfI \\ (\\'@((x, b, c')) #\\<^sub>\\ \\) (i(x \\ s))\" using wfI_upd_full assms wfC_wf eval_v_base wfI_suffix wfI_def wfV_wf by fast\n then obtain s1 where s1:\"eval_c (i(x \\ s)) c s1\" using eval_c_exist[of \\ \"(\\'@(x,b,c')#\\<^sub>\\\\)\" \"(i ( x \\ s))\" B c ] assms by auto\n\n have \"\\ ; B ; ((\\'[x::=v]\\<^sub>\\\\<^sub>v)@\\) \\\\<^sub>w\\<^sub>f c[x::=v]\\<^sub>c\\<^sub>v\" using wbc_subst assms by auto\n\n then obtain s2 where s2:\"eval_c i c[x::=v]\\<^sub>c\\<^sub>v s2\" using eval_c_exist[of \\ \"((\\'[x::=v]\\<^sub>\\\\<^sub>v)@\\)\" \"i\" B \"c[x::=v]\\<^sub>c\\<^sub>v\" ] assms by auto\n\n show ?thesis using s1 s2 subst_c_eval_v[OF assms(1) s2 s1] is_satis.cases\n using eval_c_uniqueness is_satis.simps by auto\nqed\n\nsection \\Validity\\\n\nlemma validI[intro]:\n fixes c::c\n assumes \"wfC P B G c\" and \"\\i. P ; G \\ i \\ i \\ G \\ i \\ c\"\n shows \"P ; B ; G \\ c\"\n using assms valid.simps by presburger\n\nlemma valid_g_wf:\n fixes c::c and G::\\\n assumes \"P ; B ; G \\ c\"\n shows \"P ; B \\\\<^sub>w\\<^sub>f G\"\n using assms wfC_wf valid.simps by blast\n\nlemma valid_reflI [intro]:\n fixes b::b\n assumes \"P ; B ; ((x,b,c1)#\\<^sub>\\G) \\\\<^sub>w\\<^sub>f c1\" and \"c1 = c2\"\n shows \"P ; B ; ((x,b,c1)#\\<^sub>\\G) \\ c2\"\n using satis_reflI assms by simp\n\nsubsection \\Weakening and Strengthening\\\n\ntext \\ Adding to the domain of a valuation doesn't change the result \\\n\nlemma eval_v_weakening:\n fixes c::v and B::\"bv fset\"\n assumes \"i = i'|` d\" and \"supp c \\ atom ` d \\ supp B \" and \"i \\ c \\ ~ s\"\n shows \"i' \\ c \\ ~ s\"\n using assms proof(nominal_induct c arbitrary:s rule: v.strong_induct)\n case (V_lit x)\n then show ?case using eval_v_elims eval_v_litI by metis\nnext\n case (V_var x)\n have \"atom x \\ atom ` d\" using x_not_in_b_set[of x B] assms v.supp(2) supp_at_base \n proof -\n show ?thesis\n by (metis UnE V_var.prems(2) \\atom x \\ supp B\\ singletonI subset_iff supp_at_base v.supp(2)) (* 46 ms *)\n qed \n moreover have \"Some s = i x\" using assms eval_v_elims(2) \n using V_var.prems(3) by blast\n hence \"Some s= i' x\" using assms insert_subset restrict_in \n proof -\n show ?thesis\n by (metis (no_types) \\i = i' |` d\\ \\Some s = i x\\ atom_eq_iff calculation imageE restrict_in) (* 31 ms *)\n qed\n thus ?case using eval_v.eval_v_varI by simp\n\nnext\n case (V_pair v1 v2)\n then show ?case using eval_v_elims(3) eval_v_pairI v.supp\n by (metis assms le_sup_iff)\nnext\n case (V_cons dc v1)\n then show ?case using eval_v_elims(4) eval_v_consI v.supp\n by (metis assms le_sup_iff)\nnext\n case (V_consp tyid dc b1 v1)\n\n then obtain sv1 where *:\"i \\ v1 \\ ~ sv1 \\ s = SConsp tyid dc b1 sv1\" using eval_v_elims by metis\n hence \"i' \\ v1 \\ ~ sv1\" using V_consp by auto \n then show ?case using * eval_v_conspI v.supp eval_v.simps assms le_sup_iff by metis\nqed\n\nlemma eval_v_restrict:\n fixes c::v and B::\"bv fset\"\n assumes \"i = i' |` d\" and \"supp c \\ atom ` d \\ supp B \" and \"i' \\ c \\ ~ s\"\n shows \"i \\ c \\ ~ s\"\n using assms proof(nominal_induct c arbitrary:s rule: v.strong_induct)\n case (V_lit x)\n then show ?case using eval_v_elims eval_v_litI by metis\nnext\n case (V_var x)\n have \"atom x \\ atom ` d\" using x_not_in_b_set[of x B] assms v.supp(2) supp_at_base \n proof -\n show ?thesis\n by (metis UnE V_var.prems(2) \\atom x \\ supp B\\ singletonI subset_iff supp_at_base v.supp(2)) (* 46 ms *)\n qed \n moreover have \"Some s = i' x\" using assms eval_v_elims(2) \n using V_var.prems(3) by blast\n hence \"Some s= i x\" using assms insert_subset restrict_in \n proof -\n show ?thesis\n by (metis (no_types) \\i = i' |` d\\ \\Some s = i' x\\ atom_eq_iff calculation imageE restrict_in) (* 31 ms *)\n qed\n thus ?case using eval_v.eval_v_varI by simp\nnext\n case (V_pair v1 v2)\n then show ?case using eval_v_elims(3) eval_v_pairI v.supp\n by (metis assms le_sup_iff)\nnext\n case (V_cons dc v1)\n then show ?case using eval_v_elims(4) eval_v_consI v.supp\n by (metis assms le_sup_iff)\nnext\n case (V_consp tyid dc b1 v1)\n then obtain sv1 where *:\"i' \\ v1 \\ ~ sv1 \\ s = SConsp tyid dc b1 sv1\" using eval_v_elims by metis\n hence \"i \\ v1 \\ ~ sv1\" using V_consp by auto \n then show ?case using * eval_v_conspI v.supp eval_v.simps assms le_sup_iff by metis\nqed\n\nlemma eval_e_weakening:\n fixes e::ce and B::\"bv fset\"\n assumes \"i \\ e \\ ~ s\" and \"i = i' |` d\" and \"supp e \\ atom ` d \\ supp B \"\n shows \"i' \\ e \\ ~ s\"\n using assms proof(induct rule: eval_e.induct)\n case (eval_e_valI i v sv)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nnext\n case (eval_e_plusI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nnext\n case (eval_e_leqI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nnext\n case (eval_e_eqI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nnext\n case (eval_e_fstI i v v1 v2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by metis\nnext\n case (eval_e_sndI i v v1 v2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by metis\nnext\n case (eval_e_concatI i v1 bv2 v2 bv1)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nnext\n case (eval_e_lenI i v bv)\n then show ?case using ce.supp eval_e.intros\n using eval_v_weakening by auto\nqed\n\nlemma eval_e_restrict :\n fixes e::ce and B::\"bv fset\"\n assumes \"i' \\ e \\ ~ s\" and \"i = i' |` d\" and \"supp e \\ atom ` d \\ supp B \"\n shows \"i \\ e \\ ~ s\"\n using assms proof(induct rule: eval_e.induct)\n case (eval_e_valI i v sv)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nnext\n case (eval_e_plusI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nnext\n case (eval_e_leqI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nnext\n case (eval_e_eqI i v1 n1 v2 n2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nnext\n case (eval_e_fstI i v v1 v2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by metis\nnext\n case (eval_e_sndI i v v1 v2)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by metis\nnext\n case (eval_e_concatI i v1 bv2 v2 bv1)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nnext\n case (eval_e_lenI i v bv)\n then show ?case using ce.supp eval_e.intros\n using eval_v_restrict by auto\nqed\n\nlemma eval_c_i_weakening:\n fixes c::c and B::\"bv fset\"\n assumes \"i \\ c \\ ~ s\" and \"i = i' |` d\" and \"supp c \\ atom ` d \\ supp B\"\n shows \"i' \\ c \\ ~ s\"\n using assms proof(induct rule:eval_c.induct)\n case (eval_c_eqI i e1 sv1 e2 sv2)\n then show ?case using eval_c.intros eval_e_weakening by auto\nqed(auto simp add: eval_c.intros)+\n\nlemma eval_c_i_restrict:\n fixes c::c and B::\"bv fset\"\n assumes \"i' \\ c \\ ~ s\" and \"i = i' |` d\" and \"supp c \\ atom ` d \\ supp B\"\n shows \"i \\ c \\ ~ s\"\n using assms proof(induct rule:eval_c.induct)\n case (eval_c_eqI i e1 sv1 e2 sv2)\n then show ?case using eval_c.intros eval_e_restrict by auto\nqed(auto simp add: eval_c.intros)+\n\nlemma is_satis_i_weakening:\n fixes c::c and B::\"bv fset\"\n assumes \"i = i' |` d\" and \"supp c \\ atom ` d \\ supp B \" and \"i \\ c\"\n shows \"i' \\ c\"\n using is_satis.simps eval_c_i_weakening[OF _ assms(1) assms(2) ]\n using assms(3) by auto\n\nlemma is_satis_i_restrict:\n fixes c::c and B::\"bv fset\"\n assumes \"i = i' |` d\" and \"supp c \\ atom ` d \\ supp B\" and \"i' \\ c\"\n shows \"i \\ c\"\n using is_satis.simps eval_c_i_restrict[OF _ assms(1) assms(2) ]\n using assms(3) by auto\n\nlemma is_satis_g_restrict1:\n fixes \\'::\\ and \\::\\\n assumes \"toSet \\ \\ toSet \\'\" and \"i \\ \\'\"\n shows \"i \\ \\\"\n using assms proof(induct \\ rule: \\.induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons xbc G)\n obtain x and b and c::c where xbc: \"xbc=(x,b,c)\"\n using prod_cases3 by blast\n hence \"i \\ G\" using GCons by auto\n moreover have \"i \\ c\" using GCons\n is_satis_iff toSet.simps subset_iff\n using xbc by blast\n ultimately show ?case using is_satis_g.simps GCons\n by (simp add: xbc)\nqed\n\nlemma is_satis_g_restrict2:\n fixes \\'::\\ and \\::\\\n assumes \"i \\ \\\" and \"i' = i |` d\" and \"atom_dom \\ \\ atom ` d\" and \"\\ ; B \\\\<^sub>w\\<^sub>f \\\"\n shows \"i' \\ \\\"\n using assms proof(induct \\ rule: \\_induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons x b c G)\n\n hence \"i' \\ G\" proof -\n have \"i \\ G\" using GCons by simp\n moreover have \"atom_dom G \\ atom ` d\" using GCons by simp\n ultimately show ?thesis using GCons wfG_cons2 by blast\n qed\n\n moreover have \"i' \\ c\" proof -\n have \"i \\ c\" using GCons by auto\n moreover have \"\\ ; B ; (x, b, TRUE) #\\<^sub>\\ G \\\\<^sub>w\\<^sub>f c\" using wfG_wfC GCons by simp\n moreover hence \"supp c \\ atom ` d \\ supp B\" using wfC_supp GCons atom_dom_eq by blast\n ultimately show ?thesis using is_satis_i_restrict[of i' i d c] GCons by simp\n qed\n\n ultimately show ?case by auto\nqed\n\nlemma is_satis_g_restrict:\n fixes \\'::\\ and \\::\\\n assumes \"toSet \\ \\ toSet \\'\" and \"i' \\ \\'\" and \"i = i' |` (fst ` toSet \\)\" and \"\\ ; B \\\\<^sub>w\\<^sub>f \\\"\n shows \"i \\ \\\"\n using assms is_satis_g_restrict1[OF assms(1) assms(2)] is_satis_g_restrict2[OF _ assms(3)] by simp\n\nsubsection \\Updating valuation\\\n\nlemma is_satis_c_i_upd:\n fixes c::c\n assumes \"atom x \\ c\" and \"i \\ c\"\n shows \"((i ( x \\s))) \\ c\"\n using assms eval_c_i_upd is_satis.simps by simp\n\nlemma is_satis_g_i_upd:\n fixes G::\\\n assumes \"atom x \\ G\" and \"i \\ G\"\n shows \"((i ( x \\s))) \\ G\"\n using assms proof(induct G rule: \\_induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons x' b' c' G')\n\n hence *:\"atom x \\ G' \\ atom x \\ c'\"\n using fresh_def fresh_GCons GCons by force\n moreover hence \"is_satis ((i ( x \\s))) c'\"\n using is_satis_c_i_upd GCons is_satis_g.simps by auto\n moreover have \" is_satis_g (i(x \\ s)) G'\" using GCons * by fastforce\n ultimately show ?case\n using GCons is_satis_g.simps(2) by metis\nqed\n\nlemma valid_weakening:\n assumes \"\\ ; B ; \\ \\ c\" and \"toSet \\ \\ toSet \\'\" and \"wfG \\ B \\'\"\n shows \"\\ ; B ; \\' \\ c\"\nproof -\n have \"wfC \\ B \\ c\" using assms valid.simps by auto\n hence sp: \"supp c \\ atom `(fst `toSet \\) \\ supp B\" using wfX_wfY wfG_elims\n using atom_dom.simps dom.simps wf_supp(2) by metis\n have wfg: \"wfG \\ B \\\" using assms valid.simps wfC_wf by auto\n\n moreover have a1: \"(\\i. wfI \\ \\' i \\ i \\ \\' \\ i \\ c)\" proof(rule allI, rule impI)\n fix i\n assume as: \"wfI \\ \\' i \\ i \\ \\'\"\n hence as1: \"fst ` toSet \\ \\ dom i\" using assms wfI_domi by blast\n obtain i' where idash: \"i' = restrict_map i (fst `toSet \\)\" by blast\n hence as2: \"dom i' = (fst `toSet \\)\" using dom_restrict as1 by auto\n\n have id2: \"\\ ; \\ \\ i' \\ i' \\ \\\" proof -\n have \"wfI \\ \\ i'\" using as2 wfI_restrict_weakening[of \\ \\' i i' \\] as assms\n using idash by blast\n moreover have \"i' \\ \\\" using is_satis_g_restrict[OF assms(2)] wfg as idash by auto\n ultimately show ?thesis using idash by auto\n qed\n hence \"i' \\ c\" using assms valid.simps by auto\n thus \"i \\ c\" using assms valid.simps is_satis_i_weakening idash sp by blast\n qed\n moreover have \"wfC \\ B \\' c\" using wf_weakening assms valid.simps\n by (meson wfg)\n ultimately show ?thesis using assms valid.simps by auto\nqed\n\nlemma is_satis_g_suffix:\n fixes G::\\\n assumes \"i \\ (G'@G)\"\n shows \"i \\ G\"\n using assms proof(induct G' rule:\\.induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons xbc x2)\n obtain x and b and c::c where xbc: \"xbc=(x,b,c)\"\n using prod_cases3 by blast\n hence \" i \\ (xbc #\\<^sub>\\ (x2 @ G))\" using append_g.simps GCons by fastforce\n then show ?case using is_satis_g.simps GCons xbc by blast\nqed\n\nlemma wfG_inside_valid2:\n fixes x::x and \\::\\ and c0::c and c0'::c\n assumes \"wfG \\ B (\\'@((x,b0,c0')#\\<^sub>\\\\))\" and\n \"\\ ; B ; \\'@(x,b0,c0)#\\<^sub>\\\\ \\ c0'\"\n shows \"wfG \\ B (\\'@((x,b0,c0)#\\<^sub>\\\\))\"\nproof -\n have \"wfG \\ B (\\'@(x,b0,c0)#\\<^sub>\\\\)\" using valid.simps wfC_wf assms by auto\n thus ?thesis using wfG_replace_inside_full assms by auto\nqed\n\nlemma valid_trans:\n assumes \" \\ ; \\ ; \\ \\ c0[z::=v]\\<^sub>v\" and \" \\ ; \\ ; (z,b,c0)#\\<^sub>\\\\ \\ c1\" and \"atom z \\ \\\" and \"wfV \\ \\ \\ v b\" \n shows \" \\ ; \\ ; \\ \\ c1[z::=v]\\<^sub>v\"\nproof - \n have *:\"wfC \\ \\ ((z,b,c0)#\\<^sub>\\\\) c1\" using valid.simps assms by auto\n hence \"wfC \\ \\ \\ (c1[z::=v]\\<^sub>v)\" using wf_subst1(2)[OF * , of GNil ] assms subst_gv.simps subst_v_c_def by force\n\n moreover have \"\\i. wfI \\ \\ i \\ is_satis_g i \\ \\ is_satis i (c1[z::=v]\\<^sub>v)\" \n proof(rule,rule)\n fix i\n assume as: \"wfI \\ \\ i \\ is_satis_g i \\\"\n then obtain sv where sv: \"eval_v i v sv \\ wfRCV \\ sv b\" using eval_v_exist assms by metis\n hence \"is_satis i (c0[z::=v]\\<^sub>v)\" using assms valid.simps as by metis\n hence \"is_satis (i(z \\ sv)) c0\" using subst_c_satis sv as assms valid.simps wfC_wf wfG_elim2 subst_v_c_def by metis\n moreover have \"is_satis_g (i(z \\ sv)) \\\" \n using is_satis_g_i_upd assms by (simp add: as)\n ultimately have \"is_satis_g (i(z \\ sv)) ((z,b,c0)#\\<^sub>\\\\)\" \n using is_satis_g.simps by simp\n moreover have \"wfI \\ ((z,b,c0)#\\<^sub>\\\\) (i(z \\ sv))\" using as wfI_upd sv assms valid.simps wfC_wf by metis\n ultimately have \"is_satis (i(z \\ sv)) c1\" using assms valid.simps by auto\n thus \"is_satis i (c1[z::=v]\\<^sub>v)\" using subst_c_satis sv as assms valid.simps wfC_wf wfG_elim2 subst_v_c_def by metis\n qed\n\n ultimately show ?thesis using valid.simps by auto\nqed\n\nlemma valid_trans_full:\n assumes \"\\ ; \\ ; ((x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\) \\ c2[z2::=V_var x]\\<^sub>v\" and\n \"\\ ; \\ ; ((x, b, c2[z2::=V_var x]\\<^sub>v) #\\<^sub>\\ \\) \\ c3[z3::=V_var x]\\<^sub>v\" \n shows \"\\ ; \\ ; ((x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\) \\ c3[z3::=V_var x]\\<^sub>v\"\n unfolding valid.simps proof\n show \"\\ ; \\ ; (x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\ \\\\<^sub>w\\<^sub>f c3[z3::=V_var x]\\<^sub>v\" using wf_trans valid.simps assms by metis\n\n show \"\\i. ( wfI \\ ((x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\) i \\ (is_satis_g i ((x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\)) \\ (is_satis i (c3[z3::=V_var x]\\<^sub>v)) ) \"\n proof(rule,rule)\n fix i\n assume as: \"\\ ; (x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\ \\ i \\ i \\ (x, b, c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\ \\\" \n have \"i \\ c2[z2::=V_var x]\\<^sub>v\" using is_satis_g.simps as assms by simp\n moreover have \"i \\ \\\" using is_satis_g.simps as by simp\n ultimately show \"i \\ c3[z3::=V_var x]\\<^sub>v \" using assms is_satis_g.simps valid.simps \n by (metis append_g.simps(1) as wfI_replace_inside)\n qed\nqed\n\nlemma eval_v_weakening_x:\n fixes c::v\n assumes \"i' \\ c \\ ~ s\" and \"atom x \\ c\" and \"i = i' (x \\ s')\"\n shows \"i \\ c \\ ~ s\"\n using assms proof(induct rule: eval_v.induct)\n case (eval_v_litI i l)\n then show ?case using eval_v.intros by auto\nnext\n case (eval_v_varI sv i1 x1)\n hence \"x \\ x1\" using v.fresh fresh_at_base by auto\n hence \"i x1 = Some sv\" using eval_v_varI by simp\n then show ?case using eval_v.intros by auto\nnext\n case (eval_v_pairI i v1 s1 v2 s2)\n then show ?case using eval_v.intros by auto\nnext\n case (eval_v_consI i v s tyid dc)\n then show ?case using eval_v.intros by auto\nnext\n case (eval_v_conspI i v s tyid dc b)\n then show ?case using eval_v.intros by auto\nqed\n\nlemma eval_e_weakening_x:\n fixes c::ce\n assumes \"i' \\ c \\ ~ s\" and \"atom x \\ c\" and \"i = i' (x \\ s')\"\n shows \"i \\ c \\ ~ s\"\n using assms proof(induct rule: eval_e.induct)\n case (eval_e_valI i v sv)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_plusI i v1 n1 v2 n2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_leqI i v1 n1 v2 n2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_eqI i v1 n1 v2 n2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_fstI i v v1 v2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_sndI i v v1 v2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_concatI i v1 bv1 v2 bv2)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nnext\n case (eval_e_lenI i v bv)\n then show ?case using eval_v_weakening_x eval_e.intros ce.fresh by metis\nqed\n\nlemma eval_c_weakening_x:\n fixes c::c\n assumes \"i' \\ c \\ ~ s\" and \"atom x \\ c\" and \"i = i' (x \\ s')\"\n shows \"i \\ c \\ ~ s\"\n using assms proof(induct rule: eval_c.induct)\n case (eval_c_trueI i)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_falseI i)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_conjI i c1 b1 c2 b2)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_disjI i c1 b1 c2 b2)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_impI i c1 b1 c2 b2)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_notI i c b)\n then show ?case using eval_c.intros by auto\nnext\n case (eval_c_eqI i e1 sv1 e2 sv2)\n then show ?case using eval_e_weakening_x c.fresh eval_c.intros by metis\nqed\n\nlemma is_satis_weakening_x:\n fixes c::c\n assumes \"i' \\ c\" and \"atom x \\ c\" and \"i = i' (x \\ s)\"\n shows \"i \\ c\"\n using eval_c_weakening_x assms is_satis.simps by simp\n\nlemma is_satis_g_weakening_x:\n fixes G::\\\n assumes \"i' \\ G\" and \"atom x \\ G\" and \"i = i' (x \\ s)\"\n shows \"i \\ G\"\n using assms proof(induct G rule: \\_induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons x' b' c' \\')\n hence \"atom x \\ c'\" using fresh_GCons fresh_prodN by simp\n moreover hence \"i \\ c'\" using is_satis_weakening_x is_satis_g.simps(2) GCons by metis\n then show ?case using is_satis_g.simps(2)[of i x' b' c' \\'] GCons fresh_GCons by simp\nqed\n\nsection \\Base Type Substitution\\\n\ntext \\The idea of boxing is to take an smt val and its base type and at nodes in the smt val that correspond to type variables we\nwrap them in an SUt smt val node. Another way of looking at it is that s' where the node for the base type variable is an 'any node'.\nIt is needed to prove subst\\_b\\_valid - the base-type variable substitution lemma for validity.\n\nThe first @{text \"rcl_val\"} is the expanded form (has type with base-variables replaced with base-type terms)\n ; the second is its corresponding form\n\nWe only have one variable so we need to ensure that in all of the @{text \"bs_boxed_BVarI\"} cases, the s has the same\n base type.\n\nFor example is an SMT value is (SPair (SInt 1) (SBool true)) and it has sort (BPair (BVar x) BBool)[x::=BInt] then \nthe boxed version is SPair (SUt (SInt 1)) (SBool true) and is has sort (BPair (BVar x) BBool). We need to do this \nso that we can obtain from a valuation i, that gives values like the first smt value, to a valuation i' that gives values like\nthe second.\n\\\n\ninductive boxed_b :: \"\\ \\ rcl_val \\ b \\ bv \\ b \\ rcl_val \\ bool\" ( \" _ \\ _ ~ _ [ _ ::= _ ] \\ _ \" [50,50] 50) where \n boxed_b_BVar1I: \"\\ bv = bv' ; wfRCV P s b \\ \\ boxed_b P s (B_var bv') bv b (SUt s)\"\n| boxed_b_BVar2I: \"\\ bv \\ bv'; wfRCV P s (B_var bv') \\ \\ boxed_b P s (B_var bv') bv b s\"\n| boxed_b_BIntI:\"wfRCV P s B_int \\ boxed_b P s B_int _ _ s\"\n| boxed_b_BBoolI:\"wfRCV P s B_bool \\ boxed_b P s B_bool _ _ s \"\n| boxed_b_BUnitI:\"wfRCV P s B_unit \\ boxed_b P s B_unit _ _ s\"\n| boxed_b_BPairI:\"\\ boxed_b P s1 b1 bv b s1' ; boxed_b P s2 b2 bv b s2' \\ \\ boxed_b P (SPair s1 s2) (B_pair b1 b2) bv b (SPair s1' s2')\"\n\n| boxed_b_BConsI:\"\\ \n AF_typedef tyid dclist \\ set P;\n (dc, \\ x : b | c \\) \\ set dclist ;\n boxed_b P s1 b bv b' s1'\n \\ \\ \n boxed_b P (SCons tyid dc s1) (B_id tyid) bv b' (SCons tyid dc s1')\"\n\n| boxed_b_BConspI:\"\\ AF_typedef_poly tyid bva dclist \\ set P;\n atom bva \\ (b1,bv,b',s1,s1');\n (dc, \\ x : b | c \\) \\ set dclist ;\n boxed_b P s1 (b[bva::=b1]\\<^sub>b\\<^sub>b) bv b' s1' \n \\ \\ \n boxed_b P (SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s1) (B_app tyid b1) bv b' (SConsp tyid dc b1 s1')\"\n\n| boxed_b_Bbitvec: \"wfRCV P s B_bitvec \\ boxed_b P s B_bitvec bv b s\"\n\nequivariance boxed_b \nnominal_inductive boxed_b .\n\ninductive_cases boxed_b_elims:\n \"boxed_b P s (B_var bv) bv' b s'\"\n \"boxed_b P s B_int bv b s'\"\n \"boxed_b P s B_bool bv b s'\"\n \"boxed_b P s B_unit bv b s'\"\n \"boxed_b P s (B_pair b1 b2) bv b s'\"\n \"boxed_b P s (B_id dc) bv b s'\"\n \"boxed_b P s B_bitvec bv b s'\"\n \"boxed_b P s (B_app dc b') bv b s'\"\n\nlemma boxed_b_wfRCV:\n assumes \"boxed_b P s b bv b' s'\" (*and \"supp s = {}\"*) and \"\\\\<^sub>w\\<^sub>f P\"\n shows \"wfRCV P s b[bv::=b']\\<^sub>b\\<^sub>b \\ wfRCV P s' b\"\n using assms proof(induct rule: boxed_b.inducts)\n case (boxed_b_BVar1I bv bv' P s b )\n then show ?case using wfRCV.intros by auto\nnext\n case (boxed_b_BVar2I bv bv' P s )\n then show ?case using wfRCV.intros by auto\nnext\n case (boxed_b_BPairI P s1 b1 bv b s1' s2 b2 s2')\n then show ?case using wfRCV.intros rcl_val.supp by simp\nnext\n case (boxed_b_BConsI tyid dclist P dc x b c s1 bv b' s1')\n hence \"supp b = {}\" using wfTh_supp_b by metis\n hence \"b [ bv ::= b' ]\\<^sub>b\\<^sub>b = b\" using fresh_def subst_b_b_def forget_subst[of \"bv\" b b'] by auto\n hence \" P \\ SCons tyid dc s1 : (B_id tyid)\" using wfRCV.intros rcl_val.supp subst_bb.simps boxed_b_BConsI by metis\n moreover have \"P \\ SCons tyid dc s1' : B_id tyid\" using boxed_b_BConsI \n using wfRCV.intros rcl_val.supp subst_bb.simps boxed_b_BConsI by metis\n ultimately show ?case using subst_bb.simps by metis\nnext\n case (boxed_b_BConspI tyid bva dclist P b1 bv b' s1 s1' dc x b c)\n\n obtain bva2 and dclist2 where *:\"AF_typedef_poly tyid bva dclist = AF_typedef_poly tyid bva2 dclist2 \\ \n atom bva2 \\ (bv,(P, SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s1, B_app tyid b1[bv::=b']\\<^sub>b\\<^sub>b))\" \n using obtain_fresh_bv by metis\n\n then obtain x2 and b2 and c2 where **:\\(dc, \\ x2 : b2 | c2 \\) \\ set dclist2\\ \n using boxed_b_BConspI td_lookup_eq_iff type_def.eq_iff by metis\n\n have \"P \\ SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s1 : (B_app tyid b1[bv::=b']\\<^sub>b\\<^sub>b)\" proof\n show 1: \\AF_typedef_poly tyid bva2 dclist2 \\ set P\\ using boxed_b_BConspI * by auto\n show 2: \\(dc, \\ x2 : b2 | c2 \\) \\ set dclist2\\ using boxed_b_BConspI using ** by simp\n\n hence \"atom bv \\ b2\" proof -\n have \"supp b2 \\ { atom bva2 }\" using wfTh_poly_supp_b 1 2 boxed_b_BConspI by auto\n moreover have \"bv \\ bva2\" using * fresh_Pair fresh_at_base by metis\n ultimately show ?thesis using fresh_def by force\n qed\n moreover have \"b[bva::=b1]\\<^sub>b\\<^sub>b = b2[bva2::=b1]\\<^sub>b\\<^sub>b\" using wfTh_typedef_poly_b_eq_iff * 2 boxed_b_BConspI by metis\n ultimately show \\ P \\ s1 : b2[bva2::=b1[bv::=b']\\<^sub>b\\<^sub>b]\\<^sub>b\\<^sub>b\\ using boxed_b_BConspI subst_b_b_def subst_bb_commute by auto\n show \"atom bva2 \\ (P, SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s1, B_app tyid b1[bv::=b']\\<^sub>b\\<^sub>b)\" using * fresh_Pair by metis\n qed\n\n moreover have \"P \\ SConsp tyid dc b1 s1' : B_app tyid b1\" proof\n show \\AF_typedef_poly tyid bva dclist \\ set P\\ using boxed_b_BConspI by auto\n show \\(dc, \\ x : b | c \\) \\ set dclist\\ using boxed_b_BConspI by auto\n show \\ P \\ s1' : b[bva::=b1]\\<^sub>b\\<^sub>b\\ using boxed_b_BConspI by auto\n have \"atom bva \\ P\" using boxed_b_BConspI wfTh_fresh by metis\n thus \"atom bva \\ (P, SConsp tyid dc b1 s1', B_app tyid b1)\" using boxed_b_BConspI rcl_val.fresh b.fresh pure_fresh fresh_prodN by metis\n qed\n\n ultimately show ?case using subst_bb.simps by simp\nqed(auto)+\n\nlemma subst_b_var:\n assumes \"B_var bv2 = b[bv::=b']\\<^sub>b\\<^sub>b\"\n shows \"(b = B_var bv \\ b' = B_var bv2) \\ (b=B_var bv2 \\ bv \\ bv2)\"\n using assms by(nominal_induct b rule: b.strong_induct,auto+)\n\ntext \\Here the valuation i' is the conv wrap version of i. For every x in G, i' x is the conv wrap version of i x.\nThe next lemma for a clearer explanation of what this is. i produces values of sort b[bv::=b'] and i' produces values of sort b\\\n\ninductive boxed_i :: \"\\ \\ \\ \\ b \\ bv \\ valuation \\ valuation \\ bool\" ( \" _ ; _ ; _ , _ \\ _ \\ _\" [50,50] 50) where\n boxed_i_GNilI: \"\\ ; GNil ; b , bv \\ i \\ i\"\n| boxed_i_GConsI: \"\\ Some s = i x; boxed_b \\ s b bv b' s' ; \\ ; \\ ; b' , bv \\ i \\ i' \\ \\ \\ ; ((x,b,c)#\\<^sub>\\\\) ; b' , bv \\ i \\ (i'(x \\ s'))\"\nequivariance boxed_i\nnominal_inductive boxed_i .\n\ninductive_cases boxed_i_elims:\n \"\\ ;GNil ; b , bv \\ i \\ i'\"\n \"\\ ; ((x,b,c)#\\<^sub>\\\\) ; b' , bv \\ i \\ i'\"\n\nlemma wfRCV_poly_elims:\n fixes tm::\"'a::fs\" and b::b\n assumes \"T \\ SConsp typid dc bdc s : b\" \n obtains bva dclist x1 b1 c1 where \"b = B_app typid bdc \\\n AF_typedef_poly typid bva dclist \\ set T \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist \\ T \\ s : b1[bva::=bdc]\\<^sub>b\\<^sub>b \\ atom bva \\ tm\" \n using assms proof(nominal_induct \"SConsp typid dc bdc s\" b avoiding: tm rule:wfRCV.strong_induct)\n case (wfRCV_BConsPI bv dclist \\ x b c)\n then show ?case by simp\nqed\n\nlemma boxed_b_ex:\n assumes \"wfRCV T s b[bv::=b']\\<^sub>b\\<^sub>b\" and \"wfTh T\"\n shows \"\\s'. boxed_b T s b bv b' s'\"\n using assms proof(nominal_induct s arbitrary: b rule: rcl_val.strong_induct)\n case (SBitvec x)\n have *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_bitvec\" using wfRCV_elims(9)[OF SBitvec(1)] by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SBitvec x : B_bitvec\" using wfRCV.intros by simp\n moreover hence \"b' = B_bitvec\" using True SBitvec subst_bb.simps * by simp\n ultimately show ?thesis using boxed_b.intros wfRCV.intros by metis\n next\n case False\n hence \"b = B_bitvec\" using subst_bb_inject * by metis \n then show ?thesis using * SBitvec boxed_b.intros by metis\n qed\nnext\n case (SNum x)\n have *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_int\" using wfRCV_elims(10)[OF SNum(1)] by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SNum x : B_int\" using wfRCV.intros by simp\n moreover hence \"b' = B_int\" using True SNum subst_bb.simps(1) * by simp\n ultimately show ?thesis using boxed_b_BVar1I wfRCV.intros by metis\n next\n case False\n hence \"b = B_int\" using subst_bb_inject(1) * by metis \n then show ?thesis using * SNum boxed_b_BIntI by metis\n qed\nnext\n case (SBool x)\n have *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_bool\" using wfRCV_elims(11)[OF SBool(1)] by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SBool x : B_bool\" using wfRCV.intros by simp\n moreover hence \"b' = B_bool\" using True SBool subst_bb.simps * by simp\n ultimately show ?thesis using boxed_b.intros wfRCV.intros by metis\n next\n case False\n hence \"b = B_bool\" using subst_bb_inject * by metis \n then show ?thesis using * SBool boxed_b.intros by metis\n qed\nnext\n case (SPair s1 s2)\n then obtain b1 and b2 where *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_pair b1 b2 \\ wfRCV T s1 b1 \\ wfRCV T s2 b2\" using wfRCV_elims(12) by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SPair s1 s2 : B_pair b1 b2\" using wfRCV.intros * by simp\n moreover hence \"b' = B_pair b1 b2\" using True SPair subst_bb.simps(1) * by simp\n ultimately show ?thesis using boxed_b_BVar1I by metis\n next\n case False\n then obtain b1' and b2' where \"b = B_pair b1' b2' \\ b1=b1'[bv::=b']\\<^sub>b\\<^sub>b \\ b2=b2'[bv::=b']\\<^sub>b\\<^sub>b\" using subst_bb_inject(5)[OF _ False ] * by metis\n then show ?thesis using * SPair boxed_b_BPairI by blast\n qed\nnext\n case (SCons tyid dc s1)\n have *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_id tyid\" using wfRCV_elims(13)[OF SCons(2)] by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SCons tyid dc s1 : B_id tyid\" using wfRCV.intros \n using \"local.*\" SCons.prems by auto\n moreover hence \"b' = B_id tyid\" using True SCons subst_bb.simps(1) * by simp\n ultimately show ?thesis using boxed_b_BVar1I wfRCV.intros by metis\n next\n case False\n then obtain b1' where beq: \"b = B_id tyid\" using subst_bb_inject * by metis \n then obtain b2 dclist x c where **:\"AF_typedef tyid dclist \\ set T \\ (dc, \\ x : b2 | c \\) \\ set dclist \\ wfRCV T s1 b2\" using wfRCV_elims(13) * SCons by metis\n then have \"atom bv \\ b2\" using \\wfTh T\\ wfTh_lookup_supp_empty[of tyid dclist T dc \"\\ x : b2 | c \\\"] \\.fresh fresh_def by auto\n then have \"b2 = b2[ bv ::= b']\\<^sub>b\\<^sub>b\" using forget_subst subst_b_b_def by metis\n then obtain s1' where s1:\"T \\ s1 ~ b2 [ bv ::= b' ] \\ s1'\" using SCons ** by metis\n\n have \"T \\ SCons tyid dc s1 ~ (B_id tyid) [ bv ::= b' ] \\ SCons tyid dc s1'\" proof(rule boxed_b_BConsI)\n show \"AF_typedef tyid dclist \\ set T\" using ** by auto\n show \"(dc, \\ x : b2 | c \\) \\ set dclist\" using ** by auto\n show \"T \\ s1 ~ b2 [ bv ::= b' ] \\ s1' \" using s1 ** by auto\n\n qed\n thus ?thesis using beq by metis\n qed\nnext\n case (SConsp typid dc bdc s)\n\n obtain bva dclist x1 b1 c1 where **:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_app typid bdc \\\n AF_typedef_poly typid bva dclist \\ set T \\ (dc, \\ x1 : b1 | c1 \\) \\ set dclist \\ T \\ s : b1[bva::=bdc]\\<^sub>b\\<^sub>b \\ atom bva \\ bv\"\n using wfRCV_poly_elims[OF SConsp(2)] by metis\n\n then have *:\"B_app typid bdc = b[bv::=b']\\<^sub>b\\<^sub>b\" using wfRCV_elims(14)[OF SConsp(2)] by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SConsp typid dc bdc s : B_app typid bdc\" using wfRCV.intros \n using \"local.*\" SConsp.prems(1) by auto\n moreover hence \"b' = B_app typid bdc\" using True SConsp subst_bb.simps * by simp\n ultimately show ?thesis using boxed_b.intros wfRCV.intros by metis\n next\n case False\n then obtain bdc' where bdc: \"b = B_app typid bdc' \\ bdc = bdc'[bv::=b']\\<^sub>b\\<^sub>b\" using * subst_bb_inject(8)[OF *] by metis\n (*hence beq:\"b = B_app typid bdc\" using subst_bb_inject * sory (* going to be like the above as bdc is closed *)*)\n have \"atom bv \\ b1\" proof -\n have \"supp b1 \\ { atom bva }\" using wfTh_poly_supp_b ** SConsp by metis\n moreover have \"bv \\ bva\" using ** by auto\n ultimately show ?thesis using fresh_def by force\n qed \n have \"T \\ s : b1[bva::=bdc]\\<^sub>b\\<^sub>b\" using ** by auto\n moreover have \"b1[bva::=bdc']\\<^sub>b\\<^sub>b[bv::=b']\\<^sub>b\\<^sub>b = b1[bva::=bdc]\\<^sub>b\\<^sub>b\" using bdc subst_bb_commute \\atom bv \\ b1\\ by auto\n ultimately obtain s' where s':\"T \\ s ~ b1[bva::=bdc']\\<^sub>b\\<^sub>b [ bv ::= b' ] \\ s'\" \n using SConsp(1)[of \"b1[bva::=bdc']\\<^sub>b\\<^sub>b\"] bdc SConsp by metis\n have \"T \\ SConsp typid dc bdc'[bv::=b']\\<^sub>b\\<^sub>b s ~ (B_app typid bdc') [ bv ::= b' ] \\ SConsp typid dc bdc' s'\" \n proof - \n\n obtain bva3 and dclist3 where 3:\"AF_typedef_poly typid bva3 dclist3 = AF_typedef_poly typid bva dclist \\ \n atom bva3 \\ (bdc', bv, b', s, s')\" using obtain_fresh_bv by metis\n then obtain x3 b3 c3 where 4:\"(dc, \\ x3 : b3 | c3 \\) \\ set dclist3\" \n using boxed_b_BConspI td_lookup_eq_iff type_def.eq_iff \n by (metis \"**\")\n\n show ?thesis proof\n show \\AF_typedef_poly typid bva3 dclist3 \\ set T\\ using 3 ** by metis \n show \\atom bva3 \\ (bdc', bv, b', s, s')\\ using 3 by metis\n show 4:\\(dc, \\ x3 : b3 | c3 \\) \\ set dclist3\\ using 4 by auto\n have \"b3[bva3::=bdc']\\<^sub>b\\<^sub>b = b1[bva::=bdc']\\<^sub>b\\<^sub>b\" proof(rule wfTh_typedef_poly_b_eq_iff)\n show \\AF_typedef_poly typid bva3 dclist3 \\ set T\\ using 3 ** by metis\n show \\(dc, \\ x3 : b3 | c3 \\) \\ set dclist3\\ using 4 by auto\n show \\AF_typedef_poly typid bva dclist \\ set T\\ using ** by auto\n show \\(dc, \\ x1 : b1 | c1 \\) \\ set dclist\\ using ** by auto\n qed(simp add: ** SConsp)\n thus \\ T \\ s ~ b3[bva3::=bdc']\\<^sub>b\\<^sub>b [ bv ::= b' ] \\ s' \\ using s' by auto\n qed\n qed\n then show ?thesis using bdc by auto\n\n qed\nnext \n case SUnit\n have *:\"b[bv::=b']\\<^sub>b\\<^sub>b = B_unit\" using wfRCV_elims SUnit by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n moreover have \"T \\ SUnit : B_unit\" using wfRCV.intros by simp\n moreover hence \"b' = B_unit\" using True SUnit subst_bb.simps * by simp\n ultimately show ?thesis using boxed_b.intros wfRCV.intros by metis\n next\n case False\n hence \"b = B_unit\" using subst_bb_inject * by metis \n then show ?thesis using * SUnit boxed_b.intros by metis\n qed\nnext\n case (SUt x) \n then obtain bv' where *:\"b[bv::=b']\\<^sub>b\\<^sub>b= B_var bv'\" using wfRCV_elims by metis\n show ?case proof (cases \"b = B_var bv\")\n case True\n then show ?thesis using boxed_b_BVar1I \n using \"local.*\" wfRCV_BVarI by fastforce\n next\n case False\n then show ?thesis using boxed_b_BVar1I boxed_b_BVar2I\n using \"local.*\" wfRCV_BVarI by (metis subst_b_var)\n qed\nqed\n\nlemma boxed_i_ex:\n assumes \"wfI T \\[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"wfTh T\"\n shows \"\\i'. T ; \\ ; b , bv \\ i \\ i'\"\n using assms proof(induct \\ arbitrary: i rule:\\_induct)\n case GNil\n then show ?case using boxed_i_GNilI by metis\nnext\n case (GCons x' b' c' \\')\n then obtain s where 1:\"Some s = i x' \\ wfRCV T s b'[bv::=b]\\<^sub>b\\<^sub>b\" using wfI_def subst_gb.simps by auto\n then obtain s' where 2: \"boxed_b T s b' bv b s'\" using boxed_b_ex GCons by metis\n then obtain i' where 3: \"boxed_i T \\' b bv i i'\" using GCons wfI_def subst_gb.simps by force\n have \"boxed_i T ((x', b', c') #\\<^sub>\\ \\') b bv i (i'(x' \\ s'))\" proof\n show \"Some s = i x'\" using 1 by auto\n show \"boxed_b T s b' bv b s'\" using 2 by auto\n show \"T ; \\' ; b , bv \\ i \\ i'\" using \"3\" by auto\n qed\n thus ?case by auto\nqed\n\nlemma boxed_b_eq:\n assumes \"boxed_b \\ s1 b bv b' s1'\" and \"\\\\<^sub>w\\<^sub>f \\\"\n shows \"wfTh \\ \\ boxed_b \\ s2 b bv b' s2' \\ ( s1 = s2 ) = ( s1' = s2' )\"\n using assms proof(induct arbitrary: s2 s2' rule: boxed_b.inducts )\n case (boxed_b_BVar1I bv bv' P s b ) \n then show ?case \n using boxed_b_elims(1) rcl_val.eq_iff by metis\nnext\n case (boxed_b_BVar2I bv bv' P s b)\n then show ?case using boxed_b_elims(1) by metis\nnext\n case (boxed_b_BIntI P s uu uv)\n hence \"s2 = s2'\" using boxed_b_elims by metis\n then show ?case by auto\nnext\n case (boxed_b_BBoolI P s uw ux)\n hence \"s2 = s2'\" using boxed_b_elims by metis\n then show ?case by auto\nnext\n case (boxed_b_BUnitI P s uy uz)\n hence \"s2 = s2'\" using boxed_b_elims by metis\n then show ?case by auto\nnext\n case (boxed_b_BPairI P s1 b1 bv b s1' s2a b2 s2a')\n then show ?case\n by (metis boxed_b_elims(5) rcl_val.eq_iff(4))\nnext\n case (boxed_b_BConsI tyid dclist P dc x b c s1 bv b' s1')\n obtain s22 and s22' dclist2 dc2 x2 b2 c2 where *:\"s2 = SCons tyid dc2 s22 \\ s2' = SCons tyid dc2 s22' \\ boxed_b P s22 b2 bv b' s22' \n \\ AF_typedef tyid dclist2 \\ set P \\ (dc2, \\ x2 : b2 | c2 \\) \\ set dclist2\" using boxed_b_elims(6)[OF boxed_b_BConsI(6)] by metis\n show ?case proof(cases \"dc = dc2\")\n case True\n hence \"b = b2\" using wfTh_ctor_unique \\.eq_iff wfTh_dclist_unique wf boxed_b_BConsI * by metis\n then show ?thesis using boxed_b_BConsI True * by auto\n next\n case False\n then show ?thesis using * boxed_b_BConsI by simp\n qed \nnext\n case (boxed_b_Bbitvec P s bv b)\n hence \"s2 = s2'\" using boxed_b_elims by metis\n then show ?case by auto\nnext\n case (boxed_b_BConspI tyid bva dclist P b1 bv b' s1 s1' dc x b c)\n obtain bva2 s22 s22' dclist2 dc2 x2 b2 c2 where *:\"\n s2 = SConsp tyid dc2 b1[bv::=b']\\<^sub>b\\<^sub>b s22 \\ \n s2' = SConsp tyid dc2 b1 s22' \\ \n boxed_b P s22 b2[bva2::=b1]\\<^sub>b\\<^sub>b bv b' s22' \\ \n AF_typedef_poly tyid bva2 dclist2 \\ set P \\ (dc2, \\ x2 : b2 | c2 \\) \\ set dclist2\" using boxed_b_elims(8)[OF boxed_b_BConspI(7)] by metis\n show ?case proof(cases \"dc = dc2\")\n case True\n hence \"AF_typedef_poly tyid bva2 dclist2 \\ set P \\ (dc, \\ x2 : b2 | c2 \\) \\ set dclist2\" using * by auto\n hence \"b[bva::=b1]\\<^sub>b\\<^sub>b = b2[bva2::=b1]\\<^sub>b\\<^sub>b\" using wfTh_typedef_poly_b_eq_iff[OF boxed_b_BConspI(1) boxed_b_BConspI(3)] * boxed_b_BConspI by metis\n then show ?thesis using boxed_b_BConspI True * by auto\n next\n case False\n then show ?thesis using * boxed_b_BConspI by simp\n qed \nqed\n\nlemma bs_boxed_var:\n assumes \"boxed_i \\ \\ b' bv i i'\"\n shows \"Some (b,c) = lookup \\ x \\ Some s = i x \\ Some s' = i' x \\ boxed_b \\ s b bv b' s'\"\n using assms proof(induct rule: boxed_i.inducts)\n case (boxed_i_GNilI T i)\n then show ?case using lookup.simps by auto\nnext\n case (boxed_i_GConsI s i x1 \\ b1 bv b' s' \\ i' c)\n show ?case proof (cases \"x=x1\")\n case True\n then show ?thesis using boxed_i_GConsI\n fun_upd_same lookup.simps(2) option.inject prod.inject by metis\n next\n case False\n then show ?thesis using boxed_i_GConsI\n fun_upd_same lookup.simps option.inject prod.inject by auto\n qed\nqed\n\nlemma eval_l_boxed_b:\n assumes \"\\ l \\ = s\"\n shows \"boxed_b \\ s (base_for_lit l) bv b' s\"\n using assms proof(nominal_induct l arbitrary: s rule:l.strong_induct)\nqed(auto simp add: boxed_b.intros wfRCV.intros )+\n\nlemma boxed_i_eval_v_boxed_b:\n fixes v::v\n assumes \"boxed_i \\ \\ b' bv i i'\" and \"i \\ v[bv::=b']\\<^sub>v\\<^sub>b \\ ~ s\" and \"i' \\ v \\ ~ s'\" and \"wfV \\ B \\ v b\" and \"wfI \\ \\ i'\"\n shows \"boxed_b \\ s b bv b' s'\"\n using assms proof(nominal_induct v arbitrary: s s' b rule:v.strong_induct)\n case (V_lit l)\n hence \"\\ l \\ = s \\ \\ l \\ = s'\" using eval_v_elims by auto\n moreover have \"b = base_for_lit l\" using wfV_elims(2) V_lit by metis\n ultimately show ?case using V_lit using eval_l_boxed_b subst_b_base_for_lit by metis\nnext\n case (V_var x) (* look at defn of bs_boxed *)\n hence \"Some s = i x \\ Some s' = i' x\" using eval_v_elims subst_vb.simps by metis\n moreover obtain c1 where bc:\"Some (b,c1) = lookup \\ x\" using wfV_elims V_var by metis\n ultimately show ?case using bs_boxed_var V_var by metis\n\nnext\n case (V_pair v1 v2)\n then obtain b1 and b2 where b:\"b=B_pair b1 b2\" using wfV_elims subst_vb.simps by metis\n obtain s1 and s2 where s: \"eval_v i (v1[bv::=b']\\<^sub>v\\<^sub>b) s1 \\ eval_v i (v2[bv::=b']\\<^sub>v\\<^sub>b) s2 \\ s = SPair s1 s2\" using eval_v_elims V_pair subst_vb.simps by metis\n obtain s1' and s2' where s': \"eval_v i' v1 s1' \\ eval_v i' v2 s2' \\ s' = SPair s1' s2'\" using eval_v_elims V_pair by metis\n have \"boxed_b \\ (SPair s1 s2) (B_pair b1 b2) bv b' (SPair s1' s2') \" proof(rule boxed_b_BPairI)\n show \"boxed_b \\ s1 b1 bv b' s1'\" using V_pair eval_v_elims wfV_elims b s s' b.eq_iff by metis\n show \"boxed_b \\ s2 b2 bv b' s2'\" using V_pair eval_v_elims wfV_elims b s s' b.eq_iff by metis\n qed\n then show ?case using s s' b by auto\nnext\n case (V_cons tyid dc v1)\n\n obtain dclist x b1 c where *: \"b = B_id tyid \\ AF_typedef tyid dclist \\ set \\ \\ (dc, \\ x : b1 | c \\) \\ set dclist \\ \\ ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : b1\"\n using wfV_elims(4)[OF V_cons(5)] V_cons by metis\n obtain s2 where s2: \"s = SCons tyid dc s2 \\ i \\ (v1[bv::=b']\\<^sub>v\\<^sub>b) \\ ~ s2\" using eval_v_elims V_cons subst_vb.simps by metis\n obtain s2' where s2': \"s' = SCons tyid dc s2' \\ i' \\ v1 \\ ~ s2'\" using eval_v_elims V_cons by metis\n have sp: \"supp \\ x : b1 | c \\ = {}\" using wfTh_lookup_supp_empty * wfX_wfY by metis\n\n have \"boxed_b \\ (SCons tyid dc s2) (B_id tyid) bv b' (SCons tyid dc s2')\"\n proof(rule boxed_b_BConsI)\n show 1:\"AF_typedef tyid dclist \\ set \\\" using * by auto\n show 2:\"(dc, \\ x : b1 | c \\) \\ set dclist\" using * by auto\n have bvf:\"atom bv \\ b1\" using sp \\.fresh fresh_def by auto \n show \"\\ \\ s2 ~ b1 [ bv ::= b' ] \\ s2'\" using V_cons s2 s2' * by metis\n qed\n then show ?case using * s2 s2' by simp\nnext\n case (V_consp tyid dc b1 v1)\n\n obtain bv2 dclist x2 b2 c2 where *: \"b = B_app tyid b1 \\ AF_typedef_poly tyid bv2 dclist \\ set \\ \\ \n (dc, \\ x2 : b2 | c2 \\) \\ set dclist \\ \\ ; B ; \\ \\\\<^sub>w\\<^sub>f v1 : b2[bv2::=b1]\\<^sub>b\\<^sub>b\"\n using wf_strong_elim(1)[OF V_consp (5)] by metis\n\n obtain s2 where s2: \"s = SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s2 \\ i \\ (v1[bv::=b']\\<^sub>v\\<^sub>b) \\ ~ s2\" \n using eval_v_elims V_consp subst_vb.simps by metis\n\n obtain s2' where s2': \"s' = SConsp tyid dc b1 s2' \\ i' \\ v1 \\ ~ s2'\" \n using eval_v_elims V_consp by metis\n\n have \"\\\\<^sub>w\\<^sub>f \\\" using V_consp wfX_wfY by metis\n then obtain bv3::bv and dclist3 x3 b3 c3 where **:\" AF_typedef_poly tyid bv2 dclist = AF_typedef_poly tyid bv3 dclist3 \\\n (dc, \\ x3 : b3 | c3 \\) \\ set dclist3 \\ atom bv3 \\ (b1, bv, b', s2, s2') \\ b2[bv2::=b1]\\<^sub>b\\<^sub>b = b3[bv3::=b1]\\<^sub>b\\<^sub>b\"\n using * obtain_fresh_bv_dclist_b_iff[where tm=\"(b1, bv, b', s2, s2')\"] by metis\n\n have \"boxed_b \\ (SConsp tyid dc b1[bv::=b']\\<^sub>b\\<^sub>b s2) (B_app tyid b1) bv b' (SConsp tyid dc b1 s2')\"\n proof(rule boxed_b_BConspI[of tyid bv3 dclist3 \\, where x=x3 and b=b3 and c=c3])\n show 1:\"AF_typedef_poly tyid bv3 dclist3 \\ set \\\" using * ** by auto\n show 2:\"(dc, \\ x3 : b3 | c3 \\) \\ set dclist3\" using ** by auto\n show \"atom bv3 \\ (b1, bv, b', s2, s2')\" using ** by auto \n show \" \\ \\ s2 ~ b3[bv3::=b1]\\<^sub>b\\<^sub>b [ bv ::= b' ] \\ s2'\" using V_consp s2 s2' * ** by metis\n qed\n then show ?case using * s2 s2' by simp\nqed\n\nlemma boxed_b_eq_eq:\n assumes \"boxed_b \\ n1 b1 bv b' n1'\" and \"boxed_b \\ n2 b1 bv b' n2'\" and \"s = SBool (n1 = n2)\" and \"\\\\<^sub>w\\<^sub>f \\\"\n \"s' = SBool (n1' = n2')\"\n shows \"s=s'\" \n using boxed_b_eq assms by auto\n\nlemma boxed_i_eval_ce_boxed_b:\n fixes e::ce\n assumes \"i' \\ e \\ ~ s'\" and \"i \\ e[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ s\" and \"wfCE \\ B \\ e b\" and \"boxed_i \\ \\ b' bv i i'\" and \"wfI \\ \\ i'\"\n shows \"boxed_b \\ s b bv b' s'\"\n using assms proof(nominal_induct e arbitrary: s s' b b' rule: ce.strong_induct)\n case (CE_val x)\n then show ?case using boxed_i_eval_v_boxed_b eval_e_elims wfCE_elims subst_ceb.simps by metis\nnext\n case (CE_op opp v1 v2)\n\n show ?case proof(rule opp.exhaust)\n assume \\opp = Plus\\\n have 1:\"wfCE \\ B \\ v1 (B_int)\" using wfCE_elims CE_op \\opp = Plus\\ by metis\n have 2:\"wfCE \\ B \\ v2 (B_int)\" using wfCE_elims CE_op \\opp = Plus\\ by metis\n have *:\"b = B_int\" using CE_op wfCE_elims \n by (metis \\opp = plus\\)\n\n obtain n1 and n2 where n:\"s = SNum (n1 + n2) \\ i \\ v1[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SNum n1 \\ i \\ v2[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SNum n2\" using eval_e_elims CE_op subst_ceb.simps \\opp = plus\\ by metis\n obtain n1' and n2' where n':\"s' = SNum (n1' + n2') \\ i' \\ v1 \\ ~ SNum n1' \\ i' \\ v2 \\ ~ SNum n2'\" using eval_e_elims Plus CE_op \\opp = plus\\ by metis\n\n have \"boxed_b \\ (SNum n1) B_int bv b' (SNum n1')\" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op \\opp = plus\\ by metis\n moreover have \"boxed_b \\ (SNum n2) B_int bv b' (SNum n2')\" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis\n ultimately have \"s=s'\" using n' n boxed_b_elims(2)\n by (metis rcl_val.eq_iff(2))\n thus ?thesis using * n n' boxed_b_BIntI CE_op wfRCV.intros Plus by simp\n next\n assume \\opp = LEq\\\n have 1:\"wfCE \\ B \\ v1 (B_int)\" using wfCE_elims CE_op \\opp = LEq\\ by metis\n have 2:\"wfCE \\ B \\ v2 (B_int)\" using wfCE_elims CE_op \\opp = LEq\\ by metis\n hence *:\"b = B_bool\" using CE_op wfCE_elims \\opp = LEq\\ by metis\n obtain n1 and n2 where n:\"s = SBool (n1 \\ n2) \\ i \\ v1[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SNum n1 \\ i \\ v2[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SNum n2\" using eval_e_elims subst_ceb.simps CE_op \\opp = LEq\\ by metis\n obtain n1' and n2' where n':\"s' = SBool (n1' \\ n2') \\ i' \\ v1 \\ ~ SNum n1' \\ i' \\ v2 \\ ~ SNum n2'\" using eval_e_elims CE_op \\opp = LEq\\ by metis\n\n have \"boxed_b \\ (SNum n1) B_int bv b' (SNum n1')\" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis\n moreover have \"boxed_b \\ (SNum n2) B_int bv b' (SNum n2')\" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis\n ultimately have \"s=s'\" using n' n boxed_b_elims(2)\n by (metis rcl_val.eq_iff(2))\n thus ?thesis using * n n' boxed_b_BBoolI CE_op wfRCV.intros \\opp = LEq\\ by simp\n next\n assume \\opp = Eq\\\n obtain b1 where b1:\"wfCE \\ B \\ v1 b1 \\ wfCE \\ B \\ v2 b1\" using wfCE_elims CE_op \\opp = Eq\\ by metis\n\n hence *:\"b = B_bool\" using CE_op wfCE_elims \\opp = Eq\\ by metis\n obtain n1 and n2 where n:\"s = SBool (n1 = n2) \\ i \\ v1[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ n1 \\ i \\ v2[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ n2\" using eval_e_elims subst_ceb.simps CE_op \\opp = Eq\\ by metis\n obtain n1' and n2' where n':\"s' = SBool (n1' = n2') \\ i' \\ v1 \\ ~ n1' \\ i' \\ v2 \\ ~ n2'\" using eval_e_elims CE_op \\opp = Eq\\ by metis\n\n have \"boxed_b \\ n1 b1 bv b' n1'\" using boxed_i_eval_v_boxed_b b1 n n' CE_op by metis\n moreover have \"boxed_b \\ n2 b1 bv b' n2'\" using boxed_i_eval_v_boxed_b b1 n n' CE_op by metis\n moreover have \"\\\\<^sub>w\\<^sub>f \\\" using b1 wfX_wfY by metis\n ultimately have \"s=s'\" using n' n boxed_b_elims\n boxed_b_eq_eq by metis\n thus ?thesis using * n n' boxed_b_BBoolI CE_op wfRCV.intros \\opp = Eq\\ by simp\n qed\n\nnext\n case (CE_concat v1 v2)\n\n obtain bv1 and bv2 where s : \"s = SBitvec (bv1 @ bv2) \\ (i \\ v1[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SBitvec bv1) \\ i \\ v2[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SBitvec bv2\"\n using eval_e_elims(7) subst_ceb.simps CE_concat.prems(2) eval_e_elims(6) subst_ceb.simps(6) by metis\n obtain bv1' and bv2' where s' : \"s' = SBitvec (bv1' @ bv2') \\ i' \\ v1 \\ ~ SBitvec bv1' \\ i' \\ v2 \\ ~ SBitvec bv2'\"\n using eval_e_elims(7) CE_concat by metis\n\n then show ?case using boxed_i_eval_v_boxed_b wfCE_elims s s' CE_concat \n by (metis CE_concat.prems(3) assms assms(5) wfRCV_BBitvecI boxed_b_Bbitvec boxed_b_elims(7) eval_e_concatI eval_e_uniqueness)\nnext\n case (CE_fst ce)\n obtain s2 where 1:\"i \\ ce[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SPair s s2\" using CE_fst eval_e_elims subst_ceb.simps by metis\n obtain s2' where 2:\"i' \\ ce \\ ~ SPair s' s2'\" using CE_fst eval_e_elims by metis\n obtain b2 where 3:\"wfCE \\ B \\ ce (B_pair b b2)\" using wfCE_elims(4) CE_fst by metis\n\n have \"boxed_b \\ (SPair s s2) (B_pair b b2) bv b' (SPair s' s2')\" \n using 1 2 3 CE_fst boxed_i_eval_v_boxed_b boxed_b_BPairI by auto\n thus ?case using boxed_b_elims(5) by force\nnext\n case (CE_snd v)\n obtain s1 where 1:\"i \\ v[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SPair s1 s\" using CE_snd eval_e_elims subst_ceb.simps by metis\n obtain s1' where 2:\"i' \\ v \\ ~ SPair s1' s'\" using CE_snd eval_e_elims by metis\n obtain b1 where 3:\"wfCE \\ B \\ v (B_pair b1 b )\" using wfCE_elims(5) CE_snd by metis\n\n have \"boxed_b \\ (SPair s1 s ) (B_pair b1 b ) bv b' (SPair s1' s')\" using 1 2 3 CE_snd boxed_i_eval_v_boxed_b by simp\n thus ?case using boxed_b_elims(5) by force\nnext\n case (CE_len v)\n obtain s1 where s: \"i \\ v[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b \\ ~ SBitvec s1\" using CE_len eval_e_elims subst_ceb.simps by metis\n obtain s1' where s': \"i' \\ v \\ ~ SBitvec s1'\" using CE_len eval_e_elims by metis\n\n have \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f v : B_bitvec \\ b = B_int\" using wfCE_elims CE_len by metis\n then show ?case using boxed_i_eval_v_boxed_b s s' CE_len \n by (metis boxed_b_BIntI boxed_b_elims(7) eval_e_lenI eval_e_uniqueness subst_ceb.simps(5) wfI_wfCE_eval_e)\nqed\n\nlemma eval_c_eq_bs_boxed:\n fixes c::c\n assumes \"i \\ c[bv::=b]\\<^sub>c\\<^sub>b \\ ~ s\" and \"i' \\ c \\ ~ s'\" and \"wfC \\ B \\ c\" and \"wfI \\ \\ i'\" and \"\\ ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ i \"\n and \"boxed_i \\ \\ b bv i i'\"\n shows \"s = s'\"\n using assms proof(nominal_induct c arbitrary: s s' rule:c.strong_induct)\n case C_true\n then show ?case using eval_c_elims subst_cb.simps by metis\nnext\n case C_false\n then show ?case using eval_c_elims subst_cb.simps by metis\nnext\n case (C_conj c1 c2)\n obtain s1 and s2 where 1: \"eval_c i (c1[bv::=b]\\<^sub>c\\<^sub>b) s1 \\ eval_c i (c2[bv::=b]\\<^sub>c\\<^sub>b) s2 \\ s = (s1\\s2)\" using C_conj eval_c_elims(3) subst_cb.simps(3) by metis\n obtain s1' and s2' where 2:\"eval_c i' c1 s1' \\ eval_c i' c2 s2' \\ s' = (s1'\\s2')\" using C_conj eval_c_elims(3) by metis\n then show ?case using 1 2 wfC_elims C_conj by metis\nnext\n case (C_disj c1 c2)\n\n obtain s1 and s2 where 1: \"eval_c i (c1[bv::=b]\\<^sub>c\\<^sub>b) s1 \\ eval_c i (c2[bv::=b]\\<^sub>c\\<^sub>b) s2 \\ s = (s1\\s2)\" using C_disj eval_c_elims(4) subst_cb.simps(4) by metis\n obtain s1' and s2' where 2:\"eval_c i' c1 s1' \\ eval_c i' c2 s2' \\ s' = (s1'\\s2')\" using C_disj eval_c_elims(4) by metis\n then show ?case using 1 2 wfC_elims C_disj by metis\nnext\n case (C_not c)\n obtain s1::bool where 1: \"(i \\ c[bv::=b]\\<^sub>c\\<^sub>b \\ ~ s1) \\ (s = (\\ s1))\" using C_not eval_c_elims(6) subst_cb.simps(7) by metis\n obtain s1'::bool where 2: \"(i' \\ c \\ ~ s1') \\ (s' = (\\ s1'))\" using C_not eval_c_elims(6) by metis\n then show ?case using 1 2 wfC_elims C_not by metis\nnext\n case (C_imp c1 c2)\n obtain s1 and s2 where 1: \"eval_c i (c1[bv::=b]\\<^sub>c\\<^sub>b) s1 \\ eval_c i (c2[bv::=b]\\<^sub>c\\<^sub>b) s2 \\ s = (s1 \\ s2)\" using C_imp eval_c_elims(5) subst_cb.simps(5) by metis\n obtain s1' and s2' where 2:\"eval_c i' c1 s1' \\ eval_c i' c2 s2' \\ s' = (s1' \\ s2')\" using C_imp eval_c_elims(5) by metis\n then show ?case using 1 2 wfC_elims C_imp by metis\nnext\n case (C_eq e1 e2)\n obtain be where be: \"wfCE \\ B \\ e1 be \\ wfCE \\ B \\ e2 be\" using C_eq wfC_elims by metis\n obtain s1 and s2 where 1: \"eval_e i (e1[bv::=b]\\<^sub>c\\<^sub>e\\<^sub>b) s1 \\ eval_e i (e2[bv::=b]\\<^sub>c\\<^sub>e\\<^sub>b) s2 \\ s = (s1 = s2)\" using C_eq eval_c_elims(7) subst_cb.simps(6) by metis\n obtain s1' and s2' where 2:\"eval_e i' e1 s1' \\ eval_e i' e2 s2' \\ s' = (s1' = s2' )\" using C_eq eval_c_elims(7) by metis\n have \"\\\\<^sub>w\\<^sub>f \\\" using C_eq wfX_wfY by metis\n moreover have \"\\ ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ i \" using C_eq by auto\n ultimately show ?case using boxed_b_eq[of \\ s1 be bv b s1' s2 s2'] 1 2 boxed_i_eval_ce_boxed_b C_eq wfC_elims subst_cb.simps 1 2 be by auto\nqed\n\nlemma is_satis_bs_boxed:\n fixes c::c\n assumes \"boxed_i \\ \\ b bv i i'\" and \"wfC \\ B \\ c\" and \"wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"\\ ; \\ \\ i'\"\n and \"(i \\ c[bv::=b]\\<^sub>c\\<^sub>b)\"\n shows \"(i' \\ c)\"\nproof -\n have \"eval_c i (c[bv::=b]\\<^sub>c\\<^sub>b) True\" using is_satis.simps assms by auto\n moreover obtain s where \"i' \\ c \\ ~ s\" using eval_c_exist assms by metis\n ultimately show ?thesis using eval_c_eq_bs_boxed assms is_satis.simps by metis\nqed\n\nlemma is_satis_bs_boxed_rev:\n fixes c::c\n assumes \"boxed_i \\ \\ b bv i i'\" and \"wfC \\ B \\ c\" and \"wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"\\ ; \\ \\ i'\" and \"wfC \\ {||} \\[bv::=b]\\<^sub>\\\\<^sub>b (c[bv::=b]\\<^sub>c\\<^sub>b)\"\n and \"(i' \\ c)\"\n shows \"(i \\ c[bv::=b]\\<^sub>c\\<^sub>b)\"\nproof -\n have \"eval_c i' c True\" using is_satis.simps assms by auto\n moreover obtain s where \"i \\ c[bv::=b]\\<^sub>c\\<^sub>b \\ ~ s\" using eval_c_exist assms by metis\n ultimately show ?thesis using eval_c_eq_bs_boxed assms is_satis.simps by metis\nqed\n\nlemma bs_boxed_wfi_aux:\n fixes b::b and bv::bv and \\::\\ and B::\\\n assumes \"boxed_i \\ \\ b bv i i'\" and \"wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"\\\\<^sub>w\\<^sub>f \\\" and \"wfG \\ B \\\"\n shows \"\\ ; \\ \\ i'\"\n using assms proof(induct rule: boxed_i.inducts)\n case (boxed_i_GNilI T i)\n then show ?case using wfI_def by auto\nnext\n case (boxed_i_GConsI s i x1 T b1 bv b s' G i' c1)\n {\n fix x2 b2 c2\n assume as : \"(x2,b2,c2) \\ toSet ((x1, b1, c1) #\\<^sub>\\ G)\"\n\n then consider (hd) \"(x2,b2,c2) = (x1, b1, c1)\" | (tail) \"(x2,b2,c2) \\ toSet G\" using toSet.simps by auto\n hence \"\\s. Some s = (i'(x1 \\ s')) x2 \\ wfRCV T s b2\" proof(cases)\n case hd\n hence \"b1=b2\" by auto\n moreover have \"(x2,b2[bv::=b]\\<^sub>b\\<^sub>b,c2[bv::=b]\\<^sub>c\\<^sub>b) \\ toSet ((x1, b1, c1) #\\<^sub>\\ G)[bv::=b]\\<^sub>\\\\<^sub>b\" using hd subst_gb.simps by simp\n moreover hence \"wfRCV T s b2[bv::=b]\\<^sub>b\\<^sub>b\" using wfI_def boxed_i_GConsI hd\n proof -\n obtain ss :: \"b \\ x \\ (x \\ rcl_val option) \\ type_def list \\ rcl_val\" where\n \"\\x1a x2a x3 x4. (\\v5. Some v5 = x3 x2a \\ wfRCV x4 v5 x1a) = (Some (ss x1a x2a x3 x4) = x3 x2a \\ wfRCV x4 (ss x1a x2a x3 x4) x1a)\"\n by moura (* 0.0 ms *)\n then have f1: \"Some (ss b2[bv::=b]\\<^sub>b\\<^sub>b x1 i T) = i x1 \\ wfRCV T (ss b2[bv::=b]\\<^sub>b\\<^sub>b x1 i T) b2[bv::=b]\\<^sub>b\\<^sub>b\"\n using boxed_i_GConsI.prems(1) hd wfI_def by auto (* 31 ms *)\n then have \"ss b2[bv::=b]\\<^sub>b\\<^sub>b x1 i T = s\"\n by (metis (no_types) boxed_i_GConsI.hyps(1) option.inject) (* 0.0 ms *)\n then show ?thesis\n using f1 by blast (* 0.0 ms *)\n qed\n ultimately have \"wfRCV T s' b2\" using boxed_i_GConsI boxed_b_wfRCV by metis\n\n then show ?thesis using hd by simp\n next\n case tail\n hence \"wfI T G i'\" using boxed_i_GConsI wfI_suffix wfG_suffix subst_gb.simps\n by (metis (no_types, lifting) Un_iff toSet.simps(2) wfG_cons2 wfI_def)\n then show ?thesis using wfI_def[of T G i'] tail\n using boxed_i_GConsI.prems(3) split_G wfG_cons_fresh2 by fastforce\n qed\n }\n thus ?case using wfI_def by fast\n\nqed\n\nlemma is_satis_g_bs_boxed_aux:\n fixes G::\\\n assumes \"boxed_i \\ G1 b bv i i'\" and \"wfI \\ G1[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"wfI \\ G1 i'\" and \"G1 = (G2@G)\" and \"wfG \\ B G1\"\n and \"(i \\ G[bv::=b]\\<^sub>\\\\<^sub>b) \"\n shows \"(i' \\ G)\"\n using assms proof(induct G arbitrary: G2 rule: \\_induct)\n case GNil\n then show ?case by auto\nnext\n case (GCons x' b' c' \\' G2)\n show ?case proof(subst is_satis_g.simps,rule)\n have *:\"wfC \\ B G1 c'\" using GCons wfG_wfC_inside by force\n show \"i' \\ c'\" using is_satis_bs_boxed[OF assms(1) * ] GCons by auto\n obtain G3 where \"G1 = G3 @ \\'\" using GCons append_g.simps\n by (metis append_g_assoc)\n then show \"i' \\ \\'\" using GCons append_g.simps by simp\n qed\nqed\n\nlemma is_satis_g_bs_boxed:\n fixes G::\\\n assumes \"boxed_i \\ G b bv i i'\" and \"wfI \\ G[bv::=b]\\<^sub>\\\\<^sub>b i\" and \"wfI \\ G i'\" and \"wfG \\ B G\"\n and \"(i \\ G[bv::=b]\\<^sub>\\\\<^sub>b) \"\n shows \"(i' \\ G)\"\n using is_satis_g_bs_boxed_aux assms\n by (metis (full_types) append_g.simps(1))\n\nlemma subst_b_valid:\n fixes s::s and b::b\n assumes \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\" and \"\\ ; {|bv|} ;\\ \\ c\"\n shows \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ c[bv::=b]\\<^sub>c\\<^sub>b \"\nproof(rule validI)\n\n show **:\"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f c[bv::=b]\\<^sub>c\\<^sub>b \" using assms valid.simps wf_b_subst subst_gb.simps by metis\n show \"\\i. (wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i \\ i \\ \\[bv::=b]\\<^sub>\\\\<^sub>b) \\ i \\ c[bv::=b]\\<^sub>c\\<^sub>b \"\n proof(rule,rule)\n fix i\n assume *:\"wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i \\ i \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\"\n\n obtain i' where idash: \"boxed_i \\ \\ b bv i i'\" using boxed_i_ex wfX_wfY assms * by fastforce\n\n have wfc: \"\\ ; {|bv|} ; \\ \\\\<^sub>w\\<^sub>f c\" using valid.simps assms by simp\n have wfg: \"\\ ; {|bv|} \\\\<^sub>w\\<^sub>f \\\" using valid.simps wfX_wfY assms by metis\n hence wfi: \"wfI \\ \\ i'\" using idash * bs_boxed_wfi_aux subst_gb.simps wfX_wfY by metis\n moreover have \"i' \\ \\\" proof (rule is_satis_g_bs_boxed[OF idash ] wfX_wfY(2)[OF wfc])\n show \"wfI \\ \\[bv::=b]\\<^sub>\\\\<^sub>b i\" using subst_gb.simps * by simp\n show \"wfI \\ \\ i'\" using wfi by auto\n show \"\\ ; B \\\\<^sub>w\\<^sub>f \\ \" using wfg assms by auto\n show \"i \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_gb.simps * by simp\n qed\n ultimately have ic:\"i' \\ c\" using assms valid_def using valid.simps by blast\n\n show \"i \\ c[bv::=b]\\<^sub>c\\<^sub>b\" proof(rule is_satis_bs_boxed_rev)\n show \"\\ ; \\ ; b , bv \\ i \\ i'\" using idash by auto\n show \"\\ ; B ; \\ \\\\<^sub>w\\<^sub>f c \" using wfc assms by auto\n show \"\\ ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ i\" using subst_gb.simps * by simp\n show \"\\ ; \\ \\ i'\" using wfi by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f c[bv::=b]\\<^sub>c\\<^sub>b \" using ** by auto\n show \"i' \\ c\" using ic by auto\n qed\n\n qed\nqed\n\nsection \\Expression Operator Lemmas\\\n\nlemma is_satis_len_imp:\n assumes \"i \\ (CE_val (V_var x) == CE_val (V_lit (L_num (int (length v)))) )\" (is \"is_satis i ?c1\")\n shows \"i \\ (CE_val (V_var x) == CE_len [V_lit (L_bitvec v)]\\<^sup>c\\<^sup>e)\"\nproof -\n have *:\"eval_c i ?c1 True\" using assms is_satis.simps by blast\n then have \"eval_e i (CE_val (V_lit (L_num (int (length v))))) (SNum (int (length v)))\"\n using eval_e_elims(1) eval_v_elims eval_l.simps by (metis eval_e.intros(1) eval_v_litI)\n hence \"eval_e i (CE_val (V_var x)) (SNum (int (length v)))\" using eval_c_elims(7)[OF *]\n by (metis eval_e_elims(1) eval_v_elims(1))\n moreover have \"eval_e i (CE_len [V_lit (L_bitvec v)]\\<^sup>c\\<^sup>e) (SNum (int (length v)))\"\n using eval_e_elims(7) eval_v_elims eval_l.simps by (metis eval_e.intros eval_v_litI)\n ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce\nqed\n\nlemma is_satis_plus_imp:\n assumes \"i \\ (CE_val (V_var x) == CE_val (V_lit (L_num (n1+n2))))\" (is \"is_satis i ?c1\")\n shows \"i \\ (CE_val (V_var x) == CE_op Plus ([V_lit (L_num n1)]\\<^sup>c\\<^sup>e) ([V_lit (L_num n2)]\\<^sup>c\\<^sup>e))\"\nproof -\n have *:\"eval_c i ?c1 True\" using assms is_satis.simps by blast\n then have \"eval_e i (CE_val (V_lit (L_num (n1+n2)))) (SNum (n1+n2))\"\n using eval_e_elims(1) eval_v_elims eval_l.simps by (metis eval_e.intros(1) eval_v_litI)\n hence \"eval_e i (CE_val (V_var x)) (SNum (n1+n2))\" using eval_c_elims(7)[OF *]\n by (metis eval_e_elims(1) eval_v_elims(1))\n moreover have \"eval_e i (CE_op Plus ([V_lit (L_num n1)]\\<^sup>c\\<^sup>e) ([V_lit (L_num n2)]\\<^sup>c\\<^sup>e)) (SNum (n1+n2))\"\n using eval_e_elims(7) eval_v_elims eval_l.simps by (metis eval_e.intros eval_v_litI)\n ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce\nqed\n\nlemma is_satis_leq_imp:\n assumes \"i \\ (CE_val (V_var x) == CE_val (V_lit (if (n1 \\ n2) then L_true else L_false)))\" (is \"is_satis i ?c1\")\n shows \"i \\ (CE_val (V_var x) == CE_op LEq [(V_lit (L_num n1))]\\<^sup>c\\<^sup>e [(V_lit (L_num n2))]\\<^sup>c\\<^sup>e)\"\nproof -\n have *:\"eval_c i ?c1 True\" using assms is_satis.simps by blast\n then have \"eval_e i (CE_val (V_lit ((if (n1 \\ n2) then L_true else L_false)))) (SBool (n1\\n2))\"\n using eval_e_elims(1) eval_v_elims eval_l.simps\n by (metis (full_types) eval_e.intros(1) eval_v_litI)\n hence \"eval_e i (CE_val (V_var x)) (SBool (n1\\n2))\" using eval_c_elims(7)[OF *]\n by (metis eval_e_elims(1) eval_v_elims(1))\n moreover have \"eval_e i (CE_op LEq [(V_lit (L_num n1))]\\<^sup>c\\<^sup>e [(V_lit (L_num n2) )]\\<^sup>c\\<^sup>e) (SBool (n1\\n2))\"\n using eval_e_elims(3) eval_v_elims eval_l.simps by (metis eval_e.intros eval_v_litI)\n ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce\nqed\n\nlemma eval_lit_inj:\n fixes n1::l and n2::l\n assumes \"\\ n1 \\ = s\" and \"\\ n2 \\ = s\" \n shows \"n1=n2\" \n using assms proof(nominal_induct s rule: rcl_val.strong_induct)\n case (SBitvec x)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SNum x)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SBool x)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SPair x1a x2a)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SCons x1a x2a x3a)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SConsp x1a x2a x3a x4)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case SUnit\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nnext\n case (SUt x)\n then show ?case using eval_l.simps \n by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)\nqed\n\nlemma eval_e_lit_inj:\n fixes n1::l and n2::l\n assumes \"i \\ [ [ n1 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s\" and \"i \\ [ [ n2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s\" \n shows \"n1=n2\" \n using eval_lit_inj assms eval_e_elims eval_v_elims by metis\n\nlemma is_satis_eq_imp:\n assumes \"i \\ (CE_val (V_var x) == CE_val (V_lit (if (n1 = n2) then L_true else L_false)))\" (is \"is_satis i ?c1\")\n shows \"i \\ (CE_val (V_var x) == CE_op Eq [(V_lit (n1))]\\<^sup>c\\<^sup>e [(V_lit (n2))]\\<^sup>c\\<^sup>e)\"\nproof -\n have *:\"eval_c i ?c1 True\" using assms is_satis.simps by blast\n then have \"eval_e i (CE_val (V_lit ((if (n1=n2) then L_true else L_false)))) (SBool (n1=n2))\"\n using eval_e_elims(1) eval_v_elims eval_l.simps\n by (metis (full_types) eval_e.intros(1) eval_v_litI)\n hence \"eval_e i (CE_val (V_var x)) (SBool (n1=n2))\" using eval_c_elims(7)[OF *]\n by (metis eval_e_elims(1) eval_v_elims(1))\n moreover have \"eval_e i (CE_op Eq [(V_lit (n1))]\\<^sup>c\\<^sup>e [(V_lit (n2) )]\\<^sup>c\\<^sup>e) (SBool (n1=n2))\"\n proof -\n obtain s1 and s2 where *:\"i \\ [ [ n1 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s1 \\ i \\ [ [ n2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s2\" using eval_l.simps eval_e.intros eval_v_litI by metis\n moreover have \" SBool (n1 = n2) = SBool (s1 = s2)\" proof(cases \"n1=n2\")\n case True\n then show ?thesis using * \n by (simp add: calculation eval_e_uniqueness)\n next\n case False\n then show ?thesis using * eval_e_lit_inj by auto\n qed\n ultimately show ?thesis using eval_e_eqI[of i \"[(V_lit (n1))]\\<^sup>c\\<^sup>e\" s1 \"[(V_lit (n2))]\\<^sup>c\\<^sup>e\" s2 ] by auto\n qed\n ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce\nqed\n\nlemma valid_eq_e:\n assumes \"\\i s1 s2. wfG P \\ GNil \\ wfI P GNil i \\ eval_e i e1 s1 \\ eval_e i e2 s2 \\ s1 = s2\" \n and \"wfCE P \\ GNil e1 b\" and \"wfCE P \\ GNil e2 b\" \n shows \"P ; \\ ; (x, b , CE_val (V_var x) == e1 )#\\<^sub>\\ GNil \\ CE_val (V_var x) == e2\"\n unfolding valid.simps\nproof(intro conjI)\n show \\ P ; \\ ; (x, b, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1 ) #\\<^sub>\\ GNil \\\\<^sub>w\\<^sub>f [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e2 \\ \n using assms wf_intros wfX_wfY b.eq_iff fresh_GNil wfC_e_eq2 wfV_elims by meson\n show \\\\i. ((P ; (x, b, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1 ) #\\<^sub>\\ GNil \\ i) \\ (i \\ (x, b, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1 ) #\\<^sub>\\ GNil) \\\n (i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e2)) \\ proof(rule+)\n fix i\n assume as:\"P ; (x, b, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1 ) #\\<^sub>\\ GNil \\ i \\ i \\ (x, b, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1 ) #\\<^sub>\\ GNil\"\n\n have *: \"P ; GNil \\ i \" using wfI_def by auto\n\n then obtain s1 where s1:\"eval_e i e1 s1\" using assms eval_e_exist by metis\n obtain s2 where s2:\"eval_e i e2 s2\" using assms eval_e_exist * by metis\n moreover have \"i x = Some s1\" proof -\n have \"i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e1\" using as is_satis_g.simps by auto\n thus ?thesis using s1 \n by (metis eval_c_elims(7) eval_e_elims(1) eval_e_uniqueness eval_v_elims(2) is_satis.cases)\n qed\n moreover have \"s1 = s2\" using s1 s2 * assms wfG_nilI wfX_wfY by metis\n\n ultimately show \"i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == e2 \\ ~ True\" \n using eval_c.intros eval_e.intros eval_v.intros \n proof -\n have \"i \\ e2 \\ ~ s1\"\n by (metis \\s1 = s2\\ s2) (* 0.0 ms *)\n then show ?thesis\n by (metis (full_types) \\i x = Some s1\\ eval_c_eqI eval_e_valI eval_v_varI) (* 31 ms *)\n qed\n qed\nqed\n\nlemma valid_len:\n assumes \" \\\\<^sub>w\\<^sub>f \\\" \n shows \"\\ ; \\ ; (x, B_int, [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == [[ L_num (int (length v)) ]\\<^sup>v]\\<^sup>c\\<^sup>e) #\\<^sub>\\ GNil \\ [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == CE_len [[ L_bitvec v ]\\<^sup>v]\\<^sup>c\\<^sup>e\" (is \"\\ ; \\ ; ?G \\ ?c\" )\nproof - \n have *:\"\\ \\\\<^sub>w\\<^sub>f ([]::\\) \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f []\\<^sub>\\ \" using assms wfG_nilI wfD_emptyI wfPhi_emptyI by auto\n\n moreover hence \"\\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f CE_val (V_lit (L_num (int (length v)))) : B_int\" \n using wfCE_valI * wfV_litI base_for_lit.simps \n by (metis wfE_valI wfX_wfY)\n\n moreover have \"\\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f CE_len [(V_lit (L_bitvec v))]\\<^sup>c\\<^sup>e : B_int\" \n using wfE_valI * wfV_litI base_for_lit.simps wfE_valI wfX_wfY wfCE_valI\n by (metis wfCE_lenI)\n moreover have \"atom x \\ GNil\" by auto\n ultimately have \"\\ ; \\ ; ?G \\\\<^sub>w\\<^sub>f ?c\" using wfC_e_eq2 assms by simp\n moreover have \"(\\i. wfI \\ ?G i \\ is_satis_g i ?G \\ is_satis i ?c)\" using is_satis_len_imp by auto\n ultimately show ?thesis using valid.simps by auto\nqed\n\nlemma valid_arith_bop:\n assumes \"wfG \\ \\ \\\" and \"opp = Plus \\ ll = (L_num (n1+n2)) \\ (opp = LEq \\ ll = ( if n1\\n2 then L_true else L_false))\" \n and \"(opp = Plus \\ b = B_int) \\ (opp = LEq \\ b = B_bool)\" and\n \"atom x \\ \\\" \n shows \"\\; \\ ; (x, b, (CE_val (V_var x) == CE_val (V_lit (ll)) )) #\\<^sub>\\ \\ \n \\ (CE_val (V_var x) == CE_op opp ([V_lit (L_num n1)]\\<^sup>c\\<^sup>e) ([V_lit (L_num n2)]\\<^sup>c\\<^sup>e ))\" (is \"\\ ; \\ ; ?G \\ ?c\")\nproof -\n have \"wfC \\ \\ ?G ?c\" proof(rule wfC_e_eq2)\n show \"\\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f CE_val (V_lit ll) : b\" using wfCE_valI wfV_litI assms base_for_lit.simps by metis\n show \"\\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f CE_op opp ([V_lit (L_num n1)]\\<^sup>c\\<^sup>e) ([V_lit (L_num n2)]\\<^sup>c\\<^sup>e) : b \" \n using wfCE_plusI wfCE_leqI wfCE_eqI wfV_litI wfCE_valI base_for_lit.simps assms by metis\n show \"\\\\<^sub>w\\<^sub>f \\\" using assms wfX_wfY by auto \n show \"atom x \\ \\\" using assms by auto\n qed\n\n moreover have \"\\i. wfI \\ ?G i \\ is_satis_g i ?G \\ is_satis i ?c\" proof(rule allI , rule impI)\n fix i\n assume \"wfI \\ ?G i \\ is_satis_g i ?G\" \n\n hence \"is_satis i ((CE_val (V_var x) == CE_val (V_lit (ll)) ))\" by auto\n thus \"is_satis i ((CE_val (V_var x) == CE_op opp ([V_lit (L_num n1)]\\<^sup>c\\<^sup>e) ([V_lit (L_num n2)]\\<^sup>c\\<^sup>e)))\" \n using is_satis_plus_imp assms opp.exhaust is_satis_leq_imp by auto\n qed\n ultimately show ?thesis using valid.simps by metis\nqed\n\nlemma valid_eq_bop:\n assumes \"wfG \\ \\ \\\" and \"atom x \\ \\\" and \"base_for_lit l1 = base_for_lit l2\"\n shows \"\\; \\ ; (x, B_bool, (CE_val (V_var x) == CE_val (V_lit (if l1 = l2 then L_true else L_false)) )) #\\<^sub>\\ \\ \n \\ (CE_val (V_var x) == CE_op Eq ([V_lit (l1)]\\<^sup>c\\<^sup>e) ([V_lit (l2)]\\<^sup>c\\<^sup>e ))\" (is \"\\ ; \\ ; ?G \\ ?c\")\nproof -\n let ?ll = \"(if l1 = l2 then L_true else L_false)\"\n have \"wfC \\ \\ ?G ?c\" proof(rule wfC_e_eq2)\n show \"\\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f CE_val (V_lit ?ll) : B_bool\" using wfCE_valI wfV_litI assms base_for_lit.simps by metis\n show \"\\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f CE_op Eq ([V_lit (l1)]\\<^sup>c\\<^sup>e) ([V_lit (l2)]\\<^sup>c\\<^sup>e) : B_bool \" \n using wfCE_eqI wfCE_leqI wfCE_eqI wfV_litI wfCE_valI base_for_lit.simps assms by metis\n show \"\\\\<^sub>w\\<^sub>f \\\" using assms wfX_wfY by auto \n show \"atom x \\ \\\" using assms by auto\n qed\n\n moreover have \"\\i. wfI \\ ?G i \\ is_satis_g i ?G \\ is_satis i ?c\" proof(rule allI , rule impI)\n fix i\n assume \"wfI \\ ?G i \\ is_satis_g i ?G\" \n\n hence \"is_satis i ((CE_val (V_var x) == CE_val (V_lit (?ll)) ))\" by auto\n thus \"is_satis i ((CE_val (V_var x) == CE_op Eq ([V_lit (l1)]\\<^sup>c\\<^sup>e) ([V_lit (l2)]\\<^sup>c\\<^sup>e)))\" \n using is_satis_eq_imp assms by auto\n qed\n ultimately show ?thesis using valid.simps by metis\nqed\n\nlemma valid_fst:\n fixes x::x and v\\<^sub>1::v and v\\<^sub>2::v\n assumes \"wfTh \\\" and \"wfV \\ \\ GNil (V_pair v\\<^sub>1 v\\<^sub>2) (B_pair b\\<^sub>1 b\\<^sub>2)\"\n shows \"\\ ; \\ ; (x, b\\<^sub>1, [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == [v\\<^sub>1]\\<^sup>c\\<^sup>e) #\\<^sub>\\ GNil \\ [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == [#1[[v\\<^sub>1,v\\<^sub>2]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e\" \nproof(rule valid_eq_e)\n show \\\\i s1 s2. (\\ ; \\ \\\\<^sub>w\\<^sub>f GNil) \\ (\\ ; GNil \\ i) \\ (i \\ [ v\\<^sub>1 ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ (i \\ [#1[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2) \\ s1 = s2\\ \n proof(rule+)\n fix i s1 s2 \n assume as:\"\\ ; \\ \\\\<^sub>w\\<^sub>f GNil \\ \\ ; GNil \\ i \\ (i \\ [ v\\<^sub>1 ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ (i \\ [#1[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2)\"\n then obtain s2' where *:\"i \\ [ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v \\ ~ SPair s2 s2'\" \n using eval_e_elims(5)[of i \"[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e\" s2] eval_e_elims \n by meson\n then have \" i \\ v\\<^sub>1 \\ ~ s2\" using eval_v_elims(3)[OF *] by auto\n then show \"s1 = s2\" using eval_v_uniqueness as \n using eval_e_uniqueness eval_e_valI by blast\n qed\n\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [ v\\<^sub>1 ]\\<^sup>c\\<^sup>e : b\\<^sub>1 \\ using assms \n by (metis b.eq_iff(4) wfV_elims(3) wfV_wfCE)\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [#1[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e : b\\<^sub>1 \\ using assms using wfCE_fstI \n using wfCE_valI by blast\nqed\n\nlemma valid_snd: \n fixes x::x and v\\<^sub>1::v and v\\<^sub>2::v\n assumes \"wfTh \\\" and \"wfV \\ \\ GNil (V_pair v\\<^sub>1 v\\<^sub>2) (B_pair b\\<^sub>1 b\\<^sub>2)\"\n shows \"\\ ; \\ ; (x, b\\<^sub>2, [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == [v\\<^sub>2]\\<^sup>c\\<^sup>e) #\\<^sub>\\ GNil \\ [[x]\\<^sup>v]\\<^sup>c\\<^sup>e == [#2[[v\\<^sub>1,v\\<^sub>2]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e\" \nproof(rule valid_eq_e)\n show \\\\i s1 s2. (\\ ; \\ \\\\<^sub>w\\<^sub>f GNil) \\ (\\ ; GNil \\ i) \\ (i \\ [ v\\<^sub>2 ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ \n(i \\ [#2[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2) \\ s1 = s2\\ \n proof(rule+)\n fix i s1 s2 \n assume as:\"\\ ; \\ \\\\<^sub>w\\<^sub>f GNil \\ \\ ; GNil \\ i \\ (i \\ [ v\\<^sub>2 ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ (i \\ [#2[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2)\"\n then obtain s2' where *:\"i \\ [ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v \\ ~ SPair s2' s2\" \n using eval_e_elims(5)[of i \"[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e\" s2] eval_e_elims \n by meson\n then have \" i \\ v\\<^sub>2 \\ ~ s2\" using eval_v_elims(3)[OF *] by auto\n then show \"s1 = s2\" using eval_v_uniqueness as \n using eval_e_uniqueness eval_e_valI by blast\n qed\n\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [ v\\<^sub>2 ]\\<^sup>c\\<^sup>e : b\\<^sub>2 \\ using assms \n by (metis b.eq_iff wfV_elims wfV_wfCE)\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [#2[[ v\\<^sub>1 , v\\<^sub>2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e : b\\<^sub>2 \\ using assms using wfCE_sndI wfCE_valI by blast\nqed\n\nlemma valid_concat:\n fixes v1::\"bit list\" and v2::\"bit list\"\n assumes \" \\\\<^sub>w\\<^sub>f \\\" \n shows \"\\ ; \\ ; (x, B_bitvec, (CE_val (V_var x) == CE_val (V_lit (L_bitvec (v1@ v2))))) #\\<^sub>\\ GNil \\\n (CE_val (V_var x) == CE_concat ([V_lit (L_bitvec v1)]\\<^sup>c\\<^sup>e ) ([V_lit (L_bitvec v2)]\\<^sup>c\\<^sup>e) )\"\nproof(rule valid_eq_e) \n show \\\\i s1 s2. ((\\ ; \\ \\\\<^sub>w\\<^sub>f GNil) \\ (\\ ; GNil \\ i) \\ \n (i \\ [ [ L_bitvec (v1 @ v2) ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ (i \\ [[[ L_bitvec v1 ]\\<^sup>v]\\<^sup>c\\<^sup>e @@ [[ L_bitvec v2 ]\\<^sup>v]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ s2) \\\n s1 = s2)\\ \n proof(rule+)\n fix i s1 s2 \n assume as: \"(\\ ; \\ \\\\<^sub>w\\<^sub>f GNil) \\ (\\ ; GNil \\ i) \\ (i \\ [ [ L_bitvec (v1 @ v2) ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ s1) \\ \n (i \\ [[[ L_bitvec v1 ]\\<^sup>v]\\<^sup>c\\<^sup>e @@ [[ L_bitvec v2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2) \"\n\n hence *: \"i \\ [[[ L_bitvec v1 ]\\<^sup>v]\\<^sup>c\\<^sup>e @@ [[ L_bitvec v2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ s2\" by auto\n obtain bv1 bv2 where s2:\"s2 = SBitvec (bv1 @ bv2) \\ i \\ [ L_bitvec v1 ]\\<^sup>v \\ ~ SBitvec bv1 \\ (i \\ [ L_bitvec v2 ]\\<^sup>v \\ ~ SBitvec bv2)\" \n using eval_e_elims(7)[OF *] eval_e_elims(1) by metis\n hence \"v1 = bv1 \\ v2 = bv2\" using eval_v_elims(1) eval_l.simps(5) by force\n moreover then have \"s1 = SBitvec (bv1 @ bv2)\" using s2 using eval_v_elims(1) eval_l.simps(5) \n by (metis as eval_e_elims(1))\n\n then show \"s1 = s2\" using s2 by auto\n qed \n\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [ [ L_bitvec (v1 @ v2) ]\\<^sup>v ]\\<^sup>c\\<^sup>e : B_bitvec \\ \n by (metis assms base_for_lit.simps(5) wfG_nilI wfV_litI wfV_wfCE)\n show \\ \\ ; \\ ; GNil \\\\<^sub>w\\<^sub>f [[[ L_bitvec v1 ]\\<^sup>v]\\<^sup>c\\<^sup>e @@ [[ L_bitvec v2 ]\\<^sup>v]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e : B_bitvec \\ \n by (metis assms base_for_lit.simps(5) wfCE_concatI wfG_nilI wfV_litI wfCE_valI)\nqed\n\nlemma valid_ce_eq:\n fixes ce::ce\n assumes \"\\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f ce : b\"\n shows \\\\ ; \\ ; \\ \\ ce == ce \\\n unfolding valid.simps proof \n show \\ \\ ; \\ ; \\ \\\\<^sub>w\\<^sub>f ce == ce \\ using assms wfC_eqI by auto\n show \\\\i. \\ ; \\ \\ i \\ i \\ \\ \\ i \\ ce == ce \\ proof(rule+)\n fix i\n assume \"\\ ; \\ \\ i \\ i \\ \\\"\n then obtain s where \"i\\ ce \\ ~ s\" using assms eval_e_exist by metis\n then show \"i \\ ce == ce \\ ~ True \" using eval_c_eqI by metis\n qed\nqed\n\nlemma valid_eq_imp:\n fixes c1::c and c2::c\n assumes \" \\ ; \\ ; (x, b, c2) #\\<^sub>\\ \\ \\\\<^sub>w\\<^sub>f c1 IMP c2\"\n shows \" \\ ; \\ ; (x, b, c2) #\\<^sub>\\ \\ \\ c1 IMP c2 \"\nproof -\n have \"\\i. (\\ ; (x, b, c2) #\\<^sub>\\ \\ \\ i \\ i \\ (x, b, c2) #\\<^sub>\\ \\) \\ i \\ ( c1 IMP c2 )\"\n proof(rule,rule)\n fix i\n assume as:\"\\ ; (x, b, c2) #\\<^sub>\\ \\ \\ i \\ i \\ (x, b, c2) #\\<^sub>\\ \\\"\n\n have \"\\ ; \\ ; (x, b, c2) #\\<^sub>\\ \\ \\\\<^sub>w\\<^sub>f c1\" using wfC_elims assms by metis\n\n then obtain sc where \"i \\ c1 \\ ~ sc\" using eval_c_exist assms as by metis\n moreover have \"i \\ c2 \\ ~ True\" using as is_satis_g.simps is_satis.simps by auto\n\n ultimately have \"i \\ c1 IMP c2 \\ ~ True\" using eval_c_impI by metis\n\n thus \"i \\ c1 IMP c2\" using is_satis.simps by auto\n qed\n thus ?thesis using assms by auto\nqed\n\nlemma valid_range:\n assumes \"0 \\ n \\ n \\ m\" and \"\\\\<^sub>w\\<^sub>f \\\"\n shows \"\\ ; {||} ; (x, B_int , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\\<^sub>\\ GNil \\ \n (C_eq (CE_op LEq (CE_val (V_var x)) (CE_val (V_lit (L_num m)))) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e) AND\n (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x))) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e)\"\n (is \"\\ ; {||} ; ?G \\ ?c1 AND ?c2\")\nproof(rule validI)\n have wfg: \" \\ ; {||} \\\\<^sub>w\\<^sub>f (x, B_int, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e ) #\\<^sub>\\ GNil \" \n using assms base_for_lit.simps wfG_nilI wfV_litI fresh_GNil wfB_intI wfC_v_eq wfG_cons1I wfG_cons2I by metis\n\n show \"\\ ; {||} ; ?G \\\\<^sub>w\\<^sub>f ?c1 AND ?c2\" \n using wfC_conjI wfC_eqI wfCE_leqI wfCE_valI wfV_varI wfg lookup.simps base_for_lit.simps wfV_litI wfB_intI wfB_boolI \n by metis\n\n show \"\\i. \\ ; ?G \\ i \\ i \\ ?G \\ i \\ ?c1 AND ?c2\" proof(rule,rule)\n fix i\n assume a:\"\\ ; ?G \\ i \\ i \\ ?G\"\n hence *:\"i \\ V_var x \\ ~ SNum n\" \n proof - \n obtain sv where sv: \"i x = Some sv \\ \\ \\ sv : B_int\" using a wfI_def by force\n have \"i \\ (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n)))) \\ ~ True\" \n using a is_satis_g.simps \n using is_satis.cases by blast\n hence \"i x = Some(SNum n)\" using sv \n by (metis eval_c_elims(7) eval_e_elims(1) eval_l.simps(3) eval_v_elims(1) eval_v_elims(2))\n thus ?thesis using eval_v_varI by auto\n qed\n\n show \"i \\ ?c1 AND ?c2\" \n proof - \n have \"i \\ ?c1 \\ ~ True\" \n proof -\n have \"i \\ [ leq [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ L_num m ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e\\ ~ SBool True\" \n using eval_e_leqI assms eval_v_litI eval_l.simps * \n by (metis (full_types) eval_e_valI)\n moreover have \"i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SBool True\" \n using eval_v_litI eval_e_valI eval_l.simps by metis\n ultimately show ?thesis using eval_c_eqI by metis\n qed\n\n moreover have \"i \\ ?c2 \\ ~ True\" \n proof -\n have \"i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ SBool True\"\n using eval_e_leqI assms eval_v_litI eval_l.simps * \n by (metis (full_types) eval_e_valI)\n moreover have \"i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SBool True\" \n using eval_v_litI eval_e_valI eval_l.simps by metis\n ultimately show ?thesis using eval_c_eqI by metis\n qed \n ultimately show ?thesis using eval_c_conjI is_satis.simps by metis\n qed\n qed\nqed\n\nlemma valid_range_length:\n fixes \\::\\\n assumes \"0 \\ n \\ n \\ int (length v)\" and \" \\ ; {||} \\\\<^sub>w\\<^sub>f \\\" and \"atom x \\ \\\"\n shows \"\\ ; {||} ; (x, B_int , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\\<^sub>\\ \\ \\ \n (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x))) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e) AND \n (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e )) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e)\n \"\n (is \"\\ ; {||} ; ?G \\ ?c1 AND ?c2\")\nproof(rule validI)\n have wfg: \" \\ ; {||} \\\\<^sub>w\\<^sub>f (x, B_int, [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e ) #\\<^sub>\\ \\ \" apply(rule wfG_cons1I)\n apply simp\n using assms apply simp+\n using assms base_for_lit.simps wfG_nilI wfV_litI wfB_intI wfC_v_eq wfB_intI wfX_wfY assms by metis+\n\n show \"\\ ; {||} ; ?G \\\\<^sub>w\\<^sub>f ?c1 AND ?c2\" \n using wfC_conjI wfC_eqI wfCE_leqI wfCE_valI wfV_varI wfg lookup.simps base_for_lit.simps wfV_litI wfB_intI wfB_boolI \n by (metis (full_types) wfCE_lenI)\n\n show \"\\i. \\ ; ?G \\ i \\ i \\ ?G \\ i \\ ?c1 AND ?c2\" proof(rule,rule)\n fix i\n assume a:\"\\ ; ?G \\ i \\ i \\ ?G\"\n hence *:\"i \\ V_var x \\ ~ SNum n\" \n proof - \n obtain sv where sv: \"i x = Some sv \\ \\ \\ sv : B_int\" using a wfI_def by force\n have \"i \\ (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n)))) \\ ~ True\" \n using a is_satis_g.simps \n using is_satis.cases by blast\n hence \"i x = Some(SNum n)\" using sv \n by (metis eval_c_elims(7) eval_e_elims(1) eval_l.simps(3) eval_v_elims(1) eval_v_elims(2))\n thus ?thesis using eval_v_varI by auto\n qed\n\n show \"i \\ ?c1 AND ?c2\" \n proof - \n have \"i \\ ?c2 \\ ~ True\" \n proof -\n have \"i \\ [ leq [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e [| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e\\ ~ SBool True\" \n using eval_e_leqI assms eval_v_litI eval_l.simps * \n by (metis (full_types) eval_e_lenI eval_e_valI) \n moreover have \"i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SBool True\" \n using eval_v_litI eval_e_valI eval_l.simps by metis\n ultimately show ?thesis using eval_c_eqI by metis\n qed\n\n moreover have \"i \\ ?c1 \\ ~ True\" \n proof -\n have \"i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ SBool True\"\n using eval_e_leqI assms eval_v_litI eval_l.simps * \n by (metis (full_types) eval_e_valI)\n moreover have \"i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SBool True\" \n using eval_v_litI eval_e_valI eval_l.simps by metis\n ultimately show ?thesis using eval_c_eqI by metis\n qed \n ultimately show ?thesis using eval_c_conjI is_satis.simps by metis\n qed\n qed\nqed\n\nlemma valid_range_length_inv_gnil:\n fixes \\::\\\n assumes \"\\\\<^sub>w\\<^sub>f \\ \"\n and \"\\ ; {||} ; (x, B_int , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\\<^sub>\\ GNil \\ \n (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x))) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e) AND \n (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e )) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e)\n \"\n (is \"\\ ; {||} ; ?G \\ ?c1 AND ?c2\")\n shows \"0 \\ n \\ n \\ int (length v)\" \nproof -\n have *:\"\\i. \\ ; ?G \\ i \\ i \\ ?G \\ i \\ ?c1 AND ?c2\" using assms valid.simps by simp\n\n obtain i where i: \"i x = Some (SNum n)\" by auto\n have \"\\ ; ?G \\ i \\ i \\ ?G\" proof \n show \"\\ ; ?G \\ i\" unfolding wfI_def using wfRCV_BIntI i * by auto\n have \"i \\ ([ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e ) \\ ~ True\" \n using * eval_c.intros(7) eval_e.intros eval_v.intros eval_l.simps \n by (metis (full_types) i)\n thus \"i \\ ?G\" unfolding is_satis_g.simps is_satis.simps by auto\n qed \n hence **:\"i \\ ?c1 AND ?c2\" using * by auto\n\n hence 1: \"i \\ ?c1 \\ ~ True\" using eval_c_elims(3) is_satis.simps \n by fastforce\n then obtain sv1 and sv2 where \"(sv1 = sv2) = True \\ i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\" \n using eval_c_elims(7) by metis\n hence \"sv1 = SBool True\" using eval_e_elims eval_v_elims eval_l.simps i by metis\n obtain n1 and n2 where \"SBool True = SBool (n1 \\ n2) \\ (i \\ [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n1) \\ (i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n2)\" \n using eval_e_elims(3)[of i \" [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e\" \"[ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \" \"SBool True\"] \n using \\(sv1 = sv2) = True \\ i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\\ \\sv1 = SBool True\\ by fastforce\n moreover hence \"n1 = 0\" and \"n2 = n\" using eval_e_elims eval_v_elims i \n apply (metis eval_l.simps(3) rcl_val.eq_iff(2))\n using eval_e_elims eval_v_elims i \n by (metis calculation option.inject rcl_val.eq_iff(2))\n ultimately have le1: \"0 \\ n \" by simp\n\n hence 2: \"i \\ ?c2 \\ ~ True\" using ** eval_c_elims(3) is_satis.simps \n by fastforce\n then obtain sv1 and sv2 where sv: \"(sv1 = sv2) = True \\ i \\ [ leq [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e [| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\" \n using eval_c_elims(7) by metis\n hence \"sv1 = SBool True\" using eval_e_elims eval_v_elims eval_l.simps i by metis\n obtain n1 and n2 where ***:\"SBool True = SBool (n1 \\ n2) \\ (i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n1) \\ (i \\ [| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e \\ ~ SNum n2)\" \n using eval_e_elims(3) \n using sv \\sv1 = SBool True\\ by metis\n moreover hence \"n1 = n\" using eval_e_elims(1)[of i] eval_v_elims(2)[of i x \"SNum n1\"] i by auto\n moreover have \"n2 = int (length v)\" using eval_e_elims(8) eval_v_elims(1) eval_l.simps i \n by (metis \"***\" eval_e_elims(1) rcl_val.eq_iff(1) rcl_val.eq_iff(2)) \n ultimately have le2: \"n \\ int (length v) \" by simp\n\n show ?thesis using le1 le2 by auto\nqed\n\nlemma wfI_cons: \n fixes i::valuation and \\::\\\n assumes \"i' \\ \\\" and \"\\ ; \\ \\ i'\" and \"i = i' ( x \\ s)\" and \"\\ \\ s : b\" and \"atom x \\ \\\"\n shows \"\\ ; (x,b,c) #\\<^sub>\\ \\ \\ i\" \n unfolding wfI_def proof - \n { \n fix x' b' c' \n assume \"(x',b',c') \\ toSet ((x, b, c) #\\<^sub>\\ \\)\"\n then consider \"(x',b',c') = (x,b,c)\" | \"(x',b',c') \\ toSet \\\" using toSet.simps by auto\n then have \"\\s. Some s = i x' \\ \\ \\ s : b'\" proof(cases)\n case 1\n then show ?thesis using assms by auto\n next\n case 2\n then obtain s where s:\"Some s = i' x' \\ \\ \\ s : b'\" using assms wfI_def by auto\n moreover have \"x' \\ x\" using assms 2 fresh_dom_free by auto\n ultimately have \"Some s = i x'\" using assms by auto\n then show ?thesis using s wfI_def by auto\n qed\n }\n thus \"\\(x, b, c)\\toSet ((x, b, c) #\\<^sub>\\ \\). \\s. Some s = i x \\ \\ \\ s : b\" by auto\nqed\n\nlemma valid_range_length_inv:\n fixes \\::\\\n assumes \"\\ ; B \\\\<^sub>w\\<^sub>f \\ \" and \"atom x \\ \\\" and \"\\i. i \\ \\ \\ \\ ; \\ \\ i\"\n and \"\\ ; B ; (x, B_int , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\\<^sub>\\ \\ \\ \n (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x))) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e) AND \n (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e )) [[ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e)\n \"\n (is \"\\ ; ?B ; ?G \\ ?c1 AND ?c2\")\n shows \"0 \\ n \\ n \\ int (length v)\" \nproof -\n have *:\"\\i. \\ ; ?G \\ i \\ i \\ ?G \\ i \\ ?c1 AND ?c2\" using assms valid.simps by simp\n\n obtain i' where idash: \"is_satis_g i' \\ \\ \\ ; \\ \\ i'\" using assms by auto\n obtain i where i: \"i = i' ( x \\ SNum n)\" by auto\n hence ix: \"i x = Some (SNum n)\" by auto\n have \"\\ ; ?G \\ i \\ i \\ ?G\" proof \n show \"\\ ; ?G \\ i\" using wfI_cons i idash ix wfRCV_BIntI assms by simp\n\n have **:\"i \\ ([ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e ) \\ ~ True\" \n using * eval_c.intros(7) eval_e.intros eval_v.intros eval_l.simps i \n by (metis (full_types) ix)\n\n show \"i \\ ?G\" unfolding is_satis_g.simps proof \n show \\ i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ using ** is_satis.simps by auto\n show \\ i \\ \\ \\ using idash i assms is_satis_g_i_upd by metis\n qed\n qed \n hence **:\"i \\ ?c1 AND ?c2\" using * by auto\n\n hence 1: \"i \\ ?c1 \\ ~ True\" using eval_c_elims(3) is_satis.simps \n by fastforce\n then obtain sv1 and sv2 where \"(sv1 = sv2) = True \\ i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\" \n using eval_c_elims(7) by metis\n hence \"sv1 = SBool True\" using eval_e_elims eval_v_elims eval_l.simps i by metis\n obtain n1 and n2 where \"SBool True = SBool (n1 \\ n2) \\ (i \\ [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n1) \\ (i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n2)\" \n using eval_e_elims(3)[of i \" [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e\" \"[ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \" \"SBool True\"] \n using \\(sv1 = sv2) = True \\ i \\ [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\\ \\sv1 = SBool True\\ by fastforce\n moreover hence \"n1 = 0\" and \"n2 = n\" using eval_e_elims eval_v_elims i \n apply (metis eval_l.simps(3) rcl_val.eq_iff(2))\n using eval_e_elims eval_v_elims i \n calculation option.inject rcl_val.eq_iff(2)\n by (metis ix)\n ultimately have le1: \"0 \\ n \" by simp\n\n hence 2: \"i \\ ?c2 \\ ~ True\" using ** eval_c_elims(3) is_satis.simps \n by fastforce\n then obtain sv1 and sv2 where sv: \"(sv1 = sv2) = True \\ i \\ [ leq [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e [| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ sv1 \\ i \\ [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv2\" \n using eval_c_elims(7) by metis\n hence \"sv1 = SBool True\" using eval_e_elims eval_v_elims eval_l.simps i by metis\n obtain n1 and n2 where ***:\"SBool True = SBool (n1 \\ n2) \\ (i \\ [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n1) \\ (i \\ [| [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e \\ ~ SNum n2)\" \n using eval_e_elims(3) \n using sv \\sv1 = SBool True\\ by metis\n moreover hence \"n1 = n\" using eval_e_elims(1)[of i] eval_v_elims(2)[of i x \"SNum n1\"] i by auto\n moreover have \"n2 = int (length v)\" using eval_e_elims(8) eval_v_elims(1) eval_l.simps i \n by (metis \"***\" eval_e_elims(1) rcl_val.eq_iff(1) rcl_val.eq_iff(2)) \n ultimately have le2: \"n \\ int (length v) \" by simp\n\n show ?thesis using le1 le2 by auto\nqed\n\nlemma eval_c_conj2I[intro]: \n assumes \"i \\ c1 \\ ~ True\" and \"i \\ c2 \\ ~ True\"\n shows \"i \\ (C_conj c1 c2) \\ ~ True\"\n using assms eval_c_conjI by metis\n\nlemma valid_split:\n assumes \"split n v (v1,v2)\" and \"\\\\<^sub>w\\<^sub>f \\\"\n shows \"\\ ; {||} ; (z , [B_bitvec , B_bitvec ]\\<^sup>b , [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ [ L_bitvec v1 ]\\<^sup>v , [ L_bitvec v2 ]\\<^sup>v ]\\<^sup>v ]\\<^sup>c\\<^sup>e) #\\<^sub>\\ GNil \n\\ ([ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [#1[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e @@ [#2[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e) AND ([| [#1[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e == [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e)\"\n (is \"\\ ; {||} ; ?G \\ ?c1 AND ?c2\")\n unfolding valid.simps proof\n\n have wfg: \" \\ ; {||} \\\\<^sub>w\\<^sub>f (z, [B_bitvec , B_bitvec ]\\<^sup>b , [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ [ L_bitvec v1 ]\\<^sup>v , [ L_bitvec v2 ]\\<^sup>v ]\\<^sup>v ]\\<^sup>c\\<^sup>e) #\\<^sub>\\ GNil\" \n using wf_intros assms base_for_lit.simps fresh_GNil wfC_v_eq wfG_intros2 by metis \n\n show \"\\ ; {||} ; ?G \\\\<^sub>w\\<^sub>f ?c1 AND ?c2\" \n apply(rule wfC_conjI)\n apply(rule wfC_eqI)\n apply(rule wfCE_valI)\n apply(rule wfV_litI)\n using wf_intros wfg lookup.simps base_for_lit.simps wfC_v_eq \n apply (metis )+\n done\n\n have len:\"int (length v1) = n\" using assms split_length by auto\n\n show \"\\i. \\ ; ?G \\ i \\ i \\ ?G \\ i \\ (?c1 AND ?c2)\" \n proof(rule,rule)\n fix i\n assume a:\"\\ ; ?G \\ i \\ i \\ ?G\"\n hence \"i \\ [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ [ [ L_bitvec v1 ]\\<^sup>v , [ L_bitvec v2 ]\\<^sup>v ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ True\" \n using is_satis_g.simps is_satis.simps by simp\n then obtain sv where \"i \\ [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv \\ i \\ [ [ [ L_bitvec v1 ]\\<^sup>v , [ L_bitvec v2 ]\\<^sup>v ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ sv\" \n using eval_c_elims by metis\n hence \"i \\ [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ (SPair (SBitvec v1) (SBitvec v2))\" using eval_c_eqI eval_v.intros eval_l.simps \n by (metis eval_e_elims(1) eval_v_uniqueness)\n hence b:\"i z = Some (SPair (SBitvec v1) (SBitvec v2))\" using a eval_e_elims eval_v_elims by metis\n\n have v1: \"i \\ [#1[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ SBitvec v1 \" \n using eval_e_fstI eval_e_valI eval_v_varI b by metis\n have v2: \"i \\ [#2[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e \\ ~ SBitvec v2\" \n using eval_e_sndI eval_e_valI eval_v_varI b by metis\n\n have \"i \\ [ [ L_bitvec v ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SBitvec v\" using eval_e.intros eval_v.intros eval_l.simps by metis\n moreover have \"i \\ [ [#1[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e @@ [#2[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e \\ ~ SBitvec v\" \n using assms split_concat v1 v2 eval_e_concatI by metis\n moreover have \"i \\ [| [#1[ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e \\ ~ SNum (int (length v1))\" \n using v1 eval_e_lenI by auto\n moreover have \"i \\ [ [ L_num n ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\ ~ SNum n\" using eval_e.intros eval_v.intros eval_l.simps by metis\n ultimately show \"i \\ ?c1 AND ?c2\" using is_satis.intros eval_c_conj2I eval_c_eqI len by metis\n qed\nqed\n\n\nlemma is_satis_eq:\n assumes \"wfI \\ G i\" and \"wfCE \\ \\ G e b\"\n shows \"is_satis i (e == e)\"\nproof(rule)\n obtain s where \"eval_e i e s\" using eval_e_exist assms by metis\n thus \"eval_c i (e == e ) True\" using eval_c_eqI by metis\nqed\n\nlemma is_satis_g_i_upd2:\n assumes \"eval_v i v s\" and \"is_satis ((i ( x \\ s))) c0\" and \"atom x \\ G\" and \"wfG \\ \\ (G3@((x,b,c0)#\\<^sub>\\G))\" and \"wfV \\ \\ G v b\" and \"wfI \\ (G3[x::=v]\\<^sub>\\\\<^sub>v@G) i\" \n and \"is_satis_g i (G3[x::=v]\\<^sub>\\\\<^sub>v@G)\"\n shows \"is_satis_g (i ( x \\ s)) (G3@((x,b,c0)#\\<^sub>\\G))\"\n using assms proof(induct G3 rule: \\_induct)\n case GNil\n hence \"is_satis_g (i(x \\ s)) G\" using is_satis_g_i_upd by auto\n then show ?case using GNil using is_satis_g.simps append_g.simps by metis\nnext\n case (GCons x' b' c' \\')\n hence \"x\\x'\" using wfG_cons_append by metis\n hence \"is_satis_g i (((x', b', c'[x::=v]\\<^sub>c\\<^sub>v) #\\<^sub>\\ (\\'[x::=v]\\<^sub>\\\\<^sub>v) @ G))\" using subst_gv.simps GCons by auto\n hence *:\"is_satis i c'[x::=v]\\<^sub>c\\<^sub>v \\ is_satis_g i ((\\'[x::=v]\\<^sub>\\\\<^sub>v) @ G)\" using subst_gv.simps by auto\n\n have \"is_satis_g (i(x \\ s)) ((x', b', c') #\\<^sub>\\ (\\'@ (x, b, c0) #\\<^sub>\\ G))\" proof(subst is_satis_g.simps,rule)\n show \"is_satis (i(x \\ s)) c'\" proof(subst subst_c_satis_full[symmetric])\n show \\eval_v i v s\\ using GCons by auto\n show \\ \\ ; \\ ; ((x', b', c') #\\<^sub>\\\\')@(x, b, c0) #\\<^sub>\\ G \\\\<^sub>w\\<^sub>f c' \\ using GCons wfC_refl by auto\n show \\wfI \\ ((((x', b', c') #\\<^sub>\\ \\')[x::=v]\\<^sub>\\\\<^sub>v) @ G) i\\ using GCons by auto\n show \\ \\ ; \\ ; G \\\\<^sub>w\\<^sub>f v : b \\ using GCons by auto\n show \\is_satis i c'[x::=v]\\<^sub>c\\<^sub>v\\ using * by auto\n qed\n show \"is_satis_g (i(x \\ s)) (\\' @ (x, b, c0) #\\<^sub>\\ G)\" proof(rule GCons(1))\n show \\eval_v i v s\\ using GCons by auto\n show \\is_satis (i(x \\ s)) c0\\ using GCons by metis\n show \\atom x \\ G\\ using GCons by auto\n show \\ \\ ; \\\\\\<^sub>w\\<^sub>f \\' @ (x, b, c0) #\\<^sub>\\ G \\ using GCons wfG_elims append_g.simps by metis\n show \\is_satis_g i (\\'[x::=v]\\<^sub>\\\\<^sub>v @ G)\\ using * by auto\n show \"wfI \\ (\\'[x::=v]\\<^sub>\\\\<^sub>v @ G) i\" using GCons wfI_def subst_g_assoc_cons \\x\\x'\\ by auto\n show \"\\ ; \\ ; G \\\\<^sub>w\\<^sub>f v : b \" using GCons by auto\n qed\n qed\n moreover have \"((x', b', c') #\\<^sub>\\ \\' @ (x, b, c0) #\\<^sub>\\ G) = (((x', b', c') #\\<^sub>\\ \\') @ (x, b, c0) #\\<^sub>\\ G)\" by auto\n ultimately show ?case using GCons by metis\nqed\n\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/MiniSail/RCLogicL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.29626562686036534}} {"text": "theory WorldSatisfaction\nimports Misc Namespace View\nbegin\n\nsubsection \\Invariants\\\n\nsubsubsection \\World satisfaction\\\ntext \\ \n Impredicative invariants are formalized as propositions which are managed by the so called\n World Satisfaction. It holds a map of named invariants and keeps track which of them are opened \n (i.e. enabled/can be used thread-locally and might not hold) and which are closed \n (i.e. disabled/hold for all threads).\n\\\ntext \\Arbitrary but unique names for singleton cameras\\\ndefinition \"invariant_name :: gname \\ 1\" \ndefinition \"enabled_name :: gname \\ 2\" \ndefinition \"disabled_name :: gname \\ 3\"\n\ntype_synonym inv = \"(name, pre_iprop later) map_view \\ name dset \\ name dfset\"\n\ncontext \nfixes get_inv :: \"gname \\ 'res::ucamera \\ inv option\"\n and put_inv\nassumes inv_inG: \"inG get_inv put_inv\"\nbegin\n\ndefinition own_inv :: \"gname \\ inv \\ 'res upred_f\" (\"Own\\<^sub>i _ _\") where\n \"own_inv \\ i = own put_inv \\ i\"\n\ntext \\Allocate new invariant map\\\ndefinition ownI :: \"name \\ 'res upred_f \\ 'res upred_f\" where\n \"ownI \\ P = Own\\<^sub>i invariant_name (map_view_frag \\ DfracDiscarded (Next (pre P)),\\,\\)\"\n\ndefinition inv_raw :: \"namespace \\ 'res upred_f \\ 'res upred_f\" where\n \"inv_raw N P \\ \\\\<^sub>u \\. ((\\(\\\\\\<^sub>d dnames N)) \\\\<^sub>u ownI \\ P)\"\n\ntext \\Allocate new enabled invariant map\\\ndefinition ownE :: \"name set \\ 'res upred_f\" where\n \"ownE E = Own\\<^sub>i enabled_name (\\,DSet E,\\)\"\n\ntext \\Allocate new disabled invariant map\\\ndefinition ownD :: \"name fset \\ 'res upred_f\" where\n \"ownD D = Own\\<^sub>i disabled_name (\\,\\,DFSet D)\"\n \ndefinition lift_inv_fmap :: \"(name,'res upred_f) fmap \\ (name, pre_iprop later) fmap\" where\n \"lift_inv_fmap m = Abs_fmap (map_option (Next \\ pre) \\ (fmlookup m))\"\n\nlemma lift_inf_fmap_finite: \"(map_option (Next \\ pre) \\ (fmlookup m)) \\ {m. finite (dom m)}\"\n by auto\n\ntext \\World satisfaction, i.e. the invariant that holds all invariants\\\ndefinition wsat :: \"'res upred_f\" where\n \"wsat \\ \\\\<^sub>u (I::(name,'res upred_f) fmap).\n ((Own\\<^sub>i invariant_name (map_view_auth (DfracOwn 1) (lift_inv_fmap I),\\,\\))\n \\<^emph> (sep_map_fmdom (\\\\. (\\(the (fmlookup I \\))) \\<^emph> ownD {|\\|} \\\\<^sub>u (ownE {\\})) I)\n )\"\n\nlemma own_inv_ne [upred_ne_rule]: \"\\n_equiv n \\1 \\2; n_equiv n i j\\ \\ n_equiv n (Own\\<^sub>i \\1 i) (Own\\<^sub>i \\2 j)\"\n apply (auto simp: own_inv_def n_equiv_fun_def ofe_refl n_equiv_option_def intro!: upred_ne_rule)\n using inG.own_ne inv_inG by blast\n\nlemma ownI_ne [upred_ne_rule]: \"\\n_equiv n n1 n2; n_equiv n P Q\\ \\ n_equiv n (ownI n1 P) (ownI n2 Q)\"\napply (auto simp: ownI_def ofe_refl n_equiv_map_view_def map_view_auth_proj_def map_view_frag_proj_def \n map_view_frag_def view_frag_def n_equiv_fun_def n_equiv_option_def n_equiv_ag.rep_eq to_ag.rep_eq \n n_equiv_later_def intro!: upred_ne_rule split: map_view.splits)\n using non_expansiveE[OF ipropIso.to_ne] diff_le_self ofe_mono by blast\n\nlemma inv_raw_ne [upred_ne_rule]: \"\\n_equiv n N M; n_equiv n P Q\\ \\ n_equiv n (inv_raw N P) (inv_raw M Q)\"\n by (auto simp: inv_raw_def intro!: upred_ne_rule)\n\nlemma inv_ownE_ne [upred_ne_rule]: \"n_equiv n N M \\ n_equiv n (ownE N) (ownE M)\"\n by (auto simp: ownE_def ofe_refl n_equiv_dset_def d_equiv intro!: upred_ne_rule)\n\nlemma inv_ownD_ne [upred_ne_rule]: \"n_equiv n N M \\ n_equiv n (ownD N) (ownD M)\"\n by (auto simp: ownD_def ofe_refl n_equiv_dfset_def d_equiv intro!: upred_ne_rule)\n \nlemma pcore_id_inv: \"pcore_id_pred (map_view_frag \\ DfracDiscarded (Next (pre P)), \\, \\)\"\n unfolding prod_pcore_id_pred apply (simp add: \\_pcore_id_def)\n by (meson discarded_core_id pcore_id_frag)\n\nlemma persistent_ownI [pers_rule,log_prog_rule]: \"persistent (ownI \\ P)\"\nunfolding ownI_def own_inv_def by (rule persistent_core_own2[OF inv_inG, OF pcore_id_inv])\n\nlemma persistent_inv_raw [pers_rule,log_prog_rule]: \"persistent (inv_raw N P)\"\n unfolding inv_raw_def\n apply (rule persistent_exists)\n apply (rule persistent_conj)\n apply (rule persistent_pure)\n by (rule persistent_ownI)\n\nlemma put_inv_valid: \"\\valid mv; valid e; valid d\\ \\ valid (put_inv \\ (mv,e,d))\"\n by (auto simp: valid_def inG.put_n_valid[OF inv_inG] valid_raw_prod_def sprop_conj.rep_eq)\n\nlemma ownE_singleton_twice: \"ownE {i} \\<^emph> ownE {i} \\ \\False\"\n unfolding ownE_def own_inv_def\n apply (rule upred_entails_trans[OF upred_entail_eqR[OF inG.own_op[OF inv_inG]]])\n apply (rule upred_entails_trans[OF inG.own_valid[OF inv_inG]])\n apply (simp add: op_prod_def \\_left_id op_dset_def)\n apply transfer\n by (auto simp: prod_n_valid_def \\_n_valid valid_raw_dset_def) \n \nlemma ownD_singleton_twice: \"ownD {|i|} \\<^emph> ownD {|i|} \\ \\False\"\n unfolding ownD_def own_inv_def inG.own_def[OF inv_inG]\n apply (auto simp: op_prod_def \\_left_id op_dfset_def inG.put_op[OF inv_inG, symmetric]\n intro!: upred_entails_trans[OF upred_entail_eqR[OF upred_own_op]] upred_entails_trans[OF upred_own_valid])\n apply (rule upred_entails_trans[OF upred_entail_eqL[OF inG.valid_get[OF inv_inG]]])\n apply transfer\n by (simp add: prod_n_valid_def \\_n_valid valid_raw_dfset_def)\n \nlemma ownE_op: \"E1 \\ E2 = {} \\ ownE (E1 \\ E2) \\\\ ownE E1 \\<^emph> ownE E2\"\nproof -\n assume \"E1 \\ E2 = {}\"\n then have un_op:\"DSet (E1 \\ E2) = DSet E1 \\ DSet E2\" unfolding op_dset_def by simp\n from inG.own_op[OF inv_inG, of \"enabled_name\" \"(\\,DSet E1,\\)\" \"(\\,DSet E2,\\)\"]\n show ?thesis by (auto simp: ownE_def own_inv_def un_op op_prod_def \\_left_id)\nqed\n\nlemma ownE_op': \"(\\(E1 \\ E2 = {})) \\\\<^sub>u ownE (E1 \\ E2) \\\\ ownE E1 \\<^emph> ownE E2\"\n apply (auto simp: upred_entail_eq_def)\n apply (subst upred_conj_comm)\n apply (auto intro!: upred_pure_impl' upred_entail_eqL[OF ownE_op])\n apply (auto simp: ownE_def own_inv_def op_prod_def \\_left_id inG.own_def[OF inv_inG]\n inG.put_op[OF inv_inG,symmetric] intro!: upred_entails_trans[OF upred_entail_eqR[OF upred_own_op]])\n apply (auto simp: upred_entails.rep_eq upred_own.rep_eq upred_pure.rep_eq upred_conj.rep_eq)\n sorry\n \nlemma ownE_op_minus: \"E1 \\ E2 \\ ownE (E1 \\ (E2-E1)) \\\\ ownE E1 \\<^emph> ownE (E2-E1)\"\nproof -\n assume \"E1 \\ E2\"\n then have \"E1 \\ (E2-E1) = {}\" by simp\n from ownE_op[OF this] show ?thesis .\nqed\n \nlemma auth_map_both_validI: \n \"\\(put_inv \\ (map_view_auth (DfracOwn 1) m,\\,\\) \\ put_inv \\ (map_view_frag k dq v,\\,\\)) \\\n (fmlookup m k =\\<^sub>u Some v) \\\\<^sub>u \\(valid dq)\"\nunfolding inG.put_op[OF inv_inG,symmetric]\napply (rule upred_entails_trans[OF upred_entail_eqL[OF inG.valid_get[OF inv_inG]]])\nunfolding op_prod_def\napply (simp add: \\_left_id auth_comb_opL op_prod_def split: prod.splits)\napply transfer'\napply (simp add: prod_n_valid_def \\_n_valid valid_raw_option_def \\_option_def)\nusing map_view_both_valid by metis\n\nlemma invariant_lookup: \n \"Own\\<^sub>i invariant_name (map_view_auth (DfracOwn 1) (lift_inv_fmap I),\\,\\) \\<^emph> ownI \\ P \\ \n (\\\\<^sub>u Q. \\(fmlookup I \\ = Some Q) \\<^emph> \\(Q=\\<^sub>uP))\"\n unfolding ownI_def own_inv_def inG.own_def[OF inv_inG]\n apply (rule upred_entails_trans[OF upred_entail_eqR[OF upred_own_op]])\n apply (rule upred_entails_trans[OF upred_own_valid])\n apply (rule upred_entails_trans[OF auth_map_both_validI])\n apply (auto simp: lift_inv_fmap_def valid_raw_dfrac_def valid_def n_equiv_option_def \n Abs_fmap_inverse[OF lift_inf_fmap_finite] emp_rule)\n apply (rule upred_entails_trans[OF upred_entail_eqL[OF option_equivI]])\n apply (auto simp: upred_exists_eq_sep' split: option.splits)\n apply (rule upred_entails_trans[OF upred_entail_eqL[OF later_equivI]])\n apply (rule upred_later_mono)\n apply transfer\n by (auto simp: ipropIso.to_equiv)\n\nlemma lookup_pers [pers_rule,log_prog_rule]: \"persistent (\\\\<^sub>u Q. \\(fmlookup I \\ = Some Q) \\<^emph> \\(Q=\\<^sub>uP))\"\n by pers_solver\n\nlemma ownI_open: \"wsat \\<^emph> ownI i P \\<^emph> ownE {i} \\ wsat \\<^emph> (\\P) \\<^emph> ownD {|i|}\"\nunfolding wsat_def\napply (rule pull_exists_antecedent2)\napply (rule upred_existsE')\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule upred_entails_trans[OF upred_sep_assoc'])\napply (rule upred_entails_trans[OF upred_sep_comm3M])\napply (rule upred_entails_trans[OF upred_sep_assoc_rev])\napply (rule upred_entails_substE[OF persistent_keep[OF lookup_pers invariant_lookup]])\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule pull_exists_antecedentR)\napply (rule upred_existsE')\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule upred_pure_impl)\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\napply (rule upred_entails_trans[OF upred_sep_assoc])+\napply (simp add: sep_map_dom_delete)\napply (rule upred_entails_trans[OF upred_sep_assoc])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (rule upred_disjE')\nsubgoal for I Q\n apply (rule upred_entails_trans[OF upred_sep_assoc])\n apply (rule upred_frame)\n apply (rule upred_entails_trans[OF upred_sep_comm4_2])\n apply (rule upred_entails_trans[OF upred_sep_comm3M])\n apply (rule persistent_split[OF persistent_later[OF persistent_eq]])\n subgoal\n apply (rule upred_entails_trans[OF upred_entail_eqR[OF upred_later_sep]])\n apply (rule upred_later_mono)\n apply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\n apply (simp add: upred_eq_comm)\n apply (rule upred_eqE)\n by simp\n apply(rule upred_existsI[of _ _ \"I\"])\n apply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\n apply (rule upred_entails_trans[OF upred_sep_assoc])\n apply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\n apply (rule upred_entails_trans[OF upred_sep_assoc])+\n apply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\n apply (rule upred_entails_trans[OF upred_sep_assoc])+\n apply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\n apply (rule upred_entails_trans[OF upred_sep_assoc])\n apply (rule upred_entails_trans[OF _ upred_entails_eq[OF upred_sep_comm]])\n apply (rule upred_frame)\n apply (simp add: sep_map_dom_delete)\n apply (rule upred_entails_trans[OF upred_sep_assoc])+\n apply (rule upred_entails_trans[OF upred_sep_comm2R])\n apply (rule upred_frame)\n apply (rule upred_disjIR)\n apply (rule upred_entails_trans[OF upred_sep_comm2R])\nby (rule upred_weakeningR)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (rule upred_entails_trans[OF upred_sep_assoc'])\napply (rule upred_entails_trans[OF upred_sep_assoc_rev])\napply (rule upred_entails_substE[OF ownE_singleton_twice])\nby simp\n\nlemma ownI_close: \"wsat \\<^emph> ownI i P \\<^emph> (\\ P) \\<^emph> ownD {|i|} \\ wsat \\<^emph> ownE {i}\"\napply (simp add: wsat_def)\napply (auto simp: pull_exists_eq intro!: upred_existsE')\napply (rule upred_entails_trans[OF upred_sep_comm3M])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (auto simp: upred_sep_assoc_eq)\napply (rule upred_entails_trans[OF upred_sep_comm4_2])\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (auto simp: upred_sep_assoc_eq)\napply (rule upred_entails_substE[OF persistent_keep[OF lookup_pers invariant_lookup], unfolded upred_sep_assoc_eq])\nsubgoal for I \napply (auto simp: upred_sep_assoc_eq intro!: upred_existsI[of _ _ I] pull_exists_antecedentR upred_existsE')\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (auto simp: sep_map_dom_delete upred_sep_assoc_eq intro!: upred_pure_impl)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm]])\napply (simp add: upred_sep_assoc_eq)\napply (rule upred_entails_trans[OF upred_sep_comm4_2])\napply (rule upred_entails_trans[OF upred_sep_comm3M])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (auto simp: upred_sep_assoc_eq intro!: upred_disjE')\nsubgoal for Q \n apply (rule upred_entails_trans[OF upred_sep_comm6_2R])\n by (auto intro!: upred_entails_substE[OF ownD_singleton_twice, unfolded upred_sep_assoc_eq])\napply (auto simp: upred_sep_assoc_eq intro!: upred_frame)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (auto simp: upred_sep_assoc_eq intro!: upred_frame)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (simp add: upred_sep_assoc_eq)\napply (rule upred_entails_trans[OF upred_sep_comm4_2])\napply (rule upred_entails_trans[OF upred_sep_comm3M])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (rule upred_entails_trans[OF _ upred_entails_eq[OF upred_sep_comm]])\napply (auto simp: upred_sep_assoc_eq intro!: upred_frame upred_disjIL)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\nby (auto intro!: upred_entails_trans[OF upred_weakeningR2] \n upred_entails_trans[OF upred_entail_eqR[OF upred_later_sep]] upred_later_mono upred_eqE)\ndone\n\nlemma ownI_alloc: \"(\\E::name fset. \\i. \\i|\\|E \\ \\ i) \\ \n (wsat \\<^emph> \\ P) ==\\<^emph> (\\\\<^sub>u i. \\(\\ i) \\<^emph> wsat \\<^emph> ownI i P)\"\napply (auto simp: wsat_def pull_exists_eq intro!: upred_wand_holdsI upred_existsE')\napply (rule add_holds[OF upred_own_unit,unfolded bupd_emp[OF upred_own_nothing_emp_eq]])\napply (rule upred_entails_substE[OF upred_wand_holdsE[OF upred_own_updateP]])\nsorry (* Axiomatized as this requires too much low level ghost state reasoning for which I'd need to add\n way more lemmata and things. *)\n\nlemma ownI_alloc_open: \"(\\E::name fset. \\i. \\i|\\|E \\ \\ i) \\ \n wsat ==\\<^emph> (\\\\<^sub>u i. \\(\\ i) \\<^emph> (ownE {i} -\\<^emph> wsat) \\<^emph> ownI i P \\<^emph> ownD {|i|})\"\napply (auto simp: wsat_def pull_exists_eq intro!: upred_wand_holdsI upred_existsE')\nsorry (* Axiomatized as this requires too much low level ghost state reasoning for which I'd need to add\n way more lemmata and things. *)\n\nlemma wsat_alloc: \"\\\\<^sub>b (\\\\<^sub>u _:: inv. wsat \\<^emph> ownE UNIV)\"\napply (auto simp: upred_holds_entails)\napply (rule inG.add_own[OF inv_inG, where ?\\ =\"invariant_name\" and ?a=\"(map_view_auth (DfracOwn 1) fmempty,\\,\\)\",\n OF prod_validI[OF map_view_auth_valid prod_validI[OF \\_valid \\_valid]]])\napply (rule inG.add_own[OF inv_inG, where ?\\ = \"enabled_name\" and ?a = \"(\\,DSet UNIV,\\)\", \n OF prod_validI[OF \\_valid prod_validI[OF _ \\_valid]]])\napply (simp add: valid_raw_dset_def valid_def)\napply (rule inG.add_own[OF inv_inG, where ?\\ = \"disabled_name\" and ?a = \"(\\,\\,DFSet {||})\", \n OF prod_validI[OF \\_valid prod_validI[OF \\_valid _]], unfolded \\_dfset_def[symmetric], OF \\_valid])\napply (auto simp: wsat_def pull_exists_eq own_inv_def ownE_def ownD_def \n intro!: upred_entails_trans[OF _ updI])\napply (rule upred_existsI)\napply (rule upred_existsI[of _ _ fmempty])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\napply (auto intro!: upred_frame)\napply (auto simp: lift_inv_fmap_def fmempty.rep_eq fmempty_def[symmetric] sep_fold_fset_def \n comp_fun_commute.ffold_empty[OF sep_P_comp_fun_commute] intro!: upred_frame)\napply (rule upred_entails_trans[OF upred_entails_eq[OF upred_sep_comm2L]])\napply (rule upred_entails_trans[OF upred_sep_comm2R])\nby (auto simp: upred_weakeningL intro!: upred_frame)\nend\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/IrisCore/WorldSatisfaction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29614125174964995}} {"text": "theory RCU\nimports RCU_model\nbegin \n\n\nlemmas genericwfs_lemma [simp] = wfs_2_def\n\n\nlemma initial_wfs_2: assumes \"initial_state \\ I\" shows \"wfs_2 \\\"\n apply(simp)\n apply(rule conjI)\n using assms initial_wfs apply blast\n using assms apply (simp add: initial_state_def)\n by blast\n\nlemma wfs_2_preserved:\n assumes \"wfs_2 \\\"\n and \"OpSem.step t a \\ \\'\"\n shows \"wfs_2 \\'\"\n using assms apply(unfold wfs_2_def)\n apply (intro conjI)\n using wfs_preserved assms apply blast\n apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) wfs_2_def wfs_def apply auto[1]\n apply (simp add: read_trans_def lastWr_def covered_v_def Let_def rev_app_def OpSem.step_def update_thrView_def split:if_splits)\n using assms(1) apply auto[1]\n apply (unfold writes_on_def wfs_2_def wfs_def)\n apply (simp add: var_def update_mods_def update_modView_def )\n apply (simp add: write_trans_def valid_fresh_ts_def lastWr_def covered_v_def Let_def rev_app_def step_def update_thrView_def split:if_splits)\n apply (simp add: visible_writes_def update_mods_def update_modView_def )\n \n apply safe\n apply (simp add: fst_def tst_def snd_def)\n apply(case_tac \"thrView \\ t x\", simp_all add:update_trans_def Let_def rev_app_def) \n apply(case_tac \"releasing \\ (aaa, ba)\", simp_all)\n apply (metis assms(1) case_prod_conv less_irrefl subset_iff wfs_2_def wfs_def)\n by (metis assms(1) case_prod_conv less_irrefl subset_iff wfs_2_def wfs_def)\n\n\nlemma lastNotCovered:\n\"wfs \\ \\ lastWr \\ x \\ covered \\ \n \\ (\\ b. (x, b) \\ covered \\ \\ lastWr \\ x \\ writes_on \\ x) \"\n apply (simp add: lastWr_def)\n apply (unfold writes_on_def)\n by (metis lastWr_def last_write_write_on writes_on_def)\n\n\n(*\n(\\ x. lastWr \\ x \\ covered \\)\"\n*)\n\n(*the following must be included in the proof:\n\ncon_assms ps assumed --- concerns allocation/bounds of C and rcu_0+i for all i\n\nmain_inv ms *done* --- main invariant has 3 parts\npsem_rules ps *done* --- how allocation works on the inside\nallocated_addresses ms ps *done* --- allocation for above are defined here\nsimple - observation_inv_ms ms *done* --- how own\\<^sub>W affects loc status (own\\<^sub>W loc = t \\ loc\\{s,n,det} t)\nhard - observation_inv_sig ms ps \\ *done* --- limits which values can be WM_read from C\nsimple - own\\<^sub>W_n_by_t_imp ms *done* --- related own\\<^sub>W of n to n_dec and n (value)\ntedious - general_structure ms *done* --- says how n \\ s \\ detaddrs\nlocal - preCond ms ps \\ (pc ms t) t *done* --- defines preconditions for t to proceed with stepping \nglobal - preCond ms ps \\ (pc ms ta) ta *done* --- defines preconditions for t to proceed with stepping \n\nlocal - weak_mem (pre/in/post block) (t ta)\nglobal - weak_mem (pre/in/post block) (ta t)\n*)\n\n\n\n(*the following describes originally reserved addresses*)\ndefinition \"default_locs \\ {i | i a. i=C \\ i = rcu_0+a \\ a \\i. i\\default_locs \\ \\isfree_addr i ps\"\n\ndefinition \"reservations_differ \\ \\i. i C\\rcu_0+i\"\n\ndefinition \"counters_limit ms \\ \\t. t CTRsync\\<^sub>1 ms t \\T_max \\ CTRsync\\<^sub>2 ms t \\T_max\"\n\ndefinition \"con_assms ms ps \\ reserved_bydef ps \\ reservations_differ \\ counters_limit ms \"\n \nlemmas con_assms_lemmas [simp] = reserved_bydef_def reservations_differ_def\n default_locs_def counters_limit_def\n\n\n\n\n\n\n\n\n(*----------------supporting lemmas--------------------*)\nlemma blind_isabelle_hdlist [simp]:\n \"det ms t\\[] \\ hd(det ms t) = det ms t!0\"\n by (simp add: hd_conv_nth)\n\nlemma aap_supplem_1:\n \"i det ms t\\[] \\((det ms t @ [ya]) ! i) = (det ms t)!i\"\n by (simp add: nth_append)\n\nlemma supportingrandomwhat1:\n \"ms' = ms\\v := v ms(t \\ z), pc := (pc ms)(t := I10)\\ \\ \ns ms t = s ms' t \\ n ms t = n ms' t \\ n_dec ms t = n_dec ms' t \\ det ms t = det ms' t \\ (\\loc. (own\\<^sub>W ms loc = own\\<^sub>W ms' loc \\ own\\<^sub>R ms loc = own\\<^sub>R ms' loc))\"\n by simp\n\nlemma suppotingrandom1:\n \"ms' = ms \\det := (det ms)(t := det ms t @ [ya]), pc := (pc ms)(t := R2),\n s_dec := (s_dec ms)(t := False), s := (s ms)(t := None)\\ \n\\ \\ loc. loc\\detaddrs ms t \\ loc\\detaddrs ms' t\"\n apply(clarsimp)\n by (metis butlast_snoc less_SucI nth_butlast)\n\n\nlemma suppotingrandom2:\n \"ms' = ms \\det := (det ms)(t := tl (det ms t)),\n own\\<^sub>R := (own\\<^sub>R ms)(hd (det ms t) := own\\<^sub>R ms (hd (det ms t)) - {t}),\n own\\<^sub>W := (own\\<^sub>W ms)(hd (det ms t) := None), pc := (pc ms)(t := R4)\\\n\\ det ms' t = tl(det ms t)\"\n by(clarsimp) \n\nlemma suppotingrandom3:\n \"ms' = ms \\det := (det ms)(t := tl (det ms t)),\n own\\<^sub>R := (own\\<^sub>R ms)(hd (det ms t) := own\\<^sub>R ms (hd (det ms t)) - {t}),\n own\\<^sub>W := (own\\<^sub>W ms)(hd (det ms t) := None), pc := (pc ms)(t := R4)\\\n\\ det ms t \\[]\n\\ loc \\ detaddrs ms' t\\ loc\\detaddrs ms t\"\n apply(clarsimp) \n by (metis Nitpick.size_list_simp(2) Suc_less_eq Suc_pred length_greater_0_conv nth_tl)\n \n\nlemma suppotingrandom4:\n \"ms' = ms \\det := (det ms)(t := tl (det ms t)),\n own\\<^sub>R := (own\\<^sub>R ms)(hd (det ms t) := own\\<^sub>R ms (hd (det ms t)) - {t}),\n own\\<^sub>W := (own\\<^sub>W ms)(hd (det ms t) := None), pc := (pc ms)(t := R4)\\\n\\ det ms t \\[]\n\\ loc\\detaddrs ms t \\ loc\\ detaddrs ms' t \\ loc = hd(det ms t)\"\n apply(clarsimp) \n by (metis Nitpick.size_list_simp(2) Suc_less_eq Suc_pred less_Suc_eq_0_disj nth_tl)\n \n\nlemma supp1:\n \"cvd[C,vala] \\ \\\n \\ [z \\ ya]\\<^sub>t \\' \\\n cvd[C,vala] \\'\"\n apply(simp add:covered_v_def lastWr_def OpSem.step_def RdX_def visible_writes_def) unfolding writes_on_def\n read_trans_def\n by (smt (z3) Collect_cong rev_app_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def)\n\nlemma supp2:\n \"cvd[C,vala] \\ \\\nwfs \\ \\\n \\ [z := ya]\\<^sub>t \\' \\\n z\\C \\\n cvd[C,vala] \\'\"\n by (metis cvd_WrX_other_var_pres)\n\n\n\n\n\n\n(*******************************************************************)\n\n\n\n\n\n\n(*----------------Main Invariant Shown--------------------*)\n\nlemma main_invariant_1_preservation:\n \"main_inv ms ps \\ \n wfs_2 \\ \\\n cvd[C,l] \\ \\\n t\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n general_structure ms \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n observation_inv_sig ms ps \\ \\\n main_inv_1 ms'\"\n apply simp \n apply(simp add: step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:new_int_def)\n apply clarify\n apply(subgoal_tac \"n ms t = None\") prefer 2\n apply fastforce apply(simp add:main_inv_lemmas) \n apply clarify \n apply(case_tac \"ta = t\", simp_all) \n apply(case_tac \"y = loc\", simp_all)\n apply (metis insert_not_empty option.sel)\n apply (metis option.sel)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"repeat ms t\", simp add:general_structure_lemmas)\n apply (metis Diff_empty Diff_insert0 option.sel)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*FAAZ*) defer\n apply(simp add:abbr main_inv_lemmas Rcap_def) apply clarify \n apply(simp add:general_structure_def)\n apply (metis option.sel)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n(*CAS*) defer\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply (metis singleton_iff)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def) apply auto[1]\n apply(case_tac \"nondet_val ms t \", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(case_tac \"det ms t \\ []\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply (metis Diff_empty Diff_insert0 singleton_inject)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n(*r[i] = rcu[counter]*) defer\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def) \n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n(*load(rcu[i])*) defer\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n apply(simp add:abbr main_inv_lemmas Rcap_def)\n(*dealing with FAAZ*)\n apply(simp add:FAAZ_def get_C_val_def)\n apply(case_tac \"\\repeat ms t\", simp_all)\n apply clarify\n apply(case_tac \"ta = t\")\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n apply (metis option.sel set_eq_subset)\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n apply clarify apply(intro conjI impI) prefer 2\n apply (metis option.sel)\n apply(subgoal_tac \"ta < T_max \\ own\\<^sub>W ms (the(n ms ta)) = Some ta\") prefer 2\n apply (metis option.sel)\n apply(subgoal_tac \"l \\ (the(n ms ta))\") prefer 2\n apply blast\n apply(subgoal_tac \"l = value \\ (a,b)\")\n apply blast \n prefer 2\n apply clarify\n apply(case_tac \"ta = t\")\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n apply (metis option.sel set_eq_subset)\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n apply clarify apply(intro conjI impI) prefer 2\n apply (metis option.sel)\n apply(subgoal_tac \"ta < T_max \\ own\\<^sub>W ms (the(n ms ta)) = Some ta\") prefer 2\n apply (metis option.sel)\n apply(subgoal_tac \"l \\ (the(n ms ta))\") prefer 2 \n apply blast\n apply(subgoal_tac \"l = value \\ (a,b)\")\n apply blast \n unfolding covered_v_def lastWr_def writes_on_def\n apply (metis (mono_tags, lifting) mem_Collect_eq subsetD visible_var visible_writes_in_writes )\n apply (metis (mono_tags, lifting) mem_Collect_eq subsetD visible_var visible_writes_in_writes )\n(*resolving CAS*)\n apply(simp add:cas_step_rcu_def) apply clarify\n apply(case_tac \"ya\", simp_all)\n apply(simp add:main_inv_lemmas)\n apply(simp add:main_inv_lemmas)\n(*resolving load_rcu_to_r*)\n apply(simp add:load_rcu_to_r_def)\n apply(simp add:main_inv_lemmas)\n apply clarify\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n apply (metis option.sel)\n(*resolving load(counter)*)\n apply(simp add:rcu_temp_copy_def)\n apply(simp add:main_inv_lemmas)\n apply clarify\n apply(simp add:general_structure_def own\\<^sub>W_n_by_t_imp_def observation_inv_sig_def)\n by (metis option.sel)\n\n\nlemma main_invariant_2_preservation:\n \"main_inv ms ps \\ \n wfs_2 \\ \\\n cvd[C,l] \\ \\\n t\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n general_structure ms \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n observation_inv_ms ms \\\n observation_inv_sig ms ps \\ \\\n main_inv_2 ms' ps'\"\n apply simp \n apply(simp add: step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas) \n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:new_int_def)\n apply clarify\n apply(subgoal_tac \"n ms t = None\") prefer 2\n apply fastforce apply(simp add:main_inv_lemmas) \n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"repeat ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n(*FAAZ*) defer\n apply(simp add:abbr main_inv_lemmas)\n apply force\n apply(simp add:abbr main_inv_lemmas)\n(*CAS*) defer\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"CAS_succ ms t \", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply clarify\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"det ms t = []\")\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply clarify\n apply(case_tac \"loc = det ms t ! 0\", simp_all)\n apply blast\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*r[i] = rcu[counter]*) defer\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*load(rcu[i])*) defer\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*dealing with FAAZ*)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:FAAZ_def get_C_val_def)\n apply(case_tac \"\\repeat ms t\", simp_all)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def)\n apply (metis Up_reads_cvd_v relating_step_to_update_trans_1)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def general_structure_def)\n apply (metis Up_reads_cvd_v relating_step_to_update_trans_1)\n(*dealing with CAS*)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:cas_step_rcu_def)\n apply clarify\n apply(case_tac \"ya\", simp_all)\n(*dealing with load_rcu_to_r*)\n apply(simp add:load_rcu_to_r_def main_inv_lemmas)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def)\n(*dealing with rcu_temp_copy*)\n apply(simp add:rcu_temp_copy_def main_inv_lemmas)\n apply clarify\n by(simp add:observation_inv_sig_def observation_inv_ms_def)\n\n\n\nlemma main_invariant_3_preservation:\n \"main_inv ms ps \\ \n wfs_2 \\ \\\n cvd[C,l] \\ \\\n t\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n general_structure ms \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n observation_inv_ms ms \\\n observation_inv_sig ms ps \\ \\\n main_inv_3 ms' ps'\"\n apply simp \n apply(simp add: step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:new_int_def)\n apply clarify apply(simp add:main_inv_lemmas) \n apply (metis insert_iff option.inject)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"repeat ms t\", simp_all) \n apply clarify\n apply(case_tac \"ta = t\", simp_all)\n apply(subgoal_tac \"the(n ms t) \\ the(s ms t)\") prefer 2\n apply (metis general_structure_def n_differ_from_s_inside_def option.sel)\n apply(subgoal_tac \"\\i. i det ms t ! i \\ the(s ms t)\")\n apply (smt (verit) insert_iff mem_Collect_eq names_2(2) option.sel)\n apply (metis (no_types, lifting) general_structure_def less_zeroE list.size(3) s_differ_from_det_inside_def)\n apply(simp add:abbr main_inv_lemmas)\n(*FAAZ*) defer\n apply(simp add:abbr main_inv_lemmas)\n apply force\n apply(simp add:abbr main_inv_lemmas)\n(*CAS*) defer\n apply(simp add:abbr main_inv_lemmas) \n apply (metis option.sel own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"CAS_succ ms t \", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply clarify\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"det ms t = []\")\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*r[i] = rcu[counter]*) defer\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*load(rcu[i])*) defer\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:abbr main_inv_lemmas)\n(*dealing with FAAZ*)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:FAAZ_def get_C_val_def)\n apply(case_tac \"\\repeat ms t\", simp_all)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def) \n apply (metis insertCI)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def general_structure_def) \n apply (metis insertI2)\n(*dealing with CAS*)\n apply(simp add:abbr main_inv_lemmas)\n apply(simp add:cas_step_rcu_def)\n apply clarify\n apply(case_tac \"ya\", simp_all) \n apply (metis (no_types, lifting) Rcap_def fun_upd_apply insertCI option.discI option.inject)\n(*dealing with load_rcu_to_r*)\n apply(simp add:load_rcu_to_r_def main_inv_lemmas)\n apply clarify\n apply(simp add:observation_inv_sig_def observation_inv_ms_def)\n(*dealing with rcu_temp_copy*)\n apply(simp add:rcu_temp_copy_def main_inv_lemmas)\n apply clarify\n by(simp add:observation_inv_sig_def observation_inv_ms_def)\n\n\n\n\nlemma main_invariant_preservation:\n \"main_inv ms ps \\ \n wfs_2 \\ \\ \\ \\new\\ \n t\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n observation_inv_ms ms \\ \\ \\new\\ \n cvd[C,vala] \\ \\ \n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\ \nmain_inv ms' ps'\"\n unfolding main_inv_def\n apply(intro conjI impI)\n using main_invariant_1_preservation main_inv_def apply blast\n using main_invariant_2_preservation main_inv_def apply blast\n using main_invariant_3_preservation main_inv_def by blast\n\n(*--------------------------------------------------------------------*)\n\n\n\n\n\n\n\n(*----------------allocated_addresses ms ps--------------------*)\n\nlemma allocated_addresses_preservation:\n \"main_inv ms ps \\ \n t\n wfs_2 \\ \\\n cvd[C,vala] \\ \\\n \\isfree_addr vala ps \\ \\ \\this is easily shown through alloc_addr\\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n allocated_addresses ms ps \\\n psem_rules ps \\\n con_assms ms ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n allocated_addresses ms' ps'\"\n apply (simp add:step_def preCond_def)\n apply(case_tac \" pc ms t\", simp_all add:own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas) \n apply meson\n apply(subgoal_tac \"n ms t = None\") prefer 2\n apply meson \n apply clarsimp \n apply(simp add:abbr allocated_addresses_lemmas general_structure_def)\n apply(intro conjI impI) \n apply clarsimp\n apply(simp add:Rcap_def)\n apply metis\n apply clarsimp\n apply(simp add:Rcap_def)\n apply (metis option.sel)\n apply clarsimp\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \"repeat ms t\", simp_all) \n apply (metis option.sel)\n apply(simp add:abbr allocated_addresses_lemmas) \n defer (*FAAZ*)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:OpSem.step_def RdX_def) \n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp \n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas cas_step_rcu_def) apply clarify\n apply(case_tac \"ya\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas) \n apply (metis option.sel)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(intro conjI impI) \n apply meson \n apply(case_tac \"det ms t = []\", simp_all)\n apply(simp add:general_structure_def)\n apply (metis Rcap_def insertCI option.sel) apply clarify\n apply(simp add:Rcap_def)\n apply(simp add:general_structure_def) \n apply (metis (no_types, opaque_lifting) aap_supplem_1 less_Suc_eq nth_append_length)\n apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \" det ms t \\ [] \", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas) \n apply(simp add:abbr allocated_addresses_lemmas general_structure_def) \n apply clarsimp \n apply(intro conjI impI)\n apply(case_tac \"det ms t = []\", simp add:Rcap_def)\n apply clarsimp\n apply(subgoal_tac \"hd (det ms t) = det ms t !0\") prefer 2 \n apply (metis hd_conv_nth)\n apply (metis empty_iff insert_iff length_0_conv not_gr_zero) \n apply (meson length_greater_0_conv n_differ_from_det_def)\n apply(case_tac \"det ms t = []\", simp add:Rcap_def)\n apply clarsimp\n apply(subgoal_tac \"hd (det ms t) = det ms t !0\") prefer 2 \n apply (metis hd_conv_nth) \n apply(case_tac \"t \\ ta\") \n apply (meson det_differ_from_det_def length_greater_0_conv)\n apply clarify \n apply clarsimp\n apply(case_tac \"length(det ms t) = 1\") \n apply linarith\n apply(subgoal_tac \"hd (det ms t) = det ms t !0\") prefer 2 \n apply (metis hd_conv_nth)\n apply(subgoal_tac \"tl (det ms t) ! ia = (det ms t) ! (ia+1)\") prefer 2\n apply (metis One_nat_def Suc_eq_plus1 length_tl nth_tl) \n apply(simp add:det_differ_from_det_def det_differ_inside_def) \n apply (metis (no_types, lifting) Suc_less_eq Suc_pred length_greater_0_conv)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \" CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:OpSem.step_def RdX_def) \n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:OpSem.step_def RdX_def) \n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr allocated_addresses_lemmas)\n apply(simp add:abbr allocated_addresses_lemmas)\n (*FAAZ*)\n apply(simp add:allocated_addresses_def)\n apply(intro conjI impI) prefer 2\n apply(simp add:get_C_val_def allocated_n_addr_def)\n apply(simp add:abbr allocated_addresses_lemmas FAAZ_def)\n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp\n apply metis prefer 2\n apply(simp add:get_C_val_def allocated_n_addr_def)\n apply(simp add:abbr allocated_addresses_lemmas FAAZ_def)\n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp\n apply(simp add:get_C_val_def allocated_n_addr_def)\n apply(simp add:abbr allocated_addresses_lemmas FAAZ_def)\n apply(simp add:Rcap_def Wcap_def general_structure_def con_assms_def)\n apply clarsimp\n by (metis Up_reads_cvd_v map_upd_eqD1 relating_step_to_update_trans_1)\n\n\n(*--------------------------------------------------------------------*)\n\n\n\n\n\n\n\n(*---------------------observation_inv_ms ms----------------------------*)\n\n\n\n\n\nlemma Local_correctness_observation_inv_ms:\n \"main_inv ms ps \\ \n t\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_ms ms \\\n own\\<^sub>W_n_by_t_imp ms \\ \nobservation_inv_ms ms'\"\n apply(simp add:observation_inv_ms_def)\n apply(simp add:step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr own\\<^sub>W_n_by_t_imp_def Wcap_def Rcap_def)\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply meson\n apply metis apply clarsimp \n apply (metis option.inject)\n apply(case_tac \"repeat ms t\", simp_all)\n (*FAAZ*) defer\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply clarify\n apply(simp add: step_def RdX_def)\n apply metis\n (*CAS*) defer\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply clarify \n apply(subgoal_tac \"det ms t @ [ya] = det ms' t\") prefer 2\n apply clarsimp\n apply(subgoal_tac \"\\i. own\\<^sub>W ms i = Some t \\ i\\detaddrs ms t \\ i = the(s ms t)\") prefer 2\n apply clarsimp\n apply meson\n apply(case_tac \"loc \\ detaddrs ms t\") \n apply (metis lessI nth_append_length)\n apply clarify\n apply(case_tac \"det ms t = []\")\n apply (metis Suc_le_length_iff detaddrs_def empty_Collect_eq inlist_def insert_absorb insert_not_empty less_eq_Suc_le list.distinct(1))\n apply(subgoal_tac \"\\ loc. loc\\detaddrs ms t \\ loc\\detaddrs ms' t\") apply clarsimp \n apply metis \n apply (metis suppotingrandom1)\n apply clarify apply(case_tac \"b\") apply(simp_all)\n apply blast\n apply blast\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(case_tac \" det ms t \\ [] \", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply clarify \n apply(case_tac \"det ms t=[]\") \n apply fastforce\n apply(case_tac \"length(det ms t) = Suc 0\")\n apply (metis less_Suc0)\n apply(subgoal_tac \"\\ loc. loc\\detaddrs ms t \\ loc\\detaddrs ms' t \\ loc = hd(det ms t)\") apply clarsimp \n apply meson \n apply(subgoal_tac \"hd(det ms t) = det ms t!0\") prefer 2\n apply (meson blind_isabelle_hdlist)\n apply (metis suppotingrandom4)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply clarify apply(simp add:step_def RdX_def) \n apply blast\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(simp add:general_structure_lemmas con_assms_def observation_inv_sig_def main_inv_lemmas)\n apply clarify apply(simp add:step_def RdX_def) \n apply blast\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n defer\n apply(clarify) apply(simp add:cas_step_rcu_def) apply clarify\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts')\", simp_all)\n apply(case_tac \"loc = y\", simp_all) \n apply(case_tac \"y = ya\", simp_all) \n apply(case_tac \"loc = ya\", simp_all)\n apply metis\n apply blast\n apply(simp add:get_C_val_def FAAZ_def)\n apply(case_tac \"repeat ms t\", simp_all)\n apply clarsimp \n apply metis\n apply clarsimp\n by metis \n\n(*---------------------------------------------------------------------*)\n\n\n\n\n\n\n(*------------------------observation_inv_sig Correctness---------------------------*)\n\n\n\n\nlemma Local_correctness_observation_inv_sig:\n \"main_inv ms ps \\ \n t\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n observation_inv_ms ms \\\n cvd[C,vala] \\ \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\ \n wfs_2 \\ \\\n con_assms ms ps \\\n allocated_addresses ms ps \\\nobservation_inv_sig ms' ps' \\'\"\n apply(simp add:step_def preCond_def)\n apply(case_tac \"pc ms t\")\n apply simp_all \n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply clarsimp apply(simp add:covered_v_def)\n apply metis\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def )\n apply (metis cvd_backwards_WrX )\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply(simp add:observation_inv_sig_def con_assms_def abbr)\n apply(case_tac \"repeat ms t\", simp_all)\n apply (metis cvd_backwards_WrX)\n apply (metis cvd_backwards_WrX )\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply(simp add:observation_inv_sig_def con_assms_def abbr)\n apply (metis cvd_backwards_WrX )\n (*FAAZ*) defer \n apply(simp add:abbr observation_inv_sig_def) apply clarify\n apply(simp add:Wcap_def own\\<^sub>W_n_by_t_imp_def)\n apply (metis not_cvd_RdX_pres)\n apply(simp add:writeto_star_n_def observation_inv_sig_def con_assms_def)\n apply (metis not_cvd_WrX_pres) \n (*cas_step_rcu*) defer\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply (metis cvd_backwards_WrX)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply clarify apply(case_tac \"b\", simp_all)\n apply auto[1]\n apply auto[1]\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(case_tac \"det ms t \\ []\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:Wcap_def own\\<^sub>W_n_by_t_imp_def)\n apply clarify\n apply(case_tac \"loc \\ hd (det ms t)\", simp_all)\n apply auto[1] \n apply(simp add:Rcap_def)\n apply (metis length_greater_0_conv)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def) \n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(simp add:Wcap_def own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:observation_inv_sig_def)\n apply (metis not_cvd_RdX_pres)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(simp add:Wcap_def own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply (metis not_cvd_RdX_pres)\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n apply(simp add:abbr observation_inv_sig_def con_assms_def) apply clarify \n(*FAAZ*)\n apply(simp add:abbr observation_inv_sig_def con_assms_def)\n apply(case_tac \"repeat ms t\", simp_all)\n apply(simp add:get_C_val_def)\n apply(subgoal_tac \"cvd[C,vala] \\'\") prefer 2\n using cvd_pres_by_FAAZ_unfold \n apply (metis (no_types, lifting) wfs_2_def)\n apply(subgoal_tac \"\\t loc. t own\\<^sub>W ms loc = Some t \\ t own\\<^sub>W ms' loc = Some t\") prefer 2\n apply clarsimp\n apply(subgoal_tac \"\\loc. isfree_addr loc ps \\ isfree_addr loc ps'\") prefer 2\n apply clarsimp\n apply clarsimp\n apply (elim disjE) prefer 2\n apply (meson FAAZ_is_RMW_R testtttttt wfs_2_def wfs_2_preserved)\n apply (meson FAAZ_is_RMW_R testtttttt wfs_2_def wfs_2_preserved)\n apply(simp add:get_C_val_def)\n apply(subgoal_tac \"cvd[C,vala] \\'\") prefer 2\n using cvd_pres_by_FAAZ_unfold \n apply (metis (no_types, lifting) wfs_2_def)\n apply(subgoal_tac \"\\t loc. t own\\<^sub>W ms loc = Some t \\ t own\\<^sub>W ms' loc = Some t\") prefer 2\n apply clarsimp\n apply(subgoal_tac \"\\loc. isfree_addr loc ps \\ isfree_addr loc ps'\") prefer 2\n apply clarsimp\n apply clarsimp\n apply (elim disjE) prefer 2\n apply (meson FAAZ_is_RMW_R testtttttt wfs_2_def wfs_2_preserved)\n apply (meson FAAZ_is_RMW_R testtttttt wfs_2_def wfs_2_preserved)\n(*cas_step_rcu*)\n apply (simp add:cas_step_rcu_def)\n apply (simp add:observation_inv_sig_def)\n apply (simp add:CAS_def)\n apply(clarify)\n apply(case_tac \"ya\", simp_all) prefer 2\n apply(case_tac \"value \\ (a, b) = yb\", simp_all)\n apply(subgoal_tac \"cvd[C,vala] \\'\") prefer 2 \n apply (metis CAS_def cvd_pres_by_CAS_unfold_pt1 fst_conv wfs_2_def) apply clarsimp\n apply(simp add:covered_v_def Rcap_def main_inv_lemmas Wcap_def)\n apply metis\n apply(case_tac \"value \\ (a, b) = yb\", simp_all)\n apply(case_tac \"loc = yb\", simp_all add:general_structure_lemmas)\n apply (metis (no_types, opaque_lifting) RMW_exist_w_in_post covered_v_def relating_step_to_update_trans_1)\n apply(case_tac \"loc = y\", simp_all add:Wcap_def)\n apply (meson allocated_addresses_def allocated_n_addr_def isfree_addr_def)\n by (metis (no_types, opaque_lifting) RMW_exist_w_in_post covered_v_def relating_step_to_update_trans_1)\n \n\n(*--------------------------------------------------------------*)\n\n\n\n\n\n\n\n(*-------------------own\\<^sub>W_n_by_t_imp ms----------------------*)\n\nlemma own\\<^sub>W_n_by_t_imp_preservation:\n \"main_inv ms ps \\ \n t\n own\\<^sub>W_n_by_t_imp ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n con_assms ms ps \\\n allocated_addresses ms ps\\\n general_structure ms \\\n own\\<^sub>W_n_by_t_imp ms'\"\n apply(simp add:step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply clarify \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply clarsimp apply(case_tac \"ta = t\", simp_all) \n apply (simp add: main_inv_2_def main_inv_3_def main_inv_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp split:if_splits add: allocated_addresses_lemmas)\n apply(case_tac \"repeat ms t\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n defer (*FAAZ*)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp split:if_splits add: allocated_addresses_lemmas)\n apply(simp add:Rcap_def)\n apply clarsimp\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n defer (*CAS*)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply clarsimp\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(case_tac \"det ms t = []\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n defer (*free(pop(detatched))*)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def)\n apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) defer\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def) \n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def get_C_val_def Rcap_def) (*FAAZ*)\n apply(case_tac \"repeat ms t\", simp_all)\n apply clarsimp\n apply clarsimp\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def cas_step_rcu_def Rcap_def)\n apply clarsimp\n apply(case_tac \"ya\", simp_all)\n apply (metis (no_types, lifting) general_structure_def n_differ_from_s_inside_def n_differ_from_s_outside_def option.sel)\n apply(simp add:abbr own\\<^sub>W_n_by_t_imp_def Rcap_def) (*free[pop[detached[t]]]*)\n apply (meson general_structure_def length_greater_0_conv n_differ_from_det_def)\n apply clarify\n by(simp add:OpSem.step_def)\n\n \n\n\n(*--------------------------------------------------------------*)\n\n\n\n\n\n\n\n\n(*-----------------------------General Struct Supp-------------------------------------------*)\n\n(*FAAZ for n_differ*)\nlemma faaz_n_differ:\n \" main_inv ms ps' \\\n t < T_max \\\n n_differ ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n psem_rules ps \\\n allocated_addresses ms ps' \\ n_differ ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def n_differ_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify \n apply(case_tac \"ta\\t\") \n apply simp\n apply(case_tac \"taa\\t\") \n apply simp\n by meson\n \n(*FAAZ for n_differ_from_s_outside*)\nlemma faaz_n_differ_from_s_outside:\n \" main_inv ms ps \\\n general_structure ms \\\n t < T_max \\\n wfs_2 \\ \\\n cvd[C,l] \\ \\\n n_differ_from_s_outside ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n observation_inv_sig ms ps \\ \\ n_differ_from_s_outside ms'\"\n unfolding general_structure_def preCond_def own\\<^sub>W_n_by_t_imp_def\n apply(simp add:get_C_val_def FAAZ_def n_differ_from_s_outside_def allocated_addresses_lemmas main_inv_lemmas)\n apply clarify\n apply(case_tac \"ta = t\")\n apply(subgoal_tac \"n_dec ms ta\") prefer 2\n apply meson\n apply(subgoal_tac \"n ms ta = Some i\") prefer 2\n apply auto[1]\n apply clarify\n apply(subgoal_tac \"taa \\ own\\<^sub>R ms i\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. taa \\ own\\<^sub>R ms loca \\ taa\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. taa \\ own\\<^sub>R ms loca \\ taa\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply blast\n apply(case_tac \"taa \\ t\")\n apply(subgoal_tac \"ta \\ t\") prefer 2 apply auto[1]\n apply(subgoal_tac \"\\loca. taa \\ own\\<^sub>R ms loca \\ taa\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. taa \\ own\\<^sub>R ms loca \\ taa\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. ta \\ own\\<^sub>R ms loca \\ ta\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. ta \\ own\\<^sub>R ms loca \\ ta\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply clarsimp\n apply meson\n apply(subgoal_tac \"taa = t\") prefer 2 apply auto[1]\n apply(subgoal_tac \"ta \\ t\") prefer 2 apply auto[1]\n apply clarsimp\n apply(subgoal_tac \"\\loca. ta \\ own\\<^sub>R ms loca \\ ta\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. ta \\ own\\<^sub>R ms loca \\ ta\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply(subgoal_tac \"\\loca. t \\ own\\<^sub>R ms loca \\ t\\own\\<^sub>R ms' loca\") prefer 2\n apply auto[1]\n apply clarsimp\n by (smt (verit) CollectD covered_v_def observation_inv_sig_def visible_writes_def)\n\n\n\n(*FAAZ for n_differ_from_s_inside*)\nlemma faaz_n_differ_from_s_inside:\n \" main_inv ms ps \\\n general_structure ms \\\n t < T_max \\\n wfs_2 \\ \\\n cvd[C,l] \\ \\\n n_differ_from_s_inside ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n psem_rules ps \\\n observation_inv_sig ms ps \\ \\ n_differ_from_s_inside ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def n_differ_from_s_inside_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(subgoal_tac \"n ms t = n ms' t\") prefer 2 apply simp\n apply(subgoal_tac \"s ms' t = Some (snd (update_trans t (a, b) (value \\ (a, b)) \\ ts', value \\ (a, b)))\") prefer 2\n apply clarsimp apply clarsimp\n apply(case_tac \"ta = t\", simp_all)\n by (metis Up_reads_cvd_v observation_inv_sig_def own\\<^sub>W_n_by_t_imp_def relating_step_to_update_trans_1)\n\n\n(*FAAZ for s_differ_from_det_inside*)\nlemma faaz_s_differ_from_det_inside:\n \" main_inv ms ps \\\n general_structure ms \\\n wfs_2 \\ \\\n cvd[C,l] \\ \\\n t < T_max \\\n s_differ_from_det_inside ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n psem_rules ps \\\n observation_inv_sig ms ps \\ \\ s_differ_from_det_inside ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def s_differ_from_det_inside_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(case_tac \"ta\\t\")\n apply simp \n apply (metis (no_types, lifting) insertE) apply clarsimp \n by (smt (verit) CollectD covered_v_def observation_inv_sig_def own\\<^sub>W_and_det_things_def visible_writes_def)\n \n\n(*FAAZ for n_differ_from_det*)\nlemma faaz_n_differ_from_det:\n \" main_inv ms ps \\\n t < T_max \\\n wfs_2 \\ \\\n n_differ_from_det ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n psem_rules ps \\\n allocated_addresses ms ps \\ n_differ_from_det ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def n_differ_from_det_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(case_tac \"ta\\t\")\n apply simp\n apply auto[1]\n apply(case_tac \"taa\\t\")\n apply simp\n apply auto[1]\n apply clarsimp \n by blast\n\n(*FAAZ for det_differ_from_det*)\nlemma faaz_det_differ_from_det:\n \" main_inv ms ps \\\n t < T_max \\\n wfs_2 \\ \\\n det_differ_from_det ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n psem_rules ps \\\n allocated_addresses ms ps \\ det_differ_from_det ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def det_differ_from_det_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(case_tac \"ta\\t\")\n apply simp\n by auto[1]\n\n(*FAAZ for det_differ_inside*)\nlemma faaz_det_differ_inside:\n \" main_inv ms ps \\\n t < T_max \\\n wfs_2 \\ \\\n det_differ_inside ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n psem_rules ps \\\n allocated_addresses ms ps \\ det_differ_inside ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def det_differ_inside_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(case_tac \"ta\\t\")\n apply simp\n by auto[1]\n\n(*FAAZ for own\\<^sub>W_and_det_things*)\nlemma faaz_own\\<^sub>W_and_det_things:\n \" main_inv ms ps \\\n t < T_max \\\n wfs_2 \\ \\\n cvd[C,l] \\ \\ \n own\\<^sub>W_and_det_things ms \\\n ms \\ s:=\\<^sup>FC t ms' \\' \\ ps = ps' \\\n preCond ms ps \\ (pc ms t) t \\ \n pc ms t = I8 \\\n con_assms ms ps \\\n psem_rules ps \\\n allocated_addresses ms ps \\ own\\<^sub>W_and_det_things ms'\"\n unfolding general_structure_def\n unfolding get_C_val_def FAAZ_def own\\<^sub>W_and_det_things_def allocated_addresses_lemmas main_inv_lemmas\n apply clarify\n apply(case_tac \"ta\\t\")\n apply simp\n by auto[1]\n\n\n\n\n\n\n\n\n(*----------------general_structure ms preservation--------------------*)\n\nlemma general_structure_preservation:\n \"main_inv ms ps \\ \n wfs_2 \\ \\\n cvd[C,l] \\ \\\n t\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n con_assms ms ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n observation_inv_sig ms ps \\ \\\n observation_inv_ms ms \\\n psem_rules ps \\\n allocated_addresses ms ps \\\n general_structure ms'\"\n apply(simp add:step_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add: abbr general_structure_def)\n apply(intro conjI impI)\n apply(simp add: n_differ_def)\n apply blast\n apply(simp add: n_differ_def n_differ_from_s_outside_def)\n apply blast\n apply (simp add: n_differ_from_s_inside_def)\n apply (simp add: s_differ_from_det_inside_def)\n apply(simp add:n_differ_from_det_def)\n apply blast\n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def)\n apply(intro conjI impI)\n apply(simp add: n_differ_def)\n apply blast\n apply(simp add: n_differ_def n_differ_from_s_outside_def)\n apply blast\n apply (simp add: n_differ_from_s_inside_def)\n apply (simp add: s_differ_from_det_inside_def)\n apply(simp add:n_differ_from_det_def)\n apply blast\n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def)\n apply(intro conjI impI)\n apply(simp add: n_differ_def)\n apply blast\n apply(simp add: n_differ_def n_differ_from_s_outside_def)\n apply blast\n apply (simp add: n_differ_from_s_inside_def)\n apply (simp add: s_differ_from_det_inside_def)\n apply(simp add:n_differ_from_det_def)\n apply blast\n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def)\n apply(intro conjI impI)\n apply(simp add: n_differ_def preCond_def) apply auto[1] \n apply(case_tac \"ta = t\", simp_all) apply clarsimp\n apply (metis (no_types, opaque_lifting) allocated_addresses_def isfree_addr_def pecpec1)\n apply (metis (no_types, opaque_lifting) allocated_addresses_def isfree_addr_def pecpec1)\n apply(simp add: n_differ_from_s_outside_def preCond_def) apply auto[1]\n apply(case_tac \"ta = t\", simp add:general_structure_lemmas) apply clarsimp\n apply (metis empty_iff isfree_addr_def main_inv_2_def main_inv_def)\n apply(simp add:general_structure_lemmas)\n apply (metis (no_types, opaque_lifting) allocated_addresses_def isfree_addr_def pecpec1)\n apply(simp add:general_structure_lemmas) apply clarsimp \n apply(case_tac \"ta = t\", simp_all)\n apply clarsimp\n apply(simp add:preCond_def)\n apply(simp add:s_differ_from_det_inside_def preCond_def) apply auto[1]\n apply (metis (no_types, lifting) insertE option.simps(3))\n apply(simp add:n_differ_from_det_def preCond_def) apply auto[1]\n apply (metis (no_types, opaque_lifting) allocated_addresses_def allocated_det_addr_def isfree_addr_def option.sel)\n apply(simp add:det_differ_from_det_def preCond_def) apply auto[1]\n apply(simp add:det_differ_inside_def) apply auto[1]\n apply(simp add:own\\<^sub>W_and_det_things_def) apply auto[1]\n apply (metis allocated_addresses_def allocated_det_addr_def isfree_addr_def)\n(*rcu_enter*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*rcu_exit*)\n apply(case_tac \"repeat ms t\")\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*rcu_enter 2*)\n apply(case_tac \"repeat ms t\")\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*FAAZ*)\n apply (metis Unique_allocs_def constant_alloc_ass_def faaz_det_differ_from_det faaz_det_differ_inside faaz_n_differ faaz_n_differ_from_det faaz_n_differ_from_s_inside faaz_n_differ_from_s_outside faaz_own\\<^sub>W_and_det_things faaz_s_differ_from_det_inside general_structure_def newran_def psem_rules_def wfs_2_def)\n(*v:=*s*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) apply auto[1]\n apply(simp add:s_differ_from_det_inside_def) apply auto[1] apply blast\n apply(simp add:n_differ_from_det_def)\n apply (metis (no_types, lifting) mstate.select_convs(3) mstate.select_convs(6) mstate.select_convs(8) mstate.surjective mstate.update_convs(1) mstate.update_convs(5))\n apply(simp add:det_differ_from_det_def) apply auto[1]\n apply(simp add:det_differ_inside_def) apply auto[1]\n apply(simp add:own\\<^sub>W_and_det_things_def) apply auto[1]\n(**n:=newv*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*cas_step_rcu*) \n apply(simp add: cas_step_rcu_def general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1] apply meson apply meson\n apply(simp add:n_differ_from_s_outside_def) apply auto[1] apply meson apply meson\n apply(simp add:n_differ_from_s_inside_def) apply auto[1] apply meson apply meson\n apply(simp add:s_differ_from_det_inside_def) apply auto[1] apply blast apply blast apply blast\n apply(simp add:n_differ_from_det_def) apply auto[1] apply blast apply (metis (no_types, lifting)) apply (metis (no_types, lifting))\n apply(simp add:det_differ_from_det_def) apply auto[1]\n apply(simp add:det_differ_inside_def) apply auto[1]\n apply(simp add:own\\<^sub>W_and_det_things_def) apply auto[1]\n apply(case_tac \"det ms ta ! i = yb\", simp_all) apply auto[1]\n apply(simp add:observation_inv_sig_def)\n apply(simp add:CAS_def)\n apply(case_tac \"value \\ (a, b) = det ms ta ! i\", simp_all)\n using visible_writes_def covered_v_def\n apply (smt (verit) CollectD)\n apply (simp add: n_differ_from_det_def)\n (*rcu_exit*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*go_to_I14*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def)\n apply(simp add:n_differ_from_det_def)\n apply(simp add:n_differ_from_det_def)\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*repeat?*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:n_differ_from_s_outside_def)\n apply(simp add:n_differ_from_det_def) \n apply(simp add:n_differ_from_det_def) \n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*CAS_succ choice*)\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*insert[detached[t],s]*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) \n apply(simp add:n_differ_from_det_def own\\<^sub>W_n_by_t_imp_def) \n apply clarsimp\n apply(intro conjI impI)\n apply auto[1]\n apply (smt (verit) Wcap_def bot_nat_0.extremum_strict insertCI less_Suc_eq list.size(3) nth_append nth_append_length option.sel)\n apply auto[1]\n apply blast\n apply(simp add:det_differ_from_det_def own\\<^sub>W_n_by_t_imp_def) apply auto[1]\n apply (smt (verit) Wcap_def bot_nat_0.extremum_strict insertCI less_Suc_eq list.size(3) map_upd_eqD1 nth_append nth_append_length own\\<^sub>W_and_det_things_def)\n apply (smt (verit) Wcap_def aap_supplem_1 diff_is_0_eq diff_zero insertCI less_Suc_eq less_Suc_eq_le list.size(3) map_upd_eqD1 nth_append_length own\\<^sub>W_and_det_things_def)\n apply(simp add:det_differ_inside_def det_differ_from_det_def own\\<^sub>W_n_by_t_imp_def) apply auto[1]\n apply safe\n apply(simp add:own\\<^sub>W_and_det_things_def s_differ_from_det_inside_def)\n apply (smt (verit) Rcap_def aap_supplem_1 bot_nat_0.extremum_strict insertCI less_Suc_eq list.size(3) nth_append_length)\n apply(simp add:own\\<^sub>W_and_det_things_def s_differ_from_det_inside_def det_differ_inside_def)\n apply auto[1] \n apply(subgoal_tac \"\\i. i own\\<^sub>W ms ((det ms t) ! i) = Some t\") prefer 2 \n apply (metis gr_implies_not_zero list.size(3)) \n apply (metis (no_types, lifting) Wcap_def insertCI less_Suc_eq nth_append nth_append_length)\n(*nondet()*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*nondet choice*)\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*move_to_r5 if det ms t=[]*)\n apply(case_tac \"det ms t \\ []\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*free[pop[detached[t]]]*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply (smt (z3) One_nat_def diff_less length_greater_0_conv length_tl lessI less_trans_Suc nth_tl)\n apply(simp add:det_differ_from_det_def) \n apply (simp add: less_diff_conv nth_tl)\n apply(simp add:det_differ_inside_def) \n apply (simp add: less_diff_conv nth_tl)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply (simp add: less_diff_conv nth_tl)\n apply (metis (no_types, lifting) Nitpick.size_list_simp(2) Suc_less_eq det_differ_from_det_def det_differ_inside_def length_greater_0_conv nat.distinct(1) nth_tl)\n(*r[N]:={0}*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*if CRTsync1 then...splits*)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*r[i]:=rcu[CTRsync\\<^sub>1 ms t]*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) apply auto[1]\n apply(simp add:s_differ_from_det_inside_def) apply auto[1] apply blast\n apply(simp add:n_differ_from_det_def) apply auto[1] apply blast\n apply(simp add:det_differ_from_det_def) apply auto[1]\n apply(simp add:det_differ_inside_def) apply auto[1]\n apply(simp add:own\\<^sub>W_and_det_things_def) apply auto[1]\n(*if CTRsync\\<^sub>2 ms t < T_max splits*)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*r ms t (CTRsync\\<^sub>2 ms t) = 0 splits*)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n(*loadCTRsync\\<^sub>2*)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) apply auto[1]\n apply(simp add:s_differ_from_det_inside_def) apply auto[1] apply blast\n apply(simp add:n_differ_from_det_def) apply auto[1] apply blast\n apply(simp add:det_differ_from_det_def) apply auto[1]\n apply(simp add:det_differ_inside_def) apply auto[1]\n apply(simp add:own\\<^sub>W_and_det_things_def) apply auto[1]\n(*reg ms t = Suc 0 splits*)\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n apply(simp add:own\\<^sub>W_and_det_things_def)\n apply(simp add: abbr general_structure_def preCond_def)\n apply(intro conjI impI)\n apply(simp add:n_differ_def) apply auto[1]\n apply(simp add:n_differ_from_s_outside_def) apply auto[1]\n apply(simp add:n_differ_from_s_inside_def) \n apply(simp add:s_differ_from_det_inside_def) apply auto[1]\n apply(simp add:n_differ_from_det_def) \n apply(simp add:det_differ_from_det_def)\n apply(simp add:det_differ_inside_def)\n by(simp add:own\\<^sub>W_and_det_things_def)\n\n\n(*--------------------------------------------------------------------*)\n\n\n\n\n\n\n\n(*----------------Local Correctness--------------------*)\n\nlemma Local_Correctness_preservation:\n \"main_inv ms ps \\ \n t\n wfs_2 \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n con_assms ms ps \\\n general_structure ms \\\n observation_inv_sig ms ps \\ \\\n observation_inv_ms ms \\\n own\\<^sub>W_n_by_t_imp ms \\\n allocated_addresses ms ps \\\n preCond ms' ps' \\' (pc ms' t) t\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) \n apply (meson insertI1)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"repeat ms t\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(intro conjI impI) \n apply clarsimp\n apply(simp add:general_structure_lemmas) apply clarify\n apply (metis less_nat_zero_code list.size(3))\n apply meson\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def get_C_val_def) apply clarsimp\n apply(intro conjI impI)\n apply(simp add:Rcap_def)\n apply(simp add:Wcap_def) \n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) \n(*cas_step*) defer\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply (metis own\\<^sub>W_n_by_t_imp_def)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"CAS_succ ms t\", simp_all) \n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:general_structure_def own\\<^sub>W_and_det_things_def)\n apply(simp add:main_inv_lemmas) apply clarsimp\n apply(subgoal_tac \"length(det ms t @ [ya]) = Suc(length(det ms t))\") prefer 2\n apply (meson length_append_singleton)\n apply (metis aap_supplem_1 bot_nat_0.extremum_strict less_Suc_eq list.size(3) nth_append_length)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"det ms t \\ [] \", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp defer\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp defer\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>1 ms t = t\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n(*r[i]:=rcu[counter]*) defer\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n(*load(counter)*) defer\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n(*dealing with cas_step_rcu*)\n apply(simp add:cas_step_rcu_def) apply clarsimp\n apply(case_tac \"ya\", simp_all)\n apply(simp add:abbr Rcap_def Wcap_def) apply clarsimp\n apply (metis general_structure_def less_nat_zero_code list.size(3) n_differ_from_det_def)\n apply(simp add:abbr Rcap_def Wcap_def) defer defer\n(*dealing with r[i]:=rcu[counter]*)\n apply(simp add:load_rcu_to_r_def) apply clarsimp\n apply(simp add:abbr Rcap_def Wcap_def)\n(*dealing with rcu_temp_copy*)\n apply(simp add:rcu_temp_copy_def)\n apply clarsimp \n apply(simp add:abbr Rcap_def Wcap_def) defer\n apply(intro conjI impI)\n apply (simp add: det_differ_inside_def general_structure_def nth_tl)\n apply(subgoal_tac \"\\j. j own\\<^sub>W ms (det ms t!j) = Some t\") prefer 2 \n apply blast\n apply safe\n sledgehammer\n sorry\n(*--------------------------------------------------------------------*)\n\n\n\n\n\n\n(*----------------- Supporting Global Correctness -----------------*)\n\nlemma Global_Correctness_preservation_S1:\n \"pc ms t = S1 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(simp_all add:abbr Rcap_def Wcap_def)\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] by auto[1]\n\n\n\nlemma Global_Correctness_preservation_S2:\n \"pc ms t = S2 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(case_tac[!] \"CTRsync\\<^sub>1 ms t = t\", simp_all add:abbr Rcap_def Wcap_def)\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] apply auto[1]\n apply auto[1] apply auto[1] apply auto[1] by auto[1]\n\n\n\n\nlemma Global_Correctness_preservation_S3:\n \"pc ms t = S3 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify apply auto[1]\n apply(simp add:Rcap_def Wcap_def) apply clarify by auto[1]\n\n\n\n\n\n\n\n\nlemma Global_Correctness_preservation_S4:\n \"pc ms t = S4 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\n\n\nlemma Global_Correctness_preservation_S5:\n \"pc ms t = S5 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\n\n\nlemma Global_Correctness_preservation_S6:\n \"pc ms t = S6 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n apply (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n apply(simp add:Rcap_def Wcap_def) \n by (metis canonically_ordered_monoid_add_class.lessE con_assms_def counters_limit_def le_neq_implies_less not_add_less1)\n\n\n\n\n\nlemma Global_Correctness_preservation_S7:\n \"pc ms t = S7 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"reg ms t = Suc 0\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\n\n\n\n\nlemma Global_Correctness_preservation_R1:\n \"pc ms t = R1 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def) apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\nlemma Global_Correctness_preservation_R2:\n \"pc ms t = R2 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(clarify) apply(case_tac \"b\", simp_all)\n apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) apply(case_tac \"b\", simp_all)\n apply(simp add:Rcap_def Wcap_def) apply(clarify) by(case_tac \"b\", simp_all)\n\n\n\n\nlemma Global_Correctness_preservation_R3:\n \"pc ms t = R3 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"nondet_val ms t\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\nlemma Global_Correctness_preservation_R4:\n \"pc ms t = R4 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(case_tac[!] \"det ms t \\ []\", simp_all add:abbr)\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) \n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) apply metis\n apply(simp add:Rcap_def Wcap_def) by metis\n\n\n\n\nlemma Global_Correctness_preservation_R5:\n \"pc ms t = R5 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(case_tac \"repeat ms ta\", simp_all)\n apply(intro conjI impI)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis con_assms_def counters_limit_def leD)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis con_assms_def counters_limit_def leD)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis con_assms_def counters_limit_def leD)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(simp add:Rcap_def Wcap_def)\n apply (metis length_greater_0_conv singleton_iff)\n apply(intro conjI impI)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n by (metis con_assms_def counters_limit_def leD)\n\n\n\nlemma Global_Correctness_preservation_cas_res:\n \"pc ms t = cas_res \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(case_tac[!] \"CAS_succ ms t\", simp_all add:abbr)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\n\n\nlemma Global_Correctness_preservation_I1:\n \"pc ms t = I1 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\n\nlemma Global_Correctness_preservation_I2:\n \"pc ms t = I2 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\nlemma Global_Correctness_preservation_I3:\n \"pc ms t = I3 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\n\n\n\nlemma Global_Correctness_preservation_I4:\n \"pc ms t = I4 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply(case_tac \"repeat ms ta\", simp_all)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply(case_tac \"CAS_succ ms ta\", simp_all)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject)\n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis con_assms_def counters_limit_def leD)\n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n apply (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n apply(clarify, simp add:observation_inv_ms_def allocated_addresses_lemmas)\n by (metis insert_iff less_nat_zero_code list.size(3) option.inject) \n \n\n\nlemma Global_Correctness_preservation_I5:\n \"pc ms t = I5 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\nlemma Global_Correctness_preservation_I6:\n \"pc ms t = I6 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(case_tac[!] \"repeat ms t\", simp_all)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp)\n\n\n\n\n\nlemma Global_Correctness_preservation_I7:\n \"pc ms t = I7 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) by(clarify, simp) \n\n\n\n\n\n\nlemma Global_Correctness_preservation_I8:\n \"pc ms t = I8 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr get_C_val_def FAAZ_def cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(case_tac \"repeat ms t\", simp_all)\n apply (metis con_assms_def counters_limit_def leD)\n apply (metis con_assms_def counters_limit_def leD)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n by(clarify, simp) \n\n\n\n\n\n\n\nlemma Global_Correctness_preservation_I9:\n \"pc ms t = I9 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(case_tac \"CAS_succ ms ta\", simp_all)\n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) apply(clarify, simp) apply(clarify, simp) \n apply(clarify, simp) by(clarify, simp)\n\n\n\n\n\nlemma Global_Correctness_preservation_I10:\n \"pc ms t = I10 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis by metis\n\n\n\n\nlemma Global_Correctness_preservation_I11:\n \"pc ms t = I11 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n observation_inv_sig ms ps \\ \\ observation_inv_ms ms \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr cas_step_rcu_def Rcap_def Wcap_def)\n apply(intro conjI impI)\n apply(clarify , case_tac \"ya\", simp_all)\n apply(clarify , case_tac \"ya\", simp_all)\n apply auto[1]\n apply (meson general_structure_def n_differ_from_s_outside_def)\n apply (meson general_structure_def n_differ_from_s_outside_def)\n apply (simp add: general_structure_lemmas)\n apply(subgoal_tac \"n ms ta \\ Some yb\") prefer 2\n apply (metis option.distinct(1))\n apply(subgoal_tac \"s ms ta \\ Some yb\") prefer 2\n apply presburger\n apply(subgoal_tac \"\\i. i det ms ta !i \\ vala\") prefer 2\n apply(simp add:observation_inv_sig_def)\n apply metis\n apply(simp add:CAS_def visible_writes_def covered_v_def)\n apply (metis Pair_inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify)\n apply(intro conjI impI)\n apply (metis option.inject)\n apply (metis option.inject)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(case_tac \"vala = yb\", simp_all)\n apply metis\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify)\n apply(intro conjI impI)\n apply (metis option.inject)\n apply (metis option.inject)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(case_tac \"vala = yb\", simp_all)\n apply metis\n apply(clarify, case_tac \"ya\", simp_all)\n apply(clarify)\n apply(intro conjI impI)\n apply (metis option.inject)\n apply (metis option.inject)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(case_tac \"vala = yb\", simp_all)\n apply metis\n apply(clarify, case_tac \"yb\", simp_all)\n apply(clarify)\n apply(intro conjI impI)\n apply (metis option.inject)\n apply (metis option.inject)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis Pair_inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.inject prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"yb\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"yb\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"yb\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"yb\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply(case_tac \"vala = yd\", simp_all)\n apply(case_tac \"CAS_succ ms ta\", simp_all)\n apply (metis option.sel)\n apply (metis option.sel)\n apply metis\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n apply (metis option.sel prod.inject)\n apply(clarify, case_tac \"ya\", simp_all)\n apply(simp add:CAS_def visible_writes_def covered_v_def observation_inv_sig_def)\n by (metis option.sel prod.inject)\n \n \n\n\n\n\nlemma Global_Correctness_preservation_I12:\n \"pc ms t = I12 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr Rcap_def Wcap_def)\n by metis+\n\nlemma Global_Correctness_preservation_I13:\n \"pc ms t = I13 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr Rcap_def Wcap_def)\n by metis+\n\n\n\nlemma Global_Correctness_preservation_I14:\n \"pc ms t = I14 \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (simp_all add:step_def preCond_def)\n apply(case_tac \"pc ms ta\", simp_all add:abbr Rcap_def Wcap_def)\n by metis+\n\n\nlemma Global_Correctness_preservation_finished:\n \"pc ms t = finished \\\n main_inv ms ps \\ t ta t\\ta \\ wfs_2 \\ \\ cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ preCond ms ps \\ (pc ms t) t \\ preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\ psem_rules ps \\ allocated_addresses ms ps \\ con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n by (simp_all add:step_def preCond_def)\n\n\n\n(*----------------Global Correctness--------------------*)\n\nlemma Global_Correctness_preservation:\n \"main_inv ms ps \\ \n t\n ta\n t\\ta \\\n wfs_2 \\ \\\n cvd[C,vala] \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n preCond ms ps \\ (pc ms ta) ta \\ \n general_structure ms \\\n psem_rules ps \\\n observation_inv_sig ms ps \\ \\ \n observation_inv_ms ms \\\n allocated_addresses ms ps \\\n con_assms ms ps \\\n preCond ms' ps' \\' (pc ms ta) ta\"\n apply (case_tac \"pc ms t\")\n using Global_Correctness_preservation_I1 apply blast\n using Global_Correctness_preservation_I2 apply blast\n using Global_Correctness_preservation_I3 apply blast\n using Global_Correctness_preservation_I4 apply blast\n using Global_Correctness_preservation_I5 apply blast\n using Global_Correctness_preservation_I6 apply blast\n using Global_Correctness_preservation_I7 apply blast\n using Global_Correctness_preservation_I8 apply blast\n using Global_Correctness_preservation_I9 apply blast\n using Global_Correctness_preservation_I10 apply blast\n using Global_Correctness_preservation_I11 apply blast\n using Global_Correctness_preservation_I12 apply blast\n using Global_Correctness_preservation_I13 apply blast\n using Global_Correctness_preservation_I14 apply blast\n using Global_Correctness_preservation_cas_res apply blast\n using Global_Correctness_preservation_finished apply blast\n using Global_Correctness_preservation_R1 apply blast\n using Global_Correctness_preservation_R2 apply blast\n using Global_Correctness_preservation_R3 apply blast\n using Global_Correctness_preservation_R4 apply blast\n using Global_Correctness_preservation_R5 apply blast\n using Global_Correctness_preservation_S1 apply blast\n using Global_Correctness_preservation_S2 apply blast\n using Global_Correctness_preservation_S3 apply blast\n using Global_Correctness_preservation_S4 apply blast\n using Global_Correctness_preservation_S5 apply blast\n using Global_Correctness_preservation_S6 apply blast\n using Global_Correctness_preservation_S7 by blast\n\n\n\n\n(*--------------------------------------------------------------------*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*=======================================================*)\n(*+++++++++++++++++++these \"MIGHT\" be useful+++++++++++++*)\n(*=======================================================*)\n\n(*---------------counter2_rule ms------------------------*)\n\nlemma Local_counter2_rule:\n \"main_inv ms ps \\ \n t\n wfs_2 \\ \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n counter2_rule ms \\\n con_assms ms ps \\\n general_structure ms \\\n observation_inv_sig ms ps \\ \\\n observation_inv_ms ms \\\n psem_rules ps \\ \n own\\<^sub>W_n_by_t_imp ms \\\n allocated_addresses ms ps \\\n counter2_rule ms'\"\n apply (simp_all add:step_def preCond_def counter2_rule_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n apply clarsimp\n apply(simp split: if_splits)\n apply(simp add:general_structure_def n_differ_from_det_def Rcap_def own\\<^sub>W_and_det_things_def)\n apply(simp add:allocated_addresses_lemmas)\n apply (metis less_nat_zero_code list.size(3))\n apply blast\n apply clarsimp \n apply(case_tac \"repeat ms t\", simp)\n apply (metis (no_types, lifting) DiffD1)\n apply blast \n defer (*FAAZ*)\n apply clarsimp\n apply blast\n apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) ya y \\ ts')\", simp_all)\n apply blast\n apply blast\n apply clarsimp\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply blast\n apply blast\n apply auto[1]\n apply clarsimp\n apply blast\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply clarsimp\n \n\n\n sorry\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/RCU.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29614125174964995}} {"text": "(*<*)\ntheory BenOr_Proofs\nimports Heard_Of.Reduction\n Two_Step_Observing \"../HO_Transition_System\" BenOr_Defs\nbegin\n(*>*)\n\nsubsection \\Proofs\\\n\ntype_synonym ben_or_TS_state = \"(nat \\ (process \\ (val pstate)))\"\n\nconsts \n val0 :: val \n val1 :: val\n\ntext \\Ben-Or works only on binary values.\\\naxiomatization where \n val_exhaust: \"v = val0 \\ v = val1\"\n and val_diff: \"val0 \\ val1\"\n\ncontext mono_quorum\nbegin\n\ndefinition BenOr_Alg :: \"(process, val pstate, val msg)CHOAlgorithm\" where\n \"BenOr_Alg = CHOAlgorithm.truncate BenOr_M\"\n\ndefinition BenOr_TS ::\n \"(round \\ process HO) \\ (round \\ process HO) \\ (round \\ process) \\ ben_or_TS_state TS\"\nwhere\n \"BenOr_TS HOs SHOs crds = CHO_to_TS BenOr_Alg HOs SHOs (K o crds)\"\n\nlemmas BenOr_TS_defs = BenOr_TS_def CHO_to_TS_def BenOr_Alg_def CHOinitConfig_def\n BenOr_initState_def\n\ntype_synonym rHO = \"nat \\ process HO\"\n\ndefinition BenOr_trans_step \n where\n \"BenOr_trans_step HOs SHOs nxt_f snd_f stp \\ \\r \\.\n {((r, cfg), (Suc r, cfg'))|cfg cfg'. two_step r = stp \\ (\\p.\n \\ p \\ get_msgs (snd_f r) cfg (HOs r) (SHOs r) p\n \\ nxt_f r p (cfg p) (\\ p) (cfg' p)\n )}\"\n\nlemma two_step_less_D:\n \"0 < two_step r \\ two_step r = Suc 0\"\n by(auto simp add: two_step_def)\n\nlemma BenOr_trans:\n \"CSHO_trans_alt BenOr_sendMsg (\\r p st msgs crd st'. BenOr_nextState r p st msgs st') HOs SHOs crds = \n BenOr_trans_step HOs SHOs next0 send0 0\n \\ BenOr_trans_step HOs SHOs next1 send1 1\n \"\nproof\n show \"CSHO_trans_alt BenOr_sendMsg (\\r p st msgs crd. BenOr_nextState r p st msgs) HOs SHOs crds\n \\ BenOr_trans_step HOs SHOs next0 send0 0 \\ BenOr_trans_step HOs SHOs next1 send1 1\"\n by(force simp add: CSHO_trans_alt_def BenOr_sendMsg_def BenOr_nextState_def BenOr_trans_step_def \n K_def dest!: two_step_less_D)\nnext\n show \" BenOr_trans_step HOs SHOs next0 send0 0 \\\n BenOr_trans_step HOs SHOs next1 send1 1\n \\ CSHO_trans_alt BenOr_sendMsg\n (\\r p st msgs crd. BenOr_nextState r p st msgs) HOs SHOs crds\"\n by(force simp add: CSHO_trans_alt_def BenOr_sendMsg_def BenOr_nextState_def BenOr_trans_step_def)\nqed\n\ndefinition \"BenOr_A = CHOAlgorithm.truncate BenOr_M\"\n\nsubsubsection \\Refinement\\\n(******************************************************************************)\n\ntext \\Agreement for BenOr only holds if the communication predicates hold\\\ncontext\n fixes\n HOs :: \"nat \\ process \\ process set\"\n and rho :: \"nat \\ process \\ val pstate\"\n assumes comm_global: \"BenOr_commGlobal HOs\"\n and per_rd: \"\\r. BenOr_commPerRd (HOs r)\"\n and run: \"HORun BenOr_A rho HOs\"\nbegin\n(******************************************************************************)\n\ndefinition no_vote_diff where\n \"no_vote_diff sc p \\ vote (sc p) = None \\\n (\\q q'. x (sc q) \\ x (sc q'))\"\n\ndefinition ref_rel :: \"(tso_state \\ ben_or_TS_state)set\" where\n \"ref_rel \\ {(sa, (r, sc)).\n r = next_round sa\n \\ (two_step r = 1 \\ r_votes sa = vote o sc)\n \\ (two_step r = 1 \\ (\\p. no_vote_diff sc p))\n \\ (\\p v. x (sc p) = v \\ (\\q. last_obs sa q \\ {None, Some v}))\n \\ decisions sa = decide o sc\n }\"\n\nlemma HOs_intersect:\n \"HOs r p \\ HOs r' q \\ {}\" using per_rd\n apply(simp add: BenOr_commPerRd_def)\n apply(blast dest: qintersect)\n done\n\nlemma HOs_nonempty:\n \"HOs r p \\ {}\" \n using HOs_intersect\n by blast\n\nlemma vote_origin:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = 0\"\n shows \n \"vote (cfg' p) = Some v \\ (\\q \\ HOs r p. x (cfg q) = v)\" \n using send[THEN spec, where x=p] step[THEN spec, where x=p] step_r HOs_nonempty\n by(auto simp add: next0_def get_msgs_benign send0_def msgRcvd_def o_def restrict_map_def)\n \nlemma same_new_vote:\n assumes \n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = 0\"\n obtains v where \"\\p w. vote (cfg' p) = Some w \\ w = v\" \nproof(cases \"\\p v. vote (cfg' p) = Some v\")\n case True\n assume asm: \"\\v. \\p w. vote (cfg' p) = Some w \\ w = v \\ thesis\"\n from True obtain p v where \"vote (cfg' p) = Some v\" by auto\n\n hence \"\\p w. vote (cfg' p) = Some w \\ w = v\" (is \"?LV(v)\")\n using vote_origin[OF send step step_r] HOs_intersect\n by(force)\n\n from asm[OF this] show ?thesis .\nqed(auto)\n\nlemma no_x_change:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = 0\"\n shows \n \"x (cfg' p) = x (cfg p)\" \n using send[THEN spec, where x=p] step[THEN spec, where x=p] step_r HOs_nonempty\n by(auto simp add: next0_def get_msgs_benign send0_def msgRcvd_def o_def restrict_map_def)\n\nlemma no_vote:\n assumes \n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = 0\"\n shows\n \"no_vote_diff cfg' p\" \n unfolding no_vote_diff_def\nproof\n assume\n \"vote (cfg' p) = None\"\n hence \"(\\q q'. x (cfg q) \\ x (cfg q'))\"\n using send[THEN spec, where x=p] step[THEN spec, where x=p] step_r HOs_nonempty \n apply(clarsimp simp add: next0_def get_msgs_benign send0_def msgRcvd_def o_def restrict_map_def)\n by metis\n thus \"(\\q q'. x (cfg' q) \\ x (cfg' q'))\" \n using no_x_change[OF send step step_r]\n by(simp)\nqed\n \n\nlemma step0_ref:\n \"{ref_rel} \\r S v. tso_round0 r S v, \n BenOr_trans_step HOs HOs next0 send0 0 {> ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs BenOr_trans_step_def all_conj_distrib)\n fix sa r cfg \\ cfg'\n assume\n R: \"(sa, (r, cfg)) \\ ref_rel\"\n and step_r: \"two_step r = 0\" \n and send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n\n from R have next_r: \"next_round sa = r\"\n by(simp add: ref_rel_def)\n\n from HOs_nonempty send have \"\\p. \\q. q \\ msgRcvd (\\ p)\"\n by(fastforce simp add: get_msgs_benign send0_def msgRcvd_def restrict_map_def)\n with step have same_dec: \"decide o cfg' = decide o cfg\"\n apply(simp add: next0_def o_def)\n by (metis pstate.select_convs(3) pstate.surjective pstate.update_convs(2))\n \n define S where \"S = {p. \\v. vote (cfg' p) = Some v}\"\n from same_new_vote[OF send step step_r] \n obtain v where v: \"\\p \\ S. vote (cfg' p) = Some v\"\n by(simp add: S_def) (metis)\n hence vote_const_map: \"vote o cfg' = const_map v S\"\n by(auto simp add: S_def const_map_def restrict_map_def intro!: ext)\n\n define sa' where \"sa' = sa\\ next_round := Suc r, r_votes := const_map v S \\\"\n\n have \"\\p. p \\ S \\ opt_obs_safe (last_obs sa) v\"\n using vote_origin[OF send step step_r] R per_rd[THEN spec, of r] v\n apply(clarsimp simp add: BenOr_commPerRd_def opt_obs_safe_def ref_rel_def)\n by metis\n \n hence \"(sa, sa') \\ tso_round0 r S v\" using next_r step_r v R \n vote_origin[OF send step step_r]\n by(auto simp add: tso_round0_def sa'_def all_conj_distrib)\n\n\n moreover have \"(sa', Suc r, cfg') \\ ref_rel\" using step send v R same_dec step_r next_r\n apply(auto simp add: ref_rel_def sa'_def two_step_phase_Suc vote_const_map next0_def\n all_conj_distrib no_vote[OF send step step_r])\n by (metis pstate.select_convs(1) pstate.surjective pstate.update_convs(2))\n\n ultimately show\n \"\\sa'. (\\r S v. (sa, sa') \\ tso_round0 r S v) \\ (sa', Suc r, cfg') \\ ref_rel\"\n by blast\nqed\n\ndefinition D where\n \"D cfg cfg' \\ {p. decide (cfg' p) \\ decide (cfg p) }\"\n\nlemma decide_origin:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send1 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next1 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = Suc 0\"\n shows \n \"D cfg cfg' \\ {p. \\v. decide (cfg' p) = Some v \\ (\\q \\ HOs r p. vote (cfg q) = Some v)}\" \n using assms\n by(fastforce simp add: D_def next1_def get_msgs_benign send1_def msgRcvd_def o_def restrict_map_def\n x_update_def dec_update_def identicalVoteRcvd_def all_conj_distrib someVoteRcvd_def isVote_def)\n \nlemma step1_ref:\n \"{ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UNIV} \\r d_f o_f. tso_round1 r d_f o_f, \n BenOr_trans_step HOs HOs next1 send1 (Suc 0) {> ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs BenOr_trans_step_def all_conj_distrib)\n fix sa r cfg \\ and cfg' :: \"process \\ val pstate\"\n assume\n R: \"(sa, (r, cfg)) \\ ref_rel\"\n and step_r: \"two_step r = Suc 0\" \n and send: \"\\p. \\ p \\ get_msgs (send1 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next1 r p (cfg p) (\\ p) (cfg' p)\"\n and ainv: \"sa \\ TSO_inv1\"\n and ainv2: \"sa \\ TSO_inv2\"\n\n from R have next_r: \"next_round sa = r\"\n by(simp add: ref_rel_def)\n\n define S where \"S = {p. \\v. vote (cfg p) = Some v}\"\n from R obtain v where v: \"\\p \\ S. vote (cfg p) = Some v\" using ainv step_r\n by(auto simp add: ref_rel_def TSO_inv1_def S_def)\n\n define Ob where \"Ob = {p. x (cfg' p) = v}\"\n define o_f where \"o_f p = (if S \\ Quorum then Some v else None)\" for p :: process\n\n define dec_f where \"dec_f p = (if p \\ D cfg cfg' then decide (cfg' p) else None)\" for p\n\n {\n fix p w\n assume \"vote (cfg p) = Some w\"\n hence \"w = v\" using v\n by(unfold S_def, auto)\n } note v'=this\n \n have d_guard: \"d_guard dec_f (vote \\ cfg)\" using per_rd[THEN spec, of r]\n by(fastforce simp add: d_guard_def locked_in_vf_def quorum_for_def dec_f_def\n BenOr_commPerRd_def dest!: decide_origin[OF send step step_r, THEN subsetD])\n\n have \"dom (vote \\ cfg) \\ Quorum \\ Ob = UNIV\"\n proof(auto simp add: Ob_def)\n fix p\n assume Q: \"dom (vote \\ cfg) \\ Quorum\" (is \"?Q \\ Quorum\")\n hence \"?Q \\ HOs r p \\ {}\" using per_rd[THEN spec, of r]\n by(auto simp add: BenOr_commPerRd_def dest: qintersect)\n hence \"someVoteRcvd (\\ p) \\ {}\" using send[THEN spec, of p]\n by(force simp add: someVoteRcvd_def get_msgs_benign msgRcvd_def restrict_map_def \n isVote_def send1_def)\n moreover have \"\\q \\ someVoteRcvd (\\ p). \\x'. \\ p q = Some (Vote (Some v))\"\n using send[THEN spec, of p]\n by(auto simp add: someVoteRcvd_def get_msgs_benign msgRcvd_def restrict_map_def\n isVote_def send1_def dest: v')\n ultimately show \"x (cfg' p) = v\" using step[THEN spec, of p]\n by(auto simp add: next1_def x_update_def)\n qed\n note Ob_UNIV=this[rule_format]\n\n have obs_guard: \"obs_guard o_f (vote \\ cfg)\"\n apply(auto simp add: obs_guard_def o_f_def S_def dom_def\n dest: v' Ob_UNIV quorum_non_empty) \n apply (metis S_def all_not_in_conv empty_not_quorum v)\n done\n\n define sa' where \"sa' = sa\\ \n next_round := Suc (next_round sa)\n , decisions := decisions sa ++ dec_f\n , last_obs := last_obs sa ++ o_f\n \\\"\n\n \\ \\Abstract step\\\n have abs_step: \"(sa, sa') \\ tso_round1 r dec_f o_f\" using next_r step_r R d_guard obs_guard\n by(auto simp add: tso_round1_def sa'_def ref_rel_def)\n\n \\ \\Relation preserved\\\n have \"\\p. ((decide \\ cfg) ++ dec_f) p = decide (cfg' p)\"\n proof\n fix p\n show \"((decide \\ cfg) ++ dec_f) p = decide (cfg' p)\" using step[THEN spec, of p]\n by(auto simp add: dec_f_def D_def next1_def dec_update_def map_add_def)\n qed\n note dec_rel=this[rule_format]\n\n have \"\\p. (\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (x (cfg' p)))\"\n proof(intro allI impI, cases \"S \\ Quorum\")\n fix p \n case True \n hence \"x (cfg' p) = v\" using Ob_UNIV\n by(auto simp add: S_def Ob_def dom_def)\n thus \"(\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (x (cfg' p)))\"\n using True\n by(auto simp add: o_f_def)\n next\n fix p\n case False\n hence empty: \"o_f = Map.empty\"\n by(auto simp add: o_f_def)\n from False have \"S \\ UNIV\" using UNIV_quorum\n by auto\n then obtain q where q: \"vote (cfg q) = None\" using False\n by(auto simp add: o_f_def S_def)\n then obtain q1 q2 where \n \"x (cfg q1) \\ x (cfg q2)\" using R step_r\n by(auto simp add: ref_rel_def no_vote_diff_def)\n then obtain q1' q2' where\n \"x (cfg q1') = val0\"\n \"x (cfg q2') = val1\"\n by (metis (poly_guards_query) val_exhaust)\n hence \"\\v. \\q. opt_obsv_state.last_obs sa q \\ {None, Some v}\" using R step_r\n apply(auto simp add: ref_rel_def)\n by (metis (poly_guards_query) val_exhaust)\n (* note x = x_origin2[OF send step step_r refl, of p] *)\n thus \"(\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (x (cfg' p)))\" using empty\n by(auto)\n qed\n note obs_rel=this[rule_format]\n\n have post_rel: \n \"(sa', Suc r, cfg') \\ ref_rel\" using step send next_r R step_r\n by(auto simp add: sa'_def ref_rel_def \n two_step_phase_Suc dec_rel obs_rel)\n \n from abs_step post_rel show\n \"\\sa'. (\\r d_f o_f. (sa, sa') \\ tso_round1 r d_f o_f) \\ (sa', Suc r, cfg') \\ ref_rel\"\n by blast\nqed\n\nlemma BenOr_Refines_Two_Step_Obs:\n \"PO_refines (ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UNIV)\n tso_TS (BenOr_TS HOs HOs crds)\"\nproof(rule refine_using_invariants)\n show \"init (BenOr_TS HOs HOs crds) \\ ref_rel `` init tso_TS\"\n by(auto simp add: BenOr_TS_defs BenOr_HOMachine_def CHOAlgorithm.truncate_def \n tso_TS_defs ref_rel_def tso_init_def Let_def o_def)\nnext\n show \n \"{ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UNIV} TS.trans tso_TS, \n TS.trans (BenOr_TS HOs HOs crds) {> ref_rel}\"\n apply(simp add: tso_TS_defs BenOr_TS_defs BenOr_HOMachine_def CHOAlgorithm.truncate_def)\n apply(auto simp add: CHO_trans_alt BenOr_trans intro!: step0_ref step1_ref)\n done\nqed(auto intro!: TSO_inv1_inductive TSO_inv2_inductive)\n\nsubsubsection \\Termination\\\n(******************************************************************************)\n\ntext \\The full termination proof for Ben-Or is probabilistic, and depends on the state\nof the processes, and a \"favorable\" coin toss, where \"favorable\" is relative to this state.\nAs this termination pre-condition is state-dependent, we cannot capture it in an HO \npredicate.\n\nInstead, we prove a variant of the argument, where we assume that there exists a \nround where all the processes hear from the same set of other processes, and all toss the \nsame coin.\n\\\n\n\n\n from r1 obtain r0 where r1_def: \"r1 = Suc r0\" and step_r0: \"two_step r0 = 0\"\n by (cases r1) (auto simp add: two_step_phase_Suc two_step_def mod_Suc)\n\n define cfg0 where \"cfg0 = rho r0\"\n define cfg1 where \"cfg1 = rho r1\"\n define r2 where \"r2 = Suc r1\"\n define cfg2 where \"cfg2 = rho r2\"\n define r3 where \"r3 = Suc r2\"\n define cfg3 where \"cfg3 = rho r3\"\n define cfg4 where \"cfg4 = rho (Suc r3)\"\n\n have step_r2: \"two_step r2 = 0\" using r1\n by(auto simp add: r2_def two_step_phase_Suc)\n\n from\n run[simplified HORun_def SHORun_def, THEN CSHORun_step, THEN spec, where x=\"r0\"]\n run[simplified HORun_def SHORun_def, THEN CSHORun_step, THEN spec, where x=\"r1\"]\n run[simplified HORun_def SHORun_def, THEN CSHORun_step, THEN spec, where x=\"r2\"] \n run[simplified HORun_def SHORun_def, THEN CSHORun_step, THEN spec, where x=\"r3\"]\n obtain \\0 \\1 \\2 \\3 where\n send0: \"\\p. \\0 p \\ get_msgs (send0 r0) cfg0 (HOs r0) (HOs r0) p\"\n and step0: \"\\p. next0 r0 p (cfg0 p) (\\0 p) (cfg1 p)\"\n and send1: \"\\p. \\1 p \\ get_msgs (send1 r1) cfg1 (HOs r1) (HOs r1) p\"\n and step1: \"\\p. next1 r1 p (cfg1 p) (\\1 p) (cfg2 p)\"\n and send2: \"\\p. \\2 p \\ get_msgs (send0 r2) cfg2 (HOs r2) (HOs r2) p\"\n and step2: \"\\p. next0 r2 p (cfg2 p) (\\2 p) (cfg3 p)\"\n and send3: \"\\p. \\3 p \\ get_msgs (send1 r3) cfg3 (HOs r3) (HOs r3) p\"\n and step3: \"\\p. next1 r3 p (cfg3 p) (\\3 p) (cfg4 p)\"\n by(auto simp add: BenOr_A_def BenOr_HOMachine_def \n two_step_phase_Suc BenOr_nextState_def BenOr_sendMsg_def all_conj_distrib\n CHOAlgorithm.truncate_def step_r0 r1_def r2_def r3_def\n cfg0_def cfg1_def cfg2_def cfg3_def cfg4_def \n )\n \n let ?v = \"x (cfg2 p)\"\n from per_rd r1 have xs: \"\\q. x (cfg2 q) = ?v\"\n proof(cases \"\\q w. q \\ HOs r1 p \\ vote (cfg1 q) = Some w\")\n case True\n then obtain q w where q_w: \"q \\ HOs r1 p \\ vote (cfg1 q) = Some w\"\n by auto\n then have \"\\q'. vote (cfg1 q') \\ {None, Some w}\" using same_new_vote[OF send0 step0 step_r0]\n by (metis insert_iff not_None_eq)\n hence \"\\q'. x (cfg2 q') = w\" using step1 send1 q_w\n apply(auto simp add: next1_def all_conj_distrib dec_update_def x_update_def\n get_msgs_benign send1_def isVote_def msgRcvd_def identicalVoteRcvd_def \n someVoteRcvd_def restrict_map_def)\n by (metis (erased, hide_lams) option.distinct(2) option.sel r1(1))\n thus ?thesis\n by auto\n next\n case False\n hence \"\\q'. x (cfg2 q') = coin r1 q'\" using r1 step1 send1\n apply(auto simp add: next1_def all_conj_distrib dec_update_def x_update_def\n get_msgs_benign send1_def isVote_def msgRcvd_def identicalVoteRcvd_def \n someVoteRcvd_def restrict_map_def)\n by (metis False)\n thus ?thesis using r1\n by(metis) \n qed\n \n hence \"\\q. vote (cfg3 q) = Some ?v\"\n by(simp add: vote_origin[OF send2 step2 step_r2])\n\n hence \"decide (cfg4 p) = Some ?v\" using send3[THEN spec, of p] step3[THEN spec, of p] HOs_nonempty\n by(auto simp add: next1_def send1_def get_msgs_benign dec_update_def\n restrict_map_def identicalVoteRcvd_def msgRcvd_def isVote_def)\n\n thus ?thesis\n by(auto simp add: cfg4_def)\nqed\n\nend (* HO predicate context *)\n\nend (* mono_quorum context *)\n\nend (* theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Consensus_Refined/Observing/BenOr_Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2961412517496499}} {"text": "theory DeadCodeRemoval2Correct\nimports Launchbury LaunchburyAbstractTransformation DeadCodeRemoval2\nbegin\n\ndefinition rdcH :: \"var set \\ heap \\ heap\"\n where \"rdcH S \\ = restrictA (-S) (clearjunk (map_ran (\\ _ e . remove_dead_code e) \\))\" \n\ninductive dc_rel :: \"(heap \\ exp) \\ var list \\ (heap \\ exp) \\ bool\" (\"_ \\\\<^bsub>_\\<^esub> _\" [50,50,50] 50 )\n where \"S \\ domA \\ \\ set L \\ S \\ fv (rdcH S \\, remove_dead_code e, L) = {} \\ (\\, e) \\\\<^bsub>L\\<^esub> (rdcH S \\, remove_dead_code e)\"\n\nlemma delete_map_ran[simp]: \"delete x (map_ran f \\) = map_ran f (delete x \\)\"\n by (induction \\) auto\n\nlemma map_of_rdcH: \"map_of (rdcH S \\) x = (if x \\ S then None else map_option remove_dead_code (map_of \\ x))\"\n apply (induction \\ rule: clearjunk.induct)\n apply (auto simp add: rdcH_def map_of_clearjunk split: if_splits)\n by (metis delete_map_ran map_of_delete)\n\nlemma delete_rdcH[simp]: \"delete x (rdcH S \\) = rdcH S (delete x \\)\"\n by (induction \\ rule:clearjunk.induct) \n (auto simp add: rdcH_def delete_twist split: if_splits)\n\nlemma restrictA_UNIV[simp]: \"restrictA UNIV \\ = \\\"\n by (induction \\) auto\n\nlemma restrictA_delete[simp]: \"restrictA S (delete x \\) = restrictA (S - {x}) \\\"\n by (induction \\) auto\n\nlemma clearjunk_append: \"clearjunk (\\1 @ \\2) = clearjunk \\1 @ clearjunk (restrictA (-domA \\1) \\2)\"\n by (induction \\1 arbitrary: \\2 rule:clearjunk.induct) (auto simp add: Compl_insert)\n\nlemma restrictA_clearjunk: \"restrictA S (clearjunk \\) = clearjunk (restrictA S \\)\"\n by (induction \\ rule:clearjunk.induct) (auto simp add: Compl_insert)\n\nlemma rdcH_append[simp]: \"domA as \\ domA \\ = {} \\ rdcH S (as @ \\) = rdcH S as @ rdcH S \\\"\n unfolding rdcH_def apply (simp add: clearjunk_append restrictA_clearjunk map_ran_append restrictA_append)\n apply (rule arg_cong) back\n apply (rule restrictA_cong)\n apply auto\n done\n\nlemma restrict_is_nil[simp]: \"restrictA S \\ = [] \\ S \\ domA \\ = {}\"\n by (induction \\) auto\n\nlemma rdcH_nil[simp]: \"rdcH S [] = []\"\n by (auto simp add: rdcH_def)\n\nlemma rdcH_is_nil: \"domA \\ \\ S \\ rdcH S \\ = []\"\n by (auto simp add: rdcH_def)\n\nlemma rdcH_cong_set: \"S \\ domA \\ = S' \\ domA \\ \\ rdcH S \\ = rdcH S' \\\"\n unfolding rdcH_def by (rule restrictA_cong) auto\n\ninterpretation rel_lambda_cong dc_rel\n by default (auto elim!: dc_rel.cases simp del: exp_assn.eq_iff(4))\ninterpretation rel_app_cong dc_rel\n by default (auto elim: dc_rel.cases)\ninterpretation rel_var_cong dc_rel\n by default (auto elim: dc_rel.cases)\n\nlemma rdcH_eqvt[eqvt]: \"\\ \\ (rdcH S \\) = rdcH (\\ \\ S) (\\ \\ \\)\"\n unfolding rdcH_def by perm_simp rule\n\nlemma rdch_fresh[intro]: \"a \\ \\ \\ a \\ rdcH S \\\"\n by (induction \\ rule: clearjunk.induct)\n (auto simp add: rdcH_def fresh_Nil fresh_Pair fresh_Cons eqvt_fresh_cong1[OF remove_dead_code.eqvt] fresh_delete)\n\nlemma rdch_fv_subset: \"fv (rdcH S \\) \\ fv \\\"\n using rdch_fresh unfolding fresh_def fv_def by auto\n\nlemma rdch_Cons[simp]:\n \"x \\ S \\ rdcH S ((x, z) # \\) = (x, remove_dead_code z) # rdcH S (delete x \\)\"\n unfolding rdcH_def\n by (auto simp add: clearjunk_restrict[symmetric] delete_map_ran[symmetric] simp del: delete_map_ran)\n\ninterpretation reds_rel_fresh dc_rel\n by default (auto elim!: dc_rel.cases intro: eqvt_fresh_cong1[OF remove_dead_code.eqvt])\n\ninterpretation rel_lambda_case dc_rel by default\n\nlemma Lam_eq_same_var[simp]: \"Lam [y]. e = Lam [y]. e' \\ e = e'\"\n by auto (metis fresh_PairD(2) obtain_fresh)\n\ninterpretation rel_app_case dc_rel\nproof\n fix \\ e x L \\' e''\n assume \"(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', App e'' x)\"\n thus \"(\\, e) \\\\<^bsub>x # L\\<^esub> (\\', e'')\" \n by (fastforce elim!: dc_rel.cases intro!: dc_rel.intros)\nnext\n fix \\ y body x L \\' body'\n assume \"(\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\', Lam [y]. body')\"\n thus \"(\\, body[y::=x]) \\\\<^bsub>L\\<^esub> (\\', body'[y::=x])\"\n apply (auto elim!: dc_rel.cases intro!: dc_rel.intros dest: set_mp simp del: exp_assn.eq_iff(4) simp add: subst_remove_dead_code disjoint_iff_not_equal fv_subst_eq split: if_splits)\n apply (auto simp add: subst_remove_dead_code[symmetric] fv_subst_eq split: if_splits)\n done\nqed\n\ninterpretation rel_var_case dc_rel\nproof\n case (goal1 \\ x L \\' e thesis)\n show thesis\n proof (rule goal1)\n\n from goal1(1)\n obtain S where \"\\' = rdcH S \\\"\n and \"S \\ domA \\ \\ set L\" and \"S \\ fv (rdcH S \\, Var x, L) = {}\" by (auto elim!: dc_rel.cases)\n hence \"x \\ S\" by auto\n\n from `map_of \\ x = Some e` and `\\' = _` and `x \\ S`\n show \"map_of \\' x = Some (remove_dead_code e)\" by (auto simp add: map_of_rdcH)\n\n have *: \"\\ S . fv (rdcH S (delete x \\)) \\ fv (rdcH S \\)\" by (metis delete_rdcH fv_delete_subset)\n\n from `map_of \\' x = Some (remove_dead_code e)`\n have **: \"fv (remove_dead_code e) \\ fv \\'\" by (metis domA_from_set map_of_fv_subset map_of_is_SomeD option.sel)\n\n from goal1(1)\n show \"(delete x \\, e) \\\\<^bsub>x # L\\<^esub> (delete x \\', remove_dead_code e)\"\n by (fastforce elim!: dc_rel.cases intro!: dc_rel.intros dest: set_mp[OF *] set_mp[OF **] simp add: disjoint_iff_not_equal)\n qed\nnext\n fix \\ z x L \\' z'\n assume \"(\\, z) \\\\<^bsub>x # L\\<^esub> (\\', z')\"\n then obtain S where \"\\' = rdcH S \\\" and \"z' = remove_dead_code z\"\n and \"S \\ insert x (domA \\ \\ set L)\" and \"S \\ fv (rdcH S \\, remove_dead_code z, x # L) = {}\" by (auto elim!: dc_rel.cases)\n\n from this(4)\n have \"x \\ S\" by auto\n moreover\n assume \"x \\ domA \\\"\n ultimately\n have [simp]: \"rdcH S ((x, z) # \\) = (x,remove_dead_code z) # rdcH S \\\" by simp\n\n have \"((x, z) # \\, z) \\\\<^bsub>L\\<^esub> (rdcH S ((x, z) # \\), remove_dead_code z)\"\n apply (rule dc_rel.intros) using `S \\ _` `S \\ _ = _` by auto\n thus \"((x, z) # \\, z) \\\\<^bsub>L\\<^esub> ((x, z') # \\', z')\"\n unfolding `\\' = _` `z' = _` by auto\nqed\n\nlocale let_removed = \n fixes \\ as body\n assumes \"domA as \\ fv body = {} \"\n\n\nlemma map_fst_map_ran[simp]: \"map fst (map_ran f l) = map fst l\" by (induction l) auto\n\nlemma permute_list_id: \"supp p \\ set xs \\ p \\ xs = xs \\ p = 0\"\nproof (induction xs)\n case Nil\n hence \"supp p = {}\" by auto\n thus \"p = 0\" by (metis empty_subsetI supp_perm_singleton)\nnext\n case (Cons x xs)\n hence \"p \\ x = x\" by auto\n hence \"x \\ supp p\" by (metis fresh_def fresh_perm)\n with Cons show \"p = 0\" by auto\nqed\n\nlemma Abs_lst_same[simp]: \"[xs]lst. (y::'a::fs) = [xs]lst. y' \\ y = y'\"\n apply rule\n prefer 2\n apply simp\n unfolding Abs_eq_iff2\n apply (erule exE)\n apply auto\n unfolding alpha_lst.simps\n apply (subgoal_tac \"p = 0\")\n apply auto[1]\n apply (auto simp add: permute_list_id)\n done\n\nlemma Let_eq_same_var[simp]:\n assumes \"map fst as = map fst as'\"\n shows \"Terms.Let as e = Terms.Let as' e' \\ (as = as' \\ e = e')\"\nproof-\n from assms have \"map (\\x. atom (fst x)) as = map (\\x. atom (fst x)) as'\"\n by (induction as as' rule: list_induct2') auto\n thus ?thesis by auto\nqed\n\nlemma disjoint_mono: \"A \\ B = {} \\ A' \\ A \\ B' \\ B \\ A' \\ B' = {}\" by auto\n\nlemma disjoint_Un1: \"(A \\ B) \\ C = {} \\ A \\ C = {} \\ B \\ C = {} \" by auto\nlemma disjoint_Un2: \"C \\ (A \\ B) = {} \\ C \\ A = {} \\ C \\ B = {} \" by auto\n\ntheorem DeadCodeRemovalCorrect:\n assumes \"\\ : e \\\\<^bsub>L\\<^esub> \\ : z\"\n assumes \"(\\, e) \\\\<^bsub>L\\<^esub> (\\', e')\"\n shows \"\\ \\' z'. (\\, z) \\\\<^bsub>L\\<^esub> (\\', z') \\ \\' : e' \\\\<^bsub>L\\<^esub> \\' : z'\"\n using assms\nproof(nominal_induct arbitrary: \\' e' rule:reds.strong_induct)\ncase (Lambda \\ x e L) thus ?case by (rule lambda_case)\nnext\ncase (Application y \\ e x L \\ \\ z body) thus ?case by (rule app_case)\nnext\ncase (Variable \\ x e L \\ z \\' var) thus ?case by (rule var_case)\nnext\ncase (Let as \\ L body \\ z \\' let')\n let \"Terms.Let ?as' ?body'\" = \"Terms.Let (restrict_reachable (map_ran (\\_. remove_dead_code) as) (remove_dead_code body)) (remove_dead_code body)\"\n\n from `(\\, Terms.Let as body) \\\\<^bsub>L\\<^esub> (\\', let')` \n obtain S where \"\\' = rdcH S \\\" and \"let' = SmartLet ?as' ?body'\"\n and \"S \\ domA \\ \\ set L\" and S: \"S \\ fv (rdcH S \\, SmartLet ?as' ?body', L) = {}\" by (auto elim!: dc_rel.cases)\n\n let \"?S'\" = \"domA as - reachable (map_ran (\\_. remove_dead_code) as) ?body'\"\n\n from `S \\ _` and fresh_distinct[OF Let(1)] and fresh_distinct_list[OF Let(2)]\n have \"S \\ domA as = {}\" by auto \n hence [simp]: \"(rdcH (?S' \\ S) as) = ?as'\"\n unfolding restrict_reachable_def rdcH_def\n by -(rule restrictA_cong, auto)\n \n have [simp]: \"(rdcH (?S' \\ S) \\) = (rdcH S \\)\"\n using fresh_distinct[OF Let(1)]\n by (auto intro: rdcH_cong_set simp add: fresh_star_at_base)\n\n have \"(as @ \\, body) \\\\<^bsub>L\\<^esub> (rdcH (?S' \\ S) (as @ \\), ?body')\"\n proof (rule dc_rel.intros)\n show \"(?S' \\ S) \\ domA (as @ \\) \\ set L\" using `S \\ domA \\ \\ set L` by auto\n\n have \"?S' \\ fv ?as' = {}\"\n using fv_heap_reachable by auto\n moreover\n have \"?S' \\ fv \\ = {}\"\n using Let(1) by (auto simp add: fresh_star_def fresh_def fv_def)\n hence \"?S' \\ fv (rdcH S \\) = {}\"\n by (rule disjoint_mono[OF _ subset_refl rdch_fv_subset])\n moreover\n have \"?S' \\ fv (?body') = {}\"\n using fv_e_reachable by auto\n moreover\n have \"?S' \\ fv L = {}\"\n using fresh_distinct_list[OF Let(2)] by auto\n moreover\n have \"S \\ fv ?as' = {}\"\n using S `S \\ domA as = {}` by auto\n moreover\n have \"S \\ fv (rdcH S \\) = {}\"\n using S by auto\n moreover\n have \"S \\ fv (?body') = {}\"\n using S `S \\ domA as = {}` by auto\n moreover\n have \"S \\ fv L = {}\"\n using S by auto\n ultimately\n show \"(?S' \\ S) \\ fv (rdcH (?S' \\ S) (as @ \\), ?body', L) = {}\" using fresh_distinct[OF Let(1)] by auto\n qed\n hence \"(as @ \\, body) \\\\<^bsub>L\\<^esub> (?as' @ \\', ?body')\" unfolding `\\'=_` using fresh_distinct[OF Let(1)] by simp\n from Let(4)[OF this]\n obtain \\' z' where \"(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')\" and \"?as' @ \\' : ?body' \\\\<^bsub>L\\<^esub> \\' : z'\" by auto\n from reds_SmartLet[OF _ this(2)]\n have \"\\' : let' \\\\<^bsub>L\\<^esub> \\' : z'\" unfolding `\\'=_` `let' = _`\n using Let(1,2) by (auto simp add: fresh_star_def fresh_Pair)\n with `(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')`\n show ?case by auto\nqed\n\n\ncorollary\n assumes \"[] : e \\\\<^bsub>L\\<^esub> \\ : z\"\n shows \"\\ \\' z'. [] : remove_dead_code e \\\\<^bsub>L\\<^esub> \\' : z'\"\nproof-\n have \"([], e) \\\\<^bsub>L\\<^esub> (rdcH {} [], remove_dead_code e)\" by (rule dc_rel.intros) auto\n hence \"([], e) \\\\<^bsub>L\\<^esub> ([], remove_dead_code e)\" by simp\n from DeadCodeRemovalCorrect[OF assms this]\n show ?thesis by auto\nqed\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/DeadCodeRemoval2Correct.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2961323567379952}} {"text": "(* Title: HOL/HOLCF/IOA/NTP/Impl.thy\n Author: Tobias Nipkow & Konrad Slind\n*)\n\nsection \\The implementation\\\n\ntheory Impl\nimports Sender Receiver Abschannel\nbegin\n\ntype_synonym 'm impl_state\n = \"'m sender_state * 'm receiver_state * 'm packet multiset * bool multiset\"\n (* sender_state * receiver_state * srch_state * rsch_state *)\n\n\ndefinition\n impl_ioa :: \"('m action, 'm impl_state)ioa\" where\n impl_def: \"impl_ioa == (sender_ioa \\ receiver_ioa \\ srch_ioa \\ rsch_ioa)\"\n\ndefinition sen :: \"'m impl_state => 'm sender_state\" where \"sen = fst\"\ndefinition rec :: \"'m impl_state => 'm receiver_state\" where \"rec = fst \\ snd\"\ndefinition srch :: \"'m impl_state => 'm packet multiset\" where \"srch = fst \\ snd \\ snd\"\ndefinition rsch :: \"'m impl_state => bool multiset\" where \"rsch = snd \\ snd \\ snd\"\n\ndefinition\n hdr_sum :: \"'m packet multiset => bool => nat\" where\n \"hdr_sum M b == countm M (%pkt. hdr(pkt) = b)\"\n\n(* Lemma 5.1 *)\ndefinition\n \"inv1(s) \\\n (\\b. count (rsent(rec s)) b = count (srcvd(sen s)) b + count (rsch s) b)\n \\ (\\b. count (ssent(sen s)) b\n = hdr_sum (rrcvd(rec s)) b + hdr_sum (srch s) b)\"\n\n(* Lemma 5.2 *)\ndefinition\n \"inv2(s) ==\n (rbit(rec(s)) = sbit(sen(s)) &\n ssending(sen(s)) &\n count (rsent(rec s)) (~sbit(sen s)) <= count (ssent(sen s)) (~sbit(sen s)) &\n count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)))\n |\n (rbit(rec(s)) = (~sbit(sen(s))) &\n rsending(rec(s)) &\n count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)) &\n count (rsent(rec s)) (sbit(sen s)) <= count (ssent(sen s)) (sbit(sen s)))\"\n\n(* Lemma 5.3 *)\ndefinition\n \"inv3(s) \\\n rbit(rec(s)) = sbit(sen(s))\n \\ (\\m. sq(sen(s))=[] | m \\ hd(sq(sen(s)))\n \\ count (rrcvd(rec s)) (sbit(sen(s)),m)\n + count (srch s) (sbit(sen(s)),m)\n \\ count (rsent(rec s)) (~sbit(sen s)))\"\n\n(* Lemma 5.4 *)\ndefinition \"inv4(s) == rbit(rec(s)) = (~sbit(sen(s))) --> sq(sen(s)) ~= []\"\n\n\nsubsection \\Invariants\\\n\ndeclare le_SucI [simp]\n\nlemmas impl_ioas =\n impl_def sender_ioa_def receiver_ioa_def srch_ioa_thm [THEN eq_reflection]\n rsch_ioa_thm [THEN eq_reflection]\n\nlemmas \"transitions\" =\n sender_trans_def receiver_trans_def srch_trans_def rsch_trans_def\n\n\nlemmas [simp] =\n ioa_triple_proj starts_of_par trans_of_par4 in_sender_asig\n in_receiver_asig in_srch_asig in_rsch_asig\n\ndeclare let_weak_cong [cong]\n\n\n\nlemma [simp]:\n \"a\\actions(sender_asig)\n \\ a\\actions(receiver_asig)\n \\ a\\actions(srch_asig)\n \\ a\\actions(rsch_asig)\"\n by (induct a) simp_all\n\ndeclare split_paired_All [simp del]\n\n\n(* Three Simp_sets in different sizes\n----------------------------------------------\n\n1) simpset() does not unfold the transition relations\n2) ss unfolds transition relations\n3) renname_ss unfolds transitions and the abstract channel *)\n\nML \\\nval ss = simpset_of (\\<^context> addsimps @{thms \"transitions\"});\nval rename_ss = simpset_of (put_simpset ss \\<^context> addsimps @{thms unfold_renaming});\n\nfun tac ctxt =\n asm_simp_tac (put_simpset ss ctxt\n |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm if_split})\nfun tac_ren ctxt =\n asm_simp_tac (put_simpset rename_ss ctxt\n |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm if_split})\n\\\n\n\nsubsubsection \\Invariant 1\\\n\nlemma raw_inv1: \"invariant impl_ioa inv1\"\n\napply (unfold impl_ioas)\napply (rule invariantI)\napply (simp add: inv1_def hdr_sum_def srcvd_def ssent_def rsent_def rrcvd_def)\n\napply (simp (no_asm) del: trans_of_par4 add: imp_conjR inv1_def)\n\ntxt \\Split proof in two\\\napply (rule conjI)\n\n(* First half *)\napply (simp add: Impl.inv1_def split del: if_split)\napply (induct_tac a)\n\napply (tactic \"EVERY1[tac \\<^context>, tac \\<^context>, tac \\<^context>, tac \\<^context>]\")\napply (tactic \"tac \\<^context> 1\")\napply (tactic \"tac_ren \\<^context> 1\")\n\ntxt \\5 + 1\\\n\napply (tactic \"tac \\<^context> 1\")\napply (tactic \"tac_ren \\<^context> 1\")\n\ntxt \\4 + 1\\\napply (tactic \\EVERY1[tac \\<^context>, tac \\<^context>, tac \\<^context>, tac \\<^context>]\\)\n\n\ntxt \\Now the other half\\\napply (simp add: Impl.inv1_def split del: if_split)\napply (induct_tac a)\napply (tactic \"EVERY1 [tac \\<^context>, tac \\<^context>]\")\n\ntxt \\detour 1\\\napply (tactic \"tac \\<^context> 1\")\napply (tactic \"tac_ren \\<^context> 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp (no_asm_simp) add: hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n split: if_split)\ntxt \\detour 2\\\napply (tactic \"tac \\<^context> 1\")\napply (tactic \"tac_ren \\<^context> 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp add: Impl.hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n Multiset.delm_nonempty_def split: if_split)\napply (rule allI)\napply (rule conjI)\napply (rule impI)\napply hypsubst\napply (rule pred_suc [THEN iffD1])\napply (drule less_le_trans)\napply (cut_tac eq_packet_imp_eq_hdr [unfolded Packet.hdr_def, THEN countm_props])\napply assumption\napply assumption\n\napply (rule countm_done_delm [THEN mp, symmetric])\napply (rule refl)\napply (simp (no_asm_simp) add: Multiset.count_def)\n\napply (rule impI)\napply (simp add: neg_flip)\napply hypsubst\napply (rule countm_spurious_delm)\napply (simp (no_asm))\n\napply (tactic \"EVERY1 [tac \\<^context>, tac \\<^context>, tac \\<^context>,\n tac \\<^context>, tac \\<^context>, tac \\<^context>]\")\n\ndone\n\n\n\nsubsubsection \\INVARIANT 2\\\n\nlemma raw_inv2: \"invariant impl_ioa inv2\"\n\n apply (rule invariantI1)\n txt \\Base case\\\n apply (simp add: inv2_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n txt \\10 cases. First 4 are simple, since state doesn't change\\\n\n ML_prf \\val tac2 = asm_full_simp_tac (put_simpset ss \\<^context> addsimps [@{thm inv2_def}])\\\n\n txt \\10 - 7\\\n apply (tactic \"EVERY1 [tac2,tac2,tac2,tac2]\")\n txt \\6\\\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n\n txt \\6 - 5\\\n apply (tactic \"EVERY1 [tac2,tac2]\")\n\n txt \\4\\\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n apply (tactic \"tac2 1\")\n\n txt \\3\\\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE})] 1\\)\n\n apply (tactic \"tac2 1\")\n apply (tactic \\fold_goals_tac \\<^context> [rewrite_rule \\<^context> [@{thm Packet.hdr_def}]\n (@{thm Impl.hdr_sum_def})]\\)\n apply arith\n\n txt \\2\\\n apply (tactic \"tac2 1\")\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n apply (intro strip)\n apply (erule conjE)+\n apply simp\n\n txt \\1\\\n apply (tactic \"tac2 1\")\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1\\)\n apply (intro strip)\n apply (erule conjE)+\n apply (tactic \\fold_goals_tac \\<^context>\n [rewrite_rule \\<^context> [@{thm Packet.hdr_def}] (@{thm Impl.hdr_sum_def})]\\)\n apply simp\n\n done\n\n\nsubsubsection \\INVARIANT 3\\\n\nlemma raw_inv3: \"invariant impl_ioa inv3\"\n\n apply (rule invariantI)\n txt \\Base case\\\n apply (simp add: Impl.inv3_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n ML_prf \\val tac3 = asm_full_simp_tac (put_simpset ss \\<^context> addsimps [@{thm inv3_def}])\\\n\n txt \\10 - 8\\\n\n apply (tactic \"EVERY1[tac3,tac3,tac3]\")\n\n apply (tactic \"tac_ren \\<^context> 1\")\n apply (intro strip, (erule conjE)+)\n apply hypsubst\n apply (erule exE)\n apply simp\n\n txt \\7\\\n apply (tactic \"tac3 1\")\n apply (tactic \"tac_ren \\<^context> 1\")\n apply force\n\n txt \\6 - 3\\\n\n apply (tactic \"EVERY1[tac3,tac3,tac3,tac3]\")\n\n txt \\2\\\n apply (tactic \"asm_full_simp_tac (put_simpset ss \\<^context>) 1\")\n apply (simp (no_asm) add: inv3_def)\n apply (intro strip, (erule conjE)+)\n apply (rule imp_disjL [THEN iffD1])\n apply (rule impI)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n apply (erule conjE)+\n apply (rule_tac j = \"count (ssent (sen s)) (~sbit (sen s))\" and\n k = \"count (rsent (rec s)) (sbit (sen s))\" in le_trans)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1\\)\n apply (simp add: hdr_sum_def Multiset.count_def)\n apply (rule add_le_mono)\n apply (rule countm_props)\n apply (simp (no_asm))\n apply (rule countm_props)\n apply (simp (no_asm))\n apply assumption\n\n txt \\1\\\n apply (tactic \"tac3 1\")\n apply (intro strip, (erule conjE)+)\n apply (rule imp_disjL [THEN iffD1])\n apply (rule impI)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n done\n\n\nsubsubsection \\INVARIANT 4\\\n\nlemma raw_inv4: \"invariant impl_ioa inv4\"\n\n apply (rule invariantI)\n txt \\Base case\\\n apply (simp add: Impl.inv4_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n ML_prf \\val tac4 = asm_full_simp_tac (put_simpset ss \\<^context> addsimps [@{thm inv4_def}])\\\n\n txt \\10 - 2\\\n\n apply (tactic \"EVERY1[tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4]\")\n\n txt \\2 b\\\n\n apply (intro strip, (erule conjE)+)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n\n txt \\1\\\n apply (tactic \"tac4 1\")\n apply (intro strip, (erule conjE)+)\n apply (rule ccontr)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply (tactic \\forward_tac \\<^context> [rewrite_rule \\<^context> [@{thm Impl.inv3_def}]\n (@{thm raw_inv3} RS @{thm invariantE})] 1\\)\n apply simp\n apply (rename_tac m, erule_tac x = \"m\" in allE)\n apply simp\n done\n\n\ntext \\rebind them\\\n\nlemmas inv1 = raw_inv1 [THEN invariantE, unfolded inv1_def]\n and inv2 = raw_inv2 [THEN invariantE, unfolded inv2_def]\n and inv3 = raw_inv3 [THEN invariantE, unfolded inv3_def]\n and inv4 = raw_inv4 [THEN invariantE, unfolded inv4_def]\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/NTP/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.29605060278058815}} {"text": "(* derivations on arbitrary states indexed with natural numbers to differentiate the states *)\ntheory IndexedDerivations\nimports\n HOL_ext\n Hints\n Protocol\n ExecMessage\nbegin\n\n\nchapter{* Security Proofs *}\n\n\nsection{* Networked Transition Systems *}\n\ntypes 's nts = \"'s \\ ('s \\ execmsg option \\ 's \\ execmsg option) set\"\n\nsection{* Standard Execution Model *}\n\ninductive_set \n dy :: \"'s nts \\ ('s list \\ execmsg set) set\"\n for P :: \"'s nts\"\nwhere\n init : \"([fst P], {}) \\ dy P\"\n| proto: \n \"\\ (tr@[s], M) \\ dy P;\n Option.set inp \\ M;\n (s, inp, s', out) \\ snd P\n \\ \\\n (tr@[s,s'], M \\ Option.set out) \\ dy P\" \n| infer:\n \"\\ (tr, M) \\ dy P;\n m \\ infer M\n \\ \\\n (tr, insert m M) \\ dy P\"\n\n\nsection{* Derivations *}\n\ndatatype 's node = Init | State \"nat \\ 's\" | Msg execmsg\n\ntypes 's derivation = \"('s node \\ 's node) set\"\n\nfun analz :: \"execmsg set \\ 's node set \\ execmsg \\ 's derivation\"\nwhere\n \"analz M N (Tup x y) = \n (if (Tup x y \\ M) \n then {} \n else N \\ {Msg (Tup x y)} \\ analz M N x \\ analz M N y \n )\"\n| \"analz M N (Enc m k) =\n (if (Enc m k \\ M)\n then {}\n else\n N \\ {Msg (Enc m k)} \\ \n (if (inv k \\ M)\n then analz M {Msg (Enc m k), Msg (inv k)} m\n else {}\n )\n )\"\n| \"analz M N m = \n (if m \\ M then {} else N \\ {Msg m})\"\n\ndefinition knows :: \"'s derivation \\ execmsg set\"\nwhere \"knows D \\ {m. Msg m \\ Range D}\"\n\ndefinition \"states\" :: \"'s derivation \\ (nat \\ 's) set\"\nwhere \"states D \\ {s. State s \\ Range D}\"\n\ninductive_set\n derivs :: \"'s nts \\ 's derivation set\"\n for P :: \"'s nts\"\nwhere\n init: \"{(Init, State (0,fst P))} \\ derivs P\"\n\n| proto:\n \"\\ D \\ derivs P;\n Option.set inp \\ knows D;\n (i, s) \\ states D;\n \\ (i',s') \\ states D. i' \\ i;\n (s, inp, s', out) \\ snd P\n \\ \\\n (insert (State (i,s),State (Suc i,s')) D \\ \n ((Msg ` Option.set inp) \\ {State (Suc i, s')}) \\\n UNION (Option.set out) (analz (knows D) {State (Suc i, s')})\n ) \\ derivs P\"\n\n| hash:\n \"\\ D \\ derivs P;\n m \\ knows D;\n Hash m \\ knows D\n \\ \\ \n insert (Msg m, Msg (Hash m)) D \\ derivs P\"\n\n| tuple:\n \"\\ D \\ derivs P;\n x \\ knows D;\n y \\ knows D;\n Tup x y \\ knows D\n \\ \\ \n {Msg x, Msg y} \\ {Msg (Tup x y)} \\ D \\ derivs P\"\n\n| encr:\n \"\\ D \\ derivs P;\n m \\ knows D;\n k \\ knows D;\n Enc m k \\ knows D\n \\ \\ \n {Msg m, Msg k} \\ {Msg (Enc m k)} \\ D \\ derivs P\"\n\n\n\nsubsection{* All derivations are orders on nodes *}\n\n\nlocale derivation =\n fixes P :: \"'s nts\"\n and D :: \"'s derivation\"\n assumes derivable: \"D \\ derivs P\"\nbegin\n \ntext{* A local variant of the induction rule of @{term \"reachable\"}. *}\nlemmas derivs_induct = derivs.induct\n [ OF derivable\n , rule_format\n , consumes 0\n , case_names init proto hash tuple encr\n ]\n\n\n \nlemma analz_irr: \n \"N \\ range State \\ { Msg m' | m'. size m' > size m} \\\n (x,x) \\ analz M N m\"\napply(induct m arbitrary: N)\napply(simp_all)\napply(case_tac x, simp, simp, simp)\napply(clarsimp)\napply(force)\napply(case_tac x, simp)\napply(clarsimp)\noops\n\n\nlemma derivation_irr: \"(x,x) \\ D\"\nproof(induct rule: derivs_induct)\n case init thus ?case by simp\nnext\n case (proto D inp i s s' out) thus ?case\n apply (clarsimp simp: image_def)\n apply (rule conjI)\n apply (case_tac x)\n apply (simp, simp, simp)\n apply (case_tac out)\n apply(simp)\n apply(simp)\n\n\n apply(induct t, auto)\n apply(case_tac x, auto)\n apply(case_tac a, auto)\n apply(case_tac a, auto)\n done\n\nlemma predOrd_distinct'_trans: \n \"\\ predOrd t x y; predOrd t y z; distinct' t \\ \n \\ predOrd t x z\"\n apply(induct t x y rule: predOrd.induct)\n apply(auto dest: in_set_predOrd1 in_set_predOrd2)\n done\n\nlemma predOrd_distinct'_asymD: \n \"\\ predOrd t x y; distinct' t \\ \\ \\ predOrd t y x\"\n apply(induct t x y rule: predOrd.induct)\n apply(auto dest: in_set_predOrd1 in_set_predOrd2)\n done\n\n\nlemma\n\n(*\ndefinition sound :: \"'s derivation \\ bool\"\nwhere \"sound dr = (case dr of (tr, D) \\\n (acyclic ({ (State s, State s') | s s'. listOrd tr s s' } \\ D) \\ \n (\\ m \\ knows D. (\\ s. (State s, Msg m) \\ D\\<^sup>+))))\"\n\ndefinition derivs :: \"'s nts \\ 's derivation set\"\nwhere \"derivs P \\ \n { (tr, drop_msgs M D) \n | tr D M. \n (tr, D) \\ derivs P \\ sound (tr, drop_msgs M D)\n }\"\n*)\n\n\nsection{* Relating the two models *}\n\n\nlemma dy_conv_derivs:\n \"{ (tr, M) | tr M M'. M \\ M' \\ (tr, M) \\ dy P } = \n { (tr, knows D) | tr D. (tr, D) \\ derivs P }\"\n oops\n\n(* MOVE *)\nlemma acyclic_empty [iff]: \"acyclic {}\"\n by (simp add: acyclic_def)\n\n\nlemma knows_empty [iff]: \"knows {} = {}\"\n by (auto simp: knows_def)\n\n(*\nlemma in_derivsE [elim!]:\n \"\\ (tr, D) \\ derivs P;\n \\ M D'. \\ (tr, D') \\ derivs P; \n D = D' - (Msg ` M) \\ UNIV - UNIV \\ (Msg ` M); \n sound (tr, D)\n \\ \\ Q\n \\ \\ Q\"\n by(auto simp: derivs_def)\n\nlemma knows_cases: \"\\ (tr, D) \\ derivs P; m \\ knows D \\ \\ R\"\n apply(clarsimp)\n apply(drule derivs.cases)\n apply(simp_all)\n oops\n*)\n\nlemma knows_union [simp]: \"knows (M \\ N) = knows M \\ knows N\"\n by (auto simp: knows_def)\n\nlemma knows_insert_Msg [simp]: \"knows (insert (x, Msg m) D) = insert m (knows D)\"\n by(auto simp: knows_def)\n\nlemma knows_insert_State [simp]: \"knows (insert (x, State s) D) = knows D\"\n by(auto simp: knows_def)\n\nlemma in_knows_times: \"M \\ {} \\ (m \\ knows (M \\ N)) = (Msg m \\ N)\"\n by (auto simp: knows_def Range_iff)\n\nlemma dy_imp_derivs:\n \"(tr, M) \\ dy P \\\n \\ D. (tr, D) \\ derivs P \\ M \\ knows D\n \"\nproof(induct rule: dy.induct)\n case init thus ?case by(auto intro!: derivs.init)\nnext\n case (proto tr s M inp s' out) thus ?case\n apply(clarsimp)\n apply(rule exI, rule conjI)\n apply(rule_tac inp=inp in derivs.proto)\n apply(assumption)\n apply(blast) \n apply(assumption)\n apply(rule conjI)\n apply(fastsimp)\n apply(clarsimp)\n apply(rule classical)\n apply(case_tac x)\n apply(simp_all)\n done\nnext\n case (infer tr M m)\n then obtain D where the_deriv: \"(tr, D) \\ derivs P\" \"M \\ knows D\"\n by auto\n have \" \\ m \\ infer M; M \\ knows D; (tr, D) \\ derivs P \\ \\\n \\D'. (tr, D' \\ D) \\ derivs P \\ m \\ knows (D \\ D') \\ \n (\\ x \\ M. m \\ knows D')\"\n proof(induct arbitrary: D rule: infer.induct)\n case Inj thus ?case \n apply -\n apply(rule_tac x=\"{}\" in exI)\n apply(auto)\n done\n next\n case (Tup x y) thus ?case\n apply(clarsimp)\n apply(rule exI, rule conjI)\n apply(rule derivs.tuple[of tr D _ x y], assumption+)\n oops\n\nsection{* Properties of the derivations *}\n\nfun add_index :: \"nat \\ 'a list \\ (nat \\ 'a) list\"\nwhere\n \"add_index i [] = []\"\n| \"add_index i (x#xs) = (i,x) # add_index (Suc i) xs\"\n\ndefinition deps :: \"'s derivation \\ 's derivations\"\nwhere \"deps dr \\ case dr of (tr, D) \\ \n D \\ { (x,y) | x y. listOrd (add_index 0 tr) (State x) (State y)}\"\n \n \nsection{* Executing Protocol Scripts *}\n\ntypes threadpool = \"tid \\ (rolestep list \\ rolestep list)\"\n\ntypes state = \"threadpool \\ store\"\n\n\ndefinition proto2nts :: \"proto \\ state option nts\"\nwhere \"proto2nts P =\n ( None \n , ({ ( None, None, Some (th, st), None)\n | th st.\n (\\ i done todo. th i = Some (done,todo) \\ \n done = [] \\ todo \\ P) \\\n (\\ a i. st (AVar a, i) \\ Compromised \\ Uncompromised)\n } \n \\\n { (s, None, s, Some m) \n | s m. \n m \\ IK0\n }\n \\\n (\\ R \\ P.\n { ( Some (th, st) \n , Some (inst st i pt)\n , Some (th(i\\ (done @ [Recv l pt], todo)), st)\n , None \n )\n | th st i l pt done todo.\n th i = Some (done, Recv l pt # todo)\n }\n )\n \\\n (\\ R \\ P.\n { ( Some (th, st) \n , None\n , Some (th(i\\ (done @ [Send l pt], todo)), st)\n , Some (inst st i pt) \n )\n | th st i l pt done todo.\n th i = Some (done, Send l pt # todo)\n }\n )\n )\n )\n\"\n\n\n\n(* OOOOOOOOOOOOOOOOOOOOLDDDDDDDDDDDDDDDDDDDDDDDD *)\n\nterm \"undefined\"\nthm the_def\nthm \nthm undefined_def\n\ntypes explicit_trace = \"rawevent list\"\ntypes execstep = \"tid \\ rolestep\"\n\n\nfun knows :: \"explicit_trace \\ execmsg set\"\nwhere\n \"knows [] = {}\"\n| \"knows (Learns M # t) = M \\ knows t\"\n| \"knows (Step estep # t) = knows t\"\n\nfun steps :: \"explicit_trace \\ execstep set\"\nwhere\n \"steps [] = {}\"\n| \"steps (Learns M # t) = steps t\"\n| \"steps (Step estep # t) = insert estep (steps t)\"\n\ntypes state = \"explicit_trace \\ threadpool \\ store\"\n\ninductive_set \n reachable :: \"proto \\ state set\" \n for P :: \"proto\"\nwhere\n init: \"\\ \\ i done todo. r i = Some (done,todo) \\ \n done = [] \\ todo \\ P;\n \\ a i. s (AVar a, i) \\ Compromised \\ Uncompromised\n \\\n \\ ([Learns IK0], r, s) \\ reachable P\"\n\n| send: \"\\ (t, r, s) \\ reachable P;\n r i = Some (done, Send l pt # todo);\n m = inst s i pt\n \\\n \\ (t @ [Step (i, Send l pt), \n Learns (pairParts m - knows t)]\n , r(i \\ (done @ [Send l pt], todo))\n , s) \\ reachable P\"\n \n| recv: \"\\ (t, r, s) \\ reachable P;\n r i = Some (done, Recv l pt # todo);\n inst s i pt \\ knows t\n \\\n \\ (t @ [Step (i, Recv l pt)]\n , r(i \\ (done @ [Recv l pt], todo))\n , s) \\ reachable P\"\n\n| hash: \"\\ (t, r, s) \\ reachable P;\n m \\ knows t;\n Hash m \\ knows t\n \\\n \\ (t @ [Learns {Hash m}], r, s) \\ reachable P\"\n\n| tuple: \"\\ (t, r, s) \\ reachable P;\n x \\ knows t;\n y \\ knows t;\n Tup x y \\ knows t\n \\\n \\ (t @ [Learns {Tup x y}], r, s) \\ reachable P\"\n\n| encr: \"\\ (t, r, s) \\ reachable P;\n m \\ knows t;\n k \\ knows t;\n Enc m k \\ knows t\n \\\n \\ (t @ [Learns {Enc m k}], r, s) \\ reachable P\"\n\n\n| decr: \"\\ (t, r, s) \\ reachable P;\n Enc m k \\ knows t;\n inv k \\ knows t\n \\\n \\ (t @ [Learns (pairParts m - knows t)], r, s) \\ reachable P\"\n\nlocale reachable_state = wf_proto +\n fixes t :: explicit_trace\n and r :: threadpool\n and s :: store\n assumes reachable [simp,intro!]: \"(t,r,s) \\ reachable P\"\nbegin\n text{* A local variant of the induction rule of @{term \"reachable\"}. *}\n lemmas reachable_induct = reachable.induct\n [ OF reachable\n , rule_format\n , consumes 0\n , case_names init send recv hash tuple encr decr\n ]\nend\n\ntext{* An extension of the reachable state locale denoting\n an individual thread and its state. *}\n\nlocale reachable_thread = reachable_state +\n fixes i :: \"tid\"\n and \"done\" :: \"rolestep list\"\n and todo :: \"rolestep list\"\n assumes thread_exists: \"r i = Some (done, todo)\"\nbegin\n\n text{* The thread state is built such that @{term \"done @ todo\"} is\n always a role of @{term P}. *}\n\n lemma role_in_P:\n \"done @ todo \\ P\"\n using thread_exists\n proof (induct arbitrary: i \"done\" todo rule: reachable_induct)\n qed (fastsimp split: if_splits)+\n\nend\n\ntext{* Importing all lemmas of the wellformed role locale for\nthe term @{term \"done @ todo\"}. *}\nsublocale reachable_thread \\ wf_role \"done @ todo\"\n by (rule wf_roles[OF role_in_P])\n\n\n\nsubsection{* Basic Properties *}\n\nlemma knowsI: \"\\ Learns M \\ set t; m \\ M \\ \\ m \\ knows t\"\n by(induct t rule: knows.induct, auto)\n\nlemma knowsD: \"m \\ knows t \\ \\ M. Learns M \\ set t \\ m \\ M\"\n by(induct t rule: steps.induct, auto)\n\nlemma knows_append [simp]: \n \"knows (xs@ys) = knows xs \\ knows ys\"\n by(induct xs rule: knows.induct, auto)\n\nlemma stepsI: \"Step estep \\ set t \\ estep \\ steps t\"\n by(induct t rule: steps.induct, auto)\n\nlemma stepsD: \"estep \\ steps t \\ Step estep \\ set t\"\n by(induct t rule: steps.induct, auto)\n\nlemma Step_in_set_conv [simp]: \n \"(Step estep \\ set t) = (estep \\ steps t)\"\n by(auto intro!: stepsI stepsD)\n\nlemma steps_append [simp]: \n \"steps (t@t') = steps t \\ steps t'\"\n by(induct t rule: steps.induct, auto)\n\n\n\nsubsection{* Thread Execution *}\n\nlemma (in reachable_state) step_in_dom: \n \"(i, step) \\ steps t \\ i \\ dom r\"\nproof (induct rule: reachable_induct) qed auto\n\ncontext reachable_thread\nbegin\n\nlemma in_dom_r [iff]: \"i \\ dom r\" \n by (auto intro!: thread_exists)\n\nlemma distinct_done [iff]: \"distinct done\"\nusing distinct by auto\n\nlemma distinct_todo [iff]: \"distinct todo\"\nusing distinct by auto\n\nlemma in_steps_eq_in_done:\n \"((i, step) \\ steps t) = (step \\ set done)\"\nproof -\n have \n \"((i, step) \\ steps t) = \n (\\ done todo. r i = Some (done, todo) \\ step \\ set done)\"\n proof(induct arbitrary: i \"done\" todo rule: reachable_induct)\n case (init r s i) thus ?case by fastsimp\n qed auto\n thus ?thesis using thread_exists by auto\nqed\n\nlemmas steps_in_done [elim!] = iffD1[OF in_steps_eq_in_done, rule_format]\nlemmas done_in_steps [elim!] = iffD2[OF in_steps_eq_in_done, rule_format]\n\nlemma todo_notin_stepsD:\n \"step \\ set todo \\ (i, step) \\ steps t\"\nusing distinct by(auto dest!: steps_in_done)\n\nlemmas todo_notin_stepsE = notE[OF todo_notin_stepsD, rule_format]\n\nlemma listOrd_done_imp_listOrd_trace: \n \"listOrd done prev step \\ \n listOrd t (Step (i, prev)) (Step (i, step))\"\nusing thread_exists\nproof(induct arbitrary: i \"done\" todo rule: reachable_induct)\n case (init r s i \"done\" todo) thus ?case\n by fastsimp\nnext\n case (send t r s i \"done\" l msg todo m i' done' todo')\n then interpret this_thread: \n reachable_thread P t r s i \"done\" \"Send l msg # todo\"\n by unfold_locales auto\n from send show ?case\n by(auto split: if_splits)\nnext\n case (recv t r s i \"done\" l msg todo i' done' todo')\n then interpret this_thread: \n reachable_thread P t r s i \"done\" \"Recv l msg # todo\"\n by unfold_locales auto\n from recv show ?case\n by(auto split: if_splits)\nqed auto\n\nlemma listOrd_role_imp_listOrd_trace:\n \"\\ (i, step) \\ steps t; listOrd (done @ todo) prev step \\\n \\ listOrd t (Step (i, prev)) (Step (i, step))\"\nusing distinct\nby (fastsimp dest: in_set_listOrd2 listOrd_done_imp_listOrd_trace)\n\nend\n\n\nsubsection{* Variable Substitutions *}\n\ncontext reachable_state\nbegin\n\nlemma inst_AVar_cases: \n \"s (AVar v, i) \\ Uncompromised \\ s (AVar v, i) \\ Compromised\"\n by (induct rule: reachable_induct) (fastsimp+)\n\nlemma inst_AVar_in_IK0: \n \"s (AVar v, i) \\ IK0\"\nusing inst_AVar_cases[of v i] \nby (auto simp: IK0_def Uncompromised_def Compromised_def)\n\nlemma knows_IK0: \"m \\ IK0 \\ m \\ knows t\"\n by(induct rule: reachable_induct, auto)\n\nlemma inst_AVar_in_knows [iff]:\n \"s (AVar a, i) \\ knows t\"\n by (rule knows_IK0[OF inst_AVar_in_IK0])\n\nend (* reachable_state *)\n\n(* TODO: Move *)\nlemma MVar_in_FV_conv_FMV [iff]:\n \"(MVar v \\ FV pt) = (v \\ FMV pt)\"\n by(induct pt, auto, case_tac varid, auto)\n\n\ncontext reachable_state\nbegin\n\nlemma send_step_FV:\n assumes thread_exists: \"r i = Some (done, Send l msg # todo)\"\n and FV: \"MVar n \\ FV msg\"\n shows \"\\ l' msg'. (i, Recv l' msg') \\ steps t \\ MVar n \\ FV msg'\"\nproof -\n interpret this_thread: reachable_thread P t r s i \"done\" \"Send l msg # todo\"\n using thread_exists by unfold_locales auto\n let ?role = \"done @ Send l msg # todo\"\n have \"Send l msg \\ set ?role\" by simp\n then obtain l' msg' \n where \"listOrd ?role (Recv l' msg') (Send l msg)\"\n and \"MVar n \\ FV msg'\"\n using FV by(fast dest!: this_thread.Send_FV)\n thus ?thesis using this_thread.distinct\n by(auto dest: in_set_listOrd1 in_set_listOrd2)\nqed\n\nend\n\n\nsubsubsection{* The Effect of a Step on the Intruder Knowledge *}\n\n\ncontext reachable_state\nbegin\n\nlemma SendD: \n \"(i, Send lbl pt) \\ steps t \\ \n inst s i pt \\ knows t\"\nproof(induct rule: reachable_induct)\nqed auto\n\nend\n\n\nsubsection{* Almost Distinct Traces *}\n\nfun distinct' :: \"explicit_trace \\ bool\"\nwhere\n \"distinct' [] = True\"\n| \"distinct' (Learns M # t) =\n ((\\ m \\ M. m \\ knows t) \\ distinct' t)\"\n| \"distinct' (Step estep # t) =\n ((estep \\ steps t) \\ distinct' t)\"\n\n\nlemma distinct'_append [simp]:\n \"distinct' (t@t') = \n (distinct' t \\ distinct' t' \\ \n (knows t \\ knows t' = {}) \\ (steps t \\ steps t' = {}))\"\nproof (induct t rule: distinct'.induct)\nqed (auto intro!: knowsI)\n\nlemma distinct'_singleton [iff]: \"distinct' [x]\"\nby (cases x) auto\n\nlemma (in reachable_state) distinct'_trace [iff]:\n \"distinct' t\"\nproof(induct rule: reachable_induct)\n case (recv t r s i \"done\" l msg todo)\n then interpret this_thread: \n reachable_thread P t r s i \"done\" \"Recv l msg # todo\"\n by unfold_locales auto\n show ?case using `distinct' t` and this_thread.distinct\n by(auto dest!: this_thread.steps_in_done)\nnext\n case (send t r s i \"done\" l msg todo m)\n then interpret this_thread: \n reachable_thread P t r s i \"done\" \"Send l msg # todo\"\n by unfold_locales auto\n show ?case using `distinct' t` and this_thread.distinct\n by(auto dest!: this_thread.steps_in_done)\nqed auto\n\n\nsubsection{* Happens-Before Order *}\n\ndatatype event = St \"tid \\ rolestep\" | Ln execmsg\n\nfun predOrd :: \"explicit_trace \\ event \\ event \\ bool\"\nwhere\n \"predOrd [] x y = False\"\n| \"predOrd (Learns M # xs) x y =\n ((x \\ Ln ` M \\ (y \\ Ln ` knows xs \\ y \\ St ` steps xs)) \\\n predOrd xs x y)\"\n| \"predOrd (Step estep # xs) x y =\n ((x = St estep \\ (y \\ Ln ` knows xs \\ y \\ St ` steps xs)) \\\n predOrd xs x y)\"\n\n\ndefinition predEqOrd :: \"explicit_trace \\ event \\ event \\ bool\"\nwhere \"predEqOrd t x y = ((x = y) \\ predOrd t x y)\"\n\n\nlemma predOrd_singleton [simp]: \"\\ predOrd [a] x y\"\nby (cases a) auto\n\nlemma in_knows_predOrd1: \"predOrd t (Ln x) y \\ x \\ knows t\"\nproof (induct t)\n case (Cons e t) thus ?case by (cases e) auto\nqed auto\n\n\nlemma in_knows_predOrd2: \"predOrd t x (Ln y) \\ y \\ knows t\"\nproof (induct t)\n case (Cons e t) thus ?case by (cases e) auto\nqed auto\n\nlemma in_steps_predOrd1: \"predOrd t (St x) y \\ x \\ steps t\"\nproof (induct t)\n case (Cons e t) thus ?case by (cases e) auto\nqed auto\n\nlemma in_steps_predOrd2: \"predOrd t x (St y) \\ y \\ steps t\"\nproof (induct t)\n case (Cons e t) thus ?case by (cases e) auto\nqed auto\n\nlemmas event_predOrdI = \n in_knows_predOrd1 in_knows_predOrd2 \n in_steps_predOrd1 in_steps_predOrd2\n\nlemma in_set_predOrd1: \n \"predOrd t x y \\ x \\ Ln ` knows t \\ x \\ St ` steps t\"\nby (induct t x y rule: predOrd.induct) auto\n\nlemma in_set_predOrd2: \n \"predOrd t x y \\ y \\ Ln ` knows t \\ y \\ St ` steps t\"\nby (induct t x y rule: predOrd.induct) auto\n\nlemma listOrd_imp_predOrd:\n \"listOrd t (Step e) (Step e') \\ predOrd t (St e) (St e')\"\nby (induct t rule: steps.induct) (auto dest!: stepsI)\n\nlemma predOrd_append [simp]:\n \"predOrd (xs@ys) x y = \n (predOrd xs x y \\ predOrd ys x y \\\n ((x \\ Ln ` knows xs \\ x \\ St ` steps xs) \\ \n (y \\ Ln ` knows ys \\ y \\ St ` steps ys)))\"\n apply(induct xs x y rule: predOrd.induct)\n apply(simp_all)\n apply(blast+)\n done\n\nlemma predOrd_distinct'_irr [simp]: \n \"distinct' t \\ \\predOrd t x x\"\n apply(induct t, auto)\n apply(case_tac x, auto)\n apply(case_tac a, auto)\n apply(case_tac a, auto)\n done\n\nlemma predOrd_distinct'_trans: \n \"\\ predOrd t x y; predOrd t y z; distinct' t \\ \n \\ predOrd t x z\"\n apply(induct t x y rule: predOrd.induct)\n apply(auto dest: in_set_predOrd1 in_set_predOrd2)\n done\n\nlemma predOrd_distinct'_asymD: \n \"\\ predOrd t x y; distinct' t \\ \\ \\ predOrd t y x\"\n apply(induct t x y rule: predOrd.induct)\n apply(auto dest: in_set_predOrd1 in_set_predOrd2)\n done\n\n\nsublocale reachable_state \\ beforeOrd: order \"predEqOrd t\" \"predOrd t\"\n apply(unfold_locales)\n apply(auto simp: predEqOrd_def\n dest: predOrd_distinct'_asymD \n intro: predOrd_distinct'_trans)\n done\n\nabbreviation (in reachable_state)\n \"pred'\" (infixl \"\\\" 50) where \"pred' \\ predOrd t\"\n\nabbreviation (in reachable_state) \n \"predEq'\" (infixl \"\\\" 50) where \"predEq' \\ predEqOrd t\"\n\nlemma predOrd_conv:\n \"predOrd xs x y = \n (\\ ys zs. xs = ys @ zs \\ \n (x \\ Ln ` knows ys \\ x \\ St ` steps ys) \\\n (y \\ Ln ` knows zs \\ y \\ St ` steps zs))\"\n (is \"?pred xs = (\\ ys zs. ?decomp xs ys zs)\")\nproof -\n { assume \"?pred xs\"\n hence \"\\ ys zs. ?decomp xs ys zs\"\n proof (induct xs)\n case Nil thus ?case by simp\n next\n case (Cons e xs) thus ?case\n proof(cases e)\n\tcase (Step st) thus ?thesis\n\tproof(cases \"x = St st\")\n\t case True hence \"?decomp (e#xs) [e] xs\" \n\t using Step Cons by auto\n\t thus ?thesis by blast\n\tnext\n\t case False\n\t hence \"predOrd xs x y\"\n\t using Step Cons by auto\n\t then obtain ys zs where \"?decomp xs ys zs\"\n\t using Cons by auto\n\t hence \"?decomp (e#xs) (e#ys) zs\"\n\t using Step Cons by auto\n\t thus ?thesis by blast\n\tqed\n next\n\tcase (Learns M) thus ?thesis\n\tproof(cases \"\\ m \\ M. x = Ln m\")\n\t case True \n\t then obtain m where \"m \\ M\" and \"x = Ln m\"\n\t by auto\n\t hence \"?decomp (e#xs) [e] xs\" \n\t using Learns Cons by auto\n\t thus ?thesis by blast\n\tnext\n\t case False\n\t hence \"predOrd xs x y\"\n\t using Learns Cons by auto\n\t then obtain ys zs where \"?decomp xs ys zs\"\n\t using Cons by auto\n\t hence \"?decomp (e#xs) (e#ys) zs\"\n\t using Learns Cons by auto\n\t thus ?thesis by blast\n\tqed\n qed\n qed\n }\n moreover\n { assume \"\\ ys zs. ?decomp xs ys zs\"\n hence \"?pred xs\"\n proof (induct xs)\n case Nil thus ?case by simp\n next\n case (Cons e xs)\n then obtain ys zs where decomp1: \"?decomp (e#xs) ys zs\"\n\tby blast\n hence \"ys = [] \\ e # xs = zs \\ (\\ys'. e # ys' = ys \\ xs = ys' @ zs)\"\n\t(is \"?nil \\ ?non_nil\")\n\tby (simp add: Cons_eq_append_conv)\n moreover\n { assume ?nil hence ?case using decomp1 by auto }\n moreover\n { assume ?non_nil\n\tthen obtain ys' where decomp2: \"ys = e # ys'\" and \"xs = ys' @ zs\"\n\t by auto\n\thence ?case\n\tproof(cases e)\n\t case (Step st) thus ?thesis\n\t proof(cases \"x = St st\")\n\t case True thus ?thesis\n\t using Step decomp1 decomp2 by auto\n\t next\n\t case False\n\t hence \"?decomp xs ys' zs\"\n\t using Step decomp1 decomp2 by auto\n\t hence \"predOrd xs x y\"\n\t using Cons by auto\n\t thus ?thesis\n\t using Step by auto\n\t qed\n\tnext\n\t case (Learns M) thus ?thesis\n\t proof(cases \"\\ m \\ M. x = Ln m\")\n\t case True thus ?thesis\n\t using Learns decomp1 decomp2 by auto\n\t next\n\t case False\n\t hence \"?decomp xs ys' zs\"\n\t using Learns decomp1 decomp2 by auto\n\t hence \"predOrd xs x y\"\n\t using Cons by auto\n\t thus ?thesis\n\t using Learns by auto\n\t qed\n\tqed\n }\n ultimately show ?case by fast\n qed\n }\n ultimately show ?thesis by fast\nqed\n\n\nsubsection{* Input Terms *}\n\n\ncontext reachable_state\nbegin\n\nlemma knows_pairParts_closed:\n \"m \\ knows t \\ pairParts m \\ knows t\"\nproof(induct arbitrary: m rule: reachable_induct)\n case init thus ?case by(auto simp: IK0_def) \nnext\n case send thus ?case by(auto dest: pairParts_idemD)\nnext\n case decr thus ?case by(auto dest: pairParts_idemD)\nnext\n case tuple thus ?case by fastsimp\nqed auto\n\n\nlemmas knows_pairParts_closedD =\n subsetD[OF knows_pairParts_closed, rule_format]\n\nlemmas rev_knows_pairParts_closedD =\n rev_subsetD[OF _ knows_pairParts_closed, rule_format]\n\n\nlemma pairParts_before:\n \"\\ predOrd t (Ln m) y; m' \\ pairParts m \\ \\\n predOrd t (Ln m') y\"\nproof(induct rule: reachable_induct)\n case (hash t r s msg)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from hash show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (encr t r s msg key)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from encr show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (tuple t r s msg1 msg2)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from tuple show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (decr t r s msg key)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from decr show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (send t r s i \"done\" l msg todo msg)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from send show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (recv t r s i \"done\" l msg todo)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n from recv show ?case\n by (fastsimp dest: s1.rev_knows_pairParts_closedD)\nnext\n case (init r s) thus ?case by simp\nqed\n\nlemma Ln_before_inp:\n \"(i, Recv l pt) \\ steps t \\ \n Ln (inst s i pt) \\ St (i, Recv l pt)\"\nproof(induct arbitrary: i l pt rule: reachable_induct)\nqed auto\n\nlemmas knows_inp = in_knows_predOrd1[OF Ln_before_inp, rule_format]\n\ntext{* Three of the lemmas for the reasoning technique. *}\nlemmas Input = Ln_before_inp\n\nlemma split_before:\n \"Ln (Tup m m') \\ y \\ Ln m \\ y \\ Ln m' \\ y\"\n by (fastsimp intro: pairParts_before)\n\nlemma split_knows:\n \"Tup m m' \\ knows t \\ m \\ knows t \\ m' \\ knows t\"\n by (fastsimp intro: knows_pairParts_closedD)\n\nend\n\n\nsubsection{* Case Distinction on Learning Messages *}\n\ntext{* Note that the hints are logically equal to true. Thus they have no logical\n content. However they are placed here to track the individual cases when \n computing the decryption chains for a concrete message and protocol.\n*}\nfun decrChain :: \"string \\ explicit_trace \\ event set \\ execmsg \\ execmsg \\ bool\"\nwhere\n \"decrChain path t from (Enc msg key) m = \n ( ( m = Enc msg key \\ (\\ f \\ from. predOrd t f (Ln m)) \\ \n hint ''decrChainPath'' path\n ) \\\n ( (\\ f \\ from. predOrd t f (Ln (Enc msg key))) \\ \n decrChain (path@''E'') t {Ln (Enc msg key), Ln (inv key)} msg m )\n )\"\n| \"decrChain path t from (Tup x y) m = \n ( ( m = Tup x y \\ (\\ f \\ from. predOrd t f (Ln m)) \\\n hint ''decrChainPath'' path\n ) \\\n decrChain (path@''L'') t from x m \\\n decrChain (path@''R'') t from y m\n )\"\n| \"decrChain path t from msg m =\n ( m = msg \\ (\\ f \\ from. predOrd t f (Ln m)) \\\n hint ''decrChainPath'' path\n )\"\n\nlemma decrChain_append:\n \"decrChain path t from msg m \\ decrChain path (t@t') from msg m\"\n by (induct path t \"from\" msg m rule: decrChain.induct) auto\n\nlemma decrChain_unpair:\n \"\\ m' \\ pairParts m; m' \\ M;\n \\ f \\ from. f \\ Ln ` knows t \\ f \\ St ` steps t\n \\ \\ decrChain path (t@[Learns M]) from m m'\"\nby (induct m arbitrary: path M) (auto simp: remove_hints)\n\nlemma decrChain_decrypt:\n \"\\ decrChain path t from msg (Enc m k);\n Enc m k \\ knows t; inv k \\ knows t;\n m' \\ pairParts m; m' \\ knows t \\ \\\n decrChain path' (t @ [Learns (pairParts m - knows t)]) from msg m'\"\nproof(induct msg arbitrary: path path' \"from\")\n case (Enc msg key)\n hence from_before [simp]: \n \"\\f\\from. predOrd t f (Ln (Enc msg key))\" by auto\n have \"m = msg \\ k = key \\ \n decrChain (path@''E'') t {Ln (Enc msg key), Ln (Message.inv key)} msg (Enc m k)\"\n (is \"?here \\ ?nested\")\n using Enc by auto\n moreover\n { assume \"?here\"\n hence \"?case\"\n proof(cases \"m' = Enc m k\")\n case True thus ?thesis\n\tusing `?here` Enc by fastsimp\n next\n case False thus ?thesis\n\tusing `?here` Enc\n\tby(auto intro!: decrChain_unpair)\n qed\n }\n moreover\n { assume \"?nested\"\n hence \"?case\" using Enc\n by (fastsimp dest!: Enc(2))\n }\n ultimately show ?case by fast\nqed auto\n\n\nlemma (in reachable_state) knows_cases_raw:\n assumes knows: \"m' \\ knows t\"\n shows \n \"(m' \\ IK0) \\\n (\\ m. m' = Hash m \\ Ln m \\ Ln (Hash m)) \\\n (\\ m k. m' = Enc m k \\ Ln m \\ Ln (Enc m k) \\ Ln k \\ Ln (Enc m k)) \\\n (\\ x y. m' = Tup x y \\ Ln x \\ Ln (Tup x y) \\ Ln y \\ Ln (Tup x y)) \\\n (\\ i done todo. r i = Some (done, todo) \\ \n (\\ l pt. \n Send l pt \\ set done \\\n decrChain [] t {St (i, Send l pt)} (inst s i pt) m'\n )\n )\"\n (is \"?cases m' t r s\")\nproof -\n --{* Prove cases transfer lemma for trace extension *}\n { fix m' t t' r s\n let ?thesis = \"?cases m' (t@t') r s\"\n assume \"?cases m' t r s\" (is \"?ik0 \\ ?hash \\ ?enc \\ ?tup \\ ?chain t r s\")\n moreover\n { assume \"?ik0\" hence \"?thesis\" by blast } moreover\n { assume \"?hash\" hence \"?thesis\" by fastsimp } moreover\n { assume \"?enc\" hence \"?thesis\" by fastsimp } moreover\n { assume \"?tup\" hence \"?thesis\" by fastsimp } moreover\n { assume \"?chain t r s\"\n hence \"?chain (t@t') r s\" \n\tby (fastsimp intro!: decrChain_append)\n hence \"?thesis\" by blast\n }\n ultimately have ?thesis by fast\n }\n note cases_appendI_trace = this\n\n --{* Prove actual thesis *}\n from knows show ?thesis\n proof (induct arbitrary: m' rule: reachable_induct)\n case init thus ?case by simp\n next\n case (hash t r s m)\n let ?t' = \"t @ [Learns {Hash m}]\"\n note IH = hash(2)\n have \"m' \\ knows t \\ m' = Hash m\" (is \"?old \\ ?new\")\n using hash by fastsimp\n moreover\n { assume \"?new\" hence ?case \n\tusing `m \\ knows t` by fastsimp \n }\n moreover\n { assume \"?old\" \n hence ?case by (fastsimp intro!: IH cases_appendI_trace)\n }\n ultimately show ?case by fast\n next\n case (encr t r s m k)\n let ?t' = \"t @ [Learns {Enc m k}]\"\n note IH = encr(2)\n have \"m' \\ knows t \\ m' = Enc m k\" (is \"?old \\ ?new\")\n using encr by fastsimp\n moreover\n { assume \"?new\" hence ?case \n\tusing `m \\ knows t` and `k \\ knows t` by fastsimp \n }\n moreover\n { assume \"?old\" \n hence ?case by (fast intro!: IH cases_appendI_trace)\n }\n ultimately show ?case by fast\n next\n case (tuple t r s x y)\n let ?t' = \"t @ [Learns {Tup x y}]\"\n note IH = tuple(2)\n have \"m' \\ knows t \\ m' = Tup x y\" (is \"?old \\ ?new\")\n using tuple by fastsimp\n moreover\n { assume \"?new\" hence ?case \n\tusing `x \\ knows t` and `y \\ knows t` by fastsimp \n }\n moreover\n { assume \"?old\" \n hence ?case by (fast intro!: IH cases_appendI_trace)\n }\n ultimately show ?case by fast\n next\n case (recv t r s i \"done\" l pt todo)\n hence \"?cases m' t r s\" (is \"?ik0 \\ ?hash \\ ?enc \\ ?tup \\ ?chain t r s\")\n by clarsimp\n moreover\n { assume \"?ik0\" hence \"?case\" by blast } moreover\n { assume \"?hash\" hence \"?case\" by fastsimp } moreover\n { assume \"?enc\" hence \"?case\" by fastsimp } moreover\n { assume \"?tup\" hence \"?case\" by fastsimp } moreover\n { let ?t' = \"t@[Step (i, Recv l pt)]\"\n and ?r' = \"r(i \\ (done @ [Recv l pt], todo))\"\n assume \"?chain t r s\" then\n obtain i' done' todo' l' pt'\n\twhere thread': \"r i' = Some (done', todo')\"\n\tand send: \"Send l' pt' \\ set done'\"\n\tand chain: \"decrChain [] t {St (i', Send l' pt')} (inst s i' pt') m'\"\n\tby auto\n then interpret th1: reachable_thread P t r s i' done' todo'\n\tusing recv by unfold_locales auto\n moreover\n obtain done'' todo'' \n\twhere \"Send l' pt' \\ set done''\"\n\tand \"?r' i' = Some (done'', todo'')\"\n\tusing `r i = Some (done, Recv l pt # todo)` thread' send\n\tby (cases \"i = i'\") (fastsimp+)\n ultimately\n have \"?chain ?t' ?r' s\"\n\tusing chain\n\tapply-\n\tapply(rule exI)+\n\tapply(rule conjI, assumption)\n\tby(fastsimp intro!: decrChain_append)+\n hence \"?case\" by auto\n }\n ultimately show ?case by fast\n next\n case (send t r s i \"done\" l pt todo m)\n then interpret th1: \n reachable_thread P t r s i \"done\" \"Send l pt # todo\"\n by unfold_locales\n let ?r' = \"r(i \\ (done @ [Send l pt], todo))\"\n let ?m = \"inst s i pt\"\n let ?t' = \"(t @ [Step (i, Send l pt)]) @ [Learns (pairParts ?m - knows t)]\"\n have \"m' \\ knows t \\ m' \\ pairParts m \\ m' \\ knows t\" (is \"?old \\ ?new\")\n using send by fastsimp\n moreover\n { assume \"?new\"\n hence \"m' \\ pairParts (inst s i pt)\" and \"m' \\ knows t\" \n\tusing `m = inst s i pt` by auto\n hence \"decrChain [] ?t' {St (i, Send l pt)} ?m m'\"\n\tby (fastsimp intro!: decrChain_unpair)\n moreover\n have \"?r' i = Some (done @ [Send l pt], todo)\"\n\tusing th1.thread_exists by auto\n ultimately\n have ?case using `m = inst s i pt`\n\tapply-\n\tapply(rule disjI2)+\n\tapply(rule exI)+\n\tapply(rule conjI, assumption)\n\tapply(auto)\n\tdone\n }\n moreover\n { assume \"?old\" \n hence \"?cases m' t r s\" (is \"?ik0 \\ ?hash \\ ?enc \\ ?tup \\ ?chain t r s\")\n\tusing send by clarsimp\n moreover\n { assume \"?ik0\" hence \"?case\" by blast } moreover\n { assume \"?hash\" hence \"?case\" by fastsimp } moreover\n { assume \"?enc\" hence \"?case\" by fastsimp } moreover\n { assume \"?tup\" hence \"?case\" by fastsimp } moreover\n { assume \"?chain t r s\" then\n\tobtain i' done' todo' l' pt'\n\t where thread': \"r i' = Some (done', todo')\"\n\t and send: \"Send l' pt' \\ set done'\"\n\t and chain: \"decrChain [] t {St (i', Send l' pt')} (inst s i' pt') m'\"\n\t by auto\n\tobtain done'' todo'' \n\t where \"Send l' pt' \\ set done''\"\n\t and \"(r(i \\ (done @ [Send l pt], todo))) i' = Some (done'', todo'')\"\n\t using `r i = Some (done, Send l pt # todo)` thread' send\n\t by (cases \"i = i'\") (fastsimp+)\n\thence \"?chain ?t' ?r' s\"\n\t using chain\n\t apply-\n\t apply(rule exI)+\n\t apply(rule conjI, assumption)\n\t by(fastsimp intro!: decrChain_append)+\n\thence \"?case\" using `m = inst s i pt` by auto\n }\n ultimately have ?case by fast\n }\n ultimately show ?case by fast\n next\n case (decr t r s m k)\n then interpret s1: reachable_state P t r s\n by unfold_locales\n let ?t' = \"t @ [Learns (pairParts m - knows t)]\"\n note IH = decr(2)\n have \"m' \\ knows t \\ m' \\ pairParts m \\ m' \\ knows t\" (is \"?old \\ ?new\")\n using decr by fastsimp\n moreover\n { assume \"?new\"\n hence \"m' \\ pairParts m\" and \"m' \\ knows t\" by auto\n have \n\t\"predOrd t (Ln m) (Ln (Enc m k)) \\ predOrd t (Ln k) (Ln (Enc m k)) \\\n (\\i done todo. r i = Some (done, todo) \\\n (\\l pt. Send l pt \\ set done \\\n decrChain [] t {St (i, Send l pt)} (inst s i pt) (Enc m k)))\"\n\t(is \"?fake_enc \\ ?chain t (Enc m k)\")\n\tusing IH[OF `Enc m k \\ knows t`] by auto\n moreover\n { assume \"?fake_enc\"\n\thence \"?case\" using `?new`\n\t by (auto dest!: in_knows_predOrd1 s1.rev_knows_pairParts_closedD)\n }\n moreover\n { assume \"?chain t (Enc m k)\" then\n\tobtain i' done' todo' l' pt'\n\t where thread': \"r i' = Some (done', todo')\"\n\t and send: \"Send l' pt' \\ set done'\"\n\t and chain: \"decrChain [] t {St (i', Send l' pt')} (inst s i' pt') (Enc m k)\"\n\t by auto\n\tmoreover\n\thence \"decrChain [] ?t' {St (i', Send l' pt')} (inst s i' pt') m'\"\n\t using `?new` `Enc m k \\ knows t` `inv k \\ knows t`\n\t by (fastsimp intro!: decrChain_decrypt)\n\tultimately\n\thave \"?chain ?t' m'\" by fastsimp\n\thence \"?case\" by blast\n }\n ultimately have ?case by fast\n }\n moreover\n { assume \"?old\" \n hence ?case by (fast intro!: IH cases_appendI_trace)\n }\n ultimately show ?case by fast thm decr\n qed\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/experiments/protocol_semantics/IndexedDerivations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.29605060278058803}} {"text": "theory ConditionalMode\n\nimports Complex_Main FaultModellingTypes\n\nbegin\n\ndatatype_new ('a, 'b) ConditionalValue = \n CVC (V: 'b)\n | CVIF 'a \"('a, 'b) ConditionalValue\" \"('a, 'b) ConditionalValue\" \n\ndatatype_new ('FMode, 'vv) OperationalMode = \n NominalMode real \n | FailureMode \"'FMode\"\n | VarMode (var: 'vv)\n\ntype_synonym ('a, 'FMode, 'vv) ConditionalMode = \n \"('a, ('FMode, 'vv) OperationalMode) ConditionalValue\"\n\nnotation (output) NominalMode (\"N\\_\\\" 40)\nnotation (output) FailureMode (\"F\\_\\\" 41)\nnotation (output) VarMode (\"_\" 41)\nnotation (output) CVC (\"\\_\\\" 50)\nnotation (output) CVIF (\"_ \\ _ \\ _\" 80)\n\nprimrec val_ConditionalValue :: \"('a \\ bool) \\ ('a, 'b) ConditionalValue \\ 'b\" where\n\"val_ConditionalValue _ (CVC b) = b\" |\n\"val_ConditionalValue s (CVIF a t1 t2) = \n (if s a then val_ConditionalValue s t1 else val_ConditionalValue s t2)\"\n\ntype_synonym 'a ConditionalValueEnv = \"('a * bool) list\"\n\ndefinition agree :: \"('a \\ bool) \\ 'a ConditionalValueEnv \\ bool\" where\n\"agree s env = (\\x b. map_of env x = Some b \\ s x = b)\"\n\nlemma agree_Nil: \"agree s []\"\nby(simp add: agree_def)\n\nlemma agree_Cons: \"distinct(map fst env) \\ x \\ set(map fst env)\n \\ agree s ((x,b) # env) = ((if b then s x else \\ s x) \\ agree s env)\"\nby(auto simp: agree_def image_iff)\n\nlemma agreeDT:\n \"\\ agree s env; distinct (map fst env) \\ \\ (x,True) \\ set env \\ s x\"\nby(simp add: agree_def)\n\nlemma agreeDF:\n \"\\ agree s env; distinct (map fst env) \\ \\ (x,False) \\ set env \\ \\ s x\"\nby(simp add: agree_def)\n\ndefinition mkIF :: \"'a \\ ('a, 'b) ConditionalValue \\ ('a, 'b) ConditionalValue \\ \n ('a, 'b) ConditionalValue\" where\n\"mkIF x t1 t2 = (if t1 = t2 then t1 else CVIF x t1 t2)\"\n\nfun reduce :: \"'a ConditionalValueEnv \\ ('a, 'b) ConditionalValue \\ \n ('a, 'b) ConditionalValue\" where\n\"reduce env (CVIF x t1 t2) = (case map_of env x of\n None \\ mkIF x (reduce ((x,True)#env) t1) (reduce ((x,False)#env) t2) |\n Some b \\ reduce env (if b then t1 else t2))\" |\n\"reduce _ t = t\"\n\nprimrec normif :: \"'a ConditionalValueEnv \\ ('a, 'b) ConditionalValue \\ \n ('a, 'b) ConditionalValue \\ ('a, 'b) ConditionalValue \\ ('a, 'b) ConditionalValue\" where\n\"normif env (CVC b) t1 t2 = CVC b\" |\n\"normif env (CVIF x t1 t2) t3 t4 =\n (case map_of env x of\n None \\ mkIF x (normif ((x,True) # env) t1 t3 t4) (normif ((x,False) # env) t2 t3 t4) |\n Some b \\ if b then normif env t1 t3 t4 else normif env t2 t3 t4)\"\n\nlemma val_mkIF: \"val_ConditionalValue s (mkIF x t1 t2) = val_ConditionalValue s (CVIF x t1 t2)\"\napply (auto simp: mkIF_def Let_def)\ndone\n\ntheorem val_reduce: \"agree s env \\ distinct(map fst env) \\\n val_ConditionalValue s (reduce env t) = val_ConditionalValue s t\"\napply(induct t arbitrary: s env)\napply(auto simp: map_of_eq_None_iff val_mkIF agree_Cons Let_def\n dest: agreeDT agreeDF split: option.splits)\ndone\n\nfun reduced :: \"('a, 'b) ConditionalValue \\ 'a set \\ bool\" where\n\"reduced (CVIF x t1 t2) X =\n (x \\ X \\ t1 \\ t2 \\ reduced t1 (insert x X) \\ reduced t2 (insert x X))\" |\n\"reduced _ _ = True\"\n\nlemma reduced_antimono: \"X \\ Y \\ reduced t Y \\ reduced t X\"\napply(induction t arbitrary: X Y)\nby auto (metis insert_mono)+\n\nlemma reduced_mkIF: \"x \\ X \\\n reduced t1 (insert x X) \\ reduced t2 (insert x X) \\ reduced (mkIF x t1 t2) X\"\nby(auto simp: mkIF_def intro:reduced_antimono)\n\nlemma reduced_reduce:\n \"distinct(map fst env) \\ reduced (reduce env t) (fst ` set env)\"\nproof(induction t arbitrary: env)\n case (CVIF x t1 t2)\n thus ?case using CVIF.IH(1)[of \"(x, True) # env\"] CVIF.IH(2)[of \"(x, False) # env\"]\n by(auto simp: map_of_eq_None_iff image_iff reduced_mkIF split: option.split)\nqed auto\n\nlemma reduced_normif:\n \"distinct(map fst env) \\ reduced (normif env t t1 t2) (fst ` set env)\"\nproof(induction t arbitrary: t1 t2 env)\n case (CVIF x s1 s2)\n thus ?case using CVIF.IH(1)[of \"(x, True) # env\"] CVIF.IH(2)[of \"(x, False) # env\"]\n by(auto simp: reduced_mkIF map_of_eq_None_iff split: option.split)\nqed (auto simp: reduced_reduce)\n\nlemma same_val_if_reduced:\n \"reduced t X \\ \\x. x \\ X \\ s1 x = s2 x \\ \n val_ConditionalValue s1 t = val_ConditionalValue s2 t\"\nby(induction t arbitrary: X) auto\n\n(*\ndatatype 'a ConditionalValuePredicateEvaluation =\n CVPTrue | CVPFalse | CVPVar 'a | CVPNotVar 'a \n | CVPAnd \"'a ConditionalValuePredicateEvaluation\" \"'a ConditionalValuePredicateEvaluation\"\n*)\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/fault-modelling-theory/ConditionalMode.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.29595855948374056}} {"text": "(* Title: HOL/Bali/Type.thy\n Author: David von Oheimb\n*)\n\nsubsection {* Java types *}\n\ntheory Type imports Name begin\n\ntext {*\nsimplifications:\n\\begin{itemize}\n\\item only the most important primitive types\n\\item the null type is regarded as reference type\n\\end{itemize}\n*}\n\ndatatype prim_ty --{* primitive type, cf. 4.2 *}\n = Void --{* result type of void methods *}\n | Boolean\n | Integer\n\n\ndatatype ref_ty --{* reference type, cf. 4.3 *}\n = NullT --{* null type, cf. 4.1 *}\n | IfaceT qtname --{* interface type *}\n | ClassT qtname --{* class type *}\n | ArrayT ty --{* array type *}\n\nand ty --{* any type, cf. 4.1 *}\n = PrimT prim_ty --{* primitive type *}\n | RefT ref_ty --{* reference type *}\n\nabbreviation \"NT == RefT NullT\"\nabbreviation \"Iface I == RefT (IfaceT I)\"\nabbreviation \"Class C == RefT (ClassT C)\"\nabbreviation Array :: \"ty \\ ty\" (\"_.[]\" [90] 90)\n where \"T.[] == RefT (ArrayT T)\"\n\ndefinition\n the_Class :: \"ty \\ qtname\"\n where \"the_Class T = (SOME C. T = Class C)\" (** primrec not possible here **)\n \nlemma the_Class_eq [simp]: \"the_Class (Class C)= C\"\nby (auto simp add: the_Class_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4726834766204329, "lm_q1q2_score": 0.2959585528883825}} {"text": "theory Strong_CRef\nimports Main \"CRef\" \nbegin\n\n\ncoinductive \"RGSimStrong\"::\"[('g\\'l,'p,'f,'e) body,('g,'l,'p,'f,'e) config_p, (('g,'l) c_state) rel1, \n (('g,'l) c_state) rel1,\n (('g,'l) c_state,('g1,'l1) c_state) rel,\n (('g,'l) c_state,('g1,'l1) c_state) rel,\n (('g,'l) c_state,('g1,'l1) c_state) rel,\n ('g1\\'l1,'p,'f,'e) body,('g1,'l1,'p,'f,'e) config_p, (('g1,'l1) c_state) rel1, \n (('g1,'l1) c_state) rel1\n ] \\ bool\" \n(\"'(_,_,_,_')/ \\\\<^sub>s\\<^sub>'(\\<^sub>_\\<^sub>;\\<^sub>_\\<^sub>;\\<^sub>_\\<^sub>')/ '(_,_,_,_')\" [81,81,81,81,81,81,81,81,81,81,81] 100)\nwhere\n srgsim: \"\\(((\\g,\\l),\\ls),((\\g, \\l), \\ls))\\\\; \n \\c\\<^sub>c' \\g' \\l'. \\\\<^sub>c\\\\<^sub>c\\<^sub>\\ (c\\<^sub>c,(\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s, (\\g, \\l)) \\\\<^sub>\\\\<^sup>* (c\\<^sub>s', (\\g', \\l'))) \\ \n (\\c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s, (\\g, \\l)) \\\\<^sub>\\\\<^sup>* (c\\<^sub>s', (\\g', \\l')) \\\n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s)) ; \n \\v c\\<^sub>c' \\g' \\l' e. e=Some v \\ \\\\<^sub>c\\\\<^sub>c\\<^sub>e (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l'))) \\\n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l')) \\ \n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n (((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ (G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s)) ; \n \\\\g' \\l' \\ls' \\g' \\l' \\ls'. \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls')),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls'))) \\ ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (\\\\<^sub>c,(c\\<^sub>c, ((\\g',\\l'),\\ls')),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s, ((\\g', \\l'), \\ls')),R\\<^sub>s,G\\<^sub>s); \n c\\<^sub>c = Skip \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Skip, (\\g', \\l'))) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Skip, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>q \\ \\\\<^sub>q\\\\); \n c\\<^sub>c = Throw \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Throw, (\\g', \\l'))) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Throw, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>a \\ \\\\<^sub>a\\\\);\n \\f. c\\<^sub>c = Fault f \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Fault f, (\\g', \\l'))) \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Fault f, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\);\n c\\<^sub>c = Stuck \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Stuck, (\\g', \\l'))) \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Stuck, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\)\n \\ \\ (\\\\<^sub>c,(c\\<^sub>c, ((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s, ((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\"\n \ninductive_cases s_sim_elim_cases:\n \"(\\\\<^sub>c,(c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c',((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\" \n \n \ninductive_cases s_sim_elim_cases_c[split_format (complete)]:\n \"(\\\\<^sub>c,(Skip,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c',((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\" \n \"(\\\\<^sub>c,(Throw, ((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c',((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\" \n \"(\\\\<^sub>c,(Fault f, ((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c',((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\" \n \"(\\\\<^sub>c,(Stuck, ((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c',((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\"\n\nlemma dest_s_sim_ev_step:\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>(Some v) (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l'))) \\\n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l')) \\\n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\" \n apply (erule s_sim_elim_cases)\n by auto\n\nlemma dest_s_sim_ev_step':\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>(Some v) (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l')) \\ \n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\" \n using dest_s_sim_ev_step by fast\n \n \nlemma dest_s_sim_ev_step1:\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>(Some v) (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l'))) \\\n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l')) \\\n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\" \n by (erule s_sim_elim_cases, auto)\n\nlemma dest_s_sim_ev_step1':\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>(Some v) (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c\\<^sub>v (c\\<^sub>s,(\\g, \\l)) \\\\<^sup>+ (c\\<^sub>s', (\\g', \\l')) \\ \n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\" \n using dest_s_sim_ev_step1 by fast\n\n \nlemma dest_s_sim_tau_step:\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>\\ (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (c\\<^sub>s', (\\g', \\l'))) \\\n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (c\\<^sub>s', (\\g', \\l')) \\\n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\"\n by (erule s_sim_elim_cases, force)\n\nlemma dest_s_sim_tau_step':\n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n \\\\<^sub>c\\\\<^sub>c\\<^sub>\\ (c\\<^sub>c, (\\g,\\l)) \\ (c\\<^sub>c', (\\g',\\l')) \\ \n (\\ c\\<^sub>s' \\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (c\\<^sub>s', (\\g', \\l')) \\\n (((\\g',\\l'),\\ls),((\\g', \\l'), \\ls))\\\\ \\ \n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls)),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c', ((\\g',\\l'),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s', ((\\g', \\l'), \\ls)),R\\<^sub>s,G\\<^sub>s))\"\n using dest_s_sim_tau_step by fast\n\nlemma dest_s_sim_env_step: \n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n ((((\\g,\\l),\\ls),((\\g',\\l'),\\ls')),\n (((\\g, \\l), \\ls),((\\g', \\l'), \\ls'))) \\ ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\) \\\n (\\\\<^sub>c,(c\\<^sub>c, ((\\g',\\l'),\\ls')),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s, ((\\g', \\l'), \\ls')),R\\<^sub>s,G\\<^sub>s)\" \n by (erule s_sim_elim_cases, auto)\n \n lemma dest_s_sim_alpha: \n \"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (((\\g,\\l),\\ls),((\\g, \\l), \\ls)) \\ \\\" \n by (erule s_sim_elim_cases,auto)\n\nlemma dest_s_final_skip:\n\"(\\\\<^sub>c,(Skip,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Skip, (\\g', \\l'))) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Skip, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>q \\ \\\\<^sub>q\\\\)\"\n by (erule s_sim_elim_cases,auto)\n\nlemma dest_s_final_skip':\n\"(\\\\<^sub>c,(Skip,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Skip, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>q \\ \\\\<^sub>q\\\\)\"\n using dest_s_final_skip by fast\n\nlemma dest_s_final_Throw:\n\"(\\\\<^sub>c,(Throw,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Throw, (\\g', \\l'))) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Throw, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>a \\ \\\\<^sub>a\\\\)\"\n by (erule s_sim_elim_cases,auto)\n\nlemma dest_s_final_Throw':\n\"(\\\\<^sub>c,(Throw,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Throw, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\\\<^sub>a \\ \\\\<^sub>a\\\\)\"\n using dest_s_final_Throw by fast\n\nlemma dest_s_final_Fault:\n\"(\\\\<^sub>c,(Fault f,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Fault f, (\\g', \\l'))) \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Fault f, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\)\"\n by (erule s_sim_elim_cases, auto)\n\nlemma dest_s_final_Fault':\n\"(\\\\<^sub>c,(Fault f,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Fault f, (\\g', \\l')) \\\n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\)\"\n using dest_s_final_Fault by fast\n\n\nlemma dest_s_final_Stuck:\n\"(\\\\<^sub>c,(Stuck,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Stuck, (\\g', \\l'))) \\ \n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Stuck, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\)\"\n by (erule s_sim_elim_cases, auto)\n\nlemma dest_s_final_Stuck':\n\"(\\\\<^sub>c,(Stuck,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\\n (\\\\g' \\l'. \\\\<^sub>s\\\\<^sub>c (c\\<^sub>s,(\\g, \\l)) \\\\<^sub>\\\\<^sup>* (Stuck, (\\g', \\l')) \\ \n ((((\\g,\\l),\\ls),((\\g,\\l),\\ls)), (((\\g, \\l), \\ls),((\\g', \\l'), \\ls))) \\ ((G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\) \\ \n (((\\g,\\l),\\ls), ((\\g', \\l'), \\ls))\\\\)\"\n using dest_s_final_Stuck by fast\n\n\nlemma sim_strong_weak:\"(\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s) \\ \n (\\\\<^sub>c,(c\\<^sub>c,((\\g,\\l),\\ls)),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>q\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c\\<^sub>s,((\\g, \\l), \\ls)),R\\<^sub>s,G\\<^sub>s)\"\n apply(coinduction arbitrary: \\g \\l \\ls \\g \\l \\ls c\\<^sub>c c\\<^sub>s, clarsimp) \n apply (auto simp add: toSeq_def)\n apply (auto intro: dest_s_sim_alpha)[1] \n apply (fast dest: dest_s_sim_tau_step')\n apply (drule dest_s_sim_ev_step1', fast) \n by (fast dest: dest_s_sim_env_step dest_s_final_skip \n dest_s_final_Throw dest_s_final_Fault dest_s_final_Stuck)+\n\ndefinition \"SRGSim_pre\":: \n \"[('g\\'l,'p,'f,'e) body,('g \\ 'l,'p,'f,'e)com, \n (('g,'l) c_state) rel1, (('g,'l) c_state) rel1,\n (('g,'l) c_state,('g1,'l1) c_state) rel, (('g,'l) c_state,('g1,'l1) c_state) rel,\n (('g,'l) c_state,('g1,'l1) c_state) rel, (('g,'l) c_state,('g1,'l1) c_state) rel,\n ('g1\\'l1,'p,'f,'e) body,('g1 \\ 'l1,'p,'f,'e) com, \n (('g1,'l1) c_state) rel1, (('g1,'l1) c_state) rel1] \\ bool \" \n (\"'(_,_,_,_')/ \\\\<^sub>s\\<^sub>'(\\<^sub>_\\<^sub>;\\<^sub>_\\<^sub>\\\\<^sub>_\\<^sub>;\\<^sub>_\\<^sub>')/ '(_,_,_,_')\" [81,81,81,81,81,81,81,81,81,81,81,81] 100)\n where\n\" (\\\\<^sub>c,c,R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>\\\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,c',R\\<^sub>s,G\\<^sub>s) \\ \n \\\\ \\. (\\,\\)\\\\ \\ (\\\\<^sub>c,(c, \\),R\\<^sub>c,G\\<^sub>c) \\\\<^sub>s\\<^sub>(\\<^sub>\\\\<^sub>;\\<^sub>\\\\<^sub>n\\<^sub>;\\<^sub>\\\\<^sub>a\\<^sub>) (\\\\<^sub>s,(c', \\),R\\<^sub>s,G\\<^sub>s)\n\"\n\n \nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/Conc_Refinement/Strong_CRef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.29588798117936765}} {"text": "(* Title: HOL/Auth/Guard/Proto.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\Other Protocol-Independent Results\\\n\ntheory Proto imports Guard_Public begin\n\nsubsection\\protocols\\\n\ntype_synonym rule = \"event set * event\"\n\nabbreviation\n msg' :: \"rule => msg\" where\n \"msg' R == msg (snd R)\"\n\ntype_synonym proto = \"rule set\"\n\ndefinition wdef :: \"proto => bool\" where\n\"wdef p == ALL R k. R:p --> Number k:parts {msg' R}\n--> Number k:parts (msg`(fst R))\"\n\nsubsection\\substitutions\\\n\nrecord subs =\n agent :: \"agent => agent\"\n nonce :: \"nat => nat\"\n nb :: \"nat => msg\"\n key :: \"key => key\"\n\nprimrec apm :: \"subs => msg => msg\" where\n \"apm s (Agent A) = Agent (agent s A)\"\n| \"apm s (Nonce n) = Nonce (nonce s n)\"\n| \"apm s (Number n) = nb s n\"\n| \"apm s (Key K) = Key (key s K)\"\n| \"apm s (Hash X) = Hash (apm s X)\"\n| \"apm s (Crypt K X) = (\nif (EX A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)\nelse if (EX A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)\nelse Crypt (key s K) (apm s X))\"\n| \"apm s \\X,Y\\ = \\apm s X, apm s Y\\\"\n\nlemma apm_parts: \"X:parts {Y} ==> apm s X:parts {apm s Y}\"\napply (erule parts.induct, simp_all, blast)\napply (erule parts.Fst)\napply (erule parts.Snd)\nby (erule parts.Body)+\n\nlemma Nonce_apm [rule_format]: \"Nonce n:parts {apm s X} ==>\n(ALL k. Number k:parts {X} --> Nonce n ~:parts {nb s k}) -->\n(EX k. Nonce k:parts {X} & nonce s k = n)\"\nby (induct X, simp_all, blast)\n\nlemma wdef_Nonce: \"[| Nonce n:parts {apm s X}; R:p; msg' R = X; wdef p;\nNonce n ~:parts (apm s `(msg `(fst R))) |] ==>\n(EX k. Nonce k:parts {X} & nonce s k = n)\"\napply (erule Nonce_apm, unfold wdef_def)\napply (drule_tac x=R in spec, drule_tac x=k in spec, clarsimp)\napply (drule_tac x=x in bspec, simp)\napply (drule_tac Y=\"msg x\" and s=s in apm_parts, simp)\nby (blast dest: parts_parts)\n\nprimrec ap :: \"subs => event => event\" where\n \"ap s (Says A B X) = Says (agent s A) (agent s B) (apm s X)\"\n| \"ap s (Gets A X) = Gets (agent s A) (apm s X)\"\n| \"ap s (Notes A X) = Notes (agent s A) (apm s X)\"\n\nabbreviation\n ap' :: \"subs => rule => event\" where\n \"ap' s R == ap s (snd R)\"\n\nabbreviation\n apm' :: \"subs => rule => msg\" where\n \"apm' s R == apm s (msg' R)\"\n\nabbreviation\n priK' :: \"subs => agent => key\" where\n \"priK' s A == priK (agent s A)\"\n\nabbreviation\n pubK' :: \"subs => agent => key\" where\n \"pubK' s A == pubK (agent s A)\"\n\nsubsection\\nonces generated by a rule\\\n\ndefinition newn :: \"rule => nat set\" where\n\"newn R == {n. Nonce n:parts {msg (snd R)} & Nonce n ~:parts (msg`(fst R))}\"\n\nlemma newn_parts: \"n:newn R ==> Nonce (nonce s n):parts {apm' s R}\"\nby (auto simp: newn_def dest: apm_parts)\n\nsubsection\\traces generated by a protocol\\\n\ndefinition ok :: \"event list => rule => subs => bool\" where\n\"ok evs R s == ((ALL x. x:fst R --> ap s x:set evs)\n& (ALL n. n:newn R --> Nonce (nonce s n) ~:used evs))\"\n\ninductive_set\n tr :: \"proto => event list set\"\n for p :: proto\nwhere\n\n Nil [intro]: \"[]:tr p\"\n\n| Fake [intro]: \"[| evsf:tr p; X:synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf:tr p\"\n\n| Proto [intro]: \"[| evs:tr p; R:p; ok evs R s |] ==> ap' s R # evs:tr p\"\n\nsubsection\\general properties\\\n\nlemma one_step_tr [iff]: \"one_step (tr p)\"\napply (unfold one_step_def, clarify)\nby (ind_cases \"ev # evs:tr p\" for ev evs, auto)\n\ndefinition has_only_Says' :: \"proto => bool\" where\n\"has_only_Says' p == ALL R. R:p --> is_Says (snd R)\"\n\nlemma has_only_Says'D: \"[| R:p; has_only_Says' p |]\n==> (EX A B X. snd R = Says A B X)\"\nby (unfold has_only_Says'_def is_Says_def, blast)\n\nlemma has_only_Says_tr [simp]: \"has_only_Says' p ==> has_only_Says (tr p)\"\napply (unfold has_only_Says_def)\napply (rule allI, rule allI, rule impI)\napply (erule tr.induct)\napply (auto simp: has_only_Says'_def ok_def)\nby (drule_tac x=a in spec, auto simp: is_Says_def)\n\nlemma has_only_Says'_in_trD: \"[| has_only_Says' p; list @ ev # evs1 \\ tr p |]\n==> (EX A B X. ev = Says A B X)\"\nby (drule has_only_Says_tr, auto)\n\nlemma ok_not_used: \"[| Nonce n ~:used evs; ok evs R s;\nALL x. x:fst R --> is_Says x |] ==> Nonce n ~:parts (apm s `(msg `(fst R)))\"\napply (unfold ok_def, clarsimp)\napply (drule_tac x=x in spec, drule_tac x=x in spec)\nby (auto simp: is_Says_def dest: Says_imp_spies not_used_not_spied parts_parts)\n\nlemma ok_is_Says: \"[| evs' @ ev # evs:tr p; ok evs R s; has_only_Says' p;\nR:p; x:fst R |] ==> is_Says x\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=x in spec, simp)\napply (subgoal_tac \"one_step (tr p)\")\napply (drule trunc, simp, drule one_step_Cons, simp)\napply (drule has_only_SaysD, simp+)\nby (clarify, case_tac x, auto)\n\nsubsection\\types\\\n\ntype_synonym keyfun = \"rule => subs => nat => event list => key set\"\n\ntype_synonym secfun = \"rule => nat => subs => key set => msg\"\n\nsubsection\\introduction of a fresh guarded nonce\\\n\ndefinition fresh :: \"proto => rule => subs => nat => key set => event list\n=> bool\" where\n\"fresh p R s n Ks evs == (EX evs1 evs2. evs = evs2 @ ap' s R # evs1\n& Nonce n ~:used evs1 & R:p & ok evs1 R s & Nonce n:parts {apm' s R}\n& apm' s R:guard n Ks)\"\n\nlemma freshD: \"fresh p R s n Ks evs ==> (EX evs1 evs2.\nevs = evs2 @ ap' s R # evs1 & Nonce n ~:used evs1 & R:p & ok evs1 R s\n& Nonce n:parts {apm' s R} & apm' s R:guard n Ks)\"\nby (unfold fresh_def, blast)\n\nlemma freshI [intro]: \"[| Nonce n ~:used evs1; R:p; Nonce n:parts {apm' s R};\nok evs1 R s; apm' s R:guard n Ks |]\n==> fresh p R s n Ks (list @ ap' s R # evs1)\"\nby (unfold fresh_def, blast)\n\nlemma freshI': \"[| Nonce n ~:used evs1; (l,r):p;\nNonce n:parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r):guard n Ks |]\n==> fresh p (l,r) s n Ks (evs2 @ ap s r # evs1)\"\nby (drule freshI, simp+)\n\nlemma fresh_used: \"[| fresh p R' s' n Ks evs; has_only_Says' p |]\n==> Nonce n:used evs\"\napply (unfold fresh_def, clarify)\napply (drule has_only_Says'D)\nby (auto intro: parts_used_app)\n\nlemma fresh_newn: \"[| evs' @ ap' s R # evs:tr p; wdef p; has_only_Says' p;\nNonce n ~:used evs; R:p; ok evs R s; Nonce n:parts {apm' s R} |]\n==> EX k. k:newn R & nonce s k = n\"\napply (drule wdef_Nonce, simp+)\napply (frule ok_not_used, simp+)\napply (clarify, erule ok_is_Says, simp+)\napply (clarify, rule_tac x=k in exI, simp add: newn_def)\napply (clarify, drule_tac Y=\"msg x\" and s=s in apm_parts)\napply (drule ok_not_used, simp+)\nby (clarify, erule ok_is_Says, simp_all)\n\nlemma fresh_rule: \"[| evs' @ ev # evs:tr p; wdef p; Nonce n ~:used evs;\nNonce n:parts {msg ev} |] ==> EX R s. R:p & ap' s R = ev\"\napply (drule trunc, simp, ind_cases \"ev # evs:tr p\", simp)\nby (drule_tac x=X in in_sub, drule parts_sub, simp, simp, blast+)\n\nlemma fresh_ruleD: \"[| fresh p R' s' n Ks evs; keys R' s' n evs <= Ks; wdef p;\nhas_only_Says' p; evs:tr p; ALL R k s. nonce s k = n --> Nonce n:used evs -->\nR:p --> k:newn R --> Nonce n:parts {apm' s R} --> apm' s R:guard n Ks -->\napm' s R:parts (spies evs) --> keys R s n evs <= Ks --> P |] ==> P\"\napply (frule fresh_used, simp)\napply (unfold fresh_def, clarify)\napply (drule_tac x=R' in spec)\napply (drule fresh_newn, simp+, clarify)\napply (drule_tac x=k in spec)\napply (drule_tac x=s' in spec)\napply (subgoal_tac \"apm' s' R':parts (spies (evs2 @ ap' s' R' # evs1))\")\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (rule_tac Y=\"apm s' X\" in parts_parts, blast)\nby (rule parts.Inj, rule Says_imp_spies, simp, blast)\n\nsubsection\\safe keys\\\n\ndefinition safe :: \"key set => msg set => bool\" where\n\"safe Ks G == ALL K. K:Ks --> Key K ~:analz G\"\n\nlemma safeD [dest]: \"[| safe Ks G; K:Ks |] ==> Key K ~:analz G\"\nby (unfold safe_def, blast)\n\nlemma safe_insert: \"safe Ks (insert X G) ==> safe Ks G\"\nby (unfold safe_def, blast)\n\nlemma Guard_safe: \"[| Guard n Ks G; safe Ks G |] ==> Nonce n ~:analz G\"\nby (blast dest: Guard_invKey)\n\nsubsection\\guardedness preservation\\\n\ndefinition preserv :: \"proto => keyfun => nat => key set => bool\" where\n\"preserv p keys n Ks == (ALL evs R' s' R s. evs:tr p -->\nGuard n Ks (spies evs) --> safe Ks (spies evs) --> fresh p R' s' n Ks evs -->\nkeys R' s' n evs <= Ks --> R:p --> ok evs R s --> apm' s R:guard n Ks)\"\n\nlemma preservD: \"[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; R:p; ok evs R s;\nkeys R' s' n evs <= Ks |] ==> apm' s R:guard n Ks\"\nby (unfold preserv_def, blast)\n\nlemma preservD': \"[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X):p;\nok evs (l,Says A B X) s; keys R' s' n evs <= Ks |] ==> apm s X:guard n Ks\"\nby (drule preservD, simp+)\n\nsubsection\\monotonic keyfun\\\n\ndefinition monoton :: \"proto => keyfun => bool\" where\n\"monoton p keys == ALL R' s' n ev evs. ev # evs:tr p -->\nkeys R' s' n evs <= keys R' s' n (ev # evs)\"\n\nlemma monotonD [dest]: \"[| keys R' s' n (ev # evs) <= Ks; monoton p keys;\nev # evs:tr p |] ==> keys R' s' n evs <= Ks\"\nby (unfold monoton_def, blast)\n\nsubsection\\guardedness theorem\\\n\nlemma Guard_tr [rule_format]: \"[| evs:tr p; has_only_Says' p;\npreserv p keys n Ks; monoton p keys; Guard n Ks (initState Spy) |] ==>\nsafe Ks (spies evs) --> fresh p R' s' n Ks evs --> keys R' s' n evs <= Ks -->\nGuard n Ks (spies evs)\"\napply (erule tr.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply (clarify, drule freshD, clarsimp)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, blast)\n(* evs2 = aa # list *)\napply (clarsimp, rule conjI)\napply (blast dest: safe_insert)\n(* X:guard n Ks *)\napply (rule in_synth_Guard, simp, rule Guard_analz)\napply (blast dest: safe_insert)\napply (drule safe_insert, simp add: safe_def)\n(* Proto *)\napply (clarify, drule freshD, clarify)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (frule_tac R=R' in has_only_Says'D, simp)\napply (case_tac R', clarsimp, blast)\n(* evs2 = ab # list *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, rule conjI)\napply (drule Proto, simp+, blast dest: safe_insert)\n(* apm s X:guard n Ks *)\napply (frule Proto, simp+)\napply (erule preservD', simp+)\napply (blast dest: safe_insert)\napply (blast dest: safe_insert)\nby (blast, simp, simp, blast)\n\nsubsection\\useful properties for guardedness\\\n\nlemma newn_neq_used: \"[| Nonce n:used evs; ok evs R s; k:newn R |]\n==> n ~= nonce s k\"\nby (auto simp: ok_def)\n\nlemma ok_Guard: \"[| ok evs R s; Guard n Ks (spies evs); x:fst R; is_Says x |]\n==> apm s (msg x):parts (spies evs) & apm s (msg x):guard n Ks\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=\"Says A B X\" in spec, simp)\nby (drule Says_imp_spies, auto intro: parts_parts)\n\nlemma ok_parts_not_new: \"[| Y:parts (spies evs); Nonce (nonce s n):parts {Y};\nok evs R s |] ==> n ~:newn R\"\nby (auto simp: ok_def dest: not_used_not_spied parts_parts)\n\nsubsection\\unicity\\\n\ndefinition uniq :: \"proto => secfun => bool\" where\n\"uniq p secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->\nn:newn R --> n':newn R' --> nonce s n = nonce s' n' -->\nNonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->\napm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->\nevs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->\nsecret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniqD: \"[| uniq p secret; evs: tr p; R:p; R':p; n:newn R; n':newn R';\nnonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);\nNonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};\nsecret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);\napm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq_def, blast)\n\ndefinition ord :: \"proto => (rule => rule => bool) => bool\" where\n\"ord p inff == ALL R R'. R:p --> R':p --> ~ inff R R' --> inff R' R\"\n\nlemma ordD: \"[| ord p inff; ~ inff R R'; R:p; R':p |] ==> inff R' R\"\nby (unfold ord_def, blast)\n\ndefinition uniq' :: \"proto => (rule => rule => bool) => secfun => bool\" where\n\"uniq' p inff secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->\ninff R R' --> n:newn R --> n':newn R' --> nonce s n = nonce s' n' -->\nNonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->\napm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->\nevs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->\nsecret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniq'D: \"[| uniq' p inff secret; evs: tr p; inff R R'; R:p; R':p; n:newn R;\nn':newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);\nNonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};\nsecret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);\napm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq'_def, blast)\n\nlemma uniq'_imp_uniq: \"[| uniq' p inff secret; ord p inff |] ==> uniq p secret\"\napply (unfold uniq_def)\napply (rule allI)+\napply (case_tac \"inff R R'\")\napply (blast dest: uniq'D)\nby (auto dest: ordD uniq'D intro: sym)\n\nsubsection\\Needham-Schroeder-Lowe\\\n\ndefinition a :: agent where \"a == Friend 0\"\ndefinition b :: agent where \"b == Friend 1\"\ndefinition a' :: agent where \"a' == Friend 2\"\ndefinition b' :: agent where \"b' == Friend 3\"\ndefinition Na :: nat where \"Na == 0\"\ndefinition Nb :: nat where \"Nb == 1\"\n\nabbreviation\n ns1 :: rule where\n \"ns1 == ({}, Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\))\"\n\nabbreviation\n ns2 :: rule where\n \"ns2 == ({Says a' b (Crypt (pubK b) \\Nonce Na, Agent a\\)},\n Says b a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\))\"\n\nabbreviation\n ns3 :: rule where\n \"ns3 == ({Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\),\n Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)},\n Says a b (Crypt (pubK b) (Nonce Nb)))\"\n\ninductive_set ns :: proto where\n [iff]: \"ns1:ns\"\n| [iff]: \"ns2:ns\"\n| [iff]: \"ns3:ns\"\n\nabbreviation (input)\n ns3a :: event where\n \"ns3a == Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\)\"\n\nabbreviation (input)\n ns3b :: event where\n \"ns3b == Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\"\n\ndefinition keys :: \"keyfun\" where\n\"keys R' s' n evs == {priK' s' a, priK' s' b}\"\n\nlemma \"monoton ns keys\"\nby (simp add: keys_def monoton_def)\n\ndefinition secret :: \"secfun\" where\n\"secret R n s Ks ==\n(if R=ns1 then apm s (Crypt (pubK b) \\Nonce Na, Agent a\\)\nelse if R=ns2 then apm s (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\nelse Number 0)\"\n\ndefinition inf :: \"rule => rule => bool\" where\n\"inf R R' == (R=ns1 | (R=ns2 & R'~=ns1) | (R=ns3 & R'=ns3))\"\n\nlemma inf_is_ord [iff]: \"ord ns inf\"\napply (unfold ord_def inf_def)\napply (rule allI)+\napply (rule impI)\napply (simp add: split_paired_all)\nby (rule impI, erule ns.cases, simp_all)+\n\nsubsection\\general properties\\\n\nlemma ns_has_only_Says' [iff]: \"has_only_Says' ns\"\napply (unfold has_only_Says'_def)\napply (rule allI, rule impI)\napply (simp add: split_paired_all)\nby (erule ns.cases, auto)\n\nlemma newn_ns1 [iff]: \"newn ns1 = {Na}\"\nby (simp add: newn_def)\n\nlemma newn_ns2 [iff]: \"newn ns2 = {Nb}\"\nby (auto simp: newn_def Na_def Nb_def)\n\nlemma newn_ns3 [iff]: \"newn ns3 = {}\"\nby (auto simp: newn_def)\n\nlemma ns_wdef [iff]: \"wdef ns\"\nby (auto simp: wdef_def elim: ns.cases)\n\nsubsection\\guardedness for NSL\\\n\nlemma \"uniq ns secret ==> preserv ns keys n Ks\"\napply (unfold preserv_def)\napply (rule allI)+\napply (rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule fresh_ruleD, simp, simp, simp, simp)\napply (rule allI)+\napply (rule impI, rule impI, rule impI)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* fresh with NS1 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Na = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Na = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* fresh with NS2 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Nb = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Nb = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* fresh with NS3 *)\nby simp\n\nsubsection\\unicity for NSL\\\n\nlemma \"uniq' ns inf secret\"\napply (unfold uniq'_def)\napply (rule allI)+\napply (simp add: split_paired_all)\napply (rule impI, erule ns.cases)\n(* R = ns1 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp)\napply (drule ok_parts_not_new, simp, simp, simp)\napply (clarify, drule ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (simp add: secret_def)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Na in ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns3 *)\napply simp\n(* R = ns2 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (simp only: inf_def, blast)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (simp add: secret_def)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\napply (erule disjE, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\nby (simp_all add: secret_def)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/Proto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.29588681067120404}} {"text": "theory flash9Bra imports flash9Rev\n \n begin\nlemma onInv9:\n\n assumes a1:\"iInv1 \\ N\" and \n\n b1:\"r \\ rules N\" and b2:\"invf=inv9 iInv1 \"\n shows \"invHoldForRule' s invf r (invariants N)\" \n proof - \nhave c1:\"ex1P N (% iRule1 . r=NI_Local_GetX_PutX1 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_GetX iRule1 )\\ex1P N (% iRule1 . r=NI_Replace iRule1 )\\ex0P N ( r=NI_ShWb N )\\ex0P N ( r=PI_Local_GetX_GetX2 )\\ex0P N ( r=NI_Local_PutXAcksDone )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX7 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak2 iRule1 )\\ex0P N ( r=NI_ReplaceHomeShrVld )\\ex1P N (% iRule1 . r=NI_Remote_Put iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX5 N iRule1 )\\ex0P N ( r=NI_Wb )\\ex1P N (% iRule1 . r=NI_Local_Get_Get iRule1 )\\ex0P N ( r=PI_Local_Replace )\\ex1P N (% iRule1 . r=NI_ReplaceShrVld iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX8 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_InvAck_2 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Nak2 iRule1 iRule2 )\\ex1P N (% iRule1 . r=PI_Remote_Replace iRule1 )\\ex0P N ( r=NI_Nak_Home )\\ex1P N (% iRule1 . r=NI_Local_Get_Put2 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_InvAck_1 iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX11 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX6 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Put2 iRule1 iRule2 )\\ex0P N ( r=PI_Local_Get_Put )\\ex0P N ( r=PI_Local_GetX_PutX1 N )\\ex1P N (% iRule1 . r=NI_InvAck_1_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak2 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX10_home N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_Get iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak3 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX10 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX2 N iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Put1 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_PutX iRule1 )\\ex1P N (% iRule1 . r=Store iRule1 )\\ex0P N ( r=NI_FAck )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX3 N iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX3 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_PutX iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX8_home N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put1 N iRule1 )\\ex0P N ( r=PI_Local_GetX_GetX1 )\\ex0P N ( r=StoreHome )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_Nak iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Inv iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_PutX iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX4 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX4 N iRule1 )\\ex1P N (% iRule1 . r=NI_Nak iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX2 N )\\ex0P N ( r=NI_Local_Put )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak1 iRule1 )\\ex0P N ( r=NI_Nak_Clear )\\ex0P N ( r=PI_Local_PutX )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak3 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_GetX_Nak_Home iRule1 )\\ex0P N ( r=PI_Local_Get_Get )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX9 N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_GetX iRule1 )\\ex0P N ( r=NI_ReplaceHome )\\ex1P N (% iRule1 . r=NI_Remote_GetX_PutX_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put3 iRule1 )\" \n\n apply(cut_tac b1)\n apply auto\n done moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_GetXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_ReplaceVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ShWb N )\n\"\n \n from c1 have c2:\" r= NI_ShWb N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_ShWb N ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_ShWbVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX2 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_GetX2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_PutXAcksDone )\n\"\n \n from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_Local_PutXAcksDoneVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX7 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX7 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX7VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Nak2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHomeShrVld )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_ReplaceHomeShrVldVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Put iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Put iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_PutVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX5 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX5 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX5VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Wb )\n\"\n \n from c1 have c2:\" r= NI_Wb \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Wb ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_WbVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_GetVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Replace )\n\"\n \n from c1 have c2:\" r= PI_Local_Replace \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Replace ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_ReplaceVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_ReplaceShrVld iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_ReplaceShrVld iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_ReplaceShrVldVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX8 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX8 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX8VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_InvAck_2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Nak2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Nak2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_Get_Nak2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis PI_Remote_ReplaceVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Home )\n\"\n \n from c1 have c2:\" r= NI_Nak_Home \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak_Home ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_Nak_HomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Put2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_InvAck_1 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_InvAck_1 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_InvAck_1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX11 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX11 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX11VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX6 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX6 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX6VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Put2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Put2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_Get_Put2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Put )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Get_Put ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_Get_PutVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX1 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_PutX1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_1_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_1_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_InvAck_1_HomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_Get_Nak1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Nak1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_Nak2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX10_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX10_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX10_homeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis PI_Remote_GetVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_Nak3VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX10 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX10 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX10VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Put1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Put1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_Get_Put1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_PutXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= Store iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= Store iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (Store iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis StoreVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_FAck )\n\"\n \n from c1 have c2:\" r= NI_FAck \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_FAck ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_FAckVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX3 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX3 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX3VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX3 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_PutX3VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_PutX iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_PutX iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_GetX_PutXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX8_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX8_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX8_homeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Put1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX1 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_GetX1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= StoreHome )\n\"\n \n from c1 have c2:\" r= StoreHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (StoreHome ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis StoreHomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_Nak iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_Nak iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_GetX_NakVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Inv iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Inv iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Inv iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_InvVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis PI_Remote_PutXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX4 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_PutX4VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX4 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX4 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX4VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Nak iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Nak iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_NakVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX2 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_GetX_PutX2VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_Put )\n\"\n \n from c1 have c2:\" r= NI_Local_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Put ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_Local_PutVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_Nak1VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Clear )\n\"\n \n from c1 have c2:\" r= NI_Nak_Clear \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak_Clear ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_Nak_ClearVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_PutX )\n\"\n \n from c1 have c2:\" r= PI_Local_PutX \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_PutX ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_PutXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Nak3VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_Nak_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_Nak_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_GetX_Nak_HomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Get )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Get \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Get_Get ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis PI_Local_Get_GetVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX9 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX9 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_GetX_PutX9VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis PI_Remote_GetXVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHome )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceHome ) (invariants N) \"\n apply(cut_tac a1 b2 c2 )\n by (metis NI_ReplaceHomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_PutX_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_PutX_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Remote_GetX_PutX_HomeVsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 )\n by (metis NI_Local_Get_Put3VsInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n by blast \n qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash9Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.295865622195672}} {"text": "(* Title: JinjaThreads/BV/BVSpec.thy\n Author: Cornelia Pusch, Gerwin Klein, Andreas Lochbihler\n\n Based on the theory Jinja/BV/BVSpec\n*)\n\nheader {* \\isaheader{The Bytecode Verifier}\\label{sec:BVSpec} *}\n\ntheory BVSpec\nimports\n Effect\nbegin\n\ntext {*\n This theory contains a specification of the BV. The specification\n describes correct typings of method bodies; it corresponds \n to type \\emph{checking}.\n*}\n\n-- \"The method type only contains declared classes:\"\ndefinition check_types :: \"'m prog \\ nat \\ nat \\ ty\\<^sub>i' err list \\ bool\"\nwhere \n \"check_types P mxs mxl \\s \\ set \\s \\ states P mxs mxl\"\n\n-- \"An instruction is welltyped if it is applicable and its effect\"\n-- \"is compatible with the type at all successor instructions:\"\ndefinition wt_instr :: \"['m prog,ty,nat,pc,ex_table,'addr instr,pc,ty\\<^sub>m] \\ bool\"\n (\"_,_,_,_,_ \\ _,_ :: _\" [60,0,0,0,0,0,0,61] 60)\nwhere\n \"P,T,mxs,mpc,xt \\ i,pc :: \\s \\\n app i P mxs T pc mpc xt (\\s!pc) \\ \n (\\(pc',\\') \\ set (eff i P pc xt (\\s!pc)). P \\ \\' \\' \\s!pc')\"\n\n-- {* The type at @{text \"pc=0\"} conforms to the method calling convention: *}\ndefinition wt_start :: \"['m prog,cname,ty list,nat,ty\\<^sub>m] \\ bool\"\nwhere\n \"wt_start P C Ts mxl\\<^sub>0 \\s \\\n P \\ Some ([],OK (Class C)#map OK Ts@replicate mxl\\<^sub>0 Err) \\' \\s!0\"\n\n-- \"A method is welltyped if the body is not empty,\"\n-- \"if the method type covers all instructions and mentions\"\n-- \"declared classes only, if the method calling convention is respected, and\"\n-- \"if all instructions are welltyped.\"\ndefinition wt_method :: \"['m prog,cname,ty list,ty,nat,nat,'addr instr list, ex_table,ty\\<^sub>m] \\ bool\"\nwhere\n \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s \\\n 0 < size is \\ size \\s = size is \\\n check_types P mxs (1+size Ts+mxl\\<^sub>0) (map OK \\s) \\\n wt_start P C Ts mxl\\<^sub>0 \\s \\\n (\\pc < size is. P,T\\<^sub>r,mxs,size is,xt \\ is!pc,pc :: \\s)\"\n\n-- \"A program is welltyped if it is wellformed and all methods are welltyped\"\ndefinition wf_jvm_prog_phi :: \"ty\\<^sub>P \\ 'addr jvm_prog \\ bool\" (\"wf'_jvm'_prog\\<^bsub>_\\<^esub>\")\nwhere\n \"wf_jvm_prog\\<^bsub>\\\\<^esub> \\\n wf_prog (\\P C (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\ C M))\"\n\ndefinition wf_jvm_prog :: \"'addr jvm_prog \\ bool\"\nwhere\n \"wf_jvm_prog P \\ \\\\. wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n\nlemma wt_jvm_progD:\n \"wf_jvm_prog\\<^bsub>\\\\<^esub> P \\ \\wt. wf_prog wt P\"\n(*<*) by (unfold wf_jvm_prog_phi_def, blast) (*>*)\n\nlemma wt_jvm_prog_impl_wt_instr:\n \"\\ wf_jvm_prog\\<^bsub>\\\\<^esub> P; \n P \\ C sees M:Ts \\ T = \\(mxs,mxl\\<^sub>0,ins,xt)\\ in C; pc < size ins \\ \n \\ P,T,mxs,size ins,xt \\ ins!pc,pc :: \\ C M\"\n(*<*)\n apply (unfold wf_jvm_prog_phi_def)\n apply (drule (1) sees_wf_mdecl)\n apply (simp add: wf_mdecl_def wt_method_def)\n done\n(*>*)\n\nlemma wt_jvm_prog_impl_wt_start:\n \"\\ wf_jvm_prog\\<^bsub>\\\\<^esub> P; \n P \\ C sees M:Ts \\ T = \\(mxs,mxl\\<^sub>0,ins,xt)\\ in C \\ \\ \n 0 < size ins \\ wt_start P C Ts mxl\\<^sub>0 (\\ C M)\"\n(*<*)\n apply (unfold wf_jvm_prog_phi_def)\n apply (drule (1) sees_wf_mdecl)\n apply (simp add: wf_mdecl_def wt_method_def)\n done\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/BV/BVSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.295865622195672}} {"text": "theory \"isoiec-9798_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\nrole A\nwhere \"A =\n [ Recv ''1'' <| sMV ''B'', sAV ''A'', sMV ''Rb'', sMV ''Text1'' |>\n , Recv ''text2'' ( sMV ''Text2'' )\n , Send ''2'' <| sAV ''A'', sAV ''P'', sN ''Ra'', sMV ''Rb'', sMV ''B'',\n sMV ''Text2''\n |>\n , Recv ''3'' <| sAV ''P'', sAV ''A'', sMV ''Text5'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_1'', sN ''Ra'', sMV ''Kab'',\n sMV ''B'', sMV ''Text4''\n |>\n ( sK ''A'' ''P'' ),\n sMV ''TokenPA_for_B''\n |>\n , Recv ''text4'' <| sMV ''Text6'', sMV ''Text7'' |>\n , Send ''4'' <| sAV ''A'', sMV ''B'', sMV ''Text7'', sAV ''P'',\n sMV ''TokenPA_for_B'',\n PEnc <| sC ''isoiec_9798_2_6_enc_4'', sN ''Rpa'', sMV ''Rb'',\n sMV ''Text6''\n |>\n ( sMV ''Kab'' )\n |>\n , Recv ''5'' <| sMV ''B'', sAV ''A'', sMV ''Text9'',\n PEnc <| sC ''isoiec_9798_2_6_enc_5'', sMV ''Rb'', sN ''Rpa'',\n sMV ''Text8''\n |>\n ( sMV ''Kab'' )\n |>\n ]\"\n\nrole Abd\nwhere \"Abd =\n [ Recv ''1'' <| sMV ''Bbd'', sAV ''Abd'', sMV ''Rb'', sMV ''Text1'' |>\n , Recv ''text2'' ( sMV ''Text2'' )\n , Send ''2'' <| sAV ''Abd'', sAV ''Pbd'', sN ''Ra'', sMV ''Rb'',\n sMV ''Bbd'', sMV ''Text2''\n |>\n , Recv ''3'' <| sAV ''Pbd'', sAV ''Abd'', sMV ''Text5'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_1'', sN ''Ra'', sMV ''Kab'',\n sAV ''Abd'', sMV ''Bbd'', sMV ''Text4''\n |>\n ( sKbd (AVar ''Abd'') (AVar ''Pbd'') ),\n sMV ''TokenPA_for_B''\n |>\n , Recv ''text4'' <| sMV ''Text6'', sMV ''Text7'' |>\n , Send ''4'' <| sAV ''Abd'', sMV ''Bbd'', sMV ''Text7'', sAV ''Pbd'',\n sMV ''TokenPA_for_B'',\n PEnc <| sC ''isoiec_9798_2_6_enc_4'', sN ''Rpa'', sMV ''Rb'',\n sMV ''Text6''\n |>\n ( sMV ''Kab'' )\n |>\n , Recv ''5'' <| sMV ''Bbd'', sAV ''Abd'', sMV ''Text9'',\n PEnc <| sC ''isoiec_9798_2_6_enc_5'', sMV ''Rb'', sN ''Rpa'',\n sMV ''Text8''\n |>\n ( sMV ''Kab'' )\n |>\n ]\"\n\nrole B\nwhere \"B =\n [ Recv ''text1'' ( sMV ''Text1'' )\n , Send ''1'' <| sAV ''B'', sAV ''A'', sN ''Rb'', sMV ''Text1'' |>\n , Recv ''4'' <| sAV ''A'', sAV ''B'', sMV ''Text7'', sMV ''P'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_2'', sN ''Rb'', sMV ''Kab'',\n sAV ''A'', sMV ''Text3''\n |>\n ( PSymK ( sAV ''B'' ) ( sMV ''P'' ) ),\n PEnc <| sC ''isoiec_9798_2_6_enc_4'', sMV ''Rpa'', sN ''Rb'',\n sMV ''Text6''\n |>\n ( sMV ''Kab'' )\n |>\n , Recv ''text5'' <| sMV ''Text8'', sMV ''Text9'' |>\n , Send ''5'' <| sAV ''B'', sAV ''A'', sMV ''Text9'',\n PEnc <| sC ''isoiec_9798_2_6_enc_5'', sN ''Rb'', sMV ''Rpa'',\n sMV ''Text8''\n |>\n ( sMV ''Kab'' )\n |>\n ]\"\n\nrole Bbd\nwhere \"Bbd =\n [ Recv ''text1'' ( sMV ''Text1'' )\n , Send ''1'' <| sAV ''Bbd'', sAV ''Abd'', sN ''Rb'', sMV ''Text1'' |>\n , Recv ''4'' <| sAV ''Abd'', sAV ''Bbd'', sMV ''Text7'', sMV ''Pbd'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_2'', sN ''Rb'', sMV ''Kab'',\n sAV ''Abd'', sAV ''Bbd'', sMV ''Text3''\n |>\n ( sKbd (AVar ''Bbd'') (MVar ''Pbd'') ),\n PEnc <| sC ''isoiec_9798_2_6_enc_4'', sMV ''Rpa'', sN ''Rb'',\n sMV ''Text6''\n |>\n ( sMV ''Kab'' )\n |>\n , Recv ''text5'' <| sMV ''Text8'', sMV ''Text9'' |>\n , Send ''5'' <| sAV ''Bbd'', sAV ''Abd'', sMV ''Text9'',\n PEnc <| sC ''isoiec_9798_2_6_enc_5'', sN ''Rb'', sMV ''Rpa'',\n sMV ''Text8''\n |>\n ( sMV ''Kab'' )\n |>\n ]\"\n\nrole P\nwhere \"P =\n [ Recv ''2'' <| sMV ''A'', sAV ''P'', sMV ''Ra'', sMV ''Rb'', sMV ''B'',\n sMV ''Text2''\n |>\n , Recv ''text3'' <| sMV ''Text3'', sMV ''Text4'', sMV ''Text5'' |>\n , Send ''3'' <| sAV ''P'', sMV ''A'', sMV ''Text5'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_1'', sMV ''Ra'', sN ''Kab'',\n sMV ''B'', sMV ''Text4''\n |>\n ( PSymK ( sMV ''A'' ) ( sAV ''P'' ) ),\n PEnc <| sC ''isoiec_9798_2_6_enc_3_2'', sMV ''Rb'', sN ''Kab'',\n sMV ''A'', sMV ''Text3''\n |>\n ( PSymK ( sMV ''B'' ) ( sAV ''P'' ) )\n |>\n ]\"\n\nrole Pbd\nwhere \"Pbd =\n [ Recv ''2'' <| sMV ''Abd'', sAV ''Pbd'', sMV ''Ra'', sMV ''Rb'',\n sMV ''Bbd'', sMV ''Text2''\n |>\n , Recv ''text3'' <| sMV ''Text3'', sMV ''Text4'', sMV ''Text5'' |>\n , Send ''3'' <| sAV ''Pbd'', sMV ''Abd'', sMV ''Text5'',\n PEnc <| sC ''isoiec_9798_2_6_enc_3_1'', sMV ''Ra'', sN ''Kab'',\n sMV ''Abd'', sMV ''Bbd'', sMV ''Text4''\n |>\n ( sKbd (MVar ''Abd'') (AVar ''Pbd'') ),\n PEnc <| sC ''isoiec_9798_2_6_enc_3_2'', sMV ''Rb'', sN ''Kab'',\n sMV ''Abd'', sMV ''Bbd'', sMV ''Text3''\n |>\n ( sKbd (MVar ''Bbd'') (AVar ''Pbd'') )\n |>\n ]\"\n\nprotocol isoiec_9798_2_6\nwhere \"isoiec_9798_2_6 = { A, Abd, B, Bbd, P, Pbd }\"\n\nlocale restricted_isoiec_9798_2_6_state = isoiec_9798_2_6_state\n\ntype_invariant typing_2_6 for isoiec_9798_2_6\nwhere \"typing_2_6 = mk_typing\n [ ((P, ''A''), (KnownT P_2))\n , ((Pbd, ''Abd''), (KnownT Pbd_2))\n , ((A, ''B''), (KnownT A_1))\n , ((P, ''B''), (KnownT P_2))\n , ((Abd, ''Bbd''), (KnownT Abd_1))\n , ((Pbd, ''Bbd''), (KnownT Pbd_2))\n , ((A, ''Kab''), (SumT (KnownT A_3) (NonceT P ''Kab'')))\n , ((Abd, ''Kab''), (SumT (KnownT Abd_3) (NonceT Pbd ''Kab'')))\n , ((B, ''Kab''), (SumT (KnownT B_4) (NonceT P ''Kab'')))\n , ((Bbd, ''Kab''), (SumT (KnownT Bbd_4) (NonceT Pbd ''Kab'')))\n , ((B, ''P''), (KnownT B_4))\n , ((Bbd, ''Pbd''), (KnownT Bbd_4))\n , ((P, ''Ra''), (KnownT P_2))\n , ((Pbd, ''Ra''), (KnownT Pbd_2))\n , ((A, ''Rb''), (KnownT A_1))\n , ((Abd, ''Rb''), (KnownT Abd_1))\n , ((P, ''Rb''), (KnownT P_2))\n , ((Pbd, ''Rb''), (KnownT Pbd_2))\n , ((B, ''Rpa''),\n (SumT (KnownT B_4) (SumT (NonceT A ''Rpa'') (NonceT Abd ''Rpa''))))\n , ((Bbd, ''Rpa''),\n (SumT (KnownT Bbd_4) (SumT (NonceT A ''Rpa'') (NonceT Abd ''Rpa''))))\n , ((A, ''Text1''), (KnownT A_1))\n , ((Abd, ''Text1''), (KnownT Abd_1))\n , ((B, ''Text1''), (KnownT B_text1))\n , ((Bbd, ''Text1''), (KnownT Bbd_text1))\n , ((A, ''Text2''), (KnownT A_text2))\n , ((Abd, ''Text2''), (KnownT Abd_text2))\n , ((P, ''Text2''), (KnownT P_2))\n , ((Pbd, ''Text2''), (KnownT Pbd_2))\n , ((B, ''Text3''), (KnownT B_4))\n , ((Bbd, ''Text3''), (KnownT Bbd_4))\n , ((P, ''Text3''), (KnownT P_text3))\n , ((Pbd, ''Text3''), (KnownT Pbd_text3))\n , ((A, ''Text4''), (KnownT A_3))\n , ((Abd, ''Text4''), (KnownT Abd_3))\n , ((P, ''Text4''), (KnownT P_text3))\n , ((Pbd, ''Text4''), (KnownT Pbd_text3))\n , ((A, ''Text5''), (KnownT A_3))\n , ((Abd, ''Text5''), (KnownT Abd_3))\n , ((P, ''Text5''), (KnownT P_text3))\n , ((Pbd, ''Text5''), (KnownT Pbd_text3))\n , ((A, ''Text6''), (KnownT A_text4))\n , ((Abd, ''Text6''), (KnownT Abd_text4))\n , ((B, ''Text6''), (KnownT B_4))\n , ((Bbd, ''Text6''), (KnownT Bbd_4))\n , ((A, ''Text7''), (KnownT A_text4))\n , ((Abd, ''Text7''), (KnownT Abd_text4))\n , ((B, ''Text7''), (KnownT B_4))\n , ((Bbd, ''Text7''), (KnownT Bbd_4))\n , ((A, ''Text8''), (KnownT A_5))\n , ((Abd, ''Text8''), (KnownT Abd_5))\n , ((B, ''Text8''), (KnownT B_text5))\n , ((Bbd, ''Text8''), (KnownT Bbd_text5))\n , ((A, ''Text9''), (KnownT A_5))\n , ((Abd, ''Text9''), (KnownT Abd_5))\n , ((B, ''Text9''), (KnownT B_text5))\n , ((Bbd, ''Text9''), (KnownT Bbd_text5))\n , ((A, ''TokenPA_for_B''), (KnownT A_3))\n , ((Abd, ''TokenPA_for_B''), (KnownT Abd_3))\n ]\"\n\nsublocale isoiec_9798_2_6_state < typing_2_6_state\nproof -\n have \"(t,r,s) : approx typing_2_6\"\n proof(cases rule: reachable_in_approxI_ext\n [OF typing_2_6.monoTyp, completeness_cases_rule])\n case (A_1_B t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_1_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_1_Rb t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_1_Rb\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_1_Text1 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_1_Text1\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_3_Kab t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_3_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_1'', LN ''Ra'' tid0,\n s(MV ''Kab'' tid0), s(MV ''B'' tid0), s(MV ''Text4'' tid0)\n |}\n ( K ( s(AV ''A'' tid0) ) ( s(AV ''P'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (A_3_Text4 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_3_Text4\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_1'', LN ''Ra'' tid0,\n s(MV ''Kab'' tid0), s(MV ''B'' tid0), s(MV ''Text4'' tid0)\n |}\n ( K ( s(AV ''A'' tid0) ) ( s(AV ''P'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (A_3_Text5 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_3_Text5\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_3_TokenPA_for_B t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_3_TokenPA_for_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_text4_Text6 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_text4_Text6\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_text4_Text7 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_text4_Text7\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_5_Text8 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_5_Text8\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_5'', s(MV ''Rb'' tid0), LN ''Rpa'' tid0,\n s(MV ''Text8'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (A_5_Text9 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_5_Text9\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_1_Bbd t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_1_Bbd\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_1_Rb t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_1_Rb\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_1_Text1 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_1_Text1\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_3_Kab t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_3_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_1'', LN ''Ra'' tid0,\n s(MV ''Kab'' tid0), s(AV ''Abd'' tid0), s(MV ''Bbd'' tid0),\n s(MV ''Text4'' tid0)\n |}\n ( Kbd ( s(AV ''Abd'' tid0) ) ( s(AV ''Pbd'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Abd_3_Text4 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_3_Text4\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_1'', LN ''Ra'' tid0,\n s(MV ''Kab'' tid0), s(AV ''Abd'' tid0), s(MV ''Bbd'' tid0),\n s(MV ''Text4'' tid0)\n |}\n ( Kbd ( s(AV ''Abd'' tid0) ) ( s(AV ''Pbd'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Abd_3_Text5 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_3_Text5\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_3_TokenPA_for_B t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_3_TokenPA_for_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_text4_Text6 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_text4_Text6\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_text4_Text7 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_text4_Text7\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Abd_5_Text8 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_5_Text8\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_5'', s(MV ''Rb'' tid0), LN ''Rpa'' tid0,\n s(MV ''Text8'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Abd_5_Text9 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Abd_5_Text9\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_4_Kab t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_2'', LN ''Rb'' tid0,\n s(MV ''Kab'' tid0), s(AV ''A'' tid0), s(MV ''Text3'' tid0)\n |}\n ( K ( s(AV ''B'' tid0) ) ( s(MV ''P'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_4_P t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_P\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_4_Rpa t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_Rpa\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_4'', s(MV ''Rpa'' tid0), LN ''Rb'' tid0,\n s(MV ''Text6'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_4_Text3 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_Text3\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_2'', LN ''Rb'' tid0,\n s(MV ''Kab'' tid0), s(AV ''A'' tid0), s(MV ''Text3'' tid0)\n |}\n ( K ( s(AV ''B'' tid0) ) ( s(MV ''P'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_4_Text6 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_Text6\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_4'', s(MV ''Rpa'' tid0), LN ''Rb'' tid0,\n s(MV ''Text6'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_4_Text7 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_4_Text7\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_text5_Text8 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_text5_Text8\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_text5_Text9 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_text5_Text9\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Bbd_4_Kab t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_2'', LN ''Rb'' tid0,\n s(MV ''Kab'' tid0), s(AV ''Abd'' tid0), s(AV ''Bbd'' tid0),\n s(MV ''Text3'' tid0)\n |}\n ( Kbd ( s(AV ''Bbd'' tid0) ) ( s(MV ''Pbd'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Bbd_4_Pbd t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Pbd\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Bbd_4_Rpa t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Rpa\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_4'', s(MV ''Rpa'' tid0), LN ''Rb'' tid0,\n s(MV ''Text6'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Bbd_4_Text3 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Text3\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_3_2'', LN ''Rb'' tid0,\n s(MV ''Kab'' tid0), s(AV ''Abd'' tid0), s(AV ''Bbd'' tid0),\n s(MV ''Text3'' tid0)\n |}\n ( Kbd ( s(AV ''Bbd'' tid0) ) ( s(MV ''Pbd'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Bbd_4_Text6 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Text6\n thus ?case\n proof(sources! \"\n Enc {| LC ''isoiec_9798_2_6_enc_4'', s(MV ''Rpa'' tid0), LN ''Rb'' tid0,\n s(MV ''Text6'' tid0)\n |}\n ( s(MV ''Kab'' tid0) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (Bbd_4_Text7 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_4_Text7\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Bbd_text5_Text8 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_text5_Text8\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Bbd_text5_Text9 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Bbd_text5_Text9\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_2_A t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_2_A\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_2_B t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_2_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_2_Ra t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_2_Ra\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_2_Rb t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_2_Rb\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_2_Text2 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_2_Text2\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_text3_Text3 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_text3_Text3\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_text3_Text4 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_text3_Text4\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_text3_Text5 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = P_text3_Text5\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_2_Abd t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_2_Abd\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_2_Bbd t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_2_Bbd\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_2_Ra t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_2_Ra\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_2_Rb t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_2_Rb\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_2_Text2 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_2_Text2\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_text3_Text3 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_text3_Text3\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_text3_Text4 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_text3_Text4\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (Pbd_text3_Text5 t r s tid0)\n then interpret state: typing_2_6_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = Pbd_text3_Text5\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n qed\n thus \"typing_2_6_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext isoiec_9798_2_6_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/iso9798/isabelle-proofs/isoiec-9798_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.2955139749472743}} {"text": "(* Title: Misc_CryptHOL.thy\n Author: Andreas Lochbihler, ETH Zurich *)\n\nsection \\Miscellaneous library additions\\\n\ntheory Misc_CryptHOL imports \n Probabilistic_While.While_SPMF\n \"HOL-Library.Rewrite\"\n \"HOL-Library.Simps_Case_Conv\"\n \"HOL-Library.Type_Length\"\n \"HOL-Eisbach.Eisbach\"\n Coinductive.TLList\n Monad_Normalisation.Monad_Normalisation\n Monomorphic_Monad.Monomorphic_Monad\n Applicative_Lifting.Applicative\nbegin\n\nhide_const (open) Henstock_Kurzweil_Integration.negligible\n\ndeclare eq_on_def [simp del]\n\nsubsection \\HOL\\\n\nlemma asm_rl_conv: \"(PROP P \\ PROP P) \\ Trueprop True\"\nby(rule equal_intr_rule) iprover+\n\nnamed_theorems if_distribs \"Distributivity theorems for If\"\n\nlemma if_mono_cong: \"\\b \\ x \\ x'; \\ b \\ y \\ y' \\ \\ If b x y \\ If b x' y'\"\nby simp\n\n\n\nlemma if_False_eq: \"\\ b \\ False; e = e' \\ \\ If b t e = e'\"\nby auto\n\nlemma imp_OO_imp [simp]: \"(\\) OO (\\) = (\\)\"\nby auto\n\nlemma inj_on_fun_updD: \"\\ inj_on (f(x := y)) A; x \\ A \\ \\ inj_on f A\"\nby(auto simp add: inj_on_def split: if_split_asm)\n\nlemma disjoint_notin1: \"\\ A \\ B = {}; x \\ B \\ \\ x \\ A\" by auto\n\nlemma Least_le_Least:\n fixes x :: \"'a :: wellorder\"\n assumes \"Q x\"\n and Q: \"\\x. Q x \\ \\y\\x. P y\"\n shows \"Least P \\ Least Q\"\nproof -\n obtain f :: \"'a \\ 'a\" where \"\\a. \\ Q a \\ f a \\ a \\ P (f a)\" using Q by moura\n moreover have \"Q (Least Q)\" using \\Q x\\ by(rule LeastI)\n ultimately show ?thesis by (metis (full_types) le_cases le_less less_le_trans not_less_Least)\nqed\n\nlemma is_empty_image [simp]: \"Set.is_empty (f ` A) = Set.is_empty A\"\n by(auto simp add: Set.is_empty_def)\n\nsubsection \\Relations\\\n\ninductive Imagep :: \"('a \\ 'b \\ bool) \\ ('a \\ bool) \\ 'b \\ bool\"\n for R P\nwhere ImagepI: \"\\ P x; R x y \\ \\ Imagep R P y\"\n\nlemma r_r_into_tranclp: \"\\ r x y; r y z \\ \\ r^++ x z\"\nby(rule tranclp.trancl_into_trancl)(rule tranclp.r_into_trancl)\n\nlemma transp_tranclp_id:\n assumes \"transp R\"\n shows \"tranclp R = R\"\nproof(intro ext iffI)\n fix x y\n assume \"R^++ x y\"\n thus \"R x y\" by induction(blast dest: transpD[OF assms])+\nqed simp\n\nlemma transp_inv_image: \"transp r \\ transp (\\x y. r (f x) (f y))\"\nusing trans_inv_image[where r=\"{(x, y). r x y}\" and f = f]\nby(simp add: transp_trans inv_image_def)\n\nlemma Domainp_conversep: \"Domainp R\\\\ = Rangep R\"\nby(auto)\n\nlemma bi_unique_rel_set_bij_betw:\n assumes unique: \"bi_unique R\"\n and rel: \"rel_set R A B\"\n shows \"\\f. bij_betw f A B \\ (\\x\\A. R x (f x))\"\nproof -\n from assms obtain f where f: \"\\x. x \\ A \\ R x (f x)\" and B: \"\\x. x \\ A \\ f x \\ B\"\n apply(atomize_elim)\n apply(fold all_conj_distrib)\n apply(subst choice_iff[symmetric])\n apply(auto dest: rel_setD1)\n done\n have \"inj_on f A\" by(rule inj_onI)(auto dest!: f dest: bi_uniqueDl[OF unique])\n moreover have \"f ` A = B\" using rel\n by(auto 4 3 intro: B dest: rel_setD2 f bi_uniqueDr[OF unique])\n ultimately have \"bij_betw f A B\" unfolding bij_betw_def ..\n thus ?thesis using f by blast\nqed\n\ndefinition restrict_relp :: \"('a \\ 'b \\ bool) \\ ('a \\ bool) \\ ('b \\ bool) \\ 'a \\ 'b \\ bool\"\n (\"_ \\ (_ \\ _)\" [53, 54, 54] 53)\nwhere \"restrict_relp R P Q = (\\x y. R x y \\ P x \\ Q y)\"\n\nlemma restrict_relp_apply [simp]: \"(R \\ P \\ Q) x y \\ R x y \\ P x \\ Q y\"\nby(simp add: restrict_relp_def)\n\nlemma restrict_relpI [intro?]: \"\\ R x y; P x; Q y \\ \\ (R \\ P \\ Q) x y\"\nby(simp add: restrict_relp_def)\n\nlemma restrict_relpE [elim?, cases pred]:\n assumes \"(R \\ P \\ Q) x y\"\n obtains (restrict_relp) \"R x y\" \"P x\" \"Q y\"\nusing assms by(simp add: restrict_relp_def)\n\nlemma conversep_restrict_relp [simp]: \"(R \\ P \\ Q)\\\\ = R\\\\ \\ Q \\ P\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_restrict_relp [simp]: \"R \\ P \\ Q \\ P' \\ Q' = R \\ inf P P' \\ inf Q Q'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_cong:\n \"\\ P = P'; Q = Q'; \\x y. \\ P x; Q y \\ \\ R x y = R' x y \\ \\ R \\ P \\ Q = R' \\ P' \\ Q'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_cong_simp:\n \"\\ P = P'; Q = Q'; \\x y. P x =simp=> Q y =simp=> R x y = R' x y \\ \\ R \\ P \\ Q = R' \\ P' \\ Q'\"\nby(rule restrict_relp_cong; simp add: simp_implies_def)\n\nlemma restrict_relp_parametric [transfer_rule]:\n includes lifting_syntax shows\n \"((A ===> B ===> (=)) ===> (A ===> (=)) ===> (B ===> (=)) ===> A ===> B ===> (=)) restrict_relp restrict_relp\"\nunfolding restrict_relp_def[abs_def] by transfer_prover\n\nlemma restrict_relp_mono: \"\\ R \\ R'; P \\ P'; Q \\ Q' \\ \\ R \\ P \\ Q \\ R' \\ P' \\ Q'\"\nby(simp add: le_fun_def)\n\nlemma restrict_relp_mono': \n \"\\ (R \\ P \\ Q) x y; \\ R x y; P x; Q y \\ \\ R' x y &&& P' x &&& Q' y \\\n \\ (R' \\ P' \\ Q') x y\"\nby(auto dest: conjunctionD1 conjunctionD2)\n\nlemma restrict_relp_DomainpD: \"Domainp (R \\ P \\ Q) x \\ Domainp R x \\ P x\"\nby(auto simp add: Domainp.simps)\n\nlemma restrict_relp_True: \"R \\ (\\_. True) \\ (\\_. True) = R\"\nby(simp add: fun_eq_iff)\n\nlemma restrict_relp_False1: \"R \\ (\\_. False) \\ Q = bot\"\nby(simp add: fun_eq_iff)\n\nlemma restrict_relp_False2: \"R \\ P \\ (\\_. False) = bot\"\nby(simp add: fun_eq_iff)\n\ndefinition rel_prod2 :: \"('a \\ 'b \\ bool) \\ 'a \\ ('c \\ 'b) \\ bool\"\nwhere \"rel_prod2 R a = (\\(c, b). R a b)\"\n\nlemma rel_prod2_simps [simp]: \"rel_prod2 R a (c, b) \\ R a b\"\nby(simp add: rel_prod2_def)\n\nlemma restrict_rel_prod:\n \"rel_prod (R \\ I1 \\ I2) (S \\ I1' \\ I2') = rel_prod R S \\ pred_prod I1 I1' \\ pred_prod I2 I2'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_rel_prod1:\n \"rel_prod (R \\ I1 \\ I2) S = rel_prod R S \\ pred_prod I1 (\\_. True) \\ pred_prod I2 (\\_. True)\"\nby(simp add: restrict_rel_prod[symmetric] restrict_relp_True)\n\nlemma restrict_rel_prod2:\n \"rel_prod R (S \\ I1 \\ I2) = rel_prod R S \\ pred_prod (\\_. True) I1 \\ pred_prod (\\_. True) I2\"\nby(simp add: restrict_rel_prod[symmetric] restrict_relp_True)\n\nconsts relcompp_witness :: \"('a \\ 'b \\ bool) \\ ('b \\ 'c \\ bool) \\ 'a \\ 'c \\ 'b\"\nspecification (relcompp_witness)\n relcompp_witness1: \"(A OO B) (fst xy) (snd xy) \\ A (fst xy) (relcompp_witness A B xy)\"\n relcompp_witness2: \"(A OO B) (fst xy) (snd xy) \\ B (relcompp_witness A B xy) (snd xy)\"\n apply(fold all_conj_distrib)\n apply(rule choice allI)+\n by(auto intro: choice allI)\n\nlemmas relcompp_witness[of _ _ \"(x, y)\" for x y, simplified] = relcompp_witness1 relcompp_witness2\n\nhide_fact (open) relcompp_witness1 relcompp_witness2\n\nlemma relcompp_witness_eq [simp]: \"relcompp_witness (=) (=) (x, x) = x\"\n using relcompp_witness(1)[of \"(=)\" \"(=)\" x x] by(simp add: eq_OO)\n\nsubsection \\Pairs\\\n\nlemma split_apfst [simp]: \"case_prod h (apfst f xy) = case_prod (h \\ f) xy\"\nby(cases xy) simp\n\ndefinition corec_prod :: \"('s \\ 'a) \\ ('s \\ 'b) \\ 's \\ 'a \\ 'b\"\nwhere \"corec_prod f g = (\\s. (f s, g s))\"\n\nlemma corec_prod_apply: \"corec_prod f g s = (f s, g s)\"\nby(simp add: corec_prod_def)\n\nlemma corec_prod_sel [simp]:\n shows fst_corec_prod: \"fst (corec_prod f g s) = f s\"\n and snd_corec_prod: \"snd (corec_prod f g s) = g s\"\nby(simp_all add: corec_prod_apply)\n\nlemma apfst_corec_prod [simp]: \"apfst h (corec_prod f g s) = corec_prod (h \\ f) g s\"\nby(simp add: corec_prod_apply)\n\nlemma apsnd_corec_prod [simp]: \"apsnd h (corec_prod f g s) = corec_prod f (h \\ g) s\"\nby(simp add: corec_prod_apply)\n\nlemma map_corec_prod [simp]: \"map_prod f g (corec_prod h k s) = corec_prod (f \\ h) (g \\ k) s\"\nby(simp add: corec_prod_apply)\n\nlemma split_corec_prod [simp]: \"case_prod h (corec_prod f g s) = h (f s) (g s)\"\nby(simp add: corec_prod_apply)\n\nlemma Pair_fst_Unity: \"(fst x, ()) = x\"\n by(cases x) simp\n\ndefinition rprodl :: \"('a \\ 'b) \\ 'c \\ 'a \\ ('b \\ 'c)\" where \"rprodl = (\\((a, b), c). (a, (b, c)))\"\n\nlemma rprodl_simps [simp]: \"rprodl ((a, b), c) = (a, (b, c))\"\n by(simp add: rprodl_def)\n\nlemma rprodl_parametric [transfer_rule]: includes lifting_syntax shows\n \"(rel_prod (rel_prod A B) C ===> rel_prod A (rel_prod B C)) rprodl rprodl\"\n unfolding rprodl_def by transfer_prover\n\ndefinition lprodr :: \"'a \\ ('b \\ 'c) \\ ('a \\ 'b) \\ 'c\" where \"lprodr = (\\(a, b, c). ((a, b), c))\"\n\nlemma lprodr_simps [simp]: \"lprodr (a, b, c) = ((a, b), c)\"\n by(simp add: lprodr_def)\n\nlemma lprodr_parametric [transfer_rule]: includes lifting_syntax shows\n \"(rel_prod A (rel_prod B C) ===> rel_prod (rel_prod A B) C) lprodr lprodr\"\n unfolding lprodr_def by transfer_prover\n\nlemma lprodr_inverse [simp]: \"rprodl (lprodr x) = x\"\n by(cases x) auto\n\nlemma rprodl_inverse [simp]: \"lprodr (rprodl x) = x\"\n by(cases x) auto\n\nlemma pred_prod_mono' [mono]:\n \"pred_prod A B xy \\ pred_prod A' B' xy\"\n if \"\\x. A x \\ A' x\" \"\\y. B y \\ B' y\"\n using that by(cases xy) auto\n\nfun rel_witness_prod :: \"('a \\ 'b) \\ ('c \\ 'd) \\ (('a \\ 'c) \\ ('b \\ 'd))\" where\n \"rel_witness_prod ((a, b), (c, d)) = ((a, c), (b, d))\"\n\nsubsection \\Sums\\\n\nlemma islE:\n assumes \"isl x\"\n obtains l where \"x = Inl l\"\nusing assms by(cases x) auto\n\nlemma Inl_in_Plus [simp]: \"Inl x \\ A <+> B \\ x \\ A\"\nby auto\n\nlemma Inr_in_Plus [simp]: \"Inr x \\ A <+> B \\ x \\ B\"\nby auto\n\nlemma Inl_eq_map_sum_iff: \"Inl x = map_sum f g y \\ (\\z. y = Inl z \\ x = f z)\"\nby(cases y) auto\n\nlemma Inr_eq_map_sum_iff: \"Inr x = map_sum f g y \\ (\\z. y = Inr z \\ x = g z)\"\nby(cases y) auto\n\nlemma inj_on_map_sum [simp]:\n \"\\ inj_on f A; inj_on g B \\ \\ inj_on (map_sum f g) (A <+> B)\"\nproof(rule inj_onI, goal_cases)\n case (1 x y)\n then show ?case by(cases x; cases y; auto simp add: inj_on_def)\nqed\n\nlemma inv_into_map_sum:\n \"inv_into (A <+> B) (map_sum f g) x = map_sum (inv_into A f) (inv_into B g) x\"\n if \"x \\ f ` A <+> g ` B\" \"inj_on f A\" \"inj_on g B\"\n using that by(cases rule: PlusE[consumes 1])(auto simp add: inv_into_f_eq f_inv_into_f)\n\nfun rsuml :: \"('a + 'b) + 'c \\ 'a + ('b + 'c)\" where\n \"rsuml (Inl (Inl a)) = Inl a\"\n| \"rsuml (Inl (Inr b)) = Inr (Inl b)\"\n| \"rsuml (Inr c) = Inr (Inr c)\"\n\nfun lsumr :: \"'a + ('b + 'c) \\ ('a + 'b) + 'c\" where\n \"lsumr (Inl a) = Inl (Inl a)\"\n| \"lsumr (Inr (Inl b)) = Inl (Inr b)\"\n| \"lsumr (Inr (Inr c)) = Inr c\"\n\nlemma rsuml_lsumr [simp]: \"rsuml (lsumr x) = x\"\n by(cases x rule: lsumr.cases) simp_all\n\nlemma lsumr_rsuml [simp]: \"lsumr (rsuml x) = x\"\n by(cases x rule: rsuml.cases) simp_all\n\nsubsection \\Option\\\n\ndeclare is_none_bind [simp]\n\nlemma case_option_collapse: \"case_option x (\\_. x) y = x\"\nby(simp split: option.split)\n\nlemma indicator_single_Some: \"indicator {Some x} (Some y) = indicator {x} y\"\nby(simp split: split_indicator)\n\nsubsubsection \\Predicator and relator\\\n\nlemma option_pred_mono_strong:\n \"\\ pred_option P x; \\a. \\ a \\ set_option x; P a \\ \\ P' a \\ \\ pred_option P' x\"\nby(fact option.pred_mono_strong)\n\nlemma option_pred_map [simp]: \"pred_option P (map_option f x) = pred_option (P \\ f) x\"\nby(fact option.pred_map)\n\nlemma option_pred_o_map [simp]: \"pred_option P \\ map_option f = pred_option (P \\ f)\"\nby(simp add: fun_eq_iff)\n\nlemma option_pred_bind [simp]: \"pred_option P (Option.bind x f) = pred_option (pred_option P \\ f) x\"\nby(simp add: pred_option_def)\n\nlemma pred_option_conj [simp]:\n \"pred_option (\\x. P x \\ Q x) = (\\x. pred_option P x \\ pred_option Q x)\"\nby(auto simp add: pred_option_def)\n\nlemma pred_option_top [simp]:\n \"pred_option (\\_. True) = (\\_. True)\"\nby(fact option.pred_True)\n\nlemma rel_option_restrict_relpI [intro?]:\n \"\\ rel_option R x y; pred_option P x; pred_option Q y \\ \\ rel_option (R \\ P \\ Q) x y\"\nby(erule option.rel_mono_strong) simp\n\nlemma rel_option_restrict_relpE [elim?]:\n assumes \"rel_option (R \\ P \\ Q) x y\"\n obtains \"rel_option R x y\" \"pred_option P x\" \"pred_option Q y\"\nproof\n show \"rel_option R x y\" using assms by(auto elim!: option.rel_mono_strong)\n have \"pred_option (Domainp (R \\ P \\ Q)) x\" using assms by(fold option.Domainp_rel) blast\n then show \"pred_option P x\" by(rule option_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n have \"pred_option (Domainp (R \\ P \\ Q)\\\\) y\" using assms\n by(fold option.Domainp_rel)(auto simp only: option.rel_conversep Domainp_conversep)\n then show \"pred_option Q y\" by(rule option_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_option_restrict_relp_iff:\n \"rel_option (R \\ P \\ Q) x y \\ rel_option R x y \\ pred_option P x \\ pred_option Q y\"\nby(blast intro: rel_option_restrict_relpI elim: rel_option_restrict_relpE)\n\nlemma option_rel_map_restrict_relp:\n shows option_rel_map_restrict_relp1:\n \"rel_option (R \\ P \\ Q) (map_option f x) = rel_option (R \\ f \\ P \\ f \\ Q) x\"\n and option_rel_map_restrict_relp2:\n \"rel_option (R \\ P \\ Q) x (map_option g y) = rel_option ((\\x. R x \\ g) \\ P \\ Q \\ g) x y\"\nby(simp_all add: option.rel_map restrict_relp_def fun_eq_iff)\n\nfun rel_witness_option :: \"'a option \\ 'b option \\ ('a \\ 'b) option\" where\n \"rel_witness_option (Some x, Some y) = Some (x, y)\"\n| \"rel_witness_option (None, None) = None\"\n| \"rel_witness_option _ = None\" \\ \\Just to make the definition complete\\\n\nlemma rel_witness_option:\n shows set_rel_witness_option: \"\\ rel_option A x y; (a, b) \\ set_option (rel_witness_option (x, y)) \\ \\ A a b\"\n and map1_rel_witness_option: \"rel_option A x y \\ map_option fst (rel_witness_option (x, y)) = x\"\n and map2_rel_witness_option: \"rel_option A x y \\ map_option snd (rel_witness_option (x, y)) = y\"\n by(cases \"(x, y)\" rule: rel_witness_option.cases; simp; fail)+\n\nlemma rel_witness_option1:\n assumes \"rel_option A x y\"\n shows \"rel_option (\\a (a', b). a = a' \\ A a' b) x (rel_witness_option (x, y))\"\n using map1_rel_witness_option[OF assms, symmetric]\n unfolding option.rel_eq[symmetric] option.rel_map\n by(rule option.rel_mono_strong)(auto intro: set_rel_witness_option[OF assms])\n\nlemma rel_witness_option2:\n assumes \"rel_option A x y\"\n shows \"rel_option (\\(a, b') b. b = b' \\ A a b') (rel_witness_option (x, y)) y\"\n using map2_rel_witness_option[OF assms]\n unfolding option.rel_eq[symmetric] option.rel_map\n by(rule option.rel_mono_strong)(auto intro: set_rel_witness_option[OF assms])\n\nsubsubsection \\Orders on option\\\n\nabbreviation le_option :: \"'a option \\ 'a option \\ bool\"\nwhere \"le_option \\ ord_option (=)\"\n\nlemma le_option_bind_mono:\n \"\\ le_option x y; \\a. a \\ set_option x \\ le_option (f a) (g a) \\\n \\ le_option (Option.bind x f) (Option.bind y g)\"\nby(cases x) simp_all\n\nlemma le_option_refl [simp]: \"le_option x x\"\nby(cases x) simp_all\n\n\nlemma le_option_conv_option_ord: \"le_option = option_ord\"\nby(auto simp add: fun_eq_iff flat_ord_def elim: ord_option.cases)\n\ndefinition pcr_Some :: \"('a \\ 'b \\ bool) \\ 'a \\ 'b option \\ bool\"\nwhere \"pcr_Some R x y \\ (\\z. y = Some z \\ R x z)\"\n\nlemma pcr_Some_simps [simp]: \"pcr_Some R x (Some y) \\ R x y\"\nby(simp add: pcr_Some_def)\n\nlemma pcr_SomeE [cases pred]:\n assumes \"pcr_Some R x y\"\n obtains (pcr_Some) z where \"y = Some z\" \"R x z\"\nusing assms by(auto simp add: pcr_Some_def)\n\nsubsubsection \\Filter for option\\\n\nfun filter_option :: \"('a \\ bool) \\ 'a option \\ 'a option\"\nwhere\n \"filter_option P None = None\"\n| \"filter_option P (Some x) = (if P x then Some x else None)\"\n\nlemma set_filter_option [simp]: \"set_option (filter_option P x) = {y \\ set_option x. P y}\"\nby(cases x) auto\n\nlemma filter_map_option: \"filter_option P (map_option f x) = map_option f (filter_option (P \\ f) x)\"\nby(cases x) simp_all\n\nlemma is_none_filter_option [simp]: \"Option.is_none (filter_option P x) \\ Option.is_none x \\ \\ P (the x)\"\nby(cases x) simp_all\n\nlemma filter_option_eq_Some_iff [simp]: \"filter_option P x = Some y \\ x = Some y \\ P y\"\nby(cases x) auto\n\nlemma Some_eq_filter_option_iff [simp]: \"Some y = filter_option P x \\ x = Some y \\ P y\"\nby(cases x) auto\n\nlemma filter_conv_bind_option: \"filter_option P x = Option.bind x (\\y. if P y then Some y else None)\"\nby(cases x) simp_all\n\nsubsubsection \\Assert for option\\\n\nprimrec assert_option :: \"bool \\ unit option\" where\n \"assert_option True = Some ()\"\n| \"assert_option False = None\"\n\nlemma set_assert_option_conv: \"set_option (assert_option b) = (if b then {()} else {})\"\nby(simp)\n\nlemma in_set_assert_option [simp]: \"x \\ set_option (assert_option b) \\ b\"\nby(cases b) simp_all\n\n\nsubsubsection \\Join on options\\\n\ndefinition join_option :: \"'a option option \\ 'a option\"\nwhere \"join_option x = (case x of Some y \\ y | None \\ None)\"\n\nsimps_of_case join_simps [simp, code]: join_option_def\n\nlemma set_join_option [simp]: \"set_option (join_option x) = \\(set_option ` set_option x)\"\nby(cases x)(simp_all)\n\nlemma in_set_join_option: \"x \\ set_option (join_option (Some (Some x)))\"\nby simp\n\nlemma map_join_option: \"map_option f (join_option x) = join_option (map_option (map_option f) x)\"\nby(cases x) simp_all\n\nlemma bind_conv_join_option: \"Option.bind x f = join_option (map_option f x)\"\nby(cases x) simp_all\n\nlemma join_conv_bind_option: \"join_option x = Option.bind x id\"\nby(cases x) simp_all\n\nlemma join_option_parametric [transfer_rule]:\n includes lifting_syntax shows\n \"(rel_option (rel_option R) ===> rel_option R) join_option join_option\"\nunfolding join_conv_bind_option[abs_def] by transfer_prover\n\nlemma join_option_eq_Some [simp]: \"join_option x = Some y \\ x = Some (Some y)\"\nby(cases x) simp_all\n\nlemma Some_eq_join_option [simp]: \"Some y = join_option x \\ x = Some (Some y)\"\nby(cases x) auto\n\nlemma join_option_eq_None: \"join_option x = None \\ x = None \\ x = Some None\"\nby(cases x) simp_all\n\nlemma None_eq_join_option: \"None = join_option x \\ x = None \\ x = Some None\"\nby(cases x) auto\n\nsubsubsection \\Zip on options\\\n\nfunction zip_option :: \"'a option \\ 'b option \\ ('a \\ 'b) option\"\nwhere\n \"zip_option (Some x) (Some y) = Some (x, y)\"\n| \"zip_option _ None = None\"\n| \"zip_option None _ = None\"\nby pat_completeness auto\ntermination by lexicographic_order\n\nlemma zip_option_eq_Some_iff [iff]:\n \"zip_option x y = Some (a, b) \\ x = Some a \\ y = Some b\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma set_zip_option [simp]:\n \"set_option (zip_option x y) = set_option x \\ set_option y\"\nby auto\n\nlemma zip_map_option1: \"zip_option (map_option f x) y = map_option (apfst f) (zip_option x y)\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma zip_map_option2: \"zip_option x (map_option g y) = map_option (apsnd g) (zip_option x y)\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma map_zip_option:\n \"map_option (map_prod f g) (zip_option x y) = zip_option (map_option f x) (map_option g y)\"\nby(simp add: zip_map_option1 zip_map_option2 option.map_comp apfst_def apsnd_def o_def prod.map_comp)\n\nlemma zip_conv_bind_option:\n \"zip_option x y = Option.bind x (\\x. Option.bind y (\\y. Some (x, y)))\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma zip_option_parametric [transfer_rule]:\n includes lifting_syntax shows\n \"(rel_option R ===> rel_option Q ===> rel_option (rel_prod R Q)) zip_option zip_option\"\nunfolding zip_conv_bind_option[abs_def] by transfer_prover\n\nlemma rel_option_eqI [simp]: \"rel_option (=) x x\"\nby(simp add: option.rel_eq)\n\nsubsubsection \\Binary supremum on @{typ \"'a option\"}\\\n\nprimrec sup_option :: \"'a option \\ 'a option \\ 'a option\"\nwhere\n \"sup_option x None = x\"\n| \"sup_option x (Some y) = (Some y)\"\n\nlemma sup_option_idem [simp]: \"sup_option x x = x\"\nby(cases x) simp_all\n\nlemma sup_option_assoc: \"sup_option (sup_option x y) z = sup_option x (sup_option y z)\"\nby(cases z) simp_all\n\nlemma sup_option_left_idem: \"sup_option x (sup_option x y) = sup_option x y\"\nby(rewrite sup_option_assoc[symmetric])(simp)\n\nlemmas sup_option_ai = sup_option_assoc sup_option_left_idem\n\nlemma sup_option_None [simp]: \"sup_option None y = y\"\nby(cases y) simp_all\n\nsubsubsection \\Restriction on @{typ \"'a option\"}\\\n\nprimrec (transfer) enforce_option :: \"('a \\ bool) \\ 'a option \\ 'a option\" where\n \"enforce_option P (Some x) = (if P x then Some x else None)\"\n| \"enforce_option P None = None\"\n\nlemma set_enforce_option [simp]: \"set_option (enforce_option P x) = {a \\ set_option x. P a}\"\n by(cases x) auto\n\nlemma enforce_map_option: \"enforce_option P (map_option f x) = map_option f (enforce_option (P \\ f) x)\"\n by(cases x) auto\n\nlemma enforce_bind_option [simp]:\n \"enforce_option P (Option.bind x f) = Option.bind x (enforce_option P \\ f)\"\n by(cases x) auto\n\nlemma enforce_option_alt_def:\n \"enforce_option P x = Option.bind x (\\a. Option.bind (assert_option (P a)) (\\_ :: unit. Some a))\"\n by(cases x) simp_all\n\nlemma enforce_option_eq_None_iff [simp]:\n \"enforce_option P x = None \\ (\\a. x = Some a \\ \\ P a)\"\n by(cases x) auto\n\nlemma enforce_option_eq_Some_iff [simp]:\n \"enforce_option P x = Some y \\ x = Some y \\ P y\"\n by(cases x) auto\n\nlemma Some_eq_enforce_option_iff [simp]:\n \"Some y = enforce_option P x \\ x = Some y \\ P y\"\n by(cases x) auto\n\nlemma enforce_option_top [simp]: \"enforce_option \\ = id\"\n by(rule ext; rename_tac x; case_tac x; simp)\n\nlemma enforce_option_K_True [simp]: \"enforce_option (\\_. True) x = x\"\n by(cases x) simp_all\n\nlemma enforce_option_bot [simp]: \"enforce_option \\ = (\\_. None)\"\n by(simp add: fun_eq_iff)\n\nlemma enforce_option_K_False [simp]: \"enforce_option (\\_. False) x = None\"\n by simp\n\nlemma enforce_pred_id_option: \"pred_option P x \\ enforce_option P x = x\"\n by(cases x) auto\n\nsubsubsection \\Maps\\\n\nlemma map_add_apply: \"(m1 ++ m2) x = sup_option (m1 x) (m2 x)\"\nby(simp add: map_add_def split: option.split)\n\nlemma map_le_map_upd2: \"\\ f \\\\<^sub>m g; \\y'. f x = Some y' \\ y' = y \\ \\ f \\\\<^sub>m g(x \\ y)\"\nby(cases \"x \\ dom f\")(auto simp add: map_le_def Ball_def)\n\nlemma eq_None_iff_not_dom: \"f x = None \\ x \\ dom f\"\nby auto\n\nlemma card_ran_le_dom: \"finite (dom m) \\ card (ran m) \\ card (dom m)\"\nby(simp add: ran_alt_def card_image_le)\n\nlemma dom_subset_ran_iff:\n assumes \"finite (ran m)\"\n shows \"dom m \\ ran m \\ dom m = ran m\"\nproof\n assume le: \"dom m \\ ran m\"\n then have \"card (dom m) \\ card (ran m)\" by(simp add: card_mono assms)\n moreover have \"card (ran m) \\ card (dom m)\" by(simp add: finite_subset[OF le assms] card_ran_le_dom)\n ultimately show \"dom m = ran m\" using card_subset_eq[OF assms le] by simp\nqed simp\n\ntext \\\n We need a polymorphic constant for the empty map such that \\transfer_prover\\\n can use a custom transfer rule for @{const Map.empty}\n\\\ndefinition Map_empty where [simp]: \"Map_empty \\ Map.empty\"\n\n\n\nlemma map_le_fun_upd2: \"\\ f \\\\<^sub>m g; x \\ dom f \\ \\ f \\\\<^sub>m g(x := y)\"\nby(auto simp add: map_le_def)\n\nlemma map_eqI: \"\\x\\dom m \\ dom m'. m x = m' x \\ m = m'\"\nby(auto simp add: fun_eq_iff domIff intro: option.expand)\n\n\nsubsection \\Countable\\\n\nlemma countable_lfp:\n assumes step: \"\\Y. countable Y \\ countable (F Y)\"\n and cont: \"Order_Continuity.sup_continuous F\"\n shows \"countable (lfp F)\"\nby(subst sup_continuous_lfp[OF cont])(simp add: countable_funpow[OF step])\n\nlemma countable_lfp_apply:\n assumes step: \"\\Y x. (\\x. countable (Y x)) \\ countable (F Y x)\"\n and cont: \"Order_Continuity.sup_continuous F\"\n shows \"countable (lfp F x)\"\nproof -\n { fix n\n have \"\\x. countable ((F ^^ n) bot x)\"\n by(induct n)(auto intro: step) }\n thus ?thesis using cont by(simp add: sup_continuous_lfp)\nqed\n\n\nsubsection \\ Extended naturals \\\n\nlemma idiff_enat_eq_enat_iff: \"x - enat n = enat m \\ (\\k. x = enat k \\ k - n = m)\"\n by (cases x) simp_all\n\nlemma eSuc_SUP: \"A \\ {} \\ eSuc (\\ (f ` A)) = (\\x\\A. eSuc (f x))\"\n by (subst eSuc_Sup) (simp_all add: image_comp)\n\nlemma ereal_of_enat_1: \"ereal_of_enat 1 = ereal 1\"\n by (simp add: one_enat_def)\n\nlemma ennreal_real_conv_ennreal_of_enat: \"ennreal (real n) = ennreal_of_enat n\"\n by (simp add: ennreal_of_nat_eq_real_of_nat)\n\nlemma enat_add_sub_same2: \"b \\ \\ \\ a + b - b = (a :: enat)\"\n by (cases a; cases b) simp_all\n\nlemma enat_sub_add: \"y \\ x \\ x - y + z = x + z - (y :: enat)\"\n by (cases x; cases y; cases z) simp_all\n\nlemma SUP_enat_eq_0_iff [simp]: \"\\ (f ` A) = (0 :: enat) \\ (\\x\\A. f x = 0)\"\n by (simp add: bot_enat_def [symmetric])\n\nlemma SUP_enat_add_left:\n assumes \"I \\ {}\"\n shows \"(SUP i\\I. f i + c :: enat) = (SUP i\\I. f i) + c\" (is \"?lhs = ?rhs\")\nproof(cases \"c\", rule antisym)\n case (enat n)\n show \"?lhs \\ ?rhs\" by(auto 4 3 intro: SUP_upper intro: SUP_least)\n have \"(SUP i\\I. f i) \\ ?lhs - c\" using enat \n by(auto simp add: enat_add_sub_same2 intro!: SUP_least order_trans[OF _ SUP_upper[THEN enat_minus_mono1]])\n note add_right_mono[OF this, of c]\n also have \"\\ + c \\ ?lhs\" using assms\n by(subst enat_sub_add)(auto intro: SUP_upper2 simp add: enat_add_sub_same2 enat)\n finally show \"?rhs \\ ?lhs\" .\nqed(simp add: assms SUP_constant)\n\nlemma SUP_enat_add_right:\n assumes \"I \\ {}\"\n shows \"(SUP i\\I. c + f i :: enat) = c + (SUP i\\I. f i)\"\nusing SUP_enat_add_left[OF assms, of f c]\nby(simp add: add.commute)\n\nlemma iadd_SUP_le_iff: \"n + (SUP x\\A. f x :: enat) \\ y \\ (if A = {} then n \\ y else \\x\\A. n + f x \\ y)\"\nby(simp add: bot_enat_def SUP_enat_add_right[symmetric] SUP_le_iff)\n\nlemma SUP_iadd_le_iff: \"(SUP x\\A. f x :: enat) + n \\ y \\ (if A = {} then n \\ y else \\x\\A. f x + n \\ y)\"\nusing iadd_SUP_le_iff[of n f A y] by(simp add: add.commute)\n\n\nsubsection \\Extended non-negative reals\\\n\nlemma (in finite_measure) nn_integral_indicator_neq_infty: \n \"f -` A \\ sets M \\ (\\\\<^sup>+ x. indicator A (f x) \\M) \\ \\\"\nunfolding ennreal_indicator[symmetric]\napply(rule integrableD)\napply(rule integrable_const_bound[where B=1])\napply(simp_all add: indicator_vimage[symmetric])\ndone\n\nlemma (in finite_measure) nn_integral_indicator_neq_top: \n \"f -` A \\ sets M \\ (\\\\<^sup>+ x. indicator A (f x) \\M) \\ \\\"\nby(drule nn_integral_indicator_neq_infty) simp\n\nlemma nn_integral_indicator_map:\n assumes [measurable]: \"f \\ measurable M N\" \"{x\\space N. P x} \\ sets N\"\n shows \"(\\\\<^sup>+x. indicator {x\\space N. P x} (f x) \\M) = emeasure M {x\\space M. P (f x)}\"\n using assms(1)[THEN measurable_space] \n by (subst nn_integral_indicator[symmetric])\n (auto intro!: nn_integral_cong split: split_indicator simp del: nn_integral_indicator)\n\n\nsubsection \\BNF material\\\n\nlemma transp_rel_fun: \"\\ is_equality Q; transp R \\ \\ transp (rel_fun Q R)\"\nby(rule transpI)(auto dest: transpD rel_funD simp add: is_equality_def)\n\nlemma rel_fun_inf: \"inf (rel_fun Q R) (rel_fun Q R') = rel_fun Q (inf R R')\"\nby(rule antisym)(auto elim: rel_fun_mono dest: rel_funD)\n\nlemma reflp_fun1: includes lifting_syntax shows \"\\ is_equality A; reflp B \\ \\ reflp (A ===> B)\"\nby(simp add: reflp_def rel_fun_def is_equality_def)\n\nlemma type_copy_id': \"type_definition (\\x. x) (\\x. x) UNIV\"\nby unfold_locales simp_all\n\nlemma type_copy_id: \"type_definition id id UNIV\"\nby(simp add: id_def type_copy_id')\n\nlemma GrpE [cases pred]:\n assumes \"BNF_Def.Grp A f x y\"\n obtains (Grp) \"y = f x\" \"x \\ A\"\nusing assms\nby(simp add: Grp_def)\n\nlemma rel_fun_Grp_copy_Abs:\n includes lifting_syntax\n assumes \"type_definition Rep Abs A\"\n shows \"rel_fun (BNF_Def.Grp A Abs) (BNF_Def.Grp B g) = BNF_Def.Grp {f. f ` A \\ B} (Rep ---> g)\"\nproof -\n interpret type_definition Rep Abs A by fact\n show ?thesis\n by(auto simp add: rel_fun_def Grp_def fun_eq_iff Abs_inverse Rep_inverse intro!: Rep)\nqed\n\nlemma rel_set_Grp:\n \"rel_set (BNF_Def.Grp A f) = BNF_Def.Grp {B. B \\ A} (image f)\"\nby(auto simp add: rel_set_def BNF_Def.Grp_def fun_eq_iff)\n\nlemma rel_set_comp_Grp:\n \"rel_set R = (BNF_Def.Grp {x. x \\ {(x, y). R x y}} ((`) fst))\\\\ OO BNF_Def.Grp {x. x \\ {(x, y). R x y}} ((`) snd)\"\napply(auto 4 4 del: ext intro!: ext simp add: BNF_Def.Grp_def intro!: rel_setI intro: rev_bexI)\napply(simp add: relcompp_apply)\nsubgoal for A B\n apply(rule exI[where x=\"A \\ B \\ {(x, y). R x y}\"])\n apply(auto 4 3 dest: rel_setD1 rel_setD2 intro: rev_image_eqI)\n done\ndone\n\nlemma Domainp_Grp: \"Domainp (BNF_Def.Grp A f) = (\\x. x \\ A)\"\nby(auto simp add: fun_eq_iff Grp_def)\n\nlemma pred_prod_conj [simp]:\n shows pred_prod_conj1: \"\\P Q R. pred_prod (\\x. P x \\ Q x) R = (\\x. pred_prod P R x \\ pred_prod Q R x)\"\n and pred_prod_conj2: \"\\P Q R. pred_prod P (\\x. Q x \\ R x) = (\\x. pred_prod P Q x \\ pred_prod P R x)\"\nby(auto simp add: pred_prod.simps)\n\nlemma pred_sum_conj [simp]:\n shows pred_sum_conj1: \"\\P Q R. pred_sum (\\x. P x \\ Q x) R = (\\x. pred_sum P R x \\ pred_sum Q R x)\"\n and pred_sum_conj2: \"\\P Q R. pred_sum P (\\x. Q x \\ R x) = (\\x. pred_sum P Q x \\ pred_sum P R x)\"\nby(auto simp add: pred_sum.simps fun_eq_iff)\n\nlemma pred_list_conj [simp]: \"list_all (\\x. P x \\ Q x) = (\\x. list_all P x \\ list_all Q x)\"\nby(auto simp add: list_all_def)\n\nlemma pred_prod_top [simp]:\n \"pred_prod (\\_. True) (\\_. True) = (\\_. True)\"\nby(simp add: pred_prod.simps fun_eq_iff)\n\nlemma rel_fun_conversep: includes lifting_syntax shows\n \"(A^--1 ===> B^--1) = (A ===> B)^--1\"\nby(auto simp add: rel_fun_def fun_eq_iff)\n\nlemma left_unique_Grp [iff]:\n \"left_unique (BNF_Def.Grp A f) \\ inj_on f A\"\nunfolding Grp_def left_unique_def by(auto simp add: inj_on_def)\n\nlemma right_unique_Grp [simp, intro!]: \"right_unique (BNF_Def.Grp A f)\"\nby(simp add: Grp_def right_unique_def)\n\nlemma bi_unique_Grp [iff]:\n \"bi_unique (BNF_Def.Grp A f) \\ inj_on f A\"\nby(simp add: bi_unique_alt_def)\n\nlemma left_total_Grp [iff]:\n \"left_total (BNF_Def.Grp A f) \\ A = UNIV\"\nby(auto simp add: left_total_def Grp_def)\n\nlemma right_total_Grp [iff]:\n \"right_total (BNF_Def.Grp A f) \\ f ` A = UNIV\"\nby(auto simp add: right_total_def BNF_Def.Grp_def image_def)\n\nlemma bi_total_Grp [iff]:\n \"bi_total (BNF_Def.Grp A f) \\ A = UNIV \\ surj f\"\nby(auto simp add: bi_total_alt_def)\n\nlemma left_unique_vimage2p [simp]:\n \"\\ left_unique P; inj f \\ \\ left_unique (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro left_unique_OO) simp_all\n\nlemma right_unique_vimage2p [simp]:\n \"\\ right_unique P; inj g \\ \\ right_unique (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro right_unique_OO) simp_all\n\nlemma bi_unique_vimage2p [simp]:\n \"\\ bi_unique P; inj f; inj g \\ \\ bi_unique (BNF_Def.vimage2p f g P)\"\nunfolding bi_unique_alt_def by simp\n\nlemma left_total_vimage2p [simp]:\n \"\\ left_total P; surj g \\ \\ left_total (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro left_total_OO) simp_all\n\nlemma right_total_vimage2p [simp]:\n \"\\ right_total P; surj f \\ \\ right_total (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro right_total_OO) simp_all\n\nlemma bi_total_vimage2p [simp]:\n \"\\ bi_total P; surj f; surj g \\ \\ bi_total (BNF_Def.vimage2p f g P)\"\nunfolding bi_total_alt_def by simp\n\nlemma vimage2p_eq [simp]:\n \"inj f \\ BNF_Def.vimage2p f f (=) = (=)\"\nby(auto simp add: vimage2p_def fun_eq_iff inj_on_def)\n\nlemma vimage2p_conversep: \"BNF_Def.vimage2p f g R^--1 = (BNF_Def.vimage2p g f R)^--1\"\nby(simp add: vimage2p_def fun_eq_iff)\n\nlemma rel_fun_refl: \"\\ A \\ (=); (=) \\ B \\ \\ (=) \\ rel_fun A B\"\n by(subst fun.rel_eq[symmetric])(rule fun_mono)\n\nlemma rel_fun_mono_strong:\n \"\\ rel_fun A B f g; A' \\ A; \\x y. \\ x \\ f ` {x. Domainp A' x}; y \\ g ` {x. Rangep A' x}; B x y \\ \\ B' x y \\ \\ rel_fun A' B' f g\"\n by(auto simp add: rel_fun_def) fastforce\n\nlemma rel_fun_refl_strong: \n assumes \"A \\ (=)\" \"\\x. x \\ f ` {x. Domainp A x} \\ B x x\"\n shows \"rel_fun A B f f\"\nproof -\n have \"rel_fun (=) (=) f f\" by(simp add: rel_fun_eq)\n then show ?thesis using assms(1)\n by(rule rel_fun_mono_strong) (auto intro: assms(2))\nqed\n\nlemma Grp_iff: \"BNF_Def.Grp B g x y \\ y = g x \\ x \\ B\" by(simp add: Grp_def)\n\nlemma Rangep_Grp: \"Rangep (BNF_Def.Grp A f) = (\\x. x \\ f ` A)\"\n by(auto simp add: fun_eq_iff Grp_iff)\n\nlemma rel_fun_Grp:\n \"rel_fun (BNF_Def.Grp UNIV h)\\\\ (BNF_Def.Grp A g) = BNF_Def.Grp {f. f ` range h \\ A} (map_fun h g)\"\n by(auto simp add: rel_fun_def fun_eq_iff Grp_iff)\n\nsubsection \\Transfer and lifting material\\\n\ncontext includes lifting_syntax begin\n\nlemma monotone_parametric [transfer_rule]:\n assumes [transfer_rule]: \"bi_total A\"\n shows \"((A ===> A ===> (=)) ===> (B ===> B ===> (=)) ===> (A ===> B) ===> (=)) monotone monotone\"\nunfolding monotone_def[abs_def] by transfer_prover\n\nlemma fun_ord_parametric [transfer_rule]:\n assumes [transfer_rule]: \"bi_total C\"\n shows \"((A ===> B ===> (=)) ===> (C ===> A) ===> (C ===> B) ===> (=)) fun_ord fun_ord\"\nunfolding fun_ord_def[abs_def] by transfer_prover\n\nlemma Plus_parametric [transfer_rule]:\n \"(rel_set A ===> rel_set B ===> rel_set (rel_sum A B)) (<+>) (<+>)\"\nunfolding Plus_def[abs_def] by transfer_prover\n\nlemma pred_fun_parametric [transfer_rule]:\n assumes [transfer_rule]: \"bi_total A\"\n shows \"((A ===> (=)) ===> (B ===> (=)) ===> (A ===> B) ===> (=)) pred_fun pred_fun\"\nunfolding pred_fun_def by(transfer_prover)\n\nlemma rel_fun_eq_OO: \"((=) ===> A) OO ((=) ===> B) = ((=) ===> A OO B)\"\nby(clarsimp simp add: rel_fun_def fun_eq_iff relcompp.simps) metis\n\nend\n\nlemma Quotient_set_rel_eq:\n includes lifting_syntax\n assumes \"Quotient R Abs Rep T\"\n shows \"(rel_set T ===> rel_set T ===> (=)) (rel_set R) (=)\"\nproof(rule rel_funI iffI)+\n fix A B C D\n assume AB: \"rel_set T A B\" and CD: \"rel_set T C D\"\n have *: \"\\x y. R x y = (T x (Abs x) \\ T y (Abs y) \\ Abs x = Abs y)\"\n \"\\a b. T a b \\ Abs a = b\"\n using assms unfolding Quotient_alt_def by simp_all\n\n { assume [simp]: \"B = D\"\n thus \"rel_set R A C\"\n by(auto 4 4 intro!: rel_setI dest: rel_setD1[OF AB, simplified] rel_setD2[OF AB, simplified] rel_setD2[OF CD] rel_setD1[OF CD] simp add: * elim!: rev_bexI)\n next\n assume AC: \"rel_set R A C\"\n show \"B = D\"\n apply safe\n apply(drule rel_setD2[OF AB], erule bexE)\n apply(drule rel_setD1[OF AC], erule bexE)\n apply(drule rel_setD1[OF CD], erule bexE)\n apply(simp add: *)\n apply(drule rel_setD2[OF CD], erule bexE)\n apply(drule rel_setD2[OF AC], erule bexE)\n apply(drule rel_setD1[OF AB], erule bexE)\n apply(simp add: *)\n done\n }\nqed\n\nlemma Domainp_eq: \"Domainp (=) = (\\_. True)\"\nby(simp add: Domainp.simps fun_eq_iff)\n\nlemma rel_fun_eq_onpI: \"eq_onp (pred_fun P Q) f g \\ rel_fun (eq_onp P) (eq_onp Q) f g\"\nby(auto simp add: eq_onp_def rel_fun_def)\n\nlemma bi_unique_eq_onp: \"bi_unique (eq_onp P)\"\nby(simp add: bi_unique_def eq_onp_def)\n\nlemma rel_fun_eq_conversep: includes lifting_syntax shows \"(A\\\\ ===> (=)) = (A ===> (=))\\\\\"\nby(auto simp add: fun_eq_iff rel_fun_def)\n\n\n\nlemma rel_fun_map_fun1: \"rel_fun (BNF_Def.Grp UNIV h)\\\\ A f g \\ rel_fun (=) A (map_fun h id f) g\"\n by(auto simp add: rel_fun_def Grp_def)\n\nlemma map_fun2_id: \"map_fun f g x = g \\ map_fun f id x\"\n by(simp add: map_fun_def o_assoc)\n\nlemma map_fun_id2_in: \"map_fun g h f = map_fun g id (h \\ f)\"\n by(simp add: map_fun_def)\n\nlemma Domainp_rel_fun_le: \"Domainp (rel_fun A B) \\ pred_fun (Domainp A) (Domainp B)\"\n by(auto dest: rel_funD)\n\ndefinition rel_witness_fun :: \"('a \\ 'b \\ bool) \\ ('b \\ 'c \\ bool) \\ ('a \\ 'd) \\ ('c \\ 'e) \\ ('b \\ 'd \\ 'e)\" where\n \"rel_witness_fun A A' = (\\(f, g) b. (f (THE a. A a b), g (THE c. A' b c)))\"\n\nlemma\n assumes fg: \"rel_fun (A OO A') B f g\"\n and A: \"left_unique A\" \"right_total A\"\n and A': \"right_unique A'\" \"left_total A'\"\n shows rel_witness_fun1: \"rel_fun A (\\x (x', y). x = x' \\ B x' y) f (rel_witness_fun A A' (f, g))\"\n and rel_witness_fun2: \"rel_fun A' (\\(x, y') y. y = y' \\ B x y') (rel_witness_fun A A' (f, g)) g\"\nproof (goal_cases)\n case 1\n have \"A x y \\ f x = f (THE a. A a y) \\ B (f (THE a. A a y)) (g (The (A' y)))\" for x y \n by(rule left_totalE[OF A'(2)]; erule meta_allE[of _ y]; erule exE; frule (1) fg[THEN rel_funD, OF relcomppI])\n (auto intro!: arg_cong[where f=f] arg_cong[where f=g] rel_funI the_equality the_equality[symmetric] dest: left_uniqueD[OF A(1)] right_uniqueD[OF A'(1)] elim!: arg_cong2[where f=B, THEN iffD2, rotated -1])\n\n with 1 show ?case by(clarsimp simp add: rel_fun_def rel_witness_fun_def)\nnext\n case 2\n have \"A' x y \\ g y = g (The (A' x)) \\ B (f (THE a. A a x)) (g (The (A' x)))\" for x y\n by(rule right_totalE[OF A(2), of x]; frule (1) fg[THEN rel_funD, OF relcomppI])\n (auto intro!: arg_cong[where f=f] arg_cong[where f=g] rel_funI the_equality the_equality[symmetric] dest: left_uniqueD[OF A(1)] right_uniqueD[OF A'(1)] elim!: arg_cong2[where f=B, THEN iffD2, rotated -1])\n\n with 2 show ?case by(clarsimp simp add: rel_fun_def rel_witness_fun_def) \nqed\n\nlemma rel_witness_fun_eq [simp]: \"rel_witness_fun (=) (=) (f, g) = (\\x. (f x, g x))\"\n by(simp add: rel_witness_fun_def)\n\nsubsection \\Arithmetic\\\n\nlemma abs_diff_triangle_ineq2: \"\\a - b :: _ :: ordered_ab_group_add_abs\\ \\ \\a - c\\ + \\c - b\\\"\nby(rule order_trans[OF _ abs_diff_triangle_ineq]) simp\n\nlemma (in ordered_ab_semigroup_add) add_left_mono_trans:\n \"\\ x \\ a + b; b \\ c \\ \\ x \\ a + c\"\nby(erule order_trans)(rule add_left_mono)\n\nlemma of_nat_le_one_cancel_iff [simp]:\n fixes n :: nat shows \"real n \\ 1 \\ n \\ 1\"\nby linarith\n\nlemma (in linordered_semidom) mult_right_le: \"c \\ 1 \\ 0 \\ a \\ c * a \\ a\"\nby(subst mult.commute)(rule mult_left_le)\n\nsubsection \\Chain-complete partial orders and \\partial_function\\\\\n\nlemma fun_ordD: \"fun_ord ord f g \\ ord (f x) (g x)\"\nby(simp add: fun_ord_def)\n\nlemma parallel_fixp_induct_strong:\n assumes ccpo1: \"class.ccpo luba orda (mk_less orda)\"\n and ccpo2: \"class.ccpo lubb ordb (mk_less ordb)\"\n and adm: \"ccpo.admissible (prod_lub luba lubb) (rel_prod orda ordb) (\\x. P (fst x) (snd x))\"\n and f: \"monotone orda orda f\"\n and g: \"monotone ordb ordb g\"\n and bot: \"P (luba {}) (lubb {})\"\n and step: \"\\x y. \\ orda x (ccpo.fixp luba orda f); ordb y (ccpo.fixp lubb ordb g); P x y \\ \\ P (f x) (g y)\"\n shows \"P (ccpo.fixp luba orda f) (ccpo.fixp lubb ordb g)\"\nproof -\n let ?P=\"\\x y. orda x (ccpo.fixp luba orda f) \\ ordb y (ccpo.fixp lubb ordb g) \\ P x y\"\n show ?thesis using ccpo1 ccpo2 _ f g\n proof(rule parallel_fixp_induct[where P=\"?P\", THEN conjunct2, THEN conjunct2])\n note [cont_intro] = \n admissible_leI[OF ccpo1] ccpo.mcont_const[OF ccpo1]\n admissible_leI[OF ccpo2] ccpo.mcont_const[OF ccpo2]\n show \"ccpo.admissible (prod_lub luba lubb) (rel_prod orda ordb) (\\xy. ?P (fst xy) (snd xy))\"\n using adm by simp\n show \"?P (luba {}) (lubb {})\" using bot by(auto intro: ccpo.ccpo_Sup_least ccpo1 ccpo2 chain_empty)\n show \"?P (f x) (g y)\" if \"?P x y\" for x y using that\n apply(subst ccpo.fixp_unfold[OF ccpo1 f])\n apply(subst ccpo.fixp_unfold[OF ccpo2 g])\n apply(auto intro: step monotoneD[OF f] monotoneD[OF g])\n done\n qed\nqed\n\nlemma parallel_fixp_induct_strong_uc:\n assumes a: \"partial_function_definitions orda luba\"\n and b: \"partial_function_definitions ordb lubb\"\n and F: \"\\x. monotone (fun_ord orda) orda (\\f. U1 (F (C1 f)) x)\"\n and G: \"\\y. monotone (fun_ord ordb) ordb (\\g. U2 (G (C2 g)) y)\"\n and eq1: \"f \\ C1 (ccpo.fixp (fun_lub luba) (fun_ord orda) (\\f. U1 (F (C1 f))))\"\n and eq2: \"g \\ C2 (ccpo.fixp (fun_lub lubb) (fun_ord ordb) (\\g. U2 (G (C2 g))))\"\n and inverse: \"\\f. U1 (C1 f) = f\"\n and inverse2: \"\\g. U2 (C2 g) = g\"\n and adm: \"ccpo.admissible (prod_lub (fun_lub luba) (fun_lub lubb)) (rel_prod (fun_ord orda) (fun_ord ordb)) (\\x. P (fst x) (snd x))\"\n and bot: \"P (\\_. luba {}) (\\_. lubb {})\"\n and step: \"\\f' g'. \\ \\x. orda (U1 f' x) (U1 f x); \\y. ordb (U2 g' y) (U2 g y); P (U1 f') (U2 g') \\ \\ P (U1 (F f')) (U2 (G g'))\"\n shows \"P (U1 f) (U2 g)\"\napply(unfold eq1 eq2 inverse inverse2)\napply(rule parallel_fixp_induct_strong[OF partial_function_definitions.ccpo[OF a] partial_function_definitions.ccpo[OF b] adm])\nusing F apply(simp add: monotone_def fun_ord_def)\nusing G apply(simp add: monotone_def fun_ord_def)\napply(simp add: fun_lub_def bot)\napply(rule step; simp add: inverse inverse2 eq1 eq2 fun_ordD)\ndone\n\nlemmas parallel_fixp_induct_strong_1_1 = parallel_fixp_induct_strong_uc[\n of _ _ _ _ \"\\x. x\" _ \"\\x. x\" \"\\x. x\" _ \"\\x. x\",\n OF _ _ _ _ _ _ refl refl]\n\nlemmas parallel_fixp_induct_strong_2_2 = parallel_fixp_induct_strong_uc[\n of _ _ _ _ \"case_prod\" _ \"curry\" \"case_prod\" _ \"curry\",\n where P=\"\\f g. P (curry f) (curry g)\",\n unfolded case_prod_curry curry_case_prod curry_K,\n OF _ _ _ _ _ _ refl refl,\n split_format (complete), unfolded prod.case]\n for P\n\nlemma fixp_induct_option': \\ \\Stronger induction rule\\\n fixes F :: \"'c \\ 'c\" and\n U :: \"'c \\ 'b \\ 'a option\" and\n C :: \"('b \\ 'a option) \\ 'c\" and\n P :: \"'b \\ 'a \\ bool\"\n assumes mono: \"\\x. mono_option (\\f. U (F (C f)) x)\"\n assumes eq: \"f \\ C (ccpo.fixp (fun_lub (flat_lub None)) (fun_ord option_ord) (\\f. U (F (C f))))\"\n assumes inverse2: \"\\f. U (C f) = f\"\n assumes step: \"\\g x y. \\ \\x y. U g x = Some y \\ P x y; U (F g) x = Some y; \\x. option_ord (U g x) (U f x) \\ \\ P x y\"\n assumes defined: \"U f x = Some y\"\n shows \"P x y\"\nusing step defined option.fixp_strong_induct_uc[of U F C, OF mono eq inverse2 option_admissible, of P]\nunfolding fun_lub_def flat_lub_def fun_ord_def\nby(simp (no_asm_use)) blast\n\ndeclaration \\Partial_Function.init \"option'\" @{term option.fixp_fun}\n @{term option.mono_body} @{thm option.fixp_rule_uc} @{thm option.fixp_induct_uc}\n (SOME @{thm fixp_induct_option'})\\\n\nlemma bot_fun_least [simp]: \"(\\_. bot :: 'a :: order_bot) \\ x\"\nby(fold bot_fun_def) simp\n\nlemma fun_ord_conv_rel_fun: \"fun_ord = rel_fun (=)\"\nby(simp add: fun_ord_def fun_eq_iff rel_fun_def)\n\ninductive finite_chains :: \"('a \\ 'a \\ bool) \\ bool\"\n for ord\nwhere finite_chainsI: \"(\\Y. Complete_Partial_Order.chain ord Y \\ finite Y) \\ finite_chains ord\"\n\nlemma finite_chainsD: \"\\ finite_chains ord; Complete_Partial_Order.chain ord Y \\ \\ finite Y\"\nby(rule finite_chains.cases)\n\nlemma finite_chains_flat_ord [simp, intro!]: \"finite_chains (flat_ord x)\"\nproof\n fix Y\n assume chain: \"Complete_Partial_Order.chain (flat_ord x) Y\"\n show \"finite Y\"\n proof(cases \"\\y \\ Y. y \\ x\")\n case True\n then obtain y where y: \"y \\ Y\" and yx: \"y \\ x\" by blast\n hence \"Y \\ {x, y}\" by(auto dest: chainD[OF chain] simp add: flat_ord_def)\n thus ?thesis by(rule finite_subset) simp\n next\n case False\n hence \"Y \\ {x}\" by auto\n thus ?thesis by(rule finite_subset) simp\n qed\nqed \n\nlemma mcont_finite_chains:\n assumes finite: \"finite_chains ord\"\n and mono: \"monotone ord ord' f\"\n and ccpo: \"class.ccpo lub ord (mk_less ord)\"\n and ccpo': \"class.ccpo lub' ord' (mk_less ord')\"\n shows \"mcont lub ord lub' ord' f\"\nproof(intro mcontI contI)\n fix Y\n assume chain: \"Complete_Partial_Order.chain ord Y\" and Y: \"Y \\ {}\"\n from finite chain have fin: \"finite Y\" by(rule finite_chainsD)\n from ccpo chain fin Y have lub: \"lub Y \\ Y\" by(rule ccpo.in_chain_finite)\n\n interpret ccpo': ccpo lub' ord' \"mk_less ord'\" by(rule ccpo')\n\n have chain': \"Complete_Partial_Order.chain ord' (f ` Y)\" using chain\n by(rule chain_imageI)(rule monotoneD[OF mono])\n\n have \"ord' (f (lub Y)) (lub' (f ` Y))\" using chain'\n by(rule ccpo'.ccpo_Sup_upper)(simp add: lub)\n moreover\n have \"ord' (lub' (f ` Y)) (f (lub Y))\" using chain'\n by(rule ccpo'.ccpo_Sup_least)(blast intro: monotoneD[OF mono] ccpo.ccpo_Sup_upper[OF ccpo chain])\n ultimately show \"f (lub Y) = lub' (f ` Y)\" by(rule ccpo'.order.antisym)\nqed(fact mono) \n\nlemma rel_fun_curry: includes lifting_syntax shows\n \"(A ===> B ===> C) f g \\ (rel_prod A B ===> C) (case_prod f) (case_prod g)\"\nby(auto simp add: rel_fun_def)\n\nlemma (in ccpo) Sup_image_mono:\n assumes ccpo: \"class.ccpo luba orda lessa\"\n and mono: \"monotone orda (\\) f\"\n and chain: \"Complete_Partial_Order.chain orda A\"\n and \"A \\ {}\"\n shows \"Sup (f ` A) \\ (f (luba A))\"\nproof(rule ccpo_Sup_least)\n from chain show \"Complete_Partial_Order.chain (\\) (f ` A)\"\n by(rule chain_imageI)(rule monotoneD[OF mono])\n fix x\n assume \"x \\ f ` A\"\n then obtain y where \"x = f y\" \"y \\ A\" by blast\n from \\y \\ A\\ have \"orda y (luba A)\" by(rule ccpo.ccpo_Sup_upper[OF ccpo chain])\n hence \"f y \\ f (luba A)\" by(rule monotoneD[OF mono])\n thus \"x \\ f (luba A)\" using \\x = f y\\ by simp\nqed\n\nlemma (in ccpo) admissible_le_mono:\n assumes \"monotone (\\) (\\) f\"\n shows \"ccpo.admissible Sup (\\) (\\x. x \\ f x)\"\nproof(rule ccpo.admissibleI)\n fix Y\n assume chain: \"Complete_Partial_Order.chain (\\) Y\"\n and Y: \"Y \\ {}\"\n and le [rule_format]: \"\\x\\Y. x \\ f x\"\n have \"\\Y \\ \\(f ` Y)\" using chain\n by(rule ccpo_Sup_least)(rule order_trans[OF le]; blast intro!: ccpo_Sup_upper chain_imageI[OF chain] intro: monotoneD[OF assms])\n also have \"\\ \\ f (\\Y)\"\n by(rule Sup_image_mono[OF _ assms chain Y, where lessa=\"(<)\"]) unfold_locales\n finally show \"\\Y \\ \\\" .\nqed\n\nlemma (in ccpo) fixp_induct_strong2:\n assumes adm: \"ccpo.admissible Sup (\\) P\"\n and mono: \"monotone (\\) (\\) f\"\n and bot: \"P (\\{})\"\n and step: \"\\x. \\ x \\ ccpo_class.fixp f; x \\ f x; P x \\ \\ P (f x)\"\n shows \"P (ccpo_class.fixp f)\"\nproof(rule fixp_strong_induct[where P=\"\\x. x \\ f x \\ P x\", THEN conjunct2])\n show \"ccpo.admissible Sup (\\) (\\x. x \\ f x \\ P x)\"\n using admissible_le_mono adm by(rule admissible_conj)(rule mono)\nnext\n show \"\\{} \\ f (\\{}) \\ P (\\{})\"\n by(auto simp add: bot chain_empty intro: ccpo_Sup_least)\nnext\n fix x\n assume \"x \\ ccpo_class.fixp f\" \"x \\ f x \\ P x\"\n thus \"f x \\ f (f x) \\ P (f x)\"\n by(auto dest: monotoneD[OF mono] intro: step)\nqed(rule mono)\n\ncontext partial_function_definitions begin\n\nlemma fixp_induct_strong2_uc:\n fixes F :: \"'c \\ 'c\"\n and U :: \"'c \\ 'b \\ 'a\"\n and C :: \"('b \\ 'a) \\ 'c\"\n and P :: \"('b \\ 'a) \\ bool\"\n assumes mono: \"\\x. mono_body (\\f. U (F (C f)) x)\"\n and eq: \"f \\ C (fixp_fun (\\f. U (F (C f))))\"\n and inverse: \"\\f. U (C f) = f\"\n and adm: \"ccpo.admissible lub_fun le_fun P\"\n and bot: \"P (\\_. lub {})\"\n and step: \"\\f'. \\ le_fun (U f') (U f); le_fun (U f') (U (F f')); P (U f') \\ \\ P (U (F f'))\"\n shows \"P (U f)\"\nunfolding eq inverse\napply (rule ccpo.fixp_induct_strong2[OF ccpo adm])\napply (insert mono, auto simp: monotone_def fun_ord_def bot fun_lub_def)[2]\napply (rule_tac f'5=\"C x\" in step)\napply (simp_all add: inverse eq)\ndone\n\nend\n\nlemmas parallel_fixp_induct_2_4 = parallel_fixp_induct_uc[\n of _ _ _ _ \"case_prod\" _ \"curry\" \"\\f. case_prod (case_prod (case_prod f))\" _ \"\\f. curry (curry (curry f))\",\n where P=\"\\f g. P (curry f) (curry (curry (curry g)))\",\n unfolded case_prod_curry curry_case_prod curry_K,\n OF _ _ _ _ _ _ refl refl]\n for P\n \nlemma (in ccpo) fixp_greatest:\n assumes f: \"monotone (\\) (\\) f\"\n and ge: \"\\y. f y \\ y \\ x \\ y\"\n shows \"x \\ ccpo.fixp Sup (\\) f\"\n by(rule ge)(simp add: fixp_unfold[OF f, symmetric])\n\nlemma fixp_rolling:\n assumes \"class.ccpo lub1 leq1 (mk_less leq1)\"\n and \"class.ccpo lub2 leq2 (mk_less leq2)\"\n and f: \"monotone leq1 leq2 f\"\n and g: \"monotone leq2 leq1 g\"\n shows \"ccpo.fixp lub1 leq1 (\\x. g (f x)) = g (ccpo.fixp lub2 leq2 (\\x. f (g x)))\"\nproof -\n interpret c1: ccpo lub1 leq1 \"mk_less leq1\" by fact\n interpret c2: ccpo lub2 leq2 \"mk_less leq2\" by fact\n show ?thesis\n proof(rule c1.order.antisym)\n have fg: \"monotone leq2 leq2 (\\x. f (g x))\" using f g by(rule monotone2monotone) simp_all\n have gf: \"monotone leq1 leq1 (\\x. g (f x))\" using g f by(rule monotone2monotone) simp_all\n show \"leq1 (c1.fixp (\\x. g (f x))) (g (c2.fixp (\\x. f (g x))))\" using gf\n by(rule c1.fixp_lowerbound)(subst (2) c2.fixp_unfold[OF fg], simp)\n show \"leq1 (g (c2.fixp (\\x. f (g x)))) (c1.fixp (\\x. g (f x)))\" using gf\n proof(rule c1.fixp_greatest)\n fix u\n assume u: \"leq1 (g (f u)) u\"\n have \"leq1 (g (c2.fixp (\\x. f (g x)))) (g (f u))\"\n by(intro monotoneD[OF g] c2.fixp_lowerbound[OF fg] monotoneD[OF f u])\n then show \"leq1 (g (c2.fixp (\\x. f (g x)))) u\" using u by(rule c1.order_trans)\n qed\n qed\nqed\n\nlemma fixp_lfp_parametric_eq:\n includes lifting_syntax\n assumes f: \"\\x. lfp.mono_body (\\f. F f x)\"\n and g: \"\\x. lfp.mono_body (\\f. G f x)\"\n and param: \"((A ===> (=)) ===> A ===> (=)) F G\"\n shows \"(A ===> (=)) (lfp.fixp_fun F) (lfp.fixp_fun G)\"\nusing f g\nproof(rule parallel_fixp_induct_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions _ _ reflexive reflexive, where P=\"(A ===> (=))\"])\n show \"ccpo.admissible (prod_lub lfp.lub_fun lfp.lub_fun) (rel_prod lfp.le_fun lfp.le_fun) (\\x. (A ===> (=)) (fst x) (snd x))\"\n unfolding rel_fun_def by simp\n show \"(A ===> (=)) (\\_. \\{}) (\\_. \\{})\" by auto\n show \"(A ===> (=)) (F f) (G g)\" if \"(A ===> (=)) f g\" for f g\n using that by(rule rel_funD[OF param])\nqed\n\nlemma mono2mono_map_option[THEN option.mono2mono, simp, cont_intro]:\n shows monotone_map_option: \"monotone option_ord option_ord (map_option f)\"\nby(rule monotoneI)(auto simp add: flat_ord_def)\n\nlemma mcont2mcont_map_option[THEN option.mcont2mcont, simp, cont_intro]:\n shows mcont_map_option: \"mcont (flat_lub None) option_ord (flat_lub None) option_ord (map_option f)\"\nby(rule mcont_finite_chains[OF _ _ flat_interpretation[THEN ccpo] flat_interpretation[THEN ccpo]]) simp_all\n\nlemma mono2mono_set_option [THEN lfp.mono2mono]:\n shows monotone_set_option: \"monotone option_ord (\\) set_option\"\nby(auto intro!: monotoneI simp add: option_ord_Some1_iff)\n\n\n\nlemma eadd_gfp_partial_function_mono [partial_function_mono]:\n \"\\ monotone (fun_ord (\\)) (\\) f; monotone (fun_ord (\\)) (\\) g \\\n \\ monotone (fun_ord (\\)) (\\) (\\x. f x + g x :: enat)\"\nby(rule mono2mono_gfp_eadd)\n\nlemma map_option_mono [partial_function_mono]:\n \"mono_option B \\ mono_option (\\f. map_option g (B f))\"\nunfolding map_conv_bind_option by(rule bind_mono) simp_all\n\n\nsubsection \\Folding over finite sets\\\n\nlemma (in comp_fun_commute) fold_invariant_remove [consumes 1, case_names start step]:\n assumes fin: \"finite A\"\n and start: \"I A s\"\n and step: \"\\x s A'. \\ x \\ A'; I A' s; A' \\ A \\ \\ I (A' - {x}) (f x s)\"\n shows \"I {} (Finite_Set.fold f s A)\"\nproof -\n define A' where \"A' == A\"\n with fin start have \"finite A'\" \"A' \\ A\" \"I A' s\" by simp_all\n thus \"I {} (Finite_Set.fold f s A')\"\n proof(induction arbitrary: s)\n case empty thus ?case by simp\n next\n case (insert x A')\n let ?A' = \"insert x A'\"\n have \"x \\ ?A'\" \"I ?A' s\" \"?A' \\ A\" using insert by auto\n hence \"I (?A' - {x}) (f x s)\" by(rule step)\n with insert have \"A' \\ A\" \"I A' (f x s)\" by auto\n hence \"I {} (Finite_Set.fold f (f x s) A')\" by(rule insert.IH)\n thus ?case using insert by(simp add: fold_insert2 del: fold_insert)\n qed\nqed\n\nlemma (in comp_fun_commute) fold_invariant_insert [consumes 1, case_names start step]:\n assumes fin: \"finite A\"\n and start: \"I {} s\"\n and step: \"\\x s A'. \\ I A' s; x \\ A'; x \\ A; A' \\ A \\ \\ I (insert x A') (f x s)\"\n shows \"I A (Finite_Set.fold f s A)\"\nusing fin start\nproof(rule fold_invariant_remove[where I=\"\\A'. I (A - A')\" and A=A and s=s, simplified])\n fix x s A'\n assume *: \"x \\ A'\" \"I (A - A') s\" \"A' \\ A\"\n hence \"x \\ A - A'\" \"x \\ A\" \"A - A' \\ A\" by auto\n with \\I (A - A') s\\ have \"I (insert x (A - A')) (f x s)\" by(rule step)\n also have \"insert x (A - A') = A - (A' - {x})\" using * by auto\n finally show \"I \\ (f x s)\" .\nqed\n\nlemma (in comp_fun_idem) fold_set_union:\n assumes \"finite A\" \"finite B\"\n shows \"Finite_Set.fold f z (A \\ B) = Finite_Set.fold f (Finite_Set.fold f z A) B\"\nusing assms(2,1) by induction simp_all\n\n\nsubsection \\Parametrisation of transfer rules\\\n\nattribute_setup transfer_parametric = \\ \n Attrib.thm >> (fn parametricity =>\n Thm.rule_attribute [] (fn context => fn transfer_rule =>\n let\n val ctxt = Context.proof_of context;\n val thm' = Lifting_Term.parametrize_transfer_rule ctxt transfer_rule\n in Lifting_Def.generate_parametric_transfer_rule ctxt thm' parametricity\n end\n handle Lifting_Term.MERGE_TRANSFER_REL msg => error (Pretty.string_of msg)\n ))\n\\ \"combine transfer rule with parametricity theorem\"\n\nsubsection \\Lists\\\n\nlemma nth_eq_tlI: \"xs ! n = z \\ (x # xs) ! Suc n = z\"\nby simp\n\nlemma list_all2_append':\n \"length us = length vs \\ list_all2 P (xs @ us) (ys @ vs) \\ list_all2 P xs ys \\ list_all2 P us vs\"\nby(auto simp add: list_all2_append1 list_all2_append2 dest: list_all2_lengthD)\n\ndefinition disjointp :: \"('a \\ bool) list \\ bool\"\nwhere \"disjointp xs = disjoint_family_on (\\n. {x. (xs ! n) x}) {0.. disjointp xs; (xs ! n) x; (xs ! m) x; n < length xs; m < length xs \\ \\ n = m\"\nby(auto 4 3 simp add: disjointp_def disjoint_family_on_def)\n\nlemma disjointpD':\n \"\\ disjointp xs; P x; Q x; xs ! n = P; xs ! m = Q; n < length xs; m < length xs \\ \\ n = m\"\nby(auto 4 3 simp add: disjointp_def disjoint_family_on_def)\n\nlemma wf_strict_prefix: \"wfP strict_prefix\"\nproof -\n from wf have \"wf (inv_image {(x, y). x < y} length)\" by(rule wf_inv_image)\n moreover have \"{(x, y). strict_prefix x y} \\ inv_image {(x, y). x < y} length\" by(auto intro: prefix_length_less)\n ultimately show ?thesis unfolding wfP_def by(rule wf_subset)\nqed\n\nlemma strict_prefix_setD:\n \"strict_prefix xs ys \\ set xs \\ set ys\"\n by(auto simp add: strict_prefix_def prefix_def)\n\nsubsubsection \\List of a given length\\\n\ninductive_set nlists :: \"'a set \\ nat \\ 'a list set\" for A n\nwhere nlists: \"\\ set xs \\ A; length xs = n \\ \\ xs \\ nlists A n\"\nhide_fact (open) nlists\n\nlemma nlists_alt_def: \"nlists A n = {xs. set xs \\ A \\ length xs = n}\"\nby(auto simp add: nlists.simps)\n\nlemma nlists_empty: \"nlists {} n = (if n = 0 then {[]} else {})\"\nby(auto simp add: nlists_alt_def)\n\nlemma nlists_empty_gt0 [simp]: \"n > 0 \\ nlists {} n = {}\"\nby(simp add: nlists_empty)\n\nlemma nlists_0 [simp]: \"nlists A 0 = {[]}\"\nby(auto simp add: nlists_alt_def)\n\n\n\nlemma Nil_in_nlists [simp]: \"[] \\ nlists A n \\ n = 0\"\nby(auto simp add: nlists_alt_def)\n\nlemma Cons_in_nlists_iff: \"x # xs \\ nlists A n \\ (\\n'. n = Suc n' \\ x \\ A \\ xs \\ nlists A n')\"\nby(cases n) simp_all\n\nlemma in_nlists_Suc_iff: \"xs \\ nlists A (Suc n) \\ (\\x xs'. xs = x # xs' \\ x \\ A \\ xs' \\ nlists A n)\"\nby(cases xs) simp_all\n\nlemma nlists_Suc: \"nlists A (Suc n) = (\\x\\A. (#) x ` nlists A n)\"\nby(auto 4 3 simp add: in_nlists_Suc_iff intro: rev_image_eqI)\n\nlemma replicate_in_nlists [simp, intro]: \"x \\ A \\ replicate n x \\ nlists A n\"\nby(simp add: nlists_alt_def set_replicate_conv_if)\n\nlemma nlists_eq_empty_iff [simp]: \"nlists A n = {} \\ n > 0 \\ A = {}\"\nusing replicate_in_nlists by(cases n)(auto)\n\nlemma finite_nlists [simp]: \"finite A \\ finite (nlists A n)\"\nby(induction n)(simp_all add: nlists_Suc)\n\nlemma finite_nlistsD: \n assumes \"finite (nlists A n)\"\n shows \"finite A \\ n = 0\"\nproof(rule disjCI)\n assume \"n \\ 0\"\n then obtain n' where n: \"n = Suc n'\" by(cases n)auto\n then have \"A = hd ` nlists A n\" by(auto 4 4 simp add: nlists_Suc intro: rev_image_eqI rev_bexI)\n also have \"finite \\\" using assms ..\n finally show \"finite A\" .\nqed\n\nlemma finite_nlists_iff: \"finite (nlists A n) \\ finite A \\ n = 0\"\nby(auto dest: finite_nlistsD)\n\nlemma card_nlists: \"card (nlists A n) = card A ^ n\"\nproof(induction n)\n case (Suc n)\n have \"card (\\x\\A. (#) x ` nlists A n) = card A * card (nlists A n)\"\n proof(cases \"finite A\")\n case True\n then show ?thesis by(subst card_UN_disjoint)(auto simp add: card_image inj_on_def)\n next\n case False\n hence \"\\ finite (\\x\\A. (#) x ` nlists A n)\"\n unfolding nlists_Suc[symmetric] by(auto dest: finite_nlistsD)\n then show ?thesis using False by simp\n qed\n then show ?case using Suc.IH by(simp add: nlists_Suc)\nqed simp\n\nlemma in_nlists_UNIV: \"xs \\ nlists UNIV n \\ length xs = n\"\nby(simp add: nlists_alt_def)\n\nsubsubsection \\ The type of lists of a given length \\\n\ntypedef (overloaded) ('a, 'b :: len0) nlist = \"nlists (UNIV :: 'a set) (LENGTH('b))\"\nproof\n show \"replicate LENGTH('b) undefined \\ ?nlist\" by simp\nqed\n\nsetup_lifting type_definition_nlist\n\nsubsection \\Streams and infinite lists\\\n\nprimrec sprefix :: \"'a list \\ 'a stream \\ bool\" where\n sprefix_Nil: \"sprefix [] ys = True\"\n| sprefix_Cons: \"sprefix (x # xs) ys \\ x = shd ys \\ sprefix xs (stl ys)\"\n\nlemma sprefix_append: \"sprefix (xs @ ys) zs \\ sprefix xs zs \\ sprefix ys (sdrop (length xs) zs)\"\nby(induct xs arbitrary: zs) simp_all\n\nlemma sprefix_stake_same [simp]: \"sprefix (stake n xs) xs\"\nby(induct n arbitrary: xs) simp_all\n\nlemma sprefix_same_imp_eq:\n assumes \"sprefix xs ys\" \"sprefix xs' ys\"\n and \"length xs = length xs'\"\n shows \"xs = xs'\"\nusing assms(3,1,2) by(induct arbitrary: ys rule: list_induct2) auto\n\nlemma sprefix_shift_same [simp]:\n \"sprefix xs (xs @- ys)\"\nby(induct xs) simp_all\n\nlemma sprefix_shift [simp]:\n \"length xs \\ length ys \\ sprefix xs (ys @- zs) \\ prefix xs ys\"\nby(induct xs arbitrary: ys)(simp, case_tac ys, auto)\n\nlemma prefixeq_stake2 [simp]: \"prefix xs (stake n ys) \\ length xs \\ n \\ sprefix xs ys\"\nproof(induct xs arbitrary: n ys)\n case (Cons x xs)\n thus ?case by(cases ys n rule: stream.exhaust[case_product nat.exhaust]) auto\nqed simp\n\nlemma tlength_eq_infinity_iff: \"tlength xs = \\ \\ \\ tfinite xs\"\nincluding tllist.lifting by transfer(simp add: llength_eq_infty_conv_lfinite)\n\nsubsection \\Monomorphic monads\\\n\ncontext includes lifting_syntax begin\nlocal_setup \\Local_Theory.map_background_naming (Name_Space.mandatory_path \"monad\")\\\n\ndefinition bind_option :: \"'m fail \\ 'a option \\ ('a \\ 'm) \\ 'm\"\nwhere \"bind_option fail x f = (case x of None \\ fail | Some x' \\ f x')\" for fail\n\nsimps_of_case bind_option_simps [simp]: bind_option_def\n\nlemma bind_option_parametric [transfer_rule]:\n \"(M ===> rel_option B ===> (B ===> M) ===> M) bind_option bind_option\"\nunfolding bind_option_def by transfer_prover\n\nlemma bind_option_K:\n \"\\monad. (x = None \\ m = fail) \\ bind_option fail x (\\_. m) = m\"\nby(cases x) simp_all\n\nend\n\nlemma bind_option_option [simp]: \"monad.bind_option None = Option.bind\"\nby(simp add: monad.bind_option_def fun_eq_iff split: option.split)\n\ncontext monad_fail_hom begin\n\nlemma hom_bind_option: \"h (monad.bind_option fail1 x f) = monad.bind_option fail2 x (h \\ f)\"\nby(cases x)(simp_all)\n\nend\n\nlemma bind_option_set [simp]: \"monad.bind_option fail_set = (\\x f. \\ (f ` set_option x))\"\nby(simp add: monad.bind_option_def fun_eq_iff split: option.split)\n\nlemma run_bind_option_stateT [simp]:\n \"\\more. run_state (monad.bind_option (fail_state fail) x f) s = \n monad.bind_option fail x (\\y. run_state (f y) s)\"\nby(cases x) simp_all\n\nlemma run_bind_option_envT [simp]:\n \"\\more. run_env (monad.bind_option (fail_env fail) x f) s = \n monad.bind_option fail x (\\y. run_env (f y) s)\"\nby(cases x) simp_all\n\n\nsubsection \\Measures\\\n\ndeclare sets_restrict_space_count_space [measurable_cong]\n\nlemma (in sigma_algebra) sets_Collect_countable_Ex1:\n \"(\\i :: 'i :: countable. {x \\ \\. P i x} \\ M) \\ {x \\ \\. \\!i. P i x} \\ M\"\nusing sets_Collect_countable_Ex1'[of \"UNIV :: 'i set\"] by simp\n\nlemma pred_countable_Ex1 [measurable]:\n \"(\\i :: _ :: countable. Measurable.pred M (\\x. P i x))\n \\ Measurable.pred M (\\x. \\!i. P i x)\"\nunfolding pred_def by(rule sets.sets_Collect_countable_Ex1)\n\nlemma measurable_snd_count_space [measurable]: \n \"A \\ B \\ snd \\ measurable (M1 \\\\<^sub>M count_space A) (count_space B)\"\nby(auto simp add: measurable_def space_pair_measure snd_vimage_eq_Times Times_Int_Times)\n\nlemma integrable_scale_measure [simp]:\n \"\\ integrable M f; r < \\ \\ \\ integrable (scale_measure r M) f\" \n for f :: \"'a \\ 'b::{banach, second_countable_topology}\"\n by(auto simp add: integrable_iff_bounded nn_integral_scale_measure ennreal_mult_less_top)\n\nlemma integral_scale_measure:\n assumes \"integrable M f\" \"r < \\\"\n shows \"integral\\<^sup>L (scale_measure r M) f = enn2real r * integral\\<^sup>L M f\"\n using assms\n apply(subst (1 2) real_lebesgue_integral_def)\n apply(simp_all add: nn_integral_scale_measure ennreal_enn2real_if)\n by(auto simp add: ennreal_mult_less_top ennreal_less_top_iff ennreal_mult_eq_top_iff enn2real_mult right_diff_distrib elim!: integrableE)\n\nsubsection \\Sequence space\\\n\nlemma (in sequence_space) nn_integral_split:\n assumes f[measurable]: \"f \\ borel_measurable S\"\n shows \"(\\\\<^sup>+\\. f \\ \\S) = (\\\\<^sup>+\\. (\\\\<^sup>+\\'. f (comb_seq i \\ \\') \\S) \\S)\"\nby (subst PiM_comb_seq[symmetric, where i=i])\n (simp add: nn_integral_distr P.nn_integral_fst[symmetric])\n\nlemma (in sequence_space) prob_Collect_split:\n assumes f[measurable]: \"{x\\space S. P x} \\ sets S\"\n shows \"\\

(x in S. P x) = (\\\\<^sup>+x. \\

(x' in S. P (comb_seq i x x')) \\S)\"\nproof -\n have \"\\

(x in S. P x) = (\\\\<^sup>+x. (\\\\<^sup>+x'. indicator {x\\space S. P x} (comb_seq i x x') \\S) \\S)\"\n using nn_integral_split[of \"indicator {x\\space S. P x}\"] by (auto simp: emeasure_eq_measure)\n also have \"\\ = (\\\\<^sup>+x. \\

(x' in S. P (comb_seq i x x')) \\S)\"\n by (intro nn_integral_cong) (auto simp: emeasure_eq_measure nn_integral_indicator_map)\n finally show ?thesis .\nqed\n\nsubsection \\Probability mass functions\\\n\nlemma measure_map_pmf_conv_distr:\n \"measure_pmf (map_pmf f p) = distr (measure_pmf p) (count_space UNIV) f\"\nby(fact map_pmf_rep_eq)\n\nabbreviation coin_pmf :: \"bool pmf\" where \"coin_pmf \\ pmf_of_set UNIV\"\n\ntext \\The rule @{thm [source] rel_pmf_bindI} is not complete as a program logic.\\\nnotepad begin\n define x where \"x = pmf_of_set {True, False}\"\n define y where \"y = pmf_of_set {True, False}\"\n define f where \"f x = pmf_of_set {True, False}\" for x :: bool\n define g :: \"bool \\ bool pmf\" where \"g = return_pmf\"\n define P :: \"bool \\ bool \\ bool\" where \"P = (=)\"\n have \"rel_pmf P (bind_pmf x f) (bind_pmf y g)\"\n by(simp add: P_def f_def[abs_def] g_def y_def bind_return_pmf' pmf.rel_eq)\n have \"\\ R x y\" if \"\\x y. R x y \\ rel_pmf P (f x) (g y)\" for R x y\n \\ \\Only the empty relation satisfies @{thm [source] rel_pmf_bindI}'s second premise.\\\n proof\n assume \"R x y\"\n hence \"rel_pmf P (f x) (g y)\" by(rule that)\n thus False by(auto simp add: P_def f_def g_def rel_pmf_return_pmf2)\n qed\n define R where \"R x y = False\" for x y :: bool\n have \"\\ rel_pmf R x y\" by(simp add: R_def[abs_def])\nend\n\nlemma pred_rel_pmf:\n \"\\ pred_pmf P p; rel_pmf R p q \\ \\ pred_pmf (Imagep R P) q\"\nunfolding pred_pmf_def\napply(rule ballI)\napply(unfold rel_pmf.simps)\napply(erule exE conjE)+\napply hypsubst\napply(unfold pmf.set_map)\napply(erule imageE, hypsubst)\napply(drule bspec)\n apply(erule rev_image_eqI)\n apply(rule refl)\napply(erule Imagep.intros)\napply(erule allE)+\n apply(erule mp)\napply(unfold prod.collapse)\napply assumption\ndone\n\nlemma pmf_rel_mono': \"\\ rel_pmf P x y; P \\ Q \\ \\ rel_pmf Q x y\"\nby(drule pmf.rel_mono) (auto)\n\nlemma rel_pmf_eqI [simp]: \"rel_pmf (=) x x\"\nby(simp add: pmf.rel_eq)\n\nlemma rel_pmf_bind_reflI:\n \"(\\x. x \\ set_pmf p \\ rel_pmf R (f x) (g x))\n \\ rel_pmf R (bind_pmf p f) (bind_pmf p g)\"\nby(rule rel_pmf_bindI[where R=\"\\x y. x = y \\ x \\ set_pmf p\"])(auto intro: rel_pmf_reflI)\n\nlemma pmf_pred_mono_strong:\n \"\\ pred_pmf P p; \\a. \\ a \\ set_pmf p; P a \\ \\ P' a \\ \\ pred_pmf P' p\"\nby(simp add: pred_pmf_def)\n\nlemma rel_pmf_restrict_relpI [intro?]:\n \"\\ rel_pmf R x y; pred_pmf P x; pred_pmf Q y \\ \\ rel_pmf (R \\ P \\ Q) x y\"\nby(erule pmf.rel_mono_strong)(simp add: pred_pmf_def)\n\nlemma rel_pmf_restrict_relpE [elim?]:\n assumes \"rel_pmf (R \\ P \\ Q) x y\"\n obtains \"rel_pmf R x y\" \"pred_pmf P x\" \"pred_pmf Q y\"\nproof\n show \"rel_pmf R x y\" using assms by(auto elim!: pmf.rel_mono_strong)\n have \"pred_pmf (Domainp (R \\ P \\ Q)) x\" using assms by(fold pmf.Domainp_rel) blast\n then show \"pred_pmf P x\" by(rule pmf_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n have \"pred_pmf (Domainp (R \\ P \\ Q)\\\\) y\" using assms\n by(fold pmf.Domainp_rel)(auto simp only: pmf.rel_conversep Domainp_conversep)\n then show \"pred_pmf Q y\" by(rule pmf_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_pmf_restrict_relp_iff:\n \"rel_pmf (R \\ P \\ Q) x y \\ rel_pmf R x y \\ pred_pmf P x \\ pred_pmf Q y\"\nby(blast intro: rel_pmf_restrict_relpI elim: rel_pmf_restrict_relpE)\n\nlemma rel_pmf_OO_trans [trans]:\n \"\\ rel_pmf R p q; rel_pmf S q r \\ \\ rel_pmf (R OO S) p r\"\nunfolding pmf.rel_compp by blast\n\nlemma pmf_pred_map [simp]: \"pred_pmf P (map_pmf f p) = pred_pmf (P \\ f) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_bind [simp]: \"pred_pmf P (bind_pmf p f) = pred_pmf (pred_pmf P \\ f) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_return [simp]: \"pred_pmf P (return_pmf x) = P x\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_of_set [simp]: \"\\ finite A; A \\ {} \\ \\ pred_pmf P (pmf_of_set A) = Ball A P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_of_multiset [simp]: \"M \\ {#} \\ pred_pmf P (pmf_of_multiset M) = Ball (set_mset M) P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_cond [simp]:\n \"set_pmf p \\ A \\ {} \\ pred_pmf P (cond_pmf p A) = pred_pmf (\\x. x \\ A \\ P x) p\"\nby(auto simp add: pred_pmf_def)\n\nlemma pred_pmf_pair [simp]:\n \"pred_pmf P (pair_pmf p q) = pred_pmf (\\x. pred_pmf (P \\ Pair x) q) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_join [simp]: \"pred_pmf P (join_pmf p) = pred_pmf (pred_pmf P) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_bernoulli [simp]: \"\\ 0 < p; p < 1 \\ \\ pred_pmf P (bernoulli_pmf p) = All P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_geometric [simp]: \"\\ 0 < p; p < 1 \\ \\ pred_pmf P (geometric_pmf p) = All P\"\nby(simp add: pred_pmf_def set_pmf_geometric)\n\nlemma pred_pmf_poisson [simp]: \"0 < rate \\ pred_pmf P (poisson_pmf rate) = All P\"\nby(simp add: pred_pmf_def)\n\nlemma pmf_rel_map_restrict_relp: \n shows pmf_rel_map_restrict_relp1: \"rel_pmf (R \\ P \\ Q) (map_pmf f p) = rel_pmf (R \\ f \\ P \\ f \\ Q) p\"\n and pmf_rel_map_restrict_relp2: \"rel_pmf (R \\ P \\ Q) p (map_pmf g q) = rel_pmf ((\\x. R x \\ g) \\ P \\ Q \\ g) p q\"\nby(simp_all add: pmf.rel_map restrict_relp_def fun_eq_iff)\n\nlemma pred_pmf_conj [simp]: \"pred_pmf (\\x. P x \\ Q x) = (\\x. pred_pmf P x \\ pred_pmf Q x)\"\nby(auto simp add: pred_pmf_def)\n\nlemma pred_pmf_top [simp]:\n \"pred_pmf (\\_. True) = (\\_. True)\"\nby(simp add: pred_pmf_def)\n\nlemma rel_pmf_of_setI:\n assumes A: \"A \\ {}\" \"finite A\"\n and B: \"B \\ {}\" \"finite B\"\n and card: \"\\X. X \\ A \\ card B * card X \\ card A * card {y\\B. \\x\\X. R x y}\"\n shows \"rel_pmf R (pmf_of_set A) (pmf_of_set B)\"\napply(rule rel_pmf_measureI)\nusing assms\napply(clarsimp simp add: measure_pmf_of_set card_gt_0_iff field_simps of_nat_mult[symmetric] simp del: of_nat_mult)\napply(subst mult.commute)\napply(erule meta_allE)\napply(erule meta_impE)\n prefer 2\n apply(erule order_trans)\napply(auto simp add: card_gt_0_iff intro: card_mono)\ndone\n\nconsts rel_witness_pmf :: \"('a \\ 'b \\ bool) \\ 'a pmf \\ 'b pmf \\ ('a \\ 'b) pmf\"\nspecification (rel_witness_pmf)\n set_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\ set_pmf (rel_witness_pmf A xy) \\ {(a, b). A a b}\"\n map1_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\ map_pmf fst (rel_witness_pmf A xy) = fst xy\"\n map2_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\ map_pmf snd (rel_witness_pmf A xy) = snd xy\"\n apply(fold all_conj_distrib imp_conjR)\n apply(rule choice allI)+\n apply(unfold pmf.in_rel)\n by blast\n\nlemmas set_rel_witness_pmf = set_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas map1_rel_witness_pmf = map1_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas map2_rel_witness_pmf = map2_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas rel_witness_pmf = set_rel_witness_pmf map1_rel_witness_pmf map2_rel_witness_pmf\n\nlemma rel_witness_pmf1:\n assumes \"rel_pmf A p q\" \n shows \"rel_pmf (\\a (a', b). a = a' \\ A a' b) p (rel_witness_pmf A (p, q))\"\n using map1_rel_witness_pmf[OF assms, symmetric]\n unfolding pmf.rel_eq[symmetric] pmf.rel_map\n by(rule pmf.rel_mono_strong)(auto dest: set_rel_witness_pmf[OF assms, THEN subsetD])\n\nlemma rel_witness_pmf2:\n assumes \"rel_pmf A p q\" \n shows \"rel_pmf (\\(a, b') b. b = b' \\ A a b') (rel_witness_pmf A (p, q)) q\"\n using map2_rel_witness_pmf[OF assms]\n unfolding pmf.rel_eq[symmetric] pmf.rel_map\n by(rule pmf.rel_mono_strong)(auto dest: set_rel_witness_pmf[OF assms, THEN subsetD])\n\nlemma cond_pmf_of_set:\n assumes fin: \"finite A\" and nonempty: \"A \\ B \\ {}\"\n shows \"cond_pmf (pmf_of_set A) B = pmf_of_set (A \\ B)\" (is \"?lhs = ?rhs\")\nproof(rule pmf_eqI)\n from nonempty have A: \"A \\ {}\" by auto\n show \"pmf ?lhs x = pmf ?rhs x\" for x\n by(subst pmf_cond; clarsimp simp add: fin A nonempty measure_pmf_of_set split: split_indicator)\nqed\n\nlemma pair_pmf_of_set:\n assumes A: \"finite A\" \"A \\ {}\"\n and B: \"finite B\" \"B \\ {}\"\n shows \"pair_pmf (pmf_of_set A) (pmf_of_set B) = pmf_of_set (A \\ B)\"\n by(rule pmf_eqI)(clarsimp simp add: pmf_pair assms split: split_indicator)\n\nlemma emeasure_cond_pmf:\n fixes p A\n defines \"q \\ cond_pmf p A\"\n assumes \"set_pmf p \\ A \\ {}\"\n shows \"emeasure (measure_pmf q) B = emeasure (measure_pmf p) (A \\ B) / emeasure (measure_pmf p) A\"\nproof -\n note [transfer_rule] = cond_pmf.transfer[OF assms(2), folded q_def]\n interpret pmf_as_measure .\n show ?thesis by transfer simp\nqed\n\nlemma measure_cond_pmf:\n \"measure (measure_pmf (cond_pmf p A)) B = measure (measure_pmf p) (A \\ B) / measure (measure_pmf p) A\"\n if \"set_pmf p \\ A \\ {}\"\n using emeasure_cond_pmf[OF that, of B] that \n by(auto simp add: measure_pmf.emeasure_eq_measure measure_pmf_posI divide_ennreal)\n\nlemma emeasure_measure_pmf_zero_iff: \"emeasure (measure_pmf p) s = 0 \\ set_pmf p \\ s = {}\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs \\ (AE x in measure_pmf p. x \\ s)\"\n by(subst AE_iff_measurable)(auto)\n also have \"\\ = ?rhs\" by(auto simp add: AE_measure_pmf_iff)\n finally show ?thesis .\nqed\n\nsubsection \\Subprobability mass functions\\\n\nlemma ord_spmf_return_spmf1: \"ord_spmf R (return_spmf x) p \\ lossless_spmf p \\ (\\y\\set_spmf p. R x y)\"\nby(auto simp add: rel_pmf_return_pmf1 ord_option.simps in_set_spmf lossless_iff_set_pmf_None Ball_def) (metis option.exhaust)\n\nlemma ord_spmf_conv:\n \"ord_spmf R = rel_spmf R OO ord_spmf (=)\"\napply(subst pmf.rel_compp[symmetric])\napply(rule arg_cong[where f=\"rel_pmf\"]) \napply(rule ext)+\napply(auto elim!: ord_option.cases option.rel_cases intro: option.rel_intros)\ndone\n\nlemma ord_spmf_expand:\n \"NO_MATCH (=) R \\ ord_spmf R = rel_spmf R OO ord_spmf (=)\"\nby(rule ord_spmf_conv)\n\nlemma ord_spmf_eqD_measure: \"ord_spmf (=) p q \\ measure (measure_spmf p) A \\ measure (measure_spmf q) A\"\nby(drule ord_spmf_eqD_measure_spmf)(simp add: le_measure measure_spmf.emeasure_eq_measure)\n\nlemma ord_spmf_measureD:\n assumes \"ord_spmf R p q\"\n shows \"measure (measure_spmf p) A \\ measure (measure_spmf q) {y. \\x\\A. R x y}\"\n (is \"?lhs \\ ?rhs\")\nproof -\n from assms obtain p' where *: \"rel_spmf R p p'\" and **: \"ord_spmf (=) p' q\"\n by(auto simp add: ord_spmf_expand)\n have \"?lhs \\ measure (measure_spmf p') {y. \\x\\A. R x y}\" using * by(rule rel_spmf_measureD)\n also have \"\\ \\ ?rhs\" using ** by(rule ord_spmf_eqD_measure)\n finally show ?thesis .\nqed\n\nlemma ord_spmf_bind_pmfI1:\n \"(\\x. x \\ set_pmf p \\ ord_spmf R (f x) q) \\ ord_spmf R (bind_pmf p f) q\"\n apply(rewrite at \"ord_spmf _ _ \\\" bind_return_pmf[symmetric, where f=\"\\_ :: unit. q\"])\n apply(rule rel_pmf_bindI[where R=\"\\x y. x \\ set_pmf p\"])\n apply(simp_all add: rel_pmf_return_pmf2)\n done\n \nlemma ord_spmf_bind_spmfI1:\n \"(\\x. x \\ set_spmf p \\ ord_spmf R (f x) q) \\ ord_spmf R (bind_spmf p f) q\"\nunfolding bind_spmf_def by(rule ord_spmf_bind_pmfI1)(auto split: option.split simp add: in_set_spmf)\n\nlemma spmf_of_set_empty: \"spmf_of_set {} = return_pmf None\"\nby(simp add: spmf_of_set_def)\n\nlemma rel_spmf_of_setI:\n assumes card: \"\\X. X \\ A \\ card B * card X \\ card A * card {y\\B. \\x\\X. R x y}\"\n and eq: \"(finite A \\ A \\ {}) \\ (finite B \\ B \\ {})\"\n shows \"rel_spmf R (spmf_of_set A) (spmf_of_set B)\"\nusing eq by(clarsimp simp add: spmf_of_set_def card rel_pmf_of_setI simp del: spmf_of_pmf_pmf_of_set cong: conj_cong)\n\nlemmas map_bind_spmf = map_spmf_bind_spmf\n\nlemma nn_integral_measure_spmf_conv_measure_pmf:\n assumes [measurable]: \"f \\ borel_measurable (count_space UNIV)\"\n shows \"nn_integral (measure_spmf p) f = nn_integral (restrict_space (measure_pmf p) (range Some)) (f \\ the)\"\nby(simp add: measure_spmf_def nn_integral_distr o_def)\n\nlemma nn_integral_spmf_neq_infinity: \"(\\\\<^sup>+ x. spmf p x \\count_space UNIV) \\ \\\"\nusing nn_integral_measure_spmf[where f=\"\\_. 1\", of p, symmetric] by simp\n\nlemma return_pmf_bind_option:\n \"return_pmf (Option.bind x f) = bind_spmf (return_pmf x) (return_pmf \\ f)\"\nby(cases x) simp_all\n\nlemma rel_spmf_pos_distr: \"rel_spmf A OO rel_spmf B \\ rel_spmf (A OO B)\"\nunfolding option.rel_compp pmf.rel_compp ..\n\nlemma rel_spmf_OO_trans [trans]:\n \"\\ rel_spmf R p q; rel_spmf S q r \\ \\ rel_spmf (R OO S) p r\"\nby(rule rel_spmf_pos_distr[THEN predicate2D]) auto\n\nlemma map_spmf_eq_map_spmf_iff: \"map_spmf f p = map_spmf g q \\ rel_spmf (\\x y. f x = g y) p q\"\nby(simp add: spmf_rel_eq[symmetric] spmf_rel_map)\n\nlemma map_spmf_eq_map_spmfI: \"rel_spmf (\\x y. f x = g y) p q \\ map_spmf f p = map_spmf g q\"\nby(simp add: map_spmf_eq_map_spmf_iff)\n\nlemma spmf_rel_mono_strong:\n \"\\rel_spmf A f g; \\x y. \\ x \\ set_spmf f; y \\ set_spmf g; A x y \\ \\ B x y \\ \\ rel_spmf B f g\"\napply(erule pmf.rel_mono_strong)\napply(erule option.rel_mono_strong)\nby(clarsimp simp add: in_set_spmf)\n\nlemma set_spmf_eq_empty: \"set_spmf p = {} \\ p = return_pmf None\"\nby auto (metis restrict_spmf_empty restrict_spmf_trivial)\n\n\nlemma measure_pair_spmf_times:\n \"measure (measure_spmf (pair_spmf p q)) (A \\ B) = measure (measure_spmf p) A * measure (measure_spmf q) B\"\nproof -\n have \"emeasure (measure_spmf (pair_spmf p q)) (A \\ B) = (\\\\<^sup>+ x. ennreal (spmf (pair_spmf p q) x) * indicator (A \\ B) x \\count_space UNIV)\"\n by(simp add: nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n also have \"\\ = (\\\\<^sup>+ x. (\\\\<^sup>+ y. (ennreal (spmf p x) * indicator A x) * (ennreal (spmf q y) * indicator B y) \\count_space UNIV) \\count_space UNIV)\"\n by(subst nn_integral_fst_count_space[symmetric])(auto intro!: nn_integral_cong split: split_indicator simp add: ennreal_mult)\n also have \"\\ = (\\\\<^sup>+ x. ennreal (spmf p x) * indicator A x * emeasure (measure_spmf q) B \\count_space UNIV)\"\n by(simp add: nn_integral_cmult nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n also have \"\\ = emeasure (measure_spmf p) A * emeasure (measure_spmf q) B\"\n by(simp add: nn_integral_multc)(simp add: nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n finally show ?thesis by(simp add: measure_spmf.emeasure_eq_measure ennreal_mult[symmetric])\nqed\n\nlemma lossless_spmfD_set_spmf_nonempty: \"lossless_spmf p \\ set_spmf p \\ {}\"\nusing set_pmf_not_empty[of p] by(auto simp add: set_spmf_def bind_UNION lossless_iff_set_pmf_None)\n\nlemma set_spmf_return_pmf: \"set_spmf (return_pmf x) = set_option x\"\nby(cases x) simp_all\n\nlemma bind_spmf_pmf_assoc: \"bind_spmf (bind_pmf p f) g = bind_pmf p (\\x. bind_spmf (f x) g)\"\nby(simp add: bind_spmf_def bind_assoc_pmf)\n\nlemma bind_spmf_of_set: \"\\ finite A; A \\ {} \\ \\ bind_spmf (spmf_of_set A) f = bind_pmf (pmf_of_set A) f\"\nby(simp add: spmf_of_set_def del: spmf_of_pmf_pmf_of_set)\n\nlemma bind_spmf_map_pmf:\n \"bind_spmf (map_pmf f p) g = bind_pmf p (\\x. bind_spmf (return_pmf (f x)) g)\"\nby(simp add: map_pmf_def bind_spmf_def bind_assoc_pmf)\n\nlemma rel_spmf_eqI [simp]: \"rel_spmf (=) x x\"\nby(simp add: option.rel_eq)\n\nlemma set_spmf_map_pmf: \"set_spmf (map_pmf f p) = (\\x\\set_pmf p. set_option (f x))\" (* Move up *)\nby(simp add: set_spmf_def bind_UNION)\n\nlemma ord_spmf_return_spmf [simp]: \"ord_spmf (=) (return_spmf x) p \\ p = return_spmf x\"\nproof -\n have \"p = return_spmf x \\ ord_spmf (=) (return_spmf x) p\" by simp\n thus ?thesis\n by (metis (no_types) ord_option_eq_simps(2) rel_pmf_return_pmf1 rel_pmf_return_pmf2 spmf.leq_antisym)\nqed\n\ndeclare\n set_bind_spmf [simp]\n set_spmf_return_pmf [simp]\n\nlemma bind_spmf_pmf_commute:\n \"bind_spmf p (\\x. bind_pmf q (f x)) = bind_pmf q (\\y. bind_spmf p (\\x. f x y))\"\nunfolding bind_spmf_def \nby(subst bind_commute_pmf)(auto intro: bind_pmf_cong[OF refl] split: option.split)\n\nlemma return_pmf_map_option_conv_bind:\n \"return_pmf (map_option f x) = bind_spmf (return_pmf x) (return_spmf \\ f)\"\nby(cases x) simp_all\n\nlemma lossless_return_pmf_iff [simp]: \"lossless_spmf (return_pmf x) \\ x \\ None\"\nby(cases x) simp_all\n\nlemma lossless_map_pmf: \"lossless_spmf (map_pmf f p) \\ (\\x \\ set_pmf p. f x \\ None)\"\nusing image_iff by(fastforce simp add: lossless_iff_set_pmf_None)\n\nlemma bind_pmf_spmf_assoc:\n \"g None = return_pmf None\n \\ bind_pmf (bind_spmf p f) g = bind_spmf p (\\x. bind_pmf (f x) g)\"\nby(auto simp add: bind_spmf_def bind_assoc_pmf bind_return_pmf fun_eq_iff intro!: arg_cong2[where f=bind_pmf] split: option.split)\n\nabbreviation pred_spmf :: \"('a \\ bool) \\ 'a spmf \\ bool\"\nwhere \"pred_spmf P \\ pred_pmf (pred_option P)\"\n\nlemma pred_spmf_def: \"pred_spmf P p \\ (\\x\\set_spmf p. P x)\"\nby(auto simp add: pred_pmf_def pred_option_def set_spmf_def)\n\nlemma spmf_pred_mono_strong:\n \"\\ pred_spmf P p; \\a. \\ a \\ set_spmf p; P a \\ \\ P' a \\ \\ pred_spmf P' p\"\nby(simp add: pred_spmf_def)\n\nlemma spmf_Domainp_rel: \"Domainp (rel_spmf R) = pred_spmf (Domainp R)\"\nby(simp add: pmf.Domainp_rel option.Domainp_rel)\n\nlemma rel_spmf_restrict_relpI [intro?]:\n \"\\ rel_spmf R p q; pred_spmf P p; pred_spmf Q q \\ \\ rel_spmf (R \\ P \\ Q) p q\"\nby(erule spmf_rel_mono_strong)(simp add: pred_spmf_def)\n\nlemma rel_spmf_restrict_relpE [elim?]:\n assumes \"rel_spmf (R \\ P \\ Q) x y\"\n obtains \"rel_spmf R x y\" \"pred_spmf P x\" \"pred_spmf Q y\"\nproof\n show \"rel_spmf R x y\" using assms by(auto elim!: spmf_rel_mono_strong)\n have \"pred_spmf (Domainp (R \\ P \\ Q)) x\" using assms by(fold spmf_Domainp_rel) blast\n then show \"pred_spmf P x\" by(rule spmf_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n have \"pred_spmf (Domainp (R \\ P \\ Q)\\\\) y\" using assms\n by(fold spmf_Domainp_rel)(auto simp only: spmf_rel_conversep Domainp_conversep)\n then show \"pred_spmf Q y\" by(rule spmf_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_spmf_restrict_relp_iff:\n \"rel_spmf (R \\ P \\ Q) x y \\ rel_spmf R x y \\ pred_spmf P x \\ pred_spmf Q y\"\nby(blast intro: rel_spmf_restrict_relpI elim: rel_spmf_restrict_relpE)\n\nlemma spmf_pred_map: \"pred_spmf P (map_spmf f p) = pred_spmf (P \\ f) p\"\nby(simp)\n\nlemma pred_spmf_bind [simp]: \"pred_spmf P (bind_spmf p f) = pred_spmf (pred_spmf P \\ f) p\"\nby(simp add: pred_spmf_def bind_UNION)\n\nlemma pred_spmf_return: \"pred_spmf P (return_spmf x) = P x\"\nby simp\n\nlemma pred_spmf_return_pmf_None: \"pred_spmf P (return_pmf None)\"\nby simp\n\nlemma pred_spmf_spmf_of_pmf [simp]: \"pred_spmf P (spmf_of_pmf p) = pred_pmf P p\"\nunfolding pred_spmf_def by(simp add: pred_pmf_def)\n\nlemma pred_spmf_of_set [simp]: \"pred_spmf P (spmf_of_set A) = (finite A \\ Ball A P)\"\nby(auto simp add: pred_spmf_def set_spmf_of_set)\n\nlemma pred_spmf_assert_spmf [simp]: \"pred_spmf P (assert_spmf b) = (b \\ P ())\"\nby(cases b) simp_all\n\nlemma pred_spmf_pair [simp]:\n \"pred_spmf P (pair_spmf p q) = pred_spmf (\\x. pred_spmf (P \\ Pair x) q) p\"\nby(simp add: pred_spmf_def)\n\nlemma set_spmf_try [simp]:\n \"set_spmf (try_spmf p q) = set_spmf p \\ (if lossless_spmf p then {} else set_spmf q)\"\nby(auto simp add: try_spmf_def set_spmf_bind_pmf in_set_spmf lossless_iff_set_pmf_None split: option.splits)(metis option.collapse)\n\nlemma try_spmf_bind_out1:\n \"(\\x. lossless_spmf (f x)) \\ bind_spmf (TRY p ELSE q) f = TRY (bind_spmf p f) ELSE (bind_spmf q f)\"\n apply(clarsimp simp add: bind_spmf_def try_spmf_def bind_assoc_pmf bind_return_pmf intro!: bind_pmf_cong[OF refl] split: option.split)\n apply(rewrite in \"\\ = _\" bind_return_pmf'[symmetric])\n apply(rule bind_pmf_cong[OF refl])\n apply(clarsimp split: option.split simp add: lossless_iff_set_pmf_None)\n done\n\nlemma pred_spmf_try [simp]:\n \"pred_spmf P (try_spmf p q) = (pred_spmf P p \\ (\\ lossless_spmf p \\ pred_spmf P q))\"\nby(auto simp add: pred_spmf_def)\n\nlemma pred_spmf_cond [simp]:\n \"pred_spmf P (cond_spmf p A) = pred_spmf (\\x. x \\ A \\ P x) p\"\nby(auto simp add: pred_spmf_def)\n\nlemma spmf_rel_map_restrict_relp: \n shows spmf_rel_map_restrict_relp1: \"rel_spmf (R \\ P \\ Q) (map_spmf f p) = rel_spmf (R \\ f \\ P \\ f \\ Q) p\"\n and spmf_rel_map_restrict_relp2: \"rel_spmf (R \\ P \\ Q) p (map_spmf g q) = rel_spmf ((\\x. R x \\ g) \\ P \\ Q \\ g) p q\"\nby(simp_all add: spmf_rel_map restrict_relp_def)\n\nlemma pred_spmf_conj: \"pred_spmf (\\x. P x \\ Q x) = (\\x. pred_spmf P x \\ pred_spmf Q x)\"\nby simp\n\nlemma spmf_of_pmf_parametric [transfer_rule]: \n includes lifting_syntax shows\n \"(rel_pmf A ===> rel_spmf A) spmf_of_pmf spmf_of_pmf\"\nunfolding spmf_of_pmf_def[abs_def] by transfer_prover\n\nlemma mono2mono_return_pmf[THEN spmf.mono2mono, simp, cont_intro]: (* Move to SPMF *)\n shows monotone_return_pmf: \"monotone option_ord (ord_spmf (=)) return_pmf\"\nby(rule monotoneI)(auto simp add: flat_ord_def)\n\nlemma mcont2mcont_return_pmf[THEN spmf.mcont2mcont, simp, cont_intro]: (* Move to SPMF *)\n shows mcont_return_pmf: \"mcont (flat_lub None) option_ord lub_spmf (ord_spmf (=)) return_pmf\"\nby(rule mcont_finite_chains[OF _ _ flat_interpretation[THEN ccpo] ccpo_spmf]) simp_all\n\nlemma pred_spmf_top: (* Move up *)\n \"pred_spmf (\\_. True) = (\\_. True)\"\nby(simp)\n\nlemma rel_spmf_restrict_relpI' [intro?]:\n \"\\ rel_spmf (\\x y. P x \\ Q y \\ R x y) p q; pred_spmf P p; pred_spmf Q q \\ \\ rel_spmf (R \\ P \\ Q) p q\"\nby(erule spmf_rel_mono_strong)(simp add: pred_spmf_def)\n\nlemma set_spmf_map_pmf_MATCH [simp]:\n assumes \"NO_MATCH (map_option g) f\"\n shows \"set_spmf (map_pmf f p) = (\\x\\set_pmf p. set_option (f x))\"\nby(rule set_spmf_map_pmf)\n\nlemma rel_spmf_bindI':\n \"\\ rel_spmf A p q; \\x y. \\ A x y; x \\ set_spmf p; y \\ set_spmf q \\ \\ rel_spmf B (f x) (g y) \\\n \\ rel_spmf B (p \\ f) (q \\ g)\"\napply(rule rel_spmf_bindI[where R=\"\\x y. A x y \\ x \\ set_spmf p \\ y \\ set_spmf q\"])\n apply(erule spmf_rel_mono_strong; simp)\napply simp\ndone\n\ndefinition rel_witness_spmf :: \"('a \\ 'b \\ bool) \\ 'a spmf \\ 'b spmf \\ ('a \\ 'b) spmf\" where\n \"rel_witness_spmf A = map_pmf rel_witness_option \\ rel_witness_pmf (rel_option A)\"\n\nlemma assumes \"rel_spmf A p q\"\n shows rel_witness_spmf1: \"rel_spmf (\\a (a', b). a = a' \\ A a' b) p (rel_witness_spmf A (p, q))\"\n and rel_witness_spmf2: \"rel_spmf (\\(a, b') b. b = b' \\ A a b') (rel_witness_spmf A (p, q)) q\"\n by(auto simp add: pmf.rel_map rel_witness_spmf_def intro: pmf.rel_mono_strong[OF rel_witness_pmf1[OF assms]] rel_witness_option1 pmf.rel_mono_strong[OF rel_witness_pmf2[OF assms]] rel_witness_option2)\n\nlemma weight_assert_spmf [simp]: \"weight_spmf (assert_spmf b) = indicator {True} b\"\n by(simp split: split_indicator)\n\ndefinition enforce_spmf :: \"('a \\ bool) \\ 'a spmf \\ 'a spmf\" where\n \"enforce_spmf P = map_pmf (enforce_option P)\"\n\nlemma enforce_spmf_parametric [transfer_rule]: includes lifting_syntax shows\n \"((A ===> (=)) ===> rel_spmf A ===> rel_spmf A) enforce_spmf enforce_spmf\"\n unfolding enforce_spmf_def by transfer_prover\n\nlemma enforce_return_spmf [simp]:\n \"enforce_spmf P (return_spmf x) = (if P x then return_spmf x else return_pmf None)\"\n by(simp add: enforce_spmf_def)\n\nlemma enforce_return_pmf_None [simp]:\n \"enforce_spmf P (return_pmf None) = return_pmf None\"\n by(simp add: enforce_spmf_def)\n\nlemma enforce_map_spmf:\n \"enforce_spmf P (map_spmf f p) = map_spmf f (enforce_spmf (P \\ f) p)\"\n by(simp add: enforce_spmf_def pmf.map_comp o_def enforce_map_option)\n\nlemma enforce_bind_spmf [simp]:\n \"enforce_spmf P (bind_spmf p f) = bind_spmf p (enforce_spmf P \\ f)\"\n by(auto simp add: enforce_spmf_def bind_spmf_def map_bind_pmf intro!: bind_pmf_cong split: option.split)\n\nlemma set_enforce_spmf [simp]: \"set_spmf (enforce_spmf P p) = {a \\ set_spmf p. P a}\"\n by(auto simp add: enforce_spmf_def in_set_spmf)\n\nlemma enforce_spmf_alt_def:\n \"enforce_spmf P p = bind_spmf p (\\a. bind_spmf (assert_spmf (P a)) (\\_ :: unit. return_spmf a))\"\n by(auto simp add: enforce_spmf_def assert_spmf_def map_pmf_def bind_spmf_def bind_return_pmf intro!: bind_pmf_cong split: option.split)\n\nlemma bind_enforce_spmf [simp]:\n \"bind_spmf (enforce_spmf P p) f = bind_spmf p (\\x. if P x then f x else return_pmf None)\"\n by(auto simp add: enforce_spmf_alt_def assert_spmf_def intro!: bind_spmf_cong)\n\nlemma weight_enforce_spmf:\n \"weight_spmf (enforce_spmf P p) = weight_spmf p - measure (measure_spmf p) {x. \\ P x}\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = LINT x|measure_spmf p. indicator {x. P x} x\"\n by(auto simp add: enforce_spmf_alt_def weight_bind_spmf o_def simp del: Bochner_Integration.integral_indicator intro!: Bochner_Integration.integral_cong split: split_indicator)\n also have \"\\ = ?rhs\"\n by(subst measure_spmf.finite_measure_Diff[symmetric])(auto simp add: space_measure_spmf intro!: arg_cong2[where f=measure])\n finally show ?thesis .\nqed\n\nlemma lossless_enforce_spmf [simp]:\n \"lossless_spmf (enforce_spmf P p) \\ lossless_spmf p \\ set_spmf p \\ {x. P x}\"\n by(auto simp add: enforce_spmf_alt_def)\n\nlemma enforce_spmf_top [simp]: \"enforce_spmf \\ = id\"\n by(simp add: enforce_spmf_def)\n\nlemma enforce_spmf_K_True [simp]: \"enforce_spmf (\\_. True) p = p\"\n using enforce_spmf_top[THEN fun_cong, of p] by(simp add: top_fun_def)\n\nlemma enforce_spmf_bot [simp]: \"enforce_spmf \\ = (\\_. return_pmf None)\"\n by(simp add: enforce_spmf_def fun_eq_iff)\n\nlemma enforce_spmf_K_False [simp]: \"enforce_spmf (\\_. False) p = return_pmf None\"\n using enforce_spmf_bot[THEN fun_cong, of p] by(simp add: bot_fun_def)\n\nlemma enforce_pred_id_spmf: \"enforce_spmf P p = p\" if \"pred_spmf P p\"\nproof -\n have \"enforce_spmf P p = map_pmf id p\" using that\n by(auto simp add: enforce_spmf_def enforce_pred_id_option simp del: map_pmf_id intro!: pmf.map_cong_pred[OF refl] elim!: pmf_pred_mono_strong)\n then show ?thesis by simp\nqed\n\nlemma map_the_spmf_of_pmf [simp]: \"map_pmf the (spmf_of_pmf p) = p\"\n by(simp add: spmf_of_pmf_def pmf.map_comp o_def)\n\nlemma bind_bind_conv_pair_spmf:\n \"bind_spmf p (\\x. bind_spmf q (f x)) = bind_spmf (pair_spmf p q) (\\(x, y). f x y)\"\n by(simp add: pair_spmf_alt_def)\n\nlemma cond_spmf_spmf_of_set:\n \"cond_spmf (spmf_of_set A) B = spmf_of_set (A \\ B)\" if \"finite A\"\n by(rule spmf_eqI)(auto simp add: spmf_of_set measure_spmf_of_set that split: split_indicator)\n\nlemma pair_spmf_of_set:\n \"pair_spmf (spmf_of_set A) (spmf_of_set B) = spmf_of_set (A \\ B)\"\n by(rule spmf_eqI)(clarsimp simp add: spmf_of_set card_cartesian_product split: split_indicator)\n\nlemma emeasure_cond_spmf:\n \"emeasure (measure_spmf (cond_spmf p A)) B = emeasure (measure_spmf p) (A \\ B) / emeasure (measure_spmf p) A\"\n apply(clarsimp simp add: cond_spmf_def emeasure_measure_spmf_conv_measure_pmf emeasure_measure_pmf_zero_iff set_pmf_Int_Some split!: if_split)\n apply blast\n apply(subst (asm) emeasure_cond_pmf)\n by(auto simp add: set_pmf_Int_Some image_Int)\n\nlemma measure_cond_spmf:\n \"measure (measure_spmf (cond_spmf p A)) B = measure (measure_spmf p) (A \\ B) / measure (measure_spmf p) A\"\n apply(clarsimp simp add: cond_spmf_def measure_measure_spmf_conv_measure_pmf measure_pmf_zero_iff set_pmf_Int_Some split!: if_split)\n apply(subst (asm) measure_cond_pmf)\n by(auto simp add: image_Int set_pmf_Int_Some)\n\n\nlemma lossless_cond_spmf [simp]: \"lossless_spmf (cond_spmf p A) \\ set_spmf p \\ A \\ {}\"\n by(clarsimp simp add: cond_spmf_def lossless_iff_set_pmf_None set_pmf_Int_Some)\n\nlemma measure_spmf_eq_density: \"measure_spmf p = density (count_space UNIV) (spmf p)\"\n by(rule measure_eqI)(simp_all add: emeasure_density nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n\nlemma integral_measure_spmf:\n fixes f :: \"'a \\ 'b::{banach, second_countable_topology}\"\n assumes A: \"finite A\"\n shows \"(\\a. a \\ set_spmf M \\ f a \\ 0 \\ a \\ A) \\ (LINT x|measure_spmf M. f x) = (\\a\\A. spmf M a *\\<^sub>R f a)\"\n unfolding measure_spmf_eq_density\n apply (simp add: integral_density)\n apply (subst lebesgue_integral_count_space_finite_support)\n by (auto intro!: finite_subset[OF _ \\finite A\\] sum.mono_neutral_left simp: spmf_eq_0_set_spmf)\n\n\nlemma image_set_spmf_eq:\n \"f ` set_spmf p = g ` set_spmf q\" if \"ASSUMPTION (map_spmf f p = map_spmf g q)\"\n using that[unfolded ASSUMPTION_def, THEN arg_cong[where f=set_spmf]] by simp\n\nlemma map_spmf_const: \"map_spmf (\\_. x) p = scale_spmf (weight_spmf p) (return_spmf x)\"\n by(simp add: map_spmf_conv_bind_spmf bind_spmf_const)\n\nlemma cond_return_pmf [simp]: \"cond_pmf (return_pmf x) A = return_pmf x\" if \"x \\ A\"\n using that by(intro pmf_eqI)(auto simp add: pmf_cond split: split_indicator)\n\nlemma cond_return_spmf [simp]: \"cond_spmf (return_spmf x) A = (if x \\ A then return_spmf x else return_pmf None)\"\n by(simp add: cond_spmf_def)\n\nlemma measure_range_Some_eq_weight:\n \"measure (measure_pmf p) (range Some) = weight_spmf p\"\n by (simp add: measure_measure_spmf_conv_measure_pmf space_measure_spmf)\n\nlemma restrict_spmf_eq_return_pmf_None [simp]:\n \"restrict_spmf p A = return_pmf None \\ set_spmf p \\ A = {}\"\n by(auto 4 3 simp add: restrict_spmf_def map_pmf_eq_return_pmf_iff bind_UNION in_set_spmf bind_eq_None_conv option.the_def dest: bspec split: if_split_asm option.split_asm)\n\ndefinition mk_lossless :: \"'a spmf \\ 'a spmf\" where\n \"mk_lossless p = scale_spmf (inverse (weight_spmf p)) p\"\n\nlemma mk_lossless_idem [simp]: \"mk_lossless (mk_lossless p) = mk_lossless p\"\n by(simp add: mk_lossless_def weight_scale_spmf min_def max_def inverse_eq_divide) \n\nlemma mk_lossless_return [simp]: \"mk_lossless (return_pmf x) = return_pmf x\"\n by(cases x)(simp_all add: mk_lossless_def)\n\n\n\nlemma spmf_mk_lossless [simp]: \"spmf (mk_lossless p) x = spmf p x / weight_spmf p\"\n by(simp add: mk_lossless_def spmf_scale_spmf inverse_eq_divide max_def)\n\nlemma set_spmf_mk_lossless [simp]: \"set_spmf (mk_lossless p) = set_spmf p\"\n by(simp add: mk_lossless_def set_scale_spmf measure_spmf_zero_iff zero_less_measure_iff)\n\n\n\nlemma mk_lossless_eq_return_pmf_None [simp]: \"mk_lossless p = return_pmf None \\ p = return_pmf None\"\nproof -\n have aux: \"weight_spmf p = 0 \\ spmf p i = 0\" for i\n by(rule antisym, rule order_trans[OF spmf_le_weight]) (auto intro!: order_trans[OF spmf_le_weight])\n\n have[simp]: \" spmf (scale_spmf (inverse (weight_spmf p)) p) = spmf (return_pmf None) \\ spmf p i = 0\" for i\n by(drule fun_cong[where x=i]) (auto simp add: aux spmf_scale_spmf max_def)\n\n show ?thesis by(auto simp add: mk_lossless_def intro: spmf_eqI)\nqed\n\nlemma return_pmf_None_eq_mk_lossless [simp]: \"return_pmf None = mk_lossless p \\ p = return_pmf None\"\n by(metis mk_lossless_eq_return_pmf_None)\n\nlemma mk_lossless_spmf_of_set [simp]: \"mk_lossless (spmf_of_set A) = spmf_of_set A\"\n by(simp add: spmf_of_set_def del: spmf_of_pmf_pmf_of_set)\n\nlemma weight_mk_lossless: \"weight_spmf (mk_lossless p) = (if p = return_pmf None then 0 else 1)\"\n by(simp add: mk_lossless_def weight_scale_spmf min_def max_def inverse_eq_divide weight_spmf_eq_0)\n\nlemma mk_lossless_parametric [transfer_rule]: includes lifting_syntax shows\n \"(rel_spmf A ===> rel_spmf A) mk_lossless mk_lossless\"\n by(simp add: mk_lossless_def rel_fun_def rel_spmf_weightD rel_spmf_scaleI)\n\nlemma rel_spmf_mk_losslessI:\n \"rel_spmf A p q \\ rel_spmf A (mk_lossless p) (mk_lossless q)\"\n by(rule mk_lossless_parametric[THEN rel_funD])\n\nlemma rel_spmf_restrict_spmfI:\n \"rel_spmf (\\x y. (x \\ A \\ y \\ B \\ R x y) \\ x \\ A \\ y \\ B) p q\n \\ rel_spmf R (restrict_spmf p A) (restrict_spmf q B)\"\n by(auto simp add: restrict_spmf_def pmf.rel_map elim!: option.rel_cases pmf.rel_mono_strong)\n\nlemma cond_spmf_alt: \"cond_spmf p A = mk_lossless (restrict_spmf p A)\"\nproof(cases \"set_spmf p \\ A = {}\")\n case True\n then show ?thesis by(simp add: cond_spmf_def measure_spmf_zero_iff)\nnext\n case False\n show ?thesis\n by(rule spmf_eqI)(simp add: False cond_spmf_def pmf_cond set_pmf_Int_Some image_iff measure_measure_spmf_conv_measure_pmf[symmetric] spmf_scale_spmf max_def inverse_eq_divide)\nqed\n\nlemma cond_spmf_bind:\n \"cond_spmf (bind_spmf p f) A = mk_lossless (p \\ (\\x. f x \\ A))\"\n by(simp add: cond_spmf_alt restrict_bind_spmf scale_bind_spmf)\n\nlemma cond_spmf_UNIV [simp]: \"cond_spmf p UNIV = mk_lossless p\"\n by(clarsimp simp add: cond_spmf_alt)\n\nlemma cond_pmf_singleton:\n \"cond_pmf p A = return_pmf x\" if \"set_pmf p \\ A = {x}\"\nproof -\n have[simp]: \"set_pmf p \\ A = {x} \\ x \\ A \\ measure_pmf.prob p A = pmf p x\"\n by(auto simp add: measure_pmf_single[symmetric] AE_measure_pmf_iff intro!: measure_pmf.finite_measure_eq_AE)\n\n have \"pmf (cond_pmf p A) i = pmf (return_pmf x) i\" for i\n using that by(auto simp add: pmf_cond measure_pmf_zero_iff pmf_eq_0_set_pmf split: split_indicator)\n\n then show ?thesis by(rule pmf_eqI)\nqed\n\n\ndefinition cond_spmf_fst :: \"('a \\ 'b) spmf \\ 'a \\ 'b spmf\" where\n \"cond_spmf_fst p a = map_spmf snd (cond_spmf p ({a} \\ UNIV))\"\n\nlemma cond_spmf_fst_return_spmf [simp]:\n \"cond_spmf_fst (return_spmf (x, y)) x = return_spmf y\"\n by(simp add: cond_spmf_fst_def)\n\nlemma cond_spmf_fst_map_Pair [simp]: \"cond_spmf_fst (map_spmf (Pair x) p) x = mk_lossless p\"\n by(clarsimp simp add: cond_spmf_fst_def spmf.map_comp o_def)\n\nlemma cond_spmf_fst_map_Pair' [simp]: \"cond_spmf_fst (map_spmf (\\y. (x, f y)) p) x = map_spmf f (mk_lossless p)\"\n by(subst spmf.map_comp[where f=\"Pair x\", symmetric, unfolded o_def]) simp\n\nlemma cond_spmf_fst_eq_return_None [simp]: \"cond_spmf_fst p x = return_pmf None \\ x \\ fst ` set_spmf p\"\n by(auto 4 4 simp add: cond_spmf_fst_def map_pmf_eq_return_pmf_iff in_set_spmf[symmetric] dest: bspec[where x=\"Some _\"] intro: ccontr rev_image_eqI)\n\nlemma cond_spmf_fst_map_Pair1:\n \"cond_spmf_fst (map_spmf (\\x. (f x, g x)) p) (f x) = return_spmf (g (inv_into (set_spmf p) f (f x)))\"\n if \"x \\ set_spmf p\" \"inj_on f (set_spmf p)\"\nproof -\n let ?foo=\"\\y. map_option (\\x. (f x, g x)) -` Some ` ({f y} \\ UNIV)\"\n have[simp]: \"y \\ set_spmf p \\ f x = f y \\ set_pmf p \\ (?foo y) \\ {}\" for y\n by(auto simp add: vimage_def image_def in_set_spmf)\n\n have[simp]: \"y \\ set_spmf p \\ f x = f y \\ map_spmf snd (map_spmf (\\x. (f x, g x)) (cond_pmf p (?foo y))) = return_spmf (g x)\" for y\n using that by(subst cond_pmf_singleton[where x=\"Some x\"]) (auto simp add: in_set_spmf elim: inj_onD)\n\n show ?thesis\n using that\n by(auto simp add: cond_spmf_fst_def cond_spmf_def)\n (erule notE, subst cond_map_pmf, simp_all)\nqed\n\nlemma lossless_cond_spmf_fst [simp]: \"lossless_spmf (cond_spmf_fst p x) \\ x \\ fst ` set_spmf p\"\n by(auto simp add: cond_spmf_fst_def intro: rev_image_eqI)\n\nlemma cond_spmf_fst_inverse:\n \"bind_spmf (map_spmf fst p) (\\x. map_spmf (Pair x) (cond_spmf_fst p x)) = p\"\n (is \"?lhs = ?rhs\")\nproof(rule spmf_eqI)\n fix i :: \"'a \\ 'b\"\n have *: \"({x} \\ UNIV \\ (Pair x \\ snd) -` {i}) = (if x = fst i then {i} else {})\" for x by(cases i)auto\n have \"spmf ?lhs i = LINT x|measure_spmf (map_spmf fst p). spmf (map_spmf (Pair x \\ snd) (cond_spmf p ({x} \\ UNIV))) i\"\n by(auto simp add: spmf_bind spmf.map_comp[symmetric] cond_spmf_fst_def intro!: integral_cong_AE)\n also have \"\\ = LINT x|measure_spmf (map_spmf fst p). measure (measure_spmf (cond_spmf p ({x} \\ UNIV))) ((Pair x \\ snd) -` {i})\"\n by(rule integral_cong_AE)(auto simp add: spmf_map)\n also have \"\\ = LINT x|measure_spmf (map_spmf fst p). measure (measure_spmf p) ({x} \\ UNIV \\ (Pair x \\ snd) -` {i}) /\n measure (measure_spmf p) ({x} \\ UNIV)\"\n by(rule integral_cong_AE; clarsimp simp add: measure_cond_spmf)\n also have \"\\ = spmf (map_spmf fst p) (fst i) * spmf p i / measure (measure_spmf p) ({fst i} \\ UNIV)\"\n by(simp add: * if_distrib[where f=\"measure (measure_spmf _)\"] cong: if_cong)\n (subst integral_measure_spmf[where A=\"{fst i}\"]; auto split: if_split_asm simp add: spmf_conv_measure_spmf)\n also have \"\\ = spmf p i\"\n by(clarsimp simp add: spmf_map vimage_fst)(metis (no_types, lifting) Int_insert_left_if1 in_set_spmf_iff_spmf insertI1 insert_UNIV insert_absorb insert_not_empty measure_spmf_zero_iff mem_Sigma_iff prod.collapse)\n finally show \"spmf ?lhs i = spmf ?rhs i\" .\nqed\n\nsubsubsection \\Embedding of @{typ \"'a option\"} into @{typ \"'a spmf\"}\\\n\ntext \\This theoretically follows from the embedding between @{typ \"_ id\"} into @{typ \"_ prob\"} and the isomorphism\n between @{typ \"(_, _ prob) optionT\"} and @{typ \"_ spmf\"}, but we would only get the monomorphic\n version via this connection. So we do it directly.\n\\\n\nlemma bind_option_spmf_monad [simp]: \"monad.bind_option (return_pmf None) x = bind_spmf (return_pmf x)\"\nby(cases x)(simp_all add: fun_eq_iff)\n\nlocale option_to_spmf begin\n\ntext \\\n We have to get the embedding into the lifting package such that we can use the parametrisation of transfer rules.\n\\\n\ndefinition the_pmf :: \"'a pmf \\ 'a\" where \"the_pmf p = (THE x. p = return_pmf x)\"\n\nlemma the_pmf_return [simp]: \"the_pmf (return_pmf x) = x\"\nby(simp add: the_pmf_def)\n\nlemma type_definition_option_spmf: \"type_definition return_pmf the_pmf {x. \\y :: 'a option. x = return_pmf y}\"\nby unfold_locales(auto)\n\ncontext begin\nprivate setup_lifting type_definition_option_spmf\nabbreviation cr_spmf_option where \"cr_spmf_option \\ cr_option\"\nabbreviation pcr_spmf_option where \"pcr_spmf_option \\ pcr_option\"\nlemmas Quotient_spmf_option = Quotient_option\n and cr_spmf_option_def = cr_option_def\n and pcr_spmf_option_bi_unique = option.bi_unique\n and Domainp_pcr_spmf_option = option.domain\n and Domainp_pcr_spmf_option_eq = option.domain_eq\n and Domainp_pcr_spmf_option_par = option.domain_par\n and Domainp_pcr_spmf_option_left_total = option.domain_par_left_total\n and pcr_spmf_option_left_unique = option.left_unique\n and pcr_spmf_option_cr_eq = option.pcr_cr_eq\n and pcr_spmf_option_return_pmf_transfer = option.rep_transfer\n and pcr_spmf_option_right_total = option.right_total\n and pcr_spmf_option_right_unique = option.right_unique\n and pcr_spmf_option_def = pcr_option_def\nbundle spmf_option_lifting = [[Lifting.lifting_restore_internal \"Misc_CryptHOL.option.lifting\"]]\nend\n\n\ncontext includes lifting_syntax begin\n\nlemma return_option_spmf_transfer [transfer_parametric return_spmf_parametric, transfer_rule]:\n \"((=) ===> cr_spmf_option) return_spmf Some\"\nby(rule rel_funI)(simp add: cr_spmf_option_def)\n\nlemma map_option_spmf_transfer [transfer_parametric map_spmf_parametric, transfer_rule]:\n \"(((=) ===> (=)) ===> cr_spmf_option ===> cr_spmf_option) map_spmf map_option\"\nunfolding rel_fun_eq by(auto simp add: rel_fun_def cr_spmf_option_def)\n\nlemma fail_option_spmf_transfer [transfer_parametric return_spmf_None_parametric, transfer_rule]:\n \"cr_spmf_option (return_pmf None) None\"\nby(simp add: cr_spmf_option_def)\n\nlemma bind_option_spmf_transfer [transfer_parametric bind_spmf_parametric, transfer_rule]:\n \"(cr_spmf_option ===> ((=) ===> cr_spmf_option) ===> cr_spmf_option) bind_spmf Option.bind\"\napply(clarsimp simp add: rel_fun_def cr_spmf_option_def)\nsubgoal for x f g by(cases x; simp)\ndone\n\nlemma set_option_spmf_transfer [transfer_parametric set_spmf_parametric, transfer_rule]:\n \"(cr_spmf_option ===> rel_set (=)) set_spmf set_option\"\nby(clarsimp simp add: rel_fun_def cr_spmf_option_def rel_set_eq)\n\nlemma rel_option_spmf_transfer [transfer_parametric rel_spmf_parametric, transfer_rule]:\n \"(((=) ===> (=) ===> (=)) ===> cr_spmf_option ===> cr_spmf_option ===> (=)) rel_spmf rel_option\"\nunfolding rel_fun_eq by(simp add: rel_fun_def cr_spmf_option_def)\n\nend\n\nend\n\nlocale option_le_spmf begin\n\ntext \\\n Embedding where only successful computations in the option monad are related to Dirac spmf.\n\\\n\ndefinition cr_option_le_spmf :: \"'a option \\ 'a spmf \\ bool\"\nwhere \"cr_option_le_spmf x p \\ ord_spmf (=) (return_pmf x) p\"\n\ncontext includes lifting_syntax begin\n\nlemma return_option_le_spmf_transfer [transfer_rule]:\n \"((=) ===> cr_option_le_spmf) (\\x. x) return_pmf\"\nby(rule rel_funI)(simp add: cr_option_le_spmf_def ord_option_reflI)\n\nlemma map_option_le_spmf_transfer [transfer_rule]:\n \"(((=) ===> (=)) ===> cr_option_le_spmf ===> cr_option_le_spmf) map_option map_spmf\"\nunfolding rel_fun_eq\napply(clarsimp simp add: rel_fun_def cr_option_le_spmf_def rel_pmf_return_pmf1 ord_option_map1 ord_option_map2)\nsubgoal for f x p y by(cases x; simp add: ord_option_reflI)\ndone\n\nlemma bind_option_le_spmf_transfer [transfer_rule]:\n \"(cr_option_le_spmf ===> ((=) ===> cr_option_le_spmf) ===> cr_option_le_spmf) Option.bind bind_spmf\"\napply(clarsimp simp add: rel_fun_def cr_option_le_spmf_def)\nsubgoal for x p f g by(cases x; auto 4 3 simp add: rel_pmf_return_pmf1 set_pmf_bind_spmf)\ndone\n\nend\n\nend\n\ninterpretation rel_spmf_characterisation by unfold_locales(rule rel_pmf_measureI)\n\nlemma if_distrib_bind_spmf1 [if_distribs]:\n \"bind_spmf (if b then x else y) f = (if b then bind_spmf x f else bind_spmf y f)\"\nby simp\n\nlemma if_distrib_bind_spmf2 [if_distribs]:\n \"bind_spmf x (\\y. if b then f y else g y) = (if b then bind_spmf x f else bind_spmf x g)\"\nby simp\n\nlemma rel_spmf_if_distrib [if_distribs]:\n \"rel_spmf R (if b then x else y) (if b then x' else y') \\\n (b \\ rel_spmf R x x') \\ (\\ b \\ rel_spmf R y y')\"\nby(simp)\n\nlemma if_distrib_map_spmf [if_distribs]:\n \"map_spmf f (if b then p else q) = (if b then map_spmf f p else map_spmf f q)\"\nby simp\n\nlemma if_distrib_restrict_spmf1 [if_distribs]:\n \"restrict_spmf (if b then p else q) A = (if b then restrict_spmf p A else restrict_spmf q A)\"\nby simp\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CryptHOL/Misc_CryptHOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.2955139675052756}} {"text": "(*\nTiTitle: Value-Dependent SIFUM-Type-Systems\nAuthors: Toby Murray, Robert Sison, Edward Pierzchalski, Christine Rizkallah\n(Based on the SIFUM-Type-Systems AFP entry, whose authors\n are: Sylvia Grewe, Heiko Mantel, Daniel Schoepe)\n*)\nsection \\Type System for Ensuring Locally Sound Use of Modes\\\n\ntheory LocallySoundModeUse\nimports Security Language\nbegin\n\nsubsection \\Typing Rules\\\n\nlocale sifum_modes = \n sifum_lang_no_dma ev\\<^sub>A ev\\<^sub>B aexp_vars bexp_vars + sifum_security dma \\_vars \\ eval\\<^sub>w undefined\n for ev\\<^sub>A :: \"('Var, 'Val) Mem \\ 'AExp \\ 'Val\"\n and ev\\<^sub>B :: \"('Var, 'Val) Mem \\ 'BExp \\ bool\"\n and aexp_vars :: \"'AExp \\ 'Var set\"\n and bexp_vars :: \"'BExp \\ 'Var set\"\n and dma :: \"('Var,'Val) Mem \\ 'Var \\ Sec\"\n and \\_vars :: \"'Var \\ 'Var set\"\n and \\ :: \"'Var set\"\n\ncontext sifum_modes\nbegin\n\nabbreviation \n eval_abv_modes :: \"(_, 'Var, 'Val) LocalConf \\ (_, _, _) LocalConf \\ bool\"\n (infixl \"\\\" 70)\nwhere\n \"x \\ y \\ (x, y) \\ eval\\<^sub>w\"\n\nfun \n update_annos :: \"'Var Mds \\ 'Var ModeUpd list \\ 'Var Mds\"\n (infix \"\\\" 140)\nwhere\n \"update_annos mds [] = mds\" |\n \"update_annos mds (a # as) = update_annos (update_modes a mds) as\"\n\nfun \n annotate :: \"('Var, 'AExp, 'BExp) Stmt \\ 'Var ModeUpd list \\ ('Var, 'AExp, 'BExp) Stmt\"\n (infix \"\\\" 140)\nwhere\n \"annotate c [] = c\" |\n \"annotate c (a # as) = (annotate c as)@[a]\"\n\ninductive \n mode_type :: \"'Var Mds \\ ('Var, 'AExp, 'BExp) Stmt \\ 'Var Mds \\ bool\" (\"\\ _ { _ } _\")\nwhere\n skip: \"\\ mds { Skip \\ annos } (mds \\ annos)\" |\n assign: \"\\ x \\ mds GuarNoWrite \\ mds GuarNoReadOrWrite ; aexp_vars e \\ mds GuarNoReadOrWrite = {};\n \\v. (x \\ \\_vars v \\ v \\ mds GuarNoWrite \\ mds GuarNoReadOrWrite) \\\n (\\_vars v \\ aexp_vars e \\ {} \\ v \\ mds GuarNoReadOrWrite)\\ \\\n \\ mds { (x \\ e) \\ annos } (mds \\ annos)\" |\n if_: \"\\ \\ (mds \\ annos) { c\\<^sub>1 } mds'' ;\n \\ (mds \\ annos) { c\\<^sub>2 } mds'' ;\n bexp_vars e \\ mds GuarNoReadOrWrite = {};\n \\ v. \\_vars v \\ bexp_vars e \\ {} \\ v \\ mds GuarNoReadOrWrite\\ \\\n \\ mds { If e c\\<^sub>1 c\\<^sub>2 \\ annos } mds''\" |\n while: \"\\ mds' = mds \\ annos ; \\ mds' { c } mds' ; bexp_vars e \\ mds' GuarNoReadOrWrite = {};\n \\ v. \\_vars v \\ bexp_vars e \\ {} \\ v \\ mds' GuarNoReadOrWrite\\ \\\n \\ mds { While e c \\ annos } mds'\" |\n seq: \"\\ \\ mds { c\\<^sub>1 } mds' ; \\ mds' { c\\<^sub>2 } mds'' \\ \\ \\ mds { c\\<^sub>1 ;; c\\<^sub>2 } mds''\" |\n sub: \"\\ \\ mds\\<^sub>2 { c } mds\\<^sub>2' ; mds\\<^sub>1 \\ mds\\<^sub>2 ; mds\\<^sub>2' \\ mds\\<^sub>1' \\ \\\n \\ mds\\<^sub>1 { c } mds\\<^sub>1'\"\n\nsubsection \\Soundness of the Type System\\\n\n(* Special case for evaluation with an empty context *)\n\n\nlemma update_preserves_le:\n \"mds\\<^sub>1 \\ mds\\<^sub>2 \\ (mds\\<^sub>1 \\ annos) \\ (mds\\<^sub>2 \\ annos)\"\nproof (induct annos arbitrary: mds\\<^sub>1 mds\\<^sub>2)\n case Nil\n thus ?case by simp\nnext\n case (Cons a annos mds\\<^sub>1 mds\\<^sub>2)\n hence \"update_modes a mds\\<^sub>1 \\ update_modes a mds\\<^sub>2\"\n by (case_tac a, auto simp: le_fun_def)\n with Cons show ?case\n by auto\nqed\n\n(* Annotations do not affect doesnt_read and doesnt_modify: *)\nlemma doesnt_read_annos:\n \"doesnt_read_or_modify c x \\ doesnt_read_or_modify (c \\ annos) x\"\n unfolding doesnt_read_or_modify_def doesnt_read_or_modify_vars_def\n apply clarify\n apply (induct annos)\n apply simp\n apply (metis (lifting))\n apply clarsimp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.decl)\n apply (metis cxt_eval eval\\<^sub>w.decl upd_elim)+\n done\n\nlemma doesnt_modify_annos:\n \"doesnt_modify c x \\ doesnt_modify (c \\ annos) x\"\n unfolding doesnt_modify_def\n apply clarsimp\n apply (induct annos)\n apply simp \n by (metis annotate.simps(2) upd_elim)\n \n(* The following part contains some lemmas about evaluation of\n commands annotated using \\ and characterisations of loc_reach for\n commands. *)\n\nlemma stop_loc_reach:\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\Stop, mds, mem\\ \\ \\\n c' = Stop \\ mds' = mds\"\n apply (induct rule: loc_reach.induct)\n by (auto simp: stop_no_eval)\n\nlemma stop_doesnt_access:\n \"doesnt_modify Stop x \\ doesnt_read_or_modify Stop x\"\n unfolding doesnt_modify_def and doesnt_read_or_modify_def doesnt_read_or_modify_vars_def\n using stop_no_eval\n by auto\n\nlemma skip_eval_step:\n \"\\Skip \\ annos, mds, mem\\ \\ \\Stop, mds \\ annos, mem\\\"\n apply (induct annos arbitrary: mds)\n apply simp\n apply (metis cxt_to_stmt.simps(1) eval\\<^sub>w.unannotated eval\\<^sub>w_simple.skip)\n apply simp\n apply (insert eval\\<^sub>w.decl)\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.decl)\n by auto\n\nlemma skip_eval_elim:\n \"\\ \\Skip \\ annos, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\ c' = Stop \\ mds' = mds \\ annos \\ mem' = mem\"\n apply (rule ccontr)\n apply (insert skip_eval_step deterministic)\n apply clarify\n apply clarsimp\n by metis+\n\nlemma skip_doesnt_read:\n \"doesnt_read_or_modify (Skip \\ annos) x\"\n apply (rule doesnt_read_annos)\n apply (clarsimp simp: doesnt_read_or_modify_def doesnt_read_or_modify_vars_def)\n by (metis annotate.simps(1) skip_elim skip_eval_step)+\n\nlemma skip_doesnt_write:\n \"doesnt_modify (Skip \\ annos) x\"\n apply (rule doesnt_modify_annos)\n apply (clarsimp simp: doesnt_modify_def)\n by (metis skip_elim)+\n\nlemma skip_loc_reach:\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\Skip \\ annos, mds, mem\\ \\ \\\n (c' = Stop \\ mds' = (mds \\ annos)) \\ (c' = Skip \\ annos \\ mds' = mds)\"\n apply (induct rule: loc_reach.induct)\n apply (metis fst_conv snd_conv)\n apply (metis skip_eval_elim stop_no_eval)\n by metis\n\nlemma skip_doesnt_access:\n \"\\ lc \\ loc_reach \\Skip \\ annos, mds, mem\\ ; lc = \\c', mds', mem'\\ \\ \\ doesnt_read_or_modify c' x \\ doesnt_modify c' x\"\n apply (subgoal_tac \"(c' = Stop \\ mds' = (mds \\ annos)) \\ (c' = Skip \\ annos \\ mds' = mds)\")\n apply (rule conjI, erule disjE)\n apply (simp add: doesnt_read_or_modify_def doesnt_read_or_modify_vars_def stop_no_eval)\n apply (metis (lifting) annotate.simps skip_doesnt_read)\n apply (erule disjE)\n apply (simp add: doesnt_modify_def stop_no_eval)\n apply (metis (lifting) annotate.simps skip_doesnt_write)\n by (metis skip_loc_reach)\n\nlemma assign_doesnt_modify:\n \"\\ x \\ y; x \\ \\_vars y \\ \\ doesnt_modify ((x \\ e) \\ annos) y\"\n apply (rule doesnt_modify_annos)\n apply (simp add: doesnt_modify_def)\n by (metis assign_elim fun_upd_apply dma_\\_vars)\n \nlemma assign_annos_eval:\n \"\\(x \\ e) \\ annos, mds, mem\\ \\ \\Stop, mds \\ annos, mem (x := ev\\<^sub>A mem e)\\\"\n apply (induct annos arbitrary: mds)\n apply (simp only: annotate.simps update_annos.simps)\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (rule eval\\<^sub>w_simple.assign)\n apply (rule cxt_eval)\n apply (simp del: cxt_to_stmt.simps)\n apply (rule eval\\<^sub>w.decl)\n by auto\n\nlemma assign_annos_eval_elim:\n \"\\ \\(x \\ e) \\ annos, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\\n c' = Stop \\ mds' = mds \\ annos\"\n apply (rule ccontr)\n apply (insert deterministic assign_annos_eval)\n apply clarsimp\n by (metis (lifting))\n\nlemma mem_upd_commute:\n \"\\ x \\ y \\ \\ mem (x := v\\<^sub>1, y := v\\<^sub>2) = mem (y := v\\<^sub>2, x := v\\<^sub>1)\"\n by (metis fun_upd_twist)\n\nlemma assign_doesnt_read:\n \"\\ y \\ x; y \\ aexp_vars e; x \\ \\_vars y; \\_vars y \\ aexp_vars e = {} \\ \\ doesnt_read_or_modify ((x \\ e) \\ annos) y\"\n apply (rule doesnt_read_annos)\nproof -\n assume \"y \\ x\"\n \"y \\ aexp_vars e\"\n \"x \\ \\_vars y\"\n \"\\_vars y \\ aexp_vars e = {}\"\n thus \"doesnt_read_or_modify (x \\ e) y\"\n unfolding doesnt_read_or_modify_def doesnt_read_or_modify_vars_def\n apply -\n apply (rule allI)+\n apply (rename_tac mds mem c' mds' mem')\n apply (rule impI)\n apply (subgoal_tac \"c' = Stop \\ mds' = mds \\ mem' = mem (x := ev\\<^sub>A mem e)\")\n apply simp\n apply clarify\n apply (rule conjI)\n apply clarify\n apply (subgoal_tac \"mem (x := ev\\<^sub>A mem e, y := v) = mem (y := v, x := ev\\<^sub>A mem e)\")\n apply simp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated) \n apply (metis eval\\<^sub>w_simple.assign eval_vars_det\\<^sub>A fun_upd_apply)\n apply (metis mem_upd_commute)\n apply clarify\n apply (rename_tac va v)\n apply (subgoal_tac \"mem (x := ev\\<^sub>A mem e, va := v) = mem (va := v, x := ev\\<^sub>A mem e)\")\n apply simp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (subgoal_tac \"va \\ aexp_vars e\")\n apply (metis eval\\<^sub>w_simple.assign eval_vars_det\\<^sub>A fun_upd_apply)\n apply blast\n apply (metis mem_upd_commute)\n apply (metis assign_elim)\n done\nqed\n\nlemma assign_loc_reach:\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\(x \\ e) \\ annos, mds, mem\\ \\ \\\n (c' = Stop \\ mds' = (mds \\ annos)) \\ (c' = (x \\ e) \\ annos \\ mds' = mds)\"\n apply (induct rule: loc_reach.induct)\n apply simp_all\n by (metis assign_annos_eval_elim stop_no_eval)\n\nlemma if_doesnt_modify:\n \"doesnt_modify (If e c\\<^sub>1 c\\<^sub>2 \\ annos) x\"\n apply (rule doesnt_modify_annos)\n by (auto simp: doesnt_modify_def)\n\nlemma vars_eval\\<^sub>B:\n \"x \\ bexp_vars e \\ ev\\<^sub>B mem e = ev\\<^sub>B (mem (x := v)) e\"\n by (metis (lifting) eval_vars_det\\<^sub>B fun_upd_other)\n\nlemma if_doesnt_read:\n \"x \\ bexp_vars e \\ \\_vars x \\ bexp_vars e = {} \\ doesnt_read_or_modify (If e c\\<^sub>1 c\\<^sub>2 \\ annos) x\"\n apply (rule doesnt_read_annos)\n apply (clarsimp simp: doesnt_read_or_modify_def doesnt_read_or_modify_vars_def, safe)\n apply (rename_tac mds mem c' mds' mem' v)\n apply (case_tac \"ev\\<^sub>B mem e\")\n apply (subgoal_tac \"c' = c\\<^sub>1 \\ mds' = mds \\ mem' = mem\")\n prefer 2\n apply auto[1]\n apply clarsimp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (rule eval\\<^sub>w_simple.if_true)\n apply (metis (lifting) vars_eval\\<^sub>B)\n apply (subgoal_tac \"c' = c\\<^sub>2 \\ mds' = mds \\ mem' = mem\")\n prefer 2\n apply auto[1]\n apply clarsimp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (rule eval\\<^sub>w_simple.if_false)\n apply (metis (lifting) vars_eval\\<^sub>B)\n apply (rename_tac mds mem c' mds' mem' va v)\n apply (case_tac \"ev\\<^sub>B mem e\")\n apply (subgoal_tac \"c' = c\\<^sub>1 \\ mds' = mds \\ mem' = mem\")\n prefer 2\n apply auto[1]\n apply clarsimp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (rule eval\\<^sub>w_simple.if_true)\n apply (subgoal_tac \"va \\ bexp_vars e\")\n apply (metis (lifting) vars_eval\\<^sub>B)\n apply blast\n apply (subgoal_tac \"c' = c\\<^sub>2 \\ mds' = mds \\ mem' = mem\")\n prefer 2\n apply auto[1]\n apply clarsimp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (rule eval\\<^sub>w_simple.if_false)\n apply (subgoal_tac \"va \\ bexp_vars e\")\n apply (metis (lifting) vars_eval\\<^sub>B)\n apply blast\n done\n \nlemma if_eval_true:\n \"\\ ev\\<^sub>B mem e \\ \\\n \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds, mem\\ \\ \\c\\<^sub>1, mds \\ annos, mem\\\"\n apply (induct annos arbitrary: mds)\n apply simp\n apply (metis cxt_eval eval\\<^sub>w.unannotated eval\\<^sub>w_simple.if_true)\n by (metis annotate.simps(2) cxt_eval eval\\<^sub>w.decl update_annos.simps(2))\n\nlemma if_eval_false:\n \"\\ \\ ev\\<^sub>B mem e \\ \\\n \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds, mem\\ \\ \\c\\<^sub>2, mds \\ annos, mem\\\"\n apply (induct annos arbitrary: mds)\n apply simp\n apply (metis cxt_eval eval\\<^sub>w.unannotated eval\\<^sub>w_simple.if_false)\n by (metis annotate.simps(2) cxt_eval eval\\<^sub>w.decl update_annos.simps(2))\n\nlemma if_eval_elim:\n \"\\ \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\\n ((c' = c\\<^sub>1 \\ ev\\<^sub>B mem e) \\ (c' = c\\<^sub>2 \\ \\ ev\\<^sub>B mem e)) \\ mds' = mds \\ annos \\ mem' = mem\"\n apply (rule ccontr)\n apply (cases \"ev\\<^sub>B mem e\")\n apply (insert if_eval_true deterministic)\n apply blast\n using if_eval_false deterministic\n by blast\n\nlemma if_eval_elim':\n \"\\ \\If e c\\<^sub>1 c\\<^sub>2, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\\n ((c' = c\\<^sub>1 \\ ev\\<^sub>B mem e) \\ (c' = c\\<^sub>2 \\ \\ ev\\<^sub>B mem e)) \\ mds' = mds \\ mem' = mem\"\n using if_eval_elim [where annos = \"[]\"]\n by auto\n\nlemma loc_reach_refl':\n \"\\c, mds, mem\\ \\ loc_reach \\c, mds, mem\\\"\n apply (subgoal_tac \"\\ lc. lc \\ loc_reach lc \\ lc = \\c, mds, mem\\\")\n apply blast\n by (metis loc_reach.refl fst_conv snd_conv)\n\nlemma if_loc_reach:\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds, mem\\ \\ \\\n (c' = If e c\\<^sub>1 c\\<^sub>2 \\ annos \\ mds' = mds) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>1, mds \\ annos, mem''\\) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds \\ annos, mem''\\)\"\n apply (induct rule: loc_reach.induct)\n apply (metis fst_conv snd_conv)\n apply (erule disjE)\n apply (erule conjE)\n apply simp\n apply (drule if_eval_elim)\n apply (erule conjE)+\n apply (erule disjE)\n apply (erule conjE)\n apply simp\n apply (metis loc_reach_refl')\n apply (metis loc_reach_refl')\n apply (metis loc_reach.step)\n by (metis loc_reach.mem_diff)\n\nlemma if_loc_reach':\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\If e c\\<^sub>1 c\\<^sub>2, mds, mem\\ \\ \\\n (c' = If e c\\<^sub>1 c\\<^sub>2 \\ mds' = mds) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>1, mds, mem''\\) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds, mem''\\)\"\n using if_loc_reach [where annos = \"[]\"]\n by simp\n\nlemma seq_loc_reach:\n \"\\ \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>1 ;; c\\<^sub>2, mds, mem\\ \\ \\\n (\\ c''. c' = c'' ;; c\\<^sub>2 \\ \\c'', mds', mem'\\ \\ loc_reach \\c\\<^sub>1, mds, mem\\) \\\n (\\ c'' mds'' mem''. \\Stop, mds'', mem''\\ \\ loc_reach \\c\\<^sub>1, mds, mem\\ \\ \n \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds'', mem''\\)\"\n apply (induct rule: loc_reach.induct)\n apply simp\n apply (metis loc_reach_refl')\n apply simp\n apply (metis (no_types) loc_reach.step loc_reach_refl' seq_elim seq_stop_elim)\n by (metis (lifting) loc_reach.mem_diff)\n\nlemma seq_doesnt_read:\n \"\\ doesnt_read_or_modify c x \\ \\ doesnt_read_or_modify (c ;; c') x\"\n apply (clarsimp simp: doesnt_read_or_modify_def doesnt_read_or_modify_vars_def | safe)+\n apply (rename_tac mds mem c'a mds' mem' v)\n apply (case_tac \"c = Stop\")\n apply clarsimp\n apply (subgoal_tac \"c'a = c' \\ mds' = mds \\ mem' = mem\")\n apply simp\n apply (metis cxt_eval eval\\<^sub>w.unannotated eval\\<^sub>w_simple.seq_stop)\n apply (metis (lifting) seq_stop_elim)\n apply (metis (lifting, no_types) eval\\<^sub>w.seq seq_elim)\n apply (rename_tac mds mem c'a mds' mem' va v)\n apply (case_tac \"c = Stop\")\n apply clarsimp\n apply (subgoal_tac \"c'a = c' \\ mds' = mds \\ mem' = mem\")\n apply simp\n apply (metis cxt_eval eval\\<^sub>w.unannotated eval\\<^sub>w_simple.seq_stop)\n apply (metis (lifting) seq_stop_elim)\n apply (metis (lifting, no_types) eval\\<^sub>w.seq seq_elim)\n done\n \n\n\n\n\nlemma seq_split:\n \"\\ \\Stop, mds', mem'\\ \\ loc_reach \\c\\<^sub>1 ;; c\\<^sub>2, mds, mem\\ \\ \\\n \\ mds'' mem''. \\Stop, mds'', mem''\\ \\ loc_reach \\c\\<^sub>1, mds, mem\\ \\\n \\Stop, mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds'', mem''\\\"\n apply (drule seq_loc_reach)\n by (metis Stmt.simps(49))\n\nlemma while_eval:\n \"\\While e c \\ annos, mds, mem\\ \\ \\(If e (c ;; While e c) Stop), mds \\ annos, mem\\\"\n apply (induct annos arbitrary: mds)\n apply simp\n apply (rule cxt_eval)\n apply (rule eval\\<^sub>w.unannotated)\n apply (metis (lifting) eval\\<^sub>w_simple.while)\n apply simp\n by (metis cxt_eval eval\\<^sub>w.decl)\n\nlemma while_eval':\n \"\\While e c, mds, mem\\ \\ \\If e (c ;; While e c) Stop, mds, mem\\\"\n using while_eval [where annos = \"[]\"]\n by auto\n\nlemma while_eval_elim:\n \"\\ \\While e c \\ annos, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\\n (c' = If e (c ;; While e c) Stop \\ mds' = mds \\ annos \\ mem' = mem)\"\n apply (rule ccontr)\n apply (insert while_eval deterministic)\n by blast\n\nlemma while_eval_elim':\n \"\\ \\While e c, mds, mem\\ \\ \\c', mds', mem'\\ \\ \\\n (c' = If e (c ;; While e c) Stop \\ mds' = mds \\ mem' = mem)\"\n using while_eval_elim [where annos = \"[]\"]\n by auto\n\nlemma while_doesnt_read:\n \"\\ x \\ bexp_vars e \\ \\ doesnt_read_or_modify (While e c \\ annos) x\"\n unfolding doesnt_read_or_modify_def doesnt_read_or_modify_vars_def\n using while_eval while_eval_elim\n by metis\n\nlemma while_doesnt_modify:\n \"doesnt_modify (While e c \\ annos) x\"\n unfolding doesnt_modify_def\n using while_eval_elim\n by metis\n\n(* TODO: try to find a better solution to this: *)\nlemma disjE3:\n \"\\ A \\ B \\ C ; A \\ P ; B \\ P ; C \\ P \\ \\ P\"\n by auto\n\nlemma disjE5:\n \"\\ A \\ B \\ C \\ D \\ E ; A \\ P ; B \\ P ; C \\ P ; D \\ P ; E \\ P \\ \\ P\"\n by auto\n\nlemma if_doesnt_read':\n \"x \\ bexp_vars e \\ \\_vars x \\ bexp_vars e = {} \\ doesnt_read_or_modify (If e c\\<^sub>1 c\\<^sub>2) x\"\n using if_doesnt_read [where annos = \"[]\"]\n by auto\n\ntheorem mode_type_sound:\n assumes typeable: \"\\ mds\\<^sub>1 { c } mds\\<^sub>1'\"\n assumes mode_le: \"mds\\<^sub>2 \\ mds\\<^sub>1\"\n shows \"\\ mem. (\\Stop, mds\\<^sub>2', mem'\\ \\ loc_reach \\c, mds\\<^sub>2, mem\\ \\ mds\\<^sub>2' \\ mds\\<^sub>1') \\ \n locally_sound_mode_use \\c, mds\\<^sub>2, mem\\\"\n using typeable mode_le\nproof (induct arbitrary: mds\\<^sub>2 mds\\<^sub>2' mem' mem rule: mode_type.induct)\n case (skip mds annos)\n thus ?case\n apply (clarsimp, intro conjI)\n apply (metis (lifting) skip_eval_step skip_loc_reach stop_no_eval update_preserves_le)\n apply (simp add: locally_sound_mode_use_def)\n by (metis annotate.simps skip_doesnt_access)\nnext\n case (assign x mds e annos)\n hence \"\\ mem. locally_sound_mode_use \\(x \\ e) \\ annos, mds\\<^sub>2, mem\\\"\n unfolding locally_sound_mode_use_def\n proof (clarify)\n fix mem c' mds' mem' y\n assume asm: \"\\c', mds', mem'\\ \\ loc_reach \\(x \\ e) \\ annos, mds\\<^sub>2, mem\\\"\n hence \"c' = (x \\ e) \\ annos \\ mds' = mds\\<^sub>2 \\ c' = Stop \\ mds' = mds\\<^sub>2 \\ annos\"\n using assign_loc_reach by blast\n thus \"(y \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' y) \\\n (y \\ mds' GuarNoWrite \\ doesnt_modify c' y)\"\n proof\n assume \"c' = (x \\ e) \\ annos \\ mds' = mds\\<^sub>2\"\n thus ?thesis\n proof (safe)\n assume nin: \"y \\ mds\\<^sub>2 GuarNoReadOrWrite\"\n hence nin: \"y \\ mds GuarNoReadOrWrite\"\n using assign.prems unfolding le_fun_def by blast\n hence \"y \\ aexp_vars e\"\n by (metis IntD2 IntI assign.hyps(2) assign.prems empty_iff inf_apply le_iff_inf)\n moreover from nin assign.hyps(3) have \"\\_vars y \\ aexp_vars e = {}\"\n by (meson contra_subsetD)\n moreover from nin assign.hyps have \"x \\ \\_vars y \\ x \\ y\"\n by blast\n ultimately show \"doesnt_read_or_modify ((x \\ e) \\ annos) y\"\n using assign_doesnt_read\n by fastforce\n next\n assume \"y \\ mds\\<^sub>2 GuarNoWrite\"\n hence nin: \"y \\ mds GuarNoWrite\"\n using assign.prems unfolding le_fun_def by blast\n hence \"x \\ y \\ x \\ \\_vars y\"\n using assign by blast\n with assign_doesnt_modify show \"doesnt_modify ((x \\ e) \\ annos) y\"\n by blast\n qed\n next\n assume \"c' = Stop \\ mds' = mds\\<^sub>2 \\ annos\"\n with stop_doesnt_access show ?thesis by blast\n qed\n qed\n thus ?case\n apply clarsimp\n by (metis assign.prems assign_annos_eval assign_loc_reach stop_no_eval update_preserves_le)\nnext\n case (if_ mds annos c\\<^sub>1 mds'' c\\<^sub>2 e)\n let ?c = \"(If e c\\<^sub>1 c\\<^sub>2) \\ annos\"\n from if_ have modes_le': \"mds\\<^sub>2 \\ annos \\ mds \\ annos\"\n by (metis (lifting) update_preserves_le)\n from if_ show ?case\n apply (simp add: locally_sound_mode_use_def)\n apply clarify\n apply (rule conjI)\n apply clarify\n prefer 2\n apply clarify\n proof -\n fix mem\n assume \"\\Stop, mds\\<^sub>2', mem'\\ \\ loc_reach \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds\\<^sub>2, mem\\\"\n with modes_le' and if_ show \"mds\\<^sub>2' \\ mds''\"\n by (metis if_eval_false if_eval_true if_loc_reach stop_no_eval)\n next\n fix mem c' mds' mem' x\n assume \"\\c', mds', mem'\\ \\ loc_reach \\If e c\\<^sub>1 c\\<^sub>2 \\ annos, mds\\<^sub>2, mem\\\"\n hence \"(c' = If e c\\<^sub>1 c\\<^sub>2 \\ annos \\ mds' = mds\\<^sub>2) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>1, mds\\<^sub>2 \\ annos, mem''\\) \\\n (\\ mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds\\<^sub>2 \\ annos, mem''\\)\"\n using if_loc_reach by blast\n thus \"(x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n proof\n assume \"c' = If e c\\<^sub>1 c\\<^sub>2 \\ annos \\ mds' = mds\\<^sub>2\"\n thus ?thesis\n proof (safe)\n assume \"x \\ mds\\<^sub>2 GuarNoReadOrWrite\"\n hence nin: \"x \\ mds GuarNoReadOrWrite\"\n using if_ unfolding le_fun_def by auto\n with \\bexp_vars e \\ mds GuarNoReadOrWrite = {}\\ have \"x \\ bexp_vars e\"\n by (metis IntD2 disjoint_iff_not_equal)\n moreover from if_(6) nin have \"\\_vars x \\ bexp_vars e = {}\"\n by blast\n ultimately show \"doesnt_read_or_modify (If e c\\<^sub>1 c\\<^sub>2 \\ annos) x\"\n using if_doesnt_read by blast\n next\n assume \"x \\ mds\\<^sub>2 GuarNoWrite\"\n thus \"doesnt_modify (If e c\\<^sub>1 c\\<^sub>2 \\ annos) x\"\n using if_doesnt_modify by blast\n qed\n next\n assume \"(\\mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>1, mds\\<^sub>2 \\ annos, mem''\\) \\\n (\\mem''. \\c', mds', mem'\\ \\ loc_reach \\c\\<^sub>2, mds\\<^sub>2 \\ annos, mem''\\)\"\n with if_ show ?thesis\n by (metis locally_sound_mode_use_def modes_le')\n qed\n qed\nnext\n case (while mdsa mds annos c e)\n hence \"mds\\<^sub>2 \\ annos \\ mds \\ annos\"\n by (metis (lifting) update_preserves_le)\n have while_loc_reach: \"\\ c' mds' mem' mem.\n \\c', mds', mem'\\ \\ loc_reach \\While e c \\ annos, mds\\<^sub>2, mem\\ \\\n c' = While e c \\ annos \\ mds' = mds\\<^sub>2 \\\n c' = While e c \\ mds' \\ mdsa \\\n c' = Stmt.If e (c ;; While e c) Stop \\ mds' \\ mdsa \\\n c' = Stop \\ mds' \\ mdsa \\\n (\\c'' mem'' mds\\<^sub>3.\n c' = c'' ;; While e c \\\n mds\\<^sub>3 \\ mdsa \\ \\c'', mds', mem'\\ \\ loc_reach \\c, mds\\<^sub>3, mem''\\)\"\n proof -\n fix mem c' mds' mem'\n assume \"\\c', mds', mem'\\ \\ loc_reach \\While e c \\ annos, mds\\<^sub>2, mem\\\"\n thus \"?thesis c' mds' mem' mem\"\n apply (induct rule: loc_reach.induct)\n apply simp_all\n apply (erule disjE)\n apply simp\n apply (metis \\mds\\<^sub>2 \\ annos \\ mds \\ annos\\ while.hyps(1) while_eval_elim)\n apply (erule disjE)\n apply (metis while_eval_elim')\n apply (erule disjE)\n apply simp\n apply (metis if_eval_elim' loc_reach_refl')\n apply (erule disjE)\n apply (metis stop_no_eval)\n apply (erule exE)\n apply (rename_tac c' mds' mem' c'' mds'' mem'' c''a)\n apply (case_tac \"c''a = Stop\")\n apply (insert while.hyps(3))\n apply (metis seq_stop_elim while.hyps(3))\n apply (metis loc_reach.step seq_elim)\n by (metis (full_types) loc_reach.mem_diff)\n qed\n from while show ?case\n proof (safe)\n fix mem\n assume \"\\Stop, mds\\<^sub>2', mem'\\ \\ loc_reach \\While e c \\ annos, mds\\<^sub>2, mem\\\"\n thus \"mds\\<^sub>2' \\ mds \\ annos\"\n by (metis Stmt.distinct(35) Stmt.distinct(43) annotate.elims update_annos.simps(1) while.hyps(1) while.prems while_loc_reach)\n next\n fix mem\n from while have a: \"bexp_vars e \\ (mds\\<^sub>2 \\ annos) GuarNoReadOrWrite = {}\"\n by (metis (lifting, no_types) Int_empty_right Int_left_commute \\mds\\<^sub>2 \\ annos \\ mds \\ annos\\ inf_fun_def le_iff_inf)\n from while have b: \"\\v. \\_vars v \\ bexp_vars e \\ {} \\ v \\ (mds\\<^sub>2 \\ annos) GuarNoReadOrWrite\"\n by (meson \\mds\\<^sub>2 \\ annos \\ mds \\ annos\\ le_fun_def subsetCE) \n show \"locally_sound_mode_use \\While e c \\ annos, mds\\<^sub>2, mem\\\"\n unfolding locally_sound_mode_use_def\n apply (rule allI)+\n apply (rule impI)\n proof -\n fix c' mds' mem'\n define lc where \"lc = \\While e c \\ annos, mds\\<^sub>2, mem\\\"\n assume \"\\c', mds', mem'\\ \\ loc_reach lc\"\n thus \"\\x. (x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n apply (simp add: lc_def)\n apply (drule while_loc_reach)\n apply (rule allI)\n apply (erule disjE5)\n proof (clarsimp)\n fix x\n show \"(x \\ mds\\<^sub>2 GuarNoReadOrWrite \\ doesnt_read_or_modify (While e c \\ annos) x) \\\n (x \\ mds\\<^sub>2 GuarNoWrite \\ doesnt_modify (While e c \\ annos) x)\"\n unfolding doesnt_read_or_modify_def doesnt_read_or_modify_vars_def and doesnt_modify_def\n using while_eval and while_eval_elim\n by blast\n next\n fix x\n assume a: \"c' = Stmt.If e (c ;; While e c) Stop \\ mds' \\ mdsa\"\n hence \"mds' \\ mdsa\" by blast\n let ?c' = \"If e (c ;; While e c) Stop\"\n have \"x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify ?c' x\"\n apply clarify\n apply (rule if_doesnt_read')\n apply (metis IntI \\mds' \\ mdsa\\ empty_iff le_fun_def rev_subsetD while.hyps(1) while.hyps(4))\n by (metis IntI \\mds' \\ mdsa\\ empty_iff le_fun_def rev_subsetD while.hyps(1) while.hyps(5))\n moreover\n have \"x \\ mds' GuarNoWrite \\ doesnt_modify ?c' x\"\n by (metis annotate.simps(1) if_doesnt_modify)\n ultimately show \"(x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n using a by simp \n next\n fix x\n assume \"c' = Stop \\ mds' \\ mdsa\"\n thus \"(x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n by (simp, metis stop_doesnt_access)\n next\n fix x\n assume \"\\c'' mem'' mds\\<^sub>3.\n c' = c'' ;; While e c \\\n mds\\<^sub>3 \\ mdsa \\\n \\c'', mds', mem'\\\n \\ loc_reach \\c, mds\\<^sub>3, mem''\\\"\n from this obtain\n c'' mem'' mds\\<^sub>3\n where \"mds\\<^sub>3 \\ mdsa\" and [simp]: \"c' = c'' ;; While e c\"\n and \"\\c'', mds', mem'\\ \\ loc_reach \\c, mds\\<^sub>3, mem''\\\" by blast\n thus \"(x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n apply (clarsimp, safe)\n apply (rule seq_doesnt_read)\n apply (insert while(3))\n apply (metis \\mds\\<^sub>3 \\ mdsa\\ locally_sound_mode_use_def while.hyps(1))\n apply (rule seq_doesnt_modify)\n by (metis \\mds\\<^sub>3 \\ mdsa\\ locally_sound_mode_use_def while.hyps(1))\n next\n fix x\n assume \"c' = While e c \\ mds' \\ mdsa\"\n thus \"(x \\ mds' GuarNoReadOrWrite \\ doesnt_read_or_modify c' x) \\\n (x \\ mds' GuarNoWrite \\ doesnt_modify c' x)\"\n unfolding doesnt_read_or_modify_def doesnt_read_or_modify_vars_def and doesnt_modify_def\n using while_eval' and while_eval_elim'\n by blast\n qed\n qed\n qed\nnext\n case (seq mds c\\<^sub>1 mds' c\\<^sub>2 mds'')\n thus ?case\n proof (safe)\n fix mem\n assume \"\\Stop, mds\\<^sub>2', mem'\\ \\ loc_reach \\c\\<^sub>1 ;; c\\<^sub>2, mds\\<^sub>2, mem\\\"\n then obtain mds\\<^sub>2'' mem'' where \"\\Stop, mds\\<^sub>2'', mem''\\ \\ loc_reach \\c\\<^sub>1, mds\\<^sub>2, mem\\\" and\n \"\\Stop, mds\\<^sub>2', mem'\\ \\ loc_reach \\c\\<^sub>2, mds\\<^sub>2'', mem''\\\"\n using seq_split by blast\n thus \"mds\\<^sub>2' \\ mds''\"\n using seq by blast\n next\n fix mem\n from seq show \"locally_sound_mode_use \\c\\<^sub>1 ;; c\\<^sub>2, mds\\<^sub>2, mem\\\"\n apply (simp add: locally_sound_mode_use_def)\n apply clarify\n apply (drule seq_loc_reach)\n apply (erule disjE)\n apply (metis seq_doesnt_modify seq_doesnt_read)\n by metis\n qed\nnext\n case (sub mds\\<^sub>2'' c mds\\<^sub>2' mds\\<^sub>1 mds\\<^sub>1' c\\<^sub>1)\n thus ?case\n apply clarsimp\n by (metis (hide_lams, no_types) inf_absorb2 le_infI1)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Dependent_SIFUM_Type_Systems/LocallySoundModeUse.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2951926061713521}} {"text": "section \\Options and Maps with Default Value for None\\\ntheory Array_Map_Default\nimports Dynamic_Array DRAT_Misc\nbegin\n text \\Implements maps from natural numbers to any value type that has an \n unused default value in its implementation type. \n Internally, uses a dynamic array.\n \\\n definition \"is_unused_elem dflt A \\ \\x. A x dflt = false\"\n lemma is_unused_elem_pure[simp]: \n \"is_unused_elem dflt (pure R) \\ dflt \\ Domain R\"\n unfolding is_unused_elem_def\n by (auto simp: pure_rel_eq_false_iff)\n \n \n definition \"dflt_option_rel_aux dflt \n \\ { (dflt,None) } \\ { (x, Some x) | x. x\\dflt }\"\n definition [to_relAPP]: \"dflt_option_assn dflt A \n \\ pure (dflt_option_rel_aux dflt O \\the_pure A\\option_rel)\"\n \n subsection \\Function-Level Map Operations\\ \n text \\We justify the map operations implemented by a function\\\n lemma amd1_empty_refine: \n \"(uncurry0 (\\_. dflt), uncurry0 op_map_empty) \n \\ Id \\\\<^sub>f (Id \\ dflt_option_rel_aux dflt)\"\n by (auto simp: dflt_option_rel_aux_def fref_def)\n \n lemma amd1_lookup_refine: \n \"(\\x f. f x, op_map_lookup) \n \\ Id \\ (Id \\ dflt_option_rel_aux dflt) \\ dflt_option_rel_aux dflt\"\n apply simp by parametricity\n \n lemma amd1_update_refine: \n \"(uncurry2 (\\k v f. f(k:=v)), uncurry2 op_map_update) \n \\ [\\((k,v),m). v\\dflt]\\<^sub>f \n ((Id \\\\<^sub>r Id) \\\\<^sub>r (Id \\ dflt_option_rel_aux dflt)) \n \\ (Id \\ dflt_option_rel_aux dflt)\"\n unfolding op_map_update_def\n apply (rule frefI)\n apply auto\n applyS (auto simp: dflt_option_rel_aux_def)\n applyS (parametricity; simp)\n done\n \n definition [simp]: \"amd1_delete dflt k f \\ fun_upd f k dflt\"\n lemma amd1_delete_refine: \n \"(uncurry (amd1_delete dflt), uncurry op_map_delete) \n \\ Id \\\\<^sub>r (Id \\ dflt_option_rel_aux dflt) \\\\<^sub>f (Id \\ dflt_option_rel_aux dflt)\"\n unfolding op_map_delete_def PR_CONST_def amd1_delete_def\n apply (rule frefI)\n apply parametricity\n apply (auto simp: dflt_option_rel_aux_def)\n done\n\n subsection \\Map Operations, array-level\\\n text \\We use dynamic arrays to implement the function, and combine both to \n implement the map interface.\\\n definition [code_unfold]: \"amd_empty dflt \\ dyn_array_new_sz dflt 16\"\n definition [code_unfold]: \"amd_lookup dflt k a \\ array_get_dyn dflt a k\"\n definition [code_unfold]: \"amd_update dflt k v a \\ array_set_dyn dflt a k v\"\n definition [code_unfold]: \"amd_delete dflt k a \\ array_set_dyn dflt a k dflt\"\n \n definition \"amd_assn dflt K V \n \\ hr_comp (hr_comp \n (is_nff dflt) \n (nat_rel \\\\<^sub>f dflt_option_rel_aux dflt)) \n (\\the_pure K, the_pure V\\map_rel)\"\n \n lemma amd_assn_fold2: \"hr_comp (hr_comp \n (is_nff dflt) \n (nat_rel \\ dflt_option_rel_aux dflt)) \n (\\the_pure K, the_pure V\\map_rel) \n = amd_assn dflt K V\"\n unfolding amd_assn_def\n apply (fo_rule fun_cong arg_cong)+\n unfolding fref_def fun_rel_def by auto\n \n (* TODO: Move *)\n lemmas [intf_of_assn] \n = intf_of_assnI[where R=\"amd_assn dflt K V\" \n and 'a=\"(nat,'vv) i_map\" for dflt K V]\n \n lemmas [safe_constraint_rules] \n = CN_FALSEI[of is_pure \"amd_assn dflt K V\" for dflt K V]\n \n \ncontext \n notes [fcomp_norm_unfold] = \n amd_assn_def[symmetric] dflt_option_assn_def[symmetric] amd_assn_fold2\n notes [intro!] = hfrefI hn_refineI[THEN hn_refine_preI]\n notes [simp] = pure_def hn_ctxt_def invalid_assn_def \n fixes dflt :: \"'a::heap\"\nbegin \n lemma amd2_empty_refine: \n \"(uncurry0 (amd_empty dflt), uncurry0 (RETURN (\\_. dflt))) \n \\ unit_assn\\<^sup>k \\\\<^sub>a is_nff dflt\"\n by (sep_auto simp: amd_empty_def)\n\n lemma amd2_lookup_refine: \n \"(uncurry (amd_lookup dflt), uncurry (RETURN oo (\\x f. f x))) \n \\ id_assn\\<^sup>k*\\<^sub>a(is_nff dflt)\\<^sup>k \\\\<^sub>a id_assn\" \n by (sep_auto simp: amd_lookup_def)\n\n lemma amd2_update_refine: \n \"(uncurry2 (amd_update dflt), uncurry2 (RETURN ooo (\\k v f. f(k:=v)))) \n \\ id_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k*\\<^sub>a(is_nff dflt)\\<^sup>d \\\\<^sub>a is_nff dflt\"\n by (sep_auto simp: amd_update_def)\n\n lemma amd2_delete_refine: \n \"(uncurry (amd_delete dflt), uncurry (RETURN oo (amd1_delete dflt))) \n \\ id_assn\\<^sup>k*\\<^sub>a(is_nff dflt)\\<^sup>d \\\\<^sub>a is_nff dflt\"\n by (sep_auto simp: amd_delete_def)\n \n sepref_decl_impl (no_register) amd_empty: \n amd2_empty_refine[FCOMP amd1_empty_refine[where dflt=dflt]] .\n \n definition [simp]: \"op_amd_empty \\ op_map_empty\" \n \n sepref_decl_impl \n amd2_lookup_refine[FCOMP amd1_lookup_refine[where dflt=dflt]] .\n sepref_decl_impl \n amd2_delete_refine[FCOMP amd1_delete_refine[where dflt=dflt]] .\n\n text \\The only complication arises for the update operation, where we have \n to use the fact that the default element is invalid, which forces us to do\n a manual composition proof.\\\n lemma amd2_update_hnr_aux:\n assumes \"CONSTRAINT (IS_PURE single_valued) K\"\n and \"CONSTRAINT (IS_PURE IS_LEFT_UNIQUE) K\"\n and \"CONSTRAINT is_pure V\"\n and \"CONSTRAINT (is_unused_elem dflt) V\"\n shows \"(uncurry2 (amd_update dflt), uncurry2 (RETURN \\\\\\ op_map_update))\n \\ K\\<^sup>k *\\<^sub>a V\\<^sup>k *\\<^sub>a (amd_assn dflt K V)\\<^sup>d \\\\<^sub>a amd_assn dflt K V\" \n apply (rule \n hfref_cons[\n OF amd2_update_refine[\n FCOMP amd1_update_refine[where dflt=dflt], \n FCOMP (no_prenorm) op_map_update.fref, of K V]])\n subgoal using assms by (simp add: IS_PURE_def)\n subgoal using assms by (simp add: IS_PURE_def)\n subgoal using assms by (simp add: IS_PURE_def)\n subgoal using assms by (simp add: IS_PURE_def IS_LEFT_UNIQUE_def)\n subgoal\n using assms\n by (auto \n simp del: pure_def\n simp: comp_PRE_def IS_PURE_def is_unused_elem_def is_pure_conv \n simp: pure_rel_eq_false_iff \n elim!: prod_relE)\n applyS simp\n applyS simp\n applyS simp\n done\n\n (* TODO: Somewhat of a hack. Perhaps add a flag to switch of \n automatic parameterization on sepref_decl_impl? *)\n private lemma op_map_update_id_param: \n \"(uncurry2 (RETURN \\\\\\ op_map_update), uncurry2 (RETURN \\\\\\ op_map_update)) \n \\ (Id\\\\<^sub>rId)\\\\<^sub>rId \\\\<^sub>f \\Id\\nres_rel\" \n by (simp add: fref_def nres_rel_def)\n \n sepref_decl_impl amd2_update_hnr_aux uses op_map_update_id_param .\n\nend \n\ninterpretation amd: map_custom_empty op_amd_empty apply unfold_locales by auto \nlemmas [sepref_fr_rules] = amd_empty_hnr[folded op_amd_empty_def]\n \n \nsubsection \\Operations on Options\\\n\ntext \\We give own names to constructors, otherwise, we will get confusions \n with the default option refinement.\\\ndefinition [simp]: \"dflt_None \\ None\"\ndefinition [simp]: \"dflt_Some \\ Some\"\nsepref_register dflt_None dflt_Some\n\nlemma doa_None_hnr: \n \"(uncurry0 (return dflt), uncurry0 (RETURN dflt_None)) \n \\ unit_assn\\<^sup>k \\\\<^sub>a dflt_option_assn dflt A\"\n apply (sepref_to_hoare)\n apply (sep_auto simp: pure_def dflt_option_rel_aux_def dflt_option_assn_def)\n done \n\nlemma doa_Some_hnr: \"\\CONSTRAINT (is_unused_elem dflt) A; CONSTRAINT is_pure A\\ \n \\ (return o (\\x. x), RETURN o dflt_Some) \\ A\\<^sup>k \\\\<^sub>a dflt_option_assn dflt A\"\n apply (sepref_to_hoare)\n apply (clarsimp simp: is_pure_conv dflt_option_assn_def)\n apply (sep_auto simp: pure_def)\n apply (fastforce simp: dflt_option_rel_aux_def)\n done \n\nlemma doa_is_None_hnr[sepref_fr_rules]: \n \"(return o ((=) dflt), RETURN o is_None) \n \\ (dflt_option_assn dflt A)\\<^sup>k \\\\<^sub>a bool_assn\"\n apply (sepref_to_hoare)\n by (sep_auto \n simp: dflt_option_assn_def pure_def dflt_option_rel_aux_def \n split: option.split)\n\nlemma doa_the_hnr[sepref_fr_rules]: \"\\CONSTRAINT is_pure A\\ \n \\ (return o (\\x. x), RETURN o the) \n \\ [\\x. x\\None]\\<^sub>a (dflt_option_assn dflt A)\\<^sup>k \\ A\"\n apply (sepref_to_hoare)\n apply (clarsimp simp: is_pure_conv dflt_option_assn_def)\n apply (sep_auto simp: pure_def dflt_option_rel_aux_def)\n done\n\n(* TODO: Add proper rule for case distinction *)\n\n(* Workaround for case-distinction: Rewrite with abstract-level rule: *)\nlemma cnv_option_case_2_if: \"(case x of None \\ fn | Some v \\ fv v) \n \\ (if is_None x then fn else fv (the x))\" by (cases x) auto\n\n\n(* TODO: Hack:\n Due to lack of recursive generic algorithms with specialization, \n we have instantiated equality on options as combinator rule. \n This allows no backtracking or alternatives.\n Thus, we do a type-based rewriting of option-equalities for dflt-option \n types in operator-id phase.\n*)\ndefinition [simp]: \"dflt_option_eq \\ (=)\"\n\nlocale dflt_option =\n fixes A :: \"'a \\ 'c \\ assn\"\n fixes dflt :: \"'c\"\n fixes eq :: \"'c \\ 'c \\ bool Heap\"\n assumes unused_dflt[safe_constraint_rules]: \"(is_unused_elem dflt) A\"\n\n assumes eq_op: \"(uncurry eq, uncurry (RETURN oo (=))) \\ A\\<^sup>k*\\<^sub>aA\\<^sup>k\\\\<^sub>abool_assn\"\n assumes eq_dflt: \"\\a b. \\ a=dflt \\ b=dflt \\ \\ eq a b <\\r. \\(r \\ a=b)>\\<^sub>t\"\nbegin\n (* Type-based rewrites. \n TODO: We would prefer type-based specializations in translate-phase! *)\n lemma fold_dflt_option[def_pat_rules]: \n \"(None::'a option) \\ dflt_None\"\n \"(Some::'a\\_) \\ dflt_Some\"\n \"((=)::'a option \\ _) \\ dflt_option_eq\"\n by auto\n\n (* Constructors *)\n lemmas [sepref_fr_rules] = \n doa_None_hnr[where dflt = dflt and A=A]\n doa_Some_hnr[where dflt = dflt and A=A]\n\n lemma eq_option_refine[sepref_fr_rules]:\n assumes \"CONSTRAINT is_pure A\"\n shows \"(uncurry eq,uncurry (RETURN oo dflt_option_eq)) \n \\ (dflt_option_assn dflt A)\\<^sup>k *\\<^sub>a (dflt_option_assn dflt A)\\<^sup>k \\\\<^sub>a bool_assn\"\n proof -\n from assms obtain R where [simp]: \"A = pure R\" by (auto simp: is_pure_conv)\n \n from eq_op have [sep_heap_rules]: \n \"\\ (x,x')\\R; (y,y')\\R \\ \n \\ eq x y <\\r. \\(r \\ x'=y')>\\<^sub>t\" for x x' y y'\n apply (drule_tac hfrefD[where a=\"(x',y')\" and c=\"(x,y)\"])\n apply simp\n apply (drule hn_refineD)\n apply simp\n apply (sep_auto simp: pure_def)\n apply (rule Hoare_Triple.cons_post_rule)\n apply assumption\n apply sep_auto\n done\n \n note [simplified,sep_heap_rules] \n = eq_dflt[of dflt dflt] eq_dflt[of dflt] eq_dflt[of _ dflt] \n \n show ?thesis\n apply sepref_to_hoare\n apply (simp add: dflt_option_assn_def)\n apply (auto simp: pure_def dflt_option_rel_aux_def elim!: option_relE)\n apply (sep_auto)\n apply (sep_auto)\n apply (sep_auto)\n apply (sep_auto)\n done\n qed \n \n \n \nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/VerifyThis2018/lib/Array_Map_Default.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.2951926061713521}} {"text": "theory FurtherLogicExperimental\nimports DerivedConstructions Frac BaseLogicDeepExperimental2 Namespace \"../HeapLang/PrimitiveLaws\"\n \"../SpanningTree/SpanningTreeCameras\" \"../HeapLang/State\"\nbegin\n\ndatatype inv = Inv \"(name, iprop later) map_view \\ name dset \\ name dfset\"\n and iprop = iProp (pred: \"(graphUR auth \\ markingUR auth \\ inv \\ heap_lang_heap) cmra_pred\")\n\ninstance inv :: ucamera sorry\ninstance iprop :: ofe sorry\n\ndeclare [[coercion pred, coercion Inv]]\n \nabbreviation own_heap :: \"heap_lang_heap \\ iprop\" (\"Own\\<^sub>h _\") where\n \"own_heap h \\ iProp (Atom (Own (ConstC (\\,\\,\\,h))))\"\n\ndefinition points_to :: \"loc \\ dfrac \\ val \\ iprop\" where\n \"points_to l dq v = Own\\<^sub>h(view_frag [l\\(dq, to_ag (Some v))])\"\nabbreviation points_to_disc :: \"loc \\ val \\ iprop\" where \n \"points_to_disc \\ \\l v. points_to l DfracDiscarded v\"\nabbreviation points_to_own :: \"loc \\ frac \\ val \\ iprop\" where\n \"points_to_own \\ \\l p v. points_to l (DfracOwn p) v\"\nabbreviation points_to_full :: \"loc \\ val \\ iprop\" where\n \"points_to_full \\ \\l v. points_to_own l 1 v\"\n\ndefinition \"iprop_holds iP \\ case iP of iProp P \\ pred_holds P\"\n \nlemma points_to_valid: \n \"iprop_holds (iProp (Wand (pred (points_to l dq v)) (Pure (valid dq))))\"\n unfolding pred_holds_def upred_holds_def points_to_def iprop_holds_def\n apply auto\n sorry\n\ndefinition own_inv :: \"inv \\ iprop\" (\"Own\\<^sub>i _\") where\n \"own_inv i = iProp (Atom (Own(ConstC (\\,\\,i,\\))))\"\n\ndefinition own_state_heap :: \"state \\ iprop\" where\n \"own_state_heap s = Own\\<^sub>h (view_auth_full (heap s))\"\n\ndefinition sep_map_set :: \"('b\\iprop) \\ 'b set \\ iprop\" where\n \"sep_map_set f s = iProp (folding_on.F (\\x a. Sep a (pred (f x))) (Pure True) s)\"\n \ncontext assumes \"SORT_CONSTRAINT('c::ucamera)\" and \"SORT_CONSTRAINT('v::ofe)\"\nbegin\n\ndefinition ownI :: \"name \\ iprop \\ iprop\" where\n \"ownI \\ P = Own\\<^sub>i (Inv (view_frag [\\\\(DfracDiscarded,to_ag (Next P))],\\,\\))\"\n\ndefinition inv :: \"namespace \\ iprop \\ iprop\" where\n \"inv N P = iProp (\\\\<^sub>u \\. (Conj (Pure (uname \\\\names N)) (pred (ownI (uname \\) P))))\"\n \ndefinition ownE :: \"name dset \\ iprop\" where\n \"ownE E = Own\\<^sub>i (Inv (\\,E,\\))\"\n\ndefinition ownD :: \"name dfset \\ iprop\" where\n \"ownD D = Own\\<^sub>i (Inv (\\,\\,D))\"\n \ndefinition lift_inv_fmap :: \"(name,iprop) fmap \\ (name,iprop later) fmap\" where\n \"lift_inv_fmap m = Abs_fmap (map_option Next \\ (fmlookup m))\"\n \ndefinition wsat :: iprop where\n \"wsat \\ \\\\<^sub>u (I::(name,iprop) fmap).\n (Sep (pred (Own\\<^sub>i (Inv(view_auth_full(lift_inv_fmap I),\\,\\))))\n (pred (sep_map_set (\\\\. iProp (Disj (Sep (Later((pred \\ the \\ (fmlookup I)) \\)) (pred (ownD (DFSet {|\\|})))) \n (pred (ownE (DSet {\\}))))) (fmdom' I))))\"\nend\n \nfunction wp :: \"expr \\ (val \\ iprop) \\ iprop\" where\n \"wp e \\ = iProp (case to_val e of Some v \\ BUpd (pred (\\ v))\n | None \\ (\\\\<^sub>u \\. (Wand (pred (own_state_heap (ustate \\)))\n (BUpd (Conj (Pure(red e (ustate \\))) (Later (\\\\<^sub>u \\ e2 \\2 efs. Wand \n (Pure(e (ustate \\) (ulist uobs \\) \\\\<^sub>h (uexpr e2) (ustate \\2) (ulist uexpr efs)))\n (BUpd (Sep (pred (own_state_heap (ustate \\2))) \n (Sep (pred (wp (uexpr e2) \\)) \n (pred (sep_map_set (\\e'. (wp e' (\\_. iProp (Pure True)))) (set (ulist uexpr efs)\n )))))))))))))\"\n by fast auto\n \nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/IrisCore/FurtherLogicExperimental.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585786300049, "lm_q2_score": 0.4035668537353746, "lm_q1q2_score": 0.295031010473966}} {"text": "theory InfrastructureOne\n imports CoronaApp\nbegin\n\ntext \\This is the new element for refining the Ephemeral Id -- a list\n of ephemeral ids repreented as a function from nat to the efid type. \n This function needs to be unique and reversible so it must be injective and\n also for all actors the ranges should be disjoint. These properties are\n not part of the actual type but are proved as invariants. In applications\n (e.g. CoronaApp) they need to be shown for initial states and then the\n invariants can be applied to show that they hold in any reachable state.\\\ndatatype efidlist = Efids \"efid\" \"nat\" \"nat \\ efid\"\n\nprimrec efids_root :: \"efidlist \\ efid\"\n where \"efids_root (Efids e n el) = e\"\nprimrec efids_index :: \"efidlist \\ nat\"\n where \"efids_index (Efids e n el) = n\"\nprimrec efids_inc_ind :: \"efidlist \\ efidlist\"\n where \"efids_inc_ind (Efids e n ef) = (Efids e (Suc n) ef) \"\nprimrec efids_cur:: \"efidlist \\ efid\"\n where \"efids_cur (Efids e n ef) = ef n\"\nprimrec efids_list :: \"efidlist \\ nat \\ efid\"\n where \"efids_list (Efids e n ef) = ef\"\ndefinition repl_efr :: \"efidlist \\ efid\"\n where \"repl_efr el \\ efids_root el\" \n\ndatatype igraph = Lgraph \"(location * location)set\" \"location \\ identity set\"\n \"identity \\ efidlist\" \n \"location \\ string * (dlm * data) set\"\n \"location \\ efid set\"\n \"identity \\ location \\ (identity * efid)set\"\n\ndatatype infrastructure = \n Infrastructure \"igraph\" \n \"[igraph, location] \\ policy set\" \n \nprimrec loc :: \"location \\ nat\"\nwhere \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\ (location * location)set\"\nwhere \"gra(Lgraph g a c l e k) = g\"\nprimrec agra :: \"igraph \\ (location \\ identity set)\"\nwhere \"agra(Lgraph g a c l e k) = a\"\nprimrec cgra :: \"igraph \\ identity \\ efidlist\"\nwhere \"cgra(Lgraph g a c l e k) = c\"\nprimrec lgra :: \"igraph \\ (location \\ string * (dlm * data) set)\"\n where \"lgra(Lgraph g a c l e k) = l\"\nprimrec egra :: \"igraph \\ location \\ efid set\"\n where \"egra(Lgraph g a c l e k) = e\"\nprimrec kgra:: \"[igraph, identity, location] \\ (identity * efid)set\"\n where \"kgra(Lgraph g a c l e k) = k\"\n\ndefinition nodes :: \"igraph \\ location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\ identity set\" \nwhere \"actors_graph g == {x. ? y. y : nodes g \\ x \\ (agra g y)}\"\n\nprimrec graphI :: \"infrastructure \\ igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\ policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, identity ] \\ efidlist\"\n where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\ string * (dlm * data)set\"\n where \"lspace (Infrastructure g d) = lgra g\"\n\n\n\ntext \\Predicates and projections for the labels to encode their meaning.\\\ndefinition owner :: \"dlm * data \\ actor\" where \"owner d \\ fst(fst d)\"\ndefinition owns :: \"[igraph, location, actor, dlm * data] \\ bool\"\n where \"owns G l a d \\ owner d = a\"\ndefinition readers :: \"dlm * data \\ actor set\"\n where \"readers d \\ snd (fst d)\"\n\ntext \\The predicate @{text \\has_access\\} is true for owners or readers.\\ \ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\ bool\" \nwhere \"has_access G l a d \\ owns G l a d \\ a \\ readers d\"\n\ntypedef label_fun = \"{f :: dlm * data \\ dlm * data. \n \\ x:: dlm * data. fst x = fst (f x)}\" \n by (fastforce)\n\ndefinition secure_process :: \"label_fun \\ dlm * data \\ dlm * data\" (infixr \"\\\" 50)\n where \"f \\ d \\ (Rep_label_fun f) d\" \n\ndefinition atI :: \"[identity, igraph, location] \\ bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\ a \\ (agra G l)\"\n\ndefinition enables :: \"[infrastructure, location, actor, action] \\ bool\"\nwhere\n\"enables I l a a' \\ (\\ (p,e) \\ delta I (graphI I) l. a' \\ e \\ p a)\"\n\ndefinition behaviour :: \"infrastructure \\ (location * actor * action)set\"\nwhere \"behaviour I \\ {(t,a,a'). enables I t a a'}\"\n\ndefinition misbehaviour :: \"infrastructure \\ (location * actor * action)set\"\nwhere \"misbehaviour I \\ -(behaviour I)\"\n\nprimrec jonce :: \"['a, 'a list] \\ bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\ (set ls)) else jonce a ls)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\ igraph\"\nwhere \"move_graph_a n l l' g \\ Lgraph (gra g) \n (if n \\ ((agra g) l) & n \\ ((agra g) l') then \n ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n else (agra g))\n (cgra g) \n (lgra g)\n (if n \\ ((agra g) l) & n \\ ((agra g) l') then\n ((egra g)(l := (egra g l) - {efids_cur(cgra g n)}))\n (l' := insert (efids_cur(cgra g n))(egra g l'))\n else egra g)(kgra g)\"\n\ndefinition put_graph_efid :: \"[identity, location, igraph] \\ igraph\"\n where \\put_graph_efid n l g \\ Lgraph (gra g)(agra g)\n ((cgra g)(n := efids_inc_ind(cgra g n)))\n (lgra g)\n ((egra g)(l := insert (efids_cur(efids_inc_ind(cgra g n)))\n ((egra g l) - {efids_cur(cgra g n)})))\n (kgra g)\\\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\ bool\" (\"(_ \\\\<^sub>n _)\" 50)\nwhere\n move: \"\\ G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\ nodes G; l' \\ nodes G;\n (a) \\ actors_graph(graphI I); enables I l' (Actor a) move;\n I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\ \\ I \\\\<^sub>n I'\" \n| get : \"\\ G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\ nodes G;\n enables I l (Actor a) get;\n I' = Infrastructure \n (Lgraph (gra G)(agra G)(cgra G)(lgra G)(egra G)\n ((kgra G)(a := ((kgra G a)(l:= {(x,y). x \\ agra G l \\ y \\ egra G l})))))\n (delta I)\n \\ \\ I \\\\<^sub>n I'\"\n| put : \"G = graphI I \\ a @\\<^bsub>G\\<^esub> l \\ enables I l (Actor a) put \\\n I' = Infrastructure (put_graph_efid a l G)(delta I)\n \\ I \\\\<^sub>n I'\"\n\ntext \\Note that the type infrastructure can now be instantiated to the axiomatic type class \n @{text\\state\\} which enables the use of the underlying Kripke structures and CTL.\\\ninstantiation \"infrastructure\" :: state\nbegin\ndefinition \n state_transition_infra_def: \"(i \\\\<^sub>i i') = (i \\\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\\\<^sub>n* _)\" 50)\nwhere \"s \\\\<^sub>n* s' \\ ((s,s') \\ {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n\n\nlemma move_graph_eq: \"move_graph_a a l l g = g\" \n by (simp add: move_graph_a_def, case_tac g, force)\n\ndefinition anonymous_actor :: \"infrastructure \\ efid \\ identity\"\n where\n\"anonymous_actor I e = (SOME a :: identity. a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n e \\ range(efids_list (InfrastructureOne.cgra (graphI I) a)))\"\n\nlemma anonymous_actor_defO: \"InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\ {} \\\n(\\ a \\ actors_graph (graphI I). inj (efids_list (InfrastructureOne.cgra (graphI I) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n l \\ nodes (graphI I) \\ \n e \\ (\\ a \\ actors_graph (InfrastructureOne.graphI I). \n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \n \\\n \\! a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I). e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a))\"\n apply (rule ex_ex1I)\n apply blast\n by blast\n\nlemma anonymous_actor_def1a: \"InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\ {} \\\n(\\ a \\ actors_graph (graphI I). inj (efids_list (InfrastructureOne.cgra (graphI I) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n l \\ nodes (graphI I) \\ \n e \\ (\\ a \\ actors_graph (InfrastructureOne.graphI I). \n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \n \\\n anonymous_actor I e \\InfrastructureOne.actors_graph (InfrastructureOne.graphI I)\n \\ e \\ range (efids_list (InfrastructureOne.cgra (graphI I)(anonymous_actor I e)))\"\n apply (drule anonymous_actor_defO, assumption+)\n apply (simp add: anonymous_actor_def)\n by (metis (mono_tags, lifting) someI)\n\nlemma anonymous_actor_def1b: \"InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\ {} \\\n(\\ a \\ actors_graph (graphI I). inj (efids_list (InfrastructureOne.cgra (graphI I) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n l \\ nodes (graphI I) \\ \n e \\ (\\ a \\ actors_graph (InfrastructureOne.graphI I). \n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \n \\\n a' \\InfrastructureOne.actors_graph (InfrastructureOne.graphI I)\n \\ e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a'))\n \\ a' = anonymous_actor I e\"\n apply (drule anonymous_actor_defO, assumption+)\n apply (simp add: anonymous_actor_def)\n by (metis (no_types, lifting) someI)\n\n\ndefinition ref_map :: \"[InfrastructureOne.infrastructure, \n [Infrastructure.igraph, Infrastructure.location] \\ policy set]\n \\ Infrastructure.infrastructure\"\n where \"ref_map I lp = Infrastructure.Infrastructure \n (Infrastructure.Lgraph\n (InfrastructureOne.gra (graphI I))\n (InfrastructureOne.agra (graphI I))\n (\\ h:: identity. repl_efr \n ((InfrastructureOne.cgra (graphI I)) h))\n (InfrastructureOne.lgra (graphI I))\n (\\ l :: Infrastructure.location. \n (\\ a. \n efids_root (InfrastructureOne.cgra (graphI I) a)) ` \n (InfrastructureOne.agra (graphI I) l))\n (\\ a :: identity. \\ l :: Infrastructure.location.\n if (a \\ (InfrastructureOne.actors_graph(graphI I)) \\ l \\ (InfrastructureOne.nodes (graphI I)))\n then ((\\ (x,y).(x, efids_root(InfrastructureOne.cgra (graphI I)(anonymous_actor I y))))\n `(InfrastructureOne.kgra (graphI I)) a l)\n else {})) \n lp\"\n\nlemma delta_invariant: \"\\ z z'. z \\\\<^sub>n z' \\ delta(z) = delta(z')\"\n apply clarify\n apply (erule state_transition_in.cases)\n by simp+\n\nlemma same_actors0[rule_format]: \"\\ z z'. z \\\\<^sub>n z' \\ actors_graph (graphI z) = actors_graph (graphI z')\"\nproof (clarify, erule state_transition_in.cases)\n show \"\\z z' G I a l l' I'.\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor a) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z')\"\n apply (simp add: InfrastructureOne.actors_graph_def)\n apply (rule equalityI)\n apply (rule subsetI)\n apply (rule CollectI)\n apply (drule CollectD)\n apply (erule exE, erule conjE)+\n apply (simp add: move_graph_a_def)\n proof -\n fix z :: InfrastructureOne.infrastructure and z' :: InfrastructureOne.infrastructure and G :: InfrastructureOne.igraph and I :: InfrastructureOne.infrastructure and a :: \"char list\" and l :: location and l' :: location and I' :: InfrastructureOne.infrastructure and x :: \"char list\" and y :: location and ya :: location\n assume a1: \"G = InfrastructureOne.graphI I\"\n assume a2: \"l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\n assume a3: \"l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\n assume a4: \"ya \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\nassume \"x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) ya\"\nthen have f5: \"x \\ InfrastructureOne.agra G ya\"\nusing a1 by meson\n have f6: \"ya \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}\"\n using a4 a1 InfrastructureOne.nodes_def by blast\n { assume \"x \\ InfrastructureOne.agra G l\"\n moreover\n { assume \"\\la. x \\ InfrastructureOne.agra G l \\ la = l \\ x \\ a\"\n then have \"(\\la. x \\ InfrastructureOne.agra G l \\ la = l \\ x \\ a \\ l' \\ l) \\ (\\la lb. x \\ InfrastructureOne.agra G la \\ x \\ InfrastructureOne.agra G l \\ x \\ InfrastructureOne.agra G l' \\ lb = l \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ l' \\ {l. \\la. (l, la) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G)) \\ (la, l) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G))} \\ l \\ {la. \\lb. (la, lb) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l := InfrastructureOne.agra G l - {a}, l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l := InfrastructureOne.egra G l - {efids_cur (InfrastructureOne.cgra G a)}, l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G)) \\ (lb, la) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l := InfrastructureOne.agra G l - {a}, l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l := InfrastructureOne.egra G l - {efids_cur (InfrastructureOne.cgra G a)}, l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G))} \\ x \\ a)\"\n using a2 a1 InfrastructureOne.nodes_def by auto\n moreover\n { assume \"\\la lb. x \\ InfrastructureOne.agra G la \\ x \\ InfrastructureOne.agra G l \\ x \\ InfrastructureOne.agra G l' \\ lb = l \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ l' \\ {l. \\la. (l, la) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G)) \\ (la, l) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G))} \\ l \\ {la. \\lb. (la, lb) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l := InfrastructureOne.agra G l - {a}, l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l := InfrastructureOne.egra G l - {efids_cur (InfrastructureOne.cgra G a)}, l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G)) \\ (lb, la) \\ InfrastructureOne.gra (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) ((InfrastructureOne.agra G) (l := InfrastructureOne.agra G l - {a}, l' := insert a (InfrastructureOne.agra G l'))) (InfrastructureOne.cgra G) (InfrastructureOne.lgra G) ((InfrastructureOne.egra G) (l := InfrastructureOne.egra G l - {efids_cur (InfrastructureOne.cgra G a)}, l' := insert (efids_cur (InfrastructureOne.cgra G a)) (InfrastructureOne.egra G l'))) (InfrastructureOne.kgra G))} \\ x \\ a\"\n then have \"(a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using a1 InfrastructureOne.nodes_def by auto }\n moreover\n { assume \"\\la. x \\ InfrastructureOne.agra G l \\ la = l \\ x \\ a \\ l' \\ l\"\n then have \"(a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using a2 a1 InfrastructureOne.nodes_def by auto }\n ultimately have \"(a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n by fastforce }\n moreover\n { assume \"x = a\"\n moreover\n { assume \"x = a \\ a \\ InfrastructureOne.agra G l'\"\n moreover\n { assume \"a \\ InfrastructureOne.agra G l\"\n then have \"\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l\"\n using f6 f5 by blast }\n ultimately have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using a3 a1 InfrastructureOne.nodes_def by fastforce }\n moreover\n { assume \"a \\ InfrastructureOne.agra G l'\"\n then have \"\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}\"\n using f6 f5 by blast }\n ultimately have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n by fastforce }\n ultimately have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n by fastforce }\n moreover\n { assume \"x \\ InfrastructureOne.agra G l\"\n then have \"ya \\ l\"\n using f5 by meson\n moreover\n { assume \"ya \\ l \\ x \\ InfrastructureOne.agra G l'\"\n then have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using f6 f5 a1 InfrastructureOne.nodes_def by auto }\n ultimately have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using a3 a1 InfrastructureOne.nodes_def by fastforce }\n ultimately have \"(\\la. x \\ InfrastructureOne.agra G la \\ la \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G} \\ a \\ InfrastructureOne.agra G l) \\ (\\l. x \\ InfrastructureOne.agra G l \\ a \\ InfrastructureOne.agra G l' \\ l \\ {l. \\la. (l, la) \\ InfrastructureOne.gra G \\ (la, l) \\ InfrastructureOne.gra G}) \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n by fastforce\n then show \"(a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ ((a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\ (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ (\\la. (la = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\ (la \\ l \\ (la = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (la \\ l' \\ la \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) la)))) \\ (\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I)) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l))\"\n using a1 InfrastructureOne.nodes_def by auto\nnext show \" \\z z' G I a l l' I'.\n z = I \\\n z' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>InfrastructureOne.graphI I\\<^esub> l \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y \\\n InfrastructureOne.enables I l' (Actor a) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n {x. \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I)) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I)) y}\n \\ {x. \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y}\"\n\n apply (simp add: InfrastructureOne.enables_def move_graph_a_def)\n apply (rule conjI)\n apply (rule impI)+\n apply (rule subsetI)\n apply (rule CollectI)\n apply (drule CollectD)\n apply (erule exE)+\n apply (erule conjE)+\n proof -\nfix z :: InfrastructureOne.infrastructure and z' :: InfrastructureOne.infrastructure and G :: InfrastructureOne.igraph and I :: InfrastructureOne.infrastructure and a :: \"char list\" and l :: location and l' :: location and I' :: InfrastructureOne.infrastructure and x :: \"char list\" and y :: location and ya :: location\nassume a1: \"G = InfrastructureOne.graphI I\"\n assume a2: \"ya = l \\ (l = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (l \\ l' \\ l \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)\"\nassume a3: \"l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\nassume a4: \"l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\nassume a5: \"a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y\"\n assume a6: \"ya \\ l \\ (ya = l' \\ l' \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\ (ya \\ l' \\ ya \\ InfrastructureOne.nodes (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I)) ((InfrastructureOne.agra (InfrastructureOne.graphI I)) (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}, l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I)) ((InfrastructureOne.egra (InfrastructureOne.graphI I)) (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l - {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}, l' := insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))) (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) ya)\"\n assume a7: \"y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I)\"\n have \"ya = l' \\ ya = l \\ (\\l. x \\ InfrastructureOne.agra G l \\ l \\ InfrastructureOne.nodes G)\"\n using a6 a1 InfrastructureOne.nodes_def by force\n then show \"\\l. l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l\"\n using a7 a6 a5 a4 a3 a2 a1 by (metis (no_types))\nnext show \"\\z z' G I a l l' I'.\n z = I \\\n z' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n (if a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l'\n then (InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))\n else InfrastructureOne.agra (InfrastructureOne.graphI I))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n (if a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l'\n then (InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))\n else InfrastructureOne.egra (InfrastructureOne.graphI I))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I)))\n (InfrastructureOne.delta I) \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>InfrastructureOne.graphI I\\<^esub> l \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y \\\n \\x\\InfrastructureOne.delta I (InfrastructureOne.graphI I) l'. case x of (p, e) \\ move \\ e \\ p (Actor a) \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n (if a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l'\n then (InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l'))\n else InfrastructureOne.agra (InfrastructureOne.graphI I))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n (if a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l'\n then (InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l'))\n else InfrastructureOne.egra (InfrastructureOne.graphI I))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I)))\n (InfrastructureOne.delta I) \\\n (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l') \\\n (a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\\n {x. \\y. (y = l \\\n (l = l' \\\n l' \\ InfrastructureOne.nodes\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n ((InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n ((InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\\n (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\\n (l \\ l' \\\n l \\ InfrastructureOne.nodes\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n ((InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n ((InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ x \\ a)) \\\n (y \\ l \\\n (y = l' \\\n l' \\ InfrastructureOne.nodes\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n ((InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n ((InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\\n (x = a \\ x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l')) \\\n (y \\ l' \\\n y \\ InfrastructureOne.nodes\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n ((InfrastructureOne.agra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n ((InfrastructureOne.egra (InfrastructureOne.graphI I))\n (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n l' :=\n insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n (InfrastructureOne.egra (InfrastructureOne.graphI I) l')))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y))}\n \\ {x. \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y}) \\\n {x. \\y. y \\ InfrastructureOne.nodes\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n (InfrastructureOne.agra (InfrastructureOne.graphI I))\n (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n (InfrastructureOne.egra (InfrastructureOne.graphI I))\n (InfrastructureOne.kgra (InfrastructureOne.graphI I))) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y}\n \\ {x. \\y. y \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n x \\ InfrastructureOne.agra (InfrastructureOne.graphI I) y}\"\n using InfrastructureOne.nodes_def by auto\nqed\nqed\nnext show \"\\z z' G I a l I'.\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I l (Actor a) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (a := (InfrastructureOne.kgra G a)\n (l := {(x, y). x \\ InfrastructureOne.agra G l \\ y \\ InfrastructureOne.egra G l}))))\n (InfrastructureOne.delta I) \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z')\"\n by (simp add: InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def)\nnext show \"\\z z' G I a l I'.\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n InfrastructureOne.enables I l (Actor a) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a l G)\n (InfrastructureOne.delta I) \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z')\"\n by (simp add: InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def InfrastructureOne.put_graph_efid_def)\nqed\n\nlemma same_actors: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ actors_graph(graphI I) = actors_graph(graphI y)\"\nproof (erule rtrancl_induct)\n show \"actors_graph (graphI I) = actors_graph (graphI I)\"\n by (rule refl)\nnext show \"\\(y::infrastructure) z::infrastructure.\n (I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y} \\\n actors_graph (graphI I) = actors_graph (graphI y) \\\n actors_graph (graphI I) = actors_graph (graphI z)\"\n by (drule CollectD, simp, drule same_actors0, simp) \nqed\n\n(* locations invariants *)\n lemma same_nodes0[rule_format]: \"\\ z z'. z \\\\<^sub>n z' \\ nodes(graphI z) = nodes(graphI z')\" \n apply clarify\n apply (erule InfrastructureOne.state_transition_in.cases)\n by (simp add: move_graph_a_def atI_def actors_graph_def nodes_def put_graph_efid_def)+\n\nlemma same_nodes: \"(c, s) \\ {(x::InfrastructureOne.infrastructure, y::InfrastructureOne.infrastructure). x \\\\<^sub>n y}\\<^sup>*\n\\ InfrastructureOne.nodes (graphI c) = InfrastructureOne.nodes (graphI s)\"\n apply (erule rtrancl_induct)\n apply (rule refl)\n apply (drule CollectD)\n apply simp\n apply (drule same_nodes0)\n by simp \n\n(* delta invariants *)\nlemma init_state_policy0: \"\\ \\ z z'. z \\\\<^sub>n z' \\ delta(z) = delta(z'); \n (x,y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\ \\ \n delta(x) = delta(y)\" \n apply (rule mp)\n prefer 2\n apply (rotate_tac 1)\n apply assumption\n thm rtrancl_induct\n apply (erule rtrancl_induct) \n apply (rule impI)\n apply (rule refl)\n apply (subgoal_tac \"delta y = delta z\")\n apply (erule impE)\n apply assumption\n apply (rule impI)\n apply (rule trans)\n apply assumption+\n apply (drule_tac x = y in spec)\n apply (drule_tac x = z in spec)\n apply (rotate_tac -1)\n apply (erule impE)\n apply simp\nby assumption\n \nlemma init_state_policy: \"\\ (x,y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\ \\ \n delta(x) = delta(y)\" \n apply (rule init_state_policy0)\n apply (rule delta_invariant)\n by assumption\n\n(* anonymous actor invariant, i.e. we show that any efid that appears in a state, that is, either in \n the egra component or in the kgra component, is in the range of an efidlist for some actor a\n in the set of actors of the infrastructure. Typical for invariants, we first show that the invariant \n is preserved in a step, and this is then simply extrapolated by induction to any reachable I has the \n property if it is reached from an initial I that already had that property.*)\nlemma efids_list_eq[rule_format]: \"(\\ z z'. (z \\\\<^sub>n z') \\ \nefids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\nefids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n\nproof (clarify, frule same_actors0, frule same_nodes0, erule state_transition_in.cases)\n show \"\\z z' G I aa l l' I'.\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n aa \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor aa) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a aa l l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n using InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.move_graph_a_def by presburger\nnext show \"\\z z' G I aa l I'.\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I l (Actor aa) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (aa := (InfrastructureOne.kgra G aa)\n (l := {(x, y). x \\ InfrastructureOne.agra G l \\ y \\ InfrastructureOne.egra G l}))))\n (InfrastructureOne.delta I) \\\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n by force\nnext show \"\\z z' G I aa l I'.\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n InfrastructureOne.enables I l (Actor aa) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid aa l G)\n (InfrastructureOne.delta I) \\\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a) \"\n by (metis InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def efidlist.exhaust efids_inc_ind.simps efids_list.simps fun_upd_apply)\nqed\n\nlemma efids_list_eq0: \"\\ z z'. (z \\\\<^sub>n z') \\\n\\ a. efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\nefids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n by (simp add: efids_list_eq)\n\n\nlemma efid_in_range_invariantO: \"(\\ z z'. (z \\\\<^sub>n z') \\ \n (\\ l \\ nodes (graphI z).\n (\\ e \\ (egra (InfrastructureOne.graphI z) l).\n (\\ a \\ actors_graph (graphI z). e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a)))))\n \\ (\\ l \\ nodes (graphI z').\n (\\ e \\ (egra (InfrastructureOne.graphI z') l). \n (\\ a \\ actors_graph (graphI z'). e \\ range (efids_list (InfrastructureOne.cgra (graphI z') a))))))\"\nproof (clarify, frule same_actors0, frule same_nodes0, frule efids_list_eq0, erule state_transition_in.cases)\n show \"\\z z' l e G I a la l' I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor a) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a la l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n apply (case_tac \"a \\ ((agra (InfrastructureOne.graphI I)) la) & a \\ ((agra (InfrastructureOne.graphI I)) l')\")\n prefer 2\n apply (simp add: move_graph_a_def)+\n by (metis (mono_tags, hide_lams) Diff_iff UNIV_I efidlist.exhaust efids_cur.simps efids_list.simps fun_upd_apply image_eqI insert_iff)\n (* for Isabelle 2021-1 ...(mono_tags, opaque_lifting)... *)\nnext show \" \\z z' l e G I a la I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I la (Actor a) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (a := (InfrastructureOne.kgra G a)\n (la := {(x, y). x \\ InfrastructureOne.agra G la \\ y \\ InfrastructureOne.egra G la}))))\n (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n by simp\nnext show \"\\z z' l e G I a la I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n \\a. efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a) \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n InfrastructureOne.enables I la (Actor a) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a la G)\n (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n by (smt (z3) Diff_iff InfrastructureOne.actors_graph_def InfrastructureOne.atI_def InfrastructureOne.egra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def UNIV_I efidlist.exhaust efids_cur.simps efids_inc_ind.simps efids_list.simps fun_upd_apply image_eqI insert_iff mem_Collect_eq)\nqed\n\n(* variation for applicability*)\nlemma efid_in_range_invariantOa: \"(z \\\\<^sub>n z') \\ \n (\\ l \\ nodes (graphI z).\n (\\ e \\ (egra (InfrastructureOne.graphI z) l).\n (\\ a \\ actors_graph (graphI z). e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a)))))\n \\ (\\ l \\ nodes (graphI z').\n (\\ e \\ (egra (InfrastructureOne.graphI z') l). \n (\\ a \\ actors_graph (graphI z'). e \\ range (efids_list (InfrastructureOne.cgra (graphI z') a)))))\"\n using efid_in_range_invariantO by presburger\n\n(*\nlemma efid_in_range_invariant: \"(\\ z z'. (z \\\\<^sub>n z') \\\n (l \\ nodes (graphI z) \\\n e \\ (egra (InfrastructureOne.graphI z) l) \\ \n (\\ a \\ actors_graph (graphI z). e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a))))\n \\ (l \\ nodes (graphI z') \\\n e \\ (egra (InfrastructureOne.graphI z') l) \\ \n (\\ a \\ actors_graph (graphI z'). e \\ range (efids_list (InfrastructureOne.cgra (graphI z') a)))))\"\n sorry\n*)\n\nlemma efids_in_range_invariantOO[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ (\\ l \\ nodes (graphI I).\n \\ e \\ (egra (InfrastructureOne.graphI I) l).\n \\ a \\ actors_graph (graphI I). e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a)))\n \\ (\\ l \\ nodes (graphI y).\n \\ e \\ (egra (InfrastructureOne.graphI y) l).\n \\ a \\ actors_graph (graphI y). e \\ range (efids_list (InfrastructureOne.cgra (graphI y) a)))\"\nproof (erule rtrancl_induct)\n show \"\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\"\n by blast\nnext show \"\\y z. \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI y).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI y) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \"\n using efid_in_range_invariantO by auto\nqed\n\n(*\nlemma efid_in_range_invariantOOO: \"(\\ z z'. (z \\\\<^sub>n z') \\ \n (\\ l \\ nodes (graphI z).\n (\\ e \\ (egra (InfrastructureOne.graphI z) l).\n (\\ a \\ agra (graphI z) l. e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a)))))\n \\ (\\ l \\ nodes (graphI z').\n (\\ e \\ (egra (InfrastructureOne.graphI z') l). \n (\\ a \\ agra (graphI z') l. e \\ range (efids_list (InfrastructureOne.cgra (graphI z') a))))))\"\n sorry\n\nproof (clarify, frule same_actors0, frule same_nodes0, frule efids_list_eq0, erule state_transition_in.cases)\n show \"\\z z' l e G I a la l' I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z) l.\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n \\a. efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) =\n efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a) \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor a) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a la l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z') l.\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n apply (case_tac \"a \\ ((agra (InfrastructureOne.graphI I)) la) & a \\ ((agra (InfrastructureOne.graphI I)) l')\")\n prefer 2\n apply (simp add: move_graph_a_def)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply fastforce\n apply (rule impI)\n*)\n\n(*\nlemma efids_in_range_invariantOOOO[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ (\\ l \\ nodes (graphI I).\n \\ e \\ (egra (InfrastructureOne.graphI I) l).\n \\ a \\ agra (graphI I) l. e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a)))\n \\ (\\ l \\ nodes (graphI y).\n \\ e \\ (egra (InfrastructureOne.graphI y) l).\n \\ a \\ agra (graphI y) l. e \\ range (efids_list (InfrastructureOne.cgra (graphI y) a)))\"\n sorry\n*)\n\nlemma anonymous_actor_eq: \"(z \\\\<^sub>n z') \\ \nInfrastructureOne.actors_graph (InfrastructureOne.graphI z) \\ {} \\\n(\\ a \\ actors_graph (graphI z). inj (efids_list (InfrastructureOne.cgra (graphI z) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')))) = {}))) \\\n e \\ (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)))\n\\ anonymous_actor z e = anonymous_actor z' e\"\n by (smt (verit, ccfv_threshold) InfrastructureOne.actors_graph_def InfrastructureOne.same_actors0 UN_iff anonymous_actor_def1b efids_list_eq0 mem_Collect_eq)\n\n\n\n\n(* This version is too special because ot the missing quantification \nlemma anonymous_actor: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ l \\ nodes (graphI I) \\\n e \\ (egra (InfrastructureOne.graphI I) l) \\ \n \\ a \\ actors_graph (graphI I). e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a))\n \\ l \\ nodes (graphI y) \\\n e \\ (egra (InfrastructureOne.graphI y) l) \\ \n \\ a \\ actors_graph (graphI y). e \\ range (efids_list (InfrastructureOne.cgra (graphI y) a))\"\nproof (erule rtrancl_induct)\n show \" l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI I) l \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI y) \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI y) l \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\"\n by blast\nnext show \"\\ya z.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI I) l \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI y) \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI y) l \\\n (I, ya) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (ya, z) \\ {(x, y). x \\\\<^sub>n y} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI ya).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI ya) a)) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \"\n using InfrastructureOne.same_actors efids_list_eq by auto\nqed\n*)\n\n(* Same as for egra also for kgra *)\nlemma efid_kgra_in_range_invariantO: \n\"\\ (z :: InfrastructureOne.infrastructure)(z' ::InfrastructureOne.infrastructure). (z \\\\<^sub>n z') \\ \n (\\ l \\ nodes (graphI z).\n (\\ e \\ (egra (InfrastructureOne.graphI z) l).\n (\\ a \\ actors_graph (graphI z). e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a))))) \\\n (\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z). \n (\\ h \\ InfrastructureOne.actors_graph(InfrastructureOne.graphI z).\n (\\ e \\ (snd`((InfrastructureOne.kgra (InfrastructureOne.graphI z) h l))).\n (\\ a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z). \n e \\ range (InfrastructureOne.efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))))))\n \\ \n (\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z'). \n (\\ h' \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n (\\ e \\ (snd `((InfrastructureOne.kgra (InfrastructureOne.graphI z') h' l))). \n (\\ a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z'). \n e \\ range (InfrastructureOne.efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))))))\"\nproof (clarify, frule same_actors0, erule state_transition_in.cases)\n show \"\\z z' l h' e a b G I aa la l' I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\h\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI z) h l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n h' \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n (a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI z') h' l \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n aa \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor aa) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a aa la l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n \\aa\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n snd (a, b) \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') aa))\"\n apply (simp add: move_graph_a_def)\n by (smt (z3) Collect_cong Diff_iff InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.gra.simps InfrastructureOne.nodes_def fun_upd_apply insert_iff singletonD snd_conv)\nnext show \"\\z z' l h' e a b G I aa la I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\h\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI z) h l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n h' \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n (a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI z') h' l \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> la \\\n InfrastructureOne.enables I la (Actor aa) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid aa la G)\n (InfrastructureOne.delta I) \\\n \\aa\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n snd (a, b) \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') aa)) \"\n apply (simp add: put_graph_efid_def)\n by (metis (no_types, opaque_lifting) InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def InfrastructureOne.same_actors0 InfrastructureOne.same_nodes0 InfrastructureOne.state_transition_in.put efidlist.exhaust efids_inc_ind.simps efids_list.simps snd_conv)\nnext show \"\\z z' l h' e a b G I aa la I'.\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\h\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI z) h l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n h' \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n (a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI z') h' l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I la (Actor aa) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (aa := (InfrastructureOne.kgra G aa)\n (la := {(x, y). x \\ InfrastructureOne.agra G la \\ y \\ InfrastructureOne.egra G la}))))\n (InfrastructureOne.delta I) \\\n \\aa\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n snd (a, b) \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') aa))\"\n apply (subgoal_tac \" \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z').\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z') l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z').\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\")\n prefer 2\n using InfrastructureOne.nodes_def apply force\n apply (case_tac \"l = la\")\n apply (case_tac \"h' = aa\")\n apply fastforce\n apply (subgoal_tac \"(a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI (InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)))\n (InfrastructureOne.delta I))) h' l\")\n apply (subgoal_tac \"(a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI z) h' l \")\n prefer 2\n apply (metis InfrastructureOne.graphI.simps InfrastructureOne.kgra.simps)\n apply (rotate_tac 1)\n apply (drule_tac x = l in bspec)\n apply simp\n apply (rotate_tac -1)\n apply (drule_tac x = h' in bspec)\n apply simp\n apply (rotate_tac -1)\n apply (drule_tac x = b in bspec)\n apply (metis image_iff snd_conv)\n apply simp\n apply simp\n(* *)\n apply (subgoal_tac \"(a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI (InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)))\n (InfrastructureOne.delta I))) h' l\")\n apply (subgoal_tac \"(a, b) \\ InfrastructureOne.kgra (InfrastructureOne.graphI z) h' l \")\n prefer 2\n apply (metis InfrastructureOne.graphI.simps InfrastructureOne.kgra.simps)\n apply (rotate_tac 1)\n apply (drule_tac x = l in bspec)\n apply (simp add: InfrastructureOne.nodes_def)\n apply (rotate_tac -1)\n apply (rotate_tac -1)\n apply (drule_tac x = h' in bspec)\n apply simp\n apply (rotate_tac -1)\n apply (drule_tac x = b in bspec)\n apply (metis image_iff snd_conv)\n apply simp\n by (metis (no_types, lifting) InfrastructureOne.graphI.simps InfrastructureOne.kgra.simps fun_upd_apply)\nqed\n\nlemma efid_kgra_in_range_invariantOO[rule_format]: \n \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ (\\ l \\ nodes (graphI I).\n (\\ e \\ (egra (InfrastructureOne.graphI I) l).\n (\\ a \\ actors_graph (graphI I). e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a)))))\n \\ (\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I). \n (\\ h \\ InfrastructureOne.actors_graph(InfrastructureOne.graphI I).\n (\\ e \\ (snd`((InfrastructureOne.kgra (InfrastructureOne.graphI I) h l))).\n (\\ a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I). \n e \\ range (InfrastructureOne.efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))))))\n \\ \n (\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI y). \n (\\ h' \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n (\\ e \\ (snd `((InfrastructureOne.kgra (InfrastructureOne.graphI y) h' l))). \n (\\ a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI y). \n e \\ range (InfrastructureOne.efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a))))))\"\nproof (erule rtrancl_induct)\n show \" \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\h\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI I) h l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\h'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI I) h' l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\"\n by blast\nnext show \" \\y z. \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\h\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI I) h l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI y).\n \\h'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI y) h' l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\h'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n \\e\\snd ` InfrastructureOne.kgra (InfrastructureOne.graphI z) h' l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \"\n using efid_kgra_in_range_invariantO efids_in_range_invariantOO by auto\nqed\n\n\n\nlemma efids_root_efids_inc_lem: \"efids_root (efids_inc_ind el) = efids_root el\"\n by (case_tac el, simp add: efids_inc_ind_def efids_root_def)\n\ntext \\ similar to same_nodes we need to prove invariant for reachable states:\n xa \\ a \\\n efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) xa) \\\n efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) a) \\\n(* efids invariants *)\nlemma eroots_inj_inv0: \"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\ \n(inj(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \\ \ninj(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI z') x)))))\"\n apply clarify\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (simp add: InfrastructureOne.move_graph_a_def)\n apply simp\n by (smt InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def efids_root_efids_inc_lem fun_upd_apply inj_on_cong)\n\nlemma eroots_inj_inv[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n\\ (inj(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \\ \n inj(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI y) x)))\"\nproof (erule rtrancl_induct)\n show \"inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \\\n inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\" by simp\nnext show \"\\y z. (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \\\n inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI y) x)) \\\n inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \\\n inj (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \"\n using eroots_inj_inv0 by auto\nqed\n\nlemma eroots_inj_on_inv0: \"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\ \n(inj_on(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z)) \\ \n inj_on(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI z') x))\n (actors_graph (InfrastructureOne.graphI z')))))\"\n apply clarify\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (simp add: InfrastructureOne.move_graph_a_def actors_graph_def inj_on_def\n InfrastructureOne.gra.simps InfrastructureOne.nodes_def)\n apply (erule exE)+\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (erule exE)+\n apply (erule conjE)+\n apply (erule exE)+\n(* update to Isabelle 2021 solved remaining subgoals automatically (sledgehammer) *)\n apply metis\n apply (simp add: InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def)\n by (smt (z3) InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.put efids_root_efids_inc_lem fun_upd_apply inj_on_def)\n\nlemma eroots_inj_on_inv[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n\\ (inj_on(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \n (actors_graph (InfrastructureOne.graphI I)) \\ \n inj_on(\\ x. efids_root(InfrastructureOne.cgra (InfrastructureOne.graphI y) x))\n (actors_graph (InfrastructureOne.graphI y)))\"\nproof (erule rtrancl_induct)\nshow \"inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I))\"\n by simp\nnext show \"\\y z. (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI y) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI y)) \\\n inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n inj_on (\\x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI z) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI z))\"\n by (simp add: eroots_inj_on_inv0)\nqed\n\n(* *)\nlemma efids_list_disjoint: \"(\\ (z :: InfrastructureOne.infrastructure). (\\ z'. (z \\\\<^sub>n z') \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\ \n(range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a'))) = {}))\n\\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z'). (\\ a' \\ actors_graph(InfrastructureOne.graphI z'). a \\ a' \\ \n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a')))) = {})))\n))\"\n apply clarify\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (smt (verit, ccfv_SIG) InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.move_graph_a_def InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.move)\n apply (simp add: InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def)\n apply (simp add: put_graph_efid_def)\n by (metis InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.put efidlist.exhaust efids_inc_ind.simps efids_list.simps)\n\n\n(* efids_cur inj_on*)\nlemma efids_cur_in_efids_listO: \"a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\n \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\"\n apply (case_tac \"(InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\")\n by simp\n\n\nlemma efids_cur_in_efids_list: \"a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n efids_cur (efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\"\n apply (case_tac \"(InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\")\n by simp\n\nlemma inj_on_put_preserve0: \"\\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n inj_on ((\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (a:= efids_cur (efids_inc_ind ((InfrastructureOne.cgra (InfrastructureOne.graphI I) a)))))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I))\"\n apply (rule Fun.inj_on_fun_updI)\n apply blast\n apply (unfold image_def)\n apply (rule notI)\n apply (drule CollectD)\n apply (erule bexE)\n apply (case_tac \"x = a\")\n apply fastforce\n apply (drule_tac x = a in bspec)\n apply assumption\n apply (rotate_tac -1)\n apply (drule_tac x = x in bspec)\n apply assumption\n apply (subgoal_tac \"efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\")\n apply (subgoal_tac \"efids_cur (efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\")\n apply fastforce\n apply (simp add: efids_list_def)\n prefer 2\n apply (case_tac \"InfrastructureOne.cgra (InfrastructureOne.graphI I) x\")\n apply simp\n by (metis efidlist.exhaust efidlist.simps(3) efids_cur_in_efids_list efids_list.simps)\n\n\nlemma inj_on_put_preserve: \"\\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n inj_on (\\x. efids_cur\n (if x = a then efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\n else InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I))\"\n by (smt (verit, ccfv_SIG) fun_upd_apply inj_on_cong inj_on_put_preserve0)\n\n\n\n\nlemma efids_cur_inj_on_inv0[rule_format]: \"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\ \n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')))) = {}))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z)) \\ \n inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z') x))\n (actors_graph (InfrastructureOne.graphI z')))))\"\n apply clarify\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (simp add: InfrastructureOne.move_graph_a_def actors_graph_def inj_on_def\n InfrastructureOne.gra.simps InfrastructureOne.nodes_def)\n apply (erule exE)+\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (erule exE)+\n apply (erule conjE)+\n apply (erule exE)+\n(* update to Isabelle 2021 solved remaining subgoals automatically (sledgehammer) *)\n apply metis\n(* get *)\n using InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.get apply fastforce\n(* put *)\n by (smt (z3) InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.put fun_upd_apply inj_on_cong inj_on_put_preserve0)\n\n\n(* additional invariants for applying/generalizing efids_cur_inj_on_inv0*)\nlemma ran_efidslist_disjoint:\n\"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\ \n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')))) = {})))\n\\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z'). (\\ a' \\ actors_graph(InfrastructureOne.graphI z'). a \\ a' \\ \n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a')))) = {})))\n))\"\n by (rule efids_list_disjoint)\n\nlemma ran_efids_list_disjoint_refl: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI y). (\\ a' \\ actors_graph(InfrastructureOne.graphI y). a \\ a' \\\n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a')))) = {})))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI y).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a')) =\n {} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI z).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')) =\n {}\"\n by (simp add: ran_efidslist_disjoint)\nqed\n\n\n(* injectivity of efids_list is preserved and implies \n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \n*)\n\nlemma efids_list_inj: \"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)))))\"\n\nproof (clarify, erule InfrastructureOne.state_transition_in.cases)\n show \"\\z z' a G I aa l l' I'.\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n aa \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor aa) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a aa l l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n using InfrastructureOne.move_graph_a_def by force\nnext show \"\\z z' a G I aa l I'.\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I l (Actor aa) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (aa := (InfrastructureOne.kgra G aa)\n (l := {(x, y). x \\ InfrastructureOne.agra G l \\ y \\ InfrastructureOne.egra G l}))))\n (InfrastructureOne.delta I) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n by simp\nnext show \"\\z z' a G I aa l I'.\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI z) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n aa @\\<^bsub>G\\<^esub> l \\\n InfrastructureOne.enables I l (Actor aa) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid aa l G)\n (InfrastructureOne.delta I) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z') a))\"\n by (metis InfrastructureOne.cgra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def efidlist.exhaust efids_inc_ind.simps efids_list.simps fun_upd_apply)\nqed\n\n\nlemma efids_list_inj_refl: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\na \\ actors_graph(InfrastructureOne.graphI I) \\\ninj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\ninj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))\"\n by (simp add: InfrastructureOne.same_actors efids_list_inj)\nqed\n\nlemma efids_list_inj_imp_inc_ind_not_eq[rule_format]: \" (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)))\"\nproof (clarify, simp add: efids_inc_ind_def efids_cur_def efids_list_def, case_tac \"InfrastructureOne.graphI z\", simp)\n show \"\\a x1 x2 x3 x4 x5 x6.\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.igraph.Lgraph x1 x2 x3 x4 x5 x6) \\\n inj (rec_efidlist (\\e n ef. ef) (x3 a)) \\\n rec_efidlist (\\e n ef. ef n) (x3 a) = rec_efidlist (\\e n ef. ef n) (rec_efidlist (\\e n. Efids e (Suc n)) (x3 a)) \\\n InfrastructureOne.graphI z = InfrastructureOne.igraph.Lgraph x1 x2 x3 x4 x5 x6 \\ False\"\n by (smt (z3) efidlist.exhaust efidlist.rec n_not_Suc_n the_inv_f_f)\nqed\n\n\nlemma efids_cur_inj_on_inv: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n \\ a \\ actors_graph(InfrastructureOne.graphI I). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n(inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \n (actors_graph (InfrastructureOne.graphI I))) \\\n(inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI y) x)) \n (actors_graph (InfrastructureOne.graphI y)))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI y) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI y)) \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI z))\"\n apply (rule_tac z = y in efids_cur_inj_on_inv0, simp)\n apply (simp add: ran_efids_list_disjoint_refl)\n apply (rule efids_list_inj_imp_inc_ind_not_eq, assumption)\n apply (rule efids_list_inj_refl, simp)\n using InfrastructureOne.same_actors apply presburger\n apply (metis InfrastructureOne.same_actors)\n by blast\nqed\n\n(* agra \\ egra invariants *) \nlemma actor_unique_loc_lem00[rule_format]: \"\\ z z'. z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l')) \n \\ (\\ a.\n (\\ l l'. l \\ nodes (graphI z') \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l' \\ l = l'))\"\n apply (rule allI)+\n apply (rule impI)+\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (simp add: move_graph_a_def)\n apply auto[1]\n using InfrastructureOne.agra.simps InfrastructureOne.graphI.simps apply presburger\n using InfrastructureOne.agra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def by presburger\n\n\n\nlemma actor_unique_loc_lem0[rule_format]: \"\\ z z'. z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (\\ a.\n (\\ l. l \\ nodes (graphI z) \\ (\\ l'. l' \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l'))) \n \\ (\\ a.\n (\\ l. l \\ nodes (graphI z') \\ (\\ l'. l' \\ nodes (graphI z') \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l' \\ l = l')))\"\n apply (rule allI)+\n apply (rule impI)+\n apply (erule InfrastructureOne.state_transition_in.cases)\n apply (simp add: move_graph_a_def)\n using InfrastructureOne.atI_def apply force\n using InfrastructureOne.agra.simps InfrastructureOne.graphI.simps apply presburger\n using InfrastructureOne.agra.simps InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def by presburger\nthm actor_unique_loc_lem0\n\nlemma actor_unique_loc_lem0a: \"z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l'))\n \\ l \\ nodes (graphI z') \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l' \\ l = l'\"\n using actor_unique_loc_lem00 by presburger\n\n\nlemma actor_unique_loc_lem[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n (\\ a.\n (\\ l l'. l \\ nodes (graphI I) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l')) \\\n (\\ a.\n (\\ l l'. l \\ nodes (graphI y) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l' \\ l = l'))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l' \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI y) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l' \\ l = l' \\\n \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l'\"\n by (metis CollectD InfrastructureOne.same_nodes actor_unique_loc_lem0a case_prodD rtrancl.rtrancl_into_rtrancl)\nqed\n\nlemma isthere_lem0: \"\\ z z'. z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\\n a \\ agra (graphI z) l \\ a \\ agra (graphI z) l' \\ l = l')) \\\n (\\ a.\n (\\ l. l \\ nodes (graphI z) \\ a \\ agra (graphI z) l \\\n efids_cur ((InfrastructureOne.cgra (graphI z) a)) \\ egra (graphI z) l)) \n \\ (\\ a. \n (\\ l'. l' \\ nodes (graphI z') \\ a \\ agra (graphI z') l' \\\n efids_cur ((InfrastructureOne.cgra (graphI z') a)) \\ egra (graphI z') l'))\"\n apply (rule allI)+\n apply (rule impI)\n apply (rule InfrastructureOne.state_transition_in.cases, assumption)\n apply (simp add: move_graph_a_def)\n apply (rule conjI)\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (erule conjE)+\n apply (metis (no_types, lifting) InfrastructureOne.actors_graph_def inj_on_contraD mem_Collect_eq)\n apply (rule impI)+\n apply fastforce\n(* get *)\n apply (rule impI)+\n using InfrastructureOne.agra.simps InfrastructureOne.cgra.simps InfrastructureOne.egra.simps InfrastructureOne.graphI.simps apply presburger\n(* put *)\n apply (rule impI)+\n apply (rule allI)+\n apply (rule impI)+\n apply simp\n apply (simp add: put_graph_efid_def)\n apply (rule conjI)\n prefer 2\n apply (metis (mono_tags, lifting) InfrastructureOne.actors_graph_def InfrastructureOne.atI_def inj_on_def mem_Collect_eq)\n apply (rule impI)+\n apply (subgoal_tac \"l' = l\")\n apply simp\n apply (rule_tac z = z and z' = z' and a = a in actor_unique_loc_lem0a)\n prefer 5\n apply simp\n apply force\n apply (meson InfrastructureOne.same_nodes0)\n apply presburger\n apply (metis InfrastructureOne.same_nodes0)\nby (simp add: atI_def)\n\nlemma isthere_lem0a: \"z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n efids_cur(efids_inc_ind (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\\n a \\ agra (graphI z) l \\ a \\ agra (graphI z) l' \\ l = l')) \\\n (\\ a.\n (\\ l. l \\ nodes (graphI z) \\ a \\ agra (graphI z) l \\\n efids_cur ((InfrastructureOne.cgra (graphI z) a)) \\ egra (graphI z) l)) \\\n (\\ a. \n (\\ l'. l' \\ nodes (graphI z') \\ a \\ agra (graphI z') l' \\\n efids_cur ((InfrastructureOne.cgra (graphI z') a)) \\ egra (graphI z') l'))\"\n using isthere_lem0 by presburger\n\n\nlemma isthere_lem00: \"\\ z z'. z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\\n a \\ agra (graphI z) l \\ a \\ agra (graphI z) l' \\ l = l')) \\\n (\\ a.\n (\\ l. l \\ nodes (graphI z) \\ a \\ agra (graphI z) l \\\n efids_cur ((InfrastructureOne.cgra (graphI z) a)) \\ egra (graphI z) l)) \n \\ (\\ a. \n (\\ l'. l' \\ nodes (graphI z') \\ a \\ agra (graphI z') l' \\\n efids_cur ((InfrastructureOne.cgra (graphI z') a)) \\ egra (graphI z') l'))\"\n apply (rule allI)+\n apply (rule impI)\n apply (rule InfrastructureOne.state_transition_in.cases, assumption)\n apply (simp add: move_graph_a_def)\n apply (rule conjI)\n apply (rule impI)+\n apply (rule allI)\n apply (rule impI)+\n apply (erule conjE)+\n apply (metis (no_types, lifting) InfrastructureOne.actors_graph_def inj_on_contraD mem_Collect_eq)\n apply (rule impI)+\n apply fastforce\n(* get *)\n apply (rule impI)+\n using InfrastructureOne.agra.simps InfrastructureOne.cgra.simps InfrastructureOne.egra.simps InfrastructureOne.graphI.simps apply presburger\n(* put *)\n apply (rule impI)+\n apply (rule allI)+\n apply (rule impI)+\n apply simp\n apply (simp add: put_graph_efid_def)\n apply (rule conjI)\n prefer 2\n apply (metis (mono_tags, lifting) InfrastructureOne.actors_graph_def InfrastructureOne.atI_def inj_on_def mem_Collect_eq)\n apply (rule impI)+\n apply (subgoal_tac \"l' = l\")\n apply simp\n apply (rule_tac z = z and z' = z' and a = a in actor_unique_loc_lem0a)\n prefer 5\n apply simp\n apply force\n apply (meson InfrastructureOne.same_nodes0)\n apply presburger\n apply (metis InfrastructureOne.same_nodes0)\nby (simp add: atI_def)\n\nlemma isthere_lem00a: \"z \\\\<^sub>n z' \\ nodes (graphI z) = nodes (graphI z') \\\n (inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI z) x)) \n (actors_graph (InfrastructureOne.graphI z))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI z). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\\n a \\ agra (graphI z) l \\ a \\ agra (graphI z) l' \\ l = l')) \\\n (\\ a.\n (\\ l. l \\ nodes (graphI z) \\ a \\ agra (graphI z) l \\\n efids_cur ((InfrastructureOne.cgra (graphI z) a)) \\ egra (graphI z) l)) \\\n (\\ a. \n (\\ l'. l' \\ nodes (graphI z') \\ a \\ agra (graphI z') l' \\\n efids_cur ((InfrastructureOne.cgra (graphI z') a)) \\ egra (graphI z') l'))\"\n using isthere_lem00 by presburger\n\n\n\n\n\nlemma is_there_lem[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n (inj_on(\\ x. efids_cur(InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) \n (actors_graph (InfrastructureOne.graphI I))) \\\n (\\ a \\ actors_graph (InfrastructureOne.graphI I). \n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \\\n (\\ a.\n (\\ l l'. l \\ nodes (graphI I) \\\n a \\ agra (graphI I) l \\ a \\ agra (graphI I) l' \\ l = l')) \\\n(\\ a.\n (\\ l. l \\ nodes (graphI I) \\ a \\ agra (graphI I) l \\\n efids_cur ((InfrastructureOne.cgra (graphI I) a)) \\ egra (graphI I) l)) \\\n (\\ a. \n (\\ l'. l' \\ nodes (graphI y) \\ a \\ agra (graphI y) l' \\\n efids_cur ((InfrastructureOne.cgra (graphI y) a)) \\ egra (graphI y) l'))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n inj_on (\\x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) x))\n (InfrastructureOne.actors_graph (InfrastructureOne.graphI I)) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l' \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n (\\a l. l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\n \\ InfrastructureOne.egra (InfrastructureOne.graphI I) l) \\\n (\\a l'.\n l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI y) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l' \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)\n \\ InfrastructureOne.egra (InfrastructureOne.graphI y) l') \\\n (\\a l. l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)\n \\ InfrastructureOne.egra (InfrastructureOne.graphI I) l) \\\n (\\a l'.\n l' \\ InfrastructureOne.nodes (InfrastructureOne.graphI z) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\\n efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)\n \\ InfrastructureOne.egra (InfrastructureOne.graphI z) l') \"\n apply (rule impI)\n apply (rule_tac z = y in isthere_lem00a)\n apply force\n apply (meson InfrastructureOne.same_nodes r_into_rtrancl)\n using efids_cur_inj_on_inv apply presburger\n apply (metis InfrastructureOne.same_actors efids_list_inj_refl)\n using actor_unique_loc_lem apply presburger\n by meson\nqed\n\n\nlemma ext_image: \"\\ x \\ A. f x = g x \\ f ` A = g ` A\"\n by simp\n\nlemma ext_ifte[rule_format]: \"(\\ a l. P a l = Q a l) \\ (\\ a l. Q a l \\ t a l = r a l) \\ \n (\\ x y. if P x y then t x y else t') = (\\ x y. if Q x y then r x y else t')\"\n by meson\n\nlemma ext_ifte'[rule_format]: \"(\\ a l. P a l = Q a l) \\ (\\ a l. Q a l \\ t a l = r a l) \\ \n (\\ x. if P x y then t x y else t') = (\\ x. if Q x y then r x y else t')\"\n by meson\n\nlemma ext_ifte''[rule_format]: \"(\\ l. P l = Q l) \\ (\\ l. Q l \\ t l = r l) \\ \n (\\ x. if P x then t x else t') = (\\ x. if Q x then r x else t')\"\n by meson\n\n\n(* *)\nthm actor_unique_loc_lem\n\nlemma actors_loc_unique: \n\"z \\\\<^sub>n z' \\ (\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l')) \\\n l \\ nodes (graphI z') \\ l \\ la \\\naa \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l \\\na \\ InfrastructureOne.agra (InfrastructureOne.graphI z') la \\ aa \\ a\"\n apply (erule contrapos_nn)\n apply (rule actor_unique_loc_lem0a, assumption)\n using InfrastructureOne.same_nodes0 apply presburger\n apply assumption\n apply assumption\n apply assumption\n by (erule ssubst)\n\n\n(* attempt with agra instead of actors_graph (more specific) *)\nlemma efids_cur_eq_egra[rule_format]: \"(\\ z. (\\ z'. (z \\\\<^sub>n z') \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l')) \\\n(\\ l \\ nodes(InfrastructureOne.graphI z).\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI z) l).\n (\\ a \\ agra (InfrastructureOne.graphI z) l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ l \\ nodes(InfrastructureOne.graphI z').\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI z') l).\n (\\ a \\ agra (InfrastructureOne.graphI z') l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)))))\"\nproof (clarify, frule same_actors0, frule same_nodes0, rule state_transition_in.cases, assumption)\n show \"\\z z' l e G I a la l' I'.\n z \\\\<^sub>n z' \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n l' \\ InfrastructureOne.nodes G \\\n a \\ InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\\n InfrastructureOne.enables I l' (Actor a) move \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.move_graph_a a la l' (InfrastructureOne.graphI I)) (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z') l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n apply (simp add: move_graph_a_def)\n by fastforce\nnext show \"\\z z' l e G I a la I'.\n z \\\\<^sub>n z' \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n la \\ InfrastructureOne.nodes G \\\n InfrastructureOne.enables I la (Actor a) get \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure\n (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n ((InfrastructureOne.kgra G)\n (a := (InfrastructureOne.kgra G a)\n (la := {(x, y). x \\ InfrastructureOne.agra G la \\ y \\ InfrastructureOne.egra G la}))))\n (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z') l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n by simp\nnext show \"\\z z' l e G I a la I'.\n z \\\\<^sub>n z' \\\n \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l' \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a) \\\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n e \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l \\\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z) =\n InfrastructureOne.actors_graph (InfrastructureOne.graphI z') \\\n InfrastructureOne.nodes (InfrastructureOne.graphI z) = InfrastructureOne.nodes (InfrastructureOne.graphI z') \\\n z = I \\\n z' = I' \\\n G = InfrastructureOne.graphI I \\\n a @\\<^bsub>G\\<^esub> la \\\n InfrastructureOne.enables I la (Actor a) put \\\n I' =\n InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a la G)\n (InfrastructureOne.delta I) \\\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z') l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)\"\n apply (unfold put_graph_efid_def)\n apply (case_tac \"l = la\")\n apply (smt (z3) DiffE InfrastructureOne.agra.simps InfrastructureOne.atI_def InfrastructureOne.cgra.simps InfrastructureOne.egra.simps InfrastructureOne.graphI.simps fun_upd_apply insertCI insertE)\n apply (drule_tac x = l in bspec)\n apply metis\n apply (subgoal_tac \"e \\ InfrastructureOne.egra (InfrastructureOne.graphI z) l \")\n prefer 2\n apply fastforce\n apply (drule_tac x = e in bspec, assumption)\n apply (erule bexE)\n apply (rule_tac x = aa in bexI)\n apply (simp add: atI_def)\n apply (subgoal_tac \"aa \\ a\")\n apply simp\n prefer 2\n using InfrastructureOne.agra.simps InfrastructureOne.graphI.simps apply presburger\n by meson\nqed\n\nlemma efids_cur_eq_egra_refl[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI I) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l')) \\\n(\\ l \\ nodes(InfrastructureOne.graphI I).\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI I) l).\n (\\ a \\ agra (InfrastructureOne.graphI I) l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \\\n(\\ l \\ nodes(InfrastructureOne.graphI y).\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI y) l).\n (\\ a \\ agra (InfrastructureOne.graphI y) l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)))\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l' \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI I) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI y).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI y) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI y) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI y) a)) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI I) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n \\a\\InfrastructureOne.agra (InfrastructureOne.graphI z) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))\"\n by (simp add: Pair_inject actor_unique_loc_lem case_prodE efids_cur_eq_egra)\nqed\n\n\nlemma efids_cur_efids_list_actor_unique: \n\"(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')))) = {}))) \\\n a \\ actors_graph (InfrastructureOne.graphI z) \\ a' \\ actors_graph (InfrastructureOne.graphI z) \\\nefids_cur (cgra (graphI z) a) \\ range(efids_list (cgra (graphI z) a')) \\ a = a'\"\n by (smt (verit, ccfv_threshold) IntI UNIV_I efidlist.exhaust efids_cur.simps efids_list.simps empty_iff imageE image_eqI)\n\nlemma anonymous_actor_in_agra[rule_format]: \"\\ z z'. z \\\\<^sub>n z' \\\nInfrastructureOne.actors_graph (InfrastructureOne.graphI z) \\ {} \\\n(\\ a \\ actors_graph (graphI z). inj (efids_list (InfrastructureOne.cgra (graphI z) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI z). (\\ a' \\ actors_graph(InfrastructureOne.graphI z). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI z) a')))) = {}))) \\\n(\\ l \\ nodes (graphI z).\n (\\ e \\ (egra (InfrastructureOne.graphI z) l).\n (\\ a \\ actors_graph (InfrastructureOne.graphI z) . e \\ range (efids_list (InfrastructureOne.cgra (graphI z) a))))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI z) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l' \\ l = l')) \\\n(\\ l \\ nodes(InfrastructureOne.graphI z).\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI z) l).\n (\\ a \\ agra (InfrastructureOne.graphI z) l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z) a))) \\\n(\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\ y \\ InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n anonymous_actor z y \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l) \\\n(\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI z').\n \\ y \\ InfrastructureOne.egra (InfrastructureOne.graphI z') l.\n anonymous_actor z' y \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l)\"\n apply (rule allI)+\n apply (rule impI)+\n apply (rule ballI)+\n apply (subgoal_tac \"(\\ l \\ nodes(InfrastructureOne.graphI z').\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI z') l).\n (\\ a \\ agra (InfrastructureOne.graphI z') l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI z') a)))\")\n prefer 2\n apply (simp add: efids_cur_eq_egra)\n apply (subgoal_tac \"\\ a' \\ agra(graphI z') l. y = efids_cur(cgra (graphI z') a')\")\n prefer 2\n apply fastforce\n apply (erule bexE)\n apply (subgoal_tac \"(\\ l \\ nodes (graphI z').\n (\\ e \\ (egra (InfrastructureOne.graphI z') l).\n (\\ a \\ actors_graph (InfrastructureOne.graphI z') .\n e \\ range (efids_list (InfrastructureOne.cgra (graphI z') a)))))\")\n prefer 2\n using efid_in_range_invariantO apply presburger\n apply (subgoal_tac \"(\\ a \\ actors_graph (InfrastructureOne.graphI z') .\n efids_cur(cgra (graphI z') a') \\ range (efids_list (InfrastructureOne.cgra (graphI z') a)))\")\n prefer 2\n apply fastforce\n apply (erule bexE)\n apply (subgoal_tac \"a = a'\")\n prefer 2\n apply (smt (verit, ccfv_SIG) InfrastructureOne.actors_graph_def InfrastructureOne.same_actors0 efids_cur_efids_list_actor_unique efids_list_eq mem_Collect_eq)\n apply (subgoal_tac \"a \\ InfrastructureOne.agra (InfrastructureOne.graphI z') l \")\n prefer 2\n apply simp\napply (subgoal_tac \"\\ a'. a' \\InfrastructureOne.actors_graph (InfrastructureOne.graphI z')\n \\ y \\ range (efids_list (InfrastructureOne.cgra (graphI z') a'))\n \\ a' = anonymous_actor z' y\")\n prefer 2\n apply (simp add: InfrastructureOne.same_actors0 anonymous_actor_def1b efids_list_eq)\n apply (subgoal_tac \"a = anonymous_actor z' y \")\n prefer 2\n apply presburger\n apply (rotate_tac -1)\n apply (erule subst)\n by assumption\n\n\nlemma anonymous_actor_invOO[rule_format]: \"(I, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\nInfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\ {} \\\n(\\ a \\ actors_graph (graphI I). inj (efids_list (InfrastructureOne.cgra (graphI I) a))) \\\n(\\ a \\ actors_graph (InfrastructureOne.graphI I). (\\ a' \\ actors_graph(InfrastructureOne.graphI I). a \\ a' \\\n ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\ \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')))) = {}))) \\\n(\\ l \\ nodes (graphI I).\n (\\ e \\ (egra (InfrastructureOne.graphI I) l).\n (\\ a \\ actors_graph (graphI I). e \\ range (efids_list (InfrastructureOne.cgra (graphI I) a))))) \\\n(\\ a.\n (\\ l l'. l \\ nodes (graphI I) \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\ \n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l')) \\\n(\\ l \\ nodes(InfrastructureOne.graphI I).\n\\ e \\ (InfrastructureOne.egra (InfrastructureOne.graphI I) l).\n (\\ a \\ agra(InfrastructureOne.graphI I) l. \n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))) \\\n(\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\ e \\ InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n anonymous_actor I e \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l) \\\n(\\ l \\ InfrastructureOne.nodes (InfrastructureOne.graphI y).\n \\ e \\ InfrastructureOne.egra (InfrastructureOne.graphI y) l.\n anonymous_actor y e \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l)\"\nproof (erule rtrancl_induct, simp)\n show \"\\y z. InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\ {} \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n inj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n \\a'\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n a \\ a' \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a')) =\n {} \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\InfrastructureOne.actors_graph (InfrastructureOne.graphI I).\n e \\ range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) \\\n \\a l l'.\n l \\ InfrastructureOne.nodes (InfrastructureOne.graphI I) \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l \\\n a \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l' \\ l = l' \\\n \\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n \\a\\ agra (InfrastructureOne.graphI I) l.\n e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a) \\\n (I, y) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n (y, z) \\ {(x, y). x \\\\<^sub>n y} \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n anonymous_actor I e \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI y).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI y) l.\n anonymous_actor y e \\ InfrastructureOne.agra (InfrastructureOne.graphI y) l) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI I).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI I) l.\n anonymous_actor I e \\ InfrastructureOne.agra (InfrastructureOne.graphI I) l) \\\n (\\l\\InfrastructureOne.nodes (InfrastructureOne.graphI z).\n \\e\\InfrastructureOne.egra (InfrastructureOne.graphI z) l.\n anonymous_actor z e \\ InfrastructureOne.agra (InfrastructureOne.graphI z) l)\"\n apply (rule impI)\n apply (rule ballI)+\n thm anonymous_actor_in_agra\n apply (rule_tac z' = z in anonymous_actor_in_agra)\n apply simp\n using InfrastructureOne.same_actors apply force\n apply (metis InfrastructureOne.same_actors efids_list_inj_refl)\n apply (metis ran_efids_list_disjoint_refl)\n apply (metis efids_in_range_invariantOO)\n using actor_unique_loc_lem apply presburger\n apply (simp add: efids_cur_eq_egra_refl)\n apply fastforce\nby assumption+\nqed\n\nend\n\n ", "meta": {"author": "flokam", "repo": "CoronaApp", "sha": "6258178b8f9d10f43e0825d99cbb0126ee51612c", "save_path": "github-repos/isabelle/flokam-CoronaApp", "path": "github-repos/isabelle/flokam-CoronaApp/CoronaApp-6258178b8f9d10f43e0825d99cbb0126ee51612c/IsabelleCorona/InfrastructureOne.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.29490619110950467}} {"text": "theory utp_rea_core\n imports \"UTP-Designs.utp_des_core\" \"UTP2.utp\" \"UTP2.utp_pred\" \"Shallow-Expressions.Shallow_Expressions\" \"Z_Toolkit.Trace_Algebra\"\nbegin\n\nalphabet 't::trace rea_vars = des_vars +\n wait :: bool\n tr :: 't\n\ntype_synonym ('t, '\\) rp = \"('t, '\\) rea_vars_scheme\"\n\ntype_synonym ('t,'\\,'\\) rel_rp = \"(('t,'\\) rea_vars_scheme, ('t,'\\) rea_vars_scheme) urel\"\n\ntype_synonym ('t, '\\) hrel_rp = \"(('t,'\\) rea_vars_scheme, ('t,'\\) rea_vars_scheme) urel\"\n\ntranslations\n (type) \"('t,'\\) rp\" <= (type) \"('t, '\\) rea_vars_scheme\"\n (type) \"('t,'\\) rp\" <= (type) \"('t, '\\) rea_vars_ext\"\n (type) \"('t,'\\,'\\) rel_rp\" <= (type) \"(('t,'\\) rea_vars_scheme, ('\\,'\\) rea_vars_scheme) urel\"\n (type) \"('t,'\\) hrel_rp\" <= (type) \"(('t,'\\) rea_vars_scheme, ('\\,'\\) rea_vars_scheme) urel\"\n\n(* Now denoted as v\\<^sub>R rather than \\\\<^sub>R *)\n\nnotation rea_vars.more\\<^sub>L (\"\\<^bold>v\\<^sub>R\")\n\nterm \"\\<^bold>v\\<^sub>R\"\n\n\nsyntax\n \"_svid_rea_alpha\" :: \"svid\" (\"\\<^bold>v\\<^sub>R\")\n\ntranslations\n \"_svid_rea_alpha\" => \"CONST rea_vars.more\\<^sub>L\"\n\n(*declare zero_list_def [upred_defs]\ndeclare plus_list_def [upred_defs]*)\ndeclare prefixE [elim]\n\nabbreviation wait_f::\"('t::trace, '\\, '\\) rel_rp \\ ('t, '\\, '\\) rel_rp\" (\"_\\<^sub>f\" [1000] 1000)\nwhere \"wait_f R \\ R\\False/wait\\<^sup><\\\"\n\nabbreviation wait_t::\"('t::trace, '\\, '\\) rel_rp \\ ('t, '\\, '\\) rel_rp\" (\"_\\<^sub>t\" [1000] 1000)\n where \"wait_t R \\ R\\True/wait\\<^sup><\\\"\n\n(*\nsyntax\n \"_wait_f\" :: \"logic \\ logic\" (\"_\\<^sub>f\" [1000] 1000)\n \"_wait_t\" :: \"logic \\ logic\" (\"_\\<^sub>t\" [1000] 1000)\n\ntranslations\n \"P \\<^sub>f\" \\ \"CONST usubst (CONST subst_upd id\\<^sub>s (CONST in_var CONST wait) false) P\"\n \"P \\<^sub>t\" \\ \"CONST usubst (CONST subst_upd id\\<^sub>s (CONST in_var CONST wait) true) P\"\n*)\n\nabbreviation lift_rea :: \"('\\, '\\) urel \\ ('t::trace, '\\, '\\) rel_rp\" (\"\\_\\\\<^sub>R\") where\n\"\\P\\\\<^sub>R \\ P \\ (\\<^bold>v\\<^sub>R\\<^sup>2)\"\n\ndefinition drop_rea :: \"('t::trace, '\\, '\\) rel_rp \\ ('\\, '\\) urel\" (\"\\_\\\\<^sub>R\") where\n\"\\P\\\\<^sub>R \\ P \\ (\\<^bold>v\\<^sub>R\\<^sup>2)\"\n\n(*\nabbreviation rea_pre_lift :: \"('d \\ 'e) \\ ('a, 'b, 'c) rel_rp\" (\"\\_\\\\<^sub>R\\<^sub><\") where \"\\n\\\\<^sub>R\\<^sub>< \\ \\n\\<^sup><\\\\<^sub>R\"\n\nlemma unrest_ok_lift_rea [unrest]:\n \"$ok\\<^sup>< \\ \\P\\\\<^sub>R\" \"$ok\\<^sup>> \\ \\P\\\\<^sub>R\"\n unfolding lift_rea_def\n apply (simp add: unrest_aext_expr_lens)\n apply (simp add: unrest_aext_expr_lens) \n done\n*)\n\nsubsection \\ Reactive Lemmas \\\n\nlemma des_lens_equiv_wait_tr_rest: \"\\<^bold>v\\<^sub>D \\\\<^sub>L (wait +\\<^sub>L tr +\\<^sub>L \\<^bold>v\\<^sub>R)\"\n by simp\n\ntext \\ Pairing the reactive alphabet with its control variables forms a bijective lens. \\\nlemma rea_lens_bij: \"bij_lens (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L \\<^bold>v\\<^sub>R)\"\nproof -\n have \"ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L \\<^bold>v\\<^sub>R \\\\<^sub>L ok +\\<^sub>L \\<^bold>v\\<^sub>D\"\n using des_lens_equiv_wait_tr_rest des_vars.indeps lens_equiv_sym lens_plus_eq_right by blast\n also have \"... \\\\<^sub>L 1\\<^sub>L\"\n using bij_lens_equiv_id[of \"ok +\\<^sub>L \\<^bold>v\\<^sub>D\"]\n using des_vars.bij_lenses by blast\n finally show ?thesis\n by (simp add: bij_lens_equiv_id)\nqed\n\nlemma seqr_wait_true [usubst]: \"(P ;; Q) \\<^sub>t = (P \\<^sub>t ;; Q)\"\n by pred_simp\n\nlemma seqr_wait_false [usubst]: \"(P ;; Q) \\<^sub>f = (P \\<^sub>f ;; Q)\"\n by pred_simp\n\ndefinition tcontr :: \"'t::trace \\ ('t, '\\) rp \\ ('t, '\\) rp\" (\"tt\") where\n [lens_defs]:\n \"tcontr = \\ lens_get = (\\ s. get\\<^bsub>ns_alpha snd\\<^sub>L tr\\<^esub> s - get\\<^bsub>ns_alpha fst\\<^sub>L tr\\<^esub> s) , \n lens_put = (\\ s v. put\\<^bsub>ns_alpha snd\\<^sub>L tr\\<^esub> s (get\\<^bsub>ns_alpha fst\\<^sub>L tr\\<^esub> s + v)) \\\"\n\ndefinition itrace :: \"'t::trace \\ ('t, '\\) rp \\ ('t, '\\) rp\" (\"\\<^bold>i\\<^bold>t\") where\n [lens_defs]:\n \"itrace = \\ lens_get = get\\<^bsub>ns_alpha fst\\<^sub>L tr\\<^esub>, \n lens_put = (\\ s v. put\\<^bsub>ns_alpha snd\\<^sub>L tr\\<^esub> (put\\<^bsub>ns_alpha fst\\<^sub>L tr\\<^esub> s v) v) \\\"\n\nsyntax\n \"_svid_tcontr\" :: \"svid\" (\"tt\")\n \"_svid_itrace\" :: \"svid\" (\"\\<^bold>i\\<^bold>t\")\n \"_utr_iter\" :: \"logic \\ logic \\ logic\" (\"iter[_]'(_')\")\n\n\ntranslations\n \"_svid_tcontr\" == \"CONST tcontr\"\n \"_svid_itrace\" == \"CONST itrace\"\n \"iter[n](P)\" == \"CONST uop (CONST tr_iter n) P\"\n\n\nlemma tcontr_alt_def: \"(tt)\\<^sub>e = (tr\\<^sup>> - tr\\<^sup><)\"\n by pred_auto\n\nlemma tcontr_alt_def': \"var tt = (tr\\<^sup>> - tr\\<^sup><)\"\n by pred_auto\n\nlemma tt_indeps [simp]:\n assumes \"x \\ (ns_alpha fst\\<^sub>L tr)\" \"x \\ (ns_alpha snd\\<^sub>L tr)\"\n shows \"x \\ tt\" \"tt \\ x\"\n using assms\n by (unfold lens_indep_def, safe, simp_all add: tcontr_def)\n \nlemma itrace_indeps [simp]:\n assumes \"x \\ (ns_alpha fst\\<^sub>L tr)\" \"x \\ (ns_alpha snd\\<^sub>L tr)\"\n shows \"x \\ \\<^bold>i\\<^bold>t\" \"\\<^bold>i\\<^bold>t \\ x\"\n using assms by (unfold lens_indep_def, safe, simp_all add: lens_defs)\n\n(* Thomas: these lemmata are not applicable unless we want to lift trace operations\n * to expressions as in UTP1 *)\n(*\ntext \\ We lift a few trace properties from the trace class using \\emph{transfer}. \\\n\nlemma uexpr_diff_zero [simp]:\n fixes a :: \"('\\::trace, 'a) expr\"\n shows \"a - 0 = a\"\n by (simp add: minus_uexpr_def zero_uexpr_def, transfer, auto)\n\nlemma uexpr_add_diff_cancel_left [simp]:\n fixes a b :: \"('\\::trace, 'a) expr\"\n shows \"(a + b) - a = b\"\n by (simp add: minus_uexpr_def plus_uexpr_def, transfer, auto)\n\nlemma iter_0 [simp]: \"iter[0](t) = U([])\"\n by (transfer, simp)\n*)\n\nend\n", "meta": {"author": "isabelle-utp", "repo": "UTP-Reactive", "sha": "d09fc006152794f02cfb5871060658b93757836b", "save_path": "github-repos/isabelle/isabelle-utp-UTP-Reactive", "path": "github-repos/isabelle/isabelle-utp-UTP-Reactive/UTP-Reactive-d09fc006152794f02cfb5871060658b93757836b/utp_rea_core.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438502, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2948981631986742}} {"text": "theory ComputationCon imports \"SmallStepCon\" \"HOL-Eisbach.Eisbach_Tools\"\nbegin\ntype_synonym ('g,'l) c_state = \"('g\\'l)\\('l list)\"\ntype_synonym ('g, 'l, 'p,'f,'e) config_gs = \"('g\\'l,'p,'f,'e)com \\ ('g,'l) c_state\"\n\n(* inductive \n \"step_e\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\nwhere\nEnv:\"(\\ns'. t'\\Normal ns' \\ (snd (fst ns) =snd (fst ns') \\ \n length (snd ns) = length (snd ns'))) \\ \n \\\\\\<^sub>c (Ps, Normal ns) \\\\<^sub>e (Ps, t')\"\n|Env_n: \"(\\ns. t\\Normal ns) \\ \\\\\\<^sub>c (Ps, t) \\\\<^sub>e (Ps, t)\"\n\n inductive \n \"step_e1\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e\\<^sub>1/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\nwhere\nEnv1:\"(\\ns'. t'\\Normal ns') \\ (\\ns'. t'=Normal ns' \\ (snd (fst ns) =snd (fst ns') \\ \n length (snd ns) = length (snd ns'))) \\ \n \\\\\\<^sub>c (Ps, Normal ns) \\\\<^sub>e\\<^sub>1 (Ps, t')\"\n|Env_n1: \"(\\ns. t\\Normal ns) \\ \\\\\\<^sub>c (Ps, t) \\\\<^sub>e\\<^sub>1 (Ps, t)\"\n\ninductive \n \"step_e2\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e\\<^sub>2/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\nwhere\nEnv:\"(\\ns'. t'\\Normal ns' \\ t'\\Abrupt ns') \\ \n (\\ns'. t'=Normal ns' \\ snd (fst ns) =snd (fst ns') \\ \n length (snd ns) = length (snd ns')) \\ \n (\\ns'. t'=Abrupt ns' \\ length (snd ns) = length (snd ns')) \\ \n \\\\\\<^sub>c (Ps, Normal ns) \\\\<^sub>e\\<^sub>2 (Ps, t')\"\n|Env_n: \"(\\ns. t\\Normal ns) \\ \\\\\\<^sub>c (Ps, t) \\\\<^sub>e\\<^sub>2 (Ps, t)\"\n\ninductive \n \"step_e3\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e\\<^sub>3/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\nwhere\nEnv:\"(\\ns'. (t'\\Normal ns' \\ t'\\Abrupt ns') \\ (t'=Normal ns' \\ snd (fst ns) =snd (fst ns') \\ \n length (snd ns) = length (snd ns')) \\ \n (t'=Abrupt ns' \\ length (snd ns) = length (snd ns'))) \\ \n \\\\\\<^sub>c (Ps, Normal ns) \\\\<^sub>e\\<^sub>3 (Ps, t')\"\n|Env_n: \"(\\ns. t\\Normal ns) \\ \\\\\\<^sub>c (Ps, t) \\\\<^sub>e\\<^sub>3 (Ps, t)\" *)\n\ninductive \n \"step_e\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\nwhere\nEnv:\"snd (fst s) =snd (fst t) \\ length (snd s) = length (snd t) \\ \n \\\\\\<^sub>c (Ps, s) \\\\<^sub>e (Ps, t)\"\n\n\nlemma etranE: \"\\\\\\<^sub>c c \\\\<^sub>e c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule step_e.cases, blast)\n\ninductive_cases stepe_elim_cases1 [cases set]:\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps',t)\"\n\ninductive_cases stepe_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,t)\"\n\n\nlemma env_c_c'_false:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" \n shows \"~(c=c') \\ P\"\nusing step_m etranE by blast\n\n(* lemma eenv_normal_s'_normal_s:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', Normal s')\" \n shows \"(\\s1. s\\Normal s1) \\ P\"\n using step_m\n using env_c_c'_false stepe_not_norm_elim_cases(4) by blast *)\n\nlemma eenv_eq_length:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" and\n normal_s:\"s= ((g,l),ls)\" and normal_s':\"s'= ((g',l'),ls')\"\n shows \"(length ls \\ length ls') \\ P\"\n using step_m normal_s normal_s'\n using env_c_c'_false stepe_elim_cases1 by fastforce\n\n(* lemma env_normal_s'_normal_s:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', Normal s') \" \n shows \"\\s1. s= Normal s1\"\n using step_m \n using env_c_c'_false stepe_not_norm_elim_cases(4) by blast\n *)\n\nlemma env_c_c':\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" \n shows \"(c=c')\"\nusing env_c_c'_false step_m by fastforce \n\n\nlemma env_normal_same_local_length:\n assumes a1:\"\\\\\\<^sub>c (c, ((g,l),ls)) \\\\<^sub>e (c', ((g',l'),ls'))\" \n shows \"l=l' \\ length ls = length ls'\"\n using a1 \n by (cases rule:step_e.cases,auto)\n\n\nlemma env_normal_same_local:\n assumes a1:\"\\\\\\<^sub>c (c, ((g,l),ls)) \\\\<^sub>e (c', ((g',l'),ls'))\" \n shows \"l=l'\"\n using a1 env_normal_same_local_length\n by fast\n\nlemma env_normal_same_length:\n assumes a1:\"\\\\\\<^sub>c (c, ((g,l),ls)) \\\\<^sub>e (c', ((g',l'),ls'))\" \n shows \"length ls = length ls'\"\n using a1 env_normal_same_local_length\n by fast\n\nlemma env_intro:\n assumes a1:\"length ls = length ls'\"\n shows \"\\\\\\<^sub>c (c, ((g,l),ls)) \\\\<^sub>e (c, ((g',l),ls'))\" \n using a1 by (auto intro: step_e.intros)\n\nlemma env_intro_diff_p:\"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t) \\\n \\\\\\<^sub>c (Q, s) \\\\<^sub>e (Q, t)\"\n by (auto elim: stepe_elim_cases simp add: Env )\n \n\nlemma snormal_enviroment:\n \" snd (fst s) =snd (fst t) \\ length (snd s) = length (snd t) \\\n \\\\\\<^sub>c (x, s) \\\\<^sub>e (x, t)\"\n by (simp add: step_e.intros)\n\n \n(* definition final_glob:: \"('g,'l,'p,'f,'e) config_gs \\ bool\" where\n \"final_glob cfg \\ (fst cfg=Skip \\ ((fst cfg=Throw) \\ (\\s. snd cfg=Normal s)))\"\n \nlemma final_eq:\"snd cfg = Normal s \\ final_glob cfg = SmallStepCon.final (fst cfg, Normal (fst s))\"\n unfolding final_def final_glob_def SmallStepCon.final_def\n by auto\n*)\n\nsection \\ computation with enviroment \\\n\nfun toSeq ::\"(('g\\'l)\\('l list)) \\ (('g\\'l)) \"\n where\n\"toSeq ns = (fst ns)\"\n\nlemma \n assumes \n a0:\"snd s = snd s'\" and \n a1:\"toSeq s = toSeq s'\"\n shows eq_toSeq:\"s = s'\" using a0 a1\n by (cases s, simp)\n\ninductive\n \"step_ce\"::\"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('g\\'l,'p,'f,'e) body\"\n where\nc_step: \"\\\\\\\\<^sub>c (c, (toSeq s)) \\ (c', toSeq s'); snd s = snd s'\\ \\ \n \\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e (c',s')\"\n|e_step: \"\\\\\\<^sub>c (c,s) \\\\<^sub>e (c',s') \\ \\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e (c',s') \" \n\nlemmas step_ce_induct = step_ce.induct [of _ \"(c,s)\" \"(c',s')\", split_format (complete), case_names\nc_step e_step, induct set]\n\n \ninductive_cases step_ce_elim_cases [cases set]:\n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1\"\n\ninductive_cases step_ce_elim_cases_eq_locals [cases set]:\n \"\\\\\\<^sub>c (c,((g,l),ls)) \\\\<^sub>c\\<^sub>e (c', ((g',l),ls'))\"\n \"\\\\\\<^sub>c (c,((g,l),ls)) \\\\<^sub>c\\<^sub>e (c', ((g',l'),ls))\"\n\n\nlemma step_dest:\n assumes a0:\"\\\\\\<^sub>c(P, s) \\\\<^sub>c\\<^sub>e (Q,t)\"\n shows \"\\\\\\<^sub>c(P, s) \\\\<^sub>e (Q,t) \\ \n (\\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t) \\ (snd s) = (snd t))\" \n using a0 apply clarsimp\n apply (erule step_ce_elim_cases) \n by auto \n\nlemma step_dest1:\n assumes a0:\"\\\\\\<^sub>c(P, s) \\\\<^sub>c\\<^sub>e (Q,t)\" and\n a1:\"\\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t)\"\nshows\"((snd s) = (snd t))\" \n using a0 a1 apply clarsimp\n apply (erule step_ce_elim_cases) \n apply auto\n by (metis (no_types) mod_env_not_component stepe_elim_cases1) \n \n\nlemma transfer_normal:\"\n \\\\\\<^sub>c (c, s) \\ (c', s') \\\n \\\\\\<^sub>c (c, (s, ls)) \\\\<^sub>c\\<^sub>e (c', (s', ls))\" \n by (auto intro: c_step)\n \nlemma step_c_normal_normal: assumes a1: \"\\\\\\<^sub>c cf0 \\ cf1\"\n shows \"\\ c\\<^sub>1 s s'. \\cf0 = (c\\<^sub>1,Normal s);cf1=(c\\<^sub>1,s');(\\sa. \\(s'=Normal sa))\\\n \\ P\"\nusing a1 \nby (induct rule: stepc.induct, induct, auto)\n\n\nlemma call_f_step_ce_not_s_eq_t_env_step:\n assumes \n a0:\"\\\\\\<^sub>c(P,s) \\\\<^sub>c\\<^sub>e (Q,t)\" and\n a1:\"(redex P = Call fn \\ \\ fn = Some bdy \\ (s\\t)) \\\n (redex P = Call fn \\ \\ fn = Some bdy \\ s=t \\ P=Q \\ \\ fn \\ Some (Call fn)) \"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (Q,t)\"\nby (metis (no_types, hide_lams) a0 a1 call_f_step_not_s_eq_t_false eq_toSeq step_dest)\n\nabbreviation \n \"stepce_rtrancl\" :: \"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e\\<^sup>* cf1 \\ ((CONST step_ce \\))\\<^sup>*\\<^sup>* cf0 cf1\" \n (* \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ (CONST ((stepc \\) \\ (step_e \\)))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\nabbreviation \n \"stepce_trancl\" :: \"[('g\\'l,'p,'f,'e) body,('g, 'l, 'p,'f,'e) config_gs,('g, 'l, 'p,'f,'e) config_gs] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e\\<^sup>+ cf1 \\ (CONST step_ce \\)\\<^sup>+\\<^sup>+ cf0 cf1\"\n\ntext \\ lemmas about single step computation \\ \n\n(* lemma ce_not_normal_s:\n assumes a1:\"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1\"\n shows \"\\ c\\<^sub>1 c\\<^sub>2 s s'. \\cf0 = (c\\<^sub>1,s);cf1=(c\\<^sub>2,s');(\\sa. (s\\Normal sa))\\\n \\ s=s'\"\nusing a1\n apply (clarify, cases rule:step_ce.cases) \n apply (metis eq_toSeq prod.sel(1) prod.sel(2) step_not_normal_s_eq_t toSeq.simps xstate.simps(5))\n using env_not_normal_s by blast *)\n\nlemma not_eq_not_env:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"~(c=c') \\ \\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s') \\ P\"\nusing step_m etranE by blast\n\n\nlemma step_ce_not_step_e_step_c:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"\\ (\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')) \\(\\\\\\<^sub>c (c, toSeq s) \\ (c', toSeq s'))\"\n using step_m \n by (meson step_dest) \n\nlemma step_ce_step_c_eq_c:\nassumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"(\\\\\\<^sub>c (c, toSeq s) \\ (c', toSeq s')) \\ c=c' \\ P\"\n using step_m step_ce_elim_cases step_ce_not_step_e_step_c\n by (simp add: mod_env_not_component)\n\n(* lemma step_ce_notNormal: \n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"(\\sa. \\(s=Normal sa)) \\ s'=s\"\nusing step_m\nproof (induct rule:step_ce_induct) \n case (e_step a b a' b')\n thus ?case\n using env_not_normal_s by blast\nnext\n case (c_step a b a' b')\n thus ?case\n using ce_not_normal_s step_ce.c_step by blast\nqed *)\n\n(* lemma steps_ce_not_Normal: \n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\" \n shows \"\\sa. \\(s=Normal sa) \\ s'=s\"\nusing step_m\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl then show ?case by auto\nnext\n case (Trans a b a' b') \n thus ?case using step_ce_notNormal by blast \nqed *)\n\nlemma step_ce_Normal_eq_l: \n assumes step_m: \"\\\\\\<^sub>c (c, (s,l)) \\\\<^sub>c\\<^sub>e (c', (s',l'))\" and\n step_ce:\"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"l=l'\" \n by (metis env_c_c' mod_env_not_component snd_conv step_ce step_dest step_m)\n\nlemma step_ce_dest: \n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"\\\\\\<^sub>c (c, toSeq s) \\ (c', toSeq s') \\ \\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\"\n using step_ce_not_step_e_step_c step_m by blast\n\n\n(* lemma steps_not_normal_ce_c: \n assumes steps: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\"\n shows \"( \\sa. \\(s=Normal sa)) \\ \\\\\\<^sub>c (c, toSeq s) \\\\<^sup>* (c', toSeq s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by auto\nnext\n case (Trans a b a' b') then show ?case \n by (metis (no_types, hide_lams) converse_rtranclp_into_rtranclp env_c_c' \n step_ce_notNormal step_ce_not_step_e_step_c)\nqed *)\n\nlemma ce_eq_length: assumes a0:\"\\\\\\<^sub>c (P,s) \\\\<^sub>c\\<^sub>e (Q,t)\"\n shows \"length (snd s) = length (snd t)\"\n by (metis assms step_dest stepe_elim_cases1)\n\n\n\n\n\nlemma ce_Throw_toSkip: \n assumes a0:\"\\\\\\<^sub>c (LanguageCon.com.Throw, s) \\\\<^sub>c\\<^sub>e x\"\n shows \"fst x = Throw\"\nproof-\n have \"\\\\\\<^sub>c (Throw, toSeq s) \\ (fst x, toSeq (snd x)) \n \\ \\\\\\<^sub>c (Throw, s) \\\\<^sub>e x\" using a0 step_ce_dest\n by (metis prod.collapse)\n thus ?thesis\n by (metis env_c_c' prod.collapse prod.inject stepc_elim_cases(11))\nqed\n\n\nsubsection \\Computations\\\nsubsubsection \\Sequential computations\\\n\ntype_synonym ('g,'l,'p,'f,'e) confs = \n \"('g\\'l,'p,'f,'e) body \\ (('g, 'l, 'p,'f,'e) config_gs) list\"\n\n\ninductive_set cptn :: \"(('g,'l,'p,'f,'e) confs) set\"\nwhere\n CptnOne: \" (\\, [(P,s)]) \\ cptn\"\n| Cptn: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>c\\<^sub>e (Q,t); (\\,(Q, t)#xs) \\ cptn \\ \\\n (\\,(P,s)#(Q,t)#xs) \\ cptn\"\n\n\ninductive_cases cptn_elim_cases [cases set]:\n\"(\\, [(P,s)]) \\ cptn\"\n\"(\\,(P,s)#(Q,t)#xs) \\ cptn\"\n\n\ninductive_cases cptn_elim_cases_pair [cases set]:\n\"(\\, [x]) \\ cptn\"\n\"(\\, x#x1#xs) \\ cptn\"\n\nlemma cptn_dest:\"(\\,(P,s)#(Q,t)#xs) \\ cptn \\ (\\,(Q,t)#xs)\\ cptn\"\nby (auto dest: cptn_elim_cases)\n\nlemma cptn_dest_pair:\"(\\,x#x1#xs) \\ cptn \\ (\\,x1#xs)\\ cptn\"\nproof -\n assume \"(\\,x#x1#xs) \\ cptn\"\n thus ?thesis using cptn_dest prod.collapse by metis\nqed\n\nlemma cptn_dest1:\"(\\,(P,s)#(Q,t)#xs) \\ cptn \\ (\\,(P,s)#[(Q,t)])\\ cptn\"\nproof -\n assume a1: \"(\\, (P, s) # (Q, t) # xs) \\ cptn\"\n have \"(\\, [(Q, t)]) \\ cptn\"\n by (meson cptn.CptnOne)\n thus ?thesis\n using a1 cptn.Cptn cptn_elim_cases(2) by blast\n \nqed\n\nlemma cptn_dest1_pair:\"(\\,x#x1#xs) \\ cptn \\ (\\,x#[x1])\\ cptn\"\nproof -\n assume \"(\\,x#x1#xs) \\ cptn\"\n thus ?thesis using cptn_dest1 prod.collapse by metis\nqed\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\b a. (\\,b#c1)\\cptn \\ (\\,a#c2)\\cptn \\ (b#c1)!length c1=a \\ (\\,b#c1@c2)\\cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\n using cptn.Cptn by blast\n(* apply (simp add: cptn.CptnEnv)\nby (simp add: cptn.CptnComp) *)\n\nlemma cptn_dest_2:\n \"(\\,a#xs@ys) \\ cptn \\ (\\,a#xs)\\ cptn\"\nproof (induct \"xs\" arbitrary: a)\n case Nil \n then have \"\\p. [p] = [a]\"\n by blast\n then show ?case\n using cptn.simps by fastforce \nnext\n case (Cons x xs')\n then have \"(\\,a#[x])\\cptn\" by (simp add: cptn_dest1_pair)\n also have \"(\\, x # xs') \\ cptn\" \n by (metis (no_types) Cons.hyps Cons.prems append_Cons cptn_dest_pair) \n ultimately show ?case using cptn_append_is_cptn [of \\ a \"[x]\" x xs']\n by force \nqed \n\nlemma tl_in_cptn: \"\\ (g,a#xs) \\cptn; xs\\[] \\ \\ (g,xs)\\cptn\"\n by (force elim: cptn.cases)\n\nlemma sublist_in_cptn:\"(\\, ys@ xs) \\ cptn \\ xs\\ [] \\ (\\, xs) \\ cptn\"\nproof(induct ys)\n case Nil\n then show ?case by auto\nnext\n case (Cons a ys)\n then have \"(\\, a # (ys @ xs)) \\ cptn \" by auto\n then show ?case \n by (metis Cons.hyps Cons.prems(2) Nil_is_append_conv tl_in_cptn) \nqed\n\nsubsection {* Relation between @{term \"stepc_rtrancl\"} and @{term \"cptn\"} *}\n\nlemma stepc_rtrancl_cptn:\n assumes step: \"\\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf,sf)\" \n shows \"\\xs. (\\,(c, s)#xs) \\ cptn \\(cf,sf) = (last ((c,s)#xs))\"\nusing step \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans]) \n case Refl thus ?case using cptn.CptnOne\n by (metis last_ConsL)\nnext\n case (Trans c s c' s') \n have \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s') \\ \\\\\\<^sub>c (c, toSeq s) \\ (c', toSeq s')\"\n using Trans.hyps(1) step_ce_not_step_e_step_c by blast \n then show ?case \n by (metis (no_types) Trans.hyps(1) Trans.hyps(3) cptn.Cptn \n last_ConsR list.simps(3))\nqed\n\n\n\nlemma cptn_stepc_rtrancl:\n assumes cptn_step: \"(\\,(c, s)#xs) \\ cptn\" and\n cf_last:\"(cf,sf) = (last ((c,s)#xs))\"\n shows \"\\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf,sf)\"\nusing cptn_step cf_last\nproof (induct xs arbitrary: c s) \n case Nil\n thus ?case by simp \nnext\n case (Cons a xs c s) \n then obtain ca sa where eq_pair: \"a=(ca,sa)\" and \"(cf, sf) = last ((ca,sa) # xs) \" \n using Cons\n by (metis last.simps list.distinct(1) surj_pair) \n then have \"\\\\\\<^sub>c (ca,sa) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf, sf)\" using Cons\n using cptn_dest_pair by blast\n moreover have \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (ca, sa)\" using Cons eq_pair\n using cptn_elim_cases(2) by blast\n ultimately show ?case\n by auto\nqed\n\nlemma cptn_stepc_rtran:\n assumes cptn_step: \"(\\,x#xs) \\ cptn\" and \n a1:\"Suc i < length (x#xs)\"\n shows \"\\\\\\<^sub>c ((x#xs)!i) \\\\<^sub>c\\<^sub>e ((x#xs)!(Suc i))\"\nusing cptn_step a1\nproof (induct i arbitrary: x xs)\n case 0\n then obtain x1 xs1 where xs:\"xs=x1#xs1\"\n by (metis length_Cons less_not_refl list.exhaust list.size(3)) \n then have \"\\\\\\<^sub>c x \\\\<^sub>c\\<^sub>e x1\"\n using \"0.prems\"(1) cptn_elim_cases_pair(2) by blast\n then show ?case\n by (simp add: xs) \nnext\n case (Suc i) \n then have \"Suc i < length xs\" by auto\n moreover obtain x1 xs1 where xs:\"xs=x1#xs1\"\n by (metis (full_types) calculation list.exhaust list.size(3) not_less0) \n moreover have \"\\\\\\<^sub>c ((x1 # xs1) ! i) \\\\<^sub>c\\<^sub>e ((x1 # xs1) ! Suc i)\" \n using Suc\n using calculation(1) cptn_dest_pair xs by blast\n thus ?case using xs by auto\nqed \n \n \nlemma cptn_stepconf_rtrancl:\n assumes cptn_step: \"(\\,cfg1#xs) \\ cptn\" and\n cf_last:\"cfg2 = (last (cfg1#xs))\"\n shows \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* cfg2\"\nusing cptn_step cf_last\nby (metis cptn_stepc_rtrancl prod.collapse)\n\nlemma cptn_all_steps_rtrancl:\n assumes cptn_step: \"(\\,cfg1#xs) \\ cptn\" \n shows \"\\i\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* ((cfg1#xs)!i)\"\nusing cptn_step \nproof (induct xs arbitrary: cfg1)\n case Nil thus ?case by auto\nnext\n case (Cons x xs1) thus ?case\n proof -\n have hyp:\"\\i\\\\<^sub>c x \\\\<^sub>c\\<^sub>e\\<^sup>* ((x # xs1) ! i)\"\n using Cons.hyps Cons.prems cptn_dest_pair by blast \n thus ?thesis\n proof\n {\n fix i\n assume a0:\"i\\\\<^sub>c (cfg1 # x # xs1) ! 0 \\\\<^sub>c\\<^sub>e ((cfg1 # x # xs1) ! Suc 0)\"\n using Cons.prems cptn_stepc_rtran by blast\n then have \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e x\" using Cons by simp\n also have \"i < Suc (Suc (length xs1))\"\n using a0 by force\n ultimately have \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* (cfg1 # x # xs1) ! i\" using hyp Cons\n using converse_rtranclp_into_rtranclp hyp less_Suc_eq_0_disj \n by auto \n } thus ?thesis by auto qed\n qed\nqed\n\n\n(* lemma last_not_F:\nassumes \n a0:\"(\\,xs)\\cptn\" \nshows \"snd (last xs) \\ Fault ` F \\ \\i < length xs. snd (xs!i) \\ Fault ` F\"\nusing a0\nproof(induct) print_cases\n case (CptnOne \\ p s) thus ?case by auto\nnext\n case (Cptn \\ P s t xs) \n thus ?case \n by (metis (no_types, hide_lams) ce_not_normal_s image_iff last_ConsR length_Cons less_Suc_eq_0_disj list.simps(3) nth_Cons_0 \n nth_Cons_Suc snd_conv xstate.distinct(3)) \nqed *)\n\n(* lemma Normal_Normal: \nassumes p1:\"(\\, (P, Normal s) # a # as) \\ cptn\" and \n p2:\"(\\sb. snd (last ((P, Normal s) # a # as)) = Normal sb)\"\nshows \"\\sa. snd a = Normal sa\"\nproof -\n obtain la1 la2 where last_prod:\"last ((P, Normal s)# a#as) = (la1,la2)\" by fastforce\n obtain a1 a2 where a_prod:\"a=(a1,a2)\" by fastforce\n from p1 have clos_p_a:\"\\\\\\<^sub>c (P,Normal s) \\\\<^sub>c\\<^sub>e\\<^sup>* (a1, a2)\" \n using a_prod cptn_elim_cases(2)\n by blast \n then have \"\\\\\\<^sub>c (fst a, snd a) \\\\<^sub>c\\<^sub>e\\<^sup>* (la1,la2)\"\n by (metis cptn_stepconf_rtrancl last_ConsR last_prod list.distinct(1) \n p1 prod.exhaust_sel tl_in_cptn) \n moreover obtain bb where \"Normal bb = la2\" using last_prod p2 by auto\n ultimately show ?thesis by (metis (no_types) steps_ce_not_Normal)\nqed *)\n\nlemma cptn_eq_length:\"(\\,l)\\cptn \\ \n \\i. Suc i< length l \\ length (snd (snd (l!i))) = length (snd (snd (l!(i+1))))\"\nproof-\n assume a0:\"(\\,l)\\cptn\"\n {\n fix i\n assume a00:\"Suc i< length l\"\n moreover obtain a as where \"l = a#as\"\n using a0 calculation by (metis list.exhaust list.size(3) not_less_zero)\n ultimately have \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!Suc i)\" \n using a0\n using cptn_stepc_rtran by blast\n then have \"length (snd (snd (l!i))) = length (snd (snd (l!(i+1))))\"\n by (metis Suc_eq_plus1 ce_eq_length prod.exhaust_sel)\n }\n then show ?thesis by auto\nqed\n\nlemma cptn_all_len_eq_0:\n \"(\\,l)\\cptn \\ snd ( (l!0)) = s \\\n ilength (snd (snd (l!i))) =length (snd s)\"\nproof(induct i)\n case 0\n then show ?case\n by simp \nnext \n case (Suc i)\n then have \"length (snd (snd (l!i))) =length (snd s) \" by auto \n then show ?case using cptn_eq_length Suc by fastforce\nqed\n\nlemma skip_all_skip:\n assumes a0:\"(\\,cfg)\\cptn\" and\n a1:\"cfg = (Skip,s)#cfg1\"\n shows \"\\i,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n have \"\\\\\\<^sub>c(Skip,s) \\\\<^sub>e x\" using cptn_elim_cases_pair(2)[OF Cons(2)[simplified Cons(3)]]\n by (metis step_ce_dest stepc_elim_cases(1)) \n then obtain s' where x:\"x = (Skip,s')\"\n by (metis env_c_c' prod.exhaust_sel) \n moreover have cptn:\"(\\,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n moreover have \n xs:\"x # xs = (LanguageCon.com.Skip, s') # xs\" using x by auto\n ultimately show ?case using Cons(1)[OF cptn xs] Cons(3)\n using diff_Suc_1 fstI length_Cons less_Suc_eq_0_disj nth_Cons' by auto \nqed\n\nlemma skip_all_skip_throw:\n assumes a0:\"(\\,cfg)\\cptn\" and\n a1:\"cfg = (Throw,s)#cfg1\"\n shows \"\\i,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n have ce:\"\\\\\\<^sub>c(Throw,s) \\\\<^sub>c\\<^sub>e x\" \n by (auto intro:cptn_elim_cases_pair(2)[OF Cons(2)[simplified Cons(3)]])\n then obtain s' where x:\"x = (Throw, s')\"\n using ce_Throw_toSkip \n by (metis eq_fst_iff) \n show ?case using x\n by (metis (no_types, lifting) Cons.hyps Cons.prems(2) cptn diff_Suc_1 \n fstI length_Cons less_Suc_eq_0_disj nth_Cons') \nqed\n\n\nlemma cptn_env_same_prog:\nassumes a0: \"(\\, l) \\ cptn\" and\n a1: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a2: \"Suc j < length l\"\nshows \"fst (l!j) = fst (l!0)\"\nusing a0 a1 a2\nproof (induct j arbitrary: l)\n case 0 thus ?case by auto\nnext\n case (Suc j) \n then have \"fst (l!j) = fst (l!0)\" by fastforce\n thus ?case using Suc \n by (metis (no_types) env_c_c' lessI prod.collapse)\n qed\n\n\n\nlemma takecptn_is_cptn [rule_format, elim!]:\n \"\\j. (\\,c) \\ cptn \\ (\\, take (Suc j) c) \\ cptn\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j)\n apply simp\n apply(rule CptnOne)\napply simp\napply(force intro:cptn.intros elim:cptn.cases)\ndone\n\n\n\nlemma dropcptn_is_cptn [rule_format,elim!]:\n \"\\j,c) \\ cptn \\ (\\, drop j c) \\ cptn\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j,simp+)\napply(erule cptn.cases)\n apply simp\n apply force\n done\n\nsubsection\\Modular Definition of Computation\\\ndefinition lift :: \"('g\\'l,'p,'f,'e)com \\ ('g, 'l, 'p,'f,'e) config_gs \\ ('g, 'l, 'p,'f,'e) config_gs\" where\n \"lift Q \\ \\(P, s). ((Seq P Q), s)\" \n\ndefinition lift_catch :: \"('g\\'l,'p,'f,'e)com \\ ('g, 'l, 'p,'f,'e) config_gs \\ ('g, 'l, 'p,'f,'e) config_gs\" where\n \"lift_catch Q \\ \\(P, s). (Catch P Q, s)\" \n\nlemma map_lift_eq_xs_xs':\"map (lift a) xs = map (lift a) xs' \\ xs=xs'\" \nproof (induct xs arbitrary: xs')\n case Nil thus ?case by auto\nnext\n case (Cons x xsa)\n then have a0:\"(lift a) x # map (lift a) xsa = map (lift a) (x # xsa)\"\n by fastforce \n also obtain x' xsa' where xs':\"xs' = x'#xsa'\" \n using Cons by auto\n ultimately have a1:\"map (lift a) (x # xsa) =map (lift a) (x' # xsa')\"\n using Cons by auto\n then have xs:\"xsa=xsa'\" using a0 a1 Cons by fastforce\n then have \"(lift a) x' = (lift a) x\" using a0 a1 by auto\n then have \"x' = x\" unfolding lift_def\n by (metis (no_types, lifting) LanguageCon.com.inject(3) \n case_prod_beta old.prod.inject prod.collapse) \n thus ?case using xs xs' by auto\nqed\n\nlemma map_lift_catch_eq_xs_xs':\"map (lift_catch a) xs = map (lift_catch a) xs' \\ xs=xs'\" \nproof (induct xs arbitrary: xs')\n case Nil thus ?case by auto\nnext\n case (Cons x xsa)\n then have a0:\"(lift_catch a) x # map (lift_catch a) xsa = map (lift_catch a) (x # xsa)\"\n by auto \n also obtain x' xsa' where xs':\"xs' = x'#xsa'\" \n using Cons by auto\n ultimately have a1:\"map (lift_catch a) (x # xsa) =map (lift_catch a) (x' # xsa')\"\n using Cons by auto \n then have xs:\"xsa=xsa'\" using a0 a1 Cons by fastforce \n then have \"(lift_catch a) x' = (lift_catch a) x\" using a0 a1 by auto\n then have \"x' = x\" unfolding lift_catch_def\n by (simp add: prod.case_eq_if prod_eq_iff)\n thus ?case using xs xs' by auto\nqed\n\nlemma map_lift_all_seq:\n assumes a0:\"zs=map (lift a) xs\" and\n a1:\"ib. fst (zs!i) = Seq b a\"\nusing a0 a1\nproof (induct zs arbitrary: xs i)\n case Nil thus ?case by auto\nnext\n case (Cons z1 zsa) thus ?case unfolding lift_def\n proof -\n assume a1: \"z1 # zsa = map (\\b. case b of (P, s) \\ (LanguageCon.com.Seq P a, s)) xs\"\n have \"\\p c. \\x. \\pa ca xa. \n (pa \\ (ca::('a, 'b, 'c, 'd) LanguageCon.com, xa::('a, 'c) xstate) \\ ca = fst pa) \\ \n ((c::('a, 'b, 'c, 'd) LanguageCon.com) \\ fst p \\ (c, x::('a, 'c) xstate) = p)\"\n by fastforce\n then obtain xx :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate\" where\n \"\\p c x ca pa. (p \\ (c::('a, 'b, 'c, 'd) LanguageCon.com, x::('a, 'c) xstate) \\ c = fst p) \\ (ca \\ fst pa \\ (ca, xx pa ca) = pa)\"\n by (metis (full_types)) \n then show ?thesis\n using a1 \\i < length (z1 # zsa)\\\n by (simp add: Cons.hyps Cons.prems(1) case_prod_beta')\n qed\nqed\n\nlemma map_lift_catch_all_catch:\n assumes a0:\"zs=map (lift_catch a) xs\" and\n a1:\"ib. fst (zs!i) = Catch b a\"\nusing a0 a1\nproof (induct zs arbitrary: xs i)\n case Nil thus ?case by auto\nnext\n case (Cons z1 zsa) thus ?case unfolding lift_catch_def\n proof -\n assume a1: \"z1 # zsa = map (\\b. case b of (P, s) \\ (LanguageCon.com.Catch P a, s)) xs\"\n have \"\\p c. \\x. \\pa ca xa. \n (pa \\ (ca::('a, 'b, 'c, 'd) LanguageCon.com, xa::('a, 'c) xstate) \\ ca = fst pa) \\ \n ((c::('a, 'b, 'c, 'd) LanguageCon.com) \\ fst p \\ (c, x::('a, 'c) xstate) = p)\"\n by fastforce\n then obtain xx :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate\" where\n \"\\p c x ca pa. (p \\ (c::('a, 'b, 'c, 'd) LanguageCon.com, x::('a, 'c) xstate) \\ c = fst p) \\ (ca \\ fst pa \\ (ca, xx pa ca) = pa)\"\n by (metis (full_types)) \n then show ?thesis\n using a1 \\i < length (z1 # zsa)\\\n by (simp add: Cons.hyps Cons.prems(1) case_prod_beta')\n qed\nqed\n\nlemma map_lift_some_eq_pos:\n assumes a0:\"map (lift P) xs @ (P1, s1)#ys = \n map (lift P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Seq p0 P\" and\n a2:\"\\p0. P2\\Seq p0 P\" \n shows \"length xs = length xs'\"\nproof -\n {assume ass:\"length xs \\ length xs'\"\n { assume ass:\"length xs < length xs'\"\n then have False using a0 map_lift_all_seq a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n }note l=this\n { assume ass:\"length xs > length xs'\"\n then have False using a0 map_lift_all_seq a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n } then have False using l ass by fastforce\n }\n thus ?thesis by auto\nqed\n\nlemma map_lift_some_eq:\n assumes a0:\"map (lift P) xs @ (P1, s1)#ys = \n map (lift P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Seq p0 P\" and\n a2:\"\\p0. P2\\Seq p0 P\" \n shows \"xs' = xs \\ ys = ys'\"\nproof -\n have \"length xs = length xs'\" using a0 map_lift_some_eq_pos a1 a2 by blast\n also have \"xs' = xs\" using a0 assms calculation map_lift_eq_xs_xs' by fastforce\n ultimately show ?thesis using a0 by fastforce\nqed\n\nlemma map_lift_catch_some_eq_pos:\n assumes a0:\"map (lift_catch P) xs @ (P1, s1)#ys = \n map (lift_catch P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Catch p0 P\" and\n a2:\"\\p0. P2\\Catch p0 P\" \n shows \"length xs = length xs'\"\nproof -\n {assume ass:\"length xs \\ length xs'\"\n { assume ass:\"length xs < length xs'\"\n then have False using a0 map_lift_catch_all_catch a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n }note l=this\n { assume ass:\"length xs > length xs'\"\n then have False using a0 map_lift_catch_all_catch a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n } then have False using l ass by fastforce\n }\n thus ?thesis by auto\nqed\n\nlemma map_lift_catch_some_eq:\n assumes a0:\"map (lift_catch P) xs @ (P1, s1)#ys = \n map (lift_catch P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Catch p0 P\" and\n a2:\"\\p0. P2\\Catch p0 P\" \n shows \"xs' = xs \\ ys = ys'\"\nproof -\n have \"length xs = length xs'\" using a0 map_lift_catch_some_eq_pos a1 a2 by blast\n also have \"xs' = xs\" using a0 assms calculation map_lift_catch_eq_xs_xs' by fastforce\n ultimately show ?thesis using a0 by fastforce\nqed\n\n\n\ninductive_set cptn_mod :: \"(('g,'l,'p,'f,'e) confs) set\"\nwhere\n CptnModOne: \"(\\,[(P, s)]) \\ cptn_mod\"\n| CptnModEnv: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t);(\\,(P, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P, s)#(P, t)#xs) \\ cptn_mod\"\n| CptnModSkip: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Skip,toSeq t); redex P = P;\n snd s = snd t;\n (\\,(Skip, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Skip, t)#xs) \\cptn_mod\"\n| CptnModThrow: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Throw,toSeq t); redex P = P;\n snd s = snd t; (\\,(Throw, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Throw, t)#xs) \\cptn_mod\" \n| CptnModStuck: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Stuck,toSeq t); redex P = P;\n snd s = snd t; (\\,(Stuck, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Stuck, t)#xs) \\cptn_mod\"\n| CptnModFault: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Fault f,toSeq t); redex P = P;\n snd s = snd t; (\\,(Fault f, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Fault f, t)#xs) \\cptn_mod\"\n| CptnModCondT: \"\\(\\,(P0, s)#ys) \\ cptn_mod; fst s \\ b \\ \\ \n (\\,((Cond b P0 P1), s)#(P0, s)#ys) \\ cptn_mod\"\n| CptnModCondF: \"\\(\\,(P1, s)#ys) \\ cptn_mod; fst s \\ b \\ \\ \n (\\,((Cond b P0 P1), s)#(P1, s)#ys) \\ cptn_mod\"\n| CptnModSeq1: \n \"\\(\\,(P0, s)#xs) \\ cptn_mod; zs=map (lift P1) xs \\ \\ \n (\\,((Seq P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModSeq2: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; fst(last ((P0, s)#xs)) = Skip;\n (\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod;\n zs=(map (lift P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (\\,((Seq P0 P1), s)#zs) \\ cptn_mod\"\n(*| CptnModSeq3:\n \"\\ (\\,(P1, s)#xs) \\ cptn_mod\\ \\ (\\,((Seq Skip P1), s)#(P1, s)#xs) \\ cptn_mod\"*)\n\n| CptnModSeq3: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; \n fst(last ((P0, s)#xs)) = t; \n t = Fault f \\ t = Stuck \\ t = Throw;\n snd(last ((P0, s)#xs)) = s'; \n (\\,(t, s')#ys) \\ cptn_mod; \n zs=(map (lift P1) xs)@((t, s')#ys) \\ \\\n (\\,((Seq P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModWhile1: \n \"\\(\\, (P, s)#xs) \\ cptn_mod; fst s \\ b; \n zs=map (lift (While b P)) xs \\ \\ \n (\\, ((While b P), s)#\n ((Seq P (While b P)), s)#zs) \\ cptn_mod\"\n\n| CptnModWhile2: \n \"\\ (\\, (P, s)#xs) \\ cptn_mod; \n fst(last ((P, s)#xs))=Skip; fst s \\ b; \n zs=(map (lift (While b P)) xs)@\n (While b P, snd(last ((P, s)#xs)))#ys; \n (\\,(While b P, snd(last ((P, s)#xs)))#ys) \\ cptn_mod\\ \\ \n (\\,(While b P, s)#\n (Seq P (While b P), s)#zs) \\ cptn_mod\"\n\n| CptnModWhile3: \n \"\\ (\\, (P, s)#xs) \\ cptn_mod; \n fst(last ((P, s)#xs))=t; t=Throw \\ t= Fault f \\ t = Stuck; fst s \\ b;\n snd(last ((P, s)#xs)) = s'; \n (\\,(t, s')#ys) \\ cptn_mod; \n zs=(map (lift (While b P)) xs)@((t, s')#ys)\\ \\ \n (\\,(While b P, s)#\n (Seq P (While b P), s)#zs) \\ cptn_mod\"\n\n| CptnModCall: \"\\(\\,(bdy, s)#ys) \\ cptn_mod;\\ p = Some bdy; bdy\\Call p \\ \\ \n (\\,((Call p), s)#(bdy, s)#ys) \\ cptn_mod\" \n\n| CptnModDynCom: \"\\(\\,(c (fst s), s)#ys) \\ cptn_mod \\ \\ \n (\\,(DynCom c, s)#(c (fst s), s)#ys) \\ cptn_mod\"\n\n| CptnModGuard: \"\\(\\,(c, s)#ys) \\ cptn_mod; fst s \\ g \\ \\ \n (\\,(Guard f g c, s)#(c, s)#ys) \\ cptn_mod\"\n\n| CptnModCatch1: \"\\(\\,(P0, s)#xs) \\ cptn_mod; zs=map (lift_catch P1) xs \\\n \\ (\\,((Catch P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModCatch2: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; fst(last ((P0, s)#xs)) = t; \n t = Skip \\ t = Fault f \\ t=Stuck; \n (\\,(t,snd(last ((P0, s)#xs)))#ys) \\ cptn_mod; \n zs=(map (lift_catch P1) xs)@((t,snd(last ((P0, s)#xs)))#ys) \\ \\ \n (\\,((Catch P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModCatch3: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; fst(last ((P0, s)#xs)) = Throw; \n snd(last ((P0, s)#xs)) = s';\n (\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod; \n zs=(map (lift_catch P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (\\,((Catch P0 P1), s)#zs) \\ cptn_mod\"\n\n\nlemmas CptnMod_induct = cptn_mod.induct [of _ \"[(c,s)]\", split_format (complete), case_names\nCptnModOne CptnModEnv CptnModSkip CptnModThrow CptnModStuck CptnModFault\n CptnModCondT CptnModCondF CptnModSeq1 CptnModSeq2 CptnModSeq3 CptnModWhile1 \nCptnModWhile2 CptnModWhile3 CptnModCall CptnModDynCom CptnModGuard \nCptnModCatch1 CptnModCatch2 CptnModCatch3, induct set]\n\ninductive_cases CptnMod_elim_cases [cases set]:\n\"(\\,(Skip, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Guard f g c, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Basic f e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Spec r e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Seq c1 c2, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Cond b c1 c2, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Await b c2 e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Call p, s)#u#xs) \\ cptn_mod\"\n\"(\\,(DynCom c,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Throw,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Catch c1 c2,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Fault f,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Stuck,s)#u#xs) \\ cptn_mod\"\n\ninductive_cases CptnMod_env_elim_cases [cases set]:\n\"(\\,(P, s)#(P,s')#xs) \\ cptn_mod\"\n\nsubsection \\Equivalence of small semantics and computational\\\n\ndefinition catch_cond \nwhere\n\"catch_cond zs Q xs P s s'' s' \\ \\ (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\t. (fst(((P, s)#xs)!length xs)=t \\ (t=Skip \\ (\\f. t = Fault f) \\ t = Stuck) \\\n (\\ys. (\\,(t,snd(last ((P, s)#xs)))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((t,snd(last ((P, s)#xs)))#ys)))))\n\"\n\nlemma div_catch: assumes cptn_m:\"(\\,list) \\ cptn_mod\"\nshows \"(\\s P Q zs. list=(Catch P Q, s)#zs \\\n (\\xs s' s''. \n (\\,(P, s)#xs) \\ cptn_mod \\ \n catch_cond zs Q xs P s s'' s' \\))\"\nunfolding catch_cond_def\nusing cptn_m\nproof (induct rule: cptn_mod.induct)\ncase (CptnModOne \\ P s)\n thus ?case using cptn_mod.CptnModOne by blast \nnext\n case (CptnModSkip \\ P s t xs) \n from CptnModSkip.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Skip, toSeq t)\" by auto\n thus ?case \n using CptnModSkip.hyps(2) redex_not_Catch by fast\nnext\n case (CptnModThrow \\ P s t xs) \n from CptnModThrow.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Throw, toSeq t)\" by auto \n thus ?case\n using CptnModThrow.hyps(2) redex_not_Catch by fast \nnext\n case (CptnModFault \\ P s f t xs)\n thus ?case\n using redex_not_Catch by force\nnext\n case (CptnModStuck \\ P s t xs)\n thus ?case using redex_not_Catch by force \nnext\n case (CptnModCondT \\ P0 s ys b P1)\n thus ?case using CptnModOne by fast\nnext\n case (CptnModCondF \\ P0 s ys b P1)\n thus ?case using CptnModOne by fast\nnext\n case (CptnModCatch1 sa P Q zs)\n thus ?case by fast\nnext\n case (CptnModCatch2 \\ P0 s xs t f ys zs P1) \n from CptnModCatch2.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = Skip \\\n fst (((P0, s) # xs) ! length xs) = Stuck \\\n (\\f. fst (((P0, s) # xs) ! length xs) = Fault f)\"\n by (metis CptnModCatch2.hyps(4) last_length)\n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact \n then have \"zs = map (lift_catch P1) xs @((Skip, (snd(last ((P0, s)#xs))))#ys) \\ \n zs = map (lift_catch P1) xs @((Stuck, (snd(last ((P0, s)#xs))))#ys)\\\n (\\f. zs = map (lift_catch P1) xs @((Fault f, (snd(last ((P0, s)#xs))))#ys))\"\n using CptnModCatch2.hyps(4) CptnModCatch2.hyps(7) by auto\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, s) # zs = (Catch P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto\n then have \"(P0, s) = (P, sa)\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zs = (map (lift_catch Q) xs)@((t,snd(last ((P0, s)#xs)))#ys)\"\n by (simp add: CptnModCatch2.hyps(7) \\P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa\\) \n then have \"\\xs s' s''.\n (\\, (P, s) # xs) \\ cptn_mod \\\n (zs = map (lift_catch Q) xs \\\n fst (((P, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs)) = s' \\\n s = s'' \\\n (\\ys. (\\, (Q, snd (((P, s) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs =\n map (lift_catch Q) xs @ (Q, snd (((P, s) # xs) ! length xs)) # ys) \\\n (\\t. fst (((P, s) # xs) ! length xs) = t \\\n (t = LanguageCon.com.Skip \\ (\\f. t = com.Fault f) \\ t = com.Stuck) \\\n (\\ys. (\\, (t, snd (last ((P, s) # xs))) # ys) \\ cptn_mod \\\n zs =\n map (lift_catch Q) xs @\n (t, snd (last ((P, s) # xs))) # ys)))\"\n using P0cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` \n last CptnModCatch2.hyps(4)\n by (metis CptnModCatch2.hyps(3) CptnModCatch2.hyps(5) last_length) \n } \n thus ?thesis by auto\n qed\nnext\n case (CptnModCatch3 \\ P0 s xs s' P1 ys zs) \n from CptnModCatch3.hyps(3)\n have last:\"fst (((P0, s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n from CptnModCatch3.hyps(4) \n have lastnormal:\"snd (last ((P0, s) # xs)) = s'\"\n by (simp add: last_length)\n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact\n from CptnModCatch3.hyps(5) have P1cptn:\"(\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod\"\n by (simp add: last_length) \n then have \"zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n by (simp add:CptnModCatch3.hyps)\n show ?case\n by (metis CptnModCatch3.hyps(3) CptnModCatch3.hyps(5) CptnModCatch3.hyps(7) \n LanguageCon.com.inject(10) P0cptn fst_conv last_length \n lastnormal list.inject snd_conv) \nnext\n case (CptnModEnv \\ P s t xs) \n then have step:\"(\\, (P, t) # xs) \\ cptn_mod\" by auto \n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModEnv by auto\n show ?case \n proof (cases P)\n case (Catch P1 P2) \n then have eq_P_Catch:\"(P, t) # xs = (LanguageCon.com.Catch P1 P2, t) # xs\" by auto \n then obtain xsa t' t'' where \n p1:\"(\\, (P1, t) # xsa) \\ cptn_mod\" and p2:\"\n (xs = map (lift_catch P2) xsa \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = t' \\\n t = t'' \\\n (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @ \n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n (\\c. fst (((P1, t) # xsa) ! length xsa) = c \\ \n (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys.(\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @\n ((c, snd (last ((P1, t) # xsa)))#ys))))\" \n using CptnModEnv(3) by fastforce\n have all_step:\"(\\, (P1, s)#((P1, t) # xsa)) \\ cptn_mod\" \n using cptn_mod.CptnModEnv p1 step_e by (metis env_intro_diff_p) \n show ?thesis using p2 \n proof \n assume \"xs = map (lift_catch P2) xsa\"\n have \"(P, t) # xs = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: `xs = map (lift_catch P2) xsa` lift_catch_def local.Catch)\n thus ?thesis using all_step eq_P_Catch by fastforce\n next \n assume \n \"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\ snd (last ((P1, t) # xsa)) = t' \\\n t = t'' \\ (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n (\\c. fst (((P1, t) # xsa) ! length xsa) = c \\ \n (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys.(\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys)))\" \n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\ snd (last ((P1, t) # xsa)) = t' \\\n t = t'' \\ (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys)\"\n then obtain ys where p2_exec:\"(\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys\" \n by fastforce\n from a1 obtain t1 where t_normal: \"t= t1\" by blast\n have f1:\"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t)#xsa)) = LanguageCon.com.Throw\"\n using a1 by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xsa)) = t'\"\n by fastforce \n then have p2_long_exec: \"(\\, (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys) \\ cptn_mod \\\n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys\" using p2_exec \n by (simp add: lift_catch_def local.Catch) \n thus ?thesis using a1 f1 last_normal all_step eq_P_Catch by fastforce \n next \n assume as1:\"\\c. fst (((P1, t) # xsa) ! length xsa) = c \\ \n (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys.(\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys))\" \n then obtain c where as1:\"fst (((P1, t) # xsa) ! length xsa) = c \\ \n (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys.(\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys))\"\n by auto\n then have c:\"c = Skip \\ (\\f. c = Fault f) \\ c = Stuck\" by auto\n then obtain ys where p1:\"(\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n ((c, snd (last ((P1, t) # xsa)))#ys)\"\n proof -\n assume a1: \"\\ys. (\\, (c, snd (last ((P1, t) # xsa))) # ys) \\ cptn_mod \\ (P, t) # xs = map (lift_catch P2) ((P1, t) # xsa) @ (c, snd (last ((P1, t) # xsa))) # ys \\ thesis\"\n have \"(LanguageCon.com.Catch P1 P2, t) # map (lift_catch P2) xsa = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: lift_catch_def)\n thus ?thesis\n using a1 as1 eq_P_Catch by fastforce\n qed \n show ?thesis using p1 as1 all_step eq_P_Catch \n by fastforce\n qed\n qed\n qed (auto)\nqed(force+)\n\n\ndefinition seq_cond \nwhere\n\"seq_cond zs Q xs P s s'' s' \\ \\ (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\t. (fst(((P, s)#xs)!length xs)=t \\ (t=Throw \\ t=Stuck \\ (\\f. t = Fault f)) \\\n snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (\\,(t, s')#ys) \\ cptn_mod \\ zs=(map (lift Q) xs)@((t, s')#ys)))))\n\"\n\nlemma div_seq: assumes cptn_m:\"(\\,list) \\ cptn_mod\"\nshows \"(\\s P Q zs. list=(Seq P Q, s)#zs \\\n (\\xs s' s''. \n (\\,(P, s)#xs) \\ cptn_mod \\ \n seq_cond zs Q xs P s s'' s' \\)) \n \"\nunfolding seq_cond_def\nusing cptn_m\nproof (induct rule: cptn_mod.induct)\n case (CptnModOne \\ P s)\n thus ?case using cptn_mod.CptnModOne by blast \nnext\n case (CptnModSkip \\ P s t xs) \n from CptnModSkip.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Skip, toSeq t)\" by auto\n from CptnModSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1)\n by (metis (no_types) local.step stepc_elim_cases(1)) \n have x: \"\\c c1 c2. redex c = Seq c1 c2 \\ False\"\n using redex_not_Seq by blast\n from CptnModSkip.hyps\n have in_cptn_mod: \"(\\, (Skip, t) # xs) \\ cptn_mod\" by auto \n then show ?case using CptnModSkip.hyps(2) SmallStepCon.redex_not_Seq\n by (metis fst_conv list.inject) \nnext\n case (CptnModThrow \\ P s t xs)\n from CptnModThrow.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Throw, toSeq t)\" by auto \n moreover from CptnModThrow.hyps\n have in_cptn_mod: \"(\\, (Throw, t) # xs) \\ cptn_mod\" by auto \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" \n using CptnModThrow.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto \nnext case (CptnModStuck \\ P s t xs) \n thus ?case\n by (metis Pair_inject SmallStepCon.redex_not_Seq list.inject)\nnext case (CptnModFault \\ P s f t xs) \n thus ?case \n by (metis Pair_inject SmallStepCon.redex_not_Seq list.inject)\nnext \n case (CptnModCondT \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModCondF \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModSeq1 \\ P0 s xs zs P1)\n thus ?case by blast\nnext \n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n from CptnModSeq2.hyps(3) last_length have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact\n from CptnModSeq2.hyps(4) have P1cptn:\"(\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\" by (simp add:CptnModSeq2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, s) # zs = (Seq P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys` \n by force \n then have \"\\xs s' s''.\n (\\, (P, s) # xs) \\ cptn_mod \\\n (zs = map (lift Q) xs \\\n fst (((P, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (\\, (Q, snd (((P, s) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift Q) xs @ (Q, snd (((P, s) # xs) ! length xs)) # ys) \\\n (\\t. fst (((P, s) # xs) ! length xs) = t \\\n (t = LanguageCon.com.Throw \\ t = com.Stuck \\ (\\f. t = com.Fault f)) \\\n snd (last ((P, s) # xs)) = s' \\\n s = s'' \\\n (\\ys. (\\, (t, s') # ys) \\ cptn_mod \\\n zs = map (lift Q) xs @ (t, s') # ys)))\" \n using P0cptn P1cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last \n by blast \n } \n thus ?case by auto qed \nnext\n case (CptnModSeq3 \\ P0 s xs t f s' ys zs P1) \n from CptnModSeq3.hyps(3) \n obtain c where \n last:\"fst (((P0, s) # xs) ! length xs) = c \\ \n (c = Throw \\ c = Stuck \\ (\\f. c = Fault f))\"\n by (metis CptnModSeq3.hyps(4) last_length)\n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact\n from CptnModSeq3.hyps(5) \n have lastnormal:\"snd (last ((P0, s) # xs)) = s'\"\n by blast \n then have \"zs = map (lift P1) xs @ ((c, s')#ys)\" \n by (metis CptnModSeq3.hyps(3) CptnModSeq3.hyps(8) last last_length)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, s) # zs = (Seq P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s= sa \\ zs=zsa\" by auto\n then have \"(P0, s) = (P, sa)\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\" \n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have zsa:\"zsa = (map (lift Q) xs)@((c, s')#ys)\" \n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` \n `zs = map (lift P1) xs @ ((c, s')#ys)`\n by force\n then have a1:\"(\\,(c, s')#ys) \\ cptn_mod\" using CptnModSeq3.hyps(6)\n using CptnModSeq3.hyps(3) \\(P0, s) = (P, sa)\\ \n \\last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\\ last by auto \n \n then have \"(\\xs s' s''. (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\\n fst (((P, sa) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n (\\t. fst (((P, sa) # xs) ! length xs) = t \\\n (t = LanguageCon.com.Throw \\ t = com.Stuck \\ (\\f. t = com.Fault f)) \\\n snd (last ((P, sa) # xs)) = s' \\\n sa = s'' \\\n (\\ys. (\\, (t, s') # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (t, s') # ys))))\"\n using P0cptn zsa a1 last lastnormal\n using \\P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa\\ by blast \n } \n thus ?thesis by fastforce qed \nnext \n case (CptnModEnv \\ P s t zs) \n then have step:\"(\\, (P, t) # zs) \\ cptn_mod\" by auto\n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModEnv by auto \n show ?case \n proof (cases P)\n case (Seq P1 P2) \n then have eq_P:\"(P, t) # zs = (LanguageCon.com.Seq P1 P2, t) # zs\" by auto \n then obtain xs t' t'' c where \n p1:\"(\\, (P1, t) # xs) \\ cptn_mod\" and \n p2:\"(zs = map (lift P2) xs \\ \n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ c = Stuck \\ (\\f. c = Fault f)) \\\n snd (last ((P1, t) # xs)) = t' \\\n t = t'' \\ (\\ys. (\\,(c, t')#ys) \\ cptn_mod \\ \n zs = map (lift P2) xs @ ((c, t')#ys))) \" \n using CptnModEnv(3) by fastforce\n have all_step:\"(\\, (P1, s)#((P1, t) # xs)) \\ cptn_mod\"\n using cptn_mod.CptnModEnv p1 step_e\n by (metis env_intro_diff_p) \n show ?thesis using p2 \n proof \n assume \"zs = map (lift P2) xs\"\n have \"(P, t) # zs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: `zs = map (lift P2) xs` lift_def local.Seq)\n thus ?thesis using all_step eq_P by fastforce\n next \n assume \n \"(fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ c = Stuck \\ (\\f. c = Fault f)) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ (\\ys. (\\,(c, t')#ys) \\ cptn_mod \\ \n zs = map (lift P2) xs @ ((c, t')#ys))) \"\n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys)\"\n from a1 obtain ys where \n p2_exec:\"(\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys\" \n by auto \n have f1:\"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs)) = LanguageCon.com.Skip\"\n using a1 by fastforce \n then have p2_long_exec: \n \"(\\, (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys) \\ cptn_mod \\\n (P, t)#zs = map (lift P2) ((P1, t) # xs) @\n (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys\" \n using p2_exec by (simp add: lift_def local.Seq) \n thus ?thesis using a1 f1 all_step eq_P by blast \n next\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ c = Stuck \\ (\\f. c = Fault f)) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ (\\ys. (\\,(c, t')#ys) \\ cptn_mod \\ \n zs = map (lift P2) xs @ ((c, t')#ys))\" \n then have last_throw:\n \"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t) #xs)) = c\" \n by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xs)) = t'\"\n by fastforce\n have seq_lift:\n \"(LanguageCon.com.Seq P1 P2, t) # map (lift P2) xs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: a1 lift_def) \n thus ?thesis using a1 last_throw last_normal all_step eq_P \n by (clarify, metis (no_types, lifting) append_Cons ) \n qed\n qed\n qed (auto) \nqed (force)+\n\n\n\nlemma cptn_onlyif_cptn_mod_aux:\n assumes vars:\"v = toSeq s\" and vars1:\"w = toSeq t\" and stepseq:\"\\\\\\<^sub>c (P,v) \\ (Q,w)\" and\n normal_eq_l:\"snd s = snd t\" and\n stepmod:\"(\\,(Q,t)#xs) \\ cptn_mod\"\nshows \"(\\,(P,s)#(Q,t)#xs) \\ cptn_mod\"\nusing stepseq normal_eq_l stepmod vars vars1\nproof (induct arbitrary: xs)\n case (Basicc f e s1) \n thus ?case using stepc.Basicc[of \\ f e s1] \n by (simp add: cptn_mod.CptnModSkip) \nnext\n case (Specc s1 t1 r)\n thus ?case using stepc.Specc[of s1 t1 r \\] by (simp add: cptn_mod.CptnModSkip)\nnext\n case (SpecStuckc s1 r)\n thus ?case using stepc.SpecStuckc[of s1 _ \\] by (simp add: cptn_mod.CptnModStuck) \nnext\n case (Guardc s1 g f c)\n thus ?case\n by (metis cptn_modp.CptnModGuard cptn_modp_cptn_mod_eq prod.exhaust_sel toSeq.simps)\nnext\n case (GuardFaultc)\n thus ?case\n by (simp add: cptn_mod.CptnModFault stepc.GuardFaultc) \nnext\n case (Seqc c1 s1 c1' t1 c2) \n have step: \"\\\\\\<^sub>c (c1, s1) \\ (c1', t1)\" by (simp add: Seqc.hyps(1))\n then have nsc1: \"c1\\Skip\" \n using stepc_elim_cases(1) by auto\n have assum: \"(\\, (Seq c1' c2, t) # xs) \\ cptn_mod\" using Seqc.prems by blast\n have divseq:\"(\\s P Q zs. (Seq c1' c2, t) # xs=(Seq P Q, s)#zs \\\n (\\xs sv' sv''. \n ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift Q) xs) \\ \n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, s)#xs)!length xs)=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((P, s)#xs)) = sv' \\ t= sv''\\\n (\\ys. (\\,(c, sv')#ys) \\ cptn_mod \\ zs=(map (lift Q) xs)@((c, sv')#ys))))))))\" \n using div_seq [OF assum] unfolding seq_cond_def by auto\n { fix sa P Q zsa\n assume ass:\"(Seq c1' c2, t) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ t = sa \\ xs = zsa\" by auto\n then have \"\\xs sv' sv''. \n (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n (\\c. (fst(((P, sa)#xs)!length xs)=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f))\\\n snd(last ((P, sa)#xs)) = sv' \\ t= sv''\\\n (\\ys. (\\,(c, sv')#ys) \\ cptn_mod \\ zsa=(map (lift Q) xs)@((c, sv')#ys)))))\" \n using ass divseq by blast\n } note conc=this [of c1' c2 t xs] \n then obtain xs' sa' sa''\n where split:\"(\\, (c1', t) # xs') \\ cptn_mod \\\n (xs = map (lift c2) xs' \\ \n fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (\\,(c, sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((c, sa')#ys)))))\" by blast\n then have \"xs = map (lift c2) xs' \\ \n fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1',t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (\\,(c, sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((c, sa')#ys))))\" by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift c2) xs'\"\n then have c1'cptn:\"(\\, (c1', t) # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Seqc.hyps(2)\n using Seqc.prems(3) Seqc.prems(4) normal_eq_l by blast \n then have \"(Seq c1' c2, t)#xs = map (lift c2) ((c1', t)#xs')\"\n using c1'nonf\n by (simp add: CptnModSeq1 lift_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModSeq1)\n next\n assume \"fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (\\,(c, sa')#ys) \\ cptn_mod \\ xs=(map (lift c2) xs')@((c, sa')#ys))))\" \n thus ?thesis\n proof\n assume assth:\n \"fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys)\"\n then obtain ys where split':\n \"(\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n by auto \n then have c1'cptn:\"(\\, (c1', t) # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Seqc.hyps(2)\n using Seqc.prems(3) Seqc.prems(4) normal_eq_l by blast \n then have seqmap:\"(Seq c1 c2, s)#(Seq c1' c2, t)#xs = map (lift c2) ((c1,s)#(c1', t)#xs') @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using split' \n by (simp add: CptnModSeq2 lift_def) \n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = Skip\" \n using assth by fastforce \n thus ?thesis \n using seqmap split' last_length cptn_mod.CptnModSeq2 induct_step lastc1 lastc1skip\n by (smt append_Cons list.inject list.simps(9)) \n next\n assume assm: \n \"\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (\\,(c, sa')#ys) \\ cptn_mod \\ xs=(map (lift c2) xs')@((c, sa')#ys)))\"\n then obtain c where \n c:\"(fst(((c1', t)#xs')!length xs')=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (\\,(c, sa')#ys) \\ cptn_mod \\ xs=(map (lift c2) xs')@((c, sa')#ys)))\" by auto\n then have s'eqsa'': \"t= sa''\" by auto\n then have snormal: \"\\ns. s= ns\" using c_step normal_eq_l by blast\n then have c1'cptn:\"(\\, (c1', t) # xs') \\ cptn_mod\" using split by blast \n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Seqc.hyps(2) Seqc.prems(3) Seqc.prems(4) normal_eq_l by blast \n then obtain ys where seqmap:\n \"(Seq c1' c2, t)#xs = (map (lift c2) ((c1', t)#xs'))@((c, sa')#ys)\"\n using assm using c unfolding lift_def by auto \n moreover have \"fst (last ((c1, s) # (c1', t) # xs')) = c\" \n using c by (simp add: c last_length) \n moreover have \"snd (last ((c1, s) # (c1', t) # xs')) = sa'\" using c by (auto simp add: last_length) \n ultimately show ?thesis\n using assm c1'cptn induct_step snormal seqmap s'eqsa'' \n by (auto simp add:cptn_mod.CptnModSeq3)\n qed\n }qed \nnext\n case (SeqSkipc c2 s1 xs)\n then have c2incptn:\"(\\, (c2, s) # xs) \\ cptn_mod\"\n using eq_toSeq by blast\n moreover have 1:\"(\\, [(Skip, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n moreover have 2:\"fst(last ([(Skip, s)])) = Skip\" by fastforce\n moreover have 3:\"(\\,(c2, snd(last [(Skip, s)]))#xs) \\ cptn_mod\" \n using c2incptn by auto \n moreover have \"(c2,s)#xs=(map (lift c2) [])@(c2, snd(last [(Skip, s)]))#xs\"\n by (auto simp add:lift_def)\n moreover have \"s=t\" using eq_toSeq SeqSkipc by blast\n ultimately show ?case \n by (simp add: CptnModSeq2)\nnext\n case (SeqThrowc c2 s1 xs) \n have eq_st:\"s=t\" using eq_toSeq[OF SeqThrowc(1)] SeqThrowc by auto\n obtain ns where normals:\"s= ns\" using SeqThrowc by auto \n have \"(\\, [(Throw, ns)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne) \n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Throw, s)#ys)\\ cptn_mod\" \n using normals by auto\n moreover have \"fst (last ((Throw, ns)#ys)) = Throw\" using ys_nil last by auto\n moreover have \"snd (last ((Throw, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case using SeqThrowc.prems cptn_mod.CptnModSeq3 eq_st normals\n by (metis append_Nil)\nnext \n case (SeqFaultc f c2 sa xs)\n have eq_st:\"s=t\" \n using SeqFaultc.prems(3) SeqFaultc.prems(4) eq_toSeq normal_eq_l by blast\n obtain ns where normals:\"s= ns\" by auto \n have \"(\\, [(Fault f, ns)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne) \n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Fault f, s)#ys)\\ cptn_mod\" \n using normals by auto\n moreover have \"fst (last ((Fault f, ns)#ys)) = Fault f\" using ys_nil last by auto\n moreover have \"snd (last ((Fault f, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case using SeqFaultc.prems cptn_mod.CptnModSeq3 eq_st normals\n by (metis append_Nil)\nnext \n case (SeqStuckc c2 sa xs)\n have eq_st:\"s=t\" \n using SeqStuckc.prems(3) SeqStuckc.prems(4) eq_toSeq normal_eq_l by blast\n obtain ns where normals:\"s= ns\" by auto \n have \"(\\, [(Stuck, ns)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne) \n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Stuck, s)#ys)\\ cptn_mod\" \n using normals by auto\n moreover have \"fst (last ((Stuck, ns)#ys)) = Stuck\" using ys_nil last by auto\n moreover have \"snd (last ((Stuck, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case using SeqStuckc.prems cptn_mod.CptnModSeq3 eq_st normals\n by (metis append_Nil)\nnext\n case (CondTruec s1 b c1 c2)\n moreover obtain ns where normals:\"s= ns\" by fastforce \n moreover have \"s=t\"\n using calculation(4,5) eq_toSeq[OF calculation(2)] by auto\n ultimately show ?case by (simp add: cptn_mod.CptnModCondT)\nnext\n case (CondFalsec s1 b c1 c2)\n moreover obtain ns where normals:\"s= ns\" by fastforce\n moreover have \"s=t\"\n using calculation(4,5) eq_toSeq[OF calculation(2)] by auto\n ultimately show ?case\n by (simp add: cptn_mod.CptnModCondF)\nnext\n case (WhileTruec s1 b c)\n have sinb: \"s1\\b\" by fact\n obtain ns where normals:\"s= ns\" by fastforce\n have eq_st:\"s=t\" using eq_toSeq[OF WhileTruec(2)] WhileTruec by fastforce\n have SeqcWhile: \"(\\, (Seq c (While b c), ns) # xs) \\ cptn_mod\" \n using sinb normals eq_st WhileTruec by blast \n have divseq:\n \"(\\s P Q zs. (Seq c (While b c), ns) # xs=(Seq P Q, s)#zs \\\n (\\xs s'. ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, s)#xs)!length xs)=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((P, s)#xs)) = s' \\\n (\\ys. (\\,(c, s')#ys) \\ cptn_mod \\ zs=(map (lift Q) xs)@((c, s')#ys)))))) \n ))\" \n using div_seq [OF SeqcWhile] eq_st normals unfolding seq_cond_def by fastforce\n { fix sa P Q zsa\n assume ass:\"(Seq c (While b c), ns) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c = P \\ (While b c) = Q \\ ns = sa \\ xs = zsa\" by auto\n then have \n \"(\\xs s'. (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n (\\c. (fst(((P, sa)#xs)!length xs)=c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((P, sa)#xs)) = s' \\ \n (\\ys. (\\,(c, s')#ys) \\ cptn_mod \\ zsa=(map (lift Q) xs)@((c, s')#ys))))))\" \n using ass divseq by fastforce\n } note conc=this [of c \"While b c\" \" ns\" xs] \n then obtain xs' s' \n where split:\n \"(\\, (c, ns) # xs') \\ cptn_mod \\\n (xs = map (lift (While b c)) xs' \\\n fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\t. fst (((c, ns) # xs') ! length xs') = t \\ (t=Throw \\ t=Stuck \\ (\\f. t = Fault f)) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (\\, ((t, s')#ys)) \\ cptn_mod \\ xs = map (lift (While b c)) xs' @ ((t, s')#ys))))\"\n by blast\n then have \n \"xs = map (lift (While b c)) xs' \\\n fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\t. fst (((c, ns) # xs') ! length xs') = t \\ (t=Throw \\ t=Stuck \\ (\\f. t = Fault f)) \\\n snd (last ((c, ns) # xs')) = s' \\\n (\\ys. (\\, ((t, s')#ys)) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ ((t, s')#ys)))\" ..\n thus ?case\n proof{ \n assume 1:\"xs = map (lift (While b c)) xs'\" \n have 3:\"(\\, (c, ns) # xs') \\ cptn_mod\" using split by auto \n then show ?thesis using \"1\" cptn_mod.CptnModWhile1 sinb normals eq_st WhileTruec.prems(3) \n by fastforce \n next\n assume \n \"fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\t. fst (((c, ns) # xs') ! length xs') = t \\ (t=Throw \\ t=Stuck \\ (\\f. t = Fault f)) \\\n snd (last ((c, ns) # xs')) = s' \\\n (\\ys. (\\, ((t, s')#ys)) \\ cptn_mod \\ xs = map (lift (While b c)) xs' @ ((t, s')#ys)))\"\n thus ?case\n proof\n assume asm:\"fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\"\n then obtain ys where asm':\n \"(\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ (While b c, snd (((c, ns) # xs') ! length xs')) # ys\" \n by (auto simp add: last_length)\n moreover have 3:\"(\\, (c, ns) # xs') \\ cptn_mod\" using split by auto\n moreover from asm have \"fst (last ((c, ns) # xs')) = Skip\"\n by (simp add: last_length) \n ultimately show ?case using sinb normals eq_st WhileTruec.prems(3)\n by (metis cptn_mod.CptnModWhile2 last_length toSeq.simps) \n next\n assume asm:\n \"\\t. fst (((c, ns) # xs') ! length xs') = t \\ (t=Throw \\ t=Stuck \\ (\\f. t = Fault f)) \\\n snd (last ((c, ns) # xs')) = s' \\\n (\\ys. (\\, ((t, s')#ys)) \\ cptn_mod \\ xs = map (lift (While b c)) xs' @ ((t, s')#ys))\" \n moreover have 3:\"(\\, (c, ns) # xs') \\ cptn_mod\" using split by auto\n moreover from asm obtain v \n where \"fst (last ((c, ns) # xs')) = v \\ (v=Throw \\ v=Stuck \\ (\\f. v = Fault f))\"\n by (metis last_length) \n ultimately show ?case using sinb normals eq_st WhileTruec.prems(3) CptnModWhile3\n by (metis (no_types, lifting) last_length toSeq.simps) \n qed\n }qed \nnext\n case (WhileFalsec s1 b c)\n thus ?case using stepc.WhileFalsec[of s1 b \\ c] \n by (simp add: cptn_mod.CptnModSkip) \nnext\n case (Awaitc s1 b \\a c t1)\n thus ?case using stepc.Awaitc[of s1 b \\a \\]\n by (simp add: cptn_mod.CptnModSkip)\nnext\n case (AwaitAbruptc s1 b \\a c t1 ta)\n thus ?case using stepc.AwaitAbruptc[of s1 b \\a \\ c t1 ta] by (simp add: cptn_mod.CptnModThrow) \nnext \n case (AwaitFaultc s1 b \\a c f t1 ta)\n thus ?case using stepc.AwaitFaultc\n by (simp add: stepc.AwaitFaultc cptn_mod.CptnModFault) \nnext \n case (AwaitStuckc s1 b \\a c t1 ta)\n thus ?case using stepc.AwaitStuckc\n by (simp add: stepc.AwaitStuckc cptn_mod.CptnModStuck) \nnext\n case (Callc p bdy s1)\n moreover have eq_st:\"s=t\" using eq_toSeq[OF Callc(3)] Callc by auto\n then show ?case using cptn_mod.CptnModCall\n by (simp add: cptn_mod.CptnModCall calculation(1) calculation(2) calculation(4)) \nnext\n case (CallUndefinedc p s1) \n thus ?case using stepc.CallUndefinedc[of \\ p s1,OF CallUndefinedc(1)]\n by (simp add: cptn_mod.CptnModStuck)\nnext\n case (DynComc c s1)\n moreover obtain ns where \"s= ns\" by auto \n moreover have \"fst ns = s1\"\n using calculation(3) calculation(5) by auto\n moreover have \"s=t\"\n using calculation(3,4) eq_toSeq[OF DynComc(1)] by force \n ultimately show ?case \n proof -\n show ?thesis\n using \\(\\, (c s1, t) # xs) \\ cptn_mod\\ \\fst ns = s1\\ \\s = ns\\ \\s = t\\ \n cptn_mod.CptnModDynCom by blast\n qed \nnext\n case (Catchc c1 s1 c1' t1 c2)\n have step: \"\\\\\\<^sub>c (c1, s1) \\ (c1', t1)\" by (simp add: Catchc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1)\n by fastforce \n have assum: \"(\\, (Catch c1' c2, t) # xs) \\ cptn_mod\" \n using Catchc.prems by blast\n have divcatch:\n \"(\\s P Q zs. (Catch c1' c2, t) # xs=(Catch P Q, s)#zs \\\n (\\xs s' s''. ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\t. (fst(((P, s)#xs)!length xs)=t \\ (t=Skip \\ (\\f. t = Fault f) \\ t = Stuck) \\ \n (\\ys. (\\,(t,snd(last ((P, s)#xs)))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((t,snd(last ((P, s)#xs)))#ys))))))))\" \n using div_catch [OF assum] by (auto simp add: catch_cond_def)\n {fix sa P Q zsa\n assume ass:\"(Catch c1' c2, t) # xs = (Catch P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ t = sa \\ xs = zsa\" by auto\n then have \"(\\xs sv' sv''. ((\\,(P, sa)#xs) \\ cptn_mod \\ \n (zsa=(map (lift_catch Q) xs) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\\n snd(last ((P, sa)#xs)) = sv' \\ t= sv''\\\n (\\ys. (\\,(Q, snd(((P, sa)#xs)!length xs))#ys) \\ cptn_mod \\ \n zsa=(map (lift_catch Q) xs)@((Q, snd(((P, sa)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, sa)#xs)!length xs)=c \\ (c=Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\ \n (\\ys. (\\,(c,snd(last ((P, sa)#xs)))#ys) \\ cptn_mod \\ \n zsa=(map (lift_catch Q) xs)@((c,snd(last ((P, sa)#xs)))#ys)))))))\" \n using ass divcatch by fastforce\n } note conc=this [of c1' c2 t xs] \n then obtain xs' sa' sa'' where split:\n \"(\\, (c1', t) # xs') \\ cptn_mod \\ \n (xs = map (lift_catch c2) xs' \\\n fst (((c1', t) # xs') ! length xs') = Throw \\\n snd (last ((c1', t) # xs')) = sa' \\ t = sa'' \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. fst (((c1', t) # xs') ! length xs') = c \\ (c=Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (\\,(c,snd(last ((c1', t)#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((c,snd(last ((c1', t)#xs')))#ys))))\" \n by blast\n note conjunct2[OF split] \n thus ?case \n proof{\n assume c1'nonf:\"xs = map (lift_catch c2) xs'\" \n then have c1'cptn:\"(\\, (c1', t) # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Catchc.hyps(2) Catchc.prems(3) Catchc.prems(4) normal_eq_l by blast\n then have \"(Catch c1' c2, t)#xs = map (lift_catch c2) ((c1', t)#xs')\"\n using c1'nonf\n by (simp add: CptnModCatch1 lift_catch_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModCatch1)\n next\n assume \"fst (((c1', t) # xs') ! length xs') = Throw \\\n snd (last ((c1', t) # xs')) = sa' \\ t = sa'' \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. fst (((c1', t) # xs') ! length xs') = c \\ (c=Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (\\,(c,snd(last ((c1', t)#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((c,snd(last ((c1', t)#xs')))#ys)))\" \n thus ?thesis\n proof\n assume assth:\n \"fst (((c1', t) # xs') ! length xs') = Throw \\\n snd (last ((c1', t) # xs')) = sa' \\ t = sa'' \\\n (\\ys. (\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys)\" \n then have snormal: \"\\ns. s= ns\" by auto\n then obtain ys \n where split':\"(\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using assth by auto \n then have c1'cptn:\"(\\, (c1',t) # xs') \\ cptn_mod\" \n using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Catchc.hyps(2) Catchc.prems(3) Catchc.prems(4) normal_eq_l by blast\n then have seqmap:\"(Catch c1 c2, s)#(Catch c1' c2, t)#xs = \n map (lift_catch c2) ((c1,s)#(c1', t)#xs') @ \n (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using split' by (simp add: CptnModCatch3 lift_catch_def) \n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = Throw\" \n using assth by fastforce\n then have \"snd (last ((c1, s) # (c1', t) # xs')) = sa'\" \n using assth by force\n thus ?thesis \n using snormal seqmap split' \n cptn_mod.CptnModCatch3 induct_step lastc1 lastc1skip by fastforce\n \n next \n assume assm:\n \"(\\c. fst (((c1', t) # xs') ! length xs') = c \\ (c=Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (\\,(c,snd(last ((c1', t)#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((c,snd(last ((c1', t)#xs')))#ys)))\" \n then obtain c where assm:\n \"fst (((c1', t) # xs') ! length xs') = c \\ (c=Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (\\,(c,snd(last ((c1', t)#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((c,snd(last ((c1', t)#xs')))#ys))\" by auto\n then have c1'cptn:\"(\\, (c1', t) # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', t)#xs') \\ cptn_mod\"\n using Catchc.hyps(2) Catchc.prems(3) Catchc.prems(4) normal_eq_l by blast \n then have \"map (lift_catch c2) ((c1', t) # xs') = \n (Catch c1' c2, t) # map (lift_catch c2) xs'\" \n by (auto simp add: lift_catch_def)\n then obtain ys\n where seqmap:\"(Catch c1' c2, t)#xs = \n (map (lift_catch c2) ((c1', t)#xs'))@((c,snd(last ((c1', t)#xs')))#ys)\" \n using assm by fastforce\n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = c\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', t) # xs')) = snd (last ((c1',t) # xs'))\"\n using assm by force\n thus ?thesis \n using assm c1'cptn seqmap \n cptn_mod.CptnModCatch2[OF induct_step lastc1skip] \n by fastforce\n qed\n }qed \nnext\n case (CatchThrowc c2 s1)\n then obtain ns where ns:\"s = ns\"\n by auto\n then have eq_st: \"s=t\" using eq_toSeq[OF CatchThrowc(1)] CatchThrowc(3,4) by auto\n then have c2incptn:\"(\\, (c2, ns) # xs) \\ cptn_mod\" using ns CatchThrowc\n by auto\n then have 1:\"(\\, [(Throw, ns)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then have 2:\"fst(last ([(Throw, ns)])) = Throw\" by fastforce\n then have 3:\"(\\,(c2, snd(last [(Throw, ns)]))#xs) \\ cptn_mod\" \n using c2incptn by auto \n then have \"(c2, ns)#xs=(map (lift c2) [])@(c2, snd(last [(Throw, ns)]))#xs\" \n by (auto simp add:lift_def)\n thus ?case using eq_st ns CptnModCatch3 1 2 3\n by fastforce \nnext\n case (CatchSkipc c2 s1)\n have \"(\\, [(Skip, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Skip, s)#ys)\\ cptn_mod\"\n by auto\n moreover have \"fst (last ((Skip, s)#ys)) = Skip\" using ys_nil last by auto\n moreover have \"snd (last ((Skip, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto \n moreover have \"s=t\"\n using CatchSkipc.prems(3) CatchSkipc.prems(4) eq_toSeq normal_eq_l by blast \n ultimately show ?case using CatchSkipc.prems by (simp add: cptn_mod.CptnModCatch2 ys_nil)\nnext\n case (CatchFaultc f c2 sa xs) \n have \"(\\, [(Fault f, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Fault f, s)#ys)\\ cptn_mod\"\n by auto\n moreover have \"fst (last ((Fault f, s)#ys)) = Fault f\" using ys_nil last by auto\n moreover have \"snd (last ((Fault f , s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto \n moreover have \"s=t\"\n using CatchFaultc.prems(3) CatchFaultc.prems(4) eq_toSeq normal_eq_l by blast \n ultimately show ?case\n by (metis CatchFaultc.prems(2) append_Nil cptn_modp.CptnModCatch2 cptn_modp_cptn_mod_eq)\nnext\n case (CatchStuckc c2 sa xs) \n have \"(\\, [(Stuck, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Stuck, s)#ys)\\ cptn_mod\"\n by auto\n moreover have \"fst (last ((Stuck, s)#ys)) = Stuck\" using ys_nil last by auto\n moreover have \"snd (last ((Stuck , s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto \n moreover have \"s=t\"\n using CatchStuckc.prems(3) CatchStuckc.prems(4) eq_toSeq normal_eq_l by blast \n ultimately show ?case\n by (metis CatchStuckc.prems(2) append_Nil cptn_modp.CptnModCatch2 cptn_modp_cptn_mod_eq)\nqed\n\nlemma cptn_onlyif_cptn_mod: \nassumes cptn_asm:\"(\\,c) \\ cptn\"\nshows \"(\\,c) \\ cptn_mod\"\nusing cptn_asm\nproof (induct) \n case CptnOne thus ?case by (rule CptnModOne)\nnext\n case (Cptn \\ P s Q t xs)\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (Q, t) \\ \\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t)\"\n using step_ce_not_step_e_step_c by blast\n moreover{\n assume \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (Q, t)\"\n then have ?case\n using Cptn.hyps(3) cptn_mod.CptnModEnv env_c_c' by blast\n }\n moreover{\n assume a00:\"\\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t)\" \n moreover have \"\\ \\\\\\<^sub>c (P, s) \\\\<^sub>e (Q, t)\"\n using env_c_c' mod_env_not_component calculation by fast \n ultimately have ?case using cptn_onlyif_cptn_mod_aux[OF _ _ a00 _ Cptn(3)] Cptn\n using step_dest1 by fast\n }\n ultimately show ?case by auto \nqed\n\nlemma lift_is_cptn: \nassumes cptn_asm:\"(\\,c)\\cptn\"\nshows \"(\\,map (lift P) c) \\ cptn\"\nusing cptn_asm\nproof (induct) \n case CptnOne\n have \"\\p f. (f, [p]) \\ cptn\"\n using cptn.simps by fastforce\n then show ?case by fastforce\nnext\n case (Cptn \\ Pa s Q t xs)\n have \"\\\\\\<^sub>c (Pa, s) \\\\<^sub>e (Q, t) \\ \\\\\\<^sub>c (Pa, toSeq s) \\ (Q, toSeq t)\"\n using Cptn.hyps(1) step_ce_not_step_e_step_c by blast\n moreover{\n assume \"\\\\\\<^sub>c (Pa, s) \\\\<^sub>e (Q, t)\" \n then have ?case using Cptn unfolding lift_def \n by (cases rule: step_e.cases, (simp add: Env cptn.Cptn e_step)) \n }\n moreover {\n assume \"\\\\\\<^sub>c (Pa, toSeq s) \\ (Q, toSeq t)\"\n moreover have \"\\\\\\<^sub>c (LanguageCon.com.Seq Pa P, toSeq s) \\ (LanguageCon.com.Seq Q P, toSeq t)\"\n using Seqc calculation\n by (simp add: Seqc)\n ultimately have \"\\\\\\<^sub>c (LanguageCon.com.Seq Pa P, s) \\\\<^sub>c\\<^sub>e (LanguageCon.com.Seq Q P, t)\"\n using Cptn.hyps(1) c_step[of \\ \"LanguageCon.com.Seq Pa P\" s \"LanguageCon.com.Seq Q P\" t] \n env_c_c' step_ce_step_c_eq_c step_dest by blast\n then have ?case using Cptn by (simp add: cptn.Cptn lift_def)\n }\n ultimately show ?case by auto\nqed\n\nlemma lift_catch_is_cptn:\nassumes cptn_asm:\"(\\,c)\\cptn\"\nshows \"(\\,map (lift_catch P) c) \\ cptn\"\nusing cptn_asm\nproof (induct)\n case CptnOne\n have \"\\p f. (f, [p]) \\ cptn\"\n using cptn.simps by fastforce\n then show ?case by fastforce \nnext\n case (Cptn \\ Pa s Q t xs)\n have \"\\\\\\<^sub>c (Pa, s) \\\\<^sub>e (Q, t) \\ \\\\\\<^sub>c (Pa, toSeq s) \\ (Q, toSeq t)\"\n using Cptn.hyps(1) step_ce_not_step_e_step_c by blast\n moreover{\n assume \"\\\\\\<^sub>c (Pa, s) \\\\<^sub>e (Q, t)\" \n then have ?case using Cptn unfolding lift_catch_def\n by (cases rule: step_e.cases, (simp add: Env cptn.Cptn e_step)) \n }\n moreover {\n assume \"\\\\\\<^sub>c (Pa, toSeq s) \\ (Q, toSeq t)\"\n moreover have \"\\\\\\<^sub>c (LanguageCon.com.Catch Pa P, toSeq s) \\ (LanguageCon.com.Catch Q P, toSeq t)\"\n using Catchc calculation by auto\n ultimately have \"\\\\\\<^sub>c (LanguageCon.com.Catch Pa P, s) \\\\<^sub>c\\<^sub>e (LanguageCon.com.Catch Q P, t)\"\n using Cptn.hyps(1) c_step[of \\ \"LanguageCon.com.Catch Pa P\" s \"LanguageCon.com.Catch Q P\" t] \n env_c_c' step_ce_step_c_eq_c step_dest by blast \n then have ?case using Cptn by (simp add: cptn.Cptn lift_catch_def)\n }\n ultimately show ?case by auto \nqed\n\nlemma last_lift: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=Q\\ \n \\ fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=Seq Q P\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_lift_catch: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=Q\\ \n \\ fst((map (lift_catch P) xs)!(length (map (lift_catch P) xs)- (Suc 0)))=Catch Q P\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_catch_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\ \\P a \\ P (x!(length x - (Suc 0)))\" \n by (induct x) simp_all\n\n\nlemma last_fst_esp: \n \"fst(((P,s)#xs)!(length xs))=Skip \\ P\\Skip \\ fst(xs!(length xs - (Suc 0)))=Skip\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\[] \\ \n snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma last_snd_catch: \"xs\\[] \\ \n snd(((map (lift_catch P) xs))!(length (map (lift_catch P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_catch_def)\n\nlemma Cons_lift: \"((Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((P, s) # xs)\"\n by (simp add:lift_def)\nthm last_map eq_snd_iff list.inject list.simps(9) last_length\nlemma Cons_lift_catch: \"((Catch P Q), s) # (map (lift_catch Q) xs) = map (lift_catch Q) ((P, s) # xs)\"\n by (simp add:lift_catch_def)\n\nlemma Cons_lift_append: \n \"((Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((P, s) # xs)@ ys \"\n by (simp add:lift_def)\n\nlemma Cons_lift_catch_append: \n \"((Catch P Q), s) # (map (lift_catch Q) xs) @ ys = map (lift_catch Q) ((P, s) # xs)@ ys \"\n by (simp add:lift_catch_def)\n\nlemma lift_nth: \"i map (lift Q) xs ! i = lift Q (xs! i)\"\n by (simp add:lift_def)\n\nlemma lift_catch_nth: \"i map (lift_catch Q) xs ! i = lift_catch Q (xs! i)\"\n by (simp add:lift_catch_def)\nthm list.simps(9) last_length lift_catch_def Cons_lift_catch\nlemma snd_lift: \"i< length xs \\ snd(lift Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_def)\n\nlemma snd_lift_catch: \"i< length xs \\ snd(lift_catch Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_catch_def)\n\n\nlemma lift_P1: \n assumes map_cptn:\"(\\, map (lift Q) ((P, s) # xs)) \\ cptn\" and\n P_ends:\"fst (last ((P, s) # xs)) = Skip\"\n shows \"(\\, map (lift Q) ((P, s) # xs) @ [(Q, snd (last ((P, s) # xs)))]) \\ cptn\"\nusing map_cptn P_ends\nproof (induct xs arbitrary: P s) \n case Nil\n have P0_skips: \"P=Skip\" using Nil.prems(2) by auto \n then have \"\\\\\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip Q, s) \\\\<^sub>c\\<^sub>e (Q, s)\" \n by (metis SeqSkipc c_step)\n then have \"(\\,[(Seq Skip Q, s), (Q, s)]) \\ cptn\" \n by (simp add: cptn.Cptn cptn.CptnOne)\n then show ?case using P0_skips by (simp add: lift_def)\nnext\n case (Cons a xs)\n have \"(\\, map (lift Q) ((P, s) # a # xs)) \\ cptn\"\n using Cons.prems(1) by blast \n have \"fst (last ( a # xs)) = Skip\" using Cons.prems(2) by auto\n also have seq_PQ:\"(\\,(Seq P Q,s) # (map (lift Q) (a#xs))) \\ cptn\"\n by (metis Cons.prems(1) Cons_lift)\n then have \"(\\,(map (lift Q) (a#xs))) \\ cptn\"\n by (simp add: tl_in_cptn)\n then have \"(\\, map (lift Q) (a#xs) @ [(Q, snd (last ((a#xs))))]) \\ cptn\" \n by (metis Cons.hyps(1) calculation prod.collapse) \n then have t1:\"(\\, (Seq (fst a) Q, (snd a))#map (lift Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))]) \\ cptn\"\n by (simp add: Cons_lift_append)\n then have \"(\\,(Seq P Q,s) # (Seq (fst a) Q, (snd a))#map (lift Q) xs)\\ cptn\"\n using seq_PQ by (simp add: Cons_lift) \n then have t2: \"(\\,(Seq P Q,s) # [(Seq (fst a) Q, (snd a))]) \\ cptn\"\n using cptn_dest1 by blast\n then have\"((Seq P Q,s) # [(Seq (fst a) Q, (snd a))])!length [(Seq (fst a) Q, (snd a))] = (Seq (fst a) Q, (snd a))\"\n by auto \n then have \"(\\,(Seq P Q,s) # [(Seq (fst a) Q, (snd a))]@map (lift Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))])\\ cptn\"\n using cptn_append_is_cptn t1 t2 by blast \n then have \"(\\, map (lift Q) ((P,s)#(fst a, snd a)#xs) @[(Q, snd (last ((P, s)#(a#xs))))])\\cptn\"\n using Cons_lift_append append_Cons append_Nil by metis\n thus ?case by auto \nqed\n\n\nlemma lift_catch_P1: \n assumes map_cptn:\"(\\, map (lift_catch Q) ((P, s) # xs)) \\ cptn\" and\n P_ends:\"fst (last ((P, s) # xs)) = Throw\" and\n P_ends_normal:\"\\p. snd(last ((P, s) # xs)) = p\"\n shows \"(\\, map (lift_catch Q) ((P, s) # xs) @ [(Q, snd (last ((P, s) # xs)))]) \\ cptn\"\nusing map_cptn P_ends P_ends_normal\nproof (induct xs arbitrary: P s) \n case Nil\n have P0_skips: \"P=Throw\" using Nil.prems(2) by auto \n then have \"\\\\\\<^sub>c (LanguageCon.com.Catch LanguageCon.com.Throw Q, s) \\\\<^sub>c\\<^sub>e (Q, s)\"\n by (metis CatchThrowc surj_pair transfer_normal)\n then have \"(\\,[(Catch Throw Q, s), (Q, s)]) \\ cptn\"\n by (simp add: cptn.Cptn CatchThrowc cptn.CptnOne)\n then show ?case using P0_skips by (simp add: lift_catch_def)\nnext\n case (Cons a xs) \n have s1:\"(\\, map (lift_catch Q) ((P, s) # a # xs)) \\ cptn\"\n using Cons.prems(1) by blast \n have s2:\"fst (last ( a # xs)) = Throw\" using Cons.prems(2) by auto\n then obtain p where s3:\"snd(last (a #xs)) = p\" using Cons.prems(3) by auto\n also have seq_PQ:\"(\\,(Catch P Q, s) # (map (lift_catch Q) (a#xs))) \\ cptn\"\n by (metis Cons.prems(1) Cons_lift_catch) thm Cons.hyps\n then have axs_in_cptn:\"(\\,(map (lift_catch Q) (a#xs))) \\ cptn\"\n by (simp add: tl_in_cptn)\n then have \"(\\, map (lift_catch Q) (a#xs) @ [(Q, snd (last ((a#xs))))]) \\ cptn\"\n by (metis Cons.hyps prod.exhaust_sel s2)\n then have t1:\"(\\, (Catch (fst a) Q, (snd a))#map (lift_catch Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))]) \\ cptn\"\n by (simp add: Cons_lift_catch_append)\n then have \"(\\,(Catch P Q, s) # (Catch (fst a) Q, (snd a))#map (lift_catch Q) xs)\\ cptn\"\n using seq_PQ by (simp add: Cons_lift_catch) \n then have t2: \"(\\,(Catch P Q, s) # [(Catch (fst a) Q, (snd a))]) \\ cptn\"\n using cptn_dest1 by blast\n then have\"((Catch P Q, s) # [(Catch (fst a) Q, (snd a))])!length [(Catch (fst a) Q, (snd a))] = \n (Catch (fst a) Q, (snd a))\"\n by auto \n then have \"(\\,(Catch P Q, s) # [(Catch (fst a) Q, (snd a))]@\n map (lift_catch Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))])\\ cptn\"\n using cptn_append_is_cptn t1 t2 by blast\n then have \"(\\, map (lift_catch Q) ((P, s)#(fst a, snd a)#xs) @[(Q, snd (last ((P, s)#(a#xs))))])\\cptn\"\n using Cons_lift_catch_append append_Cons append_Nil by metis\n thus ?case by auto \nqed\n\nlemma seq2:\nassumes \n p1:\"(\\, (P0, s) # xs) \\ cptn_mod\" and\n p2:\"(\\, (P0, s) # xs) \\ cptn\" and\n p3:\"fst (last ((P0, s) # xs)) = Skip\" and\n p4:\"(\\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod\" and\n p5:\"(\\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn\" and\n p6:\"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\nshows \"(\\, (Seq P0 P1, s) # zs) \\ cptn\"\nusing p1 p2 p3 p4 p5 p6\nproof -\nhave last_skip:\"fst (last ((P0, s) # xs)) = Skip\" using p3 by blast \n have \"(\\, (map (lift P1) ((P0, s) # xs))@(P1, snd (last ((P0, s) # xs))) # ys) \\ cptn\"\n proof -\n have \"(\\,map (lift P1) ((P0, s) #xs)) \\ cptn\"\n using p2 lift_is_cptn by blast \n then have \"(\\,map (lift P1) ((P0, s) #xs)@[(P1, snd (last ((P0, s) # xs)))]) \\ cptn\" \n using last_skip lift_P1 by blast \n then have \"(\\,(Seq P0 P1, s) # map (lift P1) xs@[(P1, snd (last ((P0, s) # xs)))]) \\ cptn\"\n by (simp add: Cons_lift_append)\n moreover have \"last ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))]) = (P1, snd (last ((P0, s) # xs)))\" \n by auto \n moreover have \"last ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))]) =\n ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))])!length (map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))])\" \n by (metis last_length) \n ultimately have \"(\\, (Seq P0 P1, s) # map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys)\\ cptn\" \n using cptn_append_is_cptn p5 by fastforce\n thus ?thesis by (simp add: Cons_lift_append)\n qed \n thus ?thesis \n by (simp add: Cons_lift_append p6)\nqed\n\nlemma seq3:\nassumes\n p1:\"(\\, (P0, s) # xs) \\ cptn_mod\" and\n p2:\"(\\, (P0, s) # xs) \\ cptn\" and\n p3:\"fst (last ((P0, s) # xs)) = c\" and p3':\"c = Throw \\ c = Stuck \\ (\\f. c = Fault f)\" and\n p4:\"snd (last ((P0, s) # xs)) = s'\" and\n p5:\"(\\,(c, s')#ys) \\ cptn_mod\" and\n p6:\"(\\,(c, s')#ys) \\ cptn\" and\n p7:\"zs = map (lift P1) xs @((c, s')#ys)\" \nshows \"(\\, (Seq P0 P1, s) # zs) \\ cptn\"\nusing p1 p2 p3 p4 p5 p6 p7\nproof (induct xs arbitrary: zs P0 s) \n case Nil \n have h:\"\\\\\\<^sub>c (LanguageCon.com.Seq c P1, s') \\\\<^sub>c\\<^sub>e (c, s')\"\n using SeqThrowc\n by (metis SeqFaultc SeqStuckc c_step p3') \n show ?case using cptn.Cptn[OF h,of ys] Nil\n by simp\nnext\n case (Cons a as)\n then obtain sa where \"snd a = sa\" by meson\n obtain a1 a2 where a_prod:\"a=(a1,a2)\"\n using prod.exhaust_sel by blast\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\"\n using prod.exhaust_sel by blast \n then have lasst_aas_last: \"last (a#as) = (last ((P0, s) # a # as))\" by auto \n then have \"la1 = c\" using Cons.prems(3) last_prod by force\n have \"la2 = s'\" using Cons.prems(4) last_prod lasst_aas_last by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have f2: \" sa = a2\"\n using `snd a = sa` a_prod by force\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Seq a1 P1, sa) # \n map (lift P1) as @ ((c, s')#ys)) \\ cptn\"\n using Cons.hyps Cons.prems(3) Cons.prems(4) \n Cons.prems(5) Cons.prems(6) a_prod f1 f2 by fastforce\n thus ?case\n proof -\n have f1: \"(LanguageCon.com.Seq a1 P1, a2) # map (lift P1) as = map (lift P1) (a # as)\"\n using Cons_lift a_prod by blast\n have f2: \"(LanguageCon.com.Seq a1 P1, a2) # map (lift P1) as @ (c, s') # ys = zs\"\n by (simp add: Cons.prems(7) Cons_lift_append a_prod)\n have \"[(LanguageCon.com.Seq a1 P1, a2)] \\ []\"\n by fastforce\n then have \"\\\\\\<^sub>c (LanguageCon.com.Seq P0 P1, s) \\\\<^sub>c\\<^sub>e (LanguageCon.com.Seq a1 P1, a2)\"\n using f1 by (metis (no_types) Cons.prems(2) Cons_lift cptn_dest1\n cptn_stepc_rtran last.simps last_length length_Cons \n lessI lift_is_cptn list.size(3) nth_Cons_0)\n then show ?thesis\n using f2 cptn.Cptn f2 hyp\n by (metis \\snd a = sa\\ a_prod snd_conv)\n qed \nqed\n\nlemma cptn_if_cptn_mod: \nassumes cptn_mod_asm:\"(\\,c) \\ cptn_mod\"\nshows \"(\\,c) \\ cptn\"\nusing cptn_mod_asm\nproof (induct)\n case (CptnModOne) thus ?case using cptn.CptnOne by blast\nnext\n case CptnModSkip thus ?case\n by (simp add: c_step cptn.Cptn) \nnext\n case CptnModThrow thus ?case by (simp add: c_step cptn.Cptn) \nnext \n case CptnModStuck thus ?case by (simp add: c_step cptn.Cptn) \nnext \n case CptnModFault thus ?case by (simp add: c_step cptn.Cptn)\nnext \n case CptnModCondT thus ?case\n by (metis CondTruec cptn.Cptn prod.exhaust_sel transfer_normal) \nnext\n case CptnModCondF thus ?case\n by (metis CondFalsec cptn.Cptn prod.exhaust_sel transfer_normal)\nnext\n case (CptnModSeq1 \\ P0 s xs zs P1) \n have \"(\\, map (lift P1) ((P0, s) # xs)) \\ cptn\"\n using CptnModSeq1.hyps(2) lift_is_cptn by blast\n thus ?case by (simp add: Cons_lift CptnModSeq1.hyps(3))\nnext\n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n thus ?case by (simp add:seq2)\nnext\n case (CptnModSeq3 \\ P0 s xs t f s' ys zs P1) \n thus ?case using seq3 by blast\nnext\n case (CptnModWhile1 \\ P s xs b zs) thus ?case \n by (metis Cons_lift WhileTruec cptn.Cptn lift_is_cptn prod.collapse transfer_normal)\nnext \n case (CptnModWhile2 \\ P s xs b zs ys) \n then have \"(\\, (Seq P (While b P), s) # zs) \\ cptn\" \n by (simp add:seq2) \n moreover have \"\\\\\\<^sub>c(While b P,toSeq ( s)) \\ (Seq P (While b P),toSeq( s))\" \n by (simp add: CptnModWhile2.hyps(4) WhileTruec)\n ultimately show ?case\n by (metis cptn.Cptn prod.collapse toSeq.simps(1) transfer_normal)\nnext\n case (CptnModWhile3 \\ P s xs t f b s' ys zs) \n then have \"(\\,(Seq P (While b P), s) # zs) \\ cptn\"\n using seq3 by blast \n moreover have \"\\\\\\<^sub>c(While b P,toSeq ( s)) \\ (Seq P (While b P),toSeq ( s))\"\n by (simp add: CptnModWhile3.hyps(5) WhileTruec)\n ultimately show ?case by (metis cptn.Cptn prod.collapse toSeq.simps(1) transfer_normal)\nnext \n case (CptnModCall \\ bdy s ys p) thus ?case\n by (metis Callc cptn.Cptn prod.exhaust_sel transfer_normal) \nnext\n case (CptnModDynCom \\ c s ys) thus ?case\n by (metis DynComc cptn.Cptn prod.exhaust_sel transfer_normal)\nnext\n case (CptnModGuard \\ c s ys g f) thus ?case\n by (metis Guardc cptn.Cptn prod.exhaust_sel transfer_normal)\nnext\n case (CptnModCatch1 \\ P0 s xs zs P1)\n have \"(\\, map (lift_catch P1) ((P0, s) # xs)) \\ cptn\"\n using CptnModCatch1.hyps(2) lift_catch_is_cptn by blast\n thus ?case by (simp add: Cons_lift_catch CptnModCatch1.hyps(3))\nnext\n case (CptnModCatch2 \\ P0 s xs t f ys zs P1)\n thus ?case\n proof (induct xs arbitrary: zs P0 s) \n case Nil \n then have step: \"\\\\\\<^sub>c (Catch t P1, s) \\\\<^sub>c\\<^sub>e (t, s)\"\n by (metis CatchFaultc CatchSkipc CatchStuckc c_step)\n have \"\\c p. (c, p) # zs = (LanguageCon.com.Catch P0 P1, s) # zs \\ \\\\\\<^sub>c (c, p) \\\\<^sub>c\\<^sub>e (P0, s)\"\n using step Nil.prems(3) by force\n then show ?case\n using Nil.prems(7) Nil.prems(3) Nil.prems(6) cptn.simps by fastforce \n next\n case (Cons a as)\n then obtain sa where \"snd a = sa\" by auto\n then obtain a1 a2 where a_prod:\"a=(a1,a2)\" and sa_a2: \"a2 =sa\"\n using prod.exhaust_sel by blast\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\"\n using prod.exhaust_sel by blast \n then have lasst_aas_last: \"last (a#as) = (last ((P0, s) # a # as))\" by auto \n then have \"la1 = t\" using Cons.prems(3) last_prod by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Catch a1 P1, a2) # \n map (lift_catch P1) as @ ((t, la2)#ys)) \\ cptn\"\n using Cons.prems a_prod f1 last_prod\n by (simp add: Cons.hyps)\n thus ?case\n proof -\n have \"(a1, sa) # as = a # as\"\n using a_prod sa_a2 by fastforce\n then have f1: \"(LanguageCon.com.Catch a1 P1, sa) # map (lift_catch P1) as @ (t, la2) # ys = zs\"\n using Cons.prems(7) Cons_lift_catch_append last_prod by fastforce\n have f2: \"((LanguageCon.com.Catch P0 P1, s) # map (lift_catch P1) (a # as)) ! Suc 0 = lift_catch P1 (a1, a2)\"\n by (simp add: a_prod)\n have f3: \"lift_catch P1 (a1, a2) = (LanguageCon.com.Catch a1 P1, a2)\"\n by (metis (no_types) Cons_lift_catch list.inject list.simps(9))\n have \"Suc 0 < length ((LanguageCon.com.Catch P0 P1, s) # map (lift_catch P1) (a # as))\"\n by simp\n then show ?thesis\n using f3 f2 f1 by (metis (no_types) Cons.prems(2) Cons_lift_catch cptn.Cptn cptn_stepc_rtran hyp lift_catch_is_cptn nth_Cons_0 sa_a2)\n qed\n qed\nnext \n case (CptnModCatch3 \\ P0 s xs s' P1 ys zs)\n thus ?case\n proof (induct xs arbitrary: zs P0 s) \n case Nil \n then have \"\\\\\\<^sub>c (LanguageCon.com.Catch LanguageCon.com.Throw P1, s) \\\\<^sub>c\\<^sub>e (P1, s)\"\n by (metis CatchThrowc prod.exhaust_sel transfer_normal)\n then have \"\\c p. (c, p) # zs = (LanguageCon.com.Catch LanguageCon.com.Throw P1, s) # zs \\ \\\\\\<^sub>c (c, p) \\\\<^sub>c\\<^sub>e (P1, s)\"\n by auto\n thus ?case using cptn.simps\n using Nil.prems(3) Nil.prems(6) Nil.prems(7) by fastforce \n next\n case (Cons a as)\n then obtain sa where \"snd a = sa\" by auto\n obtain a1 a2 where a_prod:\"a=(a1,a2)\" \n by (meson prod.exhaust_sel)\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\"\n by (meson prod.exhaust_sel) \n then have lasst_aas_last: \"last (a#as) = (last ((P0, s) # a # as))\" by auto \n then have \"la1 = Throw\" using Cons.prems(3) last_prod by force\n have \"la2 = s'\" using Cons.prems(4) last_prod lasst_aas_last by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have f2: \"sa = a2\"\n using `snd a = sa` a_prod by force\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Catch a1 P1, sa) # \n map (lift_catch P1) as @ (P1, snd (last ((a1, sa) # as))) # ys) \\ cptn\"\n using Cons.hyps Cons.prems a_prod f1 f2\n by (metis lasst_aas_last)\n thus ?case\n proof -\n(* have \"\\\\\\<^sub>c (P0, Normal s) \\\\<^sub>e (P0, a2)\"\n by (fastforce intro: step_e.intros) \n then *) \n have transit:\"\\\\\\<^sub>c(P0, s) \\\\<^sub>c\\<^sub>e (a1, sa)\" \n by (metis (no_types) Cons.prems(2) a_prod cptn_elim_cases(2) f2)\n then have transit_catch:\"\\\\\\<^sub>c(Catch P0 P1, s) \\\\<^sub>c\\<^sub>e (Catch a1 P1, sa)\" \n proof -\n have f1: \"P0 = a1 \\ \\ \\\\\\<^sub>c (P0, s) \\\\<^sub>e (a1, sa)\"\n using not_eq_not_env transit by blast\n have \"\\\\\\<^sub>c (a1, s) \\\\<^sub>e (a1, sa) \\ \n \\\\\\<^sub>c (Catch a1 P1, s) \\\\<^sub>e (Catch a1 P1, sa)\"\n using env_intro\n by (simp add: env_intro_diff_p)\n then show ?thesis\n using f1 by (metis (no_types) Catchc e_step prod.collapse \n step_dest toSeq.simps(1) transfer_normal transit)\n qed \n have \"a=(a1, sa)\" using a_prod f2 by auto\n then have \"snd (last ((a1, sa) # as)) = s'\"\n using Cons lasst_aas_last by fastforce\n hence f1: \"snd (last ((a1, sa) # as)) = la2\"\n using `la2 = s'` by blast\n have \"(Catch a1 P1, a2) # map (lift_catch P1) as @ (P1, la2) # ys = zs\"\n using Cons.prems Cons_lift_catch_append a_prod last_prod\n by (simp add: Cons_lift_catch_append)\n moreover have \"\\\\\\<^sub>c (LanguageCon.com.Catch P0 P1, s) \\\\<^sub>c\\<^sub>e (LanguageCon.com.Catch a1 P1, a2)\"\n using f2 transit_catch by blast\n ultimately show ?thesis\n using f1 cptn.Cptn f2 hyp by metis\n qed\n qed\nnext \n case (CptnModEnv) thus ?case\n by (simp add: cptn.Cptn e_step)\nqed\n\nlemma cptn_eq_cptn_mod: \nshows \"(x \\cptn_mod) = (x\\cptn)\"\nby (cases x, auto simp add: cptn_if_cptn_mod cptn_onlyif_cptn_mod)\n\nlemma cptn_eq_cptn_mod_set: \nshows \"cptn_mod = cptn\"\nby (auto simp add: cptn_if_cptn_mod cptn_onlyif_cptn_mod)\n\nsubsection \\Computational modular semantic for nested calls\\\ninductive_set cptn_mod_nest_call :: \"(nat\\('g,'l,'p,'f,'e) confs) set\"\nwhere\n CptnModNestOne: \"(n,\\,[(P, s)]) \\ cptn_mod_nest_call\"\n| CptnModNestEnv: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t);(n,\\,(P, t)#xs) \\ cptn_mod_nest_call\\ \\ \n (n,\\,(P, s)#(P, t)#xs) \\ cptn_mod_nest_call\"\n| CptnModNestSkip: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Skip,toSeq t); redex P = P; \n snd s= snd t;\n \\f. ((\\ f) = Some Skip \\ P \\ Call f );\n (n,\\,(Skip, t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Skip, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestThrow: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Throw,toSeq t); redex P = P; \n \\f. ((\\ f) = Some Throw \\ P \\ Call f ); snd s = snd t;\n (n,\\,(Throw, t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Throw, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestStuck: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Stuck,toSeq t); redex P = P; \n \\f. ((\\ f) = Some Stuck \\ P \\ Call f ); snd s = snd t;\n (n,\\,(Stuck, t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Stuck, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestFault: \"\\\\\\\\<^sub>c(P,toSeq s) \\ (Fault f,toSeq t); redex P = P; \n \\fn. ((\\ fn) = Some (Fault f) \\ P \\ Call fn); snd s = snd t;\n (n,\\,((Fault f), t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Fault f, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestCondT: \"\\(n,\\,(P0, s)#ys) \\ cptn_mod_nest_call; fst s \\ b \\ \\ \n (n,\\,((Cond b P0 P1), s)#(P0, s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestCondF: \"\\(n,\\,(P1, s)#ys) \\ cptn_mod_nest_call; fst s \\ b \\ \\ \n (n,\\,((Cond b P0 P1), s)#(P1, s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq1: \n \"\\(n,\\,(P0, s)#xs) \\ cptn_mod_nest_call; zs=map (lift P1) xs \\ \\ \n (n,\\,((Seq P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq2: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, s)#xs)) = Skip;\n (n,\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod_nest_call;\n zs=(map (lift P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (n,\\,((Seq P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq3: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P0, s)#xs)) = t; t = Fault f \\ t = Stuck \\ t = Throw;\n snd(last ((P0, s)#xs)) = s'; \n (n,\\,(t, s')#ys) \\ cptn_mod_nest_call; \n zs=(map (lift P1) xs)@((t, s')#ys) \\ \\\n (n,\\,((Seq P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile1: \n \"\\(n,\\, (P, s)#xs) \\ cptn_mod_nest_call; fst s \\ b; \n zs=map (lift (While b P)) xs \\ \\ \n (n,\\, ((While b P), s)#\n ((Seq P (While b P)), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile2: \n \"\\ (n,\\, (P, s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P, s)#xs))=Skip; fst s \\ b; \n zs=(map (lift (While b P)) xs)@\n (While b P, snd(last ((P, s)#xs)))#ys; \n (n,\\,(While b P, snd(last ((P, s)#xs)))#ys) \\ \n cptn_mod_nest_call\\ \\ \n (n,\\,(While b P, s)#\n (Seq P (While b P), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile3: \n \"\\ (n,\\, (P, s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P, s)#xs))=t; t=Throw \\ t= Fault f \\ t = Stuck; fst s \\ b;\n snd(last ((P, s)#xs)) = s'; \n (n,\\,(t, s')#ys) \\ cptn_mod_nest_call; \n zs=(map (lift (While b P)) xs)@((t, s')#ys)\\ \\ \n (n,\\,(While b P, s)#\n (Seq P (While b P), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCall: \"\\(n,\\,(bdy, s)#ys) \\ cptn_mod_nest_call;\\ p = Some bdy; bdy\\Call p \\ \\ \n (Suc n, \\,((Call p), s)#(bdy, s)#ys) \\ cptn_mod_nest_call\" \n\n| CptnModNestDynCom: \"\\(n,\\,(c (fst s), s)#ys) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(DynCom c, s)#(c (fst s), s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestGuard: \"\\(n,\\,(c, s)#ys) \\ cptn_mod_nest_call; fst s \\ g \\ \\ \n (n,\\,(Guard f g c, s)#(c, s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch1: \"\\(n,\\,(P0, s)#xs) \\ cptn_mod_nest_call; zs=map (lift_catch P1) xs \\\n \\ (n,\\,((Catch P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch2: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, s)#xs)) = t; \n t = Skip \\ t = Fault f \\ t=Stuck; \n (n,\\,(t,snd(last ((P0, s)#xs)))#ys) \\ cptn_mod_nest_call; \n zs=(map (lift_catch P1) xs)@((t,snd(last ((P0, s)#xs)))#ys) \\ \\ \n (n,\\,((Catch P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch3: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, s)#xs)) = Throw; \n snd(last ((P0, s)#xs)) = s';\n (n,\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod_nest_call; \n zs=(map (lift_catch P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (n,\\,((Catch P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\nlemmas CptnMod_nest_call_induct = cptn_mod_nest_call.induct [of _ _ \"[(c,s)]\", split_format (complete), case_names\nCptnModOne CptnModEnv CptnModSkip CptnModThrow CptnModNestStuck CptnModNestFault CptnModCondT CptnModCondF \nCptnModSeq1 CptnModSeq2 CptnModSeq3 CptnModSeq4 CptnModWhile1 CptnModWhile2 CptnModWhile3 CptnModCall CptnModDynCom CptnModGuard \nCptnModCatch1 CptnModCatch2 CptnModCatch3, induct set]\n\ninductive_cases CptnModNest_elim_cases [cases set]:\n\"(n,\\,(Skip, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Fault f, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Stuck, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Guard f g c, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Basic f e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Spec r e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Seq c1 c2, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Cond b c1 c2, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Await b c2 e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Call p, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(DynCom c,s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Throw,s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Catch c1 c2,s)#u#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases stepc_elim_cases_Seq_Seq':\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (Seq c1' c2',s')\" \n\ninductive_cases stepc_elim_cases_Catch_Catch':\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Catch c1' c2',s')\" \n\ninductive_cases CptnModNest_same_elim_cases [cases set]:\n\"(n,\\,(u, s)#(u,t)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_Skip [cases set]:\n\"(n,\\,(Call p, s)#(Skip, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_Stuck [cases set]:\n\"(n,\\,(Call p, s)#(Stuck, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_Fault [cases set]:\n\"(n,\\,(Call p, s)#(Fault f, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_Throw [cases set]:\n\"(n,\\,(Call p, s)#(Throw, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call [cases set]:\n\"(0, \\,((Call p), s)#(bdy, s)#ys) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnEmpty [cases set]:\n\"(n, \\,[]) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_normal [cases set]:\n\"(Suc n, \\,((Call p), s)#(bdy, s)#ys) \\ cptn_mod_nest_call\"\n\nlemma cptn_mod_nest_mono1: \"(n,\\,cfs) \\ cptn_mod_nest_call \\ (Suc n,\\,cfs)\\ cptn_mod_nest_call\"\nproof (induct rule:cptn_mod_nest_call.induct)\n case (CptnModNestOne) thus ?case using cptn_mod_nest_call.CptnModNestOne by blast\nnext\n case (CptnModNestEnv) thus ?case using cptn_mod_nest_call.CptnModNestEnv by blast\nnext\n case (CptnModNestSkip) thus ?case using cptn_mod_nest_call.CptnModNestSkip by blast\nnext\n case (CptnModNestThrow) thus ?case using cptn_mod_nest_call.intros(4) by blast\nnext\n case (CptnModNestFault) thus ?case using cptn_mod_nest_call.intros(6) by fast\nnext\n case (CptnModNestStuck) thus ?case using cptn_mod_nest_call.intros(5) by fast\nnext\n case (CptnModNestCondT n) thus ?case \n using cptn_mod_nest_call.CptnModNestCondT[of \"Suc n\"] by blast\nnext\n case (CptnModNestCondF n) thus ?case \n using cptn_mod_nest_call.CptnModNestCondF[of \"Suc n\"] by blast\nnext\n case (CptnModNestSeq1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq1[of \"Suc n\"] by blast\nnext\n case (CptnModNestSeq2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq2[of \"Suc n\"] by blast\nnext\n case (CptnModNestSeq3 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq3[of \"Suc n\"]by fast\nnext\n case (CptnModNestWhile1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile1[of \"Suc n\"] by blast\nnext\n case (CptnModNestWhile2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile2[of \"Suc n\"] by blast\nnext\n case (CptnModNestWhile3 n \\ P s xs t f b s' ys zs) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile3[of \"Suc n\" \\] by blast\nnext\n case (CptnModNestCall) thus ?case \n using cptn_mod_nest_call.CptnModNestCall by fastforce\nnext \n case (CptnModNestDynCom) thus ?case \n using cptn_mod_nest_call.CptnModNestDynCom by blast\nnext\n case (CptnModNestGuard n) thus ?case \n using cptn_mod_nest_call.CptnModNestGuard[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCatch1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch1[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCatch2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch2[of \"Suc n\"] by fast\nnext\n case (CptnModNestCatch3 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch3[of \"Suc n\"] by fast\nqed\n\nlemma cptn_mod_nest_mono2: \n \"(n,\\,cfs) \\ cptn_mod_nest_call \\ m>n \\\n (m,\\,cfs)\\ cptn_mod_nest_call\"\nproof (induct \"m-n\" arbitrary: m n)\n case 0 thus ?case by auto\nnext\n case (Suc k) \n have \"m - Suc n = k\"\n using Suc.hyps(2) Suc.prems(2) Suc_diff_Suc Suc_inject by presburger\n then show ?case\n using Suc.hyps(1) Suc.prems(1) Suc.prems(2) cptn_mod_nest_mono1 less_Suc_eq by blast \nqed\n\nlemma cptn_mod_nest_mono: \n \"(n,\\,cfs) \\ cptn_mod_nest_call \\ m\\n \\\n (m,\\,cfs)\\ cptn_mod_nest_call\"\nproof (cases \"n=m\")\n assume \"(n, \\, cfs) \\ cptn_mod_nest_call\" and \n \"n = m\" thus ?thesis by auto\nnext\n assume \"(n, \\, cfs) \\ cptn_mod_nest_call\" and \n \"n\\m\" and\n \"n \\ m\" \n thus ?thesis by (auto simp add: cptn_mod_nest_mono2)\n qed\n\n\n\nsubsection \\Equivalence of comp mod semantics and comp mod nested\\\n\ndefinition catch_cond_nest\nwhere\n\"catch_cond_nest zs Q xs P s s'' s' \\ n \\ (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\t. (fst(((P, s)#xs)!length xs)=t \\ (t=Skip \\ (\\f. t = Fault f) \\ t = Stuck) \\ \n (\\ys. (n,\\,(t,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((t,snd(last ((P, s)#xs)))#ys)))))\n\"\n\nlemma div_catch_nest: assumes cptn_m:\"(n,\\,list) \\ cptn_mod_nest_call\"\nshows \"(\\s P Q zs. list=(Catch P Q, s)#zs \\\n (\\xs s' s''. \n (n, \\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs P s s'' s' \\ n)) \n \"\nunfolding catch_cond_nest_def\nusing cptn_m\nproof (induct rule: cptn_mod_nest_call.induct)\ncase (CptnModNestOne \\ P s)\n thus ?case using cptn_mod_nest_call.CptnModNestOne by blast \nnext\n case (CptnModNestSkip \\ P s t n xs) \n from CptnModNestSkip.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Skip, toSeq t)\" by auto\n from CptnModNestSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1) by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestSkip.hyps(2) redex_not_Catch by auto\n from CptnModNestSkip.hyps\n have in_cptn_mod: \"(n,\\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n then show ?case using no_catch by simp\nnext\n case (CptnModNestThrow \\ P s t n xs) \n from CptnModNestThrow.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Throw, toSeq t)\" by auto \n from CptnModNestThrow.hyps\n have in_cptn_mod: \"(n,\\, (Throw, t) # xs) \\ cptn_mod_nest_call\" by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestThrow.hyps(2) redex_not_Catch by auto\n then show ?case by auto\nnext\n case (CptnModNestStuck \\ P s t n xs) \n from CptnModNestStuck.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Stuck, toSeq t)\" by auto \n from CptnModNestStuck.hyps \n have in_cptn_mod: \"(n,\\, (Stuck, t) # xs) \\ cptn_mod_nest_call\" by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestStuck.hyps(2) redex_not_Catch by auto\n then show ?case by auto\nnext\n case (CptnModNestFault \\ P s f t n xs) \n from CptnModNestFault.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Fault f, toSeq t)\" by auto \n from CptnModNestFault.hyps\n have in_cptn_mod: \"(n,\\, (Fault f, t) # xs) \\ cptn_mod_nest_call\" by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestFault.hyps(2) redex_not_Catch by auto\n then show ?case by auto\nnext\n case (CptnModNestCondT \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModNestCondF \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModNestCatch1 sa P Q zs)\n thus ?case by blast\nnext\n case (CptnModNestCatch2 n \\ P0 s xs t f ys zs P1) \n from CptnModNestCatch2.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = t\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact \n then have \"zs = map (lift_catch P1) xs @((t,snd(last ((P0, s)#xs)))#ys)\" \n by (simp add:CptnModNestCatch2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, s) # zs = (Catch P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto\n then have \"(P0, s) = (P, sa)\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zs = (map (lift_catch Q) xs)@((t,snd(last ((P0, s)#xs)))#ys)\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift_catch P1) xs @ ((t,snd(last ((P0, s)#xs)))#ys)` \n by force \n then have \"(\\xs s' s''. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n ((zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\t. ((fst(((P, s)#xs)!length xs)=t \\ (t = LanguageCon.com.Skip \\ (\\f. t = com.Fault f) \\ t = com.Stuck) \\ \n (\\ys. (n,\\,(t,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((t,snd(last ((P0, s)#xs)))#ys)))))))))\"\n using P0cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` \n last CptnModNestCatch2.hyps(4,5) \n by blast \n } \n thus ?thesis by blast\n qed\nnext\n case (CptnModNestCatch3 n \\ P0 s xs s' P1 ys zs)\n from CptnModNestCatch3.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n from CptnModNestCatch3.hyps(4) \n have lastnormal:\"snd (last ((P0, s) # xs)) = s'\"\n by (simp add: last_length)\n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestCatch3.hyps(5) \n have P1cptn:\"(n,\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call\"\n by (simp add: last_length) \n then have \"zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\" \n by (simp add:CptnModNestCatch3.hyps)\n show ?case\n by (metis CptnModNestCatch3.hyps(3) CptnModNestCatch3.hyps(5) CptnModNestCatch3.hyps(7)\n LanguageCon.com.inject(10) P0cptn fst_conv last_length list.sel(3) nth_Cons_0 snd_conv) \nnext\n case (CptnModNestEnv \\ P s t n xs) \n then have step:\"(n, \\, (P, t) # xs) \\ cptn_mod_nest_call\" by auto \n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModNestEnv by auto\n show ?case \n proof (cases P)\n case (Catch P1 P2) \n then have eq_P_Catch:\"(P, t) # xs = (LanguageCon.com.Catch P1 P2, t) # xs\" by auto \n then obtain xsa t' t'' where \n p1:\"(n,\\, (P1, t) # xsa) \\ cptn_mod_nest_call\" and \n p2:\" (xs = map (lift_catch P2) xsa \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = t' \\\n t = t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n (\\c. fst (((P1, t) # xsa) ! length xsa) = c \\ (c = Skip \\ c = Stuck \\ (\\f. c = Fault f))\\\n (\\ys.(n,\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @\n ((c, snd (last ((P1, t) # xsa)))#ys))))\" \n using CptnModNestEnv(3) by fastforce\n have all_step:\"(n,\\, (P1, s)#((P1, t) # xsa)) \\ cptn_mod_nest_call\"\n proof -\n have \"\\\\\\<^sub>c (P1, s) \\\\<^sub>e (P1, t)\"\n using step_e\n by (metis env_intro_diff_p)\n then show ?thesis\n by (simp add: cptn_mod_nest_call.CptnModNestEnv p1)\n qed\n show ?thesis using p2 \n proof \n assume \"xs = map (lift_catch P2) xsa\"\n have \"(P, t) # xs = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: `xs = map (lift_catch P2) xsa` lift_catch_def local.Catch)\n thus ?thesis using all_step eq_P_Catch by fastforce\n next \n assume \n \"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = t' \\\n t = t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n (\\c. fst (((P1, t) # xsa) ! length xsa) = c \\ (c = Skip \\ c = Stuck \\ (\\f. c = Fault f)) \\ \n (\\ys. (n,\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys)))\" \n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = t' \\ t = t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys)\"\n then obtain ys where p2_exec:\n \"(n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys\" \n by fastforce\n from a1 obtain t1 where t_normal: \"t= t1\" \n by blast\n have f1:\"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t)#xsa)) = LanguageCon.com.Throw\"\n using a1 by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xsa)) = t'\"\n by fastforce \n then have p2_long_exec: \n \"(n,\\, (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys) \\ \n cptn_mod_nest_call \\\n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys\" \n using p2_exec by (simp add: lift_catch_def local.Catch) \n thus ?thesis using a1 f1 last_normal all_step eq_P_Catch by fastforce \n next\n assume \n as1:\n \"\\c. fst (((P1, t) # xsa) ! length xsa) =c \\ (c = Skip \\ c = Stuck \\ (\\f. c = Fault f)) \\\n (\\ys. (n,\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys))\" \n then obtain c where \n as1:\"fst (((P1, t) # xsa) ! length xsa) =c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck ) \\\n (\\ys. (n,\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @ ((c, snd (last ((P1, t) # xsa)))#ys))\"\n by auto\n then obtain ys where p1:\n \"(n,\\,(c,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @ ((c, snd (last ((P1, t) # xsa)))#ys)\"\n proof -\n assume a1: \"\\ys. (n,\\, (c, snd (last ((P1, t) # xsa))) # ys) \\ cptn_mod_nest_call \\ \n (P, t) # xs = map (lift_catch P2) ((P1, t) # xsa) @ \n (c, snd (last ((P1, t) # xsa))) # ys \\ thesis\"\n have \"(LanguageCon.com.Catch P1 P2, t) # map (lift_catch P2) xsa = \n map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: lift_catch_def)\n thus ?thesis\n using a1 as1 eq_P_Catch as1 by auto \n qed \n from as1 have p2: \"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t) #xsa)) =c\"\n by fastforce \n moreover have \" (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck )\" using as1 by auto\n ultimately show ?thesis using p1 all_step eq_P_Catch by fastforce \n qed\n qed\nqed (auto)\nqed(force+)\n\n\ndefinition seq_cond_nest\nwhere\n\"seq_cond_nest zs Q xs P s s'' s' \\ n \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, s)#xs)!length xs)=c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\ \n snd(last ((P, s)#xs)) = s' \\ s= s''\\\n (\\ys. (n,\\,(c, s')#ys) \\ cptn_mod_nest_call \\ zs=(map (lift Q) xs)@((c, s')#ys)))))\"\n\nlemma Seq_P_Not_finish:\n assumes\n a0:\"zs = map (lift Q) xs\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs'\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume \"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs\" using a0 by auto \n thus ?thesis using map_lift_eq_xs_xs' by fastforce\nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (c, s') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c, s') # ys))\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys where \n zs:\"zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys\" \n by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs'))) = Q\" \n by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_all_seq\n using seq_and_if_not_eq(4) by fastforce \n }note l = this\n {assume ass:\n \"\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (c, s') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c, s') # ys)\"\n then obtain c ys where zs:\n \"zs = map (lift Q) xs' @ (c, s') # ys \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck)\" by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = c\" by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @(c, s') # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_all_seq \n by (metis LanguageCon.com.distinct(79) LanguageCon.com.distinct(85) \n LanguageCon.com.distinct(87) zs) \n } thus ?thesis using l ass by auto\nqed\n\nlemma Seq_P_Ends_Normal:\n assumes\n a0:\"zs = map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" and\n a0':\"fst (last ((P, s) # xs)) = Skip\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume ass:\"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs))) = Q\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_all_seq\n using seq_and_if_not_eq(4)\n by metis \nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') =c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (c, s') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (c, s') # ys))\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where zs:\n \"zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys' \\\n (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call\" \n by auto \n then have ?thesis \n using map_lift_some_eq[of Q xs Q _ ys xs' Q _ ys'] a0 seq_and_if_not_eq(4)[of Q] \n by fast \n }note l = this\n {assume ass:\n \"\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (c, s') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c, s') # ys)\" \n then have \"xs =xs'\" \n using a0 a0' map_lift_some_eq seq_and_if_not_eq(4)\n by (metis (no_types) LanguageCon.com.distinct(79) LanguageCon.com.distinct(85) \n LanguageCon.com.distinct(87))\n then have False using a0' ass\n by (metis LanguageCon.com.distinct(13) \n LanguageCon.com.distinct(19) LanguageCon.com.distinct(21) last_length)\n then have ?thesis by auto\n } thus ?thesis using l ass by auto\nqed\n\nlemma Seq_P_Ends_Abort:\n assumes\n a0:\"zs = map (lift Q) xs @ (c, s') # ys\" and an:\"c = Throw \\ (\\f. c = Fault f) \\ c = Stuck\" and\n a0':\"fst (last ((P, s) # xs)) = c\" and\n a0'':\"snd(last ((P, s) # xs)) = s'\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P s ns'' ns' \\ m\" \nshows \"xs=xs' \\ (m,\\,(c, s')#ys) \\ cptn_mod_nest_call\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume ass:\"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs @ (c, s') # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs))) = c\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift Q) xs @ (c, s') # ys)\" \n using a0 by auto\n then have \"(length (map (lift Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_all_seq an\n by (metis LanguageCon.com.distinct(79) LanguageCon.com.distinct(85) LanguageCon.com.simps(99))\nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = ns' \\ s = ns'' \\\n (\\ys. (m, \\, (c, ns') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c, ns') # ys))\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\" (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys'\" \n by auto \n then have \"xs = xs'\" and \"ys = ys'\"\n using a0 a0' seq_and_if_not_eq(4)[of Q] ass map_lift_some_eq\n by (metis LanguageCon.com.distinct(79) \n LanguageCon.com.distinct(85) LanguageCon.com.distinct(87) an)+ \n then have ?thesis\n using a0 ass by blast \n }note l = this\n {assume ass:\"\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P, s) # xs')) = ns' \\ s = ns'' \\\n (\\ys. (m, \\, (c, ns') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c, ns') # ys)\"\n then obtain c1 where \n ass:\"fst (((P, s) # xs') ! length xs') = c1 \\ (c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((P, s) # xs')) = ns' \\ s = ns'' \\\n (\\ys. (m, \\, (c1, ns') # ys) \\ cptn_mod_nest_call \\ zs = map (lift Q) xs' @ (c1, ns') # ys)\"\n by auto\n then obtain ys' where \n zs:\"(m, \\, (c1, ns') # ys') \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (c1, ns') # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = c1\" \n by (metis fstI nth_append_length) \n then have \"xs=xs' \\ ys = ys'\" \n using a0 zs map_lift_some_eq[of Q xs c s' ys xs' c1 ns' ys'] an ass\n by (metis LanguageCon.com.distinct(79) \n LanguageCon.com.distinct(85) LanguageCon.com.distinct(87)) \n then have ?thesis using a0 ass map_lift_some_eq an by blast \n } thus ?thesis using l ass by auto\n qed\n\n\nlemma Catch_P_Not_finish:\n assumes\n a0:\"zs = map (lift_catch Q) xs\" and \n a1:\"catch_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs'\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume \"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs\" using a0 by auto \n thus ?thesis using map_lift_catch_eq_xs_xs' by fastforce\nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys))\"\n {assume \n ass:\"\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys)\"\n then obtain c where ass:\n \"fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys)\"\n by auto\n then obtain ys where \n zs:\"(m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys\" \n by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs'))) = c \" \n by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @\n (Q, snd (((P, s) # xs') ! length xs')) # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_catch_all_catch ass \n by (metis com.distinct(149) com.distinct(173) com.distinct(23) length_map) \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') =Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys where \n zs:\"zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys\" by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = Q\"\n by (metis (no_types) eq_fst_iff length_map nth_append_length zs) \n have \"length zs = length (map (lift Q) xs' @(LanguageCon.com.Throw, s') # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < \n length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_catch_all_catch\n by fastforce\n } thus ?thesis using l ass by auto\nqed\n\nlemma Catch_P_Ends_Normal:\n assumes\n a0:\"zs = map (lift_catch Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" and\n a0':\"fst (last ((P, s) # xs)) = Throw\" and\n a1:\"catch_cond_nest zs Q xs' P ( s) s'' s' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume ass:\"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" \n using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs))) = Q\"\n by (metis a0 fstI nth_append_length) \n also have \"length zs = length (map (lift_catch Q) xs @ (Q, snd (last ((P, s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift_catch Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_catch_all_catch\n using seq_and_if_not_eq(12)\n by metis\nnext \n assume ass: \"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys))\" \n (* ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, Normal s) # xs')) = ns' \\\n s = ns'' \\\n (\\ys. (m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\\n fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys)\" *)\n {assume \n ass:\"(\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys))\" \n then obtain c where ass:\"fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys)\"\n by auto\n then obtain ys' where \n zs:\"(m, \\, (c, snd (last ((P, s) # xs'))) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys'\" \n by auto\n then have ?thesis\n using map_lift_catch_some_eq[of Q xs Q _ ys xs' c _ ys'] \n zs a0 seq_and_if_not_eq(12)[of Q] a0' ass\n by (metis com.distinct(147) com.distinct(149) com.distinct(171) com.distinct(173) \n com.distinct(21) com.distinct(23) last_length) \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift_catch Q) xs'))) = Q\" by (metis fstI nth_append_length) \n\n then have ?thesis \n using LanguageCon.com.distinct(17) LanguageCon.com.distinct(71) \n a0 a0' ass last_length map_lift_catch_some_eq[of Q xs Q _ ys xs' Q _ ys'] \n seq_and_if_not_eq(12) zs\n by blast \n } thus ?thesis using l ass by auto\n qed\n\nlemma Catch_P_Ends_Skip:\n assumes\n a0:\"zs = map (lift_catch Q) xs @ (c, snd (last ((P, s) # xs))) # ys\" and\n a0':\"fst (last ((P,s) # xs)) = c\" and an:\"c = Skip \\ (\\f. c = Fault f) \\ c = Stuck\" and\n a1:\"catch_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs' \\ (m,\\,(c,snd(last ((P,s) # xs)))#ys) \\ cptn_mod_nest_call\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume ass:\"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs @ (c, snd (last ((P, s) # xs))) # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs))) = c\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift_catch Q) xs @ (c, snd (last ((P, s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift_catch Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_catch_all_catch an\n by (metis com.distinct(149) com.distinct(173) com.distinct(23)) \nnext \n assume ass: \"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n (\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys))\"\n {assume \n ass:\"\\c. fst (((P, s) # xs') ! length xs') = c \\ (c = Skip \\ (\\f. c = Fault f) \\ c = Stuck) \\\n (\\ys. (m, \\, (c, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c, snd (last ((P, s) # xs'))) # ys)\"\n then obtain c1 where ass: \"fst (((P, s) # xs') ! length xs') = c1 \\ (c1 = Skip \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n (\\ys. (m, \\, (c1, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c1, snd (last ((P, s) # xs'))) # ys)\"\n by auto\n then obtain ys' where \n zs:\"(m, \\, (c1, snd (last ((P, s) # xs'))) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (c1, snd (last ((P, s) # xs'))) # ys'\" \n by auto \n then have \"xs = xs' \\ ys = ys'\" using map_lift_catch_some_eq \n by (metis com.distinct(149) com.distinct(173) com.distinct(23) a0 an ass)\n then have ?thesis\n by (metis a0' ass last_length zs) \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = s' \\ s = s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift_catch Q) xs'))) = Q\" \n by (metis fstI nth_append_length) \n then have \"xs = xs' \\ ys = ys'\" \n using map_lift_catch_some_eq a0 zs a0' ass \n by (metis com.distinct(149) com.distinct(173) com.distinct(23) an seq_and_if_not_eq(12)) \n then have ?thesis \n using a0 zs by auto \n } thus ?thesis using l ass by fast\nqed\n\n\nlemma div_seq_nest: \n assumes cptn_m:\"(n,\\,list) \\ cptn_mod_nest_call\"\n shows \"(\\s P Q zs. list=(Seq P Q, s)#zs \\\n (\\xs s' s''. \n (n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n seq_cond_nest zs Q xs P s s'' s' \\ n))\"\nunfolding seq_cond_nest_def\nusing cptn_m\nproof (induct rule: cptn_mod_nest_call.induct)\n case (CptnModNestOne \\ P s)\n thus ?case using cptn_mod_nest_call.CptnModNestOne \n by blast\nnext\n case (CptnModNestSkip \\ P s t n xs) \n from CptnModNestSkip.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Skip, toSeq t)\" by auto\n from CptnModNestSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1)\n by auto\n have x: \"\\c c1 c2. redex c = Seq c1 c2 \\ False\"\n using redex_not_Seq by blast\n from CptnModNestSkip.hyps\n have in_cptn_mod: \"(n,\\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n then show ?case using CptnModNestSkip.hyps(2) SmallStepCon.redex_not_Seq by blast\nnext\n case (CptnModNestThrow \\ P s t xs)\n from CptnModNestThrow.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Throw, toSeq t)\" by auto \n moreover from CptnModNestThrow.hyps \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" using CptnModNestThrow.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto \nnext \n case (CptnModNestFault \\ P s f t n xs)\n from CptnModNestFault.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Fault f, toSeq t)\" by auto \n moreover from CptnModNestFault.hyps \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" using CptnModNestFault.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto \nnext\n case (CptnModNestStuck \\ P s t xs)\n from CptnModNestStuck.hyps\n have step: \"\\\\\\<^sub>c (P, toSeq s) \\ (Stuck, toSeq t)\" by auto \n moreover from CptnModNestStuck.hyps \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" using CptnModNestStuck.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto\nnext \n case (CptnModNestCondT \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModNestCondF \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModNestSeq1 n \\ P0 s xs zs P1) thus ?case \n by blast \nnext \n case (CptnModNestSeq2 n \\ P0 s xs P1 ys zs) \n from CptnModNestSeq2.hyps(3) last_length have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestSeq2.hyps(4) \n have P1cptn:\"(n,\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\" \n by (simp add:CptnModNestSeq2.hyps)\n show ?case\n by (metis CptnModNestSeq2.hyps(3) CptnModNestSeq2.hyps(4) CptnModNestSeq2.hyps(6) \n LanguageCon.com.inject(3) P0cptn fst_conv last_length list.inject snd_conv) \nnext\n case (CptnModNestSeq3 n \\ P0 s xs t f s' ys zs P1) \n from CptnModNestSeq3.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = t\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestSeq3.hyps(5) \n have lastnormal:\"snd (last ((P0, s) # xs)) = s'\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ ((t, s')#ys)\" by (simp add:CptnModNestSeq3.hyps)\n show ?case\n by (metis CptnModNestSeq3.hyps(3) CptnModNestSeq3.hyps(4) CptnModNestSeq3.hyps(6) CptnModNestSeq3.hyps(8)\n LanguageCon.com.inject(3) P0cptn \n fst_conv last_length lastnormal list.inject snd_conv) \nnext \n case (CptnModNestEnv \\ P s t n zs) \n then have step:\"(n,\\, (P, t) # zs) \\ cptn_mod_nest_call\" by auto\n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModNestEnv by auto \n show ?case \n proof (cases P)\n case (Seq P1 P2) \n then have eq_P:\"(P, t) # zs = (LanguageCon.com.Seq P1 P2, t) # zs\" by auto \n then obtain xs t' t'' where \n p1:\"(n,\\, (P1, t) # xs) \\ cptn_mod_nest_call\" and \n p2:\"(zs = map (lift P2) xs \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n (\\c. fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ (\\f. Fault f = c) \\ c = Stuck) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ \n (\\ys. (n,\\,(c, t')#ys) \\ cptn_mod_nest_call \\ zs = map (lift P2) xs @ ((c, t')#ys)))) \" \n using CptnModNestEnv(3) by fastforce\n have all_step:\"(n,\\, (P1, s)#((P1, t) # xs)) \\ cptn_mod_nest_call\" \n using p1 cptn_mod_nest_call.CptnModNestEnv step_e\n using env_intro_diff_p by blast\n show ?thesis using p2 \n proof \n assume \"zs = map (lift P2) xs\"\n have \"(P, t) # zs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: `zs = map (lift P2) xs` lift_def local.Seq)\n thus ?thesis using all_step eq_P by fastforce\n next \n assume \n \"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n (\\c. fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ (\\f. Fault f = c) \\ c = Stuck) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ \n (\\ys. (n,\\,(c, t')#ys) \\ cptn_mod_nest_call \\ zs = map (lift P2) xs @ ((c, t')#ys)))\"\n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys)\"\n from a1 obtain ys where \n p2_exec:\"(n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys\" \n by auto \n have f1:\"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs)) = LanguageCon.com.Skip\"\n using a1 by fastforce \n then have p2_long_exec: \n \"(n,\\, (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys) \\ cptn_mod_nest_call \\\n (P, t)#zs = map (lift P2) ((P1, t) # xs) @\n (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys\" \n using p2_exec by (simp add: lift_def local.Seq) \n thus ?thesis using a1 f1 all_step eq_P by blast \n next\n assume \n a1:\"\\c. fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ (\\f. Fault f = c) \\ c = Stuck) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ \n (\\ys. (n,\\,(c, t')#ys) \\ cptn_mod_nest_call \\ zs = map (lift P2) xs @ ((c, t')#ys))\"\n then obtain c where a1:\n \"fst (((P1, t) # xs) ! length xs) =c \\ (c = Throw \\ (\\f. Fault f = c) \\ c = Stuck) \\\n snd (last ((P1, t) # xs)) = t' \\ t = t'' \\ \n (\\ys. (n,\\,(c, t')#ys) \\ cptn_mod_nest_call \\ zs = map (lift P2) xs @ ((c, t')#ys))\"\n by auto\n then have last_throw:\n \"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t) #xs)) = c\" \n by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xs)) = t'\"\n by fastforce\n have seq_lift:\n \"(LanguageCon.com.Seq P1 P2, t) # map (lift P2) xs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: a1 lift_def) \n thus ?thesis using a1 last_throw last_normal all_step eq_P \n by (clarify, metis (no_types, lifting) append_Cons ) \n qed\n qed\n qed (auto) \nqed (force)+\n\nlemma exD: assumes a0:\"\\x. P x\" obtains x where \"P x\"\n using exE[OF a0] by auto\n\n\n\nlemma not_func_redex_cptn_mod_nest_n': \n assumes \n vars:\"v = toSeq s\" and vars1:\"w = toSeq t\" and \n a0:\"\\\\\\<^sub>c (P, v) \\ (Q, w)\" and\n a0':\"snd s = snd t\" and\n a1:\"(n,\\,(Q,t)#xs) \\ cptn_mod_nest_call\" and \n a2:\"(\\fn. redex P \\ Call fn) \\ \n (redex P = Call fn \\ \\ fn = None) \"\nshows \"(n,\\,(P,s)#(Q,t)#xs) \\ cptn_mod_nest_call\"\nusing a0 a1 a2 a0' vars vars1\nproof (induct arbitrary: xs) \n case (Basicc f e s1) \n thus ?case using stepc.Basicc[of \\ f e s1]\n by (simp add: Basicc cptn_mod_nest_call.CptnModNestSkip)\nnext\n case (Specc s1 t1 r)\n thus ?case using stepc.Specc[of s1 t1 r \\] \n by (simp add: Specc cptn_mod_nest_call.CptnModNestSkip)\nnext\n case (SpecStuckc s1 r)\n thus ?case using stepc.SpecStuckc[of s1 _ \\] \n by (metis LanguageCon.com.distinct(57) SmallStepCon.redex.simps(3) CptnModNestStuck )\nnext\n case (Guardc s1 g f c) \n thus ?case\n by (metis (mono_tags, lifting) cptn_mod_nest_call.CptnModNestGuard prod_eqI toSeq.simps(1) ) \n next\n case (GuardFaultc s1 g f c) \n thus ?case using stepc.GuardFaultc[of s1 g \\ f]\n by (simp add: cptn_mod_nest_call.CptnModNestFault)\nnext\ncase (Seqc c1 s1 c1' t1 c2)\n have step: \"\\\\\\<^sub>c (c1, s1) \\ (c1', t1)\" by (simp add: Seqc.hyps(1))\n then have nsc1: \"c1\\Skip\"\n by (meson stepc_elim_cases(1)) \n have assum: \"(n, \\, (Seq c1' c2, t) # xs) \\ cptn_mod_nest_call\" using Seqc.prems by blast\n have divseq:\n \"(\\s P Q zs. (Seq c1' c2, t) # xs=(Seq P Q, s)#zs \\\n (\\xs sv' sv''. \n ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift Q) xs) \\ \n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, s)#xs)!length xs)=c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((P, s)#xs)) = sv' \\ t= sv''\\\n (\\ys. (n,\\,(c, sv')#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift Q) xs)@((c, sv')#ys)))))) ))\" \n using div_seq_nest [OF assum] unfolding seq_cond_nest_def by auto\n {fix sa P Q zsa\n assume ass:\"(Seq c1' c2, t) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ t = sa \\ xs = zsa\" by auto\n then have \n \"(\\xs sv' sv''. (n,\\, (P, sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n (\\c. (fst(((P, sa)#xs)!length xs)=c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((P, sa)#xs)) = sv' \\ t= sv''\\\n (\\ys. (n,\\,(c, sv')#ys) \\ cptn_mod_nest_call \\ zsa=(map (lift Q) xs)@((c, sv')#ys))))))\" \n using ass divseq by blast\n } note conc=this [of c1' c2 t xs] \n then obtain xs' sa' sa'' where \n split:\"(n,\\, (c1',t) # xs') \\ cptn_mod_nest_call \\\n (xs = map (lift c2) xs' \\ \n fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1',t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c= Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (n,\\,(c, sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((c, sa')#ys)))))\" \n by blast\n then have \"xs = map (lift c2) xs' \\ \n fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1',t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c= Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (n,\\,(c, sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((c, sa')#ys))))\" \n by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift c2) xs'\"\n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', t)#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2) Seqc.prems(4) a0' \n by (simp add: Seqc.prems(5))\n then have \"(Seq c1' c2, t)#xs = map (lift c2) ((c1', t)#xs')\"\n using c1'nonf\n by (simp add: lift_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModNestSeq1)\n next\n assume \" \n fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1',t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c= Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (n,\\,(c, sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((c, sa')#ys))))\" \n thus ?thesis\n proof\n assume assth:\"fst (((c1', t) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys)\"\n then obtain ys \n where split':\"(n,\\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n by auto \n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', t)#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2)\n by (simp add: Seqc.prems(4) Seqc.prems(5) a0') \n then have seqmap:\"(Seq c1 c2, s)#(Seq c1' c2, t)#xs =\n map (lift c2) ((c1,s)#(c1', t)#xs') @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using split' by (simp add: lift_def) \n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = Skip\" \n using assth by fastforce \n thus ?thesis\n using seqmap split' cptn_mod_nest_call.CptnModNestSeq2 induct_step lastc1 lastc1skip\n by (metis (no_types) Cons_lift_append ) \n next \n assume assm:\n \"\\c. (fst(((c1', t)#xs')!length xs')=c \\ (c= Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (n,\\,(c, sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((c, sa')#ys)))\"\n then obtain c where assm:\n \"(fst(((c1', t)#xs')!length xs')=c \\ (c= Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((c1', t)#xs')) = sa' \\ t= sa''\\\n (\\ys. (n,\\,(c, sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((c, sa')#ys)))\"\n by auto\n then have s'eqsa'': \"t= sa''\" by auto\n then have snormal: \"\\ns. s= ns\" by auto\n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" using split by blast \n then have induct_step: \"(n,\\, (c1, s) # (c1', t)#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2) \n by (simp add: Seqc.prems(4) Seqc.prems(5) a0') \n then obtain ys where\n seqmap:\"(Seq c1' c2, t)#xs = \n (map (lift c2) ((c1', t)#xs'))@((c, sa')#ys)\"\n using assm\n using Cons_lift_append by blast \n then have lastc1:\"last ((c1, s) # (c1',t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = c\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', t) # xs')) = sa'\"\n using assm by force \n thus ?thesis\n using assm c1'cptn induct_step lastc1skip snormal seqmap s'eqsa'' \n by (auto simp add:cptn_mod_nest_call.CptnModNestSeq3)\n qed\n }qed \n next\n case (SeqSkipc c2 s1 xs) \n have c2incptn:\"(n,\\, (c2, s) # xs) \\ cptn_mod_nest_call\" \n using SeqSkipc.prems(1) SeqSkipc.prems(4) SeqSkipc.prems(5) a0' eq_toSeq by blast\n moreover have 1:\"(n,\\, [(Skip, s)]) \\ cptn_mod_nest_call\"\n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n moreover have 2:\"fst(last ([(Skip, s)])) = Skip\" by fastforce\n moreover have 3:\"(n,\\,(c2, snd(last [(Skip, s)]))#xs) \\ cptn_mod_nest_call\" \n using c2incptn by auto \n moreover have \"(c2,s)#xs=(map (lift c2) [])@(c2, snd(last [(Skip, s)]))#xs\" \n by (auto simp add:lift_def)\n moreover have \"s=t\" using eq_toSeq SeqSkipc by blast\n ultimately show ?case by (simp add: CptnModNestSeq2) \nnext\n case (SeqThrowc c2 s1 xs) \n have eq_st:\"s=t\" using eq_toSeq[OF SeqThrowc(3)] SeqThrowc by auto\n obtain ns where normals:\"s= ns\" using SeqThrowc by auto\n have \"(n,\\, [(Throw, ns)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n, \\, (Throw, s)#ys)\\ cptn_mod_nest_call\"\n using normals \n by auto\n moreover have \"fst (last ((Throw, ns)#ys)) = Throw\" using ys_nil last by auto\n moreover have \"snd (last ((Throw, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case \n using SeqThrowc.prems cptn_mod_nest_call.CptnModNestSeq3 eq_st normals\n by (metis append_Nil) \nnext\n case (SeqFaultc f c2 s1 xs) \n have eq_st:\"s=t\" using eq_toSeq[OF SeqFaultc(3)] SeqFaultc by auto\n obtain ns where normals:\"s= ns\" using SeqThrowc by auto\n have f:\"(n,\\, [(Fault f, ns)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n, \\, (Fault f, s)#ys)\\ cptn_mod_nest_call\"\n using normals \n by auto\n moreover have \"fst (last ((Fault f, ns)#ys)) = Fault f\" using ys_nil last by auto\n moreover have \"snd (last ((Fault f, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case \n using SeqFaultc.prems cptn_mod_nest_call.CptnModNestSeq3 eq_st normals f \n by (metis append_Nil) \nnext\n case (SeqStuckc c2 s1 xs) \n have eq_st:\"s=t\" using eq_toSeq[OF SeqStuckc(3)] SeqStuckc by auto\n obtain ns where normals:\"s= ns\" using SeqThrowc by auto\n have f:\"(n,\\, [(Stuck, ns)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n, \\, (Stuck, s)#ys)\\ cptn_mod_nest_call\"\n using normals \n by auto\n moreover have \"fst (last ((Stuck, ns)#ys)) = Stuck\" using ys_nil last by auto\n moreover have \"snd (last ((Stuck, ns)#ys)) = ns\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case \n using SeqStuckc.prems cptn_mod_nest_call.CptnModNestSeq3 eq_st normals f \n by (metis append_Nil) \nnext\n case (CondTruec s1 b c1 c2)\n moreover obtain ns where normals:\"s= ns\" by auto\n moreover have \"s=t\"\n using calculation(5,6) eq_toSeq[OF calculation(4)] by auto\n ultimately show ?case by (simp add: cptn_mod_nest_call.CptnModNestCondT)\nnext\n case (CondFalsec s1 b c1 c2)\n moreover obtain ns where normals:\"s= ns\" by auto\n moreover have \"s=t\"\n using calculation(5,6) eq_toSeq[OF calculation(4)] by auto\n ultimately show ?case by (simp add: cptn_mod_nest_call.CptnModNestCondF)\nnext \n case (WhileTruec s1 b c) \n have sinb: \"s1\\b\" by fact\n obtain ns where normals:\"s= ns\" by auto\n have eq_st:\"s=t\" using eq_toSeq[OF WhileTruec(4)] WhileTruec by blast\n have SeqcWhile: \"(n,\\, (Seq c (While b c), ns) # xs) \\ cptn_mod_nest_call\"\n using WhileTruec.prems(1) eq_st normals by force\n have divseq:\n \"(\\s P Q zs. (Seq c (While b c), ns) # xs=(Seq P Q, s)#zs \\\n (\\xs s'. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\c. (fst(((P, s)#xs)!length xs)=c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((P, s)#xs)) = s' \\\n (\\ys. (n,\\,(c, s')#ys) \\ cptn_mod_nest_call \\ zs=(map (lift Q) xs)@((c, s')#ys))))))))\" \n using div_seq_nest [OF SeqcWhile] eq_st normals \n unfolding seq_cond_nest_def by fastforce\n { fix sa P Q zsa\n assume ass:\"(Seq c (While b c), ns) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c = P \\ (While b c) = Q \\ ns = sa \\ xs = zsa\" by auto\n then have \"(\\xs s'. (n,\\, (P, sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n (\\c. (fst(((P, sa)#xs)!length xs)=c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd(last ((P, sa)#xs)) = s' \\\n (\\ys. (n,\\,(c, s')#ys) \\ cptn_mod_nest_call \\ zsa=(map (lift Q) xs)@((c, s')#ys))))))\" \n using ass divseq by auto \n } note conc=this [of c \"While b c\" \" ns\" xs] \n then obtain xs' s' where split:\"(n,\\, (c, ns) # xs') \\ cptn_mod_nest_call \\\n (xs = map (lift (While b c)) xs' \\\n fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @\n (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\c1. fst (((c, ns) # xs') ! length xs') = c1 \\(c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (n,\\, ((c1, s')#ys)) \\ cptn_mod_nest_call \\ \n xs = map (lift (While b c)) xs' @ ((c1, s')#ys))))\" \n by blast\n then have \"(xs = map (lift (While b c)) xs' \\\n fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @\n (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\c1. fst (((c, ns) # xs') ! length xs') = c1 \\(c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (n,\\, ((c1, s')#ys)) \\ cptn_mod_nest_call \\ \n xs = map (lift (While b c)) xs' @ ((c1, s')#ys))))\" .. \n thus ?case \n proof{ \n assume 1:\"xs = map (lift (While b c)) xs'\"\n have 3:\"(n, \\, (c, ns) # xs') \\ cptn_mod_nest_call\" using split by auto \n then show ?thesis \n using \"1\" cptn_mod_nest_call.CptnModNestWhile1 sinb normals eq_st WhileTruec.prems(4) \n by fastforce \n next\n assume \"fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @\n (While b c, snd (((c, ns) # xs') ! length xs')) # ys) \\\n (\\c1. fst (((c, ns) # xs') ! length xs') = c1 \\(c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (n,\\, ((c1, s')#ys)) \\ cptn_mod_nest_call \\ \n xs = map (lift (While b c)) xs' @ ((c1, s')#ys)))\"\n thus ?case\n proof\n assume asm:\"fst (((c, ns) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @\n (While b c, snd (((c, ns) # xs') ! length xs')) # ys)\"\n then obtain ys where \n asm':\"(n,\\, (While b c, snd (last ((c, ns) # xs'))) # ys) \\ cptn_mod_nest_call \\ \n xs = map (lift (While b c)) xs' @ (While b c, snd (last ((c, ns) # xs'))) # ys\" \n by (auto simp add: last_length)\n moreover have 3:\"(n,\\, (c, ns) # xs') \\ cptn_mod_nest_call\" using split by auto\n moreover from asm have \"fst (last ((c, ns) # xs')) = Skip\"\n by (simp add: last_length) \n ultimately show ?case using sinb normals eq_st WhileTruec.prems(4)\n by (auto simp add:CptnModNestWhile2)\n next\n assume asm:\n \"(\\c1. fst (((c, ns) # xs') ! length xs') = c1 \\(c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (n,\\, ((c1, s')#ys)) \\ cptn_mod_nest_call \\ xs = \n map (lift (While b c)) xs' @ ((c1, s')#ys)))\" \n then obtain c1 where asm:\n \"fst (((c, ns) # xs') ! length xs') = c1 \\ (c1 = Throw \\ (\\f. c1 = Fault f) \\ c1 = Stuck) \\\n snd (last ((c, ns) # xs')) = s' \\ \n (\\ys. (n,\\, ((c1, s')#ys)) \\ cptn_mod_nest_call \\ xs = \n map (lift (While b c)) xs' @ ((c1, s')#ys))\" \n by auto \n moreover from asm have h:\"fst (last ((c, ns) # xs')) = c1\"\n by (simp add: last_length) \n ultimately show ?case \n using sinb normals split eq_st asm WhileTruec.prems(4) CptnModNestWhile3[OF ] \n by (auto simp add:CptnModNestWhile3)\n qed\n }qed \nnext\n case (WhileFalsec s1 b c) \n thus ?case using stepc.WhileFalsec[of s1 b \\ c] \n by (simp add: cptn_mod_nest_call.CptnModNestSkip)\nnext\n case (Awaitc s1 b \\a c t1)\n thus ?case using stepc.Awaitc[of s1 b \\a \\] \n by (simp add: cptn_mod_nest_call.CptnModNestSkip)\nnext\n case (AwaitAbruptc s1 b \\a c t1 ta)\n thus ?case using stepc.AwaitAbruptc[of s1 b \\a \\ c t1 ta] \n by (simp add: cptn_mod_nest_call.CptnModNestThrow) \nnext \n case (AwaitFaultc s1 b \\a c f e ta)\n thus ?case using stepc.AwaitFaultc\n by (simp add: stepc.AwaitFaultc cptn_mod_nest_call.CptnModNestFault)\nnext \n case (AwaitStuckc s1 b \\a c e ta)\n thus ?case using stepc.AwaitStuckc\n by (simp add: stepc.AwaitStuckc cptn_mod_nest_call.CptnModNestStuck)\nnext\n case (Callc p bdy s1)\n moreover have eq_st:\"s=t\" using eq_toSeq[OF Callc(5)] Callc by auto\n moreover obtain ns where normals:\"s= ns\" by auto\n ultimately show ?case\n by (metis LanguageCon.com.inject(6) SmallStepCon.redex.simps(7) option.distinct(1)) \nnext\n case (CallUndefinedc p s1) \n then have seq:\"\\\\\\<^sub>c( (LanguageCon.com.Call p),toSeq s) \\ (Stuck,toSeq t)\" \n using stepc.CallUndefinedc[of \\ p s1] by auto\n thus ?case \n using CallUndefinedc CptnModNestStuck[OF seq _ _ _ CallUndefinedc(2)] \n by force\nnext\n case (DynComc c s1) \n moreover have eq_st:\"s=t\"\n using calculation(4) calculation(5) eq_toSeq[OF calculation(3)] by force\n moreover obtain ns where normals:\"s= ns\" by auto \n moreover have \"(n, \\, (LanguageCon.com.DynCom c, ns) # \n (c (fst ns), ns) # xs) \\ cptn_mod_nest_call\"\n using DynComc.prems(1) DynComc.prems(4) \n cptn_mod_nest_call.CptnModNestDynCom eq_st normals by fastforce\n then show ?case\n using DynComc.prems(4) eq_st normals by fastforce\nnext (* (\\s P Q zs. (Catch c1' c2, t) # xs=(Catch P Q, s)#zs \\\n (\\xs s' s''. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P, s)#xs)))#ys)) \n ))))\n )) *)\n case (Catchc c1 s1 c1' t1 c2 xs)\n have step: \"\\\\\\<^sub>c (c1, s1) \\ (c1', t1)\" by (simp add: Catchc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1) by fastforce \n have assum: \"(n,\\, (Catch c1' c2, t) # xs) \\ cptn_mod_nest_call\" \n using Catchc.prems by blast\n note div = div_catch_nest[OF assum, simplified catch_cond_nest_def] \n { fix sa P Q zsa\n assume ass:\"(Catch c1' c2,t) # xs = (Catch P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ t = sa \\ xs = zsa\" by auto\n note univ = spec[OF spec[OF spec[OF spec[OF div, of sa], of P ], of Q], of zsa] \n note cond = mp[OF univ ass] \n } note conc=this [of c1' c2 t xs] \n have ass:\"(LanguageCon.com.Catch c1' c2, t) # xs = (LanguageCon.com.Catch c1' c2, t) # xs\"\n by auto\n note body =conc[OF ass] \n then obtain xs' sa' sa'' \n where split:\n \"(n, \\, (c1', t) # xs') \\ cptn_mod_nest_call \\\n (xs = map (lift_catch c2) xs' \\\n fst (((c1', t) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((c1', t) # xs')) = sa' \\\n t = sa'' \\\n (\\ys. (n, \\, (c2, snd (((c1', t) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\ta. fst (((c1', t) # xs') ! length xs') = ta \\\n (ta = LanguageCon.com.Skip \\ (\\f. ta = com.Fault f) \\ ta = com.Stuck) \\\n (\\ys. (n, \\, (ta, snd (last ((c1', t) # xs'))) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (ta, snd (last ((c1', t) # xs'))) # ys)))\" \n by blast\n note c1 = conjunct2[OF this] \n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift_catch c2) xs'\"\n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n, \\, (c1, s) # (c1',t)#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) \n by (simp add: Catchc.prems(4) Catchc.prems(5) a0') \n then have \"(Catch c1' c2, t)#xs = map (lift_catch c2) ((c1', t)#xs')\"\n using c1'nonf\n by (simp add: CptnModCatch1 lift_catch_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step \n by (auto simp add: CptnModNestCatch1)\n next \n assume \"fst (((c1', t) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((c1', t) # xs')) = sa' \\ t = sa'' \\\n (\\ys. (n, \\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\\n (\\ta. fst (((c1', t) # xs') ! length xs') = ta \\\n (ta = LanguageCon.com.Skip \\ (\\f. ta = com.Fault f) \\ ta = com.Stuck) \\\n (\\ys. (n, \\, (ta, snd (last ((c1', t) # xs'))) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (ta, snd (last ((c1', t) # xs'))) # ys))\" \n thus ?thesis\n proof\n assume assth:\n \"fst (((c1', t) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((c1', t) # xs')) = sa' \\ t = sa'' \\\n (\\ys. (n, \\, (c2, snd (((c1', t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys)\"\n then have s'eqsa'': \"t= sa''\" by auto\n then have snormal: \"\\ns. s= ns\"\n using Catchc.prems(4) Catchc.prems(5) a0' c_step local.step by blast\n then obtain ys \n where split':\"(n,\\, (c2, snd (((c1',t) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using assth by auto \n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" \n using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', t)#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) SmallStepCon.redex.simps(11)\n by (simp add: Catchc.prems(4) Catchc.prems(5) a0')\n then have seqmap:\"(Catch c1 c2, s)#(Catch c1' c2, t)#xs = \n map (lift_catch c2) ((c1,s)#(c1', t)#xs') @ \n (c2, snd (((c1', t) # xs') ! length xs')) # ys\"\n using split' by (simp add: CptnModCatch3 lift_catch_def) \n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = Throw\" \n using assth by fastforce\n then have \"snd (last ((c1, s) # (c1', t) # xs')) = sa'\"\n using assth by fastforce\n thus ?thesis using snormal seqmap s'eqsa'' split' \n cptn_mod_nest_call.CptnModNestCatch3 \n induct_step lastc1 lastc1skip\n using Cons_lift_catch_append\n by (metis) \n next\n assume assm:\"(\\ta. fst (((c1', t) # xs') ! length xs') = ta \\\n (ta = LanguageCon.com.Skip \\ (\\f. ta = com.Fault f) \\ ta = com.Stuck) \\\n (\\ys. (n, \\, (ta, snd (last ((c1', t) # xs'))) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (ta, snd (last ((c1', t) # xs'))) # ys))\"\n then obtain c where assm:\"fst (((c1', t) # xs') ! length xs') = c \\\n (c = LanguageCon.com.Skip \\ (\\f. c = com.Fault f) \\ c = com.Stuck) \\\n (\\ys. (n, \\, (c, snd (last ((c1', t) # xs'))) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @ (c, snd (last ((c1', t) # xs'))) # ys)\"\n by auto\n then have c1'cptn:\"(n,\\, (c1', t) # xs') \\ cptn_mod_nest_call\" \n using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', t)#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) SmallStepCon.redex.simps(11) \n by (simp add: Catchc.prems(4) Catchc.prems(5) a0')\n then have \"map (lift_catch c2) ((c1', t) # xs') = (Catch c1' c2, t) # map (lift_catch c2) xs'\" \n by (auto simp add: lift_catch_def)\n then obtain ys \n where seqmap:\"(Catch c1' c2, t)#xs = (map (lift_catch c2) ((c1', t)#xs'))@((c,snd(last ((c1', t)#xs')))#ys)\"\n using assm by fastforce\n then have lastc1:\"last ((c1, s) # (c1', t) # xs') = ((c1', t) # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', t) # xs')) = c\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', t) # xs')) = snd (last ((c1', t) # xs'))\"\n using assm by force\n then obtain f where c:\"(c = LanguageCon.com.Skip \\ (c = com.Fault f) \\ c = com.Stuck)\" using assm by auto\n thus ?thesis \n using assm c1'cptn induct_step lastc1skip seqmap \n cptn_mod_nest_call.CptnModNestCatch2[OF induct_step lastc1skip c]\n by auto\n qed\n }qed \nnext\n case (CatchThrowc c2 s1)\n then obtain ns where ns:\"s = ns\" by auto\n then have eq_st: \"s=t\" using eq_toSeq[OF CatchThrowc(3)] CatchThrowc(4,5) by auto\n have c2incptn:\"(n,\\, (c2, ns) # xs) \\ cptn_mod_nest_call\"\n using CatchThrowc.prems(1) eq_st ns by fastforce\n have 1:\"(n,\\, [(Throw, ns)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n have 2:\"fst(last ([(Throw, ns)])) = Throw\" by fastforce\n have 3:\"(n,\\,(c2, snd(last [(Throw, ns)]))#xs) \\ cptn_mod_nest_call\" \n using c2incptn by auto\n moreover have \"(c2, ns)#xs=\n (map (lift c2) [])@(c2, snd(last [(Throw, ns)]))#xs\" \n by (auto simp add:lift_def) \n ultimately show ?case using eq_st ns CptnModNestCatch3[OF 1 2] by fastforce\nnext\n case (CatchSkipc c2 s1)\n have \"(n,\\, [(Skip, s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n,\\, (Skip, s)#ys)\\ cptn_mod_nest_call\"\n by auto\n moreover have \"fst (last ((Skip, s)#ys)) = Skip\" using ys_nil last by auto\n moreover have \"snd (last ((Skip, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto\n moreover have \"s=t\"\n using CatchSkipc.prems(4) CatchSkipc.prems(5) a0' eq_toSeq by blast\n ultimately show ?case using CatchSkipc.prems \n by simp (simp add: cptn_mod_nest_call.CptnModNestCatch2 ys_nil)\nnext\n case (CatchFaultc f c2 s1)\n have \"(n,\\, [(Fault f, s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n,\\, (Fault f, s)#ys)\\ cptn_mod_nest_call\"\n by auto\n moreover have \"fst (last ((Fault f, s)#ys)) = Fault f\" using ys_nil last by auto\n moreover have \"snd (last ((Fault f, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto\n moreover have \"s=t\"\n using CatchFaultc.prems(4) CatchFaultc.prems(5) a0' eq_toSeq by blast\n ultimately show ?case using CatchFaultc.prems \n by simp (simp add: cptn_mod_nest_call.CptnModNestCatch2 ys_nil)\nnext\n case (CatchStuckc c2 s1)\n have \"(n,\\, [(Stuck, s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n,\\, (Stuck, s)#ys)\\ cptn_mod_nest_call\"\n by auto\n moreover have \"fst (last ((Stuck, s)#ys)) = Stuck\" using ys_nil last by auto\n moreover have \"snd (last ((Stuck, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto\n moreover have \"s=t\"\n using CatchStuckc.prems(4) CatchStuckc.prems(5) a0' eq_toSeq by blast\n ultimately show ?case using CatchStuckc.prems \n by simp (simp add: cptn_mod_nest_call.CptnModNestCatch2 ys_nil)\nqed\n\n\nlemma not_func_redex_cptn_mod_nest_n_env: \nassumes a0:\"\\\\\\<^sub>c (P,s) \\\\<^sub>e (P, t)\" and\n a1:\"(n,\\,(P,t)#xs) \\ cptn_mod_nest_call\" \nshows \"(n,\\,(P,s)#(P,t)#xs) \\ cptn_mod_nest_call\"\n by (simp add: a0 a1 cptn_mod_nest_call.CptnModNestEnv)\n\n\nlemma cptn_mod_nest_cptn_mod:\"(n,\\,cfs) \\ cptn_mod_nest_call \\ (\\,cfs)\\ cptn_mod\"\n by (induct rule:cptn_mod_nest_call.induct, (auto simp:cptn_mod.intros )+)\n \n\nlemma cptn_mod_cptn_mod_nest: \"(\\,cfs)\\ cptn_mod \\ \\n. (n,\\,cfs) \\ cptn_mod_nest_call\"\nproof (induct rule:cptn_mod.induct)\n case (CptnModSkip \\ P s t xs) \n then obtain n where cptn_nest:\"(n, \\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = sn) \\ (\\ f) = Some Skip \\ P \\ Call f )\" \n then have ?case\n by (meson CptnModSkip.hyps(1) CptnModSkip.hyps(2) CptnModSkip.hyps(3) \n cptn_nest cptn_mod_nest_callp.CptnModNestSkip\n cptn_mod_nest_callp_cptn_mod_nest_call_eq) \n }note t1=this\n {assume asm:\"\\ (\\f. ((\\sn. s = sn) \\ (\\ f) = Some Skip \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = sn) \\ (\\ f) = Some Skip \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s= sn\" by auto\n then have t_eq_s:\"t=s\" \n using asm cptn_nest normal_s call_f_step_not_s_eq_t_false[OF CptnModSkip(1)] \n eq_toSeq[OF CptnModSkip.hyps(3)] CptnModSkip.hyps(2) toSeq.simps(1) \n by blast \n then have \"(Suc n, \\,((Call f), sn)#(Skip, sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce \nnext\n case (CptnModThrow \\ P s t xs) \n then obtain n where cptn_nest:\"(n, \\, (Throw, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = sn) \\ (\\ f) = Some Throw \\ P \\ Call f )\" \n then have ?case \n using CptnModNestThrow[OF CptnModThrow(1) CptnModThrow(2) ] asm CptnModThrow(3)\n using cptn_nest by blast\n }note t1=this\n { assume asm:\"\\ (\\f. ((\\sn. s = sn) \\ (\\ f) = Some Throw \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = sn) \\ (\\ f) = Some Throw \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s= sn\" by auto\n then have t_eq_s:\"t=s\" \n using asm cptn_nest normal_s eq_toSeq[OF CptnModThrow.hyps(3)]\n CptnModThrow.hyps(1) \n call_f_step_not_s_eq_t_false[OF CptnModThrow.hyps(1)] \n by fastforce \n then have \"(Suc n, \\,((Call f), sn)#(Throw, sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce\nnext\n case (CptnModFault \\ P s f1 t xs) \n then obtain n where cptn_nest:\"(n, \\, (Fault f1, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = sn) \\ (\\ f) = Some (Fault f1) \\ P \\ Call f )\" \n then have ?case \n using CptnModNestFault[OF CptnModFault(1) CptnModFault(2) ] asm CptnModFault(3)\n using cptn_nest by blast\n }note t1=this\n { assume asm:\"\\ (\\f. ((\\sn. s = sn) \\ (\\ f) = Some (Fault f1) \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = sn) \\ (\\ f) = Some (Fault f1) \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s= sn\" by auto\n then have t_eq_s:\"t=s\" \n using asm cptn_nest normal_s eq_toSeq[OF CptnModFault.hyps(3)]\n CptnModFault.hyps(1) \n call_f_step_not_s_eq_t_false[OF CptnModFault.hyps(1)] \n by fastforce \n then have \"(Suc n, \\,((Call f), sn)#(Fault f1, sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce\nnext\n case (CptnModStuck \\ P s t xs) \n then obtain n where cptn_nest:\"(n, \\, (Stuck, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = sn) \\ (\\ f) = Some Stuck \\ P \\ Call f )\" \n then have ?case \n using CptnModNestStuck[OF CptnModStuck(1) CptnModStuck(2) ] asm CptnModStuck(3)\n using cptn_nest by blast\n }note t1=this\n { assume asm:\"\\ (\\f. ((\\sn. s = sn) \\ (\\ f) = Some Stuck \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = sn) \\ (\\ f) = Some Stuck \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s= sn\" by auto\n then have t_eq_s:\"t=s\" \n using asm cptn_nest normal_s eq_toSeq[OF CptnModStuck.hyps(3)]\n CptnModStuck.hyps(1) \n call_f_step_not_s_eq_t_false[OF CptnModStuck.hyps(1)] \n by fastforce \n then have \"(Suc n, \\,((Call f), sn)#(Stuck, sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce\nnext\n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" using CptnModSeq2(2) by auto\n also obtain m where m:\"(m, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using CptnModSeq2(5) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModSeq2 cptn_mod_nest_call.CptnModNestSeq2 by blast\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModSeq2 \n cptn_mod_nest_call.CptnModNestSeq2 le_cases3 by blast \n qed\nnext\n case (CptnModSeq3 \\ P0 s xs t f s' ys zs P1) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" using CptnModSeq3(2) by auto\n also obtain m where m:\"(m, \\, (t, s') # ys) \\ cptn_mod_nest_call\"\n using CptnModSeq3.hyps(7) by blast \n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModSeq3 cptn_mod_nest_call.CptnModNestSeq3\n by fast\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModSeq3\n cptn_mod_nest_call.CptnModNestSeq3 le_cases3\n by (smt cptn_mod_nest_mono) \n qed\nnext\n case (CptnModWhile2 \\ P s xs b zs ys) \n obtain n where n:\"(n, \\, (P, s) # xs) \\ cptn_mod_nest_call\" using CptnModWhile2(2) by auto\n also obtain m where \n m:\" (m, \\, (LanguageCon.com.While b P, snd (last ((P, s) # xs))) # ys) \\ \n cptn_mod_nest_call\"\n using CptnModWhile2(7) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n \n CptnModWhile2 cptn_mod_nest_call.CptnModNestWhile2 by metis\n next \n case False \n thus ?thesis \n proof -\n have f1: \"\\ n \\ m \\ (m, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_mono[of n \\ _ m] n by presburger\n have \"n \\ m\"\n using False by linarith\n then have \"(m, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using f1 by metis\n then show ?thesis\n by (metis (no_types) CptnModWhile2(3) CptnModWhile2(4) CptnModWhile2(5) \n cptn_mod_nest_call.CptnModNestWhile2 m)\n qed \n qed\nnext\n case (CptnModWhile3 \\ P s xs t f b s' ys zs)\n obtain n where n:\"(n, \\, (P, s) # xs) \\ cptn_mod_nest_call\" \n using CptnModWhile3(2) by auto\n also obtain m where \n m:\" (m, \\, (t, s') # ys) \\ cptn_mod_nest_call\"\n using CptnModWhile3(8) by auto\n ultimately show ?case \n proof (cases \"n\\m\") \n case True thus ?thesis \n proof -\n have \"(n, \\, (t, s') # ys) \\ cptn_mod_nest_call\"\n using True cptn_mod_nest_mono[of m \\ _ n] m by presburger\n then show ?thesis \n by (metis (no_types) local.CptnModWhile3(3) local.CptnModWhile3(4) \n local.CptnModWhile3(6) local.CptnModWhile3(9)\n CptnModWhile3.hyps(5) cptn_mod_nest_call.CptnModNestWhile3 n)\n qed \n next \n case False \n thus ?thesis \n using m n cptn_mod_nest_call.CptnModNestWhile3[OF n] cptn_mod_nest_mono[of n \\ _ m]\n by (smt CptnModWhile3.hyps(3) CptnModWhile3.hyps(4) CptnModWhile3.hyps(5) \n CptnModWhile3.hyps(6) CptnModWhile3.hyps(9) cptn_mod_nest_call.CptnModNestWhile3 le_cases3)\n qed\nnext\n case (CptnModCatch2 \\ P0 s xs t f ys zs P1) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" \n using CptnModCatch2(2) by auto\n also obtain m where m:\"(m, \\, (t, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using CptnModCatch2(6) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n \n CptnModCatch2 cptn_mod_nest_call.CptnModNestCatch2 by fast\n next \n case False\n then have \"n\\m\" by auto\n thus ?thesis\n using False cptn_mod_nest_mono[OF n] m n CptnModCatch2 \n CptnModNestCatch2[OF _ CptnModCatch2(3)] \n by blast\n qed\nnext\n case (CptnModCatch3 \\ P0 s xs s' ys zs P1) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" \n using CptnModCatch3(2) by auto\n also obtain m where m:\"(m, \\, (ys, snd (last ((P0, s) # xs))) # zs) \\ cptn_mod_nest_call\"\n using CptnModCatch3(6) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModCatch3 cptn_mod_nest_call.CptnModNestCatch3\n by blast\n next \n case False \n have f1: \"\\ n \\ m \\ (m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_mono[of n \\ _ m] n by presburger\n have \"n \\ m\"\n using False by auto\n then have \"(m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\"\n using f1 by meson\n then show ?thesis\n by (metis (no_types) CptnModCatch3(3,4,7) cptn_mod_nest_call.CptnModNestCatch3 m) \n qed\n qed(fastforce intro: cptn_mod_nest_call.intros)+\n\nlemma cptn_mod_same_n:\n assumes a0:\"(\\,cfs)\\ cptn_mod\" \n shows \"\\n. (n,\\,cfs) \\ cptn_mod_nest_call\"\nproof -\n show ?thesis using cptn_mod_cptn_mod_nest\n by (metis a0 )\nqed\n\nlemma cptn_mod_same_n1:\n assumes a0:\"(\\,cfs)\\ cptn_mod\" and \n a1:\"(\\,cfs1)\\ cptn_mod\"\n shows \"\\n. (n,\\,cfs) \\ cptn_mod_nest_call \\ (n,\\,cfs1) \\ cptn_mod_nest_call\"\nproof -\n show ?thesis using cptn_mod_nest_mono cptn_mod_cptn_mod_nest\n by (metis a0 a1 cptn_mod_nest_mono2 leI)\nqed\n\nlemma cptn_mod_eq_cptn_mod_nest:\n \"(\\,cfs)\\ cptn_mod \\ (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by auto\n\nlemma cptn_mod_eq_cptn_mod_nest':\n \"\\n. ((\\,cfs)\\ cptn_mod \\ (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_eq_cptn_mod_nest by auto\n\nlemma cptn_mod_eq_cptn_mod_nest1:\n \"(\\,cfs)\\ cptn_mod = (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by auto\n\n\nlemma cptn_eq_cptn_mod_nest:\n \"(\\,cfs)\\ cptn = (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by blast\n\nsubsection \\computation on nested calls limit\\\nsubsection \\Elimination theorems\\\nlemma elim_cptn_mod_nest_step_c:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" \n shows \"\\\\\\<^sub>c (P,toSeq s) \\ (Q,toSeq t) \\ \\\\\\<^sub>c (P,s) \\\\<^sub>e (Q,t)\"\nproof-\n have \"(\\,cfg) \\ cptn\" using a0 cptn_mod_nest_cptn_mod\n using cptn_eq_cptn_mod_set by auto \n then have \"\\\\\\<^sub>c (P,s) \\\\<^sub>c\\<^sub>e (Q,t)\" using a1\n by (metis cptn_elim_cases(2))\n thus ?thesis\n using step_ce_not_step_e_step_c by blast \nqed\n\nlemma elim_cptn_mod_nest_call_env:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(P,t)#cfg1\" and\n a2:\"\\f. \\ f = Some (LanguageCon.com.Call f) \\ \n s = t \\ SmallStepCon.redex P \\ LanguageCon.com.Call f\"\n shows \"(n,\\,(P,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 a2\nproof (induct arbitrary: P cfg1 s t rule:cptn_mod_nest_call.induct ) \ncase (CptnModNestSeq1 n \\ P0 sa xs zs P1)\n then obtain xs' where \"xs = (P0, t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1\n apply auto\n using CptnModNestSeq1.hyps(2) by blast \n have \"(P, t) = lift P1 (P0, t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0, t) # xs'\\ by auto\n then have \"(n, \\, (LanguageCon.com.Seq P0 P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n then show ?case\n using CptnModNestSeq1.prems(1) by fastforce \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by fastforce\n next\n case (Cons x xs') \n have x:\"x=(P0,t) \\ s=sa \\ P = Seq P0 P1\"\n proof-\n have \"zs=(Seq P0 P1,t)#cfg1\" using Cons by fastforce\n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0 P1 \\ snd x = t\"\n by (simp add: \\zs = (LanguageCon.com.Seq P0 P1, t) # cfg1\\ case_prod_beta)\n then show ?thesis using CptnModNestSeq2.prems(1)\n by fastforce\n qed \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons x by auto \n have \"fst (last ((P0, t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n cptn_mod_nest_call.CptnModNestSeq2[OF step] by fastforce\n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs ta f s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"x=(P0,t)\" \n proof-\n have zs:\"zs=(Seq P0 P1,t)#cfg1\" using Cons by fastforce\n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0 P1 \\ snd x = t\"\n using Cons.prems(8) zs by fastforce\n then show ?thesis\n by fastforce \n qed \n have s:\"s=sa\" using CptnModNestSeq3.prems(1) by auto\n have P:\"P= Seq P0 P1\" using CptnModNestSeq3.prems(1) by auto\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons x s P by auto \n then obtain t' where t:\"t= t'\" by auto\n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0, t') # xs') = last ((P0, sa) # x # xs')\"\n using t x by force\n then have h:\"fst (last ((P0, t') # xs')) = ta\"\n using Cons.prems(3) by presburger\n show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestSeq3.prems(1) Cons.prems(6) Cons.prems(8) \n cptn_mod_nest_call.CptnModNestSeq3[OF local.step[simplified t] h] \n t x s P\n by fastforce\n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain xs' where \"xs = (P0, t)#xs' \" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1\n by (metis SmallStepCon.redex.simps(11) fst_conv nth_Cons_0 snd_conv) \n have \"(P, t) = lift_catch P1 (P0, t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) \\xs = (P0, t) # xs'\\ by auto\n then have \"(n, \\, (Catch P0 P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by fastforce \nnext\n case (CptnModNestCatch2 n \\ P0 sa xs ta f ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"x=(P0,t)\" \n proof-\n have zs:\"zs=(Catch P0 P1,t)#cfg1\" using Cons by fastforce\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0 P1 \\ snd x = t\"\n using Cons.prems(7) zs by fastforce \n then show ?thesis\n by fastforce \n qed\n moreover have \"s=sa \\ P = Catch P0 P1\" using CptnModNestCatch2.prems(1) by auto \n ultimately have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons(3,9,10) by auto \n have \"fst (last ((P0, t) # xs')) = ta\"\n using Cons.prems(3) x CptnModNestCatch2.prems(1) by auto\n then show ?case\n using Cons.prems(4,5) Cons.prems(7) CptnModNestCatch2.prems(1) \n cptn_mod_nest_call.CptnModNestCatch2[OF step] x by auto \n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"x=(P0,t) \\ s = sa \\ P = Catch P0 P1\" \n proof-\n have zs:\"zs=(Catch P0 P1,t)#cfg1\" using Cons by fastforce\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0 P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis\n using CptnModNestCatch3.prems(1) by auto\n qed \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons by auto\n then obtain t' where t:\"t= t'\" by auto \n then show ?case \n using cptn_mod_nest_call.CptnModNestCatch3[OF local.step[simplified t]]\n Cons.prems(3,4,7) CptnModNestCatch3.hyps(4,5) CptnModNestCatch3.prems(1) x by fastforce\n qed \nqed(fastforce+)\n\n\nlemma elim_cptn_mod_nest_not_env_call:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"(\\f. redex P \\ Call f) \\ \n SmallStepCon.redex P = LanguageCon.com.Call fn \\ \\ fn = None\" \n shows \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 a2\nproof (induct arbitrary: P Q cfg1 s t rule:cptn_mod_nest_call.induct )\ncase (CptnModNestSeq1 n \\ P0 s xs zs P1)\n then obtain P0' xs' where \"xs = (P0', t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1 by fastforce \n have Q:\"(Q, t) = lift P1 (P0', t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0', t) # xs'\\ by auto\n also then have \"(n, \\, (LanguageCon.com.Seq P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n ultimately show ?case\n using CptnModNestSeq1.prems(1)\n by (simp add: Cons_lift Q) \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0'' where zs: \"zs=(Seq P0'' P1,t)#cfg1\" using Cons(7) Cons(8) \n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta') \n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0'' P1 \\ snd x = t\"\n by (simp add: zs case_prod_beta)\n also have \"sa=s\" using Cons by fastforce\n ultimately show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t) \\ s = sa \\ P = Seq P0 P1\"\n using CptnModNestSeq2.prems(1) by blast \n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by auto\n have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n local.step cptn_mod_nest_call.CptnModNestSeq2[of n \\ P0' t xs' P1 ys] Cons_lift_append\n by (metis (no_types, lifting) last_ConsR list.inject list.simps(3)) \n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs c f s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\"\n proof-\n obtain P0' where zs:\"zs=(Seq P0' P1,t)#cfg1\" using Cons(8) Cons(9) \n unfolding lift_def\n by (smt CptnModNestSeq3.prems(1) append_Cons list.sel(3) \n list.simps(9) nth_Cons_0 prod.case_eq_if snd_conv) \n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0' P1 \\ snd x = t\"\n using Cons.prems(8) zs by force \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\"\n proof -\n have f1: \"LanguageCon.com.Seq P0 P1 = P \\ sa = s\"\n using CptnModNestSeq3.prems(1) by blast\n then have \"SmallStepCon.redex P = SmallStepCon.redex P0\"\n by (metis SmallStepCon.redex.simps(4))\n then show ?thesis\n using f1 Cons.prems(2) CptnModNestSeq3.prems(2) x by presburger\n qed \n then obtain t' where t:\"t= t'\" by auto\n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0', t') # xs') = last ((P0, sa) # x # xs')\"\n using t x by force\n also then have \"fst (last ((P0', t') # xs')) = c\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4,5,6,8) \n CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3[of n \\ P0' t' xs' c f s' ys] \n local.step t x Cons_lift_append\n by (metis (no_types, lifting) list.sel(3)) \n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where xs:\"xs = (P0', t)#xs'\" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1 by fastforce \n have Q:\"(Q, t) = lift_catch P1 (P0', t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) xs by auto\n then have \"(n, \\, (Catch P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by (simp add:Cons_lift_catch Q)\nnext\n case (CptnModNestCatch2 n \\ P0 sa xs c f ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n using Cons.prems(7) zs by fastforce \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t) \\ s = sa \\ P = Catch P0 P1\" using CptnModNestCatch2.prems(1) by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" \n using Cons.prems(2) CptnModNestCatch2.prems(1) CptnModNestCatch2.prems(2) x by auto\n have skip:\"fst (last ((P0', t) # xs')) = c\"\n using Cons.prems(3) x by auto\n show ?case\n proof -\n have \"(P, s) # (Q, t) # cfg1 = (LanguageCon.com.Catch P0 P1, sa) # map (lift_catch P1) (x # xs') @ \n (c, snd (last ((P0, sa) # x # xs'))) # ys\"\n using CptnModNestCatch2.prems Cons.prems(7) by auto\n then show ?thesis \n using Cons_lift_catch_append Cons.prems(4,5) \n cptn_mod_nest_call.CptnModNestCatch2[OF local.step skip] last.simps list.distinct(1)\n x\n by (smt list.inject) \n qed\n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t) \\ s = sa \\ P = Catch P0 P1\"\n using CptnModNestCatch3.prems(1) by blast\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons\n using Cons.prems(2) CptnModNestCatch3.prems(1) CptnModNestCatch3.prems(2) x by simp \n then show ?case \n proof -\n have \"last ((P0', t) # xs') = last ((P0, sa) # x # xs')\"\n using x by force\n also then have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestCatch3.prems(1) cptn_mod_nest_call.CptnModNestCatch3[of n \\ P0' t xs' s' P1] \n local.step x by (metis Cons_lift_catch_append list.sel(3)) \n qed\n qed\nnext\ncase (CptnModNestWhile1 n \\ P0 s' xs b zs) \n thus ?case\n using cptn_mod_nest_call.CptnModNestSeq1 list.inject by blast \nnext\n case (CptnModNestWhile2 n \\ P0 s' xs b zs ys) \n have \"(LanguageCon.com.While b P0, s') = (P, s) \\ \n (LanguageCon.com.Seq P0 (LanguageCon.com.While b P0), s') # zs = (Q, t) # cfg1\"\n using CptnModNestWhile2.prems by fastforce\n then show ?case\n using CptnModNestWhile2.hyps(1) CptnModNestWhile2.hyps(3) \n CptnModNestWhile2.hyps(5) CptnModNestWhile2.hyps(6) \n cptn_mod_nest_call.CptnModNestSeq2 by blast\nnext\n case (CptnModNestWhile3 n \\ P0 s' xs b zs) thus ?case\n by (metis (no_types) CptnModNestWhile3.hyps(1,3,6) CptnModNestWhile3.prems(1)\n cptn_mod_nest_call.CptnModNestSeq3 list.inject) \nqed(fastforce+)\n\nlemma elim_cptn_mod_nest_call_n_greater_zero:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P, s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ P\\Q\"\n shows \"n>0\" \n using a0 a1 by (induct rule:cptn_mod_nest_call.induct, fast+)\n\n\nlemma elim_cptn_mod_nest_call_0_False:\n assumes a0:\"(0,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P, s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ P\\Q\"\nshows \"PP\"\nusing a0 a1 elim_cptn_mod_nest_call_n_greater_zero \nby fast\n\nlemma elim_cptn_mod_nest_call_n_dec1:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P, s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ t= s \\ P\\Q\"\n shows \"(n-1,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 \n by (induct rule:cptn_mod_nest_call.induct,force+)\n\nlemma elim_cptn_mod_nest_call_n_dec:\n assumes a0:\"(n,\\,(Call f, s)#(the (\\ f), s)#cfg1) \\ cptn_mod_nest_call\" and\n a1:\"\\ f = Some Q \" and a2:\"Call f\\the (\\ f)\"\n shows \"(n-1,\\,(the (\\ f), s)#cfg1) \\ cptn_mod_nest_call\"\n using elim_cptn_mod_nest_call_n_dec1[OF a0] a1 a2\n by fastforce\n\n\nlemma elim_cptn_mod_nest_call_n:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P, s)#(Q,t)#cfg1\" \n shows \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 \nproof (induct arbitrary: P Q cfg1 s t rule:cptn_mod_nest_call.induct )\ncase (CptnModNestCall n \\ bdy sa ys p)\n thus ?case using cptn_mod_nest_mono1 list.inject by blast\nnext \ncase (CptnModNestSeq1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where \"xs = (P0', t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1 by fastforce \n have Q:\"(Q, t) = lift P1 (P0', t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0', t) # xs'\\ by auto\n also then have \"(n, \\, (LanguageCon.com.Seq P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n ultimately show ?case\n using CptnModNestSeq1.prems(1)\n by (simp add: Cons_lift Q) \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0'' where zs: \"zs=(Seq P0'' P1,t)#cfg1\" using Cons(7) Cons(8) \n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta') \n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0'' P1 \\ snd x = t\"\n by (simp add: zs case_prod_beta)\n also have \"sa=s\" using Cons by fastforce\n ultimately show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons\n by blast \n have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n local.step cptn_mod_nest_call.CptnModNestSeq2[of n \\ P0' t xs' P1 ys] Cons_lift_append\n by (metis (no_types, lifting) last_ConsR list.inject list.simps(3)) \n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs c f s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\"\n proof-\n obtain P0' where zs:\"zs=(Seq P0' P1,t)#cfg1\" using Cons(8) Cons(9) CptnModNestSeq3.prems\n unfolding lift_def \n by (smt append_Cons list.sel(3) \n list.simps(9) nth_Cons_0 prod.case_eq_if snd_conv)\n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0' P1 \\ snd x = t\"\n using zs by (simp add: Cons.prems(8)) \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t) \\ s = sa \\ P = Seq P0 P1\"\n using CptnModNestSeq3.prems by blast\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by auto \n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0', t) # xs') = last ((P0, sa) # x # xs')\"\n using x by force\n also then have \"fst (last ((P0', t) # xs')) = c\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4,5,6,8)\n CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3[of n \\ P0' t xs' c f s' ys] \n local.step x Cons_lift_append\n by (metis (no_types, lifting) list.sel(3)) \n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where xs:\"xs = (P0', t)#xs'\" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1 by fastforce \n have Q:\"(Q, t) = lift_catch P1 (P0', t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) xs by auto\n then have \"(n, \\, (Catch P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by (simp add:Cons_lift_catch Q)\nnext\n case (CptnModNestCatch2 n \\ P0 sa xs c f ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n using Cons.prems(6,7) zs by fastforce \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t) \\ s = sa \\ P = Catch P0 P1\" using CptnModNestCatch2.prems by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by auto \n have skip:\"fst (last ((P0', t) # xs')) = c\"\n using Cons.prems(3) x by auto\n show ?case\n proof -\n have \"(P, s) # (Q, t) # cfg1 = (LanguageCon.com.Catch P0 P1, sa) # map (lift_catch P1) (x # xs') @ \n (c, snd (last ((P0, sa) # x # xs'))) # ys\"\n using CptnModNestCatch2.prems Cons.prems(6,7) by auto\n then show ?thesis \n using Cons_lift_catch_append Cons.prems(5,6,7) \n cptn_mod_nest_call.CptnModNestCatch2[OF local.step skip Cons.prems(4) _ ] last.simps list.distinct(1)\n x\n by (metis (no_types) list.sel(3) )\n qed\n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by simp \n then show ?case \n proof -\n have \"last ((P0', t) # xs') = last ((P0, sa) # x # xs')\"\n using x by force\n also then have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4,5,7) \n CptnModNestCatch3.prems(1) cptn_mod_nest_call.CptnModNestCatch3[of n \\ P0' t xs' s' P1] \n local.step x by (metis Cons_lift_catch_append list.sel(3)) \n qed\n qed\nnext\ncase (CptnModNestWhile1 n \\ P0 s' xs b zs) \n thus ?case\n using cptn_mod_nest_call.CptnModNestSeq1 list.inject by blast \nnext\n case (CptnModNestWhile2 n \\ P0 s' xs b zs ys) \n have \"(LanguageCon.com.While b P0, s') = (P, s) \\ \n (LanguageCon.com.Seq P0 (LanguageCon.com.While b P0), s') # zs = (Q, t) # cfg1\"\n using CptnModNestWhile2.prems by fastforce\n then show ?case\n using CptnModNestWhile2.hyps(1) CptnModNestWhile2.hyps(3) \n CptnModNestWhile2.hyps(5) CptnModNestWhile2.hyps(6) \n cptn_mod_nest_call.CptnModNestSeq2 by blast\nnext\n case (CptnModNestWhile3 n \\ P0 s' xs b zs) thus ?case\n by (metis (no_types) CptnModNestWhile3.hyps(1,3,6) CptnModNestWhile3.prems \n cptn_mod_nest_call.CptnModNestSeq3 list.inject) \nqed (fastforce+) \n\nlemma dropcptn_is_cptn1 [rule_format,elim!]:\n \"\\j,c) \\ cptn_mod_nest_call \\ (n,\\, drop j c) \\ cptn_mod_nest_call\"\nproof -\n {fix j\n assume \"j (n,\\,c) \\ cptn_mod_nest_call\"\n then have \"(n,\\, drop j c) \\ cptn_mod_nest_call\" \n proof(induction j arbitrary: c)\n case 0 then show ?case by auto\n next\n case (Suc j) \n then obtain a b c' where \"c=a#b#c'\"\n by (metis (no_types, hide_lams) Suc_less_eq length_Cons list.exhaust list.size(3) not_less0)\n then also have \"j, drop j (b # c')) \\ cptn_mod_nest_call\" using elim_cptn_mod_nest_call_n[of n \\ c] Suc\n by (metis surj_pair) \n ultimately show ?case by auto \n qed\n } thus ?thesis by auto \nqed\n\ndefinition min_call where\n\"min_call n \\ cfs \\ (n,\\,cfs) \\ cptn_mod_nest_call \\ (\\m((m,\\,cfs) \\ cptn_mod_nest_call))\"\n\nlemma minimum_nest_call:\n \"(m,\\,cfs) \\ cptn_mod_nest_call \\\n \\n. min_call n \\ cfs\"\nunfolding min_call_def\nproof (induct arbitrary: m rule:cptn_mod_nest_call.induct) \n case (CptnModNestOne) thus ?case using cptn_mod_nest_call.CptnModNestOne by blast \nnext\n case (CptnModNestEnv \\ P s t n xs) \n then have \"\\ \\\\\\<^sub>c (P, toSeq s) \\ (P, toSeq t)\" \n using mod_env_not_component step_change_p_or_eq_s by fastforce \n then obtain min_n where min:\"(min_n, \\, (P, t) # xs) \\ cptn_mod_nest_call \\ \n (\\m, (P, t) # xs) \\ cptn_mod_nest_call)\" \n using CptnModNestEnv by blast\n then have \"(min_n, \\, (P,s)#(P, t) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_call.CptnModNestEnv CptnModNestEnv by blast\n also have \"(\\m, (P, s)#(P, t) # xs) \\ cptn_mod_nest_call)\"\n using elim_cptn_mod_nest_call_n min by blast \n ultimately show ?case by auto \nnext\n case (CptnModNestSkip \\ P s t n xs) \n then obtain min_n where \n min:\"(min_n, \\, (LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call \\\n (\\m, (LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call)\" \n by auto\n then have \"(min_n, \\, (P,s)#(LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_call.CptnModNestSkip CptnModNestSkip by blast\n also have \"(\\m, (P, s)#(LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call)\"\n using elim_cptn_mod_nest_call_n min by blast \n ultimately show ?case by fastforce \nnext\n case (CptnModNestThrow \\ P s t n xs) thus ?case \n using elim_cptn_mod_nest_call_n[OF CptnModNestThrow(5)] \n by (metis (no_types, lifting) cptn_mod_nest_call.CptnModNestThrow elim_cptn_mod_nest_call_n) \nnext\n case (CptnModNestStuck \\ P s t n xs) thus ?case \n using elim_cptn_mod_nest_call_n[OF CptnModNestStuck(5)] \n by (metis (no_types, lifting) cptn_mod_nest_call.CptnModNestStuck elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestFault \\ P s f t n xs) thus ?case \n using elim_cptn_mod_nest_call_n[OF CptnModNestFault(5)] \n by (metis (no_types, lifting) cptn_mod_nest_call.CptnModNestFault elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestCondT n \\ P0 s xs b P1) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestCondT elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestCondF n \\ P1 s xs b P0) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestCondF elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestSeq1 n \\ P s xs zs Q) thus ?case\n by (metis (no_types, lifting) Seq_P_Not_finish cptn_mod_nest_call.CptnModNestSeq1 div_seq_nest)\nnext\n case (CptnModNestSeq2 n \\ P s xs Q ys zs) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestSeq2(5) obtain min_q where\n min_q:\"(min_q, \\, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (Q, snd (last ((P,s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestSeq2[of min_p \\ P s xs Q ys zs] \n CptnModNestSeq2(6) CptnModNestSeq2(3)\n by blast\n also have \"\\m,(Seq P Q,s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq2.hyps(3) CptnModNestSeq2.hyps(6) Seq_P_Ends_Normal div_seq_nest min_p) \n ultimately show ?thesis by auto \n next\n case False \n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestSeq2[of min_q \\ P s xs Q ys zs] \n CptnModNestSeq2(6) CptnModNestSeq2(3)\n by blast\n also have \"\\m,(Seq P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P Q, s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have ?thesis\n using Seq_P_Ends_Normal[OF CptnModNestSeq2(6) CptnModNestSeq2(3) ass]\n min_m min_q \n by (metis last_length) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestSeq3 n \\ P s xs c f s' ys zs Q) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestSeq3(6,7) obtain min_q where\n min_q:\"(min_q, \\, (c, s') # ys) \\ cptn_mod_nest_call \\\n (\\m, (c, s') # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True \n then have \"(min_p, \\, (c, s') # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestSeq3[of min_p \\ P s xs c f s' ys zs Q] \n CptnModNestSeq3(3,4,5,6,8)\n by blast\n also have \"\\m,(Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq3.hyps(3,4,5,8) Seq_P_Ends_Abort div_seq_nest min_p)\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestSeq3[of min_q \\ P s xs c f s' ys zs Q] \n CptnModNestSeq3(3,4,5,8)\n by blast\n also have \"\\m,(Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq3.hyps(3,4,5,8) Seq_P_Ends_Abort div_seq_nest min_q) \n ultimately show ?thesis by auto\n qed \nnext\n case (CptnModNestWhile1 n \\ P s xs b zs) \n then obtain min_n where \n min:\"(min_n, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n then have \"(min_n, \\, (While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_call.CptnModNestWhile1[of min_n \\ P s xs b zs] CptnModNestWhile1\n by meson \n also have \"\\m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile1.hyps(4) Seq_P_Not_finish div_seq_nest elim_cptn_mod_nest_call_n min) \n ultimately show ?case by auto\nnext\n case (CptnModNestWhile2 n \\ P s xs b zs ys) \n then obtain min_n_p where \n min_p:\"(min_n_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n from CptnModNestWhile2 obtain min_n_w where\n min_w:\"(min_n_w, \\, (LanguageCon.com.While b P, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (LanguageCon.com.While b P, snd (last ((P, s) # xs))) # ys)\n \\ cptn_mod_nest_call)\"\n by auto\n thus ?case \n proof (cases \"min_n_p\\min_n_w\")\n case True \n then have \"(min_n_p, \\, \n (LanguageCon.com.While b P, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_w using cptn_mod_nest_mono by blast \n then have \"(min_n_p, \\, (While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_call.CptnModNestWhile2[of min_n_p \\ P s xs b zs] CptnModNestWhile2\n by blast\n also have \"\\m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile2.hyps(3) CptnModNestWhile2.hyps(5) \n Seq_P_Ends_Normal div_seq_nest elim_cptn_mod_nest_call_n min_p) \n ultimately show ?thesis by auto \n next\n case False\n then have False:\"min_n_p, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_n_w, \\, (While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n using min_w min_p cptn_mod_nest_call.CptnModNestWhile2[of min_n_w \\ P s xs b zs] CptnModNestWhile2\n by blast\n also have \"\\m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\" \n proof -\n {fix m\n assume min_m:\"m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume \"(m, \\,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n then have a1:\"(m, \\,(Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\" \n by (meson elim_cptn_mod_nest_call_n)\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs (While b P) xs' P ( s) s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P (LanguageCon.com.While b P), s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs (While b P) xs' P ( s) s'' s' \\ m\" by auto\n then have ?thesis unfolding seq_cond_nest_def\n by (metis CptnModNestWhile2.hyps(3) CptnModNestWhile2.hyps(5) Seq_P_Ends_Normal a1 last_length m_cptn min_m min_w) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestWhile3 n \\ P s xs c f b s' ys zs) \n then obtain min_n_p where \n min_p:\"(min_n_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n from CptnModNestWhile3 obtain min_n_w where\n min_w:\"(min_n_w, \\, (c, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (c, snd (last ((P, s) # xs))) # ys)\n \\ cptn_mod_nest_call)\"\n by auto\n thus ?case \n proof (cases \"min_n_p\\min_n_w\")\n case True \n then have \"(min_n_p, \\, \n (c, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_w using cptn_mod_nest_mono by blast \n then have \"(min_n_p, \\, (While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_call.CptnModNestWhile3[of min_n_p \\ P s xs c f b s' ys zs] \n CptnModNestWhile3\n by fastforce\n also have \"\\m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile3.hyps(3,4,6,9) \n Seq_P_Ends_Abort div_seq_nest elim_cptn_mod_nest_call_n min_p) \n ultimately show ?thesis by auto \n next\n case False\n then have False:\"min_n_p, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_n_w, \\, (While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n using min_w min_p cptn_mod_nest_call.CptnModNestWhile3[of min_n_w \\ P s xs c f b s' ys zs] \n CptnModNestWhile3\n by fastforce \n also have \"\\m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume \"(m, \\,(While b P, s) # (Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\"\n then have s1:\"(m, \\,(Seq P (While b P), s) # zs) \\ cptn_mod_nest_call\" \n using elim_cptn_mod_nest_not_env_call\n by (meson elim_cptn_mod_nest_call_n) \n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs (While b P) xs' P ( s) s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P (LanguageCon.com.While b P), s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs (While b P) xs' P s s'' s' \\ m\" by auto\n then have ?thesis unfolding seq_cond_nest_def\n by (metis CptnModNestWhile3.hyps(3,4,6,9) Seq_P_Ends_Abort s1 m_cptn min_m min_w) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestCall n \\ bdy s xs f) thus ?case\n proof -\n { fix nn :: \"nat \\ nat\"\n obtain nna :: nat where\n ff1: \"(nna, \\, (bdy, s) # xs) \\ cptn_mod_nest_call \\ (\\n. \\ n < nna \\ (n, \\, (bdy, s) # xs) \\ cptn_mod_nest_call)\"\n by (meson CptnModNestCall.hyps(2))\n moreover\n { assume \"(nn (nn (Suc nna)), \\, (bdy, s) # xs) \\ cptn_mod_nest_call\"\n then have \"\\ Suc (nn (nn (Suc nna))) < Suc nna\"\n using ff1 by blast\n then have \"(nn (Suc nna), \\, (LanguageCon.com.Call f, s) # (bdy, s) # xs) \\ cptn_mod_nest_call \\ (\\n. (n, \\, (LanguageCon.com.Call f, s) # (bdy, s) # xs) \\ cptn_mod_nest_call \\ \n (\\ nn n < n \\ (nn n, \\, (LanguageCon.com.Call f, s) # (bdy, s) # xs) \\ cptn_mod_nest_call))\"\n using ff1 by (meson CptnModNestCall.hyps(3) CptnModNestCall.hyps(4) cptn_mod_nest_call.CptnModNestCall less_trans_Suc) }\n ultimately have \"\\n. (n, \\, (LanguageCon.com.Call f, s) # (bdy, s) # xs) \\ cptn_mod_nest_call \\ (\\ nn n < n \\ (nn n, \\, (LanguageCon.com.Call f, s) # (bdy, s) # xs) \\ cptn_mod_nest_call)\"\n by (metis (no_types) CptnModNestCall.hyps(3) CptnModNestCall.hyps(4) cptn_mod_nest_call.CptnModNestCall elim_cptn_mod_nest_call_n) }\n then show ?thesis\n by meson\n qed \nnext \n case (CptnModNestDynCom n \\ c s xs) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestDynCom elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestGuard n \\ c s xs g f) thus ?case \n by (meson cptn_mod_nest_call.CptnModNestGuard elim_cptn_mod_nest_call_n) \nnext\n case (CptnModNestCatch1 n \\ P s xs zs Q) thus ?case\n by (metis (no_types, lifting) Catch_P_Not_finish cptn_mod_nest_call.CptnModNestCatch1 div_catch_nest)\nnext\n case (CptnModNestCatch2 n \\ P s xs c f ys zs Q) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestCatch2(5) obtain min_q where\n min_q:\"(min_q, \\, (c, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (c, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n using CptnModNestCatch2.hyps(6) by blast \n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (c, snd (last ((P,s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestCatch2[of min_p \\ P s xs] \n CptnModNestCatch2(3,4,7)\n by blast\n also have \"\\m,(Catch P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have \"xs=xs'\" \n using Catch_P_Ends_Skip[OF CptnModNestCatch2(7) CptnModNestCatch2(3)]\n using CptnModNestCatch2.hyps(4) by blast\n then have \"(m, \\, (P,s) # xs) \\ cptn_mod_nest_call\"\n using m_cptn by auto\n then have False using min_p min_m by fastforce\n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestCatch2[of min_q \\ P s xs ] \n CptnModNestCatch2(3,4,7)\n by blast\n also have \"\\m,(Catch P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have ?thesis\n using Catch_P_Ends_Skip[OF CptnModNestCatch2(7) CptnModNestCatch2(3)]\n min_m min_q\n using CptnModNestCatch2.hyps(4) by blast\n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestCatch3 n \\ P s xs s' Q ys zs ) then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestCatch3(6) CptnModNestCatch3(4) obtain min_q where\n min_q:\"(min_q, \\, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestCatch3[of min_p \\ P s xs s' Q ys zs] \n CptnModNestCatch3(4) CptnModNestCatch3(3) CptnModNestCatch3(7)\n by fastforce\n also have \"\\m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' ns' ns'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P ( s) ns'' ns' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P ( s) ns'' ns' \\ m\" by auto \n then have \"xs=xs'\" \n using Catch_P_Ends_Normal[OF CptnModNestCatch3(7) CptnModNestCatch3(3) ] \n by fastforce\n then have \"(m, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using m_cptn by auto\n then have False using min_p min_m by fastforce\n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestCatch3[of min_q \\ P s xs s' ] \n CptnModNestCatch3(4) CptnModNestCatch3(3) CptnModNestCatch3(7)\n by blast\n also have \"\\m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' ns' ns'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P ( s) ns'' ns' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P ( s) ns'' ns' \\ m\" by auto\n then have ?thesis\n using Catch_P_Ends_Normal[OF CptnModNestCatch3(7) CptnModNestCatch3(3) ]\n min_m min_q \n by (metis last_length) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed \nqed\n\n lemma elim_cptn_mod_min_nest_call:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"(\\f. redex P \\ Call f) \\ \n SmallStepCon.redex P = LanguageCon.com.Call fn \\ \\ fn = None \\ \n (redex P = Call fn \\ P=Q)\" \n shows \"min_call n \\ ((Q,t)#cfg1)\"\nproof -\n have a0: \"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a0': \"(\\m, cfg) \\ cptn_mod_nest_call)\"\n using a0 unfolding min_call_def by auto\n then have \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\" \n using a0 a1 elim_cptn_mod_nest_call_n by blast\n also have \"(\\m, (Q,t)#cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { assume \"\\(\\m, (Q,t)#cfg1) \\ cptn_mod_nest_call)\"\n then obtain m where \n asm0:\"m, (Q,t)#cfg1) \\ cptn_mod_nest_call\"\n by auto\n have ce:\"\\\\\\<^sub>c (P, s) \\\\<^sub>c\\<^sub>e (Q, t)\"\n using a0 a1 cptn_elim_cases(2) cptn_eq_cptn_mod_nest by blast\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (Q, t) \\ \\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t)\"\n using step_ce_dest by blast \n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" \n proof\n assume \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (Q, t)\"\n then show ?thesis \n using a0 a1 a2 cptn_mod_nest_call.CptnModNestEnv \n by (metis asm1 env_c_c')\n next\n assume a00:\"\\\\\\<^sub>c (P, toSeq s) \\ (Q, toSeq t)\"\n moreover have \"P\\Q\" using mod_env_not_component calculation\n by fastforce\n moreover have norm:\"snd s = snd t\"\n using calculation ce step_dest1 by blast \n then show ?thesis using mod_env_not_component a2 not_func_redex_cptn_mod_nest_n'[OF _ _ a00 norm]\n by (simp add: a1 asm1 calculation(2)) \n qed \n then have False using a0' asm0 by auto\n } thus ?thesis by auto qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed \n\nlemma elim_call_cptn_mod_min_nest_call:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"P = Call f \\ \n \\ f = Some Q \\ P\\Q\" \n shows \"min_call (n-1) \\ ((Q,t)#cfg1)\"\nproof -\n have a0: \"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a0': \"(\\m, cfg) \\ cptn_mod_nest_call)\"\n using a0 a2 unfolding min_call_def by auto \n then have \"(n-1,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\" \n using a1 a2 elim_cptn_mod_nest_call_n_dec[of n \\ f s cfg1 Q]\n by (metis (no_types, lifting) SmallStepCon.redex.simps(7) call_f_step_ce_not_s_eq_t_env_step \n cptn_elim_cases(2) cptn_if_cptn_mod cptn_mod_nest_cptn_mod \n elim_cptn_mod_nest_call_n_dec1 not_eq_not_env) \n moreover have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n proof -\n { fix m\n assume \"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n by (smt SmallStepCon.redex.simps(7) Suc_eq_plus1 a0 a0' a1 a2 \n call_f_step_ce_not_s_eq_t_env_step cptn_elim_cases_pair(2) cptn_if_cptn_mod \n cptn_mod_nest_call.CptnModNestCall cptn_mod_nest_cptn_mod \n less_diff_conv not_eq_not_env)\n \n }\n thus ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma term_all_skip:\n assumes a0:\"(\\,cfg)\\cptn\" and\n a1:\"cfg = (c,s)#cfg1\" and a1':\"(c=Skip \\ c=Throw \\ c=Stuck \\ (\\f. c = Fault f))\"\n shows \"\\i,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n have \"\\\\\\<^sub>c(c,s) \\\\<^sub>e x\" using cptn_elim_cases_pair(2)[OF Cons(2)[simplified Cons(3)]] a1'\n by (metis SmallStepCon.final_def SmallStepCon.no_step_final fst_conv step_ce_not_step_e_step_c) \n then obtain s' where x:\"x = (c,s')\"\n by (metis env_c_c' prod.exhaust_sel) \n moreover have cptn:\"(\\,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n moreover have \n xs:\"x # xs = (c, s') # xs\" using x by auto\n ultimately show ?case using Cons(1)[OF cptn xs] Cons(3)\n using diff_Suc_1 fstI length_Cons less_Suc_eq_0_disj nth_Cons' a1' by auto \nqed\n\nlemma term_min_nested_call_0:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (c,s)#cfg1\" and a1':\"(c=Skip \\ c=Throw \\ c=Stuck \\ (\\f. c = Fault f))\"\n shows \"n=0\"\nproof -\n have asm0:\"(n, \\, cfg) \\ cptn_mod_nest_call\" and \n asm1:\"(\\m, cfg) \\ cptn_mod_nest_call)\" \n using a0 unfolding min_call_def by auto \n show ?thesis using a1 asm0 asm1\n proof (induct cfg1 arbitrary: cfg s n)\n case Nil thus ?case\n using cptn_mod_nest_call.CptnModNestOne neq0_conv by blast\n next\n case (Cons x xs)\n then obtain Q s' where cfg:\"cfg = (c, s) # (Q,s') # xs\"\n using prod.exhaust_sel by blast\n then have min_call:\"min_call n \\ cfg\" using Cons unfolding min_call_def by auto\n then have \"(\\f. SmallStepCon.redex c \\ LanguageCon.com.Call f)\" using a1' by auto\n then have \"min_call n \\ ((Q, s')#xs)\" \n using elim_cptn_mod_min_nest_call[OF min_call cfg] cfg\n by simp\n thus ?case using Cons cfg unfolding min_call_def\n proof -\n assume a1: \"(n, \\, (Q, s') # xs) \\ cptn_mod_nest_call \\ \n (\\m, (Q, s') # xs) \\ cptn_mod_nest_call)\"\n have \"c = Q\" using term_all_skip\n proof -\n have \"Suc 0 < length ((c, s) # (Q, s') # xs)\"\n by auto\n then have \"fst (((c, s) # (Q, s') # xs) ! Suc 0) = c\"\n using Cons.prems(2) a1' cfg cptn_if_cptn_mod cptn_mod_nest_cptn_mod term_all_skip by blast\n then show ?thesis\n by simp\n qed\n then show ?thesis\n using a1 Cons.hyps by blast\n qed \n qed\nqed\n\n\ntext \\ function to calculate that there is not any subsequent where the nested call is n \\\ndefinition cond_seq_1\nwhere \n\"cond_seq_1 n \\ c1 s xs c2 zs ys \\ ((n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last((c1,s)#xs)) = Skip \\\n (n,\\,((c2, snd(last ((c1, s)#xs)))#ys)) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys))\"\n\ndefinition cond_seq_2\nwhere\n\"cond_seq_2 n \\ c1 s xs c2 zs ys s' s'' \\ s = s'' \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n snd(last ((c1, s)#xs)) = s' \\ \n (\\c. fst(last ((c1, s)#xs)) = c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n (n,\\,(c, s')#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift c2) xs)@((c, s')#ys))\"\n\ndefinition cond_catch_1\nwhere \n\"cond_catch_1 n \\ c1 s xs c2 zs ys \\ ((n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n (\\c. fst(last((c1,s)#xs)) = c \\ (c=Skip \\ c=Stuck \\ (\\f. c = Fault f)) \\\n (n,\\,((c, snd(last ((c1, s)#xs)))#ys)) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((c, snd(last ((c1, s)#xs)))#ys)))\"\n\ndefinition cond_catch_2\nwhere\n\"cond_catch_2 n \\ c1 s xs c2 zs ys s' s'' \\ s= s'' \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Throw \\\n snd(last ((c1, s)#xs)) = s' \\ \n (n,\\,(c2, s')#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch c2) xs)@((c2, s')#ys)\"\n\n(* fun biggest_nest_call :: \"('s,'p,'f,'e)com \\ \n ('s,'f) xstate \\ \n (('s,'p,'f,'e) config) list \\ \n ('s,'p,'f,'e) body \\ \n nat \\ bool\"\nwhere\n \"biggest_nest_call (Seq c1 c2) s zs \\ n = \n (if (\\xs. ((min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift c2) xs))) then\n let xsa = (SOME xs. (min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift c2) xs)) in\n (biggest_nest_call c1 s xsa \\ n)\n else if (\\xs ys. cond_seq_1 n \\ c1 s xs c2 zs ys) then\n let xsa = (SOME xs. \\ys. cond_seq_1 n \\ c1 s xs c2 zs ys);\n ysa = (SOME ys. cond_seq_1 n \\ c1 s xsa c2 zs ys) in\n if (min_call n \\ ((c2, snd(last ((c1, s)#xsa)))#ysa)) then True\n else (biggest_nest_call c1 s xsa \\ n) \n else let xsa = (SOME xs. \\ys s' s''. cond_seq_2 n \\ c1 s xs c2 zs ys s' s'') in\n (biggest_nest_call c1 s xsa \\ n))\" \n|\"biggest_nest_call (Catch c1 c2) s zs \\ n = \n (if (\\xs. ((min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift_catch c2) xs))) then\n let xsa = (SOME xs. (min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift_catch c2) xs)) in\n (biggest_nest_call c1 s xsa \\ n)\n else if (\\xs ys. cond_catch_1 n \\ c1 s xs c2 zs ys) then\n let xsa = (SOME xs. \\ys. cond_catch_1 n \\ c1 s xs c2 zs ys) in \n (biggest_nest_call c1 s xsa \\ n)\n else let xsa = (SOME xs. \\ys s' s''. cond_catch_2 n \\ c1 s xs c2 zs ys s' s'');\n ysa = (SOME ys. \\s' s''. cond_catch_2 n \\ c1 s xsa c2 zs ys s' s'') in\n if (min_call n \\ ((c2, snd(last ((c1, s)#xsa)))#ysa)) then True\n else (biggest_nest_call c1 s xsa \\ n))\"\n|\"biggest_nest_call _ _ _ _ _ = False\"\n*)\n\nlemma min_call_less_eq_n:\n \"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys) \\\n p\\n \\ q\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_seq_less_eq_n':\n \"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n min_call p \\ ((c1, s)#xs) \\\n p\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_seq2:\n \"min_call n \\ ((Seq c1 c2,s)#zs) \\\n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Skip \\\n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs) \\ min_call n \\ ((c2, snd(last ((c1, s)#xs)))#ys)\n \"\nproof -\n assume a0:\"min_call n \\ ((Seq c1 c2,s)#zs)\" and\n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = Skip\" and\n a3:\"(n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p q where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call by blast\n then have p_q:\"p\\n \\ q\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p q , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(q,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\q\")\n case True \n then have q_cptn_c1:\"(q, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(q, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(q,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 CptnModNestSeq2[OF q_cptn_c1 a2 q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 CptnModNestSeq2[OF q_cptn_c1 a2 q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ q \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_seq3:\n \"min_call n \\ ((Seq c1 c2,s)#zs) \\\n s= s'' \\\n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = c \\ (c=Throw \\ c=Stuck \\ (\\f. c = Fault f)) \\\n snd(last ((c1, s)#xs)) = s' \\\n (n,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((c, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ ((Seq c1 c2,s)#zs)\" and\n a0':\"s= s''\" and\n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = c\" and a2'':\"(c=Throw \\ c=Stuck \\ (\\f. c = Fault f))\" and\n a2':\"snd(last ((c1, s)#xs)) = s'\" and\n a3:\"(n,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift c2) xs)@((c, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call 0 \\ ((c, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call term_min_nested_call_0 a2' by metis\n then have p_q:\"p\\n \\ 0\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p 0 , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(0,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\0\")\n case True \n then have q_cptn_c1:\"(0, \\, (c1, s'') # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls a0' unfolding min_call_def \n by blast\n have q_cptn_c2:\"(0, \\, (c, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(0,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 a2' a0' a2'' CptnModNestSeq3[OF q_cptn_c1 _ ] \n by blast\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s'') # xs) \\ cptn_mod_nest_call\" \n using min_calls a0' unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 a0' a2' a2'' CptnModNestSeq3[OF q_cptn_c1]\n by blast\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ 0 \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_catch2:\n \"min_call n \\ ((Catch c1 c2,s)#zs) \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = c \\ (c=Skip \\ c=Stuck \\ (\\f. c = Fault f)) \\ \n (n,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((c, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ ((Catch c1 c2,s)#zs)\" and \n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = c\" and a2':\"(c=Skip \\ c=Stuck \\ (\\f. c = Fault f))\" and \n a3:\"(n,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift_catch c2) xs)@((c, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call 0 \\ ((c, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call term_min_nested_call_0 by metis\n then have p_q:\"p\\n \\ 0\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p 0 , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(0,\\,(c, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\0\")\n case True \n then have q_cptn_c1:\"(0, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(0, \\, (c, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(0,\\,((Catch c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 a2' CptnModNestCatch2[OF q_cptn_c1 ] \n by blast\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Catch c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 a2' CptnModNestCatch2[OF q_cptn_c1]\n by blast \n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ 0 \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_catch_less_eq_n:\n \"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys) \\\n p\\n \\ q\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_catch3:\n \"min_call n \\ ((Catch c1 c2, s)#zs) \\\n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Throw \\\n snd(last ((c1, s)#xs)) = s' \\\n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs) \\ min_call n \\ ((c2, snd(last ((c1, s)#xs)))#ys)\n \"\nproof -\n assume a0:\"min_call n \\ ((Catch c1 c2, s)#zs)\" and\n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = Throw\" and\n a2':\"snd(last ((c1, s)#xs)) = s'\" and\n a3:\"(n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift_catch c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p q where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call by blast\n then have p_q:\"p\\n \\ q\\n\" \n using a1 a2 a2' a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p q , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(q,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\q\")\n case True \n then have q_cptn_c1:\"(q, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(q, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(q,\\,((Catch c1 c2, s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a2' a4 CptnModNestCatch3[OF q_cptn_c1 a2 a2' q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Catch c1 c2, s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 CptnModNestCatch3[OF q_cptn_c1 a2 a2' q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ q \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_seq_c1_not_finish:\n \"min_call n \\ cfg \\\n cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1 \\\n (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs \\\n min_call n \\ ((P0, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ cfg\" and\n a1:\" cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1\" and\n a2:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and\n a3:\"(Q, t) # cfg1 = map (lift P1) xs\" \n then have \"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" using a2 by auto\n moreover have \"\\m,(P0, s)#xs) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, (P0, s) # xs) \\ cptn_mod_nest_call\"\n then have \"(m,\\,cfg) \\ cptn_mod_nest_call\" \n using a1 a3 CptnModNestSeq1[OF ass1] by auto\n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_seq_not_finish:\n \" min_call n \\ ((P0, s)#xs) \\\n cfg = (LanguageCon.com.Seq P0 P1, s) # cfg1 \\ \n cfg1 = map (lift P1) xs \\\n min_call n \\ cfg \n \"\nproof -\n assume a0:\"min_call n \\ ((P0, s)#xs)\" and\n a1:\" cfg = (LanguageCon.com.Seq P0 P1, s) # cfg1\" and \n a2:\" cfg1 = map (lift P1) xs\" \n then have \"(n, \\,cfg) \\ cptn_mod_nest_call\" \n using a0 a1 a2 CptnModNestSeq1[of n \\ P0 s xs \"cfg1\" P1] unfolding min_call_def \n by auto\n moreover have \"\\m,cfg) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, cfg) \\ cptn_mod_nest_call\"\n then have \"(m,\\,(P0, s)#xs) \\ cptn_mod_nest_call\" \n using a1 a2 by (metis (no_types) Seq_P_Not_finish div_seq_nest) \n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_catch_c1_not_finish:\n \"min_call n \\ cfg \\\n cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1 \\\n (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs \\\n min_call n \\ ((P0, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ cfg\" and\n a1:\" cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1\" and\n a2:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and\n a3:\"(Q, t) # cfg1 = map (lift_catch P1) xs\" \n then have \"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" using a2 by auto\n moreover have \"\\m,(P0, s)#xs) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, (P0, s) # xs) \\ cptn_mod_nest_call\"\n then have \"(m,\\,cfg) \\ cptn_mod_nest_call\" \n using a1 a3 CptnModNestCatch1[OF ass1] by auto\n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_catch_not_finish:\n \" min_call n \\ ((P0, s)#xs) \\\n cfg = (LanguageCon.com.Catch P0 P1, s) # cfg1 \\ \n cfg1 = map (lift_catch P1) xs \\\n min_call n \\ cfg \n \"\nproof -\n assume a0:\"min_call n \\ ((P0, s)#xs)\" and\n a1:\" cfg = (Catch P0 P1, s) # cfg1\" and \n a2:\" cfg1 = map (lift_catch P1) xs\" \n then have \"(n, \\,cfg) \\ cptn_mod_nest_call\" \n using a0 a1 a2 CptnModNestCatch1[of n \\ P0 s xs \"cfg1\" P1] unfolding min_call_def \n by auto\n moreover have \"\\m,cfg) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, cfg) \\ cptn_mod_nest_call\"\n then have \"(m,\\,(P0, s)#xs) \\ cptn_mod_nest_call\" \n using a1 a2 by (metis (no_types) Catch_P_Not_finish div_catch_nest) \n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma seq_xs_no_empty: assumes\n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\" and\n cfg:\"cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1\" and\n a0:\"SmallStepCon.redex (LanguageCon.com.Seq P0 P1) = LanguageCon.com.Call f\"\n shows\"\\Q' xs'. Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\nusing seq\nunfolding lift_def seq_cond_nest_def\nproof\n assume \"(Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs\"\n thus ?thesis by auto\nnext\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n (\\c. fst (((P0, s) # xs) ! length xs) = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P0, s) # xs)) = s' \\\n s = s'' \\ (\\ys. (n, \\, (c, s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (Seq P P1, s)) xs @(c, s') # ys))\"\n thus ?thesis\n proof \n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n show ?thesis \n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\"\n using prod.exhaust_sel by blast\n obtain pps where\n \"(Q, t) = (Seq a P1, b) \\ \n cfg1 = map (\\(c, y). (Seq c P1, y)) xsa @ \n (P1, snd (((P0, s) # xs) ! length xs)) # pps\" \n using ass local.Cons xa by moura \n then show ?thesis\n using local.Cons xa by auto\n qed \n next\n assume ass:\"\\c. fst (((P0, s) # xs) ! length xs) = c \\ (c = Throw \\ (\\f. c = Fault f) \\ c = Stuck) \\\n snd (last ((P0, s) # xs)) = s' \\\n s = s'' \\ (\\ys. (n, \\, (c, s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (Seq P P1, s)) xs @(c, s') # ys)\"\n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa) \n then obtain a b where xa:\"xa = (a,b)\" using prod.exhaust_sel Cons by blast\n obtain c where c:\" fst (((P0, s) # xs) ! length xs) = c \\\n (c = LanguageCon.com.Throw \\ (\\f. c = com.Fault f) \\ c = com.Stuck) \\\n snd (last ((P0, s) # xs)) = s' \\\n s = s'' \\\n (\\ys. (n, \\, (c, s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @ (c, s') # ys)\" \n using ass by fastforce\n then obtain pps where\n \"(Q, t) = (Seq a P1, b) \\ \n cfg1 = map (\\(c, y). (Seq c P1, y)) xsa @ (c, s') # pps\"\n using ass local.Cons xa by auto\n then show ?thesis\n using local.Cons xa by auto\n qed \n qed\nqed\n\nlemma catch_xs_no_empty: assumes\n seq:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\" and\n cfg:\"cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1\" and\n a0:\"SmallStepCon.redex (LanguageCon.com.Catch P0 P1) = LanguageCon.com.Call f\"\n shows\"\\Q' xs'. Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\nusing seq\nunfolding lift_catch_def catch_cond_nest_def\nproof\n assume \"(Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs\"\n thus ?thesis by auto\nnext\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = s' \\\n s = s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n (\\c. fst (((P0, s) # xs) ! length xs) = c \\ (c=Skip \\ (\\f. c = Fault f)\\ c=Stuck) \\\n (\\ys. (n, \\, (c, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (c, snd (last ((P0, s) # xs))) # ys))\"\n thus ?thesis\n proof \n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = s' \\\n s = s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n show ?thesis \n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\"\n using prod.exhaust_sel by blast \n obtain pps where\n \"(Q, t) = (Catch a P1, b) \\ \n cfg1 = map (\\(c, y). (Catch c P1, y)) xsa @ \n (P1, snd (((P0, s) # xs) ! length xs)) # pps\"\n using ass local.Cons xa by moura\n then show ?thesis\n using local.Cons xa by auto\n qed\n next\n assume ass:\"(\\c. fst (((P0, s) # xs) ! length xs) = c \\ (c=Skip \\ (\\f. c = Fault f)\\ c=Stuck) \\\n (\\ys. (n, \\, (c, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (c, snd (last ((P0, s) # xs))) # ys))\"\n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\" \n using prod.exhaust_sel by blast \n obtain c where \"fst (((P0, s) # xs) ! length xs) = c \\ (c=Skip \\ (\\f. c = Fault f)\\ c=Stuck) \\\n (\\ys. (n, \\, (c, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (c, snd (last ((P0, s) # xs))) # ys)\"\n using ass by auto\n then obtain pps where\n \"(Q, t) = (Catch a P1, b) \\ \n cfg1 = map (\\(c, y). (Catch c P1, y)) xsa @ (c, snd (last ((P0, s) # xs))) # pps\"\n using ass local.Cons xa by auto \n then show ?thesis\n using local.Cons xa by auto\n qed \n qed\nqed\n\nlemma redex_call_cptn_mod_min_nest_call_gr_zero:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"redex P = Call f \\ \n \\ f = Some bdy \\ t=s\" and\n a3:\"\\\\\\<^sub>c(P,toSeq s)\\(Q,toSeq t)\"\n shows \"n>0\"\nusing a0 a1 a2 a3\nproof (induct P arbitrary: Q cfg1 cfg s t n)\n case (Call f1)\n then show ?case using Call stepc_not_normal_elim_cases\n elim_cptn_mod_nest_call_n_greater_zero unfolding min_call_def\n by (metis SmallStepCon.redex.simps(7) option.distinct(1) )\nnext\n case (Seq P0 P1) \n then obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_seq_nest[of n \\ cfg] unfolding min_call_def by blast\n then obtain m where min:\"min_call m \\ ((P0, s)#xs)\"\n using minimum_nest_call by blast \n have xs':\"\\Q' xs'. Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\n using seq Seq seq_xs_no_empty\n by meson \n then have \"0,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_catch_nest[of n \\ cfg] unfolding min_call_def by blast\n then obtain m where min:\"min_call m \\ ((P0, s)#xs)\"\n using minimum_nest_call by blast \n obtain Q' xs' where xs':\"Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\n using catch_xs_no_empty[OF seq Catch(4)] Catch by blast\n then have \"0 cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"redex P = Call f \\ \n \\ f = Some bdy \\ (\\sa. s=Normal sa) \\ t=s \" and\n a3:\"biggest_nest_call P s ((Q,t)#cfg1) \\ n\" \n shows \"min_call n \\ ((Q,t)#cfg1)\"\nusing a0 a1 a2 a3 \nproof (induct P arbitrary: Q cfg1 cfg s t n) \n case Cond thus ?case by fastforce\nnext\n case (Seq P0 P1) \n then obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_seq_nest[of n \\ cfg] unfolding min_call_def by blast\n \n show ?case using seq unfolding seq_cond_nest_def \n proof\n assume ass:\"(Q, t) # cfg1 = map (lift P1) xs\" \n then obtain Q' xs' where xs':\"Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\n unfolding lift_def by fastforce\n then have ctpn_P0:\"(P0, s) # xs = (P0, s) # (Q', t) # xs'\" by auto\n then have min_p0:\"min_call n \\ ((P0, s)#xs)\"\n using min_call_seq_c1_not_finish[OF Seq(3) Seq(4) p0_cptn] ass by auto\n then have ex_xs:\"\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs\" \n using ass by auto\n then have min_xs:\"min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs\" \n using min_p0 ass by auto\n have \"xs= (SOME xs. (min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs))\"\n proof -\n have \"\\xsa. min_call n \\ ((P0, s)#xsa) \\ (Q, t) # cfg1 = map (lift P1) xsa \\ xsa = xs\"\n using xs' ass by (metis map_lift_eq_xs_xs')\n thus ?thesis using min_xs some_equality by (metis (mono_tags, lifting))\n qed\n then have big:\"biggest_nest_call P0 s ((Q', t) # xs') \\ n\" \n using biggest_nest_call.simps(1)[of P0 P1 s \"((Q, t) # cfg1)\" \\ n] \n Seq(6) xs' ex_xs by auto \n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Seq(5) xs' by auto \n have min_call:\"min_call n \\ ((Q', t) # xs')\" \n using Seq(1)[OF min_p0 ctpn_P0 reP0] big xs' ass by auto\n thus ?thesis using min_call_seq_not_finish[OF min_call] ass xs' by blast\n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys)\"\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n have ?thesis \n proof (cases xs)\n case Nil thus ?thesis using Seq ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n seq2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) (xa#xsa) @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n using ass by auto \n then obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using seq2_ass minimum_nest_call p0_cptn by fastforce \n then have mp: \"mq\\n \\ mp1 \\n\"\n using seq2_ass min_call_less_eq_n[of n \\ P0 s xs P1 ys mq mp1] \n Seq(3,4) p0_cptn by (simp add: last_length)\n have min_call:\"min_call n \\ ((P0, s) # xs) \\ \n min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using seq2_ass min_call_seq2[of n \\ P0 P1 s \"(Q, t) # cfg1\" xs ys] \n Seq(3,4) p0_cptn by (simp add: last_length local.Cons) \n from seq2_ass obtain Q' where Q':\"Q=Seq Q' P1 \\ xa=(Q',t)\" \n unfolding lift_def \n by (metis (mono_tags, lifting) fst_conv length_greater_0_conv \n list.simps(3) list.simps(9) nth_Cons_0 nth_append prod.case_eq_if prod.collapse snd_conv) \n then have q'_n_cptn:\"(n,\\,(Q',t)#xsa)\\cptn_mod_nest_call\" using p0_cptn Q' Cons\n using elim_cptn_mod_nest_call_n by blast \n show ?thesis\n proof(cases \"mp1=n\")\n case True\n then have \"min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using min_call_p1 by auto\n then have min_P1:\"min_call n \\ ((P1, snd ((xa # xsa) ! length xsa)) # ys)\"\n using Cons seq2_ass by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have False using min_P1 ass Q' Cons unfolding min_call_def\n proof -\n assume a1: \"(n, \\, (P1, snd ((xa # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\ (\\m, (P1, snd ((xa # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call)\"\n have f2: \"\\n f ps. (n, f, ps) \\ cptn_mod_nest_call \\ (\\x c ca psa. ps \\ (LanguageCon.com.Seq (c::('b, 'a, 'c,'d) LanguageCon.com) ca, x) # psa \\ (\\ps b ba. (n, f, (c, x) # ps) \\ cptn_mod_nest_call \\ seq_cond_nest psa ca ps c x ba b f n))\"\n using div_seq_nest by blast\n have f3: \"(P1, snd (last ((Q', t) # xsa))) # ys = (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n by (simp add: Q' last_length local.Cons)\n have \"fst (last ((Q', t) # xsa)) = LanguageCon.com.Skip\"\n by (metis (no_types) Q' last_ConsR last_length list.distinct(1) local.Cons seq2_ass)\n then show ?thesis\n using f3 f2 a1 by (metis (no_types) Cons_lift_append Q' Seq_P_Ends_Normal Q_m ass seq2_ass)\n qed\n } \n } then show ?thesis by auto\n qed \n ultimately show ?thesis unfolding min_call_def by auto\n next\n case False\n then have \"mp1 min_call n \\ ((P1, snd (last ((P0, s) # xs))) # ys)\"\n using min_call_p1 last_length unfolding min_call_def by metis\n then have min_call:\"min_call n \\ ((P0, s) # xs)\" \n using min_call last_length unfolding min_call_def by metis\n then have \"(P0, s) # xs = (P0, s) # xa#xsa\"\n using Cons by auto\n then have big:\"biggest_nest_call P0 s (((Q',t))#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs)\"\n using min_call seq2_ass Cons\n proof -\n have \"min_call n \\ ((LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1)\"\n using Seq.prems(1) Seq.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Seq_P_Not_finish append_Nil2 list.simps(3) \n local.Cons min_call_def same_append_eq seq seq2_ass)\n qed\n moreover have \"\\xs ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys\"\n using seq2_ass p0_cptn unfolding cond_seq_1_def \n by (metis last_length local.Cons) \n moreover have \"(SOME xs. \\ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = xs\" \n proof -\n let ?P = \"\\xsa. \\ys. (n, \\, (P0, s) # xsa) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xsa)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xsa @ (P1, snd (last ((P0, s) # xsa))) # ys\" \n have \"(\\x. \\ys. (n, \\, (P0, s) # x) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # x)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # x))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) x @ (P1, snd (last ((P0, s) # x))) # ys \\\n x = xs)\" \n by (metis Seq_P_Ends_Normal cptn_mod_nest_call.CptnModNestSeq2 seq)\n moreover have \"\\ys. (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n using ass p0_cptn by (simp add: last_length) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_seq_1_def by blast \n qed\n moreover have \"(SOME ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = ys\"\n proof -\n let ?P = \"\\ys. (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n have \"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n using p0_cptn seq2_ass Cons by (simp add: last_length) \n then show ?thesis using some_equality[of ?P ys]\n unfolding cond_seq_1_def by fastforce \n qed\n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using not_min_call_p1_n Seq(6) \n biggest_nest_call.simps(1)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed\n have C:\"(P0, s) # xs = (P0, s) # (Q', t) # xsa\" using Cons Q' by auto\n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s\" using Seq(5) Q' by auto\n then have min_call:\"min_call n \\ ((Q', t) # xsa)\" using Seq(1)[OF min_call C reP0 big]\n by auto\n have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"seq_cond_nest cfg1 P1 xsa' Q' t s1 s1' \\ m\"\n using div_seq_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n then have \"xsa=xsa'\" \n using seq2_ass \n Seq_P_Ends_Normal[of cfg1 P1 xsa Q' t ys m \\ xsa' s1 s1'] Cons\n by (metis Cons_lift_append Q' Q_m last.simps last_length list.inject list.simps(3)) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed\n \n ultimately show ?thesis unfolding min_call_def by auto\n qed \n qed\n }note l=this\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\ (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys)\" \n have ?thesis\n proof (cases \"\\\\\\<^sub>c(LanguageCon.com.Seq P0 P1, s) \\ (Q,t)\")\n case True \n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using Seq ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n seq2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\ (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys\"\n using ass by auto \n then have t_eq:\"t=Normal s''\" using Seq by fastforce\n obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((Throw, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using seq2_ass minimum_nest_call p0_cptn by (metis last_length)\n then have mp1_zero:\"mp1=0\" by (simp add: throw_min_nested_call_0)\n then have min_call: \"min_call n \\ ((P0, s) # xs)\" \n using seq2_ass min_call_seq3[of n \\ P0 P1 s \"(Q, t) # cfg1\" s'' xs s' ys]\n Seq(3,4) p0_cptn by (metis last_length) \n have n_z:\"n>0\" using redex_call_cptn_mod_min_nest_call_gr_zero[OF Seq(3) Seq(4) Seq(5) True]\n by auto \n from seq2_ass obtain Q' where Q':\"Q=Seq Q' P1 \\ xa=(Q',t)\" \n unfolding lift_def using Cons\n proof -\n assume a1: \"\\Q'. Q = LanguageCon.com.Seq Q' P1 \\ xa = (Q', t) \\ thesis\"\n have \"(LanguageCon.com.Seq (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n using seq2_ass unfolding lift_def\n by (simp add: Cons case_prod_unfold)\n then show ?thesis\n using a1 by fastforce\n qed \n have big_call:\"biggest_nest_call P0 s ((Q',t)#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs)\"\n using min_call seq2_ass Cons Seq.prems(1) Seq.prems(2)\n by (metis Seq_P_Not_finish append_Nil2 list.simps(3) min_call_def same_append_eq seq)\n moreover have \"\\(\\xs ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\" \n using min_call seq2_ass p0_cptn Cons Seq.prems(1) Seq.prems(2) \n unfolding cond_seq_1_def\n by (metis com.distinct(17) com.distinct(71) last_length \n map_lift_some_eq seq_and_if_not_eq(4))\n moreover have \"(SOME xs. \\ys s' s''. cond_seq_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = xs\"\n proof-\n let ?P=\"\\xsa. \\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#xs)) = Throw \\\n snd(last ((P0, s)#xs)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) xs)@((Throw,Normal s')#ys)\"\n have \"(\\x. \\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#x) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#x)) = Throw \\\n snd(last ((P0, s)#x)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) x)@((Throw,Normal s')#ys) \\\n x=xs)\" using map_lift_some_eq seq2_ass by fastforce\n moreover have \"\\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#xs)) = Throw \\\n snd(last ((P0, s)#xs)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) xs)@((Throw,Normal s')#ys)\" \n using ass p0_cptn by (simp add: last_length Cons)\n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_seq_2_def by blast\n qed\n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using Seq(6) \n biggest_nest_call.simps(1)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed \n have min_call:\"min_call n \\ ((Q',t)#xsa)\" \n using Seq(1)[OF min_call _ _ big_call] Seq(5) Cons Q' by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast \n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"seq_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using div_seq_nest[of m \\ \"(Q, t) # cfg1\"] Q' t_eq by blast\n then have \"xsa=xsa'\" \n using seq2_ass \n Seq_P_Ends_Abort[of cfg1 P1 xsa s' ys Q' s'' m \\ xsa' s1 s1' ] Cons Q' Q_m\n by (simp add: Cons_lift_append last_length t_eq) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed \n ultimately show ?thesis unfolding min_call_def by auto\n qed\n next\n case False \n then have env:\"\\\\\\<^sub>c(LanguageCon.com.Seq P0 P1, s) \\\\<^sub>e (Q,t)\" using Seq\n by (meson elim_cptn_mod_nest_step_c min_call_def)\n moreover then have Q:\"Q=Seq P0 P1\" using env_c_c' by blast \n ultimately show ?thesis using Seq\n proof -\n obtain nn :: \"(('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ \n ('a \\ ('b, 'a, 'c,'d) LanguageCon.com option) \\ nat \\ nat\" where\n f1: \"\\x0 x1 x2. (\\v3 cptn_mod_nest_call) = (nn x0 x1 x2 < x2 \\ (nn x0 x1 x2, x1, x0) \\ cptn_mod_nest_call)\"\n by moura\n have f2: \"(n, \\, (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call \\ (\\n. \\ n < n \\ (n, \\, (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n using local.Seq(3) local.Seq(4) min_call_def by blast\n then have \"\\ nn ((Q, t) # cfg1) \\ n < n \\ (nn ((Q, t) # cfg1) \\ n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using False env env_c_c' not_func_redex_cptn_mod_nest_n_env \n by (metis Seq.prems(1) Seq.prems(2) min_call_def)\n then show ?thesis\n using f2 f1 by (meson elim_cptn_mod_nest_call_n min_call_def)\n qed\n qed \n }\n thus ?thesis using l ass by fastforce\n qed\nnext\n case (Catch P0 P1) \nthen obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n catch:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_catch_nest[of n \\ cfg] unfolding min_call_def by blast\n \n show ?case using catch unfolding catch_cond_nest_def \n proof\n assume ass:\"(Q, t) # cfg1 = map (lift_catch P1) xs\" \n then obtain Q' xs' where xs':\"Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\n unfolding lift_catch_def by fastforce\n then have ctpn_P0:\"(P0, s) # xs = (P0, s) # (Q', t) # xs'\" by auto\n then have min_p0:\"min_call n \\ ((P0, s)#xs)\"\n using min_call_catch_c1_not_finish[OF Catch(3) Catch(4) p0_cptn] ass by auto\n then have ex_xs:\"\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs\" \n using ass by auto\n then have min_xs:\"min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs\" \n using min_p0 ass by auto\n have \"xs= (SOME xs. (min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs))\"\n proof -\n have \"\\xsa. min_call n \\ ((P0, s)#xsa) \\ (Q, t) # cfg1 = map (lift_catch P1) xsa \\ xsa = xs\"\n using xs' ass by (metis map_lift_catch_eq_xs_xs')\n thus ?thesis using min_xs some_equality by (metis (mono_tags, lifting))\n qed\n then have big:\"biggest_nest_call P0 s ((Q', t) # xs') \\ n\" \n using biggest_nest_call.simps(2)[of P0 P1 s \"((Q, t) # cfg1)\" \\ n] \n Catch(6) xs' ex_xs by auto \n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Catch(5) xs' by auto \n have min_call:\"min_call n \\ ((Q', t) # xs')\" \n using Catch(1)[OF min_p0 ctpn_P0 reP0] big xs' ass by auto\n thus ?thesis using min_call_catch_not_finish[OF min_call] ass xs' by blast\n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\" \n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n have ?thesis \n proof (cases xs)\n case Nil thus ?thesis using Catch ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n catch2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n using ass by auto \n then obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using catch2_ass minimum_nest_call p0_cptn by fastforce \n then have mp: \"mq\\n \\ mp1 \\n\"\n using catch2_ass min_call_less_eq_n \n Catch(3,4) p0_cptn by (metis last_length) \n have min_call:\"min_call n \\ ((P0, s) # xs) \\ \n min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using catch2_ass min_call_catch3[of n \\ P0 P1 s'' \"(Q, t) # cfg1\" xs s' ys] \n Catch(3,4) p0_cptn by (metis last_length) \n from catch2_ass obtain Q' where Q':\"Q=Catch Q' P1 \\ xa=(Q',t)\" \n unfolding lift_catch_def\n proof -\n assume a1: \"\\Q'. Q = LanguageCon.com.Catch Q' P1 \\ xa = (Q', t) \\ thesis\"\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\ snd (last ((P0, s) # xs)) = Normal s' \\ s = Normal s'' \\ (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\ (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n then have \"(LanguageCon.com.Catch (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n by (simp add: local.Cons prod.case_eq_if)\n then show ?thesis\n using a1 by force\n qed \n then have q'_n_cptn:\"(n,\\,(Q',t)#xsa)\\cptn_mod_nest_call\" using p0_cptn Q' Cons\n using elim_cptn_mod_nest_call_n by blast \n show ?thesis\n proof(cases \"mp1=n\")\n case True\n then have \"min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using min_call_p1 by auto\n then have min_P1:\"min_call n \\ ((P1, snd ((xa # xsa) ! length xsa)) # ys)\"\n using Cons catch2_ass by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have t_eq_s:\"t=Normal s''\" using Catch catch2_ass by fastforce \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n catch_cond:\"catch_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using Q_m div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n have fst:\"fst (last ((Q', Normal s'') # xsa)) = LanguageCon.com.Throw\" \n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have cfg:\"cfg1 = map (lift_catch P1) xsa @ (P1, snd (last ((Q', Normal s'') # xsa))) # ys\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have snd:\"snd (last ((Q', Normal s'') # xsa)) = Normal s'\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n then have \"xsa=xsa' \\ \n (m, \\, (P1, snd (((Q', Normal s'') # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call\" \n using catch2_ass Catch_P_Ends_Normal[OF cfg fst snd catch_cond] Cons\n by auto \n then have False using min_P1 ass Q' t_eq_s unfolding min_call_def by auto \n } \n } then show ?thesis by auto\n qed \n ultimately show ?thesis unfolding min_call_def by auto\n next\n case False\n then have \"mp1 min_call n \\ ((P1, snd (last ((P0, s) # xs))) # ys)\"\n using min_call_p1 last_length unfolding min_call_def by metis\n then have min_call:\"min_call n \\ ((P0, s) # xs)\" \n using min_call last_length unfolding min_call_def by metis\n then have \"(P0, s) # xs = (P0, s) # xa#xsa\"\n using Cons by auto\n then have big:\"biggest_nest_call P0 s (((Q',t))#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs)\"\n using min_call catch2_ass Cons\n proof -\n have \"min_call n \\ ((Catch P0 P1, s) # (Q, t) # cfg1)\"\n using Catch.prems(1) Catch.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Catch_P_Not_finish append_Nil2 list.simps(3) \n same_append_eq catch catch2_ass)\n qed\n moreover have \"\\(\\xs ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\"\n unfolding cond_catch_1_def using catch2_ass \n by (metis Catch_P_Ends_Skip LanguageCon.com.distinct(17) catch last_length)\n moreover have \"\\xs ys. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s''\"\n using catch2_ass p0_cptn unfolding cond_catch_2_def last_length\n by metis \n moreover have \"(SOME xs. \\ys s' s''. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = xs\" \n proof -\n let ?P = \"\\xsa. s = Normal s'' \\\n (n, \\, (P0, s) # xsa) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xsa)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xsa)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xsa @ (P1, Normal s') # ys\" \n have \"(\\x. \\ys s' s''. s = Normal s'' \\\n (n, \\, (P0, s) # x) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # x)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # x)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) x @ (P1, Normal s') # ys \\\n x = xs)\" \n by (metis Catch_P_Ends_Normal catch)\n moreover have \"\\ys. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ys\"\n using ass p0_cptn by (metis (full_types) last_length ) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_catch_2_def by blast \n qed\n moreover have \"(SOME ys. \\s' s''. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = ys\"\n proof -\n let ?P = \"\\ysa. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ysa) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ysa\"\n have \"(\\x. \\s' s''. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # x) \\ cptn_mod_nest_call \\ (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # x \\\n x = ys)\" using catch2_ass by auto \n moreover have \"s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ys\"\n using ass p0_cptn by (metis (full_types) catch2_ass last_length p0_cptn) \n ultimately show ?thesis using some_equality[of ?P ys]\n unfolding cond_catch_2_def by blast\n qed \n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using not_min_call_p1_n Catch(6) \n biggest_nest_call.simps(2)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed\n have C:\"(P0, s) # xs = (P0, s) # (Q', t) # xsa\" using Cons Q' by auto\n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Catch(5) Q' by auto\n then have min_call:\"min_call n \\ ((Q', t) # xsa)\" using Catch(1)[OF min_call C reP0 big]\n by auto\n have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have t_eq_s:\"t=Normal s''\" using Catch catch2_ass by fastforce\n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n catch_cond:\"catch_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using Q_m div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n have fst:\"fst (last ((Q', Normal s'') # xsa)) = LanguageCon.com.Throw\" \n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have cfg:\"cfg1 = map (lift_catch P1) xsa @ (P1, snd (last ((Q', Normal s'') # xsa))) # ys\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have snd:\"snd (last ((Q', Normal s'') # xsa)) = Normal s'\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n then have \"xsa=xsa'\" \n using catch2_ass Catch_P_Ends_Normal[OF cfg fst snd catch_cond] Cons\n by auto \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed\n ultimately show ?thesis unfolding min_call_def by auto\n qed \n qed\n }note l=this\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\"\n have ?thesis\n proof (cases \"\\\\\\<^sub>c(Catch P0 P1, s) \\ (Q,t)\")\n case True \n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using Catch ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n catch2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys\"\n using ass by auto \n then have t_eq:\"t=s\" using Catch by fastforce\n obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((Skip, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using catch2_ass minimum_nest_call p0_cptn by (metis last_length)\n then have mp1_zero:\"mp1=0\" by (simp add: skip_min_nested_call_0)\n then have min_call: \"min_call n \\ ((P0, s) # xs)\" \n using catch2_ass min_call_catch2[of n \\ P0 P1 s \"(Q, t) # cfg1\" xs ys]\n Catch(3,4) p0_cptn by (metis last_length) \n have n_z:\"n>0\" using redex_call_cptn_mod_min_nest_call_gr_zero[OF Catch(3) Catch(4) Catch(5) True]\n by auto \n from catch2_ass obtain Q' where Q':\"Q=Catch Q' P1 \\ xa=(Q',t)\" \n unfolding lift_catch_def using Cons\n proof -\n assume a1: \"\\Q'. Q = Catch Q' P1 \\ xa = (Q', t) \\ thesis\"\n have \"(Catch (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n using catch2_ass unfolding lift_catch_def\n by (simp add: Cons case_prod_unfold)\n then show ?thesis\n using a1 by fastforce\n qed \n have big_call:\"biggest_nest_call P0 s ((Q',t)#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs)\"\n using min_call catch2_ass Cons\n proof -\n have \"min_call n \\ ((Catch P0 P1, s) # (Q, t) # cfg1)\"\n using Catch.prems(1) Catch.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Catch_P_Not_finish append_Nil2 list.simps(3) \n same_append_eq catch catch2_ass)\n qed\n moreover have \"(\\xs ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\"\n using catch2_ass p0_cptn unfolding cond_catch_1_def last_length\n by metis\n moreover have \"(SOME xs. \\ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = xs\"\n proof -\n let ?P = \"\\xsa. \\ys. (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xsa @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xsa))) # ys\"\n have \"\\xsa. \\ys. (n, \\,(P0, s)#xsa) \\ cptn_mod_nest_call \\ \n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xsa @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xsa))) # ys \\\n xsa = xs\"\n using Catch_P_Ends_Skip catch catch2_ass map_lift_catch_some_eq by fastforce \n moreover have \"\\ys. (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys\" \n using ass p0_cptn by (simp add: last_length) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_catch_1_def by blast \n qed \n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using Catch(6) \n biggest_nest_call.simps(2)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed \n have min_call:\"min_call n \\ ((Q',t)#xsa)\" \n using Catch(1)[OF min_call _ _ big_call] Catch(5) Cons Q' by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast \n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"catch_cond_nest cfg1 P1 xsa' Q' t s1 s1' \\ m\"\n using div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' t_eq by blast\n then have \"xsa=xsa'\" \n using catch2_ass \n Catch_P_Ends_Skip[of cfg1 P1 xsa Q' t ys xsa' s1 s1'] \n Cons Q' Q_m \n by (simp add: last_length) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed \n ultimately show ?thesis unfolding min_call_def by auto\n qed\n next\n case False \n then have env:\"\\\\\\<^sub>c(Catch P0 P1, s) \\\\<^sub>e (Q,t)\" using Catch\n by (meson elim_cptn_mod_nest_step_c min_call_def)\n moreover then have Q:\"Q=Catch P0 P1\" using env_c_c' by blast \n ultimately show ?thesis using Catch\n proof -\n obtain nn :: \"(('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ ('a \\ ('b, 'a, 'c,'d) LanguageCon.com option) \\ nat \\ nat\" where\n f1: \"\\x0 x1 x2. (\\v3 cptn_mod_nest_call) = (nn x0 x1 x2 < x2 \\ (nn x0 x1 x2, x1, x0) \\ cptn_mod_nest_call)\"\n by moura\n have f2: \"(n, \\, (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call \\ (\\n. \\ n < n \\ (n, \\, (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n using local.Catch(3) local.Catch(4) min_call_def by blast\n then have \"\\ nn ((Q, t) # cfg1) \\ n < n \\ (nn ((Q, t) # cfg1) \\ n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using False env env_c_c' not_func_redex_cptn_mod_nest_n_env \n by (metis Catch.prems(1) Catch.prems(2) min_call_def)\n then show ?thesis\n using f2 f1 by (meson elim_cptn_mod_nest_call_n min_call_def)\n qed\n qed \n }\n thus ?thesis using l ass by fastforce\n qed \nqed (fastforce)+\n*)\n\nlemma cptn_mod_nest_n_1:\n assumes a0:\"(n,\\,cfs) \\ cptn_mod_nest_call\" and\n a1:\"cfs=(p,s)#cfs'\" and\n a2:\"\\ (min_call n \\ cfs)\"\n shows \"(n-1,\\,cfs) \\ cptn_mod_nest_call\"\nusing a0 a1 a2 \nby (metis (no_types, lifting) Suc_diff_1 Suc_leI cptn_mod_nest_mono less_nat_zero_code min_call_def not_less)\n\nlemma cptn_mod_nest_tl_n_1:\n assumes a0:\"(n,\\,cfs) \\ cptn_mod_nest_call\" and\n a1:\"cfs=(p,s)#(q,t)#cfs'\" and\n a2:\"\\ (min_call n \\ cfs)\"\n shows \"(n-1,\\,(q,t)#cfs') \\ cptn_mod_nest_call\"\n using a0 a1 a2\nby (meson elim_cptn_mod_nest_call_n cptn_mod_nest_n_1) \n\nlemma cptn_mod_nest_tl_not_min:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg=(p,s)#cfg'\" and\n a2:\"\\ (min_call n \\ cfg)\"\n shows \"\\ (min_call n \\ cfg')\"\nproof (cases cfg')\n case Nil \n have \"(\\, []) \\ cptn\"\n using cptn.simps by blast\n then show ?thesis unfolding min_call_def\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod local.Nil by blast \nnext\n case (Cons xa cfga)\n then obtain q t where \"xa = (q,t)\" \n using prod.exhaust_sel by blast\n then have \"(n-1,\\,cfg') \\ cptn_mod_nest_call\"\n using a0 a1 a2 cptn_mod_nest_tl_n_1 Cons by blast\n also then have \"(n,\\,cfg') \\ cptn_mod_nest_call\"\n using cptn_mod_nest_mono Nat.diff_le_self by blast\n ultimately show ?thesis unfolding min_call_def\n using a0 a2 min_call_def by force \nqed\n\ndefinition cp :: \"('g\\'l,'p,'f,'e) body \\ ('g\\'l,'p,'f,'e)com \\\n ('g\\'l)\\('l list) \\ (('g,'l,'p,'f,'e) confs) set\" where\n \"cp \\ P s \\ {(\\1,l). l!0=(P,s) \\ (\\,l) \\ cptn \\ \\1=\\}\" \n\n \n\nlemma cp_sub: \n assumes a0: \"(\\,(x#l0)@l1) \\ cp \\ P s\"\n shows \"(\\,(x#l0)) \\ cp \\ P s\"\nproof -\n have \"(x#l0)!0 = (P,s)\" using a0 unfolding cp_def by auto\n also have \"(\\,(x#l0))\\cptn\" using a0 unfolding cp_def\n using cptn_dest_2 by fastforce\n ultimately show ?thesis using a0 unfolding cp_def by blast\nqed\n\n\ndefinition cpn :: \"nat \\ ('g\\'l,'p,'f,'e) body \\ ('g\\'l,'p,'f,'e)com \\ \n ('g\\'l)\\('l list) \\ (('g,'l,'p,'f,'e) confs) set\" \nwhere\n \"cpn n \\ P s \\ {(\\1,l). l!0=(P,s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\1=\\}\"\n\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/ComputationCon.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2948981631986741}} {"text": "section \\Generation of Verification Conditions\\\n\ntheory OG_Tactics\nimports OG_Hoare\nbegin\n\nlemmas ann_hoare_intros=AnnBasic AnnSeq AnnCond1 AnnCond2 AnnWhile AnnAwait AnnConseq\nlemmas oghoare_intros=Parallel Basic Seq Cond While Conseq\n\nlemma ParallelConseqRule:\n \"\\ p \\ (\\i\\{i. i- (\\i\\{i. ii\\{i. ii\\{i. i q \\\n \\ \\- p (Parallel Ts) q\"\napply (rule Conseq)\nprefer 2\n apply fast\napply assumption+\ndone\n\nlemma SkipRule: \"p \\ q \\ \\- p (Basic id) q\"\napply(rule oghoare_intros)\n prefer 2 apply(rule Basic)\n prefer 2 apply(rule subset_refl)\napply(simp add:Id_def)\ndone\n\nlemma BasicRule: \"p \\ {s. (f s)\\q} \\ \\- p (Basic f) q\"\napply(rule oghoare_intros)\n prefer 2 apply(rule oghoare_intros)\n prefer 2 apply(rule subset_refl)\napply assumption\ndone\n\nlemma SeqRule: \"\\ \\- p c1 r; \\- r c2 q \\ \\ \\- p (Seq c1 c2) q\"\napply(rule Seq)\napply fast+\ndone\n\nlemma CondRule:\n \"\\ p \\ {s. (s\\b \\ s\\w) \\ (s\\b \\ s\\w')}; \\- w c1 q; \\- w' c2 q \\\n \\ \\- p (Cond b c1 c2) q\"\napply(rule Cond)\n apply(rule Conseq)\n prefer 4 apply(rule Conseq)\napply simp_all\napply force+\ndone\n\nlemma WhileRule: \"\\ p \\ i; \\- (i \\ b) c i ; (i \\ (-b)) \\ q \\\n \\ \\- p (While b i c) q\"\napply(rule Conseq)\n prefer 2 apply(rule While)\napply assumption+\ndone\n\ntext \\Three new proof rules for special instances of the \\AnnBasic\\ and the \\AnnAwait\\ commands when the transformation\nperformed on the state is the identity, and for an \\AnnAwait\\\ncommand where the boolean condition is \\{s. True}\\:\\\n\nlemma AnnatomRule:\n \"\\ atom_com(c); \\- r c q \\ \\ \\ (AnnAwait r {s. True} c) q\"\napply(rule AnnAwait)\napply simp_all\ndone\n\nlemma AnnskipRule:\n \"r \\ q \\ \\ (AnnBasic r id) q\"\napply(rule AnnBasic)\napply simp\ndone\n\nlemma AnnwaitRule:\n \"\\ (r \\ b) \\ q \\ \\ \\ (AnnAwait r b (Basic id)) q\"\napply(rule AnnAwait)\n apply simp\napply(rule BasicRule)\napply simp\ndone\n\ntext \\Lemmata to avoid using the definition of \\map_ann_hoare\\, \\interfree_aux\\, \\interfree_swap\\ and\n\\interfree\\ by splitting it into different cases:\\\n\nlemma interfree_aux_rule1: \"interfree_aux(co, q, None)\"\nby(simp add:interfree_aux_def)\n\nlemma interfree_aux_rule2:\n \"\\(R,r)\\(atomics a). \\- (q \\ R) r q \\ interfree_aux(None, q, Some a)\"\napply(simp add:interfree_aux_def)\napply(force elim:oghoare_sound)\ndone\n\nlemma interfree_aux_rule3:\n \"(\\(R, r)\\(atomics a). \\- (q \\ R) r q \\ (\\p\\(assertions c). \\- (p \\ R) r p))\n \\ interfree_aux(Some c, q, Some a)\"\napply(simp add:interfree_aux_def)\napply(force elim:oghoare_sound)\ndone\n\nlemma AnnBasic_assertions:\n \"\\interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)\\ \\\n interfree_aux(Some (AnnBasic r f), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnSeq_assertions:\n \"\\ interfree_aux(Some c1, q, Some a); interfree_aux(Some c2, q, Some a)\\\\\n interfree_aux(Some (AnnSeq c1 c2), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond1_assertions:\n \"\\ interfree_aux(None, r, Some a); interfree_aux(Some c1, q, Some a);\n interfree_aux(Some c2, q, Some a)\\\\\n interfree_aux(Some(AnnCond1 r b c1 c2), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond2_assertions:\n \"\\ interfree_aux(None, r, Some a); interfree_aux(Some c, q, Some a)\\\\\n interfree_aux(Some (AnnCond2 r b c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnWhile_assertions:\n \"\\ interfree_aux(None, r, Some a); interfree_aux(None, i, Some a);\n interfree_aux(Some c, q, Some a)\\\\\n interfree_aux(Some (AnnWhile r b i c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnAwait_assertions:\n \"\\ interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)\\\\\n interfree_aux(Some (AnnAwait r b c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnBasic_atomics:\n \"\\- (q \\ r) (Basic f) q \\ interfree_aux(None, q, Some (AnnBasic r f))\"\nby(simp add: interfree_aux_def oghoare_sound)\n\nlemma AnnSeq_atomics:\n \"\\ interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)\\\\\n interfree_aux(Any, q, Some (AnnSeq a1 a2))\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond1_atomics:\n \"\\ interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)\\\\\n interfree_aux(Any, q, Some (AnnCond1 r b a1 a2))\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond2_atomics:\n \"interfree_aux (Any, q, Some a)\\ interfree_aux(Any, q, Some (AnnCond2 r b a))\"\nby(simp add: interfree_aux_def)\n\nlemma AnnWhile_atomics: \"interfree_aux (Any, q, Some a)\n \\ interfree_aux(Any, q, Some (AnnWhile r b i a))\"\nby(simp add: interfree_aux_def)\n\nlemma Annatom_atomics:\n \"\\- (q \\ r) a q \\ interfree_aux (None, q, Some (AnnAwait r {x. True} a))\"\nby(simp add: interfree_aux_def oghoare_sound)\n\nlemma AnnAwait_atomics:\n \"\\- (q \\ (r \\ b)) a q \\ interfree_aux (None, q, Some (AnnAwait r b a))\"\nby(simp add: interfree_aux_def oghoare_sound)\n\ndefinition interfree_swap :: \"('a ann_triple_op * ('a ann_triple_op) list) \\ bool\" where\n \"interfree_swap == \\(x, xs). \\y\\set xs. interfree_aux (com x, post x, com y)\n \\ interfree_aux(com y, post y, com x)\"\n\nlemma interfree_swap_Empty: \"interfree_swap (x, [])\"\nby(simp add:interfree_swap_def)\n\nlemma interfree_swap_List:\n \"\\ interfree_aux (com x, post x, com y);\n interfree_aux (com y, post y ,com x); interfree_swap (x, xs) \\\n \\ interfree_swap (x, y#xs)\"\nby(simp add:interfree_swap_def)\n\nlemma interfree_swap_Map: \"\\k. i\\k \\ k interfree_aux (com x, post x, c k)\n \\ interfree_aux (c k, Q k, com x)\n \\ interfree_swap (x, map (\\k. (c k, Q k)) [i.. interfree_swap(x, xs); interfree xs \\ \\ interfree (x#xs)\"\napply(simp add:interfree_def interfree_swap_def)\napply clarify\napply(case_tac i)\n apply(case_tac j)\n apply simp_all\napply(case_tac j,simp+)\ndone\n\nlemma interfree_Map:\n \"(\\i j. a\\i \\ i a\\j \\ j i\\j \\ interfree_aux (c i, Q i, c j))\n \\ interfree (map (\\k. (c k, Q k)) [a.. bool \" (\"[\\] _\" [0] 45) where\n \"[\\] Ts == (\\ic q. Ts!i=(Some c, q) \\ \\ c q)\"\n\nlemma MapAnnEmpty: \"[\\] []\"\nby(simp add:map_ann_hoare_def)\n\nlemma MapAnnList: \"\\ \\ c q ; [\\] xs \\ \\ [\\] (Some c,q)#xs\"\napply(simp add:map_ann_hoare_def)\napply clarify\napply(case_tac i,simp+)\ndone\n\nlemma MapAnnMap:\n \"\\k. i\\k \\ k \\ (c k) (Q k) \\ [\\] map (\\k. (Some (c k), Q k)) [i.. [\\] Ts ; interfree Ts \\\n \\ \\- (\\i\\{i. ii\\{i. i \\k (c k) (Q k);\n \\k l. k l k\\l \\ interfree_aux (Some(c k), Q k, Some(c l)) \\\n \\ \\- (\\i\\{i. iii\\{i. iThe following are some useful lemmas and simplification\ntactics to control which theorems are used to simplify at each moment,\nso that the original input does not suffer any unexpected\ntransformation.\\\n\nlemma Compl_Collect: \"-(Collect b) = {x. \\(b x)}\"\n by fast\n\nlemma list_length: \"length []=0\" \"length (x#xs) = Suc(length xs)\"\n by simp_all\nlemma list_lemmas: \"length []=0\" \"length (x#xs) = Suc(length xs)\"\n \"(x#xs) ! 0 = x\" \"(x#xs) ! Suc n = xs ! n\"\n by simp_all\nlemma le_Suc_eq_insert: \"{i. i \nfun before_interfree_simp_tac ctxt =\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps [@{thm com.simps}, @{thm post.simps}])\n\nfun interfree_simp_tac ctxt =\n asm_simp_tac (put_simpset HOL_ss ctxt\n addsimps [@{thm split}, @{thm ball_Un}, @{thm ball_empty}] @ @{thms my_simp_list})\n\nfun ParallelConseq ctxt =\n simp_tac (put_simpset HOL_basic_ss ctxt\n addsimps @{thms ParallelConseq_list} @ @{thms my_simp_list})\n\\\n\ntext \\The following tactic applies \\tac\\ to each conjunct in a\nsubgoal of the form \\A \\ a1 \\ a2 \\ .. \\ an\\ returning\n\\n\\ subgoals, one for each conjunct:\\\n\nML \\\nfun conjI_Tac ctxt tac i st = st |>\n ( (EVERY [resolve_tac ctxt [conjI] i,\n conjI_Tac ctxt tac (i+1),\n tac i]) ORELSE (tac i) )\n\\\n\n\nsubsubsection \\Tactic for the generation of the verification conditions\\\n\ntext \\The tactic basically uses two subtactics:\n\n\\begin{description}\n\n\\item[HoareRuleTac] is called at the level of parallel programs, it\n uses the ParallelTac to solve parallel composition of programs.\n This verification has two parts, namely, (1) all component programs are\n correct and (2) they are interference free. \\HoareRuleTac\\ is\n also called at the level of atomic regions, i.e. \\\\ \\\\ and\n \\AWAIT b THEN _ END\\, and at each interference freedom test.\n\n\\item[AnnHoareRuleTac] is for component programs which\n are annotated programs and so, there are not unknown assertions\n (no need to use the parameter precond, see NOTE).\n\n NOTE: precond(::bool) informs if the subgoal has the form \\\\- ?p c q\\,\n in this case we have precond=False and the generated verification\n condition would have the form \\?p \\ \\\\ which can be solved by\n \\rtac subset_refl\\, if True we proceed to simplify it using\n the simplification tactics above.\n\n\\end{description}\n\\\n\nML \\\n\nfun WlpTac ctxt i = resolve_tac ctxt @{thms SeqRule} i THEN HoareRuleTac ctxt false (i + 1)\nand HoareRuleTac ctxt precond i st = st |>\n ( (WlpTac ctxt i THEN HoareRuleTac ctxt precond i)\n ORELSE\n (FIRST[resolve_tac ctxt @{thms SkipRule} i,\n resolve_tac ctxt @{thms BasicRule} i,\n EVERY[resolve_tac ctxt @{thms ParallelConseqRule} i,\n ParallelConseq ctxt (i+2),\n ParallelTac ctxt (i+1),\n ParallelConseq ctxt i],\n EVERY[resolve_tac ctxt @{thms CondRule} i,\n HoareRuleTac ctxt false (i+2),\n HoareRuleTac ctxt false (i+1)],\n EVERY[resolve_tac ctxt @{thms WhileRule} i,\n HoareRuleTac ctxt true (i+1)],\n K all_tac i ]\n THEN (if precond then (K all_tac i) else resolve_tac ctxt @{thms subset_refl} i)))\n\nand AnnWlpTac ctxt i = resolve_tac ctxt @{thms AnnSeq} i THEN AnnHoareRuleTac ctxt (i + 1)\nand AnnHoareRuleTac ctxt i st = st |>\n ( (AnnWlpTac ctxt i THEN AnnHoareRuleTac ctxt i )\n ORELSE\n (FIRST[(resolve_tac ctxt @{thms AnnskipRule} i),\n EVERY[resolve_tac ctxt @{thms AnnatomRule} i,\n HoareRuleTac ctxt true (i+1)],\n (resolve_tac ctxt @{thms AnnwaitRule} i),\n resolve_tac ctxt @{thms AnnBasic} i,\n EVERY[resolve_tac ctxt @{thms AnnCond1} i,\n AnnHoareRuleTac ctxt (i+3),\n AnnHoareRuleTac ctxt (i+1)],\n EVERY[resolve_tac ctxt @{thms AnnCond2} i,\n AnnHoareRuleTac ctxt (i+1)],\n EVERY[resolve_tac ctxt @{thms AnnWhile} i,\n AnnHoareRuleTac ctxt (i+2)],\n EVERY[resolve_tac ctxt @{thms AnnAwait} i,\n HoareRuleTac ctxt true (i+1)],\n K all_tac i]))\n\nand ParallelTac ctxt i = EVERY[resolve_tac ctxt @{thms ParallelRule} i,\n interfree_Tac ctxt (i+1),\n MapAnn_Tac ctxt i]\n\nand MapAnn_Tac ctxt i st = st |>\n (FIRST[resolve_tac ctxt @{thms MapAnnEmpty} i,\n EVERY[resolve_tac ctxt @{thms MapAnnList} i,\n MapAnn_Tac ctxt (i+1),\n AnnHoareRuleTac ctxt i],\n EVERY[resolve_tac ctxt @{thms MapAnnMap} i,\n resolve_tac ctxt @{thms allI} i,\n resolve_tac ctxt @{thms impI} i,\n AnnHoareRuleTac ctxt i]])\n\nand interfree_swap_Tac ctxt i st = st |>\n (FIRST[resolve_tac ctxt @{thms interfree_swap_Empty} i,\n EVERY[resolve_tac ctxt @{thms interfree_swap_List} i,\n interfree_swap_Tac ctxt (i+2),\n interfree_aux_Tac ctxt (i+1),\n interfree_aux_Tac ctxt i ],\n EVERY[resolve_tac ctxt @{thms interfree_swap_Map} i,\n resolve_tac ctxt @{thms allI} i,\n resolve_tac ctxt @{thms impI} i,\n conjI_Tac ctxt (interfree_aux_Tac ctxt) i]])\n\nand interfree_Tac ctxt i st = st |>\n (FIRST[resolve_tac ctxt @{thms interfree_Empty} i,\n EVERY[resolve_tac ctxt @{thms interfree_List} i,\n interfree_Tac ctxt (i+1),\n interfree_swap_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms interfree_Map} i,\n resolve_tac ctxt @{thms allI} i,\n resolve_tac ctxt @{thms allI} i,\n resolve_tac ctxt @{thms impI} i,\n interfree_aux_Tac ctxt i ]])\n\nand interfree_aux_Tac ctxt i = (before_interfree_simp_tac ctxt i ) THEN\n (FIRST[resolve_tac ctxt @{thms interfree_aux_rule1} i,\n dest_assertions_Tac ctxt i])\n\nand dest_assertions_Tac ctxt i st = st |>\n (FIRST[EVERY[resolve_tac ctxt @{thms AnnBasic_assertions} i,\n dest_atomics_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnSeq_assertions} i,\n dest_assertions_Tac ctxt (i+1),\n dest_assertions_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnCond1_assertions} i,\n dest_assertions_Tac ctxt (i+2),\n dest_assertions_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnCond2_assertions} i,\n dest_assertions_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnWhile_assertions} i,\n dest_assertions_Tac ctxt (i+2),\n dest_atomics_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnAwait_assertions} i,\n dest_atomics_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n dest_atomics_Tac ctxt i])\n\nand dest_atomics_Tac ctxt i st = st |>\n (FIRST[EVERY[resolve_tac ctxt @{thms AnnBasic_atomics} i,\n HoareRuleTac ctxt true i],\n EVERY[resolve_tac ctxt @{thms AnnSeq_atomics} i,\n dest_atomics_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnCond1_atomics} i,\n dest_atomics_Tac ctxt (i+1),\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnCond2_atomics} i,\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms AnnWhile_atomics} i,\n dest_atomics_Tac ctxt i],\n EVERY[resolve_tac ctxt @{thms Annatom_atomics} i,\n HoareRuleTac ctxt true i],\n EVERY[resolve_tac ctxt @{thms AnnAwait_atomics} i,\n HoareRuleTac ctxt true i],\n K all_tac i])\n\\\n\n\ntext \\The final tactic is given the name \\oghoare\\:\\\n\nML \\\nfun oghoare_tac ctxt = SUBGOAL (fn (_, i) => HoareRuleTac ctxt true i)\n\\\n\ntext \\Notice that the tactic for parallel programs \\oghoare_tac\\ is initially invoked with the value \\true\\ for\nthe parameter \\precond\\.\n\nParts of the tactic can be also individually used to generate the\nverification conditions for annotated sequential programs and to\ngenerate verification conditions out of interference freedom tests:\\\n\nML \\\nfun annhoare_tac ctxt = SUBGOAL (fn (_, i) => AnnHoareRuleTac ctxt i)\n\nfun interfree_aux_tac ctxt = SUBGOAL (fn (_, i) => interfree_aux_Tac ctxt i)\n\\\n\ntext \\The so defined ML tactics are then ``exported'' to be used in\nIsabelle proofs.\\\n\nmethod_setup oghoare = \\\n Scan.succeed (SIMPLE_METHOD' o oghoare_tac)\\\n \"verification condition generator for the oghoare logic\"\n\nmethod_setup annhoare = \\\n Scan.succeed (SIMPLE_METHOD' o annhoare_tac)\\\n \"verification condition generator for the ann_hoare logic\"\n\nmethod_setup interfree_aux = \\\n Scan.succeed (SIMPLE_METHOD' o interfree_aux_tac)\\\n \"verification condition generator for interference freedom tests\"\n\ntext \\Tactics useful for dealing with the generated verification conditions:\\\n\nmethod_setup conjI_tac = \\\n Scan.succeed (fn ctxt => SIMPLE_METHOD' (conjI_Tac ctxt (K all_tac)))\\\n \"verification condition generator for interference freedom tests\"\n\nML \\\nfun disjE_Tac ctxt tac i st = st |>\n ( (EVERY [eresolve_tac ctxt [disjE] i,\n disjE_Tac ctxt tac (i+1),\n tac i]) ORELSE (tac i) )\n\\\n\nmethod_setup disjE_tac = \\\n Scan.succeed (fn ctxt => SIMPLE_METHOD' (disjE_Tac ctxt (K all_tac)))\\\n \"verification condition generator for interference freedom tests\"\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Hoare_Parallel/OG_Tactics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29483607469542883}} {"text": "theory IMP_Minus_Minus_Subprograms_Nat\n imports Primitives IMP_Minus_Minus_Subprograms \nbegin \n\n\n\n\nfun map_all_subprograms:: \"nat \\ nat \\ nat\" where \n\"map_all_subprograms c n = (if n =0 then 0 else ( 2## (hd_nat n) ## c ## 0) ## map_all_subprograms c (tl_nat n) )\"\n\n\nlemma submap_all_subprograms:\n\"map_all_subprograms c n = map_nat (\\x. 2## x ## c ## 0) n\"\n apply (induct c n rule: map_all_subprograms.induct)\n apply auto\n done\n\nfun map_all_subprograms_acc:: \"nat \\ nat \\ nat \\ nat\" where \n\"map_all_subprograms_acc c acc n = (if n =0 then acc else \nmap_all_subprograms_acc c (( 2## (hd_nat n) ## c ## 0) ## acc) (tl_nat n) )\"\n\nlemma map_all_subprograms_induct:\n\" map_all_subprograms_acc c acc n = map_acc (\\x. 2## x ## c ## 0) acc n\"\n apply(induct c acc n rule:map_all_subprograms_acc.induct)\n apply auto\n done\n\ndefinition map_all_subprograms_tail :: \"nat \\ nat \\ nat\" where \n\"map_all_subprograms_tail c n = reverse_nat (map_all_subprograms_acc c 0 n)\"\n\nlemma subtail_map_all_subprograms:\n\"map_all_subprograms_tail c n = map_all_subprograms c n\"\n using submap_all_subprograms map_all_subprograms_tail_def map_all_subprograms_induct[of c 0 n]\n subtail_map by presburger\n\ndatatype all_sub = Bot \"com list\" |\n SKIP|\n Assign vname bit |\n Seq_0 com com|\n Seq_m com com \"com list\"|\n Seq_f com com \"com list\" \"com list\"|\n If_0 \"vname list\" com com |\n If_m \"vname list\" com com \"com list\"|\n If_f \"vname list\" com com \"com list\" \"com list\"|\n While_0 \"vname list\" com |\n While_f \"vname list\" com \"com list\"\n\n\nfun all_sub_encode :: \"all_sub \\ nat\" where \n\"all_sub_encode SKIP = list_encode [0] \"|\n\"all_sub_encode (Assign v b) = list_encode [1, vname_encode v, bit_encode b]\"|\n\"all_sub_encode (Seq_0 c1 c2) = list_encode[2 , comm_encode c1 , comm_encode c2]\"|\n\"all_sub_encode (If_0 v c1 c2) = list_encode [3, vname_list_encode v, comm_encode c1, comm_encode c2]\"|\n\"all_sub_encode (While_0 v c) = list_encode [4,vname_list_encode v, comm_encode c]\"|\n\"all_sub_encode (Seq_m c1 c2 c3) = list_encode[5, comm_encode c1 ,comm_encode c2, list_encode (map comm_encode c3) ]\"|\n\"all_sub_encode (Seq_f c1 c2 c3 c4) = list_encode [6, comm_encode c1 ,comm_encode c2 , list_encode (map comm_encode c3) , list_encode (map comm_encode c4)]\"|\n\"all_sub_encode (If_m v c1 c2 c3) = list_encode[7, vname_list_encode v, comm_encode c1 ,comm_encode c2, list_encode (map comm_encode c3)]\"|\n\"all_sub_encode (If_f v c1 c2 c3 c4) = list_encode [8, vname_list_encode v, comm_encode c1, comm_encode c2, list_encode (map comm_encode c3), list_encode (map comm_encode c4)]\"|\n\"all_sub_encode (While_f v c c') = list_encode [9, vname_list_encode v, comm_encode c, list_encode (map comm_encode c')]\"|\n\"all_sub_encode (Bot x) = list_encode [10, list_encode (map comm_encode x)]\"\n\nfun push_stack :: \"com \\ all_sub list \\ all_sub list\" where \n\"push_stack com.SKIP s = SKIP#s \"|\n\"push_stack (com.Assign v b) s = Assign v b # s\"|\n\"push_stack (com.Seq c1 c2) s = Seq_0 c1 c2 # s\"|\n\"push_stack (com.If v c1 c2) s = If_0 v c1 c2 # s\"|\n\"push_stack (com.While v c) s = While_0 v c #s\"\n\nfun push_stack_nat :: \"nat \\ nat \\ nat\" where \n\"push_stack_nat c s = (c ##s )\"\n\nlemma sub_push_stack:\n\"push_stack_nat (comm_encode c) (list_encode (map all_sub_encode s)) \n= list_encode (map all_sub_encode (push_stack c s))\"\n apply( cases c)\n apply (auto simp add: sub_cons simp del: list_encode.simps)\n done\n\nlemma push_stack_not_Nil:\n\"push_stack c s \\ []\"\n apply(cases c)\n apply auto\n done\n\n\n\nfun add_res :: \"com list \\ all_sub list \\ all_sub list\" where \n\"add_res c [] = [Bot c] \"|\n\"add_res c (Seq_0 c1 c2 # s) = Seq_m c1 c2 c #s \"|\n\"add_res c (Seq_m c1 c2 c3 # s) = Seq_f c1 c2 c3 c # s\"|\n\"add_res c (If_0 v c1 c2 # s) = If_m v c1 c2 c # s \"|\n\"add_res c (If_m v c1 c2 c3 #s) = If_f v c1 c2 c3 c # s\"|\n\"add_res c (While_0 v c'#s) = While_f v c' c # s\"|\n\"add_res c s = s\"\n\nlemma add_res_not_Nil:\n\"add_res c s \\ []\"\n apply(cases s)\n apply auto\n subgoal for a xs\n apply (cases a)\n apply auto\n done\n done\n\nfun add_res_nat :: \"nat \\ nat \\ nat\" where \n\"add_res_nat c s = (if s =0 then (10##c##0)##0 else \n(let h = hd_nat s; con = hd_nat h ; fs = nth_nat (Suc 0) h ; sn = nth_nat (Suc (Suc 0)) h;\n th = nth_nat (Suc (Suc (Suc 0))) h; ft = nth_nat (Suc (Suc (Suc (Suc 0)))) h; t = tl_nat s in\n if con = 2 then (5## fs ## sn ## c ## 0) ## t\nelse if con = 5 then(6 ## fs ## sn ## th ## c ## 0) ## t\nelse if con = 3 then (7 ## fs ## sn ## th ## c ## 0) ## t\nelse if con = 7 then (8 ## fs ## sn ## th ## ft ## c ## 0)## t\nelse if con = 4 then (9 ## fs ## sn ## c ## 0) ## t else s \n ))\"\n\nlemma sub_add_res:\n\"add_res_nat (list_encode (map comm_encode c)) (list_encode (map all_sub_encode s))\n= list_encode (map all_sub_encode (add_res c s))\"\n apply (cases s)\n apply (simp add: cons0 sub_cons flip: list_encode.simps)\n subgoal for a xs \n apply(cases a)\n apply (auto simp add:cons0 sub_cons list_encode_eq sub_hd sub_tl simp flip: list_encode.simps)\n apply(auto simp add: Let_def sub_hd sub_tl simp flip: list_encode.simps(2)) \n done\n done\n\nfunction (sequential, domintros) all_subprograms_stack :: \"all_sub list \\ com list\" where \n\"all_subprograms_stack (Bot x#s) = x\"|\n\"all_subprograms_stack (SKIP # s) = all_subprograms_stack (add_res [com.SKIP] s )\"|\n\"all_subprograms_stack (Assign v b # s) = all_subprograms_stack (add_res [(com.Assign v b), com.SKIP] s )\"|\n\"all_subprograms_stack (Seq_0 c1 c2 # s) = all_subprograms_stack (push_stack c1 (Seq_0 c1 c2 # s) )\"|\n\"all_subprograms_stack (Seq_m c1 c2 c3 # s) = all_subprograms_stack (push_stack c2 (Seq_m c1 c2 c3 # s))\"|\n\"all_subprograms_stack (Seq_f c1 c2 c3 c4 #s) = all_subprograms_stack (add_res ((map (\\ c. c ;; c2) c3 ) @ c3 \n @ c4) s) \"|\n\"all_subprograms_stack (If_0 v c1 c2 # s) = all_subprograms_stack (push_stack c1 (If_0 v c1 c2 # s))\"|\n\"all_subprograms_stack (If_m v c1 c2 c3 # s) = all_subprograms_stack (push_stack c2 (If_m v c1 c2 c3 # s)) \"|\n\"all_subprograms_stack (If_f v c1 c2 c3 c4 # s) = all_subprograms_stack (add_res (\n[(com.If v c1 c2)] @ c3 @ c4 ) s )\"|\n\"all_subprograms_stack (While_0 v c # s) = all_subprograms_stack (push_stack c (While_0 v c # s) )\"|\n\"all_subprograms_stack (While_f v c c' # s) = all_subprograms_stack (add_res ([(While v c), com.SKIP] @ c' @ \n (map (\\ x. x ;; (While v c)) c')) s)\"\n by pat_completeness auto\ntermination sorry \n\nfunction all_subprograms_stack_nat :: \"nat \\ nat\" where \n\"all_subprograms_stack_nat s = (let h = hd_nat s; con = hd_nat h ; fs = nth_nat (Suc 0) h ; sn = nth_nat (Suc (Suc 0)) h;\n th = nth_nat (Suc (Suc (Suc 0))) h; ft = nth_nat (Suc (Suc (Suc (Suc 0)))) h; v = nth_nat (Suc (Suc (Suc (Suc (Suc 0))))) h; t = tl_nat s in\nif con = 10 then fs else \nif con = 0 then all_subprograms_stack_nat (add_res_nat ((0##0)##0) t ) else\nif con = 1 then all_subprograms_stack_nat (add_res_nat (h##(0##0)##0) t ) else \nif con = 2 then all_subprograms_stack_nat (push_stack_nat fs s) else \nif con = 5 then all_subprograms_stack_nat (push_stack_nat sn s) else \nif con = 6 then all_subprograms_stack_nat (add_res_nat (append_nat ( append_nat (map_all_subprograms_tail sn th ) th \n ) ft) t) else\nif con = 3 then all_subprograms_stack_nat (push_stack_nat sn s) else\nif con = 7 then all_subprograms_stack_nat (push_stack_nat th s) else\nif con = 8 then all_subprograms_stack_nat (add_res_nat (append_nat ((3##fs##sn##th##0)## ft )v) t) else\nif con = 4 then all_subprograms_stack_nat (push_stack_nat sn s) else\nall_subprograms_stack_nat (add_res_nat ((4##fs##sn##0) ## (0##0) ## append_nat th (map_all_subprograms_tail (4##fs##sn##0) th)) t)\n) \"\n sorry\ntermination sorry \n\nlemma map_singleton:\n\"[f x] = map f [x]\" by auto\nlemma sub_all_programs_stack:\n\"s \\ [] \\ all_subprograms_stack_nat (list_encode (map all_sub_encode s))\n = list_encode (map comm_encode (all_subprograms_stack s))\"\n apply (cases s)\n apply simp\n subgoal for a xs\n apply(induct s arbitrary : a xs rule:all_subprograms_stack.induct)\n using push_stack_not_Nil add_res_not_Nil apply (auto simp only:)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack.simps )\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack.simps ) \n apply(simp only: add_res.simps sub_add_res map_singleton[of comm_encode] flip: comm_encode.simps list.map )\n apply (metis neq_Nil_conv)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack.simps ) \n apply(simp only: add_res.simps sub_add_res map_singleton[of comm_encode] flip: One_nat_def comm_encode.simps list.map )\n apply (metis neq_Nil_conv)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: sub_push_stack flip: One_nat_def all_sub_encode.simps list.map )\n apply (metis list.exhaust)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: sub_push_stack flip: One_nat_def all_sub_encode.simps list.map )\n apply (metis list.exhaust)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: subtail_map_all_subprograms submap_all_subprograms\n sub_map sub_append map_map comp_def sub_cons cons0\n add_res.simps sub_add_res flip: One_nat_def comm_encode.simps list.map )\n apply (simp only: sub_add_res flip: map_append comp_def[of comm_encode \"\\x. (com.Seq x _ )\"] map_map)\n apply (metis append.assoc neq_Nil_conv)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: sub_push_stack flip: One_nat_def all_sub_encode.simps list.map )\n apply (metis list.exhaust)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: sub_push_stack flip: One_nat_def all_sub_encode.simps list.map )\n apply (metis list.exhaust)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: subtail_map_all_subprograms submap_all_subprograms\n sub_map sub_append map_map comp_def sub_cons cons0\n add_res.simps sub_add_res flip: One_nat_def comm_encode.simps list.map map_append)\n apply (metis append_Cons neq_Nil_conv)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: sub_push_stack flip: One_nat_def all_sub_encode.simps list.map )\n apply (metis list.exhaust)\n apply (subst all_subprograms_stack_nat.simps)\n apply (simp add: Let_def sub_nth sub_hd sub_cons sub_tl cons0\n del: all_subprograms_stack_nat.simps \n list_encode.simps nth_nat.simps add_res_nat.simps push_stack_nat.simps ) \n apply(simp only: subtail_map_all_subprograms submap_all_subprograms\n sub_map sub_append map_map comp_def sub_cons cons0\n add_res.simps sub_add_res flip: One_nat_def comm_encode.simps list.map map_append)\n apply (simp only: sub_add_res flip: comp_def [of comm_encode \"\\x. (com.Seq x (com.While _ _))\" ]\n map_map map_append list.map )\n apply (metis list.exhaust)\n done\n done\n\nlemma all_subprograms_stack_correct:\n\"all_subprograms_stack (push_stack c s) = all_subprograms_stack (add_res (all_subprograms c) s)\"\n apply (induct c arbitrary: s )\n apply auto\n done\n\ndefinition all_subprograms_t :: \"com \\ com list\" where\n\"all_subprograms_t c = all_subprograms_stack (push_stack c [] )\"\n\ndefinition all_subprograms_nat :: \"nat \\ nat\" where \n\"all_subprograms_nat c = all_subprograms_stack_nat (push_stack_nat c 0)\"\n\nlemma subtailnat_all_subprograms:\n\"all_subprograms_nat (comm_encode c) = list_encode (map comm_encode (all_subprograms_t c))\"\n by (metis all_subprograms_nat_def all_subprograms_t_def list.simps(8) list_encode.simps(1)\n push_stack_not_Nil sub_all_programs_stack sub_push_stack)\n\nlemma sub_all_subprograms_t:\n\"all_subprograms_t c = all_subprograms c\"\n by (simp add: all_subprograms_stack_correct all_subprograms_t_def)\n\nlemma sub_all_subprograms:\n \"all_subprograms_nat (comm_encode c) = list_encode(map comm_encode (all_subprograms c))\"\n by (simp add: sub_all_subprograms_t subtailnat_all_subprograms)\n\ndefinition all_subprograms_tail :: \"nat \\ nat\" where \n\"all_subprograms_tail c = all_subprograms_nat c\"\n\nlemma subtail_all_subprograms:\n\"all_subprograms_tail c = all_subprograms_nat c\"\n by (simp add: all_subprograms_tail_def)\n\ndefinition enumerate_subprograms_nat :: \"nat \\nat\" where\n\"enumerate_subprograms_nat c = remdups_nat (all_subprograms_nat c)\"\n\ndefinition enumerate_subprograms_tail :: \"nat \\nat\" where\n\"enumerate_subprograms_tail c = remdups_tail (all_subprograms_tail c)\"\n\nlemma subtail_enumerate_subprograms:\n\"enumerate_subprograms_tail c = enumerate_subprograms_nat c\"\n using all_subprograms_tail_def enumerate_subprograms_nat_def \nenumerate_subprograms_tail_def subtail_remdups by auto\n\nlemma sub_enumerate_subprograms:\n\"enumerate_subprograms_nat (comm_encode c) = list_encode (map comm_encode (enumerate_subprograms c))\"\n using comm_inj\n apply (auto simp only: enumerate_subprograms_nat_def enumerate_subprograms_def remdups_map sub_all_subprograms sub_remdups list_encode_eq)\n done\n\nfun all_variables_nat :: \"nat \\nat\" where\n\"all_variables_nat n = (if n=0 \\ hd_nat n =0 \\ hd_nat n =2 then 0 else\nif hd_nat n = 1 then (nth_nat (Suc 0) n) ## 0 else\nnth_nat (Suc 0) n )\"\n\ndefinition all_variables_tail where \"all_variables_tail = all_variables_nat\"\n\nlemma subtail_all_variables : \"all_variables_tail = all_variables_nat\" using all_variables_tail_def by meson\n\nlemma sub_all_variables: \"all_variables_nat (comm_encode c) = vname_list_encode (all_variables c)\"\n apply (cases c)\n apply (auto simp only:all_variables_nat.simps sub_hd comm_encode.simps head.simps \n vname_list_encode_def cons0 sub_cons sub_nth nth.simps)\n apply auto\n done\n\nfun map_all_variables:: \"nat \\ nat\" where \n\"map_all_variables n = (if n =0 then 0 else (all_variables_nat (hd_nat n)) ## map_all_variables (tl_nat n) )\"\n\nfun map_all_variables_acc :: \"nat \\ nat \\ nat\" where \n\"map_all_variables_acc acc n = (if n =0 then acc else map_all_variables_acc ((all_variables_tail (hd_nat n)) ## acc) (tl_nat n) )\"\n\nlemma submap_all_variables:\n\"map_all_variables n = map_nat all_variables_nat n\"\n apply (induct n rule:map_all_variables.induct)\n apply auto\n done\nlemma map_all_variables_induct:\n\" map_all_variables_acc acc n = map_acc all_variables_nat acc n\"\n apply(induct acc n rule: map_all_variables_acc.induct)\n apply (auto simp add: subtail_all_variables )\n done\n\ndefinition map_all_variables_tail :: \"nat \\ nat\" where \n\" map_all_variables_tail n = reverse_nat (map_all_variables_acc 0 n)\"\n\nlemma subtail_map_all_variables:\n\" map_all_variables_tail n = map_all_variables n \"\n using map_all_variables_tail_def map_all_variables_induct[of 0 n]\n submap_all_variables subtail_map by presburger\n\n\ndefinition enumerate_variables_nat :: \"nat \\ nat\" where\n\"enumerate_variables_nat c =\n remdups_nat (concat_nat (map_all_variables (enumerate_subprograms_nat c)))\"\n\ndefinition enumerate_variables_tail :: \"nat \\ nat\" where\n\"enumerate_variables_tail c =\n remdups_tail (concat_tail (map_all_variables_tail (enumerate_subprograms_tail c)))\"\n\n\nlemma subtail_enumerate_variables:\n\"enumerate_variables_tail c = enumerate_variables_nat c \"\n by (simp add: enumerate_variables_nat_def enumerate_variables_tail_def subtail_concat \nsubtail_enumerate_subprograms subtail_map_all_variables subtail_remdups)\n\nlemma sub_enumerate_variables:\n \"enumerate_variables_nat (comm_encode c) = vname_list_encode ( enumerate_variables c)\"\n apply \n (simp only: submap_all_variables enumerate_variables_nat_def enumerate_variables_def sub_enumerate_subprograms \n sub_map map_map)\n apply (simp only: comp_def)\n apply (simp only: sub_all_variables)\n apply (simp only: flip:comp_def) \n apply (simp only: flip:map_map)\n apply (simp only: vname_list_encode_as_comp)\n apply (simp only: flip:map_map)\n using vname_inj\n apply (simp only: sub_concat sub_remdups comp_apply map_concat flip:remdups_map )\n done\n\n\nend ", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP--_To_SAS++/IMP_Minus_Minus_Subprograms_Nat.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2947509667317434}} {"text": "section {* ICF-setup for Automatic Refinement *}\ntheory ICF_Autoref\nimports \n ICF_Refine_Monadic \n \"../GenCF/Intf/Intf_Set\"\n \"../GenCF/Intf/Intf_Map\"\nbegin\n\nsubsection {* Unique Priority Queue *}\nconsts i_prio :: \"interface \\ interface \\ interface\"\ndefinition [simp]: \"op_uprio_empty \\ Map.empty\"\ndefinition [simp]: \"op_uprio_is_empty x \\ x = Map.empty\"\ndefinition [simp]: \"op_uprio_insert s e a \\ s(e \\ a)\"\ndefinition op_uprio_prio :: \"('e\\'a)\\'e\\'a\"\n where [simp]: \"op_uprio_prio s e \\ s e\"\n\n(* FIXME: Tune id-op phase such that it can distinguish those patterns!\n For now: Only include this patterns on demand!\n*)\ncontext begin interpretation autoref_syn .\n\nlemma uprio_pats:\n fixes s :: \"'e\\'a\"\n shows\n \"Map.empty::'e\\'a \\ op_uprio_empty\"\n \"s e \\ op_uprio_prio$s$e\"\n \"s(e\\a) \\ op_uprio_insert$s$e$a\"\n\n \"dom s = {} \\ op_uprio_is_empty$s\"\n \"{} = dom s \\ op_uprio_is_empty$s\"\n \"s=Map.empty \\ op_uprio_is_empty$s\"\n \"Map.empty=s \\ op_uprio_is_empty$s\"\n by (auto intro!: eq_reflection)\n\nend\n\nterm prio_pop_min\n\nlemma [autoref_itype]:\n \"op_uprio_empty ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio\"\n \"op_uprio_prio ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i Ie \\\\<^sub>i \\Ia\\\\<^sub>ii_option\"\n \"op_uprio_is_empty ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i i_bool\"\n \"op_uprio_insert ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i Ie \\\\<^sub>i Ia \\\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio\"\n \"prio_pop_min ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i \\\\Ie,\\Ia,\\Ie,Ia\\\\<^sub>ii_prio\\\\<^sub>ii_prod\\\\<^sub>ii_prod\\\\<^sub>ii_nres\"\n by simp_all\n\ncontext uprio begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\"\n lemma rel_def:\n \"\\Re,Ra\\rel \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n \n\n lemma rel_sv[relator_props]: \n \"\\Range Re = UNIV; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by tagged_solver\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_prio]\nend\n\n\nlemma (in uprio) rel_alt: \"\\Id,Rv\\rel = \n { (c,a). \\x. (\\ c x,a x)\\\\Rv\\option_rel \\ invar c }\"\n by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in uprio_empty) autoref_empty[autoref_rules]:\n \"PREFER_id Re \\ (empty (),op_uprio_empty)\\\\Re,Ra\\rel\"\n by (auto simp: empty_correct rel_alt)\n\nlemma (in uprio_isEmpty) autoref_is_empty[autoref_rules]:\n \"PREFER_id Re \\ (isEmpty,op_uprio_is_empty)\\\\Re,Ra\\rel\\bool_rel\"\n by (auto simp: isEmpty_correct rel_alt intro!: ext)\n\nlemma (in uprio_prio) autoref_prio[autoref_rules]:\n \"PREFER_id Re \\ (prio,op_uprio_prio)\\\\Re,Ra\\rel\\Re\\\\Ra\\option_rel\"\n by (auto simp: prio_correct rel_alt intro!: ext)\n\nlemma (in uprio_insert) autoref_insert[autoref_rules]:\n \"PREFER_id Re \\ (insert,op_uprio_insert)\\\\Re,Ra\\rel\\Re\\Ra\\\\Re,Ra\\rel\"\n by (auto simp: insert_correct rel_alt intro!: ext)\n\nlemma (in uprio_pop) autoref_prio_pop_min[autoref_rules]:\n \"\\PREFER_id Re; PREFER_id Ra \\ \n \\ (\\s. RETURN (pop s),prio_pop_min)\\\\Re,Ra\\rel\\\\\\Re,\\Ra,\\Re,Ra\\rel\\prod_rel\\prod_rel\\nres_rel\"\n apply simp\n apply (intro fun_relI nres_relI)\n by (rule prio_pop_min_refine)\n\n\n\n\ncontext set begin\n definition rel_def_internal: \"rel R \\ br \\ invar O \\R\\set_rel\"\n lemma rel_def: \"\\R\\rel \\ br \\ invar O \\R\\set_rel\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id\\rel = br \\ invar\" by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \"single_valued R \\ single_valued (\\R\\rel)\"\n unfolding rel_def by tagged_solver\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_set]\n\nend\n\ncontext map begin\n definition rel_def_internal: \n \"rel Rk Rv \\ br \\ invar O (Rk \\ \\Rv\\ option_rel)\"\n lemma rel_def: \n \"\\Rk,Rv\\rel \\ br \\ invar O (Rk \\ \\Rv\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\Range Rk = UNIV; single_valued Rv\\ \\ single_valued (\\Rk,Rv\\rel)\"\n unfolding rel_def \n by (tagged_solver (trace))\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_map]\n\nend\n\n\n(*\ncontext list begin\n definition rel_def_internal: \n \"rel R \\ br \\ invar O R\"\n lemma rel_def: \"\\R\\rel \\ br \\ invar O R\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \"single_valued R \\ single_valued (\\R\\rel)\"\n unfolding rel_def by refine_post\nend\n\ncontext al begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O \\\\Re,Ra\\ prod_rel\\list_rel\"\n lemma rel_def: \n \"\\Re,Ra\\rel \\ br \\ invar O \\\\Re,Ra\\ prod_rel\\list_rel\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\single_valued Re; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by refine_post\n\nend\n\ncontext prio begin\n (* TODO: Fix that to use multiset_rel! *)\n definition rel_def[simp]: \"rel \\ br \\ invar\"\n lemma rel_sv: \"single_valued rel\" unfolding rel_def by refine_post\nend\n\ncontext uprio begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\"\n lemma rel_def:\n \"\\Re,Ra\\rel \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\Range Re = UNIV; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by refine_post\n\nend\n*)\n\n\nsetup {* Revert_Abbrev.revert_abbrev \"Autoref_Binding_ICF.*.rel\" *}\n\n\n\n\n(* TODO: Move *)\nlemma Collect_x_x_pairs_rel_image[simp]: \"{p. \\x. p = (x, x)}``x = x\" \n by auto\n\n\nsubsection \"Set\"\n\nlemma (in set_empty) empty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (empty (), {}) \\ \\Rk\\rel\"\n by (simp add: br_def empty_correct)\n\nlemma (in set_memb) memb_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (memb,op \\)\\Rk\\\\Rk\\rel\\Id\"\n apply simp\n by (auto simp add: memb_correct br_def)\n\nlemma (in set_ins) ins_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (ins,Set.insert)\\Rk\\\\Rk\\rel\\\\Rk\\rel\"\n by simp (auto simp add: ins_correct br_def)\n\ncontext set_ins_dj begin\ncontext begin interpretation autoref_syn .\nlemma ins_dj_autoref[autoref_rules]: \n assumes \"SIDE_PRECOND_OPT (x'\\s')\"\n assumes \"PREFER_id Rk\"\n assumes \"(x,x')\\Rk\"\n assumes \"(s,s')\\\\Rk\\rel\"\n shows \"(ins_dj x s,(OP Set.insert ::: Rk \\ \\Rk\\rel \\ \\Rk\\rel)$x'$s')\\\\Rk\\rel\"\n using assms \n apply simp\n apply (auto simp add: ins_dj_correct br_def)\n done\nend\nend\n\nlemma (in set_delete) delete_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (delete,op_set_delete)\\Rk\\\\Rk\\rel\\\\Rk\\rel\"\n by simp (auto simp add: delete_correct op_set_delete_def br_def)\n \nlemma (in set_isEmpty) isEmpty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isEmpty,op_set_isEmpty) \\ \\Rk\\rel\\Id\"\n apply (simp add: br_def)\n apply (fastforce simp: isEmpty_correct)\n done\n\nlemma (in set_isSng) isSng_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isSng,op_set_isSng) \\ \\Rk\\rel\\Id\"\n by simp\n (auto simp add: isSng_correct op_set_isSng_def br_def card_Suc_eq)\n\nlemma (in set_ball) ball_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (ball,Set.Ball) \\ \\Rk\\rel\\(Rk\\Id)\\Id\"\n by simp (auto simp add: ball_correct fun_rel_def br_def)\n\nlemma (in set_bex) bex_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (bex,Set.Bex) \\ \\Rk\\rel\\(Rk\\Id)\\Id\"\n apply simp\n apply (auto simp: bex_correct fun_rel_def br_def intro!: ext)\n done\n\nlemma (in set_size) size_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (size,card) \\ \\Rk\\rel \\ Id\"\n by simp (auto simp add: size_correct br_def)\n\nlemma (in set_size_abort) size_abort_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (size_abort,op_set_size_abort) \\ Id \\ \\Rk\\rel \\ Id\"\n by simp\n (auto simp add: size_abort_correct op_set_size_abort_def br_def)\n\nlemma (in set_union) union_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (union,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s3.rel\"\n by simp (auto simp add: union_correct br_def)\n\ncontext set_union_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma union_dj_autoref[autoref_rules]:\n assumes \"PREFER_id Rk\"\n assumes \"SIDE_PRECOND_OPT (a'\\b'={})\"\n assumes \"(a,a')\\\\Rk\\s1.rel\"\n assumes \"(b,b')\\\\Rk\\s2.rel\"\n shows \"(union_dj a b,(OP op \\ ::: \\Rk\\s1.rel \\ \\Rk\\s2.rel \\ \\Rk\\s3.rel)$a'$b')\n \\\\Rk\\s3.rel\"\n using assms \n by simp (auto simp: union_dj_correct br_def)\nend \nend\n\nlemma (in set_diff) diff_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (diff,op -)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s1.rel\"\n by simp (auto simp add: diff_correct br_def)\n\nlemma (in set_filter) filter_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (filter,op_set_filter)\\(Rk \\ Id) \\ \\Rk\\s1.rel\\\\Rk\\s2.rel\"\n by simp (auto simp add: filter_correct op_set_filter_def fun_rel_def \n br_def)\n\nlemma (in set_inter) inter_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (inter,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s3.rel\"\n by simp (auto simp add: inter_correct br_def)\n\nlemma (in set_subset) subset_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (subset,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: subset_correct br_def)\n\nlemma (in set_equal) equal_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (equal,op =)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: equal_correct br_def)\n\nlemma (in set_disjoint) disjoint_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (disjoint,op_set_disjoint)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: disjoint_correct op_set_disjoint_def br_def)\n\nlemma (in list_to_set) to_set_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (to_set,set)\\\\Rk\\list_rel \\ \\Rk\\rel\"\n apply simp\n apply (auto simp add: to_set_correct br_def)\n done\n\ncontext set_sel' begin\ncontext begin interpretation autoref_syn .\n\nlemma autoref_op_set_pick[autoref_rules]: \n assumes \"SIDE_PRECOND (s'\\{})\"\n assumes \"PREFER_id Rk\"\n assumes \"(s,s')\\\\Rk\\rel\"\n shows \"(RETURN (the (sel' s (\\_. True))), \n (OP op_set_pick ::: \\Rk\\rel \\ \\Rk\\nres_rel) $ s')\n \\ \\Rk\\nres_rel\"\n using assms\n apply (clarsimp simp add: br_def nres_rel_def ex_in_conv[symmetric])\n apply (erule (1) sel'E[OF _ _ TrueI])\n apply (auto intro: RES_refine)\n done\nend\nend\n\nlemma (in poly_set_iteratei) proper[proper_it]:\n \"proper_it' iteratei iteratei\"\n apply (rule proper_it'I)\n by (rule pi_iteratei)\n\nlemma (in poly_set_iteratei) autoref_iteratei[autoref_ga_rules]: \n \"REL_IS_ID Rk \\ is_set_to_list Rk rel (it_to_list iteratei)\"\n unfolding is_set_to_list_def is_set_to_sorted_list_def it_to_list_def \n it_to_sorted_list_def\n apply (simp add: br_def, intro allI impI)\n apply (drule iteratei_correct)\n unfolding set_iterator_def set_iterator_genord_foldli_conv\n apply (elim exE)\n apply clarsimp\n apply (drule fun_cong[where x=\"\\_::'x list. True\"])\n apply simp\n done\n\nlemma (in poly_set_iterateoi) proper_o[proper_it]:\n \"proper_it' iterateoi iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_iterateoi)\n\n\n\nlemma (in poly_set_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n \"REL_IS_ID Rk \\ \n is_set_to_sorted_list op \\ Rk rel (it_to_list rev_iterateoi)\"\n unfolding is_set_to_sorted_list_def it_to_list_def it_to_sorted_list_def\n apply (simp add: br_def, intro allI impI)\n apply (drule rev_iterateoi_correct)\n unfolding set_iterator_rev_linord_def set_iterator_genord_foldli_conv\n apply (elim exE)\n apply clarsimp\n apply (drule fun_cong[where x=\"\\_::'x list. True\"])\n apply simp\n done\n\nlemma (in poly_set_rev_iterateoi) proper_ro[proper_it]:\n \"proper_it' rev_iterateoi rev_iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_rev_iterateoi)\n\nsubsection \"Map\"\n\nlemma (in map) rel_alt: \"\\Id,Rv\\rel = \n { (c,a). \\x. (\\ c x,a x)\\\\Rv\\option_rel \\ invar c }\"\n by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in map_empty) empty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (empty (),op_map_empty)\\\\Rk,Rv\\rel\"\n by (auto simp: empty_correct rel_alt)\n \nlemma (in map_lookup) lookup_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (lookup,op_map_lookup)\\Rk\\\\Rk,Rv\\rel\\\\Rv\\option_rel\"\n apply (intro fun_relI option_relI)\n apply (auto simp: lookup_correct rel_alt\n dest: fun_relD2)\n done\n\nlemma (in map_update) update_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (update,op_map_update)\\Rk\\Rv\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (intro fun_relI)\n apply (simp add: update_correct rel_alt)\n done\n\ncontext map_update_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma update_dj_autoref[autoref_rules]: \n assumes \"SIDE_PRECOND_OPT (k'\\dom m')\"\n assumes \"PREFER_id Rk\"\n assumes \"(k,k')\\Rk\"\n assumes \"(v,v')\\Rv\"\n assumes \"(m,m')\\\\Rk,Rv\\rel\"\n shows \"(update_dj k v m,\n (OP op_map_update ::: Rk \\ Rv \\ \\Rk,Rv\\rel \\ \\Rk,Rv\\rel)$k'$v'$m'\n )\\\\Rk,Rv\\rel\"\n using assms\n apply (subgoal_tac \"k\\dom (\\ m)\")\n apply (simp add: update_dj_correct rel_alt)\n apply (auto simp add: rel_alt option_rel_def)\n apply (metis option.simps(3))\n done\nend\nend\n\nlemma (in map_delete) delete_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (delete,op_map_delete)\\Rk\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (intro fun_relI)\n apply (simp add: delete_correct restrict_map_def rel_alt)\n done\n\nlemma (in map_restrict) restrict_autoref[autoref_rules]: \n \"PREFER_id Rk \\ \n (restrict,op_map_restrict) \n \\ (\\Rk,Rv\\prod_rel \\ Id) \\ \\Rk,Rv\\m1.rel \\ \\Rk,Rv\\m2.rel\"\n apply (intro fun_relI)\n apply (simp add: restrict_correct br_comp_alt m1.rel_def m2.rel_def )\n apply (intro fun_relI)\n apply (auto simp: restrict_map_def split: split_if_asm)\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def) []\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def) []\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n apply (drule (1) fun_relD2)\n apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n done\n\nlemma (in map_add) add_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (add,op ++)\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (auto simp add: add_correct rel_alt Map.map_add_def\n split: option.split)\n apply (drule_tac x=x in spec)+\n apply simp\n apply (metis option.simps(3) option_rel_simp(2))\n by (metis (lifting) option_rel_simp(3))\n\n\ncontext map_add_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma add_dj_autoref[autoref_rules]: \n assumes \"PREFER_id Rk\"\n assumes \"SIDE_PRECOND_OPT (dom a' \\ dom b' = {})\"\n assumes \"(a,a')\\\\Rk,Rv\\rel\"\n assumes \"(b,b')\\\\Rk,Rv\\rel\"\n shows \"(add_dj a b, (OP op ++ ::: \\Rk,Rv\\rel \\ \\Rk,Rv\\rel \\ \\Rk,Rv\\rel) $ a' $ b')\\\\Rk,Rv\\rel\"\n using assms\n apply simp\n apply (subgoal_tac \"dom (\\ a) \\ dom (\\ b) = {}\")\n apply (clarsimp simp add: add_dj_correct rel_def br_comp_alt)\n apply (auto \n simp add: rel_def br_comp_alt Map.map_add_def\n split: option.split\n elim: fun_relE1 dest: fun_relD1 intro: option_relI\n ) []\n\n apply (clarsimp simp add: rel_def br_comp_alt)\n\n apply (auto simp: dom_def)\n apply (drule (1) fun_relD1)\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def)\n done\nend\nend\n\nlemma (in map_isEmpty) isEmpty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isEmpty,op_map_isEmpty)\\\\Rk,Rv\\rel\\Id\"\n by (auto simp: isEmpty_correct rel_alt\n intro!: ext)\n\nlemma sngI: \n assumes \"m k = Some v\"\n assumes \"\\k'. k'\\k \\ m k' = None\"\n shows \"m = [k\\v]\"\n using assms\n by (auto intro!: ext)\n\nlemma (in map_isSng) isSng_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isSng,op_map_isSng)\\\\Rk,Rv\\rel\\Id\"\n (* TODO: Clean up this mess *)\n apply (auto simp add: isSng_correct rel_alt)\n apply (rule_tac x=k in exI)\n apply (rule_tac x=\"the (a' k)\" in exI)\n apply (rule sngI)\n apply (drule_tac x=k in spec)\n apply (auto elim: option_relE) []\n apply (force elim: option_relE) []\n\n apply (rule_tac x=k in exI)\n apply (rule_tac x=\"the (\\ a k)\" in exI)\n apply (rule sngI)\n apply (drule_tac x=k in spec)\n apply (auto elim: option_relE) []\n apply (force elim: option_relE) []\n done\n\nlemma (in map_ball) ball_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (ball,op_map_ball)\\\\Rk,Rv\\rel\\(\\Rk,Rv\\prod_rel\\Id)\\Id\"\n apply (auto simp: ball_correct rel_alt map_to_set_def\n option_rel_def prod_rel_def fun_rel_def)\n apply (metis option.inject option.simps(3))+\n done\n\nlemma (in map_bex) bex_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (bex,op_map_bex)\\\\Rk,Rv\\rel\\(\\Rk,Rv\\prod_rel\\Id)\\Id\"\n apply (auto simp: bex_correct map_to_set_def rel_alt \n option_rel_def prod_rel_def fun_rel_def)\n apply (metis option.inject option.simps(3))+\n done\n\nlemma (in map_size) size_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (size,op_map_size)\\\\Rk,Rv\\rel\\Id\"\n apply (auto simp: size_correct rel_alt option_rel_def dom_def \n intro!: arg_cong[where f=card])\n apply (metis option.simps(3))+\n done\n\nlemma (in map_size_abort) size_abort_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (size_abort,op_map_size_abort)\\Id\\\\Rk,Rv\\rel\\Id\"\n apply (auto simp: size_abort_correct \n rel_alt option_rel_def\n dom_def intro!: arg_cong[where f=card] cong[OF arg_cong[where f=min]])\n apply (metis option.simps(3))+\n done\n\nlemma (in list_to_map) to_map_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (to_map,map_of)\\ \\\\Rk,Rv\\prod_rel\\list_rel \\ \\Rk,Rv\\rel\"\nproof (intro fun_relI)\n fix l :: \"('u\\'v) list\" and l' :: \"('u\\'a) list\"\n assume \"PREFER_id Rk\" hence [simp]: \"Rk=Id\" by simp\n assume \"(l,l')\\\\\\Rk,Rv\\prod_rel\\list_rel\"\n thus \"(to_map l, map_of l') \\ \\Rk,Rv\\rel\"\n apply (simp add: list_rel_def)\n proof (induct rule: list_all2_induct)\n case Nil thus ?case \n by (auto simp add: to_map_correct rel_alt)\n next\n case (Cons x x' l l') thus ?case\n by (auto simp add: to_map_correct \n rel_alt prod_rel_def)\n qed\nqed\n\n(* TODO: Move *)\nlemma key_rel_true[simp]: \"key_rel (\\_ _. True) = (\\_ _. True)\"\n by (auto intro!: ext simp: key_rel_def)\n\n\nlemma (in poly_map_iteratei) proper[proper_it]:\n \"proper_it' iteratei iteratei\"\n apply (rule proper_it'I)\n by (rule pi_iteratei)\n\nlemma (in poly_map_iteratei) autoref_iteratei[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_list Rk Rv rel (it_to_list iteratei)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def is_map_to_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_genord_correct[where it = iteratei, \n where R=\"\\_ _. True\", simplified, OF \n iteratei_correct[OF I, unfolded set_iterator_def]\n ] have \n M: \"Map.map_of (it_to_list iteratei m) = \\ m\"\n and D: \"distinct (List.map fst (it_to_list iteratei m))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list iteratei m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list iteratei m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n qed\nqed\n\nlemma (in poly_map_iterateoi) proper_o[proper_it]:\n \"proper_it' iterateoi iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_iterateoi)\n\nlemma (in poly_map_iterateoi) autoref_iterateoi[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_sorted_list op \\ Rk Rv rel (it_to_list iterateoi)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_linord_correct[where it = iterateoi, \n OF iterateoi_correct[OF I]\n ] have \n M: \"map_of (it_to_list iterateoi m) = \\ m\"\n and D: \"distinct (map fst (it_to_list iterateoi m))\"\n and S: \"sorted (map fst (it_to_list iterateoi m))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list iterateoi m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list iterateoi m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n\n from S show \"sorted_by_rel (key_rel op \\) (it_to_list iterateoi m)\"\n by (simp add: key_rel_def[abs_def])\n\n qed\nqed\n\nlemma (in poly_map_rev_iterateoi) proper_ro[proper_it]:\n \"proper_it' rev_iterateoi rev_iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_rev_iterateoi)\n\nlemma (in poly_map_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_sorted_list op \\ Rk Rv rel (it_to_list rev_iterateoi)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_rev_linord_correct[where it = rev_iterateoi, \n OF rev_iterateoi_correct[OF I]\n ] have \n M: \"map_of (it_to_list rev_iterateoi m) = \\ m\"\n and D: \"distinct (map fst (it_to_list rev_iterateoi m))\"\n and S: \"sorted (rev (map fst (it_to_list rev_iterateoi m)))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list rev_iterateoi m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list rev_iterateoi m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n\n from S show \"sorted_by_rel (key_rel op \\) (it_to_list rev_iterateoi m)\"\n by (simp add: key_rel_def[abs_def])\n\n qed\nqed\n\n\n\n\n\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/ICF_Autoref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2946826900294997}} {"text": "(* Title: ZF/Inductive.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1993 University of Cambridge\n\nInductive definitions use least fixedpoints with standard products and sums\nCoinductive definitions use greatest fixedpoints with Quine products and sums\n\nSums are used only for mutual recursion;\nProducts are used only to derive \"streamlined\" induction rules for relations\n*)\n\nsection\\Inductive and Coinductive Definitions\\\n\ntheory Inductive\nimports Fixedpt QPair Nat\nkeywords\n \"inductive\" \"coinductive\" \"inductive_cases\" \"rep_datatype\" \"primrec\" :: thy_decl and\n \"domains\" \"intros\" \"monos\" \"con_defs\" \"type_intros\" \"type_elims\"\n \"elimination\" \"induction\" \"case_eqns\" \"recursor_eqns\" :: quasi_command\nbegin\n\nlemma def_swap_iff: \"a == b ==> a = c \\ c = b\"\n by blast\n\nlemma def_trans: \"f == g ==> g(a) = b ==> f(a) = b\"\n by simp\n\nlemma refl_thin: \"!!P. a = a ==> P ==> P\" .\n\nML_file \\ind_syntax.ML\\\nML_file \\Tools/ind_cases.ML\\\nML_file \\Tools/cartprod.ML\\\nML_file \\Tools/inductive_package.ML\\\nML_file \\Tools/induct_tacs.ML\\\nML_file \\Tools/primrec_package.ML\\\n\nML \\\nstructure Lfp =\n struct\n val oper = \\<^const>\\lfp\\\n val bnd_mono = \\<^const>\\bnd_mono\\\n val bnd_monoI = @{thm bnd_monoI}\n val subs = @{thm def_lfp_subset}\n val Tarski = @{thm def_lfp_unfold}\n val induct = @{thm def_induct}\n end;\n\nstructure Standard_Prod =\n struct\n val sigma = \\<^const>\\Sigma\\\n val pair = \\<^const>\\Pair\\\n val split_name = \\<^const_name>\\split\\\n val pair_iff = @{thm Pair_iff}\n val split_eq = @{thm split}\n val fsplitI = @{thm splitI}\n val fsplitD = @{thm splitD}\n val fsplitE = @{thm splitE}\n end;\n\nstructure Standard_CP = CartProd_Fun (Standard_Prod);\n\nstructure Standard_Sum =\n struct\n val sum = \\<^const>\\sum\\\n val inl = \\<^const>\\Inl\\\n val inr = \\<^const>\\Inr\\\n val elim = \\<^const>\\case\\\n val case_inl = @{thm case_Inl}\n val case_inr = @{thm case_Inr}\n val inl_iff = @{thm Inl_iff}\n val inr_iff = @{thm Inr_iff}\n val distinct = @{thm Inl_Inr_iff}\n val distinct' = @{thm Inr_Inl_iff}\n val free_SEs = Ind_Syntax.mk_free_SEs\n [distinct, distinct', inl_iff, inr_iff, Standard_Prod.pair_iff]\n end;\n\n\nstructure Ind_Package =\n Add_inductive_def_Fun\n (structure Fp=Lfp and Pr=Standard_Prod and CP=Standard_CP\n and Su=Standard_Sum val coind = false);\n\n\nstructure Gfp =\n struct\n val oper = \\<^const>\\gfp\\\n val bnd_mono = \\<^const>\\bnd_mono\\\n val bnd_monoI = @{thm bnd_monoI}\n val subs = @{thm def_gfp_subset}\n val Tarski = @{thm def_gfp_unfold}\n val induct = @{thm def_Collect_coinduct}\n end;\n\nstructure Quine_Prod =\n struct\n val sigma = \\<^const>\\QSigma\\\n val pair = \\<^const>\\QPair\\\n val split_name = \\<^const_name>\\qsplit\\\n val pair_iff = @{thm QPair_iff}\n val split_eq = @{thm qsplit}\n val fsplitI = @{thm qsplitI}\n val fsplitD = @{thm qsplitD}\n val fsplitE = @{thm qsplitE}\n end;\n\nstructure Quine_CP = CartProd_Fun (Quine_Prod);\n\nstructure Quine_Sum =\n struct\n val sum = \\<^const>\\qsum\\\n val inl = \\<^const>\\QInl\\\n val inr = \\<^const>\\QInr\\\n val elim = \\<^const>\\qcase\\\n val case_inl = @{thm qcase_QInl}\n val case_inr = @{thm qcase_QInr}\n val inl_iff = @{thm QInl_iff}\n val inr_iff = @{thm QInr_iff}\n val distinct = @{thm QInl_QInr_iff}\n val distinct' = @{thm QInr_QInl_iff}\n val free_SEs = Ind_Syntax.mk_free_SEs\n [distinct, distinct', inl_iff, inr_iff, Quine_Prod.pair_iff]\n end;\n\n\nstructure CoInd_Package =\n Add_inductive_def_Fun(structure Fp=Gfp and Pr=Quine_Prod and CP=Quine_CP\n and Su=Quine_Sum val coind = true);\n\n\\\n\nend\n", "meta": {"author": "landonf", "repo": "isabelle-legacy", "sha": "e40f3ca7e9a42bb91e57fd15f969388e6e83f692", "save_path": "github-repos/isabelle/landonf-isabelle-legacy", "path": "github-repos/isabelle/landonf-isabelle-legacy/isabelle-legacy-e40f3ca7e9a42bb91e57fd15f969388e6e83f692/src/ZF/Inductive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832058771035, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.2946826819319902}} {"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\Universal arrow\\\ntheory CZH_UCAT_Universal\n imports \n CZH_UCAT_Introduction\n CZH_Elementary_Categories.CZH_ECAT_FUNCT\n CZH_Elementary_Categories.CZH_ECAT_Hom\nbegin\n\n\n\nsubsection\\Background\\\n\n\ntext\\\nThe following section is based, primarily, on the elements of the content \nof Chapter III-1 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\nnamed_theorems ua_field_simps\n\ndefinition UObj :: V where [ua_field_simps]: \"UObj = 0\"\ndefinition UArr :: V where [ua_field_simps]: \"UArr = 1\\<^sub>\\\"\n\nlemma [cat_cs_simps]:\n shows UObj_simp: \"[a, b]\\<^sub>\\\\UObj\\ = a\"\n and UArr_simp: \"[a, b]\\<^sub>\\\\UArr\\ = b\"\n unfolding ua_field_simps by (simp_all add: nat_omega_simps)\n\n\n\nsubsection\\Universal map\\\n\n\ntext\\\nThe universal map is a convenience utility that allows treating \na part of the definition of the universal arrow as an arrow in the\ncategory \\Set\\.\n\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\ndefinition umap_of :: \"V \\ V \\ V \\ V \\ V \\ V\"\n where \"umap_of \\ c r u d =\n [\n (\\f'\\\\<^sub>\\Hom (\\\\HomDom\\) r d. \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> u),\n Hom (\\\\HomDom\\) r d,\n Hom (\\\\HomCod\\) c (\\\\ObjMap\\\\d\\)\n ]\\<^sub>\\\"\n\ndefinition umap_fo :: \"V \\ V \\ V \\ V \\ V \\ V\"\n where \"umap_fo \\ c r u d = umap_of (op_cf \\) c r u d\"\n\n\ntext\\Components.\\\n\nlemma (in is_functor) umap_of_components:\n assumes \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\" (*do not remove*)\n shows \"umap_of \\ c r u d\\ArrVal\\ = (\\f'\\\\<^sub>\\Hom \\ r d. \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u)\"\n and \"umap_of \\ c r u d\\ArrDom\\ = Hom \\ r d\"\n and \"umap_of \\ c r u d\\ArrCod\\ = Hom \\ c (\\\\ObjMap\\\\d\\)\"\n unfolding umap_of_def arr_field_simps\n by (simp_all add: cat_cs_simps nat_omega_simps)\n\nlemma (in is_functor) umap_fo_components:\n assumes \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"umap_fo \\ c r u d\\ArrVal\\ = (\\f'\\\\<^sub>\\Hom \\ d r. u \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f'\\)\"\n and \"umap_fo \\ c r u d\\ArrDom\\ = Hom \\ d r\"\n and \"umap_fo \\ c r u d\\ArrCod\\ = Hom \\ (\\\\ObjMap\\\\d\\) c\"\n unfolding \n umap_fo_def \n is_functor.umap_of_components[\n OF is_functor_op, unfolded cat_op_simps, OF assms\n ] \nproof(rule vsv_eqI)\n fix f' assume \"f' \\\\<^sub>\\ \\\\<^sub>\\ (\\f'\\\\<^sub>\\Hom \\ d r. \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> u)\"\n then have f': \"f' : d \\\\<^bsub>\\\\<^esub> r\" by simp\n then have \\f': \"\\\\ArrMap\\\\f'\\ : \\\\ObjMap\\\\d\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\" \n by (auto intro: cat_cs_intros)\n from f' show \n \"(\\f'\\\\<^sub>\\Hom \\ d r. \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> u)\\f'\\ = \n (\\f'\\\\<^sub>\\Hom \\ d r. u \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f'\\)\\f'\\\"\n by (simp add: HomCod.op_cat_Comp[OF assms \\f'])\nqed simp_all\n\n\ntext\\Universal maps for the opposite functor.\\\n\nlemma (in is_functor) op_umap_of[cat_op_simps]: \"umap_of (op_cf \\) = umap_fo \\\"\n unfolding umap_fo_def by simp \n\nlemma (in is_functor) op_umap_fo[cat_op_simps]: \"umap_fo (op_cf \\) = umap_of \\\"\n unfolding umap_fo_def by (simp add: cat_op_simps)\n\nlemmas [cat_op_simps] = \n is_functor.op_umap_of\n is_functor.op_umap_fo\n\n\nsubsubsection\\Arrow value\\\n\nlemma umap_of_ArrVal_vsv[cat_cs_intros]: \"vsv (umap_of \\ c r u d\\ArrVal\\)\"\n unfolding umap_of_def arr_field_simps by (simp add: nat_omega_simps)\n\nlemma umap_fo_ArrVal_vsv[cat_cs_intros]: \"vsv (umap_fo \\ c r u d\\ArrVal\\)\"\n unfolding umap_fo_def by (rule umap_of_ArrVal_vsv)\n\nlemma (in is_functor) umap_of_ArrVal_vdomain: \n assumes \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"\\\\<^sub>\\ (umap_of \\ c r u d\\ArrVal\\) = Hom \\ r d\"\n unfolding umap_of_components[OF assms] by simp\n\nlemmas [cat_cs_simps] = is_functor.umap_of_ArrVal_vdomain\n\nlemma (in is_functor) umap_fo_ArrVal_vdomain:\n assumes \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"\\\\<^sub>\\ (umap_fo \\ c r u d\\ArrVal\\) = Hom \\ d r\"\n unfolding umap_fo_components[OF assms] by simp\n\nlemmas [cat_cs_simps] = is_functor.umap_fo_ArrVal_vdomain\n\nlemma (in is_functor) umap_of_ArrVal_app: \n assumes \"f' : r \\\\<^bsub>\\\\<^esub> d\" and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"umap_of \\ c r u d\\ArrVal\\\\f'\\ = \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u\"\n using assms(1) unfolding umap_of_components[OF assms(2)] by simp\n\nlemmas [cat_cs_simps] = is_functor.umap_of_ArrVal_app\n\nlemma (in is_functor) umap_fo_ArrVal_app: \n assumes \"f' : d \\\\<^bsub>\\\\<^esub> r\" and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"umap_fo \\ c r u d\\ArrVal\\\\f'\\ = u \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f'\\\"\nproof-\n from assms have \"\\\\ArrMap\\\\f'\\ : \\\\ObjMap\\\\d\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\" \n by (auto intro: cat_cs_intros)\n from this assms(2) have \\f'[simp]:\n \"\\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> u = u \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f'\\\"\n by (simp add: cat_op_simps)\n from\n is_functor_axioms\n is_functor.umap_of_ArrVal_app[\n OF is_functor_op, unfolded cat_op_simps, \n OF assms\n ] \n show ?thesis\n by (simp add: cat_op_simps cat_cs_simps)\nqed\n\nlemmas [cat_cs_simps] = is_functor.umap_fo_ArrVal_app\n\nlemma (in is_functor) umap_of_ArrVal_vrange: \n assumes \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"\\\\<^sub>\\ (umap_of \\ c r u d\\ArrVal\\) \\\\<^sub>\\ Hom \\ c (\\\\ObjMap\\\\d\\)\"\nproof(intro vsubset_antisym vsubsetI)\n interpret vsv \\umap_of \\ c r u d\\ArrVal\\\\ \n unfolding umap_of_components[OF assms] by simp\n fix g assume \"g \\\\<^sub>\\ \\\\<^sub>\\ (umap_of \\ c r u d\\ArrVal\\)\"\n then obtain f' \n where g_def: \"g = umap_of \\ c r u d\\ArrVal\\\\f'\\\" \n and f': \"f' \\\\<^sub>\\ \\\\<^sub>\\ (umap_of \\ c r u d\\ArrVal\\)\"\n unfolding umap_of_components[OF assms] by auto\n then have f': \"f' : r \\\\<^bsub>\\\\<^esub> d\" \n unfolding umap_of_ArrVal_vdomain[OF assms] by simp\n then have \\f': \"\\\\ArrMap\\\\f'\\ : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\d\\\" \n by (auto intro!: cat_cs_intros)\n have g_def: \"g = \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u\"\n unfolding g_def umap_of_ArrVal_app[OF f' assms]..\n from \\f' assms show \"g \\\\<^sub>\\ Hom \\ c (\\\\ObjMap\\\\d\\)\" \n unfolding g_def by (auto intro: cat_cs_intros)\nqed\n\nlemma (in is_functor) umap_fo_ArrVal_vrange: \n assumes \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"\\\\<^sub>\\ (umap_fo \\ c r u d\\ArrVal\\) \\\\<^sub>\\ Hom \\ (\\\\ObjMap\\\\d\\) c\"\n by \n (\n rule is_functor.umap_of_ArrVal_vrange[\n OF is_functor_op, unfolded cat_op_simps, OF assms, folded umap_fo_def\n ]\n )\n\n\nsubsubsection\\Universal map is an arrow in the category \\Set\\\\\n\nlemma (in is_functor) cf_arr_Set_umap_of: \n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and r: \"r \\\\<^sub>\\ \\\\Obj\\\" \n and d: \"d \\\\<^sub>\\ \\\\Obj\\\"\n and u: \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"arr_Set \\ (umap_of \\ c r u d)\"\nproof(intro arr_SetI)\n interpret HomDom: category \\ \\ by (rule assms(1))\n interpret HomCod: category \\ \\ by (rule assms(2))\n note umap_of_components = umap_of_components[OF u]\n from u d have c: \"c \\\\<^sub>\\ \\\\Obj\\\" and \\d: \"(\\\\ObjMap\\\\d\\) \\\\<^sub>\\ \\\\Obj\\\" \n by (auto intro: cat_cs_intros)\n show \"vfsequence (umap_of \\ c r u d)\" unfolding umap_of_def by simp\n show \"vcard (umap_of \\ c r u d) = 3\\<^sub>\\\"\n unfolding umap_of_def by (simp add: nat_omega_simps)\n from umap_of_ArrVal_vrange[OF u] show \n \"\\\\<^sub>\\ (umap_of \\ c r u d\\ArrVal\\) \\\\<^sub>\\ umap_of \\ c r u d\\ArrCod\\\"\n unfolding umap_of_components by simp\n from r d show \"umap_of \\ c r u d\\ArrDom\\ \\\\<^sub>\\ Vset \\\"\n unfolding umap_of_components by (intro HomDom.cat_Hom_in_Vset)\n from c \\d show \"umap_of \\ c r u d\\ArrCod\\ \\\\<^sub>\\ Vset \\\"\n unfolding umap_of_components by (intro HomCod.cat_Hom_in_Vset)\nqed (auto simp: umap_of_components[OF u])\n\nlemma (in is_functor) cf_arr_Set_umap_fo: \n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and r: \"r \\\\<^sub>\\ \\\\Obj\\\" \n and d: \"d \\\\<^sub>\\ \\\\Obj\\\"\n and u: \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"arr_Set \\ (umap_fo \\ c r u d)\"\nproof-\n from assms(1) have \\: \"category \\ (op_cat \\)\" \n by (auto intro: cat_cs_intros)\n from assms(2) have \\: \"category \\ (op_cat \\)\" \n by (auto intro: cat_cs_intros)\n show ?thesis\n by \n (\n rule \n is_functor.cf_arr_Set_umap_of[\n OF is_functor_op, unfolded cat_op_simps, OF \\ \\ r d u\n ]\n )\nqed\n\nlemma (in is_functor) cf_umap_of_is_arr:\n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"d \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"umap_of \\ c r u d : Hom \\ r d \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\d\\)\"\nproof(intro cat_Set_is_arrI)\n show \"arr_Set \\ (umap_of \\ c r u d)\" \n by (rule cf_arr_Set_umap_of[OF assms])\nqed (simp_all add: umap_of_components[OF assms(5)])\n\nlemma (in is_functor) cf_umap_of_is_arr':\n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"d \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n and \"A = Hom \\ r d\"\n and \"B = Hom \\ c (\\\\ObjMap\\\\d\\)\"\n and \"\\ = cat_Set \\\"\n shows \"umap_of \\ c r u d : A \\\\<^bsub>\\\\<^esub> B\"\n using assms(1-5) unfolding assms(6-8) by (rule cf_umap_of_is_arr)\n\nlemmas [cat_cs_intros] = is_functor.cf_umap_of_is_arr'\n\nlemma (in is_functor) cf_umap_fo_is_arr:\n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"d \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"umap_fo \\ c r u d : Hom \\ d r \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ (\\\\ObjMap\\\\d\\) c\"\nproof(intro cat_Set_is_arrI)\n show \"arr_Set \\ (umap_fo \\ c r u d)\" \n by (rule cf_arr_Set_umap_fo[OF assms])\nqed (simp_all add: umap_fo_components[OF assms(5)])\n\nlemma (in is_functor) cf_umap_fo_is_arr':\n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"d \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n and \"A = Hom \\ d r\"\n and \"B = Hom \\ (\\\\ObjMap\\\\d\\) c\"\n and \"\\ = cat_Set \\\"\n shows \"umap_fo \\ c r u d : A \\\\<^bsub>\\\\<^esub> B\"\n using assms(1-5) unfolding assms(6-8) by (rule cf_umap_fo_is_arr)\n\nlemmas [cat_cs_intros] = is_functor.cf_umap_fo_is_arr'\n\n\n\nsubsection\\Universal arrow: definition and elementary properties\\\n\n\ntext\\See Chapter III-1 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition universal_arrow_of :: \"V \\ V \\ V \\ V \\ bool\"\n where \"universal_arrow_of \\ c r u \\\n (\n r \\\\<^sub>\\ \\\\HomDom\\\\Obj\\ \\\n u : c \\\\<^bsub>\\\\HomCod\\\\<^esub> \\\\ObjMap\\\\r\\ \\\n (\n \\r' u'.\n r' \\\\<^sub>\\ \\\\HomDom\\\\Obj\\ \\\n u' : c \\\\<^bsub>\\\\HomCod\\\\<^esub> \\\\ObjMap\\\\r'\\ \\\n (\\!f'. f' : r \\\\<^bsub>\\\\HomDom\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\f'\\)\n )\n )\"\n\ndefinition universal_arrow_fo :: \"V \\ V \\ V \\ V \\ bool\"\n where \"universal_arrow_fo \\ c r u \\ universal_arrow_of (op_cf \\) c r u\"\n\n\ntext\\Rules.\\\n\nmk_ide (in is_functor) rf \n universal_arrow_of_def[where \\=\\, unfolded cf_HomDom cf_HomCod]\n |intro universal_arrow_ofI|\n |dest universal_arrow_ofD[dest]|\n |elim universal_arrow_ofE[elim]|\n\nlemma (in is_functor) universal_arrow_foI:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\" \n and \"\\r' u'. \\ r' \\\\<^sub>\\ \\\\Obj\\; u' : \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> c \\ \\ \n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = umap_fo \\ c r u r'\\ArrVal\\\\f'\\\"\n shows \"universal_arrow_fo \\ c r u\"\n by \n (\n simp add: \n is_functor.universal_arrow_ofI\n [\n OF is_functor_op, \n folded universal_arrow_fo_def, \n unfolded cat_op_simps, \n OF assms\n ]\n )\n\nlemma (in is_functor) universal_arrow_foD[dest]:\n assumes \"universal_arrow_fo \\ c r u\"\n shows \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\" \n and \"\\r' u'. \\ r' \\\\<^sub>\\ \\\\Obj\\; u' : \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> c \\ \\ \n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = umap_fo \\ c r u r'\\ArrVal\\\\f'\\\"\n by\n (\n auto simp: \n is_functor.universal_arrow_ofD\n [\n OF is_functor_op, \n folded universal_arrow_fo_def, \n unfolded cat_op_simps,\n OF assms\n ]\n )\n\nlemma (in is_functor) universal_arrow_foE[elim]:\n assumes \"universal_arrow_fo \\ c r u\"\n obtains \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\" \n and \"\\r' u'. \\ r' \\\\<^sub>\\ \\\\Obj\\; u' : \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> c \\ \\ \n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = umap_fo \\ c r u r'\\ArrVal\\\\f'\\\"\n using assms by (auto simp: universal_arrow_foD)\n\n\ntext\\Elementary properties.\\\n\nlemma (in is_functor) op_cf_universal_arrow_of[cat_op_simps]: \n \"universal_arrow_of (op_cf \\) c r u \\ universal_arrow_fo \\ c r u\"\n unfolding universal_arrow_fo_def ..\n\nlemma (in is_functor) op_cf_universal_arrow_fo[cat_op_simps]: \n \"universal_arrow_fo (op_cf \\) c r u \\ universal_arrow_of \\ c r u\"\n unfolding universal_arrow_fo_def cat_op_simps ..\n\nlemmas (in is_functor) [cat_op_simps] = \n is_functor.op_cf_universal_arrow_of\n is_functor.op_cf_universal_arrow_fo\n\n\n\nsubsection\\Uniqueness\\\n\n\ntext\\\nThe following properties are related to the uniqueness of the \nuniversal arrow. These properties can be inferred from the content of\nChapter III-1 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\nlemma (in is_functor) cf_universal_arrow_of_ex_is_iso_arr:\n \\\\The proof is based on the ideas expressed in the proof of Theorem 5.2 \n in Chapter Introduction in \\cite{hungerford_algebra_2003}.\\\n assumes \"universal_arrow_of \\ c r u\" and \"universal_arrow_of \\ c r' u'\"\n obtains f where \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" and \"u' = umap_of \\ c r u r'\\ArrVal\\\\f\\\"\nproof-\n\n note ua1 = universal_arrow_ofD[OF assms(1)]\n note ua2 = universal_arrow_ofD[OF assms(2)]\n\n from ua1(1) have \\r: \"\\\\CId\\\\r\\ : r \\\\<^bsub>\\\\<^esub> r\" by (auto intro: cat_cs_intros)\n from ua1(1) have \"\\\\ArrMap\\\\\\\\CId\\\\r\\\\ = \\\\CId\\\\\\\\ObjMap\\\\r\\\\\"\n by (auto intro: cat_cs_intros)\n with ua1(1,2) have u_def: \"u = umap_of \\ c r u r\\ArrVal\\\\\\\\CId\\\\r\\\\\"\n unfolding umap_of_ArrVal_app[OF \\r ua1(2)] by (auto simp: cat_cs_simps)\n\n from ua2(1) have \\r': \"\\\\CId\\\\r'\\ : r' \\\\<^bsub>\\\\<^esub> r'\" by (auto intro: cat_cs_intros)\n from ua2(1) have \"\\\\ArrMap\\\\\\\\CId\\\\r'\\\\ = \\\\CId\\\\\\\\ObjMap\\\\r'\\\\\" \n by (auto intro: cat_cs_intros)\n with ua2(1,2) have u'_def: \"u' = umap_of \\ c r' u' r'\\ArrVal\\\\\\\\CId\\\\r'\\\\\"\n unfolding umap_of_ArrVal_app[OF \\r' ua2(2)] by (auto simp: cat_cs_simps)\n\n from \\r u_def universal_arrow_ofD(3)[OF assms(1) ua1(1,2)] have eq_CId_rI: \n \"\\ f' : r \\\\<^bsub>\\\\<^esub> r; u = umap_of \\ c r u r\\ArrVal\\\\f'\\ \\ \\ f' = \\\\CId\\\\r\\\" \n for f'\n by blast\n from \\r' u'_def universal_arrow_ofD(3)[OF assms(2) ua2(1,2)] have eq_CId_r'I: \n \"\\ f' : r' \\\\<^bsub>\\\\<^esub> r'; u' = umap_of \\ c r' u' r'\\ArrVal\\\\f'\\ \\ \\\n f' = \\\\CId\\\\r'\\\" \n for f'\n by blast\n\n from ua1(3)[OF ua2(1,2)] obtain f \n where f: \"f : r \\\\<^bsub>\\\\<^esub> r'\" \n and u'_def: \"u' = umap_of \\ c r u r'\\ArrVal\\\\f\\\"\n and \"g : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\g\\ \\ f = g\" \n for g\n by metis\n from ua2(3)[OF ua1(1,2)] obtain f' \n where f': \"f' : r' \\\\<^bsub>\\\\<^esub> r\" \n and u_def: \"u = umap_of \\ c r' u' r\\ArrVal\\\\f'\\\"\n and \"g : r' \\\\<^bsub>\\\\<^esub> r \\ u = umap_of \\ c r' u' r\\ArrVal\\\\g\\ \\ f' = g\" \n for g\n by metis\n\n have \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\"\n proof(intro is_iso_arrI is_inverseI)\n show f: \"f : r \\\\<^bsub>\\\\<^esub> r'\" by (rule f)\n show f': \"f' : r' \\\\<^bsub>\\\\<^esub> r\" by (rule f')\n show \"f : r \\\\<^bsub>\\\\<^esub> r'\" by (rule f)\n from f' have \\f': \"\\\\ArrMap\\\\f'\\ : \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\" \n by (auto intro: cat_cs_intros)\n from f have \\f: \"\\\\ArrMap\\\\f\\ : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r'\\\" \n by (auto intro: cat_cs_intros)\n note u'_def' = u'_def[symmetric, unfolded umap_of_ArrVal_app[OF f ua1(2)]] \n and u_def' = u_def[symmetric, unfolded umap_of_ArrVal_app[OF f' ua2(2)]]\n show \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f = \\\\CId\\\\r\\\"\n proof(rule eq_CId_rI)\n from f f' show f'f: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f : r \\\\<^bsub>\\\\<^esub> r\" \n by (auto intro: cat_cs_intros)\n from ua1(2) \\f' \\f show \"u = umap_of \\ c r u r\\ArrVal\\\\f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\"\n unfolding umap_of_ArrVal_app[OF f'f ua1(2)] cf_ArrMap_Comp[OF f' f]\n by (simp add: HomCod.cat_Comp_assoc u'_def' u_def')\n qed\n show \"f \\\\<^sub>A\\<^bsub>\\\\<^esub> f' = \\\\CId\\\\r'\\\"\n proof(rule eq_CId_r'I)\n from f f' show ff': \"f \\\\<^sub>A\\<^bsub>\\\\<^esub> f' : r' \\\\<^bsub>\\\\<^esub> r'\" \n by (auto intro: cat_cs_intros)\n from ua2(2) \\f' \\f show \"u' = umap_of \\ c r' u' r'\\ArrVal\\\\f \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\"\n unfolding umap_of_ArrVal_app[OF ff' ua2(2)] cf_ArrMap_Comp[OF f f']\n by (simp add: HomCod.cat_Comp_assoc u'_def' u_def')\n qed\n qed\n \n with u'_def that show ?thesis by auto\n\nqed\n\nlemma (in is_functor) cf_universal_arrow_fo_ex_is_iso_arr:\n assumes \"universal_arrow_fo \\ c r u\"\n and \"universal_arrow_fo \\ c r' u'\"\n obtains f where \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" and \"u' = umap_fo \\ c r u r'\\ArrVal\\\\f\\\"\n by \n (\n elim \n is_functor.cf_universal_arrow_of_ex_is_iso_arr[\n OF is_functor_op, unfolded cat_op_simps, OF assms\n ]\n )\n\nlemma (in is_functor) cf_universal_arrow_of_unique:\n assumes \"universal_arrow_of \\ c r u\"\n and \"universal_arrow_of \\ c r' u'\"\n shows \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\f'\\\"\nproof-\n note ua1 = universal_arrow_ofD[OF assms(1)]\n note ua2 = universal_arrow_ofD[OF assms(2)]\n from ua1(3)[OF ua2(1,2)] show ?thesis .\nqed\n\nlemma (in is_functor) cf_universal_arrow_fo_unique:\n assumes \"universal_arrow_fo \\ c r u\"\n and \"universal_arrow_fo \\ c r' u'\"\n shows \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = umap_fo \\ c r u r'\\ArrVal\\\\f'\\\"\nproof-\n note ua1 = universal_arrow_foD[OF assms(1)]\n note ua2 = universal_arrow_foD[OF assms(2)]\n from ua1(3)[OF ua2(1,2)] show ?thesis .\nqed\n\nlemma (in is_functor) cf_universal_arrow_of_is_iso_arr:\n assumes \"universal_arrow_of \\ c r u\"\n and \"universal_arrow_of \\ c r' u'\"\n and \"f : r \\\\<^bsub>\\\\<^esub> r'\" \n and \"u' = umap_of \\ c r u r'\\ArrVal\\\\f\\\"\n shows \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\"\nproof-\n from assms(3,4) cf_universal_arrow_of_unique[OF assms(1,2)] have eq: \n \"g : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\g\\ \\ f = g\" for g\n by blast\n from assms(1,2) obtain f' \n where iso_f': \"f' : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" \n and u'_def: \"u' = umap_of \\ c r u r'\\ArrVal\\\\f'\\\"\n by (auto elim: cf_universal_arrow_of_ex_is_iso_arr)\n then have f': \"f' : r \\\\<^bsub>\\\\<^esub> r'\" by auto\n from iso_f' show ?thesis unfolding eq[OF f' u'_def, symmetric].\nqed\n\nlemma (in is_functor) cf_universal_arrow_fo_is_iso_arr:\n assumes \"universal_arrow_fo \\ c r u\"\n and \"universal_arrow_fo \\ c r' u'\"\n and \"f : r' \\\\<^bsub>\\\\<^esub> r\" \n and \"u' = umap_fo \\ c r u r'\\ArrVal\\\\f\\\"\n shows \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\"\n by \n (\n rule \n is_functor.cf_universal_arrow_of_is_iso_arr[\n OF is_functor_op, unfolded cat_op_simps, OF assms\n ]\n )\n\nlemma (in is_functor) universal_arrow_of_if_universal_arrow_of:\n assumes \"universal_arrow_of \\ c r u\" \n and \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\"\n and \"u' = umap_of \\ c r u r'\\ArrVal\\\\f\\\"\n shows \"universal_arrow_of \\ c r' u'\"\nproof(intro universal_arrow_ofI assms(2))\n\n note ua = universal_arrow_ofD[OF assms(1)]\n note f = is_iso_arrD(1)[OF assms(2)]\n from assms(3) ua(1,2) f have u'_def: \"u' = \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u\"\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from ua(2) f show u': \"u' : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r'\\\"\n unfolding u'_def by (cs_concl cs_intro: cat_cs_intros)\n\n from f(1) show \"r' \\\\<^sub>\\ \\\\Obj\\\" by auto\n\n fix r'' u'' assume prems: \"r'' \\\\<^sub>\\ \\\\Obj\\\" \"u'' : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r''\\\"\n\n from ua(3)[OF prems] obtain f' \n where f': \"f' : r \\\\<^bsub>\\\\<^esub> r''\"\n and u''_def: \"u'' = umap_of \\ c r u r''\\ArrVal\\\\f'\\\"\n and f'_unique: \"\\f''.\n \\ f'' : r \\\\<^bsub>\\\\<^esub> r''; u'' = umap_of \\ c r u r''\\ArrVal\\\\f''\\ \\ \\\n f'' = f'\"\n by metis\n\n from u''_def f' ua(2) have [cat_cs_simps]: \"\\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u = u''\"\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros) simp\n\n show \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r'' \\ u'' = umap_of \\ c r' u' r''\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n from f' assms(2) f show \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\\<^sub>C\\<^bsub>\\\\<^esub> : r' \\\\<^bsub>\\\\<^esub> r''\"\n by (cs_concl cs_intro: cat_cs_intros cat_arrow_cs_intros)\n have \n \"\\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\\\<^sub>C\\<^bsub>\\\\<^esub>\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u') =\n \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\\\<^sub>C\\<^bsub>\\\\<^esub>\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u))\"\n unfolding u'_def ..\n also from f' assms(2) u' f ua(2) have \n \"\\ = \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\) \\\\<^sub>A\\<^bsub>\\\\<^esub> u\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cs_intro: cat_arrow_cs_intros cat_cs_intros\n )\n also from f' assms(2) f ua(2) have \"\\ = u''\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n finally have [cat_cs_simps]: \n \"\\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> (\\\\ArrMap\\\\f\\\\<^sub>C\\<^bsub>\\\\<^esub>\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u') = u''\".\n from f' assms(2) u' f show \n \"u'' = umap_of \\ c r' u' r''\\ArrVal\\\\f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\\<^sub>C\\<^bsub>\\\\<^esub>\\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_arrow_cs_intros\n )\n fix g assume prems': \n \"g : r' \\\\<^bsub>\\\\<^esub> r''\" \"u'' = umap_of \\ c r' u' r''\\ArrVal\\\\g\\\"\n from prems'(1) f have gf: \"g \\\\<^sub>A\\<^bsub>\\\\<^esub> f : r \\\\<^bsub>\\\\<^esub> r''\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from prems'(2,1) assms(2) u' have \"u'' = \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u'\"\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n also from prems'(1) f ua(2) have \n \"\\ = \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u\"\n by (cs_concl cs_simp: cat_cs_simps u'_def u''_def cs_intro: cat_cs_intros)\n also from prems'(1) f ua(2) have \n \"\\ = umap_of \\ c r u r''\\ArrVal\\\\g \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n finally have \"u'' = umap_of \\ c r u r''\\ArrVal\\\\g \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\".\n from f'_unique[OF gf this] have \"g \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\".\n then have \"(g \\\\<^sub>A\\<^bsub>\\\\<^esub> f) \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\\<^sub>C\\<^bsub>\\\\<^esub> = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\\<^sub>C\\<^bsub>\\\\<^esub>\" by simp\n from this assms(2) prems'(1) u' f ua(2) show \"g = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\\<^sub>C\\<^bsub>\\\\<^esub>\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cs_intro: cat_arrow_cs_intros cat_cs_intros\n )\n qed\n\nqed\n\nlemma (in is_functor) universal_arrow_fo_if_universal_arrow_fo:\n assumes \"universal_arrow_fo \\ c r u\" \n and \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\"\n and \"u' = umap_fo \\ c r u r'\\ArrVal\\\\f\\\"\n shows \"universal_arrow_fo \\ c r' u'\"\n by \n (\n rule is_functor.universal_arrow_of_if_universal_arrow_of[\n OF is_functor_op, unfolded cat_op_simps, OF assms\n ]\n )\n\n\n\nsubsection\\Universal natural transformation\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\\nThe concept of the universal natural transformation is introduced for the \nstatement of the elements of a variant of Proposition 1 in Chapter III-2\nin \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\ndefinition ntcf_ua_of :: \"V \\ V \\ V \\ V \\ V \\ V\"\n where \"ntcf_ua_of \\ \\ c r u =\n [\n (\\d\\\\<^sub>\\\\\\HomDom\\\\Obj\\. umap_of \\ c r u d),\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\\\HomDom\\(r,-),\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\\\HomCod\\(c,-) \\\\<^sub>C\\<^sub>F \\,\n \\\\HomDom\\,\n cat_Set \\\n ]\\<^sub>\\\"\n\ndefinition ntcf_ua_fo :: \"V \\ V \\ V \\ V \\ V \\ V\"\n where \"ntcf_ua_fo \\ \\ c r u = ntcf_ua_of \\ (op_cf \\) c r u\"\n\n\ntext\\Components.\\\n\nlemma ntcf_ua_of_components:\n shows \"ntcf_ua_of \\ \\ c r u\\NTMap\\ = (\\d\\\\<^sub>\\\\\\HomDom\\\\Obj\\. umap_of \\ c r u d)\"\n and \"ntcf_ua_of \\ \\ c r u\\NTDom\\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\\\HomDom\\(r,-)\"\n and \"ntcf_ua_of \\ \\ c r u\\NTCod\\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\\\HomCod\\(c,-) \\\\<^sub>C\\<^sub>F \\\"\n and \"ntcf_ua_of \\ \\ c r u\\NTDGDom\\ = \\\\HomDom\\\"\n and \"ntcf_ua_of \\ \\ c r u\\NTDGCod\\ = cat_Set \\\"\n unfolding ntcf_ua_of_def nt_field_simps by (simp_all add: nat_omega_simps) \n\nlemma ntcf_ua_fo_components:\n shows \"ntcf_ua_fo \\ \\ c r u\\NTMap\\ = (\\d\\\\<^sub>\\\\\\HomDom\\\\Obj\\. umap_fo \\ c r u d)\"\n and \"ntcf_ua_fo \\ \\ c r u\\NTDom\\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>op_cat (\\\\HomDom\\)(r,-)\"\n and \"ntcf_ua_fo \\ \\ c r u\\NTCod\\ =\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>op_cat (\\\\HomCod\\)(c,-) \\\\<^sub>C\\<^sub>F op_cf \\\"\n and \"ntcf_ua_fo \\ \\ c r u\\NTDGDom\\ = op_cat (\\\\HomDom\\)\"\n and \"ntcf_ua_fo \\ \\ c r u\\NTDGCod\\ = cat_Set \\\"\n unfolding ntcf_ua_fo_def ntcf_ua_of_components umap_fo_def cat_op_simps \n by simp_all\n\ncontext is_functor\nbegin\n\nlemmas ntcf_ua_of_components' = \n ntcf_ua_of_components[where \\=\\ and \\=\\, unfolded cat_cs_simps]\n\nlemmas [cat_cs_simps] = ntcf_ua_of_components'(2-5)\n\nlemma ntcf_ua_fo_components':\n assumes \"c \\\\<^sub>\\ \\\\Obj\\\" and \"r \\\\<^sub>\\ \\\\Obj\\\" \n shows \"ntcf_ua_fo \\ \\ c r u\\NTMap\\ = (\\d\\\\<^sub>\\\\\\Obj\\. umap_fo \\ c r u d)\"\n and [cat_cs_simps]: \n \"ntcf_ua_fo \\ \\ c r u\\NTDom\\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,r)\"\n and [cat_cs_simps]: \n \"ntcf_ua_fo \\ \\ c r u\\NTCod\\ = Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,c) \\\\<^sub>C\\<^sub>F op_cf \\\"\n and [cat_cs_simps]: \"ntcf_ua_fo \\ \\ c r u\\NTDGDom\\ = op_cat \\\"\n and [cat_cs_simps]: \"ntcf_ua_fo \\ \\ c r u\\NTDGCod\\ = cat_Set \\\"\n unfolding\n ntcf_ua_fo_components cat_cs_simps\n HomDom.cat_op_cat_cf_Hom_snd[OF assms(2)] \n HomCod.cat_op_cat_cf_Hom_snd[OF assms(1)]\n by simp_all\n\nend\n\nlemmas [cat_cs_simps] = \n is_functor.ntcf_ua_of_components'(2-5)\n is_functor.ntcf_ua_fo_components'(2-5)\n\n\nsubsubsection\\Natural transformation map\\\n\nmk_VLambda (in is_functor) \n ntcf_ua_of_components(1)[where \\=\\ and \\=\\, unfolded cf_HomDom]\n |vsv ntcf_ua_of_NTMap_vsv|\n |vdomain ntcf_ua_of_NTMap_vdomain|\n |app ntcf_ua_of_NTMap_app|\n\ncontext is_functor\nbegin\n\ncontext\n fixes c r\n assumes r: \"r \\\\<^sub>\\ \\\\Obj\\\" and c: \"c \\\\<^sub>\\ \\\\Obj\\\" \nbegin\n\nmk_VLambda ntcf_ua_fo_components'(1)[OF c r]\n |vsv ntcf_ua_fo_NTMap_vsv|\n |vdomain ntcf_ua_fo_NTMap_vdomain|\n |app ntcf_ua_fo_NTMap_app|\n\nend\n\nend\n\nlemmas [cat_cs_intros] = \n is_functor.ntcf_ua_fo_NTMap_vsv\n is_functor.ntcf_ua_of_NTMap_vsv\n\nlemmas [cat_cs_simps] = \n is_functor.ntcf_ua_fo_NTMap_vdomain\n is_functor.ntcf_ua_fo_NTMap_app\n is_functor.ntcf_ua_of_NTMap_vdomain\n is_functor.ntcf_ua_of_NTMap_app\n\nlemma (in is_functor) ntcf_ua_of_NTMap_vrange:\n assumes \"category \\ \\\" \n and \"category \\ \\\" \n and \"r \\\\<^sub>\\ \\\\Obj\\\" \n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"\\\\<^sub>\\ (ntcf_ua_of \\ \\ c r u\\NTMap\\) \\\\<^sub>\\ cat_Set \\\\Arr\\\"\nproof(rule vsv.vsv_vrange_vsubset, unfold ntcf_ua_of_NTMap_vdomain)\n show \"vsv (ntcf_ua_of \\ \\ c r u\\NTMap\\)\" by (rule ntcf_ua_of_NTMap_vsv)\n fix d assume prems: \"d \\\\<^sub>\\ \\\\Obj\\\"\n with category_cat_Set is_functor_axioms assms show \n \"ntcf_ua_of \\ \\ c r u\\NTMap\\\\d\\ \\\\<^sub>\\ cat_Set \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\nqed\n\n\nsubsubsection\\Commutativity of the universal maps and \\hom\\-functions\\\n\nlemma (in is_functor) cf_umap_of_cf_hom_commute: \n assumes \"category \\ \\\"\n and \"category \\ \\\"\n and \"c \\\\<^sub>\\ \\\\Obj\\\"\n and \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n and \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \n \"umap_of \\ c r u b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> cf_hom \\ [\\\\CId\\\\r\\, f]\\<^sub>\\ =\n cf_hom \\ [\\\\CId\\\\c\\, \\\\ArrMap\\\\f\\]\\<^sub>\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> umap_of \\ c r u a\"\n (is \\?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf = ?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a\\)\nproof-\n\n from is_functor_axioms category_cat_Set assms(1,2,4-6) have b_rf: \n \"?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf : Hom \\ r a \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\b\\)\"\n by \n (\n cs_concl cs_shallow \n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros\n )\n from is_functor_axioms category_cat_Set assms(1,2,4-6) have cf_a: \n \"?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a : Hom \\ r a \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\b\\)\"\n by (cs_concl cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros)\n\n show ?thesis\n proof(rule arr_Set_eqI[of \\])\n from b_rf show arr_Set_b_rf: \"arr_Set \\ (?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf)\"\n by (auto dest: cat_Set_is_arrD(1))\n from b_rf have dom_lhs: \n \"\\\\<^sub>\\ ((?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf)\\ArrVal\\) = Hom \\ r a\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)+\n from cf_a show arr_Set_cf_a: \"arr_Set \\ (?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a)\"\n by (auto dest: cat_Set_is_arrD(1))\n from cf_a have dom_rhs: \n \"\\\\<^sub>\\ ((?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a)\\ArrVal\\) = Hom \\ r a\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n show \"(?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf)\\ArrVal\\ = (?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a)\\ArrVal\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs in_Hom_iff)\n fix q assume \"q : r \\\\<^bsub>\\\\<^esub> a\"\n with is_functor_axioms category_cat_Set assms show \n \"(?uof_b \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?rf)\\ArrVal\\\\q\\ =\n (?cf \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_a)\\ArrVal\\\\q\\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros\n )\n qed (use arr_Set_b_rf arr_Set_cf_a in auto)\n \n qed (use b_rf cf_a in \\cs_concl cs_shallow cs_simp: cat_cs_simps\\)+\n\nqed\n\nlemma cf_umap_of_cf_hom_unit_commute:\n assumes \"category \\ \\\"\n and \"category \\ \\

\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\
\"\n and \"\\ : \\
\\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : cf_id \\ \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"g : c' \\\\<^bsub>\\\\<^esub> c\" \n and \"f : d \\\\<^bsub>\\
\\<^esub> d'\"\n shows \n \"umap_of \\ c' (\\\\ObjMap\\\\c'\\) (\\\\NTMap\\\\c'\\) d' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub>\n cf_hom \\
[\\\\ArrMap\\\\g\\, f]\\<^sub>\\ =\n cf_hom \\ [g, \\\\ArrMap\\\\f\\]\\<^sub>\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub>\n umap_of \\ c (\\\\ObjMap\\\\c\\) (\\\\NTMap\\\\c\\) d\"\n (is \\?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf = ?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd\\)\nproof-\n\n interpret \\: is_ntcf \\ \\ \\ \\cf_id \\\\ \\\\ \\\\<^sub>C\\<^sub>F \\\\ \\ by (rule assms(5))\n\n from assms have c'd'_\\gf: \"?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf :\n Hom \\
(\\\\ObjMap\\\\c\\) d \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c' (\\\\ObjMap\\\\d'\\)\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps \n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros\n )\n then have dom_lhs:\n \"\\\\<^sub>\\ ((?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf)\\ArrVal\\) = Hom \\
(\\\\ObjMap\\\\c\\) d\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n from assms have g\\f_cd: \"?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd :\n Hom \\
(\\\\ObjMap\\\\c\\) d \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c' (\\\\ObjMap\\\\d'\\)\"\n by \n (\n cs_concl \n cs_simp: cat_cs_simps \n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros\n )\n then have dom_rhs: \n \"\\\\<^sub>\\ ((?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd)\\ArrVal\\) = Hom \\
(\\\\ObjMap\\\\c\\) d\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n\n show ?thesis\n proof(rule arr_Set_eqI[of \\])\n from c'd'_\\gf show arr_Set_c'd'_\\gf: \n \"arr_Set \\ (?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf)\"\n by (auto dest: cat_Set_is_arrD(1))\n from g\\f_cd show arr_Set_g\\f_cd:\n \"arr_Set \\ (?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd)\"\n by (auto dest: cat_Set_is_arrD(1))\n show \n \"(?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf)\\ArrVal\\ =\n (?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd)\\ArrVal\\\"\n proof(rule vsv_eqI, unfold dom_lhs dom_rhs in_Hom_iff)\n fix h assume prems: \"h : \\\\ObjMap\\\\c\\ \\\\<^bsub>\\
\\<^esub> d\"\n from \\.ntcf_Comp_commute[OF assms(6)] assms have [cat_cs_simps]:\n \"\\\\NTMap\\\\c\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g = \\\\ArrMap\\\\\\\\ArrMap\\\\g\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\c'\\\"\n by \n (\n cs_prems cs_shallow \n cs_simp: cat_cs_simps cat_op_simps cs_intro: cat_cs_intros\n )\n from assms prems show \n \"(?uof_c'd' \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?\\gf)\\ArrVal\\\\h\\ =\n (?g\\f \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?uof_cd)\\ArrVal\\\\h\\\"\n by \n (\n cs_concl\n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros \n cs_simp: cat_cs_simps\n )\n qed (use arr_Set_c'd'_\\gf arr_Set_g\\f_cd in auto)\n \n qed (use c'd'_\\gf g\\f_cd in \\cs_concl cs_shallow cs_simp: cat_cs_simps\\)+\n\nqed\n\n\nsubsubsection\\Universal natural transformation is a natural transformation\\\n\nlemma (in is_functor) cf_ntcf_ua_of_is_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n shows \"ntcf_ua_of \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) \\\\<^sub>C\\<^sub>F Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof(intro is_ntcfI')\n let ?ua = \\ntcf_ua_of \\ \\ c r u\\\n show \"vfsequence (ntcf_ua_of \\ \\ c r u)\" unfolding ntcf_ua_of_def by simp\n show \"vcard ?ua = 5\\<^sub>\\\" unfolding ntcf_ua_of_def by (simp add: nat_omega_simps)\n from assms(1) show \"Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n from is_functor_axioms assms(2) show \n \"Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n by (cs_concl cs_intro: cat_cs_intros)\n from is_functor_axioms assms show \"\\\\<^sub>\\ (?ua\\NTMap\\) = \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n show \"?ua\\NTMap\\\\a\\ :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ObjMap\\\\a\\ \\\\<^bsub>cat_Set \\\\<^esub> (Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\a\\\"\n if \"a \\\\<^sub>\\ \\\\Obj\\\" for a\n using is_functor_axioms assms that \n by (cs_concl cs_simp: cat_cs_simps cat_op_simps cs_intro: cat_cs_intros)\n show \"?ua\\NTMap\\\\b\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ArrMap\\\\f\\ =\n (Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> ?ua\\NTMap\\\\a\\\"\n if \"f : a \\\\<^bsub>\\\\<^esub> b\" for a b f\n using is_functor_axioms assms that \n by \n ( \n cs_concl \n cs_simp: cf_umap_of_cf_hom_commute cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\nqed (auto simp: ntcf_ua_of_components cat_cs_simps)\n\nlemma (in is_functor) cf_ntcf_ua_fo_is_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\" and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n shows \"ntcf_ua_fo \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,r) \\\\<^sub>C\\<^sub>F Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,c) \\\\<^sub>C\\<^sub>F op_cf \\ :\n op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof-\n from assms(2) have c: \"c \\\\<^sub>\\ \\\\Obj\\\" by auto\n show ?thesis\n by \n (\n rule is_functor.cf_ntcf_ua_of_is_ntcf\n [\n OF is_functor_op, \n unfolded cat_op_simps, \n OF assms(1,2),\n unfolded \n HomDom.cat_op_cat_cf_Hom_snd[OF assms(1)] \n HomCod.cat_op_cat_cf_Hom_snd[OF c]\n ntcf_ua_fo_def[symmetric]\n ]\n )\nqed\n\n\nsubsubsection\\Universal natural transformation and universal arrow\\\n\n\ntext\\\nThe lemmas in this subsection correspond to \nvariants of elements of Proposition 1 in Chapter III-2 in \n\\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\nlemma (in is_functor) cf_ntcf_ua_of_is_iso_ntcf:\n assumes \"universal_arrow_of \\ c r u\"\n shows \"ntcf_ua_of \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof-\n\n have r: \"r \\\\<^sub>\\ \\\\Obj\\\"\n and u: \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n and bij: \"\\r' u'.\n \\\n r' \\\\<^sub>\\ \\\\Obj\\; \n u' : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r'\\\n \\ \\ \\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\f'\\\"\n by (auto intro!: universal_arrow_ofD[OF assms(1)])\n\n show ?thesis\n proof(intro is_iso_ntcfI)\n show \"ntcf_ua_of \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) \\\\<^sub>C\\<^sub>F Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n by (rule cf_ntcf_ua_of_is_ntcf[OF r u])\n fix a assume prems: \"a \\\\<^sub>\\ \\\\Obj\\\"\n from is_functor_axioms prems r u have [simp]:\n \"umap_of \\ c r u a : Hom \\ r a \\\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\a\\)\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n then have dom: \"\\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\) = Hom \\ r a\"\n by (cs_concl cs_simp: cat_cs_simps)\n have \"umap_of \\ c r u a : Hom \\ r a \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\a\\)\"\n proof(intro cat_Set_is_iso_arrI, unfold dom)\n \n show umof_a: \"v11 (umap_of \\ c r u a\\ArrVal\\)\"\n proof(intro vsv.vsv_valeq_v11I, unfold dom in_Hom_iff)\n fix g f assume prems': \n \"g : r \\\\<^bsub>\\\\<^esub> a\"\n \"f : r \\\\<^bsub>\\\\<^esub> a\" \n \"umap_of \\ c r u a\\ArrVal\\\\g\\ = umap_of \\ c r u a\\ArrVal\\\\f\\\"\n from is_functor_axioms r u prems'(1) have \\g:\n \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n from bij[OF prems \\g] have unique:\n \"\\\n f' : r \\\\<^bsub>\\\\<^esub> a;\n \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u = umap_of \\ c r u a\\ArrVal\\\\f'\\ \n \\ \\ g = f'\"\n for f' by (metis prems'(1) u umap_of_ArrVal_app)\n from is_functor_axioms prems'(1,2) u have \\g_u:\n \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> u = umap_of \\ c r u a\\ArrVal\\\\f\\\"\n by (cs_concl cs_simp: prems'(3)[symmetric] cat_cs_simps)\n show \"g = f\" by (rule unique[OF prems'(2) \\g_u])\n qed (auto simp: cat_cs_simps cat_cs_intros)\n\n interpret umof_a: v11 \\umap_of \\ c r u a\\ArrVal\\\\ by (rule umof_a)\n\n show \"\\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\) = Hom \\ c (\\\\ObjMap\\\\a\\)\"\n proof(intro vsubset_antisym)\n from u show \"\\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\) \\\\<^sub>\\ Hom \\ c (\\\\ObjMap\\\\a\\)\"\n by (rule umap_of_ArrVal_vrange)\n show \"Hom \\ c (\\\\ObjMap\\\\a\\) \\\\<^sub>\\ \\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\)\"\n proof(rule vsubsetI, unfold in_Hom_iff )\n fix f assume prems': \"f : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n from bij[OF prems prems'] obtain f' \n where f': \"f' : r \\\\<^bsub>\\\\<^esub> a\" \n and f_def: \"f = umap_of \\ c r u a\\ArrVal\\\\f'\\\"\n by auto\n from is_functor_axioms prems prems' u f' have \n \"f' \\\\<^sub>\\ \\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\)\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from this show \"f \\\\<^sub>\\ \\\\<^sub>\\ (umap_of \\ c r u a\\ArrVal\\)\"\n unfolding f_def by (rule umof_a.vsv_vimageI2)\n qed\n\n qed\n\n qed simp_all\n\n from is_functor_axioms prems r u this show \n \"ntcf_ua_of \\ \\ c r u\\NTMap\\\\a\\ :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ObjMap\\\\a\\ \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\\\<^esub>\n (Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\a\\\"\n by \n (\n cs_concl \n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\n qed\n\nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_ntcf_ua_of_is_iso_ntcf\n\nlemma (in is_functor) cf_ntcf_ua_fo_is_iso_ntcf:\n assumes \"universal_arrow_fo \\ c r u\"\n shows \"ntcf_ua_fo \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,r) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,c) \\\\<^sub>C\\<^sub>F op_cf \\ :\n op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\nproof-\n from universal_arrow_foD[OF assms] have r: \"r \\\\<^sub>\\ \\\\Obj\\\" and c: \"c \\\\<^sub>\\ \\\\Obj\\\"\n by auto\n show ?thesis\n by \n (\n rule is_functor.cf_ntcf_ua_of_is_iso_ntcf\n [\n OF is_functor_op, \n unfolded cat_op_simps, \n OF assms,\n unfolded \n HomDom.cat_op_cat_cf_Hom_snd[OF r] \n HomCod.cat_op_cat_cf_Hom_snd[OF c]\n ntcf_ua_fo_def[symmetric]\n ]\n ) \nqed\n\nlemmas [cat_cs_intros] = is_functor.cf_ntcf_ua_fo_is_iso_ntcf\n\nlemma (in is_functor) cf_ua_of_if_ntcf_ua_of_is_iso_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n and \"ntcf_ua_of \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n shows \"universal_arrow_of \\ c r u\"\nproof(rule universal_arrow_ofI)\n interpret ua_of_u: is_iso_ntcf \n \\ \n \\ \n \\cat_Set \\\\\n \\Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ \n \\Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\\\ \n \\ntcf_ua_of \\ \\ c r u\\\n by (rule assms(3))\n fix r' u' assume prems: \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r'\\\" \n have \"ntcf_ua_of \\ \\ c r u\\NTMap\\\\r'\\ :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ObjMap\\\\r'\\ \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\\\<^esub>\n (Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\r'\\\"\n by (rule is_iso_ntcf.iso_ntcf_is_iso_arr[OF assms(3) prems(1)])\n from this is_functor_axioms assms(1-2) prems have uof_r':\n \"umap_of \\ c r u r' : Hom \\ r r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\\\<^esub> Hom \\ c (\\\\ObjMap\\\\r'\\)\"\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_op_intros)\n note uof_r' = cat_Set_is_iso_arrD[OF uof_r'] \n interpret uof_r': v11 \\umap_of \\ c r u r'\\ArrVal\\\\ by (rule uof_r'(2)) \n from \n uof_r'.v11_vrange_ex1_eq[\n THEN iffD1, unfolded uof_r'(3,4) in_Hom_iff, OF prems(2)\n ] \n show \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r u r'\\ArrVal\\\\f'\\\"\n by metis\nqed (intro assms)+\n\nlemma (in is_functor) cf_ua_fo_if_ntcf_ua_fo_is_iso_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"u : \\\\ObjMap\\\\r\\ \\\\<^bsub>\\\\<^esub> c\"\n and \"ntcf_ua_fo \\ \\ c r u :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,r) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,c) \\\\<^sub>C\\<^sub>F op_cf \\ :\n op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n shows \"universal_arrow_fo \\ c r u\"\nproof-\n from assms(2) have c: \"c \\\\<^sub>\\ \\\\Obj\\\" by auto\n show ?thesis\n by \n (\n rule is_functor.cf_ua_of_if_ntcf_ua_of_is_iso_ntcf\n [\n OF is_functor_op, \n unfolded cat_op_simps,\n OF assms(1,2),\n unfolded \n HomDom.cat_op_cat_cf_Hom_snd[OF assms(1)] \n HomCod.cat_op_cat_cf_Hom_snd[OF c]\n ntcf_ua_fo_def[symmetric],\n OF assms(3)\n ]\n )\nqed\n\nlemma (in is_functor) cf_universal_arrow_of_if_is_iso_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"c \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\ :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n shows \"universal_arrow_of \\ c r (\\\\NTMap\\\\r\\\\ArrVal\\\\\\\\CId\\\\r\\\\)\"\n (is \\universal_arrow_of \\ c r ?u\\)\nproof-\n\n interpret \\: is_iso_ntcf \n \\ \\ \\cat_Set \\\\ \\Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ \\Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\\\ \\\n by (rule assms(3))\n\n show ?thesis\n proof(intro universal_arrow_ofI assms)\n \n from assms(1,2) show u: \"?u : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_cs_simps cat_op_simps cs_intro: cat_cs_intros\n )\n fix r' u' assume prems: \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : c \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\r'\\\"\n have \\r'_ArrVal_app[symmetric, cat_cs_simps]:\n \"\\\\NTMap\\\\r'\\\\ArrVal\\\\f'\\ =\n \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\r\\\\ArrVal\\\\\\\\CId\\\\r\\\\\"\n if \"f' : r \\\\<^bsub>\\\\<^esub> r'\" for f'\n proof-\n have \"\\\\NTMap\\\\r'\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(r,-)\\ArrMap\\\\f'\\ =\n (Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(c,-) \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> \\\\NTMap\\\\r\\\"\n using that by (intro \\.ntcf_Comp_commute)\n then have \n \"\\\\NTMap\\\\r'\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> cf_hom \\ [\\\\CId\\\\r\\, f']\\<^sub>\\ =\n cf_hom \\ [\\\\CId\\\\c\\, \\\\ArrMap\\\\f'\\]\\<^sub>\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub> \\\\NTMap\\\\r\\\" \n using assms(1,2) that prems\n by \n (\n cs_prems cs_shallow \n cs_simp: cat_cs_simps cat_op_simps cs_intro: cat_cs_intros\n )\n then have\n \"(\\\\NTMap\\\\r'\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub>\n cf_hom \\ [\\\\CId\\\\r\\, f']\\<^sub>\\)\\ArrVal\\\\\\\\CId\\\\r\\\\ =\n (cf_hom \\ [\\\\CId\\\\c\\, \\\\ArrMap\\\\f'\\]\\<^sub>\\ \\\\<^sub>A\\<^bsub>cat_Set \\\\<^esub>\n \\\\NTMap\\\\r\\)\\ArrVal\\\\\\\\CId\\\\r\\\\\"\n by simp\n from this assms(1,2) u that show ?thesis\n by\n (\n cs_prems cs_shallow\n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros cat_prod_cs_intros\n )\n qed \n \n show \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = umap_of \\ c r ?u r'\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n from assms prems show \n \"(\\\\NTMap\\\\r'\\)\\\\<^sub>C\\<^bsub>cat_Set \\\\<^esub>\\ArrVal\\\\u'\\ : r \\\\<^bsub>\\\\<^esub> r'\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_arrow_cs_intros\n )\n with assms(1,2) prems show \"u' =\n umap_of \\ c r ?u r'\\ArrVal\\\\(\\\\NTMap\\\\r'\\)\\\\<^sub>C\\<^bsub>cat_Set \\\\<^esub>\\ArrVal\\\\u'\\\\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_arrow_cs_intros cat_cs_intros cat_op_intros\n )\n fix f' assume prems': \n \"f' : r \\\\<^bsub>\\\\<^esub> r'\"\n \"u' = umap_of \\ c r (\\\\NTMap\\\\r\\\\ArrVal\\\\\\\\CId\\\\r\\\\) r'\\ArrVal\\\\f'\\\"\n from prems'(2,1) assms(1,2) have u'_def: \n \"u' = \\\\ArrMap\\\\f'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\NTMap\\\\r\\\\ArrVal\\\\\\\\CId\\\\r\\\\\"\n by\n (\n cs_prems cs_shallow\n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_op_intros\n )\n from prems' show \"f' = (\\\\NTMap\\\\r'\\)\\\\<^sub>C\\<^bsub>cat_Set \\\\<^esub>\\ArrVal\\\\u'\\\"\n unfolding u'_def \\r'_ArrVal_app[OF prems'(1)]\n by\n (\n cs_concl \n cs_simp: cat_cs_simps\n cs_intro: cat_arrow_cs_intros cat_cs_intros cat_op_intros\n )\n\n qed\n\n qed\n\nqed\n\nlemma (in is_functor) cf_universal_arrow_fo_if_is_iso_ntcf:\n assumes \"r \\\\<^sub>\\ \\\\Obj\\\"\n and \"c \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\ :\n Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,r) \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\\\<^esub>\\(-,c) \\\\<^sub>C\\<^sub>F op_cf \\ :\n op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Set \\\"\n shows \"universal_arrow_fo \\ c r (\\\\NTMap\\\\r\\\\ArrVal\\\\\\\\CId\\\\r\\\\)\"\n by\n (\n rule is_functor.cf_universal_arrow_of_if_is_iso_ntcf\n [\n OF is_functor_op,\n unfolded cat_op_simps,\n OF assms(1,2),\n unfolded \n HomDom.cat_op_cat_cf_Hom_snd[OF assms(1)] \n HomCod.cat_op_cat_cf_Hom_snd[OF assms(2)]\n ntcf_ua_fo_def[symmetric],\n OF assms(3)\n ]\n )\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Universal_Constructions/czh_ucategories/CZH_UCAT_Universal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.29462914398004864}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory KBPs\nimports Kripke Traces\nbegin\n(*>*)\n\nsection\\Knowledge-based Programs\\\n\ntext \\\n\n\\label{sec:kbps-theory-kbps-semantics}\n\nA knowledge-based programs (KBPs) encodes the dependency of action on\nknowledge by a sequence of guarded commands, and a \\emph{joint\nknowledge-based program} (JKBP) assigns a KBP to each agent:\n\n\\\n\nrecord ('a, 'p, 'aAct) GC =\n guard :: \"('a, 'p) Kform\"\n action :: \"'aAct\"\n\ntype_synonym ('a, 'p, 'aAct) KBP = \"('a, 'p, 'aAct) GC list\"\ntype_synonym ('a, 'p, 'aAct) JKBP = \"'a \\ ('a, 'p, 'aAct) KBP\"\n\ntext\\\n\nWe use a list of guarded commands just so we can reuse this definition\nand others in algorithmic contexts; we would otherwise use a set as\nthere is no problem with infinite programs or actions, and we always\nignore the sequential structure.\n\nIntuitively a KBP for an agent cannot directly evaluate the truth of\nan arbitrary formula as it may depend on propositions that the agent\nhas no certainty about. For example, a card-playing agent cannot\ndetermine which cards are in the deck, despite being sure that those\nin her hand are not. Conversely agent $a$ can evaluate formulas of the\nform @{term \"\\<^bold>K\\<^sub>a \\\"} as these depend only on the worlds the agent thinks\nis possible.\n\nThus we restrict the guards of the JKBP to be boolean combinations of\n\\emph{subjective} formulas:\n\n\\\n\nfun subjective :: \"'a \\ ('a, 'p) Kform \\ bool\" where\n \"subjective a (Kprop p) = False\"\n| \"subjective a (Knot f) = subjective a f\"\n| \"subjective a (Kand f g) = (subjective a f \\ subjective a g)\"\n| \"subjective a (Kknows a' f) = (a = a')\"\n| \"subjective a (Kcknows as f) = (a \\ set as)\"\n\ntext\\\n\nAll JKBPs in the following sections are assumed to be subjective.\n\nThis syntactic restriction implies the desired semantic property, that\nwe can evaluate a guard at an arbitrary world that is compatible with\na given observation \\citep[\\S3]{DBLP:journals/dc/FaginHMV97}.\n\n\\\n\nlemma S5n_subjective_eq:\n assumes S5n: \"S5n M\"\n assumes subj: \"subjective a \\\"\n assumes ww': \"(w, w') \\ relations M a\"\n shows \"M, w \\ \\ \\ M, w' \\ \\\"\n(*<*)\nusing subj ww'\nproof(induct \\ rule: subjective.induct[case_names Kprop Knot Kand Kknows Kcknows])\n case (Kcknows a as \\)\n hence \"(w, w') \\ (\\a\\set as. relations M a)\\<^sup>+\" by auto\n with Kcknows S5n show ?case by (auto dest: S5n_tc_rels_eq)\nqed (auto dest: S5n_rels_eq[OF S5n])\n\n(*>*)\ntext\\\n\nThe proof is by induction over the formula @{term \"\\\"}, using the\nproperties of $S5_n$ Kripke structures in the knowledge cases.\n\nWe capture the fixed but arbitrary JKBP using a locale, and work in\nthis context for the rest of this section.\n\n\\\n\nlocale JKBP =\n fixes jkbp :: \"('a, 'p, 'aAct) JKBP\"\n assumes subj: \"\\a gc. gc \\ set (jkbp a) \\ subjective a (guard gc)\"\n\ncontext JKBP\nbegin\n\ntext\\\n\nThe action of the JKBP at a world is the list of all actions that are\nenabled at that world:\n\n\\\n\ndefinition jAction :: \"('a, 'p, 'w) KripkeStructure \\ 'w \\ 'a \\ 'aAct list\"\nwhere \"jAction \\ \\M w a. [ action gc. gc \\ jkbp a, M, w \\ guard gc ]\"\n\ntext\\\n\nAll of our machinery on Kripke structures lifts from the models\nrelation of \\S\\ref{sec:kbps-logic-of-knowledge} through @{term\n\"jAction\"}, due to the subjectivity requirement. In particular, the\nKBP for agent $a$ behaves the same at worlds that $a$ cannot\ndistinguish amongst:\n\n\\\n\nlemma S5n_jAction_eq:\n assumes S5n: \"S5n M\"\n assumes ww': \"(w, w') \\ relations M a\"\n shows \"jAction M w a = jAction M w' a\"\n(*<*)\nproof -\n { fix gc assume \"gc \\ set (jkbp a)\"\n with subj have \"subjective a (guard gc)\" by auto\n with S5n ww' have \"M, w \\ guard gc = M, w' \\ guard gc\"\n by - (rule S5n_subjective_eq, simp_all) }\n thus ?thesis\n unfolding jAction_def\n by - (rule arg_cong[where f=concat], simp)\nqed\n(*>*)\n\ntext\\\n\nAlso the JKBP behaves the same on relevant generated models for all\nagents:\n\n\\\n\nlemma gen_model_jAction_eq:\n assumes S: \"gen_model M w = gen_model M' w\"\n assumes w': \"w' \\ worlds (gen_model M' w)\"\n assumes M: \"kripke M\"\n assumes M': \"kripke M'\"\n shows \"jAction M w' = jAction M' w'\"\n(*<*)\n unfolding jAction_def\n by (auto iff: gen_model_eq[OF M M' S w'])\n(*>*)\n\ntext\\\n\nFinally, @{term \"jAction\"} is invariant under simulations:\n\n\\\n\nlemma simulation_jAction_eq:\n assumes M: \"kripke M\"\n assumes sim: \"sim M M' f\"\n assumes w: \"w \\ worlds M\"\n shows \"jAction M w = jAction M' (f w)\"\n(*<*)\n unfolding jAction_def\n using assms by (auto iff: sim_semantic_equivalence)\n(*>*)\n\nend\n\nsection\\Environments and Views\\\n\ntext\\\n\n\\label{sec:kbps-theory-environments}\n\nThe previous section showed how a JKBP can be interpreted statically,\nwith respect to a fixed Kripke structure. As we also wish to capture\nhow agents interact, we adopt the \\emph{interpreted systems} and\n\\emph{contexts} of \\cite{FHMV:1995}, which we term \\emph{environments}\nfollowing \\cite{Ron:1996}.\n\nA \\emph{pre-environment} consists of the following:\n\\begin{itemize}\n\n\\item @{term \"envInit\"}, an arbitrary set of initial states;\n\n\\item The protocol of the environment @{term \"envAction\"}, which\n depends on the current state;\n\n\\item A transition function @{term \"envTrans\"}, which incorporates the\n environment's action and agents' behaviour into a state change; and\n\n\\item A propositional evaluation function @{term \"envVal\"}.\n\n\\end{itemize}\nWe extend the @{term \"JKBP\"} locale with these constants:\n\n\\\n\nlocale PreEnvironment = JKBP jkbp for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n+ fixes envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n\ntext\\\n\n\\label{sec:kbps-views}\n\nWe represent the possible evolutions of the system as finite sequences\nof states, represented by a left-recursive type @{typ \"'s Trace\"} with\nconstructors @{term \"tInit s\"} and @{term \"t \\ s\"}, equipped with\n@{term \"tFirst\"}, @{term \"tLast\"}, @{term \"tLength\"} and @{term\n\"tMap\"} functions.\n\nConstructing these traces requires us to determine the agents' actions\nat a given state. To do so we need to find an appropriate S$5_n$\nstructure for interpreting @{term \"jkbp\"}.\n\nGiven that we want the agents to make optimal use of the information\nthey have access to, we allow these structures to depend on the entire\nhistory of the system, suitably conditioned by what the agents can\nobserve. We capture this notion of observation with a \\emph{view}\n\\citep{Ron:1996}, which is an arbitrary function of a trace:\n\n\\\n\ntype_synonym ('s, 'tview) View = \"'s Trace \\ 'tview\"\ntype_synonym ('a, 's, 'tview) JointView = \"'a \\ 's Trace \\ 'tview\"\n\ntext\\\n\n\\label{sec:kbps-synchrony}\n\nWe require views to be \\emph{synchronous}, i.e. that agents be able to\ntell the time using their view by distinguishing two traces of\ndifferent lengths. As we will see in the next section, this guarantees\nthat the JKBP has an essentially unique implementation.\n\nWe extend the @{term \"PreEnvironment\"} locale with a view:\n\n\\\n\nlocale PreEnvironmentJView =\n PreEnvironment jkbp envInit envAction envTrans envVal\n for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n and envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n+ fixes jview :: \"('a, 's, 'tview) JointView\"\n assumes sync: \"\\a t t'. jview a t = jview a t' \\ tLength t = tLength t'\"\n\ntext\\\n\nThe two principle synchronous views are the clock view and the\nperfect-recall view which we discuss further in\n\\S\\ref{sec:kbps-theory-views}. We will later derive an agent's\nconcrete view from an instantaneous observation of the global state in\n\\S\\ref{sec:kbps-environments}.\n\nWe build a Kripke structure from a set of traces by relating traces\nthat yield the same view. To obtain an S$5_n$ structure we also need a\nway to evaluate propositions: we apply @{term \"envVal\"} to the final\nstate of a trace:\n\n\\\n\ndefinition (in PreEnvironmentJView)\n mkM :: \"'s Trace set \\ ('a, 'p, 's Trace) KripkeStructure\"\nwhere\n \"mkM T \\\n \\ worlds = T,\n relations = \\a. { (t, t') . {t, t'} \\ T \\ jview a t = jview a t' },\n valuation = envVal \\ tLast \\\"\n(*<*)\n\ncontext PreEnvironmentJView\nbegin\n\nlemma mkM_kripke[intro, simp]: \"kripke (mkM T)\"\n unfolding mkM_def by (rule kripkeI) fastforce\n\nlemma mkM_S5n[intro, simp]: \"S5n (mkM T)\"\n unfolding mkM_def\n by (intro S5nI equivI)\n (bestsimp intro: equivI refl_onI symI transI)+\n\nlemma mkM_simps[simp]:\n \"worlds (mkM T) = T\"\n \"\\ (t, t') \\ relations (mkM T) a \\ \\ jview a t = jview a t'\"\n \"\\ (t, t') \\ relations (mkM T) a \\ \\ t \\ T\"\n \"\\ (t, t') \\ relations (mkM T) a \\ \\ t' \\ T\"\n \"valuation (mkM T) = envVal \\ tLast\"\n unfolding mkM_def by simp_all\n\nlemma mkM_rel_length[simp]:\n assumes tt': \"(t, t') \\ relations (mkM T) a\"\n shows \"tLength t' = tLength t\"\nproof -\n from tt' have \"jview a t = jview a t'\" by simp\n thus ?thesis by (bestsimp dest: sync[rule_format])\nqed\n\n(*>*)\ntext\\\n\nThis construction supplants the role of the \\emph{local states} of\n\\citet{FHMV:1995}.\n\nThe following section shows how we can canonically interpret the JKBP\nwith respect to this structure.\n\n\\\n\nsection\\Canonical Structures\\\n\ntext\\\n\n\\label{sec:kbps-canonical-kripke}\n\nOur goal in this section is to find the canonical set of traces for a\ngiven JKBP in a particular environment. As we will see, this always\nexists with respect to synchronous views.\n\nWe inductively define an \\emph{interpretation} of a JKBP with respect\nto an arbitrary set of traces @{term \"T\"} by constructing a sequence\nof sets of traces of increasing length:\n\n\\\n\nfun jkbpTn :: \"nat \\ 's Trace set \\ 's Trace set\"(*<*)(\"jkbpT\\<^bsub>_\\<^esub>\")(*>*) where\n \"jkbpT\\<^bsub>0\\<^esub> T = { tInit s |s. s \\ set envInit }\"\n| \"jkbpT\\<^bsub>Suc n\\<^esub> T = { t \\ envTrans eact aact (tLast t) |t eact aact.\n t \\ jkbpT\\<^bsub>n\\<^esub> T \\ eact \\ set (envAction (tLast t))\n \\ (\\a. aact a \\ set (jAction (mkM T) t a)) }\"\n\ntext\\\n\nThis model reflects the failure of any agent to provide an action as\nfailure of the entire system. In general @{term \"envTrans\"} may\nincorporate a scheduler and communication failure models.\n\nThe union of this sequence gives us a closure property:\n\n\\\n\ndefinition jkbpT :: \"'s Trace set \\ 's Trace set\" where\n \"jkbpT T \\ \\n. jkbpT\\<^bsub>n\\<^esub> T\"\n(*<*)\n\nlemma jkbpTn_length:\n \"t \\ jkbpTn n T \\ tLength t = n\"\n by (induct n arbitrary: t, auto)\n\nlemma jkbpT_tLength_inv:\n \"\\ t \\ jkbpT T; tLength t = n \\ \\ t \\ jkbpTn n T\"\n unfolding jkbpT_def\n by (induct n arbitrary: t) (fastforce simp: jkbpTn_length)+\n\nlemma jkbpT_traces_of_length:\n \"{ t \\ jkbpT T . tLength t = n } = jkbpTn n T\"\n using jkbpT_tLength_inv\n unfolding jkbpT_def by (bestsimp simp: jkbpTn_length)\n\n(*>*)\ntext\\\n\nWe say that a set of traces @{term \"T\"} \\emph{represents} a JKBP if it\nis closed under @{term \"jkbpT\"}:\n\n\\\n\ndefinition represents :: \"'s Trace set \\ bool\" where\n \"represents T \\ jkbpT T = T\"\n(*<*)\n\nlemma representsI:\n \"jkbpT T = T \\ represents T\"\n unfolding represents_def by simp\n\nlemma representsD:\n \"represents T \\ jkbpT T = T\"\n unfolding represents_def by simp\n\n(*>*)\ntext\\\n\nThis is the vicious cycle that we break using our assumption that the\nview is synchronous. The key property of such views is that the\nsatisfaction of an epistemic formula is determined by the set of\ntraces in the model that have the same length. Lifted to @{term\n\"jAction\"}, we have:\n\n\\\n\n(*<*)\nlemma sync_tLength_eq_trc:\n assumes \"(t, t') \\ (\\a\\as. relations (mkM T) a)\\<^sup>*\"\n shows \"tLength t = tLength t'\"\n using assms by (induct rule: rtrancl_induct) auto\n\nlemma sync_gen_model_tLength:\n assumes traces: \"{ t \\ T . tLength t = n } = { t \\ T' . tLength t = n }\"\n and tT: \"t \\ { t \\ T . tLength t = n }\"\n shows \"gen_model (mkM T) t = gen_model (mkM T') t\"\n apply(rule gen_model_subset[where T=\"{ t \\ T . tLength t = n }\"])\n apply simp_all\n\n (* t \\ T and t \\ T' *)\n prefer 4\n using tT\n apply simp\n prefer 4\n using tT traces\n apply simp\n\n apply (unfold mkM_def)[1]\n using tT traces\n apply (auto)[1]\n\n using tT\n apply (auto dest: sync_tLength_eq_trc[where as=UNIV] kripke_rels_trc_worlds)[1]\n\n using tT traces\n apply (auto dest: sync_tLength_eq_trc[where as=UNIV] kripke_rels_trc_worlds)[1]\n\n done\n\n(*>*)\nlemma sync_jview_jAction_eq:\n assumes traces: \"{ t \\ T . tLength t = n } = { t \\ T' . tLength t = n }\"\n assumes tT: \"t \\ { t \\ T . tLength t = n }\"\n shows \"jAction (mkM T) t = jAction (mkM T') t\"\n(*<*)\n apply (rule gen_model_jAction_eq[where w=t])\n apply (rule sync_gen_model_tLength)\n using assms\n apply (auto intro: gen_model_world_refl)\n done\n\n(*>*)\ntext\\\n\nThis implies that for a synchronous view we can inductively define the\n\\emph{canonical traces} of a JKBP. These are the traces that a JKBP\ngenerates when it is interpreted with respect to those very same\ntraces. We do this by constructing the sequence \\jkbpC\\<^sub>n\\ of\n\\emph{(canonical) temporal slices} similarly to @{term \"jkbpT\\<^bsub>n\\<^esub>\"}:\n\n\\\n\nfun jkbpCn :: \"nat \\ 's Trace set\"(*<*)(\"jkbpC\\<^bsub>_\\<^esub>\")(*>*) where\n \"jkbpC\\<^bsub>0\\<^esub> = { tInit s |s. s \\ set envInit }\"\n| \"jkbpC\\<^bsub>Suc n\\<^esub> = { t \\ envTrans eact aact (tLast t) |t eact aact.\n t \\ jkbpC\\<^bsub>n\\<^esub> \\ eact \\ set (envAction (tLast t))\n \\ (\\a. aact a \\ set (jAction (mkM jkbpC\\<^bsub>n\\<^esub>) t a)) }\"\n\nabbreviation MCn :: \"nat \\ ('a, 'p, 's Trace) KripkeStructure\"(*<*)(\"MC\\<^bsub>_\\<^esub>\")(*>*) where\n \"MC\\<^bsub>n\\<^esub> \\ mkM jkbpC\\<^bsub>n\\<^esub>\"\n(*<*)\n\nlemma jkbpCn_step_inv:\n \"t \\ s \\ jkbpCn (Suc n) \\ t \\ jkbpCn n\"\n by (induct n arbitrary: t, (fastforce simp add: Let_def)+)\n\nlemma jkbpCn_length[simp]:\n \"t \\ jkbpCn n \\ tLength t = n\"\n by (induct n arbitrary: t, (fastforce simp add: Let_def)+)\n\nlemma jkbpCn_init_inv[intro]:\n \"tInit s \\ jkbpCn n \\ s \\ set envInit\"\n by (frule jkbpCn_length) auto\n\nlemma jkbpCn_tFirst_init_inv[intro]:\n \"t \\ jkbpCn n \\ tFirst t \\ set envInit\"\n by (induct n arbitrary: t) (auto iff: Let_def)\n\n(*>*)\ntext\\\n\nThe canonical set of traces for a JKBP with respect to a joint view is\nthe set of canonical traces of all lengths.\n\n\\\n\ndefinition jkbpC :: \"'s Trace set\" where\n \"jkbpC \\ \\n. jkbpC\\<^bsub>n\\<^esub>\"\n\nabbreviation MC :: \"('a, 'p, 's Trace) KripkeStructure\" where\n \"MC \\ mkM jkbpC\"\n(*<*)\n\nlemma jkbpCn_jkbpC_subset:\n \"jkbpCn n \\ jkbpC\"\n unfolding jkbpC_def by blast\n\nlemma jkbpCn_jkbpC_inc[intro]:\n \"t \\ jkbpCn n \\ t \\ jkbpC\"\n unfolding jkbpC_def by best\n\nlemma jkbpC_tLength_inv[intro]:\n \"\\ t \\ jkbpC; tLength t = n \\ \\ t \\ jkbpCn n\"\n unfolding jkbpC_def\n by (induct n arbitrary: t, (fastforce simp add: Let_def)+)\n\nlemma jkbpC_traces_of_length:\n \"{ t \\ jkbpC . tLength t = n } = jkbpCn n\"\n unfolding jkbpC_def by bestsimp\n\nlemma jkbpC_prefix_closed[dest]:\n \"t \\ s \\ jkbpC \\ t \\ jkbpC\"\n apply (drule jkbpC_tLength_inv)\n apply simp\n apply (auto iff: Let_def jkbpC_def)\n done\n\nlemma jkbpC_init[iff]:\n \"tInit s \\ jkbpC \\ s \\ set envInit\"\n unfolding jkbpC_def\n apply rule\n apply fast\n apply (subgoal_tac \"tInit s \\ jkbpCn 0\")\n apply simp\n apply (rule_tac x=0 in exI)\n apply simp_all\n done\n\nlemma jkbpC_jkbpCn_rels:\n \"\\ (u, v) \\ relations MC a; tLength u = n \\\n \\ (u, v) \\ relations (MC\\<^bsub>n\\<^esub>) a\"\n unfolding mkM_def by (fastforce dest: sync[rule_format])\n\nlemma jkbpC_tFirst_init_inv[intro]:\n \"t \\ jkbpC \\ tFirst t \\ set envInit\"\n unfolding jkbpC_def by blast\n\n(*>*)\ntext\\\n\nWe can show that @{term \"jkbpC\"} represents the joint knowledge-based\nprogram @{term \"jkbp\"} with respect to @{term \"jview\"}:\n\n\\\n\nlemma jkbpC_jkbpCn_jAction_eq:\n assumes tCn: \"t \\ jkbpC\\<^bsub>n\\<^esub>\"\n shows \"jAction MC t = jAction MC\\<^bsub>n\\<^esub> t\"\n(*<*)\n using assms\n by - (rule sync_jview_jAction_eq, auto iff: jkbpC_traces_of_length)\n\n(*>*)\ntext\\\\\n\n\n\ntext\\\\\n\ntheorem jkbpC_represents: \"represents jkbpC\"\n(*<*)\n using jkbpTn_jkbpCn_represents\n by (simp add: representsI jkbpC_def jkbpT_def)\n\n(*>*)\ntext\\\n\nWe can show uniqueness too, by a similar argument:\n\n\\\n\ntheorem jkbpC_represents_uniquely:\n assumes repT: \"represents T\"\n shows \"T = jkbpC\"\n(*<*)\nproof -\n { fix n\n have \"{ t \\ T . tLength t = n } = { t \\ jkbpC . tLength t = n }\"\n proof(induct n)\n case 0\n from repT have F: \"{t \\ T. tLength t = 0} = jkbpTn 0 T\"\n by - (subst jkbpT_traces_of_length[symmetric], simp add: representsD)\n thus ?case by (simp add: jkbpC_traces_of_length)\n next\n case (Suc n)\n hence indhyp: \"{t \\ T. tLength t = n} = jkbpCn n\"\n by (simp add: jkbpC_traces_of_length)\n\n (* F and H are very similar. *)\n from repT have F: \"\\n. jkbpTn n T = {t \\ T. tLength t = n}\"\n by - (subst jkbpT_traces_of_length[symmetric], simp add: representsD)\n from indhyp F have G: \"jkbpTn n T = jkbpCn n\"\n by simp\n from repT have H: \"\\n. {t \\ T. tLength t = n} = {t \\ jkbpTn n T. tLength t = n}\"\n by (subst representsD[OF repT, symmetric], auto iff: jkbpT_traces_of_length jkbpTn_length)\n from F indhyp have ACTS:\n \"\\t. t \\ jkbpTn n T\n \\ jAction (mkM T) t = jAction (MCn n) t\"\n by - (rule sync_jview_jAction_eq[where n=\"n\"], auto)\n show ?case\n apply (auto iff: Let_def ACTS G H jkbpC_traces_of_length)\n apply blast+\n done\n qed }\n thus ?thesis by auto\nqed\n(*>*)\n\nend (* context PreEnvironmentJView *)\n\ntext\\\n\nThus, at least with synchronous views, we are justified in talking\nabout \\emph{the} representation of a JKBP in a given environment. More\ngenerally these results are also valid for the more general notion of\n\\emph{provides witnesses} as shown by \\citet[Lemma 7.2.4]{FHMV:1995}\nand \\citet{DBLP:journals/dc/FaginHMV97}: it requires only that if a\nsubjective knowledge formula is false on a trace then there is a trace\nof the same length or less that bears witness to that effect. This is\na useful generalisation in asynchronous settings.\n\nThe next section shows how we can construct canonical representations\nof JKBPs using automata.\n\n\\\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/KBPs/KBPs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.29462913608814545}} {"text": "theory ReduceExp\n imports SRRead\nbegin\n\n (*\n --- OVERVIEW ---\n 1. expression syntax\n 2. free variables / reduction\n 4. type system for expressions\n 4. disjoint environments [disj_env]\n 5. well-typed value lemmas [is_value, env_level, max_env_level]\n 6. well-typed s-expression lemmas [is_sexp, env_level, max_env_level]\n 7. well-typed free var lemmas [well_typed, free_vars]\n 8. well-typed manipulation lemmas [well_typed, add_env, rem_env, comb_env]\n *)\n\n \n (* \n ####################################\n P3. reduction\n ####################################\n *) \n \n (* memory values *)\n \ndatatype mem_value =\n ArrValue \"p_exp list\"\n | ChanSValue\n | ChanRValue string\n (* true if unique, false otherwise *)\n (*| PairValue p_exp p_exp*) (*p_aff*) \n \ntype_synonym p_state = \"mem_value gen_env\" \n \nfun app_op :: \"p_op \\ p_const \\ p_exp \\ bool\" where\n \"app_op (I2Op f2) c e' = (\\ i. c = IConst i \\ e' = OpExp (I1Op (f2 i)))\"\n| \"app_op (I1Op f1) c e' = (\\ i. c = IConst i \\ e' = ConstExp (IConst (f1 i)))\"\n| \"app_op (C2Op f2) c e' = (\\ i. c = IConst i \\ e' = OpExp (C1Op (f2 i)))\"\n| \"app_op (C1Op f1) c e' = (\\ i. c = IConst i \\ e' = ConstExp (BConst (f1 i)))\"\n| \"app_op (R2Op f2) c e' = (\\ b. c = BConst b \\ e' = OpExp (R1Op (f2 b)))\"\n| \"app_op (R1Op f1) c e' = (\\ b. c = BConst b \\ e' = ConstExp (BConst (f1 b)))\"\n \nfun new_array_dat :: \"int \\ 'a \\ 'a list\" where\n \"new_array_dat i v = (if i \\ 0 then [] else v # (new_array_dat (i - 1) v))\" \n \ndefinition new_array :: \"int \\ p_exp \\ mem_value\" where\n \"new_array i v = (ArrValue (new_array_dat i v))\" \n \nfun read_array where\n \"read_array [] i = None\"\n| \"read_array (v # t) i = (if i = 0 then Some v else read_array t (i - 1))\"\n \nfun write_array where\n \"write_array [] i v' = None\"\n| \"write_array (v # t) i v' = (if i = 0 then Some (v' # t) else (case (write_array t (i - 1) v') of\n None \\ None\n | Some t' \\ Some (v # t')\n ))\"\n \n (* in order to ensure that ownership transfer is safe, we require aggressive removal of permissions once\n they are no longer needed. for this reason, every use is tracked as an action. *)\ndatatype p_act =\n (* - nothing *)\n NoAct\n (* - new resource, ##resources consumed to create the resource *)\n | MakeAct string (*\"string set\"*)\n | Mk2Act string string\n (* - resource used, ##resources transferred to the resource *)\n | UseAct string (*\"string set\"*)\n \nfun ext_list where\n \"ext_list [] v = [v]\"\n| \"ext_list (v' # t) v = v' # (ext_list t v)\" \n \n \nfun app_con :: \"p_state \\ p_const \\ p_exp \\ p_act \\ p_state \\ p_exp \\ bool\" where\n \"app_con s EmptyArrayConst v ax (s', e') = (\\ a. ax = MakeAct a \\ v = ConstExp UnitConst \\\n e' = VarExp a SelfRef \\ s' = add_env s a (ArrValue []) \\ fresh_var s a\n )\"\n| \"app_con s NewChanConst v ax (s', e') = (\\ c_s c_r. ax = Mk2Act c_s c_r \\ v = ConstExp UnitConst \\\n e' = (PairExp (VarExp c_s SelfRef) (VarExp c_r SelfRef)) \\ s' = add_env (add_env s c_s ChanSValue) c_r (ChanRValue c_s) \\\n fresh_var s c_s \\ fresh_var s c_r \\ c_s \\ c_r)\"\n| \"app_con s UnpackConst v ax (s', e') = (\\ v1 v2 f. ax = NoAct \\ v = PairExp v1 v2 \\ s' = s \\\n e' = (LamExp f (AppExp (AppExp (VarExp f NoRef) v1) v2)) \\ f \\ free_vars v \\ f \\ ref_vars v)\"\n(*\n| \"app_con s ReadConst e ax (s', e') = (\\ x a i v arr. ax = UseAct x \\ ack_full_exp x v e' \\\n e = PairExp (VarExp x a) (ConstExp (IConst i)) \\\n s (deref_name x a) = Some (ArrValue arr) \\ read_array arr i = Some v \\ s' = s\n )\"\n| \"app_con s ExtArrayConst e ax (s', e') = (\\ x a v arr. ax = UseAct x \\\n e = PairExp (VarExp x a) v \\ is_value v \\ s (deref_name x a) = Some (ArrValue arr) \\\n e' = VarExp x a \\ s' = add_env s (deref_name x a) (ArrValue (ext_list arr v))\n )\" *)\n \n (*\n| \"app_con s PairConst v ax (s', e') = (\\ p. ax = MakeAct p \\\n e' = VarExp p True \\ s' = add_mem s p (LValue v) \\ fresh_var s p)\"\n\n\n| \"app_con s WriteConst (VarExp x True) NoAct (s', e') = (\\ x2 a i v arr arr'. e' = ConstExp UnitConst \\\n s x = Some (PairValue (VarExp x2 True) v) \\ s x2 = Some (PairValue (VarExp a True) (ConstExp (IConst i))) \\\n s a = Some (ArrValue arr) \\ Some arr' = write_array arr i v \\ s' = add_mem s a (ArrValue arr')\n )\"*)\n| \"app_con s c v a (s', e') = False\"\n \ndefinition unit_exp where\n \"unit_exp = ConstExp UnitConst\" \n \nfun app_cv :: \"p_state \\ p_const \\ p_exp \\ p_exp \\ p_act \\ p_state \\ p_exp \\ bool\" where\n \"app_cv s ReadConst e ix ax (s', e') = (\\ x a i v arr. e = VarExp x a \\ ix = ConstExp (IConst i) \\\n ax = UseAct x \\ s (deref_name x a) = Some (ArrValue arr) \\\n read_array arr i = Some v \\ ack_full_exp x v e' \\ s' = s)\"\n| \"app_cv s ExtArrayConst e v ax (s', e') = (\\ x a arr. e = VarExp x a \\\n ax = UseAct x \\ s (deref_name x a) = Some (ArrValue arr) \\\n e' = e \\ s' = add_env s (deref_name x a) (ArrValue (ext_list arr v)))\"\n| \"app_cv s WriteConst e p ax (s', e') = (\\ x a i v arr arr'. e = VarExp x a \\\n p = PairExp (ConstExp (IConst i)) v \\ ax = UseAct x \\\n s (deref_name x a) = Some (ArrValue arr) \\ Some arr' = write_array arr i v \\\n e' = unit_exp \\ s' = add_env s (deref_name x a) (ArrValue arr'))\"(*\n| \"app_cv s UnpackConst f p ax (s', e') = (\\ v1 v2. v1 = f \\ p = PairExp v1 v2 \\\n ax = NoAct \\ s' = s \\ e' = AppExp (AppExp f v1) v2)\"*)\n\n| \"app_cv s c v1 v2 ax (s', e') = False\" \n \n \ndatatype app_act =\n LamApp\n | FixApp\n | ConstApp\n | OpApp\n | IfApp1\n | IfApp2\n | CVApp\n (*| UnpackApp*)\n \nfun app_red_exp :: \"app_act \\ p_state \\ p_exp \\ p_act \\ p_state \\ p_exp \\ bool\" where\n \"app_red_exp LamApp (s, e) a (s', e') = (\\ x ex v.\n e = AppExp (LamExp x ex) v \\ a = NoAct \\ is_value v \\ safe_subst_exp ex x v e' \\ s = s')\"\n| \"app_red_exp FixApp (s, e) a (s', e') = (\\ x ex. e = AppExp (ConstExp FixConst) (LamExp x ex) \\\n a = NoAct \\ safe_subst_exp ex x (AppExp (ConstExp FixConst) (LamExp x ex)) e' \\ s = s')\"\n| \"app_red_exp OpApp (s, e) a (s', e') = (\\ xop c. e = AppExp (OpExp xop) (ConstExp c) \\\n a = NoAct \\ app_op xop c e' \\ s = s')\"\n| \"app_red_exp ConstApp (s, e) a (s', e') = (\\ c v. e = AppExp (ConstExp c) v \\\n is_value v \\ app_con s c v a (s', e'))\"\n| \"app_red_exp CVApp (s, e) a (s', e') = (\\ c v1 v2. e = AppExp (AppExp (ConstExp c) v1) v2 \\\n bin_const c \\ is_value v1 \\ is_value v2 \\ app_cv s c v1 v2 a (s', e'))\"\n (*\n| \"app_red_exp UnpackApp (s, e) a (s', e') = (\\ f v1 v2. e = AppExp (AppExp (ConstExp UnpackConst) f) (PairExp v1 v2) \\\n a = NoAct \\ is_value f \\ is_value v1 \\ is_value v2 \\ s' = s \\ e' = AppExp (AppExp f v1) v2)\" *)\n| \"app_red_exp IfApp1 (s, e) a (s', e') = (\\ e1 e2. e = IfExp (ConstExp (BConst True)) e1 e2 \\\n a = NoAct \\ e' = e1 \\ s = s')\"\n| \"app_red_exp IfApp2 (s, e) a (s', e') = (\\ e1 e2. e = IfExp (ConstExp (BConst False)) e1 e2 \\\n a = NoAct \\ e' = e2 \\ s = s')\"\n \n (*\nfun red_exp :: \"p_state \\ p_exp \\ p_act \\ p_state \\ p_exp \\ bool\" where\n \"red_exp (s, e) a (s', e') = (app_red_exp (s, e) a (s', e') \\ (case e of\n AppExp e1 e2 \\ (\\ e2'. AppExp e1 e2' = e' \\ red_exp (s, e2) a (s', e2')) \\\n (\\ e1'. AppExp e1' e2 = e' \\ red_exp (s, e1) a (s', e1'))\n | other \\ False\n ))\"*) \n \n (* ##### basic reduction lemmas ##### *)\n (*\nlemma app_red_exp_contain_env: \"\\ app_red_exp are (s1, e1) ax (s2, e2) \\ \\ contain_env s2 s1\"\n apply (case_tac are)\n apply (auto)\n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac add_contain_env)\n apply (simp add: fresh_var_def)\n apply (rule_tac add_contain_env)\n \n \n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n done *)\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ReduceExp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2945399082458839}} {"text": "section \\ Designs parallel-by-merge \\\n\ntheory utp_des_parallel\n imports utp_des_prog\nbegin\n\nsubsection \\ Definitions \\\n\ntext \\ We introduce the parametric design merge, which handles merging of the $ok$ variables, and\n leaves the other variables to the parametrised \"inner\" merge predicate. As expected, a parallel\n composition of designs can diverge whenever one of its arguments can. \\\n\ndefinition des_merge :: \"(('\\, '\\, '\\) mrg, '\\) urel \\ (('\\ des, '\\ des, '\\ des) mrg, '\\ des) urel\" (\"\\<^bold>D\\<^bold>M'(_')\") where\n[upred_defs]: \"\\<^bold>D\\<^bold>M(M) \\ (($0:ok \\ $1:ok \\ $ok\\ \\ $\\<^bold>v\\<^sub>D:0\\ =\\<^sub>u $0:\\<^bold>v\\<^sub>D \\ $\\<^bold>v\\<^sub>D:1\\ =\\<^sub>u $1:\\<^bold>v\\<^sub>D \\ $\\<^bold>v\\<^sub>D:<\\ =\\<^sub>u $<:\\<^bold>v\\<^sub>D) ;; (true \\\\<^sub>n M))\"\n\ntext \\ Parallel composition is then defined via the above merge predicate and the standard UTP\n parallel-by-merge operator. \\\n\nabbreviation\n dpar_by_merge :: \"('\\, '\\) rel_des \\ (('\\, '\\, '\\) mrg, '\\) urel \\ ('\\, '\\) rel_des \\ ('\\, '\\) rel_des\" \n (\"_ \\\\<^sup>D\\<^bsub>_\\<^esub> _\" [85,0,86] 85)\n where \"P \\\\<^sup>D\\<^bsub>M\\<^esub> Q \\ P \\\\<^bsub>\\<^bold>D\\<^bold>M(M)\\<^esub> Q\"\n\nsubsection \\ Theorems \\\n\ntext \\ The design merge predicate is symmetric up to the inner merge predicate. \\\n\nlemma swap_des_merge: \"swap\\<^sub>m ;; \\<^bold>D\\<^bold>M(M) = \\<^bold>D\\<^bold>M(swap\\<^sub>m ;; M)\"\n by (rel_auto)\n\ntext \\ The following laws explain the meaning of a merge of two normal (@{term H3}) designs. \n The postcondition is straightforward: we simply distribute the inner merge. However, the \n precondition is more complex. We'd be forgiven for thinking it would simply be $p \\wedge q$, but\n this does not account for the possibility of miraculous behaviour in either argument. When this\n occurs, divergence is effectively overshadowed by miraculous behaviour, and so the precondition\n needs to involve the relational preconditions of both the design commitments ($P$ and $Q$). \\\n\nlemma ndes_par_aux: \n \"(p \\\\<^sub>n P) \\\\<^sup>D\\<^bsub>M\\<^esub> (q \\\\<^sub>n Q) =(\\ Pre(\\ p\\<^sup>< \\ (q\\<^sup>< \\ Q)) \\ \\ Pre(\\ q\\<^sup>< \\ (p\\<^sup>< \\ P))) \\\\<^sub>n (P \\\\<^bsub>M\\<^esub> Q)\"\nproof -\n have p2: \"(\\p \\\\<^sub>n P\\\\<^sub>0 \\ \\q \\\\<^sub>n Q\\\\<^sub>1 \\ $<\\ =\\<^sub>u $\\<^bold>v) ;; \n ($0:ok \\ $1:ok \\ $ok\\ \\ $\\<^bold>v\\<^sub>D:0\\ =\\<^sub>u $0:\\<^bold>v\\<^sub>D \\ $\\<^bold>v\\<^sub>D:1\\ =\\<^sub>u $1:\\<^bold>v\\<^sub>D \\ $\\<^bold>v\\<^sub>D:<\\ =\\<^sub>u $<:\\<^bold>v\\<^sub>D)\n = (\\ Pre(\\ p\\<^sup>< \\ (q\\<^sup>< \\ Q)) \\ \\ Pre(\\ q\\<^sup>< \\ (p\\<^sup>< \\ P))) \\\\<^sub>n (\\P\\\\<^sub>0 \\ \\Q\\\\<^sub>1 \\ $<:\\<^bold>v\\ =\\<^sub>u $\\<^bold>v)\"\n by (rel_auto, metis+)\n show ?thesis \n by (simp add: des_merge_def par_by_merge_alt_def seqr_assoc[THEN sym] ndesign_composition_wp wp p2)\nqed\n\nlemma ndes_par [ndes_simp]: \n \"(p \\\\<^sub>n P) \\\\<^sup>D\\<^bsub>M\\<^esub> (q \\\\<^sub>n Q) =((p \\ q \\ \\Pre(Q)) \\ (q \\ p \\ \\Pre(P))) \\\\<^sub>n (P \\\\<^bsub>M\\<^esub> Q)\"\n by (simp add: ndes_par_aux, rel_auto)\n\nlemma ndes_par_wlp: \n \"(p \\\\<^sub>n P) \\\\<^sup>D\\<^bsub>M\\<^esub> (q \\\\<^sub>n Q) =((p \\ q \\ Q wlp false) \\ (q \\ p \\ P wlp false)) \\\\<^sub>n (P \\\\<^bsub>M\\<^esub> Q)\"\n by (simp add: ndes_par_aux, rel_auto)\n\ntext \\ If the commitments are both total relations, then we do indeed get a precondition of simply\n $p \\wedge q$. \\\n\nlemma ndes_par_total: \n assumes \"Pre(P) = true\" \"Pre(Q) = true\"\n shows \"(p \\\\<^sub>n P) \\\\<^sup>D\\<^bsub>M\\<^esub> (q \\\\<^sub>n Q) =(p \\ q) \\\\<^sub>n (P \\\\<^bsub>M\\<^esub> Q)\"\n by (simp add: ndes_par assms)\n\nlemma ndes_par_assigns: \"(p\\<^sub>1 \\\\<^sub>n \\\\\\\\<^sub>a) \\\\<^sup>D\\<^bsub>M\\<^esub> (q\\<^sub>1 \\\\<^sub>n \\\\\\\\<^sub>a) = (p\\<^sub>1 \\ q\\<^sub>1) \\\\<^sub>n (\\\\\\\\<^sub>a \\\\<^bsub>M\\<^esub> \\\\\\\\<^sub>a)\" (is \"?lhs = ?rhs\")\n by (rule ndes_par_total, simp_all add: Pre_assigns)\n\nlemma ndes_par_H1_H3_closed [closure]: \n assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n shows \"P \\\\<^sup>D\\<^bsub>M\\<^esub> Q is \\<^bold>N\"\n by (metis assms ndes_par ndesign_H1_H3 ndesign_form)\n\nlemma ndes_par_commute:\n \"P \\\\<^sup>D\\<^bsub>swap\\<^sub>m ;; M\\<^esub> Q = Q \\\\<^sup>D\\<^bsub>M\\<^esub> P\"\n by (metis par_by_merge_commute_swap swap_des_merge)\n\nlemma ndes_merge_miracle:\n assumes \"P is \\<^bold>N\"\n shows \"P \\\\<^sup>D\\<^bsub>M\\<^esub> \\\\<^sub>D = \\\\<^sub>D\"\n by (ndes_simp cls: assms, simp add: prepost)\n\nlemma ndes_merge_chaos:\n assumes \"P is \\<^bold>N\" \"Pre(post\\<^sub>D(P)) = true\"\n shows \"P \\\\<^sup>D\\<^bsub>M\\<^esub> \\\\<^sub>D = \\\\<^sub>D\"\nproof -\n obtain p\\<^sub>1 P\\<^sub>2 where \"P = p\\<^sub>1 \\\\<^sub>n P\\<^sub>2\"\n by (metis assms(1) ndesign_form)\n with assms(2) show ?thesis\n by (simp add: ndes_simp, rel_auto)\nqed\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/designs/utp_des_parallel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.2945399082458839}} {"text": "(* Title: JinjaThreads/JVM/JVMExceptions.thy\n Author: Gerwin Klein, Martin Strecker, Andreas Lochbihler\n*)\n\nsection \\Exception handling in the JVM\\\n\ntheory JVMExceptions\nimports\n JVMInstructions\nbegin\n\nabbreviation Any :: \"cname option\"\nwhere \"Any \\ None\"\n\ndefinition matches_ex_entry :: \"'m prog \\ cname \\ pc \\ ex_entry \\ bool\"\nwhere\n \"matches_ex_entry P C pc xcp \\\n let (s, e, C', h, d) = xcp in\n s \\ pc \\ pc < e \\ (case C' of None \\ True | \\C''\\ \\ P \\ C \\\\<^sup>* C'')\"\n\n\nprimrec\n match_ex_table :: \"'m prog \\ cname \\ pc \\ ex_table \\ (pc \\ nat) option\"\nwhere\n \"match_ex_table P C pc [] = None\"\n| \"match_ex_table P C pc (e#es) = (if matches_ex_entry P C pc e\n then Some (snd(snd(snd e)))\n else match_ex_table P C pc es)\"\n\nabbreviation ex_table_of :: \"'addr jvm_prog \\ cname \\ mname \\ ex_table\"\nwhere \"ex_table_of P C M == snd (snd (snd (the (snd (snd (snd(method P C M)))))))\"\n\nlemma match_ex_table_SomeD:\n \"match_ex_table P C pc xt = Some (pc',d') \\ \n \\(f,t,D,h,d) \\ set xt. matches_ex_entry P C pc (f,t,D,h,d) \\ h = pc' \\ d=d'\"\n by (induct xt) (auto split: if_split_asm)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/JVM/JVMExceptions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.29449895007702226}} {"text": "theory IMP_Minus_To_SAT\n imports \"IMP_Minus_To_SAS_Plus\" \"Verified_SAT_Based_AI_Planning.SAT_Solve_SAS_Plus\"\n \"../Complexity_classes/Cook_Levin\" \"IMP_Minus.Max_Constant\"\nbegin\n\nsection \\Translation from IMP- to SAT\\\n\ntext \\In this theory the translations `from IMP- to SAS+`\n and `SAS+ to SAT` are composed and the `main_lemma` for\n the Cook_Levin theorem is proven correct.\\\n\n\nsubsection \\The partial steps:\\\n\ntext \\theorems about the translation from IMP- to SAS+\\\nthm SAS_Plus_to_IMP_Minus_correctness\n\nthm IMP_Minus_to_SAS_Plus_correctness\n\n\ntext \\theorem about the translation from SAS+ to SAT\\\nthm sas_plus_problem_has_serial_solution_iff\n\n(* TODO: use that *)\nterm Sema.sat\n\n\nsubsection \\Putting things together\\\n\ntext \\Putting things together works in three steps:\n \\<^item> first we put together the transformations on the HOL level\n \\<^item> then we synthesize a IMP- program that refines the HOL algorithm\n \\<^item> then we instantiate the Cook_Levin locale\\\n\nsubsubsection \\Putting things together on the HOL level\\\n\ndefinition encode_sat :: \"_ \\ nat\" where\n \"encode_sat F = undefined\"\n\n\nlemma valid_problem: \"is_valid_problem_sas_plus (IMP_Minus_to_SAS_Plus c I r G t)\"\n using SAS_Plus_Plus_To_SAS_Plus_valid[OF imp_minus_minus_to_sas_plus_valid]\n by (auto simp: IMP_Minus_to_SAS_Plus_def Let_def)\n\nlemma while_program_has_model:\n assumes \n \"I \\\\<^sub>m Some \\ s1\"\n \"finite (range s1)\"\n (*Mohammad: The next assumption has to be fixed in IMP_Minus_to_SAS_Plus_correctness*)\n \"Max (range s1) < r\"\n \"G \\\\<^sub>m Some \\ s2\"\n \"(c, s1) \\\\<^bsup> t \\<^esup> s2\"\n \"t \\ t'\"\n shows \n (*Mohammad: there is still a problem with this theorem, namely, the generated formula is still\n parameterised by the specific running time 't'.\n This can only be fixed by generalising IMP_Minus_to_SAS_Plus_correctness *)\n \"\\\\. \\ \\ \\\\<^sub>\\ (\\ prob_with_noop (IMP_Minus_to_SAS_Plus c I r G t'))\n 100 * (max_input_bits c I r + t' + 1) * (t' - 1) +\n (max_input_bits c I r + t' + 2) *\n (num_variables c + 2) + 52\"\n (is \"\\_. _ \\ \\\\<^sub>\\ _ (?b::nat)\")\nproof-\n obtain plan where plan:\n \"length plan \\ ?b\"\n \"SAS_Plus_Semantics.is_serial_solution_for_problem (IMP_Minus_to_SAS_Plus c I r G t') plan\"\n using assms(6) le_trans IMP_Minus_to_SAS_Plus_correctness[OF assms(1-5)]\n by (smt group_cancel.add1 one_add_one)\n thus ?thesis\n using sas_plus_problem_has_serial_solution_iff_ii'[OF valid_problem plan(2,1)]\n by auto\nqed\n\nlemma if_there_is_model_then_program_terminates:\n assumes \n \"dom I \\ set (Max_Constant.all_variables c)\"\n \"dom G \\ set (Max_Constant.all_variables c)\"\n \"Max (ran G) < 2 ^ (t + max_input_bits c I r)\"\n (* Mohammad: The following assumption cannot be true for many verifiers. s1 has to depend on I \n , otherwise the assumption is vacuous.*)\n \"\\s1. I \\\\<^sub>m Some \\ s1 \\ \\s2. \\t' \\ t. (c, s1) \\\\<^bsup>t'\\<^esup> s2\"\n \"\\ \\ \\\\<^sub>\\ (\\ prob_with_noop (IMP_Minus_to_SAS_Plus c I r G t))\n 100 * (max_input_bits c I r + t + 1) * (t - 1) +\n (max_input_bits c I r + t + 2) *\n (num_variables c + 2) + 52\"\n shows \"\\s1 s2 t'. t' \\ t \\ I \\\\<^sub>m Some \\ s1 \\ G \\\\<^sub>m Some \\ s2 \\ (c, s1) \\\\<^bsup>t'\\<^esup> s2\"\nproof-\n obtain plan\n where \"SAS_Plus_Semantics.is_serial_solution_for_problem (IMP_Minus_to_SAS_Plus c I r G t) plan\"\n using sas_plus_problem_has_serial_solution_iff_i'[OF valid_problem assms(5)] \n by rule\n thus ?thesis\n using assms\n by(auto intro: SAS_Plus_to_IMP_Minus_correctness)\nqed\n\ndefinition t' ::\"(nat \\ nat) \\ (nat\\ nat) \\ nat \\ nat\"\n where \"t' pt p_cer x = (make_mono pt) (bit_length x + (make_mono p_cer) (bit_length x)) + 1\"\n\n definition imp_to_sat :: \"Com.com \\ (nat \\ nat) \\ (nat\\ nat) \\ nat \\ sat_plan_formula\" where\n \"imp_to_sat c pt p_cer x =\n (let I = (Map.empty)(''input'' \\ x); \n G = (Map.empty)(''input'' \\ 0);\n guess_range = x + 1 + 2 * 2 ^ (p_cer (bit_length x));\n max_bits = max_input_bits c I guess_range\n in\n \\\\<^sub>\\ (\\ prob_with_noop (IMP_Minus_to_SAS_Plus c I guess_range G (t' pt p_cer x)))\n 100 * (max_bits + (t' pt p_cer x) + 1) * ((t' pt p_cer x) - 1) +\n (max_bits + (t' pt p_cer x) + 2) * (num_variables c + 2) + 52)\"\n\nlemma main_lemma_hol:\n fixes c pt p_cer in_lang\n assumes \"poly pt\"\n assumes \"poly p_cer\"\n assumes verifier_tbounded:\n (*Mohammad: I don't think we need the time to bounded by the cert length since the cert length\n is bounded by input length.*)\n \"\\s. \\t s'. (c, s) \\\\<^bsup> t \\<^esup> s' \\\n t \\ pt (bit_length (s ''input''))\"\n assumes verifier_terminates: \n (*\"\\x z. \\s. s ''input'' = x \\ s ''certificate'' = z \\\n (\\t s'. (c, s) \\\\<^bsup> t \\<^esup> s' \\ s' ''input'' = in_lang x)\"*)\n (*Mohammad: The TM needs no access to the certificate since it is non-deterministic, i.e. it can\n assume it is guessed.*)\n (*Mohammad: The computation output should depend on the state, otherwise the theorem\n statement does not hold*)\n (*Mohammad: We need to specify what it means for c to be a verifier for the certificates*)\n \"\\x s. \\in_lang x = 0 ; s ''input'' = x\\ \\\n (\\z t s'. bit_length z \\ p_cer (bit_length x) \\\n (c, s(''certificate'' := z)) \\\\<^bsup> t \\<^esup> s' \\\n s' ''input'' = in_lang x)\"\n \"\\x s s' t. \\in_lang x \\ 0; s ''input'' = x; (c, s) \\\\<^bsup> t \\<^esup> s'\\ \\\n s' ''input'' = in_lang x\"\n assumes verifier_has_registers:\n \"''input'' \\ set (Max_Constant.all_variables c)\"\n shows \"\\t_red s_red.\n poly t_red \n \\ poly s_red\n \\ (\\x. \\f. bit_length (encode_sat f) \\ s_red ( bit_length x ) \\ imp_to_sat c pt p_cer x = f\n \\ (Sema.sat {f} \\ in_lang x = 0))\"\nproof -\n define t''::\"(char list \\ nat) \\ nat\" where\n \"t'' s = (make_mono pt) (bit_length (s ''input''))\" for s\n\n\n have t_bound: \"\\t s'. (c, s) \\\\<^bsup> t \\<^esup> s' \\ t \\ t'' s\" for s\n using verifier_tbounded[of s] order.trans\n by (auto 5 1 simp: t''_def)\n\n\n text\\Upper bound on the time\\\n\n have t_bound_2: \"\\s' t. t \\ t' pt p_cer x \\ (c, s) \\\\<^bsup> t \\<^esup> s'\"\n if \"s ''input'' = x\"\n for s x\n proof- \n obtain t s' where \n \"(c, s) \\\\<^bsup> t \\<^esup> s'\"\n \"t \\ pt (bit_length (s ''input''))\"\n using verifier_tbounded\n by blast+\n have \"t'' s \\ t' pt p_cer (s ''input'')\"\n by (auto simp: t'_def t''_def le_make_mono order_trans\n intro!: le_SucI monoD[OF mono_make_mono])\n hence \"t \\ t' pt p_cer (s ''input'')\"\n using t_bound \\(c, s) \\\\<^bsup> t \\<^esup> s'\\\n by (smt bigstepT_the_cost less_le_trans not_le)\n thus ?thesis\n using \\(c, s) \\\\<^bsup> t \\<^esup> s'\\ that\n by auto\n qed\n\n have \"Sema.sat {imp_to_sat c pt p_cer x}\"\n if init: \"in_lang x = 0\"\n for x\n proof-\n define s where \"s \\ (\\_. 0) (''input'' := x)\"\n have \"s ''input'' = x\"\n by (auto simp add: s_def)\n then obtain z t s'\n where \"bit_length z \\ p_cer (bit_length x)\"\n \"(c, s(''certificate'' := z)) \\\\<^bsup> t \\<^esup> s'\"\n \"s' ''input'' = in_lang x\"\n using verifier_terminates(1)[of x s, OF init]\n by auto\n moreover hence \"t'' (s(''certificate'' := z)) \\ t' pt p_cer x\"\n by (auto simp: \\s ''input'' = x\\ t'_def t''_def bit_length_def le_make_mono order_trans\n intro!: le_SucI monoD[OF mono_make_mono])\n hence \"t \\ t' pt p_cer x\"\n using t_bound \\(c, s(''certificate'' := z)) \\\\<^bsup> t \\<^esup> s'\\\n by (smt bigstepT_the_cost less_le_trans not_le)\n moreover have \"[''input'' \\ x] \\\\<^sub>m Some \\ s(''certificate'' := z)\"\n by (auto simp: s_def map_le_def)\n moreover have \"finite (range (s(''certificate'' := z)))\"\n by (auto simp: image_def s_def)\n moreover have \"z \\ 2 * 2 ^ p_cer (Discrete.log x)\"\n using \\bit_length z \\ p_cer (bit_length x)\\\n apply(simp add: bit_length_def)\n by (metis le_iff_add log_exp2_ge mult.commute not_less power_of_two_increase_exponent_le)\n ultimately have \"\\\\. \\ \\ imp_to_sat c pt p_cer x\"\n unfolding Sema.sat_def imp_to_sat_def Let_def\n by (fastforce simp add: s_def bit_length_def map_le_def init\n intro!: while_program_has_model[of _ \"s(''certificate'' := z)\" _ _ s' _ t])\n thus ?thesis\n by (auto simp: Sema.sat_def)\n qed\n\n moreover have \"in_lang x = 0\"\n if \"Sema.sat {imp_to_sat c pt p_cer x}\"\n for x\n proof-\n obtain \\ where \"\\ \\ imp_to_sat c pt p_cer x\"\n using \\Sema.sat {imp_to_sat c pt p_cer x}\\\n by (auto simp: Sema.sat_def)\n hence \"\\s1 s2 t''. t'' \\ t' pt p_cer x \\ [''input'' \\ x] \\\\<^sub>m Some \\ s1 \\\n [''input'' \\ 0] \\\\<^sub>m Some \\ s2 \\ (c, s1) \\\\<^bsup> t'' \\<^esup> s2\"\n apply(intro if_there_is_model_then_program_terminates \n [where \\ = \\ and r = \"x + 1 + 2 * 2 ^ (p_cer (bit_length x))\"])\n using verifier_has_registers\n by (auto simp: map_le_def imp_to_sat_def Let_def intro: t_bound_2 )\n then obtain s1 s2 t'' \n where \"t'' \\ t' pt p_cer x\" \"[''input'' \\ x] \\\\<^sub>m Some \\ s1\"\n \"[''input'' \\ 0] \\\\<^sub>m Some \\ s2\" \"(c, s1) \\\\<^bsup> t'' \\<^esup> s2\"\n by auto\n moreover hence \"s2 ''input'' = 0\" \"s1 ''input'' = x\"\n by (auto simp: map_le_def)\n ultimately show \"in_lang x = 0\"\n using verifier_terminates(2)\n by fastforce\n qed\n\n ultimately show ?thesis\n sorry\nqed\n\ndefinition decode_sat :: \"nat \\ nat three_sat\" where\n \"decode_sat n = undefined\"\n\ninterpretation encode_decode_sat encode_sat decode_sat\n sorry\n\nsubsubsection \\Synthesizing the IMP- Program\\\n\nlemma main_lemma_synth : \n fixes c pt p_cer\n assumes \"poly pt\"\n assumes \"poly p_cer\"\n assumes \"\\s. \\t. Ex (big_step_t (c, s) t) \\ t \\ \n pt (bit_length (s ''input'') + bit_length (s ''certificate''))\"\n assumes \"\\x z. \\r. \\s. s ''input'' = x \\ s ''certificate'' = z \\\n (\\t s'. (c, s) \\\\<^bsup> t \\<^esup> s' \\ s' ''input'' = r)\"\n shows \"\\imp_to_sat t_red s_red.\n poly t_red \n \\ poly s_red\n \\ (\\s t s'. (imp_to_sat,s) \\\\<^bsup> t \\<^esup> s' \\ s ''certificate'' = s' ''certificate'')\n \\ (\\x. \\f. bit_length f \\ s_red ( bit_length x )\n \\ (\\s. s ''input'' = x \\ (\\t s'. (imp_to_sat,s) \\\\<^bsup> t \\<^esup> s' \\ \n s' ''input'' = f \\ t \\ t_red(bit_length x)))\n \\ ( f \\ IMP_SAT \\\n (\\z. bit_length z \\ p_cer (bit_length x) \\\n (\\s t s'. s ''input'' = x \n \\ s ''certificate'' = z \n \\(c, s) \\\\<^bsup> t \\<^esup> s' \\ s' ''input'' = 0))\n )\n )\"\n sorry\n\n\nsubsubsection \\Instantiating the Cook_Levin locale\\\n\n(*interpretation Cook_Levin_assumes_Main_lemma encode_sat decode_sat\n apply standard\n by (fact main_lemma_synth) \n \nterm strict_sorted*)\n\nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP_Minus_To_SAT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.29449895007702226}} {"text": "section {* Simulink Blocks Examples *}\n\ntheory simu_contract_real_example\n imports\n simu_contract_real\nbegin\n\nsubsection {* inps and outps *}\nlemma \n fixes ok and inouts\n shows \"\\(true \\\\<^sub>r II)\\\\<^sub>e\n (\\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\, \\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\)\"\n apply (rel_auto)\ndone\n\nlemma \n fixes ok and inouts\n assumes \"\\(true \\\\<^sub>r II)\\\\<^sub>e\n (\\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\, \\ok\\<^sub>v = ok1, inouts\\<^sub>v = inouts\\)\"\n shows \"(ok1 = ok) \\ \\ok\"\n using assms apply (simp add: urel_defs)\n apply (rel_simp)\ndone\n\nlemma \n fixes ok and inouts\n assumes \"\\(true \\\\<^sub>r II)\\\\<^sub>e\n (\\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\, \\ok\\<^sub>v = ok1, inouts\\<^sub>v = inouts\\)\"\n shows \"ok1 = ok\"\n using assms apply (simp add: urel_defs)\n apply (rel_simp)\n (*\n \"e\": The prover derived \"False\" from \"SimBlock_def\", \"impl_mp1\", \"inps_outps\", \"rdesign_post\", \"rdesign_pre\", and \"utp_pred_laws.inf_top_left\", which could be due to a bug in Sledgehammer or to inconsistent axioms (including \"sorry\"s) \n \"z3\": Timed out \n \"cvc4\": Timed out \n \"spass\": Timed out\n *)\nsorry\n\ndeclare [[show_types]]\nlemma \n fixes ok and inouts\n assumes \"\\x . length(inouts x) = Suc 0\"\n shows \"\\Id\\\\<^sub>e\n (\\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\, \\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\)\"\n apply (simp add: sim_blocks)\n apply (rel_simp)\n by (simp add: assms)\n\nlemma \n fixes ok and inouts\n assumes \"\\x . length(inouts x) = 2\"\n shows \"\\takem 2 1\\\\<^sub>e\n (\\ok\\<^sub>v = ok, inouts\\<^sub>v = inouts\\, \\ok\\<^sub>v = ok, inouts\\<^sub>v = \\na . [hd(inouts na)]\\)\"\n apply (simp add: sim_blocks)\n apply (rel_simp)\n by (metis assms length_0_conv take_0 take_Suc zero_not_eq_two)\n\nlemma \n fixes ok\\<^sub>v0 and inouts\\<^sub>v0\n assumes \"\\x . length(inouts\\<^sub>v0 x) = (m1 + m2 + m3)\"\n shows \"\\takem (m1 + m2 + m3) (m1 + m2)\\\\<^sub>e\n (\\ok\\<^sub>v = ok\\<^sub>v0, inouts\\<^sub>v = inouts\\<^sub>v0\\, \\ok\\<^sub>v = ok\\<^sub>v0, inouts\\<^sub>v = \\na . take (m1+m2) (inouts\\<^sub>v0 na)\\)\"\n apply (simp add: sim_blocks)\n apply (rel_simp)\n using assms by auto\n\nlemma \n fixes m and n\n assumes a2: \"n \\ m\"\n assumes a1: \"\\takem m n\\\\<^sub>e\n (\\ok\\<^sub>v = ok\\<^sub>v0, inouts\\<^sub>v = inouts\\<^sub>v0\\, \\ok\\<^sub>v = ok\\<^sub>v1, inouts\\<^sub>v = inouts\\<^sub>v1\\)\"\n (* shows \"(ok\\<^sub>v0 \\ ok\\<^sub>v1)\"*)\n (* shows \"(ok\\<^sub>v1 = ok\\<^sub>v0) \\ ok\\<^sub>v1)\" *)\n shows \"ok\\<^sub>v0 \\ (\\x . length(inouts\\<^sub>v0 x) = (m))\"\n proof -\n show ?thesis\n using a1 a2 apply (simp add: sim_blocks)\n apply (rel_simp)\n done\n qed\n\nlemma \n fixes m and n\n assumes a2: \"n \\ m\"\n assumes a1: \"\\takem m n\\\\<^sub>e\n (\\ok\\<^sub>v = ok\\<^sub>v0, inouts\\<^sub>v = inouts\\<^sub>v0\\, \\ok\\<^sub>v = ok\\<^sub>v1, inouts\\<^sub>v = inouts\\<^sub>v1\\)\"\n (* shows \"(ok\\<^sub>v0 \\ ok\\<^sub>v1)\"*)\n (* shows \"(ok\\<^sub>v1 = ok\\<^sub>v0) \\ ok\\<^sub>v1)\" *)\n shows \"ok\\<^sub>v0 \\ n \\ 0 \\ (inouts\\<^sub>v1 = (\\na. (take n (inouts\\<^sub>v0 na))))\"\n proof -\n show ?thesis\n using a1 a2 apply (simp add: sim_blocks)\n apply (rel_simp)\n proof -\n fix x\n assume \"\\x::nat.\n length(inouts\\<^sub>v0 x) = m \\\n length(inouts\\<^sub>v1 x) = n \\\n \\bop op = (\\take n\\($inouts(\\x\\)\\<^sub>a)\\<^sub>a) ($inouts\\(\\x\\)\\<^sub>a)\\\\<^sub>e\n (get\\<^bsub>\\\\<^sub>D \\ \\\\<^sub>D\\<^esub> (\\ok\\<^sub>v = True, inouts\\<^sub>v = inouts\\<^sub>v0\\, \\ok\\<^sub>v = True, inouts\\<^sub>v = inouts\\<^sub>v1\\))\"\n show \"inouts\\<^sub>v1 x = take n (inouts\\<^sub>v0 x)\"\n done\n qed\n\nlemma \n fixes m and n\n assumes a2: \"n \\ m\"\n assumes a1: \"\\takem m n\\\\<^sub>e\n (\\ok\\<^sub>v = ok\\<^sub>v0, inouts\\<^sub>v = inouts\\<^sub>v0\\, \\ok\\<^sub>v = ok\\<^sub>v1, inouts\\<^sub>v = inouts\\<^sub>v1\\)\"\n (* shows \"(ok\\<^sub>v0 \\ ok\\<^sub>v1)\"*)\n (* shows \"(ok\\<^sub>v1 = ok\\<^sub>v0) \\ ok\\<^sub>v1)\" *)\n shows \"ok\\<^sub>v0 \\ (\\x . length(inouts\\<^sub>v1 x) = (n))\"\n proof -\n show ?thesis\n using a1 a2 apply (simp add: sim_blocks)\n apply (rel_simp)\n done\n qed\n\n\nsubsubsection {* SimBlock *}\nparagraph {* Illustration *}\n\nlemma \"(pre\\<^sub>D(Id) \\ post\\<^sub>D(Id)) = \n (\\<^bold>\\ n \\ #\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u 1 \\ #\\<^sub>u($inouts\\(\\n\\)\\<^sub>a) =\\<^sub>u 1 \\ \n head\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts\\(\\n\\)\\<^sub>a))\"\napply (simp add: sim_blocks)\ndone\n\nlemma Dom_Id: \"Dom(pre\\<^sub>D(Id) \\ post\\<^sub>D(Id)) = (\\<^bold>\\ n \\ #\\<^sub>u(&inouts(\\n\\)\\<^sub>a) =\\<^sub>u 1)\"\napply (simp add: sim_blocks Dom_def)\napply (rel_auto)\ndone\n\nlemma Ran_Id: \"Ran(pre\\<^sub>D(Id) \\ post\\<^sub>D(Id)) = (\\<^bold>\\ n \\ #\\<^sub>u(&inouts(\\n\\)\\<^sub>a) =\\<^sub>u 1)\"\napply (simp add: sim_blocks Ran_def)\napply (rel_auto)\ndone\n\nlemma \"(\\<^bold>\\ n \\ #\\<^sub>u(&inouts(\\n\\)\\<^sub>a) =\\<^sub>u 1) \\ Dom(pre\\<^sub>D(Id) \\ post\\<^sub>D(Id))\"\napply (simp add: Dom_Id)\ndone\n\nsubsubsection {* inps and outps *}\n\nsubsection {* Experiments *}\n\nparagraph {* Example *}\nlemma takem_simp2:\n\"(takem (Suc (Suc 0)) (Suc 0)) ;; Id = \n true \\\\<^sub>r (\\<^bold>\\ n \\ #\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u \\2\\ \\\n #\\<^sub>u($inouts\\(\\n\\)\\<^sub>a) =\\<^sub>u \\1\\ \\\n head\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts\\(\\n\\)\\<^sub>a))\"\napply (simp add: sim_blocks)\napply (rel_auto)\napply (metis list.sel(1) list.size(3) numeral_2_eq_2 take_Suc zero_not_eq_two)\nby (metis Cons_nth_drop_Suc Suc_1 Suc_leI append.simps(1) drop_0 drop_all hd_drop_conv_nth take_0 take_hd_drop zero_less_Suc)\n\nlemma dropm_simp2:\n\"(dropm (Suc (Suc 0)) (Suc 0)) ;; Id = \n true \\\\<^sub>r (\\<^bold>\\ n \\ #\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u \\2\\ \\\n #\\<^sub>u($inouts\\(\\n\\)\\<^sub>a) =\\<^sub>u \\1\\ \\\n last\\<^sub>u($inouts(\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts\\(\\n\\)\\<^sub>a))\"\napply (simp add: sim_blocks)\napply (rel_auto)\napply (metis One_nat_def add_Suc_right cancel_ab_semigroup_add_class.add_diff_cancel_left' hd_drop_conv_nth last_conv_nth lessI list.size(3) numeral_2_eq_2 of_nat_1 of_nat_Suc semiring_1_class.of_nat_0 zero_not_eq_two)\nby (smt Cons_nth_drop_Suc One_nat_def Suc_less_eq add_2_eq_Suc add_Suc cancel_ab_semigroup_add_class.add_diff_cancel_left' drop_0 drop_all hd_drop_conv_nth last_conv_nth neq0_conv neq_Nil_conv not_less_zero numeral_2_eq_2 order_refl)\n\nlemma lem_parallel_1 : \"\\(ok\\<^sub>v::bool) inouts\\<^sub>v more (ok\\<^sub>v'::bool) inouts\\<^sub>v'.\n \\ ok\\<^sub>v \\\n \\ok\\<^sub>v inouts\\<^sub>v'' morea ok\\<^sub>v'' inouts\\<^sub>v'''.\n (\\inouts\\<^sub>v. \\x. inouts\\<^sub>v''' x = inouts\\<^sub>v x) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v'' x = inouts\\<^sub>v x) \\\n morea = more \\ ok\\<^sub>v' = (ok\\<^sub>v'' \\ ok\\<^sub>v''') \\ (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v''' x @ inouts\\<^sub>v'''' x))\"\nproof -\n -- {* use fix to fix variables in \\ *}\n fix ok\\<^sub>v :: \"bool\" and \n inouts\\<^sub>v and \n more and \n ok\\<^sub>v':: \"bool\" and \n inouts\\<^sub>v'\n assume \"\\ ok\\<^sub>v\"\n show \"\\ok1\\<^sub>v inouts\\<^sub>v'' morea ok\\<^sub>v'' inouts\\<^sub>v'''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v''' x = inouts1\\<^sub>v x) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok1\\<^sub>v \\\n (\\x. inouts\\<^sub>v'' x = inouts\\<^sub>v x) \\\n morea = more \\\n ok\\<^sub>v' = (ok\\<^sub>v'' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v''' x @ inouts\\<^sub>v'''' x))\"\n proof -\n -- {* use obtain to fix local variables in \\ *}\n obtain ok1\\<^sub>v and inouts\\<^sub>v'' and morea and ok\\<^sub>v'' and inouts\\<^sub>v''' \n where p: \"ok1\\<^sub>v = ok\\<^sub>v\" and \"inouts\\<^sub>v'' = inouts\\<^sub>v\" and \"morea = more\" and \"ok\\<^sub>v''= ok\\<^sub>v'\" and\n \"inouts\\<^sub>v''' = inouts\\<^sub>v'\" \n apply blast\n done\n (* P(x) *)\n have 1: \"(\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v' x = inouts1\\<^sub>v x) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ inouts\\<^sub>v'''' x))\"\n proof -\n have c1: \"(\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v' x = inouts1\\<^sub>v x)\" \n by blast\n have c2: \"(\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ inouts\\<^sub>v'''' x))\"\n proof -\n obtain ok\\<^sub>v''' and inouts\\<^sub>v'''' where \"ok\\<^sub>v''' = ok\\<^sub>v'\" and \"inouts\\<^sub>v'''' = (\\x.[])\"\n by auto\n have c3: \"(\\inouts1\\<^sub>v. \\x. [] = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ [])\"\n using \\\\ ok\\<^sub>v\\ by fastforce\n from c3 show ?thesis\n by metis\n qed\n from c1 and c2 show ?thesis\n by auto\n qed\n (* \\x. P(x) *)\n then show ?thesis\n by metis\n qed\nqed\n\ntext {* Parallel of two @{term \"Id\"}s equal to a @{term \"Idm\"} with two inputs and ouptuts. *}\nlemma parallel_id_equal_idm2: \"sim_parallel Id Id = Idm 2\"\napply (simp add: sim_parallel_def inps_id mergeB_def par_by_merge_def)\napply (simp add: takem_simp2)\napply (simp add: dropm_simp2)\napply (simp add: Idm_def)\napply (simp add: U0_def U1_def)\napply (rel_auto+)\napply (metis Cons_nth_drop_Suc One_nat_def Suc_1 add.right_neutral add_Suc_right append.simps(1) append_Cons cancel_ab_semigroup_add_class.add_diff_cancel_left' drop_0 drop_all hd_drop_conv_nth last_conv_nth lessI neq0_conv neq_Nil_conv order_refl zero_neq_numeral)\n-- {* Subgoal 2: *}\napply (simp add: lem_parallel_1)\nproof -\n (*\n -- {* use fix to fix variables in \\ *}\n fix ok\\<^sub>v :: \"bool\" and \n inouts\\<^sub>v and \n more and \n ok\\<^sub>v':: \"bool\" and \n inouts\\<^sub>v'\n assume \"\\ ok\\<^sub>v\"\n show \"\\ok1\\<^sub>v inouts\\<^sub>v'' morea ok\\<^sub>v'' inouts\\<^sub>v'''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v''' x = inouts1\\<^sub>v x) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok1\\<^sub>v \\\n (\\x. inouts\\<^sub>v'' x = inouts\\<^sub>v x) \\\n morea = more \\\n ok\\<^sub>v' = (ok\\<^sub>v'' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v''' x @ inouts\\<^sub>v'''' x))\"\n proof -\n -- {* use obtain to fix local variables in \\ *}\n obtain ok1\\<^sub>v and inouts\\<^sub>v'' and morea and ok\\<^sub>v'' and inouts\\<^sub>v''' \n where p: \"ok1\\<^sub>v = ok\\<^sub>v\" and \"inouts\\<^sub>v'' = inouts\\<^sub>v\" and \"morea = more\" and \"ok\\<^sub>v''= ok\\<^sub>v'\" and\n \"inouts\\<^sub>v''' = inouts\\<^sub>v'\" \n apply blast\n done\n (* P(x) *)\n have 1: \"(\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v' x = inouts1\\<^sub>v x) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ inouts\\<^sub>v'''' x))\"\n proof -\n have c1: \"(\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v' x = inouts1\\<^sub>v x)\" \n by blast\n have c2: \"(\\ok\\<^sub>v''' inouts\\<^sub>v''''.\n (\\inouts1\\<^sub>v. \\x. inouts\\<^sub>v'''' x = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v''') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ inouts\\<^sub>v'''' x))\"\n proof -\n obtain ok\\<^sub>v''' and inouts\\<^sub>v'''' where \"ok\\<^sub>v''' = ok\\<^sub>v'\" and \"inouts\\<^sub>v'''' = (\\x.[])\"\n by auto\n have c3: \"(\\inouts1\\<^sub>v. \\x. [] = inouts1\\<^sub>v x) \\\n \\ ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v x = inouts\\<^sub>v x) \\\n more = more \\\n ok\\<^sub>v' = (ok\\<^sub>v' \\ ok\\<^sub>v') \\ \n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x @ [])\"\n using \\\\ ok\\<^sub>v\\ by fastforce\n from c3 show ?thesis\n by metis\n qed\n from c1 and c2 show ?thesis\n by auto\n qed\n (* \\x. P(x) *)\n then show ?thesis\n by metis\n qed\nnext\n*)\n fix ok\\<^sub>v :: \"bool\" and \n inouts\\<^sub>v and \n more and \n ok\\<^sub>v':: \"bool\" and \n inouts\\<^sub>v'\n assume s1: \" ok\\<^sub>v'\"\n assume s2: \"\\x. length(inouts\\<^sub>v x) = 2 \\ length(inouts\\<^sub>v' x) = 2 \\ inouts\\<^sub>v x = inouts\\<^sub>v' x\"\n show \"\\ok0\\<^sub>v' inouts0\\<^sub>v morea ok\\<^sub>v'' inouts\\<^sub>v''.\n (\\inouts1\\<^sub>v.\n (ok\\<^sub>v \\ ok\\<^sub>v'' \\ (\\x. length(inouts1\\<^sub>v x) = Suc 0 \\ hd (inouts\\<^sub>v' x) = hd (inouts1\\<^sub>v x))) \\\n (\\x. inouts\\<^sub>v'' x = inouts1\\<^sub>v x)) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v'''.\n (\\inouts\\<^sub>v.\n (ok\\<^sub>v \\ ok\\<^sub>v''' \\ (\\x. length(inouts\\<^sub>v x) = Suc 0 \\ last (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x))) \\\n (\\x. inouts\\<^sub>v''' x = inouts\\<^sub>v x)) \\\n ok0\\<^sub>v' = ok\\<^sub>v \\\n (\\x. inouts0\\<^sub>v x = inouts\\<^sub>v' x) \\\n morea = more \\ ok\\<^sub>v'' \\ ok\\<^sub>v''' \\ (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v'' x @ inouts\\<^sub>v''' x))\"\n proof -\n obtain ok0\\<^sub>v' and inouts0\\<^sub>v and morea and ok\\<^sub>v'' and inouts\\<^sub>v'' \n where p: \"ok0\\<^sub>v' = ok\\<^sub>v\" and \"inouts0\\<^sub>v = inouts\\<^sub>v'\" and \"morea = more\" and \"ok\\<^sub>v''= True\" and\n \"inouts\\<^sub>v'' = (\\x. [hd(inouts\\<^sub>v' x)])\"\n apply auto\n done\n have Px: \"(\\inouts1\\<^sub>v.\n (ok\\<^sub>v \\ True \\ (\\x. length(inouts1\\<^sub>v x) = Suc 0 \\ hd (inouts\\<^sub>v' x) = hd (inouts1\\<^sub>v x))) \\\n (\\x. [hd(inouts\\<^sub>v' x)] = inouts1\\<^sub>v x)) \\\n (\\ok\\<^sub>v''' inouts\\<^sub>v'''.\n (\\inouts\\<^sub>v.\n (ok\\<^sub>v \\ ok\\<^sub>v''' \\ (\\x. length(inouts\\<^sub>v x) = Suc 0 \\ last (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x))) \\\n (\\x. inouts\\<^sub>v''' x = inouts\\<^sub>v x)) \\\n ok\\<^sub>v = ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x) \\\n more = more \\ True \\ ok\\<^sub>v''' \\ (\\x. inouts\\<^sub>v' x = [hd(inouts\\<^sub>v' x)] @ inouts\\<^sub>v''' x))\"\n proof -\n have c1: \"(\\inouts1\\<^sub>v.\n (ok\\<^sub>v \\ True \\ (\\x. length(inouts1\\<^sub>v x) = Suc 0 \\ hd (inouts\\<^sub>v' x) = hd (inouts1\\<^sub>v x))) \\\n (\\x. [hd(inouts\\<^sub>v' x)] = inouts1\\<^sub>v x))\"\n by (metis \\inouts\\<^sub>v'' = (\\x. [hd (inouts\\<^sub>v' x)])\\ length_Cons list.sel(1) list.size(3))\n have c2: \"(\\ok\\<^sub>v''' inouts\\<^sub>v'''.\n (\\inouts\\<^sub>v.\n (ok\\<^sub>v \\ ok\\<^sub>v''' \\ (\\x. length(inouts\\<^sub>v x) = Suc 0 \\ last (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x))) \\\n (\\x. inouts\\<^sub>v''' x = inouts\\<^sub>v x)) \\\n ok\\<^sub>v = ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x) \\\n more = more \\ True \\ ok\\<^sub>v''' \\ (\\x. inouts\\<^sub>v' x = [hd(inouts\\<^sub>v' x)] @ inouts\\<^sub>v''' x))\"\n proof -\n obtain ok\\<^sub>v''' and inouts\\<^sub>v''' where \n \"ok\\<^sub>v''' = True\" and \"inouts\\<^sub>v''' = (\\x. [last(inouts\\<^sub>v' x)])\"\n by auto \n have Px: \"(\\inouts\\<^sub>v.\n (ok\\<^sub>v \\ True \\ (\\x. length(inouts\\<^sub>v x) = Suc 0 \\ last (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x))) \\\n (\\x. [last(inouts\\<^sub>v' x)] = inouts\\<^sub>v x)) \\\n ok\\<^sub>v = ok\\<^sub>v \\\n (\\x. inouts\\<^sub>v' x = inouts\\<^sub>v' x) \\\n more = more \\ True \\ True \\ (\\x. inouts\\<^sub>v' x = [hd(inouts\\<^sub>v' x)] @ [last(inouts\\<^sub>v' x)])\"\n proof -\n have c1: \"(\\inouts\\<^sub>v.\n (ok\\<^sub>v \\ True \\ (\\x. length(inouts\\<^sub>v x) = Suc 0 \\ last (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x))) \\\n (\\x. [last(inouts\\<^sub>v' x)] = inouts\\<^sub>v x))\"\n by force\n have c2: \"(\\x. inouts\\<^sub>v' x = [hd(inouts\\<^sub>v' x)] @ [last(inouts\\<^sub>v' x)])\"\n using list_equal_size2 s2 by blast\n from c1 and c2 show ?thesis\n by auto\n qed\n then show ?thesis \n by metis\n qed\n from c1 and c2 show ?thesis by auto\n qed\n then show ?thesis\n by metis\n qed\nqed\n\nparagraph {* Example *}\ntext {* For example, *}\ndefinition IntegratorWOFeedback :: \"(dummyT sim_state_scheme, dummyT sim_state_scheme) rel_des\" where\n\"IntegratorWOFeedback = (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 2) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 2) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a) + \n (if n = 0 then 0 else head\\<^sub>u(tail\\<^sub>u($inouts (\\n-1\\)\\<^sub>a)))) \\\n head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u(tail\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)))\n ))\"\n\ndefinition PreFD1 :: \"(nat \\ real) \\ (dummyT sim_state_scheme, dummyT sim_state_scheme) rel_des\" where\n\"PreFD1 x = (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 2) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a)) \\ \n (head\\<^sub>u(tail\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u (\\x n\\))) ))\"\n\ndefinition PostFD1 :: \"(nat \\ real) \\ (dummyT sim_state_scheme, dummyT sim_state_scheme) rel_des\" where\n\"PostFD1 x = (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 2) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a)) \\ \n (head\\<^sub>u(tail\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u (\\x n\\))) ))\"\n\ndefinition Integrator :: \"(dummyT sim_state_scheme, dummyT sim_state_scheme) rel_des\" where \n\"Integrator = (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a) + \n (if n = 0 then 0 else head\\<^sub>u($inouts\\ (\\n-1\\)\\<^sub>a))))\n ))\"\n\ndefinition IntegratorWCFeedback :: \"(dummyT sim_state_scheme, dummyT sim_state_scheme) rel_des\" where\n\"IntegratorWCFeedback = (\\<^bold>\\ (x) \\ ((PreFD1 x) ;; IntegratorWOFeedback ;; (PostFD1 x)))\"\n\n(*\nlemma \"IntegratorWCFeedback = Integrator\"\napply (simp add: IntegratorWCFeedback_def Integrator_def)\napply (simp add: PreFD1_def PostFD1_def IntegratorWOFeedback_def)\napply (rel_auto)\napply (metis not_gr0)\n-- {* Goal 2: *}\nproof - (* 2 *)\n fix inouts\\<^sub>v :: \"nat \\ real list\" and inouts\\<^sub>v':: \"nat \\ real list\" and ok\\<^sub>v and ok\\<^sub>v'\n assume s1: \"ok\\<^sub>v\" and \"ok\\<^sub>v'\"\n assume s2: \"\\x. (x = 0 \\ length(inouts\\<^sub>v 0) = Suc 0 \\ length(inouts\\<^sub>v' 0) = Suc 0 \\ \n hd (inouts\\<^sub>v' 0) = hd (inouts\\<^sub>v 0)) \\\n (0 < x \\ length(inouts\\<^sub>v x) = Suc 0 \\ length(inouts\\<^sub>v' x) = Suc 0 \\ \n hd (inouts\\<^sub>v' x) = hd (inouts\\<^sub>v x) + hd (inouts\\<^sub>v' (x - Suc 0)))\"\n show \"\\x inouts\\<^sub>v''.\n (\\xa. length(inouts\\<^sub>v xa) = Suc 0 \\ length(inouts\\<^sub>v'' xa) = 2 \\ \n hd (inouts\\<^sub>v'' xa) = hd (inouts\\<^sub>v xa) \\ hd (tl (inouts\\<^sub>v'' xa)) = x xa) \\\n (\\inouts\\<^sub>v.\n (\\x. (x = 0 \\ length(inouts\\<^sub>v'' 0) = 2 \\ length(inouts\\<^sub>v 0) = 2 \\ \n hd (inouts\\<^sub>v 0) = hd (inouts\\<^sub>v'' 0) \\ hd (inouts\\<^sub>v 0) = hd (tl (inouts\\<^sub>v 0))) \\\n (0 < x \\ length(inouts\\<^sub>v'' x) = 2 \\ length(inouts\\<^sub>v x) = 2 \\\n hd (inouts\\<^sub>v x) = hd (inouts\\<^sub>v'' x) + hd (tl (inouts\\<^sub>v'' (x - Suc 0))) \\\n hd (inouts\\<^sub>v x) = hd (tl (inouts\\<^sub>v x)))) \\\n (\\xa. length(inouts\\<^sub>v xa) = 2 \\ length(inouts\\<^sub>v' xa) = Suc 0 \\ \n hd (inouts\\<^sub>v' xa) = hd (inouts\\<^sub>v xa) \\ hd (tl (inouts\\<^sub>v xa)) = x xa))\"\n -- {* Goal 2.1: unroll forall*}\n proof - (* 2.1 *)\n let ?x = \"(\\n. (if n = 0 then hd (inouts\\<^sub>v n) else hd (inouts\\<^sub>v n) + hd (inouts\\<^sub>v' (n - Suc 0))))\"\n obtain x and inouts\\<^sub>v'' where \n p: \"x = ?x\" and \"inouts\\<^sub>v'' = (\\n.[hd (inouts\\<^sub>v n), ?x n])\"\n by auto\n (* P(x) *)\n let ?P = \"\\u v . (\\xa. length(inouts\\<^sub>v xa) = Suc 0 \\ length(u xa) = 2 \\ \n hd (u xa) = hd (inouts\\<^sub>v xa) \\ hd (tl (u xa)) = v xa) \\\n (\\inouts\\<^sub>v.\n (\\x. (x = 0 \\ length(u 0) = 2 \\ length(inouts\\<^sub>v 0) = 2 \\ \n hd (inouts\\<^sub>v 0) = hd (u 0) \\ hd (inouts\\<^sub>v 0) = hd (tl (inouts\\<^sub>v 0))) \\\n (0 < x \\ length(u x) = 2 \\ length(inouts\\<^sub>v x) = 2 \\\n hd (inouts\\<^sub>v x) = hd (u x) + hd (tl (u (x - Suc 0))) \\\n hd (inouts\\<^sub>v x) = hd (tl (inouts\\<^sub>v x)))) \\\n (\\xa. length(inouts\\<^sub>v xa) = 2 \\ length(inouts\\<^sub>v' xa) = Suc 0 \\ \n hd (inouts\\<^sub>v' xa) = hd (inouts\\<^sub>v xa) \\ hd (tl (inouts\\<^sub>v xa)) = v xa))\"\n -- {* Goal 2.1.1 : unroll exists *}\n have Px: \"?P (\\n.[hd (inouts\\<^sub>v n), ?x n]) (?x)\"\n proof - (* 2.1.1 *)\n have 0: \"\\xa. length(inouts\\<^sub>v xa) = Suc 0\"\n using neq0_conv s2 by blast\n -- {* Goal 2.1.1.1 : 1st conjunction *}\n then have 1: \"(\\xa. length(inouts\\<^sub>v xa) = Suc 0 \\\n length([hd (inouts\\<^sub>v xa), ?x xa]) = 2 \\ hd [hd (inouts\\<^sub>v xa), ?x xa] =\n hd (inouts\\<^sub>v xa) \\\n hd (tl [hd (inouts\\<^sub>v xa), ?x xa]) = ?x xa)\"\n by simp\n -- {* Goal 2.1.1.2 : 2nd conjunction *}\n let ?P2 = \"(\\inouts\\<^sub>v'' :: nat\\real list.\n (\\x. (x = 0 \\\n length([hd (inouts\\<^sub>v 0), ?x 0]) = 2 \\\n length(inouts\\<^sub>v'' 0) = 2 \\\n hd (inouts\\<^sub>v'' 0) = hd [hd (inouts\\<^sub>v 0), ?x 0] \\\n hd (inouts\\<^sub>v'' 0) = hd (tl (inouts\\<^sub>v'' 0))) \\\n (0 < x \\\n length([hd (inouts\\<^sub>v x), ?x x]) = 2 \\\n length(inouts\\<^sub>v'' x) = 2 \\\n hd (inouts\\<^sub>v'' x) = hd [hd (inouts\\<^sub>v x), ?x x] +\n hd (tl [hd (inouts\\<^sub>v (x - Suc 0)),\n if x - Suc 0 = 0 then hd (inouts\\<^sub>v (x - Suc 0))\n else hd (inouts\\<^sub>v (x - Suc 0)) + hd (inouts\\<^sub>v' (x - Suc 0 - Suc 0))]) \\\n hd (inouts\\<^sub>v'' x) = hd (tl (inouts\\<^sub>v'' x)))) \\\n (\\xa. length(inouts\\<^sub>v'' xa) = 2 \\\n length(inouts\\<^sub>v' xa) = Suc 0 \\\n hd (inouts\\<^sub>v' xa) = hd (inouts\\<^sub>v'' xa) \\\n hd (tl (inouts\\<^sub>v'' xa)) =\n (if xa = 0 then hd (inouts\\<^sub>v xa) else hd (inouts\\<^sub>v xa) + hd (inouts\\<^sub>v' (xa - Suc 0)))))\"\n -- {* Goal 2.1.1.2 : 2nd conjunction *}\n have 2: \"(\\inouts\\<^sub>v''. (?P2 inouts\\<^sub>v''))\"\n proof - (* 2.1.1 *)\n -- {* Goal 2.1.1.2.1 : unroll exists *}\n let ?t = \"\\n.(hd (inouts\\<^sub>v n) + (\n if n = 0 then 0 else \n if n = 1 then hd (inouts\\<^sub>v (n-1)) else \n hd (inouts\\<^sub>v (n-1)) + hd (inouts\\<^sub>v' (n - 2))))\"\n obtain inouts\\<^sub>v'' where p: \"inouts\\<^sub>v''= (\\n.[?t n,?t n])\"\n by auto\n have P2x: \"?P2 (\\n.[?t n,?t n])\"\n proof - (* 2.1.1.1 *)\n -- {* Goal 2.1.1.2.1.1 : 1st conjunction *}\n have 11: \"\\x. (x = 0 \\\n length([hd (inouts\\<^sub>v 0), ?x 0]) = 2 \\\n length([?t 0, ?t 0]) = 2 \\\n hd [?t 0, ?t 0] = hd [hd (inouts\\<^sub>v 0), ?x 0] \\\n hd [?t 0, ?t 0] = hd (tl [?t 0, ?t 0]))\"\n by simp\n -- {* Goal 2.1.1.2.1.2 : 2st conjunction *}\n have 12: \"(\\x.(0 < x \\\n length([hd (inouts\\<^sub>v x), ?x 0]) = 2 \\\n length([?t x, ?t x]) = 2 \\\n hd [?t x, ?t x] = hd [hd (inouts\\<^sub>v x), ?x x] +\n hd (tl [hd (inouts\\<^sub>v (x - Suc 0)),\n if x - Suc 0 = 0 then hd (inouts\\<^sub>v (x - Suc 0))\n else hd (inouts\\<^sub>v (x - Suc 0)) + hd (inouts\\<^sub>v' (x - Suc 0 - Suc 0))]) \\\n hd [?t x, ?t x] = hd (tl [?t x, ?t x])))\"\n by (smt Suc_1 Suc_diff_eq_diff_pred diff_Suc_1 length_Cons less_imp_Suc_add list.sel(1) list.sel(3) list.size(3) neq0_conv numeral_1_eq_Suc_0 numeral_One pos2)\n -- {* Goal 2.1.1.2.1.3 : 3rd conjunction *}\n have 13: \"(\\xa. length([?t xa, ?t xa]) = 2 \\\n length(inouts\\<^sub>v' xa) = Suc 0 \\\n hd (inouts\\<^sub>v' xa) = hd [?t xa, ?t xa] \\\n hd (tl [?t xa, ?t xa]) = (?x xa))\"\n using \"12\" s2 by auto\n show ?thesis using 11 12 13\n by simp\n qed -- {* Goal 2.1.1.2.1 : 1st conjunction *} (* 2.1.1.1 *)\n show ?thesis using P2x \n sorry (* proof found but slow *)\n qed -- {* Goal 2.1.1.2 *} (* 2.1.1 *)\n then show ?thesis using 1 2\n by blast\n qed -- {* Goal 2.1.1 *} (* 2.1 *)\n then show ?thesis using Px \n by (metis \\\\thesis. (\\x inouts\\<^sub>v''. \\x = (\\n. if n = 0 then hd (inouts\\<^sub>v n) else hd (inouts\\<^sub>v n) + hd (inouts\\<^sub>v' (n - Suc 0))); inouts\\<^sub>v'' = (\\n. [hd (inouts\\<^sub>v n), if n = 0 then hd (inouts\\<^sub>v n) else hd (inouts\\<^sub>v n) + hd (inouts\\<^sub>v' (n - Suc 0))])\\ \\ thesis) \\ thesis\\)\n qed (* 2 *)\nqed\n*)\n\n(*\nlemma \"(inps IntegratorWOFeedback) = 2\"\nproof -\n have 1: \"IntegratorWOFeedback is HDim 2\"\n apply (simp add: IntegratorWOFeedback_def Healthy_def sim_blocks)\n apply (ndes_simp) \n sorry\n then show ?thesis\n apply (simp add: inps_dim)\n done\nqed\n*)\n(*\nlemma \"IntegratorWOFeedback f\\<^sub>D [(1,1)] = Integrator\"\napply (simp add: sim_blocks IntegratorWOFeedback_def Integrator_def)\napply (rel_auto)\n apply blast\n apply blast\n apply blast\n(* apply blast\n apply blast\n apply blast *)\nsorry\n\nlemma \"IntegratorWCFeedback = IntegratorWOFeedback f\\<^sub>D [(1,1)]\"\napply (simp add: sim_blocks IntegratorWCFeedback_def PreFD1_def PostFD1_def IntegratorWOFeedback_def)\napply (rel_auto)\n apply blast\n apply blast\n apply blast\n(* apply blast\n apply blast\n apply blast *)\nsorry\n*)\n\nsubsection {* Examples *}\n\nsubsubsection {* PID Integrator *}\nfun listsum :: \"real list \\ real\" where\n \"listsum [] = 0\" |\n \"listsum (x # xs) = x + listsum xs\" \n\nterm \"(map nat [0..n])\"\nterm \"head\\<^sub>u($inouts (\\x\\)\\<^sub>a)\"\nterm \"(\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\"\nterm \"(\\map\\ (\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\\<^sub>a (\\(map nat [0..n])\\)\\<^sub>a)\"\nterm \"(\\list_sum\\ (\\map\\ (\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\\<^sub>a (\\(map nat [0..n])\\)\\<^sub>a)\\<^sub>a) + 0\"\nterm \"head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)\"\nterm \"head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\x\\)\\<^sub>a)\"\n(*\nterm \"(head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u \n ((\\list_sum\\ (\\map\\ (\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\\<^sub>a (\\(map nat [0..n])\\)\\<^sub>a)\\<^sub>a) + 0))\"\n*)\n\nlemma sum_1:\n fixes n :: \"nat\" and x :: \"nat \\ real\" and y :: \"nat \\ real\"\n assumes \"\\n. (x(n) = y(n) + (if (n = 0) then 1 else x(n-1)))\"\n shows \"(x(n) = list_sum (map (\\x. y(x)) (map nat [0..n])) + 1)\"\nproof (induction n)\n case 0\n then show ?case \n proof -\n from assms have 0: \"x(0) = y(0) + 1\"\n by simp\n have 1: \"list_sum (map (\\x. y(x)) (map nat [0..0])) = y(0)\"\n by (simp add: upto.simps)\n from 0 1 show ?thesis \n by auto\n qed\nnext\n case (Suc n)\n then show ?case \n proof -\n have 00: \"(map y (map nat [0..int (Suc n)])) = (map y (map nat [0..int n])) @ [y(Suc n)]\"\n by (smt list.simps(8) list.simps(9) map_append nat_int of_nat_0_le_iff of_nat_Suc upto_rec2)\n then have 01: \"(foldr op + (map y (map nat [0..int (Suc n)])) 0) = \n (foldr op + (map y (map nat [0..int (n)])) 0) + y(Suc n)\"\n sorry\n from assms have 0: \"x (Suc n) = y(Suc n) + x(n)\"\n by simp\n then have 1: \"... = y(Suc n) + (foldr op + (map y (map nat [0..int n])) 0 + 1)\"\n by (simp add: Suc.IH)\n then have 2: \"... = (foldr op + (map y (map nat [0..int (Suc n)])) 0 + 1)\"\n using \"01\" by auto\n show ?thesis\n using \"0\" \"2\" Suc.IH by linarith\n qed\nqed\n\n(*\nlemma pid_int_l1:\n shows \"\n (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a) + \n (if n = 0 then 0 else head\\<^sub>u($inouts\\ (\\n-1\\)\\<^sub>a))))\n )\n )\n = \n (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u ((\\list_sum\\ (\\map\\ (\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\\<^sub>a (\\(map nat [0..n])\\)\\<^sub>a)\\<^sub>a) + 0)))\n )\n )\"\nsorry\n\n(* (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u ((\\sum_list\\ (\\map\\ (\\x \\ head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\\<^sub>a (\\[0..n]\\)\\<^sub>a)) + 0) *)\n\nlemma pid_int:\n shows \"((Id \\\\<^sub>D (UnitDelay 0)) ;; Sum) =\n (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 2) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a) + \n (if n = 0 then 0 else (\\nth\\ ($inouts (\\n-1\\)\\<^sub>a)\\<^sub>a (1)\\<^sub>a))))\n )\n )\"\nsorry\n\nterm \" (\\x. head\\<^sub>u($inouts (\\x\\)\\<^sub>a))\"\nterm \"map (\\x. head\\<^sub>u($inouts (\\x\\)\\<^sub>a)) (map nat [0..n])\"\n\nlemma pid_int_feed:\n shows \"(true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u head\\<^sub>u($inouts (\\n\\)\\<^sub>a) + \n (if n = 0 then 1 else head\\<^sub>u($inouts\\ (\\n-1\\)\\<^sub>a))))\n )\n ) = (true \\\\<^sub>r\n (\\<^bold>\\ n::nat \\ \n (((#\\<^sub>u($inouts (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ ((#\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a)) =\\<^sub>u 1) \\ \n (head\\<^sub>u($inouts\\ (\\n\\)\\<^sub>a) =\\<^sub>u (\\list_sum\\ (map (\\x. head\\<^sub>u($inouts (\\x\\)\\<^sub>a)) (map (nat) ([0..n])))\\<^sub>a) + 1))\n )\n )\"\napply (rel_auto)\n*)\n\n\nend", "meta": {"author": "RandallYe", "repo": "Compositional_AG_Reasoning_Simulink_UTP", "sha": "2fd13e1b22d18855093f15969c761644c8cf4cb6", "save_path": "github-repos/isabelle/RandallYe-Compositional_AG_Reasoning_Simulink_UTP", "path": "github-repos/isabelle/RandallYe-Compositional_AG_Reasoning_Simulink_UTP/Compositional_AG_Reasoning_Simulink_UTP-2fd13e1b22d18855093f15969c761644c8cf4cb6/simu_contract_real_example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5, "lm_q1q2_score": 0.294444565383916}} {"text": "theory Tools \nimports \"HOL.HOL\"\nkeywords \"close\" :: \"prf_script\" % \"proof\"\nbegin\n\nsubsection {* \"close\" keyword *}\n\ntxt \\See @{file \"tools.ML\"}\\\n\nsubsection {* Simplifier modulo equivalence relation *}\n\ntxt {* See also @{url \"http://stackoverflow.com/q/30573837/2646248\"} *}\n\ndefinition fun_equiv :: \"('a \\ 'b) \\ 'a \\ 'a \\ bool\" where \"fun_equiv f x y == f x = f y\"\nlemma fun_equiv_refl: \"fun_equiv f x x\" by(simp add: fun_equiv_def)\n\nML_file \"tools.ML\"\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Tools.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.294415049561893}} {"text": "theory Monitor_Code\n imports \"HOL-Library.Code_Target_Nat\" \"Containers.Containers\" Monitor Preliminaries\nbegin\n\nderive (eq) ceq enat\n\ninstantiation enat :: ccompare begin\n\ndefinition ccompare_enat :: \"enat comparator option\" where\n \"ccompare_enat = Some (\\x y. if x = y then order.Eq else if x < y then order.Lt else order.Gt)\"\n\ninstance by intro_classes\n (auto simp: ccompare_enat_def split: if_splits intro!: comparator.intro)\n\nend\n\ncode_printing\n code_module \"IArray\" \\ (OCaml)\n\\module IArray : sig\n val length' : 'a array -> Z.t\n val sub' : 'a array * Z.t -> 'a\nend = struct\n\nlet length' xs = Z.of_int (Array.length xs);;\n\nlet sub' (xs, i) = Array.get xs (Z.to_int i);;\n\nend\\ for type_constructor iarray constant IArray.length' IArray.sub'\n\ncode_reserved OCaml IArray\n\ncode_printing\n type_constructor iarray \\ (OCaml) \"_ array\"\n| constant iarray_of_list \\ (OCaml) \"Array.of'_list\"\n| constant IArray.list_of \\ (OCaml) \"Array.to'_list\"\n| constant IArray.length' \\ (OCaml) \"IArray.length'\"\n| constant IArray.sub' \\ (OCaml) \"IArray.sub'\"\n\nlemma iarray_list_of_inj: \"IArray.list_of xs = IArray.list_of ys \\ xs = ys\"\n by (cases xs; cases ys) auto\n\ninstantiation iarray :: (ccompare) ccompare\nbegin\n\ndefinition ccompare_iarray :: \"('a iarray \\ 'a iarray \\ order) option\" where\n \"ccompare_iarray = (case ID CCOMPARE('a list) of None \\ None\n | Some c \\ Some (\\xs ys. c (IArray.list_of xs) (IArray.list_of ys)))\"\n\ninstance\n apply standard\n apply unfold_locales\n using comparator.sym[OF ID_ccompare'] comparator.weak_eq[OF ID_ccompare']\n comparator.comp_trans[OF ID_ccompare'] iarray_list_of_inj\n apply (auto simp: ccompare_iarray_def split: option.splits)\n apply blast+\n done\n\nend\n\nderive (rbt) mapping_impl iarray\n\ndefinition mk_db :: \"String.literal list \\ String.literal set\" where \"mk_db = set\"\n\ndefinition init_vydra_string_enat :: \"_ \\ _ \\ _ \\ (String.literal, enat, 'e) vydra\" where\n \"init_vydra_string_enat = init_vydra\"\ndefinition run_vydra_string_enat :: \" _ \\ (String.literal, enat, 'e) vydra \\ _\" where\n \"run_vydra_string_enat = run_vydra\"\ndefinition progress_enat :: \"(String.literal, enat) formula \\ enat list \\ nat\" where\n \"progress_enat = progress\"\ndefinition bounded_future_fmla_enat :: \"(String.literal, enat) formula \\ bool\" where\n \"bounded_future_fmla_enat = bounded_future_fmla\"\ndefinition wf_fmla_enat :: \"(String.literal, enat) formula \\ bool\" where\n \"wf_fmla_enat = wf_fmla\"\ndefinition mdl2mdl'_enat :: \"(String.literal, enat) formula \\ (String.literal, enat) Preliminaries.formula\" where\n \"mdl2mdl'_enat = mdl2mdl'\"\ndefinition interval_enat :: \"enat \\ enat \\ bool \\ bool \\ enat \\\" where\n \"interval_enat = interval\"\ndefinition rep_interval_enat :: \"enat \\ \\ enat \\ enat \\ bool \\ bool\" where\n \"rep_interval_enat = Rep_\\\"\n\ndefinition init_vydra_string_ereal :: \"_ \\ _ \\ _ \\ (String.literal, ereal, 'e) vydra\" where\n \"init_vydra_string_ereal = init_vydra\"\ndefinition run_vydra_string_ereal :: \" _ \\ (String.literal, ereal, 'e) vydra \\ _\" where\n \"run_vydra_string_ereal = run_vydra\"\ndefinition progress_ereal :: \"(String.literal, ereal) formula \\ ereal list \\ real\" where\n \"progress_ereal = progress\"\ndefinition bounded_future_fmla_ereal :: \"(String.literal, ereal) formula \\ bool\" where\n \"bounded_future_fmla_ereal = bounded_future_fmla\"\ndefinition wf_fmla_ereal :: \"(String.literal, ereal) formula \\ bool\" where\n \"wf_fmla_ereal = wf_fmla\"\ndefinition mdl2mdl'_ereal :: \"(String.literal, ereal) formula \\ (String.literal, ereal) Preliminaries.formula\" where\n \"mdl2mdl'_ereal = mdl2mdl'\"\ndefinition interval_ereal :: \"ereal \\ ereal \\ bool \\ bool \\ ereal \\\" where\n \"interval_ereal = interval\"\ndefinition rep_interval_ereal :: \"ereal \\ \\ ereal \\ ereal \\ bool \\ bool\" where\n \"rep_interval_ereal = Rep_\\\"\n\nlemma tfin_enat_code[code]: \"(tfin :: enat set) = Collect_set (\\x. x \\ \\)\"\n by (auto simp: tfin_enat_def)\n\nlemma tfin_ereal_code[code]: \"(tfin :: ereal set) = Collect_set (\\x. x \\ -\\ \\ x \\ \\)\"\n by (auto simp: tfin_ereal_def)\n\nlemma Ball_atms[code_unfold]: \"Ball (atms r) P = list_all P (collect_subfmlas r [])\"\n using collect_subfmlas_atms[where ?phis=\"[]\"]\n by (auto simp: list_all_def)\n\nlemma MIN_fold: \"(MIN x\\set (z # zs). f x) = fold min (map f zs) (f z)\"\n by (metis Min.set_eq_fold list.set_map list.simps(9))\n\ndeclare progress.simps(1-8)[code]\n\nlemma progress_matchP_code[code]:\n \"progress (MatchP I r) ts = (case collect_subfmlas r [] of x # xs \\ fold min (map (\\f. progress f ts) xs) (progress x ts))\"\n using collect_subfmlas_atms[where ?r=r and ?phis=\"[]\"] atms_nonempty[of r]\n by (auto split: list.splits) (smt (z3) MIN_fold[where ?f=\"\\f. progress f ts\"] list.simps(15))\n\nlemma progress_matchF_code[code]:\n \"progress (MatchF I r) ts = (if length ts = 0 then 0 else\n (let k = min (length ts - 1) (case collect_subfmlas r [] of x # xs \\ fold min (map (\\f. progress f ts) xs) (progress x ts)) in\n Min {j \\ {..k}. memR (ts ! j) (ts ! k) I}))\"\n by (auto simp: progress_matchP_code[unfolded progress.simps])\n\nexport_code init_vydra_string_enat run_vydra_string_enat progress_enat bounded_future_fmla_enat wf_fmla_enat mdl2mdl'_enat\n Bool Preliminaries.Bool enat interval_enat rep_interval_enat nat_of_integer integer_of_nat mk_db\n in OCaml module_name VYDRA file_prefix \"verified\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/VYDRA_MDL/Monitor_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.29441504956189296}} {"text": "theory NP4_Optimising_Action_Semantics\n imports\n NP4_Optimising_Action_Values\n(*\n This file contains the semantics and progression rules to capture the behaviour of\n P4's action constructs. This mostly includes the statements present in P4, and the\n way these statements alter the state.\n\n Note: the state is a mapping from vnames to values (vals)\n*)\n\nbegin\n(* ============================================================================================================== *)\n(* SMALL STEP SEMANTICS RULES *)\n(* ============================================================================================================== *)\n\n(* The way P4 statements update the state and progress. The natural number included is to prove\n that computation always progresses. With every step of the computation this number always\n decreases, indicating progression and ultimately termination. Note that method invocations and\n switch statements are omitted as these can be modelled with the present statements as well. *)\ninductive small_step :: \"(statOrDecl * state * nat) \\ (statOrDecl * state * nat) \\ bool\" (infix \"\\\" 55)\n where\n Exit: \"(ExitStat, s, n) \\ (EmptyStat, s, n-1)\"\n | CondTrue: \"eval e s (BOOL True) \\ ((ConditionalStat e stmt1 stmt2), s, n) \\ (stmt1, s, n-1)\"\n | CondFalse: \"eval e s (BOOL False) \\ ((ConditionalStat e stmt1 stmt2), s, n) \\ (stmt2, s, n-1)\"\n | EmptyBlock: \"(BlockStat [], s, n) \\ (EmptyStat, s, n-1)\" \n | EmptyFirst: \"(BlockStat (EmptyStat # rest), s, n) \\ (BlockStat rest, s, n-1)\"\n | FullBlock: \"(stmt, s, n) \\ (stmt', s', n') \\ n' \\ n \\ (BlockStat (stmt # rest), s, n) \\ (BlockStat (stmt' # rest), s', n')\"\n | Assign: \"eval e s v \\ (AssignmentStat vName e, s, n) \\ (EmptyStat, s (vName := v), n-1)\"\n | VarDecl: \"(VariableDecl vName None, s, n) \\ (EmptyStat, s, n-1)\"\n | VarInit: \"eval e s v \\ (VariableDecl vName (Some e), s, n) \\ (EmptyStat, s (vName := v), n-1)\"\n | ConstInit: \"eval e s v \\ (ConstantDecl vName e, s, n) \\ (EmptyStat, s (vName := v), n-1)\"\n\ndeclare small_step.intros[simp, intro]\n\ninductive_cases [elim!]: \"(EmptyStat, s, n) \\ ct\" \"(ExitStat, s, n) \\ ct\" \"(ConditionalStat e stmt1 stmt2, s, n) \\ ct\"\n \"(BlockStat stmts, s, n) \\ ct\" \"(AssignmentStat l e, s, n) \\ ct\" \"(VariableDecl l e, s, n) \\ ct\" \"(ConstantDecl l e, s, n) \\ ct\"\n\nlemmas small_step_induct = small_step.induct[split_format(complete)]\n\nlemma small_step_deterministic: \"cs \\ cs' \\ cs \\ cs'' \\ cs' = cs''\"\nproof (induction arbitrary: cs'' rule: small_step.induct)\nnext case (CondTrue e s stmt1 stmt2 n) thus ?case using eval_deterministic by auto\nnext case (CondFalse e s stmt1 stm2 n stmt2) thus ?case using eval_deterministic by auto\nnext case (Assign e s v vName n) thus ?case using eval_deterministic by auto\nnext case (VarDecl vName s n) thus ?case using eval_deterministic by auto\nnext case (VarInit e s v vName n) thus ?case using eval_deterministic by auto\nnext case (ConstInit e s v vName n) thus ?case using eval_deterministic by auto\nqed auto\n\nlemma step_equal_or_smaller: \"(c, s, n) \\ (c', s', n') \\ n' \\ n\"\n apply (induction c rule: statOrDecl.induct)\n apply (auto)\n done\n\nabbreviation equiv_stmt :: \"statOrDecl \\ statOrDecl \\ bool\" (infix \"~\" 50) where\n \"stmt1 ~ stmt2 \\ (\\s t n. ((stmt1, s, n) \\ t) = ((stmt2, s, n) \\ t))\"\n\nlemma equiv_refl: \"c ~ c\" by simp\nlemma equiv_sym: \"(c ~ c') = (c' ~ c)\" by auto\nlemma equiv_trans: \"(c ~ c') \\ (c' ~ c'') \\ (c ~ c'')\" by simp\n\n(* ============================================================================================================== *)\n(* REFLEXIVE TRANSITIVE CLOSURE *)\n(* ============================================================================================================== *)\n\n(* Define the reflexive transitive closure on the signature of the small-step semantics. *)\ninductive star :: \"('a \\ 'a \\ bool) \\ 'a \\ 'a \\ bool\"\n for r :: \"('a \\ 'a \\ bool)\" where\nrefl: \"star r x x\" |\nstep: \"r x y \\ star r y z \\ star r x z\"\n\nhide_fact (open) refl step\n\nlemma star_trans: \"star r x y \\ star r y z \\ star r x z\"\n apply (induction rule: star.induct)\n apply (assumption)\n apply (metis star.step)\n done\n\nlemmas star_induct = star.induct[of \"r:: 'a*'b*'c \\ 'a*'b*'c \\ bool\", split_format(complete)]\n\ndeclare star.refl[simp, intro]\n\nlemma star_step1[simp, intro]: \"r x y \\ star r x y\"\n by (metis star.refl star.step)\n\ncode_pred star .\n\n(* The reflexive transitive closure of the small step function yields whether a state is reachable in any number of\n steps from the starting state and thereby models complete execution. *)\nabbreviation small_steps :: \"(statOrDecl * state * nat) \\ (statOrDecl * state * nat) \\ bool\" (infix \"\\*\" 55)\n where \"x \\* y \\ star small_step x y\"\n\nlemma star_equal_or_smaller: \"(c, s, n) \\* (c', s', n') \\ n' \\ n\"\nproof (induction rule: star_induct)\n case (refl a a b) thus ?case by simp\nnext case (step a a b a a b a a b) thus ?case by (meson dual_order.trans step_equal_or_smaller)\nqed\n\n(* ============================================================================================================== *)\n(* CONDITIONAL EQUIVALENCE PROOFS *)\n(* ============================================================================================================== *)\n\ntype_synonym assn = \"state \\ bool\"\n\n(*definition equiv_up_to :: \"assn \\ statOrDecl \\ statOrDecl \\ bool\" where \"\"*)\n\ndefinition equiv_up_to :: \"assn \\ statOrDecl \\ statOrDecl \\ bool\" (\"_ \\ _ ~ _\" [50, 0, 10] 50)\n where\n \"P \\ stmt1 ~ stmt2 \\ (\\s t n. P s \\ ((stmt1, s, n) \\ t) \\ ((stmt2, s, n) \\ t))\"\n\nlemma equiv_up_to_True: \"((\\_. True) \\ stmt1 ~ stmt2) = (stmt1 ~ stmt2)\"\n by (simp add: equiv_up_to_def)\n \nlemma equiv_up_to_weaken: \"P \\ stmt1 ~ stmt2 \\ (\\s. P' s \\ P s) \\ P' \\ stmt1 ~ stmt2\"\n by (simp add: equiv_up_to_def)\n\nlemma equiv_to_toI: \"(\\s t n. P s \\ (stmt1, s, n) \\ t = (stmt2, s, n) \\ t) \\ P \\ stmt1 ~ stmt2\"\n by (simp add: equiv_up_to_def)\n\nlemma equiv_up_toD1: \"P \\ stmt1 ~ stmt2 \\ (stmt1, s, n) \\ t \\ P s \\ (stmt2, s, n) \\ t\"\n by (unfold equiv_up_to_def) blast\nlemma equiv_up_toD2: \"P \\ stmt1 ~ stmt2 \\ (stmt2, s, n) \\ t \\ P s \\ (stmt1, s, n) \\ t\"\n by (unfold equiv_up_to_def) blast\n\nlemma equiv_up_to_refl [simp, intro!]: \"P \\ stmt ~ stmt\"\n by (auto simp: equiv_up_to_def)\nlemma equiv_up_to_sym: \"(P \\ stmt1 ~ stmt2) = (P \\ stmt2 ~ stmt1)\"\n by (auto simp: equiv_up_to_def)\nlemma equiv_up_to_trans: \"P \\ stmt1 ~ stmt2 \\ P \\ stmt2 ~ stmt3 \\ P \\ stmt1 ~ stmt3\"\n by (auto simp: equiv_up_to_def)\n\n(* ============================================================================================================== *)\n(* OPTIMISATION SEMANTIC EQUIVALENCE PROOFS *)\n(* ============================================================================================================== *)\n\ndefinition\n \"merge t1 t2 = (\\m. if t1 m = t2 m then t1 m else None)\"\n\nlemma approx_merge:\n \"approx t1 s \\ approx t2 s \\ approx (merge t1 t2) s\"\n by (smt approx_def merge_def option.distinct(1))\n\nfun defs :: \"statOrDecl \\ tab \\ tab\" where\n \"defs EmptyStat t = t\"\n | \"defs ExitStat t = t\"\n | \"defs (ConditionalStat expr stmt1 stmt2) t = merge (defs stmt1 t) (defs stmt2 t)\"\n | \"defs (BlockStat []) t = t\"\n | \"defs (BlockStat (stmt # xs)) t = (defs stmt \\ defs (BlockStat xs)) t\"\n | \"defs (AssignmentStat vName expr) t = (case efold expr t of\n (BASE bVal) \\ t (vName := Some (baseToVal bVal))\n | _ \\ t (vName := None))\"\n | \"defs (VariableDecl vName None) t = t\"\n | \"defs (VariableDecl vName (Some expr)) t = (case efold expr t of\n (BASE bVal) \\ t (vName := Some (baseToVal bVal))\n | _ \\ t (vName := None))\"\n | \"defs (ConstantDecl vName expr) t = (case efold expr t of\n (BASE bVal) \\ t (vName := Some (baseToVal bVal))\n | _ \\ t (vName := None))\"\n\nfun\n folds :: \"statOrDecl list \\ tab \\ statOrDecl list\"\nand\n fold :: \"statOrDecl \\ tab \\ statOrDecl\"\nwhere\n \"folds [] t = []\"\n | \"folds (stmt # stmts) t = ((fold stmt t) # (folds stmts (defs stmt t)))\"\n | \"fold EmptyStat t = EmptyStat\"\n | \"fold ExitStat t = ExitStat\"\n | \"fold (ConditionalStat expr stmt1 stmt2) t = (ConditionalStat expr (fold stmt1 t) (fold stmt2 t))\"\n | \"fold (BlockStat stmts) t = (BlockStat (folds stmts t))\"\n | \"fold (AssignmentStat vName expr) t = (AssignmentStat vName (efold expr t))\"\n | \"fold (VariableDecl vName None) t = (VariableDecl vName None)\"\n | \"fold (VariableDecl vName (Some expr)) t = (VariableDecl vName (Some (efold expr t)))\"\n | \"fold (ConstantDecl vName expr) t = (ConstantDecl vName (efold expr t))\"\n\nlemma small_step_pres_approx:\n \"(stmt, s, n) \\ (stmt', s', n') \\ approx t s \\ approx (defs stmt t) s'\"\nproof (induction arbitrary: t rule: small_step_induct)\n case (Exit s n)\n then show ?case\n by simp\nnext\n case (CondTrue e s stmt1 stmt2 n)\n then show ?case sorry\nnext\n case (CondFalse e s stmt1 stmt2 n)\n then show ?case sorry\nnext\n case (EmptyBlock s n)\n then show ?case\n by simp\nnext\n case (EmptyFirst rest s n)\n then show ?case sorry\nnext\n case (FullBlock stmt s n stmt' s' n' rest)\n then show ?case sorry\nnext\n case (Assign e s v vName n)\n then show ?case sorry\nnext\n case (VarDecl vName s n)\n then show ?case sorry\nnext\n case (VarInit e s v vName n)\n then show ?case sorry\nnext\n case (ConstInit e s v vName n)\n then show ?case sorry\nqed\n\nlemma approx_eq:\n \"approx t \\ c ~ (fold c t)\"\nproof (induction c arbitrary: t)\n case EmptyStat\n then show ?case\n by simp\nnext\n case ExitStat\n then show ?case\n by simp\nnext\n case (ConditionalStat x1 c1 c2)\n then show ?case sorry\nnext\n case (BlockStat x)\n then show ?case sorry\nnext\n case (AssignmentStat x1 x2)\n then show ?case sorry\nnext\n case (VariableDecl x1 x2)\n then show ?case sorry\nnext\n case (ConstantDecl x1 x2)\n then show ?case sorry\nqed\n\ntheorem constant_folding_equiv:\n \"fold c Map.empty ~ c\"\n by (metis approx_empty approx_eq equiv_up_to_def)\n\n(* ============================================================================================================== *)\n(* TYPING SYSTEM DEFINITION *)\n(* ============================================================================================================== *)\n\ndatatype ty = UINTty | SINTty | IINTty | VINTty | BOOLty | STRINGty | ERRORty | MATCHty\n\n(* Helper function to yield type from val object *)\nfun getValType :: \"val \\ ty\" where\n \"getValType (UINT n) = UINTty\"\n | \"getValType (SINT n) = SINTty\"\n | \"getValType (IINT n) = IINTty\"\n | \"getValType (VINT n) = VINTty\"\n | \"getValType (BOOL b) = BOOLty\"\n | \"getValType (STRING s) = STRINGty\"\n | \"getValType (ERROR e) = ERRORty\"\n | \"getValType (MATCH m) = MATCHty\"\n\nfun getBaseType :: \"baseType \\ ty\" where\n \"getBaseType (BUINT n) = UINTty\"\n | \"getBaseType (BSINT n) = SINTty\"\n | \"getBaseType (BIINT n) = IINTty\"\n | \"getBaseType (BVINT n) = VINTty\"\n | \"getBaseType (BBOOL b) = BOOLty\"\n | \"getBaseType (BSTRING s) = STRINGty\"\n | \"getBaseType (BERROR e) = ERRORty\"\n | \"getBaseType (BMATCH m) = MATCHty\"\n\n(* Mapping from a variable name to a type symbol *)\ntype_synonym typeEnv = \"vname \\ ty\"\n\n(* The typing environment for expressions. If a case is defined it implies the expression is well-typed\n given the context of the typing environment. *)\ninductive exprTyping :: \"typeEnv \\ expression \\ ty \\ bool\" (\"(1_/ \\/ (_ ::/ _))\" [50,0,50] 50) where\n(* =============== Base types =============== *)\n UINT_ty: \"\\ \\ (BASE (BUINT n)) :: UINTty\"\n | SINT_ty: \"\\ \\ (BASE (BSINT n)) :: SINTty\"\n | IINT_ty: \"\\ \\ (BASE (BIINT n)) :: IINTty\"\n | VINT_ty: \"\\ \\ (BASE (BVINT n)) :: VINTty\"\n | BOOL_ty: \"\\ \\ (BASE (BBOOL b)) :: BOOLty\"\n | STRING_ty: \"\\ \\ (BASE (BSTRING s)) :: STRINGty\"\n | ERROR_ty: \"\\ \\ (BASE (BERROR e)) :: ERRORty\"\n | MATCH_ty: \"\\ \\ (BASE (BMATCH m)) :: MATCHty\"\n(* =============== Miscellaneous expressions =============== *)\n | TERNEXPR_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ e2 :: \\ \\ \\ \\ e3 :: \\ \\ \\ \\ TernExpr e1 e2 e3 :: \\\"\n(* =============== Variable mapping =============== *)\n | VAR_ty: \"\\ \\ NamedVar vName :: \\ vName\"\n(* =============== Operations that yield a single bit (SBIT) =============== *)\n (* Empty for now *)\n(* =============== Operations that yield a boolean (BOOL) =============== *)\n (* Boolean operations *)\n | ULNEB_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ UNA_LNE e1 :: BOOLty\"\n | BEQUB_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ e2 :: BOOLty \\ \\ \\ BIN_EQU e1 e2 :: BOOLty\"\n | BNEQB_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ e2 :: BOOLty \\ \\ \\ BIN_NEQ e1 e2 :: BOOLty\"\n | BFANB_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ e2 :: BOOLty \\ \\ \\ BIN_FAN e1 e2 :: BOOLty\"\n | BFORB_ty: \"\\ \\ e1 :: BOOLty \\ \\ \\ e2 :: BOOLty \\ \\ \\ BIN_FOR e1 e2 :: BOOLty\"\n (* Signed integer operations *)\n | BEQUS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_EQU e1 e2 :: BOOLty\"\n | BNEQS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_NEQ e1 e2 :: BOOLty\"\n | BLEQS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_LEQ e1 e2 :: BOOLty\"\n | BGEQS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_GEQ e1 e2 :: BOOLty\"\n | BLESS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_LES e1 e2 :: BOOLty\"\n | BGRES_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_GRE e1 e2 :: BOOLty\"\n (* Unsigned integer operations *)\n | BEQUU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_EQU e1 e2 :: BOOLty\"\n | BNEQU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_NEQ e1 e2 :: BOOLty\"\n | BLEQU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_LEQ e1 e2 :: BOOLty\"\n | BGEQU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_GEQ e1 e2 :: BOOLty\"\n | BLESU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_LES e1 e2 :: BOOLty\"\n | BGREU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_GRE e1 e2 :: BOOLty\"\n (* Infinite precision integer operations *)\n | BEQUI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_EQU e1 e2 :: BOOLty\"\n | BNEQI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_NEQ e1 e2 :: BOOLty\"\n | BLEQI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_LEQ e1 e2 :: BOOLty\"\n | BGEQI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_GEQ e1 e2 :: BOOLty\"\n | BLESI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_LES e1 e2 :: BOOLty\"\n | BGREI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_GRE e1 e2 :: BOOLty\"\n (* Variable size bitstring operations *)\n | BEQUV_ty: \"\\ \\ e1 :: VINTty \\ \\ \\ e2 :: VINTty \\ \\ \\ BIN_EQU e1 e2 :: BOOLty\"\n | BNEQV_ty: \"\\ \\ e1 :: VINTty \\ \\ \\ e2 :: VINTty \\ \\ \\ BIN_NEQ e1 e2 :: BOOLty\"\n(* =============== Operations that yield an unsigned integer (UINT) =============== *)\n | UNEGU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ UNA_NEG e1 :: UINTty\"\n | UPOSU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ UNA_POS e1 :: UINTty\"\n | UCOMU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ UNA_COM e1 :: UINTty\"\n | BADDU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_ADD e1 e2 :: UINTty\"\n | BMINU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_MIN e1 e2 :: UINTty\"\n | BANDU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_AND e1 e2 :: UINTty\"\n | BXORU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_XOR e1 e2 :: UINTty\"\n | BLORU_ty: \"\\ \\ e1 :: UINTty \\ \\ \\ e2 :: UINTty \\ \\ \\ BIN_LOR e1 e2 :: UINTty\"\n(* =============== Operations that yield a signed integer (SINT) =============== *)\n | UNEGS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ UNA_NEG e1 :: SINTty\"\n | UPOSS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ UNA_POS e1 :: SINTty\"\n | BADDS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_ADD e1 e2 :: SINTty\"\n | BMINS_ty: \"\\ \\ e1 :: SINTty \\ \\ \\ e2 :: SINTty \\ \\ \\ BIN_MIN e1 e2 :: SINTty\"\n(* =============== Operations that yield an infinite-precision integer (IINT) =============== *)\n | UNEGI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ UNA_NEG e1 :: IINTty\"\n | UPOSI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ UNA_POS e1 :: IINTty\"\n | BADDI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_ADD e1 e2 :: IINTty\"\n | BMINI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_MIN e1 e2 :: IINTty\"\n | BMULI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_MUL e1 e2 :: IINTty\"\n | BDIVI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_DIV e1 e2 :: IINTty\"\n | BMODI_ty: \"\\ \\ e1 :: IINTty \\ \\ \\ e2 :: IINTty \\ \\ \\ BIN_MOD e1 e2 :: IINTty\"\n(* =============== Operations that yield a variable-width integer (VINT) =============== *)\n (* Empty for now *)\n\ndeclare exprTyping.intros [intro!]\ninductive_cases [elim!]:\n \"\\ \\ BASE b :: \\\" \"\\ \\ UNA_LNE e1 :: \\\" \"\\ \\ UNA_COM e1 :: \\\" \"\\ \\ UNA_NEG e1 :: \\\" \"\\ \\ UNA_POS e1 :: \\\"\n \"\\ \\ BIN_DIV e1 e2 :: \\\" \"\\ \\ BIN_MOD e1 e2 :: \\\" \"\\ \\ BIN_ADD e1 e2 :: \\\" \"\\ \\ BIN_MIN e1 e2 :: \\\" \"\\ \\ BIN_AND e1 e2 :: \\\"\n \"\\ \\ BIN_XOR e1 e2 :: \\\" \"\\ \\ BIN_LOR e1 e2 :: \\\" \"\\ \\ BIN_LEQ e1 e2 :: \\\" \"\\ \\ BIN_GEQ e1 e2 :: \\\" \"\\ \\ BIN_LES e1 e2 :: \\\"\n \"\\ \\ BIN_GRE e1 e2 :: \\\" \"\\ \\ BIN_NEQ e1 e2 :: \\\" \"\\ \\ BIN_EQU e1 e2 :: \\\" \"\\ \\ BIN_FAN e1 e2 :: \\\" \"\\ \\ BIN_FOR e1 e2 :: \\\"\n \"\\ \\ BIN_MUL e1 e2 :: \\\" \"\\ \\ TernExpr e1 e2 e3 :: \\\" \"\\ \\ NamedVar v :: \\\"\n\nlemma expr_typing_deterministic: \"\\ \\ e :: t \\ \\ \\ e :: t' \\ t' = t\"\n apply (induction arbitrary: t' rule: exprTyping.induct)\n apply (blast+)\n done\n\n(* The typing environment for statements. If a case is defined it implies the statement is well-typed\n given the context of the typing environment. *)\ninductive stmtTyping :: \"typeEnv \\ statOrDecl \\ bool\" (infix \"\\\" 50) where\n Empty_ty: \"\\ \\ EmptyStat\"\n | Exit_ty: \"\\ \\ ExitStat\"\n | Conditional_ty: \"\\ \\ e :: (BOOLty) \\ \\ \\ stmt1 \\ \\ \\ stmt2 \\ \\ \\ (ConditionalStat e stmt1 stmt2)\"\n | Block_Empty_ty: \"\\ \\ (BlockStat [])\"\n | BlockFull_ty: \"\\ \\ stmt \\ \\ \\ (BlockStat rest) \\ \\ \\ (BlockStat (stmt # rest))\"\n | Assign_ty: \"\\ \\ e :: \\ vName \\ \\ \\ (AssignmentStat vName e)\"\n | VarDecl_ty: \"\\ \\ (VariableDecl vName None)\"\n(* Remove \\ (vName) in below with just \\ because they should allow to change the type *)\n | VarInit_ty: \"\\ \\ e :: \\ vName \\ \\ \\ (VariableDecl vName (Some e))\"\n | ConstInit_ty: \"\\ \\ e :: \\ vName \\ \\ \\ (ConstantDecl vName e)\"\n\ndeclare stmtTyping.intros [intro!]\ninductive_cases [elim!]:\n \"\\ \\ ExitStat\" \"\\ \\ ConditionalStat e stmt1 stmt2\" \"\\ \\ BlockStat l\" \"\\ \\ AssignmentStat n e\" \"\\ \\ VariableDecl n e\"\n \"\\ \\ ConstantDecl n e\"\n\n(* The typing environment for the state. It states that a state is correctly typed if and only if the type\n of all variables in the state correspond with the typing environment. *)\ndefinition stateTyping :: \"typeEnv \\ state \\ bool\" (infix \"\\\" 50)\n where \"\\ \\ s \\ (\\x. getValType (s x) = \\ x)\"\n\n(* ============================================================================================================== *)\n(* TYPING SYSTEM PROOF *)\n(* ============================================================================================================== *)\n\n(* Prove that if the type of a particular variable is a given type, there always exists a concrete value with the\n matching type to satisfy the constraint. *)\nlemma type_eq_UINT[simp]: \"getValType v = UINTty \\ (\\i. v = UINT i)\" by (cases v) simp_all\nlemma type_eq_SINT[simp]: \"getValType v = SINTty \\ (\\i. v = SINT i)\" by (cases v) simp_all\nlemma type_eq_IINT[simp]: \"getValType v = IINTty \\ (\\i. v = IINT i)\" by (cases v) simp_all\nlemma type_eq_VINT[simp]: \"getValType v = VINTty \\ (\\i. v = VINT i)\" by (cases v) simp_all\nlemma type_eq_BOOL[simp]: \"getValType v = BOOLty \\ (\\i. v = BOOL i)\" by (cases v) simp_all\nlemma type_eq_STRING[simp]: \"getValType v = STRINGty \\ (\\i. v = STRING i)\" by (cases v) simp_all\nlemma type_eq_ERROR[simp]: \"getValType v = ERRORty \\ (\\i. v = ERROR i)\" by (cases v) simp_all\nlemma type_eq_MATCH[simp]: \"getValType v = MATCHty \\ (\\i. v = MATCH i)\" by (cases v) simp_all\n\n(* Theorem to state that if expression are well-typed, the result is necessarily also well-typed. *)\ntheorem expr_preservation: \"\\ \\ expr :: \\ \\ eval expr s v \\ \\ \\ s \\ getValType v = \\\"\n apply (induction arbitrary: v rule: exprTyping.induct)\n apply (fastforce simp: stateTyping_def)+\n done\n\nlemma expr_progress: \"\\ \\ e :: \\ \\ \\ \\ s \\ \\v. eval e s v\"\nproof (induction rule: exprTyping.induct)\n case (UINT_ty \\ n) thus ?case using RUINT by blast\nnext case (SINT_ty \\ n) thus ?case using RSINT by blast\nnext case (IINT_ty \\ n) thus ?case using RIINT by blast\nnext case (VINT_ty \\ n) thus ?case using RVINT by blast\nnext case (BOOL_ty \\ b) thus ?case using RBOOL by blast\nnext case (STRING_ty \\ s) thus ?case using RSTRING by blast\nnext case (ERROR_ty \\ e) thus ?case using RERROR by blast\nnext case (MATCH_ty \\ m) thus ?case using RMATCH by blast\nnext case (TERNEXPR_ty \\ e1 e2 \\ e3) thus ?case by (metis TERNFALSE TERNTRUE expr_preservation type_eq_BOOL)\nnext case (VAR_ty \\ vName) thus ?case using NAMEDVAR by blast \nnext case (ULNEB_ty \\ e1) thus ?case by (metis ULNEB expr_preservation type_eq_BOOL)\nnext case (BEQUB_ty \\ e1 e2) thus ?case by (metis BEQUB expr_preservation type_eq_BOOL)\nnext case (BNEQB_ty \\ e1 e2) thus ?case by (metis BNEQB expr_preservation type_eq_BOOL)\nnext case (BFANB_ty \\ e1 e2) thus ?case by (metis BFANB expr_preservation type_eq_BOOL)\nnext case (BFORB_ty \\ e1 e2) thus ?case by (metis BFORB expr_preservation type_eq_BOOL)\nnext case (BEQUS_ty \\ e1 e2) thus ?case by (metis BEQUS expr_preservation type_eq_SINT)\nnext case (BNEQS_ty \\ e1 e2) thus ?case by (metis BNEQS expr_preservation type_eq_SINT)\nnext case (BLEQS_ty \\ e1 e2) thus ?case by (metis BLEQS expr_preservation type_eq_SINT)\nnext case (BGEQS_ty \\ e1 e2) thus ?case by (metis BGEQS expr_preservation type_eq_SINT)\nnext case (BLESS_ty \\ e1 e2) thus ?case by (metis BLESS expr_preservation type_eq_SINT)\nnext case (BGRES_ty \\ e1 e2) thus ?case by (metis BGRES expr_preservation type_eq_SINT)\nnext case (BEQUU_ty \\ e1 e2) thus ?case by (metis BEQUU expr_preservation type_eq_UINT)\nnext case (BNEQU_ty \\ e1 e2) thus ?case by (metis BNEQU expr_preservation type_eq_UINT)\nnext case (BLEQU_ty \\ e1 e2) thus ?case by (metis BLEQU expr_preservation type_eq_UINT)\nnext case (BGEQU_ty \\ e1 e2) thus ?case by (metis BGEQU expr_preservation type_eq_UINT)\nnext case (BLESU_ty \\ e1 e2) thus ?case by (metis BLESU expr_preservation type_eq_UINT)\nnext case (BGREU_ty \\ e1 e2) thus ?case by (metis BGREU expr_preservation type_eq_UINT)\nnext case (BEQUI_ty \\ e1 e2) thus ?case by (metis BEQUI expr_preservation type_eq_IINT)\nnext case (BNEQI_ty \\ e1 e2) thus ?case by (metis BNEQI expr_preservation type_eq_IINT)\nnext case (BLEQI_ty \\ e1 e2) thus ?case by (metis BLEQI expr_preservation type_eq_IINT)\nnext case (BGEQI_ty \\ e1 e2) thus ?case by (metis BGEQI expr_preservation type_eq_IINT)\nnext case (BLESI_ty \\ e1 e2) thus ?case by (metis BLESI expr_preservation type_eq_IINT)\nnext case (BGREI_ty \\ e1 e2) thus ?case by (metis BGREI expr_preservation type_eq_IINT)\nnext case (BEQUV_ty \\ e1 e2) thus ?case by (metis BEQUV expr_preservation type_eq_VINT)\nnext case (BNEQV_ty \\ e1 e2) thus ?case by (metis BNEQV expr_preservation type_eq_VINT)\nnext case (UNEGS_ty \\ e1) thus ?case by (metis UNEGS expr_preservation type_eq_SINT)\nnext case (UPOSS_ty \\ e1) thus ?case by (metis UPOSS expr_preservation type_eq_SINT)\nnext case (BADDS_ty \\ e1 e2) thus ?case by (metis BADDS expr_preservation type_eq_SINT)\nnext case (BMINS_ty \\ e1 e2) thus ?case by (metis BMINS expr_preservation type_eq_SINT)\nnext case (UNEGU_ty \\ e1) thus ?case by (metis UNEGU expr_preservation type_eq_UINT)\nnext case (UPOSU_ty \\ e1) thus ?case by (metis UPOSU expr_preservation type_eq_UINT)\nnext case (UCOMU_ty \\ e1) thus ?case by (metis UCOMU expr_preservation type_eq_UINT)\nnext case (BADDU_ty \\ e1 e2) thus ?case by (metis BADDU expr_preservation type_eq_UINT)\nnext case (BMINU_ty \\ e1 e2) thus ?case by (metis BMINU expr_preservation type_eq_UINT)\nnext case (BANDU_ty \\ e1 e2) thus ?case by (metis BANDU expr_preservation type_eq_UINT)\nnext case (BXORU_ty \\ e1 e2) thus ?case by (metis BXORU expr_preservation type_eq_UINT)\nnext case (BLORU_ty \\ e1 e2) thus ?case by (metis BLORU expr_preservation type_eq_UINT)\nnext case (UNEGI_ty \\ e1) thus ?case by (metis UNEGI expr_preservation type_eq_IINT)\nnext case (UPOSI_ty \\ e1) thus ?case by (metis UPOSI expr_preservation type_eq_IINT)\nnext case (BADDI_ty \\ e1 e2) thus ?case by (metis BADDI expr_preservation type_eq_IINT)\nnext case (BMINI_ty \\ e1 e2) thus ?case by (metis BMINI expr_preservation type_eq_IINT)\nnext case (BMULI_ty \\ e1 e2) thus ?case by (metis BMULI expr_preservation type_eq_IINT)\nnext case (BDIVI_ty \\ e1 e2) thus ?case by (metis BDIVI expr_preservation type_eq_IINT)\nnext case (BMODI_ty \\ e1 e2) thus ?case by (metis BMODI expr_preservation type_eq_IINT)\nqed\n\ntheorem progress: \"\\ \\ c \\ \\ \\ s \\ c \\ EmptyStat \\ \\cs'. (c, s, n) \\ cs'\"\nproof (induction rule: stmtTyping.induct)\n case (Conditional_ty \\ e stmnt1 stmnt2) thus ?case by (smt CondFalse CondTrue expr_preservation expr_progress type_eq_BOOL)\nnext case (BlockFull_ty \\ firstStat remainder) thus ?case by (metis (full_types) EmptyFirst FullBlock old.prod.exhaust step_equal_or_smaller)\nnext case (Block_Empty_ty \\) thus ?case using expr_progress by blast\nnext case (Assign_ty \\ e vName) thus ?case using expr_progress by blast\nnext case (VarInit_ty \\ e vName) thus ?case using expr_progress by blast\nnext case (ConstInit_ty \\ e vName) thus ?case using expr_progress by blast\nqed blast+\n\ntheorem state_preservation: \"(c, s, n) \\ (c', s', n') \\ \\ \\ c \\ \\ \\ s \\ \\ \\ s'\"\nproof (induct rule: small_step_induct)\n case (Assign e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (VarDecl vName s n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (VarInit e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (ConstInit e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nqed blast+\n\ntheorem stmt_preservation: \"(c, s, n) \\ (c', s', n') \\ \\ \\ c \\ \\ \\ c'\"\nproof (induction rule: small_step_induct)\n case (FullBlock stmt s n stmt' s' n' rest) thus ?case\n proof -\n have \"\\ \\ stmt\" using FullBlock.prems by blast\n then have \"\\ \\ stmt'\" by (simp add: FullBlock.IH \\\\ \\ stmt\\)\n then have \"\\ \\ (BlockStat (stmt # rest))\" by (simp add: FullBlock.prems)\n then have \"\\ \\ (BlockStat (stmt' # rest))\" using \\\\ \\ stmt'\\ by blast\n thus ?case by auto\n qed\nqed auto\n\ntheorem type_sound: \"(c, s, n) \\* (c', s', n') \\ \\ \\ c \\ \\ \\ s \\ c' \\ EmptyStat \\ \\cs''. (c', s', n') \\ cs''\"\nproof (induction rule: star_induct)\n case (refl a a b) thus ?case using progress by auto\nnext case (step a a b a a b a a b) thus ?case using state_preservation stmt_preservation by auto\nqed\n\n(* ============================================================================================================== *)\n(* FINAL STATE PROPERTIES *)\n(* ============================================================================================================== *)\n\ndefinition \"final cs \\ (\\cs'. cs \\ cs')\"\n\nlemma EmptyFinal: \"c = EmptyStat \\ final (c, s, n)\" using final_def by blast\nlemma FinalEmpty: \"final (c, s, n) \\ \\ \\ c \\ \\ \\ s \\ c = EmptyStat\" using final_def progress by blast\n\n(* ============================================================================================================== *)\n(* REACHABILITY PROPERTIES *)\n(* ============================================================================================================== *)\n\ndefinition reachable :: \"statOrDecl \\ statOrDecl set\" where\n \"reachable c = {c'. \\s s' n n'. (c, s, n) \\* (c', s', n')}\"\n\nfun small_steps_n :: \"(statOrDecl * state * nat) \\ nat \\ (statOrDecl * state * nat) \\ bool\" (\"_ \\'(_') _\" [55,0,55] 55)\n where\n \"(cs \\(0) cs') = (cs' = cs)\"\n | \"(cs \\(Suc n) cs'') = (\\cs'. cs \\ cs' \\ cs' \\(n) cs'')\"\n\nlemma steps_n_if_star: \"cs \\* cs' \\ \\n. cs \\(n) cs'\"\nproof (induction rule: star.induct)\n case (refl x) thus ?case using small_steps_n.simps(1) by blast\nnext\n case (step x y z) thus ?case using small_steps_n.simps(2) by blast\nqed\n\nlemma star_if_steps_n: \"cs \\(n) cs' \\ cs \\* cs'\"\n apply (induction n arbitrary: cs)\n apply (simp)\n apply (meson small_steps_n.simps(2) star.simps)\n done\n\nlemma steps_n_decreases: \"(c, s, n) \\(x) (c', s', n') \\ n' \\ n\"\n using star_equal_or_smaller star_if_steps_n by blast\n\nend", "meta": {"author": "Johanmyst", "repo": "Nano-P4", "sha": "fc3720d7115d0bac5d719cfe6c73a024aae7f9c4", "save_path": "github-repos/isabelle/Johanmyst-Nano-P4", "path": "github-repos/isabelle/Johanmyst-Nano-P4/Nano-P4-fc3720d7115d0bac5d719cfe6c73a024aae7f9c4/Theory_Files/Optimisation_Verification/NP4_Optimising_Action_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.2943399442988436}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\ntheory Deterministic_AI\nimports AInvs\nbegin\n\ncontext begin interpretation Arch .\nrequalify_facts\n update_work_units_empty_fail\n reset_work_units_empty_fail\n get_cap_kheap\n set_domain_empty_fail\n thread_set_domain_empty_fail\nend\n\nlemmas [wp] =\n update_work_units_empty_fail\n reset_work_units_empty_fail\n get_cap_kheap\n set_domain_empty_fail\n thread_set_domain_empty_fail\n\ndeclare dxo_wp_weak[wp del]\n\n(** This theory shows that the cdt_list operations\n correctly correspond to the existing cdt operations\n and demonstrates their effect on the traversal order\n of the tree. *)\n\n(* An unspecified invariant is given from the state\n extension's type class, which is assumed to hold over\n all the capability operations. We show here that it\n therefore holds over the whole kernel. This will\n later be instantiated to valid_list. *)\n\n(* a valid cdt_list for a node is a list that contains all of its children\n (from the mdb) exactly once *)\n\n (*Some nasty hackery to get around lack of polymorphic type class operations*)\n\nlemma and_assoc: \"(A and (B and C)) = (A and B and C)\"\n apply (rule ext)\n apply simp\ndone\n\nlemma no_children_empty_desc:\n \"(\\c. m c \\ Some slot) = (descendants_of slot m = {})\"\n apply(rule iffI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(intro allI notI)\n apply(drule tranclD)\n apply(simp)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n done\n\nlemma next_childD:\n \"\\next_child slot t = Some child; valid_list_2 t m\\\n \\ (\\xs. t slot = child # xs) \\ m child = Some slot\"\n apply(simp only: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=slot in allE)\n apply(clarsimp simp: next_child_def valid_list_2_def)\n apply(case_tac \"t slot\")\n apply(simp)\n apply(fastforce)\n done\n\nlemma next_child_NoneD:\n notes split_paired_All[simp del]\n shows \"next_child slot t = None \\ t slot = []\"\n apply(simp add: next_child_def)\n apply(case_tac \"t slot\")\n apply(simp)\n apply(simp)\n done\n\nlemma next_child_None_empty_desc:\n notes split_paired_All[simp del]\n shows \"valid_list_2 t m\n \\ (next_child slot t = None) = (descendants_of slot m = {})\"\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=slot in allE)\n apply(clarsimp simp: next_child_def)\n apply(case_tac \"t slot\")\n apply(simp add: no_children_empty_desc)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n done\n\nlemma next_sibD:\n \"next_sib slot t m = Some child\n \\ (\\p. m slot = Some p \\ after_in_list (t p) slot = Some child)\"\n apply(clarsimp simp: next_sib_def)\n apply(case_tac \"m slot\")\n apply(simp)\n apply(clarsimp)\n done\n\nlemma next_sib_NoneD:\n \"next_sib slot t m = None\n \\ m slot = None \\ (\\p. m slot = Some p \\ after_in_list (t p) slot = None)\"\n apply(clarsimp simp: next_sib_def)\n apply(case_tac \"m slot\")\n apply(fastforce)+\n done\n\nlemma desc_not_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_mdb s \\ slot \\ descendants_of slot (cdt s)\"\n apply(fastforce simp: valid_mdb_def no_mloop_def descendants_of_def cdt_parent_defs)\n done\n\nlemma next_childI:\n \"t slot = child # xs\n \\ next_child slot t = Some child\"\n by (simp add: next_child_def)\n\nlemma next_childI':\n \"\\t slot = child # xs; x = Some child\\\n \\ next_child slot t = x\"\n by (simp add: next_child_def)\n\nlemma next_sibI:\n \"\\m slot = Some p; after_in_list (t p) slot = Some sib\\\n \\ next_sib slot t m = Some sib\"\n by (simp add: next_sib_def)\n\nlemma next_sibI':\n \"\\m slot = Some p; after_in_list (t p) slot = Some sib; x = Some sib\\\n \\ next_sib slot t m = x\"\n by (simp add: next_sib_def)\n\nlemma next_child_NoneI:\n \"t slot = [] \\ next_child slot t = None\"\n by (simp add: next_child_def)\n\nlemma next_sib_NoneI:\n \"m slot = None \\ (m slot = Some p \\ after_in_list (t p) slot = None) \\ next_sib slot t m = None\"\n by (fastforce simp: next_sib_def)\n\nlemma not_child_not_sib:\n \"\\m slot = None; valid_list_2 t m\\ \\ next_sib p t m \\ Some slot\"\n apply(simp add: next_sib_def)\n apply(case_tac \"m p\")\n apply(simp)\n apply(simp)\n apply(rule notI)\n apply(simp only: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=a in allE)\n apply(fastforce dest: after_in_list_in_list)\n done\n\nlemma not_child_no_sibs:\n \"m slot = None \\ next_sib slot t m = None\"\n by (simp add: next_sib_def)\n\nlemma descendants_linear:\n \"\\a \\ descendants_of b m; a \\ descendants_of c m; b \\ c\\\n \\ b \\ descendants_of c m \\ c \\ descendants_of b m\"\n apply(clarsimp)\n apply(simp add: descendants_of_def cdt_parent_rel_def is_cdt_parent_def)\n apply(induct b a rule: trancl.induct)\n apply(simp)\n apply(erule tranclE)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(subgoal_tac \"(c, b) \\ {(p, c). m c = Some p}\\<^sup>+\")\n apply(simp)\n apply(subgoal_tac \"b \\ c\")\n apply(erule_tac a=c and b=ca in tranclE)\n apply(simp)\n apply(simp)\n apply(fastforce)\n done\n\nlemma descendants_trans:\n \"\\a \\ descendants_of b m; b \\ descendants_of c m\\ \\ a \\ descendants_of c m\"\n by (simp add: descendants_of_def)\n\ndefinition finite_depth :: \"cdt \\ bool\" where\n \"finite_depth m \\\n \\slot. \\p. (slot \\ descendants_of p m \\ p = slot) \\ m p = None\"\n\nlemma sib_not_desc:\n \"\\no_mloop m; m x = Some p; m y = Some p\\\n \\ x \\ descendants_of y m\"\n apply(rule notI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)\n apply(elim conjE exE)\n apply(simp)\n apply(drule rtranclD)\n apply(erule disjE)\n apply(fastforce simp: no_mloop_def cdt_parent_defs)\n apply(erule conjE)\n apply(subgoal_tac \"(z, z) \\ {(p, c). m c = Some p}\\<^sup>+\")\n prefer 2\n apply(rule_tac b=y in trancl_into_trancl2)\n apply(simp)\n apply(simp)\n apply(fastforce simp: no_mloop_def cdt_parent_defs)\n done\n\nlemma finite_depth:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"valid_mdb s \\ finite_depth (cdt s)\"\n apply(simp add: finite_depth_def)\n apply(intro allI)\n apply(subgoal_tac \"{x. slot \\ descendants_of x (cdt s)} \\ {x. cte_wp_at (\\_. True) x s}\")\n prefer 2\n apply(fastforce simp: descendants_of_cte_at2)\n apply(drule finite_subset)\n apply(simp add: cte_wp_at_set_finite)\n apply(case_tac \"cdt s slot\")\n apply(fastforce)\n apply(rule ccontr)\n apply(simp)\n apply(frule_tac f=\"\\x. THE y. cdt s x = Some y\" in inj_on_iff_eq_card)\n apply(subgoal_tac \"inj_on (\\x. THE y. cdt s x = Some y) {x. slot \\ descendants_of x (cdt s)}\")\n prefer 2\n apply(simp(no_asm) add: inj_on_def)\n apply(intro allI impI)\n apply(rule ccontr)\n apply(frule_tac b=x and c=y in descendants_linear)\n apply(simp)\n apply(simp)\n apply(case_tac \"cdt s x\")\n apply(fastforce)\n apply(case_tac \"cdt s y\")\n apply(fastforce)\n apply(fastforce simp: valid_mdb_def sib_not_desc)\n apply(simp)\n apply(subgoal_tac \"((\\x. THE y. cdt s x = Some y) ` {x. slot \\ descendants_of x (cdt s)})\n \\ {x. slot \\ descendants_of x (cdt s)}\")\n prefer 2\n apply(rule psubsetI)\n apply(rule subsetI)\n apply(simp)\n apply(erule imageE)\n apply(case_tac \"cdt s xa\")\n apply(fastforce)\n apply(rule_tac b=xa in descendants_trans)\n apply(simp)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(rule_tac x=a in set_neqI[symmetric])\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(rule notI)\n apply(erule imageE)\n apply(case_tac \"cdt s x\")\n apply(fastforce)\n apply(fastforce simp: sib_not_desc valid_mdb_def)\n apply(drule psubset_card_mono)\n apply(assumption)\n apply(simp)\n done\n\nlemma cdt_power:\n \"\\\\i. m (f i) = Some (f (Suc i)); (p, f 0) \\ {(p, c). m c = Some p} ^^ n\\\n \\ p = f n\"\n apply(induct n arbitrary: p)\n apply(simp)\n apply (metis (lifting, full_types) mem_Collect_eq option.inject prod.simps(2) relpow_Suc_D2)\n done\n\nlemma wf_cdt_parent_rel:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"finite_depth m \\ wf (cdt_parent_rel m)\"\n apply(subst wf_iff_no_infinite_down_chain)\n apply(rule notI)\n apply(clarsimp simp: finite_depth_def descendants_of_def cdt_parent_defs)\n apply(erule_tac x=\"f 0\" in allE)\n apply(elim exE conjE)\n apply(erule disjE)\n apply(simp add: trancl_power)\n apply(elim exE conjE)\n apply(frule cdt_power)\n apply(assumption)\n apply(clarsimp)\n apply(simp)\n done\n\nlemma cdt_induct:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\\\x. m x = None \\ P x; \\x y. \\m x = Some y; P y\\ \\ P x; finite_depth m\\\n \\ P slot\"\n apply(induct_tac rule: wf_induct[where r=\"cdt_parent_rel m\"])\n apply(simp add: wf_cdt_parent_rel)\n apply(simp add: cdt_parent_defs)\n apply(case_tac \"m x\")\n apply(simp)\n apply(erule_tac x=a in allE)\n apply(simp)\n done\n\nlemma next_not_child_domintros:\n \"(\\x. \\next_sib slot t m = None; m slot = Some x\\\n \\ next_not_child_dom (x, t, m))\n \\ next_not_child_dom (slot, t, m)\"\n apply(rule accpI)\n apply(erule next_not_child_rel.cases)\n apply(simp)\n done\n\nlemma next_not_child_termination:\n \"finite_depth m \\ next_not_child_dom (slot, t, m)\"\n apply(induct_tac rule: cdt_induct[where m=m])\n apply(rule next_not_child_domintros)\n apply(simp)\n apply(rule next_not_child_domintros)\n apply(simp)\n apply(simp)\n done\n\nlemma next_not_child_pinduct':\n \"\\next_not_child_dom (slot, t, m);\n \\slot.\n \\next_not_child_dom (slot, t, m);\n \\a. \\next_sib slot t m = None; m slot = Some a\\ \\ P a t m\\\n \\ P slot t m\\\n \\ P slot t m\"\n apply(induct rule: next_not_child.pinduct)\n apply(simp)\n done\n\nlemma next_not_child_pinduct:\n \"\\\\slot. \\\\a. \\next_sib slot t m = None; m slot = Some a\\ \\ P a\\\n \\ P slot; finite_depth m\\\n \\ P slot\"\n apply(rule_tac t=t and m=m in next_not_child_pinduct')\n apply(rule next_not_child_termination)\n apply(assumption)\n apply(fastforce)\n done\n\ndeclare next_not_child.psimps[simp]\n\nlemma next_not_child_pinduct2':\n \"\\next_not_child_dom (p, t, m);\n \\a slot. \\next_sib a t m = None; m a = Some slot; P a\\ \\ P slot;\n next_not_child p t m = Some n; P p;\n \\a slot. next_sib a t m = Some slot \\ P slot\\\n \\ P n\"\n apply(induct rule: next_not_child.pinduct)\n apply(simp split: if_split_asm del: split_paired_All)\n apply(case_tac \"m slot\")\n apply simp\n apply simp\n done\n\nlemma next_not_child_pinduct2:\n \"\\\\a slot. \\next_sib a t m = None; m a = Some slot; P a\\ \\ P slot;\n next_not_child p t m = Some n; P p;\n \\a slot. next_sib a t m = Some slot \\ P slot; finite_depth m\\\n \\ P n\"\n by (rule next_not_child_pinduct2', simp_all add: next_not_child_termination)\n\nlemma next_not_child_linearI:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\" shows\n \"\\m p = m' p; next_sib p t m = next_sib p t' m';\n \\q. p \\ descendants_of q m \\ m q = m' q\n \\ next_sib q t m = next_sib q t' m'; finite_depth m; finite_depth m'\\\n \\ next_not_child p t' m' = next_not_child p t m\"\n apply(induct rule: next_not_child_pinduct[where t=t and m=m])\n apply(simp)\n apply(case_tac \"m slot\")\n apply(simp add: next_not_child_termination)\n apply(case_tac \"next_sib slot t m\")\n apply(simp add: next_not_child_termination)\n apply(case_tac \"m' slot\")\n apply(simp)\n apply(simp)\n apply(atomize)\n apply(erule_tac x=aa in allE)\n apply(simp split: if_split_asm)\n apply(case_tac \"m' aa\")\n apply(simp)\n apply(simp add: next_not_child_termination)\n apply(intro conjI impI)\n apply(case_tac \"m aa\")\n apply(simp)\n apply(erule_tac x=aa in allE)\n apply(erule impE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(simp)\n apply(erule exE)\n apply(erule_tac x=aa in allE)(* condense *)\n apply(erule impE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(simp)\n apply(simp)\n apply(erule impE)\n apply(erule_tac x=aa in allE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(erule impE)\n apply(erule_tac x=aa in allE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(erule impE)\n apply(intro allI impI)\n apply(erule_tac x=q in allE)\n apply(erule impE)\n apply(simp add: cdt_parent_defs descendants_of_def)\n apply(rule_tac b=aa in trancl_into_trancl)\n apply(simp, simp)\n apply(simp)\n apply(erule_tac x= aa in allE)\n apply(erule impE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(simp add: next_not_child_termination) (* condense *)\n apply(erule_tac x=aa in allE)\n apply(erule impE)\n apply(fastforce simp: cdt_parent_defs descendants_of_def)\n apply(simp add: next_not_child_termination)\n apply(simp)\n apply(fastforce simp: next_not_child_termination)\n using f_d\n apply(assumption)\n done\n\nlemma next_not_child_linearI':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\" shows\n \"\\finite_depth m'; m p = m' p; next_sib p t m = next_sib p t' m';\n \\q. p \\ descendants_of q m \\ m q = m' q\n \\ (m q = m' q \\ next_sib q t m = next_sib q t' m')\\\n \\ next_not_child p t' m' = next_not_child p t m\"\n using f_d\n apply (rule next_not_child_linearI,simp+)\n done\n\nlemma next_not_childI':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\" shows\n \"\\next_sib p t m = Some n \\\n (next_sib p t m = None \\\n (\\q. next_sib q t m = Some n \\ p \\ descendants_of q m\n \\ (\\q'. q' \\ descendants_of q m \\ p \\ descendants_of q' m\n \\ next_sib q' t m = None))); finite_depth m\\\n \\ next_not_child p t m = Some n\"\n apply(induct p rule: next_not_child_pinduct[where t=t and m=m])\n apply(simp)\n apply(erule disjE)\n apply(simp add: next_not_child_termination)\n apply(simp)\n apply(elim conjE exE)\n apply(subst next_not_child.psimps, simp add: next_not_child_termination)\n apply(simp)\n apply(case_tac \"m slot\")\n apply(simp)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)\n apply(fastforce)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(simp)\n apply(case_tac \"next_sib a t m\")\n apply(simp)\n apply(case_tac \"a=q\")\n apply(simp)\n apply(erule impE)\n apply(rule_tac x=q in exI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)\n apply(elim exE conjE, simp)\n apply(drule rtranclD, simp)\n apply(intro allI impI)\n apply(erule_tac x=q' in allE)\n apply(simp)\n apply(elim impE conjE)\n apply(drule_tac x=q' and y=z in tranclD2)\n apply(elim exE conjE)\n apply(simp)\n apply(rule_tac b=z in trancl_into_trancl)\n apply(rule_tac b=za in rtrancl_into_trancl1)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(case_tac \"a=q\")\n apply(simp)\n apply(erule_tac x=a in allE)\n apply(erule_tac Q=\"next_sib a t m = None\" in impE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule conjI)\n apply(drule tranclD2)\n apply(elim conjE exE)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(fastforce)\n apply(simp)\n using f_d apply(simp)\n done\n\nlemma next_not_childI:\n \"\\next_sib p t m = Some n \\\n (next_sib p t m = None \\\n (\\q. next_sib q t m = Some n \\ p \\ descendants_of q m\n \\ (\\q'. q' \\ descendants_of q m \\ p \\ descendants_of q' m\n \\ next_sib q' t m = None))); finite_depth m\\\n \\ next_not_child p t m = Some n\"\n by(simp add: next_not_childI')\n\nlemma next_not_child_NoneI':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\"\n shows\n \"\\\\q. p \\ descendants_of q m \\ next_sib q t m = None;\n next_sib p t m = None; finite_depth m\\\n \\ next_not_child p t m = None\"\n apply(induct p rule: next_not_child_pinduct[where t=t and m=m])\n apply(simp)\n apply(case_tac \"m slot\")\n apply(simp add: next_not_child_termination)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(simp)\n apply(erule impE)\n apply(intro allI impI)\n apply(erule_tac x=q in allE)\n apply(erule impE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule_tac b=a in trancl_into_trancl)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(erule impE)\n apply(erule_tac x=a in allE)\n apply(erule impE)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp)\n apply(subst next_not_child.psimps)\n apply(simp add: next_not_child_termination)\n apply(simp)\n using f_d apply(simp)\n done\n\nlemma next_not_child_NoneI:\n \"\\\\q. p \\ descendants_of q m \\ next_sib q t m = None;\n next_sib p t m = None; finite_depth m\\\n \\ next_not_child p t m = None\"\n by(simp add: next_not_child_NoneI')\n\nlemma next_not_childD':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\" shows\n \"\\next_not_child p t m = Some n; finite_depth m; no_mloop m\\\n \\ next_sib p t m = Some n \\\n (next_sib p t m = None \\\n (\\q. next_sib q t m = Some n \\ p \\ descendants_of q m\n \\ (\\q'. q' \\ descendants_of q m \\ p \\ descendants_of q' m\n \\ next_sib q' t m = None)))\"\n apply(induct p rule: next_not_child_pinduct[where t=t and m=m])\n apply(simp)\n apply(case_tac \"m slot\")\n apply(simp)\n apply(rule disjCI)\n apply(simp)\n apply(erule disjE)\n apply(erule exE, drule next_sibD)\n apply(simp add: next_sib_def)\n apply(simp add: next_not_child_termination split: if_split_asm)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(simp)\n apply(case_tac \"next_sib slot t m\")\n apply(simp)\n apply(case_tac \"next_not_child a t m = Some n\")\n apply(simp)\n apply(erule disjE)\n apply(rule_tac x=a in exI)\n apply(simp)\n apply(rule conjI)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(intro impI allI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(erule conjE)\n apply(drule_tac x=q' in tranclD2)\n apply(elim exE conjE)\n apply(simp)\n apply(drule_tac b=q' and c=z in trancl_rtrancl_trancl)\n apply(simp)\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(elim conjE exE)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(rule conjI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule_tac b=a in trancl_into_trancl)\n apply(simp)\n apply(simp)\n apply(intro allI impI)\n apply(case_tac \"a=q'\")\n apply(simp)\n apply(erule_tac x=q' in allE)\n apply(erule impE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(erule conjE)\n apply(drule_tac y=slot in tranclD2)\n apply(elim conjE exE)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(simp)\n apply(simp add: next_not_child_termination)\n apply(simp add: next_not_child_termination)\n using f_d apply(simp)\n done\n\nlemma next_not_childD:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\next_not_child p t m = Some n; finite_depth m; no_mloop m\\\n \\ next_sib p t m = Some n \\\n (next_sib p t m = None \\\n (\\q. next_sib q t m = Some n \\ p \\ descendants_of q m\n \\ (\\q'. q' \\ descendants_of q m \\ p \\ descendants_of q' m\n \\ next_sib q' t m = None)))\"\n by (simp add: next_not_childD')\n\nlemma next_not_child_NoneD':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes f_d: \"finite_depth m\" shows\n \"\\next_not_child p t m = None; finite_depth m\\\n \\ (\\q. p \\ descendants_of q m \\ next_sib q t m = None) \\\n next_sib p t m = None\"\n apply(induct p rule: next_not_child_pinduct[where t=t and m=m])\n apply(subgoal_tac \"next_sib slot t m = None\")\n prefer 2\n apply(subst(asm)(2) next_not_child.psimps)\n apply(simp add: next_not_child_termination)\n apply(case_tac \"next_sib slot t m\")\n apply(simp)\n apply(simp)\n apply(simp)\n apply(intro allI impI)\n apply(case_tac \"m slot\")\n apply(subst(asm)(2) next_not_child.psimps)\n apply(simp add: next_not_child_termination)\n apply(case_tac \"next_sib slot t m\")\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)\n apply(fastforce)\n apply(simp)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(simp)\n apply(erule impE)\n apply(simp add: next_not_child_termination)\n apply(case_tac \"q=a\")\n apply(simp add: next_not_child_termination split: if_split_asm)\n apply(erule conjE)\n apply(erule_tac x=q in allE)\n apply(erule impE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)\n apply(elim conjE exE)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(simp)\n using f_d apply(simp)\n done\n\nlemma next_not_child_NoneD:\n \"\\next_not_child p t m = None; finite_depth m\\\n \\ (\\q. p \\ descendants_of q m \\ next_sib q t m = None) \\\n next_sib p t m = None\"\n by (simp add: next_not_child_NoneD')\n\nlemma slot_in_one_list:\n \"\\c \\ set (t p); c \\ set (t p'); valid_list_2 t m\\ \\ p = p'\"\n by (simp only: valid_list_2_def, simp)\n\n\nlemma next_sib_inj:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\next_sib a t m = Some y; next_sib b t m = Some y; valid_list_2 t m\\\n \\ a = b\"\n apply(drule next_sibD)+\n apply(simp add: valid_list_2_def)\n apply(elim exE conjE)\n apply(frule_tac a=a in after_in_list_in_list)\n apply(frule_tac a=b in after_in_list_in_list)\n apply(rule_tac list=\"t pa\" and x=y in after_in_list_inj)\n apply(simp)\n apply(simp)\n apply(simp)\n done\n\nlemma no_mloop_descendants:\n \"no_mloop m = (\\x. x \\ descendants_of x m)\"\n by (clarsimp simp: no_mloop_def descendants_of_def)\n\nlemma no_mloop_descendants':\n \"no_mloop m \\ x \\ descendants_of x m\"\n by (simp add: no_mloop_descendants del: split_paired_All)\n\nlemma valid_list_2D:\n notes split_paired_All[simp del]\n shows\n \"valid_list_2 t m \\ src \\ set (t p) \\ m src = Some p\"\n apply (simp add: valid_list_2_def)\n done\n\n\nlemma replace_parent_ignore:\n notes split_paired_All[simp del]\n shows\n \"valid_list_2 t m \\ m src \\ Some src_p \\ (list_replace (t src_p) src dest) = (t src_p)\"\n apply (rule list_replace_ignore)\n apply (clarsimp simp add: valid_list_2_def)\n done\n\nlemma after_in_list_not_parent:\n notes split_paired_All[simp del]\n shows\n \"valid_list_2 t m \\ no_mloop m \\ after_in_list (t x) z \\ Some x\"\n apply (rule notI)\n apply (frule(1) valid_list_2D[OF _ after_in_list_in_list])\n apply (frule(1) no_mloop_neq,simp)\n done\n\nlemma ancestor_not_descendant:\nnotes split_paired_All[simp del]\nshows\n\"no_mloop m \\ src \\ descendants_of src_p m \\ src_p \\ descendants_of src m\"\n apply (rule notI)\n apply (frule(1) descendants_trans)\n apply (simp add: no_mloop_def descendants_of_def)\n done\n\nlemma child_descendant:\n\"m src = Some src_p \\ src \\ descendants_of src_p m\"\n apply (simp add: descendants_of_def cdt_parent_rel_def is_cdt_parent_def)\n apply (rule r_into_trancl')\n apply simp\n done\n\nlemmas parent_not_descendant = ancestor_not_descendant[OF _ child_descendant]\n\nlemma next_sib_not_self:\nnotes split_paired_All[simp del]\nshows\n\"valid_list_2 t m \\ next_sib src t m \\ Some src\"\n apply (rule notI)\n apply (simp add: next_sib_def split: option.splits)\n apply (subgoal_tac \"distinct (t (the (m src)))\")\n apply (frule distinct_after_in_list_not_self[where src=src])\n apply simp\n apply (simp add: valid_list_2_def)\n done\n\nlemma next_sib_same_parent:\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\nshows\n\"valid_list_2 t m \\ next_sib sib t m = Some me \\ \\p. m sib = Some p \\ m me = Some p\"\n apply (simp add: next_sib_def split: option.splits)\n apply (drule after_in_list_in_list)\n apply (simp add: valid_list_2_def)\n done\n\nlemma next_not_child_not_self:\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\nshows\n\"valid_list_2 t m \\ finite_depth m \\ no_mloop m \\ next_not_child src t m \\ Some src\"\n apply (rule notI)\n apply (drule next_not_childD,simp+)\n apply (elim disjE)\n apply (frule next_sib_not_self[where src=src],simp)\n apply (elim conjE exE)\n apply (frule_tac me=src and sib=q in next_sib_same_parent,assumption)\n apply (elim exE conjE)\n apply (subgoal_tac \"src \\ descendants_of q m\")\n apply simp\n apply (rule sib_not_desc,simp+)\n done\n\nlemma empty_list_empty_desc:\n \"valid_list_2 t m \\ (t p = []) = (descendants_of p m = {})\"\n apply(drule_tac slot=p in next_child_None_empty_desc)\n apply(simp add: next_child_def)\n apply(case_tac \"t p\", simp+)\n done\n\n\nlemma after_in_list_not_self_helper:\n \"\\distinct list;\n after_in_list list c = Some c;\n (list, c) = (x # y # xs, a)\\\n \\ False\"\n apply (induct list arbitrary: x y xs a,simp)\n apply atomize\n apply (case_tac xs)\n apply (case_tac \"aa =x\")\n apply (case_tac \"x = y\",simp,simp)\n apply (simp split: if_split_asm)+\n done\n\nlemma after_in_list_not_self:\n \"\\m c = Some p; valid_list_2 t m\\ \\ after_in_list (t p) c \\ Some c\"\n apply (simp only: valid_list_2_def)\n apply (erule conjE)\n apply (drule_tac x = p in spec)+\n apply (thin_tac \"set (t p) = {c. m c = Some p}\")\n apply (rule notI)\n apply (rule_tac x = \"(t p, c)\" in after_in_list.cases, simp, simp)\n apply (blast intro: after_in_list_not_self_helper)\n done\n\nlemma not_sib_self:\n \"valid_list_2 t m \\ next_sib slot t m \\ Some slot\"\n by (case_tac \"m slot\", auto simp: next_sib_def after_in_list_not_self)\n\n\nlemma next_not_child_eq_next_sib_None:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next_not_child p t m = next_not_child q t m; p \\ descendants_of a m \\ p = a;\n a \\ descendants_of q m; valid_list_2 t m; finite_depth m; no_mloop m\\\n \\ next_sib a t m = None\"\n apply(case_tac \"next_not_child p t m\")\n apply(drule(1) next_not_child_NoneD)\n apply(fastforce)\n apply(case_tac \"next_not_child q t m\")\n apply(simp)\n apply(subgoal_tac \"aa=aaa\")\n prefer 2\n apply(simp)\n apply(drule(2) next_not_childD)+\n apply(erule_tac P=\"next_sib p t m = Some aa\" in disjE)\n apply(erule_tac P=\"next_sib q t m = Some aaa\" in disjE)\n apply(simp)\n apply(drule(2) next_sib_inj)\n apply(simp)\n apply(erule disjE)\n apply(drule_tac a=q and c=q in descendants_trans)\n apply(simp)\n apply(simp add: no_mloop_descendants)\n apply(simp add: no_mloop_descendants)\n apply(elim exE conjE)\n apply(drule_tac a=p and b=qa in next_sib_inj)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(erule disjE)\n apply(drule_tac a=qa and c=q in descendants_trans, simp)\n apply(drule_tac a=qa and c=qa in descendants_trans, simp)\n apply(simp add: no_mloop_descendants)\n apply(simp)\n apply(drule_tac a=a and c=a in descendants_trans, simp)\n apply(simp add: no_mloop_descendants)\n apply(erule_tac P=\"next_sib q t m = Some aaa\" in disjE)\n apply(elim exE conjE, simp)\n apply(drule(2) next_sib_inj, fastforce)\n apply(elim exE conjE, simp)\n apply(drule(2) next_sib_inj, simp)\n apply(erule_tac x=a in allE)+\n apply(erule disjE)\n apply(simp)\n apply(erule impE)\n apply(rule_tac b=q in descendants_trans, simp+)\n done\n\nlemma remove_collect: \"{y. P y} - {x} = {y. P y \\ y \\ x}\"\n apply blast\n done\n\n\nlocale mdb_insert_abs_simple =\nfixes m :: cdt\nfixes t :: cdt_list\nfixes dest :: cslot_ptr\nassumes valid_list : \"valid_list_2 t m\"\n\n\nlocale mdb_insert_abs_simple_parent = mdb_insert_abs_simple +\nfixes dest_p :: cslot_ptr\nfixes t' :: cdt_list\n\ndefines \"t' \\ t(dest_p := list_remove (t dest_p) dest)\"\n\nassumes dest: \"m dest = Some dest_p\"\nbegin\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\n valid_list_2 (t'(src := dest # (t' src)))\n (m(dest \\ src))\"\n apply (insert valid_list dest)\n apply (simp add: valid_list_2_def t'_def)\n apply (simp add: list_remove_removed insert_Collect remove_collect)\n apply (intro impI conjI allI)\n apply (fastforce simp: list_remove_distinct cong: Collect_cong)+\n done\n\n lemma valid_list_post':\n \"\\ t' src = []\\ \\\n valid_list_2 (t'(src := [dest]))\n (m(dest \\ src))\"\n\n by (insert valid_list_post[where src=src],simp)\n\n\nend\n\nlocale mdb_insert_abs_simple_no_parent = mdb_insert_abs_simple +\nassumes dest: \"m dest = None\"\n\ncontext mdb_insert_abs_simple_no_parent\nbegin\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 (t(src := dest # (t src)))\n (m(dest \\ src))\"\n apply (insert valid_list dest)\n apply (fastforce simp: valid_list_2_def)\n done\n\n\nlemma valid_list_post':\n \"\\ t src = []\\ \\\n valid_list_2 (t(src := [dest]))\n (m(dest \\ src))\"\n by (insert valid_list_post[where src=src],simp)\nend\n\nlocale mdb_insert_abs_sib_simple_no_parent = mdb_insert_abs_simple_no_parent +\n\nfixes src :: cslot_ptr\nfixes n\ndefines \"n \\ m(dest := m src)\"\nassumes neq: \"dest \\ src\"\nbegin\n\nlemma valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m src = None\\ \\ valid_list_2 t n\"\n apply (insert valid_list dest)\n apply (simp add: valid_list_2_def n_def)\n apply fastforce\n done\n\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m src = Some p\\\n \\ valid_list_2 (t(p := list_insert_after (t p) src dest)) n\"\n apply (insert valid_list dest neq)\n apply (simp add: valid_list_2_def n_def)\n apply (fastforce simp: distinct_list_insert_after set_list_insert_after)\n done\n\nend\n\n\nlocale mdb_insert_abs_sib_simple_parent = mdb_insert_abs_simple_parent +\n\nfixes src :: cslot_ptr\nfixes n\ndefines \"n \\ m(dest := m src)\"\nassumes neq: \"dest \\ src\"\n\ncontext mdb_insert_abs_sib_simple_parent\nbegin\n\nlemma valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m src = None\\ \\ valid_list_2 t' n\"\n apply (insert valid_list dest)\n apply (simp add: valid_list_2_def t'_def n_def)\n apply (simp add: list_remove_removed insert_Collect remove_collect)\n apply (fastforce simp: list_remove_distinct cong: Collect_cong)\n done\n\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m src = Some p\\\n \\ valid_list_2 (t'(p := list_insert_after (t' p) src dest)) n\"\n apply (insert valid_list dest neq)\n apply (simp add: valid_list_2_def t'_def n_def)\n apply (fastforce simp: distinct_list_insert_after list_remove_distinct set_list_insert_after list_remove_removed)\n done\n\nend\n\n\ncontext mdb_insert_abs\nbegin\n\nlemma finite_depth_insert_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"finite_depth m \\ finite_depth (m(dest \\ src))\"\n apply(simp add: finite_depth_def descendants_child split del: if_split)\n apply(rule allI)\n apply(case_tac \"slot=dest\")\n apply(case_tac \"m src\")\n apply(rule_tac x=src in exI)\n apply(simp add: neq)\n apply(erule_tac x=src in allE)\n apply(elim exE conjE)\n apply(rule_tac x=p in exI)\n apply(simp)\n apply(rule notI)\n apply(simp add: desc neq)\n apply(erule_tac x=slot in allE)\n apply(elim conjE exE)\n apply(rule_tac x=p in exI)\n apply(simp add: neq)\n apply(intro conjI impI notI)\n apply(simp add: desc)\n apply(simp add: desc)\n done\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m\n \\ valid_list_2 (t(src := dest # t src))\n (m(dest \\ src))\"\n apply (insert dest)\n apply(fastforce simp: valid_list_2_def)\n done\n\nlemma valid_list_post':\n \"\\valid_list_2 t m; t src = []\\\n \\ valid_list_2 (t(src := [dest]))\n (m(dest \\ src))\"\n by (drule valid_list_post, simp)\n\nlemma next_child:\n \"next_child p (t(src := dest # t src))\n = (if p = src then Some dest else next_child p t)\"\n apply(fastforce simp: next_child_def)\n done\n\nlemma next_child':\n \"t src = []\n \\ next_child p (t(src := [dest])) = (if p = src then Some dest else next_child p t)\"\n by (fastforce simp: next_child_def)\n\nlemma next_sib:\n \"valid_list_2 t m\n \\ next_sib p (t(src := dest # t src))\n (m(dest \\ src))\n = (if p = dest then next_child src t else next_sib p t m)\"\n apply(case_tac \"next_child src t\")\n apply(simp)\n apply(drule next_child_NoneD)\n apply(safe)[1]\n apply(rule_tac p=src in next_sib_NoneI)\n apply(simp)\n apply(case_tac \"next_sib p t m\")\n apply(simp)\n apply(drule next_sib_NoneD)\n apply(erule disjE)\n apply(rule next_sib_NoneI)\n apply(simp)\n apply(elim exE conjE)\n apply(rule_tac p=pa in next_sib_NoneI)\n apply(simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(rule_tac p=pa in next_sibI)\n apply(simp)\n apply(fastforce simp: valid_list_2_def)\n apply(drule (1) next_childD)\n apply(simp, safe)\n apply(case_tac \"next_child src t\")\n apply(fastforce dest: next_child_NoneD)\n apply(simp)\n apply(fastforce dest: next_childD intro: next_sibI)\n apply(case_tac \"next_sib p t m\")\n apply(fastforce dest: next_sib_NoneD next_sibD intro: next_sib_NoneI next_sibI)+\n done\n\nlemma next_sib':\n \"\\valid_list_2 t m; t src = []\\\n \\ next_sib p (t(src := [dest]))\n (m(dest \\ src))\n = (if p = dest then None else next_sib p t m)\"\n by (fastforce dest: next_sib[where p=p] intro: next_child_NoneI)\n\nlemma next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; finite_depth m; no_mloop m\\\n \\ next_not_child p (t(src := dest # t src)) (m(dest \\ src))\n = (if p = dest then next_slot src t m\n else next_not_child p t m)\"\n apply(simp)\n apply(intro conjI impI)\n apply(case_tac \"next_slot src t m\")\n apply(simp add: next_slot_def split: if_split_asm)\n apply(case_tac \"t src\", simp, simp add: next_child_def)\n apply(drule(1) next_not_child_NoneD)\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib' descendants_child no_mloop_descendants desc)\n apply(simp add: descendants_of_def)\n apply(simp add: next_sib')\n apply(simp add: finite_depth_insert_child)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(rule next_not_childI)\n apply(simp add: next_sib)\n apply(simp add: finite_depth_insert_child)\n apply(drule(2) next_not_childD)\n apply(rule next_not_childI)\n apply(simp add: next_sib' descendants_child)\n apply(erule disjE)\n apply(rule_tac x=src in exI)\n apply(simp add: no_mloop_descendants desc neq)\n apply(intro allI impI conjI)\n apply(drule_tac a=src and b=q' and c=src in descendants_trans, simp)\n apply(simp)\n apply(simp add: descendants_of_def)\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro conjI impI notI allI)\n apply(simp add: desc)\n apply(simp add: descendants_of_def)\n apply(simp)\n apply(simp add: finite_depth_insert_child)\n apply(case_tac \"next_not_child p t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD)\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib descendants_child neq desc)\n apply(simp add: next_sib)\n apply(simp add: finite_depth_insert_child)\n apply(simp)\n apply(drule(2) next_not_childD)\n apply(rule next_not_childI)\n apply(simp add: next_sib descendants_child split del: if_split)\n apply(erule disjE, simp, simp split del: if_split)\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(simp add: desc neq)\n apply(intro conjI impI notI)\n apply(simp add: desc)\n apply(simp add: desc)\n apply(simp add: finite_depth_insert_child)\n done\n\nlemma next_not_child':\n \"\\valid_list_2 t m; finite_depth m; no_mloop m; t src = []\\\n \\ next_not_child p (t(src := [dest])) (m(dest \\ src))\n = (if p = dest then next_not_child src t m\n else next_not_child p t m)\"\n apply(drule(2) next_not_child[where p=p])\n apply(simp add: next_slot_def)\n done\n\nlemma next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; finite_depth m; no_mloop m\\\n \\ next_slot p (t(src := dest # t src)) (m(dest \\ src))\n = (if p = src then Some dest\n else if p = dest then next_slot src t m\n else next_slot p t m)\"\n apply(simp add: next_slot_def next_not_child next_child next_not_child' next_child')\n apply(rule impI)\n apply(drule next_child_None_empty_desc[where slot=dest])\n apply(simp add: next_child_def)\n apply(case_tac \"t dest\", simp, simp add: desc)\n done\nend\n\n\n\n\ncontext mdb_insert_abs_sib\nbegin\n\nlemma finite_depth:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"finite_depth m \\ finite_depth n\"\n apply(simp add: finite_depth_def descendants)\n apply(simp add: n_def)\n apply(rule allI)\n apply(case_tac \"slot=dest\")\n apply(erule_tac x=src in allE)\n apply(elim exE conjE)\n apply(erule disjE)\n apply(rule_tac x=p in exI)\n apply(simp)\n apply(rule impI, simp add: desc)\n apply(rule_tac x=dest in exI)\n apply(simp)\n apply(erule_tac x=slot in allE)\n apply(elim exE conjE)\n apply(rule_tac x=p in exI)\n apply(simp)\n apply(rule impI)\n apply(simp add: desc)\n done\n\nlemma valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = None\\ \\ valid_list_2 t n\"\n apply(insert dest)\n apply(fastforce simp: n_def valid_list_2_def)\n done\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = Some p\\\n \\ valid_list_2 (t(p := list_insert_after (t p) src dest)) n\"\n apply(insert dest)\n apply(fastforce simp: n_def valid_list_2_def set_list_insert_after distinct_list_insert_after)\n done\n\nlemma next_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = Some src_p\\\n \\ next_child p (t(src_p := list_insert_after (t src_p) src dest)) = next_child p t\"\n apply(simp add: next_child_def)\n apply(case_tac \"list_insert_after (t src_p) src dest\")\n apply(simp)\n apply(case_tac \"t src_p\")\n apply(simp)\n apply(simp split: if_split_asm)\n apply(simp)\n apply(case_tac \"t src_p\")\n apply(simp)\n apply(simp split: if_split_asm)\n done\n\nlemma next_sib_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = None\\\n \\ next_sib p t n\n = (if p = src \\ m src \\ None then Some dest\n else if p = dest then next_sib src t m\n else next_sib p t m)\"\n apply(simp add: n_def next_sib_def)\n done\n\nlemma next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = Some src_p\\\n \\ next_sib p (t(src_p := list_insert_after (t src_p) src dest)) n\n = (if p = src \\ m src \\ None then Some dest\n else if p = dest then next_sib src t m\n else next_sib p t m)\"\n apply(subgoal_tac \"dest \\ set (t src_p) \\ src \\ set (t src_p)\")\n prefer 2\n apply(simp add: valid_list_2_def)\n apply(simp add: next_sib_def n_def neq list_insert_after_after valid_list_2_def)\n apply(case_tac \"m p\")\n apply(simp)\n apply(simp add: list_insert_after_after)\n done\n\nlemma next_not_child_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; finite_depth m; no_mloop m; m src = None\\\n \\ next_not_child p t n\n = (if p = src then (if m src = None then None else Some dest)\n else if p = dest then next_not_child src t m\n else if p \\ descendants_of src m\n \\ next_not_child p t m = next_not_child src t m then\n (if m src = None then None else Some dest)\n else next_not_child p t m)\"\n apply(simp)\n apply(intro conjI impI)\n apply(simp add: descendants_of_def)\n apply(simp add: no_mloop_def descendants_of_def)\n apply(subgoal_tac \"next_not_child src t m = None\")\n prefer 2\n apply(rule next_not_child_NoneI)\n apply(fastforce dest: descendants_of_NoneD)\n apply(simp add: next_sib_def)\n apply(simp)\n apply(erule conjE, simp)\n apply(drule(1) next_not_child_NoneD[where p=p])\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib_no_parent descendants desc)\n apply(simp add: next_sib_no_parent)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child src t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD, rule next_not_child_NoneI)\n apply(simp add: descendants next_sib_no_parent)\n apply(simp add: descendants_of_def )\n apply(simp add: next_sib_no_parent)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule(2) next_not_childD, rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib_no_parent descendants)\n apply(rule disjI2)\n apply(simp add: next_sib_no_parent descendants)\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro allI conjI impI notI)\n apply(simp add: desc)\n apply(simp add: descendants_of_def)\n apply(simp add: finite_depth)\n apply(rule next_not_child_NoneI)\n apply(intro allI impI)\n apply(fastforce simp: descendants split: if_split_asm dest: descendants_of_NoneD)\n apply(simp add: next_sib_no_parent)\n apply(simp add: next_sib_def)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m\")\n apply(simp add: next_sib_no_parent descendants desc finite_depth\n | drule next_not_child_NoneD | rule next_not_child_NoneI)+\n apply(simp add: next_sib_no_parent descendants desc\n | drule next_not_childD | rule next_not_childI | erule disjE)+\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(case_tac \"m dest\")\n apply(fastforce simp: next_sib_def)\n apply(fastforce simp: next_sib_def dest)\n apply(simp add: finite_depth)\n done\n\nlemma next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; finite_depth m; no_mloop m; m src = Some src_p\\\n \\ next_not_child p (t(src_p := list_insert_after (t src_p) src dest)) n\n = (if p = src then (if m src = None then None else Some dest)\n else if p = dest then next_not_child src t m\n else if p \\ descendants_of src m\n \\ next_not_child p t m = next_not_child src t m then\n (if m src = None then None else Some dest)\n else next_not_child p t m)\"\n apply(simp)\n apply(intro conjI impI)\n apply(simp add: descendants_of_def)\n apply(simp add: no_mloop_def descendants_of_def)\n apply(erule conjE)\n apply(rule next_not_childI)\n apply(rule disjI2)\n apply(rule conjI)\n apply(simp add: next_sib)\n apply(rule_tac p=p and q=src in next_not_child_eq_next_sib_None)\n apply(simp_all)[6]\n apply(rule_tac x=src in exI)\n apply(simp add: next_sib descendants no_mloop_descendants desc)\n apply(intro allI impI)\n apply(rule_tac p=p and q=src in next_not_child_eq_next_sib_None)\n apply(simp_all add: no_mloop_descendants)[6]\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child src t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD, rule next_not_child_NoneI)\n apply(simp add: descendants next_sib)\n apply(simp add: descendants_of_def no_mloop_def)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule(2) next_not_childD, rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib descendants)\n apply(rule disjI2)\n apply(simp add: next_sib descendants no_mloop_descendants)\n apply(simp add: descendants_of_def)\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro conjI impI notI)\n apply(simp add: desc)\n apply(simp add: descendants_of_def)\n apply(simp add: finite_depth)\n apply(rule next_not_childI)\n apply(rule disjI1)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m\")\n apply(frule(1) next_not_child_NoneD)\n apply(simp add: next_sib descendants desc finite_depth\n | rule next_not_child_NoneI)+\n apply(intro impI notI)\n apply(simp)\n apply(case_tac \"next_not_child src t m\")\n apply(simp)\n apply(drule(2) next_not_childD)\n apply(erule disjE, simp)\n apply(elim exE conjE)\n apply(drule_tac a=p and c=q in descendants_trans, simp, simp)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(simp add: next_sib descendants desc no_mloop_descendants\n | drule next_not_childD | rule next_not_childI | erule disjE)+\n apply(elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro conjI impI notI)\n apply(simp_all add: desc finite_depth)\n apply(erule notE)\n apply(rule next_not_childI[symmetric])\n apply(simp)\n apply(rule_tac x=q in exI)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp add: finite_depth)\n apply(erule notE)\n apply(rule next_not_childI[symmetric])\n apply(simp)\n apply(simp add: finite_depth)\n done\n\nlemma next_slot_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; finite_depth m; no_mloop m; m src = None\\\n \\ next_slot p t n\n = next_slot p t m\"\n apply(subgoal_tac \"next_not_child dest t m = None\")\n prefer 2\n apply((rule next_not_child_NoneI | intro allI impI\n | simp add: descendants_of_def next_sib_def finite_depth dest)+)[1]\n apply(subgoal_tac \"next_not_child src t m = None\")\n prefer 2\n apply((rule next_not_child_NoneI | intro allI impI |\n drule(1) descendants_of_NoneD | simp add: next_sib_def finite_depth)+)[1]\n apply(simp add: next_slot_def next_not_child_no_parent)\n done\n\nlemma next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; finite_depth m; no_mloop m; m src = Some src_p; t src = []\\\n \\ next_slot p (t(src_p := list_insert_after (t src_p) src dest)) n\n = (if p = src then Some dest\n else if p = dest then next_slot src t m\n else next_slot p t m)\"\n apply(simp)\n apply(intro impI conjI)\n apply(simp add: next_slot_def next_child next_not_child empty_list_empty_desc desc)\n apply(rule impI, insert dest_no_parent_d, simp)[1]\n apply(simp add: next_slot_def next_child next_not_child)\n apply(rule impI, simp add: no_mloop_weaken)\n apply(simp add: next_slot_def next_child next_not_child)\n apply(intro conjI impI)\n apply(simp_all)\n apply(erule conjE, drule_tac a=src_p and c=src_p in descendants_trans,\n simp add: child_descendant, simp add: no_mloop_descendants)+\n apply(simp add: empty_list_empty_desc)\n apply(simp only: set_empty[symmetric])\n apply(simp add: set_list_insert_after)\n done\nend\n\ncrunch exst[wp]: set_cap \"(\\s. P (exst s))\" (wp: crunch_wps simp: crunch_simps)\n\nlemma set_cap_caps_of_state3:\n \"\\\\s. P (caps_of_state s (p \\ cap)) (cdt s) (exst s) (is_original_cap s)\\\n set_cap cap p\n \\\\rv s. P (caps_of_state s) (cdt s) (exst s) (is_original_cap s)\\\"\n apply (rule_tac Q=\"\\rv s. \\m mr t. P (caps_of_state s) m t mr\n \\ (cdt s = m) \\ (exst s = t) \\ (is_original_cap s = mr)\"\n in hoare_post_imp)\n apply simp\n apply (wp hoare_vcg_ex_lift)\n apply (rule_tac x=\"cdt s\" in exI)\n apply (rule_tac x=\"is_original_cap s\" in exI)\n apply (simp add: fun_upd_def)\n done\n\n\nlemma exst_cdt_update[iff]:\n \"exst (s\\cdt := a\\) = exst s\"\n by simp\n\ndefinition valid_mdb_weak where\n\"valid_mdb_weak s \\ mdb_cte_at (swp (cte_wp_at (op \\ NullCap)) s) (cdt s) \\ no_mloop (cdt s)\"\n\nlemma self_parent_eq: \"m src = Some src \\ m(dest \\ src) = m (dest := m src)\"\n by simp\n\nlemma ex1_False: \"(\\x. \\P x) \\ \\ (\\!x. P x)\" by auto\n\nlemma set_cap_match: \"(\\s x. P s = P (s\\kheap := x\\)) \\ \\P\\ set_cap a b \\\\_.P\\\"\n apply (simp add: set_cap_def split_def set_object_def get_object_def)\n apply wpsimp\n done\n\ncrunch all_but_exst[wp]: cap_insert_ext \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: cap_insert_ext\n\ninterpretation cap_insert_ext_extended: is_extended \"cap_insert_ext a b c d e\"\n by (unfold_locales; wp)\n\n\nlemma cap_insert_valid_list [wp]:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list\\\n cap_insert cap src dest\n \\\\_ s. valid_list s\\\"\n apply (simp add: cap_insert_def)\n apply(simp add: set_untyped_cap_as_full_def update_cdt_def set_cdt_def update_cdt_list_def set_cdt_list_def bind_assoc cap_insert_ext_def)\n apply (rule hoare_pre)\n apply (fold revokable_def)\n apply (wp | simp cong: option.case_cong if_cong del: fun_upd_apply split del: if_split)+\n apply(wp set_cap_caps_of_state3)[1]\n apply (case_tac \"is_untyped_cap src_cap \\\n is_untyped_cap cap \\\n obj_ref_of src_cap = obj_ref_of cap \\\n cap_bits_untyped src_cap = cap_bits_untyped cap\")\n\n apply (simp del: fun_upd_apply split del: if_split)\n apply (wp set_cap_caps_of_state3)\n apply (simp only:)\n apply (simp del: fun_upd_apply split del: if_split)\n apply (wp get_cap_wp)+\n apply(intro allI impI conjI)\n apply (case_tac \"src = dest\")\n apply (simp add: cte_wp_at_caps_of_state fun_upd_idem del: fun_upd_apply)\n apply (case_tac \"cdt s dest\")\n apply (simp del: fun_upd_apply split del: if_split cong: option.case_cong)\n apply (simp add: del: fun_upd_apply split del: if_split cong: option.case_cong)\n\n apply (fastforce simp add: valid_list_2_def list_remove_removed list_remove_distinct)\n apply (case_tac \"cdt s dest\")\n\n apply (subgoal_tac \"mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\")\n prefer 2\n apply (rule mdb_insert_abs_simple_no_parent.intro[OF mdb_insert_abs_simple.intro])\n apply simp\n apply (rule mdb_insert_abs_simple_no_parent_axioms.intro)\n apply simp\n\n apply (subgoal_tac \"mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src\")\n prefer 2\n apply (rule mdb_insert_abs_sib_simple_no_parent.intro,assumption)\n apply (rule mdb_insert_abs_sib_simple_no_parent_axioms.intro,simp)\n apply(case_tac\"should_be_parent_of capa (is_original_cap s src) cap (revokable capa cap)\")\n apply (case_tac \"cdt s src\")\n apply (simp del: fun_upd_apply)\n apply (rule mdb_insert_abs_simple_no_parent.valid_list_post,simp)\n apply (case_tac \"a = src\")\n apply (simp del: fun_upd_apply)\n apply (subst self_parent_eq,assumption)\n apply (rule mdb_insert_abs_sib_simple_no_parent.valid_list_post,simp,simp)\n apply (simp add: fun_upd_twist del: fun_upd_apply)\n apply (rule mdb_insert_abs_simple_no_parent.valid_list_post,simp)\n apply (case_tac \"cdt s src\")\n apply (frule(1) mdb_insert_abs_sib_simple_no_parent.valid_list_post_no_parent)\n apply (simp del: fun_upd_apply)\n apply (simp del: fun_upd_apply)\n apply (frule(1) mdb_insert_abs_sib_simple_no_parent.valid_list_post)\n apply (simp del: fun_upd_apply)\n\n apply (subgoal_tac \"mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\")\n prefer 2\n apply (rule mdb_insert_abs_simple_parent.intro[OF mdb_insert_abs_simple.intro])\n apply simp\n apply (rule mdb_insert_abs_simple_parent_axioms.intro)\n apply simp\n apply (subgoal_tac \"mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src\")\n prefer 2\n apply (rule mdb_insert_abs_sib_simple_parent.intro,assumption)\n apply (rule mdb_insert_abs_sib_simple_parent_axioms.intro,simp)\n apply(case_tac\"should_be_parent_of capa (is_original_cap s src) cap (revokable capa cap)\")\n apply (case_tac \"cdt s src\")\n apply (simp del: fun_upd_apply)\n apply (rule mdb_insert_abs_simple_parent.valid_list_post,simp)\n apply (case_tac \"aa = src\")\n apply (simp del: fun_upd_apply)\n apply (subst self_parent_eq,assumption)\n apply (rule mdb_insert_abs_sib_simple_parent.valid_list_post,simp,simp)\n apply (simp add: fun_upd_twist del: fun_upd_apply)\n apply (rule mdb_insert_abs_simple_parent.valid_list_post,simp)\n apply (case_tac \"cdt s src\")\n apply (frule(1) mdb_insert_abs_sib_simple_parent.valid_list_post_no_parent)\n apply (simp del: fun_upd_apply)\n apply (simp del: fun_upd_apply)\n apply (frule(1) mdb_insert_abs_sib_simple_parent.valid_list_post)\n apply (simp del: fun_upd_apply)\n done\n\nlemma cte_at_next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list s; valid_mdb s; finite_depth (cdt s)\\\n \\ next_slot p (cdt_list s) (cdt s) = Some n \\ cte_at p s\"\n apply(simp add: next_slot_def)\n apply(simp split: if_split_asm)\n apply(drule next_childD, simp)\n apply(rule_tac p=n in descendants_of_cte_at2)\n apply(simp add: child_descendant)\n apply(simp)\n apply(subgoal_tac \"next_not_child_dom (p, cdt_list s, cdt s)\")\n prefer 2\n apply(simp add: next_not_child_termination valid_mdb_def valid_list_2_def)\n apply(simp split: if_split_asm)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(rule descendants_of_cte_at)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(rule descendants_of_cte_at)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n done\n\nlemma cte_at_next_slot':\n \"\\valid_list s; valid_mdb s; finite_depth (cdt s)\\\n \\ next_slot p (cdt_list s) (cdt s) = Some n \\ cte_at n s\"\n apply(simp add: next_slot_def)\n apply(simp split: if_split_asm)\n apply(drule next_childD, simp)\n apply(rule_tac x=p in descendants_of_cte_at, simp add: child_descendant, simp)\n apply(rule next_not_child_pinduct2[where t=\"cdt_list s\" and p=p\n and m=\"cdt s\"])\n apply(rule_tac p=a in descendants_of_cte_at2)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp)\n apply(assumption)\n apply(simp add: next_not_child_termination valid_mdb_def valid_list_2_def\n split: if_split_asm)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(simp)\n apply(rule descendants_of_cte_at)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp add: valid_mdb_def)\n apply(drule next_sibD)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(rule descendants_of_cte_at)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp add: valid_mdb_def)\n apply(intro allI impI, drule next_sibD)\n apply(simp)\n apply(elim exE conjE)\n apply(drule_tac after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(rule_tac x=\"(aa, b)\" in descendants_of_cte_at, simp add: child_descendant, simp)\n apply(simp)\n done\n\nlemma Collect_union: \"{c. P c} \\ {c. Q c} = {c. P c \\ Q c}\"\n apply blast\n done\n\nlocale mdb_move_abs_simple =\nfixes m m' m'' :: cdt\nfixes t t' t''\nfixes src dest\nfixes valid_list_post\nassumes neq : \"src \\ dest\"\nassumes valid_list: \"valid_list_2 t m\"\ndefines \"t' \\ case m dest of Some dest_p \\ t(dest_p := list_remove (t dest_p) dest) | None \\ t\"\ndefines \"t'' \\ case m src of Some src_p \\ t'(src_p := list_replace (t' src_p) src dest) | None \\ t'\"\n\ndefines \"m'' \\ \\r. if r = src then None else (m(dest := m src)) r\"\ndefines \"m' \\\n \\r. if m'' r = Some src then Some dest\n else (m(dest := m src, src := None)) r\"\nbegin\n\nlemma \"{c. m c = Some ab} - {dest} \\ {c. m c = Some dest} =\n {c. c \\ dest \\\n (c \\ dest \\ c \\ ab \\ (c \\ ab \\ m c \\ Some ab \\ m c = Some dest))}\"\n oops\n\nlemma valid_list_post_no_parents:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes replace_distinct[simplified list_replace_def,simp]\n shows\n \"m src = None \\ m dest = None \\ valid_list_2 (t''(src := [], dest := (t'' src) @ (t'' dest))) m'\"\n apply (insert valid_list neq)\n apply (simp add: m'_def m''_def t'_def t''_def valid_list_2_def list_replace_def)\n apply (intro impI conjI allI)\n apply fastforce\n apply fastforce\n apply fastforce\n done\n\nlemma valid_list_post_src_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes replace_distinct[simplified list_replace_def,simp]\n notes list_remove_distinct[simp]\n shows\n \"m src = None \\ m dest = Some dest_p \\ valid_list_2 (t''(src := [], dest := (t'' src) @ (t'' dest))) m'\"\n apply (insert valid_list neq)\n apply (simp add: m'_def m''_def t'_def t''_def valid_list_2_def list_replace_def list_remove_removed)\n apply (intro impI conjI allI)\n apply fastforce+\n done\n\nlemma valid_list_post_dest_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes replace_distinct[simplified list_replace_def,simp]\n notes list_remove_distinct[simp]\n shows\n \"m src = Some src_p \\ m dest = None \\ valid_list_2 (t''(src := [], dest := (t'' src) @ (t'' dest))) m'\"\n apply (insert valid_list neq)\n apply (simp add: m'_def m''_def t'_def t''_def valid_list_2_def list_replace_def list_remove_removed)\n apply (intro impI conjI allI)\n apply fastforce+\n done\n\nlemma valid_list_post_parents:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes replace_distinct[simplified list_replace_def,simp]\n notes list_remove_distinct[simp]\n shows\n \"m src = Some src_p \\ m dest = Some dest_p \\ valid_list_2 (t''(src := [], dest := (t'' src) @ (t'' dest))) m'\"\n apply (insert valid_list neq)\n apply (simp add: m'_def m''_def t'_def t''_def )\n apply (intro impI conjI allI)\n apply (simp_all add: valid_list_2_def)\n apply (simp_all add: list_replace_def list_remove_removed)\n apply (intro impI conjI allI | fastforce)+\n done\n\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes replace_distinct[simplified list_replace_def,simp]\n shows \"valid_list_2 (t''(src := [], dest := (t'' src) @ (t'' dest))) m'\"\n apply (case_tac \"m src\")\n apply (case_tac \"m dest\")\n apply (simp add: valid_list_post_no_parents)\n apply (simp add: valid_list_post_src_no_parent)\n apply (case_tac \"m dest\")\n apply (simp add: valid_list_post_dest_no_parent)\n apply (simp add: valid_list_post_parents)\n done\n\nend\n\n\n\n\nlocale mdb_move_abs' = mdb_move_abs + constrains s::\"det_ext state\"\n\ncontext mdb_move_abs'\nbegin\n\nlemma findepth : \"finite_depth m\"\n apply (simp add: m)\n apply (rule Deterministic_AI.finite_depth)\n apply (rule valid_mdb)\n done\n\nlemma finite_depth:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"finite_depth m'\"\n apply (insert findepth)\n apply(simp add: finite_depth_def descendants)\n apply(rule allI)\n apply(case_tac \"slot=dest\")\n apply(erule_tac x=src in allE)\n apply(elim exE conjE)\n apply(erule disjE)\n apply(rule_tac x=p in exI)\n apply(simp add: m'_def m''_def)\n apply(rule conjI)\n apply(rule impI, simp add: dest_desc)\n apply(intro impI notI)\n apply(insert valid_mdb)[1]\n apply(drule_tac slot=src in desc_not_parent, simp add: m)\n apply(simp add: m'_def m''_def)\n apply(fastforce)\n apply(simp add: m'_def m''_def)\n apply(erule_tac x=slot in allE)\n apply(elim exE conjE)\n apply(case_tac \"p=src\")\n apply(erule disjE)\n apply(rule_tac x=dest in exI)\n apply(simp)\n apply(rule_tac x=src in exI)\n apply(simp)\n apply(case_tac \"slot=src\")\n apply(rule_tac x=src in exI)\n apply(simp)\n apply(rule_tac x=p in exI)\n apply(simp)\n apply(intro conjI impI)\n apply(simp add: dest_desc)\n apply(simp add: dest_desc)\n done\n\nlemma valid_list_post_helper:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\dest \\ set list;\n distinct list\\\n \\ distinct\n (map (\\x. if x = src then dest else x) list)\"\n apply (induct list)\n apply force+\n done\n\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = Some src_p\\\n \\ valid_list_2 (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m'\"\n apply (simp add: valid_list_2_def)\n apply (rule Collect_cong | simp add: list_replace_def m'_def m''_def split: if_split_asm | intro iffI impI conjI notI allI | force | fastforce)+\n apply clarsimp\n apply (subgoal_tac \"dest \\ set (t src_p)\")\n apply (blast intro: valid_list_post_helper)\n apply simp\n done\n\nlemma valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m src = None\\\\ valid_list_2 (t(src := [], dest := t src)) m'\"\n apply(simp add: valid_list_2_def)\n apply (rule Collect_cong | simp add: list_replace_def m'_def m''_def split: if_split_asm | intro iffI impI conjI notI allI | fastforce)+\n done\n\n\nlemma next_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m \\ m src = Some src_p\n \\ next_child p (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src))\n = (if p = src then None\n else if p = dest then next_child src t\n else if next_child p t = Some src then Some dest\n else next_child p t)\"\n apply (simp split: if_split)\n apply (clarsimp simp: next_child_def list_replace_def)\n apply (intro impI conjI)\n apply (fold next_child_def)[1]\n apply (frule(1) next_childD)\n apply clarsimp\n apply (case_tac \"t src_p\",simp+)\n apply (case_tac \"t p\",simp)\n apply (simp add: valid_list_2_def)\n apply (subgoal_tac \"src \\ set (t p)\")\n apply (thin_tac \"t p = src # list\")\n apply simp+\n done\n\n\nlemma next_child_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m \\ m src = None\n \\ next_child p (t(src := [], dest := t src))\n = (if p = src then None\n else if p = dest then next_child src t\n else if next_child p t = Some src then Some dest\n else next_child p t)\"\n apply (simp split: if_split)\n apply (clarsimp simp add: next_child_def)\n apply (fold next_child_def)\n apply (frule(1) next_childD,clarsimp)\n done\n\nlemma next_sib_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m \\ m src = None\n \\ next_sib p (t(src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_sib src t m\n else if next_sib p t m = Some src then Some dest\n else next_sib p t m)\"\n apply (simp add: next_sib_def m'_def m''_def split: if_split)\n apply (intro impI conjI)\n apply (simp split: option.splits | drule(1) valid_list_2D[OF _ after_in_list_in_list])+\n done\n\n\n\n\n\n\nlemma next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m \\ m src = Some src_p\n \\ next_sib p (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_sib src t m\n else if next_sib p t m = Some src then Some dest\n else next_sib p t m)\"\n apply (simp add: next_sib_def m'_def m''_def split: if_split)\n apply (intro impI conjI)\n apply (intro impI | simp split: option.splits | drule(1) valid_list_2D[OF _ after_in_list_in_list] | rule after_in_list_list_replace | rule replace_list_preserve_after replace_list_preserve_after' | simp add: valid_list_2_def)+\n done\n\nlemma next_not_child_root:\n assumes findepth: \"finite_depth k\"\n shows\n \"k p = None \\ next_not_child p t k = None\"\n apply (subst next_not_child.psimps[OF next_not_child_termination[OF findepth]])\n apply (simp add: next_sib_def)\n done\n\n\n\nlemma next_not_child_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes nnext = next_not_child.psimps[OF next_not_child_termination[OF findepth]]\n notes nnext' = next_not_child.psimps[OF next_not_child_termination[OF finite_depth]]\n notes nnext'' = nnext'[simplified m'_def m''_def]\n shows\n \"valid_list_2 t m \\ m src = None\n \\ next_not_child p (t(src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_not_child src t m\n else if next_not_child p t m = Some src then Some dest\n else next_not_child p t m)\"\n apply (induct p rule: next_not_child_pinduct[where t=t and m=m, OF _ findepth])\n apply (case_tac \"m slot\")\n apply (subst next_not_child_root[OF findepth],assumption)+\n apply (subst next_not_child_root[OF finite_depth])\n apply ((simp add: m'_def m''_def)+)[2]\n apply (case_tac \"next_sib slot t m\")\n apply (drule_tac x=\"a\" in meta_spec)\n apply (simp add: m'_def m''_def next_sib_def nnext nnext'' cong: if_weak_cong split: if_split_asm)\n apply (simp split del: if_split)\n apply (thin_tac \"\\a. \\False; Q a\\ \\ P a\" for Q P)\n apply (simp add: m'_def m''_def next_sib_def nnext nnext'' cong: if_weak_cong split: if_split_asm | intro impI conjI)+\n apply (simp add: valid_list_2_def | drule after_in_list_in_list | clarsimp)+\n done\n\nlemma m'_helper: \"m src = k \\ m' dest = k\"\n apply (clarsimp simp: m'_def m''_def)+\n done\n\nlemma m'_helper2: \"x \\ src \\ x \\ dest \\ m x \\ Some src \\ m' x = m x\"\n apply (clarsimp simp: m'_def m''_def)\n done\n\nlemma m'_helper3: \"x \\ dest \\ m x = Some src \\ m' x = Some dest\"\n apply (clarsimp simp: m'_def m''_def)\n done\n\nlemma m'_helper4: \"m' src = None\"\n apply (clarsimp simp: m'_def m''_def)\n done\n\nlemmas m'_helpers = m'_helper m'_helper2 m'_helper3 m'_helper4\n\nlemma not_self[simp]: \"m x \\ Some x\"\n apply clarsimp\n apply (insert no_mloop)\n apply (frule no_mloop_neq)\n apply simp+\n done\n\nlemma src_loop_facts: \"m src = Some src_p \\ m src_p \\ Some src\" \"m src = Some src_p \\ src_p \\ src\"\n apply -\n apply (rule notI)\n apply (frule child_descendant)\n apply (frule parent_not_descendant[OF no_mloop],simp)\n apply (rule notI)\n apply simp\n done\n\n\n\n\nlemma next_not_child_parent:\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\nshows\n\"\\valid_list_2 t m; m src = Some src_p\\\n \\ next_not_child src_p (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m' =\n next_not_child src_p t m\"\n apply (case_tac \"src_p = dest\",simp)\n apply (insert src_loop_facts[where src_p=src_p])\n apply (rule next_not_child_linearI'[OF findepth finite_depth])\n apply (simp add: m'_def m''_def)\n apply (simp add: next_sib)\n apply (rule notI)\n apply (frule(1) next_sib_same_parent,simp)\n apply (intro impI allI conjI)\n apply (simp add: m'_def m''_def)\n apply (intro impI conjI)\n apply (rule notI)\n apply simp\n apply (cut_tac dest_desc,simp)\n apply (rule notI)\n apply simp\n apply (frule parent_not_descendant[OF no_mloop],simp)\n apply (rule notI)\n apply (subgoal_tac \"q \\ descendants_of src_p m\")\n apply (frule ancestor_not_descendant[OF no_mloop],simp)\n apply (rule descendants_trans)\n apply (rule child_descendant)\n apply simp\n apply (rule child_descendant)\n apply simp\n apply (simp add: next_sib)\n apply (intro impI conjI)\n apply (simp add: m'_helpers)+\n apply (frule(1) next_sib_same_parent,simp)\n apply (frule parent_not_descendant[OF no_mloop],simp)\n apply (simp add: m'_def m''_def)+\n done\n\n\n\nlemma next_not_child_helper':\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\n notes nnext = next_not_child.psimps[OF next_not_child_termination[OF findepth]]\n notes nnext' = next_not_child.psimps[OF next_not_child_termination[OF finite_depth]]\nshows\n\"\\valid_list_2 t m; m src = Some src_p; m slot = None\\\n \\ next_not_child slot (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src))\n m' =\n (if slot = src then None\n else if slot = dest then next_not_child src t m\n else if next_not_child slot t m = Some src then Some dest\n else next_not_child slot t m)\"\n apply (simp add: next_sib m'_helpers\n nnext[where slot=slot]\n nnext[where slot=dest]\n nnext[where slot=src]\n nnext'[where slot=slot]\n nnext'[where slot=dest]\n nnext'[where slot=src])\n apply (intro impI conjI,simp_all)\n apply (rule next_not_child_parent,simp+)+\n done\n\nlemma next_not_child_helper'':\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\n notes nnext = next_not_child.psimps[OF next_not_child_termination[OF findepth]]\n notes nnext' = next_not_child.psimps[OF next_not_child_termination[OF finite_depth]]\n\nshows\n \"\\valid_list_2 t m; m src = Some src_p; m slot = Some a;\n next_sib slot t m = Some aa\\\n \\ next_not_child slot (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m' =\n (if slot = src then None\n else if slot = dest then next_not_child src t m\n else if next_not_child slot t m = Some src then Some dest else next_not_child slot t m)\"\n apply (simp add: next_sib m'_helpers\n nnext[where slot=slot]\n nnext'[where slot=slot] )\n apply (intro impI conjI,simp_all)\n done\n\nlemma next_not_child_helper''':\nnotes split_paired_All[simp del] split_paired_Ex[simp del]\n notes nnext = next_not_child.psimps[OF next_not_child_termination[OF findepth]]\n notes nnext' = next_not_child.psimps[OF next_not_child_termination[OF finite_depth]]\n\nshows\n\"\\valid_list_2 t m; m src = Some src_p; src_p \\ src; m src_p \\ Some src; m slot = Some a;\n next_not_child a (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m' =\n (if a = src then None\n else if a = dest then next_not_child src t m\n else if next_not_child a t m = Some src then Some dest else next_not_child a t m);\n next_sib slot t m = None\\\n \\ next_not_child slot (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m' =\n (if slot = src then None\n else if slot = dest then next_not_child src t m\n else if next_not_child slot t m = Some src then Some dest else next_not_child slot t m)\"\n apply (case_tac \"src_p = dest\")\n apply simp\n apply (simp add: next_sib m'_helpers\n nnext[where slot=slot]\n nnext[where slot=dest]\n nnext[where slot=src]\n\n nnext'[where slot=slot]\n nnext'[where slot=dest]\n nnext'[where slot=src]\nsplit: if_split_asm)\n apply (intro impI conjI,simp_all)\n apply (drule next_not_childD[OF _ findepth no_mloop])\n apply (elim disjE)\n apply (frule(1) next_sib_same_parent,simp)\n apply (elim conjE exE)\n apply (frule (1) next_sib_same_parent,simp)\n apply (frule parent_not_descendant[OF no_mloop],simp)\n apply (rule next_not_child_parent,simp+)\n apply (frule next_sib_not_self[where src=src],simp)\n apply (intro impI conjI)\n apply (rule next_not_child_parent,simp+)\n apply (intro impI conjI)\n apply (rule next_not_child_parent,simp+)\n done\n\n\nlemma next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes nnext = next_not_child.psimps[OF next_not_child_termination[OF findepth]]\n notes nnext' = next_not_child.psimps[OF next_not_child_termination[OF finite_depth]]\n assumes misc: \"valid_list_2 t m\" \"m src = Some src_p\"\n shows\n \"next_not_child p (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_not_child src t m\n else if next_not_child p t m = Some src then Some dest\n else next_not_child p t m)\"\n apply (insert misc)\n apply (insert src_loop_facts[where src_p=src_p],simp split del: if_split)\n apply (induct p rule: next_not_child_pinduct[where t=t and m=m, OF _ findepth])\n apply (case_tac \"m slot\")\n apply (rule next_not_child_helper',(simp split del: if_split)+)\n apply (drule_tac x=a in meta_spec)\n apply (simp split del: if_split)\n apply (case_tac \"next_sib slot t m\")\n apply (rule next_not_child_helper''',(simp split del: if_split)+)\n apply (rule next_not_child_helper'',(simp split del: if_split)+)\n done\n\n\nlemma next_slot_no_parent:\n \"valid_list_2 t m \\ m src = None\n \\ next_slot p (t(src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_slot src t m\n else if next_slot p t m = Some src then Some dest\n else next_slot p t m)\"\n apply (simp only: next_slot_def split: if_split)\n apply (intro impI conjI)\n apply (subst next_child_no_parent| subst next_not_child_no_parent | simp)+\n done\n\n\n\nlemma next_slot:\n \"valid_list_2 t m \\ m src = Some src_p\n \\ next_slot p (t(src_p := list_replace (t src_p) src dest, src := [], dest := t src)) m'\n = (if p = src then None\n else if p = dest then next_slot src t m\n else if next_slot p t m = Some src then Some dest\n else next_slot p t m)\"\n apply (simp only: next_slot_def split: if_split)\n apply (intro impI conjI)\n apply (subst next_child | subst next_not_child | (simp split: if_split_asm) | intro impI conjI)+\n done\n\nend\n\nlemma\nnotes split_paired_All[simp del]\nshows\n\"\\valid_list_2 t m\\\n \\ valid_list_2\n (case m dest of None \\ t\n | Some a \\ t\n (a := list_remove (t a) dest))\n (m(dest := None))\"\n\n apply (case_tac \"m dest\")\n apply (fastforce simp: valid_list_2_def list_remove_removed intro: list_remove_distinct)+\n done\n\nlemma cap_move_valid_list [wp]:\n\n notes split_paired_All[simp del]\n shows\n \"\\valid_list\\\n cap_move cap src dest\n \\\\_. valid_list\\\"\n apply (case_tac \"src = dest\")\n apply (simp add: cap_move_def)\n apply(simp add: set_cdt_def cap_move_ext_def\n update_cdt_list_def set_cdt_list_def del: fun_upd_apply split del: if_split)\n apply(wp)\n apply (simp del: fun_upd_apply cong: option.case_cong)\n apply (wp set_cap_caps_of_state3)+\n apply (case_tac \"cdt s dest\")\n apply (fastforce simp: valid_list_2_def list_remove_removed intro: list_remove_distinct)+\n apply (simp add: cap_move_def)\n apply(simp add: cap_move_def set_cdt_def cap_move_ext_def bind_assoc\n update_cdt_list_def set_cdt_list_def del: fun_upd_apply split del: if_split)\n apply(wp)\n apply (simp del: fun_upd_apply split del: if_split)\n apply (unfold valid_list_2_def)\n apply (simp del: fun_upd_apply cong: option.case_cong split del: if_split)\n apply (wp set_cap_caps_of_state3)+\n apply (fold valid_list_2_def)\n apply (rule mdb_move_abs_simple.valid_list_post)\n apply (rule mdb_move_abs_simple.intro; simp)\n done\n\ndeclare if_cong[cong]\n\n\nlemma next_sib_share_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next_sib a t m = Some b; valid_list_2 t m\\\n \\ a \\ descendants_of c m = (b \\ descendants_of c m)\"\n apply(drule next_sibD)\n apply(case_tac \"m a\", simp, simp)\n apply(subgoal_tac \"m b = Some aa\")\n prefer 2\n apply(fastforce simp: after_in_list_in_list valid_list_2_def)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(case_tac \"c=aa\")\n apply(fastforce)\n apply(rule iffI)\n apply(rule_tac b=aa in trancl_into_trancl)\n apply(drule tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(simp)\n apply(rule_tac b=aa in trancl_into_trancl)\n apply(drule tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(simp)\n done\n\nlemma desc_sib_ne:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\a \\ descendants_of b m; next_sib b t m = Some c; valid_list_2 t m;\n no_mloop m\\\n \\ a \\ c\"\n apply(rule notI)\n apply(drule next_sibD)\n apply(case_tac \"m b\", simp, simp)\n apply(subgoal_tac \"aa \\ descendants_of aa m\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule_tac b=b in trancl_into_trancl2)\n apply(simp)\n apply(drule tranclD2)\n apply(simp)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(drule rtranclD)\n apply(fastforce)\n apply(simp add: no_mloop_descendants)\n done\n\nlemma (in mdb_empty_abs) finite_depth:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"finite_depth m \\ finite_depth n\"\n apply(simp add: finite_depth_def descendants)\n apply(rule allI)\n apply(simp add: n_def)\n apply(case_tac \"slota=slot\")\n apply(simp)\n apply(simp)\n apply(erule_tac x=slota in allE)\n apply(elim exE conjE)\n apply(case_tac \"p=slot\")\n apply(simp)\n apply(subgoal_tac \"\\a. m a = Some slot \\\n (slota \\ descendants_of a m \\ slota = a)\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD)\n apply(elim exE conjE)\n apply(simp)\n apply(rule_tac x=z in exI)\n apply(simp)\n apply(drule rtranclD)\n apply(erule disjE)\n apply(simp)\n apply(simp)\n apply(erule exE)\n apply(rule_tac x=a in exI)\n apply(simp)\n apply(fastforce)\n apply(rule_tac x=p in exI)\n apply(simp)\n done\n\n\n\nlemma distinct_list_replace_list:\n \"\\distinct list; distinct list'; set list \\ set list' = {}; slot \\ set list\\\n \\ distinct (list_replace_list list slot list')\"\n apply(induct list)\n apply(simp)\n apply(simp)\n apply(intro conjI impI)\n apply(fastforce)\n apply(subst set_list_replace_list)\n apply(simp)\n apply(simp)\n apply(fastforce)\n apply(simp)\n apply(simp)\n done\n\n\nlocale mdb_empty_abs_simple =\nfixes m n t slot\nassumes valid_list: \"valid_list_2 t m\"\ndefines \"n \\ (\\p. if m p = Some slot then m slot else m p)(slot := None)\"\nbegin\n\nlemma valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m slot = None\\ \\ valid_list_2 (t(slot := [])) n\"\n apply (insert valid_list)\n apply(simp add: valid_list_2_def n_def)\n apply(intro conjI impI allI notI)\n apply(fastforce)\n done\n\nlemma valid_list_post_self_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m slot = Some slot_p; slot_p = slot\\\n \\ valid_list_2 (t(slot_p := list_remove (t slot_p) slot)) n\"\n apply (insert valid_list)\n apply (simp add: valid_list_2_def n_def list_remove_removed list_remove_distinct)\n apply fastforce\n done\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\m slot = Some slot_p; slot_p \\ slot\\\n \\ valid_list_2 (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n\"\n apply (insert valid_list)\n apply(simp add: valid_list_2_def n_def)\n apply(intro conjI impI allI)\n apply (fastforce simp: set_list_replace_list intro!: distinct_list_replace_list)+\n done\nend\n\nlocale mdb_empty_abs' = mdb_empty_abs + constrains s::\"det_ext state\"\n\n\n\nlemma (in mdb_empty_abs') valid_list_post_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = None\\ \\ valid_list_2 (t(slot := [])) n\"\n apply(simp add: valid_list_2_def)\n apply(intro conjI impI allI notI)\n apply(simp add: n_def split: if_split_asm)\n apply(fastforce simp: n_def split: if_split_asm)\n done\n\n\n\nlemma (in mdb_empty_abs') valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = Some slot_p\\\n \\ valid_list_2 (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n\"\n apply(simp add: valid_list_2_def)\n apply(intro conjI impI allI)\n apply(simp)\n apply(simp add: n_def)\n apply(fastforce simp: set_list_replace_list n_def)\n apply(simp add: n_def)\n apply(simp add: n_def, fastforce)\n apply(rule distinct_list_replace_list)\n apply(simp)+\n apply(rule ccontr)\n apply(fastforce dest: int_not_emptyD)\n apply(simp)\n done\n\nlemma (in mdb_empty_abs') next_child_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = None\\\n \\ next_child p (t(slot := []))\n = (if p = slot then None\n else next_child p t)\"\n apply(simp, intro conjI impI)\n apply(rule next_child_NoneI)\n apply(simp)\n apply(case_tac \"next_child p t\")\n apply(simp)\n apply(rule next_child_NoneI, drule next_child_NoneD)\n apply(simp)\n apply(simp)\n apply(drule(1) next_childD)\n apply(elim exE conjE)\n apply(rule next_childI)\n apply(simp)\n done\n\nlemma (in mdb_empty_abs') next_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = Some slot_p\\\n \\ next_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := []))\n = (if p = slot then None\n else if next_child p t = Some slot then\n if t slot = [] then\n if t p = [slot] then None\n else if hd (t p) = slot then after_in_list (t p) slot\n else Some (hd (t p))\n else next_child slot t\n else next_child p t)\"\n apply(case_tac \"p=slot\")\n apply(fastforce intro: next_child_NoneI dest: next_child_NoneD)\n apply(case_tac \"next_child p t = Some slot\")\n apply(simp split del: if_split)\n apply(drule(1) next_childD)\n apply(elim exE conjE)\n apply(case_tac \"t slot\")\n apply(simp)\n apply(intro conjI impI)\n apply(rule next_child_NoneI)\n apply(simp)\n apply(case_tac xs, simp, simp)\n apply(rule next_childI)\n apply(simp)\n apply(simp)\n apply(fastforce simp: next_child_def intro: next_childI next_child_NoneI)\n apply(simp)\n apply(case_tac \"next_child p t\")\n apply(simp)\n apply(drule next_child_NoneD)\n apply(rule next_child_NoneI)\n apply(fastforce)\n apply(simp)\n apply(fastforce intro: next_childI dest: next_childD simp: next_child_def)\n done\n\nlemma (in mdb_empty_abs') next_sib_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = None\\\n \\ next_sib p (t(slot := [])) n\n = (if m p = Some slot then None\n else next_sib p t m)\"\n apply(simp, intro conjI impI)\n apply(rule next_sib_NoneI)\n apply(simp add: n_def)\n apply(case_tac \"next_sib p t m\")\n apply(simp)\n apply(drule next_sib_NoneD)\n apply(erule disjE)\n apply(rule next_sib_NoneI)\n apply(simp add: n_def)\n apply(elim exE conjE)\n apply(rule next_sib_NoneI)\n apply(rule disjI2)\n apply(fastforce simp: n_def)\n apply(fastforce dest: next_sibD intro: next_sibI simp: n_def)\n done\n\n\nlemma (in mdb_empty_abs') next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = Some slot_p\\\n \\ next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n\n = (if p = slot then None\n else if next_sib p t m = Some slot then\n if t slot = [] then next_sib slot t m\n else next_child slot t\n else if m p = Some slot \\ after_in_list (t slot) p = None then\n next_sib slot t m\n else next_sib p t m)\"\n apply(case_tac \"p=slot\")\n apply(simp)\n apply(fastforce simp: n_def intro: next_sib_NoneI)\n apply(case_tac \"next_sib p t m = Some slot\")\n apply(simp, intro conjI impI)\n apply(case_tac \"next_sib slot t m\")\n apply(simp)\n apply(drule next_sib_NoneD)\n apply(erule disjE)\n apply(fastforce intro: next_sib_NoneI)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(rule next_sib_NoneI)\n apply(rule disjI2)\n apply(rule conjI)\n apply(fastforce simp: n_def)\n apply(simp, intro conjI impI)\n apply(simp add: list_replace_empty_after_empty valid_list_2_def)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(drule next_sibD)+\n apply(elim exE conjE)\n apply(rule next_sibI)\n apply(fastforce simp: n_def)\n apply(simp)\n apply(intro conjI impI notI)\n apply(simp)\n apply(simp add: list_replace_empty_after_empty valid_list_2_def)\n apply(simp)\n apply(drule after_in_list_in_list, simp add: valid_list_2_def)\n apply(drule next_sibD, elim exE conjE)\n apply(case_tac \"next_child slot t\")\n apply(simp, drule next_child_NoneD)\n apply(rule next_sib_NoneI, simp add: n_def)\n apply(simp, drule(1) next_childD)\n apply(elim exE conjE)\n apply(rule next_sibI)\n apply(simp add: n_def)\n apply(intro conjI impI)\n apply(simp)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(intro conjI impI notI, simp)\n apply(subst list_replace_after_fst_list)\n apply(frule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(simp)\n apply(intro conjI impI)\n apply(case_tac \"next_sib slot t m\")\n apply(simp)\n apply(drule next_sib_NoneD)\n apply(erule disjE)\n apply(fastforce simp: n_def intro: next_sib_NoneI)\n apply(elim exE conjE)\n apply(rule next_sib_NoneI)\n apply(rule disjI2)\n apply(rule conjI)\n apply(fastforce simp: n_def)\n apply(simp)\n apply(rule impI)\n apply(drule_tac list=\"t slot_p\" and slot=slot in list_replace_after_None_notin_old)\n apply(simp add: valid_list_2_def)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(rule next_sibI)\n apply(simp add: n_def)\n apply(simp)\n apply(intro conjI impI notI)\n apply simp\n apply(drule_tac list=\"t slot_p\" and slot=slot in list_replace_after_None_notin_old)\n apply(simp add: valid_list_2_def)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(case_tac \"next_sib p t m\")\n apply(simp)\n apply(drule next_sib_NoneD)\n apply(erule disjE)\n apply(fastforce intro: next_sib_NoneI simp: n_def)\n apply(elim exE conjE)\n apply(case_tac \"pa=slot\")\n apply(fastforce intro: next_sib_NoneI)\n apply(rule_tac p=pa in next_sib_NoneI)\n apply(rule disjI2)\n apply(fastforce simp add: valid_list_2_def n_def list_replace_after_None_notin_new)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(case_tac \"pa=slot\")\n apply(rule next_sibI)\n apply(simp add: n_def)\n apply(simp)\n apply(fastforce intro: list_replace_after_notin_old simp: valid_list_2_def)\n apply(simp)\n apply(rule next_sibI)\n apply(simp add: n_def)\n apply(fastforce intro: list_replace_after_notin_new simp: valid_list_2_def)\n done\n\nlemma (in mdb_empty_abs') next_not_child_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; finite_depth m; m slot = None\\\n \\ next_not_child p (t(slot := [])) n\n = (if (\\sl. next_not_child p t m = Some sl \\ m sl = Some slot)\n then None\n else next_not_child p t m)\"\n apply(simp)\n apply(intro conjI impI)\n apply(elim exE conjE)\n apply(drule(1) next_not_childD, simp add: no_mloop)\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib_no_parent descendants)\n apply(intro allI impI)\n apply(erule disjE)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2, simp)\n apply(drule rtranclD, simp)\n apply(drule tranclD2, simp)\n apply(elim conjE exE)\n apply(erule_tac x=q in allE)\n apply(erule impE)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(drule_tac a=p and b=q and c=qa in descendants_linear)\n apply(simp)\n apply(fastforce)\n apply(erule disjE)\n apply(simp)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=q in tranclD2, simp)\n apply(drule rtranclD, simp)\n apply(drule_tac x=q in tranclD2, simp)\n apply(simp)\n apply(simp add: next_sib_no_parent)\n apply(rule impI)\n apply(erule disjE)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD)\n apply(rule next_not_child_NoneI)\n apply(intro allI impI)\n apply(simp add: next_sib_no_parent descendants split: if_split_asm)\n apply(simp add: next_sib_no_parent)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule(1) next_not_childD, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(rule disjI1)\n apply(simp add: next_sib_no_parent)\n apply(drule next_sibD)\n apply(elim exE conjE, drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(rule disjI2)\n apply(rule conjI)\n apply(simp add: next_sib_no_parent)\n apply(elim conjE exE)\n apply(rule_tac x=q in exI)\n apply(intro conjI)\n apply(simp add: next_sib_no_parent)\n apply(drule next_sibD)\n apply(elim exE conjE, drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(simp add: descendants)\n apply(drule next_sibD)\n apply(elim exE conjE, drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(rule conjI)\n apply(fastforce)\n apply(intro notI impI)\n apply(simp)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2, simp)\n apply(intro allI impI)\n apply(simp add: next_sib_no_parent descendants split: if_split_asm)\n apply(simp add: finite_depth)\n done\n\nlemma (in mdb_empty_abs') next_sib':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = Some slot_p; t slot = []\\\n \\ next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n\n = (if p = slot then None\n else if next_sib p t m = Some slot then\n next_sib slot t m\n else next_sib p t m)\"\n apply(insert next_sib)\n apply(atomize)\n apply(erule_tac x=t in allE, erule_tac x=slot_p in allE, erule_tac x=p in allE)\n apply(simp split: if_split_asm)\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=slot in allE)\n apply(fastforce)\n done\n\nlemma (in mdb_empty_abs') next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; m slot = Some slot_p; finite_depth m\\\n \\ next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n\n = (if p = slot then None\n else if next_not_child p t m = Some slot then next_slot slot t m\n else next_not_child p t m)\"\n apply(case_tac \"p=slot\")\n apply(simp)\n apply(rule next_not_child_NoneI)\n apply(fastforce simp: next_sib descendants)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m = Some slot\")\n apply(simp)\n apply(simp add: next_slot_def)\n apply(intro conjI impI)\n apply(subgoal_tac \"\\c. next_child slot t = Some c\")\n prefer 2\n apply(case_tac \"t slot\")\n apply(simp add: next_child_def)\n apply(simp add: next_child_def)\n apply(erule exE)\n apply(simp)\n apply(drule(1) next_not_childD, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(rule disjI2)\n apply(elim exE conjE)\n apply(subgoal_tac \"p \\ descendants_of slot m\")\n prefer 2\n apply(rule notI)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule_tac a=p and b=slot and c=q in descendants_linear)\n apply(simp)\n apply(rule notI, simp add: after_in_list_not_self valid_list_2_def)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(subgoal_tac \"pa \\ descendants_of pa m\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(erule disjE)\n apply(rule_tac b=q in trancl_into_trancl2)\n apply(simp)\n apply(drule_tac x=q and y=slot in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(fastforce)\n apply(rule_tac b=slot in trancl_into_trancl2)\n apply(simp)\n apply(drule_tac x=slot and y=q in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(fastforce)\n apply(insert valid_mdb)[1]\n apply(drule_tac slot=pa in desc_not_parent, simp add: m_def)\n apply(subgoal_tac \"m p \\ Some slot\")\n prefer 2\n apply(rule notI)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(rule conjI)\n apply(simp add: next_sib)\n apply(rule_tac x=q in exI)\n apply(simp add: descendants)\n apply(intro conjI impI notI)\n apply(simp)\n apply(simp add: next_sib)\n apply(intro allI impI)\n apply(subgoal_tac \"m q' \\ Some slot\")\n prefer 2\n apply(rule notI)\n apply(drule next_sibD)\n apply(elim exE conjE, drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(subgoal_tac \"pa \\ descendants_of pa m\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule_tac b=q in trancl_into_trancl2)\n apply(simp)\n apply(elim conjE)\n apply(drule_tac x=q and y=q' in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(drule_tac x=q and y=slot in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(fastforce)\n apply(insert valid_mdb)[1]\n apply(drule_tac slot=pa in desc_not_parent, simp add: m_def)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child slot t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD)\n apply(drule(1) next_not_childD, simp add: no_mloop)\n apply(rule next_not_child_NoneI)\n apply(intro impI allI)\n apply(simp add: next_sib' descendants split: if_split_asm)\n apply(erule disjE)\n apply(drule_tac c=q in next_sib_share_parent, simp)\n apply(fastforce)\n apply(elim conjE exE)\n apply(rule impI)\n apply(drule_tac a=p and b=qa and c=q in descendants_linear)\n apply(simp)\n apply(fastforce)\n apply(erule disjE)\n apply(drule_tac c=q in next_sib_share_parent, simp)\n apply(fastforce)\n apply(fastforce)\n apply(fastforce simp: next_sib')\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule(1) next_not_childD, simp add: no_mloop)+\n apply(elim disjE conjE exE)\n apply(rule next_not_childI)\n apply(simp add: next_sib')\n apply(simp add: finite_depth)\n apply(frule_tac a=p and c=q in next_sib_share_parent, simp)\n apply(rule next_not_childI)\n apply(simp add: next_sib' descendants)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(frule_tac a=slot and c=a in desc_sib_ne)\n apply(simp)\n apply(simp)\n apply(simp add: no_mloop)\n apply(simp)\n apply(rule conjI)\n apply(rule notI)\n apply(simp add: no_mloop no_mloop_descendants)\n apply(intro impI allI)\n apply(elim conjE)\n apply(drule_tac a=p and c=q' in next_sib_share_parent, simp)\n apply(simp)\n apply(simp add: finite_depth)\n apply(rule next_not_childI)\n apply(simp add: next_sib')\n apply(rule_tac x=q in exI)\n apply(simp add: descendants)\n apply(intro conjI impI allI notI)\n apply(frule next_sibD)\n apply(simp add: not_sib_self)\n apply(simp)\n apply(simp add: finite_depth)\n apply(rule next_not_childI)\n apply(simp add: next_sib')\n apply(rule_tac x=qa in exI)\n apply(simp add: descendants)\n apply(frule_tac a=slot and b=qa and c=a in desc_sib_ne)\n apply(simp)\n apply(simp)\n apply(simp add: no_mloop)\n apply(simp)\n apply(frule_tac a=q and c=qa in next_sib_share_parent)\n apply(simp)\n apply(simp)\n apply(intro conjI impI allI notI)\n apply(simp)\n apply(rule_tac b=q in descendants_trans)\n apply(simp)\n apply(simp)\n apply(erule conjE)\n apply(case_tac \"q=q'\")\n apply(simp)\n apply(frule_tac a=p and b=q and c=q' in descendants_linear)\n apply(simp)\n apply(simp)\n apply(erule disjE)\n apply(drule_tac a=q and c=q' in next_sib_share_parent)\n apply(simp)\n apply(fastforce)\n apply(fastforce)\n apply(simp add: finite_depth)\n apply(simp)\n apply(case_tac \"next_not_child p t m\")\n apply(simp)\n apply(drule(1) next_not_child_NoneD)\n apply(erule conjE)\n apply(rule next_not_child_NoneI)\n apply(intro allI impI)\n apply(simp add: next_sib descendants split: if_split_asm)\n apply(intro impI conjI)\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=slot in allE)+\n apply(fastforce)\n apply(drule_tac a=p and b=q and c=slot in descendants_trans)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp)\n apply(simp add: next_sib)\n apply(erule_tac x=slot in allE)\n apply(fastforce simp: descendants_of_def cdt_parent_defs)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule(1) next_not_childD, simp add: no_mloop)\n apply(erule disjE)\n apply(frule next_sibD)\n apply(rule next_not_childI)\n apply(rule disjI1)\n apply(fastforce simp: next_sib)\n apply(simp add: finite_depth)\n apply(elim conjE exE)\n apply(rule next_not_childI)\n apply(case_tac \"q=slot \\ m p = Some slot\")\n apply(rule disjI1)\n apply(simp add: next_sib)\n apply(drule next_sib_NoneD, simp, simp)\n apply(rule disjI2)\n apply(rule conjI)\n apply(simp add: next_sib)\n apply(rule impI)\n apply(erule conjE)\n apply(frule_tac a=p and b=q and c=slot in descendants_linear)\n apply(simp add: child_descendant)\n apply(simp)\n apply(erule disjE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2, simp)\n apply(drule rtranclD, simp)\n apply(drule_tac x=slot and y=q and z=slot in trancl_trans)\n apply(simp)\n apply(insert no_mloop)[1]\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(simp add: child_descendant)\n apply(case_tac \"q=slot\")\n apply(simp)\n apply(subgoal_tac \"\\c. m c = Some slot \\ p \\ descendants_of c m\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD)\n apply(elim exE conjE)\n apply(rule_tac x=z in exI)\n apply(simp)\n apply(drule rtranclD)\n apply(fastforce)\n apply(elim exE conjE)\n apply(rule_tac x=c in exI)\n apply(rule conjI)\n apply(simp add: next_sib)\n apply(subgoal_tac \"next_sib c t m = None\")\n prefer 2\n apply(erule_tac x=c in allE)\n apply(erule_tac Q=\"next_sib c t m = None\" in impE)\n apply(simp add: child_descendant)\n apply(simp)\n apply(simp)\n apply(intro conjI impI)\n apply(fastforce)\n apply(fastforce)\n apply(frule_tac slot=c in next_sib_NoneD, simp)\n apply(rule conjI)\n apply(simp add: descendants)\n apply(fastforce)\n apply(intro allI impI)\n apply(simp add: next_sib descendants split: if_split_asm)\n apply(subgoal_tac \"next_sib q' t m = None\")\n prefer 2\n apply(erule_tac x=q' in allE)\n apply(erule_tac Q=\"next_sib q' t m = None\" in impE)\n apply(simp)\n apply(rule_tac b=c in descendants_trans)\n apply(simp)\n apply(simp add: child_descendant)\n apply(simp)\n apply(simp)\n apply(intro conjI impI notI)\n apply(simp add: valid_list_2_def, erule conjE)\n apply(erule_tac x=slot in allE)+\n apply(fastforce)\n apply(erule conjE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=c and y=q' in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(simp)\n apply(drule_tac a=c and b=slot and c=c in trancl_into_trancl)\n apply(simp)\n apply(insert no_mloop)[1]\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(rule_tac x=q in exI)\n apply(intro conjI)\n apply(simp add: next_sib)\n apply(frule next_sibD)\n apply(intro conjI impI)\n apply(simp)\n apply(simp add: descendants)\n apply(intro allI impI)\n apply(simp add: next_sib descendants split: if_split_asm)\n apply(intro conjI impI)\n apply(simp add: valid_list_2_def, erule conjE)\n apply(erule_tac x=slot in allE)+\n apply(fastforce)\n apply(elim conjE)\n apply(erule_tac x=slot in allE)\n apply(erule impE)\n apply(rule conjI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=q and y=q' in tranclD2, simp)\n apply(drule rtranclD, simp)\n apply(rule_tac b=q' in descendants_trans)\n apply(simp)\n apply(simp add: child_descendant)\n apply(simp)\n apply(simp add: finite_depth)\n done\n\nlemma (in mdb_empty_abs') next_slot_no_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = None; no_mloop m; finite_depth m\\\n \\ next_slot p (t(slot := [])) n\n = (if p = slot then None\n else if (\\sl. next_slot p t m = Some sl \\ m sl = Some slot)\n then None\n else next_slot p t m)\"\n apply(case_tac \"p=slot\")\n apply(simp add: next_slot_def next_not_child_no_parent)\n apply(rule impI)\n apply(simp add: next_not_child_termination next_sib_def)\n apply(case_tac \"\\sl. next_slot p t m = Some sl \\ m sl = Some slot\")\n apply(simp add: next_slot_def)\n apply(intro conjI impI)\n apply(elim exE conjE)\n apply(simp split: if_split_asm)\n apply(drule(1) next_childD)\n apply(simp)\n apply(simp add: next_not_child_no_parent)\n apply(simp only:, simp)\n apply(simp add: next_slot_def next_child_no_parent next_not_child_no_parent)\n apply(fastforce split: if_split_asm)\n done\n\nlemma (in mdb_empty_abs') next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list_2 t m; m slot = Some slot_p; no_mloop m; finite_depth m\\\n \\ next_slot p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n\n = (if p = slot then None\n else if next_slot p t m = Some slot then next_slot slot t m\n else next_slot p t m)\"\n apply(case_tac \"p=slot\")\n apply(simp add: next_slot_def next_not_child next_child)\n apply(case_tac \"next_slot p t m = Some slot\")\n apply(simp only: next_slot_def next_not_child next_child)\n apply(case_tac \"t slot = []\")\n apply(simp split del: if_split)\n apply(case_tac \"t p = []\")\n apply(fastforce)\n apply(case_tac \"p=slot_p \\ t slot_p = [slot]\")\n apply(simp)\n apply(rule impI)\n apply(subgoal_tac \"next_not_child_dom (slot, t, m)\")\n prefer 2\n apply(simp add: next_not_child_termination valid_list_2_def)\n apply(simp)\n apply(rule impI, erule exE)\n apply(frule_tac src=slot in next_sib_not_self)\n apply(drule next_sibD)\n apply(fastforce)\n apply(simp split del: if_split)\n apply(case_tac \"p = slot_p\")\n apply(subgoal_tac \"list_replace_list (t slot_p) slot [] \\ []\")\n prefer 2\n apply(case_tac \"t slot_p\")\n apply(simp)\n apply(simp add: valid_list_2_def)\n apply(simp split del: if_split)\n apply(simp)\n apply(intro conjI impI)\n apply(case_tac \"t slot_p\")\n apply(simp)\n apply(simp)\n apply(case_tac list)\n apply(simp)\n apply(simp)\n apply(rule next_not_childI[symmetric])\n apply(simp add: next_sib_def)\n apply(simp)\n apply(case_tac \"t slot_p\")\n apply(simp)\n apply(simp add: next_child_def)\n apply(simp)\n apply(rule conjI)\n apply(rule impI)\n apply(case_tac \"t p\")\n apply(simp)\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=p in allE)\n apply(simp add: set_eq_subset)\n apply(intro conjI impI)\n apply(fastforce simp: valid_list_2_def)\n apply(case_tac \"t p\")\n apply(simp)\n apply(simp add: next_child_def)\n apply(simp split del: if_split)\n apply(case_tac \"t p\")\n apply(fastforce)\n apply(case_tac \"t p = [slot]\")\n apply(fastforce)\n apply(fastforce split: if_split_asm)\n apply(simp)\n apply(simp add: next_slot_def split del: if_split)\n apply(case_tac \"t p\")\n apply(fastforce simp: next_not_child next_child)\n apply(case_tac \"t p = [slot]\")\n apply(simp add: next_not_child next_child next_child_def)\n apply(simp add: next_child next_not_child)\n apply(fastforce split: if_split_asm)\n done\n\ncrunch valid_list[wp]: deleted_irq_handler,set_cap valid_list\n\ncrunch all_but_exst[wp]: empty_slot_ext \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: empty_slot_ext\n\ninterpretation empty_slot_extended: is_extended \"empty_slot_ext a b\"\n by (unfold_locales; wp)\n\n\nlemma empty_slot_valid_list[wp]:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list\\\n empty_slot sl irqopt\n \\\\rv. valid_list\\\"\n apply (simp add: empty_slot_def)\n apply (simp add: set_cdt_def update_cdt_list_def set_cdt_list_def\n empty_slot_ext_def bind_assoc cong: if_cong)\n apply (wp get_cap_wp static_imp_wp | wpc | wp_once hoare_vcg_all_lift)+\n apply (clarsimp simp del: fun_upd_apply)\n apply (frule mdb_empty_abs_simple.intro)\n apply(case_tac \"cdt s sl\")\n apply (frule(1) mdb_empty_abs_simple.valid_list_post_no_parent)\n apply simp\n apply (case_tac \"a = sl\")\n apply (frule(2) mdb_empty_abs_simple.valid_list_post_self_parent)\n apply simp\n apply (frule(2) mdb_empty_abs_simple.valid_list_post)\n apply simp\n done\n\nlemma set_cap_exst_update:\n \"((),s') \\ fst (set_cap c p s) \\ ((),exst_update f s') \\ fst (set_cap c p (exst_update f s))\"\n apply (cases p)\n apply (clarsimp simp add: set_cap_def in_monad get_object_def)\n apply (case_tac y)\n apply (auto simp add: in_monad set_object_def split: if_split_asm)\n done\n\nlemma no_parent_not_next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\m slot = None; valid_list_2 t m; finite_depth m; no_mloop m\\\n \\ next_slot p t m \\ Some slot\"\n apply(rule notI)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(drule(1) next_childD)\n apply(simp)\n apply(drule(2) next_not_childD)\n apply(erule disjE)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n apply(elim conjE exE)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(simp add: valid_list_2_def)\n done\n\n\ndefinition descendants_prop where\n \"descendants_prop P t \\ (\\p. \\c \\ set (t p). P c)\"\n\nlocale mdb_swap_abs_simple =\n fixes m :: cdt\n fixes t t' t'' n' n dest src\n defines \"n' \\\n \\n. if m n = Some src then Some dest\n else if m n = Some dest then Some src else m n\"\n and \"n \\ n'(src := n' dest, dest := n' src)\"\n defines \"t' \\ (case n src of\n None \\ (case n dest of\n None \\ t'' |\n Some dest_p \\ t'' (dest_p := list_replace (t'' dest_p) src dest)) |\n Some src_p \\ (case n dest of\n None \\ t'' (src_p := list_replace (t'' src_p) dest src) |\n Some dest_p \\ if src_p = dest_p\n then t'' (src_p := list_swap (t'' src_p) src dest)\n else t'' (src_p := list_replace (t'' src_p) dest src,\n dest_p := list_replace (t'' dest_p) src dest)))\"\n defines \"t'' \\ t(src := t dest, dest := t src)\"\n assumes valid_list: \"valid_list_2 t m\"\nbegin\n\n\n\nlemma valid_list_post_no_parents:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"m src = None \\ m dest = None \\ valid_list_2 t' n\"\n apply (insert valid_list)\n apply (simp add: t'_def t''_def n_def n'_def valid_list_2_def)\n apply (intro impI conjI allI)\n apply fastforce+\n done\n\nlemma valid_list_post_src_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"m src = Some src_p \\ m dest = None \\ valid_list_2 t' n\"\n apply (insert valid_list)\n apply (simp add: t'_def t''_def n_def n'_def)\n apply (intro impI conjI allI)\n apply (fastforce simp: valid_list_2_def replace_distinct list_replace_set)+\n done\n\nlemma valid_list_post_dest_parent:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"m src = None \\ m dest = Some dest_p \\ valid_list_2 t' n\"\n apply (insert valid_list)\n apply (simp add: t'_def t''_def n_def n'_def)\n apply (intro impI conjI allI)\n apply (fastforce simp: valid_list_2_def replace_distinct list_replace_set)+\n done\n\nlemma valid_list_post_parents:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"m src = Some src_p \\ m dest = Some dest_p \\ valid_list_2 t' n\"\n apply (insert valid_list)\n apply (simp add: t'_def t''_def n_def n'_def)\n apply (intro impI conjI allI)\n apply (simp add: valid_list_2_def list_swap_def swap_distinct[simplified list_swap_def] list_replace_def replace_distinct[simplified list_replace_def]| intro impI conjI allI | fastforce)+\n done\n\nlemma valid_list_post:\n \"valid_list_2 t' n\"\n apply (case_tac \"m src\")\n apply (case_tac \"m dest\")\n apply (simp add: valid_list_post_no_parents)\n apply (simp add: valid_list_post_dest_parent)\n apply (case_tac \"m dest\")\n apply (simp add: valid_list_post_src_parent)\n apply (simp add: valid_list_post_parents)\n done\n\nend\n\nlocale mdb_swap_abs'' = mdb_swap_abs + constrains s::\"det_state\"\n\nlocale mdb_swap_abs' = mdb_swap_abs'' +\n fixes t t' t''\n defines \"t' \\ (case n src of\n None \\ (case n dest of\n None \\ t'' |\n Some dest_p \\ t'' (dest_p := list_replace (t'' dest_p) src dest)) |\n Some src_p \\ (case n dest of\n None \\ t'' (src_p := list_replace (t'' src_p) dest src) |\n Some dest_p \\ if src_p = dest_p\n then t'' (src_p := list_swap (t'' src_p) src dest)\n else t'' (src_p := list_replace (t'' src_p) dest src,\n dest_p := list_replace (t'' dest_p) src dest)))\"\n defines \"t'' \\ t(src := t dest, dest := t src)\"\n assumes \"t = cdt_list s\"\n assumes valid_list: \"valid_list_2 t m\"\n\ncontext mdb_swap_abs'\nbegin\n\nlemma findepth:\n \"finite_depth m\"\n apply (simp add: m)\n apply (rule Deterministic_AI.finite_depth)\n apply (rule valid_mdb)\n done\n\nlemma finite_depth:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"finite_depth n\"\n apply (insert findepth)\n apply(simp add: finite_depth_def descendants split del: if_split)\n apply(simp add: n_def n'_def split del: if_split)\n apply(rule allI)\n apply(case_tac \"slot=src\")\n apply(erule_tac x=dest in allE)\n apply(elim exE conjE)\n apply(case_tac \"p=src\")\n apply(rule_tac x=dest in exI, simp add: s_d_swap_def)\n apply(case_tac \"p = dest\")\n apply(rule_tac x =\"src\" in exI, simp add: s_d_swap_def)\n apply(rule_tac x=p in exI, simp add: s_d_swap_def)\n apply (case_tac \"slot=dest\")\n apply(erule_tac x=src in allE)\n apply (elim exE conjE)\n apply (case_tac \"p=src\")\n apply (rule_tac x =dest in exI, simp add: s_d_swap_def)\n apply (case_tac \"p=dest\")\n apply (simp add: descendants_of_def)\n apply (intro conjI impI)\n apply (rule_tac x = \"src\" in exI, intro conjI, rule impI, simp+)\n apply (rule_tac x = \"src\" in exI)\n apply (intro conjI impI; simp)\n apply (rule_tac x = \"p\" in exI)\n apply (simp add: descendants_of_def s_d_swap_def)\n apply (erule_tac x = slot in allE)\n apply (elim exE conjE)\n apply (case_tac \"p = dest\")\n apply (rule_tac x = \"src\" in exI, simp add: descendants_of_def s_d_swap_def)\n apply (case_tac \"p = src\")\n apply (rule_tac x = \"dest\" in exI, simp add: descendants_of_def s_d_swap_def)\n apply (rule_tac x =\"p\" in exI, simp add: descendants_of_def s_d_swap_def)\n done\n\nlemma parency_antisym: \"\\x y. m x = Some y \\ m y \\ Some x\"\n apply (frule parent_not_descendant[OF no_mloop])\n apply (rule notI)\n apply (frule_tac src=y and src_p=x in child_descendant,simp)\n done\n\nlemma parent_not_next_child: \"x \\ set (t x)\"\n apply (insert no_mloop valid_list)\n apply (simp add: valid_list_2_def no_mloop_def del: split_paired_All)\n done\n\nlemma valid_list_post:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes parency_antisym[where x=src and y = dest,simp]\n notes parent_not_next_child[simp]\n shows \"valid_list_2 t' n\"\n proof -\n from valid_list show ?thesis\n apply (simp add: t'_def t''_def n_def n'_def cong: option.case_cong)\n by (simp add: replace_distinct[OF parent_not_next_child]\n replace_distinct list_replace_set\n list_swap_both insert_Collect remove_collect\n swap_distinct\n | intro impI conjI iffI allI\n | (intro impI conjI iffI notI,simp_all)\n | rule Collect_cong\n | simp split: option.splits\n | (rule ccontr,simp,elim impE,rule notI)\n | simp only: valid_list_2_def )+ (*slow*)\nqed\n\nlemma next_child_antisym: \"next_child x t = Some y \\ next_child y t \\ Some x\"\n apply (rule notI)\n apply (clarsimp dest!: next_childD[OF _ valid_list])\n apply (simp add: parency_antisym)\n done\n\nlemma next_childI'': \"(\\xs. t''' slot = child # xs) \\ next_child slot t''' = Some child\"\n apply (elim exE)\n apply (rule next_childI,simp)\n done\n\nlemma next_childD'':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n\"next_child slot t''' \\ Some child \\ t''' slot = [] \\ (\\xs a. t''' slot = a#xs \\ a \\ child)\"\n apply (simp add: next_child_def)\n apply (case_tac \"t''' slot\")\n apply simp+\n done\n\nlemma next_child_eq_ignore: \"g p = g' p \\ next_child p g = next_child p g'\"\n by(simp add: next_child_def)\n\nlemma next_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes parency_antisym[where x=src and y = dest,simp]\n notes next_child_antisym[where x=src and y = dest,simp]\n notes next_childD' = next_childD[OF _ valid_list]\n notes rdefs = t'_def t''_def n_def n'_def\n shows \n \"next_child p t'\n = (if p = src then\n (if next_child dest t = Some src then Some dest\n else next_child dest t)\n else if p = dest then\n (if next_child src t = Some dest then Some src\n else next_child src t)\n else if next_child p t = Some src then Some dest\n else if next_child p t = Some dest then Some src\n else next_child p t)\"\n apply (simp add: rdefs split: option.splits)\n apply (intro impI conjI,simp_all)\n by ((intro impI conjI allI | drule next_child_NoneD next_childD' next_childD'' | \n rule next_childI'' | simp add: list_replace_def list_swap_def | elim exE conjE disjE |\n simp add: next_child_def)+) (*slow*)\n\n\nlemma next_sib_antisym:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"next_sib x t m = Some y \\ next_sib y t m \\ Some x\"\n apply (rule notI)\n apply (frule next_sib_same_parent[OF valid_list])\n apply (elim exE conjE)\n apply (drule next_sibD)+\n apply (elim exE conjE)\n apply (simp add: valid_list[simplified valid_list_2_def] distinct_after_in_list_antisym)\n done\n\n\nlemma after_in_listD': \"after_in_list (t p) x = Some y \\ (\\xs ys. xs @ (x # y # ys) = (t p) \\ x \\ set xs) \\ (m y = Some p \\ m x = Some p) \\ x \\ y\"\n apply (rule conjI)\n apply (drule after_in_listD)\n apply force\n apply (drule after_in_listD)\n apply (elim exE conjE)\n apply (rule conjI)\n apply (subgoal_tac \"x \\ set (t p) \\ y \\ set (t p)\")\n apply (thin_tac \"t p = Q\" for Q)\n apply (simp add: valid_list[simplified valid_list_2_def])+\n apply (subgoal_tac \"distinct (t p)\")\n apply simp\n apply (thin_tac \"t p = Q\" for Q)\n apply (simp add: valid_list[simplified valid_list_2_def])+\n done\n\nlemma optionD: \"x \\ Some y \\ x = None \\ (\\z. x = Some z \\ z \\ y)\"\n by (case_tac \"x\"; simp)\n\nlemma t_distinct: \"distinct (t x)\"\n by (simp add: valid_list[simplified valid_list_2_def])\n\nlemma t_some[simp]: \"set (t x) = {c. m c = Some x}\"\n by (simp add: valid_list[simplified valid_list_2_def])\n\ndeclare t_distinct [simp]\n\nlemmas list_swap_preservation_t = \n list_swap_preserve_after list_swap_preserve_after'\n list_swap_preserve_after'' list_swap_preserve_None list_swap_preserve_None'\n list_swap_preserve_Some_other' list_swap_preserve_Some_other_distinct[OF t_distinct]\n list_swap_preserve_Some_other_distinct[OF t_distinct, simplified list_swap_symmetric]\n list_swap_does_swap[OF t_distinct]\n list_swap_does_swap[OF t_distinct,simplified list_swap_symmetric] \n list_swap_preserve_after_None list_swap_preserve_separate list_swap_does_swap'\n\nlemma next_sibD':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"next_sib slot t m = Some child \\\n \\p. m slot = Some p \\ m child = Some p \\ after_in_list (t p) slot = Some child\"\n apply (frule next_sib_same_parent[OF valid_list])\n apply (drule next_sibD)\n apply clarsimp\n done\n\nlemma next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n notes parency_antisym[where x=src and y = dest,simp]\n notes next_sib_antisym[where x=src and y = dest,simp]\n notes distinct_after_in_list_not_self[OF t_distinct,simp]\n notes rdefs = t'_def t''_def n_def n'_def\n notes parent_not_next_child[simp]\n shows\n \"next_sib p t' n\n = (if p = src then\n (if next_sib dest t m = Some src then Some dest\n else next_sib dest t m)\n else if p = dest then\n (if next_sib src t m = Some dest then Some src\n else next_sib src t m)\n else if next_sib p t m = Some src then Some dest\n else if next_sib p t m = Some dest then Some src\n else next_sib p t m)\"\n apply simp\n apply (intro impI conjI allI,simp_all)\n by ((intro impI conjI allI\n | drule next_sib_NoneD next_sibD'\n | simp add: next_sib_def rdefs split: option.splits\n | simp add: after_in_list_append_notin_hd replace_list_preserve_after replace_list_preserve_after'\n list_swap_preservation_t replace_distinct swap_distinct\n | rule after_in_list_list_replace\n | drule optionD after_in_listD'\n | elim exE conjE disjE | force )+) (*slow*)\n\nlemma next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"next_not_child p t' n\n = (if p = src then\n (if next_not_child dest t m = Some src then Some dest\n else next_not_child dest t m)\n else if p = dest then\n (if next_not_child src t m = Some dest then Some src\n else next_not_child src t m)\n else if next_not_child p t m = Some src then Some dest\n else if next_not_child p t m = Some dest then Some src\n else next_not_child p t m)\"\n apply(case_tac \"p=src\")\n apply(case_tac \"next_not_child dest t m = Some src\")\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(elim conjE exE)\n apply(rule disjI2)\n apply(simp add: next_sib)\n apply(intro impI conjI)\n apply(drule next_sibD')+\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(case_tac \"m q\", simp)\n apply(case_tac \"m src\", simp)\n apply(simp)\n apply(drule tranclD2)\n apply(simp)\n apply(drule_tac a=q and b=a and c=q in rtrancl_into_trancl1)\n apply(simp)\n apply(insert no_mloop)[1]\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(case_tac \"q=src\")\n apply(rule_tac x=dest in exI)\n apply(simp)\n apply(simp add: not_sib_self valid_list)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro conjI impI notI allI)\n apply(simp add: descendants s_d_swap_def split: if_split_asm)+\n apply(simp add: finite_depth)\n apply(simp)\n apply(case_tac \"next_not_child dest t m\")\n apply(simp)\n apply(drule next_not_child_NoneD, simp add: findepth)\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib descendants s_d_swap_def)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(elim conjE exE)\n apply(rule disjI2)\n apply(simp add: next_sib split del: if_split)\n apply(case_tac \"q=src\")\n apply(rule_tac x=dest in exI)\n apply(simp add: descendants s_d_swap_def)\n apply(insert no_mloop)[1]\n apply(intro conjI impI notI allI)\n apply((simp add: no_mloop_def descendants_of_def)+)[7]\n apply(drule(1) desc_sib_ne, simp add: valid_list, simp, simp)\n apply(simp)\n apply(simp)\n apply(rule_tac x=q in exI)\n apply(subgoal_tac \"q\\dest\")\n prefer 2\n apply(rule notI)\n apply(insert valid_mdb)[1]\n apply(drule_tac slot=dest in desc_not_parent, simp)\n apply(subgoal_tac \"a\\dest\")\n prefer 2\n apply(rule notI, simp)\n apply(drule(1) desc_sib_ne, simp add: valid_list, simp add: no_mloop, simp)\n apply(simp add: descendants s_d_swap_def split del: if_split)\n apply(simp)\n apply(intro conjI impI allI notI, simp+)\n apply(simp add: finite_depth)\n apply(case_tac \"p=dest\")\n apply(case_tac \"next_not_child src t m = Some dest\")\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(elim conjE exE)\n apply(rule disjI2)\n apply(simp add: next_sib)\n apply(intro impI conjI)\n apply(drule next_sibD')+\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(case_tac \"m q\", simp)\n apply(case_tac \"m dest\", simp)\n apply(simp)\n apply(drule tranclD2)\n apply(simp)\n apply(drule_tac a=q and b=a and c=q in rtrancl_into_trancl1)\n apply(simp)\n apply(insert no_mloop)[1]\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(case_tac \"q=dest\")\n apply(rule_tac x=src in exI)\n apply(simp add: not_sib_self valid_list)\n apply(rule_tac x=q in exI)\n apply(simp)\n apply(intro conjI impI notI allI)\n apply(simp add: descendants s_d_swap_def split: if_split_asm)+\n apply(simp add: finite_depth)\n apply(simp)\n apply(case_tac \"next_not_child src t m\")\n apply(simp)\n apply(drule next_not_child_NoneD, simp add: findepth)\n apply(rule next_not_child_NoneI)\n apply(simp add: next_sib descendants s_d_swap_def)\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(elim conjE exE)\n apply(rule disjI2)\n apply(simp add: next_sib split del: if_split)\n apply(case_tac \"q=dest\")\n apply(rule_tac x=src in exI)\n apply(simp add: descendants s_d_swap_def)\n apply(insert no_mloop)[1]\n apply(intro conjI impI notI allI)\n apply((simp add: no_mloop_def descendants_of_def)+)[7]\n apply(drule(1) desc_sib_ne, simp add: valid_list, simp, simp)\n apply(simp)\n apply(simp)\n apply(rule_tac x=q in exI)\n apply(subgoal_tac \"q\\src\")\n prefer 2\n apply(rule notI)\n apply(insert valid_mdb)[1]\n apply(drule_tac slot=src in desc_not_parent, simp)\n apply(subgoal_tac \"a\\src\")\n prefer 2\n apply(rule notI, simp)\n apply(drule(1) desc_sib_ne, simp add: valid_list, simp add: no_mloop, simp)\n apply(simp add: descendants s_d_swap_def split del: if_split)\n apply(simp)\n apply(intro conjI impI allI notI, simp+)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m = Some src\")\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(rule disjI2)\n apply(elim conjE exE)\n apply(subst next_sib, simp)\n apply(case_tac \"q=dest\")\n apply(rule_tac x=src in exI)\n apply(simp add: next_sib descendants s_d_swap_def split del: if_split)\n apply(intro allI impI)\n apply(simp)\n apply(simp split: if_split_asm)\n apply(rule_tac x=q in exI)\n apply(subgoal_tac \"q\\src\")\n prefer 2\n apply(rule notI)\n apply(simp add: not_sib_self valid_list)\n apply(intro conjI allI impI)\n apply(simp add: next_sib)\n apply(simp add: descendants s_d_swap_def)\n apply(simp add: next_sib)\n apply(subgoal_tac \"next_sib dest t m \\ Some src\")\n prefer 2\n apply(rule notI)\n apply(drule_tac a=q and b=dest in next_sib_inj, simp, simp add: valid_list, simp)\n apply(case_tac \"q'=dest\")\n apply(simp add: descendants s_d_swap_def split: if_split_asm)\n apply(simp add: descendants s_d_swap_def split: if_split_asm)\n apply(simp add: finite_depth)\n apply(case_tac \"next_not_child p t m = Some dest\")\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(rule disjI2)\n apply(elim conjE exE)\n apply(subst next_sib, simp)\n apply(case_tac \"q=src\")\n apply(rule_tac x=dest in exI)\n apply(simp add: next_sib descendants s_d_swap_def split del: if_split)\n apply(intro allI impI)\n apply(simp)\n apply(simp split: if_split_asm)\n apply(rule_tac x=q in exI)\n apply(subgoal_tac \"q\\dest\")\n prefer 2\n apply(rule notI)\n apply(simp add: not_sib_self valid_list)\n apply(intro conjI allI impI)\n apply(simp add: next_sib)\n apply(simp add: descendants s_d_swap_def)\n apply(simp add: next_sib)\n apply(subgoal_tac \"next_sib src t m \\ Some dest\")\n prefer 2\n apply(rule notI)\n apply(drule_tac a=q and b=src in next_sib_inj, simp, simp add: valid_list, simp)\n apply(case_tac \"q'=src\")\n apply(simp add: descendants s_d_swap_def split: if_split_asm)\n apply(simp add: descendants s_d_swap_def split: if_split_asm)\n apply(simp add: finite_depth)\n apply(simp)\n apply(case_tac \"next_not_child p t m\")\n apply(simp)\n apply(drule next_not_child_NoneD, simp add: findepth)\n apply(rule next_not_child_NoneI)\n apply(simp add: descendants s_d_swap_def next_sib split del: if_split)\n apply(intro allI conjI)\n apply(simp_all)[3]\n apply(simp add: next_sib)\n apply(simp add: finite_depth)\n apply(simp)\n apply(drule next_not_childD, simp add: findepth, simp add: no_mloop)\n apply(rule next_not_childI)\n apply(erule disjE)\n apply(simp add: next_sib)\n apply(rule disjI2)\n apply(rule conjI)\n apply(simp add: next_sib)\n apply(elim conjE exE)\n apply(case_tac \"q=dest\")\n apply(rule_tac x=src in exI)\n apply(intro conjI impI allI)\n apply(simp add: next_sib)\n apply(simp add: descendants s_d_swap_def)\n apply(simp add: next_sib descendants s_d_swap_def split: if_split_asm)\n apply(case_tac \"q=src\")\n apply(rule_tac x=dest in exI)\n apply(intro conjI impI allI)\n apply(simp add: next_sib)\n apply(simp add: descendants s_d_swap_def)\n apply(simp add: next_sib descendants s_d_swap_def split: if_split_asm)\n apply(rule_tac x=q in exI)\n apply(intro conjI impI allI)\n apply(simp add: next_sib)\n apply(simp add: descendants s_d_swap_def)\n apply(simp add: next_sib descendants s_d_swap_def split: if_split_asm)\n apply(simp add: finite_depth)\n done\n\nlemma t'_empty:\n \"(t' src = []) = (t dest = [])\"\n \"(t' dest = []) = (t src = [])\"\n \"p\\src \\ p\\dest \\ (t' p = []) = (t p = [])\"\n by(fastforce simp: n_def n'_def t''_def t'_def list_swap_def\n split: option.splits split: if_split_asm)+\n\nlemma next_slot:\n \"next_slot p t' n\n = (if p = src then\n (if next_slot dest t m = Some src then Some dest\n else next_slot dest t m)\n else if p = dest then\n (if next_slot src t m = Some dest then Some src\n else next_slot src t m)\n else if next_slot p t m = Some src then Some dest\n else if next_slot p t m = Some dest then Some src\n else next_slot p t m)\"\n apply(case_tac \"p=src\")\n apply(simp add: next_slot_def next_child next_not_child valid_list t'_empty)\n apply(case_tac \"p=dest\")\n apply(simp add: next_slot_def next_child next_not_child valid_list t'_empty\n split: if_split_asm)\n apply(case_tac \"next_slot p t m = Some src\")\n apply(simp add: next_slot_def next_child next_not_child s_d_swap_def t'_empty\n split: if_split_asm)\n apply(case_tac \"next_slot p t m = Some dest\")\n apply(simp add: next_slot_def next_child next_not_child s_d_swap_def t'_empty\n split: if_split_asm)\n apply(simp add: next_slot_def next_child next_not_child s_d_swap_def t'_empty\n split: if_split_asm)\n done\n\nend\n\n\ncrunch all_but_exst[wp]: cap_swap_ext \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: cap_swap_ext\n\ninterpretation cap_swap_ext_extended: is_extended \"cap_swap_ext a b c d\"\n by (unfold_locales; wp cap_swap_ext_all_but_exst)\n\n\nlemma cap_swap_valid_list [wp]:\n \"\\valid_list\\\n cap_swap c a c' b\n \\\\_. valid_list\\\"\n apply (simp only: cap_swap_def cap_swap_ext_extended.dxo_eq)\n apply (simp only: cap_swap_ext_def update_cdt_list_def set_cdt_list_def set_cdt_def bind_assoc)\n apply wp\n apply (simp del: fun_upd_apply split del: if_split cong: option.case_cong)\n apply (wp set_cap_caps_of_state3)+\n apply (case_tac \"a = b\")\n apply (simp split: option.splits)\n apply(subgoal_tac \"mdb_swap_abs_simple (cdt s) (cdt_list s)\")\n prefer 2\n apply(rule mdb_swap_abs_simple.intro)\n apply simp\n apply(frule mdb_swap_abs_simple.valid_list_post[where src=a and dest=b])\n apply(simp add: fun_upd_def split del: if_split cong: option.case_cong)\n done\n\n\nlemma exst_set_cap:\n \"(x,s') \\ fst (set_cap p c s) \\ exst s' = exst s\"\n by (erule use_valid[OF _ set_cap_exst],simp)\n\ncrunch all_but_exst[wp]: create_cap_ext \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: create_cap_ext\n\ninterpretation create_cap_extended: is_extended \"create_cap_ext a b c\"\n by (unfold_locales; wp)\n\nlemma create_cap_valid_list[wp]:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_list \\\n create_cap tp sz p dev x \\\\rv. valid_list\\\"\n apply (case_tac x)\n apply (simp add: create_cap_def)\n apply(simp add: set_cdt_def update_cdt_list_def set_cdt_list_def create_cap_ext_def bind_assoc)\n apply (rule hoare_pre)\n apply (simp add: valid_list_2_def)\n apply (wp | simp cong: option.case_cong if_cong del: fun_upd_apply split del: if_split)+\n apply(wp set_cap_caps_of_state3 get_cap_wp)+\n apply(simp del: fun_upd_apply split: option.splits split del: if_split cong:if_weak_cong)\n apply (intro impI conjI allI)\n apply (simp add: valid_list_2_def | intro impI conjI allI | fastforce simp: list_remove_removed list_remove_distinct)+\n done\n\n\ncrunch valid_list[wp]: set_extra_badge valid_list\n\nlemmas transfer_caps_loop_ext_valid[wp] =\n transfer_caps_loop_pres[OF cap_insert_valid_list set_extra_badge_valid_list]\n\ncrunch valid_list[wp]: tcb_sched_action,reschedule_required,set_thread_state_ext \"valid_list\"\n (simp: unless_def)\n\ncrunch all_but_exst[wp]: set_thread_state_ext \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: set_thread_state_ext\n\ninterpretation set_thread_state_ext_extended: is_extended \"set_thread_state_ext a\"\n by (unfold_locales; wp)\n\ncrunch all_but_exst[wp]: reschedule_required \"all_but_exst P\"\n\ninterpretation reschedule_required_ext_extended: is_extended \"reschedule_required\"\n by (unfold_locales; wp)\n\ncrunch valid_list[wp]: fast_finalise valid_list (wp: crunch_wps)\n\nlemma cap_delete_one_valid_list[wp]: \"\\valid_list\\ cap_delete_one a \\\\_.valid_list\\\"\n unfolding cap_delete_one_def by (wpsimp simp: unless_def)\n\ncrunch valid_list[wp]: thread_set valid_list\n\nlemma reply_cancel_ipc_valid_list[wp]: \"\\valid_list\\ reply_cancel_ipc a \\\\_. valid_list\\\"\n unfolding reply_cancel_ipc_def\n by (wp select_wp hoare_drop_imps thread_set_mdb | simp)+\n\ncrunch all_but_exst[wp]: update_work_units \"all_but_exst P\"\n\ncrunch all_but_exst[wp]: reset_work_units \"all_but_exst P\"\n\nglobal_interpretation update_work_units_ext_extended: is_extended \"update_work_units\"\n by (unfold_locales; wp)\n \nglobal_interpretation reset_work_units_ext_extended: is_extended \"reset_work_units\"\n by (unfold_locales; wp)\n\nlemma preemption_point_inv':\n \"\\irq_state_independent_A P; \\f s. P (work_units_completed_update f s) = P s\\ \\ \\P\\ preemption_point \\\\_. P\\\"\n apply (intro impI conjI | simp add: preemption_point_def o_def\n | wp hoare_post_imp[OF _ getActiveIRQ_wp] OR_choiceE_weak_wp alternative_wp[where P=P]\n | wpc | simp add: update_work_units_def reset_work_units_def)+\n done\n\n\nlocale Deterministic_AI_1 =\n assumes cap_swap_for_delete_valid_list[wp]:\n \"\\param_a param_b. \\valid_list\\ cap_swap_for_delete param_a param_b \\\\_. valid_list\\\"\n assumes finalise_cap_valid_list:\n \"\\param_a param_b. \\valid_list\\ finalise_cap param_a param_b \\\\_. valid_list\\\"\n assumes get_cap_valid_list[wp]:\n \"\\param_a. \\valid_list\\ get_cap param_a \\\\_. valid_list\\\"\n assumes arch_tcb_set_ipc_buffer_valid_list[wp]:\n \"\\t ptr. \\valid_list\\ arch_tcb_set_ipc_buffer t ptr \\\\_. valid_list\\\"\n\n\ncontext Deterministic_AI_1 begin\n\nlemmas rec_del_valid_list[wp] = rec_del_preservation\n [OF cap_swap_for_delete_valid_list\n set_cap_valid_list\n empty_slot_valid_list\n finalise_cap_valid_list]\n\ncrunch valid_list[wp]: cap_delete valid_list\n (wp: preemption_point_inv')\n\nend\n\nlemma irq_state_independent_A_valid_list[simp]: \"irq_state_independent_A valid_list\"\n by (simp add: irq_state_independent_A_def)\n\ncontext Deterministic_AI_1 begin\n\nlemma cap_revoke_valid_list[wp]:\"\\valid_list\\ cap_revoke a \\\\_. valid_list\\\"\n apply (rule cap_revoke_preservation2)\n apply (wp preemption_point_inv'|simp)+\n done\n\ncrunch valid_list[wp]: ethread_set \"valid_list\"\n\nend\n\ncrunch all_but_exst[wp]: ethread_set \"all_but_exst P\"\n\ncrunch (empty_fail) empty_fail[wp]: ethread_set\n\nglobal_interpretation ethread_set_extended: is_extended \"ethread_set a b\"\n by (unfold_locales; wp)\n\ncrunch valid_list[wp]: cancel_badged_sends valid_list\n (wp: crunch_wps preemption_point_inv' simp: crunch_simps filterM_mapM unless_def\n ignore: without_preemption filterM )\n\ncontext Deterministic_AI_1 begin\n\nlemma invoke_cnode_valid_list[wp]: \n \"\\valid_list\\ invoke_cnode ci \\\\_.valid_list\\\"\n apply (rule hoare_pre)\n apply (wp crunch_wps cap_move_src_slot_Null hoare_drop_imps hoare_vcg_all_lift | wpc | simp add: invoke_cnode_def crunch_simps split del: if_split)+\n done\n\nend\n\ncrunch valid_list[wp]: switch_if_required_to,set_priority,set_mcpriority \"valid_list\"\n (wp: crunch_wps)\n\ncrunch all_but_exst[wp]: switch_if_required_to \"all_but_exst P\" (simp: ethread_get_def)\n\nlemma empty_fail_possible_switch_to[wp]: \"empty_fail (possible_switch_to a b)\"\n apply (simp add: possible_switch_to_def)\n apply (wp | clarsimp split: scheduler_action.splits)+\n done\n\ncrunch (empty_fail)empty_fail[wp]: switch_if_required_to\n\nglobal_interpretation possible_switch_to_extended: is_extended \"possible_switch_to a b\"\n by (unfold_locales; wp)\n\nglobal_interpretation switch_if_required_to_extended: is_extended \"switch_if_required_to a\"\n by (unfold_locales; wp)\n\ncrunch all_but_exst[wp]: set_priority \"all_but_exst P\" (simp: ethread_get_def)\n\ncrunch (empty_fail)empty_fail[wp]: set_priority,set_mcpriority\n\nglobal_interpretation set_priority_extended: is_extended \"set_priority a b\"\n by (unfold_locales; wp)\n\ncrunch all_but_exst[wp]: set_domain \"all_but_exst P\" (simp: ethread_get_def)\n\nglobal_interpretation set_domain_extended: is_extended \"set_domain a b\"\n by (unfold_locales; wp)\n\nglobal_interpretation thread_set_domain_extended: is_extended \"thread_set_domain a b\"\n by (unfold_locales; wp)\n\ncrunch all_but_exst[wp]: dec_domain_time \"all_but_exst P\" (simp: ethread_get_def)\n\ncrunch (empty_fail) empty_fail[wp]: dec_domain_time\n\nglobal_interpretation dec_domain_time_extended: is_extended \"dec_domain_time\"\n by (unfold_locales; wp)\n\ncontext Deterministic_AI_1 begin\ncrunch valid_list[wp]: invoke_tcb valid_list\n (wp: mapM_x_wp' ignore: check_cap_at simp: check_cap_at_def)\nend\n\nlemma delete_objects_valid_list[wp]: \"\\valid_list\\ delete_objects ptr bits \\\\_.valid_list\\\"\n unfolding delete_objects_def\n apply (wp | simp add: detype_def detype_ext_def wrap_ext_det_ext_ext_def)+\n done\n\nlemmas mapM_x_def_bak = mapM_x_def[symmetric]\n\nlemma retype_region_ext_valid_list_ext[wp]: \"\\valid_list\\ retype_region_ext a b \\\\_.valid_list\\\"\n by (wpsimp simp: retype_region_ext_def)\n\ncrunch all_but_exst[wp]: retype_region_ext \"all_but_exst P\" (simp: ethread_get_def)\n\ncrunch (empty_fail)empty_fail[wp]: retype_region_ext\n\nglobal_interpretation retype_region_ext_extended: is_extended \"retype_region_ext a b\"\n by (unfold_locales; wp)\n\ncrunch valid_list[wp]: invoke_irq_handler valid_list\n\ncrunch valid_list[wp]: attempt_switch_to \"valid_list\"\n\nglobal_interpretation attempt_switch_to_extended: is_extended \"attempt_switch_to a\"\n apply (simp add: attempt_switch_to_def)\n apply (unfold_locales)\n done\n\ncrunch valid_list[wp]: thread_set_time_slice,timer_tick \"valid_list\" (simp: Let_def)\n\ncrunch all_but_exst[wp]: timer_tick \"all_but_exst P\" (simp: ethread_get_def crunch_simps)\n\ncrunch (empty_fail)empty_fail[wp]: timer_tick\n (simp: thread_state.splits)\n\nglobal_interpretation timer_tick_extended: is_extended \"timer_tick\"\n by (unfold_locales; wp)\n\nlocale Deterministic_AI_2 = Deterministic_AI_1 +\n assumes handle_interrupt_valid_list[wp]:\n \"\\irq. \\valid_list\\ handle_interrupt irq \\\\_.valid_list\\\"\n assumes handle_call_valid_list[wp]:\n \"\\valid_list\\ handle_call \\\\_. valid_list\\\"\n assumes handle_fault_valid_list[wp]:\n \"\\param_a param_b. \\valid_list\\ handle_fault param_a param_b \\\\_. valid_list\\\"\n assumes handle_recv_valid_list[wp]:\n \"\\param_a. \\valid_list\\ handle_recv param_a \\\\_. valid_list\\\"\n assumes handle_reply_valid_list[wp]:\n \"\\valid_list\\ handle_reply \\\\_. valid_list\\\"\n assumes handle_send_valid_list[wp]:\n \"\\param_a. \\valid_list\\ handle_send param_a \\\\_. valid_list\\\"\n assumes handle_vm_fault_valid_list[wp]:\n \"\\thread fault. \\valid_list\\ handle_vm_fault thread fault \\\\_. valid_list\\\"\n assumes handle_yield_valid_list[wp]:\n \"\\valid_list\\ handle_yield \\\\_. valid_list\\\"\n assumes handle_hypervisor_fault_valid_list[wp]:\n \"\\valid_list\\ handle_hypervisor_fault thread fault \\\\_. valid_list\\\"\n\n\ncontext Deterministic_AI_2 begin\n\nlemma handle_event_valid_list[wp]:\n \"\\valid_list\\ handle_event e \\\\_.valid_list\\\"\n by (case_tac e; wpsimp wp: hoare_drop_imps)\n\nend\n\n\n(* Recovering cdt_list operations that only consider sane cases.\n This is to recover the current refinement proofs.*)\n\nlemma (in mdb_move_abs') dest_empty_list:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 t m \\ t dest = []\"\n apply (insert dest_desc)\n apply (subgoal_tac \"set (t dest) = {}\")\n apply simp\n apply (simp add: valid_list_2_def)\n done\n\nlemma update_cdt_list_bind: \"do y \\ (update_cdt_list f); update_cdt_list f' od =\n update_cdt_list (\\s. f' (f s))\"\n apply (simp add: bind_def update_cdt_list_def gets_def\n return_def get_def set_cdt_list_def\n put_def)\n done\n\nlemma update_list_eq: \"(f (cdt_list e)) = (f' (cdt_list e)) \\\n update_cdt_list f e = update_cdt_list f' e\"\n apply (simp add: update_cdt_list_def gets_def\n get_def set_cdt_list_def put_def\n bind_def return_def)\n done\n\nlemma (in mdb_move_abs') cap_move_ext_det_def2:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 (cdt_list e) m \\ src_p = (m src) \\ dest_p = (m dest) \\\n cap_move_ext src dest src_p dest_p e =\n (update_cdt_list (\\list. case (m src) of\n None \\ list (src := [], dest := list src) |\n Some p \\ list (p := list_replace (list p) src dest,\n src := [], dest := list src))) e\"\n apply (simp add: cap_move_ext_def update_cdt_list_bind)\n apply (rule update_list_eq)\n apply (insert dest_None neq)\n apply (case_tac \"m src\")\n apply (simp add: dest_empty_list)\n apply simp\n apply (insert no_mloop)\n apply (frule no_mloop_weaken[where a=src])\n apply simp\n apply (insert dest_desc)\n apply (intro impI conjI)\n apply (simp add: no_children_empty_desc[symmetric])\n apply (simp add: dest_empty_list)\n done\n\nlemma (in mdb_insert_abs) cap_insert_ext_det_def2:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 (cdt_list e) m \\ no_mloop m \\ src_p = (m src) \\ dest_p = (m dest) \\\n cap_insert_ext src_parent src dest src_p dest_p e = (\\ src_parent src_slot dest_slot src_p dest_p.\n update_cdt_list (\\list. case (m src_slot) of\n None \\ list (\n src_slot := if src_parent then [dest_slot] @ (list src_slot) else list src_slot) |\n Some p \\ list (\n src_slot := if src_parent then [dest_slot] @ (list src_slot) else list src_slot,\n p := if src_parent then list p else list_insert_after (list p) src_slot dest_slot))) src_parent src dest src_p dest_p e\"\n apply (simp add: cap_insert_ext_def update_cdt_list_bind)\n apply (rule update_list_eq)\n apply (simp split del: if_split cong: option.case_cong)\n apply (insert dest neq)\n apply (case_tac \"m src\")\n apply simp+\n apply (frule no_mloop_weaken[where a=src])\n apply simp\n done\n\n\nlemma (in mdb_empty_abs') empty_slot_ext_det_def2:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 (cdt_list e) m \\ slot_p = (m slot) \\\n empty_slot_ext slot slot_p e = (\n update_cdt_list (\\list. case (m slot) of None \\ list (slot := []) |\n Some p \\ list (p := list_replace_list (list p) slot (list slot), slot := []))) e\"\n apply (simp add: empty_slot_ext_def update_cdt_list_bind)\n apply (rule update_list_eq)\n apply (simp cong: option.case_cong)\n apply (case_tac \"m slot\")\n apply simp\n apply (cut_tac no_mloop_weaken[OF no_mloop, where a=slot])\n apply simp\n done\n\n\nlemma (in mdb_insert_abs) create_cap_ext_det_def2:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"valid_list_2 (cdt_list e) m \\ dest_p = (m dest) \\\n create_cap_ext untyped dest dest_p e = (\n update_cdt_list (\\list. list (untyped := [dest] @ list untyped))) e\"\n apply (simp add: create_cap_ext_def update_cdt_list_bind)\n apply (rule update_list_eq)\n apply (insert dest neq)\n apply (case_tac \"m src\")\n apply simp+\n done\n\n(* next_sib_2 will give the same result as next_sib, which can\n be used to define the cdt_list of a node. next_sib_2 is introduced\n as it is comparable to functions (mdb_next) in the Haskell spec\n for use in the projection. next_sib_2 traverses the tree until\n it finds a sibling, rather than directly using the cdt_list. *)\n\nfunction (domintros) next_sib_2 where\n \"next_sib_2 slot p s =\n (if slot \\ descendants_of p (cdt s) then\n case next_slot slot (cdt_list s) (cdt s) of Some next \\\n if cdt s next = Some p then\n Some next\n else next_sib_2 next p s\n | None \\ None\n else None)\"\n by (auto | atomize)+\n\nlemma next_sib_2_domintros:\n \"(\\x. \\slot \\ descendants_of p (cdt s);\n next_slot slot (cdt_list s) (cdt s) = Some x; cdt s x \\ Some p\\\n \\ next_sib_2_dom (x, p, s))\n \\ next_sib_2_dom (slot, p, s)\"\n apply(rule accpI)\n apply(erule next_sib_2_rel.cases)\n apply(simp)\n done\n\ndefinition next_slot_set :: \"cslot_ptr \\ cdt_list \\ cdt \\ cslot_ptr set\" where\n \"next_slot_set slot t m \\ {next. (next, slot) \\ {(next, p). next_slot p t m = Some next}\\<^sup>+}\"\n\ndefinition next_sib_set :: \"cslot_ptr \\ cdt_list \\ cdt \\ cslot_ptr set\" where\n \"next_sib_set slot t m \\ {next. (next, slot) \\ {(next, p). next_sib p t m = Some next}\\<^sup>+}\"\n\nlemma next_sib_set_same_parent:\n \"\\next \\ next_sib_set slot t m; valid_list_2 t m\\\n \\ \\p. m slot = Some p \\ m next = Some p\"\n apply (simp add: next_sib_set_def)\n by (induct \"next\" slot rule: trancl.induct; fastforce dest: next_sib_same_parent)\n\nlemma next_slot_setD:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next \\ next_slot_set slot t m; valid_list_2 t m; no_mloop m; finite_depth m\\\n \\ next \\ descendants_of slot m \\ next \\ next_sib_set slot t m \\\n (\\p q. (slot \\ descendants_of p m \\ p = slot) \\ q \\ next_sib_set p t m \\ next \\ descendants_of q m \\ {q})\"\n apply(subst(asm) next_slot_set_def)\n apply(simp)\n apply(induct_tac \"next\" slot rule: trancl.induct)\n apply(assumption)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(simp add: next_child_def valid_list_2_def descendants_of_def cdt_parent_defs)\n apply(case_tac \"t b\", simp, fastforce)\n apply(drule(2) next_not_childD)\n apply(erule disjE)\n apply(fastforce simp: next_sib_set_def)\n apply(fastforce simp: next_sib_set_def)\n apply(simp)\n apply(erule disjE)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(rule disjI1)\n apply(rule_tac b=b in descendants_trans)\n apply(simp)\n apply(fastforce dest: next_childD simp: descendants_of_def cdt_parent_defs)\n apply(drule(2) next_not_childD)\n apply(fastforce simp: next_sib_set_def)\n apply(erule disjE)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(rule disjI1)\n apply(fastforce intro: child_descendant dest: next_childD next_sib_set_same_parent)\n apply(drule(2) next_not_childD)\n apply(erule disjE, rule disjI2, rule disjI1)\n apply(fastforce simp: next_sib_set_def intro: trancl_into_trancl)\n apply(intro disjI2, elim exE conjE)\n apply(rule_tac x=q in exI)\n apply(fastforce simp: next_sib_set_def intro: trancl_into_trancl)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(erule disjE)\n apply(rule disjI2)+\n apply(rule_tac x=p in exI)\n apply(rule conjI)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule(1) next_childD)\n apply(drule_tac x=p in tranclD2)\n apply(elim exE conjE, simp)\n apply(fastforce dest: rtranclD)\n apply(fastforce)\n apply(rule disjI1)\n apply(frule(1) next_sib_set_same_parent)\n apply(drule(1) next_childD)\n apply(fastforce simp: descendants_of_def cdt_parent_defs intro: trancl_into_trancl2)\n apply(drule(2) next_not_childD)\n apply(rule disjI2)+\n apply(case_tac \"next_sib c t m = Some b\")\n apply(erule disjE)\n apply(simp)\n apply(rule_tac x=p in exI)\n apply(fastforce dest: next_sib_share_parent)\n apply(rule_tac x=c in exI)\n apply(simp)\n apply(rule_tac x=q in exI)\n apply(fastforce simp: next_sib_set_def intro: trancl_into_trancl)\n apply(simp | elim conjE exE)+\n apply(erule disjE)\n apply(rule_tac x=p in exI)\n apply(rule conjI)\n apply(rule disjI1)\n apply(drule_tac c=p in next_sib_share_parent, simp)\n apply(rule_tac b=qa in descendants_trans, simp, simp)\n apply(fastforce)\n apply(fastforce simp: next_sib_set_def intro: trancl_into_trancl)\n done\n\nlemma list_eq_after_in_list:\n \"\\valid_list_2 t m; m x = Some p\\\n \\ \\list. t p = list @ x # after_in_list_list (t p) x\"\n apply(simp only:valid_list_2_def)\n apply (erule conjE)\n apply (drule_tac x = p in spec)+\n apply (subgoal_tac \"x \\ set (t p)\")\n apply (drule_tac in_set_conv_nth[THEN iffD1], erule exE)\n apply (auto simp: in_set_conv_nth list_eq_after_in_list')\n done\n\nlemma next_sib_set_eq_after_in_list_set_Some:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; m x = Some p\\\n \\ next_sib_set x t m = {a. (a, x) \\ {(next, c). after_in_list (t p) c = Some next}\\<^sup>+}\"\n apply(intro equalityI subsetI)\n apply(simp add: next_sib_set_def)\n apply(drule trancl_Collect_rev)\n apply(rule trancl_Collect_rev)\n apply(erule trancl_induct)\n apply(fastforce simp: next_sib_def split: option.splits)\n apply(rule trancl_into_trancl)\n apply(simp)\n apply(subgoal_tac \"y \\ next_sib_set x t m\") (* bad *)\n prefer 2\n apply(fastforce simp: next_sib_set_def intro: trancl_Collect_rev)\n apply(fastforce simp: next_sib_def split: option.splits dest: next_sib_set_same_parent)\n apply(simp)\n apply(drule trancl_Collect_rev)\n apply(erule trancl_induct)\n apply(fastforce simp: next_sib_set_def next_sib_def split: option.splits)\n apply(simp add: next_sib_set_def)\n apply(subgoal_tac \"y \\ next_sib_set x t m\")\n prefer 2\n apply(fastforce simp: next_sib_set_def intro: trancl_Collect_rev)\n apply(drule(1) next_sib_set_same_parent)\n apply(rule trancl_into_trancl2)\n apply(fastforce simp: next_sib_def split: option.splits)\n apply(simp)\n done\n\nlemma next_sib_set_eq_after_in_list_set:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"valid_list_2 t m \\ next_sib_set x t m = (case m x of None \\ {}\n | Some q \\ {a. (a, x) \\ {(next, p). after_in_list (t q) p = Some next}\\<^sup>+})\"\n apply(simp add: next_sib_set_eq_after_in_list_set_Some split: option.splits)\n apply(fastforce simp: next_sib_set_def next_sib_def split: option.splits dest: tranclD2)\n done\n\n\nlemma valid_list_distinct:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; m x = Some p\\ \\ distinct (t p)\"\nby (simp add:valid_list_2_def)\n\nlemma next_sib_set_not_self:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"valid_list_2 t m \\ x \\ next_sib_set x t m\"\n apply(simp add: next_sib_set_eq_after_in_list_set valid_list_distinct after_in_list_list_set[symmetric] split: option.splits)\n apply(intro allI impI)\n apply(frule_tac p=\"the (m x)\" in list_eq_after_in_list)\n apply(simp)\n apply(clarsimp simp add: valid_list_2_def)\n apply(erule_tac x=\"the (m x)\" in allE)+\n apply(drule_tac x=\"t x\" and f=distinct for x in arg_cong)\n apply(simp)\ndone\n\nlemma next_slot_set_after_in_list:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next \\ next_slot_set slot t m; m slot = Some p; m next = Some p; valid_list_2 t m; no_mloop m; finite_depth m\\\n \\ next \\ next_sib_set slot t m\"\n apply(drule(3) next_slot_setD)\n apply(elim disjE)\n apply(simp add: descendants_of_def cdt_parent_defs no_mloop_def)\n apply(drule tranclD2)\n apply(fastforce dest: trancl_into_trancl rtranclD)\n apply(simp)\n apply(elim exE conjE)\n apply(frule(1) next_sib_set_same_parent)\n apply(simp)\n apply(elim conjE exE disjE)\n apply(fastforce dest: sib_not_desc)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule tranclD2)+\n apply(elim exE conjE)\n apply(drule rtranclD)+\n apply(elim disjE)\n apply(simp add: next_sib_set_not_self)\n apply(simp)\n apply(drule_tac x=za and y=q in sib_not_desc)\n apply(assumption)+\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(simp)\n apply(drule_tac x=za and y=pa in sib_not_desc)\n apply(assumption)+\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(simp)\n apply(subgoal_tac \"za \\ descendants_of pa m \\ za \\ descendants_of q m\")\n prefer 2\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(erule conjE, drule(1) descendants_linear)\n apply(fastforce simp: next_sib_set_not_self)\n apply(simp add: sib_not_desc)\n apply(simp)\n apply(simp add: sib_not_desc)\n done\n\nlemma next_slot_no_loop:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; no_mloop m; finite_depth m\\\n \\ x \\ next_slot_set x t m\"\n apply(rule notI)\n apply(case_tac \"m x\")\n apply(drule(2) next_slot_setD, simp)\n apply(simp add: next_sib_set_not_self)\n apply(erule disjE)\n apply(simp add: no_mloop_def descendants_of_def)\n apply(elim exE conjE)\n apply(erule disjE)\n apply(fastforce simp: descendants_of_def cdt_parent_defs dest: tranclD2)\n apply(fastforce simp: next_sib_set_def next_sib_def split: option.splits dest: tranclD2)\n apply(drule next_slot_set_after_in_list)\n apply(assumption)+\n apply(simp add: next_sib_set_not_self)\n done\n\nlemma wf_next_slot:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\valid_mdb s; valid_list s\\\n \\ wf {(next, p). next_slot p (cdt_list s) (cdt s) = Some next}\"\n apply(rule finite_acyclic_wf)\n apply(insert cte_wp_at_set_finite)[1]\n apply(rule_tac B=\"{p. cte_wp_at \\ p s} \\ {p. cte_wp_at \\ p s}\" in finite_subset)\n apply(fastforce dest: cte_at_next_slot cte_at_next_slot' simp: finite_depth)\n apply(fastforce intro: finite_cartesian_product)\n apply(rule acyclicI)\n apply(frule finite_depth)\n apply(rule allI)\n apply(drule next_slot_no_loop, simp add: valid_mdb_def, simp add: finite_depth)\n apply(fastforce simp: next_slot_set_def)\n done\n\nlemma next_slot_induct:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows\n \"\\\\x. next_slot x (cdt_list s) (cdt s) = None \\ P x; \\x y. \\next_slot x (cdt_list s) (cdt s) = Some y; P y\\ \\ P x;\n valid_mdb s; valid_list s\\\n \\ P slot\"\n apply(induct_tac rule: wf_induct[where r=\"{(next, p). next_slot p (cdt_list s) (cdt s) = Some next}\"])\n apply(simp add: wf_next_slot)\n apply(fastforce split: if_split_asm)\n done\n\nlemma next_sib_2_termination:\n \"\\valid_mdb s; valid_list s\\ \\ next_sib_2_dom (slot, p, s)\"\n apply(induct_tac slot rule: next_slot_induct[where s=s])\n apply(fastforce intro: next_sib_2_domintros)+\n done\n\nlemma next_sib_2_pinduct':\n \"\\next_sib_2_dom (slot, p, s);\n \\slot.\n \\next_sib_2_dom (slot, p, s);\n \\a. \\slot \\ descendants_of p (cdt s);\n next_slot slot (cdt_list s) (cdt s) = Some a; cdt s a \\ Some p\\ \\ P a t m\\\n \\ P slot t m\\\n \\ P slot t m\"\n apply(induct rule: next_sib_2.pinduct)\n apply(simp)\n done\n\nlemma next_sib_2_pinduct:\n \"\\\\slot. \\\\a. \\slot \\ descendants_of p (cdt s);\n next_slot slot (cdt_list s) (cdt s) = Some a; cdt s a \\ Some p\\ \\ P a\\\n \\ P slot; valid_mdb s; valid_list s\\\n \\ P slot\"\n apply(rule_tac t=t and m=m in next_sib_2_pinduct')\n apply(rule next_sib_2_termination)\n apply(assumption)+\n apply(fastforce)\n done\n\nlemma next_slot_set_in_desc:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next \\ next_slot_set slot (cdt_list s) (cdt s); cdt s next = Some p;\n slot \\ descendants_of p (cdt s); next_slot slot (cdt_list s) (cdt s) = Some a;\n valid_list s; valid_mdb s\\\n \\ a \\ descendants_of p (cdt s)\"\n apply(frule finite_depth)\n apply(subgoal_tac \"no_mloop (cdt s)\")\n prefer 2\n apply(simp add: valid_mdb_def)\n apply(frule(1) next_slot_setD)\n apply(simp add: valid_mdb_def, simp+)\n apply(elim disjE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=slot in tranclD2)\n apply(simp)\n apply(drule(1) rtrancl_trancl_trancl)\n apply(simp add: no_mloop_def cdt_parent_defs)\n apply(frule(1) next_sib_set_same_parent)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(drule(1) next_childD)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule_tac b=slot in r_r_into_trancl)\n apply(simp)\n apply(simp)\n apply(simp add: next_not_child_termination)\n apply(simp split: if_split_asm option.splits)\n apply(fastforce dest: tranclD2 simp: next_sib_set_def)+\n apply(drule(1) next_sib_same_parent, simp add: child_descendant)\n apply(elim exE conjE)\n apply(subgoal_tac \"q = next\")\n prefer 2\n apply(subgoal_tac \"pa \\ descendants_of p (cdt s)\")\n prefer 2\n apply(erule disjE)\n apply(frule_tac b=p and c=pa in descendants_linear, simp)\n apply(frule(1) next_sib_set_same_parent)\n apply(elim exE conjE)\n apply(rule notI, simp)\n apply(erule disjE)\n apply(simp add: no_mloop_weaken)\n apply(frule_tac a=\"next\" and c=pa in descendants_linear)\n apply(simp add: child_descendant)\n apply(fastforce simp: next_sib_set_not_self)\n apply(simp add: sib_not_desc)\n apply(frule(1) next_sib_set_same_parent)\n apply(erule disjE)+\n apply(simp add: child_descendant)\n apply(simp)\n apply(erule disjE)\n apply(frule_tac a=p and c=q in descendants_linear)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=q in tranclD2)\n apply(simp)\n apply(drule rtranclD)\n apply(elim disjE exE conjE)\n apply(fastforce dest: sib_not_desc[simplified descendants_of_def cdt_parent_defs])\n apply(simp)\n apply(fastforce simp: next_sib_set_not_self)\n apply(fastforce dest: sib_not_desc)\n apply(simp)\n apply(simp)\n apply(erule_tac P=\"next = q\" in disjE, simp)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(drule_tac x=q in tranclD2)\n apply(simp)\n apply(drule_tac x=q and z=pa in rtrancl_trancl_trancl, simp)\n apply(fastforce dest: sib_not_desc[simplified descendants_of_def cdt_parent_defs]\n next_sib_set_same_parent)\n apply(simp)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(drule(1) next_childD)\n apply(rule descendants_trans)\n apply(rule child_descendant)\n apply(simp)\n apply(simp)\n apply(drule(2) next_not_childD)\n apply(erule_tac P=\"next_sib slot (cdt_list s) (cdt s) = Some a\" in disjE)\n apply(simp add: next_sib_share_parent)\n apply(elim exE conjE)\n apply(case_tac \"qa=pa\")\n apply(fastforce intro: child_descendant dest: next_sib_same_parent next_sib_set_same_parent)\n apply(erule disjE)\n apply(frule_tac a=slot and b=pa and c=qa in descendants_linear)\n apply(simp)+\n apply(erule disjE)\n apply(fastforce simp: next_sib_set_def dest: tranclD2)\n apply(drule_tac a=qa and c=p in descendants_trans)\n apply(fastforce dest: next_sib_set_same_parent simp: child_descendant)\n apply(fastforce dest: next_sib_share_parent)\n apply(simp)\n apply(fastforce simp: next_sib_set_def dest: tranclD2)\n done\n\ndeclare next_sib_2.psimps[simp]\n\nlemma next_sib_2_NoneD:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"next_sib_2 slot p s = None\" \"slot \\ descendants_of p (cdt s)\" \"valid_mdb s\"\n \"valid_list s\" \"q \\ next_slot_set slot (cdt_list s) (cdt s)\"\n shows \"cdt s q \\ Some p\"\n apply(insert assms)\n apply(rule notI)\n apply(case_tac \"next_slot slot (cdt_list s) (cdt s)\")\n apply(fastforce simp: next_slot_set_def dest: tranclD2)\n apply(frule(5) next_slot_set_in_desc)\n apply(erule notE[rotated])\n apply(simp)\n apply(induct slot rule: next_sib_2_pinduct[where s=s and p=p])\n apply(simp)\n apply(atomize)\n apply(simp)\n apply(elim impCE)\n apply(fastforce simp: next_sib_2_termination)\n apply(simp add: next_slot_set_def)\n apply(drule tranclD2, simp)\n apply(drule rtranclD)\n apply(fastforce simp: next_sib_2_termination)\n apply(case_tac \"next_slot a (cdt_list s) (cdt s)\")\n apply(simp add: next_slot_set_def)\n apply(drule tranclD2, simp)\n apply(drule rtranclD)\n apply(erule disjE)\n apply(fastforce simp: next_sib_2_termination)\n apply(fastforce dest: tranclD2)\n apply(case_tac \"q=a\")\n apply(fastforce simp: next_sib_2_termination)\n apply(subgoal_tac \"q \\ next_slot_set a (cdt_list s) (cdt s)\")\n prefer 2\n apply(simp add: next_slot_set_def)\n apply(drule tranclD2, simp)\n apply(drule rtranclD)\n apply(fastforce simp: next_sib_2_termination)\n apply(frule_tac slot=a in next_slot_set_in_desc) (* rename *)\n apply(simp_all)\n apply(simp)\n apply(erule exE)\n apply(case_tac \"cdt s a = Some p\")\n apply(fastforce simp: next_sib_2_termination)\n apply(rule_tac x=y in exI)\n apply(fastforce simp: next_sib_2_termination)\n apply(simp_all add: assms)\n done\n\ndefinition last_child where\n \"last_child slot t = (if t slot = [] then None else Some (last (t slot)))\"\n\ndefinition last_child_set where\n \"last_child_set slot t = {p. (p, slot) \\ {(next, c). last_child c t = Some next}\\<^sup>+}\"\n\nfunction (domintros) last_last_child where\n \"last_last_child slot t = (case last_child slot t of None \\ None\n | Some child \\ (if last_child child t = None then Some child\n else last_last_child child t))\"\n by auto\n\n\nlemma last_childD:\n notes split_paired_All[simp del]\n shows \"\\last_child slot t = Some child; valid_list_2 t m\\\n \\ m child = Some slot \\ next_sib child t m = None\"\n apply(rule context_conjI)\n apply(fastforce simp: valid_list_2_def last_child_def split: if_split_asm)\n apply(rule next_sib_NoneI[where p=slot])\n apply(case_tac \"t slot\")\n apply(simp)\n apply(simp add: valid_list_2_def last_child_def split: if_split_asm)\n apply(erule_tac x=slot in allE)+\n apply(drule after_in_list_last_None)\n apply(simp)\n done\n\n\nlemma last_child_set_in_desc:\n \"\\valid_list_2 t m; c \\ last_child_set p t\\ \\ c \\ descendants_of p m\"\n apply(simp add: last_child_set_def)\n apply(erule trancl_induct)\n apply(fastforce simp: child_descendant dest: last_childD)\n apply(simp)\n apply(drule(1) last_childD)\n apply(erule conjE)\n apply(drule child_descendant)\n apply(rule descendants_trans)\n apply(simp)+\n done\n\nlemma last_child_no_loop:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list_2 t m; no_mloop m\\\n \\ x \\ last_child_set x t\"\n apply(rule notI)\n apply(drule(1) last_child_set_in_desc)\n apply(simp add: no_mloop_descendants)\n done\n\n\nlemma wf_last_child:\n \"\\valid_mdb s; valid_list s\\ \\ wf {(next, p). last_child p (cdt_list s) = Some next}\"\n apply(rule finite_acyclic_wf)\n apply(insert cte_wp_at_set_finite)[1]\n apply(rule_tac B=\"{p. cte_wp_at \\ p s} \\ {p. cte_wp_at \\ p s}\" in finite_subset)\n apply(fastforce dest: last_childD child_descendant descendants_of_cte_at\n descendants_of_cte_at2)\n apply(fastforce intro: finite_cartesian_product)\n apply(rule acyclicI)\n apply(rule allI)\n apply(drule_tac x=x in last_child_no_loop, simp add: valid_mdb_def)\n apply(simp add: last_child_set_def)\n done\n\nlemma last_child_induct:\n \"\\\\x. last_child x (cdt_list s) = None \\ P x; \\x y. \\last_child x (cdt_list s) = Some y; P y\\ \\ P x;\n valid_mdb s; valid_list s\\\n \\ P slot\"\n apply(induct_tac rule: wf_induct[where r=\"{(next, p). last_child p (cdt_list s) = Some next}\"])\n apply(simp add: wf_last_child)\n apply(fastforce split: if_split_asm)\n done\n\nlemma last_last_child_termination:\n \"\\valid_mdb s; valid_list s\\ \\ last_last_child_dom (slot, (cdt_list s))\"\n apply(induct_tac slot rule: last_child_induct[where s=s])\n apply(fastforce intro: last_last_child.domintros)+\n done\n\ndeclare last_last_child.psimps[simp]\n\nlemma last_child_NoneD:\n \"\\last_child x t = None; valid_list_2 t m\\ \\ descendants_of x m = {}\"\n by(simp add: last_child_def empty_list_empty_desc split: if_split_asm)\n\nlemma last_last_child_NoneD:\n notes split_paired_Ex[simp del]\n assumes \"last_last_child slot (cdt_list s) = None\" \"valid_list s\" \"valid_mdb s\"\n shows \"descendants_of slot (cdt s) = {}\"\n apply(insert assms)\n apply(simp add: last_last_child_termination)\n apply(simp split: if_split_asm option.splits)\n apply(simp add:last_child_NoneD)\n apply(erule exE)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(fastforce dest: last_child_NoneD)\n apply(simp)\n apply(case_tac \"last_child ya (cdt_list s)\")\n apply(simp add: last_last_child_termination)\n apply(atomize, simp)\n apply(erule impE)\n apply(simp add: last_last_child_termination)\n apply(drule_tac slot=y in last_childD, simp)\n apply(fastforce dest: child_descendant)\n using assms\n apply(simp+)\n done\n\nlemma last_child_None_empty_desc:\n \"\\last_child slot t = None; valid_list_2 t m\\ \\ descendants_of slot m = {}\"\n by (simp add: last_child_def empty_list_empty_desc split: if_split_asm)\n\nlemma last_last_child_empty_desc:\n assumes \"last_last_child slot (cdt_list s) = Some child\" \"valid_mdb s\" \"valid_list s\"\n shows \"descendants_of child (cdt s) = {}\"\n apply(insert assms)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_last_child_termination)\n apply(case_tac \"y=child\")\n apply(simp add: last_last_child_termination last_child_None_empty_desc\n split: if_split_asm)\n apply(simp)\n apply(atomize, erule impE)\n apply(subst(asm) last_last_child.psimps)\n apply(simp add: last_last_child_termination)\n apply(simp split: option.splits if_split_asm)\n apply(simp)\n using assms\n apply(simp+)\n done\n\nlemma last_last_child_next_sib:\n assumes \"last_last_child slot (cdt_list s) = Some child\" \"valid_mdb s\" \"valid_list s\"\n shows \"next_sib child (cdt_list s) (cdt s) = None\"\n apply(insert assms)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_last_child_termination)\n apply(case_tac \"y=child\")\n apply(fastforce dest: last_childD)\n apply(simp)\n apply(atomize, erule impE)\n apply(subst(asm) last_last_child.psimps)\n apply(simp add: last_last_child_termination)\n apply(simp split: option.splits if_split_asm)\n apply(simp)\n using assms\n apply(simp+)\n done\n\nlemma last_last_child_in_desc:\n assumes \"last_last_child slot (cdt_list s) = Some child\" \"valid_mdb s\" \"valid_list s\"\n shows \"child \\ descendants_of slot (cdt s)\"\n apply(insert assms)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_last_child_termination)\n apply(case_tac \"y=child\")\n apply(simp add: last_last_child_termination)\n apply(drule last_childD, simp)\n apply(fastforce dest: child_descendant intro: descendants_trans split: option.splits)\n apply(simp)\n apply(atomize, erule impE)\n apply(subst(asm) last_last_child.psimps)\n apply(simp add: last_last_child_termination)\n apply(simp split: option.splits if_split_asm)\n apply(drule last_childD, simp)\n apply(fastforce dest: child_descendant descendants_trans)\n using assms\n apply(simp+)\n done\n\nlemma last_last_child_next_not_child:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"last_last_child slot (cdt_list s) = Some child\" \"valid_mdb s\" \"valid_list s\"\n shows \"next_not_child child (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)\"\n apply(insert assms)\n apply(frule(2) last_last_child_empty_desc)\n apply(frule(2) last_last_child_next_sib)\n apply(frule(2) last_last_child_in_desc)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_last_child_termination)\n apply(case_tac \"y=child\")\n apply(subst next_not_child.psimps)\n apply(simp add: next_not_child_termination finite_depth)\n apply(drule last_childD, simp,simp)\n apply(simp, atomize)\n apply(elim impE)\n apply(subst(asm) last_last_child.psimps)\n apply(simp add: last_last_child_termination)\n apply(simp split: option.splits if_split_asm)\n apply(subst(asm) last_last_child.psimps)\n apply(simp add: last_last_child_termination)\n apply(simp split: if_split_asm)\n apply(rule last_last_child_in_desc, simp+)\n apply(drule last_childD, simp)\n apply(simp add: next_not_child_termination finite_depth)\n using assms\n apply(simp+)\n done\n\nlemma last_child_NoneI:\n \"\\descendants_of slot m = {}; valid_list_2 t m\\\n \\ last_child slot t = None\"\n by (simp add: last_child_def empty_list_empty_desc)\n\nlemma last_last_childI:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"child \\ last_child_set slot (cdt_list s)\"\n \"descendants_of child (cdt s) = {}\" \"valid_mdb s\" \"valid_list s\"\n shows \"last_last_child slot (cdt_list s) = Some child\"\n apply(insert assms)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(fastforce simp: last_child_set_def dest: tranclD2)\n apply(simp)\n apply(case_tac \"y=child\")\n apply(simp add: last_last_child_termination last_child_NoneI)\n apply(atomize)\n apply(erule impE)\n apply(fastforce simp: last_child_set_def dest: tranclD2 rtranclD)\n apply(simp add: last_last_child_termination split: option.splits)\n using assms\n apply(simp+)\n done\n\nlemma desc_next_slot_desc_or_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"p \\ descendants_of slot (cdt s)\"\"valid_list s\" \"valid_mdb s\"\n shows \"(\\q. next_slot p (cdt_list s) (cdt s) = Some q \\\n q \\ descendants_of slot (cdt s))\n \\ last_last_child slot (cdt_list s) = Some p\n \\ next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)\"\n apply(insert assms)\n apply(case_tac \"last_last_child slot (cdt_list s) = Some p\")\n apply(frule(2) last_last_child_empty_desc)\n apply(frule(2) last_last_child_next_not_child)\n apply(rule disjI2)\n apply(simp add: next_slot_def empty_list_empty_desc split: if_split_asm)\n apply(rule disjI1)\n apply(case_tac \"next_slot p (cdt_list s) (cdt s)\")\n apply(simp)\n apply(erule notE)\n apply(rule last_last_childI)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(drule next_child_NoneD)\n apply(simp add: empty_list_empty_desc )\n apply(simp add: empty_list_empty_desc)\n apply(drule next_not_child_NoneD, simp add: finite_depth)\n apply(erule conjE)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_child_None_empty_desc)\n apply(case_tac \"y=p\")\n apply(fastforce simp: last_child_set_def)\n apply(simp)\n apply(atomize)\n apply(erule impE)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(frule tranclD, simp)\n apply(elim exE conjE)\n apply(drule rtranclD)\n apply(erule_tac P=\"z=p\" in disjE)\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=x in allE)+\n apply(simp add: next_sib_def)\n apply(drule after_in_list_last_None)\n apply(drule after_in_list_None_last, simp)\n apply(simp add: last_child_def split: if_split_asm)\n apply(erule_tac x=z and P=\"\\q. (q, p) \\ {(p, c). cdt s c = Some p}\\<^sup>+ \\\n next_sib q (cdt_list s) (cdt s) = None\" in allE)\n apply(erule impE)\n apply(simp)\n apply(simp add: next_sib_def valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=x in allE)+\n apply(drule after_in_list_last_None)\n apply(drule after_in_list_None_last, simp)\n apply(simp add: last_child_def split: if_split_asm)\n apply(fastforce simp: last_child_set_def intro: trancl_into_trancl)\n using assms\n apply(simp_all add: empty_list_empty_desc)\n apply(simp add: next_slot_def empty_list_empty_desc next_child_def split: if_split_asm list.splits)\n apply(simp add: next_slot_def split: if_split_asm)\n apply(fastforce dest: next_childD child_descendant descendants_trans)\n apply(drule next_not_childD, simp add: finite_depth, simp add: valid_mdb_def)\n apply(erule disjE)\n apply(fastforce dest: next_sib_share_parent)\n apply(rule ccontr)\n apply(elim exE conjE)\n apply(erule notE)\n apply(rule last_last_childI)\n apply(induct slot rule: last_child_induct[where s=s])\n apply(simp add: last_child_None_empty_desc)\n apply(case_tac \"y=p\")\n apply(fastforce simp: last_child_set_def)\n apply(simp)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(erule_tac x=q and P=\"\\q. p \\ descendants_of y (cdt s) \\\n a \\ descendants_of y (cdt s) \\\n next_sib q (cdt_list s) (cdt s) = Some a \\\n p \\ descendants_of q (cdt s) \\\n (\\q'. q' \\ descendants_of q (cdt s) \\ p \\ descendants_of q' (cdt s) \\\n next_sib q' (cdt_list s) (cdt s) = None) \\\n p \\ last_child_set y (cdt_list s)\" in allE)\n apply(simp)\n apply(elim impE)\n apply(subgoal_tac \"x \\ descendants_of q (cdt s) \\ {q}\")\n prefer 2\n apply(rule ccontr)\n apply(erule notE)\n apply(simp)\n apply(drule_tac c=x in next_sib_share_parent, simp)\n apply(drule(1) descendants_linear, simp)\n apply(simp)\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(frule tranclD, simp)\n apply(elim exE conjE)\n apply(drule rtranclD)\n apply(erule_tac P=\"z=p\" in disjE)\n apply(simp add: valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=x in allE)+\n apply(simp add: next_sib_def)\n apply(drule after_in_list_last_None)\n apply(drule after_in_list_None_last, simp)\n apply(simp add: last_child_def split: if_split_asm)\n apply(erule_tac x=z in allE)\n apply(erule impE)\n apply(rule conjI)\n apply(fastforce intro: trancl_into_trancl)\n apply(fastforce dest: rtranclD)\n apply(simp add: next_sib_def valid_list_2_def)\n apply(erule conjE)\n apply(erule_tac x=x in allE)+\n apply(drule after_in_list_last_None)\n apply(drule after_in_list_None_last, simp)\n apply(simp add: last_child_def split: if_split_asm)\n apply(rule notI, erule notE)\n apply(drule(1) last_childD)\n apply(fastforce dest: child_descendant intro: descendants_trans)\n apply(fastforce simp: last_child_set_def intro: trancl_into_trancl)\n using assms\n apply(simp_all add: empty_list_empty_desc)\n done\n\nlemma finite_descendants:\n \"valid_mdb s \\ finite (descendants_of slot (cdt s))\"\n apply(rule_tac B=\"{p. cte_at p s}\" in finite_subset)\n apply(rule subsetI)\n apply(simp add: descendants_of_cte_at)\n apply(simp add: cte_wp_at_set_finite)\n done\n\nlemma next_slot_linear:\n \"\\a \\ next_slot_set c t m; b \\ next_slot_set c t m; a \\ b\\\n \\ a \\ next_slot_set b t m \\ b \\ next_slot_set a t m\"\n apply(clarsimp)\n apply(simp add: next_slot_set_def)\n apply(induct a c rule: trancl.induct)\n apply(simp)\n apply(erule tranclE)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(case_tac \"ba=b\")\n apply(simp)\n apply(subgoal_tac \"(b, ba) \\ {(next, p). next_slot p t m = Some next}\\<^sup>+\")\n apply(simp)\n apply(erule_tac a=b and b=c in tranclE)\n apply(simp)\n apply(simp)\n done\n\nlemma next_sib_in_next_slot_set:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next_sib slot (cdt_list s) (cdt s) = Some next; valid_list s; valid_mdb s\\\n \\ next \\ next_slot_set slot (cdt_list s) (cdt s)\"\n apply(subgoal_tac \"finite (descendants_of slot (cdt s))\")\n prefer 2\n apply(rule finite_subset[OF _ cte_wp_at_set_finite[where P=\"\\\\\" and s=s]])\n apply(fastforce simp: descendants_of_cte_at)\n apply(frule finite_depth)\n apply(subgoal_tac \"no_mloop (cdt s)\")\n prefer 2\n apply(simp add: valid_mdb_def)\n apply(case_tac \"descendants_of slot (cdt s) = {}\")\n apply(fastforce simp: next_slot_set_def next_slot_def empty_list_empty_desc next_not_child_termination)\n apply(case_tac \"last_last_child slot (cdt_list s)\")\n apply(drule(2) last_last_child_NoneD, simp)\n apply(case_tac \"a \\ next_slot_set slot (cdt_list s) (cdt s)\")\n apply(frule(2) last_last_child_empty_desc)\n apply(drule(2) last_last_child_next_not_child)\n apply(simp add: next_slot_set_def)\n apply(rule_tac b=a in trancl_into_trancl2)\n apply(simp add: next_slot_def empty_list_empty_desc next_not_child_termination)\n apply(simp)\n apply(subgoal_tac \"next_slot_set slot (cdt_list s) (cdt s) \\ descendants_of slot (cdt s)\")\n prefer 2\n apply(rule subsetI)\n apply(simp add: next_slot_set_def)\n apply(drule trancl_Collect_rev)\n apply(erule trancl_induct)\n apply(simp add: empty_list_empty_desc next_slot_def)\n apply(drule(1) next_childD, simp add: child_descendant)\n apply(simp)\n apply(drule(2) desc_next_slot_desc_or_sib)\n apply(erule disjE, simp)\n apply(drule_tac b=y in trancl_Collect_rev)\n apply(simp)\n apply(subgoal_tac \"(\\p. the (next_slot p (cdt_list s) (cdt s))) ` (next_slot_set slot (cdt_list s) (cdt s)) \\ next_slot_set slot (cdt_list s) (cdt s)\")\n prefer 2\n apply(simp add: image_def)\n apply(rule psubsetI)\n apply(rule subsetI)\n apply(simp)\n apply(erule bexE)\n apply(simp add: next_slot_set_def)\n apply(case_tac \"next_slot xa (cdt_list s) (cdt s)\")\n apply(drule_tac c=xa in subsetD)\n apply(simp)\n apply(drule(2) desc_next_slot_desc_or_sib, simp)\n apply(drule trancl_Collect_rev)\n apply(drule_tac c=x in trancl_into_trancl)\n apply(case_tac \"next_slot xa (cdt_list s) (cdt s)\")\n apply(simp)\n apply(simp add: the_def)\n apply(simp)\n apply(drule trancl_Collect_rev, simp)\n apply(case_tac \"next_slot slot (cdt_list s) (cdt s)\")\n apply(fastforce simp: next_slot_def empty_list_empty_desc next_child_def split: if_split_asm list.splits)\n apply(rule_tac x=aa in set_neqI[symmetric])\n apply(fastforce simp: next_slot_set_def)\n apply(rule ccontr, simp)\n apply(erule bexE)\n apply(simp)\n apply(subgoal_tac \"\\y. next_slot x (cdt_list s) (cdt s) = Some y\")\n prefer 2\n apply(rule ccontr)\n apply(simp)\n apply(drule_tac c=x in subsetD)\n apply(simp)\n apply(drule(2) desc_next_slot_desc_or_sib, simp)\n apply(erule exE, simp)\n apply(frule_tac x=y in next_slot_no_loop, assumption+)\n apply(erule notE)+\n apply(simp add: next_slot_set_def)\n apply(drule tranclD2, simp)\n apply(drule rtranclD)\n apply(erule disjE, fastforce)\n apply(rule_tac b=x in trancl_into_trancl2)\n apply(simp)\n apply(simp)\n apply(frule finite_subset)\n apply(simp add: finite_descendants)\n apply(frule(1) psubset_card_mono)\n apply(drule_tac f=\"(\\p. the (next_slot p (cdt_list s) (cdt s)))\" and A=\"next_slot_set slot (cdt_list s) (cdt s)\" in inj_on_iff_eq_card)\n apply(erule iffE)\n apply(erule impE)\n apply(simp)\n apply(rule inj_onI)\n apply(frule_tac c=x in subsetD, simp)\n apply(frule_tac c=y in subsetD, simp)\n apply(case_tac \"next_slot x (cdt_list s) (cdt s)\")\n apply(drule(2) desc_next_slot_desc_or_sib)+\n apply(simp)\n apply(case_tac \"next_slot y (cdt_list s) (cdt s)\")\n apply(drule(2) desc_next_slot_desc_or_sib)+\n apply(simp)\n apply(simp)\n apply(rule ccontr)\n apply(drule(2) next_slot_linear)\n apply(erule disjE)\n apply(drule_tac x=x in next_slot_no_loop, assumption+)\n apply(simp add: next_slot_set_def)\n apply(drule_tac x=x in tranclD2, simp)\n apply(drule_tac x=x and z=x in rtrancl_trancl_trancl)\n apply(rule r_into_trancl, simp+)\n apply(drule_tac x=y in next_slot_no_loop, assumption+)\n apply(simp add: next_slot_set_def)\n apply(drule_tac x=y and y=x in tranclD2, simp)\n apply(drule_tac x=y and z=y in rtrancl_trancl_trancl)\n apply(rule r_into_trancl, simp+)\n done\n\n\nlemma next_sib_2_None_next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next_sib_2 slot p s = None; valid_mdb s; valid_list s; cdt s slot = Some p\\\n \\ next_sib slot (cdt_list s) (cdt s) = None\"\n apply(rule ccontr, simp, erule exE)\n apply(frule(2) next_sib_in_next_slot_set)\n apply(frule child_descendant)\n apply(drule(4) next_sib_2_NoneD)\n apply(fastforce dest: next_sibD next_sib_same_parent)\n done\n\nlemma next_sib_2_in_next_slot_set:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"next_sib_2 slot p s = Some next\" \"valid_list s\" \"valid_mdb s\"\n shows \"next \\ next_slot_set slot (cdt_list s) (cdt s)\"\n using assms\n apply(induct rule: next_slot_induct[where s=s])\n apply(simp add: next_sib_2_termination split: if_splits)\n apply(simp add: next_sib_2_termination split: if_splits)\n apply(fastforce simp: next_slot_set_def intro: trancl_into_trancl)\n apply(fastforce simp: next_slot_set_def intro: trancl_into_trancl)\n apply(insert assms, simp+)\n done\n\nlemma next_sib_2_sib':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"next_sib_2 slot p s = Some next\" \"cdt s slot \\ Some p\" \"valid_list s\" \"valid_mdb s\"\n shows \"cdt s next = Some p\"\n apply(insert assms)\n apply(induct slot rule: next_sib_2_pinduct[where s=s and p=p])\n apply(simp)\n apply(frule(2) next_sib_2_in_next_slot_set)\n apply(case_tac \"next_slot slot (cdt_list s) (cdt s)\")\n apply(fastforce simp: next_slot_set_def dest: tranclD2)\n apply(simp)\n apply(atomize)\n apply(erule_tac x=a in allE, simp)\n apply(case_tac \"a=next\")\n apply(simp add: next_sib_2_termination split: if_split_asm | erule impE)+\n apply(insert assms, simp+)\n done\n\nlemma next_sib_2_sib:\n \"\\next_sib_2 slot p s = Some next; valid_list s; valid_mdb s\\\n \\ cdt s next = Some p\"\n apply(case_tac \"cdt s slot = Some p\")\n apply(simp add: next_sib_2_termination split: if_split_asm)\n apply(simp split: option.splits if_split_asm)\n apply(fastforce intro: next_sib_2_sib')+\n done\n\nlemma ex_imp:\n \"\\\\x. P x \\ Q x; \\x. P x\\ \\ \\x. Q x\"\n by auto\n\nlemma next_sib_2I:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes \"cdt s next = Some p\" \"next \\ next_slot_set slot (cdt_list s) (cdt s)\"\n \"\\q. q \\ next_slot_set slot (cdt_list s) (cdt s) \\\n next \\ next_slot_set q (cdt_list s) (cdt s) \\ cdt s q \\ Some p\"\n \"slot \\ descendants_of p (cdt s)\" \"valid_mdb s\" \"valid_list s\"\n shows \"next_sib_2 slot p s = Some next\"\n using assms\n apply(induct slot rule: next_sib_2_pinduct[where s=s and p=p])\n apply(simp)\n apply(case_tac \"next_slot slot (cdt_list s) (cdt s)\")\n apply(fastforce simp: next_slot_set_def dest: tranclD2)\n apply(atomize)\n apply(erule_tac x=a in allE)\n apply(simp)\n apply(case_tac \"a=next\")\n apply(simp add: next_sib_2_termination)\n apply(erule impE)\n apply(rule notI)\n apply(erule_tac x=a in allE)\n apply(erule impE)\n apply(rule conjI)\n apply(fastforce simp: next_slot_set_def)\n apply(fastforce dest: rtranclD tranclD2 simp: next_slot_set_def)\n apply(simp)\n apply(elim impE)\n apply(fastforce simp: next_slot_set_def dest: rtranclD tranclD2)\n apply(intro allI impI notI)\n apply(erule_tac x=q in allE)\n apply(erule impE)\n apply(fastforce intro: trancl_into_trancl simp: next_slot_set_def)\n apply(simp)\n apply(drule(5) next_slot_set_in_desc, simp)\n apply(simp add: next_sib_2_termination)\n apply(erule_tac x=a in allE, erule impE)\n apply(rule conjI)\n apply(fastforce simp: next_slot_set_def)\n apply(fastforce simp: next_slot_set_def dest: tranclD2 rtranclD)\n using assms\n apply(simp)+\n done\n\nlemma between_next_sib_2_not_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n assumes\n \"next_sib_2 slot p s = Some next\" \"q \\ next_slot_set slot (cdt_list s) (cdt s)\"\n \"next \\ next_slot_set q (cdt_list s) (cdt s)\" \"valid_list s\" \"valid_mdb s\"\n shows \"cdt s q \\ Some p\"\n using assms\n apply(subgoal_tac \"no_mloop (cdt s)\")\n prefer 2\n apply(simp add: valid_mdb_def)\n apply(frule finite_depth)\n apply(rule notI)\n apply(case_tac \"next_sib_2 slot p s = Some q\")\n apply(simp add: next_slot_no_loop)\n apply(subgoal_tac \"\\q'. next_sib_2 slot p s = Some q' \\\n q \\ next_slot_set q' (cdt_list s) (cdt s)\")\n prefer 2\n apply(rule_tac P=\"\\q'. cdt s q' = Some p \\\n q' \\ next_slot_set slot (cdt_list s) (cdt s) \\\n (\\q. q \\ next_slot_set slot (cdt_list s) (cdt s) \\\n q' \\ next_slot_set q (cdt_list s) (cdt s) \\ cdt s q \\ Some p) \\\n q \\ next_slot_set q' (cdt_list s) (cdt s)\" in ex_imp)\n apply(simp)\n apply(intro allI impI)\n apply(elim conjE)\n apply(drule(2) next_sib_2I)\n apply(simp add: next_sib_2_termination split: if_split_asm)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(induct slot rule: next_slot_induct[where s=s])\n apply(fastforce simp: next_slot_set_def dest: tranclD2)\n apply(simp)\n apply(case_tac \"y=next\")\n apply(simp add: next_slot_set_def)\n apply(drule_tac x=q in tranclD2)\n apply(simp)\n apply(drule(1) rtrancl_trancl_trancl)\n apply(drule(2) next_slot_no_loop[simplified next_slot_set_def, where x=q])\n apply(simp)\n apply(case_tac \"y=q\")\n apply(simp add: next_sib_2_termination split: if_split_asm)\n apply(atomize)\n apply(elim impE)\n apply(simp add: next_sib_2_termination split: if_split_asm)\n apply(fastforce simp: next_slot_set_def dest: rtranclD tranclD2)\n apply(elim exE conjE)\n apply(rule_tac x=xa in exI)\n apply(simp)\n apply(rule conjI)\n apply(simp add: next_slot_set_def)\n apply(rule trancl_into_trancl)\n apply(simp)+\n apply(intro allI impI)\n apply(erule_tac x=qa in allE)\n apply(simp)\n apply(case_tac \"qa=y\")\n apply(simp add: next_sib_2_termination split: if_split_asm)\n apply(simp add: next_slot_set_def)\n apply(erule conjE)\n apply(drule_tac x=qa and y=x in tranclD2, simp)\n apply(drule rtranclD, simp)\n using assms\n apply(simp_all add: next_slot_set_def)\n apply(drule(1) trancl_trans[where y=\"next\"])\n apply(fastforce dest: next_slot_no_loop simp: next_slot_set_def)\n done\n\nlemma next_sib_set_in_next_slot_set:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next \\ next_sib_set slot (cdt_list s) (cdt s); valid_list s; valid_mdb s\\\n \\ next \\ next_slot_set slot (cdt_list s) (cdt s)\"\n apply(simp add: next_sib_set_def)\n apply(induct \"next\" slot rule: trancl.induct)\n apply(simp add: next_sib_in_next_slot_set)\n apply(simp add: next_slot_set_def)\n apply(rule trancl_trans)\n apply(simp)\n apply(drule(2) next_sib_in_next_slot_set)\n apply(simp add: next_slot_set_def)\n done\n\nlemma next_sib_2_eq_next_sib:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\next_sib_2 slot p s = Some next; valid_list s; valid_mdb s; cdt s slot = Some p\\\n \\ next_sib slot (cdt_list s) (cdt s) = Some next\"\n apply(frule finite_depth, subgoal_tac \"no_mloop (cdt s)\")\n prefer 2\n apply(simp add: valid_mdb_def)\n apply(frule(2) next_sib_2_in_next_slot_set)\n apply(frule(2) next_sib_2_sib)\n apply(frule(5) next_slot_set_after_in_list)\n apply(simp add: next_sib_set_def)\n apply(drule tranclD2)\n apply(elim exE conjE)\n apply(simp)\n apply(drule rtranclD)\n apply(erule disjE, simp)\n apply(frule_tac q=z in between_next_sib_2_not_sib)\n apply(rule next_sib_in_next_slot_set)\n apply(simp, simp, simp)\n apply(rule next_sib_set_in_next_slot_set)\n apply(fastforce simp: next_sib_set_def, simp, simp)\n apply(simp, simp)\n apply(fastforce dest: next_sib_same_parent)\n done\n\nlemma next_sib_def2:\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_mdb s; valid_list s; cdt s slot = Some p\\\n \\ next_sib_2 slot p s = next_sib slot (cdt_list s) (cdt s)\"\n apply(case_tac \"next_sib_2 slot p s\")\n apply(fastforce dest: next_sib_2_None_next_sib)\n apply(fastforce dest: next_sib_2_eq_next_sib)\n done\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/Deterministic_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2943399374156755}} {"text": "theory Fused_Resource imports\n Fold_Spmf\nbegin\n\n(* TODO: move these somewhere *)\ncontext includes \\.lifting begin\nlift_definition e\\ :: \"('a, 'b) \\ \\ ('a, 'b \\ 'c) \\\" is \"\\\\ x. \\ x \\ UNIV\" .\n\nlemma outs_\\_e\\[simp]: \"outs_\\ (e\\ \\) = outs_\\ \\\"\n by transfer simp\n\nlemma responses_\\_e\\ [simp]: \"responses_\\ (e\\ \\) x = responses_\\ \\ x \\ UNIV\"\n by transfer simp\n\nlemma e\\_map_\\: \"e\\ (map_\\ f g \\) = map_\\ f (apfst g) (e\\ \\)\"\n by transfer(auto simp add: fun_eq_iff intro: rev_image_eqI)\n\nlemma e\\_inverse [simp]: \"map_\\ id fst (e\\ \\) = \\\"\n by transfer auto\nend\nlifting_update \\.lifting\nlifting_forget \\.lifting\n\n\nsection \\Fused Resource\\\n\nsubsection \\Event Oracles -- they generate events\\\n\ntype_synonym \n ('state, 'event, 'input, 'output) eoracle = \"('state, 'input, 'output \\ 'event list) oracle'\" \n\ndefinition\n parallel_eoracle :: \"\n ('s1, 'e1, 'i1, 'o1) eoracle \\ ('s2, 'e2, 'i2, 'o2) eoracle \\\n ('s1 \\ 's2, 'e1 + 'e2, 'i1 + 'i2, 'o1 + 'o2) eoracle\"\n where\n \"parallel_eoracle eoracle1 eoracle2 state \\\n comp\n (map_spmf \n (map_prod \n (case_sum \n (map_prod Inl (map Inl)) \n (map_prod Inr (map Inr))) \n id))\n (parallel_oracle eoracle1 eoracle2 state)\"\n\ndefinition\n plus_eoracle :: \"\n ('s, 'e1, 'i1, 'o1) eoracle \\ ('s, 'e2, 'i2, 'o2) eoracle \\\n ('s, 'e1 + 'e2, 'i1 + 'i2, 'o1 + 'o2) eoracle\"\n where\n \"plus_eoracle eoracle1 eoracle2 state \\\n comp\n (map_spmf \n (map_prod \n (case_sum \n (map_prod Inl (map Inl)) \n (map_prod Inr (map Inr))) \n id))\n (plus_oracle eoracle1 eoracle2 state)\"\n\ndefinition\n translate_eoracle :: \"\n ('s_event, 'e1, 'e2 list) oracle' \\ ('s_event \\ 's, 'e1, 'i, 'o) eoracle \\\n ('s_event \\ 's, 'e2, 'i, 'o) eoracle\"\n where\n \"translate_eoracle translator eoracle state inp \\ \n bind_spmf\n (eoracle state inp)\n (\\((out, e_in), s).\n let conc = (\\(es, st) e. map_spmf (map_prod ((@) es) id) (translator st e)) in do {\n (e_out, s_event) \\ foldl_spmf conc (return_spmf ([], fst s)) e_in;\n return_spmf ((out, e_out), s_event, snd s)\n })\"\n\n\nsubsection \\Event Handlers -- they absorb (and silently handle) events\\\n\ntype_synonym\n ('state, 'event) handler = \"'state \\ 'event \\ 'state spmf\"\n\nfun\n parallel_handler :: \"('s1, 'e1) handler \\ ('s2, 'e2) handler \\ ('s1 \\ 's2, 'e1 + 'e2) handler\"\n where\n \"parallel_handler left _ s (Inl e1) = map_spmf (\\s1'. (s1', snd s)) (left (fst s) e1)\"\n | \"parallel_handler _ right s (Inr e2) = map_spmf (\\s2'. (fst s, s2')) (right (snd s) e2)\"\n\ndefinition\n plus_handler :: \"('s, 'e1) handler \\ ('s, 'e2) handler \\ ('s, 'e1 + 'e2) handler\"\n where\n \"plus_handler left right s \\ case_sum (left s) (right s)\"\n\nlemma parallel_handler_left:\n \"map_fun id (map_fun Inl id) (parallel_handler left right) = \n (\\(s_l, s_r) q. map_spmf (\\s_l'. (s_l', s_r)) (left s_l q))\"\n by force\n\nlemma parallel_handler_right:\n \"map_fun id (map_fun Inr id) (parallel_handler left right) = \n (\\(s_l, s_r) q. map_spmf (\\s_r'. (s_l, s_r')) (right s_r q))\"\n by force\n\nlemma in_set_spmf_parallel_handler:\n \"s' \\ set_spmf (parallel_handler left right s x) \\\n (case x of Inl e \\ fst s' \\ set_spmf (left (fst s) e) \\ snd s' = snd s\n | Inr e \\ snd s' \\ set_spmf (right (snd s) e) \\ fst s' = fst s)\"\n by(cases s; cases s'; auto split: sum.split)\n\nsubsection \\Fused Resource Construction\\\n\ncodatatype \n ('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core =\n Core\n (cpoke: \"('s_core, 'event) handler\")\n (cfunc_adv: \"('s_core, 'iadv_core, 'oadv_core) oracle'\")\n (cfunc_usr: \"('s_core, 'iusr_core, 'ousr_core) oracle'\")\n\ndeclare core.sel_transfer[transfer_rule del]\ndeclare core.ctr_transfer[transfer_rule del]\ndeclare core.case_transfer[transfer_rule del]\n\ncontext \n includes lifting_syntax \nbegin\n\ninductive \n rel_core':: \"\n ('s_core \\ 's_core' \\ bool) \\ \n ('event \\ 'event' \\ bool) \\ \n ('iadv_core \\ 'iadv_core' \\ bool) \\\n ('iusr_core \\ 'iusr_core' \\ bool) \\ \n ('oadv_core \\ 'oadv_core' \\ bool) \\ \n ('ousr_core \\ 'ousr_core' \\ bool) \\\n ('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core \\ \n ('s_core', 'event', 'iadv_core', 'iusr_core', 'oadv_core', 'ousr_core') core \\ bool\"\n for S E IA IU OA OU\n where \"rel_core' S E IA IU OA OU (Core cpoke cfunc_adv cfunc_usr) (Core cpoke' cfunc_adv' cfunc_usr')\"\n if \n \"(S ===> E ===> rel_spmf S) cpoke cpoke'\" and \n \"(S ===> IA ===> rel_spmf (rel_prod OA S)) cfunc_adv cfunc_adv'\" and \n \"(S ===> IU ===> rel_spmf (rel_prod OU S)) cfunc_usr cfunc_usr'\"\n for cpoke cfunc_adv cfunc_usr\n\ninductive_simps \n rel_core'_simps [simp]: \n \"rel_core' S E IA IU OA OU (Core cpoke' cfunc_adv' cfunc_usr') (Core cpoke'' cfunc_adv'' cfunc_usr'')\"\n\nlemma \n rel_core'_eq [relator_eq]:\n \"rel_core' (=) (=) (=) (=) (=) (=) = (=)\"\n apply(intro ext)\n subgoal for x y by(cases x; cases y)(auto simp add: fun_eq_iff rel_fun_def relator_eq)\n done\n\nlemma \n rel_core'_mono [relator_mono]:\n \"rel_core' S E IA IU OA OU \\ rel_core' S E' IA' IU' OA' OU'\"\n if \"E' \\ E\" \"IA' \\ IA\" \"IU' \\ IU\" \"OA \\ OA'\" \"OU \\ OU'\"\n apply(rule predicate2I)\n subgoal for x y\n apply(cases x; cases y; clarsimp; intro conjI)\n apply(erule rel_fun_mono rel_spmf_mono prod.rel_mono[THEN predicate2D, rotated -1] |\n rule impI that order_refl | erule that[THEN predicate2D] | erule rel_spmf_mono | assumption)+\n done\n done\n\nlemma \n cpoke_parametric [transfer_rule]:\n \"(rel_core' S E IA IU OA OU ===> S ===> E ===> rel_spmf S) cpoke cpoke\"\n by(rule rel_funI; erule rel_core'.cases; simp)\n\nlemma \n cfunc_adv_parametric [transfer_rule]:\n \"(rel_core' S E IA IU OA OU ===> S ===> IA ===> rel_spmf (rel_prod OA S)) cfunc_adv cfunc_adv\"\n by(rule rel_funI; erule rel_core'.cases; simp)\n\nlemma \n cfunc_usr_parametric [transfer_rule]:\n \"(rel_core' S E IA IU OA OU ===> S ===> IU ===> rel_spmf (rel_prod OU S)) cfunc_usr cfunc_usr\"\n by(rule rel_funI; erule rel_core'.cases; simp)\n\nlemma \n Core_parametric [transfer_rule]:\n \"((S ===> E ===> rel_spmf S) ===> (S ===> IA ===> rel_spmf (rel_prod OA S)) ===> (S ===> IU ===> rel_spmf (rel_prod OU S))\n ===> rel_core' S E IA IU OA OU) Core Core\"\n by(rule rel_funI)+ simp\n\nlemma \n case_core_parametric [transfer_rule]:\n \"(((S ===> E ===> rel_spmf S) ===> \n (S ===> IA ===> rel_spmf (rel_prod OA S)) ===> \n (S ===> IU ===> rel_spmf (rel_prod OU S)) ===> X) ===> \n rel_core' S E IA IU OA OU ===> X) case_core case_core\"\n by(rule rel_funI)+(auto 4 4 split: core.split dest: rel_funD)\n\nlemma \n corec_core_parametric [transfer_rule]:\n \"((X ===> S ===> E ===> rel_spmf S) ===> \n (X ===> S ===> IA ===> rel_spmf (rel_prod OA S)) ===> \n (X ===> S ===> IU ===> rel_spmf (rel_prod OU S)) ===> \n X ===> rel_core' S E IA IU OA OU) corec_core corec_core\"\n by(rule rel_funI)+(auto simp add: core.corec dest: rel_funD)\n\nprimcorec map_core' ::\n \"('event' \\ 'event) \\ \n ('iadv_core' \\ 'iadv_core) \\\n ('iusr_core' \\ 'iusr_core) \\ \n ('oadv_core \\ 'oadv_core') \\ \n ('ousr_core \\ 'ousr_core') \\\n ('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core \\ \n ('s_core, 'event', 'iadv_core', 'iusr_core', 'oadv_core', 'ousr_core') core\"\n where\n \"cpoke (map_core' e ia iu oa ou core) = (id ---> e ---> id) (cpoke core)\"\n| \"cfunc_adv (map_core' e ia iu oa ou core) = (id ---> ia ---> map_spmf (map_prod oa id)) (cfunc_adv core)\"\n| \"cfunc_usr (map_core' e ia iu oa ou core) = (id ---> iu ---> map_spmf (map_prod ou id)) (cfunc_usr core)\"\n\nlemmas map_core'_simps [simp] = map_core'.ctr[where core=\"Core _ _ _\", simplified]\n\nparametric_constant map_core'_parametric[transfer_rule]: map_core'_def\n\nlemma core'_rel_Grp:\n \"rel_core' (=) (BNF_Def.Grp UNIV e)\\\\ (BNF_Def.Grp UNIV ia)\\\\ (BNF_Def.Grp UNIV iu)\\\\ (BNF_Def.Grp UNIV oa) (BNF_Def.Grp UNIV ou)\n = BNF_Def.Grp UNIV (map_core' e ia iu oa ou)\"\n apply(intro ext)\n subgoal for x y\n apply(cases x; cases y; clarsimp)\n apply(subst (2 4 6) eq_alt_conversep)\n apply(subst (2 3 4) eq_alt)\n apply(simp add: pmf.rel_Grp option.rel_Grp prod.rel_Grp rel_fun_conversep_grp_grp)\n apply(auto simp add: Grp_def spmf.map_id[abs_def] id_def[symmetric])\n done\n done\n\nend\n\ninductive WT_core :: \"('iadv, 'oadv) \\ \\ ('iusr, 'ousr) \\ \\ ('s \\ bool) \\ ('s, 'event, 'iadv, 'iusr, 'oadv, 'ousr) core \\ bool\"\n for \\_adv \\_usr I core where\n \"WT_core \\_adv \\_usr I core\" if\n \"\\s e s'. \\ s' \\ set_spmf (cpoke core s e); I s \\ \\ I s'\"\n \"\\s x y s'. \\ (y, s') \\ set_spmf (cfunc_adv core s x); x \\ outs_\\ \\_adv; I s \\ \\ y \\ responses_\\ \\_adv x \\ I s'\"\n \"\\s x y s'. \\ (y, s') \\ set_spmf (cfunc_usr core s x); x \\ outs_\\ \\_usr; I s \\ \\ y \\ responses_\\ \\_usr x \\ I s'\"\n\nlemma WT_coreD:\n assumes \"WT_core \\_adv \\_usr I core\"\n shows WT_coreD_cpoke: \"\\s e s'. \\ s' \\ set_spmf (cpoke core s e); I s \\ \\ I s'\"\n and WT_coreD_cfunc_adv: \"\\s x y s'. \\ (y, s') \\ set_spmf (cfunc_adv core s x); x \\ outs_\\ \\_adv; I s \\ \\ y \\ responses_\\ \\_adv x \\ I s'\"\n and WT_coreD_cfund_usr: \"\\s x y s'. \\ (y, s') \\ set_spmf (cfunc_usr core s x); x \\ outs_\\ \\_usr; I s \\ \\ y \\ responses_\\ \\_usr x \\ I s'\"\n using assms by(auto elim!: WT_core.cases)\n\nlemma WT_coreD_foldl_spmf_cpoke:\n assumes \"WT_core \\_adv \\_usr I core\"\n and \"s' \\ set_spmf (foldl_spmf (cpoke core) p es)\"\n and \"\\s \\ set_spmf p. I s\"\n shows \"I s'\"\n using assms(2, 3)\n by(induction es arbitrary: p)(fastforce dest: WT_coreD_cpoke[OF assms(1)] simp add: bind_UNION)+\n\nlemma WT_core_trivial:\n assumes adv: \"\\s. \\_adv \\c cfunc_adv core s \\\"\n and usr: \"\\s. \\_usr \\c cfunc_usr core s \\\"\n shows \"WT_core \\_adv \\_usr (\\_. True) core\"\n by(rule WT_core.intros)(auto dest: assms[THEN WT_calleeD])\n\ncodatatype \n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme =\n Rest\n (rinit: \"'more\")\n (rfunc_adv: \"('s_rest, 'event, 'iadv_rest, 'oadv_rest) eoracle\")\n (rfunc_usr: \"('s_rest, 'event, 'iusr_rest, 'ousr_rest) eoracle\")\n\ndeclare rest_scheme.sel_transfer[transfer_rule del]\ndeclare rest_scheme.ctr_transfer[transfer_rule del]\ndeclare rest_scheme.case_transfer[transfer_rule del]\n\ncontext \n includes lifting_syntax \nbegin\n\ninductive \n rel_rest':: \"\n ('s_rest \\ 's_rest' \\ bool) \\ \n ('event \\ 'event' \\ bool) \\ \n ('iadv_rest \\ 'iadv_rest' \\ bool) \\\n ('iusr_rest \\ 'iusr_rest' \\ bool) \\ \n ('oadv_rest \\ 'oadv_rest' \\ bool) \\ \n ('ousr_rest \\ 'ousr_rest' \\ bool) \\\n ('more \\ 'more' \\ bool) \\ \n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme \\ \n ('s_rest', 'event', 'iadv_rest', 'iusr_rest', 'oadv_rest', 'ousr_rest', 'more') rest_scheme \\ bool\"\n for S E IA IU OA OU M\n where \"rel_rest' S E IA IU OA OU M (Rest rinit rfunc_adv rfunc_usr) (Rest rinit' rfunc_adv' rfunc_usr')\"\n if \n \"M rinit rinit'\" and \n \"(S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S)) rfunc_adv rfunc_adv'\" and \n \"(S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S)) rfunc_usr rfunc_usr'\"\n for rinit rfunc_adv rfunc_usr\n\ninductive_simps \n rel_rest'_simps [simp]: \n \"rel_rest' S E IA IU OA OU M (Rest rinit' rfunc_adv' rfunc_usr') (Rest rinit'' rfunc_adv'' rfunc_usr'')\"\n\nlemma \n rel_rest'_eq [relator_eq]:\n \"rel_rest' (=) (=) (=) (=) (=) (=) (=) = (=)\"\n apply(intro ext)\n subgoal for x y by(cases x; cases y)(auto simp add: fun_eq_iff rel_fun_def relator_eq)\n done\n\nlemma \n rel_rest'_mono [relator_mono]:\n \"rel_rest' S E IA IU OA OU M \\ rel_rest' S E' IA' IU' OA' OU' M'\"\n if \"E \\ E'\" \"IA' \\ IA\" \"IU' \\ IU\" \"OA \\ OA'\" \"OU \\ OU'\" \"M \\ M'\"\n apply(rule predicate2I)\n subgoal for x y\n apply(cases x; cases y; clarsimp; intro conjI)\n apply(erule rel_fun_mono rel_spmf_mono prod.rel_mono[THEN predicate2D, rotated -1] |\n rule impI that order_refl prod.rel_mono list.rel_mono | erule that[THEN predicate2D] | erule rel_spmf_mono | assumption)+\n done\n done\n\nlemma rel_rest'_sel: \"rel_rest' S E IA IU OA OU M rest1 rest2\"\n if \"M (rinit rest1) (rinit rest2)\"\n and \"(S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S)) (rfunc_adv rest1) (rfunc_adv rest2)\" \n and \"(S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S)) (rfunc_usr rest1) (rfunc_usr rest2)\"\n using that by(cases rest1; cases rest2) simp\n\nlemma rinit_parametric [transfer_rule]: \"(rel_rest' S E IA IU OA OU M ===> M) rinit rinit\"\n by(rule rel_funI; erule rel_rest'.cases; simp)\n\nlemma rfunc_adv_parametric [transfer_rule]:\n \"(rel_rest' S E IA IU OA OU M ===> S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S)) rfunc_adv rfunc_adv\"\n by(rule rel_funI; erule rel_rest'.cases; simp)\n\nlemma rfunc_usr_parametric [transfer_rule]:\n \"(rel_rest' S E IA IU OA OU M ===> S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S)) rfunc_usr rfunc_usr\"\n by(rule rel_funI; erule rel_rest'.cases; simp)\n\nlemma Rest_parametric [transfer_rule]:\n \"(M ===> (S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S))\n ===> (S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S))\n ===> rel_rest' S E IA IU OA OU M) Rest Rest\"\n by(rule rel_funI)+ simp\n\nlemma case_rest_scheme_parametric [transfer_rule]:\n \"((M ===> \n (S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S)) ===> \n (S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S)) ===> X) ===> \n rel_rest' S E IA IU OA OU M ===> X) case_rest_scheme case_rest_scheme\"\n by(rule rel_funI)+(auto 4 4 split: rest_scheme.split dest: rel_funD)\n\nlemma corec_rest_scheme_parametric [transfer_rule]:\n \"((X ===> M) ===> \n (X ===> S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S)) ===> \n (X ===> S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S)) ===> \n X ===> rel_rest' S E IA IU OA OU M) corec_rest_scheme corec_rest_scheme\"\n by(rule rel_funI)+(auto simp add: rest_scheme.corec dest: rel_funD)\n\nprimcorec map_rest' ::\n \"('event \\ 'event') \\ \n ('iadv_rest' \\ 'iadv_rest) \\\n ('iusr_rest' \\ 'iusr_rest) \\ \n ('oadv_rest \\ 'oadv_rest') \\ \n ('ousr_rest \\ 'ousr_rest') \\\n ('more \\ 'more') \\\n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme \\ \n ('s_rest, 'event', 'iadv_rest', 'iusr_rest', 'oadv_rest', 'ousr_rest', 'more') rest_scheme\"\n where\n \"rinit (map_rest' e ia iu oa ou m rest) = m (rinit rest)\"\n| \"rfunc_adv (map_rest' e ia iu oa ou m rest) =\n (id ---> ia ---> map_spmf (map_prod (map_prod oa (map e)) id)) (rfunc_adv rest)\"\n| \"rfunc_usr (map_rest' e ia iu oa ou m rest) =\n (id ---> iu ---> map_spmf (map_prod (map_prod ou (map e)) id)) (rfunc_usr rest)\"\n\nlemmas map_rest'_simps [simp] = map_rest'.ctr[where rest=\"Rest _ _ _\", simplified]\n\nparametric_constant map_rest'_parametric[transfer_rule]: map_rest'_def\n\nlemma rest'_rel_Grp:\n \"rel_rest' (=) (BNF_Def.Grp UNIV e) (BNF_Def.Grp UNIV ia)\\\\ (BNF_Def.Grp UNIV iu)\\\\ (BNF_Def.Grp UNIV oa) (BNF_Def.Grp UNIV ou) (BNF_Def.Grp UNIV m)\n = BNF_Def.Grp UNIV (map_rest' e ia iu oa ou m)\"\n apply(intro ext)\n subgoal for x y\n apply(cases x; cases y; clarsimp)\n apply(subst (2 4) eq_alt_conversep)\n apply(subst (2 3) eq_alt)\n apply(simp add: pmf.rel_Grp list.rel_Grp option.rel_Grp prod.rel_Grp rel_fun_conversep_grp_grp)\n apply(auto simp add: Grp_def spmf.map_id[abs_def] id_def[symmetric])\n done\n done\n\nend\n\ntype_synonym \n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) rest_wstate =\n \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 's_rest) rest_scheme\"\n\ninductive WT_rest :: \"('iadv, 'oadv) \\ \\ ('iusr, 'ousr) \\ \\ ('s \\ bool) \\ ('s, 'event, 'iadv, 'iusr, 'oadv, 'ousr) rest_wstate \\ bool\"\n for \\_adv \\_usr I rest where\n \"WT_rest \\_adv \\_usr I rest\" if\n \"\\s x y es s'. \\ ((y, es), s') \\ set_spmf (rfunc_adv rest s x); x \\ outs_\\ \\_adv; I s \\ \\ y \\ responses_\\ \\_adv x \\ I s'\"\n \"\\s x y es s'. \\ ((y, es), s') \\ set_spmf (rfunc_usr rest s x); x \\ outs_\\ \\_usr; I s \\ \\ y \\ responses_\\ \\_usr x \\ I s'\"\n \"I (rinit rest)\"\n\nlemma WT_restD:\n assumes \"WT_rest \\_adv \\_usr I rest\"\n shows WT_restD_rfunc_adv: \"\\s x y es s'. \\ ((y, es), s') \\ set_spmf (rfunc_adv rest s x); x \\ outs_\\ \\_adv; I s \\ \\ y \\ responses_\\ \\_adv x \\ I s'\"\n and WT_restD_rfunc_usr: \"\\s x y es s'. \\ ((y, es), s') \\ set_spmf (rfunc_usr rest s x); x \\ outs_\\ \\_usr; I s \\ \\ y \\ responses_\\ \\_usr x \\ I s'\"\n and WT_restD_rinit: \"I (rinit rest)\"\n using assms by(auto elim!: WT_rest.cases)\n\nabbreviation\n fuse_cfunc :: \"\n ('o \\ 'x) \\ ('s_core, 'i, 'o) oracle' \\ ('s_core \\ 's_rest, 'i , 'x) oracle'\"\n where\n \"fuse_cfunc redirect cfunc state inp \\ do {\n let handle = map_prod redirect (prod.swap o Pair (snd state));\n (os_cfunc :: 'o \\ 's_core) \\ cfunc (fst state) inp;\n return_spmf (handle os_cfunc)\n }\"\n\nabbreviation\n fuse_rfunc :: \"\n ('o \\ 'x) \\ ('s_rest, 'e, 'i, 'o) eoracle \\ ('s_core, 'e) handler \\ \n ('s_core \\ 's_rest, 'i , 'x) oracle'\"\n where\n \"fuse_rfunc redirect rfunc notify state inp \\ \n bind_spmf \n (rfunc (snd state) inp)\n (\\((o_rfunc, e_lst), s_rfunc). \n bind_spmf \n (foldl_spmf notify (return_spmf (fst state)) e_lst)\n (\\s_notify. return_spmf (redirect o_rfunc, s_notify, s_rfunc)))\n \"\n\n\nlocale fused_resource =\n fixes \n core :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\" and \n core_init :: 's_core\nbegin\n\nfun\n fuse :: \"\n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'm) rest_scheme \\\n ('s_core \\ 's_rest, \n ('iadv_core + 'iadv_rest) + ('iusr_core + 'iusr_rest), \n ('oadv_core + 'oadv_rest) + ('ousr_core + 'ousr_rest)) oracle'\" \n where\n \"fuse rest state (Inl (Inl iadv_core)) = \n fuse_cfunc (Inl o Inl) (cfunc_adv core) state iadv_core\"\n | \"fuse rest state (Inl (Inr iadv_rest)) = \n fuse_rfunc (Inl o Inr) (rfunc_adv rest) (cpoke core) state iadv_rest\"\n | \"fuse rest state (Inr (Inl iusr_core)) = \n fuse_cfunc (Inr o Inl) (cfunc_usr core) state iusr_core\"\n | \"fuse rest state (Inr (Inr iusr_rest)) = \n fuse_rfunc (Inr o Inr) (rfunc_usr rest) (cpoke core) state iusr_rest\"\n\ncase_of_simps fuse_case: fused_resource.fuse.simps\n\nlemma callee_invariant_on_fuse:\n assumes \"WT_core \\_adv_core \\_usr_core I_core core\" \n and \"WT_rest \\_adv_rest \\_usr_rest I_rest rest\"\n shows \"callee_invariant_on (fuse rest) (pred_prod I_core I_rest) ((\\_adv_core \\\\<^sub>\\ \\_adv_rest) \\\\<^sub>\\ (\\_usr_core \\\\<^sub>\\ \\_usr_rest))\"\nproof(unfold_locales, goal_cases)\n case (1 s x y s')\n then show ?case using assms\n by(cases s; cases s')(auto 4 4 dest: WT_restD WT_coreD WT_coreD_foldl_spmf_cpoke)\nnext\n case (2 s)\n show ?case\n apply(rule WT_calleeI)\n subgoal for x y s' using 2 assms\n by (cases \"(rest, s, x)\" rule: fuse.cases) (auto simp add: pred_prod_beta dest: WT_restD WT_coreD )\n done\nqed\n\ndefinition \n resource :: \"\n ('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) rest_wstate \\\n (('iadv_core + 'iadv_rest) + ('iusr_core + 'iusr_rest),\n ('oadv_core + 'oadv_rest) + ('ousr_core + 'ousr_rest)) resource\" \n where\n \"resource rest = resource_of_oracle (fuse rest) (core_init, rinit rest)\"\n\nlemma WT_resource [WT_intro]:\n assumes \"WT_core \\_adv_core \\_usr_core I_core core\"\n and \"WT_rest \\_adv_rest \\_usr_rest I_rest rest\"\n and \"I_core core_init\"\n shows \"(\\_adv_core \\\\<^sub>\\ \\_adv_rest) \\\\<^sub>\\ (\\_usr_core \\\\<^sub>\\ \\_usr_rest) \\res resource rest \\\"\nproof -\n interpret callee_invariant_on \"fuse rest\" \"pred_prod I_core I_rest\" \"(\\_adv_core \\\\<^sub>\\ \\_adv_rest) \\\\<^sub>\\ (\\_usr_core \\\\<^sub>\\ \\_usr_rest)\"\n using assms(1,2) by(rule callee_invariant_on_fuse)\n show ?thesis unfolding resource_def\n by(rule WT_resource_of_oracle)(simp add: assms(3) WT_restD_rinit[OF assms(2)])\nqed\n\nend\n\nparametric_constant \n fuse_parametric [transfer_rule]: fused_resource.fuse_case\n\nsubsection \\More helpful construction functions\\\n\ncontext\n fixes\n core1 :: \"('s_core1, 'event1, 'iadv_core1, 'iusr_core1, 'oadv_core1, 'ousr_core1) core\" and\n core2 :: \"('s_core2, 'event2, 'iadv_core2, 'iusr_core2, 'oadv_core2, 'ousr_core2) core\"\nbegin\n\nprimcorec parallel_core :: \"\n ('s_core1 \\ 's_core2, 'event1 + 'event2, \n 'iadv_core1 + 'iadv_core2, 'iusr_core1 + 'iusr_core2,\n 'oadv_core1 + 'oadv_core2, 'ousr_core1 + 'ousr_core2) core\" \n where\n \"cpoke parallel_core = parallel_handler (cpoke core1) (cpoke core2)\"\n | \"cfunc_adv parallel_core = parallel_oracle (cfunc_adv core1) (cfunc_adv core2)\"\n | \"cfunc_usr parallel_core = parallel_oracle (cfunc_usr core1) (cfunc_usr core2)\"\n\nend\n\n\ncontext\n fixes\n cnv_adv :: \"'s_adv \\ 'iadv \\ ('oadv \\ 's_adv, 'iadv_core, 'oadv_core) gpv\" and\n cnv_usr :: \"'s_usr \\ 'iusr \\ ('ousr \\ 's_usr, 'iusr_core, 'ousr_core) gpv\" and\n core :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\nbegin\n\nprimcorec \n attach_core :: \"(('s_adv \\ 's_usr) \\ 's_core, 'event, 'iadv, 'iusr, 'oadv, 'ousr) core\"\n where\n \"cpoke attach_core = (\\(s_advusr, s_core) event. \n map_spmf (\\s_core'. (s_advusr, s_core')) (cpoke core s_core event))\"\n | \"cfunc_adv attach_core = (\\((s_adv, s_usr), s_core) iadv. \n map_spmf \n (\\((oadv, s_adv'), s_core'). (oadv, ((s_adv', s_usr), s_core'))) \n (exec_gpv (cfunc_adv core) (cnv_adv s_adv iadv) s_core))\"\n | \"cfunc_usr attach_core = (\\((s_adv, s_usr), s_core) iusr. \n map_spmf \n (\\((ousr, s_usr'), s_core'). (ousr, ((s_adv, s_usr'), s_core'))) \n (exec_gpv (cfunc_usr core) (cnv_usr s_usr iusr) s_core))\"\n\nend\n\n\nlemma \n attach_core_id_oracle_adv: \"cfunc_adv (attach_core 1\\<^sub>I cnv core) = \n (\\(s_cnv, s_core) q. map_spmf (\\(out, s_core'). (out, s_cnv, s_core')) (cfunc_adv core s_core q))\"\n by(simp add: id_oracle_def split_def map_spmf_conv_bind_spmf)\n\nlemma \n attach_core_id_oracle_usr: \"cfunc_usr (attach_core cnv 1\\<^sub>I core) = \n (\\(s_cnv, s_core) q. map_spmf (\\(out, s_core'). (out, s_cnv, s_core')) (cfunc_usr core s_core q))\"\n by(simp add: id_oracle_def split_def map_spmf_conv_bind_spmf)\n\n\ncontext\n fixes\n rest1 :: \"('s_rest1, 'event1, 'iadv_rest1, 'iusr_rest1, 'oadv_rest1, 'ousr_rest1, 'more1) rest_scheme\" and\n rest2 :: \"('s_rest2, 'event2, 'iadv_rest2, 'iusr_rest2, 'oadv_rest2, 'ousr_rest2, 'more2) rest_scheme\"\nbegin\n\nprimcorec parallel_rest :: \"\n ('s_rest1 \\ 's_rest2, 'event1 + 'event2, 'iadv_rest1 + 'iadv_rest2, 'iusr_rest1 + 'iusr_rest2, \n 'oadv_rest1 + 'oadv_rest2, 'ousr_rest1 + 'ousr_rest2, 'more1 \\ 'more2) rest_scheme\" \n where\n \"rinit parallel_rest = (rinit rest1, rinit rest2)\"\n | \"rfunc_adv parallel_rest = parallel_eoracle (rfunc_adv rest1) (rfunc_adv rest2)\"\n | \"rfunc_usr parallel_rest = parallel_eoracle (rfunc_usr rest1) (rfunc_usr rest2)\"\n\nend\n\nlemma WT_parallel_rest [WT_intro]:\n \"WT_rest (\\_adv1 \\\\<^sub>\\ \\_adv2) (\\_usr1 \\\\<^sub>\\ \\_usr2) (pred_prod I1 I2) (parallel_rest rest1 rest2)\"\n if \"WT_rest \\_adv1 \\_usr1 I1 rest1\"\n and \"WT_rest \\_adv2 \\_usr2 I2 rest2\"\n by(rule WT_rest.intros)\n (auto 4 3 simp add: parallel_eoracle_def simp add: that[THEN WT_restD_rinit] dest: that[THEN WT_restD_rfunc_adv] that[THEN WT_restD_rfunc_usr])\n\ncontext\n fixes\n cnv_adv :: \"'s_adv \\ 'iadv \\ ('oadv \\ 's_adv, 'iadv_rest, 'oadv_rest) gpv\" and\n cnv_usr :: \"'s_usr \\ 'iusr \\ ('ousr \\ 's_usr, 'iusr_rest, 'ousr_rest) gpv\" and\n f_init :: \"'more \\ 'more'\" and\n rest :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\"\nbegin\n\nprimcorec \n attach_rest :: \"\n (('s_adv \\ 's_usr) \\ 's_rest, 'event, 'iadv, 'iusr, 'oadv, 'ousr, 'more') rest_scheme\"\n where\n \"rinit attach_rest = f_init (rinit rest)\"\n | \"rfunc_adv attach_rest = (\\((s_adv, s_usr), s_rest) iadv.\n let orc_of = \\orc (s, es) q. map_spmf (\\ ((out, e), s'). (out, s', es @ e)) (orc s q) in\n let eorc_of = \\((oadv, s_adv'), (s_rest', es)). ((oadv, es), ((s_adv', s_usr), s_rest')) in\n map_spmf eorc_of (exec_gpv (orc_of (rfunc_adv rest)) (cnv_adv s_adv iadv) (s_rest, [])))\"\n | \"rfunc_usr attach_rest = (\\((s_adv, s_usr), s_rest) iusr. \n let orc_of = \\orc (s, es) q. map_spmf (\\ ((out, e), s'). (out, s', es @ e)) (orc s q) in\n let eorc_of = \\((ousr, s_usr'), (s_rest', es)). ((ousr, es), ((s_adv, s_usr'), s_rest')) in\n map_spmf eorc_of (exec_gpv (orc_of (rfunc_usr rest)) (cnv_usr s_usr iusr) (s_rest, [])))\"\n \nend\n\n\nlemma \n attach_rest_id_oracle_adv: \"rfunc_adv (attach_rest 1\\<^sub>I cnv f_init rest) = \n (\\(s_cnv, s_core) q. map_spmf (\\(out, s_core'). (out, s_cnv, s_core')) (rfunc_adv rest s_core q))\"\n by(simp add: id_oracle_def split_def map_spmf_conv_bind_spmf fun_eq_iff) \n\nlemma\n attach_rest_id_oracle_usr: \"rfunc_usr (attach_rest cnv 1\\<^sub>I f_init rest) = \n (\\(s_cnv, s_core) q. map_spmf (\\(out, s_core'). (out, s_cnv, s_core')) (rfunc_usr rest s_core q))\"\n by(simp add: id_oracle_def split_def map_spmf_conv_bind_spmf) \n\n\n\nsection \\Traces\\\n\ntype_synonym ('event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) trace_core =\n \"('event + 'iadv_core \\ 'oadv_core + 'iusr_core \\ 'ousr_core) list \n \\ ('event \\ real)\n \\ ('iadv_core \\ 'oadv_core spmf) \n \\ ('iusr_core \\ 'ousr_core spmf)\"\n\ncontext \n fixes core :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\nbegin\n\nprimrec trace_core' :: \"'s_core spmf \\ ('event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) trace_core\" where\n \"trace_core' S [] = \n (\\e. weight_spmf' (bind_spmf S (\\s. cpoke core s e)),\n \\ia. bind_spmf S (\\s. map_spmf fst (cfunc_adv core s ia)),\n \\iu. bind_spmf S (\\s. map_spmf fst (cfunc_usr core s iu)))\"\n| \"trace_core' S (obs # tr) = (case obs of\n Inl e \\ trace_core' (mk_lossless (bind_spmf S (\\s. cpoke core s e))) tr\n | Inr (Inl (ia, oa)) \\ trace_core' (cond_spmf_fst (bind_spmf S (\\s. cfunc_adv core s ia)) oa) tr\n | Inr (Inr (iu, ou)) \\ trace_core' (cond_spmf_fst (bind_spmf S (\\s. cfunc_usr core s iu)) ou) tr\n )\"\n\nend\n\ndeclare trace_core'.simps [simp del]\ncase_of_simps trace_core'_unfold: trace_core'.simps[unfolded weight_spmf'_def]\nsimps_of_case trace_core'_simps [simp]: trace_core'_unfold\n\ncontext includes lifting_syntax begin\n\nlemma trace_core'_parametric [transfer_rule]:\n \"(rel_core' S E IA IU (=) (=) ===>\n rel_spmf S ===>\n list_all2 (rel_sum E (rel_sum (rel_prod IA (=)) (rel_prod IU (=)))) ===>\n rel_prod (E ===> (=)) (rel_prod (IA ===> (=)) (IU ===> (=))))\n trace_core' trace_core'\"\n unfolding trace_core'_def by transfer_prover\n\ndefinition trace_core_eq \n :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\n \\ ('s_core', 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\n \\ 'event set \\ 'iadv_core set \\ 'iusr_core set\n \\ 's_core spmf \\ 's_core' spmf \\ bool\" where\n \"trace_core_eq core1 core2 E IA IU p q \\\n (\\tr. set tr \\ E <+> (IA \\ UNIV) <+> (IU \\ UNIV) \\ \n rel_prod (eq_onp (\\e. e \\ E) ===> (=)) (rel_prod (eq_onp (\\ia. ia \\ IA) ===> (=)) (eq_onp (\\iu. iu \\ IU) ===> (=)))\n (trace_core' core1 p tr) (trace_core' core2 q tr))\"\n\nend\n\nlemma trace_core_eqD:\n assumes \"trace_core_eq core1 core2 E IA IU p q\"\n and \"set tr \\ E <+> (IA \\ UNIV) <+> (IU \\ UNIV)\"\n shows trace_core_eqD_cpoke: \n \"e \\ E \\ fst (trace_core' core1 p tr) e = fst (trace_core' core2 q tr) e\"\n and trace_core_eqD_cfunc_adv: \n \"ia \\ IA \\ fst (snd (trace_core' core1 p tr)) ia = fst (snd (trace_core' core2 q tr)) ia\"\n and trace_core_eqD_cfunc_usr:\n \"iu \\ IU \\ snd (snd (trace_core' core1 p tr)) iu = snd (snd (trace_core' core2 q tr)) iu\"\n using assms by(auto simp add: trace_core_eq_def rel_fun_def eq_onp_def rel_prod_sel)\n\nlemma trace_core_eqI:\n assumes \"\\tr e. \\ set tr \\ E <+> (IA \\ UNIV) <+> (IU \\ UNIV); e \\ E \\ \n \\ fst (trace_core' core1 p tr) e = fst (trace_core' core2 q tr) e\"\n and \"\\tr ia. \\ set tr \\ E <+> (IA \\ UNIV) <+> (IU \\ UNIV); ia \\ IA \\\n \\ fst (snd (trace_core' core1 p tr)) ia = fst (snd (trace_core' core2 q tr)) ia\"\n and \"\\tr iu. \\ set tr \\ E <+> (IA \\ UNIV) <+> (IU \\ UNIV); iu \\ IU \\\n \\ snd (snd (trace_core' core1 p tr)) iu = snd (snd (trace_core' core2 q tr)) iu\"\n shows \"trace_core_eq core1 core2 E IA IU p q\"\n using assms by(auto simp add: trace_core_eq_def rel_fun_def eq_onp_def rel_prod_sel)\n\nlemma trace_core_return_pmf_None [simp]:\n \"trace_core' core (return_pmf None) tr = (\\_. 0, \\_. return_pmf None, \\_. return_pmf None)\"\n by(induction tr)(simp_all add: trace_core'.simps split: sum.split)\n\nlemma rel_core'_into_trace_core_eq: \"trace_core_eq core core' E IA IU p q\" \n if \"rel_core' S (eq_onp (\\e. e \\ E)) (eq_onp (\\ia. ia \\ IA)) (eq_onp (\\iu. iu \\ IU)) (=) (=) core core'\"\n \"rel_spmf S p q\"\n using trace_core'_parametric[THEN rel_funD, THEN rel_funD, OF that]\n unfolding trace_core_eq_def\n apply(intro strip)\n subgoal for tr\n apply(simp add: eq_onp_True[symmetric] prod.rel_eq_onp sum.rel_eq_onp list.rel_eq_onp)\n apply(auto 4 3 simp add: eq_onp_def list_all_iff dest: rel_funD[where x=tr and y=tr])\n done\n done\n\nlemma trace_core_eq_simI:\n fixes core1 :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and core2 :: \"('s_core', 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and S :: \"'s_core spmf \\ 's_core' spmf \\ bool\"\n assumes start: \"S p q\"\n and step_cpoke: \"\\p q e. \\ S p q; e \\ E \\ \\ \n weight_spmf (bind_spmf p (\\s. cpoke core1 s e)) = weight_spmf (bind_spmf q (\\s. cpoke core2 s e))\"\n and sim_cpoke: \"\\p q e. \\ S p q; e \\ E \\ \\ \n S (mk_lossless (bind_spmf p (\\s. cpoke core1 s e))) (mk_lossless (bind_spmf q (\\s. cpoke core2 s e)))\"\n and step_cfunc_adv: \"\\p q ia. \\ S p q; ia \\ IA \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_adv core1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (cfunc_adv core2 s2 ia))\"\n and sim_cfunc_adv: \"\\p q ia s1 s2 s1' s2' oa. \\ S p q; ia \\ IA; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (oa, s1') \\ set_spmf (cfunc_adv core1 s1 ia); (oa, s2') \\ set_spmf (cfunc_adv core2 s2 ia) \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_adv core1 s1 ia)) oa) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_adv core2 s2 ia)) oa)\"\n and step_cfunc_usr: \"\\p q iu. \\ S p q; iu \\ IU \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_usr core1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (cfunc_usr core2 s2 iu))\"\n and sim_cfunc_usr: \"\\p q iu s1 s2 s1' s2' ou. \\ S p q; iu \\ IU; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (ou, s1') \\ set_spmf (cfunc_usr core1 s1 iu); (ou, s2') \\ set_spmf (cfunc_usr core2 s2 iu) \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_usr core1 s1 iu)) ou) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_usr core2 s2 iu)) ou)\"\n shows \"trace_core_eq core1 core2 E IA IU p q\"\nproof(rule trace_core_eqI)\n fix tr :: \" ('event + 'iadv_core \\ 'oadv_core + 'iusr_core \\ 'ousr_core) list\"\n assume \"set tr \\ E <+> IA \\ UNIV <+> IU \\ UNIV\"\n then have \"(\\e\\E. fst (trace_core' core1 p tr) e = fst (trace_core' core2 q tr) e) \\\n (\\ia\\IA. fst (snd (trace_core' core1 p tr)) ia = fst (snd (trace_core' core2 q tr)) ia) \\\n (\\iu\\IU. snd (snd (trace_core' core1 p tr)) iu = snd (snd (trace_core' core2 q tr)) iu)\"\n using start\n proof(induction tr arbitrary: p q)\n case Nil\n then show ?case by(simp add: step_cpoke step_cfunc_adv step_cfunc_usr)\n next\n case (Cons a tr)\n from Cons.prems(1) have tr: \"set tr \\ E <+> IA \\ UNIV <+> IU \\ UNIV\" by simp\n from Cons.prems(1)\n consider (cpoke) e where \"a = Inl e\" \"e \\ E\"\n | (cfunc_adv) ia oa where \"a = Inr (Inl (ia, oa))\" \"ia \\ IA\"\n | (cfunc_usr) iu ou where \"a = Inr (Inr (iu, ou))\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case cpoke\n then show ?thesis using tr Cons.prems(2) by(auto simp add: sim_cpoke intro!: Cons.IH)\n next\n case cfunc_adv\n let ?p = \"bind_spmf p (\\s1. cfunc_adv core1 s1 ia)\"\n let ?q = \"bind_spmf q (\\s2. cfunc_adv core2 s2 ia)\"\n show ?thesis\n proof(cases \"oa \\ fst ` set_spmf ?p\")\n case True\n with step_cfunc_adv[OF Cons.prems(2) cfunc_adv(2), THEN arg_cong[where f=set_spmf]]\n have \"oa \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def)\n then show ?thesis using True Cons.prems cfunc_adv\n by(clarsimp)(rule Cons.IH; blast intro: sim_cfunc_adv)\n next\n case False\n hence \"cond_spmf_fst ?p oa = return_pmf None\" by simp\n moreover\n from step_cfunc_adv[OF Cons.prems(2) cfunc_adv(2), THEN arg_cong[where f=set_spmf]] False\n have oa': \"oa \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def) simp\n hence \"cond_spmf_fst ?q oa = return_pmf None\" by simp\n ultimately show ?thesis using cfunc_adv by(simp del: cond_spmf_fst_eq_return_None)\n qed\n next\n case cfunc_usr\n let ?p = \"bind_spmf p (\\s1. cfunc_usr core1 s1 iu)\"\n let ?q = \"bind_spmf q (\\s2. cfunc_usr core2 s2 iu)\"\n show ?thesis\n proof(cases \"ou \\ fst ` set_spmf ?p\")\n case True\n with step_cfunc_usr[OF Cons.prems(2) cfunc_usr(2), THEN arg_cong[where f=set_spmf]]\n have \"ou \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def)\n then show ?thesis using True Cons.prems cfunc_usr\n by(clarsimp)(rule Cons.IH; blast intro: sim_cfunc_usr)\n next\n case False\n hence \"cond_spmf_fst ?p ou = return_pmf None\" by simp\n moreover\n from step_cfunc_usr[OF Cons.prems(2) cfunc_usr(2), THEN arg_cong[where f=set_spmf]] False\n have oa': \"ou \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def) simp\n hence \"cond_spmf_fst ?q ou = return_pmf None\" by simp\n ultimately show ?thesis using cfunc_usr by(simp del: cond_spmf_fst_eq_return_None)\n qed\n qed\n qed\n then show \"e \\ E \\ fst (trace_core' core1 p tr) e = fst (trace_core' core2 q tr) e\"\n and \"ia \\ IA \\ fst (snd (trace_core' core1 p tr)) ia = fst (snd (trace_core' core2 q tr)) ia\"\n and \"iu \\ IU \\ snd (snd (trace_core' core1 p tr)) iu = snd (snd (trace_core' core2 q tr)) iu\"\n for e ia iu by blast+\nqed\n\ncontext \n fixes core :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\nbegin\n\nfun trace_core_aux \n :: \"'s_core spmf \\ ('event + 'iadv_core \\ 'oadv_core + 'iusr_core \\ 'ousr_core) list \\ 's_core spmf\" where\n \"trace_core_aux p [] = p\"\n| \"trace_core_aux p (Inl e # tr) = trace_core_aux (mk_lossless (bind_spmf p (\\s. cpoke core s e))) tr\"\n| \"trace_core_aux p (Inr (Inl (ia, oa)) # tr) = trace_core_aux (cond_spmf_fst (bind_spmf p (\\s. cfunc_adv core s ia)) oa) tr\"\n| \"trace_core_aux p (Inr (Inr (iu, ou)) # tr) = trace_core_aux (cond_spmf_fst (bind_spmf p (\\s. cfunc_usr core s iu)) ou) tr\"\n\nend\n\nlemma trace_core_conv_trace_core_aux:\n \"trace_core' core p tr = \n (\\e. weight_spmf (bind_spmf (trace_core_aux core p tr) (\\s. cpoke core s e)),\n \\ia. bind_spmf (trace_core_aux core p tr) (\\s. map_spmf fst (cfunc_adv core s ia)),\n \\iu. bind_spmf (trace_core_aux core p tr) (\\s. map_spmf fst (cfunc_usr core s iu)))\"\n by(induction p tr rule: trace_core_aux.induct) simp_all\n\nlemma trace_core_aux_append:\n \"trace_core_aux core p (tr @ tr') = trace_core_aux core (trace_core_aux core p tr) tr'\"\n by(induction p tr rule: trace_core_aux.induct) auto\n\ninductive trace_core_closure \n :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\n \\ ('s_core', 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\n \\ 'event set \\ 'iadv_core set \\ 'iusr_core set\n \\ 's_core spmf \\ 's_core' spmf \\ 's_core spmf \\ 's_core' spmf \\ bool\"\n for core1 core2 E IA IU p q where\n \"trace_core_closure core1 core2 E IA IU p q (trace_core_aux core1 p tr) (trace_core_aux core2 q tr)\"\n if \"set tr \\ E <+> IA \\ UNIV <+> IU \\ UNIV\"\n\nlemma trace_core_closure_start: \"trace_core_closure core1 core2 E IA IU p q p q\"\n by(simp add: trace_core_closure.simps exI[where x=\"[]\"])\n\nlemma trace_core_closure_step:\n assumes \"trace_core_eq core1 core2 E IA IU p q\"\n and \"trace_core_closure core1 core2 E IA IU p q p' q'\"\n shows trace_core_closure_step_cpoke:\n \"e \\ E \\ weight_spmf (bind_spmf p' (\\s. cpoke core1 s e)) = weight_spmf (bind_spmf q' (\\s. cpoke core2 s e))\"\n (is \"PROP ?thesis1\")\n and trace_core_closure_step_cfunc_adv: \n \"ia \\ IA \\ bind_spmf p' (\\s1. map_spmf fst (cfunc_adv core1 s1 ia)) = bind_spmf q' (\\s2. map_spmf fst (cfunc_adv core2 s2 ia))\"\n (is \"PROP ?thesis2\")\n and trace_core_closure_step_cfunc_usr:\n \"iu \\ IU \\ bind_spmf p' (\\s1. map_spmf fst (cfunc_usr core1 s1 iu)) = bind_spmf q' (\\s2. map_spmf fst (cfunc_usr core2 s2 iu))\"\n (is \"PROP ?thesis3\")\nproof -\n from assms(2) obtain tr where p: \"p' = trace_core_aux core1 p tr\"\n and q: \"q' = trace_core_aux core2 q tr\"\n and tr: \"set tr \\ E <+> IA \\ UNIV <+> IU \\ UNIV\" by cases\n from trace_core_eqD[OF assms(1) tr] p q\n show \"PROP ?thesis1\" and \"PROP ?thesis2\" \"PROP ?thesis3\"\n by(simp_all add: trace_core_conv_trace_core_aux)\nqed\n\nlemma trace_core_closure_sim:\n fixes core1 core2 E IA IU p q\n defines \"S \\ trace_core_closure core1 core2 E IA IU p q\"\n assumes \"S p' q'\"\n shows trace_core_closure_sim_cpoke:\n \"e \\ E \\ S (mk_lossless (bind_spmf p' (\\s. cpoke core1 s e))) (mk_lossless (bind_spmf q' (\\s. cpoke core2 s e)))\"\n (is \"PROP ?thesis1\")\n and trace_core_closure_sim_cfunc_adv: \"ia \\ IA \n \\ S (cond_spmf_fst (bind_spmf p' (\\s1. cfunc_adv core1 s1 ia)) oa) \n (cond_spmf_fst (bind_spmf q' (\\s2. cfunc_adv core2 s2 ia)) oa)\"\n (is \"PROP ?thesis2\")\n and trace_core_closure_sim_cfunc_usr: \"iu \\ IU \n \\ S (cond_spmf_fst (bind_spmf p' (\\s1. cfunc_usr core1 s1 iu)) ou)\n (cond_spmf_fst (bind_spmf q' (\\s2. cfunc_usr core2 s2 iu)) ou)\"\n (is \"PROP ?thesis3\")\nproof -\n from assms(2) obtain tr where p: \"p' = trace_core_aux core1 p tr\"\n and q: \"q' = trace_core_aux core2 q tr\"\n and tr: \"set tr \\ E <+> IA \\ UNIV <+> IU \\ UNIV\" unfolding S_def by cases\n show \"PROP ?thesis1\" using p q tr\n by(auto simp add: S_def trace_core_closure.simps trace_core_aux_append intro!: exI[where x=\"tr @ [Inl _]\"])\n show \"PROP ?thesis2\" using p q tr\n by(auto simp add: S_def trace_core_closure.simps trace_core_aux_append intro!: exI[where x=\"tr @ [Inr (Inl (_, _))]\"])\n show \"PROP ?thesis3\" using p q tr\n by(auto simp add: S_def trace_core_closure.simps trace_core_aux_append intro!: exI[where x=\"tr @ [Inr (Inr (_, _))]\"])\nqed\n\nproposition trace_core_eq_complete:\n assumes \"trace_core_eq core1 core2 E IA IU p q\"\n obtains S\n where \"S p q\"\n and \"\\p q e. \\ S p q; e \\ E \\ \\ \n weight_spmf (bind_spmf p (\\s. cpoke core1 s e)) = weight_spmf (bind_spmf q (\\s. cpoke core2 s e))\"\n and \"\\p q e. \\ S p q; e \\ E \\ \\ \n S (mk_lossless (bind_spmf p (\\s. cpoke core1 s e))) (mk_lossless (bind_spmf q (\\s. cpoke core2 s e)))\"\n and \"\\p q ia. \\ S p q; ia \\ IA \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_adv core1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (cfunc_adv core2 s2 ia))\"\n and \"\\p q ia oa. \\ S p q; ia \\ IA \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_adv core1 s1 ia)) oa) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_adv core2 s2 ia)) oa)\"\n and \"\\p q iu. \\ S p q; iu \\ IU \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_usr core1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (cfunc_usr core2 s2 iu))\"\n and \"\\p q iu ou. \\ S p q; iu \\ IU \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_usr core1 s1 iu)) ou) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_usr core2 s2 iu)) ou)\"\nproof -\n show thesis\n by(rule that[where S=\"trace_core_closure core1 core2 E IA IU p q\"])\n (auto intro: trace_core_closure_start trace_core_closure_step[OF assms] trace_core_closure_sim (* trace_core_closure_weight[OF assms] *))\nqed\n\n\n\ntype_synonym ('event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) trace_rest =\n \"('iadv_rest \\ 'oadv_rest \\ 'event list + 'iusr_rest \\ 'ousr_rest \\ 'event list) list\n \\ ('iadv_rest \\ ('oadv_rest \\ 'event list) spmf) \n \\ ('iusr_rest \\ ('ousr_rest \\ 'event list) spmf)\"\n\ncontext\n fixes rest :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\"\nbegin\n\nprimrec trace_rest' :: \"'s_rest spmf \\ ('event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) trace_rest\" where\n \"trace_rest' S [] =\n (\\ia. bind_spmf S (\\s. map_spmf fst (rfunc_adv rest s ia)),\n \\iu. bind_spmf S (\\s. map_spmf fst (rfunc_usr rest s iu)))\"\n| \"trace_rest' S (obs # tr) = (case obs of\n Inl (ia, oa) \\ trace_rest' (cond_spmf_fst (bind_spmf S (\\s. rfunc_adv rest s ia)) oa) tr\n | Inr (iu, ou) \\ trace_rest' (cond_spmf_fst (bind_spmf S (\\s. rfunc_usr rest s iu)) ou) tr)\"\n\nend\n\ndeclare trace_rest'.simps [simp del]\ncase_of_simps trace_rest'_unfold: trace_rest'.simps\nsimps_of_case trace_rest'_simps [simp]: trace_rest'_unfold\n\ncontext includes lifting_syntax begin\n\nlemma trace_rest'_parametric [transfer_rule]:\n \"(rel_rest' S (=) IA IU (=) (=) M ===> rel_spmf S ===>\n list_all2 (rel_sum (rel_prod IA (=)) (rel_prod IU (=))) ===>\n rel_prod (IA ===> (=)) (IU ===> (=)))\n trace_rest' trace_rest'\"\n unfolding trace_rest'_def by transfer_prover\n\ndefinition trace_rest_eq\n :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more1) rest_scheme\n \\ ('s_rest', 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more2) rest_scheme\n \\ 'iadv_rest set \\ 'iusr_rest set\n \\ 's_rest spmf \\ 's_rest' spmf \\ bool\" where\n \"trace_rest_eq rest1 rest2 IA IU p q \\\n (\\tr. set tr \\ (IA \\ UNIV) <+> (IU \\ UNIV) \\\n rel_prod (eq_onp (\\ia. ia \\ IA) ===> (=)) (eq_onp (\\iu. iu \\ IU) ===> (=))\n (trace_rest' rest1 p tr) (trace_rest' rest2 q tr))\"\n\nend\n\nlemma trace_rest_eqD:\n assumes \"trace_rest_eq rest1 rest2 IA IU p q\"\n and \"set tr \\ (IA \\ UNIV) <+> (IU \\ UNIV)\"\n shows trace_rest_eqD_rfunc_adv:\n \"ia \\ IA \\ fst (trace_rest' rest1 p tr) ia = fst (trace_rest' rest2 q tr) ia\"\n and trace_rest_eqD_rfunc_usr:\n \"iu \\ IU \\ snd (trace_rest' rest1 p tr) iu = snd (trace_rest' rest2 q tr) iu\"\n using assms by(auto simp add: trace_rest_eq_def rel_fun_def rel_prod_sel eq_onp_def)\n\nlemma trace_rest_eqI:\n assumes \"\\tr ia. \\ set tr \\ (IA \\ UNIV) <+> (IU \\ UNIV); ia \\ IA \\\n \\ fst (trace_rest' rest1 p tr) ia = fst (trace_rest' rest2 q tr) ia\"\n and \"\\tr iu. \\ set tr \\ (IA \\ UNIV) <+> (IU \\ UNIV); iu \\ IU \\\n \\ snd (trace_rest' rest1 p tr) iu = snd (trace_rest' rest2 q tr) iu\"\n shows \"trace_rest_eq rest1 rest2 IA IU p q\"\n using assms by(auto simp add: trace_rest_eq_def rel_fun_def eq_onp_def rel_prod_sel)\n\nlemma trace_rest_return_pmf_None [simp]:\n \"trace_rest' rest (return_pmf None) tr = (\\_. return_pmf None, \\_. return_pmf None)\"\n by(induction tr)(simp_all add: trace_rest'.simps split: sum.split)\n\nlemma rel_rest'_into_trace_rest_eq: \"trace_rest_eq rest rest' IA IU p q\" \n if \"rel_rest' S (=) (eq_onp (\\ia. ia \\ IA)) (eq_onp (\\iu. iu \\ IU)) (=) (=) M rest rest'\"\n \"rel_spmf S p q\"\n using trace_rest'_parametric[THEN rel_funD, THEN rel_funD, OF that]\n unfolding trace_rest_eq_def\n apply(intro strip)\n subgoal for tr\n apply(simp add: eq_onp_True[symmetric] prod.rel_eq_onp sum.rel_eq_onp list.rel_eq_onp)\n apply(auto 4 3 simp add: eq_onp_def list_all_iff dest: rel_funD[where x=tr and y=tr])\n done\n done\n\nlemma trace_rest_eq_simI:\n fixes rest1 :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\"\n and rest2 :: \"('s_rest', 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\"\n and S :: \"'s_rest spmf \\ 's_rest' spmf \\ bool\"\n assumes start: \"S p q\"\n and step_rfunc_adv: \"\\p q ia. \\ S p q; ia \\ IA \\ \\ \n bind_spmf p (\\s1. map_spmf fst (rfunc_adv rest1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (rfunc_adv rest2 s2 ia))\"\n and sim_rfunc_adv: \"\\p q ia s1 s2 s1' s2' oa. \\ S p q; ia \\ IA; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (oa, s1') \\ set_spmf (rfunc_adv rest1 s1 ia); (oa, s2') \\ set_spmf (rfunc_adv rest2 s2 ia) \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. rfunc_adv rest1 s1 ia)) oa) (cond_spmf_fst (bind_spmf q (\\s2. rfunc_adv rest2 s2 ia)) oa)\"\n and step_rfunc_usr: \"\\p q iu. \\ S p q; iu \\ IU \\ \\ \n bind_spmf p (\\s1. map_spmf fst (rfunc_usr rest1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (rfunc_usr rest2 s2 iu))\"\n and sim_rfunc_usr: \"\\p q iu s1 s2 s1' s2' ou. \\ S p q; iu \\ IU; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (ou, s1') \\ set_spmf (rfunc_usr rest1 s1 iu); (ou, s2') \\ set_spmf (rfunc_usr rest2 s2 iu) \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. rfunc_usr rest1 s1 iu)) ou) (cond_spmf_fst (bind_spmf q (\\s2. rfunc_usr rest2 s2 iu)) ou)\"\n shows \"trace_rest_eq rest1 rest2 IA IU p q\"\nproof(rule trace_rest_eqI)\n fix tr :: \"('iadv_rest \\ 'oadv_rest \\ 'event list + 'iusr_rest \\ 'ousr_rest \\ 'event list) list\"\n assume \"set tr \\ IA \\ UNIV <+> IU \\ UNIV\"\n then have \"(\\ia\\IA. fst (trace_rest' rest1 p tr) ia = fst (trace_rest' rest2 q tr) ia) \\\n (\\iu\\IU. snd (trace_rest' rest1 p tr) iu = snd (trace_rest' rest2 q tr) iu)\"\n using start\n proof(induction tr arbitrary: p q)\n case Nil\n then show ?case by(simp add: step_rfunc_adv step_rfunc_usr)\n next\n case (Cons a tr)\n from Cons.prems(1) have tr: \"set tr \\ IA \\ UNIV <+> IU \\ UNIV\" by simp\n from Cons.prems(1)\n consider (rfunc_adv) ia oa where \"a = Inl (ia, oa)\" \"ia \\ IA\"\n | (rfunc_usr) iu ou where \"a = Inr (iu, ou)\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case rfunc_adv\n let ?p = \"bind_spmf p (\\s1. rfunc_adv rest1 s1 ia)\"\n let ?q = \"bind_spmf q (\\s2. rfunc_adv rest2 s2 ia)\"\n show ?thesis\n proof(cases \"oa \\ fst ` set_spmf ?p\")\n case True\n with step_rfunc_adv[OF Cons.prems(2) rfunc_adv(2), THEN arg_cong[where f=set_spmf]]\n have \"oa \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def)\n then show ?thesis using True Cons.prems rfunc_adv\n by(clarsimp)(rule Cons.IH; blast intro: sim_rfunc_adv)\n next\n case False\n hence \"cond_spmf_fst ?p oa = return_pmf None\" by simp\n moreover\n from step_rfunc_adv[OF Cons.prems(2) rfunc_adv(2), THEN arg_cong[where f=set_spmf]] False\n have oa': \"oa \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def) simp\n hence \"cond_spmf_fst ?q oa = return_pmf None\" by simp\n ultimately show ?thesis using rfunc_adv by(simp del: cond_spmf_fst_eq_return_None)\n qed\n next\n case rfunc_usr\n let ?p = \"bind_spmf p (\\s1. rfunc_usr rest1 s1 iu)\"\n let ?q = \"bind_spmf q (\\s2. rfunc_usr rest2 s2 iu)\"\n show ?thesis\n proof(cases \"ou \\ fst ` set_spmf ?p\")\n case True\n with step_rfunc_usr[OF Cons.prems(2) rfunc_usr(2), THEN arg_cong[where f=set_spmf]]\n have \"ou \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def)\n then show ?thesis using True Cons.prems rfunc_usr\n by(clarsimp)(rule Cons.IH; blast intro: sim_rfunc_usr)\n next\n case False\n hence \"cond_spmf_fst ?p ou = return_pmf None\" by simp\n moreover\n from step_rfunc_usr[OF Cons.prems(2) rfunc_usr(2), THEN arg_cong[where f=set_spmf]] False\n have oa': \"ou \\ fst ` set_spmf ?q\"\n unfolding set_map_spmf[symmetric] by(simp only: map_bind_spmf o_def) simp\n hence \"cond_spmf_fst ?q ou = return_pmf None\" by simp\n ultimately show ?thesis using rfunc_usr by(simp del: cond_spmf_fst_eq_return_None)\n qed\n qed\n qed\n then show \"ia \\ IA \\ fst (trace_rest' rest1 p tr) ia = fst (trace_rest' rest2 q tr) ia\"\n and \"iu \\ IU \\ snd (trace_rest' rest1 p tr) iu = snd (trace_rest' rest2 q tr) iu\"\n for ia iu by blast+\nqed\n\ncontext \n fixes rest :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\"\nbegin\n\nfun trace_rest_aux \n :: \"'s_rest spmf \\ ('iadv_rest \\ 'oadv_rest \\ 'event list + 'iusr_rest \\ 'ousr_rest \\ 'event list) list \\ 's_rest spmf\" where\n \"trace_rest_aux p [] = p\"\n| \"trace_rest_aux p (Inl (ia, oaes) # tr) = trace_rest_aux (cond_spmf_fst (bind_spmf p (\\s. rfunc_adv rest s ia)) oaes) tr\"\n| \"trace_rest_aux p (Inr (iu, oues) # tr) = trace_rest_aux (cond_spmf_fst (bind_spmf p (\\s. rfunc_usr rest s iu)) oues) tr\"\n\nend\n\nlemma trace_rest_conv_trace_rest_aux:\n \"trace_rest' rest p tr = \n (\\ia. bind_spmf (trace_rest_aux rest p tr) (\\s. map_spmf fst (rfunc_adv rest s ia)),\n \\iu. bind_spmf (trace_rest_aux rest p tr) (\\s. map_spmf fst (rfunc_usr rest s iu)))\"\n by(induction p tr rule: trace_rest_aux.induct) simp_all\n\nlemma trace_rest_aux_append:\n \"trace_rest_aux rest p (tr @ tr') = trace_rest_aux rest (trace_rest_aux rest p tr) tr'\"\n by(induction p tr rule: trace_rest_aux.induct) auto\n\ninductive trace_rest_closure \n :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\n \\ ('s_rest', 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more') rest_scheme\n \\ 'iadv_rest set \\ 'iusr_rest set\n \\ 's_rest spmf \\ 's_rest' spmf \\ 's_rest spmf \\ 's_rest' spmf \\ bool\"\n for rest1 rest2 IA IU p q where\n \"trace_rest_closure rest1 rest2 IA IU p q (trace_rest_aux rest1 p tr) (trace_rest_aux rest2 q tr)\"\n if \"set tr \\ IA \\ UNIV <+> IU \\ UNIV\"\n\nlemma trace_rest_closure_start: \"trace_rest_closure rest1 rest2 IA IU p q p q\"\n by(simp add: trace_rest_closure.simps exI[where x=\"[]\"])\n\nlemma trace_rest_closure_step:\n assumes \"trace_rest_eq rest1 rest2 IA IU p q\"\n and \"trace_rest_closure rest1 rest2 IA IU p q p' q'\"\n shows trace_rest_closure_step_rfunc_adv: \n \"ia \\ IA \\ bind_spmf p' (\\s1. map_spmf fst (rfunc_adv rest1 s1 ia)) = bind_spmf q' (\\s2. map_spmf fst (rfunc_adv rest2 s2 ia))\"\n (is \"PROP ?thesis1\")\n and trace_rest_closure_step_rfunc_usr:\n \"iu \\ IU \\ bind_spmf p' (\\s1. map_spmf fst (rfunc_usr rest1 s1 iu)) = bind_spmf q' (\\s2. map_spmf fst (rfunc_usr rest2 s2 iu))\"\n (is \"PROP ?thesis2\")\nproof -\n from assms(2) obtain tr where p: \"p' = trace_rest_aux rest1 p tr\"\n and q: \"q' = trace_rest_aux rest2 q tr\"\n and tr: \"set tr \\ IA \\ UNIV <+> IU \\ UNIV\" by cases\n from trace_rest_eqD[OF assms(1) tr] p q\n show \"PROP ?thesis1\" and \"PROP ?thesis2\"\n by(simp_all add: trace_rest_conv_trace_rest_aux)\nqed\n\nlemma trace_rest_closure_sim:\n fixes rest1 rest2 IA IU p q\n defines \"S \\ trace_rest_closure rest1 rest2 IA IU p q\"\n assumes \"S p' q'\"\n shows trace_rest_closure_sim_rfunc_adv: \"ia \\ IA \n \\ S (cond_spmf_fst (bind_spmf p' (\\s1. rfunc_adv rest1 s1 ia)) oa) \n (cond_spmf_fst (bind_spmf q' (\\s2. rfunc_adv rest2 s2 ia)) oa)\"\n (is \"PROP ?thesis1\")\n and trace_rest_closure_sim_rfunc_usr: \"iu \\ IU \n \\ S (cond_spmf_fst (bind_spmf p' (\\s1. rfunc_usr rest1 s1 iu)) ou)\n (cond_spmf_fst (bind_spmf q' (\\s2. rfunc_usr rest2 s2 iu)) ou)\"\n (is \"PROP ?thesis2\")\nproof -\n from assms(2) obtain tr where p: \"p' = trace_rest_aux rest1 p tr\"\n and q: \"q' = trace_rest_aux rest2 q tr\"\n and tr: \"set tr \\ IA \\ UNIV <+> IU \\ UNIV\" unfolding S_def by cases\n show \"PROP ?thesis1\" using p q tr\n by(auto simp add: S_def trace_rest_closure.simps trace_rest_aux_append intro!: exI[where x=\"tr @ [Inl (_, _)]\"])\n show \"PROP ?thesis2\" using p q tr\n by(auto simp add: S_def trace_rest_closure.simps trace_rest_aux_append intro!: exI[where x=\"tr @ [Inr (_, _)]\"])\nqed\n\nproposition trace_rest_eq_complete:\n assumes \"trace_rest_eq rest1 rest2 IA IU p q\"\n obtains S\n where \"S p q\"\n and \"\\p q ia. \\ S p q; ia \\ IA \\ \\ \n bind_spmf p (\\s1. map_spmf fst (rfunc_adv rest1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (rfunc_adv rest2 s2 ia))\"\n and \"\\p q ia oa. \\ S p q; ia \\ IA \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. rfunc_adv rest1 s1 ia)) oa) (cond_spmf_fst (bind_spmf q (\\s2. rfunc_adv rest2 s2 ia)) oa)\"\n and \"\\p q iu. \\ S p q; iu \\ IU \\ \\ \n bind_spmf p (\\s1. map_spmf fst (rfunc_usr rest1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (rfunc_usr rest2 s2 iu))\"\n and \"\\p q iu ou. \\ S p q; iu \\ IU \\\n \\ S (cond_spmf_fst (bind_spmf p (\\s1. rfunc_usr rest1 s1 iu)) ou) (cond_spmf_fst (bind_spmf q (\\s2. rfunc_usr rest2 s2 iu)) ou)\"\nproof -\n show thesis\n by(rule that[where S=\"trace_rest_closure rest1 rest2 IA IU p q\"])\n (auto intro: trace_rest_closure_start trace_rest_closure_step[OF assms] trace_rest_closure_sim (* trace_rest_closure_weight[OF assms] *))\nqed\n\ndefinition callee_of_core\n :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\n \\ ('s_core, 'event + 'iadv_core + 'iusr_core, unit + 'oadv_core + 'ousr_core) oracle'\" where\n \"callee_of_core core =\n map_fun id (map_fun id (map_spmf (Pair ()))) (cpoke core) \\\\<^sub>O cfunc_adv core \\\\<^sub>O cfunc_usr core\"\n\nlemma callee_of_core_simps [simp]:\n \"callee_of_core core s (Inl e) = map_spmf (Pair (Inl ())) (cpoke core s e)\"\n \"callee_of_core core s (Inr (Inl iadv_core)) = map_spmf (apfst (Inr \\ Inl)) (cfunc_adv core s iadv_core)\"\n \"callee_of_core core s (Inr (Inr iusr_core)) = map_spmf (apfst (Inr \\ Inr)) (cfunc_usr core s iusr_core)\"\n by(simp_all add: callee_of_core_def spmf.map_comp o_def apfst_def prod.map_comp id_def)\n\nlemma WT_callee_of_core [WT_intro]:\n assumes WT: \"WT_core \\_adv \\_usr I core\"\n and I: \"I s\"\n shows \"\\_full \\\\<^sub>\\ (\\_adv \\\\<^sub>\\ \\_usr) \\c callee_of_core core s \\\"\n apply(rule WT_calleeI)\n subgoal for x y s' using I WT_coreD[OF WT]\n by(auto simp add: callee_of_core_def plus_oracle_def split!: sum.splits)\n done\n\nlemma WT_core_callee_invariant_on [WT_intro]:\n assumes WT: \"WT_core \\_adv \\_usr I core\"\n shows \"callee_invariant_on (callee_of_core core) I (\\_full \\\\<^sub>\\ (\\_adv \\\\<^sub>\\ \\_usr))\"\n apply unfold_locales\n subgoal for s x y s' by(auto simp add: callee_of_core_def plus_oracle_def split!: sum.splits dest: WT_coreD[OF assms])\n subgoal by(rule WT_callee_of_core[OF WT])\n done\n\ndefinition callee_of_rest\n :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\n \\ ('s_rest, 'iadv_rest + 'iusr_rest, 'oadv_rest \\ 'event list + 'ousr_rest \\ 'event list) oracle'\" where\n \"callee_of_rest rest = rfunc_adv rest \\\\<^sub>O rfunc_usr rest\"\n\nlemma callee_of_rest_simps [simp]:\n \"callee_of_rest rest s (Inl iadv_rest) = map_spmf (apfst Inl) (rfunc_adv rest s iadv_rest)\"\n \"callee_of_rest rest s (Inr iusr_rest) = map_spmf (apfst Inr) (rfunc_usr rest s iusr_rest)\"\n by(simp_all add: callee_of_rest_def)\n\nlemma WT_callee_of_rest [WT_intro]:\n assumes WT: \"WT_rest \\_adv \\_usr I rest\"\n and I: \"I s\"\n shows \"e\\ \\_adv \\\\<^sub>\\ e\\ \\_usr \\c callee_of_rest rest s \\\"\n apply(rule WT_calleeI)\n subgoal for x y s' using I WT_restD[OF WT]\n by(auto simp add: callee_of_core_def plus_oracle_def split!: sum.splits)\n done\n\nfun fuse_callee \n :: \"('iadv_core + 'iadv_rest) + ('iusr_core + 'iusr_rest) \\\n (('oadv_core + 'oadv_rest) + ('ousr_core + 'ousr_rest),\n ('event + 'iadv_core + 'iusr_core) + ('iadv_rest + 'iusr_rest),\n (unit + 'oadv_core + 'ousr_core) + ('oadv_rest \\ 'event list + 'ousr_rest \\ 'event list)) gpv\"\n where\n \"fuse_callee (Inl (Inl iadv_core)) = Pause (Inl (Inr (Inl iadv_core))) (\\x. case x of\n Inl (Inr (Inl oadv_core)) \\ Done (Inl (Inl oadv_core))\n | _ \\ Fail)\"\n| \"fuse_callee (Inl (Inr iadv_rest)) = Pause (Inr (Inl iadv_rest)) (\\x. case x of\n Inr (Inl (oadv_rest, es)) \\ bind_gpv (pauses (map (Inl \\ Inl) es)) (\\_. Done (Inl (Inr oadv_rest)))\n | _ \\ Fail)\"\n| \"fuse_callee (Inr (Inl iusr_core)) = Pause (Inl (Inr (Inr iusr_core))) (\\x. case x of\n Inl (Inr (Inr oadv_core)) \\ Done (Inr (Inl oadv_core)))\"\n| \"fuse_callee (Inr (Inr iusr_rest)) = Pause (Inr (Inr iusr_rest)) (\\x. case x of\n Inr (Inr (ousr_rest, es)) \\ bind_gpv (pauses (map (Inl \\ Inl) es)) (\\_. Done (Inr (Inr ousr_rest))))\"\n\ncase_of_simps fuse_callee_case: fuse_callee.simps\n\n(* parametric_constant fuse_callee_parametric [transfer_rule]: fuse_callee_case *)\n\ndefinition fuse_converter \n :: \"(('iadv_core + 'iadv_rest) + ('iusr_core + 'iusr_rest), \n ('oadv_core + 'oadv_rest) + ('ousr_core + 'ousr_rest),\n ('event + 'iadv_core + 'iusr_core) + ('iadv_rest + 'iusr_rest),\n (unit + 'oadv_core + 'ousr_core) + ('oadv_rest \\ 'event list + 'ousr_rest \\ 'event list)) converter\"\n where\n \"fuse_converter = converter_of_callee (stateless_callee fuse_callee) ()\"\n\nlemma fuse_converter:\n \"resource_of_oracle (fused_resource.fuse core rest) (s_core, s_rest) = \n fuse_converter \\ (resource_of_oracle (callee_of_core core) s_core \\ resource_of_oracle (callee_of_rest rest) s_rest)\"\n unfolding fuse_converter_def resource_of_parallel_oracle[symmetric] attach_CNV_RES attach_stateless_callee resource_of_oracle_extend_state_oracle\nproof(rule arg_cong2[where f=resource_of_oracle]; clarsimp simp add: fun_eq_iff)\n interpret fused_resource core core_init for core_init .\n have \"foldl_spmf (map_fun id (map_fun (Inl \\ Inl) id) (map_fun id (map_fun id (map_spmf snd)) (callee_of_core core \\\\<^sub>O callee_of_rest rest))) (return_spmf (s_core, s_rest)) xs\n = map_spmf (\\s_core. (s_core, s_rest)) (foldl_spmf (cpoke core) (return_spmf s_core) xs)\" for s_core s_rest xs\n by(induction xs arbitrary: s_core)\n (simp_all add: spmf.map_comp foldl_spmf_Cons' map_bind_spmf bind_map_spmf o_def del: foldl_spmf_Cons)\n then show \"fuse rest (s_core, s_rest) q = exec_gpv (callee_of_core core \\\\<^sub>O callee_of_rest rest) (fuse_callee q) (s_core, s_rest)\"\n for s_core s_rest q\n by(cases q rule: fuse_callee.cases; clarsimp simp add: map_bind_spmf bind_map_spmf exec_gpv_bind exec_gpv_pauses intro!: bind_spmf_cong[OF refl]; simp add: map_spmf_conv_bind_spmf[symmetric])\nqed\n\nlemma trace_eq_callee_of_coreI:\n \"trace_callee_eq (callee_of_core core1) (callee_of_core core2) (E <+> IA <+> IU) p q\"\n if \"trace_core_eq core1 core2 E IA IU p q\"\nproof -\n from that obtain S_core \n where core_start: \"S_core p q\"\n and step_cpoke: \"\\p q e. S_core p q \\ e \\ E\n \\ weight_spmf (bind_spmf p (\\s. cpoke core1 s e)) = weight_spmf (bind_spmf q (\\s. cpoke core2 s e))\"\n and sim_cpoke: \"\\p q e. S_core p q \\ e \\ E \n \\ S_core (mk_lossless (bind_spmf p (\\s. cpoke core1 s e))) (mk_lossless (bind_spmf q (\\s. cpoke core2 s e)))\"\n and step_cfunc_adv: \"\\p q ia. \\ S_core p q; ia \\ IA \\\n \\ bind_spmf p (\\s1. map_spmf fst (cfunc_adv core1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (cfunc_adv core2 s2 ia))\"\n and sim_cfunc_adv: \"\\p q ia oa. \\ S_core p q; ia \\ IA \\ \\\n S_core (cond_spmf_fst (bind_spmf p (\\s1. cfunc_adv core1 s1 ia)) oa)\n (cond_spmf_fst (bind_spmf q (\\s2. cfunc_adv core2 s2 ia)) oa)\"\n and step_cfunc_usr: \"\\p q iu. \\ S_core p q; iu \\ IU \\\n \\ bind_spmf p (\\s1. map_spmf fst (cfunc_usr core1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (cfunc_usr core2 s2 iu))\"\n and sim_cfunc_usr: \"\\p q iu ou. \\ S_core p q; iu \\ IU \\ \\\n S_core (cond_spmf_fst (bind_spmf p (\\s1. cfunc_usr core1 s1 iu)) ou)\n (cond_spmf_fst (bind_spmf q (\\s2. cfunc_usr core2 s2 iu)) ou)\"\n by(rule trace_core_eq_complete) blast\n\n show ?thesis using core_start\n proof(coinduct rule: trace'_eqI_sim[consumes 1, case_names step sim])\n case (step p q a)\n then consider (cpoke) e where \"a = Inl e\" \"e \\ E\"\n | (cfunc_adv) ia where \"a = Inr (Inl ia)\" \"ia \\ IA\"\n | (cfunc_usr) iu where \"a = Inr (Inr iu)\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case cpoke\n with step_cpoke[OF step(1), of e] show ?thesis \n by(simp add: spmf.map_comp o_def map_spmf_const weight_bind_spmf)\n (auto intro!: spmf_eqI simp add: spmf_bind spmf_scale_spmf max_def min_absorb2 weight_spmf_le_1)\n next\n case cfunc_adv\n with step_cfunc_adv[OF step(1) cfunc_adv(2)] show ?thesis\n by(simp add: spmf.map_comp)(simp add: spmf.map_comp[symmetric] map_bind_spmf[unfolded o_def, symmetric])\n next\n case cfunc_usr\n with step_cfunc_usr[OF step(1) cfunc_usr(2)] show ?thesis\n by(simp add: spmf.map_comp)(simp add: spmf.map_comp[symmetric] map_bind_spmf[unfolded o_def, symmetric])\n qed \n next\n case (sim p q a res b s')\n then consider (cpoke) e where \"a = Inl e\" \"e \\ E\"\n | (cfunc_adv) ia where \"a = Inr (Inl ia)\" \"ia \\ IA\"\n | (cfunc_usr) iu where \"a = Inr (Inr iu)\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case cpoke\n with sim_cpoke[OF sim(1) , of e] sim show ?thesis \n by(clarsimp simp add: map_bind_spmf[unfolded o_def, symmetric])\n next\n case cfunc_adv\n with sim_cfunc_adv[OF sim(1) cfunc_adv(2)] sim show ?thesis\n apply(clarsimp simp add: map_bind_spmf[unfolded o_def, symmetric] apfst_def map_prod_def)\n apply(subst (1 2) cond_spmf_fst_map_prod_inj)\n apply(simp_all add: o_def[symmetric] inj_compose del: o_apply)\n done\n next\n case cfunc_usr\n with sim_cfunc_usr[OF sim(1) cfunc_usr(2)] sim show ?thesis\n apply(clarsimp simp add: map_bind_spmf[unfolded o_def, symmetric] apfst_def map_prod_def)\n apply(subst (1 2) cond_spmf_fst_map_prod_inj)\n apply(simp_all add: o_def[symmetric] inj_compose del: o_apply)\n done\n qed\n qed\nqed\n\nlemma trace_eq_callee_of_restI:\n \"trace_callee_eq (callee_of_rest rest1) (callee_of_rest rest2) (IA <+> IU) p q\"\n if \"trace_rest_eq rest1 rest2 IA IU p q\"\nproof -\n from that obtain S_rest \n where rest_start: \"S_rest p q\"\n and step_rfunc_adv: \"\\p q ia. \\ S_rest p q; ia \\ IA \\\n \\ bind_spmf p (\\s1. map_spmf fst (rfunc_adv rest1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (rfunc_adv rest2 s2 ia))\"\n and sim_rfunc_adv: \"\\p q ia oa. \\ S_rest p q; ia \\ IA \\ \\\n S_rest (cond_spmf_fst (bind_spmf p (\\s1. rfunc_adv rest1 s1 ia)) oa)\n (cond_spmf_fst (bind_spmf q (\\s2. rfunc_adv rest2 s2 ia)) oa)\"\n and step_rfunc_usr: \"\\p q iu. \\ S_rest p q; iu \\ IU \\\n \\ bind_spmf p (\\s1. map_spmf fst (rfunc_usr rest1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (rfunc_usr rest2 s2 iu))\"\n and sim_rfunc_usr: \"\\p q iu ou. \\ S_rest p q; iu \\ IU \\ \\\n S_rest (cond_spmf_fst (bind_spmf p (\\s1. rfunc_usr rest1 s1 iu)) ou)\n (cond_spmf_fst (bind_spmf q (\\s2. rfunc_usr rest2 s2 iu)) ou)\"\n by(rule trace_rest_eq_complete) blast\n\n show ?thesis using rest_start\n proof(coinduct rule: trace'_eqI_sim[consumes 1, case_names step sim])\n case (step p q a)\n then consider (rfunc_adv) ia where \"a = Inl ia\" \"ia \\ IA\"\n | (rfunc_usr) iu where \"a = Inr iu\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case rfunc_adv\n with step_rfunc_adv[OF step(1) rfunc_adv(2)] show ?thesis\n by(simp add: spmf.map_comp)(simp add: spmf.map_comp[symmetric] map_bind_spmf[unfolded o_def, symmetric])\n next\n case rfunc_usr\n with step_rfunc_usr[OF step(1) rfunc_usr(2)] show ?thesis\n by(simp add: spmf.map_comp)(simp add: spmf.map_comp[symmetric] map_bind_spmf[unfolded o_def, symmetric])\n qed \n next\n case (sim p q a res b s')\n then consider (rfunc_adv) ia where \"a = Inl ia\" \"ia \\ IA\"\n | (rfunc_usr) iu where \"a = Inr iu\" \"iu \\ IU\" by auto\n then show ?case\n proof cases\n case rfunc_adv\n with sim_rfunc_adv[OF sim(1) rfunc_adv(2)] sim show ?thesis\n by(clarsimp simp add: map_bind_spmf[unfolded o_def, symmetric] apfst_def map_prod_def)\n (subst (1 2) cond_spmf_fst_map_prod_inj; simp)\n next\n case rfunc_usr\n with sim_rfunc_usr[OF sim(1) rfunc_usr(2)] sim show ?thesis\n by(clarsimp simp add: map_bind_spmf[unfolded o_def, symmetric] apfst_def map_prod_def)\n (subst (1 2) cond_spmf_fst_map_prod_inj; simp)\n qed\n qed\nqed\n\nlemma trace_callee_resource_of_oracle:\n \"trace_callee run_resource (map_spmf (resource_of_oracle callee) p) = trace_callee callee p\"\n (is \"?lhs = ?rhs\")\nproof(intro ext)\n show \"?lhs tr x = ?rhs tr x\" for tr x\n proof(induction tr arbitrary: p)\n case Nil show ?case by(simp add: bind_map_spmf o_def spmf.map_comp)\n next\n case (Cons a tr)\n obtain y z where a [simp]: \"a = (y, z)\" by(cases a)\n have \"trace_callee run_resource (map_spmf (RES callee) p) (a # tr) x =\n trace_callee run_resource (cond_spmf_fst (map_spmf (\\(x, y). (x, RES callee y)) (p \\ (\\x. (callee x y)))) z) tr x\"\n by(clarsimp simp add: bind_map_spmf o_def map_prod_def map_bind_spmf)\n also have \"\\ = trace_callee run_resource (map_spmf (RES callee) (cond_spmf_fst (p \\ (\\x. (callee x y))) z)) tr x\"\n by(subst cond_spmf_fst_map_prod_inj) simp_all\n finally show ?case using Cons.IH by simp\n qed\nqed\n\nlemma trace_callee_resource_of_oracle':\n \"trace_callee run_resource (return_spmf (resource_of_oracle callee s)) = trace_callee callee (return_spmf s)\"\n using trace_callee_resource_of_oracle[where p=\"return_spmf s\"]\n by simp\n\nlemma trace_eq_resource_of_oracle:\n \"trace_eq A (map_spmf (resource_of_oracle callee1) p) (map_spmf (resource_of_oracle callee2) q) =\n trace_callee_eq callee1 callee2 A p q\"\n unfolding trace_callee_eq_def trace_callee_resource_of_oracle by(rule refl)\n\nlemma WT_fuse_converter [WT_intro]:\n \"(\\AC \\\\<^sub>\\ map_\\ id fst \\AR) \\\\<^sub>\\ (\\UC \\\\<^sub>\\ map_\\ id fst \\UR), (\\E \\\\<^sub>\\ (\\AC \\\\<^sub>\\ \\UC)) \\\\<^sub>\\ (\\AR \\\\<^sub>\\ \\UR) \\\\<^sub>C fuse_converter \\\"\n if \"\\x. \\(y, es)\\responses_\\ \\AR x. set es \\ outs_\\ \\E\" \"\\x. \\(y, es)\\responses_\\ \\UR x. set es \\ outs_\\ \\E\"\n unfolding fuse_converter_def using that\n by(intro WT_converter_of_callee)\n (fastforce simp add: stateless_callee_def image_image intro: rev_image_eqI intro!: WT_gpv_pauses split: if_split_asm)+\n\ntheorem fuse_trace_eq:\n fixes core1 :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and core2 :: \"('s_core', 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and rest1 :: \"('s_rest, 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more1) rest_scheme\"\n and rest2 :: \"('s_rest', 'event, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more2) rest_scheme\"\n assumes core: \"trace_core_eq core1 core2 (outs_\\ \\E) (outs_\\ \\CA) (outs_\\ \\CU) (return_spmf s_core) (return_spmf s_core')\"\n and rest: \"trace_rest_eq rest1 rest2 (outs_\\ \\RA) (outs_\\ \\RU) (return_spmf s_rest) (return_spmf s_rest')\"\n and IC1: \"callee_invariant_on (callee_of_core core1) IC1 (\\E \\\\<^sub>\\ (\\CA \\\\<^sub>\\ \\CU))\" \"IC1 s_core\"\n and IC2: \"callee_invariant_on (callee_of_core core2) IC2 (\\E \\\\<^sub>\\ (\\CA \\\\<^sub>\\ \\CU))\" \"IC2 s_core'\"\n and IR1: \"callee_invariant_on (callee_of_rest rest1) IR1 (\\RA \\\\<^sub>\\ \\RU)\" \"IR1 s_rest\"\n and IR2: \"callee_invariant_on (callee_of_rest rest2) IR2 (\\RA \\\\<^sub>\\ \\RU)\" \"IR2 s_rest'\"\n and E1 [WT_intro]: \"\\x. \\(y, es)\\responses_\\ \\RA x. set es \\ outs_\\ \\E\"\n and E2 [WT_intro]: \"\\x. \\(y, es)\\responses_\\ \\RU x. set es \\ outs_\\ \\E\"\n shows \"trace_callee_eq (fused_resource.fuse core1 rest1) (fused_resource.fuse core2 rest2)\n ((outs_\\ \\CA <+> outs_\\ \\RA) <+> (outs_\\ \\CU <+> outs_\\ \\RU)) (return_spmf (s_core, s_rest)) (return_spmf (s_core', s_rest'))\"\nproof -\n let ?\\C = \"\\E \\\\<^sub>\\ (\\CA \\\\<^sub>\\ \\CU)\"\n let ?\\R = \"\\RA \\\\<^sub>\\ \\RU\"\n let ?\\' = \"?\\C \\\\<^sub>\\ ?\\R\"\n let ?\\ = \"(\\CA \\\\<^sub>\\ map_\\ id fst \\RA) \\\\<^sub>\\ (\\CU \\\\<^sub>\\ map_\\ id fst \\RU)\"\n\n interpret fuse1: fused_resource core1 s1 for s1 .\n interpret fuse2: fused_resource core2 s2 for s2 .\n interpret IC1: callee_invariant_on \"callee_of_core core1\" IC1 ?\\C by fact\n interpret IC2: callee_invariant_on \"callee_of_core core2\" IC2 ?\\C by fact\n interpret IR1: callee_invariant_on \"callee_of_rest rest1\" IR1 ?\\R by fact\n interpret IR2: callee_invariant_on \"callee_of_rest rest2\" IR2 ?\\R by fact\n\n from core have \"outs_\\ ?\\C \\\\<^sub>C callee_of_core core1(s_core) \\ callee_of_core core2(s_core')\"\n by(simp add: trace_eq_callee_of_coreI)\n hence \"outs_\\ ?\\C \\\\<^sub>R RES (callee_of_core core1) s_core \\ RES (callee_of_core core2) s_core'\" by simp\n moreover have \"outs_\\ ?\\R \\\\<^sub>C callee_of_rest rest1(s_rest) \\ callee_of_rest rest2(s_rest')\" using rest\n by(simp add: trace_eq_callee_of_restI)\n hence \"outs_\\ ?\\R \\\\<^sub>R RES (callee_of_rest rest1) s_rest \\ RES (callee_of_rest rest2) s_rest'\" by simp\n ultimately have \"outs_\\ ?\\' \\\\<^sub>R\n RES (callee_of_core core1) s_core \\ RES (callee_of_rest rest1) s_rest \\\n RES (callee_of_core core2) s_core' \\ RES (callee_of_rest rest2) s_rest'\"\n by(simp add: trace_eq'_parallel_resource)\n hence \"outs_\\ ?\\ \\\\<^sub>R fuse_converter \\ (RES (callee_of_core core1) s_core \\ RES (callee_of_rest rest1) s_rest) \\\n fuse_converter \\ (RES (callee_of_core core2) s_core' \\ RES (callee_of_rest rest2) s_rest')\"\n by(rule attach_trace_eq')(intro WT_intro IC1.WT_resource_of_oracle IC1 IC2.WT_resource_of_oracle IC2 IR1.WT_resource_of_oracle IR1 IR2.WT_resource_of_oracle IR2)+\n hence \"trace_eq' (outs_\\ ?\\) (resource_of_oracle (fuse1.fuse rest1) (s_core, s_rest)) (resource_of_oracle (fuse2.fuse rest2) (s_core', s_rest'))\"\n unfolding fuse_converter by simp\n then show ?thesis by simp\nqed\n\n\ninductive trace_eq_simcl :: \"('s1 spmf \\ 's2 spmf \\ bool) \\ 's1 spmf \\ 's2 spmf \\ bool\"\n for S where\n base: \"trace_eq_simcl S p q\" if \"S p q\" for p q\n| bind_nat: \"trace_eq_simcl S (bind_spmf p f) (bind_spmf p g)\" \nif \"\\x :: nat. x \\ set_spmf p \\ S (f x) (g x)\"\n\nlemma trace_eq_simcl_bindI [intro?]: \"trace_eq_simcl S (bind_spmf p f) (bind_spmf p g)\"\n if \"\\x. x \\ set_spmf p \\ S (f x) (g x)\"\n by(subst (1 2) bind_spmf_to_nat_on[symmetric])(auto intro!: trace_eq_simcl.bind_nat simp add: that)\n\nlemma trace_eq_simcl_bind: \"trace_eq_simcl S (bind_spmf p f) (bind_spmf p g)\"\n if *: \"\\x :: 'a. x \\ set_spmf p \\ trace_eq_simcl S (f x) (g x)\"\nproof -\n obtain P :: \"'a \\ nat spmf\" and F G where\n **: \"\\x. x \\ set_spmf p \\ f x = bind_spmf (P x) (F x) \\ g x = bind_spmf (P x) (G x) \\ (\\y\\set_spmf (P x). S (F x y) (G x y))\"\n apply(atomize_elim)\n apply(subst choice_iff[symmetric])+\n apply(fastforce dest!: * elim!: trace_eq_simcl.cases intro: exI[where x=\"return_spmf _\"])\n done\n have \"bind_spmf p f = bind_spmf (bind_spmf p (\\x. map_spmf (Pair x) (P x))) (\\(x, y). F x y)\"\n by(simp add: bind_map_spmf o_def ** cong: bind_spmf_cong)\n moreover have \"bind_spmf p g = bind_spmf (bind_spmf p (\\x. map_spmf (Pair x) (P x))) (\\(x, y). G x y)\"\n by(simp add: bind_map_spmf o_def ** cong: bind_spmf_cong)\n ultimately show ?thesis by(simp only:)(rule trace_eq_simcl_bindI; clarsimp simp add: **)\nqed\n\nlemma trace_eq_simcl_bind1_scale: \"trace_eq_simcl S (bind_spmf p f) (scale_spmf (weight_spmf p) q)\"\n if \"\\x\\set_spmf p. trace_eq_simcl S (f x) q\"\nproof -\n have \"trace_eq_simcl S (bind_spmf p f) (bind_spmf p (\\_. q))\"\n by(rule trace_eq_simcl_bind)(simp add: that)\n thus ?thesis by(simp add: bind_spmf_const)\nqed\n\nlemma trace_eq_simcl_bind1: \"trace_eq_simcl S (bind_spmf p f) q\"\n if \"\\x\\set_spmf p. trace_eq_simcl S (f x) q\" \"lossless_spmf p\"\n using trace_eq_simcl_bind1_scale[OF that(1)] that(2) by(simp add: lossless_weight_spmfD)\n\nlemma trace_eq_simcl_bind2_scale: \"trace_eq_simcl S (scale_spmf (weight_spmf q) p) (bind_spmf q f)\"\n if \"\\x\\set_spmf q. trace_eq_simcl S p (f x)\"\nproof -\n have \"trace_eq_simcl S (bind_spmf q (\\_. p)) (bind_spmf q f)\"\n by(rule trace_eq_simcl_bind)(simp add: that)\n thus ?thesis by(simp add: bind_spmf_const)\nqed\n\nlemma trace_eq_simcl_bind2: \"trace_eq_simcl S p (bind_spmf q f)\"\n if \"\\x\\set_spmf q. trace_eq_simcl S p (f x)\" \"lossless_spmf q\"\n using trace_eq_simcl_bind2_scale[OF that(1)] that(2) by(simp add: lossless_weight_spmfD)\n\nlemma trace_eq_simcl_return_pmf_None [simp, intro!]: \"trace_eq_simcl S (return_pmf None) (return_pmf None)\" \n for S :: \"'s1 spmf \\ 's2 spmf \\ bool\"\nproof -\n have \"trace_eq_simcl S (bind_spmf (return_pmf None) (undefined :: nat \\ 's1 spmf)) (bind_spmf (return_pmf None) (undefined :: nat \\ 's2 spmf))\"\n by(rule trace_eq_simcl_bindI) simp\n then show ?thesis by simp\nqed\n\nlemma trace_eq_simcl_map: \"trace_eq_simcl S (map_spmf f p) (map_spmf g p)\"\n if \"\\x\\set_spmf p. S (return_spmf (f x)) (return_spmf (g x))\"\n unfolding map_spmf_conv_bind_spmf\n by(rule trace_eq_simcl_bindI)(simp add: that)\n\nlemma trace_eq_simcl_map1: \"trace_eq_simcl S (map_spmf f p) q\"\n if \"\\x\\set_spmf p. trace_eq_simcl S (return_spmf (f x)) q\" \"lossless_spmf p\"\n unfolding map_spmf_conv_bind_spmf\n by(rule trace_eq_simcl_bind1)(simp_all add: that)\n\nlemma trace_eq_simcl_map2: \"trace_eq_simcl S p (map_spmf f q)\"\n if \"\\x\\set_spmf q. trace_eq_simcl S p (return_spmf (f x))\" \"lossless_spmf q\"\n unfolding map_spmf_conv_bind_spmf\n by(rule trace_eq_simcl_bind2)(simp_all add: that)\n\nlemma trace_eq_simcl_return_spmf [simp]: \"trace_eq_simcl S (return_spmf x) (return_spmf y) \\ S (return_spmf x) (return_spmf y)\"\n apply(rule iffI)\n subgoal by(erule trace_eq_simcl.cases; clarsimp dest!: sym[where s=\"return_spmf _\"])(auto 4 4 simp add: bind_eq_return_spmf dest!: lossless_spmfD_set_spmf_nonempty)\n by(simp add: trace_eq_simcl.base)\n\nlemma trace_eq_simcl_callee:\n fixes callee1 :: \"('a, 'b, 's1) callee\" and callee2 :: \"('a, 'b, 's2) callee\"\n assumes step: \"\\p q a. \\ S p q; a \\ A \\ \\\n bind_spmf p (\\s. map_spmf fst (callee1 s a)) = bind_spmf q (\\s. map_spmf fst (callee2 s a))\"\n and sim: \"\\p q a res b s'. \\ S p q; a \\ A; res \\ set_spmf q; (b, s') \\ set_spmf (callee2 res a) \\\n \\ trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s. callee1 s a)) b)\n (cond_spmf_fst (bind_spmf q (\\s. callee2 s a)) b)\"\n and start: \"trace_eq_simcl S p q\" and a: \"a \\ A\"\n shows trace_eq_simcl_callee_step: \"bind_spmf p (\\s. map_spmf fst (callee1 s a)) = bind_spmf q (\\s. map_spmf fst (callee2 s a))\" (is \"?step\")\n and trace_eq_simcl_callee_sim: \"\\res b s'. \\ res \\ set_spmf q; (b, s') \\ set_spmf (callee2 res a) \\\n \\ trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s. callee1 s a)) b)\n (cond_spmf_fst (bind_spmf q (\\s. callee2 s a)) b)\" (is \"\\res b s'. \\ ?res res; ?b res b s' \\ \\ ?sim res b s'\")\nproof -\n show eq: ?step using start a by cases(auto intro!: bind_spmf_cong intro: step)\n show \"?sim res b s'\" if \"?res res\" \"?b res b s'\" for res b s' using start\n proof cases\n case base then show ?thesis using a that by(rule sim)\n next\n case (bind_nat X f g)\n let ?Y = \"cond_bind_spmf_fst X (\\y. map_spmf fst (bind_spmf (f y) (\\s. callee1 s a))) b\"\n let ?Y' = \"cond_bind_spmf_fst X (\\y. map_spmf fst (bind_spmf (g y) (\\s. callee2 s a))) b\"\n have \"cond_spmf_fst (bind_spmf p (\\s. callee1 s a)) b = bind_spmf ?Y (\\x. cond_spmf_fst (bind_spmf (f x) (\\s. callee1 s a)) b)\"\n unfolding bind_nat by(simp add: cond_spmf_fst_bind o_def)\n moreover have \"cond_spmf_fst (bind_spmf q (\\s. callee2 s a)) b = bind_spmf ?Y' (\\x. cond_spmf_fst (bind_spmf (g x) (\\s. callee2 s a)) b)\"\n unfolding bind_nat by(simp add: cond_spmf_fst_bind o_def)\n moreover have \"?Y = ?Y'\" using bind_nat eq\n by(intro spmf_eqI)(fastforce simp add: map_bind_spmf o_def spmf_eq_0_set_spmf dest: step[OF _ a])\n ultimately \n show \"trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s. callee1 s a)) b)\n (cond_spmf_fst (bind_spmf q (\\s. callee2 s a)) b)\" using bind_nat a\n by(simp)(rule trace_eq_simcl_bind; auto intro!: sim simp add: bind_UNION)\n qed\nqed\n\nproposition trace'_eqI_sim_upto:\n fixes callee1 :: \"('a, 'b, 's1) callee\" and callee2 :: \"('a, 'b, 's2) callee\"\n assumes start: \"S p q\"\n and step: \"\\p q a. \\ S p q; a \\ A \\ \\\n bind_spmf p (\\s. map_spmf fst (callee1 s a)) = bind_spmf q (\\s. map_spmf fst (callee2 s a))\"\n and sim: \"\\p q a res b s'. \\ S p q; a \\ A; res \\ set_spmf q; (b, s') \\ set_spmf (callee2 res a) \\\n \\ trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s. callee1 s a)) b)\n (cond_spmf_fst (bind_spmf q (\\s. callee2 s a)) b)\"\n shows \"trace_callee_eq callee1 callee2 A p q\"\nproof -\n let ?S = \"trace_eq_simcl S\"\n from start have \"?S p q\" by(rule trace_eq_simcl.base)\n then show ?thesis by(rule trace'_eqI_sim)(rule trace_eq_simcl_callee[OF step sim]; assumption)+\nqed\n\nlemma trace_core_eq_simI_upto:\n fixes core1 :: \"('s_core, 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and core2 :: \"('s_core', 'event, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and S :: \"'s_core spmf \\ 's_core' spmf \\ bool\"\n assumes start: \"S p q\"\n and step_cpoke: \"\\p q e. \\ S p q; e \\ E \\ \\ \n weight_spmf (bind_spmf p (\\s. cpoke core1 s e)) = weight_spmf (bind_spmf q (\\s. cpoke core2 s e))\"\n and sim_cpoke: \"\\p q e. \\ S p q; e \\ E \\ \\ \n trace_eq_simcl S (mk_lossless (bind_spmf p (\\s. cpoke core1 s e))) (mk_lossless (bind_spmf q (\\s. cpoke core2 s e)))\"\n and step_cfunc_adv: \"\\p q ia. \\ S p q; ia \\ IA \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_adv core1 s1 ia)) = bind_spmf q (\\s2. map_spmf fst (cfunc_adv core2 s2 ia))\"\n and sim_cfunc_adv: \"\\p q ia s1 s2 s1' s2' oa. \\ S p q; ia \\ IA; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (oa, s1') \\ set_spmf (cfunc_adv core1 s1 ia); (oa, s2') \\ set_spmf (cfunc_adv core2 s2 ia) \\\n \\ trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_adv core1 s1 ia)) oa) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_adv core2 s2 ia)) oa)\"\n and step_cfunc_usr: \"\\p q iu. \\ S p q; iu \\ IU \\ \\ \n bind_spmf p (\\s1. map_spmf fst (cfunc_usr core1 s1 iu)) = bind_spmf q (\\s2. map_spmf fst (cfunc_usr core2 s2 iu))\"\n and sim_cfunc_usr: \"\\p q iu s1 s2 s1' s2' ou. \\ S p q; iu \\ IU; \n s1 \\ set_spmf p; s2 \\ set_spmf q; (ou, s1') \\ set_spmf (cfunc_usr core1 s1 iu); (ou, s2') \\ set_spmf (cfunc_usr core2 s2 iu) \\\n \\ trace_eq_simcl S (cond_spmf_fst (bind_spmf p (\\s1. cfunc_usr core1 s1 iu)) ou) (cond_spmf_fst (bind_spmf q (\\s2. cfunc_usr core2 s2 iu)) ou)\"\n shows \"trace_core_eq core1 core2 E IA IU p q\"\nproof -\n let ?S = \"trace_eq_simcl S\"\n from start have \"?S p q\" by(rule trace_eq_simcl.base)\n then show ?thesis \n proof(rule trace_core_eq_simI, goal_cases Step_cpoke Sim_cpoke Step_cfunc_adv Sim_cfunc_adv Step_cfunc_usr Sim_cfunc_usr)\n { case (Step_cpoke p q e)\n then show ?case using step_cpoke\n by cases(auto simp add: weight_bind_spmf o_def intro!: Bochner_Integration.integral_cong_AE) }\n note eq = this\n\n case (Sim_cpoke p q e) then show ?case\n proof cases\n case base then show ?thesis using Sim_cpoke(2) by(rule sim_cpoke)\n next\n case (bind_nat X f g)\n then have \"cond_bind_spmf X (\\y. f y \\ (\\s. cpoke core1 s e)) UNIV = cond_bind_spmf X (\\y. g y \\ (\\s. cpoke core2 s e)) UNIV\"\n using eq[OF Sim_cpoke] step_cpoke Sim_cpoke\n by(intro spmf_eqI)(simp add: weight_spmf_def measure_spmf_zero_iff bind_UNION spmf_eq_0_set_spmf)\n then show ?thesis using bind_nat Sim_cpoke sim_cpoke\n by(auto simp add: cond_bind_spmf cond_spmf_UNIV[symmetric] simp del: cond_spmf_UNIV intro: trace_eq_simcl_bind)\n qed\n next \n { case (Step_cfunc_adv p q ia)\n then show ?case using step_cfunc_adv by cases(auto intro!: bind_spmf_cong) }\n note eq = this\n\n case (Sim_cfunc_adv p q ia s1 s2 s1' s2' oa) then show ?case \n proof cases\n case base then show ?thesis using Sim_cfunc_adv(2-) by(rule sim_cfunc_adv)\n next\n case (bind_nat X f g)\n then have \"cond_bind_spmf_fst X (\\y. map_spmf fst (f y \\ (\\s1. cfunc_adv core1 s1 ia))) oa =\n cond_bind_spmf_fst X (\\y. map_spmf fst (g y \\ (\\s2. cfunc_adv core2 s2 ia))) oa\"\n using eq[OF Sim_cfunc_adv(1,2)]\n by(intro spmf_eqI)(fastforce simp add: map_bind_spmf o_def spmf_eq_0_set_spmf dest: step_cfunc_adv[OF _ Sim_cfunc_adv(2)])\n then show ?thesis using bind_nat(3-) Sim_cfunc_adv(1-2)\n unfolding bind_nat(1,2) bind_spmf_assoc\n apply(subst (1 2) cond_spmf_fst_bind)\n apply(simp add: o_def)\n apply(rule trace_eq_simcl_bind)\n apply clarsimp\n apply(frule step_cfunc_adv[OF bind_nat(3) Sim_cfunc_adv(2), THEN arg_cong[where f=\"set_spmf\"], THEN equalityD2])\n apply(clarsimp simp add: o_def bind_UNION)\n apply(drule subsetD)\n apply fastforce\n apply(auto intro: sim_cfunc_adv)\n done\n qed\n next\n { case (Step_cfunc_usr p q iu)\n then show ?case using step_cfunc_usr by cases(auto intro!: bind_spmf_cong) }\n note eq = this\n\n case (Sim_cfunc_usr p q iu s1 s2 s1' s2' ou) then show ?case\n proof cases\n case base then show ?thesis using Sim_cfunc_usr(2-) by(rule sim_cfunc_usr)\n next\n case (bind_nat X f g)\n then have \"cond_bind_spmf_fst X (\\y. map_spmf fst (f y \\ (\\s1. cfunc_usr core1 s1 iu))) ou =\n cond_bind_spmf_fst X (\\y. map_spmf fst (g y \\ (\\s2. cfunc_usr core2 s2 iu))) ou\"\n using eq[OF Sim_cfunc_usr(1,2)]\n by(intro spmf_eqI)(fastforce simp add: map_bind_spmf o_def spmf_eq_0_set_spmf dest: step_cfunc_usr[OF _ Sim_cfunc_usr(2)])\n then show ?thesis using bind_nat(3-) Sim_cfunc_usr(1-2)\n unfolding bind_nat(1,2) bind_spmf_assoc\n apply(subst (1 2) cond_spmf_fst_bind)\n apply(simp add: o_def)\n apply(rule trace_eq_simcl_bind)\n apply clarsimp\n apply(frule step_cfunc_usr[OF bind_nat(3) Sim_cfunc_usr(2), THEN arg_cong[where f=\"set_spmf\"], THEN equalityD2])\n apply(clarsimp simp add: o_def bind_UNION)\n apply(drule subsetD)\n apply fastforce\n apply(auto intro: sim_cfunc_usr)\n done\n qed\n qed\nqed\n\n\n\ncontext\n fixes core :: \"('s_core, 'event1 + 'event2, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and rest :: \"('s_rest, 'event2, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest, 'more) rest_scheme\" \nbegin\n\nprimcorec core_with_rest :: \n \"('s_core \\ 's_rest, 'event1, 'iadv_core + 'iadv_rest, 'iusr_core + 'iusr_rest, 'oadv_core + 'oadv_rest, 'ousr_core + 'ousr_rest) core\" \n where\n \"cpoke core_with_rest = (\\(s_core, s_rest) e. map_spmf (\\s_core'. (s_core', s_rest)) (cpoke core s_core (Inl e)))\"\n | \"cfunc_adv core_with_rest = (\\(s_core, s_rest) iadv. case iadv of\n Inl iadv_core \\ map_spmf (\\(oadv_core, s_core'). (Inl oadv_core, (s_core', s_rest))) (cfunc_adv core s_core iadv_core)\n | Inr iadv_rest \\ \n bind_spmf (rfunc_adv rest s_rest iadv_rest) (\\((oadv_rest, es), s_rest'). \n map_spmf (\\s_core'. (Inr oadv_rest, (s_core', s_rest'))) (foldl_spmf (cpoke core) (return_spmf s_core) (map Inr es))))\"\n | \"cfunc_usr core_with_rest = (\\(s_core, s_rest) iusr. case iusr of\n Inl iusr_core \\ map_spmf (\\(ousr_core, s_core'). (Inl ousr_core, (s_core', s_rest))) (cfunc_usr core s_core iusr_core)\n | Inr iusr_rest \\\n bind_spmf (rfunc_usr rest s_rest iusr_rest) (\\((ousr_rest, es), s_rest').\n map_spmf (\\s_core'. (Inr ousr_rest, (s_core', s_rest'))) (foldl_spmf (cpoke core) (return_spmf s_core) (map Inr es))))\"\n\nend\n\nlemma fuse_core_with_rest:\n fixes core :: \"('s_core, 'event1 + 'event2, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n and rest1 :: \"('s_rest1, 'event1, 'iadv_rest1, 'iusr_rest1, 'oadv_rest1, 'ousr_rest1, 'more1) rest_scheme\"\n and rest2 :: \"('s_rest2, 'event2, 'iadv_rest2, 'iusr_rest2, 'oadv_rest2, 'ousr_rest2, 'more2) rest_scheme\"\n shows\n \"fused_resource.fuse core (parallel_rest rest1 rest2) (s_core, (s_rest1, s_rest2)) = \n map_fun (map_sum (lsumr \\ map_sum id swap_sum) (lsumr \\ map_sum id swap_sum)) (map_spmf (map_prod (map_sum (map_sum id swap_sum \\ rsuml) (map_sum id swap_sum \\ rsuml)) (map_prod id prod.swap \\ rprodl)))\n (fused_resource.fuse (core_with_rest core rest2) rest1 ((s_core, s_rest2), s_rest1))\"\n apply(rule ext)\n subgoal for x\n apply(cases \"(parallel_rest rest1 rest2, (s_core, (s_rest1, s_rest2)), x)\" rule: fused_resource.fuse.cases)\n apply(auto simp add: fused_resource.fuse.simps map_bind_spmf bind_map_spmf map_prod_def split_def o_def parallel_eoracle_def parallel_oracle_def split!: sum.split intro!: bind_spmf_cong)\n apply(subst foldl_spmf_pair_left[simplified split_def]; simp add: map_fun_def o_def bind_map_spmf)+\n done\n done\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Fused_Resource.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621764862150636, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2942546125784851}} {"text": "theory Kruskal_Impl\n imports Kruskal_Refine\n \"../../Refine_Imperative_HOL/IICF/Impl/IICF_DArray_List\"\n UnionFind_Impl\nbegin\n\ncontext\n fixes t :: \"nat \\ nat\"\nbegin\n definition mop_sortEdges where\n \"mop_sortEdges l = (SPECT (emb (\\(L,n). n= Max (insert 0 (set (map fst L) \\ set (map (snd o snd) L))) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat (t (length l)))))\"\n \n sepref_register \"mop_sortEdges\" \nend\n\nlocale sortMaxnode = \n fixes sortEdges_impl :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) Heap\" \n and sort_time' :: \"nat \\ nat\"\n assumes \n sortEdges_impl[sepref_fr_rules]: \"\\t. (sortEdges_impl, PR_CONST (mop_sortEdges t)) \\\n [\\l. sort_time' (length l) \\ t (length l)]\\<^sub>a\n (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn))\\<^sup>k \\ (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\\\\<^sub>a nat_assn)\"\n\n\n\n \n\n \nlemma set_uprod_nonempty[simp]: \"set_uprod x \\ {}\"\n apply(cases x) by auto\n\n\nlocale Kruskal_intermediate_Impl0 = Kruskal_intermediate E forest connected path weight for E forest connected path \n and weight :: \"nat uprod \\ int\" +\n fixes getEdges :: \"(nat \\ int \\ nat) list nrest\"\n and getEdges_impl :: \"(nat \\ int \\ nat) list Heap\" \n and getEdges_time sort_time :: nat\n(* and sortEdges :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) nrest\"\n and sortEdges_impl :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) Heap\" *)\n and empty_uf_time indep_test_time insert_uf_time :: nat\n assumes \n E_nonempty: \"E\\{}\"\n and \n getEdges_refine: \"getEdges \\ \\ Id (SPECT (emb (\\L. lst_graph_P' weight L E) (enat getEdges_time)))\"\n and\n getEdges_impl[sepref_fr_rules]: \"(uncurry0 getEdges_impl, uncurry0 getEdges) \\ unit_assn\\<^sup>k \\\\<^sub>a list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\"\n(* and\n sortEdges_refine': \"sortEdges l \\ (SPECT (emb (\\(L,n). n= Max (set (map fst l) \\ set (map (snd o snd) l)) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat sort_time)))\"\n and\n sortEdges_impl[sepref_fr_rules]: \"(sortEdges_impl, sortEdges) \\\n (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn))\\<^sup>k \\\\<^sub>a (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\\\\<^sub>a nat_assn)\"\n \n*)\n \nbegin\n\nthm conc_fun_br\n\nabbreviation \"sortEdges \\ mop_sortEdges (\\_. sort_time)\"\n\n\n(*\nlemma sortEdges_refine: \n assumes a: \"V = set (map fst l) \\ set (map (snd o snd) l)\"\n shows \"sortEdges l = \\ (br fst (\\(l,n). n= Max V)) (SPECT (emb (\\L. sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat sort_time)))\"\nproof -\n have gg: \"(\\x. (case x of (l, n) \\ n = Max V) \\ sorted_wrt edges_less_eq (fst x) \\ distinct (fst x) \\ set (fst x) = set l)\n =(\\(L, n). n = Max (set (map fst l) \\ set (map (snd o snd) l)) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l)\"\n unfolding a by auto\n show ?thesis \n apply(simp only: conc_fun_br gg) by(rule sortEdges_refine')\nqed *)\n\nabbreviation \"insert_time \\ 23\"\nabbreviation \"empty_forest_time \\ 12\"\n\n\nsublocale Kruskal_intermediate_time E forest connected path weight\n empty_forest_time empty_uf_time indep_test_time insert_time insert_uf_time getEdges_time sort_time\n apply unfold_locales .\n\n\n\nterm obtain_sorted_carrier''\n \ndefinition (in -) obtain_sorted_carrier'''_aux where\n \"obtain_sorted_carrier'''_aux gE sE c =\n do {\n l \\ gE;\n ASSERT (length l = card c);\n sE l\n}\" \n\nabbreviation \"obtain_sorted_carrier''' \\ obtain_sorted_carrier'''_aux getEdges sortEdges E\"\n \nlemma distinct_mset_eq:\"distinct a \\ mset a = mset b \\ distinct b\"\n by (metis card_distinct distinct_card set_mset_mset size_mset)\n\nlemma quicksort_by_rel_distinct: \"distinct l \\ distinct (quicksort_by_rel edges_less_eq [] l)\"\n by (auto intro: distinct_mset_eq)\n\ndefinition \"add_size_rel = br fst (\\(l,n). n= Max V)\"\n\n\n\nlemma max_node_is_Max_V: \" E = (\\(a, _, y). Upair a y) ` set la \\ max_node la = Max V\"\nproof -\n assume E: \"E = (\\(a, _, y). Upair a y) ` set la\"\n have pff: \"fst ` set la \\ (\\x. snd (snd x)) ` set la = (\\x\\set la. case x of (x1, x1a, x2a) \\ {x1, x2a})\"\n by (auto simp add: rev_image_eqI) \n have \"V \\ {}\" using E_nonempty V_def by auto\n then have Mo: \"Max V = Max (insert 0 V)\" by auto \n show ?thesis unfolding Mo unfolding V_def\n unfolding E apply simp \n by (auto simp add: max_node_def prod.case_distrib pff ) \nqed\n\nlemma lst_graph_P_V: \"lst_graph_P la E \\ V = (fst ` set la \\ (\\x. snd (snd x)) ` set la)\" \n by (auto simp: emb_eq_Some_conv lst_graph_P_def V_def rev_image_eqI) \n\n \n\nlemma k: \"\\V::nat set. finite V \\ V \\ {} \\ Max V = Max (insert 0 V)\" by auto\n\nlemma *: \"(la::((nat*int*nat) list)) \\ [] \\ Max (insert 0 (fst ` set la \\ (\\x. snd (snd x)) ` set la)) = Max (fst ` set la \\ (\\x. snd (snd x)) ` set la)\"\nproof -\n assume \"la \\ []\"\n then have \"fst ` set la \\ (snd \\ snd) ` set la \\ {}\" by auto\n then show ?thesis apply(intro k[symmetric]) apply simp by simp\nqed\n\n\nlemma obtain_sorted_carrier'''_refine: \"obtain_sorted_carrier''' \\ \\add_size_rel obtain_sorted_carrier''\"\n unfolding obtain_sorted_carrier'''_aux_def add_size_rel_def\n apply(rule bindT_refine') \n apply(rule getEdges_refine) apply safe\n apply(auto simp: emb_eq_Some_conv dest!: split: if_splits)\n unfolding conc_fun_br mop_sortEdges_def \n apply(auto simp: le_fun_def emb'_def dest: lst_graph_P_V split: if_splits)\n apply(rule le_R_ASSERTI)\n apply(rule ASSERT_leI) apply simp\n apply(rule SPECT_refine) apply (auto split: if_splits) \n apply(subst * ) subgoal apply auto using E_nonempty by auto \n by (metis (mono_tags) fst_conv in_br_conv lst_graph_P_V prod_case_simp) \n \n \n\ndefinition (in -) initState''_aux where\n \"initState''_aux mn eft eut\\ do {\n initial_union_find \\ mop_per_init (\\_. eut) (mn + 1);\n ASSERT ( card (Domain initial_union_find) = mn + 1);\n e \\ mop_empty_list (\\_. eft);\n RETURNT (initial_union_find, e) \n }\" \n\n\nabbreviation \"initState'' mn == initState''_aux mn empty_forest_time empty_uf_time\"\n\n definition (in -) \"addEdge''_aux uf a w b T iut it = do {\n uf \\ mop_per_union (\\_. iut) uf a b;\n T' \\ mop_push_list (\\_. it) (a,w,b) T;\n RETURNT (uf, T')\n }\"\n\nabbreviation \"addEdge'' uf a w b T == addEdge''_aux uf a w b T insert_uf_time insert_time\"\n\ndefinition (in -) \"notcompare uf a b itt = do {\n i \\ mop_per_compare (\\_. itt) uf a b;\n RETURNT (\\i)\n }\"\n\n\n definition (in -) kruskal3_aux \n where \"kruskal3_aux E gE sE eft eut iut it itt \\ do {\n (sl,mn) \\ obtain_sorted_carrier'''_aux gE sE E;\n ASSERT (mn = Max (Kruskal_intermediate_defs.V E));\n s \\ initState''_aux mn eft eut ;\n (per, spanning_forest) \\ nfoldli sl (\\_. True)\n (\\(a,w,b) (uf, T). do { \n ASSERT (a \\ Domain uf \\ b \\ Domain uf);\n ASSERT ( card (Domain uf) = Max (Kruskal_intermediate_defs.V E) + 1);\n i \\ notcompare uf a b itt;\n if i then\n do { \n ASSERT ((a,w,b)\\set T);\n addEdge''_aux uf a w b T iut it\n }\n else \n RETURNT (uf,T)\n }) s;\n RETURNT spanning_forest\n }\"\n\nabbreviation \"kruskal3 \\ kruskal3_aux E getEdges sortEdges empty_forest_time empty_uf_time\n insert_uf_time insert_time indep_test_time\"\n\n definition per_supset_rel :: \"('a per \\ 'a per) set\" where\n \"per_supset_rel\n \\ {(p1,p2). p1 \\ Domain p2 \\ Domain p2 = p2 \\ p1 - (Domain p2 \\ Domain p2) \\ Id}\"\n\n definition \"kk_rel n \\ per_supset_rel \\ ({p. Domain p = {0.. UNIV)\"\n\nlemma kk_relD: \"x\\ kk_rel n \\ x\\per_supset_rel\" unfolding kk_rel_def by auto\n\n lemma per_supset_rel_dom: \"(p1, p2) \\ per_supset_rel \\ Domain p1 \\ Domain p2\"\n by (auto simp: per_supset_rel_def)\n \n lemma per_supset_compare:\n \"(p1, p2) \\ per_supset_rel \\ x1\\Domain p2 \\ x2\\Domain p2 \\ per_compare p1 x1 x2 \\ per_compare p2 x1 x2\"\n by (auto simp: per_supset_rel_def)\n \n lemma per_supset_union: \"(p1, p2) \\ per_supset_rel \\ x1\\Domain p2 \\ x2\\Domain p2 \\\n (per_union p1 x1 x2, per_union p2 x1 x2) \\ per_supset_rel\"\n apply (clarsimp simp: per_supset_rel_def per_union_def Domain_unfold )\n apply (intro subsetI conjI)\n apply blast\n apply force\n done\n\n lemma per_kk_rel_union: \n assumes \"(p1, p2) \\ kk_rel n\" and inDom: \"x1\\Domain p2\" \"x2\\Domain p2\"\n shows \"(per_union p1 x1 x2, per_union p2 x1 x2) \\ kk_rel n\"\n proof -\n from assms(1) have \"(p1, p2) \\ per_supset_rel\" by(auto dest: kk_relD)\n with inDom have ss: \"(per_union p1 x1 x2, per_union p2 x1 x2) \\ per_supset_rel\" \n by(auto intro: per_supset_union)\n\n from assms(1) have \"Domain p1 = {0.. per_supset_rel\"\n unfolding per_supset_rel_def per_init'_def per_init_def max_node_def\n by (auto simp: less_Suc_eq_le ) \n\nlemma per_init'_refine: \"SPECT [per_init' (Max V + 1) \\ enat empty_uf_time] \\ \\ per_supset_rel (SPECT [per_init V \\ enat empty_uf_time])\"\n apply(rule SPECT_refine) using per_initN_refine by (auto split: if_splits)\n \nlemma gg: \"{(i, i) |i. i < X} = (\\i. (i,i)) ` {i. i < X}\" by auto\n \n\nlemma ff: \"\\X. card (Domain {(i, i) |i. i < X}) = X\"\n unfolding Domain_fst apply(subst card_image)\n subgoal by (smt fst_conv inj_onI mem_Collect_eq) \n subgoal unfolding gg apply(subst card_image) by auto \n done\n\n\nlemma initState''_refine: \"initState'' (Max V) \\ \\(kk_rel (Max V + 1) \\\\<^sub>r Id) initState'\"\n unfolding initState'_aux_def initState''_aux_def mop_empty_list_def kk_rel_def\n unfolding mop_per_init_def\n apply(rule bindT_refine') apply(rule per_init'_refine)\n\n apply(refine_rcg ) \n subgoal by (auto split: if_splits simp: ff per_init'_def ) \n unfolding conc_fun_RES \n apply(rule T_specifies_I) \n apply(vcg' \\-\\ ) \n apply(rule Sup_upper) by (auto simp: per_init'_def numeral_eq_enat split: if_splits) \n\n \n\nlemma SPECT_bind_RETURNT: \"SPECT [x \\ t] \\ (\\i. RETURNT (f i)) = SPECT [f x \\ t]\"\n unfolding bindT_def by(auto split: nrest.split)\n\ntheorem kruskal3_refine: \"kruskal3 \\ \\ Id kruskal2\"\n unfolding kruskal2_aux_def kruskal3_aux_def Let_def\n apply (refine_rcg obtain_sorted_carrier'''_refine )\n (*supply RELATESI[where R=\"per_supset_rel::(nat per \\ _) set\", refine_dref_RELATES]*)\n supply RELATESI[where R=\"kk_rel (Max V + 1)::(nat per \\ _) set\", refine_dref_RELATES]\n apply refine_dref_type \n subgoal unfolding add_size_rel_def by (auto simp: in_br_conv)\n subgoal apply (simp add: add_size_rel_def in_br_conv )\n using initState''_refine by simp \n apply (auto simp add: add_size_rel_def in_br_conv per_supset_compare\n per_supset_union \n dest: per_supset_rel_dom\n simp del: per_compare_def )\n subgoal by(auto dest!: kk_relD per_supset_rel_dom) \n subgoal by(auto dest!: kk_relD per_supset_rel_dom) \n subgoal by(auto simp: kk_rel_def) \n subgoal apply(auto dest!: kk_relD simp: SPECT_bind_RETURNT le_fun_def notcompare_def mop_per_compare_def)\n by (meson Domain.simps local.per_supset_compare per_compare_def)+ \n subgoal unfolding addEdge'_aux_def addEdge''_aux_def mop_per_union_def mop_push_list_def\n apply(refine_rcg)\n apply refine_dref_type \n subgoal apply (rule SPECT_refine) by (auto split: if_splits intro: per_kk_rel_union)\n subgoal apply (rule RETURNT_refine) by(auto split: if_splits) \n done\n done\n\nend\n\n\n \n\nlocale Kruskal_intermediate_Impl = Kruskal_intermediate_Impl0\n + UnionFind_Impl + sortMaxnode +\n assumes \n [simp]: \"uf_init_time (Suc (Max V)) \\ empty_uf_time\" \n \"uf_cmp_time (Suc (Max V)) \\ indep_test_time\" \n \"uf_union_time (Suc (Max V)) \\ insert_uf_time\" \n \"sort_time' (card E) \\ sort_time\"\nbegin\n\nsection \\Kruskal\\\n\n\n lemma [fcomp_norm_simps]: \"list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: list_assn_pure_conv)\n lemma [fcomp_norm_simps]: \" (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: )\n\n lemma [sepref_import_param]: \"(sort_edges,sort_edges)\\\\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel \\\\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel\" by simp\n lemma [sepref_import_param]: \"(max_node, max_node) \\ \\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel \\ nat_rel\" by simp\n\n sepref_register \"getEdges\" :: \"(nat \\ int \\ nat) list nrest\"\n sepref_register uf_init :: \"nat \\ uf Heap\"\n sepref_register uf_cmp :: \"uf \\ nat \\ nat \\ bool Heap\"\n sepref_register uf_union :: \"uf \\ nat \\ nat \\ uf Heap\"\n \ndeclare getEdges_impl [sepref_fr_rules]\n\n \n\nsepref_definition kruskal is\n \"uncurry0 kruskal3\" :: \"(unit_assn)\\<^sup>k \\\\<^sub>a da_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\"\n unfolding kruskal3_aux_def obtain_sorted_carrier'''_aux_def initState''_aux_def\n addEdge''_aux_def notcompare_def nfoldli_def\n using [[goals_limit = 2]]\n \n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id \n apply sepref_dbg_monadify\n\n apply sepref_dbg_opt_init\n\n apply sepref_dbg_trans \n \n apply sepref_dbg_opt\n apply sepref_dbg_cons_solve \\ \\Frame rule, recovering the invalidated list \n or pure elements, propagating recovery over the list structure\\\n apply sepref_dbg_cons_solve \\ \\Trivial frame rule\\\n apply sepref_dbg_constraints\n done \n\n\n concrete_definition (in -) kruskal' \n uses Kruskal_intermediate_Impl.kruskal_def\n\n\nthm kruskal3_refine kruskal2_refine kruskal1_refine kruskal0_refine minWeightBasis3_refine\n \nthm kruskal.refine kruskal3_refine kruskal2_refine kruskal1_refine kruskal0_refine minWeightBasis3_refine\n\n\nabbreviation \"MST == minBasis\"\n\nterm minWeightBasis3\n\n(* TODO: *) \n\nlemma k3: \"(kruskal3,kruskal2) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal3_refine) \nlemma k2: \"(kruskal2,kruskal1) \\ \\lst_graph_rel\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal2_refine) \nlemma k1: \"(kruskal1,kruskal0) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal1_refine) \nlemma k0: \"(kruskal0,minWeightBasis3) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal0_refine) \nlemma kmw: \"(minWeightBasis3,SPECT (emb minBasis (enat minBasis_time))) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) \n by (rule minWeightBasis3_refine)\n\nlemmas k_ref_spec = k3[FCOMP k2, FCOMP k1, FCOMP k0, FCOMP kmw]\n\n\n lemma [fcomp_norm_simps]: \"list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: list_assn_pure_conv)\nlemmas kruskal_ref_spec = kruskal.refine[FCOMP k_ref_spec]\n\nthm minBasis_time_def\nlemma kruskal_correct_forest:\n shows \"<$ minBasis_time> kruskal <\\r. (\\\\<^sub>Ara. hr_comp (da_assn id_assn) lst_graph_rel ra r * \\ (MST ra))>\\<^sub>t\"\nproof -\n thm extract_cost_ub \n note l= hn_refine_ref[OF _ kruskal_ref_spec[to_hnr] ]\n thm extract_cost_ub[OF l, where Cost_ub=\"minBasis_time\", simplified in_ran_emb_special_case]\n have ht: \" kruskal <\\r. emp * (\\\\<^sub>Ara. hr_comp (da_assn id_assn) lst_graph_rel ra r * \\ (ra \\ dom ((emb MST (enat minBasis_time)))))>\\<^sub>t\"\n apply(rule extract_cost_ub[OF l, where Cost_ub=\"minBasis_time\" ])\n by (auto simp: in_ran_emb_special_case) \n\n from ht show ?thesis by auto \nqed\nthm minBasis_time_def \nend\n(*\nthm extract_cost_ub[where M= \"(emb Pr t)\", no_vars]\n\nlemma \"hn_refine \\ c \\' R (SPECT (emb Pr t)) \\\n<\\ * $ t> c <\\r. \\' * (\\\\<^sub>Ara. R ra r * \\ (Pr ra))>\\<^sub>t\"\nproof -\n assume \"hn_refine \\ c \\' R (SPECT (emb Pr t))\"\n from extract_cost_ub[OF this, of t]\n show ?thesis by (simp add: ran_emb')\nqed\n \n\nlemma array_length_rule_raw [hoare_triple]:\n \"\n array_length p\n <\\r. dyn_array_raw (xs, n) p * \\(r = n)>\"\n unfolding dyn_array'_def array_length_def \n apply(cases p)\n by (sep_auto simp: zero_time) \n \n\nlemma array_max_rule_raw [hoare_triple]:\n \"\n array_max p\n <\\r. dyn_array_raw (xs, n) p * \\(r = length xs)>\"\n unfolding array_max_def \n apply (cases p)\n by (sep_auto heap: length_rule simp: zero_time) \n\n\nlemma double_length_raw_rule2 [hoare_triple]:\n \"length xs = n \\\n \n double_length p\n \\<^sub>t\" \n using double_length_raw_rule[of xs n p] by(simp add: mult.commute) \n\nlemma push_array_raw_rule [hoare_triple]:\n \"n \\ length xs \\\n \n push_array x p\n \\<^sub>t\" \n unfolding \n push_array_def \n apply(sep_auto heap: array_max_rule_raw push_array_basic_raw_rule\n array_length_rule_raw double_length_raw_rule2)\n subgoal apply(subst array_copy_length) by simp_all\n by sep_auto\n\nlemma push_array_rule''' [hoare_triple]:\n \"n \\ length xs \\\n \n push_array x p\n \\<^sub>t\" \n unfolding \n push_array_def\n apply(sep_auto heap: array_max_rule' array_length_rule' push_array_basic_rule')\n apply(sep_auto heap: double_length_rule' )\n using push_array_basic_rule'\n unfolding double_length_fun.simps\n apply(sep_auto simp only: heap: push_array_basic_rule')\n subgoal apply(subst array_copy_length) by simp_all\n by sep_auto\n \nthm array_max_rule'\n\n*)\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Examples/Kruskal/Kruskal_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.29422624734834735}} {"text": "(*\n Copyright 2017 Myriam Begel\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n*)\n\ntheory \"BasicBlocks\"\n\nimports \"../lem/Evm\"\n\"Apply_Trace_Cmd\"\n\nbegin\n(* Types definitions *)\ndatatype tblock =\nNext | Jump | Jumpi | Terminal\n\ntype_synonym position = \"int\"\ntype_synonym pos_inst = \"position * inst\"\ntype_synonym vert = \"pos_inst list * tblock\"\ntype_synonym vertex = \"int * vert\"\ntype_synonym basic_blocks = \"vertex list\"\n\ntype_synonym stack_value = \"w256 option\"\n\n(* Auxiliary functions *)\n\nabbreviation block_lookup :: \"basic_blocks \\ int \\ vert option\" where\n\"block_lookup bb == map_of bb\"\n\nabbreviation v_ind :: \"vertex \\ int\" where\n\"v_ind v == fst v\"\n\nabbreviation v_ty :: \"vertex \\ tblock\" where\n\"v_ty v == snd (snd v)\"\n\nabbreviation v_insts :: \"vertex \\ pos_inst list\" where\n\"v_insts v == fst (snd v)\"\n\ndefinition byteListInt :: \"8 word list \\ int\" where\n\"byteListInt l = uint ((word_rcat l):: 32 word)\"\n\ndefinition next_i :: \"basic_blocks \\ int \\ int\" where\n \"next_i v n = v_ind (hd (dropWhile (\\u. (v_ind u)\\n) v))\"\n(* \"next_i (i#j#l) n = (if fst i=n then fst j else next_i (j#l) n)\"*)\n\ndefinition find_block :: \"int \\ vertex \\ bool\" where\n\"find_block n bl == n=v_ind bl\"\n\nfun good_dest :: \"int \\ basic_blocks \\ bool\" where\n \"good_dest m [] = False\"\n| \"good_dest m ((n,[],_)#l) = good_dest m l\"\n| \"good_dest m ((n,(_,i)#inst,_)#l) = (if m = n then (i = Pc JUMPDEST) else good_dest m l )\"\n\ndefinition blocks_indexes :: \"basic_blocks \\ int list\" where\n\"blocks_indexes xs = map v_ind xs\"\n\nfun extract_blocks :: \"basic_blocks \\ int \\ vert option\" where\n\"extract_blocks [] = Map.empty\"\n|\"extract_blocks (x#xs) = (extract_blocks xs)(fst x:= Some (snd x))\"\n\nfun rebuild_basic_blocks :: \"int list \\ (int \\ vert option) \\ basic_blocks\" where\n\"rebuild_basic_blocks [] m = []\"\n|\"rebuild_basic_blocks (x#xs) m = (x,the (m x)) # (rebuild_basic_blocks xs m)\"\n\n(* Stack manipulations *)\n\ndefinition stack_swap :: \"stack_value list \\ nat \\ stack_value list\" where\n\"stack_swap st n = (let first = hd st in\n let unchanged = take (n -2) (tl st) in\n let to_swap = hd (drop (max (n-1) 1) st) in\n (to_swap # unchanged) @ (first # (drop n st))\n)\"\n\nvalue \"stack_swap [Value 1, Value 2, Value 3, Value 4] 2\"\n\ndefinition stack_dup :: \"stack_value list \\ nat \\ stack_value list\" where\n\"stack_dup st n = (st ! (n-1)) # st\"\n\nvalue \"stack_dup [Value 1, Value 2, Value 3, Value 4] 2\"\n\ndefinition block_pt :: \"pos_inst list \\ pos_inst \\ int\" where\n \"block_pt bl pt = (case bl of\n [] \\ fst pt\n | _ \\ fst (hd bl))\"\n\n(* Main functions *)\n\n(* Add the address of each instruction *)\n\nfun add_address' :: \"inst list \\ int \\ pos_inst list\" where\n\"add_address' [] n = []\"\n| \"add_address' (x#xs) n = (n,x)#(add_address' xs (n + inst_size x))\"\n\ndefinition add_address :: \"inst list \\ pos_inst list\" where\n\"add_address xs = add_address' xs 0\"\n\n(* The execution of a basic block must be sequential. *)\n(* We remove JUMP and JUMPI instructions and cut after them or a stopping instruction *)\n(* and before a Jump destination. *)\nfun aux_basic_block :: \"pos_inst list \\ pos_inst list \\ basic_blocks\" where\n \"aux_basic_block [] [] = []\"\n|\"aux_basic_block [] block = [(fst (hd block), block, Next)]\"\n|\"aux_basic_block ((i)#tl1) block =\n\t(let bl_pt = block_pt block i in\n (case snd i of\n Pc JUMPDEST \\ (if block = [] then (aux_basic_block tl1 [i])\n else (bl_pt, block, Next) # (aux_basic_block tl1 [i]))\n | Pc JUMP \\(bl_pt, block, Jump) # ( aux_basic_block tl1 [])\n | Pc JUMPI \\(bl_pt, block, Jumpi) # ( aux_basic_block tl1 [])\n | Misc _ \\(bl_pt, block @ [i], Terminal) # ( aux_basic_block tl1 [])\n | Unknown a \\ (bl_pt, block @ [i], Terminal) # ( aux_basic_block tl1 [])\n | _ \\ aux_basic_block tl1 (block@[i])))\"\ndeclare aux_basic_block.simps[simp del]\n\ndefinition build_basic_blocks :: \"inst list \\ basic_blocks\" where\n\"build_basic_blocks prog == aux_basic_block (add_address prog) []\"\n\ndefinition build_blocks :: \"inst list \\ basic_blocks\" where\n\"build_blocks prog = build_basic_blocks prog\"\n\n(* Verification *)\nlemmas reg_inst_splits = inst.splits misc_inst.splits pc_inst.splits\n\n(* Define how BLOCKSs should be for the program logic to be sound *)\n\nfun reg_inst :: \"inst \\ bool\" where\n \"reg_inst (Pc JUMP) = False\"\n| \"reg_inst (Pc JUMPI) = False\"\n|\"reg_inst (Pc _) = True\"\n|\"reg_inst (Misc _) = False\"\n|\"reg_inst (Unknown a) = False\"\n|\"reg_inst _ = True\"\n\ndefinition reg_block :: \"pos_inst list \\ bool\" where\n\"reg_block xs = list_all reg_inst (map snd xs)\"\n\ndefinition reg_vertex :: \"vertex \\ bool\" where\n\"reg_vertex v = (case v_ty v of\nTerminal \\ reg_block (butlast (v_insts v))\n| _ \\ reg_block (v_insts v))\"\n\ndefinition reg_basic_blocks :: \"basic_blocks \\ bool\" where\n\"reg_basic_blocks xs = list_all reg_vertex xs\"\n\nfun seq_block :: \"pos_inst list \\ bool\" where \n\"seq_block [] = True\"\n| \"seq_block [x] = True\"\n| \"seq_block (x#y#ys) = (fst y = fst x + inst_size (snd x) \\ seq_block (y#ys))\"\ndeclare seq_block.simps[simp del]\n\ndefinition last_no::\"pos_inst list \\ bool\" where\n\"last_no insts == (\\a. snd (last insts) = Misc a) \\ (\\a. snd (last insts) = Unknown a)\"\n\ndefinition wf_blocks:: \"basic_blocks \\ bool\" where\n\"wf_blocks c == \n(\\n insts ty.\n(block_lookup c n = Some (insts, ty) \\\n\tn \\ set (blocks_indexes c) \\ reg_vertex (n, insts, ty) \\\n (insts \\ [] \\ (fst (hd insts) = n)) \\ seq_block insts \\\n 0 \\ n \\ n < 2 ^ 256) \\\n(block_lookup c n = Some (insts, Next) \\\n\t insts \\ []) \\\n(block_lookup c n = Some (insts, Terminal) \\\n\t insts \\ [] \\ last_no insts)\n)\"\n\n(* Proof that we build well formed BLOCKSs *)\n\nlemma index_have_blocks:\n\"c = build_blocks bytecode \\\n \\ block_lookup c n = None \\\n n \\ set (blocks_indexes c)\"\nby(simp add: Let_def build_blocks_def blocks_indexes_def map_of_eq_None_iff)\n\nlemma index_block_eq:\n\"(n, (j,i)#b, t)#xs = aux_basic_block insts block \\\nj=n\"\napply(induction insts arbitrary: block n j i t xs b)\n apply(case_tac block)\n apply(simp add: aux_basic_block.simps block_pt_def split:if_splits list.splits)\n apply(clarsimp)\n apply(simp add: aux_basic_block.simps block_pt_def split:if_splits list.splits)\n apply(clarsimp)\napply(simp add: aux_basic_block.simps Let_def)\napply(simp split: inst.splits add: inst_size_def inst_code.simps)\n apply(clarsimp simp add: block_pt_def split: list.splits)\n apply(clarsimp simp add: block_pt_def split: pc_inst.splits list.splits if_splits)\napply(clarsimp simp add: block_pt_def split: misc_inst.splits list.splits)\ndone\n\nlemma seq_block_compose:\n\"seq_block bl \\\n \\i j. bl \\ [] \\ last bl = (j, i) \\ m = j + inst_size i \\\n seq_block (bl @ [(m, a)])\"\napply(induction bl)\n apply(simp add: seq_block.simps)\napply(case_tac bl; simp)\n apply(simp add: seq_block.simps)\napply(simp add: seq_block.simps)\ndone\n\nlemma in_aux_bb_intermediate:\n\"(n, b, t) \\ set (aux_basic_block insts block) \\\n\\ys bl xs. (n, b, t)#xs = aux_basic_block ys bl\"\napply(induction insts arbitrary: block)\n apply(rule_tac x=\"[]\" in exI)\n apply(case_tac block)\n apply(simp add: aux_basic_block.simps split: if_splits)+\n apply(rule_tac x=block in exI, simp add: aux_basic_block.simps)\napply(subgoal_tac \"(n, b, t) \\ set\n\t\t\t(aux_basic_block (a # insts) block)\")\n apply(drule subst[OF aux_basic_block.simps(3)])\n apply(simp add: Let_def)\n apply(clarsimp split: inst.splits simp add: inst_size_def inst_code.simps)\n apply(erule disjE, rule_tac x=\"(a,Unknown x1) # insts\" in exI, rule_tac x=block in exI,\n\t\t\t\tsimp add: aux_basic_block.simps Let_def, fastforce)\n apply(simp split: pc_inst.splits if_splits add: inst_size_def inst_code.simps;\n\t\t\t\terule disjE, rule_tac x=\"(a,Pc x9) # insts\" in exI, rule_tac x=block in exI,\n\t\t\t\tsimp add: aux_basic_block.simps Let_def, fastforce)\n apply(erule disjE, rule_tac x=\"(a,Misc x13) # insts\" in exI, rule_tac x=block in exI,\n\t\t\t\tsimp add: aux_basic_block.simps Let_def, fastforce)\napply(assumption)\ndone\n\n(* Lemmas to show that build blocks are regular *)\nlemma list_all_in:\n\"x \\ set xs \\ list_all P xs \\ P x\"\n apply(induction xs)\n apply(simp)\n apply(case_tac \"x=a\"; simp)\ndone\n\nlemma reg_block_butlast:\n\"reg_block xs \\ reg_block (butlast xs)\"\n apply(induction xs)\n apply(simp)\n apply(simp add: reg_block_def List.List.list.pred_map)\ndone\n\nlemmas reg_simps =\nreg_basic_blocks_def reg_vertex_def reg_block_def\n\nlemma reg_aux_bb:\n\"reg_block block \\\n reg_basic_blocks (aux_basic_block insts block)\"\n apply(induction insts arbitrary: block)\n apply(case_tac block)\n apply(simp add: reg_simps aux_basic_block.simps)\n apply(simp add: reg_basic_blocks_def reg_vertex_def aux_basic_block.simps)\n apply(simp add:Let_def aux_basic_block.simps)\n apply(case_tac block; clarsimp)\n apply(simp split: inst.split pc_inst.split misc_inst.split)\n apply(simp add:reg_simps)\n apply(simp split: inst.split pc_inst.split misc_inst.split)\n apply(simp add:reg_simps)\ndone\n\nlemma reg_bb:\n\"reg_basic_blocks (build_basic_blocks insts)\"\n apply(simp add: build_basic_blocks_def)\n apply(rule reg_aux_bb)\n apply(simp add: reg_simps)\ndone\nvalue \"sum_list (map inst_size [Pc JUMP, Pc PC])\"\n\nlemma seq_block_tl:\n\"seq_block (x#xs) \\ seq_block xs\"\napply(case_tac xs)\n apply(simp add: seq_block.simps)+\ndone\n\nlemma seq_block_append:\n\"seq_block bl \\\nbl \\ [] \\ fst a = fst (last bl) + inst_size (snd (last bl))\\\nseq_block (bl@[a])\"\napply(induction bl; simp add: seq_block.simps)\napply(simp add: seq_block_tl)\napply(case_tac bl; simp add: seq_block.simps)\ndone\n\nlemma seq_block_tl':\n\"seq_block (xs@ys) \\ seq_block ys\"\napply(induction xs; simp add: seq_block.simps)\napply(simp add: seq_block_tl)\ndone\n\nlemma inst_size_pos:\n\"inst_size x > 0\"\napply(simp add: inst_size_def)\napply(case_tac x; clarsimp simp add: inst_code.simps)\napply(case_tac x10; clarsimp simp add: stack_inst_code.simps)\napply(simp split: if_splits)\ndone\n\nabbreviation bound where\n\"bound mini maxi n == mini \\ (fst n) \\ (fst n) < maxi\"\n\nlemma sequential_basic_blocks:\n\"seq_block ys \\\n seq_block bl \\\n list_all (bound 0 m) ys \\\n list_all (bound 0 m) bl \\\n ys \\ [] \\ bl \\ [] \\ fst (hd ys) = fst (last bl) + inst_size (snd (last bl))\\\n (n, insts, ty) \\ set (aux_basic_block ys bl) \\\n seq_block insts \\ 0 \\ n \\ n < m\"\napply(induction ys arbitrary: bl)\n apply(case_tac bl; simp add: aux_basic_block.simps)\napply(simp add: aux_basic_block.simps Let_def)\n apply(case_tac \"reg_inst (snd a) \\ (snd a) \\ Pc JUMPDEST\")\n apply(drule_tac x=\"bl@[a]\" in meta_spec)\n apply(simp add: seq_block_tl seq_block_append)\n apply(drule meta_mp; clarsimp; case_tac ys; simp add: seq_block.simps;\n simp split: reg_inst_splits)\napply(case_tac \"(snd a) = Pc JUMPDEST\")\n apply(clarsimp)\n apply(drule_tac x=\"[(a, Pc JUMPDEST)]\" in meta_spec)\n apply(simp add: seq_block_tl seq_block.simps)\n apply(drule meta_mp; case_tac ys; simp add: seq_block.simps)\n apply(case_tac \"bl=[]\"; simp split: if_splits)\n apply(erule disjE; clarsimp simp add: block_pt_def split: list.splits)\n apply(case_tac \"bl=[]\"; simp split: if_splits)\n apply(erule disjE; clarsimp simp add: block_pt_def split: list.splits)\napply(drule meta_spec[where x=\"[]\"])\napply(simp add: seq_block_tl seq_block_append seq_block.simps)\napply(simp split: reg_inst_splits)\n apply(erule disjE; clarsimp simp add: block_pt_def seq_block_append split: list.splits)+\ndone\n\nlemma seq_block_add_address:\n\"seq_block (add_address' insts k)\"\napply(induction insts arbitrary:k)\n apply(simp add: seq_block.simps)\napply(simp)\napply(case_tac insts; simp add: seq_block.simps)\ndone\n\nlemma bound_add_address':\n\"(x,y) \\ set (add_address' xs k) \\\nk \\ x \\ x \\ fst (last (add_address' xs k))\"\napply(induction xs arbitrary: k x y)\n apply(simp)\napply(simp)\napply(erule disjE; simp)\n apply(case_tac \"add_address' xs (k + inst_size a)\"; clarsimp)\n apply(drule_tac x=\"k + inst_size a\" in meta_spec; drule_tac x=\"aa\" and y=\"b\" in meta_spec2)\n apply(simp split: list.splits if_splits)\n apply(case_tac xs; simp)\n apply(drule conjunct1; drule sym[where s=\"_ + _\"]; simp add: inst_size_pos Orderings.order_class.order.strict_implies_order)\n apply(erule conjE)\n apply(subgoal_tac \"k \\ k + inst_size a\"; simp)\n apply(simp add: inst_size_pos Orderings.order_class.order.strict_implies_order)\napply(drule_tac x=\"k + inst_size a\" in meta_spec; drule_tac x=\"x\" and y=\"y\" in meta_spec2)\napply(simp)\napply(erule conjE)\napply(rule conjI; clarsimp)\napply(subgoal_tac \"k \\ k + inst_size a\"; simp)\napply(simp add: inst_size_pos Orderings.order_class.order.strict_implies_order)\ndone\n\nlemma non_empty_block_next:\n\"(n, [], Next) # xs = aux_basic_block ys bl \\ False\"\napply(induction ys arbitrary:bl)\n apply(case_tac bl; simp add: aux_basic_block.simps)\napply(simp add: aux_basic_block.simps Let_def)\napply(simp split: reg_inst_splits if_splits; fastforce)\ndone\n\nlemma block_no:\n\"(n, insts, Terminal) \\ set (aux_basic_block ys bl) \\\n reg_block bl \\\n insts \\ [] \\ last_no insts\"\napply(induction ys arbitrary:bl)\n apply(case_tac bl; simp add: aux_basic_block.simps last_no_def)\napply(simp add: aux_basic_block.simps Let_def)\napply(case_tac \"reg_inst (snd a) \\ snd a \\ Pc JUMPDEST\")\n apply(drule_tac x=\"bl @ [a]\" in meta_spec; simp add: reg_block_def)\n apply(simp split: reg_inst_splits if_splits)\napply(case_tac \"snd a = Pc JUMPDEST\")\n apply(simp; case_tac bl; simp split: if_splits)\n apply(drule_tac x=\"[a]\" in meta_spec; simp add: reg_block_def)\n apply(drule_tac x=\"[a]\" in meta_spec; simp add: reg_block_def)\napply(drule_tac x=\"[]\" in meta_spec; simp add: reg_block_def)\napply(simp split: reg_inst_splits if_splits)\n apply(erule disjE; simp add: last_no_def)+\ndone\n\n(* Main theorem *)\n\nlemma wf_build_blocks:\n\"fst (last (add_address bytecode)) < 2^256 \\\nwf_blocks (build_blocks bytecode)\"\n apply(simp add: wf_blocks_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(clarsimp; rule conjI)\n apply(case_tac \"\\ block_lookup (build_blocks bytecode) n = None\")\n apply(simp add: index_have_blocks)\n apply(simp)\n apply(simp add: build_blocks_def Let_def)\n apply(drule map_of_SomeD)\n apply(rule conjI)\n apply(cut_tac reg_bb[where insts=bytecode])\n apply(simp add: reg_basic_blocks_def list_all_in)\n apply(rule conjI)\n\t apply(simp add: build_basic_blocks_def)\n\t apply(drule in_aux_bb_intermediate, clarify)\n\t apply(case_tac insts; clarsimp simp add: index_block_eq)\n\tapply(simp add: build_basic_blocks_def)\n apply(rule_tac ty=ty in sequential_basic_blocks[where ys=\"add_address bytecode\" and bl=\"[]\"])\n apply(simp add: seq_block_add_address add_address_def)\n apply(simp add: seq_block.simps)\n apply(clarsimp simp add: list_all_def add_address_def)\n apply(cut_tac x=a and y=b in bound_add_address'[where xs=bytecode and k=0]; simp)\n apply(simp)+\n apply(thin_tac \"_ < _\")\n apply(rule conjI)\n apply(simp add: build_blocks_def Let_def build_basic_blocks_def)\n apply(rule impI)\n apply(drule map_of_SomeD)\n apply(drule in_aux_bb_intermediate, clarify)\n apply(drule non_empty_block_next; simp)\n apply(rule impI)\n apply(simp add: build_blocks_def Let_def build_basic_blocks_def)\n apply(drule map_of_SomeD)\n apply(drule block_no; simp add: reg_block_def)\ndone\n\n(* Check that we can rebuild the initial list of instructions from basic blocks *)\nfun inst_size_list::\"pos_inst list \\ int\" where\n\"inst_size_list [] = 0\"\n| \"inst_size_list (x#xs) = inst_size (snd x) + inst_size_list xs\"\n\nlemma seq_block_sumC:\n\"seq_block ((i,j) # list @ (a, b) # xs) \\\n i + (inst_size j + inst_size_list list) = a\"\napply(induction list arbitrary: i j; clarsimp)\n apply(simp add: seq_block.simps)\napply(simp add: seq_block.simps)\napply(fastforce)\ndone\n\nfun rebuild_with_add :: \"basic_blocks \\ pos_inst list\" where\n \"rebuild_with_add [] = []\"\n| \"rebuild_with_add ((n,b,Jump)#q) = b@[(n+inst_size_list b,Pc JUMP)] @ (rebuild_with_add q)\"\n| \"rebuild_with_add ((n,b,Jumpi)#q) = b@[(n+inst_size_list b,Pc JUMPI)] @ (rebuild_with_add q)\"\n| \"rebuild_with_add ((n,b,_)#q) = b @ (rebuild_with_add q)\"\n\nlemma rev_rebuild_with_add_aux:\nnotes if_split[split del]\nshows\n\"seq_block (b@c) \\\nrebuild_with_add (aux_basic_block c b) =\n b@c\"\napply(induction c arbitrary: b)\n apply(case_tac b; simp add: aux_basic_block.simps)\napply(simp add: aux_basic_block.simps Let_def)\napply(case_tac \"reg_inst (snd a) \\ snd a \\ Pc JUMPDEST\")\n apply(simp split: reg_inst_splits)\n apply(drule conjunct1; rule conjI, clarsimp)\n apply(rule conjI)\n apply(rule allI; clarify; rule conjI; clarsimp)\n apply(clarsimp)\napply(case_tac \"snd a = Pc JUMPDEST\"; clarsimp)\n apply(simp split: if_splits)\n apply(drule_tac x=\"[(a, Pc JUMPDEST)]\" in meta_spec)\n apply(simp add: seq_block_tl')\napply(drule_tac x=\"[]\" in meta_spec)\napply(drule meta_mp)\napply(simp add: seq_block_tl'[where xs=\"_ @ [(_,_)]\"])\napply(case_tac b; simp)\n apply(rename_tac x; case_tac x; simp add: block_pt_def; case_tac ba; simp add: seq_block_sumC)+\ndone\n \nlemma rev_rebuild_with_add:\n\"rebuild_with_add (build_blocks c) = add_address c\"\napply(simp add: build_blocks_def Let_def)\napply(simp add: build_basic_blocks_def)\napply(subst rev_rebuild_with_add_aux)\n apply(simp add: seq_block_add_address add_address_def)\napply(simp)\ndone\n\nfun reconstruct_bytecode :: \"basic_blocks \\ inst list\" where\n \"reconstruct_bytecode [] = []\"\n| \"reconstruct_bytecode ((n,b,Jump)#q) = (map snd b)@[Pc JUMP] @ (reconstruct_bytecode q)\"\n| \"reconstruct_bytecode ((n,b,Jumpi)#q) = (map snd b)@[Pc JUMPI] @ (reconstruct_bytecode q)\"\n| \"reconstruct_bytecode ((n,b,_)#q) = (map snd b) @ (reconstruct_bytecode q)\"\n\nlemma rev_basic_blocks: \"reconstruct_bytecode (aux_basic_block i b) = (map snd b)@(map snd i)\"\napply(induction i arbitrary: b)\napply(case_tac b)\napply(auto simp: Let_def aux_basic_block.simps split: reg_inst_splits)\ndone\n\nlemma remove_address:\n\"map snd (add_address' i k) = i\"\nby(induction i arbitrary: k; simp)\n\nlemma reverse_basic_blocks: \"reconstruct_bytecode (build_basic_blocks i) = i\"\napply(simp add: rev_basic_blocks build_basic_blocks_def add_address_def remove_address)\ndone\n\ndefinition blocks_insts :: \"basic_blocks \\ pos_inst set\" where\n\"blocks_insts b = set (rebuild_with_add b)\"\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/attic/BasicBlocks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.29422624734834735}} {"text": "theory Proof_1_500\n imports Proofs1\nbegin\n\nabbreviation s where \" s s0 PdOut'value paid'value opened'value \\\n(toEnv\n (setPstate\n (setVarBool (setVarBool (setVarBool s0 PdOut' PdOut'value) paid' paid'value) opened' opened'value)\n Init'init' Controller'isOpened'))\"\n\ntheorem proof_1_500: \"VC500 inv1 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC500_def inv1_def R1_def)\n apply(rule impI)\n apply(rule conjI)\n apply(rule conjI)\n apply simp\n apply(unfold extraInv_def)\n apply(erule conjE)\n apply(erule conjE)\n apply((rule allI)+)\n subgoal premises vc_prems for s1 s2\n apply(insert vc_prems(2))\n apply(erule conjE)\n subgoal premises invs0\n apply(rule impI)\n apply((erule conjE)+)\n apply(erule le_imp_less_or_eq[THEN disjE])\n apply(rule cut_rl[of \" \\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ 10 - 1 \\\n \\ getVarBool s4 Controller'minimalOpened' \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\ getVarBool s3 Controller'minimalOpened')\"])\n apply(erule exE)\n subgoal for s4\n apply(rule exI[of _ s4])\n by simp\n apply(insert invs0(1))[1]\n apply(erule conjE)\n apply(erule allE[of _ s1])\n apply(erule allE[of _ s2])\n apply(simp split: if_splits)\n apply(rule cut_rl[of \"\\ s5. toEnvP s5 \\ substate s2 s5 \\ substate s5 (s s0 PdOut_value paid_value opened_value) \\\npred1 s1 s2 (s s0 PdOut_value paid_value opened_value) s5\"])\n apply(erule allE[of _ s2])\n apply(erule impE)\n using substate_refl apply blast\n apply(unfold pred1_def)\n apply(erule impE)\n apply(insert substate_refl substate_trans substate_antisym)[1]\n apply blast\n apply assumption\n apply(rule allI)\n subgoal premises prems for s5\n apply(induction rule: state_ind)\n using prems apply simp\n apply(rule impI)\n\n apply(rule impE[OF minimalOpened_not_passed_R1[of s1 s2 s0 s0]])\n using vc_prems(1) apply(simp split: if_splits)\n using invs0(2) substate_refl\n apply (smt (verit))\n apply(erule exE)\n subgoal for s3\n apply((erule conjE)+)\n apply(erule allE[of _ s3])\n apply(erule impE)\n using substate_antisym[of s3 s0] substate_refl apply auto[1]\n by blast\n\n subgoal for s5\n apply(rule impI)\n apply(cases \"getVarBool (predEnv s5) open' = False\")\n apply(rule exI[of _ \"predEnv s5\"])\n apply(rule conjI)\n apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n apply blast\n apply(rule conjI)\n using substate_refl apply simp\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(rule conjI)\n using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 PdOut_value paid_value opened_value) \"] \n apply fastforce\n apply(rule conjI)\n apply blast\n using substate_antisym apply blast\n apply(drule impE)\n prefer 3\n apply assumption\n apply(((rule conjI),blast)+)\n using substate_imp_substatete_predEnv_or_eq apply blast\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule exI[of _ s4])\n apply(rule conjI)\n apply blast\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(((rule conjI),blast)+)\n using predEnv_substate_imp_substate_or_eq by blast\n done\n done\n done\n done\n \n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proof_1_500.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.29422624734834735}} {"text": "theory Finite_Linear_Priority_Tick\n\nimports\n Finite_Linear_Priority\n Finite_Linear_Tick_Param\n Finite_Linear_Induction\nbegin\n\nlemma prirelacc_not_in_imp [simp]:\n assumes \"prirelacc p A Z\" \"e \\\\<^sub>\\\\<^sub>\\ Z\"\n shows \"e \\\\<^sub>\\\\<^sub>\\ A\"\n using assms by(induct p A Z rule:prirelacc.induct, auto)\n\nlemma pri_tickWF:\n assumes \"prirel p x Z\" \"tickWF tick Z\"\n shows \"tickWF tick x\"\n using assms apply (induct p x Z arbitrary:tick rule:prirel.induct, auto)\n by (case_tac aa, auto, case_tac x1, auto)\n\nlemma FLTick0_pri:\n assumes \"FLTick0 tick P\"\n shows \"FLTick0 tick (Pri p P)\"\n using assms unfolding FLTick0_def Pri_def apply auto\n by (simp add: pri_tickWF)\n\nlemma prirel_extend_both_last_null_imp:\n assumes \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\)\" \"length \\ = length \\\" \"a \\\\<^sub>\\\\<^sub>\\ A\" \"last \\ = \\\" \"last \\ = \\\"\n shows \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\(A,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (\\ &\\<^sub>\\\\<^sub>\\ \\(A,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n using assms by (induct \\ \\ rule:prirel.induct, auto)\n\nlemma prirel_extend_both_last_null_imp2:\n assumes \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) (\\ &\\<^sub>\\\\<^sub>\\ \\B\\\\<^sub>\\\\<^sub>\\)\" \"length \\ = length \\\" \"a \\\\<^sub>\\\\<^sub>\\ A\" \"last \\ = \\\" \"last \\ = \\\" \"\\e. e \\\\<^sub>\\\\<^sub>\\ A \\ e \\\\<^sub>\\\\<^sub>\\ B\"\n shows \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\(A,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (\\ &\\<^sub>\\\\<^sub>\\ \\(B,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n using assms by (induct \\ \\ rule:prirel.induct, auto)\n\nlemma prirel_eq_length_imp_last_member:\n assumes \"length xs = length ys\" \"last xs = \\\" \"last ys \\ \\\" \"prirel p (xs &\\<^sub>\\\\<^sub>\\ \\x\\\\<^sub>\\\\<^sub>\\) ys\"\n shows \"\\e. e \\\\<^sub>\\\\<^sub>\\ x \\ e \\\\<^sub>\\\\<^sub>\\ last ys\"\n using assms\nproof(induct p xs ys rule:prirel.induct)\n case (1 p A Z)\n then show ?case apply auto\n apply (cases x, auto)\n apply (cases A, auto)\n by (cases Z, auto)\nnext\n case (2 p A Z zz)\nthen show ?case by auto\nnext\n case (3 p A aa Z)\n then show ?case by auto\nnext\n case (4 p A aa Z zz)\n then show ?case by auto\nqed\n \nlemma pri_FL2:\n assumes \"FL2 P\" \"a \\\\<^sub>\\\\<^sub>\\ A\" \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) Z\" \"Z \\ P\"\n shows \"\\Z. prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\(A,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) Z \\ Z \\ P\"\n using assms\nproof (cases \"last \\ = \\\")\n case True\n then obtain \\ where pGama:\"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) \\ \\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\ = Z \\ length \\ = length \\\"\n using assms \n by (metis Finite_Linear_Model.last.simps(1) acceptance.distinct(1) add_cancel_right_right amember.elims(2) concat_FL_last_not_bullet_absorb last_bullet_then_last_cons length.simps(1) length_cons prirel_cons_eq_length_imp_prirel_acceptances_last_bullet_eq prirel_cons_eq_length_imp_prirel_acceptances_last_not_bullet prirel_same_length)\n then show ?thesis\n proof (cases \"last \\ = \\\")\n case True\n then show ?thesis \n by (metis FL2_def pGama assms(1) assms(2) assms(4) concat_FL_last_not_bullet_absorb prirel_extend_both_last_null_imp)\n next\n case False\n then have \"\\ = Z\"\n using concat_FL_last_not_bullet_absorb pGama by fastforce\n then have \"\\e. e \\\\<^sub>\\\\<^sub>\\ A \\ e \\\\<^sub>\\\\<^sub>\\ last \\\"\n using True pGama False assms(3) prirel_eq_length_imp_last_member by blast\n then have \"\\ = butlast \\ &\\<^sub>\\\\<^sub>\\ \\last \\\\\\<^sub>\\\\<^sub>\\\"\n by (simp add: butlast_last_cons2_FL)\n then have \"butlast \\ &\\<^sub>\\\\<^sub>\\ \\(last \\,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P\"\n by (metis FL2_def \\\\ = Z\\ \\\\e. e \\\\<^sub>\\\\<^sub>\\ A \\ e \\\\<^sub>\\\\<^sub>\\ Finite_Linear_Model.last \\\\ assms(1) assms(2) assms(4))\n\n have \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) \\\"\n using pGama \\\\ = Z\\ by auto\n then have \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) (butlast \\ &\\<^sub>\\\\<^sub>\\ \\last \\\\\\<^sub>\\\\<^sub>\\)\"\n by (simp add: butlast_last_cons2_FL)\n have \"length \\ = length (butlast \\)\"\n by (metis butlast_last_cons2_FL pGama rev_rev_butlast strong_less_eq_fltrace_cons_imp_lhs strong_less_eq_fltrace_eq_length strong_less_eq_fltrace_refl)\n\n then have \"prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\(A,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (butlast \\ &\\<^sub>\\\\<^sub>\\ \\(last \\,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n using True \\\\e. e \\\\<^sub>\\\\<^sub>\\ A \\ e \\\\<^sub>\\\\<^sub>\\ Finite_Linear_Model.last \\\\ \\prirel p (\\ &\\<^sub>\\\\<^sub>\\ \\A\\\\<^sub>\\\\<^sub>\\) (Finite_Linear_Model.butlast \\ &\\<^sub>\\\\<^sub>\\ \\Finite_Linear_Model.last \\\\\\<^sub>\\\\<^sub>\\)\\ assms(2) last_butlast_cons_bullet prirel_extend_both_last_null_imp2 by fastforce\n then show ?thesis\n using \\Finite_Linear_Model.butlast \\ &\\<^sub>\\\\<^sub>\\ \\(Finite_Linear_Model.last \\,a)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P\\ by blast\n qed\nnext\ncase False\n then show ?thesis \n using assms\n by (metis concat_FL_last_not_bullet_absorb)\nqed\n\nlemma FL2_pri:\n assumes \"FL2 P\"\n shows \"FL2 (Pri p P)\"\n using assms unfolding FL2_def Pri_def apply auto\n by (simp add: assms pri_FL2)\n\ntext \\Does Pri distribute through sequential composition in this model?\\\n\nlemma prirel_consFL_both_imp:\n assumes \"prirel p (x &\\<^sub>\\\\<^sub>\\y) (s &\\<^sub>\\\\<^sub>\\ t)\" \"length x = length s\" \"last x = \\\" \"last s = \\\"\n shows \"prirel p x s\"\n using assms by(induct x s rule:prirel.induct, auto)\n\nlemma prirel_consFL_both_imp':\n assumes \"prirel p x s\" \"prirel p y t\" \n shows \"prirel p (x &\\<^sub>\\\\<^sub>\\y) (s &\\<^sub>\\\\<^sub>\\ t)\" \n using assms apply(induct x s rule:prirel.induct, auto)\n apply (case_tac A, auto, case_tac Z, auto)\n apply (smt Collect_cong Finite_Linear_Model.last.simps(1) acceptance.distinct(1) concat_FL_last_not_bullet_absorb prirel.simps(1) prirelacc.simps(2))\n by (case_tac A, auto)\n\nlemma prirel_consFL_exists:\n assumes \"prirel p x (s &\\<^sub>\\\\<^sub>\\ t)\"\n shows \"\\y. prirel p y s\"\n using assms apply(induct x s rule:prirel.induct, auto) \n apply (metis Finite_Linear_Model.last.simps(1) concat_FL_last_not_bullet_absorb prirelAlt_bullet_refl prirelAlt_imp_prirel)\n apply (metis Finite_Linear_Model.last.simps(1) concat_FL_last_not_bullet_absorb prirelAlt_bullet_refl prirelAlt_imp_prirel)\n using prirel.simps(4) apply fastforce\n apply (metis prirel.simps(4))\n using prirel.simps(4) apply fastforce\n using prirel.simps(4) apply fastforce\n by (metis prirel.simps(4) prirelacc.simps(1))\n \n\nlemma prirel_consFL_last_bullet_exists:\n assumes \"prirel p x (s &\\<^sub>\\\\<^sub>\\ t)\" \"last s = \\\"\n shows \"\\s0 t0. x = s0 &\\<^sub>\\\\<^sub>\\ t0 \\ prirel p s0 s \\ prirel p t0 t\"\n using assms apply(induct x s rule:prirel.induct, auto)\n apply (metis bullet_left_zero2 prirelAlt_bullet_refl prirelAlt_imp_prirel)\n apply (metis bullet_left_zero2 prirelAlt_bullet_refl prirelAlt_imp_prirel)\n apply (metis fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq amember.simps(1) event.rep_eq fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq event.rep_eq fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq fltrace_concat2.simps(2) prirel.simps(4) prirelacc.simps(1))\n by (metis fltrace_concat2.simps(2) prirel.simps(4) prirelacc.simps(1))\n\nlemma prirel_consFL_last_bullet_exists':\n assumes \"prirel p (s &\\<^sub>\\\\<^sub>\\ t) x\" \"last s = \\\"\n shows \"\\s0 t0. x = s0 &\\<^sub>\\\\<^sub>\\ t0 \\ prirel p s s0 \\ prirel p t t0\"\n using assms apply(induct x s rule:prirel.induct, auto)\n apply (metis bullet_left_zero2 prirelAlt_bullet_refl prirelAlt_imp_prirel)\n apply (metis bullet_left_zero2 prirelAlt_bullet_refl prirelAlt_imp_prirel)\n apply (metis fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq amember.simps(1) event.rep_eq fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq event.rep_eq fltrace_concat2.simps(2) prirel.simps(4))\n apply (metis acceptance.rep_eq fltrace_concat2.simps(2) prirel.simps(4) prirelacc.simps(1))\n by (metis fltrace_concat2.simps(2) prirel.simps(4) prirelacc.simps(1))\n(* non trivial *)\n\nlemma prirel_not_events:\n assumes \"prirel p x s\" \"tick \\ events s\"\n shows \"tick \\ events x\"\n using assms by (induct p x s rule:prirel.induct, auto)\n\nlemma prirel_not_events':\n assumes \"prirel p x s\" \"tick \\ events x\"\n shows \"tick \\ events s\"\n using assms by (induct p x s rule:prirel.induct, auto)\n\nlemma prirel_consFL_both_imp_prirel:\n assumes \"prirel p (s &\\<^sub>\\\\<^sub>\\ t) (u &\\<^sub>\\\\<^sub>\\ v)\" \"last s = \\\" \"last u = \\\" \"length s = length u\"\n shows \"prirel p t v\"\n using assms by(induct p s u rule:prirel.induct, auto)\n\nlemma prirel_consFL_last_bullet_both:\n assumes \"prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,b)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (ys &\\<^sub>\\\\<^sub>\\ \\(a,c)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\" \"last s = \\\" \"last ys = \\\" \"maximal(p,b)\" \"c \\\\<^sub>\\\\<^sub>\\ a \\ a = \\\"\n shows \"b = c\"\n using assms apply(induct p s ys rule:prirel.induct, auto)\n apply (case_tac Z, auto)\n apply (metis (no_types, hide_lams) Finite_Linear_Model.butlast.simps(1) butlast_last_cons2_FL concat_FL_last_not_bullet_absorb fltrace.exhaust prirel.simps(1) prirel.simps(2) rev3.simps(1) rev3_little_more_extra)\n apply (metis fltrace.distinct(1) fltrace.exhaust prirel.simps(2) rev3.simps(1) rev3_little_more_extra)\n apply (metis Finite_Linear_Model.butlast.simps(1) bullet_left_zero2 butlast_last_cons2_FL fltrace.exhaust fltrace_concat2.simps(2) prirel.simps(2))\n by (metis Finite_Linear_Model.butlast.simps(1) bullet_right_zero2 butlast_last_cons2_FL fltrace.exhaust fltrace_concat2.simps(2) prirel.simps(3) s_and_tick_iff)+\n\nlemma tickWF_consFL_tick_imp_bullet:\n assumes \"tickWF tick (ys &\\<^sub>\\\\<^sub>\\ \\(y,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\" \"last ys = \\\" \"tick \\\\<^sub>\\\\<^sub>\\ y \\ y = \\\"\n shows \"y = \\\"\n using assms apply (induct ys rule:tickWF.induct, auto)\n by (metis fltrace.distinct(1) rev3.simps(1) rev3_little_more)\n\nlemma prirel_exists_tick_max:\n assumes \"prirel p S Z\" \"last s = \\\" \"maximal(p,tick)\" \"S = (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\" \"tickWF tick Z\"\n shows \"\\z. last z = \\ \\ Z = (z &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) \\ length s = length z\"\n using assms \nproof (induct S Z rule:ftrace_cons_induct_both_eq_length)\n case 1\n then show ?case \n using assms(1) prirel_same_length by blast\nnext\n case (2 x y)\n then show ?case \n by (metis fltrace.distinct(1) rev3.simps(1) rev3_little_more)\nnext\n case (3 x y xs ys)\n then show ?case \n by (metis Finite_Linear_Model.last.simps(1) bullet_right_zero2 last_bullet_then_last_cons last_cons_bullet_iff prirel.simps(1) prirel_consFL_both_imp_prirel)\nnext\n case (4 x y xs ys)\n then have \"prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (ys &\\<^sub>\\\\<^sub>\\ \\y,\\\\\\<^sub>\\\\<^sub>\\)\"\n by auto\n then obtain yA yEvent where yA:\"y = (yA,yEvent)\\<^sub>\\\\<^sub>\\ \\ (yEvent \\\\<^sub>\\\\<^sub>\\ yA \\ yA = \\)\"\n proof -\n assume a1: \"\\yA yEvent. y = (yA,yEvent)\\<^sub>\\\\<^sub>\\ \\ (yEvent \\\\<^sub>\\\\<^sub>\\ yA \\ yA = \\) \\ thesis\"\n have \"y \\ (acceptance y,event y)\\<^sub>\\\\<^sub>\\\"\n by (simp add: less_eq_aevent_def)\n then show ?thesis\n using a1 by (metis aevent_less_eq_iff_components event_in_acceptance)\n qed\n then have \"prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (ys &\\<^sub>\\\\<^sub>\\ \\(yA,yEvent)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n using \"4.prems\"(1) \"4.prems\"(4) by auto\n then have \"yEvent = tick\"\n \"yA = \\\"\n using prirel_consFL_last_bullet_both \"4.hyps\"(4) yA assms(2) assms(3) apply fastforce\n using 4 tickWF_consFL_tick_imp_bullet \n by (metis prirel_consFL_last_bullet_both yA)\n then have \"ys &\\<^sub>\\\\<^sub>\\ \\y,\\\\\\<^sub>\\\\<^sub>\\ = ys &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ Finite_Linear_Model.length s = Finite_Linear_Model.length ys\"\n by (metis \"4.hyps\"(2) \"4.hyps\"(3) \"4.prems\"(4) assms(2) fltrace.inject(2) rev3_little_more rev3_rev3_const2_last yA)\n then show ?case\n using \"4.hyps\"(4) by blast\nqed\n\nlemma pri_dist_SeqComp:\n assumes \"FLTick0 tick P\" \"maximal(p,tick)\"\n shows \"Pri p (P (tick);\\<^sub>\\\\<^sub>\\ Q) = ((Pri p P) (tick);\\<^sub>\\\\<^sub>\\ (Pri p Q))\"\n using assms unfolding Pri_def SeqComp_def\nproof (auto)\n fix \"x\" \"s\" \"t\"\n assume assm0:\"FLTick0 tick P\"\n and assm1:\"prirel p x (s &\\<^sub>\\\\<^sub>\\ t)\"\n and assm2:\"s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P\"\n and assm3:\"t \\ Q\"\n show \"\\s. (\\Z. prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) Z \\ Z \\ P) \\ (\\t. (\\Z. prirel p t Z \\ Z \\ Q) \\ x = s &\\<^sub>\\\\<^sub>\\ t) \\\n (\\Z. prirel p s Z \\ Z \\ P) \\ tick \\ events s \\ x = s\"\n proof (cases \"last s = \\\")\n case True\n then obtain s0 t0 where s0t0:\"x = s0 &\\<^sub>\\\\<^sub>\\ t0 \\ prirel p s0 s \\ prirel p t0 t\"\n using assm1 prirel_consFL_last_bullet_exists by blast\n then have \"prirel p \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\\"\n using assms(2) by auto\n then have \"prirel p (s0 &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n using s0t0 prirel_consFL_both_imp' by blast \n then show ?thesis\n using assm2 assm3 s0t0 by blast\n next\n case False\n then show ?thesis\n by (smt FLTick0_def assm1 assm2 assms bullet_right_zero2 concat_FL_last_not_bullet_absorb last_rev3_is_bullet length.simps(1) length_cons pri_tickWF prirel.simps(1) prirel_cons_eq_length_imp_prirel_acceptances_eq prirel_same_length rev3_rev3_const2_last tickWF_last_x_is_emptyset)\n qed\nnext\n fix \"x\" \"s\"\n assume assm0:\"FLTick0 tick P\"\n and assm1:\"maximal(p,tick)\"\n and assm2:\"prirel p x s\"\n and assm3:\"s \\ P\"\n and assm4:\"tick \\ events s\"\n show \"\\s. (\\Z. prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) Z \\ Z \\ P) \\ (\\t. (\\Z. prirel p t Z \\ Z \\ Q) \\ x = s &\\<^sub>\\\\<^sub>\\ t) \\\n (\\Z. prirel p s Z \\ Z \\ P) \\ tick \\ events s \\ x = s\"\n proof -\n have \"tick \\ events x\"\n using assm2 assm4 prirel_not_events\n by fastforce\n then show ?thesis\n using assm2 assm3 by blast\n qed\nnext\n fix \"s\" \"t\" \"Z\" \"Za\"\n assume \n assm0: \"FLTick0 tick P\"\n and assm1: \"maximal(p,tick)\"\n and assm2: \"prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) Z\"\n and assm3: \"Z \\ P\"\n and assm4: \"prirel p t Za\"\n and assm5: \"Za \\ Q\"\n show \"\\Z. prirel p (s &\\<^sub>\\\\<^sub>\\ t) Z \\ (\\s. s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P \\ (\\t. t \\ Q \\ Z = s &\\<^sub>\\\\<^sub>\\ t) \\ s \\ P \\ tick \\ events s \\ Z = s)\"\n proof (cases \"last s = \\\")\n case True\n then obtain s0 where s0:\"prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) (s0 &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) \\ last s0 = \\ \\ length s = length s0 \\ Z = (s0 &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\)\"\n by (metis FLTick0_def assm0 assm1 assm2 assm3 prirel_exists_tick_max)\n then have \"prirel p s s0\"\n using True prirel_consFL_both_imp by blast\n then have \"prirel p (s &\\<^sub>\\\\<^sub>\\ t) (s0 &\\<^sub>\\\\<^sub>\\ Za)\"\n by (simp add: assm4 prirel_consFL_both_imp')\n then have \"\\Z. prirel p (s &\\<^sub>\\\\<^sub>\\ t) (s0 &\\<^sub>\\\\<^sub>\\ Za) \\ s0 &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P \\ Za \\ Q \\ Z = s0 &\\<^sub>\\\\<^sub>\\ Za\"\n using s0 assm5 assm3 by blast\n then show ?thesis\n by blast\n next\n case False\n then show ?thesis \n by (metis FLTick0_def \\Z \\ P\\ \\prirel p (s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\) Z\\ assms(1) concat_FL_last_not_bullet_absorb prirel_cons_eq_length_imp_prirel_acceptances_last_bullet_eq prirel_cons_eq_length_imp_prirel_acceptances_last_not_bullet prirel_same_length tickWF_last_x_is_emptyset)\n qed\nnext\n fix \"s\" \"Z\"\n assume \n assm0: \"FLTick0 tick P\"\n and assm1: \"maximal(p,tick)\"\n and assm2: \"tick \\ events s\"\n and assm3: \"prirel p s Z\"\n and assm4: \"Z \\ P\"\n show \"\\Z. prirel p s Z \\ (\\s. s &\\<^sub>\\\\<^sub>\\ \\(\\,tick)\\<^sub>\\\\<^sub>\\,\\\\\\<^sub>\\\\<^sub>\\ \\ P \\ (\\t. t \\ Q \\ Z = s &\\<^sub>\\\\<^sub>\\ t) \\ s \\ P \\ tick \\ events s \\ Z = s)\"\n using assm3 assm4 assm2 apply (rule_tac x=\"Z\" in exI, auto)\n apply (rule_tac x=\"Z\" in exI, auto)\n by (simp add: prirel_not_events')+\nqed\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/FL/Finite_Linear_Priority_Tick.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2940586976544659}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Sep_Tactic_Examples\nimports\n \"SepDSpec.Sep_Tactic_Helper\"\n KHeap_DP\nbegin\n\n\n(* Thesis : Automated Tactics for Seperation Logic *)\n\n(* seperation logic *)\n\n(* after we show that addition and disjointedness on our heap obeys certain laws, we get a seperation algebra *)\n\n(* connectives *)\n\nterm \"P \\* Q\"\n\nterm \"P \\* Q\"\n\nlemma frame_rule:\n \"\\R. \\P\\ f \\\\_. Q\\ \\ \\P \\* R\\ f \\\\_. Q \\* R\\\"\n oops\n\nthm swap_cap_wp[no_vars]\n\nlemma\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp set_cap_wp) (* set_cap doesn't apply *)\nthm set_cap_wp[no_vars]\n apply (rule hoare_strengthen_post)\n apply (wp set_cap_wp)\n apply (clarsimp simp: sep_conj_ac )\noops\n\n\n(* tactics we had pre-thesis *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4)\n apply (sep_select_asm 3)\n apply (sep_select 2)\n apply (sep_cancel)\n apply (sep_cancel)\n apply (sep_cancel)\ndone\n\n(* forward reasoning *)\n\n\nlemma example_drule:\n \"(ptr \\o obj) s\n \\ (ptr \\S obj \\* ptr \\f obj) s\"\n by (metis sep_conj_commute sep_map_o_decomp)\n\nlemma sep_drule_example:\n \"(ptr \\o obj \\* A \\* B ) s\n \\ (A \\* B \\* ptr \\f obj \\* ptr \\S obj) s\"\n apply (sep_drule example_drule)\n apply (sep_solve)\ndone\n\n(* backwards reasoning *)\n\nlemma example_rule:\n \"(ptr \\f obj \\* ptr \\S obj) s\n \\ (ptr \\o obj) s\"\n by (metis sep_map_o_decomp)\n\nlemma sep_rule_example: \"(ptr \\f obj \\* A \\* B \\* ptr \\S obj ) s \\ (ptr \\o obj \\* A \\* B) s\"\n apply (sep_rule example_rule)\n apply (sep_solve)\ndone\n\n\n\n(* the state of proving before new stuff *)\n\nlemma swap_cap_wp_old:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp add: swap_cap_def)\n apply (wp swap_parents_wp set_cap_wp)\n apply (rule hoare_chain)\n apply (rule set_cap_wp)\n apply (sep_solve)+\ndone\n\n\nlemma move_cap_wp_old:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n including no_pre\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp)\n apply (rule hoare_strengthen_post)\n apply (rule set_cap_wp)\n apply (sep_select 2)\n apply (sep_solve)\n apply (rule hoare_chain)\n apply (rule insert_cap_orphan_wp)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\nlemma invoke_cnode_rotate2_wp_old:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n including no_pre\n apply (clarsimp simp: invoke_cnode_def)\n apply (wp)\n apply (rule hoare_strengthen_post)\n apply (rule move_cap_wp)\n apply (sep_solve )\n apply (rule hoare_chain)\n apply (rule move_cap_wp)\n apply (sep_select_asm 2, sep_select_asm 3)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\n(* new sep_select/asm *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4 3 2 1)\n apply (sep_select_asm 4 3 2 1)\n apply (sep_select_asm 2 4)\noops\n\n\n(* sep_select_pre/post *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\n(* can be made to work for arbitrary monads *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, \\E\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, -\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"(P \\* (P \\* Q)) s \\ Q s\"\n apply (sep_mp, assumption )\n done\n\nlemma \"P s \\ (Q \\* (P \\* Q)) s\"\n apply (erule sep_curry[rotated])\n apply (assumption)\n done\n\nthm sep_mp[no_vars] sep_curry[rotated, no_vars]\n\n\n(* wp tactic testing *)\n\n\n(* sep_wand approach *)\n\nmethod_setup debug = \\\n Attrib.thms >> (fn _ => fn ctxt =>\n let\n val wp_pre_tac = SELECT_GOAL (Method.NO_CONTEXT_TACTIC ctxt\n (Method_Closure.apply_method ctxt @{method wp_pre} [] [] [] ctxt []))\n in\n SIMPLE_METHOD' (CHANGED o wp_pre_tac)\n end\n)\n\\\n\nlemma move_cap_wp2:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (sep_wp set_cap_wp swap_parents_wp insert_cap_orphan_wp)+\n apply (sep_solve)\n done\n\nlemma swap_cap_wp2:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp: swap_cap_def)\n apply (sep_wp swap_parents_wp set_cap_wp)+\n apply (sep_solve)\n done\n\nlemma invoke_cnode_rotate2_wp:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n apply (clarsimp simp: invoke_cnode_def)\n apply (sep_wp move_cap_wp)+\n apply (sep_solve)\n done\n\n\n(* sep_drule/rule *)\n\nlemma sep_rule_example2:\n \"\\(ptr \\o obj) s; finite (dom (object_slots obj))\\ \\\n (ptr \\E obj \\* ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (subst (asm) sep_map_o_decomp)\n apply (subst (asm) sep_map_S_decomp, simp+)\n apply sep_solve\n done\n\nlemma sep_drule_example2:\n \"\\(ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* ptr \\E obj) s;\n finite (dom (object_slots obj))\\\n \\\n (ptr \\o obj) s\"\n by (metis sep_map_S_decomp sep_map_o_decomp)\n\n(* sep_curry *)\n\nlemma sep_drule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\f obj \\* A \\* B \\*\n (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* D \\* G \\* E \\* F \\* ptr \\E obj ) s;\n finite (dom (object_slots obj))\\\n \\\n (D \\* G \\* E \\* F \\* ptr \\o obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B) s\"\n apply (sep_drule sep_drule_example2)\n apply assumption\n apply sep_solve\n done\n\n\n(* sep_back *)\n\n\nlemma sep_rule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\o obj \\* A \\* B \\* D \\* G \\* E \\* F ) s;\n finite (dom (object_slots obj))\\ \\\n (D \\* G \\* E \\* F \\* ptr \\f obj \\* H \\* Z \\* J \\* L \\* Y \\* ptr \\E obj \\*\n A \\* B \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (sep_rule sep_rule_example2)\n apply sep_solve\n apply assumption\n done\n\n\n(* works even with multiple conjuncts in assumptions and conclusions *)\nlemma sep_rule_double_conjunct_example:\n \"\\((obj_id, slot) \\c cap \\* obj_id \\f obj) s;\n object_slots obj slot = Some cap\\\n \\ ((obj_id, slot) \\s obj \\* obj_id \\f obj) s\"\n apply (sep_drule sep_map_s_sep_map_c)\n apply assumption\n apply (sep_cancel)+\n done\n\nlemma sep_rule_double_conjunct_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_rule sep_rule_double_conjunct_example)\n apply sep_solve\n apply assumption\n done\n\n(* side-conditions*)\n\n\nlemma sep_drule_side_condition_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_drule sep_rule_double_conjunct_example, assumption)\n apply (sep_solve)\n done\n\nschematic_goal \"(P \\* ?A) s \\ (A \\* B \\* P) s\"\n apply (sep_solve)\n done\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/capDL-api/Sep_Tactic_Examples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.29405869765446585}} {"text": "(* SPDX-License-Identifier: BSD-3-Clause *)\n(*\n * Copyright (C) 2002 Tobias Nipkow (TUM)\n * Copyright (C) 2013--2014 Japheth Lim (NICTA)\n * Copyright (C) 2013--2014 David Greenaway (NICTA)\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above copyright\n * notice, this list of conditions and the following disclaimer in the\n * documentation and/or other materials provided with the distribution.\n *\n * * Neither the name of the University of Cambridge or the Technische\n * Universitaet Muenchen nor the names of their contributors may be used\n * to endorse or promote products derived from this software without\n * specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS\n * IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED\n * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\n * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n *)\n\ntheory CList imports\n \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"list.c\"\ninstall_C_file \"list.c\"\nautocorres \"list.c\"\n\ncontext list begin\n\nthm reverse'_def\nthm revappend'_def\n\nsection \"The heap\"\n\nsubsection \"Paths in the heap\"\n\ndefinition node_next where \"node_next s p = next_C (heap_node_C s p)\"\ndefinition node_exists where \"node_exists s p = (p \\ NULL \\ is_valid_node_C s p)\"\n\ndefinition node_next_upd where\n \"node_next_upd s p q = heap_node_C_update (\\old. old(p := next_C_update (\\_. q) (old p))) s\"\n\nlemma \"p \\ x \\ heap_node_C (node_next_upd s x q) p = heap_node_C s p\"\nby (simp add: node_next_def node_next_upd_def fun_upd_apply)\n\n\nprimrec Path :: \"lifted_globals \\ node_C ptr \\ node_C ptr list \\ node_C ptr \\ bool\" where\n \"Path s x [] y \\ x = y\"\n| \"Path s x (a#as) y \\ node_exists s x \\ x = a \\ Path s (node_next s x) as y\"\n\n\n\nlemma [simp]: \"node_exists s a \\ Path s a as z =\n(as = [] \\ a = z \\ (\\bs. as = a # bs \\ Path s (node_next s a) bs z))\"\nby (case_tac as, fastforce, fastforce simp: node_exists_def)\n\nlemma [simp]: \"\\x. Path s x (as@bs) z =\n(\\y. Path s x as y \\ Path s y bs z)\"\nby (induct as, simp+)\n\nlemma Path_upd[simp]:\n\"\\x. u \\ set as \\\nPath (node_next_upd s u v) x as y = Path s x as y\"\napply (induct as, simp)\napply (simp add: node_exists_def node_next_def node_next_upd_def fun_upd_apply)\ndone\n\nlemma Path_snoc:\n\"\\ node_exists s a; Path (node_next_upd s a q) p as a \\ \\ Path (node_next_upd s a q) p (as @ [a]) q\"\nby simp\n\n\nsubsection \"Non-repeating paths\"\n\ndefinition distPath ::\n \"lifted_globals \\ node_C ptr \\ node_C ptr list \\ node_C ptr \\ bool\"\n where \"distPath s x as y \\ Path s x as y \\ distinct as\"\n\ntext\\The term @{term \"distPath s x as y\"} expresses the fact that a\nnon-repeating path @{term as} connects location @{term x} to location\n@{term y} over the heap @{term s}. In the case where @{text \"x = y\"},\nand there is a cycle from @{term x} to itself, @{term as} can\nbe both @{term \"[]\"} and the non-repeating list of nodes in the\ncycle.\\\n\nlemma neq_dP: \"p \\ q \\ Path s p Ps q \\ distinct Ps \\\n \\ a Qs. p = a & Ps = a#Qs & a \\ set Qs\"\nby (case_tac Ps, auto)\n\n\nlemma neq_dP_disp: \"\\ p \\ q; distPath s p Ps q \\ \\\n \\ a Qs. p = a \\ Ps = a#Qs \\ a \\ set Qs\"\napply (simp only:distPath_def)\nby (case_tac Ps, auto)\n\n\nsubsection \"Lists on the heap\"\n\nsubsubsection \"Relational abstraction\"\n\ndefinition List :: \"lifted_globals \\ node_C ptr \\ node_C ptr list \\ bool\"\n where \"List s x as = Path s x as NULL\"\n\nlemma [simp]: \"List s x [] = (x = NULL)\"\nby(simp add:List_def)\n\nlemma List_case [simp]: \"List s x (a#as) = (x = a \\ node_exists s a \\ List s (node_next s a) as)\"\nby(auto simp:List_def)\n\nlemma [simp]: \"List s NULL as = (as = [])\"\nby(case_tac as, simp_all add: node_exists_def)\n\nlemma List_Ref[simp]: \"node_exists s a \\ List s a as = (\\bs. as = a#bs \\ List s (node_next s a) bs)\"\nby(case_tac as, simp_all add: node_exists_def, fast)\n\n\n\nlemma List_unique: \"\\x bs. List s x as \\ List s x bs \\ as = bs\"\nby(induct as, simp, clarsimp)\n\nlemma List_unique1: \"List s p as \\ \\!as. List s p as\"\nby(blast intro:List_unique)\n\nlemma List_app: \"\\x. List s x (as@bs) = (\\y. Path s x as y \\ List s y bs)\"\nby(induct as, simp, auto)\n\nlemma List_hd_not_in_tl[simp]: \"List s (node_next s a) as \\ a \\ set as\"\napply(clarsimp simp add:in_set_conv_decomp)\napply(frule List_app[THEN iffD1])\napply(fastforce dest: List_unique)\ndone\n\nlemma List_distinct[simp]: \"\\x. List s x as \\ distinct as\"\napply(induct as, simp)\napply(fastforce dest:List_hd_not_in_tl)\ndone\n\nlemma Path_is_List:\n \"\\node_exists s a; Path s b Ps a; a \\ set Ps\\ \\ List (node_next_upd s a NULL) b (Ps @ [a])\"\napply (induct Ps arbitrary: b)\napply (auto simp: node_exists_def node_next_upd_def node_next_def fun_upd_apply)\ndone\n\n\n\nsubsection \"Functional abstraction\"\n\ndefinition islist :: \"lifted_globals \\ node_C ptr \\ bool\"\n where \"islist s p \\ (\\as. List s p as)\"\n\ndefinition list :: \"lifted_globals \\ node_C ptr \\ node_C ptr list\"\n where \"list s p = (SOME as. List s p as)\"\n\nlemma List_conv_islist_list: \"List s p as = (islist s p \\ as = list s p)\"\napply(simp add:islist_def list_def)\napply(rule iffI)\napply(rule conjI)\napply blast\napply(subst some1_equality)\n apply(erule List_unique1)\n apply assumption\napply(rule refl)\napply simp\napply(rule someI_ex)\napply fast\ndone\n\nlemma [simp]: \"islist s NULL\"\nby(simp add:islist_def)\n\nlemma [simp]: \"node_exists s a \\ islist s a = islist s (node_next s a)\"\nby(simp add:islist_def)\n\nlemma [simp]: \"\\ node_exists s a; islist s a \\ \\ islist s (node_next s a)\"\napply (clarsimp simp: islist_def)\ndone\n\nlemma [simp]: \"list s NULL = []\"\nby(simp add:list_def)\n\nlemma list_Ref_conv[simp]:\n \"\\ node_exists s a; islist s (node_next s a) \\ \\ list s a = a # list s (node_next s a)\"\napply(insert List_Ref[of s])\napply(metis List_conv_islist_list)\ndone\n\nlemma [simp]: \"\\ node_exists s a; islist s (node_next s a) \\ \\ a \\ set(list s (node_next s a))\"\napply(insert List_hd_not_in_tl[of s])\napply(metis List_conv_islist_list)\ndone\n\nlemma list_upd_conv[simp]:\n \"islist s p \\ y \\ set(list s p) \\ list (node_next_upd s y q) p = list s p\"\n apply (clarsimp simp: islist_def node_next_upd_def)\n by (metis (mono_tags) list.List_def list.List_unique list.Path_upd list.list_def list.node_next_upd_def some_eq_ex)\n\nlemma islist_upd[simp]:\n \"islist s p \\ y \\ set(list s p) \\ islist (node_next_upd s y q) p\"\n apply (clarsimp simp: islist_def node_next_upd_def)\n by (metis (mono_tags) list.List_def list.List_unique list.Path_upd list.list_def list.node_next_upd_def some_eq_ex)\n\n\nsubsection \"List reversal\"\n\nsubsubsection \"Program representation\"\ntext \\This is AutoCorres's representation of revappend.\\\nthm revappend'_def\n\ntext \\The heap operations are a bit too low level,\n so let's lift them using our heap accessors.\\\nschematic_goal revappend'_abstract: \"revappend' p q = ?new_definition\"\n apply (subst revappend'_def)\n unfolding node_next_def[symmetric]\n node_next_upd_def[symmetric]\n modify_def\n apply (rule refl)\n done\n\n\ntext \\node_exists is a prerequisite for most of our abstraction rules.\n But we cannot extract this prerequisite from the program text because it is\n implied by our Hoare preconditions (below) which are not a part of the program\n text. Here we arrange for Isabelle's tactics to infer it when needed.\\\n\n(* FIXME: figure out why we need to take this out of the simpset for\n the loop termination subgoals. *)\nlemma node_exists_imp_valid[simp]: \"node_exists s b \\ is_valid_node_C s b\"\n by (simp add: node_exists_def)\n\nlemma List_node_exists [dest!]: \"\\ p \\ NULL; List s p as \\ \\ node_exists s p\"\nby (case_tac as, auto simp: node_exists_def)\n\nlemma islist_node_exists [simp]: \"\\ p \\ NULL; islist s p \\ \\ node_exists s p\"\n apply (clarsimp simp: islist_def)\n apply (rename_tac a, case_tac a, simp_all add: node_exists_def)\n done\n\n\n\nsubsubsection \"Verification with relational abstraction\"\ntext \\Almost automatic proof using the relational abstraction.\n (The termination proof uses functional abstraction.)\\\n\nlemma\n\"\\ \\s. List s p Ps \\ List s q Qs \\ set Ps \\ set Qs = {} \\\n revappend' p q\n \\ \\r s. List s r (rev Ps @ Qs) \\!\"\n txt \\We verify the abstracted version of the program.\\\n unfolding revappend'_abstract\n\n txt \\Add the loop invariant and measure.\\\n apply (subst whileLoop_add_inv\n [where I = \"\\(dest', list') s.\n \\ps qs. List s list' ps \\ List s dest' qs \\ set ps \\ set qs = {} \\\n rev ps @ qs = rev Ps @ Qs\"\n and M = \" (\\((_, list'), s). length (list s list'))\"])\n apply (wp validNF_whileLoop_inv_measure_twosteps)\n\n txt \\Loop invariant.\\\n apply (fastforce intro: notin_List_update[THEN iffD2])\n\n txt \\Loop measure.\\\n apply wp\n apply (fastforce simp: List_conv_islist_list simp del: node_exists_imp_valid)\n\n txt \\Loop entrance and exit.\\\n apply fastforce+\n done\n\n\n\nsubsubsection \"Verification with functional abstraction\"\ntext \\Fully automatic proof using the functional abstraction.\\\nlemma\n\"\\ \\s. islist s p \\ islist s q \\ Ps = list s p \\ Qs = list s q \\ set Ps \\ set Qs = {} \\\n revappend' p q\n \\ \\r s. islist s r \\ list s r = rev Ps @ Qs \\!\"\n unfolding revappend'_abstract\n\n apply (subst whileLoop_add_inv\n [where I = \"\\(q, p) s. islist s p \\ islist s q \\\n set(list s p) \\ set(list s q) = {} \\\n rev(list s p) @ (list s q) = rev Ps @ Qs\"\n and M = \"(\\((q, p), s). length (list s p))\"])\n apply (wp validNF_whileLoop_inv_measure_twosteps)\n\n txt \\Loop invariant.\\\n apply clarsimp\n\n txt \\Loop measure.\\\n apply wp\n apply (clarsimp simp del: node_exists_imp_valid)\n\n txt \\Loop entrance and exit.\\\n apply clarsimp+\n done\n\ntext \\Provide the node_exists condition manually.\\\nlemma\n\"\\ \\s. islist s p \\ islist s q \\ Ps = list s p \\ Qs = list s q \\ set Ps \\ set Qs = {} \\\n revappend' p q\n \\ \\r s. islist s r \\ list s r = rev Ps @ Qs \\!\"\n unfolding revappend'_abstract\n\n apply (subst whileLoop_add_inv\n [where I = \"\\(q, p) s. islist s p \\ islist s q \\\n set(list s p) \\ set(list s q) = {} \\\n rev(list s p) @ (list s q) = rev Ps @ Qs\"\n and M = \"(\\((q, p), s). length (list s p))\"])\n apply (wp validNF_whileLoop_inv_measure_twosteps)\n apply (clarsimp simp del: islist_node_exists)\n apply (frule islist_node_exists, assumption)\n apply (clarsimp simp del: islist_node_exists)\n\n apply wp\n apply (clarsimp simp del: node_exists_imp_valid)\n\n apply clarsimp+\n done\n\nend (* context list *)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/CList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521307073646, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.2940586892329891}} {"text": "(* Title: HOL/Bali/AxSem.thy\n Author: David von Oheimb\n*)\n\nsubsection {* Axiomatic semantics of Java expressions and statements \n (see also Eval.thy)\n *}\ntheory AxSem imports Evaln TypeSafe begin\n\ntext {*\ndesign issues:\n\\begin{itemize}\n\\item a strong version of validity for triples with premises, namely one that \n takes the recursive depth needed to complete execution, enables \n correctness proof\n\\item auxiliary variables are handled first-class (-> Thomas Kleymann)\n\\item expressions not flattened to elementary assignments (as usual for \n axiomatic semantics) but treated first-class => explicit result value \n handling\n\\item intermediate values not on triple, but on assertion level \n (with result entry)\n\\item multiple results with semantical substitution mechnism not requiring a \n stack \n\\item because of dynamic method binding, terms need to be dependent on state.\n this is also useful for conditional expressions and statements\n\\item result values in triples exactly as in eval relation (also for xcpt \n states)\n\\item validity: additional assumption of state conformance and well-typedness,\n which is required for soundness and thus rule hazard required of completeness\n\\end{itemize}\n\nrestrictions:\n\\begin{itemize}\n\\item all triples in a derivation are of the same type (due to weak \n polymorphism)\n\\end{itemize}\n*}\n\ntype_synonym res = vals --{* result entry *}\n\nabbreviation (input)\n Val where \"Val x == In1 x\"\n\nabbreviation (input)\n Var where \"Var x == In2 x\"\n\nabbreviation (input)\n Vals where \"Vals x == In3 x\"\n\nsyntax\n \"_Val\" :: \"[pttrn] => pttrn\" (\"Val:_\" [951] 950)\n \"_Var\" :: \"[pttrn] => pttrn\" (\"Var:_\" [951] 950)\n \"_Vals\" :: \"[pttrn] => pttrn\" (\"Vals:_\" [951] 950)\n\ntranslations\n \"\\Val:v . b\" == \"(\\v. b) \\ CONST the_In1\"\n \"\\Var:v . b\" == \"(\\v. b) \\ CONST the_In2\"\n \"\\Vals:v. b\" == \"(\\v. b) \\ CONST the_In3\"\n\n --{* relation on result values, state and auxiliary variables *}\ntype_synonym 'a assn = \"res \\ state \\ 'a \\ bool\"\ntranslations\n (type) \"'a assn\" <= (type) \"vals \\ state \\ 'a \\ bool\"\n\ndefinition\n assn_imp :: \"'a assn \\ 'a assn \\ bool\" (infixr \"\\\" 25)\n where \"(P \\ Q) = (\\Y s Z. P Y s Z \\ Q Y s Z)\"\n \nlemma assn_imp_def2 [iff]: \"(P \\ Q) = (\\Y s Z. P Y s Z \\ Q Y s Z)\"\napply (unfold assn_imp_def)\napply (rule HOL.refl)\ndone\n\n\nsubsubsection \"assertion transformers\"\n\nsubsection \"peek-and\"\n\ndefinition\n peek_and :: \"'a assn \\ (state \\ bool) \\ 'a assn\" (infixl \"\\.\" 13)\n where \"(P \\. p) = (\\Y s Z. P Y s Z \\ p s)\"\n\nlemma peek_and_def2 [simp]: \"peek_and P p Y s = (\\Z. (P Y s Z \\ p s))\"\napply (unfold peek_and_def)\napply (simp (no_asm))\ndone\n\nlemma peek_and_Not [simp]: \"(P \\. (\\s. \\ f s)) = (P \\. Not \\ f)\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_and_and [simp]: \"peek_and (peek_and P p) p = peek_and P p\"\napply (unfold peek_and_def)\napply (simp (no_asm))\ndone\n\nlemma peek_and_commut: \"(P \\. p \\. q) = (P \\. q \\. p)\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply auto\ndone\n\nabbreviation\n Normal :: \"'a assn \\ 'a assn\"\n where \"Normal P == P \\. normal\"\n\nlemma peek_and_Normal [simp]: \"peek_and (Normal P) p = Normal (peek_and P p)\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply auto\ndone\n\nsubsection \"assn-supd\"\n\ndefinition\n assn_supd :: \"'a assn \\ (state \\ state) \\ 'a assn\" (infixl \";.\" 13)\n where \"(P ;. f) = (\\Y s' Z. \\s. P Y s Z \\ s' = f s)\"\n\nlemma assn_supd_def2 [simp]: \"assn_supd P f Y s' Z = (\\s. P Y s Z \\ s' = f s)\"\napply (unfold assn_supd_def)\napply (simp (no_asm))\ndone\n\nsubsection \"supd-assn\"\n\ndefinition\n supd_assn :: \"(state \\ state) \\ 'a assn \\ 'a assn\" (infixr \".;\" 13)\n where \"(f .; P) = (\\Y s. P Y (f s))\"\n\n\nlemma supd_assn_def2 [simp]: \"(f .; P) Y s = P Y (f s)\"\napply (unfold supd_assn_def)\napply (simp (no_asm))\ndone\n\nlemma supd_assn_supdD [elim]: \"((f .; Q) ;. f) Y s Z \\ Q Y s Z\"\napply auto\ndone\n\nlemma supd_assn_supdI [elim]: \"Q Y s Z \\ (f .; (Q ;. f)) Y s Z\"\napply (auto simp del: split_paired_Ex)\ndone\n\nsubsection \"subst-res\"\n\ndefinition\n subst_res :: \"'a assn \\ res \\ 'a assn\" (\"_\\_\" [60,61] 60)\n where \"P\\w = (\\Y. P w)\"\n\nlemma subst_res_def2 [simp]: \"(P\\w) Y = P w\"\napply (unfold subst_res_def)\napply (simp (no_asm))\ndone\n\nlemma subst_subst_res [simp]: \"P\\w\\v = P\\w\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_and_subst_res [simp]: \"(P \\. p)\\w = (P\\w \\. p)\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\n(*###Do not work for some strange (unification?) reason\nlemma subst_res_Val_beta [simp]: \"(\\Y. P (the_In1 Y))\\Val v = (\\Y. P v)\"\napply (rule ext)\nby simp\n\nlemma subst_res_Var_beta [simp]: \"(\\Y. P (the_In2 Y))\\Var vf = (\\Y. P vf)\";\napply (rule ext)\nby simp\n\nlemma subst_res_Vals_beta [simp]: \"(\\Y. P (the_In3 Y))\\Vals vs = (\\Y. P vs)\";\napply (rule ext)\nby simp\n*)\n\nsubsection \"subst-Bool\"\n\ndefinition\n subst_Bool :: \"'a assn \\ bool \\ 'a assn\" (\"_\\=_\" [60,61] 60)\n where \"P\\=b = (\\Y s Z. \\v. P (Val v) s Z \\ (normal s \\ the_Bool v=b))\"\n\nlemma subst_Bool_def2 [simp]: \n\"(P\\=b) Y s Z = (\\v. P (Val v) s Z \\ (normal s \\ the_Bool v=b))\"\napply (unfold subst_Bool_def)\napply (simp (no_asm))\ndone\n\nlemma subst_Bool_the_BoolI: \"P (Val b) s Z \\ (P\\=the_Bool b) Y s Z\"\napply auto\ndone\n\nsubsection \"peek-res\"\n\ndefinition\n peek_res :: \"(res \\ 'a assn) \\ 'a assn\"\n where \"peek_res Pf = (\\Y. Pf Y Y)\"\n\nsyntax\n \"_peek_res\" :: \"pttrn \\ 'a assn \\ 'a assn\" (\"\\_:. _\" [0,3] 3)\ntranslations\n \"\\w:. P\" == \"CONST peek_res (\\w. P)\"\n\nlemma peek_res_def2 [simp]: \"peek_res P Y = P Y Y\"\napply (unfold peek_res_def)\napply (simp (no_asm))\ndone\n\nlemma peek_res_subst_res [simp]: \"peek_res P\\w = P w\\w\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\n(* unused *)\nlemma peek_subst_res_allI: \n \"(\\a. T a (P (f a)\\f a)) \\ \\a. T a (peek_res P\\f a)\"\napply (rule allI)\napply (simp (no_asm))\napply fast\ndone\n\nsubsection \"ign-res\"\n\ndefinition\n ign_res :: \"'a assn \\ 'a assn\" (\"_\\\" [1000] 1000)\n where \"P\\ = (\\Y s Z. \\Y. P Y s Z)\"\n\nlemma ign_res_def2 [simp]: \"P\\ Y s Z = (\\Y. P Y s Z)\"\napply (unfold ign_res_def)\napply (simp (no_asm))\ndone\n\nlemma ign_ign_res [simp]: \"P\\\\ = P\\\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma ign_subst_res [simp]: \"P\\\\w = P\\\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_and_ign_res [simp]: \"(P \\. p)\\ = (P\\ \\. p)\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nsubsection \"peek-st\"\n\ndefinition\n peek_st :: \"(st \\ 'a assn) \\ 'a assn\"\n where \"peek_st P = (\\Y s. P (store s) Y s)\"\n\nsyntax\n \"_peek_st\" :: \"pttrn \\ 'a assn \\ 'a assn\" (\"\\_.. _\" [0,3] 3)\ntranslations\n \"\\s.. P\" == \"CONST peek_st (\\s. P)\"\n\nlemma peek_st_def2 [simp]: \"(\\s.. Pf s) Y s = Pf (store s) Y s\"\napply (unfold peek_st_def)\napply (simp (no_asm))\ndone\n\nlemma peek_st_triv [simp]: \"(\\s.. P) = P\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_st_st [simp]: \"(\\s.. \\s'.. P s s') = (\\s.. P s s)\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_st_split [simp]: \"(\\s.. \\Y s'. P s Y s') = (\\Y s. P (store s) Y s)\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_st_subst_res [simp]: \"(\\s.. P s)\\w = (\\s.. P s\\w)\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma peek_st_Normal [simp]: \"(\\s..(Normal (P s))) = Normal (\\s.. P s)\"\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\nsubsection \"ign-res-eq\"\n\ndefinition\n ign_res_eq :: \"'a assn \\ res \\ 'a assn\" (\"_\\=_\" [60,61] 60)\n where \"P\\=w \\ (\\Y:. P\\ \\. (\\s. Y=w))\"\n\nlemma ign_res_eq_def2 [simp]: \"(P\\=w) Y s Z = ((\\Y. P Y s Z) \\ Y=w)\"\napply (unfold ign_res_eq_def)\napply auto\ndone\n\nlemma ign_ign_res_eq [simp]: \"(P\\=w)\\ = P\\\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\n(* unused *)\nlemma ign_res_eq_subst_res: \"P\\=w\\w = P\\\"\napply (rule ext)\napply (rule ext)\napply (rule ext)\napply (simp (no_asm))\ndone\n\n(* unused *)\nlemma subst_Bool_ign_res_eq: \"((P\\=b)\\=x) Y s Z = ((P\\=b) Y s Z \\ Y=x)\"\napply (simp (no_asm))\ndone\n\nsubsection \"RefVar\"\n\ndefinition\n RefVar :: \"(state \\ vvar \\ state) \\ 'a assn \\ 'a assn\" (infixr \"..;\" 13)\n where \"(vf ..; P) = (\\Y s. let (v,s') = vf s in P (Var v) s')\"\n \nlemma RefVar_def2 [simp]: \"(vf ..; P) Y s = \n P (Var (fst (vf s))) (snd (vf s))\"\napply (unfold RefVar_def Let_def)\napply (simp (no_asm) add: split_beta)\ndone\n\nsubsection \"allocation\"\n\ndefinition\n Alloc :: \"prog \\ obj_tag \\ 'a assn \\ 'a assn\"\n where \"Alloc G otag P = (\\Y s Z. \\s' a. G\\s \\halloc otag\\a\\ s'\\ P (Val (Addr a)) s' Z)\"\n\ndefinition\n SXAlloc :: \"prog \\ 'a assn \\ 'a assn\"\n where \"SXAlloc G P = (\\Y s Z. \\s'. G\\s \\sxalloc\\ s' \\ P Y s' Z)\"\n\n\nlemma Alloc_def2 [simp]: \"Alloc G otag P Y s Z = \n (\\s' a. G\\s \\halloc otag\\a\\ s'\\ P (Val (Addr a)) s' Z)\"\napply (unfold Alloc_def)\napply (simp (no_asm))\ndone\n\nlemma SXAlloc_def2 [simp]: \n \"SXAlloc G P Y s Z = (\\s'. G\\s \\sxalloc\\ s' \\ P Y s' Z)\"\napply (unfold SXAlloc_def)\napply (simp (no_asm))\ndone\n\nsubsubsection \"validity\"\n\ndefinition\n type_ok :: \"prog \\ term \\ state \\ bool\" where\n \"type_ok G t s =\n (\\L T C A. (normal s \\ \\prg=G,cls=C,lcl=L\\\\t\\T \\ \n \\prg=G,cls=C,lcl=L\\\\dom (locals (store s))\\t\\A )\n \\ s\\\\(G,L))\"\n\ndatatype 'a triple = triple \"('a assn)\" \"term\" \"('a assn)\" (** should be\nsomething like triple = \\'a. triple ('a assn) term ('a assn) **)\n (\"{(1_)}/ _>/ {(1_)}\" [3,65,3]75)\ntype_synonym 'a triples = \"'a triple set\"\n\nabbreviation\n var_triple :: \"['a assn, var ,'a assn] \\ 'a triple\"\n (\"{(1_)}/ _=>/ {(1_)}\" [3,80,3] 75)\n where \"{P} e=> {Q} == {P} In2 e> {Q}\"\n\nabbreviation\n expr_triple :: \"['a assn, expr ,'a assn] \\ 'a triple\"\n (\"{(1_)}/ _->/ {(1_)}\" [3,80,3] 75)\n where \"{P} e-> {Q} == {P} In1l e> {Q}\"\n\nabbreviation\n exprs_triple :: \"['a assn, expr list ,'a assn] \\ 'a triple\"\n (\"{(1_)}/ _#>/ {(1_)}\" [3,65,3] 75)\n where \"{P} e#> {Q} == {P} In3 e> {Q}\"\n\nabbreviation\n stmt_triple :: \"['a assn, stmt, 'a assn] \\ 'a triple\"\n (\"{(1_)}/ ._./ {(1_)}\" [3,65,3] 75)\n where \"{P} .c. {Q} == {P} In1r c> {Q}\"\n\nnotation (xsymbols)\n triple (\"{(1_)}/ _\\/ {(1_)}\" [3,65,3] 75) and\n var_triple (\"{(1_)}/ _=\\/ {(1_)}\" [3,80,3] 75) and\n expr_triple (\"{(1_)}/ _-\\/ {(1_)}\" [3,80,3] 75) and\n exprs_triple (\"{(1_)}/ _\\\\/ {(1_)}\" [3,65,3] 75)\n\nlemma inj_triple: \"inj (\\(P,t,Q). {P} t\\ {Q})\"\napply (rule inj_onI)\napply auto\ndone\n\nlemma triple_inj_eq: \"({P} t\\ {Q} = {P'} t'\\ {Q'} ) = (P=P' \\ t=t' \\ Q=Q')\"\napply auto\ndone\n\ndefinition mtriples :: \"('c \\ 'sig \\ 'a assn) \\ ('c \\ 'sig \\ expr) \\ \n ('c \\ 'sig \\ 'a assn) \\ ('c \\ 'sig) set \\ 'a triples\" (\"{{(1_)}/ _-\\/ {(1_)} | _}\"[3,65,3,65]75) where\n \"{{P} tf-\\ {Q} | ms} = (\\(C,sig). {Normal(P C sig)} tf C sig-\\ {Q C sig})`ms\"\n \ndefinition\n triple_valid :: \"prog \\ nat \\ 'a triple \\ bool\" (\"_\\_:_\" [61,0, 58] 57)\n where\n \"G\\n:t =\n (case t of {P} t\\ {Q} \\\n \\Y s Z. P Y s Z \\ type_ok G t s \\\n (\\Y' s'. G\\s \\t\\\\n\\ (Y',s') \\ Q Y' s' Z))\"\n\nabbreviation\n triples_valid:: \"prog \\ nat \\ 'a triples \\ bool\" ( \"_||=_:_\" [61,0, 58] 57)\n where \"G||=n:ts == Ball ts (triple_valid G n)\"\n\nnotation (xsymbols)\n triples_valid (\"_|\\_:_\" [61,0, 58] 57)\n\n\ndefinition\n ax_valids :: \"prog \\ 'b triples \\ 'a triples \\ bool\" (\"_,_|\\_\" [61,58,58] 57)\n where \"(G,A|\\ts) = (\\n. G|\\n:A \\ G|\\n:ts)\"\n\nabbreviation\n ax_valid :: \"prog \\ 'b triples \\ 'a triple \\ bool\" ( \"_,_|=_\" [61,58,58] 57)\n where \"G,A |=t == G,A|\\{t}\"\n\nnotation (xsymbols)\n ax_valid (\"_,_\\_\" [61,58,58] 57)\n\n\nlemma triple_valid_def2: \"G\\n:{P} t\\ {Q} = \n (\\Y s Z. P Y s Z \n \\ (\\L. (normal s \\ (\\ C T A. \\prg=G,cls=C,lcl=L\\\\t\\T \\ \n \\prg=G,cls=C,lcl=L\\\\dom (locals (store s))\\t\\A)) \\ \n s\\\\(G,L))\n \\ (\\Y' s'. G\\s \\t\\\\n\\ (Y',s')\\ Q Y' s' Z))\"\napply (unfold triple_valid_def type_ok_def)\napply (simp (no_asm))\ndone\n\n\ndeclare split_paired_All [simp del] split_paired_Ex [simp del] \ndeclare split_if [split del] split_if_asm [split del] \n option.split [split del] option.split_asm [split del]\nsetup {* map_theory_simpset (fn ctxt => ctxt delloop \"split_all_tac\") *}\nsetup {* map_theory_claset (fn ctxt => ctxt delSWrapper \"split_all_tac\") *}\n\ninductive\n ax_derivs :: \"prog \\ 'a triples \\ 'a triples \\ bool\" (\"_,_|\\_\" [61,58,58] 57)\n and ax_deriv :: \"prog \\ 'a triples \\ 'a triple \\ bool\" (\"_,_\\_\" [61,58,58] 57)\n for G :: prog\nwhere\n\n \"G,A \\t \\ G,A|\\{t}\"\n\n| empty: \" G,A|\\{}\"\n| insert:\"\\G,A\\t; G,A|\\ts\\ \\\n G,A|\\insert t ts\"\n\n| asm: \"ts\\A \\ G,A|\\ts\"\n\n(* could be added for convenience and efficiency, but is not necessary\n cut: \"\\G,A'|\\ts; G,A|\\A'\\ \\\n G,A |\\ts\"\n*)\n| weaken:\"\\G,A|\\ts'; ts \\ ts'\\ \\ G,A|\\ts\"\n\n| conseq:\"\\Y s Z . P Y s Z \\ (\\P' Q'. G,A\\{P'} t\\ {Q'} \\ (\\Y' s'. \n (\\Y Z'. P' Y s Z' \\ Q' Y' s' Z') \\\n Q Y' s' Z ))\n \\ G,A\\{P } t\\ {Q }\"\n\n| hazard:\"G,A\\{P \\. Not \\ type_ok G t} t\\ {Q}\"\n\n| Abrupt: \"G,A\\{P\\(undefined3 t) \\. Not \\ normal} t\\ {P}\"\n\n --{* variables *}\n| LVar: \" G,A\\{Normal (\\s.. P\\Var (lvar vn s))} LVar vn=\\ {P}\"\n\n| FVar: \"\\G,A\\{Normal P} .Init C. {Q};\n G,A\\{Q} e-\\ {\\Val:a:. fvar C stat fn a ..; R}\\ \\\n G,A\\{Normal P} {accC,C,stat}e..fn=\\ {R}\"\n\n| AVar: \"\\G,A\\{Normal P} e1-\\ {Q};\n \\a. G,A\\{Q\\Val a} e2-\\ {\\Val:i:. avar G i a ..; R}\\ \\\n G,A\\{Normal P} e1.[e2]=\\ {R}\"\n --{* expressions *}\n\n| NewC: \"\\G,A\\{Normal P} .Init C. {Alloc G (CInst C) Q}\\ \\\n G,A\\{Normal P} NewC C-\\ {Q}\"\n\n| NewA: \"\\G,A\\{Normal P} .init_comp_ty T. {Q}; G,A\\{Q} e-\\\n {\\Val:i:. abupd (check_neg i) .; Alloc G (Arr T (the_Intg i)) R}\\ \\\n G,A\\{Normal P} New T[e]-\\ {R}\"\n\n| Cast: \"\\G,A\\{Normal P} e-\\ {\\Val:v:. \\s..\n abupd (raise_if (\\G,s\\v fits T) ClassCast) .; Q\\Val v}\\ \\\n G,A\\{Normal P} Cast T e-\\ {Q}\"\n\n| Inst: \"\\G,A\\{Normal P} e-\\ {\\Val:v:. \\s..\n Q\\Val (Bool (v\\Null \\ G,s\\v fits RefT T))}\\ \\\n G,A\\{Normal P} e InstOf T-\\ {Q}\"\n\n| Lit: \"G,A\\{Normal (P\\Val v)} Lit v-\\ {P}\"\n\n| UnOp: \"\\G,A\\{Normal P} e-\\ {\\Val:v:. Q\\Val (eval_unop unop v)}\\\n \\\n G,A\\{Normal P} UnOp unop e-\\ {Q}\"\n\n| BinOp:\n \"\\G,A\\{Normal P} e1-\\ {Q};\n \\v1. G,A\\{Q\\Val v1} \n (if need_second_arg binop v1 then (In1l e2) else (In1r Skip))\\\n {\\Val:v2:. R\\Val (eval_binop binop v1 v2)}\\\n \\\n G,A\\{Normal P} BinOp binop e1 e2-\\ {R}\" \n\n| Super:\" G,A\\{Normal (\\s.. P\\Val (val_this s))} Super-\\ {P}\"\n\n| Acc: \"\\G,A\\{Normal P} va=\\ {\\Var:(v,f):. Q\\Val v}\\ \\\n G,A\\{Normal P} Acc va-\\ {Q}\"\n\n| Ass: \"\\G,A\\{Normal P} va=\\ {Q};\n \\vf. G,A\\{Q\\Var vf} e-\\ {\\Val:v:. assign (snd vf) v .; R}\\ \\\n G,A\\{Normal P} va:=e-\\ {R}\"\n\n| Cond: \"\\G,A \\{Normal P} e0-\\ {P'};\n \\b. G,A\\{P'\\=b} (if b then e1 else e2)-\\ {Q}\\ \\\n G,A\\{Normal P} e0 ? e1 : e2-\\ {Q}\"\n\n| Call: \n\"\\G,A\\{Normal P} e-\\ {Q}; \\a. G,A\\{Q\\Val a} args\\\\ {R a};\n \\a vs invC declC l. G,A\\{(R a\\Vals vs \\.\n (\\s. declC=invocation_declclass G mode (store s) a statT \\name=mn,parTs=pTs\\ \\\n invC = invocation_class mode (store s) a statT \\\n l = locals (store s)) ;.\n init_lvars G declC \\name=mn,parTs=pTs\\ mode a vs) \\.\n (\\s. normal s \\ G\\mode\\invC\\statT)}\n Methd declC \\name=mn,parTs=pTs\\-\\ {set_lvars l .; S}\\ \\\n G,A\\{Normal P} {accC,statT,mode}e\\mn({pTs}args)-\\ {S}\"\n\n| Methd:\"\\G,A\\ {{P} Methd-\\ {Q} | ms} |\\ {{P} body G-\\ {Q} | ms}\\ \\\n G,A|\\{{P} Methd-\\ {Q} | ms}\"\n\n| Body: \"\\G,A\\{Normal P} .Init D. {Q}; \n G,A\\{Q} .c. {\\s.. abupd (absorb Ret) .; R\\(In1 (the (locals s Result)))}\\ \n \\\n G,A\\{Normal P} Body D c-\\ {R}\"\n \n --{* expression lists *}\n\n| Nil: \"G,A\\{Normal (P\\Vals [])} []\\\\ {P}\"\n\n| Cons: \"\\G,A\\{Normal P} e-\\ {Q};\n \\v. G,A\\{Q\\Val v} es\\\\ {\\Vals:vs:. R\\Vals (v#vs)}\\ \\\n G,A\\{Normal P} e#es\\\\ {R}\"\n\n --{* statements *}\n\n| Skip: \"G,A\\{Normal (P\\\\)} .Skip. {P}\"\n\n| Expr: \"\\G,A\\{Normal P} e-\\ {Q\\\\}\\ \\\n G,A\\{Normal P} .Expr e. {Q}\"\n\n| Lab: \"\\G,A\\{Normal P} .c. {abupd (absorb l) .; Q}\\ \\\n G,A\\{Normal P} .l\\ c. {Q}\"\n\n| Comp: \"\\G,A\\{Normal P} .c1. {Q};\n G,A\\{Q} .c2. {R}\\ \\\n G,A\\{Normal P} .c1;;c2. {R}\"\n\n| If: \"\\G,A \\{Normal P} e-\\ {P'};\n \\b. G,A\\{P'\\=b} .(if b then c1 else c2). {Q}\\ \\\n G,A\\{Normal P} .If(e) c1 Else c2. {Q}\"\n(* unfolding variant of Loop, not needed here\n LoopU:\"\\G,A \\{Normal P} e-\\ {P'};\n \\b. G,A\\{P'\\=b} .(if b then c;;While(e) c else Skip).{Q}\\\n \\ G,A\\{Normal P} .While(e) c. {Q}\"\n*)\n| Loop: \"\\G,A\\{P} e-\\ {P'}; \n G,A\\{Normal (P'\\=True)} .c. {abupd (absorb (Cont l)) .; P}\\ \\\n G,A\\{P} .l\\ While(e) c. {(P'\\=False)\\=\\}\"\n \n| Jmp: \"G,A\\{Normal (abupd (\\a. (Some (Jump j))) .; P\\\\)} .Jmp j. {P}\"\n\n| Throw:\"\\G,A\\{Normal P} e-\\ {\\Val:a:. abupd (throw a) .; Q\\\\}\\ \\\n G,A\\{Normal P} .Throw e. {Q}\"\n\n| Try: \"\\G,A\\{Normal P} .c1. {SXAlloc G Q};\n G,A\\{Q \\. (\\s. G,s\\catch C) ;. new_xcpt_var vn} .c2. {R};\n (Q \\. (\\s. \\G,s\\catch C)) \\ R\\ \\\n G,A\\{Normal P} .Try c1 Catch(C vn) c2. {R}\"\n\n| Fin: \"\\G,A\\{Normal P} .c1. {Q};\n \\x. G,A\\{Q \\. (\\s. x = fst s) ;. abupd (\\x. None)}\n .c2. {abupd (abrupt_if (x\\None) x) .; R}\\ \\\n G,A\\{Normal P} .c1 Finally c2. {R}\"\n\n| Done: \"G,A\\{Normal (P\\\\ \\. initd C)} .Init C. {P}\"\n\n| Init: \"\\the (class G C) = c;\n G,A\\{Normal ((P \\. Not \\ initd C) ;. supd (init_class_obj G C))}\n .(if C = Object then Skip else Init (super c)). {Q};\n \\l. G,A\\{Q \\. (\\s. l = locals (store s)) ;. set_lvars empty}\n .init c. {set_lvars l .; R}\\ \\\n G,A\\{Normal (P \\. Not \\ initd C)} .Init C. {R}\"\n\n-- {* Some dummy rules for the intermediate terms @{text Callee},\n@{text InsInitE}, @{text InsInitV}, @{text FinA} only used by the smallstep \nsemantics.\n*}\n| InsInitV: \" G,A\\{Normal P} InsInitV c v=\\ {Q}\"\n| InsInitE: \" G,A\\{Normal P} InsInitE c e-\\ {Q}\"\n| Callee: \" G,A\\{Normal P} Callee l e-\\ {Q}\"\n| FinA: \" G,A\\{Normal P} .FinA a c. {Q}\"\n(*\naxioms \n*)\n\ndefinition\n adapt_pre :: \"'a assn \\ 'a assn \\ 'a assn \\ 'a assn\"\n where \"adapt_pre P Q Q' = (\\Y s Z. \\Y' s'. \\Z'. P Y s Z' \\ (Q Y' s' Z' \\ Q' Y' s' Z))\"\n\n\nsubsubsection \"rules derived by induction\"\n\nlemma cut_valid: \"\\G,A'|\\ts; G,A|\\A'\\ \\ G,A|\\ts\"\napply (unfold ax_valids_def)\napply fast\ndone\n\n(*if cut is available\nGoal \"\\G,A'|\\ts; A' \\ A; \\P Q t. {P} t\\ {Q} \\ A' \\ (\\T. (G,L)\\t\\T) \\ \\ \n G,A|\\ts\"\nb y etac ax_derivs.cut 1;\nb y eatac ax_derivs.asm 1 1;\nqed \"ax_thin\";\n*)\nlemma ax_thin [rule_format (no_asm)]: \n \"G,(A'::'a triple set)|\\(ts::'a triple set) \\ \\A. A' \\ A \\ G,A|\\ts\"\napply (erule ax_derivs.induct)\napply (tactic \"ALLGOALS (EVERY'[clarify_tac @{context}, REPEAT o smp_tac @{context} 1])\")\napply (rule ax_derivs.empty)\napply (erule (1) ax_derivs.insert)\napply (fast intro: ax_derivs.asm)\n(*apply (fast intro: ax_derivs.cut) *)\napply (fast intro: ax_derivs.weaken)\napply (rule ax_derivs.conseq, intro strip, tactic \"smp_tac @{context} 3 1\",clarify,\n tactic \"smp_tac @{context} 1 1\",rule exI, rule exI, erule (1) conjI) \n(* 37 subgoals *)\nprefer 18 (* Methd *)\napply (rule ax_derivs.Methd, drule spec, erule mp, fast) \napply (tactic {* TRYALL (resolve_tac ((funpow 5 tl) @{thms ax_derivs.intros})) *})\napply auto\ndone\n\nlemma ax_thin_insert: \"G,(A::'a triple set)\\(t::'a triple) \\ G,insert x A\\t\"\napply (erule ax_thin)\napply fast\ndone\n\nlemma subset_mtriples_iff: \n \"ts \\ {{P} mb-\\ {Q} | ms} = (\\ms'. ms'\\ms \\ ts = {{P} mb-\\ {Q} | ms'})\"\napply (unfold mtriples_def)\napply (rule subset_image_iff)\ndone\n\nlemma weaken: \n \"G,(A::'a triple set)|\\(ts'::'a triple set) \\ !ts. ts \\ ts' \\ G,A|\\ts\"\napply (erule ax_derivs.induct)\n(*42 subgoals*)\napply (tactic \"ALLGOALS strip_tac\")\napply (tactic {* ALLGOALS(REPEAT o (EVERY'[dtac @{thm subset_singletonD},\n etac disjE, fast_tac (@{context} addSIs @{thms ax_derivs.empty})]))*})\napply (tactic \"TRYALL (hyp_subst_tac @{context})\")\napply (simp, rule ax_derivs.empty)\napply (drule subset_insertD)\napply (blast intro: ax_derivs.insert)\napply (fast intro: ax_derivs.asm)\n(*apply (blast intro: ax_derivs.cut) *)\napply (fast intro: ax_derivs.weaken)\napply (rule ax_derivs.conseq, clarify, tactic \"smp_tac @{context} 3 1\", blast(* unused *))\n(*37 subgoals*)\napply (tactic {* TRYALL (resolve_tac ((funpow 5 tl) @{thms ax_derivs.intros}) \n THEN_ALL_NEW fast_tac @{context}) *})\n(*1 subgoal*)\napply (clarsimp simp add: subset_mtriples_iff)\napply (rule ax_derivs.Methd)\napply (drule spec)\napply (erule impE)\napply (rule exI)\napply (erule conjI)\napply (rule HOL.refl)\noops (* dead end, Methd is to blame *)\n\n\nsubsubsection \"rules derived from conseq\"\n\ntext {* In the following rules we often have to give some type annotations like:\n @{term \"G,(A::'a triple set)\\{P::'a assn} t\\ {Q}\"}.\nGiven only the term above without annotations, Isabelle would infer a more \ngeneral type were we could have \ndifferent types of auxiliary variables in the assumption set (@{term A}) and \nin the triple itself (@{term P} and @{term Q}). But \n@{text \"ax_derivs.Methd\"} enforces the same type in the inductive definition of\nthe derivation. So we have to restrict the types to be able to apply the\nrules. \n*}\nlemma conseq12: \"\\G,(A::'a triple set)\\{P'::'a assn} t\\ {Q'}; \n \\Y s Z. P Y s Z \\ (\\Y' s'. (\\Y Z'. P' Y s Z' \\ Q' Y' s' Z') \\ \n Q Y' s' Z)\\ \n \\ G,A\\{P ::'a assn} t\\ {Q }\"\napply (rule ax_derivs.conseq)\napply clarsimp\napply blast\ndone\n\n-- {* Nice variant, since it is so symmetric we might be able to memorise it. *}\nlemma conseq12': \"\\G,(A::'a triple set)\\{P'::'a assn} t\\ {Q'}; \\s Y' s'. \n (\\Y Z. P' Y s Z \\ Q' Y' s' Z) \\ \n (\\Y Z. P Y s Z \\ Q Y' s' Z)\\ \n \\ G,A\\{P::'a assn } t\\ {Q }\"\napply (erule conseq12)\napply fast\ndone\n\nlemma conseq12_from_conseq12': \"\\G,(A::'a triple set)\\{P'::'a assn} t\\ {Q'}; \n \\Y s Z. P Y s Z \\ (\\Y' s'. (\\Y Z'. P' Y s Z' \\ Q' Y' s' Z') \\ \n Q Y' s' Z)\\ \n \\ G,A\\{P::'a assn} t\\ {Q }\"\napply (erule conseq12')\napply blast\ndone\n\nlemma conseq1: \"\\G,(A::'a triple set)\\{P'::'a assn} t\\ {Q}; P \\ P'\\ \n \\ G,A\\{P::'a assn} t\\ {Q}\"\napply (erule conseq12)\napply blast\ndone\n\nlemma conseq2: \"\\G,(A::'a triple set)\\{P::'a assn} t\\ {Q'}; Q' \\ Q\\ \n\\ G,A\\{P::'a assn} t\\ {Q}\"\napply (erule conseq12)\napply blast\ndone\n\nlemma ax_escape: \n \"\\\\Y s Z. P Y s Z \n \\ G,(A::'a triple set)\\{\\Y' s' (Z'::'a). (Y',s') = (Y,s)} \n t\\ \n {\\Y s Z'. Q Y s Z}\n\\ \\ G,A\\{P::'a assn} t\\ {Q::'a assn}\"\napply (rule ax_derivs.conseq)\napply force\ndone\n\n(* unused *)\nlemma ax_constant: \"\\ C \\ G,(A::'a triple set)\\{P::'a assn} t\\ {Q}\\ \n\\ G,A\\{\\Y s Z. C \\ P Y s Z} t\\ {Q}\"\napply (rule ax_escape (* unused *))\napply clarify\napply (rule conseq12)\napply fast\napply auto\ndone\n(*alternative (more direct) proof:\napply (rule ax_derivs.conseq) *)(* unused *)(*\napply (fast)\n*)\n\n\nlemma ax_impossible [intro]: \n \"G,(A::'a triple set)\\{\\Y s Z. False} t\\ {Q::'a assn}\"\napply (rule ax_escape)\napply clarify\ndone\n\n(* unused *)\nlemma ax_nochange_lemma: \"\\P Y s; All (op = w)\\ \\ P w s\"\napply auto\ndone\n\nlemma ax_nochange:\n \"G,(A::(res \\ state) triple set)\\{\\Y s Z. (Y,s)=Z} t\\ {\\Y s Z. (Y,s)=Z} \n \\ G,A\\{P::(res \\ state) assn} t\\ {P}\"\napply (erule conseq12)\napply auto\napply (erule (1) ax_nochange_lemma)\ndone\n\n(* unused *)\nlemma ax_trivial: \"G,(A::'a triple set)\\{P::'a assn} t\\ {\\Y s Z. True}\"\napply (rule ax_derivs.conseq(* unused *))\napply auto\ndone\n\n(* unused *)\nlemma ax_disj: \n \"\\G,(A::'a triple set)\\{P1::'a assn} t\\ {Q1}; G,A\\{P2::'a assn} t\\ {Q2}\\ \n \\ G,A\\{\\Y s Z. P1 Y s Z \\ P2 Y s Z} t\\ {\\Y s Z. Q1 Y s Z \\ Q2 Y s Z}\"\napply (rule ax_escape (* unused *))\napply safe\napply (erule conseq12, fast)+\ndone\n\n(* unused *)\nlemma ax_supd_shuffle: \n \"(\\Q. G,(A::'a triple set)\\{P::'a assn} .c1. {Q} \\ G,A\\{Q ;. f} .c2. {R}) = \n (\\Q'. G,A\\{P} .c1. {f .; Q'} \\ G,A\\{Q'} .c2. {R})\"\napply (best elim!: conseq1 conseq2)\ndone\n\nlemma ax_cases: \"\n \\G,(A::'a triple set)\\{P \\. C} t\\ {Q::'a assn}; \n G,A\\{P \\. Not \\ C} t\\ {Q}\\ \\ G,A\\{P} t\\ {Q}\"\napply (unfold peek_and_def)\napply (rule ax_escape)\napply clarify\napply (case_tac \"C s\")\napply (erule conseq12, force)+\ndone\n(*alternative (more direct) proof:\napply (rule rtac ax_derivs.conseq) *)(* unused *)(*\napply clarify\napply (case_tac \"C s\")\napply force+\n*)\n\nlemma ax_adapt: \"G,(A::'a triple set)\\{P::'a assn} t\\ {Q} \n \\ G,A\\{adapt_pre P Q Q'} t\\ {Q'}\"\napply (unfold adapt_pre_def)\napply (erule conseq12)\napply fast\ndone\n\nlemma adapt_pre_adapts: \"G,(A::'a triple set)\\{P::'a assn} t\\ {Q} \n\\ G,A\\{adapt_pre P Q Q'} t\\ {Q'}\"\napply (unfold adapt_pre_def)\napply (simp add: ax_valids_def triple_valid_def2)\napply fast\ndone\n\n\nlemma adapt_pre_weakest: \n\"\\G (A::'a triple set) t. G,A\\{P} t\\ {Q} \\ G,A\\{P'} t\\ {Q'} \\ \n P' \\ adapt_pre P Q (Q'::'a assn)\"\napply (unfold adapt_pre_def)\napply (drule spec)\napply (drule_tac x = \"{}\" in spec)\napply (drule_tac x = \"In1r Skip\" in spec)\napply (simp add: ax_valids_def triple_valid_def2)\noops\n\nlemma peek_and_forget1_Normal: \n \"G,(A::'a triple set)\\{Normal P} t\\ {Q::'a assn} \n \\ G,A\\{Normal (P \\. p)} t\\ {Q}\"\napply (erule conseq1)\napply (simp (no_asm))\ndone\n\nlemma peek_and_forget1: \n\"G,(A::'a triple set)\\{P::'a assn} t\\ {Q} \n \\ G,A\\{P \\. p} t\\ {Q}\"\napply (erule conseq1)\napply (simp (no_asm))\ndone\n\nlemmas ax_NormalD = peek_and_forget1 [of _ _ _ _ _ normal] \n\nlemma peek_and_forget2: \n\"G,(A::'a triple set)\\{P::'a assn} t\\ {Q \\. p} \n\\ G,A\\{P} t\\ {Q}\"\napply (erule conseq2)\napply (simp (no_asm))\ndone\n\nlemma ax_subst_Val_allI: \n\"\\v. G,(A::'a triple set)\\{(P' v )\\Val v} t\\ {(Q v)::'a assn}\n \\ \\v. G,A\\{(\\w:. P' (the_In1 w))\\Val v} t\\ {Q v}\"\napply (force elim!: conseq1)\ndone\n\nlemma ax_subst_Var_allI: \n\"\\v. G,(A::'a triple set)\\{(P' v )\\Var v} t\\ {(Q v)::'a assn}\n \\ \\v. G,A\\{(\\w:. P' (the_In2 w))\\Var v} t\\ {Q v}\"\napply (force elim!: conseq1)\ndone\n\nlemma ax_subst_Vals_allI: \n\"(\\v. G,(A::'a triple set)\\{( P' v )\\Vals v} t\\ {(Q v)::'a assn})\n \\ \\v. G,A\\{(\\w:. P' (the_In3 w))\\Vals v} t\\ {Q v}\"\napply (force elim!: conseq1)\ndone\n\n\nsubsubsection \"alternative axioms\"\n\nlemma ax_Lit2: \n \"G,(A::'a triple set)\\{Normal P::'a assn} Lit v-\\ {Normal (P\\=Val v)}\"\napply (rule ax_derivs.Lit [THEN conseq1])\napply force\ndone\nlemma ax_Lit2_test_complete: \n \"G,(A::'a triple set)\\{Normal (P\\Val v)::'a assn} Lit v-\\ {P}\"\napply (rule ax_Lit2 [THEN conseq2])\napply force\ndone\n\nlemma ax_LVar2: \"G,(A::'a triple set)\\{Normal P::'a assn} LVar vn=\\ {Normal (\\s.. P\\=Var (lvar vn s))}\"\napply (rule ax_derivs.LVar [THEN conseq1])\napply force\ndone\n\nlemma ax_Super2: \"G,(A::'a triple set)\\\n {Normal P::'a assn} Super-\\ {Normal (\\s.. P\\=Val (val_this s))}\"\napply (rule ax_derivs.Super [THEN conseq1])\napply force\ndone\n\nlemma ax_Nil2: \n \"G,(A::'a triple set)\\{Normal P::'a assn} []\\\\ {Normal (P\\=Vals [])}\"\napply (rule ax_derivs.Nil [THEN conseq1])\napply force\ndone\n\n\nsubsubsection \"misc derived structural rules\"\n\n(* unused *)\nlemma ax_finite_mtriples_lemma: \"\\F \\ ms; finite ms; \\(C,sig)\\ms. \n G,(A::'a triple set)\\{Normal (P C sig)::'a assn} mb C sig-\\ {Q C sig}\\ \\ \n G,A|\\{{P} mb-\\ {Q} | F}\"\napply (frule (1) finite_subset)\napply (erule rev_mp)\napply (erule thin_rl)\napply (erule finite_induct)\napply (unfold mtriples_def)\napply (clarsimp intro!: ax_derivs.empty ax_derivs.insert)+\napply force\ndone\nlemmas ax_finite_mtriples = ax_finite_mtriples_lemma [OF subset_refl]\n\nlemma ax_derivs_insertD: \n \"G,(A::'a triple set)|\\insert (t::'a triple) ts \\ G,A\\t \\ G,A|\\ts\"\napply (fast intro: ax_derivs.weaken)\ndone\n\nlemma ax_methods_spec: \n\"\\G,(A::'a triple set)|\\split f ` ms; (C,sig) \\ ms\\\\ G,A\\((f C sig)::'a triple)\"\napply (erule ax_derivs.weaken)\napply (force del: image_eqI intro: rev_image_eqI)\ndone\n\n(* this version is used to avoid using the cut rule *)\nlemma ax_finite_pointwise_lemma [rule_format]: \"\\F \\ ms; finite ms\\ \\ \n ((\\(C,sig)\\F. G,(A::'a triple set)\\(f C sig::'a triple)) \\ (\\(C,sig)\\ms. G,A\\(g C sig::'a triple))) \\ \n G,A|\\split f ` F \\ G,A|\\split g ` F\"\napply (frule (1) finite_subset)\napply (erule rev_mp)\napply (erule thin_rl)\napply (erule finite_induct)\napply clarsimp+\napply (drule ax_derivs_insertD)\napply (rule ax_derivs.insert)\napply (simp (no_asm_simp) only: split_tupled_all)\napply (auto elim: ax_methods_spec)\ndone\nlemmas ax_finite_pointwise = ax_finite_pointwise_lemma [OF subset_refl]\n \nlemma ax_no_hazard: \n \"G,(A::'a triple set)\\{P \\. type_ok G t} t\\ {Q::'a assn} \\ G,A\\{P} t\\ {Q}\"\napply (erule ax_cases)\napply (rule ax_derivs.hazard [THEN conseq1])\napply force\ndone\n\nlemma ax_free_wt: \n \"(\\T L C. \\prg=G,cls=C,lcl=L\\\\t\\T) \n \\ G,(A::'a triple set)\\{Normal P} t\\ {Q::'a assn} \\ \n G,A\\{Normal P} t\\ {Q}\"\napply (rule ax_no_hazard)\napply (rule ax_escape)\napply clarify\napply (erule mp [THEN conseq12])\napply (auto simp add: type_ok_def)\ndone\n\nML {* ML_Thms.bind_thms (\"ax_Abrupts\", sum3_instantiate @{context} @{thm ax_derivs.Abrupt}) *}\ndeclare ax_Abrupts [intro!]\n\nlemmas ax_Normal_cases = ax_cases [of _ _ _ normal]\n\nlemma ax_Skip [intro!]: \"G,(A::'a triple set)\\{P\\\\} .Skip. {P::'a assn}\"\napply (rule ax_Normal_cases)\napply (rule ax_derivs.Skip)\napply fast\ndone\nlemmas ax_SkipI = ax_Skip [THEN conseq1]\n\n\nsubsubsection \"derived rules for methd call\"\n\nlemma ax_Call_known_DynT: \n\"\\G\\IntVir\\C\\statT; \n \\a vs l. G,A\\{(R a\\Vals vs \\. (\\s. l = locals (store s)) ;.\n init_lvars G C \\name=mn,parTs=pTs\\ IntVir a vs)} \n Methd C \\name=mn,parTs=pTs\\-\\ {set_lvars l .; S}; \n \\a. G,A\\{Q\\Val a} args\\\\ \n {R a \\. (\\s. C = obj_class (the (heap (store s) (the_Addr a))) \\\n C = invocation_declclass \n G IntVir (store s) a statT \\name=mn,parTs=pTs\\ )}; \n G,(A::'a triple set)\\{Normal P} e-\\ {Q::'a assn}\\ \n \\ G,A\\{Normal P} {accC,statT,IntVir}e\\mn({pTs}args)-\\ {S}\"\napply (erule ax_derivs.Call)\napply safe\napply (erule spec)\napply (rule ax_escape, clarsimp)\napply (drule spec, drule spec, drule spec,erule conseq12)\napply force\ndone\n\n\nlemma ax_Call_Static: \n \"\\\\a vs l. G,A\\{R a\\Vals vs \\. (\\s. l = locals (store s)) ;. \n init_lvars G C \\name=mn,parTs=pTs\\ Static any_Addr vs} \n Methd C \\name=mn,parTs=pTs\\-\\ {set_lvars l .; S}; \n G,A\\{Normal P} e-\\ {Q};\n \\ a. G,(A::'a triple set)\\{Q\\Val a} args\\\\ {(R::val \\ 'a assn) a \n \\. (\\ s. C=invocation_declclass \n G Static (store s) a statT \\name=mn,parTs=pTs\\)}\n\\ \\ G,A\\{Normal P} {accC,statT,Static}e\\mn({pTs}args)-\\ {S}\"\napply (erule ax_derivs.Call)\napply safe\napply (erule spec)\napply (rule ax_escape, clarsimp)\napply (erule_tac V = \"?P \\ ?Q\" in thin_rl)\napply (drule spec,drule spec,drule spec, erule conseq12)\napply (force simp add: init_lvars_def Let_def)\ndone\n\nlemma ax_Methd1: \n \"\\G,A\\{{P} Methd-\\ {Q} | ms}|\\ {{P} body G-\\ {Q} | ms}; (C,sig)\\ ms\\ \\ \n G,A\\{Normal (P C sig)} Methd C sig-\\ {Q C sig}\"\napply (drule ax_derivs.Methd)\napply (unfold mtriples_def)\napply (erule (1) ax_methods_spec)\ndone\n\nlemma ax_MethdN: \n\"G,insert({Normal P} Methd C sig-\\ {Q}) A\\ \n {Normal P} body G C sig-\\ {Q} \\ \n G,A\\{Normal P} Methd C sig-\\ {Q}\"\napply (rule ax_Methd1)\napply (rule_tac [2] singletonI)\napply (unfold mtriples_def)\napply clarsimp\ndone\n\nlemma ax_StatRef: \n \"G,(A::'a triple set)\\{Normal (P\\Val Null)} StatRef rt-\\ {P::'a assn}\"\napply (rule ax_derivs.Cast)\napply (rule ax_Lit2 [THEN conseq2])\napply clarsimp\ndone\n\nsubsubsection \"rules derived from Init and Done\"\n\n lemma ax_InitS: \"\\the (class G C) = c; C \\ Object; \n \\l. G,A\\{Q \\. (\\s. l = locals (store s)) ;. set_lvars empty} \n .init c. {set_lvars l .; R}; \n G,A\\{Normal ((P \\. Not \\ initd C) ;. supd (init_class_obj G C))} \n .Init (super c). {Q}\\ \\ \n G,(A::'a triple set)\\{Normal (P \\. Not \\ initd C)} .Init C. {R::'a assn}\"\napply (erule ax_derivs.Init)\napply (simp (no_asm_simp))\napply assumption\ndone\n\nlemma ax_Init_Skip_lemma: \n\"\\l. G,(A::'a triple set)\\{P\\\\ \\. (\\s. l = locals (store s)) ;. set_lvars l'}\n .Skip. {(set_lvars l .; P)::'a assn}\"\napply (rule allI)\napply (rule ax_SkipI)\napply clarsimp\ndone\n\nlemma ax_triv_InitS: \"\\the (class G C) = c;init c = Skip; C \\ Object; \n P\\\\ \\ (supd (init_class_obj G C) .; P); \n G,A\\{Normal (P \\. initd C)} .Init (super c). {(P \\. initd C)\\\\}\\ \\ \n G,(A::'a triple set)\\{Normal P\\\\} .Init C. {(P \\. initd C)::'a assn}\"\napply (rule_tac C = \"initd C\" in ax_cases)\napply (rule conseq1, rule ax_derivs.Done, clarsimp)\napply (simp (no_asm))\napply (erule (1) ax_InitS)\napply simp\napply (rule ax_Init_Skip_lemma)\napply (erule conseq1)\napply force\ndone\n\nlemma ax_Init_Object: \"wf_prog G \\ G,(A::'a triple set)\\\n {Normal ((supd (init_class_obj G Object) .; P\\\\) \\. Not \\ initd Object)} \n .Init Object. {(P \\. initd Object)::'a assn}\"\napply (rule ax_derivs.Init)\napply (drule class_Object, force)\napply (simp_all (no_asm))\napply (rule_tac [2] ax_Init_Skip_lemma)\napply (rule ax_SkipI, force)\ndone\n\nlemma ax_triv_Init_Object: \"\\wf_prog G; \n (P::'a assn) \\ (supd (init_class_obj G Object) .; P)\\ \\ \n G,(A::'a triple set)\\{Normal P\\\\} .Init Object. {P \\. initd Object}\"\napply (rule_tac C = \"initd Object\" in ax_cases)\napply (rule conseq1, rule ax_derivs.Done, clarsimp)\napply (erule ax_Init_Object [THEN conseq1])\napply force\ndone\n\n\nsubsubsection \"introduction rules for Alloc and SXAlloc\"\n\nlemma ax_SXAlloc_Normal: \n \"G,(A::'a triple set)\\{P::'a assn} .c. {Normal Q} \n \\ G,A\\{P} .c. {SXAlloc G Q}\"\napply (erule conseq2)\napply (clarsimp elim!: sxalloc_elim_cases simp add: split_tupled_all)\ndone\n\nlemma ax_Alloc: \n \"G,(A::'a triple set)\\{P::'a assn} t\\ \n {Normal (\\Y (x,s) Z. (\\a. new_Addr (heap s) = Some a \\ \n Q (Val (Addr a)) (Norm(init_obj G (CInst C) (Heap a) s)) Z)) \\. \n heap_free (Suc (Suc 0))}\n \\ G,A\\{P} t\\ {Alloc G (CInst C) Q}\"\napply (erule conseq2)\napply (auto elim!: halloc_elim_cases)\ndone\n\nlemma ax_Alloc_Arr: \n \"G,(A::'a triple set)\\{P::'a assn} t\\ \n {\\Val:i:. Normal (\\Y (x,s) Z. \\the_Intg i<0 \\ \n (\\a. new_Addr (heap s) = Some a \\ \n Q (Val (Addr a)) (Norm (init_obj G (Arr T (the_Intg i)) (Heap a) s)) Z)) \\.\n heap_free (Suc (Suc 0))} \n \\ \n G,A\\{P} t\\ {\\Val:i:. abupd (check_neg i) .; Alloc G (Arr T(the_Intg i)) Q}\"\napply (erule conseq2)\napply (auto elim!: halloc_elim_cases)\ndone\n\nlemma ax_SXAlloc_catch_SXcpt: \n \"\\G,(A::'a triple set)\\{P::'a assn} t\\ \n {(\\Y (x,s) Z. x=Some (Xcpt (Std xn)) \\ \n (\\a. new_Addr (heap s) = Some a \\ \n Q Y (Some (Xcpt (Loc a)),init_obj G (CInst (SXcpt xn)) (Heap a) s) Z)) \n \\. heap_free (Suc (Suc 0))}\\ \n \\ \n G,A\\{P} t\\ {SXAlloc G (\\Y s Z. Q Y s Z \\ G,s\\catch SXcpt xn)}\"\napply (erule conseq2)\napply (auto elim!: sxalloc_elim_cases halloc_elim_cases)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/AxSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926666143433998, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.29401825030918183}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory WhileLoopVarsPreserved imports\n \"../../AutoCorres\"\nbegin\n\ninstall_C_file \"while_loop_vars_preserved.c\"\n\nautocorres [ts_force nondet = loop] \"while_loop_vars_preserved.c\"\n\ncontext while_loop_vars_preserved begin\n\nlemma \"\\ \\s. True \\ loop' var1 var2 var3 var4 \\ \\r s. r = var1 + var2 + var3 + var4 \\\"\n apply (unfold loop'_def)\n apply (subst whileLoop_add_inv [where I=\"\\(meow, woof, neigh, ii, squeek) s.\n ii = (var1 + var2 + var3 + var4 - (meow + woof + neigh + squeek))\"\n and M=\"\\((meow, woof, neigh, ii, squeek), s).\n unat meow + unat woof + unat neigh + unat squeek\"])\n apply wp\n apply (auto simp: word_gt_0)\n done\n\nend\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/tests/proof-tests/WhileLoopVarsPreserved.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.29401824317072395}} {"text": "header {* \\isaheader{Static Weak Control Dependence} *}\n\ntheory WeakControlDependence imports \n \"../Basic/Postdomination\" \n \"../Basic/DynWeakControlDependence\"\nbegin\n\ncontext StrongPostdomination begin\n\ndefinition \n weak_control_dependence :: \"'node \\ 'node \\ bool\" \n (\"_ weakly controls _\" [51,0])\nwhere weak_control_dependences_eq:\n \"n weakly controls n' \\ \\as. n weakly controls n' via as\"\n\nlemma \n weak_control_dependence_def:\"n weakly controls n' = \n (\\a a' as. (n' \\ set(sourcenodes (a#as))) \\ (n -a#as\\* n') \\\n (n' strongly-postdominates (targetnode a)) \\\n (valid_edge a') \\ (sourcenode a' = n) \\ \n (\\ n' strongly-postdominates (targetnode a')))\"\nby(auto simp:weak_control_dependences_eq dyn_weak_control_dependence_def)\n\n\nlemma Exit_not_weak_control_dependent:\n \"n weakly controls (_Exit_) \\ False\"\nby(auto simp:weak_control_dependences_eq \n intro:Exit_not_dyn_weak_control_dependent)\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/StaticIntra/WeakControlDependence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.2938938756215326}} {"text": "(* Title: HOL/HOLCF/IOA/TLS.thy\n Author: Olaf Müller\n*)\n\nsection \\Temporal Logic of Steps -- tailored for I/O automata\\\n\ntheory TLS\nimports IOA TL\nbegin\n\ndefault_sort type\n\ntype_synonym ('a, 's) ioa_temp = \"('a option, 's) transition temporal\"\n\ntype_synonym ('a, 's) step_pred = \"('a option, 's) transition predicate\"\n\ntype_synonym 's state_pred = \"'s predicate\"\n\ndefinition mkfin :: \"'a Seq \\ 'a Seq\"\n where \"mkfin s = (if Partial s then SOME t. Finite t \\ s = t @@ UU else s)\"\n\ndefinition option_lift :: \"('a \\ 'b) \\ 'b \\ 'a option \\ 'b\"\n where \"option_lift f s y = (case y of None \\ s | Some x \\ f x)\"\n\ndefinition plift :: \"('a \\ bool) \\ 'a option \\ bool\"\n(* plift is used to determine that None action is always false in\n transition predicates *)\n where \"plift P = option_lift P False\"\n\ndefinition xt1 :: \"'s predicate \\ ('a, 's) step_pred\"\n where \"xt1 P tr = P (fst tr)\"\n\ndefinition xt2 :: \"'a option predicate \\ ('a, 's) step_pred\"\n where \"xt2 P tr = P (fst (snd tr))\"\n\ndefinition ex2seqC :: \"('a, 's) pairs \\ ('s \\ ('a option, 's) transition Seq)\"\n where \"ex2seqC =\n (fix \\ (LAM h ex. (\\s. case ex of\n nil \\ (s, None, s) \\ nil\n | x ## xs \\ (flift1 (\\pr. (s, Some (fst pr), snd pr) \\ (h \\ xs) (snd pr)) \\ x))))\"\n\ndefinition ex2seq :: \"('a, 's) execution \\ ('a option, 's) transition Seq\"\n where \"ex2seq ex = (ex2seqC \\ (mkfin (snd ex))) (fst ex)\"\n\ndefinition temp_sat :: \"('a, 's) execution \\ ('a, 's) ioa_temp \\ bool\" (infixr \"\\\" 22)\n where \"(ex \\ P) \\ ((ex2seq ex) \\ P)\"\n\ndefinition validTE :: \"('a, 's) ioa_temp \\ bool\"\n where \"validTE P \\ (\\ex. (ex \\ P))\"\n\ndefinition validIOA :: \"('a, 's) ioa \\ ('a, 's) ioa_temp \\ bool\"\n where \"validIOA A P \\ (\\ex \\ executions A. (ex \\ P))\"\n\n\nlemma IMPLIES_temp_sat [simp]: \"(ex \\ P \\<^bold>\\ Q) \\ ((ex \\ P) \\ (ex \\ Q))\"\n by (simp add: IMPLIES_def temp_sat_def satisfies_def)\n\nlemma AND_temp_sat [simp]: \"(ex \\ P \\<^bold>\\ Q) \\ ((ex \\ P) \\ (ex \\ Q))\"\n by (simp add: AND_def temp_sat_def satisfies_def)\n\nlemma OR_temp_sat [simp]: \"(ex \\ P \\<^bold>\\ Q) \\ ((ex \\ P) \\ (ex \\ Q))\"\n by (simp add: OR_def temp_sat_def satisfies_def)\n\nlemma NOT_temp_sat [simp]: \"(ex \\ \\<^bold>\\ P) \\ (\\ (ex \\ P))\"\n by (simp add: NOT_def temp_sat_def satisfies_def)\n\n\naxiomatization\nwhere mkfin_UU [simp]: \"mkfin UU = nil\"\n and mkfin_nil [simp]: \"mkfin nil = nil\"\n and mkfin_cons [simp]: \"mkfin (a \\ s) = a \\ mkfin s\"\n\n\nlemmas [simp del] = HOL.ex_simps HOL.all_simps split_paired_Ex\n\nsetup \\map_theory_claset (fn ctxt => ctxt delSWrapper \"split_all_tac\")\\\n\n\nsubsection \\ex2seqC\\\n\nlemma ex2seqC_unfold:\n \"ex2seqC =\n (LAM ex. (\\s. case ex of\n nil \\ (s, None, s) \\ nil\n | x ## xs \\\n (flift1 (\\pr. (s, Some (fst pr), snd pr) \\ (ex2seqC \\ xs) (snd pr)) \\ x)))\"\n apply (rule trans)\n apply (rule fix_eq4)\n apply (rule ex2seqC_def)\n apply (rule beta_cfun)\n apply (simp add: flift1_def)\n done\n\nlemma ex2seqC_UU [simp]: \"(ex2seqC \\ UU) s = UU\"\n apply (subst ex2seqC_unfold)\n apply simp\n done\n\nlemma ex2seqC_nil [simp]: \"(ex2seqC \\ nil) s = (s, None, s) \\ nil\"\n apply (subst ex2seqC_unfold)\n apply simp\n done\n\nlemma ex2seqC_cons [simp]: \"(ex2seqC \\ ((a, t) \\ xs)) s = (s, Some a,t ) \\ (ex2seqC \\ xs) t\"\n apply (rule trans)\n apply (subst ex2seqC_unfold)\n apply (simp add: Consq_def flift1_def)\n apply (simp add: Consq_def flift1_def)\n done\n\n\nlemma ex2seq_UU: \"ex2seq (s, UU) = (s, None, s) \\ nil\"\n by (simp add: ex2seq_def)\n\nlemma ex2seq_nil: \"ex2seq (s, nil) = (s, None, s) \\ nil\"\n by (simp add: ex2seq_def)\n\nlemma ex2seq_cons: \"ex2seq (s, (a, t) \\ ex) = (s, Some a, t) \\ ex2seq (t, ex)\"\n by (simp add: ex2seq_def)\n\ndeclare ex2seqC_UU [simp del] ex2seqC_nil [simp del] ex2seqC_cons [simp del]\ndeclare ex2seq_UU [simp] ex2seq_nil [simp] ex2seq_cons [simp]\n\n\nlemma ex2seq_nUUnnil: \"ex2seq exec \\ UU \\ ex2seq exec \\ nil\"\n apply (pair exec)\n apply (Seq_case_simp x2)\n apply (pair a)\n done\n\n\nsubsection \\Interface TL -- TLS\\\n\n(* uses the fact that in executions states overlap, which is lost in\n after the translation via ex2seq !! *)\n\nlemma TL_TLS:\n \"\\s a t. (P s) \\ s \\a\\A\\ t \\ (Q t)\n \\ ex \\ (Init (\\(s, a, t). P s) \\<^bold>\\ Init (\\(s, a, t). s \\a\\A\\ t)\n \\<^bold>\\ (\\(Init (\\(s, a, t). Q s))))\"\n apply (unfold Init_def Next_def temp_sat_def satisfies_def IMPLIES_def AND_def)\n apply clarify\n apply (simp split: if_split)\n text \\\\TL = UU\\\\\n apply (rule conjI)\n apply (pair ex)\n apply (Seq_case_simp x2)\n apply (pair a)\n apply (Seq_case_simp s)\n apply (pair a)\n text \\\\TL = nil\\\\\n apply (rule conjI)\n apply (pair ex)\n apply (Seq_case x2)\n apply (simp add: unlift_def)\n apply (simp add: unlift_def)\n apply (simp add: unlift_def)\n apply (pair a)\n apply (Seq_case_simp s)\n apply (pair a)\n text \\\\TL = cons\\\\\n apply (simp add: unlift_def)\n apply (pair ex)\n apply (Seq_case_simp x2)\n apply (pair a)\n apply (Seq_case_simp s)\n apply (pair a)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/TLS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.29382737609670473}} {"text": "(* File: Parallel_Composition.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nsection \\Parallel Composition\\\n\ntheory Parallel_Composition\n imports \"Basic_Modules/Component_Types/Aggregator\"\n \"Basic_Modules/Component_Types/Electoral_Module\"\nbegin\n\ntext \\\n The parallel composition composes a new electoral module from\n two electoral modules combined with an aggregator.\n Therein, the two modules each make a decision and the aggregator combines\n them to a single (aggregated) result.\n\\\n\nsubsection \\Definition\\\n\nfun parallel_composition :: \"'a Electoral_Module \\ 'a Electoral_Module \\\n 'a Aggregator \\ 'a Electoral_Module\" where\n \"parallel_composition m n agg A p = agg A (m A p) (n A p)\"\n\nabbreviation parallel :: \"'a Electoral_Module \\ 'a Aggregator \\\n 'a Electoral_Module \\ 'a Electoral_Module\"\n (\"_ \\\\<^sub>_ _\" [50, 1000, 51] 50) where\n \"m \\\\<^sub>a n == parallel_composition m n a\"\n\nsubsection \\Soundness\\\n\ntheorem par_comp_sound[simp]:\n assumes\n mod_m: \"electoral_module m\" and\n mod_n: \"electoral_module n\" and\n agg_a: \"aggregator a\"\n shows \"electoral_module (m \\\\<^sub>a n)\"\nproof (unfold electoral_module_def, safe)\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\"\n have wf_quant:\n \"\\ a. aggregator a =\n (\\ A' e r d e' r' d'.\n (\\ well_formed (A'::'a set) (e, r', d) \\\n \\ well_formed A' (r, d', e')) \\\n well_formed A'\n (a A' (e, r', d) (r, d', e')))\"\n unfolding aggregator_def\n by blast\n have wf_imp:\n \"\\ m' A' p'.\n (electoral_module m' \\ finite (A'::'a set) \\\n profile A' p') \\\n well_formed A' (m' A' p')\"\n using par_comp_result_sound\n by (metis (no_types))\n from mod_m mod_n fin_A prof_A agg_a\n have \"well_formed A (a A (m A p) (n A p))\"\n using agg_a combine_ele_rej_def fin_A\n mod_m mod_n prof_A wf_imp wf_quant\n by metis\n thus \"well_formed A ((m \\\\<^sub>a n) A p)\"\n by simp\nqed\n\nsubsection \\Composition Rule\\\n\ntext \\\n Using a conservative aggregator, the parallel composition\n preserves the property non-electing.\n\\\n\ntheorem conserv_agg_presv_non_electing[simp]:\n assumes\n non_electing_m: \"non_electing m\" and\n non_electing_n: \"non_electing n\" and\n conservative: \"agg_conservative a\"\n shows \"non_electing (m \\\\<^sub>a n)\"\nproof (unfold non_electing_def, safe)\n have emod_m: \"electoral_module m\"\n using non_electing_m\n unfolding non_electing_def\n by simp\n have emod_n: \"electoral_module n\"\n using non_electing_n\n unfolding non_electing_def\n by simp\n have agg_a: \"aggregator a\"\n using conservative\n unfolding agg_conservative_def\n by simp\n thus \"electoral_module (m \\\\<^sub>a n)\"\n using emod_m emod_n agg_a par_comp_sound\n by simp\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n x :: \"'a\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\" and\n x_wins: \"x \\ elect (m \\\\<^sub>a n) A p\"\n have emod_m: \"electoral_module m\"\n using non_electing_m\n unfolding non_electing_def\n by simp\n have emod_n: \"electoral_module n\"\n using non_electing_n\n unfolding non_electing_def\n by simp\n have\n \"\\ r r' d d' e e' A' f.\n (well_formed (A'::'a set) (e', r', d') \\ well_formed A' (e, r, d) \\\n elect_r (f A' (e', r', d') (e, r, d)) \\ e' \\ e \\\n reject_r (f A' (e', r', d') (e, r, d)) \\ r' \\ r \\\n defer_r (f A' (e', r', d') (e, r, d)) \\ d' \\ d) =\n ((\\ well_formed A' (e', r', d') \\ \\ well_formed A' (e, r, d)) \\\n elect_r (f A' (e', r', d') (e, r, d)) \\ e' \\ e \\\n reject_r (f A' (e', r', d') (e, r, d)) \\ r' \\ r \\\n defer_r (f A' (e', r', d') (e, r, d)) \\ d' \\ d)\"\n by linarith\n hence\n \"\\ a. agg_conservative a =\n (aggregator a \\\n (\\ A' e e' d d' r r'. (\\ well_formed (A'::'a set) (e, r, d) \\\n \\ well_formed A' (e', r', d')) \\\n elect_r (a A' (e, r, d) (e', r', d')) \\ e \\ e' \\\n reject_r (a A' (e, r, d) (e', r', d')) \\ r \\ r' \\\n defer_r (a A' (e, r, d) (e', r', d')) \\ d \\ d'))\"\n unfolding agg_conservative_def\n by simp\n hence\n \"aggregator a \\\n (\\ A' e e' d d' r r'. \\ well_formed A' (e, r, d) \\\n \\ well_formed A' (e', r', d') \\\n elect_r (a A' (e, r, d) (e', r', d')) \\ e \\ e' \\\n reject_r (a A' (e, r, d) (e', r', d')) \\ r \\ r' \\\n defer_r (a A' (e, r, d) (e', r', d')) \\ d \\ d')\"\n using conservative\n by presburger\n hence\n \"let c = (a A (m A p) (n A p)) in\n (elect_r c \\ ((elect m A p) \\ (elect n A p)))\"\n using emod_m emod_n fin_A par_comp_result_sound\n prod.collapse prof_A\n by metis\n hence \"x \\ ((elect m A p) \\ (elect n A p))\"\n using x_wins\n by auto\n thus \"x \\ {}\"\n using sup_bot_right fin_A prof_A\n non_electing_m non_electing_n\n unfolding non_electing_def\n by (metis (no_types, lifting))\nqed\n\nend\n", "meta": {"author": "VeriVote", "repo": "verifiedVotingRuleConstruction", "sha": "17bf689350c733dc7b419f4924d099a0e65de036", "save_path": "github-repos/isabelle/VeriVote-verifiedVotingRuleConstruction", "path": "github-repos/isabelle/VeriVote-verifiedVotingRuleConstruction/verifiedVotingRuleConstruction-17bf689350c733dc7b419f4924d099a0e65de036/theories/Compositional_Structures/Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2938273760967047}} {"text": "section \\Entry-Point to Word Library and additional lemmas for Isabelle-LLVM\\\ntheory LLVM_More_Word\nimports \"HOL-Library.Word\" (*\"HOL-Library.Bit_Operations\"*) Bits_Natural \"Word_Lib.Word_Lib_Sumo\"\nbegin\n(* TODO: Fix in Word.thy! \n Introducing proper infix-syntax for signed comparisons. So, also (Additional Lemmas\\\n\nclass len2 = len +\n assumes len2_not_1 [simp]: \"LENGTH('a) \\ Suc 0\"\n\nlemma len2_simps[simp]:\n \"LENGTH('a::len2) > Suc 0\"\n \"LENGTH('a::len2) \\ 2\"\n subgoal by (metis Suc_lessI len2_not_1 len_gt_0)\n subgoal using \\Suc 0 < LENGTH('a)\\ by linarith\n done\n \nlemma len2E: obtains n where \"LENGTH('a::len2) = 2+n\"\n apply (cases \"LENGTH('a)\"; simp)\n subgoal for k by (cases k; simp)\n done\n \ninstance bit0 :: (len) len2 \n by standard simp\n \ninstance bit1 :: (len) len2 \n by standard simp\n \ndefinition \"len2 (TYPE('a::len2)) \\ True\" \n\n\n(* Original theorem is in simpset, but useless due to non-normalized LHS *)\nlemmas [simp] = word_sbin.norm_Rep[simplified]\n\n\nlemma to_bl_scast_down: \"is_down SCAST('a::len \\ 'b::len) \\ to_bl (SCAST('a \\ 'b) w) = drop (LENGTH('a)-LENGTH('b)) (to_bl w)\" \n by (simp add: is_down scast_down_drop source_size target_size)\n \n\n\ndeclare word_unat.Rep_inject[simp del]\ndeclare word_uint.Rep_inject[simp del]\n\nlemma msb_uint_big: \"msb (w::'a::len word) \\ uint w \\ 2^(LENGTH('a)-1)\" \n apply (simp add: msb_big) \n by (metis One_nat_def Suc_pred' diff_le_self le_antisym len_gt_0 n_not_Suc_n p2_eq_0 uint_2p word_le_def word_neq_0_conv)\n\nlemma msb_unat_big: \"msb (w::'a::len word) \\ unat w \\ 2^(LENGTH('a)-1)\" \n by (simp add: msb_big word_le_nat_alt)\n\n(* TODO: Move *) \nlemma word1_neqZ_is_one: \"(a::1 word) \\ 0 \\ a=1\" \n apply transfer\n subgoal for a\n apply (cases \"bin_last a\")\n by auto\n done\n \nlemma word1_cases[cases type]: \n fixes a :: \"1 word\" obtains (zero) \"a=0\" | (one) \"a=1\"\n apply (cases \"a=0\")\n by (auto simp: word1_neqZ_is_one)\n \n(* TODO: Move *) \nlemma word1_NOT_eq: \"~~(x::1 word) = x+1\"\n by (auto simp: NOT_eq)\n\nlemma upcast_no_msb[simp]: \"LENGTH('small::len) < LENGTH('big::len) \\ \\msb (UCAST('small \\ 'big) x)\" \n by (simp add: bit_word_ucast_iff msb_word_eq)\n\nsubsection \\Integer Division with Rounding Towards Zero\\\n\ntext \\Division with rounding towards zero\\\n\nlemma int_sgn_cases: fixes a::int obtains (negative) \"a<0\" | (zero) \"a=0\" | (positive) \"a>0\"\n by (rule linorder_cases)\n\ntext \\Lemmas to match original definitions from this development to \n definitions from Word-Library, to which we switched at some point.\\\nlemma sdiv_int_original_def: \"(a::int) sdiv b = (if a\\0 \\ b\\0 then \\a\\ div \\b\\ else - ( \\a\\ div \\b\\))\"\n apply (cases a rule: int_sgn_cases; cases b rule: int_sgn_cases)\n apply (auto simp: sdiv_int_def sgn_mult)\n done\n \nlemma srem_int_original_def: \"(a::int) smod b = (if a\\0 then \\a\\ mod \\b\\ else - (\\a\\ mod \\b\\))\"\n apply (cases a rule: int_sgn_cases; cases b rule: int_sgn_cases)\n apply (auto \n simp: smod_int_def sdiv_int_def sgn_mult algebra_simps \n simp flip: minus_mod_eq_mult_div mult_minus_left)\n done \n \n \ntext \\Standard properties of remainders\\\nlemma div_rem_rtz_id: \"(a::int) sdiv b * b + a smod b = a\"\n by (simp add: smod_int_def)\n\nlemma abs_rem_rtz_lt: \"b\\0 \\ \\a smod b\\ < \\b::int\\\"\n using srem_int_original_def by auto\n \ntext \\LLVM documentation: The remainder is either zero, or has the same sign as the dividend\\\nlemma rem_rtz_sign: \"(a::int) smod b = 0 \\ sgn ((a::int) smod b) = sgn a\"\n apply (clarsimp simp: srem_int_original_def)\n by (metis (no_types, hide_lams) Euclidean_Division.pos_mod_sign abs_le_zero_iff abs_of_nonneg add.inverse_neutral mod_0 mod_by_0 neg_le_0_iff_le not_le sgn_pos)\n (*by (smt Euclidean_Division.pos_mod_sign sgn_pos zmod_trival_iff)*)\n \n\nlemma sdiv_positive[simp]: \"(a::int)\\0 \\ b\\0 \\ a sdiv b = a div b\"\n by (simp add: sdiv_int_original_def)\n\nlemma smod_positive[simp]: \"(a::int)\\0 \\ b\\0 \\ a smod b = a mod b\"\n by (auto simp: srem_int_original_def)\n\n\nsubsection \\Additions to Bits-Int\\\ndeclare bin_to_bl_def[simp del]\n\n(* TODO: Move *)\nlemma map2_eq_Nil_conv[simp]: \"map2 f a b = [] \\ a=[] \\ b=[]\"\n by (cases a; cases b; auto)\n \nlemma bin_to_bl_eq_Nil_conv[simp]: \"bin_to_bl w i = [] \\ w=0\"\n by (metis bin_to_bl_aux.Z bin_to_bl_def size_bin_to_bl)\n\nlemma bin_to_bl_aux_eq_Nil_conv[simp]: \"bin_to_bl_aux w i acc = [] \\ w=0 \\ acc=[]\"\n by (metis bin_to_bl_aux.Z bin_to_bl_eq_Nil_conv take.simps(1) take_bin2bl_lem1)\n\nlemma \"bl_to_bin_aux bl (1+n) = bl_to_bin_aux bl n + 2 ^ length bl\"\n apply (induction bl arbitrary: n)\n apply (simp_all add: algebra_simps)\n by smt\n\nlemma bl_to_bin_True [simp]: \"bl_to_bin (True # bl) = bl_to_bin bl + 2^length bl\"\nproof -\n have \"bl_to_bin_aux bl (1+n) = bl_to_bin_aux bl n + 2 ^ length bl\" for n\n apply (induction bl arbitrary: n)\n apply (simp_all add: algebra_simps)\n by smt\n from this[of 0] show ?thesis\n unfolding bl_to_bin_def\n by simp\nqed\n\nlemma bl_to_bin_append_num: \"bl_to_bin (a@b) = 2^length b * bl_to_bin a + bl_to_bin b\"\n by (simp add: bin_cat_num bl_to_bin_app_cat)\n\nlemma bl_to_bin_rep_True: \"bl_to_bin (replicate n True) = 2 ^ n - 1\"\n by (metis bin_bl_bin bin_to_bl_minus1 bintr_Min)\n\nlemma bl_to_bin_rep_T: \"bl_to_bin (replicate n True @ bl) = 2 ^ length bl * (2 ^ n - 1) + bl_to_bin bl\"\n by (simp add: bl_to_bin_append_num bl_to_bin_rep_True algebra_simps)\n\nlemma bin_to_bl_strunc[simp]: \n \"w\\<^sub>1 \\ w\\<^sub>2 + 1 \\ bin_to_bl w\\<^sub>1 (sbintrunc w\\<^sub>2 i) = bin_to_bl w\\<^sub>1 i\"\n by (simp add: bintrunc_sbintrunc_le bl_to_bin_inj)\n\nlemma bin_last_x2[simp]: \"bin_last (2*n) = False\" by (auto)\nlemma bin_rest_x2[simp]: \"bin_rest (2*n) = n\" by simp\n\nlemma bin_to_bl_x2[simp]: \"w\\0 \\ bin_to_bl w (2*n) = bin_to_bl (w-1) n @ [False]\"\n by (cases w) (auto simp: bin_to_bl_def bin_to_bl_aux_append)\n\nlemma bin_to_bl_xp2[simp]:\n assumes \"n\\w\" \n shows \"bin_to_bl w (x * 2^n) = bin_to_bl (w-n) x @ replicate n False\"\nproof -\n have [simp]: \"x * (2 * 2 ^ n) = 2 * (x*2^n)\" for n by auto\n\n show ?thesis using assms\n by (induction n) (auto simp: drop_bin2bl[symmetric] replicate_append_same)\nqed\n\nlemma bintrunc_eq_if_in_range: \"bintrunc w i = i \\ i\\uints w\"\n by (simp add: bintrunc_mod2p int_mod_lem uints_num)\n\nlemma sbintrunc_eq_if_in_range: \"sbintrunc (w-Suc 0) i = i \\ i\\sints w\"\n by (clarsimp simp: sints_def sbintrunc_eq_in_range)\n\nlemma bl_to_bin_in_uints: \"bl_to_bin x \\ uints (length x)\"\n using bl_to_bin_def bintrunc_eq_if_in_range by fastforce\n\n\n(* TODO: This is probably a special case of a more general scheme! *)\n\nmethod_setup pull_mods = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (\n CONVERSION (Conv.top_conv (K (Conv.try_conv (Conv.rewrs_conv @{thms pull_mods}))) ctxt)\n))\\\n\nmethod_setup pull_push_mods = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (\n CONVERSION (Conv.top_conv (K (Conv.try_conv (Conv.rewrs_conv @{thms pull_mods}))) ctxt)\n THEN' (full_simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms mod_mod_trivial push_mods}))\n))\\ \\Pull in, then push out modulos\\\n\n\nsubsection \\Signed integers in Two's Complement Representation\\\n\ndefinition bl_to_sbin :: \"bool list \\ int\" \n where \"bl_to_sbin bl = sbintrunc (length bl - 1) (bl_to_bin bl)\"\n\nlemma bl_to_sbin_alt:\n \"bl_to_sbin bl = (case bl of [] \\ 0 | b#bl \\ (if b then -(2^length bl) else 0) + bl_to_bin bl)\"\n apply (auto simp: bl_to_sbin_def sbintrunc_mod2p bl_to_bin_ge0 bl_to_bin_lt2p split: list.splits)\n by (smt bl_to_bin_ge0 bl_to_bin_lt2p int_mod_eq')\n\nlemma bl_sbin_bl[simp]: \"bin_to_bl (length bs) (bl_to_sbin bs) = bs\"\n unfolding bl_to_sbin_def by auto\n\nlemma sbin_bl_bin[simp]:\n \"0 bl_to_sbin (bin_to_bl w i) = sbintrunc (w-1) i\"\n unfolding bl_to_sbin_def by auto\n\nlemma bl_to_sbin_in_sints: \"bl_to_sbin x \\ sints (length x)\"\n using bl_to_sbin_def sbintrunc_eq_if_in_range by fastforce\n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/lib/LLVM_More_Word.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.2938273760967047}} {"text": "(* Title: HOL/HOLCF/IOA/NTP/Abschannel.thy\n Author: Olaf Müller\n*)\n\nsection \\The (faulty) transmission channel (both directions)\\\n\ntheory Abschannel\nimports \"../IOA\" Action\nbegin\n\ndatatype 'a abs_action = S 'a | R 'a\n\ndefinition\n ch_asig :: \"'a abs_action signature\" where\n \"ch_asig = (UN b. {S(b)}, UN b. {R(b)}, {})\"\n\ndefinition\n ch_trans :: \"('a abs_action, 'a multiset)transition set\" where\n \"ch_trans =\n {tr. let s = fst(tr);\n t = snd(snd(tr))\n in\n case fst(snd(tr))\n of S(b) => t = addm s b |\n R(b) => count s b ~= 0 & t = delm s b}\"\n\ndefinition\n ch_ioa :: \"('a abs_action, 'a multiset)ioa\" where\n \"ch_ioa = (ch_asig, {{|}}, ch_trans,{},{})\"\n\ndefinition\n rsch_actions :: \"'m action => bool abs_action option\" where\n \"rsch_actions (akt) =\n (case akt of\n S_msg(m) => None |\n R_msg(m) => None |\n S_pkt(packet) => None |\n R_pkt(packet) => None |\n S_ack(b) => Some(S(b)) |\n R_ack(b) => Some(R(b)) |\n C_m_s => None |\n C_m_r => None |\n C_r_s => None |\n C_r_r(m) => None)\"\n\ndefinition\n srch_actions :: \"'m action =>(bool * 'm) abs_action option\" where\n \"srch_actions (akt) =\n (case akt of\n S_msg(m) => None |\n R_msg(m) => None |\n S_pkt(p) => Some(S(p)) |\n R_pkt(p) => Some(R(p)) |\n S_ack(b) => None |\n R_ack(b) => None |\n C_m_s => None |\n C_m_r => None |\n C_r_s => None |\n C_r_r(m) => None)\"\n\ndefinition\n srch_ioa :: \"('m action, 'm packet multiset)ioa\" where\n \"srch_ioa = rename ch_ioa srch_actions\"\n\ndefinition\n rsch_ioa :: \"('m action, bool multiset)ioa\" where\n \"rsch_ioa = rename ch_ioa rsch_actions\"\n\ndefinition\n srch_asig :: \"'m action signature\" where\n \"srch_asig = asig_of(srch_ioa)\"\n\ndefinition\n rsch_asig :: \"'m action signature\" where\n \"rsch_asig = asig_of(rsch_ioa)\"\n\ndefinition\n srch_wfair :: \"('m action)set set\" where\n \"srch_wfair = wfair_of(srch_ioa)\"\ndefinition\n srch_sfair :: \"('m action)set set\" where\n \"srch_sfair = sfair_of(srch_ioa)\"\ndefinition\n rsch_sfair :: \"('m action)set set\" where\n \"rsch_sfair = sfair_of(rsch_ioa)\"\ndefinition\n rsch_wfair :: \"('m action)set set\" where\n \"rsch_wfair = wfair_of(rsch_ioa)\"\n\ndefinition\n srch_trans :: \"('m action, 'm packet multiset)transition set\" where\n \"srch_trans = trans_of(srch_ioa)\"\ndefinition\n rsch_trans :: \"('m action, bool multiset)transition set\" where\n \"rsch_trans = trans_of(rsch_ioa)\"\n\n\nlemmas unfold_renaming =\n srch_asig_def rsch_asig_def rsch_ioa_def srch_ioa_def ch_ioa_def\n ch_asig_def srch_actions_def rsch_actions_def rename_def rename_set_def asig_of_def\n actions_def srch_trans_def rsch_trans_def ch_trans_def starts_of_def\n trans_of_def asig_projections\n\nlemma in_srch_asig: \n \"S_msg(m) ~: actions(srch_asig) & \n R_msg(m) ~: actions(srch_asig) & \n S_pkt(pkt) : actions(srch_asig) & \n R_pkt(pkt) : actions(srch_asig) & \n S_ack(b) ~: actions(srch_asig) & \n R_ack(b) ~: actions(srch_asig) & \n C_m_s ~: actions(srch_asig) & \n C_m_r ~: actions(srch_asig) & \n C_r_s ~: actions(srch_asig) & C_r_r(m) ~: actions(srch_asig)\"\n by (simp add: unfold_renaming)\n\nlemma in_rsch_asig: \n \"S_msg(m) ~: actions(rsch_asig) & \n R_msg(m) ~: actions(rsch_asig) & \n S_pkt(pkt) ~: actions(rsch_asig) & \n R_pkt(pkt) ~: actions(rsch_asig) & \n S_ack(b) : actions(rsch_asig) & \n R_ack(b) : actions(rsch_asig) & \n C_m_s ~: actions(rsch_asig) & \n C_m_r ~: actions(rsch_asig) & \n C_r_s ~: actions(rsch_asig) & \n C_r_r(m) ~: actions(rsch_asig)\"\n by (simp add: unfold_renaming)\n\nlemma srch_ioa_thm: \"srch_ioa = \n (srch_asig, {{|}}, srch_trans,srch_wfair,srch_sfair)\"\napply (simp (no_asm) add: srch_asig_def srch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def srch_wfair_def srch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nlemma rsch_ioa_thm: \"rsch_ioa = \n (rsch_asig, {{|}}, rsch_trans,rsch_wfair,rsch_sfair)\"\napply (simp (no_asm) add: rsch_asig_def rsch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def rsch_wfair_def rsch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/HOLCF/IOA/NTP/Abschannel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.29375600911509386}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m2_ds.thy (Isabelle/HOL 2016-1)\n ID: $Id: m2_ds.thy 132890 2016-12-24 10:25:57Z csprenge $\n Author: Ivano Somaini, ETH Zurich \n Christoph Sprenger, ETH Zurich \n\n Key distribution protocols\n Level 2: channel protocol, parallel version of Denning-Sacco\n\n Copyright (c) 2009-2016 Ivano Somaini and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Abstract Denning-Sacco protocol (L2)\\\n\ntheory m2_ds imports m1_ds \"../Refinement/Channels\"\nbegin\n\ntext \\\nWe model an abstract version of the Denning-Sacco protocol:\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B \\\\ \n \\mathrm{M2.} & S \\rightarrow A: & \\{B, Kab, T,\\{Kab, A, T\\}_{Kbs} \\}_{Kas} \\\\\n \\mathrm{M3.} & A \\rightarrow B: & \\{Kab, A, T\\}_{Kbs} \\\\\n\\end{array}\n\\]\n\nThis refinement introduces channels with security properties. We model \na parallel version of the DS protocol:\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B \\\\ \n \\mathrm{M2a.} & S \\rightarrow A: & \\{B, Kab, T\\}_{Kas} \\\\\n \\mathrm{M2b.} & S \\rightarrow B: & \\{Kab, A, T\\}_{Kbs} \\\\\n\\end{array}\n\\]\nMessage 1 is sent over an insecure channel, the other two message over\nsecure channels.\n\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\State and observations\\\n\nrecord m2_state = \"m1_state\" +\n chan :: \"chmsg set\" \\ \\channel messages\\\n\ntype_synonym \n m2_obs = \"m1_state\" \n\ndefinition \n m2_obs :: \"m2_state \\ m2_obs\" where\n \"m2_obs s \\ \\ \n runs = runs s,\n leak = leak s,\n clk = clk s\n \\\"\n\ntype_synonym\n m2_pred = \"m2_state set\"\n\ntype_synonym\n m2_trans = \"(m2_state \\ m2_state) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext \\Protocol events.\\\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m1a_step1\"}\\\n m2_step1 :: \"[rid_t, agent, agent] \\ m2_trans\"\nwhere\n \"m2_step1 Ra A B \\ {(s, s1).\n\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n\n \\ \\actions:\\\n \\ \\create initiator thread and send message 1\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n chan := insert (Insec A B (Msg [])) (chan s) \\ \\send M1\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m1e_step2\"}\\\n m2_step2 :: \"[rid_t, agent, agent] \\ m2_trans\"\nwhere\n \"m2_step2 \\ m1_step2\"\n\ndefinition \\ \\by @{text \"Server\"}, refines @{term m1e_step3}\\\n m2_step3 :: \"[rid_t, agent, agent, key, time] \\ m2_trans\"\nwhere\n \"m2_step3 Rs A B Kab Ts \\ {(s, s1). \n\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh server run\\\n Kab = sesK (Rs$sk) \\ \\ \\fresh session key\\\n Ts = clk s \\ \\ \\fresh timestamp\\ \n\n Insec A B (Msg []) \\ chan s \\ \\ \\recv M1\\\n \n \\ \\actions:\\\n \\ \\record key and send messages 2 and 3\\\n s1 = s\\\n runs := (runs s)(Rs \\ (Serv, [A, B], [aNum Ts])), \n chan := {Secure Sv A (Msg [aAgt B, aKey Kab, aNum Ts]), \\ \\send \\M2a/b\\\\\n Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts])} \\ chan s\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m1e_step4}\\\n m2_step4 :: \"[rid_t, agent, agent, key, time] \\ m2_trans\"\nwhere\n \"m2_step4 Ra A B Kab Ts \\ {(s, s1).\n\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\ \n Secure Sv A (Msg [aAgt B, aKey Kab, aNum Ts]) \\ chan s \\ \\ \\recv \\M2a\\\\\n\n clk s < Ts + Ls \\ \\ \\ensure key freshness\\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts]))\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m1e_step5}\\\n m2_step5 :: \"[rid_t, agent, agent, key, time] \\ m2_trans\"\nwhere\n \"m2_step5 Rb A B Kab Ts \\ {(s, s1). \n\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\\n Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts]) \\ chan s \\ \\ \\recv \\M2b\\\\\n\n \\ \\ensure freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, aNum Ts]))\n \\\n }\"\n\ntext \\Clock tick event\\\n\ndefinition \\ \\refines @{term m1_tick}\\\n m2_tick :: \"time \\ m2_trans\" \nwhere\n \"m2_tick \\ m1_tick\"\n\n\ntext \\Session key compromise.\\\n\ndefinition \\ \\refines @{term m1_leak}\\ \n m2_leak :: \"rid_t \\ m2_trans\"\nwhere\n \"m2_leak Rs \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\\n fst (the (runs s Rs)) = Serv \\ \\ \\compromise server run \\Rs\\\\\n\n \\ \\actions:\\\n \\ \\record session key as leaked;\\\n \\ \\intruder sends himself an insecure channel message containing the key\\\n s1 = s\\ leak := insert (sesK (Rs$sk)) (leak s), \n chan := insert (Insec undefined undefined (Msg [aKey (sesK (Rs$sk))])) (chan s) \\ \n }\"\n\n\ntext \\Intruder fake event (new).\\\n\ndefinition \\ \\refines @{term Id}\\ \n m2_fake :: \"m2_trans\"\nwhere\n \"m2_fake \\ {(s, s1). \n\n \\ \\actions:\\\n s1 = s\\\n \\ \\close under fakeable messages\\\n chan := fake ik0 (dom (runs s)) (chan s) \n \\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\ndefinition \n m2_init :: \"m2_pred\"\nwhere\n \"m2_init \\ { \\\n runs = Map.empty,\n leak = corrKey,\n clk = 0,\n chan = {} \\ \\\\Channels.ik0\\ contains \\aKey`corrKey\\\\\n \\ }\"\n\ndefinition \n m2_trans :: \"m2_trans\" where\n \"m2_trans \\ (\\A B Ra Rb Rs Kab Ts T.\n m2_step1 Ra A B \\\n m2_step2 Rb A B \\\n m2_step3 Rs A B Kab Ts \\\n m2_step4 Ra A B Kab Ts \\\n m2_step5 Rb A B Kab Ts \\\n m2_tick T \\\n m2_leak Rs \\\n m2_fake \\\n Id\n )\"\n\ndefinition \n m2 :: \"(m2_state, m2_obs) spec\" where\n \"m2 \\ \\\n init = m2_init,\n trans = m2_trans,\n obs = m2_obs\n \\\"\n\nlemmas m2_loc_defs = \n m2_def m2_init_def m2_trans_def m2_obs_def\n m2_step1_def m2_step2_def m2_step3_def m2_step4_def m2_step5_def \n m2_tick_def m2_leak_def m2_fake_def \n\nlemmas m2_defs = m2_loc_defs m1_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants and simulation relation\\\n(******************************************************************************)\n\n(*\nsubsubsection {* inv1: Key definedness [UNUSED] *}\n(******************************************************************************)\n\ntext {* All session keys in channel messages stem from existing runs. *}\n\ndefinition \n m2_inv1_keys :: \"m2_state set\"\nwhere \n \"m2_inv1_keys \\ {s. \\R.\n aKey (sesK (R$sk)) \\ atoms (chan s) (* \\ sesK (R$sk) \\ leak s *) \\ \n R \\ dom (runs s)\n }\"\n\nlemmas m2_inv1_keysI = \n m2_inv1_keys_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv1_keysE [elim] = \n m2_inv1_keys_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv1_keysD = \n m2_inv1_keys_def [THEN setc_def_to_dest, rule_format]\n\n\ntext {* Invariance proof. *}\n\nlemma PO_m2_inv1_keys_init [iff]:\n \"init m2 \\ m2_inv1_keys\"\nby (auto simp add: m2_defs intro!: m2_inv1_keysI)\n\nlemma PO_m2_inv1_keys_trans [iff]:\n \"{m2_inv1_keys} trans m2 {> m2_inv1_keys}\"\nby (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv1_keysI)\n (auto simp add: ik0_def dest: m2_inv1_keysD dom_lemmas)\n\nlemma PO_m2_inv1_keys [iff]: \"reach m2 \\ m2_inv1_keys\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection {* inv2: Definedness of used keys [UNUSED] *}\n(******************************************************************************)\n\ndefinition \n m2_inv2_keys_for :: \"m2_state set\"\nwhere \n \"m2_inv2_keys_for \\ {s. \\R.\n sesK (R$sk) \\ keys_for (chan s) \\ R \\ dom (runs s)\n }\"\n\nlemmas m2_inv2_keys_forI = \n m2_inv2_keys_for_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv2_keys_forE [elim] = \n m2_inv2_keys_for_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv2_keys_forD = \n m2_inv2_keys_for_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext {* Invariance proof. *}\n\nlemma PO_m2_inv2_keys_for_init [iff]:\n \"init m2 \\ m2_inv2_keys_for\"\nby (auto simp add: m2_defs intro!: m2_inv2_keys_forI)\n\nlemma PO_m2_inv2_keys_for_trans [iff]:\n \"{m2_inv2_keys_for \\ m2_inv1_keys} trans m2 {> m2_inv2_keys_for}\"\napply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv2_keys_forI) \n-- {* 1 subgoal, from fake *}\napply (auto simp add: keys_for_def ik0_def, erule fake.cases, fastforce+)\ndone\n\nlemma PO_m2_inv2_keys_for [iff]: \"reach m2 \\ m2_inv2_keys_for\"\nby (rule inv_rule_incr) (auto del: subsetI)\n\n\ntext {* Useful application of invariant. *}\n\nlemma m2_inv2_keys_for__extr_insert_key: (* OBSOLETE?! *)\n \"\\ R \\ dom (runs s); s \\ m2_inv2_keys_for \\\n \\ extr (insert (aKey (sesK (R$sk))) T) (chan s) \n = insert (aKey (sesK (R$sk))) (extr T (chan s))\"\nby (subgoal_tac \"sesK (R$sk) \\ keys_for (chan s)\") \n (auto)\n*)\n\nsubsubsection \\inv3a: Session key compromise\\\n(******************************************************************************)\n\ntext \\A L2 version of a session key comprise invariant. Roughly, it states\nthat adding a set of keys @{term KK} to the parameter \\T\\ of @{term extr} \ndoes not help the intruder to extract keys other than those in @{term KK} or\nextractable without adding @{term KK}.\n\\\n\ndefinition \n m2_inv3a_sesK_compr :: \"m2_state set\"\nwhere \n \"m2_inv3a_sesK_compr \\ {s. \\K KK.\n aKey K \\ extr (aKey`KK \\ ik0) (chan s) \\ (K \\ KK \\ aKey K \\ extr ik0 (chan s)) \n }\"\n\nlemmas m2_inv3a_sesK_comprI = \n m2_inv3a_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv3a_sesK_comprE [elim] = \n m2_inv3a_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv3a_sesK_comprD = \n m2_inv3a_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Additional lemma\\\nlemmas insert_commute_aKey = insert_commute [where x=\"aKey K\" for K] \n\nlemmas m2_inv3a_sesK_compr_simps = \n m2_inv3a_sesK_comprD\n m2_inv3a_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n m2_inv3a_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n insert_commute_aKey \\ \\to get the keys to the front\\\n\nlemma PO_m2_inv3a_sesK_compr_init [iff]:\n \"init m2 \\ m2_inv3a_sesK_compr\"\nby (auto simp add: m2_defs intro!: m2_inv3a_sesK_comprI)\n\nlemma PO_m2_inv3a_sesK_compr_trans [iff]:\n \"{m2_inv3a_sesK_compr} trans m2 {> m2_inv3a_sesK_compr}\"\nby (auto simp add: PO_hoare_defs m2_defs m2_inv3a_sesK_compr_simps intro!: m2_inv3a_sesK_comprI)\n\nlemma PO_m2_inv3a_sesK_compr [iff]: \"reach m2 \\ m2_inv3a_sesK_compr\"\nby (rule inv_rule_basic) (auto) \n\n\nsubsubsection \\inv3: Extracted session keys\\\n(******************************************************************************)\n\ntext \\inv3: Extracted non-leaked session keys were generated by the server \nfor at least one bad agent. This invariant is needed in the proof of the \nstrengthening of the authorization guards in steps 4 and 5 \n(e.g., @{term \"(Kab, A) \\ azC (runs s)\"} for the initiator's step4).\\\n\ndefinition \n m2_inv3_extrKey :: \"m2_state set\"\nwhere\n \"m2_inv3_extrKey \\ {s. \\K.\n aKey K \\ extr ik0 (chan s) \\ K \\ leak s \\ \\ \\was: \\K \\ corrKey \\\\\\\n (\\R A' B' Ts'. K = sesK (R$sk) \\\n runs s R = Some (Serv, [A', B'], [aNum Ts']) \\ \n (A' \\ bad \\ B' \\ bad))\n }\"\n\nlemmas m2_inv3_extrKeyI = \n m2_inv3_extrKey_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv3_extrKeyE [elim] = \n m2_inv3_extrKey_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv3_extrKeyD = \n m2_inv3_extrKey_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m2_inv3_extrKey_init [iff]:\n \"init m2 \\ m2_inv3_extrKey\"\nby (auto simp add: m2_defs ik0_def intro!: m2_inv3_extrKeyI)\n\nlemma PO_m2_inv3_extrKey_trans [iff]:\n \"{m2_inv3_extrKey \\ m2_inv3a_sesK_compr} \n trans m2 \n {> m2_inv3_extrKey}\"\nproof (simp add: m2_def m2_trans_def, safe)\n fix Rs A B Kab Ts\n show\n \"{m2_inv3_extrKey \\ m2_inv3a_sesK_compr} m2_step3 Rs A B Kab Ts {> m2_inv3_extrKey}\"\n apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv3_extrKeyI)\n apply (auto simp add: m2_inv3a_sesK_compr_simps \n dest!: m2_inv3_extrKeyD dest: dom_lemmas)\n done\nnext\n fix Ra A B Kab Ts\n show \n \"{m2_inv3_extrKey \\ m2_inv3a_sesK_compr} m2_step4 Ra A B Kab Ts {> m2_inv3_extrKey}\"\n apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv3_extrKeyI)\n apply (auto simp add: dest!: m2_inv3_extrKeyD dest: dom_lemmas) \n apply (auto intro!: exI)\n done\nnext \n fix Rb A B Kab Ts\n show \n \"{m2_inv3_extrKey \\ m2_inv3a_sesK_compr} m2_step5 Rb A B Kab Ts {> m2_inv3_extrKey}\"\n apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv3_extrKeyI)\n apply (auto dest!: m2_inv3_extrKeyD dest: dom_lemmas) \n apply (auto intro!: exI)\n done\nnext \n fix Rs\n show\n \"{m2_inv3_extrKey \\ m2_inv3a_sesK_compr} m2_leak Rs {> m2_inv3_extrKey}\"\n apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv3_extrKeyI)\n apply (auto simp add: m2_inv3a_sesK_compr_simps)\n done\nqed (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv3_extrKeyI,\n auto dest!: m2_inv3_extrKeyD dest: dom_lemmas)\n\n\nlemma PO_m2_inv3_extrKey [iff]: \"reach m2 \\ m2_inv3_extrKey\"\nby (rule_tac J=\"m2_inv3a_sesK_compr\" in inv_rule_incr) (auto) \n\n\n\nsubsubsection \\inv4: Messages M2a/M2b for good agents and server state\\\n(******************************************************************************)\n\ntext \\inv4: Secure messages to honest agents and server state; one variant \nfor each of M2a and M2b. These invariants establish guard strengthening for\nserver authentication by the initiator and the responder.\\\n\ndefinition \n m2_inv4_M2a :: \"m2_state set\"\nwhere\n \"m2_inv4_M2a \\ {s. \\A B Kab Ts.\n Secure Sv A (Msg [aAgt B, aKey Kab, aNum Ts]) \\ chan s \\ A \\ good \\\n (\\Rs. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], [aNum Ts]))\n }\"\n\ndefinition \n m2_inv4_M2b :: \"m2_state set\"\nwhere\n \"m2_inv4_M2b \\ {s. \\A B Kab Ts.\n Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts]) \\ chan s \\ B \\ good \\\n (\\Rs. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], [aNum Ts]))\n }\"\n\nlemmas m2_inv4_M2aI = \n m2_inv4_M2a_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv4_M2aE [elim] = \n m2_inv4_M2a_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv4_M2aD = \n m2_inv4_M2a_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemmas m2_inv4_M2bI = m2_inv4_M2b_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv4_M2bE [elim] = \n m2_inv4_M2b_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv4_M2bD = \n m2_inv4_M2b_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proofs.\\\n\nlemma PO_m2_inv4_M2a_init [iff]:\n \"init m2 \\ m2_inv4_M2a\"\nby (auto simp add: m2_defs intro!: m2_inv4_M2aI)\n\nlemma PO_m2_inv4_M2a_trans [iff]:\n \"{m2_inv4_M2a} trans m2 {> m2_inv4_M2a}\"\napply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv4_M2aI)\napply (auto dest!: m2_inv4_M2aD dest: dom_lemmas)\n\\ \\3 subgoals\\\napply (force dest!: spec)+\ndone\n\nlemma PO_m2_inv4_M2a [iff]: \"reach m2 \\ m2_inv4_M2a\"\nby (rule inv_rule_basic) (auto)\n\n\nlemma PO_m2_inv4_M2b_init [iff]:\n \"init m2 \\ m2_inv4_M2b\"\nby (auto simp add: m2_defs intro!: m2_inv4_M2bI)\n\nlemma PO_m2_inv4_M2b_trans [iff]:\n \"{m2_inv4_M2b} trans m2 {> m2_inv4_M2b}\"\napply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv4_M2bI) \napply (auto dest!: m2_inv4_M2bD dest: dom_lemmas)\n\\ \\3 subgoals\\\napply (force dest!: spec)+\ndone\n\nlemma PO_m2_inv4_M2b [iff]: \"reach m2 \\ m2_inv4_M2b\"\nby (rule inv_rule_incr) (auto del: subsetI)\n\n\ntext \\Consequence needed in proof of inv8/step5 and inv9/step4: The \nsession key uniquely identifies other fields in M2a and M2b, provided it \nis secret.\\\n\nlemma m2_inv4_M2a_M2b_match:\n \"\\ Secure Sv A' (Msg [aAgt B', aKey Kab, aNum Ts']) \\ chan s; \n Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts]) \\ chan s; \n aKey Kab \\ extr ik0 (chan s); s \\ m2_inv4_M2a; s \\ m2_inv4_M2b \\\n \\ A = A' \\ B = B' \\ Ts = Ts'\"\napply (subgoal_tac \"A' \\ bad \\ B \\ bad\", auto)\napply (auto dest!: m2_inv4_M2aD m2_inv4_M2bD)\ndone\n\n\ntext \\More consequences of invariants. Needed in ref/step4 and ref/step5 \nrespectively to show the strengthening of the authorization guards.\\\n\nlemma m2_inv34_M2a_authorized:\n assumes \"Secure Sv A (Msg [aAgt B, aKey K, aNum T]) \\ chan s\" \n \"s \\ m2_inv3_extrKey\" \"s \\ m2_inv4_M2a\" \"K \\ leak s\" \n shows \"(K, A) \\ azC (runs s)\"\nproof (cases \"A \\ bad\")\n case True \n from assms(1) \\A \\ bad\\ have \"aKey K \\ extr ik0 (chan s)\" by auto\n with \\s \\ m2_inv3_extrKey\\ \\K \\ leak s\\ show ?thesis by auto \nnext\n case False \n with assms show ?thesis by (auto dest: m2_inv4_M2aD) \nqed\n\nlemma m2_inv34_M2b_authorized:\n assumes \"Secure Sv B (Msg [aKey K, aAgt A, aNum T]) \\ chan s\" \n \"s \\ m2_inv3_extrKey\" \"s \\ m2_inv4_M2b\" \"K \\ leak s\" \n shows \"(K, B) \\ azC (runs s)\"\nproof (cases \"B \\ bad\")\n case True \n from assms(1) \\B \\ bad\\ have \"aKey K \\ extr ik0 (chan s)\" by auto\n with \\s \\ m2_inv3_extrKey\\ \\K \\ leak s\\ show ?thesis by auto \nnext\n case False \n with assms show ?thesis by (auto dest: m2_inv4_M2bD) \nqed\n\n\nsubsubsection \\inv5: Key secrecy for server\\\n(******************************************************************************)\n\ntext \\inv5: Key secrecy from server perspective. This invariant links the \nabstract notion of key secrecy to the intruder key knowledge.\\\n\ndefinition \n m2_inv5_ikk_sv :: \"m2_state set\"\nwhere\n \"m2_inv5_ikk_sv \\ {s. \\R A B al.\n runs s R = Some (Serv, [A, B], al) \\ A \\ good \\ B \\ good \\\n aKey (sesK (R$sk)) \\ extr ik0 (chan s) \\\n sesK (R$sk) \\ leak s\n }\"\n\nlemmas m2_inv5_ikk_svI = \n m2_inv5_ikk_sv_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv5_ikk_svE [elim] = \n m2_inv5_ikk_sv_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv5_ikk_svD = \n m2_inv5_ikk_sv_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m2_inv5_ikk_sv_init [iff]:\n \"init m2 \\ m2_inv5_ikk_sv\"\nby (auto simp add: m2_defs intro!: m2_inv5_ikk_svI)\n\nlemma PO_m2_inv5_ikk_sv_trans [iff]:\n \"{m2_inv5_ikk_sv \\ m2_inv3a_sesK_compr \\ m2_inv3_extrKey} \n trans m2 \n {> m2_inv5_ikk_sv}\"\nby (simp add: PO_hoare_defs m2_defs, safe intro!: m2_inv5_ikk_svI)\n (auto simp add: m2_inv3a_sesK_compr_simps dest: dom_lemmas)\n\nlemma PO_m2_inv5_ikk_sv [iff]: \"reach m2 \\ m2_inv5_ikk_sv\"\nby (rule_tac J=\"m2_inv3_extrKey \\ m2_inv3a_sesK_compr\" in inv_rule_incr) (auto)\n\n\nsubsubsection \\inv6/7: Key secrecy for initiator and responder\\\n(******************************************************************************)\n\ntext \\These invariants are derivable.\\\n\ndefinition \n m2_inv6_ikk_init :: \"m2_state set\"\nwhere\n \"m2_inv6_ikk_init \\ {s. \\A B Ra K Ts nl.\n runs s Ra = Some (Init, [A, B], aKey K # aNum Ts # nl) \\ \n A \\ good \\ B \\ good \\ aKey K \\ extr ik0 (chan s) \\ \n K \\ leak s\n }\"\n\nlemmas m2_inv6_ikk_initI = m2_inv6_ikk_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv6_ikk_initE [elim] = m2_inv6_ikk_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv6_ikk_initD = m2_inv6_ikk_init_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ndefinition \n m2_inv7_ikk_resp :: \"m2_state set\"\nwhere\n \"m2_inv7_ikk_resp \\ {s. \\A B Rb K Ts nl.\n runs s Rb = Some (Resp, [A, B], aKey K # aNum Ts # nl) \\ \n A \\ good \\ B \\ good \\ aKey K \\ extr ik0 (chan s) \\\n K \\ leak s\n }\"\n\nlemmas m2_inv7_ikk_respI = m2_inv7_ikk_resp_def [THEN setc_def_to_intro, rule_format]\nlemmas m2_inv7_ikk_respE [elim] = m2_inv7_ikk_resp_def [THEN setc_def_to_elim, rule_format]\nlemmas m2_inv7_ikk_respD = m2_inv7_ikk_resp_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\ntext \\The simulation relation. This is a pure superposition refinement.\\\n\ndefinition\n R12 :: \"(m1_state \\ m2_state) set\" where\n \"R12 \\ {(s, t). runs s = runs t \\ leak s = leak t \\ clk s = clk t}\"\n\ntext \\The mediator function is the identity.\\\n\ndefinition \n med21 :: \"m2_obs \\ m1_obs\" where\n \"med21 = id\"\n\n\ntext \\Refinement proof.\\\n\nlemma PO_m2_step1_refines_m1_step1:\n \"{R12} \n (m1_step1 Ra A B), (m2_step1 Ra A B) \n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, auto)\n\nlemma PO_m2_step2_refines_m1_step2:\n \"{R12} \n (m1_step2 Rb A B), (m2_step2 Rb A B)\n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, auto)\n\nlemma PO_m2_step3_refines_m1_step3:\n \"{R12} \n (m1_step3 Rs A B Kab Ts), (m2_step3 Rs A B Kab Ts)\n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, auto)\n\nlemma PO_m2_step4_refines_m1_step4:\n \"{R12 \\ UNIV \\ (m2_inv4_M2a \\ m2_inv3_extrKey)} \n (m1_step4 Ra A B Kab Ts), (m2_step4 Ra A B Kab Ts) \n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, simp_all)\n (auto dest: m2_inv34_M2a_authorized)\n\nlemma PO_m2_step5_refines_m1_step5:\n \"{R12 \\ UNIV \\ (m2_inv4_M2b \\ m2_inv3_extrKey)} \\ \\REMOVED!: \\m2_inv5_ikk_sv\\\\\n (m1_step5 Rb A B Kab Ts), (m2_step5 Rb A B Kab Ts) \n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, simp_all)\n (auto dest: m2_inv34_M2b_authorized)\n\nlemma PO_m2_tick_refines_m1_tick:\n \"{R12}\n (m1_tick T), (m2_tick T)\n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, simp_all)\n\nlemma PO_m2_leak_refines_m1_leak:\n \"{R12} \n (m1_leak Rs), (m2_leak Rs)\n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, auto)\n\nlemma PO_m2_fake_refines_skip:\n \"{R12} \n Id, m2_fake\n {> R12}\"\nby (simp add: PO_rhoare_defs R12_def m2_defs, safe, auto)\n\n\ntext \\All together now...\\\n\nlemmas PO_m2_trans_refines_m1_trans = \n PO_m2_step1_refines_m1_step1 PO_m2_step2_refines_m1_step2\n PO_m2_step3_refines_m1_step3 PO_m2_step4_refines_m1_step4\n PO_m2_step5_refines_m1_step5 PO_m2_tick_refines_m1_tick \n PO_m2_leak_refines_m1_leak PO_m2_fake_refines_skip \n\nlemma PO_m2_refines_init_m1 [iff]:\n \"init m2 \\ R12``(init m1)\"\nby (auto simp add: R12_def m1_defs m2_loc_defs)\n\nlemma PO_m2_refines_trans_m1 [iff]:\n \"{R12 \\ \n UNIV \\ (m2_inv4_M2b \\ m2_inv4_M2a \\ m2_inv3_extrKey)} \n (trans m1), (trans m2) \n {> R12}\"\nby (auto simp add: m2_def m2_trans_def m1_def m1_trans_def)\n (blast intro!: PO_m2_trans_refines_m1_trans)+\n\n\nlemma PO_obs_consistent_R12 [iff]: \n \"obs_consistent R12 med21 m1 m2\"\nby (auto simp add: obs_consistent_def R12_def med21_def m2_defs)\n\n\ntext \\Refinement result.\\\n\nlemma m2_refines_m1 [iff]:\n \"refines \n (R12 \\ \n (UNIV \\ (m2_inv4_M2b \\ m2_inv4_M2a \\ m2_inv3_extrKey \\ m2_inv3a_sesK_compr)))\n med21 m1 m2\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m2_implements_m1 [iff]:\n \"implements med21 m1 m2\"\nby (rule refinement_soundness) (auto)\n\n\n(******************************************************************************)\nsubsection \\Inherited and derived invariants\\\n(******************************************************************************)\n(*\ntext {* Show preservation of invariants @{term \"m1_inv2i_serv\"} and\n@{term \"m1_inv2r_serv\"} from @{text \"m1\"}. *}\n\nlemma PO_m2_sat_m1_inv2i_serv [iff]: \"reach m2 \\ m1_inv2i_serv\"\nby (rule_tac Pa=m1_inv2i_serv and Qa=m1_inv2i_serv and Q=m1_inv2i_serv \n in m2_implements_m1 [THEN [5] internal_invariant_translation])\n (auto simp add: m2_loc_defs med21_def intro!: m1_inv2i_servI)\n\nlemma PO_m2_sat_m1_inv2r_serv [iff]: \"reach m2 \\ m1_inv2r_serv\"\nby (rule_tac Pa=m1_inv2r_serv and Qa=m1_inv2r_serv and Q=m1_inv2r_serv\n in m2_implements_m1 [THEN [5] internal_invariant_translation])\n (fastforce simp add: m2_loc_defs med21_def intro!: m1_inv2r_servI)+\n\n\ntext {* Now we derive the L2 key secrecy invariants for the initiator \nand the responder (for definition, see above). *}\n\nlemma PO_m2_inv6_init_ikk [iff]: \"reach m2 \\ m2_inv6_ikk_init\"\napply (rule_tac B=\" m1_inv2i_serv \\ m2_inv5_ikk_sv\" in subset_trans, auto)\napply (rule m2_inv6_ikk_initI, auto)\napply (blast dest!: m1_inv2i_servD) \ndone\n\nlemma PO_m2_inv6_resp_ikk [iff]: \"reach m2 \\ m2_inv7_ikk_resp\"\napply (rule_tac B=\" m1_inv2r_serv \\ m2_inv5_ikk_sv\" in subset_trans, auto)\napply (rule m2_inv7_ikk_respI, auto)\napply (blast dest!: m1_inv2r_servD) \ndone\n*)\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m2_ds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.29368188519411215}} {"text": "theory FunctionalImplementation\nimports Initialization SolveLoop\nbegin\n\n(******************************************************************************)\nsubsection{* Total correctness theorem *}\n(******************************************************************************)\n\ntheorem correctness:\nshows \n\"(solve F0 = TRUE \\ satisfiable F0) \\ (solve F0 = FALSE \\ \\ satisfiable F0)\"\nproof-\n let ?istate = \"initialize F0 initialState\"\n let ?F0' = \"filter (\\ c. \\ clauseTautology c) F0\"\n have\n \"InvariantConsistent (getM ?istate)\"\n \"InvariantUniq (getM ?istate)\"\n \"InvariantWatchesEl (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and \n \"InvariantWatchesDiffer (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and \n \"InvariantWatchCharacterization (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate) (getM ?istate)\" and \n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?istate) (getF ?istate)\" and\n \"InvariantWatchListsUniq (getWatchList ?istate)\" and\n \"InvariantWatchListsCharacterization (getWatchList ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and\n \"InvariantUniqQ (getQ ?istate)\" and\n \"InvariantQCharacterization (getConflictFlag ?istate) (getQ ?istate) (getF ?istate) (getM ?istate)\" and\n \"InvariantConflictFlagCharacterization (getConflictFlag ?istate) (getF ?istate) (getM ?istate)\" and\n \"InvariantNoDecisionsWhenConflict (getF ?istate) (getM ?istate) (currentLevel (getM ?istate))\" and\n \"InvariantNoDecisionsWhenUnit (getF ?istate) (getM ?istate) (currentLevel (getM ?istate))\" and\n \"InvariantGetReasonIsReason (getReason ?istate) (getF ?istate) (getM ?istate) (set (getQ ?istate))\" and\n \"InvariantConflictClauseCharacterization (getConflictFlag ?istate) (getConflictClause ?istate) (getF ?istate) (getM ?istate)\"\n \"InvariantVarsM (getM ?istate) F0 (vars F0)\"\n \"InvariantVarsQ (getQ ?istate) F0 (vars F0)\"\n \"InvariantVarsF (getF ?istate) F0 (vars F0)\"\n \"getSATFlag ?istate = UNDEF \\ InvariantEquivalentZL (getF ?istate) (getM ?istate) ?F0'\" and\n \"getSATFlag ?istate = FALSE \\ \\ satisfiable ?F0'\"\n \"getSATFlag ?istate = TRUE \\ satisfiable F0\"\n using assms\n using InvariantsAfterInitialization[of \"F0\"]\n using InvariantEquivalentZLAfterInitialization[of \"F0\"]\n unfolding InvariantVarsM_def\n unfolding InvariantVarsF_def\n unfolding InvariantVarsQ_def\n by (auto simp add: Let_def)\n moreover\n hence \"solve_loop_dom ?istate (vars F0)\"\n using SolveLoopTermination[of \"?istate\" \"?F0'\" \"vars F0\" \"F0\"]\n using finiteVarsFormula[of \"F0\"]\n using varsSubsetFormula[of \"?F0'\" \"F0\"]\n by auto\n ultimately\n show ?thesis\n using finiteVarsFormula[of \"F0\"]\n using SATFlagAfterSolveLoop[of \"?istate\" \"vars F0\" \"?F0'\" \"F0\"]\n using satisfiableFilterTautologies[of \"F0\"]\n unfolding solve_def\n using varsSubsetFormula[of \"?F0'\" \"F0\"]\n by (auto simp add: Let_def)\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/SATSolverVerification/FunctionalImplementation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2936222174100474}} {"text": "\nsection \"Algebraic laws for abrupt designs\"\ntheory algebraic_laws_fault\nimports algebraic_laws_fault_aux\n\nbegin\n(*TODO: add laws for assigns when composed with try catch...*)\nsubsection\"Simpset configuration\"\n\ndeclare urel_comp [uflt_comp]\ndeclare urel_cond [uflt_cond]\n\nsubsection\"Skip\"\n\ntext{*In this section we introduce the algebraic laws of programming related to the SKIP\n statement.*}\n\nlemma true_left_zero_skip_cpf_abr[uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; true) = (true)\"\n by rel_auto\n\nlemma true_lift_flt_right_zero_skip_flt[uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; \\true\\\\<^sub>F\\<^sub>L\\<^sub>T) = (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma false_lift_flt_right_zero[uflt_comp]:\n \"(P ;; \\false\\\\<^sub>F\\<^sub>L\\<^sub>T) = (\\false\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma skip_flt_left_unit_assigns_flt[uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; \\\\\\\\<^sub>F\\<^sub>L\\<^sub>T) = (\\\\\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma top_flt_right_zero_skip_flt[uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; \\\\<^sub>F\\<^sub>L\\<^sub>T) = (\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma ivar_left_zero_skip_flt[uflt_comp]: \n \"($x ;; SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = $x\" \n by rel_auto \n\nlemma top_flt_left_zero_skip_flt[uflt_comp]: \n \"(\\\\<^sub>F\\<^sub>L\\<^sub>T ;; SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (\\\\<^sub>F\\<^sub>L\\<^sub>T)\" \n by rel_auto\n\nlemma skip_flt_idem [uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = SKIP\\<^sub>F\\<^sub>L\\<^sub>T\"\n by rel_auto\n\nlemma skip_flt_alpha_eq:\n \"SKIP\\<^sub>F\\<^sub>L\\<^sub>T = Simpl\\<^sub>F\\<^sub>L\\<^sub>T (\\$fault\\ \\ ($\\\\<^sub>F\\<^sub>L\\<^sub>T\\ =\\<^sub>u $\\\\<^sub>F\\<^sub>L\\<^sub>T))\"\n by rel_auto\n\nlemma simpl_pre_skip_flt_post:\n \"(Simpl\\<^sub>F\\<^sub>L\\<^sub>T \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>< \\ SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (SKIP\\<^sub>F\\<^sub>L\\<^sub>T \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>>)\"\n by rel_auto \n\nlemma simpl_pre_skip_flt_var:\n fixes x :: \"(bool, ('b) cpf) uvar\"\n shows \"(Simpl\\<^sub>F\\<^sub>L\\<^sub>T $x \\ SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (SKIP\\<^sub>F\\<^sub>L\\<^sub>T \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T $x\\)\"\n by rel_auto\n\nlemma skip_flt_post_left_unit[uflt_comp]:\n \"(S \\ (SKIP\\<^sub>F\\<^sub>L\\<^sub>T;; Q)) = (S \\ Q)\"\n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma simpl_flt_post_left_unit[uflt_comp]:\n \"(S \\ (Simpl\\<^sub>F\\<^sub>L\\<^sub>T (\\$fault\\ \\ \\II\\\\<^sub>F\\<^sub>L\\<^sub>T);; Q)) = (S \\ Q)\"\n apply pred_simp \n apply rel_simp\n apply transfer\n apply auto\ndone\n\n\nsubsection {*Assignment Laws*}\ntext{*In this section we introduce the algebraic laws of programming related to the assignment\n statement.*}\n\n\nlemma design_post_seqr_assigns_flt_condr_fault_L6_left[urel_cond]:\n \"((S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; (P \\ $fault \\ Q))) \\ \\ $fault \\ R) = \n ((S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; Q)) \\ \\ $fault \\ R)\"\n unfolding assigns_flt_def \n apply pred_simp \n apply fastforce\ndone\n\nlemma design_post_seqr_assigns_flt_condr_not_fault_L6_left[urel_cond]:\n \"((S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; (P \\ \\ $fault \\ Q))) \\ $fault \\ R) = \n ((S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; Q)) \\ $fault \\ R)\"\n unfolding assigns_flt_def \n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma design_post_seqr_assigns_flt_condr_fault_L6_right[urel_cond]:\n \"(R \\ \\ $fault \\ (S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; (P \\ $fault \\ Q)))) = \n (R \\ \\ $fault \\ (S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; P)))\"\n unfolding assigns_flt_def \n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma design_post_seqr_assigns_flt_condr_not_fault_L6_right[urel_cond]:\n \"(R \\ $fault \\ (S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; (P \\ \\ $fault \\ Q)))) = \n (R \\ $fault \\ (S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; P)) )\"\n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma rcond_not_fault_subst_cancel_design_post_right[urel_cond]:\n \"R \\ \\ $fault \\ (S \\ (\\a\\\\<^sub>F\\<^sub>L\\<^sub>T;; P)) = \n R \\ \\ $fault \\ (S \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\II\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $fault\\) ;; P))\"\n apply pred_simp \n apply rel_simp\ndone\n\nlemma usubst_flt_cancel [usubst]: \n assumes 1:\"weak_lens v\" \n shows \"($v)\\\\expr\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>= \\expr\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub><\"\n using 1\n by rel_auto\n\nlemma usubst_flt_lift_cancel[usubst]: \n assumes 1:\"weak_lens v\" \n shows \"\\($v)\\\\expr\\\\<^sub>\\\\<^sub>F\\<^sub>L\\<^sub>T= \\expr\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub><\"\n using 1\n by rel_auto\n\nlemma assigns_flt_id [uflt_simpl]: \n \"SKIP\\<^sub>F\\<^sub>L\\<^sub>T = \\id\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (rel_auto)\n\nlemma assign_test[uflt_comp]:\n assumes 1:\"mwb_lens x\" \n shows \"(x \\ \\u\\ ;; x \\ \\v\\) = (x \\ \\v\\)\"\n using 1 \n by (simp add: usubst uflt_comp )\n\nlemma assign_flt_left_comp_subst[uflt_comp]: \n \"(x \\ u ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T(\\P\\\\<^sub>F\\<^sub>L\\<^sub>T \\ \\Q\\\\<^sub>F\\<^sub>L\\<^sub>T)) = Simpl\\<^sub>F\\<^sub>L\\<^sub>T(\\P\\\\u\\\\<^sub>\\\\<^sub>F\\<^sub>L\\<^sub>T \\ \\Q\\\\u\\\\<^sub>\\\\<^sub>F\\<^sub>L\\<^sub>T)\" \n by (simp add: uflt_comp usubst)\n\nlemma assign_flt_twice[uflt_comp]: \n assumes \"mwb_lens x\" and \"x \\ f\" \n shows \"(x \\ e ;; x \\ f) = (x \\ f)\" \n using assms\n by (simp add: uflt_comp usubst)\n \nlemma assign_flt_commute:\n assumes \"x \\ y\" \"x \\ f\" \"y \\ e\"\n shows \"(x \\ e ;; y \\ f) = (y \\ f ;; x \\ e)\"\n using assms\n by (simp add: uflt_comp usubst usubst_upd_comm)\n\nlemma assign_flt_cond_flt[uflt_comp]: (*needs more laws to be automatic*)\n fixes x :: \"('a, '\\) uvar\"\n shows \"(x \\ e ;; (bif b then Simpl\\<^sub>F\\<^sub>L\\<^sub>T P else Simpl\\<^sub>F\\<^sub>L\\<^sub>T Q eif)) = \n (bif (b\\e/x\\) then (x \\ e ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) else (x \\ e ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T Q) eif)\"\n apply (simp add: usubst uflt_comp)\n apply rel_auto\ndone\n\nlemma assign_flt_uop1[uflt_comp]: \n assumes 1: \"mwb_lens v\"\n shows \"(v \\ e1 ;; v \\ (uop F (&v))) = (v \\ (uop F e1))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_bop1[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v \\ e1 ;; v \\(bop bp (&v) e2)) = (v \\ (bop bp e1 e2))\"\n by (simp add: usubst uflt_comp assms)\n \nlemma assign_flt_bop2[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v \\ e1 ;; v \\ (bop bp e2 (&v))) = (v \\ (bop bp e2 e1))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_trop1[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp (&v) e2 e3)) = \n (v \\ (trop tp e1 e2 e3))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_trop2[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp e2 (&v) e3)) = \n (v \\ (trop tp e2 e1 e3))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_trop3[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp e2 e3 (&v))) = \n (v \\ (trop tp e2 e3 e1))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_qtop1[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp (&v) e2 e3 e4)) = \n (v \\ (qtop tp e1 e2 e3 e4))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_qtop2[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 (&v) e3 e4)) = \n (v \\ (qtop tp e2 e1 e3 e4))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_qtop3[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 e3 (&v) e4)) = \n (v \\ (qtop tp e2 e3 e1 e4))\"\n by (simp add: usubst uflt_comp assms)\n\nlemma assign_flt_qtop4[uflt_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 e3 e4 (&v))) = \n (v \\ (qtop tp e2 e3 e4 e1))\"\n by (simp add: usubst uflt_comp assms)\n \ntext {*In the sequel we define assignment laws proposed by Hoare*}\n\nlemma assign_flt_vwb_skip_flt[uflt_comp]:\n assumes 1: \"vwb_lens v\"\n shows \"(v \\ &v) = SKIP\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (simp add: assms usubst uflt_simpl)\n\nlemma assign_flt_simultaneous:\n assumes 1: \"vwb_lens var2\"\n and 2: \"var1 \\ var2\"\n shows \"var1, var2 \\ exp, &var2 = var1 \\ exp\"\n by (simp add: assms usubst_upd_comm usubst)\n\nlemma assign_flt_seq[uflt_comp]:\n assumes 1: \"vwb_lens var2\"\n shows\"(var1 \\ exp);; (var2 \\ &var2) = (var1 \\ exp)\"\n by (simp add: assms usubst uflt_comp)\n\nlemma assign_flt_cond_flt_uop[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\"\n shows \"bif uop F exp then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif uop F (&v) then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_bop1[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\"\n shows \"bif bop bp exp exp2 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif bop bp (&v) exp2 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_bop2[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\"\n shows \"bif bop bp exp2 exp then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif bop bp exp2 (&v) then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_trop1[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp exp2 exp3 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif trop bp (&v) exp2 exp3 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_trop2[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp2 exp exp3 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif trop bp exp2 (&v) exp3 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_trop3[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp2 exp3 exp then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;;Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif trop bp exp2 exp3 (&v) then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_qtop1[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp exp2 exp3 exp4 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif qtop bp (&v) exp2 exp3 exp4 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_qtop2[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4:\"v \\ exp4\"\n shows \"bif qtop bp exp2 exp exp3 exp4 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif qtop bp exp2 (&v) exp3 exp4 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_qtop3[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp2 exp3 exp exp4 then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif qtop bp exp2 exp3 (&v) exp4 then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_qtop4[uflt_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp2 exp3 exp4 exp then (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1) else (v \\ exp ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2) eif = \n v \\ exp ;; bif qtop bp exp2 exp3 exp4 (&v) then Simpl\\<^sub>F\\<^sub>L\\<^sub>T C1 else Simpl\\<^sub>F\\<^sub>L\\<^sub>T C2 eif\"\n apply (simp add: assms usubst uflt_comp uflt_simpl)\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_flt_cond_If [uflt_cond]: \n \"(bif bexp then (v \\ exp1) else (v \\ exp2) eif) = \n (v \\ (exp1 \\ bexp \\ exp2))\" \n by rel_auto\n\nsubsection {*While laws*}\ntext{*In this section we introduce the algebraic laws of programming related to the while\n statement.*}\n\ntheorem while_unfold:\n \"while b do P od = (bif b then (P ;; while b do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\nproof -\n have m:\"mono (\\X. bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (auto intro: monoI seqr_mono if_mono)\n have \"(while b do P od) = (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (simp add: While_def)\n also have \"... = (bif b then (P ;; (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (subst lfp_unfold,simp_all add:m )\n also have \"... = (bif b then (P ;; while b do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (simp add: While_def)\n finally show ?thesis .\nqed\n\n\n(*lemma while_true:\n shows \"(while true do P od) = \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (simp add: While_def alpha)\n apply (rule antisym)\n apply (simp_all)\n apply (rule conjI)\n apply (rule lfp_lowerbound)\n apply (simp add: C3_abr_def design_def cond_def)\n apply rel_auto\n apply (frule cond_mono)\ndone*)\n\nlemma while_false:\n shows \"(while false do P od) = SKIP\\<^sub>F\\<^sub>L\\<^sub>T\"\nproof -\n have \"(while false do P od) = bif false then (P ;; while false do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif\" \n using while_unfold[of _ P] by simp\n also have \"... = SKIP\\<^sub>F\\<^sub>L\\<^sub>T\" by rel_blast\n finally show ?thesis . \nqed\n\nlemma while_inv_unfold:\n \"while b invr p do P od = (bif b then (P ;; while b invr p do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n unfolding While_inv_def using while_unfold\n by auto\n\ntheorem while_bot_unfold:\n \"while\\<^sub>\\ b do P od = (bif b then (P ;; while\\<^sub>\\ b do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\nproof -\n have m:\"mono (\\X. bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (auto intro: monoI seqr_mono if_mono)\n have \"(while\\<^sub>\\ b do P od) = (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (simp add: While_bot_def)\n also have \"... = (bif b then (P ;; (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (subst gfp_unfold, simp_all add: m)\n also have \"... = (bif b then (P ;; while\\<^sub>\\ b do P od) else SKIP\\<^sub>F\\<^sub>L\\<^sub>T eif)\"\n by (simp add: While_bot_def)\n finally show ?thesis .\nqed\n\ntheorem while_bot_false: \"while\\<^sub>\\ false do P od = SKIP\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (simp add: While_bot_def mu_const alpha)\n\ntheorem while_bot_true: \"while\\<^sub>\\ true do P od = (\\ X \\ (P ;; X))\"\n by (simp add: While_bot_def alpha)\n\nsubsection {*assume laws*}\n\nlemma assume_twice[uflt_comp]: \"(b\\<^sup>\\\\<^sup>C ;; c\\<^sup>\\\\<^sup>C) = (b \\ c)\\<^sup>\\\\<^sup>C\"\n apply pred_simp \n apply auto\n apply (rel_simp)+\n apply blast\n apply (rel_simp)+\n apply (metis (full_types))\ndone\n\nlemma assert_twice[uflt_comp]: \"(b\\<^sub>\\\\<^sub>C ;; c\\<^sub>\\\\<^sub>C) = (b \\ c)\\<^sub>\\\\<^sub>C\" \n apply pred_simp \n apply auto\n apply (rel_simp)+\n apply blast\n apply (rel_simp)+\n apply (metis (full_types))\ndone\n\nsubsection {*Try Catch laws*}\n(*see utp_hoare_helper*)\n\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/AlgebraicLaws/Fault/algebraic_laws_fault.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301064, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2935607743132893}} {"text": "section \\ Procedures \\\n\ntheory ITree_Procedure\n imports ITree_Circus ITree_Hoare\n keywords \"over\"\nbegin\n\ndatatype (discs_sels) ('inp, 'outp) methop = Call_C 'inp | Return_C 'outp\n\ndefinition [lens_defs]: \"Call = ctor_prism Call_C is_Call_C un_Call_C\"\ndefinition [lens_defs]: \"Return = ctor_prism Return_C (Not \\ is_Call_C) un_Return_C\"\n\nrecord ('val, 'st) valst =\n vval :: 'val\n vst :: 'st\n\ntype_synonym ('e, 'inp, 'outp, 'st) \"procedure\" = \"('e, ('inp, 'st) valst, ('outp, 'st) valst) ktree\"\n\ntranslations\n (type) \"('e, 'inp, 'outp, 'st) procedure\" <= (type) \"('inp, 'st) valst \\ ('e, ('outp, 'st') valst) itree\" \n\ndefinition procproc :: \"(_, 'inp, 'outp, 'st::default) procedure \\ ('inp, 'outp) methop process\" where\n\"procproc P = process [\\] (\\ s. inp Call \\ (\\ inp. P \\ vval = inp, vst = s \\ \\ (\\ vst. outp Return (vval vst) \\ Ret)))\"\n\ndefinition promote_proc :: \"('e, 'inp, 'outp, 'ls) procedure \\ ('i \\ ('ls \\ 's)) \\ ('e, 'i \\ 'inp, 'outp, 's) procedure\" where\n\"promote_proc P a = (\\ v. P \\ vval = snd (vval v), vst = get\\<^bsub>a (fst (vval v))\\<^esub> (vst v) \\ \\ (\\ v'. Ret \\ vval = vval v', vst = put\\<^bsub>a (fst (vval v))\\<^esub> (vst v) (vst v')\\))\"\n\nlemma Call_wb_prism [simp, code_unfold]: \"wb_prism Call\" by (unfold_locales, auto simp add: lens_defs)\nlemma Return_wb_prism [simp, code_unfold]: \"wb_prism Return\" by (unfold_locales, auto simp add: lens_defs)\n\ndefinition \"proc_ret e = (\\ s. Ret \\ vval = e s, vst = s \\)\"\n\ndefinition \"procedure\" :: \"('inp \\ 'st \\ ('e, ('outp, 'st) valst) itree) \\ ('e, 'inp, 'outp, 'st) procedure\" where\n\"procedure P = (\\ vs. P (vval vs) (vst vs))\"\n\ndefinition proc_call :: \"('o \\ 's) \\ ('e, 'i, 'o, 'ls::default) procedure \\ ('i, 's) expr \\ ('e, 's) htree\" \n where \"proc_call x P e = (\\ s. P \\ vval = e s, vst = default \\ \\ (\\ vs. Ret (put\\<^bsub>x\\<^esub> s (vval vs))))\"\n\ndefinition exec_proc :: \"(unit, 'inp, 'out, 'st::default) procedure \\ 'inp \\ (unit, 'out) itree\" where\n\"exec_proc P i = P \\ vval = i, vst = default \\ \\ (\\ x. Ret (vval x))\"\n\nsyntax \n \"_procedure\" :: \"pttrn \\ logic \\ logic\" (\"proc _./ _\" [0, 20] 20)\n \"_call\" :: \"svid \\ logic \\ logic \\ logic\" (\"_ := call _ _\" [61, 0, 61] 61)\n \"_return\" :: \"logic \\ logic\" (\"return\")\n\ntranslations \n \"_procedure x P\" == \"CONST procedure (\\ x. P)\"\n \"_return e\" == \"CONST proc_ret (e)\\<^sub>e\"\n \"_call x P e\" == \"CONST proc_call x P (e)\\<^sub>e\"\n\nML_file \\ITree_Procedure.ML\\\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/UTP/ITree_Procedure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525098, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.29356076685369104}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n*)\n\nheader {* \\isaheader{Determinism Proof} *}\n\ntheory Determinism\nimports TypeSafe\nbegin\n\nsection{* Some lemmas *}\n\nlemma maps_nth:\n \"\\(E(xs [\\] ys)) x = Some y; length xs = length ys; distinct xs\\ \n \\ \\i. x = xs!i \\ i < length xs \\ y = ys!i\"\nproof (induct xs arbitrary: ys E)\n case Nil thus ?case by simp\nnext\n case (Cons x' xs')\n have map:\"(E(x' # xs' [\\] ys)) x = Some y\"\n and length:\"length (x'#xs') = length ys\"\n and dist:\"distinct (x'#xs')\"\n and IH:\"\\ys E. \\(E(xs' [\\] ys)) x = Some y; length xs' = length ys; \n distinct xs'\\ \n \\ \\i. x = xs'!i \\ i < length xs' \\ y = ys!i\" by fact+\n from length obtain y' ys' where ys:\"ys = y'#ys'\" by(cases ys) auto\n { fix i assume x:\"x = (x'#xs')!i\" and i:\"i < length(x'#xs')\"\n have \"y = ys!i\"\n proof(cases i)\n case 0 with x map ys dist show ?thesis by simp\n next\n case (Suc n)\n with x i have x':\"x = xs'!n\" and n:\"n < length xs'\" by simp_all\n from map ys have map':\"(E(x' \\ y')(xs' [\\] ys')) x = Some y\" by simp\n from length ys have length':\"length xs' = length ys'\" by simp\n from dist have dist':\"distinct xs'\" by simp\n from IH[OF map' length' dist'] \n have \"\\i. x = xs'!i \\ i < length xs' \\ y = ys'!i\" .\n with x' n have \"y = ys'!n\" by simp\n with ys n Suc show ?thesis by simp\n qed }\n thus ?case by simp\nqed\n\n\nlemma nth_maps:\"\\length pns = length Ts; distinct pns; i < length Ts\\ \n \\ (E(pns [\\] Ts)) (pns!i) = Some (Ts!i)\"\nproof (induct i arbitrary: E pns Ts)\n case 0\n have dist:\"distinct pns\" and length:\"length pns = length Ts\"\n and i_length:\"0 < length Ts\" by fact+\n from i_length obtain T' Ts' where Ts:\"Ts = T'#Ts'\" by(cases Ts) auto\n with length obtain p' pns' where \"pns = p'#pns'\" by(cases pns) auto\n with Ts dist show ?case by simp\nnext\n case (Suc n)\n have i_length:\"Suc n < length Ts\" and dist:\"distinct pns\"\n and length:\"length pns = length Ts\" by fact+\n from Suc obtain T' Ts' where Ts:\"Ts = T'#Ts'\" by(cases Ts) auto\n with length obtain p' pns' where pns:\"pns = p'#pns'\" by(cases pns) auto\n with Ts length dist have length':\"length pns' = length Ts'\" \n and dist':\"distinct pns'\" and notin:\"p' \\ set pns'\" by simp_all\n from i_length Ts have n_length:\"n < length Ts'\" by simp\n with length' dist' have map:\"(E(p' \\ T')(pns' [\\] Ts')) (pns'!n) = Some(Ts'!n)\" by fact\n with notin have \"(E(p' \\ T')(pns' [\\] Ts')) p' = Some T'\" by simp\n with pns Ts map show ?case by simp\nqed\n\nlemma casts_casts_eq_result:\n fixes s :: state\n assumes casts:\"P \\ T casts v to v'\" and casts':\"P \\ T casts v to w'\" \n and type:\"is_type P T\" and wte:\"P,E \\ e :: T'\" and leq:\"P \\ T' \\ T\"\n and eval:\"P,E \\ \\e,s\\ \\ \\Val v,(h,l)\\\" and sconf:\"P,E \\ s \\\"\n and wf:\"wf_C_prog P\"\n shows \"v' = w'\"\nproof(cases \"\\C. T \\ Class C\")\n case True\n with casts casts' show ?thesis\n by(auto elim:casts_to.cases)\nnext\n case False\n then obtain C where T:\"T = Class C\" by auto\n with type have \"is_class P C\" by simp\n with wf T leq have \"T' = NT \\ (\\D. T' = Class D \\ P \\ Path D to C unique)\"\n by(simp add:widen_Class)\n thus ?thesis\n proof(rule disjE)\n assume \"T' = NT\"\n with wf eval sconf wte have \"v = Null\"\n by(fastforce dest:eval_preserves_type)\n with casts casts' show ?thesis by(fastforce elim:casts_to.cases)\n next\n assume \"\\D. T' = Class D \\ P \\ Path D to C unique\"\n then obtain D where T':\"T' = Class D\" \n and path_unique:\"P \\ Path D to C unique\" by auto\n with wf eval sconf wte\n have \"P,E,h \\ Val v : T' \\ P,E,h \\ Val v : NT\"\n by(fastforce dest:eval_preserves_type)\n thus ?thesis\n proof(rule disjE)\n assume \"P,E,h \\ Val v : T'\"\n with T' obtain a Cs C' S where h:\"h a = Some(C',S)\" and v:\"v = Ref(a,Cs)\"\n and last:\"last Cs = D\"\n by(fastforce dest:typeof_Class_Subo)\n from casts' v last T obtain Cs' Ds where \"P \\ Path D to C via Cs'\"\n and \"Ds = Cs@\\<^sub>pCs'\" and \"w' = Ref(a,Ds)\"\n by(auto elim:casts_to.cases)\n with casts T v last path_unique show ?thesis\n by auto(erule casts_to.cases,auto simp:path_via_def path_unique_def)\n next\n assume \"P,E,h \\ Val v : NT\"\n with wf eval sconf wte have \"v = Null\"\n by(fastforce dest:eval_preserves_type)\n with casts casts' show ?thesis by(fastforce elim:casts_to.cases)\n qed\n qed\nqed\n\nlemma Casts_Casts_eq_result:\n assumes wf:\"wf_C_prog P\"\n shows \"\\P \\ Ts Casts vs to vs'; P \\ Ts Casts vs to ws'; \\T \\ set Ts. is_type P T;\n P,E \\ es [::] Ts'; P \\ Ts' [\\] Ts; P,E \\ \\es,s\\ [\\] \\map Val vs,(h,l)\\;\n P,E \\ s \\\\\n \\ vs' = ws'\"\nproof (induct vs arbitrary: vs' ws' Ts Ts' es s)\n case Nil thus ?case by (auto elim!:Casts_to.cases)\nnext\n case (Cons x xs)\n have CastsCons:\"P \\ Ts Casts x # xs to vs'\" \n and CastsCons':\"P \\ Ts Casts x # xs to ws'\"\n and type:\"\\T \\ set Ts. is_type P T\" \n and wtes:\"P,E \\ es [::] Ts'\" and subs:\"P \\ Ts' [\\] Ts\"\n and evals:\"P,E \\ \\es,s\\ [\\] \\map Val (x#xs),(h,l)\\\"\n and sconf:\"P,E \\ s \\\"\n and IH:\"\\vs' ws' Ts Ts' es s. \n \\P \\ Ts Casts xs to vs'; P \\ Ts Casts xs to ws'; \\T \\ set Ts. is_type P T; \n P,E \\ es [::] Ts'; P \\ Ts' [\\] Ts; P,E \\ \\es,s\\ [\\] \\map Val xs,(h,l)\\;\n P,E \\ s \\\\ \n \\ vs' = ws'\" by fact+\n from CastsCons obtain y ys S Ss where vs':\"vs' = y#ys\" and Ts:\"Ts = S#Ss\"\n apply -\n apply(frule length_Casts_vs,cases Ts,auto)\n apply(frule length_Casts_vs',cases vs',auto)\n done\n with CastsCons have casts:\"P \\ S casts x to y\" and Casts:\"P \\ Ss Casts xs to ys\"\n by(auto elim:Casts_to.cases)\n from Ts type have type':\"is_type P S\" and types':\"\\T \\ set Ss. is_type P T\"\n by auto\n from Ts CastsCons' obtain z zs where ws':\"ws' = z#zs\"\n by simp(frule length_Casts_vs',cases ws',auto)\n with Ts CastsCons' have casts':\"P \\ S casts x to z\" \n and Casts':\"P \\ Ss Casts xs to zs\"\n by(auto elim:Casts_to.cases)\n from Ts subs obtain U Us where Ts':\"Ts' = U#Us\" and subs':\"P \\ Us [\\] Ss\"\n and sub:\"P \\ U \\ S\" by(cases Ts',auto simp:fun_of_def)\n from wtes Ts' obtain e' es' where es:\"es = e'#es'\" and wte':\"P,E \\ e' :: U\"\n and wtes':\"P,E \\ es' [::] Us\" by(cases es) auto\n with evals obtain h' l' where eval:\"P,E \\ \\e',s\\ \\ \\Val x,(h',l')\\\"\n and evals':\"P,E \\ \\es',(h',l')\\ [\\] \\map Val xs,(h,l)\\\"\n by (auto elim:evals.cases)\n from wf eval wte' sconf have \"P,E \\ (h',l') \\\" by(rule eval_preserves_sconf)\n from IH[OF Casts Casts' types' wtes' subs' evals' this] have eq:\"ys = zs\" .\n from casts casts' type' wte' sub eval sconf wf have \"y = z\"\n by(rule casts_casts_eq_result)\n with eq vs' ws' show ?case by simp\nqed\n\n\n\nlemma Casts_conf: assumes wf: \"wf_C_prog P\"\n shows \"P \\ Ts Casts vs to vs' \\ \n (\\es s Ts'. \\ P,E \\ es [::] Ts'; P,E \\ \\es,s\\ [\\] \\map Val vs,(h,l)\\; P,E \\ s \\;\n P \\ Ts' [\\] Ts\\ \\ \n \\i < length Ts. P,h \\ vs'!i :\\ Ts!i)\"\nproof(induct rule:Casts_to.induct)\n case Casts_Nil thus ?case by simp\nnext\n case (Casts_Cons T v v' Ts vs vs')\n have casts:\"P \\ T casts v to v'\" and wtes:\"P,E \\ es [::] Ts'\" \n and evals:\"P,E \\ \\es,s\\ [\\] \\map Val (v#vs),(h,l)\\\"\n and subs:\"P \\ Ts' [\\] (T#Ts)\" and sconf:\"P,E \\ s \\\"\n and IH:\"\\es s Ts'.\\P,E \\ es [::] Ts'; P,E \\ \\es,s\\ [\\] \\map Val vs,(h,l)\\; \n P,E \\ s \\; P \\ Ts' [\\] Ts\\\n \\ \\i vs' ! i :\\ Ts ! i\" by fact+\n from subs obtain U Us where Ts':\"Ts' = U#Us\" by(cases Ts') auto\n with subs have sub':\"P \\ U \\ T\" and subs':\"P \\ Us [\\] Ts\" \n by (simp_all add:fun_of_def)\n from wtes Ts' obtain e' es' where es:\"es = e'#es'\" by(cases es) auto\n with Ts' wtes have wte':\"P,E \\ e' :: U\" and wtes':\"P,E \\ es' [::] Us\" by auto\n from es evals obtain s' where eval':\"P,E \\ \\e',s\\ \\ \\Val v,s'\\\"\n and evals':\"P,E \\ \\es',s'\\ [\\] \\map Val vs,(h,l)\\\" \n by(auto elim:evals.cases)\n from wf eval' wte' sconf have sconf':\"P,E \\ s' \\\" by(rule eval_preserves_sconf)\n from evals' have hext:\"hp s' \\ h\" by(cases s',auto intro:evals_hext)\n from wf eval' sconf wte' have \"P,E,(hp s') \\ Val v :\\<^bsub>NT\\<^esub> U\"\n by(rule eval_preserves_type)\n with hext have wtrt:\"P,E,h \\ Val v :\\<^bsub>NT\\<^esub> U\"\n by(cases U,auto intro:hext_typeof_mono)\n from casts wtrt sub' have \"P,h \\ v' :\\ T\"\n proof(induct rule:casts_to.induct)\n case (casts_prim T'' v'')\n have \"\\C. T'' \\ Class C\" and \"P,E,h \\ Val v'' :\\<^bsub>NT\\<^esub> U\" and \"P \\ U \\ T''\" by fact+\n thus ?case by(cases T'') auto\n next\n case (casts_null C) thus ?case by simp\n next\n case (casts_ref Cs C Cs' Ds a)\n have path:\"P \\ Path last Cs to C via Cs'\"\n and Ds:\"Ds = Cs @\\<^sub>p Cs'\"\n and wtref:\"P,E,h \\ ref (a, Cs) :\\<^bsub>NT\\<^esub> U\" by fact+\n from wtref obtain D S where subo:\"Subobjs P D Cs\" and h:\"h a = Some(D,S)\"\n by(cases U,auto split:split_if_asm)\n from path Ds have last:\"C = last Ds\" \n by(fastforce intro!:appendPath_last Subobjs_nonempty simp:path_via_def)\n from subo path Ds wf have \"Subobjs P D Ds\"\n by(fastforce intro:Subobjs_appendPath simp:path_via_def)\n with last h show ?case by simp\n qed\n with IH[OF wtes' evals' sconf' subs'] show ?case\n by(auto simp:nth_Cons,case_tac i,auto)\nqed\n\n\nlemma map_Val_throw_False:\"map Val vs = map Val ws @ throw ex # es \\ False\"\nproof (induct vs arbitrary: ws)\n case Nil thus ?case by simp\nnext\n case (Cons v' vs')\n have eq:\"map Val (v'#vs') = map Val ws @ throw ex # es\"\n and IH:\"\\ws'. map Val vs' = map Val ws' @ throw ex # es \\ False\" by fact+\n from eq obtain w' ws' where ws:\"ws = w'#ws'\" by(cases ws) auto\n from eq have \"tl(map Val (v'#vs')) = tl(map Val ws @ throw ex # es)\" by simp\n hence \"map Val vs' = tl(map Val ws @ throw ex # es)\" by simp\n with ws have \"map Val vs' = map Val ws' @ throw ex # es\" by simp\n from IH[OF this] show ?case .\nqed\n\nlemma map_Val_throw_eq:\"map Val vs @ throw ex # es = map Val ws @ throw ex' # es' \n \\ vs = ws \\ ex = ex' \\ es = es'\"\n apply(clarsimp simp:append_eq_append_conv2)\n apply(erule disjE)\n apply(case_tac us)\n apply(fastforce elim:map_injective simp:inj_on_def)\n apply(fastforce dest:map_Val_throw_False)\n apply(case_tac us)\n apply(fastforce elim:map_injective simp:inj_on_def)\n apply(fastforce dest:sym[THEN map_Val_throw_False])\n done\n\n\nsection {* The proof *}\n\nlemma deterministic_big_step:\nassumes wf:\"wf_C_prog P\"\nshows \"P,E \\ \\e,s\\ \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \n (\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s \\\\ \n \\ e\\<^sub>1 = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2)\"\n and \"P,E \\ \\es,s\\ [\\] \\es\\<^sub>1,s\\<^sub>1\\ \\ \n (\\es\\<^sub>2 s\\<^sub>2 Ts. \\P,E \\ \\es,s\\ [\\] \\es\\<^sub>2,s\\<^sub>2\\; P,E \\ es [::] Ts; P,E \\ s \\\\ \n \\ es\\<^sub>1 = es\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2)\"\nproof (induct rule:eval_evals.inducts)\n case New thus ?case by(auto elim: eval_cases)\nnext\n case NewFail thus ?case by(auto elim: eval_cases)\nnext\n case (StaticUpCast E e s\\<^sub>0 a Cs s\\<^sub>1 C Cs' Ds e\\<^sub>2 s\\<^sub>2)\n have eval:\"P,E \\ \\\\C\\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and path_via:\"P \\ Path last Cs to C via Cs'\" and Ds:\"Ds = Cs @\\<^sub>p Cs'\" \n and wt:\"P,E \\ \\C\\e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ ref (a,Cs) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where \"class\":\"is_class P C\" and wte:\"P,E \\ e :: Class D\"\n and disj:\"P \\ Path D to C unique \\ \n (P \\ C \\\\<^sup>* D \\ (\\Cs. P \\ Path C to D via Cs \\ Subobjs\\<^sub>R P C Cs))\"\n by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n and path_via':\"P \\ Path last Xs to C via Xs'\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@\\<^sub>pXs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte have last:\"last Cs = D\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n from disj show \"ref (a,Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\"\n proof (rule disjE)\n assume \"P \\ Path D to C unique\"\n with path_via path_via' eq last have \"Cs' = Xs'\"\n by(fastforce simp add:path_via_def path_unique_def)\n with eq ref Ds show ?thesis by simp\n next\n assume \"P \\ C \\\\<^sup>* D \\ (\\Cs. P \\ Path C to D via Cs \\ Subobjs\\<^sub>R P C Cs)\"\n with \"class\" wf obtain Cs'' where \"P \\ Path C to D via Cs''\"\n by(auto dest:leq_implies_path)\n with path_via path_via' wf eq last have \"Cs' = Xs'\"\n by(auto dest:path_via_reverse)\n with eq ref Ds show ?thesis by simp\n qed\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@[C])\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs@C#Xs' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last Cs = D\" and \"Subobjs P C' (Xs@C#Xs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence subo:\"Subobjs P C (C#Xs')\" by(fastforce intro:Subobjs_Subobjs)\n with eq last have leq:\"P \\ C \\\\<^sup>* D\" by(fastforce dest:Subobjs_subclass)\n from path_via last have \"P \\ D \\\\<^sup>* C\"\n by(auto dest:Subobjs_subclass simp:path_via_def)\n with leq wf have CeqD:\"C = D\" by(rule subcls_asym2)\n with last path_via wf have \"Cs' = [D]\" by(fastforce intro:path_via_C)\n with Ds last have Ds':\"Ds = Cs\" by(simp add:appendPath_def)\n from subo CeqD last eq wf have \"Xs' = []\" by(auto dest:mdc_eq_last)\n with eq Ds' ref show \"ref (a,Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"ref (a,Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\" and notin:\"C \\ set Xs\"\n and notleq:\"\\ P \\ last Xs \\\\<^sup>* C\" and throw:\"e\\<^sub>2 = THROW ClassCast\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte have last:\"last Cs = D\" and notempty:\"Cs \\ []\"\n by(auto dest!:eval_preserves_type Subobjs_nonempty split:split_if_asm)\n from disj have \"C = D\"\n proof(rule disjE)\n assume path_unique:\"P \\ Path D to C unique\"\n with last have \"P \\ D \\\\<^sup>* C\" \n by(fastforce dest:Subobjs_subclass simp:path_unique_def)\n with notleq last eq show ?thesis by simp\n next\n assume ass:\"P \\ C \\\\<^sup>* D \\ \n (\\Cs. P \\ Path C to D via Cs \\ Subobjs\\<^sub>R P C Cs)\"\n with \"class\" wf obtain Cs'' where path_via':\"P \\ Path C to D via Cs''\"\n by(auto dest:leq_implies_path)\n with path_via wf eq last have \"Cs'' = [D]\"\n by(fastforce dest:path_via_reverse)\n with ass path_via' have \"Subobjs\\<^sub>R P C [D]\" by simp\n thus ?thesis by(fastforce dest:hd_SubobjsR)\n qed\n with last notin eq notempty show \"ref (a,Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\"\n by(fastforce intro:last_in_set)\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"ref (a,Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticDownCast E e s\\<^sub>0 a Cs C Cs' s\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\\\C\\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\" \n and eval':\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a,Cs@[C]@Cs'),s\\<^sub>1\\\"\n and wt:\"P,E \\ \\C\\e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref(a,Cs@[C]@Cs') = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\"\n and disj:\"P \\ Path D to C unique \\ \n (P \\ C \\\\<^sup>* D \\ (\\Cs. P \\ Path C to D via Cs \\ Subobjs\\<^sub>R P C Cs))\"\n by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\" \n and path_via:\"P \\ Path last Xs to C via Xs'\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@\\<^sub>pXs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs@[C]@Cs' = Xs \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last(C#Cs') = D\" and \"Subobjs P C' (Cs@[C]@Cs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence \"P \\ Path C to D via C#Cs'\" \n by(fastforce intro:Subobjs_Subobjs simp:path_via_def)\n with eq last path_via wf have \"Xs' = [C] \\ Cs' = [] \\ C = D\"\n apply clarsimp\n apply(split split_if_asm)\n by(simp,drule path_via_reverse,simp,simp)+\n with ref eq show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by(fastforce simp:appendPath_def)\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@[C])\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs@[C]@Cs' = Xs@C#Xs' \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last(C#Xs') = D\" and subo:\"Subobjs P C' (Cs@[C]@Cs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n from subo wf have notin:\"C \\ set Cs\" by -(rule unique2,simp)\n from subo wf have \"C \\ set Cs'\" by -(rule unique1,simp,simp)\n with notin eq have \"Cs = Xs \\ Cs' = Xs'\"\n by -(rule only_one_append,simp+)\n with eq ref show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"ref (a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs a' \n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\" and notin:\"C \\ set Xs\"\n from IH[OF eval_ref wte sconf] have \"a = a' \\ Cs@[C]@Cs' = Xs \\ s\\<^sub>1 = s\\<^sub>2\" \n by simp\n with notin show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fastforce\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"ref (a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticCastNull E e s\\<^sub>0 s\\<^sub>1 C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\\\C\\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ \\C\\e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\" and \"e\\<^sub>2 = null\"\n with IH[OF eval_null wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs a' \n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticCastFail E e s\\<^sub>0 a Cs s\\<^sub>1 C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\\\C\\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and notleq:\"\\ P \\ last Cs \\\\<^sup>* C\" and notin:\"C \\ set Cs\"\n and wt:\"P,E \\ \\C\\e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ref (a, Cs) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n and path_via:\"P \\ Path last Xs to C via Xs'\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with path_via wf have \"P \\ last Cs \\\\<^sup>* C\" \n by(auto dest:Subobjs_subclass simp:path_via_def)\n with notleq show \"THROW ClassCast = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] have \"a = a' \\ Cs = Xs@C#Xs' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with notin show \"THROW ClassCast = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"THROW ClassCast = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs a' \n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\"\n and throw:\"e\\<^sub>2 = THROW ClassCast\"\n from IH[OF eval_ref wte sconf] have \"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with throw show \"THROW ClassCast = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"THROW ClassCast = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed \nnext\n case (StaticCastThrow E e s\\<^sub>0 e' s\\<^sub>1 C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\\\C\\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ \\C\\e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n from IH[OF eval_ref wte sconf] show \" throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e'' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e'',s\\<^sub>2\\\"\n and throw:\"e\\<^sub>2 = throw e''\"\n from IH[OF eval_throw wte sconf] throw show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticUpDynCast E e s\\<^sub>0 a Cs s\\<^sub>1 C Cs' Ds e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and path_via:\"P \\ Path last Cs to C via Cs'\" \n and path_unique:\"P \\ Path last Cs to C unique\"\n and Ds:\"Ds = Cs@\\<^sub>pCs'\" and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref(a,Cs) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n and path_via':\"P \\ Path last Xs to C via Xs'\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@\\<^sub>pXs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte have last:\"last Cs = D\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n with path_unique path_via path_via' eq have \"Xs' = Cs'\"\n by(fastforce simp:path_via_def path_unique_def)\n with eq Ds ref show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@[C])\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs@C#Xs' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last Cs = D\" and \"Subobjs P C' (Xs@C#Xs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence \"Subobjs P C (C#Xs')\" by(fastforce intro:Subobjs_Subobjs)\n with last eq have \"P \\ Path C to D via C#Xs'\" \n by(simp add:path_via_def)\n with path_via wf last have \"Xs' = [] \\ Cs' = [C] \\ C = D\" \n by(fastforce dest:path_via_reverse)\n with eq Ds ref show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by (simp add:appendPath_def)\n next\n fix Xs Xs' D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\"\n and h:\"h a' = Some(D',S)\" and path_via':\"P \\ Path D' to C via Xs'\"\n and path_unique':\"P \\ Path D' to C unique\" and s2:\"s\\<^sub>2 = (h,l)\"\n and ref:\"e\\<^sub>2 = ref(a',Xs')\"\n from IH[OF eval_ref wte sconf] s2 have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte h have \"last Cs = D\"\n and \"Subobjs P D' Cs\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n with path_via wf have \"P \\ Path D' to C via Cs@\\<^sub>pCs'\"\n by(fastforce intro:Subobjs_appendPath appendPath_last[THEN sym] \n dest:Subobjs_nonempty simp:path_via_def)\n with path_via' path_unique' Ds have \"Xs' = Ds\"\n by(fastforce simp:path_via_def path_unique_def)\n with eq ref show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\"\n and not_unique:\"\\ P \\ Path last Xs to C unique\" and s2:\"s\\<^sub>2 = (h,l)\"\n from IH[OF eval_ref wte sconf] s2 have eq:\"a = a' \\ Cs = Xs \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n with path_unique not_unique show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"ref (a, Ds) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticDownDynCast E e s\\<^sub>0 a Cs C Cs' s\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref(a,Cs@[C]@Cs') = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\" \n and path_via:\"P \\ Path last Xs to C via Xs'\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@\\<^sub>pXs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs@[C]@Cs' = Xs \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last(C#Cs') = D\" and \"Subobjs P C' (Cs@[C]@Cs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence \"P \\ Path C to D via C#Cs'\" \n by(fastforce intro:Subobjs_Subobjs simp:path_via_def)\n with eq last path_via wf have \"Xs' = [C] \\ Cs' = [] \\ C = D\"\n apply clarsimp\n apply(split split_if_asm)\n by(simp,drule path_via_reverse,simp,simp)+\n with ref eq show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by(fastforce simp:appendPath_def)\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@[C])\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs@[C]@Cs' = Xs@C#Xs' \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte obtain C' where \n last:\"last(C#Xs') = D\" and subo:\"Subobjs P C' (Cs@[C]@Cs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n from subo wf have notin:\"C \\ set Cs\" by -(rule unique2,simp)\n from subo wf have \"C \\ set Cs'\" by -(rule unique1,simp,simp)\n with notin eq have \"Cs = Xs \\ Cs' = Xs'\"\n by -(rule only_one_append,simp+)\n with eq ref show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\"\n and h:\"h a' = Some(D',S)\" and path_via:\"P \\ Path D' to C via Xs'\"\n and path_unique:\"P \\ Path D' to C unique\" and s2:\"s\\<^sub>2 = (h,l)\"\n and ref:\"e\\<^sub>2 = ref(a',Xs')\"\n from IH[OF eval_ref wte sconf] s2 have eq:\"a = a' \\ Cs@[C]@Cs' = Xs \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte h have \"Subobjs P D' (Cs@[C]@Cs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence \"Subobjs P D' (Cs@[C])\" by(fastforce intro:appendSubobj)\n with path_via path_unique have \"Xs' = Cs@[C]\" \n by(fastforce simp:path_via_def path_unique_def)\n with eq ref show \"ref(a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"ref (a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\"\n and notin:\"C \\ set Xs\" and s2:\"s\\<^sub>2 = (h,l)\"\n from IH[OF eval_ref wte sconf] s2 have \"a = a' \\ Cs@[C]@Cs' = Xs \\ s\\<^sub>1 = s\\<^sub>2\"\n by simp\n with notin show \"ref (a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fastforce\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"ref (a,Cs@[C]) = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (DynCast E e s\\<^sub>0 a Cs h l D S C Cs' e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and path_via:\"P \\ Path D to C via Cs'\" and path_unique:\"P \\ Path D to C unique\"\n and h:\"h a = Some(D,S)\" and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref(a,Cs) = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by fact+\n from wt obtain D' where wte:\"P,E \\ e :: Class D'\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\"\n and path_via':\"P \\ Path last Xs to C via Xs'\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@\\<^sub>pXs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ (h,l) = s\\<^sub>2\" by simp\n with wf eval_ref sconf wte h have \"last Cs = D'\"\n and \"Subobjs P D Cs\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n with path_via' wf eq have \"P \\ Path D to C via Xs@\\<^sub>pXs'\"\n by(fastforce intro:Subobjs_appendPath appendPath_last[THEN sym] \n dest:Subobjs_nonempty simp:path_via_def)\n with path_via path_unique have \"Cs' = Xs@\\<^sub>pXs'\"\n by(fastforce simp:path_via_def path_unique_def)\n with ref eq show \"ref(a,Cs') = e\\<^sub>2 \\ (h, l) = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n and ref:\"e\\<^sub>2 = ref (a',Xs@[C])\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs@C#Xs' \\ (h,l) = s\\<^sub>2\"\n by simp\n with wf eval_ref sconf wte h have \"Subobjs P D (Xs@[C]@Xs')\"\n by(auto dest:eval_preserves_type split:split_if_asm)\n hence \"Subobjs P D (Xs@[C])\" by(fastforce intro:appendSubobj)\n with path_via path_unique have \"Cs' = Xs@[C]\" \n by(fastforce simp:path_via_def path_unique_def)\n with eq ref show \"ref(a,Cs') = e\\<^sub>2 \\ (h, l) = s\\<^sub>2\" by simp\n next\n fix Xs Xs' D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n and h':\"h' a' = Some(D'',S')\" and path_via':\"P \\ Path D'' to C via Xs'\"\n and s2:\"s\\<^sub>2 = (h',l')\" and ref:\"e\\<^sub>2 = ref(a',Xs')\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ h = h' \\ l = l'\"\n by simp\n with h h' path_via path_via' path_unique s2 ref\n show \"ref(a,Cs') = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\"\n by(fastforce simp:path_via_def path_unique_def)\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"ref(a,Cs') = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix Xs D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n and h':\"h' a' = Some(D'',S')\" and not_unique:\"\\ P \\ Path D'' to C unique\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ h = h' \\ l = l'\"\n by simp\n with h h' path_unique not_unique show \"ref(a,Cs') = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"ref (a,Cs') = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n qed\nnext\n case (DynCastNull E e s\\<^sub>0 s\\<^sub>1 C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\"\n from IH[OF eval_ref wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\" and \"e\\<^sub>2 = null\"\n with IH[OF eval_null wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs D' S a' h l\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h,l)\\\" and s2:\"s\\<^sub>2 = (h,l)\"\n from IH[OF eval_ref wte sconf] s2 show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (DynCastFail E e s\\<^sub>0 a Cs h l D S C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and h:\"h a = Some(D,S)\" and not_unique1:\"\\ P \\ Path D to C unique\"\n and not_unique2:\"\\ P \\ Path last Cs to C unique\" and notin:\"C \\ set Cs\"\n and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref (a, Cs) = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by fact+\n from wt obtain D' where wte:\"P,E \\ e :: Class D'\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\<^sub>2\\\"\n and path_unique:\"P \\ Path last Xs to C unique\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs \\ (h,l) = s\\<^sub>2\" by simp\n with path_unique not_unique2 show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] have eq:\"a = a' \\ Cs = Xs@C#Xs' \\ (h,l) = s\\<^sub>2\"\n by simp\n with notin show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by fastforce\n next\n fix Xs Xs' D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n and h':\"h' a' = Some(D'',S')\" and path_unique:\"P \\ Path D'' to C unique\"\n from IH[OF eval_ref wte sconf] have \"a = a' \\ Cs = Xs \\ h = h' \\ l = l'\"\n by simp\n with h h' not_unique1 path_unique show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix Xs D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n and null:\"e\\<^sub>2 = null\" and s2:\"s\\<^sub>2 = (h',l')\"\n from IH[OF eval_ref wte sconf] null s2 show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"null = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n qed\nnext\n case (DynCastThrow E e s\\<^sub>0 e' s\\<^sub>1 C e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Cast C e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ Cast C e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain D where wte:\"P,E \\ e :: Class D\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a',Xs),s\\<^sub>2\\\" \n from IH[OF eval_ref wte sconf] show \" throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' a'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs@C#Xs'),s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs Xs' D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix Xs D'' S' a' h' l'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),(h',l')\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e'' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e'',s\\<^sub>2\\\"\n and throw:\"e\\<^sub>2 = throw e''\"\n from IH[OF eval_throw wte sconf] throw show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case Val thus ?case by(auto elim: eval_cases)\nnext\n case (BinOp E e\\<^sub>1 s\\<^sub>0 v\\<^sub>1 s\\<^sub>1 e\\<^sub>2 v\\<^sub>2 s\\<^sub>2 bop v e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and binop:\"binop (bop, v\\<^sub>1, v\\<^sub>2) = Some v\"\n and wt:\"P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ Val v\\<^sub>1 = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\\n \\ Val v\\<^sub>2 = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain T\\<^sub>1 T\\<^sub>2 where wte1:\"P,E \\ e\\<^sub>1 :: T\\<^sub>1\" and wte2:\"P,E \\ e\\<^sub>2 :: T\\<^sub>2\"\n by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s w w\\<^sub>1 w\\<^sub>2\n assume eval_val1:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w\\<^sub>1,s\\\"\n and eval_val2:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w\\<^sub>2,s\\<^sub>2'\\\"\n and binop':\"binop(bop,w\\<^sub>1,w\\<^sub>2) = Some w\" and e2':\"e\\<^sub>2' = Val w\"\n from IH1[OF eval_val1 wte1 sconf] have w1:\"v\\<^sub>1 = w\\<^sub>1\" and s:\"s = s\\<^sub>1\" by simp_all\n with wf eval_val1 wte1 sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val2[simplified s] wte2 this] have \"v\\<^sub>2 = w\\<^sub>2\" and s2:\"s\\<^sub>2 = s\\<^sub>2'\"\n by simp_all\n with w1 binop binop' have \"w = v\" by simp\n with e2' s2 show \"Val v = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix e assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte1 sconf] show \"Val v = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix e s w \n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and eval_throw:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\throw e,s\\<^sub>2'\\\"\n from IH1[OF eval_val wte1 sconf] have s:\"s = s\\<^sub>1\" by simp_all\n with wf eval_val wte1 sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified s] wte2 this] show \"Val v = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n qed\nnext\n case (BinOpThrow1 E e\\<^sub>1 s\\<^sub>0 e s\\<^sub>1 bop e\\<^sub>2 e\\<^sub>2' s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2\\\"\n and wt:\"P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain T\\<^sub>1 T\\<^sub>2 where wte1:\"P,E \\ e\\<^sub>1 :: T\\<^sub>1\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s w w\\<^sub>1 w\\<^sub>2\n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w\\<^sub>1,s\\\"\n from IH[OF eval_val wte1 sconf] show \"throw e = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e' \n assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\" and throw:\"e\\<^sub>2' = throw e'\"\n from IH[OF eval_throw wte1 sconf] throw show \"throw e = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix e s w \n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte1 sconf] show \"throw e = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (BinOpThrow2 E e\\<^sub>1 s\\<^sub>0 v\\<^sub>1 s\\<^sub>1 e\\<^sub>2 e s\\<^sub>2 bop e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and wt:\"P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ Val v\\<^sub>1 = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\\n \\ throw e = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain T\\<^sub>1 T\\<^sub>2 where wte1:\"P,E \\ e\\<^sub>1 :: T\\<^sub>1\" and wte2:\"P,E \\ e\\<^sub>2 :: T\\<^sub>2\"\n by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s w w\\<^sub>1 w\\<^sub>2\n assume eval_val1:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w\\<^sub>1,s\\\"\n and eval_val2:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w\\<^sub>2,s\\<^sub>2'\\\"\n from IH1[OF eval_val1 wte1 sconf] have s:\"s = s\\<^sub>1\" by simp_all\n with wf eval_val1 wte1 sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val2[simplified s] wte2 this] show \"throw e = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n next\n fix e' \n assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte1 sconf] show \"throw e = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix e' s w \n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and eval_throw:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\throw e',s\\<^sub>2'\\\"\n and throw:\"e\\<^sub>2' = throw e'\"\n from IH1[OF eval_val wte1 sconf] have s:\"s = s\\<^sub>1\" by simp_all\n with wf eval_val wte1 sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified s] wte2 this] throw\n show \"throw e = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n qed\nnext\n case Var thus ?case by(auto elim: eval_cases) \nnext\n case (LAss E e s\\<^sub>0 v h l V T v' l' e\\<^sub>2 s\\<^sub>2 T')\n have eval:\"P,E \\ \\V:=e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and env:\"E V = Some T\" and casts:\"P \\ T casts v to v'\" and l':\"l' = l(V \\ v')\"\n and wt:\"P,E \\ V:=e :: T'\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ Val v = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by fact+\n from wt env obtain T'' where wte:\"P,E \\ e :: T''\" and leq:\"P \\ T'' \\ T\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix U h' l'' w w'\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,(h',l'')\\\" and env':\"E V = Some U\"\n and casts':\"P \\ U casts w to w'\" and e2:\"e\\<^sub>2 = Val w'\" \n and s2:\"s\\<^sub>2 = (h',l''(V \\ w'))\"\n from env env' have UeqT:\"U = T\" by simp\n from IH[OF eval_val wte sconf] have eq:\"v = w \\ h = h' \\ l = l''\" by simp\n from sconf env have \"is_type P T\"\n by(clarsimp simp:sconf_def envconf_def)\n with casts casts' eq UeqT wte leq eval_val sconf wf have \"v' = w'\"\n by(auto intro:casts_casts_eq_result)\n with e2 s2 l' eq show \"Val v' = e\\<^sub>2 \\ (h, l') = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"Val v' = e\\<^sub>2 \\ (h, l') = s\\<^sub>2\" by simp\n qed\nnext\n case (LAssThrow E e s\\<^sub>0 e' s\\<^sub>1 V e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\V:=e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ V:=e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain T'' where wte:\"P,E \\ e :: T''\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix U h' l'' w w'\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,(h',l'')\\\"\n from IH[OF eval_val wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (FAcc E e s\\<^sub>0 a Cs' h l D S Ds Cs fs F v e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\F{Cs},s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and eval':\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref (a, Cs'),(h,l)\\\"\n and h:\"h a = Some(D,S)\" and Ds:\"Ds = Cs'@\\<^sub>pCs\"\n and S:\"(Ds,fs) \\ S\" and fs:\"fs F = Some v\"\n and wt:\"P,E \\ e\\F{Cs} :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref (a, Cs') = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval_preserves_sconf[OF wf eval' wte sconf] h have oconf:\"P,h \\ (D,S) \\\"\n by(simp add:sconf_def hconf_def)\n from eval show ?case\n proof(rule eval_cases)\n fix Xs' D' S' a' fs' h' l' v'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs'),(h',l')\\\"\n and h':\"h' a' = Some(D',S')\" and S':\"(Xs'@\\<^sub>pCs,fs') \\ S'\"\n and fs':\"fs' F = Some v'\" and e2:\"e\\<^sub>2 = Val v'\" and s2:\"s\\<^sub>2 = (h',l')\"\n from IH[OF eval_ref wte sconf] h h'\n have eq:\"a = a' \\ Cs' = Xs' \\ h = h' \\ l = l' \\ D = D' \\ S = S'\" by simp\n with oconf S S' Ds have \"fs = fs'\" by (auto simp:oconf_def)\n with fs fs' have \"v = v'\" by simp\n with e2 s2 eq show \"Val v = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"Val v = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"Val v = e\\<^sub>2 \\ (h,l) = s\\<^sub>2\" by simp\n qed\nnext\n case (FAccNull E e s\\<^sub>0 s\\<^sub>1 F Cs e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\F{Cs},s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ e\\F{Cs} :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ null = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs' D' S' a' fs' h' l' v'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs'),(h',l')\\\"\n from IH[OF eval_ref wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH[OF eval_null wte sconf] e2 show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" \n by simp\n next\n fix e' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (FAccThrow E e s\\<^sub>0 e' s\\<^sub>1 F Cs e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\F{Cs},s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ e\\F{Cs} :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs' D' S' a' fs' h' l' v'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs'),(h',l')\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (FAss E e\\<^sub>1 s\\<^sub>0 a Cs' s\\<^sub>1 e\\<^sub>2 v h\\<^sub>2 l\\<^sub>2 D S F T Cs v' Ds fs fs' S' h\\<^sub>2' e\\<^sub>2' s\\<^sub>2 T')\n have eval:\"P,E \\ \\e\\<^sub>1\\F{Cs} := e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2\\\"\n and eval':\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ref(a,Cs'),s\\<^sub>1\\\"\n and eval'':\"P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2)\\\"\n and h2:\"h\\<^sub>2 a = Some(D, S)\"\n and has_least:\"P \\ last Cs' has least F:T via Cs\"\n and casts:\"P \\ T casts v to v'\" and Ds:\"Ds = Cs'@\\<^sub>pCs\"\n and S:\"(Ds, fs) \\ S\" and fs':\"fs' = fs(F \\ v')\"\n and S':\"S' = S - {(Ds, fs)} \\ {(Ds, fs')}\"\n and h2':\"h\\<^sub>2' = h\\<^sub>2(a \\ (D, S'))\"\n and wt:\"P,E \\ e\\<^sub>1\\F{Cs} := e\\<^sub>2 :: T'\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref(a,Cs') = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\\n \\ Val v = ei \\ (h\\<^sub>2,l\\<^sub>2) = si\" by fact+\n from wt obtain C T'' where wte1:\"P,E \\ e\\<^sub>1 :: Class C\" \n and has_least':\"P \\ C has least F:T' via Cs\"\n and wte2:\"P,E \\ e\\<^sub>2 :: T''\" and leq:\"P \\ T'' \\ T'\"\n by auto\n from wf eval' wte1 sconf have \"last Cs' = C\"\n by(auto dest!:eval_preserves_type split:split_if_asm)\n with has_least has_least' have TeqT':\"T = T'\" by (fastforce intro:sees_field_fun)\n from eval show ?case\n proof(rule eval_cases)\n fix Xs D' S'' U a' fs'' h l s w w'\n assume eval_ref:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and eval_val:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w,(h,l)\\\"\n and h:\"h a' = Some(D',S'')\"\n and has_least'':\"P \\ last Xs has least F:U via Cs\"\n and casts':\"P \\ U casts w to w'\"\n and S'':\"(Xs@\\<^sub>pCs,fs'') \\ S''\" and e2':\"e\\<^sub>2' = Val w'\"\n and s2:\"s\\<^sub>2 = (h(a'\\(D',insert (Xs@\\<^sub>pCs,fs''(F \\ w')) \n (S''-{(Xs@\\<^sub>pCs,fs'')}))),l)\"\n from IH1[OF eval_ref wte1 sconf] have eq:\"a = a' \\ Cs' = Xs \\ s\\<^sub>1 = s\" by simp\n with wf eval_ref wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF _ wte2 this] eval_val eq have eq':\"v = w \\ h = h\\<^sub>2 \\ l = l\\<^sub>2\" by auto\n from has_least'' eq has_least have UeqT:\"U = T\" by (fastforce intro:sees_field_fun)\n from has_least wf have \"is_type P T\" by(rule least_field_is_type)\n with casts casts' eq eq' UeqT TeqT' wte2 leq eval_val sconf' wf have v':\"v' = w'\"\n by(auto intro!:casts_casts_eq_result)\n from eval_preserves_sconf[OF wf eval'' wte2 sconf'] h2\n have oconf:\"P,h\\<^sub>2 \\ (D,S) \\\"\n by(simp add:sconf_def hconf_def)\n from eq eq' h2 h have \"S = S''\" by simp\n with oconf eq S S' S'' Ds have \"fs = fs''\" by (auto simp:oconf_def)\n with h2' h h2 eq eq' s2 S' Ds fs' v' e2' show \"Val v' = e\\<^sub>2' \\ (h\\<^sub>2',l\\<^sub>2) = s\\<^sub>2\"\n by simp\n next\n fix s w assume eval_null:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH1[OF eval_null wte1 sconf] show \"Val v' = e\\<^sub>2' \\ (h\\<^sub>2',l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n from IH1[OF eval_throw wte1 sconf] show \"Val v' = e\\<^sub>2' \\ (h\\<^sub>2',l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix ex s w\n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and eval_throw:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\throw ex,s\\<^sub>2\\\"\n from IH1[OF eval_val wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified eq] wte2 this]\n show \"Val v' = e\\<^sub>2' \\ (h\\<^sub>2',l\\<^sub>2) = s\\<^sub>2\" by simp\n qed\nnext\n case (FAssNull E e\\<^sub>1 s\\<^sub>0 s\\<^sub>1 e\\<^sub>2 v s\\<^sub>2 F Cs e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\e\\<^sub>1\\F{Cs} := e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and wt:\"P,E \\ e\\<^sub>1\\F{Cs} := e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ null = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\\n \\ Val v = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain C T'' where wte1:\"P,E \\ e\\<^sub>1 :: Class C\" \n and wte2:\"P,E \\ e\\<^sub>2 :: T''\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs D' S'' U a' fs'' h l s w w'\n assume eval_ref:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH1[OF eval_ref wte1 sconf] show \"THROW NullPointer = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n next\n fix s w \n assume eval_null:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\\"\n and eval_val:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w,s\\<^sub>2'\\\"\n and e2':\"e\\<^sub>2' = THROW NullPointer\"\n from IH1[OF eval_null wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val[simplified eq] wte2 this] e2'\n show \"THROW NullPointer = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte1 sconf] show \"THROW NullPointer = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" \n by simp\n next\n fix ex s w\n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and eval_throw:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_val wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified eq] wte2 this] \n show \"THROW NullPointer = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (FAssThrow1 E e\\<^sub>1 s\\<^sub>0 e' s\\<^sub>1 F Cs e\\<^sub>2 e\\<^sub>2' s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\<^sub>1\\F{Cs} := e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2\\\" \n and wt:\"P,E \\ e\\<^sub>1\\F{Cs} := e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain C T'' where wte1:\"P,E \\ e\\<^sub>1 :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs D' S'' U a' fs'' h l s w w'\n assume eval_ref:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH[OF eval_ref wte1 sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s w \n assume eval_null:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH[OF eval_null wte1 sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex\n assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2':\"e\\<^sub>2' = throw ex\"\n from IH[OF eval_throw wte1 sconf] e2' show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex s w assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte1 sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (FAssThrow2 E e\\<^sub>1 s\\<^sub>0 v s\\<^sub>1 e\\<^sub>2 e' s\\<^sub>2 F Cs e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\e\\<^sub>1\\F{Cs} := e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\" \n and wt:\"P,E \\ e\\<^sub>1\\F{Cs} := e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ Val v = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\\n \\ throw e' = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain C T'' where wte1:\"P,E \\ e\\<^sub>1 :: Class C\" \n and wte2:\"P,E \\ e\\<^sub>2 :: T''\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix Xs D' S'' U a' fs'' h l s w w'\n assume eval_ref:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and eval_val:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w,(h,l)\\\"\n from IH1[OF eval_ref wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_ref wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val[simplified eq] wte2 this] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n next\n fix s w \n assume eval_null:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\\"\n and eval_val:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\Val w,s\\<^sub>2'\\\"\n from IH1[OF eval_null wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val[simplified eq] wte2 this] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte1 sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix ex s w\n assume eval_val:\"P,E \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and eval_throw:\"P,E \\ \\e\\<^sub>2,s\\ \\ \\throw ex,s\\<^sub>2'\\\" and e2':\"e\\<^sub>2' = throw ex\"\n from IH1[OF eval_val wte1 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte1 sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified eq] wte2 this] e2' \n show \"throw e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (CallObjThrow E e s\\<^sub>0 e' s\\<^sub>1 Copt M es e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\Call e Copt M es,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ Call e Copt M es :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by(cases Copt)auto\n show ?case\n proof(cases Copt)\n assume \"Copt = None\"\n with eval have \"P,E \\ \\e\\M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex\n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix es' ex' s w ws assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\n next\n fix C' assume \"Copt = Some C'\"\n with eval have \"P,E \\ \\e\\(C'::)M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex\n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix es' ex' s w ws assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix C'' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\n qed\nnext\n case (CallParamsThrow E e s\\<^sub>0 v s\\<^sub>1 es vs ex es' s\\<^sub>2 Copt M e\\<^sub>2 s\\<^sub>2' T)\n have eval:\"P,E \\ \\Call e Copt M es,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\"\n and wt:\"P,E \\ Call e Copt M es :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ Val v = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\esi si Ts. \\P,E \\ \\es,s\\<^sub>1\\ [\\] \\esi,si\\; P,E \\ es [::] Ts; P,E \\ s\\<^sub>1 \\\\\n \\ map Val vs @ throw ex # es' = esi \\ s\\<^sub>2 = si\" by fact+\n from wt obtain C Ts where wte:\"P,E \\ e :: Class C\" and wtes:\"P,E \\ es [::] Ts\" \n by(cases Copt)auto\n show ?case\n proof(cases Copt)\n assume \"Copt = None\"\n with eval have \"P,E \\ \\e\\M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix es'' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es'',s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = throw ex'\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] e2\n have \"vs = ws \\ ex = ex' \\ es' = es'' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:map_Val_throw_eq)\n with e2 show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,(h,l)\\\"\n from IH1[OF eval_ref wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_ref wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this]\n show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:sym[THEN map_Val_throw_False])\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH1[OF eval_null wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this] \n show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:sym[THEN map_Val_throw_False])\n qed\n next\n fix C' assume \"Copt = Some C'\"\n with eval have \"P,E \\ \\e\\(C'::)M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix es'' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es'',s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = throw ex'\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] e2\n have \"vs = ws \\ ex = ex' \\ es' = es'' \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:map_Val_throw_eq)\n with e2 show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,(h,l)\\\"\n from IH1[OF eval_ref wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_ref wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this]\n show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:sym[THEN map_Val_throw_False])\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH1[OF eval_null wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this] \n show \"throw ex = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by(fastforce dest:sym[THEN map_Val_throw_False])\n qed\n qed\nnext\n case (Call E e s\\<^sub>0 a Cs s\\<^sub>1 es vs h\\<^sub>2 l\\<^sub>2 C S M Ts' T' pns' body' Ds Ts T pns\n body Cs' vs' l\\<^sub>2' new_body e' h\\<^sub>3 l\\<^sub>3 e\\<^sub>2 s\\<^sub>2 T'')\n have eval:\"P,E \\ \\e\\M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and eval':\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a,Cs),s\\<^sub>1\\\"\n and eval'':\"P,E \\ \\es,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,l\\<^sub>2)\\\" and h2:\"h\\<^sub>2 a = Some(C,S)\"\n and has_least:\"P \\ last Cs has least M = (Ts',T',pns',body') via Ds\"\n and selects:\"P \\ (C,Cs@\\<^sub>pDs) selects M = (Ts,T,pns,body) via Cs'\"\n and length:\"length vs = length pns\" and Casts:\"P \\ Ts Casts vs to vs'\"\n and l2':\"l\\<^sub>2' = [this \\ Ref (a, Cs'), pns [\\] vs']\"\n and new_body:\"new_body = (case T' of Class D \\ \\D\\body | _ \\ body)\"\n and eval_body:\"P,E(this \\ Class (last Cs'), pns [\\] Ts) \\ \n \\new_body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,l\\<^sub>3)\\\"\n and wt:\"P,E \\ e\\M(es) :: T''\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref (a,Cs) = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\esi si Ts. \\P,E \\ \\es,s\\<^sub>1\\ [\\] \\esi,si\\; P,E \\ es [::] Ts; P,E \\ s\\<^sub>1 \\\\\n \\ map Val vs = esi \\ (h\\<^sub>2,l\\<^sub>2) = si\"\n and IH3:\"\\ei si T. \n \\P,E(this \\ Class (last Cs'), pns [\\] Ts) \\ \\new_body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\ei,si\\;\n P,E(this \\ Class (last Cs'), pns [\\] Ts) \\ new_body :: T;\n P,E(this \\ Class (last Cs'), pns [\\] Ts) \\ (h\\<^sub>2,l\\<^sub>2') \\\\\n \\ e' = ei \\ (h\\<^sub>3, l\\<^sub>3) = si\" by fact+\n from wt obtain D Ss Ss' m Cs'' where wte:\"P,E \\ e :: Class D\" \n and has_least':\"P \\ D has least M = (Ss,T'',m) via Cs''\"\n and wtes:\"P,E \\ es [::] Ss'\" and subs:\"P \\ Ss' [\\] Ss\" by auto\n from eval_preserves_type[OF wf eval' sconf wte]\n have last:\"last Cs = D\" by (auto split:split_if_asm)\n with has_least has_least' wf\n have eq:\"Ts' = Ss \\ T' = T'' \\ (pns',body') = m \\ Ds = Cs''\"\n by(fastforce dest:wf_sees_method_fun)\n from wf selects have param_type:\"\\T \\ set Ts. is_type P T\" \n and return_type:\"is_type P T\" and TnotNT:\"T \\ NT\"\n by(auto dest:select_method_wf_mdecl simp:wf_mdecl_def)\n from selects wf have subo:\"Subobjs P C Cs'\"\n by(induct rule:SelectMethodDef.induct,\n auto simp:FinalOverriderMethodDef_def OverriderMethodDefs_def \n MinimalMethodDefs_def LeastMethodDef_def MethodDefs_def)\n with wf have \"class\":\"is_class P (last Cs')\" by(auto intro!:Subobj_last_isClass)\n from eval'' have hext:\"hp s\\<^sub>1 \\ h\\<^sub>2\" by (cases s\\<^sub>1,auto intro: evals_hext)\n from wf eval' sconf wte last have \"P,E,(hp s\\<^sub>1) \\ ref(a,Cs) :\\<^bsub>NT\\<^esub> Class(last Cs)\"\n by -(rule eval_preserves_type,simp_all)\n with hext have \"P,E,h\\<^sub>2 \\ ref(a,Cs) :\\<^bsub>NT\\<^esub> Class(last Cs)\"\n by(auto intro:WTrt_hext_mono dest:hext_objD split:split_if_asm)\n with h2 have \"Subobjs P C Cs\" by (auto split:split_if_asm)\n hence \"P \\ Path C to (last Cs) via Cs\"\n by (auto simp:path_via_def split:split_if_asm)\n with selects has_least wf have param_types:\"Ts' = Ts \\ P \\ T \\ T'\"\n by -(rule select_least_methods_subtypes,simp_all)\n from wf selects have wt_body:\"P,[this\\Class(last Cs'),pns[\\]Ts] \\ body :: T\"\n and this_not_pns:\"this \\ set pns\" and length:\"length pns = length Ts\"\n and dist:\"distinct pns\"\n by(auto dest!:select_method_wf_mdecl simp:wf_mdecl_def)\n have \"P,[this\\Class(last Cs'),pns[\\]Ts] \\ new_body :: T'\"\n proof(cases \"\\C. T' = Class C\")\n case False with wt_body new_body param_types show ?thesis by(cases T') auto\n next\n case True\n then obtain D' where T':\"T' = Class D'\" by auto\n with wf has_least have \"class\":\"is_class P D'\"\n by(fastforce dest:has_least_wf_mdecl simp:wf_mdecl_def)\n with wf T' TnotNT param_types obtain D'' where T:\"T = Class D''\"\n by(fastforce dest:widen_Class)\n with wf return_type T' param_types have \"P \\ Path D'' to D' unique\"\n by(simp add:Class_widen_Class)\n with wt_body \"class\" T T' new_body show ?thesis by auto\n qed\n hence wt_new_body:\"P,E(this\\Class(last Cs'),pns[\\]Ts) \\ new_body :: T'\"\n by(fastforce intro:wt_env_mono)\n from eval show ?case\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2\\\"\n from IH1[OF eval_throw wte sconf] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix es'' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es'',s\\<^sub>2\\\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>2) = s\\<^sub>2\"\n by(fastforce dest:map_Val_throw_False)\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,(h,l)\\\"\n and h:\"h a' = Some(C',S')\" \n and has_least'':\"P \\ last Xs has least M = (Us',U',pns''',body''') via Ds'\"\n and selects':\"P \\ (C',Xs@\\<^sub>pDs') selects M = (Us,U,pns'',body'') via Xs'\"\n and length':\"length ws = length pns''\" and Casts':\"P \\ Us Casts ws to ws'\"\n and eval_body':\"P,E(this \\ Class (last Xs'), pns'' [\\] Us) \\ \n \\case U' of Class D \\ \\D\\body'' | _ \\ body'',\n (h,[this \\ Ref(a',Xs'), pns'' [\\] ws'])\\ \\ \\e\\<^sub>2,(h',l')\\\"\n and s2:\"s\\<^sub>2 = (h',l)\"\n from IH1[OF eval_ref wte sconf] have eq1:\"a = a' \\ Cs = Xs\" and s:\"s = s\\<^sub>1\" \n by simp_all\n with has_least has_least'' wf have eq2:\"T' = U' \\ Ts' = Us' \\ Ds = Ds'\"\n by(fastforce dest:wf_sees_method_fun)\n from s wf eval_ref wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified s] wtes this]\n have eq3:\"vs = ws \\ h\\<^sub>2 = h \\ l\\<^sub>2 = l\"\n by(fastforce elim:map_injective simp:inj_on_def)\n with eq1 h2 h have eq4:\"C = C' \\ S = S'\" by simp\n with eq1 eq2 selects selects' wf\n have eq5:\"Ts = Us \\ T = U \\ pns'' = pns \\ body'' = body \\ Cs' = Xs'\"\n by simp(drule_tac mthd'=\"(Us,U,pns'',body'')\" in wf_select_method_fun,auto)\n with subs eq param_types have \"P \\ Ss' [\\] Us\" by simp\n with wf Casts Casts' param_type wtes evals_vals sconf' s eq eq2 eq3 eq5\n have eq6:\"vs' = ws'\"\n by(fastforce intro:Casts_Casts_eq_result)\n with eval_body' l2' eq1 eq2 eq3 eq5 new_body \n have eval_body'':\"P,E(this \\ Class(last Cs'), pns [\\] Ts) \\ \n \\new_body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e\\<^sub>2,(h',l')\\\"\n by fastforce\n from wf evals_vals wtes sconf' s eq3 have sconf'':\"P,E \\ (h\\<^sub>2,l\\<^sub>2) \\\"\n by(fastforce intro:evals_preserves_sconf)\n have \"P,E(this \\ Class (last Cs'), pns [\\] Ts) \\ (h\\<^sub>2,l\\<^sub>2') \\\"\n proof(auto simp:sconf_def)\n from sconf'' show \"P \\ h\\<^sub>2 \\\" by(simp add:sconf_def)\n next\n { fix V v assume map:\"[this \\ Ref (a,Cs'), pns [\\] vs'] V = Some v\"\n have \"\\T. (E(this \\ Class (last Cs'), pns [\\] Ts)) V = Some T \\ \n P,h\\<^sub>2 \\ v :\\ T\"\n proof(cases \"V \\ set (this#pns)\")\n case False with map show ?thesis by simp\n next\n case True\n hence \"V = this \\ V \\ set pns\" by simp\n thus ?thesis\n proof(rule disjE)\n assume V:\"V = this\"\n with map this_not_pns have \"v = Ref(a,Cs')\" by simp\n with V h2 subo this_not_pns have \n \"(E(this \\ Class (last Cs'),pns [\\] Ts)) V = Some(Class (last Cs'))\"\n and \"P,h\\<^sub>2 \\ v :\\ Class (last Cs')\" by simp_all\n thus ?thesis by simp\n next\n assume \"V \\ set pns\"\n then obtain i where V:\"V = pns!i\" and length_i:\"i < length pns\"\n by(auto simp:in_set_conv_nth)\n from Casts have \"length Ts = length vs'\"\n by(induct rule:Casts_to.induct,auto)\n with length have \"length pns = length vs'\" by simp\n with map dist V length_i have v:\"v = vs'!i\" by(fastforce dest:maps_nth)\n from length dist length_i\n have env:\"(E(this \\ Class (last Cs'))(pns [\\] Ts)) (pns!i) = Some(Ts!i)\"\n by(rule_tac E=\"E(this \\ Class (last Cs'))\" in nth_maps,simp_all)\n from wf Casts wtes subs eq param_types eval'' sconf'\n have \"\\i < length Ts. P,h\\<^sub>2 \\ vs'!i :\\ Ts!i\"\n by simp(rule Casts_conf,auto)\n with length_i length env V v show ?thesis by simp\n qed\n qed }\n thus \"P,h\\<^sub>2 \\ l\\<^sub>2' (:\\)\\<^sub>w E(this \\ Class (last Cs'), pns [\\] Ts)\"\n using l2' by(simp add:lconf_def)\n next\n { fix V Tx assume env:\"(E(this \\ Class (last Cs'), pns [\\] Ts)) V = Some Tx\"\n have \"is_type P Tx\"\n proof(cases \"V \\ set (this#pns)\")\n case False\n with env sconf'' show ?thesis\n by(clarsimp simp:sconf_def envconf_def)\n next\n case True\n hence \"V = this \\ V \\ set pns\" by simp\n thus ?thesis\n proof(rule disjE)\n assume \"V = this\"\n with env this_not_pns have \"Tx = Class(last Cs')\" by simp\n with \"class\" show ?thesis by simp\n next\n assume \"V \\ set pns\"\n then obtain i where V:\"V = pns!i\" and length_i:\"i < length pns\"\n by(auto simp:in_set_conv_nth)\n with dist length env have \"Tx = Ts!i\" by(fastforce dest:maps_nth)\n with length_i length have \"Tx \\ set Ts\"\n by(fastforce simp:in_set_conv_nth)\n with param_type show ?thesis by simp\n qed\n qed }\n thus \"P \\ E(this \\ Class (last Cs'), pns [\\] Ts) \\\" by (simp add:envconf_def)\n qed\n from IH3[OF eval_body'' wt_new_body this] have \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>3) = (h',l')\" .\n with eq3 s2 show \"e' = e\\<^sub>2 \\ (h\\<^sub>3,l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH1[OF eval_null wte sconf] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3,l\\<^sub>2) = s\\<^sub>2\" by simp\n qed\nnext\n case (StaticCall E e s\\<^sub>0 a Cs s\\<^sub>1 es vs h\\<^sub>2 l\\<^sub>2 C Cs'' M Ts T pns body Cs'\n Ds vs' l\\<^sub>2' e' h\\<^sub>3 l\\<^sub>3 e\\<^sub>2 s\\<^sub>2 T')\n have eval:\"P,E \\ \\e\\(C::)M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and eval':\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a,Cs),s\\<^sub>1\\\"\n and eval'':\"P,E \\ \\es,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2, l\\<^sub>2)\\\"\n and path_unique:\"P \\ Path last Cs to C unique\" \n and path_via:\"P \\ Path last Cs to C via Cs''\"\n and has_least:\"P \\ C has least M = (Ts,T,pns,body) via Cs'\"\n and Ds:\"Ds = (Cs@\\<^sub>pCs'')@\\<^sub>pCs'\" and length:\"length vs = length pns\"\n and Casts:\"P \\ Ts Casts vs to vs'\"\n and l2':\"l\\<^sub>2' = [this \\ Ref (a, Ds), pns [\\] vs']\"\n and eval_body:\"P,E(this \\ Class (last Ds), pns [\\] Ts) \\ \n \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,l\\<^sub>3)\\\"\n and wt:\"P,E \\ e\\(C::)M(es) :: T'\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ ref (a,Cs) = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\esi si Ts. \n \\P,E \\ \\es,s\\<^sub>1\\ [\\] \\esi,si\\; P,E \\ es [::] Ts; P,E \\ s\\<^sub>1 \\\\\n \\ map Val vs = esi \\ (h\\<^sub>2,l\\<^sub>2) = si\"\n and IH3:\"\\ei si T.\n \\P,E(this \\ Class (last Ds), pns [\\] Ts) \\ \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\ei,si\\;\n P,E(this \\ Class (last Ds), pns [\\] Ts) \\ body :: T;\n P,E(this \\ Class (last Ds), pns [\\] Ts) \\ (h\\<^sub>2,l\\<^sub>2') \\\\\n \\ e' = ei \\ (h\\<^sub>3, l\\<^sub>3) = si\" by fact+\n from wt has_least wf obtain C' Ts' where wte:\"P,E \\ e :: Class C'\"\n and wtes:\"P,E \\ es [::] Ts'\" and subs:\"P \\ Ts' [\\] Ts\"\n by(auto dest:wf_sees_method_fun)\n from eval_preserves_type[OF wf eval' sconf wte]\n have last:\"last Cs = C'\" by (auto split:split_if_asm)\n from wf has_least have param_type:\"\\T \\ set Ts. is_type P T\" \n and return_type:\"is_type P T\" and TnotNT:\"T \\ NT\"\n by(auto dest:has_least_wf_mdecl simp:wf_mdecl_def)\n from path_via have last':\"last Cs'' = last(Cs@\\<^sub>pCs'')\"\n by(fastforce intro!:appendPath_last Subobjs_nonempty simp:path_via_def)\n from eval'' have hext:\"hp s\\<^sub>1 \\ h\\<^sub>2\" by (cases s\\<^sub>1,auto intro: evals_hext)\n from wf eval' sconf wte last have \"P,E,(hp s\\<^sub>1) \\ ref(a,Cs) :\\<^bsub>NT\\<^esub> Class(last Cs)\"\n by -(rule eval_preserves_type,simp_all)\n with hext have \"P,E,h\\<^sub>2 \\ ref(a,Cs) :\\<^bsub>NT\\<^esub> Class(last Cs)\"\n by(auto intro:WTrt_hext_mono dest:hext_objD split:split_if_asm)\n then obtain D S where h2:\"h\\<^sub>2 a = Some(D,S)\" and \"Subobjs P D Cs\"\n by (auto split:split_if_asm)\n with path_via wf have \"Subobjs P D (Cs@\\<^sub>pCs'')\" and \"last Cs'' = C\"\n by(auto intro:Subobjs_appendPath simp:path_via_def)\n with has_least wf last' Ds have subo:\"Subobjs P D Ds\"\n by(fastforce intro:Subobjs_appendPath simp:LeastMethodDef_def MethodDefs_def)\n with wf have \"class\":\"is_class P (last Ds)\" by(auto intro!:Subobj_last_isClass)\n from has_least wf obtain D' where \"Subobjs P D' Cs'\"\n by(auto simp:LeastMethodDef_def MethodDefs_def)\n with Ds have last_Ds:\"last Cs' = last Ds\"\n by(fastforce intro!:appendPath_last Subobjs_nonempty)\n with wf has_least have \"P,[this\\Class(last Ds),pns[\\]Ts] \\ body :: T\"\n and this_not_pns:\"this \\ set pns\" and length:\"length pns = length Ts\"\n and dist:\"distinct pns\"\n by(auto dest!:has_least_wf_mdecl simp:wf_mdecl_def)\n hence wt_body:\"P,E(this\\Class(last Ds),pns[\\]Ts) \\ body :: T\"\n by(fastforce intro:wt_env_mono)\n from eval show ?case\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2\\\"\n from IH1[OF eval_throw wte sconf] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix es'' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es'',s\\<^sub>2\\\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>2) = s\\<^sub>2\"\n by(fastforce dest:map_Val_throw_False)\n next\n fix Xs Xs' Xs'' U Us a' body' h h' l l' pns' s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,(h,l)\\\"\n and path_unique':\"P \\ Path last Xs to C unique\"\n and path_via':\"P \\ Path last Xs to C via Xs''\"\n and has_least':\"P \\ C has least M = (Us,U,pns',body') via Xs'\"\n and length':\"length ws = length pns'\"\n and Casts':\"P \\ Us Casts ws to ws'\"\n and eval_body':\"P,E(this \\ Class(last((Xs@\\<^sub>pXs'')@\\<^sub>pXs')),pns' [\\] Us) \\ \n \\body',(h,[this \\ Ref(a',(Xs@\\<^sub>pXs'')@\\<^sub>pXs'),pns' [\\] ws'])\\ \\ \\e\\<^sub>2,(h',l')\\\"\n and s2:\"s\\<^sub>2 = (h',l)\"\n from IH1[OF eval_ref wte sconf] have eq1:\"a = a' \\ Cs = Xs\" and s:\"s = s\\<^sub>1\" \n by simp_all\n from has_least has_least' wf \n have eq2:\"T = U \\ Ts = Us \\ Cs' = Xs' \\ pns = pns' \\ body = body'\"\n by(fastforce dest:wf_sees_method_fun)\n from s wf eval_ref wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified s] wtes this]\n have eq3:\"vs = ws \\ h\\<^sub>2 = h \\ l\\<^sub>2 = l\"\n by(fastforce elim:map_injective simp:inj_on_def)\n from path_unique path_via path_via' eq1 have \"Cs'' = Xs''\" \n by(fastforce simp:path_unique_def path_via_def)\n with Ds eq1 eq2 have Ds':\"Ds = (Xs@\\<^sub>pXs'')@\\<^sub>pXs'\" by simp\n from wf Casts Casts' param_type wtes subs evals_vals sconf' s eq2 eq3\n have eq4:\"vs' = ws'\"\n by(fastforce intro:Casts_Casts_eq_result)\n with eval_body' Ds' l2' eq1 eq2 eq3\n have eval_body'':\"P,E(this \\ Class(last Ds),pns [\\] Ts) \\ \n \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e\\<^sub>2,(h',l')\\\"\n by simp\n from wf evals_vals wtes sconf' s eq3 have sconf'':\"P,E \\ (h\\<^sub>2,l\\<^sub>2) \\\"\n by(fastforce intro:evals_preserves_sconf)\n have \"P,E(this \\ Class (last Ds), pns [\\] Ts) \\ (h\\<^sub>2,l\\<^sub>2') \\\"\n proof(auto simp:sconf_def)\n from sconf'' show \"P \\ h\\<^sub>2 \\\" by(simp add:sconf_def)\n next\n { fix V v assume map:\"[this \\ Ref (a,Ds), pns [\\] vs'] V = Some v\"\n have \"\\T. (E(this \\ Class (last Ds), pns [\\] Ts)) V = Some T \\ \n P,h\\<^sub>2 \\ v :\\ T\"\n proof(cases \"V \\ set (this#pns)\")\n case False with map show ?thesis by simp\n next\n case True\n hence \"V = this \\ V \\ set pns\" by simp\n thus ?thesis\n proof(rule disjE)\n assume V:\"V = this\"\n with map this_not_pns have \"v = Ref(a,Ds)\" by simp\n with V h2 subo this_not_pns have\n \"(E(this \\ Class (last Ds),pns [\\] Ts)) V = Some(Class (last Ds))\"\n and \"P,h\\<^sub>2 \\ v :\\ Class (last Ds)\" by simp_all\n thus ?thesis by simp\n next\n assume \"V \\ set pns\"\n then obtain i where V:\"V = pns!i\" and length_i:\"i < length pns\"\n by(auto simp:in_set_conv_nth)\n from Casts have \"length Ts = length vs'\"\n by(induct rule:Casts_to.induct,auto)\n with length have \"length pns = length vs'\" by simp\n with map dist V length_i have v:\"v = vs'!i\" by(fastforce dest:maps_nth)\n from length dist length_i\n have env:\"(E(this \\ Class (last Ds))(pns [\\] Ts)) (pns!i) = Some(Ts!i)\"\n by(rule_tac E=\"E(this \\ Class (last Ds))\" in nth_maps,simp_all)\n from wf Casts wtes subs eval'' sconf'\n have \"\\i < length Ts. P,h\\<^sub>2 \\ vs'!i :\\ Ts!i\"\n by -(rule Casts_conf,auto)\n with length_i length env V v show ?thesis by simp\n qed\n qed }\n thus \"P,h\\<^sub>2 \\ l\\<^sub>2' (:\\)\\<^sub>w E(this \\ Class (last Ds), pns [\\] Ts)\"\n using l2' by(simp add:lconf_def)\n next\n { fix V Tx assume env:\"(E(this \\ Class (last Ds), pns [\\] Ts)) V = Some Tx\"\n have \"is_type P Tx\"\n proof(cases \"V \\ set (this#pns)\")\n case False\n with env sconf'' show ?thesis\n by(clarsimp simp:sconf_def envconf_def)\n next\n case True\n hence \"V = this \\ V \\ set pns\" by simp\n thus ?thesis\n proof(rule disjE)\n assume \"V = this\"\n with env this_not_pns have \"Tx = Class(last Ds)\" by simp\n with \"class\" show ?thesis by simp\n next\n assume \"V \\ set pns\"\n then obtain i where V:\"V = pns!i\" and length_i:\"i < length pns\"\n by(auto simp:in_set_conv_nth)\n with dist length env have \"Tx = Ts!i\" by(fastforce dest:maps_nth)\n with length_i length have \"Tx \\ set Ts\"\n by(fastforce simp:in_set_conv_nth)\n with param_type show ?thesis by simp\n qed\n qed }\n thus \"P \\ E(this \\ Class (last Ds), pns [\\] Ts) \\\" by (simp add:envconf_def)\n qed\n from IH3[OF eval_body'' wt_body this] have \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>3) = (h',l')\" .\n with eq3 s2 show \"e' = e\\<^sub>2 \\ (h\\<^sub>3, l\\<^sub>2) = s\\<^sub>2\" by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n from IH1[OF eval_null wte sconf] show \"e' = e\\<^sub>2 \\ (h\\<^sub>3,l\\<^sub>2) = s\\<^sub>2\" by simp\n qed\nnext\n case (CallNull E e s\\<^sub>0 s\\<^sub>1 es vs s\\<^sub>2 Copt M e\\<^sub>2 s\\<^sub>2' T)\n have eval:\"P,E \\ \\Call e Copt M es,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\"\n and wt:\"P,E \\ Call e Copt M es :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ null = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\esi si Ts. \\P,E \\ \\es,s\\<^sub>1\\ [\\] \\esi,si\\; P,E \\ es [::] Ts; P,E \\ s\\<^sub>1 \\\\\n \\ map Val vs = esi \\ s\\<^sub>2 = si\" by fact+\n from wt obtain C Ts where wte:\"P,E \\ e :: Class C\" and wtes:\"P,E \\ es [::] Ts\" \n by(cases Copt)auto\n show ?case\n proof(cases Copt)\n assume \"Copt = None\"\n with eval have \"P,E \\ \\e\\M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" \n by simp\n next\n fix es' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es',s\\<^sub>2'\\\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] \n show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by(fastforce dest:map_Val_throw_False)\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH1[OF eval_ref wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" \n by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH1[OF eval_null wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this] e2\n show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\n next\n fix C' assume \"Copt = Some C'\"\n with eval have \"P,E \\ \\e\\(C'::)M(es),s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\" by simp\n thus ?thesis\n proof(rule eval_cases)\n fix ex' assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex',s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" \n by simp\n next\n fix es' ex' s w ws\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and evals_throw:\"P,E \\ \\es,s\\ [\\] \\map Val ws@throw ex'#es',s\\<^sub>2'\\\"\n from IH1[OF eval_val wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_throw[simplified eq] wtes this] \n show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by(fastforce dest:map_Val_throw_False)\n next\n fix C' Xs Xs' Ds' S' U U' Us Us' a' body'' body''' h h' l l' pns'' pns''' \n s ws ws'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref(a',Xs),s\\\"\n from IH1[OF eval_ref wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" \n by simp\n next\n fix s ws\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\map Val ws,s\\<^sub>2'\\\"\n and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH1[OF eval_null wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_null wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified eq] wtes this] e2\n show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\n qed\nnext\n case (Block E V T e\\<^sub>0 h\\<^sub>0 l\\<^sub>0 e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T')\n have eval:\"P,E \\ \\{V:T; e\\<^sub>0},(h\\<^sub>0, l\\<^sub>0)\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ {V:T; e\\<^sub>0} :: T'\" and sconf:\"P,E \\ (h\\<^sub>0, l\\<^sub>0) \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T'. \\P,E(V \\ T) \\ \\e\\<^sub>0,(h\\<^sub>0, l\\<^sub>0(V := None))\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; \n P,E(V \\ T) \\ e\\<^sub>0 :: T'; P,E(V \\ T) \\ (h\\<^sub>0, l\\<^sub>0(V := None)) \\\\\n \\ e\\<^sub>1 = e\\<^sub>2 \\ (h\\<^sub>1, l\\<^sub>1) = s\\<^sub>2\" by fact+\n from wt have type:\"is_type P T\" and wte:\"P,E(V \\ T) \\ e\\<^sub>0 :: T'\" by auto\n from sconf type have sconf':\"P,E(V \\ T) \\ (h\\<^sub>0, l\\<^sub>0(V := None)) \\\"\n by(auto simp:sconf_def lconf_def envconf_def)\n from eval obtain h l where \n eval':\"P,E(V \\ T) \\ \\e\\<^sub>0,(h\\<^sub>0,l\\<^sub>0(V:=None))\\ \\ \\e\\<^sub>2,(h,l)\\\"\n and s2:\"s\\<^sub>2 = (h,l(V:=l\\<^sub>0 V))\" by (auto elim:eval_cases)\n from IH[OF eval' wte sconf'] s2 show ?case by simp\nnext\n case (Seq E e\\<^sub>0 s\\<^sub>0 v s\\<^sub>1 e\\<^sub>1 e\\<^sub>2 s\\<^sub>2 e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\e\\<^sub>0;; e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and wt:\"P,E \\ e\\<^sub>0;; e\\<^sub>1 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>0 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ Val v = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>1 \\\\ \n \\ e\\<^sub>2 = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain T' where wte0:\"P,E \\ e\\<^sub>0 :: T'\" and wte1:\"P,E \\ e\\<^sub>1 :: T\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s w \n assume eval_val:\"P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val w,s\\\" \n and eval':\"P,E \\ \\e\\<^sub>1,s\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n from IH1[OF eval_val wte0 sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_val wte0 sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval'[simplified eq] wte1 this] show \"e\\<^sub>2 = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" .\n next\n fix ex assume eval_throw:\"P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte0 sconf] show \"e\\<^sub>2 = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (SeqThrow E e\\<^sub>0 s\\<^sub>0 e s\\<^sub>1 e\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\e\\<^sub>0;; e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ e\\<^sub>0;; e\\<^sub>1 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e\\<^sub>0 :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain T' where wte0:\"P,E \\ e\\<^sub>0 :: T'\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s w \n assume eval_val:\"P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte0 sconf] show \"throw e = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte0 sconf] e2 show \"throw e = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (CondT E e s\\<^sub>0 s\\<^sub>1 e\\<^sub>1 e' s\\<^sub>2 e\\<^sub>2 e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and wt:\"P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ true = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>1 :: T; P,E \\ s\\<^sub>1 \\\\ \n \\ e' = ei \\ s\\<^sub>2 = si\" by fact+\n from wt have wte:\"P,E \\ e :: Boolean\" and wte1:\"P,E \\ e\\<^sub>1 :: T\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s \n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\" and eval':\"P,E \\ \\e\\<^sub>1,s\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n from IH1[OF eval_true wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_true wte sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval'[simplified eq] wte1 this] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" .\n next\n fix s assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\\"\n from IH1[OF eval_false wte sconf] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (CondF E e s\\<^sub>0 s\\<^sub>1 e\\<^sub>2 e' s\\<^sub>2 e\\<^sub>1 e\\<^sub>2' s\\<^sub>2' T)\n have eval:\"P,E \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n and wt:\"P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ false = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ e\\<^sub>2 :: T; P,E \\ s\\<^sub>1 \\\\ \n \\ e' = ei \\ s\\<^sub>2 = si\" by fact+\n from wt have wte:\"P,E \\ e :: Boolean\" and wte2:\"P,E \\ e\\<^sub>2 :: T\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s \n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH1[OF eval_true wte sconf] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix s\n assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\\"\n and eval':\"P,E \\ \\e\\<^sub>2,s\\ \\ \\e\\<^sub>2',s\\<^sub>2'\\\"\n from IH1[OF eval_false wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_false wte sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval'[simplified eq] wte2 this] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" .\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"e' = e\\<^sub>2' \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (CondThrow E e s\\<^sub>0 e' s\\<^sub>1 e\\<^sub>1 e\\<^sub>2 e\\<^sub>2' s\\<^sub>2 T)\n have eval:\"P,E \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',s\\<^sub>2\\\"\n and wt:\"P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ throw e' = ei \\ s\\<^sub>1 = si\" by fact+\n from wt have wte:\"P,E \\ e :: Boolean\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix s \n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH[OF eval_true wte sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\\"\n from IH[OF eval_false wte sconf] show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex\n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2':\"e\\<^sub>2' = throw ex\"\n from IH[OF eval_throw wte sconf] e2' show \"throw e' = e\\<^sub>2' \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (WhileF E e s\\<^sub>0 s\\<^sub>1 c e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ while (e) c :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\e\\<^sub>2 s\\<^sub>2 T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ false = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by fact+\n from wt have wte:\"P,E \\ e :: Boolean\" by auto\n from eval show ?case\n proof(rule eval_cases)\n assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = unit\"\n from IH[OF eval_false wte sconf] e2 show \"unit = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s s' w\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH[OF eval_true wte sconf] show \"unit = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"unit = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex s\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH[OF eval_true wte sconf] show \"unit = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (WhileT E e s\\<^sub>0 s\\<^sub>1 c v\\<^sub>1 s\\<^sub>2 e\\<^sub>3 s\\<^sub>3 e\\<^sub>2 s\\<^sub>2' T)\n have eval:\"P,E \\ \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\"\n and wt:\"P,E \\ while (e) c :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ true = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\c,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ c :: T; P,E \\ s\\<^sub>1 \\\\ \n \\ Val v\\<^sub>1 = ei \\ s\\<^sub>2 = si\"\n and IH3:\"\\ei si T. \\P,E \\ \\while (e) c,s\\<^sub>2\\ \\ \\ei,si\\; P,E \\ while (e) c :: T; \n P,E \\ s\\<^sub>2 \\\\\n \\ e\\<^sub>3 = ei \\ s\\<^sub>3 = si\" by fact+\n from wt obtain T' where wte:\"P,E \\ e :: Boolean\" and wtc:\"P,E \\ c :: T'\" by auto\n from eval show ?case\n proof(rule eval_cases)\n assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>2'\\\"\n from IH1[OF eval_false wte sconf] show \"e\\<^sub>3 = e\\<^sub>2 \\ s\\<^sub>3 = s\\<^sub>2'\" by simp\n next\n fix s s' w\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\" \n and eval_val:\"P,E \\ \\c,s\\ \\ \\Val w,s'\\\"\n and eval_while:\"P,E \\ \\while (e) c,s'\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\"\n from IH1[OF eval_true wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_true wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val[simplified eq] wtc this] have eq':\"s' = s\\<^sub>2\" by simp\n with wf eval_val wtc sconf' eq have \"P,E \\ s\\<^sub>2 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH3[OF eval_while[simplified eq'] wt this] show \"e\\<^sub>3 = e\\<^sub>2 \\ s\\<^sub>3 = s\\<^sub>2'\" .\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"e\\<^sub>3 = e\\<^sub>2 \\ s\\<^sub>3 = s\\<^sub>2'\" by simp\n next\n fix ex s\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\" \n and eval_throw:\"P,E \\ \\c,s\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_true wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_true wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified eq] wtc this] show \"e\\<^sub>3 = e\\<^sub>2 \\ s\\<^sub>3 = s\\<^sub>2'\" by simp\n qed\nnext\n case (WhileCondThrow E e s\\<^sub>0 e' s\\<^sub>1 c e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ while (e) c :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\\n \\ throw e' = ei \\ s\\<^sub>1 = si\" by fact+\n from wt have wte:\"P,E \\ e :: Boolean\" by auto\n from eval show ?case\n proof(rule eval_cases)\n assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>2\\\"\n from IH[OF eval_false wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix s s' w\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH[OF eval_true wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex s\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\"\n from IH[OF eval_true wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (WhileBodyThrow E e s\\<^sub>0 s\\<^sub>1 c e' s\\<^sub>2 e\\<^sub>2 s\\<^sub>2' T)\n have eval:\"P,E \\ \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2'\\\"\n and wt:\"P,E \\ while (e) c :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ true = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\ei si T. \\P,E \\ \\c,s\\<^sub>1\\ \\ \\ei,si\\; P,E \\ c :: T; P,E \\ s\\<^sub>1 \\\\\n \\ throw e' = ei \\ s\\<^sub>2 = si\" by fact+\n from wt obtain T' where wte:\"P,E \\ e :: Boolean\" and wtc:\"P,E \\ c :: T'\" by auto\n from eval show ?case\n proof(rule eval_cases)\n assume eval_false:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>2'\\\"\n from IH1[OF eval_false wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix s s' w\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\" \n and eval_val:\"P,E \\ \\c,s\\ \\ \\Val w,s'\\\"\n from IH1[OF eval_true wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_true wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_val[simplified eq] wtc this] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix ex s\n assume eval_true:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\true,s\\\" \n and eval_throw:\"P,E \\ \\c,s\\ \\ \\throw ex,s\\<^sub>2'\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH1[OF eval_true wte sconf] have eq:\"s = s\\<^sub>1\" by simp\n with wf eval_true wte sconf have sconf':\"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF eval_throw[simplified eq] wtc this] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\"\n by simp\n qed\nnext\n case (Throw E e s\\<^sub>0 r s\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\throw e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ throw e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ ref r = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix r'\n assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref r',s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = Throw r'\"\n from IH[OF eval_ref wte sconf] e2 show \"Throw r = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"Throw r = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"Throw r = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (ThrowNull E e s\\<^sub>0 s\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\throw e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ throw e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ null = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix r' assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref r',s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = THROW NullPointer\"\n from IH[OF eval_null wte sconf] e2 show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" \n by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n from IH[OF eval_throw wte sconf] show \"THROW NullPointer = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case (ThrowThrow E e s\\<^sub>0 e' s\\<^sub>1 e\\<^sub>2 s\\<^sub>2 T)\n have eval:\"P,E \\ \\throw e,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ throw e :: T\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ throw e' = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain C where wte:\"P,E \\ e :: Class C\" by auto\n from eval show ?case\n proof(rule eval_cases)\n fix r' assume eval_ref:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\ref r',s\\<^sub>2\\\"\n from IH[OF eval_ref wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n assume eval_null:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>2\\\"\n from IH[OF eval_null wte sconf] show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and e2:\"e\\<^sub>2 = throw ex\"\n from IH[OF eval_throw wte sconf] e2 show \"throw e' = e\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nnext\n case Nil thus ?case by (auto elim:evals_cases)\nnext\n case (Cons E e s\\<^sub>0 v s\\<^sub>1 es es' s\\<^sub>2 es\\<^sub>2 s\\<^sub>2' Ts)\n have evals:\"P,E \\ \\e#es,s\\<^sub>0\\ [\\] \\es\\<^sub>2,s\\<^sub>2'\\\"\n and wt:\"P,E \\ e#es [::] Ts\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH1:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ Val v = ei \\ s\\<^sub>1 = si\"\n and IH2:\"\\esi si Ts. \\P,E \\ \\es,s\\<^sub>1\\ [\\] \\esi,si\\; P,E \\ es [::] Ts; P,E \\ s\\<^sub>1 \\\\\n \\ es' = esi \\ s\\<^sub>2 = si\" by fact+\n from wt obtain T' Ts' where Ts:\"Ts = T'#Ts'\" by(cases Ts) auto\n with wt have wte:\"P,E \\ e :: T'\" and wtes:\"P,E \\ es [::] Ts'\" by auto\n from evals show ?case\n proof(rule evals_cases)\n fix es'' s w\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n and evals_vals:\"P,E \\ \\es,s\\ [\\] \\es'',s\\<^sub>2'\\\" and es2:\"es\\<^sub>2 = Val w#es''\"\n from IH1[OF eval_val wte sconf] have s:\"s = s\\<^sub>1\" and v:\"v = w\" by simp_all\n with wf eval_val wte sconf have \"P,E \\ s\\<^sub>1 \\\"\n by(fastforce intro:eval_preserves_sconf)\n from IH2[OF evals_vals[simplified s] wtes this] have \"es' = es'' \\ s\\<^sub>2 = s\\<^sub>2'\" .\n with es2 v show \"Val v # es' = es\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n next\n fix ex assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2'\\\"\n from IH1[OF eval_throw wte sconf] show \"Val v # es' = es\\<^sub>2 \\ s\\<^sub>2 = s\\<^sub>2'\" by simp\n qed\nnext\n case (ConsThrow E e s\\<^sub>0 e' s\\<^sub>1 es es\\<^sub>2 s\\<^sub>2 Ts)\n have evals:\"P,E \\ \\e#es,s\\<^sub>0\\ [\\] \\es\\<^sub>2,s\\<^sub>2\\\"\n and wt:\"P,E \\ e#es [::] Ts\" and sconf:\"P,E \\ s\\<^sub>0 \\\"\n and IH:\"\\ei si T. \\P,E \\ \\e,s\\<^sub>0\\ \\ \\ei,si\\; P,E \\ e :: T; P,E \\ s\\<^sub>0 \\\\ \n \\ throw e' = ei \\ s\\<^sub>1 = si\" by fact+\n from wt obtain T' Ts' where Ts:\"Ts = T'#Ts'\" by(cases Ts) auto\n with wt have wte:\"P,E \\ e :: T'\" by auto\n from evals show ?case\n proof(rule evals_cases)\n fix es'' s w\n assume eval_val:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\Val w,s\\\"\n from IH[OF eval_val wte sconf] show \"throw e'#es = es\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n next\n fix ex \n assume eval_throw:\"P,E \\ \\e,s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\" and es2:\"es\\<^sub>2 = throw ex#es\"\n from IH[OF eval_throw wte sconf] es2 show \"throw e'#es = es\\<^sub>2 \\ s\\<^sub>1 = s\\<^sub>2\" by simp\n qed\nqed\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/Determinism.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.293560766853691}} {"text": "section \\Lifting theorems onto filters\\\ntheory Eventuallize\n imports Complex_Main\nbegin\n\ntext \\\n The following attribute and ML function lift a given theorem of the form\n \\<^prop>\\\\x. A x \\ B x \\ C x\\\n to\n \\<^prop>\\eventually A F \\ eventually B F \\ eventually C F\\ .\n\\\n\nML \\\nsignature EVENTUALLIZE =\nsig\nval eventuallize : Proof.context -> thm -> int option -> thm\nend\n\nstructure Eventuallize : EVENTUALLIZE =\nstruct\n\nfun dest_All (Const (\\<^const_name>\\HOL.All\\, _) $ Abs (x, T, t)) = (x, T, t)\n | dest_All (Const (\\<^const_name>\\HOL.All\\, T) $ f) =\n (\"x\", T |> dest_funT |> fst |> dest_funT |> fst, f $ Bound 0)\n | dest_All t = raise TERM (\"dest_All\", [t])\n\nfun strip_imp (\\<^term>\\(\\)\\ $ a $ b) = apfst (cons a) (strip_imp b)\n | strip_imp t = ([], t)\n\nfun eventuallize ctxt thm n =\n let\n fun err n = raise THM (\"Invalid index in eventuallize: \" ^ Int.toString n, 0, [thm])\n val n_max =\n thm |> Thm.concl_of |> HOLogic.dest_Trueprop |> dest_All |> #3 |> strip_imp |> fst |> length\n val _ = case n of NONE => () | SOME n =>\n if n >= 0 andalso n <= n_max then () else err n\n val n = case n of SOME n => n | NONE => n_max\n fun conv n =\n if n < 2 then Conv.all_conv else Conv.arg_conv (conv (n - 1)) then_conv\n Conv.rewr_conv @{thm eq_reflection[OF imp_conjL [symmetric]]}\n val conv = Conv.arg_conv (Conv.binder_conv (K (conv n)) ctxt)\n val thm' = Conv.fconv_rule conv thm\n fun go n = if n < 2 then @{thm _} else @{thm eventually_conj} OF [@{thm _}, go (n - 1)]\n in\n @{thm eventually_rev_mp[OF _ always_eventually]} OF [go n, thm']\n end\n\nend\n\\\n\nattribute_setup eventuallized = \\\n Scan.lift (Scan.option Parse.nat) >>\n (fn n => fn (ctxt, thm) =>\n (NONE, SOME (Eventuallize.eventuallize (Context.proof_of ctxt) thm n)))\n\\\n\nend", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Real_Asymp/Eventuallize.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.293560766853691}} {"text": "section\\PTA Generalisation\\\ntext\\The problem with the simplistic heuristics of \\<^cite>\\\"foster2019\"\\ is that the performance of the\nInference technique is almost entirely dependent on the quality and applicability of the heuristics\nprovided to it. Producing high quality heuristics often requires some inside knowledge of the system\nunder inference. If the user has this knowledge already, they are unlikely to require automated\ninference. Ideally, we would like something more generally applicable. This theory presents a more\nabstract \\emph{metaheuristic} which can be implemented with genetic programming.\\\n\ntheory PTA_Generalisation\n imports \"../Inference\" Same_Register Group_By\nbegin\n\nhide_const I\n\ndatatype value_type = N | S\n\ninstantiation value_type :: linorder begin\nfun less_value_type :: \"value_type \\ value_type \\ bool\" where\n \"less_value_type N S = True\" |\n \"less_value_type _ _ = False\"\n\ndefinition less_eq_value_type :: \"value_type \\ value_type \\ bool\" where\n \"less_eq_value_type v1 v2 \\ (v1 < v2 \\ v1 = v2)\"\n\ninstance\n apply standard\n using less_eq_value_type_def less_value_type.elims(2) apply blast\n apply (simp add: less_eq_value_type_def)\n apply (metis less_eq_value_type_def value_type.exhaust)\n using less_eq_value_type_def less_value_type.elims(2) apply blast\n by (metis less_eq_value_type_def less_value_type.elims(3) value_type.simps(2))\n\nend\n\n\\ \\This is a very hacky way of making sure that things with differently typed outputs don't get\n lumped together.\\\nfun typeSig :: \"output_function \\ value_type\" where\n \"typeSig (L (value.Str _)) = S\" |\n \"typeSig _ = N\"\n\ndefinition same_structure :: \"transition \\ transition \\ bool\" where\n \"same_structure t1 t2 = (\n Label t1 = Label t2 \\\n Arity t1 = Arity t2 \\\n map typeSig (Outputs t1) = map typeSig (Outputs t2)\n )\"\n\nlemma same_structure_equiv:\n \"Outputs t1 = [L (Num m)] \\ Outputs t2 = [L (Num n)] \\\n same_structure t1 t2 = Transition.same_structure t1 t2\"\n by (simp add: same_structure_def Transition.same_structure_def)\n\ntype_synonym transition_group = \"(tids \\ transition) list\"\n\nfun observe_all :: \"iEFSM \\ cfstate \\ registers \\ trace \\ transition_group\" where\n \"observe_all _ _ _ [] = []\" |\n \"observe_all e s r ((l, i, _)#es) =\n (case random_member (i_possible_steps e s r l i) of\n (Some (ids, s', t)) \\ (((ids, t)#(observe_all e s' (evaluate_updates t i r) es))) |\n _ \\ []\n )\"\n\ndefinition transition_groups_exec :: \"iEFSM \\ trace \\ (nat \\ tids \\ transition) list list\" where\n \"transition_groups_exec e t = group_by (\\(_, _, t1) (_, _, t2). same_structure t1 t2) (enumerate 0 (observe_all e 0 <> t))\"\n\ntype_synonym struct = \"(label \\ arity \\ value_type list)\"\n\ntext\\We need to take the list of transition groups and tag them with the last transition that was\ntaken which had a different structure.\\\nfun tag :: \"struct option \\ (nat \\ tids \\ transition) list list \\ (struct option \\ struct \\ (nat \\ tids \\ transition) list) list\" where\n \"tag _ [] = []\" |\n \"tag t (g#gs) = (\n let\n (_, _, head) = hd g;\n struct = (Label head, Arity head, map typeSig (Outputs head))\n in\n (t, struct, g)#(tag (Some struct) gs)\n )\"\n\ntext\\We need to group transitions not just by their structure but also by their history - i.e. the\nlast transition which was taken which had a different structure. We need to order these groups by\ntheir relative positions within the traces such that output and update functions can be inferred in\nthe correct order.\\\ndefinition transition_groups :: \"iEFSM \\ log \\ transition_group list\" where\n \"transition_groups e l = (\n let\n trace_groups = map (transition_groups_exec e) l;\n tagged = map (tag None) trace_groups;\n flat = sort (fold (@) tagged []);\n group_fun = fold (\\(tag, s, gp) f. f((tag, s) $:= gp@(f$(tag, s)))) flat (K$ []);\n grouped = map (\\x. group_fun $ x) (finfun_to_list group_fun);\n inx_groups = map (\\gp. (Min (set (map fst gp)), map snd gp)) grouped\n in\n map snd (sort inx_groups)\n )\"\n\ntext\\For a given trace group, log, and EFSM, we want to build the training set for that group. That\nis, the set of inputs, registers, and expected outputs from those transitions. To do this, we must\nwalk the traces in the EFSM to obtain the register values.\\\nfun trace_group_training_set :: \"transition_group \\ iEFSM \\ cfstate \\ registers \\ trace \\ (inputs \\ registers \\ value list) list \\ (inputs \\ registers \\ value list) list\" where\n \"trace_group_training_set _ _ _ _ [] train = train\" |\n \"trace_group_training_set gp e s r ((l, i, p)#t) train = (\n let\n (id, s', transition) = fthe_elem (i_possible_steps e s r l i)\n in\n if \\(id', _) \\ set gp. id' = id then\n trace_group_training_set gp e s' (evaluate_updates transition i r) t ((i, r, p)#train)\n else\n trace_group_training_set gp e s' (evaluate_updates transition i r) t train\n )\"\n\ndefinition make_training_set :: \"iEFSM \\ log \\ transition_group \\ (inputs \\ registers \\ value list) list\" where\n \"make_training_set e l gp = fold (\\h a. trace_group_training_set gp e 0 <> h a) l []\"\n\nprimrec replace_groups :: \"transition_group list \\ iEFSM \\ iEFSM\" where\n \"replace_groups [] e = e\" |\n \"replace_groups (h#t) e = replace_groups t (fold (\\(id, t) acc. replace_transition acc id t) h e)\"\n\nlemma replace_groups_fold [code]:\n \"replace_groups xs e = fold (\\h acc'. (fold (\\(id, t) acc. replace_transition acc id t) h acc')) xs e\"\n by (induct xs arbitrary: e, auto)\n\ndefinition insert_updates :: \"transition \\ update_function list \\ transition\" where\n \"insert_updates t u = (\n let\n \\ \\Want to filter out null updates of the form rn := rn. It doesn't affect anything but it \\\n \\ \\does make things look cleaner \\\n necessary_updates = filter (\\(r, u). u \\ V (R r)) u\n in\n t\\Updates := (filter (\\(r, _). r \\ set (map fst u)) (Updates t))@necessary_updates\\\n )\"\n\nfun add_groupwise_updates_trace :: \"trace \\ (tids \\ update_function list) list \\ iEFSM \\ cfstate \\ registers \\ iEFSM\" where\n \"add_groupwise_updates_trace [] _ e _ _ = e\" |\n \"add_groupwise_updates_trace ((l, i, _)#trace) funs e s r = (\n let\n (id, s', t) = fthe_elem (i_possible_steps e s r l i);\n updated = evaluate_updates t i r;\n newUpdates = List.maps snd (filter (\\(tids, _). set id \\ set tids) funs);\n t' = insert_updates t newUpdates;\n updated' = apply_updates (Updates t') (join_ir i r) r;\n necessaryUpdates = filter (\\(r, _). updated $ r \\ updated' $ r) newUpdates;\n t'' = insert_updates t necessaryUpdates;\n e' = replace_transition e id t''\n in\n add_groupwise_updates_trace trace funs e' s' updated'\n )\"\n\nprimrec add_groupwise_updates :: \"log \\ (tids \\ update_function list) list \\ iEFSM \\ iEFSM\" where\n \"add_groupwise_updates [] _ e = e\" |\n \"add_groupwise_updates (h#t) funs e = add_groupwise_updates t funs (add_groupwise_updates_trace h funs e 0 <>)\"\n\nlemma fold_add_groupwise_updates [code]:\n \"add_groupwise_updates log funs e = fold (\\trace acc. add_groupwise_updates_trace trace funs acc 0 <>) log e\"\n by (induct log arbitrary: e, auto)\n\n\\ \\This will be replaced to calls to Z3 in the executable\\\ndefinition get_regs :: \"(vname \\f String.literal) \\ inputs \\ vname aexp \\ value \\ registers\" where\n \"get_regs types inputs expression output = Eps (\\r. aval expression (join_ir inputs r) = Some output)\"\n\ndeclare get_regs_def [code del]\ncode_printing constant get_regs \\ (Scala) \"Dirties.getRegs\"\n\ntype_synonym action_info = \"(cfstate \\ registers \\ registers \\ inputs \\ tids \\ transition)\"\ntype_synonym run_info = \"action_info list\"\ntype_synonym targeted_run_info = \"(registers \\ action_info) list\"\n\nfun everything_walk :: \"output_function \\ nat \\ (vname \\f String.literal) \\ trace \\ iEFSM \\ cfstate \\ registers \\ transition_group \\ run_info\" where\n \"everything_walk _ _ _ [] _ _ _ _ = []\" |\n \"everything_walk f fi types ((label, inputs, outputs)#t) oPTA s regs gp = (\n let (tid, s', ta) = fthe_elem (i_possible_steps oPTA s regs label inputs) in\n \\ \\Possible steps with a transition we need to modify\\\n if \\(tid', _) \\ set gp. tid = tid' then\n (s, regs, get_regs types inputs f (outputs!fi), inputs, tid, ta)#(everything_walk f fi types t oPTA s' (evaluate_updates ta inputs regs) gp)\n else\n let empty = <> in\n (s, regs, empty, inputs, tid, ta)#(everything_walk f fi types t oPTA s' (evaluate_updates ta inputs regs) gp)\n )\"\n\ndefinition everything_walk_log :: \"output_function \\ nat \\ (vname \\f String.literal) \\ log \\ iEFSM \\ transition_group \\ run_info list\" where\n \"everything_walk_log f fi types log e gp = map (\\t. everything_walk f fi types t e 0 <> gp) log\"\n\nfun target :: \"registers \\ run_info \\ targeted_run_info\" where\n \"target _ [] = []\" |\n \"target tRegs ((s, oldregs, regs, inputs, tid, ta)#t) = (\n let newTarget = if finfun_to_list regs = [] then tRegs else regs in\n (tRegs, s, oldregs, regs, inputs, tid, ta)#target newTarget t\n )\"\n\nfun target_tail :: \"registers \\ run_info \\ targeted_run_info \\ targeted_run_info\" where\n \"target_tail _ [] tt = rev tt\" |\n \"target_tail tRegs ((s, oldregs, regs, inputs, tid, ta)#t) tt = (\n let newTarget = if finfun_to_list regs = [] then tRegs else regs in\n target_tail newTarget t ((tRegs, s, oldregs, regs, inputs, tid, ta)#tt)\n )\"\n\nlemma target_tail: \"(rev bs)@(target tRegs ts) = target_tail tRegs ts bs\"\nproof(induct ts arbitrary: bs tRegs)\n case (Cons a ts)\n then show ?case\n apply (cases a)\n apply simp\n apply standard\n by (metis (no_types, lifting) append_eq_append_conv2 rev.simps(2) rev_append rev_swap self_append_conv2)+\nqed simp\n\ndefinition \"target_fold tRegs ts b = fst (fold (\\(s, oldregs, regs, inputs, tid, ta) (acc, tRegs).\nlet newTarget = if finfun_to_list regs = [] then tRegs else regs in\n (acc@[(tRegs, s, oldregs, regs, inputs, tid, ta)], newTarget)\n) ts (rev b, tRegs))\"\n\nlemma target_tail_fold: \"target_tail tRegs ts b = target_fold tRegs ts b\"\nproof(induct ts arbitrary: tRegs b)\n case Nil\n then show ?case\n by (simp add: target_fold_def)\nnext\n case (Cons a ts)\n then show ?case\n apply (cases a)\n by (simp add: target_fold_def)\nqed\n\nlemma target_fold [code]: \"target tRegs ts = target_fold tRegs ts []\"\n by (metis append_self_conv2 rev.simps(1) target_tail_fold target_tail)\n\n\\ \\This will be replaced by symbolic regression in the executable\\\ndefinition get_update :: \"label \\ nat \\ value list \\ (inputs \\ registers \\ registers) list \\ vname aexp option\" where\n \"get_update _ reg values train = (let\n possible_funs = {a. \\(i, r, r') \\ set train. aval a (join_ir i r) = r' $ reg}\n in\n if possible_funs = {} then None else Some (Eps (\\x. x \\ possible_funs))\n )\"\n\ndeclare get_update_def [code del]\ncode_printing constant get_update \\ (Scala) \"Dirties.getUpdate\"\n\ndefinition get_updates_opt :: \"label \\ value list \\ (inputs \\ registers \\ registers) list \\ (nat \\ vname aexp option) list\" where\n \"get_updates_opt l values train = (let\n updated_regs = fold List.union (map (finfun_to_list \\ snd \\ snd) train) [] in\n map (\\r.\n let targetValues = remdups (map (\\(_, _, regs). regs $ r) train) in\n if (\\(_, anteriorRegs, posteriorRegs) \\ set train. anteriorRegs $ r = posteriorRegs $ r) then\n (r, Some (V (R r)))\n else if length targetValues = 1 \\ (\\(inputs, anteriorRegs, _) \\ set train. finfun_to_list anteriorRegs = []) then\n case hd targetValues of Some v \\\n (r, Some (L v))\n else\n (r, get_update l r values train)\n ) updated_regs\n )\"\n\ndefinition finfun_add :: \"(('a::linorder) \\f 'b) \\ ('a \\f 'b) \\ ('a \\f 'b)\" where\n \"finfun_add a b = fold (\\k f. f(k $:= b $ k)) (finfun_to_list b) a\"\n\ndefinition group_update :: \"value list \\ targeted_run_info \\ (tids \\ (nat \\ vname aexp) list) option\" where\n \"group_update values l = (\n let\n (_, (_, _, _, _, _, t)) = hd l;\n targeted = filter (\\(regs, _). finfun_to_list regs \\ []) l;\n maybe_updates = get_updates_opt (Label t) values (map (\\(tRegs, s, oldRegs, regs, inputs, tid, ta). (inputs, finfun_add oldRegs regs, tRegs)) targeted)\n in\n if \\(_, f_opt) \\ set maybe_updates. f_opt = None then\n None\n else\n Some (fold List.union (map (\\(tRegs, s, oldRegs, regs, inputs, tid, ta). tid) l) [], map (\\(r, f_o). (r, the f_o)) maybe_updates)\n )\"\n\nfun groupwise_put_updates :: \"transition_group list \\ log \\ value list \\ run_info list \\ (nat \\ (vname aexp \\ vname \\f String.literal)) \\ iEFSM \\ iEFSM\" where\n \"groupwise_put_updates [] _ _ _ _ e = e\" |\n \"groupwise_put_updates (gp#gps) log values walked (o_inx, (op, types)) e = (\n let\n targeted = map (\\x. filter (\\(_, _, _, _, _, id, tran). (id, tran) \\ set gp) x) (map (\\w. rev (target <> (rev w))) walked);\n group = fold List.union targeted []\n in\n case group_update values group of\n None \\ groupwise_put_updates gps log values walked (o_inx, (op, types)) e |\n Some u \\ groupwise_put_updates gps log values walked (o_inx, (op, types)) (make_distinct (add_groupwise_updates log [u] e))\n )\"\n\ndefinition updates_for_output :: \"log \\ value list \\ transition_group \\ nat \\ vname aexp \\ vname \\f String.literal \\ iEFSM \\ iEFSM\" where\n\"updates_for_output log values current o_inx op types e = (\n if AExp.enumerate_regs op = {} then e\n else\n let\n walked = everything_walk_log op o_inx types log e current;\n groups = transition_groups e log\n in\n groupwise_put_updates groups log values walked (o_inx, (op, types)) e\n )\"\n\ntype_synonym output_types = \"(vname aexp \\ vname \\f String.literal)\"\n\nfun put_updates :: \"log \\ value list \\ transition_group \\ (nat \\ output_types option) list \\ iEFSM \\ iEFSM\" where\n \"put_updates _ _ _ [] e = e\" |\n \"put_updates log values gp ((_, None)#ops) e = put_updates log values gp ops e\" |\n \"put_updates log values gp ((o_inx, Some (op, types))#ops) e = (\n let\n gp' = map (\\(id, t). (id, t\\Outputs := list_update (Outputs t) o_inx op\\)) gp;\n generalised_model = fold (\\(id, t) acc. replace_transition acc id t) gp' e;\n e' = updates_for_output log values gp o_inx op types generalised_model\n in\n if accepts_log (set log) (tm e') then\n put_updates log values gp' ops e'\n else\n put_updates log values gp ops e\n )\"\n\nfun unzip_3 :: \"('a \\ 'b \\ 'c) list \\ ('a list \\ 'b list \\ 'c list)\" where\n \"unzip_3 [] = ([], [], [])\" |\n \"unzip_3 ((a, b, c)#l) = (\n let (as, bs, cs) = unzip_3 l in\n (a#as, b#bs, c#cs)\n )\"\n\nlemma unzip_3: \"unzip_3 l = (map fst l, map (fst \\ snd) l, map (snd \\ snd) l)\"\n by (induct l, auto)\n\nfun unzip_3_tailrec_rev :: \"('a \\ 'b \\ 'c) list \\ ('a list \\ 'b list \\ 'c list) \\ ('a list \\ 'b list \\ 'c list)\" where\n \"unzip_3_tailrec_rev [] (as, bs, cs) = (as, bs, cs)\" |\n \"unzip_3_tailrec_rev ((a, b, c)#t) (as, bs, cs) = unzip_3_tailrec_rev t (a#as, b#bs, c#cs)\"\n\nlemma unzip_3_tailrec_rev: \"unzip_3_tailrec_rev l (as, bs, cs) = ((map_tailrec_rev fst l as), (map_tailrec_rev (fst \\ snd) l bs), (map_tailrec_rev (snd \\ snd) l cs))\"\n by (induct l arbitrary: as bs cs, auto)\n\ndefinition \"unzip_3_tailrec l = (let (as, bs, cs) = unzip_3_tailrec_rev l ([],[],[]) in (rev as, rev bs, rev cs))\"\n\nlemma unzip_3_tailrec [code]: \"unzip_3 l = unzip_3_tailrec l\"\n apply (simp only: unzip_3_tailrec_def unzip_3_tailrec_rev)\n by (simp add: Let_def map_tailrec_rev unzip_3 map_eq_map_tailrec)\n\ntext\\We want to return an aexp which, when evaluated in the correct context accounts for the literal\ninput-output pairs within the training set. This will be replaced by symbolic regression in the\nexecutable\\\ndefinition get_output :: \"label \\ nat \\ value list \\ (inputs \\ registers \\ value) list \\ (vname aexp \\ (vname \\f String.literal)) option\" where\n \"get_output _ maxReg values train = (let\n possible_funs = {a. \\(i, r, p) \\ set train. aval a (join_ir i r) = Some p}\n in\n if possible_funs = {} then None else Some (Eps (\\x. x \\ possible_funs), (K$ STR ''int''))\n )\"\ndeclare get_output_def [code del]\ncode_printing constant get_output \\ (Scala) \"Dirties.getOutput\"\n\ndefinition get_outputs :: \"label \\ nat \\ value list \\ inputs list \\ registers list \\ value list list \\ (vname aexp \\ (vname \\f String.literal)) option list\" where\n \"get_outputs l maxReg values I r outputs = map_tailrec (\\(maxReg, ps). get_output l maxReg values (zip I (zip r ps))) (enumerate maxReg (transpose outputs))\"\n\ndefinition enumerate_exec_values :: \"trace \\ value list\" where\n \"enumerate_exec_values vs = fold (\\(_, i, p) I. List.union (List.union i p) I) vs []\"\n\ndefinition enumerate_log_values :: \"log \\ value list\" where\n \"enumerate_log_values l = fold (\\e I. List.union (enumerate_exec_values e) I) l []\"\n\n(*This is where the types stuff originates*)\ndefinition generalise_and_update :: \"log \\ iEFSM \\ transition_group \\ iEFSM\" where\n \"generalise_and_update log e gp = (\n let\n label = Label (snd (hd gp));\n values = enumerate_log_values log;\n new_gp_ts = make_training_set e log gp;\n (I, R, P) = unzip_3 new_gp_ts;\n max_reg = max_reg_total e;\n outputs = get_outputs label max_reg values I R P\n in\n put_updates log values gp (enumerate 0 outputs) e\n )\"\n\ntext \\Splitting structural groups up into subgroups by previous transition can cause different\nsubgroups to get different updates. We ideally want structural groups to have the same output and\nupdate functions, as structural groups are likely to be instances of the same underlying behaviour.\\\ndefinition standardise_group :: \"iEFSM \\ log \\ transition_group \\ (iEFSM \\ log \\ transition_group \\ transition_group) \\ iEFSM\" where\n \"standardise_group e l gp s = (\n let\n standardised = s e l gp;\n e' = replace_transitions e standardised\n in\n if e' = e then e else\n if accepts_log (set l) (tm e') then e' else e\n)\"\n\nprimrec find_outputs :: \"output_function list list \\ iEFSM \\ log \\ transition_group \\ output_function list option\" where\n \"find_outputs [] _ _ _ = None\" |\n \"find_outputs (h#t) e l g = (\n let\n outputs = fold (\\(tids, t) acc. replace_transition acc tids (t\\Outputs := h\\)) g e\n in\n if accepts_log (set l) (tm outputs) then\n Some h\n else\n find_outputs t e l g\n )\"\n\nprimrec find_updates_outputs :: \"update_function list list \\ output_function list list \\ iEFSM \\ log \\ transition_group \\ (output_function list \\ update_function list) option\" where\n \"find_updates_outputs [] _ _ _ _ = None\" |\n \"find_updates_outputs (h#t) p e l g = (\n let\n updates = fold (\\(tids, t) acc. replace_transition acc tids (t\\Updates := h\\)) g e\n in\n case find_outputs p updates l (map (\\(id, t). (id,t\\Updates := h\\)) g) of\n Some pp \\ Some (pp, h) |\n None \\ find_updates_outputs t p e l g\n )\"\n\ndefinition updates_for :: \"update_function list \\ update_function list list\" where\n \"updates_for U = (\n let uf = fold (\\(r, u) f. f(r $:= u#(f $ r))) U (K$ []) in\n map (\\r. map (\\u. (r, u)) (uf $ r)) (finfun_to_list uf)\n )\"\n\ndefinition standardise_group_outputs_updates :: \"iEFSM \\ log \\ transition_group \\ transition_group\" where\n \"standardise_group_outputs_updates e l g = (\n let\n update_groups = product_lists (updates_for (remdups (List.maps (Updates \\ snd) g)));\n update_groups_subs = fold (List.union \\ subseqs) update_groups [];\n output_groups = product_lists (transpose (remdups (map (Outputs \\ snd) g)))\n in\n case find_updates_outputs update_groups_subs output_groups e l g of\n None \\ g |\n Some (p, u) \\ map (\\(id, t). (id, t\\Outputs := p, Updates := u\\)) g\n )\"\n\nfun find_first_use_of_trace :: \"nat \\ trace \\ iEFSM \\ cfstate \\ registers \\ tids option\" where\n \"find_first_use_of_trace _ [] _ _ _ = None\" |\n \"find_first_use_of_trace rr ((l, i, _)#es) e s r = (\n let\n (id, s', t) = fthe_elem (i_possible_steps e s r l i)\n in\n if (\\p \\ set (Outputs t). aexp_constrains p (V (R rr))) then\n Some id\n else\n find_first_use_of_trace rr es e s' (evaluate_updates t i r)\n )\"\n\ndefinition find_first_uses_of :: \"nat \\ log \\ iEFSM \\ tids list\" where\n \"find_first_uses_of r l e = List.maps (\\x. case x of None \\ [] | Some x \\ [x]) (map (\\t. find_first_use_of_trace r t e 0 <>) l)\"\n\nfun find_initialisation_of_trace :: \"nat \\ trace \\ iEFSM \\ cfstate \\ registers \\ (tids \\ transition) option\" where\n \"find_initialisation_of_trace _ [] _ _ _ = None\" |\n \"find_initialisation_of_trace r' ((l, i, _)#es) e s r = (\n let\n (tids, s', t) = fthe_elem (i_possible_steps e s r l i)\n in\n if (\\(rr, u) \\ set (Updates t). rr = r' \\ is_lit u) then\n Some (tids, t)\n else\n find_initialisation_of_trace r' es e s' (evaluate_updates t i r)\n )\"\n\nprimrec find_initialisation_of :: \"nat \\ iEFSM \\ log \\ (tids \\ transition) option list\" where\n \"find_initialisation_of _ _ [] = []\" |\n \"find_initialisation_of r e (h#t) = (\n case find_initialisation_of_trace r h e 0 <> of\n None \\ find_initialisation_of r e t |\n Some thing \\ Some thing#(find_initialisation_of r e t)\n )\"\n\ndefinition delay_initialisation_of :: \"nat \\ log \\ iEFSM \\ tids list \\ iEFSM\" where\n \"delay_initialisation_of r l e tids = fold (\\x e. case x of\n None \\ e |\n Some (i_tids, t) \\\n let\n origins = map (\\id. origin id e) tids;\n init_val = snd (hd (filter (\\(r', _). r = r') (Updates t)));\n e' = fimage (\\(id, (origin', dest), tr).\n \\ \\Add the initialisation update to incoming transitions\\\n if dest \\ set origins then\n (id, (origin', dest), tr\\Updates := List.insert (r, init_val) (Updates tr)\\)\n \\ \\Strip the initialisation update from the original initialising transition\\\n else if id = i_tids then\n (id, (origin', dest), tr\\Updates := filter (\\(r', _). r \\ r') (Updates tr)\\)\n else\n (id, (origin', dest), tr)\n ) e\n in\n \\ \\We don't want to update a register twice so just leave it\\\n if accepts_log (set l) (tm e') then\n e'\n else\n e\n ) (find_initialisation_of r e l) e\"\n\nfun groupwise_generalise_and_update :: \"log \\ iEFSM \\ transition_group list \\ iEFSM\" where\n \"groupwise_generalise_and_update _ e [] = e\" |\n \"groupwise_generalise_and_update log e (gp#t) = (\n let\n e' = generalise_and_update log e gp;\n rep = snd (hd (gp));\n structural_group = fimage (\\(i, _, t). (i, t)) (ffilter (\\(_, _, t). same_structure rep t) e');\n delayed = fold (\\r acc. delay_initialisation_of r log acc (find_first_uses_of r log acc)) (sorted_list_of_set (all_regs e')) e';\n standardised = standardise_group delayed log (sorted_list_of_fset structural_group) standardise_group_outputs_updates;\n structural_group2 = fimage (\\(_, _, t). (Outputs t, Updates t)) (ffilter (\\(_, _, t). Label rep = Label t \\ Arity rep = Arity t \\ length (Outputs rep) = length (Outputs t)) standardised)\n in\n \\ \\If we manage to standardise a structural group, we do not need to evolve outputs and\n updates for the other historical subgroups so can filter them out.\\\n if fis_singleton structural_group2 then\n groupwise_generalise_and_update log (merge_regs standardised (accepts_log (set log))) (filter (\\g. set g \\ fset structural_group = {}) t)\n else\n groupwise_generalise_and_update log (merge_regs standardised (accepts_log (set log))) t\n )\"\n\ndefinition drop_all_guards :: \"iEFSM \\ iEFSM \\ log \\ update_modifier \\ (iEFSM \\ nondeterministic_pair fset) \\ iEFSM\" where\n\"drop_all_guards e pta log m np = (let\n derestricted = fimage (\\(id, tf, tran). (id, tf, tran\\Guards := []\\)) e;\n nondeterministic_pairs = sorted_list_of_fset (np derestricted)\n in\n case resolve_nondeterminism {} nondeterministic_pairs pta derestricted m (accepts_log (set log)) np of\n (None, _) \\ pta |\n (Some resolved, _) \\ resolved\n )\"\n\ndefinition updated_regs :: \"transition \\ nat set\" where\n \"updated_regs t = set (map fst (Updates t))\"\n\ndefinition fewer_updates :: \"transition \\ transition fset \\ transition option\" where\n \"fewer_updates t tt = (\n let p = ffilter (\\t'. same_structure t t' \\ Outputs t = Outputs t' \\ updated_regs t' \\ updated_regs t) tt in\n if p = {||} then None else Some (snd (fMin (fimage (\\t. (length (Updates t), t)) p))))\"\n\nfun remove_spurious_updates_aux :: \"iEFSM \\ transition_group \\ transition fset \\ log \\ iEFSM\" where\n \"remove_spurious_updates_aux e [] _ _ = e\" |\n \"remove_spurious_updates_aux e ((tid, t)#ts) tt l = (\n case fewer_updates t tt of\n None \\ remove_spurious_updates_aux e ts tt l |\n Some t' \\ (\n let e' = replace_transition e tid t' in\n if accepts_log (set l) (tm e') then\n remove_spurious_updates_aux e' ts tt l\n else\n remove_spurious_updates_aux e ts tt l\n )\n )\"\n\n(* This goes through and tries to remove spurious updates that get introduced during preprocessing *)\ndefinition remove_spurious_updates :: \"iEFSM \\ log \\ iEFSM\" where\n \"remove_spurious_updates e l = (\n let transitions = fimage (\\(tid, _, t). (tid, t)) e in\n remove_spurious_updates_aux e (sorted_list_of_fset transitions) (fimage snd transitions) l\n )\"\n\ndefinition derestrict :: \"iEFSM \\ log \\ update_modifier \\ (iEFSM \\ nondeterministic_pair fset) \\ iEFSM\" where\n \"derestrict pta log m np = (\n let\n normalised = groupwise_generalise_and_update log pta (transition_groups pta log)\n in\n drop_all_guards normalised pta log m np\n )\"\n\ndefinition \"drop_pta_guards pta log m np = drop_all_guards pta pta log m np\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/heuristics/PTA_Generalisation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.29355732540343704}} {"text": "section \\ Idle and Active Relations \\\n\ntheory tcircus_idle\n imports tcircus_rel\nbegin\n\ndefinition filter_idle :: \"('s, 'e) taction \\ ('s, 'e) taction\" (\"idle'(_')\") where\n[upred_defs]: \"filter_idle P = U(R1(P \\ &tt \\ tocks UNIV))\"\n\ndefinition filter_time :: \"('s, 'e) taction \\ ('s, 'e) taction\" (\"time'(_')\") where\n[upred_defs]: \"filter_time P = U(R1(\\ $st\\ \\ \\ $pat\\ \\ \\ $ref\\ \\ P\\idleprefix(&tt)/&tt\\))\"\n\ndefinition filter_active :: \"('s, 'e) taction \\ ('s, 'e) taction\" (\"active'(_')\") where \n[upred_defs]: \"filter_active(P) = U(R1(\\ t e t'. P \\ \\t\\ \\ tocks UNIV \\ &tt = \\t @ (Evt e # t')\\))\"\n\nutp_const filter_idle filter_active\n\nlemma idle_TRR [closure]: assumes \"P is TRR\" shows \"idle(P) is TRR\"\nproof -\n have \"TRR(idle(TRR(P))) = idle(TRR(P))\" by rel_blast\n thus \"idle(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma active_TRR [closure]: assumes \"P is TRR\" shows \"active(P) is TRR\"\nproof -\n have \"TRR(active(TRR(P))) = active(TRR(P))\" by rel_blast\n thus \"active(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma time_TRR [closure]: assumes \"P is TRR\" shows \"time(P) is TRR\"\nproof -\n have \"TRR(time(TRR(P))) = time(TRR(P))\" by rel_blast\n thus \"time(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma \n assumes \"P is TRR\"\n shows \"(P \\ time(P)) is TIP\"\n apply (simp add: Healthy_def)\n apply (trr_auto cls: assms)\n oops\n\nlemma active_disj [rpred]: \"active(P \\ Q) = (active(P) \\ active(Q))\"\n by rel_auto\n\nlemma idle_conj [rpred]: \"idle(P \\ Q) = (idle(P) \\ idle(Q))\"\n by (rel_auto)\n\nlemma idle_disj [rpred]: \"idle(P \\ Q) = (idle(P) \\ idle(Q))\"\n by (rel_auto)\n\nlemma idle_idem [rpred]: \"idle(idle(P)) = idle(P)\"\n by rel_auto\n\nlemma idle_true': \"idle(true) = U(R1(&tt \\ tocks UNIV))\"\n by rel_auto\n\nlemma active_idem [rpred]: \"active(active(P)) = active(P)\"\n by rel_auto\n\nlemma TRR_idle_or_active [rpred]:\n assumes \"P is TRR\"\n shows \"(idle(P) \\ active(P)) = P\"\n by (trr_auto cls: assms)\n (metis hd_Cons_tl hd_activesuffix idle_active_decomp idleprefix_tocks rangeE tocks_Nil tocks_append)\n \nlemma refine_eval_dest: \"P \\ Q \\ \\Q\\\\<^sub>e s \\ \\P\\\\<^sub>e s\"\n by (rel_auto)\n\nlemma Healthy_after: \"\\ \\ i. P i is H \\ \\ H \\ P = P\"\n by (metis (mono_tags, lifting) Healthy_if fun.map_cong fun.map_id0 id_apply image_iff)\n \nlemma idle_skip [rpred]: \"idle(II\\<^sub>t) = II\\<^sub>t\"\n by (rel_auto)\n\nlemma idle_false [rpred]: \"idle(false) = false\"\n by (rel_auto)\n\nlemma time_disj [rpred]: \"time(P \\ Q) = (time(P) \\ time(Q))\"\n by (rel_auto)\n\nlemma TIP_has_time [rpred]:\n assumes \"P is TRR\" \"P is TIP\"\n shows \"(P \\ time(P)) = P\"\n apply (trr_auto cls: assms)\n apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n apply (rel_blast)\n done\n\nlemma TIP_time_active [rpred]:\n assumes \"P is TRR\" \"P is TIP\"\n shows \"(active(P) \\ time(P)) = active(P)\"\n apply (trr_auto cls: assms)\n apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n apply (rel_blast)\n done\n\nlemma TRF_time [closure]:\n \"P is TRR \\ time(P) is TRF\"\n by (rule TRF_intro, simp add: closure unrest, simp_all add: filter_time_def unrest)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/tockcircus/tcircus_idle.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.29355731834207455}} {"text": "theory Failures_TickTock_Hiding\n\nimports\n Failures_TickTock\nbegin\n(*\nlemma\n assumes \"\\ P Q. (s2w (opS P Q)) = (opW (s2w P) (s2w Q))\"\n \"\\ P. s2w (w2s P) = P\"\n shows \"(w2s (opW P Q)) = (opS (w2s P) (w2s Q))\"\nproof -\n have \"\\P Q. (s2w (opS P Q)) = (opW (s2w P) (s2w Q))\"\n using assms by auto\n then have \"(s2w (opS (w2s P) (w2s Q))) = (opW (s2w (w2s P)) (s2w (w2s Q)))\"\n by auto\n then have \"(s2w (opS (w2s P) (w2s Q))) = (opW P Q)\"\n using assms by auto\n then have \"(w2s (s2w (opS (w2s P) (w2s Q)))) = (w2s (opW P Q))\"\n by auto\n then have \"(opS (w2s P) (w2s Q)) = (w2s (opW P Q))\"\n using assms\n\n obtain p where p:\"p = (w2s P)\n\n then have \"\\ P Q. s2w (opS (w2s P) (w2s Q)) = (opW (s2w (w2s P)) (s2w (w2s Q)))\"\n using *)\n\n\n\nlemma ttproc2F_HideF_failures_subseteq_HidingTT:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\" \n shows \"fst ((ttproc2F P) \\\\<^sub>F HS) \\ fst (ttproc2F (P \\\\<^sub>C (ttevt2F`HS)))\" \n using assms unfolding ttproc2F_def HidingTT_def HideF_def\nproof (auto)\n fix b s y\n assume assm1:\"Some (s, b \\ HS) = tt2F y\"\n and assm2:\"y \\ P\"\n\n text \\ To proceed with the proof we need to remove HS, and keep b.\n This exists in P so long as P is TT1, because it is a subset refusal. \\\n\n then obtain z2 where z2:\"Some (s, b) = tt2F z2 \\ z2 \\ P\"\n using assm1 assm2 apply auto\n using Some_tt2F_subset TT1_P TT1_def by blast\n then have Some_z2:\"Some (s, b) = tt2F z2\"\n by auto\n\n text \\ Then we can pick any z, where filtering the trace based on Some(s,b)\n is equivalent to getting a failure via tt2F. \\\n\n then obtain z where z:\"tt2F z = Some (filter (\\e. e \\ HS) s, b)\"\n using Some_tt2F_exists_filter assm1 z2\n by metis\n\n text \\ Then it is sufficient to induce over the original hide_trace rule for the \n following predicate that doesn't mention P at all. \\\n \n have \"\\z. z \\ hide_trace (ttevt2F ` HS) y \\ Some (filter (\\e. e \\ HS) s, b) = tt2F z\"\n using assm1 z\n proof (induct \"(ttevt2F `HS)\" y arbitrary:b s z rule:hide_trace.induct)\n case 1\n then show ?case by auto\n next\n case (2 e xs) (* {t. (Event e \\ X \\ t \\ hide_trace X s) \n \\ (\\s'. Event e \\ X \\ s' \\ hide_trace X s \\ t = [Event e]\\<^sub>E # s')} *)\n have \"Some (s, b \\ HS) = tt2F ([Event e]\\<^sub>E # xs)\"\n using 2 by auto\n then have tt2F_xs:\"Some(tl s,b \\ HS) = tt2F xs\"\n by (simp add: Some_tt2F_event_tl)\n then have tt2T_tl_s:\"tt2T xs = tl s\"\n using Some_tt2F_imp_tt2T' by blast\n\n have \"s = tt2T ([Event e]\\<^sub>E # xs)\"\n using \"2.prems\"(1) Some_tt2F_imp_tt2T' by blast\n\n then have \"tt2T z = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # xs))\"\n using 2\n by (simp add: Some_tt2F_imp_tt2T')\n then have tt2T_z:\"tt2T z = filter (\\e. e \\ HS) (evt e # tt2T xs)\"\n by auto\n \n then show ?case using 2 \n proof (cases \"Event e \\ (ttevt2F ` HS)\")\n case True\n then have \"evt e \\ HS\"\n apply auto\n by (metis evt.exhaust ttevent.distinct(3) ttevent.inject ttevt2F.simps(1) ttevt2F.simps(2))\n then have \"tt2T z = filter (\\e. e \\ HS) (tt2T xs)\"\n using tt2T_z by simp\n then have \"tt2T z = filter (\\e. e \\ HS) (tl s)\"\n using tt2T_tl_s by simp\n then have \"\\z. z \\ hide_trace (ttevt2F ` HS) xs \\ Some (filter (\\e. e \\ HS) s, b) = tt2F z\"\n using 2 tt2F_xs \n using \\s = tt2T ([Event e]\\<^sub>E # xs)\\ \\tt2T z = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # xs))\\ by auto\n then show ?thesis\n by (simp add: True)\n next\n case False\n then have \"evt e \\ HS\"\n using image_iff by fastforce\n then have \"tt2T z = (evt e # (filter (\\e. e \\ HS) (tt2T xs)))\"\n by (simp add: tt2T_z)\n then have \"tt2T (tl z) = (filter (\\e. e \\ HS) (tt2T xs))\" and\n hd_z:\"hd z = [Event e]\\<^sub>E\"\n apply (simp add: tt2T_tl_evt)\n by (simp add: \\tt2T z = evt e # filter (\\e. e \\ HS) (tt2T xs)\\ tt2T_hd_evt)\n then have \"\\z. z \\ hide_trace (ttevt2F ` HS) xs \\ Some (filter (\\e. e \\ HS) (tl s), b) = tt2F z\"\n using 2 tt2F_xs tt2T_tl_s\n by (smt Some_tt2F_tail \\s = tt2T ([Event e]\\<^sub>E # xs)\\ \\tt2T z = evt e # filter (\\e. e \\ HS) (tt2T xs)\\ \\tt2T z = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # xs))\\)\n then have \"\\z. [Event e]\\<^sub>E # z \\ hide_trace (ttevt2F ` HS) ([Event e]\\<^sub>E # xs) \\ Some (filter (\\e. e \\ HS) s, b) = tt2F ([Event e]\\<^sub>E # z)\"\n using hd_z apply auto\n using False\n by (metis (mono_tags, lifting) \\s = tt2T ([Event e]\\<^sub>E # xs)\\ \\tt2T z = evt e # filter (\\e. e \\ HS) (tt2T xs)\\ \\tt2T z = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # xs))\\ eq_fst_iff eq_snd_iff option.simps(5) tt2T_tl_s)\n then have \"\\z. z \\ hide_trace (ttevt2F ` HS) ([Event e]\\<^sub>E # xs) \\ Some (filter (\\e. e \\ HS) s, b) = tt2F z\"\n by (metis \\tt2T z = evt e # filter (\\e. e \\ HS) (tt2T xs)\\ hd_z list.distinct(1) list.exhaust_sel tt2T.simps(3))\n then show ?thesis \n using hd_z by auto\n qed\n next\n case 3\n then show ?case by auto\n next\n case (4 Y s)\n then show ?case by auto\n next\n case (5 Y)\n then have \"s = []\"\n using Some_tt2F_imp_tt2T' tt2T.simps(5) by blast\n then obtain Z where Z:\"z = [[Z]\\<^sub>R] \\ ttevt2F`b \\ Z\"\n using 5 apply auto\n by (metis (no_types, lifting) image_Collect_subsetI old.prod.inject option.inject tt2F.simps(1) tt2F_some_exists)\n show ?case using 5\n proof (cases \"(ttevt2F ` (b \\ HS)) \\ Y\")\n case True\n then show ?thesis using 5 Z\n apply auto\n by (rule_tac x=\"[[(ttevt2F`b)]\\<^sub>R]\" in exI, auto)\n next\n case False\n then show ?thesis using 5 Z \n by auto\n qed\n next\n case (6 t)\n then show ?case by auto\n next\n case (7 Y e t)\n then show ?case by auto\n next\n case (8 Y t)\n then show ?case by auto\n next\n case (9 Y Z t)\n then show ?case by auto\n next\n case (10 x t)\n then show ?case by auto\n qed\n\n then have \"\\z. Some (filter (\\e. e \\ HS) s, b) = tt2F z \\ (\\x. x = hide_trace (ttevt2F ` HS) y \\ y \\ P \\ z \\ x)\"\n using assm2 assm1 z\n by blast\n then show \"\\y. Some (filter (\\e. e \\ HS) s, b) = tt2F y \\ (\\x. (\\p. x = hide_trace (ttevt2F ` HS) p \\ p \\ P) \\ y \\ x)\"\n by auto\nqed\n\nlemma ttproc2F_HidingTT_failures_subseteq_HideF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n shows \"fst (ttproc2F (P \\\\<^sub>C (ttevt2F`HS))) \\ fst ((ttproc2F P) \\\\<^sub>F HS)\" \n using assms unfolding ttproc2F_def HidingTT_def HideF_def\nproof (auto)\n fix a b y p\n assume assm1:\"Some (a, b) = tt2F y\"\n and assm2:\"y \\ hide_trace (ttevt2F ` HS) p\"\n and assm3:\"p \\ P\"\n\n text \\ Key to doing this proof without using p \\ P is to use p\n and focus on showing that some prefix of it exists that\n satisfies the condition. \\\n \n have \"\\s. (\\r. Some (s, b \\ HS) = tt2F r \\ r \\\\<^sub>C p) \\ a = filter (\\e. e \\ HS) s\"\n using assm1 assm2\n proof (induct \"(ttevt2F ` HS)\" p arbitrary:y a b rule:hide_trace.induct)\n case (1 X)\n then show ?case by auto\n next\n case (2 X e s)\n then show ?case\n proof (cases \"Event X \\ (ttevt2F ` HS)\")\n case True\n then have evt_X:\"evt X \\ HS\"\n by (metis (no_types, hide_lams) evt.exhaust imageE ttevent.inject ttevent.simps(5) ttevt2F.simps(1) ttevt2F.simps(2))\n then have \"s \\ hide_trace (ttevt2F ` HS) e\"\n using 2 True by auto\n then have \"\\s. (\\r. Some (s, b \\ HS) = tt2F r \\ r \\\\<^sub>C e) \\ a = filter (\\e. e \\ HS) s\"\n using 2 by auto\n then have \"\\s. (\\r. Some (evt X # s, b \\ HS) = tt2F ([Event X]\\<^sub>E # r) \\ r \\\\<^sub>C e) \\ a = filter (\\e. e \\ HS) (evt X # s)\"\n using True evt_X apply auto\n by (metis (no_types, lifting) fst_conv option.simps(5) snd_conv)\n then show ?thesis \n using tt_prefix_subset.simps(3) by blast\n next\n case False \n then have \"evt X \\ HS\"\n using image_iff by fastforce\n then have tl_s:\"(tl s) \\ hide_trace (ttevt2F ` HS) e\"\n using 2 False by auto\n\n then obtain ax where ax_bx:\"Some (ax, b) = tt2F (tl s) \\ evt X # ax = a\"\n using \"2.prems\"(1) \"2.prems\"(2) False Some_tt2F_event_tl\n proof -\n assume a1: \"\\ax. Some (ax, b) = tt2F (tl s) \\ evt X # ax = a \\ thesis\"\n have \"tt2T s = a\"\n using \"2.prems\"(1) Some_tt2F_imp_tt2T' by blast\n then show ?thesis\n using a1 \"2.prems\"(1) \"2.prems\"(2) False Some_tt2F_event_tl by fastforce\n qed\n then have \"\\s. (\\r. Some (s, b \\ HS) = tt2F r \\ r \\\\<^sub>C e) \\ ax = filter (\\e. e \\ HS) s\"\n using 2 tl_s by auto\n then have \"\\s. (\\r. Some (s, b \\ HS) = tt2F ([Event X]\\<^sub>E # r) \\ r \\\\<^sub>C e) \\ (evt X # ax) = filter (\\e. e \\ HS) s\"\n using 2 False\n by (smt \\evt X \\ HS\\ filter.simps(2) fst_conv option.simps(5) snd_conv tt2F.simps(2))\n then show ?thesis using ax_bx\n using tt_prefix_subset.simps(3) by blast\n qed\n next\n case (3 X)\n then show ?case by auto\n next\n case (4 X Y s)\n have \"Tock \\ (ttevt2F ` HS)\"\n apply auto\n by (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n then have \"tt2F s = None\"\n using 4 by auto\n then show ?case\n using 4 by auto\n next\n case (5 X Y)\n then have \"a = []\"\n using 5 by auto\n then obtain Z where Z:\"Y = [[Z]\\<^sub>R] \\ ttevt2F`(b) \\ Z\" (* {t. \\ Z\\Y. X \\ Y \\ t = [[Z]\\<^sub>R]} *)\n using 5 apply simp\n apply safe \n by auto\n then show ?case using 5\n proof (cases \"(ttevt2F ` HS) \\ X\")\n case True\n have \"(ttevt2F ` (b \\ HS)) \\ X\"\n using 5 Z by auto\n have \"Some (a, b) = tt2F [[Z]\\<^sub>R] \\ a = filter (\\e. e \\ HS) a\"\n using 5 Z by auto\n then have \"Some (a, (b \\ HS)) = tt2F [[Z \\ ttevt2F`HS]\\<^sub>R] \\ a = filter (\\e. e \\ HS) a\"\n using 5 Z apply auto\n using Some_tt2F_set by fastforce\n then show ?thesis using 5 Z\n apply auto\n by (metis (no_types, lifting) \\Some (a, b \\ HS) = tt2F [[Z \\ ttevt2F ` HS]\\<^sub>R] \\ a = filter (\\e. e \\ HS) a\\ sup.absorb_iff2 sup_assoc tt_prefix_subset.simps(2) tt_prefix_subset_refl)\n next\n case False\n then show ?thesis using 5 by auto\n qed \n next\n case (6 X t)\n then show ?case by auto\n next\n case (7 X Y e t)\n then show ?case by auto\n next\n case (8 X Y t)\n then show ?case by auto\n next\n case (9 X Y Z t)\n then show ?case by auto\n next\n case (10 X x t)\n then show ?case by auto\n qed\n\n then show \"\\s. (\\y. Some (s, b \\ HS) = tt2F y \\ y \\ P) \\ a = filter (\\e. e \\ HS) s\"\n using assm3 TT1_P TT1_def by blast\nqed\n\nlemma ttproc2F_HideF_traces_subseteq_HidingTT:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n shows \"snd ((ttproc2F P) \\\\<^sub>F HS) \\ snd (ttproc2F (P \\\\<^sub>C (ttevt2F`HS)))\" \n using assms unfolding ttproc2F_def HidingTT_def HideF_def\nproof(auto)\n fix y\n assume assm1:\"y \\ P\"\n\n have \"ttWF y\"\n using TTwf_P TTwf_def assm1 by blast\n\n then have \"\\z r. filter (\\e. e \\ HS) (tt2T y) = tt2T z \\ z \\ hide_trace (ttevt2F ` HS) r \\ r \\\\<^sub>C y\"\n proof (induct \"(ttevt2F `HS)\" y rule:hide_trace.induct)\n case 1\n then show ?case \n by (rule_tac x=\"[]\" in exI, auto)+\n next\n case (2 e s)\n then have hyp:\"\\z r. filter (\\e. e \\ HS) (tt2T s) = tt2T z \\ z \\ hide_trace (ttevt2F ` HS) r \\ r \\\\<^sub>C s\"\n by auto\n \n then show ?case\n proof (cases \"Event e \\ (ttevt2F ` HS)\")\n case True\n then have \"\\z r. filter (\\e. e \\ HS) (tt2T s) = tt2T z \\ z \\ hide_trace (ttevt2F ` HS) ([Event e]\\<^sub>E # r) \\ [Event e]\\<^sub>E # r \\\\<^sub>C [Event e]\\<^sub>E # s\"\n using hyp by auto\n then have \"\\z r. filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # s)) = tt2T z \\ z \\ hide_trace (ttevt2F ` HS) ([Event e]\\<^sub>E # r) \\ [Event e]\\<^sub>E # r \\\\<^sub>C [Event e]\\<^sub>E # s\"\n using True\n by (smt evt.exhaust filter.simps(2) imageE tt2T.simps(2) ttevent.distinct(3) ttevt2F.simps(1) ttevt2F.simps(2))\n then show ?thesis using 2 by blast\n next\n case False\n then have \"\\z r. filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # s)) = tt2T ([Event e]\\<^sub>E # z) \\ ([Event e]\\<^sub>E # z) \\ hide_trace (ttevt2F ` HS) ([Event e]\\<^sub>E # r) \\ [Event e]\\<^sub>E # r \\\\<^sub>C [Event e]\\<^sub>E # s\"\n using hyp apply auto\n by (simp add: rev_image_eqI)\n then show ?thesis by blast\n qed\n next\n case 3\n then show ?case\n apply auto\n apply (smt evt.exhaust hide_trace.simps(3) image_iff mem_Collect_eq tt2T.simps(1) tt_prefix_subset_refl ttevent.distinct(3) ttevt2F.simps(1))\n by (metis filter.simps(1) hide_trace.simps(1) lists.Nil lists_empty tt2T.simps(3) tt_prefix_subset.simps(1))\n \n next\n case (4 Y s)\n then show ?case\n proof (cases \"Tock \\ (ttevt2F ` HS)\")\n case True\n then show ?thesis\n by (metis evt.exhaust image_iff ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n next\n case False\n then show ?thesis \n using 4 False apply auto\n apply (rule_tac x=\"[]\" in exI, simp)\n by (rule_tac x=\"[]\" in exI, simp)\n qed\n \n next\n case (5 Y)\n then show ?case\n by (rule_tac x=\"[]\" in exI, simp)+\n next\n case (6 t)\n then show ?case by auto\n next\n case (7 Y e t)\n then show ?case by auto\n next\n case (8 Y t)\n then show ?case by auto\n next\n case (9 Y Z t)\n then show ?case by auto\n next\n case (10 x t)\n then show ?case by auto\n qed\n\n then show \"\\ya. filter (\\e. e \\ HS) (tt2T y) = tt2T ya \\ (\\x. (\\p. x = hide_trace (ttevt2F ` HS) p \\ p \\ P) \\ ya \\ x)\"\n using assm1 \n using TT1_P TT1_def by blast\nqed \n\nlemma ttproc2F_HidingTT_traces_subseteq_HideF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n shows \"snd (ttproc2F (P \\\\<^sub>C (ttevt2F`HS))) \\ snd ((ttproc2F P) \\\\<^sub>F HS)\" \n using assms unfolding ttproc2F_def HidingTT_def HideF_def\nproof (auto)\n fix y p\n assume assm1:\"y \\ hide_trace (ttevt2F ` HS) p\"\n and assm2:\"p \\ P\"\n\n have \"\\r. tt2T y = filter (\\e. e \\ HS) (tt2T r) \\ r \\\\<^sub>C p\"\n using assm1\n proof (induct \"(ttevt2F ` HS)\" p arbitrary:y rule:hide_trace.induct)\n case 1\n then show ?case\n apply auto\n by (rule_tac x=\"[]\" in exI, auto)+\n next\n case (2 e s)\n then show ?case\n proof (cases \"Event e \\ (ttevt2F ` HS)\")\n case True\n then have evt_HS:\"evt e \\ HS\"\n by (metis (no_types, hide_lams) evt.exhaust imageE ttevent.inject ttevent.simps(5) ttevt2F.simps(1) ttevt2F.simps(2))\n then have \"y \\ hide_trace (ttevt2F ` HS) s\"\n using 2 True by auto\n \n then have \"\\r. tt2T y = filter (\\e. e \\ HS) (tt2T r) \\ r \\\\<^sub>C s\"\n using 2 by auto\n then have \"\\r. tt2T y = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # r)) \\ ([Event e]\\<^sub>E # r) \\\\<^sub>C [Event e]\\<^sub>E # s\"\n by (simp add: evt_HS)\n then show ?thesis by blast\n next\n case False\n then have evt_no_HS:\"evt e \\ HS\"\n using image_iff by fastforce\n then have tl_s:\"(tl y) \\ hide_trace (ttevt2F ` HS) s\"\n using 2 False by auto\n then have \"\\r. tt2T (tl y) = filter (\\e. e \\ HS) (tt2T r) \\ r \\\\<^sub>C s\"\n using 2 by auto\n then have \"\\r. tt2T ([Event e]\\<^sub>E # (tl y)) = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # r)) \\ ([Event e]\\<^sub>E # r) \\\\<^sub>C ([Event e]\\<^sub>E # s)\"\n by (simp add: evt_no_HS)\n then show ?thesis\n proof -\n have \"y = [Event e]\\<^sub>E # tl y\"\n using \"2.prems\" False by auto\n then show ?thesis\n by (metis (full_types) \\\\r. tt2T ([Event e]\\<^sub>E # tl y) = filter (\\e. e \\ HS) (tt2T ([Event e]\\<^sub>E # r)) \\ [Event e]\\<^sub>E # r \\\\<^sub>C [Event e]\\<^sub>E # s\\)\n qed\n qed\n next\n case 3\n then show ?case\n by (smt filter.simps(1) filter.simps(2) hide_trace.simps(3) image_eqI mem_Collect_eq tt2T.simps(1) tt2T.simps(3) tt_prefix_subset.simps(1) tt_prefix_subset_refl ttevt2F.simps(2))\n next\n case (4 Y s)\n then show ?case\n apply auto\n apply (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n by (rule_tac x=\"[]\" in exI, auto)\n next\n case (5 Y)\n then show ?case\n apply auto\n by (rule_tac x=\"[]\" in exI, auto)\n next\n case (6 t)\n then show ?case by auto\n next\n case (7 Y e t)\n then show ?case by auto\n next\n case (8 Y t)\n then show ?case by auto\n next\n case (9 Y Z t)\n then show ?case by auto\n next\n case (10 x t)\n then show ?case by auto\n qed\n\n then show \"\\z. tt2T y = filter (\\e. e \\ HS) z \\ (\\y. z = tt2T y \\ y \\ P)\"\n using TT1_P TT1_def assm2 by blast\nqed\n\nlemma ttproc2F_HidingTT_eq_HideF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n shows \"ttproc2F (P \\\\<^sub>C (ttevt2F`HS)) = (ttproc2F P) \\\\<^sub>F HS\" \n by (metis (no_types, lifting) HideF_def TT0_P TT1_P TTwf_P fst_conv snd_conv subset_antisym ttproc2F_HideF_failures_subseteq_HidingTT ttproc2F_HideF_traces_subseteq_HidingTT ttproc2F_HidingTT_failures_subseteq_HideF ttproc2F_HidingTT_traces_subseteq_HideF ttproc2F_def)\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures_TickTock_Hiding.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.29355731128071205}} {"text": "section \\Implementation of Heaps by Arrays\\\ntheory IICF_Impl_Heapmap\nimports IICF_Abs_Heapmap \"../IICF_Indexed_Array_List\"\nbegin\n\n(* TODO/FIXME: Division setup of the code generator is a mess.\n TODO: Why does [code_unfold] not work to rewrite \"x div 2\"?\n*)\ntext \\Some setup to circumvent the really inefficient implementation \n of division in the code generator, which has to consider several\n cases for negative divisors and dividends. \\\ndefinition [code_unfold]: \n \"efficient_nat_div2 n \n \\ nat_of_integer (fst (Code_Numeral.divmod_abs (integer_of_nat n) 2))\"\n\nlemma efficient_nat_div2[simp]: \"efficient_nat_div2 n = n div 2\"\n by (simp add: efficient_nat_div2_def nat_of_integer.rep_eq)\n\n type_synonym 'v hma = \"nat list \\ ('v list)\"\n sepref_decl_intf 'v i_hma is \"nat list \\ (nat \\ 'v)\"\n\n locale hmstruct_impl = hmstruct prio for prio :: \"'v::heap \\ 'p::linorder\"\n begin\n lemma param_prio: \"(prio,prio) \\ Id \\ Id\" by simp\n lemmas [sepref_import_param] = param_prio\n sepref_register prio\n end\n\n context\n fixes maxsize :: nat\n fixes prio :: \"'v::heap \\ 'p::linorder\"\n notes [map_type_eqs] = map_type_eqI[Pure.of \"TYPE((nat,'v) ahm)\" \"TYPE('v i_hma)\"]\n begin\n\n interpretation hmstruct .\n interpretation hmstruct_impl .\n \n definition \"hm_impl1_\\ \\ \\(pq,ml). \n (pq,\\k. if k\\set pq then Some (ml!k) else None)\"\n\n definition \"hm_impl1_invar \\ \\(pq,ml). \n hmr_invar (hm_impl1_\\ (pq,ml))\n \\ set pq \\ {0.. ((pq=[] \\ ml=[]) \\ (length ml = maxsize))\" \n\n definition \"hm_impl1_weak_invar \\ \\(pq,ml). \n set pq \\ {0.. ((pq=[] \\ ml=[]) \\ (length ml = maxsize))\" \n\n definition \"hm_impl1_rel \\ br hm_impl1_\\ hm_impl1_invar\"\n definition \"hm_weak_impl'_rel \\ br hm_impl1_\\ hm_impl1_weak_invar\"\n\n\n lemmas hm_impl1_rel_defs = \n hm_impl1_rel_def hm_weak_impl'_rel_def hm_impl1_weak_invar_def hm_impl1_invar_def hm_impl1_\\_def in_br_conv\n \n\n lemma hm_impl_\\_fst_eq: \n \"(x1, x2) = hm_impl1_\\ (x1a, x2a) \\ x1 = x1a\"\n unfolding hm_impl1_\\_def by (auto split: if_split_asm)\n\n\n term hm_empty_op \n definition hm_empty_op' :: \"'v hma nres\" \n where \"hm_empty_op' \\ do {\n let pq = op_ial_empty_sz maxsize;\n let ml = op_list_empty;\n RETURN (pq,ml)\n }\"\n\n\n lemma hm_empty_op'_refine: \"(hm_empty_op', hm_empty_op) \\ \\hm_impl1_rel\\nres_rel\" \n apply (intro fun_relI nres_relI)\n unfolding hm_empty_op'_def hm_empty_op_def hm_impl1_rel_defs \n by (auto simp: in_br_conv)\n\n definition hm_length' :: \"'v hma \\ nat\" where \"hm_length' \\ \\(pq,ml). length pq\"\n\n lemma hm_length'_refine: \"(RETURN o hm_length',RETURN o hm_length) \\ hm_impl1_rel \\ \\nat_rel\\nres_rel\"\n apply (intro fun_relI nres_relI)\n unfolding hm_length'_def hm_length_def hm_impl1_rel_defs\n by (auto)\n \n term hm_key_of_op \n definition \"hm_key_of_op' \\ \\(pq,ml) i. ASSERT (i>0) \\ mop_list_get pq (i - 1)\"\n lemma hm_key_of_op'_refine: \"(hm_key_of_op', hm_key_of_op) \\ hm_impl1_rel \\ nat_rel \\ \\nat_rel\\nres_rel\"\n apply (intro fun_relI nres_relI)\n unfolding hm_key_of_op'_def hm_key_of_op_def hm_impl1_rel_defs\n by (auto)\n\n term hm_lookup \n definition \"hm_lookup_op' \\ \\(pq,ml) k. do {\n if (k \\TODO: This check can be eliminated, but this will complicate refinement of keys in basic ops\\\n let c = op_list_contains k pq;\n if c then do {\n v \\ mop_list_get ml k;\n RETURN (Some v)\n } else RETURN None\n } else RETURN None \n }\"\n \n lemma hm_lookup_op'_refine: \"(uncurry hm_lookup_op', uncurry (RETURN oo hm_lookup)) \n \\ (hm_impl1_rel \\\\<^sub>r nat_rel) \\\\<^sub>f \\\\Id\\option_rel\\nres_rel\"\n apply (intro frefI nres_relI)\n unfolding hm_lookup_op_def hm_lookup_op'_def o_def uncurry_def\n apply refine_vcg\n apply (auto simp: hm_impl1_rel_defs heapmap_\\_def hmr_invar_def)\n done\n\n term hm_contains_key_op \n definition \"hm_contains_key_op' \\ \\k (pq,ml). do {\n if (k \\TODO: This check can be eliminated, but this will complicate refinement of keys in basic ops\\\n RETURN (op_list_contains k pq)\n } else RETURN False \n }\"\n \n lemma hm_contains_key_op'_refine: \"(uncurry hm_contains_key_op', uncurry hm_contains_key_op) \n \\ (nat_rel \\\\<^sub>r hm_impl1_rel) \\\\<^sub>f \\bool_rel\\nres_rel\"\n apply (intro frefI nres_relI)\n unfolding hm_contains_key_op_def hm_contains_key_op'_def o_def uncurry_def PR_CONST_def\n apply refine_vcg\n apply (auto simp: hm_impl1_rel_defs heapmap_\\_def hmr_invar_def)\n done\n\n\n term hm_valid \n\n definition \"hm_exch_op' \\ \\(pq,ml) i j. do {\n ASSERT (hm_valid (hm_impl1_\\ (pq,ml)) i);\n ASSERT (hm_valid (hm_impl1_\\ (pq,ml)) j);\n pq \\ mop_list_swap pq (i - 1) (j - 1);\n RETURN (pq,ml)\n }\"\n\n lemma hm_impl1_relI:\n assumes \"hmr_invar b\"\n assumes \"(a,b)\\hm_weak_impl'_rel\"\n shows \"(a,b)\\hm_impl1_rel\"\n using assms\n unfolding hmr_rel_def hm_impl1_rel_def hm_weak_impl'_rel_def in_br_conv\n hm_impl1_weak_invar_def hm_impl1_invar_def\n by auto\n\n lemma hm_impl1_nres_relI:\n assumes \"b \\\\<^sub>n SPEC hmr_invar\"\n assumes \"(a,b)\\\\hm_weak_impl'_rel\\nres_rel\"\n shows \"(a,b)\\\\hm_impl1_rel\\nres_rel\"\n using assms hm_impl1_relI\n apply (auto simp: pw_le_iff pw_leof_iff refine_pw_simps in_br_conv nres_rel_def)\n apply blast\n done\n\n\n lemma hm_exch_op'_refine: \"(hm_exch_op', hm_exch_op) \\ hm_impl1_rel \\ nat_rel \\ nat_rel \\ \\hm_impl1_rel\\nres_rel\"\n apply (intro fun_relI hm_impl1_nres_relI[OF hm_exch_op_invar])\n unfolding hm_exch_op'_def hm_exch_op_def\n apply (auto simp: pw_le_iff refine_pw_simps nres_rel_def\n hm_impl1_rel_def in_br_conv split: prod.splits)\n apply (auto simp: hm_impl1_\\_def)\n unfolding hm_impl1_rel_defs\n apply auto\n done\n\n\n term hm_index_op \n\n definition \"hm_index_op' \\ \\(pq,ml) k. \n do {\n ASSERT (hm_impl1_invar (pq,ml) \\ heapmap_\\ (hm_impl1_\\ (pq,ml)) k \\ None \\ k\\set pq);\n i \\ mop_list_index pq k;\n RETURN (i+1)\n }\"\n lemma hm_index_op'_refine: \"(hm_index_op',hm_index_op) \n \\ hm_impl1_rel \\ nat_rel \\ \\nat_rel\\nres_rel\" \n apply (intro fun_relI nres_relI)\n unfolding hm_index_op'_def hm_index_op_def hm_impl1_rel_defs\n apply (auto simp: pw_le_iff refine_pw_simps heapmap_\\_def split: if_split_asm)\n done\n\n definition hm_update_op' where\n \"hm_update_op' \\ \\(pq,ml) i v. do {\n ASSERT (hm_valid (hm_impl1_\\ (pq,ml)) i \\ hm_impl1_invar (pq,ml));\n k \\ mop_list_get pq (i - 1);\n ml \\ mop_list_set ml k v;\n RETURN (pq, ml)\n }\"\n lemma hm_update_op'_refine: \"(hm_update_op', hm_update_op) \\ hm_impl1_rel \\ nat_rel \\ Id \\ \\hm_impl1_rel\\nres_rel\" \n apply (intro fun_relI hm_impl1_nres_relI[OF hm_update_op_invar])\n unfolding hm_update_op'_def hm_update_op_def\n apply (auto simp: pw_le_iff refine_pw_simps nres_rel_def\n hm_impl1_rel_def in_br_conv split: prod.splits)\n apply (auto simp: hm_impl1_\\_def)\n unfolding hm_impl1_rel_defs\n apply (auto simp: subset_code(1))\n done\n \n \n term hm_butlast_op \n\n lemma hm_butlast_op_invar: \"hm_butlast_op hm \\\\<^sub>n SPEC hmr_invar\"\n unfolding hm_butlast_op_def h.butlast_op_def\n apply refine_vcg\n apply (clarsimp_all simp: hmr_rel_defs map_butlast distinct_butlast)\n apply safe\n\n apply (auto simp: in_set_conv_nth nth_butlast) []\n apply (metis Suc_pred len_greater_imp_nonempty length_greater_0_conv less_antisym)\n \n apply (auto dest: in_set_butlastD) []\n\n apply (metis One_nat_def append_butlast_last_id distinct_butlast last_conv_nth not_distinct_conv_prefix)\n done\n\n\n definition hm_butlast_op' where\n \"hm_butlast_op' \\ \\(pq,ml). do {\n ASSERT (hmr_invar (hm_impl1_\\ (pq,ml)));\n pq \\ mop_list_butlast pq;\n RETURN (pq,ml)\n }\"\n\n lemma set_butlast_distinct_conv: \n \"\\distinct l\\ \\ set (butlast l) = set l - {last l}\" \n by (cases l rule: rev_cases; auto)\n\n lemma hm_butlast_op'_refine: \"(hm_butlast_op', hm_butlast_op) \\ hm_impl1_rel \\ \\hm_impl1_rel\\nres_rel\" \n apply (intro fun_relI hm_impl1_nres_relI[OF hm_butlast_op_invar])\n unfolding hm_butlast_op'_def hm_butlast_op_def\n apply (auto simp: pw_le_iff refine_pw_simps nres_rel_def\n hm_impl1_rel_def in_br_conv split: prod.splits)\n apply (auto simp: hm_impl1_\\_def)\n unfolding hm_impl1_rel_defs\n apply (auto simp: restrict_map_def) []\n\n defer\n\n apply (auto dest: in_set_butlastD) []\n apply (auto intro!: ext \n simp: hmr_invar_def set_butlast_distinct_conv last_conv_nth\n dest: in_set_butlastD) []\n done\n\n definition hm_append_op' \n where \"hm_append_op' \\ \\(pq,ml) k v. do {\n ASSERT (k \\ set pq \\ k mop_list_append pq k;\n ml \\ (if length ml = 0 then mop_list_replicate maxsize v else RETURN ml);\n ml \\ mop_list_set ml k v;\n RETURN (pq,ml)\n }\"\n\n lemma hm_append_op'_refine: \"(uncurry2 hm_append_op', uncurry2 hm_append_op) \n \\ [\\((hm,k),v). kf (hm_impl1_rel \\\\<^sub>r nat_rel) \\\\<^sub>r Id \\ \\hm_impl1_rel\\nres_rel\" \n apply (intro frefI hm_impl1_nres_relI[OF hm_append_op_invar])\n unfolding hm_append_op'_def hm_append_op_def\n apply (auto simp: pw_le_iff refine_pw_simps nres_rel_def\n hm_impl1_rel_def in_br_conv split: prod.splits)\n unfolding hm_impl1_rel_defs\n apply (auto simp: restrict_map_def hmr_invar_def split: prod.splits if_split_asm) \n done\n \n definition \"hm_impl2_rel \\ prod_assn (ial_assn maxsize id_assn) (array_assn id_assn)\"\n definition \"hm_impl_rel \\ hr_comp hm_impl2_rel hm_impl1_rel\"\n\n lemmas [fcomp_norm_unfold] = hm_impl_rel_def[symmetric]\n\n (*lemma hm_impl_rel_precise[constraint_rules]: \"precise hm_impl_rel\"\n unfolding hm_impl_rel_def hm_impl1_rel_def hm_impl2_rel_def\n by (constraint_rules)*)\n\n\n subsection \\Implement Basic Operations\\ \n\n\n lemma param_parent: \"(efficient_nat_div2,h.parent) \\ Id \\ Id\" \n by (intro fun_relI) (simp add: h.parent_def)\n lemmas [sepref_import_param] = param_parent\n sepref_register h.parent\n\n lemma param_left: \"(h.left,h.left) \\ Id \\ Id\" by simp\n lemmas [sepref_import_param] = param_left\n sepref_register h.left\n\n lemma param_right: \"(h.right,h.right) \\ Id \\ Id\" by simp\n lemmas [sepref_import_param] = param_right\n sepref_register h.right\n\n abbreviation (input) \"prio_rel \\ (Id::('p\\'p) set)\"\n\n lemma param_prio_le: \"((\\), (\\)) \\ prio_rel \\ prio_rel \\ bool_rel\" by simp\n lemmas [sepref_import_param] = param_prio_le\n \n lemma param_prio_lt: \"((<), (<)) \\ prio_rel \\ prio_rel \\ bool_rel\" by simp\n lemmas [sepref_import_param] = param_prio_lt\n\n abbreviation \"I_HM_UNF \\ TYPE(nat list \\ 'v list)\"\n\n sepref_definition hm_length_impl is \"RETURN o hm_length'\" :: \"hm_impl2_rel\\<^sup>k\\\\<^sub>anat_assn\"\n unfolding hm_length'_def hm_impl2_rel_def\n by sepref\n lemmas [sepref_fr_rules] = hm_length_impl.refine[FCOMP hm_length'_refine]\n sepref_register \"hm_length::(nat,'v) ahm \\ _\"\n\n sepref_definition hm_key_of_op_impl is \"uncurry hm_key_of_op'\" :: \"hm_impl2_rel\\<^sup>k*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>anat_assn\"\n unfolding hm_key_of_op'_def hm_impl2_rel_def\n by sepref\n lemmas [sepref_fr_rules] = hm_key_of_op_impl.refine[FCOMP hm_key_of_op'_refine]\n sepref_register \"hm_key_of_op::(nat,'v) ahm \\ _\"\n\n context \n notes [id_rules] = itypeI[Pure.of maxsize \"TYPE(nat)\"]\n notes [sepref_import_param] = IdI[of maxsize]\n begin\n\n\n sepref_definition hm_lookup_impl is \"uncurry hm_lookup_op'\" :: \"(hm_impl2_rel\\<^sup>k*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>aoption_assn id_assn)\"\n unfolding hm_lookup_op'_def hm_impl2_rel_def\n by sepref\n lemmas [sepref_fr_rules] = \n hm_lookup_impl.refine[FCOMP hm_lookup_op'_refine]\n sepref_register \"hm_lookup::(nat,'v) ahm \\ _\" \n\n sepref_definition hm_exch_op_impl is \"uncurry2 hm_exch_op'\" :: \"hm_impl2_rel\\<^sup>d*\\<^sub>anat_assn\\<^sup>k*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>a hm_impl2_rel\"\n unfolding hm_exch_op'_def hm_impl2_rel_def\n by sepref\n lemmas [sepref_fr_rules] = hm_exch_op_impl.refine[FCOMP hm_exch_op'_refine]\n sepref_register \"hm_exch_op::(nat,'v) ahm \\ _\" \n\n sepref_definition hm_index_op_impl is \"uncurry hm_index_op'\" :: \"hm_impl2_rel\\<^sup>k*\\<^sub>aid_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding hm_index_op'_def hm_impl2_rel_def \n by sepref\n lemmas [sepref_fr_rules] = hm_index_op_impl.refine[FCOMP hm_index_op'_refine]\n sepref_register \"hm_index_op::(nat,'v) ahm \\ _\" \n\n sepref_definition hm_update_op_impl is \"uncurry2 hm_update_op'\" :: \"hm_impl2_rel\\<^sup>d*\\<^sub>aid_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k \\\\<^sub>a hm_impl2_rel\"\n unfolding hm_update_op'_def hm_impl2_rel_def \n by sepref\n lemmas [sepref_fr_rules] = hm_update_op_impl.refine[FCOMP hm_update_op'_refine]\n sepref_register \"hm_update_op::(nat,'v) ahm \\ _\" \n\n\n sepref_definition hm_butlast_op_impl is \"hm_butlast_op'\" :: \"hm_impl2_rel\\<^sup>d \\\\<^sub>a hm_impl2_rel\"\n unfolding hm_butlast_op'_def hm_impl2_rel_def by sepref\n lemmas [sepref_fr_rules] = hm_butlast_op_impl.refine[FCOMP hm_butlast_op'_refine]\n sepref_register \"hm_butlast_op::(nat,'v) ahm \\ _\"\n\n sepref_definition hm_append_op_impl is \"uncurry2 hm_append_op'\" :: \"hm_impl2_rel\\<^sup>d *\\<^sub>a id_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a hm_impl2_rel\"\n unfolding hm_append_op'_def hm_impl2_rel_def \n apply (rewrite array_fold_custom_replicate)\n by sepref\n lemmas [sepref_fr_rules] = hm_append_op_impl.refine[FCOMP hm_append_op'_refine]\n sepref_register \"hm_append_op::(nat,'v) ahm \\ _\" \n\n\n subsection \\Auxiliary Operations\\\n\n lemmas [intf_of_assn] = intf_of_assnI[where R=\"hm_impl_rel :: (nat,'v) ahm \\ _\" and 'a=\"'v i_hma\"]\n\n sepref_definition hm_valid_impl is \"uncurry (RETURN oo hm_valid)\" :: \"hm_impl_rel\\<^sup>k*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>a bool_assn \"\n unfolding hm_valid_def[abs_def]\n by sepref\n lemmas [sepref_fr_rules] = hm_valid_impl.refine\n sepref_register \"hm_valid::(nat,'v) ahm \\ _\"\n\n\n (* Optimization *)\n definition \"hm_the_lookup_op' hm k \\ do {\n let (pq,ml) = hm;\n ASSERT (heapmap_\\ (hm_impl1_\\ hm) k \\ None \\ hm_impl1_invar hm);\n v \\ mop_list_get ml k;\n RETURN v\n }\"\n lemma hm_the_lookup_op'_refine: \n \"(hm_the_lookup_op', hm_the_lookup_op) \\ hm_impl1_rel \\ nat_rel \\ \\Id\\nres_rel\"\n apply (intro fun_relI nres_relI)\n unfolding hm_the_lookup_op'_def hm_the_lookup_op_def\n apply refine_vcg\n apply (auto simp: hm_impl1_rel_defs heapmap_\\_def hmr_invar_def split: if_split_asm)\n done\n\n sepref_definition hm_the_lookup_op_impl is \"uncurry hm_the_lookup_op'\" :: \"hm_impl2_rel\\<^sup>k*\\<^sub>aid_assn\\<^sup>k \\\\<^sub>aid_assn\" \n unfolding hm_the_lookup_op'_def[abs_def] hm_impl2_rel_def\n by sepref\n lemmas hm_the_lookup_op_impl[sepref_fr_rules] = hm_the_lookup_op_impl.refine[FCOMP hm_the_lookup_op'_refine]\n sepref_register \"hm_the_lookup_op::(nat,'v) ahm \\ _\"\n\n sepref_definition hm_val_of_op_impl is \"uncurry hm_val_of_op\" :: \"hm_impl_rel\\<^sup>k*\\<^sub>aid_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding hm_val_of_op_def by sepref\n lemmas [sepref_fr_rules] = hm_val_of_op_impl.refine\n sepref_register \"hm_val_of_op::(nat,'v) ahm \\ _\"\n\n sepref_definition hm_prio_of_op_impl is \"uncurry (PR_CONST hm_prio_of_op)\" :: \"hm_impl_rel\\<^sup>k*\\<^sub>aid_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding hm_prio_of_op_def[abs_def] PR_CONST_def by sepref\n lemmas [sepref_fr_rules] = hm_prio_of_op_impl.refine\n sepref_register \"PR_CONST hm_prio_of_op::(nat,'v) ahm \\ _\"\n \n\n text \\No code theorem preparation, as we define optimized version later\\ \n sepref_definition (no_prep_code) hm_swim_op_impl is \"uncurry (PR_CONST hm_swim_op)\" :: \"hm_impl_rel\\<^sup>d*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>a hm_impl_rel\"\n unfolding hm_swim_op_def[abs_def] PR_CONST_def\n using [[goals_limit = 1]]\n by sepref\n lemmas [sepref_fr_rules] = hm_swim_op_impl.refine\n sepref_register \"PR_CONST hm_swim_op::(nat,'v) ahm \\ _\"\n lemma [def_pat_rules]: \"hmstruct.hm_swim_op$prio \\ PR_CONST hm_swim_op\" by simp\n\n text \\No code theorem preparation, as we define optimized version later\\ \n sepref_definition (no_prep_code) hm_sink_op_impl is \"uncurry (PR_CONST hm_sink_op)\" :: \"hm_impl_rel\\<^sup>d*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>a hm_impl_rel\"\n unfolding hm_sink_op_def[abs_def] PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_sink_op_impl.refine\n sepref_register \"PR_CONST hm_sink_op::(nat,'v) ahm \\ _\"\n lemma [def_pat_rules]: \"hmstruct.hm_sink_op$prio \\ PR_CONST hm_sink_op\" by simp\n\n sepref_definition hm_repair_op_impl is \"uncurry (PR_CONST hm_repair_op)\" :: \"hm_impl_rel\\<^sup>d*\\<^sub>anat_assn\\<^sup>k \\\\<^sub>a hm_impl_rel\"\n unfolding hm_repair_op_def[abs_def] PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_repair_op_impl.refine\n sepref_register \"PR_CONST hm_repair_op::(nat,'v) ahm \\ _\"\n lemma [def_pat_rules]: \"hmstruct.hm_repair_op$prio \\ PR_CONST hm_repair_op\" by simp\n\n subsection \\Interface Operations\\\n definition hm_rel_np where \n \"hm_rel_np \\ hr_comp hm_impl_rel heapmap_rel\"\n lemmas [fcomp_norm_unfold] = hm_rel_np_def[symmetric] \n\n definition hm_rel where\n \"hm_rel K V \\ hr_comp hm_rel_np (\\the_pure K,the_pure V\\map_rel)\"\n lemmas [fcomp_norm_unfold] = hm_rel_def[symmetric] \n\n lemmas [intf_of_assn] = intf_of_assnI[where R=\"hm_rel K V\" and 'a=\"('kk,'vv) i_map\" for K V]\n\n lemma hm_rel_id_conv: \"hm_rel id_assn id_assn = hm_rel_np\"\n \\ \\Used for generic algorithms: Unfold with this, then let decl-impl compose with \\map_rel\\ again.\\\n unfolding hm_rel_def by simp\n\n\n subsubsection \\Synthesis\\\n definition op_hm_empty_sz :: \"nat \\ 'kk\\'vv\"\n where [simp]: \"op_hm_empty_sz sz \\ op_map_empty\"\n sepref_register \"PR_CONST (op_hm_empty_sz maxsize)\" :: \"('k,'v) i_map\"\n lemma [def_pat_rules]: \"op_hm_empty_sz$maxsize \\ UNPROTECT (op_hm_empty_sz maxsize)\" by simp\n\n lemma hm_fold_custom_empty_sz: \n \"op_map_empty = op_hm_empty_sz sz\"\n \"Map.empty = op_hm_empty_sz sz\"\n by auto\n\n sepref_definition hm_empty_op_impl is \"uncurry0 hm_empty_op'\" :: \"unit_assn\\<^sup>k \\\\<^sub>a hm_impl2_rel\" \n unfolding hm_empty_op'_def hm_impl2_rel_def array.fold_custom_empty\n by sepref\n \n sepref_definition hm_insert_op_impl is \"uncurry2 hm_insert_op\" :: \"[\\((k,_),_). ka id_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k*\\<^sub>ahm_impl_rel\\<^sup>d \\ hm_impl_rel\"\n unfolding hm_insert_op_def\n by sepref\n\n sepref_definition hm_is_empty_op_impl is \"hm_is_empty_op\" :: \"hm_impl_rel\\<^sup>k \\\\<^sub>a bool_assn\"\n unfolding hm_is_empty_op_def\n by sepref\n\n sepref_definition hm_lookup_op_impl is \"uncurry hm_lookup_op\" :: \"id_assn\\<^sup>k*\\<^sub>ahm_impl_rel\\<^sup>k \\\\<^sub>a option_assn id_assn\"\n unfolding hm_lookup_op_def by sepref\n\n sepref_definition hm_contains_key_impl is \"uncurry hm_contains_key_op'\" :: \"id_assn\\<^sup>k*\\<^sub>ahm_impl2_rel\\<^sup>k \\\\<^sub>a bool_assn\"\n unfolding hm_contains_key_op'_def hm_impl2_rel_def\n by sepref\n\n sepref_definition hm_decrease_key_op_impl is \"uncurry2 hm_decrease_key_op\" :: \"id_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k*\\<^sub>ahm_impl_rel\\<^sup>d \\\\<^sub>a hm_impl_rel\"\n unfolding hm_decrease_key_op_def by sepref\n\n sepref_definition hm_increase_key_op_impl is \"uncurry2 hm_increase_key_op\" :: \"id_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k*\\<^sub>ahm_impl_rel\\<^sup>d \\\\<^sub>a hm_impl_rel\"\n unfolding hm_increase_key_op_def by sepref\n\n sepref_definition hm_change_key_op_impl is \"uncurry2 hm_change_key_op\" :: \"id_assn\\<^sup>k*\\<^sub>aid_assn\\<^sup>k*\\<^sub>ahm_impl_rel\\<^sup>d \\\\<^sub>a hm_impl_rel\"\n unfolding hm_change_key_op_def by sepref\n\n sepref_definition hm_pop_min_op_impl is hm_pop_min_op :: \"hm_impl_rel\\<^sup>d \\\\<^sub>a prod_assn (prod_assn nat_assn id_assn) hm_impl_rel \"\n unfolding hm_pop_min_op_def[abs_def]\n by sepref\n\n sepref_definition hm_remove_op_impl is \"uncurry hm_remove_op\" :: \"id_assn\\<^sup>k *\\<^sub>a hm_impl_rel\\<^sup>d \\\\<^sub>a hm_impl_rel\"\n unfolding hm_remove_op_def[abs_def] by sepref\n\n sepref_definition hm_peek_min_op_impl is \"hm_peek_min_op\" :: \"hm_impl_rel\\<^sup>k \\\\<^sub>a prod_assn nat_assn id_assn\"\n unfolding hm_peek_min_op_def[abs_def] hm_kv_of_op_def\n by sepref\n\n\n\n subsubsection \\Setup of Refinements\\\n\n sepref_decl_impl (no_register) hm_empty: \n hm_empty_op_impl.refine[FCOMP hm_empty_op'_refine, FCOMP hm_empty_aref] .\n\n context fixes K assumes \"IS_BELOW_ID K\" begin\n lemmas mop_map_update_new_fref' = mop_map_update_new.fref[of K] \n lemmas op_map_update_fref' = op_map_update.fref[of K] \n end \n\n sepref_decl_impl (ismop) hm_insert: hm_insert_op_impl.refine[FCOMP hm_insert_op_aref]\n uses mop_map_update_new_fref'\n unfolding IS_BELOW_ID_def\n apply (parametricity; auto simp: single_valued_below_Id)\n done\n\n sepref_decl_impl hm_is_empty: hm_is_empty_op_impl.refine[FCOMP hm_is_empty_op_aref] .\n sepref_decl_impl hm_lookup: hm_lookup_op_impl.refine[FCOMP hm_lookup_op_aref] .\n\n sepref_decl_impl hm_contains_key: \n hm_contains_key_impl.refine[FCOMP hm_contains_key_op'_refine, FCOMP hm_contains_key_op_aref]\n .\n\n sepref_decl_impl (ismop) hm_decrease_key: hm_decrease_key_op_impl.refine[FCOMP hm_decrease_key_op_aref] .\n sepref_decl_impl (ismop) hm_increase_key: hm_increase_key_op_impl.refine[FCOMP hm_increase_key_op_aref] .\n sepref_decl_impl (ismop) hm_change_key: hm_change_key_op_impl.refine[FCOMP hm_change_key_op_aref] .\n \n sepref_decl_impl (ismop) hm_remove: hm_remove_op_impl.refine[FCOMP hm_remove_op_aref] .\n\n sepref_decl_impl (ismop) hm_pop_min: hm_pop_min_op_impl.refine[FCOMP hm_pop_min_op_aref] .\n sepref_decl_impl (ismop) hm_peek_min: hm_peek_min_op_impl.refine[FCOMP hm_peek_min_op_aref] .\n\n \\ \\Realized as generic algorithm. Note that we use @{term id_assn} for the elements.\\\n sepref_definition hm_upd_op_impl is \"uncurry2 (RETURN ooo op_map_update)\" :: \"[\\((k,_),_). ka id_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k *\\<^sub>a (hm_rel id_assn id_assn)\\<^sup>d \\ hm_rel id_assn id_assn\"\n unfolding op_pm_set_gen_impl by sepref\n\n sepref_decl_impl hm_upd_op_impl.refine[unfolded hm_rel_id_conv] uses op_map_update_fref'\n unfolding IS_BELOW_ID_def\n apply (parametricity; auto simp: single_valued_below_Id)\n done\n\nend \nend\n\ninterpretation hm: map_custom_empty \"PR_CONST (op_hm_empty_sz maxsize)\"\n apply unfold_locales by simp\n\nlemma op_hm_empty_sz_hnr[sepref_fr_rules]:\n \"(uncurry0 (hm_empty_op_impl maxsize), uncurry0 (RETURN (PR_CONST (op_hm_empty_sz maxsize)))) \\ unit_assn\\<^sup>k \\\\<^sub>a hm_rel maxsize prio K V\"\n using hm_empty_hnr by simp\n\n\nsubsection \\Manual fine-tuning of code-lemmas\\\n(* TODO: Integrate into Sepref-tool optimization phase! *)\n\ncontext\nnotes [simp del] = CNV_def efficient_nat_div2\nbegin\n\nlemma nested_case_bind: \n \"(case p of (a,b) \\ bind (case a of (a1,a2) \\ m a b a1 a2) (f a b)) \n = (case p of ((a1,a2),b) \\ bind (m (a1,a2) b a1 a2) (f (a1,a2) b))\"\n \"(case p of (a,b) \\ bind (case b of (b1,b2) \\ m a b b1 b2) (f a b)) \n = (case p of (a,b1,b2) \\ bind (m a (b1,b2) b1 b2) (f a (b1,b2)))\"\n by (simp_all split: prod.splits)\n\nlemma it_case: \"(case p of (a,b) \\ f p a b) = (case p of (a,b) \\ f (a,b) a b)\"\n by (auto split: prod.split)\n\nlemma c2l: \"(case p of (a,b) \\ bind (m a b) (f a b)) = \n do { let (a,b) = p; bind (m a b) (f a b)}\" by simp\n\nlemma bind_Let: \"do { x \\ do { let y = v; (f y :: 'a Heap)}; g x } = do { let y=v; x \\ f y; g x }\" by auto\nlemma bind_case: \"do { x \\ (case y of (a,b) \\ f a b); (g x :: 'a Heap) } = do { let (a,b) = y; x \\ f a b; g x }\"\n by (auto split: prod.splits)\n\nlemma bind_case_mvup: \"do { x \\ f; case y of (a,b) \\ g a b x } \n = do { let (a,b) = y; x \\ f; (g a b x :: 'a Heap) }\"\n by (auto split: prod.splits)\n\nlemma if_case_mvup: \"(if b then case p of (x1,x2) \\ f x1 x2 else e)\n = (case p of (x1,x2) \\ if b then f x1 x2 else e)\" by auto\n\nlemma nested_case: \"(case p of (a,b) \\ (case p of (c,d) \\ f a b c d)) =\n (case p of (a,b) \\ f a b a b)\"\n by (auto split: prod.split)\n\nlemma split_prod_bound: \"(\\p. f p) = (\\(a,b). f (a,b))\" by auto\n\nlemma bpc_conv: \"do { (a,b) \\ (m::(_*_) Heap); f a b } = do {\n ab \\ (m);\n f (fst ab) (snd ab)\n}\" \n apply (subst (2) split_prod_bound)\n by simp\n\nlemma it_case_pp: \"(case p of ((p1,p2)) \\ case p of ((p1',p2')) \\ f p1 p2 p1' p2')\n = (case p of ((p1,p2)) \\ f p1 p2 p1 p2)\"\n by (auto split: prod.split)\n\n\nlemma it_case_ppp: \"(case p of ((p1,p2),p3) \\ case p of ((p1',p2'),p3') \\ f p1 p2 p3 p1' p2' p3')\n = (case p of ((p1,p2),p3) \\ f p1 p2 p3 p1 p2 p3)\"\n by (auto split: prod.split)\n\nlemma it_case_pppp: \"(case a1 of\n (((a, b), c), d) \\\n case a1 of\n (((a', b'), c'), d') \\ f a b c d a' b' c' d') =\n (case a1 of\n (((a, b), c), d) \\ f a b c d a b c d)\"\n by (auto split: prod.splits)\n\nprivate lemmas inlines = hm_append_op_impl_def ial_append_def\n marl_length_def marl_append_def hm_length_impl_def ial_length_def\n hm_valid_impl_def hm_prio_of_op_impl_def hm_val_of_op_impl_def hm_key_of_op_impl_def\n ial_get_def hm_the_lookup_op_impl_def heap_array_set_def marl_get_def\n it_case_ppp it_case_pppp bind_case bind_case_mvup nested_case if_case_mvup\n it_case_pp\n\nschematic_goal [code]: \"hm_insert_op_impl maxsize prio hm k v = ?f\"\n unfolding hm_insert_op_impl_def\n apply (rule CNV_eqD)\n apply (simp add: inlines cong: if_cong)\n by (rule CNV_I)\n \n\nschematic_goal \"hm_swim_op_impl prio hm i \\ ?f\"\n unfolding hm_swim_op_impl_def \n apply (rule eq_reflection)\n apply (rule CNV_eqD)\n apply (simp add: inlines efficient_nat_div2 \n cong: if_cong)\n by (rule CNV_I)\n\n\nlemma hm_swim_op_impl_code[code]: \"hm_swim_op_impl prio hm i \\ ccpo.fixp (fun_lub Heap_lub) (fun_ord Heap_ord)\n (\\cf (a1, a2).\n case a1 of\n ((a1b, a2b), a2a) \\\n case a1b of\n (a, b) \\ do {\n let d2 = efficient_nat_div2 a2; \n if 0 < d2 \\ d2 \\ b\n then do {\n x \\ (case a1b of (a, n) \\ Array.nth a) (d2 - Suc 0);\n x \\ Array.nth a2a x;\n xa \\ (case a1b of (a, n) \\ Array.nth a) (a2 - Suc 0);\n xa \\ Array.nth a2a xa;\n if prio x \\ prio xa then return a1\n else do {\n x'g \\ hm_exch_op_impl a1 a2 (d2);\n cf (x'g, d2)\n }\n }\n else return a1\n })\n (hm, i)\"\n unfolding hm_swim_op_impl_def \n apply (rule eq_reflection)\n apply (simp add: inlines efficient_nat_div2 Let_def \n cong: if_cong)\n done\n\nprepare_code_thms hm_swim_op_impl_code\n\nschematic_goal hm_sink_opt_impl_code[code]: \"hm_sink_op_impl prio hm i \\ ?f\"\n unfolding hm_sink_op_impl_def \n apply (rule eq_reflection)\n apply (rule CNV_eqD)\n apply (simp add: inlines \n cong: if_cong)\n by (rule CNV_I)\n\nprepare_code_thms hm_sink_opt_impl_code\n\nexport_code hm_swim_op_impl in SML_imp module_name Test\n\n\nschematic_goal hm_change_key_opt_impl_code[code]: \"\n hm_change_key_op_impl prio k v hm \\ ?f\"\n unfolding hm_change_key_op_impl_def \n apply (rule eq_reflection)\n apply (rule CNV_eqD)\n apply (simp add: inlines hm_contains_key_impl_def ial_contains_def\n hm_change_key_op_impl_def hm_index_op_impl_def hm_update_op_impl_def\n ial_index_def\n cong: if_cong split: prod.splits)\n oops\n\n\nschematic_goal hm_change_key_opt_impl_code[code]: \"\n hm_change_key_op_impl prio k v hm \\ case hm of (((a, b), ba), x2) \\\n (do {\n x \\ Array.nth ba k;\n xa \\ Array.nth a x;\n xa \\ Array.upd xa v x2;\n hm_repair_op_impl prio (((a, b), ba), xa) (Suc x)\n })\"\n unfolding hm_change_key_op_impl_def \n apply (rule eq_reflection)\n apply (simp add: inlines hm_contains_key_impl_def ial_contains_def\n hm_change_key_op_impl_def hm_index_op_impl_def hm_update_op_impl_def\n ial_index_def\n cong: if_cong split: prod.splits)\n done\n\n\nschematic_goal hm_set_opt_impl_code[code]: \"hm_upd_op_impl maxsize prio hm k v \\ ?f\"\n unfolding hm_upd_op_impl_def \n apply (rule eq_reflection)\n apply (rule CNV_eqD)\n apply (simp add: inlines hm_contains_key_impl_def ial_contains_def\n hm_change_key_op_impl_def hm_index_op_impl_def hm_update_op_impl_def\n ial_index_def\n cong: if_cong)\n by (rule CNV_I)\n\nschematic_goal hm_pop_min_opt_impl_code[code]: \"hm_pop_min_op_impl prio hm \\ ?f\"\n unfolding hm_pop_min_op_impl_def \n apply (rule eq_reflection)\n apply (rule CNV_eqD)\n apply (simp add: inlines hm_contains_key_impl_def ial_contains_def\n hm_change_key_op_impl_def hm_index_op_impl_def hm_update_op_impl_def\n hm_butlast_op_impl_def ial_butlast_def\n ial_index_def\n cong: if_cong)\n by (rule CNV_I)\n \nend\n\nexport_code \n hm_empty_op_impl \n hm_insert_op_impl\n hm_is_empty_op_impl\n hm_lookup_op_impl\n hm_contains_key_impl\n hm_decrease_key_op_impl\n hm_increase_key_op_impl\n hm_change_key_op_impl\n hm_upd_op_impl\n hm_pop_min_op_impl\n hm_remove_op_impl\n hm_peek_min_op_impl\n checking SML_imp\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/Heaps/IICF_Impl_Heapmap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2935211519297387}} {"text": "section \\Exploration of Deterministic Rabin Automata\\\n\ntheory DRA_Nodes\nimports\n DFS_Framework.Reachable_Nodes\n DRA_Implement\nbegin\n\n definition dra_G :: \"('label, 'state) dra \\ 'state graph_rec\" where\n \"dra_G A \\ \\ g_V = UNIV, g_E = E_of_succ (successors A), g_V0 = {initial A} \\\"\n\n lemma dra_G_graph[simp]: \"graph (dra_G A)\" unfolding dra_G_def graph_def by simp\n lemma dra_G_reachable_nodes: \"op_reachable (dra_G A) = nodes A\"\n unfolding op_reachable_def dra_G_def graph_rec.simps E_of_succ_def\n proof safe\n show \"p \\ nodes A\" if \"(initial A, p) \\ {(u, v). v \\ successors A u}\\<^sup>*\" for p\n using that by induct auto\n show \"(initial A, p) \\ {(u, v). v \\ successors A u}\\<^sup>*\" if \"p \\ nodes A\" for p\n using that by (induct) (auto intro: rtrancl_into_rtrancl)\n qed\n\n context\n begin\n\n interpretation autoref_syn by this\n\n lemma dra_G_ahs: \"dra_G A = \\ g_V = UNIV, g_E = E_of_succ (\\ p. CAST\n ((\\ a. transition A a p ::: S) ` alphabet A ::: \\S\\ ahs_rel bhc)), g_V0 = {initial A} \\\"\n unfolding dra_G_def CAST_def id_apply E_of_succ_def autoref_tag_defs by auto\n\n schematic_goal drai_Gi:\n notes map2set_to_list[autoref_ga_rules]\n fixes S :: \"('statei \\ 'state) set\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ drai_dra_rel\"\n shows \"(?f :: ?'a, RETURN (dra_G A)) \\ ?A\"\n unfolding dra_G_ahs[where S = S and bhc = bhc] by (autoref_monadic (plain))\n concrete_definition drai_Gi uses drai_Gi\n (* TODO: why are term local.drai_Gi and term BA_Nodes.drai_Gi not the same *)\n lemma drai_Gi_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n shows \"(DRA_Nodes.drai_Gi seq bhc hms, dra_G) \\ \\L, S\\ drai_dra_rel \\ \\unit_rel, S\\ g_impl_rel_ext\"\n using drai_Gi.refine[THEN RETURN_nres_relD] assms unfolding autoref_tag_defs by blast\n\n schematic_goal dra_nodes:\n fixes S :: \"('statei \\ 'state) set\"\n assumes [simp]: \"finite ((g_E (dra_G A))\\<^sup>* `` g_V0 (dra_G A))\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ drai_dra_rel\"\n shows \"(?f :: ?'a, op_reachable (dra_G A)) \\ ?R\" by autoref\n concrete_definition dra_nodes uses dra_nodes\n lemma dra_nodes_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_PRECOND (finite (nodes A))\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n assumes \"(Ai, A) \\ \\L, S\\ drai_dra_rel\"\n shows \"(DRA_Nodes.dra_nodes seq bhc hms Ai,\n (OP nodes ::: \\L, S\\ drai_dra_rel \\ \\S\\ ahs_rel bhc) $ A) \\ \\S\\ ahs_rel bhc\"\n proof -\n have \"finite ((g_E (dra_G A))\\<^sup>* `` g_V0 (dra_G A))\"\n using assms(1) unfolding autoref_tag_defs dra_G_reachable_nodes[symmetric] by simp\n then show ?thesis using dra_nodes.refine assms\n unfolding autoref_tag_defs dra_G_reachable_nodes[symmetric] by blast\n qed\n\n end\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Automata/DRA/DRA_Nodes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.29352114538869767}} {"text": "theory TrivialArityAnal\nimports ArityAnalysisSpec \"../Launchbury/Env-Nominal\"\nbegin\n\ndefinition Trivial_Aexp :: \"exp \\ Arity \\ AEnv\"\n where \"Trivial_Aexp e = (\\ n. (\\ x. up\\0) f|` fv e)\"\n\nlemma Trivial_Aexp_simp: \"Trivial_Aexp e \\ n = (\\ x. up\\0) f|` fv e\"\n unfolding Trivial_Aexp_def by simp\n\nlemma edom_Trivial_Aexp[simp]: \"edom (Trivial_Aexp e \\ n) = fv e\"\n by (auto simp add: edom_def env_restr_def Trivial_Aexp_def) \n\nlemma Trivial_Aexp_eq[iff]: \"Trivial_Aexp e \\ n = Trivial_Aexp e' \\ n' \\ fv e = (fv e' :: var set)\"\n apply (auto simp add: Trivial_Aexp_simp env_restr_def)\n apply (metis up_defined)+\n done\n \nlemma below_Trivial_Aexp[simp]: \"(ae \\ Trivial_Aexp e \\ n) \\ edom ae \\ fv e\"\n by (auto dest:fun_belowD intro!: fun_belowI simp add: Trivial_Aexp_def env_restr_def edom_def split:if_splits)\n\n\ninterpretation ArityAnalysis Trivial_Aexp.\ninterpretation EdomArityAnalysis Trivial_Aexp\n by standard simp\n\n\ninterpretation ArityAnalysisSafe Trivial_Aexp\nproof\n(*\n fix \\\n show \"\\ \\ Trivial_Aexp = Trivial_Aexp\" by perm_simp rule\nnext\n*)\n fix n x\n show \"up\\n \\ (Trivial_Aexp (Var x)\\n) x\"\n by (simp add: Trivial_Aexp_simp)\nnext\n fix e x n\n show \"Trivial_Aexp e\\(inc\\n) \\ esing x\\(up\\0) \\ Trivial_Aexp (App e x)\\n\"\n by (auto intro: fun_belowI simp add: Trivial_Aexp_def env_restr_def )\nnext\n fix y e n\n show \"env_delete y (Trivial_Aexp e\\(pred\\n)) \\ Trivial_Aexp (Lam [y]. e)\\n\"\n by (auto simp add: Trivial_Aexp_simp env_delete_restr Diff_eq inf_commute)\nnext\n fix x y :: var and S e a\n assume \"x \\ S\" and \"y \\ S\"\n thus \"Trivial_Aexp e[x::=y]\\a f|` S = Trivial_Aexp e\\a f|` S\"\n by (auto simp add: Trivial_Aexp_simp fv_subst_eq intro!: arg_cong[where f = \"\\ S. env_restr S e\" for e])\nnext\n fix scrut e1 a e2\n show \"Trivial_Aexp scrut\\0 \\ Trivial_Aexp e1\\a \\ Trivial_Aexp e2\\a \\ Trivial_Aexp (scrut ? e1 : e2)\\a\"\n by (auto intro: env_restr_mono2 simp add: Trivial_Aexp_simp join_below_iff )\nqed\n\ndefinition Trivial_Aheap :: \"heap \\ exp \\ Arity \\ AEnv\" where\n \"Trivial_Aheap \\ e = (\\ a. (\\ x. up\\0) f|` domA \\)\"\n\nlemma Trivial_Aheap_eqvt[eqvt]: \"\\ \\ (Trivial_Aheap \\ e) = Trivial_Aheap (\\ \\ \\) (\\ \\ e)\"\n unfolding Trivial_Aheap_def\n apply perm_simp\n apply (simp add: Abs_cfun_eqvt)\n done\n\nlemma Trivial_Aheap_simp: \"Trivial_Aheap \\ e\\ a = (\\ x. up\\0) f|` domA \\\"\n unfolding Trivial_Aheap_def by simp\n\nlemma Trivial_fup_Aexp_below_fv: \"fup\\(Trivial_Aexp e)\\a \\ (\\ x . up\\0) f|` fv e\"\n by (cases a)(auto simp add: Trivial_Aexp_simp)\n\nlemma Trivial_Abinds_below_fv: \"ABinds \\\\ae \\ (\\ x . up\\0) f|` fv \\\"\n by (induction \\ rule:ABinds.induct)\n (auto simp add: join_below_iff intro!: below_trans[OF Trivial_fup_Aexp_below_fv] env_restr_mono2 elim: below_trans dest: set_mp[OF fv_delete_subset] simp del: fun_meet_simp)\n\ninterpretation ArityAnalysisLetSafe Trivial_Aexp Trivial_Aheap\nproof\n fix \\\n show \"\\ \\ Trivial_Aheap = Trivial_Aheap\" by perm_simp rule \nnext\n fix \\ e ae show \"edom (Trivial_Aheap \\ e\\ae) \\ domA \\\"\n by (simp add: Trivial_Aheap_simp)\nnext\n fix \\ :: heap and e and a\n show \"ABinds \\\\(Trivial_Aheap \\ e\\a) \\ Trivial_Aexp e\\a \\ Trivial_Aheap \\ e\\a \\ Trivial_Aexp (Terms.Let \\ e)\\a\"\n by (auto simp add: Trivial_Aheap_simp Trivial_Aexp_simp join_below_iff env_restr_join2 intro!: env_restr_mono2 below_trans[OF Trivial_Abinds_below_fv])\nnext\n fix x y :: var and \\ :: heap and e\n assume \"x \\ domA \\\" and \"y \\ domA \\\"\n thus \"Trivial_Aheap \\[x::h=y] e[x::=y] = Trivial_Aheap \\ e\"\n by (auto intro: cfun_eqI simp add: Trivial_Aheap_simp)\nqed\n\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/TrivialArityAnal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.29352113884765646}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: StateSpace.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\State Space Template\\\ntheory StateSpace imports Hoare\nbegin\n\nrecord 'g state = \"globals\"::'g\n\ndefinition\n upd_globals:: \"('g \\ 'g) \\ ('g,'z) state_scheme \\ ('g,'z) state_scheme\"\nwhere\n \"upd_globals upd s = s\\globals := upd (globals s)\\\"\n\nrecord ('g, 'n, 'val) stateSP = \"'g state\" +\n locals :: \"'n \\ 'val\"\n\nlemma upd_globals_conv: \"upd_globals f = (\\s. s\\globals := f (globals s)\\)\"\n by (rule ext) (simp add: upd_globals_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/StateSpace.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.29334444885962874}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Refinement/a0n_agree.thy (Isabelle/HOL 2016-1)\n ID: $Id: a0n_agree.thy 134924 2017-05-24 17:23:15Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n \n One-Way authentication protocols\n Initial Model: Non-injective agreement \n\n Copyright (c) 2009-2016 Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Non-injective Agreement\\\n\ntheory a0n_agree imports Refinement Agents\nbegin\n\ntext \\The initial model abstractly specifies entity authentication, where \none agent/role authenticates another. More precisely, this property corresponds \nto non-injective agreement on a data set \\ds\\. We use Running and Commit \nsignals to obtain a protocol-independent extensional specification.\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\.\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\Signals. At this stage there are no protocol runs yet. All we model\nare the signals that indicate a certain progress of a protocol run by one \nagent/role (Commit signal) and the other role (Running signal). The signals \ncontain a list of agents that are assumed to be honest and a polymorphic data \nset to be agreed upon, which is instantiated later. \n\nUsually, the agent list will contain the names of the two agents who want to\nagree on the data, but sometimes one of the agents is honest by assumption \n(e.g., the server) or the honesty of additional agents needs to be assumed\nfor the agreement to hold.\\\n\ndatatype 'ds signal =\n Running \"agent list\" \"'ds\" \n| Commit \"agent list\" \"'ds\"\n\nrecord 'ds a0n_state = \n signals :: \"'ds signal \\ nat\" \\ \\multi-set of signals\\\n corrupted :: \"'ds set\" \\ \\set of corrupted data\\\n\ntype_synonym \n 'ds a0n_obs = \"'ds a0n_state\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ndefinition \n a0n_init :: \"'ds a0n_state set\"\nwhere\n \"a0n_init \\ {s. \\ds. s = \\\n signals = \\s. 0,\n corrupted = ds\n \\ }\"\n\ntext \\Running signal, indicating end of responder run.\\\n\ndefinition \n a0n_running :: \"[agent list, 'ds] \\ ('ds a0n_state \\ 'ds a0n_state) set\"\nwhere \n \"a0n_running h d \\ {(s, s').\n \\ \\actions:\\\n s' = s\\ \n signals := (signals s)(Running h d := signals s (Running h d) + 1) \n \\\n }\"\n\n\ntext \\Commit signal, marking end of initiator run.\\\n\ndefinition \n a0n_commit :: \"[agent list, 'ds] \\ ('ds a0n_state \\ 'ds a0n_state) set\"\nwhere \n \"a0n_commit h d \\ {(s, s').\n \\ \\guards:\\\n (set h \\ good \\ d \\ corrupted s \\ signals s (Running h d) > 0) \\\n\n \\ \\actions:\\\n s' = s\\ \n signals := (signals s)(Commit h d := signals s (Commit h d) + 1) \n \\\n }\"\n\ntext \\Data corruption.\\\n\ndefinition \n a0n_corrupt :: \"'ds set \\ ('ds a0n_state \\ 'ds a0n_state) set\"\nwhere\n \"a0n_corrupt ds \\ {(s, s').\n \\ \\actions:\\\n s' = s\\ \n corrupted := corrupted s \\ ds \n \\ \n }\"\n\n\ntext \\Transition system.\\\n\ndefinition \n a0n_trans :: \"('ds a0n_state \\ 'ds a0n_state) set\" where\n \"a0n_trans \\ (\\h d ds.\n a0n_running h d \\\n a0n_commit h d \\ \n a0n_corrupt ds \\ \n Id\n )\"\n\ndefinition \n a0n :: \"('ds a0n_state, 'ds a0n_obs) spec\" where\n \"a0n \\ \\\n init = a0n_init,\n trans = a0n_trans, \n obs = id\n \\\"\n\nlemmas a0n_defs = \n a0n_def a0n_init_def a0n_trans_def \n a0n_running_def a0n_commit_def a0n_corrupt_def\n\n\ntext \\Any property is trivially observable.\\\n\nlemma a0n_obs [simp]: \"obs a0n= id\"\nby (simp add: a0n_def) \n\nlemma a0n_anyP_observable [iff]: \"observable (obs a0n) P\"\nby (auto) \n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\nsubsection \\inv1: non-injective agreement\\\n(******************************************************************************)\n\ntext \\This is an extensional variant of Lowe's \\emph{non-injective agreement}\nof the first with the second agent (by convention) in \\h\\ on data \n\\d\\ [Lowe97]. \n\\\n\ndefinition \n a0n_inv1_niagree :: \"'ds a0n_state set\" \nwhere\n \"a0n_inv1_niagree \\ {s. \\h d.\n set h \\ good \\ d \\ corrupted s \\\n signals s (Commit h d) > 0 \\ signals s (Running h d) > 0\n }\"\n\nlemmas a0n_inv1_niagreeI = \n a0n_inv1_niagree_def [THEN setc_def_to_intro, rule_format]\nlemmas a0n_inv1_niagreeE [elim] = \n a0n_inv1_niagree_def [THEN setc_def_to_elim, rule_format]\nlemmas a0n_inv1_niagreeD = \n a0n_inv1_niagree_def [THEN setc_def_to_dest, rule_format, rotated 2]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_a0n_inv1_niagree_init [iff]:\n \"init a0n \\ a0n_inv1_niagree\"\nby (auto simp add: a0n_defs intro!: a0n_inv1_niagreeI)\n\nlemma PO_a0n_inv1_niagree_trans [iff]:\n \"{a0n_inv1_niagree} trans a0n {> a0n_inv1_niagree}\"\napply (auto simp add: PO_hoare_defs a0n_defs intro!: a0n_inv1_niagreeI)\napply (auto dest!: a0n_inv1_niagreeD dest: dom_lemmas)\ndone\n\nlemma PO_a0n_inv1_niagree [iff]: \"reach a0n \\ a0n_inv1_niagree\"\nby (rule inv_rule_basic) (auto)\n\n\ntext \\This is also an external invariant.\\\n\nlemma a0n_obs_inv1_niagree [iff]:\n \"oreach a0n \\ a0n_inv1_niagree\"\napply (rule external_from_internal_invariant, fast) \napply (subst a0n_def, auto)\ndone\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Refinement/a0n_agree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.29334444885962874}} {"text": "subsection \\CISK (Controlled Interruptible Separation Kernel)\\\n\ntheory CISK\n imports ISK\nbegin\n\ntext \\\n This section presents a generic model of a Controlled Interruptible Separation Kernel (CISK).\n It formulates security, i.e., intransitive noninterference.\n For a presentation of this model, see Section 2 of~\\cite{Verbeek2013}.\n\\\n\ntext \\\n First, a locale is defined that defines all generic functions and all proof obligations (see Section 2.3 of ~\\cite{Verbeek2013}).\n\\\nlocale Controllable_Interruptible_Separation_Kernel = \\ \\CISK\\\nfixes kstep :: \"'state_t \\ 'action_t \\ 'state_t\" \\ \\Executes one atomic kernel action\\\n and output_f :: \"'state_t \\ 'action_t \\ 'output_t\" \\ \\Returns the observable behavior\\\n and s0 :: \"'state_t\" \\ \\The initial state\\\n and current :: \"'state_t => 'dom_t\" \\ \\Returns the currently active domain\\\n and cswitch :: \"time_t \\ 'state_t \\ 'state_t\" \\ \\Performs a context switch\\\n and interrupt :: \"time_t \\ bool\" \\ \\Returns t iff an interrupt occurs in the given state at the given time\\\n and kinvolved :: \"'action_t \\ 'dom_t set\" \\ \\Returns the set of domains that are involved in the given action\\\n and ifp :: \"'dom_t \\ 'dom_t \\ bool\" \\ \\The security policy.\\\n and vpeq :: \"'dom_t \\ 'state_t \\ 'state_t \\ bool\" \\ \\View partitioning equivalence\\\n and AS_set :: \"('action_t list) set\" \\ \\Returns a set of valid action sequences, i.e., the attack surface\\\n and invariant :: \"'state_t \\ bool\" \\ \\Returns an inductive state-invariant\\\n and AS_precondition :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns the preconditions under which the given action can be executed.\\ \n and aborting :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns true iff the action is aborted.\\\n and waiting :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns true iff execution of the given action is delayed.\\\n and set_error_code :: \"'state_t \\ 'action_t \\ 'state_t\" \\ \\Sets an error code when actions are aborted.\\\nassumes vpeq_transitive: \" \\ a b c u. (vpeq u a b \\ vpeq u b c) \\ vpeq u a c\"\n and vpeq_symmetric: \"\\ a b u. vpeq u a b \\ vpeq u b a\"\n and vpeq_reflexive: \"\\ a u. vpeq u a a\"\n and ifp_reflexive: \"\\ u . ifp u u\" \n and weakly_step_consistent: \"\\ s t u a. vpeq u s t \\ vpeq (current s) s t \\ invariant s \\ AS_precondition s (current s) a \\ invariant t \\ AS_precondition t (current t) a \\ current s = current t \\ vpeq u (kstep s a) (kstep t a)\"\n and locally_respects: \"\\ a s u. \\ifp (current s) u \\ invariant s \\ AS_precondition s (current s) a \\ vpeq u s (kstep s a)\"\n and output_consistent: \"\\ a s t. vpeq (current s) s t \\ current s = current t \\ (output_f s a) = (output_f t a)\"\n and step_atomicity: \"\\ s a . current (kstep s a) = current s\"\n and cswitch_independent_of_state: \"\\ n s t . current s = current t \\ current (cswitch n s) = current (cswitch n t)\"\n and cswitch_consistency: \"\\ u s t n . vpeq u s t \\ vpeq u (cswitch n s) (cswitch n t)\"\n and empty_in_AS_set: \"[] \\ AS_set\"\n and invariant_s0: \"invariant s0\"\n and invariant_after_cswitch: \"\\ s n . invariant s \\ invariant (cswitch n s)\"\n and precondition_after_cswitch: \"\\ s d n a. AS_precondition s d a \\ AS_precondition (cswitch n s) d a\"\n and AS_prec_first_action: \"\\ s d aseq . invariant s \\ aseq \\ AS_set \\ aseq \\ [] \\ AS_precondition s d (hd aseq)\"\n and AS_prec_after_step: \"\\ s a a' . (\\ aseq \\ AS_set . is_sub_seq a a' aseq) \\ invariant s \\ AS_precondition s (current s) a \\ \\aborting s (current s) a \\ \\ waiting s (current s) a\\ AS_precondition (kstep s a) (current s) a'\"\n and AS_prec_dom_independent: \"\\ s d a a' . current s \\ d \\ AS_precondition s d a \\ AS_precondition (kstep s a') d a\"\n and spec_of_invariant: \"\\ s a . invariant s \\ invariant (kstep s a)\"\n and aborting_switch_independent: \"\\ n s . aborting (cswitch n s) = aborting s\"\n and aborting_error_update: \"\\ s d a' a . current s \\ d \\ aborting s d a \\ aborting (set_error_code s a') d a\"\n and aborting_after_step: \"\\ s a d . current s \\ d \\ aborting (kstep s a) d = aborting s d\" (* TODO: I think this PO can be removed *)\n and aborting_consistent: \"\\ s t u . vpeq u s t \\ aborting s u = aborting t u\"\n and waiting_switch_independent: \"\\ n s . waiting (cswitch n s) = waiting s\"\n and waiting_error_update: \"\\ s d a' a . current s \\ d \\ waiting s d a \\ waiting (set_error_code s a') d a\"\n and waiting_consistent: \"\\s t u a . vpeq (current s) s t \\ (\\ d \\ kinvolved a . vpeq d s t) \\ vpeq u s t \\ waiting s u a = waiting t u a\"\n and spec_of_waiting: \"\\ s a . waiting s (current s) a \\ kstep s a = s\"\n and set_error_consistent: \"\\ s t u a . vpeq u s t \\ vpeq u (set_error_code s a) (set_error_code t a)\"\n and set_error_locally_respects: \"\\ s u a . \\ifp (current s) u \\ vpeq u s (set_error_code s a)\"\n and current_set_error_code: \"\\ s a . current (set_error_code s a) = current s\"\n and precondition_after_set_error_code: \"\\ s d a a'. AS_precondition s d a \\ aborting s (current s) a' \\ AS_precondition (set_error_code s a') d a\"\n and invariant_after_set_error_code: \"\\ s a . invariant s \\ invariant (set_error_code s a)\"\n and involved_ifp: \"\\ s a . \\ d \\ (kinvolved a) . AS_precondition s (current s) a \\ ifp d (current s)\" \nbegin \n\nsubsubsection\\Execution semantics\\\n\ntext\\\n Control is based on generic functions \\emph{aborting}, \\emph{waiting} and \\emph{set\\_error\\_code}.\n Function \\emph{aborting} decides whether a certain action is aborting, given its domain and the state.\n If so, then function set\\_error\\_code will be used to update the state, possibly communicating to other domains that an action has been aborted.\n Function \\emph{waiting} can delay the execution of an action.\n This behavior is implemented in function CISK\\_control.\n\\\nfunction CISK_control :: \"'state_t \\ 'dom_t \\ 'action_t execution \\ ('action_t option \\ 'action_t execution \\ 'state_t)\"\nwhere \"CISK_control s d [] = (None,[],s)\" \\ \\The thread is empty\\\n | \"CISK_control s d ([]#[]) = (None,[],s)\" \\ \\The current action sequence has been finished and the thread has no next action sequences to execute\\\n | \"CISK_control s d ([]#(as'#execs')) = (None,as'#execs',s)\" \\ \\The current action sequence has been finished. Skip to the next sequence\\\n | \"CISK_control s d ((a#as)#execs') = (if aborting s d a then \n (None, execs',set_error_code s a)\n else if waiting s d a then\n (Some a, (a#as)#execs',s)\n else\n (Some a, as#execs',s))\" \\ \\Executing an action sequence\\\nby pat_completeness auto\ntermination by lexicographic_order\n\ntext\\\n Function \\emph{run} defines the execution semantics.\n This function is presented in ~\\cite{Verbeek2013} by pseudo code (see Algorithm 1).\n Before defining the run function, we define accessor functions for the control mechanism.\n Functions next\\_action, next\\_execs and next\\_state correspond to ``control.a'', ``control.x'' and ``control.s'' in ~\\cite{Verbeek2013}.\n\\\nabbreviation next_action::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ 'action_t option\"\nwhere \"next_action \\ Kernel.next_action current CISK_control\"\nabbreviation next_execs::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ ('dom_t \\ 'action_t execution)\"\nwhere \"next_execs \\ Kernel.next_execs current CISK_control\"\nabbreviation next_state::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ 'state_t\"\nwhere \"next_state \\ Kernel.next_state current CISK_control\"\ntext \\\n\\\ntext \\\n A thread is empty iff either it has no further action sequences to execute, or when the current action sequence is finished and there are no further action sequences to execute.\n\\\nabbreviation thread_empty::\"'action_t execution \\ bool\"\nwhere \"thread_empty exec \\ exec = [] \\ exec = [[]]\"\n\ntext\\\n The following function defines the execution semantics of CISK, using function CISK\\_control.\n\\\nfunction run :: \"time_t \\ 'state_t \\ ('dom_t \\ 'action_t execution) \\ 'state_t\"\nwhere \"run 0 s execs = s\"\n| \"interrupt (Suc n) \\ run (Suc n) s execs = run n (cswitch (Suc n) s) execs\"\n| \"\\interrupt (Suc n) \\ thread_empty(execs (current s)) \\ run (Suc n) s execs = run n s execs\"\n| \"\\interrupt (Suc n) \\ \\thread_empty(execs (current s)) \\\n run (Suc n) s execs = (let control_a = next_action s execs;\n control_s = next_state s execs;\n control_x = next_execs s execs in\n case control_a of None \\ run n control_s control_x\n | (Some a) \\ run n (kstep control_s a) control_x)\"\nusing not0_implies_Suc by (metis prod_cases3,auto)\ntermination by lexicographic_order\n\nsubsubsection \\Formulations of security\\\n\ntext\\\n The definitions of security as presented in Section 2.2 of~\\cite{Verbeek2013}.\n\\\n\nabbreviation kprecondition\n where \"kprecondition s a \\ invariant s \\ AS_precondition s (current s) a\"\ndefinition realistic_execution\nwhere \"realistic_execution aseq \\ set aseq \\ AS_set\"\ndefinition realistic_executions :: \"('dom_t \\ 'action_t execution) \\ bool\"\nwhere \"realistic_executions execs \\ \\d. realistic_execution (execs d)\"\nabbreviation involved where \"involved \\ Kernel.involved kinvolved\"\nabbreviation step where \"step \\ Kernel.step kstep\"\nabbreviation purge where \"purge \\ Separation_Kernel.purge realistic_execution ifp\"\nabbreviation ipurge_l where \"ipurge_l \\ Separation_Kernel.ipurge_l kinvolved ifp\"\nabbreviation ipurge_r where \"ipurge_r \\ Separation_Kernel.ipurge_r realistic_execution kinvolved ifp\"\n\ndefinition NI_unrelated::bool\nwhere \"NI_unrelated\n \\ \\ execs a n . realistic_executions execs \\\n (let s_f = run n s0 execs in\n output_f s_f a = output_f (run n s0 (purge execs (current s_f))) a)\"\ndefinition NI_indirect_sources::bool\nwhere \"NI_indirect_sources\n \\ \\ execs a n. realistic_executions execs \\\n (let s_f = run n s0 execs in\n output_f (run n s0 (ipurge_l execs (current s_f))) a =\n output_f (run n s0 (ipurge_r execs (current s_f))) a)\"\ndefinition isecure::bool\nwhere \"isecure \\ NI_unrelated \\ NI_indirect_sources\"\n\n\nsubsubsection \\Proofs\\\ntext\\\n The final theorem is unwinding\\_implies\\_isecure\\_CISK.\n This theorem shows that any interpretation of locale CISK is secure.\n\n To prove this theorem, the refinement framework is used.\n CISK is a refinement of ISK, as the only idfference is the control function.\n In ISK, this function is a generic function called \\emph{control}, in CISK it is interpreted in function \\emph{CISK\\_control}.\n It is proven that function \\emph{CISK\\_control} satisfies all the proof obligations concerning generic function \\emph{control}.\n In other words, \\emph{CISK\\_control} is proven to be an interpretation of control.\n Therefore, all theorems on run\\_total apply to the run function of CISK as well.\n\\\n\nlemma next_action_consistent: \nshows \"\\ s t execs . vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ next_action s execs = next_action t execs\"\nproof-\n{\n fix s t execs\n assume vpeq: \"vpeq (current s) s t\"\n assume vpeq_involved: \"\\ d \\ involved (next_action s execs) . vpeq d s t\"\n assume current_s_t: \"current s = current t\"\n from aborting_consistent current_s_t vpeq\n have \"aborting t (current s) = aborting s (current s)\" by auto\n from current_s_t this waiting_consistent vpeq_involved\n have \"next_action s execs = next_action t execs\"\n unfolding Kernel.next_action_def \n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_execs_consistent:\nshows \"\\ s t execs . vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\nproof-\n{\n fix s t execs\n assume vpeq: \"vpeq (current s) s t\"\n assume vpeq_involved: \"\\ d \\ involved (next_action s execs) . vpeq d s t\"\n assume current_s_t: \"current s = current t\"\n from aborting_consistent current_s_t vpeq\n have 1: \"aborting t (current s) = aborting s (current s)\" by auto\n from 1 vpeq current_s_t vpeq_involved waiting_consistent[THEN spec,THEN spec,THEN spec,THEN spec,where x3=s and x2=t and x1=\"current s\" and x=\"the (next_action s execs)\"]\n have \"fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\n unfolding Kernel.next_action_def Kernel.involved_def\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_consistent:\nshows \"\\ s t u execs . vpeq (current s) s t \\ vpeq u s t \\ current s = current t \\ vpeq u (next_state s execs) (next_state t execs)\"\nproof-\n{\n fix s t u execs\n assume vpeq_s_t: \"vpeq (current s) s t \\ vpeq u s t\"\n assume current_s_t: \"current s = current t\"\n from vpeq_s_t current_s_t\n have \"vpeq u (next_state s execs) (next_state t execs)\"\n unfolding Kernel.next_state_def\n using aborting_consistent set_error_consistent\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma current_next_state:\nshows \"\\ s execs . current (next_state s execs) = current s\" \nproof-\n{\n fix s execs\n have \"current (next_state s execs) = current s\"\n unfolding Kernel.next_state_def\n using current_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma locally_respects_next_state:\nshows \"\\ s u execs. \\ifp (current s) u \\ vpeq u s (next_state s execs)\"\nproof-\n{\n fix s u execs\n assume \"\\ifp (current s) u\"\n hence \"vpeq u s (next_state s execs)\"\n unfolding Kernel.next_state_def\n using vpeq_reflexive set_error_locally_respects\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma CISK_control_spec:\nshows \"\\s d aseqs.\n case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\nproof-\n{\n fix s d aseqs\n have \"case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_after_cswitch:\nshows \"\\ s n d aseqs . fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\nproof-\n{\n fix s n d aseqs\n have \"fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\n using aborting_switch_independent waiting_switch_independent\n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\n\nlemma next_action_after_next_state:\nshows \"\\ s execs d . current s \\ d \\ fst (CISK_control (next_state s execs) d (execs d)) = None \\ fst (CISK_control (next_state s execs) d (execs d)) = fst (CISK_control s d (execs d))\"\nproof-\n{\n fix s execs d aseqs\n assume 1: \"current s \\ d\"\n have \"fst (CISK_control (next_state s execs) d aseqs) = None \\ fst (CISK_control (next_state s execs) d aseqs) = fst (CISK_control s d aseqs)\"\n proof(cases \"(s,d,aseqs)\" rule: CISK_control.cases,simp,simp,simp)\n case (4 sa da a as execs')\n thus ?thesis\n unfolding Kernel.next_state_def\n using aborting_error_update waiting_error_update 1\n by(cases \"(sa,current sa,execs (current sa))\" rule: CISK_control.cases,auto split: if_split_asm)\n qed\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_after_step:\nshows \"\\ s a d aseqs . current s \\ d \\ fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\nproof-\n{\n fix s a d aseqs\n assume 1: \"current s \\ d\"\n from this aborting_after_step \n have \"fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\n unfolding Kernel.step_def \n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,simp,simp,simp,cases a,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_precondition:\nshows \"\\s d a execs. AS_precondition s d a \\ AS_precondition (next_state s execs) d a\"\nproof-\n{\n fix s a d execs\n assume \"AS_precondition s d a\"\n hence \"AS_precondition (next_state s execs) d a\"\n unfolding Kernel.next_state_def\n using precondition_after_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_invariant:\nshows \"\\s execs. invariant s \\ invariant (next_state s execs)\"\nproof-\n{\n fix s execs\n assume \"invariant s\"\n hence \"invariant (next_state s execs)\"\n unfolding Kernel.next_state_def\n using invariant_after_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_from_execs:\nshows \"\\ s execs . next_action s execs \\ (\\ a . a \\ actions_in_execution (execs (current s)))\"\nproof-\n{\n fix s execs\n {\n fix a\n assume 1: \"next_action s execs = Some a\"\n from 1 have \"a \\ actions_in_execution (execs (current s))\"\n unfolding Kernel.next_action_def actions_in_execution_def\n by (cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n }\n hence \"next_action s execs \\ (\\ a . a \\ actions_in_execution (execs (current s)))\"\n unfolding B_def\n by (cases \"next_action s execs\",auto)\n}\nthus ?thesis unfolding B_def by (auto)\nqed\n\nlemma next_execs_subset:\nshows \"\\s execs u . actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\nproof-\n{\n fix s execs u\n have \"actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\n unfolding Kernel.next_execs_def actions_in_execution_def\n by (cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n}\nthus ?thesis by auto\nqed\n\n\ntheorem unwinding_implies_isecure_CISK:\nshows isecure\nproof-\n interpret int: Interruptible_Separation_Kernel kstep output_f s0 current cswitch interrupt kprecondition realistic_execution CISK_control kinvolved ifp vpeq AS_set invariant AS_precondition aborting waiting\n proof (unfold_locales)\n show \"\\a b c u. vpeq u a b \\ vpeq u b c \\ vpeq u a c\"\n using vpeq_transitive by blast\n show \"\\a b u. vpeq u a b \\ vpeq u b a\"\n using vpeq_symmetric by blast\n show \"\\a u. vpeq u a a\"\n using vpeq_reflexive by blast\n show \"\\u. ifp u u\"\n using ifp_reflexive by blast\n show \"\\ s t u a. vpeq u s t \\ vpeq (current s) s t \\ kprecondition s a \\ kprecondition t a \\ current s = current t \\ vpeq u (kstep s a) (kstep t a)\"\n using weakly_step_consistent by blast\n show \"\\ a s u. \\ifp (current s) u \\ kprecondition s a \\ vpeq u s (kstep s a)\"\n using locally_respects by blast\n show \"\\ a s t. vpeq (current s) s t \\ current s = current t \\ (output_f s a) = (output_f t a)\"\n using output_consistent by blast \n show \"\\ s a . current (kstep s a) = current s\"\n using step_atomicity by blast \n show \"\\ n s t . current s = current t \\ current (cswitch n s) = current (cswitch n t)\"\n using cswitch_independent_of_state by blast \n show \"\\ u s t n . vpeq u s t \\ vpeq u (cswitch n s) (cswitch n t)\"\n using cswitch_consistency by blast\n show \"\\s t execs. vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ next_action s execs = next_action t execs\"\n using next_action_consistent by blast\n show \"\\s t execs.\n vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\\n fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\n using next_execs_consistent by blast\n show \" \\s t u execs. vpeq (current s) s t \\ vpeq u s t \\ current s = current t \\ vpeq u (next_state s execs) (next_state t execs)\"\n using next_state_consistent by auto\n show \" \\s execs. current (next_state s execs) = current s\"\n using current_next_state by auto\n show \"\\s u execs. \\ ifp (current s) u \\ vpeq u s (next_state s execs)\"\n using locally_respects_next_state by auto\n show \"[] \\ AS_set\"\n using empty_in_AS_set by blast\n show \"\\ s n . invariant s \\ invariant (cswitch n s)\"\n using invariant_after_cswitch by blast\n show \"\\ s d n a. AS_precondition s d a \\ AS_precondition (cswitch n s) d a\"\n using precondition_after_cswitch by blast\n show \"invariant s0\"\n using invariant_s0 by blast\n show \"\\ s d aseq . invariant s \\ aseq \\ AS_set \\ aseq \\ [] \\ AS_precondition s d (hd aseq)\"\n using AS_prec_first_action by blast\n show \"\\s a a'. (\\aseq\\AS_set. is_sub_seq a a' aseq) \\ invariant s \\ AS_precondition s (current s) a \\ \\ aborting s (current s) a \\ \\ waiting s (current s) a \\\n AS_precondition (kstep s a) (current s) a'\"\n using AS_prec_after_step by blast \n show \"\\ s d a a' . current s \\ d \\ AS_precondition s d a \\ AS_precondition (kstep s a') d a\"\n using AS_prec_dom_independent by blast \n show \"\\ s a . invariant s \\ invariant (kstep s a)\"\n using spec_of_invariant by blast\n show \"\\s a. kprecondition s a \\ kprecondition s a\"\n by auto \n show \"\\aseq. realistic_execution aseq \\ set aseq \\ AS_set\"\n unfolding realistic_execution_def\n by auto\n show \"\\s a. \\ d \\ involved a. kprecondition s (the a) \\ ifp d (current s)\"\n using involved_ifp unfolding Kernel.involved_def by (auto split: option.splits)\n show \"\\s execs. next_action s execs \\ (\\a. a \\ actions_in_execution (execs (current s)))\"\n using next_action_from_execs by blast \n show \"\\s execs u. actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\n using next_execs_subset by blast \n show \"\\s d aseqs.\n case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\n using CISK_control_spec by blast\n show \"\\s n d aseqs. fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\n using next_action_after_cswitch by auto\n show \"\\s execs d.\n current s \\ d \\\n fst (CISK_control (next_state s execs) d (execs d)) = None \\ fst (CISK_control (next_state s execs) d (execs d)) = fst (CISK_control s d (execs d))\"\n using next_action_after_next_state by auto\n show \"\\s a d aseqs. current s \\ d \\ fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\n using next_action_after_step by auto\n show \"\\s d a execs. AS_precondition s d a \\ AS_precondition (next_state s execs) d a\"\n using next_state_precondition by auto\n show \"\\s execs. invariant s \\ invariant (next_state s execs)\"\n using next_state_invariant by auto\n show \"\\s a. waiting s (current s) a \\ kstep s a = s\"\n using spec_of_waiting by blast\n qed\n \n note interpreted = int.Interruptible_Separation_Kernel_axioms\n note run_total_induct = Interruptible_Separation_Kernel.run_total.induct[of kstep output_f s0 current cswitch kprecondition realistic_execution\n CISK_control kinvolved ifp vpeq AS_set invariant AS_precondition aborting waiting _ interrupt]\n have run_equals_run_total:\n \"\\ n s execs . run n s execs \\ Interruptible_Separation_Kernel.run_total kstep current cswitch interrupt CISK_control n s execs\"\n proof-\n fix n s execs\n show \"run n s execs \\ Interruptible_Separation_Kernel.run_total kstep current cswitch interrupt CISK_control n s execs\"\n using interpreted int.step_def\n by(induct n s execs rule: run_total_induct,auto split: option.splits)\n qed\n from interpreted\n have 0: \"Interruptible_Separation_Kernel.isecure_total kstep output_f s0 current cswitch interrupt realistic_execution CISK_control kinvolved ifp\"\n by (metis int.unwinding_implies_isecure_total)\n from 0 run_equals_run_total\n have 1: \"NI_unrelated\"\n by (metis realistic_executions_def int.isecure_total_def int.realistic_executions_def int.NI_unrelated_total_def NI_unrelated_def)\n from 0 run_equals_run_total\n have 2: \"NI_indirect_sources\"\n by (metis realistic_executions_def int.NI_indirect_sources_total_def int.isecure_total_def int.realistic_executions_def NI_indirect_sources_def)\n from 1 2 show ?thesis unfolding isecure_def by auto\nqed\n\nend\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CISC-Kernel/trace/Rushby-with-Control/CISK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757645879592642, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2932693057451644}} {"text": "section \"Packed Traces\"\ntheory packed_traces\n imports commutativity\nbegin\n\n\ntext \"In this section we show that traces can be packed.\nIntuitively a transaction is packed, if there are no steps from other invocations between a \n@{term ABeginAtomic} and @{term AEndAtomic} action.\n\nThe following definition defines that such a step exists at an index @{term k}.\n\"\n\ndefinition indexInOtherTransaction :: \"('proc, 'op, 'any) trace \\ txId \\ nat \\ bool\" where\n \"indexInOtherTransaction tr tx k \\ \n \\i s ntxns. \n k i tr!i = (s, ABeginAtomic tx ntxns) \n \\ get_invoc (tr!k) \\ s\n \\ \\(\\j. i < j \\ j < k \\ tr!j = (s, AEndAtomic))\"\n\ntext \"With this we can define that a trace is packed, if no such step exists:\"\n\ndefinition transactionIsPacked :: \"('proc, 'op, 'any) trace \\ txId \\ bool\" where\n \"transactionIsPacked tr tx \\ \n \\k. \\indexInOtherTransaction tr tx k\" \n\n\n\n\n\n\\ \\this is an alternative definition, which might be easier to work with in some cases\\\ndefinition transactionIsPackedAlt :: \"('proc, 'op, 'any) trace \\ txId \\ bool\" where\n \"transactionIsPackedAlt tr tx \\ \n if \\i s ntxns. i < length tr \\ tr!i = (s, ABeginAtomic tx ntxns) then\n \\i s end ntxns. \n i < length tr \n \\ tr!i = (s, ABeginAtomic tx ntxns)\n \\ end > i \n \\ (end < length tr \\ tr!end = (s, AEndAtomic) \\ end = length tr) \n \\ (\\j. i\\j \\ j< end \\ get_invoc (tr!j) = s) \n else\n True\n \" \n\nlemma transactionIsPackedAlt_case_tx_exists:\n assumes \"(s, ABeginAtomic tx ntxns) \\ set tr\"\n shows \"transactionIsPackedAlt tr tx \\ \n \\i s end ntxns. \n i < length tr \n \\ tr!i = (s, ABeginAtomic tx ntxns)\n \\ end > i \n \\ (end < length tr \\ tr!end = (s, AEndAtomic) \\ end = length tr) \n \\ (\\j. i\\j \\ j< end \\ get_invoc (tr!j) = s) \n \" \n by (subst transactionIsPackedAlt_def,\n subst if_P,\n insert assms,\n meson in_set_conv_nth, simp)\n\n\n\nlemma transactionIsPackedAlt_eq:\n assumes uniqueTxs: \"\\i j s s' tnxns tnxns'. \\i \\ i = j\"\n shows \"transactionIsPackedAlt tr tx = transactionIsPacked tr tx\"\nproof (auto simp add: transactionIsPackedAlt_def )\n fix i s ntxns ia sa ntxns'\n assume a0: \"i < length tr\"\n and a1: \"tr ! i = (s, ABeginAtomic tx ntxns)\"\n and a2: \"ia < length tr\"\n and a3: \"tr ! ia = (sa, ABeginAtomic tx ntxns')\"\n and a4: \"\\j. ia \\ j \\ j < length tr \\ get_invoc (tr ! j) = sa\"\n\n have [simp]: \"ia = i\"\n using a2 a0 a3 a1 by (rule uniqueTxs)\n\n\n\n then have [simp]: \"sa = s\"\n using a1 a3 by auto \n then have a4': \"\\j. i \\ j \\ j < length tr \\ get_invoc (tr ! j) = s\" \n using a4 by auto\n\n show \"transactionIsPacked tr tx\"\n by (auto simp add: transactionIsPacked_def indexInOtherTransaction_def,\n smt \\ia = i\\ \\sa = s\\ a2 a3 a4' le_eq_less_or_eq le_less_trans prod.inject uniqueTxs)\nnext\n fix i s ntxns\n assume a0: \"i < length tr\"\n and a1: \"tr ! i = (s, ABeginAtomic tx ntxns)\"\n and a2: \"transactionIsPacked tr tx\"\n\n from a2\n have a2': \"get_invoc (tr ! k) = s \\ (\\j tr ! j = (s, AEndAtomic))\" \n if \"kis. (\\ntxns. tr ! i = (s, ABeginAtomic tx ntxns)) \\ (\\end>i. (end < length tr \\ tr ! end = (s, AEndAtomic) \\ end = length tr) \\ (\\j. i \\ j \\ j < end \\ get_invoc (tr ! j) = s))\" \n proof (rule exI[where x=i], (auto simp add: a0))\n show \"\\s. (\\ntxns. tr ! i = (s, ABeginAtomic tx ntxns)) \\ (\\end>i. (end < length tr \\ tr ! end = (s, AEndAtomic) \\ end = length tr) \\ (\\j. i \\ j \\ j < end \\ get_invoc (tr ! j) = s))\"\n proof (rule exI[where x=s], safe)\n show \"\\ntxns. tr ! i = (s, ABeginAtomic tx ntxns)\"\n by (simp add: a1) \n define endPos where \"endPos = (if \\j. i j tr!j = (s, AEndAtomic) then LEAST j. i j tr!j = (s, AEndAtomic) else length tr)\"\n show \"\\end>i. (end < length tr \\ tr ! end = (s, AEndAtomic) \\ end = length tr) \\ (\\j. i \\ j \\ j < end \\ get_invoc (tr ! j) = s) \"\n proof (rule exI[where x=\"endPos\"], (auto simp add: endPos_def))\n show \"\\j. \\i < j; j < length tr; tr ! j = (s, AEndAtomic); (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic)) \\ length tr\\ \\ (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic)) < length tr\"\n by (smt less_trans neqE not_less_Least)\n show \"\\j. \\i < j; j < length tr; tr ! j = (s, AEndAtomic); (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic)) \\ length tr\\ \\ tr ! (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic)) = (s, AEndAtomic)\"\n by (smt LeastI)\n show \"\\j ja. \\i < j; j < length tr; tr ! j = (s, AEndAtomic); i \\ ja; ja < (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic))\\ \\ get_invoc (tr ! ja) = s\"\n by (smt a1 a2' dual_order.strict_trans fst_conv neqE not_le not_less_Least)\n show \"\\j. \\\\j tr ! j \\ (s, AEndAtomic); i \\ j; j < length tr\\ \\ get_invoc (tr ! j) = s\"\n by (metis a1 a2' dual_order.strict_trans fst_conv le_eq_less_or_eq)\n show \"\\j. \\i < j; j < length tr; tr ! j = (s, AEndAtomic)\\ \\ i < (LEAST j. i < j \\ j < length tr \\ tr ! j = (s, AEndAtomic))\"\n by (metis (mono_tags, lifting) LeastI_ex)\n show \"\\j tr ! j \\ (s, AEndAtomic) \\ i < length tr\"\n using a0 by blast \n qed\n qed\n qed \nnext\n show \"\\is ntxns. tr ! i \\ (s, ABeginAtomic tx ntxns) \\ transactionIsPacked tr tx\"\n by (auto simp add: transactionIsPacked_def indexInOtherTransaction_def)\nnext\n fix i s ntxns ia sa ntxns' ende\n assume a0: \"i < length tr\"\n and a1: \"tr ! i = (s, ABeginAtomic tx ntxns)\"\n and a3: \"tr ! ia = (sa, ABeginAtomic tx ntxns')\"\n and a7: \"ia < ende\"\n and a4: \"\\j. ia \\ j \\ j < ende \\ get_invoc (tr ! j) = sa\"\n and a5: \"ende < length tr\"\n and a6: \"tr ! ende = (sa, AEndAtomic)\"\n\n have a2: \"ia < length tr\"\n using a5 a7 less_trans by blast\n\n\n with uniqueTxs have [simp]: \"ia = i\"\n using a0 a1 a3 by blast\n\n then have [simp]: \"sa = s\"\n using a1 a3 by auto \n\n have a4': \"get_invoc (tr ! j) = s\" if \"i \\ j\" and \"j < ende\" for j\n by (auto simp add: that a4) \n\n\n show \"transactionIsPacked tr tx\"\n proof (auto simp add: transactionIsPacked_def indexInOtherTransaction_def)\n fix k i' s' ntxns\n assume b0: \"k < length tr\"\n and b1: \"i' < k\"\n and b2: \"tr ! i' = (s', ABeginAtomic tx ntxns)\"\n and b3: \"\\j>i'. j < k \\ tr ! j \\ (s', AEndAtomic)\"\n and b4: \"get_invoc (tr ! k) \\ s'\"\n\n have \" i' < length tr\"\n using b0 b1 order.strict_trans by blast \n\n\n then have [simp]: \"i' = i\"\n using uniqueTxs b2 a1 a0 by blast \n\n then have [simp]: \"s' = s\"\n using a1 b2 by auto\n\n have b3': \"\\j>i. j < k \\ tr ! j \\ (s, AEndAtomic)\"\n using b3 by simp \n have \"get_invoc (tr ! k) = s\"\n proof (cases \"k < ende\")\n case True\n show ?thesis\n proof (rule a4')\n show \"i \\ k\"\n using \\i' = i\\ b1 dual_order.strict_implies_order by blast \n show \"k < ende\" using True .\n qed\n next case False\n then have \"k \\ ende\" by simp\n show ?thesis\n proof (cases \"k = ende\")\n case True\n then show ?thesis\n by (simp add: a6) \n next\n case False\n then have \"k > ende\"\n by (simp add: \\ende \\ k\\ dual_order.strict_iff_order) \n from b3' have \"ende>i \\ ende < k \\ tr ! ende \\ (s, AEndAtomic)\"\n by blast\n with \\k > ende\\ have \"tr ! ende \\ (s, AEndAtomic)\"\n using \\ia = i\\ a7 by blast\n\n then show ?thesis\n by (simp add: a6) \n qed\n qed \n with b4 show False by simp\n qed\nqed\n\nlemma transactionIsPackedAlt_eq2:\n assumes steps: \"initialState p ~~ tr \\* S\"\n shows \"transactionIsPackedAlt tr tx = transactionIsPacked tr tx\"\n by (auto simp add: transactionIdsUnique[OF steps] transactionIsPackedAlt_eq)\n\n\n\n\n\n\nlemma transactionIsPacked_show:\n assumes steps: \"initialState p ~~ tr \\* S\"\n and beginAtomic1: \"beginAtomic < endAtomic\"\n and beginAtomic2: \"tr!beginAtomic = (s, ABeginAtomic tx ntxns)\"\n and endAtomic1: \"endAtomic < length tr\" \n and endAtomic2: \"tr!endAtomic = (s, AEndAtomic)\"\n and a1: \"\\i. beginAtomic \\ i \\ i \\ endAtomic \\ get_invoc (tr ! i) = s\"\n shows \"transactionIsPacked tr tx\"\nproof (auto simp add: transactionIsPacked_def indexInOtherTransaction_def)\n fix k i s' ntxns\n assume b0: \"k < length tr\"\n and b1: \"i < k\"\n and b2: \"tr ! i = (s', ABeginAtomic tx ntxns)\"\n and b3: \"\\j>i. j < k \\ tr ! j \\ (s', AEndAtomic)\"\n and b4: \"get_invoc (tr ! k) \\ s'\"\n\n from b2\n have \"i = beginAtomic\"\n using b0 b1 beginAtomic1 beginAtomic2 endAtomic1 transactionIdsUnique[OF steps] by auto\n then have \"s' = s\"\n using b2 beginAtomic2 by auto\n\n from b3\n have \"k \\ endAtomic\"\n using \\i = beginAtomic\\ \\s' = s\\ beginAtomic1 endAtomic2 leI by blast\n\n with b4 show False\n using \\i = beginAtomic\\ \\k \\ endAtomic\\ a1 b1 b2 by auto\nqed \n\n\n\n\\ \\the set of transactions occurring in the trace\\ \ndefinition traceTransactions :: \"('proc, 'op, 'any) trace \\ txId set\" where\n \"traceTransactions tr \\ {tx | s tx txns. (s, ABeginAtomic tx txns) \\ set tr}\"\n\ntext \\between begin and end of a transaction there are no actions from other sessions\\\ndefinition transactionsArePacked :: \"('proc, 'op, 'any) trace \\ bool\" where\n \"transactionsArePacked tr \\\n \\i k s t txns. \n i k tr!i = (s, ABeginAtomic t txns) \n \\ get_invoc (tr!k) \\ s\n \\ (\\j. i < j \\ j < k \\ tr!j = (s, AEndAtomic))\"\n\ntext \\\nFor termination proofs, we want to measure how far a trace is from being packed.\nFor this we take the sum over all actions in the trace and count in how many transactions\nit appears.\n\\\n\n\n\\ \\checks if sessions s is in a transaction at position i in trace tr\\\ndefinition inTransaction :: \"('proc, 'op, 'any) trace \\ nat \\ invocId \\ bool\" where \n \"inTransaction tr i s \\\n \\j. j\\i \\ i (\\t txns. tr!j = (s, ABeginAtomic t txns))\n \\ (\\k. j k < length tr \\ k\\i \\ tr!k \\ (s, AEndAtomic))\n\"\n\n\\ \\returns the set of all transactions, which are in a transaction at point i in the trace\\\ndefinition sessionsInTransaction :: \"('proc, 'op, 'any) trace \\ nat \\ invocId set\" where \n \"sessionsInTransaction tr i \\ {s. inTransaction tr i s}\"\n\n\n\n\n\n\nlemma sessionsInTransaction_h1: \" sessionsInTransaction [(s\\<^sub>1, ABeginAtomic t\\<^sub>1 txns), (s\\<^sub>1, AEndAtomic)] 3 = {}\" \n by (auto simp add: sessionsInTransaction_def inTransaction_def nth_Cons' split: if_splits)\n\n\nlemma sessionsInTransaction_h2: \" sessionsInTransaction [(s1, ABeginAtomic t\\<^sub>1 txns)] 0= {s1}\" \n by (auto simp add: sessionsInTransaction_def inTransaction_def nth_Cons' split: if_splits)\n\nlemma sessionsInTransaction_h3: \" sessionsInTransaction [(s\\<^sub>1, ABeginAtomic t\\<^sub>1 txns), (s\\<^sub>1, AEndAtomic)] 1 = {}\" \n by (auto simp add: sessionsInTransaction_def inTransaction_def nth_Cons' split: if_splits )\n\n\n\nlemma sessionsInTransaction_append:\n \"i sessionsInTransaction (xs@ys) i = sessionsInTransaction xs i\"\n by (auto simp add: nth_append sessionsInTransaction_def inTransaction_def)\n\n\n\nlemma not_packed_example:\n assumes notPacked: \"\\transactionsArePacked tr\"\n shows \"\\i k s t ts a s'. \n tr ! k = (s', a)\n \\ i k tr!i = (s, ABeginAtomic t ts) \n \\ s' \\ s\n \\ (\\j. i < j \\ j < k \\ tr!j \\ (s, AEndAtomic))\"\n using assms by (auto simp add: transactionsArePacked_def, metis prod.collapse)\n\n\n\n\n\nlemma show_traceCorrect_same:\n assumes sameTraceContent: \"set tr = set tr'\"\n shows \"traceCorrect tr' = traceCorrect tr\"\n using assms by (auto simp add: traceCorrect_def)\n\n\n\ndefinition allowed_context_switch where \n \"allowed_context_switch action \\ \n (\\txId txns. action = ABeginAtomic txId txns) \n \\ (\\p. action = AInvoc p)\"\n\nlemma allowed_context_switch_cases[consumes 1, elim, case_names invoc beginAtomic]:\n assumes \"allowed_context_switch action\"\n and \"\\p. action = AInvoc p \\ P\"\n and \"\\txId txns. action = ABeginAtomic txId txns \\ P\"\n shows P\n using allowed_context_switch_def assms by blast\n\n\n\nlemma allowed_context_switch_simps:\n shows \"\\allowed_context_switch (ALocal ok)\" \n and \"\\allowed_context_switch (ANewId uid)\"\n and \"allowed_context_switch (ABeginAtomic t ats)\"\n and \"\\allowed_context_switch AEndAtomic\" \n and \"\\allowed_context_switch (ADbOp c x ar)\" \n and \"allowed_context_switch (AInvoc p)\"\n and \"\\allowed_context_switch (AReturn ir)\" \n and \"\\allowed_context_switch ACrash\" \n and \"\\allowed_context_switch (AInvcheck invr)\" by (auto simp add: allowed_context_switch_def)\n\n\n\n\nlemma canSwap_when_allowed:\n assumes no_ctxt_switch: \"\\allowed_context_switch b\"\n and no_invcheck_a: \"\\is_AInvcheck a\"\n and no_invcheck_b: \"\\is_AInvcheck b\" \n and no_fail_a: \"a \\ ACrash\"\n and no_fail_b: \"b \\ ACrash\" \n shows \"canSwap t a b\"\n by (metis allowed_context_switch_def canSwap_cases no_ctxt_switch no_fail_a no_fail_b no_invcheck_a no_invcheck_b)\n\n\n\n\ndefinition packed_trace :: \"('proc, 'op, 'any) trace \\ bool\" where\n \"packed_trace tr \\\n \\i.\n 0 i get_invoc (tr!(i-1)) \\ get_invoc (tr!i)\n \\ (allowed_context_switch (get_action (tr!i)))\" \n\n\ntext \\\\DefineSnippet{packed_trace_def}{\n @{thm [display] packed_trace_def[unfolded imp_conjL[symmetric]]}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{allowed_context_switch_def}{\n @{thm [display] allowed_context_switch_def}\n}%EndSnippet\\\n\nlemmas use_packed_trace = iffD1[OF packed_trace_def[THEN meta_eq_to_obj_eq], rule_format]\n\n\n\nlemma prefixes_are_packed:\n assumes \"packed_trace tr'\" \n and \"isPrefix tr tr'\"\n shows \"packed_trace tr\"\n using \\packed_trace tr'\\ by (auto simp add: packed_trace_def,\n metis (no_types, lifting) Suc_leI assms(2) diff_less_Suc isPrefix_len isPrefix_same less_le_trans)\n\n\n\nlemma context_switches_in_packed: \n assumes packed: \"packed_trace tr\"\n and split_tr: \"tr = tr1@[(s,a),(s',a')]@tr2\"\n and differentSession: \"s \\ s'\"\n shows \"allowed_context_switch a'\"\nproof -\n have \"a' = get_action(tr!(1+length tr1))\"\n using split_tr by (auto simp add: nth_append)\n\n moreover\n have \"allowed_context_switch (get_action(tr!(1+length tr1)))\"\n using packed proof (rule use_packed_trace)\n show \"0 < 1 + length tr1\" by simp\n show \"1 + length tr1 < length tr\" using split_tr by auto\n show \"get_invoc (tr ! (1 + length tr1 - 1)) \\ get_invoc (tr ! (1 + length tr1))\" using split_tr \\s \\ s'\\ by (auto simp add: nth_append)\n qed\n ultimately\n show ?thesis by simp\nqed \n\n\n\ndefinition packed_trace_i :: \"('proc, 'op, 'any) trace \\ invocId \\ bool\" where\n \"packed_trace_i tr i \\\n \\k.\n 0 k get_invoc (tr!k) = i\n \\ get_invoc (tr!(k-1)) \\ i\n \\ (allowed_context_switch (get_action (tr!k)))\" \n\ntext_raw \\\\DefineSnippet{pack_trace_for_one_session}{\\\nlemma pack_trace_for_one_session:\n assumes steps: \"initialState program ~~ tr1 \\* C\"\n and noFail: \"\\s. (s, ACrash) \\ set tr1\" (is \"\\s. _ \\ set ?tr\")\n and noInvcheck: \"\\s a. (s, a)\\set tr1 \\ \\is_AInvcheck a \"\n shows \"\\tr'. packed_trace_i tr' s\n \\ (initialState program ~~ tr' \\* C)\n \\ (\\s. packed_trace_i tr1 s \\ packed_trace_i tr' s)\n \\ (set tr' = set tr1)\"\ntext_raw \\}%EndSnippet\\\n text \\By induction over the minimal index that is not packed.\\\nproof -\n\n have \"\\tr'. \n (\\i(0 < i \n \\ get_invoc (tr'!(i-1)) \\ s \n \\ get_invoc (tr'!i) = s \n \\ \\(allowed_context_switch (get_action(tr'!i))) ) )\n \\ (initialState program ~~ tr' \\* C)\n \\ (length tr' = length tr1)\n \\ (\\s. packed_trace_i tr1 s \\ packed_trace_i tr' s)\n \\ (set tr' = set tr1)\" (is \"\\tr'. ?P tr'\")\n proof (rule fix_smallest_induct, auto simp add: assms disj_imp rewrite_and_implies, rename_tac tr i)\n\n show \"\\tr'. \n (\\j\\i. 0 < j \n \\ get_invoc (tr' ! (j - Suc 0)) \\ get_invoc (tr ! i) \n \\ get_invoc (tr' ! j) = get_invoc (tr ! i) \n \\ allowed_context_switch (get_action (tr' ! j))) \n \\ initialState program ~~ tr' \\* C \n \\ length tr' = length tr1 \n \\ (\\s. packed_trace_i tr1 s \\ packed_trace_i tr' s) \n \\ set tr' = set tr1\"\n if c0: \"\\j. j < i \\ 0 < j \\ get_invoc (tr ! (j - Suc 0)) \\ get_invoc (tr ! i) \\ get_invoc (tr ! j) = get_invoc (tr ! i) \\ allowed_context_switch (get_action (tr ! j))\"\n and c1: \"i < length tr1\"\n and c2: \"initialState program ~~ tr \\* C\"\n and i1[simp]: \"0 < i\"\n and c4: \"length tr = length tr1\"\n and c5: \"get_invoc (tr ! (i - Suc 0)) \\ get_invoc (tr ! i)\"\n and c6: \"\\s. packed_trace_i tr1 s \\ packed_trace_i tr s\"\n and same_tr: \"set tr = set tr1\"\n and i5: \"\\ allowed_context_switch (get_action (tr ! i))\"\n and c8: \"s = get_invoc (tr ! i)\"\n for tr i\n proof -\n\n have i2: \"iThere must be a previous action on the same invocId (at least the invocId should be there, since i is no invocId).\\\n obtain prev\n where prev1: \"get_invoc(tr!prev) = s\"\n and prev2: \"prev < i\"\n and prev3: \"\\j. \\prev < j; j < i\\ \\ get_invoc(tr!j) \\ s\"\n proof (atomize_elim)\n from \\initialState program ~~ tr \\* C\\ \\i \\get_invoc (tr!i) = s\\\n have \"\\j (\\p. get_action (tr ! j) = AInvoc p)\"\n proof (rule exists_invoc)\n show \"\\p. get_action (tr ! i) \\ AInvoc p\"\n using allowed_context_switch_def[where action=\"get_action (tr ! i)\"] i5 by blast\n show \"\\ is_AInvcheck (get_action (tr ! i))\"\n by (metis i2 noInvcheck nth_mem prod.collapse same_tr)\n qed\n then have \"\\jj. (j get_invoc (tr ! j) = s) \\ (\\j'. j' get_invoc (tr ! j') = s \\ j'\\j)\"\n proof (rule exists_greatest')\n show \"\\bound. \\j. j < i \\ get_invoc (tr ! j) = s \\ j \\ bound\"\n using less_or_eq_imp_le by blast\n qed\n from this obtain j where \"(j get_invoc (tr ! j) = s) \\ (\\j'. j' get_invoc (tr ! j') = s \\ j'\\j)\"\n by blast\n then have \"get_invoc (tr ! j) = s \\ j < i \\ (\\j'>j. j' < i \\ get_invoc (tr ! j') \\ s)\"\n by auto\n\n then show \"\\prev. get_invoc (tr ! prev) = s \\ prev < i \\ (\\j>prev. j < i \\ get_invoc (tr ! j) \\ s)\" ..\n qed\n\n have [simp]: \"prev < length tr\"\n using i2 order.strict_trans prev2 by blast\n have [simp]: \"min (length tr) prev = prev\"\n using i2 prev2 by linarith \n have [simp]: \"min (length tr) i = i\"\n using i2 by linarith \n\n text \\Then we can split the trace, so that we have (one action from s) -- (many other actions) -- (action i form s)\\\n have tr_split: \"tr = take prev tr @ [tr!prev] @ drop (Suc prev) (take i tr) @ [tr!i] @ drop (Suc i) tr\"\n proof (rule nth_equalityI)\n show \"length tr = length (take prev tr @ [tr ! prev] @ drop (Suc prev) (take i tr) @ [tr ! i] @ drop (Suc i) tr)\"\n using i2 prev2 by auto\n show \"tr ! ia = (take prev tr @ [tr ! prev] @ drop (Suc prev) (take i tr) @ [tr ! i] @ drop (Suc i) tr) ! ia\" if \"iaBecause of the swap lemma we can change this to (one action from s) -- (action i form s) -- (many other actions)\\\n define tr' where \"tr' = take prev tr @ [tr!prev, tr!i] @ drop (Suc prev) (take i tr) @ drop (Suc i) tr\"\n\n have tr'sameLength: \"length tr' = length tr\"\n using i2 prev2 by (auto simp add: tr'_def)\n\n\n have tr'_sameSet: \"set tr' = set tr\" \n by (subst tr_split, subst tr'_def, auto)\n\n\n have tr'1: \"tr'!x = tr!x\" if \"x \\ prev\" for x\n using that by (auto simp add: tr'_def nth_append)\n moreover have tr'2: \"tr'!x = tr!i\" if \"x=Suc prev\" for x\n using that by (auto simp add: tr'_def nth_append)\n moreover have tr'3: \"tr'!x = tr!(x-1)\" if \"x>Suc prev\" and \"x i\" and \"x < length tr\" for x\n using that prev2 by (auto simp add: tr'_def nth_append nth_Cons')\n ultimately have tr'i_def: \"tr'!x = (if x\\prev then tr!x else if x=Suc prev then tr!i else if x\\i then tr!(x-1) else tr!x)\" if \"x* C\"\n proof (rule swapMany_middle')\n show \"initialState program ~~ (take prev tr @ [tr ! prev]) @ drop (Suc prev) (take i tr) @ [tr ! i] @ drop (Suc i) tr \\* C\"\n using tr_split c2 by auto \n\n show \"\\x. x \\ set (drop (Suc prev) (take i tr)) \\ get_invoc x \\ get_invoc (tr ! i)\"\n using prev3 by (auto simp add: in_set_conv_nth,\n metis add.commute add_Suc_right fst_conv i4 less_add_Suc1 less_diff_conv) \n\n from i5\n show \"canSwap t (get_action x) (get_action (tr ! i))\" if \"x \\ set (drop (Suc prev) (take i tr))\" for x t\n proof (rule canSwap_when_allowed)\n from that obtain k \n where k1: \"x = tr!k\" \n and k2: \"kprev\"\n by (auto simp add: in_set_conv_nth)\n\n then have k4: \"x\\set tr\"\n using dual_order.strict_trans i2 nth_mem by blast\n\n\n show \"\\ is_AInvcheck (get_action x)\"\n by (metis k4 noInvcheck prod.collapse same_tr)\n show \"\\ is_AInvcheck (get_action (tr ! i))\"\n by (metis i2 noInvcheck nth_mem prod.collapse same_tr)\n show \"get_action x \\ ACrash\"\n by (metis k4 noFail prod.collapse same_tr)\n show \"get_action (tr ! i) \\ ACrash\"\n by (metis c1 c4 noFail nth_mem same_tr surjective_pairing)\n qed \n\n show \"state_wellFormed (initialState program)\"\n by (simp add: state_wellFormed_init)\n\n from noFail\n show \"\\i. (i, ACrash) \\ set (take prev tr @ [tr ! prev])\"\n by (metis Un_iff same_tr set_append tr_split)\n from noFail\n show \"\\ia. (ia, ACrash) \\ set (drop (Suc prev) (take i tr))\"\n using in_set_dropD in_set_takeD same_tr by fastforce\n qed \n\n\n then have \"initialState program ~~ tr' \\* C\"\n by (simp add: tr'_def)\n\n have tr'packed: \"packed_trace_i tr' s\" if \"packed_trace_i tr s\" for s\n using that Suc_leI prev2 \n by (auto simp add: packed_trace_i_def tr'i_def tr'sameLength i4 prev1,\n metis Suc_pred c8 diff_le_self le_less_Suc_eq le_zero_eq not_le_imp_less,\n metis Suc_pred c5 i2 i5 le_less_Suc_eq not_le_imp_less not_less0 not_less_iff_gr_or_eq)\n\n show \"\\tr'. (\\j\\i. 0 < j \\\n get_invoc (tr' ! (j - Suc 0)) \\ get_invoc (tr ! i) \\\n get_invoc (tr' ! j) = get_invoc (tr ! i) \\ allowed_context_switch (get_action (tr' ! j))) \\\n (initialState program ~~ tr' \\* C) \\\n length tr' = length tr1 \\ (\\s. packed_trace_i tr1 s \\ packed_trace_i tr' s) \\ set tr' = set tr1\"\n proof (rule exI[where x=tr'], intro conjI impI allI)\n\n show \"initialState program ~~ tr' \\* C\"\n by (simp add: \\initialState program ~~ tr' \\* C\\)\n show \"length tr' = length tr1\"\n using c4 tr'sameLength by auto\n\n show \"\\s. packed_trace_i tr1 s \\ packed_trace_i tr' s\"\n using c6 tr'packed by blast\n\n show \"allowed_context_switch (get_action (tr' ! j))\"\n if d0: \"j \\ i\"\n and d1: \"0 < j\"\n and d2: \"get_invoc (tr' ! (j - Suc 0)) \\ get_invoc (tr ! i)\"\n and d3: \"get_invoc (tr' ! j) = get_invoc (tr ! i)\"\n for j\n proof (cases \"j = i\")\n case True\n then show ?thesis\n using c5 d3 tr'4 by (auto simp add: tr'_def nth_append nth_Cons' split: if_splits)\n next\n case False\n hence \"j < i\"\n using antisym_conv2 d0 by blast\n hence \"allowed_context_switch (get_action (tr ! j))\"\n by (smt Suc_pred c0 c1 c4 c8 d0 d1 d2 d3 diff_Suc_1 leD less_trans not_le_imp_less not_less_eq prev1 prev3 tr'i_def)\n\n thus \"allowed_context_switch (get_action (tr' ! j))\"\n using \\j < i\\ c1 c4 c8 d2 d3 less_trans prev1 prev3 tr'i_def by auto\n qed\n\n show \" set tr' = set tr1\"\n by (simp add: same_tr tr'_sameSet)\n qed\n qed\n qed\n\n thus ?thesis\n by (metis packed_trace_i_def)\n\nqed\n\n\nlemma packed_trace_iff_all_sessions_packed:\n \"packed_trace tr \\ (\\i. packed_trace_i tr i)\"\n by (auto simp add: packed_trace_def packed_trace_i_def)\n\ntext \\\\DefineSnippet{packed_trace_i_def}{\n @{thm [display] packed_trace_i_def[unfolded imp_conjL[symmetric]]}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{packed_trace_iff_all_sessions_packed}{\n @{thm [display] packed_trace_iff_all_sessions_packed}\n}%EndSnippet\\\n\n\ntext \\Now we can just repeat fixing invocId by invocId, until all sessions are packed.\\\nlemma pack_trace:\n assumes steps: \"initialState program ~~ tr \\* C\"\n and noFail: \"\\s. (s, ACrash) \\ set tr\"\n and noInvcheck: \"\\s a. (s, a)\\set tr \\ \\is_AInvcheck a \"\n shows \"\\tr'. packed_trace tr'\n \\ (initialState program ~~ tr' \\* C)\n \\ (set tr' = set tr)\"\nproof -\n have \"{s. \\packed_trace_i tr s } \\ set (map get_invoc tr)\"\n by (auto simp add: packed_trace_i_def)\n\n then have \"finite {s. \\packed_trace_i tr s }\"\n using infinite_super by blast\n\n from this and assms\n show ?thesis\n proof (induct \"{s. \\packed_trace_i tr s }\" arbitrary: tr rule: finite_psubset_induct)\n case psubset\n\n show ?case \n proof (cases \"{s. \\packed_trace_i tr s } = {}\")\n case True\n then have \"packed_trace tr\"\n by (auto simp add: packed_trace_iff_all_sessions_packed)\n then show ?thesis\n using psubset.prems by blast \n next\n case False\n from this obtain s where \"\\ packed_trace_i tr s\"\n by blast\n\n\n from \\initialState program ~~ tr \\* C\\ \\\\s. (s, ACrash) \\ set tr\\ \\\\s a. (s, a) \\ set tr \\ \\ is_AInvcheck a\\\n have \"\\tr'. packed_trace_i tr' s \n \\ (initialState program ~~ tr' \\* C) \n \\ (\\s. packed_trace_i tr s \\ packed_trace_i tr' s) \n \\ (set tr' = set tr)\" \n by (rule pack_trace_for_one_session; force)\n\n from this\n obtain tr' \n where tr'1: \"packed_trace_i tr' s\"\n and tr'2: \"initialState program ~~ tr' \\* C\"\n and tr'3: \"\\s. packed_trace_i tr s \\ packed_trace_i tr' s\"\n and tr'4: \"set tr' = set tr\"\n by blast\n\n from tr'1 tr'3 \\\\ packed_trace_i tr s\\\n have subset: \"{s. \\packed_trace_i tr' s } \\ {s. \\packed_trace_i tr s }\"\n by auto\n\n from subset tr'2\n have \" \\tr''. packed_trace tr'' \\ (initialState program ~~ tr'' \\* C) \\ set tr'' = set tr'\"\n proof (rule psubset.hyps(2))\n show \"\\s. (s, ACrash) \\ set tr'\"\n by (simp add: psubset.prems(2) tr'4)\n show \"\\s a. (s, a) \\ set tr' \\ \\ is_AInvcheck a\"\n using psubset.prems(3) tr'4 by blast\n qed\n\n thus ?thesis\n by (simp add: tr'4)\n qed\n qed\nqed\n\nlemma remove_invchecks:\n assumes \"(S ~~ tr \\* S') \"\n shows \"(S ~~ filter (\\a. \\is_AInvcheck (get_action a)) tr \\* S')\"\n using assms proof (induct rule: steps_induct)\n case initial\n then show ?case \n by (simp add: steps_refl)\nnext\n case (step S' tr a S'')\n then show ?case \n by( auto simp add: is_AInvcheck_def step.simps steps_step steps_empty)\nqed\n\n\n\ntext_raw \\\\DefineSnippet{pack_incorrect_trace}{\\\nlemma pack_incorrect_trace:\n assumes steps: \"initialState program ~~ tr \\* C\"\n and noFail: \"\\s. (s, ACrash) \\ set tr\"\n and notCorrect: \"\\traceCorrect tr\"\n shows \"\\tr' C'. packed_trace tr' \n \\ (initialState program ~~ tr' \\* C')\n \\ (\\s. (s, ACrash) \\ set tr')\n \\ \\traceCorrect tr'\"\ntext_raw \\}%EndSnippet\\\nproof -\n text \\As the trace is not correct, there must be a failing invariant:\\ \n\n show ?thesis\n proof (cases \"\\failPos1 < length tr. \\s. tr ! failPos1 = (s, AInvcheck False)\")\n case True\n\n from this\n obtain failPos1 \n where failPos1_props: \"failPos1 < length tr \\ (\\s. tr ! failPos1 = (s, AInvcheck False))\"\n by blast\n\n text \\Now take the minimal failing position.\\ \n then have \"\\failPos1. (failPos1 < length tr \\ (\\s. tr ! failPos1 = (s, AInvcheck False)))\n \\ (\\i. (i < length tr \\ (\\s. tr ! i = (s, AInvcheck False))) \\ i \\ failPos1)\"\n by (rule ex_has_least_nat)\n from this\n obtain failPos failPos_s \n where failPos_len: \"failPos < length tr\" \n and failPos_fail: \"tr ! failPos = (failPos_s, AInvcheck False)\"\n and failPos_min: \"\\ i. \\i < length tr; \\s txns. tr ! i = (s, AInvcheck False)\\ \\ i\\failPos\"\n by auto\n\n\n\n text \\Only the part leading to the invariant violation is relevant ...\\ \n\n define tr' where \"tr' = take failPos tr\"\n\n from steps\n obtain C' where tr'_steps: \"initialState program ~~ tr' \\* C'\"\n by (metis append_take_drop_id steps_append tr'_def)\n\n from steps\n have \"initialState program ~~ (tr'@[tr!failPos]@drop (Suc failPos) tr) \\* C\"\n by (metis \\failPos < length tr\\ append.assoc append_take_drop_id take_Suc_conv_app_nth tr'_def)\n then have \"\\C''. C' ~~ tr ! failPos \\ C''\"\n using tr'_steps by (auto simp add: steps_append2 steps_appendFront)\n\n then have C'_fails: \"\\s. C' ~~ (s, AInvcheck False) \\ C'\" \n by (auto simp add: failPos_fail step_simps)\n\n\n text \\Now remove all other invariant checks\\\n define tr'' where \"tr'' = filter (\\a. \\is_AInvcheck (get_action a)) tr'\"\n\n from tr'_steps\n have tr''_steps: \"initialState program ~~ tr'' \\* C'\"\n using remove_invchecks tr''_def by blast\n\n\n have no_crash'': \"\\s. (s, ACrash) \\ set tr''\"\n using noFail by (auto simp add: tr'_def tr''_def dest: in_set_takeD)\n have no_invcheck'': \"\\s a. (s, a) \\ set tr'' \\ \\ is_AInvcheck a\"\n by (auto simp add: tr''_def)\n\n from tr''_steps no_crash'' no_invcheck''\n have \"\\tr'''. packed_trace tr''' \\ (initialState program ~~ tr''' \\* C') \\ (set tr''' = set tr'')\"\n by (rule pack_trace)\n\n from this\n obtain tr'''\n where tr'''1: \"packed_trace tr'''\"\n and tr'''2: \"initialState program ~~ tr''' \\* C'\"\n and tr'''3: \"set tr''' = set tr''\"\n by blast\n\n define tr4 where \"tr4 = tr''' @ [(get_invoc (last tr'''), AInvcheck False)]\"\n\n from \\packed_trace tr'''\\\n have \"packed_trace tr4\"\n by (auto simp add: packed_trace_def tr4_def nth_append,\n metis One_nat_def gr_implies_not_zero last_conv_nth length_0_conv less_SucE)\n\n\n moreover have \"initialState program ~~ tr4 \\* C'\"\n using C'_fails steps_append2 steps_single tr'''2 tr4_def by blast\n moreover have \"\\s. (s, ACrash) \\ set tr4\"\n by (simp add: no_crash'' tr'''3 tr4_def)\n moreover have \"\\ traceCorrect tr4\"\n by (simp add: actionCorrect_def tr4_def traceCorrect_def)\n\n ultimately show ?thesis by blast\n next \n case False\n hence \"(i, AInvcheck False) \\ set tr\" for i\n by (meson in_set_conv_nth)\n hence assertionError: \"\\i. (i, ALocal False) \\ set tr\"\n using notCorrect by (auto simp add: traceCorrect_def actionCorrect_def)\n\n\n\n text \\Remove all invariant checks\\\n define tr' where \"tr' = filter (\\a. \\is_AInvcheck (get_action a)) tr\"\n\n from steps\n have tr'_steps: \"initialState program ~~ tr' \\* C\"\n using remove_invchecks tr'_def by blast\n\n\n have noFail': \"\\s. (s, ACrash) \\ set tr'\"\n by (simp add: noFail tr'_def)\n\n\n have \"\\tr''. packed_trace tr'' \n \\ (initialState program ~~ tr'' \\* C) \n \\ (set tr'' = set tr')\"\n proof (rule pack_trace[OF tr'_steps noFail'])\n show \"\\s a. (s, a) \\ set tr' \\ \\ is_AInvcheck a\"\n by (simp add: tr'_def)\n qed\n\n from this obtain tr''\n where \"packed_trace tr'' \"\n and \"initialState program ~~ tr'' \\* C\"\n and \"set tr'' = set tr'\"\n by blast\n\n show ?thesis\n proof (intro exI[where x=tr''] exI[where x=C] conjI)\n show \" packed_trace tr''\"\n by (simp add: \\packed_trace tr''\\)\n\n show \" initialState program ~~ tr'' \\* C\"\n by (simp add: \\initialState program ~~ tr'' \\* C\\)\n\n show \" \\s. (s, ACrash) \\ set tr''\"\n by (simp add: \\set tr'' = set tr'\\ noFail')\n\n from assertionError\n show \" \\ traceCorrect tr''\"\n using `set tr'' = set tr'` is_AInvcheck_def\n by (auto simp add: tr'_def traceCorrect_def actionCorrect_def)\n qed \n qed\nqed\n\n\n\n\n\nend\n", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/packed_traces.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792046, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.29325899800760713}} {"text": "theory Safety_Certification_Pure\n imports\n Safety_Certification\n \\ \\We generalize the material from this theory to federation subsumption:\\\n Certification.Unreachability_Certification2 \\ \\XXX: These should be merged.\\\nbegin\n\nlocale Reachability_Impl_pure_base =\n Reachability_Impl_base where less_eq = less_eq\n for less_eq :: \"'a \\ 'a set \\ bool\" (infix \"\\\" 50) +\n fixes get_succs and K and A and L and Li and lei\n and Li_split :: \"'ki list list\"\n assumes K_right_unique: \"single_valued K\"\n assumes K_left_unique: \"single_valued (K\\)\"\n assumes Li_L: \"(Li, L) \\ \\K\\list_set_rel\"\n assumes lei_less_eq: \"(lei, less_eq) \\ A \\ \\A\\list_set_rel \\ bool_rel\"\n assumes get_succs_succs[param]:\n \"(get_succs, succs) \\ K \\ \\A\\list_set_rel \\ \\K \\\\<^sub>r \\A\\list_set_rel\\list_rel\"\n assumes full_split: \"set Li = (\\xs \\ set Li_split. set xs)\"\nbegin\n\nlemma lei_refine[refine_mono]:\n \\RETURN (lei a b) \\ RETURN (a' \\ b')\\ if \\(a, a') \\ A\\ \\(b, b') \\ \\A\\list_set_rel\\\n using that using lei_less_eq by simp (metis pair_in_Id_conv tagged_fun_relD_both)\n\ndefinition list_all_split :: \"_ \\ 'ki list \\ bool\" where [simp]:\n \"list_all_split = list_all\"\n\ndefinition monadic_list_all_split :: \"_ \\ 'ki list \\ bool nres\" where [simp]:\n \"monadic_list_all_split = monadic_list_all\"\n\nlemmas pure_unfolds =\n monadic_list_all_RETURN[where 'a = 'ki, folded monadic_list_all_split_def list_all_split_def]\n monadic_list_ex_RETURN monadic_list_all_RETURN monadic_list_ex_RETURN\n nres_monad1 option.case_distrib[where h = RETURN, symmetric]\n if_distrib[where f = RETURN, symmetric] prod.case_distrib[where h = RETURN, symmetric]\n\nlemma list_all_split:\n \"list_all_split Q Li = list_all id (Parallel.map (list_all Q) Li_split)\"\n unfolding list_all_split_def list_all_split[OF full_split, symmetric] Parallel.map_def ..\n\nend\n\n\nlocale Reachability_Impl_pure_invariant =\n Certification_Impl_invariant where M = M +\n Reachability_Impl_pure_base where Li_split = Li_split\n for M :: \"'k \\ 'a set\" and Li_split :: \"'ki list list\"\n\nlocale Reachability_Impl_pure_base2 =\n Reachability_Impl_pure_base where less_eq = less_eq and Li_split = Li_split\n for less_eq :: \"'a \\ 'a set \\ bool\" (infix \"\\\" 50) and Li_split :: \"'ki list list\" +\n fixes Pi and Fi\n assumes Pi_P'[refine,param]: \"(Pi, P') \\ K \\\\<^sub>r A \\ bool_rel\"\n assumes Fi_F[refine]: \"(Fi, F) \\ K \\\\<^sub>r A \\ bool_rel\"\n\nlocale Reachability_Impl_pure =\n Certification_Impl_common where M = M +\n Reachability_Impl_pure_base2 +\n Reachability_Impl_correct where M = \"\\x. case M x of None \\ {} | Some S \\ S\"\n for M :: \"'k \\ 'a set option\" +\n fixes Mi l\\<^sub>0i s\\<^sub>0i\n assumes Mi_M[param]: \"(Mi, M) \\ K \\ \\\\A\\list_set_rel\\option_rel\"\n assumes l\\<^sub>0i_l\\<^sub>0[refine,param]: \"(l\\<^sub>0i, l\\<^sub>0) \\ K\"\n and s\\<^sub>0i_s\\<^sub>0[refine,param,refine_mono]: \"(s\\<^sub>0i, s\\<^sub>0) \\ A\"\n fixes nonempty :: \"'a \\ bool\"\n assumes empty_not_subsumed [simp]:\n \"nonempty x \\ x \\ {} \\ False\"\n assumes succs_nonempty:\n \"(l', S') \\ set (succs l S) \\ x \\ S' \\ nonempty x\"\n assumes M_l\\<^sub>0_not_None: \"s\\<^sub>0 \\ {} \\ M l\\<^sub>0 \\ None\"\nbegin\n\nparagraph \\Refinement\\\n\ndefinition \"check_invariant1 L' \\\ndo {\n monadic_list_all_split (\\l.\n case Mi l of\n None \\ RETURN True\n | Some as \\ do {\n let succs = get_succs l as;\n monadic_list_all (\\(l', xs).\n do {\n if xs = [] then RETURN True\n else do {\n case Mi l' of\n None \\ RETURN False\n | Some ys \\ monadic_list_all (\\x.\n RETURN (lei x ys)\n ) xs\n }\n }\n ) succs\n }\n ) L'\n}\n\"\n\nlemma Mi_M_None_iff[simp]:\n \"M l = None \\ Mi li = None\" if \"(li, l) \\ K\"\nproof -\n from that have \"(Mi li, M l) \\ \\\\A\\list_set_rel\\option_rel\"\n by parametricity\n then show ?thesis\n by auto\nqed\n\ndefinition A' where \"A' = {(c, a). (c, a) \\ A \\ nonempty a}\"\n\nlemma A'_le_A [relator_props]:\n \"A' \\ A\"\n unfolding A'_def by auto\n\nlemma get_succs_succs'[param]:\n \"(get_succs, succs) \\ K \\ \\A\\list_set_rel \\ \\K \\\\<^sub>r \\A'\\list_set_rel\\list_rel\"\n using succs_nonempty get_succs_succs unfolding A'_def\n by (auto dest!: fun_relD)\n (auto elim!: list.rel_mono_strong intro!: relcomp.relcompI\n simp: refine_rel_defs list_set_rel_def)\n\nlemma empty_not_subsumed' [simp]:\n \"(cs, as) \\ \\A'\\list_rel \\ x \\ set as \\ x \\ {} \\ False\"\n unfolding A'_def by (auto elim: list_rel_setE2)\n\nlemma check_invariant1_refine[refine]:\n \"check_invariant1 L1 \\ check_invariant L'\" if \"(L1, L') \\ \\K\\list_rel\" \"L = dom M\"\n unfolding check_invariant1_def check_invariant_def Let_def monadic_list_all_split_def\n apply (refine_rcg monadic_list_all_mono' refine_IdI that)\n apply (clarsimp split: option.splits simp: succs_empty; safe)\n apply (simp flip: Mi_M_None_iff; fail)\n apply (refine_rcg monadic_list_all_mono')\n apply parametricity\n subgoal\n using Mi_M by (auto dest!: fun_relD1)\n apply (clarsimp split: option.splits; safe)\n apply (\n elim list_set_relE specify_right;\n auto simp: monadic_list_all_False intro!: res_right simp flip: Mi_M_None_iff; fail)\n apply (\n elim list_set_relE specify_right;\n auto simp: monadic_list_all_RETURN list_all_iff intro!: res_right simp flip: Mi_M_None_iff;\n fail)+\n subgoal premises prems for _ _ _ _ li _ l _ S xsi\n proof -\n have rel_mono: \"\\A'\\list_rel \\ \\A\\list_rel\"\n by (intro relator_props)\n have *: \\li \\ set Li \\ l \\ L\\ if \\(li, l) \\ K\\\n using that using Li_L K_left_unique K_right_unique\n by (auto dest: single_valuedD elim: list_rel_setE1 list_rel_setE2 elim!: list_set_relE)\n have [simp]: \"l \\ L\"\n using prems(6) that(2) by blast\n from prems have \"(Mi li, M l) \\ \\\\A\\list_set_rel\\option_rel\"\n by parametricity\n with prems have \"(xsi, S) \\ \\A\\list_set_rel\"\n by auto\n with prems show ?thesis\n apply (elim list_set_relE, elim specify_right)\n apply (clarsimp, safe)\n apply (auto; fail)\n supply [refine_mono] = monadic_list_all_mono' monadic_list_ex_mono'\n apply refine_mono\n using rel_mono by fast\n qed\n done\n\ndefinition check_prop1 where\n \"check_prop1 L' M' = do {\n l \\ RETURN L';\n monadic_list_all (\\l. do {\n let S = op_map_lookup l M';\n case S of None \\ RETURN True | Some S \\ do {\n xs \\ RETURN S;\n r \\ monadic_list_all (\\s.\n RETURN (Pi (l, s))\n ) xs;\n RETURN r\n }\n }\n ) l\n }\"\n\nlemma check_prop1_refine:\n \"(check_prop1, check_prop') \\ \\K\\list_set_rel \\ (K \\ \\\\A\\list_set_rel\\option_rel) \\ \\Id\\nres_rel\"\n supply [refine] =\n list_of_set_impl[THEN fun_relD, THEN nres_relD] monadic_list_all_mono' case_option_mono'\n supply [refine_mono] =\n monadic_list_all_mono' list_of_set_impl[THEN fun_relD, THEN nres_relD]\n unfolding check_prop1_def check_prop'_def list_of_set_def[symmetric] Let_def op_map_lookup_def\n apply refine_rcg\n apply assumption\n apply (refine_rcg refine_IdI, assumption)\n apply parametricity\n apply (rule bind_mono)\n apply refine_mono+\n using Pi_P'\n apply (auto simp add: prod_rel_def dest!: fun_relD)\n done\n\nlemma [refine]:\n \"(Mi l\\<^sub>0i \\ None, l\\<^sub>0 \\ L) \\ bool_rel\" if \"L = dom M\"\n using that by (auto simp: Mi_M_None_iff[symmetric, OF l\\<^sub>0i_l\\<^sub>0])\n\nlemma [refine]:\n \"(Pi (l\\<^sub>0i, s\\<^sub>0i), P' (l\\<^sub>0, s\\<^sub>0)) \\ bool_rel\"\n by parametricity\n\ndefinition\n \"check_all_pre1 \\ do {\n b1 \\ RETURN (Mi l\\<^sub>0i \\ None);\n b2 \\ RETURN (Pi (l\\<^sub>0i, s\\<^sub>0i));\n case Mi l\\<^sub>0i of\n None \\ RETURN False\n | Some xs \\ do {\n b3 \\ RETURN (lei s\\<^sub>0i xs);\n b4 \\ check_prop1 Li Mi;\n RETURN (b1 \\ b2 \\ b3 \\ b4)\n }\n }\"\n\ndefinition check_all_pre0 where\n \"check_all_pre0 = do {\n b1 \\ RETURN (l\\<^sub>0 \\ L);\n b2 \\ RETURN (P' (l\\<^sub>0, s\\<^sub>0));\n case M l\\<^sub>0 of\n None \\ RETURN False\n | Some xs \\ do {\n b3 \\ RETURN (less_eq s\\<^sub>0 xs);\n b4 \\ check_prop P';\n RETURN (b1 \\ b2 \\ b3 \\ b4)\n }\n }\"\n\nlemma check_all_pre0_correct:\n \"check_all_pre0 \\ SPEC (\\r. r \\ check_all_pre_spec l\\<^sub>0 s\\<^sub>0)\"\n unfolding check_all_pre0_def check_all_pre_spec_def\n by (refine_vcg check_prop_correct; auto simp: list_ex_iff)\n\nlemma check_all_pre0_1_refine:\n \"(check_all_pre1, check_all_pre0) \\ \\bool_rel\\nres_rel\" if \"L = dom M\"\nunfolding check_all_pre1_def check_all_pre0_def\n apply (refine_rcg that; simp)\n supply [refine_mono] =\n monadic_list_ex_mono' monadic_list_ex_RETURN_mono specify_right HOL.refl\n check_prop1_refine[THEN fun_relD, THEN fun_relD, THEN nres_relD, THEN refine_IdD,\n of Li L Mi M, unfolded check_prop_alt_def]\n Li_L Mi_M\n supply [param] = lei_less_eq\n apply parametricity\n apply parametricity\n apply (rule order.trans)\n apply (rule refine_mono)\n apply refine_mono\n apply refine_mono\napply refine_rcg+\n by simp\n\nlemma check_all_pre1_correct:\n \"check_all_pre1 \\ SPEC (\\r. r \\ check_all_pre_spec l\\<^sub>0 s\\<^sub>0)\" if \"L = dom M\"\nproof -\n note check_all_pre0_1_refine[THEN nres_relD]\n also note check_all_pre0_correct\n finally show ?thesis using that .\nqed\n\nlemma (in -) nres_cases'[case_names FAIL RES]:\n obtains \"M=FAIL\" | X where \"X = {}\" \"M=RES X\" | X where \"X \\ {}\" \"M=RES X\"\n by (cases M) auto\n\ntext \\This is just a refinement-oriented alternative to derive @{thm check_all_pre1_correct}.\\\nlemma check_prop_nofail:\n \"nofail (check_prop P')\"\n unfolding check_prop_def\n by (auto 4 5 intro: monadic_list_all_nofailI no_fail_RES_bindI split: option.split_asm)\n\nlemma check_all_pre0_refine:\n \"(check_all_pre0, check_all_pre l\\<^sub>0 s\\<^sub>0) \\ \\bool_rel\\nres_rel\" if \"L = dom M\"\n apply (cases \"M l\\<^sub>0\")\n apply (cases \"P' (l\\<^sub>0, s\\<^sub>0)\")\n unfolding check_all_pre0_def check_all_pre_def\n subgoal\n apply (refine_rcg, simp)\n apply (cases \"s\\<^sub>0 \\ {}\"; simp add: M_l\\<^sub>0_not_None)\n apply (cases \"check_prop P'\" rule: nres_cases'; simp)\n using check_prop_gt_SUCCEED by order\n subgoal\n apply (cases \"check_prop P'\" rule: nres_cases'; simp)\n subgoal\n using check_prop_nofail by refine_rcg\n subgoal for X\n using check_prop_gt_SUCCEED by order\n by refine_rcg\n by refine_rcg auto\n\nlemma check_all_pre1_refine:\n \"(check_all_pre1, check_all_pre l\\<^sub>0 s\\<^sub>0) \\ \\bool_rel\\nres_rel\" if \"L = dom M\"\nproof -\n note check_all_pre0_1_refine [THEN nres_relD]\n also note check_all_pre0_refine [THEN nres_relD]\n finally show ?thesis\n using that by refine_vcg\nqed\n\ndefinition\n \"check_all1 \\ do {\n b \\ check_all_pre1;\n if b\n then do {\n r \\ check_invariant1 Li;\n PRINT_CHECK STR ''State set invariant check'' r;\n RETURN r\n }\n else RETURN False\n }\n\"\n\nlemma check_all1_correct[refine]:\n \"check_all1 \\ SPEC (\\r. r \\ check_all_pre_spec l\\<^sub>0 s\\<^sub>0 \\ check_invariant_spec L)\" if \"L = dom M\"\nproof -\n note [refine] = check_all_pre1_correct [OF that]\n obtain L' where \"(Li, L') \\ \\K\\list_rel\" \"set L' = L\"\n using Li_L by (elim list_set_relE)\n note check_invariant1_refine\n also note check_invariant_correct\n also have [refine]: \"check_invariant1 Li \\ SPEC (\\r. r \\ check_invariant_spec L)\"\n if \"check_all_pre_spec l\\<^sub>0 s\\<^sub>0\"\n apply (subst (2) \\_ = L\\[symmetric])\n apply (rule calculation)\n using Li_L \\(Li, L') \\ _\\ that unfolding check_all_pre_spec_def\n by (auto simp: \\_ = L\\ \\L = _\\ dest: P'_P)\n show ?thesis\n unfolding check_all1_def PRINT_CHECK_def comp_def by (refine_vcg; simp)\nqed\n\ndefinition\n \"check_final1 L' = do {\n monadic_list_all (\\l. do {\n case op_map_lookup l Mi of None \\ RETURN True | Some xs \\ do {\n monadic_list_all (\\s.\n RETURN (\\ PR_CONST Fi (l, s))\n ) xs\n }\n }\n ) L'\n }\"\n\nlemma check_final1_refine:\n \"check_final1 Li \\ check_final' L M\"\n using Li_L apply (elim list_set_relE)\n unfolding check_final1_def check_final'_def\n apply (erule specify_right)\n supply [refine_mono] = monadic_list_all_mono'\n apply refine_mono\n apply (clarsimp split: option.splits)\n apply (refine_rcg monadic_list_all_mono')\n apply (simp flip: Mi_M_None_iff; fail)\n subgoal premises prems for _ li l xsi S\n proof -\n from \\(li, l) \\ K\\ have \"(Mi li, M l) \\ \\\\A\\list_set_rel\\option_rel\"\n by parametricity\n with prems have \"(xsi, S) \\ \\A\\list_set_rel\"\n by auto\n then obtain xs where \"(xsi, xs) \\ \\A\\list_rel\" \"set xs = S\"\n by (elim list_set_relE)\n then show ?thesis\n using Fi_F \\(li, l) \\ K\\\n by (refine_rcg monadic_list_all_mono' specify_right) (auto dest!: fun_relD)\n qed\n done\n\ndefinition\n \"certify_unreachable1 = do {\n b1 \\ check_all1;\n b2 \\ check_final1 Li;\n RETURN (b1 \\ b2)\n }\"\n\nlemma certify_unreachable1_correct:\n \"certify_unreachable1 \\ SPEC (\\r. r \\ check_all_spec \\ check_final_spec)\" if \"L = dom M\"\nproof -\n note check_final1_refine[unfolded check_final_alt_def]\n also note check_final_correct\n finally have [refine]: \"check_final1 Li \\ SPEC (\\r. r = check_final_spec)\" .\n show ?thesis\n unfolding certify_unreachable1_def check_all_spec_def by (refine_vcg that; fast)\nqed\n\nparagraph \\Synthesizing a pure program via rewriting\\\n\nlemma check_final1_alt_def:\n \"check_final1 L' = RETURN (list_all_split\n (\\l. case op_map_lookup l Mi of None \\ True | Some xs \\ list_all (\\s. \\ Fi (l, s)) xs) L')\"\n unfolding check_final1_def\n unfolding monadic_list_all_RETURN[symmetric] list_all_split_def\n by (fo_rule arg_cong2, intro ext)\n (auto split: option.splits simp: monadic_list_all_RETURN[symmetric])\n\nconcrete_definition check_final_impl\n uses check_final1_alt_def is \"_ = RETURN ?f\"\n\nschematic_goal check_prop1_alt_def:\n \"check_prop1 L' M' \\ RETURN ?f\"\n unfolding check_prop1_def pure_unfolds Let_def .\n\nconcrete_definition check_prop_impl uses check_prop1_alt_def is \"_ \\ RETURN ?f\"\n\nschematic_goal check_all_pre1_alt_def:\n \"check_all_pre1 \\ RETURN ?f\"\n unfolding check_all_pre1_def check_prop_impl.refine pure_unfolds .\n\nconcrete_definition check_all_pre_impl uses check_all_pre1_alt_def is \"_ \\ RETURN ?f\" \n\nschematic_goal check_invariant1_alt_def:\n \"check_invariant1 Li \\ RETURN ?f\"\n unfolding check_invariant1_def Let_def pure_unfolds .\n\nconcrete_definition check_invariant_impl uses check_invariant1_alt_def is \"_ \\ RETURN ?f\"\n\nschematic_goal certify_unreachable1_alt_def:\n \"certify_unreachable1 \\ RETURN ?f\"\n unfolding\n certify_unreachable1_def check_all1_def check_final_impl.refine check_all_pre_impl.refine\n check_invariant_impl.refine\n pure_unfolds PRINT_CHECK_def comp_def short_circuit_conv .\n\nconcrete_definition certify_unreachable_impl_pure1\n uses certify_unreachable1_alt_def is \"_ \\ RETURN ?f\"\n\ntext \\This is where we add parallel execution:\\\n\nschematic_goal certify_unreachable_impl_pure1_alt_def:\n \"certify_unreachable_impl_pure1 \\ ?f\"\n unfolding certify_unreachable_impl_pure1_def\n apply (abstract_let check_invariant_impl check_invariant)\n apply (abstract_let \"check_final_impl Li\" check_final)\n apply (abstract_let check_all_pre_impl check_all_pre_impl)\n apply (time_it \"STR ''Time for state set preconditions check''\" check_all_pre_impl)\n apply (time_it \"STR ''Time for state space invariant check''\" check_invariant_impl)\n apply (time_it \"STR ''Time to check final state predicate''\" \"check_final_impl Li\")\n unfolding\n check_invariant_impl_def check_all_pre_impl_def\n check_prop_impl_def check_final_impl_def\n list_all_split\n apply (subst list_all_default_split[where xs = Li, folded Parallel.map_def])\n .\n\nconcrete_definition (in -) certify_unreachable_impl_pure\n uses Reachability_Impl_pure.certify_unreachable_impl_pure1_alt_def is \"_ \\ ?f\"\n\nsublocale correct: Reachability_Impl_correct where\n M = \"\\x. case M x of None \\ {} | Some S \\ abs_s ` S\"\n apply standard\n oops\n\nend (* Reachability_Impl_pure *)\n\nlocale Reachability_Impl_pure_correct =\n Reachability_Impl_pure where M = M +\n Reachability_Impl_correct where M = \"\\x. case M x of None \\ {} | Some S \\ S\" for M\nbegin\n\ntheorem certify_unreachable_impl_pure_correct:\n \"certify_unreachable_impl_pure get_succs Li lei Li_split Pi Fi Mi l\\<^sub>0i s\\<^sub>0i\n \\ (\\s'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, s\\<^sub>0) s' \\ F s')\"\n if \"L = dom M\"\n using certify_unreachable1_correct that\n unfolding\n certify_unreachable_impl_pure1.refine\n certify_unreachable_impl_pure.refine[OF Reachability_Impl_pure_axioms]\n using certify_unreachableI by simp\n\nend (* Reachability_Impl_pure correct *)\n\nlocale Reachability_Impl_imp_base =\n Reachability_Impl_base +\n Certification_Impl_imp_base\n\nlocale Reachability_Impl_imp_to_pure_base = Reachability_Impl_imp_base\n where K = K and A = A\n for K :: \"'k \\ ('ki :: {hashable,heap}) \\ assn\" and A :: \"'s \\ ('si :: heap) \\ assn\"\n +\n fixes to_state :: \"'s1 \\ 'si Heap\" and from_state :: \"'si \\ 's1 Heap\"\n and to_loc :: \"'k1 \\ 'ki\" and from_loc :: \"'ki \\ 'k1\"\n fixes lei\n fixes K_rel and A_rel\n fixes L_list :: \"'ki list\" and Li :: \"'k1 list\" and L :: \"'k set\" and L' :: \"'k list\"\n fixes Li_split :: \"'k1 list list\"\n assumes Li: \"(L_list, L') \\ \\the_pure K\\list_rel\" \"(Li, L') \\ \\K_rel\\list_rel\" \"set L' = L\"\n assumes to_state_ht: \"(s1, s) \\ A_rel \\ to_state s1 <\\si. A s si>\"\n assumes from_state_ht: \" from_state si <\\s'. \\((s', s) \\ A_rel)>\\<^sub>t\"\n assumes from_loc: \"(li, l) \\ the_pure K \\ (from_loc li, l) \\ K_rel\"\n assumes to_loc: \"(l1, l) \\ K_rel \\ (to_loc l1, l) \\ the_pure K\"\n assumes K_rel: \"single_valued K_rel\" \"single_valued (K_rel\\)\"\n \\<^cancel>\\assumes lei_less_eq: \"(lei, (\\)) \\ A_rel \\ A_rel \\ bool_rel\"\\\n assumes lei_less_eq: \"(lei, (\\)) \\ A_rel \\ \\A_rel\\list_set_rel \\ bool_rel\"\n assumes full_split: \"set Li = (\\xs \\ set Li_split. set xs)\"\nbegin\n\ndefinition\n \"get_succs l xs \\\n do {\n let li = to_loc l;\n xsi \\ Heap_Monad.fold_map to_state xs;\n r \\ succsi li xsi;\n Heap_Monad.fold_map\n (\\(li, xsi). do {xs \\ Heap_Monad.fold_map from_state xsi; return (from_loc li, xs)}) r\n }\"\n\nlemma get_succs:\n \"(run_heap oo get_succs, succs)\n \\ K_rel \\ \\A_rel\\list_set_rel \\ \\K_rel \\\\<^sub>r \\A_rel\\list_set_rel\\list_rel\"\nproof (refine_rcg, clarsimp, rule hoare_triple_run_heapD)\n fix l :: \\'k\\ and l1 :: \\'k1\\ and xs :: \\'s1 list\\ and S :: \\'s set\\\n assume \\(l1, l) \\ K_rel\\ \\(xs, S) \\ \\A_rel\\list_set_rel\\\n then obtain ys where ys: \"(xs, ys) \\ \\A_rel\\list_rel\" \"set ys = S\"\n by (elim list_set_relE)\n have 1: \"K = pure (the_pure K)\"\n using pure_K by auto\n let ?li = \"to_loc l1\"\n show \" get_succs l1 xs <\\r. \\((r, succs l S) \\ \\K_rel \\\\<^sub>r \\A_rel\\list_set_rel\\list_rel)>\\<^sub>t\"\n unfolding get_succs_def\n apply sep_auto\n (* fold_map to_state *)\n apply (rule Hoare_Triple.cons_pre_rule[rotated])\n apply (rule fold_map_ht3[where A = true and R = \"pure A_rel\" and Q = A and xs = ys])\n apply (sep_auto heap: to_state_ht simp: pure_def; fail)\n apply (unfold list_assn_pure_conv, sep_auto simp: pure_def ys; fail)\n apply sep_auto\n (* succsi *)\n apply (rule Hoare_Triple.cons_pre_rule[rotated], rule frame_rule[where R = true])\n apply (rule succsi[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified, of S _ l ?li])\n subgoal\n using ys \\(l1, l) \\ K_rel\\ unfolding lso_assn_def hr_comp_def br_def \\set ys = _\\[symmetric]\n by (subst 1) (sep_auto simp: pure_def to_loc)\n (* nested fold_map *)\n apply (sep_auto simp: invalid_assn_def)\n apply (rule cons_rule[rotated 2])\n apply (rule frame_rule)\n apply (rule fold_map_ht1[where\n A = true and R = \"(K \\\\<^sub>a lso_assn A)\" and xs = \"succs l S\" and\n Q = \"\\x xi. (xi, x) \\ K_rel \\\\<^sub>r \\A_rel\\list_set_rel\"\n ])\n subgoal\n unfolding lso_assn_def\n apply (subst 1, subst pure_def)\n apply (sep_auto simp: prod_assn_def hr_comp_def br_def split: prod.splits)\n (* inner fold_map *)\n apply (rule Hoare_Triple.cons_pre_rule[rotated])\n apply (rule fold_map_ht1[where A = true and R = A and Q = \"\\l l1. (l1, l) \\ A_rel\"])\n apply (rule cons_rule[rotated 2], rule frame_rule, rule from_state_ht)\n apply frame_inference\n apply (sep_auto; fail)\n apply solve_entails\n (* return *)\n using list_all2_swap by (sep_auto simp: list.rel_eq list_set_rel_def from_loc list_rel_def)\n apply solve_entails\n using list_all2_swap by (sep_auto simp: list_rel_def)\nqed\n\ndefinition\n \"to_pair \\ \\(l, s). do {s \\ to_state s; return (to_loc l, s)}\"\n\nlemma to_pair_ht:\n \" to_pair a1 <\\ai. (K \\\\<^sub>a A) a ai>\" if \"(a1, a) \\ K_rel \\\\<^sub>r A_rel\"\n using that unfolding to_pair_def\n by (cases a, cases a1, subst pure_the_pure[symmetric, OF pure_K])\n (sep_auto heap: to_state_ht simp: pure_def to_loc prod_assn_def split: prod.splits)\n\nsublocale pure:\n Reachability_Impl_pure_base2\n where\n get_succs = \"run_heap oo get_succs\" and\n K = K_rel and\n A = A_rel and\n lei = lei and\n Pi = \"\\a. run_heap (do {a \\ to_pair a; Pi a})\" and\n Fi = \"\\a. run_heap (do {a \\ to_pair a; Fi a})\" \\<^cancel>\\and\n l\\<^sub>0i = \"from_loc (run_heap l\\<^sub>0i)\" and\n s\\<^sub>0i = \"run_heap (do {s \\ s\\<^sub>0i; from_state s})\"\\\n apply standard\n subgoal\n by (rule K_rel)\n subgoal\n by (rule K_rel)\n subgoal\n using Li unfolding list_set_rel_def by auto\n subgoal\n by (rule lei_less_eq)\n subgoal\n using get_succs .\n subgoal\n by (rule full_split)\n subgoal\n apply standard\n apply (rule hoare_triple_run_heapD)\n apply (sep_auto heap: to_pair_ht simp del: prod_rel_simp prod_assn_pair_conv)\n apply (rule Hoare_Triple.cons_rule[rotated 2])\n apply (rule Pi_P'[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified], rule ent_refl)\n apply (sep_auto simp: pure_def)\n done\n subgoal\n apply standard\n apply (rule hoare_triple_run_heapD)\n apply (sep_auto heap: to_pair_ht simp del: prod_rel_simp prod_assn_pair_conv)\n apply (rule Hoare_Triple.cons_rule[rotated 2])\n apply (rule Fi_F[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified], rule ent_refl)\n apply (sep_auto simp: pure_def)\n done\n done\n\nend\n\nlocale Reachability_Impl_imp_to_pure = Reachability_Impl where\n l\\<^sub>0 = l\\<^sub>0 and s\\<^sub>0 = s\\<^sub>0 and M = M and K = K and A = A\n + Reachability_Impl_imp_to_pure_base\n where K_rel = K_rel and A_rel = A_rel and K = K and A = A\n for l\\<^sub>0 :: 'k and s\\<^sub>0 :: 'a\n and K :: \"'k \\ ('ki :: {hashable,heap}) \\ assn\" and A :: \"'a \\ ('ai :: heap) \\ assn\"\n and M and K_rel :: \"('k1 \\ 'k) set\" and A_rel :: \"('a1 \\ 'a) set\" +\n fixes Mi :: \"'k1 \\ 'a1 list option\"\n assumes Mi_M: \"(Mi, M) \\ K_rel \\ \\\\A_rel\\list_set_rel\\option_rel\"\n fixes nonempty :: \"'a \\ bool\"\n assumes empty_not_subsumed [simp]:\n \"nonempty x \\ x \\ {} \\ False\"\n assumes succs_nonempty:\n \"(l', S') \\ set (succs l S) \\ x \\ S' \\ nonempty x\"\n assumes M_l\\<^sub>0_not_None: \"s\\<^sub>0 \\ {} \\ M l\\<^sub>0 \\ None\"\nbegin\n\nsublocale pure:\n Reachability_Impl_pure\n where \n M = M and\n Mi = Mi and\n get_succs = \"run_heap oo get_succs\" and\n K = K_rel and\n A = A_rel and\n lei = lei and\n Pi = \"\\a. run_heap (do {a \\ to_pair a; Pi a})\" and\n Fi = \"\\a. run_heap (do {a \\ to_pair a; Fi a})\" and\n l\\<^sub>0i = \"from_loc (run_heap l\\<^sub>0i)\" and\n s\\<^sub>0i = \"run_heap (do {s \\ s\\<^sub>0i; from_state s})\"\n apply standard\n apply (rule Mi_M)\n subgoal\n apply (rule from_loc)\n apply (rule hoare_triple_run_heapD)\n using l\\<^sub>0i_l\\<^sub>0[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified]\n apply (subst (asm) pure_the_pure[symmetric, OF pure_K])\n apply (sep_auto simp: pure_def elim!: cons_post_rule)\n done\n subgoal\n using s\\<^sub>0i_s\\<^sub>0[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified]\n by - (rule hoare_triple_run_heapD, sep_auto heap: from_state_ht)\n apply (rule empty_not_subsumed succs_nonempty M_l\\<^sub>0_not_None; assumption; fail)+\n done\n\nend\n\nlocale Reachability_Impl_imp_to_pure_correct =\n Reachability_Impl_imp_to_pure where M = M\n + Reachability_Impl_correct where M = \"\\x. case M x of None \\ {} | Some S \\ S\"\n for M\nbegin\n\nsublocale pure:\n Reachability_Impl_pure_correct\n where \n M = M and\n Mi = Mi and\n get_succs = \"run_heap oo get_succs\" and\n K = K_rel and\n A = A_rel and\n lei = lei and\n Pi = \"\\a. run_heap (do {a \\ to_pair a; Pi a})\" and\n Fi = \"\\a. run_heap (do {a \\ to_pair a; Fi a})\" and\n l\\<^sub>0i = \"from_loc (run_heap l\\<^sub>0i)\" and\n s\\<^sub>0i = \"run_heap (do {s \\ s\\<^sub>0i; from_state s})\"\n by standard\n\nend\n\nend", "meta": {"author": "wimmers", "repo": "munta-games", "sha": "12da82b74f595c33278aeac82b58cbfbfd2fd6a3", "save_path": "github-repos/isabelle/wimmers-munta-games", "path": "github-repos/isabelle/wimmers-munta-games/munta-games-12da82b74f595c33278aeac82b58cbfbfd2fd6a3/Safety_Certification_Pure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2932589980076071}} {"text": "theory Hoare_Indexed\n imports\n \"../Syntax/Gensyn\" \"../Syntax/Gensyn_Descend\" \"../Mergeable/Mergeable\"\n \"../Mergeable/Mergeable_Instances\"\n \"../Semantics/Semantics\" \"../Semantics/Semantics_Facts\"\nbegin\n\n(*\n * An alternate version of Hoare logic that includes explicit step-counts.\n * This ends up being useful for proving statements about control constructs that may\n * diverge (e.g. loops).\n *)\n\n(* Captures being safe for a certain number of steps *)\ndefinition safe_for :: \"('syn, 'mstate) semc \\ ('syn, 'mstate) control \\ nat \\ bool\" where\n\"safe_for gs full n =\n ((\\ n0 full' . n0 \\ n \\ sem_exec_c_p gs full n0 full' \\ cont full' = Inl []) \\\n (\\ n0 . n0 \\ n \\ (\\ full' h t . sem_exec_c_p gs full n0 full' \\ cont full' = Inl (h#t))))\"\n\nlemma safe_forI_halt :\n assumes \"n0 \\ n\"\n assumes \"sem_exec_c_p gs full n0 full'\"\n assumes \"cont full' = Inl []\"\n shows \"safe_for gs full n\"\n using assms unfolding safe_for_def by blast\n\nlemma safe_forI_spin :\n assumes \"\\ n0 . n0 \\ n \\ (\\ full' h t . sem_exec_c_p gs full n0 full' \\ cont full' = Inl (h#t))\"\n shows \"safe_for gs full n\" using assms unfolding safe_for_def by blast\n\nlemma exec_c_p_prefix :\n assumes H : \"sem_exec_c_p gs st1 n st2\"\n assumes \"cont st2 = Inl z\"\n assumes \"n' < n\"\n shows \"(\\ st2' h' t' . sem_exec_c_p gs st1 n' st2' \\ cont st2' = Inl (h'#t'))\"\n using assms\nproof(induction arbitrary: z n' rule: sem_exec_c_p.induct)\n case (Excp_0 m)\n\n then show ?case using Excp_0 by blast\nnext\n case (Excp_Suc m1 m2 n m3)\n then show ?case \n proof(cases n')\n case 0\n\n have Exec0 : \"sem_exec_c_p gs m1 n' m1\"\n using sem_exec_c_p.intros(1)[of gs m1] unfolding 0 by auto\n\n obtain h t where Cont1 : \"cont m1 = Inl (h#t)\"\n using Excp_Suc.hyps(1)\n unfolding sem_step_p_eq sem_step_def\n by(auto split: sum.splits list.splits)\n\n show ?thesis using Exec0 Cont1 by blast\n next\n case (Suc n'')\n\n then have Lt : \"n'' < n\"\n using Excp_Suc.prems by auto\n\n obtain st2' h' t' where\n Exec2 : \"sem_exec_c_p gs m2 n'' st2'\" and Cont2 :\"cont st2' = Inl (h'#t')\"\n using Excp_Suc.IH[OF Excp_Suc.prems(1) Lt]\n by blast\n\n have ExecSuc : \"sem_exec_c_p gs m1 (Suc n'') st2'\"\n using sem_exec_c_p.intros(2)[OF Excp_Suc.hyps(1) Exec2] by auto\n\n show ?thesis using ExecSuc Cont2 unfolding Suc by blast\n qed\nqed\n\n\nlemma safe_for_weaken :\n assumes H : \"safe_for gs full n\"\n assumes Leq : \"n' \\ n\"\n shows \"safe_for gs full n'\"\nproof-\n\n consider \n (1) n0 full' where \"n0 \\ n\" \"sem_exec_c_p gs full n0 full'\" \"cont full' = Inl []\" |\n (2) \"\\ n0 . n0 \\n \\ \\full' h t. sem_exec_c_p gs full n0 full' \\ cont full' = Inl (h # t)\"\n using H unfolding safe_for_def\n by blast\n\n then show \"safe_for gs full n'\"\n proof cases\n case 1\n then show ?thesis\n proof(cases \"n0 \\ n'\")\n case True\n\n show ?thesis using safe_forI_halt[OF True 1(2) 1(3)] by auto\n next\n case False\n\n hence False' : \"n' < n0\" by simp\n\n obtain mid h t where\n Exec_Mid : \"sem_exec_c_p gs full n' mid\" and\n Cont_Mid : \"cont mid = Inl (h#t)\"\n using exec_c_p_prefix[OF 1(2) 1(3) False'] by blast\n\n have Safe_for_prem : \"(\\nx. nx \\ n' \\ \\fullx hx tx. sem_exec_c_p gs full nx fullx \\ cont fullx = Inl (hx # tx))\"\n proof-\n fix nx\n\n assume Nx : \"nx \\ n'\"\n hence Nx' : \"nx < n0\" using False' by auto\n\n obtain mid h t where\n Exec_Mid : \"sem_exec_c_p gs full nx mid\" and\n Cont_Mid : \"cont mid = Inl (h#t)\"\n using exec_c_p_prefix[OF 1(2) 1(3) Nx'] by blast\n\n then show \"\\fullx hx tx. sem_exec_c_p gs full nx fullx \\ cont fullx = Inl (hx # tx)\"\n by blast\n qed\n\n show ?thesis using safe_forI_spin[OF Safe_for_prem] by blast\n qed\n next\n case 2\n\n have Safe_for_prem : \"(\\nx. nx \\ n' \\ \\fullx hx tx. sem_exec_c_p gs full nx fullx \\ cont fullx = Inl (hx # tx))\"\n proof-\n fix nx\n assume Nx : \"nx \\ n'\"\n\n have Leq' : \"nx \\ n\" using Nx Leq by simp\n\n show \"\\fullx hx tx. sem_exec_c_p gs full nx fullx \\ cont fullx = Inl (hx # tx)\"\n using 2[OF Leq'] by blast\n qed\n\n then show ?thesis using safe_forI_spin[OF Safe_for_prem] by blast\n qed\nqed\n\nlemma safe_for_extend :\n assumes H : \"safe_for gs st2 n2\"\n assumes Hexec : \"sem_exec_c_p gs st1 n1 st2\"\n shows \"safe_for gs st1 (n1 + n2)\" using Hexec H\nproof(induction arbitrary: n2 rule: sem_exec_c_p.induct)\n case (Excp_0 m)\n then show ?case by simp\nnext\n case (Excp_Suc m1 m2 n m3)\n\n have Safe2 : \"safe_for gs m2 (n + n2)\"\n using Excp_Suc.IH[OF Excp_Suc.prems(1)] by simp\n\n consider \n (1) n0 full' where \"n0 \\ n + n2\" \"sem_exec_c_p gs m2 n0 full'\" \"cont full' = Inl []\" |\n (2) \"\\ n0 . n0 \\n + n2 \\ \\full' h t. sem_exec_c_p gs m2 n0 full' \\ cont full' = Inl (h # t)\"\n using Safe2 unfolding safe_for_def\n by blast\n\n then show ?case\n proof cases\n case 1\n\n have Exec : \"sem_exec_c_p gs m1 (Suc n0) full'\"\n using sem_exec_c_p.intros(2)[OF Excp_Suc.hyps(1) 1(2)] by simp\n\n have Leq : \"Suc n0 \\ Suc n + n2 \" using 1(1) by simp\n\n show ?thesis using safe_forI_halt[OF Leq Exec 1(3)] by simp\n next\n case 2\n\n have Safe_for_prem :\n \"(\\n0. n0 \\ (Suc n + n2) \\ \\full' h t. sem_exec_c_p gs m1 n0 full' \\ cont full' = Inl (h # t))\"\n proof-\n fix n0\n assume N0 : \"n0 \\ Suc n + n2\"\n\n show \"\\full' h t. sem_exec_c_p gs m1 n0 full' \\ cont full' = Inl (h # t)\"\n proof(cases n0)\n case 0\n\n have Exec0 : \"sem_exec_c_p gs m1 n0 m1\"\n using sem_exec_c_p.intros(1)[of gs m1] unfolding 0 by simp\n\n obtain h t where Cont0 : \"cont m1 = Inl (h # t)\"\n using Excp_Suc.hyps(1) unfolding sem_step_p_eq sem_step_def\n by(auto split: sum.splits list.splits)\n\n show ?thesis using Exec0 Cont0 by blast\n next\n case (Suc n0')\n\n have Leq' : \"n0' \\ n + n2\" using Suc N0 by simp\n\n obtain m2' h t where M2_exec : \"sem_exec_c_p gs m2 n0' m2'\" and M2_cont : \"cont m2' = Inl (h # t)\"\n using 2[OF Leq'] by blast\n\n have Exec_Suc : \"sem_exec_c_p gs m1 n0 m2'\"\n using sem_exec_c_p.intros(2)[OF Excp_Suc.hyps(1) M2_exec] \n unfolding Suc by simp\n\n show ?thesis using Exec_Suc M2_cont by blast\n qed\n qed\n\n show ?thesis using safe_forI_spin[OF Safe_for_prem, of \"Suc n + n2\"] by simp\n qed\nqed\n\n(* Indexed version of guarded (capturing the idea that starting in a state satisfying P\n * means we are safe for a certain number of steps)\n *)\ndefinition guarded :: \"('syn, 'mstate :: Okay) semc \\ ('mstate \\ bool) \\ nat \\ 'syn gensyn list \\ bool\"\n(\"|#_#| {#_, _#} _\" [210, 212, 214, 216])\n where\n\"guarded gs P n c =\n (\\ m . m \\ ok_S \\ P (payload m) \\ cont m = Inl c \\ safe_for gs m n)\"\n\nlemma guardediI [intro] :\n assumes H : \"\\ m . m \\ ok_S \\ P (payload m) \\ cont m = Inl c \\ safe_for gs m n\"\n shows \"guarded gs P n c\" using H\n unfolding guarded_def\n by auto\n\nlemma guardediD :\n assumes H : \"guarded gs P n c\"\n assumes Hok : \"m \\ ok_S\"\n assumes HP : \"P (payload m)\"\n assumes Hcont : \"cont m = Inl c\"\n shows \"safe_for gs m n\" using assms\n unfolding guarded_def by blast\n\n(* Our indexed Hoare triple. The basic idea here is that we limit the number of steps we are\n * required to be safe for, both on the \"input\" (|gs| {Q, nq} (c')) \n * and the \"output\" (|gs| {P, np} (c @ c')) *)\ndefinition HT :: \"('syn, 'mstate :: Okay) semc \\ ('mstate \\ bool) \\ nat \\ 'syn gensyn list \\ ('mstate \\ bool) \\ nat \\ bool\" \n (\"|#_#| {#-_, _-#} _ {#-_, _-#}\" [220, 222, 224, 226, 228, 230])\n where\n\"HT gs P np c Q nq =\n (\\ c' . |#gs#| {#Q, nq#} (c') \\ |#gs#| {#P, np#} (c @ c'))\"\n\nlemma HTiI [intro] :\n assumes H : \"\\ c' . |#gs#| {#Q, nq#} (c') \\ |#gs#| {#P, np#} (c @ c')\"\n shows \"HT gs P np c Q nq\" using H unfolding HT_def\n by auto\n\nlemma HTiE [elim]:\n assumes H : \"HT gs P np c Q nq\"\n assumes H' : \"|#gs#| {#Q, nq#} c'\"\n shows \"|#gs#| {#P, np#} (c@c')\" using assms\n unfolding HT_def\n by auto\n\nlemma HConseq :\n assumes H : \"|#gs#| {#- P', np' -#} c {#-Q', nq'-#}\"\n assumes HP1 : \"\\ st . P st \\ P' st\"\n assumes HP2 : \"np \\ np'\"\n assumes HQ1 : \"\\ st . Q' st \\ Q st\"\n assumes HQ2 : \"nq' \\ nq\"\n shows \"|#gs#| {#-P, np-#} c {#-Q, nq-#}\"\nproof(rule HTiI)\n fix c'\n assume Exec : \"|#gs#| {#Q, nq#} c'\"\n\n have Exec' : \"|#gs#| {#Q', nq'#} c'\"\n proof\n fix m :: \"('a, 'b) control\"\n assume Ok : \"m \\ ok_S\"\n assume Q' : \"Q' (payload m)\"\n assume C : \"cont m = Inl c'\"\n\n have Q : \"Q (payload m)\" using HQ1[OF Q'] by simp\n\n have Conc' : \"safe_for gs m nq\"\n using guardediD[OF Exec Ok Q C] by auto\n\n show \"safe_for gs m nq'\"\n using safe_for_weaken[OF Conc' HQ2] by auto\n qed\n\n then have Exec'' :\"|#gs#| {#P', np'#} (c@c')\"\n using HTiE[OF H Exec'] by auto\n\n show \"|#gs#| {#P, np#} (c @ c')\"\n proof\n fix m :: \"('a, 'b) control\"\n assume Ok : \"m \\ ok_S\"\n assume P: \"P (payload m)\"\n assume C : \"cont m = Inl (c @ c')\"\n\n have P' : \"P' (payload m)\" using HP1[OF P] by simp\n\n have Conc' : \"safe_for gs m np'\"\n using guardediD[OF Exec'' Ok P' C] by auto\n\n show \"safe_for gs m np\"\n using safe_for_weaken[OF Conc' HP2] by auto\n qed\nqed\n\nlemma HCat :\n assumes H : \"|#gs#| {#- P1, np1 -#} c1 {#- P2, np2 -#}\"\n assumes H' : \"|#gs#| {#- P2, np2 -#} c2 {#- P3, np3 -#}\"\n shows \"|#gs#| {#- P1, np1 -#} (c1 @ c2) {#- P3, np3 -#}\"\nproof(rule HTiI)\n fix c'\n assume HP3 : \"|#gs#| {#P3, np3#} c'\"\n\n have P2_cont : \"|#gs#| {#P2, np2#} (c2 @ c')\"\n using HTiE[OF H' HP3]\n by auto\n\n show \"|#gs#| {#P1, np1#} ((c1 @ c2) @ c')\"\n using HTiE[OF H P2_cont]\n unfolding append_assoc\n by auto\nqed\n\n(* Wrapping the indexed Hoare triples to make them work like non-indexed ones.\n * The idea here is that we only care about how long the \"output\" (program combined with\n * the arbitrary tail quantified within the Hoare triple definition) is safe for. So, in order\n * for this to work like a normal Hoare triple, for any desired safe execution length npre,\n * we must be able to find a suffix execution\n * (safe for some npost number of steps) such that the concatenation is safe for npre. *)\ndefinition HT' :: \"('syn, 'mstate :: Okay) semc \\ ('mstate \\ bool) \\ 'syn gensyn list \\ ('mstate \\ bool)\\ bool\" \n (\"|_| {~_~} _ {~_~}\" [250, 252, 254, 256]) \n where\n\"HT' gs P c Q =\n ((\\ npost . \\ npre . |#gs#| {#- P, (npre + npost) -#} c {#- Q, npost -#}))\"\n\nlemma HT'I :\n assumes H : \"(\\ npost. \\ npre . |#gs#| {#- P, (npre + npost) -#} c {#- Q, npost -#})\"\n shows \"HT' gs P c Q\" using assms unfolding HT'_def by blast\n\nlemma HT'D :\n assumes H : \"HT' gs P c Q\"\n shows \"(\\ npost . \\ npre . |#gs#| {#- P, (npre + npost) -#} c {#- Q, npost -#})\"\n using H unfolding HT'_def by simp\n\n(* Consequence and Cat for our wrapped Hoare triple. \n * Rules using the \"wrapped\" indexed Hoare logic HT' will have names starting with Hx.\n *)\n\nlemma HT'Conseq :\n assumes H : \"|gs| {~ P'~} c {~Q'~}\"\n assumes HP1 : \"\\ st . P st \\ P' st\"\n assumes HQ1 : \"\\ st . Q' st \\ Q st\"\n shows \"|gs| {~P~} c {~Q~}\"\nproof(rule HT'I)\n fix npre\n\n obtain npre'\n where Npre' : \"|#gs#| {#-P', (npre' + npre) -#} c {#-Q', npre-#}\"\n using HT'D[OF H, of npre]\n by blast\n\n have \"|#gs#| {#-P, (0 + npre) -#} c {#-Q, npre-#}\"\n using HConseq[OF Npre', of P npre Q npre] HP1 HQ1\n by(auto)\n\n then show \"\\npre''. |#gs#| {#-P, (npre'' + npre)-#} c {#-Q, npre-#}\"\n by blast\nqed\n\nlemma HT'Cat :\n assumes H : \"|gs| {~ P1 ~} c1 {~ P2 ~}\"\n assumes H' : \"|gs| {~ P2 ~} c2 {~ P3 ~}\"\n shows \"|gs| {~ P1 ~} (c1 @ c2) {~ P3 ~}\"\nproof(rule HT'I)\n fix npre\n\n obtain n1\n where N1 : \"|#gs#| {#-P1, (n1 + npre)-#} c1 {#-P2, npre-#}\"\n using HT'D[OF H]\n by blast\n\n obtain n2\n where N2 : \"|#gs#| {#-P2, (n2 + npre)-#} c2 {#-P3, npre-#}\"\n using HT'D[OF H']\n by blast\n\n have N2' : \"|#gs#| {#-P2, (npre)-#} c2 {#-P3, npre-#}\"\n using HConseq[OF N2, of P2 npre P3 npre] by auto\n\n\n show \"\\n3. |#gs#| {#-P1, (n3 + npre)-#} (c1 @ c2) {#-P3, npre-#}\"\n using HCat[OF N1 N2'] by blast\nqed\n\nlemma HT'Cons :\n assumes H : \"|gs| {~P1~} [c] {~P2~}\"\n assumes H' : \"|gs| {~P2~} cs {~P3~}\"\n shows \"|gs| {~P1~} (c#cs) {~P3~}\"\n using HT'Cat[OF H H']\n by auto\n\nlemma HT'D0 :\n assumes H : \"HT' gs P c Q\"\n shows \"(\\ npost . |#gs#| {#- P, (npost) -#} c {#- Q, npost -#})\"\nproof-\n fix npost\n\n obtain npre where Npre : \"|#gs#| {#- P, (npre + npost) -#} c {#- Q, npost -#}\"\n using HT'D[OF H] by blast\n\n show \"|#gs#| {#-P, npost-#} c {#-Q, npost-#}\"\n using HConseq[OF Npre, of P npost Q npost] by auto\nqed\n\nlemma HT'Nil :\n shows \"|gs| {~P1~} [] {~P1~}\"\nproof(rule HT'I)\n fix npost\n\n have \"|#gs#| {#-P1, (npost)-#} [] {#-P1, npost-#}\"\n proof\n fix c'\n assume \"|#gs#| {#P1, npost#} c'\"\n then show \"|#gs#| {#P1, npost#} ([] @ c')\"\n by auto\n qed\n\n then have \"|#gs#| {#-P1, (0 + npost)-#} [] {#-P1, npost-#}\"\n by simp\n\n then show \"\\npre. |#gs#| {#-P1, (npre + npost)-#} [] {#-P1, npost-#}\"\n by blast\nqed\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Hoare/Hoare_Indexed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.29313835555535167}} {"text": "(*****************************************************************************\n * Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.5\n * for the OMG Standard.\n * http://www.brucker.ch/projects/hol-testgen/\n *\n * UML_State.thy --- State Operations and Objects.\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2012-2015 Université Paris-Saclay, Univ. Paris-Sud, France\n * 2013-2015 IRT SystemX, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\nchapter\\Formalization III: UML/OCL constructs: State Operations and Objects\\\n\ntheory UML_State\nimports UML_Library\nbegin\n\nno_notation None (\"\\\")\nsection\\Introduction: States over Typed Object Universes\\\n\ntext\\\\label{sec:universe}\n In the following, we will refine the concepts of a user-defined\n data-model (implied by a class-diagram) as well as the notion of\n $\\state{}$ used in the previous section to much more detail.\n Surprisingly, even without a concrete notion of an objects and a\n universe of object representation, the generic infrastructure of\n state-related operations is fairly rich.\n\\\n\n\n\nsubsection\\Fundamental Properties on Objects: Core Referential Equality\\\nsubsubsection\\Definition\\\n\ntext\\Generic referential equality - to be used for instantiations\n with concrete object types ...\\\ndefinition StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t :: \"('\\,'a::{object,null})val \\ ('\\,'a)val \\ ('\\)Boolean\"\nwhere \"StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x y\n \\ \\ \\. if (\\ x) \\ = true \\ \\ (\\ y) \\ = true \\\n then if x \\ = null \\ y \\ = null\n then \\\\x \\ = null \\ y \\ = null\\\\\n else \\\\(oid_of (x \\)) = (oid_of (y \\)) \\\\\n else invalid \\\"\n\nsubsubsection\\Strictness and context passing\\\n\nlemma StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_strict1[simp,code_unfold] :\n\"(StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x invalid) = invalid\"\nby(rule ext, simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def true_def false_def)\n\nlemma StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_strict2[simp,code_unfold] :\n\"(StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t invalid x) = invalid\"\nby(rule ext, simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def true_def false_def)\n\n\nlemma cp_StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t:\n\"(StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x y \\) = (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t (\\_. x \\) (\\_. y \\)) \\\"\nby(auto simp: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def cp_valid[symmetric])\n\ntext_raw\\\\isatagafp\\\nlemmas cp0_StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t= cp_StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t[THEN allI[THEN allI[THEN allI[THEN cpI2]],\n of \"StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t\"]]\n\nlemmas cp_intro''[intro!,simp,code_unfold] =\n cp_intro''\n cp_StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t[THEN allI[THEN allI[THEN allI[THEN cpI2]],\n of \"StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t\"]]\n\ntext_raw\\\\endisatagafp\\\n\nsubsection\\Logic and Algebraic Layer on Object\\\nsubsubsection\\Validity and Definedness Properties\\\n\ntext\\We derive the usual laws on definedness for (generic) object equality:\\\n\n\n\n\nlemma StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def_homo :\n\"\\(StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x (y::('\\,'a::{null,object})val)) = ((\\ x) and (\\ y))\"\noops (* sorry *)\n\nsubsubsection\\Symmetry\\\n\nlemma StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_sym :\nassumes x_val : \"\\ \\ \\ x\"\nshows \"\\ \\ StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x x\"\nby(simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def true_def OclValid_def\n x_val[simplified OclValid_def])\n\n\nsubsubsection\\Behavior vs StrongEq\\\n\ntext\\It remains to clarify the role of the state invariant\n$\\inv_\\sigma(\\sigma)$ mentioned above that states the condition that\nthere is a ``one-to-one'' correspondence between object\nrepresentations and $\\oid$'s: $\\forall \\mathit{oid} \\in \\dom\\ap\n\\sigma\\spot oid = \\HolOclOidOf\\ap \\drop{\\sigma(\\mathit{oid})}$. This\ncondition is also mentioned in~\\cite[Annex A]{omg:ocl:2012} and goes\nback to \\citet{richters:precise:2002}; however, we state this\ncondition as an invariant on states rather than a global axiom. It\ncan, therefore, not be taken for granted that an $\\oid$ makes sense\nboth in pre- and post-states of OCL expressions.\n\\\n\ntext\\We capture this invariant in the predicate WFF :\\\n\ndefinition WFF :: \"('\\::object)st \\ bool\"\nwhere \"WFF \\ = ((\\ x \\ ran(heap(fst \\)). \\heap(fst \\) (oid_of x)\\ = x) \\\n (\\ x \\ ran(heap(snd \\)). \\heap(snd \\) (oid_of x)\\ = x))\"\n\ntext\\It turns out that WFF is a key-concept for linking strict referential equality to\nlogical equality: in well-formed states (i.e. those states where the self (oid-of) field contains\nthe pointer to which the object is associated to in the state), referential equality coincides\nwith logical equality.\\\n\n\ntext\\We turn now to the generic definition of referential equality on objects:\nEquality on objects in a state is reduced to equality on the\nreferences to these objects. As in HOL-OCL~\\cite{brucker.ea:hol-ocl:2008,brucker.ea:hol-ocl-book:2006},\nwe will store the reference of an object inside the object in a (ghost) field.\nBy establishing certain invariants (``consistent state''), it can\nbe assured that there is a ``one-to-one-correspondence'' of objects\nto their references---and therefore the definition below\nbehaves as we expect.\\\ntext\\Generic Referential Equality enjoys the usual properties:\n(quasi) reflexivity, symmetry, transitivity, substitutivity for\ndefined values. For type-technical reasons, for each concrete\nobject type, the equality \\\\\\ is defined by generic referential\nequality.\\\n\ntheorem StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_vs_StrongEq:\nassumes WFF: \"WFF \\\"\nand valid_x: \"\\ \\(\\ x)\"\nand valid_y: \"\\ \\(\\ y)\"\nand x_present_pre: \"x \\ \\ ran (heap(fst \\))\"\nand y_present_pre: \"y \\ \\ ran (heap(fst \\))\"\nand x_present_post:\"x \\ \\ ran (heap(snd \\))\"\nand y_present_post:\"y \\ \\ ran (heap(snd \\))\"\n (* x and y must be object representations that exist in either the pre or post state *)\nshows \"(\\ \\ (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x y)) = (\\ \\ (x \\ y))\"\napply(insert WFF valid_x valid_y x_present_pre y_present_pre x_present_post y_present_post)\napply(auto simp: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def OclValid_def WFF_def StrongEq_def true_def Ball_def)\napply(erule_tac x=\"x \\\" in allE', simp_all)\ndone\n\ntheorem StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_vs_StrongEq':\nassumes WFF: \"WFF \\\"\nand valid_x: \"\\ \\(\\ (x :: ('\\::object,'\\::{null,object})val))\"\nand valid_y: \"\\ \\(\\ y)\"\nand oid_preserve: \"\\x. x \\ ran (heap(fst \\)) \\ x \\ ran (heap(snd \\)) \\\n H x \\ \\ \\ oid_of (H x) = oid_of x\"\nand xy_together: \"x \\ \\ H ` ran (heap(fst \\)) \\ y \\ \\ H ` ran (heap(fst \\)) \\\n x \\ \\ H ` ran (heap(snd \\)) \\ y \\ \\ H ` ran (heap(snd \\))\"\n (* x and y must be object representations that exist in either the pre or post state *)\nshows \"(\\ \\ (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x y)) = (\\ \\ (x \\ y))\"\n apply(insert WFF valid_x valid_y xy_together)\n apply(simp add: WFF_def)\n apply(auto simp: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def OclValid_def WFF_def StrongEq_def true_def Ball_def)\nby (metis foundation18' oid_preserve valid_x valid_y)+\n\ntext\\So, if two object descriptions live in the same state (both pre or post), the referential\nequality on objects implies in a WFF state the logical equality.\\\n\nsection\\Operations on Object\\\nsubsection\\Initial States (for testing and code generation)\\\n\ndefinition \\\\<^sub>0 :: \"('\\)st\"\nwhere \"\\\\<^sub>0 \\ (\\heap=Map.empty, assocs = Map.empty\\,\n \\heap=Map.empty, assocs = Map.empty\\)\"\n\nsubsection\\OclAllInstances\\\n\ntext\\To denote OCL types occurring in OCL expressions syntactically---as, for example,\nas ``argument'' of \\inlineocl{oclAllInstances()}---we use the inverses of the injection functions into the object\nuniverses; we show that this is a sufficient ``characterization.''\\\n\ndefinition OclAllInstances_generic :: \"(('\\::object) st \\ '\\ state) \\ ('\\::object \\ '\\) \\\n ('\\, '\\ option option) Set\"\nwhere \"OclAllInstances_generic fst_snd H =\n (\\\\. Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\\\ Some ` ((H ` ran (heap (fst_snd \\))) - { None }) \\\\)\"\n\nlemma OclAllInstances_generic_defined: \"\\ \\ \\ (OclAllInstances_generic pre_post H)\"\n apply(simp add: defined_def OclValid_def OclAllInstances_generic_def false_def true_def\n bot_fun_def bot_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_fun_def null_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n apply(rule conjI)\n apply(rule notI, subst (asm) Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, simp,\n (rule disjI2)+,\n metis bot_option_def option.distinct(1),\n (simp add: bot_option_def null_option_def)+)+\ndone\n\nlemma OclAllInstances_generic_init_empty:\n assumes [simp]: \"\\x. pre_post (x, x) = x\"\n shows \"\\\\<^sub>0 \\ OclAllInstances_generic pre_post H \\ Set{}\"\nby(simp add: StrongEq_def OclAllInstances_generic_def OclValid_def \\\\<^sub>0_def mtSet_def)\n\n\n\n\nlemma represented_generic_objects_defined:\nassumes A: \"\\ \\ ((OclAllInstances_generic pre_post (H::('\\::object \\ '\\))) ->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\nshows \"\\ \\ \\ (OclAllInstances_generic pre_post H) \\ \\ \\ \\ x\"\nby (metis OclAllInstances_generic_defined\n A[THEN represented_generic_objects_nonnull] OclIncludes.defined_args_valid\n A foundation16' foundation18 foundation24 foundation6)\n\n\ntext\\One way to establish the actual presence of an object representation in a state is:\\\n\ndefinition \"is_represented_in_state fst_snd x H \\ = (x \\ \\ (Some o H) ` ran (heap (fst_snd \\)))\"\n\nlemma represented_generic_objects_in_state:\nassumes A: \"\\ \\ (OclAllInstances_generic pre_post H)->includes\\<^sub>S\\<^sub>e\\<^sub>t(x)\"\nshows \"is_represented_in_state pre_post x H \\\"\nproof -\n have B: \"(\\ (OclAllInstances_generic pre_post H)) \\ = true \\\"\n by(simp add: OclValid_def[symmetric] OclAllInstances_generic_defined)\n have C: \"(\\ x) \\ = true \\\"\n by (metis OclValid_def UML_Set.OclIncludes_def assms bot_option_def option.distinct(1) true_def)\n have F: \"Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\\\Some ` (H ` ran (heap (pre_post \\)) - {None})\\\\) =\n \\\\Some ` (H ` ran (heap (pre_post \\)) - {None})\\\\\"\n by(subst Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e.Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse,simp_all add: bot_option_def)\n show ?thesis\n apply(insert A)\n apply(simp add: is_represented_in_state_def OclIncludes_def OclValid_def ran_def B C image_def true_def)\n apply(simp add: OclAllInstances_generic_def)\n apply(simp add: F)\n apply(simp add: ran_def)\n by(fastforce)\nqed\n\n\nlemma state_update_vs_allInstances_generic_empty:\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nshows \"(mk \\heap=Map.empty, assocs=A\\) \\ OclAllInstances_generic pre_post Type \\ Set{}\"\nproof -\n have state_update_vs_allInstances_empty:\n \"(OclAllInstances_generic pre_post Type) (mk \\heap=Map.empty, assocs=A\\) =\n Set{} (mk \\heap=Map.empty, assocs=A\\)\"\n by(simp add: OclAllInstances_generic_def mtSet_def)\n show ?thesis\n apply(simp only: OclValid_def, subst StrictRefEq\\<^sub>S\\<^sub>e\\<^sub>t.cp0,\n simp only: state_update_vs_allInstances_empty StrictRefEq\\<^sub>S\\<^sub>e\\<^sub>t.refl_ext)\n apply(simp add: OclIf_def valid_def mtSet_def defined_def\n bot_fun_def null_fun_def null_option_def bot_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n by(subst Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, (simp add: bot_option_def true_def)+)\nqed\n\ntext\\Here comes a couple of operational rules that allow to infer the value\nof \\inlineisar+oclAllInstances+ from the context $\\tau$. These rules are a special-case\nin the sense that they are the only rules that relate statements with \\emph{different}\n$\\tau$'s. For that reason, new concepts like ``constant contexts P'' are necessary\n(for which we do not elaborate an own theory for reasons of space limitations;\n in examples, we will prove resulting constraints straight forward by hand).\\\n\n\nlemma state_update_vs_allInstances_generic_including':\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\n shows \"(OclAllInstances_generic pre_post Type)\n (mk \\heap=\\'(oid\\Object), assocs=A\\)\n =\n ((OclAllInstances_generic pre_post Type)->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (mk \\heap=\\',assocs=A\\)\"\nproof -\n have drop_none : \"\\x. x \\ None \\ \\\\x\\\\ = x\"\n by(case_tac x, simp+)\n\n have insert_diff : \"\\x S. insert \\x\\ (S - {None}) = (insert \\x\\ S) - {None}\"\n by (metis insert_Diff_if option.distinct(1) singletonE)\n\n show ?thesis\n apply(simp add: UML_Set.OclIncluding_def OclAllInstances_generic_defined[simplified OclValid_def],\n simp add: OclAllInstances_generic_def)\n apply(subst Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp add: bot_option_def, simp add: comp_def,\n subst image_insert[symmetric],\n subst drop_none, simp add: assms)\n apply(case_tac \"Type Object\", simp add: assms, simp only:,\n subst insert_diff, drule sym, simp)\n apply(subgoal_tac \"ran (\\'(oid \\ Object)) = insert Object (ran \\')\", simp)\n apply(case_tac \"\\ (\\x. \\' oid = Some x)\")\n apply(rule ran_map_upd, simp)\n apply(simp, erule exE, frule assms, simp)\n apply(subgoal_tac \"Object \\ ran \\'\") prefer 2\n apply(rule ranI, simp)\n by(subst insert_absorb, simp, metis fun_upd_apply)\n\nqed\n\n\nlemma state_update_vs_allInstances_generic_including:\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\nshows \"(OclAllInstances_generic pre_post Type)\n (mk \\heap=\\'(oid\\Object), assocs=A\\)\n =\n ((\\_. (OclAllInstances_generic pre_post Type)\n (mk \\heap=\\', assocs=A\\))->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (mk \\heap=\\'(oid\\Object), assocs=A\\)\"\n apply(subst state_update_vs_allInstances_generic_including', (simp add: assms)+,\n subst UML_Set.OclIncluding.cp0,\n simp add: UML_Set.OclIncluding_def)\n apply(subst (1 3) cp_defined[symmetric],\n simp add: OclAllInstances_generic_defined[simplified OclValid_def])\n\n apply(simp add: defined_def OclValid_def OclAllInstances_generic_def invalid_def\n bot_fun_def null_fun_def bot_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n apply(subst (1 3) Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject)\nby(simp add: bot_option_def null_option_def)+\n\n\n\nlemma state_update_vs_allInstances_generic_noincluding':\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object = None\"\n shows \"(OclAllInstances_generic pre_post Type)\n (mk \\heap=\\'(oid\\Object), assocs=A\\)\n =\n (OclAllInstances_generic pre_post Type)\n (mk \\heap=\\', assocs=A\\)\"\nproof -\n have drop_none : \"\\x. x \\ None \\ \\\\x\\\\ = x\"\n by(case_tac x, simp+)\n\n have insert_diff : \"\\x S. insert \\x\\ (S - {None}) = (insert \\x\\ S) - {None}\"\n by (metis insert_Diff_if option.distinct(1) singletonE)\n\n show ?thesis\n apply(simp add: OclIncluding_def OclAllInstances_generic_defined[simplified OclValid_def]\n OclAllInstances_generic_def)\n apply(subgoal_tac \"ran (\\'(oid \\ Object)) = insert Object (ran \\')\", simp add: assms)\n apply(case_tac \"\\ (\\x. \\' oid = Some x)\")\n apply(rule ran_map_upd, simp)\n apply(simp, erule exE, frule assms, simp)\n apply(subgoal_tac \"Object \\ ran \\'\") prefer 2\n apply(rule ranI, simp)\n apply(subst insert_absorb, simp)\n by (metis fun_upd_apply)\nqed\n\ntheorem state_update_vs_allInstances_generic_ntc:\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nassumes oid_def: \"oid\\dom \\'\"\nand non_type_conform: \"Type Object = None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"(mk \\heap=\\'(oid\\Object),assocs=A\\ \\ P (OclAllInstances_generic pre_post Type)) =\n (mk \\heap=\\', assocs=A\\ \\ P (OclAllInstances_generic pre_post Type))\"\n (is \"(?\\ \\ P ?\\) = (?\\' \\ P ?\\)\")\nproof -\n have P_cp : \"\\x \\. P x \\ = P (\\_. x \\) \\\"\n by (metis (full_types) cp_ctxt cp_def)\n have A : \"const (P (\\_. ?\\ ?\\))\"\n by(simp add: const_ctxt const_ss)\n have \"(?\\ \\ P ?\\) = (?\\ \\ \\_. P ?\\ ?\\)\"\n by(subst foundation23, rule refl)\n also have \"... = (?\\ \\ \\_. P (\\_. ?\\ ?\\) ?\\)\"\n by(subst P_cp, rule refl)\n also have \"... = (?\\' \\ \\_. P (\\_. ?\\ ?\\) ?\\')\"\n apply(simp add: OclValid_def)\n by(subst A[simplified const_def], subst const_true[simplified const_def], simp)\n finally have X: \"(?\\ \\ P ?\\) = (?\\' \\ \\_. P (\\_. ?\\ ?\\) ?\\')\"\n by simp\n show ?thesis\n apply(subst X) apply(subst foundation23[symmetric])\n apply(rule StrongEq_L_subst3[OF cp_ctxt])\n apply(simp add: OclValid_def StrongEq_def true_def)\n apply(rule state_update_vs_allInstances_generic_noincluding')\n by(insert oid_def, auto simp: non_type_conform)\nqed\n\ntheorem state_update_vs_allInstances_generic_tc:\nassumes [simp]: \"\\a. pre_post (mk a) = a\"\nassumes oid_def: \"oid\\dom \\'\"\nand type_conform: \"Type Object \\ None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"(mk \\heap=\\'(oid\\Object),assocs=A\\ \\ P (OclAllInstances_generic pre_post Type)) =\n (mk \\heap=\\', assocs=A\\ \\ P ((OclAllInstances_generic pre_post Type)\n ->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\(Type Object)\\)))\"\n (is \"(?\\ \\ P ?\\) = (?\\' \\ P ?\\')\")\nproof -\n have P_cp : \"\\x \\. P x \\ = P (\\_. x \\) \\\"\n by (metis (full_types) cp_ctxt cp_def)\n have A : \"const (P (\\_. ?\\ ?\\))\"\n by(simp add: const_ctxt const_ss)\n have \"(?\\ \\ P ?\\) = (?\\ \\ \\_. P ?\\ ?\\)\"\n by(subst foundation23, rule refl)\n also have \"... = (?\\ \\ \\_. P (\\_. ?\\ ?\\) ?\\)\"\n by(subst P_cp, rule refl)\n also have \"... = (?\\' \\ \\_. P (\\_. ?\\ ?\\) ?\\')\"\n apply(simp add: OclValid_def)\n by(subst A[simplified const_def], subst const_true[simplified const_def], simp)\n finally have X: \"(?\\ \\ P ?\\) = (?\\' \\ \\_. P (\\_. ?\\ ?\\) ?\\')\"\n by simp\n let ?allInstances = \"OclAllInstances_generic pre_post Type\"\n have \"?allInstances ?\\ = \\_. ?allInstances ?\\'->including\\<^sub>S\\<^sub>e\\<^sub>t(\\_.\\\\\\Type Object\\\\\\) ?\\\"\n apply(rule state_update_vs_allInstances_generic_including)\n by(insert oid_def, auto simp: type_conform)\n also have \"... = ((\\_. ?allInstances ?\\')->including\\<^sub>S\\<^sub>e\\<^sub>t(\\_. (\\_.\\\\\\Type Object\\\\\\) ?\\') ?\\')\"\n by(subst const_OclIncluding[simplified const_def], simp+)\n also have \"... = (?allInstances->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\Type Object\\) ?\\')\"\n apply(subst UML_Set.OclIncluding.cp0[symmetric])\n by(insert type_conform, auto)\n finally have Y : \"?allInstances ?\\ = (?allInstances->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\Type Object\\) ?\\')\"\n by auto\n show ?thesis\n apply(subst X) apply(subst foundation23[symmetric])\n apply(rule StrongEq_L_subst3[OF cp_ctxt])\n apply(simp add: OclValid_def StrongEq_def Y true_def)\n done\nqed\n\ndeclare OclAllInstances_generic_def [simp]\n\nsubsubsection\\OclAllInstances (@post)\\\n\ndefinition OclAllInstances_at_post :: \"('\\ :: object \\ '\\) \\ ('\\, '\\ option option) Set\"\n (\"_ .allInstances'(')\")\nwhere \"OclAllInstances_at_post = OclAllInstances_generic snd\"\n\nlemma OclAllInstances_at_post_defined: \"\\ \\ \\ (H .allInstances())\"\nunfolding OclAllInstances_at_post_def\nby(rule OclAllInstances_generic_defined)\n\nlemma \"\\\\<^sub>0 \\ H .allInstances() \\ Set{}\"\nunfolding OclAllInstances_at_post_def\nby(rule OclAllInstances_generic_init_empty, simp)\n\n\nlemma represented_at_post_objects_nonnull:\nassumes A: \"\\ \\ (((H::('\\::object \\ '\\)).allInstances()) ->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\nshows \"\\ \\ not(x \\ null)\"\nby(rule represented_generic_objects_nonnull[OF A[simplified OclAllInstances_at_post_def]])\n\n\nlemma represented_at_post_objects_defined:\nassumes A: \"\\ \\ (((H::('\\::object \\ '\\)).allInstances()) ->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\nshows \"\\ \\ \\ (H .allInstances()) \\ \\ \\ \\ x\"\nunfolding OclAllInstances_at_post_def\nby(rule represented_generic_objects_defined[OF A[simplified OclAllInstances_at_post_def]])\n\n\ntext\\One way to establish the actual presence of an object representation in a state is:\\\n\nlemma\nassumes A: \"\\ \\ H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x)\"\nshows \"is_represented_in_state snd x H \\\"\nby(rule represented_generic_objects_in_state[OF A[simplified OclAllInstances_at_post_def]])\n\nlemma state_update_vs_allInstances_at_post_empty:\nshows \"(\\, \\heap=Map.empty, assocs=A\\) \\ Type .allInstances() \\ Set{}\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_empty[OF snd_conv])\n\ntext\\Here comes a couple of operational rules that allow to infer the value\nof \\inlineisar+oclAllInstances+ from the context $\\tau$. These rules are a special-case\nin the sense that they are the only rules that relate statements with \\emph{different}\n$\\tau$'s. For that reason, new concepts like ``constant contexts P'' are necessary\n(for which we do not elaborate an own theory for reasons of space limitations;\n in examples, we will prove resulting constraints straight forward by hand).\\\n\n\nlemma state_update_vs_allInstances_at_post_including':\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\n shows \"(Type .allInstances())\n (\\, \\heap=\\'(oid\\Object), assocs=A\\)\n =\n ((Type .allInstances())->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (\\, \\heap=\\',assocs=A\\)\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_including'[OF snd_conv], insert assms)\n\n\nlemma state_update_vs_allInstances_at_post_including:\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\nshows \"(Type .allInstances())\n (\\, \\heap=\\'(oid\\Object), assocs=A\\)\n =\n ((\\_. (Type .allInstances())\n (\\, \\heap=\\', assocs=A\\))->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (\\, \\heap=\\'(oid\\Object), assocs=A\\)\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_including[OF snd_conv], insert assms)\n\n\n\nlemma state_update_vs_allInstances_at_post_noincluding':\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object = None\"\n shows \"(Type .allInstances())\n (\\, \\heap=\\'(oid\\Object), assocs=A\\)\n =\n (Type .allInstances())\n (\\, \\heap=\\', assocs=A\\)\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_noincluding'[OF snd_conv], insert assms)\n\ntheorem state_update_vs_allInstances_at_post_ntc:\nassumes oid_def: \"oid\\dom \\'\"\nand non_type_conform: \"Type Object = None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"((\\, \\heap=\\'(oid\\Object),assocs=A\\) \\ (P(Type .allInstances()))) =\n ((\\, \\heap=\\', assocs=A\\) \\ (P(Type .allInstances())))\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_ntc[OF snd_conv], insert assms)\n\ntheorem state_update_vs_allInstances_at_post_tc:\nassumes oid_def: \"oid\\dom \\'\"\nand type_conform: \"Type Object \\ None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"((\\, \\heap=\\'(oid\\Object),assocs=A\\) \\ (P(Type .allInstances()))) =\n ((\\, \\heap=\\', assocs=A\\) \\ (P((Type .allInstances())\n ->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\(Type Object)\\))))\"\nunfolding OclAllInstances_at_post_def\nby(rule state_update_vs_allInstances_generic_tc[OF snd_conv], insert assms)\n\nsubsubsection\\OclAllInstances (@pre)\\\n\ndefinition OclAllInstances_at_pre :: \"('\\ :: object \\ '\\) \\ ('\\, '\\ option option) Set\"\n (\"_ .allInstances@pre'(')\")\nwhere \"OclAllInstances_at_pre = OclAllInstances_generic fst\"\n\nlemma OclAllInstances_at_pre_defined: \"\\ \\ \\ (H .allInstances@pre())\"\nunfolding OclAllInstances_at_pre_def\nby(rule OclAllInstances_generic_defined)\n\nlemma \"\\\\<^sub>0 \\ H .allInstances@pre() \\ Set{}\"\nunfolding OclAllInstances_at_pre_def\nby(rule OclAllInstances_generic_init_empty, simp)\n\n\nlemma represented_at_pre_objects_nonnull:\nassumes A: \"\\ \\ (((H::('\\::object \\ '\\)).allInstances@pre()) ->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\nshows \"\\ \\ not(x \\ null)\"\nby(rule represented_generic_objects_nonnull[OF A[simplified OclAllInstances_at_pre_def]])\n\nlemma represented_at_pre_objects_defined:\nassumes A: \"\\ \\ (((H::('\\::object \\ '\\)).allInstances@pre()) ->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\nshows \"\\ \\ \\ (H .allInstances@pre()) \\ \\ \\ \\ x\"\nunfolding OclAllInstances_at_pre_def\nby(rule represented_generic_objects_defined[OF A[simplified OclAllInstances_at_pre_def]])\n\n\ntext\\One way to establish the actual presence of an object representation in a state is:\\\n\nlemma\nassumes A: \"\\ \\ H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x)\"\nshows \"is_represented_in_state fst x H \\\"\nby(rule represented_generic_objects_in_state[OF A[simplified OclAllInstances_at_pre_def]])\n\n\nlemma state_update_vs_allInstances_at_pre_empty:\nshows \"(\\heap=Map.empty, assocs=A\\, \\) \\ Type .allInstances@pre() \\ Set{}\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_empty[OF fst_conv])\n\ntext\\Here comes a couple of operational rules that allow to infer the value\nof \\inlineisar+oclAllInstances@pre+ from the context $\\tau$. These rules are a special-case\nin the sense that they are the only rules that relate statements with \\emph{different}\n$\\tau$'s. For that reason, new concepts like ``constant contexts P'' are necessary\n(for which we do not elaborate an own theory for reasons of space limitations;\n in examples, we will prove resulting constraints straight forward by hand).\\\n\n\nlemma state_update_vs_allInstances_at_pre_including':\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\n shows \"(Type .allInstances@pre())\n (\\heap=\\'(oid\\Object), assocs=A\\, \\)\n =\n ((Type .allInstances@pre())->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (\\heap=\\',assocs=A\\, \\)\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_including'[OF fst_conv], insert assms)\n\n\nlemma state_update_vs_allInstances_at_pre_including:\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object \\ None\"\nshows \"(Type .allInstances@pre())\n (\\heap=\\'(oid\\Object), assocs=A\\, \\)\n =\n ((\\_. (Type .allInstances@pre())\n (\\heap=\\', assocs=A\\, \\))->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\\\ drop (Type Object) \\\\))\n (\\heap=\\'(oid\\Object), assocs=A\\, \\)\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_including[OF fst_conv], insert assms)\n\n\n\nlemma state_update_vs_allInstances_at_pre_noincluding':\nassumes \"\\x. \\' oid = Some x \\ x = Object\"\n and \"Type Object = None\"\n shows \"(Type .allInstances@pre())\n (\\heap=\\'(oid\\Object), assocs=A\\, \\)\n =\n (Type .allInstances@pre())\n (\\heap=\\', assocs=A\\, \\)\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_noincluding'[OF fst_conv], insert assms)\n\ntheorem state_update_vs_allInstances_at_pre_ntc:\nassumes oid_def: \"oid\\dom \\'\"\nand non_type_conform: \"Type Object = None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"((\\heap=\\'(oid\\Object),assocs=A\\, \\) \\ (P(Type .allInstances@pre()))) =\n ((\\heap=\\', assocs=A\\, \\) \\ (P(Type .allInstances@pre())))\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_ntc[OF fst_conv], insert assms)\n\ntheorem state_update_vs_allInstances_at_pre_tc:\nassumes oid_def: \"oid\\dom \\'\"\nand type_conform: \"Type Object \\ None \"\nand cp_ctxt: \"cp P\"\nand const_ctxt: \"\\X. const X \\ const (P X)\"\nshows \"((\\heap=\\'(oid\\Object),assocs=A\\, \\) \\ (P(Type .allInstances@pre()))) =\n ((\\heap=\\', assocs=A\\, \\) \\ (P((Type .allInstances@pre())\n ->including\\<^sub>S\\<^sub>e\\<^sub>t(\\ _. \\(Type Object)\\))))\"\nunfolding OclAllInstances_at_pre_def\nby(rule state_update_vs_allInstances_generic_tc[OF fst_conv], insert assms)\n\nsubsubsection\\@post or @pre\\\n\ntheorem StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_vs_StrongEq'':\nassumes WFF: \"WFF \\\"\nand valid_x: \"\\ \\(\\ (x :: ('\\::object,'\\::object option option)val))\"\nand valid_y: \"\\ \\(\\ y)\"\nand oid_preserve: \"\\x. x \\ ran (heap(fst \\)) \\ x \\ ran (heap(snd \\)) \\\n oid_of (H x) = oid_of x\"\nand xy_together: \"\\ \\ ((H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x) and H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(y)) or\n (H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x) and H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(y)))\"\n (* x and y must be object representations that exist in either the pre or post state *)\nshows \"(\\ \\ (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x y)) = (\\ \\ (x \\ y))\"\nproof -\n have at_post_def : \"\\x. \\ \\ \\ x \\ \\ \\ \\ (H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\n apply(simp add: OclIncludes_def OclValid_def\n OclAllInstances_at_post_defined[simplified OclValid_def])\n by(subst cp_defined, simp)\n have at_pre_def : \"\\x. \\ \\ \\ x \\ \\ \\ \\ (H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x))\"\n apply(simp add: OclIncludes_def OclValid_def\n OclAllInstances_at_pre_defined[simplified OclValid_def])\n by(subst cp_defined, simp)\n have F: \"Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\\\Some ` (H ` ran (heap (fst \\)) - {None})\\\\) =\n \\\\Some ` (H ` ran (heap (fst \\)) - {None})\\\\\"\n by(subst Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e.Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse,simp_all add: bot_option_def)\n have F': \"Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\\\Some ` (H ` ran (heap (snd \\)) - {None})\\\\) =\n \\\\Some ` (H ` ran (heap (snd \\)) - {None})\\\\\"\n by(subst Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e.Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse,simp_all add: bot_option_def)\n show ?thesis\n apply(rule StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_vs_StrongEq'[OF WFF valid_x valid_y, where H = \"Some o H\"])\n apply(subst oid_preserve[symmetric], simp, simp add: oid_of_option_def)\n apply(insert xy_together,\n subst (asm) foundation11,\n metis at_post_def defined_and_I valid_x valid_y,\n metis at_pre_def defined_and_I valid_x valid_y)\n apply(erule disjE)\n by(drule foundation5,\n simp add: OclAllInstances_at_pre_def OclAllInstances_at_post_def\n OclValid_def OclIncludes_def true_def F F'\n valid_x[simplified OclValid_def] valid_y[simplified OclValid_def] bot_option_def\n split: if_split_asm,\n simp add: comp_def image_def, fastforce)+\nqed\n\nsubsection\\OclIsNew, OclIsDeleted, OclIsMaintained, OclIsAbsent\\\n\ndefinition OclIsNew:: \"('\\, '\\::{null,object})val \\ ('\\)Boolean\" (\"(_).oclIsNew'(')\")\nwhere \"X .oclIsNew() \\ (\\\\ . if (\\ X) \\ = true \\\n then \\\\oid_of (X \\) \\ dom(heap(fst \\)) \\\n oid_of (X \\) \\ dom(heap(snd \\))\\\\\n else invalid \\)\"\n\ntext\\The following predicates --- which are not part of the OCL standard descriptions ---\ncomplete the goal of \\inlineisar+oclIsNew+ by describing where an object belongs.\n\\\n\ndefinition OclIsDeleted:: \"('\\, '\\::{null,object})val \\ ('\\)Boolean\" (\"(_).oclIsDeleted'(')\")\nwhere \"X .oclIsDeleted() \\ (\\\\ . if (\\ X) \\ = true \\\n then \\\\oid_of (X \\) \\ dom(heap(fst \\)) \\\n oid_of (X \\) \\ dom(heap(snd \\))\\\\\n else invalid \\)\"\n\ndefinition OclIsMaintained:: \"('\\, '\\::{null,object})val \\ ('\\)Boolean\"(\"(_).oclIsMaintained'(')\")\nwhere \"X .oclIsMaintained() \\ (\\\\ . if (\\ X) \\ = true \\\n then \\\\oid_of (X \\) \\ dom(heap(fst \\)) \\\n oid_of (X \\) \\ dom(heap(snd \\))\\\\\n else invalid \\)\"\n\ndefinition OclIsAbsent:: \"('\\, '\\::{null,object})val \\ ('\\)Boolean\" (\"(_).oclIsAbsent'(')\")\nwhere \"X .oclIsAbsent() \\ (\\\\ . if (\\ X) \\ = true \\\n then \\\\oid_of (X \\) \\ dom(heap(fst \\)) \\\n oid_of (X \\) \\ dom(heap(snd \\))\\\\\n else invalid \\)\"\n\nlemma state_split : \"\\ \\ \\ X \\\n \\ \\ (X .oclIsNew()) \\ \\ \\ (X .oclIsDeleted()) \\\n \\ \\ (X .oclIsMaintained()) \\ \\ \\ (X .oclIsAbsent())\"\nby(simp add: OclIsDeleted_def OclIsNew_def OclIsMaintained_def OclIsAbsent_def\n OclValid_def true_def, blast)\n\nlemma notNew_vs_others : \"\\ \\ \\ X \\\n (\\ \\ \\ (X .oclIsNew())) = (\\ \\ (X .oclIsDeleted()) \\\n \\ \\ (X .oclIsMaintained()) \\ \\ \\ (X .oclIsAbsent()))\"\nby(simp add: OclIsDeleted_def OclIsNew_def OclIsMaintained_def OclIsAbsent_def\n OclNot_def OclValid_def true_def, blast)\n\nsubsection\\OclIsModifiedOnly\\\nsubsubsection\\Definition\\\n\ntext\\The following predicate---which is not part of the OCL\nstandard---provides a simple, but powerful means to describe framing\nconditions. For any formal approach, be it animation of OCL contracts,\ntest-case generation or die-hard theorem proving, the specification of\nthe part of a system transition that \\emph{does not change} is of\nprimordial importance. The following operator establishes the equality\nbetween old and new objects in the state (provided that they exist in\nboth states), with the exception of those objects.\\\n\ndefinition OclIsModifiedOnly ::\"('\\::object,'\\::{null,object})Set \\ '\\ Boolean\"\n (\"_->oclIsModifiedOnly'(')\")\nwhere \"X->oclIsModifiedOnly() \\ (\\(\\,\\').\n let X' = (oid_of ` \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(X(\\,\\'))\\\\);\n S = ((dom (heap \\) \\ dom (heap \\')) - X')\n in if (\\ X) (\\,\\') = true (\\,\\') \\ (\\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(X(\\,\\'))\\\\. x \\ null)\n then \\\\\\ x \\ S. (heap \\) x = (heap \\') x\\\\\n else invalid (\\,\\'))\"\n\nsubsubsection\\Execution with Invalid or Null or Null Element as Argument\\\n\nlemma \"invalid->oclIsModifiedOnly() = invalid\"\nby(simp add: OclIsModifiedOnly_def)\n\nlemma \"null->oclIsModifiedOnly() = invalid\"\nby(simp add: OclIsModifiedOnly_def)\n\nlemma\n assumes X_null : \"\\ \\ X->includes\\<^sub>S\\<^sub>e\\<^sub>t(null)\"\n shows \"\\ \\ X->oclIsModifiedOnly() \\ invalid\"\n apply(insert X_null,\n simp add : OclIncludes_def OclIsModifiedOnly_def StrongEq_def OclValid_def true_def)\n apply(case_tac \\, simp)\n apply(simp split: if_split_asm)\nby(simp add: null_fun_def, blast)\n\nsubsubsection\\Context Passing\\\n\nlemma cp_OclIsModifiedOnly : \"X->oclIsModifiedOnly() \\ = (\\_. X \\)->oclIsModifiedOnly() \\\"\nby(simp only: OclIsModifiedOnly_def, case_tac \\, simp only:, subst cp_defined, simp)\n\nsubsection\\OclSelf\\\n\ntext\\The following predicate---which is not part of the OCL\nstandard---explicitly retrieves in the pre or post state the original OCL expression\ngiven as argument.\\\n\ndefinition [simp]: \"OclSelf x H fst_snd = (\\\\ . if (\\ x) \\ = true \\\n then if oid_of (x \\) \\ dom(heap(fst \\)) \\ oid_of (x \\) \\ dom(heap (snd \\))\n then H \\(heap(fst_snd \\))(oid_of (x \\))\\\n else invalid \\\n else invalid \\)\"\n\ndefinition OclSelf_at_pre :: \"('\\::object,'\\::{null,object})val \\\n ('\\ \\ '\\) \\\n ('\\::object,'\\::{null,object})val\" (\"(_)@pre(_)\")\nwhere \"x @pre H = OclSelf x H fst\"\n\ndefinition OclSelf_at_post :: \"('\\::object,'\\::{null,object})val \\\n ('\\ \\ '\\) \\\n ('\\::object,'\\::{null,object})val\" (\"(_)@post(_)\")\nwhere \"x @post H = OclSelf x H snd\"\n\nsubsection\\Framing Theorem\\\n\nlemma all_oid_diff:\n assumes def_x : \"\\ \\ \\ x\"\n assumes def_X : \"\\ \\ \\ X\"\n assumes def_X' : \"\\x. x \\ \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\ \\ x \\ null\"\n\n defines \"P \\ (\\a. not (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x a))\"\n shows \"(\\ \\ X->forAll\\<^sub>S\\<^sub>e\\<^sub>t(a| P a)) = (oid_of (x \\) \\ oid_of ` \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\)\"\nproof -\n have P_null_bot: \"\\b. b = null \\ b = \\ \\\n \\ (\\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\(_:: 'a state \\ 'a state). x) \\ = b \\)\"\n apply(erule disjE)\n apply(simp, rule ballI,\n simp add: P_def StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def, rename_tac x',\n subst cp_OclNot, simp,\n subgoal_tac \"x \\ \\ null \\ x' \\ null\", simp,\n simp add: OclNot_def null_fun_def null_option_def bot_option_def bot_fun_def invalid_def,\n ( metis def_X' def_x foundation16[THEN iffD1]\n | (metis bot_fun_def OclValid_def Set_inv_lemma def_X def_x defined_def valid_def,\n metis def_X' def_x foundation16[THEN iffD1])))+\n done\n\n\n have not_inj : \"\\x y. ((not x) \\ = (not y) \\) = (x \\ = y \\)\"\n by (metis foundation21 foundation22)\n\n have P_false : \"\\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ = false \\ \\\n oid_of (x \\) \\ oid_of ` \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\\"\n apply(erule bexE, rename_tac x')\n apply(simp add: P_def)\n apply(simp only: OclNot3[symmetric], simp only: not_inj)\n apply(simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def split: if_split_asm)\n apply(subgoal_tac \"x \\ \\ null \\ x' \\ null\", simp)\n apply (metis (mono_tags) drop.simps def_x foundation16[THEN iffD1] true_def)\n by(simp add: invalid_def bot_option_def true_def)+\n\n have P_true : \"\\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ = true \\ \\\n oid_of (x \\) \\ oid_of ` \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\\"\n apply(subgoal_tac \"\\x'\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. oid_of x' \\ oid_of (x \\)\")\n apply (metis imageE)\n apply(rule ballI, drule_tac x = \"x'\" in ballE) prefer 3 apply assumption\n apply(simp add: P_def)\n apply(simp only: OclNot4[symmetric], simp only: not_inj)\n apply(simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def false_def split: if_split_asm)\n apply(subgoal_tac \"x \\ \\ null \\ x' \\ null\", simp)\n apply (metis def_X' def_x foundation16[THEN iffD1])\n by(simp add: invalid_def bot_option_def false_def)+\n\n have bool_split : \"\\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ \\ null \\ \\\n \\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ \\ \\ \\ \\\n \\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ \\ false \\ \\\n \\x\\\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\. P (\\_. x) \\ = true \\\"\n apply(rule ballI)\n apply(drule_tac x = x in ballE) prefer 3 apply assumption\n apply(drule_tac x = x in ballE) prefer 3 apply assumption\n apply(drule_tac x = x in ballE) prefer 3 apply assumption\n apply (metis (full_types) bot_fun_def OclNot4 OclValid_def foundation16\n foundation9 not_inj null_fun_def)\n by(fast+)\n\n show ?thesis\n apply(subst OclForall_rep_set_true[OF def_X], simp add: OclValid_def)\n apply(rule iffI, simp add: P_true)\n by (metis P_false P_null_bot bool_split)\nqed\n\ntheorem framing:\n assumes modifiesclause:\"\\ \\ (X->excluding\\<^sub>S\\<^sub>e\\<^sub>t(x))->oclIsModifiedOnly()\"\n and oid_is_typerepr : \"\\ \\ X->forAll\\<^sub>S\\<^sub>e\\<^sub>t(a| not (StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t x a))\"\n shows \"\\ \\ (x @pre P \\ (x @post P))\"\n apply(case_tac \"\\ \\ \\ x\")\n proof - show \"\\ \\ \\ x \\ ?thesis\" proof - assume def_x : \"\\ \\ \\ x\" show ?thesis proof -\n\n have def_X : \"\\ \\ \\ X\"\n apply(insert oid_is_typerepr, simp add: UML_Set.OclForall_def OclValid_def split: if_split_asm)\n by(simp add: bot_option_def true_def)\n\n have def_X' : \"\\x. x \\ \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\ \\ x \\ null\"\n apply(insert modifiesclause, simp add: OclIsModifiedOnly_def OclValid_def split: if_split_asm)\n apply(case_tac \\, simp split: if_split_asm)\n apply(simp add: UML_Set.OclExcluding_def split: if_split_asm)\n apply(subst (asm) (2) Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse)\n apply(simp, (rule disjI2)+)\n apply (metis (hide_lams, mono_tags) Diff_iff Set_inv_lemma def_X)\n apply(simp)\n apply(erule ballE[where P = \"\\x. x \\ null\"]) apply(assumption)\n apply(simp)\n apply (metis (hide_lams, no_types) def_x foundation16[THEN iffD1])\n apply (metis (hide_lams, no_types) OclValid_def def_X def_x foundation20\n OclExcluding_valid_args_valid OclExcluding_valid_args_valid'')\n by(simp add: invalid_def bot_option_def)\n\n have oid_is_typerepr : \"oid_of (x \\) \\ oid_of ` \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\)\\\\\"\n by(rule all_oid_diff[THEN iffD1, OF def_x def_X def_X' oid_is_typerepr])\n\n show ?thesis\n apply(simp add: StrongEq_def OclValid_def true_def OclSelf_at_pre_def OclSelf_at_post_def\n def_x[simplified OclValid_def])\n apply(rule conjI, rule impI)\n apply(rule_tac f = \"\\x. P \\x\\\" in arg_cong)\n apply(insert modifiesclause[simplified OclIsModifiedOnly_def OclValid_def])\n apply(case_tac \\, rename_tac \\ \\', simp split: if_split_asm)\n apply(subst (asm) (2) UML_Set.OclExcluding_def)\n apply(drule foundation5[simplified OclValid_def true_def], simp)\n apply(subst (asm) Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp)\n apply(rule disjI2)+\n apply (metis (hide_lams, no_types) DiffD1 OclValid_def Set_inv_lemma def_x\n foundation16 foundation18')\n apply(simp)\n apply(erule_tac x = \"oid_of (x (\\, \\'))\" in ballE) apply simp+\n apply (metis (hide_lams, no_types)\n DiffD1 image_iff image_insert insert_Diff_single insert_absorb oid_is_typerepr)\n apply(simp add: invalid_def bot_option_def)+\n by blast\n qed qed\nqed(simp add: OclSelf_at_post_def OclSelf_at_pre_def OclValid_def StrongEq_def true_def)+\n\n\ntext\\As corollary, the framing property can be expressed with only the strong equality\nas comparison operator.\\\n\ntheorem framing':\n assumes wff : \"WFF \\\"\n assumes modifiesclause:\"\\ \\ (X->excluding\\<^sub>S\\<^sub>e\\<^sub>t(x))->oclIsModifiedOnly()\"\n and oid_is_typerepr : \"\\ \\ X->forAll\\<^sub>S\\<^sub>e\\<^sub>t(a| not (x \\ a))\"\n and oid_preserve: \"\\x. x \\ ran (heap(fst \\)) \\ x \\ ran (heap(snd \\)) \\\n oid_of (H x) = oid_of x\"\n and xy_together:\n \"\\ \\ X->forAll\\<^sub>S\\<^sub>e\\<^sub>t(y | (H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x) and H .allInstances()->includes\\<^sub>S\\<^sub>e\\<^sub>t(y)) or\n (H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(x) and H .allInstances@pre()->includes\\<^sub>S\\<^sub>e\\<^sub>t(y)))\"\n shows \"\\ \\ (x @pre P \\ (x @post P))\"\nproof -\n have def_X : \"\\ \\ \\ X\"\n apply(insert oid_is_typerepr, simp add: UML_Set.OclForall_def OclValid_def split: if_split_asm)\n by(simp add: bot_option_def true_def)\n show ?thesis\n apply(case_tac \"\\ \\ \\ x\", drule foundation20)\n apply(rule framing[OF modifiesclause])\n apply(rule OclForall_cong'[OF _ oid_is_typerepr xy_together], rename_tac y)\n apply(cut_tac Set_inv_lemma'[OF def_X]) prefer 2 apply assumption\n apply(rule OclNot_contrapos_nn, simp add: StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_def)\n apply(simp add: OclValid_def, subst cp_defined, simp,\n assumption)\n apply(rule StrictRefEq\\<^sub>O\\<^sub>b\\<^sub>j\\<^sub>e\\<^sub>c\\<^sub>t_vs_StrongEq''[THEN iffD1, OF wff _ _ oid_preserve], assumption+)\n by(simp add: OclSelf_at_post_def OclSelf_at_pre_def OclValid_def StrongEq_def true_def)+\nqed\n\nsubsection\\Miscellaneous\\\n\nlemma pre_post_new: \"\\ \\ (x .oclIsNew()) \\ \\ (\\ \\ \\(x @pre H1)) \\ \\ (\\ \\ \\(x @post H2))\"\nby(simp add: OclIsNew_def OclSelf_at_pre_def OclSelf_at_post_def\n OclValid_def StrongEq_def true_def false_def\n bot_option_def invalid_def bot_fun_def valid_def\n split: if_split_asm)\n\nlemma pre_post_old: \"\\ \\ (x .oclIsDeleted()) \\ \\ (\\ \\ \\(x @pre H1)) \\ \\ (\\ \\ \\(x @post H2))\"\nby(simp add: OclIsDeleted_def OclSelf_at_pre_def OclSelf_at_post_def\n OclValid_def StrongEq_def true_def false_def\n bot_option_def invalid_def bot_fun_def valid_def\n split: if_split_asm)\n\nlemma pre_post_absent: \"\\ \\ (x .oclIsAbsent()) \\ \\ (\\ \\ \\(x @pre H1)) \\ \\ (\\ \\ \\(x @post H2))\"\nby(simp add: OclIsAbsent_def OclSelf_at_pre_def OclSelf_at_post_def\n OclValid_def StrongEq_def true_def false_def\n bot_option_def invalid_def bot_fun_def valid_def\n split: if_split_asm)\n\nlemma pre_post_maintained: \"(\\ \\ \\(x @pre H1) \\ \\ \\ \\(x @post H2)) \\ \\ \\ (x .oclIsMaintained())\"\nby(simp add: OclIsMaintained_def OclSelf_at_pre_def OclSelf_at_post_def\n OclValid_def StrongEq_def true_def false_def\n bot_option_def invalid_def bot_fun_def valid_def\n split: if_split_asm)\n\nlemma pre_post_maintained':\n\"\\ \\ (x .oclIsMaintained()) \\ (\\ \\ \\(x @pre (Some o H1)) \\ \\ \\ \\(x @post (Some o H2)))\"\nby(simp add: OclIsMaintained_def OclSelf_at_pre_def OclSelf_at_post_def\n OclValid_def StrongEq_def true_def false_def\n bot_option_def invalid_def bot_fun_def valid_def\n split: if_split_asm)\n\nlemma framing_same_state: \"(\\, \\) \\ (x @pre H \\ (x @post H))\"\nby(simp add: OclSelf_at_pre_def OclSelf_at_post_def OclValid_def StrongEq_def)\n\nsection\\Accessors on Object\\\nsubsection\\Definition\\\n\ndefinition \"select_object mt incl smash deref l = smash (foldl incl mt (map deref l))\n \\ \\smash returns null with \\mt\\ in input (in this case, object contains null pointer)\\\"\n\ntext\\The continuation \\f\\ is usually instantiated with a smashing\nfunction which is either the identity @{term id} or, for \\inlineocl{0..1} cardinalities\nof associations, the @{term OclANY}-selector which also handles the\n@{term null}-cases appropriately. A standard use-case for this combinator\nis for example:\\\nterm \"(select_object mtSet UML_Set.OclIncluding UML_Set.OclANY f l oid )::('\\, 'a::null)val\"\n\ndefinition \"select_object\\<^sub>S\\<^sub>e\\<^sub>t = select_object mtSet UML_Set.OclIncluding id\"\ndefinition \"select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t f s_set = UML_Set.OclANY (select_object\\<^sub>S\\<^sub>e\\<^sub>t f s_set)\"\ndefinition \"select_object_any\\<^sub>S\\<^sub>e\\<^sub>t f s_set = \n (let s = select_object\\<^sub>S\\<^sub>e\\<^sub>t f s_set in\n if s->size\\<^sub>S\\<^sub>e\\<^sub>t() \\ \\ then\n s->any\\<^sub>S\\<^sub>e\\<^sub>t()\n else\n \\\n endif)\"\ndefinition \"select_object\\<^sub>S\\<^sub>e\\<^sub>q = select_object mtSequence UML_Sequence.OclIncluding id\"\ndefinition \"select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set = UML_Sequence.OclANY (select_object\\<^sub>S\\<^sub>e\\<^sub>q f s_set)\"\ndefinition \"select_object\\<^sub>P\\<^sub>a\\<^sub>i\\<^sub>r f1 f2 = (\\(a,b). OclPair (f1 a) (f2 b))\"\n\nsubsection\\Validity and Definedness Properties\\\n\nlemma select_fold_exec\\<^sub>S\\<^sub>e\\<^sub>q:\n assumes \"list_all (\\f. (\\ \\ \\ f)) l\"\n shows \"\\\\Rep_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (foldl UML_Sequence.OclIncluding Sequence{} l \\)\\\\ = List.map (\\f. f \\) l\"\nproof -\n have def_fold: \"\\l. list_all (\\f. \\ \\ \\ f) l \\\n \\ \\ (\\ foldl UML_Sequence.OclIncluding Sequence{} l)\"\n apply(rule rev_induct[where P = \"\\l. list_all (\\f. (\\ \\ \\ f)) l \\ \\ \\ (\\ foldl UML_Sequence.OclIncluding Sequence{} l)\", THEN mp], simp)\n by(simp add: foundation10')\n show ?thesis\n apply(rule rev_induct[where P = \"\\l. list_all (\\f. (\\ \\ \\ f)) l \\ \\\\Rep_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (foldl UML_Sequence.OclIncluding Sequence{} l \\)\\\\ = List.map (\\f. f \\) l\", THEN mp], simp)\n apply(simp add: mtSequence_def)\n apply(subst Abs_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, (simp | intro impI)+)\n apply(simp add: UML_Sequence.OclIncluding_def, intro conjI impI)\n apply(subst Abs_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp, (rule disjI2)+)\n apply(simp add: list_all_iff foundation18', simp)\n apply(subst (asm) def_fold[simplified (no_asm) OclValid_def], simp, simp add: OclValid_def)\n by (rule assms)\nqed\n\nlemma select_fold_exec\\<^sub>S\\<^sub>e\\<^sub>t:\n assumes \"list_all (\\f. (\\ \\ \\ f)) l\"\n shows \"\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (foldl UML_Set.OclIncluding Set{} l \\)\\\\ = set (List.map (\\f. f \\) l)\"\nproof -\n have def_fold: \"\\l. list_all (\\f. \\ \\ \\ f) l \\\n \\ \\ (\\ foldl UML_Set.OclIncluding Set{} l)\"\n apply(rule rev_induct[where P = \"\\l. list_all (\\f. (\\ \\ \\ f)) l \\ \\ \\ (\\ foldl UML_Set.OclIncluding Set{} l)\", THEN mp], simp)\n by(simp add: foundation10')\n show ?thesis\n apply(rule rev_induct[where P = \"\\l. list_all (\\f. (\\ \\ \\ f)) l \\ \\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (foldl UML_Set.OclIncluding Set{} l \\)\\\\ = set (List.map (\\f. f \\) l)\", THEN mp], simp)\n apply(simp add: mtSet_def)\n apply(subst Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, (simp | intro impI)+)\n apply(simp add: UML_Set.OclIncluding_def, intro conjI impI)\n apply(subst Abs_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp, (rule disjI2)+)\n apply(simp add: list_all_iff foundation18', simp)\n apply(subst (asm) def_fold[simplified (no_asm) OclValid_def], simp, simp add: OclValid_def)\n by (rule assms)\nqed\n\n\n\nlemma fold_val_elem\\<^sub>S\\<^sub>e\\<^sub>t:\n assumes \"\\ \\ \\ (foldl UML_Set.OclIncluding Set{} (List.map (f p) s_set))\"\n shows \"list_all (\\x. (\\ \\ \\ (f p x))) s_set\"\n apply(rule rev_induct[where P = \"\\s_set. \\ \\ \\ foldl UML_Set.OclIncluding Set{} (List.map (f p) s_set) \\ list_all (\\x. \\ \\ \\ f p x) s_set\", THEN mp])\n apply(simp, auto)\n apply (metis (hide_lams, mono_tags) foundation10' foundation20)+\nby(simp add: assms)\n\nlemma select_object_any_defined\\<^sub>S\\<^sub>e\\<^sub>q:\n assumes def_sel: \"\\ \\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set)\"\n shows \"s_set \\ []\"\n apply(insert def_sel, case_tac s_set)\n apply(simp add: select_object_any\\<^sub>S\\<^sub>e\\<^sub>q_def UML_Sequence.OclANY_def select_object\\<^sub>S\\<^sub>e\\<^sub>q_def select_object_def\n defined_def OclValid_def\n false_def true_def bot_fun_def bot_option_def\n split: if_split_asm)\n apply(simp add: mtSequence_def, subst (asm) Abs_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp, simp)\nby(simp)\n\nlemma (*select_object_any_defined\\<^sub>S\\<^sub>e\\<^sub>t:*)\n assumes def_sel: \"\\ \\ \\ (select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t f s_set)\"\n shows \"s_set \\ []\"\n apply(insert def_sel, case_tac s_set)\n apply(simp add: select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t_def UML_Sequence.OclANY_def select_object\\<^sub>S\\<^sub>e\\<^sub>t_def select_object_def\n defined_def OclValid_def\n false_def true_def bot_fun_def bot_option_def\n split: if_split_asm)\nby(simp)\n\nlemma select_object_any_defined\\<^sub>S\\<^sub>e\\<^sub>t:\n assumes def_sel: \"\\ \\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>t f s_set)\"\n shows \"s_set \\ []\"\n apply(insert def_sel, case_tac s_set)\n apply(simp add: select_object_any\\<^sub>S\\<^sub>e\\<^sub>t_def UML_Sequence.OclANY_def select_object\\<^sub>S\\<^sub>e\\<^sub>t_def select_object_def\n defined_def OclValid_def\n false_def true_def bot_fun_def bot_option_def\n OclInt0_def OclInt1_def StrongEq_def OclIf_def null_fun_def null_option_def\n split: if_split_asm)\nby(simp)\n\nlemma select_object_any_exec0\\<^sub>S\\<^sub>e\\<^sub>q:\n assumes def_sel: \"\\ \\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set)\"\n shows \"\\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set \\ f (hd s_set))\"\n apply(insert def_sel[simplified foundation16],\n simp add: select_object_any\\<^sub>S\\<^sub>e\\<^sub>q_def foundation22 UML_Sequence.OclANY_def split: if_split_asm)\n apply(case_tac \"\\\\Rep_Sequence\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (select_object\\<^sub>S\\<^sub>e\\<^sub>q f s_set \\)\\\\\", simp add: bot_option_def, simp)\n apply(simp add: select_object\\<^sub>S\\<^sub>e\\<^sub>q_def select_object_def)\n apply(subst (asm) select_fold_exec\\<^sub>S\\<^sub>e\\<^sub>q)\n apply(rule fold_val_elem\\<^sub>S\\<^sub>e\\<^sub>q, simp add: foundation18' invalid_def)\n apply(simp)\nby(drule arg_cong[where f = hd], subst (asm) hd_map, simp add: select_object_any_defined\\<^sub>S\\<^sub>e\\<^sub>q[OF def_sel], simp)\n\nlemma select_object_any_exec\\<^sub>S\\<^sub>e\\<^sub>q:\n assumes def_sel: \"\\ \\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set)\"\n shows \"\\e. List.member s_set e \\ (\\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>q f s_set \\ f e))\"\n apply(insert select_object_any_exec0\\<^sub>S\\<^sub>e\\<^sub>q[OF def_sel])\n apply(rule exI[where x = \"hd s_set\"], simp)\n apply(case_tac s_set, simp add: select_object_any_defined\\<^sub>S\\<^sub>e\\<^sub>q[OF def_sel])\nby (metis list.sel member_rec(1))\n\nlemma (*select_object_any_exec\\<^sub>S\\<^sub>e\\<^sub>t:*)\n assumes def_sel: \"\\ \\ \\ (select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t f s_set)\"\n shows \"\\ e. List.member s_set e \\ (\\ \\ (select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t f s_set \\ f e))\"\nproof -\n have list_all_map: \"\\P f l. list_all P (List.map f l) = list_all (P o f) l\"\n by(induct_tac l, simp_all)\n\n fix z\n show ?thesis\n when \"\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (select_object\\<^sub>S\\<^sub>e\\<^sub>t f s_set \\)\\\\ = z\"\n apply(insert that def_sel[simplified foundation16],\n simp add: select_object_any0\\<^sub>S\\<^sub>e\\<^sub>t_def foundation22 UML_Set.OclANY_def null_fun_def split: if_split_asm)\n\n apply(simp add: select_object\\<^sub>S\\<^sub>e\\<^sub>t_def select_object_def)\n apply(subst (asm) select_fold_exec\\<^sub>S\\<^sub>e\\<^sub>t)\n apply(rule fold_val_elem\\<^sub>S\\<^sub>e\\<^sub>t, simp add: OclValid_def)\n apply(simp add: comp_def)\n\n apply(case_tac s_set, simp, simp add: false_def true_def, simp)\n\n proof - fix a l\n show \"insert (f a \\) ((\\x. f x \\) ` set l) = z \\\n \\e. List.member (a # l) e \\ (SOME y. y \\ z) = f e \\\"\n apply(rule list.induct[where P = \"\\l. \\z a. insert (f a \\) ((\\x. f x \\) ` set l) = z \\\n (\\e. List.member (a # l) e \\ ((SOME y. y \\ z) = f e \\))\", THEN spec, THEN spec, THEN mp], intro allI impI)\n proof - fix x xa show \"insert (f xa \\) ((\\x. f x \\) ` set []) = x \\ \\e. List.member [xa] e \\ (SOME y. y \\ x) = f e \\\"\n apply(rule exI[where x = xa], simp add: List.member_def)\n apply(subst some_equality[where a = \"f xa \\\"])\n apply (metis (mono_tags) insertI1)\n apply (metis (mono_tags) empty_iff insert_iff)\n by(simp)\n apply_end(intro allI impI, simp)\n fix x list xa xb\n show \" \\x. \\e. List.member (x # list) e \\ (SOME y. y = f x \\ \\ y \\ (\\x. f x \\) ` set list) = f e \\ \\\n insert (f xb \\) (insert (f x \\) ((\\x. f x \\) ` set list)) = xa \\\n \\e. List.member (xb # x # list) e \\ (SOME y. y \\ xa) = f e \\\"\n apply(case_tac \"x = xb\", simp)\n apply(erule allE[where x = xb])\n apply(erule exE)\n proof - fix e show \"insert (f xb \\) ((\\x. f x \\) ` set list) = xa \\\n x = xb \\\n List.member (xb # list) e \\ (SOME y. y = f xb \\ \\ y \\ (\\x. f x \\) ` set list) = f e \\ \\\n \\e. List.member (xb # xb # list) e \\ (SOME y. y \\ xa) = f e \\\"\n apply(rule exI[where x = e], auto)\n by (metis member_rec(1))\n apply_end(case_tac \"List.member list x\")\n apply_end(erule allE[where x = xb])\n apply_end(erule exE)\n fix e\n let ?P = \"\\y. y = f xb \\ \\ y \\ (\\x. f x \\) ` set list\"\n show \"insert (f xb \\) (insert (f x \\) ((\\x. f x \\) ` set list)) = xa \\\n x \\ xb \\\n List.member list x \\\n List.member (xb # list) e \\ (SOME y. y = f xb \\ \\ y \\ (\\x. f x \\) ` set list) = f e \\ \\\n \\e. List.member (xb # x # list) e \\ (SOME y. y \\ xa) = f e \\\"\n apply(rule exI[where x = e], auto)\n apply (metis member_rec(1))\n\n apply(subgoal_tac \"?P (f e \\)\")\n prefer 2\n apply(case_tac \"xb = e\", simp)\n apply (metis (mono_tags) image_eqI in_set_member member_rec(1)) \n\n apply(rule someI2[where a = \"f e \\\"])\n apply(erule disjE, simp)+\n apply(rule disjI2)+ apply(simp)\noops\n\nlemma select_object_any_exec\\<^sub>S\\<^sub>e\\<^sub>t:\n assumes def_sel: \"\\ \\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>t f s_set)\"\n shows \"\\ e. List.member s_set e \\ (\\ \\ (select_object_any\\<^sub>S\\<^sub>e\\<^sub>t f s_set \\ f e))\"\nproof -\n have card_singl: \"\\A a. finite A \\ card (insert a A) = 1 \\ A \\ {a}\"\n by (auto, metis Suc_inject card_Suc_eq card_eq_0_iff insert_absorb insert_not_empty singleton_iff)\n\n have list_same: \"\\f s_set z' x. f ` set s_set = {z'} \\ List.member s_set x \\ f x = z'\"\n by (metis (full_types) empty_iff imageI in_set_member insert_iff)\n\n fix z\n show ?thesis\n when \"\\\\Rep_Set\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (select_object\\<^sub>S\\<^sub>e\\<^sub>t f s_set \\)\\\\ = z\"\n apply(insert that def_sel[simplified foundation16],\n simp add: select_object_any\\<^sub>S\\<^sub>e\\<^sub>t_def foundation22\n Let_def null_fun_def bot_fun_def OclIf_def\n split: if_split_asm)\n apply(simp add: StrongEq_def OclInt1_def true_def UML_Set.OclSize_def\n bot_option_def UML_Set.OclANY_def null_fun_def\n split: if_split_asm)\n apply(subgoal_tac \"\\z'. z = {z'}\")\n prefer 2\n apply(rule finite.cases[where a = z], simp, simp, simp)\n apply(rule card_singl, simp, simp)\n apply(erule exE, clarsimp)\n\n apply(simp add: select_object\\<^sub>S\\<^sub>e\\<^sub>t_def select_object_def)\n apply(subst (asm) select_fold_exec\\<^sub>S\\<^sub>e\\<^sub>t)\n apply(rule fold_val_elem\\<^sub>S\\<^sub>e\\<^sub>t, simp add: OclValid_def true_def)\n apply(simp add: comp_def)\n\n apply(case_tac s_set, simp)\n proof - fix z' a list show \"(\\x. f x \\) ` set s_set = {z'} \\ s_set = a # list \\ \\e. List.member s_set e \\ z' = f e \\\"\n apply(drule list_same[where x1 = a])\n apply (metis member_rec(1))\n by (metis (hide_lams, mono_tags) ListMem_iff elem in_set_member)\n qed\nqed blast+\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Featherweight_OCL/UML_State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.29313834883000983}} {"text": "(*\n Author: Gerwin Klein\n Copyright 1999 Technische Universitaet Muenchen\n*)\n\nsection \\Correctness of the LBV\\\n\ntheory LBVCorrect\nimports LBVSpec Typing_Framework\nbegin\n\nlocale lbvs = lbv +\n fixes s\\<^sub>0 :: 'a\n fixes c :: \"'a list\"\n fixes ins :: \"'b list\"\n fixes \\s :: \"'a list\"\n defines phi_def:\n \"\\s \\ map (\\pc. if c!pc = \\ then wtl (take pc ins) c 0 s\\<^sub>0 else c!pc) \n [0.. \\ A\"\n assumes pres: \"pres_type step (size ins) A\"\n\nlemma (in lbvs) phi_None [intro?]:\n \"\\ pc < size ins; c!pc = \\ \\ \\ \\s!pc = wtl (take pc ins) c 0 s\\<^sub>0\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_Some [intro?]:\n \"\\ pc < size ins; c!pc \\ \\ \\ \\ \\s!pc = c!pc\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_len [simp]: \"size \\s = size ins\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) wtl_suc_pc:\n assumes all: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes pc: \"pc+1 < size ins\"\n shows \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\\\<^sub>r \\s!(pc+1)\"\n(*<*)\nproof -\n from all pc\n have \"wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s\\<^sub>0) \\ T\" by (rule wtl_all)\n with pc show ?thesis by (simp add: phi_def wtc split: if_split_asm)\nqed\n(*>*)\n\nlemma (in lbvs) wtl_stable:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes s\\<^sub>0: \"s\\<^sub>0 \\ A\" and pc: \"pc < size ins\" \n shows \"stable r step \\s pc\"\n(*<*)\nproof (unfold stable_def, clarify)\n fix pc' s' assume step: \"(pc',s') \\ set (step pc (\\s ! pc))\" \n (is \"(pc',s') \\ set (?step pc)\")\n \n from bounded pc step have pc': \"pc' < size ins\" by (rule boundedD)\n\n have tkpc: \"wtl (take pc ins) c 0 s\\<^sub>0 \\ \\\" (is \"?s\\<^sub>1 \\ _\") using wtl by (rule wtl_take)\n have s\\<^sub>2: \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\ \\\" (is \"?s\\<^sub>2 \\ _\") using wtl by (rule wtl_take)\n \n from wtl pc have wt_s\\<^sub>1: \"wtc c pc ?s\\<^sub>1 \\ \\\" by (rule wtl_all)\n\n have c_Some: \"\\pc t. pc < size ins \\ c!pc \\ \\ \\ \\s!pc = c!pc\" \n by (simp add: phi_def)\n have c_None: \"c!pc = \\ \\ \\s!pc = ?s\\<^sub>1\" using pc ..\n\n from wt_s\\<^sub>1 pc c_None c_Some\n have inst: \"wtc c pc ?s\\<^sub>1 = wti c pc (\\s!pc)\"\n by (simp add: wtc split: if_split_asm)\n\n have \"?s\\<^sub>1 \\ A\" using pres cert s\\<^sub>0 wtl pc by (rule wtl_pres)\n with pc c_Some cert c_None\n have \"\\s!pc \\ A\" by (cases \"c!pc = \\\") (auto dest: cert_okD1)\n with pc pres\n have step_in_A: \"snd`set (?step pc) \\ A\" by (auto dest: pres_typeD2)\n\n show \"s' \\\\<^sub>r \\s!pc'\" \n proof (cases \"pc' = pc+1\")\n case True\n with pc' cert\n have cert_in_A: \"c!(pc+1) \\ A\" by (auto dest: cert_okD1)\n from True pc' have pc1: \"pc+1 < size ins\" by simp\n with tkpc have \"?s\\<^sub>2 = wtc c pc ?s\\<^sub>1\" by - (rule wtl_Suc)\n with inst \n have merge: \"?s\\<^sub>2 = merge c pc (?step pc) (c!(pc+1))\" by (simp add: wti)\n also from s\\<^sub>2 merge have \"\\ \\ \\\" (is \"?merge \\ _\") by simp\n with cert_in_A step_in_A\n have \"?merge = (map snd [(p',t') \\ ?step pc. p'=pc+1] \\\\<^bsub>f\\<^esub> c!(pc+1))\"\n by (rule merge_not_top_s) \n finally have \"s' \\\\<^sub>r ?s\\<^sub>2\" using step_in_A cert_in_A True step \n by (auto intro: pp_ub1')\n also from wtl pc1 have \"?s\\<^sub>2 \\\\<^sub>r \\s!(pc+1)\" by (rule wtl_suc_pc)\n also note True [symmetric]\n finally show ?thesis by simp \n next\n case False\n from wt_s\\<^sub>1 inst \n have \"merge c pc (?step pc) (c!(pc+1)) \\ \\\" by (simp add: wti)\n with step_in_A have \"\\(pc', s')\\set (?step pc). pc'\\pc+1 \\ s' \\\\<^sub>r c!pc'\"\n by - (rule merge_not_top)\n with step False have ok: \"s' \\\\<^sub>r c!pc'\" by blast\n moreover from ok have \"c!pc' = \\ \\ s' = \\\" by simp\n moreover from c_Some pc' have \"c!pc' \\ \\ \\ \\s!pc' = c!pc'\" by auto\n ultimately show ?thesis by (cases \"c!pc' = \\\") auto \n qed\nqed\n(*>*)\n \nlemma (in lbvs) phi_not_top:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and pc: \"pc < size ins\"\n shows \"\\s!pc \\ \\\"\n(*<*)\nproof (cases \"c!pc = \\\")\n case False with pc\n have \"\\s!pc = c!pc\" ..\n also from cert pc have \"\\ \\ \\\" by (rule cert_okD4)\n finally show ?thesis .\nnext\n case True with pc\n have \"\\s!pc = wtl (take pc ins) c 0 s\\<^sub>0\" ..\n also from wtl have \"\\ \\ \\\" by (rule wtl_take)\n finally show ?thesis .\nqed\n(*>*)\n\nlemma (in lbvs) phi_in_A:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and s\\<^sub>0: \"s\\<^sub>0 \\ A\"\n shows \"\\s \\ list (size ins) A\"\n(*<*)\nproof -\n { fix x assume \"x \\ set \\s\"\n then obtain xs ys where \"\\s = xs @ x # ys\" \n by (auto simp add: in_set_conv_decomp)\n then obtain pc where pc: \"pc < size \\s\" and x: \"\\s!pc = x\"\n by (simp add: that [of \"size xs\"] nth_append)\n \n from pres cert wtl s\\<^sub>0 pc \n have \"wtl (take pc ins) c 0 s\\<^sub>0 \\ A\" by (auto intro!: wtl_pres)\n moreover\n from pc have \"pc < size ins\" by simp\n with cert have \"c!pc \\ A\" ..\n ultimately\n have \"\\s!pc \\ A\" using pc by (simp add: phi_def)\n hence \"x \\ A\" using x by simp\n } \n hence \"set \\s \\ A\" ..\n thus ?thesis by (unfold list_def) simp\nqed\n(*>*)\n\nlemma (in lbvs) phi0:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and 0: \"0 < size ins\"\n shows \"s\\<^sub>0 \\\\<^sub>r \\s!0\"\n(*<*)\nproof (cases \"c!0 = \\\")\n case True\n with 0 have \"\\s!0 = wtl (take 0 ins) c 0 s\\<^sub>0\" ..\n moreover have \"wtl (take 0 ins) c 0 s\\<^sub>0 = s\\<^sub>0\" by simp\n ultimately have \"\\s!0 = s\\<^sub>0\" by simp\n thus ?thesis by simp\nnext\n case False\n with 0 have \"\\s!0 = c!0\" ..\n moreover \n have \"wtl (take 1 ins) c 0 s\\<^sub>0 \\ \\\" using wtl by (rule wtl_take)\n with 0 False \n have \"s\\<^sub>0 \\\\<^sub>r c!0\" by (auto simp add: neq_Nil_conv wtc split: if_split_asm)\n ultimately\n show ?thesis by simp\nqed\n(*>*)\n\n\n\n\n\ntheorem (in lbvs) wtl_sound_strong:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes s\\<^sub>0: \"s\\<^sub>0 \\ A\" and ins: \"0 < size ins\"\n shows \"\\\\s \\ list (size ins) A. wt_step r \\ step \\s \\ s\\<^sub>0 \\\\<^sub>r \\s!0\"\n(*<*)\nproof -\n have \"\\s \\ list (size ins) A\" using wtl s\\<^sub>0 by (rule phi_in_A)\n moreover\n have \"wt_step r \\ step \\s\"\n proof (unfold wt_step_def, intro strip conjI)\n fix pc assume \"pc < size \\s\"\n then obtain pc: \"pc < size ins\" by simp\n with wtl show \"\\s!pc \\ \\\" by (rule phi_not_top)\n from wtl s\\<^sub>0 and pc show \"stable r step \\s pc\" by (rule wtl_stable)\n qed\n moreover from wtl ins have \"s\\<^sub>0 \\\\<^sub>r \\s!0\" by (rule phi0)\n ultimately show ?thesis by fast\nqed\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/DFA/LBVCorrect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.29306201686046157}} {"text": "theory IDentity imports\n CryptHOL.CryptHOL\n Game_Based_Crypto.Game_Based_Crypto\nbegin\n\nsledgehammer_params[timeout = 1000]\n\ntype_synonym ('share1', 'share2', 'share3') share_user_record = \"'share1' \\ 'share2' \\ 'share3'\"\n\ntype_synonym ('attrs', 'sens_atrrs', 'result') query = \"('attrs' set \\ 'sens_atrrs' set) \\ 'result'\"\n\ntype_synonym ('attrs', 'sens_atrrs') user_attrs = \"('attrs' set \\ 'sens_atrrs' set)\" \n\ntype_synonym ('user', 'state_attr_hid', 'enc_attrs') attr_hiding_adversary\n = \"(('user' \\ 'user') \\ 'state_attr_hid') spmf \\ ('state_attr_hid' \\ 'enc_attrs' \\ bool spmf)\"\n\ntype_synonym ('user', 'state_attr_hid', 'share1', 'share2', 'share3') attr_hiding_adversary'\n = \"(('user' \\ 'user') \\ 'state_attr_hid') spmf \\ ('state_attr_hid' \\ ('share1', 'share2', 'share3') share_user_record \\ bool spmf)\"\n\ntype_synonym ('token', 'state', 'auth_token') hiding_adversary = \"(('token' \\ 'token') \\ 'state') spmf \\ ('state' \\ 'auth_token' \\ bool spmf)\"\n\ntype_synonym 'token' soundness_adversary = \"'token' \\ 'token' spmf\"\n\nlocale identity_system =\n fixes reg_enc_sens_attrs :: \"'sens_atrrs set \\ 'enc_attrs spmf\" \\ \\The user encrypts their attributes before sending them to the government.\\ \n and reg_govt_shares :: \"'attrs set \\ 'enc_attrs \\ (('share1, 'share2, 'share3) share_user_record \\ 'state_govt) spmf\"\n and reg_govt_token :: \"'state_govt \\ ('share1, 'share2, 'share3) share_user_record \\ 'token spmf\"\n \\ \\The government first produces the shares of the user record and then a token to be sent back to the user.\\\n and auth :: \"'token \\ ('attrs, 'sens_atrrs, 'result) query \\ 'auth_token spmf\" \n \\ \\Authentication is run between a user and a service provider. \n The user inputs their token, the service provider their desired query and an authorised token is returned. This is sent to the government.\\\n and ver :: \"'auth_token \\ 'result spmf\"\n \\ \\The government uses the authorised token to determine the response to the query.\\\n and valid_user :: \"'user \\ bool\"\n and valid_attrs :: \"('attrs set \\ 'sens_atrrs set) \\ bool\" \n and valid_token :: \"'token \\ bool\"\n and valid_query :: \"('attrs, 'sens_atrrs, 'result) query \\ bool\"\n and user_set :: \"'user set\"\n and attrs_set :: \"('attrs set \\ 'sens_atrrs set) set\"\n and users_attr_creation :: \"'user \\ ('attrs set \\ 'sens_atrrs set)\"\n assumes users_are_valid: \"user \\ user_set \\ valid_user user\"\n and atrrs_are_valid: \"attrs \\ attrs_set \\ valid_attrs attrs\"\n and user_set_not_empty: \"user_set \\ {}\"\n and attrs_set_not_empty: \"attrs_set \\ {}\"\n and bij_betw_users_attrs: \"bij_betw users_attr_creation user_set attrs_set\"\n and lossless_reg_govt_token: \"lossless_spmf (reg_govt_token \\ S)\"\nbegin\n\nlemma all_users_valid: \"\\ user. user \\ user_set \\ valid_user user\" \n using users_are_valid by simp\n\nlemma all_attrs_valid: \"\\ attrs. attrs \\ attrs_set \\ valid_attrs attrs\" \n using atrrs_are_valid by simp\n\ntext\\We define the registration phase using the fixes parameters for the user and government.\\\n\ndefinition reg :: \"'user \\ ('token \\ ('share1, 'share2, 'share3) share_user_record) spmf\" \n where \"reg user = do {\n let (attrs, sens_attrs) = users_attr_creation user;\n enc_attrs \\ reg_enc_sens_attrs sens_attrs;\n (S, \\) \\ reg_govt_shares attrs enc_attrs;\n token \\ reg_govt_token \\ S;\n return_spmf (token, S)}\"\n\nsubsection\\Functional Properties\\\n\nlemma obtain_user_from_attrs:\n fixes attrs\n assumes \"attrs \\ attrs_set\"\n obtains user where \"user \\ user_set\" and \"users_attr_creation user = attrs\"\n using bij_betw_users_attrs[unfolded bij_betw_def] assms\n by auto \n\nlemma obtain_attrs_from_user:\n fixes user\n assumes \"user \\ user_set\"\n obtains attrs where \"attrs \\ attrs_set\" \"users_attr_creation user = attrs\"\n using bij_betw_users_attrs[unfolded bij_betw_def] assms by blast\n\ntext\\We require that that no two users, with different attributes, will yield the same tokens upon registration. This must be a property of the registration phase the attributes.\\\n\ndefinition \"unique_users = (\\ user1 user2. user1 \\ user_set \\ user2 \\ user_set \\ user1 \\ user2 \\ reg user1 \\ reg user2)\"\n\ntext \\The correctness property ensures if the IDentity system is carried out honestly the correct query result is returned.\\\n\ndefinition correct_game :: \"'user \\ ('attrs, 'sens_atrrs, 'result) query \\ bool spmf\"\n where \"correct_game user query = do {\n let attrs = users_attr_creation user;\n (token, enc_user_record) \\ reg user;\n auth_token \\ auth token query;\n b \\ ver auth_token;\n return_spmf (b = query attrs)}\" \n\ndefinition \"correct \\ (\\ user query. valid_user user \\ valid_query query \\ spmf (correct_game user query) True = 1)\"\n\n(*the output given to the adversary should be from after the registration phase, in particular the \nsecond output from the reg phase as this is what the government sees.*)\n\nprimrec sens_attrs_hiding_game :: \"('user, 'state_attr_hid, 'enc_attrs) attr_hiding_adversary \\ bool spmf\"\n where \n \"sens_attrs_hiding_game (\\1, \\2) = TRY do {\n ((user0, user1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user user0 \\ valid_user user1);\n b \\ coin_spmf;\n let (attrsb, sens_attrsb) = users_attr_creation (if b then user0 else user1);\n enc_attrs_b \\ reg_enc_sens_attrs sens_attrsb;\n b' \\ \\2 \\ enc_attrs_b;\n return_spmf (b' = b)} ELSE coin_spmf\"\n\nprimrec sens_attrs_hiding_game' :: \"('user, 'state_attr_hid, 'share1, 'share2, 'share3) attr_hiding_adversary' \\ bool spmf\"\n where \n \"sens_attrs_hiding_game' (\\1, \\2) = TRY do {\n ((user0, user1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user user0 \\ valid_user user1);\n b :: bool \\ coin_spmf;\n (token, S) \\ reg (if b then user0 else user1);\n b' \\ \\2 \\ S;\n return_spmf (b' = b)} ELSE coin_spmf\"\n\ndefinition \"sens_attrs_hiding_advantage \\ = \\spmf (sens_attrs_hiding_game \\) True - 1/2\\\"\n\ndefinition \"sens_attrs_hiding_advantage' \\ = \\spmf (sens_attrs_hiding_game' \\) True - 1/2\\\"\n\ndefinition \"perfect_sens_attrs_hiding \\ \\ sens_attrs_hiding_advantage \\ = 0\"\n\ndefinition \"perfect_sens_attrs_hiding' \\ \\ sens_attrs_hiding_advantage' \\ = 0\"\n\ndefinition \"no_sens_attr \\ (\\ user. snd (users_attr_creation user) = {})\"\n\nlemma \n assumes \"no_sens_attr\"\n shows \"perfect_sens_attrs_hiding \\\"\n including monad_normalisation\nproof-\n note [simp] = Let_def split_def \n have \"\\spmf (sens_attrs_hiding_game \\) True - 1/2\\ = 0\"\n proof-\n obtain \\1 and \\2 where \\ [simp]: \"\\ = (\\1, \\2)\" by(cases \\)\n have \"sens_attrs_hiding_game (\\1, \\2) = TRY do {\n ((user0, user1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user user0 \\ valid_user user1);\n b \\ coin_spmf;\n let (attrsb, sens_attrsb) = users_attr_creation (if b then user0 else user1);\n enc_attrs_b \\ reg_enc_sens_attrs sens_attrsb;\n b' \\ \\2 \\ enc_attrs_b;\n return_spmf (b' = b)} ELSE coin_spmf\"\n by(simp add: sens_attrs_hiding_game_def)\n also have \"... = TRY do {\n ((user0, user1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user user0 \\ valid_user user1);\n b :: bool \\ coin_spmf;\n enc_attrs_b \\ reg_enc_sens_attrs {};\n b' :: bool \\ \\2 \\ enc_attrs_b;\n return_spmf (b' = b)} ELSE coin_spmf\"\n using assms[unfolded no_sens_attr_def] \n by simp\n also have \"... = TRY do {\n ((user0, user1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user user0 \\ valid_user user1);\n enc_attrs_b \\ reg_enc_sens_attrs {};\n b' :: bool \\ \\2 \\ enc_attrs_b;\n map_spmf((=) b') coin_spmf} ELSE coin_spmf\"\n by(simp add: map_spmf_conv_bind_spmf)\n also have \"... = coin_spmf\" \n by(auto simp add: bind_spmf_const map_eq_const_coin_spmf try_bind_spmf_lossless2' scale_bind_spmf weight_spmf_le_1 scale_scale_spmf)\n ultimately show ?thesis \n by(simp add: spmf_of_set)\n qed\n thus ?thesis \n by(simp add: perfect_sens_attrs_hiding_def sens_attrs_hiding_advantage_def)\nqed\n\ndefinition token_hiding_game :: \"('attrs, 'sens_atrrs, 'result) query \\ ('token, 'state, 'auth_token) hiding_adversary \\ bool spmf\"\n where \n \"token_hiding_game query \\ = do {\n let (\\1, \\2) = \\;\n ((token0, token1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_token token0 \\ valid_token token1);\n b \\ coin_spmf;\n auth_token \\ auth (if b then token1 else token0) query;\n b' \\ \\2 \\ auth_token; \n return_spmf (b = b')}\"\n\ndefinition \"token_hiding_advantage query \\ = (\\spmf (token_hiding_game query \\) True - 1/2\\)\"\n\ndefinition \"perfect_hiding \\ \\ (\\ query. valid_query query \\ token_hiding_advantage query \\ = 0)\" \n\ndefinition user_binding_game :: \"'user \\ ('attrs, 'sens_atrrs, 'result) query \\ 'token soundness_adversary \\ bool spmf\"\n where \n \"user_binding_game user query \\ = do {\n (token1, enc_user_record) \\ reg user;\n token2 \\ \\ token1;\n _ :: unit \\ assert_spmf (valid_token token2);\n auth_token1 \\ auth token1 query;\n auth_token2 \\ auth token2 query;\n b :: 'result \\ ver auth_token1;\n b' \\ ver auth_token2;\n return_spmf (b \\ b')}\"\n\ndefinition \"user_binding_advantage user query \\ = \\spmf (user_binding_game user query \\) True\\\"\n\ndefinition \"perfect_soundness \\ \\ (\\ user query. valid_user user \\ valid_query query \\ user_binding_advantage user query \\ = 0)\"\n\nend\n\nlocale identity_ind_cpa_base = enc: ind_cpa key_gen encrypt decrypt valid_plains \n for key_gen :: \"('pk \\ 'sk) spmf\"\n and encrypt :: \"'pk \\ 'sens_atrrs set \\ 'enc_attrs spmf\"\n and decrypt :: \"'sk \\ 'enc_attrs \\ 'sens_atrrs set option\"\n and valid_plains :: \"'sens_atrrs set \\ 'sens_atrrs set \\ bool\"\nbegin\n\ndefinition reg_enc_sens_attrs :: \"'sens_atrrs set \\ 'enc_attrs spmf\"\n where \n \"reg_enc_sens_attrs sens_attrs = do {\n (pk,sk) \\ key_gen;\n encrypt pk sens_attrs}\" \n\nend \n\nlocale id_ind_cpa = identity_ind_cpa_base + \n id_sys: identity_system reg_enc_sens_attrs reg_govt_shares reg_govt_token auth ver valid_user valid_attrs valid_token valid_query user_set attrs_set users_attr_creation\n for reg_govt_shares reg_govt_token auth ver valid_user valid_attrs valid_token valid_query user_set attrs_set users_attr_creation\n + \n assumes valid_user_valid_plains: \"\\ u0 u1. valid_user u0 \\ valid_user u1 \\ valid_plains (snd (users_attr_creation u0)) (snd (users_attr_creation u1))\"\nbegin\n\n\ndefinition sens_hiding_adversary1 :: \"(('m \\ 'm) \\ 'n) spmf \\ 'a \\ (('c set \\ 'c set) \\ 'n) spmf\"\n where \"sens_hiding_adversary1 \\1 pk = do {\n ((u0,u1), \\) \\ \\1;\n _ :: unit \\ assert_spmf (valid_user u0 \\ valid_user u1);\n let sens_set0 = snd (users_attr_creation u0);\n let sens_set1 = snd (users_attr_creation u1);\n return_spmf ((sens_set0, sens_set1), \\)}\"\n\ndefinition sens_hiding_adversary2 :: \"('n \\ 'd \\ bool spmf) \\ 'd \\ 'n \\ bool spmf\"\n where \"sens_hiding_adversary2 \\2 enc \\ = \\2 \\ enc\"\n\nfun sens_hiding_adversary:: \"(('m \\ 'm) \\ 'n) spmf \\ ('n \\ 'd \\ bool spmf) \\ ('a \\ (('c set \\ 'c set) \\ 'n) spmf) \\ ('d \\ 'n \\ bool spmf)\"\n where \"sens_hiding_adversary (\\1, \\2) = (sens_hiding_adversary1 \\1, sens_hiding_adversary2 \\2)\"\n\nlemma if_cases_sens_hiding_attrs:\n shows \"(if b then fst (fst ((snd (users_attr_creation (fst (fst y))), snd (users_attr_creation (snd (fst y)))), snd y))\n else snd (fst ((snd (users_attr_creation (fst (fst y))), snd (users_attr_creation (snd (fst y)))), snd y))) =\n snd (users_attr_creation (if b then fst (fst y) else snd (fst y)))\"\n by(cases b; auto)\ndeclare[[show_types]]\nterm \"enc.advantage\"\nterm \"id_sys.sens_attrs_hiding_advantage\"\nlemma sens_attrs_hiding_reduce_to_ind_cpa:\n shows \"id_sys.sens_attrs_hiding_advantage \\ = enc.advantage (sens_hiding_adversary \\)\"\n unfolding id_sys.reg_def id_sys.sens_attrs_hiding_advantage_def enc.advantage_def enc.ind_cpa_def id_sys.sens_attrs_hiding_game_def reg_enc_sens_attrs_def\n including monad_normalisation\nproof-\n note [simp] = split_def Let_def\n obtain \\1 and \\2 where \\ [simp]: \"\\ = (\\1, \\2)\" by(cases \\)\n have \"id_sys.sens_attrs_hiding_advantage (\\1, \\2) = enc.advantage (sens_hiding_adversary1 \\1, sens_hiding_adversary2 \\2)\"\n proof-\n have \"TRY coin_spmf \\\n (\\b. key_gen \\\n (\\y. \\1 \\\n (\\p. encrypt (fst y) (snd (users_attr_creation (if b then fst (fst p) else snd (fst p)))) \\\n (\\enc_attrs_b.\n \\2 (snd p) enc_attrs_b \\ (\\b'. assert_spmf (valid_user (fst (fst p)) \\ valid_user (snd (fst p))) \n \\ (\\_ :: unit. return_spmf (b' = b))))))) ELSE coin_spmf = \n TRY coin_spmf \\\n (\\b. key_gen \\\n (\\p. \\1 \\\n (\\y. encrypt (fst p) (snd (users_attr_creation (if b then fst (fst y) else snd (fst y)))) \\\n (\\cipher.\n \\2 (snd y) cipher \\\n (\\b'. assert_spmf (valid_user (fst (fst y)) \\ valid_user (snd (fst y))) \\\n (\\ya :: unit. assert_spmf (valid_plains (snd (users_attr_creation (fst (fst y)))) (snd (users_attr_creation (snd (fst y))))) \\\n (\\_ :: unit. return_spmf (b = b')))))))) ELSE coin_spmf\"\n apply(intro try_spmf_cong bind_spmf_cong[OF refl]; clarsimp?)+ using valid_user_valid_plains by force\n thus ?thesis\n unfolding id_sys.sens_attrs_hiding_advantage_def enc.advantage_def id_sys.sens_attrs_hiding_game_def \n enc.ind_cpa_def reg_enc_sens_attrs_def sens_hiding_adversary1_def sens_hiding_adversary2_def\n by(auto simp add: if_cases_sens_hiding_attrs) \n qed\n then show ?thesis by auto\nqed\n\ncorollary perfect_sens_attrs_hiding:\n \"id_sys.perfect_sens_attrs_hiding \\\" if \"enc.advantage (sens_hiding_adversary \\) = 0\"\n unfolding id_sys.perfect_sens_attrs_hiding_def\n by (simp add: sens_attrs_hiding_reduce_to_ind_cpa that)\n\nend\n\n(*To consider token hiding we need to define the token value that is returned to the user in the registration phase as being an encrypted value*)\n\nend", "meta": {"author": "Davetbutler", "repo": "Privacy-ID", "sha": "a9d67b9ef02dea9ae51e5c6de8630666c4d0a148", "save_path": "github-repos/isabelle/Davetbutler-Privacy-ID", "path": "github-repos/isabelle/Davetbutler-Privacy-ID/Privacy-ID-a9d67b9ef02dea9ae51e5c6de8630666c4d0a148/ID_system_formalisation/IDentity.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2930620098766091}} {"text": "section {*FUNCTION\\_\\_DPDA\\_EA\\_OPT\\_\\_DPDA\\_ENFORCE\\_ACCESSIBLE\\_OPT*}\ntheory\n FUNCTION__DPDA_EA_OPT__DPDA_ENFORCE_ACCESSIBLE_OPT\n\nimports\n PRJ_12_08_04__ENTRY\n\nbegin\n\nlemma F_DPDA_EA_OPT__preserves_DPDA: \"\n valid_dpda G\n \\ valid_dpda (F_DPDA_EA_OPT G)\"\n apply(simp add: F_DPDA_EA_OPT_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and E=\"(F_DPDA_DRE G (Suc 0))\" in F_EPDA_RE__SOUND2)\n apply(simp add: F_EPDA_RE__SpecInput2_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and k=\"Suc 0\" in F_DPDA_DRE__SOUND)\n apply(simp add: F_DPDA_DRE__SpecInput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply (metis epdaS_required_edges__vs__epdaH_required_edges valid_dpda_def valid_pda_def)\n apply(simp add: F_EPDA_RE__SpecOutput2_def)\n done\n\nlemma F_DPDA_EA_OPT__preserves_lang: \"\n valid_dpda G\n \\ epdaS.marked_language G = epdaS.marked_language (F_DPDA_EA_OPT G)\"\n apply(simp add: F_DPDA_EA_OPT_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and E=\"(F_DPDA_DRE G (Suc 0))\" in F_EPDA_RE__SOUND2)\n apply(simp add: F_EPDA_RE__SpecInput2_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and k=\"Suc 0\" in F_DPDA_DRE__SOUND)\n apply(simp add: F_DPDA_DRE__SpecInput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply (metis epdaS_required_edges__vs__epdaH_required_edges valid_dpda_def valid_pda_def)\n apply(simp add: F_EPDA_RE__SpecOutput2_def)\n done\n\nlemma F_DPDA_EA_OPT__preserves_unmarked_language: \"\n valid_dpda G\n \\ epdaH.Nonblockingness_branching G\n \\ epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_OPT G)\"\n apply(simp add: F_DPDA_EA_OPT_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and E=\"(F_DPDA_DRE G (Suc 0))\" in F_EPDA_RE__SOUND2)\n apply(simp add: F_EPDA_RE__SpecInput2_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and k=\"Suc 0\" in F_DPDA_DRE__SOUND)\n apply(simp add: F_DPDA_DRE__SpecInput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply (metis epdaS_required_edges__vs__epdaH_required_edges valid_dpda_def valid_pda_def)\n apply(simp add: F_EPDA_RE__SpecOutput2_def)\n apply(force)\n done\n\nlemma F_DPDA_EA_OPT__enforces_accessible: \"\n valid_dpda G\n \\ epdaS.accessible (F_DPDA_EA_OPT G)\"\n apply(simp add: F_DPDA_EA_OPT_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and E=\"(F_DPDA_DRE G (Suc 0))\" in F_EPDA_RE__SOUND2)\n apply(simp add: F_EPDA_RE__SpecInput2_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" and k=\"Suc 0\" in F_DPDA_DRE__SOUND)\n apply(simp add: F_DPDA_DRE__SpecInput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply(simp add: F_DPDA_DRE__SpecOutput_def)\n apply (metis epdaS_required_edges__vs__epdaH_required_edges valid_dpda_def valid_pda_def)\n apply(simp add: F_EPDA_RE__SpecOutput2_def)\n done\n\nlemma F_DPDA_EA_OPT__preserves_epdaH_no_livelocks_from_marking_states: \"\n valid_dpda G\n \\ epdaH_no_livelocks_from_marking_states G\n \\ epdaH_no_livelocks_from_marking_states (F_DPDA_EA_OPT G)\"\n apply(simp add: epdaH_no_livelocks_from_marking_states_def F_DPDA_EA_OPT_def)\n apply(clarsimp)\n apply(rename_tac d n e c)(*strict*)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac d n e c)(*strict*)\n prefer 2\n apply(simp add: F_EPDA_R_def F_EPDA_RE_def F_DPDA_DAE_def Let_def)\n apply(rename_tac d n e c)(*strict*)\n apply(rule epdaH.derivation_initialI)\n apply(rename_tac d n e c)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d n e c ca)(*strict*)\n apply(simp add: get_configuration_def epdaH_initial_configurations_def epdaH.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac d n e c ca)(*strict*)\n apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n apply(rename_tac d n e c ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac d n e c ca)(*strict*)\n apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n apply(rename_tac d n e c ca)(*strict*)\n apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n apply(rename_tac d n e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(thin_tac \"d n = Some (pair (Some e) c)\")\n apply(thin_tac \"case d 0 of None \\ False\n | Some (pair e c) \\\n c \\ epdaH_initial_configurations (F_EPDA_RE G (F_DPDA_DRE G (Suc 0))) \\ e = None\")\n apply(rename_tac d n e c)(*strict*)\n apply(thin_tac \"edge_src e \\ epda_marking (F_EPDA_RE G (F_DPDA_DRE G (Suc 0)))\")\n apply(thin_tac \"edge_event e = None\")\n apply(simp (no_asm) add: epdaH.derivation_def)\n apply(rename_tac d)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(case_tac i)\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d)(*strict*)\n apply(simp add: epdaH.derivation_def)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac d nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"nat\"\n and m=\"Suc nat\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d nat a)(*strict*)\n apply(force)\n apply(rename_tac d nat a)(*strict*)\n apply(force)\n apply(rename_tac d nat a)(*strict*)\n apply(force)\n apply(rename_tac d nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d nat e1 e2 c1 c2 w)(*strict*)\n apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n done\n\ndefinition F_DPDA_EA_OPT__SpecInput :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_EA_OPT__SpecInput G \\\n valid_dpda G\n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n \\ epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EA_OPT__SpecOutput :: \"\n ('p, 'event, 'stack) epda\n \\ ('state, 'event, 'stackx) epda\n \\ bool\"\n where\n \"F_DPDA_EA_OPT__SpecOutput Gi Go \\\n valid_dpda Go\n \\ epdaS.marked_language Gi = epdaS.marked_language Go\n \\ epdaS.unmarked_language Gi = epdaS.unmarked_language Go\n \\ nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n \\ epdaS.accessible Go\n \\ epdaH_no_livelocks_from_marking_states Go\"\n\ntheorem F_DPDA_EA_OPT__SOUND: \"\n F_DPDA_EA_OPT__SpecInput G\n \\ F_DPDA_EA_OPT__SpecOutput G (F_DPDA_EA_OPT G)\"\n apply(simp add: F_DPDA_EA_OPT__SpecInput_def F_DPDA_EA_OPT__SpecOutput_def)\n apply(rule conjI)\n apply (metis F_DPDA_EA_OPT__preserves_DPDA)\n apply(rule context_conjI)\n apply(rule F_DPDA_EA_OPT__preserves_lang)\n apply(force)\n apply(rule context_conjI)\n apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_OPT G)\")\n apply(force)\n apply(rule F_DPDA_EA_OPT__preserves_unmarked_language)\n apply(force)\n apply (metis epdaH_operational_Nonblockingness_from_language_Nonblockingness epda_inter_semantic_relationship valid_dpda_def valid_pda_def)\n apply(rule context_conjI)\n apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_OPT G)\")\n apply(force)\n apply(rule F_DPDA_EA_OPT__preserves_unmarked_language)\n apply(force)\n apply (metis epdaH_operational_Nonblockingness_from_language_Nonblockingness epda_inter_semantic_relationship valid_dpda_def valid_pda_def)\n apply(rule conjI)\n apply(rule F_DPDA_EA_OPT__enforces_accessible)\n apply(force)\n apply(rule F_DPDA_EA_OPT__preserves_epdaH_no_livelocks_from_marking_states)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_EA_OPT__constructs_epda_sub: \"\n valid_epda G\n \\ epda_sub (F_DPDA_EA_OPT G) G\"\n apply(simp add: epda_sub_def F_EPDA_R_def F_DPDA_EA_OPT_def F_EPDA_RE_def Let_def)\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n done\n\ntheorem F_DPDA_EA_OPT__preserves_not_livelock: \"\n valid_epda G\n \\ \\ epdaH_livelock G\n \\ \\ epdaH_livelock (F_DPDA_EA_OPT G)\"\n apply(rule epda_sub_preserves_not_livelock)\n apply(simp add: F_DPDA_EA_OPT_def F_EPDA_RE_def)\n apply(rule F_EPDA_R_preserves_valid_epda)\n apply(force)\n prefer 2\n apply(force)\n apply(force)\n apply(force)\n apply(rule F_DPDA_EA_OPT__constructs_epda_sub)\n apply(force)\n apply(force)\n done\n\nhide_fact F_DPDA_EA_OPT__preserves_DPDA\nhide_fact F_DPDA_EA_OPT__preserves_lang\nhide_fact F_DPDA_EA_OPT__preserves_unmarked_language\nhide_fact F_DPDA_EA_OPT__enforces_accessible\nhide_fact F_DPDA_EA_OPT__preserves_epdaH_no_livelocks_from_marking_states\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_08_04/FUNCTION__DPDA_EA_OPT__DPDA_ENFORCE_ACCESSIBLE_OPT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2930620098766091}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2020\n(C) Copyright Sebastian A. Mödersheim, DTU, 2020\n(C) Copyright Achim D. Brucker, University of Exeter, 2020\n(C) Copyright Anders Schlichtkrull, DTU, 2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Term_Implication.thy\n Author: Andreas Viktor Hess, DTU\n Author: Sebastian A. Mödersheim, DTU\n Author: Achim D. Brucker, University of Exeter\n Author: Anders Schlichtkrull, DTU\n*)\n\nsection\\Term Implication\\\ntheory Term_Implication\n imports Stateful_Protocol_Model Term_Variants\nbegin\n\nsubsection \\Single Term Implications\\\ndefinition timpl_apply_term (\"\\_ --\\ _\\\\_\\\") where\n \"\\a --\\ b\\\\t\\ \\ term_variants ((\\_. [])(Abs a := [Abs b])) t\"\n\ndefinition timpl_apply_terms (\"\\_ --\\ _\\\\_\\\\<^sub>s\\<^sub>e\\<^sub>t\") where\n \"\\a --\\ b\\\\M\\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\((set o timpl_apply_term a b) ` M)\"\n\nlemma timpl_apply_Fun:\n assumes \"\\i. i < length T \\ S ! i \\ set \\a --\\ b\\\\T ! i\\\"\n and \"length T = length S\"\n shows \"Fun f S \\ set \\a --\\ b\\\\Fun f T\\\"\nusing assms term_variants_Fun term_variants_pred_iff_in_term_variants\nby (metis timpl_apply_term_def)\n\nlemma timpl_apply_Abs:\n assumes \"\\i. i < length T \\ S ! i \\ set \\a --\\ b\\\\T ! i\\\"\n and \"length T = length S\"\n shows \"Fun (Abs b) S \\ set \\a --\\ b\\\\Fun (Abs a) T\\\"\nusing assms(1) term_variants_P[OF assms(2), of \"(\\_. [])(Abs a := [Abs b])\" \"Abs b\" \"Abs a\"]\nunfolding timpl_apply_term_def term_variants_pred_iff_in_term_variants[symmetric]\nby fastforce\n\nlemma timpl_apply_refl: \"t \\ set \\a --\\ b\\\\t\\\"\nunfolding timpl_apply_term_def\nby (metis term_variants_pred_refl term_variants_pred_iff_in_term_variants)\n\nlemma timpl_apply_const: \"Fun (Abs b) [] \\ set \\a --\\ b\\\\Fun (Abs a) []\\\"\nusing term_variants_pred_iff_in_term_variants term_variants_pred_const\nunfolding timpl_apply_term_def by auto\n\nlemma timpl_apply_const':\n \"c = a \\ set \\a --\\ b\\\\Fun (Abs c) []\\ = {Fun (Abs b) [], Fun (Abs c) []}\"\n \"c \\ a \\ set \\a --\\ b\\\\Fun (Abs c) []\\ = {Fun (Abs c) []}\"\nusing term_variants_pred_const_cases[of \"(\\_. [])(Abs a := [Abs b])\" \"Abs c\"]\n term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\"]\nunfolding timpl_apply_term_def by auto\n\nlemma timpl_apply_term_subst:\n \"s \\ set \\a --\\ b\\\\t\\ \\ s \\ \\ \\ set \\a --\\ b\\\\t \\ \\\\\"\nby (metis term_variants_pred_iff_in_term_variants term_variants_pred_subst timpl_apply_term_def)\n\nlemma timpl_apply_inv:\n assumes \"Fun h S \\ set \\a --\\ b\\\\Fun f T\\\"\n shows \"length T = length S\"\n and \"\\i. i < length T \\ S ! i \\ set \\a --\\ b\\\\T ! i\\\"\n and \"f \\ h \\ f = Abs a \\ h = Abs b\"\nusing assms term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\"]\nunfolding timpl_apply_term_def\nby (metis (full_types) term_variants_pred_inv(1),\n metis (full_types) term_variants_pred_inv(2),\n fastforce dest: term_variants_pred_inv(3))\n\nlemma timpl_apply_inv':\n assumes \"s \\ set \\a --\\ b\\\\Fun f T\\\"\n shows \"\\g S. s = Fun g S\"\nproof -\n have *: \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) (Fun f T) s\"\n using assms term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\"]\n unfolding timpl_apply_term_def by force\n show ?thesis using term_variants_pred.cases[OF *, of ?thesis] by fastforce\nqed\n\nlemma timpl_apply_term_Var_iff:\n \"Var x \\ set \\a --\\ b\\\\t\\ \\ t = Var x\"\nusing term_variants_pred_inv_Var term_variants_pred_iff_in_term_variants\nunfolding timpl_apply_term_def by metis\n\n\n\nsubsection \\Term Implication Closure\\\ninductive_set timpl_closure for t TI where\n FP: \"t \\ timpl_closure t TI\"\n| TI: \"\\u \\ timpl_closure t TI; (a,b) \\ TI; term_variants_pred ((\\_. [])(Abs a := [Abs b])) u s\\\n \\ s \\ timpl_closure t TI\"\n\ndefinition \"timpl_closure_set M TI \\ (\\t \\ M. timpl_closure t TI)\"\n\ninductive_set timpl_closure'_step for TI where\n \"\\(a,b) \\ TI; term_variants_pred ((\\_. [])(Abs a := [Abs b])) t s\\\n \\ (t,s) \\ timpl_closure'_step TI\"\n\ndefinition \"timpl_closure' TI \\ (timpl_closure'_step TI)\\<^sup>*\"\n\ndefinition comp_timpl_closure where\n \"comp_timpl_closure FP TI \\\n let f = \\X. FP \\ (\\x \\ X. \\(a,b) \\ TI. set \\a --\\ b\\\\x\\)\n in while (\\X. f X \\ X) f {}\"\n\ndefinition comp_timpl_closure_list where\n \"comp_timpl_closure_list FP TI \\\n let f = \\X. remdups (concat (map (\\x. concat (map (\\(a,b). \\a --\\ b\\\\x\\) TI)) X))\n in while (\\X. set (f X) \\ set X) f FP\"\n\nlemma timpl_closure_setI:\n \"t \\ M \\ t \\ timpl_closure_set M TI\"\nunfolding timpl_closure_set_def by (auto intro: timpl_closure.FP)\n\nlemma timpl_closure_set_empty_timpls:\n \"timpl_closure t {} = {t}\" (is \"?A = ?B\")\nproof (intro subset_antisym subsetI)\n fix s show \"s \\ ?A \\ s \\ ?B\"\n by (induct s rule: timpl_closure.induct) auto\nqed (simp add: timpl_closure.FP)\n\nlemmas timpl_closure_set_is_timpl_closure_union = meta_eq_to_obj_eq[OF timpl_closure_set_def]\n\nlemma term_variants_pred_eq_case_Abs:\n fixes a b\n defines \"P \\ (\\_. [])(Abs a := [Abs b])\"\n assumes \"term_variants_pred P t s\" \"\\f \\ funs_term s. \\is_Abs f\"\n shows \"t = s\"\nusing assms(2,3) P_def\nproof (induction P t s rule: term_variants_pred.induct)\n case (term_variants_Fun T S f)\n have \"\\is_Abs h\" when i: \"i < length S\" and h: \"h \\ funs_term (S ! i)\" for i h\n using i h term_variants_Fun.hyps(4) by auto\n hence \"T ! i = S ! i\" when i: \"i < length T\" for i using i term_variants_Fun.hyps(1,3) by auto\n hence \"T = S\" using term_variants_Fun.hyps(1) nth_equalityI[of T S] by fast\n thus ?case using term_variants_Fun.hyps(1) by blast\nqed (simp_all add: term_variants_pred_refl)\n\nlemma timpl_closure'_step_inv:\n assumes \"(t,s) \\ timpl_closure'_step TI\"\n obtains a b where \"(a,b) \\ TI\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) t s\"\nusing assms by (auto elim: timpl_closure'_step.cases)\n\nlemma timpl_closure_mono:\n assumes \"TI \\ TI'\"\n shows \"timpl_closure t TI \\ timpl_closure t TI'\"\nproof\n fix s show \"s \\ timpl_closure t TI \\ s \\ timpl_closure t TI'\"\n apply (induct rule: timpl_closure.induct)\n using assms by (auto intro: timpl_closure.intros)\nqed\n\nlemma timpl_closure_set_mono:\n assumes \"M \\ M'\" \"TI \\ TI'\"\n shows \"timpl_closure_set M TI \\ timpl_closure_set M' TI'\"\nusing assms(1) timpl_closure_mono[OF assms(2)] unfolding timpl_closure_set_def by fast\n\nlemma timpl_closure_idem:\n \"timpl_closure_set (timpl_closure t TI) TI = timpl_closure t TI\" (is \"?A = ?B\")\nproof\n have \"s \\ timpl_closure t TI\"\n when \"s \\ timpl_closure u TI\" \"u \\ timpl_closure t TI\"\n for s u\n using that\n by (induction rule: timpl_closure.induct)\n (auto intro: timpl_closure.intros)\n thus \"?A \\ ?B\" unfolding timpl_closure_set_def by blast\n\n show \"?B \\ ?A\"\n unfolding timpl_closure_set_def\n by (blast intro: timpl_closure.FP)\nqed\n\nlemma timpl_closure_set_idem:\n \"timpl_closure_set (timpl_closure_set M TI) TI = timpl_closure_set M TI\"\nusing timpl_closure_idem[of _ TI]unfolding timpl_closure_set_def by auto\n\nlemma timpl_closure_set_mono_timpl_closure_set:\n assumes N: \"N \\ timpl_closure_set M TI\"\n shows \"timpl_closure_set N TI \\ timpl_closure_set M TI\"\nusing timpl_closure_set_mono[OF N, of TI TI] timpl_closure_set_idem[of M TI]\nby simp\n\nlemma timpl_closure_is_timpl_closure':\n \"s \\ timpl_closure t TI \\ (t,s) \\ timpl_closure' TI\"\nproof\n show \"s \\ timpl_closure t TI \\ (t,s) \\ timpl_closure' TI\"\n unfolding timpl_closure'_def\n by (induct rule: timpl_closure.induct)\n (auto intro: rtrancl_into_rtrancl timpl_closure'_step.intros)\n\n show \"(t,s) \\ timpl_closure' TI \\ s \\ timpl_closure t TI\"\n unfolding timpl_closure'_def\n by (induct rule: rtrancl_induct)\n (auto dest: timpl_closure'_step_inv\n intro: timpl_closure.FP timpl_closure.TI)\nqed\n\nlemma timpl_closure'_mono:\n assumes \"TI \\ TI'\"\n shows \"timpl_closure' TI \\ timpl_closure' TI'\"\nusing timpl_closure_mono[OF assms]\n timpl_closure_is_timpl_closure'[of _ _ TI]\n timpl_closure_is_timpl_closure'[of _ _ TI']\nby fast\n\nlemma timpl_closureton_is_timpl_closure:\n \"timpl_closure_set {t} TI = timpl_closure t TI\"\nby (simp add: timpl_closure_set_is_timpl_closure_union)\n\nlemma timpl_closure'_timpls_trancl_subset:\n \"timpl_closure' (c\\<^sup>+) \\ timpl_closure' c\"\nunfolding timpl_closure'_def\nproof\n fix s t::\"(('a,'b,'c) prot_fun,'d) term\"\n show \"(s,t) \\ (timpl_closure'_step (c\\<^sup>+))\\<^sup>* \\ (s,t) \\ (timpl_closure'_step c)\\<^sup>*\"\n proof (induction rule: rtrancl_induct)\n case (step u t)\n obtain a b where ab:\n \"(a,b) \\ c\\<^sup>+\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u t\"\n using step.hyps(2) timpl_closure'_step_inv by blast\n hence \"(u,t) \\ (timpl_closure'_step c)\\<^sup>*\"\n proof (induction arbitrary: t rule: trancl_induct)\n case (step d e)\n obtain s where s:\n \"term_variants_pred ((\\_. [])(Abs a := [Abs d])) u s\"\n \"term_variants_pred ((\\_. [])(Abs d := [Abs e])) s t\"\n using term_variants_pred_dense'[OF step.prems, of \"Abs d\"] by blast\n\n have \"(u,s) \\ (timpl_closure'_step c)\\<^sup>*\"\n \"(s,t) \\ timpl_closure'_step c\"\n using step.hyps(2) s(2) step.IH[OF s(1)]\n by (auto intro: timpl_closure'_step.intros)\n thus ?case by simp\n qed (auto intro: timpl_closure'_step.intros)\n thus ?case using step.IH by simp\n qed simp\nqed\n\nlemma timpl_closure'_timpls_trancl_subset':\n \"timpl_closure' {(a,b) \\ c\\<^sup>+. a \\ b} \\ timpl_closure' c\"\nusing timpl_closure'_timpls_trancl_subset\n timpl_closure'_mono[of \"{(a,b) \\ c\\<^sup>+. a \\ b}\" \"c\\<^sup>+\"]\nby fast\n\nlemma timpl_closure_set_timpls_trancl_subset:\n \"timpl_closure_set M (c\\<^sup>+) \\ timpl_closure_set M c\"\nusing timpl_closure'_timpls_trancl_subset[of c]\n timpl_closure_is_timpl_closure'[of _ _ c]\n timpl_closure_is_timpl_closure'[of _ _ \"c\\<^sup>+\"]\n timpl_closure_set_is_timpl_closure_union[of M c]\n timpl_closure_set_is_timpl_closure_union[of M \"c\\<^sup>+\"]\nby fastforce\n\nlemma timpl_closure_set_timpls_trancl_subset':\n \"timpl_closure_set M {(a,b) \\ c\\<^sup>+. a \\ b} \\ timpl_closure_set M c\"\nusing timpl_closure'_timpls_trancl_subset'[of c]\n timpl_closure_is_timpl_closure'[of _ _ c]\n timpl_closure_is_timpl_closure'[of _ _ \"{(a,b) \\ c\\<^sup>+. a \\ b}\"]\n timpl_closure_set_is_timpl_closure_union[of M c]\n timpl_closure_set_is_timpl_closure_union[of M \"{(a,b) \\ c\\<^sup>+. a \\ b}\"]\nby fastforce\n\nlemma timpl_closure'_timpls_trancl_supset':\n \"timpl_closure' c \\ timpl_closure' {(a,b) \\ c\\<^sup>+. a \\ b}\"\nunfolding timpl_closure'_def\nproof\n let ?cl = \"{(a,b) \\ c\\<^sup>+. a \\ b}\"\n\n fix s t::\"(('e,'f,'c) prot_fun,'g) term\"\n show \"(s,t) \\ (timpl_closure'_step c)\\<^sup>* \\ (s,t) \\ (timpl_closure'_step ?cl)\\<^sup>*\"\n proof (induction rule: rtrancl_induct)\n case (step u t)\n obtain a b where ab:\n \"(a,b) \\ c\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u t\"\n using step.hyps(2) timpl_closure'_step_inv by blast\n hence \"(a,b) \\ c\\<^sup>+\" by simp\n hence \"(u,t) \\ (timpl_closure'_step ?cl)\\<^sup>*\" using ab(2)\n proof (induction arbitrary: t rule: trancl_induct)\n case (base d) show ?case\n proof (cases \"a = d\")\n case True thus ?thesis\n using base term_variants_pred_refl_inv[of _ u t]\n by force\n next\n case False thus ?thesis\n using base timpl_closure'_step.intros[of a d ?cl]\n by fast\n qed\n next\n case (step d e)\n obtain s where s:\n \"term_variants_pred ((\\_. [])(Abs a := [Abs d])) u s\"\n \"term_variants_pred ((\\_. [])(Abs d := [Abs e])) s t\"\n using term_variants_pred_dense'[OF step.prems, of \"Abs d\"] by blast\n\n show ?case\n proof (cases \"d = e\")\n case True\n thus ?thesis\n using step.prems step.IH[of t]\n by blast\n next\n case False\n hence \"(u,s) \\ (timpl_closure'_step ?cl)\\<^sup>*\"\n \"(s,t) \\ timpl_closure'_step ?cl\"\n using step.hyps(2) s(2) step.IH[OF s(1)]\n by (auto intro: timpl_closure'_step.intros)\n thus ?thesis by simp\n qed\n qed\n thus ?case using step.IH by simp\n qed simp\nqed\n\nlemma timpl_closure'_timpls_trancl_supset:\n \"timpl_closure' c \\ timpl_closure' (c\\<^sup>+)\"\nusing timpl_closure'_timpls_trancl_supset'[of c]\n timpl_closure'_mono[of \"{(a,b) \\ c\\<^sup>+. a \\ b}\" \"c\\<^sup>+\"]\nby fast\n\nlemma timpl_closure'_timpls_trancl_eq:\n \"timpl_closure' (c\\<^sup>+) = timpl_closure' c\"\nusing timpl_closure'_timpls_trancl_subset timpl_closure'_timpls_trancl_supset\nby blast\n\nlemma timpl_closure'_timpls_trancl_eq':\n \"timpl_closure' {(a,b) \\ c\\<^sup>+. a \\ b} = timpl_closure' c\"\nusing timpl_closure'_timpls_trancl_subset' timpl_closure'_timpls_trancl_supset'\nby blast\n\nlemma timpl_closure'_timpls_rtrancl_subset:\n \"timpl_closure' (c\\<^sup>*) \\ timpl_closure' c\"\nunfolding timpl_closure'_def\nproof\n fix s t::\"(('a,'b,'c) prot_fun,'d) term\"\n show \"(s,t) \\ (timpl_closure'_step (c\\<^sup>*))\\<^sup>* \\ (s,t) \\ (timpl_closure'_step c)\\<^sup>*\"\n proof (induction rule: rtrancl_induct)\n case (step u t)\n obtain a b where ab:\n \"(a,b) \\ c\\<^sup>*\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u t\"\n using step.hyps(2) timpl_closure'_step_inv by blast\n hence \"(u,t) \\ (timpl_closure'_step c)\\<^sup>*\"\n proof (induction arbitrary: t rule: rtrancl_induct)\n case base\n hence \"u = t\" using term_variants_pred_refl_inv by fastforce\n thus ?case by simp\n next\n case (step d e)\n obtain s where s:\n \"term_variants_pred ((\\_. [])(Abs a := [Abs d])) u s\"\n \"term_variants_pred ((\\_. [])(Abs d := [Abs e])) s t\"\n using term_variants_pred_dense'[OF step.prems, of \"Abs d\"] by blast\n\n have \"(u,s) \\ (timpl_closure'_step c)\\<^sup>*\"\n \"(s,t) \\ timpl_closure'_step c\"\n using step.hyps(2) s(2) step.IH[OF s(1)]\n by (auto intro: timpl_closure'_step.intros)\n thus ?case by simp\n qed\n thus ?case using step.IH by simp\n qed simp\nqed\n\nlemma timpl_closure'_timpls_rtrancl_supset:\n \"timpl_closure' c \\ timpl_closure' (c\\<^sup>*)\"\nunfolding timpl_closure'_def\nproof\n fix s t::\"(('e,'f,'c) prot_fun,'g) term\"\n show \"(s,t) \\ (timpl_closure'_step c)\\<^sup>* \\ (s,t) \\ (timpl_closure'_step (c\\<^sup>*))\\<^sup>*\"\n proof (induction rule: rtrancl_induct)\n case (step u t)\n obtain a b where ab:\n \"(a,b) \\ c\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u t\"\n using step.hyps(2) timpl_closure'_step_inv by blast\n hence \"(a,b) \\ c\\<^sup>*\" by simp\n hence \"(u,t) \\ (timpl_closure'_step (c\\<^sup>*))\\<^sup>*\" using ab(2)\n proof (induction arbitrary: t rule: rtrancl_induct)\n case (base t) thus ?case using term_variants_pred_refl_inv[of _ u t] by fastforce\n next\n case (step d e)\n obtain s where s:\n \"term_variants_pred ((\\_. [])(Abs a := [Abs d])) u s\"\n \"term_variants_pred ((\\_. [])(Abs d := [Abs e])) s t\"\n using term_variants_pred_dense'[OF step.prems, of \"Abs d\"] by blast\n\n show ?case\n proof (cases \"d = e\")\n case True\n thus ?thesis\n using step.prems step.IH[of t]\n by blast\n next\n case False\n hence \"(u,s) \\ (timpl_closure'_step (c\\<^sup>*))\\<^sup>*\"\n \"(s,t) \\ timpl_closure'_step (c\\<^sup>*)\"\n using step.hyps(2) s(2) step.IH[OF s(1)]\n by (auto intro: timpl_closure'_step.intros)\n thus ?thesis by simp\n qed\n qed\n thus ?case using step.IH by simp\n qed simp\nqed\n\nlemma timpl_closure'_timpls_rtrancl_eq:\n \"timpl_closure' (c\\<^sup>*) = timpl_closure' c\"\nusing timpl_closure'_timpls_rtrancl_subset timpl_closure'_timpls_rtrancl_supset\nby blast\n\nlemma timpl_closure_timpls_trancl_eq:\n \"timpl_closure t (c\\<^sup>+) = timpl_closure t c\"\nusing timpl_closure'_timpls_trancl_eq[of c]\n timpl_closure_is_timpl_closure'[of _ _ c]\n timpl_closure_is_timpl_closure'[of _ _ \"c\\<^sup>+\"]\nby fastforce\n\n\n\nlemma timpl_closure_set_timpls_trancl_eq':\n \"timpl_closure_set M {(a,b) \\ c\\<^sup>+. a \\ b} = timpl_closure_set M c\"\nusing timpl_closure'_timpls_trancl_eq'[of c]\n timpl_closure_is_timpl_closure'[of _ _ c]\n timpl_closure_is_timpl_closure'[of _ _ \"{(a,b) \\ c\\<^sup>+. a \\ b}\"]\n timpl_closure_set_is_timpl_closure_union[of M c]\n timpl_closure_set_is_timpl_closure_union[of M \"{(a,b) \\ c\\<^sup>+. a \\ b}\"]\nby fastforce\n\nlemma timpl_closure_Var_in_iff:\n \"Var x \\ timpl_closure t TI \\ t = Var x\" (is \"?A \\ ?B\")\nproof\n have \"s \\ timpl_closure t TI \\ s = Var x \\ s = t\" for s\n apply (induction rule: timpl_closure.induct)\n by (simp, metis term_variants_pred_inv_Var(2))\n thus \"?A \\ ?B\" by blast\nqed (blast intro: timpl_closure.FP)\n\nlemma timpl_closure_set_Var_in_iff:\n \"Var x \\ timpl_closure_set M TI \\ Var x \\ M\"\nunfolding timpl_closure_set_def by (simp add: timpl_closure_Var_in_iff[of x _ TI]) \n\nlemma timpl_closure_Var_inv:\n assumes \"t \\ timpl_closure (Var x) TI\"\n shows \"t = Var x\"\nusing assms\nproof (induction rule: timpl_closure.induct)\n case (TI u a b s) thus ?case using term_variants_pred_inv_Var by fast\nqed simp\n\nlemma timpls_Un_mono: \"mono (\\X. FP \\ (\\x \\ X. \\(a,b) \\ TI. set \\a --\\ b\\\\x\\))\"\nby (auto intro!: monoI)\n\nlemma timpl_closure_set_lfp:\n fixes M TI\n defines \"f \\ \\X. M \\ (\\x \\ X. \\(a,b) \\ TI. set \\a --\\ b\\\\x\\)\"\n shows \"lfp f = timpl_closure_set M TI\"\nproof\n note 0 = timpls_Un_mono[of M TI, unfolded f_def[symmetric]]\n\n let ?N = \"timpl_closure_set M TI\"\n\n show \"lfp f \\ ?N\"\n proof (induction rule: lfp_induct)\n case 2 thus ?case\n proof\n fix t assume \"t \\ f (lfp f \\ ?N)\"\n hence \"t \\ M \\ t \\ (\\x \\ ?N. \\(a,b) \\ TI. set \\a --\\ b\\\\x\\)\" (is \"?A \\ ?B\")\n unfolding f_def by blast\n thus \"t \\ ?N\"\n proof\n assume ?B\n then obtain s a b where s: \"s \\ ?N\" \"(a,b) \\ TI\" \"t \\ set \\a --\\ b\\\\s\\\" by moura\n thus ?thesis \n using term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\" s]\n unfolding timpl_closure_set_def timpl_apply_term_def\n by (auto intro: timpl_closure.intros)\n qed (auto simp add: timpl_closure_set_def intro: timpl_closure.intros)\n qed\n qed (rule 0)\n\n have \"t \\ lfp f\" when t: \"t \\ timpl_closure s TI\" and s: \"s \\ M\" for t s\n using t\n proof (induction t rule: timpl_closure.induct)\n case (TI u a b v) thus ?case \n using term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\"]\n lfp_fixpoint[OF 0]\n unfolding timpl_apply_term_def f_def by fastforce\n qed (use s lfp_fixpoint[OF 0] f_def in blast)\n thus \"?N \\ lfp f\" unfolding timpl_closure_set_def by blast\nqed\n\nlemma timpl_closure_set_supset:\n assumes \"\\t \\ FP. t \\ closure\"\n and \"\\t \\ closure. \\(a,b) \\ TI. \\s \\ set \\a --\\ b\\\\t\\. s \\ closure\"\n shows \"timpl_closure_set FP TI \\ closure\"\nproof -\n have \"t \\ closure\" when t: \"t \\ timpl_closure s TI\" and s: \"s \\ FP\" for t s\n using t\n proof (induction rule: timpl_closure.induct)\n case FP thus ?case using s assms(1) by blast\n next\n case (TI u a b s') thus ?case\n using assms(2) term_variants_pred_iff_in_term_variants[of \"(\\_. [])(Abs a := [Abs b])\"]\n unfolding timpl_apply_term_def by fastforce\n qed\n thus ?thesis unfolding timpl_closure_set_def by blast\nqed\n\nlemma timpl_closure_set_supset':\n assumes \"\\t \\ FP. \\(a,b) \\ TI. \\s \\ set \\a --\\ b\\\\t\\. s \\ FP\"\n shows \"timpl_closure_set FP TI \\ FP\"\nusing timpl_closure_set_supset[OF _ assms] by blast\n\nlemma timpl_closure'_param:\n assumes \"(t,s) \\ timpl_closure' c\"\n and fg: \"f = g \\ (\\a b. (a,b) \\ c \\ f = Abs a \\ g = Abs b)\"\n shows \"(Fun f (S@t#T), Fun g (S@s#T)) \\ timpl_closure' c\"\nusing assms(1) unfolding timpl_closure'_def\nproof (induction rule: rtrancl_induct)\n case base thus ?case\n proof (cases \"f = g\")\n case False\n then obtain a b where ab: \"(a,b) \\ c\" \"f = Abs a\" \"g = Abs b\"\n using fg by moura\n show ?thesis\n using term_variants_pred_param[OF term_variants_pred_refl[of \"(\\_. [])(Abs a := [Abs b])\" t]]\n timpl_closure'_step.intros[OF ab(1)] ab(2,3)\n by fastforce\n qed simp\nnext\n case (step u s)\n obtain a b where ab: \"(a,b) \\ c\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u s\"\n using timpl_closure'_step_inv[OF step.hyps(2)] by blast\n have \"(Fun g (S@u#T), Fun g (S@s#T)) \\ timpl_closure'_step c\"\n using ab(1) term_variants_pred_param[OF ab(2), of g g S T]\n by (auto simp add: timpl_closure'_def intro: timpl_closure'_step.intros)\n thus ?case using rtrancl_into_rtrancl[OF step.IH] fg by blast\nqed\n\nlemma timpl_closure'_param':\n assumes \"(t,s) \\ timpl_closure' c\"\n shows \"(Fun f (S@t#T), Fun f (S@s#T)) \\ timpl_closure' c\"\nusing timpl_closure'_param[OF assms] by simp\n\nlemma timpl_closure_FunI:\n assumes IH: \"\\i. i < length T \\ (T ! i, S ! i) \\ timpl_closure' c\"\n and len: \"length T = length S\"\n and fg: \"f = g \\ (\\a b. (a,b) \\ c\\<^sup>+ \\ f = Abs a \\ g = Abs b)\"\n shows \"(Fun f T, Fun g S) \\ timpl_closure' c\"\nproof -\n have aux: \"(Fun f T, Fun g (take n S@drop n T)) \\ timpl_closure' c\"\n when \"n \\ length T\" for n\n using that\n proof (induction n)\n case 0\n have \"(T ! n, T ! n) \\ timpl_closure' c\" when n: \"n < length T\" for n\n using n unfolding timpl_closure'_def by simp\n hence \"(Fun f T, Fun g T) \\ timpl_closure' c\"\n proof (cases \"f = g\")\n case False\n then obtain a b where ab: \"(a, b) \\ c\\<^sup>+\" \"f = Abs a\" \"g = Abs b\"\n using fg by moura\n show ?thesis\n using timpl_closure'_step.intros[OF ab(1), of \"Fun f T\" \"Fun g T\"] ab(2,3)\n term_variants_P[OF _ term_variants_pred_refl[of \"(\\_. [])(Abs a := [Abs b])\"],\n of T g f]\n timpl_closure'_timpls_trancl_eq\n unfolding timpl_closure'_def\n by (metis fun_upd_same list.set_intros(1) r_into_rtrancl)\n qed (simp add: timpl_closure'_def)\n thus ?case by simp\n next\n case (Suc n)\n hence IH': \"(Fun f T, Fun g (take n S@drop n T)) \\ timpl_closure' c\"\n and n: \"n < length T\" \"n < length S\"\n by (simp_all add: len)\n\n obtain T1 T2 where T: \"T = T1@T ! n#T2\" \"length T1 = n\"\n using length_prefix_ex'[OF n(1)] by auto\n\n obtain S1 S2 where S: \"S = S1@S ! n#S2\" \"length S1 = n\"\n using length_prefix_ex'[OF n(2)] by auto\n\n have \"take n S@drop n T = S1@T ! n#T2\" \"take (Suc n) S@drop (Suc n) T = S1@S ! n#T2\"\n using n T S append_eq_conv_conj\n by (metis, metis (no_types, opaque_lifting) Cons_nth_drop_Suc append.assoc append_Cons\n append_Nil take_Suc_conv_app_nth) \n moreover have \"(T ! n, S ! n) \\ timpl_closure' c\" using IH Suc.prems by simp\n ultimately show ?case\n using timpl_closure'_param IH'(1)\n by (metis (no_types, lifting) timpl_closure'_def rtrancl_trans)\n qed\n\n show ?thesis using aux[of \"length T\"] len by simp\nqed\n\nlemma timpl_closure_FunI':\n assumes IH: \"\\i. i < length T \\ (T ! i, S ! i) \\ timpl_closure' c\"\n and len: \"length T = length S\"\n shows \"(Fun f T, Fun f S) \\ timpl_closure' c\"\nusing timpl_closure_FunI[OF IH len] by simp\n\nlemma timpl_closure_FunI2:\n fixes f g::\"('a, 'b, 'c) prot_fun\"\n assumes IH: \"\\i. i < length T \\ \\u. (T!i, u) \\ timpl_closure' c \\ (S!i, u) \\ timpl_closure' c\"\n and len: \"length T = length S\"\n and fg: \"f = g \\ (\\a b d. (a, d) \\ c\\<^sup>+ \\ (b, d) \\ c\\<^sup>+ \\ f = Abs a \\ g = Abs b)\"\n shows \"\\h U. (Fun f T, Fun h U) \\ timpl_closure' c \\ (Fun g S, Fun h U) \\ timpl_closure' c\"\nproof -\n let ?P = \"\\i u. (T ! i, u) \\ timpl_closure' c \\ (S ! i, u) \\ timpl_closure' c\"\n\n define U where \"U \\ map (\\i. SOME u. ?P i u) [0.. timpl_closure' c \\ (S ! i, U ! i) \\ timpl_closure' c\"\n when i: \"i < length U\" for i\n using i someI_ex[of \"?P i\"] IH[of i] U1 len\n unfolding U_def by simp\n\n show ?thesis\n proof (cases \"f = g\")\n case False\n then obtain a b d where abd: \"(a, d) \\ c\\<^sup>+\" \"(b, d) \\ c\\<^sup>+\" \"f = Abs a\" \"g = Abs b\"\n using fg by moura\n\n define h::\"('a, 'b, 'c) prot_fun\" where \"h = Abs d\"\n\n have \"f = h \\ (\\a b. (a, b) \\ c\\<^sup>+ \\ f = Abs a \\ h = Abs b)\"\n \"g = h \\ (\\a b. (a, b) \\ c\\<^sup>+ \\ g = Abs a \\ h = Abs b)\"\n using abd unfolding h_def by blast+\n thus ?thesis by (metis timpl_closure_FunI len U1 U2)\n qed (metis timpl_closure_FunI' len U1 U2)\nqed\n\nlemma timpl_closure_FunI3:\n fixes f g::\"('a, 'b, 'c) prot_fun\"\n assumes IH: \"\\i. i < length T \\ \\u. (T!i, u) \\ timpl_closure' c \\ (S!i, u) \\ timpl_closure' c\"\n and len: \"length T = length S\"\n and fg: \"f = g \\ (\\a b d. (a, d) \\ c \\ (b, d) \\ c \\ f = Abs a \\ g = Abs b)\"\n shows \"\\h U. (Fun f T, Fun h U) \\ timpl_closure' c \\ (Fun g S, Fun h U) \\ timpl_closure' c\"\nusing timpl_closure_FunI2[OF IH len] fg unfolding timpl_closure'_timpls_trancl_eq by blast\n\n\n\nlemma (in stateful_protocol_model) timpl_closure_subst:\n assumes t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\x \\ fv t. \\a. \\\\<^sub>v x = TAtom (Atom a)\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"timpl_closure (t \\ \\) T = timpl_closure t T \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof\n have \"s \\ timpl_closure t T \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n when \"s \\ timpl_closure (t \\ \\) T\" for s\n using that\n proof (induction s rule: timpl_closure.induct)\n case FP thus ?case using timpl_closure.FP[of t T] by simp\n next\n case (TI u a b s)\n then obtain u' where u': \"u' \\ timpl_closure t T\" \"u = u' \\ \\\" by moura\n \n have u'_fv: \"\\x \\ fv u'. \\a. \\\\<^sub>v x = TAtom (Atom a)\"\n using timpl_closure_fv_eq[OF u'(1)] t(2) by simp\n hence u_fv: \"\\x \\ fv u. \\a. \\\\<^sub>v x = TAtom (Atom a)\"\n using u'(2) wt_subst_trm''[OF \\(1)] wt_subst_const_fv_type_eq[OF _ \\(1,2), of u']\n by fastforce\n\n have \"\\x \\ fv u' \\ fv s. (\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ Abs a \\ f)\"\n proof (intro ballI)\n fix x assume x: \"x \\ fv u' \\ fv s\"\n then obtain c where c: \"\\\\<^sub>v x = TAtom (Atom c)\"\n using u'_fv u_fv term_variants_pred_fv_eq[OF TI.hyps(3)]\n by blast\n\n show \"(\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ Abs a \\ f)\"\n proof (cases \"\\ x\")\n case (Fun f T)\n hence **: \"\\ (Fun f T) = TAtom (Atom c)\" and \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n using c wt_subst_trm''[OF \\(1), of \"Var x\"] \\(2)\n by fastforce+\n hence \"\\ x = Fun f []\" using Fun const_type_inv_wf by metis\n thus ?thesis using ** by force\n qed metis\n qed\n hence *: \"\\x \\ fv u' \\ fv s.\n (\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ ((\\_. [])(Abs a := [Abs b])) f = [])\"\n by fastforce\n\n obtain s' where s': \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) u' s'\" \"s = s' \\ \\\"\n using term_variants_pred_subst'[OF _ *] u'(2) TI.hyps(3)\n by blast\n\n show ?case using timpl_closure.TI[OF u'(1) TI.hyps(2) s'(1)] s'(2) by blast\n qed\n thus \"timpl_closure (t \\ \\) T \\ timpl_closure t T \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by fast\n\n have \"s \\ timpl_closure (t \\ \\) T\"\n when s: \"s \\ timpl_closure t T \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" for s\n proof -\n obtain s' where s': \"s' \\ timpl_closure t T\" \"s = s' \\ \\\" using s by moura\n have \"s' \\ \\ \\ timpl_closure (t \\ \\) T\" using s'(1)\n proof (induction s' rule: timpl_closure.induct)\n case FP thus ?case using timpl_closure.FP[of \"t \\ \\\" T] by simp\n next\n case (TI u' a b s') show ?case\n using timpl_closure.TI[OF TI.IH TI.hyps(2)]\n term_variants_pred_subst[OF TI.hyps(3)]\n by blast\n qed\n thus ?thesis using s'(2) by metis\n qed\n thus \"timpl_closure t T \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ timpl_closure (t \\ \\) T\" by fast\nqed\n\nlemma (in stateful_protocol_model) timpl_closure_subst_subset:\n assumes t: \"t \\ M\"\n and M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\" \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. \\a. \\\\<^sub>v x = TAtom (Atom a)\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"ground (subst_range \\)\" \"subst_domain \\ \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M\"\n and M_supset: \"timpl_closure t T \\ M\"\n shows \"timpl_closure (t \\ \\) T \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof -\n have t': \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\x \\ fv t. \\a. \\\\<^sub>v x = TAtom (Atom a)\" using t M by auto\n show ?thesis using timpl_closure_subst[OF t' \\(1,2), of T] M_supset by blast\nqed\n\nlemma (in stateful_protocol_model) timpl_closure_set_subst_subset:\n assumes M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\" \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. \\a. \\\\<^sub>v x = TAtom (Atom a)\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"ground (subst_range \\)\" \"subst_domain \\ \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M\"\n and M_supset: \"timpl_closure_set M T \\ M\"\n shows \"timpl_closure_set (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\) T \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing timpl_closure_subst_subset[OF _ M \\, of _ T] M_supset\n timpl_closure_set_is_timpl_closure_union[of \"M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" T]\n timpl_closure_set_is_timpl_closure_union[of M T]\nby auto\n\nlemma timpl_closure_set_Union:\n \"timpl_closure_set (\\Ms) T = (\\M \\ Ms. timpl_closure_set M T)\"\nusing timpl_closure_set_is_timpl_closure_union[of \"\\Ms\" T]\n timpl_closure_set_is_timpl_closure_union[of _ T]\nby force\n\nlemma timpl_closure_set_Union_subst_set:\n assumes \"s \\ timpl_closure_set (\\{M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ | \\. P \\}) T\"\n shows \"\\\\. P \\ \\ s \\ timpl_closure_set (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\) T\"\nusing assms timpl_closure_set_is_timpl_closure_union[of \"(\\{M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ | \\. P \\})\" T]\n timpl_closure_set_is_timpl_closure_union[of _ T]\nby blast\n\nlemma timpl_closure_set_Union_subst_singleton:\n assumes \"s \\ timpl_closure_set {t \\ \\ | \\. P \\} T\"\n shows \"\\\\. P \\ \\ s \\ timpl_closure_set {t \\ \\} T\"\nusing assms timpl_closure_set_is_timpl_closure_union[of \"{t \\ \\ |\\. P \\}\" T]\n timpl_closureton_is_timpl_closure[of _ T]\nby fast\n\n\n\nlemma timpl_closure'_inv':\n assumes \"(s, t) \\ timpl_closure' TI\"\n shows \"(\\x. s = Var x \\ t = Var x) \\\n (\\f g S T. s = Fun f S \\ t = Fun g T \\ length S = length T \\\n (\\i < length T. (S ! i, T ! i) \\ timpl_closure' TI) \\\n (f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ TI\\<^sup>+))\"\n (is \"?A s t \\ ?B s t (timpl_closure' TI)\")\nusing assms unfolding timpl_closure'_def\nproof (induction rule: rtrancl_induct)\n case base thus ?case by (cases s) auto\nnext\n case (step t u)\n obtain a b where ab: \"(a, b) \\ TI\" \"term_variants_pred ((\\_. [])(Abs a := [Abs b])) t u\"\n using timpl_closure'_step_inv[OF step.hyps(2)] by blast\n show ?case using step.IH\n proof\n assume \"?A s t\"\n thus ?case using step.hyps(2) term_variants_pred_inv_Var ab by fastforce\n next\n assume \"?B s t ((timpl_closure'_step TI)\\<^sup>*)\"\n then obtain f g S T where st:\n \"s = Fun f S\" \"t = Fun g T\" \"length S = length T\"\n \"\\i. i < length T \\ (S ! i, T ! i) \\ (timpl_closure'_step TI)\\<^sup>*\"\n \"f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ TI\\<^sup>+\"\n by moura\n obtain h U where u:\n \"u = Fun h U\" \"length T = length U\"\n \"\\i. i < length T \\ term_variants_pred ((\\_. [])(Abs a := [Abs b])) (T ! i) (U ! i)\"\n \"g \\ h \\ is_Abs g \\ is_Abs h \\ (the_Abs g, the_Abs h) \\ TI\\<^sup>+\"\n using ab(2) st(2) r_into_trancl[OF ab(1)]\n term_variants_pred_inv'(1,2,3,4)[of \"(\\_. [])(Abs a := [Abs b])\" g T u]\n term_variants_pred_inv'(5)[of \"(\\_. [])(Abs a := [Abs b])\" g T u \"Abs a\" \"Abs b\"]\n unfolding is_Abs_def the_Abs_def by force\n\n have \"(S ! i, U ! i) \\ (timpl_closure'_step TI)\\<^sup>*\" when i: \"i < length U\" for i\n using u(2) i rtrancl.rtrancl_into_rtrancl[OF\n st(4)[of i] timpl_closure'_step.intros[OF ab(1) u(3)[of i]]]\n by argo\n moreover have \"length S = length U\" using st u by argo\n moreover have \"is_Abs f \\ is_Abs h \\ (the_Abs f, the_Abs h) \\ TI\\<^sup>+\" when fh: \"f \\ h\"\n using fh st u by fastforce\n ultimately show ?case using st(1) u(1) by blast\n qed\nqed\n\nlemma timpl_closure'_inv'':\n assumes \"(Fun f S, Fun g T) \\ timpl_closure' TI\"\n shows \"length S = length T\"\n and \"\\i. i < length T \\ (S ! i, T ! i) \\ timpl_closure' TI\"\n and \"f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ TI\\<^sup>+\"\nusing assms timpl_closure'_inv' by auto\n\nlemma timpl_closure_Fun_inv:\n assumes \"s \\ timpl_closure (Fun f T) TI\"\n shows \"\\g S. s = Fun g S\"\nusing assms timpl_closure_is_timpl_closure' timpl_closure'_inv\nby fastforce\n\nlemma timpl_closure_Fun_inv':\n assumes \"Fun g S \\ timpl_closure (Fun f T) TI\"\n shows \"length S = length T\"\n and \"\\i. i < length S \\ S ! i \\ timpl_closure (T ! i) TI\"\n and \"f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ TI\\<^sup>+\"\nusing assms timpl_closure_is_timpl_closure'\nby (metis timpl_closure'_inv''(1), metis timpl_closure'_inv''(2), metis timpl_closure'_inv''(3))\n\nlemma timpl_closure_Fun_not_Var[simp]:\n \"Fun f T \\ timpl_closure (Var x) TI\"\nusing timpl_closure_Var_inv by fast\n\nlemma timpl_closure_Var_not_Fun[simp]:\n \"Var x \\ timpl_closure (Fun f T) TI\"\nusing timpl_closure_Fun_inv by fast\n\nlemma (in stateful_protocol_model) timpl_closure_wf_trms:\n assumes m: \"wf\\<^sub>t\\<^sub>r\\<^sub>m m\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (timpl_closure m TI)\"\nproof\n fix t assume \"t \\ timpl_closure m TI\"\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n proof (induction t rule: timpl_closure.induct)\n case TI thus ?case using term_variants_pred_wf_trms by force\n qed (rule m)\nqed\n\nlemma (in stateful_protocol_model) timpl_closure_set_wf_trms:\n assumes M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (timpl_closure_set M TI)\"\nproof\n fix t assume \"t \\ timpl_closure_set M TI\"\n then obtain m where \"t \\ timpl_closure m TI\" \"m \\ M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m m\"\n using M timpl_closure_set_is_timpl_closure_union by blast\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using timpl_closure_wf_trms by blast\nqed\n\n\n\n show ?case\n using term_variants_pred_inv'(1,2,4)[OF *] U\n by force\nqed simp\n\nlemma timpl_closure_Fu_inv':\n assumes \"Fun (Fu f) T \\ timpl_closure t TI\"\n shows \"\\S. length S = length T \\ t = Fun (Fu f) S\"\nusing assms\nproof (induction \"Fun (Fu f) T\" arbitrary: T rule: timpl_closure.induct)\n case (TI u a b)\n obtain g U where U:\n \"u = Fun g U\" \"length U = length T\"\n \"Fu f \\ g \\ Abs a = g \\ Fu f = Abs b\"\n using term_variants_pred_inv''[OF TI.hyps(4)] by fastforce\n\n have g: \"g = Fu f\" using U(3) by blast\n \n show ?case using TI.hyps(2)[OF U(1)[unfolded g]] U(2) by auto\nqed simp\n\nlemma timpl_closure_no_Abs_eq:\n assumes \"t \\ timpl_closure s TI\"\n and \"\\f \\ funs_term t. \\is_Abs f\"\n shows \"t = s\"\nusing assms\nproof (induction t rule: timpl_closure.induct)\n case (TI t a b s) thus ?case\n using term_variants_pred_eq_case_Abs[of a b t s]\n unfolding timpl_apply_term_def term_variants_pred_iff_in_term_variants[symmetric]\n by metis\nqed simp\n\nlemma timpl_closure_set_no_Abs_in_set:\n assumes \"t \\ timpl_closure_set FP TI\"\n and \"\\f \\ funs_term t. \\is_Abs f\"\n shows \"t \\ FP\"\nusing assms timpl_closure_no_Abs_eq unfolding timpl_closure_set_def by blast\n\nlemma timpl_closure_funs_term_subset:\n \"\\(funs_term ` (timpl_closure t TI)) \\ funs_term t \\ Abs ` snd ` TI\"\n (is \"?A \\ ?B \\ ?C\")\nproof\n fix f assume \"f \\ ?A\"\n then obtain s where \"s \\ timpl_closure t TI\" \"f \\ funs_term s\" by moura\n thus \"f \\ ?B \\ ?C\"\n proof (induction s rule: timpl_closure.induct)\n case (TI u a b s)\n have \"Abs b \\ Abs ` snd ` TI\" using TI.hyps(2) by force\n thus ?case using term_variants_pred_funs_term[OF TI.hyps(3) TI.prems] TI.IH by force\n qed blast\nqed\n\nlemma timpl_closure_set_funs_term_subset:\n \"\\(funs_term ` (timpl_closure_set FP TI)) \\ \\(funs_term ` FP) \\ Abs ` snd ` TI\"\nusing timpl_closure_funs_term_subset[of _ TI]\n timpl_closure_set_is_timpl_closure_union[of FP TI]\nby auto\n\nlemma funs_term_OCC_TI_subset:\n defines \"absc \\ \\a. Fun (Abs a) []\"\n assumes OCC1: \"\\t \\ FP. \\f \\ funs_term t. is_Abs f \\ f \\ Abs ` OCC\"\n and OCC2: \"snd ` TI \\ OCC\"\n shows \"\\t \\ timpl_closure_set FP TI. \\f \\ funs_term t. is_Abs f \\ f \\ Abs ` OCC\" (is ?A)\n and \"\\t \\ absc ` OCC. \\(a,b) \\ TI. \\s \\ set \\a --\\ b\\\\t\\. s \\ absc ` OCC\" (is ?B)\nproof -\n let ?F = \"\\(funs_term ` FP)\"\n let ?G = \"Abs ` snd ` TI\"\n\n show ?A\n proof (intro ballI impI)\n fix t f assume t: \"t \\ timpl_closure_set FP TI\" and f: \"f \\ funs_term t\" \"is_Abs f\"\n hence \"f \\ ?F \\ f \\ ?G\" using timpl_closure_set_funs_term_subset[of FP TI] by auto\n thus \"f \\ Abs ` OCC\"\n proof\n assume \"f \\ ?F\" thus ?thesis using OCC1 f(2) by fast\n next\n assume \"f \\ ?G\" thus ?thesis using OCC2 by auto\n qed\n qed\n\n { fix s t a b\n assume t: \"t \\ absc ` OCC\"\n and ab: \"(a, b) \\ TI\"\n and s: \"s \\ set \\a --\\ b\\\\t\\\"\n obtain c where c: \"t = absc c\" \"c \\ OCC\" using t by moura\n hence \"s = absc b \\ s = absc c\"\n using ab s timpl_apply_const'[of c a b] unfolding absc_def by auto\n moreover have \"b \\ OCC\" using ab OCC2 by auto\n ultimately have \"s \\ absc ` OCC\" using c(2) by blast\n } thus ?B by blast\nqed\n\nlemma (in stateful_protocol_model) intruder_synth_timpl_closure_set:\n fixes M::\"('fun,'atom,'sets) prot_terms\" and t::\"('fun,'atom,'sets) prot_term\"\n assumes \"M \\\\<^sub>c t\"\n and \"s \\ timpl_closure t TI\"\n shows \"timpl_closure_set M TI \\\\<^sub>c s\"\nusing assms\nproof (induction t arbitrary: s rule: intruder_synth_induct)\n case (AxiomC t)\n hence \"s \\ timpl_closure_set M TI\"\n using timpl_closure_set_is_timpl_closure_union[of M TI]\n by blast\n thus ?case by simp\nnext\n case (ComposeC T f)\n obtain g S where s: \"s = Fun g S\"\n using timpl_closure_Fun_inv[OF ComposeC.prems] by moura\n hence s':\n \"f = g\" \"length S = length T\"\n \"\\i. i < length S \\ S ! i \\ timpl_closure (T ! i) TI\"\n using timpl_closure_Fun_inv'[of g S f T TI] ComposeC.prems ComposeC.hyps(2)\n unfolding is_Abs_def by fastforce+\n \n have \"timpl_closure_set M TI \\\\<^sub>c u\" when u: \"u \\ set S\" for u\n using ComposeC.IH u s'(2,3) in_set_conv_nth[of _ T] in_set_conv_nth[of u S] by auto\n thus ?case\n using s s'(1,2) ComposeC.hyps(1,2) intruder_synth.ComposeC[of S g \"timpl_closure_set M TI\"]\n by argo\nqed\n\nlemma (in stateful_protocol_model) intruder_synth_timpl_closure':\n fixes M::\"('fun,'atom,'sets) prot_terms\" and t::\"('fun,'atom,'sets) prot_term\"\n assumes \"timpl_closure_set M TI \\\\<^sub>c t\"\n and \"s \\ timpl_closure t TI\"\n shows \"timpl_closure_set M TI \\\\<^sub>c s\"\nby (metis intruder_synth_timpl_closure_set[OF assms] timpl_closure_set_idem)\n\n\n\n\nsubsection \\Composition-only Intruder Deduction Modulo Term Implication Closure of the Intruder Knowledge\\\ncontext stateful_protocol_model\nbegin\n\nfun in_trancl where\n \"in_trancl TI a b = (\n if (a,b) \\ set TI then True\n else list_ex (\\(c,d). c = a \\ in_trancl (removeAll (c,d) TI) d b) TI)\"\n\ndefinition in_rtrancl where\n \"in_rtrancl TI a b \\ a = b \\ in_trancl TI a b\"\n\ndeclare in_trancl.simps[simp del]\n\nfun timpls_transformable_to where\n \"timpls_transformable_to TI (Var x) (Var y) = (x = y)\"\n| \"timpls_transformable_to TI (Fun f T) (Fun g S) = (\n (f = g \\ (is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set TI)) \\\n list_all2 (timpls_transformable_to TI) T S)\"\n| \"timpls_transformable_to _ _ _ = False\"\n\nfun timpls_transformable_to' where\n \"timpls_transformable_to' TI (Var x) (Var y) = (x = y)\"\n| \"timpls_transformable_to' TI (Fun f T) (Fun g S) = (\n (f = g \\ (is_Abs f \\ is_Abs g \\ in_trancl TI (the_Abs f) (the_Abs g))) \\\n list_all2 (timpls_transformable_to' TI) T S)\"\n| \"timpls_transformable_to' _ _ _ = False\"\n\nfun equal_mod_timpls where\n \"equal_mod_timpls TI (Var x) (Var y) = (x = y)\"\n| \"equal_mod_timpls TI (Fun f T) (Fun g S) = (\n (f = g \\ (is_Abs f \\ is_Abs g \\\n ((the_Abs f, the_Abs g) \\ set TI \\\n (the_Abs g, the_Abs f) \\ set TI \\\n (\\ti \\ set TI. (the_Abs f, snd ti) \\ set TI \\ (the_Abs g, snd ti) \\ set TI)))) \\\n list_all2 (equal_mod_timpls TI) T S)\"\n| \"equal_mod_timpls _ _ _ = False\"\n\nfun intruder_synth_mod_timpls where\n \"intruder_synth_mod_timpls M TI (Var x) = List.member M (Var x)\"\n| \"intruder_synth_mod_timpls M TI (Fun f T) = (\n (list_ex (\\t. timpls_transformable_to TI t (Fun f T)) M) \\\n (public f \\ length T = arity f \\ list_all (intruder_synth_mod_timpls M TI) T))\"\n\nfun intruder_synth_mod_timpls' where\n \"intruder_synth_mod_timpls' M TI (Var x) = List.member M (Var x)\"\n| \"intruder_synth_mod_timpls' M TI (Fun f T) = (\n (list_ex (\\t. timpls_transformable_to' TI t (Fun f T)) M) \\\n (public f \\ length T = arity f \\ list_all (intruder_synth_mod_timpls' M TI) T))\"\n\nfun intruder_synth_mod_eq_timpls where\n \"intruder_synth_mod_eq_timpls M TI (Var x) = (Var x \\ M)\"\n| \"intruder_synth_mod_eq_timpls M TI (Fun f T) = (\n (\\t \\ M. equal_mod_timpls TI t (Fun f T)) \\\n (public f \\ length T = arity f \\ list_all (intruder_synth_mod_eq_timpls M TI) T))\"\n\ndefinition analyzed_closed_mod_timpls where\n \"analyzed_closed_mod_timpls M TI \\\n let f = list_all (intruder_synth_mod_timpls M TI);\n g = \\t. if f (fst (Ana t)) then f (snd (Ana t))\n else \\s \\ comp_timpl_closure {t} (set TI). case Ana s of (K,R) \\ f K \\ f R\n in list_all g M\"\n\ndefinition analyzed_closed_mod_timpls' where\n \"analyzed_closed_mod_timpls' M TI \\\n let f = list_all (intruder_synth_mod_timpls' M TI);\n g = \\t. if f (fst (Ana t)) then f (snd (Ana t))\n else \\s \\ comp_timpl_closure {t} (set TI). case Ana s of (K,R) \\ f K \\ f R\n in list_all g M\"\n(* Alternative definition (allows for computing the closures beforehand which may be useful) *)\ndefinition analyzed_closed_mod_timpls_alt where\n \"analyzed_closed_mod_timpls_alt M TI timpl_cl_witness \\\n let f = \\R. \\r \\ set R. intruder_synth_mod_timpls M TI r;\n N = {t \\ set M. f (fst (Ana t))};\n N' = set M - N\n in (\\t \\ N. f (snd (Ana t))) \\\n (N' \\ {} \\ (N' \\ (\\x\\timpl_cl_witness. \\(a,b)\\set TI. set \\a --\\ b\\\\x\\) \\ timpl_cl_witness)) \\\n (\\s \\ timpl_cl_witness. case Ana s of (K,R) \\ f K \\ f R)\"\n\nlemma in_trancl_closure_iff_in_trancl_fun:\n \"(a,b) \\ (set TI)\\<^sup>+ \\ in_trancl TI a b\" (is \"?A TI a b \\ ?B TI a b\")\nproof\n show \"?A TI a b \\ ?B TI a b\"\n proof (induction rule: trancl_induct)\n case (step c d)\n show ?case using step.IH step.hyps(2)\n proof (induction TI a c rule: in_trancl.induct)\n case (1 TI a b) thus ?case using in_trancl.simps\n by (smt Bex_set case_prodE case_prodI member_remove prod.sel(2) remove_code(1))\n qed\n qed (metis in_trancl.simps)\n\n show \"?B TI a b \\ ?A TI a b\"\n proof (induction TI a b rule: in_trancl.induct)\n case (1 TI a b)\n let ?P = \"\\TI a b c d. in_trancl (List.removeAll (c,d) TI) d b\"\n have *: \"\\(c,d) \\ set TI. c = a \\ ?P TI a b c d\" when \"(a,b) \\ set TI\"\n using that \"1.prems\" list_ex_iff[of _ TI] in_trancl.simps[of TI a b]\n by auto\n show ?case\n proof (cases \"(a,b) \\ set TI\")\n case False\n hence \"\\(c,d) \\ set TI. c = a \\ ?P TI a b c d\" using * by blast\n then obtain d where d: \"(a,d) \\ set TI\" \"?P TI a b a d\" by blast\n have \"(d,b) \\ (set (removeAll (a,d) TI))\\<^sup>+\" using \"1.IH\"[OF False d(1)] d(2) by blast\n moreover have \"set (removeAll (a,d) TI) \\ set TI\" by simp\n ultimately have \"(d,b) \\ (set TI)\\<^sup>+\" using trancl_mono by blast\n thus ?thesis using d(1) by fastforce\n qed simp\n qed\nqed\n\nlemma in_rtrancl_closure_iff_in_rtrancl_fun:\n \"(a,b) \\ (set TI)\\<^sup>* \\ in_rtrancl TI a b\"\nby (metis rtrancl_eq_or_trancl in_trancl_closure_iff_in_trancl_fun in_rtrancl_def)\n\nlemma in_trancl_mono:\n assumes \"set TI \\ set TI'\"\n and \"in_trancl TI a b\"\n shows \"in_trancl TI' a b\"\nby (metis assms in_trancl_closure_iff_in_trancl_fun trancl_mono)\n\nlemma equal_mod_timpls_refl:\n \"equal_mod_timpls TI t t\"\nproof (induction t)\n case (Fun f T) thus ?case\n using list_all2_conv_all_nth[of \"equal_mod_timpls TI\" T T] by force\nqed simp\n\nlemma equal_mod_timpls_inv_Var:\n \"equal_mod_timpls TI (Var x) t \\ t = Var x\" (is \"?A \\ ?C\")\n \"equal_mod_timpls TI t (Var x) \\ t = Var x\" (is \"?B \\ ?C\")\nproof -\n show \"?A \\ ?C\" by (cases t) auto\n show \"?B \\ ?C\" by (cases t) auto\nqed\n\nlemma equal_mod_timpls_inv:\n assumes \"equal_mod_timpls TI (Fun f T) (Fun g S)\"\n shows \"length T = length S\"\n and \"\\i. i < length T \\ equal_mod_timpls TI (T ! i) (S ! i)\"\n and \"f \\ g \\ (is_Abs f \\ is_Abs g \\ (\n (the_Abs f, the_Abs g) \\ set TI \\ (the_Abs g, the_Abs f) \\ set TI \\\n (\\ti \\ set TI. (the_Abs f, snd ti) \\ set TI \\\n (the_Abs g, snd ti) \\ set TI)))\"\nusing assms list_all2_conv_all_nth[of \"equal_mod_timpls TI\" T S]\nby (auto elim: equal_mod_timpls.cases)\n\nlemma equal_mod_timpls_inv':\n assumes \"equal_mod_timpls TI (Fun f T) t\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ equal_mod_timpls TI (T ! i) (args t ! i)\"\n and \"f \\ the_Fun t \\ (is_Abs f \\ is_Abs (the_Fun t) \\ (\n (the_Abs f, the_Abs (the_Fun t)) \\ set TI \\\n (the_Abs (the_Fun t), the_Abs f) \\ set TI \\\n (\\ti \\ set TI. (the_Abs f, snd ti) \\ set TI \\\n (the_Abs (the_Fun t), snd ti) \\ set TI)))\"\n and \"\\is_Abs f \\ f = the_Fun t\"\nusing assms list_all2_conv_all_nth[of \"equal_mod_timpls TI\" T]\nby (cases t; auto)+\n\nlemma equal_mod_timpls_if_term_variants:\n fixes s t::\"(('a, 'b, 'c) prot_fun, 'd) term\" and a b::\"'c set\"\n defines \"P \\ (\\_. [])(Abs a := [Abs b])\"\n assumes st: \"term_variants_pred P s t\"\n and ab: \"(a,b) \\ set TI\"\n shows \"equal_mod_timpls TI s t\"\nusing st P_def\nproof (induction rule: term_variants_pred.induct)\n case (term_variants_P T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"equal_mod_timpls TI\" T S]\n in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n by auto\nnext\n case (term_variants_Fun T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"equal_mod_timpls TI\" T S]\n in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n by auto\nqed simp\n\nlemma equal_mod_timpls_mono:\n assumes \"set TI \\ set TI'\"\n and \"equal_mod_timpls TI s t\"\n shows \"equal_mod_timpls TI' s t\"\n using assms\nproof (induction TI s t rule: equal_mod_timpls.induct)\n case (2 TI f T g S)\n have *: \"f = g \\ (is_Abs f \\ is_Abs g \\ ((the_Abs f, the_Abs g) \\ set TI \\\n (the_Abs g, the_Abs f) \\ set TI \\\n (\\ti \\ set TI. (the_Abs f, snd ti) \\ set TI \\\n (the_Abs g, snd ti) \\ set TI)))\"\n \"list_all2 (equal_mod_timpls TI) T S\"\n using \"2.prems\" by simp_all\n\n show ?case\n using \"2.IH\" \"2.prems\"(1) list.rel_mono_strong[OF *(2)] *(1) in_trancl_mono[of TI TI']\n by (metis (no_types, lifting) equal_mod_timpls.simps(2) set_rev_mp)\nqed auto\n\nlemma equal_mod_timpls_refl_minus_eq:\n \"equal_mod_timpls TI s t \\ equal_mod_timpls (filter (\\(a,b). a \\ b) TI) s t\"\n (is \"?A \\ ?B\")\nproof\n show ?A when ?B using that equal_mod_timpls_mono[of \"filter (\\(a,b). a \\ b) TI\" TI] by auto\n\n show ?B when ?A using that\n proof (induction TI s t rule: equal_mod_timpls.induct)\n case (2 TI f T g S)\n define TI' where \"TI' \\ filter (\\(a,b). a \\ b) TI\"\n\n let ?P = \"\\X Y. f = g \\ (is_Abs f \\ is_Abs g \\ ((the_Abs f, the_Abs g) \\ set X \\\n (the_Abs g, the_Abs f) \\ set X \\ (\\ti \\ set Y.\n (the_Abs f, snd ti) \\ set X \\ (the_Abs g, snd ti) \\ set X)))\"\n\n have *: \"?P TI TI\" \"list_all2 (equal_mod_timpls TI) T S\"\n using \"2.prems\" by simp_all\n\n have \"?P TI' TI\"\n using *(1) unfolding TI'_def is_Abs_def by auto\n hence \"?P TI' TI'\"\n by (metis (no_types, lifting) snd_conv)\n moreover have \"list_all2 (equal_mod_timpls TI') T S\"\n using *(2) \"2.IH\" list.rel_mono_strong unfolding TI'_def by blast\n ultimately show ?case unfolding TI'_def by force\n qed auto\nqed\n\nlemma timpls_transformable_to_refl:\n \"timpls_transformable_to TI t t\" (is ?A)\n \"timpls_transformable_to' TI t t\" (is ?B)\nby (induct t) (auto simp add: list_all2_conv_all_nth)\n\nlemma timpls_transformable_to_inv_Var:\n \"timpls_transformable_to TI (Var x) t \\ t = Var x\" (is \"?A \\ ?C\")\n \"timpls_transformable_to TI t (Var x) \\ t = Var x\" (is \"?B \\ ?C\")\n \"timpls_transformable_to' TI (Var x) t \\ t = Var x\" (is \"?A' \\ ?C\")\n \"timpls_transformable_to' TI t (Var x) \\ t = Var x\" (is \"?B' \\ ?C\")\nby (cases t; auto)+\n\nlemma timpls_transformable_to_inv:\n assumes \"timpls_transformable_to TI (Fun f T) (Fun g S)\"\n shows \"length T = length S\"\n and \"\\i. i < length T \\ timpls_transformable_to TI (T ! i) (S ! i)\"\n and \"f \\ g \\ (is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set TI)\"\nusing assms list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T S] by auto\n\nlemma timpls_transformable_to'_inv:\n assumes \"timpls_transformable_to' TI (Fun f T) (Fun g S)\"\n shows \"length T = length S\"\n and \"\\i. i < length T \\ timpls_transformable_to' TI (T ! i) (S ! i)\"\n and \"f \\ g \\ (is_Abs f \\ is_Abs g \\ in_trancl TI (the_Abs f) (the_Abs g))\"\nusing assms list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T S] by auto\n\nlemma timpls_transformable_to_inv':\n assumes \"timpls_transformable_to TI (Fun f T) t\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ timpls_transformable_to TI (T ! i) (args t ! i)\"\n and \"f \\ the_Fun t \\ (\n is_Abs f \\ is_Abs (the_Fun t) \\ (the_Abs f, the_Abs (the_Fun t)) \\ set TI)\"\n and \"\\is_Abs f \\ f = the_Fun t\"\nusing assms list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T]\nby (cases t; auto)+\n\nlemma timpls_transformable_to'_inv':\n assumes \"timpls_transformable_to' TI (Fun f T) t\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ timpls_transformable_to' TI (T ! i) (args t ! i)\"\n and \"f \\ the_Fun t \\ (\n is_Abs f \\ is_Abs (the_Fun t) \\ in_trancl TI (the_Abs f) (the_Abs (the_Fun t)))\"\n and \"\\is_Abs f \\ f = the_Fun t\"\nusing assms list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T]\nby (cases t; auto)+\n\nlemma timpls_transformable_to_size_eq:\n fixes s t::\"(('b, 'c, 'a) prot_fun, 'd) term\"\n shows \"timpls_transformable_to TI s t \\ size s = size t\" (is \"?A \\ ?C\")\n and \"timpls_transformable_to' TI s t \\ size s = size t\" (is \"?B \\ ?C\")\nproof -\n have *: \"size_list size T = size_list size S\"\n when \"length T = length S\" \"\\i. i < length T \\ size (T ! i) = size (S ! i)\"\n for S T::\"(('b, 'c, 'a) prot_fun, 'd) term list\"\n using that\n proof (induction T arbitrary: S)\n case (Cons x T')\n then obtain y S' where y: \"S = y#S'\" by (cases S) auto\n hence \"size_list size T' = size_list size S'\" \"size x = size y\"\n using Cons.prems Cons.IH[of S'] by force+\n thus ?case using y by simp\n qed simp\n\n show ?C when ?A using that\n proof (induction rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n hence \"length T = length S\" \"\\i. i < length T \\ size (T ! i) = size (S ! i)\"\n using timpls_transformable_to_inv(1,2)[of TI f T g S] by auto\n thus ?case using *[of S T] by simp\n qed simp_all\n\n show ?C when ?B using that\n proof (induction rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n hence \"length T = length S\" \"\\i. i < length T \\ size (T ! i) = size (S ! i)\"\n using timpls_transformable_to'_inv(1,2)[of TI f T g S] by auto\n thus ?case using *[of S T] by simp\n qed simp_all\nqed\n\nlemma timpls_transformable_to_if_term_variants:\n fixes s t::\"(('a, 'b, 'c) prot_fun, 'd) term\" and a b::\"'c set\"\n defines \"P \\ (\\_. [])(Abs a := [Abs b])\"\n assumes st: \"term_variants_pred P s t\"\n and ab: \"(a,b) \\ set TI\"\n shows \"timpls_transformable_to TI s t\"\nusing st P_def\nproof (induction rule: term_variants_pred.induct)\n case (term_variants_P T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T S]\n by auto\nnext\n case (term_variants_Fun T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T S]\n by auto\nqed simp\n\nlemma timpls_transformable_to'_if_term_variants:\n fixes s t::\"(('a, 'b, 'c) prot_fun, 'd) term\" and a b::\"'c set\"\n defines \"P \\ (\\_. [])(Abs a := [Abs b])\"\n assumes st: \"term_variants_pred P s t\"\n and ab: \"(a,b) \\ (set TI)\\<^sup>+\"\n shows \"timpls_transformable_to' TI s t\"\nusing st P_def\nproof (induction rule: term_variants_pred.induct)\n case (term_variants_P T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T S]\n in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n by auto\nnext\n case (term_variants_Fun T S f) thus ?case\n using ab list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T S]\n in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n by auto\nqed simp\n\nlemma timpls_transformable_to_trans:\n assumes TI_trancl: \"\\(a,b) \\ (set TI)\\<^sup>+. a \\ b \\ (a,b) \\ set TI\"\n and st: \"timpls_transformable_to TI s t\"\n and tu: \"timpls_transformable_to TI t u\"\n shows \"timpls_transformable_to TI s u\"\nusing st tu\nproof (induction s arbitrary: t u)\n case (Var x) thus ?case using tu timpls_transformable_to_inv_Var(1) by fast\nnext\n case (Fun f T)\n obtain g S where t:\n \"t = Fun g S\" \"length T = length S\"\n \"\\i. i < length T \\ timpls_transformable_to TI (T ! i) (S ! i)\"\n \"f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set TI\"\n using timpls_transformable_to_inv'[OF Fun.prems(1)] TI_trancl by moura\n\n obtain h U where u:\n \"u = Fun h U\" \"length S = length U\"\n \"\\i. i < length S \\ timpls_transformable_to TI (S ! i) (U ! i)\"\n \"g \\ h \\ is_Abs g \\ is_Abs h \\ (the_Abs g, the_Abs h) \\ set TI\"\n using timpls_transformable_to_inv'[OF Fun.prems(2)[unfolded t(1)]] TI_trancl by moura\n\n have \"list_all2 (timpls_transformable_to TI) T U\"\n using t(1,2,3) u(1,2,3) Fun.IH\n list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T S]\n list_all2_conv_all_nth[of \"timpls_transformable_to TI\" S U]\n list_all2_conv_all_nth[of \"timpls_transformable_to TI\" T U]\n by force\n moreover have \"(the_Abs f, the_Abs h) \\ set TI\"\n when \"(the_Abs f, the_Abs g) \\ set TI\" \"(the_Abs g, the_Abs h) \\ set TI\"\n \"f \\ h\" \"is_Abs f\" \"is_Abs h\"\n using that(3,4,5) TI_trancl trancl_into_trancl[OF r_into_trancl[OF that(1)] that(2)]\n unfolding is_Abs_def the_Abs_def\n by force\n hence \"is_Abs f \\ is_Abs h \\ (the_Abs f, the_Abs h) \\ set TI\"\n when \"f \\ h\"\n using that TI_trancl t(4) u(4) by fast\n ultimately show ?case using t(1) u(1) by force\nqed\n\nlemma timpls_transformable_to'_trans:\n assumes st: \"timpls_transformable_to' TI s t\"\n and tu: \"timpls_transformable_to' TI t u\"\n shows \"timpls_transformable_to' TI s u\"\nusing st tu\nproof (induction s arbitrary: t u)\n case (Var x) thus ?case using tu timpls_transformable_to_inv_Var(3) by fast\nnext\n case (Fun f T)\n note 0 = in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n\n obtain g S where t:\n \"t = Fun g S\" \"length T = length S\"\n \"\\i. i < length T \\ timpls_transformable_to' TI (T ! i) (S ! i)\"\n \"f \\ g \\ is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ (set TI)\\<^sup>+\"\n using timpls_transformable_to'_inv'[OF Fun.prems(1)] 0 by moura\n\n obtain h U where u:\n \"u = Fun h U\" \"length S = length U\"\n \"\\i. i < length S \\ timpls_transformable_to' TI (S ! i) (U ! i)\"\n \"g \\ h \\ is_Abs g \\ is_Abs h \\ (the_Abs g, the_Abs h) \\ (set TI)\\<^sup>+\"\n using timpls_transformable_to'_inv'[OF Fun.prems(2)[unfolded t(1)]] 0 by moura\n\n have \"list_all2 (timpls_transformable_to' TI) T U\"\n using t(1,2,3) u(1,2,3) Fun.IH\n list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T S]\n list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" S U]\n list_all2_conv_all_nth[of \"timpls_transformable_to' TI\" T U]\n by force\n moreover have \"(the_Abs f, the_Abs h) \\ (set TI)\\<^sup>+\"\n when \"(the_Abs f, the_Abs g) \\ (set TI)\\<^sup>+\" \"(the_Abs g, the_Abs h) \\ (set TI)\\<^sup>+\"\n using that by simp\n hence \"is_Abs f \\ is_Abs h \\ (the_Abs f, the_Abs h) \\ (set TI)\\<^sup>+\"\n when \"f \\ h\"\n by (metis that t(4) u(4))\n ultimately show ?case using t(1) u(1) 0 by force\nqed\n\nlemma timpls_transformable_to_mono:\n assumes \"set TI \\ set TI'\"\n and \"timpls_transformable_to TI s t\"\n shows \"timpls_transformable_to TI' s t\"\n using assms\nproof (induction TI s t rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n have *: \"f = g \\ (is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set TI)\"\n \"list_all2 (timpls_transformable_to TI) T S\"\n using \"2.prems\" by simp_all\n\n show ?case\n using \"2.IH\" \"2.prems\"(1) list.rel_mono_strong[OF *(2)] *(1) in_trancl_mono[of TI TI']\n by (metis (no_types, lifting) timpls_transformable_to.simps(2) set_rev_mp)\nqed auto\n\nlemma timpls_transformable_to'_mono:\n assumes \"set TI \\ set TI'\"\n and \"timpls_transformable_to' TI s t\"\n shows \"timpls_transformable_to' TI' s t\"\n using assms\nproof (induction TI s t rule: timpls_transformable_to'.induct)\n case (2 TI f T g S)\n have *: \"f = g \\ (is_Abs f \\ is_Abs g \\ in_trancl TI (the_Abs f) (the_Abs g))\"\n \"list_all2 (timpls_transformable_to' TI) T S\"\n using \"2.prems\" by simp_all\n\n show ?case\n using \"2.IH\" \"2.prems\"(1) list.rel_mono_strong[OF *(2)] *(1) in_trancl_mono[of TI TI']\n by (metis (no_types, lifting) timpls_transformable_to'.simps(2))\nqed auto\n\nlemma timpls_transformable_to_refl_minus_eq:\n \"timpls_transformable_to TI s t \\ timpls_transformable_to (filter (\\(a,b). a \\ b) TI) s t\"\n (is \"?A \\ ?B\")\nproof\n let ?TI' = \"\\TI. filter (\\(a,b). a \\ b) TI\"\n\n show ?A when ?B using that timpls_transformable_to_mono[of \"?TI' TI\" TI] by auto\n\n show ?B when ?A using that\n proof (induction TI s t rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n have *: \"f = g \\ (is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set TI)\"\n \"list_all2 (timpls_transformable_to TI) T S\"\n using \"2.prems\" by simp_all\n\n have \"f = g \\ (is_Abs f \\ is_Abs g \\ (the_Abs f, the_Abs g) \\ set (?TI' TI))\"\n using *(1) unfolding is_Abs_def by auto\n moreover have \"list_all2 (timpls_transformable_to (?TI' TI)) T S\"\n using *(2) \"2.IH\" list.rel_mono_strong by blast\n ultimately show ?case by force\n qed auto\nqed\n\nlemma timpls_transformable_to_iff_in_timpl_closure:\n assumes \"set TI' = {(a,b) \\ (set TI)\\<^sup>+. a \\ b}\"\n shows \"timpls_transformable_to TI' s t \\ t \\ timpl_closure s (set TI)\" (is \"?A s t \\ ?B s t\")\nproof\n show \"?A s t \\ ?B s t\" using assms\n proof (induction s t rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n have 1: \"length T = length S\" \"\\i timpl_closure' (set TI')\" when i: \"i < length S\" for i\n proof -\n have \"timpls_transformable_to TI' (T ! i) (S ! i)\" using i 1 by presburger \n hence \"S ! i \\ timpl_closure (T ! i) (set TI)\"\n using IH[of \"T ! i\" \"S ! i\"] i 1(1) prems(2) by force\n thus ?thesis using 2[of \"S ! i\" \"T ! i\" \"set TI\"] 4 by blast\n qed\n\n have 5: \"f = g \\ (\\a b. (a, b) \\ (set TI')\\<^sup>+ \\ f = Abs a \\ g = Abs b)\"\n using prems(1) the_Abs_def[of f] the_Abs_def[of g] is_Abs_def[of f] is_Abs_def[of g] \n by fastforce\n\n show ?case using 2 4 timpl_closure_FunI[OF IH' 1(1) 5] 1(1) by auto\n qed (simp_all add: timpl_closure.FP)\n\n show \"?B s t \\ ?A s t\"\n proof (induction t rule: timpl_closure.induct)\n case (TI u a b v) show ?case\n proof (cases \"a = b\")\n case True thus ?thesis using TI.hyps(3) TI.IH term_variants_pred_refl_inv by fastforce\n next\n case False\n hence 1: \"timpls_transformable_to TI' u v\"\n using TI.hyps(2) assms timpls_transformable_to_if_term_variants[OF TI.hyps(3), of TI']\n by blast\n have 2: \"(c,d) \\ set TI'\" when cd: \"(c,d) \\ (set TI')\\<^sup>+\" \"c \\ d\" for c d\n proof -\n let ?cl = \"\\X. {(a,b) \\ X\\<^sup>+. a \\ b}\"\n have \"?cl (set TI') = ?cl (?cl (set TI))\" using assms by presburger\n hence \"set TI' = ?cl (set TI')\" using assms trancl_minus_refl_idem[of \"set TI\"] by argo\n thus ?thesis using cd by blast\n qed\n show ?thesis using timpls_transformable_to_trans[OF _ TI.IH 1] 2 by blast\n qed\n qed (use timpls_transformable_to_refl in fast)\nqed\n\nlemma timpls_transformable_to'_iff_in_timpl_closure:\n \"timpls_transformable_to' TI s t \\ t \\ timpl_closure s (set TI)\" (is \"?A s t \\ ?B s t\")\nproof\n show \"?A s t \\ ?B s t\"\n proof (induction s t rule: timpls_transformable_to'.induct)\n case (2 TI f T g S)\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n have 1: \"length T = length S\" \"\\i timpl_closure' (set TI)\" when i: \"i < length S\" for i\n proof -\n have \"timpls_transformable_to' TI (T ! i) (S ! i)\" using i 1 by presburger \n hence \"S ! i \\ timpl_closure (T ! i) (set TI)\" using IH[of \"T ! i\" \"S ! i\"] i 1(1) by force\n thus ?thesis using 2[of \"S ! i\" \"T ! i\" \"set TI\"] by blast\n qed\n\n have 4: \"f = g \\ (\\a b. (a, b) \\ (set TI)\\<^sup>+ \\ f = Abs a \\ g = Abs b)\"\n using prems the_Abs_def[of f] the_Abs_def[of g] is_Abs_def[of f] is_Abs_def[of g]\n in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n by auto\n\n show ?case using 2 timpl_closure_FunI[OF IH' 1(1) 4] 1(1) by auto\n qed (simp_all add: timpl_closure.FP)\n\n show \"?B s t \\ ?A s t\"\n proof (induction t rule: timpl_closure.induct)\n case (TI u a b v) thus ?case\n using timpls_transformable_to'_trans\n timpls_transformable_to'_if_term_variants\n by blast\n qed (use timpls_transformable_to_refl(2) in fast)\nqed\n\nlemma equal_mod_timpls_iff_ex_in_timpl_closure:\n assumes \"set TI' = {(a,b) \\ TI\\<^sup>+. a \\ b}\"\n shows \"equal_mod_timpls TI' s t \\ (\\u. u \\ timpl_closure s TI \\ u \\ timpl_closure t TI)\"\n (is \"?A s t \\ ?B s t\")\nproof\n show \"?A s t \\ ?B s t\" using assms\n proof (induction s t rule: equal_mod_timpls.induct)\n case (2 TI' f T g S)\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n have 1: \"length T = length S\" \"\\iu. (T ! i, u) \\ timpl_closure' TI \\ (S ! i, u) \\ timpl_closure' TI\"\n when i: \"i < length S\" for i\n proof -\n have \"equal_mod_timpls TI' (T ! i) (S ! i)\" using i 1 by presburger \n hence \"\\u. u \\ timpl_closure (T ! i) TI \\ u \\ timpl_closure (S ! i) TI\"\n using IH[of \"T ! i\" \"S ! i\"] i 1(1) prems by force\n thus ?thesis using 4 unfolding 2 by blast\n qed\n\n let ?P = \"\\G. f = g \\ (\\a b. (a, b) \\ G \\ f = Abs a \\ g = Abs b) \\\n (\\a b. (a, b) \\ G \\ f = Abs b \\ g = Abs a) \\\n (\\a b c. (a, c) \\ G \\ (b, c) \\ G \\ f = Abs a \\ g = Abs b)\"\n\n have \"?P (set TI')\"\n using prems the_Abs_def[of f] the_Abs_def[of g] is_Abs_def[of f] is_Abs_def[of g]\n by fastforce\n hence \"?P (TI\\<^sup>+)\" unfolding prems by blast\n hence \"?P (rtrancl TI)\" by (metis (no_types, lifting) trancl_into_rtrancl)\n hence 5: \"f = g \\ (\\a b c. (a, c) \\ TI\\<^sup>* \\ (b, c) \\ TI\\<^sup>* \\ f = Abs a \\ g = Abs b)\" by blast\n\n show ?case\n using timpl_closure_FunI3[OF _ 1(1) 5] IH 1(1)\n unfolding timpl_closure'_timpls_rtrancl_eq 2\n by auto\n qed (use timpl_closure.FP in auto)\n\n show \"?A s t\" when B: \"?B s t\"\n proof -\n obtain u where u: \"u \\ timpl_closure s TI\" \"u \\ timpl_closure t TI\"\n using B by moura\n thus ?thesis using assms\n proof (induction u arbitrary: s t rule: term.induct)\n case (Var x s t) thus ?case\n using timpl_closure_Var_in_iff[of x s TI]\n timpl_closure_Var_in_iff[of x t TI]\n equal_mod_timpls.simps(1)[of TI' x x]\n by blast\n next\n case (Fun f U s t)\n obtain g S where s:\n \"s = Fun g S\" \"length U = length S\"\n \"\\i. i < length U \\ U ! i \\ timpl_closure (S ! i) TI\"\n \"g \\ f \\ is_Abs g \\ is_Abs f \\ (the_Abs g, the_Abs f) \\ TI\\<^sup>+\"\n using Fun.prems(1) timpl_closure_Fun_inv'[of f U _ _ TI]\n by (cases s) auto\n\n obtain h T where t:\n \"t = Fun h T\" \"length U = length T\"\n \"\\i. i < length U \\ U ! i \\ timpl_closure (T ! i) TI\"\n \"h \\ f \\ is_Abs h \\ is_Abs f \\ (the_Abs h, the_Abs f) \\ TI\\<^sup>+\"\n using Fun.prems(2) timpl_closure_Fun_inv'[of f U _ _ TI]\n by (cases t) auto\n\n have g: \"(the_Abs g, the_Abs f) \\ set TI'\" \"is_Abs f\" \"is_Abs g\" when neq_f: \"g \\ f\"\n proof -\n obtain ga fa where a: \"g = Abs ga\" \"f = Abs fa\"\n using s(4)[OF neq_f] unfolding is_Abs_def by presburger\n hence \"the_Abs g \\ the_Abs f\" using neq_f by simp\n thus \"(the_Abs g, the_Abs f) \\ set TI'\" \"is_Abs f\" \"is_Abs g\"\n using s(4)[OF neq_f] Fun.prems by blast+\n qed\n\n have h: \"(the_Abs h, the_Abs f) \\ set TI'\" \"is_Abs f\" \"is_Abs h\" when neq_f: \"h \\ f\"\n proof -\n obtain ha fa where a: \"h = Abs ha\" \"f = Abs fa\"\n using t(4)[OF neq_f] unfolding is_Abs_def by presburger\n hence \"the_Abs h \\ the_Abs f\" using neq_f by simp\n thus \"(the_Abs h, the_Abs f) \\ set TI'\" \"is_Abs f\" \"is_Abs h\"\n using t(4)[OF neq_f] Fun.prems by blast+\n qed\n\n have \"equal_mod_timpls TI' (S ! i) (T ! i)\"\n when i: \"i < length U\" for i\n using i Fun.IH s(1,2,3) t(1,2,3) nth_mem[OF i] Fun.prems by meson\n hence \"list_all2 (equal_mod_timpls TI') S T\"\n using list_all2_conv_all_nth[of \"equal_mod_timpls TI'\" S T] s(2) t(2) by presburger\n thus ?case using s(1) t(1) g h by fastforce\n qed\n qed\nqed\n\n(* lemma equal_mod_timpls_iff_ex_in_timpl_closure':\n \"equal_mod_timpls (TI\\<^sup>+) s t \\ (\\u. u \\ timpl_closure s TI \\ u \\ timpl_closure t TI)\"\nusing equal_mod_timpls_iff_ex_in_timpl_closure equal_mod_timpls_refl_minus_eq\nby blast *)\n\ncontext\nbegin\nprivate inductive timpls_transformable_to_pred where\n Var: \"timpls_transformable_to_pred A (Var x) (Var x)\"\n| Fun: \"\\\\is_Abs f; length T = length S;\n \\i. i < length T \\ timpls_transformable_to_pred A (T ! i) (S ! i)\\\n \\ timpls_transformable_to_pred A (Fun f T) (Fun f S)\"\n| Abs: \"b \\ A \\ timpls_transformable_to_pred A (Fun (Abs a) []) (Fun (Abs b) [])\"\n\nprivate lemma timpls_transformable_to_pred_inv_Var:\n assumes \"timpls_transformable_to_pred A (Var x) t\"\n shows \"t = Var x\"\nusing assms by (auto elim: timpls_transformable_to_pred.cases)\n\nprivate lemma timpls_transformable_to_pred_inv:\n assumes \"timpls_transformable_to_pred A (Fun f T) t\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ timpls_transformable_to_pred A (T ! i) (args t ! i)\"\n and \"\\is_Abs f \\ f = the_Fun t\"\n and \"is_Abs f \\ (is_Abs (the_Fun t) \\ the_Abs (the_Fun t) \\ A)\"\nusing assms by (auto elim!: timpls_transformable_to_pred.cases[of A])\n\nprivate lemma timpls_transformable_to_pred_finite_aux1:\n assumes f: \"\\is_Abs f\"\n shows \"{s. timpls_transformable_to_pred A (Fun f T) s} \\\n (\\S. Fun f S) ` {S. length T = length S \\\n (\\s \\ set S. \\t \\ set T. timpls_transformable_to_pred A t s)}\"\n (is \"?B \\ ?C\")\nproof\n fix s assume s: \"s \\ ?B\"\n hence *: \"timpls_transformable_to_pred A (Fun f T) s\" by blast\n\n obtain S where S:\n \"s = Fun f S\" \"length T = length S\" \"\\i. i < length T \\ timpls_transformable_to_pred A (T ! i) (S ! i)\"\n using f timpls_transformable_to_pred_inv[OF *] unfolding the_Abs_def is_Abs_def by auto\n\n have \"\\s\\set S. \\t\\set T. timpls_transformable_to_pred A t s\" using S(2,3) in_set_conv_nth by metis\n thus \"s \\ ?C\" using S(1,2) by blast\nqed\n\nprivate lemma timpls_transformable_to_pred_finite_aux2:\n \"{s. timpls_transformable_to_pred A (Fun (Abs a) []) s} \\ (\\b. Fun (Abs b) []) ` A\" (is \"?B \\ ?C\")\nproof\n fix s assume s: \"s \\ ?B\"\n hence *: \"timpls_transformable_to_pred A (Fun (Abs a) []) s\" by blast\n\n obtain b where b: \"s = Fun (Abs b) []\" \"b \\ A\"\n using timpls_transformable_to_pred_inv[OF *] unfolding the_Abs_def is_Abs_def by auto\n thus \"s \\ ?C\" by blast\nqed\n\nprivate lemma timpls_transformable_to_pred_finite:\n fixes t::\"(('fun,'atom,'sets) prot_fun, 'a) term\"\n assumes A: \"finite A\"\n and t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"finite {s. timpls_transformable_to_pred A t s}\"\nusing t\nproof (induction t)\n case (Var x)\n have \"{s::(('fun,'atom,'sets) prot_fun, 'a) term. timpls_transformable_to_pred A (Var x) s} = {Var x}\"\n by (auto intro: timpls_transformable_to_pred.Var elim: timpls_transformable_to_pred_inv_Var)\n thus ?case by simp\nnext\n case (Fun f T)\n have IH: \"finite {s. timpls_transformable_to_pred A t s}\" when t: \"t \\ set T\" for t\n using Fun.IH[OF t] wf_trm_param[OF Fun.prems t] by blast\n\n show ?case\n proof (cases \"is_Abs f\")\n case True\n then obtain a where a: \"f = Abs a\" unfolding is_Abs_def by presburger\n hence \"T = []\" using wf_trm_arity[OF Fun.prems] by simp_all\n hence \"{a. timpls_transformable_to_pred A (Fun f T) a} \\ (\\b. Fun (Abs b) []) ` A\"\n using timpls_transformable_to_pred_finite_aux2[of A a] a by auto\n thus ?thesis using A finite_subset by fast\n next\n case False thus ?thesis\n using IH finite_lists_length_eq' timpls_transformable_to_pred_finite_aux1[of f A T] finite_subset\n by blast\n qed\nqed\n\nprivate lemma timpls_transformable_to_pred_if_timpls_transformable_to:\n assumes s: \"timpls_transformable_to TI t s\"\n and t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\"\n shows \"timpls_transformable_to_pred (A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+) t s\"\nusing s t\nproof (induction rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n let ?A = \"A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+\"\n\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n note 0 = timpls_transformable_to_inv[OF prems(1)]\n\n have 1: \"T = []\" \"S = []\" when f: \"f = Abs a\" for a\n using f wf_trm_arity[OF prems(2)] 0(1) by simp_all\n\n have \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\" when t: \"t \\ set T\" for t\n using t prems(3) funs_term_subterms_eq(1)[of \"Fun f T\"] by blast\n hence 2: \"timpls_transformable_to_pred ?A (T ! i) (S ! i)\"\n when i: \"i < length T\" for i\n using i IH 0(1,2) wf_trm_param[OF prems(2)]\n by (metis (no_types) in_set_conv_nth)\n\n have 3: \"the_Abs f \\ ?A\" when f: \"is_Abs f\" using prems(3) f by force\n\n show ?case\n proof (cases \"f = g\")\n case True\n note fg = True\n show ?thesis\n proof (cases \"is_Abs f\")\n case True\n then obtain a where a: \"f = Abs a\" unfolding is_Abs_def by moura\n thus ?thesis using fg 1[OF a] timpls_transformable_to_pred.Abs[of a ?A a] 3 by simp\n qed (use fg timpls_transformable_to_pred.Fun[OF _ 0(1) 2, of f] in blast)\n next\n case False\n then obtain a b where ab: \"f = Abs a\" \"g = Abs b\" \"(a, b) \\ (set TI)\\<^sup>+\"\n using 0(3) in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n unfolding is_Abs_def the_Abs_def by fastforce\n hence \"a \\ ?A\" \"b \\ ?A\" by force+\n thus ?thesis using timpls_transformable_to_pred.Abs ab(1,2) 1[OF ab(1)] by metis\n qed\nqed (simp_all add: timpls_transformable_to_pred.Var)\n\nprivate lemma timpls_transformable_to_pred_if_timpls_transformable_to':\n assumes s: \"timpls_transformable_to' TI t s\"\n and t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\"\n shows \"timpls_transformable_to_pred (A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+) t s\"\nusing s t\nproof (induction rule: timpls_transformable_to.induct)\n case (2 TI f T g S)\n let ?A = \"A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+\"\n\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n note 0 = timpls_transformable_to'_inv[OF prems(1)]\n\n have 1: \"T = []\" \"S = []\" when f: \"f = Abs a\" for a\n using f wf_trm_arity[OF prems(2)] 0(1) by simp_all\n\n have \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\" when t: \"t \\ set T\" for t\n using t prems(3) funs_term_subterms_eq(1)[of \"Fun f T\"] by blast\n hence 2: \"timpls_transformable_to_pred ?A (T ! i) (S ! i)\"\n when i: \"i < length T\" for i\n using i IH 0(1,2) wf_trm_param[OF prems(2)]\n by (metis (no_types) in_set_conv_nth)\n\n have 3: \"the_Abs f \\ ?A\" when f: \"is_Abs f\" using prems(3) f by force\n\n show ?case\n proof (cases \"f = g\")\n case True\n note fg = True\n show ?thesis\n proof (cases \"is_Abs f\")\n case True\n then obtain a where a: \"f = Abs a\" unfolding is_Abs_def by moura\n thus ?thesis using fg 1[OF a] timpls_transformable_to_pred.Abs[of a ?A a] 3 by simp\n qed (use fg timpls_transformable_to_pred.Fun[OF _ 0(1) 2, of f] in blast)\n next\n case False\n then obtain a b where ab: \"f = Abs a\" \"g = Abs b\" \"(a, b) \\ (set TI)\\<^sup>+\"\n using 0(3) in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n unfolding is_Abs_def the_Abs_def by fastforce\n hence \"a \\ ?A\" \"b \\ ?A\" by force+\n thus ?thesis using timpls_transformable_to_pred.Abs ab(1,2) 1[OF ab(1)] by metis\n qed\nqed (simp_all add: timpls_transformable_to_pred.Var)\n\nprivate lemma timpls_transformable_to_pred_if_equal_mod_timpls:\n assumes s: \"equal_mod_timpls TI t s\"\n and t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\"\n shows \"timpls_transformable_to_pred (A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+) t s\"\nusing s t\nproof (induction rule: equal_mod_timpls.induct)\n case (2 TI f T g S)\n let ?A = \"A \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+\"\n\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n\n note 0 = equal_mod_timpls_inv[OF prems(1)]\n\n have 1: \"T = []\" \"S = []\" when f: \"f = Abs a\" for a\n using f wf_trm_arity[OF prems(2)] 0(1) by simp_all\n\n have \"\\f \\ funs_term t. is_Abs f \\ the_Abs f \\ A\" when t: \"t \\ set T\" for t\n using t prems(3) funs_term_subterms_eq(1)[of \"Fun f T\"] by blast\n hence 2: \"timpls_transformable_to_pred ?A (T ! i) (S ! i)\"\n when i: \"i < length T\" for i\n using i IH 0(1,2) wf_trm_param[OF prems(2)]\n by (metis (no_types) in_set_conv_nth)\n\n have 3: \"the_Abs f \\ ?A\" when f: \"is_Abs f\" using prems(3) f by force\n\n show ?case\n proof (cases \"f = g\")\n case True\n note fg = True\n show ?thesis\n proof (cases \"is_Abs f\")\n case True\n then obtain a where a: \"f = Abs a\" unfolding is_Abs_def by moura\n thus ?thesis using fg 1[OF a] timpls_transformable_to_pred.Abs[of a ?A a] 3 by simp\n qed (use fg timpls_transformable_to_pred.Fun[OF _ 0(1) 2, of f] in blast)\n next\n case False\n then obtain a b where ab: \"f = Abs a\" \"g = Abs b\"\n \"(a, b) \\ (set TI)\\<^sup>+ \\ (b, a) \\ (set TI)\\<^sup>+ \\\n (\\ti \\ set TI. (a, snd ti) \\ (set TI)\\<^sup>+ \\ (b, snd ti) \\ (set TI)\\<^sup>+)\"\n using 0(3) in_trancl_closure_iff_in_trancl_fun[of _ _ TI]\n unfolding is_Abs_def the_Abs_def by fastforce\n hence \"a \\ ?A\" \"b \\ ?A\" by force+\n thus ?thesis using timpls_transformable_to_pred.Abs ab(1,2) 1[OF ab(1)] by metis\n qed\nqed (simp_all add: timpls_transformable_to_pred.Var)\n\nlemma timpls_transformable_to_finite:\n assumes t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"finite {s. timpls_transformable_to TI t s}\" (is ?P)\n and \"finite {s. timpls_transformable_to' TI t s}\" (is ?Q)\nproof -\n let ?A = \"the_Abs ` {f \\ funs_term t. is_Abs f} \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+\"\n\n have 0: \"finite ?A\" by auto\n\n have 1: \"{s. timpls_transformable_to TI t s} \\ {s. timpls_transformable_to_pred ?A t s}\"\n using timpls_transformable_to_pred_if_timpls_transformable_to[OF _ t] by auto\n\n have 2: \"{s. timpls_transformable_to' TI t s} \\ {s. timpls_transformable_to_pred ?A t s}\"\n using timpls_transformable_to_pred_if_timpls_transformable_to'[OF _ t] by auto\n\n show ?P using timpls_transformable_to_pred_finite[OF 0 t] finite_subset[OF 1] by blast\n show ?Q using timpls_transformable_to_pred_finite[OF 0 t] finite_subset[OF 2] by blast\nqed\n\nlemma equal_mod_timpls_finite:\n assumes t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"finite {s. equal_mod_timpls TI t s}\"\nproof -\n let ?A = \"the_Abs ` {f \\ funs_term t. is_Abs f} \\ fst ` (set TI)\\<^sup>+ \\ snd ` (set TI)\\<^sup>+\"\n\n have 0: \"finite ?A\" by auto\n\n have 1: \"{s. equal_mod_timpls TI t s} \\ {s. timpls_transformable_to_pred ?A t s}\"\n using timpls_transformable_to_pred_if_equal_mod_timpls[OF _ t] by auto\n\n show ?thesis using timpls_transformable_to_pred_finite[OF 0 t] finite_subset[OF 1] by blast\nqed\n\nend\n\nlemma intruder_synth_mod_timpls_is_synth_timpl_closure_set:\n fixes t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\" and TI TI'\n assumes \"set TI' = {(a,b) \\ (set TI)\\<^sup>+. a \\ b}\"\n shows \"intruder_synth_mod_timpls M TI' t \\ timpl_closure_set (set M) (set TI) \\\\<^sub>c t\"\n (is \"?C t \\ ?D t\")\nproof -\n have *: \"(\\m \\ M. timpls_transformable_to TI' m t) \\ t \\ timpl_closure_set M (set TI)\"\n when \"set TI' = {(a,b) \\ (set TI)\\<^sup>+. a \\ b}\"\n for M TI TI' and t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\"\n using timpls_transformable_to_iff_in_timpl_closure[OF that]\n timpl_closure_set_is_timpl_closure_union[of M \"set TI\"]\n timpl_closure_set_timpls_trancl_eq[of M \"set TI\"]\n timpl_closure_set_timpls_trancl_eq'[of M \"set TI\"]\n by auto\n\n show \"?C t \\ ?D t\"\n proof\n show \"?C t \\ ?D t\" using assms\n proof (induction t arbitrary: M TI TI' rule: intruder_synth_mod_timpls.induct)\n case (1 M TI' x)\n hence \"Var x \\ timpl_closure_set (set M) (set TI)\"\n using timpl_closure.FP member_def unfolding timpl_closure_set_def by force\n thus ?case by simp\n next\n case (2 M TI f T)\n show ?case\n proof (cases \"\\m \\ set M. timpls_transformable_to TI' m (Fun f T)\")\n case True thus ?thesis\n using \"2.prems\" *[of TI' TI \"set M\" \"Fun f T\"]\n intruder_synth.AxiomC[of \"Fun f T\" \"timpl_closure_set (set M) (set TI)\"]\n by blast\n next\n case False\n hence \"\\(list_ex (\\t. timpls_transformable_to TI' t (Fun f T)) M)\"\n unfolding list_ex_iff by blast\n hence \"public f\" \"length T = arity f\" \"list_all (intruder_synth_mod_timpls M TI') T\"\n using \"2.prems\"(1) by force+\n thus ?thesis using \"2.IH\"[OF _ _ \"2.prems\"(2)] unfolding list_all_iff by force\n qed\n qed\n \n show \"?D t \\ ?C t\"\n proof (induction t rule: intruder_synth_induct)\n case (AxiomC t) thus ?case\n using timpl_closure_set_Var_in_iff[of _ \"set M\" \"set TI\"] *[OF assms, of \"set M\" t]\n by (cases t rule: term.exhaust) (force simp add: member_def list_ex_iff)+\n next\n case (ComposeC T f) thus ?case\n using list_all_iff[of \"intruder_synth_mod_timpls M TI'\" T]\n intruder_synth_mod_timpls.simps(2)[of M TI' f T]\n by blast\n qed\n qed\nqed\n\nlemma intruder_synth_mod_timpls'_is_synth_timpl_closure_set:\n fixes t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\" and TI\n shows \"intruder_synth_mod_timpls' M TI t \\ timpl_closure_set (set M) (set TI) \\\\<^sub>c t\"\n (is \"?A t \\ ?B t\")\nproof -\n have *: \"(\\m \\ M. timpls_transformable_to' TI m t) \\ t \\ timpl_closure_set M (set TI)\"\n for M TI and t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\"\n using timpls_transformable_to'_iff_in_timpl_closure[of TI _ t]\n timpl_closure_set_is_timpl_closure_union[of M \"set TI\"]\n by blast+\n\n show \"?A t \\ ?B t\"\n proof\n show \"?A t \\ ?B t\"\n proof (induction t arbitrary: M TI rule: intruder_synth_mod_timpls'.induct)\n case (1 M TI x)\n hence \"Var x \\ timpl_closure_set (set M) (set TI)\"\n using timpl_closure.FP List.member_def[of M] unfolding timpl_closure_set_def by auto\n thus ?case by simp\n next\n case (2 M TI f T)\n show ?case\n proof (cases \"\\m \\ set M. timpls_transformable_to' TI m (Fun f T)\")\n case True thus ?thesis\n using \"2.prems\" *[of \"set M\" TI \"Fun f T\"]\n intruder_synth.AxiomC[of \"Fun f T\" \"timpl_closure_set (set M) (set TI)\"]\n by blast\n next\n case False\n hence \"public f\" \"length T = arity f\" \"list_all (intruder_synth_mod_timpls' M TI) T\"\n using \"2.prems\" list_ex_iff[of _ M] by force+\n thus ?thesis\n using \"2.IH\"[of _ M TI] list_all_iff[of \"intruder_synth_mod_timpls' M TI\" T]\n by force\n qed\n qed\n \n show \"?B t \\ ?A t\"\n proof (induction t rule: intruder_synth_induct)\n case (AxiomC t) thus ?case\n using AxiomC timpl_closure_set_Var_in_iff[of _ \"set M\" \"set TI\"] *[of \"set M\" TI t]\n list_ex_iff[of _ M] List.member_def[of M]\n by (cases t rule: term.exhaust) force+\n next\n case (ComposeC T f) thus ?case\n using list_all_iff[of \"intruder_synth_mod_timpls' M TI\" T]\n intruder_synth_mod_timpls'.simps(2)[of M TI f T]\n by blast\n qed\n qed\nqed\n\nlemma intruder_synth_mod_eq_timpls_is_synth_timpl_closure_set:\n fixes t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\" and TI\n defines \"cl \\ \\TI. {(a,b) \\ TI\\<^sup>+. a \\ b}\"\n shows (* \"set TI' = (set TI)\\<^sup>+ \\\n intruder_synth_mod_eq_timpls M TI' t \\\n (\\s \\ timpl_closure t (set TI). timpl_closure_set M (set TI) \\\\<^sub>c s)\"\n (is \"?P TI TI' \\ ?A t \\ ?B t\")\n and *) \"set TI' = {(a,b) \\ (set TI)\\<^sup>+. a \\ b} \\\n intruder_synth_mod_eq_timpls M TI' t \\\n (\\s \\ timpl_closure t (set TI). timpl_closure_set M (set TI) \\\\<^sub>c s)\"\n (is \"?Q TI TI' \\ ?C t \\ ?D t\")\nproof -\n (* have *: \"(\\m \\ M. equal_mod_timpls TI' m t) \\\n (\\s \\ timpl_closure t (set TI). s \\ timpl_closure_set M (set TI))\"\n when P: \"?P TI TI'\"\n for M TI TI' and t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\"\n using equal_mod_timpls_iff_ex_in_timpl_closure'[OF P]\n timpl_closure_set_is_timpl_closure_union[of M \"set TI\"]\n timpl_closure_set_timpls_trancl_eq[of M \"set TI\"]\n by blast *)\n\n have **: \"(\\m \\ M. equal_mod_timpls TI' m t) \\\n (\\s \\ timpl_closure t (set TI). s \\ timpl_closure_set M (set TI))\"\n when Q: \"?Q TI TI'\"\n for M TI TI' and t::\"(('fun, 'atom, 'sets) prot_fun, 'a) term\"\n using equal_mod_timpls_iff_ex_in_timpl_closure[OF Q]\n timpl_closure_set_is_timpl_closure_union[of M \"set TI\"]\n timpl_closure_set_timpls_trancl_eq'[of M \"set TI\"]\n by fastforce\n\n(* show \"?A t \\ ?B t\" when P: \"?P TI TI'\"\n proof\n show \"?A t \\ ?B t\"\n proof (induction t arbitrary: M TI rule: intruder_synth_mod_eq_timpls.induct)\n case (1 M TI x)\n hence \"Var x \\ timpl_closure_set M TI\" \"Var x \\ timpl_closure (Var x) TI\"\n using timpl_closure.FP unfolding timpl_closure_set_def by auto\n thus ?case by force\n next\n case (2 M TI f T)\n show ?case\n proof (cases \"\\m \\ M. equal_mod_timpls (TI\\<^sup>+) m (Fun f T)\")\n case True thus ?thesis\n using \"2.prems\" *[of M TI \"Fun f T\"] intruder_synth.AxiomC[of _ \"timpl_closure_set M TI\"]\n by blast\n next\n case False\n hence f: \"public f\" \"length T = arity f\" \"list_all (intruder_synth_mod_eq_timpls M (TI\\<^sup>+)) T\"\n using \"2.prems\" by force+\n \n let ?sy = \"intruder_synth (timpl_closure_set M TI)\"\n\n have IH: \"\\u \\ timpl_closure (T ! i) TI. ?sy u\"\n when i: \"i < length T\" for i\n using \"2.IH\"[of _ M TI] f(3) nth_mem[OF i]\n unfolding list_all_iff by blast\n \n define S where \"S \\ map (\\u. SOME v. v \\ timpl_closure u TI \\ ?sy v) T\"\n \n have S1: \"length T = length S\"\n unfolding S_def by simp\n \n have S2: \"S ! i \\ timpl_closure (T ! i) TI\"\n \"timpl_closure_set M TI \\\\<^sub>c S ! i\"\n when i: \"i < length S\" for i\n using i IH someI_ex[of \"\\v. v \\ timpl_closure (T ! i) TI \\ ?sy v\"]\n unfolding S_def by auto\n \n have \"Fun f S \\ timpl_closure (Fun f T) TI\"\n using timpl_closure_FunI[of T S TI f f] S1 S2(1)\n unfolding timpl_closure_is_timpl_closure' by presburger\n thus ?thesis\n by (metis intruder_synth.ComposeC[of S f] f(1,2) S1 S2(2) in_set_conv_nth[of _ S])\n qed\n qed\n \n show \"?A t\" when B: \"?B t\"\n proof -\n obtain s where \"timpl_closure_set M TI \\\\<^sub>c s\" \"s \\ timpl_closure t TI\"\n using B by moura\n thus ?thesis\n proof (induction s arbitrary: t rule: intruder_synth_induct)\n case (AxiomC s t)\n note 1 = timpl_closure_set_Var_in_iff[of _ M TI] timpl_closure_Var_inv[of s _ TI]\n note 2 = *[of M TI]\n show ?case\n proof (cases t)\n case Var thus ?thesis using 1 AxiomC by auto\n next\n case Fun thus ?thesis using 2 AxiomC by auto\n qed\n next\n case (ComposeC T f t)\n obtain g S where gS:\n \"t = Fun g S\" \"length S = length T\"\n \"\\i < length T. T ! i \\ timpl_closure (S ! i) TI\"\n \"g \\ f \\ is_Abs g \\ is_Abs f \\ (the_Abs g, the_Abs f) \\ TI\\<^sup>+\"\n using ComposeC.prems(1) timpl_closure'_inv'[of t \"Fun f T\" TI]\n timpl_closure_is_timpl_closure'[of _ _ TI]\n by fastforce\n \n have IH: \"intruder_synth_mod_eq_timpls M (TI\\<^sup>+) u\" when u: \"u \\ set S\" for u\n by (metis u gS(2,3) ComposeC.IH in_set_conv_nth)\n \n note 0 = list_all_iff[of \"intruder_synth_mod_eq_timpls M (TI\\<^sup>+)\" S]\n intruder_synth_mod_eq_timpls.simps(2)[of M \"TI\\<^sup>+\" g S]\n \n have \"f = g\" using ComposeC.hyps gS(4) unfolding is_Abs_def by fastforce\n thus ?case by (metis ComposeC.hyps(1,2) gS(1,2) IH 0)\n qed\n qed\n qed *)\n\n show \"?C t \\ ?D t\" when Q: \"?Q TI TI'\"\n proof\n show \"?C t \\ ?D t\" using Q\n proof (induction t arbitrary: M TI rule: intruder_synth_mod_eq_timpls.induct)\n case (1 M TI' x M TI)\n hence \"Var x \\ timpl_closure_set M (set TI)\" \"Var x \\ timpl_closure (Var x) (set TI)\"\n using timpl_closure.FP unfolding timpl_closure_set_def by auto\n thus ?case by force\n next\n case (2 M TI' f T M TI)\n show ?case\n proof (cases \"\\m \\ M. equal_mod_timpls TI' m (Fun f T)\")\n case True thus ?thesis\n using **[OF \"2.prems\"(2), of M \"Fun f T\"]\n intruder_synth.AxiomC[of _ \"timpl_closure_set M (set TI)\"]\n by blast\n next\n case False\n hence f: \"public f\" \"length T = arity f\" \"list_all (intruder_synth_mod_eq_timpls M TI') T\"\n using \"2.prems\" by force+\n \n let ?sy = \"intruder_synth (timpl_closure_set M (set TI))\"\n\n have IH: \"\\u \\ timpl_closure (T ! i) (set TI). ?sy u\"\n when i: \"i < length T\" for i\n using \"2.IH\"[of _ M TI] f(3) nth_mem[OF i] \"2.prems\"(2)\n unfolding list_all_iff by blast\n \n define S where \"S \\ map (\\u. SOME v. v \\ timpl_closure u (set TI) \\ ?sy v) T\"\n \n have S1: \"length T = length S\"\n unfolding S_def by simp\n \n have S2: \"S ! i \\ timpl_closure (T ! i) (set TI)\"\n \"timpl_closure_set M (set TI) \\\\<^sub>c S ! i\"\n when i: \"i < length S\" for i\n using i IH someI_ex[of \"\\v. v \\ timpl_closure (T ! i) (set TI) \\ ?sy v\"]\n unfolding S_def by auto\n \n have \"Fun f S \\ timpl_closure (Fun f T) (set TI)\"\n using timpl_closure_FunI[of T S \"set TI\" f f] S1 S2(1)\n unfolding timpl_closure_is_timpl_closure' by presburger\n thus ?thesis\n by (metis intruder_synth.ComposeC[of S f] f(1,2) S1 S2(2) in_set_conv_nth[of _ S])\n qed\n qed\n \n show \"?C t\" when D: \"?D t\"\n proof -\n obtain s where \"timpl_closure_set M (set TI) \\\\<^sub>c s\" \"s \\ timpl_closure t (set TI)\"\n using D by moura\n thus ?thesis\n proof (induction s arbitrary: t rule: intruder_synth_induct)\n case (AxiomC s t)\n note 1 = timpl_closure_set_Var_in_iff[of _ M \"set TI\"] timpl_closure_Var_inv[of s _ \"set TI\"]\n note 2 = **[OF Q, of M]\n show ?case\n proof (cases t)\n case Var thus ?thesis using 1 AxiomC by auto\n next\n case Fun thus ?thesis using 2 AxiomC by auto\n qed\n next\n case (ComposeC T f t)\n obtain g S where gS:\n \"t = Fun g S\" \"length S = length T\"\n \"\\i < length T. T ! i \\ timpl_closure (S ! i) (set TI)\"\n \"g \\ f \\ is_Abs g \\ is_Abs f \\ (the_Abs g, the_Abs f) \\ (set TI)\\<^sup>+\"\n using ComposeC.prems(1) timpl_closure'_inv'[of t \"Fun f T\" \"set TI\"]\n timpl_closure_is_timpl_closure'[of _ _ \"set TI\"]\n by fastforce\n \n have IH: \"intruder_synth_mod_eq_timpls M TI' u\" when u: \"u \\ set S\" for u\n by (metis u gS(2,3) ComposeC.IH in_set_conv_nth)\n \n note 0 = list_all_iff[of \"intruder_synth_mod_eq_timpls M TI'\" S]\n intruder_synth_mod_eq_timpls.simps(2)[of M TI' g S]\n \n have \"f = g\" using ComposeC.hyps gS(4) unfolding is_Abs_def by fastforce\n thus ?case by (metis ComposeC.hyps(1,2) gS(1,2) IH 0)\n qed\n qed\n qed\nqed\n\nlemma timpl_closure_finite:\n assumes t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n shows \"finite (timpl_closure t (set TI))\"\nusing timpls_transformable_to'_iff_in_timpl_closure[of TI t]\n timpls_transformable_to_finite[OF t, of TI]\nby auto\n\nlemma timpl_closure_set_finite:\n fixes TI::\"('sets set \\ 'sets set) list\"\n assumes M_finite: \"finite M\"\n and M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n shows \"finite (timpl_closure_set M (set TI))\"\nusing timpl_closure_set_is_timpl_closure_union[of M \"set TI\"]\n timpl_closure_finite[of _ TI] M_finite M_wf finite\nby auto\n\nlemma comp_timpl_closure_is_timpl_closure_set:\n fixes M and TI::\"('sets set \\ 'sets set) list\"\n assumes M_finite: \"finite M\"\n and M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n shows \"comp_timpl_closure M (set TI) = timpl_closure_set M (set TI)\"\nusing lfp_while''[OF timpls_Un_mono[of M \"set TI\"]]\n timpl_closure_set_finite[OF M_finite M_wf]\n timpl_closure_set_lfp[of M \"set TI\"]\nunfolding comp_timpl_closure_def Let_def by presburger\n\ncontext\nbegin\n\nprivate lemma analyzed_closed_mod_timpls_is_analyzed_closed_timpl_closure_set_aux1:\n fixes M::\"('fun,'atom,'sets) prot_terms\"\n assumes f: \"arity\\<^sub>f f = length T\" \"arity\\<^sub>f f > 0\" \"Ana\\<^sub>f f = (K, R)\"\n and i: \"i < length R\"\n and M: \"timpl_closure_set M TI \\\\<^sub>c T ! (R ! i)\"\n and m: \"Fun (Fu f) T \\ M\"\n and t: \"Fun (Fu f) S \\ timpl_closure (Fun (Fu f) T) TI\"\n shows \"timpl_closure_set M TI \\\\<^sub>c S ! (R ! i)\"\nproof -\n have \"R ! i < length T\" using i Ana\\<^sub>f_assm2_alt[OF f(3)] f(1) by simp\n thus ?thesis\n using timpl_closure_Fun_inv'(1,2)[OF t] intruder_synth_timpl_closure'[OF M]\n by presburger\nqed\n\nprivate lemma analyzed_closed_mod_timpls_is_analyzed_closed_timpl_closure_set_aux2:\n fixes M::\"('fun,'atom,'sets) prot_terms\"\n assumes M: \"\\s \\ set (snd (Ana m)). timpl_closure_set M TI \\\\<^sub>c s\"\n and m: \"m \\ M\"\n and t: \"t \\ timpl_closure m TI\"\n and s: \"s \\ set (snd (Ana t))\"\n shows \"timpl_closure_set M TI \\\\<^sub>c s\"\nproof -\n obtain f S K N where fS: \"t = Fun (Fu f) S\" \"arity\\<^sub>f f = length S\" \"0 < arity\\<^sub>f f\"\n and Ana_f: \"Ana\\<^sub>f f = (K, N)\"\n and Ana_t: \"Ana t = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) S, map ((!) S) N)\"\n using Ana_nonempty_inv[of t] s by fastforce\n then obtain T where T: \"m = Fun (Fu f) T\" \"length T = length S\"\n using t timpl_closure_Fu_inv'[of f S m TI]\n by moura\n hence Ana_m: \"Ana m = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) N)\"\n using fS(2,3) Ana_f by auto\n\n obtain i where i: \"i < length N\" \"s = S ! (N ! i)\"\n using s[unfolded fS(1)] Ana_t[unfolded fS(1)] T(2)\n in_set_conv_nth[of s \"map (\\i. S ! i) N\"]\n by auto\n hence \"timpl_closure_set M TI \\\\<^sub>c T ! (N ! i)\"\n using M[unfolded T(1)] Ana_m[unfolded T(1)] T(2)\n by simp\n thus ?thesis\n using analyzed_closed_mod_timpls_is_analyzed_closed_timpl_closure_set_aux1[\n OF fS(2)[unfolded T(2)[symmetric]] fS(3) Ana_f\n i(1) _ m[unfolded T(1)] t[unfolded fS(1) T(1)]]\n i(2)\n by argo\nqed\n\nlemma analyzed_closed_mod_timpls_is_analyzed_timpl_closure_set:\n fixes M::\"('fun,'atom,'sets) prot_term list\"\n assumes TI': \"set TI' = {(a,b) \\ (set TI)\\<^sup>+. a \\ b}\"\n and M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n shows \"analyzed_closed_mod_timpls M TI' \\ analyzed (timpl_closure_set (set M) (set TI))\"\n (is \"?A \\ ?B\")\nproof\n let ?C = \"\\t \\ timpl_closure_set (set M) (set TI).\n analyzed_in t (timpl_closure_set (set M) (set TI))\"\n\n let ?P = \"\\T. \\t \\ set T. timpl_closure_set (set M) (set TI) \\\\<^sub>c t\"\n let ?Q = \"\\t. \\s \\ comp_timpl_closure {t} (set TI'). case Ana s of (K, R) \\ ?P K \\ ?P R\"\n \n note defs = analyzed_closed_mod_timpls_def analyzed_in_code\n note 0 = intruder_synth_mod_timpls_is_synth_timpl_closure_set[OF TI', of M]\n note 1 = timpl_closure_set_is_timpl_closure_union[of _ \"set TI\"]\n\n have 2: \"comp_timpl_closure {t} (set TI') = timpl_closure_set {t} (set TI)\"\n when t: \"t \\ set M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" for t\n using t timpl_closure_set_timpls_trancl_eq'[of \"{t}\" \"set TI\"]\n comp_timpl_closure_is_timpl_closure_set[of \"{t}\" TI']\n unfolding TI'[symmetric]\n by blast\n hence 3: \"comp_timpl_closure {t} (set TI') \\ timpl_closure_set (set M) (set TI)\"\n when t: \"t \\ set M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" for t\n using t timpl_closure_set_mono[of \"{t}\" \"set M\"]\n by fast\n\n have ?A when C: ?C\n unfolding analyzed_closed_mod_timpls_def\n intruder_synth_mod_timpls_is_synth_timpl_closure_set[OF TI']\n list_all_iff Let_def\n proof (intro ballI)\n fix t assume t: \"t \\ set M\"\n show \"if ?P (fst (Ana t)) then ?P (snd (Ana t)) else ?Q t\" (is ?R)\n proof (cases \"?P (fst (Ana t))\")\n case True\n hence \"?P (snd (Ana t))\"\n using C timpl_closure_setI[OF t, of \"set TI\"] prod.exhaust_sel\n unfolding analyzed_in_def by blast\n thus ?thesis using True by simp\n next\n case False\n have \"?Q t\" using 3[OF t] C M_wf t unfolding analyzed_in_def by auto\n thus ?thesis using False by argo\n qed\n qed\n thus ?A when B: ?B using B analyzed_is_all_analyzed_in by metis\n\n have ?C when A: ?A unfolding analyzed_in_def Let_def\n proof (intro ballI allI impI; elim conjE)\n fix t K T s\n assume t: \"t \\ timpl_closure_set (set M) (set TI)\"\n and s: \"s \\ set T\"\n and Ana_t: \"Ana t = (K, T)\"\n and K: \"\\k \\ set K. timpl_closure_set (set M) (set TI) \\\\<^sub>c k\"\n\n obtain m where m: \"m \\ set M\" \"t \\ timpl_closure m (set TI)\"\n using timpl_closure_set_is_timpl_closure_union t by moura\n\n show \"timpl_closure_set (set M) (set TI) \\\\<^sub>c s\"\n proof (cases \"\\k \\ set (fst (Ana m)). timpl_closure_set (set M) (set TI) \\\\<^sub>c k\")\n case True\n hence *: \"\\r \\ set (snd (Ana m)). timpl_closure_set (set M) (set TI) \\\\<^sub>c r\"\n using m(1) A\n unfolding analyzed_closed_mod_timpls_def\n intruder_synth_mod_timpls_is_synth_timpl_closure_set[OF TI']\n list_all_iff\n by simp\n\n show ?thesis\n using K s Ana_t A\n analyzed_closed_mod_timpls_is_analyzed_closed_timpl_closure_set_aux2[OF * m]\n by simp\n next\n case False\n hence \"?Q m\"\n using m(1) A\n unfolding analyzed_closed_mod_timpls_def\n intruder_synth_mod_timpls_is_synth_timpl_closure_set[OF TI']\n list_all_iff Let_def\n by auto \n moreover have \"comp_timpl_closure {m} (set TI') = timpl_closure m (set TI)\"\n using 2[OF m(1)] timpl_closureton_is_timpl_closure M_wf m(1)\n by blast\n ultimately show ?thesis\n using m(2) K s Ana_t\n unfolding Let_def by auto\n qed\n qed\n thus ?B when A: ?A using A analyzed_is_all_analyzed_in by metis\nqed\n\nlemma analyzed_closed_mod_timpls'_is_analyzed_timpl_closure_set:\n fixes M::\"('fun,'atom,'sets) prot_term list\"\n assumes M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n shows \"analyzed_closed_mod_timpls' M TI \\ analyzed (timpl_closure_set (set M) (set TI))\"\n (is \"?A \\ ?B\")\nproof\n let ?C = \"\\t \\ timpl_closure_set (set M) (set TI). analyzed_in t (timpl_closure_set (set M) (set TI))\"\n\n let ?P = \"\\T. \\t \\ set T. timpl_closure_set (set M) (set TI) \\\\<^sub>c t\"\n let ?Q = \"\\t. \\s \\ comp_timpl_closure {t} (set TI). case Ana s of (K, R) \\ ?P K \\ ?P R\"\n \n note defs = analyzed_closed_mod_timpls'_def analyzed_in_code\n note 0 = intruder_synth_mod_timpls'_is_synth_timpl_closure_set[of M TI]\n note 1 = timpl_closure_set_is_timpl_closure_union[of _ \"set TI\"]\n\n have 2: \"comp_timpl_closure {t} (set TI) = timpl_closure_set {t} (set TI)\"\n when t: \"t \\ set M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" for t\n using t timpl_closure_set_timpls_trancl_eq[of \"{t}\" \"set TI\"]\n comp_timpl_closure_is_timpl_closure_set[of \"{t}\"]\n by blast\n hence 3: \"comp_timpl_closure {t} (set TI) \\ timpl_closure_set (set M) (set TI)\"\n when t: \"t \\ set M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" for t\n using t timpl_closure_set_mono[of \"{t}\" \"set M\"]\n by fast\n\n have ?A when C: ?C\n unfolding analyzed_closed_mod_timpls'_def\n intruder_synth_mod_timpls'_is_synth_timpl_closure_set\n list_all_iff Let_def\n proof (intro ballI)\n fix t assume t: \"t \\ set M\"\n show \"if ?P (fst (Ana t)) then ?P (snd (Ana t)) else ?Q t\" (is ?R)\n proof (cases \"?P (fst (Ana t))\")\n case True\n hence \"?P (snd (Ana t))\"\n using C timpl_closure_setI[OF t, of \"set TI\"] prod.exhaust_sel\n unfolding analyzed_in_def by blast\n thus ?thesis using True by simp\n next\n case False\n have \"?Q t\" using 3[OF t] C M_wf t unfolding analyzed_in_def by auto\n thus ?thesis using False by argo\n qed\n qed\n thus ?A when B: ?B using B analyzed_is_all_analyzed_in by metis\n\n have ?C when A: ?A unfolding analyzed_in_def Let_def\n proof (intro ballI allI impI; elim conjE)\n fix t K T s\n assume t: \"t \\ timpl_closure_set (set M) (set TI)\"\n and s: \"s \\ set T\"\n and Ana_t: \"Ana t = (K, T)\"\n and K: \"\\k \\ set K. timpl_closure_set (set M) (set TI) \\\\<^sub>c k\"\n\n obtain m where m: \"m \\ set M\" \"t \\ timpl_closure m (set TI)\"\n using timpl_closure_set_is_timpl_closure_union t by moura\n\n show \"timpl_closure_set (set M) (set TI) \\\\<^sub>c s\"\n proof (cases \"\\k \\ set (fst (Ana m)). timpl_closure_set (set M) (set TI) \\\\<^sub>c k\")\n case True\n hence *: \"\\r \\ set (snd (Ana m)). timpl_closure_set (set M) (set TI) \\\\<^sub>c r\"\n using m(1) A\n unfolding analyzed_closed_mod_timpls'_def\n intruder_synth_mod_timpls'_is_synth_timpl_closure_set\n list_all_iff\n by simp\n\n show ?thesis\n using K s Ana_t A\n analyzed_closed_mod_timpls_is_analyzed_closed_timpl_closure_set_aux2[OF * m]\n by simp\n next\n case False\n hence \"?Q m\"\n using m(1) A\n unfolding analyzed_closed_mod_timpls'_def\n intruder_synth_mod_timpls'_is_synth_timpl_closure_set\n list_all_iff Let_def\n by auto \n moreover have \"comp_timpl_closure {m} (set TI) = timpl_closure m (set TI)\"\n using 2[OF m(1)] timpl_closureton_is_timpl_closure M_wf m(1)\n by blast\n ultimately show ?thesis\n using m(2) K s Ana_t\n unfolding Let_def by auto\n qed\n qed\n thus ?B when A: ?A using A analyzed_is_all_analyzed_in by metis\nqed\n\nend\n\nend\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Automated_Stateful_Protocol_Verification", "sha": "e24b8241b56d24240e1227caff737d4af82e12ec", "save_path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification", "path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification/Automated_Stateful_Protocol_Verification-e24b8241b56d24240e1227caff737d4af82e12ec/Automated_Stateful_Protocol_Verification/Term_Implication.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.2929222143232949}} {"text": "(* Title: HOL/Imperative_HOL/Ref.thy\n Author: John Matthews, Galois Connections; Alexander Krauss, Lukas Bulwahn & Florian Haftmann, TU Muenchen\n*)\n\nsection \\Monadic references\\\n\ntheory Ref\nimports Array\nbegin\n\ntext \\\n Imperative reference operations; modeled after their ML counterparts.\n See \\<^url>\\http://caml.inria.fr/pub/docs/manual-caml-light/node14.15.html\\\n and \\<^url>\\http://www.smlnj.org/doc/Conversion/top-level-comparison.html\\.\n\\\n\nsubsection \\Primitives\\\n\ndefinition present :: \"heap \\ 'a::heap ref \\ bool\" where\n \"present h r \\ addr_of_ref r < lim h\"\n\ndefinition get :: \"heap \\ 'a::heap ref \\ 'a\" where\n \"get h = from_nat \\ refs h TYPEREP('a) \\ addr_of_ref\"\n\ndefinition set :: \"'a::heap ref \\ 'a \\ heap \\ heap\" where\n \"set r x = refs_update\n (\\h. h(TYPEREP('a) := ((h (TYPEREP('a))) (addr_of_ref r := to_nat x))))\"\n\ndefinition alloc :: \"'a \\ heap \\ 'a::heap ref \\ heap\" where\n \"alloc x h = (let\n l = lim h;\n r = Ref l\n in (r, set r x (h\\lim := l + 1\\)))\"\n\ndefinition noteq :: \"'a::heap ref \\ 'b::heap ref \\ bool\" (infix \"=!=\" 70) where\n \"r =!= s \\ TYPEREP('a) \\ TYPEREP('b) \\ addr_of_ref r \\ addr_of_ref s\"\n\n\nsubsection \\Monad operations\\\n\ndefinition ref :: \"'a::heap \\ 'a ref Heap\" where\n [code del]: \"ref v = Heap_Monad.heap (alloc v)\"\n\ndefinition lookup :: \"'a::heap ref \\ 'a Heap\" (\"!_\" 61) where\n [code del]: \"lookup r = Heap_Monad.tap (\\h. get h r)\"\n\ndefinition update :: \"'a ref \\ 'a::heap \\ unit Heap\" (\"_ := _\" 62) where\n [code del]: \"update r v = Heap_Monad.heap (\\h. ((), set r v h))\"\n\ndefinition change :: \"('a::heap \\ 'a) \\ 'a ref \\ 'a Heap\" where\n \"change f r = do {\n x \\ ! r;\n let y = f x;\n r := y;\n return y\n }\"\n\n\nsubsection \\Properties\\\n\ntext \\Primitives\\\n\nlemma noteq_sym: \"r =!= s \\ s =!= r\"\n and unequal [simp]: \"r \\ r' \\ r =!= r'\" \\ \"same types!\"\n by (auto simp add: noteq_def)\n\nlemma noteq_irrefl: \"r =!= r \\ False\"\n by (auto simp add: noteq_def)\n\nlemma present_alloc_neq: \"present h r \\ r =!= fst (alloc v h)\"\n by (simp add: present_def alloc_def noteq_def Let_def)\n\nlemma next_fresh [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"\\ present h r\"\n using assms by (cases h) (auto simp add: alloc_def present_def Let_def)\n\nlemma next_present [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"present h' r\"\n using assms by (cases h) (auto simp add: alloc_def set_def present_def Let_def)\n\nlemma get_set_eq [simp]:\n \"get (set r x h) r = x\"\n by (simp add: get_def set_def)\n\nlemma get_set_neq [simp]:\n \"r =!= s \\ get (set s x h) r = get h r\"\n by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n \"set r x (set r y h) = set r x h\"\n by (simp add: set_def)\n\nlemma not_present_alloc [simp]:\n \"\\ present h (fst (alloc v h))\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma set_set_swap:\n \"r =!= r' \\ set r x (set r' x' h) = set r' x' (set r x h)\"\n by (simp add: noteq_def set_def fun_eq_iff)\n\nlemma alloc_set:\n \"fst (alloc x (set r x' h)) = fst (alloc x h)\"\n by (simp add: alloc_def set_def Let_def)\n\nlemma get_alloc [simp]:\n \"get (snd (alloc x h)) (fst (alloc x' h)) = x\"\n by (simp add: alloc_def Let_def)\n\nlemma set_alloc [simp]:\n \"set (fst (alloc v h)) v' (snd (alloc v h)) = snd (alloc v' h)\"\n by (simp add: alloc_def Let_def)\n\nlemma get_alloc_neq: \"r =!= fst (alloc v h) \\ \n get (snd (alloc v h)) r = get h r\"\n by (simp add: get_def set_def alloc_def Let_def noteq_def)\n\nlemma lim_set [simp]:\n \"lim (set r v h) = lim h\"\n by (simp add: set_def)\n\nlemma present_alloc [simp]: \n \"present h r \\ present (snd (alloc v h)) r\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma present_set [simp]:\n \"present (set r v h) = present h\"\n by (simp add: present_def fun_eq_iff)\n\nlemma noteq_I:\n \"present h r \\ \\ present h r' \\ r =!= r'\"\n by (auto simp add: noteq_def present_def)\n\n\ntext \\Monad operations\\\n\nlemma execute_ref [execute_simps]:\n \"execute (ref v) h = Some (alloc v h)\"\n by (simp add: ref_def execute_simps)\n\nlemma success_refI [success_intros]:\n \"success (ref v) h\"\n by (auto intro: success_intros simp add: ref_def)\n\nlemma effect_refI [effect_intros]:\n assumes \"(r, h') = alloc v h\"\n shows \"effect (ref v) h h' r\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_refE [effect_elims]:\n assumes \"effect (ref v) h h' r\"\n obtains \"get h' r = v\" and \"present h' r\" and \"\\ present h r\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_lookup [execute_simps]:\n \"Heap_Monad.execute (lookup r) h = Some (get h r, h)\"\n by (simp add: lookup_def execute_simps)\n\nlemma success_lookupI [success_intros]:\n \"success (lookup r) h\"\n by (auto intro: success_intros simp add: lookup_def)\n\nlemma effect_lookupI [effect_intros]:\n assumes \"h' = h\" \"x = get h r\"\n shows \"effect (!r) h h' x\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_lookupE [effect_elims]:\n assumes \"effect (!r) h h' x\"\n obtains \"h' = h\" \"x = get h r\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_update [execute_simps]:\n \"Heap_Monad.execute (update r v) h = Some ((), set r v h)\"\n by (simp add: update_def execute_simps)\n\nlemma success_updateI [success_intros]:\n \"success (update r v) h\"\n by (auto intro: success_intros simp add: update_def)\n\nlemma effect_updateI [effect_intros]:\n assumes \"h' = set r v h\"\n shows \"effect (r := v) h h' x\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updateE [effect_elims]:\n assumes \"effect (r' := v) h h' r\"\n obtains \"h' = set r' v h\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_change [execute_simps]:\n \"Heap_Monad.execute (change f r) h = Some (f (get h r), set r (f (get h r)) h)\"\n by (simp add: change_def bind_def Let_def execute_simps)\n\nlemma success_changeI [success_intros]:\n \"success (change f r) h\"\n by (auto intro!: success_intros effect_intros simp add: change_def)\n\nlemma effect_changeI [effect_intros]: \n assumes \"h' = set r (f (get h r)) h\" \"x = f (get h r)\"\n shows \"effect (change f r) h h' x\"\n by (rule effectI) (insert assms, simp add: execute_simps) \n\nlemma effect_changeE [effect_elims]:\n assumes \"effect (change f r') h h' r\"\n obtains \"h' = set r' (f (get h r')) h\" \"r = f (get h r')\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma lookup_chain:\n \"(!r \\ f) = f\"\n by (rule Heap_eqI) (auto simp add: lookup_def execute_simps intro: execute_bind)\n\nlemma update_change [code]:\n \"r := e = change (\\_. e) r \\ return ()\"\n by (rule Heap_eqI) (simp add: change_def lookup_chain)\n\n\ntext \\Non-interaction between imperative arrays and imperative references\\\n\nlemma array_get_set [simp]:\n \"Array.get (set r v h) = Array.get h\"\n by (simp add: Array.get_def set_def fun_eq_iff)\n\nlemma get_update [simp]:\n \"get (Array.update a i v h) r = get h r\"\n by (simp add: get_def Array.update_def Array.set_def)\n\nlemma alloc_update:\n \"fst (alloc v (Array.update a i v' h)) = fst (alloc v h)\"\n by (simp add: Array.update_def Array.get_def Array.set_def alloc_def Let_def)\n\nlemma update_set_swap:\n \"Array.update a i v (set r v' h) = set r v' (Array.update a i v h)\"\n by (simp add: Array.update_def Array.get_def Array.set_def set_def)\n\nlemma length_alloc [simp]: \n \"Array.length (snd (alloc v h)) a = Array.length h a\"\n by (simp add: Array.length_def Array.get_def alloc_def set_def Let_def)\n\nlemma array_get_alloc [simp]: \n \"Array.get (snd (alloc v h)) = Array.get h\"\n by (simp add: Array.get_def alloc_def set_def Let_def fun_eq_iff)\n\nlemma present_update [simp]: \n \"present (Array.update a i v h) = present h\"\n by (simp add: Array.update_def Array.set_def fun_eq_iff present_def)\n\nlemma array_present_set [simp]:\n \"Array.present (set r v h) = Array.present h\"\n by (simp add: Array.present_def set_def fun_eq_iff)\n\nlemma array_present_alloc [simp]:\n \"Array.present h a \\ Array.present (snd (alloc v h)) a\"\n by (simp add: Array.present_def alloc_def Let_def)\n\nlemma set_array_set_swap:\n \"Array.set a xs (set r x' h) = set r x' (Array.set a xs h)\"\n by (simp add: Array.set_def set_def)\n\nhide_const (open) present get set alloc noteq lookup update change\n\n\nsubsection \\Code generator setup\\\n\ntext \\Intermediate operation avoids invariance problem in \\Scala\\ (similar to value restriction)\\\n\ndefinition ref' where\n [code del]: \"ref' = ref\"\n\n\n\n\ntext \\SML / Eval\\\n\ncode_printing type_constructor ref \\ (SML) \"_/ ref\"\ncode_printing type_constructor ref \\ (Eval) \"_/ Unsynchronized.ref\"\ncode_printing constant Ref \\ (SML) \"raise/ (Fail/ \\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (SML) \"(fn/ ()/ =>/ ref/ _)\"\ncode_printing constant ref' \\ (Eval) \"(fn/ ()/ =>/ Unsynchronized.ref/ _)\"\ncode_printing constant Ref.lookup \\ (SML) \"(fn/ ()/ =>/ !/ _)\"\ncode_printing constant Ref.update \\ (SML) \"(fn/ ()/ =>/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (SML) infixl 6 \"=\"\n\ncode_reserved Eval Unsynchronized\n\n\ntext \\OCaml\\\n\ncode_printing type_constructor ref \\ (OCaml) \"_/ ref\"\ncode_printing constant Ref \\ (OCaml) \"failwith/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (OCaml) \"(fun/ ()/ ->/ ref/ _)\"\ncode_printing constant Ref.lookup \\ (OCaml) \"(fun/ ()/ ->/ !/ _)\"\ncode_printing constant Ref.update \\ (OCaml) \"(fun/ ()/ ->/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml ref\n\n\ntext \\Haskell\\\n\ncode_printing type_constructor ref \\ (Haskell) \"Heap.STRef/ Heap.RealWorld/ _\"\ncode_printing constant Ref \\ (Haskell) \"error/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (Haskell) \"Heap.newSTRef\"\ncode_printing constant Ref.lookup \\ (Haskell) \"Heap.readSTRef\"\ncode_printing constant Ref.update \\ (Haskell) \"Heap.writeSTRef\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Haskell) infix 4 \"==\"\ncode_printing class_instance ref :: HOL.equal \\ (Haskell) -\n\n\ntext \\Scala\\\n\ncode_printing type_constructor ref \\ (Scala) \"!Ref[_]\"\ncode_printing constant Ref \\ (Scala) \"!sys.error(\\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (Scala) \"('_: Unit)/ =>/ Ref((_))\"\ncode_printing constant Ref.lookup \\ (Scala) \"('_: Unit)/ =>/ Ref.lookup((_))\"\ncode_printing constant Ref.update \\ (Scala) \"('_: Unit)/ =>/ Ref.update((_), (_))\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Imperative_HOL/Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29292221432329485}} {"text": "theory Linked_List_Insert imports\n \"/home/dacosta/development/rockwellcollins/l4v/tools/autocorres/AutoCorres\"\n \"/home/dacosta/development/rockwellcollins/l4v/tools/autocorres/DataStructures\"\nbegin\n\ntext{* \n\nAuthor: Dan DaCosta\nDescription: Work towards a correctness proof of an order preserving linked list insert. Insertion\nrelies on the function, find_insertion, to find the correct placement for the new node. Currently,\nthere is a proof that find_insertion finds the insertion point according to the following \nstatements:\n\n - find_insertion does not alter the heap\n\n - if find_insertion returns a non-null node n, then all ancestors of n and n have values less than\n or equal to the value find_insertion was called with.\n\n - if find_insertion returns a non-null node n and n's direct descendant is not null than n's \n direct descendant has a value greater than the value of what find_insertion was called with.\n\n - if find_insertion returns null then either the list find_insertion was called with is null or\n the first element of the list is greater than the value find_insertion was called with.\n\nTODO:\n \n - Requires significant cleanup.\n\n - A proof that insert uses find_insertion to insert a new element into a linked list preserving\n ascending order must be given.\n\n*}\n\ninstall_C_file linked_list.c\nautocorres [ heap_abs_syntax, ts_rules = nondet] linked_list.c\ncontext linked_list begin\n\ninterpretation DataStructures.linked_list next_C NULL\ndone\n\ntext{*\n\nBoth of these lemma seem like poor candidates for simplification rules; they both have the \npotential for looping.\n\n*}\n\ndeclare list_split [simp del]\ndeclare path_split [simp del]\n\ndefinition lkup :: \"lifted_globals \\ ll_C ptr \\ ll_C option\" where \n\"lkup s a \\ (if is_valid_ll_C s a then Some (s[a]) else None)\"\n\ntext{*\n\nA useful lemma when using DataStructures.thy. It connects the lkup function to the structure \nnotations generated by AutoCorres.\n\n*}\n\nlemma lkup_conv[simp]: \"lkup s i = Some j \\ is_valid_ll_C s i \\ s[i] = j \\ next_C j = s[i]\\next \\ val_C j = s[i]\\val\"\nby \n (metis \n linked_list.get_ll_next_def\n linked_list.get_ll_val_def\n linked_list.lkup_def \n option.distinct(1) \n option.sel)\n\nlemma list_null_free: \"list (lkup s') xs i \\ NULL \\ set xs\"\n apply (induction xs arbitrary: i) by auto\n\nlemma list_member_not_null:\"\\list (lkup s') xs i; j \\ set xs\\ \\ j \\ NULL\"\n apply (rule ccontr)\n apply (simp add: list_null_free)\n done\n\nlemma list_non_empty_recursive: \"list (lkup s) (x # xs) i \\ list (lkup s) xs s[i]\\next\" by auto\n\nlemma list_non_empty_member: \n\"\\list (lkup s) (x # xs) i; j \\ set (x # xs)\\ \n \\ j = x \\ (list (lkup s) xs s[i]\\next \\ j \\ set xs)\" by auto\n\n(* Take a bit longer. *)\nlemma list_next:\"\\list (lkup s) xs i; j \\ set xs; s[j]\\next \\ NULL\\ \\ s[j]\\next \\ set xs\"\n apply (induction xs arbitrary: i j) using list_mem by auto \n\nlemma list_all_valid:\"\\list (lkup s) xs i; j \\ set xs\\ \\ is_valid_ll_C s j\"\n apply (induction xs arbitrary: i j) by auto\n\nlemma the_list_next_is_smaller:\"\\list (lkup s) xs i; j \\ set xs\\\n \\ length (the_list (lkup s) s[j]\\next) < length (the_list (lkup s) j)\"\n apply (induction xs arbitrary: i j)\n apply auto\n by (simp add: is_list_non_NULL linked_list.list_is_list the_list_non_NULL)\n\n(* Awkward. Can this be generalized into something more intuitive? *)\nlemma the_list_absurd:\n \"\\is_valid_ll_C s x; x \\ NULL; s[x]\\next = NULL; the_list (lkup s) x = []\\ \\ False\"\nby \n (metis \n is_list_non_NULL\n linked_list.get_ll_next_def\n linked_list.is_list_empty\n linked_list.lkup_def\n the_list_empty')\n\nlemma path_null_list_imp: \"list s xs i \\ path s i xs NULL\"\n using path_null_list by auto\n\nlemma list_singleton: \"\\list (lkup s) xs i; i \\ NULL; s[i]\\next = NULL\\ \\ xs = [i]\"\n by (cases xs, auto) \n\nlemma list_non_empty: \n\"list (lkup s) (x # xs) i \n \\ i \\ NULL \\ x = i \\ is_valid_ll_C s i \\ list (lkup s) xs s[i]\\next\"\n by auto\n\nlemma list_member_has_sublist:\"\\list (lkup s) xs i; j \\ set xs\\ \\ \\ xs1 xs2. xs = xs1 @ xs2 \\ list (lkup s) xs2 j\"\n apply (induction xs arbitrary: i)\n apply auto\n using list_non_NULL apply auto[1]\n by (metis append_Cons)\n\nlemma list_is_two_paths:\"\\list (lkup s) xs i; j \\ set xs \\ \\ \\ xs1 xs2. xs = xs1 @ xs2 \\ path (lkup s) i xs1 j \\ path (lkup s) j xs2 NULL\"\nproof(induction xs arbitrary: i j)\n case Nil\n thus ?case by auto\nnext\n case (Cons x xs)\n have \"s[i]\\next = NULL \\ s[i]\\next \\ NULL\" by auto\n thus ?case\n proof\n assume \"s[i]\\next = NULL\"\n thus ?case using Cons by (metis append_Nil empty_iff linked_list.list_singleton linked_list.path.simps(1) linked_list.path_null_list list.set(1) local.list.simps(2) set_ConsD)\n next\n assume a1:\"s[i]\\next \\ NULL\"\n have \"x = j \\ x \\ j\" by auto\n thus ?case\n proof\n assume a2:\"x = j\"\n thus ?case using a1 a2 Cons by (metis (no_types, hide_lams) append_Nil linked_list.list.simps(2) linked_list.path.simps(1) linked_list.path_null_list)\n next\n assume a2:\"x \\ j\"\n then have h1:\"list (lkup s) xs s[i]\\next\" using Cons by auto\n then have h2:\"j \\ set xs\" using a2 Cons by auto\n then obtain xs1 xs2 where \"xs = xs1 @ xs2 \\ path (lkup s) s[i]\\next xs1 j \\ path (lkup s) j xs2 NULL\" using Cons(1)[OF h1 h2] by auto\n then have \"i # xs = i # xs1 @ xs2 \\ path (lkup s) i (i # xs1) j \\ path (lkup s) j xs2 NULL\" using Cons by (metis linked_list.get_ll_next_def linked_list.list_non_empty linked_list.lkup_def path.simps(2))\n thus ?case by (metis Cons(2) append_Cons linked_list.list.simps(2))\n qed\n qed\nqed\n \nlemma list_hd_non_member_tail:\"\\list (lkup s) xs i; xs \\ []\\ \\ xs = [] \\ hd xs \\ set (tl xs)\"\napply (induction xs arbitrary: i)\napply auto\nby \n (metis \n linked_list.get_ll_next_def \n linked_list.list_all_valid \n linked_list.list_head_not_in_list \n linked_list.lkup_def)\n\nlemma path_non_empty_non_null_start:\"\\path (lkup s) i xs j; xs \\ []\\ \\ i \\ NULL\" by auto\n\nlemma path_extend:\n\"\\path (lkup s) i xs a; a \\ NULL; is_valid_ll_C s a\\ \\ path (lkup s) i (xs@[a]) s[a]\\next\"\nproof(induction xs arbitrary:i)\n case Nil\n thus ?case by (metis append_Nil linked_list.get_ll_next_def path.simps lkup_def)\nnext\n case (Cons x xs)\n then have \"i \\ NULL \\ is_valid_ll_C s a \\ i = x \\ path (lkup s) s[i]\\next xs a\" \n using lkup_def\n by (metis linked_list.get_ll_next_def option.distinct(1) option.sel path.simps(2))\n then have h1:\"i = x\" and h2:\"path (lkup s) s[i]\\next xs a\" and h3:\"i \\ NULL\" and h4:\"is_valid_ll_C s a\" by auto\n then have \"path (lkup s) s[i]\\next (xs @ [a]) s[a]\\next\" using Cons(1)[OF h2 Cons(3) Cons(4)] by auto\n thus ?case \n using h3 h4 h1 Cons.prems(1) append_Cons linked_list.get_ll_next_def \n by (metis lkup_def option.simps(3) path.simps(2))\nqed\n\nlemma path_equal_endpoints:\"path (lkup s) j [] j\" by (meson linked_list.path.simps(1))\n \nlemma list_path_no_cycles:\"\\list (lkup s) xs i; j \\ set xs; path (lkup s) j ys j\\ \\ ys = []\"\nproof (induction xs arbitrary: i)\n case Nil\n thus ?case by auto\nnext\n case (Cons x xs)\n have \"j = i \\ j \\ i\" using Cons by auto\n thus ?case\n proof\n assume \"j = i\"\n thus ?case using Cons by (meson append_self_conv2 list_split list_unique)\n next\n assume a:\"j \\ i\"\n then have \"x = i \\ list (lkup s) xs (s[i]\\next)\" using Cons list_non_empty by blast\n then have h1:\"x = i\" and h2:\"list (lkup s) xs (s[i]\\next)\" by auto\n thus ?case using Cons Cons(1)[OF h2 _ Cons(4)] a by auto\n qed\nqed\n\nlemma paths_preserve_list:\n\"\\list (lkup s) xs i; j \\ set xs; path (lkup s) i xs1 j; path (lkup s) j xs2 NULL\\ \n \\ xs = xs1 @ xs2\"\nproof (induction xs arbitrary: i)\n case Nil\n thus ?case by auto\nnext\n case (Cons x xs)\n have \"j = i \\ j \\ i\" using Cons by auto\n thus ?case\n proof\n assume \"j = i\"\n thus ?case using Cons list_path_no_cycles \n by (metis append_self_conv2 list_unique path_null_list)\n next\n assume a:\"j \\ i\"\n then have \"x = i \\ list (lkup s) xs (s[i]\\next)\" using list_non_empty Cons by blast\n then have h1:\"x = i\" and h2:\"list (lkup s) xs (s[i]\\next)\" by auto\n thus ?case \n using Cons(1)[OF h2 _ _ Cons(5)] Cons a by (meson list_split list_unique path_null_list) \n qed\nqed\n\nlemma path_shorten:\"\\path (lkup s) i xs NULL; i \\ NULL\\ \\ path (lkup s) s[i]\\next (tl xs) NULL\"\nproof -\n assume a1:\"path (lkup s) i xs NULL\"\n and a2:\"i \\ NULL\"\n have \"s[i]\\next = NULL \\ s[i]\\next \\ NULL\" by simp\n thus ?thesis\n proof \n assume \"s[i]\\next = NULL\"\n thus ?thesis \n using a1 a2 linked_list.path.simps(1) linked_list.path_null_list \n linked_list.list_singleton list.sel(3) \n by fastforce\n next\n assume \"s[i]\\next \\ NULL\"\n thus ?thesis by (metis a1 a2 linked_list.path_null_list list.sel(3) list_non_empty path_next)\n qed\nqed\n\nlemma find_insertion_1_loop_step:\nassumes a1:\"list (lkup s) xs i\"\nand a2:\"path (lkup s) i xs1 a\"\nand a3:\"\\x\\set xs1. sint s[x]\\val \\ v\"\nand a4:\"path (lkup s) a xs2 NULL\"\nand a5:\"a \\ NULL\"\nand a6:\"sint s[a]\\val \\ v\"\nand a7:\"a \\ set xs\"\nshows \"\\xs1. path (lkup s) i xs1 s[a]\\next \n \\ (\\xs2. path (lkup s) s[a]\\next xs2 NULL) \n \\ (\\x\\set xs1. sint s[x]\\val \\ v)\"\nproof - \n have h1:\"path (lkup s) i (xs1 @ [a]) s[a]\\next\" using path_extend[OF a2 a5 list_all_valid[OF a1 a7]] by simp\n then have h2:\"path (lkup s) s[a]\\next (tl xs2) NULL\" using path_shorten[OF a4 a5] by simp\n then have h3:\"\\x\\set (xs1@[a]). sint s[x]\\val \\ v\" using a3 a6 by simp\n thus ?thesis using h1 h2 h3 by metis\nqed\n\ntext{*\n\nCorrectness of find_insertion when the input list is not null and the head of the list is less \nthan or equal to value supplied.\n\n*}\n\nlemma find_insertion_1:\n\"\\ \\ (s::lifted_globals). \n s' = s\n \\ i \\ NULL\n \\ sint s'[i]\\val \\ v\n \\ list (lkup s) xs i \\\n find_insertion' v i\n\\ \\ r s.\n s' = s\n \\ r \\ set xs\n \\ (s[r]\\next = NULL \\ (s[r]\\next \\ NULL \\ v < sint s[s[r]\\next]\\val))\n \\ (\\ xs1 xs2.\n path (lkup s) i xs1 s[r]\\next \n \\ path (lkup s) s[r]\\next xs2 NULL\n \\ (\\ x \\ set xs1. sint s[x]\\val \\ v))\n\\!\"\n apply (rule validNF_assume_pre)\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_add_inv [where \n I = \" \\ (it,last,cond) s. \n s = s'\n \\ (cond \\ 0 \\ it \\ NULL \\ sint s[it]\\val \\ v \\ it \\ set xs)\n \\ (cond = 0 \\ last \\ NULL \\ (it = NULL \\ v < sint s[it]\\val))\n \\ (last \\ NULL \\ s[last]\\next = it \\ last \\ set xs)\n \\ (\\ xs1 xs2. path (lkup s) i xs1 it \\ path (lkup s) it xs2 NULL \\ (\\ x \\ set xs1. sint s[x]\\val \\ v))\n\" \n and M = \"\\((it,r,_),s). length (the_list (lkup s) it)\"])\n apply wp\n apply (clarsimp,auto intro: list_all_valid list_next list_mem the_list_next_is_smaller path_null_list_imp the_list_absurd find_insertion_1_loop_step)[1]\n apply (clarsimp, auto)\n apply wp\n apply (auto intro: list_mem list_all_valid) \n apply (metis empty_iff linked_list.path.simps(1) linked_list.path_null_list list.set(1))\ndone\n\ntext{*\n\nCorrectness of find_insertion when the input list is null.\n\n*}\n\nlemma find_insertion_2:\n\"\\ \\ (s::lifted_globals). \n s' = s\n \\ i = NULL\n \\ list (lkup s) xs i \\\n find_insertion' v i\n\\ \\ r s.\n s' = s\n \\ r = NULL\n\\!\"\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_unroll)\n apply wp\n apply (rule validNF_false_pre)\n apply (rule validNF_false_pre)\n apply wp\n apply auto\ndone\n\ntext{*\n\nCorrectness of find_insertion when the input list is not null and the head of the list is greater\nthan the value supplied to find_insertion.\n\n*}\n\nlemma find_insertion_3:\n\"\\ \\ (s::lifted_globals). \n s' = s\n \\ i \\ NULL\n \\ v < sint s'[i]\\val\n \\ list (lkup s) xs i \\\n find_insertion' v i\n\\ \\ r s.\n s' = s\n \\ r = NULL\n \\ v < sint s'[i]\\val\n\\!\"\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_unroll)\n apply wp\n apply (rule validNF_false_pre)\n apply (rule validNF_false_pre)\n apply wp\n apply (auto intro: list_all_valid list_mem) \ndone\n\nlemma find_insertion_pre_part:\n\"\\s. s' = s \\ list (lkup s) xs i\n \\ ((s' = s \\ i \\ NULL \\ sint s'[i]\\val \\ v \\ list (lkup s) xs i)\n \\ (s' = s \\ i = NULL \\ list (lkup s) xs i)\n \\ (s' = s \\ i \\ NULL \\ v < sint s'[i]\\val \\ list (lkup s) xs i))\"\nby auto\n\nlemma find_insertion:\n\"\n\\ \\ (s::lifted_globals). \n s' = s\n \\ list (lkup s) xs i \\\n find_insertion' v i\n\\ \\ r s.\n (s' = s \\ r \\ set xs \\\n (s[r]\\next = NULL \\ s[r]\\next \\ NULL \\ v < sint s[s[r]\\next]\\val) \\\n (\\xs1 xs2. path (lkup s) i xs1 s[r]\\next \\ path (lkup s) s[r]\\next xs2 NULL \\ (\\x\\set xs1. sint s[x]\\val \\ v)) \\\n s' = s \\ r = NULL) \\\n s' = s \\ r = NULL \\ v < sint s'[i]\\val\n\\!\"\nusing validNF_weaken_pre[OF \n validNF_vcg_disj_lift[OF \n validNF_vcg_disj_lift[OF find_insertion_1 find_insertion_2] \n find_insertion_3, \n of s' i v xs s' xs s' xs],\n of \"\\ s . s' = s \\ list (lkup s) xs i\"] find_insertion_pre_part by simp\n\n\nlemma else_branch:\"\\ C \\ Q \\ if C then P else Q\"\n by auto\n\nlemma next_update_preserve_validity:\"is_valid_ll_C s i = is_valid_ll_C s[j\\next := x] i\"\n by auto\n\nlemma next_update_preserve_untouched_state:\"x \\ y \\ lkup s x = lkup s[y\\next := v] x\"\n apply(unfold lkup_def) by (simp add: linked_list.update_ll_next_def)\n\nlemma next_update_preserve_path:\"\\i \\ set xs; path (lkup s) j xs k\\ \\ path (lkup s[i\\next := l]) j xs k\"\n apply(induction xs arbitrary: j)\n apply auto\n using linked_list.next_update_preserve_untouched_state by auto\n\nlemma non_member_next_update_preserves_list:\"\\list (lkup s) xs i; n \\ set xs\\ \\ list (lkup s[n\\next := j]) xs i\"\nproof (induction xs arbitrary: i) \n case Nil\n thus ?case by auto\nnext\n case (Cons x xs)\n then have h1:\"list (lkup s) xs s[i]\\next\" and h2:\"x = i\" by auto \n have h3:\"n \\ set xs\" using Cons by auto\n have h4:\"i \\ n\" using Cons h2 by auto\n have h5:\"is_valid_ll_C s[n\\next := j] i\" using next_update_preserve_validity Cons by auto\n have h6:\"i \\ NULL\" using Cons by auto\n obtain di where h7:\"lkup s i = Some di\" using Cons by auto\n have h8:\"lkup s[n\\next := j] i = Some di\" using next_update_preserve_untouched_state[OF h4,of s x] h7 using h4 linked_list.next_update_preserve_untouched_state by presburger\n have h9:\"s[n\\next := j][i]\\next = next_C di\" using h8 by auto\n have h10:\"s[i]\\next = s[n\\next := j][i]\\next\" using h4 by simp\n have h11:\"list (lkup s[n\\next := j]) xs s[n\\next := j][i]\\next\" using Cons(1)[OF h1 h3] h10 by auto\n thus ?case using h2 h6 h8 h11 h9 by auto\nqed\n\nlemma path_one_step:\"\\path (lkup s) i xs j; i\\ NULL; xs \\ []\\ \\ path (lkup s) s[i]\\next (tl xs) j\"\n apply(induction xs arbitrary: i) by auto\n(*\nlemma path_cannot_cycle:\"\\list (lkup s) xs i; j \\ set xs; path (lkup s) i ys s[j]\\next\\ \\ ys \\ []\"\nsorry\n*)\n\nlemma lkup_valid_eval:\"is_valid_ll_C s i \\ lkup s i = Some s[i]\"\n using lkup_def by metis\n\nlemma list_last_element:\"\\list (lkup s) xs i; n \\ set xs; r \\ set xs; s[r]\\next = NULL\\ \\ last xs = r\"\n apply(induction xs arbitrary: i) by auto\n\nlemma hd_last_not_equal_if_distinct:\"\\distinct xs; length xs > 1\\ \\ hd xs \\ last xs\"\n apply(induction xs) by auto\n\nlemma insert_front:\n\"\\n \\ NULL; is_valid_ll_C s n; list (lkup s) xs i; n \\ set xs\\ \n \\ list (lkup s[n\\next := i]) (n # xs) n\"\nproof -\n assume a1:\"n \\ NULL\"\n assume a2:\"is_valid_ll_C s n\"\n assume a3:\"list (lkup s) xs i\"\n assume a4:\"n \\ set xs\"\n have h1:\"is_valid_ll_C s[n\\next := i] n\" using next_update_preserve_validity a2 by auto\n have h2:\"list (lkup s[n\\next := i]) xs i\" using non_member_next_update_preserves_list[OF a3 a4, of i] by auto\n obtain dn where h3:\"lkup s[n\\next := i] n = Some dn\" by (metis h1 lkup_def)\n have h4:\"next_C dn = i\" using lkup_conv[OF h3] by simp\n thus ?thesis using a1 h3 h2 h4 by auto\nqed\n\nlemma insert_back:\n\"\\n \\ NULL; is_valid_ll_C s n; list (lkup s) xs i; n \\ set xs; last xs = r; xs \\ []\\ \n \\ list (lkup s[n\\next := NULL][r\\next := n]) (xs@[n]) i \\ insert n (set xs) = set (xs@[n])\"\nproof (induction xs arbitrary: i)\n case Nil\n thus ?case by auto\nnext\n case (Cons x xs)\n have h2:\"list (lkup s) xs s[i]\\next\" and h3:\"x = i\" and h4:\"i \\ NULL\" using Cons by auto\n have h5:\"(last xs = r \\ xs \\ []) \\ xs = []\" using Cons by auto\n thus ?case\n proof\n assume a:\"last xs = r \\ xs \\ []\"\n have \"length (x # xs) > 1\" using a Cons by auto\n then have \"r \\ i\" by (metis Cons.prems(3) Cons.prems(5) h3 list.sel(1) hd_last_not_equal_if_distinct list_distinct)\n then have h6:\"lkup s i = lkup s[n\\next := NULL][r\\next := n] i\" by (metis List.list.simps(15) h3 insert_iff Cons next_update_preserve_untouched_state )\n have \"is_valid_ll_C s[n\\next := NULL][r\\next := n] i\" using Cons next_update_preserve_validity linked_list.list_non_empty by presburger\n thus ?case using Cons h2 h3 h4 a h6 by auto\n next \n assume \"xs = []\"\n then have \"list (lkup s[n\\next := NULL][r\\next := n]) ((x # xs) @ [n]) i\" using Cons \n by (metis (no_types, hide_lams) append.simps(1) append.simps(2) empty_iff insert_front last_in_set linked_list.heap_abs_simps(36) linked_list.list_empty list.set(1) list_non_empty set_ConsD) \n thus ?case using Cons by auto\n qed\nqed\n\nlemma insert_middle:\" \\n \\ NULL; is_valid_ll_C s n; list (lkup s) xs i; n \\ set xs; r \\ set xs; path (lkup s) i xs1 s[r]\\next; path (lkup s) s[r]\\next xs2 NULL\\\n \\ list (lkup s[n\\next := s[r]\\next][r\\next := n]) (xs1@[n]@xs2) i \\ insert n (set xs) = set (xs1@[n]@xs2)\"\nproof (induction xs arbitrary: i xs1)\n case Nil\n thus ?case by auto\nnext \n case (Cons x xs)\n then have h1:\"x = i\" by auto\n then have \"r = x \\ r \\ set xs\" using Cons by auto\n thus ?case\n proof\n assume a:\"r = x\"\n then have h2:\"r = i\" using h1 by auto\n then have h3:\"r \\ set xs2\" using a Cons list_distinct by (metis linked_list.get_ll_next_def linked_list.list_head_not_in_list linked_list.path_null_list list_non_empty lkup_def)\n then have \"xs1 @ xs = i # xs\"\n by (metis (no_types) Cons h2 h1 linked_list.list_non_empty_recursive linked_list.list_split linked_list.list_unique)\n then have h4:\"xs1 = [r]\" using h2 by auto\n then have \"path (lkup s) i [r] s[r]\\next\" using Cons by auto\n then have h5:\"path (lkup s[n\\next := s[r]\\next]) i [r] s[n\\next := s[r]\\next][i]\\next\" using Cons by (metis h2 fun_upd_apply linked_list.heap_abs_simps(16) linked_list.next_update_preserve_path singleton_set)\n then have h6:\"n \\ set xs2\" using Cons by (metis List.list.simps(15) h2 insert_iff linked_list.list_non_empty_recursive linked_list.list_the_list path_null_list)\n then have h7:\"path (lkup s[n\\next := s[r]\\next]) s[n\\next := s[r]\\next][r]\\next xs2 NULL\" using next_update_preserve_path[OF h6 Cons(8)] Cons by auto\n then have h8:\"path (lkup s[n\\next := s[r]\\next][r\\next := n]) n (n#xs2) NULL\" using Cons by (metis h3 h6 linked_list.insert_front linked_list.non_member_next_update_preserves_list linked_list.path_null_list set_ConsD)\n then have h9:\"x = i\" using a h2 by auto\n then have h10:\"i \\ NULL\" using Cons by auto\n have h11:\"lkup s[n\\next := s[r]\\next] r \\ None \\ [] = xs1\" using h5 by auto\n then have h12:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) (xs1@[n]@xs2) i\" using h11 h10 h9 h4 h7 h2 h4 \n by (metis Cons.prems(1) Cons.prems(2) Cons.prems(4) Cons.prems(7) List.list.simps(15) append_Cons append_Nil h3 h6 insert_iff linked_list.insert_front linked_list.lkup_def linked_list.path_null_list)\n thus ?thesis using Cons by (metis (mono_tags, hide_lams) List.list.simps(15) a append_Cons append_Nil h4 h9 insert_commute linked_list.list_non_empty_recursive linked_list.list_the_list path_null_list)\n next\n assume a:\"r \\ set xs\"\n then have h1:\"list (lkup s) xs s[i]\\next\" using Cons by auto\n then have h2:\"path (lkup s) s[i]\\next (tl xs1) s[r]\\next\" using path_one_step[OF Cons(7)] \n Cons.prems(3) Cons.prems(5) Cons.prems(6) linked_list.list_non_empty by (metis Linked_List_Insert.linked_list.list_next a distinct.simps(2) linked_list.list_distinct linked_list.path.simps(1))\n then have h3:\"n \\ set xs\" using Cons by auto\n then have h4:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) (tl xs1 @ [n] @ xs2) s[i]\\next\" and h45:\"insert n (set xs) = set (tl xs1 @ [n] @ xs2)\"\n using Cons(1)[OF Cons(2) Cons(3) h1 h3 a h2 Cons(8)] by auto\n then have h5:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) (tl xs1 @ [n] @ xs2) s[n\\next := s[r]\\next][r\\next := n][i]\\next\" \n by (metis a append.simps(1) distinct.simps(2) fun_upd_apply in_set_conv_decomp linked_list.heap_abs_simps(16) linked_list.list_distinct local.Cons(4) local.Cons(5) local.list.simps(2))\n then have h6:\"i = x\" using Cons by (meson linked_list.list.simps(2))\n then have h7:\"x \\ NULL\" using Cons using linked_list.list_non_empty by blast\n then obtain a where h8:\"lkup s[n\\next := s[r]\\next][r\\next := n] i = Some a\" by (meson Cons.prems(3) linked_list.heap_abs_simps(36) linked_list.list_non_empty linked_list.lkup_def)\n then obtain h9:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) (tl xs1 @ [n] @ xs2) (next_C a)\"\n by (metis Cons.prems(3) Cons.prems(4) a append_Nil distinct.simps(2) h4 in_set_conv_decomp linked_list.get_ll_next_def linked_list.list_distinct linked_list.list_non_empty linked_list.lkup_def linked_list.next_update_preserve_untouched_state option.sel)\n then have h11:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) ((x # tl xs1) @ [n] @ xs2) i\" using h6 h7 h8 h9 by auto\n then have h12:\"xs1 = x # tl xs1\" using path_one_step[OF Cons(7)] h7 h6\n by (metis Cons.prems(1) Cons.prems(6) append_Cons append_Nil h1 h3 h4 linked_list.list.simps(2) linked_list.path.simps(2) list.sel(2) list.sel(3) list_mem neq_Nil_conv) \n then have h13:\"list (lkup s[n\\next := s[r]\\next][r\\next := n]) (xs1 @ [n] @ xs2) i\" using h11 h12 by auto\n thus ?thesis using h13 h45 by (metis List.list.simps(15) append_Cons h12 insert_commute)\n qed\nqed\n\nlemma gets_maintains_state:\n\"\n\\\\s. s' = s \n \\ n \\ NULL \n \\ is_valid_ll_C s n \\ s[n]\\next = NULL \n \\ list (lkup s) xs' i \n \\ n \\ set xs' \\ \nguard (\\ s. is_valid_ll_C s n)\n\\\\ _ s. s' = s\\!\"\n by (simp add: guard_def validNF_alt_def validNF_state_assert state_assert_def validNF_weaken_pre)\n\nlemma \"\\ \\ (s::lifted_globals). \n s' = s\n \\ n \\ NULL\n \\ is_valid_ll_C s n\n \\ s[n]\\next = NULL\n \\ list (lkup s) xs' i \n \\ n \\ set xs'\\\n insert' n i\n\\ \\ r s. (\\ xs . list (lkup s) xs r \\ set (n # xs') = set xs)\\!\"\n apply (rule validNF_assume_pre)\n apply (unfold insert'_def)\n apply wp\n apply (rule validNF_chain[OF find_insertion,of \"\\ s. s' = s\" s' xs'],simp)\n apply safe\n apply (rule else_branch)\n apply (simp add: list_member_not_null)\n apply (auto intro: list_all_valid)[1]\n using insert_back apply (metis linked_list.list_last_element list.distinct(1) list.set_cases)\n apply (rule else_branch)\n apply (simp add: list_member_not_null) \n apply (auto intro: list_all_valid, metis insert_middle)[1]\n apply (auto intro: list_all_valid insert_front)[1]\n apply (auto intro: list_all_valid insert_front)[1]\n apply (rule validNF_gets)\n apply (rule gets_maintains_state)\ndone\n\nend", "meta": {"author": "smaccm", "repo": "autocorres-experiments", "sha": "9d27f34ae62e50eb43fb1bceab866c2c5500e3bc", "save_path": "github-repos/isabelle/smaccm-autocorres-experiments", "path": "github-repos/isabelle/smaccm-autocorres-experiments/autocorres-experiments-9d27f34ae62e50eb43fb1bceab866c2c5500e3bc/linked_list/Linked_List_Insert.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.29292221432329485}} {"text": "theory Global\n imports \"HOL-Library.Library\" Result Env List_util Option_Extra Map_Extra AList_Extra\nbegin\n\nsledgehammer_params [timeout = 30]\nsledgehammer_params [provers = \"cvc4 e spass vampire z3 zipperposition\"]\n\ndeclare K_record_comp[simp]\n\nlemma if_then_Some_else_None_eq[simp]:\n \"(if a then Some b else None) = Some c \\ a \\ b = c\"\n \"(if a then Some b else None) = None \\ \\ a\"\n by (cases a) simp_all\n\nlemma if_then_else_distributive: \"(if a then f b else f c) = f (if a then b else c)\"\n by simp\n\n\nsection \\Rest\\\n\nlemma map_ofD:\n fixes xs k opt\n assumes \"map_of xs k = opt\"\n shows \"opt = None \\ (\\n < length xs. opt = Some (snd (xs ! n)))\"\n using assms\n by (metis in_set_conv_nth map_of_SomeD not_Some_eq snd_conv)\n\nlemma list_all2_assoc_map_rel_get:\n assumes \"list_all2 (=) (map fst xs) (map fst ys)\" and \"list_all2 R (map snd xs) (map snd ys)\"\n shows \"rel_option R (map_of xs k) (map_of ys k)\"\n using assms[unfolded list.rel_map]\nproof (induction xs ys rule: list.rel_induct)\n case Nil\n thus ?case by simp\nnext\n case (Cons x xs y ys)\n thus ?case by (cases \"k = fst x\") auto\nqed\n\nsubsection \\Function definition\\\n\ndatatype ('label, 'instr) fundef =\n Fundef (body: \"('label \\ 'instr list) list\") (arity: nat) (return: nat) (fundef_locals: nat)\n\nlemma rel_fundef_arities: \"rel_fundef r1 r2 gd1 gd2 \\ arity gd1 = arity gd2\"\n by (simp add: fundef.rel_sel)\n\nlemma rel_fundef_return: \"rel_fundef R1 R2 gd1 gd2 \\ return gd1 = return gd2\"\n by (simp add: fundef.rel_sel)\n\nlemma rel_fundef_locals: \"rel_fundef R1 R2 gd1 gd2 \\ fundef_locals gd1 = fundef_locals gd2\"\n by (simp add: fundef.rel_sel)\n\nlemma rel_fundef_body_length[simp]:\n \"rel_fundef r1 r2 fd1 fd2 \\ length (body fd1) = length (body fd2)\"\n by (auto intro: list_all2_lengthD simp add: fundef.rel_sel)\n\ndefinition funtype where\n \"funtype fd \\ (arity fd, return fd)\"\n\nlemma rel_fundef_funtype[simp]: \"rel_fundef R1 R2 fd1 fd2 \\ funtype fd1 = funtype fd2\"\n by (simp add: fundef.rel_sel funtype_def)\n\nlemma rel_fundef_rel_fst_hd_bodies:\n assumes \"rel_fundef R1 R2 fd1 fd2\" and \"body fd1 \\ [] \\ body fd2 \\ []\"\n shows \"R1 (fst (hd (body fd1))) (fst (hd (body fd2)))\"\n using assms\n unfolding fundef.rel_sel\n by (auto intro: list_all2_rel_prod_fst_hd[THEN conjunct1])\n\nlemma map_option_comp_conv:\n assumes\n \"\\x. rel_option R (f x) (g x)\"\n \"\\fd1 fd2. fd1 \\ ran f \\ fd2 \\ ran g \\ R fd1 fd2 \\ h fd1 = i fd2\"\n shows \"map_option h \\ f = map_option i \\ g\"\nproof (intro ext)\n fix x\n show \"(map_option h \\ f) x = (map_option i \\ g) x\"\n using assms(1)[of x]\n by (cases rule: option.rel_cases) (auto intro: ranI assms(2))\nqed\n\nlemma map_option_arity_comp_conv:\n assumes \"(\\x. rel_option (rel_fundef R S) (f x) (g x))\"\n shows \"map_option arity \\ f = map_option arity \\ g\"\nproof (rule map_option_comp_conv)\n fix x show \"rel_option (rel_fundef R S) (f x) (g x)\"\n by (rule assms(1))\nnext\n fix fd1 fd2\n show \"rel_fundef R S fd1 fd2 \\ arity fd1 = arity fd2 \"\n by (rule rel_fundef_arities)\nqed\n\ndefinition wf_fundef where\n \"wf_fundef fd \\ body fd \\ []\"\n\nlemma wf_fundef_non_empty_bodyD[dest,intro]: \"wf_fundef fd \\ body fd \\ []\"\n by (simp add: wf_fundef_def)\n\ndefinition wf_fundefs where\n \"wf_fundefs F \\ (\\f fd. F f = Some fd \\ wf_fundef fd)\"\n\nlemma wf_fundefsI:\n assumes \"\\f fd. F f = Some fd \\ wf_fundef fd\"\n shows \"wf_fundefs F\"\n using assms by (simp add: wf_fundefs_def)\n\nlemma wf_fundefsI':\n assumes \"\\f. pred_option wf_fundef (F f)\"\n shows \"wf_fundefs F\"\n using assms unfolding wf_fundefs_def\n by (metis option.pred_inject(2))\n\nlemma wf_fundefs_imp_wf_fundef:\n assumes \"wf_fundefs F\" and \"F f = Some fd\"\n shows \"wf_fundef fd\"\n using assms by (simp add: wf_fundefs_def)\n\nhide_fact wf_fundefs_def\n\nsubsection \\Program\\\n\ndatatype ('fenv, 'henv, 'fun) prog =\n Prog (prog_fundefs: 'fenv) (heap: 'henv) (main_fun: 'fun)\n\ndefinition wf_prog where \n \"wf_prog Get p \\ wf_fundefs (Get (prog_fundefs p))\"\n\nsubsection \\Stack frame\\\n\ndatatype ('fun, 'label, 'operand) frame =\n Frame 'fun 'label (prog_counter: nat) (regs: \"'operand list\") (operand_stack: \"'operand list\")\n\ndefinition instr_at where\n \"instr_at fd label pc =\n (case map_of (body fd) label of\n Some instrs \\\n if pc < length instrs then\n Some (instrs ! pc)\n else\n None\n | None \\ None)\"\n\nlemma instr_atD:\n assumes \"instr_at fd l pc = Some instr\"\n shows \"\\instrs. map_of (body fd) l = Some instrs \\ pc < length instrs \\ instrs ! pc = instr\"\n using assms\n by (cases \"map_of (body fd) l\") (auto simp: instr_at_def)\n\nlemma rel_fundef_imp_rel_option_instr_at:\n assumes \"rel_fundef (=) R fd1 fd2\"\n shows \"rel_option R (instr_at fd1 l pc) (instr_at fd2 l pc)\"\n using assms\nproof (cases rule: fundef.rel_cases)\n case (Fundef bblocks1 _ _ bblocks2 )\n then show ?thesis\n by (auto simp: instr_at_def list_all2_lengthD\n intro: list_all2_nthD2 elim!: option.rel_cases dest!: rel_option_map_of[of _ _ _ l])\nqed\n\ndefinition next_instr where\n \"next_instr F f label pc \\ do {\n fd \\ F f;\n instr_at fd label pc\n }\"\n\nlemma next_instr_eq_Some_conv:\n \"next_instr F f l pc = Some instr \\ (\\fd. F f = Some fd \\ instr_at fd l pc = Some instr)\"\n by (simp add: next_instr_def bind_eq_Some_conv)\n\nlemma next_instrD:\n assumes \"next_instr F f l pc = Some instr\"\n shows \"\\fd. F f = Some fd \\ instr_at fd l pc = Some instr\"\n using assms unfolding next_instr_def\n by (cases \"F f\"; simp)\n\nlemma next_instr_pc_lt_length_instrsI:\n assumes\n \"next_instr F f l pc = Some instr\" and\n \"F f = Some fd\" and\n \"map_of (body fd) l = Some instrs\"\n shows \"pc < length instrs\"\n using assms\n by (auto dest!: next_instrD instr_atD)\n\nlemma next_instr_get_map_ofD:\n assumes\n \"next_instr F f l pc = Some instr\" and\n \"F f = Some fd\" and\n \"map_of (body fd) l = Some instrs\"\n shows \"pc < length instrs\" and \"instrs ! pc = instr\"\n using assms\n by (auto dest!: next_instrD instr_atD)\n\nlemma next_instr_length_instrs:\n assumes\n \"F f = Some fd\" and\n \"map_of (body fd) label = Some instrs\"\n shows \"next_instr F f label (length instrs) = None\"\n by (simp add: assms next_instr_def instr_at_def)\n\nlemma next_instr_take_Suc_conv:\n assumes \"next_instr F f l pc = Some instr\" and\n \"F f = Some fd\" and\n \"map_of (body fd) l = Some instrs\"\n shows \"take (Suc pc) instrs = take pc instrs @ [instr]\"\n using assms\n by (auto simp: take_Suc_conv_app_nth dest!: next_instrD instr_atD)\n\n\nsubsection \\Dynamic state\\\n\ndatatype ('fenv, 'henv, 'frame) state =\n State (state_fundefs: 'fenv) (heap: 'henv) (callstack: \"'frame list\")\n\ndefinition state_ok where\n \"state_ok Get s \\ wf_fundefs (Get (state_fundefs s))\"\n\ninductive final for F_get Return where\n finalI: \"next_instr (F_get F) f l pc = Some Return \\\n final F_get Return (State F H [Frame f l pc R \\])\"\n\ndefinition allocate_frame where\n \"allocate_frame f fd args uninitialized \\\n Frame f (fst (hd (body fd))) 0 (args @ replicate (fundef_locals fd) uninitialized) []\"\n\ninductive load for F_get Uninitialized where\n \"F_get F main = Some fd \\ arity fd = 0 \\ body fd \\ [] \\\n load F_get Uninitialized (Prog F H main) (State F H [allocate_frame main fd [] Uninitialized])\"\n\nlemma length_neq_imp_not_list_all2:\n assumes \"length xs \\ length ys\"\n shows \"\\ list_all2 R xs ys\"\nproof (rule notI)\n assume \"list_all2 R xs ys\"\n hence \"length xs = length ys\"\n by (rule list_all2_lengthD)\n thus False\n using assms by contradiction\nqed\n\nlemma list_all2_rel_prod_conv:\n \"list_all2 (rel_prod R S) xs ys \\\n list_all2 R (map fst xs) (map fst ys) \\ list_all2 S (map snd xs) (map snd ys)\"\nproof (cases \"length xs = length ys\")\n case True\n then show ?thesis\n by (induction xs ys rule: list_induct2) (auto simp: rel_prod_sel)\nnext\n case False\n hence neq_length_maps:\n \"length (map fst xs) \\ length (map fst ys)\"\n \"length (map snd xs) \\ length (map snd ys)\"\n by simp_all\n show ?thesis\n using length_neq_imp_not_list_all2[OF False]\n using neq_length_maps[THEN length_neq_imp_not_list_all2]\n by simp\nqed\n\ndefinition rewrite_fundef_body ::\n \"('label, 'instr) fundef \\ 'label \\ nat \\ 'instr \\ ('label, 'instr) fundef\" where\n \"rewrite_fundef_body fd l n instr =\n (case fd of Fundef bblocks ar ret locals \\\n Fundef (AList.map_entry l (\\instrs. instrs[n := instr]) bblocks) ar ret locals)\"\n\nlemma rewrite_fundef_body_cases[case_names invalid_label valid_label]:\n assumes\n \"\\bs ar ret locals. fd = Fundef bs ar ret locals \\ map_of bs l = None \\ P\"\n \"\\bs ar ret locals instrs. fd = Fundef bs ar ret locals \\ map_of bs l = Some instrs \\ P\"\n shows \"P\"\n using assms\n by (cases fd; cases \"map_of (body fd) l\") auto\n\nlemma arity_rewrite_fundef_body[simp]: \"arity (rewrite_fundef_body fd l pc instr) = arity fd\"\n by (cases fd; simp add: rewrite_fundef_body_def option.case_eq_if)\n\nlemma return_rewrite_fundef_body[simp]: \"return (rewrite_fundef_body fd l pc instr) = return fd\"\n by (cases fd) (simp add: rewrite_fundef_body_def option.case_eq_if)\n\nlemma funtype_rewrite_fundef_body[simp]: \"funtype (rewrite_fundef_body fd l pc instr') = funtype fd\"\n by (simp add: funtype_def)\n\nlemma length_body_rewrite_fundef_body[simp]:\n \"length (body (rewrite_fundef_body fd l pc instr)) = length (body fd)\"\n by (cases fd) (simp add: rewrite_fundef_body_def)\n\nlemma prod_in_set_fst_image_conv: \"(x, y) \\ set xys \\ x \\ fst ` set xys\"\n by (metis fstI image_eqI)\n\nlemma map_of_body_rewrite_fundef_body_conv_neq[simp]:\n assumes \"l \\ l'\"\n shows \"map_of (body (rewrite_fundef_body fd l pc instr)) l' = map_of (body fd) l'\"\n using assms\n by (cases fd) (simp add: rewrite_fundef_body_def map_of_map_entry)\n\nlemma map_of_body_rewrite_fundef_body_conv_eq[simp]:\n \"map_of (body (rewrite_fundef_body fd l pc instr)) l =\n map_option (\\xs. xs[pc := instr]) (map_of (body fd) l)\"\n by (cases fd) (simp add: rewrite_fundef_body_def map_of_map_entry map_option_case)\n\nlemma instr_at_rewrite_fundef_body_conv:\n \"instr_at (rewrite_fundef_body fd l' pc' instr') l pc =\n map_option (\\instr. if l = l' \\ pc = pc' then instr' else instr) (instr_at fd l pc)\"\nproof (cases fd)\n case (Fundef bblocks ar ret locals)\n then show ?thesis\n proof (cases \"instr_at fd l pc\")\n case None\n then show ?thesis\n by (cases \"map_of bblocks l\")\n (auto simp add: Fundef rewrite_fundef_body_def instr_at_def map_of_map_entry)\n next\n case (Some instrs)\n then show ?thesis\n by (cases \"map_of bblocks l\")\n (auto simp add: Fundef rewrite_fundef_body_def instr_at_def map_of_map_entry)\n qed\nqed\n\nlemma fundef_locals_rewrite_fundef_body[simp]:\n \"fundef_locals (rewrite_fundef_body fd l pc instr) = fundef_locals fd\"\n by (cases fd; simp add: rewrite_fundef_body_def option.case_eq_if)\n\nlemma rel_fundef_rewrite_body1:\n assumes\n rel_fd1_fd2: \"rel_fundef (=) R fd1 fd2\" and\n instr_at_l_pc: \"instr_at fd1 l pc = Some instr\" and\n R_iff: \"\\x. R instr x \\ R instr' x\"\n shows \"rel_fundef (=) R (rewrite_fundef_body fd1 l pc instr') fd2\"\n using assms(1)\nproof (cases rule: fundef.rel_cases)\n case (Fundef xs ar' ret' locals' ys ar ret locals)\n show ?thesis\n using Fundef(3,3,1,2,4-) instr_at_l_pc\n proof (induction xs ys arbitrary: fd1 fd2 rule: list.rel_induct)\n case Nil\n then show ?case by (simp add: rewrite_fundef_body_def)\n next\n case (Cons x xs y ys)\n then show ?case\n apply (simp add: rewrite_fundef_body_def)\n apply safe\n using assms(3)\n apply (smt (verit, ccfv_SIG) fun_upd_apply fundef.sel(1) instr_atD list_all2_lengthD\n list_all2_nthD2 list_all2_update1_cong map_of.simps(2) option.simps(1) prod.sel(1,2)\n rel_prod_sel)\n by (simp add: instr_at_def)\n qed\nqed\n\nlemma rel_fundef_rewrite_body:\n assumes rel_fd1_fd2: \"rel_fundef (=) R fd1 fd2\" and R_i1_i2: \"R i1 i2\"\n shows \"rel_fundef (=) R (rewrite_fundef_body fd1 l pc i1) (rewrite_fundef_body fd2 l pc i2)\"\n using assms(1)\nproof (cases rule: fundef.rel_cases)\n case (Fundef bblocks1 ar1 ret1 locals1 bblocks2 ar2 ret2 locals2)\n then show ?thesis\n using R_i1_i2\n by (auto simp: rewrite_fundef_body_def\n intro!: list_all2_update_cong\n intro!: list_all2_rel_prod_map_entry\n dest: rel_option_map_of[of _ _ _ l])\nqed\n\nlemma rewrite_fundef_body_triv:\n \"instr_at fd l pc = Some instr \\ rewrite_fundef_body fd l pc instr = fd\"\n by (cases fd)\n (auto simp add: rewrite_fundef_body_def map_entry_map_of_Some_conv update_triv dest: instr_atD)\n\nlemma rel_fundef_rewrite_body2:\n assumes\n rel_fd1_fd2: \"rel_fundef (=) R fd1 fd2\" and\n instr_at_l_pc: \"instr_at fd2 l pc = Some instr\" and\n R_iff: \"\\x. R x instr \\ R x instr'\"\n shows \"rel_fundef (=) R fd1 (rewrite_fundef_body fd2 l pc instr')\"\n using assms(1)\nproof (cases rule: fundef.rel_cases)\n case (Fundef xs ar' ret' locals' ys ar ret locals)\n moreover obtain instrs2 where\n \"map_of (body fd2) l = Some instrs2\" and \"pc < length instrs2\" and \"instrs2 ! pc = instr\"\n using instr_atD[OF instr_at_l_pc] by auto\n moreover then obtain instrs1 instr1 where\n \"map_of (body fd1) l = Some instrs1\" and \"pc < length instrs1\" and \"instrs1 ! pc = instr1\"\n using rel_fundef_imp_rel_option_instr_at[OF rel_fd1_fd2, of l pc]\n apply (auto simp add: instr_at_def option_rel_Some2)\n by (metis instr_atD instr_at_def)\n moreover have \"list_all2 R instrs1 instrs2\"\n using Fundef \\map_of (body fd2) l = Some instrs2\\ \\map_of (body fd1) l = Some instrs1\\\n by (auto dest: rel_option_map_of[of _ _ _ l])\n moreover hence \"R (instrs1 ! pc) (instrs2 ! pc)\"\n using \\pc < length instrs1\\\n by (auto intro: list_all2_nthD)\n ultimately show ?thesis\n by (auto simp: rewrite_fundef_body_def R_iff\n intro!: list_all2_rel_prod_map_entry2\n intro: list_all2_update2_cong)\nqed\n\nlemma rel_fundef_rewrite_body2':\n assumes\n rel_fd1_fd2: \"rel_fundef (=) R fd1 fd2\" and\n instr_at1: \"instr_at fd1 l pc = Some instr1\" and\n R_instr1_instr2: \"R instr1 instr2'\"\n shows \"rel_fundef (=) R fd1 (rewrite_fundef_body fd2 l pc instr2')\"\n using assms(1)\nproof (cases rule: fundef.rel_cases)\n case (Fundef bblocks1 ar1 ret1 locals1 bblocks2 ar2 ret2 locals2)\n moreover obtain instrs1 where\n \"map_of bblocks1 l = Some instrs1\" and \"pc < length instrs1\" and \"instrs1 ! pc = instr1\"\n using Fundef instr_at1[THEN instr_atD] by auto\n\n moreover then obtain instrs2 instr2 where\n \"map_of (body fd2) l = Some instrs2\" and \"pc < length instrs2\" and \"instrs2 ! pc = instr2\"\n using Fundef rel_fd1_fd2\n apply (auto simp: option_rel_Some1 dest!: rel_option_map_of[where l = l])\n by (metis list_all2_lengthD)\n ultimately show ?thesis\n using R_instr1_instr2\n by (auto simp: rewrite_fundef_body_def\n intro!: list_all2_update2_cong list_all2_rel_prod_map_entry2\n dest: rel_option_map_of[of _ _ _ l])\nqed\n\nthm rel_fundef_rewrite_body\n\nlemma if_eq_const_conv: \"(if x then y else z) = w \\ x \\ y = w \\ \\ x \\ z = w\"\n by simp\n\nlemma const_eq_if_conv: \"w = (if x then y else z) \\ x \\ w = y \\ \\ x \\ w = z\"\n by auto\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/Global.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.29292221432329485}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Properties of Total Correctness Hoare Logic\\\n\ntheory HoareTotalProps imports SmallStep HoareTotalDef HoarePartialProps begin\n\nsubsection \\Soundness\\\n\nlemma hoaret_sound: \n assumes hoare: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ \\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Skip \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ \\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Basic f \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Spec r ,Normal s\\ \\ t\" \n \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n thus \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Spec r \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ r\" and exec_c2: \"\\\\\\c2,r\\ \\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: Fault_end)\n from valid_c1 ctxt exec_c1 P this\n have r: \"r \\ Normal ` R \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: exec_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s\\P\"\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c1,Normal s\\ \\ r\"\n have \"\\\\c2 \\ r\"\n proof (cases r)\n case (Normal r')\n with cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"r\\Normal ` R\"\n by auto\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n show \"\\\\c2 \\ r\"\n by auto\n qed auto \n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ \\ t\"\n by cases auto\n with P True \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ \\ t\"\n by cases auto\n with P False \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n thus \"\\\\Cond b c1 c2 \\ Normal s\"\n using cvalidt_termD [OF valid_c1 ctxt] cvalidt_termD [OF valid_c2 ctxt]\n by (cases \"s \\ b\") (auto intro: terminates.intros)\n qed\nnext\n case (While r \\ F P b c A)\n assume wf: \"wf r\"\n have valid_c: \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n using While.hyps by iprover\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume wprems: \"\\\\\\While b c,Normal s\\ \\ t\" \"s \\ P\" \"t \\ Fault ` F\"\n from wf\n have \"\\t. \\\\\\\\While b c,Normal s\\ \\ t; s \\ P; t \\ Fault ` F\\ \n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (induct)\n fix s t\n assume hyp: \n \"\\s' t. \\(s',s)\\r; \\\\\\While b c,Normal s'\\ \\ t; s' \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n assume exec: \"\\\\\\While b c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume b: \"s\\b\"\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\" \n assume exec_w: \"\\\\\\While b c,s'\\ \\ t\"\n from exec_w t_notin_F have \"s' \\ Fault ` F\"\n by (auto dest: Fault_end)\n from exec_c P b valid_c ctxt this\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P) \\ Abrupt ` A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n show ?thesis\n proof (cases s')\n case Normal \n with exec_w s' t_notin_F\n show ?thesis\n by - (rule hyp,auto)\n next\n case Abrupt\n with exec_w have \"t=s'\"\n by (auto dest: Abrupt_end)\n with Abrupt s' show ?thesis\n by blast\n next\n case Fault\n with exec_w have \"t=s'\"\n by (auto dest: Fault_end)\n with Fault s' show ?thesis\n by blast\n next\n case Stuck\n with exec_w have \"t=s'\"\n by (auto dest: Stuck_end)\n with Stuck s' show ?thesis\n by blast\n qed\n next\n assume \"s\\b\" \"t=Normal s\" with P show ?thesis by simp\n qed\n qed\n with wprems show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\" by blast\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"s \\ P\"\n with wf \n show \"\\\\While b c \\ Normal s\"\n proof (induct)\n fix s\n assume hyp: \"\\s'. \\(s',s)\\r; s' \\ P\\ \n \\ \\\\While b c \\ Normal s'\"\n assume P: \"s \\ P\"\n show \"\\\\While b c \\ Normal s\"\n proof (cases \"s \\ b\")\n case False with P show ?thesis\n by (blast intro: terminates.intros)\n next\n case True\n with valid_c P ctxt\n have \"\\\\c \\ Normal s\"\n by (simp add: cvalidt_def validt_def)\n moreover\n {\n fix s'\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases s')\n case (Normal s'')\n with exec_c P True valid_c ctxt\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P)\"\n by (fastforce simp add: cvalidt_def validt_def valid_def)\n then show ?thesis\n by (blast intro: hyp)\n qed auto\n }\n ultimately\n show ?thesis\n by (blast intro: terminates.intros)\n qed\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ (g \\ P)\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec g have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ P\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (CallRec P p Q A Specs r Specs_wf \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have wf: \"wf r\" by fact\n have Specs_wf: \n \"Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s, q),\\,p) \\ r},q,Q,A)) ` Specs)\" by fact\n from CallRec.hyps\n have valid_body: \n \"\\(P, p, Q, A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) the (\\ p) Q,A)\" by auto\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof -\n {\n fix \\p \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n from wf\n have \"\\\\ p P Q A. \\\\p = (\\,p); (P,p,Q,A) \\ Specs\\ \\ \n \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ (p))) Q,A\" \n proof (induct \\p rule: wf_induct [rule_format, consumes 1, case_names WF])\n case (WF \\p \\ p P Q A)\n have \\p: \"\\p = (\\, p)\" by fact\n have p: \"(P, p, Q, A) \\ Specs\" by fact\n {\n fix q P' Q' A'\n assume q: \"(P',q,Q',A') \\ Specs\"\n have \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' \\ {s. ((s,q), \\,p) \\ r}) (Call q) Q',A'\"\n proof (rule validtI)\n fix s t\n assume exec_q: \n \"\\\\\\Call q,Normal s\\ \\ t\"\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from Pre q \\p\n have valid_bdy: \n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') the (\\ q) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from exec_q show \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ q = Some bdy\"\n assume exec_bdy: \"\\\\\\bdy,Normal s\\ \\ t\"\n from valid_bdy [simplified bdy option.sel] t_notin_F exec_bdy Pre'\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (auto simp add: validt_def valid_def)\n with Pre q \n show ?thesis\n by auto\n next\n assume \"\\ q = None\"\n with q valid_body have False by auto\n thus ?thesis ..\n qed\n next\n fix s\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n from Pre q \\p\n have valid_bdy: \n \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') (the (\\ q)) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from valid_bdy ctxt Pre'\n have \"\\\\the (\\ q) \\ Normal s\"\n by (auto simp add: validt_def)\n with valid_body q \n show \"\\\\Call q\\ Normal s\"\n by (fastforce intro: terminates.Call)\n qed\n }\n hence \"\\(P, p, Q, A)\\Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by (auto simp add: cvalidt_def Specs_wf)\n with ctxt have \"\\(P, p, Q, A)\\\\ \\ Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by auto\n with p valid_body \n show \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (simp add: cvalidt_def) blast\n qed\n }\n note lem = this\n have valid_body': \n \"\\\\. \\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A \\ \n \\(P,p,Q,A)\\Specs. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (auto intro: lem)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_call: \"\\\\\\Call p,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n from exec_body bdy p P t_notin_F \n valid_body' [of \"s\", OF ctxt] \n ctxt\n have \"t \\ Normal ` Q \\ Abrupt ` A\"\n apply (simp only: cvalidt_def validt_def valid_def) \n apply (drule (1) bspec)\n apply auto\n done\n with p P \n show ?thesis\n by simp\n next\n assume \"\\ p = None\"\n with p valid_body have False by auto\n thus ?thesis by simp\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\"\n show \"\\\\Call p \\ Normal s\"\n proof -\n from ctxt P p valid_body' [of \"s\",OF ctxt]\n have \"\\\\(the (\\ p)) \\ Normal s\"\n by (auto simp add: cvalidt_def validt_def)\n with valid_body p show ?thesis\n by (fastforce intro: terminates.Call)\n qed\n qed\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A\" by simp\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ \\ t\" \n from cvalidt_postD [OF valid_c [rule_format, OF P] ctxt this P t_notin_F]\n show ?thesis .\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\DynCom c \\ Normal s\"\n proof -\n from cvalidt_termD [OF valid_c [rule_format, OF P] ctxt P]\n have \"\\\\c s \\ Normal s\" .\n thus ?thesis\n by (rule terminates.intros)\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ \\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n next\n fix s\n show \"\\\\Throw \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt s'\" \n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ \\ t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cvalidt_postD [OF valid_c2 ctxt] exec_c2 t_notin_F\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" \n assume notAbr: \"\\ isAbr t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P] t_notin_F\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s\" \n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt r\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"Abrupt r\\Normal ` Q \\ Abrupt ` R\"\n by auto\n hence \"Abrupt r\\Abrupt ` R\" by fast\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n have \"\\\\c\\<^sub>2 \\ Normal r\"\n by fast\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt: \n \"\\s \\ P. (\\P' Q' A'. (\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\" by blast\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from adapt [rule_format, OF P]\n obtain P' and Q' and A' where \n valid_P'_Q': \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n and weaken: \"s \\ P'\" \"Q' \\ Q\" \"A'\\ A\"\n by blast\n from exec valid_P'_Q' ctxt t_notin_F\n have P'_Q': \"Normal s \\ Normal ` P' \\ \n t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (unfold cvalidt_def validt_def valid_def) blast\n hence \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by blast\n with weaken \n show ?thesis\n by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from P adapt\n obtain P' and Q' and A' where \n \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n \"s \\ P'\"\n by blast\n with ctxt\n show ?thesis\n by (simp add: cvalidt_def validt_def)\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n assume \"(P, p, Q, A) \\ \\\"\n then show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: cvalidt_def )\nnext\n case ExFalso thus ?case by iprover\nqed\n\nlemma hoaret_sound':\n\"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (drule hoaret_sound)\n apply (simp add: cvalidt_def)\n done\n\ntheorem total_to_partial: \n assumes total: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" shows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from total have \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_sound)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cvalidt_def validt_def cvalid_def)\n thus ?thesis\n by (rule hoare_complete)\nqed\n\nsubsection \\Completeness\\\n\nlemma MGT_valid:\n\"\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s} c \n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validtI) \n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\" \n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\ \n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n apply (cases t) \n apply (auto simp add: final_notin_def)\n done\nnext\n fix s\n assume \"s \\ {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n thus \"\\\\c\\Normal s\"\n by blast\nqed\n\ntext \\The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of \\MGT_lemma\\.\\\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s}\n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n shows \"\\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT) \n apply (insert valid)\n apply (auto simp add: validt_def valid_def intro!: final_notinI)\n done\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\nlemma MGT_lemma:\n assumes MGT_Calls: \n \"\\p \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Skip \\ Normal s} \n Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Basic f \\ Normal s} \n Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Basic [THEN conseqPre]) \n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Spec r \\ Normal s} \n Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2) \n have hyp_c1: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s}\n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n have hyp_c2: \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s}\n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n from hyp_c1 \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Seq c1 c2\\Normal s} c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\ \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n elim: terminates_Normal_elim_cases \n intro: exec.intros)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s} \n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoaret.Seq )\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c2 \\ Normal t}\n c2 \n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (rule exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (rule exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2) \n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s} \n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\b) \n c1 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondTrue \n elim: terminates_Normal_elim_cases)\n moreover\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s} \n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\-b) \n c2 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondFalse \n elim: terminates_Normal_elim_cases)\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s} \n (Cond b c1 c2)\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Cond) \nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\"\n let ?A = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n let ?r = \"{(t,s). \\\\(While b c)\\Normal s \\ s\\b \\ \n \\\\\\c,Normal s\\ \\ Normal t}\"\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(While b c)\\Normal s} \n (While b c)\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"\\ Z. ?P' Z\" \n and ?Q'=\"\\ Z. ?P' Z \\ - b\"])\n have wf_r: \"wf ?r\" by (rule wf_terminates_while)\n show \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A Z)\"\n proof (rule allI, rule hoaret.While [OF wf_r])\n fix Z\n from While \n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n show \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ ?P' Z \\ b) c \n ({t. (t, \\) \\ ?r} \\ ?P' Z),(?A Z)\"\n proof (rule allI, rule ConseqMGT [OF hyp_c])\n fix \\ s\n assume \"s\\ {\\} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\n \\ b\"\n then obtain \n s_eq_\\: \"s=\\\" and\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n while_term: \"\\\\(While b c)\\Normal s\" and\n s_in_b: \"s\\b\" \n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal t} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (t,\\) \\ ?r} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b \n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\ \n \\\\(While b c)\\Normal t}) \\ \n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b while_term show ?C1 \n by (blast elim: terminates_Normal_elim_cases)\n next\n {\n fix t \n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n with s_eq_\\ while_term s_in_b have \"(t,\\) \\ ?r\"\n by blast\n moreover\n from Z_s_unroll s_t s_in_b \n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover from while_term s_t s_in_b \n have \"\\\\(While b c)\\Normal t\"\n by (blast elim: terminates_Normal_elim_cases)\n moreover note noabort\n ultimately \n have \"(t,\\) \\ ?r \\ (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\" \n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\While b c \\ Normal s}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\ \n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A s \\ t\\?A Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\" \n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\ \n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n \n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\" \n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body: \n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call p)\n from noStuck_Call\n have \"\\s \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal s}.\n p \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume p_defined: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \n \\\\\\Call p ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\\\Call p\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp: \n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c s'\\Normal s} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s} \n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp]) \n (fastforce simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Guard f g c\\ Normal s} \n Guard f g c \n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s \\ g \\ s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s} )\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Throw \\ Normal s}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>1 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \\\\c\\<^sub>2 \\ Normal t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n elim: terminates_Normal_elim_cases\n simp add: final_notin_def)\n moreover\n have \n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>2 \\ Normal s} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\ \\\\c\\<^sub>2 \\ Normal s \\ \n \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n simp add: noFault_def')\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Catch )\nqed\n\n\n\n\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step \n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n qed\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p, Normal \\) \\\\<^sup>+ (c',Normal s) \\ Throw \\ redexes c')}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp_c1:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ \n c\\<^sub>1 \\ redexes c')}\n c\\<^sub>1 \n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have hyp_c2:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\)\\\\<^sup>+(c',Normal s) \\\n Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault`(-F)) \\ \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\"\n proof (rule ConseqMGT [OF hyp_c1],clarify,safe) \n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c\\<^sub>1,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume c': \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n from steps redexes_subset [OF this]\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c\\<^sub>1 \\ redexes c'\"\n by (auto iff: root_in_redexes)\n next\n fix t\n assume \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c' t\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume red: \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal t) \\ c\\<^sub>2 \\ redexes c'\"\n proof -\n note steps_c'\n also\n from exec_impl_steps_Normal_Abrupt [OF exec_c\\<^sub>1]\n have \"\\\\ (c\\<^sub>1, Normal Z) \\\\<^sup>* (Throw, Normal t)\".\n from steps_redexes_Catch [OF this red] \n obtain c'' where\n steps_c'': \"\\\\ (c', Normal Z) \\\\<^sup>* (c'', Normal t)\" and\n Catch: \"Catch Throw c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps_c''\n also \n have step_Catch: \"\\\\ (Catch Throw c\\<^sub>2,Normal t) \\ (c\\<^sub>2,Normal t)\"\n by (rule step.CatchThrow)\n from step_redexes [OF step_Catch Catch]\n obtain c''' where\n step_c''': \"\\\\ (c'', Normal t) \\ (c''', Normal t)\" and\n c2: \"c\\<^sub>2 \\ redexes c'''\"\n by blast\n note step_c'''\n finally show ?thesis\n using c2\n by blast\n qed\n qed\n moreover\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp_c2]) (fastforce intro: exec.intros)\n ultimately show ?case\n by (rule hoaret.Catch)\nqed\n\n\ntext \\To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n\\\n\nlemma Call_lemma:\n assumes A: \n \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes pdef: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\\\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma' [OF A])\nusing pdef\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] root_in_redexes)\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\nusing p_defined\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] \nroot_in_redexes)\ndone\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext \\Another proof of \\MGT_Call\\, maybe a little more readable\\\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n define Specs where \"Specs = (\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n define Specs_wf where \"Specs_wf p \\ = (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs\" for p \\\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format, OF _ defined])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\n\ntheorem hoaret_complete: \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Call])\n\nlemma hoaret_complete': \n assumes cvalid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_complete)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\nsubsection \\And Now: Some Useful Rules\\\n\nsubsubsection \\Modify Return\\\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\(Call p),Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr, \n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p) ,Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also \n from exec_body bdy\n have \"\\\\\\Call p ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturnSameFaults_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\n\nsubsubsection \\DynCall\\\n\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.Call)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \n \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturn_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturnSameFaults_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nsubsubsection \\Conjunction of Postcondition\\\n\nlemma PostConjI_sound:\n assumes valid_Q: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_R: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n moreover\n from valid_R ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cvalidt_postD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nnext \n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from valid_Q ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n assumes deriv_R: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoaret_complete')\napply (rule PostConjI_sound)\napply (rule hoaret_sound [OF deriv_Q])\napply (rule hoaret_sound [OF deriv_R])\ndone\n\n\nlemma Merge_PostConj_sound: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n by (auto intro: validt_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cvalidt_postD [OF validF [rule_format] ctxt exec P t_noFault]\n have t: \"t \\ Normal ` Q \\ Abrupt ` A\".\n then have \"t \\ Fault ` G\"\n by auto\n from cvalidt_postD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n with t show ?thesis by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from validF ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\n\n\nlemma Merge_PostConj: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoaret_complete')\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoaret_sound)\nusing validG apply (blast intro:hoaret_sound)\ndone\n\n\nsubsubsection \\Guards and Guarantees\\\n\nlemma SplitGuards_sound:\n assumes valid_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes valid_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def) \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case Abrupt\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case (Fault f)\n assume t: \"t=Fault f\"\n with exec inter_guards_exec_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f\"\n from cvalidt_postD [OF valid_c1 ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n from cvalidD [OF valid_c2 ctxt' this P] t t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1 \\ Normal s\"\n by (rule cvalidt_termD)\n with c show ?thesis\n by (rule inter_guards_terminates)\n qed\nqed\n\nlemma SplitGuards: \n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SplitGuards_sound [OF _ _ c])\napply (rule hoaret_sound [OF deriv_c1])\napply (rule hoare_sound [OF deriv_c2])\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n from ctxt have ctxt'': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt'' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt'' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ \\ Fault f\" \n by (auto intro: exec_to_exec_strip_guards_Fault)\n from cvalidD [OF valid_strip ctxt' this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt'' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt'' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule CombineStrip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n from ctxt have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cvalidD [OF validFlip ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\n\nlemma GuardsFlip: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule GuardsFlip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\mark_guards f c,Normal s\\ \\ t\" \n from exec_mark_guards_to_exec [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\mark_guards f c \\ Normal s\"\n by (rule terminates_to_terminates_mark_guards)\nqed\n\nlemma MarkGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\n\nlemma MarkGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with exec_to_exec_mark_guards_Fault exec\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from exec_to_exec_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n by auto\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\mark_guards f c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_mark_guards_to_terminates)\nqed\n\nlemma MarkGuardsD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\"\n from exec_merge_guards_to_exec [OF exec_merge] \n have exec: \"\\\\\\c,Normal s\\ \\ t\" .\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\merge_guards c \\ Normal s\"\n by (rule terminates_to_terminates_merge_guards)\nqed\n\nlemma MergeGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoaret_complete')\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_merge_guards [OF exec] \n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\".\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\merge_guards c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_merge_guards_to_terminates)\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have termi_c': \"\\\\c' \\ Normal s\".\n from cvalidt_postD [OF valid ctxt _ P]\n have noFault_c': \"\\\\\\c',Normal s\\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def)\n from termi_c' c_c' noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule terminates_fewer_guards)\nqed\n\nlemma SubsetGuards: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n hence exec_norm: \"\\\\\\normalize c,Normal s\\ \\ t\" \n by (rule exec_to_exec_normalize)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\normalize c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_normalize_to_terminates)\nqed\n\nlemma NormalizeD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume \"\\\\\\normalize c,Normal s\\ \\ t\" \n hence exec: \"\\\\\\c,Normal s\\ \\ t\" \n by (rule exec_normalize_to_exec)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\ c \\ Normal s\".\n thus \"\\\\normalize c \\ Normal s\"\n by (rule terminates_to_terminates_normalize)\nqed\n\nlemma NormalizeI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nsubsubsection \\Restricting the Procedure Environment\\\n\nlemma validt_restrict_to_validt:\nassumes validt_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from validt_c\n have valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\" by (simp add: validt_def)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule valid_restrict_to_valid)\n moreover\n {\n fix s\n assume P: \"s \\ P\"\n have \"\\\\c\\Normal s\"\n proof -\n from P validt_c have \"\\|\\<^bsub>M\\<^esub>\\c\\Normal s\"\n by (auto simp add: validt_def)\n moreover\n from P valid_c\n have \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\\\{Stuck}\"\n by (auto simp add: valid_def final_notin_def)\n ultimately show ?thesis\n by (rule terminates_restrict_to_terminates)\n qed\n }\n ultimately show ?thesis\n by (auto simp add: validt_def)\nqed\n\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_restrict_to_validt)\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nsubsubsection \\Miscellaneous\\\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_augment_Faults [OF _ F])\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nlemma TerminationPartial_sound:\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n assumes partial_corr: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing \"termination\" partial_corr \nby (auto simp add: cvalidt_def validt_def cvalid_def)\n\nlemma TerminationPartial:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete')\n apply (rule TerminationPartial_sound [OF \"termination\"])\n apply (rule hoare_sound [OF partial_deriv])\n done\n\nlemma TerminationPartialStrip:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. strip F' \\\\strip_guards F' c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from \"termination\" have \"\\s \\ P. \\\\c\\Normal s\"\n by (auto intro: terminates_strip_guards_to_terminates \n terminates_strip_to_terminates)\n with partial_deriv\n show ?thesis\n by (rule TerminationPartial)\nqed\n\nlemma SplitTotalPartial:\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nlemma SplitTotalPartial':\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoareTotalProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2929222070130459}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | March 2007 |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_law_fix\nimports CSP_T_law_fp\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\ndefinition\n FIXn :: \"nat => ('p => ('p,'a) proc) => ('p => ('p,'a) proc)\"\n (\"FIX[_] _\" [0,1000] 55)\n where\n FIXn_def : \"FIX[n] Pf == ((Pf <<< )^^n) (%q. DIV)\"\n \ndefinition\n FIX :: \"(('p) => ('p,'a) proc) => ('p => ('p,'a) proc)\"\n (\"FIX _\" [1000] 55)\n where\n FIX_def : \"FIX Pf == (%p. (!nat n .. ((FIX[n] Pf) p)))\"\n\n(* ----- test ----- *\nconsts\n FIXnrec :: \"nat => ('p => ('p,'a) proc) => ('p => ('p,'a) proc)\"\n (\"FIXrec[_] _\" [0,1000] 55)\nprimrec\n \"FIXrec[0] Pf = (%p. DIV)\"\n \"FIXrec[Suc n] Pf = (%p. (Pf p)<<(FIXrec[n] Pf))\"\n\nlemma FIXn_FIXnrec: \"FIX[n] Pf = FIXrec[n] Pf\"\napply (induct_tac n)\napply (simp_all add: FIXn_def)\ndone\n\n * ----- test ----- *)\n\n(*-----------*\n | noPN |\n *-----------*)\n\nlemma noPNfun_FIXn: \"noPNfun (%p. (FIX[n] Pf)(p))\"\napply (simp add: FIXn_def)\napply (induct_tac n)\napply (simp add: noPNfun_def)\napply (simp (no_asm) add: noPNfun_def)\napply (intro allI)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: noPN_Subst_Pf)\ndone\n\nlemma noPN_FIXn: \"noPN ((FIX[n] Pf)p)\"\napply (insert noPNfun_FIXn[of _ Pf])\napply (simp add: noPNfun_def)\ndone\n\nlemma noPN_FIX: \"noPN ((FIX Pf) p)\"\napply (simp add: FIX_def)\napply (simp add: noPN_FIXn)\ndone\n\n(*-----------*\n | Bot |\n *-----------*)\n\nlemma traces_prod_Bot: \"(%p. traces DIV M) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: fun_eq_iff)\napply (simp add: traces_iff)\napply (simp add: bottom_domT_def)\ndone\n\nlemma semT_prod_Bot: \"(%p. [[DIV]]T) = Bot\"\nby (simp add: semT_def semTf_def traces_prod_Bot)\n\n(*-----------*\n | FIX P |\n *-----------*)\n\nlemma traces_subst_Bot: \"traces (P<<(%q. DIV)) M = (traces P) Bot\"\napply (induct_tac P)\napply (simp_all add: traces_iff)\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domT_def)\ndone\n\nlemma traces_iteration_semTfun_Bot:\n \"ALL p. traces (((Pf <<<) ^^ n) (%q. DIV) p) M = ([[Pf]]Tfun ^^ n) Bot p\"\napply (simp add: semTfun_def)\napply (simp add: semTf_def)\napply (induct_tac n)\n\n(* base *)\napply (simp_all add: traces_iff)\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domT_def)\n\n(* step *)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: traces_subst)\ndone\n\nlemma traces_FIX:\n \"traces ((FIX Pf) p) M\n = UnionT {u. EX n. u = ([[Pf]]Tfun ^^ n) Bot p}\"\napply (simp add: FIX_def FIXn_def)\napply (subgoal_tac \"{u. EX n. u = ([[Pf]]Tfun ^^ n) Bot p} ~= {}\")\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"traces (((Pf <<<) ^^ n) (%q. DIV) p) M\" in exI)\n apply (simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp add: traces_iteration_semTfun_Bot)\n\n (* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (rule disjI2)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"na\" in exI)\n apply (simp add: traces_iteration_semTfun_Bot)\n\nby (auto)\n\n(*** [[ ]]T ***)\n\nlemma semT_FIX:\n \"[[(FIX Pf) p]]T\n = UnionT {u. EX n. u = ([[Pf]]Tfun ^^ n) Bot p}\"\napply (simp add: semT_def semTf_def)\napply (simp add: traces_FIX)\ndone\n\n(*** FIX is LUB ***)\n\nlemma semT_FIX_isLUB:\n \"(%p. [[(FIX Pf) p]]T) isLUB {x. EX n. x = ([[Pf]]Tfun ^^ n) Bot}\"\napply (simp add: prod_LUB_decompo)\napply (intro allI)\napply (simp add: proj_fun_def)\napply (simp add: image_def)\napply (simp add: semT_FIX)\napply (subgoal_tac \n \"{y. EX x. (EX n. x = ([[Pf]]Tfun ^^ n) Bot) & y = x i} =\n {u. EX n. u = ([[Pf]]Tfun ^^ n) Bot i}\")\napply (simp)\napply (rule UnionT_isLUB)\napply (auto)\ndone\n\nlemma semT_FIX_LUB:\n \"(%p. [[(FIX Pf) p]]T) = LUB {x. EX n. x = ([[Pf]]Tfun ^^ n) Bot}\"\napply (rule sym)\napply (rule isLUB_LUB)\napply (simp add: semT_FIX_isLUB)\ndone\n\nlemma semT_FIX_LFP:\n \"(%p. [[(FIX Pf) p]]T) = LFP [[Pf]]Tfun\"\napply (simp add: semT_FIX_LUB)\napply (simp add: Tarski_thm_LFP_LUB continuous_semTfun)\ndone\n\nlemma semT_FIX_LFP_p:\n \"[[(FIX Pf) p]]T = LFP [[Pf]]Tfun p\"\napply (insert semT_FIX_LFP[of Pf])\napply (simp add: fun_eq_iff)\ndone\n\nlemma semT_FIX_isLFP:\n \"(%p. [[(FIX Pf) p]]T) isLFP [[Pf]]Tfun\"\napply (simp add: semT_FIX_LFP)\napply (simp add: LFP_is Tarski_thm_EX continuous_semTfun)\ndone\n\nlemma semT_FIX_LFP_fixed_point:\n \"[[Pf]]Tfun (%p. [[(FIX Pf) p]]T) = (%p. [[(FIX Pf) p]]T)\"\napply (insert semT_FIX_isLFP[of Pf])\napply (simp add: isLFP_def)\ndone\n\nlemma semT_FIX_LFP_least:\n \"ALL Tf. [[Pf]]Tfun Tf = Tf --> (%p. [[(FIX Pf) p]]T) <= Tf\"\napply (insert semT_FIX_isLFP[of Pf])\napply (simp add: isLFP_def)\ndone\n\n(*=======================================================*\n | |\n | CPO |\n | |\n *=======================================================*)\n\nlemma cspT_FIX_cpo:\n \"[| FPmode = CPOmode |\n FPmode = MIXmode ;\n Pf = PNfun |]\n ==> $p =T (FIX Pf)(p)\"\napply (simp add: eqT_def)\napply (fold semT_def)\napply (simp add: semT_FIX_LFP_p)\napply (simp add: semT_LFP_cpo)\ndone\n\nlemma cspT_FIX_cms:\n \"[| FPmode = CMSmode ;\n Pf = PNfun ;\n guardedfun (Pf) |]\n ==> $p =T (FIX Pf)(p)\"\napply (simp add: eqT_def)\napply (fold semT_def)\napply (simp add: semT_FIX_LFP_p)\napply (simp add: semT_guarded_LFP_UFP)\napply (simp add: semT_UFP_cms)\ndone\n\nlemma cspT_FIX:\n \"[| FPmode = CPOmode | \n FPmode = CMSmode & guardedfun (Pf) |\n FPmode = MIXmode ;\n Pf = PNfun |]\n ==> $p =T (FIX Pf)(p)\"\napply (erule disjE)\napply (simp add: cspT_FIX_cpo)\napply (erule disjE)\napply (simp add: cspT_FIX_cms)\napply (simp add: cspT_FIX_cpo)\ndone\n\n(*==============================================================*\n | |\n | replace process names by infinite repcicated internal choice |\n | rmPN (FIX) |\n | |\n *==============================================================*)\n\nprimrec \n rmPN :: \"('p,'a) proc => ('p,'a) proc\"\nwhere\n \"rmPN(STOP) = STOP\"\n |\"rmPN(SKIP) = SKIP\"\n |\"rmPN(DIV) = DIV\"\n |\"rmPN(a -> P) = a -> (rmPN P)\"\n |\"rmPN(? :A -> Pf) = ? a:A -> (rmPN (Pf a))\"\n |\"rmPN(P [+] Q) = (rmPN P) [+] (rmPN Q)\"\n |\"rmPN(P |~| Q) = (rmPN P) |~| (rmPN Q)\"\n |\"rmPN(!! :C .. Pf) = !! c:C .. rmPN (Pf c)\"\n |\"rmPN(IF b THEN P ELSE Q) = (IF b THEN rmPN(P) ELSE rmPN(Q))\"\n |\"rmPN(P |[X]| Q) = (rmPN P) |[X]| (rmPN Q)\"\n |\"rmPN(P -- X) = (rmPN P) -- X\"\n |\"rmPN(P [[r]]) = (rmPN P) [[r]]\"\n |\"rmPN(P ;; Q) = (rmPN P) ;; (rmPN Q)\"\n |\"rmPN(P |. n) = (rmPN P) |. n\"\n |\"rmPN($p) = (FIX PNfun)(p)\"\n\nlemma noPN_rmPN: \"noPN (rmPN P)\"\napply (induct_tac P)\napply (simp_all)\napply (simp add: noPN_FIX)\ndone\n\nlemma cspT_rmPN_eqT:\n \"FPmode = CPOmode | \n FPmode = CMSmode & guardedfun (PNfun::('p=>('p,'a) proc)) |\n FPmode = MIXmode \n ==> (P::('p,'a) proc) =T rmPN(P)\"\napply (induct_tac P)\napply (simp_all add: cspT_decompo)\napply (rule cspT_FIX)\napply (simp_all)\ndone\n\n(*-------------------------------------------------------*\n | |\n | FIX expansion (CSP-Prover intro rule) |\n | |\n *-------------------------------------------------------*)\n\nlemma traces_FIXn_plus_sub_lm:\n \"ALL n m p. traces ((FIX[n] Pf) p) M <= traces ((FIX[n+m] Pf) p) M\"\napply (rule)\napply (induct_tac n)\napply (simp add: FIXn_def Subst_procfun_prod_def)\napply (intro allI)\napply (rule)\napply (simp add: in_traces)\n\napply (rule allI)\napply (simp add: FIXn_def Subst_procfun_prod_def)\napply (drule_tac x=\"m\" in spec)\napply (simp add: traces_subst)\napply (rule allI)\napply (fold order_prod_def)\napply (simp add: mono_traces[simplified mono_def])\ndone\n\nlemma traces_FIXn_plus_sub: \n \"traces ((FIX[n] Pf) p) M <= traces ((FIX[n+m] Pf) p) M\"\nby (simp add: traces_FIXn_plus_sub_lm)\n\nlemma semT_FIXn_plus_sub:\n \"[[(FIX[n] Pf) p]]Tf M <= [[(FIX[n+m] Pf) p]]Tf M\"\napply (simp add: semTf_def)\napply (simp add: traces_FIXn_plus_sub)\ndone\n\nlemma in_traces_FIXn_plus_sub: \n \"t :t traces ((FIX[n] Pf) p) M ==> t :t traces ((FIX[n+m] Pf) p) M\"\napply (insert traces_FIXn_plus_sub[of n Pf p M m])\nby (auto)\n\n(*-----------------------------------------------------*\n | sometimes FIX[n + f n] is useful more than FIX[n] |\n *-----------------------------------------------------*)\n\nlemma cspT_FIX_plus_eq: \n \"ALL f p. (FIX Pf) p =T[M,M] (!nat n .. ((FIX[n + f n] Pf) p))\"\napply (simp add: FIX_def)\napply (simp add: eqT_def)\napply (intro allI)\napply (simp add: semTf_def)\napply (rule order_antisym)\n\n apply (rule)\n apply (simp add: in_traces)\n apply (rule disjI2)\n apply (elim conjE exE disjE, simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp add: in_traces_FIXn_plus_sub)\n\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"n + f n\" in exI)\n apply (simp)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(* 2017\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_fix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6406358548398979, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2928581713634865}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: IK.thy (Isabelle/HOL 2016-1)\n ID: $Id: IK.thy 132882 2016-12-23 09:03:55Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n State with intruder knowledge and corresponding Dolev-Yao derivation event.\n - This is used a building block for Secrecy model. \n - The attacker event is also used by level-3 models.\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Environment: Dolev-Yao Intruder\\\n\ntheory IK\nimports Message_derivation \nbegin\n\ntext \\Basic state contains intruder knowledge. The secrecy model and concrete Level 1 \nstates will be record extensions of this state.\\\n\nrecord ik_state =\n ik :: \"msg set\"\n\n\ntext \\Dolev-Yao intruder event adds a derived message.\\\n\ndefinition\n ik_dy :: \"msg \\ ('a ik_state_scheme * 'a ik_state_scheme) set\"\nwhere\n \"ik_dy m \\ {(s, s').\n \\ \\guard\\\n m \\ synth (analz (ik s)) \\\n\n \\ \\action\\\n s' = s \\ik := ik s \\ {m}\\\n }\"\n\ndefinition\n ik_trans :: \"('a ik_state_scheme * 'a ik_state_scheme) set\"\nwhere\n \"ik_trans \\ (\\ m. ik_dy m)\"\n\nlemmas ik_trans_defs = ik_trans_def ik_dy_def\n\n\nlemma ik_trans_ik_increasing: \"(s, s') \\ ik_trans \\ ik s \\ ik s'\"\nby (auto simp add: ik_trans_defs)\n\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/IK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321964553657, "lm_q2_score": 0.41111086923216805, "lm_q1q2_score": 0.29280639737990166}} {"text": "theory flash90Bra imports flash90Rev\n \n begin\nlemma onInv90:\n\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" and \n\n b1:\"r \\ rules N\" and b2:\"invf=inv90 iInv1 iInv2 \"\n shows \"invHoldForRule' s invf r (invariants N)\" \n proof - \nhave c1:\"ex1P N (% iRule1 . r=NI_Local_GetX_PutX1 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_GetX iRule1 )\\ex1P N (% iRule1 . r=NI_Replace iRule1 )\\ex0P N ( r=NI_ShWb N )\\ex0P N ( r=PI_Local_GetX_GetX2 )\\ex0P N ( r=NI_Local_PutXAcksDone )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX7 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak2 iRule1 )\\ex0P N ( r=NI_ReplaceHomeShrVld )\\ex1P N (% iRule1 . r=NI_Remote_Put iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX5 N iRule1 )\\ex0P N ( r=NI_Wb )\\ex1P N (% iRule1 . r=NI_Local_Get_Get iRule1 )\\ex0P N ( r=PI_Local_Replace )\\ex1P N (% iRule1 . r=NI_ReplaceShrVld iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX8 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_InvAck_2 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Nak2 iRule1 iRule2 )\\ex1P N (% iRule1 . r=PI_Remote_Replace iRule1 )\\ex0P N ( r=NI_Nak_Home )\\ex1P N (% iRule1 . r=NI_Local_Get_Put2 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_InvAck_1 iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX11 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX6 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Put2 iRule1 iRule2 )\\ex0P N ( r=PI_Local_Get_Put )\\ex0P N ( r=PI_Local_GetX_PutX1 N )\\ex1P N (% iRule1 . r=NI_InvAck_1_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak2 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX10_home N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_Get iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak3 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX10 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX2 N iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Put1 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_PutX iRule1 )\\ex1P N (% iRule1 . r=Store iRule1 )\\ex0P N ( r=NI_FAck )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX3 N iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX3 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_PutX iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX8_home N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put1 N iRule1 )\\ex0P N ( r=PI_Local_GetX_GetX1 )\\ex0P N ( r=StoreHome )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_Nak iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Inv iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_PutX iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX4 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX4 N iRule1 )\\ex1P N (% iRule1 . r=NI_Nak iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX2 N )\\ex0P N ( r=NI_Local_Put )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak1 iRule1 )\\ex0P N ( r=NI_Nak_Clear )\\ex0P N ( r=PI_Local_PutX )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak3 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_GetX_Nak_Home iRule1 )\\ex0P N ( r=PI_Local_Get_Get )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX9 N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_GetX iRule1 )\\ex0P N ( r=NI_ReplaceHome )\\ex1P N (% iRule1 . r=NI_Remote_GetX_PutX_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put3 iRule1 )\" \n\n apply(cut_tac b1)\n apply auto\n done moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_GetXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ShWb N )\n\"\n \n from c1 have c2:\" r= NI_ShWb N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ShWb N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ShWbVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX2 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_PutXAcksDone )\n\"\n \n from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutXAcksDoneVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX7 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX7 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX7VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHomeShrVld )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeShrVldVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Put iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Put iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX5 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX5 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX5VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Wb )\n\"\n \n from c1 have c2:\" r= NI_Wb \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Wb ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_WbVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_GetVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Replace )\n\"\n \n from c1 have c2:\" r= PI_Local_Replace \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_ReplaceVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_ReplaceShrVld iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_ReplaceShrVld iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceShrVldVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX8 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX8 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Nak2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Nak2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_ReplaceVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Home )\n\"\n \n from c1 have c2:\" r= NI_Nak_Home \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_HomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_InvAck_1 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_InvAck_1 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX11 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX11 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX11VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX6 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX6 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX6VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Put2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Put2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Put )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_PutVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX1 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_1_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_1_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1_HomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX10_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX10_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10_homeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak3VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX10 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX10 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Put1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Put1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= Store iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= Store iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (Store iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis StoreVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_FAck )\n\"\n \n from c1 have c2:\" r= NI_FAck \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_FAck ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_FAckVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX3 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX3 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX3VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX3 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX3VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_PutX iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_PutX iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX8_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX8_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8_homeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX1 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= StoreHome )\n\"\n \n from c1 have c2:\" r= StoreHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (StoreHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis StoreHomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_Nak iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_Nak iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_NakVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Inv iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Inv iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_PutXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX4 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX4VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX4 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX4 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX4VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Nak iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Nak iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_NakVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX2 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX2VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_Put )\n\"\n \n from c1 have c2:\" r= NI_Local_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak1VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Clear )\n\"\n \n from c1 have c2:\" r= NI_Nak_Clear \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_ClearVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_PutX )\n\"\n \n from c1 have c2:\" r= PI_Local_PutX \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_PutXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak3VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_Nak_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_Nak_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_Nak_HomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Get )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Get \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_GetVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX9 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX9 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX9VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetXVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHome )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_PutX_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_PutX_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutX_HomeVsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put3VsInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n by blast \n qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash90Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2927832045933706}} {"text": "section {*FUNCTION\\_CFG\\_ENFORCE\\_ACCESSIBILITY\\_cfgLM*}\ntheory\n FUNCTION_CFG_ENFORCE_ACCESSIBILITY_cfgLM\n\nimports\n FUNCTION_CFG_ENFORCE_ACCESSIBILITY_cfgLM_EXTRA\n\nbegin\n\ndefinition F_CFG_EASTD_ALT :: \"\n ('nonterminal, 'event) cfg\n \\ ('nonterminal, 'event) cfg\"\n where\n \"F_CFG_EASTD_ALT G \\\n let\n N = F_CFG_APLM__fp G (cfg_nonterminals G) {cfg_initial G}\n in\n \\cfg_nonterminals = N,\n cfg_events = cfg_events G,\n cfg_initial = cfg_initial G,\n cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ N}\\\"\n\ndefinition F_CFG_EASTD__SpecInput :: \"\n ('nonterminal, 'event) cfg\n \\ bool\"\n where\n \"F_CFG_EASTD__SpecInput G \\\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\"\n\ndefinition F_CFG_EASTD__SpecOutput :: \"\n ('nonterminal, 'event) cfg\n \\ ('nonterminal, 'event) cfg\n \\ bool\"\n where\n \"F_CFG_EASTD__SpecOutput Gi Go \\\n valid_cfg Go\n \\ cfg_sub Go Gi\n \\ cfgLM.marked_language Go = cfgLM.marked_language Gi\n \\ cfgLM.initial_marking_derivations Go = cfgLM.initial_marking_derivations Gi\n \\ cfg_nonterminals Go = cfgLM_accessible_nonterminals Gi \\ cfgSTD_Nonblockingness_nonterminals Gi\n \\ cfg_nonterminals Go = cfgLM_accessible_nonterminals Go \\ cfgSTD_Nonblockingness_nonterminals Go\n \\ cfg_nonterminals Go = cfgLM_language_relevant_nonterminals Go\n \\ cfg_productions Go = cfgLM_language_relevant_productions Go\n \\ cfgLM.marked_language Go \\ {}\"\n\nlemma F_CFG_EASTD_ALT_preserves_valid_cfg: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ valid_cfg (F_CFG_EASTD_ALT G)\"\n apply(simp add: F_CFG_EASTD_ALT_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(simp (no_asm) add: Let_def valid_cfg_def)\n apply(rule conjI)\n apply(simp add: Let_def valid_cfg_def)\n apply(rule conjI)\n apply(rule_tac\n B=\"cfgLM_accessible_nonterminals G\"\n in finite_subset)\n apply(simp (no_asm_simp))\n apply(rule_tac\n B=\"cfg_nonterminals G\"\n in finite_subset)\n apply(simp (no_asm) add: cfgLM_accessible_nonterminals_def)\n apply(force)\n apply(simp add: Let_def valid_cfg_def)\n apply(rule conjI)\n apply(rule_tac\n A=\"cfgLM_accessible_nonterminals G\"\n in set_mp)\n apply(simp (no_asm_simp))\n apply(simp (no_asm) add: cfgLM_accessible_nonterminals_def)\n apply(rule conjI)\n apply(simp add: valid_cfg_def)\n apply(rule_tac\n x=\"der1 \\cfg_conf=[teA (cfg_initial G)]\\\"\n in exI)\n apply(rule conjI)\n apply(rule cfgLM.derivation_initialI)\n apply(rule cfgLM.der1_is_derivation)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(clarsimp)\n apply(simp add: valid_cfg_def cfg_initial_configurations_def cfg_configurations_def)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(simp add: get_configuration_def der1_def)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(force)\n apply(rule conjI)\n apply(simp add: Let_def valid_cfg_def)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(force)\n apply(thin_tac \"cfgLM_accessible_nonterminals G = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\")\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(rule conjI)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(simp add: valid_cfg_def)\n apply(rename_tac e)(*strict*)\n apply(rule one_step_preserves_cfgLM_accessible_nonterminals)\n apply(rename_tac e)(*strict*)\n apply(force)+\n done\n\nlemma F_CFG_EASTD_ALT_is_cfg_sub: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ cfg_sub (F_CFG_EASTD_ALT G) G\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(force)\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(simp add: cfg_sub_def)\n apply(rule conjI)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(force)\n apply(rule_tac\n t=\"cfgSTD_Nonblockingness_nonterminals G\"\n and s=\"cfg_nonterminals G\"\n in ssubst)\n apply(force)\n apply(simp (no_asm) add: cfgLM_accessible_nonterminals_def)\n apply(force)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_preserves_language: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ cfgLM.marked_language G = cfgLM.marked_language (F_CFG_EASTD_ALT G)\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_is_cfg_sub)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(force)\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(rule antisym)\n prefer 2\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: cfgLM.marked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d)(*strict*)\n prefer 2\n apply(rule cfg_sub_preserves_cfgLM_derivation_initial)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfg_marked_effect_def)\n apply(rename_tac x d)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfgLM.derivation_initial_def)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfg_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac x d e c i)(*strict*)\n apply(simp add: cfg_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac x d e c i ia ea ca)(*strict*)\n apply(simp add: cfg_marking_configuration_def)\n apply(clarsimp)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(clarsimp)\n apply(rule cfgLM.belongs_configurations)\n apply(rename_tac x d e c i ia ea ca)(*strict*)\n apply(rule cfgLM.derivation_initial_belongs)\n apply(rename_tac x d e c i ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac x d e c i ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac x d e c i ia ea ca)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: cfgLM.marked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac x d)(*strict*)\n prefer 2\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfg_marked_effect_def)\n apply(rename_tac x d)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfgLM.derivation_initial_def)\n apply(rename_tac x d)(*strict*)\n apply(simp add: cfg_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(clarsimp)\n apply(simp add: cfg_marking_configuration_def cfg_configurations_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(rule cfg_sub_preserves_derivation_initial_contra)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(rule allI)+\n apply(rename_tac x d i e c)(*strict*)\n apply(rule impI)\n apply(rule cfg_sub_preserves_derivation_initial_contra2)\n apply(rename_tac x d i e c)(*strict*)\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x d i e c)(*strict*)\n apply(force)\n apply(rename_tac x d i e c)(*strict*)\n apply(thin_tac \"cfgLM_accessible_nonterminals G = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\")\n apply(clarsimp)\n apply(rename_tac x d i e c ea ca c')(*strict*)\n apply(simp add: cfgLM_step_relation_def cfg_configurations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c ea c' l r)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(case_tac c')\n apply(rename_tac x d i e c ea c' l r cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(rule conjI)\n apply(rename_tac x d i e c ea l r)(*strict*)\n prefer 2\n apply(simp add: cfg_sub_def valid_cfg_def)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(rule one_step_preserves_cfgLM_accessible_nonterminals)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(force)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(force)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(force)\n apply(rename_tac x d i e c ea l r)(*strict*)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_idemp_cfgLM_accessible_nonterminals: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ cfgLM_accessible_nonterminals (F_CFG_EASTD_ALT G) = cfgLM_accessible_nonterminals G\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_is_cfg_sub)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(rule antisym)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: cfgLM_accessible_nonterminals_def)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ cfgLM_accessible_nonterminals G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule_tac\n s=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and t=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\")\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp (no_asm_use) add: cfgLM_accessible_nonterminals_def)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c w1 w2)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(rule_tac\n t=\"\\cfg_nonterminals = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}, cfg_events = cfg_events G, cfg_initial = cfg_initial G, cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ cfgSTD_Nonblockingness_nonterminals G \\ (\\d. cfgLM.derivation_initial G d \\ (\\n c. get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA (prod_lhs p) # w2)))}\\\"\n and s=\"\\cfg_nonterminals = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}, cfg_events = cfg_events G, cfg_initial = cfg_initial G, cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}}\\\"\n in ssubst)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(simp add: cfgLM_accessible_nonterminals_def)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"{A \\ cfgSTD_Nonblockingness_nonterminals G. \\d. cfgLM.derivation_initial G d \\ (\\n c. get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2))}\"\n in ssubst)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(rule cfg_sub_preserves_derivation_initial_contra)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(rule allI)+\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(rule impI)\n apply(rule cfg_sub_preserves_derivation_initial_contra2)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"{A \\ cfgSTD_Nonblockingness_nonterminals G. \\d. cfgLM.derivation_initial G d \\ (\\n c. get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2))}\"\n in ssubst)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(thin_tac \"{A \\ cfgSTD_Nonblockingness_nonterminals G. \\d. cfgLM.derivation_initial G d \\ (\\n c. get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2))} = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\")\n apply(rename_tac x d n c w1 w2 i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 i e ca ea cb c')(*strict*)\n apply(simp add: cfgLM_step_relation_def cfg_configurations_def)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 i e ca ea c' l r)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(case_tac c')\n apply(rename_tac x d n c w1 w2 i e ca ea c' l r cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(rule conjI)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n prefer 2\n apply(simp add: cfg_sub_def valid_cfg_def)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(rule_tac\n t=\"{A \\ cfgSTD_Nonblockingness_nonterminals G. \\d. cfgLM.derivation_initial G d \\ (\\n c. get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2))}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(simp (no_asm_use) add: cfgLM_accessible_nonterminals_def)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(rule one_step_preserves_cfgLM_accessible_nonterminals)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(force)\n apply(rename_tac x d n c w1 w2 i e ca ea l r da na cb w1a w2a)(*strict*)\n apply(simp (no_asm_use) add: cfgLM_accessible_nonterminals_def)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_preserves_Eliminability: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ cfg_nonterminals (F_CFG_EASTD_ALT G) = cfgLM_accessible_nonterminals (F_CFG_EASTD_ALT G) \\ cfgSTD_Nonblockingness_nonterminals (F_CFG_EASTD_ALT G)\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_idemp_cfgLM_accessible_nonterminals)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_is_cfg_sub)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(rule inter_eq_intro)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n prefer 2\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ {A \\ cfg_nonterminals G. \\d n c. cfgLM.derivation_initial G d \\ get_configuration (d n) = Some c \\ (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2)}\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(unfold cfgLM_accessible_nonterminals_def)[1]\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\")\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(subgoal_tac \"x \\ {A \\ cfg_nonterminals G. \\d w'. cfgSTD.derivation_from_to G d {pair None \\cfg_conf = [teA A]\\} ({y. (\\x. y = pair x \\cfg_conf = w'\\)}) \\ setA w' = {}}\")\n apply(rename_tac x d n c w1 w2)(*strict*)\n prefer 2\n apply(simp (no_asm_use) only: cfgSTD_Nonblockingness_nonterminals_def)\n apply(rename_tac x d n c w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 da w')(*strict*)\n apply(subgoal_tac \"\\d n e. cfgSTD.derivation G d \\ d 0 = Some (pair None \\cfg_conf = [teA x]\\) \\ d n = Some (pair e \\cfg_conf = w'\\)\")\n apply(rename_tac x d n c w1 w2 da w')(*strict*)\n prefer 2\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(simp add: cfgSTD.derivation_to_def cfgSTD.derivation_from_def cfgSTD.derivation_from_to_def )\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 da w' na xa)(*strict*)\n apply(case_tac \"da 0\")\n apply(rename_tac x d n c w1 w2 da w' na xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 da w' na xa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 da w' na xa)(*strict*)\n apply(rule_tac\n x=\"na\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 da w')(*strict*)\n apply(thin_tac \"cfgSTD.derivation_from_to G da {pair None \\cfg_conf = [teA x]\\} ({y. (\\x. y = pair x \\cfg_conf = w'\\)})\")\n apply(rename_tac x d n c w1 w2 da w')(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 w' da na e)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac x d n c w1 w2 w' da na e)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d n c w1 w2 w' da na e a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac x d n c w1 w2 w' da na e a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c w1 w2 w' da na e option)(*strict*)\n apply(case_tac c)\n apply(rename_tac x d n c w1 w2 w' da na e option cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(subgoal_tac \"x \\ {A \\ cfg_nonterminals \\cfg_nonterminals = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}, cfg_events = cfg_events G, cfg_initial = cfg_initial G, cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}}\\. \\d w'. cfgSTD.derivation_from_to \\cfg_nonterminals = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}, cfg_events = cfg_events G, cfg_initial = cfg_initial G, cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}}\\ d {pair None \\cfg_conf = [teA A]\\} ({ y. (\\x. y = pair x \\cfg_conf = w'\\)}) \\ setA w' = {}}\")\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(simp add: cfgSTD_Nonblockingness_nonterminals_def)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"cfgSTD.derivation \\cfg_nonterminals = F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}, cfg_events = cfg_events G, cfg_initial = cfg_initial G, cfg_productions = {p \\ cfg_productions G. prod_lhs p \\ F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}}\\ da \")\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(rule_tac\n x=\"w'\"\n in exI)\n apply(simp add: cfgSTD.derivation_to_def cfgSTD.derivation_from_def cfgSTD.derivation_from_to_def )\n apply(rule_tac\n x=\"na\"\n in exI)\n apply(clarsimp)\n apply(case_tac \"da (Suc na)\")\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"da\"\n and n=\"na\"\n and m=\"Suc na\"\n in cfgSTD.step_detail_before_some_position)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n w1 w2 w' da na e option e2 c2)(*strict*)\n apply(simp add: cfgSTD_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x d n w1 w2 da na e option e2 c2 l r)(*strict*)\n apply(simp add: setAConcat)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(simp (no_asm) only: cfgLM_accessible_nonterminals_def)\n apply(simp (no_asm))\n apply(rule conjI)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(simp add: cfgSTD_Nonblockingness_nonterminals_def)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(rule cfg_sub_preserves_cfg_derivation_contra)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option)(*strict*)\n apply(rule allI)+\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(rule impI)\n apply(rule cfg_sub_preserves_cfg_derivation_contra2)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(simp add: cfg_configurations_def)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(simp (no_asm) only: cfgLM_accessible_nonterminals_def)\n apply(simp (no_asm))\n apply(rule conjI)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c)(*strict*)\n apply(simp add: cfgSTD_step_relation_def cfg_configurations_def)\n apply(clarsimp)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb c' l r)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(case_tac c')\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb c' l r cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(rule conjI)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n prefer 2\n apply(simp add: cfg_sub_def valid_cfg_def)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(rule_tac\n t=\"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G}\"\n and s=\"cfgLM_accessible_nonterminals G\"\n in ssubst)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(rule one_step_preserves_cfgLM_accessible_nonterminals)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(force)\n apply(rename_tac x d n w1 w2 w' da na e option i ea c eb l r)(*strict*)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_makes_precise_accessible_and_Nonblockingness: \"\n valid_cfg G\n \\ cfg_nonterminals G = cfgSTD_Nonblockingness_nonterminals G\n \\ cfg_nonterminals (F_CFG_EASTD_ALT G) = cfgLM_accessible_nonterminals G \\ cfgSTD_Nonblockingness_nonterminals G\"\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"F_CFG_APLM__fp G (cfgSTD_Nonblockingness_nonterminals G) {cfg_initial G} \\ cfg_nonterminals G\")\n apply(blast)\n apply(rule_tac B=\"cfgLM_accessible_nonterminals G\" in subset_trans)\n apply(rule F_CFG_APLM_F_CFG_APLM__fp_invariant_03_unfold)\n apply(simp add: F_CFG_APLM__fp_valid_input_def)\n apply(simp add: valid_cfg_def)\n apply(simp add: cfgLM_accessible_nonterminals_def)\n apply(force)\n done\n\nlemma cfg_with_cfgLM_Nonblockingness_nonterminals_has_nonempty_cfgLM_marked_language: \"\n valid_cfg G\n \\ cfg_nonterminals G \\ cfgLM_Nonblockingness_nonterminals G\n \\ cfgLM.marked_language G \\ {}\"\n apply(simp add: cfgLM.marked_language_def)\n apply(subgoal_tac \"cfg_initial G \\ cfgLM_Nonblockingness_nonterminals G\")\n prefer 2\n apply(simp add: valid_cfg_def)\n apply(force)\n apply(thin_tac \"cfg_nonterminals G \\ cfgLM_Nonblockingness_nonterminals G\")\n apply(simp add: cfgLM_Nonblockingness_nonterminals_def)\n apply(clarsimp)\n apply(rule_tac x=\"filterB w'\" in exI)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(simp add: cfg_marked_effect_def)\n apply(rule conjI)\n apply(rule_tac x=\"e\" in exI)\n apply(rule_tac x=\"\\cfg_conf = w'\\\" in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(force)\n apply (metis liftBDeConv2)\n apply(rule conjI)\n apply(simp add: cfgLM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def cfg_marking_condition_def cfg_marking_configuration_def)\n apply(simp add: cfg_marking_condition_def cfg_marking_configuration_def)\n apply(rule_tac x=\"n\" in exI)\n apply(clarsimp)\n apply(rule_tac d=\"d\" in cfgLM.belongs_configurations)\n apply(rule cfgLM.derivation_belongs)\n apply(force)\n apply(force)\n apply(simp add: cfgLM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def cfg_marking_condition_def cfg_marking_configuration_def)\n apply(force)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_preserves_cfgLM_initial_marking_derivations: \"\n valid_cfg Gi\n \\ valid_cfg Go\n \\ cfg_sub Go Gi\n \\ cfg_nonterminals Gi = cfgSTD_Nonblockingness_nonterminals Gi\n \\ Go = F_CFG_EASTD_ALT Gi\n \\ cfgLM.initial_marking_derivations Gi \\ cfgLM.initial_marking_derivations Go\"\n apply(simp add: cfgLM.initial_marking_derivations_def)\n apply(clarsimp)\n apply(rename_tac d)\n apply(rule conjI)\n prefer 2\n apply(simp add: cfg_marking_condition_def)\n apply(simp add: cfg_marking_configuration_def cfg_configurations_def cfg_sub_def)\n apply(clarsimp)\n apply(rule_tac x=\"i\" in exI)\n apply(clarsimp)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(force)\n apply(simp add: cfg_marking_condition_def cfg_marking_configuration_def)\n apply(clarsimp)\n apply(case_tac c)\n apply(clarsimp)\n apply(rename_tac w)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(force)\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(rule cfg_sub_preserves_derivation_initial_contra)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(rule allI)+\n apply(rule impI)\n apply(rule cfg_sub_preserves_derivation_initial_contra2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n prefer 2\n apply(force)\n apply(rule_tac\n t=\"F_CFG_APLM__fp Gi (cfgSTD_Nonblockingness_nonterminals Gi) {cfg_initial Gi}\"\n and s=\"cfgLM_accessible_nonterminals Gi\"\n in ssubst)\n apply(force)\n apply(thin_tac \"cfgLM_accessible_nonterminals Gi = F_CFG_APLM__fp Gi (cfgSTD_Nonblockingness_nonterminals Gi) {cfg_initial Gi}\")\n apply(clarsimp)\n apply(simp add: cfgLM_step_relation_def cfg_configurations_def)\n apply(clarsimp)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(case_tac c')\n apply(clarsimp)\n apply(simp add: setAConcat)\n apply(simp add: setBConcat)\n apply(rule conjI)\n prefer 2\n apply(simp add: cfg_sub_def valid_cfg_def)\n apply(rule one_step_preserves_cfgLM_accessible_nonterminals)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_makes_equal_cfgLM_initial_marking_derivations: \"\n valid_cfg Gi\n \\ valid_cfg Go\n \\ cfg_sub Go Gi\n \\ cfg_nonterminals Gi = cfgSTD_Nonblockingness_nonterminals Gi\n \\ Go = F_CFG_EASTD_ALT Gi\n \\ cfgLM.initial_marking_derivations Go = cfgLM.initial_marking_derivations Gi\"\n apply(rule antisym)\n apply(rule cfg_sub_preserves_cfgLM_initial_marking_derivations)\n apply(force)\n apply(force)\n apply(force)\n apply(rule F_CFG_EASTD_ALT_preserves_cfgLM_initial_marking_derivations)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma F_CFG_EASTD_ALT_enforces_cfgLM_language_relevant_productions: \"\n valid_cfg Gi\n \\ valid_cfg Go\n \\ cfg_sub Go Gi\n \\ cfg_nonterminals Gi = cfgSTD_Nonblockingness_nonterminals Gi\n \\ Go = F_CFG_EASTD_ALT Gi\n \\ cfg_productions Go = cfgLM_language_relevant_productions Go\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"Gi\"\n in F_CFG_EASTD_ALT_preserves_Eliminability)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"Gi\" in F_CFG_EASTD_ALT_makes_precise_accessible_and_Nonblockingness)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(subgoal_tac \"\ncfgLM_accessible_nonterminals (F_CFG_EASTD_ALT Gi) \\ cfgSTD_Nonblockingness_nonterminals (F_CFG_EASTD_ALT Gi) = cfgLM_language_relevant_nonterminals (F_CFG_EASTD_ALT Gi)\")\n prefer 2\n apply(rule cfgLM_language_relevant_nonterminals_vs_cfgLM_accessible_nonterminals_and_cfgSTD_Nonblockingness_nonterminals_in_cfgSTD_Nonblockingness_nonterminals_grammar)\n prefer 2\n apply(force)\n prefer 2\n apply(force)\n apply(force)\n apply(rule antisym)\n apply(force)\n apply(simp (no_asm) add: cfgSTD_Nonblockingness_nonterminals_def)\n apply(force)\n apply(rule antisym)\n prefer 2\n apply(simp add: cfgLM_language_relevant_productions_def)\n apply(clarsimp)\n apply(subgoal_tac \"x \\ cfg_step_labels (F_CFG_EASTD_ALT Gi)\")\n prefer 2\n apply(rule cfgLM.belongs_step_labels)\n apply(rule cfgLM.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: cfg_step_labels_def)\n apply(rule_tac t=\"cfg_productions Go\" and s=\"{p \\ cfg_productions Gi.\n prod_lhs p\n \\ F_CFG_APLM__fp Gi (cfgSTD_Nonblockingness_nonterminals Gi) {cfg_initial Gi}}\" in ssubst)\n apply(simp add: F_CFG_EASTD_ALT_def Let_def)\n apply(rule_tac\n t=\"F_CFG_APLM__fp X (cfgSTD_Nonblockingness_nonterminals X) {cfg_initial X}\"\n and s=\"cfgLM_accessible_nonterminals X\" for X\n in ssubst)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_APLMSoundL)\n apply(force)\n apply(force)\n apply(simp add: cfgLM_language_relevant_productions_def)\n apply(clarsimp)\n apply(case_tac x)\n apply(clarsimp)\n apply(rename_tac A w)\n apply(subgoal_tac \"A \\ cfgSTD_Nonblockingness_nonterminals Gi \\\n (\\d. cfgLM.derivation_initial\n Gi d \\\n (\\n c. get_configuration (d n) = Some c \\\n (\\w1 w2. cfg_conf c = liftB w1 @ teA A # w2)))\")\n prefer 2\n apply(simp add: cfgLM_accessible_nonterminals_def)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac Go=\"F_CFG_EASTD_ALT Gi\" and Gi=\"Gi\" in F_CFG_EASTD_ALT_makes_equal_cfgLM_initial_marking_derivations)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(case_tac \"d n\")\n apply(simp add: get_configuration_def)\n apply(simp add: get_configuration_def)\n apply(case_tac c)\n apply(clarsimp)\n apply(case_tac a)\n apply(clarsimp)\n apply(rename_tac e)\n apply(subgoal_tac \"\\cfg_conf = liftB w1 @ teA A # w2\\ \\ SSX\" for SSX)\n prefer 2\n apply(rule_tac d=\"d\" in cfgLM.belongs_configurations)\n apply(rule cfgLM.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"prod_lhs \\prod_lhs = A, prod_rhs = w\\ \\ cfgSTD_Nonblockingness_nonterminals Gi \\\n setA (prod_rhs \\prod_lhs = A, prod_rhs = w\\) \\ cfgSTD_Nonblockingness_nonterminals Gi \\\n setB (prod_rhs \\prod_lhs = A, prod_rhs = w\\) \\ cfg_events Gi\")\n prefer 2\n apply(simp add: valid_cfg_def)\n apply(force)\n apply(subgoal_tac \"setA (liftB w1 @ w @ w2) \\ cfg_nonterminals Gi\")\n prefer 2\n apply(simp add: cfg_configurations_def setA_liftB setAConcat)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac w=\"liftB w1 @ w @ w2\" and G=\"Gi\" in construct_elimininating_derivation_prime)\n apply(force)\n apply(rule antisym)\n prefer 2\n apply(simp add: cfgSTD_Nonblockingness_nonterminals_def)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"\\cfg_conf = liftB v\\ \\ SSX\" for SSX)\n prefer 2\n apply(rule_tac d=\"da\" in cfgLM.belongs_configurations)\n apply(rule cfgLM.derivation_belongs)\n apply(force)\n apply(force)\n apply(simp add: cfg_configurations_def)\n apply(simp add: setBConcat)\n apply(force)\n apply(force)\n apply(subgoal_tac \"derivation_append d (derivation_append (der2 \\cfg_conf = liftB w1 @ [teA A] @ w2\\ \\prod_lhs = A, prod_rhs = w\\ \\cfg_conf = liftB w1 @ w @ w2\\) da (Suc 0)) n \\ cfgLM.initial_marking_derivations (F_CFG_EASTD_ALT Gi)\")\n prefer 2\n apply(rule_tac A=\"cfgLM.initial_marking_derivations (Gi)\" in set_mp)\n apply(force)\n apply(thin_tac \"cfgLM.initial_marking_derivations A = VB\" for A VB)\n apply(simp add: cfgLM.initial_marking_derivations_def cfg_marking_condition_def)\n apply(rule context_conjI)\n apply(rule cfgLM.derivation_append_preserves_derivation_initial)\n apply(force)\n apply(force)\n apply(rule cfgLM.derivation_append_preserves_derivation)\n apply(simp add: cfgLM.derivation_initial_def)\n apply(rule cfgLM.derivation_append_preserves_derivation)\n apply(rule cfgLM.der2_is_derivation)\n apply(simp add: cfgLM_step_relation_def)\n apply(rule_tac x=\"liftB w1\" in exI)\n apply(clarsimp)\n apply(simp add: setA_liftB)\n apply(force)\n apply(simp add: der2_def)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(rule_tac x=\"n+Suc 0+na\" in exI)\n apply(simp add: setA_liftB)\n apply(simp add: derivation_append_def der2_def cfg_marking_configuration_def cfg_configurations_def)\n apply(simp add: setA_liftB)\n apply(clarsimp)\n apply(rule_tac t=\"liftB w1 @ w @ w2\" and s=\"liftB v\" in ssubst)\n apply(force)\n apply(simp (no_asm) add: setA_liftB)\n apply(thin_tac \" ATS_Language0.initial_marking_derivations cfg_initial_configurations\n cfgLM_step_relation cfg_marking_condition (F_CFG_EASTD_ALT Gi) =\n ATS_Language0.initial_marking_derivations cfg_initial_configurations\n cfgLM_step_relation cfg_marking_condition Gi \")\n apply(simp add: cfgLM.initial_marking_derivations_def)\n apply(rule_tac x=\"derivation_append d\n (derivation_append\n (der2 \\cfg_conf = liftB w1 @ teA A # w2\\ \\prod_lhs = A, prod_rhs = w\\\n \\cfg_conf = liftB w1 @ w @ w2\\)\n da (Suc 0))\n n\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"Suc n\" in exI)\n apply(simp add: derivation_append_def der2_def)\n done\n\ntheorem SOUND_FUN_CFGLMACX: \"\n F_CFG_EASTD__SpecInput G\n \\ F_CFG_EASTD__SpecOutput G (F_CFG_EASTD_ALT G)\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule F_CFG_EASTD_ALT_preserves_valid_cfg)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(force)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in F_CFG_EASTD_ALT_is_cfg_sub)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in F_CFG_APLMSoundL)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in F_CFG_EASTD_ALT_preserves_language)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in F_CFG_EASTD_ALT_preserves_Eliminability)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" in F_CFG_EASTD_ALT_makes_precise_accessible_and_Nonblockingness)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(subgoal_tac \"\ncfgLM_accessible_nonterminals (F_CFG_EASTD_ALT G) \\ cfgSTD_Nonblockingness_nonterminals (F_CFG_EASTD_ALT G) = cfgLM_language_relevant_nonterminals (F_CFG_EASTD_ALT G)\")\n prefer 2\n apply(rule cfgLM_language_relevant_nonterminals_vs_cfgLM_accessible_nonterminals_and_cfgSTD_Nonblockingness_nonterminals_in_cfgSTD_Nonblockingness_nonterminals_grammar)\n prefer 2\n apply(force)\n prefer 2\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(rule antisym)\n apply(force)\n apply(simp add: cfgSTD_Nonblockingness_nonterminals_def)\n apply(force)\n apply(subgoal_tac \"cfgLM.initial_marking_derivations (F_CFG_EASTD_ALT G) = cfgLM.initial_marking_derivations G\")\n prefer 2\n apply(rule F_CFG_EASTD_ALT_makes_equal_cfgLM_initial_marking_derivations)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n apply(subgoal_tac \"cfgLM.marked_language (F_CFG_EASTD_ALT G) \\ {}\")\n prefer 2\n apply(rule cfg_with_cfgLM_Nonblockingness_nonterminals_has_nonempty_cfgLM_marked_language)\n apply(force)\n apply(rule_tac t=\"cfgLM_Nonblockingness_nonterminals (F_CFG_EASTD_ALT G)\" and s=\"cfgSTD_Nonblockingness_nonterminals (F_CFG_EASTD_ALT G)\" in ssubst)\n prefer 2\n apply(force)\n apply (metis cfgLM_Nonblockingness_nonterminals_vs_cfgSTD_Nonblockingness_nonterminals)\n apply(subgoal_tac \"cfg_productions (F_CFG_EASTD_ALT G) = cfgLM_language_relevant_productions (F_CFG_EASTD_ALT G)\")\n prefer 2\n apply(rule F_CFG_EASTD_ALT_enforces_cfgLM_language_relevant_productions)\n prefer 2\n apply(force)\n prefer 2\n apply(force)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(simp add: F_CFG_EASTD__SpecInput_def)\n apply(force)\n apply(simp add: F_CFG_EASTD_ALT_def F_CFG_EASTD__SpecInput_def F_CFG_EASTD__SpecOutput_def)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_04/FUNCTION_CFG_ENFORCE_ACCESSIBILITY_cfgLM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.2927140786037151}} {"text": "(*<*)\ntheory Monitor\n imports Abstract_Monitor\n Optimized_Join\n \"HOL-Library.While_Combinator\"\n \"HOL-Library.Mapping\"\n \"Deriving.Derive\"\n \"Generic_Join.Generic_Join_Correctness\"\nbegin\n(*>*)\n\nsection \\Generic monitoring algorithm\\\n\ntext \\The algorithm defined here abstracts over the implementation of the temporal operators.\\\n\nsubsection \\Monitorable formulas\\\n\ndefinition \"mmonitorable \\ \\ safe_formula \\ \\ Formula.future_bounded \\\"\ndefinition \"mmonitorable_regex b g r \\ safe_regex b g r \\ Regex.pred_regex Formula.future_bounded r\"\n\ndefinition is_simple_eq :: \"Formula.trm \\ Formula.trm \\ bool\" where\n \"is_simple_eq t1 t2 = (Formula.is_Const t1 \\ (Formula.is_Const t2 \\ Formula.is_Var t2) \\\n Formula.is_Var t1 \\ Formula.is_Const t2)\"\n\nfun mmonitorable_exec :: \"Formula.formula \\ bool\" where\n \"mmonitorable_exec (Formula.Eq t1 t2) = is_simple_eq t1 t2\"\n| \"mmonitorable_exec (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var y))) = (x = y)\"\n| \"mmonitorable_exec (Formula.Pred e ts) = list_all (\\t. Formula.is_Var t \\ Formula.is_Const t) ts\"\n| \"mmonitorable_exec (Formula.Let p b \\ \\) = ({0..} \\ Formula.fv \\ \\ b \\ Formula.nfv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Neg \\) = (fv \\ = {} \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Or \\ \\) = (fv \\ = fv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.And \\ \\) = (mmonitorable_exec \\ \\\n (safe_assignment (fv \\) \\ \\ mmonitorable_exec \\ \\\n fv \\ \\ fv \\ \\ (is_constraint \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))))\"\n| \"mmonitorable_exec (Formula.Ands l) = (let (pos, neg) = partition mmonitorable_exec l in\n pos \\ [] \\ list_all mmonitorable_exec (map remove_neg neg) \\\n \\(set (map fv neg)) \\ \\(set (map fv pos)))\"\n| \"mmonitorable_exec (Formula.Exists \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Agg y \\ b f \\) = (mmonitorable_exec \\ \\\n y + b \\ Formula.fv \\ \\ {0.. Formula.fv \\ \\ Formula.fv_trm f \\ Formula.fv \\)\"\n| \"mmonitorable_exec (Formula.Prev I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Next I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Since \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Until \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\ right I \\ \\ \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.MatchP I r) = Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Past Strict r\"\n| \"mmonitorable_exec (Formula.MatchF I r) = (Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Futu Strict r \\ right I \\ \\)\"\n| \"mmonitorable_exec _ = False\"\n\nlemma cases_Neg_iff:\n \"(case \\ of formula.Neg \\ \\ P \\ | _ \\ False) \\ (\\\\. \\ = formula.Neg \\ \\ P \\)\"\n by (cases \\) auto\n\nlemma safe_formula_mmonitorable_exec: \"safe_formula \\ \\ Formula.future_bounded \\ \\ mmonitorable_exec \\\"\nproof (induct \\ rule: safe_formula.induct)\n case (8 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (9 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (10 l)\n from \"10.prems\"(2) have bounded: \"Formula.future_bounded \\\" if \"\\ \\ set l\" for \\\n using that by (auto simp: list.pred_set)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have \"set poss \\ set posm\"\n proof (rule subsetI)\n fix x assume \"x \\ set poss\"\n then have \"x \\ set l\" \"safe_formula x\" using posnegs by simp_all\n then have \"mmonitorable_exec x\" using \"10.hyps\"(1) bounded by blast\n then show \"x \\ set posm\" using \\x \\ set poss\\ posnegm posnegs by simp\n qed\n then have \"set negm \\ set negs\" using posnegm posnegs by auto\n obtain \"poss \\ []\" \"list_all safe_formula (map remove_neg negs)\"\n \"(\\x\\set negs. fv x) \\ (\\x\\set poss. fv x)\"\n using \"10.prems\"(1) posnegs by simp\n then have \"posm \\ []\" using \\set poss \\ set posm\\ by auto\n moreover have \"list_all mmonitorable_exec (map remove_neg negm)\"\n proof -\n let ?l = \"map remove_neg negm\"\n have \"\\x. x \\ set ?l \\ mmonitorable_exec x\"\n proof -\n fix x assume \"x \\ set ?l\"\n then obtain y where \"y \\ set negm\" \"x = remove_neg y\" by auto\n then have \"y \\ set negs\" using \\set negm \\ set negs\\ by blast\n then have \"safe_formula x\"\n unfolding \\x = remove_neg y\\ using \\list_all safe_formula (map remove_neg negs)\\\n by (simp add: list_all_def)\n show \"mmonitorable_exec x\"\n proof (cases \"\\z. y = Formula.Neg z\")\n case True\n then obtain z where \"y = Formula.Neg z\" by blast\n then show ?thesis\n using \"10.hyps\"(2)[OF posnegs refl] \\x = remove_neg y\\ \\y \\ set negs\\ posnegs bounded\n \\safe_formula x\\ by fastforce\n next\n case False\n then have \"remove_neg y = y\" by (cases y) simp_all\n then have \"y = x\" unfolding \\x = remove_neg y\\ by simp\n show ?thesis\n using \"10.hyps\"(1) \\y \\ set negs\\ posnegs \\safe_formula x\\ unfolding \\y = x\\\n by auto\n qed\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n moreover have \"(\\x\\set negm. fv x) \\ (\\x\\set posm. fv x)\"\n using \\\\ (fv ` set negs) \\ \\ (fv ` set poss)\\ \\set poss \\ set posm\\ \\set negm \\ set negs\\\n by fastforce\n ultimately show ?case using posnegm by simp\nnext\n case (15 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (16 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (17 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nnext\n case (18 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nqed (auto simp add: is_simple_eq_def list.pred_set)\n\nlemma safe_assignment_future_bounded: \"safe_assignment X \\ \\ Formula.future_bounded \\\"\n unfolding safe_assignment_def by (auto split: formula.splits)\n\nlemma is_constraint_future_bounded: \"is_constraint \\ \\ Formula.future_bounded \\\"\n by (induction rule: is_constraint.induct) simp_all\n\nlemma mmonitorable_exec_mmonitorable: \"mmonitorable_exec \\ \\ mmonitorable \\\"\nproof (induct \\ rule: mmonitorable_exec.induct)\n case (7 \\ \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (auto simp: cases_Neg_iff intro: safe_assignment_future_bounded is_constraint_future_bounded)\nnext\n case (8 l)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have pos_monitorable: \"list_all mmonitorable_exec posm\" using posnegm by (simp add: list_all_iff)\n have neg_monitorable: \"list_all mmonitorable_exec (map remove_neg negm)\"\n using \"8.prems\" posnegm by (simp add: list_all_iff)\n have \"set posm \\ set poss\"\n using \"8.hyps\"(1) posnegs posnegm unfolding mmonitorable_def by auto\n then have \"set negs \\ set negm\"\n using posnegs posnegm by auto\n\n have \"poss \\ []\" using \"8.prems\" posnegm \\set posm \\ set poss\\ by auto\n moreover have \"list_all safe_formula (map remove_neg negs)\"\n using neg_monitorable \"8.hyps\"(2)[OF posnegm refl] \\set negs \\ set negm\\\n unfolding mmonitorable_def by (auto simp: list_all_iff)\n moreover have \"\\ (fv ` set negm) \\ \\ (fv ` set posm)\"\n using \"8.prems\" posnegm by simp\n then have \"\\ (fv ` set negs) \\ \\ (fv ` set poss)\"\n using \\set posm \\ set poss\\ \\set negs \\ set negm\\ by fastforce\n ultimately have \"safe_formula (Formula.Ands l)\" using posnegs by simp\n moreover have \"Formula.future_bounded (Formula.Ands l)\"\n proof -\n have \"list_all Formula.future_bounded posm\"\n using pos_monitorable \"8.hyps\"(1) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n moreover have fnegm: \"list_all Formula.future_bounded (map remove_neg negm)\"\n using neg_monitorable \"8.hyps\"(2) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n then have \"list_all Formula.future_bounded negm\"\n proof -\n have \"\\x. x \\ set negm \\ Formula.future_bounded x\"\n proof -\n fix x assume \"x \\ set negm\"\n have \"Formula.future_bounded (remove_neg x)\" using fnegm \\x \\ set negm\\ by (simp add: list_all_iff)\n then show \"Formula.future_bounded x\" by (cases x) auto\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n ultimately have \"list_all Formula.future_bounded l\" using posnegm by (auto simp: list_all_iff)\n then show ?thesis by (auto simp: list_all_iff)\n qed\n ultimately show ?case unfolding mmonitorable_def ..\nnext\n case (13 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: cases_Neg_iff)\nnext\n case (14 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: one_enat_def cases_Neg_iff)\nnext\n case (15 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nnext\n case (16 I r)\n then show ?case\n by (auto 0 3 elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nqed (auto simp add: mmonitorable_def mmonitorable_regex_def is_simple_eq_def one_enat_def list.pred_set)\n\nlemma monitorable_formula_code[code]: \"mmonitorable \\ = mmonitorable_exec \\\"\n using mmonitorable_exec_mmonitorable safe_formula_mmonitorable_exec mmonitorable_def\n by blast\n\nsubsection \\Handling regular expressions\\\n\ndatatype mregex =\n MSkip nat\n | MTestPos nat\n | MTestNeg nat\n | MPlus mregex mregex\n | MTimes mregex mregex\n | MStar mregex\n\nprimrec ok where\n \"ok _ (MSkip n) = True\"\n| \"ok m (MTestPos n) = (n < m)\"\n| \"ok m (MTestNeg n) = (n < m)\"\n| \"ok m (MPlus r s) = (ok m r \\ ok m s)\"\n| \"ok m (MTimes r s) = (ok m r \\ ok m s)\"\n| \"ok m (MStar r) = ok m r\"\n\nprimrec from_mregex where\n \"from_mregex (MSkip n) _ = Regex.Skip n\"\n| \"from_mregex (MTestPos n) \\s = Regex.Test (\\s ! n)\"\n| \"from_mregex (MTestNeg n) \\s = (if safe_formula (Formula.Neg (\\s ! n))\n then Regex.Test (Formula.Neg (Formula.Neg (Formula.Neg (\\s ! n))))\n else Regex.Test (Formula.Neg (\\s ! n)))\"\n| \"from_mregex (MPlus r s) \\s = Regex.Plus (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MTimes r s) \\s = Regex.Times (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MStar r) \\s = Regex.Star (from_mregex r \\s)\"\n\nprimrec to_mregex_exec where\n \"to_mregex_exec (Regex.Skip n) xs = (MSkip n, xs)\"\n| \"to_mregex_exec (Regex.Test \\) xs = (if safe_formula \\ then (MTestPos (length xs), xs @ [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg (length xs), xs @ [\\']) | _ \\ (MSkip 0, xs))\"\n| \"to_mregex_exec (Regex.Plus r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MPlus mr ms, zs))\"\n| \"to_mregex_exec (Regex.Times r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MTimes mr ms, zs))\"\n| \"to_mregex_exec (Regex.Star r) xs =\n (let (mr, ys) = to_mregex_exec r xs in (MStar mr, ys))\"\n\nprimrec shift where\n \"shift (MSkip n) k = MSkip n\"\n| \"shift (MTestPos i) k = MTestPos (i + k)\"\n| \"shift (MTestNeg i) k = MTestNeg (i + k)\"\n| \"shift (MPlus r s) k = MPlus (shift r k) (shift s k)\"\n| \"shift (MTimes r s) k = MTimes (shift r k) (shift s k)\"\n| \"shift (MStar r) k = MStar (shift r k)\"\n\nprimrec to_mregex where\n \"to_mregex (Regex.Skip n) = (MSkip n, [])\"\n| \"to_mregex (Regex.Test \\) = (if safe_formula \\ then (MTestPos 0, [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg 0, [\\']) | _ \\ (MSkip 0, []))\"\n| \"to_mregex (Regex.Plus r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MPlus mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Times r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MTimes mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Star r) =\n (let (mr, ys) = to_mregex r in (MStar mr, ys))\"\n\nlemma shift_0: \"shift r 0 = r\"\n by (induct r) auto\n\nlemma shift_shift: \"shift (shift r k) j = shift r (k + j)\"\n by (induct r) auto\n\nlemma to_mregex_to_mregex_exec:\n \"case to_mregex r of (mr, \\s) \\ to_mregex_exec r xs = (shift mr (length xs), xs @ \\s)\"\n by (induct r arbitrary: xs)\n (auto simp: shift_shift ac_simps split: formula.splits prod.splits)\n\nlemma to_mregex_to_mregex_exec_Nil[code]: \"to_mregex r = to_mregex_exec r []\"\n using to_mregex_to_mregex_exec[where xs=\"[]\" and r = r] by (auto simp: shift_0)\n\nlemma ok_mono: \"ok m mr \\ m \\ n \\ ok n mr\"\n by (induct mr) auto\n\nlemma from_mregex_cong: \"ok m mr \\ (\\i < m. xs ! i = ys ! i) \\ from_mregex mr xs = from_mregex mr ys\"\n by (induct mr) auto\n\nlemma not_Neg_cases:\n \"(\\\\. \\ \\ Formula.Neg \\) \\ (case \\ of formula.Neg \\ \\ f \\ | _ \\ x) = x\"\n by (cases \\) auto\n\nlemma to_mregex_exec_ok:\n \"to_mregex_exec r xs = (mr, ys) \\ \\zs. ys = xs @ zs \\ set zs = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: xs mr ys)\n case (Skip x)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Star r)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nqed\n\nlemma ok_shift: \"ok (i + m) (Monitor.shift r i) \\ ok m r\"\n by (induct r) auto\n\nlemma to_mregex_ok: \"to_mregex r = (mr, ys) \\ set ys = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: mr ys)\n case (Skip x)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Star r)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nqed\n\nlemma from_mregex_shift: \"from_mregex (shift r (length xs)) (xs @ ys) = from_mregex r ys\"\n by (induct r) (auto simp: nth_append)\n\nlemma from_mregex_to_mregex: \"safe_regex m g r \\ case_prod from_mregex (to_mregex r) = r\"\n by (induct r rule: safe_regex.induct)\n (auto dest: to_mregex_ok intro!: from_mregex_cong simp: nth_append from_mregex_shift cases_Neg_iff\n split: prod.splits modality.splits)\n\nlemma from_mregex_eq: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ from_mregex mr \\s = r\"\n using from_mregex_to_mregex[of m g r] by auto\n\nlemma from_mregex_to_mregex_exec: \"safe_regex m g r \\ case_prod from_mregex (to_mregex_exec r xs) = r\"\nproof (induct r arbitrary: xs rule: safe_regex_induct)\n case (Plus b g r s)\n from Plus(3) Plus(1)[of xs] Plus(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesF g r s)\n from TimesF(3) TimesF(2)[of xs] TimesF(1)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesP g r s)\n from TimesP(3) TimesP(1)[of xs] TimesP(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (Star b g r)\n from Star(2) Star(1)[of xs] show ?case\n by (auto split: prod.splits)\nqed (auto split: prod.splits simp: cases_Neg_iff)\n\n\nderive linorder mregex\n\nsubsubsection \\LPD\\\n\ndefinition saturate where\n \"saturate f = while (\\S. f S \\ S) f\"\n\nlemma saturate_code[code]:\n \"saturate f S = (let S' = f S in if S' = S then S else saturate f S')\"\n unfolding saturate_def Let_def\n by (subst while_unfold) auto\n\ndefinition \"MTimesL r S = MTimes r ` S\"\ndefinition \"MTimesR R s = (\\r. MTimes r s) ` R\"\n\nprimrec LPD where\n \"LPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"LPD (MTestPos \\) = {}\"\n| \"LPD (MTestNeg \\) = {}\"\n| \"LPD (MPlus r s) = (LPD r \\ LPD s)\"\n| \"LPD (MTimes r s) = MTimesR (LPD r) s \\ LPD s\"\n| \"LPD (MStar r) = MTimesR (LPD r) (MStar r)\"\n\nprimrec LPDi where\n \"LPDi 0 r = {r}\"\n| \"LPDi (Suc i) r = (\\s \\ LPD r. LPDi i s)\"\n\nlemma LPDi_Suc_alt: \"LPDi (Suc i) r = (\\s \\ LPDi i r. LPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"LPDs r = (\\i. LPDi i r)\"\n\nlemma LPDs_refl: \"r \\ LPDs r\"\n by (auto simp: LPDs_def intro: exI[of _ 0])\nlemma LPDs_trans: \"r \\ LPD s \\ s \\ LPDs t \\ r \\ LPDs t\"\n by (force simp: LPDs_def LPDi_Suc_alt simp del: LPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma LPDi_Test:\n \"LPDi i (MSkip 0) \\ {MSkip 0}\"\n \"LPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma LPDs_Test:\n \"LPDs (MSkip 0) \\ {MSkip 0}\"\n \"LPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding LPDs_def using LPDi_Test by blast+\n\nlemma LPDi_MSkip: \"LPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF LPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma LPDs_MSkip: \"LPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding LPDs_def using LPDi_MSkip by auto\n\nlemma LPDi_Plus: \"LPDi i (MPlus r s) \\ {MPlus r s} \\ LPDi i r \\ LPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma LPDs_Plus: \"LPDs (MPlus r s) \\ {MPlus r s} \\ LPDs r \\ LPDs s\"\n unfolding LPDs_def using LPDi_Plus[of _ r s] by auto\n\nlemma LPDi_Times:\n \"LPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesR (\\j \\ i. LPDi j r) s \\ (\\j \\ i. LPDi j s)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesR_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma LPDs_Times: \"LPDs (MTimes r s) \\ {MTimes r s} \\ MTimesR (LPDs r) s \\ LPDs s\"\n unfolding LPDs_def using LPDi_Times[of _ r s] by (force simp: MTimesR_def)\n\nlemma LPDi_Star: \"j \\ i \\ LPDi j (MStar r) \\ {MStar r} \\ MTimesR (\\j \\ i. LPDi j r) (MStar r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesR_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF LPDi_Times])\nqed simp\n\nlemma LPDs_Star: \"LPDs (MStar r) \\ {MStar r} \\ MTimesR (LPDs r) (MStar r)\"\n unfolding LPDs_def using LPDi_Star[OF order_refl, of _ r] by (force simp: MTimesR_def)\n\nlemma finite_LPDs: \"finite (LPDs r)\"\nproof (induct r)\n case (MSkip n)\n then show ?case by (intro finite_subset[OF LPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF LPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF LPDs_Times]) (simp add: MTimesR_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF LPDs_Star]) (simp add: MTimesR_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addLPD r \\ \\S. insert r S \\ Set.bind (insert r S) LPD\"\n\nprivate lemma mono_addLPD: \"mono (addLPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma LPDs_aux1: \"lfp (addLPD r) \\ LPDs r\"\n by (rule lfp_induct[OF mono_addLPD], auto intro: LPDs_refl LPDs_trans simp: Set.bind_def)\n\nprivate lemma LPDs_aux2: \"LPDi i r \\ lfp (addLPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) (auto simp: LPDi_Suc_alt simp del: LPDi.simps)\nqed\n\nlemma LPDs_alt: \"LPDs r = lfp (addLPD r)\"\n using LPDs_aux1 LPDs_aux2 by (force simp: LPDs_def)\n\nlemma LPDs_code[code]:\n \"LPDs r = saturate (addLPD r) {}\"\n unfolding LPDs_alt saturate_def\n by (rule lfp_while[OF mono_addLPD _ finite_LPDs, of r]) (auto simp: LPDs_refl LPDs_trans Set.bind_def)\n\nend\n\nsubsubsection \\RPD\\\n\nprimrec RPD where\n \"RPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"RPD (MTestPos \\) = {}\"\n| \"RPD (MTestNeg \\) = {}\"\n| \"RPD (MPlus r s) = (RPD r \\ RPD s)\"\n| \"RPD (MTimes r s) = MTimesL r (RPD s) \\ RPD r\"\n| \"RPD (MStar r) = MTimesL (MStar r) (RPD r)\"\n\nprimrec RPDi where\n \"RPDi 0 r = {r}\"\n| \"RPDi (Suc i) r = (\\s \\ RPD r. RPDi i s)\"\n\nlemma RPDi_Suc_alt: \"RPDi (Suc i) r = (\\s \\ RPDi i r. RPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"RPDs r = (\\i. RPDi i r)\"\n\nlemma RPDs_refl: \"r \\ RPDs r\"\n by (auto simp: RPDs_def intro: exI[of _ 0])\nlemma RPDs_trans: \"r \\ RPD s \\ s \\ RPDs t \\ r \\ RPDs t\"\n by (force simp: RPDs_def RPDi_Suc_alt simp del: RPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma RPDi_Test:\n \"RPDi i (MSkip 0) \\ {MSkip 0}\"\n \"RPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma RPDs_Test:\n \"RPDs (MSkip 0) \\ {MSkip 0}\"\n \"RPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding RPDs_def using RPDi_Test by blast+\n\nlemma RPDi_MSkip: \"RPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF RPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma RPDs_MSkip: \"RPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding RPDs_def using RPDi_MSkip by auto\n\nlemma RPDi_Plus: \"RPDi i (MPlus r s) \\ {MPlus r s} \\ RPDi i r \\ RPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma RPDi_Suc_RPD_Plus:\n \"RPDi (Suc i) r \\ RPDs (MPlus r s)\"\n \"RPDi (Suc i) s \\ RPDs (MPlus r s)\"\n unfolding RPDs_def by (force intro!: exI[of _ \"Suc i\"])+\n\nlemma RPDs_Plus: \"RPDs (MPlus r s) \\ {MPlus r s} \\ RPDs r \\ RPDs s\"\n unfolding RPDs_def using RPDi_Plus[of _ r s] by auto\n\nlemma RPDi_Times:\n \"RPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesL r (\\j \\ i. RPDi j s) \\ (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesL_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma RPDs_Times: \"RPDs (MTimes r s) \\ {MTimes r s} \\ MTimesL r (RPDs s) \\ RPDs r\"\n unfolding RPDs_def using RPDi_Times[of _ r s] by (force simp: MTimesL_def)\n\nlemma RPDi_Star: \"j \\ i \\ RPDi j (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesL_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF RPDi_Times])\nqed simp\n\nlemma RPDs_Star: \"RPDs (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (RPDs r)\"\n unfolding RPDs_def using RPDi_Star[OF order_refl, of _ r] by (force simp: MTimesL_def)\n\nlemma finite_RPDs: \"finite (RPDs r)\"\nproof (induct r)\n case MSkip\n then show ?case by (intro finite_subset[OF RPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF RPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF RPDs_Times]) (simp add: MTimesL_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF RPDs_Star]) (simp add: MTimesL_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addRPD r \\ \\S. insert r S \\ Set.bind (insert r S) RPD\"\n\nprivate lemma mono_addRPD: \"mono (addRPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma RPDs_aux1: \"lfp (addRPD r) \\ RPDs r\"\n by (rule lfp_induct[OF mono_addRPD], auto intro: RPDs_refl RPDs_trans simp: Set.bind_def)\n\nprivate lemma RPDs_aux2: \"RPDi i r \\ lfp (addRPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) (auto simp: RPDi_Suc_alt simp del: RPDi.simps)\nqed\n\nlemma RPDs_alt: \"RPDs r = lfp (addRPD r)\"\n using RPDs_aux1 RPDs_aux2 by (force simp: RPDs_def)\n\nlemma RPDs_code[code]:\n \"RPDs r = saturate (addRPD r) {}\"\n unfolding RPDs_alt saturate_def\n by (rule lfp_while[OF mono_addRPD _ finite_RPDs, of r]) (auto simp: RPDs_refl RPDs_trans Set.bind_def)\n\nend\n\nsubsection \\The executable monitor\\\n\ntype_synonym ts = nat\n\ntype_synonym 'a mbuf2 = \"'a table list \\ 'a table list\"\ntype_synonym 'a mbufn = \"'a table list list\"\ntype_synonym 'a msaux = \"(ts \\ 'a table) list\"\ntype_synonym 'a muaux = \"(ts \\ 'a table \\ 'a table) list\"\ntype_synonym 'a mr\\aux = \"(ts \\ (mregex, 'a table) mapping) list\"\ntype_synonym 'a ml\\aux = \"(ts \\ 'a table list \\ 'a table) list\"\n\ndatatype mconstraint = MEq | MLess | MLessEq\n\nrecord args =\n args_ivl :: \\\n args_n :: nat\n args_L :: \"nat set\"\n args_R :: \"nat set\"\n args_pos :: bool\n\ndatatype (dead 'msaux, dead 'muaux) mformula =\n MRel \"event_data table\"\n | MPred Formula.name \"Formula.trm list\"\n | MLet Formula.name nat nat \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\"\n | MAnd \"nat set\" \"('msaux, 'muaux) mformula\" bool \"nat set\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MAndAssign \"('msaux, 'muaux) mformula\" \"nat \\ Formula.trm\"\n | MAndRel \"('msaux, 'muaux) mformula\" \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm\"\n | MAnds \"nat set list\" \"nat set list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\"\n | MOr \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MNeg \"('msaux, 'muaux) mformula\"\n | MExists \"('msaux, 'muaux) mformula\"\n | MAgg bool nat Formula.agg_op nat \"Formula.trm\" \"('msaux, 'muaux) mformula\"\n | MPrev \\ \"('msaux, 'muaux) mformula\" bool \"event_data table list\" \"ts list\"\n | MNext \\ \"('msaux, 'muaux) mformula\" bool \"ts list\"\n | MSince args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" \"'msaux\"\n | MUntil args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" \"'muaux\"\n | MMatchP \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" \"event_data mr\\aux\"\n | MMatchF \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" \"event_data ml\\aux\"\n\nrecord ('msaux, 'muaux) mstate =\n mstate_i :: nat\n mstate_m :: \"('msaux, 'muaux) mformula\"\n mstate_n :: nat\n\nfun eq_rel :: \"nat \\ Formula.trm \\ Formula.trm \\ event_data table\" where\n \"eq_rel n (Formula.Const x) (Formula.Const y) = (if x = y then unit_table n else empty_table)\"\n| \"eq_rel n (Formula.Var x) (Formula.Const y) = singleton_table n x y\"\n| \"eq_rel n (Formula.Const x) (Formula.Var y) = singleton_table n y x\"\n| \"eq_rel n _ _ = undefined\"\n\nlemma regex_atms_size: \"x \\ regex.atms r \\ size x < regex.size_regex size r\"\n by (induct r) auto\n\nlemma atms_size:\n assumes \"x \\ atms r\"\n shows \"size x < Regex.size_regex size r\"\nproof -\n { fix y assume \"y \\ regex.atms r\" \"case y of formula.Neg z \\ x = z | _ \\ False\"\n then have \"size x < Regex.size_regex size r\"\n by (cases y rule: formula.exhaust) (auto dest: regex_atms_size)\n }\n with assms show ?thesis\n unfolding atms_def\n by (auto split: formula.splits dest: regex_atms_size)\nqed\n\ndefinition init_args :: \"\\ \\ nat \\ nat set \\ nat set \\ bool \\ args\" where\n \"init_args I n L R pos = \\args_ivl = I, args_n = n, args_L = L, args_R = R, args_pos = pos\\\"\n\nlocale msaux =\n fixes valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n assumes valid_init_msaux: \"L \\ R \\\n valid_msaux (init_args I n L R pos) 0 (init_msaux (init_args I n L R pos)) []\"\n assumes valid_add_new_ts_msaux: \"valid_msaux args cur aux auxlist \\ nt \\ cur \\\n valid_msaux args nt (add_new_ts_msaux args nt aux)\n (filter (\\(t, rel). enat (nt - t) \\ right (args_ivl args)) auxlist)\"\n assumes valid_join_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n valid_msaux args cur (join_msaux args rel1 aux)\n (map (\\(t, rel). (t, join rel (args_pos args) rel1)) auxlist)\"\n assumes valid_add_new_table_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_R args) rel2 \\\n valid_msaux args cur (add_new_table_msaux args rel2 aux)\n (case auxlist of\n [] => [(cur, rel2)]\n | ((t, y) # ts) \\ if t = cur then (t, y \\ rel2) # ts else (cur, rel2) # auxlist)\"\n and valid_result_msaux: \"valid_msaux args cur aux auxlist \\ result_msaux args aux =\n foldr (\\) [rel. (t, rel) \\ auxlist, left (args_ivl args) \\ cur - t] {}\"\n\nfun check_before :: \"\\ \\ ts \\ (ts \\ 'a \\ 'b) \\ bool\" where\n \"check_before I dt (t, a, b) \\ enat t + right I < enat dt\"\n\nfun proj_thd :: \"('a \\ 'b \\ 'c) \\ 'c\" where\n \"proj_thd (t, a1, a2) = a2\"\n\ndefinition update_until :: \"args \\ event_data table \\ event_data table \\ ts \\ event_data muaux \\ event_data muaux\" where\n \"update_until args rel1 rel2 nt aux =\n (map (\\x. case x of (t, a1, a2) \\ (t, if (args_pos args) then join a1 True rel1 else a1 \\ rel1,\n if mem (nt - t) (args_ivl args) then a2 \\ join rel2 (args_pos args) a1 else a2)) aux) @\n [(nt, rel1, if left (args_ivl args) = 0 then rel2 else empty_table)]\"\n\nlemma map_proj_thd_update_until: \"map proj_thd (takeWhile (check_before (args_ivl args) nt) auxlist) =\n map proj_thd (takeWhile (check_before (args_ivl args) nt) (update_until args rel1 rel2 nt auxlist))\"\nproof (induction auxlist)\n case Nil\n then show ?case by (simp add: update_until_def)\nnext\n case (Cons a auxlist)\n then show ?case\n by (cases \"right (args_ivl args)\") (auto simp add: update_until_def split: if_splits prod.splits)\nqed\n\nfun eval_until :: \"\\ \\ ts \\ event_data muaux \\ event_data table list \\ event_data muaux\" where\n \"eval_until I nt [] = ([], [])\"\n| \"eval_until I nt ((t, a1, a2) # aux) = (if t + right I < nt then\n (let (xs, aux) = eval_until I nt aux in (a2 # xs, aux)) else ([], (t, a1, a2) # aux))\"\n\nlemma eval_until_length:\n \"eval_until I nt auxlist = (res, auxlist') \\ length auxlist = length res + length auxlist'\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlemma eval_until_res: \"eval_until I nt auxlist = (res, auxlist') \\\n res = map proj_thd (takeWhile (check_before I nt) auxlist)\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: prod.splits)\n\nlemma eval_until_auxlist': \"eval_until I nt auxlist = (res, auxlist') \\\n auxlist' = drop (length res) auxlist\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlocale muaux =\n fixes valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ ts \\ 'muaux \\ event_data table list \\ 'muaux\"\n assumes valid_init_muaux: \"L \\ R \\\n valid_muaux (init_args I n L R pos) 0 (init_muaux (init_args I n L R pos)) []\"\n assumes valid_add_new_muaux: \"valid_muaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n table (args_n args) (args_R args) rel2 \\\n nt \\ cur \\\n valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux)\n (update_until args rel1 rel2 nt auxlist)\"\n assumes valid_length_muaux: \"valid_muaux args cur aux auxlist \\ length_muaux args aux = length auxlist\"\n assumes valid_eval_muaux: \"valid_muaux args cur aux auxlist \\ nt \\ cur \\\n eval_muaux args nt aux = (res, aux') \\ eval_until (args_ivl args) nt auxlist = (res', auxlist') \\\n res = res' \\ valid_muaux args cur aux' auxlist'\"\n\nlocale maux = msaux valid_msaux init_msaux add_new_ts_msaux join_msaux add_new_table_msaux result_msaux +\n muaux valid_muaux init_muaux add_new_muaux length_muaux eval_muaux\n for valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n and valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ nat \\ 'muaux \\ event_data table list \\ 'muaux\"\n\nfun split_assignment :: \"nat set \\ Formula.formula \\ nat \\ Formula.trm\" where\n \"split_assignment X (Formula.Eq t1 t2) = (case (t1, t2) of\n (Formula.Var x, Formula.Var y) \\ if x \\ X then (y, t1) else (x, t2)\n | (Formula.Var x, _) \\ (x, t2)\n | (_, Formula.Var y) \\ (y, t1))\"\n| \"split_assignment _ _ = undefined\"\n\nfun split_constraint :: \"Formula.formula \\ Formula.trm \\ bool \\ mconstraint \\ Formula.trm\" where\n \"split_constraint (Formula.Eq t1 t2) = (t1, True, MEq, t2)\"\n| \"split_constraint (Formula.Less t1 t2) = (t1, True, MLess, t2)\"\n| \"split_constraint (Formula.LessEq t1 t2) = (t1, True, MLessEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Eq t1 t2)) = (t1, False, MEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Less t1 t2)) = (t1, False, MLess, t2)\"\n| \"split_constraint (Formula.Neg (Formula.LessEq t1 t2)) = (t1, False, MLessEq, t2)\"\n| \"split_constraint _ = undefined\"\n\nfunction (in maux) (sequential) minit0 :: \"nat \\ Formula.formula \\ ('msaux, 'muaux) mformula\" where\n \"minit0 n (Formula.Neg \\) = (if fv \\ = {} then MNeg (minit0 n \\) else MRel empty_table)\"\n| \"minit0 n (Formula.Eq t1 t2) = MRel (eq_rel n t1 t2)\"\n| \"minit0 n (Formula.Pred e ts) = MPred e ts\"\n| \"minit0 n (Formula.Let p b \\ \\) = MLet p (Formula.nfv \\) b (minit0 (Formula.nfv \\) \\) (minit0 n \\)\"\n| \"minit0 n (Formula.Or \\ \\) = MOr (minit0 n \\) (minit0 n \\) ([], [])\"\n| \"minit0 n (Formula.And \\ \\) = (if safe_assignment (fv \\) \\ then\n MAndAssign (minit0 n \\) (split_assignment (fv \\) \\)\n else if safe_formula \\ then\n MAnd (fv \\) (minit0 n \\) True (fv \\) (minit0 n \\) ([], [])\n else if is_constraint \\ then\n MAndRel (minit0 n \\) (split_constraint \\)\n else (case \\ of Formula.Neg \\ \\\n MAnd (fv \\) (minit0 n \\) False (fv \\) (minit0 n \\) ([], [])))\"\n| \"minit0 n (Formula.Ands l) = (let (pos, neg) = partition safe_formula l in\n let mpos = map (minit0 n) pos in\n let mneg = map (minit0 n) (map remove_neg neg) in\n let vpos = map fv pos in\n let vneg = map fv neg in\n MAnds vpos vneg (mpos @ mneg) (replicate (length l) []))\"\n| \"minit0 n (Formula.Exists \\) = MExists (minit0 (Suc n) \\)\"\n| \"minit0 n (Formula.Agg y \\ b f \\) = MAgg (fv \\ \\ {0.. b f (minit0 (b + n) \\)\"\n| \"minit0 n (Formula.Prev I \\) = MPrev I (minit0 n \\) True [] []\"\n| \"minit0 n (Formula.Next I \\) = MNext I (minit0 n \\) True []\"\n| \"minit0 n (Formula.Since \\ I \\) = (if safe_formula \\\n then MSince (init_args I n (Formula.fv \\) (Formula.fv \\) True) (minit0 n \\) (minit0 n \\) ([], []) [] (init_msaux (init_args I n (Formula.fv \\) (Formula.fv \\) True))\n else (case \\ of\n Formula.Neg \\ \\ MSince (init_args I n (Formula.fv \\) (Formula.fv \\) False) (minit0 n \\) (minit0 n \\) ([], []) [] (init_msaux (init_args I n (Formula.fv \\) (Formula.fv \\) False))\n | _ \\ undefined))\"\n| \"minit0 n (Formula.Until \\ I \\) = (if safe_formula \\\n then MUntil (init_args I n (Formula.fv \\) (Formula.fv \\) True) (minit0 n \\) (minit0 n \\) ([], []) [] (init_muaux (init_args I n (Formula.fv \\) (Formula.fv \\) True))\n else (case \\ of\n Formula.Neg \\ \\ MUntil (init_args I n (Formula.fv \\) (Formula.fv \\) False) (minit0 n \\) (minit0 n \\) ([], []) [] (init_muaux (init_args I n (Formula.fv \\) (Formula.fv \\) False))\n | _ \\ undefined))\"\n| \"minit0 n (Formula.MatchP I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchP I mr (sorted_list_of_set (RPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] [])\"\n| \"minit0 n (Formula.MatchF I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchF I mr (sorted_list_of_set (LPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] [])\"\n| \"minit0 n _ = undefined\"\n by pat_completeness auto\ntermination (in maux)\n by (relation \"measure (\\(_, \\). size \\)\")\n (auto simp: less_Suc_eq_le size_list_estimation' size_remove_neg\n dest!: to_mregex_ok[OF sym] atms_size)\n\ndefinition (in maux) minit :: \"Formula.formula \\ ('msaux, 'muaux) mstate\" where\n \"minit \\ = (let n = Formula.nfv \\ in \\mstate_i = 0, mstate_m = minit0 n \\, mstate_n = n\\)\"\n\nfun mprev_next :: \"\\ \\ event_data table list \\ ts list \\ event_data table list \\ event_data table list \\ ts list\" where\n \"mprev_next I [] ts = ([], [], ts)\"\n| \"mprev_next I xs [] = ([], xs, [])\"\n| \"mprev_next I xs [t] = ([], xs, [t])\"\n| \"mprev_next I (x # xs) (t # t' # ts) = (let (ys, zs) = mprev_next I xs (t' # ts)\n in ((if mem (t' - t) I then x else empty_table) # ys, zs))\"\n\nfun mbuf2_add :: \"event_data table list \\ event_data table list \\ event_data mbuf2 \\ event_data mbuf2\" where\n \"mbuf2_add xs' ys' (xs, ys) = (xs @ xs', ys @ ys')\"\n\nfun mbuf2_take :: \"(event_data table \\ event_data table \\ 'b) \\ event_data mbuf2 \\ 'b list \\ event_data mbuf2\" where\n \"mbuf2_take f (x # xs, y # ys) = (let (zs, buf) = mbuf2_take f (xs, ys) in (f x y # zs, buf))\"\n| \"mbuf2_take f (xs, ys) = ([], (xs, ys))\"\n\nfun mbuf2t_take :: \"(event_data table \\ event_data table \\ ts \\ 'b \\ 'b) \\ 'b \\\n event_data mbuf2 \\ ts list \\ 'b \\ event_data mbuf2 \\ ts list\" where\n \"mbuf2t_take f z (x # xs, y # ys) (t # ts) = mbuf2t_take f (f x y t z) (xs, ys) ts\"\n| \"mbuf2t_take f z (xs, ys) ts = (z, (xs, ys), ts)\"\n\nlemma size_list_length_diff1: \"xs \\ [] \\ [] \\ set xs \\\n size_list (\\xs. length xs - Suc 0) xs < size_list length xs\"\nproof (induct xs)\n case (Cons x xs)\n then show ?case\n by (cases xs) auto\nqed simp\n\nfun mbufn_add :: \"event_data table list list \\ event_data mbufn \\ event_data mbufn\" where\n \"mbufn_add xs' xs = List.map2 (@) xs xs'\"\n\nfunction mbufn_take :: \"(event_data table list \\ 'b \\ 'b) \\ 'b \\ event_data mbufn \\ 'b \\ event_data mbufn\" where\n \"mbufn_take f z buf = (if buf = [] \\ [] \\ set buf then (z, buf)\n else mbufn_take f (f (map hd buf) z) (map tl buf))\"\n by pat_completeness auto\ntermination by (relation \"measure (\\(_, _, buf). size_list length buf)\")\n (auto simp: comp_def Suc_le_eq size_list_length_diff1)\n\nfun mbufnt_take :: \"(event_data table list \\ ts \\ 'b \\ 'b) \\\n 'b \\ event_data mbufn \\ ts list \\ 'b \\ event_data mbufn \\ ts list\" where\n \"mbufnt_take f z buf ts =\n (if [] \\ set buf \\ ts = [] then (z, buf, ts)\n else mbufnt_take f (f (map hd buf) (hd ts) z) (map tl buf) (tl ts))\"\n\nfun match :: \"Formula.trm list \\ event_data list \\ (nat \\ event_data) option\" where\n \"match [] [] = Some Map.empty\"\n| \"match (Formula.Const x # ts) (y # ys) = (if x = y then match ts ys else None)\"\n| \"match (Formula.Var x # ts) (y # ys) = (case match ts ys of\n None \\ None\n | Some f \\ (case f x of\n None \\ Some (f(x \\ y))\n | Some z \\ if y = z then Some f else None))\"\n| \"match _ _ = None\"\n\nfun meval_trm :: \"Formula.trm \\ event_data tuple \\ event_data\" where\n \"meval_trm (Formula.Var x) v = the (v ! x)\"\n| \"meval_trm (Formula.Const x) v = x\"\n| \"meval_trm (Formula.Plus x y) v = meval_trm x v + meval_trm y v\"\n| \"meval_trm (Formula.Minus x y) v = meval_trm x v - meval_trm y v\"\n| \"meval_trm (Formula.UMinus x) v = - meval_trm x v\"\n| \"meval_trm (Formula.Mult x y) v = meval_trm x v * meval_trm y v\"\n| \"meval_trm (Formula.Div x y) v = meval_trm x v div meval_trm y v\"\n| \"meval_trm (Formula.Mod x y) v = meval_trm x v mod meval_trm y v\"\n| \"meval_trm (Formula.F2i x) v = EInt (integer_of_event_data (meval_trm x v))\"\n| \"meval_trm (Formula.I2f x) v = EFloat (double_of_event_data (meval_trm x v))\"\n\ndefinition eval_agg :: \"nat \\ bool \\ nat \\ Formula.agg_op \\ nat \\ Formula.trm \\\n event_data table \\ event_data table\" where\n \"eval_agg n g0 y \\ b f rel = (if g0 \\ rel = empty_table\n then singleton_table n y (eval_agg_op \\ {})\n else (\\k.\n let group = Set.filter (\\x. drop b x = k) rel;\n M = (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` meval_trm f ` group\n in k[y:=Some (eval_agg_op \\ M)]) ` (drop b) ` rel)\"\n\ndefinition (in maux) update_since :: \"args \\ event_data table \\ event_data table \\ ts \\\n 'msaux \\ event_data table \\ 'msaux\" where\n \"update_since args rel1 rel2 nt aux =\n (let aux0 = join_msaux args rel1 (add_new_ts_msaux args nt aux);\n aux' = add_new_table_msaux args rel2 aux0\n in (result_msaux args aux', aux'))\"\n\ndefinition \"lookup = Mapping.lookup_default empty_table\"\n\nfun \\_lax where\n \"\\_lax guard \\s (MSkip n) = (if n = 0 then guard else empty_table)\"\n| \"\\_lax guard \\s (MTestPos i) = join guard True (\\s ! i)\"\n| \"\\_lax guard \\s (MTestNeg i) = join guard False (\\s ! i)\"\n| \"\\_lax guard \\s (MPlus r s) = \\_lax guard \\s r \\ \\_lax guard \\s s\"\n| \"\\_lax guard \\s (MTimes r s) = join (\\_lax guard \\s r) True (\\_lax guard \\s s)\"\n| \"\\_lax guard \\s (MStar r) = guard\"\n\nfun r\\_strict where\n \"r\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"r\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MPlus r s) = r\\_strict n \\s r \\ r\\_strict n \\s s\"\n| \"r\\_strict n \\s (MTimes r s) = \\_lax (r\\_strict n \\s r) \\s s\"\n| \"r\\_strict n \\s (MStar r) = unit_table n\"\n\nfun l\\_strict where\n \"l\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"l\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MPlus r s) = l\\_strict n \\s r \\ l\\_strict n \\s s\"\n| \"l\\_strict n \\s (MTimes r s) = \\_lax (l\\_strict n \\s s) \\s r\"\n| \"l\\_strict n \\s (MStar r) = unit_table n\"\n\nfun r\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"r\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"r\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"r\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"r\\ \\ X \\s (MPlus r s) = r\\ \\ X \\s r \\ r\\ \\ X \\s s\"\n| \"r\\ \\ X \\s (MTimes r s) = r\\ (\\t. \\ (MTimes r t)) X \\s s \\ \\_lax (r\\ \\ X \\s r) \\s s\"\n| \"r\\ \\ X \\s (MStar r) = r\\ (\\t. \\ (MTimes (MStar r) t)) X \\s r\"\n\nfun l\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"l\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"l\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"l\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"l\\ \\ X \\s (MPlus r s) = l\\ \\ X \\s r \\ l\\ \\ X \\s s\"\n| \"l\\ \\ X \\s (MTimes r s) = l\\ (\\t. \\ (MTimes t s)) X \\s r \\ \\_lax (l\\ \\ X \\s s) \\s r\"\n| \"l\\ \\ X \\s (MStar r) = l\\ (\\t. \\ (MTimes t (MStar r))) X \\s r\"\n\nlift_definition mrtabulate :: \"mregex list \\ (mregex \\ 'b table) \\ (mregex, 'b table) mapping\"\n is \"\\ks f. (map_of (List.map_filter (\\k. let fk = f k in if fk = empty_table then None else Some (k, fk)) ks))\" .\n\nlemma lookup_tabulate:\n \"distinct xs \\ lookup (mrtabulate xs f) x = (if x \\ set xs then f x else empty_table)\"\n unfolding lookup_default_def lookup_def\n by transfer (auto simp: Let_def map_filter_def map_of_eq_None_iff o_def image_image dest!: map_of_SomeD\n split: if_splits option.splits)\n\ndefinition update_matchP :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\\n event_data mr\\aux \\ event_data table \\ event_data mr\\aux\" where\n \"update_matchP n I mr mrs rels nt aux =\n (let aux = (case [(t, mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = nt then r\\_strict n rels mr else {}))).\n (t, rel) \\ aux, enat (nt - t) \\ right I]\n of [] \\ [(nt, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = nt then x # aux'\n else (nt, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\n in (foldr (\\) [lookup rel mr. (t, rel) \\ aux, left I \\ nt - t] {}, aux))\"\n\ndefinition update_matchF_base where\n \"update_matchF_base n I mr mrs rels nt =\n (let X = mrtabulate mrs (l\\_strict n rels)\n in ([(nt, rels, if left I = 0 then lookup X mr else empty_table)], X))\"\n\ndefinition update_matchF_step where\n \"update_matchF_step I mr mrs nt = (\\(t, rels', rel) (aux', X).\n (let Y = mrtabulate mrs (l\\ id X rels')\n in ((t, rels', if mem (nt - t) I then rel \\ lookup Y mr else rel) # aux', Y)))\"\n\ndefinition update_matchF :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\ event_data ml\\aux \\ event_data ml\\aux\" where\n \"update_matchF n I mr mrs rels nt aux =\n fst (foldr (update_matchF_step I mr mrs nt) aux (update_matchF_base n I mr mrs rels nt))\"\n\nfun eval_matchF :: \"\\ \\ mregex \\ ts \\ event_data ml\\aux \\ event_data table list \\ event_data ml\\aux\" where\n \"eval_matchF I mr nt [] = ([], [])\"\n| \"eval_matchF I mr nt ((t, rels, rel) # aux) = (if t + right I < nt then\n (let (xs, aux) = eval_matchF I mr nt aux in (rel # xs, aux)) else ([], (t, rels, rel) # aux))\"\n\nprimrec map_split where\n \"map_split f [] = ([], [])\"\n| \"map_split f (x # xs) =\n (let (y, z) = f x; (ys, zs) = map_split f xs\n in (y # ys, z # zs))\"\n\nfun eval_assignment :: \"nat \\ Formula.trm \\ event_data tuple \\ event_data tuple\" where\n \"eval_assignment (x, t) y = (y[x:=Some (meval_trm t y)])\"\n\nfun eval_constraint0 :: \"mconstraint \\ event_data \\ event_data \\ bool\" where\n \"eval_constraint0 MEq x y = (x = y)\"\n| \"eval_constraint0 MLess x y = (x < y)\"\n| \"eval_constraint0 MLessEq x y = (x \\ y)\"\n\nfun eval_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ event_data tuple \\ bool\" where\n \"eval_constraint (t1, p, c, t2) x = (eval_constraint0 c (meval_trm t1 x) (meval_trm t2 x) = p)\"\n\nprimrec (in maux) meval :: \"nat \\ ts \\ Formula.database \\ ('msaux, 'muaux) mformula \\\n event_data table list \\ ('msaux, 'muaux) mformula\" where\n \"meval n t db (MRel rel) = ([rel], MRel rel)\"\n| \"meval n t db (MPred e ts) = (map (\\X. (\\f. Table.tabulate f 0 n) ` Option.these\n (match ts ` X)) (case Mapping.lookup db e of None \\ [{}] | Some xs \\ xs), MPred e ts)\"\n| \"meval n t db (MLet p m b \\ \\) =\n (let (xs, \\) = meval m t db \\; (ys, \\) = meval n t (Mapping.update p (map (image (drop b o map the)) xs) db) \\\n in (ys, MLet p m b \\ \\))\"\n| \"meval n t db (MAnd A_\\ \\ pos A_\\ \\ buf) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. bin_join n A_\\ r1 pos A_\\ r2) (mbuf2_add xs ys buf)\n in (zs, MAnd A_\\ \\ pos A_\\ \\ buf))\"\n| \"meval n t db (MAndAssign \\ conf) =\n (let (xs, \\) = meval n t db \\ in (map (\\r. eval_assignment conf ` r) xs, MAndAssign \\ conf))\"\n| \"meval n t db (MAndRel \\ conf) =\n (let (xs, \\) = meval n t db \\ in (map (Set.filter (eval_constraint conf)) xs, MAndRel \\ conf))\"\n| \"meval n t db (MAnds A_pos A_neg L buf) =\n (let R = map (meval n t db) L in\n let buf = mbufn_add (map fst R) buf in\n let (zs, buf) = mbufn_take (\\xs zs. zs @ [mmulti_join n A_pos A_neg xs]) [] buf in\n (zs, MAnds A_pos A_neg (map snd R) buf))\"\n| \"meval n t db (MOr \\ \\ buf) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. r1 \\ r2) (mbuf2_add xs ys buf)\n in (zs, MOr \\ \\ buf))\"\n| \"meval n t db (MNeg \\) =\n (let (xs, \\) = meval n t db \\ in (map (\\r. (if r = empty_table then unit_table n else empty_table)) xs, MNeg \\))\"\n| \"meval n t db (MExists \\) =\n (let (xs, \\) = meval (Suc n) t db \\ in (map (\\r. tl ` r) xs, MExists \\))\"\n| \"meval n t db (MAgg g0 y \\ b f \\) =\n (let (xs, \\) = meval (b + n) t db \\ in (map (eval_agg n g0 y \\ b f) xs, MAgg g0 y \\ b f \\))\"\n| \"meval n t db (MPrev I \\ first buf nts) =\n (let (xs, \\) = meval n t db \\;\n (zs, buf, nts) = mprev_next I (buf @ xs) (nts @ [t])\n in (if first then empty_table # zs else zs, MPrev I \\ False buf nts))\"\n| \"meval n t db (MNext I \\ first nts) =\n (let (xs, \\) = meval n t db \\;\n (xs, first) = (case (xs, first) of (_ # xs, True) \\ (xs, False) | a \\ a);\n (zs, _, nts) = mprev_next I xs (nts @ [t])\n in (zs, MNext I \\ first nts))\"\n| \"meval n t db (MSince args \\ \\ buf nts aux) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n ((zs, aux), buf, nts) = mbuf2t_take (\\r1 r2 t (zs, aux).\n let (z, aux) = update_since args r1 r2 t aux\n in (zs @ [z], aux)) ([], aux) (mbuf2_add xs ys buf) (nts @ [t])\n in (zs, MSince args \\ \\ buf nts aux))\"\n| \"meval n t db (MUntil args \\ \\ buf nts aux) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (aux, buf, nts) = mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [t]);\n (zs, aux) = eval_muaux args (case nts of [] \\ t | nt # _ \\ nt) aux\n in (zs, MUntil args \\ \\ buf nts aux))\"\n| \"meval n t db (MMatchP I mr mrs \\s buf nts aux) =\n (let (xss, \\s) = map_split id (map (meval n t db) \\s);\n ((zs, aux), buf, nts) = mbufnt_take (\\rels t (zs, aux).\n let (z, aux) = update_matchP n I mr mrs rels t aux\n in (zs @ [z], aux)) ([], aux) (mbufn_add xss buf) (nts @ [t])\n in (zs, MMatchP I mr mrs \\s buf nts aux))\"\n| \"meval n t db (MMatchF I mr mrs \\s buf nts aux) =\n (let (xss, \\s) = map_split id (map (meval n t db) \\s);\n (aux, buf, nts) = mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [t]);\n (zs, aux) = eval_matchF I mr (case nts of [] \\ t | nt # _ \\ nt) aux\n in (zs, MMatchF I mr mrs \\s buf nts aux))\"\n\ndefinition (in maux) mstep :: \"Formula.database \\ ts \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\" where\n \"mstep tdb st =\n (let (xs, m) = meval (mstate_n st) (snd tdb) (fst tdb) (mstate_m st)\n in (List.enumerate (mstate_i st) xs,\n \\mstate_i = mstate_i st + length xs, mstate_m = m, mstate_n = mstate_n st\\))\"\n\nsubsection \\Verdict delay\\\n\ncontext fixes \\ :: Formula.trace begin\n\nfun progress :: \"(Formula.name \\ nat) \\ Formula.formula \\ nat \\ nat\" where\n \"progress P (Formula.Pred e ts) j = (case P e of None \\ j | Some k \\ k)\"\n| \"progress P (Formula.Let p b \\ \\) j = progress (P(p \\ progress P \\ j)) \\ j\"\n| \"progress P (Formula.Eq t1 t2) j = j\"\n| \"progress P (Formula.Less t1 t2) j = j\"\n| \"progress P (Formula.LessEq t1 t2) j = j\"\n| \"progress P (Formula.Neg \\) j = progress P \\ j\"\n| \"progress P (Formula.Or \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.And \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Ands l) j = (if l = [] then j else Min (set (map (\\\\. progress P \\ j) l)))\"\n| \"progress P (Formula.Exists \\) j = progress P \\ j\"\n| \"progress P (Formula.Agg y \\ b f \\) j = progress P \\ j\"\n| \"progress P (Formula.Prev I \\) j = (if j = 0 then 0 else min (Suc (progress P \\ j)) j)\"\n| \"progress P (Formula.Next I \\) j = progress P \\ j - 1\"\n| \"progress P (Formula.Since \\ I \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Until \\ I \\) j =\n Inf {i. \\k. k < j \\ k \\ min (progress P \\ j) (progress P \\ j) \\ \\ \\ i + right I \\ \\ \\ k}\"\n| \"progress P (Formula.MatchP I r) j = min_regex_default (progress P) r j\"\n| \"progress P (Formula.MatchF I r) j =\n Inf {i. \\k. k < j \\ k \\ min_regex_default (progress P) r j \\ \\ \\ i + right I \\ \\ \\ k}\"\n\ndefinition \"progress_regex P = min_regex_default (progress P)\"\n\ndeclare progress.simps[simp del]\nlemmas progress_simps[simp] = progress.simps[folded progress_regex_def[THEN fun_cong, THEN fun_cong]]\n\nend\n\ndefinition \"pred_mapping Q = pred_fun (\\_. True) (pred_option Q)\"\ndefinition \"rel_mapping Q = rel_fun (=) (rel_option Q)\"\n\nlemma pred_mapping_alt: \"pred_mapping Q P = (\\p \\ dom P. Q (the (P p)))\"\n unfolding pred_mapping_def pred_fun_def option.pred_set dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_alt: \"rel_mapping Q P P' = (dom P = dom P' \\ (\\p \\ dom P. Q (the (P p)) (the (P' p))))\"\n unfolding rel_mapping_def rel_fun_def rel_option_iff dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_map_upd[simp]: \"Q x y \\ rel_mapping Q P P' \\ rel_mapping Q (P(p \\ x)) (P'(p \\ y))\"\n by (auto simp: rel_mapping_alt)\n\nlemma pred_mapping_map_upd[simp]: \"Q x \\ pred_mapping Q P \\ pred_mapping Q (P(p \\ x))\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_empty[simp]: \"pred_mapping Q Map.empty\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono: \"pred_mapping Q P \\ Q \\ R \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono_strong: \"pred_mapping Q P \\\n (\\p. p \\ dom P \\ Q (the (P p)) \\ R (the (P p))) \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma progress_mono_gen: \"j \\ j' \\ rel_mapping (\\) P P' \\ progress \\ P \\ j \\ progress \\ P' \\ j'\"\nproof (induction \\ arbitrary: P P')\n case (Pred e ts)\n then show ?case\n by (force simp: rel_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[THEN order_trans])\nnext\n case (Until \\ I \\)\n from Until(1,2)[of P P'] Until.prems show ?case\n by (cases \"right I\")\n (auto dest: trans_le_add1[OF \\_mono] intro!: cInf_superset_mono)\nnext\n case (MatchF I r)\n from MatchF(1)[of _ P P'] MatchF.prems show ?case\n by (cases \"right I\"; cases \"regex.atms r = {}\")\n (auto 0 3 simp: Min_le_iff progress_regex_def dest: trans_le_add1[OF \\_mono]\n intro!: cInf_superset_mono elim!: less_le_trans order_trans)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma rel_mapping_reflp: \"reflp Q \\ rel_mapping Q P P\"\n by (auto simp: rel_mapping_alt reflp_def)\n\nlemmas progress_mono = progress_mono_gen[OF _ rel_mapping_reflp[unfolded reflp_def], simplified]\n\nlemma progress_le_gen: \"pred_mapping (\\x. x \\ j) P \\ progress \\ P \\ j \\ j\"\nproof (induction \\ arbitrary: P)\n case (Pred e ts)\n then show ?case\n by (auto simp: pred_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[where a=\"progress \\ P (hd l) j\", THEN order_trans])\nnext\n case (Until \\ I \\)\n then show ?case\n by (cases \"right I\")\n (auto intro: trans_le_add1[OF \\_mono] intro!: cInf_lower)\nnext\n case (MatchF I r)\n then show ?case\n by (cases \"right I\")\n (auto intro: trans_le_add1[OF \\_mono] intro!: cInf_lower)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma progress_le: \"progress \\ Map.empty \\ j \\ j\"\n using progress_le_gen[of _ Map.empty] by auto\n\nlemma progress_0_gen[simp]:\n \"pred_mapping (\\x. x = 0) P \\ progress \\ P \\ 0 = 0\"\n using progress_le_gen[of 0 P] by auto\n\nlemma progress_0[simp]:\n \"progress \\ Map.empty \\ 0 = 0\"\n by (auto simp: pred_mapping_alt)\n\ndefinition max_mapping :: \"('b \\ 'a option) \\ ('b \\ 'a option) \\ 'b \\ ('a :: linorder) option\" where\n \"max_mapping P P' x = (case (P x, P' x) of\n (None, None) \\ None\n | (Some x, None) \\ None\n | (None, Some x) \\ None\n | (Some x, Some y) \\ Some (max x y))\"\n\ndefinition Max_mapping :: \"('b \\ 'a option) set \\ 'b \\ ('a :: linorder) option\" where\n \"Max_mapping Ps x = (if (\\P \\ Ps. P x \\ None) then Some (Max ((\\P. the (P x)) ` Ps)) else None)\"\n\nlemma dom_max_mapping[simp]: \"dom (max_mapping P1 P2) = dom P1 \\ dom P2\"\n unfolding max_mapping_def by (auto split: option.splits)\n\nlemma dom_Max_mapping[simp]: \"dom (Max_mapping X) = (\\P \\ X. dom P)\"\n unfolding Max_mapping_def by (auto split: if_splits)\n\nlemma Max_mapping_coboundedI:\n assumes \"finite X\" \"\\Q \\ X. dom Q = dom P\" \"P \\ X\"\n shows \"rel_mapping (\\) P (Max_mapping X)\"\n unfolding rel_mapping_alt\nproof (intro conjI ballI)\n from assms(3) have \"X \\ {}\" by auto\n then show \"dom P = dom (Max_mapping X)\" using assms(2) by auto\nnext\n fix p\n assume \"p \\ dom P\"\n with assms show \"the (P p) \\ the (Max_mapping X p)\"\n by (force simp add: Max_mapping_def intro!: Max.coboundedI imageI)\nqed\n\nlemma rel_mapping_trans: \"P OO Q \\ R \\\n rel_mapping P P1 P2 \\ rel_mapping Q P2 P3 \\ rel_mapping R P1 P3\"\n by (force simp: rel_mapping_alt dom_def set_eq_iff)\n\nabbreviation range_mapping :: \"nat \\ nat \\ ('b \\ nat option) \\ bool\" where\n \"range_mapping i j P \\ pred_mapping (\\x. i \\ x \\ x \\ j) P\"\n\nlemma range_mapping_relax:\n \"range_mapping i j P \\ i' \\ i \\ j' \\ j \\ range_mapping i' j' P\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_max_mapping[simp]:\n \"range_mapping i j1 P1 \\ range_mapping i j2 P2 \\ range_mapping i (max j1 j2) (max_mapping P1 P2)\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_Max_mapping[simp]:\n \"finite X \\ X \\ {} \\ \\x\\X. range_mapping i (j x) (P x) \\ range_mapping i (Max (j ` X)) (Max_mapping (P ` X))\"\n by (force simp: pred_mapping_alt Max_mapping_def dom_def image_iff\n intro!: Max_ge_iff[THEN iffD2] split: if_splits)\n\nlemma pred_mapping_le:\n \"pred_mapping ((\\) i) P1 \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma pred_mapping_le':\n \"pred_mapping ((\\) j) P1 \\ i \\ j \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma max_mapping_cobounded1: \"dom P1 \\ dom P2 \\ rel_mapping (\\) P1 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_cobounded2: \"dom P2 \\ dom P1 \\ rel_mapping (\\) P2 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_fun_upd2[simp]:\n \"max_mapping P1 (P2(p := y))(p \\ x) = (max_mapping P1 P2)(p \\ x)\"\n by (auto simp: max_mapping_def)\n\nlemma rel_mapping_max_mapping_fun_upd: \"dom P2 \\ dom P1 \\ p \\ dom P2 \\ the (P2 p) \\ y \\\n rel_mapping (\\) P2 (max_mapping P1 P2(p \\ y))\"\n by (auto simp: rel_mapping_alt max_mapping_def split: option.splits)\n\nlemma progress_ge_gen: \"Formula.future_bounded \\ \\\n \\P j. dom P = S \\ range_mapping i j P \\ i \\ progress \\ P \\ j\"\nproof (induction \\ arbitrary: i S)\n case (Pred e ts)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: option.splits if_splits simp: rel_mapping_alt pred_mapping_alt dom_def)\nnext\n case (Let p b \\ \\)\n from Let.prems obtain P2 j2 where P2: \"dom P2 = insert p S\" \"range_mapping i j2 P2\"\n \"i \\ progress \\ P2 \\ j2\"\n by (atomize_elim, intro Let(2)) (force simp: pred_mapping_alt rel_mapping_alt dom_def)+\n from Let.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (the (P2 p)) j1 P1\"\n \"the (P2 p) \\ progress \\ P1 \\ j1\"\n by (atomize_elim, intro Let(1)) auto\n let ?P12 = \"max_mapping P1 P2\"\n from P1 P2 have le1: \"progress \\ P1 \\ j1 \\ progress \\ (?P12(p := P1 p)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n from P1 P2 have le2: \"progress \\ P2 \\ j2 \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n show ?case\n unfolding progress.simps\n proof (intro exI[of _ \"?P12(p := P1 p)\"] exI[of _ \"max j1 j2\"] conjI)\n show \"dom (?P12(p := P1 p)) = S\"\n using P1 P2 by (auto simp: dom_def max_mapping_def)\n next\n show \"range_mapping i (max j1 j2) (?P12(p := P1 p))\"\n using P1 P2 by (force simp add: pred_mapping_alt dom_def max_mapping_def split: option.splits)\n next\n have \"i \\ progress \\ P2 \\ j2\" by fact\n also have \"... \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n using le2 by blast\n also have \"... \\ progress \\ (?P12(p := P1 p)(p\\progress \\ (?P12(p := P1 p)) \\ (max j1 j2))) \\ (max j1 j2)\"\n by (auto intro!: progress_mono_gen simp: le1 rel_mapping_alt)\n finally show \"i \\ ...\" .\n qed\nnext\n case (Eq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Less _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (LessEq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Or \\1 \\2)\n from Or(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Or(1)[of S i] by auto\n moreover\n from Or(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Or(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Or \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (And \\1 \\2)\n from And(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using And(1)[of S i] by auto\n moreover\n from And(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using And(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.And \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (Ands l)\n show ?case proof (cases \"l = []\")\n case True\n then show ?thesis\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: if_splits simp: pred_mapping_alt)\n next\n case False\n then obtain \\ where \"\\ \\ set l\" by (cases l) auto\n from Ands.prems have \"\\\\\\set l. Formula.future_bounded \\\"\n by (simp add: list.pred_set)\n { fix \\\n assume \"\\ \\ set l\"\n with Ands.prems obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Ands(1)[of \\ S i]) (auto simp: list.pred_set)\n then have \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\Pj. ?P Pj\")\n by (intro exI[of _ \"(P, j)\"]) auto\n }\n then have \"\\\\\\set l. \\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\\\\\set l. \\Pj. ?P Pj \\\")\n by blast\n with Ands(1) Ands.prems False have \"\\Pjf. \\\\\\set l. ?P (Pjf \\) \\\"\n by (auto simp: Ball_def intro: choice)\n then obtain Pjf where Pjf: \"\\\\\\set l. ?P (Pjf \\) \\\" ..\n define Pf where \"Pf = fst o Pjf\"\n define jf where \"jf = snd o Pjf\"\n have *: \"dom (Pf \\) = S\" \"range_mapping i (jf \\) (Pf \\)\" \"i \\ progress \\ (Pf \\) \\ (jf \\)\"\n if \"\\ \\ set l\" for \\\n using Pjf[THEN bspec, OF that] unfolding Pf_def jf_def by auto\n with False show ?thesis\n unfolding progress.simps eq_False[THEN iffD2, OF False] if_False\n by ((subst Min_ge_iff; simp add: False),\n intro exI[where x=\"MAX \\\\set l. jf \\\"] exI[where x=\"Max_mapping (Pf ` set l)\"]\n conjI ballI order.trans[OF *(3) progress_mono_gen] Max_mapping_coboundedI)\n (auto simp: False *[OF \\\\ \\ set l\\] \\\\ \\ set l\\)\n qed\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n then obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Prev(1)) (auto simp: pred_mapping_alt dom_def)\n with Prev(2) have\n \"dom P = S \\ range_mapping i (max i j) P \\ i \\ progress \\ P (formula.Prev I \\) (max i j)\"\n by (auto simp: le_Suc_eq max_def pred_mapping_alt split: if_splits\n elim: order.trans[OF _ progress_mono])\n then show ?case by blast\nnext\n case (Next I \\)\n then obtain P j where \"dom P = S\" \"range_mapping (Suc i) j P\" \"Suc i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Next(1)) (auto simp: pred_mapping_alt dom_def)\n then show ?case\n by (intro exI[of _ P] exI[of _ j]) (auto 0 3 simp: pred_mapping_alt dom_def)\nnext\n case (Since \\1 I \\2)\n from Since(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Since(1)[of S i] by auto\n moreover\n from Since(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Since(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Since \\1 I \\2) (max j1 j2)\"\n by (auto elim!: order.trans[OF _ progress_mono_gen] simp: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"])\n (auto elim!: pred_mapping_le intro: max_mapping_cobounded1)\nnext\n case (Until \\1 I \\2)\n from Until.prems obtain b where [simp]: \"right I = enat b\"\n by (cases \"right I\") (auto)\n obtain i' where \"i < i'\" and \"\\ \\ i + b + 1 \\ \\ \\ i'\"\n using ex_le_\\[where x=\"\\ \\ i + b + 1\"] by (auto simp add: less_eq_Suc_le)\n then have 1: \"\\ \\ i + b < \\ \\ i'\" by simp\n from Until.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (Suc i') j1 P1\" \"Suc i' \\ progress \\ P1 \\1 j1\"\n by (atomize_elim, intro Until(1)) (auto simp: pred_mapping_alt dom_def)\n from Until.prems obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping (Suc i') j2 P2\" \"Suc i' \\ progress \\ P2 \\2 j2\"\n by (atomize_elim, intro Until(2)) (auto simp: pred_mapping_alt dom_def)\n let ?P12 = \"max_mapping P1 P2\"\n have \"i \\ progress \\ ?P12 (Formula.Until \\1 I \\2) (max j1 j2)\"\n unfolding progress.simps\n proof (intro cInf_greatest, goal_cases nonempty greatest)\n case nonempty\n then show ?case\n by (auto simp: trans_le_add1[OF \\_mono] intro!: exI[of _ \"max j1 j2\"])\n next\n case (greatest x)\n from P1(2,3) have \"i' < j1\"\n by (auto simp: less_eq_Suc_le intro!: progress_le_gen elim!: order.trans pred_mapping_mono_strong)\n then have \"i' < max j1 j2\" by simp\n have \"progress \\ P1 \\1 j1 \\ progress \\ ?P12 \\1 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded1)\n moreover have \"progress \\ P2 \\2 j2 \\ progress \\ ?P12 \\2 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded2)\n ultimately have \"i' \\ min (progress \\ ?P12 \\1 (max j1 j2)) (progress \\ ?P12 \\2 (max j1 j2))\"\n using P1(3) P2(3) by simp\n with greatest \\i' < max j1 j2\\ have \"\\ \\ i' \\ \\ \\ x + b\"\n by simp\n with 1 have \"\\ \\ i < \\ \\ x\" by simp\n then show ?case by (auto dest!: less_\\D)\n qed\n with P1 P2 \\i < i'\\ show ?case\n by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) (auto simp: range_mapping_relax)\nnext\n case (MatchP I r)\n then show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchP.prems show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"] exI[of _ i])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set)\n next\n case False\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj))\"\n let ?pickP = \"fst o pick\" let ?pickj = \"snd o pick\"\n from MatchP have pick: \"\\ \\ regex.atms r \\ dom (?pickP \\) = S \\\n range_mapping i (?pickj \\) (?pickP \\) \\ i \\ progress \\ (?pickP \\) \\ (?pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n with False show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"Max_mapping (?pickP ` regex.atms r)\"] exI[of _ \"Max (?pickj ` regex.atms r)\"])\n (auto simp: Max_mapping_coboundedI\n order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen])\n qed\nnext\n case (MatchF I r)\n from MatchF.prems obtain b where [simp]: \"right I = enat b\"\n by auto\n obtain i' where i': \"i < i'\" \"\\ \\ i + b + 1 \\ \\ \\ i'\"\n using ex_le_\\[where x=\"\\ \\ i + b + 1\"] by (auto simp add: less_eq_Suc_le)\n then have 1: \"\\ \\ i + b < \\ \\ i'\" by simp\n have ix: \"i \\ x\" if \"\\ \\ i' \\ b + \\ \\ x\" \"b + \\ \\ i < \\ \\ i'\" for x\n using less_\\D[of \\ i] that less_le_trans by fastforce\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchF.prems i' ix show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some (Suc i') else None\"] exI[of _ \"Suc i'\"])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set add.commute less_Suc_eq\n intro!: cInf_greatest dest!: spec[of _ i'] less_imp_le[THEN \\_mono, of _ i' \\])\n next\n case False\n then obtain \\ where \\: \"\\ \\ regex.atms r\" by auto\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj))\"\n define pickP where \"pickP = fst o pick\" define pickj where \"pickj = snd o pick\"\n from MatchF have pick: \"\\ \\ regex.atms r \\ dom (pickP \\) = S \\\n range_mapping (Suc i') (pickj \\) (pickP \\) \\ Suc i' \\ progress \\ (pickP \\) \\ (pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set pickj_def pickP_def\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n let ?P = \"Max_mapping (pickP ` regex.atms r)\" let ?j = \"Max (pickj ` regex.atms r)\"\n from pick[OF \\] False \\ have \"Suc i' \\ ?j\"\n by (intro order_trans[OF pick[THEN conjunct2, THEN conjunct2], OF \\] order_trans[OF progress_le_gen])\n (auto simp: Max_ge_iff dest: range_mapping_relax[of _ _ _ 0, OF _ _ order_refl, simplified])\n moreover\n note i' 1 ix\n moreover\n from MatchF.prems have \"Regex.pred_regex Formula.future_bounded r\"\n by auto\n ultimately show ?thesis using \\_mono[of _ ?j \\] less_\\D[of \\ i] pick False\n by (intro exI[of _ \"?j\"] exI[of _ \"?P\"])\n (auto 0 3 intro!: cInf_greatest\n order_trans[OF le_SucI[OF order_refl] order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen]]\n range_mapping_Max_mapping[OF _ _ ballI[OF range_mapping_relax[of \"Suc i'\" _ _ i, OF _ _ order_refl]]]\n simp: ac_simps Suc_le_eq trans_le_add2 Max_mapping_coboundedI progress_regex_def\n dest: spec[of _ \"i'\"] spec[of _ ?j])\n qed\nqed (auto split: option.splits)\n\nlemma progress_ge: \"Formula.future_bounded \\ \\ \\j. i \\ progress \\ Map.empty \\ j\"\n using progress_ge_gen[of \\ \"{}\" i \\]\n by auto\n\n\n\nlemma progress_time_conv:\n assumes \"\\i \\ i = \\ \\' i\"\n shows \"progress \\ P \\ j = progress \\' P \\ j\"\n using assms proof (induction \\ arbitrary: P)\n case (Until \\1 I \\2)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with Until show ?case\n proof (cases \"right I\")\n case (enat b)\n then show ?thesis\n proof (cases \"j\")\n case (Suc n)\n with enat * Until show ?thesis\n using \\_mono[THEN trans_le_add1]\n by (auto 8 0\n intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=n] cInf_restrict_nat[symmetric, where x=n]])\n qed simp\n qed simp\nnext\n case (MatchF I r)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with MatchF show ?case using \\_mono[THEN trans_le_add1]\n by (cases \"right I\"; cases j)\n ((auto 6 0 simp: progress_le_gen progress_regex_def intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=\"j-1\"] cInf_restrict_nat[symmetric, where x=\"j-1\"]]) [])+\nqed (auto simp: progress_regex_def)\n\nlemma Inf_UNIV_nat: \"(Inf UNIV :: nat) = 0\"\n by (simp add: cInf_eq_minimum)\n\nlemma progress_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"progress \\ P \\ (plen \\) = progress \\' P \\ (plen \\)\"\n using assms by (auto intro: progress_time_conv \\_prefix_conv)\n\nlemma bounded_rtranclp_mono:\n fixes n :: \"'x :: linorder\"\n assumes \"\\i j. R i j \\ j < n \\ S i j\" \"\\i j. R i j \\ i \\ j\"\n shows \"rtranclp R i j \\ j < n \\ rtranclp S i j\"\nproof (induct rule: rtranclp_induct)\n case (step y z)\n then show ?case\n using assms(1,2)[of y z]\n by (auto elim!: rtrancl_into_rtrancl[to_pred, rotated])\nqed auto\n\nlemma sat_prefix_conv_gen:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ P \\ (plen \\) \\ dom V = dom V' \\ dom P = dom V \\\n pred_mapping (\\x. x \\ plen \\) P \\\n (\\p i \\. p \\ dom V \\ i < the (P p) \\ the (V p) i = the (V' p) i) \\\n Formula.sat \\ V v i \\ \\ Formula.sat \\' V' v i \\\"\nproof (induction \\ arbitrary: P V V' v i)\n case (Pred e ts)\n from Pred.prems(1,4) have \"i < plen \\\"\n by (blast intro!: order.strict_trans2 progress_le_gen)\n show ?case proof (cases \"V e\")\n case None\n then have \"V' e = None\" using \\dom V = dom V'\\ by auto\n with None \\_prefix_conv[OF assms(1,2) \\i < plen \\\\] show ?thesis by simp\n next\n case (Some a)\n obtain a' where \"V' e = Some a'\" using Some \\dom V = dom V'\\ by auto\n then have \"i < the (P e)\"\n using Pred.prems(1-3) by (auto split: option.splits)\n then have \"the (V e) i = the (V' e) i\"\n using Some by (intro Pred.prems(5)) (simp_all add: domI)\n with Some \\V' e = Some a'\\ show ?thesis by simp\n qed\nnext\n case (Let p b \\ \\)\n let ?V = \"\\V \\. (V(p \\\n \\i. {v. length v = Formula.nfv \\ - b \\\n (\\zs. length zs = b \\\n Formula.sat \\ V (zs @ v) i \\)}))\"\n show ?case unfolding sat.simps proof (rule Let.IH(2))\n from Let.prems show \"i < progress \\ (P(p \\ progress \\ P \\ (plen \\))) \\ (plen \\)\"\n by simp\n from Let.prems show \"dom (?V V \\) = dom (?V V' \\')\"\n by simp\n from Let.prems show \"dom (P(p \\ progress \\ P \\ (plen \\))) = dom (?V V \\)\"\n by simp\n from Let.prems show \"pred_mapping (\\x. x \\ plen \\) (P(p \\ progress \\ P \\ (plen \\)))\"\n by (auto intro!: pred_mapping_map_upd elim!: progress_le_gen)\n next\n fix p' i \\'\n assume 1: \"p' \\ dom (?V V \\)\" and 2: \"i < the ((P(p \\ progress \\ P \\ (plen \\))) p')\"\n show \"the (?V V \\ p') i = the (?V V' \\' p') i\" proof (cases \"p' = p\")\n case True\n with Let 2 show ?thesis by auto\n next\n case False\n with 1 2 show ?thesis by (auto intro!: Let.prems(5))\n qed\n qed\nnext\n case (Eq t1 t2)\n show ?case by simp\nnext\n case (Neg \\)\n then show ?case by simp\nnext\n case (Or \\1 \\2)\n then show ?case by auto\nnext\n case (Ands l)\n from Ands.prems have \"\\\\\\set l. i < progress \\ P \\ (plen \\)\"\n by (cases l) simp_all\n with Ands show ?case unfolding sat_Ands by blast\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n with \\_prefix_conv[OF assms(1,2)] show ?case\n by (cases i) (auto split: if_splits)\nnext\n case (Next I \\)\n then have \"Suc i < plen \\\"\n by (auto intro: order.strict_trans2[OF _ progress_le_gen[of _ P \\ \\]])\n with Next.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong Next) auto\nnext\n case (Since \\1 I \\2)\n then have \"i < plen \\\"\n by (auto elim!: order.strict_trans2[OF _ progress_le_gen])\n with Since.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong ex_cong ball_cong Since) auto\nnext\n case (Until \\1 I \\2)\n from Until.prems obtain b where right[simp]: \"right I = enat b\"\n by (cases \"right I\") (auto simp add: Inf_UNIV_nat)\n from Until.prems obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\"\n \"j \\ progress \\ P \\1 (plen \\)\" \"j \\ progress \\ P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < progress \\ P \\1 (plen \\)\" and 2: \"k < progress \\ P \\2 (plen \\)\"\n if \"\\ \\ k \\ \\ \\ i + b\" for k\n using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\])+\n have 3: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" for k\n using 1[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n\n from Until.prems have \"i < progress \\' P (Formula.Until \\1 I \\2) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n then obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\"\n \"j \\ progress \\' P \\1 (plen \\)\" \"j \\ progress \\' P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"k < progress \\ P \\1 (plen \\)\" and 21: \"k < progress \\ P \\2 (plen \\)\"\n if \"\\ \\' k \\ \\ \\' i + b\" for k\n unfolding progress_prefix_conv[OF assms(1,2)]\n using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\'])+\n have 31: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n using 11[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n show ?case unfolding sat.simps\n proof ((intro ex_cong iffI; elim conjE), goal_cases LR RL)\n case (LR j)\n with Until(1)[OF 1] Until(2)[OF 2] \\_prefix_conv[OF assms(1,2) 3] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \\_mono, rotated])\n next\n case (RL j)\n with Until(1)[OF 11] Until(2)[OF 21] \\_prefix_conv[OF assms(1,2) 31] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \\_mono, rotated])\n qed\nnext\n case (MatchP I r)\n then have \"i < plen \\\"\n by (force simp: pred_mapping_alt elim!: order.strict_trans2[OF _ progress_le_gen])\n with MatchP.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro ex_cong conj_cong match_cong_strong MatchP) (auto simp: progress_regex_def split: if_splits)\nnext\n case (MatchF I r)\n from MatchF.prems obtain b where right[simp]: \"right I = enat b\"\n by (cases \"right I\") (auto simp add: Inf_UNIV_nat)\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n from MatchF.prems(1) obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" for k\n by (meson \\_mono discrete not_le order.strict_trans2 that)\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n then obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 2: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n by (meson \\_mono discrete not_le order.strict_trans2 that)\n from MatchF.prems(1,4) True show ?thesis\n unfolding sat.simps conj_commute[of \"left I \\ _\" \"_ \\ _\"]\n proof (intro ex_cong conj_cong match_cong_strong, goal_cases left right sat)\n case (left j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 1, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (right j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n qed auto\n next\n case False\n from MatchF.prems(1) False obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\" \"(\\x\\regex.atms r. j \\ progress \\ P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"\\ \\ k \\ \\ \\ i + b\" for k \\\n using that\n by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\])\n then have 2: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" \"regex.atms r \\ {}\" for k\n using that\n by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n with False obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\" \"(\\x\\regex.atms r. j \\ progress \\' P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"\\ \\' k \\ \\ \\' i + b\" for k \\\n using that using progress_prefix_conv[OF assms(1,2)]\n by (auto 0 3 elim!: order.strict_trans2[rotated] intro: less_\\D[of \\'])\n have 21: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n using 11[OF that(1)] False by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n show ?thesis unfolding sat.simps conj_commute[of \"left I \\ _\" \"_ \\ _\"]\n proof ((intro ex_cong conj_cong match_cong_strong MatchF(1)[OF _ _ MatchF(3-6)]; assumption?), goal_cases right left progress)\n case (right j)\n with False show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (left j)\n with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 21, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (progress j k z)\n with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]\n by (elim 1[rotated])\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim!: order.trans[OF \\_mono, rotated])\n qed\n qed\nqed auto\n\nlemma sat_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ Map.empty \\ (plen \\) \\\n Formula.sat \\ Map.empty v i \\ \\ Formula.sat \\' Map.empty v i \\\"\n by (erule sat_prefix_conv_gen[OF assms]) auto\n\nlemma progress_remove_neg[simp]: \"progress \\ P (remove_neg \\) j = progress \\ P \\ j\"\n by (cases \\) simp_all\n\nlemma safe_progress_get_and: \"safe_formula \\ \\\n Min ((\\\\. progress \\ P \\ j) ` set (get_and_list \\)) = progress \\ P \\ j\"\n by (induction \\ rule: get_and_list.induct) auto\n\nlemma progress_convert_multiway: \"safe_formula \\ \\ progress \\ P (convert_multiway \\) j = progress \\ P \\ j\"\nproof (induction \\ arbitrary: P rule: safe_formula_induct)\n case (And_safe \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ \\)\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (get_and_list ?c\\ @ get_and_list ?c\\)\"\n using And_safe by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_safe.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (And_Not \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ (Formula.Neg \\))\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (Formula.Neg ?c\\ # get_and_list ?c\\)\"\n using And_Not by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_Not.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (MatchP I r)\n from MatchP show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nnext\n case (MatchF I r)\n from MatchF show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] arg_cong[of _ _ Inf] arg_cong[of _ _ \"(\\) _\"]\n image_cong Collect_cong all_cong1 imp_cong conj_cong image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nqed auto\n\n\ninterpretation verimon: monitor_timed_progress Formula.future_bounded \"\\\\. progress \\ Map.empty\"\n by (unfold_locales, (fact progress_mono progress_le progress_time_conv sat_prefix_conv |\n simp add: mmonitorable_def progress_ge)+)\n\nabbreviation \"mverdicts \\ verimon.verdicts\"\n\n\nsubsection \\Correctness\\\n\nsubsubsection \\Invariants\\\n\ndefinition wf_mbuf2 :: \"nat \\ nat \\ nat \\ (nat \\ event_data table \\ bool) \\ (nat \\ event_data table \\ bool) \\\n event_data mbuf2 \\ bool\" where\n \"wf_mbuf2 i ja jb P Q buf \\ i \\ ja \\ i \\ jb \\ (case buf of (xs, ys) \\\n list_all2 P [i.. list_all2 Q [i.. 'b \\ 'c \\ bool) \\ 'a list \\ 'b list \\ 'c list \\ bool\" for P :: \"('a \\ 'b \\ 'c \\ bool)\" where\n \"list_all3 P [] [] []\"\n| \"P a1 a2 a3 \\ list_all3 P q1 q2 q3 \\ list_all3 P (a1 # q1) (a2 # q2) (a3 # q3)\"\n\nlemma list_all3_list_all2D: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma list_all2_list_all3I: \"length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs \\\n list_all3 P xs ys zs\"\n by (induct xs ys arbitrary: zs rule: list_induct2)\n (auto simp: list_all2_Cons1 intro: list_all3.intros)\n\nlemma list_all3_list_all2_eq: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n using list_all2_list_all3I list_all3_list_all2D by blast\n\nlemma list_all3_mapD: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n by (induct \"map f xs\" \"map g ys\" \"map h zs\" arbitrary: xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_mapI: \"list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs \\\n list_all3 P (map f xs) (map g ys) (map h zs)\"\n by (induct xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_map_iff: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n using list_all3_mapD list_all3_mapI by blast\n\nlemmas list_all3_map =\n list_all3_map_iff[where g=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and g=id, unfolded list.map_id id_apply]\n\nlemma list_all3_conv_all_nth:\n \"list_all3 P xs ys zs =\n (length xs = length ys \\ length ys = length zs \\ (\\i < length xs. P (xs!i) (ys!i) (zs!i)))\"\n by (auto simp add: list_all3_list_all2_eq list_all2_conv_all_nth)\n\nlemma list_all3_refl [intro?]:\n \"(\\x. x \\ set xs \\ P x x x) \\ list_all3 P xs xs xs\"\n by (simp add: list_all3_conv_all_nth)\n\ndefinition wf_mbufn :: \"nat \\ nat list \\ (nat \\ event_data table \\ bool) list \\ event_data mbufn \\ bool\" where\n \"wf_mbufn i js Ps buf \\ list_all3 (\\P j xs. i \\ j \\ list_all2 P [i.. _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula \\ Formula.formula \\ event_data mbuf2 \\ bool\" where\n \"wf_mbuf2' \\ P V j n R \\ \\ buf \\ wf_mbuf2 (min (progress \\ P \\ j) (progress \\ P \\ j))\n (progress \\ P \\ j) (progress \\ P \\ j)\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) buf\"\n\ndefinition wf_mbufn' :: \"Formula.trace \\ _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula Regex.regex \\ event_data mbufn \\ bool\" where\n \"wf_mbufn' \\ P V j n R r buf \\ (case to_mregex r of (mr, \\s) \\\n wf_mbufn (progress_regex \\ P r j) (map (\\\\. progress \\ P \\ j) \\s)\n (map (\\\\ i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n buf)\"\n\nlemma wf_mbuf2'_UNIV_alt: \"wf_mbuf2' \\ P V j n UNIV \\ \\ buf \\ (case buf of (xs, ys) \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] xs \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] ys)\"\n unfolding wf_mbuf2'_def wf_mbuf2_def\n by (simp add: mem_restr_UNIV[THEN eqTrueI, abs_def] split: prod.split)\n\ndefinition wf_ts :: \"Formula.trace \\ _ \\ nat \\ Formula.formula \\ Formula.formula \\ ts list \\ bool\" where\n \"wf_ts \\ P j \\ \\ ts \\ list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j).. _ \\ nat \\ Formula.formula Regex.regex \\ ts list \\ bool\" where\n \"wf_ts_regex \\ P j r ts \\ list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j.. I \\ \\ Formula.Since (if pos then \\ else Formula.Neg \\) I \\\"\n\ndefinition (in msaux) wf_since_aux :: \"Formula.trace \\ _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'msaux \\ nat \\ bool\" where\n \"wf_since_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n qtable (args_n args) (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n\ndefinition wf_matchP_aux :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data mr\\aux \\ nat \\ bool\" where\n \"wf_matchP_aux \\ V n R I r aux ne \\ sorted_wrt (\\x y. fst x > fst y) aux \\\n (\\t X. (t, X) \\ set aux \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ (ne-1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (case to_mregex r of (mr, \\s) \\\n (\\ms \\ RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1)\n (Formula.MatchP (point (\\ \\ (ne-1) - t)) (from_mregex ms \\s)))\n (lookup X ms)))) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ (ne-1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set aux))\"\n\nlemma qtable_mem_restr_UNIV: \"qtable n A(mem_restr UNIV) Q X = wf_table n A Q X\"\n unfolding qtable_def by auto\n\nlemma (in msaux) wf_since_aux_UNIV_alt:\n \"wf_since_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n wf_table (args_n args) (Formula.fv \\)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n unfolding wf_since_aux_def qtable_mem_restr_UNIV ..\n\ndefinition wf_until_auxlist :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\ bool \\\n Formula.formula \\ \\ \\ Formula.formula \\ event_data muaux \\ nat \\ bool\" where\n \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. if pos then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length auxlist \\ mem (\\ \\ j - \\ \\ i) I \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) r2)\n auxlist [ne.. _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'muaux \\ nat \\ bool\" where\n \"wf_until_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n wf_until_auxlist \\ V (args_n args) R (args_pos args) \\ (args_ivl args) \\ auxlist ne)\"\n\nlemma (in muaux) wf_until_aux_UNIV_alt:\n \"wf_until_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n wf_table (args_n args) (Formula.fv \\) (\\v. if (args_pos args)\n then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n wf_table (args_n args) (Formula.fv \\) (\\v. \\j. i \\ j \\ j < ne + length auxlist \\ mem (\\ \\ j - \\ \\ i) (args_ivl args) \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\)) r2)\n auxlist [ne.. _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data ml\\aux \\ nat \\ nat \\ bool\" where\n \"wf_matchF_aux \\ V n R I r aux ne k \\ (case to_mregex r of (mr, \\s) \\\n list_all2 (\\x i. case x of (t, rels, rel) \\ t = \\ \\ i \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) i \\)) \\s rels \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length aux + k \\ mem (\\ \\ j - \\ \\ i) I \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel)\n aux [ne.. V n R I r st i =\n (case st of (aux, Y) \\ aux \\ [] \\ wf_matchF_aux \\ V n R I r aux i 0 \\\n (case to_mregex r of (mr, \\s) \\ \\ms \\ LPDs mr.\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux - 1)) (lookup Y ms)))\"\n\ndefinition lift_envs' :: \"nat \\ event_data list set \\ event_data list set\" where\n \"lift_envs' b R = (\\(xs,ys). xs @ ys) ` ({xs. length xs = b} \\ R)\"\n\nfun formula_of_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ Formula.formula\" where\n \"formula_of_constraint (t1, True, MEq, t2) = Formula.Eq t1 t2\"\n| \"formula_of_constraint (t1, True, MLess, t2) = Formula.Less t1 t2\"\n| \"formula_of_constraint (t1, True, MLessEq, t2) = Formula.LessEq t1 t2\"\n| \"formula_of_constraint (t1, False, MEq, t2) = Formula.Neg (Formula.Eq t1 t2)\"\n| \"formula_of_constraint (t1, False, MLess, t2) = Formula.Neg (Formula.Less t1 t2)\"\n| \"formula_of_constraint (t1, False, MLessEq, t2) = Formula.Neg (Formula.LessEq t1 t2)\"\n\ninductive (in maux) wf_mformula :: \"Formula.trace \\ nat \\ _ \\ _ \\\n nat \\ event_data list set \\ ('msaux, 'muaux) mformula \\ Formula.formula \\ bool\"\n for \\ j where\n Eq: \"is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1. x < n \\ \\x\\Formula.fv_trm t2. x < n \\\n wf_mformula \\ j P V n R (MRel (eq_rel n t1 t2)) (Formula.Eq t1 t2)\"\n | neq_Var: \"x < n \\\n wf_mformula \\ j P V n R (MRel empty_table) (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var x)))\"\n | Pred: \"\\x\\Formula.fv (Formula.Pred e ts). x < n \\\n \\t\\set ts. Formula.is_Var t \\ Formula.is_Const t \\\n wf_mformula \\ j P V n R (MPred e ts) (Formula.Pred e ts)\"\n | Let: \"wf_mformula \\ j P V m UNIV \\ \\' \\\n wf_mformula \\ j (P(p \\ progress \\ P \\' j))\n (V(p \\ \\i. {v. length v = m - b \\ (\\zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\')})) n R \\ \\' \\\n {0.. Formula.fv \\' \\ b \\ m \\ m = Formula.nfv \\' \\\n wf_mformula \\ j P V n R (MLet p m b \\ \\) (Formula.Let p b \\' \\')\"\n | And: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if pos then \\ = Formula.And \\' \\'\n else \\ = Formula.And \\' (Formula.Neg \\') \\ Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MAnd (fv \\') \\ pos (fv \\') \\ buf) \\\"\n | AndAssign: \"wf_mformula \\ j P V n R \\ \\' \\\n x < n \\ x \\ Formula.fv \\' \\ Formula.fv_trm t \\ Formula.fv \\' \\ (x, t) = conf \\\n \\' = Formula.Eq (Formula.Var x) t \\ \\' = Formula.Eq t (Formula.Var x) \\\n wf_mformula \\ j P V n R (MAndAssign \\ conf) (Formula.And \\' \\')\"\n | AndRel: \"wf_mformula \\ j P V n R \\ \\' \\\n \\' = formula_of_constraint conf \\\n (let (t1, _, _, t2) = conf in Formula.fv_trm t1 \\ Formula.fv_trm t2 \\ Formula.fv \\') \\\n wf_mformula \\ j P V n R (MAndRel \\ conf) (Formula.And \\' \\')\"\n | Ands: \"list_all2 (\\\\ \\'. wf_mformula \\ j P V n R \\ \\') l (l_pos @ map remove_neg l_neg) \\\n wf_mbufn (progress \\ P (Formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (l_pos @ map remove_neg l_neg)) (map (\\\\ i.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (l_pos @ map remove_neg l_neg)) buf \\\n (l_pos, l_neg) = partition safe_formula l' \\\n l_pos \\ [] \\\n list_all safe_formula (map remove_neg l_neg) \\\n A_pos = map fv l_pos \\\n A_neg = map fv l_neg \\\n \\(set A_neg) \\ \\(set A_pos) \\\n wf_mformula \\ j P V n R (MAnds A_pos A_neg l buf) (Formula.Ands l')\"\n | Or: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n Formula.fv \\' = Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MOr \\ \\ buf) (Formula.Or \\' \\')\"\n | Neg: \"wf_mformula \\ j P V n R \\ \\' \\ Formula.fv \\' = {} \\\n wf_mformula \\ j P V n R (MNeg \\) (Formula.Neg \\')\"\n | Exists: \"wf_mformula \\ j P V (Suc n) (lift_envs R) \\ \\' \\\n wf_mformula \\ j P V n R (MExists \\) (Formula.Exists \\')\"\n | Agg: \"wf_mformula \\ j P V (b + n) (lift_envs' b R) \\ \\' \\\n y < n \\\n y + b \\ Formula.fv \\' \\\n {0.. Formula.fv \\' \\\n Formula.fv_trm f \\ Formula.fv \\' \\\n g0 = (Formula.fv \\' \\ {0..\n wf_mformula \\ j P V n R (MAgg g0 y \\ b f \\) (Formula.Agg y \\ b f \\')\"\n | Prev: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ j = 0 \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [min (progress \\ P \\' j) (j-1).. P \\' j] buf \\\n list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\' j) (j-1)..\n wf_mformula \\ j P V n R (MPrev I \\ first buf nts) (Formula.Prev I \\')\"\n | Next: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ progress \\ P \\' j = 0 \\\n list_all2 (\\i t. t = \\ \\ i) [progress \\ P \\' j - 1..\n wf_mformula \\ j P V n R (MNext I \\ first nts) (Formula.Next I \\')\"\n | Since: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n wf_since_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Since \\'' I \\') j) \\\n wf_mformula \\ j P V n R (MSince args \\ \\ buf nts aux) (Formula.Since \\'' I \\')\"\n | Until: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n wf_until_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Until \\'' I \\') j) \\\n progress \\ P (Formula.Until \\'' I \\') j + length_muaux args aux = min (progress \\ P \\' j) (progress \\ P \\' j) \\\n wf_mformula \\ j P V n R (MUntil args \\ \\ buf nts aux) (Formula.Until \\'' I \\')\"\n | MatchP: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (RPDs mr) \\\n safe_regex Past Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j) \\\n wf_mformula \\ j P V n R (MMatchP I mr mrs \\s buf nts aux) (Formula.MatchP I r)\"\n | MatchF: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (LPDs mr) \\\n safe_regex Futu Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j \\\n wf_mformula \\ j P V n R (MMatchF I mr mrs \\s buf nts aux) (Formula.MatchF I r)\"\n\ndefinition (in maux) wf_mstate :: \"Formula.formula \\ Formula.prefix \\ event_data list set \\ ('msaux, 'muaux) mstate \\ bool\" where\n \"wf_mstate \\ \\ R st \\ mstate_n st = Formula.nfv \\ \\ (\\\\. prefix_of \\ \\ \\\n mstate_i st = progress \\ Map.empty \\ (plen \\) \\\n wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\)\"\n\n\nsubsubsection \\Initialisation\\\n\n\nlemma wf_mbuf2'_0: \"pred_mapping (\\x. x = 0) P \\ wf_mbuf2' \\ P V 0 n R \\ \\ ([], [])\"\n unfolding wf_mbuf2'_def wf_mbuf2_def by simp\n\nlemma wf_mbufn'_0: \"to_mregex r = (mr, \\s) \\ pred_mapping (\\x. x = 0) P \\ wf_mbufn' \\ P V 0 n R r (replicate (length \\s) [])\"\n unfolding wf_mbufn'_def wf_mbufn_def map_replicate_const[symmetric]\n by (auto simp: list_all3_map intro: list_all3_refl simp: Min_eq_iff progress_regex_def)\n\nlemma wf_ts_0: \"wf_ts \\ P 0 \\ \\ []\"\n unfolding wf_ts_def by simp\n\nlemma wf_ts_regex_0: \"wf_ts_regex \\ P 0 r []\"\n unfolding wf_ts_regex_def by simp\n\nlemma (in msaux) wf_since_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n wf_since_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b) \\' \\' (init_msaux (init_args I n (Formula.fv \\') (Formula.fv \\') b)) 0\"\n unfolding wf_since_aux_def by (auto intro!: valid_init_msaux)\n\nlemma (in muaux) wf_until_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n wf_until_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b) \\' \\' (init_muaux (init_args I n (Formula.fv \\') (Formula.fv \\') b)) 0\"\n unfolding wf_until_aux_def wf_until_auxlist_def by (auto intro: valid_init_muaux)\n\nlemma wf_matchP_aux_Nil: \"wf_matchP_aux \\ V n R I r [] 0\"\n unfolding wf_matchP_aux_def by simp\n\nlemma wf_matchF_aux_Nil: \"wf_matchF_aux \\ V n R I r [] 0 k\"\n unfolding wf_matchF_aux_def by simp\n\nlemma fv_regex_alt: \"safe_regex m g r \\ Formula.fv_regex r = (\\\\ \\ atms r. Formula.fv \\)\"\n unfolding fv_regex_alt atms_def\n by (auto 0 3 dest: safe_regex_safe_formula)\n\nlemmas to_mregex_atms =\n to_mregex_ok[THEN conjunct1, THEN equalityD1, THEN set_mp, rotated]\n\nlemma (in maux) wf_minit0: \"safe_formula \\ \\ \\x\\Formula.fv \\. x < n \\\n pred_mapping (\\x. x = 0) P \\\n wf_mformula \\ 0 P V n R (minit0 n \\) \\\"\nproof (induction arbitrary: n R P V rule: safe_formula_induct)\n case (Eq_Const c d)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var1 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var2 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (neq_Var x y)\n then show ?case by (auto intro!: wf_mformula.neq_Var)\nnext\n case (Pred e ts)\n then show ?case by (auto intro!: wf_mformula.Pred)\nnext\n case (Let p b \\ \\)\n with fvi_less_nfv show ?case\n by (auto simp: pred_mapping_alt dom_def intro!: wf_mformula.Let Let(4,5))\nnext\n case (And_assign \\ \\)\n then have 1: \"\\x\\fv \\. x < n\" by simp\n from 1 \\safe_assignment (fv \\) \\\\\n obtain x t where\n \"x < n\" \"x \\ fv \\\" \"fv_trm t \\ fv \\\"\n \"\\ = Formula.Eq (Formula.Var x) t \\ \\ = Formula.Eq t (Formula.Var x)\"\n unfolding safe_assignment_def by (force split: formula.splits trm.splits)\n with And_assign show ?case\n by (auto intro!: wf_mformula.AndAssign split: trm.splits)\nnext\n case (And_safe \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (And_constraint \\ \\)\n from \\fv \\ \\ fv \\\\ \\is_constraint \\\\\n obtain t1 p c t2 where\n \"(t1, p, c, t2) = split_constraint \\\"\n \"formula_of_constraint (split_constraint \\) = \\\"\n \"fv_trm t1 \\ fv_trm t2 \\ fv \\\"\n by (induction rule: is_constraint.induct) auto\n with And_constraint show ?case\n by (auto 0 3 intro!: wf_mformula.AndRel)\nnext\n case (And_Not \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (Ands l pos neg)\n note posneg = \"Ands.hyps\"(1)\n let ?wf_minit = \"\\x. wf_mformula \\ 0 P V n R (minit0 n x)\"\n let ?pos = \"filter safe_formula l\"\n let ?neg = \"filter (Not \\ safe_formula) l\"\n have \"list_all2 ?wf_minit ?pos pos\"\n using Ands.IH(1) Ands.prems posneg by (auto simp: list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all2 ?wf_minit (map remove_neg ?neg) (map remove_neg neg)\"\n using Ands.IH(2) Ands.prems posneg by (auto simp: list.rel_map list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all3 (\\_ _ _. True) (?pos @ map remove_neg ?neg) (?pos @ map remove_neg ?neg) l\"\n by (auto simp: list_all3_conv_all_nth comp_def sum_length_filter_compl)\n moreover have \"l \\ [] \\ (MIN \\\\set l. (0 :: nat)) = 0\"\n by (cases l) (auto simp: Min_eq_iff)\n ultimately show ?case using Ands.hyps Ands.prems(2)\n by (auto simp: wf_mbufn_def list_all3_map list.rel_map map_replicate_const[symmetric] subset_eq\n map_map[symmetric] map_append[symmetric] simp del: map_map map_append\n intro!: wf_mformula.Ands list_all2_appendI)\nnext\n case (Neg \\)\n then show ?case by (auto intro!: wf_mformula.Neg)\nnext\n case (Or \\ \\)\n then show ?case by (auto intro!: wf_mformula.Or wf_mbuf2'_0)\nnext\n case (Exists \\)\n then show ?case by (auto simp: fvi_Suc_bound intro!: wf_mformula.Exists)\nnext\n case (Agg y \\ b f \\)\n then show ?case by (auto intro!: wf_mformula.Agg Agg.IH fvi_plus_bound)\nnext\n case (Prev I \\)\n thm wf_mformula.Prev[where P=P]\n then show ?case by (auto intro!: wf_mformula.Prev)\nnext\n case (Next I \\)\n then show ?case by (auto intro!: wf_mformula.Next)\nnext\n case (Since \\ I \\)\n then show ?case\n using wf_since_aux_Nil\n by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)\nnext\n case (Not_Since \\ I \\)\n then show ?case\n using wf_since_aux_Nil\n by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)\nnext\n case (Until \\ I \\)\n then show ?case\n using valid_length_muaux[OF valid_init_muaux[OF Until(1)]] wf_until_aux_Nil\n by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)\nnext\n case (Not_Until \\ I \\)\n then show ?case\n using valid_length_muaux[OF valid_init_muaux[OF Not_Until(1)]] wf_until_aux_Nil\n by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)\nnext\n case (MatchP I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchP list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchP_aux_Nil\n dest!: to_mregex_atms)\nnext\n case (MatchF I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt progress_le Min_eq_iff progress_regex_def\n simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchF list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchF_aux_Nil\n dest!: to_mregex_atms)\nqed\n\nlemma (in maux) wf_mstate_minit: \"safe_formula \\ \\ wf_mstate \\ pnil R (minit \\)\"\n unfolding wf_mstate_def minit_def Let_def\n by (auto intro!: wf_minit0 fvi_less_nfv)\n\n\nsubsubsection \\Evaluation\\\n\nlemma match_wf_tuple: \"Some f = match ts xs \\\n wf_tuple n (\\t\\set ts. Formula.fv_trm t) (Table.tabulate f 0 n)\"\n by (induction ts xs arbitrary: f rule: match.induct)\n (fastforce simp: wf_tuple_def split: if_splits option.splits)+\n\nlemma match_fvi_trm_None: \"Some f = match ts xs \\ \\t\\set ts. x \\ Formula.fv_trm t \\ f x = None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_fvi_trm_Some: \"Some f = match ts xs \\ t \\ set ts \\ x \\ Formula.fv_trm t \\ f x \\ None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_eval_trm: \"\\t\\set ts. \\i\\Formula.fv_trm t. i < n \\ Some f = match ts xs \\\n map (Formula.eval_trm (Table.tabulate (\\i. the (f i)) 0 n)) ts = xs\"\nproof (induction ts xs arbitrary: f rule: match.induct)\n case (3 x ts y ys)\n from 3(1)[symmetric] 3(2,3) show ?case\n by (auto 0 3 dest: match_fvi_trm_Some sym split: option.splits if_splits intro!: eval_trm_fv_cong)\nqed (auto split: if_splits)\n\nlemma wf_tuple_tabulate_Some: \"wf_tuple n A (Table.tabulate f 0 n) \\ x \\ A \\ x < n \\ \\y. f x = Some y\"\n unfolding wf_tuple_def by auto\n\nlemma ex_match: \"wf_tuple n (\\t\\set ts. Formula.fv_trm t) v \\\n \\t\\set ts. (\\x\\Formula.fv_trm t. x < n) \\ (Formula.is_Var t \\ Formula.is_Const t) \\\n \\f. match ts (map (Formula.eval_trm (map the v)) ts) = Some f \\ v = Table.tabulate f 0 n\"\nproof (induction ts \"map (Formula.eval_trm (map the v)) ts\" arbitrary: v rule: match.induct)\n case (3 x ts y ys)\n then show ?case\n proof (cases \"x \\ (\\t\\set ts. Formula.fv_trm t)\")\n case True\n with 3 show ?thesis\n by (auto simp: insert_absorb dest!: wf_tuple_tabulate_Some meta_spec[of _ v])\n next\n case False\n with 3(3,4) have\n *: \"map (Formula.eval_trm (map the v)) ts = map (Formula.eval_trm (map the (v[x := None]))) ts\"\n by (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n from False 3(2-4) obtain f where\n \"match ts (map (Formula.eval_trm (map the v)) ts) = Some f\" \"v[x := None] = Table.tabulate f 0 n\"\n unfolding *\n by (atomize_elim, intro 3(1)[of \"v[x := None]\"])\n (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n moreover from False this have \"f x = None\" \"length v = n\"\n by (auto dest: match_fvi_trm_None[OF sym] arg_cong[of _ _ length])\n ultimately show ?thesis using 3(3)\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def)\n qed\nqed (auto simp: wf_tuple_def intro: nth_equalityI)\n\nlemma eq_rel_eval_trm: \"v \\ eq_rel n t1 t2 \\ is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1 \\ Formula.fv_trm t2. x < n \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2\"\n by (cases t1; cases t2) (simp_all add: is_simple_eq_def singleton_table_def split: if_splits)\n\nlemma in_eq_rel: \"wf_tuple n (Formula.fv_trm t1 \\ Formula.fv_trm t2) v \\\n is_simple_eq t1 t2 \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2 \\\n v \\ eq_rel n t1 t2\"\n by (cases t1; cases t2)\n (auto simp: is_simple_eq_def singleton_table_def wf_tuple_def unit_table_def\n intro!: nth_equalityI split: if_splits)\n\nlemma table_eq_rel: \"is_simple_eq t1 t2 \\\n table n (Formula.fv_trm t1 \\ Formula.fv_trm t2) (eq_rel n t1 t2)\"\n by (cases t1; cases t2; simp add: is_simple_eq_def)\n\nlemma wf_tuple_Suc_fviD: \"wf_tuple (Suc n) (Formula.fvi b \\) v \\ wf_tuple n (Formula.fvi (Suc b) \\) (tl v)\"\n unfolding wf_tuple_def by (simp add: fvi_Suc nth_tl)\n\nlemma table_fvi_tl: \"table (Suc n) (Formula.fvi b \\) X \\ table n (Formula.fvi (Suc b) \\) (tl ` X)\"\n unfolding table_def by (auto intro: wf_tuple_Suc_fviD)\n\nlemma wf_tuple_Suc_fvi_SomeI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (Some x # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma wf_tuple_Suc_fvi_NoneI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (None # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma qtable_project_fv: \"qtable (Suc n) (fv \\) (mem_restr (lift_envs R)) P X \\\n qtable n (Formula.fvi (Suc 0) \\) (mem_restr R)\n (\\v. \\x. P ((if 0 \\ fv \\ then Some x else None) # v)) (tl ` X)\"\n using neq0_conv by (fastforce simp: image_iff Bex_def fvi_Suc elim!: qtable_cong dest!: qtable_project)\n\nlemma mem_restr_lift_envs'_append[simp]:\n \"length xs = b \\ mem_restr (lift_envs' b R) (xs @ ys) = mem_restr R ys\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: list_all2_append list.rel_map intro!: exI[where x=\"map the xs\"] list.rel_refl)\n\nlemma nth_list_update_alt: \"xs[i := x] ! j = (if i < length xs \\ i = j then x else xs ! j)\"\n by auto\n\nlemma wf_tuple_upd_None: \"wf_tuple n A xs \\ A - {i} = B \\ wf_tuple n B (xs[i:=None])\"\n unfolding wf_tuple_def\n by (auto simp: nth_list_update_alt)\n\nlemma mem_restr_upd_None: \"mem_restr R xs \\ mem_restr R (xs[i:=None])\"\n unfolding mem_restr_def\n by (auto simp: list_all2_conv_all_nth nth_list_update_alt)\n\nlemma mem_restr_dropI: \"mem_restr (lift_envs' b R) xs \\ mem_restr R (drop b xs)\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: append_eq_conv_conj list_all2_append2)\n\nlemma mem_restr_dropD:\n assumes \"b \\ length xs\" and \"mem_restr R (drop b xs)\"\n shows \"mem_restr (lift_envs' b R) xs\"\nproof -\n let ?R = \"\\a b. a \\ None \\ a = Some b\"\n from assms(2) obtain v where \"v \\ R\" and \"list_all2 ?R (drop b xs) v\"\n unfolding mem_restr_def ..\n show ?thesis unfolding mem_restr_def proof\n have \"list_all2 ?R (take b xs) (map the (take b xs))\"\n by (auto simp: list.rel_map intro!: list.rel_refl)\n moreover note \\list_all2 ?R (drop b xs) v\\\n ultimately have \"list_all2 ?R (take b xs @ drop b xs) (map the (take b xs) @ v)\"\n by (rule list_all2_appendI)\n then show \"list_all2 ?R xs (map the (take b xs) @ v)\" by simp\n show \"map the (take b xs) @ v \\ lift_envs' b R\"\n unfolding lift_envs'_def using assms(1) \\v \\ R\\ by auto\n qed\nqed\n\nlemma wf_tuple_append: \"wf_tuple a {x \\ A. x < a} xs \\\n wf_tuple b {x - a | x. x \\ A \\ x \\ a} ys \\\n wf_tuple (a + b) A (xs @ ys)\"\n unfolding wf_tuple_def by (auto simp: nth_append eq_diff_iff)\n\nlemma wf_tuple_map_Some: \"length xs = n \\ {0.. A \\ wf_tuple n A (map Some xs)\"\n unfolding wf_tuple_def by auto\n\nlemma wf_tuple_drop: \"wf_tuple (b + n) A xs \\ {x - b | x. x \\ A \\ x \\ b} = B \\\n wf_tuple n B (drop b xs)\"\n unfolding wf_tuple_def by force\n\nlemma ecard_image: \"inj_on f A \\ ecard (f ` A) = ecard A\"\n unfolding ecard_def by (auto simp: card_image dest: finite_imageD)\n\nlemma meval_trm_eval_trm: \"wf_tuple n A x \\ fv_trm t \\ A \\ \\i\\A. i < n \\\n meval_trm t x = Formula.eval_trm (map the x) t\"\n unfolding wf_tuple_def\n by (induction t) simp_all\n\nlemma list_update_id: \"xs ! i = z \\ xs[i:=z] = xs\"\n by (induction xs arbitrary: i) (auto split: nat.split)\n\nlemma qtable_wf_tupleD: \"qtable n A P Q X \\ \\x\\X. wf_tuple n A x\"\n unfolding qtable_def table_def by blast\n\nlemma qtable_eval_agg:\n assumes inner: \"qtable (b + n) (Formula.fv \\) (mem_restr (lift_envs' b R))\n (\\v. Formula.sat \\ V (map the v) i \\) rel\"\n and n: \"\\x\\Formula.fv (Formula.Agg y \\ b f \\). x < n\"\n and fresh: \"y + b \\ Formula.fv \\\"\n and b_fv: \"{0.. Formula.fv \\\"\n and f_fv: \"Formula.fv_trm f \\ Formula.fv \\\"\n and g0: \"g0 = (Formula.fv \\ \\ {0.. b f \\)) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)) (eval_agg n g0 y \\ b f rel)\"\n (is \"qtable _ ?fv _ ?Q ?rel'\")\nproof -\n define M where \"M = (\\v. {(x, ecard Zs) | x Zs.\n Zs = {zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\ \\ Formula.eval_trm (zs @ v) f = x} \\\n Zs \\ {}})\"\n have f_fvi: \"Formula.fvi_trm b f \\ Formula.fvi b \\\"\n using f_fv by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n show ?thesis proof (cases \"g0 \\ rel = empty_table\")\n case True\n then have [simp]: \"Formula.fvi b \\ = {}\"\n by (auto simp: g0 fvi_iff_fv(1)[where b=b])\n then have [simp]: \"Formula.fvi_trm b f = {}\"\n using f_fvi by auto\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\" by (simp add: eval_agg_def True)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n have \"\\ Formula.sat \\ V (zs @ map the v) i \\\" if [simp]: \"length zs = b\" for zs\n proof -\n let ?zs = \"map2 (\\z i. if i \\ Formula.fv \\ then Some z else None) zs [0.. fv \\. x < b} ?zs\"\n by (simp add: wf_tuple_def)\n then have \"wf_tuple (b + n) (Formula.fv \\) (?zs @ v[y:=None])\"\n using \\wf_tuple n ?fv v\\ True\n by (auto simp: g0 intro!: wf_tuple_append wf_tuple_upd_None)\n then have \"\\ Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\\"\n using True \\mem_restr R v\\\n by (auto simp del: map_append dest!: in_qtableI[OF inner, rotated -1]\n intro!: mem_restr_upd_None)\n also have \"Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\ \\ Formula.sat \\ V (zs @ map the v) i \\\"\n using True by (auto simp: g0 nth_append intro!: sat_fv_cong)\n finally show ?thesis .\n qed\n then have M_empty: \"M (map the v) = {}\"\n unfolding M_def by blast\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0 singleton_table_def)\n have \"v \\ singleton_table n y (the (v ! y))\" \"length v = n\"\n using \\wf_tuple n ?fv v\\ unfolding wf_tuple_def singleton_table_def\n by (auto simp add: tabulate_alt map_nth\n intro!: trans[OF map_cong[where g=\"(!) v\", simplified nth_map, OF refl], symmetric])\n then show \"v \\ eval_agg n g0 y \\ b f rel\"\n if \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0)\n qed\n next\n case non_default_case: False\n have union_fv: \"{0.. (\\x. x + b) ` Formula.fvi b \\ = fv \\\"\n using b_fv\n by (auto simp: fvi_iff_fv(1)[where b=b] intro!: image_eqI[where b=x and x=\"x - b\" for x])\n have b_n: \"\\x\\fv \\. x < b + n\"\n proof\n fix x assume \"x \\ fv \\\"\n show \"x < b + n\" proof (cases \"x \\ b\")\n case True\n with \\x \\ fv \\\\ have \"x - b \\ ?fv\"\n by (simp add: fvi_iff_fv(1)[where b=b])\n then show ?thesis using n f_fvi by (auto simp: Un_absorb2)\n qed simp\n qed\n\n define M' where \"M' = (\\k. let group = Set.filter (\\x. drop b x = k) rel;\n images = meval_trm f ` group\n in (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` images)\"\n have M'_M: \"M' (drop b x) = M (map the (drop b x))\" if \"x \\ rel\" \"mem_restr (lift_envs' b R) x\" for x\n proof -\n from that have wf_x: \"wf_tuple (b + n) (fv \\) x\"\n by (auto elim!: in_qtableE[OF inner])\n then have wf_zs_x: \"wf_tuple (b + n) (fv \\) (map Some zs @ drop b x)\"\n if \"length zs = b\" for zs\n using that b_fv\n by (auto intro!: wf_tuple_append wf_tuple_map_Some wf_tuple_drop)\n have 1: \"(length zs = b \\ Formula.sat \\ V (zs @ map the (drop b x)) i \\ \\\n Formula.eval_trm (zs @ map the (drop b x)) f = y) \\\n (\\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ meval_trm f a = y)\"\n (is \"?A \\ (\\a. ?B a)\") for y zs\n proof (intro iffI conjI)\n assume ?A\n then have \"?B (map Some zs @ drop (length zs) x)\"\n using in_qtableI[OF inner wf_zs_x] \\mem_restr (lift_envs' b R) x\\\n meval_trm_eval_trm[OF wf_zs_x f_fv b_n]\n by (auto intro!: mem_restr_dropI)\n then show \"\\a. ?B a\" ..\n next\n assume \"\\a. ?B a\"\n then obtain a where \"?B a\" ..\n then have \"a \\ rel\" and a_eq: \"a = map Some zs @ drop b x\"\n using append_take_drop_id[of b a] by auto\n then have \"length a = b + n\"\n using inner unfolding qtable_def table_def\n by (blast intro!: wf_tuple_length)\n then show \"length zs = b\"\n using wf_tuple_length[OF wf_x] unfolding a_eq by simp\n then have \"mem_restr (lift_envs' b R) a\"\n using \\mem_restr _ x\\ unfolding a_eq by (auto intro!: mem_restr_dropI)\n then show \"Formula.sat \\ V (zs @ map the (drop b x)) i \\\"\n using in_qtableE[OF inner \\a \\ rel\\]\n by (auto simp: a_eq sat_fv_cong[THEN iffD1, rotated -1])\n from \\?B a\\ show \"Formula.eval_trm (zs @ map the (drop b x)) f = y\"\n using meval_trm_eval_trm[OF wf_zs_x f_fv b_n, OF \\length zs = b\\]\n unfolding a_eq by simp\n qed\n have 2: \"map Some (map the (take b a)) = take b a\" if \"a \\ rel\" for a\n using that b_fv inner[THEN qtable_wf_tupleD]\n unfolding table_def wf_tuple_def\n by (auto simp: list_eq_iff_nth_eq)\n have 3: \"ecard {zs. \\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ P a} =\n ecard {a. a \\ rel \\ drop b a = drop b x \\ P a}\" (is \"ecard ?A = ecard ?B\") for P\n proof -\n have \"ecard ?A = ecard ((\\zs. map Some zs @ drop b x) ` ?A)\"\n by (auto intro!: ecard_image[symmetric] inj_onI)\n also have \"(\\zs. map Some zs @ drop b x) ` ?A = ?B\"\n by (subst (1 2) eq_commute) (auto simp: image_iff, metis \"2\" append_take_drop_id)\n finally show ?thesis .\n qed\n show ?thesis\n unfolding M_def M'_def\n by (auto simp: non_default_case Let_def image_def Set.filter_def 1 3, metis \"2\")\n qed\n have drop_lift: \"mem_restr (lift_envs' b R) x\" if \"x \\ rel\" \"mem_restr R ((drop b x)[y:=z])\" for x z\n proof -\n have \"(drop b x)[y:=None] = (drop b x)[y:=drop b x ! y]\" proof -\n from \\x \\ rel\\ have \"drop b x ! y = None\"\n using fresh n inner[THEN qtable_wf_tupleD]\n by (simp add: add.commute wf_tuple_def)\n then show ?thesis by simp\n qed\n then have \"(drop b x)[y:=None] = drop b x\" by simp\n moreover from \\x \\ rel\\ have \"length x = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n moreover from that(2) have \"mem_restr R ((drop b x)[y:=z, y:=None])\"\n by (rule mem_restr_upd_None)\n ultimately show ?thesis\n by (auto intro!: mem_restr_dropD)\n qed\n\n {\n fix v\n assume \"mem_restr R v\"\n have \"v \\ (\\k. k[y:=Some (eval_agg_op \\ (M' k))]) ` drop b ` rel \\\n v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n (is \"v \\ ?A \\ v \\ ?B\")\n proof\n assume \"v \\ ?A\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M' (drop b v')))]\"\n by auto\n then have \"M' (drop b v') = M (map the (drop b v'))\"\n using \\mem_restr R v\\ by (auto intro!: M'_M drop_lift)\n with * show \"v \\ ?B\" by simp\n next\n assume \"v \\ ?B\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n by auto\n then have \"M (map the (drop b v')) = M' (drop b v')\"\n using \\mem_restr R v\\ by (auto intro!: M'_M[symmetric] drop_lift)\n with * show \"v \\ ?A\" by simp\n qed\n then have \"v \\ eval_agg n g0 y \\ b f rel \\ v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n by (simp add: non_default_case eval_agg_def M'_def Let_def)\n }\n note alt = this\n\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\"\n using inner[THEN qtable_wf_tupleD] n f_fvi\n by (auto simp: eval_agg_def non_default_case table_def wf_tuple_def Let_def nth_list_update\n fvi_iff_fv[where b=b] add.commute)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n then have length_v: \"length v = n\" by (simp add: wf_tuple_def)\n\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n proof -\n from that obtain v' where \"v' \\ rel\"\n \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n using alt[OF \\mem_restr R v\\] by blast\n then have length_v': \"length v' = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n have \"Formula.sat \\ V (map the v') i \\\"\n using \\v' \\ rel\\ \\mem_restr R v\\\n by (auto simp: \\v = _\\ elim!: in_qtableE[OF inner] intro!: drop_lift \\v' \\ rel\\)\n then have \"Formula.sat \\ V (map the (take b v') @ map the v) i \\\"\n proof (rule sat_fv_cong[THEN iffD1, rotated], intro ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"map the v' ! x = (map the (take b v') @ map the v) ! x\"\n by (auto simp: \\v = _\\ nth_append)\n qed\n then have 1: \"M (map the v) \\ {}\" by (force simp: M_def length_v')\n\n have \"y < length (drop b v')\" using n by (simp add: length_v')\n moreover have \"Formula.sat \\ V (zs @ map the v) i \\ \\\n Formula.sat \\ V (zs @ map the (drop b v')) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the v) f =\n Formula.eval_trm (zs @ map the (drop b v')) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the v))\"\n by (simp add: M_def \\v = _\\ conj_commute cong: conj_cong)\n with 1 show ?thesis by (auto simp: M_def)\n qed\n\n show \"v \\ eval_agg n g0 y \\ b f rel\"\n if sat_Agg: \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n proof -\n obtain zs where \"length zs = b\" and \"map Some zs @ v[y:=None] \\ rel\"\n proof (cases \"fv \\ \\ {0.. empty_table\" by (simp add: g0)\n then obtain x where \"x \\ rel\" by auto\n have \"(\\i < n. (v[y:=None]) ! i = None)\"\n using True \\wf_tuple n ?fv v\\ f_fv\n by (fastforce simp: wf_tuple_def fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n moreover have x: \"(\\i < n. drop b x ! i = None) \\ length x = b + n\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] f_fv\n by (auto simp: wf_tuple_def)\n ultimately have \"v[y:=None] = drop b x\"\n unfolding list_eq_iff_nth_eq by (auto simp: length_v)\n with \\x \\ rel\\ have \"take b x @ v[y:=None] \\ rel\" by simp\n moreover have \"map (Some \\ the) (take b x) = take b x\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] b_fv\n by (subst map_cong[where g=id, OF refl]) (auto simp: wf_tuple_def in_set_conv_nth)\n ultimately have \"map Some (map the (take b x)) @ v[y:=None] \\ rel\" by simp\n then show thesis using x[THEN conjunct2] by (fastforce intro!: that[rotated])\n next\n case False\n with sat_Agg obtain zs where \"length zs = b\" and \"Formula.sat \\ V (zs @ map the v) i \\\"\n by auto\n then have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\\"\n using fresh\n by (auto simp: map_update not_less nth_append elim!: sat_fv_cong[THEN iffD1, rotated]\n intro!: nth_list_update_neq[symmetric])\n then have \"map Some zs @ v[y:=None] \\ rel\"\n using b_fv f_fv fresh\n by (auto intro!: in_qtableI[OF inner] wf_tuple_append wf_tuple_map_Some\n wf_tuple_upd_None \\wf_tuple n ?fv v\\ mem_restr_upd_None \\mem_restr R v\\\n simp: \\length zs = b\\ set_eq_iff fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n force+\n with that \\length zs = b\\ show thesis by blast\n qed\n then have 1: \"v[y:=None] \\ drop b ` rel\" by (intro image_eqI) auto\n\n have y_length: \"y < length v\" using n by (simp add: length_v)\n moreover have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\ \\\n Formula.sat \\ V (zs @ map the v) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the (v[y:=None])) f =\n Formula.eval_trm (zs @ map the v) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the (v[y:=None])))\"\n using sat_Agg by (simp add: M_def cong: conj_cong) (simp cong: rev_conj_cong)\n then have 2: \"v ! y = Some (eval_agg_op \\ (M (map the (v[y:=None]))))\"\n using \\wf_tuple n ?fv v\\ y_length by (auto simp add: wf_tuple_def)\n show ?thesis\n unfolding alt[OF \\mem_restr R v\\]\n by (rule image_eqI[where x=\"v[y:=None]\"]) (use 1 2 in \\auto simp: y_length list_update_id\\)\n qed\n qed\n qed\nqed\n\nlemma mprev: \"mprev_next I xs ts = (ys, xs', ts') \\\n list_all2 P [i.. list_all2 (\\i t. t = \\ \\ i) [i.. i \\ j' \\ i < j \\\n list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then P i X else X = empty_table)\n [i..\n list_all2 P [min j' (j-1)..\n list_all2 (\\i t. t = \\ \\ i) [min j' (j-1)..\n list_all2 P [Suc i.. list_all2 (\\i t. t = \\ \\ i) [i.. Suc i \\ j' \\ i < j \\\n list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then P (Suc i) X else X = empty_table)\n [i..\n list_all2 P [Suc (min (j'-1) (j-1))..\n list_all2 (\\i t. t = \\ \\ i) [min (j'-1) (j-1).. A \\ A \\ set xs \\ x \\ foldr (\\) xs {}\"\n by (induction xs) auto\n\nlemma in_foldr_UnE: \"x \\ foldr (\\) xs {} \\ (\\A. A \\ set xs \\ x \\ A \\ P) \\ P\"\n by (induction xs) auto\n\nlemma sat_the_restrict: \"fv \\ \\ A \\ Formula.sat \\ V (map the (restrict A v)) i \\ = Formula.sat \\ V (map the v) i \\\"\n by (rule sat_fv_cong) (auto intro!: map_the_restrict)\n\nlemma eps_the_restrict: \"fv_regex r \\ A \\ Regex.eps (Formula.sat \\ V (map the (restrict A v))) i r = Regex.eps (Formula.sat \\ V (map the v)) i r\"\n by (rule eps_fv_cong) (auto intro!: map_the_restrict)\n\nlemma sorted_wrt_filter[simp]: \"sorted_wrt R xs \\ sorted_wrt R (filter P xs)\"\n by (induct xs) auto\n\nlemma concat_map_filter[simp]:\n \"concat (map f (filter P xs)) = concat (map (\\x. if P x then f x else []) xs)\"\n by (induct xs) auto\n\nlemma map_filter_alt:\n \"map f (filter P xs) = concat (map (\\x. if P x then [f x] else []) xs)\"\n by (induct xs) auto\n\nlemma (in maux) update_since:\n assumes pre: \"wf_since_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel2\"\n and result_eq: \"(rel, aux') = update_since args rel1 rel2 (\\ \\ ne) aux\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n and \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ I \\)) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv \\) v\"\n note sat.simps[simp del]\n from pre[unfolded wf_since_aux_def] obtain cur auxlist where aux: \"valid_msaux args cur aux auxlist\"\n \"sorted_wrt (\\x y. fst y < fst x) auxlist\"\n \"\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n qtable n (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\)) X\"\n \"\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)\"\n and cur_def:\n \"cur = (if ne = 0 then 0 else \\ \\ (ne - 1))\"\n unfolding args_ivl args_n args_pos by blast\n from pre[unfolded wf_since_aux_def] have fv_sub: \"Formula.fv \\ \\ Formula.fv \\\" by simp\n\n define aux0 where \"aux0 = join_msaux args rel1 (add_new_ts_msaux args (\\ \\ ne) aux)\"\n define auxlist0 where \"auxlist0 = [(t, join rel pos rel1). (t, rel) \\ auxlist, \\ \\ ne - t \\ right I]\"\n have tabL: \"table (args_n args) (args_L args) rel1\"\n using qtable1[unfolded qtable_def] unfolding args_n[symmetric] args_L[symmetric] by simp\n have cur_le: \"cur \\ \\ \\ ne\"\n unfolding cur_def by auto\n have valid0: \"valid_msaux args (\\ \\ ne) aux0 auxlist0\" unfolding aux0_def auxlist0_def\n using valid_join_msaux[OF valid_add_new_ts_msaux[OF aux(1)], OF cur_le tabL]\n by (auto simp: args_ivl args_pos cur_def map_filter_alt split_beta cong: map_cong)\n from aux(2) have sorted_auxlist0: \"sorted_wrt (\\x y. fst x > fst y) auxlist0\"\n unfolding auxlist0_def\n by (induction auxlist) (auto simp add: sorted_wrt_append)\n have in_auxlist0_1: \"(t, X) \\ set auxlist0 \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (Formula.sat \\ V (map the v) (ne-1) (Sincep pos \\ (point (\\ \\ (ne-1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\))) X\" for t X\n unfolding auxlist0_def using fvi_subset\n by (auto 0 1 elim!: qtable_join[OF _ qtable1] simp: sat_the_restrict dest!: aux(3))\n then have in_auxlist0_le_\\: \"(t, X) \\ set auxlist0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_auxlist0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set auxlist0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set auxlist\"\n by (atomize_elim, intro aux(4))\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\\\ \\ ne - t \\ right I\\ have \"(t, join X pos rel1) \\ set auxlist0\"\n unfolding auxlist0_def by (auto elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set auxlist0\"\n by blast\n qed\n have auxlist0_Nil: \"auxlist0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t))\"\n using in_auxlist0_2 by (auto)\n\n have aux'_eq: \"aux' = add_new_table_msaux args rel2 aux0\"\n using result_eq unfolding aux0_def update_since_def Let_def by simp\n define auxlist' where\n auxlist'_eq: \"auxlist' = (case auxlist0 of\n [] \\ [(\\ \\ ne, rel2)]\n | x # auxlist' \\ (if fst x = \\ \\ ne then (fst x, snd x \\ rel2) # auxlist' else (\\ \\ ne, rel2) # x # auxlist'))\"\n have tabR: \"table (args_n args) (args_R args) rel2\"\n using qtable2[unfolded qtable_def] unfolding args_n[symmetric] args_R[symmetric] by simp\n have valid': \"valid_msaux args (\\ \\ ne) aux' auxlist'\"\n unfolding aux'_eq auxlist'_eq using valid_add_new_table_msaux[OF valid0 tabR]\n by (auto simp: not_le split: list.splits option.splits if_splits)\n have sorted_auxlist': \"sorted_wrt (\\x y. fst x > fst y) auxlist'\"\n unfolding auxlist'_eq\n using sorted_auxlist0 in_auxlist0_le_\\ by (cases auxlist0) fastforce+\n have in_auxlist'_1: \"t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\ (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)) X\"\n if auxlist': \"(t, X) \\ set auxlist'\" for t X\n proof (cases auxlist0)\n case Nil\n with auxlist' show ?thesis\n unfolding auxlist'_eq using qtable2 auxlist0_Nil\n by (auto simp: zero_enat_def[symmetric] sat_Since_rec[where i=ne]\n dest: spec[of _ \"\\ \\ (ne-1)\"] elim!: qtable_cong[OF _ refl])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with auxlist' Cons t have \"X = snd a \\ rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 by (auto split: if_splits)\n moreover from in_auxlist0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ (ne - 1)\" \"\\ \\ ne - fst a \\ right I\" \"\\i. \\ \\ i = fst a\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1)\n (Sincep pos \\ (point (\\ \\ (ne - 1) - fst a)) \\) \\ (if pos then Formula.sat \\ V (map the v) ne \\\n else \\ Formula.sat \\ V (map the v) ne \\)) (snd a)\"\n by (auto simp: True[symmetric] zero_enat_def[symmetric])\n ultimately show ?thesis using qtable2 t True\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(6) elim!: qtable_union)\n next\n case False\n with auxlist' Cons t have \"X = rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 in_auxlist0_le_\\[of \"fst a\" \"snd a\"] by (auto split: if_splits)\n with auxlist' Cons t False show ?thesis\n unfolding auxlist'_eq using qtable2 in_auxlist0_2[of \"\\ \\ (ne-1)\"] in_auxlist0_le_\\[of \"fst a\" \"snd a\"] sorted_auxlist0\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(3) zero_enat_def[symmetric] enat_0_iff not_le\n elim!: qtable_cong[OF _ refl] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with auxlist' Cons have \"(t, X) \\ set auxlist0\"\n unfolding auxlist'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ (ne - 1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\)) X\"\n using in_auxlist0_1 by blast+\n with False auxlist' Cons show ?thesis\n unfolding auxlist'_eq using qtable2\n by (fastforce simp: sat_Since_rec[where i=ne] sat.simps(6)\n diff_diff_right[where i=\"\\ \\ ne\" and j=\"\\ \\ _ + \\ \\ ne\" and k=\"\\ \\ (ne - 1)\",\n OF trans_le_add2, simplified] elim!: qtable_cong[OF _ refl] order_trans dest: le_\\_less)\n qed\n qed\n\n have in_auxlist'_2: \"\\X. (t, X) \\ set auxlist'\" if \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases auxlist0)\n case Nil\n with True show ?thesis unfolding auxlist'_eq by (simp add: zero_enat_def[symmetric])\n next\n case (Cons a as)\n with True show ?thesis unfolding auxlist'_eq\n by (cases \"fst a = \\ \\ ne\") (auto simp: zero_enat_def[symmetric])\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set auxlist0\" using \\\\ \\ ne - t \\ right I\\ \\\\i. \\ \\ i = t\\\n using \\_mono[of \"ne - 1\" \"ne\" \\] by (atomize_elim, cases \"right I\") (auto intro!: in_auxlist0_2 simp del: \\_mono)\n then show ?thesis unfolding auxlist'_eq using False \\\\ \\ ne - t \\ right I\\\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n unfolding wf_since_aux_def args_ivl args_n args_pos\n by (auto simp add: fv_sub dest: in_auxlist'_1 intro: sorted_auxlist' in_auxlist'_2\n intro!: exI[of _ auxlist'] valid')\n\n have \"rel = result_msaux args aux'\"\n using result_eq by (auto simp add: update_since_def Let_def)\n with valid' have rel_eq: \"rel = foldr (\\) [rel. (t, rel) \\ auxlist', left I \\ \\ \\ ne - t] {}\"\n by (auto simp add: args_ivl valid_result_msaux\n intro!: arg_cong[where f = \"\\x. foldr (\\) (concat x) {}\"] split: option.splits)\n have rel_alt: \"rel = (\\(t, rel) \\ set auxlist'. if left I \\ \\ \\ ne - t then rel else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)\n show \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ I \\)) rel\"\n unfolding rel_alt\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n left I \\ \\ \\ ne - t \\ Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n proof (rule iffI, erule sat_Since_point, goal_cases left right)\n case (left j)\n then show ?case using in_auxlist'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_Since_pointD dest: in_auxlist'_1)\n qed\n qed (auto dest!: in_auxlist'_1 intro!: qtable_empty)\nqed\n\nlemma fv_regex_from_mregex:\n \"ok (length \\s) mr \\ fv_regex (from_mregex mr \\s) \\ (\\\\ \\ set \\s. fv \\)\"\n by (induct mr) (auto simp: Bex_def in_set_conv_nth)+\n\nlemma qtable_\\_lax:\n assumes \"ok (length \\s) mr\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and \"fv_regex (from_mregex mr \\s) \\ A\" and \"qtable n A (mem_restr R) Q guard\"\n shows \"qtable n A (mem_restr R)\n (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s) \\ Q v) (\\_lax guard rels mr)\"\n using assms\nproof (induct mr)\n case (MPlus mr1 mr2)\n from MPlus(3-6) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n then have \"fv_regex (from_mregex mr1 \\s) \\ A\" \"fv_regex (from_mregex mr2 \\s) \\ A\"\n using fv_regex_from_mregex[of \\s mr1] fv_regex_from_mregex[of \\s mr2] by (auto simp: subset_eq)\n with MTimes(3-6) show ?case\n by (auto simp: eps_the_restrict restrict_idle intro!: qtable_join[OF MTimes(1,2)])\nqed (auto split: prod.splits if_splits simp: qtable_empty_iff list_all2_conv_all_nth\n in_set_conv_nth restrict_idle sat_the_restrict\n intro: in_qtableI qtableI elim!: qtable_join[where A=A and C=A])\n\nlemma nullary_qtable_cases: \"qtable n {} P Q X \\ (X = empty_table \\ X = unit_table n)\"\n by (simp add: qtable_def table_empty)\n\nlemma qtable_empty_unit_table:\n \"qtable n {} R P empty_table \\ qtable n {} R (\\v. \\ P v) (unit_table n)\"\n by (auto intro: qtable_unit_table simp add: qtable_empty_iff)\n\nlemma qtable_unit_empty_table:\n \"qtable n {} R P (unit_table n) \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (auto intro!: qtable_empty elim: in_qtableE simp add: wf_tuple_empty unit_table_def)\n\nlemma qtable_nonempty_empty_table:\n \"qtable n {} R P X \\ x \\ X \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (frule nullary_qtable_cases) (auto dest: qtable_unit_empty_table)\n\n\nlemma qtable_r\\_strict:\n assumes \"safe_regex Past Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (r\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma qtable_l\\_strict:\n assumes \"safe_regex Futu Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (l\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma rtranclp_False: \"(\\i j. False)\\<^sup>*\\<^sup>* = (=)\"\nproof -\n have \"(\\i j. False)\\<^sup>*\\<^sup>* i j \\ i = j\" for i j :: 'a\n by (induct i j rule: rtranclp.induct) auto\n then show ?thesis\n by (auto intro: exI[of _ 0])\nqed\n\ninductive ok_rctxt for \\s where\n \"ok_rctxt \\s id id\"\n| \"ok_rctxt \\s \\ \\' \\ ok_rctxt \\s (\\t. \\ (MTimes mr t)) (\\t. \\' (Regex.Times (from_mregex mr \\s) t))\"\n\nlemma ok_rctxt_swap: \"ok_rctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_rctxt.induct) auto\n\nlemma ok_rctxt_cong: \"ok_rctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_rctxt.induct) simp_all\n\nlemma qtable_r\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_rctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` RPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.rpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (r\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_rctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(2) qtable_\\_lax[OF _ _ _ MTimes(1)]]\n elim!: ok_rctxt.intros(2) simp: MTimesL_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_rctxt.intros simp: MTimesL_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_r\\ = qtable_r\\\\[OF _ _ _ ok_rctxt.intros(1), unfolded rpd\\_rpd image_id id_apply]\n\ninductive ok_lctxt for \\s where\n \"ok_lctxt \\s id id\"\n| \"ok_lctxt \\s \\ \\' \\ ok_lctxt \\s (\\t. \\ (MTimes t mr)) (\\t. \\' (Regex.Times t (from_mregex mr \\s)))\"\n\nlemma ok_lctxt_swap: \"ok_lctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_lctxt.induct) auto\n\nlemma ok_lctxt_cong: \"ok_lctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_lctxt.induct) simp_all\n\nlemma qtable_l\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_lctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` LPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.lpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (l\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_lctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(1) qtable_\\_lax[OF _ _ _ MTimes(2)]]\n elim!: ok_lctxt.intros(2) simp: MTimesR_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_lctxt.intros simp: MTimesR_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_l\\ = qtable_l\\\\[OF _ _ _ ok_lctxt.intros(1), unfolded lpd\\_lpd image_id id_apply]\n\nlemma RPD_fv_regex_le:\n \"ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesL_def split: nat.splits)+\n\nlemma RPD_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPD mr \\ safe_regex Past g (from_mregex ms \\s)\"\nproof (induct Past g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesP g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesP(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le TimesP(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma RPDi_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> safe_regex Past g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: RPD_safe)\n\nlemma RPDs_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> safe_regex Past g (from_mregex ms \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe)\n\nlemma RPD_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le)\nqed\n\nlemma RPDi_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: RPD_safe_fv_regex RPD_safe)\n\nlemma RPDs_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe_fv_regex)\n\nlemma RPD_ok: \"ok m mr \\ ms \\ RPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesL_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesL_def)\nqed (auto split: nat.splits)\n\nlemma RPDi_ok: \"ok m mr \\ ms \\ RPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: RPD_ok)\n\nlemma RPDs_ok: \"ok m mr \\ ms \\ RPDs mr \\ ok m ms\"\n unfolding RPDs_def by (auto intro: RPDi_ok)\n\nlemma LPD_fv_regex_le:\n \"ms \\ LPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesR_def split: nat.splits)+\n\nlemma LPD_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPD mr ==> safe_regex Futu g (from_mregex ms \\s)\"\nproof (induct Futu g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesF g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesF(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits dest: TimesF(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma LPDi_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: LPD_safe)\n\nlemma LPDs_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe)\n\nlemma LPD_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPD mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le)\nqed\n\nlemma LPDi_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: LPD_safe_fv_regex LPD_safe)\n\nlemma LPDs_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe_fv_regex)\n\nlemma LPD_ok: \"ok m mr \\ ms \\ LPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesR_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesR_def)\nqed (auto split: nat.splits)\n\nlemma LPDi_ok: \"ok m mr \\ ms \\ LPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: LPD_ok)\n\nlemma LPDs_ok: \"ok m mr \\ ms \\ LPDs mr \\ ok m ms\"\n unfolding LPDs_def by (auto intro: LPDi_ok)\n\nlemma update_matchP:\n assumes pre: \"wf_matchP_aux \\ V n R I r aux ne\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel) \\s rels\"\n and result_eq: \"(rel, aux') = update_matchP n I mr mrs rels (\\ \\ ne) aux\"\n shows \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n and \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv_regex r) v\"\n let ?update = \"\\rel t. mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = \\ \\ ne then r\\_strict n rels mr else {}))\"\n note sat.simps[simp del]\n\n define aux0 where \"aux0 = [(t, ?update rel t). (t, rel) \\ aux, enat (\\ \\ ne - t) \\ right I]\"\n have sorted_aux0: \"sorted_wrt (\\x y. fst x > fst y) aux0\"\n using pre[unfolded wf_matchP_aux_def, THEN conjunct1]\n unfolding aux0_def\n by (induction aux) (auto simp add: sorted_wrt_append)\n { fix ms\n assume \"ms \\ RPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Past Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"RPD ms \\ RPDs mr\"\n using safe RPDs_safe RPDs_safe_fv_regex mr from_mregex_to_mregex RPDs_ok to_mregex_ok RPDs_trans\n by fastforce+\n } note * = this\n have **: \"\\ \\ ne - (\\ \\ i + \\ \\ ne - \\ \\ (ne - Suc 0)) = \\ \\ (ne - Suc 0) - \\ \\ i\" for i\n by (metis (no_types, lifting) Nat.diff_diff_right \\_mono add.commute add_diff_cancel_left diff_le_self le_add2 order_trans)\n have ***: \"\\ \\ i = \\ \\ ne\"\n if \"\\ \\ ne \\ \\ \\ i\" \"\\ \\ i \\ \\ \\ (ne - Suc 0)\" \"ne > 0\" for i\n by (metis (no_types, lifting) Suc_pred \\_mono diff_le_self le_\\_less le_antisym not_less_eq that)\n then have in_aux0_1: \"(t, X) \\ set aux0 \\ ne \\ 0 \\ t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\" for t X\n unfolding aux0_def using safe mr mrs\n by (auto simp: lookup_tabulate map_of_map_restrict restrict_map_def finite_RPDs * ** RPDs_trans diff_le_mono2\n intro!: sat_MatchP_rec[of \\ _ _ ne, THEN iffD2]\n qtable_union[OF qtable_r\\[OF _ _ qtables] qtable_r\\_strict[OF _ _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point 0) r)\" _ ms for ms]\n qtable_cong[OF qtable_r\\[OF _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point (\\ \\ (ne - Suc 0) - \\ \\ i)) r)\"\n _ _ \"(\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - \\ \\ i)) (from_mregex ms \\s)))\" for ms i]\n dest!: assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct1, rule_format]\n sat_MatchP_rec[\"of\" \\ _ _ ne, THEN iffD1]\n elim!: bspec order.trans[OF _ \\_mono] bexI[rotated] split: option.splits if_splits) (* slow 7 sec *)\n then have in_aux0_le_\\: \"(t, X) \\ set aux0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_aux0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set aux0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set aux\"\n by (atomize_elim, intro assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct2, rule_format])\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\\\ \\ ne - t \\ right I\\ have \"(t, ?update X t) \\ set aux0\"\n unfolding aux0_def by (auto simp: id_def elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set aux0\"\n by blast\n qed\n have aux0_Nil: \"aux0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t))\"\n using in_aux0_2 by (cases \"ne = 0\") (auto)\n\n have aux'_eq: \"aux' = (case aux0 of\n [] \\ [(\\ \\ ne, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = \\ \\ ne then x # aux'\n else (\\ \\ ne, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\"\n using result_eq unfolding aux0_def update_matchP_def Let_def by simp\n have sorted_aux': \"sorted_wrt (\\x y. fst x > fst y) aux'\"\n unfolding aux'_eq\n using sorted_aux0 in_aux0_le_\\ by (cases aux0) (fastforce)+\n\n have in_aux'_1: \"t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\"\n if aux': \"(t, X) \\ set aux'\" for t X\n proof (cases aux0)\n case Nil\n with aux' show ?thesis\n unfolding aux'_eq using safe mrs qtables aux0_Nil *\n by (auto simp: zero_enat_def[symmetric] sat_MatchP_rec[where i=ne]\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict]\n dest: spec[of _ \"\\ \\ (ne-1)\"])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with aux' Cons t have \"X = snd a\"\n unfolding aux'_eq using sorted_aux0 by auto\n moreover from in_aux0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ ne\" \"\\ \\ ne - fst a \\ right I\" \"\\i. \\ \\ i = fst a\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - fst a)) (from_mregex ms \\s))) (lookup (snd a) ms)\"\n by auto\n ultimately show ?thesis using t True\n by auto\n next\n case False\n with aux' Cons t have \"X = mrtabulate mrs (r\\_strict n rels)\"\n unfolding aux'_eq using sorted_aux0 in_aux0_le_\\[of \"fst a\" \"snd a\"] by auto\n with aux' Cons t False show ?thesis\n unfolding aux'_eq using safe mrs qtables * in_aux0_2[of \"\\ \\ (ne-1)\"] in_aux0_le_\\[of \"fst a\" \"snd a\"] sorted_aux0\n by (auto simp: sat_MatchP_rec[where i=ne] zero_enat_def[symmetric] enat_0_iff not_le\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with aux' Cons have \"(t, X) \\ set aux0\"\n unfolding aux'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms)\"\n using in_aux0_1 by blast+\n with False aux' Cons show ?thesis\n unfolding aux'_eq by auto\n qed\n qed\n\n have in_aux'_2: \"\\X. (t, X) \\ set aux'\" if \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases aux0)\n case Nil\n with True show ?thesis unfolding aux'_eq by simp\n next\n case (Cons a as)\n with True show ?thesis unfolding aux'_eq using eq_fst_iff[of t a]\n by (cases \"fst a = \\ \\ ne\") auto\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set aux0\" using \\\\ \\ ne - t \\ right I\\ \\\\i. \\ \\ i = t\\\n by atomize_elim (auto intro!: in_aux0_2)\n then show ?thesis unfolding aux'_eq using False\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n unfolding wf_matchP_aux_def using mr\n by (auto dest: in_aux'_1 intro: sorted_aux' in_aux'_2)\n\n have rel_eq: \"rel = foldr (\\) [lookup rel mr. (t, rel) \\ aux', left I \\ \\ \\ ne - t] {}\"\n unfolding aux'_eq aux0_def\n using result_eq by (simp add: update_matchP_def Let_def)\n have rel_alt: \"rel = (\\(t, rel) \\ set aux'. if left I \\ \\ \\ ne - t then lookup rel mr else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)\n show \"qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\n unfolding rel_alt\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n left I \\ \\ \\ ne - t \\ Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) r)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n proof (rule iffI, erule sat_MatchP_point, goal_cases left right)\n case (left j)\n then show ?case using in_aux'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_MatchP_pointD dest: in_aux'_1)\n qed\n qed (auto dest!: in_aux'_1 intro!: qtable_empty dest!: bspec[OF _ RPDs_refl]\n simp: from_mregex_eq[OF safe mr])\nqed\n\nlemma length_update_until: \"length (update_until args rel1 rel2 nt aux) = Suc (length aux)\"\n unfolding update_until_def by simp\n\nlemma wf_update_until_auxlist:\n assumes pre: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_auxlist \\ V n R pos \\ I \\ (update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist) ne\"\n unfolding wf_until_auxlist_def length_update_until\n unfolding update_until_def list.rel_map add_Suc_right upt.simps eqTrueI[OF le_add1] if_True\nproof (rule list_all2_appendI, unfold list.rel_map, goal_cases old new)\n case old\n show ?case\n proof (rule list.rel_mono_strong[OF assms(1)[unfolded wf_until_auxlist_def]]; safe, goal_cases mono1 mono2)\n case (mono1 i X Y v)\n then show ?case\n by (fastforce simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq\n elim!: qtable_join[OF _ qtable1] qtable_union[OF _ qtable1])\n next\n case (mono2 i X Y v)\n then show ?case using fvi_subset\n by (auto 0 3 simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq split: if_splits\n elim!: qtable_union[OF _ qtable_join_fixed[OF qtable2]]\n elim: qtable_cong[OF _ refl] intro: exI[of _ \"ne + length auxlist\"]) (* slow 8 sec*)\n qed\nnext\n case new\n then show ?case\n by (auto intro!: qtable_empty qtable1 qtable2[THEN qtable_cong] exI[of _ \"ne + length auxlist\"]\n simp: args_ivl args_n args_pos less_Suc_eq zero_enat_def[symmetric])\nqed\n\nlemma (in muaux) wf_update_until:\n assumes pre: \"wf_until_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_aux \\ V R args \\ \\ (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) ne \\\n length_muaux args (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) = Suc (length_muaux args aux)\"\nproof -\n from pre obtain cur auxlist where valid_aux: \"valid_muaux args cur aux auxlist\" and\n cur: \"cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1))\" and\n pre_list: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n unfolding wf_until_aux_def args_ivl args_n args_pos by auto\n have length_aux: \"length_muaux args aux = length auxlist\"\n using valid_length_muaux[OF valid_aux] .\n define nt where \"nt \\ \\ \\ (ne + length_muaux args aux)\"\n have nt_mono: \"cur \\ nt\"\n unfolding cur nt_def length_aux by simp\n define auxlist' where \"auxlist' \\ update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist\"\n have length_auxlist': \"length auxlist' = Suc (length auxlist)\"\n unfolding auxlist'_def by (auto simp add: length_update_until)\n have tab1: \"table (args_n args) (args_L args) rel1\"\n using qtable1 unfolding args_n[symmetric] args_L[symmetric] by (auto simp add: qtable_def)\n have tab2: \"table (args_n args) (args_R args) rel2\"\n using qtable2 unfolding args_n[symmetric] args_R[symmetric] by (auto simp add: qtable_def)\n have fv_sub: \"fv \\ \\ fv \\\"\n using pre unfolding wf_until_aux_def by auto\n moreover have valid_add_new_auxlist: \"valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux) auxlist'\"\n using valid_add_new_muaux[OF valid_aux tab1 tab2 nt_mono]\n unfolding auxlist'_def nt_def length_aux .\n moreover have \"length_muaux args (add_new_muaux args rel1 rel2 nt aux) = Suc (length_muaux args aux)\"\n using valid_length_muaux[OF valid_add_new_auxlist] unfolding length_auxlist' length_aux[symmetric] .\n moreover have \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist' ne\"\n using wf_update_until_auxlist[OF pre_list qtable1[unfolded length_aux] qtable2[unfolded length_aux] fv_sub args_ivl args_n args_pos]\n unfolding auxlist'_def .\n moreover have \"\\ \\ (ne + length auxlist) = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\"\n unfolding cur length_auxlist' by auto\n ultimately show ?thesis\n unfolding wf_until_aux_def nt_def length_aux args_ivl args_n args_pos by fast\nqed\n\nlemma length_update_matchF_base:\n \"length (fst (update_matchF_base I mr mrs nt entry st)) = Suc 0\"\n by (auto simp: Let_def update_matchF_base_def)\n\nlemma length_update_matchF_step:\n \"length (fst (update_matchF_step I mr mrs nt entry st)) = Suc (length (fst st))\"\n by (auto simp: Let_def update_matchF_step_def split: prod.splits)\n\nlemma length_foldr_update_matchF_step:\n \"length (fst (foldr (update_matchF_step I mr mrs nt) aux base)) = length aux + length (fst base)\"\n by (induct aux arbitrary: base) (auto simp: Let_def length_update_matchF_step)\n\nlemma length_update_matchF: \"length (update_matchF n I mr mrs rels nt aux) = Suc (length aux)\"\n unfolding update_matchF_def update_matchF_base_def length_foldr_update_matchF_step\n by (auto simp: Let_def)\n\nlemma wf_update_matchF_base_invar:\n assumes safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_base n I mr mrs rels (\\ \\ j)) j\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n show ?thesis\n unfolding wf_matchF_invar_def wf_matchF_aux_def update_matchF_base_def mr prod.case Let_def mrs\n using safe\n by (auto simp: * from_mregex qtables qtable_empty_iff zero_enat_def[symmetric]\n lookup_tabulate finite_LPDs eps_match less_Suc_eq LPDs_refl\n intro!: qtable_cong[OF qtable_l\\_strict[where \\s=\\s]] intro: qtables exI[of _ j]\n split: option.splits)\nqed\n\nlemma Un_empty_table[simp]: \"rel \\ empty_table = rel\" \"empty_table \\ rel = rel\"\n unfolding empty_table_def by auto\n\nlemma wf_matchF_invar_step:\n assumes wf: \"wf_matchF_invar \\ V n R I r st (Suc i)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and rel: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < i + length (fst st) \\ mem (\\ \\ j - \\ \\ i) I \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n and entry: \"entry = (\\ \\ i, rels, rel)\"\n and nt: \"nt = \\ \\ (i + length (fst st))\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_step I mr mrs nt entry st) i\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n { fix aux X ms\n assume \"st = (aux, X)\" \"ms \\ LPDs mr\"\n with wf mr have \"qtable n (fv_regex r) (mem_restr R)\n (\\v. Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux))\n (l\\ (\\x. x) X rels ms)\"\n by (intro qtable_cong[OF qtable_l\\[where \\s=\\s and A=\"fv_regex r\" and\n Q=\"\\v r. Regex.match (Formula.sat \\ V v) r (Suc i) (i + length aux)\", OF _ _ qtables]])\n (auto simp: wf_matchF_invar_def * LPDs_trans lpd_match[of i] elim!: bspec)\n } note l\\ = this\n have \"lookup (mrtabulate mrs f) ms = f ms\" if \"ms \\ LPDs mr\" for ms and f :: \"mregex \\ 'a table\"\n using that mrs by (fastforce simp: lookup_tabulate finite_LPDs split: option.splits)+\n then show ?thesis\n using wf mr mrs entry nt LPDs_trans\n by (auto 0 3 simp: Let_def wf_matchF_invar_def update_matchF_step_def wf_matchF_aux_def mr * LPDs_refl\n list_all2_Cons1 append_eq_Cons_conv upt_eq_Cons_conv Suc_le_eq qtables\n lookup_tabulate finite_LPDs id_def l\\ from_mregex less_Suc_eq\n intro!: qtable_union[OF rel l\\] qtable_cong[OF rel]\n intro: exI[of _ \"i + length _\"]\n split: if_splits prod.splits)\nqed\n\nlemma wf_update_matchF_invar:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne (length (fst st) - 1)\"\n and wf: \"wf_matchF_invar \\ V n R I r st (ne + length aux)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and j: \"j = ne + length aux + length (fst st) - 1\"\n shows \"wf_matchF_invar \\ V n R I r (foldr (update_matchF_step I mr mrs (\\ \\ j)) aux st) ne\"\n using pre wf unfolding j\nproof (induct aux arbitrary: ne)\n case (Cons entry aux)\n from Cons(1)[of \"Suc ne\"] Cons(2,3) show ?case\n unfolding foldr.simps o_apply\n by (intro wf_matchF_invar_step[where rels = \"fst (snd entry)\" and rel = \"snd (snd entry)\"])\n (auto simp: safe mr mrs wf_matchF_aux_def wf_matchF_invar_def list_all2_Cons1 append_eq_Cons_conv\n Suc_le_eq upt_eq_Cons_conv length_foldr_update_matchF_step add.assoc split: if_splits)\nqed simp\n\n\nlemma wf_update_matchF:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne 0\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and nt: \"nt = \\ \\ (ne + length aux)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length aux) \\) rel) \\s rels\"\n shows \"wf_matchF_aux \\ V n R I r (update_matchF n I mr mrs rels nt aux) ne 0\"\n unfolding update_matchF_def using wf_update_matchF_base_invar[OF safe mr mrs qtables, of I]\n unfolding nt\n by (intro wf_update_matchF_invar[OF _ _ safe mr mrs, unfolded wf_matchF_invar_def split_beta, THEN conjunct2, THEN conjunct1])\n (auto simp: length_update_matchF_base wf_matchF_invar_def update_matchF_base_def Let_def pre)\n\nlemma wf_until_aux_Cons: \"wf_until_auxlist \\ V n R pos \\ I \\ (a # aux) ne \\\n wf_until_auxlist \\ V n R pos \\ I \\ aux (Suc ne)\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong)\n\nlemma wf_matchF_aux_Cons: \"wf_matchF_aux \\ V n R I r (entry # aux) ne i \\\n wf_matchF_aux \\ V n R I r aux (Suc ne) i\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong split: prod.splits)\n\nlemma wf_until_aux_Cons1: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\ t = \\ \\ ne\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons1: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\ t = \\ \\ ne\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma wf_until_aux_Cons3: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux) \\ mem (\\ \\ j - \\ \\ ne) I \\\n Formula.sat \\ V (map the v) j \\ \\ (\\k\\{ne.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) a2\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons3: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux + i) \\ mem (\\ \\ j - \\ \\ ne) I \\\n Regex.match (Formula.sat \\ V (map the v)) r ne j)) rel\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma upt_append: \"a \\ b \\ b \\ c \\ [a.. ja'\" \"jb \\ jb'\"\n shows \"wf_mbuf2 i ja' jb' P Q (mbuf2_add xs ys buf)\"\n using assms unfolding wf_mbuf2_def\n by (auto 0 3 simp: list_all2_append2 upt_append dest: list_all2_lengthD\n intro: exI[where x=\"[i..j j'. [j..) js js'\"\n shows \"wf_mbufn i js' Ps (mbufn_add xss buf)\"\n unfolding wf_mbufn_def list_all3_conv_all_nth\nproof safe\n show \"length Ps = length js'\" \"length js' = length (mbufn_add xss buf)\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth by auto\nnext\n fix k assume k: \"k < length Ps\"\n then show \"i \\ js' ! k\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth\n by (auto 0 4 dest: spec[of _ i])\n from k have \" [i..i z. \\x y. P i x \\ Q i y \\ z = f x y) [i.. xs = [] \\ ys = []\"\n \"list_all3 P xs [] zs \\ xs = [] \\ zs = []\"\n \"list_all3 P [] ys zs \\ ys = [] \\ zs = []\"\n unfolding list_all3_conv_all_nth by auto\n\nlemma list_all3_Cons:\n \"list_all3 P xs ys (z # zs) \\ (\\x xs' y ys'. xs = x # xs' \\ ys = y # ys' \\ P x y z \\ list_all3 P xs' ys' zs)\"\n \"list_all3 P xs (y # ys) zs \\ (\\x xs' z zs'. xs = x # xs' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs' ys zs')\"\n \"list_all3 P (x # xs) ys zs \\ (\\y ys' z zs'. ys = y # ys' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs ys' zs')\"\n unfolding list_all3_conv_all_nth\n by (auto simp: length_Suc_conv Suc_length_conv nth_Cons split: nat.splits)\n\nlemma list_all3_mono_strong: \"list_all3 P xs ys zs \\\n (\\x y z. x \\ set xs \\ y \\ set ys \\ z \\ set zs \\ P x y z \\ Q x y z) \\\n list_all3 Q xs ys zs\"\n by (induct xs ys zs rule: list_all3.induct) (auto intro: list_all3.intros)\n\ndefinition Mini where\n \"Mini i js = (if js = [] then i else Min (set js))\"\n\nlemma wf_mbufn_in_set_Mini:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ Mini i js = i\"\n unfolding in_set_conv_nth\nproof (elim exE conjE)\n fix k\n have \"i \\ j\" if \"j \\ set js\" for j\n using that assms unfolding wf_mbufn_def list_all3_conv_all_nth in_set_conv_nth by auto\n moreover assume \"k < length buf\" \"buf ! k = []\"\n ultimately show ?thesis using assms\n unfolding Mini_def wf_mbufn_def list_all3_conv_all_nth\n by (auto 0 4 dest!: spec[of _ k] intro: Min_eqI simp: in_set_conv_nth)\nqed\n\nlemma wf_mbufn_notin_set:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ j \\ set js \\ i < j\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth\n by (cases \"i \\ set js\") (auto intro: le_neq_implies_less simp: in_set_conv_nth)\n\nlemma wf_mbufn_map_tl:\n \"wf_mbufn i js Ps buf \\ [] \\ set buf \\ wf_mbufn (Suc i) js Ps (map tl buf)\"\n by (auto simp: wf_mbufn_def list_all3_map Suc_le_eq\n dest: rel_funD[OF tl_transfer] elim!: list_all3_mono_strong le_neq_implies_less)\n\nlemma list_all3_list_all2I: \"list_all3 (\\x y z. Q x z) xs ys zs \\ list_all2 Q xs zs\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma mbuf2t_take_eqD:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n shows \"wf_mbuf2 (min ja jb) ja jb P Q buf'\"\n and \"list_all2 R [min ja jb.. set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n from nonempty rec.prems(2) have \"Mini i js = Mini (Suc i) js\"\n unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k. k \\ set js \\ k \\ j\"\n and \"k = Mini (i + length nts) js\"\n shows \"wf_mbufn k js Ps buf'\"\n and \"list_all2 R [k.. []\"\n using that by (fastforce simp flip: length_greater_0_conv)\n with 2 show ?case\n using wf_mbufn_in_set_Mini[OF 2(2)] wf_mbufn_notin_set[OF 2(2)]\n by (subst (asm) mbufnt_take.simps) (force simp: Mini_def wf_mbufn_def\n dest!: IH(2)[rotated, OF _ wf_mbufn_map_tl[OF 2(2)] *]\n split: if_splits prod.splits)\nqed\n\nlemma mbuf2t_take_induct[consumes 5, case_names base step]:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n and \"U i z\"\n and \"\\k x y t z. i \\ k \\ Suc k \\ ja \\ Suc k \\ jb \\\n P k x \\ Q k y \\ R k t \\ U k z \\ U (Suc k) (f x y t z)\"\n shows \"U (min ja jb) z'\"\n using assms unfolding wf_mbuf2_def\n by (induction f z buf nts arbitrary: i z' buf' nts' rule: mbuf2t_take.induct)\n (auto simp add: list_all2_Cons2 upt_eq_Cons_conv less_eq_Suc_le min_absorb1 min_absorb2\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated] split: prod.split)\n\nlemma list_all2_hdD:\n assumes \"list_all2 P [i.. []\"\n shows \"P i (hd xs)\" \"i < j\"\n using assms unfolding list_all2_conv_all_nth\n by (auto simp: hd_conv_nth intro: zero_less_diff[THEN iffD1] dest!: spec[of _ 0])\n\nlemma mbufn_take_induct[consumes 3, case_names base step]:\n assumes \"mbufn_take f z buf = (z', buf')\"\n and \"wf_mbufn i js Ps buf\"\n and \"U i z\"\n and \"\\k xs z. i \\ k \\ Suc k \\ Mini i js \\\n list_all2 (\\P x. P k x) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n shows \"U (Mini i js) z'\"\n using assms unfolding wf_mbufn_def\nproof (induction f z buf arbitrary: i z' buf' rule: mbufn_take.induct)\n case rec: (1 f z buf)\n show ?case proof (cases \"buf = []\")\n case True\n with rec.prems show ?thesis unfolding Mini_def by simp\n next\n case nonempty: False\n show ?thesis proof (cases \"[] \\ set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n with nonempty rec.prems(2) have more: \"Suc i \\ Mini i js\"\n using diff_is_0_eq not_le unfolding Mini_def\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n then have \"Mini i js = Mini (Suc i) js\" unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"mbufn_take f (f (map hd buf) z) (map tl buf) = (z', buf')\"\n using nonempty False rec.prems by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k xs z. Suc i \\ k \\ Suc k \\ Mini (Suc i) js \\\n list_all2 (\\P. P k) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n by (rule rec.prems(4)) (auto simp: Mini_def)\n qed\n qed\n qed\nqed\n\nlemma mbufnt_take_induct[consumes 5, case_names base step]:\n assumes \"mbufnt_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbufn i js Ps buf\"\n and \"list_all2 R [i..k. k \\ set js \\ k \\ j\"\n and \"U i z\"\n and \"\\k xs t z. i \\ k \\ Suc k \\ Mini j js \\\n list_all2 (\\P x. P k x) Ps xs \\ R k t \\ U k z \\ U (Suc k) (f xs t z)\"\n shows \"U (Mini (i + length nts) js) z'\"\n using assms\nproof (induction f z buf nts arbitrary: i z' buf' nts' rule: mbufnt_take.induct)\n case (1 f z buf nts)\n then have *: \"list_all2 R [Suc i.. []\" \"nts = []\"\n using that unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)]\n by (fastforce simp: Mini_def list_all3_Cons neq_Nil_conv)\n with 1(2-7) list_all2_hdD[OF 1(4)] show ?case\n unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)] wf_mbufn_notin_set[OF 1(3)]\n by (subst (asm) mbufnt_take.simps)\n (auto simp add: Mini_def list.rel_map Suc_le_eq\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated]\n list_all3_mono_strong[THEN list_all3_list_all2I[of _ _ js]] list_all2_hdD\n dest!: 1(1)[rotated, OF _ wf_mbufn_map_tl[OF 1(3)] * _ 1(7)] split: prod.split if_splits)\nqed\n\nlemma mbuf2_take_add':\n assumes eq: \"mbuf2_take f (mbuf2_add xs ys buf) = (zs, buf')\"\n and pre: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and rm: \"rel_mapping (\\) P P'\"\n and xs: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"list_all2 (\\i Z. \\X Y.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) Y \\\n Z = f X Y)\n [min (progress \\ P \\ j) (progress \\ P \\ j).. P' \\ j') (progress \\ P' \\ j')] zs\"\n using pre rm unfolding wf_mbuf2'_def\n by (force intro!: mbuf2_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm])+\n\nlemma mbuf2t_take_add':\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"wf_ts \\ P' j' \\ \\ nts'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def wf_ts_def\n by (auto intro!: mbuf2t_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen)\n\nlemma ok_0_atms: \"ok 0 mr \\ regex.atms (from_mregex mr []) = {}\"\n by (induct mr) auto\n\nlemma ok_0_progress: \"ok 0 mr \\ progress_regex \\ P (from_mregex mr []) j = j\"\n by (drule ok_0_atms) (auto simp: progress_regex_def)\n\nlemma atms_empty_atms: \"safe_regex m g r \\ atms r = {} \\ regex.atms r = {}\"\n by (induct r rule: safe_regex_induct) (auto split: if_splits simp: cases_Neg_iff)\n\nlemma atms_empty_progress: \"safe_regex m g r \\ atms r = {} \\ progress_regex \\ P r j = j\"\n by (drule atms_empty_atms) (auto simp: progress_regex_def)\n\nlemma to_mregex_empty_progress: \"safe_regex m g r \\ to_mregex r = (mr, []) \\\n progress_regex \\ P r j = j\"\n using from_mregex_eq ok_0_progress to_mregex_ok atms_empty_atms by fastforce\n\nlemma progress_regex_le: \"pred_mapping (\\x. x \\ j) P \\ progress_regex \\ P r j \\ j\"\n by (auto intro!: progress_le_gen simp: Min_le_iff progress_regex_def)\n\nlemma Neg_acyclic: \"formula.Neg x = x \\ P\"\n by (induct x) auto\n\nlemma case_Neg_in_iff: \"x \\ (case y of formula.Neg \\' \\ {\\'} | _ \\ {}) \\ y = formula.Neg x\"\n by (cases y) auto\n\nlemma atms_nonempty_progress:\n \"safe_regex m g r \\ atms r \\ {} \\ (\\\\. progress \\ P \\ j) ` atms r = (\\\\. progress \\ P \\ j) ` regex.atms r\"\n by (frule atms_empty_atms; simp)\n (auto 0 3 simp: atms_def image_iff case_Neg_in_iff elim!: disjE_Not2 dest: safe_regex_safe_formula)\n\nlemma to_mregex_nonempty_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ \\s \\ [] \\\n progress_regex \\ P r j = (MIN \\\\set \\s. progress \\ P \\ j)\"\n using atms_nonempty_progress to_mregex_ok unfolding progress_regex_def by fastforce\n\nlemma to_mregex_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\\n progress_regex \\ P r j = (if \\s = [] then j else (MIN \\\\set \\s. progress \\ P \\ j))\"\n using to_mregex_nonempty_progress to_mregex_empty_progress unfolding progress_regex_def by auto\n\nlemma mbufnt_take_add':\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n shows \"wf_mbufn' \\ P' V j' n R r buf'\"\n and \"wf_ts_regex \\ P' j' r nts'\"\n using pre_buf pre_nts bounded rm mr safe xss \\j \\ j'\\ unfolding wf_mbufn'_def wf_ts_regex_def\n using atms_empty_progress[of m g r] to_mregex_ok[OF mr]\n by (auto 0 3 simp: list.rel_map to_mregex_empty_progress to_mregex_nonempty_progress Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n dest: list_all2_lengthD elim!: mbufnt_take_eqD[OF eq wf_mbufn_add])\n\nlemma mbuf2t_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n and base: \"U (min (progress \\ P \\ j) (progress \\ P \\ j)) z\"\n and step: \"\\k X Y z. min (progress \\ P \\ j) (progress \\ P \\ j) \\ k \\\n Suc k \\ progress \\ P' \\ j' \\ Suc k \\ progress \\ P' \\ j' \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) Y \\\n U k z \\ U (Suc k) (f X Y (\\ \\ k) z)\"\n shows \"U (min (progress \\ P' \\ j') (progress \\ P' \\ j')) z'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def\n by (blast intro!: mbuf2t_take_induct[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen base step)\n\nlemma mbufnt_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n and base: \"U (progress_regex \\ P r j) z\"\n and step: \"\\k Xs z. progress_regex \\ P r j \\ k \\ Suc k \\ progress_regex \\ P' r j' \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\)) \\s Xs \\\n U k z \\ U (Suc k) (f Xs (\\ \\ k) z)\"\n shows \"U (progress_regex \\ P' r j') z'\"\n using pre_buf pre_nts bounded rm \\j \\ j'\\ to_mregex_progress[OF safe mr, of \\ P' j'] to_mregex_empty_progress[OF safe, of mr \\ P j] base\n unfolding wf_mbufn'_def mr prod.case\n by (fastforce dest!: mbufnt_take_induct[OF eq wf_mbufn_add[OF _ xss] pre_nts, of U]\n simp: list.rel_map le_imp_diff_is_add ac_simps Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n intro!: base step dest: list_all2_lengthD split: if_splits)\n\nlemma progress_Until_le: \"progress \\ P (Formula.Until \\ I \\) j \\ min (progress \\ P \\ j) (progress \\ P \\ j)\"\n by (cases \"right I\") (auto simp: trans_le_add1 intro!: cInf_lower)\n\nlemma progress_MatchF_le: \"progress \\ P (Formula.MatchF I r) j \\ progress_regex \\ P r j\"\n by (cases \"right I\") (auto simp: trans_le_add1 progress_regex_def intro!: cInf_lower)\n\nlemma list_all2_upt_Cons: \"P a x \\ list_all2 P [Suc a.. Suc a \\ b \\\n list_all2 P [a.. list_all2 P [b..\n a \\ b \\ b \\ c \\ list_all2 P [a..x. R x x) xs ys\"\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth)\n\nlemma map_split_map: \"map_split f (map g xs) = map_split (f o g) xs\"\n by (induct xs) auto\n\nlemma map_split_alt: \"map_split f xs = (map (fst o f) xs, map (snd o f) xs)\"\n by (induct xs) (auto split: prod.splits)\n\nlemma fv_formula_of_constraint: \"fv (formula_of_constraint (t1, p, c, t2)) = fv_trm t1 \\ fv_trm t2\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct) simp_all\n\nlemma (in maux) wf_mformula_wf_set: \"wf_mformula \\ j P V n R \\ \\' \\ wf_set n (Formula.fv \\')\"\n unfolding wf_set_def\nproof (induction rule: wf_mformula.induct)\n case (AndRel P V n R \\ \\' \\' conf)\n then show ?case by (auto simp: fv_formula_of_constraint dest!: subsetD)\nnext\n case (Ands P V n R l l_pos l_neg l' buf A_pos A_neg)\n from Ands.IH have \"\\\\'\\set (l_pos @ map remove_neg l_neg). \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \"_ @ _\"] del: set_append)\n then have \"\\\\'\\set (l_pos @ l_neg). \\x\\fv \\'. x < n\"\n by (auto dest: bspec[where x=\"remove_neg _\"])\n then show ?case using Ands.hyps(2) by auto\nnext\n case (Agg P V b n R \\ \\' y f g0 \\)\n then have \"Formula.fvi_trm b f \\ Formula.fvi b \\'\"\n by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n with Agg show ?case by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=b])\nnext\n case (MatchP r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchP have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nnext\n case (MatchF r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchF have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nqed (auto simp: fvi_Suc split: if_splits)\n\nlemma qtable_mmulti_join:\n assumes pos: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_pos Q_pos L_pos\"\n and neg: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_neg Q_neg L_neg\"\n and C_eq: \"C = \\(set A_pos)\" and L_eq: \"L = L_pos @ L_neg\"\n and \"A_pos \\ []\" and fv_subset: \"\\(set A_neg) \\ \\(set A_pos)\"\n and restrict_pos: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_pos\"\n and restrict_neg: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_neg\"\n and Qs: \"\\x. wf_tuple n C x \\ P x \\ Q x \\\n list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n shows \"qtable n C P Q (mmulti_join n A_pos A_neg L)\"\nproof (rule qtableI)\n from pos have 1: \"list_all2 (\\A X. table n A X \\ wf_set n A) A_pos L_pos\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n moreover from neg have \"list_all2 (\\A X. table n A X \\ wf_set n A) A_neg L_neg\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n ultimately have L: \"list_all2 (\\A X. table n A X \\ wf_set n A) (A_pos @ A_neg) (L_pos @ L_neg)\"\n by (rule list_all2_appendI)\n note in_join_iff = mmulti_join_correct[OF \\A_pos \\ []\\ L]\n from 1 have take_eq: \"take (length A_pos) (L_pos @ L_neg) = L_pos\"\n by (auto dest!: list_all2_lengthD)\n from 1 have drop_eq: \"drop (length A_pos) (L_pos @ L_neg) = L_neg\"\n by (auto dest!: list_all2_lengthD)\n\n note mmulti_join.simps[simp del]\n show \"table n C (mmulti_join n A_pos A_neg L)\"\n unfolding C_eq L_eq table_def by (simp add: in_join_iff)\n show \"Q x\" if \"x \\ mmulti_join n A_pos A_neg L\" \"wf_tuple n C x\" \"P x\" for x\n using that(2,3)\n proof (rule Qs[THEN iffD2, OF _ _ conjI])\n have pos': \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n and neg': \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using that(1) unfolding L_eq in_join_iff take_eq drop_eq by simp_all\n show \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n using pos pos' restrict_pos that(2,3)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n have fv_subset': \"\\i. i < length A_neg \\ A_neg ! i \\ C\"\n using fv_subset unfolding C_eq by (auto simp: Sup_le_iff)\n show \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using neg neg' restrict_neg that(2,3)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n wf_tuple_restrict_simple[OF _ fv_subset'])\n qed\n show \"x \\ mmulti_join n A_pos A_neg L\" if \"wf_tuple n C x\" \"P x\" \"Q x\" for x\n unfolding L_eq in_join_iff take_eq drop_eq\n proof (intro conjI)\n from that have pos': \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n and neg': \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using Qs[THEN iffD1] by auto\n show \"wf_tuple n (\\A\\set A_pos. A) x\"\n using \\wf_tuple n C x\\ unfolding C_eq by simp\n show \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n using pos pos' restrict_pos that(1,2)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n C_eq wf_tuple_restrict_simple[OF _ Sup_upper])\n show \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using neg neg' restrict_neg that(1,2)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n qed\nqed\n\nlemma nth_filter: \"i < length (filter P xs) \\\n (\\i'. i' < length xs \\ P (xs ! i') \\ Q (xs ! i')) \\ Q (filter P xs ! i)\"\n by (metis (lifting) in_set_conv_nth set_filter mem_Collect_eq)\n\nlemma nth_partition: \"i < length xs \\\n (\\i'. i' < length (filter P xs) \\ Q (filter P xs ! i')) \\\n (\\i'. i' < length (filter (Not \\ P) xs) \\ Q (filter (Not \\ P) xs ! i')) \\ Q (xs ! i)\"\n by (metis (no_types, lifting) in_set_conv_nth set_filter mem_Collect_eq comp_apply)\n\nlemma qtable_bin_join:\n assumes \"qtable n A P Q1 X\" \"qtable n B P Q2 Y\" \"\\ b \\ B \\ A\" \"C = A \\ B\"\n \"\\x. wf_tuple n C x \\ P x \\ P (restrict A x) \\ P (restrict B x)\"\n \"\\x. b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ Q2 (restrict B x)\"\n \"\\x. \\ b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ \\ Q2 (restrict B x)\"\n shows \"qtable n C P Q (bin_join n A X b B Y)\"\n using qtable_join[OF assms] bin_join_table[of n A X B Y b] assms(1,2)\n by (auto simp add: qtable_def)\n\nlemma restrict_update: \"y \\ A \\ y < length x \\ restrict A (x[y:=z]) = restrict A x\"\n unfolding restrict_def by (auto simp add: nth_list_update)\n\nlemma qtable_assign:\n assumes \"qtable n A P Q X\"\n \"y < n\" \"insert y A = A'\" \"y \\ A\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ P (restrict A x')\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ Q' (x[y:=Some (f x)])\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ Q' x' \\ Q (restrict A x') \\ x' ! y = Some (f (restrict A x'))\"\n shows \"qtable n A' P Q' ((\\x. x[y:=Some (f x)]) ` X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\" unfolding qtable_def by simp\n then show \"table n A' ?Y\"\n unfolding table_def wf_tuple_def using assms(2,3)\n by (auto simp: nth_list_update)\nnext\n fix x'\n assume \"x' \\ ?Y\" \"wf_tuple n A' x'\" \"P x'\"\n then obtain x where \"x \\ X\" and x'_eq: \"x' = x[y:=Some (f x)]\" by blast\n then have \"wf_tuple n A x\"\n using assms(1) unfolding qtable_def table_def by blast\n then have \"y < length x\" using assms(2) by (simp add: wf_tuple_def)\n with \\wf_tuple n A x\\ have \"restrict A x' = x\"\n unfolding x'_eq by (simp add: restrict_update[OF assms(4)] restrict_idle)\n with \\wf_tuple n A' x'\\ \\P x'\\ have \"P x\"\n using assms(5) by blast\n with \\wf_tuple n A x\\ \\x \\ X\\ have \"Q x\"\n using assms(1) by (elim in_qtableE)\n with \\wf_tuple n A x\\ \\P x\\ show \"Q' x'\"\n unfolding x'_eq by (rule assms(6))\nnext\n fix x'\n assume \"wf_tuple n A' x'\" \"P x'\" \"Q' x'\"\n then have \"wf_tuple n A (restrict A x')\"\n using assms(3) by (auto intro!: wf_tuple_restrict_simple)\n moreover have \"P (restrict A x')\"\n using \\wf_tuple n A' x'\\ \\P x'\\ by (rule assms(5))\n moreover have \"Q (restrict A x')\" and y: \"x' ! y = Some (f (restrict A x'))\"\n using \\wf_tuple n A' x'\\ \\P x'\\ \\Q' x'\\ by (auto dest!: assms(7))\n ultimately have \"restrict A x' \\ X\" by (intro in_qtableI[OF assms(1)])\n moreover have \"x' = (restrict A x')[y:=Some (f (restrict A x'))]\"\n using y assms(2,3) \\wf_tuple n A (restrict A x')\\ \\wf_tuple n A' x'\\\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def nth_list_update nth_restrict)\n ultimately show \"x' \\ ?Y\" by simp\nqed\n\nlemma sat_the_update: \"y \\ fv \\ \\ Formula.sat \\ V (map the (x[y:=z])) i \\ = Formula.sat \\ V (map the x) i \\\"\n by (rule sat_fv_cong) (metis map_update nth_list_update_neq)\n\nlemma progress_constraint: \"progress \\ P (formula_of_constraint c) j = j\"\n by (induction rule: formula_of_constraint.induct) simp_all\n\nlemma qtable_filter:\n assumes \"qtable n A P Q X\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ R x \\ Q' x\"\n shows \"qtable n A P Q' (Set.filter R X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\"\n unfolding qtable_def by simp\n then show \"table n A ?Y\"\n unfolding table_def wf_tuple_def by simp\nnext\n fix x\n assume \"x \\ ?Y\" \"wf_tuple n A x\" \"P x\"\n with assms show \"Q' x\" by (auto elim!: in_qtableE)\nnext\n fix x\n assume \"wf_tuple n A x\" \"P x\" \"Q' x\"\n with assms show \"x \\ Set.filter R X\" by (auto intro!: in_qtableI)\nqed\n\nlemma eval_constraint_sat_eq: \"wf_tuple n A x \\ fv_trm t1 \\ A \\ fv_trm t2 \\ A \\\n \\i\\A. i < n \\ eval_constraint (t1, p, c, t2) x =\n Formula.sat \\ V (map the x) i (formula_of_constraint (t1, p, c, t2))\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct)\n (simp_all add: meval_trm_eval_trm)\n\ndeclare progress_le_gen[simp]\n\ndefinition \"wf_envs \\ j P P' V db =\n (dom V = dom P \\\n Mapping.keys db = dom P \\ {p. p \\ fst ` \\ \\ j} \\\n rel_mapping (\\) P P' \\\n pred_mapping (\\i. i \\ j) P \\\n pred_mapping (\\i. i \\ Suc j) P' \\\n (\\p \\ Mapping.keys db - dom P. the (Mapping.lookup db p) = [{ts. (p, ts) \\ \\ \\ j}]) \\\n (\\p \\ dom P. list_all2 (\\i X. X = the (V p) i) [the (P p).. event_data list) set \\ Formula.database\" is\n \"\\X p. (if p \\ fst ` X then Some [{ts. (p, ts) \\ X}] else None)\" .\n\nlemma wf_envs_mk_db: \"wf_envs \\ j Map.empty Map.empty Map.empty (mk_db (\\ \\ j))\"\n unfolding wf_envs_def mk_db_def\n by transfer (force split: if_splits simp: image_iff rel_mapping_alt)\n\nlemma wf_envs_update:\n assumes wf_envs: \"wf_envs \\ j P P' V db\"\n and m_eq: \"m = Formula.nfv \\\"\n and in_fv: \"{0 ..< m} \\ fv \\\"\n and b_le_m: \"b \\ m\"\n and xs: \"list_all2 (\\i. qtable m (Formula.fv \\) (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ (Suc j)] xs\"\n shows \"wf_envs \\ j (P(p \\ progress \\ P \\ j)) (P'(p \\ progress \\ P' \\ (Suc j)))\n (V(p \\ \\i. {v. length v = m - b \\ (\\zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\)}))\n (Mapping.update p (map (image (drop b o map the)) xs) db)\"\n unfolding wf_envs_def\nproof (intro conjI ballI, goal_cases)\n case 3\n from assms show ?case\n by (auto simp: wf_envs_def pred_mapping_alt progress_le progress_mono_gen\n intro!: rel_mapping_map_upd)\nnext\n case (6 p')\n with assms show ?case by (cases \"p' \\ dom P\") (auto simp: wf_envs_def lookup_update')\nnext\n case (7 p')\n from xs have \"list_all2 (\\x y. (\\x. drop b (map the x)) ` y =\n {v. length v = m - b \\ (\\zs. length zs = b \\ Formula.sat \\ V (zs @ v) x \\)})\n [progress \\ P \\ j.. P' \\ (Suc j)] xs\"\n proof (rule list.rel_mono_strong, safe)\n fix i X\n assume qtable: \"qtable m (fv \\) (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n {\n fix v\n assume \"v \\ X\"\n then show \"length (drop b (map the v)) = m - b\" and\n \"\\zs. length zs = b \\ Formula.sat \\ V (zs @ drop b (map the v)) i \\\"\n using qtable b_le_m\n by (auto simp: wf_tuple_def elim!: in_qtableE intro!: exI[of _ \"take b (map the v)\"])\n }\n {\n fix zs v\n assume \"length v = m - length zs\" and \"Formula.sat \\ V (zs @ v) i \\\" and \"b = length zs\"\n then show \"v \\ (\\x. drop (length zs) (map the x)) ` X\"\n using in_fv b_le_m\n by (auto 0 3 simp: wf_tuple_def nth_append\n intro!: image_eqI[where x=\"map Some (zs @ v)\"] in_qtableI[OF qtable])\n }\n qed\n moreover have \"list_all2 (\\i X. X = the (V p') i) [the (P p').. p'\"\n proof -\n from that 7 have \"p' \\ dom P\" by simp\n with wf_envs show ?thesis by (simp add: wf_envs_def)\n qed\n ultimately show ?case\n by (simp add: list.rel_map image_iff lookup_update')\nqed (use assms in \\auto simp: wf_envs_def\\)\n\nlemma wf_envs_P_simps[simp]:\n \"wf_envs \\ j P P' V db \\ pred_mapping (\\i. i \\ j) P\"\n \"wf_envs \\ j P P' V db \\ pred_mapping (\\i. i \\ Suc j) P'\"\n \"wf_envs \\ j P P' V db \\ rel_mapping (\\) P P'\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_le[simp]:\n \"wf_envs \\ j P P' V db \\ progress \\ P \\ j \\ j\"\n \"wf_envs \\ j P P' V db \\ progress \\ P' \\ (Suc j) \\ Suc j\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_regex_le[simp]:\n \"wf_envs \\ j P P' V db \\ progress_regex \\ P r j \\ j\"\n \"wf_envs \\ j P P' V db \\ progress_regex \\ P' r (Suc j) \\ Suc j\"\n unfolding wf_envs_def by (auto simp: progress_regex_le)\n\nlemma wf_envs_progress_mono[simp]:\n \"wf_envs \\ j P P' V db \\ a \\ b \\ progress \\ P \\ a \\ progress \\ P' \\ b\"\n unfolding wf_envs_def\n by (auto simp: progress_mono_gen)\n\nlemma qtable_wf_tuple_cong: \"qtable n A P Q X \\ A = B \\ (\\v. wf_tuple n A v \\ P v \\ Q v = Q' v) \\ qtable n B P Q' X\"\n unfolding qtable_def table_def by blast\n\nlemma (in maux) meval:\n assumes \"wf_mformula \\ j P V n R \\ \\'\" \"wf_envs \\ j P P' V db\"\n shows \"case meval n (\\ \\ j) db \\ of (xs, \\\\<^sub>n) \\ wf_mformula \\ (Suc j) P' V n R \\\\<^sub>n \\' \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (Suc j)] xs\"\n using assms\nproof (induction \\ arbitrary: db P P' V n R \\')\n case (MRel rel)\n then show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp add: ball_Un intro: wf_mformula.intros table_eq_rel eq_rel_eval_trm\n in_eq_rel qtable_empty qtable_unit_table intro!: qtableI)\nnext\n case (MPred e ts)\n then show ?case\n proof (cases \"e \\ dom P\")\n case True\n with MPred(2) have \"e \\ Mapping.keys db\" \"e \\ dom P'\" \"e \\ dom V\"\n \"list_all2 (\\i X. X = the (V e) i) [the (P e)..x. _ = tabulate x 0 n\", OF refl]\n elim!: list.rel_mono_strong bexI[rotated] dest: ex_match\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff\n list.map_comp keys_dom_lookup)\n next\n note MPred(1)\n moreover\n case False\n moreover\n from False MPred(2) have \"e \\ dom P'\" \"e \\ dom V\"\n unfolding wf_envs_def rel_mapping_alt by auto\n moreover\n from False MPred(2) have *: \"e \\ fst ` \\ \\ j \\ e \\ Mapping.keys db\"\n unfolding wf_envs_def by auto\n from False MPred(2) have\n \"e \\ Mapping.keys db \\ Mapping.lookup db e = Some [{ts. (e, ts) \\ \\ \\ j}]\"\n unfolding wf_envs_def keys_dom_lookup by (metis Diff_iff domD option.sel)\n with * have \"(case Mapping.lookup db e of None \\ [{}] | Some xs \\ xs) = [{ts. (e, ts) \\ \\ \\ j}]\"\n by (cases \"e \\ fst ` \\ \\ j\") (auto simp: image_iff keys_dom_lookup split: option.splits)\n ultimately show ?thesis\n by (cases rule: wf_mformula.cases)\n (fastforce intro!: wf_mformula.Pred qtableI bexI[where P=\"\\x. _ = tabulate x 0 n\", OF refl]\n elim!: list.rel_mono_strong bexI[rotated] dest: ex_match\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff list.map_comp)\n qed\nnext\n case (MLet p m b \\1 \\2)\n from MLet.prems(1) obtain \\1' \\2' where Let: \"\\' = Formula.Let p b \\1' \\2'\" and\n 1: \"wf_mformula \\ j P V m UNIV \\1 \\1'\" and\n fv: \"m = Formula.nfv \\1'\" \"{0.. fv \\1'\" \"b \\ m\" and\n 2: \"wf_mformula \\ j (P(p \\ progress \\ P \\1' j))\n (V(p \\ \\i. {v. length v = m - b \\ (\\zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\1')}))\n n R \\2 \\2'\"\n by (cases rule: wf_mformula.cases) auto\n obtain xs \\1_new where e1: \"meval m (\\ \\ j) db \\1 = (xs, \\1_new)\" and\n wf1: \"wf_mformula \\ (Suc j) P' V m UNIV \\1_new \\1'\" and\n res1: \"list_all2 (\\i. qtable m (fv \\1') (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\1'))\n [progress \\ P \\1' j.. P' \\1' (Suc j)] xs\"\n using MLet(1)[OF 1(1) MLet.prems(2)] by (auto simp: eqTrueI[OF mem_restr_UNIV, abs_def])\n from MLet(2)[OF 2 wf_envs_update[OF MLet.prems(2) fv res1]] wf1 e1 fv\n show ?case unfolding Let\n by (auto simp: fun_upd_def intro!: wf_mformula.Let)\nnext\n case (MAnd A_\\ \\ pos A_\\ \\ buf)\n from MAnd.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: sat_the_restrict simp del: bin_join.simps\n dest!: MAnd.IH split: if_splits prod.splits intro!: wf_mformula.And qtable_bin_join\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MAndAssign \\ conf)\n from MAndAssign.prems obtain \\'' x t \\'' where\n wf_envs: \"wf_envs \\ j P P' V db\" and\n \\'_eq: \"\\' = formula.And \\'' \\''\" and\n wf_\\: \"wf_mformula \\ j P V n R \\ \\''\" and\n \"x < n\" and\n \"x \\ fv \\''\" and\n fv_t_subset: \"fv_trm t \\ fv \\''\" and\n conf: \"(x, t) = conf\" and\n \\''_eqs: \"\\'' = formula.Eq (trm.Var x) t \\ \\'' = formula.Eq t (trm.Var x)\"\n by (cases rule: wf_mformula.cases)\n from wf_\\ wf_envs obtain xs \\\\<^sub>n where\n meval_eq: \"meval n (\\ \\ j) db \\ = (xs, \\\\<^sub>n)\" and\n wf_\\\\<^sub>n: \"wf_mformula \\ (Suc j) P' V n R \\\\<^sub>n \\''\" and\n xs: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [progress \\ P \\'' j.. P' \\'' (Suc j)] xs\"\n by (auto dest!: MAndAssign.IH)\n have progress_eqs:\n \"progress \\ P \\' j = progress \\ P \\'' j\"\n \"progress \\ P' \\' (Suc j) = progress \\ P' \\'' (Suc j)\"\n using \\''_eqs wf_envs_progress_le[OF wf_envs] by (auto simp: \\'_eq)\n\n show ?case proof (simp add: meval_eq, intro conjI)\n show \"wf_mformula \\ (Suc j) P' V n R (MAndAssign \\\\<^sub>n conf) \\'\"\n unfolding \\'_eq\n by (rule wf_mformula.AndAssign) fact+\n next\n show \"list_all2 (\\i. qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (Suc j)] (map ((`) (eval_assignment conf)) xs)\"\n unfolding list.rel_map progress_eqs conf[symmetric] eval_assignment.simps\n using xs\n proof (rule list.rel_mono_strong)\n fix i X\n assume qtable: \"qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'') X\"\n then show \"qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\')\n ((\\y. y[x := Some (meval_trm t y)]) ` X)\"\n proof (rule qtable_assign)\n show \"x < n\" by fact\n show \"insert x (fv \\'') = fv \\'\"\n using \\''_eqs fv_t_subset by (auto simp: \\'_eq)\n show \"x \\ fv \\''\" by fact\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\') v\" and \"mem_restr R v\"\n then show \"mem_restr R (restrict (fv \\'') v)\" by simp\n\n assume sat: \"Formula.sat \\ V (map the v) i \\'\"\n then have A: \"Formula.sat \\ V (map the (restrict (fv \\'') v)) i \\''\" (is ?A)\n by (simp add: \\'_eq sat_the_restrict)\n have \"map the v ! x = Formula.eval_trm (map the v) t\"\n using sat \\''_eqs by (auto simp: \\'_eq)\n also have \"... = Formula.eval_trm (map the (restrict (fv \\'') v)) t\"\n using fv_t_subset by (auto simp: map_the_restrict intro!: eval_trm_fv_cong)\n finally have \"map the v ! x = meval_trm t (restrict (fv \\'') v)\"\n using meval_trm_eval_trm[of n \"fv \\''\" \"restrict (fv \\'') v\" t]\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (fastforce simp: \\'_eq intro!: wf_tuple_restrict)\n then have B: \"v ! x = Some (meval_trm t (restrict (fv \\'') v))\" (is ?B)\n using \\''_eqs wf_v \\x < n\\ by (auto simp: wf_tuple_def \\'_eq)\n from A B show \"?A \\ ?B\" ..\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\'') v\" and \"mem_restr R v\"\n and sat: \"Formula.sat \\ V (map the v) i \\''\"\n let ?v = \"v[x := Some (meval_trm t v)]\"\n from sat have A: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\x \\ fv \\''\\ by (simp add: sat_the_update)\n have \"y \\ fv_trm t \\ x \\ y\" for y\n using fv_t_subset \\x \\ fv \\''\\ by auto\n then have B: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\''_eqs meval_trm_eval_trm[of n \"fv \\''\" v t] \\x < n\\\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (auto simp: wf_tuple_def map_update intro!: eval_trm_fv_cong)\n from A B show \"Formula.sat \\ V (map the ?v) i \\'\"\n by (simp add: \\'_eq)\n qed\n qed\n qed\nnext\n case (MAndRel \\ conf)\n from MAndRel.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: progress_constraint progress_le list.rel_map fv_formula_of_constraint\n Un_absorb2 wf_mformula_wf_set[unfolded wf_set_def] split: prod.splits\n dest!: MAndRel.IH[where db=db and P=P and P'=P'] eval_constraint_sat_eq[THEN iffD2]\n intro!: wf_mformula.AndRel\n elim!: list.rel_mono_strong qtable_filter eval_constraint_sat_eq[THEN iffD1])\nnext\n case (MAnds A_pos A_neg l buf)\n note mbufn_take.simps[simp del] mbufn_add.simps[simp del] mmulti_join.simps[simp del]\n\n from MAnds.prems obtain pos neg l' where\n wf_l: \"list_all2 (wf_mformula \\ j P V n R) l (pos @ map remove_neg neg)\" and\n wf_buf: \"wf_mbufn (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (pos @ map remove_neg neg))\n (map (\\\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (pos @ map remove_neg neg)) buf\" and\n posneg: \"(pos, neg) = partition safe_formula l'\" and\n \"pos \\ []\" and\n safe_neg: \"list_all safe_formula (map remove_neg neg)\" and\n A_eq: \"A_pos = map fv pos\" \"A_neg = map fv neg\" and\n fv_subset: \"\\ (set A_neg) \\ \\ (set A_pos)\" and\n \"\\' = Formula.Ands l'\"\n by (cases rule: wf_mformula.cases) simp\n have progress_eq: \"progress \\ P' (formula.Ands l') (Suc j) =\n Mini (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P' \\ (Suc j)) (pos @ map remove_neg neg))\"\n using \\pos \\ []\\ posneg\n by (auto simp: Mini_def image_Un[symmetric] Collect_disj_eq[symmetric] intro!: arg_cong[where f=Min])\n\n have join_ok: \"qtable n (\\ (fv ` set l')) (mem_restr R)\n (\\v. list_all (Formula.sat \\ V (map the v) k) l')\n (mmulti_join n A_pos A_neg L)\"\n if args_ok: \"list_all2 (\\x. qtable n (fv x) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k x))\n (pos @ map remove_neg neg) L\"\n for k L\n proof (rule qtable_mmulti_join)\n let ?ok = \"\\A Qi X. qtable n A (mem_restr R) Qi X \\ wf_set n A\"\n let ?L_pos = \"take (length A_pos) L\"\n let ?L_neg = \"drop (length A_pos) L\"\n have 1: \"length pos \\ length L\"\n using args_ok by (auto dest!: list_all2_lengthD)\n show \"list_all3 ?ok A_pos (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) ?L_pos\"\n using args_ok wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth nth_append\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R]\n dest: order.strict_trans2[OF _ 1])\n from args_ok have prems_neg: \"list_all2 (\\\\. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k (remove_neg \\))) neg ?L_neg\"\n by (auto simp: A_eq list_all2_append1 list.rel_map)\n show \"list_all3 ?ok A_neg (map (\\\\ v. Formula.sat \\ V (map the v) k (remove_neg \\)) neg) ?L_neg\"\n using prems_neg wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length nth_append less_diff_conv\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R _ \"remove_neg _\", simplified])\n show \"\\(fv ` set l') = \\(set A_pos)\"\n using fv_subset posneg unfolding A_eq by auto\n show \"L = take (length A_pos) L @ drop (length A_pos) L\" by simp\n show \"A_pos \\ []\" using \\pos \\ []\\ A_eq by simp\n\n fix x :: \"event_data tuple\"\n assume \"wf_tuple n (\\ (fv ` set l')) x\" and \"mem_restr R x\"\n then show \"list_all (\\A. mem_restr R (restrict A x)) A_pos\"\n and \"list_all (\\A. mem_restr R (restrict A x)) A_neg\"\n by (simp_all add: list.pred_set)\n\n have \"list_all Formula.is_Neg neg\"\n using posneg safe_neg\n by (auto 0 3 simp add: list.pred_map elim!: list.pred_mono_strong\n intro: formula.exhaust[of \\ \"Formula.is_Neg \\\" for \\])\n then have \"list_all (\\\\. Formula.sat \\ V (map the v) i (remove_neg \\) \\\n \\ Formula.sat \\ V (map the v) i \\) neg\" for v i\n by (fastforce simp: Formula.is_Neg_def elim!: list.pred_mono_strong)\n then show \"list_all (Formula.sat \\ V (map the x) k) l' =\n (list_all2 (\\A Qi. Qi (restrict A x)) A_pos\n (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg\n (map (\\\\ v. Formula.sat \\ V (map the v) k\n (remove_neg \\))\n neg))\"\n using posneg\n by (auto simp add: A_eq list_all2_conv_all_nth list_all_length sat_the_restrict\n elim: nth_filter nth_partition[where P=safe_formula and Q=\"Formula.sat _ _ _ _\"])\n qed fact\n\n from MAnds.prems(2) show ?case\n unfolding \\\\' = Formula.Ands l'\\\n by (auto 0 3 simp add: list.rel_map progress_eq map2_map_map list_all3_map\n list_all3_list_all2_conv list.pred_map\n simp del: set_append map_append progress_simps split: prod.splits\n intro!: wf_mformula.Ands[OF _ _ posneg \\pos \\ []\\ safe_neg A_eq fv_subset]\n list.rel_mono_strong[OF wf_l] wf_mbufn_add[OF wf_buf]\n list.rel_flip[THEN iffD1, OF list.rel_mono_strong, OF wf_l]\n list.rel_refl join_ok[unfolded list.pred_set]\n dest!: MAnds.IH[OF _ _ MAnds.prems(2), rotated]\n elim!: wf_mbufn_take list_all2_appendI\n elim: mbufn_take_induct[OF _ wf_mbufn_add[OF wf_buf]])\nnext\n case (MOr \\ \\ buf)\n from MOr.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto dest!: MOr.IH split: if_splits prod.splits intro!: wf_mformula.Or qtable_union\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MNeg \\)\n have *: \"qtable n {} (mem_restr R) (\\v. P v) X \\\n \\ qtable n {} (mem_restr R) (\\v. \\ P v) empty_table \\ x \\ X \\ False\" for P x X\n using nullary_qtable_cases qtable_unit_empty_table by fastforce\n from MNeg.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto 0 4 intro!: wf_mformula.Neg dest!: MNeg.IH\n simp add: list.rel_map\n dest: nullary_qtable_cases qtable_unit_empty_table intro!: qtable_empty_unit_table\n elim!: list.rel_mono_strong elim: *)\nnext\n case (MExists \\)\n from MExists.prems show ?case\n by (cases rule: wf_mformula.cases)\n (force simp: list.rel_map fvi_Suc sat_fv_cong nth_Cons'\n intro!: wf_mformula.Exists dest!: MExists.IH qtable_project_fv\n elim!: list.rel_mono_strong table_fvi_tl qtable_cong sat_fv_cong[THEN iffD1, rotated -1]\n split: if_splits)+\nnext\n case (MAgg g0 y \\ b f \\)\n from MAgg.prems show ?case\n using wf_mformula_wf_set[OF MAgg.prems(1), unfolded wf_set_def]\n by (cases rule: wf_mformula.cases)\n (auto 0 3 simp add: list.rel_map simp del: sat.simps fvi.simps split: prod.split\n intro!: wf_mformula.Agg qtable_eval_agg dest!: MAgg.IH elim!: list.rel_mono_strong)\nnext\n case (MPrev I \\ first buf nts)\n from MPrev.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Prev \\)\n let ?xs = \"fst (meval n (\\ \\ j) db \\)\"\n let ?\\ = \"snd (meval n (\\ \\ j) db \\)\"\n let ?ls = \"fst (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j]))\"\n let ?rs = \"fst (snd (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j])))\"\n let ?ts = \"snd (snd (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?min = \"min (progress \\ P' \\ (Suc j)) (Suc j - 1)\"\n from Prev MPrev.IH[OF _ MPrev.prems(2), of n R \\] have IH: \"wf_mformula \\ (Suc j) P' V n R ?\\ \\\" and\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (Suc j)] ?xs\" by auto\n with Prev(4,5) MPrev.prems(2) have \"list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then ?P i X else X = empty_table)\n [min (progress \\ P \\ j) (j - 1)..\n list_all2 ?P [?min.. P' \\ (Suc j)] ?rs \\\n list_all2 (\\i t. t = \\ \\ i) [?min.. P \\ j)) j = Suc (min (progress \\ P \\ j) (j-1))\" if \"j > 0\"\n using that by auto\n ultimately show ?thesis using Prev(1,3) MPrev.prems(2) IH\n by (auto simp: map_Suc_upt[symmetric] upt_Suc[of 0] list.rel_map qtable_empty_iff\n simp del: upt_Suc elim!: wf_mformula.Prev list.rel_mono_strong\n split: prod.split if_split_asm)\n qed\nnext\n case (MNext I \\ first nts)\n from MNext.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Next \\)\n\n have min[simp]:\n \"min (progress \\ P \\ j - Suc 0) (j - Suc 0) = progress \\ P \\ j - Suc 0\"\n \"min (progress \\ P' \\ (Suc j) - Suc 0) j = progress \\ P' \\ (Suc j) - Suc 0\"\n using wf_envs_progress_le[OF MNext.prems(2), of \\] by auto\n\n let ?xs = \"fst (meval n (\\ \\ j) db \\)\"\n let ?ys = \"case (?xs, first) of (_ # xs, True) \\ xs | _ \\ ?xs\"\n let ?\\ = \"snd (meval n (\\ \\ j) db \\)\"\n let ?ls = \"fst (mprev_next I ?ys (nts @ [\\ \\ j]))\"\n let ?rs = \"fst (snd (mprev_next I ?ys (nts @ [\\ \\ j])))\"\n let ?ts = \"snd (snd (mprev_next I ?ys (nts @ [\\ \\ j])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?min = \"min (progress \\ P' \\ (Suc j) - 1) (Suc j - 1)\"\n from Next MNext.IH[OF _ MNext.prems(2), of n R \\] have IH: \"wf_mformula \\ (Suc j) P' V n R ?\\ \\\"\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (Suc j)] ?xs\" by auto\n with Next have \"list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then ?P (Suc i) X else X = empty_table)\n [progress \\ P \\ j - 1..\n list_all2 ?P [Suc ?min.. P' \\ (Suc j)] ?rs \\\n list_all2 (\\i t. t = \\ \\ i) [?min.. P \\ j < progress \\ P' \\ (Suc j)\"\n using that wf_envs_progress_le[OF MNext.prems(2), of \\]\n by (intro mnext) (auto simp: list_all2_Cons2 upt_eq_Cons_conv\n intro!: list_all2_upt_append list_all2_appendI split: list.splits)\n then show ?thesis using wf_envs_progress_le[OF MNext.prems(2), of \\]\n wf_envs_progress_mono[OF MNext.prems(2), of j \"Suc j\" \\, simplified] Next IH\n by (cases \"progress \\ P' \\ (Suc j) > progress \\ P \\ j\")\n (auto 0 3 simp: qtable_empty_iff le_Suc_eq le_diff_conv\n elim!: wf_mformula.Next list.rel_mono_strong list_all2_appendI\n split: prod.split list.splits if_split_asm) (* slow 5 sec*)\n qed\nnext\n case (MSince args \\ \\ buf nts aux)\n note sat.simps[simp del]\n from MSince.prems obtain \\'' \\''' \\'' I where Since_eq: \"\\' = Formula.Since \\''' I \\''\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_since_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Since \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n by (cases rule: wf_mformula.cases) (auto)\n have \\''': \"Formula.fv \\''' = Formula.fv \\''\" \"progress \\ P \\''' j = progress \\ P \\'' j\"\n \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all split: if_splits)\n from MSince.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j).. \\ j])\"\n using nts unfolding wf_ts_def\n by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)\n have update: \"wf_since_aux \\ V R args \\'' \\'' (snd (zs, aux')) (progress \\ P' (Formula.Since \\''' I \\'') (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv \\''' \\ Formula.fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Since \\''' I \\'')))\n [progress \\ P (Formula.Since \\''' I \\'') j.. P' (Formula.Since \\''' I \\'') (Suc j)] (fst (zs, aux'))\"\n if eval_\\: \"fst (meval n (\\ \\ j) db \\) = xs\"\n and eval_\\: \"fst (meval n (\\ \\ j) db \\) = ys\"\n and eq: \"mbuf2t_take (\\r1 r2 t (zs, aux).\n case update_since args r1 r2 t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbuf2_add xs ys buf) (nts @ [\\ \\ j]) = ((zs, aux'), buf', nts')\"\n for xs ys zs aux' buf' nts'\n unfolding progress_simps \\'''\n proof (rule mbuf2t_take_add_induct'[where j=j and j'=\"Suc j\" and z'=\"(zs, aux')\",\n OF eq wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc],\n goal_cases xs ys _ base step)\n case xs\n then show ?case\n using MSince.IH(1)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case ys\n then show ?case\n using MSince.IH(2)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case base\n then show ?case\n using aux by (simp add: \\''')\n next\n case (step k X Y z)\n then show ?case\n using fvi_subset pos\n by (auto 0 3 simp: args_ivl args_n args_L args_R Un_absorb1\n elim!: update_since(1) list_all2_appendI dest!: update_since(2)\n split: prod.split if_splits)\n qed simp\n with MSince.IH(1)[OF \\ MSince.prems(2)] MSince.IH(2)[OF \\ MSince.prems(2)] show ?case\n by (auto 0 3 simp: Since_eq split: prod.split\n intro: wf_mformula.Since[OF _ _ pos pos_eq args_ivl args_n args_L args_R fvi_subset]\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc])\nnext\n case (MUntil args \\ \\ buf nts aux)\n note sat.simps[simp del] progress_simps[simp del]\n from MUntil.prems obtain \\'' \\''' \\'' I where Until_eq: \"\\' = Formula.Until \\''' I \\''\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_until_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Until \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n and length_aux: \"progress \\ P (Formula.Until \\''' I \\'') j + length_muaux args aux =\n min (progress \\ P \\'' j) (progress \\ P \\'' j)\"\n by (cases rule: wf_mformula.cases) (auto)\n define pos where args_pos: \"pos = args_pos args\"\n have \\''': \"progress \\ P \\''' j = progress \\ P \\'' j\" \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all add: progress.simps split: if_splits)\n from MUntil.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j).. \\ j])\"\n using nts unfolding wf_ts_def\n by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)\n {\n fix xs ys zs aux' aux'' buf' nts'\n assume eval_\\: \"fst (meval n (\\ \\ j) db \\) = xs\"\n and eval_\\: \"fst (meval n (\\ \\ j) db \\) = ys\"\n and eq1: \"mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [\\ \\ j]) =\n (aux', buf', nts')\"\n and eq2: \"eval_muaux args (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) aux' = (zs, aux'')\"\n define ne where \"ne \\ progress \\ P (Formula.Until \\''' I \\'') j\"\n have update1: \"wf_until_aux \\ V R args \\'' \\'' aux' (progress \\ P (Formula.Until \\''' I \\'') j) \\\n ne + length_muaux args aux' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j))\"\n using MUntil.IH(1)[OF \\ MUntil.prems(2)] eval_\\ MUntil.IH(2)[OF \\ MUntil.prems(2)]\n eval_\\ nts_snoc nts_snoc length_aux aux fvi_subset\n unfolding \\'''\n by (elim mbuf2t_take_add_induct'[where j'=\"Suc j\", OF eq1 wf_envs_P_simps[OF MUntil.prems(2)] buf])\n (auto simp: args_n args_L args_R ne_def wf_update_until)\n then obtain cur auxlist' where valid_aux': \"valid_muaux args cur aux' auxlist'\" and\n cur: \"cur = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\" and\n wf_auxlist': \"wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' (progress \\ P (Formula.Until \\''' I \\'') j)\"\n unfolding wf_until_aux_def ne_def args_ivl args_n args_pos by auto\n have length_aux': \"length_muaux args aux' = length auxlist'\"\n using valid_length_muaux[OF valid_aux'] .\n have nts': \"wf_ts \\ P' (Suc j) \\'' \\'' nts'\"\n using MUntil.IH(1)[OF \\ MUntil.prems(2)] eval_\\ MUntil.IH(2)[OF \\ MUntil.prems(2)]\n MUntil.prems(2) eval_\\ nts_snoc\n unfolding wf_ts_def\n by (intro mbuf2t_take_eqD(2)[OF eq1]) (auto intro: wf_mbuf2_add buf[unfolded wf_mbuf2'_def])\n define zs'' where \"zs'' = fst (eval_until I (case nts' of [] \\ \\ \\ j | nt # x \\ nt) auxlist')\"\n define auxlist'' where \"auxlist'' = snd (eval_until I (case nts' of [] \\ \\ \\ j | nt # x \\ nt) auxlist')\"\n have current_w_le: \"cur \\ (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof (cases nts')\n case Nil\n have p_le: \"min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) - 1 \\ j\"\n using wf_envs_progress_le[OF MUntil.prems(2)]\n by (auto simp: min_def le_diff_conv)\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux']\n using Nil by auto\n next\n case (Cons nt x)\n have progress_\\''': \"progress \\ P' \\'' (Suc j) = progress \\ P' \\''' (Suc j)\"\n using pos by (auto simp add: progress.simps split: if_splits)\n have \"nt = \\ \\ (min (progress \\ P' \\'' (Suc j)) (progress \\ P' \\'' (Suc j)))\"\n using nts'[unfolded wf_ts_def Cons]\n unfolding list_all2_Cons2 upt_eq_Cons_conv by auto\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux'] Cons progress_\\'''\n by (auto split: if_splits list.splits intro!: \\_mono)\n qed\n have valid_aux'': \"valid_muaux args cur aux'' auxlist''\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n by (auto simp add: args_ivl zs''_def auxlist''_def)\n have length_aux'': \"length_muaux args aux'' = length auxlist''\"\n using valid_length_muaux[OF valid_aux''] .\n have eq2': \"eval_until I (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) auxlist' = (zs, auxlist'')\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n by (auto simp add: args_ivl zs''_def auxlist''_def)\n have length_aux'_aux'': \"length_muaux args aux' = length zs + length_muaux args aux''\"\n using eval_until_length[OF eq2'] unfolding length_aux' length_aux'' .\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' i \\\n i + length auxlist' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist'' (progress \\ P' (Formula.Until \\''' I \\'') (Suc j)) \\\n i + length zs = progress \\ P' (Formula.Until \\''' I \\'') (Suc j) \\\n i + length zs + length auxlist'' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Until (if pos then \\'' else Formula.Neg \\'') I \\'')))\n [i.. V n R pos \\'' I \\'' aux' (Suc i)\"\n by (rule wf_until_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv \\'') (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem (\\ \\ j - \\ \\ i) I \\ Formula.sat \\ V (map the v) j \\'' \\\n (\\k\\{i.. V (map the v) k \\'' else \\ Formula.sat \\ V (map the v) k \\''))) a2\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons3)\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' =\n min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j))\"\n by simp\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j)\"\n if \"enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt) \\ enat t + right I\"\n using that nts' unfolding wf_ts_def progress.simps\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv \\'''\n intro!: cInf_lower \\_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j)\"\n if \"enat t + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof -\n from that obtain m where m: \"right I = enat m\" by (cases \"right I\") auto\n have \\_min: \"\\ \\ (min j k) = min (\\ \\ j) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"(Suc j) \\ progress \\ P' \\ (Suc j) \\ progress \\ P' \\ (Suc j) = (Suc j)\" for \\\n using wf_envs_progress_le[OF MUntil.prems(2), of \\] by auto\n have min_Suc[simp]: \"min j (Suc j) = j\" by auto\n let ?X = \"{i. \\k. k < Suc j \\ k \\min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\ enat (\\ \\ k) \\ enat (\\ \\ i) + right I}\"\n let ?min = \"min j (min (progress \\ P' \\'' (Suc j)) (progress \\ P' \\'' (Suc j)))\"\n have \"\\ \\ ?min \\ \\ \\ j\"\n by (rule \\_mono) auto\n from m have \"?X \\ {}\"\n by (auto dest!: \\_mono[of _ \"progress \\ P' \\'' (Suc j)\" \\]\n simp: not_le not_less \\''' intro!: exI[of _ \"progress \\ P' \\'' (Suc j)\"])\n from m show ?thesis\n using that nts' unfolding wf_ts_def progress.simps\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto simp: 1 \\''' not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"] less_le_trans[of \"\\ \\ i + m\" \"\\ \\ _\" \"\\ \\ _ + m\"] less_\\D)\n qed\n moreover have *: \"k < progress \\ P' \\ (Suc j)\" if\n \"enat (\\ \\ i) + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n \"enat (\\ \\ k - \\ \\ i) \\ right I\" \"\\ = \\'' \\ \\ = \\''\" for k \\\n proof -\n from that(1,2) obtain m where \"right I = enat m\"\n \"\\ \\ i + m < (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\" \"\\ \\ k - \\ \\ i \\ m\"\n by (cases \"right I\") auto\n with that(3) nts' progress_le[of \\ \\'' \"Suc j\"] progress_le[of \\ \\'' \"Suc j\"]\n show ?thesis\n unfolding wf_ts_def le_diff_conv\n by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute\n simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of \"\\ \\ k\"] less_\\D)\n qed\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, a1, a2)\\\n by (auto simp: \\''' 1 sat.simps upt_conv_Cons dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n qed\n thm this\n note wf_aux'' = this[OF wf_envs_progress_mono[OF MUntil.prems(2) le_SucI[OF order_refl]]\n wf_auxlist' conjunct2[OF update1, unfolded ne_def length_aux']]\n have \"progress \\ P (formula.Until \\''' I \\'') j + length auxlist' =\n progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist''\"\n using wf_aux'' valid_aux'' length_aux'_aux''\n by (auto simp add: ne_def length_aux' length_aux'')\n then have \"cur =\n (if progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist'' = 0 then 0\n else \\ \\ (progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist'' - 1))\"\n unfolding cur ne_def by auto\n then have \"wf_until_aux \\ V R args \\'' \\'' aux'' (progress \\ P' (formula.Until \\''' I \\'') (Suc j)) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs = progress \\ P' (formula.Until \\''' I \\'') (Suc j) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs + length_muaux args aux'' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i (formula.Until (if pos then \\'' else formula.Neg \\'') I \\'')))\n [progress \\ P (formula.Until \\''' I \\'') j.. P (formula.Until \\''' I \\'') j + length zs] zs\"\n using wf_aux'' valid_aux'' fvi_subset\n unfolding wf_until_aux_def length_aux'' args_ivl args_n args_pos by (auto simp only: length_aux'')\n }\n note update = this\n from MUntil.IH(1)[OF \\ MUntil.prems(2)] MUntil.IH(2)[OF \\ MUntil.prems(2)] pos pos_eq fvi_subset show ?case\n by (auto 0 4 simp: args_ivl args_n args_pos Until_eq \\''' progress.simps(6) split: prod.split if_splits\n dest!: update[OF refl refl, rotated]\n intro!: wf_mformula.Until[OF _ _ _ _ args_ivl args_n args_L args_R fvi_subset]\n elim!: list.rel_mono_strong qtable_cong\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc])\nnext\n case (MMatchP I mr mrs \\s buf nts aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del]\n from MMatchP.prems obtain r \\s where eq: \"\\' = Formula.MatchP I r\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j)\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j.. \\ j])\"\n using nts unfolding wf_ts_regex_def\n by (auto simp add: wf_envs_progress_regex_le[OF MMatchP.prems(2)] intro: list_all2_appendI)\n have update: \"wf_matchP_aux \\ V n R I r (snd (zs, aux')) (progress \\ P' (Formula.MatchP I r) (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchP I r)))\n [progress \\ P (Formula.MatchP I r) j.. P' (Formula.MatchP I r) (Suc j)] (fst (zs, aux'))\"\n if eval: \"map (fst o meval n (\\ \\ j) db) \\s = xss\"\n and eq: \"mbufnt_take (\\rels t (zs, aux).\n case update_matchP n I mr mrs rels t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbufn_add xss buf) (nts @ [\\ \\ j]) = ((zs, aux'), buf', nts')\"\n for xss zs aux' buf' nts'\n unfolding progress_simps\n proof (rule mbufnt_take_add_induct'[where j'=\"Suc j\" and z'=\"(zs, aux')\", OF eq wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc],\n goal_cases xss _ base step)\n case xss\n then show ?case\n using eval \\s\n by (auto simp: list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map\n list.rel_flip[symmetric, of _ \\s \\s] dest!: MMatchP.IH(1)[OF _ _ MMatchP.prems(2)]\n elim!: list.rel_mono_strong split: prod.splits)\n next\n case base\n then show ?case\n using aux by auto\n next\n case (step k Xs z)\n then show ?case\n by (auto simp: Un_absorb1 mrs safe mr elim!: update_matchP(1) list_all2_appendI\n dest!: update_matchP(2) split: prod.split)\n qed simp\n then show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchP.IH[OF _ _ MMatchP.prems(2)] split: prod.splits)\nnext\n case (MMatchF I mr mrs \\s buf nts aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del] progress_simps[simp del]\n from MMatchF.prems obtain r \\s where eq: \"\\' = Formula.MatchF I r\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0\"\n and length_aux: \"progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [progress_regex \\ P r j.. \\ j])\"\n using nts unfolding wf_ts_regex_def\n by (auto simp add: wf_envs_progress_regex_le[OF MMatchF.prems(2)] intro: list_all2_appendI)\n {\n fix xss zs aux' aux'' buf' nts'\n assume eval: \"map (fst o meval n (\\ \\ j) db) \\s = xss\"\n and eq1: \"mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [\\ \\ j]) =\n (aux', buf', nts')\"\n and eq2: \"eval_matchF I mr (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) aux' = (zs, aux'')\"\n have update1: \"wf_matchF_aux \\ V n R I r aux' (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux' = progress_regex \\ P' r (Suc j)\"\n using eval nts_snoc nts_snoc length_aux aux \\s\n by (elim mbufnt_take_add_induct'[where j'=\"Suc j\", OF eq1 wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf])\n (auto simp: length_update_matchF\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)]\n elim: wf_update_matchF[OF _ safe mr mrs] elim!: list.rel_mono_strong)\n from MMatchF.prems(2) have nts': \"wf_ts_regex \\ P' (Suc j) r nts'\"\n using eval eval nts_snoc \\s\n unfolding wf_ts_regex_def\n by (intro mbufnt_take_eqD(2)[OF eq1 wf_mbufn_add[where js'=\"map (\\\\. progress \\ P' \\ (Suc j)) \\s\",\n OF buf[unfolded wf_mbufn'_def mr prod.case]]])\n (auto simp: to_mregex_progress[OF safe mr] Mini_def\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n list_all2_Cons1 elim!: list.rel_mono_strong intro!: list.rel_refl_strong\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)])\n have \"i \\ progress \\ P' (Formula.MatchF I r) (Suc j) \\\n wf_matchF_aux \\ V n R I r aux' i 0 \\\n i + length aux' = progress_regex \\ P' r (Suc j) \\\n wf_matchF_aux \\ V n R I r aux'' (progress \\ P' (Formula.MatchF I r) (Suc j)) 0 \\\n i + length zs = progress \\ P' (Formula.MatchF I r) (Suc j) \\\n i + length zs + length aux'' = progress_regex \\ P' r (Suc j) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchF I r)))\n [i.. V n R I r aux' (Suc i) 0\"\n by (rule wf_matchF_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, rels, rel)\\ by (rule wf_matchF_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem (\\ \\ j - \\ \\ i) I \\ Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n unfolding \\a = (t, rels, rel)\\ using wf_matchF_aux_Cons3 by force\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' = progress_regex \\ P' r (Suc j)\"\n by simp\n have \"i \\ progress \\ P' (Formula.MatchF I r) (Suc j)\"\n if \"enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt) \\ enat t + right I\"\n using that nts' unfolding wf_ts_regex_def progress_simps\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv\n intro!: cInf_lower \\_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.MatchF I r) (Suc j)\"\n if \"enat t + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof -\n from that obtain m where m: \"right I = enat m\" by (cases \"right I\") auto\n have \\_min: \"\\ \\ (min j k) = min (\\ \\ j) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"Suc j \\ progress \\ P' \\ (Suc j) \\ progress \\ P' \\ (Suc j) = (Suc j)\" for \\\n using wf_envs_progress_le[OF MMatchF.prems(2), of \\] by auto\n have min_Suc[simp]: \"min j (Suc j) = j\" by auto\n let ?X = \"{i. \\k. k < Suc j \\ k \\ progress_regex \\ P' r (Suc j) \\ enat (\\ \\ k) \\ enat (\\ \\ i) + right I}\"\n let ?min = \"min j (progress_regex \\ P' r (Suc j))\"\n have \"\\ \\ ?min \\ \\ \\ j\"\n by (rule \\_mono) auto\n from m have \"?X \\ {}\"\n by (auto dest!: less_\\D add_lessD1 simp: not_le not_less)\n from m show ?thesis\n using that nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]\n unfolding wf_ts_regex_def progress_simps\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto simp: 1 not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"] less_le_trans[of \"\\ \\ i + m\" \"\\ \\ _\" \"\\ \\ _ + m\"] less_\\D)\n qed\n moreover have *: \"k < progress_regex \\ P' r (Suc j)\" if\n \"enat (\\ \\ i) + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n \"enat (\\ \\ k - \\ \\ i) \\ right I\" for k\n proof -\n from that(1,2) obtain m where \"right I = enat m\"\n \"\\ \\ i + m < (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\" \"\\ \\ k - \\ \\ i \\ m\"\n by (cases \"right I\") auto\n with nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]\n show ?thesis\n unfolding wf_ts_regex_def le_diff_conv\n by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute\n simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of \"\\ \\ k\"] less_\\D)\n qed\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, rels, rel)\\\n by (auto simp: 1 sat.simps upt_conv_Cons dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n\n qed\n note this[OF progress_mono_gen[OF le_SucI, OF order.refl] conjunct1[OF update1] conjunct2[OF update1]]\n }\n note update = this[OF refl, rotated]\n with MMatchF.prems(2) show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)] update split: prod.splits)\nqed\n\n\nsubsubsection \\Monitor step\\\n\nlemma (in maux) wf_mstate_mstep: \"wf_mstate \\ \\ R st \\ last_ts \\ \\ snd tdb \\\n wf_mstate \\ (psnoc \\ tdb) R (snd (mstep (map_prod mk_db id tdb) st))\"\n unfolding wf_mstate_def mstep_def Let_def\n by (fastforce simp add: progress_mono le_imp_diff_is_add split: prod.splits\n elim!: prefix_of_psnocE dest: meval[OF _ wf_envs_mk_db] list_all2_lengthD)\n\ndefinition \"flatten_verdicts Vs = (\\ (set (map (\\(i, X). (\\v. (i, v)) ` X) Vs)))\"\n\nlemma flatten_verdicts_append[simp]:\n \"flatten_verdicts (Vs @ Us) = flatten_verdicts Vs \\ flatten_verdicts Us\"\n by (induct Vs) (auto simp: flatten_verdicts_def)\n\nlemma (in maux) mstep_output_iff:\n assumes \"wf_mstate \\ \\ R st\" \"last_ts \\ \\ snd tdb\" \"prefix_of (psnoc \\ tdb) \\\" \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n progress \\ Map.empty \\ (plen \\) \\ i \\ i < progress \\ Map.empty \\ (Suc (plen \\)) \\\n wf_tuple (Formula.nfv \\) (Formula.fv \\) v \\ Formula.sat \\ Map.empty (map the v) i \\\"\nproof -\n from prefix_of_psnocE[OF assms(3,2)] have \"prefix_of \\ \\\"\n \"\\ \\ (plen \\) = fst tdb\" \"\\ \\ (plen \\) = snd tdb\" by auto\n moreover from assms(1) \\prefix_of \\ \\\\ have \"mstate_n st = Formula.nfv \\\"\n \"mstate_i st = progress \\ Map.empty \\ (plen \\)\" \"wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\"\n unfolding wf_mstate_def by blast+\n moreover from meval[OF \\wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\\ wf_envs_mk_db] obtain Vs st' where\n \"meval (mstate_n st) (\\ \\ (plen \\)) (mk_db (\\ \\ (plen \\))) (mstate_m st) = (Vs, st')\"\n \"wf_mformula \\ (Suc (plen \\)) Map.empty Map.empty (mstate_n st) R st' \\\"\n \"list_all2 (\\i. qtable (mstate_n st) (fv \\) (mem_restr R) (\\v. Formula.sat \\ Map.empty (map the v) i \\))\n [progress \\ Map.empty \\ (plen \\).. Map.empty \\ (Suc (plen \\))] Vs\" by blast\n moreover from this assms(4) have \"qtable (mstate_n st) (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ Map.empty (map the v) i \\) (Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"\n if \"progress \\ Map.empty \\ (plen \\) \\ i\" \"i < progress \\ Map.empty \\ (Suc (plen \\))\"\n using that by (auto simp: list_all2_conv_all_nth\n dest!: spec[of _ \"(i - progress \\ Map.empty \\ (plen \\))\"])\n ultimately show ?thesis\n using assms(4) unfolding mstep_def Let_def flatten_verdicts_def\n by (auto simp: in_set_enumerate_eq list_all2_conv_all_nth progress_mono le_imp_diff_is_add\n elim!: in_qtableE in_qtableI intro!: bexI[of _ \"(i, Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"])\nqed\n\n\nsubsubsection \\Monitor function\\\n\ncontext maux\nbegin\n\ndefinition minit_safe where\n \"minit_safe \\ = (if mmonitorable_exec \\ then minit \\ else undefined)\"\n\nlemma minit_safe_minit: \"mmonitorable \\ \\ minit_safe \\ = minit \\\"\n unfolding minit_safe_def monitorable_formula_code by simp\n\nlemma mstep_mverdicts:\n assumes wf: \"wf_mstate \\ \\ R st\"\n and le[simp]: \"last_ts \\ \\ snd tdb\"\n and restrict: \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n (i, v) \\ mverdicts \\ (psnoc \\ tdb) - mverdicts \\ \\\"\nproof -\n obtain \\ where p2: \"prefix_of (psnoc \\ tdb) \\\"\n using ex_prefix_of by blast\n with le have p1: \"prefix_of \\ \\\" by (blast elim!: prefix_of_psnocE)\n show ?thesis\n unfolding verimon.verdicts_def\n by (auto 0 3 simp: p2 progress_prefix_conv[OF _ p1] sat_prefix_conv[OF _ p1] not_less\n dest: mstep_output_iff[OF wf le p2 restrict, THEN iffD1] spec[of _ \\]\n mstep_output_iff[OF wf le _ restrict, THEN iffD1] verimon.progress_sat_cong[OF p1]\n intro: mstep_output_iff[OF wf le p2 restrict, THEN iffD2] p1)\nqed\n\nprimrec msteps0 where\n \"msteps0 [] st = ([], st)\"\n| \"msteps0 (tdb # \\) st =\n (let (V', st') = mstep (map_prod mk_db id tdb) st; (V'', st'') = msteps0 \\ st' in (V' @ V'', st''))\"\n\nprimrec msteps0_stateless where\n \"msteps0_stateless [] st = []\"\n| \"msteps0_stateless (tdb # \\) st = (let (V', st') = mstep (map_prod mk_db id tdb) st in V' @ msteps0_stateless \\ st')\"\n\nlemma msteps0_msteps0_stateless: \"fst (msteps0 w st) = msteps0_stateless w st\"\n by (induct w arbitrary: st) (auto simp: split_beta)\n\nlift_definition msteps :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\"\n is msteps0 .\n\nlift_definition msteps_stateless :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list\"\n is msteps0_stateless .\n\nlemma msteps_msteps_stateless: \"fst (msteps w st) = msteps_stateless w st\"\n by transfer (rule msteps0_msteps0_stateless)\n\nlemma msteps0_snoc: \"msteps0 (\\ @ [tdb]) st =\n (let (V', st') = msteps0 \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by (induct \\ arbitrary: st) (auto split: prod.splits)\n\nlemma msteps_psnoc: \"last_ts \\ \\ snd tdb \\ msteps (psnoc \\ tdb) st =\n (let (V', st') = msteps \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by transfer' (auto simp: msteps0_snoc split: list.splits prod.splits if_splits)\n\ndefinition monitor where\n \"monitor \\ \\ = msteps_stateless \\ (minit_safe \\)\"\n\nlemma Suc_length_conv_snoc: \"(Suc n = length xs) = (\\y ys. xs = ys @ [y] \\ length ys = n)\"\n by (cases xs rule: rev_cases) auto\n\nlemma wf_mstate_msteps: \"wf_mstate \\ \\ R st \\ mem_restr R v \\ \\ \\ \\' \\\n X = msteps (pdrop (plen \\) \\') st \\ wf_mstate \\ \\' R (snd X) \\\n ((i, v) \\ flatten_verdicts (fst X)) = ((i, v) \\ mverdicts \\ \\' - mverdicts \\ \\)\"\nproof (induct \"plen \\' - plen \\\" arbitrary: X st \\ \\')\n case 0\n from 0(1,4,5) have \"\\ = \\'\" \"X = ([], st)\"\n by (transfer; auto)+\n with 0(2) show ?case unfolding flatten_verdicts_def by simp\nnext\n case (Suc x)\n from Suc(2,5) obtain \\'' tdb where \"x = plen \\'' - plen \\\" \"\\ \\ \\''\"\n \"\\' = psnoc \\'' tdb\" \"pdrop (plen \\) (psnoc \\'' tdb) = psnoc (pdrop (plen \\) \\'') tdb\"\n \"last_ts (pdrop (plen \\) \\'') \\ snd tdb\" \"last_ts \\'' \\ snd tdb\"\n \"\\'' \\ psnoc \\'' tdb\"\n proof (atomize_elim, transfer, elim exE, goal_cases prefix)\n case (prefix _ _ \\' _ \\_tdb)\n then show ?case\n proof (cases \\_tdb rule: rev_cases)\n case (snoc \\ tdb)\n with prefix show ?thesis\n by (intro bexI[of _ \"\\' @ \\\"] exI[of _ tdb])\n (force simp: sorted_append append_eq_Cons_conv split: list.splits if_splits)+\n qed simp\n qed\n with Suc(1)[OF this(1) Suc.prems(1,2) this(2) refl] Suc.prems show ?case\n unfolding msteps_msteps_stateless[symmetric]\n by (auto simp: msteps_psnoc split_beta mstep_mverdicts\n dest: verimon.verdicts_mono[THEN set_mp, rotated] intro!: wf_mstate_mstep)\nqed\n\nlemma wf_mstate_msteps_stateless:\n assumes \"wf_mstate \\ \\ R st\" \"mem_restr R v\" \"\\ \\ \\'\"\n shows \"(i, v) \\ flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) \\ (i, v) \\ mverdicts \\ \\' - mverdicts \\ \\\"\n using wf_mstate_msteps[OF assms refl] unfolding msteps_msteps_stateless by simp\n\nlemma wf_mstate_msteps_stateless_UNIV: \"wf_mstate \\ \\ UNIV st \\ \\ \\ \\' \\\n flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) = mverdicts \\ \\' - mverdicts \\ \\\"\n by (auto dest: wf_mstate_msteps_stateless[OF _ mem_restr_UNIV])\n\nlemma mverdicts_Nil: \"mverdicts \\ pnil = {}\"\n unfolding verimon.verdicts_def\n by (auto intro: ex_prefix_of)\n\nlemma wf_mstate_minit_safe: \"mmonitorable \\ \\ wf_mstate \\ pnil R (minit_safe \\)\"\n using wf_mstate_minit minit_safe_minit mmonitorable_def by metis\n\nlemma monitor_mverdicts: \"mmonitorable \\ \\ flatten_verdicts (monitor \\ \\) = mverdicts \\ \\\"\n unfolding monitor_def\n by (subst wf_mstate_msteps_stateless_UNIV[OF wf_mstate_minit_safe, simplified])\n (auto simp: mmonitorable_def mverdicts_Nil)\n\nsubsection \\Collected correctness results\\\n\ntext \\We summarize the main results proved above.\n\\begin{enumerate}\n\\item The term @{term mverdicts} describes semantically the monitor's expected behaviour:\n\\begin{itemize}\n\\item @{thm[source] verimon.mono_monitor}: @{thm verimon.mono_monitor[no_vars]}\n\\item @{thm[source] verimon.sound_monitor}: @{thm verimon.sound_monitor[no_vars]}\n\\item @{thm[source] verimon.complete_monitor}: @{thm verimon.complete_monitor[no_vars]}\n\\item @{thm[source] verimon.monitor_slice}: @{thm verimon.monitor_slice[no_vars]}\n\\end{itemize}\n\\item The executable monitor's online interface @{term minit_safe} and @{term mstep}\n preserves the invariant @{term wf_mstate} and produces the the verdicts according\n to @{term mverdicts}:\n\\begin{itemize}\n\\item @{thm[source] wf_mstate_minit_safe}: @{thm wf_mstate_minit_safe[no_vars]}\n\\item @{thm[source] wf_mstate_mstep}: @{thm wf_mstate_mstep[no_vars]}\n\\item @{thm[source] mstep_mverdicts}: @{thm mstep_mverdicts[no_vars]}\n\\end{itemize}\n\\item The executable monitor's offline interface @{term monitor} implements @{term mverdicts}:\n\\begin{itemize}\n\\item @{thm[source] monitor_mverdicts}: @{thm monitor_mverdicts[no_vars]}\n\\end{itemize}\n\\end{enumerate}\n\\\n\nend \\ \\context @{locale maux}\\\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/MFODL_Monitor_Optimized/Monitor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.292714072520862}} {"text": "theory LiarsStreet (*Christoph Benzmüller, 2020*)\n imports Main \n\n(*\nabbrevs \n Nilda=\"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a\" and Nilda=\"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a\" and And=\"( \\<^bold>a\\<^bold>n\\<^bold>d )\" and Or=\"( \\<^bold>o\\<^bold>r )\" and Not=\"(\\<^bold>n\\<^bold>o\\<^bold>t )\" and If_then=\"(\\<^bold>I\\<^bold>f \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n )\"\n and LiarsStreet=\"\\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t\" and TruthtellersRoad=\"\\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d\" and Lies=\"\\<^bold>(l\\<^bold>i\\<^bold>e\\<^bold>s )\"\n and Says_the_truth=\"(\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h )\" and Lives_not_in=\"( \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n )\" \n and Neither_nor_live_in=\"( \\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r \\<^bold>n\\<^bold>o\\<^bold>r \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n )\" and Both_live_in=\"( \\<^bold>\\<^bold>b\\<^bold>o\\<^bold>t\\<^bold>h \\<^bold>a\\<^bold>n\\<^bold>d \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n )\" \n*)\n\nbegin \n(*unimportant*) nitpick_params [user_axioms,format=2,show_all]\n(*unimportant*) declare [[show_abbrevs=false]]\n\n(***********************************************************************************\n ****************** Some Basic Types of our Ontology ******************************\n ***********************************************************************************)\n(* There are some kids, could be many more *)\ndatatype Entity = Nilda (\"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a\") | Carla (\"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a\")\nprint_theorems\n\nlemma \"\\(\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a = \\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a)\" sledgehammer by simp\n\n(* There are some roads, could be many more *)\ndatatype Street = LiarsStreet (\"\\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t\") | TruthtellersRoad (\"\\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d\") \n\n(***********************************************************************************\n ****************** Controlled Natural Language Library ***************************\n ****************** Logic and Modalities ******************************************\n ***********************************************************************************)\n\ndefinition And (\"_ \\<^bold>a\\<^bold>n\\<^bold>d _\") where \"X \\<^bold>a\\<^bold>n\\<^bold>d Y \\ X \\ Y\"\nabbreviation Or (\"_ \\<^bold>o\\<^bold>r _\") where \"X \\<^bold>o\\<^bold>r Y \\ X \\ Y\"\ndefinition Not (\"\\<^bold>n\\<^bold>o\\<^bold>t _\") where \"\\<^bold>n\\<^bold>o\\<^bold>t X \\ \\X\"\ndefinition If_then (\"\\<^bold>I\\<^bold>f _ \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n _\") where \"\\<^bold>I\\<^bold>f X \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n Y \\ X \\ Y\"\n\n\n(* \"Says\" \"Knows\" \"Belief\" \"Obligation\", etc. as uninterpreted truth-functions\n --- which, of course, will lead to known paradoxes *)\nconsts Says::\"Entity\\bool\\bool\" (\"_ \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s _\") \nconsts Knows::\"Entity\\bool\\bool\" (\"_ \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s _\") \nconsts Believes::\"Entity\\bool\\bool\" (\"_ \\<^bold>b\\<^bold>e\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>v\\<^bold>e\\<^bold>s _\") \nconsts Obligation::\"Entity\\bool\\bool\" (\"_ \\<^bold>m\\<^bold>u\\<^bold>s\\<^bold>t\\<^bold>-\\<^bold>d\\<^bold>o _\") \n\n(* We can introduce some further derived modal NL phrases *)\ndefinition Lies (\"\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s _\") where \"\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s X \\ \\Y. \\<^bold>I\\<^bold>f (X \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s Y) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n \\<^bold>n\\<^bold>o\\<^bold>t Y\"\ndefinition Says_the_truth (\"\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h _\") \n where \"\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h X \\ \\Y. \\<^bold>I\\<^bold>f (X \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s Y) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n Y\" \n\n(* We add the above defintions to our \"bag\" called \"Defs\" — Unimportant *)\nnamed_theorems Defs\ndeclare Lies_def [Defs] Says_the_truth_def [Defs] \n\n\n(***********************************************************************************\n ****************** Controlled Natural Language Library ****************************\n ****************** Domain specific concepts ***************************************\n ***********************************************************************************)\n\n(* Uninterpreted predicate: Lives_in *)\nconsts Lives_in::\"Entity\\Street\\bool\" (\"_ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n _\") \n\n(* Further derived NL phrases that concern \"Lives_in\" *)\ndefinition Lives_not_in (\"_ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n _\")\n where \"X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n G \\ \\<^bold>n\\<^bold>o\\<^bold>t (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)\"\ndefinition Neither_nor_live_in (\"\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r _ \\<^bold>n\\<^bold>o\\<^bold>r _ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n _\") \n where \"\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r X \\<^bold>n\\<^bold>o\\<^bold>r Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n G \\ (\\<^bold>n\\<^bold>o\\<^bold>t (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>n\\<^bold>o\\<^bold>t (Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G))\"\ndefinition Both_live_in (\"\\<^bold>b\\<^bold>o\\<^bold>t\\<^bold>h _ \\<^bold>a\\<^bold>n\\<^bold>d _ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n _\") \n where \"\\<^bold>b\\<^bold>o\\<^bold>t\\<^bold>h X \\<^bold>a\\<^bold>n\\<^bold>d Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n G \\ (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G) \\<^bold>a\\<^bold>n\\<^bold>d (Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)\"\n\n(* We add the above defintions to our \"bag\" called \"Defs\" — Unimportant *)\ndeclare Lives_not_in_def [Defs] Neither_nor_live_in_def [Defs] Both_live_in_def [Defs] \n\n\n(***********************************************************************************\n ****************** Example Queries ************************************************\n ***********************************************************************************)\n\naxiomatization where\nA1: \"\\X. \\<^bold>I\\<^bold>f (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n (\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s X)\" and\nA2: \"\\X. \\<^bold>I\\<^bold>f (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n (\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h X)\" \n\n\nlemma Question1:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops \n\n\n\nlemma Question1b:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops \n\nlemma Question2:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r \\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>n\\<^bold>o\\<^bold>r \\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops\n\nlemma Question3:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops\n\n(*** Do we run into Paradoxes with the modelling of modalities? ***)\n\nconsts It_holds_that_One_plus_One_Equals_Two::bool\n It_holds_that_Fermats_last_Theorem_is_True::bool\n\n\n\nlemma Question8:\n assumes\n \"It_holds_that_One_plus_One_Equals_Two\" \n \"It_holds_that_Fermats_last_Theorem_is_True\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s It_holds_that_One_plus_One_Equals_Two\"\n shows\n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s It_holds_that_Fermats_last_Theorem_is_True\" \n using assms(1) assms(2) assms(3) by auto\n\n\nlemma Question9:\n assumes\n \"It_holds_that_One_plus_One_Equals_Two\" \n \"It_holds_that_Fermats_last_Theorem_is_True\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s It_holds_that_One_plus_One_Equals_Two\"\n shows\n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s It_holds_that_Fermats_last_Theorem_is_True\" \n sledgehammer [verbose](assms)\n nitpick oops\n\nend", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/CoursesAndTutorials/2022-Bamberg/LiarsStreet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2925942007574071}} {"text": "header {* Compositional Reasoning *}\n\n(*<*)\ntheory Compositional_Reasoning\nimports BD_Security\nbegin\n(*>*)\n\n\ncontext BD_Security begin\n\n\nsubsection{* Preliminaries *}\n\ndefinition \"disjAll \\s s vl s1 vl1 \\ (\\\\ \\ \\s. \\ s vl s1 vl1)\"\n\nlemma disjAll_simps[simp]:\n \"disjAll {} \\ \\_ _ _ _. False\"\n \"disjAll (insert \\ \\s) \\ \\s vl s1 vl1. \\ s vl s1 vl1 \\ disjAll \\s s vl s1 vl1\"\n unfolding disjAll_def[abs_def] by auto\n\n\nlemma iaction_mono:\nassumes 1: \"iaction \\ s vl s1 vl1\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"iaction \\' s vl s1 vl1\"\nproof-\n obtain a1 ou1 s1' vl1'\n where \"step s1 a1 = (ou1, s1')\" and \"\\ (Trans s1 a1 ou1 s1')\"\n and \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\" and \"\\ \\ (Trans s1 a1 ou1 s1')\"\n and \"\\ s vl s1' vl1'\" using 1 unfolding iaction_def by auto\n thus ?thesis unfolding iaction_def using 2 apply -\n by (rule exI[of _ a1], rule exI[of _ ou1], rule exI[of _ s1'], rule exI[of _ vl1']) auto\nqed\n\nlemma match_mono:\nassumes 1: \"match \\ s s1 vl1 a ou s' vl'\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"match \\' s s1 vl1 a ou s' vl'\"\nproof-\n obtain a1 ou1 s1' vl1'\n where \"\\ s' vl' s1' vl1'\"\n and \"step s1 a1 = (ou1, s1')\"\n and \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\"\n and \"\\ (Trans s a ou s') = \\ (Trans s1 a1 ou1 s1')\"\n and \"(\\ (Trans s a ou s') \\ g (Trans s a ou s') = g (Trans s1 a1 ou1 s1'))\"\n using 1 unfolding match_def by auto\n thus ?thesis unfolding match_def using 2 apply -\n by (rule exI[of _ a1], rule exI[of _ ou1], rule exI[of _ s1'], rule exI[of _ vl1']) auto\nqed\n\nlemma ignore_mono:\nassumes 1: \"ignore \\ s s1 vl1 a ou s' vl'\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"ignore \\' s s1 vl1 a ou s' vl'\"\nusing assms unfolding ignore_def by auto\n\nlemma reaction_mono:\nassumes 1: \"reaction \\ s vl s1 vl1\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"reaction \\' s vl s1 vl1\"\nproof\n fix a ou s' vl'\n assume \"step s a = (ou, s')\" and \"\\ T (Trans s a ou s')\" and \"consume (Trans s a ou s') vl vl'\"\n hence \"match \\ s s1 vl1 a ou s' vl' \\ ignore \\ s s1 vl1 a ou s' vl'\" (is \"?m \\ ?i\")\n using 1 unfolding reaction_def by auto\n thus \"match \\' s s1 vl1 a ou s' vl' \\ ignore \\' s s1 vl1 a ou s' vl'\" (is \"?m' \\ ?i'\")\n proof\n assume ?m from match_mono[OF this 2] show ?thesis by simp\n next\n assume ?i from ignore_mono[OF this 2] show ?thesis by simp\n qed\nqed\n\n\nsubsection{* Decomposition into an arbitrary network of components *}\n\n(* Unwind not to itself, but to a disjunction of other relations: *)\ndefinition unwind_to where\n\"unwind_to \\ \\s \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\ s vl s1 vl1\n \\\n vl \\ [] \\ exit s (hd vl)\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n (vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1\"\n\nlemma unwind_toI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\ s vl s1 vl1\\\n \\\n vl \\ [] \\ exit s (hd vl)\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n (vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1\"\nshows \"unwind_to \\ \\s\"\nusing assms unfolding unwind_to_def by auto\n\n(* Decomposition: *)\nlemma unwind_dec:\nassumes ne: \"\\ \\. \\ \\ \\s \\ next \\ \\ \\s \\ unwind_to \\ (next \\)\"\nshows \"unwind (disjAll \\s)\" (is \"unwind ?\\\")\nproof\n fix s s1 :: 'state and vl vl1 :: \"'value list\"\n assume r: \"reachNT s\" \"reach s1\" and \\: \"?\\ s vl s1 vl1\"\n then obtain \\ where \\: \"\\ \\ \\s\" and 2: \"\\ s vl s1 vl1\" unfolding disjAll_def by auto\n let ?\\s' = \"next \\\" let ?\\' = \"disjAll ?\\s'\"\n have \"(vl \\ [] \\ exit s (hd vl)) \\\n iaction ?\\' s vl s1 vl1 \\\n ((vl \\ [] \\ vl1 = []) \\ reaction ?\\' s vl s1 vl1)\"\n using 2 \\ ne r unfolding unwind_to_def by auto\n moreover have \"\\ s vl s1 vl1. ?\\' s vl s1 vl1 \\ ?\\ s vl s1 vl1\"\n using ne[OF \\] unfolding disjAll_def by auto\n ultimately show\n \"(vl \\ [] \\ exit s (hd vl)) \\\n iaction ?\\ s vl s1 vl1 \\\n ((vl \\ [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\"\n using iaction_mono[of ?\\' _ _ _ _ ?\\] reaction_mono[of ?\\' _ _ _ _ ?\\] by blast\nqed\n\nlemma init_dec:\nassumes \\0: \"\\0 \\ \\s\"\nand i: \"\\ vl vl1. B vl vl1 \\ \\0 istate vl istate vl1\"\nshows \"\\ vl vl1. B vl vl1 \\ disjAll \\s istate vl istate vl1\"\nusing assms unfolding disjAll_def by auto\n\ntheorem unwind_dec_secure:\nassumes \\0: \"\\0 \\ \\s\"\nand i: \"\\ vl vl1. B vl vl1 \\ \\0 istate vl istate vl1\"\nand ne: \"\\ \\. \\ \\ \\s \\ next \\ \\ \\s \\ unwind_to \\ (next \\)\"\nshows secure\nusing init_dec[OF \\0 i] unwind_dec[OF ne] unwind_secure by metis\n\n\nsubsection{* A customization for linear modular reasoning *}\n\n(* The customization assumes that each component unwinds only into itself,\nits successor or an exit component. *)\n\ndefinition unwind_cont where\n\"unwind_cont \\ \\s \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\ s vl s1 vl1\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n ((vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1)\"\n\nlemma unwind_contI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\ s vl s1 vl1\\\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n ((vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1)\"\nshows \"unwind_cont \\ \\s\"\nusing assms unfolding unwind_cont_def by auto\n\ndefinition unwind_exit where\n\"unwind_exit \\e \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\e s vl s1 vl1\n \\\n vl \\ [] \\ exit s (hd vl)\"\n\nlemma unwind_exitI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\e s vl s1 vl1\\\n \\\n vl \\ [] \\ exit s (hd vl)\"\nshows \"unwind_exit \\e\"\nusing assms unfolding unwind_exit_def by auto\n\nfun allConsec :: \"'a list \\ ('a * 'a) set\" where\n \"allConsec [] = {}\"\n| \"allConsec [a] = {}\"\n| \"allConsec (a # b # as) = insert (a,b) (allConsec (b#as))\"\n\n\nlemma set_allConsec:\nassumes \"\\ \\ set \\s'\" and \"\\s = \\s' ## \\1\"\nshows \"\\ \\2. (\\,\\2) \\ allConsec \\s\"\nusing assms proof (induction \\s' arbitrary: \\s)\n case Nil thus ?case by auto\nnext\n case (Cons \\3 \\s' \\s)\n show ?case proof(cases \"\\ = \\3\")\n case True\n show ?thesis proof(cases \\s')\n case Nil\n show ?thesis unfolding `\\s = (\\3 # \\s') ## \\1` Nil True by (rule exI[of _ \\1]) simp\n next\n case (Cons \\4 \\s'')\n show ?thesis unfolding `\\s = (\\3 # \\s') ## \\1` Cons True by (rule exI[of _ \\4]) simp\n qed\n next\n case False hence \"\\ \\ set \\s'\" using Cons by auto\n then obtain \\2 where \"(\\, \\2) \\ allConsec (\\s' ## \\1)\" using Cons by auto\n thus ?thesis unfolding `\\s = (\\3 # \\s') ## \\1` by (intro exI[of _ \\2]) (cases \\s', auto)\n qed\nqed\n\nlemma allConsec_set:\nassumes \"(\\1,\\2) \\ allConsec \\s\"\nshows \"\\1 \\ set \\s \\ \\2 \\ set \\s\"\nusing assms by (induct \\s rule: allConsec.induct) auto\n\n(* Liniar decomposition: *)\ntheorem unwind_decomp_secure:\nassumes n: \"\\s \\ []\"\nand i: \"\\ vl vl1. B vl vl1 \\ hd \\s istate vl istate vl1\"\nand c: \"\\ \\1 \\2. (\\1,\\2) \\ allConsec \\s \\ unwind_cont \\1 {\\1, \\2, \\e}\"\nand l: \"unwind_cont (last \\s) {last \\s, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\nproof-\n let ?\\0 = \"hd \\s\" let ?\\s = \"insert \\e (set \\s)\"\n def \"next\" \\\n \"\\ \\1.\n if \\1 = \\e then {}\n else if \\1 = last \\s then {\\1,\\e}\n else {\\1,SOME \\2. (\\1,\\2) \\ allConsec \\s,\\e}\"\n show ?thesis\n proof(rule unwind_dec_secure)\n show \"?\\0 \\ ?\\s\" using n by auto\n next\n fix vl vl1 assume \"B vl vl1\"\n thus \"?\\0 istate vl istate vl1\" by fact\n next\n fix \\\n assume 1: \"\\ \\ ?\\s\" show \"next \\ \\ ?\\s \\ unwind_to \\ (next \\)\"\n proof-\n {assume \"\\ = \\e\"\n hence ?thesis using e unfolding next_def unwind_exit_def unwind_to_def by auto\n }\n moreover\n {assume \"\\ = last \\s\" and \"\\ \\ \\e\"\n hence ?thesis using n l unfolding next_def unwind_cont_def unwind_to_def by simp\n }\n moreover\n {assume 1: \"\\ \\ set \\s\" and 2: \"\\ \\ last \\s\" \"\\ \\ \\e\"\n then obtain \\' \\s' where \\s: \"\\s = \\s' ## \\'\" and \\: \"\\ \\ set \\s'\"\n by (metis (no_types) append_Cons append_assoc in_set_conv_decomp last_snoc rev_exhaust)\n have \"\\ \\2. (\\, \\2) \\ allConsec \\s\" using set_allConsec[OF \\ \\s] .\n hence \"(\\, SOME \\2. (\\, \\2) \\ allConsec \\s) \\ allConsec \\s\" by (metis (lifting) someI_ex)\n hence ?thesis using 1 2 c unfolding next_def unwind_cont_def unwind_to_def\n by simp (metis (no_types) allConsec_set)\n }\n ultimately show ?thesis using 1 by blast\n qed\n qed\nqed\n\nsubsection{* Instances *}\n\ncorollary unwind_decomp3_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand l: \"unwind_cont \\3 {\\3, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3]\" \\e])\nusing assms by auto\n\ncorollary unwind_decomp4_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand c3: \"unwind_cont \\3 {\\3, \\4, \\e}\"\nand l: \"unwind_cont \\4 {\\4, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3, \\4]\" \\e])\nusing assms by auto\n\ncorollary unwind_decomp5_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand c3: \"unwind_cont \\3 {\\3, \\4, \\e}\"\nand c4: \"unwind_cont \\4 {\\4, \\5, \\e}\"\nand l: \"unwind_cont \\5 {\\5, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3, \\4, \\5]\" \\e])\nusing assms by auto\n\n\n\n\n(*<*)\n\nend (* context BD_Security *)\n\n\nend\n\n(*>*)", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Bounded_Deducibility_Security/Compositional_Reasoning.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.29255872599718435}} {"text": "\nsection \"Auxiliary algebraic laws for abrupt designs\"\ntheory algebraic_laws_fault_aux\nimports \"../../../theories/Fault/utp_fault_designs\"\n \nbegin\nnamed_theorems uflt_simpl and uflt_cond and uflt_comp and uflt_lens\nsubsection {*THM setup*}\ndeclare design_condr[urel_cond] \n\n\nsubsection {*abrupt alphabet behavior*}\n\nlemma assigns_flt_alpha:\n \"(fault :== (\\ &fault)) = (\\II\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $fault\\ =\\<^sub>u (\\$fault) \\ $ok =\\<^sub>u $ok\\)\"\n \"(ok :== (\\ &ok)) = (\\II\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $fault\\ =\\<^sub>u $fault \\ $ok =\\<^sub>u (\\$ok\\))\"\n by rel_auto+\n\nlemma vwb_of_fault[simp]: \n \"vwb_lens ok\" \"vwb_lens fault\"\n by simp_all\n\nlemma unrest_pre_out\\_flt[unrest]: \"out\\ \\ \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub><\"\n by (transfer, auto simp add: out\\_def lens_prod_def)\n \nlemma unrest_post_in\\_flt[unrest]: \"in\\ \\ \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>>\"\n by (transfer, auto simp add: in\\_def lens_prod_def)\n\nlemma unrest_ok_fault_rel_uexpr_lift_cpf[unrest]:\n \"$ok \\ \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\" \"$ok\\ \\ \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n \"$fault \\ \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\" \"$fault\\ \\ \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (pred_auto)+\n\nlemma unrest_ok_fault_rel_usubst_lift_cpf[unrest]:\n \"$ok\\ \\ \\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T\" \"$ok \\ \\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T\"\n \"$fault\\ \\ \\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T\" \"$fault \\ \\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T\" \n by rel_auto+\n\nlemma unrest_in_out_rel_ok_fault_res_flt [unrest]:\n \"$ok \\ (P \\\\<^sub>\\ ok)\" \"$ok\\ \\ (P \\\\<^sub>\\ ok)\" \n \"$fault \\ (P \\\\<^sub>\\ fault)\" \"$fault\\ \\ (P \\\\<^sub>\\ fault)\"\n by (simp_all add: rel_var_res_def unrest)\n\nlemma uflt_alphabet_unrest[unrest]:(*FIXEME:These laws should be generated automatically by alphabet backend since all the fields of alphabet are independant*)\n \"$ok\\ \\ $fault\\\" \"$ok \\ $fault\"\n \"$ok\\ \\ $x\" \"$ok \\ $fault\\\"\n \"$fault\\ \\ $ok\\\" \"$fault \\ $ok \"\n \"$fault \\ $ok\\\" \"$fault\\ \\ $x\"\n by pred_simp+\n\nlemma cpf_ord [usubst]:\n \"$ok \\\\<^sub>v $ok\\\" \"$abrupt \\\\<^sub>v $abrupt\\\" \"$ok \\\\<^sub>v $abrupt\\\" \n \"$ok \\\\<^sub>v $abrupt\" \"$ok\\ \\\\<^sub>v $abrupt\\\" \"$ok\\ \\\\<^sub>v $abrupt\" \n by (simp_all add: var_name_ord_def)\n\nlemma rel_usubst_lift_cpf_in_out_fault_ok[usubst]:\n \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ $fault = $fault\" \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\$fault) = (\\$fault)\"\n \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ ($ok) = ($ok)\" \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\$ok) = (\\$ok)\" \n \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ ($fault\\) = (($fault\\))\" \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\$fault\\) = (\\$fault\\)\"\n \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ ($ok\\) = ($ok\\)\" \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\$ok\\) = (\\$ok\\)\" \n by (simp_all add: usubst unrest)\n\nlemma abrupt_ok_simpl[uflt_comp]:\n \"($fault ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = $fault\" \"(\\$ok ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = (\\$ok)\" \n \"($fault ;; (P \\ Q)) = $fault\" \"(\\$ok ;; (P \\ Q)) = (\\$ok)\"\n \"(\\$fault ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = (\\$fault)\" \"(\\$ok ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = (\\$ok)\" \n \"(\\$fault ;; (P \\ Q)) = (\\$fault)\" \"(\\$ok ;; (P \\ Q)) = (\\$ok)\"\n \"($fault\\ ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = $fault\\\" \n \"(\\$fault\\ ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T P) = (\\$fault\\)\" \n by rel_auto+\n\nlemma simpl_flt_in_ok:\n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T ($ok) = ((\\$fault \\ ($ok \\$ok\\)) \\ (II))\" \n by rel_auto\n\nlemma simpl_flt_our_ok:\n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T ($ok\\) = ((\\$fault \\ ($ok \\$ok\\)) \\ (II))\" \n by rel_auto\n\nlemma simpl_flt_in_abrupt:\n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T ($fault) = ((\\$fault \\ ($ok \\($ok\\ \\ $fault))) \\ ($fault \\ II))\" \n by rel_auto\n\nlemma simpl_flt_alt_def:\n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T (P) = ((\\$fault \\ ($ok \\($ok\\ \\ P))) \\ ($fault \\ II))\" \n by rel_auto\n\nsubsection {*Healthiness condition behavior*}\n\nlemma rel_usubst_cpf_c3_flt[usubst]: \n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \"\\ \\ C3_flt(P) = (\\ \\ P \\ \\ \\ (\\$fault) \\ (\\ \\ II))\"\n using assms unfolding C3_flt_def \n by (simp add: usubst) \n\nlemma Simpl_flt_idem[simp]: \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P)) = Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P)\"\n by (rel_auto)\n\nlemma simpl_flt_Idempotent: \"Idempotent Simpl\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (simp add: Idempotent_def)\n\nlemma Simpl_flt_mono: \"P \\ Q \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(Q)\"\n by (rel_auto)\n\nlemma simpl_flt_Monotonic: \"Monotonic Simpl\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (simp add: Monotonic_def Simpl_flt_mono)\n\nlemma simpl_flt_def: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) = ((\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ P) \\ \\$fault \\ II)\"\n unfolding C3_flt_def ..\n\nlemma simpl_flt_condr[uflt_simpl]: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P \\ b \\ Q) = (Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) \\ b \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(Q))\"\n unfolding simpl_flt_def \n by (simp add: urel_cond)\n\nlemma simpl_abr_skip_abr[uflt_simpl]: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (SKIP\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by (simp add: urel_cond urel_defs) \n \nlemma simpl_flt_assign_flt[uflt_simpl]: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(\\\\\\\\<^sub>F\\<^sub>L\\<^sub>T) = (\\\\\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by (simp add: urel_cond urel_defs)\n\nlemma simpl_flt_form: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) = (((\\$fault) \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (P))) \\ ($fault \\ II))\"\n by rel_auto \n\nlemma abrupt_simpl_flt[uflt_simpl]:\n \"($fault \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P)) = ($fault \\II)\"\n by rel_auto\n\nlemma nabrupt_simpl_flt[uflt_simpl]:\n \"(\\$fault \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P)) = (\\$fault \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (P)))\"\n by (rel_auto)\n\ndefinition design_flt_sup :: \"('\\,'\\) rel_cpf set \\ ('\\,'\\) rel_cpf\" (\"\\\\<^sub>F\\<^sub>L\\<^sub>T_\" [900] 900) where\n\"\\\\<^sub>F\\<^sub>L\\<^sub>T A = (if (A = {}) then \\\\<^sub>F\\<^sub>L\\<^sub>T else \\ A)\"\n\nlemma simpl_flt_Continuous: \"Continuous Simpl\\<^sub>F\\<^sub>L\\<^sub>T\"\n unfolding Continuous_def SUP_def apply rel_simp\n unfolding SUP_def \n apply transfer apply auto \ndone\n\nlemma simpl_flt_R3_conj: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P \\ Q) = (Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(Q))\"\n by (rel_auto)\n\nlemma simpl_flt_disj: \n \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P \\ Q) = (Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(Q))\"\n by (rel_auto)\n\nlemma Simpl_flt_USUP:\n assumes \"A \\ {}\"\n shows \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P(i)))\"\n using assms by (rel_auto)\n\nlemma design_flt_sup_non_empty [simp]: \n \"A \\ {} \\ \\\\<^sub>F\\<^sub>L\\<^sub>T A = \\ A\"\n by (simp add: design_flt_sup_def)\n\nsubsection {*Signature behavior*}\n\nlemma design_top_flt:\n \"(P \\ Q) \\ \\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (rel_auto)\n\nlemma design_flt_sup_empty [simp]: \n \"\\\\<^sub>F\\<^sub>L\\<^sub>T {} = \\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (simp add: design_flt_sup_def)\n\n\nabbreviation design_inf :: \"('\\, '\\) rel_des set \\ ('\\, '\\) rel_des\" (\"\\\\<^sub>F\\<^sub>L\\<^sub>T_\" [900] 900) where\n\"\\\\<^sub>F\\<^sub>L\\<^sub>T A \\ \\ A\"\n\nlemma design_bottom_flt:\n \"\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (P \\ Q)\"\n by simp\n\nlemma Simpl_flt_UINF:\n assumes \"A \\ {}\"\n shows \"Simpl\\<^sub>F\\<^sub>L\\<^sub>T(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P(i)))\"\n using assms by (rel_auto)\n\nlemma skip_cpf_def:\n \"II = (\\II\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $fault =\\<^sub>u $fault\\ \\ $ok =\\<^sub>u $ok\\)\" \n by rel_auto\n\nlemma skip_lift_flt_def:\n \"\\II\\\\<^sub>F\\<^sub>L\\<^sub>T = ($\\\\<^sub>F\\<^sub>L\\<^sub>T\\ =\\<^sub>u $\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma seqr_fault_true [usubst]: \n \"(P ;; Q) \\<^sub>f\\<^sub>t = (P \\<^sub>f\\<^sub>t ;; Q)\"\n by (rel_auto)\n\nlemma seqr_fault_false [usubst]: \n \"(P ;; Q) \\<^sub>f\\<^sub>f = (P \\<^sub>f\\<^sub>f ;; Q)\"\n by (rel_auto)\n\nlemma rel_usubst_lift_cpf_uexpr_lift_cpf[usubst]:\n \"\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ \\P\\\\<^sub>F\\<^sub>L\\<^sub>T = \\\\ \\ P\\\\<^sub>F\\<^sub>L\\<^sub>T\" \n by rel_auto\n\nlemma usubst_lift_cpf_assigns_lift_cpf [usubst]:\n \"\\\\\\\\<^sub>s\\<^sub>F\\<^sub>L\\<^sub>T \\ \\\\\\\\\\<^sub>a\\\\<^sub>F\\<^sub>L\\<^sub>T = \\\\\\ \\ \\\\\\<^sub>a\\\\<^sub>F\\<^sub>L\\<^sub>T\" \n by (simp add: usubst)\n\nlemma usubst_lift_cpf_pre_uexpr_lift_cpf[usubst]:\n \"\\\\\\\\<^sub>s\\<^sub>F\\<^sub>L\\<^sub>T \\ \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>< = \\\\ \\ b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub><\" \n by (simp add: usubst)\n\nlemma rel_usubst_lift_cpf_design[usubst]: \n \"(\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ (Q \\ P)) = (\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ Q) \\ (\\\\\\\\<^sub>S\\<^sub>F\\<^sub>L\\<^sub>T \\ P)\"\n by (simp add: usubst unrest)\n\nlemma usubst_cpf_true[usubst]: \n \"\\ \\ \\true\\\\<^sub>F\\<^sub>L\\<^sub>T = \\true\\\\<^sub>F\\<^sub>L\\<^sub>T\" \n by rel_auto\n\nlemma usubst_cpf_false[usubst]: \n \"\\ \\ \\false\\\\<^sub>F\\<^sub>L\\<^sub>T = \\false\\\\<^sub>F\\<^sub>L\\<^sub>T\" \n by rel_auto\n\nlemma rel_usubst_cpf_skip_cpf[usubst]: \n \"(\\ \\ II) = ((\\ \\ \\II\\\\<^sub>F\\<^sub>L\\<^sub>T) \\ \\ \\ $fault =\\<^sub>u \\ \\ $fault\\ \\ \\ \\ $ok =\\<^sub>u \\ \\ $ok\\)\" \n by (simp add: usubst unrest skip_cpf_def)\n\nlemma usubst_lift_cpf_skip_lift_cpf[usubst]: \n \"(\\\\\\\\<^sub>s\\<^sub>F\\<^sub>L\\<^sub>T \\ \\II\\\\<^sub>F\\<^sub>L\\<^sub>T) = \\\\\\\\\\<^sub>a\\\\<^sub>F\\<^sub>L\\<^sub>T\" \n unfolding skip_r_def\n by (simp add: usubst_lift_cpf_assigns_lift_cpf)\n\nlemma usubst_cpf_skip_cpf [usubst]:\n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \n \"(\\ \\ SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\ \\ (\\$fault\\ \\ \\II\\\\<^sub>F\\<^sub>L\\<^sub>T)) \\ \\ \\ (\\$fault) \\ (\\ \\ (II)))\"\n using assms unfolding skip_flt_def\n by (simp add: usubst) \n\nlemma usubst_cpf_assigns_cpf [usubst]:\n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \n \"\\ \\ \\\\\\\\<^sub>F\\<^sub>L\\<^sub>T = (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\ \\ ((\\$fault\\) \\ \\\\\\\\\\<^sub>a\\\\<^sub>F\\<^sub>L\\<^sub>T)) \\ \\ \\ (\\$fault) \\ (\\ \\ (II)))\" \n using assms unfolding assigns_flt_def\n by (simp add: usubst)\n\nlemma c3_flt_comp_left_distr:\n \"(C3_flt (P) ;; R) = ((P;;R) \\ \\$fault \\ (II ;; R))\"\n apply pred_simp\n apply rel_simp\n apply fastforce\ndone\n\nlemma c3_flt_comp_semir:\n \"(C3_flt(P) ;; C3_flt(R)) = C3_flt (P ;; C3_flt(R))\"\n by rel_auto\n\nlemma c3_flt_comp_simpl[uflt_comp]:\n \"(C3_flt(P) ;; C3_flt(R)) = ((P ;; C3_flt(R)) \\ \\$fault \\ (II))\"\n by rel_auto\n\nlemma simpl_flt_comp_semir:\n \"(Simpl\\<^sub>F\\<^sub>L\\<^sub>T(P) ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R)) = Simpl\\<^sub>F\\<^sub>L\\<^sub>T ((\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ P) ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R))\"\n by rel_auto\n\ntheorem design_top_flt_left_zero[uflt_comp]: \n \"(\\\\<^sub>F\\<^sub>L\\<^sub>T ;; (P \\ Q)) = \\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (rel_auto)\n\ntheorem Simpl_flt_top_flt_left_zero[uflt_comp]: \n \"(\\\\<^sub>F\\<^sub>L\\<^sub>T ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T (P)) = \\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (rel_auto)\n\nlemma assigns_lift_cpf_comp_rel_cpf[uflt_comp]:\n assumes \"$ok \\ P\" \"$fault \\ P\"\n shows \"(\\\\\\\\\\<^sub>a\\\\<^sub>F\\<^sub>L\\<^sub>T ;; P) = (\\\\\\\\<^sub>s\\<^sub>F\\<^sub>L\\<^sub>T \\ P)\"\n apply (insert assms)\n apply pred_simp \n apply rel_blast \ndone\n\nlemma lift_des_skip_dr_unit_flt [uflt_comp]:\n \"(\\P\\\\<^sub>F\\<^sub>L\\<^sub>T ;; \\II\\\\<^sub>F\\<^sub>L\\<^sub>T) = \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n \"(\\II\\\\<^sub>F\\<^sub>L\\<^sub>T ;; \\P\\\\<^sub>F\\<^sub>L\\<^sub>T) = \\P\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by (rel_auto)+\n\nlemma skip_cpf_left_comp_simpl[uflt_comp]:\n \"(SKIP\\<^sub>F\\<^sub>L\\<^sub>T ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R)) = (Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R))\"\n by rel_auto\n\nlemma skip_cpf_right_comp_simpl[uflt_comp]:\n \"(Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R) ;; SKIP\\<^sub>F\\<^sub>L\\<^sub>T) = (Simpl\\<^sub>F\\<^sub>L\\<^sub>T(R))\"\n by rel_auto\n\nlemma assign_flt_alt_def: \n \"\\\\\\\\<^sub>F\\<^sub>L\\<^sub>T = Simpl\\<^sub>F\\<^sub>L\\<^sub>T (\\$fault\\ \\ \\\\\\\\\\<^sub>s \\ II\\\\<^sub>F\\<^sub>L\\<^sub>T)\"\n by rel_auto\n\nlemma assign_flt_left_comp_c3[uflt_comp]:\n \"\\a\\\\<^sub>F\\<^sub>L\\<^sub>T ;; C3_flt (P \\ Q) = C3_flt (\\a\\\\<^sub>s\\<^sub>F\\<^sub>L\\<^sub>T \\ (P \\ Q))\"\n by rel_auto\n\nlemma assigns_flt_comp[uflt_comp]: \n \"(\\f\\\\<^sub>F\\<^sub>L\\<^sub>T ;; \\g\\\\<^sub>F\\<^sub>L\\<^sub>T) = \\g \\ f\\\\<^sub>F\\<^sub>L\\<^sub>T\"\n by rel_auto\n\nlemma usubst_cpf_des_cond_flt [usubst]:\n \"\\$ok \\ \\; $ok\\ \\ \\ \\ \\ \n \\ \\ (R \\ bif b then P else Q eif) = \n (\\ \\ R \\ (\\ \\ P \\ \\ \\ \\b\\\\<^sub>F\\<^sub>L\\<^sub>T\\<^sub>< \\ \\ \\ Q))\"\n by (simp add: usubst)\n\nlemma comp_cond_flt_left_distr[uflt_comp]:\n \"((bif b then Simpl\\<^sub>F\\<^sub>L\\<^sub>T P else Simpl\\<^sub>F\\<^sub>L\\<^sub>T Q eif) ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T R) = \n (bif b then (Simpl\\<^sub>F\\<^sub>L\\<^sub>T P ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T R) else (Simpl\\<^sub>F\\<^sub>L\\<^sub>T Q ;; Simpl\\<^sub>F\\<^sub>L\\<^sub>T R) eif)\"\n apply pred_simp \n apply rel_simp\ndone\n\nlemma if_mono:\n \"\\ P\\<^sub>1 \\ P\\<^sub>2; Q\\<^sub>1 \\ Q\\<^sub>2 \\ \\ (bif b then P\\<^sub>1 else Q\\<^sub>1 eif) \\ (bif b then P\\<^sub>2 else Q\\<^sub>2 eif)\"\n by rel_auto\n\nlemma design_post_seqr_rcond_left_not_ivar[urel_cond]:\n \"S \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\R\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $x\\) ;; P \\ \\ $x \\ Q) = \n S \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\R\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $x\\);; Q)\"\n apply pred_simp\n apply fastforce \ndone\n\nlemma design_post_seqr_rcond_left_ivar [urel_cond]:\n \"S \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\R\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $x\\) ;; P \\ $x \\ Q) = \n S \\ (\\true\\\\<^sub>F\\<^sub>L\\<^sub>T \\ (\\R\\\\<^sub>F\\<^sub>L\\<^sub>T \\ $x\\);; P)\"\n apply pred_simp\n apply fastforce \ndone\n\nsubsection {*While abrupt usubst*}\n\nsubsection {*block abrupt usubst*}\n\nsubsection {*Catch abrupt usubst*}\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/AlgebraicLaws/Fault/algebraic_laws_fault_aux.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2925505771016156}} {"text": "theory iPropShallow \nimports DerivedConstructions \"../SpanningTree/SpanningTreeCameras\" Namespace\n ProofSearchPredicates \"../HeapLang/PrimitiveLaws\" View ProphMap\nbegin\n\n(*\n The functorial definition of iprop is as follows (unused arguments omitted):\n\n gmapF := ((loc\\((loc option\\loc option) ex))\\frac) option auth\n markingF := loc set auth\n b invF := (name\\b later ag) auth\n heapF := (loc\\(dfrac\\val ag)) auth\n (b,_) resF := gmapF \\ markingF \\ b invF \\ heapF\n iprop := (iprop,iprop) resF upred\n*)\n\ntype_synonym 'a pre_inv = \"(name, 'a later) map_view \\ name dset \\ name dfset\"\n\nML \\\n local\n type camera_data = {\n camera: typ,\n name: string,\n getter: term option,\n constructor: term option\n }\n\n type cameras_data = {\n number: int,\n cameras: camera_data list,\n cmraPT: typ option\n }\n\n (* Names *)\n val resFN = Binding.name \"resF\"\n val invN = Binding.name \"inv\"\n val resN = Binding.name \"res\"\n val ipropN = Binding.name \"iprop\"\n val getter_prefix = \"get_\"\n val constructor_prefix = \"constr_\"\n val gnameN = \"name\"\n val mapN = \"map_res\"\n\n (* Types *)\n val pre_ipropT = \\<^typ>\\pre_iprop\\\n val gnameT = \\<^typ>\\gname\\\n fun mk_opt T = Type (\\<^type_name>\\option\\, [T])\n fun mk_res_mapT res = gnameT --> mk_opt res (* This might need to be (gname,res) fmap *)\n val invT = \\<^typ>\\'a pre_inv\\\n val heapT = \\<^typ>\\heap_lang_heap\\\n val cinvT = \\<^typ>\\frac option\\\n val aT = \\<^typ>\\'a\\\n val base_cameraT = HOLogic.mk_prodT (mk_res_mapT cinvT, \n HOLogic.mk_prodT (mk_res_mapT invT, mk_res_mapT heapT))\n \n fun mk_pred cmraT = typ_subst_atomic [(aT,cmraT)] \\<^typ>\\'a upred_f\\\n fun subst_aT fp cmraT = typ_subst_atomic [(aT,fp)] cmraT\n fun add_cameraT cmraT cmrasT = HOLogic.mk_prodT (cmraT,cmrasT)\n fun fixed_cmras preT = [\n {camera = cinvT, name = \"cinv\", getter = NONE, constructor = NONE},\n {camera = subst_aT preT invT, name = \"inv\", getter = NONE, constructor = NONE},\n {camera = heapT, name = \"heap\", getter = NONE, constructor = NONE}\n ]\n val mk_cmraT = curry (Library.foldr (uncurry add_cameraT))\n val mk_maps = map mk_res_mapT\n\n (* Setup to generate getters for single cameras from the camera product *)\n val gname_param = Free (gnameN, gnameT)\n fun mk_def trm lthy = let val prop_trm = HOLogic.mk_Trueprop trm\n in Specification.definition NONE [] [] ((Binding.empty,[]), prop_trm) lthy |> snd end\n\n fun mk_defs (cmras_data:cameras_data) lthy =\n let fun mk_getter name cmraT = \n Free (getter_prefix ^ name, [gnameT, the (#cmraPT cmras_data)]--->mk_opt cmraT)$gname_param\n fun mk_own name cmraT = \n Free (constructor_prefix ^ name, [gnameT,cmraT]--->(the (#cmraPT cmras_data)))$gname_param$\n Free (Binding.name_of resN, cmraT)\n in\n Library.foldl (fn (lthy, cmra_data:camera_data) => \n (mk_def (curry HOLogic.mk_eq (mk_getter (#name cmra_data) (#camera cmra_data))\n (the (#getter cmra_data))) \n #> mk_def (curry HOLogic.mk_eq (mk_own (#name cmra_data) (#camera cmra_data))\n (the (#constructor cmra_data))))\n lthy)\n (lthy, #cameras cmras_data)\n end\n\n val dummy_fst = Const (\\<^const_name>\\fst\\, dummyT)\n val dummy_snd = Const (\\<^const_name>\\snd\\, dummyT)\n val dummy_comp = Const (\\<^const_name>\\comp\\, dummyT)\n val dummy_I = Const (\\<^const_name>\\id\\, dummyT)\n val dummy_eps = Const (\\<^const_name>\\\\\\, dummyT)\n val dummy_cmra_object = Free (Binding.name_of resN, dummyT)\n val map_param = Bound 0\n val lookup_name = Abs (mapN, dummyT, map_param$gname_param)\n fun mk_some trm = Const (\\<^const_name>\\Some\\, dummyT-->mk_opt dummyT)$trm\n fun mk_singleton_map res = \n Const (\\<^const_name>\\fun_upd\\, [mk_res_mapT dummyT,gnameT,dummyT]--->mk_res_mapT dummyT)\n $Const (\"Map.empty\", mk_res_mapT dummyT)\n $gname_param$(mk_some res)\n fun mk_comp_lookup getter = Const (\\<^const_name>\\comp\\, dummyT)$lookup_name$getter\n\n fun mk_getter levels is_heap = \n let val base = if is_heap then dummy_I else dummy_fst\n fun add_level 0 = base\n | add_level n = dummy_comp$(add_level (n-1))$dummy_snd\n in mk_comp_lookup (add_level levels) end\n\n fun mk_getters ({ number, cameras, cmraPT}: cameras_data) = let\n fun mk_getters_levels _ _ [] = []\n | mk_getters_levels levels n ((cmra: camera_data)::cameras) = \n {camera = #camera cmra, name = #name cmra,\n getter= if n=levels then SOME (mk_getter n true) else SOME (mk_getter n false),\n constructor = #constructor cmra\n }::(mk_getters_levels levels (n+1) cameras)\n in { number = number, cameras = mk_getters_levels (number-1) 0 cameras, cmraPT = cmraPT }\n end\n\n fun mk_own levels is_heap =\n let val base = if is_heap then mk_singleton_map dummy_cmra_object \n else curry HOLogic.mk_prod (mk_singleton_map dummy_cmra_object) dummy_eps\n fun add_level 0 = base\n | add_level n = curry HOLogic.mk_prod dummy_eps (add_level (n-1))\n in add_level levels end\n\n fun mk_owns ({ number, cameras, cmraPT}: cameras_data) = let\n fun mk_owns_levels _ _ [] = []\n | mk_owns_levels levels n ((cmra: camera_data)::cameras) = \n {camera = #camera cmra, name = #name cmra,\n getter = #getter cmra,\n constructor = if n=levels then SOME (mk_own n true) else SOME (mk_own n false)\n }::(mk_owns_levels levels (n+1) cameras)\n in { number = number, cameras = mk_owns_levels (number-1) 0 cameras, cmraPT = cmraPT }\n end\n\n (* Setup functions *)\n fun def_resF cmraT = (#2 o Typedecl.abbrev_global (resFN,[\"'a\", \"'b\"],NoSyn) cmraT)\n fun def_inv preT = (#2 o Typedecl.abbrev_global (invN,[],NoSyn) (subst_aT preT invT))\n fun def_res cmraT = (#2 o Typedecl.abbrev_global (resN,[],NoSyn) cmraT)\n fun def_iprop cmraT = (#2 o Typedecl.abbrev_global (ipropN,[],NoSyn) (mk_pred cmraT))\n\n fun wrap_quick_and_dirtys_mode f thy =\n let val qad = Config.get_global thy quick_and_dirty in\n thy |> Config.put_global quick_and_dirty true |> f |> Config.put_global quick_and_dirty qad \n end\n\n in\n\n fun mk_iprop cmras thy = \n let \n val cmras_raw = map (fn (cmra,name)=>{camera=cmra, name=name, getter=NONE, constructor=NONE}) cmras\n val cmra_data = {number = length cmras+3, cameras = cmras_raw@fixed_cmras pre_ipropT, cmraPT = NONE}\n val cmra_data = mk_getters cmra_data\n val cmra_data = mk_owns cmra_data\n val cmraT = subst_aT pre_ipropT base_cameraT |> mk_cmraT (mk_maps (map fst cmras))\n val cmra_data = {number = #number cmra_data, cameras = #cameras cmra_data, cmraPT = SOME cmraT}\n in thy |> \n wrap_quick_and_dirtys_mode (fn thy => thy\n |> def_resF cmraT |> def_inv pre_ipropT |> def_res cmraT |> def_iprop cmraT\n |> Named_Target.theory_map (mk_defs cmra_data)\n )\n end\nend;\n\\\n\ntype_synonym lockG = \"unit ex\"\n\nsetup \\mk_iprop [(\\<^typ>\\graphUR auth\\, \"graph\"), (\\<^typ>\\markingUR auth\\, \"markings\"), \n (\\<^typ>\\heap_lang_proph_map\\, \"proph\"), (\\<^typ>\\lockG\\, \"lock\")]\\\n \ntext \\Again some experiments wrt the iprop fixed-point\\\ndefinition inv_map :: \"('a::cofe \\ 'b::cofe) \\ ('a pre_inv \\ 'b pre_inv)\" where \n \"inv_map (f::'a\\'b) = map_prod (map_map_view (map_later f)) id\"\n\nlift_definition marking_map :: \"('a::cofe -n> 'b::cofe) \\ (markingUR auth -n> markingUR auth)\" is\n \"\\_. id\" by (rule discrete_ne)\n\nlemma \"contractive marking_map\"\n unfolding contr_contr_alt contractive_alt_def\n apply transfer by (simp add: ofe_refl)\n\nlift_definition later_map :: \"('a::cofe -n> 'b::cofe) \\ ('a later -n> 'b later)\" is\n \"\\(f::'a\\'b) (l::'a later). map_later f l\"\n unfolding non_expansive_def\n by (auto simp: n_equiv_later_def later.map_sel)\n\nlemma contr_later: \"contractive later_map\"\n unfolding contr_contr_alt contractive_alt_def\n apply transfer by (auto simp: later.map_sel n_equiv_later_def split: nat.split)\n\nlemma \"contr_ne f \\ contr_ne (later_map f)\"\napply transfer\nunfolding contr_contr_alt contractive_alt_def non_expansive_def\napply (auto simp: later.map_sel n_equiv_later_def split: nat.splits)\nby (metis Suc_pred)\n\nlift_definition ag_map :: \"('a::cofe -n> 'b::cofe) \\ ('a ag -n> 'b ag)\" is\n \"\\(f::'a\\'b) (a::'a ag). map_ag f a\"\n unfolding non_expansive_def\n apply (auto simp: n_equiv_ag_def)\n apply (smt (verit, best) image_iff map_ag.rep_eq)\n by (smt (verit, best) ag.set_map image_iff)\n\nlemma \"contr_ne f \\ contr_ne (ag_map f)\"\napply transfer\nunfolding contr_contr_alt contractive_alt_def non_expansive_def\napply (auto simp: non_expansive_def n_equiv_ag_def image_iff map_ag.rep_eq ag.set_map split: nat.splits)\nusing Rep_ag apply fastforce\nusing Rep_ag apply fastforce\nby metis+\n\nlift_definition ag_map_contr :: \"('a::cofe -n> 'b::cofe) -c> ('a later -n> 'b later)\" is\n \"later_map\" by (rule contr_later)\n \nlocale T_iso = \nfixes to_iso :: \"'a::ofe \\ 'b::ofe\" and from_iso :: \"'b \\ 'a\"\nassumes isomorph1: \"ofe_eq (to_iso (from_iso x)) x\" and isomorph2: \"ofe_eq (from_iso (to_iso y)) y\"\n and to_ne: \"non_expansive to_iso\" and from_ne: \"non_expansive from_iso\"\n \nlemma \nassumes iso: \"T_iso to from\"\nshows \"n_equiv n x y \\ n_equiv n (to x) (to y)\"\nproof \nassume \"n_equiv n x y\"\nfrom non_expansiveE[OF T_iso.to_ne[OF iso], OF this] show \"n_equiv n (to x) (to y)\" by simp\nnext\nassume \"n_equiv n (to x) (to y)\"\nfrom non_expansiveE[OF T_iso.from_ne[OF iso], OF this] have \"n_equiv n (from (to x)) (from (to y))\" \n by simp\nwith T_iso.isomorph2[OF iso] show \"n_equiv n x y\"\nby (meson ofe_eq_equiv ofe_trans_eqL)\nqed\n \nlemma \"\\(to_iso::markingUR auth\\markingUR auth) from_iso. T_iso to_iso from_iso\"\nproof -\nhave \"T_iso (id::markingUR auth \\ markingUR auth) id\"\n by (auto simp: T_iso_def ofe_refl non_expansive_def ofe_limit)\nthen show ?thesis by auto\nqed\n\nconsts isos :: \"('a::ofe pre_inv \\ 'a) \\('a \\ 'a pre_inv)\"\nspecification (isos)\n is_iso: \"T_iso (fst isos) (snd isos)\"\n sorry\n\ntext \\inG instance examples\\\ninterpretation idInG: inG \"\\\\ (m::gname \\ 'a::ucamera). m \\\" \"\\\\ x. [\\\\x]\"\napply (auto simp: inG_def prod_n_valid_def \\_n_valid op_prod_def \\_left_id)\napply (auto simp: pcore_prod_def pcore_fun_def \\_fun_def \\_option_def pcore_option_def comp_def \n split: option.splits)\nusing singleton_map_only_n_equiv by metis\n\ninterpretation invInG: inG get_inv constr_inv\n apply (auto simp: inG_def get_inv_def constr_inv_def dest!: singleton_map_only_n_equiv)\n apply (auto simp: d_equiv n_equiv_fun_def n_equiv_option_def prod_n_valid_def \\_n_valid op_prod_def \\_left_id)\n by (auto simp: pcore_prod_def pcore_fun_def \\_fun_def \\_option_def pcore_option_def comp_def \n constr_inv_def split: option.splits)\n\nglobal_interpretation lockInG: inG get_lock constr_lock\napply (auto simp: get_lock_def constr_lock_def d_equiv inG_def prod_n_valid_def \\_n_valid op_prod_def\n \\_left_id intro: map_upd_eqD1)\nby (auto simp: pcore_prod_def pcore_fun_def \\_fun_def \\_option_def pcore_option_def comp_def\n constr_lock_def singleton_map_n_incl split: option.splits)\n\nglobal_interpretation prophInG: inG get_proph constr_proph\napply (auto simp: get_proph_def constr_proph_def d_equiv inG_def prod_n_valid_def \\_n_valid op_prod_def\n \\_left_id intro: map_upd_eqD1)\nby (auto simp: pcore_prod_def pcore_fun_def \\_fun_def \\_option_def pcore_option_def comp_def\n constr_proph_def singleton_map_n_incl split: option.splits)\n\ncontext begin\nprivate lemma testlemma: \"inG (getter::gname\\'a::ucamera\\lockG option) put\n \\ 1=2\" sorry\n \nthm testlemma[OF lockInG.inG_axioms]\nend\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/IrisCore/iPropShallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.29253255251773347}} {"text": "(* Title: HOL/Auth/Yahalom2.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection{*The Yahalom Protocol, Variant 2*}\n\ntheory Yahalom2 imports Public begin\n\ntext{*\nThis version trades encryption of NB for additional explicitness in YM3.\nAlso in YM3, care is taken to make the two certificates distinct.\n\nFrom page 259 of\n Burrows, Abadi and Needham (1989). A Logic of Authentication.\n Proc. Royal Soc. 426\n\nThis theory has the prototypical example of a secrecy relation, KeyCryptNonce.\n*}\n\ninductive_set yahalom :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ yahalom\"\n\n (*The spy MAY say anything he CAN say. We do not expect him to\n invent new nonces here, but he can also use NS1. Common to\n all similar protocols.*)\n | Fake: \"[| evsf \\ yahalom; X \\ synth (analz (knows Spy evsf)) |]\n ==> Says Spy B X # evsf \\ yahalom\"\n\n (*A message that has been sent can be received by the\n intended recipient.*)\n | Reception: \"[| evsr \\ yahalom; Says A B X \\ set evsr |]\n ==> Gets B X # evsr \\ yahalom\"\n\n (*Alice initiates a protocol run*)\n | YM1: \"[| evs1 \\ yahalom; Nonce NA \\ used evs1 |]\n ==> Says A B {|Agent A, Nonce NA|} # evs1 \\ yahalom\"\n\n (*Bob's response to Alice's message.*)\n | YM2: \"[| evs2 \\ yahalom; Nonce NB \\ used evs2;\n Gets B {|Agent A, Nonce NA|} \\ set evs2 |]\n ==> Says B Server\n {|Agent B, Nonce NB, Crypt (shrK B) {|Agent A, Nonce NA|}|}\n # evs2 \\ yahalom\"\n\n (*The Server receives Bob's message. He responds by sending a\n new session key to Alice, with a certificate for forwarding to Bob.\n Both agents are quoted in the 2nd certificate to prevent attacks!*)\n | YM3: \"[| evs3 \\ yahalom; Key KAB \\ used evs3;\n Gets Server {|Agent B, Nonce NB,\n Crypt (shrK B) {|Agent A, Nonce NA|}|}\n \\ set evs3 |]\n ==> Says Server A\n {|Nonce NB,\n Crypt (shrK A) {|Agent B, Key KAB, Nonce NA|},\n Crypt (shrK B) {|Agent A, Agent B, Key KAB, Nonce NB|}|}\n # evs3 \\ yahalom\"\n\n (*Alice receives the Server's (?) message, checks her Nonce, and\n uses the new session key to send Bob his Nonce.*)\n | YM4: \"[| evs4 \\ yahalom;\n Gets A {|Nonce NB, Crypt (shrK A) {|Agent B, Key K, Nonce NA|},\n X|} \\ set evs4;\n Says A B {|Agent A, Nonce NA|} \\ set evs4 |]\n ==> Says A B {|X, Crypt K (Nonce NB)|} # evs4 \\ yahalom\"\n\n (*This message models possible leaks of session keys. The nonces\n identify the protocol run. Quoting Server here ensures they are\n correct. *)\n | Oops: \"[| evso \\ yahalom;\n Says Server A {|Nonce NB,\n Crypt (shrK A) {|Agent B, Key K, Nonce NA|},\n X|} \\ set evso |]\n ==> Notes Spy {|Nonce NA, Nonce NB, Key K|} # evso \\ yahalom\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare Fake_parts_insert_in_Un [dest]\ndeclare analz_into_parts [dest]\n\ntext{*A \"possibility property\": there are traces that reach the end*}\nlemma \"Key K \\ used []\n ==> \\X NB. \\evs \\ yahalom.\n Says A B {|X, Crypt K (Nonce NB)|} \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] yahalom.Nil\n [THEN yahalom.YM1, THEN yahalom.Reception,\n THEN yahalom.YM2, THEN yahalom.Reception,\n THEN yahalom.YM3, THEN yahalom.Reception,\n THEN yahalom.YM4])\napply (possibility, simp add: used_Cons)\ndone\n\nlemma Gets_imp_Says:\n \"[| Gets B X \\ set evs; evs \\ yahalom |] ==> \\A. Says A B X \\ set evs\"\nby (erule rev_mp, erule yahalom.induct, auto)\n\ntext{*Must be proved separately for each protocol*}\nlemma Gets_imp_knows_Spy:\n \"[| Gets B X \\ set evs; evs \\ yahalom |] ==> X \\ knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\ndeclare Gets_imp_knows_Spy [THEN analz.Inj, dest]\n\n\nsubsection{*Inductive Proofs*}\n\ntext{*Result for reasoning about the encrypted portion of messages.\nLets us treat YM4 using a similar argument as for the Fake case.*}\nlemma YM4_analz_knows_Spy:\n \"[| Gets A {|NB, Crypt (shrK A) Y, X|} \\ set evs; evs \\ yahalom |]\n ==> X \\ analz (knows Spy evs)\"\nby blast\n\nlemmas YM4_parts_knows_Spy =\n YM4_analz_knows_Spy [THEN analz_into_parts]\n\n\n(** Theorems of the form X \\ parts (knows Spy evs) imply that NOBODY\n sends messages containing X! **)\n\ntext{*Spy never sees a good agent's shared key!*}\nlemma Spy_see_shrK [simp]:\n \"evs \\ yahalom ==> (Key (shrK A) \\ parts (knows Spy evs)) = (A \\ bad)\"\nby (erule yahalom.induct, force,\n drule_tac [6] YM4_parts_knows_Spy, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ yahalom ==> (Key (shrK A) \\ analz (knows Spy evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"[|Key (shrK A) \\ parts (knows Spy evs); evs \\ yahalom|] ==> A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\ntext{*Nobody can have used non-existent keys! \n Needed to apply @{text analz_insert_Key}*}\nlemma new_keys_not_used [simp]:\n \"[|Key K \\ used evs; K \\ symKeys; evs \\ yahalom|]\n ==> K \\ keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt{*Fake*}\napply (force dest!: keysFor_parts_insert)\ntxt{*YM3*}\napply blast\ntxt{*YM4*}\napply auto\napply (blast dest!: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\n\ntext{*Describes the form of K when the Server sends this message. Useful for\n Oops as well as main secrecy property.*}\nlemma Says_Server_message_form:\n \"[| Says Server A {|nb', Crypt (shrK A) {|Agent B, Key K, na|}, X|}\n \\ set evs; evs \\ yahalom |]\n ==> K \\ range shrK\"\nby (erule rev_mp, erule yahalom.induct, simp_all)\n\n\n(****\n The following is to prove theorems of the form\n\n Key K \\ analz (insert (Key KAB) (knows Spy evs)) ==>\n Key K \\ analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n(** Session keys are not used to encrypt other session keys **)\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\ yahalom ==>\n \\K KK. KK <= - (range shrK) -->\n (Key K \\ analz (Key`KK Un (knows Spy evs))) =\n (K \\ KK | Key K \\ analz (knows Spy evs))\"\napply (erule yahalom.induct)\napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] YM4_analz_knows_Spy, analz_freshK, spy_analz, blast)\ndone\n\nlemma analz_insert_freshK:\n \"[| evs \\ yahalom; KAB \\ range shrK |] ==>\n (Key K \\ analz (insert (Key KAB) (knows Spy evs))) =\n (K = KAB | Key K \\ analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext{*The Key K uniquely identifies the Server's message*}\nlemma unique_session_keys:\n \"[| Says Server A\n {|nb, Crypt (shrK A) {|Agent B, Key K, na|}, X|} \\ set evs;\n Says Server A'\n {|nb', Crypt (shrK A') {|Agent B', Key K, na'|}, X'|} \\ set evs;\n evs \\ yahalom |]\n ==> A=A' & B=B' & na=na' & nb=nb'\"\napply (erule rev_mp, erule rev_mp)\napply (erule yahalom.induct, simp_all)\ntxt{*YM3, by freshness*}\napply blast\ndone\n\n\nsubsection{*Crucial Secrecy Property: Spy Does Not See Key @{term KAB}*}\n\nlemma secrecy_lemma:\n \"[| A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> Says Server A\n {|nb, Crypt (shrK A) {|Agent B, Key K, na|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, nb|}|}\n \\ set evs -->\n Notes Spy {|na, nb, Key K|} \\ set evs -->\n Key K \\ analz (knows Spy evs)\"\napply (erule yahalom.induct, force, frule_tac [7] Says_Server_message_form,\n drule_tac [6] YM4_analz_knows_Spy)\napply (simp_all add: pushes analz_insert_eq analz_insert_freshK, spy_analz)\napply (blast dest: unique_session_keys)+ (*YM3, Oops*)\ndone\n\n\ntext{*Final version*}\nlemma Spy_not_see_encrypted_key:\n \"[| Says Server A\n {|nb, Crypt (shrK A) {|Agent B, Key K, na|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, nb|}|}\n \\ set evs;\n Notes Spy {|na, nb, Key K|} \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> Key K \\ analz (knows Spy evs)\"\nby (blast dest: secrecy_lemma Says_Server_message_form)\n\n\n\ntext{*This form is an immediate consequence of the previous result. It is\nsimilar to the assertions established by other methods. It is equivalent\nto the previous result in that the Spy already has @{term analz} and\n@{term synth} at his disposal. However, the conclusion\n@{term \"Key K \\ knows Spy evs\"} appears not to be inductive: all the cases\nother than Fake are trivial, while Fake requires\n@{term \"Key K \\ analz (knows Spy evs)\"}. *}\nlemma Spy_not_know_encrypted_key:\n \"[| Says Server A\n {|nb, Crypt (shrK A) {|Agent B, Key K, na|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, nb|}|}\n \\ set evs;\n Notes Spy {|na, nb, Key K|} \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> Key K \\ knows Spy evs\"\nby (blast dest: Spy_not_see_encrypted_key)\n\n\nsubsection{*Security Guarantee for A upon receiving YM3*}\n\ntext{*If the encrypted message appears then it originated with the Server.\n May now apply @{text Spy_not_see_encrypted_key}, subject to its conditions.*}\nlemma A_trusts_YM3:\n \"[| Crypt (shrK A) {|Agent B, Key K, na|} \\ parts (knows Spy evs);\n A \\ bad; evs \\ yahalom |]\n ==> \\nb. Says Server A\n {|nb, Crypt (shrK A) {|Agent B, Key K, na|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, nb|}|}\n \\ set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt{*Fake, YM3*}\napply blast+\ndone\n\ntext{*The obvious combination of @{text A_trusts_YM3} with \n@{text Spy_not_see_encrypted_key}*}\ntheorem A_gets_good_key:\n \"[| Crypt (shrK A) {|Agent B, Key K, na|} \\ parts (knows Spy evs);\n \\nb. Notes Spy {|na, nb, Key K|} \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> Key K \\ analz (knows Spy evs)\"\nby (blast dest!: A_trusts_YM3 Spy_not_see_encrypted_key)\n\n\nsubsection{*Security Guarantee for B upon receiving YM4*}\n\ntext{*B knows, by the first part of A's message, that the Server distributed\n the key for A and B, and has associated it with NB.*}\nlemma B_trusts_YM4_shrK:\n \"[| Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}\n \\ parts (knows Spy evs);\n B \\ bad; evs \\ yahalom |]\n ==> \\NA. Says Server A\n {|Nonce NB,\n Crypt (shrK A) {|Agent B, Key K, Nonce NA|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}|}\n \\ set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt{*Fake, YM3*}\napply blast+\ndone\n\n\ntext{*With this protocol variant, we don't need the 2nd part of YM4 at all:\n Nonce NB is available in the first part.*}\n\ntext{*What can B deduce from receipt of YM4? Stronger and simpler than Yahalom\n because we do not have to show that NB is secret. *}\nlemma B_trusts_YM4:\n \"[| Gets B {|Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}, X|}\n \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> \\NA. Says Server A\n {|Nonce NB,\n Crypt (shrK A) {|Agent B, Key K, Nonce NA|},\n Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}|}\n \\ set evs\"\nby (blast dest!: B_trusts_YM4_shrK)\n\n\ntext{*The obvious combination of @{text B_trusts_YM4} with \n@{text Spy_not_see_encrypted_key}*}\ntheorem B_gets_good_key:\n \"[| Gets B {|Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}, X|}\n \\ set evs;\n \\na. Notes Spy {|na, Nonce NB, Key K|} \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> Key K \\ analz (knows Spy evs)\"\nby (blast dest!: B_trusts_YM4 Spy_not_see_encrypted_key)\n\n\nsubsection{*Authenticating B to A*}\n\ntext{*The encryption in message YM2 tells us it cannot be faked.*}\nlemma B_Said_YM2:\n \"[| Crypt (shrK B) {|Agent A, Nonce NA|} \\ parts (knows Spy evs);\n B \\ bad; evs \\ yahalom |]\n ==> \\NB. Says B Server {|Agent B, Nonce NB,\n Crypt (shrK B) {|Agent A, Nonce NA|}|}\n \\ set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt{*Fake, YM2*}\napply blast+\ndone\n\n\ntext{*If the server sends YM3 then B sent YM2, perhaps with a different NB*}\nlemma YM3_auth_B_to_A_lemma:\n \"[| Says Server A {|nb, Crypt (shrK A) {|Agent B, Key K, Nonce NA|}, X|}\n \\ set evs;\n B \\ bad; evs \\ yahalom |]\n ==> \\nb'. Says B Server {|Agent B, nb',\n Crypt (shrK B) {|Agent A, Nonce NA|}|}\n \\ set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, simp_all)\ntxt{*Fake, YM2, YM3*}\napply (blast dest!: B_Said_YM2)+\ndone\n\ntext{*If A receives YM3 then B has used nonce NA (and therefore is alive)*}\ntheorem YM3_auth_B_to_A:\n \"[| Gets A {|nb, Crypt (shrK A) {|Agent B, Key K, Nonce NA|}, X|}\n \\ set evs;\n A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> \\nb'. Says B Server\n {|Agent B, nb', Crypt (shrK B) {|Agent A, Nonce NA|}|}\n \\ set evs\"\nby (blast dest!: A_trusts_YM3 YM3_auth_B_to_A_lemma)\n\n\nsubsection{*Authenticating A to B*}\n\ntext{*using the certificate @{term \"Crypt K (Nonce NB)\"}*}\n\ntext{*Assuming the session key is secure, if both certificates are present then\n A has said NB. We can't be sure about the rest of A's message, but only\n NB matters for freshness. Note that @{term \"Key K \\ analz (knows Spy evs)\"}\n must be the FIRST antecedent of the induction formula.*}\n\ntext{*This lemma allows a use of @{text unique_session_keys} in the next proof,\n which otherwise is extremely slow.*}\nlemma secure_unique_session_keys:\n \"[| Crypt (shrK A) {|Agent B, Key K, na|} \\ analz (spies evs);\n Crypt (shrK A') {|Agent B', Key K, na'|} \\ analz (spies evs);\n Key K \\ analz (knows Spy evs); evs \\ yahalom |]\n ==> A=A' & B=B'\"\nby (blast dest!: A_trusts_YM3 dest: unique_session_keys Crypt_Spy_analz_bad)\n\n\nlemma Auth_A_to_B_lemma [rule_format]:\n \"evs \\ yahalom\n ==> Key K \\ analz (knows Spy evs) -->\n K \\ symKeys -->\n Crypt K (Nonce NB) \\ parts (knows Spy evs) -->\n Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|}\n \\ parts (knows Spy evs) -->\n B \\ bad -->\n (\\X. Says A B {|X, Crypt K (Nonce NB)|} \\ set evs)\"\napply (erule yahalom.induct, force,\n frule_tac [6] YM4_parts_knows_Spy)\napply (analz_mono_contra, simp_all)\ntxt{*Fake*}\napply blast\ntxt{*YM3: by @{text new_keys_not_used}, the message\n @{term \"Crypt K (Nonce NB)\"} could not exist*}\napply (force dest!: Crypt_imp_keysFor)\ntxt{*YM4: was @{term \"Crypt K (Nonce NB)\"} the very last message? If so, \n apply unicity of session keys; if not, use the induction hypothesis*}\napply (blast dest!: B_trusts_YM4_shrK dest: secure_unique_session_keys)\ndone\n\n\ntext{*If B receives YM4 then A has used nonce NB (and therefore is alive).\n Moreover, A associates K with NB (thus is talking about the same run).\n Other premises guarantee secrecy of K.*}\ntheorem YM4_imp_A_Said_YM3 [rule_format]:\n \"[| Gets B {|Crypt (shrK B) {|Agent A, Agent B, Key K, Nonce NB|},\n Crypt K (Nonce NB)|} \\ set evs;\n (\\NA. Notes Spy {|Nonce NA, Nonce NB, Key K|} \\ set evs);\n K \\ symKeys; A \\ bad; B \\ bad; evs \\ yahalom |]\n ==> \\X. Says A B {|X, Crypt K (Nonce NB)|} \\ set evs\"\nby (blast intro: Auth_A_to_B_lemma\n dest: Spy_not_see_encrypted_key B_trusts_YM4_shrK)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Yahalom2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.29253254561177044}} {"text": "(*\n * Copyright (C) 2014, National ICT Australia Limited. All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above copyright\n * notice, this list of conditions and the following disclaimer in the\n * documentation and/or other materials provided with the distribution.\n *\n * * The name of National ICT Australia Limited nor the names of its\n * contributors may be used to endorse or promote products derived from\n * this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS\n * IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED\n * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\n * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n *)\n\nheader \"Machine Word Setup\"\n\ntheory WordSetup\nimports WordEnum DistinctProp\n\nbegin\n\ntext {* This theory defines the standard platform-specific word size\nand alignment. *}\n\ndefinition\n word_bits :: nat where\n \"word_bits \\ len_of TYPE(32)\"\n\ndefinition\n word_size :: \"'a :: numeral\" where\n \"word_size \\ 4\"\n\nlemma word_bits_conv:\n \"word_bits = 32\" unfolding word_bits_def by simp\n\nlemma word_bits_word_size_conv:\n \"word_bits = word_size * 8\"\n unfolding word_bits_def word_size_def by simp\n\ndefinition\n is_aligned :: \"'a :: len word \\ nat \\ bool\" where\n \"is_aligned ptr n \\ 2^n dvd unat ptr\"\n\ndefinition\n ptr_add :: \"word32 \\ nat \\ word32\" where\n \"ptr_add ptr n \\ ptr + of_nat n\"\n\ndefinition\n complement :: \"('a :: len) word \\ 'a word\" where\n \"complement x \\ x xor -1\"\n\ndefinition\n alignUp :: \"'a::len word \\ nat \\ 'a word\" where\n \"alignUp x n \\ x + 2 ^ n - 1 && complement (2 ^ n - 1)\"\n\nend\n", "meta": {"author": "jcaesar", "repo": "fixed-topos-header-space-analysis", "sha": "2da808ab41e5924d616ad1af15e8f50cb986c803", "save_path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis", "path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis/fixed-topos-header-space-analysis-2da808ab41e5924d616ad1af15e8f50cb986c803/thy/autocorres-0.98/lib/WordSetup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318194686359, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2925325456117704}} {"text": "section \\Helper theory for using the main passification global block theorem\\\n\ntheory PassificationEndToEnd\nimports Semantics Util Passification VCExprHelper\nbegin\n\nsubsection \\Picking an initial set of target states\\\n\ntext \\The global block theorem for the entry block in the passification phase states the following:\nGiven an initial source state s (in the non-passified program) and given a non-empty set of initial target\nstates U (in the passive program) that are related to s (w.r.t. the initial variable relation), then\nit holds for any source execution from s, there is at least target execution from some state in U\nthat simulates this source execution (there are some more properties on U that we do not mention here,\nsee \\<^const>\\passive_lemma_assms_2\\).\n\nFrom the VC phase we know that no target execution can fail if the VC holds. In our proof generation, \nwe use this result together with the global entry block theorem in the passification phase to get that:\nIf the VC holds, then there cannot be any failing source execution in the non-passified program).\n\nTo obtain this result, we must instantiate U such that every state in U is a feasible initial\ntarget state and satisfies all other properties. This subsection provides the definitions and lemmas\nto do so.\\\n\nfun initial_set :: \"'a absval_ty_fun \\ passive_rel \\ var_context \\ var_context \\ rtype_env \\ 'a nstate \\ ('a nstate) set\"\n where \"initial_set A R \\ \\' \\ ns = \n {u. state_typ_wf A \\ (local_state u) (snd \\') \\ state_typ_wf A \\ (global_state u) (fst \\') \\\n (\\x y. R x = Some (Inl y) \\ lookup_var \\ ns x = lookup_var \\' u y) \\ (\\ x y. map_of (fst \\) x = Some y \\ (global_state u) x = (global_state ns) x) \\\n binder_state u = Map.empty}\"\n\ntext \\We instantiate U with \\<^const>\\initial_set\\\\\n\ntext \\Next we construct a state that is in the selected U to show that U is non-empty under certain assumptions (\nthat we can prove when validating the passification phase) and that U satisfies the necessary properties.\\\n\nfun initial_state_local :: \"'a absval_ty_fun \\ rtype_env \\ passive_rel \\ var_context \\ var_context \\ 'a nstate \\ 'a named_state\"\n where \"initial_state_local A \\ R \\ \\' ns x = \n (case (map_of (snd \\') x) of Some tw =>\n (if (\\z. R z = Some (Inl x)) then \n lookup_var \\ ns (SOME z. R z = Some (Inl x)) \n else \n Some (val_of_type A (instantiate \\ (fst tw)))\n )\n | None \\ None)\"\n\nfun initial_state_global :: \"'a absval_ty_fun \\ rtype_env \\ passive_rel \\ var_context \\ var_context \\ 'a nstate \\ 'a named_state\"\n where \"initial_state_global A \\ R \\ \\' ns x = \n (case (map_of (fst \\') x) of Some tw =>\n (if (\\z. R z = Some (Inl x)) then \n lookup_var \\ ns (SOME z. R z = Some (Inl x)) \n else \n ( Some (val_of_type A (instantiate \\ (fst tw)))) \n )\n | None \\ None)\"\n\ndefinition rel_range\n where \"rel_range R = {y. \\x. R x = Some (Inl y)}\"\n\ndefinition inj_on_defined \n where \"inj_on_defined R = (\\ x y z. R x = R y \\ R x = Some (Inl z) \\ x = y)\"\n\nlemma initial_state_lookup: \n assumes InjAssm:\"inj_on_defined R\" and \"R x = Some (Inl y)\" and \"map_of (snd \\') y = Some vd\"\n shows \"initial_state_local A \\ R \\ \\' ns y = lookup_var \\ ns x\" (is \"?u y = lookup_var \\ ns x\")\nproof -\n from \\R x = Some (Inl y)\\ \\map_of (snd \\') y = Some vd\\ have \"?u y = (lookup_var \\ ns (SOME z. R z = Some (Inl y)))\" by auto\n thus \"?u y = lookup_var \\ ns x\" using InjAssm\n unfolding inj_on_defined_def\n by (metis (full_types, lifting) assms(2) tfl_some) \nqed\n\nlemma initial_state_global_lookup: \n assumes InjAssm: \"inj_on_defined R\" and \"R x = Some (Inl y)\" and \"map_of (fst \\') y = Some vd\"\n shows \"initial_state_global A \\ R \\ \\' ns y = lookup_var \\ ns x\" (is \"?u y = lookup_var \\ ns x\")\nproof -\n from \\R x = Some (Inl y)\\ \\map_of (fst \\') y = Some vd\\ have \"?u y = (lookup_var \\ ns (SOME z. R z = Some (Inl y)))\" \n by auto\n thus \"?u y = lookup_var \\ ns x\" using InjAssm\n unfolding inj_on_defined_def\n by (metis (full_types, lifting) assms(2) tfl_some) \nqed\n\ntext \\The following lemma shows the set we pick for U is non-empty under certain assumptions.\\\nlemma init_state_elem_init_set:\n assumes \n NonEmptyTypes:\"\\ t. closed t \\ \\v. type_of_val A v = t\" and\n Closed:\"\\y \\. \\(\\ x. R x = Some (Inl y)) \\ lookup_var_ty \\' y = Some \\ \\ closed (instantiate \\ \\)\" and \n RelTy:\"\\x y. R x = Some (Inl y) \\ lookup_var_ty \\ x = lookup_var_ty \\' y\" and\n RelWt:\"rel_well_typed A \\ \\ R ns\" and\n InjAssm:\"inj_on_defined R\" and\n GlobalsSame: \"fst \\ = fst \\'\" and\n WellTyp: \"(state_typ_wf A \\ (global_state ns) (fst \\))\" and\n (* since the initial state's global state is the same as for n_s (otherwise the axiom assumption cannot be satisfied)\n the lemma requires that that R maps globals to globals (otherwise it cannot be shown that ns and u respect R)*)\n RelGlobalsSame: \"\\x y. R x = Some (Inl y) \\ map_of (fst \\') y \\ None \\ x = y\" and \n (* no shadowing *)\n ConstsDisj:\"set (map fst (fst \\)) \\ set (map fst (snd \\)) = {}\" and\n ConstsDisj2:\"set (map fst (fst \\')) \\ set (map fst (snd \\')) = {}\"\n shows \"\\old_global_state = Map.empty, \n global_state = global_state ns, \n local_state = (initial_state_local A \\ R \\ \\' ns), \n binder_state = Map.empty \\ \\ initial_set A R \\ \\' \\ ns\" (is \"?u \\ ?U\")\nproof (simp only: initial_set.simps, rule, intro conjI)\n show \"state_typ_wf A \\ (local_state ?u) (snd \\')\"\n unfolding state_typ_wf_def\n proof ((rule allI)+, rule impI)\n fix y \\\n assume localy:\"lookup_vdecls_ty (snd \\') y = Some \\\"\n hence LookupTyY:\"lookup_var_ty \\' y = Some \\\"\n by (simp add: lookup_vdecls_ty_local_3) \n show \"map_option (type_of_val A) (local_state ?u y) = Some (instantiate \\ \\)\"\n proof (cases \"\\x. R x = Some (Inl y)\")\n case True\n from this obtain x where \"R x = Some (Inl y)\" by auto\n hence LookupUY:\"local_state ?u y = lookup_var \\ ns x\"\n by (metis InjAssm LookupTyY initial_state_lookup localy lookup_var_decl_local_2 lookup_var_ty_decl_Some lookup_vdecls_ty_def map_option_is_None nstate.select_convs(3) option.discI)\n from RelTy RelWt obtain v where\n \"lookup_var \\ ns x = Some v\" and \"type_of_val A v = instantiate \\ \\\"\n unfolding rel_well_typed_def using LookupTyY \\R x = Some (Inl y)\\\n by fastforce \n thus ?thesis using LookupUY by auto\n next\n case False\n hence \"local_state ?u y = Some (val_of_type A (instantiate \\ \\))\"\n using localy lookup_vdecls_ty_map_of\n by fastforce \n thus ?thesis using False LookupTyY Closed val_of_type_correct NonEmptyTypes\n by blast \n qed\n qed\nnext\n show \"state_typ_wf A \\ (global_state ?u) (fst \\')\" using WellTyp GlobalsSame by simp\nnext\n show \"\\ x y. R x = Some (Inl y) \\ lookup_var \\ ns x = lookup_var \\' ?u y\"\n proof (rule+)\n fix x y\n assume \"R x = Some (Inl y)\"\n hence SameTy:\"lookup_var_ty \\ x = lookup_var_ty \\' y\" using RelTy by simp\n moreover from \\R x = Some (Inl y)\\ RelWt obtain \\ where LookupX:\"lookup_var_ty \\ x = Some \\\"\n by (meson rel_well_typed_def)\n hence \"lookup_var_ty \\' y = Some \\\" using RelTy[OF \\R x = Some (Inl y)\\] by simp \n show \"lookup_var \\ ns x = lookup_var \\' ?u y\"\n proof (cases \"map_of (snd \\') y = None\")\n case True\n hence global_y:\"lookup_vdecls_ty (fst \\') y = Some \\\" using \\lookup_var_ty \\' y = Some \\\\ \n using lookup_vdecls_ty_global_5 by simp\n from True have \"lookup_var \\' ?u y = global_state ?u y\"\n by (simp add: lookup_var_def)\n hence lookup_global_u:\"lookup_var \\' ?u y = global_state ns y\" by simp\n moreover from global_y have \"map_of (snd \\) y = None\" using ConstsDisj \n by (metis GlobalsSame disjoint_iff list.set_map lookup_vdecls_ty_map_of map_of_eq_None_iff option.discI) \n ultimately have \"lookup_var \\ ns y = (global_state ns) y\" by (simp add: lookup_var_def)\n with lookup_global_u have \"lookup_var \\ ns y = lookup_var \\' ?u y\" by simp\n moreover from \\lookup_vdecls_ty (fst \\') y = Some \\\\ \\R x = Some (Inl y)\\ RelGlobalsSame have \"x = y\"\n using lookup_vdecls_ty_map_of by fastforce\n ultimately show ?thesis by simp\n next\n case False\n hence \"lookup_var \\' ?u y = local_state ?u y\"\n by (metis lookup_var_local option.exhaust_sel prod.collapse) \n hence \"\\ = (lookup_var \\ ns (SOME z. R z = Some (Inl y)))\" using \\R x = Some (Inl y)\\ False by auto \n then show ?thesis using InjAssm \\R x = Some (Inl y)\\ initial_state_lookup\n by (metis False \\lookup_var \\' ?u y = local_state ?u y\\ nstate.select_convs(3) option.collapse)\n qed\n qed\nnext\n show \"\\x y. map_of (fst \\) x = Some y \\ (global_state ?u) x = (global_state ns) x\" by simp\nnext\n show \"binder_state ?u = Map.empty\"\n by simp\nqed\n\nlemma init_set_non_empty:\n assumes NonEmptyTypes:\"\\ t. closed t \\ \\v. type_of_val A v = t\" and\n Closed:\"\\y \\. \\(\\ x. R x = Some (Inl y)) \\ lookup_var_ty \\' y = Some \\ \\ closed (instantiate \\ \\)\" and \n RelTy:\"\\x y. R x = Some (Inl y) \\ lookup_var_ty \\ x = lookup_var_ty \\' y\" and\n RelWt:\"rel_well_typed A \\ \\ R ns\" and\n InjAssm:\"inj_on_defined R\" and\n GlobalsSame: \"fst \\ = fst \\'\" and\n WellTyp: \"(state_typ_wf A \\ (global_state ns) (fst \\))\" and\n RelGlobalsSame: \"\\x y. R x = Some (Inl y) \\ map_of (fst \\') y \\ None \\ x = y\" and \n ConstsDisj:\"set (map fst (fst \\)) \\ set (map fst (snd \\)) = {}\" and\n ConstsDisj2:\"set (map fst (fst \\')) \\ set (map fst (snd \\')) = {}\"\n shows \"initial_set A R \\ \\' \\ ns \\ {}\"\n using assms init_state_elem_init_set by blast\n\ntext \\Next, we show that U has the remaining desired properties.\\\n\nlemma init_state_dependent:\"dependent A \\' \\ (initial_set A R \\ \\' \\ ns) ((rel_range R) \\ set (map fst (fst \\)))\" \n (is \"dependent A \\' \\ ?U ((rel_range R) \\ set (map fst (fst \\))) \")\n unfolding dependent_def closed_set_ty_def\n proof (rule ballI, rule allI, rule allI, rule impI, rule conjI[OF _ impI[OF allI[OF impI]]])\n fix u \\ d\n assume \"u \\ ?U\"\n hence S1:\"state_typ_wf A \\ (local_state u) (snd \\')\" and S2:\"state_typ_wf A \\ (global_state u) (fst \\')\" by auto\n assume LookupTy:\"lookup_var_ty \\' d = Some \\\"\n thus \"lookup_var_ty_match A \\' \\ u d \\\"\n using state_typ_wf_lookup[OF S1 S2 LookupTy] \n by (simp add: lookup_var_ty_match_def)\n next\n fix u \\ d v\n assume \"u \\ ?U\"\n hence S1:\"state_typ_wf A \\ (local_state u) (snd \\')\" and\n S2:\"state_typ_wf A \\ (global_state u) (fst \\')\" and\n Rel1: \"(\\x y. R x = Some (Inl y) \\ lookup_var \\ ns x = lookup_var \\' u y)\" and\n Binder1: \"binder_state u = Map.empty\" by auto\n assume LookupTy:\"lookup_var_ty \\' d = Some \\\"\n assume dNotElem:\"d \\ rel_range R \\ set (map fst (fst \\))\"\n assume TypV:\"type_of_val A v = instantiate \\ \\\"\n have S1Upd:\"state_typ_wf A \\ (local_state (update_var \\' u d v)) (snd \\')\"\n unfolding state_typ_wf_def\n proof (rule allI, rule allI, rule impI)\n fix x \\'\n assume MapOfX:\"lookup_vdecls_ty (snd \\') x = Some \\'\"\n show \"map_option (type_of_val A) (local_state (update_var \\' u d v) x) = Some (instantiate \\ \\')\"\n proof (cases \"d = x\")\n case True\n then show ?thesis \n by (metis (mono_tags, lifting) LookupTy MapOfX TypV lookup_var_local lookup_vdecls_ty_local_3 lookup_vdecls_ty_map_of option.simps(9) prod.collapse update_var_same)\n next\n case False\n from S1 MapOfX have \"map_option (type_of_val A) (local_state u x) = Some (instantiate \\ \\')\"\n using state_typ_wf_def by blast \n with False show ?thesis using local_state_update_other\n by metis\n qed\n qed\n have S2Upd:\"state_typ_wf A \\ (global_state (update_var \\' u d v)) (fst \\')\"\n unfolding state_typ_wf_def\n proof (rule allI, rule allI, rule impI)\n fix x \\'\n assume MapOfX:\"lookup_vdecls_ty (fst \\') x = Some \\'\"\n from S2 MapOfX have GlobalUX:\"map_option (type_of_val A) (global_state u x) = Some (instantiate \\ \\')\" using state_typ_wf_def by blast\n show \"map_option (type_of_val A) (global_state (update_var \\' u d v) x) = Some (instantiate \\ \\')\"\n proof (cases \"map_of (snd \\') d = None\")\n case True \n hence Aux1:\"global_state (update_var \\' u d v) = (global_state u)(d \\ v)\" by (simp add: global_update)\n show ?thesis\n proof (cases \"d = x\")\n case True\n moreover with MapOfX LookupTy \\map_of (snd \\') d = None\\ have \"\\ = \\'\"\n using lookup_vdecls_ty_global_4 lookup_vdecls_ty_map_of lookup_var_decl_global \n by auto\n ultimately show ?thesis\n apply (subst Aux1)\n using TypV MapOfX\n by simp\n next\n case False\n thus ?thesis using global_state_update_other GlobalUX\n by metis \n qed\n next\n case False\n hence Aux2: \"global_state (update_var \\' u d v) = global_state u\" using global_state_update_local by blast\n thus ?thesis using GlobalUX by simp \n qed\n qed\n have Rel1Upd: \"\\x y. R x = Some (Inl y) \\ lookup_var \\ ns x = lookup_var \\' (update_var \\' u d v) y\"\n proof (rule allI, rule allI, rule impI)\n fix x y\n assume \"R x = Some (Inl y)\"\n show \"lookup_var \\ ns x = lookup_var \\' (update_var \\' u d v) y\"\n apply (cases \"d = y\")\n using \\R x = Some (Inl y)\\ dNotElem\n apply (simp add: rel_range_def)\n using Rel1 \\R x = Some (Inl y)\\ \n apply simp\n done\n qed \n have GlobalConstraint: \"\\x y. map_of (fst \\) x = Some y \\ global_state (update_var \\' u d v) x = global_state ns x\"\n proof (rule+)\n fix x y\n assume \"map_of (fst \\) x = Some y\"\n hence \"d \\ x\" using dNotElem\n by (metis UnCI domI dom_map_of_2)\n thus \"global_state (update_var \\' u d v) x = global_state ns x\" using \\u \\ ?U\\\n by (simp add: \\map_of (fst \\) x = Some y\\ global_state_update_other)\n qed\n show \"update_var \\' u d v \\ ?U\" \n apply (simp only: initial_set.simps)\n apply (rule Set.CollectI)\n apply (intro conjI)\n apply (rule S1Upd)\n apply (rule S2Upd)\n apply (rule Rel1Upd)\n apply (rule GlobalConstraint)\n using update_var_binder_same Binder1 \n by metis\n qed\n\nlemma state_typ_wf_some:\n assumes \"map_of vs x \\ None\" and\n \"state_typ_wf A \\ ns vs\" \n shows \"ns x \\ None\"\n using assms map_of_lookup_vdecls_ty\n unfolding state_typ_wf_def\n by blast\n\nlemma nstate_old_rel_helper:\n assumes \"state_typ_wf A [] (global_state ns) (fst \\1)\" and\n \"global_state ns = old_global_state ns\" and\n \"set (map fst (fst \\1)) \\ set (map fst (snd \\1)) = {}\"\n \"u \\ initial_set A R \\1 \\2 [] ns\" and\n \"\\x y. R_old x = Some y \\ map_of (fst \\1) x \\ None\" and\n \"\\x y. R_old x = Some y \\ R x = Some y\"\n shows \"nstate_old_rel \\1 \\2 R_old ns u\"\n unfolding nstate_old_rel_def\nproof (rule allI, rule allI, rule impI) \n fix x y\n assume \"R_old x = Some (Inl y)\"\n hence GlobalX:\"map_of (fst \\1) x \\ None\"\n using assms(5) by simp\n hence NotLocalX:\"map_of (snd \\1) x = None\"\n using assms(3)\n by (metis disjoint_iff_not_equal list.set_map map_of_eq_None_iff)\n\n from \\R_old x = Some (Inl y)\\ have \"R x = Some (Inl y)\" using assms(6) by simp \n hence LookupSame:\"lookup_var \\1 ns x = lookup_var \\2 u y\" using assms(4)\n by simp\n\n from \\map_of (fst \\1) x \\ None\\\n obtain v where \"global_state ns x = Some v\"\n using assms(1) GlobalX state_typ_wf_some\n by fastforce\n moreover from this have \"lookup_var \\1 ns x = Some v\"\n using GlobalX NotLocalX\n by (metis lookup_var_global prod.collapse)\n ultimately have Rel:\"(\\v. old_global_state ns x = Some v \\ lookup_var \\2 u y = Some v)\"\n using assms(2) \n by (simp add: LookupSame)\n \n show \"(map_of (fst \\1) x \\ None \\ map_of (snd \\1) x = None) \\ (\\v. old_global_state ns x = Some v \\ lookup_var \\2 u y = Some v)\"\n using GlobalX NotLocalX Rel \n by simp\nqed\n\nlemma nstate_old_rel_states_helper:\n assumes \"state_typ_wf A [] (global_state ns) (fst \\1)\" and\n \"global_state ns = old_global_state ns\" and\n \"set (map fst (fst \\1)) \\ set (map fst (snd \\1)) = {}\"\n \"\\x y. R_old x = Some y \\ map_of (fst \\1) x \\ None\" and\n \"\\x y. R_old x = Some y \\ R x = Some y\"\n shows \"nstate_old_rel_states \\1 \\2 R_old ns (initial_set A R \\1 \\2 [] ns)\"\n unfolding nstate_old_rel_states_def\n using assms nstate_old_rel_helper\n by blast\n\nsubsection \\Some more helper definitions and lemmas for the final part of the passification validation\\\n\nlemma const_rel:\n assumes Rel:\"nstate_rel ((consts@globals),locals) (consts@globals2, locals2) R ns u\" and\n R_consts:\"list_all (\\vd. R (fst vd) = Some (Inl (fst vd))) consts\" and\n ConstsDisj:\"set (map fst consts) \\ set (map fst locals) = {}\" and\n ConstsDisj2:\"set (map fst consts) \\ set (map fst locals2) = {}\"\n shows \"state_restriction (global_state ns) consts = state_restriction (global_state u) consts\" \nproof (rule HOL.ext)\n fix x\n show \"state_restriction (global_state ns) consts x = state_restriction (global_state u) consts x\"\n proof (cases \"map_of consts x \\ None\")\n case True\n from this obtain \\ where \"map_of consts x = Some \\\" by auto\n moreover have \"map_of locals x = None\" and \"map_of locals2 x = None\" using ConstsDisj ConstsDisj2\n by (metis True disjoint_iff_not_equal domIff dom_map_of_2)+\n ultimately have LookupNs:\"lookup_var ((consts@globals),locals) ns x = global_state ns x\" and\n LookupU:\"lookup_var ((consts@globals2),locals2) u x = global_state u x\"\n by (auto simp add: lookup_var_global)\n from \\map_of consts x = Some \\\\ have \"(x,\\) \\ set (consts)\"\n by (simp add: map_of_SomeD) \n with R_consts have \"R x = Some (Inl x)\"\n by (metis (mono_tags, lifting) fst_conv in_set_conv_decomp_last list.pred_inject(2) list_all_append) \n with Rel have \"lookup_var ((consts@globals),locals) ns x = lookup_var ((consts@globals2),locals2) u x\"\n by (simp add: nstate_rel_def)\n with LookupNs LookupU show ?thesis using \\map_of consts x \\ None\\ \n by (simp add: state_restriction_def)\n next\n case False\n then show ?thesis \n by (simp add: state_restriction_def) \n qed\nqed\n\nlemma rel_well_typed_state_typ_wf: \n assumes S1:\"state_typ_wf A \\ (local_state ns) (snd \\)\" and\n S2:\"state_typ_wf A \\ (global_state ns) (fst \\)\" and\n RelWtVar:\"\\x y. R x = Some (Inl y) \\ \\\\. lookup_var_ty \\ x = Some \\\" and\n RelWtConst:\"\\x y. R x = Some (Inr y) \\ lookup_var \\ ns x = Some (LitV y) \\ (\\\\. lookup_var_ty \\ x = Some \\)\"\n shows \"rel_well_typed A \\ \\ R ns\"\n unfolding rel_well_typed_def rel_const_correct_def\n apply (rule conjI, rule allI, rule allI, rule impI)\n using state_typ_wf_lookup[OF S1 S2] RelWtVar\n apply blast\n using RelWtConst\n using \\\\x \\. lookup_var_ty \\ x = Some \\ \\ \\v. lookup_var \\ ns x = Some v \\ type_of_val A v = instantiate \\ \\\\ by force\n\nlemma convert_fun_to_list:\nassumes A0:\"R_fun = map_of R_list\" and\n A1:\"list_all (\\t. P (fst t) (snd t)) R_list\"\n shows \"R_fun x = Some y \\ P x y\" \nproof (rule+) \n assume \"R_fun x = Some y\"\n hence \"(x,y) \\ set (R_list)\"\n using A0\n by (simp add: map_of_SomeD)\n moreover from A1 have \"\\t \\ set (R_list). (\\t. P (fst t) (snd t)) t\"\n by (simp only: List.list_all_iff)\n ultimately show \"P x y\" by auto\nqed\n\nfun custom_cmp :: \"(nat + lit) \\ (nat + lit) \\ bool\"\n where \n \"custom_cmp (Inl n) (Inl m) = (n < m)\"\n | \"custom_cmp _ _ = False\"\n\nlemma custom_cmp_diff: \"custom_cmp a b \\ a \\ b\"\n by (cases a, cases b) auto \n\nfun strictly_ordered :: \"(nat + lit) list \\ bool\"\n where \n \"strictly_ordered [] = True\"\n | \"strictly_ordered [x] = True\"\n | \"strictly_ordered (x#y#zs) = (custom_cmp x y \\ strictly_ordered (y#zs))\"\n\nlemma strictly_ordered_smaller: \"strictly_ordered ((Inl a)#xs) \\ (\\ y \\ (set xs). \\a'. y= Inl a' \\ a < a')\"\nproof (induction arbitrary:a rule: strictly_ordered.induct)\n case 1\n then show ?case by simp\nnext\n case (2 x)\n then show ?case apply simp \n using custom_cmp.elims(2) by blast\nnext\n case (3 x y zs)\n show ?case\n proof (rule ballI)\n fix r\n assume RElem:\"r \\ set (x # y # zs)\"\n show \"\\a'. r = Inl a' \\ a < a'\"\n proof (cases \"r = x\")\n case True\n then show ?thesis using 3 \n by (metis custom_cmp.elims(2) custom_cmp.simps(1) strictly_ordered.simps(3))\n next\n case False\n hence \"r \\ set (y # zs)\" using RElem by simp\n then show ?thesis using 3 \n by (metis custom_cmp.elims(2) custom_cmp.simps(1) dual_order.strict_trans strictly_ordered.simps(3))\n qed\n qed\nqed\n\nlemma strictly_ordered_distinct: \"strictly_ordered xs \\ distinct xs\"\nproof (induction rule: strictly_ordered.induct)\ncase 1\nthen show ?case by simp\nnext\n case (2 x)\n then show ?case by simp\nnext\n case (3 x y zs)\n then show ?case apply simp\n by (metis (full_types) custom_cmp.elims(2) custom_cmp.simps(1) strictly_ordered_smaller sup.strict_boundedE sup.strict_order_iff)\nqed\n\nlemma distinct_helper:\n assumes A1:\"(x, fx) \\ set xs\" and \n A2:\"(y, fy) \\ set xs\" and\n \"x \\ y\"\n \"distinct (map snd xs)\"\n shows \"fx \\ fy\" \nproof -\n thm distinct_conv_nth\n from A1 obtain i where \"i < length xs\" and \"xs ! i = (x, fx)\"\n by (meson in_set_conv_nth)\n moreover from A2 obtain j where \"j < length xs\" and \"xs ! j = (y, fy)\"\n by (meson in_set_conv_nth)\n ultimately show ?thesis using \\x \\ y\\ \\distinct (map snd xs)\\ distinct_conv_nth\n by (metis eq_snd_iff length_map nth_map prod.inject)\nqed\n\nlemma injective_fun_to_list:\n assumes R_fun_def: \"R_fun = map_of R_list\" and\n Distinct:\"distinct (map snd R_list)\"\n shows \"inj_on_defined R_fun\"\n unfolding inj_on_defined_def distinct_helper \nproof ((rule allI)+, rule impI, erule conjE)\n fix x y z\n let ?map_of_x = \"map_of R_list x\"\n let ?map_of_y = \"map_of R_list y\"\n assume \"R_fun x = R_fun y\" and \"R_fun x = Some (Inl z)\"\n hence \"(x, Inl z) \\ set R_list\"\n using R_fun_def \\R_fun x = Some (Inl z)\\ map_of_SomeD by force\n moreover have \"(y, Inl z) \\ set R_list\" \n using R_fun_def \\R_fun x = Some (Inl z)\\ \\R_fun x = R_fun y\\ map_of_SomeD by fastforce\n ultimately show \"x = y\"\n using distinct_helper Distinct by fastforce\nqed\n\nlemma injective_fun_to_list_2:\n assumes \"R_fun = map_of R_list\" and\n \"strictly_ordered (map snd R_list)\"\n shows \"inj_on_defined R_fun\"\n using assms injective_fun_to_list strictly_ordered_distinct by blast\n\nfun max_rel :: \"(nat + lit) list \\ nat\"\n where \n \"max_rel [] = 0\"\n | \"max_rel ((Inl n) # xs) = (max n (max_rel xs))\" \n | \"max_rel ((Inr l) # xs) = (max_rel xs)\"\n\n\nlemma max_rel_aux:\n assumes \"max_rel xs = w_max\" and \"(Inl n) \\ set xs\" \n shows \"n \\ w_max\"\n using assms\n apply (induction arbitrary: n w_max rule: max_rel.induct)\n apply simp\n apply fastforce\n apply simp\n done\n\nfun max_rel_tail :: \"nat \\ (nat + lit) list \\ nat\"\n where \n \"max_rel_tail k [] = k\"\n | \"max_rel_tail k ((Inl n) # xs) = (max_rel_tail (max n k) xs)\" \n | \"max_rel_tail k ((Inr l) # xs) = (max_rel_tail k xs)\"\n\nlemma max_rel_tail_equiv_aux: \"max_rel_tail k xs = max k (max_rel xs)\"\n by (induction arbitrary: k rule: max_rel.induct) auto\n\nlemma max_tail_equiv: \"max_rel_tail 0 xs = max_rel xs\"\n by (simp add: max_rel_tail_equiv_aux)\n\nlemma rel_range_fun_to_list:\n assumes R_fun_def:\"R_fun = map_of R_list\" and\n \"max_rel_tail 0 (map snd R_list) = w_max\"\n shows \"\\x. x \\ rel_range R_fun \\ x \\ w_max\"\n unfolding rel_range_def\nproof (rule, rule)\n fix x\n assume \"x \\ {y. \\x. R_fun x = Some (Inl y)}\"\n from this obtain z where \"R_fun z = Some (Inl x)\" by auto\n hence \"map_of R_list z = Some (Inl x)\" using R_fun_def by simp\n hence \"(z,Inl x) \\ set (R_list)\"\n by (simp add: map_of_SomeD)\n thus \"x \\ w_max\" using max_tail_equiv max_rel_aux\n by (metis assms(2) set_zip_rightD zip_map_fst_snd)\nqed\n\nlemma axiom_assm_aux:\n assumes \"axiom_assm A \\ consts ns1 axioms\" and\n \"\\ x y. map_of consts x = Some y \\ (global_state ns1) x = (global_state ns2) x\"\n shows \"axiom_assm A \\ consts ns2 axioms\"\n using assms\n unfolding nstate_global_restriction_def state_restriction_def\nproof -\n have Aux:\" (\\x. if map_of consts x \\ None then global_state ns2 x else None) = (\\x. if map_of consts x \\ None then global_state ns1 x else None)\"\n using assms(2) by fastforce\n show \"axioms_sat A (consts, []) \\ (global_to_nstate (\\x. if map_of consts x \\ None then global_state ns2 x else None)) axioms\"\n apply (subst Aux)\n using assms(1)\n unfolding nstate_global_restriction_def state_restriction_def\n apply assumption\n done\nqed\n\nlemma helper_init_disj:\n assumes Max1:\"\\x. x \\ xs \\ x \\ n\" and \"\\y. y \\ ys \\ y \\ m\" and \"n < w_max\" and \"m < w_max\"\n shows \"{w. (w :: nat) \\ w_max} \\ (xs \\ ys) = {}\"\n using assms\n by auto\n \nfun is_prefix :: \"'b list \\ 'b list \\ bool\"\n where \n \"is_prefix [] ys = True\"\n | \"is_prefix (x#xs) (y#ys) = ((x = y) \\ is_prefix xs ys)\"\n | \"is_prefix _ _ = False\"\n\nlemma is_prefix_empty: \"is_prefix ys [] \\ ys = []\"\n by (cases ys) auto\n\nlemma is_prefix_append: \"is_prefix xs ys \\ \\zs. ys = xs@zs\"\n by (induction rule: is_prefix.induct) (auto simp: is_prefix_empty)\n\nlemma prefix_map_of:\n assumes \"\\zs. ys = xs@zs\" and\n \"R1 = map_of ys\" and\n \"R2 = map_of xs\"\n shows \"\\x y. R2 x = Some y \\ R1 x = Some y\"\n using assms\n by auto\n\nend", "meta": {"author": "gauravpartha", "repo": "foundational_boogie", "sha": "4667c538759128ad88588ff2c1ae821d7a78b16b", "save_path": "github-repos/isabelle/gauravpartha-foundational_boogie", "path": "github-repos/isabelle/gauravpartha-foundational_boogie/foundational_boogie-4667c538759128ad88588ff2c1ae821d7a78b16b/BoogieLang/PassificationEndToEnd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.2925325456117704}} {"text": "section\\Temporal Properties\\\ntext\\This theory presents some examples of temporal properties over the simple drinks machine.\\\n\ntheory Drinks_Machine_LTL\nimports \"Drinks_Machine\" \"EFSM.EFSM_LTL\"\nbegin\n\ndeclare One_nat_def [simp del]\n\nlemma P_ltl_step_0:\n assumes invalid: \"P (None, [], <>)\"\n assumes select: \"l = STR ''select'' \\ P (Some 1, [], <1 $:= Some (hd i), 2 $:= Some (Num 0)>)\"\n shows \"P (ltl_step drinks (Some 0) <> (l, i))\"\nproof-\n have length_i: \"\\d. (l, i) = (STR ''select'', [d]) \\ length i = 1\"\n by (induct i, auto)\n have length_i_2: \"\\d. i \\ [d] \\ length i \\ 1\"\n by (induct i, auto)\n show ?thesis\n apply (case_tac \"\\d. (l, i) = (STR ''select'', [d])\")\n apply (simp add: possible_steps_0 length_i select_def apply_updates_def)\n using select apply auto[1]\n by (simp add: possible_steps_0_invalid length_i_2 invalid)\nqed\n\nlemma P_ltl_step_1:\n assumes invalid: \"P (None, [], r)\"\n assumes coin: \"l = STR ''coin'' \\ P (Some 1, [value_plus (r $ 2) (Some (hd i))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))\"\n assumes vend_fail: \"value_gt (Some (Num 100)) (r $ 2) = trilean.true \\ P (Some 1, [],r)\"\n assumes vend: \"\\? value_gt (Some (Num 100)) (r $ 2) = trilean.true \\ P (Some 2, [r$1], r)\"\n shows \"P (ltl_step drinks (Some 1) r (l, i))\"\nproof-\n have length_i: \"\\s. \\d. (l, i) = (s, [d]) \\ length i = 1\"\n by (induct i, auto)\n have length_i_2: \"\\d. i \\ [d] \\ length i \\ 1\"\n by (induct i, auto)\n show ?thesis\n apply (case_tac \"\\d. (l, i) = (STR ''coin'', [d])\")\n apply (simp add: possible_steps_1_coin length_i coin_def apply_outputs_def apply_updates_def)\n using coin apply auto[1]\n apply (case_tac \"(l, i) = (STR ''vend'', [])\")\n apply (case_tac \"\\n. r $ 2 = Some (Num n)\")\n apply clarsimp\n apply (case_tac \"n \\ 100\")\n apply (simp add: drinks_vend_sufficient vend_def apply_updates_def apply_outputs_def)\n apply (metis finfun_upd_triv possible_steps_2_vend vend vend_ge_100)\n apply (simp add: drinks_vend_insufficient vend_fail_def apply_updates_def apply_outputs_def)\n apply (metis MaybeBoolInt.simps(1) finfun_upd_triv not_less value_gt_def vend_fail)\n apply (simp add: drinks_vend_invalid invalid)\n by (simp add: drinks_no_possible_steps_1 length_i_2 invalid)\nqed\n\nlemma LTL_r2_not_always_gt_100: \"not (alw (check_exp (Gt (V (Rg 2)) (L (Num 100))))) (watch drinks i)\"\n using value_gt_def by auto\n\nlemma drinks_step_2_none: \"ltl_step drinks (Some 2) r e = (None, [], r)\"\n by (simp add: drinks_end ltl_step_none_2)\n\nlemma one_before_two_2:\n \"alw (\\x. statename (shd (stl x)) = Some 2 \\ statename (shd x) = Some 1) (make_full_observation drinks (Some 2) r [r $ 1] x2a)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (simp add: drinks_step_2_none)\n by (metis (mono_tags, lifting) alw_mono nxt.simps once_none_nxt_always_none option.distinct(1))\nqed\n\nlemma one_before_two_aux:\n assumes \"\\ p r i. j = nxt (make_full_observation drinks (Some 1) r p) i\"\n shows \"alw (\\x. nxt (state_eq (Some 2)) x \\ state_eq (Some 1) x) j\"\n using assms apply(coinduct)\n apply simp\n apply clarify\n apply standard\n apply simp\n apply simp\n apply (case_tac \"shd (stl i)\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n by (simp add: one_before_two_2)\n\nlemma LTL_nxt_2_means_vend:\n \"alw (nxt (state_eq (Some 2)) impl (state_eq (Some 1))) (watch drinks i)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (case_tac \"shd i\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n using one_before_two_aux by auto\nqed\n\nlemma costsMoney_aux:\n assumes \"\\p r i. j = (nxt (make_full_observation drinks (Some 1) r p) i)\"\n shows \"alw (\\xs. nxt (state_eq (Some 2)) xs \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n apply (case_tac \"shd (stl i)\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (metis (no_types, lifting) drinks_step_2_none fst_conv make_full_observation.sel(2) nxt.simps nxt_alw once_none_always_none_aux)\n by simp\n\n(* costsMoney: THEOREM drinks |- G(X(cfstate=State_2) => gval(value_ge(r_2, Some(NUM(100))))); *)\nlemma LTL_costsMoney:\n \"(alw (nxt (state_eq (Some 2)) impl (check_exp (Ge (V (Rg 2)) (L (Num 100)))))) (watch drinks i)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (cases \"shd i\")\n subgoal for l ip\n apply (case_tac \"l = STR ''select'' \\ length ip = 1\")\n defer\n apply (simp add: possible_steps_0_invalid)\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply (simp add: )\n apply (simp add: possible_steps_0 select_def)\n apply (rule disjI2)\n apply (simp only: nxt.simps[symmetric])\n using costsMoney_aux by auto\n done\nqed\n\nlemma LTL_costsMoney_aux:\n \"(alw (not (check_exp (Ge (V (Rg 2)) (L (Num 100)))) impl (not (nxt (state_eq (Some 2)))))) (watch drinks i)\"\n by (metis (no_types, lifting) LTL_costsMoney alw_mono)\n\nlemma implode_select: \"String.implode ''select'' = STR ''select''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_coin: \"String.implode ''coin'' = STR ''coin''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_vend: \"String.implode ''vend'' = STR ''vend''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemmas implode_labels = implode_select implode_coin implode_vend\n\nlemma LTL_neverReachS2:\"(((((action_eq (''select'', [Str ''coke''])))\n aand\n (nxt ((action_eq (''coin'', [Num 100])))))\n aand\n (nxt (nxt((label_eq ''vend'' aand (input_eq []))))))\n impl\n (nxt (nxt (nxt (state_eq (Some 2))))))\n (watch drinks i)\"\n apply (simp add: implode_labels)\n apply (cases i)\n apply clarify\n apply simp\n apply (simp add: possible_steps_0 select_def)\n apply (case_tac \"shd x2\", clarify)\n apply (simp add: possible_steps_1_coin coin_def value_plus_def finfun_update_twist apply_updates_def)\n apply (case_tac \"shd (stl x2)\", clarify)\n by (simp add: drinks_vend_sufficient )\n\nlemma ltl_step_not_select:\n \"\\i. e = (STR ''select'', [i]) \\\n ltl_step drinks (Some 0) r e = (None, [], r)\"\n apply (cases e, clarify)\n apply (rule ltl_step_none)\n apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def select_def)\n by (cases e, case_tac b, auto)\n\nlemma ltl_step_select:\n \"ltl_step drinks (Some 0) <> (STR ''select'', [i]) = (Some 1, [], <1 $:= Some i, 2 $:= Some (Num 0)>)\"\n apply (rule ltl_step_some[of _ _ _ _ _ _ select])\n apply (simp add: possible_steps_0)\n apply (simp add: select_def)\n by (simp add: select_def finfun_update_twist apply_updates_def)\n\nlemma ltl_step_not_coin_or_vend:\n \"\\i. e = (STR ''coin'', [i]) \\\n e \\ (STR ''vend'', []) \\\n ltl_step drinks (Some 1) r e = (None, [], r)\"\n apply (cases e)\n apply (simp del: ltl_step.simps)\n apply (rule ltl_step_none)\n apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def transitions)\n by (case_tac e, case_tac b, auto)\n\nlemma ltl_step_coin:\n \"\\p r'. ltl_step drinks (Some 1) r (STR ''coin'', [i]) = (Some 1, p, r')\"\n by (simp add: possible_steps_1_coin)\n\nlemma alw_tl:\n \"alw \\ (make_full_observation e (Some 0) <> [] xs) \\\n alw \\\n (make_full_observation e (fst (ltl_step e (Some 0) <> (shd xs))) (snd (snd (ltl_step e (Some 0) <> (shd xs))))\n (fst (snd (ltl_step e (Some 0) <> (shd xs)))) (stl xs))\"\n by auto\n\nlemma stop_at_none:\n \"alw (\\xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs)\n (make_full_observation drinks None r p t)\"\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n by simp\n\nlemma drink_costs_money_aux:\n assumes \"\\p r t. j = make_full_observation drinks (Some 1) r p t\"\n shows \"alw (\\xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply (simp add: Str_def value_plus_never_string)\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n by simp\n\nlemma LTL_drinks_cost_money:\n \"alw (nxt (output_eq [Some (Str drink)]) impl (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply simp\n using drink_costs_money_aux\n apply simp\n by blast\nqed\n\nlemma steps_1_invalid:\n \"\\i. (a, b) = (STR ''coin'', [i]) \\\n \\i. (a, b) = (STR ''vend'', []) \\\n possible_steps drinks 1 r a b = {||}\"\n apply (simp add: possible_steps_empty drinks_def transitions can_take_transition_def can_take_def)\n by (induct b, auto)\n\nlemma output_vend_aux:\n assumes \"\\p r t. j = make_full_observation drinks (Some 1) r p t\"\n shows \"alw (\\xs. label_eq ''vend'' xs \\ output (shd (stl xs)) = [Some d] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n apply (case_tac \"shd t\")\n apply (simp add: implode_vend del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n by simp\n\ntext_raw\\\\snip{outputVend}{1}{2}{%\\\nlemma LTL_output_vend:\n \"alw (((label_eq ''vend'') aand (nxt (output_eq [Some d]))) impl\n (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\ntext_raw\\}%endsnip\\\nproof(coinduction)\n case alw\n then show ?case\n apply (simp add: implode_vend)\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply simp\n subgoal for a b\n using output_vend_aux[of \"(make_full_observation drinks (Some 1)\n <1 $:= Some (hd b), 2 $:= Some (Num 0)> [] (stl t))\" d]\n using implode_vend by auto\n done\nqed\n\ntext_raw\\\\snip{outputVendUnfolded}{1}{2}{%\\\nlemma LTL_output_vend_unfolded:\n \"alw (\\xs. (label (shd xs) = STR ''vend'' \\\n nxt (\\s. output (shd s) = [Some d]) xs) \\\n \\? value_gt (Some (Num 100)) (datastate (shd xs) $ 2) = trilean.true)\n (watch drinks t)\"\ntext_raw\\}%endsnip\\\n apply (insert LTL_output_vend[of d t])\n by (simp add: implode_vend)\n\nend\n", "meta": {"author": "jmafoster1", "repo": "efsm-isabelle", "sha": "fde322562b98c9b4618c112e36a6ac5b9a056610", "save_path": "github-repos/isabelle/jmafoster1-efsm-isabelle", "path": "github-repos/isabelle/jmafoster1-efsm-isabelle/efsm-isabelle-fde322562b98c9b4618c112e36a6ac5b9a056610/examples/Drinks_Machine_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.2924877936209498}} {"text": "(* CPS conversion *)\ntheory CPS1_Plotkin\nimports Lt\nbegin\n\nnominal_function\n CPS :: \"lt \\ lt\" (\"_*\" [250] 250)\nwhere\n \"atom k \\ x \\ (x~)* = (Lam k ((k~) $$ (x~)))\"\n| \"atom k \\ (x, M) \\ (Lam x M)* = Lam k (k~ $$ Lam x (M*))\"\n| \"atom k \\ (M, N) \\ atom m \\ (N, k) \\ atom n \\ (k, m) \\\n (M $$ N)* = Lam k (M* $$ Lam m (N* $$ Lam n (m~ $$ n~ $$ k~)))\"\nunfolding eqvt_def CPS_graph_aux_def\napply (simp)\nusing [[simproc del: alpha_lst]]\napply (simp_all add: fresh_Pair_elim)\napply (rule_tac y=\"x\" in lt.exhaust)\napply (auto)[3]\napply (rule_tac x=\"name\" and ?'a=\"name\" in obtain_fresh)\nusing [[simproc del: alpha_lst]]\napply (simp_all add: fresh_at_base)[3]\napply (rule_tac x=\"(lt1, lt2)\" and ?'a=\"name\" in obtain_fresh)\napply (rule_tac x=\"(lt2, a)\" and ?'a=\"name\" in obtain_fresh)\napply (rule_tac x=\"(a, aa)\" and ?'a=\"name\" in obtain_fresh)\napply (simp add: fresh_Pair_elim fresh_at_base)\napply (rule_tac x=\"(name, lt)\" and ?'a=\"name\" in obtain_fresh)\napply (simp add: fresh_Pair_elim fresh_at_base)[2]\napply (simp add: Abs1_eq_iff lt.fresh fresh_at_base)\n--\"-\"\napply(rule_tac s=\"[[atom ka]]lst. ka~ $$ Lam x (CPS_sumC M)\" in trans)\napply (case_tac \"k = ka\")\napply simp\nthm Abs1_eq_iff\napply(subst Abs1_eq_iff)\napply(rule disjI2)\napply(rule conjI)\napply(simp)\napply(rule conjI)\napply (simp only: lt.perm_simps(1) lt.perm_simps(2) flip_def[symmetric] lt.eq_iff)\napply (subst flip_at_base_simps(2))\napply(simp)\napply (intro conjI refl)\napply (rule flip_fresh_fresh[symmetric])\napply (simp_all add: lt.fresh)\napply (metis fresh_eqvt_at lt.fsupp)\napply (case_tac \"ka = x\")\napply simp_all[2]\napply (metis Abs_fresh_iff(3) atom_eq_iff finite_set fresh_Cons fresh_Nil fresh_atom fresh_eqvt_at fresh_finite_atom_set fresh_set lt.fsupp)\napply (metis Abs_fresh_iff(3) atom_eq_iff finite_set fresh_Cons fresh_Nil fresh_atom fresh_eqvt_at fresh_finite_atom_set fresh_set lt.fsupp)\n--\"-\"\napply (simp add: Abs1_eq(3))\napply (erule Abs_lst1_fcb2)\napply (simp_all add: Abs_fresh_iff fresh_Nil fresh_star_def eqvt_at_def)[4]\n--\"-\"\napply (rename_tac k' M N m' n')\napply (subgoal_tac \"atom k \\ CPS_sumC M \\ atom k' \\ CPS_sumC M \\ atom k \\ CPS_sumC N \\ atom k' \\ CPS_sumC N \\\n atom m \\ CPS_sumC N \\ atom m' \\ CPS_sumC N\")\nprefer 2\napply (intro conjI)\napply (erule fresh_eqvt_at, simp add: finite_supp, assumption)+\napply clarify\napply (case_tac \"k = k'\", case_tac [!] \"m' = k\",case_tac [!]\"m = k'\",case_tac[!] \"m = m'\")\napply (simp_all add: Abs1_eq_iff lt.fresh flip_def[symmetric] fresh_at_base flip_fresh_fresh permute_eq_iff)\nby (metis flip_at_base_simps(3) flip_at_simps(2) flip_commute permute_flip_at)+\n\nnominal_termination (eqvt) by lexicographic_order\n\nlemmas [simp] = fresh_Pair_elim CPS.simps(2,3)[simplified fresh_Pair_elim]\n\n\n\nlemma [simp]: \"x \\ M* = x \\ M\"\n unfolding fresh_def by simp\n\nnominal_function\n convert:: \"lt => lt\" (\"_+\" [250] 250)\nwhere\n \"(Var x)+ = Var x\"\n| \"(Lam x M)+ = Lam x (M*)\"\n| \"(M $$ N)+ = M $$ N\"\n unfolding convert_graph_aux_def eqvt_def\n apply (simp)\n apply(rule TrueI)\n apply (erule lt.exhaust)\n using [[simproc del: alpha_lst]]\n apply (simp_all)\n apply (simp add: Abs1_eq_iff CPS.eqvt)\n by blast\n\nnominal_termination (eqvt)\n by (relation \"measure size\") (simp_all)\n\nlemma convert_supp[simp]:\n shows \"supp (M+) = supp M\"\n by (induct M rule: lt.induct, simp_all add: lt.supp)\n\nlemma convert_fresh[simp]:\n shows \"x \\ (M+) = x \\ M\"\n unfolding fresh_def by simp\n\nlemma [simp]:\n shows \"isValue (p \\ (M::lt)) = isValue M\"\n by (nominal_induct M rule: lt.strong_induct) auto\n\nnominal_function\n Kapply :: \"lt \\ lt \\ lt\" (infixl \";\" 100)\nwhere\n \"Kapply (Lam x M) K = K $$ (Lam x M)+\"\n| \"Kapply (Var x) K = K $$ Var x\"\n| \"isValue M \\ isValue N \\ Kapply (M $$ N) K = M+ $$ N+ $$ K\"\n| \"isValue M \\ \\isValue N \\ atom n \\ M \\ atom n \\ K \\\n Kapply (M $$ N) K = N; (Lam n (M+ $$ Var n $$ K))\"\n| \"\\isValue M \\ atom m \\ N \\ atom m \\ K \\ atom n \\ m \\ atom n \\ K \\\n Kapply (M $$ N) K = M; (Lam m (N* $$ (Lam n (Var m $$ Var n $$ K))))\"\n unfolding Kapply_graph_aux_def eqvt_def\n apply (simp)\nusing [[simproc del: alpha_lst]]\napply (simp_all)\napply (case_tac x)\napply (rule_tac y=\"a\" in lt.exhaust)\napply (auto)\napply (case_tac \"isValue lt1\")\napply (case_tac \"isValue lt2\")\napply (auto)[1]\napply (rule_tac x=\"(lt1, ba)\" and ?'a=\"name\" in obtain_fresh)\napply (simp add: fresh_Pair_elim fresh_at_base)\napply (rule_tac x=\"(lt2, ba)\" and ?'a=\"name\" in obtain_fresh)\napply (rule_tac x=\"(a, ba)\" and ?'a=\"name\" in obtain_fresh)\napply (simp add: fresh_Pair_elim fresh_at_base)\napply (auto simp add: Abs1_eq_iff eqvts)[1]\napply (rename_tac M N u K)\napply (subgoal_tac \"Lam n (M+ $$ n~ $$ K) = Lam u (M+ $$ u~ $$ K)\")\napply (simp only:)\napply (auto simp add: Abs1_eq_iff flip_fresh_fresh fresh_at_base)[1]\napply (subgoal_tac \"Lam m (Na* $$ Lam n (m~ $$ n~ $$ Ka)) = Lam ma (Na* $$ Lam na (ma~ $$ na~ $$ Ka))\")\napply (simp only:)\napply (simp add: Abs1_eq_iff flip_fresh_fresh fresh_at_base)\napply (case_tac \"m = ma\")\napply simp_all\napply (case_tac \"m = na\")\napply(simp_all add: flip_fresh_fresh)\ndone\n\nnominal_termination (eqvt)\n by (relation \"measure (\\(t, _). size t)\") (simp_all)\n\nsection{* lemma related to Kapply *}\n\nlemma [simp]: \"isValue V \\ V; K = K $$ (V+)\"\n by (nominal_induct V rule: lt.strong_induct) auto\n\nsection{* lemma related to CPS conversion *}\n\nlemma value_CPS:\n assumes \"isValue V\"\n and \"atom a \\ V\"\n shows \"V* = Lam a (a~ $$ V+)\"\n using assms\nproof (nominal_induct V avoiding: a rule: lt.strong_induct, simp_all add: lt.fresh)\n fix name :: name and lt aa\n assume a: \"atom name \\ aa\" \"\\b. \\isValue lt; atom b \\ lt\\ \\ lt* = Lam b (b~ $$ lt+)\"\n \"atom aa \\ lt \\ aa = name\"\n obtain ab :: name where b: \"atom ab \\ (name, lt, a)\" using obtain_fresh by blast\n show \"Lam name lt* = Lam aa (aa~ $$ Lam name (lt*))\" using a b\n by (simp add: Abs1_eq_iff fresh_at_base lt.fresh)\nqed\n\nsection{* first lemma CPS subst *}\n\nlemma CPS_subst_fv:\n assumes *:\"isValue V\"\n shows \"((M[x ::= V])* = (M*)[x ::= V+])\"\nusing * proof (nominal_induct M avoiding: V x rule: lt.strong_induct)\n case (Var name)\n assume *: \"isValue V\"\n obtain a :: name where a: \"atom a \\ (x, name, V)\" using obtain_fresh by blast\n show \"((name~)[x ::= V])* = (name~)*[x ::= V+]\" using a\n by (simp add: fresh_at_base * value_CPS)\nnext\n case (Lam name lt V x)\n assume *: \"atom name \\ V\" \"atom name \\ x\" \"\\b ba. isValue b \\ (lt[ba ::= b])* = lt*[ba ::= b+]\"\n \"isValue V\"\n obtain a :: name where a: \"atom a \\ (name, lt, lt[x ::= V], x, V)\" using obtain_fresh by blast\n show \"(Lam name lt[x ::= V])* = Lam name lt*[x ::= V+]\" using * a\n by (simp add: fresh_at_base)\nnext\n case (App lt1 lt2 V x)\n assume *: \"\\b ba. isValue b \\ (lt1[ba ::= b])* = lt1*[ba ::= b+]\" \"\\b ba. isValue b \\ (lt2[ba ::= b])* = lt2*[ba ::= b+]\"\n \"isValue V\"\n obtain a :: name where a: \"atom a \\ (lt1[x ::= V], lt1, lt2[x ::= V], lt2, V, x)\" using obtain_fresh by blast\n obtain b :: name where b: \"atom b \\ (lt2[x ::= V], lt2, a, V, x)\" using obtain_fresh by blast\n obtain c :: name where c: \"atom c \\ (a, b, V, x)\" using obtain_fresh by blast\n show \"((lt1 $$ lt2)[x ::= V])* = (lt1 $$ lt2)*[x ::= V+]\" using * a b c\n by (simp add: fresh_at_base)\nqed\n\nlemma [simp]: \"isValue V \\ isValue (V+)\"\n by (nominal_induct V rule: lt.strong_induct, auto)\n\nlemma CPS_eval_Kapply:\n assumes a: \"isValue K\"\n shows \"(M* $$ K) \\\\<^isub>\\\\<^sup>* (M ; K)\"\n using a\nproof (nominal_induct M avoiding: K rule: lt.strong_induct, simp_all)\n case (Var name K)\n assume *: \"isValue K\"\n obtain a :: name where a: \"atom a \\ (name, K)\" using obtain_fresh by blast\n show \"(name~)* $$ K \\\\<^isub>\\\\<^sup>* K $$ name~\" using * a\n by simp (rule evbeta', simp_all add: fresh_at_base)\nnext\n fix name :: name and lt K\n assume *: \"atom name \\ K\" \"\\b. isValue b \\ lt* $$ b \\\\<^isub>\\\\<^sup>* lt ; b\" \"isValue K\"\n obtain a :: name where a: \"atom a \\ (name, K, lt)\" using obtain_fresh by blast\n then have b: \"atom name \\ a\" using fresh_PairD(1) fresh_at_base atom_eq_iff by metis\n show \"Lam name lt* $$ K \\\\<^isub>\\\\<^sup>* K $$ Lam name (lt*)\" using * a b\n by simp (rule evbeta', simp_all)\nnext\n fix lt1 lt2 K\n assume *: \"\\b. isValue b \\ lt1* $$ b \\\\<^isub>\\\\<^sup>* lt1 ; b\" \"\\b. isValue b \\ lt2* $$ b \\\\<^isub>\\\\<^sup>* lt2 ; b\" \"isValue K\"\n obtain a :: name where a: \"atom a \\ (lt1, lt2, K)\" using obtain_fresh by blast\n obtain b :: name where b: \"atom b \\ (lt1, lt2, K, a)\" using obtain_fresh by blast\n obtain c :: name where c: \"atom c \\ (lt1, lt2, K, a, b)\" using obtain_fresh by blast\n have d: \"atom a \\ lt1\" \"atom a \\ lt2\" \"atom a \\ K\" \"atom b \\ lt1\" \"atom b \\ lt2\" \"atom b \\ K\" \"atom b \\ a\"\n \"atom c \\ lt1\" \"atom c \\ lt2\" \"atom c \\ K\" \"atom c \\ a\" \"atom c \\ b\" using fresh_Pair a b c by simp_all\n have \"(lt1 $$ lt2)* $$ K \\\\<^isub>\\\\<^sup>* lt1* $$ Lam b (lt2* $$ Lam c (b~ $$ c~ $$ K))\" using * d\n by (simp add: fresh_at_base) (rule evbeta', simp_all add: fresh_at_base)\n also have \"... \\\\<^isub>\\\\<^sup>* lt1 $$ lt2 ; K\" proof (cases \"isValue lt1\")\n assume e: \"isValue lt1\"\n have \"lt1* $$ Lam b (lt2* $$ Lam c (b~ $$ c~ $$ K)) \\\\<^isub>\\\\<^sup>* Lam b (lt2* $$ Lam c (b~ $$ c~ $$ K)) $$ lt1+\"\n using * d e by simp\n also have \"... \\\\<^isub>\\\\<^sup>* lt2* $$ Lam c (lt1+ $$ c~ $$ K)\"\n by (rule evbeta')(simp_all add: * d e)\n also have \"... \\\\<^isub>\\\\<^sup>* lt1 $$ lt2 ; K\" proof (cases \"isValue lt2\")\n assume f: \"isValue lt2\"\n have \"lt2* $$ Lam c (lt1+ $$ c~ $$ K) \\\\<^isub>\\\\<^sup>* Lam c (lt1+ $$ c~ $$ K) $$ lt2+\" using * d e f by simp\n also have \"... \\\\<^isub>\\\\<^sup>* lt1+ $$ lt2+ $$ K\"\n by (rule evbeta', simp_all add: d e f)\n finally show ?thesis using * d e f by simp\n next\n assume f: \"\\ isValue lt2\"\n have \"lt2* $$ Lam c (lt1+ $$ c~ $$ K) \\\\<^isub>\\\\<^sup>* lt2 ; Lam c (lt1+ $$ c~ $$ K)\" using * d e f by simp\n also have \"... \\\\<^isub>\\\\<^sup>* lt2 ; Lam a (lt1+ $$ a~ $$ K)\" using Kapply.simps(4) d e evs1 f by metis\n finally show ?thesis using * d e f by simp\n qed\n finally show ?thesis .\n qed (metis Kapply.simps(5) isValue.simps(2) * d)\n finally show \"(lt1 $$ lt2)* $$ K \\\\<^isub>\\\\<^sup>* lt1 $$ lt2 ; K\" .\nqed\n\nlemma Kapply_eval:\n assumes a: \"M \\\\<^isub>\\ N\" \"isValue K\"\n shows \"(M; K) \\\\<^isub>\\\\<^sup>* (N; K)\"\n using assms\nproof (induct arbitrary: K rule: eval.induct)\n case (evbeta x V M)\n fix K\n assume a: \"isValue K\" \"isValue V\" \"atom x \\ V\"\n have \"Lam x (M*) $$ V+ $$ K \\\\<^isub>\\\\<^sup>* (((M*)[x ::= V+]) $$ K)\"\n by (rule evs2,rule ev2,rule Lt.evbeta) (simp_all add: fresh_def a[simplified fresh_def] evs1)\n also have \"... = ((M[x ::= V])* $$ K)\" by (simp add: CPS_subst_fv a)\n also have \"... \\\\<^isub>\\\\<^sup>* ((M[x ::= V]) ; K)\" by (rule CPS_eval_Kapply, simp_all add: a)\n finally show \"(Lam x M $$ V ; K) \\\\<^isub>\\\\<^sup>* ((M[x ::= V]) ; K)\" using a by simp\nnext\n case (ev1 V M N)\n fix V M N K\n assume a: \"isValue V\" \"M \\\\<^isub>\\ N\" \"\\K. isValue K \\ M ; K \\\\<^isub>\\\\<^sup>* N ; K\" \"isValue K\"\n obtain a :: name where b: \"atom a \\ (V, K, M, N)\" using obtain_fresh by blast\n show \"V $$ M ; K \\\\<^isub>\\\\<^sup>* V $$ N ; K\" proof (cases \"isValue N\")\n assume \"\\ isValue N\"\n then show \"V $$ M ; K \\\\<^isub>\\\\<^sup>* V $$ N ; K\" using a b by simp\n next\n assume n: \"isValue N\"\n have c: \"M; Lam a (V+ $$ a~ $$ K) \\\\<^isub>\\\\<^sup>* Lam a (V+ $$ a~ $$ K) $$ N+\" using a b by (simp add: n)\n also have d: \"... \\\\<^isub>\\\\<^sup>* V+ $$ N+ $$ K\" by (rule evbeta') (simp_all add: a b n)\n finally show \"V $$ M ; K \\\\<^isub>\\\\<^sup>* V $$ N ; K\" using a b by (simp add: n)\n qed\nnext\n case (ev2 M M' N)\n assume *: \"M \\\\<^isub>\\ M'\" \"\\K. isValue K \\ M ; K \\\\<^isub>\\\\<^sup>* M' ; K\" \"isValue K\"\n obtain a :: name where a: \"atom a \\ (K, M, N, M')\" using obtain_fresh by blast\n obtain b :: name where b: \"atom b \\ (a, K, M, N, M', N+)\" using obtain_fresh by blast\n have d: \"atom a \\ K\" \"atom a \\ M\" \"atom a \\ N\" \"atom a \\ M'\" \"atom b \\ a\" \"atom b \\ K\"\n \"atom b \\ M\" \"atom b \\ N\" \"atom b \\ M'\" using a b fresh_Pair by simp_all\n have \"M $$ N ; K \\\\<^isub>\\\\<^sup>* M' ; Lam a (N* $$ Lam b (a~ $$ b~ $$ K))\" using * d by simp\n also have \"... \\\\<^isub>\\\\<^sup>* M' $$ N ; K\" proof (cases \"isValue M'\")\n assume \"\\ isValue M'\"\n then show ?thesis using * d by (simp_all add: evs1)\n next\n assume e: \"isValue M'\"\n then have \"M' ; Lam a (N* $$ Lam b (a~ $$ b~ $$ K)) = Lam a (N* $$ Lam b (a~ $$ b~ $$ K)) $$ M'+\" by simp\n also have \"... \\\\<^isub>\\\\<^sup>* (N* $$ Lam b (a~ $$ b~ $$ K))[a ::= M'+]\"\n by (rule evbeta') (simp_all add: fresh_at_base e d)\n also have \"... = N* $$ Lam b (M'+ $$ b~ $$ K)\" using * d by (simp add: fresh_at_base)\n also have \"... \\\\<^isub>\\\\<^sup>* M' $$ N ; K\" proof (cases \"isValue N\")\n assume f: \"isValue N\"\n have \"N* $$ Lam b (M'+ $$ b~ $$ K) \\\\<^isub>\\\\<^sup>* Lam b (M'+ $$ b~ $$ K) $$ N+\"\n by (rule eval_trans, rule CPS_eval_Kapply) (simp_all add: d e f * evs1)\n also have \"... \\\\<^isub>\\\\<^sup>* M' $$ N ; K\" by (rule evbeta') (simp_all add: d e f evs1)\n finally show ?thesis .\n next\n assume \"\\ isValue N\"\n then show ?thesis using d e\n by (metis CPS_eval_Kapply Kapply.simps(4) isValue.simps(2))\n qed\n finally show ?thesis .\n qed\n finally show ?case .\nqed\n\nlemma Kapply_eval_rtrancl:\n assumes H: \"M \\\\<^isub>\\\\<^sup>* N\" and \"isValue K\"\n shows \"(M;K) \\\\<^isub>\\\\<^sup>* (N;K)\"\n using H\n by (induct) (metis Kapply_eval assms(2) eval_trans evs1)+\n\nlemma\n assumes \"isValue V\" \"M \\\\<^isub>\\\\<^sup>* V\"\n shows \"M* $$ (Lam x (x~)) \\\\<^isub>\\\\<^sup>* V+\"\nproof-\n obtain y::name where *: \"atom y \\ V\" using obtain_fresh by blast\n have e: \"Lam x (x~) = Lam y (y~)\"\n by (simp add: Abs1_eq_iff lt.fresh fresh_at_base)\n have \"M* $$ Lam x (x~) \\\\<^isub>\\\\<^sup>* M ; Lam x (x~)\"\n by(rule CPS_eval_Kapply,simp_all add: assms)\n also have \"... \\\\<^isub>\\\\<^sup>* (V ; Lam x (x~))\" by (rule Kapply_eval_rtrancl, simp_all add: assms)\n also have \"... = V ; Lam y (y~)\" using e by (simp only:)\n also have \"... \\\\<^isub>\\\\<^sup>* (V+)\" by (simp add: assms, rule evbeta') (simp_all add: assms *)\n finally show \"M* $$ (Lam x (x~)) \\\\<^isub>\\\\<^sup>* (V+)\" .\nqed\n\nend\n\n\n\n", "meta": {"author": "goodlyrottenapple", "repo": "Nominal2-Isabelle", "sha": "214274ed6db74c19b8694fc5c8dd9cafa13b056a", "save_path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle", "path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle/Nominal2-Isabelle-214274ed6db74c19b8694fc5c8dd9cafa13b056a/Nominal/Ex/CPS/CPS1_Plotkin.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.29248779362094973}} {"text": "section \\Set Interface\\\ntheory IICF_Set\nimports \"../../Sepref\"\nbegin\n\nsubsection \\Operations\\\n\ncontext \n notes [simp] = IS_LEFT_UNIQUE_def (* Argh, the set parametricity lemmas use single_valued (K\\) here. *)\nbegin\n\ncontext\n fixes t :: \"unit \\ nat\"\nbegin\n definition \"mop_set_empty = SPECT [ {} \\ enat (t ()) ]\"\n\n lemma mop_set_empty: \"tt \\ lst (SPECT [ {} \\ (t ()) ]) Q \\ tt\n \\ lst (mop_set_empty) Q\" unfolding mop_set_empty_def by simp\n\n sepref_register \"mop_set_empty\" \nend\n\n\ncontext\n fixes t :: \"'c set \\ nat\"\nbegin\n definition \"mop_set_isempty S = SPECT [ S={} \\ t S ]\"\n\n lemma mop_set_isempty: \"tt \\ lst (SPECT [ S={} \\ t S ]) Q\n \\ tt \\ lst (mop_set_isempty S) Q\" unfolding mop_set_isempty_def by simp\n \n sepref_register \"mop_set_isempty\" \nend\n\n\ncontext\n fixes t :: \"'c set \\ nat\"\nbegin\n definition \"mop_set_pick S = do { ASSERT (S\\{}); SPECT (emb (\\x. x\\S) (t S)) }\"\n\n lemma mop_set_pick: \"tt \\ lst (SPECT (emb (\\x. x\\S) (t S))) Q\n \\ S \\ {} \\ tt \\ lst (mop_set_pick S) Q\" unfolding mop_set_pick_def by simp\n\n lemma progress_mop_set_pick[progress_rules]: \"t S > 0 \\ progress (mop_set_pick S)\"\n unfolding mop_set_pick_def by (auto intro!: progress_rules simp add: zero_enat_def) \n\n sepref_register \"mop_set_pick\" \nend\n\ncontext\n fixes t :: \"'c set \\ nat\"\nbegin\n definition \"mop_set_pick_extract S = do { ASSERT (S\\{}); SPECT (emb (\\(x,C). x\\S \\ C=S-{x}) (t S)) }\"\n\n lemma mop_set_pick_extract: \"tt \\ lst (SPECT (emb (\\(x,C). x\\S \\ C=S-{x}) (t S))) Q\n \\ S \\ {} \\ tt \\ lst (mop_set_pick_extract S) Q\" unfolding mop_set_pick_extract_def by simp\n\n thm progress_rules\n\n lemma progress_mop_set_pick_extract[progress_rules]: \"t S > 0 \\ progress (mop_set_pick_extract S)\"\n unfolding mop_set_pick_extract_def by (auto intro!: progress_rules simp add: zero_enat_def) \n\n sepref_register \"mop_set_pick_extract\" \nend\n \n\n\ncontext\n fixes t:: \"('c * 'c set) \\ nat\" \nbegin\n definition \"mop_set_member x S = SPECT [ x \\ S \\ enat (t (x,S)) ]\"\n sepref_register \"mop_set_member\" \n print_theorems \nend\n\n \n\ncontext\n fixes t :: \"('c set * 'c) \\ nat\"\nbegin\n definition \"mop_set_del S x = SPECT [ S - {x} \\ t (S,x)]\"\n\n lemma mop_set_del: \"tt \\ lst (SPECT [ S - {x} \\ t (S,x)]) Q\n \\ tt \\ lst (mop_set_del S x) Q\" unfolding mop_set_del_def by simp\n\n\n lemma progress_mop_set_del[progress_rules]: \"t (S,x) > 0 \\ progress (mop_set_del S x)\"\n unfolding mop_set_del_def by (auto intro: progress_rules simp add: zero_enat_def) \n\n sepref_register \"mop_set_del\" \nend\n\n\ncontext \n fixes t :: \"('c*'c set) \\ nat\"\nbegin\n\n definition \"mop_set_insert x S = SPECT [insert x S \\ t (x,S)]\"\n\n lemma mop_set_insert: \"tt \\ lst (SPECT [ (insert x S) \\ t (x,S)]) Q \\\n tt \\ lst (mop_set_insert x S) Q\" unfolding mop_set_insert_def by simp\n\n sepref_register \"mop_set_insert\" \nend\n\nend\nend\n\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/IICF/Intf/IICF_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2924872866867424}} {"text": "theory Proof_5_8\n imports Proofs_5\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\\n (toEnv\n (setPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR\n Ctrl'emergency))\"\n\ntheorem proof_5_8: \"VC8 inv5 env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n apply(simp only: VC8_def inv5_def R5_def extraInv_def)\n apply(rule impI)\n apply(rule conjI)\n apply(rule conjI)\n apply simp\n apply((rule allI)+)\n apply(rule impI)\n apply((drule conjE)+)\n prefer 31\n apply assumption\n prefer 30\n apply assumption\n prefer 29\n apply assumption\n prefer 28\n apply assumption\n prefer 27\n apply assumption\n prefer 26\n apply assumption\n prefer 25\n apply assumption\n prefer 24\n apply assumption\n prefer 23\n apply assumption\n prefer 22\n apply assumption\n prefer 21\n apply assumption\n prefer 20\n apply assumption\n prefer 19\n apply assumption\n prefer 18\n apply assumption\n prefer 17\n apply assumption\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n subgoal premises prems for s1 s2\n apply(rule disjE[OF le_imp_less_or_eq[OF prems(13)]])\n apply(rule cut_rl[of \" \\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ ERROR \\\n getVarBool s4 up' = DOWN' \\\n getVarBool s4 down' = DOWN' \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\ getVarBool s3 up' = UP' \\ getVarBool s3 down' = UP')\"])\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule exI[of _ s4])\n by simp\n using prems(2) prems(4) prems(6) prems(8) prems(9) prems(11) prems(15) prems(16) apply -[1]\n apply(drule allE[of _ s1])\n prefer 2\n apply assumption\n apply(drule allE[of _ s2])\n prefer 2\n apply assumption\n apply(simp split: if_splits)\n apply(rule cut_rl[of \"\\ s5. toEnvP s5 \\ substate s2 s5 \\ substate s5\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \\\n pred5 s1 s2\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s5\"])\n apply(drule allE[of _ s2])\n prefer 2\n apply assumption\n apply(drule impE)\n prefer 3\n apply assumption\n using prems(4,8) substate_refl apply fast\n apply(simp only: pred5_def)\n apply(drule impE)\n prefer 3\n apply assumption\n using prems(2) prems(4) prems(6) prems(8) prems(9) prems(15) prems(16) substate_refl substate_trans substate_antisym\n apply blast\n apply fast\n apply(rule allI)\n subgoal premises toEnvNums2s for s5\n apply(induction rule: state_down_ind)\n using prems(8) apply simp\n apply(simp only: pred5_def)\n apply(rule impI)\n apply((drule conjE)+)\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n\n apply(rule cut_rl[of\n \"\\s4. toEnvP s4 \\ substate s4 s0 \\ toEnvNum s4 s0 \\ ERROR \\ getVarBool s4 up' = DOWN' \\ getVarBool s4 down' = DOWN'\"])\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule disjE[of \"toEnvNum s4 s0 < 1\" \"toEnvNum s4 s0 = 1\"])\n apply(rule le_imp_less_or_eq)\n apply fast\n apply (metis getPstate.simps(9) less_one prems(10) prems(30) prems(5) substate_toEnvNum_id)\n apply(rule cut_rl[of \"s4 = s1\"])\n apply simp\n apply (simp split: if_splits)\n using toEnvNum3 substate_toEnvNum_id gtimeE_inj\n by (metis prems(10) shift_toEnvNum) \n apply(rule goUp_not_moving[of s2 _ s0])\n apply(rule conjI)\n apply assumption\n apply(rule conjI)\n using prems(10) apply fast\n apply(rule conjI)\n apply (simp split: if_splits)\n apply(rule conjI)\n using substate_refl apply fast\n apply(rule conjI)\n apply(simp split: if_splits)\n apply(rule conjI)\n apply assumption\n apply(rule conjI)\n using prems(5) apply simp\n using prems apply fast\n\n subgoal for s5\n apply(simp only: pred5_def)\n apply(rule impI)\n apply(cases \"getVarBool (predEnv s5) up' = False \\ getVarBool (predEnv s5) down' = False\")\n apply(rule exI[of _ \"predEnv s5\"])\n apply(rule conjI)\n apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n apply blast\n apply(rule conjI)\n using substate_refl apply simp\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(rule conjI)\n using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"]\n apply force\n apply(rule conjI)\n apply fast\n apply(rule conjI)\n apply fast\n using substate_antisym apply fast\n apply(drule impE)\n apply(((rule conjI),blast)+)\n using substate_eq_or_predEnv apply blast\n prefer 2\n apply assumption\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule exI[of _ s4])\n apply(rule conjI)\n apply blast\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(((rule conjI),blast)+)\n apply((drule conjE)+)\n prefer 20\n apply assumption\n prefer 19\n apply assumption\n prefer 18\n apply assumption\n prefer 17\n apply assumption\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n using predEnv_substate_imp_eq_or_substate by blast\n done\n done\n done\n \n\n \n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Proof_5_8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.61878043374385, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.29248728668674234}} {"text": "theory flash imports flashMainLemma\nbegin\n\nlemma main:\n assumes a1:\"s \\ reachableSet {andList (allIniSpecs N)} (rules N)\" and a2:\"0invf. invf \\(invariants N)\\formEval invf s\"\nproof(rule newconsistentLemma)\n show \"newconsistent (invariants N) {andList (allIniSpecs N)}(rules N)\"\n proof(cut_tac a1, unfold newconsistent_def,rule conjI)\n show \" \\invf ini s. invf \\(invariants N)\\ ini \\{andList (allIniSpecs N)}\\ formEval ini s\\ formEval invf s\"\n proof((rule allI)+,(rule impI)+)\n fix invf ini s \n assume b1:\"invf \\(invariants N) \" and b2:\"ini \\ {andList (allIniSpecs N)} \" and b3:\"formEval ini s\"\n \n have b4:\"formEval (andList (allIniSpecs N)) s\"\n by(cut_tac b2 b3,simp)\n\n show \"formEval invf s\"\n proof - \n \n have c1:\" ex2P N (% iInv1 iInv2 . invf= inv1 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv2 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv3 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv4 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv5 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv6 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv7 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv8 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv9 iInv1 ) \\ ex1P N (% iInv1 . invf= inv10 iInv1 ) \\ ex2P N (% iInv1 iInv2 . invf= inv11 iInv1 iInv2 ) \\ ex0P N ( invf= inv12 ) \\ ex1P N (% iInv1 . invf= inv13 iInv1 ) \\ ex1P N (% iInv1 . invf= inv14 iInv1 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv15 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv16 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv17 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv18 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv19 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv20 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv21 iInv1 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv22 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv23 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv24 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv25 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv26 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv27 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv28 iInv1 ) \\ ex1P N (% iInv1 . invf= inv29 iInv1 ) \\ ex1P N (% iInv1 . invf= inv30 iInv1 ) \\ ex1P N (% iInv1 . invf= inv31 iInv1 ) \\ ex1P N (% iInv1 . invf= inv32 iInv1 ) \\ ex1P N (% iInv1 . invf= inv33 iInv1 ) \\ ex1P N (% iInv1 . invf= inv34 iInv1 ) \\ ex1P N (% iInv1 . invf= inv35 iInv1 ) \\ ex1P N (% iInv1 . invf= inv36 iInv1 ) \\ ex0P N ( invf= inv37 ) \\ ex0P N ( invf= inv38 ) \\ ex0P N ( invf= inv39 ) \\ ex1P N (% iInv1 . invf= inv40 iInv1 ) \\ ex2P N (% iInv1 iInv2 . invf= inv41 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv42 iInv1 iInv2 iInv3 ) \\ ex0P N ( invf= inv43 ) \\ ex2P N (% iInv1 iInv2 . invf= inv44 iInv1 iInv2 ) \\ ex0P N ( invf= inv45 ) \\ ex2P N (% iInv1 iInv2 . invf= inv46 iInv1 iInv2 ) \\ ex0P N ( invf= inv47 ) \\ ex2P N (% iInv1 iInv2 . invf= inv48 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv49 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv50 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv51 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv52 iInv1 iInv2 iInv3 ) \\ ex0P N ( invf= inv53 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv54 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv55 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv56 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv57 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv58 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv59 iInv1 iInv2 iInv3 ) \\ ex1P N (% iInv1 . invf= inv60 iInv1 ) \\ ex1P N (% iInv1 . invf= inv61 iInv1 ) \\ ex1P N (% iInv1 . invf= inv62 iInv1 ) \\ ex1P N (% iInv1 . invf= inv63 iInv1 ) \\ ex1P N (% iInv1 . invf= inv64 iInv1 ) \\ ex1P N (% iInv1 . invf= inv65 iInv1 ) \\ ex0P N ( invf= inv66 ) \\ ex0P N ( invf= inv67 ) \\ ex2P N (% iInv1 iInv2 . invf= inv68 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv69 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv70 iInv1 iInv2 ) \\ ex0P N ( invf= inv71 ) \\ ex0P N ( invf= inv72 ) \\ ex0P N ( invf= inv73 ) \\ ex0P N ( invf= inv74 ) \\ ex0P N ( invf= inv75 ) \\ ex0P N ( invf= inv76 ) \\ ex2P N (% iInv1 iInv2 . invf= inv77 iInv1 iInv2 ) \\ ex0P N ( invf= inv78 ) \\ ex2P N (% iInv1 iInv2 . invf= inv79 iInv1 iInv2 ) \\ ex0P N ( invf= inv80 ) \\ ex0P N ( invf= inv81 ) \\ ex1P N (% iInv1 . invf= inv82 iInv1 ) \\ ex0P N ( invf= inv83 ) \\ ex0P N ( invf= inv84 ) \\ ex0P N ( invf= inv85 ) \\ ex0P N ( invf= inv86 ) \\ ex2P N (% iInv1 iInv2 . invf= inv87 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv88 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv89 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv90 iInv1 iInv2 ) \\ ex0P N ( invf= inv91 ) \\ ex0P N ( invf= inv92 ) \\ ex0P N ( invf= inv93 ) \\ ex0P N ( invf= inv94 ) \\ ex0P N ( invf= inv95 ) \\ ex0P N ( invf= inv96 ) \\ ex0P N ( invf= inv97 ) \\ ex0P N ( invf= inv98 ) \\ ex0P N ( invf= inv99 ) \\ ex0P N ( invf= inv100 ) \\ ex1P N (% iInv1 . invf= inv101 iInv1 ) \\ ex0P N ( invf= inv102 ) \\ ex0P N ( invf= inv103 ) \\ ex2P N (% iInv1 iInv2 . invf= inv104 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv105 iInv1 iInv2 ) \\ ex0P N ( invf= inv106 ) \\ ex0P N ( invf= inv107 ) \\ ex0P N ( invf= inv108 ) \\ ex0P N ( invf= inv109 ) \\ ex0P N ( invf= inv110 ) \\ ex0P N ( invf= inv111 ) \\ ex0P N ( invf= inv112 ) \\ ex0P N ( invf= inv113 ) \"\n by (cut_tac b1, simp ) moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv1 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv1.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv2 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv2.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv3 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv3.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv4 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv4.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv5 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv5.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv6 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv6.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv7 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv7.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv8 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv8.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv9 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv9.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv10 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv10.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv11 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv11.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv12 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv12.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv13 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv13.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv14 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv14.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv15 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv15.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv16 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv16.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv17 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv17.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv18 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv18.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv19 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv19.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv20 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv20.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv21 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv21.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv22 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv22.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv23 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv23.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv24 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv24.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv25 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv25.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv26 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv26.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv27 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv27.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv28 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv28.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv29 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv29.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv30 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv30.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv31 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv31.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv32 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv32.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv33 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv33.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv34 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv34.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv35 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv35.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv36 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv36.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv37 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv37.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv38 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv38.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv39 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv39.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv40 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv40.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv41 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv41.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv42 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv42.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv43 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv43.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv44 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv44.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv45 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv45.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv46 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv46.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv47 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv47.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv48 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv48.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv49 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv49.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv50 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv50.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv51 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv51.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv52 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv52.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv53 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv53.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv54 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv54.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv55 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv55.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv56 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv56.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv57 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv57.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv58 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv58.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex3P N (% iInv1 iInv2 iInv3 . invf= inv59 iInv1 iInv2 iInv3 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv59.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv60 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv60.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv61 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv61.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv62 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv62.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv63 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv63.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv64 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv64.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv65 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv65.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv66 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv66.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv67 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv67.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv68 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv68.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv69 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv69.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv70 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv70.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv71 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv71.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv72 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv72.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv73 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv73.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv74 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv74.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv75 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv75.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv76 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv76.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv77 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv77.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv78 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv78.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv79 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv79.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv80 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv80.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv81 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv81.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv82 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv82.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv83 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv83.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv84 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv84.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv85 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv85.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv86 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv86.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv87 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv87.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv88 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv88.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv89 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv89.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv90 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv90.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv91 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv91.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv92 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv92.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv93 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv93.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv94 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv94.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv95 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv95.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv96 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv96.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv97 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv97.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv98 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv98.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv99 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv99.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv100 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv100.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex1P N (% iInv1 . invf= inv101 iInv1 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv101.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv102 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv102.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv103 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv103.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv104 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv104.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex2P N (% iInv1 iInv2 . invf= inv105 iInv1 iInv2 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv105.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv106 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv106.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv107 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv107.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv108 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv108.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv109 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv109.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv110 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv110.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv111 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv111.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv112 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv112.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n moreover\n {assume d1: \" ex0P N ( invf= inv113 ) \"\n\n have \"formEval invf s\"\n\n by(metis b4 d1 iniImply_inv113.iniImplyInv)\n (* apply(cut_tac d1,assumption)\n by (cut_tac b4,simp)*)\n }\n\n ultimately show \"formEval invf s\"\n by blast\n qed\n qed\nnext\n show \"\\invf r s. invf \\ invariants N\\ r \\rules N\\ invHoldForRule' s invf r (invariants N) \"\n \n\n proof((rule allI)+,(rule impI)+)\n fix invf r s\n assume b1:\"invf \\ invariants N\" and b2:\"r \\ rules N\"\n show \"invHoldForRule' s invf r (invariants N) \"\n by (metis mainLemma b1 b2) \n qed\nqed\nnext\n show \"s \\ reachableSet {andList (allIniSpecs N)} (rules N)\"\nby (metis a1)\n \n \nqed\nend \n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2924350585921213}} {"text": "section \\Operation Identification Phase\\\ntheory Sepref_Id_Op\nimports \n Main \n Automatic_Refinement.Refine_Lib\n Automatic_Refinement.Autoref_Tagging\n Refine_Imperative_HOL.Named_Theorems_Rev\nbegin\n\ntext \\\n The operation identification phase is adapted from the Autoref tool.\n The basic idea is to have a type system, which works on so called \n interface types (also called conceptual types). Each conceptual type\n denotes an abstract data type, e.g., set, map, priority queue.\n \n Each abstract operation, which must be a constant applied to its arguments,\n is assigned a conceptual type. Additionally, there is a set of \n {\\emph pattern rewrite rules},\n which are applied to subterms before type inference takes place, and \n which may be backtracked over. \n This way, encodings of abstract operations in Isabelle/HOL, like \n @{term [source] \"\\_. None\"} for the empty map, \n or @{term [source] \"fun_upd m k (Some v)\"} for map update, can be rewritten\n to abstract operations, and get properly typed.\n\\\n\nsubsection \"Proper Protection of Term\"\ntext \\ The following constants are meant to encode abstraction and \n application as proper HOL-constants, and thus avoid strange effects with\n HOL's higher-order unification heuristics and automatic \n beta and eta-contraction.\n\n The first step of operation identification is to protect the term\n by replacing all function applications and abstractions be \n the constants defined below.\n\\\n\ndefinition [simp]: \"PROTECT2 x (y::prop) \\ x\"\nconsts DUMMY :: \"prop\"\n\nabbreviation PROTECT2_syn (\"'(#_#')\") where \"PROTECT2_syn t \\ PROTECT2 t DUMMY\"\n\nabbreviation (input)ABS2 :: \"('a\\'b)\\'a\\'b\" (binder \"\\\\<^sub>2\" 10)\n where \"ABS2 f \\ (\\x. PROTECT2 (f x) DUMMY)\"\n\nlemma beta: \"(\\\\<^sub>2x. f x)$x \\ f x\" by simp\n\ntext \\\n Another version of @{const \"APP\"}. Treated like @{const APP} by our tool.\n Required to avoid infinite pattern rewriting in some cases, e.g., map-lookup.\n\\\n\ndefinition APP' (infixl \"$''\" 900) where [simp, autoref_tag_defs]: \"f$'a \\ f a\"\n\ntext \\\n Sometimes, whole terms should be protected from being processed by our tool.\n For example, our tool should not look into numerals. For this reason,\n the \\PR_CONST\\ tag indicates terms that our tool shall handle as\n atomic constants, an never look into them.\n\n The special form \\UNPROTECT\\ can be used inside pattern rewrite rules.\n It has the effect to revert the protection from its argument, and then wrap\n it into a \\PR_CONST\\.\n\\\ndefinition [simp, autoref_tag_defs]: \"PR_CONST x \\ x\" \\ \\Tag to protect constant\\\ndefinition [simp, autoref_tag_defs]: \"UNPROTECT x \\ x\" \\ \\Gets \n converted to @{term PR_CONST}, after unprotecting its content\\\n\n\nsubsection \\Operation Identification\\\n\ntext \\ Indicator predicate for conceptual typing of a constant \\\ndefinition intf_type :: \"'a \\ 'b itself \\ bool\" (infix \"::\\<^sub>i\" 10) where\n [simp]: \"c::\\<^sub>iI \\ True\"\n\nlemma itypeI: \"c::\\<^sub>iI\" by simp\nlemma itypeI': \"intf_type c TYPE('T)\" by (rule itypeI)\n\nlemma itype_self: \"(c::'a) ::\\<^sub>i TYPE('a)\" by simp\n\ndefinition CTYPE_ANNOT :: \"'b \\ 'a itself \\ 'b\" (infix \":::\\<^sub>i\" 10) where\n [simp]: \"c:::\\<^sub>iI \\ c\"\n\ntext \\ Wrapper predicate for an conceptual type inference \\\ndefinition ID :: \"'a \\ 'a \\ 'c itself \\ bool\" \n where [simp]: \"ID t t' T \\ t=t'\"\n\nsubsubsection \\Conceptual Typing Rules\\\n\nlemma ID_unfold_vars: \"ID x y T \\ x\\y\" by simp\nlemma ID_PR_CONST_trigger: \"ID (PR_CONST x) y T \\ ID (PR_CONST x) y T\" .\n\nlemma pat_rule:\n \"\\ p\\p'; ID p' t' T \\ \\ ID p t' T\" by simp\n\nlemma app_rule:\n \"\\ ID f f' TYPE('a\\'b); ID x x' TYPE('a)\\ \\ ID (f$x) (f'$x') TYPE('b)\"\n by simp\n\nlemma app'_rule:\n \"\\ ID f f' TYPE('a\\'b); ID x x' TYPE('a)\\ \\ ID (f$'x) (f'$x') TYPE('b)\"\n by simp\n\nlemma abs_rule:\n \"\\ \\x x'. ID x x' TYPE('a) \\ ID (t x) (t' x x') TYPE('b) \\ \\\n ID (\\\\<^sub>2x. t x) (\\\\<^sub>2x'. t' x' x') TYPE('a\\'b)\"\n by simp\n\nlemma id_rule: \"c::\\<^sub>iI \\ ID c c I\" by simp\n\nlemma annot_rule: \"ID t t' I \\ ID (t:::\\<^sub>iI) t' I\"\n by simp\n\nlemma fallback_rule:\n \"ID (c::'a) c TYPE('c)\"\n by simp\n\nlemma unprotect_rl1: \"ID (PR_CONST x) t T \\ ID (UNPROTECT x) t T\"\n by simp\n\nsubsection \\ ML-Level code \\\nML \\\ninfix 0 THEN_ELSE_COMB'\n\nsignature ID_OP_TACTICAL = sig\n val SOLVE_FWD: tactic' -> tactic'\n val DF_SOLVE_FWD: bool -> tactic' -> tactic'\nend\n\nstructure Id_Op_Tactical :ID_OP_TACTICAL = struct\n\n fun SOLVE_FWD tac i st = SOLVED' (\n tac \n THEN_ALL_NEW_FWD (SOLVE_FWD tac)) i st\n\n\n (* Search for solution with DFS-strategy. If dbg-flag is given,\n return sequence of stuck states if no solution is found.\n *)\n fun DF_SOLVE_FWD dbg tac = let\n val stuck_list_ref = Unsynchronized.ref []\n\n fun stuck_tac _ st = if dbg then (\n stuck_list_ref := st :: !stuck_list_ref;\n Seq.empty\n ) else Seq.empty\n\n fun rec_tac i st = (\n (tac THEN_ALL_NEW_FWD (SOLVED' rec_tac))\n ORELSE' stuck_tac\n ) i st\n\n fun fail_tac _ _ = if dbg then\n Seq.of_list (rev (!stuck_list_ref))\n else Seq.empty\n in\n rec_tac ORELSE' fail_tac \n end\n\nend\n\\\n\n\nnamed_theorems_rev id_rules \"Operation identification rules\"\nnamed_theorems_rev pat_rules \"Operation pattern rules\"\nnamed_theorems_rev def_pat_rules \"Definite operation pattern rules (not backtracked over)\"\n\n\n\nML \\\n\n structure Id_Op = struct\n\n fun id_a_conv cnv ct = case Thm.term_of ct of\n @{mpat \"ID _ _ _\"} => Conv.fun_conv (Conv.fun_conv (Conv.arg_conv cnv)) ct\n | _ => raise CTERM(\"id_a_conv\",[ct])\n\n fun \n protect env (@{mpat \"?t:::\\<^sub>i?I\"}) = let\n val t = protect env t\n in \n @{mk_term env: \"?t:::\\<^sub>i?I\"}\n end\n | protect _ (t as @{mpat \"PR_CONST _\"}) = t\n | protect env (t1$t2) = let\n val t1 = protect env t1\n val t2 = protect env t2\n in\n @{mk_term env: \"?t1.0 $ ?t2.0\"}\n end\n | protect env (Abs (x,T,t)) = let\n val t = protect (T::env) t\n in\n @{mk_term env: \"\\v_x::?'v_T. PROTECT2 ?t DUMMY\"}\n end\n | protect _ t = t\n\n fun protect_conv ctxt = Refine_Util.f_tac_conv ctxt\n (protect []) \n (simp_tac \n (put_simpset HOL_basic_ss ctxt addsimps @{thms PROTECT2_def APP_def}) 1)\n\n fun unprotect_conv ctxt\n = Simplifier.rewrite (put_simpset HOL_basic_ss ctxt \n addsimps @{thms PROTECT2_def APP_def})\n\n fun do_unprotect_tac ctxt =\n resolve_tac ctxt @{thms unprotect_rl1} THEN'\n CONVERSION (Refine_Util.HOL_concl_conv (fn ctxt => id_a_conv (unprotect_conv ctxt)) ctxt)\n\n val cfg_id_debug = \n Attrib.setup_config_bool @{binding id_debug} (K false)\n\n val cfg_id_trace_fallback = \n Attrib.setup_config_bool @{binding id_trace_fallback} (K false)\n\n fun dest_id_rl thm = case Thm.concl_of thm of\n @{mpat (typs) \"Trueprop (?c::\\<^sub>iTYPE(?'v_T))\"} => (c,T)\n | _ => raise THM(\"dest_id_rl\",~1,[thm])\n\n \n val add_id_rule = snd oo Thm.proof_attributes [Named_Theorems_Rev.add @{named_theorems_rev id_rules}]\n\n datatype id_tac_mode = Init | Step | Normal | Solve\n\n fun id_tac ss ctxt = let\n open Id_Op_Tactical\n val certT = Thm.ctyp_of ctxt\n val cert = Thm.cterm_of ctxt\n\n val thy = Proof_Context.theory_of ctxt\n\n val id_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev id_rules}\n val pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev pat_rules}\n val def_pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev def_pat_rules}\n\n val rl_net = Tactic.build_net (\n (pat_rules |> map (fn thm => thm RS @{thm pat_rule})) \n @ @{thms annot_rule app_rule app'_rule abs_rule} \n @ (id_rules |> map (fn thm => thm RS @{thm id_rule}))\n )\n\n val def_rl_net = Tactic.build_net (\n (def_pat_rules |> map (fn thm => thm RS @{thm pat_rule}))\n ) \n\n val id_pr_const_rename_tac = \n resolve_tac ctxt @{thms ID_PR_CONST_trigger} THEN'\n Subgoal.FOCUS (fn { context=ctxt, prems, ... } => \n let\n fun is_ID @{mpat \"Trueprop (ID _ _ _)\"} = true | is_ID _ = false\n val prems = filter (Thm.prop_of #> is_ID) prems\n val eqs = map (fn thm => thm RS @{thm ID_unfold_vars}) prems\n val conv = Conv.rewrs_conv eqs\n val conv = fn ctxt => (Conv.top_sweep_conv (K conv) ctxt)\n val conv = fn ctxt => Conv.fun2_conv (Conv.arg_conv (conv ctxt))\n val conv = Refine_Util.HOL_concl_conv conv ctxt\n in CONVERSION conv 1 end \n ) ctxt THEN'\n resolve_tac ctxt @{thms id_rule} THEN'\n resolve_tac ctxt id_rules \n\n val ityping = id_rules \n |> map dest_id_rl\n |> filter (is_Const o #1)\n |> map (apfst (#1 o dest_Const))\n |> Symtab.make_list\n\n val has_type = Symtab.defined ityping\n\n fun mk_fallback name cT =\n case try (Sign.the_const_constraint thy) name of\n SOME T => try (Thm.instantiate' \n [SOME (certT cT), SOME (certT T)] [SOME (cert (Const (name,cT)))])\n @{thm fallback_rule} \n | NONE => NONE\n\n fun trace_fallback thm = \n Config.get ctxt cfg_id_trace_fallback \n andalso let \n open Pretty\n val p = block [str \"ID_OP: Applying fallback rule: \", Thm.pretty_thm ctxt thm]\n in \n string_of p |> tracing; \n false\n end \n\n val fallback_tac = CONVERSION Thm.eta_conversion THEN' IF_EXGOAL (fn i => fn st =>\n case Logic.concl_of_goal (Thm.prop_of st) i of\n @{mpat \"Trueprop (ID (mpaq_STRUCT (mpaq_Const ?name ?cT)) _ _)\"} => (\n if not (has_type name) then \n case mk_fallback name cT of\n SOME thm => (trace_fallback thm; resolve_tac ctxt [thm] i st)\n | NONE => Seq.empty \n else Seq.empty\n )\n | _ => Seq.empty)\n\n val init_tac = CONVERSION (\n Refine_Util.HOL_concl_conv (fn ctxt => (id_a_conv (protect_conv ctxt))) \n ctxt\n )\n\n val step_tac = (FIRST' [\n assume_tac ctxt, \n eresolve_tac ctxt @{thms id_rule},\n resolve_from_net_tac ctxt def_rl_net, \n resolve_from_net_tac ctxt rl_net, \n id_pr_const_rename_tac,\n do_unprotect_tac ctxt, \n fallback_tac])\n\n val solve_tac = DF_SOLVE_FWD (Config.get ctxt cfg_id_debug) step_tac \n\n in\n case ss of\n Init => init_tac \n | Step => step_tac \n | Normal => init_tac THEN' solve_tac\n | Solve => solve_tac\n\n end\n\n end\n\n\\\n\nsubsection \\Default Setup\\\n\nsubsubsection \\Numerals\\ \nlemma pat_numeral[def_pat_rules]: \"numeral$x \\ UNPROTECT (numeral$x)\" by simp\n\nlemma id_nat_const[id_rules]: \"(PR_CONST (a::nat)) ::\\<^sub>i TYPE(nat)\" by simp\nlemma id_int_const[id_rules]: \"(PR_CONST (a::int)) ::\\<^sub>i TYPE(int)\" by simp\n\n(*subsection \\Example\\\nschematic_lemma \n \"ID (\\a b. (b(1::int\\2::nat) |`(-{3})) a, Map.empty, \\a. case a of None \\ Some a | Some _ \\ None) (?c) (?T::?'d itself)\"\n (*\"TERM (?c,?T)\"*)\n using [[id_debug]]\n apply (tactic {* Id_Op.id_tac Id_Op.Normal @{context} 1 *}) \n done\n*)\n\nend\n\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/Sepref_Id_Op.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2923814378995846}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | November 2004 |\n | July 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Trace_par\nimports Prefix\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n 1. s |[X]|list t : lists --> list set\n 2. s |[X]|tr t : traces --> trace set\n 3. \n 4. \n\n *****************************************************************)\n\n(* Isabelle 2005\nconsts\n parx :: \"'a set => ('a trace * 'a trace * 'a trace) set\"\n\ninductive \"parx X\"\nintros\nparx_nil_nil: \n \"(<>, <>, <>) : parx X\"\n\nparx_Tick_Tick: \n \"(, , ) : parx X\"\n\nparx_Ev_nil: \n \"[| (u, s, <>) : parx X ; a ~: X |]\n ==> ( ^^^ u, ^^^ s, <>) : parx X\"\n\nparx_nil_Ev: \n \"[| (u, <>, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, <>, ^^^ t) : parx X\"\n\nparx_Ev_sync: \n \"[| (u, s, t) : parx X ; a : X |]\n ==> ( ^^^ u, ^^^ s, ^^^ t) : parx X\"\n\nparx_Ev_left: \n \"[| (u, s, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, ^^^ s, t) : parx X\"\n\nparx_Ev_right: \n \"[| (u, s, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, s, ^^^ t) : parx X\"\n*)\n\n\ninductive_set\n parx :: \"'a set => ('a trace * 'a trace * 'a trace) set\"\n for X :: \"'a set\"\n\nwhere\nparx_nil_nil: \n \"(<>, <>, <>) : parx X\" |\n\nparx_Tick_Tick: \n \"(, , ) : parx X\" |\n\nparx_Ev_nil: \n \"[| (u, s, <>) : parx X ; a ~: X |]\n ==> ( ^^^ u, ^^^ s, <>) : parx X\" |\n\nparx_nil_Ev: \n \"[| (u, <>, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, <>, ^^^ t) : parx X\" |\n\nparx_Ev_sync: \n \"[| (u, s, t) : parx X ; a : X |]\n ==> ( ^^^ u, ^^^ s, ^^^ t) : parx X\" |\n\nparx_Ev_left: \n \"[| (u, s, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, ^^^ s, t) : parx X\" |\n\nparx_Ev_right: \n \"[| (u, s, t) : parx X ; a ~: X |]\n ==> ( ^^^ u, s, ^^^ t) : parx X\"\n\ndefinition\n par_tr :: \"'a trace => 'a set => 'a trace => 'a trace set\"\n (\"(_ |[_]|tr _)\" [76,0,77] 76)\n where\n par_tr_def : \"s |[X]|tr t == {u. (u, s, t) : parx X}\"\n\nlemma par_tr_defE: \"[| u : s |[X]|tr t ; (u, s, t) : parx X ==> R |] ==> R\"\nby (simp add: par_tr_def)\n\n(*************************************************************\n par_tr intros and elims\n *************************************************************)\n\n(*-------------------*\n | intros |\n *-------------------*)\n\nlemma par_tr_nil_nil: \n \"<> : <> |[X]|tr <>\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_Tick_Tick: \n \" : |[X]|tr \"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_Ev_nil: \n \"[| u : s |[X]|tr <> ; a ~: X |]\n ==> ^^^ u : ( ^^^ s) |[X]|tr <>\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_nil_Ev: \n \"[| u : <> |[X]|tr t ; a ~: X |]\n ==> ^^^ u : <> |[X]|tr ( ^^^ t)\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_Ev_sync: \n \"[| u : s |[X]|tr t ; a : X |]\n ==> ^^^ u : ( ^^^ s) |[X]|tr ( ^^^ t)\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_Ev_left: \n \"[| u : s |[X]|tr t ; a ~: X |]\n ==> ^^^ u : ( ^^^ s) |[X]|tr t\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\nlemma par_tr_Ev_right: \n \"[| u : s |[X]|tr t ; a ~: X |]\n ==> ^^^ u : s |[X]|tr ( ^^^ t)\"\napply (simp add: par_tr_def)\nby (simp add: parx.intros)\n\n(*** intro rule ***)\n\nlemmas par_tr_intros =\n par_tr_nil_nil\n par_tr_Tick_Tick\n par_tr_Ev_nil\n par_tr_nil_Ev\n par_tr_Ev_sync\n par_tr_Ev_left\n par_tr_Ev_right\n\n(*-------------------*\n | elims |\n *-------------------*)\n\nlemma par_tr_elims_lm:\n \"[| u : s |[X]|tr t ;\n (u = <> & s = <> & t = <>) --> P ;\n (u = & s = & t = ) --> P ;\n ALL a s' u'.\n (u = ^^^ u' & s = ^^^ s' & t = <> &\n u' : s' |[X]|tr <> & a ~: X)\n --> P;\n ALL a t' u'.\n (u = ^^^ u' & s = <> & t = ^^^ t' & \n u' : <> |[X]|tr t' & a ~: X)\n --> P;\n ALL a s' t' u'.\n (u = ^^^ u' & s = ^^^ s' & t = ^^^ t' &\n u' : s' |[X]|tr t' & a : X)\n --> P;\n ALL a s' u'.\n (u = ^^^ u' & s = ^^^ s' &\n u' : s' |[X]|tr t & a ~: X)\n --> P;\n ALL a t' u'.\n (u = ^^^ u' & t = ^^^ t' & \n u' : s |[X]|tr t' & a ~: X)\n --> P |]\n ==> P\"\napply (simp add: par_tr_def)\napply (erule parx.cases) (* .elims --> .cases *)\napply (simp_all)\ndone\n\n(*** elim rule ***)\n\nlemma par_tr_elims:\n \"[| u : s |[X]|tr t ;\n [| u = <>; s = <>; t = <> |] ==> P ;\n [| u = ; s = ; t = |] ==> P ;\n !!a s' u'.\n [| u = ^^^ u'; s = ^^^ s'; t = <> ; \n u' : s' |[X]|tr <>; a ~: X |]\n ==> P;\n !!a t' u'.\n [| u = ^^^ u' ; s = <> ; t = ^^^ t' ; \n u' : <> |[X]|tr t'; a ~: X |]\n ==> P;\n !!a s' t' u'.\n [| u = ^^^ u' ; s = ^^^ s' ; t = ^^^ t' ;\n u' : s' |[X]|tr t'; a : X |]\n ==> P;\n !!a s' u'.\n [| u = ^^^ u' ; s = ^^^ s' ; \n u' : s' |[X]|tr t; a ~: X |]\n ==> P;\n !!a t' u'.\n [| u = ^^^ u' ; t = ^^^ t' ; \n u' : s |[X]|tr t'; a ~: X |]\n ==> P |]\n ==> P\"\napply (rule par_tr_elims_lm[of u s X t])\napply (simp_all)\n(* for Isabelle 2013\napply (fast)\napply (fast)\napply (fast) (* this takes 1 min *)\napply (fast) (* this takes 1 min *)\napply (fast) (* this takes 1 min *)\n*)\ndone\n\n(*************************************************************\n par_tr decomposition\n *************************************************************)\n\n(*-------------------*\n | par nil |\n *-------------------*)\n\n(*** par_tr ***)\n\nlemma par_tr_nil_only_if:\n \"<> : s |[X]|tr t ==> s = <> & t = <>\"\napply (erule par_tr_elims)\nby (simp_all)\n\n(*** iff ***)\n\nlemma par_tr_nil1[simp]:\n \"(<> : s |[X]|tr t) = (s = <> & t = <>)\"\napply (rule iffI)\napply (simp add: par_tr_nil_only_if)\nby (simp add: par_tr_intros)\n\nlemma par_tr_nil2[simp]:\n \"(u : <> |[X]|tr <>) = (u = <>)\"\napply (rule iffI)\napply (erule par_tr_elims)\nby (simp_all)\n\n(*-------------------*\n | par Tick |\n *-------------------*)\n\n(*** only if ***)\n\nlemma par_tr_Tick_only_if:\n \" : s |[X]|tr t ==> s = & t = \"\napply (erule par_tr_elims)\nby (simp_all)\n\n(*** iff ***)\n\nlemma par_tr_Tick1[simp]:\n \" : s |[X]|tr t = (s = & t = )\"\napply (rule iffI)\napply (simp add: par_tr_Tick_only_if)\nby (simp add: par_tr_intros)\n\nlemma par_tr_Tick2[simp]:\n \"(u : |[X]|tr ) = (u = )\"\napply (rule iffI)\napply (erule par_tr_elims)\nby (simp_all)\n\n(*-----------------*\n | par Ev |\n *-----------------*)\n\n(*** only if ***)\n\nlemma par_tr_Ev_only_if:\n \" : s |[X]|tr t\n ==> ((a : X & s = & t = ) |\n (a ~: X & s = & t = <>) |\n (a ~: X & s = <> & t = ))\"\napply (erule par_tr_elims)\nby (simp_all)\n\n(*** if ***)\n\nlemma par_tr_Ev_if:\n \"((a : X & s = & t = ) |\n (a ~: X & s = & t = <>) |\n (a ~: X & s = <> & t = ))\n ==> : s |[X]|tr t\"\napply (erule disjE)\napply (insert par_tr_Ev_sync[of \"<>\" \"<>\" X \"<>\" a], simp)\napply (erule disjE)\napply (insert par_tr_Ev_left[of \"<>\" \"<>\" X \"<>\" a], simp)\napply (insert par_tr_Ev_right[of \"<>\" \"<>\" X \"<>\" a], simp)\ndone\n\nlemma par_tr_Ev:\n \" : s |[X]|tr t\n = ((a : X & s = & t = ) |\n (a ~: X & s = & t = <>) |\n (a ~: X & s = <> & t = ))\"\napply (rule iffI)\napply (simp add: par_tr_Ev_only_if)\napply (simp add: par_tr_Ev_if)\ndone\n\n(*--------------------------------------------*\n | par one |\n *--------------------------------------------*)\n\nlemma par_tr_one:\n \" : s |[X]|tr t\n = ((e = Tick & s = & t = ) |\n (EX a. e = Ev a &\n ((a : X & s = & t = ) |\n (a ~: X & s = & t = <>) |\n (a ~: X & s = <> & t = ))))\"\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"e\" in spec)\napply (erule disjE)\napply (simp)\n\napply (erule exE)\napply (simp add: par_tr_Ev)\ndone\n\n(*--------------------------------------------*\n | par head |\n *--------------------------------------------*)\n\n(*** only if ***)\n\nlemma par_tr_head_only_if:\n \" ^^^ u : s |[X]|tr t\n ==> (a : X & (EX s' t'. u : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. u : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. u : s |[X]|tr t' & t = ^^^ t'))\"\napply (erule par_tr_elims)\nby (simp_all)\n\n(*** if ***)\n\nlemma par_tr_head_if:\n \"(a : X & (EX s' t'. u : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. u : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. u : s |[X]|tr t' & t = ^^^ t'))\n ==> ^^^ u : s |[X]|tr t\"\n\n (*** sync ***)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: par_tr_intros)\n\n (*** left ***)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: par_tr_intros)\n\n (*** right ***)\n apply (elim conjE exE)\n apply (simp add: par_tr_intros)\ndone\n\n(*** iff ***)\n\nlemma par_tr_head:\n \" ^^^ u : s |[X]|tr t\n = ((a : X & (EX s' t'. u : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. u : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. u : s |[X]|tr t' & t = ^^^ t')))\"\napply (rule iffI)\napply (simp add: par_tr_head_only_if)\napply (simp add: par_tr_head_if)\ndone\n\n(* erule *)\n\nlemma par_tr_head_ifE:\n \"[| ^^^ u : s |[X]|tr t ;\n [| (a : X & (EX s' t'. u : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. u : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. u : s |[X]|tr t' & t = ^^^ t')) |] ==> R\n |] ==> R\"\nby (simp add: par_tr_head)\n\n(* head Ev Ev *)\n\nlemma par_tr_head_Ev_Ev:\n \"(u : ( ^^^ s) |[X]|tr ( ^^^ t))\n = (EX c v. u = ^^^ v &\n (c : X & v : s |[X]|tr t & a = c & b = c |\n c ~: X & v : s |[X]|tr ( ^^^ t) & a = c |\n c ~: X & v : ( ^^^ s) |[X]|tr t & b = c))\"\napply (rule iffI)\n\n (* => *)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"u\" in spec)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (simp add: par_tr_head)\n\n (* => *)\n apply (elim conjE exE)\n apply (simp add: par_tr_head)\ndone\n\n(* step *)\n\nlemma par_tr_step:\n \"(u : s |[X]|tr t)\n = ((u = <> & s = <> & t = <>) |\n (u = & s = & t = ) |\n (EX a v. u = ^^^ v & \n ((a : X & (EX s' t'. v : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. v : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. v : s |[X]|tr t' & t = ^^^ t')))))\"\napply (insert trace_nil_or_Tick_or_Ev)\napply (drule_tac x=\"u\" in spec)\napply (elim disjE)\napply (simp_all)\napply (elim exE)\napply (simp add: par_tr_head)\ndone\n\nlemma par_tr_stepI:\n \"((u = <> & s = <> & t = <>) |\n (u = & s = & t = ) |\n (EX a v. u = ^^^ v & \n ((a : X & (EX s' t'. v : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. v : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. v : s |[X]|tr t' & t = ^^^ t')))))\n ==> (u : s |[X]|tr t)\"\nby (simp add: par_tr_step[THEN sym])\n\nlemma par_tr_stepE:\n \"[| u : s |[X]|tr t ;\n ((u = <> & s = <> & t = <>) |\n (u = & s = & t = ) |\n (EX a v. u = ^^^ v & \n ((a : X & (EX s' t'. v : s' |[X]|tr t'\n & s = ^^^ s' & t = ^^^ t')) |\n (a ~: X & (EX s'. v : s' |[X]|tr t & s = ^^^ s')) |\n (a ~: X & (EX t'. v : s |[X]|tr t' & t = ^^^ t')))))\n ==> R |] ==> R\"\nby (simp add: par_tr_step[THEN sym])\n\n(*--------------------------------------------*\n | par last |\n *--------------------------------------------*)\n\n(*** only if ***)\n\nlemma par_tr_last_only_if_lm:\n \"ALL X u s t e.\n (u ^^^ : s |[X]|tr t & noTick u)\n --> (((e : Ev ` X | e = Tick) &\n (EX s' t'. u : s' |[X]|tr t' & s = s' ^^^ & t = t' ^^^ \n & noTick s' & noTick t')) |\n (e ~: Ev ` X & e ~= Tick & \n (EX s'. u : s' |[X]|tr t & s = s' ^^^ & noTick s' & noTick t)) |\n (e ~: Ev ` X & e ~= Tick & \n (EX t'. u : s |[X]|tr t' & t = t' ^^^ & noTick s & noTick t')))\" \napply (rule allI)\napply (rule allI)\napply (induct_tac u rule: induct_trace)\n\n(* base *)\n (* <> *)\n apply (intro allI impI)\n apply (simp add: par_tr_one)\n apply (erule disjE, simp)\n apply (erule exE, force)\n\n (* *)\n apply (simp)\n\n (* ^^^ ua *)\n apply (intro allI impI)\n apply (elim conjE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (elim disjE conjE exE)\n\n (* head sync *)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n\n (* last sync *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\" ^^^ s'a\" in exI)\n apply (rule_tac x=\" ^^^ t'a\" in exI)\n apply (simp add: appt_assoc)\n\n (* last left *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\" ^^^ s'a\" in exI, simp)\n apply (simp add: appt_assoc)\n\n (* last right *)\n apply (simp)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\" ^^^ t'a\" in exI, simp)\n apply (simp add: appt_assoc)\n\n (* head left *)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n\n (* last sync *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\" ^^^ s'a\" in exI)\n apply (rule_tac x=\"t'\" in exI)\n apply (simp add: appt_assoc)\n\n (* last left *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\" ^^^ s'a\" in exI, simp)\n apply (simp add: appt_assoc)\n\n (* last right *)\n apply (simp)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\"t'\" in exI, simp)\n\n (* head right *)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n\n (* last sync *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\"s'\" in exI)\n apply (rule_tac x=\" ^^^ t'a\" in exI)\n apply (simp add: appt_assoc)\n\n (* last left *)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI1)\n apply (rule_tac x=\"s'\" in exI, simp)\n\n (* last right *)\n apply (simp)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\" ^^^ t'a\" in exI)\n apply (simp add: appt_assoc)\ndone\n\n(*** rule ***)\n\nlemma par_tr_last_only_if:\n \"[| u ^^^ : s |[X]|tr t ; noTick u |]\n ==> (((e : Ev ` X | e = Tick) &\n (EX s' t'. u : s' |[X]|tr t' & s = s' ^^^ & t = t' ^^^ \n & noTick s' & noTick t')) |\n (e ~: Ev ` X & e ~= Tick & \n (EX s'. u : s' |[X]|tr t & s = s' ^^^ & noTick s' & noTick t)) |\n (e ~: Ev ` X & e ~= Tick & \n (EX t'. u : s |[X]|tr t' & t = t' ^^^ & noTick s & noTick t')))\" \nby (simp add: par_tr_last_only_if_lm)\n\n(*** if ***)\n\nlemma par_tr_last_if_lm:\n \"ALL X u s t e. (noTick u &\n (((e : Ev ` X | e = Tick) &\n (EX s' t'. u : s' |[X]|tr t' & s = s' ^^^ & t = t' ^^^ \n & noTick s' & noTick t')) |\n (e ~: Ev ` X & e ~= Tick & \n (EX s'. u : s' |[X]|tr t & s = s' ^^^ & noTick s' & noTick t)) |\n (e ~: Ev ` X & e ~= Tick & \n (EX t'. u : s |[X]|tr t' & t = t' ^^^ & noTick s & noTick t'))))\n --> u ^^^ : s |[X]|tr t\"\napply (rule allI)\napply (rule allI)\napply (induct_tac u rule: induct_trace)\n\n(* base *)\n (* <> *)\n apply (intro allI impI)\n apply (simp add: par_tr_one)\n apply (elim conjE disjE)\n apply (force)\n apply (simp)\n apply (simp add: not_Tick_to_Ev, fast)\n apply (simp add: not_Tick_to_Ev, fast)\n\n (* *)\n apply (simp)\n\n (* s ^^^ *)\n apply (intro allI impI)\n apply (simp add: par_tr_head)\n apply (simp add: appt_assoc)\n apply (elim conjE)\n apply (elim disjE)\n\n (* last sync *)\n apply (elim conjE exE)\n\n (* sync *)\n apply (rotate_tac 3)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'a ^^^ \" in spec)\n apply (drule_tac x=\"t'a ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* left *)\n apply (rotate_tac -1)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'a ^^^ \" in spec)\n apply (drule_tac x=\"t' ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* right *)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s' ^^^ \" in spec)\n apply (drule_tac x=\"t'a ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* last left *)\n apply (elim conjE exE)\n\n (* sync *)\n apply (rotate_tac 4)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'a ^^^ \" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* left *)\n apply (rotate_tac -1)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'a ^^^ \" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* right *)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s' ^^^ \" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* last right *)\n apply (elim conjE exE)\n\n (* sync *)\n apply (rotate_tac 4)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'a ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* left *)\n apply (rotate_tac -1)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t' ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\n\n (* right *)\n apply (elim conjE exE)\n apply (simp add: appt_assoc)\n apply (simp add: par_tr_head)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'a ^^^ \" in spec)\n apply (drule_tac x=\"e\" in spec)\n apply (simp)\n apply (fast)\ndone\n\n(*** rule ***)\n\nlemma par_tr_last_if:\n \"[| noTick u;\n ((e : Ev ` X | e = Tick) &\n (EX s' t'. u : s' |[X]|tr t' & s = s' ^^^ & t = t' ^^^ \n & noTick s' & noTick t')) |\n (e ~: Ev ` X & e ~= Tick & \n (EX s'. u : s' |[X]|tr t & s = s' ^^^ & noTick s' & noTick t)) |\n (e ~: Ev ` X & e ~= Tick & \n (EX t'. u : s |[X]|tr t' & t = t' ^^^ & noTick s & noTick t')) |]\n ==> u ^^^ : s |[X]|tr t\"\napply (insert par_tr_last_if_lm)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"u\" in spec)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (drule_tac x=\"e\" in spec)\nby (simp)\n\n(*** iff ***)\n\nlemma par_tr_last:\n \"noTick u ==>\n u ^^^ : s |[X]|tr t \n = (((e : Ev ` X | e = Tick) &\n (EX s' t'. u : s' |[X]|tr t' & s = s' ^^^ & t = t' ^^^ \n & noTick s' & noTick t')) |\n (e ~: Ev ` X & e ~= Tick & \n (EX s'. u : s' |[X]|tr t & s = s' ^^^ & noTick s' & noTick t)) |\n (e ~: Ev ` X & e ~= Tick & \n (EX t'. u : s |[X]|tr t' & t = t' ^^^ & noTick s & noTick t')))\" \napply (rule iffI)\napply (simp add: par_tr_last_only_if)\napply (simp add: par_tr_last_if)\ndone\n\n(*************************************************************\n symmetricity \n *************************************************************)\n\nlemma par_tr_sym_only_if_lm:\n \"ALL u s t. u : (s |[X]|tr t) --> u : (t |[X]|tr s)\"\napply (rule allI)\napply (induct_tac u rule: induct_trace)\napply (simp_all)\n\napply (intro allI impI)\napply (erule par_tr_elims)\n\n (* <> *)\n apply (simp)\n\n (* *)\n apply (simp)\n\n (* Ev_nil *)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"<>\" in spec)\n apply (simp add: par_tr_intros)\n\n (* nil_Ev *)\n apply (drule_tac x=\"<>\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (simp add: par_tr_intros)\n\n (* sync *)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (simp add: par_tr_intros)\n\n (* left *)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (simp add: par_tr_intros)\n\n (* right *)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (simp add: par_tr_intros)\ndone\n\nlemma par_tr_sym_only_if:\n \"u : (s |[X]|tr t) ==> u : (t |[X]|tr s)\"\napply (insert par_tr_sym_only_if_lm[of X])\napply (drule_tac x=\"u\" in spec)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (simp)\ndone\n\nlemma par_tr_sym: \"s |[X]|tr t = t |[X]|tr s\"\napply (auto)\napply (rule par_tr_sym_only_if, simp_all)\napply (rule par_tr_sym_only_if, simp_all)\ndone\n\n(*************************************************************\n prefix_closed\n *************************************************************)\n\nlemma par_tr_prefix_lm:\n \"ALL X v u s t. prefix v u & u : s |[X]|tr t\n --> (EX s' t'. v : s' |[X]|tr t' & \n prefix s' s & prefix t' t)\"\napply (rule allI)\napply (rule allI)\napply (induct_tac v rule: induct_trace)\napply (simp_all add: disj_not1)\napply (simp add: prefix_Tick)\n\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: par_tr_head)\n\n (* sync *)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (drule_tac x=\"u'\" in spec)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (force)\n\n (* left *)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (drule_tac x=\"u'\" in spec)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (force)\n\n (* right *)\n apply (elim conjE exE)\n apply (drule_tac x=\"u'\" in spec)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (force)\ndone\n\n(*** rule ***)\n\nlemma par_tr_prefix:\n \"[| prefix v u ; u : s |[X]|tr t |]\n ==> (EX s' t'. v : s' |[X]|tr t' & prefix s' s & prefix t' t)\"\napply (insert par_tr_prefix_lm)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"v\" in spec)\napply (drule_tac x=\"u\" in spec)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\nby (simp)\n\nlemma par_tr_prefixE:\n \"[| prefix v u ; u : s |[X]|tr t ;\n !! s' t'. [| v : s' |[X]|tr t' ; prefix s' s ; prefix t' t |] ==> R\n |] ==> R\"\napply (insert par_tr_prefix[of v u s X t])\nby (auto)\n\n(*************************************************************\n parallel lemmas etc.\n *************************************************************)\n\n(*******************************\n par_tr lenght \n *******************************)\n\nlemma par_tr_lengtht_lm:\n \"ALL X u s t. u : s |[X]|tr t\n --> lengtht s <= lengtht u & lengtht t <= lengtht u\"\napply (rule allI)\napply (rule allI)\napply (induct_tac u rule: induct_trace)\napply (simp_all)\n\napply (intro allI impI)\napply (simp add: par_tr_head)\n\n (* sync *)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (simp)\n\n (* left *)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (force)\n\n (* right *)\n apply (elim conjE exE)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (force)\ndone\n\n(*** rule ***)\n\nlemma par_tr_lengtht:\n \"u : s |[X]|tr t ==> lengtht s <= lengtht u & lengtht t <= lengtht u\"\nby (simp add: par_tr_lengtht_lm)\n\n(*** ruleE ***)\n\nlemma par_tr_lengthtE:\n \"[| u : s |[X]|tr t ; \n [| lengtht s <= lengtht u ; lengtht t <= lengtht u|] ==> R |] ==> R\"\nby (simp add: par_tr_lengtht)\n\n(**************************************************\n para\n **************************************************)\n\nlemma par_tr_nil_Ev_rev:\n \"u : <> |[X]|tr ( ^^^ t)\n ==> a ~: X & (EX v. u = ^^^ v & v : <> |[X]|tr t)\"\napply (erule par_tr_elims)\nby (simp_all add: par_tr_intros)\n\nlemma par_tr_Tick_Ev_rev:\n \"u : |[X]|tr ( ^^^ t)\n ==> a ~: X & (EX v. u = ^^^ v & v : |[X]|tr t)\"\napply (erule par_tr_elims)\nby (simp_all add: par_tr_intros)\n\n(**************************************************\n noTick\n **************************************************)\n\n(*-----------------*\n | par noTick |\n *-----------------*)\n\n(*** only if ***)\n\nlemma par_tr_noTick_only_if_lm:\n \"ALL s t. ( u : s |[X]|tr t & noTick s & noTick t ) --> noTick u\"\napply (induct_tac u rule: induct_trace)\napply (simp)\napply (intro allI)\napply (case_tac \"s ~= \", simp)\napply (case_tac \"t ~= \", simp)\napply (simp)\n\napply (intro allI impI)\napply (elim conjE)\napply (simp add: par_tr_head)\napply (elim disjE conjE exE)\napply (auto)\ndone\n\nlemma par_tr_noTick_only_if:\n \"[| u : s |[X]|tr t ; noTick s ; noTick t |] ==> noTick u\"\napply (insert par_tr_noTick_only_if_lm[of u X])\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\nby (simp)\n\n(*** if ***)\n\nlemma par_tr_noTick_if_lm:\n \"ALL s t. ( u : s |[X]|tr t & noTick u ) --> ( noTick s & noTick t )\"\napply (induct_tac u rule: induct_trace)\napply (simp)\napply (simp)\n\napply (intro allI impI)\napply (elim conjE)\napply (erule par_tr_head_ifE)\napply (elim conjE exE disjE)\n\napply (drule_tac x=\"s'\" in spec)\napply (drule_tac x=\"t'\" in spec)\napply (simp)\n\napply (drule_tac x=\"s'\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (simp)\n\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t'\" in spec)\napply (simp)\ndone\n\nlemma par_tr_noTick_if:\n \"[| u : s |[X]|tr t ; noTick u |] ==> ( noTick s & noTick t )\"\napply (insert par_tr_noTick_if_lm[of u X])\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\nby (simp)\n\n(*** iff ***)\n\nlemma par_tr_noTick:\n \"u : s |[X]|tr t ==> (noTick s & noTick t) = noTick u\"\napply (rule iffI)\napply (simp add: par_tr_noTick_only_if)\napply (simp add: par_tr_noTick_if)\ndone\n\nlemmas par_tr_noTick_compo = par_tr_noTick_only_if\nlemmas par_tr_noTick_decompo = par_tr_noTick_if\n\n(****** used in Alpha_parallel ******)\n\n(*** nil-Tick ***)\n\nlemma par_tr_nil_Tick[simp]:\n \"(u : <> |[X]|tr ) = False\"\napply (induct_tac u rule: induct_trace)\nby (simp_all add: par_tr_head)\n\nlemma par_tr_Tick_nil[simp]:\n \"(u : |[X]|tr <>) = False\"\napply (induct_tac u rule: induct_trace)\nby (simp_all add: par_tr_head)\n\n(*** nil-Ev ***)\n\nlemma par_tr_nil_Ev_iff:\n \"u : <> |[X]|tr ( ^^^ t)\n = (a ~: X & (EX v. u = ^^^ v & v : <> |[X]|tr t))\"\napply (rule iffI)\napply (rule par_tr_nil_Ev_rev)\napply (simp)\n\napply (elim conjE exE, simp)\napply (simp add: par_tr_nil_Ev)\ndone\n\n(*** Tcik-Ev ***)\n\nlemma par_tr_Tick_Ev_iff:\n \"u : |[X]|tr ( ^^^ t)\n = (a ~: X & (EX v. u = ^^^ v & v : |[X]|tr t))\"\napply (rule iffI)\napply (rule par_tr_Tick_Ev_rev)\napply (simp)\n\napply (elim conjE exE, simp)\napply (simp add: par_tr_Ev_right)\ndone\n\n(****** nil ******)\n\nlemma par_tr_nil_left_only_if_imp:\n \"ALL u. (u : <> |[X]|tr s)\n --> (u = s & Tick ~: sett u & sett u Int Ev ` X = {})\"\napply (induct_tac s rule: induct_trace)\napply (simp_all)\n\napply (intro allI impI)\napply (simp add: par_tr_nil_Ev_iff)\napply (elim conjE exE)\napply (drule_tac x=\"v\" in spec)\napply (auto)\ndone\n\nlemma par_tr_nil_left_only_if:\n \"(u : <> |[X]|tr s) \n ==> u = s & Tick ~: sett u & sett u Int Ev ` X = {}\"\napply (insert par_tr_nil_left_only_if_imp[of X s])\napply (drule_tac x=\"u\" in spec)\napply (auto)\ndone\n\nlemma par_tr_nil_left_if_imp:\n \"(Tick ~: sett u & sett u Int Ev ` X = {})\n --> (u : <> |[X]|tr u)\"\napply (induct_tac u rule: induct_trace)\nby (auto simp add: par_tr_head)\n\nlemma par_tr_nil_left_if:\n \"[| Tick ~: sett u ; sett u Int Ev ` X = {} |]\n ==> (u : <> |[X]|tr u)\"\nby (simp add: par_tr_nil_left_if_imp)\n\n(*** nil left ***)\n\nlemma par_tr_nil_left:\n \"(u : <> |[X]|tr s) = (u = s & Tick ~: sett u & sett u Int Ev ` X = {})\"\napply (rule iffI)\napply (simp add: par_tr_nil_left_only_if)\napply (auto simp add: par_tr_nil_left_if)\ndone\n\n(*** nil right ***)\n\nlemma par_tr_nil_right:\n \"(u : s |[X]|tr <>) = (u = s & Tick ~: sett u & sett u Int Ev ` X = {})\"\napply (simp add: par_tr_sym)\napply (simp add: par_tr_nil_left)\ndone\n\nlemmas par_tr_nil = par_tr_nil_left par_tr_nil_right\n\n(****** Tick ******)\n\nlemma par_tr_Tick_left_only_if_imp:\n \"ALL u. u : |[X]|tr s \n --> (u = s & Tick : sett u & sett u Int Ev ` X = {})\"\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (simp add: image_def)\n\napply (intro allI impI)\napply (simp add: par_tr_Tick_Ev_iff)\napply (elim conjE exE)\napply (drule_tac x=\"v\" in spec)\napply (auto)\ndone\n\nlemma par_tr_Tick_left_only_if:\n \"(u : |[X]|tr s) \n ==> u = s & Tick : sett u & sett u Int Ev ` X = {}\"\napply (insert par_tr_Tick_left_only_if_imp[of X s])\napply (drule_tac x=\"u\" in spec)\napply (auto)\ndone\n\nlemma par_tr_Tick_left_if_imp:\n \"(Tick : sett u & sett u Int Ev ` X = {})\n --> (u : |[X]|tr u)\"\napply (induct_tac u rule: induct_trace)\nby (auto simp add: par_tr_head)\n\nlemma par_tr_Tick_left_if:\n \"[| Tick : sett u ; sett u Int Ev ` X = {} |]\n ==> (u : |[X]|tr u)\"\nby (simp add: par_tr_Tick_left_if_imp)\n\n(*** Tick left ***)\n\nlemma par_tr_Tick_left:\n \"(u : |[X]|tr s) \n= (u = s & Tick : sett u & sett u Int Ev ` X = {})\"\napply (rule iffI)\napply (simp add: par_tr_Tick_left_only_if)\napply (auto simp add: par_tr_Tick_left_if)\ndone\n\n(*** Tick right ***)\n\nlemma par_tr_Tick_right:\n \"(u : s |[X]|tr ) \n= (u = s & Tick : sett u & sett u Int Ev ` X = {})\"\napply (simp add: par_tr_sym[of _ _ \"\"])\napply (simp add: par_tr_Tick_left)\ndone\n\nlemmas par_tr_Tick = par_tr_Tick_left par_tr_Tick_right\n\n(*** par sett ***)\n\nlemma par_tr_sett: \"ALL s t. u : s |[X]|tr t --> sett u <= sett s Un sett t\"\napply (induct_tac u rule: induct_trace)\napply (simp_all)\napply (intro allI impI)\napply (simp add: par_tr_head)\napply (erule disjE)\n\n(* sync *)\n apply (elim conjE exE)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (force)\n\n(* left *)\n apply (erule disjE)\n apply (elim conjE exE)\n apply (drule_tac x=\"s'\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (force)\n\n(* right *)\n apply (elim conjE exE)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t'\" in spec)\n apply (force)\ndone\n\n(* =================================================== *\n | addition for CSP-Prover 5 |\n * =================================================== *)\n\n\nlemma interleave_appt_left_lm:\n \"ALL u s t. \n (u : s |[{}]|tr t & (noTick v))\n --> v ^^^ u : (v ^^^ s) |[{}]|tr t\"\napply (induct_tac v rule: induct_trace)\napply (simp_all)\napply (intro allI impI)\napply (simp)\napply (drule_tac x=\"u\" in spec)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (erule conjE)\napply (simp add: appt_assoc)\napply (simp add: par_tr_head)\ndone\n\nlemma interleave_appt_left_step:\n \"[| u : s |[{}]|tr t ; noTick v |] ==> v ^^^ u : (v ^^^ s) |[{}]|tr t\"\nby (simp add: interleave_appt_left_lm)\n\nlemma interleave_appt_right_step:\n \"[| u : t |[{}]|tr s ; noTick v |] ==> v ^^^ u : t |[{}]|tr (v ^^^ s)\"\napply (simp add: par_tr_sym)\napply (insert interleave_appt_left_step[of u s t v])\napply (simp add: par_tr_sym)\ndone\n\nlemma interleave_appt_left_nil:\n \"[| u : <> |[{}]|tr t ; noTick v |] ==> v ^^^ u : v |[{}]|tr t\"\napply (insert interleave_appt_left_step[of u <> t v])\nby (simp)\n\nlemma interleave_appt_right_nil:\n \"[| u : t |[{}]|tr <> ; noTick v |] ==> v ^^^ u : t |[{}]|tr v\"\napply (insert interleave_appt_right_step[of u t <> v])\nby (simp)\n\nlemma interleave_appt_left_nil_nil:\n \"noTick t ==> t : t |[{}]|tr <>\"\napply (insert interleave_appt_left_step[of <> <> <> t])\nby (simp)\n\nlemma interleave_appt_right_nil_nil:\n \"noTick t ==> t : <> |[{}]|tr t\"\napply (insert interleave_appt_right_step[of <> <> <> t])\nby (simp)\n\nlemmas interleave_appt_left =\n interleave_appt_left_step\n interleave_appt_left_nil\n interleave_appt_left_nil_nil\n\nlemmas interleave_appt_right =\n interleave_appt_right_step\n interleave_appt_right_nil\n interleave_appt_right_nil_nil\n\n(* par decompo *)\n\nlemma par_tr_app_right[rule_format]:\n \"ALL u v s t.\n (noTick u & sett u Int (Ev ` X) = {} & v : (s |[X]|tr t))\n --> u ^^^ v : (s |[X]|tr (u ^^^ t))\"\napply (rule)\napply (induct_tac u rule: induct_trace)\napply (simp_all)\napply (intro allI impI)\napply (elim exE conjE)\napply (drule_tac x=\"v\" in spec)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (simp)\napply (simp add: appt_assoc)\napply (simp add: par_tr_head)\napply (auto)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp] \n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP/Trace_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2923814378995846}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Bisim_Pres\n imports Bisimulation Sim_Pres\nbegin\n\ncontext env begin\n\nlemma bisimInputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"\\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]\"\n\n shows \"\\ \\ M\\\\*xvec N\\.P \\ M\\\\*xvec N\\.Q\"\nproof -\n let ?X = \"{(\\, M\\\\*xvec N\\.P, M\\\\*xvec N\\.Q) | \\ M xvec N P Q. \\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]}\"\n\n from assms have \"(\\, M\\\\*xvec N\\.P, M\\\\*xvec N\\.Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ P Q)\n thus ?case by auto\n next\n case(cSim \\ P Q)\n thus ?case by(blast intro: inputPres)\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: bisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n \nlemma bisimOutputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ M\\N\\.P \\ M\\N\\.Q\"\nproof -\n let ?X = \"{(\\, M\\N\\.P, M\\N\\.Q) | \\ M N P Q. \\ \\ P \\ Q}\"\n from \\\\ \\ P \\ Q\\ have \"(\\, M\\N\\.P, M\\N\\.Q) \\ ?X\" by auto\n thus ?thesis\n by(coinduct rule: bisimCoinduct, auto) (blast intro: outputPres dest: bisimE)+\nqed\n\nlemma bisimCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes \"\\\\ P. (\\, P) mem CsP \\ \\Q. (\\, Q) mem CsQ \\ guarded Q \\ \\ \\ P \\ Q\"\n and \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q\"\n\n shows \"\\ \\ Cases CsP \\ Cases CsQ\"\nproof -\n let ?X = \"{(\\, Cases CsP, Cases CsQ) | \\ CsP CsQ. (\\\\ P. (\\, P) mem CsP \\ (\\Q. (\\, Q) mem CsQ \\ guarded Q \\ \\ \\ P \\ Q)) \\\n (\\\\ Q. (\\, Q) mem CsQ \\ (\\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q))}\"\n from assms have \"(\\, Cases CsP, Cases CsQ) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ P Q)\n thus ?case by auto\n next\n case(cSim \\ CasesP CasesQ)\n then obtain CsP CsQ where C1: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q\"\n and A: \"CasesP = Cases CsP\" and B: \"CasesQ = Cases CsQ\"\n by auto\n note C1\n moreover have \"\\\\ P Q. \\ \\ P \\ Q \\ \\ \\ P \\[bisim] Q\" by(rule bisimE)\n moreover have \"bisim \\ ?X \\ bisim\" by blast\n ultimately have \"\\ \\ Cases CsP \\[(?X \\ bisim)] Cases CsQ\"\n by(rule casePres)\n thus ?case using A B by blast\n next\n case(cExt \\ P Q)\n thus ?case by(blast dest: bisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n \n assumes \"\\ \\ P \\ Q\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\ \\\\x\\Q\"\nproof -\n let ?X = \"{(\\, \\\\x\\P, \\\\x\\Q) | \\ x P Q. \\ \\ P \\ Q \\ x \\ \\}\"\n \n from assms have \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ xP xQ)\n from \\(\\, xP, xQ) \\ ?X\\ obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n moreover from \\\\ \\ P \\ Q\\ have PeqQ: \"insertAssertion(extractFrame P) \\ \\\\<^sub>F insertAssertion(extractFrame Q) \\\"\n by(rule bisimE)\n ultimately show ?case by(auto intro: frameResPres)\n next\n case(cSim \\ xP xQ)\n from \\(\\, xP, xQ) \\ ?X\\ obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\[bisim] Q\" by(rule bisimE)\n moreover have \"eqvt ?X\"\n by(force simp add: eqvt_def bisimClosed pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n hence \"eqvt(?X \\ bisim)\" by auto\n moreover note \\x \\ \\\\\n moreover have \"bisim \\ ?X \\ bisim\" by auto\n moreover have \"\\\\ P Q x. \\(\\, P, Q) \\ bisim; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n by auto\n ultimately have \"\\ \\ \\\\x\\P \\[(?X \\ bisim)] \\\\x\\Q\"\n by(rule resPres)\n with \\xP = \\\\x\\P\\ \\xQ = \\\\x\\Q\\ show ?case\n by simp\n next\n case(cExt \\ xP xQ \\')\n from \\(\\, xP, xQ) \\ ?X\\ obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n obtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ \\\" and \"y \\ \\'\"\n by(generate_fresh \"name\", auto simp add: fresh_prod)\n from \\\\ \\ P \\ Q\\ have \"\\ \\ ([(x, y)] \\ \\') \\ P \\ Q\"\n by(rule bisimE)\n hence \"([(x, y)] \\ (\\ \\ ([(x, y)] \\ \\'))) \\ ([(x, y)] \\ P) \\ ([(x, y)] \\ Q)\"\n by(rule bisimClosed)\n with \\x \\ \\\\ \\y \\ \\\\ have \"\\ \\ \\' \\ ([(x, y)] \\ P) \\ ([(x, y)] \\ Q)\"\n by(simp add: eqvts)\n with \\y \\ \\\\ \\y \\ \\'\\ have \"(\\ \\ \\', \\\\y\\([(x, y)] \\ P), \\\\y\\([(x, y)] \\ Q)) \\ ?X\"\n by auto\n moreover from \\y \\ P\\ \\y \\ Q\\ have \"\\\\x\\P = \\\\y\\([(x, y)] \\ P)\" and \"\\\\x\\Q = \\\\y\\([(x, y)] \\ Q)\"\n by(simp add: alphaRes)+\n ultimately show ?case using \\xP = \\\\x\\P\\ \\xQ = \\\\x\\Q\\ by simp\n next\n case(cSym \\ P Q)\n thus ?case\n by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\ Q\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q\"\nusing assms\nby(induct xvec) (auto intro: bisimResPres)\n\nlemma bisimParPresAux:\n fixes \\ :: 'b\n and \\\\<^sub>R :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>R :: \"name list\"\n \n assumes \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nproof -\n let ?X = \"{(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) | xvec \\ P Q R. xvec \\* \\ \\ (\\A\\<^sub>R \\\\<^sub>R. (extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* \\ \\ A\\<^sub>R \\* P \\ A\\<^sub>R \\* Q) \\\n \\ \\ \\\\<^sub>R \\ P \\ Q)}\"\n {\n fix xvec :: \"name list\"\n and \\ :: 'b \n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assume \"xvec \\* \\\"\n and \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n\n hence \"(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) \\ ?X\"\n apply auto\n by blast\n }\n\n note XI = this\n {\n fix xvec :: \"name list\"\n and \\ :: 'b \n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assume \"xvec \\* \\\"\n and A: \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q; A\\<^sub>R \\* C\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n\n from \\xvec \\* \\\\ have \"(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) \\ ?X\"\n proof(rule XI)\n fix A\\<^sub>R \\\\<^sub>R\n assume FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n obtain p::\"name prm\" where \"(p \\ A\\<^sub>R) \\* \\\" and \"(p \\ A\\<^sub>R) \\* P\" and \"(p \\ A\\<^sub>R) \\* Q\" and \"(p \\ A\\<^sub>R) \\* R\" and \"(p \\ A\\<^sub>R) \\* C\"\n and \"(p \\ A\\<^sub>R) \\* \\\\<^sub>R\" and S: \"(set p) \\ (set A\\<^sub>R) \\ (set(p \\ A\\<^sub>R))\" and \"distinctPerm p\"\n by(rule_tac c=\"(\\, P, Q, R, \\\\<^sub>R, C)\" in name_list_avoiding) auto\n from FrR \\(p \\ A\\<^sub>R) \\* \\\\<^sub>R\\ S have \"extractFrame R = \\(p \\ A\\<^sub>R), p \\ \\\\<^sub>R\\\" by(simp add: frameChainAlpha')\n\n moreover assume \"A\\<^sub>R \\* \\\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\A\\<^sub>R \\* \\\\ \\(p \\ A\\<^sub>R) \\* \\\\ S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n moreover assume \"A\\<^sub>R \\* P\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\A\\<^sub>R \\* P\\ \\(p \\ A\\<^sub>R) \\* P\\ S have \"(p \\ A\\<^sub>R) \\* P\" by simp\n moreover assume \"A\\<^sub>R \\* Q\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\A\\<^sub>R \\* Q\\ \\(p \\ A\\<^sub>R) \\* Q\\ S have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n ultimately have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" using \\(p \\ A\\<^sub>R) \\* C\\ A by blast\n hence \"(p \\ (\\ \\ (p \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with \\A\\<^sub>R \\* \\\\ \\(p \\ A\\<^sub>R) \\* \\\\ \\A\\<^sub>R \\* P\\ \\(p \\ A\\<^sub>R) \\* P\\ \\A\\<^sub>R \\* Q\\ \\(p \\ A\\<^sub>R) \\* Q\\ S \\distinctPerm p\\\n show \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(simp add: eqvts)\n qed\n }\n note XI' = this\n\n have \"eqvt ?X\"\n apply(auto simp add: eqvt_def)\n apply(rule_tac x=\"p \\ xvec\" in exI)\n apply(rule_tac x=\"p \\ P\" in exI)\n apply(rule_tac x=\"p \\ Q\" in exI)\n apply(rule_tac x=\"p \\ R\" in exI)\n apply(simp add: eqvts)\n apply(simp add: fresh_star_bij)\n apply(clarify)\n apply(erule_tac x=\"(rev p) \\ A\\<^sub>R\" in allE)\n apply(erule_tac x=\"(rev p) \\ \\\\<^sub>R\" in allE)\n apply(drule mp)\n apply(rule conjI)\n apply(rule_tac pi=p in pt_bij4[OF pt_name_inst, OF at_name_inst])\n apply(simp add: eqvts)\n defer\n apply(drule_tac p=p in bisimClosed)\n apply(simp add: eqvts)\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n apply simp\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n apply simp\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n by simp\n\n moreover have Res: \"\\\\ P Q x. \\(\\, P, Q) \\ ?X \\ bisim; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n proof -\n fix \\ P Q x\n assume \"(\\, P, Q) \\ ?X \\ bisim\" and \"(x::name) \\ \\\"\n show \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n proof(case_tac \"(\\, P, Q) \\ ?X\")\n assume \"(\\, P, Q) \\ ?X\"\n with \\x \\ \\\\ have \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X\"\n apply auto\n by(rule_tac x=\"x#xvec\" in exI) auto\n thus ?thesis by simp\n next\n assume \"\\(\\, P, Q) \\ ?X\"\n with \\(\\, P, Q) \\ ?X \\ bisim\\ have \"\\ \\ P \\ Q\"\n by blast\n hence \"\\ \\ \\\\x\\P \\ \\\\x\\Q\" using \\x \\ \\\\\n by(rule bisimResPres)\n thus ?thesis\n by simp\n qed\n qed\n\n have \"(\\, P \\ R, Q \\ R) \\ ?X\" \n proof -\n {\n fix A\\<^sub>R' :: \"name list\"\n and \\\\<^sub>R' :: 'b\n\n assume FrR': \"extractFrame R = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\"\n and \"A\\<^sub>R' \\* P\"\n and \"A\\<^sub>R' \\* Q\"\n\n obtain p where \"(p \\ A\\<^sub>R') \\* A\\<^sub>R\" and \"(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\" and \"(p \\ A\\<^sub>R') \\* \\\" and \"(p \\ A\\<^sub>R') \\* P\" and \"(p \\ A\\<^sub>R') \\* Q\"\n and Sp: \"(set p) \\ (set A\\<^sub>R') \\ (set(p \\ A\\<^sub>R'))\" and \"distinctPerm p\"\n by(rule_tac c=\"(A\\<^sub>R, \\, \\\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n \n from FrR' \\(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\\ Sp have \"extractFrame R = \\(p \\ A\\<^sub>R'), p \\ \\\\<^sub>R'\\\"\n by(simp add: frameChainAlpha eqvts)\n with FrR \\(p \\ A\\<^sub>R') \\* A\\<^sub>R\\ obtain q::\"name prm\" \n where Sq: \"set q \\ set(p \\ A\\<^sub>R') \\ set A\\<^sub>R\" and \"distinctPerm q\" and \"\\\\<^sub>R = q \\ p \\ \\\\<^sub>R'\"\n by(force elim: frameChainEq)\n\n from \\\\ \\ \\\\<^sub>R \\ P \\ Q\\ \\\\\\<^sub>R = q \\ p \\ \\\\<^sub>R'\\ have \"\\ \\ (q \\ p \\ \\\\<^sub>R') \\ P \\ Q\" by simp\n hence \"(q \\ (\\ \\ (q \\ p \\ \\\\<^sub>R'))) \\ (q \\ P) \\ (q \\ Q)\" by(rule bisimClosed)\n with Sq \\A\\<^sub>R \\* \\\\ \\(p \\ A\\<^sub>R') \\* \\\\ \\A\\<^sub>R \\* P\\ \\(p \\ A\\<^sub>R') \\* P\\ \\A\\<^sub>R \\* Q\\ \\(p \\ A\\<^sub>R') \\* Q\\ \\distinctPerm q\\\n have \"\\ \\ (p \\ \\\\<^sub>R') \\ P \\ Q\" by(simp add: eqvts)\n hence \"(p \\ (\\ \\ (p \\ \\\\<^sub>R'))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with Sp \\A\\<^sub>R' \\* \\\\ \\(p \\ A\\<^sub>R') \\* \\\\ \\A\\<^sub>R' \\* P\\ \\(p \\ A\\<^sub>R') \\* P\\ \\A\\<^sub>R' \\* Q\\ \\(p \\ A\\<^sub>R') \\* Q\\ \\distinctPerm p\\\n have \"\\ \\ \\\\<^sub>R' \\ P \\ Q\" by(simp add: eqvts)\n }\n thus ?thesis\n apply auto\n apply(rule_tac x=\"[]\" in exI)\n by auto blast\n qed\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ PR QR)\n from \\(\\, PR, QR) \\ ?X\\\n obtain xvec P Q R A\\<^sub>R \\\\<^sub>R where PFrR: \"PR = \\\\*xvec\\(P \\ R)\" and QFrR: \"QR = \\\\*xvec\\(Q \\ R)\"\n and \"xvec \\* \\\" and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and PSimQ: \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and \"A\\<^sub>R \\* xvec\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\"\n apply auto\n apply(subgoal_tac \"\\A\\<^sub>R \\\\<^sub>R. extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* (xvec, \\, P, Q, R)\")\n apply auto\n apply(rule_tac F=\"extractFrame R\" and C=\"(xvec, \\, P, Q, R)\" in freshFrame)\n by auto\n\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* A\\<^sub>R\" and \"A\\<^sub>P \\* \\\\<^sub>R\"\n by(rule_tac C=\"(\\, A\\<^sub>R, \\\\<^sub>R)\" in freshFrame) auto\n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* A\\<^sub>R\" and \"A\\<^sub>Q \\* \\\\<^sub>R\"\n by(rule_tac C=\"(\\, A\\<^sub>R, \\\\<^sub>R)\" in freshFrame) auto\n from \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>P \\* A\\<^sub>R\\ \\A\\<^sub>Q \\* A\\<^sub>R\\ FrP FrQ have \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>Q\"\n by(force dest: extractFrameFreshChain)+\n \n have \"\\(A\\<^sub>P@A\\<^sub>R), \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>Q@A\\<^sub>R), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P\\\"\n by(metis frameResChainPres frameNilStatEq Associativity Commutativity AssertionStatEqTrans Composition)\n moreover from PSimQ have \"insertAssertion(extractFrame P) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insertAssertion(extractFrame Q) (\\ \\ \\\\<^sub>R)\"\n by(rule bisimE)\n with FrP FrQ freshCompChain \\A\\<^sub>P \\* \\\\ \\A\\<^sub>P \\* \\\\<^sub>R\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>Q \\* \\\\<^sub>R\\ have \"\\A\\<^sub>P, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by auto\n moreover have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(metis frameResChainPres frameNilStatEq Associativity Commutativity AssertionStatEqTrans Composition)\n ultimately have \"\\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(blast intro: FrameStatEqTrans)\n hence \"\\(A\\<^sub>R@A\\<^sub>P), \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>R@A\\<^sub>Q), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(drule_tac frameResChainPres) (simp add: frameChainAppend)\n thus ?thesis\n apply(simp add: frameChainAppend)\n by(metis frameResChainComm FrameStatEqTrans)\n qed\n moreover from \\A\\<^sub>P \\* \\\\ \\A\\<^sub>R \\* \\\\ have \"(A\\<^sub>P@A\\<^sub>R) \\* \\\" by simp\n moreover from \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>R \\* \\\\ have \"(A\\<^sub>Q@A\\<^sub>R) \\* \\\" by simp\n ultimately have PFrRQR: \"insertAssertion(extractFrame(P \\ R)) \\ \\\\<^sub>F insertAssertion(extractFrame(Q \\ R)) \\\"\n using FrP FrQ FrR \\A\\<^sub>P \\* A\\<^sub>R\\ \\A\\<^sub>P \\* \\\\<^sub>R\\ \\A\\<^sub>Q \\* A\\<^sub>R\\ \\A\\<^sub>Q \\* \\\\<^sub>R\\ \\A\\<^sub>R \\* \\\\<^sub>P\\ \\A\\<^sub>R \\* \\\\<^sub>Q\\\n by simp\n \n from \\xvec \\* \\\\ have \"insertAssertion (extractFrame(\\\\*xvec\\P \\ R)) \\ \\\\<^sub>F \\\\*xvec\\(insertAssertion (extractFrame(P \\ R)) \\)\"\n by(rule insertAssertionExtractFrameFresh)\n moreover from PFrRQR have \"\\\\*xvec\\(insertAssertion (extractFrame(P \\ R)) \\) \\\\<^sub>F \\\\*xvec\\(insertAssertion (extractFrame(Q \\ R)) \\)\"\n by(induct xvec) (auto intro: frameResPres)\n moreover from \\xvec \\* \\\\ have \"\\\\*xvec\\(insertAssertion (extractFrame(Q \\ R)) \\) \\\\<^sub>F insertAssertion (extractFrame(\\\\*xvec\\Q \\ R)) \\\"\n by(rule FrameStatEqSym[OF insertAssertionExtractFrameFresh])\n ultimately show ?case using PFrR QFrR\n by(blast intro: FrameStatEqTrans)\n next\n case(cSim \\ PR QR)\n {\n fix \\ P Q R xvec\n assume \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n moreover have \"eqvt bisim\" by simp\n moreover from \\eqvt ?X\\ have \"eqvt(?X \\ bisim)\" by auto\n moreover from bisimE(1) have \"\\\\ P Q. \\ \\ P \\ Q \\ insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P) \\\" by(simp add: FrameStatEq_def)\n moreover note bisimE(2) bisimE(3)\n moreover \n {\n fix \\ P Q A\\<^sub>R \\\\<^sub>R R\n assume PSimQ: \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n hence \"(\\, P \\ R, Q \\ R) \\ ?X\"\n proof -\n have \"P \\ R = \\\\*[]\\(P \\ R)\" by simp\n moreover have \"Q \\ R = \\\\*[]\\(Q \\ R)\" by simp\n moreover have \"([]::name list) \\* \\\" by simp\n moreover \n {\n fix A\\<^sub>R' \\\\<^sub>R'\n\n assume FrR': \"extractFrame R = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\"\n and \"A\\<^sub>R' \\* P\"\n and \"A\\<^sub>R' \\* Q\"\n obtain p where \"(p \\ A\\<^sub>R') \\* A\\<^sub>R\"\n and \"(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\"\n and \"(p \\ A\\<^sub>R') \\* \\\"\n and \"(p \\ A\\<^sub>R') \\* P\"\n and \"(p \\ A\\<^sub>R') \\* Q\"\n and S: \"(set p) \\ (set A\\<^sub>R') \\ (set(p \\ A\\<^sub>R'))\" and \"distinctPerm p\"\n by(rule_tac c=\"(A\\<^sub>R, \\, \\\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n\n\n from \\(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\\ S have \"\\A\\<^sub>R', \\\\<^sub>R'\\ = \\p \\ A\\<^sub>R', p \\ \\\\<^sub>R'\\\"\n by(simp add: frameChainAlpha)\n\n with FrR' have FrR'': \"extractFrame R = \\p \\ A\\<^sub>R', p \\ \\\\<^sub>R'\\\" by simp\n with FrR \\(p \\ A\\<^sub>R') \\* A\\<^sub>R\\\n obtain q where \"p \\ \\\\<^sub>R' = (q::name prm) \\ \\\\<^sub>R\" and S': \"set q \\ (set A\\<^sub>R) \\ set(p \\ A\\<^sub>R')\" and \"distinctPerm q\"\n apply auto\n apply(drule_tac sym) apply simp\n by(drule_tac frameChainEq) auto\n from PSimQ have \"(q \\ (\\ \\ \\\\<^sub>R)) \\ (q \\ P) \\ (q \\ Q)\"\n by(rule bisimClosed)\n with \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ \\(p \\ A\\<^sub>R') \\* \\\\ \\(p \\ A\\<^sub>R') \\* P\\ \\(p \\ A\\<^sub>R') \\* Q\\ S'\n have \"\\ \\ (q \\ \\\\<^sub>R) \\ P \\ Q\" by(simp add: eqvts)\n hence \"(p \\ (\\ \\ (q \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P\\ \\A\\<^sub>R' \\* Q\\ \\(p \\ A\\<^sub>R') \\* \\\\ \\(p \\ A\\<^sub>R') \\* P\\ \\(p \\ A\\<^sub>R') \\* Q\\ S \\distinctPerm p\\ \\(p \\ \\\\<^sub>R') = q \\ \\\\<^sub>R\\ \n have \"\\ \\ \\\\<^sub>R' \\ P \\ Q\"\n by(drule_tac sym) (simp add: eqvts)\n }\n ultimately show ?thesis\n by blast\n qed\n hence \"(\\, P \\ R, Q \\ R) \\ ?X \\ bisim\"\n by simp\n }\n moreover have \"\\\\ P Q xvec. \\(\\, P, Q) \\ ?X \\ bisim; (xvec::name list) \\* \\\\ \\ (\\, \\\\*xvec\\P, \\\\*xvec\\Q) \\ ?X \\ bisim\"\n proof -\n fix \\ P Q xvec\n assume \"(\\, P, Q) \\ ?X \\ bisim\"\n assume \"(xvec::name list) \\* \\\"\n thus \"(\\, \\\\*xvec\\P, \\\\*xvec\\Q) \\ ?X \\ bisim\"\n proof(induct xvec)\n case Nil\n thus ?case using \\(\\, P, Q) \\ ?X \\ bisim\\ by simp\n next\n case(Cons x xvec)\n thus ?case by(simp only: resChain.simps) (rule_tac Res, auto)\n qed\n qed\n ultimately have \"\\ \\ P \\ R \\[(?X \\ bisim)] Q \\ R\" using statEqBisim\n by(rule parPres)\n moreover assume \"(xvec::name list) \\* \\\"\n moreover from \\eqvt ?X\\ have \"eqvt(?X \\ bisim)\" by auto\n ultimately have \"\\ \\ \\\\*xvec\\(P \\ R) \\[(?X \\ bisim)] \\\\*xvec\\(Q \\ R)\" using Res\n by(rule_tac resChainPres)\n }\n with \\(\\, PR, QR) \\ ?X\\ show ?case by blast\n next\n case(cExt \\ PR QR \\')\n\n from \\(\\, PR, QR) \\ ?X\\\n obtain xvec P Q R A\\<^sub>R \\\\<^sub>R where PFrR: \"PR = \\\\*xvec\\(P \\ R)\" and QFrR: \"QR = \\\\*xvec\\(Q \\ R)\"\n and \"xvec \\* \\\" and A: \"\\A\\<^sub>R \\\\<^sub>R. (extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* \\ \\ A\\<^sub>R \\* P \\ A\\<^sub>R \\* Q) \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n by auto\n \n obtain p where \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* P\"\n and \"(p \\ xvec) \\* Q\"\n and \"(p \\ xvec) \\* R\"\n and \"(p \\ xvec) \\* \\'\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinctPerm p\"\n by(rule_tac c=\"(\\, P, Q, R, \\')\" in name_list_avoiding) auto\n\n from \\(p \\ xvec) \\* P\\ \\(p \\ xvec) \\* R\\ S have \"\\\\*xvec\\(P \\ R) = \\\\*(p \\ xvec)\\(p \\ (P \\ R))\"\n by(subst resChainAlpha) auto\n hence PRAlpha: \"\\\\*xvec\\(P \\ R) = \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ R))\"\n by(simp add: eqvts)\n\n from \\(p \\ xvec) \\* Q\\ \\(p \\ xvec) \\* R\\ S have \"\\\\*xvec\\(Q \\ R) = \\\\*(p \\ xvec)\\(p \\ (Q \\ R))\"\n by(subst resChainAlpha) auto\n hence QRAlpha: \"\\\\*xvec\\(Q \\ R) = \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ R))\"\n by(simp add: eqvts)\n\n from \\(p \\ xvec) \\* \\\\ \\(p \\ xvec) \\* \\'\\ have \"(\\ \\ \\', \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ R)), \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ R))) \\ ?X\"\n proof(rule_tac C2=\"(\\, (p \\ P), (p \\ Q), R, \\', xvec, p \\ xvec)\" in XI', auto)\n fix A\\<^sub>R \\\\<^sub>R\n assume FrR: \"extractFrame (p \\ R) = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* \\'\" and \"A\\<^sub>R \\* (p \\ P)\" and \"A\\<^sub>R \\* (p \\ Q)\"\n from FrR have \"(p \\ (extractFrame (p \\ R))) = (p \\ \\A\\<^sub>R, \\\\<^sub>R\\)\" by simp\n with \\distinctPerm p\\ have \"extractFrame R = \\p \\ A\\<^sub>R, p \\ \\\\<^sub>R\\\" by(simp add: eqvts)\n moreover from \\A\\<^sub>R \\* \\\\ have \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n moreover from \\A\\<^sub>R \\* (p \\ P)\\ have \"(p \\ A\\<^sub>R) \\* (p \\ p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\distinctPerm p\\ have \"(p \\ A\\<^sub>R) \\* P\" by simp\n moreover from \\A\\<^sub>R \\* (p \\ Q)\\ have \"(p \\ A\\<^sub>R) \\* (p \\ p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\distinctPerm p\\ have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n ultimately have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" using A by blast\n hence \"(\\ \\ (p \\ \\\\<^sub>R)) \\ (p \\ \\') \\ P \\ Q\" by(rule bisimE)\n moreover have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ (p \\ \\') \\ (\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R)\"\n by(metis Associativity Commutativity Composition AssertionStatEqTrans AssertionStatEqSym)\n ultimately have \"(\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" \n by(rule statEqBisim)\n hence \"(p \\ ((\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\"\n by(rule bisimClosed)\n with \\distinctPerm p\\ \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ S show \"(\\ \\ \\') \\ \\\\<^sub>R \\ (p \\ P) \\ (p \\ Q)\"\n by(simp add: eqvts)\n qed\n with PFrR QFrR PRAlpha QRAlpha show ?case by simp\n next\n case(cSym \\ PR QR)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nproof -\n obtain A\\<^sub>R \\\\<^sub>R where \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\"\n by(rule_tac C=\"(\\, P, Q)\" in freshFrame) auto\n moreover from \\\\ \\ P \\ Q\\ have \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(rule bisimE)\n ultimately show ?thesis by(rule_tac bisimParPresAux)\nqed\n\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.2923814378995846}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory DistinctPropLemmaBucket\nimports\n Lib\n MoreDivides\n Aligned\n HOLLemmaBucket\n DistinctProp\n \"~~/src/HOL/Library/Sublist\"\n \"~~/src/HOL/Library/Prefix_Order\"\n\nbegin\n\n\nlemma n_less_equal_power_2 [simp]:\n \"n < 2 ^ n\"\n by (induct_tac n, simp_all)\n\nlemma drop_Suc_nth:\n \"n < length xs \\ drop n xs = xs!n # drop (Suc n) xs\"\n apply (induct xs arbitrary: n)\n apply simp\n apply simp\n apply (case_tac \"n = length xs\")\n apply simp\n apply (case_tac xs, simp)\n apply (simp add: nth_append)\n apply (case_tac n, simp)\n apply simp\n done\n\nlemma minus_Suc_0_lt:\n \"a \\ 0 \\ a - Suc 0 < a\"\n by simp\n\nlemma map_length_cong:\n \"\\ length xs = length ys; \\x y. (x, y) \\ set (zip xs ys) \\ f x = g y \\\n \\ map f xs = map g ys\"\n apply atomize\n apply (erule rev_mp, erule list_induct2)\n apply auto\n done\n\n(* FIXME: duplicate *)\nlemma zip_take_triv2:\n \"n \\ length as \\ zip as (take n bs) = zip as bs\"\n apply (induct as arbitrary: n bs)\n apply simp\n apply simp\n apply (case_tac n, simp_all)\n apply (case_tac bs, simp_all)\n done\n\nlemma zip_is_empty:\n \"(zip xs ys = []) = (xs = [] \\ ys = [])\"\n apply (case_tac xs, simp_all)\n apply (case_tac ys, simp_all)\n done\n\nlemma fst_last_zip_upt:\n \"zip [0 ..< m] xs \\ [] \\\n fst (last (zip [0 ..< m] xs))\n = (if length xs < m then length xs - 1 else m - 1)\"\n apply (subst last_conv_nth, assumption)\n apply (simp only: One_nat_def)\n apply (subst nth_zip)\n apply (rule order_less_le_trans[OF minus_Suc_0_lt])\n apply (simp add: zip_is_empty)\n apply simp\n apply (rule order_less_le_trans[OF minus_Suc_0_lt])\n apply (simp add: zip_is_empty)\n apply simp\n apply (simp add: min_def zip_is_empty)\n done\n\nlemma not_prefixI:\n fixes xs :: \"'a list\"\n shows \"\\ xs \\ ys; length xs = length ys\\ \\ \\ xs \\ ys\"\n apply (erule contrapos_nn)\n apply (erule prefixE)\n apply simp\n done\n\n\nlemma less_1_helper:\n \"n \\ m \\ (n - 1 :: int) < m\"\n by arith\n\nlemma power_sub_int:\n \"\\ m \\ n; 0 < b \\ \\ b ^ n div b ^ m = (b ^ (n - m) :: int)\"\n apply (subgoal_tac \"\\n'. n = m + n'\")\n apply (clarsimp simp: power_add)\n apply (rule exI[where x=\"n - m\"])\n apply simp\n done\n\nlemma split_state_strg:\n \"(\\x. f s = x \\ P x s) \\ P (f s) s\" by clarsimp\n\nlemma theD:\n \"\\the (f x) = y; x \\ dom f \\ \\ f x = Some y\"\n by (auto simp add: dom_def)\n\nlemma bspec_split:\n \"\\ \\(a, b) \\ S. P a b; (a, b) \\ S \\ \\ P a b\"\n by fastforce\n\nlemma set_zip_same:\n \"set (zip xs xs) = Id \\ (set xs \\ set xs)\"\n apply (induct xs, simp_all)\n apply safe\n done\n\nlemma univ_eq_obvious:\n \"\\ (\\x. y \\ x)\"\n by simp\n\nlemma ball_ran_updI:\n \"(\\x \\ ran m. P x) \\ P v \\ (\\x \\ ran (m (y \\ v)). P x)\"\n by (auto simp add: ran_def)\n\nlemma not_psubset_eq:\n \"\\ \\ A \\ B; A \\ B \\ \\ A = B\"\n by blast\n\nprimrec\n opt_rel :: \"('a \\ 'b \\ bool) \\ 'a option \\ 'b option \\ bool\"\nwhere\n \"opt_rel f None y = (y = None)\"\n| \"opt_rel f (Some x) y = (\\y'. y = Some y' \\ f x y')\"\n\nlemma opt_rel_None_rhs[simp]:\n \"opt_rel f x None = (x = None)\"\n by (cases x, simp_all)\n\nlemma opt_rel_Some_rhs[simp]:\n \"opt_rel f x (Some y) = (\\x'. x = Some x' \\ f x' y)\"\n by (cases x, simp_all)\n\nlemma in_image_op_plus:\n \"(x + y \\ op + x ` S) = ((y :: 'a :: ring) \\ S)\"\n by (simp add: image_def)\n\nlemma insert_subtract_new:\n \"x \\ S \\ (insert x S - S) = {x}\"\n by auto\n\nlemma replicate_eq:\n \"(replicate n x = replicate m y) = (n = m \\ (n \\ 0 \\ x = y))\"\n apply (induct n arbitrary: m)\n apply simp\n apply (case_tac m, simp_all)[1]\n apply (case_tac m, simp_all)\n apply auto\n done\n\nlemma bspec_upd_None:\n \"\\ \\c\\ran (f (x := None)). P c; f y = Some c; y \\ x \\\n \\ P c\"\n apply (erule bspec)\n apply (simp add: fun_upd_def)\n apply (rule ranI)\n apply (subst if_not_P, assumption)\n apply assumption\n done\n\nlemma distinct_prefix:\n \"\\ distinct xs; ys \\ xs \\ \\ distinct ys\"\n apply (clarsimp simp: less_eq_list_def)\n apply (induct xs arbitrary: ys)\n apply simp\n apply (case_tac ys)\n apply simp\n apply clarsimp\n apply (drule set_mono_prefixeq)\n apply fastforce\n done\n\nprimrec\n distinct_sets :: \"'a set list \\ bool\"\nwhere\n \"distinct_sets [] = True\"\n| \"distinct_sets (x#xs) = (x \\ \\set xs = {} \\ distinct_sets xs)\"\n\nlemma distinct_sets_prop:\n \"distinct_sets xs = distinct_prop (\\x y. x \\ y = {}) xs\"\n by (induct xs) auto\n\nlemma distinct_take_strg:\n \"distinct xs \\ distinct (take n xs)\"\n by simp\n\nlemma map_fst_zip_prefix:\n \"map fst (zip xs ys) \\ xs\"\n apply (induct xs arbitrary: ys)\n apply simp\n apply (case_tac ys)\n apply simp\n apply simp\n done\n\n\nlemma distinct_prop_prefixE:\n \"\\ distinct_prop P ys; prefixeq xs ys \\ \\ distinct_prop P xs\"\n apply (induct xs arbitrary: ys)\n apply simp\n apply (case_tac ys)\n apply simp\n apply clarsimp\n apply (drule set_mono_prefixeq)\n apply (drule(1) subsetD)\n apply clarsimp\n done\n\nlemma inj_Pair:\n \"inj_on (Pair x) S\"\n by (rule inj_onI, simp)\n\nlemma inj_on_split:\n \"inj_on f S \\ inj_on (\\x. (z, f x)) S\"\n by (auto simp: inj_on_def)\n\nlemma less_Suc_unat_less_bound:\n \"n < Suc (unat (x :: ('a :: len) word)) \\ n < 2 ^ len_of TYPE('a)\"\n apply (erule order_less_le_trans)\n apply (rule Suc_leI)\n apply simp\n done\n\nlemma map_snd_zip_prefix:\n \"map snd (zip xs ys) \\ ys\"\n apply (induct xs arbitrary: ys)\n apply simp\n apply (case_tac ys)\n apply simp\n apply simp\n done\n\n\n\n(****************************************\n * Take, drop, zip, list_all etc rules. *\n ****************************************)\n\nlemma nth_upt_0 [simp]:\n \"i < length xs \\ [0..\n insert (xs ! i) (set (take i xs)) = set (take (Suc i) xs)\"\n by (subst take_Suc_conv_app_nth, assumption, fastforce)\n\nlemma zip_take_drop:\n \"\\n < length xs; length ys = length xs\\ \\\n zip xs (take n ys @ a # drop (Suc n) ys) =\n zip (take n xs) (take n ys) @ (xs ! n, a) # zip (drop (Suc n) xs) (drop (Suc n) ys)\"\n by (subst id_take_nth_drop, assumption, simp)\n\nlemma take_nth_distinct:\n \"\\distinct xs; n < length xs; xs ! n \\ set (take n xs)\\ \\ False\"\n by (fastforce simp: distinct_conv_nth in_set_conv_nth)\n\nlemma take_drop_append:\n \"drop a xs = take b (drop a xs) @ drop (a + b) xs\"\n by (metis append_take_drop_id drop_drop add.commute)\n\nlemma drop_take_drop:\n \"drop a (take (b + a) xs) @ drop (b + a) xs = drop a xs\"\n by (metis add.commute take_drop take_drop_append)\n\nlemma map_fst_zip':\n \"length xs \\ length ys \\ map fst (zip xs ys) = xs\"\n by (metis length_map length_zip map_fst_zip_prefix min_absorb1 not_prefixI)\n\nlemma zip_take_length:\n \"zip xs (take (length xs) ys) = zip xs ys\"\n by (metis order_refl zip_take_triv2)\n\nlemma zip_singleton:\n \"ys \\ [] \\ zip [a] ys = [(a, ys ! 0)]\"\n by (case_tac ys, simp_all)\n\nlemma zip_append_singleton:\n \"\\i = length xs; length xs < length ys\\\n \\ zip (xs @ [a]) ys = (zip xs ys) @ [(a,ys ! i)]\"\n apply (induct xs)\n apply (case_tac ys, simp_all)\n apply (case_tac ys, simp_all)\n apply (clarsimp simp: zip_append1 zip_take_length zip_singleton)\n done\n\nlemma ran_map_of_zip:\n \"\\length xs = length ys; distinct xs\\ \\ ran (map_of (zip xs ys)) = set ys\"\n by (induct rule: list_induct2, simp_all)\n\nlemma map_of_zip_range:\n \"\\length xs = length ys; distinct xs\\\n \\ (\\x. (the (map_of (zip xs ys) x))) ` set xs = set ys\"\n apply (clarsimp simp: image_def)\n apply (subst ran_map_of_zip [symmetric, where xs=xs and ys=ys], simp+)\n apply (clarsimp simp: ran_def)\n apply (rule)\n apply clarsimp\n apply (frule_tac x=xa in map_of_zip_is_Some, clarsimp)\n apply fast\n apply (clarsimp simp: set_zip)\n by (metis domI dom_map_of_zip nth_mem ranE ran_map_of_zip option.sel)\n\nlemma map_zip_fst:\n \"length xs = length ys \\ map (\\(x, y). f x) (zip xs ys) = map f xs\"\n apply (induct xs arbitrary: ys)\n apply simp\n apply (case_tac ys, clarsimp+)\n done\n\nlemma map_zip_fst':\n \"length xs \\ length ys \\ map (\\(x, y). f x) (zip xs ys) = map f xs\"\n by (metis length_map map_fst_zip' map_zip_fst zip_map_fst_snd)\n\nlemma map_zip_snd:\n \"length xs = length ys \\ map (\\(x, y). f y) (zip xs ys) = map f ys\"\n apply (induct ys arbitrary: xs)\n apply simp\n apply (case_tac xs, clarsimp+)\n done\n\nlemma map_zip_snd':\n \"length ys \\ length xs \\ map (\\(x, y). f y) (zip xs ys) = map f ys\"\n apply (induct ys arbitrary: xs)\n apply simp\n apply (case_tac xs, clarsimp+)\n done\n\nlemma map_of_zip_tuple_in:\n \"\\(x, y) \\ set (zip xs ys); distinct xs\\ \\ map_of (zip xs ys) x = Some y\"\n apply (induct xs arbitrary: ys, simp_all)\n apply (case_tac ys, clarsimp+)\n apply (rule conjI)\n apply (metis in_set_zipE)\n apply clarsimp\n done\n\nlemma in_set_zip1:\n \"(x, y) \\ set (zip xs ys) \\ x \\ set xs\"\n by (metis in_set_zipE)\n\nlemma in_set_zip2:\n \"(x, y) \\ set (zip xs ys) \\ y \\ set ys\"\n by (metis in_set_zipE)\n\nlemma map_zip_snd_take:\n \"map (\\(x, y). f y) (zip xs ys) = map f (take (length xs) ys)\"\n apply (subst map_zip_snd' [symmetric, where xs=xs and ys=\"take (length xs) ys\"])\n apply simp\n apply (subst zip_take_length [symmetric], simp)\n done\n\nlemma map_of_zip_is_index:\n \"\\length xs = length ys; x \\ set xs\\\n \\ \\i. (map_of (zip xs ys)) x = Some (ys ! i)\"\n apply (induct rule: list_induct2, simp_all)\n apply (rule conjI)\n apply clarsimp\n apply (metis nth_Cons_0)\n apply clarsimp\n apply (metis nth_Cons_Suc)\n done\n\nlemma map_of_zip_take_update:\n \"\\i < length xs; length xs \\ length ys; distinct xs\\\n \\ map_of (zip (take i xs) ys)(xs ! i \\ (ys ! i)) =\n map_of (zip (take (Suc i) xs) ys)\"\n apply (rule ext)\n apply (case_tac \"x=xs ! i\", simp_all)\n apply clarsimp\n apply (rule map_of_is_SomeI[symmetric])\n apply (simp add: map_fst_zip')\n apply (simp add: set_zip)\n apply (rule_tac x=i in exI)\n apply clarsimp\n apply (clarsimp simp: take_Suc_conv_app_nth zip_append_singleton map_add_def\n split: option.splits)\n done\n\n(* A weaker version of map_of_zip_is_Some (from HOL). *)\nlemma map_of_zip_is_Some':\n \"length xs \\ length ys \\ (x \\ set xs) = (\\y. map_of (zip xs ys) x = Some y)\"\n apply (subst zip_take_length[symmetric])\n apply (rule map_of_zip_is_Some)\n by (metis length_take min_absorb2)\n\nlemma map_of_zip_inj:\n \"\\distinct xs; distinct ys; length xs = length ys\\\n \\ inj_on (\\x. (the (map_of (zip xs ys) x))) (set xs)\"\n apply (clarsimp simp: inj_on_def)\n apply (subst (asm) map_of_zip_is_Some, assumption)+\n apply clarsimp\n apply (clarsimp simp: set_zip)\n by (metis nth_eq_iff_index_eq)\n\nlemma map_of_zip_inj':\n \"\\distinct xs; distinct ys; length xs \\ length ys\\\n \\ inj_on (\\x. (the (map_of (zip xs ys) x))) (set xs)\"\n apply (subst zip_take_length[symmetric])\n apply (erule map_of_zip_inj, simp)\n by (metis length_take min_absorb2)\n\nlemma list_all_nth:\n \"\\list_all P xs; i < length xs\\ \\ P (xs ! i)\"\n by (metis list_all_length)\n\nlemma list_all_update:\n \"\\list_all P xs; i < length xs; \\x. P x \\ P (f x)\\\n \\ list_all P (xs [i := f (xs ! i)])\"\n by (metis length_list_update list_all_length nth_list_update)\n\nlemma list_allI:\n \"\\list_all P xs; \\x. P x \\ P' x\\ \\ list_all P' xs\"\n by (metis list_all_length)\n\nlemma list_all_imp_filter:\n \"list_all (\\x. f x \\ g x) xs\n = list_all (\\x. g x) [x\\xs . f x]\"\n by (fastforce simp: Ball_set_list_all[symmetric])\n\nlemma list_all_imp_filter2:\n \"list_all (\\x. f x \\ g x) xs\n = list_all (\\x. \\f x) [x\\xs . (\\x. \\g x) x]\"\n by (fastforce simp: Ball_set_list_all[symmetric])\n\nlemma list_all_imp_chain:\n \"\\list_all (\\x. f x \\ g x) xs; list_all (\\x. f' x \\ f x) xs\\\n \\\n list_all (\\x. f' x \\ g x) xs\"\n by (clarsimp simp: Ball_set_list_all [symmetric])\n\n(***********************\n * distinct_sets rules *\n ***********************)\n\nlemma distinct_sets_union_sub:\n \"\\x \\ A; distinct_sets [A,B]\\ \\ A \\ B - {x} = A - {x} \\ B\"\n by (auto simp: distinct_sets_def)\n\nlemma distinct_sets_append:\n \"distinct_sets (xs @ ys) \\ distinct_sets xs \\ distinct_sets ys\"\n apply (subst distinct_sets_prop)+\n apply (subst (asm) distinct_sets_prop)\n apply (subst (asm) distinct_prop_append)\n apply clarsimp\n done\n\nlemma distinct_sets_append1:\n \"distinct_sets (xs @ ys) \\ distinct_sets xs\"\n by (drule distinct_sets_append, simp)\n\n\nlemma distinct_sets_append2:\n \"distinct_sets (xs @ ys) \\ distinct_sets ys\"\n by (drule distinct_sets_append, simp)\n\nlemma distinct_sets_append_Cons:\n \"distinct_sets (xs @ a # ys) \\ distinct_sets (xs @ ys)\"\n apply (subst distinct_sets_prop)+\n apply (subst (asm) distinct_sets_prop)\n apply (subst distinct_prop_append)\n apply (subst (asm) distinct_prop_append)\n apply clarsimp\n done\n\nlemma distinct_sets_append_Cons_disjoint:\n \"distinct_sets (xs @ a # ys) \\ a \\ \\set xs = {} \"\n apply (subst (asm) distinct_sets_prop)\n apply (subst (asm) distinct_prop_append)\n apply (subst Int_commute)\n apply (subst Union_disjoint)\n apply clarsimp\n done\n\nlemma distinct_prop_take:\n \"\\distinct_prop P xs; i < length xs\\\n \\ distinct_prop P (take i xs)\"\n by (metis take_is_prefixeq distinct_prop_prefixE)\n\nlemma distinct_sets_take:\n \"\\distinct_sets xs; i < length xs\\\n \\ distinct_sets (take i xs)\"\n by (simp add: distinct_sets_prop distinct_prop_take)\n\nlemma distinct_prop_take_Suc:\n \"\\distinct_prop P xs; i < length xs\\\n \\ distinct_prop P (take (Suc i) xs)\"\n by (metis distinct_prop_take not_less take_all)\n\nlemma distinct_sets_take_Suc:\n \"\\distinct_sets xs; i < length xs\\\n \\ distinct_sets (take (Suc i) xs)\"\n by (simp add: distinct_sets_prop distinct_prop_take_Suc)\n\nlemma distinct_prop_rev:\n \"distinct_prop P (rev xs) = distinct_prop (\\y x. P x y) xs\"\n apply (induct xs)\n apply clarsimp\n apply clarsimp\n apply rule\n apply (subst (asm) distinct_prop_append, simp)\n apply (subst distinct_prop_append, simp)\n done\n\nlemma distinct_sets_rev [simp]:\n \"distinct_sets (rev xs) = distinct_sets xs\"\n apply (unfold distinct_sets_prop)\n apply (subst distinct_prop_rev)\n apply (subst Int_commute)\n apply clarsimp\n done\n\nlemma distinct_sets_drop:\n \"\\distinct_sets xs; i < length xs\\\n \\ distinct_sets (drop i xs)\"\n apply (case_tac \"i=0\", simp)\n apply (subst distinct_sets_rev [symmetric])\n apply (subst rev_drop)\n apply (subst distinct_sets_take, simp_all)\n done\n\nlemma distinct_sets_drop_Suc:\n \"\\distinct_sets xs; i < length xs\\\n \\ distinct_sets (drop (Suc i) xs)\"\n apply (subst distinct_sets_rev [symmetric])\n apply (subst rev_drop)\n apply (subst distinct_sets_take, simp_all)\n done\n\nlemma distinct_sets_take_nth:\n \"\\distinct_sets xs; i < length xs; x \\ set (take i xs)\\ \\ x \\ xs ! i = {}\"\n apply (drule (1) distinct_sets_take_Suc)\n apply (subst (asm) take_Suc_conv_app_nth, assumption)\n apply (unfold distinct_sets_prop)\n apply (subst (asm) distinct_prop_append)\n apply clarsimp\n done\n\nlemma distinct_sets_drop_nth:\n \"\\distinct_sets xs; i < length xs; x \\ set (drop (Suc i) xs)\\ \\ x \\ xs ! i = {}\"\n apply (drule (1) distinct_sets_drop)\n apply (subst (asm) drop_Suc_nth, assumption)\n apply fastforce\n done\n\nlemma distinct_sets_append_distinct:\n \"\\x \\ set xs; y \\ set ys; distinct_sets (xs @ ys)\\\n \\ x \\ y = {}\"\n apply (unfold distinct_sets_prop)\n apply (clarsimp simp: distinct_prop_append)\n done\n\nlemma distinct_sets_update:\n \"\\a \\ xs ! i; distinct_sets xs; i < length xs\\\n \\ distinct_sets (xs[i := a])\"\n apply (subst distinct_sets_prop)\n apply (subst (asm) distinct_sets_prop)\n apply (subst upd_conv_take_nth_drop)\n apply simp\n apply (subst distinct_prop_append)\n apply (intro conjI)\n apply (erule (1) distinct_prop_take)\n apply (rule conjI|clarsimp)+\n apply (fold distinct_sets_prop)\n apply (drule (1) distinct_sets_drop)\n apply (subst (asm) drop_Suc_nth, assumption)\n apply clarsimp\n apply blast\n apply (drule (1) distinct_sets_drop)\n apply (subst (asm) drop_Suc_nth, assumption)\n apply clarsimp\n apply clarsimp\n apply rule\n apply (drule (2) distinct_sets_take_nth)\n apply blast\n apply clarsimp\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (subst (asm) id_take_nth_drop, assumption)\n apply (drule distinct_sets_append_Cons)\n apply (erule (2) distinct_sets_append_distinct)\n done\n\n\nlemma distinct_sets_map_update:\n \"\\distinct_sets (map f xs); i < length xs; f a \\ f(xs ! i)\\\n \\ distinct_sets (map f (xs[i := a]))\"\n by (metis distinct_sets_update length_map map_update nth_map)\n\nlemma Union_list_update:\n \"\\i < length xs; distinct_sets (map f xs)\\\n \\\n (\\x\\set (xs [i := a]). f x)\n = (\\x\\set xs. f x) - f (xs ! i) \\ f a\"\n apply (induct xs arbitrary: i)\n apply clarsimp\n apply clarsimp\n apply (case_tac i)\n apply clarsimp\n apply fastforce\n apply fastforce\n done\n\nlemma if_fold:\"(if P then Q else if P then R else S) = (if P then Q else S)\"\n by presburger\n\nlemma fold_and_false[simp]:\"\\(fold (op \\) xs False)\"\n apply clarsimp\n apply (induct xs)\n apply simp\n apply simp\n done\n\nlemma fold_and_true:\"fold (op \\) xs True \\ \\i < length xs. xs ! i\"\n apply clarsimp\n apply (induct xs)\n apply simp\n apply (case_tac \"i = 0\"; simp)\n apply (case_tac a; simp)\n apply (case_tac a; simp)\n done\n\nlemma fold_or_true[simp]:\"fold (op \\) xs True\"\n by (induct xs, simp+)\n\nlemma fold_or_false:\"\\(fold (op \\) xs False) \\ \\i < length xs. \\(xs ! i)\"\n apply (induct xs, simp+)\n apply (case_tac a, simp+)\n apply (rule allI, case_tac \"i = 0\", simp+)\n done\n\nlemma fst_enumerate:\"i < length xs \\ fst (enumerate n xs ! i) = i + n\"\n by (metis add.commute fst_conv nth_enumerate_eq)\n\nlemma snd_enumerate:\"i < length xs \\ snd (enumerate n xs ! i) = xs ! i\"\n by (metis nth_enumerate_eq snd_conv)\n\nlemma pair_unpack:\"((a, b) = x) = (a = fst x \\ b = snd x)\"\n by fastforce\n\nlemma enumerate_member:\"i < length xs \\ (n + i, xs ! i) \\ set (enumerate n xs)\"\n apply (subgoal_tac \"(n + i, xs ! i) = enumerate n xs ! i\")\n apply clarsimp\n apply (subst pair_unpack)\n apply (rule conjI)\n apply (simp add:fst_enumerate)\n apply (simp add:snd_enumerate)\n done\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/DistinctPropLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.29238142966199177}} {"text": "(* Title: HOL/Auth/Guard/Guard_Shared.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\lemmas on guarded messages for protocols with symmetric keys\\\n\ntheory Guard_Shared imports Guard GuardK \"../Shared\" begin\n\nsubsection\\Extensions to Theory \\Shared\\\\\n\ndeclare initState.simps [simp del]\n\nsubsubsection\\a little abbreviation\\\n\nabbreviation\n Ciph :: \"agent => msg => msg\" where\n \"Ciph A X == Crypt (shrK A) X\"\n\nsubsubsection\\agent associated to a key\\\n\ndefinition agt :: \"key => agent\" where\n\"agt K == @A. K = shrK A\"\n\nlemma agt_shrK [simp]: \"agt (shrK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection\\basic facts about @{term initState}\\\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X ~:parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X ~:analz (initState A)\"\nby auto\n\nlemma no_shrK_in_analz_init [simp]: \"A ~:bad\n==> Key (shrK A) ~:analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma shrK_notin_initState_Friend [simp]: \"A ~= Friend C\n==> Key (shrK A) ~: parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection\\sets of symmetric keys\\\n\ndefinition shrK_set :: \"key set => bool\" where\n\"shrK_set Ks == ALL K. K:Ks --> (EX A. K = shrK A)\"\n\nlemma in_shrK_set: \"[| shrK_set Ks; K:Ks |] ==> EX A. K = shrK A\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set1 [iff]: \"shrK_set {shrK A}\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set2 [iff]: \"shrK_set {shrK A, shrK B}\"\nby (simp add: shrK_set_def)\n\nsubsubsection\\sets of good keys\\\n\ndefinition good :: \"key set => bool\" where\n\"good Ks == ALL K. K:Ks --> agt K ~:bad\"\n\nlemma in_good: \"[| good Ks; K:Ks |] ==> agt K ~:bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A ~:bad ==> good {shrK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A ~:bad; B ~:bad |] ==> good {shrK A, shrK B}\"\nby (simp add: good_def)\n\n\nsubsection\\Proofs About Guarded Messages\\\n\nsubsubsection\\small hack\\\n\nlemma shrK_is_invKey_shrK: \"shrK A = invKey (shrK A)\"\nby simp\n\nlemmas shrK_is_invKey_shrK_substI = shrK_is_invKey_shrK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n:parts {X} ==> Crypt (shrK A) X:guard n {shrK A}\"\napply (rule shrK_is_invKey_shrK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection\\guardedness results on nonces\\\n\nlemma guard_ciph [simp]: \"shrK A:Ks ==> Ciph A X:guard n Ks\"\nby (rule Guard_Nonce, simp)\n\nlemma guardK_ciph [simp]: \"shrK A:Ks ==> Ciph A X:guardK n Ks\"\nby (rule Guard_Key, simp)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n ~:used evs\n==> Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\guardedness results on keys\\\n\nlemma GuardK_init [simp]: \"n ~:range shrK ==> GuardK n Ks (initState B)\"\nby (induct B, auto simp: GuardK_def initState.simps)\n\nlemma GuardK_knows_max': \"[| GuardK n A (knows_max' C evs); n ~:range shrK |]\n==> GuardK n A (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Key_not_used_GuardK_spies [dest]: \"Key n ~:used evs\n==> GuardK n A (spies evs)\"\nby (auto simp: GuardK_def dest: not_used_not_known parts_sub)\n\nlemma Key_not_used_GuardK [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_used parts_trans)\n\nlemma Key_not_used_GuardK_max [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_max_used parts_trans)\n\nlemma Key_not_used_GuardK_max' [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in GuardK_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\regular protocols\\\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p == ALL evs A. evs:p --> (Key (shrK A):parts (spies evs)) = (A:bad)\"\n\nlemma shrK_parts_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (shrK A):parts (spies evs)) = (A:bad)\"\nby (auto simp: regular_def)\n\nlemma shrK_analz_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (shrK A):analz (spies evs)) = (A:bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs:p;\nshrK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_shrK_set, simp+, clarify)\napply (frule_tac A=A in shrK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nlemma GuardK_Key_analz:\n assumes \"GuardK n Ks (spies evs)\" \"evs \\ p\" \"shrK_set Ks\"\n \"good Ks\" \"regular p\" \"n \\ range shrK\"\n shows \"Key n \\ analz (spies evs)\"\nproof (rule ccontr)\n assume \"\\ Key n \\ analz (knows Spy evs)\"\n then have *: \"Key n \\ analz (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp)\n from \\GuardK n Ks (spies evs)\\\n have \"GuardK n Ks (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp) \n then have \"GuardK n Ks (spies' evs)\"\n and \"finite (spies' evs)\" \"keyset (initState Spy)\"\n by simp_all\n moreover have \"Key n \\ initState Spy\"\n using \\n \\ range shrK\\ by (simp add: image_iff initState_Spy)\n ultimately obtain K\n where \"K \\ Ks\" and **: \"Key K \\ analz (spies' evs \\ initState Spy)\"\n using * by (auto dest: GuardK_invKey_keyset)\n from \\K \\ Ks\\ and \\good Ks\\ have \"agt K \\ bad\"\n by (auto dest: in_good)\n from \\K \\ Ks\\ \\shrK_set Ks\\ obtain A\n where \"K = shrK A\"\n by (auto dest: in_shrK_set)\n then have \"agt K \\ bad\"\n using ** \\evs \\ p\\ \\regular p\\ shrK_analz_iff_bad [of evs p \"agt K\"]\n by (simp add: knows_decomp)\n with \\agt K \\ bad\\ show False by simp\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/Guard_Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.29214426401641486}} {"text": "(* Title: JinjaThreads/MM/JMM_Type.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\JMM heap implementation 1\\\n\ntheory JMM_Type\nimports \n \"../Common/ExternalCallWF\"\n \"../Common/ConformThreaded\"\n JMM_Heap\nbegin\n\nsubsection \\Definitions\\\n\ntext \\\n The JMM heap only stores type information.\n\\\n\ntype_synonym 'addr JMM_heap = \"'addr \\ htype\"\n\ntranslations (type) \"'addr JMM_heap\" <= (type) \"'addr \\ htype option\"\n\nabbreviation jmm_empty :: \"'addr JMM_heap\" where \"jmm_empty == Map.empty\"\n\ndefinition jmm_allocate :: \"'addr JMM_heap \\ htype \\ ('addr JMM_heap \\ 'addr) set\"\nwhere \"jmm_allocate h hT = (\\a. (h(a \\ hT), a)) ` {a. h a = None}\"\n\ndefinition jmm_typeof_addr :: \"'addr JMM_heap \\ 'addr \\ htype\"\nwhere \"jmm_typeof_addr h = h\"\n\ndefinition jmm_heap_read :: \"'addr JMM_heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\nwhere \"jmm_heap_read h a ad v = True\"\n\ncontext\n notes [[inductive_internals]]\nbegin\n\ninductive jmm_heap_write :: \"'addr JMM_heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'addr JMM_heap \\ bool\"\nwhere \"jmm_heap_write h a ad v h\"\n\nend\n\ndefinition jmm_hconf :: \"'m prog \\ 'addr JMM_heap \\ bool\" (\"_ \\jmm _ \\\" [51,51] 50)\nwhere \"P \\jmm h \\ \\ ty_of_htype ` ran h \\ {T. is_type P T}\"\n\ndefinition jmm_allocated :: \"'addr JMM_heap \\ 'addr set\"\nwhere \"jmm_allocated h = dom (jmm_typeof_addr h)\"\n\ndefinition jmm_spurious_wakeups :: bool\nwhere \"jmm_spurious_wakeups = True\"\n\nlemmas jmm_heap_ops_defs =\n jmm_allocate_def jmm_typeof_addr_def \n jmm_heap_read_def jmm_heap_write_def\n jmm_allocated_def jmm_spurious_wakeups_def\n\ntype_synonym 'addr thread_id = \"'addr\"\n\nabbreviation (input) addr2thread_id :: \"'addr \\ 'addr thread_id\"\nwhere \"addr2thread_id \\ \\x. x\"\n\nabbreviation (input) thread_id2addr :: \"'addr thread_id \\ 'addr\"\nwhere \"thread_id2addr \\ \\x. x\"\n\ninterpretation jmm: heap_base\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \n.\n\nnotation jmm.hext (\"_ \\jmm _\" [51,51] 50)\nnotation jmm.conf (\"_,_ \\jmm _ :\\ _\" [51,51,51,51] 50)\nnotation jmm.addr_loc_type (\"_,_ \\jmm _@_ : _\" [50, 50, 50, 50, 50] 51)\nnotation jmm.confs (\"_,_ \\jmm _ [:\\] _\" [51,51,51,51] 50)\nnotation jmm.tconf (\"_,_ \\jmm _ \\t\" [51,51,51] 50)\n\ntext \\Now a variation of the JMM with a different read operation that permits to read only type-conformant values\\\n\ninterpretation jmm': heap_base\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n for P .\n\nnotation jmm'.hext (\"_ \\jmm'' _\" [51,51] 50)\nnotation jmm'.conf (\"_,_ \\jmm'' _ :\\ _\" [51,51,51,51] 50)\nnotation jmm'.addr_loc_type (\"_,_ \\jmm'' _@_ : _\" [50, 50, 50, 50, 50] 51)\nnotation jmm'.confs (\"_,_ \\jmm'' _ [:\\] _\" [51,51,51,51] 50)\nnotation jmm'.tconf (\"_,_ \\jmm'' _ \\t\" [51,51,51] 50)\n\nsubsection \\Heap locale interpretations\\\n\nsubsection \\Locale \\heap\\\\\n\nlemma jmm_heap: \"heap addr2thread_id thread_id2addr jmm_allocate jmm_typeof_addr jmm_heap_write P\"\nproof\n fix h' a h hT\n assume \"(h', a) \\ jmm_allocate h hT\"\n thus \"jmm_typeof_addr h' a = \\hT\\\"\n by(auto simp add: jmm_heap_ops_defs)\nnext\n fix h' :: \"('addr :: addr) JMM_heap\" and h hT a\n assume \"(h', a) \\ jmm_allocate h hT\"\n thus \"h \\jmm h'\"\n by(fastforce simp add: jmm_heap_ops_defs intro: jmm.hextI)\nnext\n fix h a al v and h' :: \"('addr :: addr) JMM_heap\"\n assume \"jmm_heap_write h a al v h'\"\n thus \"h \\jmm h'\" by cases auto\nqed simp\n\ninterpretation jmm: heap\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write\n P\n for P\nby(rule jmm_heap)\n\ndeclare jmm.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nlemmas jmm'_heap = jmm_heap\n\ninterpretation jmm': heap\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n P\n for P\nby(rule jmm'_heap)\n\ndeclare jmm'.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nsubsection \\Locale \\heap_conf\\\\\n\ninterpretation jmm: heap_conf_base\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n P\n for P .\n\nabbreviation (input) jmm'_hconf :: \"'m prog \\ 'addr JMM_heap \\ bool\" (\"_ \\jmm'' _ \\\" [51,51] 50)\nwhere \"jmm'_hconf == jmm_hconf\"\n\ninterpretation jmm': heap_conf_base\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n P\n for P .\n\nabbreviation jmm_heap_read_typeable :: \"('addr :: addr) itself \\ 'm prog \\ bool\"\nwhere \"jmm_heap_read_typeable tytok P \\ jmm.heap_read_typeable (jmm_hconf P :: 'addr JMM_heap \\ bool) P\"\n\nabbreviation jmm'_heap_read_typeable :: \"('addr :: addr) itself \\ 'm prog \\ bool\"\nwhere \"jmm'_heap_read_typeable tytok P \\ jmm'.heap_read_typeable TYPE('m) P (jmm_hconf P :: 'addr JMM_heap \\ bool) P\"\n\nlemma jmm_heap_read_typeable: \"jmm_heap_read_typeable tytok P\"\nby(rule jmm.heap_read_typeableI)(simp add: jmm_heap_read_def)\n\nlemma jmm'_heap_read_typeable: \"jmm'_heap_read_typeable tytok P\"\nby(rule jmm'.heap_read_typeableI)(auto simp add: jmm.heap_read_typed_def jmm_heap_read_def dest: jmm'.addr_loc_type_fun)\n\nlemma jmm_heap_conf:\n \"heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_write (jmm_hconf P) P\"\nproof\n show \"P \\jmm jmm_empty \\\"\n by(simp add: jmm_hconf_def)\nnext\n fix h a hT\n assume \"jmm_typeof_addr h a = \\hT\\\" \"P \\jmm h \\\"\n thus \"is_htype P hT\" by(auto simp add: jmm_hconf_def jmm_heap_ops_defs intro: ranI)\nnext\n fix h' h hT a\n assume \"(h', a) \\ jmm_allocate h hT\" \"P \\jmm h \\\" \"is_htype P hT\"\n thus \"P \\jmm h' \\\"\n by(fastforce simp add: jmm_hconf_def jmm_heap_ops_defs ran_def split: if_split_asm)\nnext\n fix h a al v h' T\n assume \"jmm_heap_write h a al v h'\" \"P \\jmm h \\\"\n and \"jmm.addr_loc_type P h a al T\" and \"P,h \\jmm v :\\ T\"\n thus \"P \\jmm h' \\\" by(cases) simp\nqed\n\ninterpretation jmm: heap_conf\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n P\n for P\nby(rule jmm_heap_conf)\n\nlemmas jmm'_heap_conf = jmm_heap_conf\n\ninterpretation jmm': heap_conf\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n P\n for P\nby(rule jmm'_heap_conf)\n\nsubsection \\Locale \\heap_progress\\\\\n\nlemma jmm_heap_progress:\n \"heap_progress addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write (jmm_hconf P) P\"\nproof\n fix h a al T\n assume \"P \\jmm h \\\"\n and al: \"jmm.addr_loc_type P h a al T\"\n show \"\\v. jmm_heap_read h a al v \\ P,h \\jmm v :\\ T\"\n using jmm.defval_conf[of P h T] unfolding jmm_heap_ops_defs by blast\nnext\n fix h a al T v\n assume \"jmm.addr_loc_type P h a al T\"\n show \"\\h'. jmm_heap_write h a al v h'\"\n by(auto intro: jmm_heap_write.intros)\nqed\n\ninterpretation jmm: heap_progress\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n P\n for P\nby(rule jmm_heap_progress)\n\nlemma jmm'_heap_progress:\n \"heap_progress addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr (jmm.heap_read_typed P) jmm_heap_write (jmm'_hconf P) P\"\nproof\n fix h a al T\n assume \"P \\jmm' h \\\"\n and al: \"jmm'.addr_loc_type P h a al T\"\n thus \"\\v. jmm.heap_read_typed P h a al v \\ P,h \\jmm' v :\\ T\"\n unfolding jmm.heap_read_typed_def jmm_heap_read_def\n by(auto dest: jmm'.addr_loc_type_fun intro: jmm'.defval_conf)\nnext\n fix h a al T v\n assume \"jmm'.addr_loc_type P h a al T\"\n and \"P,h \\jmm' v :\\ T\"\n thus \"\\h'. jmm_heap_write h a al v h'\"\n by(auto intro: jmm_heap_write.intros)\nqed\n\ninterpretation jmm': heap_progress\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n P\n for P\nby(rule jmm'_heap_progress)\n\nsubsection \\Locale \\heap_conf_read\\\\\n\nlemma jmm'_heap_conf_read:\n \"heap_conf_read addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr (jmm.heap_read_typed P) jmm_heap_write (jmm'_hconf P) P\"\nby(rule jmm.heap_conf_read_heap_read_typed)\n\ninterpretation jmm': heap_conf_read\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n P\n for P\nby(rule jmm'_heap_conf_read)\n\ninterpretation jmm': heap_typesafe\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n P\n for P\n..\n\nsubsection \\Locale \\allocated_heap\\\\\n\nlemma jmm_allocated_heap: \n \"allocated_heap addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_write jmm_allocated P\"\nproof\n show \"jmm_allocated jmm_empty = {}\" by(auto simp add: jmm_heap_ops_defs)\nnext\n fix h' a h hT\n assume \"(h', a) \\ jmm_allocate h hT\"\n thus \"jmm_allocated h' = insert a (jmm_allocated h) \\ a \\ jmm_allocated h\"\n by(auto simp add: jmm_heap_ops_defs split: if_split_asm)\nnext\n fix h a al v h'\n assume \"jmm_heap_write h a al v h'\"\n thus \"jmm_allocated h' = jmm_allocated h\" by cases simp\nqed\n\ninterpretation jmm: allocated_heap\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write\n jmm_allocated\n P\n for P\nby(rule jmm_allocated_heap)\n\nlemmas jmm'_allocated_heap = jmm_allocated_heap\n\ninterpretation jmm': allocated_heap\n addr2thread_id thread_id2addr\n jmm_spurious_wakeups\n jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n jmm_allocated\n P\n for P\nby(rule jmm'_allocated_heap)\n\nsubsection \\Syntax translations\\\n\nnotation jmm'.external_WT' (\"_,_ \\jmm'' (_\\_'(_')) : _\" [50,0,0,0,50] 60)\n\nabbreviation jmm'_red_external :: \n \"'m prog \\ 'addr thread_id \\ 'addr JMM_heap \\ 'addr \\ mname \\ 'addr val list\n \\ ('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \n \\ 'addr extCallRet \\ 'addr JMM_heap \\ bool\"\nwhere \"jmm'_red_external P \\ jmm'.red_external (TYPE('m)) P P\"\n\nabbreviation jmm'_red_external_syntax :: \n \"'m prog \\ 'addr thread_id \\ 'addr \\ mname \\ 'addr val list \\ 'addr JMM_heap\n \\ ('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \n \\ 'addr extCallRet \\ 'addr JMM_heap \\ bool\"\n (\"_,_ \\jmm'' (\\(_\\_'(_')),/_\\) -_\\ext (\\(_),/(_)\\)\" [50, 0, 0, 0, 0, 0, 0, 0, 0] 51)\nwhere\n \"P,t \\jmm' \\a\\M(vs), h\\ -ta\\ext \\va, h'\\ \\ jmm'_red_external P t h a M vs ta va h'\"\n\nabbreviation jmm'_red_external_aggr :: \n \"'m prog \\ 'addr thread_id \\ 'addr \\ mname \\ 'addr val list \\ 'addr JMM_heap \n \\ (('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \\ 'addr extCallRet \\ 'addr JMM_heap) set\"\nwhere \"jmm'_red_external_aggr P \\ jmm'.red_external_aggr TYPE('m) P P\"\n\nabbreviation jmm'_heap_copy_loc :: \n \"'m prog \\ 'addr \\ 'addr \\ addr_loc \\ 'addr JMM_heap\n \\ ('addr :: addr, 'addr thread_id) obs_event list \\ 'addr JMM_heap \\ bool\"\nwhere \"jmm'_heap_copy_loc \\ jmm'.heap_copy_loc TYPE('m)\"\n\nabbreviation jmm'_heap_copies :: \n \"'m prog \\ 'addr \\ 'addr \\ addr_loc list \\ 'addr JMM_heap\n \\ ('addr :: addr, 'addr thread_id) obs_event list \\ 'addr JMM_heap \\ bool\"\nwhere \"jmm'_heap_copies \\ jmm'.heap_copies TYPE('m)\"\n\nabbreviation jmm'_heap_clone ::\n \"'m prog \\ 'addr JMM_heap \\ 'addr \\ 'addr JMM_heap\n \\ (('addr :: addr, 'addr thread_id) obs_event list \\ 'addr) option \\ bool\"\nwhere \"jmm'_heap_clone P \\ jmm'.heap_clone TYPE('m) P P\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/MM/JMM_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.29214426401641486}} {"text": "theory Failures_TickTock_SeqComp\n\nimports\n Failures_TickTock\nbegin\n\nlemma ttproc2F_SeqCompTT_failures_subseteq_SeqCompF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n and TTwf_Q: \"TTwf Q\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\"\n shows \"fst (ttproc2F (P ;\\<^sub>C Q)) \\ fst ((ttproc2F P) ;\\<^sub>F (ttproc2F Q))\" \n using assms unfolding ttproc2F_def SeqCompTT_def SeqCompF_def\nproof (auto)\n fix a b s t\n assume assm1:\"\\s t. a = s @ t \\ (\\y. s @ [tick] = tt2T y \\ y \\ P) \\ (\\y. Some (t, b) = tt2F y \\ y \\ Q)\"\n and assm2:\"Some (a, b) = tt2F (s @ t)\" \n and assm3:\"s @ [[Tick]\\<^sub>E] \\ P\" \n and assm4:\"t \\ Q\"\n\n have \"a = tt2T (s@t)\"\n using Some_tt2F_imp_tt2T' assm2 by blast\n\n have \"\\y. tt2F (s @ t) = tt2F y \\ y \\\\<^sub>C s\"\n using assm1 assm2 assm3 assm4\n proof (induct t arbitrary:s a b rule:rev_induct)\n case Nil\n then show ?case\n apply (rule_tac x=\"s\" in exI, auto)\n using tt_prefix_subset_refl by blast\n next\n case (snoc x t)\n then show ?case\n proof (cases x)\n case (ObsEvent x1)\n then have \"tt2F (s @ t @ [x]) = None\"\n using snoc\n by (metis Some_tt2F_concat_refusal append_is_Nil_conv last_appendR last_snoc ttobs.distinct(1))\n then show ?thesis using snoc by auto\n next\n case (Ref x2)\n then have \"[Tick]\\<^sub>E \\ set s\" \"[Tock]\\<^sub>E \\ set s\" \"\\(\\R. [R]\\<^sub>R \\ set s)\"\n using TTwf_P TTwf_concat_prefix_set_no_Tick snoc.prems(3) apply blast\n using Some_tt2F_no_Tock snoc.prems(2) apply fastforce\n using snoc Some_tt2F_no_prev_refusals Ref \n by (metis (no_types) Some_tt2F_no_prev_refusals UnCI append.assoc set_append)\n then have \"a = (tt2T s) @ (tt2T t)\"\n by (smt Some_tt2F_concat_refusal append.assoc append_same_eq last_snoc snoc.prems(2) tt2T_concat_dist)\n\n then have pp:\"(\\y. (tt2T s) @ [tick] = tt2T y \\ y \\ P) \\ (\\y. Some ((tt2T t), b) = tt2F y \\ y \\ Q)\"\n using snoc by blast\n\n have \"(tt2T s) @ [tick] = tt2T (s@[[Tick]\\<^sub>E])\"\n by (simp add: \\[Tick]\\<^sub>E \\ set s\\ \\[Tock]\\<^sub>E \\ set s\\ \\\\R. [R]\\<^sub>R \\ set s\\ tt2T_concat_dist)\n\n then have \"s @ [[Tick]\\<^sub>E] \\ P \\ t @ [x] \\ Q\"\n using pp\n by (smt Nil_is_append_conv Some_tt2F_concat_refusal Some_tt2F_no_Tock TTwf_Q TTwf_def UnCI last_appendR last_snoc set_append snoc.prems(2) snoc.prems(4) ttWF_tt2F_last_refusal_concat)\n \n then show ?thesis using snoc by auto\n qed\n qed\n then show \"\\y. tt2F (s @ t) = tt2F y \\ y \\ P\"\n by (meson TT1_P TT1_def assm3 tt_prefix_concat tt_prefix_imp_prefix_subset)\nqed\n\nlemma ttproc2F_SeqCompF_failures_subseteq_SeqCompTT:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\"\n and TTwf_Q: \"TTwf Q\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\"\n shows \"fst ((ttproc2F P) ;\\<^sub>F (ttproc2F Q)) \\ fst (ttproc2F (P ;\\<^sub>C Q))\" \n using assms unfolding ttproc2F_def SeqCompTT_def SeqCompF_def\nproof (auto)\n fix a b y\n assume assm2:\"Some (a, b) = tt2F y\"\n and assm3:\"y \\ P\"\n show \"\\ya. tt2F y = tt2F ya \\ (ya \\ P \\ (\\s. ya \\ s @ [[Tick]\\<^sub>E]) \\ (\\s. s @ [[Tick]\\<^sub>E] \\ P \\ (\\t. t \\ Q \\ ya = s @ t)))\"\n using assm2 assm3 Some_tt2F_no_Tick by fastforce\nnext\n fix b s t y ya\n assume assm1:\"s @ [tick] = tt2T y\"\n and assm2:\"y \\ P\"\n and assm3:\"Some (t, b) = tt2F ya\"\n and assm4:\"ya \\ Q\"\n\n obtain z where z:\"y = z@[[Tick]\\<^sub>E]\"\n using assm1 assm2 tt2T_tick_exists_Cons by blast\n \n show \"\\y. Some (s @ t, b) = tt2F y \\ \n (y \\ P \\ (\\s. y \\ s @ [[Tick]\\<^sub>E]) \\ (\\s. s @ [[Tick]\\<^sub>E] \\ P \\ (\\t. t \\ Q \\ y = s @ t)))\"\n using assm1 assm2 assm3 assm4\n apply (rule_tac x=\"z@ya\" in exI, auto simp add:z)\n using Some_concat_extend Some_tt2F_imp_tt2T' Some_concat_extend' tt2T_tick_butlast by fastforce\nqed\n\nlemma ttproc2F_SeqCompTT_traces_subseteq_SeqCompF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\" \n and TTwf_Q: \"TTwf Q\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\"\n shows \"snd (ttproc2F (P ;\\<^sub>C Q)) \\ snd ((ttproc2F P) ;\\<^sub>F (ttproc2F Q))\" \n using assms unfolding ttproc2F_def SeqCompTT_def SeqCompF_def\nproof (auto)\n fix y\n assume assm1:\"\\s t. tt2T y = s @ t \\ (\\y. s @ [tick] = tt2T y \\ y \\ P) \\ (\\y. t = tt2T y \\ y \\ Q)\"\n and assm2:\"y \\ P\"\n and assm3:\"\\s. y \\ s @ [[Tick]\\<^sub>E]\"\n and assm4:\"tick \\ set (tt2T y)\"\n have ttWF_y:\"ttWF y\"\n using TTwf_P TTwf_def assm2 by blast\n have Tick_set:\"[Tick]\\<^sub>E \\ set y\"\n using assm4 Tick_set_tt2T_in by blast\n\n show \"False\"\n using assm1 assm2 assm3 assm4\n proof (cases \"y = []\")\n case True\n then show ?thesis using assm1 assm2 assm3 assm4 by auto\n next\n case False\n then obtain xs where xs:\"y = xs@[[Tick]\\<^sub>E]\"\n using False ttWF_y Tick_set Tick_set_ends_in_Tick by blast\n then show ?thesis using assm3 by auto\n qed\nnext\n fix s t\n assume assm1:\"\\sa ta. tt2T (s @ t) = sa @ ta \\ (\\y. sa @ [tick] = tt2T y \\ y \\ P) \\ (\\y. ta = tt2T y \\ y \\ Q)\"\n and assm2:\"s @ [[Tick]\\<^sub>E] \\ P\"\n and assm3:\"t \\ Q\"\n and assm4:\"tick \\ set (tt2T (s @ t))\"\n have \"[Tick]\\<^sub>E \\ set s\"\n using TTwf_P TTwf_concat_prefix_set_no_Tick assm2 by blast\n then show \"False\"\n using assm1 assm2 assm3 Tock_in_trace_Tick_no_Tick Tock_in_trace_Refusal_no_Tick\n by (metis TTwf_P TTwf_def assm4 tt2T.simps(1) tt2T_concat_dist)\nnext\n fix s t\n assume assm1:\"\\sa ta. tt2T (s @ t) = sa @ ta \\ (\\y. sa @ [tick] = tt2T y \\ y \\ P) \\ (\\y. ta = tt2T y \\ y \\ Q)\"\n and assm2:\"s @ [[Tick]\\<^sub>E] \\ P\"\n and assm3:\"t \\ Q\"\n have \"[Tick]\\<^sub>E \\ set s\"\n using TTwf_P TTwf_concat_prefix_set_no_Tick assm2 by blast\n\n text \\ It's basically by case analysis on whether Tock or Refs exist in s. \\\n\n show \"\\y. tt2T (s @ t) = tt2T y \\ y \\ P\"\n using assm1 assm2 assm3\n by (metis Ref_in_concat_lhs Tock_in_concat_lhs \\[Tick]\\<^sub>E \\ set s\\ tt2T.simps(1) tt2T_concat_dist)\nqed\n\nlemma\n assumes \"tick \\ set (tt2T y)\" \"ttWF y\" \"[Tock]\\<^sub>E \\ set y\"\n shows \"[Tick]\\<^sub>E \\ set y\"\n using assms apply (induct y rule:tt2T.induct, auto)\n apply (smt hd_in_set list.distinct(1) list.inject list.sel(1) list.set_cases ttWF.elims(2) ttobs.distinct(1))\n using ttWF.elims(2) by auto\n\nlemma ttproc2F_SeqCompF_traces_subseteq_SeqCompTT:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\" \n and TTwf_Q: \"TTwf Q\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\" \n shows \"snd ((ttproc2F P) ;\\<^sub>F (ttproc2F Q)) \\ snd (ttproc2F (P ;\\<^sub>C Q))\" \n unfolding ttproc2F_def SeqCompTT_def SeqCompF_def\nproof (auto)\n fix y x \n assume assm1:\"tick \\ set (tt2T y)\"\n and assm2:\"y \\ P\"\n have \"\\ya. tt2T y = tt2T ya \\ (ya \\\\<^sub>C y \\ (\\s. ya \\ s @ [[Tick]\\<^sub>E]) \\ ya @ [[Tick]\\<^sub>E] \\\\<^sub>C y)\"\n using assm1\n apply (induct y rule:tt2T.induct, auto)\n apply (metis (no_types, hide_lams) Cons_eq_append_conv tt2T.simps(2) tt_prefix_subset.simps(3) ttevent.distinct(3))\n apply (metis (no_types, hide_lams) Cons_eq_append_conv tt2T.simps(2) tt_prefix_subset.simps(3) ttevent.distinct(3))\n by (rule_tac x=\"[]\" in exI, auto)+\n then show \"\\ya. tt2T y = tt2T ya \\ (ya \\ P \\ (\\s. ya \\ s @ [[Tick]\\<^sub>E]) \\ (\\s. s @ [[Tick]\\<^sub>E] \\ P \\ (\\t. t \\ Q \\ ya = s @ t)))\"\n by (metis TT0_Q TT0_TT1_empty TT1_P TT1_Q TT1_def append.right_neutral assm2)\nnext\n fix s y ya\n assume assm1:\"s @ [tick] = tt2T y\"\n and assm2:\"y \\ P\"\n and assm3:\"ya \\ Q\"\n then show \"\\y. s @ tt2T ya = tt2T y \\ (y \\ P \\ (\\s. y \\ s @ [[Tick]\\<^sub>E]) \\ (\\s. s @ [[Tick]\\<^sub>E] \\ P \\ (\\t. t \\ Q \\ y = s @ t)))\"\n using assm1 assm2 assm3 apply (rule_tac x=\"butlast y@ya\" in exI, auto)\n apply (smt Nil_is_append_conv TTwf_P TTwf_def Tick_set_ends_in_Tick Tick_set_tt2T_in append_butlast_last_id last_in_set last_snoc not_Cons_self2 tt2T_concat_Tick_no_Ref_set tt2T_concat_Tick_no_Tick_set tt2T_concat_Tick_no_Tock_set tt2T_concat_dist tt2T_tick_butlast)\n using tt2T_tick_exists_Cons by force+\nqed\n\nlemma ttproc2F_SeqCompTT_eq_SeqCompF:\n assumes TTwf_P: \"TTwf P\" and TT0_P: \"TT0 P\" and TT1_P: \"TT1 P\" \n and TTwf_Q: \"TTwf Q\" and TT0_Q: \"TT0 Q\" and TT1_Q: \"TT1 Q\"\n shows \"(ttproc2F (P ;\\<^sub>C Q)) = ((ttproc2F P) ;\\<^sub>F (ttproc2F Q))\" \n using assms\n by (simp add: refines_asym refines_def ttproc2F_SeqCompF_failures_subseteq_SeqCompTT ttproc2F_SeqCompF_traces_subseteq_SeqCompTT ttproc2F_SeqCompTT_failures_subseteq_SeqCompF ttproc2F_SeqCompTT_traces_subseteq_SeqCompF)\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures_TickTock_SeqComp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.29214426401641486}} {"text": "section\"Example: Lorenz attractor\"\ntheory Lorenz_Approximation\nimports\n \"HOL-ODE-Numerics.ODE_Numerics\"\n Result_File_Coarse\nbegin\ntext \\\\label{sec:lorenz}\\\n\ntext \\TODO: move to isabelle? \\\nlifting_update blinfun.lifting\nlifting_forget blinfun.lifting\n\n\nlemma eventually_uniformly_on:\n \"(\\\\<^sub>F x in uniformly_on T l. P x) = (\\e>0. \\f. (\\x\\T. dist (f x) (l x) < e) \\ P f)\"\n unfolding uniformly_on_def\n apply (subst eventually_INF)\n apply safe\n subgoal for E\n apply (cases \"E = {}\")\n subgoal by (auto intro!: exI[where x=1])\n subgoal\n apply (auto simp: INF_principal_finite eventually_principal elim!: )\n proof goal_cases\n case (1 x)\n from 1 have \"0 < Min E\"\n apply (subst Min_gr_iff)\n apply force apply force apply force done\n have *: \"(\\e\\E. {f. \\t\\T. dist (f t) (l t) < e}) = {f. \\t\\T. dist (f t) (l t) < Min E}\"\n using 1 apply (auto simp: )\n apply (subst Min_gr_iff)\n apply force apply force apply force\n apply (drule bspec, assumption)\n apply (rule less_le_trans, assumption)\n apply auto\n done\n from 1 have \"\\f. (\\x\\T. dist (f x) (l x) < Min E) \\ P f\" unfolding * by simp\n then show ?case\n using 1(4)[rule_format, OF \\0 < Min E\\] by auto\n qed\n done\n subgoal for e\n apply (rule exI[where x=\"{e}\"])\n by (auto simp: eventually_principal)\n done\n\n\nlemma op_cast_image_impl[autoref_rules]:\n \"(\\x. x, op_cast_image::'a::executable_euclidean_space set \\\n 'b::executable_euclidean_space set)\n \\ aform.appr_rel \\ aform.appr_rel\"\n if \"DIM('a) = DIM('b)\"\n using that\n apply (auto simp: aform.appr_rel_def intro!: relcompI)\n unfolding lv_rel_def set_rel_br\n by (force simp: intro!: brI dest!: brD)\n\nlemma cast_bl_blinfun_of_list[simp]:\n \"cast_bl (blinfun_of_list xs::'a \\\\<^sub>L 'a) =\n (blinfun_of_list xs::'b\\\\<^sub>L'b)\"\n if \"DIM('a::executable_euclidean_space) = DIM('b::executable_euclidean_space)\"\n using that\n apply (auto simp: cast_bl_rep intro!: blinfun_eqI)\n by (auto simp: blinfun_of_list_def blinfun_of_matrix_apply\n linear_sum linear.scaleR sum_Basis_sum_nth_Basis_list\n linear_cast)\n\nlemma cast_idem[simp]: \"cast x = x\"\n by (auto simp: cast_def)\n\nlemma cast_bl_idem[simp]: \"cast_bl x = x\"\n by (auto simp: cast_bl_rep intro!: blinfun_eqI)\n\nlemma op_cast_eucl1_image_impl[autoref_rules]:\n \"(\\x. x, op_cast_eucl1_image::'a::executable_euclidean_space c1_info set \\\n 'b::executable_euclidean_space c1_info set)\n \\ aform.appr1_rel \\ aform.appr1_rel\"\n if \"DIM_precond TYPE('a) D\"\n \"DIM_precond TYPE('b) D\"\n using that\nproof (auto, goal_cases)\n case (1 a b a')\n then show ?case\n apply (auto simp: aform.appr1_rel_br set_rel_br br_def)\n subgoal for w x y z\n apply (auto simp: aform.c1_info_of_appr_def cast_eucl1_def aform.c1_info_invar_def\n split: option.splits)\n apply (rule image_eqI)\n apply (rule cast_eucl_of_list, force, force simp: Joints_imp_length_eq, force)\n subgoal for s t\n apply (rule image_eqI[where x=\"t\"])\n supply [simp del] = eucl_of_list_take_DIM\n apply (auto simp: flow1_of_list_def)\n apply (subst cast_eucl_of_list)\n subgoal by simp\n subgoal\n by (auto dest!: Joints_imp_length_eq\n simp: power2_eq_square flow1_of_list_def[abs_def])\n subgoal by simp\n done\n done\n subgoal for w x\n apply (rule image_eqI[where x=\"cast_eucl1 (w, x)\"])\n apply (auto simp: aform.c1_info_of_appr_def cast_eucl1_def\n aform.c1_info_invar_def\n split: option.splits)\n apply (rule image_eqI)\n apply (rule cast_eucl_of_list, force, force simp: Joints_imp_length_eq, force)\n subgoal for s t\n apply (rule image_eqI[where x=\"t\"])\n supply [simp del] = eucl_of_list_take_DIM\n apply (auto simp: flow1_of_list_def)\n apply (subst cast_eucl_of_list)\n subgoal by simp\n subgoal\n by (auto dest!: Joints_imp_length_eq\n simp: power2_eq_square flow1_of_list_def[abs_def])\n subgoal by simp\n done\n done\n done\nqed\n\nlemma less_3_iff: \"i < (3::nat) \\ i = 0 \\ i = 1 \\ i = 2\"\n by arith\n\ndefinition mat3_of_vec::\"R3 \\ real^3^3\" where\n \"mat3_of_vec x = (let xs = list_of_eucl x in eucl_of_list [xs!0,0,0, xs!1,0,0, xs!2,0,0])\"\n\nlemma ll3: \"{..<3} = {0,1,2::nat}\"\n by (auto simp: less_3_iff)\n\nlemma mat3_of_vec: \"cast (mat3_of_vec x *v eucl_of_list [1, 0, 0]) = x\"\n by (auto simp: mat3_of_vec_def eucl_of_list_matrix_vector_mult_eq_sum_nth_Basis_list\n linear_sum linear_cast linear.scaleR ll3 linear_add Basis_list_R3 inner_prod_def\n prod_eq_iff)\n\nprimrec bisect_form where\n \"bisect_form p f xs l u 0 = (l, u)\"\n| \"bisect_form p f xs l u (Suc n) =\n (let m = (l + u)/2 in\n if approx_form_aform p (f m) xs\n then bisect_form p f xs l m n\n else bisect_form p f xs m u n)\"\n\ntext \\This should prove that the expansion estimates are sufficient.\\\n\nlemma expansion_main: \"expansion_main (coarse_results) = Some True\"\n by eval\n\ncontext includes floatarith_notation begin\n\ndefinition \"matrix_of_degrees2\\<^sub>e =\n (let\n e = Var 2;\n ur = Rad_of (Var 0);\n vr = Rad_of (Var 1);\n x1 = Cos ur;\n x2 = Cos vr;\n y1 = Sin ur;\n y2 = Sin vr\n in\n [x1 + (e * (x2 - x1)), 0, 0,\n y1 + (e * (y2 - y1)), 0, 0,\n 0, 0, 0])\"\n\ndefinition \"matrix_of_degrees2 u v =\n approx_floatariths 30 matrix_of_degrees2\\<^sub>e (aforms_of_ivls [u, v, 0] [u, v, 1])\"\n\ntext \\following \\vector_field.h\\ / \\vector_field.cc\\\\\n\nabbreviation \"S \\ 10::real\"\nabbreviation \"B \\ 8/3::real\"\nabbreviation \"TEMP \\ sqrt((S + 1) * (S + 1) + 4 * S * (28 - 1))\"\nabbreviation \"K1 \\ S / TEMP\"\nabbreviation \"K2 \\ (S - 1 + TEMP) / (2 * S)\"\nabbreviation \"K3 \\ (S - 1 - TEMP) / (2 * S)\"\nabbreviation \"E1 \\ (- (S + 1) + TEMP) / 2\"\nabbreviation \"E2 \\ (- (S + 1) - TEMP) / 2\"\nabbreviation \"E3 \\ - B\"\nabbreviation \"C1 \\ \\X. X ! 0 + X ! 1\"\nabbreviation \"C2 \\ \\X. K1 * C1 X * X ! 2\"\n\nschematic_goal\n lorenz_fas:\n \"[E1 * X!0 - C2 X,\n E2 * X!1 + C2 X,\n E3 * X!2 + C1 X * (K2 * X!0 + K3 * X!1)] =\n interpret_floatariths ?fas X\"\n by (reify_floatariths)\nconcrete_definition lorenz_fas uses lorenz_fas\nend\n\ninterpretation lorenz: ode_interpretation true_form UNIV lorenz_fas \"\\(X0, X1, X2).\n (E1 * X0 - K1 * (X0 + X1) * X2,\n E2 * X1 + K1 * (X0 + X1) * X2,\n E3 * X2 + (X0 + X1) * (K2 * X0 + K3 * X1))::real*real*real\"\n \"d::3\" for d\n by standard\n (auto simp: lorenz_fas_def less_Suc_eq_0_disj nth_Basis_list_prod Basis_list_real_def\n mk_ode_ops_def eucl_of_list_prod power2_eq_square inverse_eq_divide intro!: isFDERIV_I)\n\nvalue [code] \"length (slp_of_fas lorenz_fas)\"\n\ndefinition \"mig_aform p x = mig_componentwise (Inf_aform' p x) (Sup_aform' p x)\"\n\ncontext includes floatarith_notation begin\n\ndefinition \"mig_aforms p x = real_of_float ((lower o the) ((approx p (Norm (map (Num o float_of o (mig_aform p)) x))) []))\"\n\ndefinition\n \"column_of_c1_info x N j = (map (\\i. the (snd x) ! i) (map (\\i. i * N + j) [0..e b))) (rotate_z_fa (Rad_of (R\\<^sub>e a)))) xs)\"\n\ndefinition \"perspective_projection_aforms xs =\n the (approx_slp_outer 30 3 (rotate_zx_slp (-30) (-60) (map Var [0..<3])) xs)\"\n\ndefinition \"print_lorenz_aform print_fun cx cy cz ci\n cd1 cd2\n = (\\a b.\n let (s1, n) = ((-6), False);\n _ = print_fun (String.implode (''# gen(''@ show a@''): ''@ shows_aforms_hr (b) '''' @ ''\\''));\n _ = print_fun (String.implode (''# box(''@ show a@''): ''@ shows_box_of_aforms_hr (b) '''' @ ''\\''));\n ((x0, y0, z0), (x1, y1, z1)) = case (map (Inf_aform' 30) (take 3 b), map (Sup_aform' 30) (take 3 b)) of\n ([x0, y0, z0], [x1, y1, z1]) \\ ((x0, y0, z0), (x1, y1, z1));\n _ = print_fun (String.implode (shows_segments_of_aform 0 1 b ((shows cx o shows_space o shows z0 o shows_space o shows z1)'''') ''\\''));\n _ = print_fun (String.implode (shows_segments_of_aform 0 2 b ((shows cy o shows_space o shows y0 o shows_space o shows y1)'''') ''\\''));\n _ = print_fun (String.implode (shows_segments_of_aform 1 2 b ((shows cz o shows_space o shows x0 o shows_space o shows x1)'''') ''\\''));\n PS = perspective_projection_aforms b;\n _ = print_fun (String.implode (shows_segments_of_aform 0 1 PS\n ((shows ci o shows_space o shows (fst (PS ! 2)) o shows_space o shows (fst (b ! 2))) '''') ''\\''))\n in if \\ a \\ length b > 10 then\n print_fun (String.implode (shows_aforms_vareq 3 [(0, 1), (0, 2), (1, 2)] [0..<3]\n cd1\n cd2\n (FloatR 1 s1 * (if n then\n real_divl 30 1 (max (mig_aforms 30 (map (\\i. b ! i) [3,6,9]))\n (mig_aforms 30 (map (\\i. b ! i) [4,7,10])))\n else 1)) \\ \\always length \\2^s!\\\\\n ''# no C1 info'' b ''''))\n else ())\"\n\ndefinition \"print_lorenz_aform_std print_fun =\n print_lorenz_aform print_fun ''0x000001'' ''0x000002'' ''0x000012'' ''0x000003''\n [''0xa66f00'', ''0x06266f'', ''0xc60000'']\n [''0xffaa00'', ''0x1240ab'', ''0xc60000'']\"\n\ndefinition \"lorenz_optns print_funo =\n (let\n pf = the_default (\\_ _. ()) (map_option print_lorenz_aform_std print_funo);\n tf = the_default (\\_ _. ()) (map_option (\\print_fun a b.\n let\n _ = print_fun (String.implode (''# '' @ a @ ''\\''))\n in case b of Some b \\\n (print_fun (String.implode (''# '' @ shows_box_of_aforms_hr (b) '''' @ ''\\'')))\n | None \\ ()) print_funo)\n in\n \\\n precision = 30,\n adaptive_atol = FloatR 1 (-30),\n adaptive_rtol = FloatR 1 (-30),\n method_id = 2,\n start_stepsize = FloatR 1 (- 8),\n iterations = 40,\n halve_stepsizes = 10,\n widening_mod = 40,\n rk2_param = FloatR 1 0,\n default_reduce = correct_girard 30 50 25,\n printing_fun = pf,\n tracing_fun = tf\n \\)\"\n\ndefinition lorenz_optns'\n where \"lorenz_optns' pf m N rk2p a = lorenz_optns pf \\\n default_reduce := correct_girard 30 m N,\n rk2_param := rk2p,\n adaptive_atol := a,\n adaptive_rtol := a\n \\\"\n\ndefinition mirror_irects\n where \"mirror_irects =\n map (\\irect. case irect of [i, j, k] \\ [if j < 0 then - i else i , abs j, k] | irect \\ irect)\"\n\ndefinition \"print_irects irects =\n (let _ = map (\\is.\n let _ = map (\\j.\n let _ = print (String.implode (show j)) in print (STR '' '')) is in print (STR ''\\'')) irects\n in ())\"\n\nabbreviation \"aforms_of_ivl \\ \\x. aforms_of_ivls (fst x) (snd x)\"\n\ndefinition \"conefield_propagation\\<^sub>e =\n ([Deg_of (Arctan (Var (6) / Var (3))),\n Deg_of (Arctan (Var (7) / Var (4))),\n Min (Norm [Var(3), Var (6), Var (9)]) (Norm [Var(4), Var (7), Var (10)])])\"\n\ndefinition \"conefield_propagation DX = approx_floatariths 30 conefield_propagation\\<^sub>e DX\"\n\ndefinition \"conefield_propagation_slp = slp_of_fas conefield_propagation\\<^sub>e\"\n\n\ndefinition op_with_unit_matrix :: \"'a::real_normed_vector \\ 'a \\ 'a \\\\<^sub>L 'a\" where\n \"op_with_unit_matrix X = (X, 1\\<^sub>L)\"\n\ncontext includes blinfun.lifting begin\nlemma matrix_vector_mult_blinfun_works[simp]: \"matrix e *v g = e g\" for e::\"(real^'n) \\\\<^sub>L (real^'m)\"\n by transfer (simp add: bounded_linear_def matrix_works)\nend\n\nlemma length_conefield_propagation\\<^sub>e[simp]: \"length conefield_propagation\\<^sub>e = 3\"\n by (simp add: conefield_propagation\\<^sub>e_def)\n\nlemma interpret_floatariths_conefield_propagation:\n \"interpret_floatariths conefield_propagation\\<^sub>e\n (list_of_eucl (vec1_of_flow1 (xDX::(real^3) \\ ((real^3)\\\\<^sub>L(real^3)))))\n =\n (let\n DX = snd xDX;\n DXu = DX (eucl_of_list [1, 0, 0]);\n DXv = DX (eucl_of_list [0, 1, 0])\n in\n [deg_of (arctan (vec_nth DXu 1 / vec_nth DXu 0)),\n deg_of (arctan (vec_nth DXv 1 / vec_nth DXv 0)),\n min (norm DXu) (norm DXv)]\n )\"\n apply (auto simp: conefield_propagation\\<^sub>e_def Let_def interpret_mvmult_nth[where 'n=3 and 'm=3]\n inverse_eq_divide vec1_of_flow1_def nth_append)\n apply (auto simp: matrix_inner_Basis_list )\n apply (auto simp: interpret_floatarith_norm[where 'a=\"real ^ 3\"]\n einterpret_mvmult_fa[where 'n=3 and 'm=3] matrix_inner_Basis_list nth_append)\n by (auto simp: matrix_def axis_eq_eucl_of_list eucl_of_list_012)\n\ndefinition \"conefield_bounds_form l u =\n (fold Conj [\n Less (-90) (N\\<^sub>r l),\n LessEqual (N\\<^sub>r l) (N\\<^sub>r u),\n LessEqual (Var 9) (0),\n LessEqual 0 (Var 9),\n Less (N\\<^sub>r u) (90),\n Less 0 (Var 3),\n AtLeastAtMost (Var 6) (Tan (Rad_of (N\\<^sub>r l)) * Var 3) (Tan (Rad_of (N\\<^sub>r u)) * Var 3)] true_form)\"\n\ndefinition \"contract_angles X i = (snd (bisect_form 30 (\\x. conefield_bounds_form x (89)) X 89 (-89) i),\n snd (bisect_form 30 (conefield_bounds_form (-89)) X (-89) 89 i))\"\n\ndefinition \"approx_conefield_bounds (DX::(R3 \\ (R3 \\\\<^sub>L R3)) set) l u =\n do {\n let DX = (cast_eucl1 ` DX::3 eucl1 set);\n DXo \\ aform.vec1rep DX;\n DX \\ (case DXo of None \\ do {\n let _ = aform.print_msg (''# approx_conefield_bounds failed DXo...'');\n SUCCEED\n }\n | Some DX \\ RETURN DX);\n let _ = aform.trace_set (''# approx_conefield_bounds DX: '') (Some DX);\n approx_form_spec (conefield_bounds_form l u) (list_of_eucl ` DX)\n }\"\n\nlemma [autoref_rules]:\n includes autoref_syntax\n shows \"(conefield_bounds_form, conefield_bounds_form) \\ Id \\ Id \\ Id \"\n by auto\n\nlemma [autoref_rules_raw]:\n \"DIM_precond TYPE((real, 3) vec \\ ((real, 3) vec, 3) vec) 12\"\n \"DIM_precond TYPE(R3) 3\"\n \"DIM_precond TYPE((real, 3) vec) 3\"\n by auto\n\nschematic_goal approx_conefield_bounds_impl:\n includes autoref_syntax\n fixes optns::\"real aform numeric_options\"\n assumes [autoref_rules]: \"(DXi, DX) \\ aform.appr1_rel\"\n assumes [autoref_rules]: \"(li, l) \\ Id\"\n assumes [autoref_rules]: \"(ui, u) \\ Id\"\n notes [autoref_rules] =\n aform.print_msg_impl[where optns = optns]\n aform.ivl_rep_of_set_autoref[where optns = optns]\n aform.transfer_operations(12)[where optns = optns]\n aform.approx_euclarithform[where optns=optns]\n aform.trace_set_impl[of optns]\n shows \"(nres_of ?r, approx_conefield_bounds $ DX $ l $ u) \\ \\bool_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding approx_conefield_bounds_def\n including art\n by autoref_monadic\nconcrete_definition approx_conefield_bounds_impl for optns li ui DXi uses\n approx_conefield_bounds_impl\nlemmas [autoref_rules] = approx_conefield_bounds_impl.refine\n\ncontext includes autoref_syntax begin\nlemma [autoref_rules]:\n \"(real_of_ereal, real_of_ereal) \\ ereal_rel \\ rnv_rel\"\n \"(\\, \\) \\ ereal_rel\"\n by auto\nend\n\nlemma interpret_form_true_form[simp]: \"interpret_form true_form \\ \\_. True\"\n by (force simp: true_form_def intro!: eq_reflection)\n\nlemma interpret_form_conefield_bounds_form_list:\n \"interpret_form (conefield_bounds_form L U)\n [x, y, z, ux, vx, wx,\n uy, vy, wy,\n uz, vz, wz]\n \\\n (0 < ux \\ -90 < L \\ L \\ U \\ U < 90 \\ uz = 0 \\\n uy \\ tan (rad_of U) * ux \\\n tan (rad_of L) * ux \\ uy)\"\n if \"U \\ float\" \"L \\ float\" \"e \\ float\" \"em \\ float\"\n using that\n by (auto simp: conefield_bounds_form_def L2_set_def)\n\nlemma list_of_eucl_eucl1_3:\n includes vec_syntax\n shows \"(list_of_eucl (vec1_of_flow1 (xDX::(real^3) \\ ((real^3)\\\\<^sub>L(real^3))))) =\n (let\n (x, DX) = xDX;\n DXu = DX (eucl_of_list [1, 0, 0]);\n DXv = DX (eucl_of_list [0, 1, 0]);\n DXw = DX (eucl_of_list [0, 0, 1])\n in [x $ 0, x $ 1, x $ 2, vec_nth DXu 0, vec_nth DXv 0, vec_nth DXw 0,\n vec_nth DXu 1, vec_nth DXv 1, vec_nth DXw 1,\n vec_nth DXu 2, vec_nth DXv 2, vec_nth DXw 2])\"\n apply (auto simp: matrix_inner_Basis_list Let_def vec1_of_flow1_def\n concat_map_map_index less_Suc_eq_0_disj\n list_of_eucl_matrix eval_nat_numeral aform.inner_Basis_eq_vec_nth\n intro!: nth_equalityI\n split: prod.splits)\n by (auto simp: matrix_def axis_eq_eucl_of_list eucl_of_list_012)\n\nlemma interpret_form_conefield_bounds_form:\n \"interpret_form (conefield_bounds_form L U)\n (list_of_eucl (vec1_of_flow1 (xDX::(real^3) \\ ((real^3)\\\\<^sub>L(real^3)))))\n =\n (let\n DX = snd xDX;\n DXu = DX (eucl_of_list [1, 0, 0]);\n DXv = DX (eucl_of_list [0, 1, 0]);\n uz = vec_nth DXu 2;\n uy = vec_nth DXu 1;\n ux = vec_nth DXu 0;\n vy = vec_nth DXv 1;\n vx = vec_nth DXv 0\n in\n ux > 0 \\ -90 < L \\ L \\ U \\ U < 90 \\ uz = 0 \\\n (uy / ux) \\ {tan (rad_of L) .. tan (rad_of U)}\n )\"\n if \"L \\ float\" \"U \\ float\"\n using that\n unfolding list_of_eucl_eucl1_3 Let_def\n by (auto split: prod.splits simp: interpret_form_conefield_bounds_form_list divide_simps)\n\nlemma approx_conefield_bounds_cast:\n \"approx_conefield_bounds DX L U \\ SPEC (\\b. b \\\n (\\(x, dx) \\ cast_eucl1 ` DX::3 eucl1 set.\n let\n u' = dx (eucl_of_list [1, 0, 0])\n in\n vec_nth u' 1 / vec_nth u' 0 \\ {tan (rad_of L) .. tan (rad_of U)}\n \\ vec_nth u' 2 = 0 \\ vec_nth u' 0 > 0 \\ -90 < L \\ L \\ U \\ U < 90)\n )\"\n if \"L \\ float\" \"U \\ float\"\n unfolding approx_conefield_bounds_def\n apply refine_vcg\n apply (auto simp: env_len_def )\n subgoal for a b c\n apply (drule bspec, assumption)\n unfolding interpret_form_conefield_bounds_form[OF that]\n by (auto simp: Let_def divide_simps)\n done\n\n\nlemma approx_conefield_bounds[le, refine_vcg]:\n \"approx_conefield_bounds DX l u \\ SPEC (\\b. b \\\n (\\(x, dx) \\ DX::R3 c1_info set.\n let\n (u'1, u'2, u'3) = dx ((1, 0, 0))\n in u'2 / u'1 \\ {tan (rad_of l) .. tan (rad_of u)} \\ u'3 = 0 \\ u'1 > 0 \\ -90 < l \\ l \\ u \\ u < 90)\n )\"\n if \"l \\ float\" \"u \\ float\"\n apply (rule approx_conefield_bounds_cast[le, OF that])\n apply (auto dest!: bspec simp: Let_def split: prod.splits)\n by (auto simp: cast_eucl1_def cast_def)\n\nschematic_goal MU\\<^sub>e: \"-E2 / E1 = interpret_floatarith ?fas []\"\n by (reify_floatariths)\nconcrete_definition MU\\<^sub>e uses MU\\<^sub>e\nschematic_goal NU\\<^sub>e: \"-E3 / E1 = interpret_floatarith ?fas []\"\n by (reify_floatariths)\nconcrete_definition NU\\<^sub>e uses NU\\<^sub>e\n\ndefinition \"approx_ivls p fas xs = do {\n let xs = ivls_of_aforms p xs;\n res \\ those (map (\\f. approx p f xs) fas);\n Some (map (real_of_float o lower) res, map (real_of_float o upper) res)\n}\"\ndefinition\n \"deform p t exit XDX = (case XDX of (lu, (X, DX)) \\\n let\n d = ldec 0.1;\n d = if exit then (1 - real_of_float (lb_sqrt 30 (1 - 2 * float_of (d)))) else d;\n sd = real_of_float ((float_of (d*d)));\n C0Deform = aforms_of_ivls [-sd,-sd,-sd] [sd, sd, sd];\n result = msum_aforms' X C0Deform\n in (lu,\n case DX of None \\ (result, None)\n | Some DX \\ let\n C1_norm = 2 * d;\n C1_norm = if exit then real_divr 30 C1_norm (1 - C1_norm) else C1_norm;\n l = -C1_norm;\n u = C1_norm;\n D_M = aforms_of_ivls [1 + l,0,0, 0,1 + l,0, 0,0,1 + l] [1 + u,0,0, 0,1 + u,0, 0,0,1 + u];\n (ri, ru) = the (approx_ivls p\n (mmult_fa 3 3 3 (map Var [0..<9]) (map Var [9..<18])) (D_M @ DX));\n Dresult = aforms_of_ivls ri ru;\n resultDresult = product_aforms result Dresult\n in (take 3 resultDresult, Some (drop 3 resultDresult))))\"\n\ndefinition \"ivls_of_aforms' p r = (map (Inf_aform' p) r, map (Sup_aform' p) r)\"\n\ndefinition \"compute_half_exit p t XDX = (case XDX of ((l, u::ereal), (X, DX)) \\\n let\n \\ \\ASSERTING that \\Y\\ straddles zero\\\n (x0, y0, _) = case map (Inf_aform' p) X of [x,y,z] \\ (x, y, z);\n (x1, y1, _) = case map (Sup_aform' p) X of [x,y,z] \\ (x, y, z);\n splitting = x0 = 0 \\ x1 = 0;\n sign_x = if (x0 + x1) / 2 > 0 then 1 else -1;\n mag_x = max (abs x0) (abs x1);\n sign_x\\<^sub>e = N\\<^sub>r sign_x;\n exit_rad\\<^sub>e = N\\<^sub>r (ldec 0.1);\n X\\<^sub>e = Var (0);\n Y\\<^sub>e = Var (1);\n Z\\<^sub>e = Var (2);\n max_x_over_r\\<^sub>e = N\\<^sub>r mag_x / exit_rad\\<^sub>e;\n abs_x_over_r\\<^sub>e = (Abs X\\<^sub>e) / exit_rad\\<^sub>e;\n result = (if splitting\n then let result = (the (approx_floatariths p [sign_x\\<^sub>e * exit_rad\\<^sub>e,\n Y\\<^sub>e * Powr (max_x_over_r\\<^sub>e) MU\\<^sub>e,\n Z\\<^sub>e * Powr (max_x_over_r\\<^sub>e) NU\\<^sub>e] X));\n (ir, sr) = ivls_of_aforms' p result\n in aforms_of_ivls (ir[1:=min 0 (ir!1), 2:=min 0 (ir!2)])\n (sr[1:=max 0 (sr!1), 2:=max 0 (sr!2)])\n else the (approx_floatariths p [sign_x\\<^sub>e * exit_rad\\<^sub>e,\n Y\\<^sub>e * Powr (abs_x_over_r\\<^sub>e) MU\\<^sub>e,\n Z\\<^sub>e * Powr (abs_x_over_r\\<^sub>e) NU\\<^sub>e] X));\n _ = ()\n in ((l::ereal, \\::ereal), (case DX of None \\ (result, None)\n | Some DX \\\n let\n ux\\<^sub>e = Var (3);\n uy\\<^sub>e = Var (6);\n P21\\<^sub>e = if splitting\n then (MU\\<^sub>e / exit_rad\\<^sub>e) * Y\\<^sub>e * sign_x\\<^sub>e * Powr (max_x_over_r\\<^sub>e) (MU\\<^sub>e - 1) \\ \\No need for \\Hull(0)\\ because \\y\\ straddles zero\\\n else (MU\\<^sub>e / exit_rad\\<^sub>e) * Y\\<^sub>e * sign_x\\<^sub>e * Powr (abs_x_over_r\\<^sub>e) (MU\\<^sub>e - 1);\n P22\\<^sub>e = if splitting\n then Powr (max_x_over_r\\<^sub>e) MU\\<^sub>e\n else Powr (abs_x_over_r\\<^sub>e) MU\\<^sub>e;\n P31\\<^sub>e = if splitting\n then sign_x\\<^sub>e * (NU\\<^sub>e / exit_rad\\<^sub>e) * Z\\<^sub>e * Powr (max_x_over_r\\<^sub>e) (NU\\<^sub>e - 1) \\ \\No need for \\Hull(\\)\\ because scaling afterwards\\\n else sign_x\\<^sub>e * (NU\\<^sub>e / exit_rad\\<^sub>e) * Z\\<^sub>e * Powr (abs_x_over_r\\<^sub>e) (NU\\<^sub>e - 1);\n ry = (P21\\<^sub>e * ux\\<^sub>e) + (P22\\<^sub>e * uy\\<^sub>e);\n rz = P31\\<^sub>e * ux\\<^sub>e;\n (iDr, sDr) = the (approx_ivls p ([0, 0, 0,\n ry, 0, 0,\n rz, 0, 0]) (X @ DX));\n Dresult = aforms_of_ivls (iDr[3:=min 0 (iDr!3)])\n (sDr[3:=max 0 (sDr!3)]);\n resultDresult = product_aforms result Dresult\n in (take 3 resultDresult, Some (drop 3 resultDresult))\n )))\"\n\nfun list3 where \"list3 [a,b,c] = (a, b, c)\"\n\ndefinition\n \"split_x n x0 y0 z0 x1 y1 z1 =\n (let\n elem = (\\(x0, x1). aforms_of_ivls [x0, y0, z0] [x1, y1, z1]);\n coord = (\\x0 n i. i * x0 * FloatR 1 (-int n));\n us = map (coord x0 n) (rev [0..<(2^n)]) @ map (coord x1 n) [Suc 0..X'. ((l, u), (X', DX'))) X's;\n Xes = map (compute_half_exit p t) XDX's;\n Xlumpies = map (deform p t True) Xes\n in\n Xlumpies)\"\n\n\ndefinition \"cube_enteri = (map ldec [-0.1, -0.00015, 0.1, 0.8,0,0, 0.0005,0,0, 0,0,0],\n map udec [ 0.1, 0.00015, 0.1, 1.7,0,0, 0.002,0,0, 0,0,0])\"\ndefinition \"cube_enter = set_of_ivl (pairself eucl_of_list cube_enteri)\"\n\nvalue [code] \"println ((show) (map (ivls_of_aforms' 100 o list_of_appr1e_aform)\n (compute_cube_exit 30 (FloatR 1 (-10)) ((ereal 1, ereal 1),\n (aforms_of_ivls (take 3 (fst cube_enteri))\n (take 3 (snd cube_enteri)),\n Some (aforms_of_ivls (drop 3 (fst cube_enteri))\n (drop 3 (snd cube_enteri))))))))\"\n\ndefinition \"cube_exiti =\n [(aforms_of_ivls (map ldec [-0.12, -0.024, -0.012])\n (map udec [-0.088, 0.024, 0.13]),\n Some (aforms_of_ivls (map ldec [0,0,0, -0.56,0,0, -0.6,0,0])\n (map udec [0,0,0, 0.56,0,0, -0.08,0,0]))),\n (aforms_of_ivls (map ldec [ 0.088, -0.024, -0.012])\n (map udec [ 0.12, 0.024, 0.13]),\n Some (aforms_of_ivls (map ldec [0,0,0, -0.53,0,0, 0.08,0,0])\n (map udec [0,0,0, 0.56,0,0, 0.6,0,0])))]\"\ndefinition \"cube_exitv = aform.c1_info_of_apprs cube_exiti\"\n\nlemma cube_enteri[autoref_rules]: \"(cube_enteri, cube_enter::'a set) \\ lvivl_rel\"\n if \"DIM_precond TYPE('a::executable_euclidean_space) 12\"\n using that\n by (auto simp: cube_enteri_def cube_enter_def set_of_ivl_def\n intro!: brI lv_relivl_relI)\n\nlemma cube_exiti[autoref_rules]: \"(cube_exiti, cube_exitv::'n eucl1 set) \\ clw_rel aform.appr1_rel\"\n if \"DIM_precond TYPE('n::enum rvec) 3\"\n unfolding cube_exitv_def cube_exiti_def\n apply (rule aform.clw_rel_appr1_relI)\n using that\n by (auto simp: aform.c1_info_invar_def power2_eq_square)\n\ndefinition \"lorenz_interrupt (optns::real aform numeric_options) b (eX::3 eucl1 set) =\n do {\n ((el, eu), X) \\ scaleR2_rep eX;\n let fX = fst ` X;\n fentry \\ op_image_fst_ivl (cube_enter::3 vec1 set);\n interrupt \\ aform.op_subset (fX:::aform.appr_rel) fentry;\n (ol, ou) \\ ivl_rep fentry;\n aform.CHECKs (ST ''asdf'') (0 < el \\ ol \\ ou);\n let _ = (if b then aform.trace_set (ST ''Potential Interrupt: '') (Some fX) else ());\n let _ = (if b then aform.trace_set (ST ''With: '') (Some ({ol .. ou::3 rvec}:::aform.appr_rel)) else ());\n if \\b \\ \\interrupt then RETURN (op_empty_coll, mk_coll eX)\n else do {\n vX \\ aform.vec1rep X;\n let _ = (if b then aform.trace_set1e (ST ''Actual Interrupt: '') (Some eX) else ());\n let l = (eucl_of_list [-1/2/2,-1/2/2,-1/2/2]::3 rvec);\n let u = eucl_of_list [1/2/2, 1/2/2, 1/2/2];\n ASSERT (l \\ u);\n let CX = mk_coll ({l .. u}:::aform.appr_rel);\n (C0::3 eucl1 set) \\ scaleRe_ivl_coll_spec el eu (fst ` cube_exitv \\ UNIV);\n (C1::3 eucl1 set) \\ scaleRe_ivl_coll_spec el eu (cube_exitv);\n case vX of None \\ RETURN (CX, C0)\n | Some vX \\ do {\n b \\ aform.op_subset vX cube_enter;\n aform.CHECKs (ST ''FAILED: TANGENT VECTORs are not contained'') b;\n RETURN (CX, C1)\n }\n }\n }\"\nlemma [autoref_rules]:\n includes autoref_syntax\n shows\n \"(real_of_int, real_of_int) \\ int_rel \\ rnv_rel\"\n \"(ldec, ldec) \\ Id \\ rnv_rel\"\n \"(udec, udec) \\ Id \\ rnv_rel\"\n by auto\n\nschematic_goal lorenz_interrupti:\n includes autoref_syntax\n assumes[autoref_rules]: \"(bi, b) \\ bool_rel\" \"(Xi, X::3 eucl1 set) \\ aform.appr1e_rel\"\n \"(optnsi, optns) \\ Id\"\n shows\n \"(nres_of ?r, lorenz_interrupt optns b X) \\ \\clw_rel aform.appr_rel \\\\<^sub>r clw_rel aform.appr1e_rel\\nres_rel\"\n unfolding lorenz_interrupt_def\n including art\n by autoref_monadic\nconcrete_definition lorenz_interrupti for optnsi1 bi Xi uses\n lorenz_interrupti[where optnsi = \"optnsi\"\n and optnsa = \"\\_ _ _ _ _ _ _ _. optnsi\"\n and optnsb = \"\\_ _ _ _ _ _ _ _ _. optnsi\"\n and optnsc = \"\\_ _ _ _ _ _ _ _ _ _ _. optnsi\"\n and optnsd = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. optnsi\"\n and optnse = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. optnsi\"\n and optnsf = \"\\_ _ _ _ _ _ _ _ _. optnsi\"\n and optns = \"\\_ _ _ _ _. optnsi\"\n for optnsi]\nlemma lorenz_interrupti_refine[autoref_rules]:\n includes autoref_syntax\n shows\n \"(\\optnsi bi Xi. (lorenz_interrupti optnsi bi Xi),\n lorenz_interrupt)\n \\ num_optns_rel \\ bool_rel \\ aform.appr1e_rel \\ \\clw_rel aform.appr_rel \\\\<^sub>r clw_rel aform.appr1e_rel\\dres_nres_rel\"\n using lorenz_interrupti.refine\n by (auto simp: nres_rel_def dres_nres_rel_def)\n\ndefinition \"(large_cube::R3 set) = {-1/4 .. 1/4} \\ {-1/4 .. 1/4} \\ {-1/4 .. 1/4}\"\n\ndefinition \"cube_entry = (cast_eucl1 ` (flow1_of_vec1 ` cube_enter::3 eucl1 set)::R3 c1_info set)\"\ndefinition \"cube_exit = (cast_eucl1 ` (cube_exitv::3 eucl1 set)::R3 c1_info set)\"\n\ntext \\protect locale parameters\\\nlemma flow0_cong[cong]: \"auto_ll_on_open.flow0 ode X = auto_ll_on_open.flow0 ode X\"\n by (auto simp:)\nlemma existence_ivl0_cong[cong]:\n \"auto_ll_on_open.existence_ivl0 ode X = auto_ll_on_open.existence_ivl0 ode X\"\n by (auto simp:)\nlemma Dflow_cong[cong]: \"c1_on_open_euclidean.Dflow ode ode_d X = c1_on_open_euclidean.Dflow ode ode_d X\"\n by (auto simp:)\nlemma flowsto_cong[cong]:\n \"c1_on_open_euclidean.flowsto ode ode_d D = c1_on_open_euclidean.flowsto ode ode_d D\"\n by (auto simp:)\nlemma poincare_mapsto_cong[cong]:\n \"c1_on_open_euclidean.poincare_mapsto ode X = c1_on_open_euclidean.poincare_mapsto ode X\"\n by (auto simp:)\nlemma returns_to_cong[cong]:\n \"auto_ll_on_open.returns_to ode X = auto_ll_on_open.returns_to ode X\"\n by (auto simp:)\nlemma return_time_cong[cong]:\n \"auto_ll_on_open.return_time ode X = auto_ll_on_open.return_time ode X\"\n by (auto simp: )\nlemma poincare_map_cong[cong]:\n \"auto_ll_on_open.poincare_map ode X = auto_ll_on_open.poincare_map ode X\"\n by (auto simp: )\n\nlemma eq_nth_iff_index:\n \"distinct xs \\ n < length xs \\ i = xs ! n \\ index xs i = n\"\n using index_nth_id by fastforce\n\nlemma cast_in_BasisI: \"(cast i::'a) \\ Basis\"\n if \"(i::'c) \\ Basis\"\"DIM('c::executable_euclidean_space) = DIM('a::executable_euclidean_space)\"\n using that\n by (auto simp: cast_def eucl_of_list_nth inner_Basis if_distrib if_distribR\n eq_nth_iff_index\n cong: if_cong)\n\nlemma cast_le_iff: \"(cast (x::'a)::'c) \\ y \\ x \\ cast y\"\n if \"DIM('c::executable_euclidean_space) = DIM('a::executable_euclidean_space)\"\n apply (auto simp: eucl_le[where 'a='a] eucl_le[where 'a='c]\n dest!: bspec intro!: )\n apply (rule cast_in_BasisI, assumption)\n apply (auto simp: that)\n apply (metis cast_eqI2 cast_inner that)\n apply (rule cast_in_BasisI, assumption)\n apply (auto simp: that)\n apply (metis cast_eqI2 cast_inner that)\n done\n\nlemma cast_le_cast_iff: \"(cast (x::'a)::'c) \\ cast y \\ x \\ y\"\n if \"DIM('c::executable_euclidean_space) = DIM('a::executable_euclidean_space)\"\n apply (auto simp: eucl_le[where 'a='a] eucl_le[where 'a='c]\n dest!: bspec intro!: )\n apply (rule cast_in_BasisI, assumption)\n apply (auto simp: that)\n apply (rule cast_in_BasisI, assumption)\n apply (auto simp: that)\n by (metis cast_eqI2 cast_inner that)\n\nlemma cast_image_Icc[simp]: \"cast ` {a .. b::'c} = {cast a .. cast b::'a}\"\n if \"DIM('c::executable_euclidean_space) = DIM('a::executable_euclidean_space)\"\n using that\n apply (auto simp: cast_le_iff dest!:)\n subgoal for x\n apply (rule image_eqI[where x=\"cast x\"])\n by (auto simp: cast_le_iff)\n done\n\nlemma cast_eucl1_image_scaleR2:\n \"cast_eucl1 ` scaleR2 l u X = scaleR2 l u (cast_eucl1 ` (X::'b c1_info set)::'a c1_info set)\"\n if \"DIM('a::executable_euclidean_space) = DIM('b::executable_euclidean_space)\"\n using that\n apply (auto simp: scaleR2_def image_def vimage_def cast_eucl1_def\n linear.scaleR linear_cast_bl)\n apply force+\n apply (rule exI conjI)+\n apply assumption\n apply (rule exI conjI)+\n apply assumption\n apply (rule bexI) prefer 2 apply assumption\n apply force\n by (auto simp: linear.scaleR linear_cast_bl)\n\nlemma scaleR2_diff_prod2: \"scaleR2 d e (X) - Y \\ UNIV = scaleR2 d e (X - Y \\ UNIV)\"\n by (force simp: scaleR2_def vimage_def image_def)\n\nend\n\nlemma (in c1_on_open_euclidean) flowsto_scaleR2I:\n \"flowsto (scaleR2 d e X0) T (CX \\ UNIV) (scaleR2 d e Y)\"\n if \"flowsto (X0) T (CX \\ UNIV) (Y)\"\n using that\n apply (auto simp: flowsto_def scaleR2_def)\n apply (drule bspec, assumption)\n apply auto\n apply (rule bexI) prefer 2 apply assumption\n apply auto\n subgoal for x a b h\n by (auto intro!: image_eqI[where x=\"(x, (flow0 a h, Dflow a h o\\<^sub>L b))\"] blinfun_eqI\n simp: blinfun.bilinear_simps)\n done\n\ndefinition \"aforms_of_resultrect x0 x1 y0 y1 = aforms_of_ivl (ivl_of_resultrect x0 x1 y0 y1)\"\n\ndefinition \"flatten_varveq x = fst x @ the_default [] (snd x)\"\n\n(*\nLessEqual (N\\<^sub>r e) (N\\<^sub>r em *\\<^sub>e floatarith.Min (norm\\<^sub>e [(3)\\<^sub>e, (6)\\<^sub>e, (9)\\<^sub>e])\n (norm\\<^sub>e [(4)\\<^sub>e, (7)\\<^sub>e, (10)\\<^sub>e]))\n*)\n\nderive \"show\" ereal\n\ndefinition \\::\"(real*real*real) set\" where\n \"\\ = {(-6, -6, 27) .. (6, 6, 27)}\"\ndefinition \\\\<^sub>l\\<^sub>e::\"(real*real*real) set\" where\n \"\\\\<^sub>l\\<^sub>e = {(x, y, z). z \\ 27}\"\n\ndefinition \"results = symmetrize coarse_results\"\ndefinition \"results_at x = {res \\ set results. x \\ source_of_res res}\"\n\ntext \\a part of the stable manifold (up to the (backward) first intersection with \\\\\\)\\\ndefinition \\::\"(real*real*real) set\" where\n \"\\ = {x.\n {0..} \\ lorenz.existence_ivl0 x \\\n (\\t>0. lorenz.flow0 x t \\ \\) \\\n (lorenz.flow0 x \\ 0) at_top}\"\n\ndefinition \"\\\\<^sub>i intr = (if intr then \\ else {})\"\ndefinition \"\\\\<^sub>i\\<^sub>v intr = cast ` (\\\\<^sub>i intr)\"\n\ndefinition \"sourcei_of_res res = source_of_res res - (\\\\<^sub>i (invoke_nf res))\"\ndefinition \"resultsi_at x = {res \\ set results. x \\ sourcei_of_res res}\"\n\ndefinition \"N = \\(source_of_res ` (set results))\"\ndefinition \"\\ x = \\(conefield_of_res ` (results_at x))\"\ndefinition \"R = lorenz.poincare_map \\\"\ndefinition \"DR x = frechet_derivative (lorenz.poincare_map \\) (at x within \\\\<^sub>l\\<^sub>e)\"\ndefinition \"\\ x = Min (expansion ` results_at x)\"\ndefinition \"\\\\<^sub>p x = Min (preexpansion ` results_at x)\"\n\nabbreviation returns_to (infixl \"returns'_to\" 50) where\n \"(x returns_to P) \\ lorenz.returns_to P x\"\n\nlemma closed_\\[intro, simp]: \"closed \\\"\n by (auto simp: \\_def)\n\nlemma \\_stable: \"lorenz.stable_on (- \\) \\\"\n unfolding lorenz.stable_on_def\nproof (intro allI impI)\n fix t x0\n assume outside: \"\\s\\{0<..t}. lorenz.flow0 x0 s \\ - \\\"\n assume assms: \"lorenz.flow0 x0 t \\ \\\" \"t \\ lorenz.existence_ivl0 x0\" \"0 < t\"\n from assms have *: \"{0..} \\ lorenz.existence_ivl0 (lorenz.flow0 x0 t)\"\n \"(lorenz.flow0 (lorenz.flow0 x0 t) \\ 0) at_top\"\n by (auto simp: \\_def)\n have nonneg_exivl: \"s \\ lorenz.existence_ivl0 x0\" if \"s \\ 0\" for s\n proof (cases \"s \\ t\")\n case True\n then show ?thesis\n using \\0 \\ s\\ assms(2) lorenz.ivl_subset_existence_ivl[of t x0] by auto\n next\n case False\n define u where \"u = s - t\"\n with False have \"u > 0\" \"s = t + u\" by auto\n note this(2)\n also have \"t + u \\ lorenz.existence_ivl0 x0\"\n apply (rule lorenz.existence_ivl_trans)\n apply fact\n using * \\u > 0\\ by auto\n finally show ?thesis .\n qed\n show \"x0 \\ \\\"\n unfolding \\_def\n proof (safe intro!: nonneg_exivl)\n have \"\\\\<^sub>F s in at_top. (s::real) \\ 0\"\n using eventually_ge_at_top by blast\n then have \"\\\\<^sub>F s in at_top. lorenz.flow0 (lorenz.flow0 x0 t) s = lorenz.flow0 x0 (s + t)\"\n proof eventually_elim\n case (elim s)\n then have \"s \\ lorenz.existence_ivl0 x0\"\n using nonneg_exivl[OF \\0 \\ s\\] by simp\n then have \"lorenz.flow0 (lorenz.flow0 x0 t) s = lorenz.flow0 x0 (t + s)\"\n apply (subst lorenz.flow_trans)\n using assms * elim by auto\n then show ?case by (simp add: ac_simps)\n qed\n then have \"((\\s. (lorenz.flow0 x0 (s + t))) \\ 0) at_top\"\n by (blast intro: * Lim_transform_eventually)\n then show \"(lorenz.flow0 x0 \\ 0) at_top\"\n unfolding aform.tendsto_at_top_translate_iff .\n next\n fix s::real assume s: \"0 < s\" \"lorenz.flow0 x0 s \\ \\\"\n show False\n proof (cases \"s \\ t\")\n case True\n then show ?thesis\n using outside s\n by (auto simp: \\_def)\n next\n case False\n then obtain u where u: \"u = s - t\" \"u > 0\"\n by auto\n then have \"lorenz.flow0 x0 (s) = lorenz.flow0 x0 (t + u)\" by (simp add: algebra_simps)\n also have \"\\ = lorenz.flow0 (lorenz.flow0 x0 t) u\"\n apply (subst lorenz.flow_trans)\n subgoal by fact\n subgoal unfolding u\n apply (rule lorenz.diff_existence_ivl_trans) apply fact+\n apply (rule nonneg_exivl) using \\0 < s\\ by simp\n subgoal by simp\n done\n also from assms(1) \\u > 0\\ have \"\\ \\ \\\"\n by (auto simp: \\_def)\n finally show ?thesis using s\n by auto\n qed\n qed\nqed\n\nlemma (in auto_ll_on_open) stable_on_empty[intro, simp]: \"stable_on asdf {}\"\n by (auto simp: stable_on_def)\n\nlemma \\\\<^sub>i_stable: \"lorenz.stable_on (- \\) (\\\\<^sub>i b)\"\n using \\_stable\n unfolding \\\\<^sub>i_def\n apply (cases b)\n subgoal by auto\n subgoal using lorenz.stable_on_empty\n by (auto simp: \\\\<^sub>i_def)\n done\n\ndefinition \"\\\\<^sub>v = (cast ` \\)\"\n\ndefinition \"NF = lorenz.flowsto (cube_entry - \\ \\ UNIV) {0..} (large_cube \\ UNIV) cube_exit\"\n\nlemma NF0: \"lorenz.flowsto ((fst ` cube_entry - \\) \\ UNIV) {0..} (large_cube \\ UNIV)\n (fst ` cube_exit \\ UNIV)\"\n if NF\n using that\n unfolding NF_def lorenz.flowsto_def\n apply (auto simp: NF_def)\n apply (drule bspec, force)\n by auto\n\nlemma [autoref_rules]: includes autoref_syntax shows \"(\\_. (), \\\\<^sub>i\\<^sub>v) \\ bool_rel \\ ghost_rel\"\n by (auto simp: ghost_rel_def)\n\nlemma lorenz_interrupt[le, refine_vcg]:\n \"lorenz_interrupt optns b X \\ SPEC (\\(CX, R).\n lorenz.flowsto ((cast_eucl1 ` X::R3 c1_info set) - (\\\\<^sub>i b \\ UNIV)) {0..} (cast ` CX \\ UNIV) (cast_eucl1 ` R))\"\n if NF\n unfolding lorenz_interrupt_def\n apply refine_vcg\n subgoal\n by (rule lorenz.flowsto_self) auto\n subgoal\n by (auto simp: eucl_le[where 'a=\"3 rvec\"] eucl_of_list_inner Basis_list_vec_def Basis_list_real_def)\n subgoal for a b c d e f g h i j k l m n p\n apply (auto)\n apply (simp add: cast_eucl1_image_scaleR2 scaleR2_diff_prod2)\n apply (erule make_neg_goal)\n apply (rule lorenz.flowsto_scaleR2I)\n using NF0[OF that]\n apply (rule lorenz.flowsto_subset)\n subgoal for q\n apply (auto simp: scaleR2_def cast_eucl1_def)\n apply (auto simp: linear_cast_bl linear.scaleR cube_entry_def cast_eucl1_def image_image)\n subgoal premises prems for r s t u v\n proof -\n from prems have \"fst ` c \\ fst ` (cube_enter::3 vec1 set)\"\n by auto\n with \\(u, v) \\ c\\ obtain w where \"((u, w)::3 vec1) \\ cube_enter\"\n by auto\n from _ this have \"cast u \\ (\\x. cast (fst (x::3 vec1))) ` cube_enter\"\n by (rule image_eqI) auto\n then show ?thesis using prems\n by blast\n qed\n subgoal by (auto simp: \\\\<^sub>i_def)\n done\n subgoal by simp\n subgoal premises _\n by (auto simp: eucl_le[where 'a=\"3 rvec\"] eucl_of_list_inner Basis_list_vec_def Basis_list_real_def\n eucl_of_list_def\n large_cube_def)\n subgoal premises prems for x\n apply (auto simp:)\n subgoal for A B C D E\n apply (rule image_eqI[where x=\"cast_eucl1 (((B, C, D), A))\"])\n apply (auto simp: cast_eucl1_def)\n subgoal premises prems\n using prems(1)\n apply (auto simp: cube_exit_def aform.c1_info_of_apprs_def cube_exiti_def\n cast_eucl1_def aform.c1_info_of_appr_def)\n done\n done\n done\n done\n subgoal for a b c d e f g h i j k l m n p\n apply (auto)\n apply (erule make_neg_goal, thin_tac \"\\ _\")\n apply (simp add: cast_eucl1_image_scaleR2 scaleR2_diff_prod2)\n apply (rule lorenz.flowsto_scaleR2I)\n using that[unfolded NF_def]\n apply (rule lorenz.flowsto_subset)\n subgoal for q\n apply (auto simp: scaleR2_def cast_eucl1_def )\n apply (auto simp: linear_cast_bl linear.scaleR cube_entry_def cast_eucl1_def image_image)\n subgoal premises prems for r s t u v\n proof -\n from prems have \\vec1_of_flow1 (u, v) \\ cube_enter\\\n by auto\n from _ this have \"(cast u, cast_bl v) \\ (\\x. (cast (fst (x::3 vec1)), cast_bl (snd (flow1_of_vec1 x)))) ` cube_enter\"\n by (rule image_eqI) (auto simp: )\n then show ?thesis\n using prems by blast\n qed\n subgoal by (auto simp: \\\\<^sub>i_def)\n done\n subgoal by simp\n subgoal premises _\n by (auto simp: eucl_le[where 'a=\"3 rvec\"] eucl_of_list_inner Basis_list_vec_def Basis_list_real_def\n eucl_of_list_def\n large_cube_def)\n subgoal by (simp add: cube_exit_def)\n done\n done\n\n\ndefinition \"lorenz_S X = (case X of (x, y, z) \\ (-x, -y, z))\"\n\nlemma lorenz_symI: \"((\\t. lorenz_S (f t)) has_vderiv_on lf') T\"\n if \"(f has_vderiv_on f') T\" \"\\t. t \\ T \\ lf' t = lorenz_S (f' t)\"\n using that\n by (auto simp: has_vderiv_on_def lorenz_S_def split_beta' has_vector_derivative_def\n intro!: derivative_eq_intros)\n\nlemma lorenz_S:\n \"t \\ lorenz.existence_ivl0 (lorenz_S X)\" (is ?th1)\n \"lorenz.flow0 (lorenz_S X) t = lorenz_S (lorenz.flow0 X t)\" (is ?th2)\n if \"t \\ lorenz.existence_ivl0 X\"\nproof -\n have 1: \"((\\t. lorenz_S (lorenz.flow0 X t)) solves_ode\n (\\_ (X0, X1, X2).\n (E1 * X0 - K1 * (X0 + X1) * X2,\n E2 * X1 + K1 * (X0 + X1) * X2,\n E3 * X2 + (X0 + X1) * (K2 * X0 + K3 * X1))))\n {0--t} UNIV\"\n apply (rule solves_odeI)\n apply (rule lorenz_symI)\n apply (rule lorenz.flow_has_vderiv_on_compose)\n apply simp\n apply simp\n apply (rule derivative_intros)\n apply (rule refl)\n using that\n apply (rule lorenz.in_existence_between_zeroI)\n apply assumption\n apply (rule refl)\n unfolding lorenz_S_def\n apply (split prod.splits)+\n apply (simp add: field_simps)\n apply simp\n done\n have \"lorenz.flow0 X 0 = X\"\n unfolding lorenz.flow_initial_time_if\n by simp\n then have 2:\n \"lorenz_S (lorenz.flow0 X 0) = lorenz_S X\"\n \"is_interval {0--t}\"\n \"0 \\ {0--t}\"\n \"{0--t} \\ UNIV\"\n by auto\n from lorenz.maximal_existence_flow[OF 1 2]\n show ?th1 ?th2 by fast+\nqed\n\nlemma \\\\<^sub>l\\<^sub>e_impl[autoref_rules]: \"(Sctn [0, 0, 1] 27, \\\\<^sub>l\\<^sub>e) \\ \\lv_rel\\below_rel\"\n apply (auto simp: below_rel_def \\\\<^sub>l\\<^sub>e_def below_halfspace_def sctn_rel_def\n intro!: relcompI[where b=\"Sctn (0, 0, 1) 27\"] brI lv_relI)\n subgoal\n unfolding lv_rel_def\n by (auto intro!: brI)\n unfolding le_halfspace_def\n by (auto intro!: brI)\n\nlemma [autoref_rules]: \"((), \\\\<^sub>v) \\ ghost_rel\"\n by (auto intro!: ghost_relI)\n\nno_notation vec_nth (infixl \"$\" 90) and vec_lambda (binder \"\\\" 10)\n\nabbreviation \"guards_rel \\ \\clw_rel (\\\\lv_rel\\ivl_rel, \\lv_rel\\plane_rel\\inter_rel) \\\\<^sub>r aform.reach_optns_rel\\list_rel\"\n\n\ndefinition \"aform_poincare_onto_from optns = aform.poincare_onto_from\"\n\nlemma aform_poincare_onto_from[autoref_rules]:\n includes autoref_syntax\n shows\n\"DIM_precond TYPE('b rvec) E \\\n (XSi, XS::'b::enum eucl1 set) \\ clw_rel aform.appr1e_rel \\\n (sctni, sctn) \\ \\lv_rel\\sctn_rel \\\n (ivli, ivl) \\ \\lv_rel\\ivl_rel \\\n (Si, Sa) \\ \\lv_rel\\halfspaces_rel \\\n (guardsi, guards) \\ guards_rel \\\n (symstartd, symstart) \\ aform.appr1e_rel \\ \\clw_rel aform.appr_rel \\\\<^sub>r clw_rel aform.appr1e_rel\\dres_nres_rel \\\n ((), trap) \\ ghost_rel \\\n (roi, roptn) \\ aform.reach_optns_rel \\\n (odoi, odo) \\ ode_ops_rel \\\n (optnsi, optns) \\ num_optns_rel \\\n (nres_of\n (solve_poincare_map_aform optnsi E odoi symstartd Si guardsi ivli\n sctni roi XSi),\n aform_poincare_onto_from $ optns $ odo $ symstart $ trap $ Sa $ guards $\n ivl $\n sctn $\n roptn $\n XS)\n \\ \\clw_rel aform.appr1e_rel\\nres_rel\"\n unfolding autoref_tag_defs aform_poincare_onto_from_def\n using aform.poincare_onto_from_impl.refine[OF _ aform_ncc aform_ncc,\n where 'a='b, of E odoi odo XSi XS Si Sa guardsi guards ivli ivl sctni sctn roi roptn\n \"(\\x. nres_of (symstartd x))\" symstart symstartd trap optnsi,\n unfolded autoref_tag_defs, OF _ _ _ _ _ _ _ _ _ order_refl]\n by (auto simp: dest!: aform.dres_nres_rel_nres_relD)\n\ndefinition \"lorenz_odo_impl = init_ode_ops True True lorenz.odo\"\ninterpretation autoref_op_pat_def lorenz.odo .\nlemma lorenz_odo_impl[autoref_rules]: \"(lorenz_odo_impl, lorenz.odo) \\ ode_ops_rel\"\n by (auto simp: ode_ops_rel_def lorenz_odo_impl_def)\n\ndefinition lorenz_poincare where\n \"lorenz_poincare optns interrupt guards roptn XS0 =\n aform_poincare_onto_from optns lorenz.odo\n (lorenz_interrupt optns interrupt)\n (\\\\<^sub>i\\<^sub>v interrupt:::ghost_rel)\n ((below_halfspaces {Sctn (eucl_of_list [0, 0, 1]) 27}::(real^3) set):::\\lv_rel\\halfspaces_rel)\n guards\n (op_atLeastAtMost_ivl (eucl_of_list [-6, -6, 27]:::lv_rel) (eucl_of_list [6, 6, 27]:::lv_rel):::lvivl_rel::(real^3) set)\n (Sctn (eucl_of_list [0, 0, -1]) (- 27)::(real^3) sctn)\n roptn\n XS0\"\n\nlemma [autoref_rules_raw]:\n includes autoref_syntax\n shows \"((),\n (OP \\\\<^sub>i\\<^sub>v ::: bool_rel \\ ghost_rel) $\n (OP intr ::: bool_rel))\n \\ ghost_rel\" by (auto simp: ghost_rel_def)\n\nschematic_goal lorenz_poincare_impl[autoref_rules]:\n includes autoref_syntax\n assumes [autoref_rules]: \"(XSi, XS) \\ clw_rel aform.appr1e_rel\"\n \"(intri, intr) \\ bool_rel\"\n \"(guardsi, guards) \\ guards_rel\"\n \"(roi, roptn) \\ aform.reach_optns_rel\"\n \"(optnsi, optns) \\ num_optns_rel\"\n shows \"(nres_of ?r, lorenz_poincare $ optns $ intr $ guards $ roptn $ XS) \\\n \\clw_rel aform.appr1e_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding lorenz_poincare_def\n including art\n supply [autoref_rules_raw] = ghost_relI\n by autoref_monadic\n\nlemma cast_image_eqI: \"cast ` X = Y\"\n if \"DIM('a) = DIM('b)\"\n \"(X::'a::executable_euclidean_space set) = cast ` (Y::'b::executable_euclidean_space set)\"\n using that\n by (auto simp: image_image)\n\nlemma transfer_\\[transfer_rule]: \"(rel_set lorenz.rel_ve) \\\\<^sub>v \\\"\n unfolding \\\\<^sub>v_def\n by (auto simp: lorenz.rel_ve_cast' intro!: rel_setI)\n\nlemma transfer_\\\\<^sub>l\\<^sub>e[transfer_rule]: \"(rel_set lorenz.rel_ve) (cast ` \\\\<^sub>l\\<^sub>e) \\\\<^sub>l\\<^sub>e\"\n by (auto simp: lorenz.rel_ve_cast' intro!: rel_setI)\n\nlemma transfer_\\\\<^sub>i[transfer_rule]: \"(rel_fun (=) (rel_set lorenz.rel_ve)) \\\\<^sub>i\\<^sub>v \\\\<^sub>i\"\n unfolding \\\\<^sub>i\\<^sub>v_def\n by (auto simp: lorenz.rel_ve_cast' intro!: rel_setI)\n\nlemma transfer_\\[transfer_rule]: \"(rel_set lorenz.rel_ve) (cast ` \\) \\\"\n by (auto simp: lorenz.rel_ve_cast' intro!: rel_setI)\n\nlemma len_fas: \"length lorenz_fas = 3\"\n by (auto simp: lorenz_fas_def)\n\nlemma lorenz_poincare[le, refine_vcg]:\n \"lorenz_poincare optns intr guards roptn XS \\ SPEC (\\R.\n aform.poincare_mapsto lorenz.odo (cast ` \\) (XS - (\\\\<^sub>i\\<^sub>v intr \\ UNIV)) (cast ` \\\\<^sub>l\\<^sub>e)\n UNIV R)\"\n if [refine_vcg]: NF\n unfolding lorenz_poincare_def aform_poincare_onto_from_def\n apply (refine_vcg)\n subgoal by (simp add: aform.wd_def aform.ode_e_def len_fas)\n subgoal for a b c d\n apply (auto simp: lorenz.flowsto_eq[symmetric])\n proof goal_cases\n case 1\n from 1(2)[unfolded lorenz.flowsto_eq[symmetric]]\n show ?case\n by transfer (simp add: lorenz.avflowsto_eq)\n qed\n subgoal\n unfolding aform.stable_on_def unfolding autoref_tag_defs\n proof (intro allI impI, goal_cases)\n case (1 t x0)\n from 1 have t: \"t \\ lorenz.v.existence_ivl0 x0\"\n using lorenz.vex_ivl_eq by simp\n from 1 have f: \"lorenz.v.flow0 x0 t \\ \\\\<^sub>i\\<^sub>v intr\"\n using lorenz.vflow_eq[OF t] by simp\n from 1 have \"lorenz.v.flow0 x0 s \\ - cast ` \\\"\n if \"s\\{0<..t}\" for s\n proof -\n from that t have s: \"s \\ lorenz.v.existence_ivl0 x0\"\n by (auto dest!: lorenz.a.v.closed_segment_subset_existence_ivl\n simp: closed_segment_eq_real_ivl)\n have \"lorenz.v.flow0 x0 s\n \\ aform.Csafe lorenz.odo -\n op_atLeastAtMost_ivl (eucl_of_list [- 6, - 6, 27]) (eucl_of_list [6, 6, 27]) \\\n plane_of (Sctn (eucl_of_list [0, 0, - 1]) (- 27))\"\n using 1(4)[rule_format, OF that]\n unfolding lorenz.vflow_eq[OF s] \n by auto\n also have \"\\ \\ - cast ` \\\"\n by (auto simp: eucl_le[where 'a=\"real^3\"] eucl_of_list_inner axis_eq_axis\n cast_def Basis_list_real_def Basis_list_vec3 \\_def plane_of_def\n eucl_of_list_inner_eq inner_lv_rel_def)\n finally show \"lorenz.v.flow0 x0 s \\ - cast ` \\\" .\n qed\n show \"x0 \\ \\\\<^sub>i\\<^sub>v intr\"\n by (rule \\\\<^sub>i_stable[Transfer.untransferred, unfolded lorenz.v.stable_on_def, rule_format])\n fact+\n qed\n subgoal for R\n proof (clarsimp, goal_cases)\n case 1\n note 1(2)\n also have \"({eucl_of_list [- 6, - 6, 27]..eucl_of_list [6, 6, 27]::3 rvec} \\\n plane_of (Sctn (eucl_of_list [0, 0, - 1]) (- 27))) = cast ` \\\"\n apply auto\n apply (auto simp: \\_def o_def plane_of_def \n eucl_of_list_def Basis_list_R3 Basis_list_vec3)\n subgoal\n by (auto simp: cast_def eucl_of_list_def Basis_list_R3 Basis_list_vec3)\n subgoal\n by (auto simp: cast_def eucl_of_list_def Basis_list_R3 Basis_list_vec3)\n subgoal\n apply (auto simp: cast_le_iff[symmetric])\n by (auto simp: cast_def eucl_of_list_def Basis_list_R3 Basis_list_vec3 less_eq_prod_def\n list_of_eucl_def inner_simps inner_axis_axis)\n subgoal\n apply (auto simp: cast_le_iff)\n by (auto simp: cast_def eucl_of_list_def Basis_list_R3 Basis_list_vec3 less_eq_prod_def\n list_of_eucl_def inner_simps inner_axis_axis)\n subgoal\n by (auto simp: cast_def eucl_of_list_def Basis_list_R3 Basis_list_vec3 less_eq_prod_def\n list_of_eucl_def inner_simps inner_axis_axis)\n done\n also have \"(below_halfspaces {Sctn (eucl_of_list [0, 0, 1]::3 rvec) 27}) = (cast ` \\\\<^sub>l\\<^sub>e)\"\n apply (auto simp: \\\\<^sub>l\\<^sub>e_def below_halfspaces_def below_halfspace_def le_halfspace_def\n eucl_of_list_def Basis_list_R3 Basis_list_vec3)\n apply (rule image_eqI)\n apply (rule cast_cast[symmetric])\n by (auto simp: cast_def list_of_eucl_def o_def plane_of_def inner_simps inner_axis_axis\n eucl_of_list_def Basis_list_R3 Basis_list_vec3)\n finally\n show ?case\n by (rule aform.poincare_mapsto_subset) (force simp: lorenz.vX_def intro: cast_cast[symmetric])+\n qed\n done\n\ncontext includes floatarith_notation begin\n\ndefinition \"mat1\\<^sub>e =\n [Var 0, Var 1, Var 2, Var 3, 0, 0,\n Var 4, 0, 0,\n Var 5, 0, 0]\"\n\ndefinition mat1_nres::\"3 rvec set \\ 3 rvec set \\ 3 eucl1 set nres\"\n where\n\"mat1_nres X v = do {\n Xv \\ aform.approx_slp_appr mat1\\<^sub>e (slp_of_fas mat1\\<^sub>e) (concat ` listset [list_of_eucl ` X, list_of_eucl ` v]);\n RETURN (flow1_of_vec1 ` Xv)\n}\"\nlemma [simp]: \"(x, x') \\ aform.appr_rel \\ aform.ncc x'\"\n using aform_ncc[where 'a='a]\n by (auto simp: aform.ncc_precond_def)\nlemma mat1e_autoref[autoref_rules]: \"(mat1\\<^sub>e, mat1\\<^sub>e) \\ \\Id\\list_rel\"\n by auto\nschematic_goal mat1_impl:\n includes autoref_syntax\n assumes [autoref_rules]: \"(Xi, X) \\ aform.appr_rel\" \"(vi, v) \\ aform.appr_rel\"\n shows \"(nres_of ?r, mat1_nres $ X $ v) \\ \\aform.appr1_rel\\nres_rel\"\n unfolding mat1_nres_def\n including art\n by autoref_monadic\nconcrete_definition mat1_impl for Xi vi uses mat1_impl\nlemmas [autoref_rules] = mat1_impl.refine\n\nlemma mat_nres[le, refine_vcg]:\n \"mat1_nres X v \\ SPEC (\\M. X \\ v \\ (\\x. (fst x, blinfun_apply (snd x) (eucl_of_list [1, 0, 0]))) ` M)\"\n unfolding mat1_nres_def\n apply refine_vcg\n apply (auto simp: dest!: bspec)\n apply (auto simp: mat1\\<^sub>e_def image_image )\n subgoal for x a b\n apply (rule image_eqI[where x=\"eucl_of_list\n [(list_of_eucl a @ list_of_eucl b) ! 0, (list_of_eucl a @ list_of_eucl b) ! Suc 0,\n (list_of_eucl a @ list_of_eucl b) ! 2, (list_of_eucl a @ list_of_eucl b) ! 3, 0, 0,\n (list_of_eucl a @ list_of_eucl b) ! 4, 0, 0, (list_of_eucl a @ list_of_eucl b) ! 5, 0, 0]\"])\n apply (auto simp: eucl_of_list_prod eucl_of_list_inner nth_append Basis_list_vec3\n intro!: euclidean_eqI[where 'a=\"3 rvec\"])\n unfolding Basis_list[symmetric] Basis_list_vec3\n by (auto simp: flow1_of_vec1_def blinfun_of_vmatrix.rep_eq Basis_list_vec3 inner_simps\n matrix_vector_mult_eq_list_of_eucl_nth ll3 inner_axis_axis)\n done\n\ndefinition [simp]: \"op_image_cast_eucl1e = (`) cast_eucl1\"\ndefinition [simp]: \"op_image_cast_eucl1e_coll = (`) cast_eucl1\"\n\nlemma prod_relI'': \"\\(fst ab, a')\\R1; (snd ab, b')\\R2\\ \\ (ab,(a', b'))\\\\R1,R2\\prod_rel\"\n by (auto simp: prod_rel_def)\n\nlemma strange_aux_lemma:\n \"(b, b') \\ A \\ (b, snd (a'a, b')) \\ A\"\n by auto\n\nlemma [autoref_rules]:\n includes autoref_syntax\n assumes\n \"DIM_precond TYPE('a::executable_euclidean_space) D\"\n \"DIM_precond TYPE('b::executable_euclidean_space) D\"\n shows\n \"(\\x. x, (op_image_cast_eucl1e::('a::executable_euclidean_space c1_info set \\ 'b::executable_euclidean_space c1_info set))) \\ aform.appr1e_rel \\ aform.appr1e_rel\"\n (is ?th1)\n and \"(\\x. x, op_image_cast_eucl1e_coll::'a::executable_euclidean_space c1_info set \\ 'b::executable_euclidean_space c1_info set) \\ clw_rel aform.appr1e_rel \\ clw_rel aform.appr1e_rel\"\n (is ?th2)\nproof -\n show 1: ?th1\n unfolding scaleR2_rel_def\n apply (rule subsetD)\n apply (rule fun_rel_comp_dist)\n apply (rule relcompI)\n apply (rule fun_relI)\n apply (erule prod_relE)\n apply simp\n apply (rule prod_relI)\n apply simp\n apply (rule fst_conv[symmetric])\n apply (rule op_cast_eucl1_image_impl[OF assms, param_fo])\n apply (rule strange_aux_lemma)\n apply (auto simp: br_def scaleR2_def image_def vimage_def\n cast_eucl1_def)\n subgoal for a b c d e f g\n apply (rule exI[where x=e] conjI)+\n apply assumption\n apply (rule exI conjI)+\n apply assumption\n apply (rule exI conjI)+\n apply (rule bexI) prefer 2 apply assumption\n apply (rule conjI) apply force\n apply (rule refl)\n using assms\n by (auto simp: blinfun.bilinear_simps linear_cast linear.scaleR\n intro!: blinfun_eqI)\n subgoal for a b c d e f g\n apply (rule exI[where x=e] exI conjI)+\n apply assumption\n apply (rule exI conjI)+\n apply assumption\n apply (rule bexI) prefer 2 apply assumption\n apply force\n using assms\n by (auto simp: blinfun.bilinear_simps linear_cast linear.scaleR\n intro!: blinfun_eqI)\n done\n have id_map: \"(\\x. x) = (map (\\x. x))\" by simp\n show ?th2\n apply (subst id_map)\n apply (rule lift_clw_rel_map)\n apply (rule relator_props)+\n subgoal using 1 by auto\n subgoal by auto\n done\nqed\n\ndefinition \"lorenz_poincare_tangents optns interrupt guards roptn c1 (X0::R3 set) (tangents::R3 set) =\n do {\n X0tanmat \\ (if c1 then\n do {\n R \\ mat1_nres (cast ` X0) (cast ` tangents);\n RETURN (R::3 eucl1 set)\n } else RETURN (cast ` X0 \\ UNIV));\n XDX0 \\ scaleRe_ivl_spec 1 1 (X0tanmat);\n let _ = aform.trace_set1e ''START'' (Some XDX0);\n let _ = aform.print_set1e False (XDX0);\n P \\ lorenz_poincare optns interrupt guards roptn ((mk_coll XDX0:::clw_rel aform.appr1e_rel));\n RETURN (op_image_cast_eucl1e_coll P::R3 c1_info set)\n }\"\nlemma [autoref_rules_raw]: \"DIM(real \\ real \\ real) = DIM((real, 3) vec)\"\n by auto\n\nschematic_goal lorenz_poincare_tangents_impl:\n includes autoref_syntax\n assumes [autoref_rules]:\n \"(optnsi, optns) \\ Id\"\n \"(intrri, intr) \\ bool_rel\"\n \"(guardsi, guards) \\ guards_rel\"\n \"(roi, roptn) \\ aform.reach_optns_rel\"\n \"(c1i, c1) \\ bool_rel\"\n \"(X0i, X0) \\ aform.appr_rel\"\n \"(tangentsi, tangents) \\ aform.appr_rel\"\n shows\n \"(nres_of ?r, lorenz_poincare_tangents $ optns $ intr $ guards $ roptn $ c1 $ (X0::R3 set) $ tangents) \\\n \\clw_rel aform.appr1e_rel\\nres_rel\"\n unfolding lorenz_poincare_tangents_def\n including art\n by (autoref_monadic)\n\nconcrete_definition lorenz_poincare_tangents_impl uses\n lorenz_poincare_tangents_impl[where\n optnsa = \"\\_ _ _ _ _ _ _ _. optns\"\n and optnsb = \"\\_ _ _ _ _ _ _ _ _. optns\"\n and optnsi = \"optns\"\n and optnsc = \"optns\"\n and optns = \"\\_ _ _ _ _ _ _. optns\"\n for optns optnsc]\nlemma lorenz_poincare_tangents_impl_refine[autoref_rules]:\n includes autoref_syntax\n shows\n \"(\\optnsi intrri guardsi roi c1i X0i tangentsi. nres_of\n (lorenz_poincare_tangents_impl optnsi intrri guardsi roi c1i X0i tangentsi),\n lorenz_poincare_tangents)\n \\ num_optns_rel \\ bool_rel \\ guards_rel \\ aform.reach_optns_rel \\ bool_rel \\ aform.appr_rel \\\n aform.appr_rel \\\n \\clw_rel aform.appr1e_rel\\nres_rel\"\n using lorenz_poincare_tangents_impl.refine by force\n\nlemma transfer_UNIV_rel_blinfun[transfer_rule]:\n \"(rel_set (rel_blinfun lorenz.rel_ve lorenz.rel_ve)) UNIV UNIV\"\n apply (auto intro!: rel_setI simp: rel_blinfun_def)\n subgoal for x\n apply (rule exI[where x=\"cast_bl x\"])\n by (auto intro!: rel_funI simp: lorenz.rel_ve_cast)\n subgoal for x\n apply (rule exI[where x=\"cast_bl x\"])\n by (auto intro!: rel_funI simp: lorenz.rel_ve_cast)\n done\n\nlemma lorenz_vX[simp]: \"lorenz.vX = (UNIV::3 rvec set)\"\n by (force simp: lorenz.vX_def intro!: cast_cast[symmetric])\n\nlemma closed_cast_\\[intro, simp]: \"closed (cast ` \\::3 rvec set)\"\n by (auto simp: \\_def )\nlemma blinfun_apply_transfer[transfer_rule]:\n \"(rel_fun (rel_blinfun lorenz.rel_ve lorenz.rel_ve)\n (rel_fun (rel_prod (=) (rel_prod (=) (=))) lorenz.rel_ve))\n (blinfun_apply o cast_bl) blinfun_apply\"\n by (auto intro!: rel_funI simp: rel_blinfun_def lorenz.rel_ve_cast\n dest!: rel_funD)\n\nlemma lorenz_poincare_tangents[le, refine_vcg]:\n \"lorenz_poincare_tangents optns intr guards roptn c1 (X0::R3 set) tangents \\\n SPEC (\\x.\n (if c1 then \\tans. X0 \\ tangents \\ (\\(x, y). (x, blinfun_apply y (1, 0, 0))) ` tans \\ lorenz.poincare_mapsto \\ (tans - \\\\<^sub>i intr \\ UNIV) (\\\\<^sub>l\\<^sub>e) UNIV x\n else lorenz.poincare_mapsto \\ ((X0 - \\\\<^sub>i intr) \\ UNIV) (\\\\<^sub>l\\<^sub>e) UNIV x))\"\n if [refine_vcg]: NF\n unfolding lorenz_poincare_tangents_def\n apply refine_vcg\n apply auto\n apply (subst lorenz.poincare_mapsto_eq[symmetric])\n apply simp\nproof goal_cases\n case (2 R)\n then show ?case\n apply transfer\n apply (subst lorenz.vpoincare_mapsto_eq[symmetric])\n apply (auto simp: )\n apply (rule aform.poincare_mapsto_subset, assumption)\n by (force simp: scaleR2_def )+\nnext\n case (1 tans R)\n show ?case\n apply (rule exI[where x=\"cast_eucl1 ` tans\"])\n apply (rule conjI)\n subgoal including lifting_syntax\n using 1(2)\n by transfer (force simp: cast_def o_def)\n subgoal\n using 1(3) apply transfer\n apply (subst lorenz.avpoincare_mapsto_eq[symmetric])\n by (auto simp: )\n done\nqed\n\ndefinition of_mat1_image::\"R3 c1_info set \\ R3 set nres\"\n where [refine_vcg_def]: \"of_mat1_image X = SPEC (\\R. R = (\\x. blinfun_apply (snd x) (1, 0, 0)) ` X)\"\n\nlemma of_mat1_image_impl[autoref_rules]:\n \"(\\x. (case x of (_, Some xs) \\ RETURN [xs ! 0, xs ! 3, xs ! 6]\n | (_, None) \\ SUCCEED), of_mat1_image) \\ aform.appr1_rel \\ \\aform.appr_rel\\nres_rel\"\n apply (auto simp: of_mat1_image_def RETURN_RES_refine_iff nres_rel_def\n aform.appr1_rel_internal aform.appr_rel_def\n intro!: relcompI\n split: option.splits)\n unfolding aforms_rel_def\n apply (rule brI)\n apply (auto simp: )\n unfolding lv_rel_def set_rel_br\n apply (rule brI)\n prefer 2 apply (force simp: Joints_imp_length_eq)\n apply (auto elim!: mem_Joints_appendE simp: flow1_of_list_def Joints_imp_length_eq)\n subgoal for a b c d e f g h i j\n apply (rule image_eqI[where x=\"[j ! 0, j ! 3, j! 6]\"])\n apply (auto simp: blinfun_of_list_def blinfun_of_matrix_apply\n Basis_prod_def Basis_list_R3 Basis_list_vec3 eval_nat_numeral zero_prod_def)\n apply (rule map_nth_Joints'[of _ _ \"[0, Suc (Suc (Suc 0)), Suc (Suc (Suc (Suc (Suc (Suc 0)))))]\",\n simplified])\n apply auto\n done\n subgoal for a b c d e f\n unfolding image_image\n apply (auto simp: Joints_def valuate_def)\n subgoal for g\n apply (rule image_eqI)\n prefer 2\n apply (rule image_eqI[where x=g])\n apply (rule refl)\n apply (auto simp: )\n apply (auto simp: blinfun_of_list_def blinfun_of_matrix_apply flow1_of_list_def\n Basis_prod_def Basis_list_R3 Basis_list_vec3 eval_nat_numeral zero_prod_def)\n done\n done\n done\n\ndefinition [refine_vcg_def]: \"floatdegs res = SPEC (\\_::unit. min_deg res \\ float \\ max_deg res \\ float)\"\ndefinition [simp]: \"isinfloat x \\ x \\ float\"\n\n\nlemma floatdegs_impl[autoref_rules]:\n includes autoref_syntax\n shows\n \"(\\res. (if isinfloat (min_deg res) \\ isinfloat (max_deg res) then RETURN () else SUCCEED), floatdegs)\n \\ Id \\ \\unit_rel\\nres_rel\"\n by (auto simp: nres_rel_def floatdegs_def)\n\ndefinition \"check_c1_entry optns em P (res0::result) (res::result) = do {\n uv_ret \\ of_mat1_image P;\n nuv \\ aform.mig_set 3 uv_ret;\n floatdegs res0;\n floatdegs res;\n let e' = em * ereal nuv;\n b1 \\ approx_conefield_bounds P (min_deg res) (max_deg res);\n let b2 = e' \\ preexpansion res;\n let b3 = e' \\ expansion res0;\n let _ = aform.print_msg ((shows ''# check_c1_entry: '' o shows_list [b1, b2, b3] o shows_space o\n shows_list [e', preexpansion res, expansion res0]) '''');\n RETURN (em \\ 0 \\ b1 \\ b2 \\ b3)\n }\"\n\nlemma [autoref_itype]:\n \"shows_prec ::\\<^sub>i i_nat \\\\<^sub>i A \\\\<^sub>i i_string \\\\<^sub>i i_string\"\n by auto\n\nlemma [autoref_rules]:\n includes autoref_syntax\n shows\n \"PREFER_id A \\ (shows_list, shows_list) \\ \\A\\list_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ string_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ ereal_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec::_\\result \\_) \\ nat_rel \\ Id \\ string_rel \\ string_rel\"\n \"(shows_space, shows_space) \\ string_rel \\ string_rel\"\n by (auto simp: string_rel_def)\nlemma [autoref_rules]:\n includes autoref_syntax\n shows\n \"(expansion, expansion) \\ Id \\ rnv_rel\"\n \"(preexpansion, preexpansion) \\ Id \\ rnv_rel\"\n \"(min_deg, min_deg) \\ Id \\ rnv_rel\"\n \"(max_deg, max_deg) \\ Id \\ rnv_rel\"\n by auto\ninterpretation autoref_op_pat_def aform.mig_set .\nlemma [autoref_rules_raw]: \"DIM_precond TYPE(real \\ real \\ real) (OP 3 ::: nat_rel)\"\n by simp\nschematic_goal check_c1_entry_impl:\n includes autoref_syntax\n assumes [autoref_rules]:\n \"(optnsi, optns) \\ Id\"\n \"(res0i, res0) \\ Id\"\n \"(resi, res) \\ Id\"\n \"(emi, em) \\ ereal_rel\"\n \"(Pei, P) \\ aform.appr1_rel\"\n shows\n \"(nres_of ?r, check_c1_entry optns em P res0 res) \\ \\bool_rel\\nres_rel\"\n unfolding check_c1_entry_def\n including art\n by autoref_monadic\n\nconcrete_definition check_c1_entry_impl uses check_c1_entry_impl[\n where optns = \"\\_ . optnsi\"\n and optnsi=\"optnsi\"\n and optnsc=optns\n and optnsa=\"\\_ _ _ _ _. optnsi\"\n and optnsb=\"\\_ _ _ _ _ _ _ _ . optnsi\"\n and optns=\"\\_. optnsi\"\n for optns optnsi]\nlemmas check_c1_entry_impl_refine[autoref_rules] = check_c1_entry_impl.refine[autoref_higher_order_rule]\n\ndefinition \"c1_entry_correct (em::ereal) (P::R3 c1_info set) res0 res = (\\(_, d)\\P. case (d (1, 0, 0)) of (dx, dy, dz) \\\n dz = 0 \\ dx > 0 \\ -90 < min_deg res \\ min_deg res \\ max_deg res \\ max_deg res < 90 \\\n ereal (preexpansion res) \\ em * (norm (dx, dy, dz)) \\\n ereal (expansion res0) \\ em * (norm (dx, dy, dz)) \\\n dy / dx \\ {tan (rad_of (min_deg res)) .. tan (rad_of (max_deg res))})\"\n\nlemma check_c1_entry[le, refine_vcg]:\n \"check_c1_entry optns em P res0 res \\ SPEC (\\b. b \\ c1_entry_correct em P res0 res)\"\n unfolding check_c1_entry_def c1_entry_correct_def\n apply refine_vcg\n apply (auto dest!: bspec simp:)\n apply (rule order_trans, assumption, rule ereal_mult_left_mono, force, force)\n apply (rule order_trans, assumption, rule ereal_mult_left_mono, force, force)\n done\n\n\nsubsection \\options for the lorenz system\\\n\ndefinition aform_numeric_optns::\"_ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\ _ \\\n real aform numeric_options\" where\n \"aform_numeric_optns = numeric_options.fields\"\n\nfun zbucket::\"real \\ real \\ real \\ real \\ real \\ real \\ real \\ ((real list \\ real list) \\ real list sctn) list\"\n where \"zbucket d (x0,x1) (y0, y1) (z0, z1) =\n [zsec' (x0 - d, x0 + d) (y0 - d, y1 + d) z0, \\ \\bottom\\\n xsec' x0 (y0 - d, y1 + d) (z0 - d, z1), \\ \\left\\\n xsec x1 (y0 - d, y1 + d) (z0 - d, z1), \\ \\right\\\n ysec' (x0 - d, x1 + d) y0 (z0 - d, z1), \\ \\backno\\\n ysec (x0 - d, x1 + d) y1 (z0 - d, z1)] \\ \\front\\\"\n\nsubsubsection \\Hybridizations\\\n\ndefinition \"reduce_weak_params c1 = (if c1 then (12::nat, 0::nat) else (3, 0))\"\ndefinition \"reduce_hard_params c1 = (if c1 then (0::nat, 100::nat) else (0, 100))\"\ndefinition \"ro_split_weak c1 w = (case reduce_weak_params c1 of (m, n) \\ ro (w + 1) m n w w (-5))\"\ndefinition \"ro_split_weak' c1 w = (case reduce_weak_params c1 of (m, n) \\ ro w m n w w (-5))\"\ndefinition \"ro_split_weak'' c1 w = (case reduce_weak_params c1 of (m, n) \\ ro (w + 2) m n w w (-5))\"\ndefinition \"ro_split_weak4' c1 w = (case reduce_weak_params c1 of (m, n) \\ ro (w + 4) m n w w (-5))\"\ndefinition \"ro_split_weak2 c1 w w2 = (case reduce_weak_params c1 of (m, n) \\ ro (w + 1) m n w w2 (-5))\"\ndefinition \"ro_split_weak2' c1 w w2 = (case reduce_weak_params c1 of (m, n) \\ ro (w) m n w w2 (-5))\"\ndefinition \"ro_split_hard c1 w0 w1 = (case reduce_hard_params c1 of (m, n) \\ ro (w0 + 1) m n w0 w1 (-5))\"\ndefinition \"ro_split_hard'' c1 w0 w1 = (case reduce_hard_params c1 of (m, n) \\ ro (w0 + 2) m n w0 w1 (-5))\"\ndefinition \"ro_split_not c1 w = (case reduce_weak_params c1 of (m, n) \\ ro 0 m n w w (-5))\"\ndefinition \"ro_split_not2 c1 w w2 = (case reduce_weak_params c1 of (m, n) \\ ro 0 m n w w2 (-5))\"\n\ndefinition \"xsecs x y z = [xsec' (-x) (-y, y) (0, z), xsec x (-y, y) (0, z)]\"\n\ntype_synonym run_options = \"(nat \\ nat) \\ int \\\n (((real list \\ real list) \\ real list sctn) list \\ real aform reach_options) list \\ real aform reach_options\"\n\nabbreviation \"p1 \\ ldec 0.1\"\n\ndefinition mode_middle::\"_ \\ run_options\" where \"mode_middle c1 = (reduce_weak_params c1, -14,\n [([zsec' (-2, 2) (-1, 1) 10], ro_split_weak' c1 (-3)),\n (xsecs (5 * p1) 10 10 @\n xsecs p1 10 (6) @\n [zsec' (-p1, p1) (-p1, p1) p1],\n ro_split_hard c1 (-5) (-2)),\n (xsecs (3/2/2) 10 (10), ro_split_not2 c1 0 (-2)), \\ \\To collect after interrupt\\\n ([zsec (-30, -6) (-10, 10) 30, zsec (6, 30) (-10, 10) 30], ro_split_not2 c1 (-1) (-3))\n ], ro_split_weak4' c1 (-5))\"\n\ndefinition mode_inner3::\"bool\\bool\\run_options\" where \"mode_inner3 c1 very_inner =\n (reduce_weak_params c1, -15,\n (if very_inner then [([zsec' (-2, 2) (-1, 1) 10], ro_split_weak' c1 (-2))] else [])@\n [(xsecs (3/2) 15 27@xsecs 1 (10) (11/2), ro_split_weak2 c1 (-2) (-1)),\n ([ zsec (-30, -6) (-10, 10) 30, zsec (6, 30) (-10, 10) 30], ro_split_not2 c1 (-1) (-3))\n ],\n if very_inner then ro_split_weak4' c1 (-5) else ro_split_weak'' c1 (-5))\"\n\ndefinition mode_inner2::\"bool \\ real \\ run_options\" where \"mode_inner2 c1 x =\n (reduce_weak_params c1, -14,\n [(xsecs x 10 27, ro_split_weak2' c1 (-2) (-1)),\n ([zsec ( -30, -6) (-10, 10) 30, zsec (6, 30) (-10, 10) 30], ro_split_not2 c1 (-3) (-3))],\n ro_split_not c1 (-6))\"\n\ndefinition \"ro_outer c1 w = (case reduce_weak_params c1 of (m, n) \\ ro w m n (-6) (-6) (-5))\"\ndefinition mode_outer::\"bool\\_\\_\\run_options\" where\n \"mode_outer c1 w i = (reduce_weak_params c1, (-i),\n [([zsec (-30, -6) (-10, 10) 27, zsec (6, 30) (-10, 10) 27], ro_split_not2 c1 (-3) (-4))], ro_outer c1 w)\"\n\ndefinition lookup_mode::\"bool \\ result \\ _\" where\n\"lookup_mode c1 i =\n (if gridx0 i \\ - 1024 then mode_outer c1 (-3) 16\n else if gridx0 i \\ - 120 then mode_outer c1 (-3) 14\n else if gridx0 i \\ 107 then mode_inner2 c1 (4)\n else if gridx0 i \\ 169 then mode_inner3 c1 False\n else if gridx0 i \\ 196 then mode_inner3 c1 True\n else if gridx0 i \\ 201 then mode_middle c1\n else if gridx0 i \\ 235 then mode_inner3 c1 True\n else if gridx0 i \\ 290 then mode_inner3 c1 False\n else if gridx0 i \\ 450 then mode_inner2 c1 4\n else mode_outer c1 (-3) 14)\"\n\ndefinition mode_ro_spec::\"bool \\ result \\ ((nat \\ nat) \\\n int \\ ((real, 3) vec set \\ unit) list \\\n unit) nres\"\nwhere [refine_vcg_def]: \"mode_ro_spec c1 res = SPEC (\\_. True)\"\n\nlemma reach_options_rel_br: \"reach_options_rel TYPE('ty) = br (\\_. ()) (\\_. True)\"\n by (auto simp: reach_options_rel_def br_def)\n\nlemma mode_ro_spec_impl[autoref_rules]:\n includes autoref_syntax\n shows \"(\\b x. RETURN (lookup_mode b x), mode_ro_spec) \\ bool_rel \\ Id \\\n \\(nat_rel \\\\<^sub>r nat_rel) \\\\<^sub>r int_rel \\\\<^sub>r guards_rel \\\\<^sub>r aform.reach_optns_rel\\nres_rel\"\n supply [simp del] = prod_rel_id_simp\n apply (rule fun_relI)\n apply (rule fun_relI)\n apply (rule nres_relI)\n unfolding mode_ro_spec_def\n apply (rule RETURN_SPEC_refine)\n apply (auto simp: mode_ro_spec_def nres_rel_def RETURN_RES_refine_iff)\n apply (rule exI)+\n apply (rule prod_relI'' IdI)+\n unfolding lv_rel_def ivl_rel_def br_rel_prod br_chain plane_rel_br inter_rel_br\n clw_rel_br br_list_rel Id_br prod_eq_iff reach_options_rel_br\n apply (rule brI refl)+\n defer apply (rule brI) apply (rule refl) apply auto\n apply (auto simp: lookup_mode_def mode_outer_def mode_inner2_def mode_inner3_def xsecs_def\n mode_middle_def)\n done\n\nlemma [autoref_rules]: includes autoref_syntax shows\n \"(ivl_of_res, ivl_of_res) \\ Id \\ \\rnv_rel\\list_rel \\\\<^sub>r \\rnv_rel\\list_rel\"\n by auto\n\n\nlemma [autoref_rules]: includes autoref_syntax shows\n \"(Polygon.pairself, Polygon.pairself) \\ (A \\ C) \\ (A \\\\<^sub>r A) \\ (C \\\\<^sub>r C)\"\n by (auto dest: fun_relD)\n\nlemma set_of_ivl_impl[autoref_rules]: includes autoref_syntax shows\n \"(\\x. x, set_of_ivl) \\ (A \\\\<^sub>r A) \\ \\A\\ivl_rel\"\n by (auto simp: ivl_rel_def br_def)\nlemma eucl_of_list_pad: includes autoref_syntax shows\n \"DIM_precond TYPE('a::executable_euclidean_space) D \\\n (\\xs. take D xs @ replicate (D - length xs) 0, eucl_of_list::_\\'a) \\ rl_rel \\ lv_rel\"\n unfolding lv_rel_def\n by (auto simp: intro!: brI)\nconcrete_definition eucl_of_list_pad uses eucl_of_list_pad\nlemmas [autoref_rules] = eucl_of_list_pad.refine\n\nlemma source_of_res_impl[autoref_rules]: includes autoref_syntax shows\n \"(ivl_of_res, source_of_res) \\ Id \\ \\lv_rel\\ivl_rel\"\n unfolding source_of_res_def\n apply (auto simp: ivl_rel_def intro!: relcompI brI)\n subgoal for a\n apply (auto simp: ivl_of_res_def ivl_of_resultrect_def\n intro!: lv_relI)\n unfolding lv_rel_def\n apply (auto intro!: brI)\n done\n done\n\ndefinition tangent_seg_of_res :: \"real aform numeric_options \\ result \\ R3 set nres\" where\n\"tangent_seg_of_res optns res0 = do {\n let fas = map (OP (nth matrix_of_degrees2\\<^sub>e)) [0, 3, 6];\n let u = min_deg res0;\n let v = max_deg res0;\n aform.approx_slp_appr fas (slp_of_fas fas) (lv_ivl [u, v, 0] [u, v, 1])\n}\"\nlemmas [refine_vcg_def] = tangent_seg_of_res_spec_def\nlemma tangent_seg_of_res[le, refine_vcg]:\n \"tangent_seg_of_res optns res \\ tangent_seg_of_res_spec res\"\n unfolding tangent_seg_of_res_def tangent_seg_of_res_spec_def\n apply refine_vcg\n apply (auto simp: matrix_of_degrees2\\<^sub>e_def Let_def in_segment)\n subgoal for x a b c u\n by (drule bspec[where x=\"[min_deg res, max_deg res, u]\"])\n (auto simp: tangent_of_deg_def lv_ivl_def algebra_simps intro!:)\n done\nlemma [autoref_rules]: includes autoref_syntax shows\n \"(nth matrix_of_degrees2\\<^sub>e, nth matrix_of_degrees2\\<^sub>e) \\ nat_rel \\ Id\"\n by auto\nschematic_goal tangent_seg_of_res_impl:\n includes autoref_syntax\n assumes [autoref_rules]: \"(resi, res) \\ Id\"\n \"(optnsi, optns) \\ num_optns_rel\"\n shows\n \"(nres_of ?r, tangent_seg_of_res optns res) \\ \\aform.appr_rel\\nres_rel\"\n unfolding tangent_seg_of_res_def\n including art\n by autoref_monadic\nconcrete_definition tangent_seg_of_res_impl uses tangent_seg_of_res_impl\nlemmas [autoref_rules] = tangent_seg_of_res_impl.refine[where\n optnsi = optnsi and optnsa=optns and optns=\"\\_ _ _. optnsi\" for optns optnsi, autoref_higher_order_rule]\n\nlemma return_of_res_impl:\n includes autoref_syntax shows\n \"(\\results res. (get_results (inf_retx res) (inf_rety res) (sup_retx res) (sup_rety res) results),\n return_of_res) \\ \\Id\\list_rel \\ Id \\ \\Id\\list_wset_rel\"\n by (auto simp: return_of_res_def list_wset_rel_def intro!: brI)\nconcrete_definition return_of_res_impl uses return_of_res_impl\nlemmas [autoref_rules] = return_of_res_impl.refine\n\nlemma lorenz_optns'_impl[autoref_rules]: includes autoref_syntax shows\n \"(lorenz_optns', lorenz_optns') \\\n \\Id \\ unit_rel\\option_rel \\ nat_rel \\ nat_rel \\ rnv_rel \\ rnv_rel \\ num_optns_rel\"\n by auto\nlemma [autoref_rules]:\n includes autoref_syntax shows\n \"(results, results) \\ \\Id\\list_rel\"\n \"(invoke_nf, invoke_nf) \\ Id \\ bool_rel\"\n by auto\n\ndefinition \"check_line_nres print_fun m0 n0 c1 res0 = do {\n let X0 = source_of_res res0;\n (X0l, X0u) \\ ivl_rep X0;\n ((m::nat, n::nat), a::int, modes, ro) \\ mode_ro_spec c1 res0;\n let interrupt = invoke_nf res0;\n let optns = lorenz_optns' print_fun (the_default m m0) (the_default n n0) 1 (FloatR 1 a);\n tangents \\ tangent_seg_of_res optns res0;\n aform.CHECKs (ST ''check_line_nres le'') (X0l \\ X0u);\n sp \\ aform.subset_spec_plane X0 (Sctn (eucl_of_list [0, 0, 1]) 27);\n aform.CHECKs (ST ''check_line_nres le'') sp;\n ASSERT (X0l \\ X0u);\n Pe \\ lorenz_poincare_tangents optns interrupt modes ro c1 ({X0l .. X0u}) tangents;\n PeS \\ sets_of_coll Pe;\n let RETs = (return_of_res results res0);\n let RET = \\((mk_coll ` (source_of_res ` RETs:::\\lvivl_rel\\list_wset_rel):::\\clw_rel lvivl_rel\\list_wset_rel));\n every \\ WEAK_ALL\\<^bsup>\\Pe. \\P em eM Rivls. em > 0 \\ Pe = scaleR2 em eM P \\ fst ` P \\ \\Rivls \\ (\\Rivl \\ Rivls. (\\res\\RETs. Rivl \\ source_of_res res \\ (c1 \\ c1_entry_correct em P res0 res)))\\<^esup>\n PeS (\\Pe. do {\n let _ = aform.trace_set1e (ST ''# Return Element: '') (Some Pe);\n ((em, eM), P) \\ scaleR2_rep Pe;\n aform.CHECKs (ST ''check_line_nres pos'') (0 < em);\n let R = (fst ` P:::aform.appr_rel);\n (Ri, Rs) \\ op_ivl_rep_of_set R;\n let Rivl = (op_atLeastAtMost_ivl Ri Rs);\n Rivls \\ aform.split_along_ivls2 3 (mk_coll Rivl) RET;\n Rivlss \\ sets_of_coll Rivls;\n WEAK_ALL\\<^bsup>\\Rivl. \\res\\RETs. Rivl \\ source_of_res res \\ (c1 \\ c1_entry_correct em P res0 res)\\<^esup> Rivlss\n (\\Rivl. do {\n b \\\n WEAK_EX\\<^bsup>\\res. Rivl \\ source_of_res res \\ (c1 \\ c1_entry_correct em P res0 res)\\<^esup> RETs\n (\\res. do {\n let src = (source_of_res res:::lvivl_rel);\n let subs = Rivl \\ src;\n cones \\ if \\(c1 \\ subs) then RETURN True else check_c1_entry optns em P res0 res;\n RETURN (subs \\ cones)\n });\n let _ = aform.print_msg ((shows (ST ''# return of '') o shows res0 o\n shows (if b then ST '' OK'' else ST '' FAILED''))'''');\n RETURN b\n })\n });\n RETURN (every, Pe, RET)\n }\"\n\n\ndefinition \"aform_subset_spec_plane optns = aform.subset_spec_plane\"\n\nlemma aform_subset_spec_plane_impl[autoref_rules]: includes autoref_syntax shows\n \"DIM_precond TYPE('a::executable_euclidean_space) D \\\n (Xi, X::'a set) \\ \\lv_rel\\ivl_rel \\\n (sctni, sctn) \\ \\lv_rel\\sctn_rel \\\n (optnsi, optns) \\ num_optns_rel \\\n (nres_of (subset_spec_plane_impl_aform optnsi D Xi sctni),\n aform_subset_spec_plane $ optns $ X $ sctn)\n \\ \\bool_rel\\nres_rel\"\n using aform.subset_spec_plane_impl.refine[where 'a='a, of D Xi X sctni sctn optnsi]\n by (force simp: aform_subset_spec_plane_def)\n\nschematic_goal check_line_impl:\n includes autoref_syntax\n assumes [autoref_rules]: \"(pfi, pf) \\ \\Id \\ unit_rel\\option_rel\"\n \"(c1i, c1) \\ bool_rel\" \"(res0i, res0) \\ Id\"\n \"(m0i, m0) \\ \\nat_rel\\option_rel\" \"(n0i, n0) \\ \\nat_rel\\option_rel\"\n shows\n \"(nres_of ?r, check_line_nres $ pf $ m0 $ n0 $ c1 $ res0) \\\n \\bool_rel \\\\<^sub>r clw_rel aform.appr1e_rel \\\\<^sub>r clw_rel lvivl_rel\\nres_rel\"\n unfolding check_line_nres_def\n including art\n by autoref_monadic\n\nconcrete_definition check_line_impl uses check_line_impl[where\n optns = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . lorenz_optns pfi\"\n and optnsa = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and optnsb = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and optnsc = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and optnsd = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and optnse = \"\\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and optnsf = \"\\ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. lorenz_optns pfi\"\n and pfi = pfi\n for pfi]\nlemmas [autoref_rules] = check_line_impl.refine\n\n\nlemma check_line_nres:\n \"check_line_nres pf m0 n0 c1 res0 \\ SPEC (\\(every, Pe, RET). \\P. Pe = \\P \\\n (if c1\n then \\tans. source_of_res res0 \\ {tangent_of_deg (min_deg res0)--tangent_of_deg (max_deg res0)} \\ (\\(x, y). (x, blinfun_apply y (1, 0, 0))) ` tans \\\n lorenz.poincare_mapsto \\ (tans - \\\\<^sub>i (invoke_nf res0) \\ UNIV) \\\\<^sub>l\\<^sub>e UNIV (Pe)\n else lorenz.poincare_mapsto \\ ((sourcei_of_res res0) \\ UNIV) \\\\<^sub>l\\<^sub>e UNIV (\\P)) \\\n source_of_res res0 \\ plane_of (Sctn (0, 0, 1) 27) \\\n (every \\\n (\\x\\P. \\P em. em > 0 \\ (\\eM. x = scaleR2 em eM P) \\\n (\\Rivls. fst ` P \\ \\Rivls \\\n (\\Rivl\\Rivls.\n \\res\\return_of_res results res0.\n Rivl \\ source_of_res res \\ (c1 \\ c1_entry_correct em P res0 res))))))\"\n if [refine_vcg]: NF\n unfolding check_line_nres_def sourcei_of_res_def\n apply (refine_vcg, clarsimp_all)\n using [[goals_limit=1]]\n subgoal for a0 a b c d e f g h i j k l m n p q r s t\n apply (rule exI[where x=i])\n apply (rule exI[where x=j])\n apply (rule conjI)\n apply force\n apply (rule conjI)\n apply (rule exI[where x=k])\n apply force\n apply (rule exI[where x=s])\n apply (rule conjI) defer apply force\n apply blast\n done\n subgoal for x0 y0 z0 x1 y1 z1 tangents s R every\n apply (rule exI[where x=R])\n apply auto\n subgoal for tans\n apply (rule exI[where x=tans])\n by auto\n subgoal for tans\n apply (rule exI[where x=tans])\n by auto\n done\n done\n\ndefinition \"print_sets_color (print_fun::String.literal \\ unit) (c::string) (X::'a::executable_euclidean_space set) = ()\"\n\ndefinition \"print_lorenz_color print_fun cx cy cz ci cd1 cd2 P = ()\"\n\ndefinition \"print_aforms print_fun c aforms =\n fold (\\a _. print_fun (String.implode (shows_segments_of_aform 0 1 a c ''\\''))) aforms ()\"\n\nlemma print_sets_color_impl[autoref_rules]: includes autoref_syntax shows\n \"(\\print_fun c X. print_aforms print_fun c X, print_sets_color) \\\n (Id \\ unit_rel) \\ string_rel \\ clw_rel aform.appr_rel \\ unit_rel\"\n by auto\n\nlemma print_lorenz_color_impl[autoref_rules]: includes autoref_syntax shows\n \"(\\print_fun cx cy cz ci cd1 cd2 P.\n fold (\\(_, x) b.\n print_lorenz_aform print_fun\n cx cy cz ci cd1 cd2\n False\n (fst x @ the_default [] (snd x))\n ) P (), print_lorenz_color) \\\n (Id \\ unit_rel) \\ string_rel \\ string_rel \\ string_rel \\ string_rel \\\n \\\\string_rel\\list_rel, \\\\string_rel\\list_rel, (\\clw_rel aform.appr1e_rel, unit_rel\\fun_rel)\\fun_rel\\fun_rel\"\n by auto\n\ndefinition check_line_core where\n \"check_line_core print_funo m0 n0 c1 i =\n do {\n let print_fun = the_default (\\_. ()) print_funo;\n CHECK (\\_. print_fun (STR ''Hey, out of bounds!'')) (i < length results);\n let res = ((results:::\\Id\\list_rel) ! (i:::nat_rel));\n (r, P, B) \\ check_line_nres print_funo m0 n0 c1 res;\n let _ = print_sets_color print_fun (ST ''0x007f00'') (aform.sets_of_ivls B);\n (_, Pu) \\ scaleR2_rep_coll P;\n let _ = print_sets_color print_fun (ST ''0x7f0000'')\n (aform.op_image_fst_coll (Pu:::clw_rel aform.appr1_rel):::clw_rel aform.appr_rel);\n let _ = print_lorenz_color print_fun\n (ST ''0x7f0000'') (ST ''0x7f0001'') (ST ''0x7f0002'') (ST ''0x7f0003'')\n [(ST ''0xc60000''), (ST ''0xc60000''), (ST ''0xc60000'')]\n [(ST ''0xf60000''), (ST ''0xf60000''), (ST ''0xf60000'')]\n P;\n let _ = (if r\n then print_fun\n (String.implode ((show (ST ''# VERIFIED '') @ show i @ show (ST ''\\''))))\n else print_fun (String.implode ((show (ST ''# Failed to verify '') @ show i @ show (ST ''\\'')) )));\n RETURN r\n }\"\nlemma [autoref_rules]: includes autoref_syntax shows\n \"(shows_prec, shows_prec) \\ nat_rel \\ nat_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ string_rel \\ string_rel \\ string_rel\"\n \"(String.implode, String.implode) \\ string_rel \\ Id\"\n by (auto simp: string_rel_def)\nschematic_goal check_line_core_impl:\n includes autoref_syntax\n assumes [autoref_rules]: \"(pfi, pf) \\ \\Id \\ unit_rel\\option_rel\"\n \"(c1i, c1) \\ bool_rel\" \"(ii, i) \\ nat_rel\"\n \"(m0i, m0) \\ \\nat_rel\\option_rel\" \"(n0i, n0) \\ \\nat_rel\\option_rel\"\n shows \"(nres_of ?f, check_line_core $ pf $ m0 $ n0 $ c1 $ i) \\ \\bool_rel\\nres_rel\"\n unfolding check_line_core_def\n including art\n by autoref_monadic\nconcrete_definition check_line_core_impl for pfi m0i n0i c1i ii uses check_line_core_impl\nlemmas [autoref_rules] = check_line_core_impl.refine\n\ndefinition \"c1i_of_res res = sourcei_of_res res \\ conefield_of_res res\"\n\ndefinition \"correct_res res =\n ((\\(x, dx) \\ c1i_of_res res.\n x \\ plane_of (Sctn (0, 0, 1) 27) \\\n dx \\ plane_of (Sctn (0, 0, 1) 0) \\\n ((lorenz.returns_to \\ x \\\n lorenz.return_time \\ differentiable at x within \\\\<^sub>l\\<^sub>e \\\n (\\D. (lorenz.poincare_map \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e) \\\n norm (D dx) \\ expansion res * norm dx \\\n (\\res2 \\ return_of_res results res.\n (lorenz.poincare_map \\ x, D dx) \\ c1_of_res res2 \\\n norm (D dx) \\ preexpansion res2 * norm dx))))))\"\n\nlemma check_line_nres_c0_correct:\n \"check_line_nres pf m0 n0 c1 res \\ SPEC (\\(every, Pe, RET). every \\\n (\\x \\ sourcei_of_res res. lorenz.poincare_map \\ x \\ \\(source_of_res ` return_of_res results res)))\"\n if NF\n apply (rule check_line_nres[OF \\NF\\, le])\n apply (auto simp: c1i_of_res_def lorenz.poincare_mapsto_def)\n subgoal\n apply (drule bspec, force)\n apply (auto dest!: spec[where x=\"1\\<^sub>L\"])\n apply (drule bspec, force)\n apply (force simp: scaleR2_def image_def vimage_def)\n done\n subgoal premises prems for a b c d e tans\n proof -\n obtain t where\n \"((c, d, e), t) \\ tans - \\\\<^sub>i (invoke_nf res) \\ UNIV\"\n \"((c, d, e), tangent_of_deg (min_deg res)) = (\\(x, y). (x, blinfun_apply y (1, 0, 0))) ((c, d, e), t)\"\n using prems\n by (auto simp: sourcei_of_res_def)\n with prems(6)[rule_format, of \"((c, d, e), t)\"] prems(3)\n obtain D x where \"tangent_of_deg (min_deg res) = blinfun_apply t (1, 0, 0)\"\n \"(c, d, e) returns_to \\\"\n \"fst ` (tans - \\\\<^sub>i (invoke_nf res) \\ UNIV) \\ \\\\<^sub>l\\<^sub>e\"\n \"lorenz.return_time \\ differentiable at (c, d, e) within \\\\<^sub>l\\<^sub>e\"\n \"(lorenz.poincare_map \\ has_derivative blinfun_apply D) (at (c, d, e) within \\\\<^sub>l\\<^sub>e)\"\n \"x \\ b\" \"(lorenz.poincare_map \\ (c, d, e), D o\\<^sub>L t) \\ x\"\n by auto\n with prems\n show ?thesis\n subgoal\n apply (auto dest!: bspec[OF _ \\x \\ b\\])\n apply (auto simp: scaleR2_def image_def vimage_def)\n apply (auto simp: subset_iff)\n by fastforce \\\\slow\\\n done\n qed\n subgoal for a b c d e f\n apply (drule bspec[where A=\"sourcei_of_res res\"]) apply force\n apply (auto dest!: spec[where x=\"1\\<^sub>L\"])\n apply (drule bspec, force)\n apply auto\n apply (auto simp: scaleR2_def image_def vimage_def)\n apply (auto simp: subset_iff)\n by fastforce\\ \\slow\\\n done\n\nlemma cone_conefield[intro, simp]: \"cone (conefield a b)\"\n unfolding conefield_alt_def\n by (rule cone_cone_hull)\n\nlemma in_segment_norm_bound: \"c \\ {a -- b} \\ norm c \\ max (norm a) (norm b)\"\n apply (auto simp: in_segment max_def intro!: norm_triangle_le)\n apply (auto simp: algebra_simps intro: add_mono mult_left_mono\n mult_right_mono)\n using affine_ineq by blast\n\nlemma norm_tangent_of_deg[simp]: \"norm (tangent_of_deg d) = 1\"\n by (auto simp: tangent_of_deg_def norm_prod_def)\n\nlemma check_line_nres_c1_correct:\n \"check_line_nres pf m0 n0 True res \\ SPEC (\\(correct, Pe, RET). correct \\ correct_res res)\"\n if NF\nproof (rule check_line_nres[OF \\NF\\, le], clarsimp, goal_cases)\n case P: (1 a P tans)\n let ?tans = \"{tangent_of_deg (min_deg res)--tangent_of_deg (max_deg res)}\"\n have tans_plane: \"?tans \\ UNIV \\ UNIV \\ {0}\"\n by (auto simp: in_segment tangent_of_deg_def)\n from P have *: \"x \\ plane_of (Sctn (0, 0, 1) 27)\" if \"x \\ sourcei_of_res res\" for x\n using that\n by (auto simp: that sourcei_of_res_def)\n from tans_plane P have **: \"dx \\ plane_of (Sctn (0, 0, 1) 0)\"\n if \"x \\ sourcei_of_res res\" \"dx \\ conefield_of_res res\" for x dx\n proof -\n from tans_plane that obtain c dx' dy' where\n c: \"dx = c *\\<^sub>R (dx', dy', 0)\" \"(dx', dy', 0) \\ ?tans\" \"c \\ 0\"\n unfolding conefield_of_res_def conefield_alt_def cone_hull_expl\n by auto\n then show ?thesis by (auto simp: plane_of_def)\n qed\n show ?case\n unfolding correct_res_def\n proof (intro ballI conjI, clarsimp_all simp add:\n * ** c1i_of_res_def c1_of_res_def sourcei_of_res_def, goal_cases)\n case source: (1 x y z dx dy dz)\n from tans_plane source obtain c dx' dy' where\n c: \"(dx, dy, dz) = c *\\<^sub>R (dx', dy', 0)\" \"(dx', dy', 0) \\ ?tans\" \"c \\ 0\"\n unfolding conefield_of_res_def conefield_alt_def cone_hull_expl\n by auto\n from c source P\n obtain t where tans: \"((x, y, z), t) \\ tans\" \"blinfun_apply t (1, 0, 0) = (dx', dy', 0)\"\n by auto \n from P(3) tans(1) source(3) obtain Re D where Re:\n \"(x, y, z) returns_to \\\" \"fst ` (tans - \\\\<^sub>i (invoke_nf res) \\ UNIV) \\ \\\\<^sub>l\\<^sub>e\"\n \"lorenz.return_time \\ differentiable at (x, y, z) within \\\\<^sub>l\\<^sub>e\"\n \"(lorenz.poincare_map \\ has_derivative blinfun_apply D) (at (x, y, z) within \\\\<^sub>l\\<^sub>e)\"\n \"Re \\ P\" \"(lorenz.poincare_map \\ (x, y, z), D o\\<^sub>L t) \\ Re\"\n by (auto simp: lorenz.poincare_mapsto_def dest!: bspec)\n from P(5)[rule_format, OF \\Re \\ P\\]\n obtain R em eM Rivls\n where R: \"Re = scaleR2 em eM R\"\n \"em > 0\"\n \"fst ` R \\ \\Rivls\"\n \"\\Rivl. Rivl\\Rivls \\\n \\resa\\return_of_res results res. Rivl \\ source_of_res resa \\ c1_entry_correct em R res resa\"\n by auto\n have \"lorenz.poincare_map \\ (x, y, z) \\ fst ` R\"\n and s2: \"(lorenz.poincare_map \\ (x, y, z), D o\\<^sub>L t) \\ scaleR2 em eM R\"\n using Re R by (auto simp: scaleR2_def)\n then obtain Rivl res' where Rivl:\n \"lorenz.poincare_map \\ (x, y, z) \\ Rivl\" \"Rivl \\ Rivls\"\n \"res' \\ return_of_res results res\" \"Rivl \\ source_of_res res'\"\n and c1: \"c1_entry_correct em R res res'\"\n using R\n by force\n from s2 obtain ed Dt where Dt:\n \"em \\ ereal ed\" \"ereal ed \\ eM\" \"D o\\<^sub>L t = ed *\\<^sub>R Dt\"\n \"(lorenz.poincare_map \\ (x, y, z), Dt) \\ R\"\n by (force simp: scaleR2_def)\n then have Dt_simp[simp]: \"Dt = inverse ed *\\<^sub>R (D o\\<^sub>L t)\"\n using \\0 < em\\\n by (cases em) (auto simp: intro!: simp: blinfun.bilinear_simps inverse_eq_divide)\n from c1[unfolded c1_entry_correct_def, rule_format, OF Dt(4)]\n obtain dxr dyr where dxrdyr: \"blinfun_apply D (dx', dy', 0) /\\<^sub>R ed = (dxr, dyr, 0)\"\n \"ereal (preexpansion res') \\ em * ereal (norm (dxr, dyr, 0::real))\"\n \"ereal (expansion res) \\ em * ereal (norm (dxr, dyr, 0::real))\"\n \"-90 < min_deg res'\" \"min_deg res' \\ max_deg res'\"\n \"tan (rad_of (min_deg res')) \\ (dyr / dxr)\"\n \"(dyr / dxr) \\ tan (rad_of (max_deg res'))\"\n \"max_deg res' < 90\"\n \"0 < dxr\"\n by (auto simp: blinfun.bilinear_simps tans)\n\n then obtain emr where emr: \"em = ereal emr\" \"0 < emr\" \"emr \\ ed\"\n \"(preexpansion res') \\ emr * (norm (dxr, dyr, 0::real))\"\n \"(expansion res) \\ emr * (norm (dxr, dyr, 0::real))\"\n using \\0 < em\\ Dt\n by (cases em) (auto simp: simp: blinfun.bilinear_simps divide_simps prod_eq_iff)\n from dxrdyr have Ddx'dy': \"D (dx', dy', 0) = ed *\\<^sub>R (dxr, dyr, 0)\"\n using \\0 < em\\ Dt\n by (cases em) (auto simp: simp: blinfun.bilinear_simps divide_simps prod_eq_iff)\n\n note \\(x, y, z) returns_to \\\\\n moreover note \\lorenz.return_time \\ differentiable at (x, y, z) within \\\\<^sub>l\\<^sub>e\\\n moreover note \\(lorenz.poincare_map \\ has_derivative D) (at (x, y, z) within \\\\<^sub>l\\<^sub>e)\\\n moreover note \\res' \\ return_of_res results res\\\n moreover have \"lorenz.poincare_map \\ (x, y, z) \\ source_of_res res'\"\n using Rivl by force\n moreover\n have \\0 \\ ed\\ using Dt \\0 < em\\ by (cases em) auto\n have \\D (dx, dy, dz) \\ conefield_of_res res'\\\n unfolding c blinfun.bilinear_simps conefield_of_res_def Ddx'dy'\n apply (intro mem_cone, simp_all add: \\0 \\ ed\\ \\0 \\ c\\ tangent_of_deg_def)\n apply (rule conefield_prod3I)\n unfolding fun_cong[OF tan_def, symmetric]\n subgoal by fact\n subgoal using dxrdyr\n apply (intro cos_gt_zero_pi)\n unfolding rad_of_lt_iff rad_of_gt_iff\n by (auto simp: deg_of_def)\n subgoal using dxrdyr\n apply (intro cos_gt_zero_pi)\n unfolding rad_of_lt_iff rad_of_gt_iff\n by (auto simp: deg_of_def)\n subgoal by fact\n subgoal by fact\n done\n moreover\n have norms_le: \"emr * norm (dx', dy', 0::real) * (\\c\\ * norm (dxr, dyr, 0::real)) \\ \\ed\\ * (\\c\\ * norm (dxr, dyr, 0::real))\"\n proof -\n from c(2)[THEN in_segment_norm_bound] have \"norm (dx', dy', 0::real) \\ 1\"\n by auto\n also have \"\\ \\ ed / emr\"\n using dxrdyr emr\n unfolding Ddx'dy'\n by auto\n finally show ?thesis\n using emr\n by (intro mult_right_mono) (auto simp: divide_simps ac_simps)\n qed\n then have \"expansion res * norm (dx, dy, dz) \\ norm (D (dx, dy, dz))\"\n unfolding c blinfun.bilinear_simps conefield_of_res_def Ddx'dy' norm_scaleR\n apply -\n apply (rule order_trans)\n apply (rule mult_right_mono)\n apply (rule emr)\n by (auto simp: ac_simps)\n moreover have \"preexpansion res' * norm (dx, dy, dz) \\ norm (D (dx, dy, dz))\"\n using norms_le\n unfolding c blinfun.bilinear_simps conefield_of_res_def Ddx'dy' norm_scaleR\n apply -\n apply (rule order_trans)\n apply (rule mult_right_mono)\n apply (rule emr)\n by (auto simp: ac_simps)\n ultimately\n show ?case\n by blast\n qed\nqed\n\nlemma conefield_ne_empyt[simp]: \"conefield a b \\ {}\"\n by (auto simp: conefield_def conesegment_def cone_hull_empty_iff[symmetric])\n\nlemma in_return_of_resD: \"res' \\ return_of_res results res \\ res' \\ set results\"\n by (auto simp: return_of_res_def get_results_def)\nlemma finite_results_at[intro, simp]: \"finite (results_at x)\"\n by (auto simp: results_at_def)\n\n\nlemma lorenz_bounds_lemma:\n \"x returns_to \\\"\n \"R x \\ N\"\n \"(R has_derivative DR x) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"\\c. c \\ \\ x \\ DR x c \\ \\ (R x)\"\n \"\\c. c \\ \\ x \\ norm (DR x c) \\ \\ x * norm c\"\n \"\\c. c \\ \\ x \\ norm (DR x c) \\ \\\\<^sub>p (R x) * norm c\"\n if \"x \\ N - \\\" NF \"\\res. res \\ set results \\ correct_res res\"\nproof -\n from \\x \\ N - \\\\ obtain res where res: \"res \\ set results\" \"x \\ sourcei_of_res res\"\n by (auto simp: N_def sourcei_of_res_def \\\\<^sub>i_def)\n then have ne: \"c1i_of_res res \\ {}\"\n by (auto simp: c1i_of_res_def conefield_of_res_def)\n from res this obtain dx where dx: \"(x, dx) \\ c1i_of_res res\"\n by (auto simp: c1i_of_res_def)\n from that(3)[OF \\res \\ set _\\] have \"correct_res res\" by simp\n from this[unfolded correct_res_def, rule_format, OF dx] res\n obtain res' D where res': \"x returns_to \\\"\n \"lorenz.return_time \\ differentiable at x within \\\\<^sub>l\\<^sub>e\"\n \"(lorenz.poincare_map \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"expansion res * norm dx \\ norm (D dx)\"\n \"res' \\ return_of_res results res\"\n \"(lorenz.poincare_map \\ x, D dx) \\ c1_of_res res'\"\n \"preexpansion res' * norm dx \\ norm (D dx)\"\n by auto\n show \"x returns_to \\\" by fact\n show \"R x \\ N\" using res'\n by (auto simp: R_def N_def N_def c1i_of_res_def c1_of_res_def in_return_of_resD\n sourcei_of_res_def)\n show \"(R has_derivative DR x) (at x within \\\\<^sub>l\\<^sub>e)\"\n apply (auto simp: R_def DR_def N_def c1_of_res_def in_return_of_resD)\n apply (subst frechet_derivative_works[symmetric])\n apply (rule differentiableI)\n by fact\nnext\n fix dx assume \"dx \\ \\ x\"\n then obtain res where res: \"res \\ set results\" and dx: \"(x, dx) \\ c1_of_res res\"\n by (auto simp: \\_def results_at_def c1_of_res_def )\n then have dx: \"(x, dx) \\ c1i_of_res res\"\n using \\x \\ N - _\\\n by (auto simp: c1i_of_res_def sourcei_of_res_def c1_of_res_def \\\\<^sub>i_def)\n from res dx have ne: \"c1i_of_res res \\ {}\"\n by (auto simp: c1_of_res_def conefield_of_res_def)\n from that(3)[OF \\res \\ set _\\] have \"correct_res res\" by simp\n from that this[unfolded correct_res_def, rule_format, OF dx] res\n obtain res' D where res': \"x returns_to \\\" \"x \\ plane_of (Sctn (0, 0, 1) 27)\"\n \"lorenz.return_time \\ differentiable at x within \\\\<^sub>l\\<^sub>e\"\n \"(lorenz.poincare_map \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"expansion res * norm dx \\ norm (D dx)\"\n \"res' \\ return_of_res results res\"\n \"(lorenz.poincare_map \\ x, D dx) \\ c1_of_res res'\"\n \"preexpansion res' * norm dx \\ norm (D dx)\"\n by auto\n have DRD: \"DR x = D\"\n unfolding DR_def\n apply (rule frechet_derivative_unique_within)\n apply (subst frechet_derivative_works[symmetric])\n apply (rule differentiableI)\n apply fact\n apply fact using \\x \\ plane_of _\\\n apply safe\n subgoal for _ _ _ e\n by (auto simp: \\\\<^sub>l\\<^sub>e_def Basis_prod_def prod_eq_iff plane_of_def prod_eq_iff\n inner_prod_def intro!: exI[where x=\"-e/2\"])\n done\n have [intro, simp]: \"res' \\ results_at (lorenz.poincare_map \\ x)\"\n using res'\n by (auto simp: c1_of_res_def results_at_def in_return_of_resD R_def\n intro!: exI[where x=res'])\n have [intro, simp]: \"res \\ results_at x\"\n using res dx\n by (auto simp: c1i_of_res_def results_at_def sourcei_of_res_def)\n show \"DR x dx \\ \\ (R x)\"\n unfolding DRD \\_def\n using res'\n by (auto simp: c1_of_res_def R_def)\n have \"\\ x * norm dx \\ expansion res * norm dx\"\n by (rule mult_right_mono) (auto simp: \\_def)\n also have \"\\ \\ norm (DR x dx)\" unfolding DRD by fact\n finally show \"\\ x * norm dx \\ norm (DR x dx)\" .\n\n have \"\\\\<^sub>p (R x) * norm dx \\ preexpansion res' * norm dx\"\n by (rule mult_right_mono) (auto simp: \\\\<^sub>p_def R_def)\n also have \"\\ \\ norm (DR x dx)\" unfolding DRD by fact\n finally show \"\\\\<^sub>p (R x) * norm dx \\ norm (DR x dx)\" .\nqed\n\n\nlemma check_line_core_correct:\n \"check_line_core pf m0 n0 True i \\ SPEC (\\correct. correct \\ correct_res (results ! i))\"\n if [refine_vcg]: NF\n unfolding check_line_core_def\n supply [refine_vcg] = check_line_nres_c1_correct[le]\n by refine_vcg\n\n\ntext \\The symmetric reduction\\\n\nlemma source_of_res_mirror: \"(x, y, z) \\ source_of_res (mirror_result res) \\\n (-x, -y, z) \\ source_of_res res\"\n by (cases res)\n (auto simp: source_of_res_def ivl_of_res_def ivl_of_resultrect_def set_of_ivl_def)\n\nlemma conefield_of_res_mirror[simp]: \"(x, y, z) \\ conefield_of_res (mirror_result res) \\\n (x, y, z) \\ conefield_of_res res\"\n by (cases res) (auto simp: conefield_of_res_def ivl_of_res_def)\n\nlemma c1_of_res_mirror: \"((x, y, z), dx, dy, dz) \\ c1_of_res (mirror_result res) \\\n ((-x, -y, z), dx, dy, dz) \\ c1_of_res res\"\n by (auto simp: c1_of_res_def source_of_res_mirror)\n\nlemmas [simp] = lorenz_S(2)\nlemma lorenz_S_idem[simp]: \"lorenz_S (lorenz_S x) = (x::R3)\"\n by (auto simp: lorenz_S_def split_beta')\nlemma lorenz_S_exivl[simp]:\n \"lorenz.existence_ivl0 (lorenz_S X) = lorenz.existence_ivl0 X\"\n using lorenz_S(1)[of _ X]\n using lorenz_S(1)[of _ \"lorenz_S X\"]\n by auto\nlemma lorenz_S_zero[simp]: \"lorenz_S x = 0 \\ (x::R3) = 0\"\n by (auto simp: lorenz_S_def split_beta' prod_eq_iff)\nlemma lorenz_S_returns_toI[simp]:\n \"x returns_to (lorenz_S ` P) \\ lorenz_S x returns_to P\"\n apply (auto simp: lorenz.returns_to_def)\n subgoal premises prems for t\n proof -\n have \" \\\\<^sub>F s in at_right 0. s < t\"\n using tendsto_ident_at \\0 < t\\\n by (rule order_tendstoD)\n then have \" \\\\<^sub>F s in at_right 0. s \\ lorenz.existence_ivl0 x\"\n unfolding eventually_at_filter\n apply eventually_elim\n using \\0 < t\\ lorenz.closed_segment_subset_existence_ivl[OF prems(3)]\n by (auto simp: closed_segment_eq_real_ivl subset_iff)\n then show ?thesis using prems(1)\n by eventually_elim force\n qed\n done\n\nlemma lorenz_S_returns_to[simp]:\n \"lorenz_S x returns_to P \\ x returns_to (lorenz_S ` P)\"\n using lorenz_S_returns_toI[of P x] lorenz_S_returns_toI[of \"lorenz_S ` P\" \"lorenz_S x\"]\n by (auto simp: image_image)\nlemma lorenz_S_image_Sigma[simp]: \"lorenz_S ` \\ = \\\"\n apply (auto simp: \\_def lorenz_S_def)\n apply (rule image_eqI)\n apply (rule lorenz_S_idem[symmetric])\n apply (auto simp: \\_def lorenz_S_def)\n done\n\nlemma linear_lorenz_S: \"linear lorenz_S\"\n by unfold_locales (auto simp: lorenz_S_def)\nlemma inj_lorenz_S: \"inj_on (lorenz_S::R3 \\ _) G\"\n by (rule inj_onI) (auto simp: lorenz_S_def prod_eq_iff)\n\nlemma lorenz_S_return_time:\n \"lorenz.return_time P (lorenz_S x) = lorenz.return_time (lorenz_S ` P) x\"\n if \"x returns_to (lorenz_S ` P)\" \"closed P\"\nproof -\n from lorenz.returns_toE[OF that(1)] obtain t0 t1\n where f: \"0 < t0\" \"t0 \\ t1\" \" t1 \\ lorenz.existence_ivl0 x\"\n \"lorenz.flow0 x t1 \\ lorenz_S ` P\"\n \"\\t. 0 < t \\ t < t0 \\ lorenz.flow0 x t \\ lorenz_S ` P\"\n by auto\n have [simp]: \"lorenz.return_time (lorenz_S ` P) x \\ lorenz.existence_ivl0 x\"\n by (auto intro!: that closed_injective_linear_image linear_lorenz_S\n lorenz.return_time_exivl\n inj_lorenz_S)\n have c': \"closed (lorenz_S ` P)\"\n by (auto intro!: that closed_injective_linear_image linear_lorenz_S\n lorenz.return_time_exivl lorenz.return_time_pos\n inj_lorenz_S)\n show ?thesis\n using f(1-4)\n using lorenz.return_time_returns[OF that(1) c']\n apply (intro lorenz.return_time_eqI)\n apply (auto intro!: that closed_injective_linear_image linear_lorenz_S\n lorenz.return_time_exivl lorenz.return_time_pos c'\n inj_lorenz_S)\n subgoal premises prems for a b c d e f g\n proof -\n have [simp]: \"a \\ lorenz.existence_ivl0 x\"\n using _ that(1)\n apply (rule lorenz.less_return_time_imp_exivl)\n using prems that(2) c'\n by auto\n have \"lorenz.return_time (lorenz_S ` P) x \\ a\"\n apply (rule lorenz.return_time_le)\n using prems\n apply (auto intro!: that closed_injective_linear_image linear_lorenz_S\n lorenz.return_time_exivl lorenz.return_time_pos c'\n inj_lorenz_S)\n apply (rule image_eqI)\n apply (rule lorenz_S_idem[symmetric])\n by auto\n then show ?thesis using prems\n by simp\n qed\n done\nqed\n\nlemma lorenz_S_poincare_map:\n \"lorenz.poincare_map P (lorenz_S x) = lorenz_S (lorenz.poincare_map (lorenz_S ` P) x)\"\n if \"x returns_to (lorenz_S ` P)\" \"closed P\"\n using that\n unfolding lorenz.poincare_map_def\n apply (auto simp: lorenz_S_return_time)\n apply (subst lorenz_S)\n by (auto intro!: lorenz.return_time_exivl that\n closed_injective_linear_image linear_lorenz_S inj_lorenz_S)\n\nlemma [continuous_intros]: \"isCont (lorenz_S::_\\R3) x\"\n \"continuous_on (G::R3 set) lorenz_S\"\n by (auto simp:lorenz_S_def[abs_def] split_beta' continuous_intros)\n\nlemma filtermap_lorenz_S_le: \"filtermap lorenz_S (at x within lorenz_S ` P) \\(at (lorenz_S x::R3) within P)\"\\ \\TODO: generalize!\\\n unfolding at_within_def\n apply (auto simp: intro!: antisym filtermap_inf[le] filtermap_inf[ge])\n apply (rule inf.coboundedI1)\n apply (subst filtermap_nhds_open_map)\n apply (auto simp: intro!: invariance_of_domain inj_lorenz_S continuous_intros)\n apply (rule inf.coboundedI2)\n apply (auto simp: image_image )\n apply (auto simp: lorenz_S_def split_beta')[]\n done\n\nlemma filtermap_lorenz_S_eq: \"filtermap lorenz_S (at (x::R3) within lorenz_S ` P) = (at (lorenz_S x::R3) within P)\"\n apply (rule antisym)\n using filtermap_lorenz_S_le[of \"x\" P]\n apply simp\n subgoal\n proof -\n have \"filtermap lorenz_S (at (lorenz_S x) within P) \\\n filtermap lorenz_S (filtermap lorenz_S (at x within lorenz_S ` P))\"\n using filtermap_lorenz_S_le[of \"lorenz_S x\" \"lorenz_S ` P\"]\n by (auto simp: image_image filtermap_filtermap)\n then show ?thesis\n apply (subst (asm) filtermap_mono_strong)\n by (auto simp: inj_lorenz_S)\n qed\n done\n\nlemma norm_lorenz_S[simp]: \"norm (lorenz_S x) = norm x\"\n by (auto simp: lorenz_S_def norm_prod_def split_beta')\n\nlemma bl_lorenz_S: \"bounded_linear (lorenz_S)\"\n by unfold_locales (auto simp: lorenz_S_def norm_prod_def intro!: exI[where x=1])\n\nlemma filtermap_lorenz_S_eq_bot[simp]:\n \"filtermap (lorenz_S::R3\\_) F = bot \\ F = bot\"\n apply (auto simp: )\n apply (subst (asm) filtermap_bot[symmetric])\n apply (subst (asm) filtermap_eq_strong)\n by (auto simp: inj_lorenz_S)\n\nlemma netlimit_filtermap[simp]:\n \"at x within X \\ bot \\ netlimit (filtermap lorenz_S (at x within X)) = lorenz_S (x::R3)\"\n apply (rule tendsto_Lim)\n unfolding filterlim_filtermap\n apply simp\n by (auto intro!: tendsto_eq_intros simp: split_beta' lorenz_S_def[abs_def])\n\nlemma lorenz_S_halfspace [simp]: \"lorenz_S ` \\\\<^sub>l\\<^sub>e = \\\\<^sub>l\\<^sub>e\"\n apply (auto simp: \\\\<^sub>l\\<^sub>e_def lorenz_S_def[abs_def])\n apply (rule image_eqI)\n apply auto\n apply (rule sym)\n apply (rule minus_minus)\n apply (rule minus_minus[symmetric])\n done\n\nlemma closure_Sigma_le_eq: \"closure \\\\<^sub>l\\<^sub>e = \\\\<^sub>l\\<^sub>e\"\nproof (rule closure_closed)\n have \"\\\\<^sub>l\\<^sub>e = {x. x \\ (0, 0, 1) \\ 27}\"\n by (auto simp: \\\\<^sub>l\\<^sub>e_def )\n also have \"closed \\\"\n by (rule closed_halfspace_component_le)\n finally show \"closed \\\\<^sub>l\\<^sub>e\" .\nqed\n\nlemma closure_Sigma_le[simp]: \"closure (\\\\<^sub>l\\<^sub>e - {x}) = \\\\<^sub>l\\<^sub>e\"\nproof (cases \"x \\ \\\\<^sub>l\\<^sub>e\")\n case that: True\n have \"closure \\\\<^sub>l\\<^sub>e \\ closure (insert x (\\\\<^sub>l\\<^sub>e - {x}))\" by (rule closure_mono) auto\n also have \"\\ = insert x (closure (\\\\<^sub>l\\<^sub>e - {x}))\"\n apply (subst closure_insert) by simp\n also\n have \"x \\ closure (\\\\<^sub>l\\<^sub>e - {x})\"\n apply (rule closed_sequentially[where f=\"\\n. x - (0, 0, inverse (Suc n))\"])\n apply (rule closed_closure)\n subgoal\n apply (auto simp: ) apply (rule subsetD) apply (rule closure_subset)\n using that\n apply (auto simp: \\\\<^sub>l\\<^sub>e_def prod_eq_iff)\n apply (rule order_trans)\n apply (rule diff_right_mono)\n apply (assumption)\n apply simp\n done\n subgoal\n apply (rule tendsto_eq_intros)\n apply (rule tendsto_intros)\n apply (rule tendsto_intros)\n apply (rule tendsto_intros)\n apply (rule tendsto_intros)\n apply (rule tendsto_intros)\n apply (rule LIMSEQ_inverse_real_of_nat)\n by (auto simp: prod_eq_iff)\n done\n then have \"insert x (closure (\\\\<^sub>l\\<^sub>e - {x})) \\ closure (\\\\<^sub>l\\<^sub>e - {x})\"\n by auto\n finally have \"closure \\\\<^sub>l\\<^sub>e \\ closure (\\\\<^sub>l\\<^sub>e - {x})\" .\n moreover\n have \"closure (\\\\<^sub>l\\<^sub>e - {x}) \\ closure (\\\\<^sub>l\\<^sub>e)\"\n by (rule closure_mono) auto\n ultimately have \"closure (\\\\<^sub>l\\<^sub>e - {x}) = closure (\\\\<^sub>l\\<^sub>e)\"\n by simp\n also have \"\\ = \\\\<^sub>l\\<^sub>e\"\n by (rule closure_Sigma_le_eq)\n finally show ?thesis .\nnext\n case False\n then show ?thesis\n apply simp\n apply (rule closure_Sigma_le_eq)\n done\nqed\n\nlemma lorenz_S_return_time_has_derivative:\n assumes \"(lorenz.return_time \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e)\"\n and \"lorenz.returns_to \\ x\" and \"x \\ \\\\<^sub>l\\<^sub>e\"\n shows \"(lorenz.return_time \\ has_derivative D o lorenz_S) (at (lorenz_S x) within \\\\<^sub>l\\<^sub>e)\"\nproof -\n have [simp]: \"\\trivial_limit (at x within \\\\<^sub>l\\<^sub>e)\"\n unfolding at_within_eq_bot_iff\n using assms\n by simp\n interpret bounded_linear \"lorenz_S::R3\\_\" by (rule bl_lorenz_S)\n have \"\\\\<^sub>F x in at x within \\\\<^sub>l\\<^sub>e. (x::R3) returns_to \\\"\n by (blast intro: lorenz.eventually_returns_to_continuousI has_derivative_continuous assms)\n then have \"\\\\<^sub>F y in at x within \\\\<^sub>l\\<^sub>e.\n inverse (norm (y - x)) * (lorenz.return_time \\ y - lorenz.return_time \\ x - D (y - x))\n = inverse (norm (lorenz_S y - lorenz_S x)) *\n (lorenz.return_time \\ (lorenz_S y) - lorenz.return_time \\ (lorenz_S x) - D (y - x))\"\n by eventually_elim (auto simp: lorenz_S_return_time assms diff[symmetric])\n then show ?thesis\n using assms\n apply (subst filtermap_lorenz_S_eq[symmetric])\n apply (auto simp: has_derivative_def filterlim_filtermap)\n unfolding o_def\n apply (rule bounded_linear_compose, assumption, rule bl_lorenz_S)\n unfolding diff lorenz_S_idem\n apply (auto simp: Lim_ident_at)\n apply (blast intro: Lim_transform_eventually)\n done\nqed\n\nlemma lorenz_S_return_time_differentiable:\n \"lorenz.return_time \\ differentiable at (lorenz_S x) within \\\\<^sub>l\\<^sub>e\"\n if \"lorenz.return_time \\ differentiable at x within \\\\<^sub>l\\<^sub>e\"\n \"lorenz.returns_to \\ x\" \"x \\ \\\\<^sub>l\\<^sub>e\"\nproof -\n from that obtain D where \"(lorenz.return_time \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e)\"\n by (auto simp: differentiable_def)\n then have \"(lorenz.return_time \\ has_derivative D o lorenz_S) (at (lorenz_S x) within \\\\<^sub>l\\<^sub>e)\"\n by (rule lorenz_S_return_time_has_derivative) fact+\n then show ?thesis\n by (auto simp: differentiable_def)\nqed\n\nlemma lorenz_S_has_derivative:\n \"(lorenz_S has_derivative lorenz_S) (at (x::R3) within X)\"\n by (auto simp: lorenz_S_def[abs_def] split_beta' intro!: derivative_eq_intros)\n\nlemma lorenz_S_poincare_map_has_derivative:\n assumes \"(lorenz.poincare_map \\ has_derivative D) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"(lorenz.return_time \\ has_derivative Dr) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"lorenz.returns_to \\ x\" \"x \\ \\\\<^sub>l\\<^sub>e\"\n shows \"(lorenz.poincare_map \\ has_derivative lorenz_S o D o lorenz_S) (at (lorenz_S x) within \\\\<^sub>l\\<^sub>e)\"\nproof -\n have [simp]: \"\\trivial_limit (at x within \\\\<^sub>l\\<^sub>e)\"\n unfolding at_within_eq_bot_iff\n using assms\n by simp\n interpret bounded_linear \"lorenz_S::R3\\_\" by (rule bl_lorenz_S)\n have \"\\\\<^sub>F x in at x within \\\\<^sub>l\\<^sub>e. (x::R3) returns_to \\\"\n by (blast intro: lorenz.eventually_returns_to_continuousI has_derivative_continuous assms)\n then have \"\\\\<^sub>F y in at x within \\\\<^sub>l\\<^sub>e.\n (lorenz_S (lorenz.poincare_map \\ y) - lorenz_S (lorenz.poincare_map \\ x) - lorenz_S (D (y - x))) /\\<^sub>R\n norm (y - x) \n = (lorenz.poincare_map \\ (lorenz_S y) - lorenz.poincare_map \\ (lorenz_S x) - lorenz_S (D (y - x))) /\\<^sub>R\n norm (lorenz_S y - lorenz_S x)\"\n by eventually_elim (auto simp: lorenz_S_return_time lorenz_S_poincare_map assms diff[symmetric])\n then show ?thesis\n using has_derivative_compose[OF assms(1) lorenz_S_has_derivative] assms\n apply (subst filtermap_lorenz_S_eq[symmetric])\n apply (auto simp: has_derivative_def filterlim_filtermap)\n unfolding o_def\n apply (rule bounded_linear_compose, rule bl_lorenz_S)\n apply (rule bounded_linear_compose, assumption, rule bl_lorenz_S)\n unfolding diff lorenz_S_idem\n apply (auto simp: Lim_ident_at)\n apply (blast intro: Lim_transform_eventually)\n done\nqed\n\nlemma [simp]: \"expansion (mirror_result res) = expansion res\"\n by (cases res) auto\n\nlemma lorenz_S_on_plane: \"lorenz_S (dx, dy, 0::real) = - (dx, dy, 0)\"\n by (auto simp: lorenz_S_def )\n\nlemma mirror_result_idem[simp]: \"mirror_result (mirror_result x) = x\"\n by (cases x) (auto simp: mirror_result_def)\n\nlemma mirror_in_set: \"x \\ set results \\ mirror_result x \\ set results\"\n by (auto simp: results_def symmetrize_def)\n\nlemma mirror_result_in:\n \"mirror_result res2 \\ return_of_res results (mirror_result res)\"\n if \"res2 \\ return_of_res results res\"\nproof -\n from that have \"res2 \\ set results\" by (rule in_return_of_resD)\n from mirror_in_set[OF this] have \"mirror_result res2 \\ set results\" .\n then show ?thesis\n apply (cases res2; cases res)\n using that\n by (auto simp: return_of_res_def get_results_def)\nqed\n\nlemma in_source_of_res_mirrorI:\n \"(x::R3) \\ source_of_res (mirror_result (r))\" if \"lorenz_S x \\ source_of_res r\"\n using that\n apply (cases r; cases x)\n by (auto simp: source_of_res_def set_of_ivl_def ivl_of_res_def lorenz_S_def\n less_eq_prod_def ivl_of_resultrect_def)\n\nlemma conefield_of_res_mirror_simp[simp]: \"conefield_of_res (mirror_result res2) = conefield_of_res res2\"\n by (cases res2) (auto simp: conefield_of_res_def)\n\nlemma lorenz_minus_planeI: \"lorenz_S (- x) = x\" if \"snd (snd (x::R3)) = 0\"\n using that\n by (auto simp: lorenz_S_def split_beta' prod_eq_iff)\n\nlemma preexpansion_mirror_result[simp]: \"preexpansion (mirror_result res2) = preexpansion res2\"\n by (cases res2) (auto simp: )\n\nlemma lorenz_S_tendsto_0I: \"(lorenz.flow0 (lorenz_S x) \\ 0) at_top\"\n if \"{0..} \\ lorenz.existence_ivl0 x\" \"(lorenz.flow0 x \\ 0) at_top\"\nproof (rule Lim_transform_eventually)\n have \"\\\\<^sub>F s in at_top. (s::real) \\ 0\"\n using eventually_ge_at_top by blast\n then show \"\\\\<^sub>F s in at_top. lorenz_S (lorenz.flow0 x s) = lorenz.flow0 (lorenz_S x) s\"\n by eventually_elim (use that in auto)\n show \"((\\s. lorenz_S (lorenz.flow0 x s)) \\ 0) at_top\"\n unfolding Zfun_def[symmetric] by (rule bounded_linear.tendsto_zero[OF bl_lorenz_S that(2)])\nqed\n\nlemma lorenz_S_tendsto_0_iff:\n \"(lorenz.flow0 (lorenz_S x) \\ 0) at_top \\ (lorenz.flow0 x \\ 0) at_top\"\n if \"{0..} \\ lorenz.existence_ivl0 x\"\n using lorenz_S_tendsto_0I[of x, OF that] lorenz_S_tendsto_0I[of \"lorenz_S x\"] that\n by auto\n\nlemma lorenz_S_eq_iff[simp]: \"lorenz_S y = lorenz_S x \\ y = x\" for x y::\"real*real*real\"\n by (auto simp: lorenz_S_def split: prod.splits)\n\nlemma lorenz_S_\\: \"lorenz_S x \\ \\ \\ x \\ \\\"\n apply (auto simp: \\_def lorenz_S_tendsto_0_iff )\n subgoal for t\n apply (auto simp: dest!: spec[where x=t])\n apply (subst (asm) lorenz_S) apply auto\n apply (subst (asm) (2) lorenz_S_image_Sigma[symmetric])\n by (simp del: lorenz_S_image_Sigma)\n subgoal for t\n apply (auto simp: dest!: spec[where x=t])\n apply (subst (asm) lorenz_S) apply auto\n apply (subst (asm) lorenz_S_image_Sigma[symmetric])\n apply (auto simp del: lorenz_S_image_Sigma)\n done\n done\n\nlemma sourcei_of_res_mirror: \"(x, y, z) \\ sourcei_of_res (mirror_result res) \\\n (-x, -y, z) \\ sourcei_of_res res\"\n using lorenz_S_\\[of \"(x, y, z)\"]\n by (cases res)\n (auto simp: source_of_res_def sourcei_of_res_def ivl_of_res_def ivl_of_resultrect_def\n set_of_ivl_def \\\\<^sub>i_def lorenz_S_def)\n\nlemma c1i_of_res_mirror: \"((x, y, z), dx, dy, dz) \\ c1i_of_res (mirror_result res) \\\n ((-x, -y, z), dx, dy, dz) \\ c1i_of_res res\"\n by (auto simp: c1i_of_res_def sourcei_of_res_mirror)\n\nlemma correct_res_mirror_result:\n \"correct_res (mirror_result res)\" if \"correct_res res\"\n unfolding correct_res_def\nproof (clarsimp simp add: c1i_of_res_mirror, goal_cases)\n case (1 x y z dx dy dz)\n then have 1: \"(lorenz_S (x, y, z), dx, dy, dz) \\ c1i_of_res res\"\n by (auto simp: lorenz_S_def)\n from that[unfolded correct_res_def, rule_format, OF 1, simplified]\n have \"(lorenz_S (x, y, z)) \\ plane_of (Sctn (0, 0, 1) 27)\"\n \"(dx, dy, dz) \\ plane_of (Sctn (0, 0, 1) 0)\"\n by auto\n then have plane: \"(x, y, z) \\ plane_of (Sctn (0, 0, 1) 27)\"\n \"(dx, dy, dz) \\ plane_of (Sctn (0, 0, 1) 0)\"\n by (auto simp: plane_of_def lorenz_S_def)\n then show ?case\n proof (clarsimp, goal_cases)\n case mem: 1\n with that[unfolded correct_res_def, rule_format, OF 1, simplified]\n obtain D res2 where D:\n \"lorenz_S (x, y, z) returns_to \\\"\n \"lorenz.return_time \\ differentiable at (lorenz_S (x, y, z)) within \\\\<^sub>l\\<^sub>e\"\n \"(lorenz.poincare_map \\ has_derivative D) (at (lorenz_S (x, y, z)) within \\\\<^sub>l\\<^sub>e)\"\n \"expansion res * norm (dx, dy, dz) \\ norm (D (dx, dy, dz))\"\n \"res2 \\ return_of_res results res\"\n \"(lorenz.poincare_map \\ (lorenz_S (x, y, z)), D (dx, dy, dz)) \\ c1_of_res res2\"\n \"preexpansion res2 * norm (dx, dy, dz) \\ norm (D (dx, dy, dz))\"\n by auto\n from plane have S_le: \"lorenz_S (x, y, z) \\ \\\\<^sub>l\\<^sub>e\"\n by (auto simp: \\\\<^sub>l\\<^sub>e_def plane_of_def lorenz_S_def)\n interpret linear D by (rule has_derivative_linear; fact)\n\n have ret: \"(x, y, z) returns_to \\\" using D(1) lorenz_S_returns_to by simp\n moreover have \"lorenz.return_time \\ differentiable at (x, y, z) within \\\\<^sub>l\\<^sub>e\"\n using lorenz_S_return_time_differentiable[OF D(2) D(1) S_le] by auto\n moreover from D obtain Dr where Dr: \"(lorenz.return_time \\ has_derivative Dr) (at (lorenz_S (x, y, z)) within \\\\<^sub>l\\<^sub>e)\"\n by (auto simp: differentiable_def)\n let ?D = \"lorenz_S \\ D \\ lorenz_S\"\n have \"(lorenz.poincare_map \\ has_derivative ?D) (at (x, y, z) within \\\\<^sub>l\\<^sub>e)\"\n using lorenz_S_poincare_map_has_derivative[OF D(3) Dr D(1) S_le]\n by auto\n moreover\n from plane have [simp]: \"dz = 0\" by (auto simp: plane_of_def)\n have \"expansion (mirror_result res) * norm (dx, dy, dz) \\ norm (?D (dx, dy, dz))\"\n using D(4) apply (auto simp: )\n unfolding lorenz_S_on_plane neg\n by simp\n moreover have \\mirror_result res2 \\ return_of_res results (mirror_result res)\\\n using D(5) by (rule mirror_result_in)\n moreover have \"(lorenz.poincare_map \\ (x, y, z), ?D (dx, dy, dz)) \\ c1_of_res (mirror_result res2)\"\n using D(6) apply (subst (asm) lorenz_S_poincare_map)\n apply auto apply fact\n apply (auto simp: c1_of_res_def in_source_of_res_mirrorI)\n unfolding lorenz_S_on_plane neg\n apply (subst lorenz_minus_planeI)\n apply (auto simp: conefield_of_res_def conefield_alt_def cone_hull_expl\n in_segment tangent_of_deg_def)\n done\n moreover have \"preexpansion (mirror_result res2) * norm (dx, dy, dz) \\ norm (?D (dx, dy, dz))\"\n using D(7) apply (auto simp: )\n unfolding lorenz_S_on_plane neg\n by simp\n ultimately show ?case\n by (force intro!: exI[where x = ?D] bexI[where x=\"mirror_result res2\"])\n qed\nqed\n\nlemma reduce_lorenz_symmetry: \"Ball (set results) correct_res\"\n if \"Ball (set coarse_results) correct_res\"\n using that\n by (auto simp: results_def symmetrize_def intro!: correct_res_mirror_result)\n\nend\n\nsubsection \\Code Generation\\\n\ndefinition [code_abbrev]: \"my_divide_integer (i::integer) (j::integer) = i div j\"\ncode_printing constant my_divide_integer \\ (SML) \"IntInf.div/ (_,/ _)\"\n\nsubsection \\Tuning code equations\\\n\ndefinition mult_twopow_int::\"int \\ int \\ int\" where \"mult_twopow_int x n = x * (power_int 2 n)\"\ndefinition div_twopow_int :: \"int \\ int \\ int\" where \"div_twopow_int x n = x div (power_int 2 n)\"\n\ncontext includes integer.lifting begin\n\nlift_definition mult_twopow_integer :: \"integer \\ integer \\ integer\" is mult_twopow_int .\nlift_definition div_twopow_integer :: \"integer \\ integer \\ integer\" is div_twopow_int .\n\nend\n\nlemma compute_float_round_down[code]:\n \"float_round_down prec (Float m e) =\n (let d = bitlen \\m\\ - int prec - 1 in\n if 0 < d then Float (div_twopow_int m d) (e + d)\n else Float m e)\"\n including float.lifting\n using Float.compute_float_down[of \"Suc prec - bitlen \\m\\ - e\" m e, symmetric]\n by transfer\n (auto simp add: field_simps abs_mult log_mult bitlen_alt_def truncate_down_def\n div_twopow_int_def power_int_def\n cong del: if_weak_cong)\n\nlemma compute_float_plus_down[code]:\n fixes p::nat and m1 e1 m2 e2::int\n shows \"float_plus_down p (Float m1 e1) (Float m2 e2) =\n (if m1 = 0 then float_round_down p (Float m2 e2)\n else if m2 = 0 then float_round_down p (Float m1 e1)\n else\n (if e1 \\ e2 then\n (let k1 = Suc p - nat (bitlen \\m1\\) in\n if bitlen \\m2\\ > e1 - e2 - k1 - 2\n then float_round_down p ((Float m1 e1) + (Float m2 e2))\n else float_round_down p (Float (mult_twopow_int m1 (int k1 + 2) + sgn m2) (e1 - int k1 - 2)))\n else float_plus_down p (Float m2 e2) (Float m1 e1)))\"\n using Float.compute_float_plus_down[of p m1 e1 m2 e2]\n by (auto simp: mult_twopow_int_def Let_def power_int_def nat_add_distrib)\n\nsubsection \\Codegen\\\n\ndefinition \"is_dRETURN_True x = (case x of dRETURN b \\ b | _ \\ False)\"\ndefinition \"file_output_option s f =\n (case s of None \\ f None\n | Some s \\ file_output (String.implode s) (\\pf. f (Some pf)))\"\n\ndefinition \"check_line_lookup_out s m0 n0 c1 i =\n is_dRETURN_True (file_output_option s (\\pf. check_line_core_impl pf m0 n0 c1 i))\"\n\nfun alternating where \"alternating [] xs = xs\"\n | \"alternating xs [] = xs\"\n | \"alternating (x#xs) (y#ys) = x#y#alternating xs ys\"\n\ndefinition \"ordered_lines = alternating (rev [0..<222]) ([222..<400])\"\n \\ \\the hard ones ``first'', potentially useless due to nondeterministic \\Parallel.map\\\\\n\ndefinition \"parallel_check filenameo m n c1 ns =\n Parallel.forall (\\i.\n let\n _ = print (String.implode (''# Starting '' @ show i @ ''\\''));\n b =\n check_line_lookup_out (map_option (\\f. f @ show i) filenameo)\n (Some m) (Some n) c1 i;\n _ = if b\n then print (String.implode (''# Success: '' @ show i @ ''\\''))\n else print (String.implode (''# Failed: '' @ show i @ ''\\''))\n in b\n ) ns\"\n\nML \\val check_line = @{computation_check\n terms:\n Trueprop\n parallel_check\n ordered_lines\n check_line_core_impl\n check_line_lookup_out\n\n (* bool *)\n True False\n\n (* num *)\n Num.One Num.Bit0 Num.Bit1\n\n (* nat *)\n Suc \"0::nat\" \"1::nat\" \"numeral::num\\nat\"\n\n (* int / integer*)\n \"numeral::num\\int\"\n \"numeral::num\\integer\"\n \"uminus::_\\int\"\n \"uminus::_\\integer\"\n int_of_integer integer_of_int\n \"0::int\"\n \"1::int\"\n\n (* Pairs *)\n \"Pair::_ \\ _\\ (real list \\ real list)\"\n \"Pair::_\\_\\(real list \\ real list) \\ real list sctn\"\n \"Pair::_\\_\\((real list \\ real list) \\ real list sctn) list \\ real aform reach_options\"\n\n (* Option *)\n \"None::nat option\"\n \"Some::_\\nat option\"\n \"None::string option\"\n \"Some::_\\string option\"\n\n (* Lists *)\n \"Nil::real list\"\n \"Cons::_\\_\\real list\"\n \"Nil::nat list\"\n \"Cons::_\\_\\nat list\"\n \"Nil::real aform list\"\n \"Cons::_\\_\\real aform list\"\n \"Nil::((real list \\ real list) \\ real list sctn) list\"\n \"Cons::_\\_\\((real list \\ real list) \\ real list sctn) list\"\n \"Nil::(((real list \\ real list) \\ real list sctn) list \\ real aform reach_options)list\"\n \"Cons::_\\_\\(((real list \\ real list) \\ real list sctn) list \\ real aform reach_options)list\"\n\n (* String *)\n String.Char\n String.implode \"Cons::char \\ char list \\ char list\" \"Nil::char list\"\n\n (* float *)\n Float float_of_int float_of_nat\n\n (* real *)\n \"numeral::num\\real\" \"real_of_float\" \"(/)::real\\real\\real\" \"uminus::real\\_\"\n real_divl real_divr\n real_of_int\n\n (* section *)\n \"Sctn::_\\_\\real list sctn\"\n\n (* aform *)\n \"aforms_of_ivls::_\\_\\real aform list\"\n\n (* input *)\n coarse_results\n\n (* modes *)\n xsec xsec' ysec ysec' zsec zsec' zbucket\n lookup_mode\n ro\n ro_outer\n mode_outer\n\n (* unit *)\n \"()\"\n\n }\\\n\n\nlemma is_dRETURN_True_iff[simp]: \"is_dRETURN_True x \\ (x = dRETURN True)\"\n by (auto simp: is_dRETURN_True_def split: dres.splits)\n\nlemma check_line_core_impl_True:\n \"check_line_core_impl pfo m n True i = dRETURN True \\ NF \\ correct_res (results ! i)\"\n apply (cases \"check_line_core_impl pfo m n True i\")\n using check_line_core_correct[of pfo m n i]\n check_line_core_impl.refine[of pfo pfo True True i i m m n n]\n apply (auto simp: nres_rel_def)\n apply (drule order_trans[where y=\"check_line_core pfo m n True i\"])\n apply assumption\n by auto\n\nlemma check_line_lookup_out: \"correct_res (results ! i)\"\n if \"\\s m n. check_line_lookup_out s m n True i\" NF\n using that\n by (auto simp: check_line_lookup_out_def file_output_iff check_line_core_impl_True\n file_output_option_def split: dres.splits option.splits)\n\ndefinition \"check_lines c1 ns = list_all (\\i. \\s m n. check_line_lookup_out s m n c1 i) ns\"\n\nlemma check_linesI:\n \"check_lines c1 ns\"\n if \"parallel_check s m n c1 ns\"\n using that\n by (auto simp: parallel_check_def check_lines_def list_all_iff)\n\nsubsection \\Automate generation of lemmas\\\n\nlemma length_coarse_results[simp]: \"length coarse_results = 400\"\n by (simp add: coarse_results_def)\n\nlemma correct_res_coarse_resultsI:\n \"correct_res (results ! i) \\ i < 400 \\ correct_res (coarse_results ! i)\"\n by (auto simp: results_def symmetrize_def nth_append)\n\nlemma Ball_coarseI: \"Ball (set coarse_results) correct_res\"\n if NF \"check_lines True xs\" \"set xs = {..<400}\"\n using that\n by (force simp: check_lines_def list_all_iff in_set_conv_nth\n intro!: correct_res_coarse_resultsI check_line_lookup_out)\n\nML \\map_option (using_master_directory_term @{context}) (SOME \"a\")\\\nML \\\nfun mk_optionT ty = Type (@{type_name \"option\"}, [ty])\nfun mk_None ty = Const (@{const_name \"None\"}, mk_optionT ty)\nfun mk_Some ty x = Const (@{const_name \"Some\"}, ty --> mk_optionT ty) $ x\nfun mk_option ty _ NONE = mk_None ty\n | mk_option ty f (SOME x) = mk_Some ty (f x)\nfun check_lines_tac' s m n ctxt =\n resolve_tac ctxt\n [Thm.instantiate ([],\n [(\"s\", @{typ \"string option\"}, mk_option @{typ string} (using_master_directory_term ctxt) s),\n (\"m\", @{typ nat}, HOLogic.mk_nat m),\n (\"n\", @{typ nat}, HOLogic.mk_nat n)]\n |> map (fn (s, ty, t) => (((s, 0), ty), Thm.cterm_of ctxt t)))\n @{thm check_linesI}]\n THEN' CONVERSION (check_line ctxt)\n THEN' resolve_tac ctxt @{thms TrueI}\n\\\n\nmethod_setup parallel_check = \\\n Scan.lift (Parse.maybe Parse.string) -- Scan.lift Parse.nat -- Scan.lift Parse.nat\n >> (fn ((s, m), n) => fn ctxt => SIMPLE_METHOD' (check_lines_tac' s m n ctxt))\n\\\n\nlemma lorenz_bounds_lemma_asym:\n \"\\x \\ N - \\. x returns_to \\\"\n \"R ` (N - \\) \\ N\"\n \"\\x \\ N - \\. (R has_derivative DR x) (at x within \\\\<^sub>l\\<^sub>e)\"\n \"\\x \\ N - \\. DR x ` \\ x \\ \\ (R x)\"\n \"\\x \\ N - \\. \\c \\ \\ x. norm (DR x c) \\ \\ x * norm c\"\n \"\\x \\ N - \\. \\c \\ \\ x. norm (DR x c) \\ \\\\<^sub>p (R x) * norm c\"\n if NF \"Ball (set results) correct_res\"\n using that\n by (auto intro!: lorenz_bounds_lemma)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Ex/Lorenz/Lorenz_Approximation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.29206267891059184}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntext \\A simple proof method for rewriting Simpl programs under a predicate which\n is preserved by semantic equivalence.\\\n\ntheory Simpl_Rewrite\nimports\n \"Simpl-VCG.Vcg\"\n \"Lib.Eisbach_Methods\"\n \"Lib.Apply_Debug\"\nbegin\n\ntext \\Definitions and lemmas for reasoning about equivalence of Simpl programs.\\\n\nnamed_theorems C_simp\nnamed_theorems C_simp_pre\nnamed_theorems C_simp_simps\nnamed_theorems C_simp_throws\n\nlocale simpl_rewrite_base =\n fixes \\ :: \"'p \\ ('s,'p,'f) com option\"\nbegin\n\ntext \\Semantic equivalence of two Simpl programs.\n\n Since we quantify over all possible states, this is somewhat stronger than some other\n notions of semantic equivalence. In particular, @{text ceqv} takes particular begin and\n end states as arguments, and is only defined for @{term Normal} begin and end states.\\\n\ndefinition\n \"com_eq t c c' \\ t \\ (\\s s'. \\ \\ \\c,s\\ \\ s' \\ \\ \\ \\c',s\\ \\ s')\"\n\ntext \\@{text com_eq} assertions may be guarded. Guards enable simple conditional rewriting.\\\n\nlemma com_eq_weaken_guard:\n \"com_eq t c c' \\ (t' \\ t) \\ com_eq t' c c'\"\n by (simp add: com_eq_def)\n\nlemma com_eq_guard_False:\n \"com_eq False c c'\"\n by (simp add: com_eq_def)\n\ntext \\Most @{text com_eq} simplification rules will be unguarded, however.\\\n\nabbreviation\n \"com_equiv \\ com_eq True\"\n\nnotation com_equiv (infix \"\\\" 10)\n\ntext \\@{term \"com_eq\"} is an equivalence relation.\\\n\nlemma com_eq_refl:\n \"c \\ c\"\n by (auto simp: com_eq_def)\n\nlemma com_eq_sym:\n \"c \\ c' \\ c' \\ c\"\n by (auto simp: com_eq_def)\n\nlemma com_eq_trans:\n \"\\ c \\ c'; c' \\ c'' \\ \\ c \\ c''\"\n by (auto simp add: com_eq_def)\n\ntext \\Structural decomposition of Simpl programs under @{term \"com_eq\"}.\\\n\nlemma com_eq_Seq:\n \"\\ c1 \\ c1'; c2 \\ c2' \\ \\ c1;;c2 \\ c1';;c2'\"\n unfolding com_eq_def by (auto intro: exec.Seq elim!: exec_elim_cases)\n\nlemma com_eq_Cond:\n \"\\ c1 \\ c1'; c2 \\ c2' \\ \\ Cond b c1 c2 \\ Cond b c1' c2'\"\n unfolding com_eq_def by (auto intro: exec.CondTrue exec.CondFalse elim!: exec_elim_cases)\n\nlemma com_eq_While':\n assumes eq: \"c \\ c'\"\n assumes W: \"\\ \\ \\While b c,s\\ \\ s'\"\n shows \"\\ \\ \\While b c',s\\ \\ s'\"\n using W\n proof (induct \"While b c\" s s')\n case WhileTrue\n with eq show ?case unfolding com_eq_def by (auto elim: exec.WhileTrue)\n next\n case WhileFalse\n then show ?case by (rule exec.WhileFalse)\n qed auto\n\nlemma com_eq_While:\n \"c \\ c' \\ While b c \\ While b c'\"\n by (subst com_eq_def) (auto intro: com_eq_While' com_eq_While' [OF com_eq_sym])\n\nlemma com_eq_whileAnno:\n \"c \\ c' \\ whileAnno b I V c \\ whileAnno b I V c'\"\n by (clarsimp simp: whileAnno_def elim!: com_eq_While)\n\nlemma com_eq_Guard:\n \"c \\ c' \\ Guard f b c \\ Guard f b c'\"\n by (auto simp: com_eq_def intro: exec.Guard exec.GuardFault elim!: exec_elim_cases)\n\nlemma com_eq_Catch:\n \"\\ c \\ c'; h \\ h' \\ \\ Catch c h \\ Catch c' h'\"\n by (auto simp: com_eq_def intro: exec.CatchMiss exec.CatchMatch elim!: exec_elim_cases)\n\nlemmas com_eq_intros =\n com_eq_Seq com_eq_Cond com_eq_While com_eq_whileAnno com_eq_Guard com_eq_Catch\n\ntext \\Simpl @{term Seq} is associative under @{term com_eq}.\\\n\nlemma com_eq_Seq_assoc_l:\n \"c1;;(c2;;c3) \\ (c1;;c2);;c3\"\n by (clarsimp simp: com_eq_def exec_assoc)\n\nlemma com_eq_Seq_assoc_r:\n \"(c1;;c2);;c3 \\ c1;;(c2;;c3)\"\n by (clarsimp simp: com_eq_def exec_assoc)\n\ntext \\Under @{term com_eq}, some Simpl elements are right-distributive w.r.t. @{term Seq}.\\\n\nlemma com_eq_Cond_distrib_r:\n \"Cond b (c1;;c) (c2;;c) \\ Cond b c1 c2 ;; c\"\n by (auto simp: com_eq_def\n intro: exec.Seq exec.CondTrue exec.CondFalse\n elim!: exec_elim_cases)\n\nlemma com_eq_Guard_distrib_r:\n \"Guard f b (c1;;c2) \\ Guard f b c1 ;; c2\"\n by (auto simp: com_eq_def\n intro: exec.Seq exec.Guard exec.GuardFault\n elim!: exec_elim_cases)\n\ntext \\Simplification rules should be of the form @{term \"com_eq t c c'\"}.\n\n Simplifications added to the @{thm C_simp_pre} set will be performed before\n sub-programs have been simplified. Those added to the @{thm C_simp} set\n will be performed after sub-programs have been simplified.\n\n Conditional simplification rules will only apply if the guard @{term t} can be\n immediately solved by @{method simp}.\\\n\nlemma com_eq_Skip_Seq [C_simp]:\n \"Skip;;c \\ c\"\n apply (clarsimp simp: com_eq_def)\n apply (rule iffI)\n apply (fastforce elim!: exec_elim_cases)\n apply (case_tac s; (simp, (erule exec_elim_cases; simp)?))\n apply (rule exec.Seq, rule exec.Skip, simp)\n done\n\nlemma com_eq_Seq_Skip [C_simp]:\n \"c;;Skip \\ c\"\n apply (clarsimp simp: com_eq_def)\n apply (rule iffI)\n apply (fastforce elim!: exec_elim_cases)\n apply (case_tac s; (simp, (erule exec_elim_cases; simp)?))\n apply (rule exec.Seq, simp)\n apply (case_tac s'; (simp, (erule exec_elim_cases; simp)?))\n apply (rule exec.Skip)\n done\n\nlemma com_eq_Cond_empty [C_simp_pre]:\n \"com_eq (b = {}) (Cond b c1 c2) c2\"\n by (clarsimp simp: com_eq_def, case_tac s, auto intro: exec.CondFalse elim!: exec_elim_cases)\n\nlemma com_eq_Cond_UNIV [C_simp_pre]:\n \"com_eq (b = UNIV) (Cond b c1 c2) c1\"\n by (clarsimp simp: com_eq_def, case_tac s, auto intro: exec.CondTrue elim!: exec_elim_cases)\n\nlemma exec_Cond_cases:\n \"\\s \\ b \\ \\\\ \\c\\<^sub>1,Normal s\\ \\ t; s \\ b \\ \\\\ \\c\\<^sub>2,Normal s\\ \\ t\\ \\\n \\\\ \\Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\"\n by (cases \"s \\ b\") (auto intro: exec.CondTrue exec.CondFalse)\n\nlemma com_eq_Cond_both [C_simp]:\n \"Cond b c c \\ c\"\n by (clarsimp simp: com_eq_def, case_tac s, auto intro: exec_Cond_cases elim!: exec_elim_cases)\n\nlemma com_eq_While_empty [C_simp_pre]:\n \"com_eq (b = {}) (While b c) Skip\"\n by (auto simp: com_eq_def intro: exec.WhileFalse exec.Skip elim!: exec_elim_cases)\n\nlemma com_eq_whileAnno_empty [C_simp_pre]:\n \"com_eq (b = {}) (whileAnno b I V c) Skip\"\n by (simp add: com_eq_While_empty whileAnno_def)\n\nlemma com_eq_Guard_UNIV [C_simp_pre]:\n \"com_eq (b = UNIV) (Guard f b c) c\"\n by (clarsimp simp: com_eq_def, case_tac s, auto intro: exec.Guard elim!: exec_elim_cases)\n\nlemma com_eq_Guard_empty [C_simp_pre]:\n \"com_eq (c \\ Skip \\ b = {}) (Guard f b c) (Guard f {} Skip)\"\n by (clarsimp simp: com_eq_def, case_tac s, auto intro: exec.GuardFault elim!: exec_elim_cases)\n\nlemma com_eq_Catch_Skip [C_simp]:\n \"Catch Skip c \\ Skip\"\n by (auto simp: com_eq_def intro: exec.CatchMiss exec.Skip elim!: exec_elim_cases)\n\nlemma com_eq_Catch_Throw [C_simp]:\n \"Catch Throw c \\ c\"\n by (clarsimp simp: com_eq_def, case_tac s)\n (auto intro: exec.CatchMatch exec.Throw elim!: exec_elim_cases)\n\ntext \\An assertion expressing that a Simpl program never finishes normally.\\\n\ndefinition\n \"never_continues t c \\ t \\ (\\s s'. \\ \\ \\ \\c, Normal s\\ \\ Normal s')\"\n\ntext \\Commands sequenced after a command that @{term never_continues} may be ignored.\\\n\nlemma never_continues_def2:\n \"never_continues t c \\ t \\ (\\r. (c;;r) \\ c)\"\n unfolding atomize_eq never_continues_def com_eq_def\n apply (rule iffI; erule (1) imp_forward; clarsimp)\n apply (rule iffI)\n apply (erule exec_elim_cases; clarsimp)\n apply (match premises in \"\\ \\ \\c, Normal _\\ \\ s'\" for s' \\ \\cases s'\\;\n clarsimp elim!: exec_elim_cases)\n apply (match premises in \"\\ \\ \\c, s\\ \\ s'\" for s s' \\ \\cases s; cases s'\\;\n clarsimp elim!: exec_elim_cases exec.Seq)\n by (fastforce dest!: spec[of _ Throw] elim!: exec_elim_cases)\n\ntext \\Rules for rewriting the arguments of @{term never_continues}.\\\n\nlemma never_continues_weaken_guard:\n \"never_continues t c \\ (t' \\ t) \\ never_continues t' c\"\n by (simp add: never_continues_def)\n\nlemma never_continues_rewrite_com_eq:\n \"c \\ c' \\ never_continues t c \\ never_continues t c'\"\n apply (simp add: never_continues_def2)\n apply (elim imp_forward all_forward, assumption)\n apply (rule com_eq_trans, rule com_eq_Seq, erule com_eq_sym, rule com_eq_refl)\n by (erule com_eq_trans[rotated])\n\ntext \\Rules of the form @{term \"never_continues True c\"} may be added to @{text C_simp_throws}.\\\n\nlemma never_continues_Throw [C_simp_throws]:\n \"never_continues True Throw\"\n by (auto simp: never_continues_def elim: exec_elim_cases)\n\nlemma While_UNIV_helper:\n \"\\ \\ \\c',s\\ \\ s'' \\ c' = While UNIV c \\ s'' = Normal s' \\ False\"\n by (induct rule: exec.induct) auto\n\nlemma never_continues_While_UNIV [C_simp_throws]:\n \"never_continues True (While UNIV c)\"\n by (auto simp: never_continues_def elim: While_UNIV_helper)\n\nlemma never_continues_While_True [C_simp_throws]:\n \"never_continues True (WHILE True DO c OD)\"\n by (simp add: whileAnno_def never_continues_While_UNIV)\n\nlemma never_continues_Guard_False [C_simp_throws]:\n \"never_continues True (Guard f {} c)\"\n by (auto simp: never_continues_def elim: exec_elim_cases)\n\ntext \\Structural decomposition of Simpl programs under @{term never_continues}.\\\n\nlemma never_continues_Seq1:\n \"never_continues t c1 \\ never_continues t (c1;;c2)\"\n apply (clarsimp simp: never_continues_def2)\n apply (frule spec[of _ c2], erule com_eq_trans[rotated, OF com_eq_sym])\n apply (rule com_eq_trans[OF com_eq_Seq_assoc_r])\n by simp\n\nlemma never_continues_Seq2:\n \"never_continues t c2 \\ never_continues t (c1;;c2)\"\n apply (clarsimp simp: never_continues_def2)\n apply (rule com_eq_trans[OF com_eq_Seq_assoc_r])\n apply (rule com_eq_Seq[OF com_eq_refl])\n by simp\n\nlemmas never_continues_Seqs =\n never_continues_Seq1 never_continues_Seq2\n\nlemma never_continues_Cond:\n \"never_continues t1 c1 \\ never_continues t2 c2 \\ never_continues (t1 \\ t2) (Cond b c1 c2)\"\n by (auto simp: never_continues_def elim: exec_elim_cases)\n\nlemma never_continues_Guard:\n \"never_continues t c \\ never_continues t (Guard f b c)\"\n by (auto simp: never_continues_def elim: exec_elim_cases)\n\nlemma never_continues_Catch:\n \"never_continues tc c \\ never_continues th h \\ never_continues (tc \\ th) (Catch c h)\"\n by (auto simp: never_continues_def elim: exec_elim_cases)\n\ntext \\If all else fails...\\\n\nlemma never_continues_False:\n \"never_continues False c\"\n by (simp add: never_continues_def)\n\nend\n\ntext \\One layer of context around a Simpl program.\n\n For example, if the current focus is the first branch of a @{term Cond},\n then the context consists of a constructor @{text CondTC} which indicates\n this is the context, and carries everything but but the focused branch,\n i.e. the condition and the second branch.\n\n The @{text CondFC} and @{text HandlerC} cases each carry an extra bit of\n information, which indicates whether the left-hand branch @{text never_continues}.\n The assumption here is that we always traverse Simpl programs left-to-right.\n @{text Seq2C} does not require an extra bit, because we never enter the second\n command of a @{term Seq} if the first command @{text never_continues}.\\\n\ndatatype ('s,'p,'f) com_ctxt\n = Seq1C \"('s,'p,'f) com\" \\ \\first command of a @{term Seq}\\\n | Seq2C \"('s,'p,'f) com\" \\ \\second command of a @{term Seq}\\\n | CondTC \"'s bexp\" \"('s,'p,'f) com\" \\ \\first branch of a @{term Cond}\\\n | CondFC \"'s bexp\" \"('s,'p,'f) com\" bool \\ \\second branch of a @{term Cond}\\\n | WhileC \"'s bexp\" \\ \\body of a @{term While}\\\n | WhileAnnoC \"'s bexp\" \"'s assn\" \"('s \\ 's) assn\" \\ \\body of a @{term whileAnno}\\\n | GuardC \"'f\" \"'s bexp\" \\ \\body of a @{term Guard}\\\n | TryC \"('s,'p,'f) com\" \\ \\body of a @{term Catch}\\\n | HandlerC \"('s,'p,'f) com\" bool \\ \\handler of a @{term Catch}\\\n\ntext \\Rewrite Simpl programs under a predicate @{term P} which is preserved by @{term com_eq}.\\\n\nlocale simpl_rewrite = simpl_rewrite_base \\\n for \\ :: \"'p \\ ('s,'p,'f) com option\" +\n fixes P :: \"('s,'p,'f) com \\ bool\"\n assumes inv: \"\\c c'. c \\ c' \\ P c' \\ P c\"\nbegin\n\ntext \\Calculate @{term P} for a Simpl program consisting of a sub-program in a nest of contexts.\\\n\nfun\n ctxt_P :: \"('s,'p,'f) com \\ ('s,'p,'f) com_ctxt list \\ bool\"\nwhere\n \"ctxt_P c [] = P c\"\n | \"ctxt_P c (Seq1C c' # cs) = ctxt_P (Seq c c') cs\"\n | \"ctxt_P c (Seq2C c' # cs) = ctxt_P (Seq c' c) cs\"\n | \"ctxt_P c (CondTC b c' # cs) = ctxt_P (Cond b c c') cs\"\n | \"ctxt_P c (CondFC b c' t # cs) = (never_continues t c' \\ ctxt_P (Cond b c' c) cs)\"\n | \"ctxt_P c (WhileC b # cs) = ctxt_P (While b c) cs\"\n | \"ctxt_P c (WhileAnnoC b I V # cs) = ctxt_P (whileAnno b I V c) cs\"\n | \"ctxt_P c (GuardC f b # cs) = ctxt_P (Guard f b c) cs\"\n | \"ctxt_P c (TryC c' # cs) = ctxt_P (Catch c c') cs\"\n | \"ctxt_P c (HandlerC c' t # cs) = (never_continues t c' \\ ctxt_P (Catch c' c) cs)\"\n\ntext \\For the current focus, we add a flag @{term t} of type @{typ \"bool option\"}.\n @{term t} is None until we have finished rewriting sub-programs.\n It is @{term \"Some t\"} when rewriting has finished for the current focus, and\n the result satisfies @{term \"never_continues t\"}.\\\n\ndefinition\n \"nc_opt t \\ never_continues (case_option False id t)\"\n\ndefinition\n \"focus c t cs \\ nc_opt t c \\ ctxt_P c cs\"\n\nlemmas focus_defs = focus_def nc_opt_def\n\nlemma nc_opt_None:\n \"nc_opt None t\"\n by (simp add: nc_opt_def never_continues_False)\n\ntext \\Rules for beginning and ending the rewriting process.\\\n\nlemma enter_focus:\n \"focus c None [] \\ P c\"\n by (simp add: focus_defs never_continues_False)\n\nlemma exit_focus:\n \"P c \\ focus c t []\"\n by (simp add: focus_defs)\n\ntext \\Rules for rewriting at the current focus.\\\n\nlemma nc_opt_rewrite_com_eq:\n \"c \\ c' \\ nc_opt t c \\ nc_opt t c'\"\n by (simp add: nc_opt_def never_continues_rewrite_com_eq)\n\nlemma ctxt_P_rewrite_com_eq:\n \"c \\ c' \\ ctxt_P c' cs \\ ctxt_P c cs\"\n proof (induct cs arbitrary: c c')\n case Nil thus ?case by (simp add: inv)\n next\n case (Cons c'' cs) show ?case using Cons.prems(2)\n by (cases c''; clarsimp elim!: Cons.hyps[rotated];\n intro com_eq_intros com_eq_refl Cons.prems(1))\n qed\n\nlemma rewrite_focus:\n \"com_eq p c c' \\ p \\ focus c' t cs \\ focus c t cs\"\n by (simp add: focus_def nc_opt_rewrite_com_eq ctxt_P_rewrite_com_eq)\n\ntext \\Rules to set the @{term never_continues} flag for the current focus.\\\n\nlemma focus_set_never_continues:\n \"never_continues t c \\ focus c (Some t) cs \\ focus c None cs\"\n by (simp add: focus_defs)\n\nlemma focus_update_never_continues:\n \"never_continues t c \\ focus c (Some (t \\ t')) cs \\ focus c (Some t') cs\"\n by (cases t; cases t'; simp add: focus_defs)\n\nlemmas focus_never_continues =\n focus_update_never_continues[where t'=True, simplified]\n focus_update_never_continues[where t'=False, simplified]\n focus_set_never_continues\n\ntext \\Rules for moving the focus down the left spine.\\\n\nlemma focus_left:\n \"focus c None (Seq1C c' # cs) \\ focus (Seq c c') None cs\"\n \"focus c None (CondTC b c' # cs) \\ focus (Cond b c c') None cs\"\n \"focus c None (WhileC b # cs) \\ focus (While b c) None cs\"\n \"focus c None (WhileAnnoC b I V # cs) \\ focus (whileAnno b I V c) None cs\"\n \"focus c None (GuardC f b # cs) \\ focus (Guard f b c) None cs\"\n \"focus c None (TryC c' # cs) \\ focus (Catch c c') None cs\"\n by (auto simp: focus_def nc_opt_None)\n\ntext \\Rules for moving the focus to the right sibling.\\\n\nlemma focus_right:\n \"focus c' None (Seq2C c # cs) \\ focus c (Some False) (Seq1C c' # cs)\"\n \"focus c' None (CondFC b c t # cs) \\ focus c (Some t) (CondTC b c' # cs)\"\n \"focus c' None (HandlerC c t # cs) \\ focus c (Some t) (TryC c' # cs)\"\n by (auto simp: focus_defs never_continues_False)\n\ntext \\Rules for moving the focus up to the parent.\\\n\nlemma ctxt_P_Seq1:\n \"never_continues True c \\ ctxt_P c cs \\ ctxt_P (Seq c c') cs\"\n by (auto simp: never_continues_def2 elim: ctxt_P_rewrite_com_eq)\n\nlemma unfocus_simple:\n \"focus c (Some True) cs \\ focus c (Some True) (Seq1C c' # cs)\"\n \"focus (Seq c' c) (Some t) cs \\ focus c (Some t) (Seq2C c' # cs)\"\n \"focus (While b c) (Some False) cs \\ focus c (Some t) (WhileC b # cs)\"\n \"focus (whileAnno b I V c) (Some False) cs \\ focus c (Some t) (WhileAnnoC b I V # cs)\"\n \"focus (Guard f b c) (Some t) cs \\ focus c (Some t) (GuardC f b # cs)\"\n by (auto simp: focus_defs never_continues_False ctxt_P_Seq1 never_continues_Seq2 never_continues_Guard)\n\nlemma unfocus_complex:\n \"focus (Cond b c' c) (Some (t' \\ t)) cs \\ focus c (Some t) (CondFC b c' t' # cs)\"\n \"focus (Catch c' c) (Some (t' \\ t)) cs \\ focus c (Some t) (HandlerC c' t' # cs)\"\n by (auto simp: focus_defs never_continues_False never_continues_Cond never_continues_Catch)\n\nlemmas unfocus =\n unfocus_complex[where t=True and t'=True, simplified]\n unfocus_complex[where t=False, simplified]\n unfocus_complex[where t'=False, simplified]\n unfocus_simple\n\ntext \\Methods to automate rewriting.\\\n\nmethod do_rewrite uses ruleset declares C_simp_simps =\n (rule rewrite_focus, rule ruleset,\n #break \"simpl_rewrite_rewrite\", (simp add: C_simp_simps; fail))+\n\nmethod rewrite_pre declares C_simp_pre C_simp_simps =\n (do_rewrite ruleset: C_simp_pre)\n\nmethod rewrite_post declares C_simp C_simp_simps =\n (do_rewrite ruleset: C_simp)\n\nmethod never_continues declares C_simp_throws =\n (rule focus_never_continues, rule C_simp_throws never_continues_False)\n\nmethod children methods do_focus declares C_simp C_simp_pre C_simp_simps C_simp_throws =\n (rule focus_left, do_focus, (rule focus_right, do_focus)?, rule unfocus)?\n\nmethod do_focus declares C_simp C_simp_pre C_simp_simps C_simp_throws =\n (#break \"simpl_rewrite_step\", rewrite_pre?, children \\do_focus\\,\n #break \"simpl_rewrite_step\", rewrite_post?, never_continues)\n\nmethod simpl_rewrite declares C_simp C_simp_pre C_simp_simps C_simp_throws =\n changed \\rule enter_focus, do_focus, rule exit_focus\\\n\ntext \\Tests\\\n\nlemma\n assumes c3: \"c3 \\ c\"\n assumes c: \"(c;;c) \\ c\"\n shows \"P (c;; Guard f UNIV (IF X THEN c ELSE c FI);; Cond {} Skip (Skip;;c2);; Skip;;\n (IF False THEN Skip ELSE SKIP;; TRY THROW CATCH c3 END FI;; SKIP))\"\n apply simpl_rewrite\n apply (match conclusion in \"P (c;;c;;c2;;c3)\" \\ \\-\\)\n apply (simpl_rewrite C_simp: c3)\n apply (match conclusion in \"P (c;;c;;c2;;c)\" \\ \\-\\)\n apply (simpl_rewrite C_simp: c)\n apply (match conclusion in \"P (c;;c2;;c)\" \\ \\-\\)\n apply (fails \\simpl_rewrite\\)\n oops\n\ntext \\Test for @{text WHILE} (@{term whileAnno}) case.\\\n\nlemma\n \"P (WHILE b DO Guard f g c;; IF False THEN c2 FI OD;; SKIP)\"\n apply simpl_rewrite\n apply (match conclusion in \"P (WHILE b DO Guard f g c OD)\" \\ \\-\\)\n oops\n\ntext \\Test that simplification works down all branches of the term.\\\n\nlemma\n \"P (IF b THEN\n (SKIP ;; c) ;; (SKIP ;; IF True THEN SKIP ELSE c FI)\n ELSE\n (SKIP ;; SKIP) ;; (Guard f UNIV c ;; SKIP)\n FI)\"\n apply simpl_rewrite\n apply (match conclusion in \"P c\" \\ \\-\\)\n oops\n\ntext \\Test that complex simplification rules work.\\\n\nlemma com_eq_Cond_redundant:\n \"(IF b THEN c1 ELSE IF b THEN c2 ELSE c3 FI FI) \\ (IF b THEN c1 ELSE c3 FI)\"\n unfolding com_eq_def\n by (auto intro: exec.CondTrue exec.CondFalse elim!: exec_elim_cases)\n\nlemma\n \"P (SKIP ;;\n IF b THEN\n (SKIP ;; c1) ;; (SKIP ;; SKIP)\n ELSE\n IF b THEN\n IF b1 THEN c2 ELSE c2 FI\n ELSE\n WHILE False DO c4 OD ;; (c3 ;; SKIP)\n FI\n FI)\"\n apply (simpl_rewrite C_simp: com_eq_Cond_redundant)\n apply (match conclusion in \"P (IF b THEN c1 ELSE c3 FI)\" \\ \\-\\)\n oops\n\ntext \\Test False guard avoids looping.\\\n\nlemma\n \"P (SKIP ;; Guard f {} (IF b THEN c ELSE c FI) ;; SKIP)\"\n apply simpl_rewrite\n apply (match conclusion in \"P (Guard f {} SKIP)\" \\ \\-\\)\n oops\n\ntext \\Test that everything after a deeply nested Throw is discarded.\\\n\nlemma\n \"P (c0;; (c1;; (c2;; (c3;; (c4;; Throw;; c5);; c6);; c7);; c8);; c9)\"\n apply simpl_rewrite\n apply (match conclusion in \"P (c0;; (c1;; (c2;; (c3;; (c4;; Throw)))))\" \\ \\-\\)\n oops\n\ntext \\Test that rewriting can simplify conditions, also using assumptions in the context.\\\n\nlemma\n assumes \"\\s. A s \\ C s\"\n shows \"\\s. Q s = (A s \\ B s \\ C s) \\ P (Cond {s. \\ Q s} c1 c2)\"\n apply (simpl_rewrite C_simp_simps: assms)\n apply (match premises in \"\\s. Q s = (A s \\ B s \\ C s)\" \\ \\match conclusion in \"P c2\" \\ \\-\\\\)\n oops\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/clib/Simpl_Rewrite.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.2920626789105918}} {"text": "header {* \\isaheader{Relations between control dependences} *}\n\ntheory ControlDependenceRelations \n imports WeakOrderDependence StandardControlDependence \nbegin\n\ncontext StrongPostdomination begin\n\nlemma standard_control_implies_weak_order: \n assumes \"n controls\\<^sub>s n'\" shows \"n \\\\<^bsub>wod\\<^esub> n',(_Exit_)\"\nproof -\n from `n controls\\<^sub>s n'` obtain as a a' as' where \"as = a#as'\"\n and \"n' \\ set(sourcenodes as)\" and \"n -as\\* n'\"\n and \"n' postdominates (targetnode a)\"\n and \"valid_edge a'\" and \"sourcenode a' = n\"\n and \"\\ n' postdominates (targetnode a')\" \n by(auto simp:standard_control_dependence_def)\n from `n -as\\* n'` `as = a#as'` have \"sourcenode a = n\" by(auto elim:path.cases)\n from `n -as\\* n'` `as = a#as'` `n' \\ set(sourcenodes as)` have \"n \\ n'\"\n by(induct rule:path.induct,auto simp:sourcenodes_def)\n from `n -as\\* n'` `as = a#as'` have \"valid_edge a\"\n by(auto elim:path.cases)\n from `n controls\\<^sub>s n'` have \"n' \\ (_Exit_)\"\n by(fastforce dest:Exit_not_standard_control_dependent)\n from `n -as\\* n'` have \"(_Exit_) \\ set (sourcenodes as)\" by fastforce\n from `n -as\\* n'` have \"valid_node n\" and \"valid_node n'\"\n by(auto dest:path_valid_node)\n with `\\ n' postdominates (targetnode a')` `valid_edge a'`\n obtain asx where \"targetnode a' -asx\\* (_Exit_)\" and \"n' \\ set(sourcenodes asx)\"\n by(auto simp:postdominate_def)\n with `valid_edge a'` `sourcenode a' = n` have \"n -a'#asx\\* (_Exit_)\"\n by(fastforce intro:Cons_path)\n with `n \\ n'` `sourcenode a' = n` `n' \\ set(sourcenodes asx)`\n have \"n' \\ set(sourcenodes (a'#asx))\" by(simp add:sourcenodes_def)\n from `n' postdominates (targetnode a)` \n obtain asx' where \"targetnode a -asx'\\* n'\" by(erule postdominate_implies_path)\n from `n' postdominates (targetnode a)`\n have \"\\as'. targetnode a -as'\\* (_Exit_) \\ n' \\ set(sourcenodes as')\"\n by(auto simp:postdominate_def)\n with `n' \\ (_Exit_)` `n -as\\* n'` `(_Exit_) \\ set (sourcenodes as)`\n `n -a'#asx\\* (_Exit_)` `n' \\ set(sourcenodes (a'#asx))`\n `valid_edge a` `sourcenode a = n` `targetnode a -asx'\\* n'`\n show ?thesis by(auto simp:wod_def)\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/StaticIntra/ControlDependenceRelations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.29201275974412266}} {"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Example_Valid_State\nimports\n \"ArchNoninterference\"\n \"Lib.Distinct_Cmd\"\n \"AInvs.KernelInit_AI\"\nbegin\n\nsection \\Example\\\n\n(* This example is a classic 'one way information flow'\n example, where information is allowed to flow from Low to High,\n but not the reverse. We consider a typical scenario where\n shared memory and an notification for notifications are used to\n implement a ring-buffer. We consider the NTFN to be in the domain of High,\n and the shared memory to be in the domain of Low. *)\n\n(* basic machine-level declarations that need to happen outside the locale *)\n\nconsts s0_context :: user_context\n\n(* define the irqs to come regularly every 10 *)\n\naxiomatization where\n irq_oracle_def: \"RISCV64.irq_oracle \\ \\pos. if pos mod 10 = 0 then 10 else 0\"\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nsubsection \\We show that the authority graph does not let information flow from High to Low\\\n\ndatatype auth_graph_label = High | Low | IRQ0\n\nabbreviation partition_label where\n \"partition_label x \\ OrdinaryLabel x\"\n\ndefinition Sys1AuthGraph :: \"(auth_graph_label subject_label) auth_graph\" where\n \"Sys1AuthGraph \\\n {(partition_label High, Read, partition_label Low),\n (partition_label Low, Notify, partition_label High),\n (partition_label Low, Reset, partition_label High),\n (SilcLabel, Read, partition_label Low),\n (SilcLabel, Notify, partition_label High),\n (SilcLabel, Reset, partition_label High)}\n \\ {(x, a, y). x = y}\"\n\nlemma subjectReads_Low:\n \"subjectReads Sys1AuthGraph (partition_label Low) = {partition_label Low}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n done\n\nlemma Low_in_subjectReads_High:\n \"partition_label Low \\ subjectReads Sys1AuthGraph (partition_label High)\"\n by (simp add: Sys1AuthGraph_def reads_read)\n\nlemma subjectReads_High:\n \"subjectReads Sys1AuthGraph (partition_label High) = {partition_label High, partition_label Low}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n apply (auto intro: Low_in_subjectReads_High)\n done\n\nlemma subjectReads_IRQ0:\n \"subjectReads Sys1AuthGraph (partition_label IRQ0) = {partition_label IRQ0}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n done\n\nlemma High_in_subjectAffects_Low:\n \"partition_label High \\ subjectAffects Sys1AuthGraph (partition_label Low)\"\n apply (rule affects_ep)\n apply (simp add: Sys1AuthGraph_def)\n apply (rule disjI1, simp+)\n done\n\nlemma subjectAffects_Low:\n \"subjectAffects Sys1AuthGraph (partition_label Low) = {partition_label Low, partition_label High}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n apply (auto intro: affects_lrefl High_in_subjectAffects_Low)\n done\n\nlemma subjectAffects_High:\n \"subjectAffects Sys1AuthGraph (partition_label High) = {partition_label High}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n apply (auto intro: affects_lrefl)\n done\n\nlemma subjectAffects_IRQ0:\n \"subjectAffects Sys1AuthGraph (partition_label IRQ0) = {partition_label IRQ0}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n apply (auto intro: affects_lrefl)\n done\n\nlemmas subjectReads = subjectReads_High subjectReads_Low subjectReads_IRQ0\n\nlemma partsSubjectAffects_Low:\n \"partsSubjectAffects Sys1AuthGraph Low = {Partition Low, Partition High}\"\n by (auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def\n subjectReads subjectAffects_Low | case_tac xa, rename_tac xa)+\n\nlemma partsSubjectAffects_High:\n \"partsSubjectAffects Sys1AuthGraph High = {Partition High}\"\n by (auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def\n subjectReads subjectAffects_High | rename_tac xa, case_tac xa)+\n\nlemma partsSubjectAffects_IRQ0:\n \"partsSubjectAffects Sys1AuthGraph IRQ0 = {Partition IRQ0}\"\n by (auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def\n subjectReads subjectAffects_IRQ0 | rename_tac xa, case_tac xa)+\n\nlemmas partsSubjectAffects =\n partsSubjectAffects_High partsSubjectAffects_Low partsSubjectAffects_IRQ0\n\ndefinition example_policy where\n \"example_policy \\\n {(PSched, d) | d. True} \\ {(d,e). d = e} \\ {(Partition Low, Partition High)}\"\n\nlemma \"policyFlows Sys1AuthGraph = example_policy\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (clarsimp simp: example_policy_def)\n apply (erule policyFlows.cases)\n apply (case_tac l, auto simp: partsSubjectAffects)[1]\n apply assumption\n apply (rule subsetI)\n apply (clarsimp simp: example_policy_def)\n apply (elim disjE)\n apply (fastforce simp: partsSubjectAffects intro: policy_affects)\n apply (fastforce intro: policy_scheduler)\n apply (fastforce intro: policyFlows_refl refl_onD)\n done\n\n\nsubsection \\We show there exists a valid initial state associated to the\n above authority graph\\\n\ntext \\\n\nThis example (modified from ../access-control/ExampleSystem) is a system Sys1 made\nof 2 main components Low and High, connected through an notification NTFN.\nBoth Low and High contains:\n\n . one TCB\n . one vspace made up of one top-level page table\n - one asid pool with a single entry for the corresponding vspace\n . each top-level pt contains a single page table, with access to a shared page in memory\n Low can read/write to this page, High can only read\n . one cspace made up of one cnode\n . each cspace contains 4 caps:\n one to the tcb\n one to the cnode itself\n one to the top level page table\n one to the asid pool\n one to the shared page\n one to the second level page table\n one to the ntfn\n\nLow can send to the ntfn while High can receive from it.\n\nAttempt to ASCII art:\n\n -------- ---- ---- --------\n | | | | | | | |\n V | | V S R | V | V\nLow_tcb(3079)-->Low_cnode(6)--->ntfn(9)<---High_cnode(7)<--High_tcb(3080)\n | | | |\n V | | V\nLow_pd(3063)<---------Low_pool High_pool------------> High_pd(3065)\n | |\n V R/W R V\nLow_pt(3072)---------------->shared_page<-----------------High_pt(3077)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove\n\n valid_initial_state s0_internal Sys1PAS timer_irq utf\n\nwhere Sys1PAS is the label graph defining the AC policy for Sys1 using\nthe authority graph defined above and s0 is the state of Sys1 described above.\n\n\\\n\nsubsubsection \\Defining the State\\\n\ndefinition \"ntfn_ptr \\ pptr_base + 0x20\"\n\ndefinition \"Low_tcb_ptr \\ pptr_base + 0x400\"\ndefinition \"High_tcb_ptr = pptr_base + 0x800\"\ndefinition \"idle_tcb_ptr = pptr_base + 0x1000\"\n\ndefinition \"Low_pt_ptr = pptr_base + 0x4000\"\ndefinition \"High_pt_ptr = pptr_base + 0x5000\"\n\ndefinition \"Low_pd_ptr = pptr_base + 0x7000\"\ndefinition \"High_pd_ptr = pptr_base + 0x8000\"\n\ndefinition \"Low_pool_ptr = pptr_base + 0x9000\"\ndefinition \"High_pool_ptr = pptr_base + 0xA000\"\n\ndefinition \"Low_cnode_ptr = pptr_base + 0x10000\"\ndefinition \"High_cnode_ptr = pptr_base + 0x18000\"\ndefinition \"Silc_cnode_ptr = pptr_base + 0x20000\"\ndefinition \"irq_cnode_ptr = pptr_base + 0x28000\"\n\ndefinition \"shared_page_ptr_virt = pptr_base + 0x200000\"\ndefinition \"shared_page_ptr_phys = addrFromPPtr shared_page_ptr_virt\"\n\ndefinition \"timer_irq \\ 10\" (* not sure exactly how this fits in *)\n\ndefinition \"Low_mcp \\ 5 :: priority\"\ndefinition \"Low_prio \\ 5 :: priority\"\ndefinition \"High_mcp \\ 5 :: priority\"\ndefinition \"High_prio \\ 5 :: priority\"\ndefinition \"Low_time_slice \\ 0 :: nat\"\ndefinition \"High_time_slice \\ 5 :: nat\"\ndefinition \"Low_domain \\ 0 :: domain\"\ndefinition \"High_domain \\ 1 :: domain\"\n\nlemmas s0_ptr_defs =\n Low_pool_ptr_def High_pool_ptr_def Low_cnode_ptr_def High_cnode_ptr_def Silc_cnode_ptr_def\n ntfn_ptr_def irq_cnode_ptr_def Low_pd_ptr_def High_pd_ptr_def Low_pt_ptr_def High_pt_ptr_def\n Low_tcb_ptr_def High_tcb_ptr_def idle_tcb_ptr_def timer_irq_def Low_prio_def High_prio_def\n Low_time_slice_def Low_domain_def High_domain_def init_irq_node_ptr_def riscv_global_pt_ptr_def\n pptr_base_def pptrBase_def canonical_bit_def shared_page_ptr_virt_def\n\n(* Distinctness proof of kernel pointers. *)\n\ndistinct ptrs_distinct[simp]:\n Low_tcb_ptr High_tcb_ptr idle_tcb_ptr ntfn_ptr\n Low_pt_ptr High_pt_ptr shared_page_ptr_virt Low_pd_ptr High_pd_ptr\n Low_cnode_ptr High_cnode_ptr Low_pool_ptr High_pool_ptr\n Silc_cnode_ptr irq_cnode_ptr riscv_global_pt_ptr\n by (auto simp: s0_ptr_defs)\n\n\ntext \\We need to define the asids of each pd and pt to ensure that\nthe object is included in the right ASID-label\\\n\ndefinition Low_asid :: asid where\n \"Low_asid \\ 1 << asid_low_bits\"\n\ndefinition High_asid :: asid where\n \"High_asid \\ 2 << asid_low_bits\"\n\ndefinition Silc_asid :: asid where\n \"Silc_asid \\ 3 << asid_low_bits\"\n\ndistinct asid_high_bits_distinct[simp]:\n \"asid_high_bits_of Low_asid\"\n \"asid_high_bits_of High_asid\"\n \"asid_high_bits_of Silc_asid\"\n by (auto simp: asid_high_bits_of_def asid_low_bits_def Low_asid_def High_asid_def Silc_asid_def)\n\ndistinct asids_distinct[simp]:\n High_asid Low_asid Silc_asid\n by (auto simp: Low_asid_def High_asid_def Silc_asid_def asid_low_bits_def)\n\n\ntext \\converting a nat to a bool list of size 10 - for the cnodes\\\n\ndefinition nat_to_bl :: \"nat \\ nat \\ bool list option\" where\n \"nat_to_bl bits n \\\n if n \\ 2^bits then None\n else Some $ bin_to_bl bits (of_nat n)\"\n\nlemma nat_to_bl_id [simp]: \"nat_to_bl (size (x :: (('a::len) word))) (unat x) = Some (to_bl x)\"\n by (clarsimp simp: nat_to_bl_def to_bl_def le_def word_size)\n\ndefinition the_nat_to_bl :: \"nat \\ nat \\ bool list\" where\n \"the_nat_to_bl sz n \\ the (nat_to_bl sz (n mod 2^sz))\"\n\nabbreviation (input) the_nat_to_bl_10 :: \"nat \\ bool list\" where\n \"the_nat_to_bl_10 n \\ the_nat_to_bl 10 n\"\n\nlemma len_the_nat_to_bl[simp]:\n \"length (the_nat_to_bl x y) = x\"\n apply (clarsimp simp: the_nat_to_bl_def nat_to_bl_def)\n apply safe\n apply (metis le_def mod_less_divisor nat_zero_less_power_iff zero_less_numeral)\n apply (clarsimp simp: len_bin_to_bl_aux not_le)\n done\n\nlemma tcb_cnode_index_nat_to_bl [simp]:\n \"the_nat_to_bl_10 n \\ tcb_cnode_index n\"\n by (clarsimp simp: tcb_cnode_index_def intro!: length_neq)\n\nlemma mod_less_self [simp]:\n \"a \\ b mod a \\ ((a :: nat) = 0)\"\n by (metis mod_less_divisor nat_neq_iff not_less not_less0)\n\nlemma split_div_mod:\n \"a = (b::nat) \\ (a div k = b div k \\ a mod k = b mod k)\"\n by (metis mult_div_mod_eq)\n\nlemma nat_to_bl_eq:\n assumes \"a < 2 ^ n \\ b < 2 ^ n\"\n shows \"nat_to_bl n a = nat_to_bl n b \\ a = b\"\n using assms\n apply -\n apply (erule disjE_R)\n apply (clarsimp simp: nat_to_bl_def)\n apply (case_tac \"a \\ 2 ^ n\")\n apply (clarsimp simp: nat_to_bl_def)\n apply (clarsimp simp: not_le)\n apply (induct n arbitrary: a b)\n apply (clarsimp simp: nat_to_bl_def)\n apply atomize\n apply (clarsimp simp: nat_to_bl_def)\n apply (erule_tac x=\"a div 2\" in allE)\n apply (erule_tac x=\"b div 2\" in allE)\n apply (erule impE)\n apply (metis power_commutes td_gal_lt zero_less_numeral)\n apply (clarsimp simp: bin_last_def zdiv_int)\n apply (rule iffI [rotated], clarsimp)\n apply (subst (asm) (1 2 3 4) bin_to_bl_aux_alt)\n apply (clarsimp simp: mod_eq_dvd_iff)\n apply (subst split_div_mod [where k=2])\n apply clarsimp\n apply presburger\n done\n\nlemma nat_to_bl_mod_n_eq[simp]:\n \"nat_to_bl n a = nat_to_bl n b \\ ((a = b \\ a < 2 ^ n) \\ (a \\ 2 ^ n \\ b \\ 2 ^ n))\"\n apply (rule iffI)\n apply (clarsimp simp: not_le)\n apply (subst (asm) nat_to_bl_eq, simp)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (clarsimp simp: nat_to_bl_def)\n done\n\nlemma the_the_eq:\n \"\\ x \\ None; y \\ None \\ \\ (the x = the y) = (x = y)\"\n by auto\n\nlemma the_nat_to_bl_eq [simp]:\n \"(the_nat_to_bl n a = the_nat_to_bl m b) \\ (n = m \\ (a mod 2 ^ n = b mod 2 ^ n))\"\n apply (case_tac \"n = m\")\n apply (clarsimp simp: the_nat_to_bl_def)\n apply (subst the_the_eq)\n apply (clarsimp simp: nat_to_bl_def)\n apply (clarsimp simp: nat_to_bl_def)\n apply simp\n apply simp\n apply (metis len_the_nat_to_bl)\n done\n\nlemma empty_cnode_eq_Some[simp]:\n \"(empty_cnode n x = Some y) = (length x = n \\ y = NullCap)\"\n by (clarsimp simp: empty_cnode_def, metis)\n\nlemma empty_cnode_eq_None[simp]:\n \"(empty_cnode n x = None) = (length x \\ n)\"\n by (clarsimp simp: empty_cnode_def)\n\n\ntext \\Low's CSpace\\\n\ndefinition Low_caps :: cnode_contents where\n \"Low_caps \\\n (empty_cnode 10)\n ((the_nat_to_bl_10 1)\n \\ ThreadCap Low_tcb_ptr,\n (the_nat_to_bl_10 2)\n \\ CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0))),\n (the_nat_to_bl_10 4)\n \\ ArchObjectCap (ASIDPoolCap Low_pool_ptr Low_asid),\n (the_nat_to_bl_10 5)\n \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_write RISCVLargePage False (Some (Low_asid,0))),\n (the_nat_to_bl_10 6)\n \\ ArchObjectCap (PageTableCap Low_pt_ptr (Some (Low_asid,0))),\n (the_nat_to_bl_10 318)\n \\ NotificationCap ntfn_ptr 0 {AllowSend})\"\n\ndefinition Low_cnode :: kernel_object where\n \"Low_cnode \\ CNode 10 Low_caps\"\n\nlemma ran_empty_cnode[simp]:\n \"ran (empty_cnode C) = {NullCap}\"\n by (auto simp: empty_cnode_def ran_def Ex_list_of_length intro: set_eqI)\n\nlemma empty_cnode_app[simp]:\n \"length x = n \\ empty_cnode n x = Some NullCap\"\n by (auto simp: empty_cnode_def)\n\nlemma in_ran_If[simp]:\n \"(x \\ ran (\\n. if P n then A n else B n)) \\\n (\\n. P n \\ A n = Some x) \\ (\\n. \\ P n \\ B n = Some x)\"\n by (auto simp: ran_def)\n\nlemma Low_caps_ran:\n \"ran Low_caps =\n {ThreadCap Low_tcb_ptr,\n CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0))),\n ArchObjectCap (PageTableCap Low_pt_ptr (Some (Low_asid,0))),\n ArchObjectCap (ASIDPoolCap Low_pool_ptr Low_asid),\n ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_write RISCVLargePage False (Some (Low_asid,0))),\n NotificationCap ntfn_ptr 0 {AllowSend},\n NullCap}\"\n apply (rule equalityI)\n apply (clarsimp simp: Low_caps_def fun_upd_def empty_cnode_def split: if_split_asm)\n apply (clarsimp simp: Low_caps_def fun_upd_def empty_cnode_def split: if_split_asm cong: conj_cong)\n apply (rule exI[where x=\"the_nat_to_bl_10 0\"])\n apply simp\n done\n\n\ntext \\High's Cspace\\\n\ndefinition High_caps :: cnode_contents where\n \"High_caps \\\n (empty_cnode 10)\n ((the_nat_to_bl_10 1)\n \\ ThreadCap High_tcb_ptr,\n (the_nat_to_bl_10 2)\n \\ CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2),\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0))),\n (the_nat_to_bl_10 4)\n \\ ArchObjectCap (ASIDPoolCap High_pool_ptr High_asid),\n (the_nat_to_bl_10 5)\n \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (High_asid,0))),\n (the_nat_to_bl_10 6)\n \\ ArchObjectCap (PageTableCap High_pt_ptr (Some (High_asid,0))),\n (the_nat_to_bl_10 318)\n \\ NotificationCap ntfn_ptr 0 {AllowRecv}) \"\n\ndefinition High_cnode :: kernel_object where\n \"High_cnode \\ CNode 10 High_caps\"\n\nlemma High_caps_ran:\n \"ran High_caps =\n {ThreadCap High_tcb_ptr,\n CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2),\n ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0))),\n ArchObjectCap (PageTableCap High_pt_ptr (Some (High_asid,0))),\n ArchObjectCap (ASIDPoolCap High_pool_ptr High_asid),\n ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (High_asid,0))),\n NotificationCap ntfn_ptr 0 {AllowRecv},\n NullCap}\"\n apply (rule equalityI)\n apply (clarsimp simp: High_caps_def ran_def empty_cnode_def split: if_split_asm)\n apply (clarsimp simp: High_caps_def ran_def empty_cnode_def split: if_split_asm cong: conj_cong)\n apply (rule exI [where x=\"the_nat_to_bl_10 0\"])\n apply simp\n done\n\n\ntext \\We need a copy of boundary crossing caps owned by SilcLabel\\\n\ndefinition Silc_caps :: cnode_contents where\n \"Silc_caps \\\n (empty_cnode 10)\n ((the_nat_to_bl_10 2)\n \\ CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2),\n (the_nat_to_bl_10 5)\n \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (Silc_asid,0))),\n (the_nat_to_bl_10 318)\n \\ NotificationCap ntfn_ptr 0 {AllowSend} )\"\n\ndefinition Silc_cnode :: kernel_object where\n \"Silc_cnode \\ CNode 10 Silc_caps\"\n\nlemma Silc_caps_ran:\n \"ran Silc_caps =\n {CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2),\n ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (Silc_asid,0))),\n NotificationCap ntfn_ptr 0 {AllowSend},\n NullCap}\"\n apply (rule equalityI)\n apply (clarsimp simp: Silc_caps_def ran_def empty_cnode_def)\n apply (clarsimp simp: ran_def Silc_caps_def empty_cnode_def cong: conj_cong)\n apply (rule_tac x=\"the_nat_to_bl_10 0\" in exI)\n apply simp\n done\n\n\ntext \\notification between Low and High\\\n\ndefinition ntfn :: kernel_object where\n \"ntfn \\ Notification \\ntfn_obj = WaitingNtfn [High_tcb_ptr], ntfn_bound_tcb=None\\\"\n\n\ntext \\global page table is mapped into the top-level page tables of each vspace\\\n\nabbreviation init_global_pt' where\n \"init_global_pt' \\ (\\idx. if idx \\ kernel_mapping_slots then global_pte idx else InvalidPTE)\"\n\n\ntext \\Low's VSpace (PageDirectory)\\\n\nabbreviation ppn_from_addr :: \"paddr \\ pte_ppn\" where\n \"ppn_from_addr addr \\ ucast (addr >> pt_bits)\"\n\nabbreviation Low_pt' :: pt where\n \"Low_pt' \\\n (\\_. InvalidPTE)\n (0 := PagePTE (ppn_from_addr shared_page_ptr_phys) {} vm_read_write)\"\n\ndefinition Low_pt :: kernel_object where\n \"Low_pt \\ ArchObj (PageTable Low_pt')\"\n\nabbreviation Low_pd' :: pt where\n \"Low_pd' \\\n init_global_pt'\n (0 := PageTablePTE (ppn_from_addr (addrFromPPtr Low_pt_ptr)) {})\"\n\ndefinition Low_pd :: kernel_object where\n \"Low_pd \\ ArchObj (PageTable Low_pd')\"\n\n\ntext \\High's VSpace (PageDirectory)\\\n\nabbreviation High_pt' :: pt where\n \"High_pt' \\\n (\\_. InvalidPTE)\n (0 := PagePTE (ppn_from_addr shared_page_ptr_phys) {} vm_read_only)\"\n\ndefinition High_pt :: kernel_object where\n \"High_pt \\ ArchObj (PageTable High_pt')\"\n\nabbreviation High_pd' :: pt where\n \"High_pd' \\\n init_global_pt'\n (0 := PageTablePTE (ppn_from_addr (addrFromPPtr High_pt_ptr)) {})\"\n\ndefinition High_pd :: kernel_object where\n \"High_pd \\ ArchObj (PageTable High_pd')\"\n\n\ntext \\Low's tcb\\\n\ndefinition Low_tcb :: kernel_object where\n \"Low_tcb \\ TCB \\tcb_ctable = CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n tcb_vtable = ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0))),\n tcb_reply = ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite},\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = Running,\n tcb_fault_handler = replicate word_bits False,\n tcb_ipc_buffer = 0,\n tcb_fault = None,\n tcb_bound_notification = None,\n tcb_mcpriority = Low_mcp,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\ndefinition Low_etcb :: etcb where\n \"Low_etcb \\ \\tcb_priority = Low_prio,\n tcb_time_slice = Low_time_slice,\n tcb_domain = Low_domain\\\"\n\n\ntext \\High's tcb\\\n\ndefinition High_tcb :: kernel_object where\n \"High_tcb \\ TCB \\tcb_ctable = CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2) ,\n tcb_vtable = ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0))),\n tcb_reply = ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite},\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = BlockedOnNotification ntfn_ptr,\n tcb_fault_handler = replicate word_bits False,\n tcb_ipc_buffer = 0,\n tcb_fault = None,\n tcb_bound_notification = None,\n tcb_mcpriority = High_mcp,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\ndefinition High_etcb :: etcb where\n \"High_etcb \\ \\tcb_priority = High_prio,\n tcb_time_slice = High_time_slice,\n tcb_domain = High_domain\\\"\n\n\ntext \\idle's tcb\\\n\ndefinition idle_tcb :: kernel_object where\n \"idle_tcb \\ TCB \\tcb_ctable = NullCap,\n tcb_vtable = NullCap,\n tcb_reply = NullCap,\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = IdleThreadState,\n tcb_fault_handler = replicate word_bits False,\n tcb_ipc_buffer = 0,\n tcb_fault = None,\n tcb_bound_notification = None,\n tcb_mcpriority = default_priority,\n tcb_arch = \\tcb_context = empty_context\\\\\"\n\ndefinition\n \"irq_cnode \\ CNode 0 (Map.empty([] \\ cap.NullCap))\"\n\nabbreviation\n \"Low_pool' \\ \\idx. if idx = asid_low_bits_of Low_asid then Some Low_pd_ptr else None\"\n\ndefinition\n \"Low_pool \\ ArchObj (ASIDPool Low_pool')\"\n\nabbreviation\n \"High_pool' \\ \\idx. if idx = asid_low_bits_of High_asid then Some High_pd_ptr else None\"\n\ndefinition\n \"High_pool \\ ArchObj (ASIDPool High_pool')\"\n\ndefinition\n \"shared_page \\ ArchObj (DataPage False RISCVLargePage)\"\n\ndefinition kh0 :: kheap where\n \"kh0 \\ (\\x. if \\irq :: irq. init_irq_node_ptr + (ucast irq << 5) = x\n then Some (CNode 0 (empty_cnode 0))\n else None)\n (Low_cnode_ptr \\ Low_cnode,\n High_cnode_ptr \\ High_cnode,\n Low_pool_ptr \\ Low_pool,\n High_pool_ptr \\ High_pool,\n Silc_cnode_ptr \\ Silc_cnode,\n ntfn_ptr \\ ntfn,\n irq_cnode_ptr \\ irq_cnode,\n Low_pd_ptr \\ Low_pd,\n High_pd_ptr \\ High_pd,\n Low_pt_ptr \\ Low_pt,\n High_pt_ptr \\ High_pt,\n Low_tcb_ptr \\ Low_tcb,\n High_tcb_ptr \\ High_tcb,\n idle_tcb_ptr \\ idle_tcb,\n shared_page_ptr_virt \\ shared_page,\n riscv_global_pt_ptr \\ init_global_pt)\"\n\nlemma irq_node_offs_min:\n \"init_irq_node_ptr \\ init_irq_node_ptr + (ucast (irq :: irq) << 5)\"\n apply (rule_tac sz=59 in machine_word_plus_mono_right_split)\n apply (simp add: unat_word_ariths mask_def shiftl_t2n s0_ptr_defs)\n apply (cut_tac x=irq and 'a=64 in ucast_less)\n apply simp\n apply (simp add: word_less_nat_alt)\n apply (simp add: word_bits_def)\n done\n\nlemma irq_node_offs_max:\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) < init_irq_node_ptr + 0x7E1\"\n apply (simp add: s0_ptr_defs shiftl_t2n)\n apply (cut_tac x=irq and 'a=64 in ucast_less)\n apply simp\n apply (simp add: word_less_nat_alt unat_word_ariths)\n done\n\ndefinition irq_node_offs_range where\n \"irq_node_offs_range \\ {x. init_irq_node_ptr \\ x \\ x < init_irq_node_ptr + 0x7E1}\n \\ {x. is_aligned x 5}\"\n\nlemma irq_node_offs_in_range:\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ irq_node_offs_range\"\n apply (clarsimp simp: irq_node_offs_min irq_node_offs_max irq_node_offs_range_def)\n apply (rule is_aligned_add[OF _ is_aligned_shift])\n apply (simp add: is_aligned_def s0_ptr_defs)\n done\n\nlemma irq_node_offs_range_correct:\n \"x \\ irq_node_offs_range\n \\ \\irq. x = init_irq_node_ptr + (ucast (irq:: irq) << 5)\"\n apply (clarsimp simp: irq_node_offs_min irq_node_offs_max irq_node_offs_range_def s0_ptr_defs)\n apply (rule_tac x=\"ucast ((x - 0xFFFFFFC000003000) >> 5)\" in exI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst aligned_shiftr_mask_shiftl)\n apply (rule aligned_sub_aligned)\n apply assumption\n apply (simp add: is_aligned_def)\n apply simp\n apply simp\n apply (rule_tac n=11 in mask_eqI)\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_def)\n apply (simp add: mask_twice)\n apply (simp add: diff_conv_add_uminus del: add_uminus_conv_diff)\n apply (subst add.commute[symmetric])\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_def)\n apply simp\n apply (simp add: diff_conv_add_uminus del: add_uminus_conv_diff)\n apply (subst add_mask_lower_bits)\n apply (simp add: is_aligned_def)\n apply clarsimp\n apply (cut_tac x=x and y=\"0xFFFFFFC0000037E0\" and n=14 in neg_mask_mono_le)\n apply (force dest: word_less_sub_1)\n apply (drule_tac n=11 in aligned_le_sharp)\n apply (simp add: is_aligned_def)\n apply (simp add: mask_def is_aligned_mask)\n apply word_bitwise\n apply fastforce\n done\n\nlemma irq_node_offs_range_distinct[simp]:\n \"Low_cnode_ptr \\ irq_node_offs_range\"\n \"High_cnode_ptr \\ irq_node_offs_range\"\n \"Low_pool_ptr \\ irq_node_offs_range\"\n \"High_pool_ptr \\ irq_node_offs_range\"\n \"Silc_cnode_ptr \\ irq_node_offs_range\"\n \"ntfn_ptr \\ irq_node_offs_range\"\n \"irq_cnode_ptr \\ irq_node_offs_range\"\n \"Low_pd_ptr \\ irq_node_offs_range\"\n \"High_pd_ptr \\ irq_node_offs_range\"\n \"Low_pt_ptr \\ irq_node_offs_range\"\n \"High_pt_ptr \\ irq_node_offs_range\"\n \"Low_tcb_ptr \\ irq_node_offs_range\"\n \"High_tcb_ptr \\ irq_node_offs_range\"\n \"idle_tcb_ptr \\ irq_node_offs_range\"\n \"riscv_global_pt_ptr \\ irq_node_offs_range\"\n \"shared_page_ptr_virt \\ irq_node_offs_range\"\n by(simp add:irq_node_offs_range_def s0_ptr_defs)+\n\nlemma irq_node_offs_distinct[simp]:\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Low_cnode_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ High_cnode_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Low_pool_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ High_pool_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Silc_cnode_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ ntfn_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ irq_cnode_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Low_pd_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ High_pd_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Low_pt_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ High_pt_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ Low_tcb_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ High_tcb_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ idle_tcb_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ riscv_global_pt_ptr\"\n \"init_irq_node_ptr + (ucast (irq:: irq) << 5) \\ shared_page_ptr_virt\"\n by (simp add:not_inD[symmetric, OF _ irq_node_offs_in_range])+\n\nlemma kh0_dom:\n \"dom kh0 = {shared_page_ptr_virt, riscv_global_pt_ptr, idle_tcb_ptr, High_tcb_ptr, Low_tcb_ptr,\n High_pt_ptr, Low_pt_ptr, High_pd_ptr, Low_pd_ptr, irq_cnode_ptr, ntfn_ptr,\n Silc_cnode_ptr, High_pool_ptr, Low_pool_ptr, High_cnode_ptr, Low_cnode_ptr}\n \\ irq_node_offs_range\"\n apply (rule equalityI)\n apply (simp add: kh0_def dom_def)\n apply (clarsimp simp: irq_node_offs_in_range)\n apply (clarsimp simp: dom_def)\n apply (rule conjI, clarsimp simp: kh0_def)+\n apply (force simp: kh0_def dest: irq_node_offs_range_correct)\n done\n\nlemmas kh0_SomeD' = set_mp[OF equalityD1[OF kh0_dom[simplified dom_def]], OF CollectI, simplified, OF exI]\n\nlemma kh0_SomeD:\n \"kh0 x = Some y \\\n x = shared_page_ptr_virt \\ y = shared_page \\\n x = riscv_global_pt_ptr \\ y = init_global_pt \\\n x = idle_tcb_ptr \\ y = idle_tcb \\\n x = High_tcb_ptr \\ y = High_tcb \\\n x = Low_tcb_ptr \\ y = Low_tcb \\\n x = High_pt_ptr \\ y = High_pt \\\n x = Low_pt_ptr \\ y = Low_pt \\\n x = High_pd_ptr \\ y = High_pd \\\n x = Low_pd_ptr \\ y = Low_pd \\\n x = irq_cnode_ptr \\ y = irq_cnode \\\n x = ntfn_ptr \\ y = ntfn \\\n x = Silc_cnode_ptr \\ y = Silc_cnode \\\n x = High_pool_ptr \\ y = High_pool \\\n x = Low_pool_ptr \\ y = Low_pool \\\n x = High_cnode_ptr \\ y = High_cnode \\\n x = Low_cnode_ptr \\ y = Low_cnode \\\n x \\ irq_node_offs_range \\ y = CNode 0 (empty_cnode 0)\"\n apply (frule kh0_SomeD')\n apply (erule disjE, simp add: kh0_def | force simp: kh0_def split: if_split_asm)+\n done\n\nlemmas kh0_obj_def =\n Low_cnode_def High_cnode_def Silc_cnode_def Low_pool_def High_pool_def Low_pd_def High_pd_def\n Low_pt_def High_pt_def Low_tcb_def High_tcb_def idle_tcb_def irq_cnode_def ntfn_def\n init_global_pt_def global_pte_def vm_kernel_only_def shared_page_def\n\n\ndefinition exst0 :: \"det_ext\" where\n \"exst0 \\ \\work_units_completed_internal = undefined,\n scheduler_action_internal = resume_cur_thread,\n ekheap_internal = [Low_tcb_ptr \\ Low_etcb,\n High_tcb_ptr \\ High_etcb,\n idle_tcb_ptr \\ default_etcb],\n domain_list_internal = [(0, 10), (1, 10)],\n domain_index_internal = 0,\n cur_domain_internal = 0,\n domain_time_internal = 5,\n ready_queues_internal = (const (const [])),\n cdt_list_internal = const []\\\"\n\nlemmas ekh0_obj_def =\n Low_etcb_def High_etcb_def default_etcb_def\n\ndefinition machine_state0 :: \"machine_state\" where\n \"machine_state0 \\ \\irq_masks = (\\irq. if irq = timer_irq then False else True),\n irq_state = 0,\n underlying_memory = const 0,\n device_state = Map.empty,\n machine_state_rest = undefined\\\"\n\ndefinition arch_state0 :: \"arch_state\" where\n \"arch_state0 \\ \\\n riscv_asid_table = [asid_high_bits_of Low_asid \\ Low_pool_ptr,\n asid_high_bits_of High_asid \\ High_pool_ptr],\n riscv_global_pts = (\\level. if level = max_pt_level then {riscv_global_pt_ptr} else {}),\n riscv_kernel_vspace = init_vspace_uses\n \\\"\n\ndefinition s0_internal :: \"det_ext state\" where\n \"s0_internal \\ \\\n kheap = kh0,\n cdt = Map.empty,\n is_original_cap = (\\_. False) ((Low_tcb_ptr, tcb_cnode_index 2) := True,\n (High_tcb_ptr, tcb_cnode_index 2) := True),\n cur_thread = Low_tcb_ptr,\n idle_thread = idle_tcb_ptr,\n machine_state = machine_state0,\n interrupt_irq_node = (\\irq. init_irq_node_ptr + (ucast irq << 5)),\n interrupt_states = (\\_. irq_state.IRQInactive) (timer_irq := irq_state.IRQTimer),\n arch_state = arch_state0,\n exst = exst0\n \\\"\n\nlemma kh_s0_def:\n \"(kheap s0_internal x = Some y) = (\n x = shared_page_ptr_virt \\ y = shared_page \\\n x = riscv_global_pt_ptr \\ y = init_global_pt \\\n x = idle_tcb_ptr \\ y = idle_tcb \\\n x = High_tcb_ptr \\ y = High_tcb \\\n x = Low_tcb_ptr \\ y = Low_tcb \\\n x = High_pt_ptr \\ y = High_pt \\\n x = Low_pt_ptr \\ y = Low_pt \\\n x = High_pd_ptr \\ y = High_pd \\\n x = Low_pd_ptr \\ y = Low_pd \\\n x = irq_cnode_ptr \\ y = irq_cnode \\\n x = ntfn_ptr \\ y = ntfn \\\n x = Silc_cnode_ptr \\ y = Silc_cnode \\\n x = High_pool_ptr \\ y = High_pool \\\n x = Low_pool_ptr \\ y = Low_pool \\\n x = High_cnode_ptr \\ y = High_cnode \\\n x = Low_cnode_ptr \\ y = Low_cnode \\\n x \\ irq_node_offs_range \\ y = CNode 0 (empty_cnode 0))\"\n apply (clarsimp simp: s0_internal_def kh0_def)\n apply (auto simp: irq_node_offs_in_range dest: irq_node_offs_range_correct)\n done\n\n\nsubsubsection \\Defining the policy graph\\\n\ndefinition Sys1AgentMap :: \"(auth_graph_label subject_label) agent_map\" where\n \"Sys1AgentMap \\\n \\ \\set the range of the shared_page to Low, default everything else to IRQ0\\\n (\\p. if p \\ ptr_range shared_page_ptr_virt (pageBitsForSize RISCVLargePage)\n then partition_label Low\n else partition_label IRQ0)\n (Low_cnode_ptr := partition_label Low,\n High_cnode_ptr := partition_label High,\n Low_pool_ptr := partition_label Low,\n High_pool_ptr := partition_label High,\n ntfn_ptr := partition_label High,\n irq_cnode_ptr := partition_label IRQ0,\n Silc_cnode_ptr := SilcLabel,\n Low_pd_ptr := partition_label Low,\n High_pd_ptr := partition_label High,\n Low_pt_ptr := partition_label Low,\n High_pt_ptr := partition_label High,\n Low_tcb_ptr := partition_label Low,\n High_tcb_ptr := partition_label High,\n idle_tcb_ptr := partition_label Low)\"\n\nlemma Sys1AgentMap_simps:\n \"Sys1AgentMap Low_cnode_ptr = partition_label Low\"\n \"Sys1AgentMap High_cnode_ptr = partition_label High\"\n \"Sys1AgentMap Low_pool_ptr = partition_label Low\"\n \"Sys1AgentMap High_pool_ptr = partition_label High\"\n \"Sys1AgentMap ntfn_ptr = partition_label High\"\n \"Sys1AgentMap irq_cnode_ptr = partition_label IRQ0\"\n \"Sys1AgentMap Silc_cnode_ptr = SilcLabel\"\n \"Sys1AgentMap Low_pd_ptr = partition_label Low\"\n \"Sys1AgentMap High_pd_ptr = partition_label High\"\n \"Sys1AgentMap Low_pt_ptr = partition_label Low\"\n \"Sys1AgentMap High_pt_ptr = partition_label High\"\n \"Sys1AgentMap Low_tcb_ptr = partition_label Low\"\n \"Sys1AgentMap High_tcb_ptr = partition_label High\"\n \"Sys1AgentMap idle_tcb_ptr = partition_label Low\"\n \"\\p. p \\ ptr_range shared_page_ptr_virt (pageBitsForSize RISCVLargePage)\n \\ Sys1AgentMap p = partition_label Low\"\n unfolding Sys1AgentMap_def\n apply simp_all\n by (auto simp: s0_ptr_defs ptr_range_def)\n\ndefinition Sys1ASIDMap :: \"(auth_graph_label subject_label) agent_asid_map\" where\n \"Sys1ASIDMap \\\n (\\x. if asid_high_bits_of x = asid_high_bits_of Low_asid\n then partition_label Low\n else if asid_high_bits_of x = asid_high_bits_of High_asid\n then partition_label High\n else if asid_high_bits_of x = asid_high_bits_of Silc_asid\n then SilcLabel\n else undefined)\"\n\n(* We include 2 domains, Low is associated to domain 0, High to domain 1,\n we default the rest of the possible domains to High *)\n\ndefinition Sys1PAS :: \"(auth_graph_label subject_label) PAS\" where\n \"Sys1PAS \\\n \\pasObjectAbs = Sys1AgentMap,\n pasASIDAbs = Sys1ASIDMap,\n pasIRQAbs = (\\_. partition_label IRQ0),\n pasPolicy = Sys1AuthGraph,\n pasSubject = partition_label Low,\n pasMayActivate = True,\n pasMayEditReadyQueues = True, pasMaySendIrqs = False,\n pasDomainAbs = ((\\_. {partition_label High})(0 := {partition_label Low}))\\\"\n\n\nsubsubsection \\Proof of pas_refined for Sys1\\\n\nlemma High_caps_well_formed: \"well_formed_cnode_n 10 High_caps\"\n by (auto simp: High_caps_def well_formed_cnode_n_def split: if_split_asm)\n\nlemma Low_caps_well_formed: \"well_formed_cnode_n 10 Low_caps\"\n by (auto simp: Low_caps_def well_formed_cnode_n_def split: if_split_asm)\n\nlemma Silc_caps_well_formed: \"well_formed_cnode_n 10 Silc_caps\"\n by (auto simp: Silc_caps_def well_formed_cnode_n_def split: if_split_asm)\n\nlemma s0_caps_of_state :\n \"caps_of_state s0_internal p = Some cap \\\n cap = NullCap \\\n (p,cap) \\\n { ((Low_cnode_ptr,(the_nat_to_bl_10 1)), ThreadCap Low_tcb_ptr),\n ((Low_cnode_ptr,(the_nat_to_bl_10 2)), CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)),\n ((Low_cnode_ptr,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0)))),\n ((Low_cnode_ptr,(the_nat_to_bl_10 6)), ArchObjectCap (PageTableCap Low_pt_ptr (Some (Low_asid,0)))),\n ((Low_cnode_ptr,(the_nat_to_bl_10 4)), ArchObjectCap (ASIDPoolCap Low_pool_ptr Low_asid)),\n ((Low_cnode_ptr,(the_nat_to_bl_10 5)), ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_write RISCVLargePage False (Some (Low_asid, 0)))),\n ((Low_cnode_ptr,(the_nat_to_bl_10 318)), NotificationCap ntfn_ptr 0 {AllowSend}),\n ((High_cnode_ptr,(the_nat_to_bl_10 1)), ThreadCap High_tcb_ptr),\n ((High_cnode_ptr,(the_nat_to_bl_10 2)), CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)),\n ((High_cnode_ptr,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0)))),\n ((High_cnode_ptr,(the_nat_to_bl_10 6)), ArchObjectCap (PageTableCap High_pt_ptr (Some (High_asid,0)))),\n ((High_cnode_ptr,(the_nat_to_bl_10 4)), ArchObjectCap (ASIDPoolCap High_pool_ptr High_asid)),\n ((High_cnode_ptr,(the_nat_to_bl_10 5)), ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (High_asid, 0)))),\n ((High_cnode_ptr,(the_nat_to_bl_10 318)), NotificationCap ntfn_ptr 0 {AllowRecv}) ,\n ((Silc_cnode_ptr,(the_nat_to_bl_10 2)), CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2)),\n ((Silc_cnode_ptr,(the_nat_to_bl_10 5)), ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (Silc_asid, 0)))),\n ((Silc_cnode_ptr,(the_nat_to_bl_10 318)), NotificationCap ntfn_ptr 0 {AllowSend}),\n ((Low_tcb_ptr,(tcb_cnode_index 0)), CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)),\n ((Low_tcb_ptr,(tcb_cnode_index 1)), ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0)))),\n ((Low_tcb_ptr,(tcb_cnode_index 2)), ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}),\n ((Low_tcb_ptr,(tcb_cnode_index 3)), NullCap),\n ((Low_tcb_ptr,(tcb_cnode_index 4)), NullCap),\n ((High_tcb_ptr,(tcb_cnode_index 0)), CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)),\n ((High_tcb_ptr,(tcb_cnode_index 1)), ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0)))),\n ((High_tcb_ptr,(tcb_cnode_index 2)), ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}),\n ((High_tcb_ptr,(tcb_cnode_index 3)), NullCap),\n ((High_tcb_ptr,(tcb_cnode_index 4)), NullCap)} \"\n supply if_cong[cong]\n apply (insert High_caps_well_formed)\n apply (insert Low_caps_well_formed)\n apply (insert Silc_caps_well_formed)\n apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n apply (case_tac p, clarsimp)\n apply (clarsimp split: if_splits)\n apply (clarsimp simp: cte_wp_at_cases tcb_cap_cases_def split: if_split_asm)+\n apply (clarsimp simp: Silc_caps_def split: if_splits)\n apply (clarsimp simp: High_caps_def split: if_splits)\n apply (clarsimp simp: Low_caps_def split: if_splits)\n done\n\nlemma tcb_states_of_state_s0:\n \"tcb_states_of_state s0_internal = [High_tcb_ptr \\ thread_state.BlockedOnNotification ntfn_ptr,\n Low_tcb_ptr \\ thread_state.Running,\n idle_tcb_ptr \\ thread_state.IdleThreadState ]\"\n unfolding s0_internal_def tcb_states_of_state_def\n by (auto simp: get_tcb_def kh0_def kh0_obj_def)\n\nlemma thread_bounds_of_state_s0:\n \"thread_bound_ntfns s0_internal = Map.empty\"\n unfolding s0_internal_def thread_bound_ntfns_def\n by (auto simp: get_tcb_def kh0_def kh0_obj_def)\n\nlemma Sys1_wellformed':\n \"policy_wellformed (pasPolicy Sys1PAS) False irqs x\"\n by (clarsimp simp: Sys1PAS_def Sys1AgentMap_simps Sys1AuthGraph_def policy_wellformed_def)\n\ncorollary Sys1_wellformed:\n \"x \\ range (pasObjectAbs Sys1PAS) \\ \\(range (pasDomainAbs Sys1PAS)) - {SilcLabel}\n \\ policy_wellformed (pasPolicy Sys1PAS) False irqs x\"\n by (rule Sys1_wellformed')\n\nlemma Sys1_pas_wellformed:\n \"pas_wellformed Sys1PAS\"\n by (clarsimp simp: Sys1PAS_def Sys1AgentMap_simps Sys1AuthGraph_def policy_wellformed_def)\n\nlemma domains_of_state_s0[simp]:\n \"domains_of_state s0_internal = {(High_tcb_ptr, High_domain),\n (Low_tcb_ptr, Low_domain),\n (idle_tcb_ptr, default_domain)}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply clarsimp\n apply (erule domains_of_state_aux.cases)\n apply (clarsimp simp: s0_internal_def exst0_def ekh0_obj_def split: if_split_asm)\n apply (force simp: s0_internal_def exst0_def ekh0_obj_def intro: domains_of_state_aux.domtcbs)+\n done\n\nlemma pool_for_asid_s0:\n \"pool_for_asid asid s0_internal = (if asid_high_bits_of asid = asid_high_bits_of High_asid\n then Some High_pool_ptr\n else if asid_high_bits_of asid = asid_high_bits_of Low_asid\n then Some Low_pool_ptr\n else None)\"\n by (clarsimp simp: pool_for_asid_def s0_internal_def arch_state0_def)\n\nlemma asid_pools_of_s0:\n \"asid_pools_of s0_internal = [Low_pool_ptr \\ Low_pool', High_pool_ptr \\ High_pool']\"\n by (auto simp: asid_pools_of_ko_at obj_at_def s0_internal_def opt_map_def kh0_def kh0_obj_def\n split: option.splits)\n\nlemma pts_of_s0:\n \"pts_of s0_internal = [Low_pd_ptr \\ Low_pd',\n High_pd_ptr \\ High_pd',\n Low_pt_ptr \\ Low_pt',\n High_pt_ptr \\ High_pt',\n riscv_global_pt_ptr \\ init_global_pt']\"\n by (auto simp: opt_map_def s0_internal_def kh0_def kh0_obj_def\n split: option.splits if_splits)+\n\n\nlemma ptes_of_s0_PageTablePTE:\n \"\\ ptes_of s0_internal ptr = Some pte; is_PageTablePTE pte \\\n \\ table_base ptr = Low_pd_ptr \\ pte = PageTablePTE (ppn_from_addr (addrFromPPtr Low_pt_ptr)) {}\n \\ table_base ptr = High_pd_ptr \\ pte = PageTablePTE (ppn_from_addr (addrFromPPtr High_pt_ptr)) {}\"\n by (auto simp: ptes_of_def pts_of_s0 obind_def kh0_obj_def split: option.splits if_splits)\n\nlemma Low_pt_is_aligned[simp]:\n \"is_aligned Low_pt_ptr pt_bits\"\n by (clarsimp simp: s0_ptr_defs pt_bits_def table_size_def ptTranslationBits_def pte_bits_def word_size_bits_def is_aligned_def)\n\nlemma High_pt_is_aligned[simp]:\n \"is_aligned High_pt_ptr pt_bits\"\n by (clarsimp simp: s0_ptr_defs pt_bits_def table_size_def ptTranslationBits_def pte_bits_def word_size_bits_def is_aligned_def)\n\nlemma Low_pd_is_aligned[simp]:\n \"is_aligned Low_pd_ptr pt_bits\"\n by (clarsimp simp: s0_ptr_defs pt_bits_def table_size_def ptTranslationBits_def pte_bits_def word_size_bits_def is_aligned_def)\n\nlemma High_pd_is_aligned[simp]:\n \"is_aligned High_pd_ptr pt_bits\"\n by (clarsimp simp: s0_ptr_defs pt_bits_def table_size_def ptTranslationBits_def pte_bits_def word_size_bits_def is_aligned_def)\n\nlemma shared_page_ptr_is_aligned[simp]:\n \"is_aligned shared_page_ptr_virt pt_bits\"\n by (clarsimp simp: s0_ptr_defs pt_bits_def table_size_def ptTranslationBits_def pte_bits_def word_size_bits_def is_aligned_def)\n\nlemma vs_lookup_s0_SomeD:\n \"vs_lookup_table lvl asid vref s0_internal = Some (lvl', p)\n \\ (asid_high_bits_of asid = asid_high_bits_of High_asid \\ lvl' = asid_pool_level \\ p = High_pool_ptr\n \\ asid_high_bits_of asid = asid_high_bits_of Low_asid \\ lvl' = asid_pool_level \\ p = Low_pool_ptr\n \\ asid = High_asid \\ lvl' = max_pt_level \\ p = High_pd_ptr\n \\ asid = Low_asid \\ lvl' = max_pt_level \\ p = Low_pd_ptr\n \\ asid = High_asid \\ lvl' = max_pt_level - 1 \\ p = High_pt_ptr\n \\ asid = Low_asid \\ lvl' = max_pt_level - 1 \\ p = Low_pt_ptr)\"\n apply (clarsimp simp: vs_lookup_table_def obind_def split: option.splits if_splits)\n apply (clarsimp simp: pool_for_asid_s0 split: if_splits)\n apply (case_tac \"lvl = max_pt_level\")\n apply (clarsimp simp: asid_pools_of_s0 pool_for_asid_s0 asid_high_low vspace_for_pool_def\n split: if_splits)\n apply (case_tac \"lvl = max_pt_level - 1\")\n apply (clarsimp simp: pt_walk.simps split: if_splits)\n apply (drule (1) ptes_of_s0_PageTablePTE)\n apply (auto simp: pptr_from_pte_def ptrFromPAddr_addr_from_ppn' ptes_of_def asid_high_low\n kh0_obj_def pts_of_s0 pool_for_asid_s0 asid_pools_of_s0 vspace_for_pool_def\n split: if_splits)[2]\n apply (clarsimp simp: pt_walk.simps)\n apply (clarsimp split: if_splits)\n apply (drule (1) ptes_of_s0_PageTablePTE)\n apply (erule disjE; clarsimp)\n by (clarsimp simp: pptr_from_pte_def ptrFromPAddr_addr_from_ppn' kh0_obj_def\n pt_walk.simps ptes_of_def pts_of_s0 asid_high_low\n pool_for_asid_s0 asid_pools_of_s0 vspace_for_pool_def\n split: if_splits)+\n\nlemma pt_bits_left_max_minus_1_pageBitsForSize:\n \"pt_bits_left (max_pt_level - 1) = pageBitsForSize RISCVLargePage\"\n apply (clarsimp simp: pt_bits_left_def max_pt_level_def2)\n done\n\nlemma Sys1_pas_refined:\n \"pas_refined Sys1PAS s0_internal\"\n apply (clarsimp simp: pas_refined_def)\n apply (intro conjI)\n apply (simp add: Sys1_pas_wellformed)\n apply (clarsimp simp: irq_map_wellformed_aux_def s0_internal_def Sys1AgentMap_def Sys1PAS_def)\n apply (clarsimp simp: s0_ptr_defs ptr_range_def)\n apply word_bitwise\n apply (clarsimp simp: tcb_domain_map_wellformed_aux_def minBound_word High_domain_def Low_domain_def\n Sys1PAS_def Sys1AgentMap_def default_domain_def)\n apply (clarsimp simp: auth_graph_map_def Sys1PAS_def state_objs_to_policy_def state_bits_to_policy_def)\n apply (erule state_bits_to_policyp.cases; clarsimp)\n apply (drule s0_caps_of_state, clarsimp)\n apply (simp add: Sys1AuthGraph_def)\n apply (elim disjE; clarsimp simp: Sys1AgentMap_simps cap_auth_conferred_def ptr_range_def\n arch_cap_auth_conferred_def vspace_cap_rights_to_auth_def\n vm_read_write_def vm_read_only_def cap_rights_to_auth_def)\n apply (drule s0_caps_of_state, clarsimp)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: state_refs_of_def thread_st_auth_def tcb_states_of_state_s0\n Sys1AuthGraph_def Sys1AgentMap_simps split: if_splits)\n apply (clarsimp simp: state_refs_of_def thread_st_auth_def thread_bounds_of_state_s0)\n apply (simp add: s0_internal_def) (* this is OK because cdt is empty..*)\n apply (simp add: s0_internal_def) (* this is OK because cdt is empty..*)\n apply (clarsimp simp: state_vrefs_def)\n apply (drule vs_lookup_s0_SomeD)\n apply (elim disjE; clarsimp)\n apply ((clarsimp simp: s0_internal_def kh0_obj_def opt_map_def vs_refs_aux_def\n vm_read_only_def vspace_cap_rights_to_auth_def pte_ref2_def\n Sys1AuthGraph_def Sys1AgentMap_simps graph_of_def ptrFromPAddr_addr_from_ppn'\n shared_page_ptr_phys_def pt_bits_left_max_minus_1_pageBitsForSize\n dest!: kh0_SomeD split: option.splits if_splits)+)[6]\n apply (rule subsetI, clarsimp)\n apply (erule state_asids_to_policy_aux.cases)\n apply (drule s0_caps_of_state, clarsimp)\n apply (fastforce simp: Sys1AuthGraph_def Sys1PAS_def Sys1ASIDMap_def Sys1AgentMap_def\n Low_asid_def High_asid_def Silc_asid_def\n asid_low_bits_def asid_high_bits_of_def)\n apply (clarsimp simp: state_vrefs_def)\n apply (drule vs_lookup_s0_SomeD)\n apply (clarsimp simp: vs_refs_aux_def s0_internal_def arch_state0_def kh0_def kh0_obj_def\n Sys1PAS_def Sys1ASIDMap_def Sys1AgentMap_simps Sys1AuthGraph_def\n opt_map_def graph_of_def split: if_splits)\n apply (clarsimp simp: Sys1PAS_def Sys1ASIDMap_def Sys1AgentMap_simps Sys1AuthGraph_def\n s0_internal_def arch_state0_def split: if_splits)\n apply (fastforce elim: state_irqs_to_policy_aux.cases dest: s0_caps_of_state)\n done\n\nlemma Sys1_pas_cur_domain:\n \"pas_cur_domain Sys1PAS s0_internal\"\n by (simp add: s0_internal_def exst0_def Sys1PAS_def)\n\nlemma Sys1_current_subject_idemp:\n \"Sys1PAS\\pasSubject := the_elem (pasDomainAbs Sys1PAS (cur_domain s0_internal))\\ = Sys1PAS\"\n by (simp add: Sys1PAS_def s0_internal_def exst0_def)\n\nlemma pasMaySendIrqs_Sys1PAS[simp]:\n \"pasMaySendIrqs Sys1PAS = False\"\n by(auto simp: Sys1PAS_def)\n\nlemma Sys1_pas_domains_distinct:\n \"pas_domains_distinct Sys1PAS\"\n by (clarsimp simp: Sys1PAS_def pas_domains_distinct_def)\n\nlemma Sys1_pas_wellformed_noninterference:\n \"pas_wellformed_noninterference Sys1PAS\"\n apply (simp add: pas_wellformed_noninterference_def)\n apply (intro conjI ballI allI)\n apply (blast intro: Sys1_wellformed)\n apply (clarsimp simp: Sys1PAS_def policy_wellformed_def Sys1AuthGraph_def)\n apply (rule Sys1_pas_domains_distinct)\n done\n\nlemma Sys1AgentMap_shared_page_ptr:\n \"Sys1AgentMap shared_page_ptr_virt = partition_label Low\"\n by (clarsimp simp: Sys1AgentMap_def s0_ptr_defs ptr_range_def bit_simps)\n\nlemma silc_inv_s0:\n \"silc_inv Sys1PAS s0_internal s0_internal\"\n apply (clarsimp simp: silc_inv_def)\n apply (rule conjI, simp add: Sys1PAS_def)\n apply (rule conjI)\n apply (clarsimp simp: Sys1PAS_def Sys1AgentMap_def s0_internal_def kh0_def obj_at_def kh0_obj_def\n is_cap_table_def Silc_caps_well_formed split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: Sys1PAS_def Sys1AuthGraph_def)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=Silc_cnode_ptr in exI)\n apply (rule conjI)\n apply (subgoal_tac \"(Silc_cnode_ptr,the_nat_to_bl_10 318) \\ slots_holding_overlapping_caps cap s0_internal\n \\ (Silc_cnode_ptr, the_nat_to_bl_10 5) \\ slots_holding_overlapping_caps cap s0_internal\")\n apply fastforce\n apply clarsimp\n apply (clarsimp simp: slots_holding_overlapping_caps_def2)\n apply (case_tac \"cap = NullCap\")\n apply clarsimp\n apply (simp add: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n apply (case_tac a, clarsimp)\n apply (clarsimp split: if_splits)\n apply ((clarsimp simp: intra_label_cap_def cte_wp_at_cases tcb_cap_cases_def\n cap_points_to_label_def split: if_split_asm)+)[8]\n apply (clarsimp simp: intra_label_cap_def cap_points_to_label_def)\n apply (drule cte_wp_at_caps_of_state' s0_caps_of_state)+\n apply ((erule disjE |\n clarsimp simp: Sys1PAS_def Sys1AgentMap_simps\n the_nat_to_bl_def nat_to_bl_def ctes_wp_at_def cte_wp_at_cases\n s0_internal_def kh0_def kh0_obj_def Silc_caps_well_formed obj_refs_def\n | simp add: Silc_caps_def)+)[1]\n apply (clarsimp simp: Sys1PAS_def Sys1AgentMap_def)\n apply (intro conjI)\n apply (clarsimp simp: all_children_def s0_internal_def silc_dom_equiv_def equiv_for_refl)\n apply (clarsimp simp: all_children_def s0_internal_def silc_dom_equiv_def equiv_for_refl)\n apply (clarsimp simp: Invariants_AI.cte_wp_at_caps_of_state )\n by (auto simp:is_transferable.simps dest:s0_caps_of_state)\n\n\nlemma only_timer_irq_s0:\n \"only_timer_irq timer_irq s0_internal\"\n apply (clarsimp simp: only_timer_irq_def s0_internal_def irq_is_recurring_def is_irq_at_def\n irq_at_def Let_def irq_oracle_def machine_state0_def timer_irq_def)\n apply presburger\n done\n\nlemma domain_sep_inv_s0:\n \"domain_sep_inv False s0_internal s0_internal\"\n apply (clarsimp simp: domain_sep_inv_def)\n apply (force dest: cte_wp_at_caps_of_state' s0_caps_of_state\n | rule conjI allI | clarsimp simp: s0_internal_def)+\n done\n\nlemma only_timer_irq_inv_s0:\n \"only_timer_irq_inv timer_irq s0_internal s0_internal\"\n by (simp add: only_timer_irq_inv_def only_timer_irq_s0 domain_sep_inv_s0)\n\nlemma Sys1_guarded_pas_domain:\n \"guarded_pas_domain Sys1PAS s0_internal\"\n by (clarsimp simp: guarded_pas_domain_def Sys1PAS_def s0_internal_def exst0_def Sys1AgentMap_simps)\n\nlemma s0_valid_domain_list:\n \"valid_domain_list s0_internal\"\n by (clarsimp simp: valid_domain_list_2_def s0_internal_def exst0_def)\n\ndefinition\n \"s0 \\ ((if ct_idle s0_internal then idle_context s0_internal else s0_context,s0_internal),KernelExit)\"\n\n\nsubsubsection \\einvs\\\n\nlemma well_formed_cnode_n_s0_caps[simp]:\n \"well_formed_cnode_n 10 High_caps\"\n \"well_formed_cnode_n 10 Low_caps\"\n \"well_formed_cnode_n 10 Silc_caps\"\n \"\\ well_formed_cnode_n 10 [[] \\ NullCap]\"\n apply (simp add: High_caps_well_formed Low_caps_well_formed Silc_caps_well_formed)+\n apply (fastforce simp: well_formed_cnode_n_def dest: eqset_imp_iff[where x=\"[]\"])\n done\n\nlemma valid_caps_s0[simp]:\n \"s0_internal \\ ThreadCap Low_tcb_ptr\"\n \"s0_internal \\ ThreadCap High_tcb_ptr\"\n \"s0_internal \\ CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n \"s0_internal \\ CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n \"s0_internal \\ CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n \"s0_internal \\ ArchObjectCap (ASIDPoolCap Low_pool_ptr Low_asid)\"\n \"s0_internal \\ ArchObjectCap (ASIDPoolCap High_pool_ptr High_asid)\"\n \"s0_internal \\ ArchObjectCap (PageTableCap Low_pd_ptr (Some (Low_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (PageTableCap High_pd_ptr (Some (High_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (PageTableCap Low_pt_ptr (Some (Low_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (PageTableCap High_pt_ptr (Some (High_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_write RISCVLargePage False (Some (Low_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (High_asid,0)))\"\n \"s0_internal \\ ArchObjectCap (FrameCap shared_page_ptr_virt vm_read_only RISCVLargePage False (Some (Silc_asid,0)))\"\n \"s0_internal \\ NotificationCap ntfn_ptr 0 {AllowWrite}\"\n \"s0_internal \\ NotificationCap ntfn_ptr 0 {AllowRead}\"\n \"s0_internal \\ ReplyCap Low_tcb_ptr True {AllowGrant,AllowWrite}\"\n \"s0_internal \\ ReplyCap High_tcb_ptr True {AllowGrant,AllowWrite}\"\n by (auto simp: s0_internal_def s0_ptr_defs kh0_def kh0_obj_def bit_simps word_bits_def\n valid_cap_def cap_aligned_def is_aligned_def obj_at_def cte_level_bits_def\n is_ntfn_def is_tcb_def is_cap_table_def a_type_def the_nat_to_bl_def nat_to_bl_def\n Low_asid_def High_asid_def Silc_asid_def asid_low_bits_def asid_bits_def\n wellformed_mapdata_def valid_vm_rights_def vmsz_aligned_def)\n\nlemma valid_obj_s0[simp]:\n \"valid_obj Low_cnode_ptr Low_cnode s0_internal\"\n \"valid_obj High_cnode_ptr High_cnode s0_internal\"\n \"valid_obj High_pool_ptr High_pool s0_internal\"\n \"valid_obj Low_pool_ptr Low_pool s0_internal\"\n \"valid_obj Silc_cnode_ptr Silc_cnode s0_internal\"\n \"valid_obj ntfn_ptr ntfn s0_internal\"\n \"valid_obj irq_cnode_ptr irq_cnode s0_internal\"\n \"valid_obj Low_pd_ptr Low_pd s0_internal\"\n \"valid_obj High_pd_ptr High_pd s0_internal\"\n \"valid_obj Low_pt_ptr Low_pt s0_internal\"\n \"valid_obj High_pt_ptr High_pt s0_internal\"\n \"valid_obj Low_tcb_ptr Low_tcb s0_internal\"\n \"valid_obj High_tcb_ptr High_tcb s0_internal\"\n \"valid_obj idle_tcb_ptr idle_tcb s0_internal\"\n \"valid_obj riscv_global_pt_ptr init_global_pt s0_internal\"\n \"valid_obj shared_page_ptr_virt shared_page s0_internal\"\n apply (simp_all add: valid_obj_def kh0_obj_def)\n apply (simp add: valid_cs_def Low_caps_ran High_caps_ran Silc_caps_ran\n valid_cs_size_def word_bits_def cte_level_bits_def)+\n apply (simp add: valid_ntfn_def obj_at_def s0_internal_def kh0_def High_tcb_def is_tcb_def)\n apply (simp add: valid_cs_def valid_cs_size_def word_bits_def\n cte_level_bits_def well_formed_cnode_n_def)\n apply (clarsimp simp: valid_tcb_def tcb_cap_cases_def valid_tcb_state_def valid_arch_tcb_def\n is_valid_vtable_root_def is_master_reply_cap_def is_ntfn_def obj_at_def\n wellformed_pte_def valid_vm_rights_def vm_kernel_only_def\n | fastforce simp: s0_internal_def kh0_def kh0_obj_def)+\n done\n\nlemma valid_objs_s0:\n \"valid_objs s0_internal\"\n apply (clarsimp simp: valid_objs_def)\n apply (subst (asm) s0_internal_def, clarsimp)\n apply (drule kh0_SomeD)\n apply (elim disjE; clarsimp)\n apply (fastforce simp: valid_obj_def valid_cs_def valid_cs_size_def\n cte_level_bits_def word_bits_def well_formed_cnode_n_def)\n done\n\nlemma pspace_aligned_s0:\n \"pspace_aligned s0_internal\"\n apply (clarsimp simp: pspace_aligned_def s0_internal_def)\n apply (drule kh0_SomeD)\n apply (auto simp: cte_level_bits_def irq_node_offs_range_def\n is_aligned_def s0_ptr_defs kh0_obj_def bit_simps)\n done\n\nlemma pspace_distinct_s0:\n \"pspace_distinct s0_internal\"\n apply (clarsimp simp: pspace_distinct_def s0_internal_def)\n apply (drule kh0_SomeD)+\n apply (case_tac \"x \\ irq_node_offs_range \\ y \\ irq_node_offs_range\")\n apply clarsimp\n apply (drule irq_node_offs_range_correct)+\n apply clarsimp\n apply (clarsimp simp: s0_ptr_defs cte_level_bits_def)\n apply word_bitwise\n apply auto[1]\n apply (elim disjE)\n (* slow *)\n by (simp | clarsimp simp: kh0_obj_def cte_level_bits_def s0_ptr_defs pte_bits_def bit_simps\n | fastforce\n | clarsimp simp: irq_node_offs_range_def s0_ptr_defs,\n drule_tac x=\"0x1F\" in word_plus_strict_mono_right, simp, simp add: add.commute,\n drule(1) notE[rotated, OF less_trans, OF _ _ leD, rotated 2]\n | drule(1) notE[rotated, OF le_less_trans, OF _ _ leD, rotated 2], simp, assumption)+\n\nlemma valid_pspace_s0[simp]:\n \"valid_pspace s0_internal\"\n apply (simp add: valid_pspace_def pspace_distinct_s0 pspace_aligned_s0 valid_objs_s0)\n apply (rule conjI)\n apply (clarsimp simp: if_live_then_nonz_cap_def)\n apply (subst (asm) s0_internal_def)\n apply (clarsimp simp: ex_nonz_cap_to_def live_def hyp_live_def obj_at_def kh0_def kh0_obj_def\n split: if_splits)\n apply (rule_tac x=\"High_cnode_ptr\" in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n apply (force simp: s0_internal_def kh0_def kh0_obj_def High_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n apply (rule_tac x=\"Low_cnode_ptr\" in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n apply (force simp: s0_internal_def kh0_def kh0_obj_def Low_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n apply (rule_tac x=\"High_cnode_ptr\" in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 318\" in exI)\n apply (force simp: s0_internal_def kh0_def kh0_obj_def High_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n apply (intro conjI)\n apply (force dest: s0_caps_of_state simp: cte_wp_at_caps_of_state zombies_final_def is_zombie_def)\n apply (clarsimp simp: sym_refs_def state_refs_of_def state_hyp_refs_of_def\n refs_of_def s0_internal_def kh0_def kh0_obj_def)\n apply (clarsimp simp: sym_refs_def state_hyp_refs_of_def s0_internal_def kh0_def)\n done\n\nlemma descendants_s0[simp]:\n \"descendants_of (a, b) (cdt s0_internal) = {}\"\n apply (rule set_eqI)\n apply clarsimp\n apply (drule descendants_of_NoneD[rotated])\n apply (simp add: s0_internal_def)+\n done\n\nlemma valid_mdb_s0[simp]:\n \"valid_mdb s0_internal\"\n apply (simp add: valid_mdb_def reply_mdb_def)\n apply (intro conjI)\n apply (clarsimp simp: mdb_cte_at_def s0_internal_def)\n apply (force dest: s0_caps_of_state simp: untyped_mdb_def)\n apply (clarsimp simp: descendants_inc_def)\n apply (clarsimp simp: no_mloop_def s0_internal_def cdt_parent_defs)\n apply (clarsimp simp: untyped_inc_def)\n apply (drule s0_caps_of_state)+\n apply ((simp | erule disjE)+)[1]\n apply (force dest: s0_caps_of_state simp: ut_revocable_def)\n apply (force dest: s0_caps_of_state simp: irq_revocable_def)\n apply (clarsimp simp: reply_master_revocable_def)\n apply (drule s0_caps_of_state)\n apply ((simp add: is_master_reply_cap_def s0_internal_def s0_ptr_defs | erule disjE)+)[1]\n apply (force dest: s0_caps_of_state simp: reply_caps_mdb_def)\n apply (clarsimp simp: reply_masters_mdb_def)\n apply (simp add: s0_internal_def)\n apply (clarsimp simp: valid_arch_mdb_def)\n done\n\nlemma valid_ioc_s0[simp]:\n \"valid_ioc s0_internal\"\n by (clarsimp simp: cte_wp_at_cases valid_ioc_def s0_internal_def kh0_def kh0_obj_def)\n\nlemma valid_idle_s0[simp]:\n \"valid_idle s0_internal\"\n by (clarsimp simp: valid_idle_def valid_arch_idle_def pred_tcb_at_def obj_at_def\n idle_thread_ptr_def idle_tcb_def kh0_def s0_ptr_defs s0_internal_def)\n\nlemma only_idle_s0[simp]:\n \"only_idle s0_internal\"\n apply (clarsimp simp: only_idle_def st_tcb_at_tcb_states_of_state_eq\n identity_eq[symmetric] tcb_states_of_state_s0)\n apply (simp add: s0_ptr_defs s0_internal_def)\n done\n\nlemma if_unsafe_then_cap_s0[simp]:\n \"if_unsafe_then_cap s0_internal\"\n apply (clarsimp simp: if_unsafe_then_cap_def ex_cte_cap_wp_to_def)\n apply (drule s0_caps_of_state)\n apply (case_tac \"a=Low_cnode_ptr\")\n apply (rule_tac x=Low_tcb_ptr in exI, rule_tac x=\"tcb_cnode_index 0\" in exI)\n apply (fastforce simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n apply (case_tac \"a=High_cnode_ptr\")\n apply (rule_tac x=High_tcb_ptr in exI, rule_tac x=\"tcb_cnode_index 0\" in exI)\n apply (fastforce simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n apply (case_tac \"a=Low_tcb_ptr\")\n apply (rule_tac x=Low_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n apply (fastforce simp: s0_internal_def kh0_def kh0_obj_def Low_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n apply (case_tac \"a=High_tcb_ptr\")\n apply (rule_tac x=High_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n apply (fastforce simp: s0_internal_def kh0_def kh0_obj_def High_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n apply (rule_tac x=Silc_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 2\" in exI)\n apply (fastforce simp: s0_internal_def kh0_def kh0_obj_def Silc_caps_def\n cte_wp_at_cases well_formed_cnode_n_def)\n done\n\nlemma valid_reply_caps_s0[simp]:\n \"valid_reply_caps s0_internal\"\n apply (clarsimp simp: valid_reply_caps_def)\n apply (rule conjI)\n apply (force dest: s0_caps_of_state\n simp: cte_wp_at_caps_of_state has_reply_cap_def is_reply_cap_to_def)\n apply (clarsimp simp: unique_reply_caps_def)\n apply (drule s0_caps_of_state)+\n apply (erule disjE | simp add: is_reply_cap_def)+\n done\n\nlemma valid_reply_masters_s0[simp]:\n \"valid_reply_masters s0_internal\"\n apply (clarsimp simp: valid_reply_masters_def)\n apply (force dest: s0_caps_of_state simp: cte_wp_at_caps_of_state is_master_reply_cap_to_def)\n done\n\nlemma valid_global_refs_s0[simp]:\n \"valid_global_refs s0_internal\"\n apply (clarsimp simp: valid_global_refs_def valid_refs_def cte_wp_at_caps_of_state)\n apply (drule s0_caps_of_state)\n apply (clarsimp simp: global_refs_def s0_internal_def arch_state0_def)\n apply (erule disjE | simp add: cap_range_def\n | clarsimp simp: irq_node_offs_distinct[symmetric]\n | simp only: s0_ptr_defs, force)+\n done\n\nlemma valid_arch_state_s0[simp]:\n \"valid_arch_state s0_internal\"\n apply (clarsimp simp: valid_arch_state_def s0_internal_def arch_state0_def)\n apply (intro conjI)\n apply (auto simp: valid_asid_table_def kh0_def kh0_obj_def opt_map_def split: option.splits)[1]\n apply (fastforce simp: valid_global_arch_objs_def obj_at_def kh0_def a_type_def\n init_global_pt_def max_pt_level_not_asid_pool_level[symmetric])\n apply (clarsimp simp: valid_global_tables_def pt_walk.simps obind_def)\n apply (fastforce dest: pt_walk_max_level\n simp: obind_def opt_map_def asid_pool_level_eq geq_max_pt_level pte_of_def kh0_def\n kh0_obj_def pte_rights_of_def\n split: if_splits)\n done\n\nlemma valid_irq_node_s0[simp]:\n \"valid_irq_node s0_internal\"\n apply (clarsimp simp: valid_irq_node_def)\n apply (rule conjI)\n apply (simp add: s0_internal_def)\n apply (rule injI)\n apply simp\n apply (rule ccontr)\n apply (rule_tac bnd=\"0x40\" and 'a=64 in shift_distinct_helper[rotated 3])\n apply assumption\n apply simp\n apply simp\n apply (rule ucast_less[where 'b=6, simplified])\n apply simp\n apply (rule ucast_less[where 'b=6, simplified])\n apply simp\n apply (rule notI)\n apply (drule ucast_up_inj)\n apply simp\n apply simp\n apply (clarsimp simp: obj_at_def s0_internal_def)\n apply (force simp: kh0_def is_cap_table_def well_formed_cnode_n_def dom_empty_cnode)\n done\n\nlemma valid_irq_handlers_s0[simp]:\n \"valid_irq_handlers s0_internal\"\n apply (clarsimp simp: valid_irq_handlers_def ran_def)\n apply (force dest: s0_caps_of_state)\n done\n\nlemma valid_irq_state_s0[simp]:\n \"valid_irq_states s0_internal\"\n by (clarsimp simp: valid_irq_states_def valid_irq_masks_def s0_internal_def machine_state0_def)\n\nlemma valid_machine_state_s0[simp]:\n \"valid_machine_state s0_internal\"\n by (clarsimp simp: valid_machine_state_def s0_internal_def const_def\n machine_state0_def in_user_frame_def obj_at_def)\n\nlemma valid_arch_objs_s0[simp]:\n \"valid_vspace_objs s0_internal\"\n apply (clarsimp simp: valid_vspace_objs_def obj_at_def)\n apply (drule vs_lookup_s0_SomeD)\n apply (auto simp: aobjs_of_Some kh_s0_def kh0_obj_def data_at_def obj_at_def\n ptrFromPAddr_addr_from_ppn' vmpage_size_of_level_def max_pt_level_def2\n shared_page_ptr_phys_def)\n done\n\nlemma valid_vs_lookup_s0_internal:\n \"valid_vs_lookup s0_internal\"\n supply pt_simps = pt_slot_offset_def pt_bits_left_def pt_index_def max_pt_level_def2\n supply user_region_simps = user_region_def canonical_user_def\n supply caps_of_state_simps = caps_of_state_def get_cap_def gets_def get_def get_object_def\n assert_def assert_opt_def fail_def return_def bind_def\n apply (clarsimp simp: valid_vs_lookup_def vs_lookup_target_def vs_lookup_slot_def split: if_splits)\n \\ \\asid pool level\\\n apply (drule vs_lookup_level)\n apply (clarsimp simp: pool_for_asid_vs_lookup pool_for_asid_s0 asid_pools_of_s0\n vspace_for_pool_def user_region_def vref_for_level_asid_pool\n dest!: asid_high_low split: if_splits)\n \\ \\High asid\\\n apply (rule conjI, clarsimp simp: High_asid_def asid_low_bits_def)\n apply (rule_tac x=High_cnode_ptr in exI)\n apply (rule_tac x=\"(the_nat_to_bl_10 3)\" in exI)\n apply (fastforce simp: High_cnode_def High_caps_def caps_of_state_def get_cap_def get_object_def\n gets_def get_def assert_def assert_opt_def fail_def return_def bind_def\n s0_internal_def kh0_def well_formed_cnode_n_def)\n \\ \\Low asid\\\n apply (rule conjI, clarsimp simp: Low_asid_def asid_low_bits_def)\n apply (rule_tac x=Low_cnode_ptr in exI)\n apply (rule_tac x=\"(the_nat_to_bl_10 3)\" in exI)\n apply (fastforce simp: Low_cnode_def Low_caps_def caps_of_state_def get_cap_def get_object_def\n gets_def get_def assert_def assert_opt_def fail_def return_def bind_def\n s0_internal_def kh0_def well_formed_cnode_n_def)\n \\ \\below asid pool level\\\n apply (clarsimp simp: vs_lookup_table_def split: if_splits)\n apply (clarsimp simp: pt_walk.simps)\n apply (case_tac \"bot_level < max_pt_level\"; clarsimp)\n\n prefer 2\n \\ \\bot level = max pt level\\\n\n apply (clarsimp simp: pool_for_asid_s0 vspace_for_pool_def asid_pools_of_s0\n dest!: asid_high_low split: if_splits)\n \\ \\High asid\\\n apply (rule conjI, clarsimp simp: High_asid_def asid_low_bits_def)\n apply (rule_tac x=High_cnode_ptr in exI)\n apply (rule_tac x=\"(the_nat_to_bl_10 6)\" in exI)\n apply (rule_tac x=\"ArchObjectCap (PageTableCap High_pt_ptr (Some (High_asid,0)))\" in exI)\n apply (subst (asm) s0_internal_def)\n apply (clarsimp simp: in_omonad ptes_of_def High_pd_def ptrFromPAddr_addr_from_ppn'\n dest!: kh0_SomeD split: if_splits)\n apply (intro conjI)\n apply (fastforce simp: High_cnode_def High_caps_def caps_of_state_simps\n s0_internal_def kh0_def well_formed_cnode_n_def)\n apply (clarsimp simp: vref_for_level_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (word_bitwise, fastforce)\n apply (clarsimp simp: kh0_obj_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (rule FalseE, word_bitwise, fastforce simp: elf_index_value)\n \\ \\Low asid\\\n apply (rule conjI, clarsimp simp: Low_asid_def asid_low_bits_def)\n apply (rule_tac x=Low_cnode_ptr in exI)\n apply (rule_tac x=\"(the_nat_to_bl_10 6)\" in exI)\n apply (rule_tac x=\"ArchObjectCap (PageTableCap Low_pt_ptr (Some (Low_asid,0)))\" in exI)\n apply (subst (asm) s0_internal_def)\n apply (clarsimp simp: in_omonad ptes_of_def Low_pd_def ptrFromPAddr_addr_from_ppn'\n dest!: kh0_SomeD split: if_splits)\n apply (intro conjI)\n apply (fastforce simp: Low_cnode_def Low_caps_def caps_of_state_simps\n s0_internal_def kh0_def well_formed_cnode_n_def)\n apply (clarsimp simp: vref_for_level_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (word_bitwise, fastforce)\n apply (clarsimp simp: kh0_obj_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (rule FalseE, word_bitwise, fastforce simp: elf_index_value)\n \\ \\bot level < max pt level\\\n apply (clarsimp simp: pool_for_asid_s0 vspace_for_pool_def asid_pools_of_s0\n dest!: asid_high_low split: if_splits)\n \\ \\High asid\\\n apply (subst (asm) ptes_of_def)\n apply (clarsimp simp: pts_of_s0)\n apply (clarsimp simp: in_omonad kh0_obj_def pptr_from_pte_def ptrFromPAddr_addr_from_ppn'\n split: if_splits)\n apply (rule conjI, clarsimp simp: High_asid_def asid_low_bits_def)\n apply (prop_tac \"pt_walk (max_pt_level - 1) bot_level High_pt_ptr vref (ptes_of s0_internal) =\n Some (max_pt_level - 1, High_pt_ptr)\")\n apply (clarsimp simp: pt_walk.simps)\n apply (clarsimp simp: ptes_of_def pts_of_s0 in_omonad split: if_splits)\n apply (clarsimp simp: ptes_of_def pts_of_s0 shared_page_ptr_phys_def ptrFromPAddr_addr_from_ppn'\n split: if_splits)\n apply (rule_tac x=High_cnode_ptr in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 5\" in exI)\n apply (rule exI, intro conjI)\n apply (fastforce simp: High_cnode_def High_caps_def caps_of_state_simps\n s0_internal_def kh0_def well_formed_cnode_n_def)\n apply clarsimp\n apply (clarsimp simp: vref_for_level_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (word_bitwise, fastforce)\n \\ \\Low asid\\\n prefer 2\n apply (subst (asm) ptes_of_def)\n apply (clarsimp simp: pts_of_s0)\n apply (clarsimp simp: in_omonad kh0_obj_def pptr_from_pte_def ptrFromPAddr_addr_from_ppn'\n split: if_splits)\n apply (rule conjI, clarsimp simp: Low_asid_def asid_low_bits_def)\n apply (prop_tac \"pt_walk (max_pt_level - 1) bot_level Low_pt_ptr vref (ptes_of s0_internal) =\n Some (max_pt_level - 1, Low_pt_ptr)\")\n apply (clarsimp simp: pt_walk.simps)\n apply (clarsimp simp: ptes_of_def pts_of_s0 in_omonad split: if_splits)\n apply (clarsimp simp: ptes_of_def pts_of_s0 shared_page_ptr_phys_def ptrFromPAddr_addr_from_ppn'\n split: if_splits)\n apply (rule_tac x=Low_cnode_ptr in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 5\" in exI)\n apply (rule exI, intro conjI)\n apply (fastforce simp: Low_cnode_def Low_caps_def caps_of_state_simps\n s0_internal_def kh0_def well_formed_cnode_n_def)\n apply clarsimp\n apply (clarsimp simp: vref_for_level_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (word_bitwise, fastforce)\n \\ \\No lookups to other ptes\\\n apply (clarsimp simp: in_omonad ptes_of_def pts_of_s0 split: if_splits)\n apply (clarsimp simp: kh0_obj_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (rule FalseE, word_bitwise, fastforce simp: elf_index_value)\n apply (clarsimp simp: in_omonad ptes_of_def pts_of_s0 split: if_splits)\n apply (clarsimp simp: kh0_obj_def mask_def pt_simps user_region_simps bit_simps s0_ptr_defs)\n apply (rule FalseE, word_bitwise, fastforce simp: elf_index_value)\n done\n\nlemma valid_arch_caps_s0[simp]:\n \"valid_arch_caps s0_internal\"\n supply if_split[split del]\n supply caps_of_state_simps = caps_of_state_def get_cap_def gets_def get_def get_object_def\n assert_def assert_opt_def fail_def return_def bind_def\n apply (clarsimp simp: valid_arch_caps_def)\n apply (intro conjI)\n apply (simp add: valid_vs_lookup_s0_internal)\n apply (clarsimp simp: valid_asid_pool_caps_def s0_internal_def arch_state0_def)\n apply (clarsimp split: if_splits)\n apply (rule_tac x=\"High_cnode_ptr\" in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 4\" in exI)\n apply (force simp: caps_of_state_simps well_formed_cnode_n_def s0_internal_def kh0_obj_def\n kh0_def High_caps_def High_asid_def asid_high_bits_of_def asid_low_bits_def\n split: if_splits)\n apply (rule_tac x=\"Low_cnode_ptr\" in exI)\n apply (rule_tac x=\"the_nat_to_bl_10 4\" in exI)\n apply (force simp: caps_of_state_simps well_formed_cnode_n_def s0_internal_def kh0_obj_def\n kh0_def Low_caps_def Low_asid_def asid_high_bits_of_def asid_low_bits_def\n split: if_splits)\n apply (clarsimp simp: valid_table_caps_def)\n apply (fastforce simp: caps_of_state_simps pts_of_s0 s0_internal_def kh0_obj_def\n tcb_cnode_map_def Silc_caps_def High_caps_def Low_caps_def\n dest!: kh0_SomeD split: if_splits kernel_object.splits option.splits)\n apply (clarsimp simp: unique_table_caps_def)\n apply (clarsimp simp: caps_of_state_simps split: if_splits kernel_object.splits option.splits)\n apply (subst (asm) s0_internal_def)\n apply (clarsimp simp: kh0_def kh0_obj_def Silc_caps_def High_caps_def Low_caps_def\n split: if_splits)\n apply (subst (asm) s0_internal_def)\n apply (clarsimp simp: kh0_def kh0_obj_def Silc_caps_def High_caps_def Low_caps_def\n split: if_splits)\n apply (clarsimp simp: s0_internal_def kh0_def kh0_obj_def split: if_splits;\n clarsimp simp: tcb_cnode_map_def split: if_splits)\n apply (clarsimp simp: s0_internal_def kh0_def kh0_obj_def split: if_splits;\n clarsimp simp: tcb_cnode_map_def split: if_splits)\n apply (clarsimp simp: unique_table_refs_def)\n apply (drule s0_caps_of_state)+\n apply clarsimp\n apply (elim disjE; clarsimp)\n done\n\nlemma valid_global_objs_s0[simp]:\n \"valid_global_objs s0_internal\"\n by (clarsimp simp: valid_global_objs_def s0_internal_def arch_state0_def)\n\nlemma valid_kernel_mappings_s0[simp]:\n \"valid_kernel_mappings s0_internal\"\n by (clarsimp simp: valid_kernel_mappings_def s0_internal_def ran_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemma equal_kernel_mappings_s0[simp]:\n \"equal_kernel_mappings s0_internal\"\n supply misc = vref_for_level_def pt_bits_left_def asid_pool_level_size\n pageBits_def ptTranslationBits_def mask_def max_pt_level_def2\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def vspace_for_asid_def\n vspace_for_pool_def pool_for_asid_s0 asid_pools_of_s0)\n apply (clarsimp simp: obind_def pts_of_s0)\n apply (clarsimp simp: has_kernel_mappings_def split: if_splits)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: kernel_mapping_slots_def s0_ptr_defs misc)\n apply (fastforce simp: pts_of_s0 s0_internal_def arch_state0_def\n kh0_obj_def opt_map_def riscv_global_pt_def\n dest!: kh0_SomeD split: if_splits option.splits)\n apply (clarsimp simp: pts_of_s0)\n apply (clarsimp simp: s0_internal_def riscv_global_pt_def arch_state0_def kh0_obj_def\n kernel_mapping_slots_def s0_ptr_defs misc elf_index_value)+\n done\n\nlemma valid_asid_map_s0[simp]:\n \"valid_asid_map s0_internal\"\n by (clarsimp simp: valid_asid_map_def s0_internal_def arch_state0_def)\n\nlemma valid_global_pd_mappings_s0_helper:\n \"\\ pptr_base \\ vref; vref < pptr_base + (1 << kernel_window_bits) \\\n \\ \\a b. pt_lookup_target 0 riscv_global_pt_ptr vref (ptes_of s0_internal) = Some (a, b) \\\n is_aligned b (pt_bits_left a) \\\n addrFromPPtr b + (vref && mask (pt_bits_left a)) = addrFromPPtr vref\"\n supply misc = vref_for_level_def pt_bits_left_def asid_pool_level_size\n pageBits_def ptTranslationBits_def mask_def max_pt_level_def2\n apply (clarsimp simp: pt_lookup_target_def obind_def split: option.splits)\n apply (prop_tac \"pt_lookup_slot_from_level max_pt_level 0 riscv_global_pt_ptr vref (ptes_of s0_internal) =\n Some (max_pt_level, pt_slot_offset max_pt_level riscv_global_pt_ptr vref)\")\n apply (clarsimp simp: pt_lookup_slot_from_level_def pt_walk.simps)\n apply (fastforce simp: ptes_of_def in_omonad s0_internal_def kh0_def init_global_pt_def\n global_pte_def is_aligned_pt_slot_offset_pte)\n apply (clarsimp simp: pt_lookup_slot_from_level_def pt_walk.simps)\n apply (rule conjI; clarsimp dest!: pt_walk_max_level simp: max_pt_level_def2 split: if_splits)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: ptes_of_def pts_of_s0 global_pte_def kernel_window_bits_def\n table_index_offset_pt_bits_left is_aligned_pt_slot_offset_pte\n split: if_splits)\n apply (clarsimp simp: misc s0_ptr_defs)\n apply (word_bitwise, fastforce)\n apply (clarsimp simp: misc s0_ptr_defs kernel_mapping_slots_def)\n apply (word_bitwise, fastforce)\n apply (clarsimp simp: ptes_of_def pts_of_s0 is_aligned_pt_slot_offset_pte global_pte_def\n split: if_splits)\n apply (clarsimp simp: addr_from_ppn_def ptrFromPAddr_def addrFromPPtr_def bit_simps\n mask_def s0_ptr_defs pt_bits_left_def max_pt_level_def2\n pptrBaseOffset_def paddrBase_def is_aligned_def kernel_window_bits_def)\n apply (word_bitwise, fastforce)\n apply (clarsimp simp: addr_from_ppn_def ptrFromPAddr_def addrFromPPtr_def bit_simps is_aligned_def\n s0_ptr_defs pt_bits_left_def max_pt_level_def2 kernel_mapping_slots_def\n mask_def pt_slot_offset_def pt_index_def pptrBaseOffset_def paddrBase_def\n toplevel_bits_value elf_index_value kernel_window_bits_def)\n apply (word_bitwise, fastforce)\n done\n\nlemma ptes_of_elf_window:\n \"\\kernel_elf_base \\ vref; vref < kernel_elf_base + 2 ^ pageBits\\\n \\ ptes_of s0_internal (pt_slot_offset max_pt_level riscv_global_pt_ptr vref)\n = Some (global_pte elf_index)\"\n unfolding ptes_of_def pts_of_s0\n apply (clarsimp simp: obind_def elf_window_4k is_aligned_pt_slot_offset_pte)\n done\n\nlemma valid_global_pd_mappings_s0_helper':\n \"\\ kernel_elf_base \\ vref; vref < kernel_elf_base + (1 << pageBits) \\\n \\ \\a b. pt_lookup_target 0 riscv_global_pt_ptr vref (ptes_of s0_internal) = Some (a, b) \\\n is_aligned b (pt_bits_left a) \\\n addrFromPPtr b + (vref && mask (pt_bits_left a)) = addrFromKPPtr vref\"\n supply misc = vref_for_level_def pt_bits_left_def asid_pool_level_size\n pageBits_def ptTranslationBits_def mask_def max_pt_level_def2\n apply (clarsimp simp: pt_lookup_target_def obind_def split: option.splits)\n apply (prop_tac \"pt_lookup_slot_from_level max_pt_level 0 riscv_global_pt_ptr vref (ptes_of s0_internal) =\n Some (max_pt_level, pt_slot_offset max_pt_level riscv_global_pt_ptr vref)\")\n apply (clarsimp simp: pt_lookup_slot_from_level_def pt_walk.simps)\n apply (fastforce simp: ptes_of_def in_omonad s0_internal_def kh0_def init_global_pt_def\n global_pte_def is_aligned_pt_slot_offset_pte)\n apply (rule conjI; clarsimp)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: pt_lookup_slot_from_level_def pt_walk.simps)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: ptes_of_elf_window global_pte_def split: if_splits)\n apply (clarsimp simp: ptes_of_elf_window global_pte_def elf_index_value)\n apply (clarsimp simp: is_aligned_ptrFromPAddr_kernelELFPAddrBase kernelELFPAddrBase_addrFromKPPtr)\n done\n\nlemma valid_global_pd_mappings_s0[simp]:\n \"valid_global_vspace_mappings s0_internal\"\n unfolding valid_global_vspace_mappings_def Let_def\n apply (intro conjI)\n apply (simp add: s0_internal_def arch_state0_def riscv_global_pt_def)\n apply (fastforce simp: s0_internal_def arch_state0_def in_omonad kernel_window_def\n init_vspace_uses_def translate_address_def riscv_global_pt_def\n dest!: valid_global_pd_mappings_s0_helper split: if_splits)\n apply (fastforce simp: translate_address_def in_omonad s0_internal_def arch_state0_def\n riscv_global_pt_def kernel_elf_window_def init_vspace_uses_def\n dest!: valid_global_pd_mappings_s0_helper' split: if_splits)\n done\n\nlemma pspace_in_kernel_window_s0[simp]:\n \"pspace_in_kernel_window s0_internal\"\n apply (clarsimp simp: pspace_in_kernel_window_def kernel_window_def\n init_vspace_uses_def s0_internal_def arch_state0_def)\n apply (subgoal_tac \"x \\ {pptr_base.. obj_refs cap = {}\")\n apply (fastforce dest: s0_caps_of_state)\n apply (rule Int_emptyI, clarsimp)\n apply (erule swap, clarsimp)\n apply (drule s0_caps_of_state)\n apply (clarsimp simp: kernel_window_def init_vspace_uses_def s0_internal_def arch_state0_def)\n apply (subgoal_tac \"x \\ {pptr_base..Haskell state\\\n\ntext \\One invariant we need on s0 is that there exists\n an associated Haskell state satisfying the invariants.\n This does not yet exist.\\\n\nlemma Sys1_valid_initial_state_noenabled:\n assumes extras_s0: \"step_restrict s0\"\n assumes utf_det: \"\\pl pr pxn tc ms s. det_inv InUserMode tc s \\ einvs s \\\n context_matches_state pl pr pxn ms s \\ ct_running s\n \\ (\\x. utf (cur_thread s) pl pr pxn (tc, ms) = {x})\"\n assumes utf_non_empty: \"\\t pl pr pxn tc ms. utf t pl pr pxn (tc, ms) \\ {}\"\n assumes utf_non_interrupt: \"\\t pl pr pxn tc ms e f g. (e,f,g) \\ utf t pl pr pxn (tc, ms)\n \\ e \\ Some Interrupt\"\n assumes det_inv_invariant: \"invariant_over_ADT_if det_inv utf\"\n assumes det_inv_s0: \"det_inv KernelExit (cur_context s0_internal) s0_internal\"\n shows \"valid_initial_state_noenabled det_inv utf s0_internal Sys1PAS timer_irq s0_context\"\n apply (unfold_locales, simp_all only: pasMaySendIrqs_Sys1PAS)\n apply (insert det_inv_invariant)[9]\n apply (erule(2) invariant_over_ADT_if.det_inv_abs_state)\n apply ((erule invariant_over_ADT_if.det_inv_abs_state\n invariant_over_ADT_if.check_active_irq_if_Idle_det_inv\n invariant_over_ADT_if.check_active_irq_if_User_det_inv\n invariant_over_ADT_if.do_user_op_if_det_inv\n invariant_over_ADT_if.handle_preemption_if_det_inv\n invariant_over_ADT_if.kernel_entry_if_Interrupt_det_inv\n invariant_over_ADT_if.kernel_entry_if_det_inv\n invariant_over_ADT_if.kernel_exit_if_det_inv\n invariant_over_ADT_if.schedule_if_det_inv)+)[8]\n apply (rule Sys1_pas_cur_domain)\n apply (rule Sys1_pas_wellformed_noninterference)\n apply (simp only: einvs_s0)\n apply (simp add: Sys1_current_subject_idemp)\n apply (simp add: only_timer_irq_inv_s0 silc_inv_s0 Sys1_pas_cur_domain\n domain_sep_inv_s0 Sys1_pas_refined Sys1_guarded_pas_domain\n idle_equiv_refl)\n apply (clarsimp simp: valid_domain_list_2_def s0_internal_def exst0_def)\n apply (simp add: det_inv_s0)\n apply (simp add: s0_internal_def exst0_def)\n apply (simp add: ct_in_state_def st_tcb_at_tcb_states_of_state_eq\n identity_eq[symmetric] tcb_states_of_state_s0)\n apply (simp add: s0_ptr_defs s0_internal_def)\n apply (simp add: s0_internal_def exst0_def)\n apply (rule utf_det)\n apply (rule utf_non_empty)\n apply (rule utf_non_interrupt)\n apply (simp add: extras_s0[simplified s0_def])\n done\n\ntext \\the extra assumptions in valid_initial_state of being enabled,\n and a serial system, follow from ADT_IF_Refine\\\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/RISCV64/Example_Valid_State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.29200266230392086}} {"text": "(*\n Copyright 2017 Sidney Amani\n Copyright 2017 Maksym Bortin\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n*)\ntheory EvmFacts\n imports \"Hoare\"\nbegin\n\ndeclare memory_as_set_def [simp del]\ndeclare storage_as_set_def [simp del]\ndeclare balance_as_set_def [simp del]\ndeclare log_as_set_def [simp del]\n\n\nlemmas gas_simps = Gverylow_def Glow_def Gmid_def Gbase_def Gzero_def Glogtopic_def \n Gsha3word_def Gsha3_def Gextcode_def Gcopy_def Gblockhash_def Gexpbyte_def Gexp_def\n Gbalance_def Gsload_def Gsreset_def Gsset_def Gjumpdest_def Ghigh_def\n Glogdata_def Glog_def Gcreate_def Ccall_def \n Cgascap_def Cextra_def Gnewaccount_def Cxfer_def Cnew_def\n Gcall_def Gcallvalue_def \n\ntermination log256floor by lexicographic_order\n\nlemma log256floor_ge_0:\n \"0 \\ log256floor s\"\n apply (induct s rule: log256floor.induct)\n subgoal for x\n by (case_tac \"\\ x \\ 255\")\n (clarsimp)+\n done\ndeclare log256floor.simps[simp del ]\n\nlemma Cextra_gt_0:\n \"0 < Cextra a b c\"\n by (simp add: gas_simps)\n\nlemma L_compare : \"x \\ 0 \\ L x \\ 0\"\nby (simp add:L_def)\n\nlemma Cgascap_gt_0:\n \"f \\ 0 \\ 0 \\ Cgascap a b c d e f + f\"\napply (auto simp add: gas_simps L_def min_def)\ndone\n\nlemma Ccall_gt_0:\n \"memu \\ 0 \\ 0 < Ccall s0 s1 s2 recipient_empty\n remaining_gas blocknumber memu + memu\"\n\n unfolding Ccall_def\napply (auto)\n apply (simp add: Cextra_gt_0 add.commute add_nonneg_pos)\n apply (metis Cextra_gt_0 Cgascap_gt_0 add.commute add.left_commute add_strict_increasing)\n by (simp add: Cextra_gt_0 add.commute add_nonneg_pos)\n\nlemma Ccall_ge_0:\n \"memu \\ 0 \\ 0 \\ Ccall s0 s1 s2 recipient_empty\n remaining_gas blocknumber memu + memu\"\nusing Ccall_gt_0\n by (simp add: dual_order.order_iff_strict)\n\n\nlemma Csuicide_gt_0:\n \"at_least_eip150 net \\ 0 < Csuicide recipient_empty net\"\n unfolding Csuicide_def\n by (auto split: if_splits\n simp add: gas_simps Gsuicide_def)\n\nlemma thirdComponentOfC_gt_0:\n \"i \\ Misc STOP \\ i \\ Misc RETURN \\ (\\v. i \\ Unknown v) \\\n i = Misc SUICIDE \\ at_least_eip150 net \\\n i = Misc DELEGATECALL \\ \\ (before_homestead net) \\\n memu \\ 0 \\\n 0 < thirdComponentOfC i s0 s1 s2 s3 recipient_empty orig_val\n new_val remaining_gas net memu + memu\"\n unfolding thirdComponentOfC_def\n apply (case_tac i ; simp add: gas_simps )\n apply fastforce\n apply (case_tac x2; simp add: gas_simps)\n apply (case_tac x3; simp add: gas_simps )\n apply (case_tac x4 ; simp add: gas_simps)\n using log256floor_ge_0[where s=\"uint s1\"]\n apply (simp add: )\n apply (clarsimp; simp add: word_less_def word_neq_0_conv)\n apply (case_tac x5; simp add: gas_simps)\n apply (case_tac x7; simp add: gas_simps)\n apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac \"s3 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac x8; simp add: gas_simps Csstore_def)\n apply (case_tac x9; simp add: gas_simps Csstore_def)\n apply (case_tac x10; simp add: gas_simps Csstore_def)\n apply ( case_tac x12; case_tac \"s1 = 0\"; \n simp add: gas_simps word_less_def word_neq_0_conv)\n apply (clarsimp split: misc_inst.splits)\n apply (rule conjI, clarsimp simp add: gas_simps L_def)\n apply (rule conjI)\n apply (auto simp add: Ccall_gt_0 at_least_eip150.simps)+\n apply (smt Csuicide_gt_0)\n apply (smt Csuicide_gt_0)\ndone\n\nlemma thirdComponentOfC_ge_0:\n \"memu \\ 0 \\\n 0 \\ thirdComponentOfC i s0 s1 s2 s3 recipient_empty orig_val\n new_val remaining_gas net memu + memu\"\n unfolding thirdComponentOfC_def\n apply (case_tac i ; simp add: gas_simps )\n apply (case_tac x2; simp add: gas_simps)\n apply (case_tac x3; simp add: gas_simps )\n apply (case_tac x4 ; simp add: gas_simps)\n using log256floor_ge_0[where s=\"uint s1\"]\n apply (simp add: )\n apply (clarsimp; simp add: word_less_def word_neq_0_conv)\n apply (case_tac x5; simp add: gas_simps)\n apply (case_tac x7; simp add: gas_simps)\n apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac \"s3 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n apply (case_tac x8; simp add: gas_simps Csstore_def)\n apply (case_tac x9; simp add: gas_simps Csstore_def)\n apply (case_tac x10; simp add: gas_simps Csstore_def)\n apply ( case_tac x12; case_tac \"s1 = 0\"; \n simp add: gas_simps word_less_def word_neq_0_conv)\n apply (clarsimp split: misc_inst.splits)\n apply (rule conjI, clarsimp simp add: gas_simps L_def)\n apply (rule conjI)\n apply (auto simp add: Ccall_ge_0 Gcreate_def Gzero_def\n Csuicide_def Gsuicide_def Gnewaccount_def)+\ndone\n\n\n\nlemma Cmem_lift:\n \"0 \\ x \\ x \\ y \\ Cmem x \\ Cmem y\"\n apply (simp add: Cmem_def Gmemory_def)\n apply (case_tac \"x = y\")\n apply clarsimp\n apply (drule (1) order_class.le_neq_trans)\n apply simp\n apply (rule add_mono, simp)\n apply (rule zdiv_mono1[rotated], simp)\n apply (rule mult_mono ; simp)\n done\n\n(*\nlemma thirdComponentOfC_gt_0_massaged :\n \"i \\ Misc STOP \\ i \\ Misc RETURN \\ (\\v. i \\ Unknown v) \\\n i = Misc SUICIDE \\ at_least_eip150 net \\\n i = Misc DELEGATECALL \\ \\ before_homestead net \\\n x \\ y \\\n 0 < x - y + thirdComponentOfC i s0 s1 s2 s3 recipient_empty orig_val\n new_val remaining_gas net (x-y)\"\n by (metis add.commute diff_ge_0_iff_ge thirdComponentOfC_gt_0)\n*)\n\nlemma vctx_memory_usage_never_decreases:\n \"orig \\ new_memory_consumption inst orig s0 s1 s2 s3 s4 s5 s6\"\n by (case_tac inst)\n (rename_tac x, case_tac x; auto simp add: new_memory_consumption.simps M_def)+\n\nlemma obvious_principle :\n\"0 < (t::int) + (m1-m2) \\\n m1 \\ m2 \\\n m2 \\ 0 \\\n 0 < m1 - m2 + t\"\nby auto\n\nlemma Cmem_zero : \"Cmem 0 = 0\"\nby (auto simp:Cmem_def)\n\nlemma meter_gas_gt_0:\n \" inst \\ Misc STOP \\\n inst \\ Misc RETURN \\\n inst = Misc SUICIDE \\ at_least_eip150 net \\\n inst = Misc DELEGATECALL \\ \\before_homestead net \\\n inst \\ range Unknown \\\n 0 \\ vctx_memory_usage var \\\n 0 < meter_gas inst var const net\"\n apply (simp add: C_def meter_gas_def)\napply (rule obvious_principle)\napply (rule thirdComponentOfC_gt_0)\napply simp\napply simp\napply force\napply simp\napply simp\nusing Cmem_lift vctx_memory_usage_never_decreases\napply force\nusing Cmem_lift vctx_memory_usage_never_decreases\napply force\nusing Cmem_lift Cmem_zero\napply force\ndone\n\nlemma obvious_principle2 :\n\"0 \\ (t::int) + (m1-m2) \\\n m1 \\ m2 \\\n m2 \\ 0 \\\n 0 \\ m1 - m2 + t\"\nby auto\n\nlemma meter_gas_ge_0:\n \"0 \\ vctx_memory_usage var \\\n 0 \\ meter_gas inst var const net\"\n apply (simp add: C_def meter_gas_def)\napply (rule obvious_principle2)\napply (rule thirdComponentOfC_ge_0)\nusing Cmem_lift vctx_memory_usage_never_decreases\napply force\nusing Cmem_lift vctx_memory_usage_never_decreases\napply force\nusing Cmem_lift Cmem_zero\napply force\ndone\n\ndefinition all :: \"state_element set_pred\" where\n\"all s = True\"\n\ndefinition ex :: \"('a \\ 'b set_pred) \\ 'b set_pred\" where\n\"ex f s = (\\x. f x s)\"\n\ndefinition gas_smaller :: \"int \\ state_element set_pred\" where\n\"gas_smaller x s = (\\y. y < x \\ gas_pred y s)\"\n\ndefinition some_gas :: \"state_element set_pred\" where\n\"some_gas s = (\\y. gas_pred y s)\"\n\ndefinition sep_add :: \"'a set_pred \\ 'a set_pred \\ 'a set_pred\"\n where\n \"sep_add p q == (\\ s. p s \\ q s)\"\n\nnotation sep_add (infixr \"\\*\" 59)\n\nlemma sep_add_assoc [simp]: \"((a \\* b) \\* c) = (a \\* b \\* c)\"\n by (simp add: sep_add_def)\n\nlemma sep_add_commute [simp]: \"(a \\* b)= (b \\* a)\"\n by (simp add: sep_add_def) blast\n\ndefinition never :: \"'a set_pred\" where\n\"never == (\\s. False)\"\n\nlemma sep_add_never [simp] : \"r \\* never = r\"\nby (simp add: never_def sep_add_def)\n\n(*\nlemma sep_add_distr [simp] : \"a ** (b \\* c) == (a**b) \\* (a**c)\"\napply (simp add: sep_add_def sep_conj_def sep_distinct_def)\napply blast\n*)\n\ndefinition action ::\n \"(contract_action \\ bool) \\ state_element set_pred\" where\n\"action p s = (\\x. {ContractActionElm x} = s \\ p x)\"\n\ndefinition failing :: \"state_element set_pred\" where\n\"failing = action (\\y. \\x. ContractFail x = y)\"\n\ndefinition returning :: \"state_element set_pred\" where\n\"returning = action (\\y. \\x. ContractReturn x = y)\"\n\ndefinition destructing :: \"state_element set_pred\" where\n\"destructing = action (\\y. \\x. ContractSuicide x = y)\"\n\ndefinition calling :: \"state_element set_pred\" where\n\"calling = action (\\y. \\x. ContractCall x = y)\"\n\ndefinition creating :: \"state_element set_pred\" where\n\"creating = action (\\y. \\x. ContractCreate x = y)\"\n\ndefinition delegating :: \"state_element set_pred\" where\n\"delegating = action (\\y. \\x. ContractDelegateCall x = y)\"\n\nlemmas rw = instruction_sem_def instruction_failure_result_def\n subtract_gas.simps stack_2_1_op_def stack_1_1_op_def\n stack_3_1_op_def stack_0_1_op_def general_dup_def\n mload_def mstore_def mstore8_def calldatacopy_def\n codecopy_def stack_0_0_op_def jump_def jumpi_def\n extcodecopy_def sstore_def pc_def pop_def swap_def log_def\n stop_def create_def call_def delegatecall_def ret_def\n suicide_def callcode_def strict_if_def blocked_jump_def\nblockedInstructionContinue_def\n\nlemma inst_no_reasons :\n\"instruction_sem v c aa net \\\n InstructionToEnvironment\n (ContractFail []) a b\"\napply (cases aa)\napply (simp add:rw)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw sha3_def\n split:list.split if_split)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a\n (vctx_memory v))\"; auto simp:rw)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;\n auto simp:rw split:list.split option.split)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\ndefer\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw\n split:list.split option.split)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw split:list.split)\napply (rename_tac inst; case_tac inst;auto simp:rw\n split:list.split option.split)\napply (case_tac \"vctx_next_instruction (v\n \\vctx_stack := x22,\n vctx_pc := uint x21\\)\n c\"; auto simp:rw)\nsubgoal for x y aaa\napply (case_tac aaa; auto simp:rw)\napply (case_tac x9; auto simp:rw)\ndone\napply (case_tac \"vctx_next_instruction (v\n \\vctx_stack := x22,\n vctx_pc := uint x21\\)\n c\"; auto simp:rw)\nsubgoal for x y z aaa\napply (case_tac aaa; auto simp:rw)\napply (case_tac x9; auto simp:rw)\ndone\ndone\n\nlemma no_reasons_next :\n \"failed_for_reasons {}\n (next_state stopper c net (InstructionContinue v)) = False\"\nby (auto simp:failed_for_reasons_def)\n\nlemma program_environment :\n\"program_sem stopper c n net (InstructionToEnvironment a b d) =\n (InstructionToEnvironment a b d)\"\nby (induction n, auto simp:program_sem.simps next_state_def)\n\n\nlemma no_reasons [simp] :\n \"failed_for_reasons {}\n (program_sem stopper c n net (InstructionContinue v)) = False\"\napply (induction n arbitrary:v)\napply (auto simp add:program_sem.simps failed_for_reasons_def\n no_reasons_next)\ndone\n\n(*\nlemmas context_rw = contexts_as_set_def constant_ctx_as_set_def variable_ctx_as_set_def\n program_as_set_def stack_as_set_def memory_as_set_def storage_as_set_def\n balance_as_set_def log_as_set_def data_sent_as_set_def ext_program_as_set_def\n account_balance_as_set_def\n*)\n\n(*\nlemma not_cont_insert :\n \"x (s-{ContinuingElm False}) \\\n (x ** not_continuing) (insert (ContinuingElm False) s)\"\napply(auto simp add:rw sep_conj_def not_continuing_def all_def\n failing_def some_gas_def code_def gas_pred_def context_rw)\ndone\nlemma context_cont :\n \"contexts_as_set x1 co_ctx -\n {ContinuingElm a, ContractActionElm b} =\n contexts_as_set x1 co_ctx\"\napply(auto simp add:rw sep_def not_continuing_def all_def\n failing_def some_gas_def code_def gas_pred_def context_rw)\ndone\n\nlemma context_cont1 :\n \"contexts_as_set x1 co_ctx - {ContinuingElm a} =\n contexts_as_set x1 co_ctx\"\napply(auto simp add:rw sep_def not_continuing_def all_def\n failing_def some_gas_def code_def gas_pred_def context_rw)\ndone\n\nlemma failing_insert :\n \"x (s-{ContractActionElm (ContractFail b)}) \\\n (x ** failing) (insert (ContractActionElm (ContractFail b)) s)\"\napply(auto simp add:rw sep_def not_continuing_def all_def\n action_def failing_def some_gas_def code_def gas_pred_def context_rw)\ndone\n\nlemma some_gas_in_context :\n\"(rest ** gas_pred g) s \\\n(rest ** some_gas ) s\"\napply(auto simp add:rw sep_def not_continuing_def all_def\n failing_def some_gas_def code_def gas_pred_def context_rw)\ndone\n\n*)\n\nlemma meter_gas_check :\n \"\\ meter_gas a x1 co_ctx net \\ vctx_gas x1 \\\n check_resources x1 co_ctx (vctx_stack x1) a net \\\n False\"\nby (simp add:check_resources_def)\n\nlemmas instruction_sem_simps =\n rw sha3_def vctx_update_storage_def\n vctx_pop_stack_def vctx_advance_pc_def\nvctx_memory_usage_never_decreases\n\nlemma env_meter_gas :\n\"instruction_sem v1 c inst net =\n InstructionToEnvironment act v2 x33 \\\n vctx_gas v2 = vctx_gas v1 - meter_gas inst v1 c net\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v1))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma continue_meter_gas :\n\"instruction_sem v1 c inst net =\n InstructionContinue v2 \\\n vctx_gas v2 = vctx_gas v1 - meter_gas inst v1 c net\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v1))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma memu_good :\n\"instruction_sem v1 c inst net = InstructionContinue v2 \\\n vctx_memory_usage v2 \\ vctx_memory_usage v1\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v1))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma memu_good_env :\n\"instruction_sem v1 c inst net = InstructionToEnvironment act v2 zz \\\n vctx_memory_usage v2 \\ vctx_memory_usage v1\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: instruction_sem_simps\n split:list.splits)\napply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v1))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\n\nlemma call_instruction :\n\"instruction_sem v c inst net =\n InstructionToEnvironment (ContractCall args) x32 x33 \\\n inst = Misc CALL \\ inst = Misc CALLCODE\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma create_instruction :\n\"instruction_sem v c inst net =\n InstructionToEnvironment (ContractCreate args) x32 x33 \\\n inst = Misc CREATE\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\n\nlemma continue_instruction :\n \"instruction_sem v c inst net = InstructionContinue v2 \\\n inst \\ Misc STOP \\ inst \\ Misc RETURN \\\n inst \\ Misc SUICIDE \\ inst \\ Misc DELEGATECALL \\\n inst \\ range Unknown\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; clarsimp simp: rw split:list.splits)\napply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps\n split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma delegatecall_instruction :\n\"instruction_sem v c inst net =\n InstructionToEnvironment (ContractDelegateCall args) x32 x33 \\\n inst = Misc DELEGATECALL \\ \\ before_homestead net\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma delegatecall_decr_gas :\n assumes a:\"instruction_sem v1 co_ctx a net =\n InstructionToEnvironment (ContractDelegateCall x1a)\n v2 x33\"\n and good:\"vctx_memory_usage v1 \\ 0\"\n shows \"vctx_gas v1 > vctx_gas v2\"\nproof -\n have inst: \"a = Misc DELEGATECALL \\\n \\ before_homestead net\"\n using delegatecall_instruction and a by force\n then have \"meter_gas a v1 co_ctx net > 0\"\n using good and meter_gas_gt_0 by blast\n then show ?thesis using env_meter_gas and a by force\nqed\n\nlemma create_decr_gas :\n assumes a:\"instruction_sem v1 co_ctx a net =\n InstructionToEnvironment (ContractCreate x1a)\n v2 x33\"\n and good:\"vctx_memory_usage v1 \\ 0\"\n shows \"vctx_gas v1 > vctx_gas v2\"\nproof -\n have inst: \"a = Misc CREATE\"\n using create_instruction and a by force\n then have \"meter_gas a v1 co_ctx net > 0\"\n using good and meter_gas_gt_0 by blast\n then show ?thesis using env_meter_gas and a by force\nqed\n\nlemma call_decr_gas :\n assumes a:\"instruction_sem v1 co_ctx a net =\n InstructionToEnvironment (ContractCall x1a)\n v2 x33\"\n and good:\"vctx_memory_usage v1 \\ 0\"\n shows \"vctx_gas v1 > vctx_gas v2\"\nproof -\n have inst: \"a = Misc CALL \\ a = Misc CALLCODE\"\n using call_instruction and a by force\n then have \"meter_gas a v1 co_ctx net > 0\"\n using good and meter_gas_gt_0 by blast\n then show ?thesis using env_meter_gas and a by force\nqed\n\nlemma continue_decr_gas :\n assumes a:\"instruction_sem v1 co_ctx a net = InstructionContinue v2\"\n and good:\"vctx_memory_usage v1 \\ 0\"\n shows \"vctx_gas v1 > vctx_gas v2\"\nproof -\n have \"meter_gas a v1 co_ctx net > 0\"\n using a and good and meter_gas_gt_0 and continue_instruction\n by auto\n then show ?thesis using continue_meter_gas and a by force\nqed\n\ndefinition all_stack :: \"state_element set_pred\" where\n\"all_stack s = (\\t. s = stack_as_set t)\"\n\ndefinition all_but_gas :: \"state_element set_pred\" where\n\"all_but_gas s = (\\c v.\n s = contexts_as_set v c - {GasElm (vctx_gas v)})\"\n\nlemma maximality_stack_aux :\n \"stack_as_set s1 \\ stack_as_set s2 \\\n i < length s1 \\\n rev s1!i = rev s2!i\"\napply(auto simp add:context_rw)\napply blast\ndone\n\nlemma maximality_stack_length :\n \"stack_as_set s1 \\ stack_as_set s2 \\\n length s1 = length s2\"\nby (auto simp add:context_rw)\n\nlemma list_eq :\n \"length l1 = length l2 \\\n (\\i. i < length l1 \\ l1!i = l2!i) \\\n rev l1 = rev l2\"\napply (rule List.nth_equalityI)\napply auto\n by (simp add: Suc_diff_Suc rev_nth)\n\n\nlemma maximality_stack_aux2 :\n \"stack_as_set s1 \\ stack_as_set s2 \\\n rev s1 = rev s2\"\napply (rule list_eq)\nusing maximality_stack_length\napply force\napply auto\nsubgoal for i\nusing maximality_stack_aux [of s1 s2 \"length s2 - i -1\"]\n and maximality_stack_length [of s1 s2]\nproof -\n assume a1: \"i < length s1\"\n assume a2: \"stack_as_set s1 \\ stack_as_set s2\"\n have f3: \"\\ stack_as_set s1 \\ stack_as_set s2 \\ length s1 = length s2\"\n by (metis \\stack_as_set s1 \\ stack_as_set s2 \\ length s1 = length s2\\)\n have f4: \"length s2 - i - 1 = length s2 - Suc i\"\n using diff_Suc_eq_diff_pred diff_commute by presburger\n have \"0 < length s2\"\n using f3 a2 a1 by linarith\n then have \"rev s1 ! (length s2 - i - 1) = rev s2 ! (length s2 - i - 1)\"\n using f4 f3 a2 \\\\stack_as_set s1 \\ stack_as_set s2; length s2 - i - 1 < length s1\\ \\ rev s1 ! (length s2 - i - 1) = rev s2 ! (length s2 - i - 1)\\ diff_Suc_less by presburger\n then show ?thesis\n using f4 f3 a2 a1 by (metis (no_types) nth_rev_alt)\nqed\ndone\n\nlemma maximality_stack :\n \"stack_as_set s1 \\ stack_as_set s2 \\\n s1 = s2\"\nusing maximality_stack_aux2\n by auto\n\nlemma stack_height_at_context :\n \"StackHeightElm x \\ contexts_as_set v2 c2 \\\n StackHeightElm x \\ stack_as_set (vctx_stack v2)\"\napply(simp add:context_rw)\ndone\n\nlemma stack_elem_at_context :\n \"StackElm (x,y) \\ contexts_as_set v2 c2 \\\n StackElm (x,y) \\ stack_as_set (vctx_stack v2)\"\napply(simp add:context_rw)\ndone\n\nlemma stack_at_context :\n \"stack_as_set s1 \\ contexts_as_set v2 c2 \\\n stack_as_set s1 \\ stack_as_set (vctx_stack v2)\"\napply auto\napply (case_tac x)\napply auto\nusing stack_height_at_context\napply force\nusing stack_elem_at_context\napply force\napply(auto simp add:context_rw)\ndone\n\nlemma stack_from_context :\n \"stack_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_stack v2 = s1\"\nusing stack_at_context [of s1 v2 c2]\n and maximality_stack [of s1 \"vctx_stack v2\"]\nby force\n\nlemma maximality_data_aux :\n \"data_sent_as_set s1 \\ data_sent_as_set s2 \\\n i < length s1 \\\n s1!i = s2!i\"\napply(auto simp add:context_rw)\napply blast\ndone\n\nlemma maximality_data_length :\n \"data_sent_as_set s1 \\ data_sent_as_set s2 \\\n length s1 = length s2\"\nby (auto simp add:context_rw)\n\nlemma maximality_data_sent :\n \"data_sent_as_set s1 \\ data_sent_as_set s2 \\\n s1 = s2\"\napply (rule List.nth_equalityI)\nusing maximality_data_length\napply force\napply auto\nsubgoal for i\nusing maximality_data_aux [of s1 s2 i]\napply simp\ndone\ndone\n\nlemma data_size_at_context :\n \"SentDataLengthElm x \\ contexts_as_set v2 c2 \\\n SentDataLengthElm x \\ data_sent_as_set (vctx_data_sent v2)\"\napply(simp add:context_rw)\ndone\n\nlemma data_elem_at_context :\n \"SentDataElm (x,y) \\ contexts_as_set v2 c2 \\\n SentDataElm (x,y) \\ data_sent_as_set (vctx_data_sent v2)\"\napply(simp add:context_rw)\ndone\n\nlemma data_at_context :\n \"data_sent_as_set s1 \\ contexts_as_set v2 c2 \\\n data_sent_as_set s1 \\ data_sent_as_set (vctx_data_sent v2)\"\napply (auto)\napply (case_tac x)\napply (auto simp:data_size_at_context data_elem_at_context)\napply(auto simp add:context_rw)\ndone\n\nlemma data_from_context :\n \"data_sent_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_data_sent v2 = s1\"\nusing data_at_context [of s1 v2 c2]\n and maximality_data_sent [of s1 \"vctx_data_sent v2\"]\nby force\n\n(* reconstruct memory *)\n\nlemma maximality_memory :\n \"memory_as_set m1 \\ memory_as_set m2 \\\n m1 = m2\"\napply(auto simp add:context_rw)\ndone\n\nlemma memory_at_context :\n \"memory_as_set s1 \\ contexts_as_set v2 c2 \\\n memory_as_set s1 \\ memory_as_set (vctx_memory v2)\"\napply(auto simp add:context_rw)\ndone\n\nlemma memory_from_context :\n \"memory_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_memory v2 = s1\"\nusing memory_at_context [of s1 v2 c2]\n and maximality_memory [of s1 \"vctx_memory v2\"]\nby force\n\n(* reconstruct storage *)\n\nlemma maximality_storage :\n \"storage_as_set m1 \\ storage_as_set m2 \\\n m1 = m2\"\napply(auto simp add:context_rw)\ndone\n\nlemma storage_at_context :\n \"storage_as_set s1 \\ contexts_as_set v2 c2 \\\n storage_as_set s1 \\ storage_as_set (vctx_storage v2)\"\napply(auto simp add:context_rw)\ndone\n\nlemma storage_from_context :\n \"storage_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_storage v2 = s1\"\nusing storage_at_context [of s1 v2 c2]\n and maximality_storage [of s1 \"vctx_storage v2\"]\nby force\n\n(* balance *)\n\nlemma maximality_balance :\n \"balance_as_set m1 \\ balance_as_set m2 \\\n m1 = m2\"\napply(auto simp add:context_rw)\ndone\n\nlemma balance_at_context :\n \"balance_as_set s1 \\ contexts_as_set v2 c2 \\\n balance_as_set s1 \\ balance_as_set (vctx_balance v2)\"\napply(auto simp add:context_rw)\ndone\n\nlemma balance_from_context :\n \"balance_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_balance v2 = s1\"\n by (metis balance_at_context maximality_balance)\n\n(* block info *)\n\nlemma maximality_block :\n \"blockhash_as_elm m1 \\ blockhash_as_elm m2 \\\n m1 = m2\"\napply(auto simp add:context_rw)\ndone\n\nlemma block_at_context :\n \"blockhash_as_elm s1 \\ contexts_as_set v2 c2 \\\n blockhash_as_elm s1 \\\n blockhash_as_elm (block_blockhash (vctx_block v2))\"\napply(auto simp add:context_rw)\ndone\n\nlemma block_from_context :\n \"blockhash_as_elm s1 \\ contexts_as_set v2 c2 \\\n block_blockhash (vctx_block v2) = s1\"\nusing block_at_context [of s1 v2 c2]\n and maximality_block [of s1 \" block_blockhash (vctx_block v2)\"]\nby force\n\n(* program *)\n\ndefinition program_inst :: \"program \\ int \\ inst\" where\n\"program_inst p i =\n (case program_content p i of None \\ Misc STOP | Some i \\ i)\"\n\ndefinition program_as_set2 :: \"program \\ state_element set\" where\n\"program_as_set2 p =\n { CodeElm (pos, i) | pos i. program_inst p pos = i }\"\n\nlemma maximality_program_aux :\n \"program_as_set2 m1 \\ program_as_set2 m2 \\\n program_inst m1 = program_inst m2\"\napply(auto simp add:context_rw program_as_set2_def)\ndone\n\nlemma program_as_set_eq : \"program_as_set p = program_as_set2 p\"\napply (auto simp:program_as_set_def\n program_as_set2_def program_inst_def split:option.split)\ndone\n\nlemma maximality_program :\n \"program_as_set m1 \\ program_as_set m2 \\\n program_inst m1 = program_inst m2\"\nby (auto simp:program_as_set_eq maximality_program_aux)\n\nlemma program_at_context :\n \"program_as_set s1 \\ contexts_as_set v2 c2 \\\n program_as_set s1 \\ program_as_set (cctx_program c2)\"\napply(auto simp add:context_rw)\napply blast\napply force\ndone\n\nlemma program_from_context :\n \"program_as_set s1 \\ contexts_as_set v2 c2 \\\n program_inst (cctx_program c2) = program_inst s1\"\n by (metis program_at_context maximality_program)\n\nlemma program_inst_same :\n \"program_inst p1 = program_inst p2 \\\n program_as_set p1 = program_as_set p2\"\napply (auto simp:program_as_set_def\n program_as_set2_def program_inst_def split:option.split)\n apply (metis option.case_eq_if option.expand option.sel option.simps(3) program_inst_def)\n apply (metis option.case_eq_if option.sel option.simps(3) program_inst_def)\n apply (metis option.case_eq_if option.sel option.simps(3) program_inst_def)\n apply (metis option.case_eq_if option.expand option.sel option.simps(3) program_inst_def)\n apply (metis option.case_eq_if option.sel option.simps(3) program_inst_def)\n apply (metis option.case_eq_if option.sel option.simps(3) program_inst_def)\ndone\n\n(* reconstruct logs *)\n\nlemma maximality_log_aux :\n \"log_as_set s1 \\ log_as_set s2 \\\n i < length s1 \\\n rev s1!i = rev s2!i\"\napply(auto simp add:context_rw)\napply blast\ndone\n\nlemma maximality_log_length :\n \"log_as_set s1 \\ log_as_set s2 \\\n length s1 = length s2\"\nby (auto simp add:context_rw)\n\nlemma maximality_log :\n \"log_as_set s1 \\ log_as_set s2 \\\n s1 = s2\"\nusing maximality_log_aux [of s1 s2]\n and maximality_log_length [of s1 s2]\n and list_eq [of s1 s2]\n by (metis length_rev nth_equalityI rev_is_rev_conv)\n\nlemma log_length_at_context :\n \"LogNumElm x \\ contexts_as_set v2 c2 \\\n LogNumElm x \\ log_as_set (vctx_logs v2)\"\napply(simp add:context_rw)\ndone\n\nlemma log_elem_at_context :\n \"LogElm (x,y) \\ contexts_as_set v2 c2 \\\n LogElm (x,y) \\ log_as_set (vctx_logs v2)\"\napply(simp add:context_rw)\ndone\n\nlemma log_at_context_aux :\n \"log_as_set s1 \\ contexts_as_set v2 c2 \\\n x \\ log_as_set s1 \\\n x \\ log_as_set (vctx_logs v2)\"\napply (case_tac x)\napply (auto simp:log_length_at_context log_elem_at_context)\napply(auto simp add:context_rw)\ndone\n\nlemma log_at_context :\n \"log_as_set s1 \\ contexts_as_set v2 c2 \\\n log_as_set s1 \\ log_as_set (vctx_logs v2)\"\nusing log_at_context_aux\napply (auto)\ndone\n\nlemma log_from_context :\n \"log_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_logs v2 = s1\"\nusing log_at_context [of s1 v2 c2]\n and maximality_log [of s1 \"vctx_logs v2\"]\nby force\n\n(* external programs *)\n\nlemma maximal_ext_length :\n \"ext_program_as_set s1 \\ ext_program_as_set s2 \\\n program_length (s1 addr) = program_length (s2 addr)\"\napply(auto simp add:context_rw)\ndone\n\nlemma maximal_ext_content :\n \"ext_program_as_set s1 \\ ext_program_as_set s2 \\\n program_as_natural_map (s1 addr) =\n program_as_natural_map (s2 addr)\"\napply(auto simp add:context_rw)\napply blast\ndone\n\nlemma ext_at_context :\n \"ext_program_as_set s1 \\ contexts_as_set v2 c2 \\\n ext_program_as_set s1 \\ ext_program_as_set (vctx_ext_program v2)\"\napply(auto simp add:context_rw)\napply blast\ndone\n\nlemma ext_length_from_context :\n \"ext_program_as_set s1 \\ contexts_as_set v2 c2 \\\n program_length (vctx_ext_program v2 addr) = program_length (s1 addr)\"\nusing ext_at_context [of s1 v2 c2]\n and maximal_ext_length [of s1 \"vctx_ext_program v2\"]\nby force\n\nlemma ext_content_from_context :\n \"ext_program_as_set s1 \\ contexts_as_set v2 c2 \\\n program_as_natural_map (vctx_ext_program v2 addr) =\n program_as_natural_map (s1 addr)\"\nusing ext_at_context [of s1 v2 c2]\n and maximal_ext_content [of s1 \"vctx_ext_program v2\"]\nby force\n\nlemma ext_program_same :\n \"(\\addr. program_length (p1 addr) = program_length (p2 addr)) \\\n (\\addr. program_as_natural_map (p1 addr) =\n program_as_natural_map (p2 addr)) \\\n ext_program_as_set p1 = ext_program_as_set p2\"\napply(simp add:ext_program_as_set_def)\ndone\n\n(* account existence *)\n\nlemma maximality_existence :\n \"account_existence_as_set m1 \\ account_existence_as_set m2 \\\n m1 = m2\"\napply(auto simp add:context_rw)\ndone\n\nlemma existence_at_context :\n \"account_existence_as_set s1 \\ contexts_as_set v2 c2 \\\n account_existence_as_set s1 \\ account_existence_as_set (vctx_account_existence v2)\"\napply(auto simp add:context_rw)\ndone\n\nlemma existence_from_context :\n \"account_existence_as_set s1 \\ contexts_as_set v2 c2 \\\n vctx_account_existence v2 = s1\"\n by (metis existence_at_context maximality_existence)\n\n\n(* lemmas for all obvious subsets *)\n\nlemma stack_subset :\n \"stack_as_set (vctx_stack v1) \\ contexts_as_set v1 c1\"\nby(auto simp add:context_rw)\n\nlemma memory_subset :\n \"memory_as_set (vctx_memory v1) \\ contexts_as_set v1 c1\"\nby(auto simp add:context_rw)\n\nlemma storage_subset :\n \"storage_as_set (vctx_storage v1) \\ contexts_as_set v1 c1\"\nby(auto simp add:context_rw)\n\nlemma balance_subset :\n \"balance_as_set (vctx_balance v1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma existence_subset :\n \"account_existence_as_set (vctx_account_existence v1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma data_sent_subset :\n \"data_sent_as_set (vctx_data_sent v1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma ext_program_subset :\n \"ext_program_as_set (vctx_ext_program v1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma log_subset :\n \"log_as_set (vctx_logs v1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma block_subset :\n \"blockhash_as_elm (block_blockhash (vctx_block v1)) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\n\nlemma program_subset :\n \"program_as_set (cctx_program c1) \\ contexts_as_set v1 c1\"\nby (auto simp add:context_rw)\n\nlemma get_condition1 :\n \"contexts_as_set v1 c1 \\ contexts_as_set v2 c2 \\\n vctx_memory_usage v1 =\n vctx_memory_usage v2 \\\n vctx_caller v1 = vctx_caller v2 \\\n vctx_value_sent v1 =\n vctx_value_sent v2 \\\n vctx_origin v1 = vctx_origin v2 \\\n vctx_gas v1 = vctx_gas v2 \\\n vctx_pc v1 = vctx_pc v2 \\\n block_coinbase (vctx_block v1) =\n block_coinbase (vctx_block v2) \\\n block_timestamp (vctx_block v1) =\n block_timestamp (vctx_block v2) \\\n block_difficulty (vctx_block v1) =\n block_difficulty (vctx_block v2) \\\n block_gaslimit (vctx_block v1) =\n block_gaslimit (vctx_block v2) \\\n block_number (vctx_block v1) =\n block_number (vctx_block v2) \\\n cctx_this c1 = cctx_this c2\"\napply(simp add:context_rw)\ndone\n\nlemma eq_class :\n \"vctx_memory_usage v1 = vctx_memory_usage v2 \\\n vctx_caller v1 = vctx_caller v2 \\\n vctx_value_sent v1 = vctx_value_sent v2 \\\n vctx_gasprice v1 = vctx_gasprice v2 \\\n vctx_origin v1 = vctx_origin v2 \\\n vctx_gas v1 = vctx_gas v2 \\\n vctx_pc v1 = vctx_pc v2 \\\n vctx_data_sent v1 = vctx_data_sent v2 \\\n block_coinbase (vctx_block v1) =\n block_coinbase (vctx_block v2) \\\n block_blockhash (vctx_block v1) =\n block_blockhash (vctx_block v2) \\\n block_timestamp (vctx_block v1) =\n block_timestamp (vctx_block v2) \\\n block_difficulty (vctx_block v1) =\n block_difficulty (vctx_block v2) \\\n block_gaslimit (vctx_block v1) =\n block_gaslimit (vctx_block v2) \\\n block_number (vctx_block v1) = block_number (vctx_block v2) \\\n vctx_logs v1 = vctx_logs v2 \\\n vctx_stack v1 = vctx_stack v2 \\\n vctx_memory v1 = vctx_memory v2 \\\n vctx_storage v1 = vctx_storage v2 \\\n vctx_balance v1 = vctx_balance v2 \\\n vctx_account_existence v1 = vctx_account_existence v2 \\\n program_inst (cctx_program c1) = program_inst (cctx_program c2) \\\n cctx_this c1 = cctx_this c2 \\\n (\\addr. program_length (vctx_ext_program v1 addr) =\n program_length (vctx_ext_program v2 addr)) \\\n (\\addr. program_as_natural_map (vctx_ext_program v1 addr) =\n program_as_natural_map (vctx_ext_program v2 addr)) \\\n contexts_as_set v1 c1 = contexts_as_set v2 c2\"\napply(simp add:contexts_as_set_def constant_ctx_as_set_def\n variable_ctx_as_set_def)\napply auto\nusing program_inst_same apply blast\nusing ext_program_same apply blast\nusing program_inst_same apply blast\nusing ext_program_same apply blast\ndone\n\nlemma maximality :\n \"contexts_as_set v1 c1 \\ contexts_as_set v2 c2 \\\n contexts_as_set v1 c1 = contexts_as_set v2 c2\"\napply (rule eq_class)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\n apply (metis data_from_context data_sent_subset order.trans)\napply(simp add:context_rw)\nusing block_from_context and block_subset\napply force\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\napply(simp add:context_rw)\nusing log_from_context and log_subset\napply force\nusing stack_from_context and stack_subset\napply force\nusing memory_from_context and memory_subset\napply force\nusing storage_from_context and storage_subset\napply force\nusing balance_from_context and balance_subset apply force\nusing existence_from_context and existence_subset apply force\nusing program_from_context and program_subset apply force\napply(simp add:context_rw)\nusing ext_length_from_context and ext_program_subset apply force\nusing ext_content_from_context and ext_program_subset apply force\ndone\n\n(* Looping *)\n(*\ndefinition zero :: \"'a set_pred\" where\n\"zero = (\\x. False)\"\n\nlemma zero_add : \"zero ## a = a\"\napply (simp add:zero_def sep_add_def)\ndone\n\nlemma zero_mul : \"zero ** a = zero\"\napply (simp add:zero_def sep_def)\ndone\n\nlemma zero_triple : \"triple net {} zero {} p\"\napply (auto simp add:zero_mul triple_def zero_def sep_def)\ndone\n\nlemma loop_triple :\n \"(\\x. \\y. y < x \\ triple net {} (p x) {} (p y ## q)) \\\n p (0::nat) = zero \\\n triple net {} (p x) {} q\"\napply auto\ndone\n\nlemma triple_three :\n \"triple net {} p2 {} (q ## p1) \\\n triple net {} p1 {} (q ## p0) \\\n triple net {} p2 {} (q ## p0)\"\napply (auto simp:triple_def failed_for_reasons_def)\napply(drule_tac x = co_ctx in spec)\napply(drule_tac x = co_ctx in spec)\napply auto\napply(drule_tac x = presult in spec)\napply(drule_tac x = rest in spec)\napply auto\napply(drule_tac x = stopper in spec)\napply auto\napply (auto simp:sep_add_def)\napply(drule_tac x = \"program_sem stopper co_ctx k net presult\" in spec)\napply(drule_tac x = rest in spec)\napply auto\napply(drule_tac x = stopper in spec)\napply auto\ndone\n\nlemma loop_triple2 :\n \"(\\x. triple net {} (p x) {} (p (x-1) ## q)) \\\n triple net {} (p x) {} (p (0::nat) ## q)\"\napply (induction x)\napply auto\n apply (metis diff_0_eq_0)\napply(drule_tac x = \"Suc x\" in spec)\napply auto\napply (rule triple_three)\napply auto\ndone\n\nlemma loop_triple_int :\n \"(\\x. triple net {} (p x) {} (p (x-1) ## q)) \\\n \\y. y < (0::int) \\ triple net {} (p x) {} (p y ## q)\"\napply (induction x)\nsubgoal for n\napply (induction n)\n apply force\napply auto\napply(drule_tac x = \"int (Suc n)\" in spec)\napply auto\nusing triple_three\n by blast\n by force\n\ndefinition stable :: \"network \\ state_element set_pred \\ bool\" where\n\"stable net pre ==\n \\ co_ctx presult rest stopper. no_assertion co_ctx \\\n (pre ** rest) (instruction_result_as_set co_ctx presult) \\\n (\\ k.\n (pre ** rest) (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)))\"\n\n\nlemma triple_stable :\n \"triple net {} p {} (q##r) \\\n triple net {} (p##r) {} (q##r)\"\n using triple_tauto triple_three by fastforce\n\nlemma triple_stable2 :\n \"triple net {} p {} (q##s) \\\n triple net {} s {} r \\\n triple net {} (p##r) {} (q##r)\"\n by (metis sep_add_def triple_stable triple_three weaken_post)\n\nlemma loop_triple_int2 :\n \"(\\x. triple net {} (p x) {} (p (x-1) ## q x)) \\\n (\\x. triple net {} (q x) {} (q (x+1))) \\\n \\y. y < (0::int) \\ triple net {} (p x) {} (p y ## q x)\"\napply (induction x)\nsubgoal for n\napply (induction n)\n apply (smt semiring_1_class.of_nat_simps(1))\napply auto\napply(drule_tac x = \"int (Suc n)\" in spec)\napply(drule_tac x = \"int n\" in spec)\napply auto\nsubgoal for n y\napply (rule exI[of _ y])\napply auto\n by (smt sep_add_assoc sep_add_commute sep_add_never triple_stable2 triple_three)\ndone\n by (smt negative_zle)\n\nlemma loop_triple_int3 :\n \"(\\x. triple net {} (p x) {} (p (x-1) ## q x)) \\\n (\\x. triple net {} (q x) {} (q (x+1))) \\\n \\y. y < (0::int) \\ y \\ x \\ triple net {} (p x) {} (p y ## q x)\"\napply (induction x)\nsubgoal for n\napply (induction n)\n apply (smt semiring_1_class.of_nat_simps(1))\napply auto\napply(drule_tac x = \"int (Suc n)\" in spec)\napply(drule_tac x = \"int n\" in spec)\napply auto\nsubgoal for n y\napply (rule exI[of _ y])\napply auto\n by (smt sep_add_assoc sep_add_commute sep_add_never triple_stable2 triple_three)\ndone\n by (smt negative_zle)\n\n\n\n\ndefinition ex_pred :: \"('b \\ 'a set_pred) \\ 'a set_pred\" where\n\"ex_pred pred = (\\s. \\y. pred y s)\"\n\ndefinition s_triple :: \"network \\ state_element set_pred \\ state_element set_pred \\ bool\" where\n\"s_triple net pre post ==\n \\ co_ctx presult rest stopper. no_assertion co_ctx \\\n (pre ** rest) (instruction_result_as_set co_ctx presult) \\\n (\\ k.\n (post ** rest) (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)))\"\n\n\nlemma s_triple_eq : \"s_triple net p q = triple net {} p {} q\"\napply (auto simp add: triple_def s_triple_def failed_for_reasons_def)\ndone\n\ndefinition failures :: \"failure_reason set \\ state_element set_pred\" where\n\"failures fails = (\\s.\n \\lst. set lst \\ fails \\ set lst \\ {} \\\n s = {ContinuingElm False,\n ContractActionElm (ContractFail lst)})\"\n\nlemma s_triple_eq2 :\n \"s_triple net (p**code c) (q**code c) = triple net {} p c q\"\napply (auto simp add: triple_def s_triple_def failed_for_reasons_def)\ndone\n\nlemma no_annotation_failure :\n \"no_assertion co_ctx \\\n presult \\ InstructionAnnotationFailure \\\n program_sem stopper co_ctx k net presult \\ InstructionAnnotationFailure\"\napply(cases presult)\napply (simp add:program_sem.simps failed_for_reasons_def\n program_annotation no_reasons_next)\nsubgoal for v1\napply (induction k arbitrary:v1 presult)\napply (auto simp add:program_sem.simps failed_for_reasons_def\n program_annotation no_reasons_next)\napply (case_tac \"next_state stopper co_ctx net\n (InstructionContinue v1)\")\napply auto\ndefer\n apply (simp add: program_environment)\napply(simp add:next_state_def)\napply(case_tac \"vctx_next_instruction v1 co_ctx\"; auto)\napply(case_tac \"check_resources v1 co_ctx (vctx_stack v1) a net\"; auto)\nusing no_annotation_inst by force\n apply (auto simp add: program_environment)\ndone\n\nlemma code_elm_preserved :\n\"no_assertion co_ctx \\\n CodeElm (pos, i) \\ instruction_result_as_set co_ctx presult \\\n CodeElm (pos, i) \\ instruction_result_as_set co_ctx\n (program_sem stopper co_ctx k net presult)\"\napply (cases presult; auto)\napply(case_tac \"program_sem stopper co_ctx k net\n (InstructionContinue x1)\")\napply (auto simp add:context_rw instruction_result_as_set_def)\nusing no_annotation_failure apply force\nusing no_annotation_failure apply force\napply(case_tac \"program_sem stopper co_ctx k net\n presult\")\napply (auto simp add:context_rw instruction_result_as_set_def)\nusing no_annotation_failure apply force\napply(case_tac \"program_sem stopper co_ctx k net\n presult\")\napply (auto simp add:context_rw instruction_result_as_set_def)\nusing no_annotation_failure apply force\ndone\n\nlemma continue_elm_false :\n\"ContinuingElm False \\\n instruction_result_as_set co_ctx\n (InstructionContinue x1)\"\napply(auto simp:context_rw instruction_result_as_set_def)\ndone\n\nlemma get_action_elm :\n\"ContractActionElm act \\\n instruction_result_as_set co_ctx\n (InstructionToEnvironment act2 v2 zz) \\\n act = act2\"\napply(auto simp:context_rw instruction_result_as_set_def)\ndone\n\nlemma s_triple_imp :\n \"s_triple net (p**code c) (q**code c ##failures f) \\\n triple net f p c q\"\napply (auto simp add: triple_def s_triple_def sep_add_def)\napply (drule_tac x = co_ctx in spec)\napply clarsimp\napply (drule_tac x = presult and y = rest in spec2)\napply clarsimp\napply (drule_tac x = stopper in spec)\napply clarsimp\nsubgoal for co_ctx presult rest stopper k\napply (rule_tac exI[of _ k])\napply auto\nusing code_elm_preserved apply fastforce\n\napply (auto simp add:sep_def failures_def\n failed_for_reasons_def)\nsubgoal for u ua v va\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\nproof -\n assume a1: \"rest ua\"\n assume a2: \"ua \\ va = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)\"\n assume a3: \"ua \\ va = {}\"\n assume \"{CodeElm (pos, i) |pos i. (pos, i) \\ c} \\ va\"\n then have f4: \"ua \\ {CodeElm (i, ia) |i ia. (i, ia) \\ c} = {}\"\n using a3 by blast\n have \"\\S. (va - S) \\ ua = {} \\ {} - ua \\ S \\ {}\"\n using a3 by blast\n then have \"(va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ ua = {} \\ ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} = ua \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c})\"\n using f4 by (simp add: Diff_triv Un_Diff)\n then show \"\\S. rest S \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ S = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ S = {}\"\n using a2 a1 by auto\nqed\napply (cases \"program_sem stopper co_ctx k net presult\")\napply simp\nsubgoal for u ua v lst x1\nusing continue_elm_false[of co_ctx x1]\napply auto\ndone\napply simp\nsubgoal for u ua v lst act vctx x33\napply (cases act; simp)\nusing get_action_elm\n [of \"ContractFail lst\" co_ctx act vctx x33]\n apply (metis contract_action.distinct(5) insertI1 insert_commute)\nusing get_action_elm\n [of \"ContractFail lst\" co_ctx act vctx x33]\n apply (metis contract_action.distinct insertI1 insert_commute)\nusing get_action_elm\n [of \"ContractFail lst\" co_ctx act vctx x33]\n apply (metis contract_action.distinct insertI1 insert_commute)\ndefer\nusing get_action_elm\n [of \"ContractFail lst\" co_ctx act vctx x33]\n apply (metis contract_action.distinct insertI1 insert_commute)\nusing get_action_elm\n [of \"ContractFail lst\" co_ctx act vctx x33]\n apply (metis contract_action.distinct insertI1 insert_commute)\n by (metis \\ContractActionElm (ContractFail lst) \\ instruction_result_as_set co_ctx (InstructionToEnvironment act vctx x33) \\ ContractFail lst = act\\ contract_action.inject(4) insertI1 insert_commute)\n\napply (cases \"program_sem stopper co_ctx k net presult\")\napply simp\n\nsubgoal for u ua v va x1\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\nproof -\n assume a1: \"rest ua\"\n assume a2: \"ua \\ va = instruction_result_as_set co_ctx (InstructionContinue x1)\"\n assume a3: \"ua \\ va = {}\"\n assume a4: \"{CodeElm (pos, i) |pos i. (pos, i) \\ c} \\ va\"\n have f5: \"\\S. {} - ua \\ S = ua \\ (va - S)\"\n using a3 by auto\n have \"ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} = ua \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c})\"\n using a4 a3 by auto\n then have \"(va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ ua = {} \\ ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} = va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ ua\"\n using f5 by (simp add: inf_sup_aci(1) inf_sup_aci(5))\n then show \"\\S. rest S \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ S = instruction_result_as_set co_ctx (InstructionContinue x1) - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ S = {}\"\n using a2 a1 by auto\nqed\napply simp\nsubgoal for u ua v va\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\ndone\nsubgoal for u ua v va act vctx x33\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\nproof -\n assume a1: \"rest ua\"\n assume a2: \"ua \\ va = {}\"\n assume a3: \"{CodeElm (pos, i) |pos i. (pos, i) \\ c} \\ va\"\n assume a4: \"q (va - {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"\n assume \"program_sem stopper co_ctx k net presult = InstructionToEnvironment act vctx x33\"\n assume a5: \"ua \\ va = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)\"\n have \"ua \\ {CodeElm (i, ia) |i ia. (i, ia) \\ c} = {}\"\n using a3 a2 by blast\n then have \"va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ ua = ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ ua = {}\"\n using a2 by (simp add: Diff_Int_distrib Diff_triv Un_Diff inf_sup_aci(1) inf_sup_aci(5))\n then show \"q (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ (\\S. rest S \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ S = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ S = {})\"\n using a5 a4 a1 by auto\nqed\ndone\ndone\n\ndefinition failures2 :: \"failure_reason set \\ state_element set_pred\" where\n\"failures2 fails = (\\s.\n \\lst. set lst \\ fails \\ set lst \\ {} \\\n ContinuingElm False \\ s \\\n ContractActionElm (ContractFail lst) \\ s)\"\n\nlemma s_triple_imp2 :\n \"s_triple net (p**code c) (q**code c ##failures2 f) \\ triple net f p c q\"\napply (auto simp add: triple_def s_triple_def sep_add_def)\napply (drule_tac x = co_ctx in spec)\napply clarsimp\napply (drule_tac x = presult and y = rest in spec2)\napply clarsimp\napply (drule_tac x = stopper in spec)\napply clarsimp\nsubgoal for co_ctx presult rest stopper k\napply (rule_tac exI[of _ k])\napply auto\nusing code_elm_preserved apply fastforce\n\napply (auto simp add:sep_def failures2_def\n failed_for_reasons_def)\nsubgoal for u ua v va\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\nproof -\n assume a1: \"rest ua\"\n assume a2: \"ua \\ va = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)\"\n assume a3: \"ua \\ va = {}\"\n assume \"{CodeElm (pos, i) |pos i. (pos, i) \\ c} \\ va\"\n then have f4: \"ua \\ {CodeElm (i, ia) |i ia. (i, ia) \\ c} = {}\"\n using a3 by blast\n have \"\\S. (va - S) \\ ua = {} \\ {} - ua \\ S \\ {}\"\n using a3 by blast\n then have \"(va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ ua = {} \\ ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} = ua \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c})\"\n using f4 by (simp add: Diff_triv Un_Diff)\n then show \"\\S. rest S \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ S = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ S = {}\"\n using a2 a1 by auto\nqed\napply (cases \"program_sem stopper co_ctx k net presult\")\napply simp\nsubgoal for u ua v va lst x1\nusing continue_elm_false[of co_ctx x1]\napply auto\ndone\napply auto\napply (cases \"program_sem stopper co_ctx k net presult\")\napply auto\nsubgoal for u ua v va lst x31 x32 x33\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\n apply (metis Un_upper2 get_action_elm subset_iff)\n by (metis Un_upper2 get_action_elm subset_iff)\nsubgoal for u ua v va\napply (rule exI [of _ \"(va -\n {CodeElm (pos, i) |pos i. (pos, i) \\ c})\"])\napply auto\nproof -\n assume a1: \"rest ua\"\n assume a2: \"ua \\ va = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)\"\n assume a3: \"ua \\ va = {}\"\n assume \"{CodeElm (pos, i) |pos i. (pos, i) \\ c} \\ va\"\n then have \"ua \\ {} = ua \\ {CodeElm (i, ia) |i ia. (i, ia) \\ c}\"\n using a3 by auto\n then have \"ua \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} = va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ ua\"\n by auto\n then show \"\\S. rest S \\ va - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ S = instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) - {CodeElm (i, ia) |i ia. (i, ia) \\ c} \\ (va - {CodeElm (i, ia) |i ia. (i, ia) \\ c}) \\ S = {}\"\n using a3 a2 a1 by auto\n qed\ndone\ndone\n\nlemma s_triple_imp2 :\n \"triple net f p c q \\ s_triple net (p**code c) (q**code c ##failures2 f)\"\napply (auto simp add: triple_def s_triple_def sep_add_def)\napply (drule_tac x = co_ctx in spec)\napply clarsimp\napply (drule_tac x = presult and y = rest in spec2)\napply clarsimp\napply (drule_tac x = stopper in spec)\napply clarsimp\nsubgoal for co_ctx presult rest stopper k\napply (rule_tac exI[of _ k])\napply auto\n\napply (auto simp add:sep_def failures_def\n failed_for_reasons_def)[1]\nsubgoal for u ua v va\napply (rule exI [of _ va])\napply clarsimp\napply (rule exI [of _\n \"ua \\ {CodeElm (pos, i) |pos i. (pos, i) \\ c}\"])\napply auto\n by (metis (no_types, lifting) Diff_cancel Int_Diff Un_Diff inf_commute inf_sup_absorb inf_sup_aci(1) sup_bot.right_neutral)\n\napply (cases \"program_sem stopper co_ctx k net presult\")\napply (simp add:failed_for_reasons_def)\napply (simp add:failed_for_reasons_def)\napply (simp add:failed_for_reasons_def)\napply clarsimp\noops\n*)\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Hoare/EvmFacts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2920026623039208}} {"text": "section \\State Separators\\\n\ntext \\This theory defined state separators.\n A state separator @{text \"S\"} of some pair of states @{text \"q1\"}, @{text \"q2\"} of some FSM @{text \"M\"} \n is an acyclic single-input FSM based on the product machine @{text \"P\"} of @{text \"M\"} with initial state\n @{text \"q1\"} and @{text \"M\"} with initial state @{text \"q2\"} such that every maximal length\n sequence in the language of @{text \"S\"} is either in the language of @{text \"q1\"} or the\n language of @{text \"q2\"}, but not both.\n That is, @{text \"C\"} represents a strategy of distinguishing @{text \"q1\"} and @{text \"q2\"} in \n every complete submachine of @{text \"P\"}.\n In testing, separators are used to distinguish states reached in the SUT to establish a lower\n bound on the number of distinct states in the SUT.\\\n\n\ntheory State_Separator\nimports Product_FSM Backwards_Reachability_Analysis \"HOL-Library.Product_Lexorder\"\nbegin\n\nsubsection \\Canonical Separators\\\n\nsubsubsection \\Construction\\\n\nlift_definition canonical_separator' :: \"('a,'b,'c) fsm \\ (('a \\ 'a),'b,'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a) + 'a,'b,'c) fsm\" is FSM_Impl.canonical_separator'\nproof -\n fix A :: \"('a,'b,'c) fsm_impl\"\n fix B :: \"('a \\ 'a,'b,'c) fsm_impl\"\n fix q1 :: 'a\n fix q2 :: 'a\n assume \"well_formed_fsm A\" and \"well_formed_fsm B\"\n\n then have p1a: \"fsm_impl.initial A \\ fsm_impl.nodes A\"\n and p2a: \"finite (fsm_impl.nodes A)\"\n and p3a: \"finite (fsm_impl.inputs A)\"\n and p4a: \"finite (fsm_impl.outputs A)\"\n and p5a: \"finite (fsm_impl.transitions A)\"\n and p6a: \"(\\t\\fsm_impl.transitions A.\n t_source t \\ fsm_impl.nodes A \\\n t_input t \\ fsm_impl.inputs A \\ t_target t \\ fsm_impl.nodes A \\\n t_output t \\ fsm_impl.outputs A)\"\n and p1b: \"fsm_impl.initial B \\ fsm_impl.nodes B\"\n and p2b: \"finite (fsm_impl.nodes B)\"\n and p3b: \"finite (fsm_impl.inputs B)\"\n and p4b: \"finite (fsm_impl.outputs B)\"\n and p5b: \"finite (fsm_impl.transitions B)\"\n and p6b: \"(\\t\\fsm_impl.transitions B.\n t_source t \\ fsm_impl.nodes B \\\n t_input t \\ fsm_impl.inputs B \\ t_target t \\ fsm_impl.nodes B \\\n t_output t \\ fsm_impl.outputs B)\"\n by simp+\n\n let ?P = \"FSM_Impl.canonical_separator' A B q1 q2\"\n\n show \"well_formed_fsm ?P\" proof (cases \"fsm_impl.initial B = (q1,q2)\")\n case False\n then show ?thesis by auto\n next\n case True\n\n let ?f = \"(\\qx . (case (set_as_map (image (\\(q,x,y,q') . ((q,x),y)) (fsm_impl.transitions A))) qx of Some yqs \\ yqs | None \\ {}))\"\n \n have \"\\ qx . (\\qx . (case (set_as_map (image (\\(q,x,y,q') . ((q,x),y)) (fsm_impl.transitions A))) qx of Some yqs \\ yqs | None \\ {})) qx = (\\ qx . {z. (qx, z) \\ (\\(q, x, y, q'). ((q, x), y)) ` fsm_impl.transitions A}) qx\"\n proof -\n fix qx\n show \"\\ qx . (\\qx . (case (set_as_map (image (\\(q,x,y,q') . ((q,x),y)) (fsm_impl.transitions A))) qx of Some yqs \\ yqs | None \\ {})) qx = (\\ qx . {z. (qx, z) \\ (\\(q, x, y, q'). ((q, x), y)) ` fsm_impl.transitions A}) qx\"\n unfolding set_as_map_def by (cases \"\\z. (qx, z) \\ (\\(q, x, y, q'). ((q, x), y)) ` fsm_impl.transitions A\"; auto)\n qed\n moreover have \"\\ qx . (\\ qx . {z. (qx, z) \\ (\\(q, x, y, q'). ((q, x), y)) ` fsm_impl.transitions A}) qx = (\\ qx . {y | y . \\ q' . (fst qx, snd qx, y, q') \\ fsm_impl.transitions A}) qx\"\n proof -\n fix qx \n show \"(\\ qx . {z. (qx, z) \\ (\\(q, x, y, q'). ((q, x), y)) ` fsm_impl.transitions A}) qx = (\\ qx . {y | y . \\ q' . (fst qx, snd qx, y, q') \\ fsm_impl.transitions A}) qx\"\n by force\n qed\n ultimately have *:\" ?f = (\\ qx . {y | y . \\ q' . (fst qx, snd qx, y, q') \\ fsm_impl.transitions A})\" \n by blast\n \n let ?shifted_transitions' = \"shifted_transitions (fsm_impl.transitions B)\"\n let ?distinguishing_transitions_lr = \"distinguishing_transitions ?f q1 q2 (fsm_impl.nodes B) (fsm_impl.inputs B)\"\n let ?ts = \"?shifted_transitions' \\ ?distinguishing_transitions_lr\"\n \n have \"FSM_Impl.nodes ?P = (image Inl (FSM_Impl.nodes B)) \\ {Inr q1, Inr q2}\"\n and \"FSM_Impl.transitions ?P = ?ts\"\n unfolding FSM_Impl.canonical_separator'.simps Let_def True by simp+\n\n have p2: \"finite (fsm_impl.nodes ?P)\"\n unfolding \\FSM_Impl.nodes ?P = (image Inl (FSM_Impl.nodes B)) \\ {Inr q1, Inr q2}\\ using p2b by blast\n \n have \"fsm_impl.initial ?P = Inl (q1,q2)\" by auto\n then have p1: \"fsm_impl.initial ?P \\ fsm_impl.nodes ?P\" \n using p1a p1b unfolding canonical_separator'.simps True by auto\n have p3: \"finite (fsm_impl.inputs ?P)\"\n using p3a p3b by auto\n have p4: \"finite (fsm_impl.outputs ?P)\"\n using p4a p4b by auto\n\n have \"finite (fsm_impl.nodes B \\ fsm_impl.inputs B)\"\n using p2b p3b by blast\n moreover have **: \"\\ x q1 . finite ({y |y. \\q'. (fst (q1, x), snd (q1, x), y, q') \\ fsm_impl.transitions A})\"\n proof - \n fix x q1\n have \"{y |y. \\q'. (fst (q1, x), snd (q1, x), y, q') \\ fsm_impl.transitions A} = {t_output t | t . t \\ fsm_impl.transitions A \\ t_source t = q1 \\ t_input t = x}\"\n by auto\n then have \"{y |y. \\q'. (fst (q1, x), snd (q1, x), y, q') \\ fsm_impl.transitions A} \\ image t_output (fsm_impl.transitions A)\"\n unfolding fst_conv snd_conv by blast\n moreover have \"finite (image t_output (fsm_impl.transitions A))\"\n using p5a by auto\n ultimately show \"finite ({y |y. \\q'. (fst (q1, x), snd (q1, x), y, q') \\ fsm_impl.transitions A})\"\n by (simp add: finite_subset)\n qed\n ultimately have \"finite ?distinguishing_transitions_lr\"\n unfolding * distinguishing_transitions_def by force\n moreover have \"finite ?shifted_transitions'\"\n unfolding shifted_transitions_def using p5b by auto\n ultimately have \"finite ?ts\" by blast\n then have p5: \"finite (fsm_impl.transitions ?P)\"\n by simp\n \n have \"fsm_impl.inputs ?P = fsm_impl.inputs A \\ fsm_impl.inputs B\"\n using True by auto\n have \"fsm_impl.outputs ?P = fsm_impl.outputs A \\ fsm_impl.outputs B\"\n using True by auto\n \n have \"\\ t . t \\ ?shifted_transitions' \\ t_source t \\ fsm_impl.nodes ?P \\ t_target t \\ fsm_impl.nodes ?P\"\n unfolding \\FSM_Impl.nodes ?P = (image Inl (FSM_Impl.nodes B)) \\ {Inr q1, Inr q2}\\ shifted_transitions_def \n using p6b by force\n moreover have \"\\ t . t \\ ?distinguishing_transitions_lr \\ t_source t \\ fsm_impl.nodes ?P \\ t_target t \\ fsm_impl.nodes ?P\"\n unfolding \\FSM_Impl.nodes ?P = (image Inl (FSM_Impl.nodes B)) \\ {Inr q1, Inr q2}\\ distinguishing_transitions_def * by force\n ultimately have \"\\ t . t \\ ?ts \\ t_source t \\ fsm_impl.nodes ?P \\ t_target t \\ fsm_impl.nodes ?P\"\n by blast\n moreover have \"\\ t . t \\ ?shifted_transitions' \\ t_input t \\ fsm_impl.inputs ?P \\ t_output t \\ fsm_impl.outputs ?P\"\n proof -\n have \"\\ t . t \\ ?shifted_transitions' \\ t_input t \\ fsm_impl.inputs B \\ t_output t \\ fsm_impl.outputs B\"\n unfolding shifted_transitions_def using p6b by auto\n then show \"\\ t . t \\ ?shifted_transitions' \\ t_input t \\ fsm_impl.inputs ?P \\ t_output t \\ fsm_impl.outputs ?P\"\n unfolding \\fsm_impl.inputs ?P = fsm_impl.inputs A \\ fsm_impl.inputs B\\\n \\fsm_impl.outputs ?P = fsm_impl.outputs A \\ fsm_impl.outputs B\\ by blast\n qed\n moreover have \"\\ t . t \\ ?distinguishing_transitions_lr \\ t_input t \\ fsm_impl.inputs ?P \\ t_output t \\ fsm_impl.outputs ?P\"\n unfolding * distinguishing_transitions_def using p6a p6b True by auto\n ultimately have p6: \"(\\t\\fsm_impl.transitions ?P.\n t_source t \\ fsm_impl.nodes ?P \\\n t_input t \\ fsm_impl.inputs ?P \\ t_target t \\ fsm_impl.nodes ?P \\\n t_output t \\ fsm_impl.outputs ?P)\"\n unfolding \\FSM_Impl.transitions ?P = ?ts\\ by blast\n \n show \"well_formed_fsm ?P\"\n using p1 p2 p3 p4 p5 p6 by linarith\n qed\nqed \n\n\nlemma canonical_separator'_simps :\n assumes \"initial P = (q1,q2)\"\n shows \"initial (canonical_separator' M P q1 q2) = Inl (q1,q2)\"\n \"nodes (canonical_separator' M P q1 q2) = (image Inl (nodes P)) \\ {Inr q1, Inr q2}\"\n \"inputs (canonical_separator' M P q1 q2) = inputs M \\ inputs P\"\n \"outputs (canonical_separator' M P q1 q2) = outputs M \\ outputs P\"\n \"transitions (canonical_separator' M P q1 q2) \n = shifted_transitions (transitions P) \n \\ distinguishing_transitions (h_out M) q1 q2 (nodes P) (inputs P)\"\n using assms unfolding h_out_code by (transfer; auto)+\n\n\n\nfun canonical_separator :: \"('a,'b,'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a) + 'a,'b,'c) fsm\" where\n \"canonical_separator M q1 q2 = (canonical_separator' M ((product (from_FSM M q1) (from_FSM M q2))) q1 q2)\"\n\n\nlemma canonical_separator_simps :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"initial (canonical_separator M q1 q2) = Inl (q1,q2)\"\n \"nodes (canonical_separator M q1 q2) \n = (image Inl (nodes (product (from_FSM M q1) (from_FSM M q2)))) \\ {Inr q1, Inr q2}\"\n \"inputs (canonical_separator M q1 q2) = inputs M\"\n \"outputs (canonical_separator M q1 q2) = outputs M\"\n \"transitions (canonical_separator M q1 q2) \n = shifted_transitions (transitions ((product (from_FSM M q1) (from_FSM M q2)))) \n \\ distinguishing_transitions (h_out M) q1 q2 (nodes ((product (from_FSM M q1) (from_FSM M q2)))) (inputs ((product (from_FSM M q1) (from_FSM M q2))))\"\nproof -\n have *: \"initial ((product (from_FSM M q1) (from_FSM M q2))) = (q1,q2)\"\n unfolding restrict_to_reachable_nodes_simps product_simps using assms by auto\n have ***: \"inputs ((product (from_FSM M q1) (from_FSM M q2))) = inputs M\"\n unfolding restrict_to_reachable_nodes_simps product_simps using assms by auto\n have ****: \"outputs ((product (from_FSM M q1) (from_FSM M q2))) = outputs M\"\n unfolding restrict_to_reachable_nodes_simps product_simps using assms by auto\n \n show \"initial (canonical_separator M q1 q2) = Inl (q1,q2)\"\n \"nodes (canonical_separator M q1 q2) = (image Inl (nodes (product (from_FSM M q1) (from_FSM M q2)))) \\ {Inr q1, Inr q2}\"\n \"inputs (canonical_separator M q1 q2) = inputs M\"\n \"outputs (canonical_separator M q1 q2) = outputs M\"\n \"transitions (canonical_separator M q1 q2) = shifted_transitions (transitions ((product (from_FSM M q1) (from_FSM M q2)))) \\ distinguishing_transitions (h_out M) q1 q2 (nodes ((product (from_FSM M q1) (from_FSM M q2)))) (inputs ((product (from_FSM M q1) (from_FSM M q2))))\"\n unfolding canonical_separator.simps canonical_separator'_simps[OF *, of M] *** **** by blast+\nqed\n\n\nlemma distinguishing_transitions_alt_def :\n \"distinguishing_transitions (h_out M) q1 q2 PS (inputs M) = \n {(Inl (q1',q2'),x,y,Inr q1) | q1' q2' x y . (q1',q2') \\ PS \\ (\\ q' . (q1',x,y,q') \\ transitions M) \\ \\(\\ q' . (q2',x,y,q') \\ transitions M)}\n \\ {(Inl (q1',q2'),x,y,Inr q2) | q1' q2' x y . (q1',q2') \\ PS \\ \\(\\ q' . (q1',x,y,q') \\ transitions M) \\ (\\ q' . (q2',x,y,q') \\ transitions M)}\"\n (is \"?dts = ?dl \\ ?dr\")\nproof -\n have \"\\ t . t \\ ?dts \\ t \\ ?dl \\ t \\ ?dr\" \n unfolding distinguishing_transitions_def h_out.simps by fastforce\n moreover have \"\\ t . t \\ ?dl \\ t \\ ?dr \\ t \\ ?dts\" \n proof -\n fix t assume \"t \\ ?dl \\ t \\ ?dr\"\n then obtain q1' q2' where \"t_source t = Inl (q1',q2')\" and \"(q1',q2') \\ PS\"\n by auto\n \n consider (a) \"t \\ ?dl\" |\n (b) \"t \\ ?dr\" \n using \\t \\ ?dl \\ t \\ ?dr\\ by blast\n then show \"t \\ ?dts\" proof cases\n case a\n then have \"t_target t = Inr q1\" and \"(\\ q' . (q1',t_input t,t_output t,q') \\ transitions M)\" \n and \"\\(\\ q' . (q2',t_input t,t_output t,q') \\ transitions M)\"\n using \\t_source t = Inl (q1',q2')\\ by force+\n then have \"t_output t \\ h_out M (q1',t_input t) - h_out M (q2',t_input t)\"\n unfolding h_out.simps by blast\n then have \"t \\ (\\y. (Inl (q1', q2'), t_input t, y, Inr q1)) ` (h_out M (q1', t_input t) - h_out M (q2', t_input t))\"\n using \\t_source t = Inl (q1',q2')\\ \\t_target t = Inr q1\\\n by (metis (mono_tags, lifting) imageI surjective_pairing) \n moreover have \"((q1',q2'),t_input t) \\ PS \\ inputs M\"\n using fsm_transition_input \\(\\ q' . (q1',t_input t,t_output t,q') \\ transitions M)\\ \n \\(q1',q2') \\ PS\\ \n by auto \n ultimately show ?thesis \n unfolding distinguishing_transitions_def by fastforce\n next\n case b\n then have \"t_target t = Inr q2\" and \"\\(\\ q' . (q1',t_input t,t_output t,q') \\ transitions M)\" \n and \"(\\ q' . (q2',t_input t,t_output t,q') \\ transitions M)\"\n using \\t_source t = Inl (q1',q2')\\ by force+\n then have \"t_output t \\ h_out M (q2',t_input t) - h_out M (q1',t_input t)\"\n unfolding h_out.simps by blast\n then have \"t \\ (\\y. (Inl (q1', q2'), t_input t, y, Inr q2)) ` (h_out M (q2', t_input t) - h_out M (q1', t_input t))\"\n using \\t_source t = Inl (q1',q2')\\ \\t_target t = Inr q2\\\n by (metis (mono_tags, lifting) imageI surjective_pairing) \n moreover have \"((q1',q2'),t_input t) \\ PS \\ inputs M\"\n using fsm_transition_input \\(\\ q' . (q2',t_input t,t_output t,q') \\ transitions M)\\ \\(q1',q2') \\ PS\\ \n by auto \n ultimately show ?thesis \n unfolding distinguishing_transitions_def by fastforce\n qed\n qed\n ultimately show ?thesis by blast\nqed\n\n\nlemma distinguishing_transitions_alt_alt_def :\n \"distinguishing_transitions (h_out M) q1 q2 PS (inputs M) = \n { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ PS \\ t_target t = Inr q1 \\ (\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ \\(\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\n \\ { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ PS \\ t_target t = Inr q2 \\ \\(\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ (\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n \nproof -\n have \"{(Inl (q1',q2'),x,y,Inr q1) | q1' q2' x y . (q1',q2') \\ PS \\ (\\ q' . (q1',x,y,q') \\ transitions M) \\ \\(\\ q' . (q2',x,y,q') \\ transitions M)}\n = { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ PS \\ t_target t = Inr q1 \\ (\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ \\(\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n by force\n moreover have \"{(Inl (q1',q2'),x,y,Inr q2) | q1' q2' x y . (q1',q2') \\ PS \\ \\(\\ q' . (q1',x,y,q') \\ transitions M) \\ (\\ q' . (q2',x,y,q') \\ transitions M)}\n = { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ PS \\ t_target t = Inr q2 \\ \\(\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ (\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n by force\n ultimately show ?thesis \n unfolding distinguishing_transitions_alt_def by force\nqed\n \n\nlemma shifted_transitions_alt_def :\n \"shifted_transitions ts = {(Inl (q1',q2'), x, y, (Inl (q1'',q2''))) | q1' q2' x y q1'' q2'' . ((q1',q2'), x, y, (q1'',q2'')) \\ ts}\" \n unfolding shifted_transitions_def by force\n\n\nlemma canonical_separator_transitions_helper :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"transitions (canonical_separator M q1 q2) = \n (shifted_transitions (transitions (product (from_FSM M q1) (from_FSM M q2))))\n \\ {(Inl (q1',q2'),x,y,Inr q1) | q1' q2' x y . (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ (\\ q' . (q1',x,y,q') \\ transitions M) \\ \\(\\ q' . (q2',x,y,q') \\ transitions M)}\n \\ {(Inl (q1',q2'),x,y,Inr q2) | q1' q2' x y . (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ \\(\\ q' . (q1',x,y,q') \\ transitions M) \\ (\\ q' . (q2',x,y,q') \\ transitions M)}\"\n unfolding canonical_separator_simps[OF assms]\n restrict_to_reachable_nodes_simps\n product_simps from_FSM_simps[OF assms(1)] from_FSM_simps[OF assms(2)]\n sup.idem\n distinguishing_transitions_alt_def \n by blast\n\n\ndefinition distinguishing_transitions_left :: \"('a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) set\" where\n \"distinguishing_transitions_left M q1 q2 \\ {(Inl (q1',q2'),x,y,Inr q1) | q1' q2' x y . (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ (\\ q' . (q1',x,y,q') \\ transitions M) \\ \\(\\ q' . (q2',x,y,q') \\ transitions M)}\"\ndefinition distinguishing_transitions_right :: \"('a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) set\" where\n \"distinguishing_transitions_right M q1 q2 \\ {(Inl (q1',q2'),x,y,Inr q2) | q1' q2' x y . (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ \\(\\ q' . (q1',x,y,q') \\ transitions M) \\ (\\ q' . (q2',x,y,q') \\ transitions M)}\"\n\ndefinition distinguishing_transitions_left_alt :: \"('a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) set\" where\n \"distinguishing_transitions_left_alt M q1 q2 \\ { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ t_target t = Inr q1 \\ (\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ \\(\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\ndefinition distinguishing_transitions_right_alt :: \"('a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) set\" where\n \"distinguishing_transitions_right_alt M q1 q2 \\ { t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ t_target t = Inr q2 \\ \\(\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ (\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n\n\ndefinition shifted_transitions_for :: \"('a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) set\" where\n\"shifted_transitions_for M q1 q2 \\ {(Inl (t_source t),t_input t, t_output t, Inl (t_target t)) | t . t \\ transitions (product (from_FSM M q1) (from_FSM M q2))}\"\n\n\nlemma shifted_transitions_for_alt_def :\n \"shifted_transitions_for M q1 q2 = {(Inl (q1',q2'), x, y, (Inl (q1'',q2''))) | q1' q2' x y q1'' q2'' . ((q1',q2'), x, y, (q1'',q2'')) \\ transitions (product (from_FSM M q1) (from_FSM M q2))}\"\n unfolding shifted_transitions_for_def by auto\n\n\nlemma distinguishing_transitions_left_alt_alt_def :\n \"distinguishing_transitions_left M q1 q2 = distinguishing_transitions_left_alt M q1 q2\" \nproof -\n have \"\\ t . t \\ distinguishing_transitions_left M q1 q2 \\ t \\ distinguishing_transitions_left_alt M q1 q2\" \n proof -\n fix t assume \"t \\ distinguishing_transitions_left M q1 q2\"\n then obtain q1' q2' x y where \"t = (Inl (q1', q2'), x, y, Inr q1)\"\n \"(q1', q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n \"(\\q'. (q1', x, y, q') \\ FSM.transitions M)\" \n \"(\\q'. (q2', x, y, q') \\ FSM.transitions M)\"\n unfolding distinguishing_transitions_left_def by blast\n\n have \"t_source t = Inl (q1', q2')\"\n using \\t = (Inl (q1', q2'), x, y, Inr q1)\\ by auto\n moreover note \\(q1', q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\\\n moreover have \"t_target t = Inr q1\"\n using \\t = (Inl (q1', q2'), x, y, Inr q1)\\ by auto\n moreover have \"(\\t'\\FSM.transitions M. t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t)\" \n using \\(\\q'. (q1', x, y, q') \\ FSM.transitions M)\\ unfolding \\t = (Inl (q1', q2'), x, y, Inr q1)\\ by force\n moreover have \"\\(\\t'\\FSM.transitions M. t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)\" \n using \\(\\q'. (q2', x, y, q') \\ FSM.transitions M)\\ unfolding \\t = (Inl (q1', q2'), x, y, Inr q1)\\ by force\n ultimately show \"t \\ distinguishing_transitions_left_alt M q1 q2\"\n unfolding distinguishing_transitions_left_alt_def by simp\n qed\n moreover have \"\\ t . t \\ distinguishing_transitions_left_alt M q1 q2 \\ t \\ distinguishing_transitions_left M q1 q2\"\n unfolding distinguishing_transitions_left_alt_def distinguishing_transitions_left_def \n by fastforce\n ultimately show ?thesis by blast \nqed\n\n\nlemma distinguishing_transitions_right_alt_alt_def :\n \"distinguishing_transitions_right M q1 q2 = distinguishing_transitions_right_alt M q1 q2\" \nproof -\n have \"\\ t . t \\ distinguishing_transitions_right M q1 q2 \\ t \\ distinguishing_transitions_right_alt M q1 q2\" \n proof -\n fix t assume \"t \\ distinguishing_transitions_right M q1 q2\"\n then obtain q1' q2' x y where \"t = (Inl (q1', q2'), x, y, Inr q2)\"\n \"(q1', q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n \"(\\q'. (q1', x, y, q') \\ FSM.transitions M)\" \n \"(\\q'. (q2', x, y, q') \\ FSM.transitions M)\"\n unfolding distinguishing_transitions_right_def by blast\n\n have \"t_source t = Inl (q1', q2')\"\n using \\t = (Inl (q1', q2'), x, y, Inr q2)\\ by auto\n moreover note \\(q1', q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\\\n moreover have \"t_target t = Inr q2\"\n using \\t = (Inl (q1', q2'), x, y, Inr q2)\\ by auto\n moreover have \"\\(\\t'\\FSM.transitions M. t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t)\" \n using \\(\\q'. (q1', x, y, q') \\ FSM.transitions M)\\ unfolding \\t = (Inl (q1', q2'), x, y, Inr q2)\\ by force\n moreover have \"(\\t'\\FSM.transitions M. t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)\" \n using \\(\\q'. (q2', x, y, q') \\ FSM.transitions M)\\ unfolding \\t = (Inl (q1', q2'), x, y, Inr q2)\\ by force\n ultimately show \"t \\ distinguishing_transitions_right_alt M q1 q2\"\n unfolding distinguishing_transitions_right_def distinguishing_transitions_right_alt_def by simp\n qed\n moreover have \"\\ t . t \\ distinguishing_transitions_right_alt M q1 q2 \\ t \\ distinguishing_transitions_right M q1 q2\"\n unfolding distinguishing_transitions_right_def distinguishing_transitions_right_alt_def by fastforce\n ultimately show ?thesis\n by blast\nqed\n\n \nlemma canonical_separator_transitions_def :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"transitions (canonical_separator M q1 q2) = \n {(Inl (q1',q2'), x, y, (Inl (q1'',q2''))) | q1' q2' x y q1'' q2'' . ((q1',q2'), x, y, (q1'',q2'')) \\ transitions (product (from_FSM M q1) (from_FSM M q2))}\n \\ (distinguishing_transitions_left M q1 q2) \n \\ (distinguishing_transitions_right M q1 q2)\"\n unfolding canonical_separator_transitions_helper[OF assms]\n shifted_transitions_alt_def \n distinguishing_transitions_left_def\n distinguishing_transitions_right_def by simp \n\nlemma canonical_separator_transitions_alt_def :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"transitions (canonical_separator M q1 q2) = \n (shifted_transitions_for M q1 q2)\n \\ (distinguishing_transitions_left_alt M q1 q2)\n \\ (distinguishing_transitions_right_alt M q1 q2)\"\nproof -\n have *: \"(shift_Inl `\n {t \\ FSM.transitions (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2)).\n t_source t \\ reachable_nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))})\n = {(Inl (t_source t), t_input t, t_output t, Inl (t_target t)) |t.\n t \\ FSM.transitions (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2)) \\\n t_source t \\ reachable_nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))}\" \n by blast\n \n show ?thesis\n unfolding canonical_separator_simps[OF assms]\n shifted_transitions_def\n restrict_to_reachable_nodes_simps\n product_simps from_FSM_simps[OF assms(1)] from_FSM_simps[OF assms(2)]\n sup.idem\n \n distinguishing_transitions_alt_alt_def\n shifted_transitions_for_def \n * \n \n distinguishing_transitions_left_alt_def\n distinguishing_transitions_right_alt_def\n by blast\nqed\n\n\n\n\nsubsubsection \\State Separators as Submachines of Canonical Separators\\\n\ndefinition is_state_separator_from_canonical_separator :: \"(('a \\ 'a) + 'a, 'b, 'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a) + 'a, 'b, 'c) fsm \\ bool\" where\n \"is_state_separator_from_canonical_separator CSep q1 q2 S = (\n is_submachine S CSep \n \\ single_input S\n \\ acyclic S\n \\ deadlock_state S (Inr q1)\n \\ deadlock_state S (Inr q2)\n \\ ((Inr q1) \\ reachable_nodes S)\n \\ ((Inr q2) \\ reachable_nodes S)\n \\ (\\ q \\ reachable_nodes S . (q \\ Inr q1 \\ q \\ Inr q2) \\ (isl q \\ \\ deadlock_state S q))\n \\ (\\ q \\ reachable_nodes S . \\ x \\ (inputs CSep) . (\\ t \\ transitions S . t_source t = q \\ t_input t = x) \\ (\\ t' \\ transitions CSep . t_source t' = q \\ t_input t' = x \\ t' \\ transitions S))\n)\"\n\n\nsubsubsection \\Canonical Separator Properties\\\n\nlemma is_state_separator_from_canonical_separator_simps :\n assumes \"is_state_separator_from_canonical_separator CSep q1 q2 S\"\n shows \"is_submachine S CSep\" \n and \"single_input S\"\n and \"acyclic S\"\n and \"deadlock_state S (Inr q1)\"\n and \"deadlock_state S (Inr q2)\"\n and \"((Inr q1) \\ reachable_nodes S)\"\n and \"((Inr q2) \\ reachable_nodes S)\"\n and \"\\ q . q \\ reachable_nodes S \\ q \\ Inr q1 \\ q \\ Inr q2 \\ (isl q \\ \\ deadlock_state S q)\"\n and \"\\ q x t . q \\ reachable_nodes S \\ x \\ (inputs CSep) \\ (\\ t \\ transitions S . t_source t = q \\ t_input t = x) \\ t \\ transitions CSep \\ t_source t = q \\ t_input t = x \\ t \\ transitions S\"\n using assms unfolding is_state_separator_from_canonical_separator_def by blast+\n\n\nlemma is_state_separator_from_canonical_separator_initial :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n shows \"initial A = Inl (q1,q2)\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(1)] \n using canonical_separator_simps(1)[OF assms(2,3)] by auto\n\n\nlemma path_shift_Inl :\n assumes \"(image shift_Inl (transitions M)) \\ (transitions C)\"\n and \"\\ t . t \\ (transitions C) \\ isl (t_target t) \\ \\ t' \\ transitions M . t = (Inl (t_source t'), t_input t', t_output t', Inl (t_target t'))\"\n and \"initial C = Inl (initial M)\"\n and \"(inputs C) = (inputs M)\"\n and \"(outputs C) = (outputs M)\"\n shows \"path M (initial M) p = path C (initial C) (map shift_Inl p)\"\nproof (induction p rule: rev_induct)\n case Nil\n then show ?case by auto\nnext\n case (snoc t p)\n\n have \"path M (initial M) (p@[t]) \\ path C (initial C) (map shift_Inl (p@[t]))\"\n proof -\n assume \"path M (initial M) (p@[t])\"\n then have \"path M (initial M) p\" by auto\n then have \"path C (initial C) (map shift_Inl p)\" using snoc.IH\n by auto \n\n have \"t_source t = target (initial M) p\"\n using \\path M (initial M) (p@[t])\\ by auto\n then have \"t_source (shift_Inl t) = target (Inl (initial M)) (map shift_Inl p)\"\n by (cases p rule: rev_cases; auto)\n then have \"t_source (shift_Inl t) = target (initial C) (map shift_Inl p)\"\n using assms(3) by auto\n moreover have \"target (initial C) (map shift_Inl p) \\ nodes C\"\n using path_target_is_node[OF \\path C (initial C) (map shift_Inl p)\\] by assumption\n ultimately have \"t_source (shift_Inl t) \\ nodes C\"\n by auto\n moreover have \"t \\ transitions M\"\n using \\path M (initial M) (p@[t])\\ by auto\n ultimately have \"(shift_Inl t) \\ transitions C\"\n using assms by auto\n\n show \"path C (initial C) (map shift_Inl (p@[t]))\"\n using path_append [OF \\path C (initial C) (map shift_Inl p)\\, of \"[shift_Inl t]\"]\n using \\(shift_Inl t) \\ transitions C\\ \\t_source (shift_Inl t) = target (initial C) (map shift_Inl p)\\\n using single_transition_path by force \n qed\n\n moreover have \"path C (initial C) (map shift_Inl (p@[t])) \\ path M (initial M) (p@[t])\" \n proof -\n assume \"path C (initial C) (map shift_Inl (p@[t]))\"\n then have \"path C (initial C) (map shift_Inl p)\" by auto\n then have \"path M (initial M) p\" using snoc.IH\n by blast \n\n have \"t_source (shift_Inl t) = target (initial C) (map shift_Inl p)\"\n using \\path C (initial C) (map shift_Inl (p@[t]))\\ by auto\n then have \"t_source (shift_Inl t) = target (Inl (initial M)) (map shift_Inl p)\"\n using assms(3) by (cases p rule: rev_cases; auto)\n then have \"t_source t = target (initial M) p\"\n by (cases p rule: rev_cases; auto)\n moreover have \"target (initial M) p \\ nodes M\"\n using path_target_is_node[OF \\path M (initial M) p\\] by assumption\n ultimately have \"t_source t \\ nodes M\"\n by auto\n moreover have \"shift_Inl t \\ transitions C\"\n using \\path C (initial C) (map shift_Inl (p@[t]))\\ by auto\n moreover have \"isl (t_target (shift_Inl t))\"\n by auto\n ultimately have \"t \\ transitions M\" using assms by fastforce\n\n show \"path M (initial M) (p@[t])\"\n using path_append [OF \\path M (initial M) p\\, of \"[t]\"]\n single_transition_path[OF \\t \\ transitions M\\]\n \\t_source t = target (initial M) p\\ by auto\n qed\n\n ultimately show ?case\n by linarith \nqed\n\n\nlemma canonical_separator_product_transitions_subset : \n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"image shift_Inl (transitions (product (from_FSM M q1) (from_FSM M q2))) \\ (transitions (canonical_separator M q1 q2))\"\n unfolding canonical_separator_simps[OF assms] shifted_transitions_def restrict_to_reachable_nodes_simps \n by blast\n\n\nlemma canonical_separator_transition_targets :\n assumes \"t \\ (transitions (canonical_separator M q1 q2))\" \n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\nshows \"isl (t_target t) \\ t \\ {(Inl (t_source t),t_input t, t_output t, Inl (t_target t)) | t . t \\ transitions (product (from_FSM M q1) (from_FSM M q2))}\" \nand \"t_target t = Inr q1 \\ q1 \\ q2 \\ t \\ (distinguishing_transitions_left_alt M q1 q2)\"\nand \"t_target t = Inr q2 \\ q1 \\ q2 \\ t \\ (distinguishing_transitions_right_alt M q1 q2)\"\nand \"isl (t_target t) \\ t_target t = Inr q1 \\ t_target t = Inr q2\"\nunfolding shifted_transitions_for_def\n distinguishing_transitions_left_alt_def\n distinguishing_transitions_right_alt_def\nproof -\n let ?shftd = \"{(Inl (t_source t),t_input t, t_output t, Inl (t_target t)) | t . t \\ transitions (product (from_FSM M q1) (from_FSM M q2))}\"\n let ?dl = \"{ t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ t_target t = Inr q1 \\ (\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ \\(\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n let ?dr = \"{ t . \\ q1' q2' . t_source t = Inl (q1',q2') \\ (q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2)) \\ t_target t = Inr q2 \\ \\(\\ t' \\ transitions M . t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t) \\ (\\ t' \\ transitions M . t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)}\"\n\n have \"t \\ ?shftd \\ ?dl \\ ?dr\"\n using assms(1) \n unfolding canonical_separator_transitions_alt_def[OF assms(2,3)]\n shifted_transitions_for_def\n distinguishing_transitions_left_alt_def\n distinguishing_transitions_right_alt_def\n by force\n\n moreover have p1: \"\\ t' . t' \\ ?shftd \\ isl (t_target t')\" \n and p2: \"\\ t' . t' \\ ?dl \\ t_target t' = Inr q1\" \n and p3: \"\\ t' . t' \\ ?dr \\ t_target t' = Inr q2\" \n by auto\n ultimately show \"isl (t_target t) \\ t_target t = Inr q1 \\ t_target t = Inr q2\" \n by fast\n\n show \"isl (t_target t) \\ t \\ ?shftd\" \n proof -\n assume \"isl (t_target t)\"\n then have \"t_target t \\ Inr q1\" and \"t_target t \\ Inr q2\" by auto\n then have \"t \\ ?dl\" and \"t \\ ?dr\" by force+\n then show ?thesis using \\t \\ ?shftd \\ ?dl \\ ?dr\\ by fastforce\n qed\n\n show \"t_target t = Inr q1 \\ q1 \\ q2 \\ t \\ ?dl\" \n proof -\n assume \"t_target t = Inr q1\" and \"q1 \\ q2\"\n then have \"\\ isl (t_target t)\" and \"t_target t \\ Inr q2\" by auto\n then have \"t \\ ?shftd\" and \"t \\ ?dr\" by force+\n then show ?thesis using \\t \\ ?shftd \\ ?dl \\ ?dr\\ by fastforce\n qed\n\n show \"t_target t = Inr q2 \\ q1 \\ q2 \\ t \\ ?dr\" \n proof -\n assume \"t_target t = Inr q2\" and \"q1 \\ q2\"\n then have \"\\ isl (t_target t)\" and \"t_target t \\ Inr q1\" by auto\n then have \"t \\ ?shftd\" and \"t \\ ?dl\" by force+\n then show ?thesis using \\t \\ ?shftd \\ ?dl \\ ?dr\\ by fastforce\n qed\nqed\n\n\nlemma canonical_separator_path_shift :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"path (product (from_FSM M q1) (from_FSM M q2)) (initial (product (from_FSM M q1) (from_FSM M q2))) p \n = path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) (map shift_Inl p)\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n let ?P = \"(product (from_FSM M q1) (from_FSM M q2))\"\n let ?PR = \"(product (from_FSM M q1) (from_FSM M q2))\"\n \n have \"(inputs ?C) = (inputs ?P)\" \n and \"(outputs ?C) = (outputs ?P)\"\n unfolding canonical_separator_simps(3,4)[OF assms] using assms by auto\n\n have p1: \"shift_Inl `\n FSM.transitions\n ((Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2)))\n \\ FSM.transitions (canonical_separator M q1 q2)\"\n using canonical_separator_product_transitions_subset[OF assms]\n unfolding restrict_to_reachable_nodes_simps by assumption\n\n have p2: \"(\\t. t \\ FSM.transitions (canonical_separator M q1 q2) \\\n isl (t_target t) \\\n \\t'\\FSM.transitions\n ((Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))).\n t = shift_Inl t')\"\n using canonical_separator_transition_targets(1)[OF _ assms] unfolding restrict_to_reachable_nodes_simps by fastforce\n\n have \"path ?PR (initial ?PR) p = path ?C (initial ?C) (map shift_Inl p)\"\n using path_shift_Inl[of ?PR ?C, OF p1 p2] \n unfolding restrict_to_reachable_nodes_simps canonical_separator_simps(1,2,3,4)[OF assms] using assms by auto\n moreover have \"path ?P (initial ?P) p = path ?PR (initial ?PR) p\"\n unfolding restrict_to_reachable_nodes_simps\n restrict_to_reachable_nodes_path[OF reachable_nodes_initial] \n by simp \n ultimately show ?thesis \n by simp\nqed\n\n\nlemma canonical_separator_t_source_isl :\n assumes \"t \\ (transitions (canonical_separator M q1 q2))\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"isl (t_source t)\"\n using assms(1) \n unfolding canonical_separator_transitions_alt_def[OF assms(2,3)] \n shifted_transitions_for_def\n distinguishing_transitions_left_alt_def\n distinguishing_transitions_right_alt_def\n by force\n\n\nlemma canonical_separator_path_from_shift :\n assumes \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) p\"\n and \"isl (target (initial (canonical_separator M q1 q2)) p)\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"\\ p' . path (product (from_FSM M q1) (from_FSM M q2)) (initial (product (from_FSM M q1) (from_FSM M q2))) p' \n \\ p = (map shift_Inl p')\"\nusing assms(1,2) proof (induction p rule: rev_induct)\n case Nil\n show ?case using canonical_separator_path_shift[OF assms(3,4), of \"[]\"] by fast\nnext\n case (snoc t p)\n then have \"isl (t_target t)\" by auto\n\n let ?C = \"(canonical_separator M q1 q2)\"\n let ?P = \"(product (from_FSM M q1) (from_FSM M q2))\"\n\n have \"t \\ transitions ?C\" and \"t_source t = target (initial ?C) p\" \n using snoc.prems by auto\n then have \"isl (t_source t)\"\n using canonical_separator_t_source_isl[of t M q1 q2, OF _ assms(3,4)] by blast \n then have \"isl (target (initial (canonical_separator M q1 q2)) p)\"\n using \\t_source t = target (initial ?C) p\\ by auto\n\n have \"path ?C (initial ?C) p\" using snoc.prems by auto\n then obtain p' where \"path ?P (initial ?P) p'\"\n and \"p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\"\n using snoc.IH[OF _ \\isl (target (initial (canonical_separator M q1 q2)) p)\\] by blast\n then have \"target (initial ?C) p = Inl (target (initial ?P) p')\"\n proof (cases p rule: rev_cases)\n case Nil\n then show ?thesis \n unfolding target.simps visited_nodes.simps using \\p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\\ canonical_separator_simps(1)[OF assms(3,4)]\n by (simp add: assms(3) assms(4)) \n next\n case (snoc ys y)\n then show ?thesis \n unfolding target.simps visited_nodes.simps using \\p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\\ by (cases p' rule: rev_cases; auto)\n qed\n \n obtain t' where \"t' \\ transitions ?P\" \n and \"t = (Inl (t_source t'), t_input t', t_output t', Inl (t_target t'))\"\n using canonical_separator_transition_targets(1)[OF \\t \\ transitions ?C\\ assms(3,4) \\isl (t_target t)\\]\n by blast \n \n have \"path ?P (initial ?P) (p'@[t'])\"\n by (metis \\path (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2)) (FSM.initial (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))) p'\\ \n \\t = shift_Inl t'\\ \\t' \\ FSM.transitions (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\\ \n \\t_source t = target (FSM.initial (canonical_separator M q1 q2)) p\\ \n \\target (FSM.initial (canonical_separator M q1 q2)) p = Inl (target (FSM.initial (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))) p')\\ \n fst_conv path_append_transition sum.inject(1))\n moreover have \"p@[t] = map shift_Inl (p'@[t'])\"\n using \\p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\\ \n \\t = (Inl (t_source t'), t_input t', t_output t', Inl (t_target t'))\\ \n by auto\n ultimately show ?case \n by meson\nqed\n \n\nlemma shifted_transitions_targets :\n assumes \"t \\ (shifted_transitions ts)\"\n shows \"isl (t_target t)\"\n using assms unfolding shifted_transitions_def by force\n\n\nlemma distinguishing_transitions_left_sources_targets :\n assumes \"t \\ (distinguishing_transitions_left_alt M q1 q2)\"\n and \"q2 \\ nodes M\" \n obtains q1' q2' t' where \"t_source t = Inl (q1',q2')\" \n \"q1' \\ nodes M\" \n \"q2' \\ nodes M\" \n \"t' \\ transitions M\" \n \"t_source t' = q1'\" \n \"t_input t' = t_input t\" \n \"t_output t' = t_output t\" \n \"\\ (\\t''\\ transitions M. t_source t'' = q2' \\ t_input t'' = t_input t \\ t_output t'' = t_output t)\" \n \"t_target t = Inr q1\"\n using assms(1) assms(2) fsm_transition_source path_target_is_node \n unfolding distinguishing_transitions_left_alt_def\n by fastforce\n\n\nlemma distinguishing_transitions_right_sources_targets :\n assumes \"t \\ (distinguishing_transitions_right_alt M q1 q2)\"\n and \"q1 \\ nodes M\" \n obtains q1' q2' t' where \"t_source t = Inl (q1',q2')\" \n \"q1' \\ nodes M\" \n \"q2' \\ nodes M\" \n \"t' \\ transitions M\" \n \"t_source t' = q2'\" \n \"t_input t' = t_input t\" \n \"t_output t' = t_output t\" \n \"\\ (\\t''\\ transitions M. t_source t'' = q1' \\ t_input t'' = t_input t \\ t_output t'' = t_output t)\" \n \"t_target t = Inr q2\"\n using assms(1) assms(2) fsm_transition_source path_target_is_node \n unfolding distinguishing_transitions_right_alt_def\n by fastforce\n\n\nlemma product_from_transition_split :\n assumes \"t \\ transitions (product (from_FSM M q1) (from_FSM M q2))\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"(\\t'\\ transitions M. t_source t' = fst (t_source t) \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\nand \"(\\t'\\ transitions M. t_source t' = snd (t_source t) \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n using product_transition_split_ob[OF assms(1)]\n unfolding product_transitions_alt_def from_FSM_simps[OF assms(2)] from_FSM_simps[OF assms(3)] by blast+\n\n\nlemma shifted_transitions_underlying_transition :\n assumes \"tS \\ shifted_transitions_for M q1 q2\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n obtains t where \"tS = (Inl (t_source t), t_input t, t_output t, Inl (t_target t))\"\n and \"t \\ (transitions ((product (from_FSM M q1) (from_FSM M q2))))\"\n and \"(\\t'\\(transitions M).\n t_source t' = fst (t_source t) \\\n t_input t' = t_input t \\ t_output t' = t_output t)\"\n and \"(\\t'\\(transitions M).\n t_source t' = snd (t_source t) \\\n t_input t' = t_input t \\ t_output t' = t_output t)\"\nproof -\n obtain t where \"tS = (Inl (t_source t), t_input t, t_output t, Inl (t_target t))\"\n and *: \"t \\ (transitions ((product (from_FSM M q1) (from_FSM M q2))))\"\n using assms unfolding shifted_transitions_for_def shifted_transitions_def restrict_to_reachable_nodes_simps by blast\n moreover have \"(\\t'\\(transitions M).\n t_source t' = fst (t_source t) \\\n t_input t' = t_input t \\ t_output t' = t_output t)\"\n using product_from_transition_split(1)[OF _ assms(2,3)]\n *\n unfolding restrict_to_reachable_nodes_simps by blast\n moreover have \"(\\t'\\(transitions M).\n t_source t' = snd (t_source t) \\\n t_input t' = t_input t \\ t_output t' = t_output t)\"\n using product_from_transition_split(2)[OF _ assms(2,3)]\n *\n unfolding restrict_to_reachable_nodes_simps by blast\n ultimately show ?thesis\n using that by blast \nqed\n \n\nlemma shifted_transitions_observable_against_distinguishing_transitions_left :\n assumes \"t1 \\ (shifted_transitions_for M q1 q2)\"\n and \"t2 \\ (distinguishing_transitions_left M q1 q2)\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"\\ (t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2)\"\n using assms(1,2)\n unfolding product_transitions_def from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)]\n shifted_transitions_for_def distinguishing_transitions_left_def\n by force\n\nlemma shifted_transitions_observable_against_distinguishing_transitions_right :\n assumes \"t1 \\ (shifted_transitions_for M q1 q2)\"\n and \"t2 \\ (distinguishing_transitions_right M q1 q2)\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"\\ (t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2)\"\n using assms\n unfolding product_transitions_def from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)] \n shifted_transitions_for_def distinguishing_transitions_right_def\n by force\n\n\nlemma distinguishing_transitions_left_observable_against_distinguishing_transitions_right :\n assumes \"t1 \\ (distinguishing_transitions_left M q1 q2)\"\n and \"t2 \\ (distinguishing_transitions_right M q1 q2)\"\nshows \"\\ (t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2)\"\n using assms \n unfolding distinguishing_transitions_left_def distinguishing_transitions_right_def by force\n\n\nlemma distinguishing_transitions_left_observable_against_distinguishing_transitions_left :\n assumes \"t1 \\ (distinguishing_transitions_left M q1 q2)\"\n and \"t2 \\ (distinguishing_transitions_left M q1 q2)\"\n and \"t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2\"\nshows \"t1 = t2\"\n using assms unfolding distinguishing_transitions_left_def by force\n\n\nlemma distinguishing_transitions_right_observable_against_distinguishing_transitions_right :\n assumes \"t1 \\ (distinguishing_transitions_right M q1 q2)\"\n and \"t2 \\ (distinguishing_transitions_right M q1 q2)\"\n and \"t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2\"\nshows \"t1 = t2\"\n using assms unfolding distinguishing_transitions_right_def by force\n\n\nlemma shifted_transitions_observable_against_shifted_transitions :\n assumes \"t1 \\ (shifted_transitions_for M q1 q2)\"\n and \"t2 \\ (shifted_transitions_for M q1 q2)\"\n and \"observable M\"\n and \"t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2\"\nshows \"t1 = t2\" \nproof -\n obtain t1' where d1: \"t1 = (Inl (t_source t1'), t_input t1', t_output t1', Inl (t_target t1'))\"\n and h1: \"t1' \\ (transitions (product (from_FSM M q1) (from_FSM M q2)))\"\n using assms(1) unfolding shifted_transitions_for_def by auto\n\n obtain t2' where d2: \"t2 = (Inl (t_source t2'), t_input t2', t_output t2', Inl (t_target t2'))\"\n and h2: \"t2' \\ (transitions (product (from_FSM M q1) (from_FSM M q2)))\"\n using assms(2) unfolding shifted_transitions_for_def by auto\n\n have \"observable (product (from_FSM M q1) (from_FSM M q2))\"\n using from_FSM_observable[OF assms(3)] \n product_observable \n by metis\n \n then have \"t1' = t2'\"\n using d1 d2 h1 h2 \\t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2\\\n by (metis fst_conv observable.elims(2) prod.expand snd_conv sum.inject(1)) \n then show ?thesis using d1 d2 by auto\nqed\n \n\nlemma canonical_separator_observable :\n assumes \"observable M\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"observable (canonical_separator M q1 q2)\" (is \"observable ?CSep\")\nproof -\n\n have \"\\ t1 t2 . t1 \\ (transitions ?CSep) \\ \n t2 \\ (transitions ?CSep) \\ \n t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2 \\ t_target t1 = t_target t2\" \n proof -\n fix t1 t2 assume \"t1 \\ (transitions ?CSep)\" \n and \"t2 \\ (transitions ?CSep)\"\n and *: \"t_source t1 = t_source t2 \\ t_input t1 = t_input t2 \\ t_output t1 = t_output t2\"\n \n moreover have \"transitions ?CSep = shifted_transitions_for M q1 q2 \\\n distinguishing_transitions_left M q1 q2 \\\n distinguishing_transitions_right M q1 q2\"\n using canonical_separator_transitions_alt_def[OF assms(2,3)] \n unfolding distinguishing_transitions_left_alt_alt_def distinguishing_transitions_right_alt_alt_def by assumption\n\n ultimately consider \"t1 \\ shifted_transitions_for M q1 q2 \\ t2 \\ shifted_transitions_for M q1 q2\"\n | \"t1 \\ shifted_transitions_for M q1 q2 \\ t2 \\ distinguishing_transitions_left M q1 q2\"\n | \"t1 \\ shifted_transitions_for M q1 q2 \\ t2 \\ distinguishing_transitions_right M q1 q2\"\n | \"t1 \\ distinguishing_transitions_left M q1 q2 \\ t2 \\ shifted_transitions_for M q1 q2\"\n | \"t1 \\ distinguishing_transitions_left M q1 q2 \\ t2 \\ distinguishing_transitions_left M q1 q2\"\n | \"t1 \\ distinguishing_transitions_left M q1 q2 \\ t2 \\ distinguishing_transitions_right M q1 q2\"\n | \"t1 \\ distinguishing_transitions_right M q1 q2 \\ t2 \\ shifted_transitions_for M q1 q2\"\n | \"t1 \\ distinguishing_transitions_right M q1 q2 \\ t2 \\ distinguishing_transitions_left M q1 q2\"\n | \"t1 \\ distinguishing_transitions_right M q1 q2 \\ t2 \\ distinguishing_transitions_right M q1 q2\"\n by force\n then show \"t_target t1 = t_target t2\" proof cases\n case 1\n then show ?thesis using shifted_transitions_observable_against_shifted_transitions[of t1 M q1 q2 t2, OF _ _ assms(1) *] by fastforce\n next\n case 2\n then show ?thesis using shifted_transitions_observable_against_distinguishing_transitions_left[OF _ _ assms(2,3), of t1 t2] * by fastforce\n next\n case 3\n then show ?thesis using shifted_transitions_observable_against_distinguishing_transitions_right[OF _ _ assms(2,3), of t1 t2] * by fastforce\n next\n case 4\n then show ?thesis using shifted_transitions_observable_against_distinguishing_transitions_left[OF _ _ assms(2,3), of t2 t1] * by fastforce\n next\n case 5\n then show ?thesis using * unfolding distinguishing_transitions_left_def by fastforce\n next\n case 6\n then show ?thesis using * unfolding distinguishing_transitions_left_def distinguishing_transitions_right_def by fastforce\n next\n case 7\n then show ?thesis using shifted_transitions_observable_against_distinguishing_transitions_right[OF _ _ assms(2,3), of t2 t1] * by fastforce\n next\n case 8\n then show ?thesis using * unfolding distinguishing_transitions_left_def distinguishing_transitions_right_def by fastforce\n next\n case 9\n then show ?thesis using * unfolding distinguishing_transitions_right_def by fastforce\n qed \n qed\n then show ?thesis unfolding observable.simps by blast\nqed\n\n\nlemma canonical_separator_targets_ineq :\n assumes \"t \\ transitions (canonical_separator M q1 q2)\" \n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"q1 \\ q2\"\n shows \"isl (t_target t) \\ t \\ (shifted_transitions_for M q1 q2)\"\n and \"t_target t = Inr q1 \\ t \\ (distinguishing_transitions_left M q1 q2)\"\n and \"t_target t = Inr q2 \\ t \\ (distinguishing_transitions_right M q1 q2)\"\nproof -\n show \"isl (t_target t) \\ t \\ (shifted_transitions_for M q1 q2)\"\n by (metis (no_types, lifting) assms(1) assms(2) assms(3) canonical_separator_transition_targets(1) shifted_transitions_for_def)\n show \"t_target t = Inr q1 \\ t \\ (distinguishing_transitions_left M q1 q2)\"\n by (metis assms(1) assms(2) assms(3) assms(4) canonical_separator_transition_targets(2) distinguishing_transitions_left_alt_alt_def)\n show \"t_target t = Inr q2 \\ t \\ (distinguishing_transitions_right M q1 q2)\"\n by (metis assms(1) assms(2) assms(3) assms(4) canonical_separator_transition_targets(3) distinguishing_transitions_right_alt_alt_def)\nqed\n\n\nlemma canonical_separator_targets_observable :\n assumes \"t \\ transitions (canonical_separator M q1 q2)\" \n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"q1 \\ q2\"\n shows \"isl (t_target t) \\ t \\ (shifted_transitions_for M q1 q2)\"\n and \"t_target t = Inr q1 \\ t \\ (distinguishing_transitions_left M q1 q2)\"\n and \"t_target t = Inr q2 \\ t \\ (distinguishing_transitions_right M q1 q2)\"\nproof -\n show \"isl (t_target t) \\ t \\ (shifted_transitions_for M q1 q2)\"\n by (metis assms canonical_separator_targets_ineq(1))\n show \"t_target t = Inr q1 \\ t \\ (distinguishing_transitions_left M q1 q2)\"\n by (metis assms canonical_separator_targets_ineq(2))\n show \"t_target t = Inr q2 \\ t \\ (distinguishing_transitions_right M q1 q2)\"\n by (metis assms canonical_separator_targets_ineq(3))\nqed\n\n\nlemma canonical_separator_maximal_path_distinguishes_left :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 S\" (is \"is_state_separator_from_canonical_separator ?C q1 q2 S\")\n and \"path S (initial S) p\"\n and \"target (initial S) p = Inr q1\" \n and \"observable M\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"q1 \\ q2\"\nshows \"p_io p \\ LS M q1 - LS M q2\"\nproof (cases p rule: rev_cases)\n case Nil\n then have \"initial S = Inr q1\" using assms(3) by auto\n then have \"initial ?C = Inr q1\"\n using assms(1) assms(5) assms(6) is_state_separator_from_canonical_separator_initial by fastforce\n then show ?thesis using canonical_separator_simps(1) Inr_Inl_False\n using assms(5) assms(6) by fastforce \nnext\n case (snoc p' t) \n then have \"path S (initial S) (p'@[t])\"\n using assms(2) by auto\n then have \"t \\ transitions S\" and \"t_source t = target (initial S) p'\" by auto\n\n\n have \"path ?C (initial ?C) (p'@[t])\"\n using \\path S (initial S) (p'@[t])\\ assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S] by (meson submachine_path_initial)\n then have \"path ?C (initial ?C) (p')\" and \"t \\ transitions ?C\"\n by auto\n\n have \"isl (target (initial S) p')\"\n proof (rule ccontr)\n assume \"\\ isl (target (initial S) p')\"\n moreover have \"target (initial S) p' \\ nodes S\"\n using \\path S (initial S) (p'@[t])\\ by auto\n ultimately have \"target (initial S) p' = Inr q1 \\ target (initial S) p' = Inr q2\"\n using \\t \\ FSM.transitions (canonical_separator M q1 q2)\\ \\t_source t = target (FSM.initial S) p'\\ assms(5) assms(6) canonical_separator_t_source_isl by fastforce \n moreover have \"deadlock_state S (Inr q1)\" and \"deadlock_state S (Inr q2)\"\n using assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S] by presburger+\n ultimately show \"False\" \n using \\t \\ transitions S\\ \\t_source t = target (initial S) p'\\ unfolding deadlock_state.simps\n by metis \n qed\n then obtain q1' q2' where \"target (initial S) p' = Inl (q1',q2')\" using isl_def prod.collapse by metis\n then have \"isl (target (initial ?C) p')\"\n using assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S]\n by (metis (no_types, lifting) Nil_is_append_conv assms(2) isl_def list.distinct(1) list.sel(1) path.cases snoc submachine_path_initial) \n\n\n obtain pC where \"path (product (from_FSM M q1) (from_FSM M q2)) (initial (product (from_FSM M q1) (from_FSM M q2))) pC\"\n and \"p' = map shift_Inl pC\"\n by (metis (mono_tags, lifting) \\isl (target (FSM.initial (canonical_separator M q1 q2)) p')\\ \n \\path (canonical_separator M q1 q2) (FSM.initial (canonical_separator M q1 q2)) p'\\ \n assms(5) assms(6) canonical_separator_path_from_shift)\n then have \"path (product (from_FSM M q1) (from_FSM M q2)) (q1,q2) pC\"\n by (simp add: assms(5) assms(6))\n then have \"path (from_FSM M q1) q1 (left_path pC)\" and \"path (from_FSM M q2) q2 (right_path pC)\"\n using product_path[of \"from_FSM M q1\" \"from_FSM M q2\" q1 q2 pC] by presburger+\n\n have \"path M q1 (left_path pC)\"\n using from_FSM_path[OF assms(5) \\path (from_FSM M q1) q1 (left_path pC)\\] by assumption\n have \"path M q2 (right_path pC)\"\n using from_FSM_path[OF assms(6) \\path (from_FSM M q2) q2 (right_path pC)\\] by assumption\n \n have \"t_target t = Inr q1\"\n using \\path S (initial S) (p'@[t])\\ snoc assms(3) by auto\n then have \"t \\ (distinguishing_transitions_left M q1 q2)\"\n using canonical_separator_targets_ineq(2)[OF \\t \\ transitions ?C\\ assms(5,6,7)] by auto\n then have \"t \\ (distinguishing_transitions_left_alt M q1 q2)\"\n using distinguishing_transitions_left_alt_alt_def by force\n\n have \"t_source t = Inl (q1',q2')\"\n using \\target (initial S) p' = Inl (q1',q2')\\ \\t_source t = target (initial S) p'\\ by auto\n\n then obtain t' where \"q1' \\ nodes M\"\n and \"q2' \\ nodes M\"\n and \"t' \\ transitions M\"\n and \"t_source t' = q1'\"\n and \"t_input t' = t_input t\"\n and \"t_output t' = t_output t\"\n and \"\\ (\\t''\\ transitions M. t_source t'' = q2' \\ t_input t'' = t_input t \\ t_output t'' = t_output t)\"\n using \\t \\ (distinguishing_transitions_left_alt M q1 q2)\\ assms(5,6) fsm_transition_source path_target_is_node \n unfolding distinguishing_transitions_left_alt_def reachable_nodes_def by fastforce\n\n\n have \"initial S = Inl (q1,q2)\"\n by (meson assms(1) assms(5) assms(6) is_state_separator_from_canonical_separator_initial)\n have \"length p' = length pC\"\n using \\p' = map shift_Inl pC\\ by auto\n then have \"target (initial S) p' = Inl (target (q1,q2) pC)\"\n using \\p' = map shift_Inl pC\\ \\initial S = Inl (q1,q2)\\ by (induction p' pC rule: list_induct2; auto)\n then have \"target (q1,q2) pC = (q1',q2')\"\n using \\target (initial S) p' = Inl (q1',q2')\\ by auto \n then have \"target q2 (right_path pC) = q2'\"\n using product_target_split(2) by fastforce\n then have \"\\ (\\t'\\ transitions M. t_source t' = target q2 (right_path pC) \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n using \\\\ (\\t'\\ transitions M. t_source t' = q2' \\ t_input t' = t_input t \\ t_output t' = t_output t)\\ by blast\n\n have \"target q1 (left_path pC) = q1'\"\n using \\target (q1,q2) pC = (q1',q2')\\ product_target_split(1) by fastforce\n then have \"path M q1 ((left_path pC)@[t'])\"\n using \\path M q1 (left_path pC)\\ \\t' \\ transitions M\\ \\t_source t' = q1'\\\n by (simp add: path_append_transition)\n then have \"p_io ((left_path pC)@[t']) \\ LS M q1\" \n unfolding LS.simps by force \n moreover have \"p_io p' = p_io (left_path pC)\"\n using \\p' = map shift_Inl pC\\ by auto\n ultimately have \"p_io (p'@[t]) \\ LS M q1\"\n using \\t_input t' = t_input t\\ \\t_output t' = t_output t\\ by auto\n \n have \"p_io (right_path pC) @ [(t_input t, t_output t)] \\ LS M q2\"\n using observable_path_language_step[OF assms(4) \\path M q2 (right_path pC)\\ \\\\ (\\t'\\ transitions M. t_source t' = target q2 (right_path pC) \\ t_input t' = t_input t \\ t_output t' = t_output t)\\] by assumption\n moreover have \"p_io p' = p_io (right_path pC)\"\n using \\p' = map shift_Inl pC\\ by auto\n ultimately have \"p_io (p'@[t]) \\ LS M q2\"\n by auto\n\n show ?thesis \n using \\p_io (p'@[t]) \\ LS M q1\\ \\p_io (p'@[t]) \\ LS M q2\\ snoc by blast\nqed\n\n\nlemma canonical_separator_maximal_path_distinguishes_right :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 S\" \n (is \"is_state_separator_from_canonical_separator ?C q1 q2 S\")\n and \"path S (initial S) p\"\n and \"target (initial S) p = Inr q2\" \n and \"observable M\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"q1 \\ q2\"\nshows \"p_io p \\ LS M q2 - LS M q1\"\nproof (cases p rule: rev_cases)\n case Nil\n then have \"initial S = Inr q2\" using assms(3) by auto\n then have \"initial ?C = Inr q2\"\n using assms(1) assms(5) assms(6) is_state_separator_from_canonical_separator_initial by fastforce\n then show ?thesis using canonical_separator_simps(1) Inr_Inl_False\n using assms(5) assms(6) by fastforce \nnext\n case (snoc p' t) \n then have \"path S (initial S) (p'@[t])\"\n using assms(2) by auto\n then have \"t \\ transitions S\" and \"t_source t = target (initial S) p'\" \n by auto\n\n have \"path ?C (initial ?C) (p'@[t])\"\n using \\path S (initial S) (p'@[t])\\ assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S] \n by (meson submachine_path_initial)\n then have \"path ?C (initial ?C) (p')\" and \"t \\ transitions ?C\"\n by auto\n\n have \"isl (target (initial S) p')\"\n proof (rule ccontr)\n assume \"\\ isl (target (initial S) p')\"\n moreover have \"target (initial S) p' \\ nodes S\"\n using \\path S (initial S) (p'@[t])\\ by auto\n ultimately have \"target (initial S) p' = Inr q1 \\ target (initial S) p' = Inr q2\"\n \n using assms(1) unfolding is_state_separator_from_canonical_separator_def\n by (metis \\t \\ FSM.transitions (canonical_separator M q1 q2)\\ \\t_source t = target (FSM.initial S) p'\\ \n assms(5) assms(6) canonical_separator_t_source_isl) \n moreover have \"deadlock_state S (Inr q1)\" and \"deadlock_state S (Inr q2)\"\n using assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S] by presburger+\n ultimately show \"False\" \n using \\t \\ transitions S\\ \\t_source t = target (initial S) p'\\ unfolding deadlock_state.simps\n by metis \n qed\n then obtain q1' q2' where \"target (initial S) p' = Inl (q1',q2')\" \n using isl_def prod.collapse by metis\n then have \"isl (target (initial ?C) p')\"\n using assms(1) is_state_separator_from_canonical_separator_def[of ?C q1 q2 S]\n by (metis (no_types, lifting) Nil_is_append_conv assms(2) isl_def list.distinct(1) list.sel(1) \n path.cases snoc submachine_path_initial) \n\n obtain pC where \"path (product (from_FSM M q1) (from_FSM M q2)) (initial (product (from_FSM M q1) (from_FSM M q2))) pC\"\n and \"p' = map shift_Inl pC\"\n using canonical_separator_path_from_shift[OF \\path ?C (initial ?C) (p')\\ \\isl (target (initial ?C) p')\\]\n using assms(5) assms(6) by blast \n then have \"path (product (from_FSM M q1) (from_FSM M q2)) (q1,q2) pC\"\n by (simp add: assms(5) assms(6))\n\n then have \"path (from_FSM M q1) q1 (left_path pC)\" and \"path (from_FSM M q2) q2 (right_path pC)\"\n using product_path[of \"from_FSM M q1\" \"from_FSM M q2\" q1 q2 pC] by presburger+\n\n have \"path M q1 (left_path pC)\"\n using from_FSM_path[OF assms(5) \\path (from_FSM M q1) q1 (left_path pC)\\] by assumption\n have \"path M q2 (right_path pC)\"\n using from_FSM_path[OF assms(6) \\path (from_FSM M q2) q2 (right_path pC)\\] by assumption\n \n have \"t_target t = Inr q2\"\n using \\path S (initial S) (p'@[t])\\ snoc assms(3) by auto\n then have \"t \\ (distinguishing_transitions_right M q1 q2)\"\n using canonical_separator_targets_ineq(3)[OF \\t \\ transitions ?C\\ assms(5,6,7)] by auto\n then have \"t \\ (distinguishing_transitions_right_alt M q1 q2)\"\n unfolding distinguishing_transitions_right_alt_alt_def by assumption\n\n have \"t_source t = Inl (q1',q2')\"\n using \\target (initial S) p' = Inl (q1',q2')\\ \\t_source t = target (initial S) p'\\ by auto\n\n then obtain t' where \"q1' \\ nodes M\"\n and \"q2' \\ nodes M\"\n and \"t' \\ transitions M\"\n and \"t_source t' = q2'\" \n and \"t_input t' = t_input t\"\n and \"t_output t' = t_output t\"\n and \"\\ (\\t''\\ transitions M. t_source t'' = q1' \\ t_input t'' = t_input t \\ t_output t'' = t_output t)\"\n using \\t \\ (distinguishing_transitions_right_alt M q1 q2)\\ assms(5,6) fsm_transition_source path_target_is_node \n unfolding distinguishing_transitions_right_alt_def reachable_nodes_def by fastforce\n\n \n have \"initial S = Inl (q1,q2)\"\n by (meson assms(1) assms(5) assms(6) is_state_separator_from_canonical_separator_initial)\n have \"length p' = length pC\"\n using \\p' = map shift_Inl pC\\ by auto\n then have \"target (initial S) p' = Inl (target (q1,q2) pC)\"\n using \\p' = map shift_Inl pC\\ \\initial S = Inl (q1,q2)\\ by (induction p' pC rule: list_induct2; auto)\n then have \"target (q1,q2) pC = (q1',q2')\"\n using \\target (initial S) p' = Inl (q1',q2')\\ by auto \n then have \"target q1 (left_path pC) = q1'\"\n using product_target_split(1) by fastforce\n then have \"\\ (\\t'\\ transitions M. t_source t' = target q1 (left_path pC) \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n using \\\\ (\\t'\\ transitions M. t_source t' = q1' \\ t_input t' = t_input t \\ t_output t' = t_output t)\\ by blast\n\n have \"target q2 (right_path pC) = q2'\"\n using \\target (q1,q2) pC = (q1',q2')\\ product_target_split(2) by fastforce\n then have \"path M q2 ((right_path pC)@[t'])\"\n using \\path M q2 (right_path pC)\\ \\t' \\ transitions M\\ \\t_source t' = q2'\\\n by (simp add: path_append_transition)\n then have \"p_io ((right_path pC)@[t']) \\ LS M q2\" \n unfolding LS.simps by force \n moreover have \"p_io p' = p_io (right_path pC)\"\n using \\p' = map shift_Inl pC\\ by auto\n ultimately have \"p_io (p'@[t]) \\ LS M q2\"\n using \\t_input t' = t_input t\\ \\t_output t' = t_output t\\ by auto\n \n\n have \"p_io (left_path pC) @ [(t_input t, t_output t)] \\ LS M q1\"\n using observable_path_language_step[OF assms(4) \\path M q1 (left_path pC)\\ \\\\ (\\t'\\ transitions M. t_source t' = target q1 (left_path pC) \\ t_input t' = t_input t \\ t_output t' = t_output t)\\] by assumption\n moreover have \"p_io p' = p_io (left_path pC)\"\n using \\p' = map shift_Inl pC\\ by auto\n ultimately have \"p_io (p'@[t]) \\ LS M q1\"\n by auto\n \n show ?thesis \n using \\p_io (p'@[t]) \\ LS M q2\\ \\p_io (p'@[t]) \\ LS M q1\\ snoc \n by blast \nqed\n\n\nlemma state_separator_from_canonical_separator_observable :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"observable M\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"observable A\"\n using submachine_observable[OF _ canonical_separator_observable[OF assms(2,3,4)]]\n using assms(1) unfolding is_state_separator_from_canonical_separator_def \n by metis\n\n\nlemma canonical_separator_initial :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"initial (canonical_separator M q1 q2) = Inl (q1,q2)\" \n unfolding canonical_separator_simps[OF assms] by simp\n\n\nlemma canonical_separator_nodes :\n assumes \"Inl (s1,s2) \\ nodes (canonical_separator M q1 q2)\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"(s1,s2) \\ nodes (product (from_FSM M q1) (from_FSM M q2))\"\n using assms(1) reachable_node_is_node\n unfolding canonical_separator_simps[OF assms(2,3)] by fastforce\n\n\nlemma canonical_separator_transition :\n assumes \"t \\ transitions (canonical_separator M q1 q2)\" (is \"t \\ transitions ?C\")\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"t_source t = Inl (s1,s2)\"\n and \"observable M\"\n and \"q1 \\ q2\"\nshows \"\\ s1' s2' . t_target t = Inl (s1',s2') \\ (s1, t_input t, t_output t, s1') \\ transitions M \\ (s2, t_input t, t_output t, s2') \\ transitions M \"\nand \"t_target t = Inr q1 \\ (\\ t'\\ transitions M . t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t) \n \\ (\\(\\ t'\\ transitions M . t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t))\"\nand \"t_target t = Inr q2 \\ (\\ t'\\ transitions M . t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t) \n \\ (\\(\\ t'\\ transitions M . t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t))\"\nand \"(\\ s1' s2' . t_target t = Inl (s1',s2')) \\ t_target t = Inr q1 \\ t_target t = Inr q2\"\nproof -\n show \"\\ s1' s2' . t_target t = Inl (s1',s2') \\ (s1, t_input t, t_output t, s1') \\ transitions M \\ (s2, t_input t, t_output t, s2') \\ transitions M\"\n using canonical_separator_transition_targets(1)[OF assms(1,2,3)] assms(4)\n unfolding shifted_transitions_for_def[symmetric] \n unfolding shifted_transitions_for_alt_def \n unfolding product_transitions_def from_FSM_simps[OF assms(2)] from_FSM_simps[OF assms(3)] by fastforce\n\n show \"t_target t = Inr q1 \\ (\\ t'\\ transitions M . t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t) \n \\ (\\(\\ t'\\ transitions M . t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t))\"\n using canonical_separator_targets_observable(2)[OF assms(1,2,3,6)] assms(4)\n unfolding distinguishing_transitions_left_def by fastforce\n\n show \"t_target t = Inr q2 \\ (\\ t'\\ transitions M . t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t) \n \\ (\\(\\ t'\\ transitions M . t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t))\"\n using canonical_separator_targets_observable(3)[OF assms(1,2,3,6)] assms(4)\n unfolding distinguishing_transitions_right_def by fastforce\n\n show \"(\\ s1' s2' . t_target t = Inl (s1',s2')) \\ t_target t = Inr q1 \\ t_target t = Inr q2\"\n using canonical_separator_transition_targets(4)[OF assms(1,2,3)]\n by (simp add: isl_def) \nqed\n\n\nlemma canonical_separator_transition_source :\n assumes \"t \\ transitions (canonical_separator M q1 q2)\" (is \"t \\ transitions ?C\")\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nobtains q1' q2' where \"t_source t = Inl (q1',q2')\"\n \"(q1',q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\nproof -\n consider \"t \\ shifted_transitions_for M q1 q2\" | \"t \\ distinguishing_transitions_left_alt M q1 q2\" |\n \"t \\ distinguishing_transitions_right_alt M q1 q2\"\n using assms(1)\n unfolding canonical_separator_transitions_alt_def[OF assms(2,3)] by blast\n then show ?thesis proof cases\n case 1\n then show ?thesis unfolding shifted_transitions_for_def using that\n using fsm_transition_source by fastforce\n next\n case 2\n then show ?thesis unfolding distinguishing_transitions_left_alt_def using that by fastforce\n next\n case 3\n then show ?thesis unfolding distinguishing_transitions_right_alt_def using that by fastforce\n qed \nqed\n\n\nlemma canonical_separator_transition_ex :\n assumes \"t \\ transitions (canonical_separator M q1 q2)\" (is \"t \\ transitions ?C\")\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"t_source t = Inl (s1,s2)\"\nshows \"(\\ t1 \\ transitions M . t_source t1 = s1 \\ t_input t1 = t_input t \\ t_output t1 = t_output t) \\\n (\\ t2 \\ transitions M . t_source t2 = s2 \\ t_input t2 = t_input t \\ t_output t2 = t_output t)\"\nproof -\n consider \"t \\ shifted_transitions_for M q1 q2\" | \"t \\ distinguishing_transitions_left_alt M q1 q2\" |\n \"t \\ distinguishing_transitions_right_alt M q1 q2\"\n using assms(1)\n unfolding canonical_separator_transitions_alt_def[OF assms(2,3)] by blast\n then show ?thesis proof cases\n case 1\n then show ?thesis unfolding shifted_transitions_for_def \n using product_from_transition_split[OF _ assms(2,3)]\n using assms(4) by force\n next\n case 2\n then show ?thesis unfolding distinguishing_transitions_left_alt_def\n using assms(4) by auto \n \n next\n case 3\n then show ?thesis unfolding distinguishing_transitions_right_alt_def \n using assms(4) by auto \n qed \nqed\n\n\nlemma canonical_separator_path_split_target_isl :\n assumes \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) (p@[t])\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n shows \"isl (target (initial (canonical_separator M q1 q2)) p)\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n have \"t \\ transitions ?C\"\n using assms by auto\n moreover have \"\\ deadlock_state ?C (t_source t)\"\n using assms unfolding deadlock_state.simps by blast\n ultimately show ?thesis \n using canonical_separator_t_source_isl assms\n by fastforce\nqed\n\n\nlemma canonical_separator_path_initial :\n assumes \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) p\" (is \"path ?C (initial ?C) p\")\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"observable M\"\n and \"q1 \\ q2\"\nshows \"\\ s1' s2' . target (initial (canonical_separator M q1 q2)) p = Inl (s1',s2') \\ (\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = p_io p2 \\ p_io p1 = p_io p \\ target q1 p1 = s1' \\ target q2 p2 = s2')\"\nand \"target (initial (canonical_separator M q1 q2)) p = Inr q1 \\ (\\ p1 p2 t . path M q1 (p1@[t]) \\ path M q2 p2 \\ p_io (p1@[t]) = p_io p \\ p_io p2 = butlast (p_io p)) \\ (\\(\\ p2 . path M q2 p2 \\ p_io p2 = p_io p))\"\nand \"target (initial (canonical_separator M q1 q2)) p = Inr q2 \\ (\\ p1 p2 t . path M q1 p1 \\ path M q2 (p2@[t]) \\ p_io p1 = butlast (p_io p) \\ p_io (p2@[t]) = p_io p) \\ (\\(\\ p1 . path M q1 p1 \\ p_io p1 = p_io p))\"\nand \"(\\ s1' s2' . target (initial (canonical_separator M q1 q2)) p = Inl (s1',s2')) \\ target (initial (canonical_separator M q1 q2)) p = Inr q1 \\ target (initial (canonical_separator M q1 q2)) p = Inr q2\"\nproof -\n\n let ?P1 = \"\\ s1' s2' . target (initial (canonical_separator M q1 q2)) p = Inl (s1',s2') \\ (\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = p_io p2 \\ p_io p1 = p_io p \\ target q1 p1 = s1' \\ target q2 p2 = s2')\"\n let ?P2 = \"target (initial (canonical_separator M q1 q2)) p = Inr q1 \\ (\\ p1 p2 t . path M q1 (p1@[t]) \\ path M q2 p2 \\ p_io (p1@[t]) = p_io p \\ p_io p2 = butlast (p_io p)) \\ (\\(\\ p2 . path M q2 p2 \\ p_io p2 = p_io p))\"\n let ?P3 = \"target (initial (canonical_separator M q1 q2)) p = Inr q2 \\ (\\ p1 p2 t . path M q1 p1 \\ path M q2 (p2@[t]) \\ p_io p1 = butlast (p_io p) \\ p_io (p2@[t]) = p_io p) \\ (\\(\\ p1 . path M q1 p1 \\ p_io p1 = p_io p))\"\n\n have \"?P1 \\ ?P2 \\ ?P3\"\n using assms(1) proof (induction p rule: rev_induct) \n case Nil \n then have \"target (FSM.initial (canonical_separator M q1 q2)) [] = Inl (q1, q2)\"\n unfolding canonical_separator_simps[OF assms(2,3)] by auto\n then show ?case using assms(2,3,4) by fastforce\n next\n case (snoc t p)\n \n have \"path ?C (initial ?C) p\" and \"t \\ transitions ?C\" and \"t_source t = target (initial ?C) p\"\n using snoc.prems(1) by auto\n\n let ?P1' = \"(\\s1' s2'. target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inl (s1', s2') \\ (\\p1 p2. path M q1 p1 \\ path M q2 p2 \\ p_io p1 = p_io p2 \\ p_io p1 = p_io (p @ [t]) \\ target q1 p1 = s1' \\ target q2 p2 = s2'))\"\n let ?P2' = \"(target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q1 \\ (\\p1 p2 ta. path M q1 (p1 @ [ta]) \\ path M q2 p2 \\ p_io (p1 @ [ta]) = p_io (p @ [t]) \\ p_io p2 = butlast (p_io (p @ [t]))) \\ (\\p2. path M q2 p2 \\ p_io p2 = p_io (p @ [t])))\"\n let ?P3' = \"(target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q2 \\ (\\p1 p2 ta. path M q1 p1 \\ path M q2 (p2 @ [ta]) \\ p_io p1 = butlast (p_io (p @ [t])) \\ p_io (p2 @ [ta]) = p_io (p @ [t])) \\ (\\p1. path M q1 p1 \\ p_io p1 = p_io (p @ [t])))\"\n\n let ?P = \"(product (from_FSM M q1) (from_FSM M q2))\"\n \n obtain p' where \"path ?P (initial ?P) p'\"\n and *:\"p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\"\n using canonical_separator_path_from_shift[OF \\path ?C (initial ?C) p\\ canonical_separator_path_split_target_isl[OF snoc.prems assms(2,3)] assms(2,3)]\n by blast\n \n \n let ?pL = \"(map (\\t. (fst (t_source t), t_input t, t_output t, fst (t_target t))) p')\"\n let ?pR = \"(map (\\t. (snd (t_source t), t_input t, t_output t, snd (t_target t))) p')\"\n \n have \"path ?P (q1,q2) p'\"\n using \\path ?P (initial ?P) p'\\ assms(2,3) unfolding product_simps(1) from_FSM_simps(1) by simp \n then have pL: \"path (from_FSM M q1) q1 ?pL\"\n and pR: \"path (from_FSM M q2) q2 ?pR\"\n using product_path[of \"from_FSM M q1\" \"from_FSM M q2\" q1 q2 p'] by simp+\n\n have \"p_io ?pL = p_io p\" and \"p_io ?pR = p_io p\"\n using * by auto\n\n have pf1: \"path (from_FSM M q1) (initial (from_FSM M q1)) ?pL\"\n using pL assms(2) unfolding from_FSM_simps(1) by auto\n have pf2: \"path (from_FSM M q2) (initial (from_FSM M q2)) ?pR\"\n using pR assms(3) unfolding from_FSM_simps(1) by auto\n have pio: \"p_io ?pL = p_io ?pR\"\n by auto\n \n have \"p_io (zip_path ?pL ?pR) = p_io ?pL\"\n by (induction p'; auto)\n\n have zip1: \"path ?P (initial ?P) (zip_path ?pL ?pR)\"\n and \"target (initial ?P) (zip_path ?pL ?pR) = (target q1 ?pL, target q2 ?pR)\"\n using product_path_from_paths[OF pf1 pf2 pio] assms(2,3)\n unfolding from_FSM_simps(1) by simp+\n \n have \"p_io (zip_path ?pL ?pR) = p_io p\"\n using \\p_io ?pL = p_io p\\ \\p_io (zip_path ?pL ?pR) = p_io ?pL\\ by auto \n have \"observable ?P\"\n using product_observable[OF from_FSM_observable[OF assms(4)] from_FSM_observable[OF assms(4)]] by assumption\n \n have \"p_io p' = p_io p\"\n using * by auto\n \n obtain s1 s2 where \"t_source t = Inl (s1,s2)\"\n using canonical_separator_path_split_target_isl[OF snoc.prems(1) assms(2,3)] \n by (metis \\t_source t = target (initial (canonical_separator M q1 q2)) p\\ isl_def old.prod.exhaust)\n \n have \"map t_target p = map (Inl o t_target) p'\"\n using * by auto\n have \"target (initial ?C) p = Inl (target (q1,q2) p')\"\n unfolding target.simps visited_nodes.simps canonical_separator_simps[OF assms(2,3)] \n unfolding \\map t_target p = map (Inl o t_target) p'\\\n by (simp add: last_map)\n then have \"target (q1,q2) p'= (s1,s2)\"\n using \\t_source t = target (initial ?C) p\\ \\t_source t = Inl (s1,s2)\\\n by auto \n \n have \"target q1 ?pL = s1\" and \"target q2 ?pR = s2\" \n using product_target_split[OF \\target (q1,q2) p'= (s1,s2)\\] by auto\n\n consider (a) \"(\\s1' s2'. t_target t = Inl (s1', s2'))\" |\n (b) \"t_target t = Inr q1\" |\n (c) \"t_target t = Inr q2\"\n using canonical_separator_transition(4)[OF \\t \\ transitions ?C\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\t_source t = Inl (s1,s2)\\ \\observable M\\ \\q1 \\ q2\\]\n by blast\n then show \"?P1' \\ ?P2' \\ ?P3'\" proof cases\n case a\n then obtain s1' s2' where \"t_target t = Inl (s1',s2')\"\n by blast\n\n let ?t1 = \"(s1, t_input t, t_output t, s1')\"\n let ?t2 = \"(s2, t_input t, t_output t, s2')\"\n\n have \"?t1 \\ transitions M\" \n and \"?t2 \\ transitions M\"\n using canonical_separator_transition(1)[OF \\t \\ transitions ?C\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\t_source t = Inl (s1,s2)\\ \\observable M\\ \\q1 \\ q2\\ \\t_target t = Inl (s1',s2')\\] \n by auto\n\n have \"target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inl (s1', s2')\"\n using \\t_target t = Inl (s1',s2')\\ by auto\n\n have \"path M q1 (?pL@[?t1])\"\n using path_append_transition[OF from_FSM_path[OF \\q1 \\ nodes M\\ pL] \\?t1 \\ transitions M\\] \\target q1 ?pL = s1\\ by auto\n moreover have \"path M q2 (?pR@[?t2])\"\n using path_append_transition[OF from_FSM_path[OF \\q2 \\ nodes M\\ pR] \\?t2 \\ transitions M\\] \\target q2 ?pR = s2\\ by auto\n moreover have \"p_io (?pL@[?t1]) = p_io (?pR@[?t2])\"\n by auto\n moreover have \"p_io (?pL@[?t1]) = p_io (p@[t])\"\n using \\p_io ?pL = p_io p\\ by auto\n moreover have \"target q1 (?pL@[?t1]) = s1'\" and \"target q2 (?pR@[?t2]) = s2'\"\n by auto \n ultimately have \"path M q1 (?pL@[?t1]) \\ path M q2 (?pR@[?t2]) \\ p_io (?pL@[?t1]) = p_io (?pR@[?t2]) \\ p_io (?pL@[?t1]) = p_io (p@[t]) \\ target q1 (?pL@[?t1]) = s1' \\ target q2 (?pR@[?t2]) = s2'\"\n by presburger\n then have \"(\\p1 p2. path M q1 p1 \\ path M q2 p2 \\ p_io p1 = p_io p2 \\ p_io p1 = p_io (p @ [t]) \\ target q1 p1 = s1' \\ target q2 p2 = s2')\"\n by meson\n then have ?P1'\n using \\target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inl (s1', s2')\\ by auto\n then show ?thesis using \\target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inl (s1', s2')\\ \n by auto\n next\n case b\n then have \"target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q1\"\n by auto\n\n have \"(\\t'\\(transitions M). t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n and \"\\ (\\t'\\(transitions M). t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n using canonical_separator_transition(2)[OF \\t \\ transitions ?C\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\t_source t = Inl (s1,s2)\\ \\observable M\\ \\q1 \\ q2\\ b] by blast+\n\n then obtain t' where \"t' \\ transitions M\" and \"t_source t' = s1\" and \"t_input t' = t_input t\" and \"t_output t' = t_output t\"\n by blast\n\n have \"path M q1 (?pL@[t'])\"\n using path_append_transition[OF from_FSM_path[OF \\q1 \\ nodes M\\ pL] \\t' \\ transitions M\\] \\target q1 ?pL = s1\\ \\t_source t' = s1\\ by auto\n moreover have \"p_io (?pL@[t']) = p_io (p@[t])\"\n using \\p_io ?pL = p_io p\\ \\t_input t' = t_input t\\ \\t_output t' = t_output t\\ by auto\n moreover have \"p_io ?pR = butlast (p_io (p @ [t]))\"\n using \\p_io ?pR = p_io p\\ by auto\n ultimately have \"path M q1 (?pL@[t']) \\ path M q2 ?pR \\ p_io (?pL@[t']) = p_io (p @ [t]) \\ p_io ?pR = butlast (p_io (p @ [t]))\"\n using from_FSM_path[OF \\q2 \\ nodes M\\ pR] by linarith\n then have \"(\\p1 p2 ta. path M q1 (p1 @ [ta]) \\ path M q2 p2 \\ p_io (p1 @ [ta]) = p_io (p @ [t]) \\ p_io p2 = butlast (p_io (p @ [t])))\"\n by meson\n \n moreover have \"(\\p2. path M q2 p2 \\ p_io p2 = p_io (p @ [t]))\"\n proof \n assume \"\\p2. path M q2 p2 \\ p_io p2 = p_io (p @ [t])\"\n then obtain p'' where \"path M q2 p'' \\ p_io p'' = p_io (p @ [t])\"\n by blast\n then have \"p'' \\ []\" by auto\n then obtain p2 t2 where \"p'' = p2@[t2]\"\n using rev_exhaust by blast\n then have \"path M q2 (p2@[t2])\" and \"p_io (p2@[t2]) = p_io (p @ [t])\"\n using \\path M q2 p'' \\ p_io p'' = p_io (p @ [t])\\ by auto\n then have \"path M q2 p2\" by auto\n\n\n then have pf2': \"path (from_FSM M q2) (initial (from_FSM M q2)) p2\"\n using from_FSM_path_initial[OF \\q2 \\ nodes M\\, of p2] by simp\n have pio': \"p_io ?pL = p_io p2\"\n using \\p_io (?pL@[t']) = p_io (p@[t])\\ \\p_io (p2@[t2]) = p_io (p @ [t])\\ by auto\n\n have zip2: \"path ?P (initial ?P) (zip_path ?pL p2)\"\n and \"target (initial ?P) (zip_path ?pL p2) = (target q1 ?pL, target q2 p2)\"\n using product_path_from_paths[OF pf1 pf2' pio'] assms(2,3)\n unfolding from_FSM_simps(1) by simp+\n\n have \"length p' = length p2\"\n using \\p_io (p2@[t2]) = p_io (p @ [t])\\ \n by (metis (no_types, lifting) length_map pio') \n then have \"p_io (zip_path ?pL p2) = p_io p'\"\n by (induction p' p2 rule: list_induct2; auto)\n then have \"p_io (zip_path ?pL p2) = p_io p\"\n using * by auto\n then have \"p_io (zip_path ?pL ?pR) = p_io (zip_path ?pL p2)\" \n using \\p_io (zip_path ?pL ?pR) = p_io p\\ by simp\n\n have \"p_io ?pR = p_io p2\"\n using \\p_io ?pL = p_io p2\\ pio by auto \n\n\n have l1: \"length ?pL = length ?pR\" by auto\n have l2: \"length ?pR = length ?pL\" by auto \n have l3: \"length ?pL = length p2\" using \\length p' = length p2\\ by auto\n \n have \"p2 = ?pR\"\n using zip_path_eq_right[OF l1 l2 l3 \\p_io ?pR = p_io p2\\ observable_path_unique[OF \\observable ?P\\ zip1 zip2 \\p_io (zip_path ?pL ?pR) = p_io (zip_path ?pL p2)\\]] by simp\n then have \"target q2 p2 = s2\"\n using \\target q2 ?pR = s2\\ by auto\n then have \"t2 \\ transitions M\" and \"t_source t2 = s2\"\n using \\path M q2 (p2@[t2])\\ by auto\n moreover have \"t_input t2 = t_input t \\ t_output t2 = t_output t\"\n using \\p_io (p2@[t2]) = p_io (p @ [t])\\ by auto\n ultimately show \"False\"\n using \\\\ (\\t'\\(transitions M). t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t)\\ by blast\n qed\n\n ultimately have ?P2' \n by blast\n moreover have ?P3' \n using \\q1 \\ q2\\ \\t_target t = Inr q1\\ by auto\n moreover have ?P1'\n using \\target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q1\\ by auto\n ultimately show ?thesis\n by blast\n next\n case c\n then have \"target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q2\"\n by auto\n\n have \"(\\t'\\(transitions M). t_source t' = s2 \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n and \"\\ (\\t'\\(transitions M). t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t)\"\n using canonical_separator_transition(3)[OF \\t \\ transitions ?C\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\t_source t = Inl (s1,s2)\\ \\observable M\\ \\q1 \\ q2\\ c] by blast+\n\n then obtain t' where \"t' \\ transitions M\" and \"t_source t' = s2\" and \"t_input t' = t_input t\" and \"t_output t' = t_output t\"\n by blast\n\n have \"path M q2 (?pR@[t'])\"\n using path_append_transition[OF from_FSM_path[OF \\q2 \\ nodes M\\ pR] \\t' \\ transitions M\\] \\target q2 ?pR = s2\\ \\t_source t' = s2\\ by auto\n moreover have \"p_io (?pR@[t']) = p_io (p@[t])\"\n using \\p_io ?pR = p_io p\\ \\t_input t' = t_input t\\ \\t_output t' = t_output t\\ by auto\n moreover have \"p_io ?pL = butlast (p_io (p @ [t]))\"\n using \\p_io ?pL = p_io p\\ by auto\n ultimately have \"path M q2 (?pR@[t']) \\ path M q1 ?pL \\ p_io (?pR@[t']) = p_io (p @ [t]) \\ p_io ?pL = butlast (p_io (p @ [t]))\"\n using from_FSM_path[OF \\q1 \\ nodes M\\ pL] by linarith\n then have \"(\\p1 p2 ta. path M q1 p1 \\ path M q2 (p2 @ [ta]) \\ p_io p1 = butlast (p_io (p @ [t])) \\ p_io (p2 @ [ta]) = p_io (p @ [t]))\"\n by meson\n \n moreover have \"(\\p1. path M q1 p1 \\ p_io p1 = p_io (p @ [t]))\"\n proof \n assume \"\\p1. path M q1 p1 \\ p_io p1 = p_io (p @ [t])\"\n then obtain p'' where \"path M q1 p'' \\ p_io p'' = p_io (p @ [t])\"\n by blast\n then have \"p'' \\ []\" by auto\n then obtain p1 t1 where \"p'' = p1@[t1]\"\n using rev_exhaust by blast\n then have \"path M q1 (p1@[t1])\" and \"p_io (p1@[t1]) = p_io (p @ [t])\"\n using \\path M q1 p'' \\ p_io p'' = p_io (p @ [t])\\ by auto\n then have \"path M q1 p1\" \n by auto\n then have pf1': \"path (from_FSM M q1) (initial (from_FSM M q1)) p1\"\n using from_FSM_path_initial[OF \\q1 \\ nodes M\\, of p1] by simp\n have pio': \"p_io p1 = p_io ?pR\"\n using \\p_io (?pR@[t']) = p_io (p@[t])\\ \\p_io (p1@[t1]) = p_io (p @ [t])\\ by auto\n\n have zip2: \"path ?P (initial ?P) (zip_path p1 ?pR)\"\n using product_path_from_paths[OF pf1' pf2 pio']\n unfolding from_FSM_simps(1) by simp\n\n have \"length p' = length p1\"\n using \\p_io (p1@[t1]) = p_io (p @ [t])\\ \n by (metis (no_types, lifting) length_map pio') \n then have \"p_io (zip_path p1 ?pR) = p_io p'\"\n using \\p_io p1 = p_io ?pR\\ by (induction p' p1 rule: list_induct2; auto)\n then have \"p_io (zip_path p1 ?pR) = p_io p\"\n using * by auto\n then have \"p_io (zip_path ?pL ?pR) = p_io (zip_path p1 ?pR)\" \n using \\p_io (zip_path ?pL ?pR) = p_io p\\ by simp\n \n have l1: \"length ?pL = length ?pR\" by auto\n have l2: \"length ?pR = length p1\" using \\length p' = length p1\\ by auto\n have l3: \"length p1 = length ?pR\" using l2 by auto\n \n have \"?pL = p1\"\n using zip_path_eq_left[OF l1 l2 l3 observable_path_unique[OF \\observable ?P\\ zip1 zip2 \\p_io (zip_path ?pL ?pR) = p_io (zip_path p1 ?pR)\\]] by simp\n then have \"target q1 p1 = s1\"\n using \\target q1 ?pL = s1\\ by auto\n then have \"t1 \\ transitions M\" and \"t_source t1 = s1\"\n using \\path M q1 (p1@[t1])\\ by auto\n moreover have \"t_input t1 = t_input t \\ t_output t1 = t_output t\"\n using \\p_io (p1@[t1]) = p_io (p @ [t])\\ by auto\n ultimately show \"False\"\n using \\\\ (\\t'\\(transitions M). t_source t' = s1 \\ t_input t' = t_input t \\ t_output t' = t_output t)\\ by blast\n qed\n\n ultimately have ?P3' \n by blast\n moreover have ?P2' \n using \\q1 \\ q2\\ \\t_target t = Inr q2\\ by auto\n moreover have ?P1'\n using \\target (initial (canonical_separator M q1 q2)) (p @ [t]) = Inr q2\\ by auto\n ultimately show ?thesis\n by blast\n qed \n qed\n\n then show \"\\ s1' s2' . target (initial (canonical_separator M q1 q2)) p = Inl (s1',s2') \\ (\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = p_io p2 \\ p_io p1 = p_io p \\ target q1 p1 = s1' \\ target q2 p2 = s2')\"\n and \"target (initial (canonical_separator M q1 q2)) p = Inr q1 \\ (\\ p1 p2 t . path M q1 (p1@[t]) \\ path M q2 p2 \\ p_io (p1@[t]) = p_io p \\ p_io p2 = butlast (p_io p)) \\ (\\(\\ p2 . path M q2 p2 \\ p_io p2 = p_io p))\"\n and \"target (initial (canonical_separator M q1 q2)) p = Inr q2 \\ (\\ p1 p2 t . path M q1 p1 \\ path M q2 (p2@[t]) \\ p_io p1 = butlast (p_io p) \\ p_io (p2@[t]) = p_io p) \\ (\\(\\ p1 . path M q1 p1 \\ p_io p1 = p_io p))\"\n by blast+\n\n \n show \"(\\ s1' s2' . target (initial (canonical_separator M q1 q2)) p = Inl (s1',s2')) \\ target (initial (canonical_separator M q1 q2)) p = Inr q1 \\ target (initial (canonical_separator M q1 q2)) p = Inr q2\"\n proof (cases p rule: rev_cases)\n case Nil\n then show ?thesis unfolding canonical_separator_simps(1)[OF assms(2,3)] by auto\n next\n case (snoc p' t)\n then have \"t \\ transitions ?C\" and \"target (initial (canonical_separator M q1 q2)) p = t_target t\"\n using assms(1) by auto\n then have \"t \\ (transitions ?C)\"\n by auto\n obtain s1 s2 where \"t_source t = Inl (s1,s2)\"\n using canonical_separator_t_source_isl[OF \\t \\ (transitions ?C)\\ assms(2,3)]\n by (metis sum.collapse(1) surjective_pairing)\n show ?thesis\n using canonical_separator_transition(4)[OF \\t \\ transitions ?C\\ assms(2,3) \\t_source t = Inl (s1,s2)\\ assms(4) \\q1 \\ q2\\] \n \\target (initial (canonical_separator M q1 q2)) p = t_target t\\\n by simp \n qed \nqed\n\n\n(* does not assume observability of M (in contrast to the much stronger canonical_separator_path_initial) *)\nlemma canonical_separator_path_initial_ex :\n assumes \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) p\" (is \"path ?C (initial ?C) p\")\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"(\\ p1 . path M q1 p1 \\ p_io p1 = p_io p) \\ (\\ p2 . path M q2 p2 \\ p_io p2 = p_io p)\"\nand \"(\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io p) \\ p_io p2 = butlast (p_io p))\"\nproof -\n have \"((\\ p1 . path M q1 p1 \\ p_io p1 = p_io p) \\ (\\ p2 . path M q2 p2 \\ p_io p2 = p_io p))\n \\ (\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io p) \\ p_io p2 = butlast (p_io p))\"\n using assms proof (induction p rule: rev_induct) \n case Nil\n then show ?case by auto\n next\n case (snoc t p)\n then have \"path ?C (initial ?C) p\" and \"t \\ transitions ?C\" and \"t_source t = target (initial ?C) p\"\n by auto\n \n let ?P = \"(product (from_FSM M q1) (from_FSM M q2))\"\n \n obtain p' where \"path ?P (initial ?P) p'\"\n and *:\"p = map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) p'\"\n using canonical_separator_path_from_shift[OF \\path ?C (initial ?C) p\\ canonical_separator_path_split_target_isl[OF snoc.prems(1) assms(2,3)] assms(2,3)]\n by blast\n \n let ?pL = \"(map (\\t. (fst (t_source t), t_input t, t_output t, fst (t_target t))) p')\"\n let ?pR = \"(map (\\t. (snd (t_source t), t_input t, t_output t, snd (t_target t))) p')\"\n \n have \"path ?P (q1,q2) p'\"\n using \\path ?P (initial ?P) p'\\ assms(2,3) by simp\n \n then have pL: \"path (from_FSM M q1) q1 ?pL\"\n and pR: \"path (from_FSM M q2) q2 ?pR\"\n using product_path[of \"from_FSM M q1\" \"from_FSM M q2\" q1 q2 p'] by auto\n\n have \"p_io ?pL = butlast (p_io (p@[t]))\" and \"p_io ?pR = butlast (p_io (p@[t]))\"\n using * by auto\n then have \"path M q1 ?pL \\ path M q2 ?pR \\ p_io ?pL = butlast (p_io (p@[t])) \\ p_io ?pR = butlast (p_io (p@[t]))\"\n using from_FSM_path[OF \\q1 \\ nodes M\\ pL] from_FSM_path[OF \\q2 \\ nodes M\\ pR] by auto\n then have \"(\\p1 p2. path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io (p @ [t])) \\ p_io p2 = butlast (p_io (p @ [t])))\"\n by blast\n \n obtain s1 s2 where \"t_source t = Inl (s1,s2)\"\n using canonical_separator_path_split_target_isl[OF snoc.prems(1) assms(2,3)] \n by (metis \\t_source t = target (initial (canonical_separator M q1 q2)) p\\ isl_def old.prod.exhaust)\n \n have \"map t_target p = map (Inl o t_target) p'\"\n using * by auto\n then have \"target (initial ?C) p = Inl (target (q1,q2) p')\"\n unfolding target.simps visited_nodes.simps canonical_separator_simps(1)[OF assms(2,3)] \n by (simp add: last_map) \n then have \"target (q1,q2) p'= (s1,s2)\"\n using \\t_source t = target (initial ?C) p\\ \\t_source t = Inl (s1,s2)\\\n by auto \n \n have \"target q1 ?pL = s1\" and \"target q2 ?pR = s2\" \n using product_target_split[OF \\target (q1,q2) p'= (s1,s2)\\] by auto\n \n consider (a) \"(\\t1\\(transitions M). t_source t1 = s1 \\ t_input t1 = t_input t \\ t_output t1 = t_output t)\" |\n (b) \"(\\t2\\(transitions M). t_source t2 = s2 \\ t_input t2 = t_input t \\ t_output t2 = t_output t)\"\n using canonical_separator_transition_ex[OF \\t \\ transitions ?C\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\t_source t = Inl (s1,s2)\\] by blast\n then show ?case proof cases\n case a\n then obtain t1 where \"t1 \\ transitions M\" and \"t_source t1 = s1\" and \"t_input t1 = t_input t\" and \"t_output t1 = t_output t\" \n by blast\n \n have \"t_source t1 = target q1 ?pL\"\n using \\target q1 ?pL = s1\\ \\t_source t1 = s1\\ by auto\n then have \"path M q1 (?pL@[t1])\"\n using pL \\t1 \\ transitions M\\\n by (meson from_FSM_path path_append_transition snoc.prems(2))\n moreover have \"p_io (?pL@[t1]) = p_io (p@[t])\"\n using * \\t_input t1 = t_input t\\ \\t_output t1 = t_output t\\ by auto\n ultimately show ?thesis\n using \\(\\p1 p2. path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io (p @ [t])) \\ p_io p2 = butlast (p_io (p @ [t])))\\\n by meson\n next\n case b\n then obtain t2 where \"t2 \\ transitions M\" and \"t_source t2 = s2\" and \"t_input t2 = t_input t\" and \"t_output t2 = t_output t\" \n by blast\n \n have \"t_source t2 = target q2 ?pR\"\n using \\target q2 ?pR = s2\\ \\t_source t2 = s2\\ by auto\n then have \"path M q2 (?pR@[t2])\"\n using pR \\t2 \\ transitions M\\\n by (meson from_FSM_path path_append_transition snoc.prems(3))\n moreover have \"p_io (?pR@[t2]) = p_io (p@[t])\"\n using * \\t_input t2 = t_input t\\ \\t_output t2 = t_output t\\ by auto\n ultimately show ?thesis\n using \\(\\p1 p2. path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io (p @ [t])) \\ p_io p2 = butlast (p_io (p @ [t])))\\\n by meson\n qed\n qed\n then show \"(\\ p1 . path M q1 p1 \\ p_io p1 = p_io p) \\ (\\ p2 . path M q2 p2 \\ p_io p2 = p_io p)\"\n and \"(\\ p1 p2 . path M q1 p1 \\ path M q2 p2 \\ p_io p1 = butlast (p_io p) \\ p_io p2 = butlast (p_io p))\"\n by blast+\nqed\n\n\nlemma canonical_separator_language :\n assumes \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"L (canonical_separator M q1 q2) \\ L (from_FSM M q1) \\ L (from_FSM M q2)\" (is \"L ?C \\ L ?M1 \\ L ?M2\")\nproof \n fix io assume \"io \\ L (canonical_separator M q1 q2)\"\n then obtain p where *: \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) p\" and **: \"p_io p = io\"\n by auto\n \n show \"io \\ L (from_FSM M q1) \\ L (from_FSM M q2)\"\n using canonical_separator_path_initial_ex[OF * assms] unfolding ** \n using from_FSM_path_initial[OF assms(1)] from_FSM_path_initial[OF assms(2)] \n unfolding LS.simps by blast\nqed\n\n\nlemma canonical_separator_language_prefix :\n assumes \"io@[xy] \\ L (canonical_separator M q1 q2)\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"observable M\"\n and \"q1 \\ q2\"\nshows \"io \\ LS M q1\"\nand \"io \\ LS M q2\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n obtain p where \"path ?C (initial ?C) p\" and \"p_io p = io@[xy]\"\n using assms(1) by auto\n\n consider (a) \"(\\s1' s2'. target (initial (canonical_separator M q1 q2)) p = Inl (s1', s2'))\" |\n (b) \"target (initial (canonical_separator M q1 q2)) p = Inr q1\" | \n (c) \"target (initial (canonical_separator M q1 q2)) p = Inr q2\"\n using canonical_separator_path_initial(4)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5)] by blast\n then have \"io \\ LS M q1 \\ io \\ LS M q2\"\n proof cases\n case a\n then obtain s1 s2 where *: \"target (initial (canonical_separator M q1 q2)) p = Inl (s1, s2)\"\n by blast\n show ?thesis using canonical_separator_path_initial(1)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5) *] language_prefix\n by (metis (mono_tags, lifting) LS.simps \\p_io p = io @ [xy]\\ mem_Collect_eq )\n next\n case b\n show ?thesis using canonical_separator_path_initial(2)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5) b]\n using \\p_io p = io @ [xy]\\ by fastforce \n next\n case c\n show ?thesis using canonical_separator_path_initial(3)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5) c]\n using \\p_io p = io @ [xy]\\ by fastforce\n qed\n then show \"io \\ LS M q1\" and \"io \\ LS M q2\"\n by auto\nqed\n\n\nlemma canonical_separator_distinguishing_transitions_left_containment :\n assumes \"t \\ (distinguishing_transitions_left M q1 q2)\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"t \\ transitions (canonical_separator M q1 q2)\" \n using assms(1) unfolding canonical_separator_transitions_def[OF assms(2,3)] by blast\n\n\nlemma canonical_separator_distinguishing_transitions_right_containment :\n assumes \"t \\ (distinguishing_transitions_right M q1 q2)\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\n shows \"t \\ transitions (canonical_separator M q1 q2)\" (is \"t \\ transitions ?C\")\n using assms(1) unfolding canonical_separator_transitions_def[OF assms(2,3)] by blast\n\n\nlemma distinguishing_transitions_left_alt_intro :\n assumes \"(s1,s2) \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n and \"(\\t \\ transitions M. t_source t = s1 \\ t_input t = x \\ t_output t = y)\" \n and \"\\(\\t \\ transitions M. t_source t = s2 \\ t_input t = x \\ t_output t = y)\" \nshows \"(Inl (s1,s2), x, y, Inr q1) \\ distinguishing_transitions_left_alt M q1 q2\"\n using assms unfolding distinguishing_transitions_left_alt_def\n by auto \n\n\nlemma distinguishing_transitions_left_right_intro :\n assumes \"(s1,s2) \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n and \"\\(\\t \\ transitions M. t_source t = s1 \\ t_input t = x \\ t_output t = y)\" \n and \"(\\t \\ transitions M. t_source t = s2 \\ t_input t = x \\ t_output t = y)\" \nshows \"(Inl (s1,s2), x, y, Inr q2) \\ distinguishing_transitions_right_alt M q1 q2\"\n using assms unfolding distinguishing_transitions_right_alt_def\n by auto \n\n\nlemma canonical_separator_io_from_prefix_left :\n assumes \"io @ [io1] \\ LS M q1\"\n and \"io \\ LS M q2\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"observable M\"\n and \"q1 \\ q2\"\nshows \"io @ [io1] \\ L (canonical_separator M q1 q2)\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n\n obtain p1 where \"path M q1 p1\" and \"p_io p1 = io @ [io1]\"\n using \\io @ [io1] \\ LS M q1\\ by auto\n then have \"p1 \\ []\"\n by auto\n then obtain pL tL where \"p1 = pL @ [tL]\"\n using rev_exhaust by blast\n then have \"path M q1 (pL@[tL])\" and \"path M q1 pL\" and \"p_io pL = io\" and \"tL \\ transitions M\" \n and \"t_input tL = fst io1\" and \"t_output tL = snd io1\" and \"p_io (pL@[tL]) = io @ [io1]\"\n using \\path M q1 p1\\ \\p_io p1 = io @ [io1]\\ by auto\n then have pLf: \"path (from_FSM M q1) (initial (from_FSM M q1)) pL\" \n and pLf': \"path (from_FSM M q1) (initial (from_FSM M q1)) (pL@[tL])\"\n using from_FSM_path_initial[OF \\q1 \\ nodes M\\] by auto\n\n obtain pR where \"path M q2 pR\" and \"p_io pR = io\"\n using \\io \\ LS M q2\\ by auto\n then have pRf: \"path (from_FSM M q2) (initial (from_FSM M q2)) pR\"\n using from_FSM_path_initial[OF \\q2 \\ nodes M\\] by auto\n\n have \"p_io pL = p_io pR\"\n using \\p_io pL = io\\ \\p_io pR = io\\ by auto\n\n let ?pLR = \"zip_path pL pR\"\n let ?pCLR = \"map shift_Inl ?pLR\"\n let ?P = \"product (from_FSM M q1) (from_FSM M q2)\"\n\n have \"path ?P (initial ?P) ?pLR\"\n and \"target (initial ?P) ?pLR = (target q1 pL, target q2 pR)\"\n using product_path_from_paths[OF pLf pRf \\p_io pL = p_io pR\\]\n unfolding from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)] by linarith+\n\n have \"path ?C (initial ?C) ?pCLR\"\n using canonical_separator_path_shift[OF assms(3,4)] \\path ?P (initial ?P) ?pLR\\ \n by simp \n\n have \"isl (target (initial ?C) ?pCLR)\" \n unfolding canonical_separator_simps(1)[OF assms(3,4)] by (cases ?pLR rule: rev_cases; auto)\n then obtain s1 s2 where \"target (initial ?C) ?pCLR = Inl (s1,s2)\"\n by (metis (no_types, lifting) \\path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) (map (\\t. (Inl (t_source t), t_input t, t_output t, Inl (t_target t))) (map (\\t. ((t_source (fst t), t_source (snd t)), t_input (fst t), t_output (fst t), t_target (fst t), t_target (snd t))) (zip pL pR)))\\ \n assms(3) assms(4) assms(5) assms(6) canonical_separator_path_initial(4) sum.discI(2))\n then have \"Inl (s1,s2) \\ nodes ?C\"\n using path_target_is_node[OF \\path ?C (initial ?C) ?pCLR\\] by simp\n then have \"(s1,s2) \\ nodes ?P\"\n using canonical_separator_nodes[OF _ assms(3,4)] by force\n\n have \"target (initial ?P) ?pLR = (s1,s2)\"\n using \\target (initial ?C) ?pCLR = Inl (s1,s2)\\ assms(3,4) \n unfolding canonical_separator_simps(1)[OF assms(3,4)] product_simps(1) from_FSM_simps target.simps visited_nodes.simps \n by (cases ?pLR rule: rev_cases; auto)\n then have \"target q1 pL = s1\" and \"target q2 pR = s2\"\n using \\target (initial ?P) ?pLR = (target q1 pL, target q2 pR)\\ by auto\n then have \"t_source tL = s1\"\n using \\path M q1 (pL@[tL])\\ by auto\n\n show ?thesis proof (cases \"\\ tR \\ (transitions M) . t_source tR = target q2 pR \\ t_input tR = t_input tL \\ t_output tR = t_output tL\")\n case True\n then obtain tR where \"tR \\ (transitions M)\" and \"t_source tR = target q2 pR\" and \"t_input tR = t_input tL\" and \"t_output tR = t_output tL\"\n by blast\n \n have \"t_source tR \\ nodes M\"\n unfolding \\t_source tR = target q2 pR\\ \\target q2 pR = s2\\ \n using \\(s1,s2) \\ nodes ?P\\ product_simps(2) from_FSM_simps(2) assms(3,4) by simp\n\n then have \"tR \\ transitions M\"\n using \\tR \\ (transitions M)\\ \\t_input tR = t_input tL\\ \\t_output tR = t_output tL\\ \\tL \\ transitions M\\ by auto\n\n then have \"path M q2 (pR@[tR])\" \n using \\path M q2 pR\\ \\t_source tR = target q2 pR\\ path_append_transition by metis\n then have pRf': \"path (from_FSM M q2) (initial (from_FSM M q2)) (pR@[tR])\"\n using from_FSM_path_initial[OF \\q2 \\ nodes M\\] by auto\n \n let ?PP = \"(zip_path (pL@[tL]) (pR@[tR]))\"\n let ?PC = \"map shift_Inl ?PP\"\n\n have \"length pL = length pR\"\n using \\p_io pL = p_io pR\\ map_eq_imp_length_eq by blast\n moreover have \"p_io (pL@[tL]) = p_io (pR@[tR])\"\n using \\p_io pR = io\\ \\t_input tL = fst io1\\ \\t_output tL = snd io1\\ \\t_input tR = t_input tL\\ \\t_output tR = t_output tL\\ \\p_io (pL@[tL]) = io@[io1]\\ by auto\n ultimately have \"p_io ?PP = p_io (pL@[tL])\"\n by (induction pL pR rule: list_induct2; auto)\n\n have \"p_io ?PC = p_io ?PP\"\n by auto\n \n have \"path ?P (initial ?P) ?PP\"\n using product_path_from_paths(1)[OF pLf' pRf' \\p_io (pL@[tL]) = p_io (pR@[tR])\\] by assumption\n then have \"path ?C (initial ?C) ?PC\"\n using canonical_separator_path_shift[OF assms(3,4)] by simp \n moreover have \"p_io ?PC = io@[io1]\"\n using \\p_io (pL@[tL]) = io@[io1]\\ \\p_io ?PP = p_io (pL@[tL])\\ \\p_io ?PC = p_io ?PP\\ by simp\n ultimately have \"\\ p . path ?C (initial ?C) p \\ p_io p = io@[io1]\"\n by blast\n then show ?thesis unfolding LS.simps by force\n next\n case False\n\n let ?t = \"(Inl (s1,s2), t_input tL, t_output tL, Inr q1)\"\n\n have \"(s1,s2) \\ reachable_nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n by (metis (no_types, lifting) \\path (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2)) (FSM.initial (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))) (zip_path pL pR)\\ \\target (FSM.initial (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))) (zip_path pL pR) = (s1, s2)\\ reachable_nodes_intro)\n moreover have \"(\\tR\\FSM.transitions M.\n t_source tR = target q1 pL \\ t_input tR = t_input tL \\ t_output tR = t_output tL)\"\n using \\tL \\ transitions M\\ \\path M q1 (pL@[tL])\\\n by auto \n ultimately have \"?t \\ (distinguishing_transitions_left_alt M q1 q2)\"\n using distinguishing_transitions_left_alt_intro[OF _ _ False ] \\q1 \\ q2\\\n unfolding \\target q1 pL = s1\\ \\target q2 pR = s2\\\n using \\(s1, s2) \\ FSM.nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\\ by blast\n then have \"?t \\ transitions ?C\" \n using canonical_separator_distinguishing_transitions_left_containment[OF _ assms(3,4)] unfolding distinguishing_transitions_left_alt_alt_def by blast \n then have \"path ?C (initial ?C) (?pCLR@[?t])\"\n using \\path ?C (initial ?C) ?pCLR\\ \\target (initial ?C) ?pCLR = Inl (s1,s2)\\ \n by (simp add: path_append_transition)\n\n have \"length pL = length pR\"\n using \\p_io pL = p_io pR\\ \n using map_eq_imp_length_eq by blast\n then have \"p_io ?pCLR = p_io pL\" \n by (induction pL pR rule: list_induct2; auto)\n then have \"p_io (?pCLR@[?t]) = io @ [io1]\"\n using \\p_io pL = io\\ \\t_input tL = fst io1\\ \\t_output tL = snd io1\\\n by auto\n then have \"\\ p . path ?C (initial ?C) p \\ p_io p = io@[io1]\"\n using \\path ?C (initial ?C) (?pCLR@[?t])\\ by meson\n then show ?thesis \n unfolding LS.simps by force\n qed\nqed\n\n\n\n\n\nlemma canonical_separator_path_targets_language :\n assumes \"path (canonical_separator M q1 q2) (initial (canonical_separator M q1 q2)) p\"\n and \"observable M\" \n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"q1 \\ q2\"\nshows \"isl (target (initial (canonical_separator M q1 q2)) p) \\ p_io p \\ LS M q1 \\ LS M q2\"\nand \"(target (initial (canonical_separator M q1 q2)) p) = Inr q1 \\ p_io p \\ LS M q1 - LS M q2 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\nand \"(target (initial (canonical_separator M q1 q2)) p) = Inr q2 \\ p_io p \\ LS M q2 - LS M q1 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\nand \"p_io p \\ LS M q1 \\ LS M q2 \\ isl (target (initial (canonical_separator M q1 q2)) p)\"\nand \"p_io p \\ LS M q1 - LS M q2 \\ target (initial (canonical_separator M q1 q2)) p = Inr q1\"\nand \"p_io p \\ LS M q2 - LS M q1 \\ target (initial (canonical_separator M q1 q2)) p = Inr q2\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n let ?tgt = \"target (initial ?C) p\"\n\n show \"isl ?tgt \\ p_io p \\ LS M q1 \\ LS M q2\"\n proof -\n assume \"isl ?tgt\"\n then obtain s1 s2 where \"?tgt = Inl (s1,s2)\"\n by (metis isl_def old.prod.exhaust)\n then obtain p1 p2 where \"path M q1 p1\" and \"path M q2 p2\" and \"p_io p1 = p_io p\" and \"p_io p2 = p_io p\" \n using canonical_separator_path_initial(1)[OF assms(1) \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\observable M\\ \\q1 \\ q2\\ \\?tgt = Inl (s1,s2)\\ ] by force\n then show \"p_io p \\ LS M q1 \\ LS M q2\"\n unfolding LS.simps by force\n qed\n moreover show \"?tgt = Inr q1 \\ p_io p \\ LS M q1 - LS M q2 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\n proof -\n assume \"?tgt = Inr q1\"\n obtain p1 p2 t where \"path M q1 (p1 @ [t])\" and \"path M q2 p2\" and \"p_io (p1 @ [t]) = p_io p\" \n and \"p_io p2 = butlast (p_io p)\" and \"(\\p2. path M q2 p2 \\ p_io p2 = p_io p)\" \n using canonical_separator_path_initial(2)[OF assms(1) \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \n \\observable M\\ \\q1 \\ q2\\ \\?tgt = Inr q1\\] \n by meson\n\n have \"path M q1 p1\"\n using \\path M q1 (p1@[t])\\ by auto\n have \"p_io p1 = butlast (p_io p)\"\n using \\p_io (p1 @ [t]) = p_io p\\ \n by (metis (no_types, lifting) butlast_snoc map_butlast)\n\n have \"p_io p \\ LS M q1\" \n using \\path M q1 (p1@[t])\\ \\p_io (p1 @ [t]) = p_io p\\ unfolding LS.simps by force\n moreover have \"p_io p \\ LS M q2\"\n using \\(\\p2. path M q2 p2 \\ p_io p2 = p_io p)\\ unfolding LS.simps by force\n moreover have \"butlast (p_io p) \\ LS M q1\"\n using \\path M q1 p1\\ \\p_io p1 = butlast (p_io p)\\ unfolding LS.simps by force\n moreover have \"butlast (p_io p) \\ LS M q2\"\n using \\path M q2 p2\\ \\p_io p2 = butlast (p_io p)\\ unfolding LS.simps by force\n ultimately show \"p_io p \\ LS M q1 - LS M q2 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\n by (simp add: map_butlast)\n qed \n moreover show \"?tgt = Inr q2 \\ p_io p \\ LS M q2 - LS M q1 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\n proof -\n assume \"?tgt = Inr q2\"\n obtain p1 p2 t where \"path M q2 (p2 @ [t])\" and \"path M q1 p1\" and \"p_io (p2 @ [t]) = p_io p\" \n and \"p_io p1 = butlast (p_io p)\" and \"(\\p2. path M q1 p2 \\ p_io p2 = p_io p)\" \n using canonical_separator_path_initial(3)[OF assms(1) \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \n \\observable M\\ \\q1 \\ q2\\ \\?tgt = Inr q2\\] \n by meson\n\n have \"path M q2 p2\"\n using \\path M q2 (p2@[t])\\ by auto\n have \"p_io p2 = butlast (p_io p)\"\n using \\p_io (p2 @ [t]) = p_io p\\ \n by (metis (no_types, lifting) butlast_snoc map_butlast)\n\n have \"p_io p \\ LS M q2\" \n using \\path M q2 (p2@[t])\\ \\p_io (p2 @ [t]) = p_io p\\ unfolding LS.simps by force\n moreover have \"p_io p \\ LS M q1\"\n using \\(\\p2. path M q1 p2 \\ p_io p2 = p_io p)\\ unfolding LS.simps by force\n moreover have \"butlast (p_io p) \\ LS M q1\"\n using \\path M q1 p1\\ \\p_io p1 = butlast (p_io p)\\ unfolding LS.simps by force\n moreover have \"butlast (p_io p) \\ LS M q2\"\n using \\path M q2 p2\\ \\p_io p2 = butlast (p_io p)\\ unfolding LS.simps by force\n ultimately show \"p_io p \\ LS M q2 - LS M q1 \\ p_io (butlast p) \\ LS M q1 \\ LS M q2\"\n by (simp add: map_butlast)\n qed \n moreover have \"isl ?tgt \\ ?tgt = Inr q1 \\ ?tgt = Inr q2\"\n using canonical_separator_path_initial(4)[OF assms(1) \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\observable M\\ \\q1 \\ q2\\] by force\n ultimately show \"p_io p \\ LS M q1 \\ LS M q2 \\ isl (target (initial (canonical_separator M q1 q2)) p)\"\n and \"p_io p \\ LS M q1 - LS M q2 \\ target (initial (canonical_separator M q1 q2)) p = Inr q1\"\n and \"p_io p \\ LS M q2 - LS M q1 \\ target (initial (canonical_separator M q1 q2)) p = Inr q2\"\n by blast+\nqed\n \n\nlemma canonical_separator_language_target :\n assumes \"io \\ L (canonical_separator M q1 q2)\"\n and \"observable M\" \n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"q1 \\ q2\"\nshows \"io \\ LS M q1 - LS M q2 \\ io_targets (canonical_separator M q1 q2) io (initial (canonical_separator M q1 q2)) = {Inr q1}\"\nand \"io \\ LS M q2 - LS M q1 \\ io_targets (canonical_separator M q1 q2) io (initial (canonical_separator M q1 q2)) = {Inr q2}\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n obtain p where \"path ?C (initial ?C) p\" and \"p_io p = io\"\n using assms(1) by force\n\n show \"io \\ LS M q1 - LS M q2 \\ io_targets (canonical_separator M q1 q2) io (initial (canonical_separator M q1 q2)) = {Inr q1}\"\n proof -\n assume \"io \\ LS M q1 - LS M q2\"\n then have \"p_io p \\ LS M q1 - LS M q2\"\n using \\p_io p = io\\ by auto\n have \"Inr q1 \\ io_targets ?C io (initial ?C)\"\n using canonical_separator_path_targets_language(5)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5) \\p_io p \\ LS M q1 - LS M q2\\]\n using \\path ?C (initial ?C) p\\ unfolding io_targets.simps \n by (metis (mono_tags, lifting) \\p_io p = io\\ mem_Collect_eq)\n then show ?thesis\n by (metis (mono_tags, lifting) assms(1) assms(2) assms(3) assms(4) canonical_separator_observable observable_io_targets singletonD)\n qed\n\n show \"io \\ LS M q2 - LS M q1 \\ io_targets (canonical_separator M q1 q2) io (initial (canonical_separator M q1 q2)) = {Inr q2}\"\n proof -\n assume \"io \\ LS M q2 - LS M q1\"\n then have \"p_io p \\ LS M q2 - LS M q1\"\n using \\p_io p = io\\ by auto\n have \"Inr q2 \\ io_targets ?C io (initial ?C)\"\n using canonical_separator_path_targets_language(6)[OF \\path ?C (initial ?C) p\\ assms(2,3,4,5) \\p_io p \\ LS M q2 - LS M q1\\]\n using \\path ?C (initial ?C) p\\ unfolding io_targets.simps \n by (metis (mono_tags, lifting) \\p_io p = io\\ mem_Collect_eq)\n then show ?thesis\n by (metis (mono_tags, lifting) assms(1) assms(2) assms(3) assms(4) canonical_separator_observable observable_io_targets singletonD)\n qed\nqed\n\n\nlemma canonical_separator_language_intersection :\n assumes \"io \\ LS M q1\"\n and \"io \\ LS M q2\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"io \\ L (canonical_separator M q1 q2)\" (is \"io \\ L ?C\")\nproof -\n let ?P = \"product (from_FSM M q1) (from_FSM M q2)\"\n\n have \"io \\ L ?P\"\n using \\io \\ LS M q1\\ \\io \\ LS M q2\\ product_language[of \"from_FSM M q1\" \"from_FSM M q2\"] \n unfolding from_FSM_language[OF \\q1 \\ nodes M\\] from_FSM_language[OF \\q2 \\ nodes M\\]\n by blast\n then obtain p where \"path ?P (initial ?P) p\" and \"p_io p = io\"\n by auto\n then have *: \"path ?C (initial ?C) (map shift_Inl p)\"\n using canonical_separator_path_shift[OF assms(3,4)] by auto\n have **: \"p_io (map shift_Inl p) = io\"\n using \\p_io p = io\\ by (induction p; auto)\n show \"io \\ L ?C\" \n using language_state_containment[OF * **] by assumption\nqed\n\n\nlemma canonical_separator_deadlock :\n assumes \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n shows \"deadlock_state (canonical_separator M q1 q2) (Inr q1)\"\n and \"deadlock_state (canonical_separator M q1 q2) (Inr q2)\"\n unfolding deadlock_state.simps \n by (metis assms(1) assms(2) canonical_separator_t_source_isl sum.disc(2))+\n\n\nlemma canonical_separator_isl_deadlock :\n assumes \"Inl (q1',q2') \\ nodes (canonical_separator M q1 q2)\"\n and \"x \\ inputs M\"\n and \"completely_specified M\"\n and \"\\(\\ t \\ transitions (canonical_separator M q1 q2) . t_source t = Inl (q1',q2') \\ t_input t = x \\ isl (t_target t))\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nobtains y1 y2 where \"(Inl (q1',q2'),x,y1,Inr q1) \\ transitions (canonical_separator M q1 q2)\"\n \"(Inl (q1',q2'),x,y2,Inr q2) \\ transitions (canonical_separator M q1 q2)\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n let ?P = \"(product (from_FSM M q1) (from_FSM M q2))\"\n\n have \"(q1',q2') \\ nodes ?P\"\n using assms(1) unfolding canonical_separator_simps[OF assms(5,6)] by fastforce\n then have \"(q1',q2') \\ nodes ?P\"\n using reachable_node_is_node by force\n then have \"q1' \\ nodes M\" and \"q2' \\ nodes M\"\n using assms(5,6) by auto\n then obtain y1 y2 where \"y1 \\ h_out M (q1',x)\" and \"y2 \\ h_out M (q2',x)\"\n by (metis (no_types, lifting) assms(2,3) h_out.simps completely_specified_alt_def mem_Collect_eq) \n moreover have \"h_out M (q1',x) \\ h_out M (q2',x) = {}\"\n proof (rule ccontr)\n assume \"h_out M (q1', x) \\ h_out M (q2', x) \\ {}\"\n then obtain y where \"y \\ h_out M (q1', x) \\ h_out M (q2', x)\" by blast\n then obtain q1'' q2'' where \"((q1',q2'),x,y,(q1'',q2'')) \\ transitions ?P\"\n unfolding product_transitions_def h_out.simps using assms(5,6) by auto\n then have \"(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ transitions ?C\"\n using \\(q1',q2') \\ nodes ?P\\ unfolding canonical_separator_transitions_def[OF assms(5,6)] h_out.simps by blast\n then show \"False\"\n using assms(4) by auto\n qed\n ultimately have \"y1 \\ h_out M (q1',x) - h_out M (q2',x)\"\n and \"y2 \\ h_out M (q2',x) - h_out M (q1',x)\"\n by blast+\n\n let ?t1 = \"(Inl (q1',q2'),x,y1,Inr q1)\"\n let ?t2 = \"(Inl (q1',q2'),x,y2,Inr q2)\"\n\n have \"?t1 \\ distinguishing_transitions_left M q1 q2\"\n using \\(q1',q2') \\ nodes ?P\\ \\y1 \\ h_out M (q1',x) - h_out M (q2',x)\\\n unfolding distinguishing_transitions_left_def by auto\n then have \"?t1 \\ transitions (canonical_separator M q1 q2)\"\n unfolding canonical_separator_transitions_def[OF assms(5,6)] by blast\n\n have \"?t2 \\ distinguishing_transitions_right M q1 q2\"\n using \\(q1',q2') \\ nodes ?P\\ \\y2 \\ h_out M (q2',x) - h_out M (q1',x)\\\n unfolding distinguishing_transitions_right_def by auto\n then have \"?t2 \\ transitions (canonical_separator M q1 q2)\"\n unfolding canonical_separator_transitions_def[OF assms(5,6)] by blast\n\n show ?thesis \n using that \\?t1 \\ transitions (canonical_separator M q1 q2)\\ \\?t2 \\ transitions (canonical_separator M q1 q2)\\ by blast\nqed\n\n\nlemma canonical_separator_deadlocks :\n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\nshows \"deadlock_state (canonical_separator M q1 q2) (Inr q1)\"\nand \"deadlock_state (canonical_separator M q1 q2) (Inr q2)\"\n using canonical_separator_t_source_isl[OF _ assms]\n unfolding deadlock_state.simps by force+\n\n\nlemma state_separator_from_canonical_separator_language_target :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"io \\ L A\"\n and \"observable M\" \n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"q1 \\ q2\"\nshows \"io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {Inr q1}\"\nand \"io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {Inr q2}\"\nand \"io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}\"\nproof -\n have \"observable A\"\n using state_separator_from_canonical_separator_observable[OF assms(1,3,4,5)] by assumption\n\n let ?C = \"canonical_separator M q1 q2\"\n\n obtain p where \"path A (initial A) p\" and \"p_io p = io\"\n using assms(2) by force\n then have \"path ?C (initial ?C) p\"\n using submachine_path_initial[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)]] by auto\n then have \"io \\ L ?C\"\n using \\p_io p = io\\ by auto\n\n show \"io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {Inr q1}\"\n proof -\n assume \"io \\ LS M q1 - LS M q2\"\n\n have \"target (initial A) p = Inr q1\"\n using submachine_path_initial[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)] \\path A (initial A) p\\] \n canonical_separator_language_target(1)[OF \\io \\ L ?C\\ assms(3,4,5,6) \\io \\ LS M q1 - LS M q2\\] \n \\p_io p = io\\\n unfolding io_targets.simps is_state_separator_from_canonical_separator_initial[OF assms(1,4,5)] \n canonical_separator_simps product_simps from_FSM_simps[OF assms(4)] from_FSM_simps[OF assms(5)]\n using assms(4) assms(5) canonical_separator_initial by fastforce\n then have \"Inr q1 \\ io_targets A io (initial A)\"\n using \\path A (initial A) p\\ \\p_io p = io\\ unfolding io_targets.simps\n by (metis (mono_tags, lifting) mem_Collect_eq) \n then show \"io_targets A io (initial A) = {Inr q1}\"\n using observable_io_targets[OF \\observable A\\ \\io \\ L A\\]\n by (metis singletonD) \n qed\n\n show \"io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {Inr q2}\"\n proof -\n assume \"io \\ LS M q2 - LS M q1\"\n\n have \"target (initial A) p = Inr q2\"\n using submachine_path_initial[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)] \\path A (initial A) p\\] \n canonical_separator_language_target(2)[OF \\io \\ L ?C\\ assms(3,4,5,6) \\io \\ LS M q2 - LS M q1\\] \n \\p_io p = io\\\n unfolding io_targets.simps is_state_separator_from_canonical_separator_initial[OF assms(1,4,5)] \n canonical_separator_simps product_simps from_FSM_simps[OF assms(4)] from_FSM_simps[OF assms(5)]\n using assms(4) assms(5) canonical_separator_initial by fastforce\n then have \"Inr q2 \\ io_targets A io (initial A)\"\n using \\path A (initial A) p\\ \\p_io p = io\\ unfolding io_targets.simps\n by (metis (mono_tags, lifting) mem_Collect_eq) \n then show \"io_targets A io (initial A) = {Inr q2}\"\n using observable_io_targets[OF \\observable A\\ \\io \\ L A\\]\n by (metis singletonD) \n qed\n\n show \"io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}\"\n proof -\n let ?P = \"product (from_FSM M q1) (from_FSM M q2)\"\n\n assume \"io \\ LS M q1 \\ LS M q2\"\n\n have\"\\ q . q \\ io_targets A io (initial A) \\ q \\ {Inr q1, Inr q2}\"\n proof -\n fix q assume \"q \\ io_targets A io (initial A)\"\n then obtain p where \"q = target (initial A) p\" and \"path A (initial A) p\" and \"p_io p = io\"\n by auto\n then have \"path ?C (initial ?C) p\"\n using submachine_path_initial[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)]] by auto\n then have \"isl (target (initial ?C) p)\"\n using canonical_separator_path_targets_language(4)[OF _ \\observable M\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\q1 \\ q2\\]\n using \\p_io p = io\\ \\io \\ LS M q1 \\ LS M q2\\ by auto\n then show \"q \\ {Inr q1, Inr q2}\"\n using \\q = target (initial A) p\\ \n unfolding is_state_separator_from_canonical_separator_initial[OF assms(1,4,5)]\n unfolding canonical_separator_simps product_simps from_FSM_simps by auto\n qed\n\n then show \"io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}\"\n by blast\n qed\nqed\n\n\nlemma state_separator_language_intersections_nonempty :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"observable M\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"q1 \\ q2\"\nshows \"\\ io . io \\ (L A \\ LS M q1) - LS M q2\" and \"\\ io . io \\ (L A \\ LS M q2) - LS M q1\"\nproof -\n have \"Inr q1 \\ reachable_nodes A\"\n using is_state_separator_from_canonical_separator_simps(6)[OF assms(1)] by assumption\n then obtain p where \"path A (initial A) p\" and \"target (initial A) p = Inr q1\"\n unfolding reachable_nodes_def by auto \n then have \"p_io p \\ LS M q1 - LS M q2\"\n using canonical_separator_maximal_path_distinguishes_left[OF assms(1) _ _ assms(2,3,4,5)] by blast\n moreover have \"p_io p \\ L A\"\n using \\path A (initial A) p\\ by auto\n ultimately show \"\\ io . io \\ (L A \\ LS M q1) - LS M q2\" by blast\n\n have \"Inr q2 \\ reachable_nodes A\"\n using is_state_separator_from_canonical_separator_simps(7)[OF assms(1)] by assumption\n then obtain p' where \"path A (initial A) p'\" and \"target (initial A) p' = Inr q2\"\n unfolding reachable_nodes_def by auto \n then have \"p_io p' \\ LS M q2 - LS M q1\"\n using canonical_separator_maximal_path_distinguishes_right[OF assms(1) _ _ assms(2,3,4,5)] by blast\n moreover have \"p_io p' \\ L A\"\n using \\path A (initial A) p'\\ by auto\n ultimately show \"\\ io . io \\ (L A \\ LS M q2) - LS M q1\" by blast\nqed\n\n\nlemma state_separator_language_inclusion :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\nshows \"L A \\ LS M q1 \\ LS M q2\"\n using canonical_separator_language[OF assms(2,3)]\n using submachine_language[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)]] \n unfolding from_FSM_language[OF assms(2)] from_FSM_language[OF assms(3)] by blast\n\n\nlemma state_separator_from_canonical_separator_targets_left_inclusion :\n assumes \"observable T\" \n and \"observable M\"\n and \"t1 \\ nodes T\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"(inputs T) = (inputs M)\"\n and \"path A (initial A) p\"\n and \"p_io p \\ LS M q1\"\n and \"q1 \\ q2\"\nshows \"target (initial A) p \\ Inr q2\"\nand \"target (initial A) p = Inr q1 \\ isl (target (initial A) p)\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n have c_path: \"\\ p . path A (initial A) p \\ path ?C (initial ?C) p\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] submachine_path_initial by metis\n have \"path ?C (initial ?C) p\"\n using assms(8) c_path by auto\n\n show \"target (initial A) p \\ Inr q2\"\n proof \n assume \"target (initial A) p = Inr q2\"\n then have \"target (initial ?C) p = Inr q2\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] by auto\n\n have \"(\\p1. path M q1 p1 \\ p_io p1 = p_io p)\"\n using canonical_separator_path_initial(3)[OF \\path ?C (initial ?C) p\\ assms(4,5,2,10) \\target (initial ?C) p = Inr q2\\] by blast\n then have \"p_io p \\ LS M q1\"\n unfolding LS.simps by force\n then show \"False\"\n using \\p_io p \\ LS M q1\\ by blast\n qed\n then have \"target (initial ?C) p \\ Inr q2\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] unfolding is_submachine.simps by simp\n then have \"target (initial ?C) p = Inr q1 \\ isl (target (initial ?C) p)\"\n proof (cases p rule: rev_cases)\n case Nil\n then show ?thesis unfolding canonical_separator_simps[OF assms(4,5)] by simp\n next\n case (snoc ys y)\n then show ?thesis\n by (metis \\path (canonical_separator M q1 q2) (FSM.initial (canonical_separator M q1 q2)) p\\ \\target (FSM.initial (canonical_separator M q1 q2)) p \\ Inr q2\\ assms(10) assms(2) assms(4) assms(5) canonical_separator_path_initial(4) isl_def) \n qed\n then show \"target (initial A) p = Inr q1 \\ isl (target (initial A) p)\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] unfolding is_submachine.simps by simp\nqed\n\n\nlemma state_separator_from_canonical_separator_targets_right_inclusion :\n assumes \"observable T\" \n and \"observable M\"\n and \"t1 \\ nodes T\"\n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"(inputs T) = (inputs M)\"\n and \"path A (initial A) p\"\n and \"p_io p \\ LS M q2\"\n and \"q1 \\ q2\"\nshows \"target (initial A) p \\ Inr q1\"\nand \"target (initial A) p = Inr q2 \\ isl (target (initial A) p)\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n have c_path: \"\\ p . path A (initial A) p \\ path ?C (initial ?C) p\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] submachine_path_initial by metis\n have \"path ?C (initial ?C) p\"\n using assms(8) c_path by auto\n\n show \"target (initial A) p \\ Inr q1\"\n proof \n assume \"target (initial A) p = Inr q1\"\n then have \"target (initial ?C) p = Inr q1\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] by auto\n\n have \"(\\p1. path M q2 p1 \\ p_io p1 = p_io p)\"\n using canonical_separator_path_initial(2)[OF \\path ?C (initial ?C) p\\ assms(4,5,2,10) \\target (initial ?C) p = Inr q1\\ ] by blast\n then have \"p_io p \\ LS M q2\"\n unfolding LS.simps by force\n then show \"False\"\n using \\p_io p \\ LS M q2\\ by blast\n qed\n\n then have \"target (initial ?C) p \\ Inr q1\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] unfolding is_submachine.simps by simp\n then have \"target (initial ?C) p = Inr q2 \\ isl (target (initial ?C) p)\"\n proof (cases p rule: rev_cases)\n case Nil\n then show ?thesis unfolding canonical_separator_simps[OF assms(4,5)] by simp\n next\n case (snoc ys y)\n then show ?thesis\n by (metis \\path (canonical_separator M q1 q2) (FSM.initial (canonical_separator M q1 q2)) p\\ \\target (FSM.initial (canonical_separator M q1 q2)) p \\ Inr q1\\ assms(10) assms(2) assms(4) assms(5) canonical_separator_path_initial(4) isl_def)\n qed\n then show \"target (initial A) p = Inr q2 \\ isl (target (initial A) p)\"\n using is_state_separator_from_canonical_separator_simps(1)[OF assms(6)] unfolding is_submachine.simps by simp\nqed\n\n\n\n\nsubsection \\Calculating State Separators\\\n\nsubsubsection \\Sufficient Condition to Induce a State Separator\\\n\ndefinition state_separator_from_input_choices :: \"('a,'b,'c) fsm \\ (('a \\ 'a) + 'a,'b,'c) fsm \\ 'a \\ 'a \\ ((('a \\ 'a) + 'a) \\ 'b) list \\ (('a \\ 'a) + 'a, 'b, 'c) fsm\" where\n \"state_separator_from_input_choices M CSep q1 q2 cs = \n (let css = set cs;\n cssQ = (set (map fst cs)) \\ {Inr q1, Inr q2};\n S0 = filter_nodes CSep (\\ q . q \\ cssQ);\n S1 = filter_transitions S0 (\\ t . (t_source t, t_input t) \\ css) \n in S1)\"\n\n\n\n\nlemma state_separator_from_input_choices_simps : \n assumes \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\nshows\n \"initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1,q2)\"\n \"nodes (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = (set (map fst cs)) \\ {Inr q1, Inr q2}\"\n \"inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = inputs M\"\n \"outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = outputs M\"\n \"transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = \n {t \\ (transitions (canonical_separator M q1 q2)) . \\ q1' q2' x . (Inl (q1',q2'),x) \\ set cs \\ t_source t = Inl (q1',q2') \\ t_input t = x \\ t_target t \\ (set (map fst cs)) \\ {Inr q1, Inr q2}}\"\nproof -\n let ?SS = \"(state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n let ?S0 = \"filter_nodes (canonical_separator M q1 q2) (\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\"\n\n have \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\"\n unfolding canonical_separator_simps[OF assms(1,2)]\n using assms(4) by simp\n\n have \"nodes ?S0 = (set (map fst cs)) \\ {Inr q1, Inr q2}\"\n proof -\n have \"\\ qq . qq \\ nodes ?S0 \\ qq \\ (set (map fst cs)) \\ {Inr q1, Inr q2}\"\n unfolding filter_nodes_simps[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", \n OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\ ]\n by fastforce\n moreover have \"\\ qq . qq \\ (set (map fst cs)) \\ {Inr q1, Inr q2} \\ qq \\ nodes ?S0\"\n proof -\n fix qq assume \"qq \\ set (map fst cs) \\ {Inr q1, Inr q2}\"\n then consider (a) \"qq \\ set (map fst cs)\" | (b) \"qq \\ {Inr q1, Inr q2}\"\n by blast\n then show \"qq \\ nodes ?S0\" proof cases\n case a\n then obtain q1' q2' where \"qq = Inl (q1',q2')\"\n using assms(5) by (metis old.prod.exhaust) \n then show ?thesis \n using a assms(3)[of qq] \n unfolding filter_nodes_simps[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\ ]\n canonical_separator_simps[OF assms(1,2)] by force\n next\n case b\n then show ?thesis using assms(3) \n unfolding filter_nodes_simps[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\ ]\n canonical_separator_simps[OF assms(1,2)] by force\n qed \n qed\n \n ultimately show ?thesis by blast\n qed\n \n\n show \"initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1,q2)\"\n \"nodes (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = (set (map fst cs)) \\ {Inr q1, Inr q2}\"\n \"inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = inputs M\"\n \"outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = outputs M\"\n unfolding canonical_separator_simps[OF assms(1,2)] \n filter_transitions_simps \n state_separator_from_input_choices_def \n Let_def \n filter_nodes_simps(1,3,4,5)[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\ ] \n \\nodes ?S0 = (set (map fst cs)) \\ {Inr q1, Inr q2}\\ \n by simp+\n\n have alt_def_shared: \"{t \\ {t \\ FSM.transitions (canonical_separator M q1 q2). t_source t \\ set (map fst cs) \\ {Inr q1, Inr q2} \\ t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}}. (t_source t, t_input t) \\ set cs}\n = {t \\ FSM.transitions (canonical_separator M q1 q2). \\ q1' q2' x . (Inl (q1', q2'), x)\\set cs \\ t_source t = Inl (q1', q2') \\ t_input t = x \\ t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}}\" \n (is \"?ts1 = ?ts2\")\n proof -\n have \"\\ t . t \\ ?ts1 \\ t \\ ?ts2\"\n proof -\n fix t assume \"t \\ ?ts1\"\n then have \"t \\ FSM.transitions (canonical_separator M q1 q2)\" and \"t_source t \\ set (map fst cs) \\ {Inr q1, Inr q2}\" and \"t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}\" and \"(t_source t, t_input t) \\ set cs\"\n by blast+\n \n have \"t_source t \\ set (map fst cs)\"\n using \\t \\ FSM.transitions (canonical_separator M q1 q2)\\ \\t_source t \\ set (map fst cs) \\ {Inr q1, Inr q2}\\\n using canonical_separator_deadlocks[OF assms(1,2)]\n by fastforce\n then obtain q1' q2' where \"t_source t = Inl (q1',q2')\"\n using assms(5) by (metis old.prod.exhaust) \n then have \"\\q1' q2' x. (Inl (q1', q2'), x) \\ set cs \\ t_source t = Inl (q1', q2') \\ t_input t = x\"\n using \\(t_source t, t_input t) \\ set cs\\ by auto\n \n then show \"t \\ ?ts2\"\n using \\t \\ FSM.transitions (canonical_separator M q1 q2)\\ \\t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}\\\n by simp\n qed\n moreover have \"\\ t . t \\ ?ts2 \\ t \\ ?ts1\"\n by force\n ultimately show ?thesis by blast\n qed\n\n show \"transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = \n {t \\ (transitions (canonical_separator M q1 q2)) . \\ q1' q2' x . (Inl (q1',q2'),x) \\ set cs \\ t_source t = Inl (q1',q2') \\ t_input t = x \\ t_target t \\ (set (map fst cs)) \\ {Inr q1, Inr q2}}\"\n unfolding canonical_separator_simps(1,2,3,4)[OF assms(1,2)] \n unfolding state_separator_from_input_choices_def Let_def\n unfolding filter_transitions_simps\n unfolding filter_nodes_simps[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\ ]\n unfolding alt_def_shared by blast\nqed\n\n\nlemma state_separator_from_input_choices_submachine :\n assumes \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n shows \"is_submachine (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) (canonical_separator M q1 q2)\"\nproof -\n have \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\"\n unfolding canonical_separator_simps[OF assms(1,2)]\n using assms(4) by simp\n\n show ?thesis\n unfolding state_separator_from_input_choices_def Let_def\n using submachine_transitive[OF filter_nodes_submachine[of \"(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2})\", OF \\(\\ q . q \\ (set (map fst cs)) \\ {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\\]\n filter_transitions_submachine[of \"filter_nodes (canonical_separator M q1 q2) (\\q. q \\ set (map fst cs) \\ {Inr q1, Inr q2})\" \"(\\t. (t_source t, t_input t) \\ set cs)\"]]\n by assumption\nqed\n\n\nlemma state_separator_from_input_choices_single_input :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n shows \"single_input (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\nproof -\n have \"\\ t1 t2 . t1 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) \\\n t2 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) \\\n t_source t1 = t_source t2 \\ t_input t1 = t_input t2\"\n proof -\n fix t1 t2\n assume \"t1 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n and \"t2 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n and \"t_source t1 = t_source t2\"\n\n obtain q1' q2' where \"(Inl (q1',q2'),t_input t1) \\ set cs\"\n and \"t_source t1 = Inl (q1',q2')\"\n using \\t1 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\\\n using state_separator_from_input_choices_simps(5)[OF assms(2,3,4,5,6)] by fastforce\n\n obtain q1'' q2'' where \"(Inl (q1'',q2''),t_input t2) \\ set cs\"\n and \"t_source t2 = Inl (q1'',q2'')\"\n using \\t2 \\ FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\\\n using state_separator_from_input_choices_simps(5)[OF assms(2,3,4,5,6)] by fastforce\n\n have \"(Inl (q1',q2'),t_input t2) \\ set cs\"\n using \\(Inl (q1'',q2''),t_input t2) \\ set cs\\ \\t_source t1 = Inl (q1',q2')\\ \\t_source t2 = Inl (q1'',q2'')\\ \\t_source t1 = t_source t2\\ \n by simp\n then show \"t_input t1 = t_input t2\"\n using \\(Inl (q1',q2'),t_input t1) \\ set cs\\ \\distinct (map fst cs)\\\n by (meson eq_key_imp_eq_value) \n qed\n then show ?thesis\n by fastforce\nqed\n\n\nlemma state_separator_from_input_choices_transition_list : \n assumes \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"t \\ transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n shows \"(t_source t, t_input t) \\ set cs\"\nusing state_separator_from_input_choices_simps(5)[OF assms(1,2,3,4,5)] assms(6) by auto\n\n\nlemma state_separator_from_input_choices_transition_target :\n assumes \"t \\ transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n shows \"t \\ transitions (canonical_separator M q1 q2) \\ t_target t \\ {Inr q1, Inr q2}\"\n using state_separator_from_input_choices_simps(5)[OF assms(2-6)] assms(1) by fastforce\n\n\nlemma state_separator_from_input_choices_acyclic_paths' :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs \n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n and \"path (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) q' p\"\n and \"target q' p = q'\"\n and \"p \\ []\"\nshows \"False\"\nproof -\n\n let ?S = \"(state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n\n from \\p \\ []\\ obtain p' t' where \"p = t'#p'\"\n using list.exhaust by blast\n then have \"path ?S q' (p@[t'])\" \n using assms(8,9) by fastforce\n\n define f :: \"(('a \\ 'a + 'a) \\ 'b \\ 'c \\ ('a \\ 'a + 'a)) \\ nat\"\n where f_def: \"f = (\\ t . the (find_index (\\ qx . (fst qx) = t_source t \\ snd qx = t_input t) cs))\"\n \n have f_prop: \"\\ t . t \\ set (p@[t']) \\ (f t < length cs) \n \\ (\\(q, x). (q, x)) (cs ! (f t)) = (t_source t,t_input t)\n \\ (\\ j < f t . (fst (cs ! j)) \\ t_source t)\"\n proof -\n fix t assume \"t \\ set (p@[t'])\"\n then have \"t \\ set p\" using \\p = t'#p'\\ by auto\n then have \"t \\ transitions ?S\" \n using assms(8)\n by (meson path_transitions subsetD) \n then have \"(t_source t, t_input t) \\ set cs\"\n using state_separator_from_input_choices_transition_list[OF assms(2,3,4,5,6)]\n by blast \n then have \"\\ qx \\ set cs . (\\ qx . (fst qx) = t_source t \\ snd qx = t_input t) qx\"\n by force\n then have \"find_index (\\ qx . (fst qx) = t_source t \\ snd qx = t_input t) cs \\ None\"\n by (simp add: find_index_exhaustive) \n then obtain i where *: \"find_index (\\ qx . (fst qx) = t_source t \\ snd qx = t_input t) cs = Some i\"\n by auto\n\n have **: \"\\ j . j < i \\ (fst (cs ! j)) = t_source t \\ cs ! i = cs ! j\"\n using assms(1)\n using nth_eq_iff_index_eq find_index_index[OF *]\n by (metis (mono_tags, lifting) Suc_lessD length_map less_trans_Suc nth_map)\n\n have \"f t < length cs\"\n unfolding f_def using find_index_index(1)[OF *] unfolding * by simp\n moreover have \"(\\(q, x). (q, x)) (cs ! (f t)) = (t_source t, t_input t)\"\n unfolding f_def using find_index_index(2)[OF *]\n by (metis \"*\" case_prod_Pair_iden option.sel prod.collapse)\n moreover have \"\\ j < f t . (fst (cs ! j)) \\ t_source t\"\n unfolding f_def using find_index_index(3)[OF *] unfolding * \n using assms(1) **\n by (metis (no_types, lifting) \"*\" \\\\qx\\set cs. fst qx = t_source t \\ snd qx = t_input t\\ eq_key_imp_eq_value find_index_index(1) nth_mem option.sel prod.collapse)\n \n ultimately show \"(f t < length cs)\n \\ (\\(q, x). (q, x)) (cs ! (f t)) = (t_source t,t_input t)\n \\ (\\ j < f t . (fst (cs ! j)) \\ t_source t)\" by simp\n qed\n\n have *: \"\\ i . Suc i < length (p@[t']) \\ f ((p@[t']) ! i) > f ((p@[t']) ! (Suc i))\"\n proof -\n fix i assume \"Suc i < length (p@[t'])\"\n then have \"(p@[t']) ! i \\ set (p@[t'])\" and \"(p@[t']) ! (Suc i) \\ set (p@[t'])\"\n using Suc_lessD nth_mem by blast+\n then have \"(p@[t']) ! i \\ transitions ?S\" and \"(p@[t']) ! Suc i \\ transitions ?S\" \n using \\path ?S q' (p@[t'])\\\n by (meson path_transitions subsetD)+\n then have \"(p @ [t']) ! i \\ FSM.transitions (canonical_separator M q1 q2) \\ t_target ((p @ [t']) ! i) \\ {Inr q1, Inr q2}\" \n using state_separator_from_input_choices_transition_target[OF _ assms(2-6)] by blast\n \n have \"f ((p@[t']) ! i) < length cs\"\n and \"(\\(q, x). (q, x)) (cs ! (f ((p@[t']) ! i))) = (t_source ((p@[t']) ! i), t_input ((p@[t']) ! i))\"\n and \"(\\j t_source ((p@[t']) ! i))\"\n using f_prop[OF \\(p@[t']) ! i \\ set (p@[t'])\\] by auto\n\n have \"f ((p@[t']) ! Suc i) < length cs\"\n and \"(\\(q, x). (q, x)) (cs ! (f ((p@[t']) ! Suc i))) = (t_source ((p@[t']) ! Suc i), t_input ((p@[t']) ! Suc i))\"\n and \"(\\j t_source ((p@[t']) ! Suc i))\"\n using f_prop[OF \\(p@[t']) ! Suc i \\ set (p@[t'])\\] by auto\n\n have \"t_source ((p @ [t']) ! i) = (fst (cs ! f ((p @ [t']) ! i)))\" and \"t_input ((p @ [t']) ! i) = snd (cs ! f ((p @ [t']) ! i))\"\n using f_prop[OF \\(p@[t']) ! i \\ set (p@[t'])\\]\n by (simp add: prod.case_eq_if)+ \n\n have \"t_target ((p@[t']) ! i) = t_source ((p@[t']) ! Suc i)\"\n using \\Suc i < length (p@[t'])\\ \\path ?S q' (p@[t'])\\\n by (simp add: path_source_target_index) \n then have \"t_target ((p@[t']) ! i) \\ {Inr q1, Inr q2}\"\n using state_separator_from_input_choices_transition_list[OF assms(2,3,4,5,6) \\(p@[t']) ! Suc i \\ transitions ?S\\] assms(6) by force\n then have \"t_target ((p @ [t']) ! i) \\ set (map fst (take (f ((p @ [t']) ! i)) cs))\"\n using assms(7)[OF \\f ((p@[t']) ! i) < length cs\\ _ \\t_source ((p @ [t']) ! i) = (fst (cs ! f ((p @ [t']) ! i)))\\ \\t_input ((p @ [t']) ! i) = snd (cs ! f ((p @ [t']) ! i))\\] \n using \\(p @ [t']) ! i \\ FSM.transitions (canonical_separator M q1 q2) \\ t_target ((p @ [t']) ! i) \\ {Inr q1, Inr q2}\\ by blast\n then have \"(\\qx'\\set (take (f ((p@[t']) ! i)) cs). (fst qx') = t_target ((p@[t']) ! i))\" \n by force \n then obtain j where \"(fst (cs ! j)) = t_source ((p@[t']) ! Suc i)\" and \"j < f ((p@[t']) ! i)\" \n unfolding \\t_target ((p@[t']) ! i) = t_source ((p@[t']) ! Suc i)\\\n by (metis (no_types, lifting) \\f ((p@[t']) ! i) < length cs\\ in_set_conv_nth leD length_take min_def_raw nth_take) \n then show \"f ((p@[t']) ! i) > f ((p@[t']) ! (Suc i))\"\n using \\(\\j t_source ((p@[t']) ! Suc i))\\\n using leI le_less_trans by blast \n qed\n\n have \"\\ i j . j < i \\ i < length (p@[t']) \\ f ((p@[t']) ! j) > f ((p@[t']) ! i)\"\n using list_index_fun_gt[of \"p@[t']\" f] * by blast\n then have \"f t' < f t'\"\n unfolding \\p = t'#p'\\ by fastforce \n then show \"False\"\n by auto\nqed\n\n\nlemma state_separator_from_input_choices_acyclic_paths :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs \n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n and \"path (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) q' p\"\nshows \"distinct (visited_nodes q' p)\"\nproof (rule ccontr)\n assume \"\\ distinct (visited_nodes q' p)\"\n \n obtain i j where p1:\"take j (drop i p) \\ []\"\n and p2:\"target (target q' (take i p)) (take j (drop i p)) = (target q' (take i p))\"\n and p3:\"path (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) (target q' (take i p)) (take j (drop i p))\"\n using cycle_from_cyclic_path[OF assms(8) \\\\ distinct (visited_nodes q' p)\\] by blast\n \n show \"False\"\n using state_separator_from_input_choices_acyclic_paths'[OF assms(1-7) p3 p2 p1] by blast\nqed\n\n\nlemma state_separator_from_input_choices_acyclic :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs \n \\ t \\ transitions (canonical_separator M q1 q2)\n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n shows \"acyclic (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n unfolding acyclic.simps using state_separator_from_input_choices_acyclic_paths[OF assms] by blast\n\n\nlemma state_separator_from_input_choices_target :\n assumes \"\\ i t . i < length cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n and \"t \\ FSM.transitions (canonical_separator M q1 q2)\"\n and \"\\ q1' q2' x . (Inl (q1', q2'), x)\\set cs \\ t_source t = Inl (q1', q2') \\ t_input t = x\" \n shows \"t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}\" \nproof -\n from assms(3) obtain q1' q2' x where \"(Inl (q1', q2'), x)\\set cs\" and \"t_source t = Inl (q1', q2')\" and \"t_input t = x\"\n by auto\n then obtain i where \"i < length cs\" and \"t_source t = (fst (cs ! i))\" and \"t_input t = snd (cs ! i)\"\n by (metis fst_conv in_set_conv_nth snd_conv)\n then have \"t_target t \\ set (map fst (take i cs)) \\ {Inr q1, Inr q2}\" using assms(1)[OF _ assms(2)] by blast\n then consider \"t_target t \\ set (map fst (take i cs))\" | \"t_target t \\ {Inr q1, Inr q2}\" by blast\n then show ?thesis proof cases\n case 1 \n then have \"t_target t \\ set (map fst cs)\" \n by (metis in_set_takeD take_map)\n then show ?thesis by blast\n next\n case 2\n then show ?thesis by auto\n qed \nqed\n\n\nlemma state_separator_from_input_choices_transitions_alt_def :\n assumes \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n shows \"transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = \n {t \\ (transitions (canonical_separator M q1 q2)) . \\ q1' q2' x . (Inl (q1',q2'),x) \\ set cs \\ t_source t = Inl (q1',q2') \\ t_input t = x}\"\nproof -\n have \"FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) =\n {t \\ FSM.transitions (canonical_separator M q1 q2).\n \\ q1' q2' x . (Inl (q1', q2'), x)\\set cs \\\n t_source t = Inl (q1', q2') \\\n t_input t = x \\ t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}}\"\n using state_separator_from_input_choices_simps(5)[OF assms(1,2,3,4,5)] by blast\n\n moreover have \"\\ t . t \\ FSM.transitions (canonical_separator M q1 q2) \\ \\ q1' q2' x . (Inl (q1', q2'), x)\\set cs \\ t_source t = Inl (q1', q2') \\ t_input t = x \\ t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}\"\n using state_separator_from_input_choices_target[OF assms(6)] by blast\n\n ultimately show ?thesis \n by fast\nqed\n\n\nlemma state_separator_from_input_choices_deadlock :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n \n shows \"\\ qq . qq \\ nodes (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) \\ deadlock_state (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) qq \\ qq \\ {Inr q1, Inr q2} \\ (\\ q1' q2' x . qq = Inl (q1',q2') \\ x \\ inputs M \\ (h_out M (q1',x) = {} \\ h_out M (q2',x) = {}))\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n let ?S = \"(state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n \n fix qq assume \"qq \\ nodes ?S\" and \"deadlock_state ?S qq\"\n\n then consider (a) \"qq \\ (set (map fst cs))\" | (b) \"qq \\ {Inr q1, Inr q2}\"\n using state_separator_from_input_choices_simps(2)[OF assms(2,3,4,5,6)] by blast\n then show \"qq \\ {Inr q1, Inr q2} \\ (\\ q1' q2' x . qq = Inl (q1',q2') \\ x \\ inputs M \\ (h_out M (q1',x) = {} \\ h_out M (q2',x) = {}))\"\n proof cases\n case a\n then obtain q1' q2' x where \"(Inl (q1',q2'),x) \\ set cs\" and \"qq = Inl (q1',q2')\" using assms(6) by fastforce\n then have \"Inl (q1',q2') \\ nodes (canonical_separator M q1 q2)\" and \"x \\ inputs M\" using assms(4) by blast+\n then have \"(q1', q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\"\n using canonical_separator_simps(2)[OF assms(2,3)] by fastforce\n\n have \"h_out M (q1',x) = {} \\ h_out M (q2',x) = {}\"\n proof (rule ccontr)\n assume \"\\ (h_out M (q1', x) = {} \\ h_out M (q2', x) = {})\"\n then consider (a1) \"\\ y \\ (h_out M (q1', x) \\ h_out M (q2', x)) . True\" | \n (a2) \"\\ y \\ (h_out M (q1', x) - h_out M (q2', x)) . True\" |\n (a3) \"\\ y \\ (h_out M (q2', x) - h_out M (q1', x)) . True\"\n by blast\n then show \"False\" proof cases\n case a1\n then obtain y q1'' q2'' where \"(y,q1'') \\ h M (q1',x)\" and \"(y,q2'') \\ h M (q2',x)\" by auto\n then have \"((q1',q2'),x,y,(q1'',q2'')) \\ transitions (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n unfolding product_transitions_def h.simps using assms(2,3) by auto\n then have \"(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ transitions ?C\" \n using \\(q1', q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\\\n canonical_separator_transitions_def[OF assms(2,3)] by fast\n \n then have \"(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ {t \\ FSM.transitions (canonical_separator M q1 q2).\n \\q1' q2' x . (Inl (q1', q2'), x)\\set cs \\\n t_source t = Inl (q1', q2') \\\n t_input t = x \\ t_target t \\ set (map fst cs) \\ {Inr q1, Inr q2}}\"\n using state_separator_from_input_choices_target[OF assms(7) \\(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ transitions ?C\\]\n using \\(Inl (q1', q2'), x) \\ set cs\\ by force \n\n then have \"(Inl (q1',q2'), x, y, Inl (q1'',q2'')) \\ transitions ?S\" \n using state_separator_from_input_choices_simps(5)[OF assms(2,3,4,5,6)] by fastforce\n then show \"False\" \n using \\deadlock_state ?S qq\\ unfolding \\qq = Inl (q1',q2')\\ by auto\n next\n case a2\n then obtain y where \"y \\ (h_out M (q1', x) - h_out M (q2', x))\" unfolding h_out.simps by blast\n then have \"(\\q'. (q1', x, y, q') \\ FSM.transitions M) \\ (\\q'. (q2', x, y, q') \\ FSM.transitions M)\" unfolding h_out.simps by blast\n then have \"(Inl (q1',q2'), x, y, Inr q1) \\ distinguishing_transitions_left M q1 q2\"\n unfolding distinguishing_transitions_left_def h.simps\n using \\(q1', q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\\ by blast\n then have \"(Inl (q1',q2'), x, y, Inr q1) \\ transitions ?C\"\n unfolding canonical_separator_transitions_def[OF assms(2,3)] by blast\n moreover have \"\\q1'' q2'' x' . (Inl (q1'', q2''), x')\\set cs \\ t_source (Inl (q1',q2'), x, y, Inr q1) = Inl (q1'', q2'') \\ t_input (Inl (q1',q2'), x, y, Inr q1) = x'\"\n using \\(Inl (q1', q2'), x) \\ set cs\\ by auto\n ultimately have \"(Inl (q1',q2'), x, y, Inr q1) \\ transitions ?S\" \n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] by blast\n then show \"False\" \n using \\deadlock_state ?S qq\\ unfolding \\qq = Inl (q1',q2')\\ by auto\n next\n case a3\n then obtain y where \"y \\ (h_out M (q2', x) - h_out M (q1', x))\" unfolding h_out.simps by blast\n then have \"\\(\\q'. (q1', x, y, q') \\ FSM.transitions M) \\ (\\q'. (q2', x, y, q') \\ FSM.transitions M)\" unfolding h_out.simps by blast\n then have \"(Inl (q1',q2'), x, y, Inr q2) \\ distinguishing_transitions_right M q1 q2\"\n unfolding distinguishing_transitions_right_def h.simps\n using \\(q1', q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\\ by blast\n then have \"(Inl (q1',q2'), x, y, Inr q2) \\ transitions ?C\"\n unfolding canonical_separator_transitions_def[OF assms(2,3)] by blast\n moreover have \"\\q1'' q2'' x' . (Inl (q1'', q2''), x')\\set cs \\ t_source (Inl (q1',q2'), x, y, Inr q2) = Inl (q1'', q2'') \\ t_input (Inl (q1',q2'), x, y, Inr q2) = x'\"\n using \\(Inl (q1', q2'), x) \\ set cs\\ by auto\n ultimately have \"(Inl (q1',q2'), x, y, Inr q2) \\ transitions ?S\" \n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] by blast\n then show \"False\" \n using \\deadlock_state ?S qq\\ unfolding \\qq = Inl (q1',q2')\\ by auto\n qed \n qed\n then show ?thesis \n using \\qq = Inl (q1', q2')\\ \\x \\ FSM.inputs M\\ by blast\n next\n case b\n then show ?thesis by simp\n qed\nqed\n\n\nlemma state_separator_from_input_choices_retains_io :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n shows \"retains_outputs_for_states_and_inputs (canonical_separator M q1 q2) (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n unfolding retains_outputs_for_states_and_inputs_def\n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] by fastforce\n\n\nlemma state_separator_from_input_choices_is_state_separator :\n assumes \"distinct (map fst cs)\"\n and \"q1 \\ nodes M\" \n and \"q2 \\ nodes M\"\n and \"\\ qq x . (qq,x) \\ set cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"Inl (q1,q2) \\ set (map fst cs)\"\n and \"\\ qq . qq \\ set (map fst cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (cs ! i))\n \\ t_input t = snd (cs ! i)\n \\ t_target t \\ ((set (map fst (take i cs))) \\ {Inr q1, Inr q2})\"\n and \"completely_specified M\"\n shows \"is_state_separator_from_canonical_separator\n (canonical_separator M q1 q2)\n q1\n q2\n (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\nproof -\n let ?C = \"(canonical_separator M q1 q2)\"\n let ?S = \"(state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n\n have submachine_prop: \"is_submachine ?S ?C\"\n using state_separator_from_input_choices_submachine[OF assms(2,3,4,5,6)] by blast\n\n have single_input_prop: \"single_input ?S\"\n using state_separator_from_input_choices_single_input[OF assms(1,2,3,4,5,6)] by blast\n\n have acyclic_prop : \"acyclic ?S\"\n using state_separator_from_input_choices_acyclic[OF assms(1,2,3,4,5,6,7)] by blast\n\n have i3: \"\\ qq . qq \\ nodes ?S \n \\ deadlock_state ?S qq \n \\ qq \\ {Inr q1, Inr q2} \n \\ (\\ q1' q2' x . qq = Inl (q1',q2') \n \\ x \\ inputs M \n \\ h_out M (q1',x) = {} \n \\ h_out M (q2',x) = {})\"\n using state_separator_from_input_choices_deadlock[OF assms(1,2,3,4,5,6,7)] by blast\n\n have i4: \"retains_outputs_for_states_and_inputs (canonical_separator M q1 q2) (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\"\n using state_separator_from_input_choices_retains_io[OF assms(1,2,3,4,5,6,7)] by blast\n\n\n\n have deadlock_prop_1: \"deadlock_state ?S (Inr q1)\"\n using submachine_deadlock[OF \\is_submachine ?S ?C\\ canonical_separator_deadlock(1)[OF assms(2,3)]] by assumption\n\n have deadlock_prop_2: \"deadlock_state ?S (Inr q2)\"\n using submachine_deadlock[OF \\is_submachine ?S ?C\\ canonical_separator_deadlock(2)[OF assms(2,3)]] by assumption\n\n have non_deadlock_prop': \"\\ qq . qq \\ nodes ?S \\ qq \\ Inr q1 \\ qq \\ Inr q2 \\ (isl qq \\ \\ deadlock_state ?S qq)\"\n proof -\n fix qq assume \"qq \\ nodes ?S\" and \"qq \\ Inr q1\" and \"qq \\ Inr q2\"\n then have \"qq \\ set (map fst cs)\"\n using state_separator_from_input_choices_simps(2)[OF assms(2,3,4,5,6)] by blast\n then obtain q1' q2' x where \"qq = Inl (q1',q2')\" and \"(Inl (q1',q2'),x) \\ set cs\"\n using assms(6) by fastforce\n then have \"(Inl (q1',q2')) \\ nodes (canonical_separator M q1 q2)\" and \"x \\ inputs M\"\n using assms(4) by blast+\n then have \"(q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\"\n using canonical_separator_simps(2)[OF assms(2,3)] by fastforce\n then have \"(q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\"\n using reachable_node_is_node by fastforce\n then have \"q1' \\ nodes M\" and \"q2' \\ nodes M\"\n using assms(2,3) by auto\n\n obtain y q1'' where \"(y,q1'') \\ h M (q1',x)\"\n using \\completely_specified M\\ \\q1' \\ nodes M\\ \\x \\ inputs M\\\n unfolding completely_specified.simps h.simps by fastforce \n\n consider (a) \"y \\ h_out M (q2',x)\" | (b) \"y \\ h_out M (q2',x)\" by blast\n then have \"\\ deadlock_state ?S (Inl (q1',q2'))\"\n proof cases\n case a \n then obtain q2'' where \"(y,q2'') \\ h M (q2',x)\" by auto\n then have \"((q1',q2'),x,y,(q1'',q2'')) \\ transitions (product (from_FSM M q1) (from_FSM M q2))\"\n using assms(2,3) \\(y,q1'') \\ h M (q1',x)\\\n unfolding h.simps product_transitions_def by fastforce\n then have \"(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ transitions ?C\"\n using canonical_separator_transitions_def[OF assms(2,3)]\n using \\(q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\\ by fast\n then have \"(Inl (q1',q2'),x,y,Inl (q1'',q2'')) \\ transitions ?S\"\n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] \n \\(Inl (q1',q2'),x) \\ set cs\\ by fastforce\n then show ?thesis \n unfolding deadlock_state.simps by fastforce\n next\n case b\n then have \"(Inl (q1',q2'),x,y,Inr q1) \\ distinguishing_transitions_left M q1 q2\"\n using \\(y,q1'') \\ h M (q1',x)\\ \\(q1',q2') \\ nodes (product (from_FSM M q1) (from_FSM M q2))\\ \n unfolding h.simps h_out.simps distinguishing_transitions_left_def \n by blast \n then have \"(Inl (q1',q2'),x,y,Inr q1) \\ transitions ?C\"\n unfolding canonical_separator_transitions_def[OF assms(2,3)] by blast\n then have \"(Inl (q1',q2'),x,y,Inr q1) \\ transitions ?S\"\n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] \n \\(Inl (q1',q2'),x) \\ set cs\\ by fastforce\n then show ?thesis \n unfolding deadlock_state.simps by fastforce\n qed\n then show \"(isl qq \\ \\ deadlock_state ?S qq)\"\n unfolding \\qq = Inl (q1',q2')\\ by simp\n qed\n then have non_deadlock_prop: \"(\\ q \\ reachable_nodes ?S . (q \\ Inr q1 \\ q \\ Inr q2) \\ (isl q \\ \\ deadlock_state ?S q))\"\n using reachable_node_is_node by force\n \n\n (* Idea for reachable-deadlock proofs:\n - get longest path from initial to some non-deadlock state\n - that state can only target deadlock states\n - by assm, both Inr q1 and Inr q2 must be reached from that state\n *)\n define ndlps where ndlps_def: \"ndlps = {p . path ?S (initial ?S) p \\ isl (target (initial ?S) p)}\"\n \n\n obtain qdl where \"qdl \\ reachable_nodes ?S\" and \"deadlock_state ?S qdl\"\n using acyclic_deadlock_reachable[OF \\acyclic ?S\\] by blast\n \n have \"qdl = Inr q1 \\ qdl = Inr q2\"\n using non_deadlock_prop'[OF reachable_node_is_node[OF \\qdl \\ reachable_nodes ?S\\]] \\deadlock_state ?S qdl\\ by fastforce\n then have \"Inr q1 \\ reachable_nodes ?S \\ Inr q2 \\ reachable_nodes ?S\"\n using \\qdl \\ reachable_nodes ?S\\ by blast\n\n have \"isl (target (initial ?S) [])\"\n using state_separator_from_input_choices_simps(1)[OF assms(2,3,4,5,6)] by auto\n then have \"[] \\ ndlps\"\n unfolding ndlps_def by auto\n then have \"ndlps \\ {}\"\n by blast\n moreover have \"finite ndlps\"\n using acyclic_finite_paths_from_reachable_node[OF \\acyclic ?S\\, of \"[]\"] unfolding ndlps_def by fastforce\n ultimately have \"\\ p \\ ndlps . \\ p' \\ ndlps . length p' \\ length p\"\n by (meson max_length_elem not_le_imp_less) \n then obtain mndlp where \"path ?S (initial ?S) mndlp\"\n and \"isl (target (initial ?S) mndlp)\"\n and \"\\ p . path ?S (initial ?S) p \\ isl (target (initial ?S) p) \\ length p \\ length mndlp\"\n unfolding ndlps_def by blast\n then have \"(target (initial ?S) mndlp) \\ reachable_nodes ?S\"\n unfolding reachable_nodes_def by auto\n then have \"(target (initial ?S) mndlp) \\ nodes ?S\"\n using reachable_node_is_node by auto\n then have \"(target (initial ?S) mndlp) \\ (set (map fst cs))\"\n using \\isl (target (initial ?S) mndlp)\\ state_separator_from_input_choices_simps(2)[OF assms(2,3,4,5,6)] by force\n then obtain q1' q2' x where \"(Inl (q1',q2'),x) \\ set cs\"\n and \"target (initial ?S) mndlp = Inl (q1',q2')\"\n using assms(6) by fastforce\n then obtain i where \"i < length cs\" and \"(cs ! i) = (Inl (q1',q2'),x)\"\n by (metis in_set_conv_nth)\n\n have \"Inl (q1', q2') \\ FSM.nodes (canonical_separator M q1 q2)\" and \"x \\ FSM.inputs M\"\n using assms(4)[OF \\(Inl (q1',q2'),x) \\ set cs\\] by blast+\n then have \"(q1',q2') \\ nodes (Product_FSM.product (FSM.from_FSM M q1) (FSM.from_FSM M q2))\"\n using canonical_separator_simps(2)[OF assms(2,3)] by blast\n\n have \"q1' \\ nodes M\" and \"q2' \\ nodes M\"\n using canonical_separator_nodes[OF \\Inl (q1', q2') \\ FSM.nodes (canonical_separator M q1 q2)\\ assms(2,3)]\n unfolding product_simps using assms(2,3) by simp+\n\n have \"\\(\\t'\\FSM.transitions (canonical_separator M q1 q2). t_source t' = target (initial ?S) mndlp \\ t_input t' = x \\ isl (t_target t'))\"\n proof \n assume \"\\t'\\FSM.transitions (canonical_separator M q1 q2). t_source t' = target (initial ?S) mndlp \\ t_input t' = x \\ isl (t_target t')\"\n then obtain t' where \"t'\\FSM.transitions (canonical_separator M q1 q2)\"\n and \"t_source t' = target (initial ?S) mndlp\"\n and \"t_input t' = x\"\n and \"isl (t_target t')\" \n by blast\n then have \"\\q1' q2' x . (Inl (q1', q2'), x)\\set cs \\ t_source t' = Inl (q1', q2') \\ t_input t' = x\"\n using \\(Inl (q1',q2'),x) \\ set cs\\ unfolding \\target (initial ?S) mndlp = Inl (q1',q2')\\ by fast\n then have \"t' \\ transitions ?S\"\n using \\t'\\FSM.transitions (canonical_separator M q1 q2)\\ \\(Inl (q1',q2'),x) \\ set cs\\\n using state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] by blast\n\n then have \"path ?S (initial ?S) (mndlp @ [t'])\"\n using \\path ?S (initial ?S) mndlp\\ \\t_source t' = target (initial ?S) mndlp\\ by (metis path_append_transition)\n moreover have \"isl (target (initial ?S) (mndlp @[t']))\"\n using \\isl (t_target t')\\ by auto\n ultimately show \"False\"\n using \\\\ p . path ?S (initial ?S) p \\ isl (target (initial ?S) p) \\ length p \\ length mndlp\\[of \"mndlp@[t']\"] by auto\n qed\n\n then obtain y1 y2 where \"(Inl (q1',q2'),x,y1,Inr q1) \\ transitions (canonical_separator M q1 q2)\"\n and \"(Inl (q1',q2'),x,y2,Inr q2) \\ transitions (canonical_separator M q1 q2)\"\n using canonical_separator_isl_deadlock[OF \\Inl (q1', q2') \\ FSM.nodes (canonical_separator M q1 q2)\\ \\x \\ FSM.inputs M\\ \\completely_specified M\\ _ assms(2,3)]\n unfolding \\target (initial ?S) mndlp = Inl (q1',q2')\\ by blast\n\n\n have \"(Inl (q1',q2'), x, y1, Inr q1) \\ transitions ?S\"\n using \\(Inl (q1',q2'),x) \\ set cs\\ state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] \\(Inl (q1',q2'),x,y1,Inr q1) \\ transitions (canonical_separator M q1 q2)\\ by force\n\n have \"(Inl (q1',q2'), x, y2, Inr q2) \\ transitions ?S\"\n using \\(Inl (q1',q2'),x) \\ set cs\\ state_separator_from_input_choices_transitions_alt_def[OF assms(2,3,4,5,6,7)] \\(Inl (q1',q2'),x,y2,Inr q2) \\ transitions (canonical_separator M q1 q2)\\ by force\n\n have \"path ?S (initial ?S) (mndlp@[(Inl (q1',q2'), x, y1, Inr q1)])\"\n using \\target (initial ?S) mndlp = Inl (q1',q2')\\ \n using path_append_transition[OF \\path ?S (initial ?S) mndlp\\ \\(Inl (q1',q2'), x, y1, Inr q1) \\ transitions ?S\\] by force\n moreover have \"target (initial ?S) (mndlp@[(Inl (q1',q2'), x, y1, Inr q1)]) = Inr q1\"\n by auto\n ultimately have reachable_prop_1: \"Inr q1 \\ reachable_nodes ?S\"\n using reachable_nodes_intro by metis\n\n have \"path ?S (initial ?S) (mndlp@[(Inl (q1',q2'), x, y2, Inr q2)])\"\n using \\target (initial ?S) mndlp = Inl (q1',q2')\\ \n using path_append_transition[OF \\path ?S (initial ?S) mndlp\\ \\(Inl (q1',q2'), x, y2, Inr q2) \\ transitions ?S\\] by force\n moreover have \"target (initial ?S) (mndlp@[(Inl (q1',q2'), x, y2, Inr q2)]) = Inr q2\"\n by auto\n ultimately have reachable_prop_2: \"Inr q2 \\ reachable_nodes ?S\"\n using reachable_nodes_intro by metis\n\n\n have retainment_prop : \"\\ q x t' . q \\ reachable_nodes ?S\n \\ x \\ FSM.inputs ?C \n \\ (\\t\\FSM.transitions ?S. t_source t = q \\ t_input t = x) \n \\ t' \\ FSM.transitions ?C\n \\ t_source t' = q \n \\ t_input t' = x \n \\ t' \\ FSM.transitions ?S\"\n proof -\n fix q x t' assume \"q \\ reachable_nodes ?S\"\n and \"x \\ FSM.inputs ?C\"\n and \"(\\t\\FSM.transitions ?S. t_source t = q \\ t_input t = x)\"\n and \"t' \\ FSM.transitions ?C\"\n and \"t_source t' = q\" \n and \"t_input t' = x\" \n\n obtain t where \"t \\ FSM.transitions ?S\" and \"t_source t = q\" and \"t_input t = x\"\n using \\(\\t\\FSM.transitions ?S. t_source t = q \\ t_input t = x)\\ by blast\n then have \"t_source t = t_source t' \\ t_input t = t_input t'\"\n using \\t_source t' = q\\ \\t_input t' = x\\ by auto\n\n \n show \"t' \\ FSM.transitions ?S\"\n using i4 unfolding retains_outputs_for_states_and_inputs_def\n using \\t \\ FSM.transitions ?S\\ \\t' \\ FSM.transitions ?C\\ \\t_source t = t_source t' \\ t_input t = t_input t'\\ \n by blast\n qed\n \n show ?thesis unfolding is_state_separator_from_canonical_separator_def\n using submachine_prop\n single_input_prop\n acyclic_prop\n deadlock_prop_1\n deadlock_prop_2\n reachable_prop_1\n reachable_prop_2\n non_deadlock_prop\n retainment_prop by blast \nqed\n \n \n\nsubsubsection \\Calculating a State Separator by Backwards Reachability Analysis\\\n\ntext \\A state separator for states @{text \"q1\"} and @{text \"q2\"} can be calculated using backwards \n reachability analysis starting from the two deadlock states of their canonical separator until\n @{text \"Inl (q1.q2)\"} is reached or it is not possible to reach @{text \"(q1,q2)\"}.\\\n\ndefinition s_states :: \"('a::linorder,'b::linorder,'c) fsm \\ 'a \\ 'a \\ ((('a \\ 'a) + 'a) \\ 'b) list\" where\n \"s_states M q1 q2 = (let C = canonical_separator M q1 q2\n in select_inputs (h C) (initial C) (inputs_as_list C) (remove1 (Inl (q1,q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list C)))) {Inr q1, Inr q2} [])\"\n\n\ndefinition state_separator_from_s_states :: \"('a::linorder,'b::linorder,'c) fsm \\ 'a \\ 'a \\ (('a \\ 'a) + 'a, 'b, 'c) fsm option\" \n where\n \"state_separator_from_s_states M q1 q2 = \n (let cs = s_states M q1 q2 \n in (case length cs of\n 0 \\ None |\n _ \\ if fst (last cs) = Inl (q1,q2)\n then Some (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)\n else None))\"\n\n\nlemma state_separator_from_s_states_code[code] :\n \"state_separator_from_s_states M q1 q2 =\n (let C = canonical_separator M q1 q2;\n cs = select_inputs (h C) (initial C) (inputs_as_list C) (remove1 (Inl (q1,q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list C)))) {Inr q1, Inr q2} []\n in (case length cs of\n 0 \\ None |\n _ \\ if fst (last cs) = Inl (q1,q2)\n then Some (state_separator_from_input_choices M C q1 q2 cs) \n else None))\"\n unfolding s_states_def state_separator_from_s_states_def Let_def by simp\n\n\nlemma s_states_properties : \n assumes \"q1 \\ nodes M\" and \"q2 \\ nodes M\" \n shows \"distinct (map fst (s_states M q1 q2))\"\n and \"\\ qq x . (qq,x) \\ set (s_states M q1 q2) \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n and \"\\ qq . qq \\ set (map fst (s_states M q1 q2)) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n and \"\\ i t . i < length (s_states M q1 q2)\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst ((s_states M q1 q2) ! i))\n \\ t_input t = snd ((s_states M q1 q2) ! i)\n \\ t_target t \\ ((set (map fst (take i (s_states M q1 q2)))) \\ {Inr q1, Inr q2})\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n let ?nS = \"{Inr q1, Inr q2}\"\n let ?nL = \"(remove1 (Inl (q1,q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list ?C))))\"\n let ?iL = \"(inputs_as_list ?C)\"\n let ?q0 = \"(initial ?C)\"\n let ?f = \"(h ?C)\"\n let ?k = \"(size (canonical_separator M q1 q2))\"\n\n let ?cs = \"(s_states M q1 q2)\"\n \n (* parameter properties required by lemmata for select_inputs *)\n have pp1: \"distinct (map fst [])\" by auto\n have pp2: \"set (map fst []) \\ ?nS\" by auto\n have pp3: \"?nS = ?nS \\ set (map fst [])\" by auto\n have pp4: \"?q0 \\ ?nS\" unfolding canonical_separator_simps[OF assms] by auto\n have pp5 :\"distinct ?nL\" using nodes_as_list_distinct by simp \n have pp6: \"?q0 \\ set ?nL\" unfolding canonical_separator_simps[OF assms] by auto\n have pp7: \"set ?nL \\ ?nS = {}\" by auto\n\n (* index based properties *)\n\n have \"\\ i . length [] \\ i\" by auto\n\n have ip1: \"\\ i . i < length ?cs \\ fst (?cs ! i) \\ (insert ?q0 (set ?nL))\" \n and ip2: \"\\ i . i < length ?cs \\ fst (?cs ! i) \\ ?nS0\"\n and ip3: \"\\ i . i < length ?cs \\ snd (?cs ! i) \\ set ?iL\"\n and ip4: \"\\ i . i < length ?cs \\ (\\ qx' \\ set (take i ?cs) . fst (?cs ! i) \\ fst qx')\"\n using select_inputs_index_properties[OF _ \\\\ i . length [] \\ i\\ pp1 pp3 pp4 pp5 pp6 pp7]\n unfolding s_states_def Let_def by blast+\n have ip5: \"\\ i . i < length ?cs \\ (\\ t \\ transitions ?C . t_source t = fst (?cs ! i) \\ t_input t = snd (?cs ! i))\"\n using select_inputs_index_properties(5)[OF _ \\\\ i . length [] \\ i\\ pp1 pp3 pp4 pp5 pp6 pp7]\n unfolding s_states_def Let_def by blast\n have ip6: \"\\ i t . i < length ?cs \\ t \\ transitions ?C \\ t_source t = fst (?cs ! i) \\ t_input t = snd (?cs ! i) \\ (t_target t \\ ?nS0 \\ (\\ qx' \\ set (take i ?cs) . fst qx' = (t_target t)))\"\n using select_inputs_index_properties(6)[OF _ \\\\ i . length [] \\ i\\ pp1 pp3 pp4 pp5 pp6 pp7]\n unfolding s_states_def Let_def by blast\n\n\n show \"distinct (map fst ?cs)\" \n using select_inputs_distinct[OF pp1 pp2 pp4 pp5 pp6 pp7]\n unfolding s_states_def Let_def by blast\n\n show \"\\ qq x . (qq,x) \\ set ?cs \\ qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n proof -\n fix qq x assume \"(qq,x) \\ set ?cs\"\n then obtain i where \"i < length ?cs\" and \"?cs ! i = (qq,x)\"\n by (meson in_set_conv_nth) \n show \"qq \\ nodes (canonical_separator M q1 q2) \\ x \\ inputs M\"\n using ip1[OF \\i < length ?cs\\] ip3[OF \\i < length ?cs\\] \n nodes_as_list_set[of ?C] inputs_as_list_set[of ?C]\n unfolding \\?cs ! i = (qq,x)\\ fst_conv snd_conv canonical_separator_simps(3)[OF assms]\n by auto \n qed\n\n show \"\\ qq . qq \\ set (map fst ?cs) \\ \\ q1' q2' . qq = Inl (q1',q2')\"\n proof -\n fix qq assume \"qq \\ set (map fst ?cs)\"\n then obtain i where \"i < length ?cs\" and \"fst (?cs ! i) = qq\"\n by (metis (no_types, lifting) in_set_conv_nth length_map nth_map)\n show \"\\ q1' q2' . qq = Inl (q1',q2')\"\n using ip1[OF \\i < length ?cs\\] nodes_as_list_set[of ?C]\n unfolding \\fst (?cs ! i) = qq\\ canonical_separator_simps[OF assms]\n by auto \n qed\n\n show \"\\ i t . i < length ?cs\n \\ t \\ transitions (canonical_separator M q1 q2) \n \\ t_source t = (fst (?cs ! i))\n \\ t_input t = snd (?cs ! i)\n \\ t_target t \\ ((set (map fst (take i ?cs))) \\ {Inr q1, Inr q2})\"\n proof -\n fix i t assume \"i < length ?cs\"\n and \"t \\ transitions ?C\"\n and \"t_source t = (fst (?cs ! i))\"\n and \"t_input t = snd (?cs ! i)\"\n\n show \"t_target t \\ ((set (map fst (take i ?cs))) \\ {Inr q1, Inr q2})\"\n using ip6[OF \\i < length ?cs\\ \\t \\ transitions ?C\\ \\t_source t = (fst (?cs ! i))\\ \\t_input t = snd (?cs ! i)\\] \n by (metis Un_iff in_set_conv_nth length_map nth_map)\n qed\nqed\n\n \nlemma state_separator_from_s_states_soundness :\n assumes \"state_separator_from_s_states M q1 q2 = Some A\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"completely_specified M\"\n shows \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\nproof -\n let ?cs = \"s_states M q1 q2\"\n\n have \"length (s_states M q1 q2) \\ 0 \\ fst (last (s_states M q1 q2)) = Inl (q1,q2)\"\n and \"A = state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 ?cs\"\n using assms(1) unfolding state_separator_from_s_states_def Let_def\n by (cases \"length (s_states M q1 q2)\"; cases \"fst (last (s_states M q1 q2)) = Inl (q1,q2)\"; auto)+\n then have \"Inl (q1,q2) \\ set (map fst ?cs)\"\n by (metis last_in_set length_0_conv map_set)\n \n\n show ?thesis \n using state_separator_from_input_choices_is_state_separator[\n OF _ assms(2,3) _ \\Inl (q1,q2) \\ set (map fst ?cs)\\,\n OF s_states_properties[OF assms(2,3)] assms(4)] \n unfolding \\A = state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 ?cs\\[symmetric] by blast\nqed\n \n\nlemma state_separator_from_s_states_exhaustiveness :\n assumes \"\\ S . is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 S\"\n and \"q1 \\ nodes M\" and \"q2 \\ nodes M\" and \"completely_specified M\" and \"observable M\"\n shows \"state_separator_from_s_states M q1 q2 \\ None\"\nproof -\n let ?CSep = \"(canonical_separator M q1 q2)\"\n\n obtain S where S_def: \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 S\"\n using assms(1) by blast\n\n then have \"is_submachine S ?CSep\" \n and \"single_input S\"\n and \"acyclic S\"\n and *:\"\\ q . q \\ reachable_nodes S \\ q \\ Inr q1 \\ q \\ Inr q2 \\ (isl q \\ \\ deadlock_state S q)\"\n and **:\"\\ q x t . q \\ reachable_nodes S \\ x \\ (inputs ?CSep) \\ (\\ t \\ transitions S . t_source t = q \\ t_input t = x) \\ t \\ transitions ?CSep \\ t_source t = q \\ t_input t = x \\ t \\ transitions S\"\n using assms unfolding is_state_separator_from_canonical_separator_def by blast+\n\n have p1: \"(\\q x. q \\ reachable_nodes S \\ h S (q, x) \\ {} \\ h S (q, x) = h ?CSep (q, x))\"\n proof - \n fix q x assume \"q \\ reachable_nodes S\" and \"h S (q, x) \\ {}\"\n\n then have \"x \\ inputs ?CSep\"\n using \\is_submachine S ?CSep\\ fsm_transition_input by force\n have \"(\\ t \\ transitions S . t_source t = q \\ t_input t = x)\"\n using \\h S (q, x) \\ {}\\ by fastforce\n\n have \"\\ y q'' . (y,q'') \\ h S (q,x) \\ (y,q'') \\ h ?CSep (q,x)\" \n using \\is_submachine S ?CSep\\ by force \n moreover have \"\\ y q'' . (y,q'') \\ h ?CSep (q,x) \\ (y,q'') \\ h S (q,x)\" \n using **[OF \\q \\ reachable_nodes S\\ \\x \\ inputs ?CSep\\ \\(\\ t \\ transitions S . t_source t = q \\ t_input t = x)\\]\n unfolding h.simps by force\n ultimately show \"h S (q, x) = h ?CSep (q, x)\" \n by force\n qed \n\n have p2: \"\\q'. q' \\ reachable_nodes S \\ deadlock_state S q' \\ q' \\ {Inr q1, Inr q2} \\ set (map fst [])\"\n using * by fast\n\n have \"initial S = Inl (q1,q2)\"\n using is_state_separator_from_canonical_separator_initial[OF S_def assms(2,3)] by assumption\n \n have ***: \"(set (remove1 (Inl (q1, q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list ?CSep)))) \\ {Inr q1, Inr q2} \\ set (map fst [])) = (nodes ?CSep - {Inl (q1,q2)})\"\n using nodes_as_list_set[of ?CSep] nodes_as_list_distinct[of ?CSep] \n unfolding \n \\initial S = Inl (q1,q2)\\ \n canonical_separator_simps(2)[OF assms(2,3)]\n by auto \n\n have \"Inl (q1,q2) \\ reachable_nodes ?CSep\"\n using reachable_nodes_initial[of S] unfolding \\initial S = Inl (q1,q2)\\\n using submachine_reachable_subset[OF \\is_submachine S ?CSep\\] by blast\n then have p3: \"nodes ?CSep = insert (FSM.initial S) (set (remove1 (Inl (q1,q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list ?CSep)))) \\ {Inr q1, Inr q2} \\ set (map fst []))\"\n unfolding *** \\initial S = Inl (q1,q2)\\\n using reachable_node_is_node by fastforce\n \n have p4: \"initial S \\ (set (remove1 (Inl (q1,q2)) (remove1 (Inr q1) (remove1 (Inr q2) (nodes_as_list ?CSep)))) \\ {Inr q1, Inr q2} \\ set (map fst []))\"\n using \\FSM.initial S = Inl (q1, q2)\\ by auto \n\n have \"fst (last (s_states M q1 q2)) = Inl (q1,q2)\" and \"length (s_states M q1 q2) > 0\"\n using select_inputs_from_submachine[OF \\single_input S\\ \\acyclic S\\ \\is_submachine S ?CSep\\ p1 p2 p3 p4]\n unfolding s_states_def submachine_simps[OF \\is_submachine S ?CSep\\] Let_def canonical_separator_simps(1)[OF assms(2,3)]\n by auto \n\n obtain k where\"length (s_states M q1 q2) = Suc k\" \n using \\length (s_states M q1 q2) > 0\\ gr0_conv_Suc by blast \n have \"(fst (last (s_states M q1 q2)) = Inl (q1,q2)) = True\"\n using \\fst (last (s_states M q1 q2)) = Inl (q1,q2)\\ by simp\n\n show ?thesis \n unfolding state_separator_from_s_states_def Let_def \\length (s_states M q1 q2) = Suc k\\ \\fst (last (s_states M q1 q2)) = Inl (q1,q2)\\\n by auto\nqed\n\n\n\nsubsection \\Generalizing State Separators\\\n\ntext \\State separators can be defined without reverence to the canonical separator:\\\n\ndefinition is_separator :: \"('a,'b,'c) fsm \\ 'a \\ 'a \\ ('d,'b,'c) fsm \\ 'd \\ 'd \\ bool\" where\n \"is_separator M q1 q2 A t1 t2 = \n (single_input A\n \\ acyclic A\n \\ observable A\n \\ deadlock_state A t1 \n \\ deadlock_state A t2\n \\ t1 \\ reachable_nodes A\n \\ t2 \\ reachable_nodes A\n \\ (\\ t \\ reachable_nodes A . (t \\ t1 \\ t \\ t2) \\ \\ deadlock_state A t)\n \\ (\\ io \\ L A . (\\ x yq yt . (io@[(x,yq)] \\ LS M q1 \\ io@[(x,yt)] \\ L A) \\ (io@[(x,yq)] \\ L A))\n \\ (\\ x yq2 yt . (io@[(x,yq2)] \\ LS M q2 \\ io@[(x,yt)] \\ L A) \\ (io@[(x,yq2)] \\ L A)))\n \\ (\\ p . (path A (initial A) p \\ target (initial A) p = t1) \\ p_io p \\ LS M q1 - LS M q2)\n \\ (\\ p . (path A (initial A) p \\ target (initial A) p = t2) \\ p_io p \\ LS M q2 - LS M q1)\n \\ (\\ p . (path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2) \\ p_io p \\ LS M q1 \\ LS M q2)\n \\ q1 \\ q2\n \\ t1 \\ t2\n \\ (inputs A) \\ (inputs M))\"\n\n\nlemma is_separator_simps :\n assumes \"is_separator M q1 q2 A t1 t2\"\nshows \"single_input A\"\n and \"acyclic A\"\n and \"observable A\"\n and \"deadlock_state A t1\"\n and \"deadlock_state A t2\"\n and \"t1 \\ reachable_nodes A\"\n and \"t2 \\ reachable_nodes A\"\n and \"\\ t . t \\ reachable_nodes A \\ t \\ t1 \\ t \\ t2 \\ \\ deadlock_state A t\"\n and \"\\ io x yq yt . io@[(x,yq)] \\ LS M q1 \\ io@[(x,yt)] \\ L A \\ (io@[(x,yq)] \\ L A)\"\n and \"\\ io x yq yt . io@[(x,yq)] \\ LS M q2 \\ io@[(x,yt)] \\ L A \\ (io@[(x,yq)] \\ L A)\"\n and \"\\ p . path A (initial A) p \\ target (initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\"\n and \"\\ p . path A (initial A) p \\ target (initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\"\n and \"\\ p . path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2 \\ p_io p \\ LS M q1 \\ LS M q2\"\n and \"q1 \\ q2\"\n and \"t1 \\ t2\"\n and \"(inputs A) \\ (inputs M)\"\nproof -\n have p01: \"single_input A\"\n and p02: \"acyclic A\"\n and p03: \"observable A\"\n and p04: \"deadlock_state A t1\" \n and p05: \"deadlock_state A t2\"\n and p06: \"t1 \\ reachable_nodes A\"\n and p07: \"t2 \\ reachable_nodes A\"\n and p08: \"(\\ t \\ reachable_nodes A . (t \\ t1 \\ t \\ t2) \\ \\ deadlock_state A t)\"\n and p09: \"(\\ io \\ L A . (\\ x yq yt . (io@[(x,yq)] \\ LS M q1 \\ io@[(x,yt)] \\ L A) \\ (io@[(x,yq)] \\ L A))\n \\ (\\ x yq2 yt . (io@[(x,yq2)] \\ LS M q2 \\ io@[(x,yt)] \\ L A) \\ (io@[(x,yq2)] \\ L A)))\"\n and p10: \"(\\ p . (path A (initial A) p \\ target (initial A) p = t1) \\ p_io p \\ LS M q1 - LS M q2)\"\n and p11: \"(\\ p . (path A (initial A) p \\ target (initial A) p = t2) \\ p_io p \\ LS M q2 - LS M q1)\"\n and p12: \"(\\ p . (path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2) \\ p_io p \\ LS M q1 \\ LS M q2)\"\n and p13: \"q1 \\ q2\"\n and p14: \"t1 \\ t2\"\n and p15: \"(inputs A) \\ (inputs M)\"\n using assms unfolding is_separator_def by presburger+\n\n show \"single_input A\" using p01 by assumption\n show \"acyclic A\" using p02 by assumption\n show \"observable A\" using p03 by assumption\n show \"deadlock_state A t1\" using p04 by assumption\n show \"deadlock_state A t2\" using p05 by assumption\n show \"t1 \\ reachable_nodes A\" using p06 by assumption\n show \"t2 \\ reachable_nodes A\" using p07 by assumption\n show \"\\ io x yq yt . io@[(x,yq)] \\ LS M q1 \\ io@[(x,yt)] \\ L A \\ (io@[(x,yq)] \\ L A)\" using p09 language_prefix[of _ _ A \"initial A\"] by blast\n show \"\\ io x yq yt . io@[(x,yq)] \\ LS M q2 \\ io@[(x,yt)] \\ L A \\ (io@[(x,yq)] \\ L A)\" using p09 language_prefix[of _ _ A \"initial A\"] by blast\n show \"\\ t . t \\ reachable_nodes A \\ t \\ t1 \\ t \\ t2 \\ \\ deadlock_state A t\" using p08 by blast\n show \"\\ p . path A (initial A) p \\ target (initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\" using p10 by blast\n show \"\\ p . path A (initial A) p \\ target (initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\" using p11 by blast\n show \"\\ p . path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2 \\ p_io p \\ LS M q1 \\ LS M q2\" using p12 by blast\n show \"q1 \\ q2\" using p13 by assumption\n show \"t1 \\ t2\" using p14 by assumption\n show \"(inputs A) \\ (inputs M)\" using p15 by assumption\nqed\n\n\nlemma separator_initial :\n assumes \"is_separator M q1 q2 A t1 t2\"\nshows \"initial A \\ t1\"\nand \"initial A \\ t2\"\nproof -\n show \"initial A \\ t1\"\n proof \n assume \"initial A = t1\"\n then have \"deadlock_state A (initial A)\"\n using is_separator_simps(4)[OF assms] by auto\n then have \"reachable_nodes A = {initial A}\" \n using nodes_initial_deadlock by blast\n then show \"False\"\n using is_separator_simps(7,15)[OF assms] \\initial A = t1\\ by auto\n qed\n\n show \"initial A \\ t2\"\n proof \n assume \"initial A = t2\"\n then have \"deadlock_state A (initial A)\"\n using is_separator_simps(5)[OF assms] by auto\n then have \"reachable_nodes A = {initial A}\" \n using nodes_initial_deadlock by blast\n then show \"False\"\n using is_separator_simps(6,15)[OF assms] \\initial A = t2\\ by auto\n qed\nqed\n\n\nlemma separator_path_targets :\n assumes \"is_separator M q1 q2 A t1 t2\"\n and \"path A (initial A) p\"\nshows \"p_io p \\ LS M q1 - LS M q2 \\ target (initial A) p = t1\"\nand \"p_io p \\ LS M q2 - LS M q1 \\ target (initial A) p = t2\"\nand \"p_io p \\ LS M q1 \\ LS M q2 \\ (target (initial A) p \\ t1 \\ target (initial A) p \\ t2)\"\nand \"p_io p \\ LS M q1 \\ LS M q2\"\nproof -\n have pt1: \"\\ p . path A (initial A) p \\ target (initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\" \n and pt2: \"\\ p . path A (initial A) p \\ target (initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\" \n and pt3: \"\\ p . path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2 \\ p_io p \\ LS M q1 \\ LS M q2\" \n and \"t1 \\ t2\"\n and \"observable A\"\n using is_separator_simps[OF assms(1)] by blast+\n\n show \"p_io p \\ LS M q1 - LS M q2 \\ target (initial A) p = t1\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\ by blast\n show \"p_io p \\ LS M q2 - LS M q1 \\ target (initial A) p = t2\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\ by blast\n show \"p_io p \\ LS M q1 \\ LS M q2 \\ (target (initial A) p \\ t1 \\ target (initial A) p \\ t2)\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\ by blast\n show \"p_io p \\ LS M q1 \\ LS M q2\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\ by blast\nqed\n\n\nlemma separator_language :\n assumes \"is_separator M q1 q2 A t1 t2\"\n and \"io \\ L A\"\nshows \"io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {t1}\"\nand \"io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {t2}\"\nand \"io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {t1,t2} = {}\"\nand \"io \\ LS M q1 \\ LS M q2\"\nproof -\n\n obtain p where \"path A (initial A) p\" and \"p_io p = io\"\n using \\io \\ L A\\ by auto\n\n have pt1: \"\\ p . path A (initial A) p \\ target (initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\" \n and pt2: \"\\ p . path A (initial A) p \\ target (initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\" \n and pt3: \"\\ p . path A (initial A) p \\ target (initial A) p \\ t1 \\ target (initial A) p \\ t2 \\ p_io p \\ LS M q1 \\ LS M q2\" \n and \"t1 \\ t2\"\n and \"observable A\"\n using is_separator_simps[OF assms(1)] by blast+\n\n\n show \"io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {t1}\"\n proof -\n assume \"io \\ LS M q1 - LS M q2\"\n \n then have \"p_io p \\ LS M q1 - LS M q2\"\n using \\p_io p = io\\ by auto\n then have \"target (initial A) p = t1\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\\n by blast \n then have \"t1 \\ io_targets A io (initial A)\"\n using \\path A (initial A) p\\ \\p_io p = io\\ unfolding io_targets.simps by force\n then show \"io_targets A io (initial A) = {t1}\"\n using observable_io_targets[OF \\observable A\\]\n by (metis \\io \\ L A\\ singletonD) \n qed\n\n show \"io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {t2}\"\n proof -\n assume \"io \\ LS M q2 - LS M q1\"\n \n then have \"p_io p \\ LS M q2 - LS M q1\"\n using \\p_io p = io\\ by auto\n then have \"target (initial A) p = t2\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\\n by blast \n then have \"t2 \\ io_targets A io (initial A)\"\n using \\path A (initial A) p\\ \\p_io p = io\\ unfolding io_targets.simps by force\n then show \"io_targets A io (initial A) = {t2}\"\n using observable_io_targets[OF \\observable A\\]\n by (metis \\io \\ L A\\ singletonD) \n qed\n\n show \"io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {t1,t2} = {}\"\n proof -\n assume \"io \\ LS M q1 \\ LS M q2\"\n \n then have \"p_io p \\ LS M q1 \\ LS M q2\"\n using \\p_io p = io\\ by auto\n then have \"target (initial A) p \\ t1\" and \"target (initial A) p \\ t2\"\n using pt1[OF \\path A (initial A) p\\] pt2[OF \\path A (initial A) p\\] pt3[OF \\path A (initial A) p\\] \\t1 \\ t2\\\n by blast+ \n moreover have \"target (initial A) p \\ io_targets A io (initial A)\"\n using \\path A (initial A) p\\ \\p_io p = io\\ unfolding io_targets.simps by force\n ultimately show \"io_targets A io (initial A) \\ {t1,t2} = {}\"\n using observable_io_targets[OF \\observable A\\ \\io \\ L A\\]\n by (metis (no_types, hide_lams) inf_bot_left insert_disjoint(2) insert_iff singletonD) \n qed\n\n show \"io \\ LS M q1 \\ LS M q2\"\n using separator_path_targets(4)[OF assms(1) \\path A (initial A) p\\] \\p_io p = io\\ by auto\nqed\n\n\nlemma is_separator_sym :\n \"is_separator M q1 q2 A t1 t2 \\ is_separator M q2 q1 A t2 t1\"\n unfolding is_separator_def Int_commute[of \"LS M q2\" \"LS M q1\"] by meson \n\n\nlemma state_separator_from_canonical_separator_is_separator :\n assumes \"is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A\"\n and \"observable M\" \n and \"q1 \\ nodes M\"\n and \"q2 \\ nodes M\"\n and \"q1 \\ q2\"\nshows \"is_separator M q1 q2 A (Inr q1) (Inr q2)\"\nproof -\n let ?C = \"canonical_separator M q1 q2\"\n have \"observable ?C\"\n using canonical_separator_observable[OF assms(2,3,4)] by assumption\n\n have \"is_submachine A ?C\" \n and p1: \"single_input A\"\n and p2: \"acyclic A\"\n and p4: \"deadlock_state A (Inr q1)\"\n and p5: \"deadlock_state A (Inr q2)\"\n and p6: \"((Inr q1) \\ reachable_nodes A)\"\n and p7: \"((Inr q2) \\ reachable_nodes A)\"\n and \"\\ q . q \\ reachable_nodes A \\ q \\ Inr q1 \\ q \\ Inr q2 \\ (isl q \\ \\ deadlock_state A q)\"\n and compl: \"\\ q x t . q \\ reachable_nodes A \\ x \\ (inputs M) \\ (\\ t \\ transitions A . t_source t = q \\ t_input t = x) \\ t \\ transitions ?C \\ t_source t = q \\ t_input t = x \\ t \\ transitions A\"\n using is_state_separator_from_canonical_separator_simps[OF assms(1)]\n unfolding canonical_separator_simps[OF assms(3,4)]\n by blast+\n\n have p3: \"observable A\" \n using state_separator_from_canonical_separator_observable[OF assms(1-4)] by assumption\n\n have p8: \"(\\t\\reachable_nodes A. t \\ Inr q1 \\ t \\ Inr q2 \\ \\ deadlock_state A t)\"\n using \\\\ q . q \\ reachable_nodes A \\ q \\ Inr q1 \\ q \\ Inr q2 \\ (isl q \\ \\ deadlock_state A q)\\ by simp\n\n have \"\\ io . io \\ L A \\ \n (io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {Inr q1}) \\\n (io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {Inr q2}) \\\n (io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}) \\\n (\\x yq yt. io @ [(x, yq)] \\ LS M q1 \\ io @ [(x, yt)] \\ LS A (initial A) \\ io @ [(x, yq)] \\ LS A (initial A)) \\\n (\\x yq2 yt. io @ [(x, yq2)] \\ LS M q2 \\ io @ [(x, yt)] \\ LS A (initial A) \\ io @ [(x, yq2)] \\ LS A (initial A))\"\n proof -\n fix io assume \"io \\ L A\"\n\n have \"io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {Inr q1}\"\n using state_separator_from_canonical_separator_language_target(1)[OF assms(1) \\io \\ L A\\ assms(2,3,4,5)] by assumption\n moreover have \"io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {Inr q2}\"\n using state_separator_from_canonical_separator_language_target(2)[OF assms(1) \\io \\ L A\\ assms(2,3,4,5)] by assumption\n moreover have \"io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}\"\n using state_separator_from_canonical_separator_language_target(3)[OF assms(1) \\io \\ L A\\ assms(2,3,4,5)] by assumption\n moreover have \"\\ x yq yt. io @ [(x, yq)] \\ LS M q1 \\ io @ [(x, yt)] \\ L A \\ io @ [(x, yq)] \\ L A\"\n proof -\n fix x yq yt assume \"io @ [(x, yq)] \\ LS M q1\" and \"io @ [(x, yt)] \\ L A\"\n\n obtain pA tA where \"path A (initial A) (pA@[tA])\" and \"p_io (pA@[tA]) = io @ [(x, yt)]\"\n using language_initial_path_append_transition[OF \\io @ [(x, yt)] \\ L A\\] by blast\n then have \"path A (initial A) pA\" and \"p_io pA = io\"\n by auto\n then have \"path ?C (initial ?C) pA\"\n using submachine_path_initial[OF \\is_submachine A ?C\\] by auto\n\n obtain p1 t1 where \"path M q1 (p1@[t1])\" and \"p_io (p1@[t1]) = io @ [(x, yq)]\"\n using language_path_append_transition[OF \\io @ [(x, yq)] \\ LS M q1\\] by blast\n then have \"path M q1 p1\" and \"p_io p1 = io\" and \"t1 \\ transitions M\" and \"t_input t1 = x\" and \"t_output t1 = yq\" and \"t_source t1 = target q1 p1\"\n by auto\n\n let ?q = \"target (initial A) pA\"\n have \"?q \\ nodes A\"\n using path_target_is_node \\path A (initial A) (pA@[tA])\\ by auto\n have \"?q \\ reachable_nodes A\"\n using \\path A (initial A) pA\\ reachable_nodes_intro by blast\n\n have \"tA \\ transitions A\" and \"t_input tA = x\" and \"t_output tA = yt\" and \"t_source tA = target (initial A) pA\"\n using \\path A (initial A) (pA@[tA])\\ \\p_io (pA@[tA]) = io @ [(x, yt)]\\ by auto\n then have \"x \\ (inputs M)\"\n using \\is_submachine A ?C\\ \n unfolding is_submachine.simps canonical_separator_simps[OF assms(3,4)] by auto\n \n have \"\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\"\n using \\tA \\ transitions A\\ \\t_input tA = x\\ \\t_source tA = target (initial A) pA\\ by blast\n\n have \"io \\ LS M q2\"\n using submachine_language[OF \\is_submachine A ?C\\] \\io @ [(x, yt)] \\ L A\\ \n using canonical_separator_language_prefix[OF _ assms(3,4,2,5), of io \"(x,yt)\"] by blast\n then obtain p2 where \"path M q2 p2\" and \"p_io p2 = io\"\n by auto\n \n\n\n show \"io @ [(x, yq)] \\ L A\" \n proof (cases \"\\ t2 \\ transitions M . t_source t2 = target q2 p2 \\ t_input t2 = x \\ t_output t2 = yq\")\n case True\n then obtain t2 where \"t2 \\ transitions M\" and \"t_source t2 = target q2 p2\" and \"t_input t2 = x\" and \"t_output t2 = yq\"\n by blast\n then have \"path M q2 (p2@[t2])\" and \"p_io (p2@[t2]) = io@[(x,yq)]\"\n using path_append_transition[OF \\path M q2 p2\\] \\p_io p2 = io\\ by auto\n then have \"io @ [(x, yq)] \\ LS M q2\"\n unfolding LS.simps by (metis (mono_tags, lifting) mem_Collect_eq) \n then have \"io@[(x,yq)] \\ L ?C\"\n using canonical_separator_language_intersection[OF \\io @ [(x, yq)] \\ LS M q1\\ _ assms(3,4)] by blast\n \n obtain pA' tA' where \"path ?C (initial ?C) (pA'@[tA'])\" and \"p_io (pA'@[tA']) = io@[(x,yq)]\"\n using language_initial_path_append_transition[OF \\io @ [(x, yq)] \\ L ?C\\] by blast\n then have \"path ?C (initial ?C) pA'\" and \"p_io pA' = io\" and \"tA' \\ transitions ?C\" and \"t_source tA' = target (initial ?C) pA'\" and \"t_input tA' = x\" and \"t_output tA' = yq\"\n by auto\n\n have \"pA = pA'\"\n using observable_path_unique[OF \\observable ?C\\ \\path ?C (initial ?C) pA'\\ \\path ?C (initial ?C) pA\\]\n using \\p_io pA' = io\\ \\p_io pA = io\\ by auto\n then have \"t_source tA' = target (initial A) pA\"\n using \\t_source tA' = target (initial ?C) pA'\\\n using is_state_separator_from_canonical_separator_initial[OF assms(1,3,4)]\n using canonical_separator_initial[OF assms(3,4)] by fastforce\n\n\n have \"tA' \\ transitions A\"\n using compl[OF \\?q \\ reachable_nodes A\\ \\x \\ (inputs M)\\ \\\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\\ \\tA' \\ transitions ?C\\ \\t_source tA' = target (initial A) pA\\ \\t_input tA' = x\\] by assumption\n then have \"path A (initial A) (pA@[tA'])\" \n using \\path A (initial A) pA\\ \\t_source tA' = target (initial A) pA\\ using path_append_transition by metis\n moreover have \"p_io (pA@[tA']) = io@[(x,yq)]\"\n using \\t_input tA' = x\\ \\t_output tA' = yq\\ \\p_io pA = io\\ by auto\n \n ultimately show ?thesis \n using language_state_containment\n by (metis (mono_tags, lifting)) \n \n next\n case False\n\n let ?P = \"product (from_FSM M q1) (from_FSM M q2)\"\n let ?qq = \"(target q1 p1, target q2 p2)\"\n let ?tA = \"(Inl (target q1 p1, target q2 p2), x, yq, Inr q1)\"\n\n have \"path (from_FSM M q1) (initial (from_FSM M q1)) p1\" \n using from_FSM_path_initial[OF \\q1 \\ nodes M\\] \\path M q1 p1\\ by auto\n have \"path (from_FSM M q2) (initial (from_FSM M q2)) p2\" \n using from_FSM_path_initial[OF \\q2 \\ nodes M\\] \\path M q2 p2\\ by auto\n have \"p_io p1 = p_io p2\"\n using \\p_io p1 = io\\ \\p_io p2 = io\\ by auto\n \n have \"?qq \\ nodes ?P\" \n using reachable_nodes_intro[OF product_path_from_paths(1)[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\ \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\ \\p_io p1 = p_io p2\\]]\n unfolding product_path_from_paths(2)[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\ \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\ \\p_io p1 = p_io p2\\] from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)] \n using reachable_node_is_node\n by metis\n moreover have \"\\q'. (target q1 p1, x, yq, q') \\ FSM.transitions M\"\n using \\t1 \\ FSM.transitions M\\ \\t_input t1 = x\\ \\t_output t1 = yq\\ \\t_source t1 = target q1 p1\\\n by (metis prod.collapse) \n moreover have \"\\(\\q'. (target q2 p2, x, yq, q') \\ FSM.transitions M)\"\n using \\t1 \\ FSM.transitions M\\ \\t_input t1 = x\\ \\t_output t1 = yq\\ \\t_source t1 = target q1 p1\\ False\n by fastforce\n ultimately have \"?tA \\ (distinguishing_transitions_left M q1 q2)\"\n unfolding distinguishing_transitions_left_def \n by blast\n\n then have \"(Inl (target q1 p1, target q2 p2), x, yq, Inr q1) \\ transitions ?C\"\n using canonical_separator_distinguishing_transitions_left_containment[OF _ assms(3,4)] by metis\n\n let ?pP = \"zip_path p1 p2\"\n let ?pC = \"map shift_Inl ?pP\"\n have \"path ?P (initial ?P) ?pP\" \n and \"target (initial ?P) ?pP = (target q1 p1, target q2 p2)\"\n using product_path_from_paths[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\\n \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\\n \\p_io p1 = p_io p2\\]\n using assms(3,4) by auto\n\n have \"length p1 = length p2\"\n using \\p_io p1 = p_io p2\\ map_eq_imp_length_eq by blast \n then have \"p_io ?pP = io\"\n using \\p_io p1 = io\\ by (induction p1 p2 arbitrary: io rule: list_induct2; auto)\n \n\n have \"path ?C (initial ?C) ?pC\"\n using canonical_separator_path_shift[OF assms(3,4)] \\path ?P (initial ?P) ?pP\\ by simp\n\n have \"target (initial ?C) ?pC = Inl (target q1 p1, target q2 p2)\"\n using path_map_target[of Inl \"initial ?P\" Inl id id ?pP ]\n using \\target (initial ?P) ?pP = (target q1 p1, target q2 p2)\\\n unfolding canonical_separator_simps[OF assms(3,4)] product_simps from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)]\n by fastforce\n \n have \"p_io ?pC = io\"\n using \\p_io ?pP = io\\ by auto\n have \"p_io pA = p_io ?pC\"\n unfolding \\p_io ?pC = io\\\n using \\p_io pA = io\\ by assumption\n \n then have \"?pC = pA\"\n using observable_path_unique[OF \\observable ?C\\ \\path ?C (initial ?C) pA\\ \\path ?C (initial ?C) ?pC\\] by auto\n then have \"t_source ?tA = target (initial A) pA\"\n using \\target (initial ?C) ?pC = Inl (target q1 p1, target q2 p2)\\\n unfolding is_state_separator_from_canonical_separator_initial[OF assms(1,3,4)]\n canonical_separator_simps[OF assms(3,4)] by force\n\n have \"?tA \\ transitions A\"\n using compl[OF \\?q \\ reachable_nodes A\\ \\x \\ (inputs M)\\ \\\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\\ \\?tA \\ transitions ?C\\ \\t_source ?tA = target (initial A) pA\\ ]\n unfolding snd_conv fst_conv by simp\n\n have *: \"path A (initial A) (pA@[?tA])\"\n using path_append_transition[OF \\path A (initial A) pA\\ \\?tA \\ transitions A\\ \\t_source ?tA = target (initial A) pA\\] by assumption\n\n have **: \"p_io (pA@[?tA]) = io@[(x,yq)]\"\n using \\p_io pA = io\\ by auto\n\n show ?thesis \n using language_state_containment[OF * **] by assumption\n qed\n qed\n\n \n moreover have \"\\ x yq yt. io @ [(x, yq)] \\ LS M q2 \\ io @ [(x, yt)] \\ L A \\ io @ [(x, yq)] \\ L A\"\n proof -\n fix x yq yt assume \"io @ [(x, yq)] \\ LS M q2\" and \"io @ [(x, yt)] \\ L A\"\n\n obtain pA tA where \"path A (initial A) (pA@[tA])\" and \"p_io (pA@[tA]) = io @ [(x, yt)]\"\n using language_initial_path_append_transition[OF \\io @ [(x, yt)] \\ L A\\] by blast\n then have \"path A (initial A) pA\" and \"p_io pA = io\"\n by auto\n then have \"path ?C (initial ?C) pA\"\n using submachine_path_initial[OF \\is_submachine A ?C\\] by auto\n\n obtain p2 t2 where \"path M q2 (p2@[t2])\" and \"p_io (p2@[t2]) = io @ [(x, yq)]\"\n using language_path_append_transition[OF \\io @ [(x, yq)] \\ LS M q2\\] by blast\n then have \"path M q2 p2\" and \"p_io p2 = io\" and \"t2 \\ transitions M\" and \"t_input t2 = x\" and \"t_output t2 = yq\" and \"t_source t2 = target q2 p2\"\n by auto\n\n let ?q = \"target (initial A) pA\"\n have \"?q \\ nodes A\"\n using path_target_is_node \\path A (initial A) (pA@[tA])\\ by auto\n\n have \"tA \\ transitions A\" and \"t_input tA = x\" and \"t_output tA = yt\" and \"t_source tA = target (initial A) pA\"\n using \\path A (initial A) (pA@[tA])\\ \\p_io (pA@[tA]) = io @ [(x, yt)]\\ by auto\n then have \"x \\ (inputs M)\"\n using \\is_submachine A ?C\\ \n unfolding is_submachine.simps canonical_separator_simps[OF assms(3,4)] by auto\n \n have \"\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\"\n using \\tA \\ transitions A\\ \\t_input tA = x\\ \\t_source tA = target (initial A) pA\\ by blast\n\n have \"io \\ LS M q1\"\n using submachine_language[OF \\is_submachine A ?C\\] \\io @ [(x, yt)] \\ L A\\ \n using canonical_separator_language_prefix[OF _ assms(3,4,2,5), of io \"(x,yt)\"] by blast\n then obtain p1 where \"path M q1 p1\" and \"p_io p1 = io\"\n by auto\n \n\n\n show \"io @ [(x, yq)] \\ L A\" \n proof (cases \"\\ t1 \\ transitions M . t_source t1 = target q1 p1 \\ t_input t1 = x \\ t_output t1 = yq\")\n case True\n then obtain t1 where \"t1 \\ transitions M\" and \"t_source t1 = target q1 p1\" and \"t_input t1 = x\" and \"t_output t1 = yq\"\n by blast\n then have \"path M q1 (p1@[t1])\" and \"p_io (p1@[t1]) = io@[(x,yq)]\"\n using path_append_transition[OF \\path M q1 p1\\] \\p_io p1 = io\\ by auto\n then have \"io @ [(x, yq)] \\ LS M q1\"\n unfolding LS.simps by (metis (mono_tags, lifting) mem_Collect_eq) \n then have \"io@[(x,yq)] \\ L ?C\"\n using canonical_separator_language_intersection[OF _ \\io @ [(x, yq)] \\ LS M q2\\ assms(3,4)] by blast\n \n obtain pA' tA' where \"path ?C (initial ?C) (pA'@[tA'])\" and \"p_io (pA'@[tA']) = io@[(x,yq)]\"\n using language_initial_path_append_transition[OF \\io @ [(x, yq)] \\ L ?C\\] by blast\n then have \"path ?C (initial ?C) pA'\" and \"p_io pA' = io\" and \"tA' \\ transitions ?C\" and \"t_source tA' = target (initial ?C) pA'\" and \"t_input tA' = x\" and \"t_output tA' = yq\"\n by auto\n\n have \"pA = pA'\"\n using observable_path_unique[OF \\observable ?C\\ \\path ?C (initial ?C) pA'\\ \\path ?C (initial ?C) pA\\]\n using \\p_io pA' = io\\ \\p_io pA = io\\ by auto\n then have \"t_source tA' = target (initial A) pA\"\n using \\t_source tA' = target (initial ?C) pA'\\\n using is_state_separator_from_canonical_separator_initial[OF assms(1,3,4)] \n unfolding canonical_separator_simps[OF assms(3,4)] by auto\n\n have \"?q \\ reachable_nodes A\"\n using \\path A (initial A) pA\\ reachable_nodes_intro by blast\n\n have \"tA' \\ transitions A\"\n using compl[OF \\?q \\ reachable_nodes A\\ \\x \\ (inputs M)\\ \\\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\\ \\tA' \\ transitions ?C\\ \\t_source tA' = target (initial A) pA\\ \\t_input tA' = x\\] by assumption\n then have \"path A (initial A) (pA@[tA'])\" \n using \\path A (initial A) pA\\ \\t_source tA' = target (initial A) pA\\ using path_append_transition by metis\n moreover have \"p_io (pA@[tA']) = io@[(x,yq)]\"\n using \\t_input tA' = x\\ \\t_output tA' = yq\\ \\p_io pA = io\\ by auto\n \n ultimately show ?thesis \n using language_state_containment\n by (metis (mono_tags, lifting)) \n \n next\n case False\n\n let ?P = \"product (from_FSM M q1) (from_FSM M q2)\"\n let ?qq = \"(target q1 p1, target q2 p2)\"\n let ?tA = \"(Inl (target q1 p1, target q2 p2), x, yq, Inr q2)\"\n\n have \"path (from_FSM M q1) (initial (from_FSM M q1)) p1\" \n using from_FSM_path_initial[OF \\q1 \\ nodes M\\] \\path M q1 p1\\ by auto\n have \"path (from_FSM M q2) (initial (from_FSM M q2)) p2\" \n using from_FSM_path_initial[OF \\q2 \\ nodes M\\] \\path M q2 p2\\ by auto\n have \"p_io p1 = p_io p2\"\n using \\p_io p1 = io\\ \\p_io p2 = io\\ by auto\n\n have \"?qq \\ nodes ?P\"\n using reachable_nodes_intro[OF product_path_from_paths(1)[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\ \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\ \\p_io p1 = p_io p2\\]]\n unfolding product_path_from_paths(2)[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\ \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\ \\p_io p1 = p_io p2\\] from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)] \n using reachable_node_is_node by metis\n moreover have \"\\q'. (target q2 p2, x, yq, q') \\ FSM.transitions M\"\n using \\t2 \\ FSM.transitions M\\ \\t_input t2 = x\\ \\t_output t2 = yq\\ \\t_source t2 = target q2 p2\\\n by (metis prod.collapse) \n moreover have \"\\(\\q'. (target q1 p1, x, yq, q') \\ FSM.transitions M)\"\n using \\t2 \\ FSM.transitions M\\ \\t_input t2 = x\\ \\t_output t2 = yq\\ \\t_source t2 = target q2 p2\\ False\n by fastforce\n ultimately have \"?tA \\ (distinguishing_transitions_right M q1 q2)\"\n unfolding distinguishing_transitions_right_def \n by blast\n\n then have \"?tA \\ transitions ?C\"\n using canonical_separator_distinguishing_transitions_right_containment[OF _ assms(3,4)] by metis\n\n let ?pP = \"zip_path p1 p2\"\n let ?pC = \"map shift_Inl ?pP\"\n have \"path ?P (initial ?P) ?pP\" \n and \"target (initial ?P) ?pP = (target q1 p1, target q2 p2)\"\n using product_path_from_paths[OF \\path (from_FSM M q1) (initial (from_FSM M q1)) p1\\\n \\path (from_FSM M q2) (initial (from_FSM M q2)) p2\\\n \\p_io p1 = p_io p2\\]\n using assms(3,4) by auto\n\n have \"length p1 = length p2\"\n using \\p_io p1 = p_io p2\\ map_eq_imp_length_eq by blast \n then have \"p_io ?pP = io\"\n using \\p_io p1 = io\\ by (induction p1 p2 arbitrary: io rule: list_induct2; auto)\n \n\n have \"path ?C (initial ?C) ?pC\"\n using canonical_separator_path_shift[OF assms(3,4)] \\path ?P (initial ?P) ?pP\\ by simp\n\n have \"target (initial ?C) ?pC = Inl (target q1 p1, target q2 p2)\"\n using path_map_target[of Inl \"initial ?P\" Inl id id ?pP ]\n using \\target (initial ?P) ?pP = (target q1 p1, target q2 p2)\\\n unfolding canonical_separator_simps[OF assms(3,4)] product_simps from_FSM_simps[OF assms(3)] from_FSM_simps[OF assms(4)] by force\n \n have \"p_io ?pC = io\"\n using \\p_io ?pP = io\\ by auto\n have \"p_io pA = p_io ?pC\"\n unfolding \\p_io ?pC = io\\\n using \\p_io pA = io\\ by assumption\n \n then have \"?pC = pA\"\n using observable_path_unique[OF \\observable ?C\\ \\path ?C (initial ?C) pA\\ \\path ?C (initial ?C) ?pC\\] by auto\n then have \"t_source ?tA = target (initial A) pA\"\n using \\target (initial ?C) ?pC = Inl (target q1 p1, target q2 p2)\\\n unfolding is_state_separator_from_canonical_separator_initial[OF assms(1,3,4)]\n canonical_separator_simps[OF assms(3,4)] by force\n\n have \"?q \\ reachable_nodes A\"\n using \\path A (initial A) pA\\ reachable_nodes_intro by blast\n have \"?tA \\ transitions A\"\n using compl[OF \\?q \\ reachable_nodes A\\ \\x \\ (inputs M)\\ \\\\t\\(transitions A). t_source t = target (initial A) pA \\ t_input t = x\\ \\?tA \\ transitions ?C\\ \\t_source ?tA = target (initial A) pA\\ ]\n unfolding snd_conv fst_conv by simp\n\n have *: \"path A (initial A) (pA@[?tA])\"\n using path_append_transition[OF \\path A (initial A) pA\\ \\?tA \\ transitions A\\ \\t_source ?tA = target (initial A) pA\\] by assumption\n\n have **: \"p_io (pA@[?tA]) = io@[(x,yq)]\"\n using \\p_io pA = io\\ by auto\n\n show ?thesis \n using language_state_containment[OF * **] by assumption\n qed\n qed\n\n\n ultimately show \"(io \\ LS M q1 - LS M q2 \\ io_targets A io (initial A) = {Inr q1}) \\\n (io \\ LS M q2 - LS M q1 \\ io_targets A io (initial A) = {Inr q2}) \\\n (io \\ LS M q1 \\ LS M q2 \\ io_targets A io (initial A) \\ {Inr q1, Inr q2} = {}) \\\n (\\x yq yt. io @ [(x, yq)] \\ LS M q1 \\ io @ [(x, yt)] \\ LS A (initial A) \\ io @ [(x, yq)] \\ LS A (initial A)) \\\n (\\x yq2 yt. io @ [(x, yq2)] \\ LS M q2 \\ io @ [(x, yt)] \\ LS A (initial A) \\ io @ [(x, yq2)] \\ LS A (initial A))\" \n by blast \n qed\n\n moreover have \"\\ p . path A (initial A) p \\ target (initial A) p = Inr q1 \\ p_io p \\ LS M q1 - LS M q2\"\n using canonical_separator_maximal_path_distinguishes_left[OF assms(1) _ _ \\observable M\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\q1 \\ q2\\] by blast\n moreover have \"\\ p . path A (initial A) p \\ target (initial A) p = Inr q2 \\ p_io p \\ LS M q2 - LS M q1\"\n using canonical_separator_maximal_path_distinguishes_right[OF assms(1) _ _ \\observable M\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\q1 \\ q2\\] by blast\n moreover have \"\\ p . path A (initial A) p \\ target (initial A) p \\ Inr q1 \\ target (initial A) p \\ Inr q2 \\ p_io p \\ LS M q1 \\ LS M q2\"\n proof -\n fix p assume \"path A (initial A) p\" and \"target (initial A) p \\ Inr q1\" and \"target (initial A) p \\ Inr q2\"\n\n have \"path ?C (initial ?C) p\"\n using submachine_path_initial[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)] \\path A (initial A) p\\] by assumption\n\n have \"target (initial ?C) p \\ Inr q1\" and \"target (initial ?C) p \\ Inr q2\"\n using \\target (initial A) p \\ Inr q1\\ \\target (initial A) p \\ Inr q2\\\n unfolding is_state_separator_from_canonical_separator_initial[OF assms(1,3,4)] canonical_separator_initial[OF assms(3,4)] by blast+\n\n then have \"isl (target (initial ?C) p)\"\n using canonical_separator_path_initial(4)[OF \\path ?C (initial ?C) p\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\observable M\\ \\q1 \\ q2\\]\n by auto \n\n then show \"p_io p \\ LS M q1 \\ LS M q2\"\n using \\path ?C (initial ?C) p\\ canonical_separator_path_targets_language(1)[OF _ \\observable M\\ \\q1 \\ nodes M\\ \\q2 \\ nodes M\\ \\q1 \\ q2\\] \n by auto\n qed\n\n moreover have \"(inputs A) \\ (inputs M)\"\n using \\is_submachine A ?C\\\n unfolding is_submachine.simps canonical_separator_simps[OF assms(3,4)] by auto\n\n ultimately show ?thesis\n unfolding is_separator_def\n using p1 p2 p3 p4 p5 p6 p7 p8 \\q1 \\ q2\\\n by (meson sum.simps(2))\nqed\n\n \nlemma is_separator_separated_node_is_node :\n assumes \"is_separator M q1 q2 A t1 t2\"\n shows \"q1 \\ nodes M\" and \"q2 \\ nodes M\"\nproof -\n have \"initial A \\ t1\"\n using separator_initial[OF assms(1)] by blast\n\n have \"t1 \\ reachable_nodes A\"\n and \"\\ p . path A (FSM.initial A) p \\ target (FSM.initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\"\n and \"t2 \\ reachable_nodes A\"\n and \"\\ p . path A (FSM.initial A) p \\ target (FSM.initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\"\n using is_separator_simps[OF assms(1)] \n by blast+\n\n obtain p1 where \"path A (FSM.initial A) p1\" and \"target (FSM.initial A) p1 = t1\"\n using \\t1 \\ reachable_nodes A\\ unfolding reachable_nodes_def by auto\n then have \"p_io p1 \\ LS M q1 - LS M q2\"\n using \\\\ p . path A (FSM.initial A) p \\ target (FSM.initial A) p = t1 \\ p_io p \\ LS M q1 - LS M q2\\ \n by blast\n then show \"q1 \\ nodes M\" unfolding LS.simps\n using path_begin_node by fastforce \n\n obtain p2 where \"path A (FSM.initial A) p2\" and \"target (FSM.initial A) p2 = t2\"\n using \\t2 \\ reachable_nodes A\\ unfolding reachable_nodes_def by auto\n then have \"p_io p2 \\ LS M q2 - LS M q1\"\n using \\\\ p . path A (FSM.initial A) p \\ target (FSM.initial A) p = t2 \\ p_io p \\ LS M q2 - LS M q1\\ \n by blast\n then show \"q2 \\ nodes M\" unfolding LS.simps\n using path_begin_node by fastforce \nqed\n\nend", "meta": {"author": "RobertSachtleben", "repo": "Refined-Adaptive-State-Counting", "sha": "3691de6f16cec5ec74282465495c12e6a40133aa", "save_path": "github-repos/isabelle/RobertSachtleben-Refined-Adaptive-State-Counting", "path": "github-repos/isabelle/RobertSachtleben-Refined-Adaptive-State-Counting/Refined-Adaptive-State-Counting-3691de6f16cec5ec74282465495c12e6a40133aa/Experiments/State_Separator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199306096343, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.29185043784158066}} {"text": "(* This file is a part of IsarMathLib - \n a library of formalized mathematics for Isabelle/Isar.\n\n Copyright (C) 2005-2020 Slawomir Kolodynski\n\n This program is free software; Redistribution and use in source and binary forms, \n with or without modification, are permitted provided that the following conditions are met:\n\n 1. Redistributions of source code must retain the above copyright notice, \n this list of conditions and the following disclaimer.\n 2. Redistributions in binary form must reproduce the above copyright notice, \n this list of conditions and the following disclaimer in the documentation and/or \n other materials provided with the distribution.\n 3. The name of the author may not be used to endorse or promote products \n derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\Even more on order relations\\\n\ntheory Order_ZF_1a imports Order_ZF\n\nbegin\n\ntext\\This theory is a continuation of \\Order_ZF\\ and talks\n about maximuma and minimum of a set, supremum and infimum\n and strict (not reflexive) versions of order relations.\\\n\nsubsection\\Maximum and minimum of a set\\\n\ntext\\In this section we show that maximum and minimum are unique if they \n exist. We also show that union of sets that have maxima (minima) has a \n maximum (minimum). We also show that singletons have maximum and minimum.\n All this allows to show (in \\Finite_ZF\\) that every finite set has \n well-defined maximum and minimum.\\\n\ntext\\A somewhat technical fact that allows to reduce the number of premises in some\n theorems: the assumption that a set has a maximum implies that it is not empty. \\\n\nlemma set_max_not_empty: assumes \"HasAmaximum(r,A)\" shows \"A\\0\"\n using assms unfolding HasAmaximum_def by auto\n\ntext\\If a set has a maximum implies that it is not empty. \\\n\nlemma set_min_not_empty: assumes \"HasAminimum(r,A)\" shows \"A\\0\"\n using assms unfolding HasAminimum_def by auto\n\ntext\\If a set has a supremum then it cannot be empty. We are probably using the fact that \n $\\bigcap \\emptyset = \\emptyset $, which makes me a bit anxious \n as this I think is just a convention. \\\n\nlemma set_sup_not_empty: assumes \"HasAsupremum(r,A)\" shows \"A\\0\"\nproof -\n from assms have \"HasAminimum(r,\\a\\A. r``{a})\" unfolding HasAsupremum_def\n by simp \n then have \"(\\a\\A. r``{a}) \\ 0\" using set_min_not_empty by simp\n then obtain x where \"x \\ (\\y\\A. r``{y})\" by blast\n thus ?thesis by auto\nqed\n\ntext\\If a set has an infimum then it cannot be empty. \\\n\nlemma set_inf_not_empty: assumes \"HasAnInfimum(r,A)\" shows \"A\\0\"\nproof -\n from assms have \"HasAmaximum(r,\\a\\A. r-``{a})\" unfolding HasAnInfimum_def\n by simp \n then have \"(\\a\\A. r-``{a}) \\ 0\" using set_max_not_empty by simp\n then obtain x where \"x \\ (\\y\\A. r-``{y})\" by blast\n thus ?thesis by auto\nqed\n \ntext\\For antisymmetric relations maximum of a set is unique if it exists.\\\n\nlemma Order_ZF_4_L1: assumes A1: \"antisym(r)\" and A2: \"HasAmaximum(r,A)\"\n shows \"\\!M. M\\A \\ (\\x\\A. \\ x,M\\ \\ r)\"\nproof\n from A2 show \"\\M. M \\ A \\ (\\x\\A. \\x, M\\ \\ r)\"\n using HasAmaximum_def by auto\n fix M1 M2 assume \n A2: \"M1 \\ A \\ (\\x\\A. \\x, M1\\ \\ r)\" \"M2 \\ A \\ (\\x\\A. \\x, M2\\ \\ r)\"\n then have \"\\M1,M2\\ \\ r\" \"\\M2,M1\\ \\ r\" by auto\n with A1 show \"M1=M2\" by (rule Fol1_L4)\nqed\n\ntext\\For antisymmetric relations minimum of a set is unique if it exists.\\\n\nlemma Order_ZF_4_L2: assumes A1: \"antisym(r)\" and A2: \"HasAminimum(r,A)\"\n shows \"\\!m. m\\A \\ (\\x\\A. \\ m,x\\ \\ r)\"\nproof\n from A2 show \"\\m. m \\ A \\ (\\x\\A. \\m, x\\ \\ r)\"\n using HasAminimum_def by auto\n fix m1 m2 assume \n A2: \"m1 \\ A \\ (\\x\\A. \\m1, x\\ \\ r)\" \"m2 \\ A \\ (\\x\\A. \\m2, x\\ \\ r)\"\n then have \"\\m1,m2\\ \\ r\" \"\\m2,m1\\ \\ r\" by auto\n with A1 show \"m1=m2\" by (rule Fol1_L4)\nqed\n\ntext\\Maximum of a set has desired properties.\\\n\nlemma Order_ZF_4_L3: assumes A1: \"antisym(r)\" and A2: \"HasAmaximum(r,A)\"\n shows \"Maximum(r,A) \\ A\" \"\\x\\A. \\x,Maximum(r,A)\\ \\ r\"\nproof - \n let ?Max = \"THE M. M\\A \\ (\\x\\A. \\ x,M\\ \\ r)\" \n from A1 A2 have \"\\!M. M\\A \\ (\\x\\A. \\ x,M\\ \\ r)\"\n by (rule Order_ZF_4_L1)\n then have \"?Max \\ A \\ (\\x\\A. \\ x,?Max\\ \\ r)\"\n by (rule theI)\n then show \"Maximum(r,A) \\ A\" \"\\x\\A. \\x,Maximum(r,A)\\ \\ r\"\n using Maximum_def by auto\nqed\n \ntext\\Minimum of a set has desired properties.\\\n \nlemma Order_ZF_4_L4: assumes A1: \"antisym(r)\" and A2: \"HasAminimum(r,A)\"\n shows \"Minimum(r,A) \\ A\" \"\\x\\A. \\Minimum(r,A),x\\ \\ r\"\nproof - \n let ?Min = \"THE m. m\\A \\ (\\x\\A. \\ m,x\\ \\ r)\" \n from A1 A2 have \"\\!m. m\\A \\ (\\x\\A. \\ m,x\\ \\ r)\"\n by (rule Order_ZF_4_L2)\n then have \"?Min \\ A \\ (\\x\\A. \\ ?Min,x\\ \\ r)\"\n by (rule theI)\n then show \"Minimum(r,A) \\ A\" \"\\x\\A. \\Minimum(r,A),x\\ \\ r\"\n using Minimum_def by auto\nqed\n\ntext\\For total and transitive relations a union a of two sets that have \n maxima has a maximum.\\\n\nlemma Order_ZF_4_L5: \n assumes A1: \"r {is total on} (A\\B)\" and A2: \"trans(r)\"\n and A3: \"HasAmaximum(r,A)\" \"HasAmaximum(r,B)\"\n shows \"HasAmaximum(r,A\\B)\"\nproof -\n from A3 obtain M K where \n D1: \"M\\A \\ (\\x\\A. \\ x,M\\ \\ r)\" \"K\\B \\ (\\x\\B. \\ x,K\\ \\ r)\" \n using HasAmaximum_def by auto\n let ?L = \"GreaterOf(r,M,K)\"\n from D1 have T1: \"M \\ A\\B\" \"K \\ A\\B\" \n \"\\x\\A. \\ x,M\\ \\ r\" \"\\x\\B. \\ x,K\\ \\ r\"\n by auto\n with A1 A2 have \"\\x\\A\\B.\\ x,?L\\ \\ r\" by (rule Order_ZF_3_L2B)\n moreover from T1 have \"?L \\ A\\B\" using GreaterOf_def IsTotal_def \n by simp\n ultimately show \"HasAmaximum(r,A\\B)\" using HasAmaximum_def by auto\nqed\n\ntext\\For total and transitive relations A union a of two sets that have \n minima has a minimum.\\\n\nlemma Order_ZF_4_L6: \n assumes A1: \"r {is total on} (A\\B)\" and A2: \"trans(r)\"\n and A3: \"HasAminimum(r,A)\" \"HasAminimum(r,B)\"\n shows \"HasAminimum(r,A\\B)\"\nproof -\n from A3 obtain m k where \n D1: \"m\\A \\ (\\x\\A. \\ m,x\\ \\ r)\" \"k\\B \\ (\\x\\B. \\ k,x\\ \\ r)\" \n using HasAminimum_def by auto\n let ?l = \"SmallerOf(r,m,k)\"\n from D1 have T1: \"m \\ A\\B\" \"k \\ A\\B\" \n \"\\x\\A. \\ m,x\\ \\ r\" \"\\x\\B. \\ k,x\\ \\ r\"\n by auto\n with A1 A2 have \"\\x\\A\\B.\\ ?l,x\\ \\ r\" by (rule Order_ZF_3_L5B)\n moreover from T1 have \"?l \\ A\\B\" using SmallerOf_def IsTotal_def \n by simp\n ultimately show \"HasAminimum(r,A\\B)\" using HasAminimum_def by auto\nqed\n\ntext\\Set that has a maximum is bounded above.\\\n\nlemma Order_ZF_4_L7:\n assumes \"HasAmaximum(r,A)\"\n shows \"IsBoundedAbove(A,r)\"\n using assms HasAmaximum_def IsBoundedAbove_def by auto\n\ntext\\Set that has a minimum is bounded below.\\\n\nlemma Order_ZF_4_L8A:\n assumes \"HasAminimum(r,A)\"\n shows \"IsBoundedBelow(A,r)\"\n using assms HasAminimum_def IsBoundedBelow_def by auto\n\ntext\\For reflexive relations singletons have a minimum and maximum.\\\n\nlemma Order_ZF_4_L8: assumes \"refl(X,r)\" and \"a\\X\"\n shows \"HasAmaximum(r,{a})\" \"HasAminimum(r,{a})\"\n using assms refl_def HasAmaximum_def HasAminimum_def by auto\n\ntext\\For total and transitive relations if we add an element to a set \n that has a maximum, the set still has a maximum.\\\n\nlemma Order_ZF_4_L9: \n assumes A1: \"r {is total on} X\" and A2: \"trans(r)\"\n and A3: \"A\\X\" and A4: \"a\\X\" and A5: \"HasAmaximum(r,A)\"\n shows \"HasAmaximum(r,A\\{a})\"\nproof -\n from A3 A4 have \"A\\{a} \\ X\" by auto\n with A1 have \"r {is total on} (A\\{a})\"\n using Order_ZF_1_L4 by blast\n moreover from A1 A2 A4 A5 have\n \"trans(r)\" \"HasAmaximum(r,A)\" by auto\n moreover from A1 A4 have \"HasAmaximum(r,{a})\"\n using total_is_refl Order_ZF_4_L8 by blast\n ultimately show \"HasAmaximum(r,A\\{a})\" by (rule Order_ZF_4_L5)\nqed\n\ntext\\For total and transitive relations if we add an element to a set \n that has a minimum, the set still has a minimum.\\\n\nlemma Order_ZF_4_L10: \n assumes A1: \"r {is total on} X\" and A2: \"trans(r)\"\n and A3: \"A\\X\" and A4: \"a\\X\" and A5: \"HasAminimum(r,A)\"\n shows \"HasAminimum(r,A\\{a})\"\nproof -\n from A3 A4 have \"A\\{a} \\ X\" by auto\n with A1 have \"r {is total on} (A\\{a})\"\n using Order_ZF_1_L4 by blast\n moreover from A1 A2 A4 A5 have\n \"trans(r)\" \"HasAminimum(r,A)\" by auto\n moreover from A1 A4 have \"HasAminimum(r,{a})\"\n using total_is_refl Order_ZF_4_L8 by blast\n ultimately show \"HasAminimum(r,A\\{a})\" by (rule Order_ZF_4_L6)\nqed\n\ntext\\If the order relation has a property that every nonempty bounded set \n attains a minimum (for example integers are like that), \n then every nonempty set bounded below attains a minimum.\\\n\nlemma Order_ZF_4_L11: \n assumes A1: \"r {is total on} X\" and \n A2: \"trans(r)\" and \n A3: \"r \\ X\\X\" and\n A4: \"\\A. IsBounded(A,r) \\ A\\0 \\ HasAminimum(r,A)\" and \n A5: \"B\\0\" and A6: \"IsBoundedBelow(B,r)\"\n shows \"HasAminimum(r,B)\"\nproof -\n from A5 obtain b where T: \"b\\B\" by auto\n let ?L = \"{x\\B. \\x,b\\ \\ r}\"\n from A3 A6 T have T1: \"b\\X\" using Order_ZF_3_L1B by blast\n with A1 T have T2: \"b \\ ?L\"\n using total_is_refl refl_def by simp\n then have \"?L \\ 0\" by auto\n moreover have \"IsBounded(?L,r)\"\n proof -\n have \"?L \\ B\" by auto\n with A6 have \"IsBoundedBelow(?L,r)\"\n using Order_ZF_3_L12 by simp\n moreover have \"IsBoundedAbove(?L,r)\"\n by (rule Order_ZF_3_L15)\n ultimately have \"IsBoundedAbove(?L,r) \\ IsBoundedBelow(?L,r)\"\n by blast\n then show \"IsBounded(?L,r)\" using IsBounded_def\n by simp\n qed\n ultimately have \"IsBounded(?L,r) \\ ?L \\ 0\" by blast\n with A4 have \"HasAminimum(r,?L)\" by simp\n then obtain m where I: \"m\\?L\" and II: \"\\x\\?L. \\ m,x\\ \\ r\" \n using HasAminimum_def by auto\n then have III: \"\\m,b\\ \\ r\" by simp\n from I have \"m\\B\" by simp\n moreover have \"\\x\\B. \\m,x\\ \\ r\"\n proof\n fix x assume A7: \"x\\B\"\n from A3 A6 have \"B\\X\" using Order_ZF_3_L1B by blast\n with A1 A7 T1 have \"x \\ ?L \\ {x\\B. \\b,x\\ \\ r}\"\n using Order_ZF_1_L5 by simp\n then have \"x\\?L \\ \\b,x\\ \\ r\" by auto\n moreover\n { assume \"x\\?L\"\n with II have \"\\m,x\\ \\ r\" by simp }\n moreover\n { assume \"\\b,x\\ \\ r\"\n with A2 III have \"trans(r)\" and \"\\m,b\\ \\ r \\ \\b,x\\ \\ r\"\n\tby auto\n then have \"\\m,x\\ \\ r\" by (rule Fol1_L3) }\n ultimately show \"\\m,x\\ \\ r\" by auto\n qed\n ultimately show \"HasAminimum(r,B)\" using HasAminimum_def\n by auto\nqed\n\ntext\\A dual to \\Order_ZF_4_L11\\: \n If the order relation has a property that every nonempty bounded set \n attains a maximum (for example integers are like that), \n then every nonempty set bounded above attains a maximum.\\\n\nlemma Order_ZF_4_L11A: \n assumes A1: \"r {is total on} X\" and \n A2: \"trans(r)\" and \n A3: \"r \\ X\\X\" and\n A4: \"\\A. IsBounded(A,r) \\ A\\0 \\ HasAmaximum(r,A)\" and \n A5: \"B\\0\" and A6: \"IsBoundedAbove(B,r)\"\n shows \"HasAmaximum(r,B)\"\nproof -\n from A5 obtain b where T: \"b\\B\" by auto\n let ?U = \"{x\\B. \\b,x\\ \\ r}\"\n from A3 A6 T have T1: \"b\\X\" using Order_ZF_3_L1A by blast\n with A1 T have T2: \"b \\ ?U\"\n using total_is_refl refl_def by simp\n then have \"?U \\ 0\" by auto\n moreover have \"IsBounded(?U,r)\"\n proof -\n have \"?U \\ B\" by auto\n with A6 have \"IsBoundedAbove(?U,r)\"\n using Order_ZF_3_L13 by blast\n moreover have \"IsBoundedBelow(?U,r)\"\n using IsBoundedBelow_def by auto\n ultimately have \"IsBoundedAbove(?U,r) \\ IsBoundedBelow(?U,r)\"\n by blast\n then show \"IsBounded(?U,r)\" using IsBounded_def\n by simp\n qed\n ultimately have \"IsBounded(?U,r) \\ ?U \\ 0\" by blast\n with A4 have \"HasAmaximum(r,?U)\" by simp\n then obtain m where I: \"m\\?U\" and II: \"\\x\\?U. \\x,m\\ \\ r\"\n using HasAmaximum_def by auto\n then have III: \"\\b,m\\ \\ r\" by simp\n from I have \"m\\B\" by simp\n moreover have \"\\x\\B. \\x,m\\ \\ r\"\n proof\n fix x assume A7: \"x\\B\"\n from A3 A6 have \"B\\X\" using Order_ZF_3_L1A by blast\n with A1 A7 T1 have \"x \\ {x\\B. \\x,b\\ \\ r} \\ ?U\"\n using Order_ZF_1_L5 by simp\n then have \"x\\?U \\ \\x,b\\ \\ r\" by auto\n moreover\n { assume \"x\\?U\"\n with II have \"\\x,m\\ \\ r\" by simp }\n moreover\n { assume \"\\x,b\\ \\ r\"\n with A2 III have \"trans(r)\" and \"\\x,b\\ \\ r \\ \\b,m\\ \\ r\"\n\tby auto\n then have \"\\x,m\\ \\ r\" by (rule Fol1_L3) }\n ultimately show \"\\x,m\\ \\ r\" by auto\n qed\n ultimately show \"HasAmaximum(r,B)\" using HasAmaximum_def\n by auto\nqed\n\ntext\\If a set has a minimum and $L$ is less or equal than \n all elements of the set, then $L$ is less or equal than the minimum.\\\n\nlemma Order_ZF_4_L12: \n assumes \"antisym(r)\" and \"HasAminimum(r,A)\" and \"\\a\\A. \\L,a\\ \\ r\"\n shows \"\\L,Minimum(r,A)\\ \\ r\"\n using assms Order_ZF_4_L4 by simp\n\n\ntext\\If a set has a maximum and all its elements are less or equal than \n $M$, then the maximum of the set is less or equal than $M$.\\\n\nlemma Order_ZF_4_L13: \n assumes \"antisym(r)\" and \"HasAmaximum(r,A)\" and \"\\a\\A. \\a,M\\ \\ r\"\n shows \"\\Maximum(r,A),M\\ \\ r\"\n using assms Order_ZF_4_L3 by simp\n\ntext\\If an element belongs to a set and is greater or equal\n than all elements of that set, then it is the maximum of that set.\\\n\nlemma Order_ZF_4_L14: \n assumes A1: \"antisym(r)\" and A2: \"M \\ A\" and \n A3: \"\\a\\A. \\a,M\\ \\ r\"\n shows \"Maximum(r,A) = M\"\nproof -\n from A2 A3 have I: \"HasAmaximum(r,A)\" using HasAmaximum_def\n by auto\n with A1 have \"\\!M. M\\A \\ (\\x\\A. \\x,M\\ \\ r)\"\n using Order_ZF_4_L1 by simp\n moreover from A2 A3 have \"M\\A \\ (\\x\\A. \\x,M\\ \\ r)\" by simp\n moreover from A1 I have \n \"Maximum(r,A) \\ A \\ (\\x\\A. \\x,Maximum(r,A)\\ \\ r)\"\n using Order_ZF_4_L3 by simp\n ultimately show \"Maximum(r,A) = M\" by auto\nqed\n\ntext\\If an element belongs to a set and is less or equal\n than all elements of that set, then it is the minimum of that set.\\\n\nlemma Order_ZF_4_L15: \n assumes A1: \"antisym(r)\" and A2: \"m \\ A\" and \n A3: \"\\a\\A. \\m,a\\ \\ r\"\n shows \"Minimum(r,A) = m\"\nproof -\n from A2 A3 have I: \"HasAminimum(r,A)\" using HasAminimum_def\n by auto\n with A1 have \"\\!m. m\\A \\ (\\x\\A. \\m,x\\ \\ r)\"\n using Order_ZF_4_L2 by simp\n moreover from A2 A3 have \"m\\A \\ (\\x\\A. \\m,x\\ \\ r)\" by simp\n moreover from A1 I have \n \"Minimum(r,A) \\ A \\ (\\x\\A. \\Minimum(r,A),x\\ \\ r)\"\n using Order_ZF_4_L4 by simp\n ultimately show \"Minimum(r,A) = m\" by auto\nqed\n\ntext\\If a set does not have a maximum, then for any its element we can\n find one that is (strictly) greater.\\\n\nlemma Order_ZF_4_L16: \n assumes A1: \"antisym(r)\" and A2: \"r {is total on} X\" and \n A3: \"A\\X\" and\n A4: \"\\HasAmaximum(r,A)\" and \n A5: \"x\\A\"\n shows \"\\y\\A. \\x,y\\ \\ r \\ y\\x\"\nproof -\n { assume A6: \"\\y\\A. \\x,y\\ \\ r \\ y=x\"\n have \"\\y\\A. \\y,x\\ \\ r\"\n proof\n fix y assume A7: \"y\\A\"\n with A6 have \"\\x,y\\ \\ r \\ y=x\" by simp\n with A2 A3 A5 A7 show \"\\y,x\\ \\ r\"\n\tusing IsTotal_def Order_ZF_1_L1 by auto\n qed\n with A5 have \"\\x\\A.\\y\\A. \\y,x\\ \\ r\"\n by auto\n with A4 have False using HasAmaximum_def by simp\n } then show \"\\y\\A. \\x,y\\ \\ r \\ y\\x\" by auto\nqed\n\n\nsubsection\\Supremum and Infimum\\\n\ntext\\In this section we consider the notions of supremum and infimum a set.\\\n\ntext\\Elements of the set of upper bounds are indeed upper bounds.\n Isabelle also thinks it is obvious.\\\n\nlemma Order_ZF_5_L1: assumes \"u \\ (\\a\\A. r``{a})\" and \"a\\A\"\n shows \"\\a,u\\ \\ r\"\n using assms by auto\n\ntext\\Elements of the set of lower bounds are indeed lower bounds.\n Isabelle also thinks it is obvious.\\\n \nlemma Order_ZF_5_L2: assumes \"l \\ (\\a\\A. r-``{a})\" and \"a\\A\"\n shows \"\\l,a\\ \\ r\"\n using assms by auto\n\ntext\\If the set of upper bounds has a minimum, then the supremum \n is less or equal than any upper bound. We can probably do away with\n the assumption that $A$ is not empty, (ab)using the fact that \n intersection over an empty family is defined in Isabelle to be empty.\n This lemma is obsolete and will be removed in the future. Use \\sup_leq_up_bnd\\ instead.\\\n\nlemma Order_ZF_5_L3: assumes A1: \"antisym(r)\" and A2: \"A\\0\" and\n A3: \"HasAminimum(r,\\a\\A. r``{a})\" and \n A4: \"\\a\\A. \\a,u\\ \\ r\"\n shows \"\\Supremum(r,A),u\\ \\ r\"\nproof -\n let ?U = \"\\a\\A. r``{a}\"\n from A4 have \"\\a\\A. u \\ r``{a}\" using image_singleton_iff\n by simp\n with A2 have \"u\\?U\" by auto\n with A1 A3 show \"\\Supremum(r,A),u\\ \\ r\"\n using Order_ZF_4_L4 Supremum_def by simp\nqed\n\ntext\\Supremum is less or equal than any upper bound. \\\n\nlemma sup_leq_up_bnd: assumes \"antisym(r)\" \"HasAsupremum(r,A)\" \"\\a\\A. \\a,u\\ \\ r\"\n shows \"\\Supremum(r,A),u\\ \\ r\"\nproof -\n let ?U = \"\\a\\A. r``{a}\"\n from assms(3) have \"\\a\\A. u \\ r``{a}\" using image_singleton_iff by simp\n with assms(2) have \"u\\?U\" using set_sup_not_empty by auto\n with assms(1,2) show \"\\Supremum(r,A),u\\ \\ r\" \n unfolding HasAsupremum_def Supremum_def using Order_ZF_4_L4 by simp\nqed\n\ntext\\Infimum is greater or equal than any lower bound. \n This lemma is obsolete and will be removed. Use \\inf_geq_lo_bnd\\ instead.\\\n\nlemma Order_ZF_5_L4: assumes A1: \"antisym(r)\" and A2: \"A\\0\" and\n A3: \"HasAmaximum(r,\\a\\A. r-``{a})\" and \n A4: \"\\a\\A. \\l,a\\ \\ r\"\n shows \"\\l,Infimum(r,A)\\ \\ r\"\nproof -\n let ?L = \"\\a\\A. r-``{a}\"\n from A4 have \"\\a\\A. l \\ r-``{a}\" using vimage_singleton_iff\n by simp\n with A2 have \"l\\?L\" by auto \n with A1 A3 show \"\\l,Infimum(r,A)\\ \\ r\"\n using Order_ZF_4_L3 Infimum_def by simp\nqed\n\ntext\\Infimum is greater or equal than any upper bound. \\\n\nlemma inf_geq_lo_bnd: assumes \"antisym(r)\" \"HasAnInfimum(r,A)\" \"\\a\\A. \\u,a\\ \\ r\"\n shows \"\\u,Infimum(r,A)\\ \\ r\"\nproof -\n let ?U = \"\\a\\A. r-``{a}\"\n from assms(3) have \"\\a\\A. u \\ r-``{a}\" using vimage_singleton_iff by simp\n with assms(2) have \"u\\?U\" using set_inf_not_empty by auto\n with assms(1,2) show \"\\u,Infimum(r,A)\\ \\ r\" \n unfolding HasAnInfimum_def Infimum_def using Order_ZF_4_L3 by simp\nqed\n\ntext\\If $z$ is an upper bound for $A$ and is less or equal than\n any other upper bound, then $z$ is the supremum of $A$.\\\n\nlemma Order_ZF_5_L5: assumes A1: \"antisym(r)\" and A2: \"A\\0\" and\n A3: \"\\x\\A. \\x,z\\ \\ r\" and \n A4: \"\\y. (\\x\\A. \\x,y\\ \\ r) \\ \\z,y\\ \\ r\"\n shows \n \"HasAminimum(r,\\a\\A. r``{a})\"\n \"z = Supremum(r,A)\"\nproof -\n let ?B = \"\\a\\A. r``{a}\"\n from A2 A3 A4 have I: \"z \\ ?B\" \"\\y\\?B. \\z,y\\ \\ r\"\n by auto\n then show \"HasAminimum(r,\\a\\A. r``{a})\"\n using HasAminimum_def by auto\n from A1 I show \"z = Supremum(r,A)\"\n using Order_ZF_4_L15 Supremum_def by simp\nqed\n\ntext\\The dual theorem to \\Order_ZF_5_L5\\: if $z$ is an lower bound for $A$ and is \n greater or equal than any other lower bound, then $z$ is the infimum of $A$.\\\n\nlemma inf_glb: \n assumes \"antisym(r)\" \"A\\0\" \"\\x\\A. \\z,x\\ \\ r\" \"\\y. (\\x\\A. \\y,x\\ \\ r) \\ \\y,z\\ \\ r\"\n shows \n \"HasAmaximum(r,\\a\\A. r-``{a})\"\n \"z = Infimum(r,A)\"\nproof -\n let ?B = \"\\a\\A. r-``{a}\"\n from assms(2,3,4) have I: \"z \\ ?B\" \"\\y\\?B. \\y,z\\ \\ r\"\n by auto\n then show \"HasAmaximum(r,\\a\\A. r-``{a})\"\n unfolding HasAmaximum_def by auto\n from assms(1) I show \"z = Infimum(r,A)\"\n using Order_ZF_4_L14 Infimum_def by simp\nqed\n\ntext\\ Supremum and infimum of a singleton is the element. \\\n\nlemma sup_inf_singl: assumes \"antisym(r)\" \"refl(X,r)\" \"z\\X\"\n shows \n \"HasAsupremum(r,{z})\" \"Supremum(r,{z}) = z\" and \n \"HasAnInfimum(r,{z})\" \"Infimum(r,{z}) = z\"\nproof -\n from assms show \"Supremum(r,{z}) = z\" and \"Infimum(r,{z}) = z\" \n using inf_glb Order_ZF_5_L5 unfolding refl_def by auto\n from assms show \"HasAsupremum(r,{z})\" \n using Order_ZF_5_L5 unfolding HasAsupremum_def refl_def by blast\n from assms show \"HasAnInfimum(r,{z})\"\n using inf_glb unfolding HasAnInfimum_def refl_def by blast\nqed\n \ntext\\If a set has a maximum, then the maximum is the supremum. This lemma is obsolete, use\n \\max_is_sup\\ instead.\\\n\nlemma Order_ZF_5_L6: \n assumes A1: \"antisym(r)\" and A2: \"A\\0\" and \n A3: \"HasAmaximum(r,A)\"\n shows \n \"HasAminimum(r,\\a\\A. r``{a})\"\n \"Maximum(r,A) = Supremum(r,A)\"\nproof -\n let ?M = \"Maximum(r,A)\"\n from A1 A3 have I: \"?M \\ A\" and II: \"\\x\\A. \\x,?M\\ \\ r\"\n using Order_ZF_4_L3 by auto\n from I have III: \"\\y. (\\x\\A. \\x,y\\ \\ r) \\ \\?M,y\\ \\ r\"\n by simp\n with A1 A2 II show \"HasAminimum(r,\\a\\A. r``{a})\"\n by (rule Order_ZF_5_L5)\n from A1 A2 II III show \"?M = Supremum(r,A)\"\n by (rule Order_ZF_5_L5)\nqed\n\ntext\\Another version of \\Order_ZF_5_L6\\ that: if a sat has a maximum then it has a supremum and \n the maximum is the supremum. \\\n\nlemma max_is_sup: assumes \"antisym(r)\" \"A\\0\" \"HasAmaximum(r,A)\"\n shows \"HasAsupremum(r,A)\" and \"Maximum(r,A) = Supremum(r,A)\"\nproof -\n let ?M = \"Maximum(r,A)\"\n from assms(1,3) have \"?M \\ A\" and I: \"\\x\\A. \\x,?M\\ \\ r\" using Order_ZF_4_L3 \n by auto\n with assms(1,2) have \"HasAminimum(r,\\a\\A. r``{a})\" using Order_ZF_5_L5(1) \n by blast\n then show \"HasAsupremum(r,A)\" unfolding HasAsupremum_def by simp\n from assms(1,2) \\?M \\ A\\ I show \"?M = Supremum(r,A)\" using Order_ZF_5_L5(2) \n by blast\nqed\n\ntext\\ Minimum is the infimum if it exists.\\\n\nlemma min_is_inf: assumes \"antisym(r)\" \"A\\0\" \"HasAminimum(r,A)\"\n shows \"HasAnInfimum(r,A)\" and \"Minimum(r,A) = Infimum(r,A)\"\nproof -\n let ?M = \"Minimum(r,A)\"\n from assms(1,3) have \"?M\\A\" and I: \"\\x\\A. \\?M,x\\ \\ r\" using Order_ZF_4_L4 \n by auto\n with assms(1,2) have \"HasAmaximum(r,\\a\\A. r-``{a})\" using inf_glb(1) by blast\n then show \"HasAnInfimum(r,A)\" unfolding HasAnInfimum_def by simp\n from assms(1,2) \\?M \\ A\\ I show \"?M = Infimum(r,A)\" using inf_glb(2) by blast\nqed\n\ntext\\For reflexive and total relations two-element set has a minimum and a maximum. \\\n\nlemma min_max_two_el: assumes \"r {is total on} X\" \"x\\X\" \"y\\X\"\n shows \"HasAminimum(r,{x,y})\" and \"HasAmaximum(r,{x,y})\"\n using assms unfolding IsTotal_def HasAminimum_def HasAmaximum_def by auto\n\ntext\\For antisymmetric, reflexive and total relations two-element set has a supremum and infimum. \\\n\nlemma inf_sup_two_el:assumes \"antisym(r)\" \"r {is total on} X\" \"x\\X\" \"y\\X\"\n shows \n \"HasAnInfimum(r,{x,y})\"\n \"Minimum(r,{x,y}) = Infimum(r,{x,y})\"\n \"HasAsupremum(r,{x,y})\"\n \"Maximum(r,{x,y}) = Supremum(r,{x,y})\"\n using assms min_max_two_el max_is_sup min_is_inf by auto\n\ntext\\A sufficient condition for the supremum to be in the space.\\\n\nlemma sup_in_space: \n assumes \"r \\ X\\X\" \"antisym(r)\" \"HasAminimum(r,\\a\\A. r``{a})\"\n shows \"Supremum(r,A) \\ X\" and \"\\x\\A. \\x,Supremum(r,A)\\ \\ r\"\nproof -\n from assms(3) have \"A\\0\" using set_sup_not_empty unfolding HasAsupremum_def by simp\n then obtain a where \"a\\A\" by auto\n with assms(1,2,3) show \"Supremum(r,A) \\ X\" unfolding Supremum_def \n using Order_ZF_4_L4 Order_ZF_5_L1 by blast\n from assms(2,3) show \"\\x\\A. \\x,Supremum(r,A)\\ \\ r\" unfolding Supremum_def\n using Order_ZF_4_L4 by blast\nqed\n\ntext\\A sufficient condition for the infimum to be in the space.\\\n\nlemma inf_in_space: \n assumes \"r \\ X\\X\" \"antisym(r)\" \"HasAmaximum(r,\\a\\A. r-``{a})\"\n shows \"Infimum(r,A) \\ X\" and \"\\x\\A. \\Infimum(r,A),x\\ \\ r\"\nproof -\n from assms(3) have \"A\\0\" using set_inf_not_empty unfolding HasAnInfimum_def by simp\n then obtain a where \"a\\A\" by auto\n with assms(1,2,3) show \"Infimum(r,A) \\ X\" unfolding Infimum_def \n using Order_ZF_4_L3 Order_ZF_5_L1 by blast\n from assms(2,3) show \"\\x\\A. \\Infimum(r,A),x\\ \\ r\" unfolding Infimum_def\n using Order_ZF_4_L3 by blast\nqed\n\ntext\\Properties of supremum of a set for complete relations.\\\n\nlemma Order_ZF_5_L7: \n assumes A1: \"r \\ X\\X\" and A2: \"antisym(r)\" and \n A3: \"r {is complete}\" and\n A4: \"A\\0\" and A5: \"\\x\\X. \\y\\A. \\y,x\\ \\ r\"\n shows \"Supremum(r,A) \\ X\" and \"\\x\\A. \\x,Supremum(r,A)\\ \\ r\"\nproof -\n from A3 A4 A5 have \"HasAminimum(r,\\a\\A. r``{a})\"\n unfolding IsBoundedAbove_def IsComplete_def by blast\n with A1 A2 show \"Supremum(r,A) \\ X\" and \"\\x\\A. \\x,Supremum(r,A)\\ \\ r\"\n using sup_in_space by auto\nqed \n\ntext\\ Infimum of the set of infima of a collection of sets is infimum of the union. \\\n\nlemma inf_inf:\n assumes \n \"r \\ X\\X\" \"antisym(r)\" \"trans(r)\" \n \"\\T\\\\. HasAnInfimum(r,T)\"\n \"HasAnInfimum(r,{Infimum(r,T).T\\\\})\"\n shows \n \"HasAnInfimum(r,\\\\)\" and \"Infimum(r,{Infimum(r,T).T\\\\}) = Infimum(r,\\\\)\"\nproof -\n let ?i = \"Infimum(r,{Infimum(r,T).T\\\\})\"\n note assms(2)\n moreover from assms(4,5) have \"\\\\ \\ 0\" using set_inf_not_empty by blast\n moreover\n have \"\\T\\\\.\\t\\T. \\?i,t\\ \\ r\"\n proof -\n { fix T t assume \"T\\\\\" \"t\\T\"\n with assms(1,2,4) have \"\\Infimum(r,T),t\\ \\ r\"\n unfolding HasAnInfimum_def using inf_in_space(2) by blast\n moreover from assms(1,2,5) \\T\\\\\\ have \"\\?i,Infimum(r,T)\\ \\ r\"\n unfolding HasAnInfimum_def using inf_in_space(2) by blast\n moreover note assms(3)\n ultimately have \"\\?i,t\\ \\ r\" unfolding trans_def by blast\n } thus ?thesis by simp\n qed\n hence I: \"\\t\\\\\\. \\?i,t\\ \\ r\" by auto\n moreover have J: \"\\y. (\\x\\\\\\. \\y,x\\ \\ r) \\ \\y,?i\\ \\ r\"\n proof -\n { fix y x assume A: \"\\x\\\\\\. \\y,x\\ \\ r\"\n with assms(2,4) have \"\\a\\{Infimum(r,T).T\\\\}. \\y,a\\ \\ r\" using inf_geq_lo_bnd\n by simp\n with assms(2,5) have \"\\y,?i\\ \\ r\" by (rule inf_geq_lo_bnd)\n } thus ?thesis by simp\n qed \n ultimately have \"HasAmaximum(r,\\a\\\\\\. r-``{a})\" by (rule inf_glb)\n then show \"HasAnInfimum(r,\\\\)\" unfolding HasAnInfimum_def by simp\n from assms(2) \\\\\\ \\ 0\\ I J show \"?i = Infimum(r,\\\\)\" by (rule inf_glb)\nqed\n\ntext\\ Supremum of the set of suprema of a collection of sets is supremum of the union. \\\n\nlemma sup_sup:\n assumes \n \"r \\ X\\X\" \"antisym(r)\" \"trans(r)\" \n \"\\T\\\\. HasAsupremum(r,T)\"\n \"HasAsupremum(r,{Supremum(r,T).T\\\\})\"\n shows \n \"HasAsupremum(r,\\\\)\" and \"Supremum(r,{Supremum(r,T).T\\\\}) = Supremum(r,\\\\)\"\nproof -\n let ?s = \"Supremum(r,{Supremum(r,T).T\\\\})\"\n note assms(2)\n moreover from assms(4,5) have \"\\\\ \\ 0\" using set_sup_not_empty by blast\n moreover\n have \"\\T\\\\.\\t\\T. \\t,?s\\ \\ r\"\n proof -\n { fix T t assume \"T\\\\\" \"t\\T\"\n with assms(1,2,4) have \"\\t,Supremum(r,T)\\ \\ r\"\n unfolding HasAsupremum_def using sup_in_space(2) by blast\n moreover from assms(1,2,5) \\T\\\\\\ have \"\\Supremum(r,T),?s\\ \\ r\"\n unfolding HasAsupremum_def using sup_in_space(2) by blast\n moreover note assms(3)\n ultimately have \"\\t,?s\\ \\ r\" unfolding trans_def by blast\n } thus ?thesis by simp\n qed\n hence I: \"\\t\\\\\\. \\t,?s\\ \\ r\" by auto\n moreover have J: \"\\y. (\\x\\\\\\. \\x,y\\ \\ r) \\ \\?s,y\\ \\ r\"\n proof -\n { fix y x assume A: \"\\x\\\\\\. \\x,y\\ \\ r\"\n with assms(2,4) have \"\\a\\{Supremum(r,T).T\\\\}. \\a,y\\ \\ r\" using sup_leq_up_bnd\n by simp\n with assms(2,5) have \"\\?s,y\\ \\ r\" by (rule sup_leq_up_bnd)\n } thus ?thesis by simp\n qed \n ultimately have \"HasAminimum(r,\\a\\\\\\. r``{a})\" by (rule Order_ZF_5_L5)\n then show \"HasAsupremum(r,\\\\)\" unfolding HasAsupremum_def by simp\n from assms(2) \\\\\\ \\ 0\\ I J show \"?s = Supremum(r,\\\\)\" by (rule Order_ZF_5_L5)\nqed\n\ntext\\If the relation is a linear order then for any \n element $y$ smaller than the supremum of a set we can\n find one element of the set that is greater than $y$.\\\n\nlemma Order_ZF_5_L8:\n assumes A1: \"r \\ X\\X\" and A2: \"IsLinOrder(X,r)\" and \n A3: \"r {is complete}\" and\n A4: \"A\\X\" \"A\\0\" and A5: \"\\x\\X. \\y\\A. \\y,x\\ \\ r\" and\n A6: \"\\y,Supremum(r,A)\\ \\ r\" \"y \\ Supremum(r,A)\"\n shows \"\\z\\A. \\y,z\\ \\ r \\ y \\ z\"\nproof -\n from A2 have \n I: \"antisym(r)\" and\n II: \"trans(r)\" and\n III: \"r {is total on} X\"\n using IsLinOrder_def by auto\n from A1 A6 have T1: \"y\\X\" by auto\n { assume A7: \"\\z \\ A. \\y,z\\ \\ r \\ y=z\"\n from A4 I have \"antisym(r)\" and \"A\\0\" by auto\n moreover have \"\\x\\A. \\x,y\\ \\ r\" \n proof \n fix x assume A8: \"x\\A\"\n with A4 have T2: \"x\\X\" by auto\n from A7 A8 have \"\\y,x\\ \\ r \\ y=x\" by simp\n with III T1 T2 show \"\\x,y\\ \\ r\"\n\tusing IsTotal_def total_is_refl refl_def by auto\n qed\n moreover have \"\\u. (\\x\\A. \\x,u\\ \\ r) \\ \\y,u\\ \\ r\"\n proof-\n { fix u assume A9: \"\\x\\A. \\x,u\\ \\ r\"\n\tfrom A4 A5 have \"IsBoundedAbove(A,r)\" and \"A\\0\"\n\t using IsBoundedAbove_def by auto\n\twith A3 A4 A6 I A9 have \n\t \"\\y,Supremum(r,A)\\ \\ r \\ \\Supremum(r,A),u\\ \\ r\"\n\t using IsComplete_def Order_ZF_5_L3 by simp\n\twith II have \"\\y,u\\ \\ r\" by (rule Fol1_L3)\n } then show \"\\u. (\\x\\A. \\x,u\\ \\ r) \\ \\y,u\\ \\ r\"\n\tby simp\n qed\n ultimately have \"y = Supremum(r,A)\"\n by (rule Order_ZF_5_L5)\n with A6 have False by simp\n } then show \"\\z\\A. \\y,z\\ \\ r \\ y \\ z\" by auto\nqed\n\nsubsection\\Strict versions of order relations\\\n\ntext\\One of the problems with translating formalized mathematics from\n Metamath to IsarMathLib is that Metamath uses strict orders (of the $<$ \n type) while in IsarMathLib we mostly use nonstrict orders (of the \n $\\leq$ type). \n This doesn't really make any difference, but is annoying as we \n have to prove many theorems twice. In this section we prove some theorems\n to make it easier to translate the statements about strict orders to\n statements about the corresponding non-strict order and vice versa.\\\n\ntext\\We define a strict version of a relation by removing the $y=x$ line \n from the relation.\\\n\ndefinition\n \"StrictVersion(r) \\ r - {\\x,x\\. x \\ domain(r)}\"\n\ntext\\A reformulation of the definition of a strict version of an order.\n\\\n\nlemma def_of_strict_ver: shows \n \"\\x,y\\ \\ StrictVersion(r) \\ \\x,y\\ \\ r \\ x\\y\"\n using StrictVersion_def domain_def by auto\n\ntext\\The next lemma is about the strict version of an antisymmetric\n relation.\\\n\nlemma strict_of_antisym: \n assumes A1: \"antisym(r)\" and A2: \"\\a,b\\ \\ StrictVersion(r)\"\n shows \"\\b,a\\ \\ StrictVersion(r)\"\nproof -\n { assume A3: \"\\b,a\\ \\ StrictVersion(r)\"\n with A2 have \"\\a,b\\ \\ r\" and \"\\b,a\\ \\ r\"\n using def_of_strict_ver by auto\n with A1 have \"a=b\" by (rule Fol1_L4)\n with A2 have False using def_of_strict_ver\n by simp\n } then show \"\\b,a\\ \\ StrictVersion(r)\" by auto\nqed\n\ntext\\The strict version of totality.\\\n\nlemma strict_of_tot:\n assumes \"r {is total on} X\" and \"a\\X\" \"b\\X\" \"a\\b\"\n shows \"\\a,b\\ \\ StrictVersion(r) \\ \\b,a\\ \\ StrictVersion(r)\"\n using assms IsTotal_def def_of_strict_ver by auto\n\ntext\\A trichotomy law for the strict version of a total \n and antisymmetric\n relation. It is kind of interesting that one does not need\n the full linear order for this.\\\n\nlemma strict_ans_tot_trich: \n assumes A1: \"antisym(r)\" and A2: \"r {is total on} X\"\n and A3: \"a\\X\" \"b\\X\"\n and A4: \"s = StrictVersion(r)\"\n shows \"Exactly_1_of_3_holds(\\a,b\\ \\ s, a=b,\\b,a\\ \\ s)\"\nproof -\n let ?p = \"\\a,b\\ \\ s\"\n let ?q = \"a=b\"\n let ?r = \"\\b,a\\ \\ s\"\n from A2 A3 A4 have \"?p \\ ?q \\ ?r\"\n using strict_of_tot by auto\n moreover from A1 A4 have \"?p \\ \\?q \\ \\?r\"\n using def_of_strict_ver strict_of_antisym by simp\n moreover from A4 have \"?q \\ \\?p \\ \\?r\"\n using def_of_strict_ver by simp\n moreover from A1 A4 have \"?r \\ \\?p \\ \\?q\"\n using def_of_strict_ver strict_of_antisym by auto\n ultimately show \"Exactly_1_of_3_holds(?p, ?q, ?r)\"\n by (rule Fol1_L5)\nqed\n\ntext\\A trichotomy law for linear order. This is a special\n case of \\strict_ans_tot_trich\\.\\\n\ncorollary strict_lin_trich: assumes A1: \"IsLinOrder(X,r)\" and\n A2: \"a\\X\" \"b\\X\" and \n A3: \"s = StrictVersion(r)\"\n shows \"Exactly_1_of_3_holds(\\a,b\\ \\ s, a=b,\\b,a\\ \\ s)\"\n using assms IsLinOrder_def strict_ans_tot_trich by auto\n\ntext\\For an antisymmetric relation if a pair is in relation then\n the reversed pair is not in the strict version of the relation. \n\\\n\nlemma geq_impl_not_less: \n assumes A1: \"antisym(r)\" and A2: \"\\a,b\\ \\ r\"\n shows \"\\b,a\\ \\ StrictVersion(r)\"\nproof -\n { assume A3: \"\\b,a\\ \\ StrictVersion(r)\"\n with A2 have \"\\a,b\\ \\ StrictVersion(r)\"\n using def_of_strict_ver by auto\n with A1 A3 have False using strict_of_antisym\n by blast\n } then show \"\\b,a\\ \\ StrictVersion(r)\" by auto\nqed\n \ntext\\If an antisymmetric relation is transitive, \n then the strict version is also transitive, an explicit\n version \\strict_of_transB\\ below.\\\n\nlemma strict_of_transA: \n assumes A1: \"trans(r)\" and A2: \"antisym(r)\" and \n A3: \"s= StrictVersion(r)\" and A4: \"\\a,b\\ \\ s\" \"\\b,c\\ \\ s\"\n shows \"\\a,c\\ \\ s\"\nproof -\n from A3 A4 have I: \"\\a,b\\ \\ r \\ \\b,c\\ \\ r\"\n using def_of_strict_ver by simp\n with A1 have \"\\a,c\\ \\ r\" by (rule Fol1_L3)\n moreover\n { assume \"a=c\"\n with I have \"\\a,b\\ \\ r\" and \"\\b,a\\ \\ r\" by auto\n with A2 have \"a=b\" by (rule Fol1_L4)\n with A3 A4 have False using def_of_strict_ver by simp\n } then have \"a\\c\" by auto\n ultimately have \"\\a,c\\ \\ StrictVersion(r)\"\n using def_of_strict_ver by simp\n with A3 show ?thesis by simp\nqed\n\ntext\\If an antisymmetric relation is transitive, \n then the strict version is also transitive.\\\n\nlemma strict_of_transB: \n assumes A1: \"trans(r)\" and A2: \"antisym(r)\"\n shows \"trans(StrictVersion(r))\"\nproof -\n let ?s = \"StrictVersion(r)\"\n from A1 A2 have \n \"\\ x y z. \\x, y\\ \\ ?s \\ \\y, z\\ \\ ?s \\ \\x, z\\ \\ ?s\"\n using strict_of_transA by blast\n then show \"trans(StrictVersion(r))\" by (rule Fol1_L2)\nqed\n\ntext\\The next lemma provides a condition that is satisfied by\n the strict version of a relation if the original relation \n is a complete linear order.\\\n\nlemma strict_of_compl: \n assumes A1: \"r \\ X\\X\" and A2: \"IsLinOrder(X,r)\" and \n A3: \"r {is complete}\" and \n A4: \"A\\X\" \"A\\0\" and A5: \"s = StrictVersion(r)\" and \n A6: \"\\u\\X. \\y\\A. \\y,u\\ \\ s\"\n shows \n \"\\x\\X. ( \\y\\A. \\x,y\\ \\ s ) \\ (\\y\\X. \\y,x\\ \\ s \\ (\\z\\A. \\y,z\\ \\ s))\"\nproof -\n let ?x = \"Supremum(r,A)\"\n from A2 have I: \"antisym(r)\" using IsLinOrder_def\n by simp\n moreover from A5 A6 have \"\\u\\X. \\y\\A. \\y,u\\ \\ r\"\n using def_of_strict_ver by auto\n moreover note A1 A3 A4 \n ultimately have II: \"?x \\ X\" \"\\y\\A. \\y,?x\\ \\ r\"\n using Order_ZF_5_L7 by auto\n then have III: \"\\x\\X. \\y\\A. \\y,x\\ \\ r\" by auto\n from A5 I II have \"?x \\ X\" \"\\y\\A. \\?x,y\\ \\ s\"\n using geq_impl_not_less by auto\n moreover from A1 A2 A3 A4 A5 III have \n \"\\y\\X. \\y,?x\\ \\ s \\ (\\z\\A. \\y,z\\ \\ s)\"\n using def_of_strict_ver Order_ZF_5_L8 by simp\n ultimately show\n \"\\x\\X. ( \\y\\A. \\x,y\\ \\ s ) \\ (\\y\\X. \\y,x\\ \\ s \\ (\\z\\A. \\y,z\\ \\ s))\"\n by auto\nqed\n\ntext\\Strict version of a relation on a set is a relation on that\n set.\\\n\nlemma strict_ver_rel: assumes A1: \"r \\ A\\A\"\n shows \"StrictVersion(r) \\ A\\A\"\n using assms StrictVersion_def by auto\n\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Order_ZF_1a.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.2918504294154786}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_ref\nimports CSP_F_law_basic CSP_T.CSP_T_law_ref\nbegin\n\n(*****************************************************************\n\n 1. rules for refinement\n\n *****************************************************************)\n\n(*-------------------------------------------------------*\n | refinement and equality |\n *-------------------------------------------------------*)\n\nlemma cspF_ref_eq_iff: \"(P <=F[M,M] Q) = (P =F[M,M] Q |~| P)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_ref_eq_iff)\napply (rule)\n\n(* <= *)\n apply (simp)\n apply (rule order_antisym)\n apply (simp add: subsetF_iff)\n apply (simp add: in_failures)\n apply (simp add: subsetF_iff)\n apply (simp add: in_failures)\n\n(* => *)\n apply (simp)\n apply (erule conjE)\n apply (erule order_antisymE)\n apply (rule)\n apply (rotate_tac 2)\n apply (erule subsetFE_ALL)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: in_failures)\ndone\n\n(*-------------------------------------------------------*\n | decompose Internal choice |\n *-------------------------------------------------------*)\n\n(*** or <= ***) (* unsafe *)\n\nlemma cspF_Int_choice_left1:\n \"P1 <=F[M1,M2] Q ==> P1 |~| P2 <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_choice_left1)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Int_choice_left2:\n \"P2 <=F[M1,M2] Q ==> P1 |~| P2 <=F[M1,M2] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\nby (simp add: cspF_Int_choice_left1)\n\n(*** <= and ***) (* safe *)\n\nlemma cspF_Int_choice_right:\n \"[| P <=F[M1,M2] Q1 ; P <=F[M1,M2] Q2 |]\n ==> P <=F[M1,M2] Q1 |~| Q2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\n(*-------------------------------------------------------*\n | decompose Replicated internal choice |\n *-------------------------------------------------------*)\n\n(*** EX <= ***) (* unsafe *)\n\nlemma cspF_Rep_int_choice_nat_left:\n \"(EX n. n:N & Pf n <=F[M1,M2] Q)\n ==> !nat :N .. Pf <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (rule conjI)\n\napply (rule cspT_Rep_int_choice_left)\napply (fast)\n\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_nat_left_x:\n \"[| n:N ; Pf n <=F[M1,M2] Q |]\n ==> !nat :N .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_nat_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_set_left:\n \"(EX X. X:Xs & Pf X <=F[M1,M2] Q)\n ==> !set :Xs .. Pf <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (rule conjI)\n\napply (rule cspT_Rep_int_choice_left)\napply (fast)\n\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_left_x:\n \"[| X:Xs ; Pf X <=F[M1,M2] Q |]\n ==> !set :Xs .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_set_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_com_left:\n \"(EX a. a:X & Pf a <=F[M1,M2] Q)\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (simp add: Rep_int_choice_com_def)\napply (rule cspF_Rep_int_choice_set_left)\napply (erule exE)\napply (rule_tac x=\"{a}\" in exI)\napply (auto)\ndone\n\nlemma cspF_Rep_int_choice_com_left_x:\n \"[| a:X ; Pf a <=F[M1,M2] Q |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_com_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_f_left:\n \"[| inj f ; (EX a. a:X & Pf a <=F[M1,M2] Q) |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (simp add: Rep_int_choice_f_def)\napply (rule cspF_Rep_int_choice_com_left)\napply (erule exE)\napply (rule_tac x=\"f a\" in exI)\napply (auto)\ndone\n\nlemma cspF_Rep_int_choice_f_left_x:\n \"[| inj f ; a:X ; Pf a <=F[M1,M2] Q |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_f_left)\napply (simp)\nby (fast)\n\nlemmas cspF_Rep_int_choice_left = cspF_Rep_int_choice_nat_left\n cspF_Rep_int_choice_set_left\n cspF_Rep_int_choice_com_left\n cspF_Rep_int_choice_f_left\n\nlemmas cspF_Rep_int_choice_left_x = cspF_Rep_int_choice_nat_left_x\n cspF_Rep_int_choice_set_left_x\n cspF_Rep_int_choice_com_left_x\n cspF_Rep_int_choice_f_left_x\n\n(*** <= ALL ***) (* safe *)\n\nlemma cspF_Rep_int_choice_nat_right:\n \"[| !!n. n:N ==> P <=F[M1,M2] Qf n |]\n ==> P <=F[M1,M2] !nat :N .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_right:\n \"[| !!X. X:Xs ==> P <=F[M1,M2] Qf X |]\n ==> P <=F[M1,M2] !set :Xs .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_right:\n \"[| !!a. a:X ==> P <=F[M1,M2] Qf a |]\n ==> P <=F[M1,M2] ! :X .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_right:\n \"[| inj f ; !!a. a:X ==> P <=F[M1,M2] Qf a |]\n ==> P <=F[M1,M2] ! :X .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_right \n = cspF_Rep_int_choice_nat_right\n cspF_Rep_int_choice_set_right\n cspF_Rep_int_choice_com_right\n cspF_Rep_int_choice_f_right\n\n(* 1,2,3,f E *)\n\nlemma cspF_Rep_int_choice_nat_rightE:\n \"[| P <=F[M1,M2] !nat :N .. Qf ;\n ALL n:N. P <=F[M1,M2] Qf n ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_rightE:\n \"[| P <=F[M1,M2] !set :Xs .. Qf ;\n ALL X:Xs. P <=F[M1,M2] Qf X ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_rightE:\n \"[| P <=F[M1,M2] ! :X .. Qf ;\n ALL a:X. P <=F[M1,M2] Qf a ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_rightE:\n \"[| P <=F[M1,M2] ! :X .. Qf ; inj f ;\n [| ALL a:X. P <=F[M1,M2] Qf a |] ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\napply (simp)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_rightE =\n cspF_Rep_int_choice_nat_rightE\n cspF_Rep_int_choice_set_rightE\n cspF_Rep_int_choice_com_rightE\n cspF_Rep_int_choice_f_rightE\n\n(*-------------------------------------------------------*\n | decomposition with subset |\n *-------------------------------------------------------*)\n\nlemma cspF_Rep_int_choice_nat_subset:\n \"[| N2 <= N1 ; !!n. n:N2 ==> Pf n <=F[M1,M2] Qf n |]\n ==> !nat :N1 .. Pf <=F[M1,M2] !nat :N2 .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_subset:\n \"[| Ys <= Xs ; !!X. X:Ys ==> Pf X <=F[M1,M2] Qf X |]\n ==> !set :Xs .. Pf <=F[M1,M2] !set :Ys .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_subset:\n \"[| Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! :X .. Pf <=F[M1,M2] ! :Y .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_subset:\n \"[| inj f ; Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! :X .. Pf <=F[M1,M2] ! :Y .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_subset \n = cspF_Rep_int_choice_nat_subset\n cspF_Rep_int_choice_set_subset\n cspF_Rep_int_choice_com_subset\n cspF_Rep_int_choice_f_subset\n\n(*** ! x:X .. and ? -> ***)\n\nlemma cspF_Int_Ext_pre_choice_subset:\n \"[| Y ~={} ; Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! x:X .. (x -> Pf x) <=F[M1,M2]\n ? :Y -> Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_Ext_pre_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_decompo_subset = cspF_Rep_int_choice_subset\n cspF_Int_Ext_pre_choice_subset\n\n(*-------------------------------------------------------*\n | decompose external choice |\n *-------------------------------------------------------*)\n\nlemma cspF_Ext_choice_right:\n \"[| P <=F[M1,M2] Q1 ;\n P <=F[M1,M2] Q2 |]\n ==> P <=F[M1,M2] Q1 [+] Q2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_right)\napply (rule)\n\n apply (simp add: in_failures)\n apply (elim disjE conjE exE, simp)\n apply (force, force, force)\n apply (simp_all)\n\n apply (subgoal_tac \"(<>, X) :f failures(Q1) M2\")\n apply (force)\n apply (rule proc_F2_F4)\n apply (simp_all)\n apply (rule proc_F2_F4)\n apply (simp_all)\n apply (simp add: cspT_semantics)\n apply (auto)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2918031064899669}} {"text": "(* Title: AWN_SOS.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke\n*)\n\nsection \"Semantics of the Algebra of Wireless Networks\"\n\ntheory AWN_SOS\nimports TransitionSystems AWN\nbegin\n\nsubsection \"Table 1: Structural operational semantics for sequential process expressions \"\n\ninductive_set\n seqp_sos\n :: \"('s, 'm, 'p, 'l) seqp_env \\ ('s \\ ('s, 'm, 'p, 'l) seqp, 'm seq_action) transition set\"\n for \\ :: \"('s, 'm, 'p, 'l) seqp_env\"\nwhere\n broadcastT: \"((\\, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g).p), broadcast (s\\<^sub>m\\<^sub>s\\<^sub>g \\), (\\, p)) \\ seqp_sos \\\"\n | groupcastT: \"((\\, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g).p), groupcast (s\\<^sub>i\\<^sub>p\\<^sub>s \\) (s\\<^sub>m\\<^sub>s\\<^sub>g \\), (\\, p)) \\ seqp_sos \\\"\n | unicastT: \"((\\, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g).p \\ q), unicast (s\\<^sub>i\\<^sub>p \\) (s\\<^sub>m\\<^sub>s\\<^sub>g \\), (\\, p)) \\ seqp_sos \\\"\n | notunicastT:\"((\\, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g).p \\ q), \\unicast (s\\<^sub>i\\<^sub>p \\), (\\, q)) \\ seqp_sos \\\"\n | sendT: \"((\\, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g).p), send (s\\<^sub>m\\<^sub>s\\<^sub>g \\), (\\, p)) \\ seqp_sos \\\"\n | deliverT: \"((\\, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a).p), deliver (s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a \\), (\\, p)) \\ seqp_sos \\\"\n | receiveT: \"((\\, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g).p), receive msg, (u\\<^sub>m\\<^sub>s\\<^sub>g msg \\, p)) \\ seqp_sos \\\"\n | assignT: \"((\\, {l}\\u\\ p), \\, (u \\, p)) \\ seqp_sos \\\"\n\n | callT: \"\\ ((\\, \\ pn), a, (\\', p')) \\ seqp_sos \\ \\ \\\n ((\\, call(pn)), a, (\\', p')) \\ seqp_sos \\\" (* TPB: quite different to Table 1 *)\n\n | choiceT1: \"((\\, p), a, (\\', p')) \\ seqp_sos \\ \\ ((\\, p \\ q), a, (\\', p')) \\ seqp_sos \\\"\n | choiceT2: \"((\\, q), a, (\\', q')) \\ seqp_sos \\ \\ ((\\, p \\ q), a, (\\', q')) \\ seqp_sos \\\"\n\n | guardT: \"\\' \\ g \\ \\ ((\\, {l}\\g\\ p), \\, (\\', p)) \\ seqp_sos \\\"\n\ninductive_cases\n seqp_callTE [elim]: \"((\\, call(pn)), a, (\\', q)) \\ seqp_sos \\\"\n and seqp_choiceTE [elim]: \"((\\, p1 \\ p2), a, (\\', q)) \\ seqp_sos \\\"\n\nlemma seqp_broadcastTE [elim]:\n \"\\((\\, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\;\n \\a = broadcast (s\\<^sub>m\\<^sub>s\\<^sub>g \\); \\' = \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\\") simp\n\nlemma seqp_groupcastTE [elim]:\n \"\\((\\, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\;\n \\a = groupcast (s\\<^sub>i\\<^sub>p\\<^sub>s \\) (s\\<^sub>m\\<^sub>s\\<^sub>g \\); \\' = \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\\") simp\n\nlemma seqp_unicastTE [elim]:\n \"\\((\\, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g). p \\ q), a, (\\', r)) \\ seqp_sos \\;\n \\a = unicast (s\\<^sub>i\\<^sub>p \\) (s\\<^sub>m\\<^sub>s\\<^sub>g \\); \\' = \\; r = p\\ \\ P;\n \\a = \\unicast (s\\<^sub>i\\<^sub>p \\); \\' = \\; r = q\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g). p \\ q), a, (\\', r)) \\ seqp_sos \\\") simp_all\n\nlemma seqp_sendTE [elim]:\n \"\\((\\, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\;\n \\a = send (s\\<^sub>m\\<^sub>s\\<^sub>g \\); \\' = \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\\") simp\n\nlemma seqp_deliverTE [elim]:\n \"\\((\\, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a). p), a, (\\', q)) \\ seqp_sos \\;\n \\a = deliver (s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a \\); \\' = \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a). p), a, (\\', q)) \\ seqp_sos \\\") simp\n\nlemma seqp_receiveTE [elim]:\n \"\\((\\, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\;\n \\msg. \\a = receive msg; \\' = u\\<^sub>m\\<^sub>s\\<^sub>g msg \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\', q)) \\ seqp_sos \\\") simp\n\nlemma seqp_assignTE [elim]:\n \"\\((\\, {l}\\u\\ p), a, (\\', q)) \\ seqp_sos \\; \\a = \\; \\' = u \\; q = p\\ \\ P\\ \\ P\"\n by (ind_cases \"((\\, {l}\\u\\ p), a, (\\', q)) \\ seqp_sos \\\") simp\n\n\n\nlemmas seqpTEs =\n seqp_broadcastTE\n seqp_groupcastTE\n seqp_unicastTE\n seqp_sendTE\n seqp_deliverTE\n seqp_receiveTE\n seqp_assignTE\n seqp_callTE\n seqp_choiceTE\n seqp_guardTE\n\ndeclare seqp_sos.intros [intro]\n\nsubsection \"Table 2: Structural operational semantics for parallel process expressions \"\n\ninductive_set\n parp_sos :: \"('s1, 'm seq_action) transition set\n \\ ('s2, 'm seq_action) transition set\n \\ ('s1 \\ 's2, 'm seq_action) transition set\"\n for S :: \"('s1, 'm seq_action) transition set\"\n and T :: \"('s2, 'm seq_action) transition set\"\nwhere\n parleft: \"\\ (s, a, s') \\ S; \\m. a \\ receive m \\ \\ ((s, t), a, (s', t)) \\ parp_sos S T\"\n | parright: \"\\ (t, a, t') \\ T; \\m. a \\ send m \\ \\ ((s, t), a, (s, t')) \\ parp_sos S T\"\n | parboth: \"\\ (s, receive m, s') \\ S; (t, send m, t') \\ T \\\n \\((s, t), \\, (s', t')) \\ parp_sos S T\"\n\nlemma par_broadcastTE [elim]:\n \"\\((s, t), broadcast m, (s', t')) \\ parp_sos S T;\n \\(s, broadcast m, s') \\ S; t' = t\\ \\ P;\n \\(t, broadcast m, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), broadcast m, (s', t')) \\ parp_sos S T\") simp_all\n\nlemma par_groupcastTE [elim]:\n \"\\((s, t), groupcast ips m, (s', t')) \\ parp_sos S T;\n \\(s, groupcast ips m, s') \\ S; t' = t\\ \\ P;\n \\(t, groupcast ips m, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), groupcast ips m, (s', t')) \\ parp_sos S T\") simp_all\n\nlemma par_unicastTE [elim]:\n \"\\((s, t), unicast i m, (s', t')) \\ parp_sos S T;\n \\(s, unicast i m, s') \\ S; t' = t\\ \\ P;\n \\(t, unicast i m, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), unicast i m, (s', t')) \\ parp_sos S T\") simp_all\n\nlemma par_notunicastTE [elim]:\n \"\\((s, t), notunicast i, (s', t')) \\ parp_sos S T;\n \\(s, notunicast i, s') \\ S; t' = t\\ \\ P;\n \\(t, notunicast i, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), notunicast i, (s', t')) \\ parp_sos S T\") simp_all\n\nlemma par_sendTE [elim]:\n \"\\((s, t), send m, (s', t')) \\ parp_sos S T;\n \\(s, send m, s') \\ S; t' = t\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), send m, (s', t')) \\ parp_sos S T\") auto\n\nlemma par_deliverTE [elim]:\n \"\\((s, t), deliver d, (s', t')) \\ parp_sos S T;\n \\(s, deliver d, s') \\ S; t' = t\\ \\ P;\n \\(t, deliver d, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), deliver d, (s', t')) \\ parp_sos S T\") simp_all\n\nlemma par_receiveTE [elim]:\n \"\\((s, t), receive m, (s', t')) \\ parp_sos S T;\n \\(t, receive m, t') \\ T; s' = s\\ \\ P\\ \\ P\"\n by (ind_cases \"((s, t), receive m, (s', t')) \\ parp_sos S T\") auto\n\ninductive_cases par_tauTE: \"((s, t), \\, (s', t')) \\ parp_sos S T\"\n\nlemmas parpTEs =\n par_broadcastTE\n par_groupcastTE\n par_unicastTE\n par_notunicastTE\n par_sendTE\n par_deliverTE\n par_receiveTE\n\nlemma parp_sos_cases [elim]:\n assumes \"((s, t), a, (s', t')) \\ parp_sos S T\"\n and \"\\ (s, a, s') \\ S; \\m. a \\ receive m; t' = t \\ \\ P\"\n and \"\\ (t, a, t') \\ T; \\m. a \\ send m; s' = s \\ \\ P\"\n and \"\\m. \\ (s, receive m, s') \\ S; (t, send m, t') \\ T \\ \\ P\"\n shows \"P\"\n using assms by cases auto\n\ndefinition\n par_comp :: \"('s1, 'm seq_action) automaton\n \\ ('s2, 'm seq_action) automaton\n \\ ('s1 \\ 's2, 'm seq_action) automaton\"\n (\"(_ \\\\ _)\" [102, 103] 102)\nwhere\n \"s \\\\ t \\ \\ init = init s \\ init t, trans = parp_sos (trans s) (trans t) \\\"\n\nlemma trans_par_comp [simp]:\n \"trans (s \\\\ t) = parp_sos (trans s) (trans t)\"\n unfolding par_comp_def by simp\n\nlemma init_par_comp [simp]:\n \"init (s \\\\ t) = init s \\ init t\"\n unfolding par_comp_def by simp\n\nsubsection \"Table 3: Structural operational semantics for node expressions \"\n\ninductive_set\n node_sos :: \"('s, 'm seq_action) transition set \\ ('s net_state, 'm node_action) transition set\"\n for S :: \"('s, 'm seq_action) transition set\"\nwhere\n node_bcast:\n \"(s, broadcast m, s') \\ S \\ (NodeS i s R, R:*cast(m), NodeS i s' R) \\ node_sos S\"\n | node_gcast:\n \"(s, groupcast D m, s') \\ S \\ (NodeS i s R, (R\\D):*cast(m), NodeS i s' R) \\ node_sos S\"\n | node_ucast:\n \"\\ (s, unicast d m, s') \\ S; d\\R \\ \\ (NodeS i s R, {d}:*cast(m), NodeS i s' R) \\ node_sos S\"\n | node_notucast:\n \"\\ (s, \\unicast d, s') \\ S; d\\R \\ \\ (NodeS i s R, \\, NodeS i s' R) \\ node_sos S\"\n | node_deliver:\n \"(s, deliver d, s') \\ S \\ (NodeS i s R, i:deliver(d), NodeS i s' R) \\ node_sos S\"\n | node_receive:\n \"(s, receive m, s') \\ S \\ (NodeS i s R, {i}\\{}:arrive(m), NodeS i s' R) \\ node_sos S\"\n | node_tau:\n \"(s, \\, s') \\ S \\ (NodeS i s R, \\, NodeS i s' R) \\ node_sos S\"\n | node_arrive:\n \"(NodeS i s R, {}\\{i}:arrive(m), NodeS i s R) \\ node_sos S\"\n | node_connect1:\n \"(NodeS i s R, connect(i, i'), NodeS i s (R \\ {i'})) \\ node_sos S\"\n | node_connect2:\n \"(NodeS i s R, connect(i', i), NodeS i s (R \\ {i'})) \\ node_sos S\"\n | node_disconnect1:\n \"(NodeS i s R, disconnect(i, i'), NodeS i s (R - {i'})) \\ node_sos S\"\n | node_disconnect2:\n \"(NodeS i s R, disconnect(i', i), NodeS i s (R - {i'})) \\ node_sos S\"\n | node_connect_other:\n \"\\ i \\ i'; i \\ i'' \\ \\ (NodeS i s R, connect(i', i''), NodeS i s R) \\ node_sos S\"\n | node_disconnect_other:\n \"\\ i \\ i'; i \\ i'' \\ \\ (NodeS i s R, disconnect(i', i''), NodeS i s R) \\ node_sos S\"\n\ninductive_cases node_arriveTE: \"(NodeS i s R, ii\\ni:arrive(m), NodeS i s' R) \\ node_sos S\"\n and node_arriveTE': \"(NodeS i s R, H\\K:arrive(m), s') \\ node_sos S\"\n and node_castTE: \"(NodeS i s R, RM:*cast(m), NodeS i s' R') \\ node_sos S\"\n and node_castTE': \"(NodeS i s R, RM:*cast(m), s') \\ node_sos S\"\n and node_deliverTE: \"(NodeS i s R, i:deliver(d), NodeS i s' R) \\ node_sos S\"\n and node_deliverTE': \"(s, i:deliver(d), s') \\ node_sos S\"\n and node_deliverTE'': \"(NodeS ii s R, i:deliver(d), s') \\ node_sos S\"\n and node_tauTE: \"(NodeS i s R, \\, NodeS i s' R) \\ node_sos S\"\n and node_tauTE': \"(NodeS i s R, \\, s') \\ node_sos S\"\n and node_connectTE: \"(NodeS ii s R, connect(i, i'), NodeS ii s' R') \\ node_sos S\"\n and node_connectTE': \"(NodeS ii s R, connect(i, i'), s') \\ node_sos S\"\n and node_disconnectTE: \"(NodeS ii s R, disconnect(i, i'), NodeS ii s' R') \\ node_sos S\"\n and node_disconnectTE': \"(NodeS ii s R, disconnect(i, i'), s') \\ node_sos S\"\n\nlemma node_sos_never_newpkt [simp]:\n assumes \"(s, a, s') \\ node_sos S\"\n shows \"a \\ i:newpkt(d, di)\"\n using assms by cases auto\n\nlemma arrives_or_not:\n assumes \"(NodeS i s R, ii\\ni:arrive(m), NodeS i' s' R') \\ node_sos S\"\n shows \"(ii = {i} \\ ni = {}) \\ (ii = {} \\ ni = {i})\"\n using assms by rule simp_all\n\ndefinition\n node_comp :: \"ip \\ ('s, 'm seq_action) automaton \\ ip set\n \\ ('s net_state, 'm node_action) automaton\"\n (\"(\\_ : (_) : _\\)\" [0, 0, 0] 104)\nwhere\n \"\\i : np : R\\<^sub>i\\ \\ \\ init = {NodeS i s R\\<^sub>i|s. s \\ init np}, trans = node_sos (trans np) \\\"\n\nlemma trans_node_comp:\n \"trans (\\i : np : R\\<^sub>i\\) = node_sos (trans np)\"\n unfolding node_comp_def by simp\n\nlemma init_node_comp:\n \"init (\\i : np : R\\<^sub>i\\) = {NodeS i s R\\<^sub>i|s. s \\ init np}\"\n unfolding node_comp_def by simp\n\nlemmas node_comps = trans_node_comp init_node_comp\n\nlemma trans_par_node_comp [simp]:\n \"trans (\\i : s \\\\ t : R\\) = node_sos (parp_sos (trans s) (trans t))\"\n unfolding node_comp_def by simp\n\nlemma snd_par_node_comp [simp]:\n \"init (\\i : s \\\\ t : R\\) = {NodeS i st R|st. st \\ init s \\ init t}\"\n unfolding node_comp_def by simp\n\nlemma node_sos_dest_is_net_state:\n assumes \"(s, a, s') \\ node_sos S\"\n shows \"\\i' P' R'. s' = NodeS i' P' R'\"\n using assms by induct auto\n\nlemma node_sos_dest:\n assumes \"(NodeS i p R, a, s') \\ node_sos S\"\n shows \"\\P' R'. s' = NodeS i P' R'\"\n using assms assms [THEN node_sos_dest_is_net_state]\n by - (erule node_sos.cases, auto)\n\nlemma node_sos_states [elim]:\n assumes \"(ns, a, ns') \\ node_sos S\"\n obtains i s R s' R' where \"ns = NodeS i s R\"\n and \"ns' = NodeS i s' R'\"\n proof -\n assume [intro!]: \"\\i s R s' R'. ns = NodeS i s R \\ ns' = NodeS i s' R' \\ thesis\"\n from assms(1) obtain i s R where \"ns = NodeS i s R\"\n by (cases ns) auto\n moreover with assms(1) obtain s' R' where \"ns' = NodeS i s' R'\"\n by (metis node_sos_dest)\n ultimately show thesis ..\n qed\n\nlemma node_sos_cases [elim]:\n \"(NodeS i p R, a, NodeS i p' R') \\ node_sos S \\\n (\\m . \\ a = R:*cast(m); R' = R; (p, broadcast m, p') \\ S \\ \\ P) \\\n (\\m D. \\ a = (R \\ D):*cast(m); R' = R; (p, groupcast D m, p') \\ S \\ \\ P) \\\n (\\d m. \\ a = {d}:*cast(m); R' = R; (p, unicast d m, p') \\ S; d \\ R \\ \\ P) \\\n (\\d. \\ a = \\; R' = R; (p, \\unicast d, p') \\ S; d \\ R \\ \\ P) \\\n (\\d. \\ a = i:deliver(d); R' = R; (p, deliver d, p') \\ S \\ \\ P) \\\n (\\m. \\ a = {i}\\{}:arrive(m); R' = R; (p, receive m, p') \\ S \\ \\ P) \\\n ( \\ a = \\; R' = R; (p, \\, p') \\ S \\ \\ P) \\\n (\\m. \\ a = {}\\{i}:arrive(m); R' = R; p = p' \\ \\ P) \\\n (\\i i'. \\ a = connect(i, i'); R' = R \\ {i'}; p = p' \\ \\ P) \\\n (\\i i'. \\ a = connect(i', i); R' = R \\ {i'}; p = p' \\ \\ P) \\\n (\\i i'. \\ a = disconnect(i, i'); R' = R - {i'}; p = p' \\ \\ P) \\\n (\\i i'. \\ a = disconnect(i', i); R' = R - {i'}; p = p' \\ \\ P) \\\n (\\i i' i''. \\ a = connect(i', i''); R' = R; p = p'; i \\ i'; i \\ i'' \\ \\ P) \\\n (\\i i' i''. \\ a = disconnect(i', i''); R' = R; p = p'; i \\ i'; i \\ i'' \\ \\ P) \\\n P\"\n by (erule node_sos.cases) simp_all\n\nsubsection \"Table 4: Structural operational semantics for partial network expressions \"\n\ninductive_set\n pnet_sos :: \"('s net_state, 'm node_action) transition set\n \\ ('s net_state, 'm node_action) transition set\n \\ ('s net_state, 'm node_action) transition set\"\n for S :: \"('s net_state, 'm node_action) transition set\"\n and T :: \"('s net_state, 'm node_action) transition set\"\nwhere\n pnet_cast1: \"\\ (s, R:*cast(m), s') \\ S; (t, H\\K:arrive(m), t') \\ T; H \\ R; K \\ R = {} \\\n \\ (SubnetS s t, R:*cast(m), SubnetS s' t') \\ pnet_sos S T\"\n\n | pnet_cast2: \"\\ (s, H\\K:arrive(m), s') \\ S; (t, R:*cast(m), t') \\ T; H \\ R; K \\ R = {} \\\n \\ (SubnetS s t, R:*cast(m), SubnetS s' t') \\ pnet_sos S T\"\n\n | pnet_arrive: \"\\ (s, H\\K:arrive(m), s') \\ S; (t, H'\\K':arrive(m), t') \\ T \\\n \\ (SubnetS s t, (H \\ H')\\(K \\ K'):arrive(m), SubnetS s' t') \\ pnet_sos S T\"\n\n | pnet_deliver1: \"(s, i:deliver(d), s') \\ S\n \\ (SubnetS s t, i:deliver(d), SubnetS s' t) \\ pnet_sos S T\"\n | pnet_deliver2: \"\\ (t, i:deliver(d), t') \\ T \\\n \\ (SubnetS s t, i:deliver(d), SubnetS s t') \\ pnet_sos S T\"\n\n | pnet_tau1: \"(s, \\, s') \\ S \\ (SubnetS s t, \\, SubnetS s' t) \\ pnet_sos S T\"\n | pnet_tau2: \"(t, \\, t') \\ T \\ (SubnetS s t, \\, SubnetS s t') \\ pnet_sos S T\"\n\n | pnet_connect: \"\\ (s, connect(i, i'), s') \\ S; (t, connect(i, i'), t') \\ T \\\n \\ (SubnetS s t, connect(i, i'), SubnetS s' t') \\ pnet_sos S T\"\n\n | pnet_disconnect: \"\\ (s, disconnect(i, i'), s') \\ S; (t, disconnect(i, i'), t') \\ T \\\n \\ (SubnetS s t, disconnect(i, i'), SubnetS s' t') \\ pnet_sos S T\"\n\ninductive_cases partial_castTE [elim]: \"(s, R:*cast(m), s') \\ pnet_sos S T\"\n and partial_arriveTE [elim]: \"(s, H\\K:arrive(m), s') \\ pnet_sos S T\"\n and partial_deliverTE [elim]: \"(s, i:deliver(d), s') \\ pnet_sos S T\"\n and partial_tauTE [elim]: \"(s, \\, s') \\ pnet_sos S T\"\n and partial_connectTE [elim]: \"(s, connect(i, i'), s') \\ pnet_sos S T\"\n and partial_disconnectTE [elim]: \"(s, disconnect(i, i'), s') \\ pnet_sos S T\"\n\nlemma pnet_sos_never_newpkt:\n assumes \"(st, a, st') \\ pnet_sos S T\"\n and \"\\i d di a s s'. (s, a, s') \\ S \\ a \\ i:newpkt(d, di)\"\n and \"\\i d di a t t'. (t, a, t') \\ T \\ a \\ i:newpkt(d, di)\"\n shows \"a \\ i:newpkt(d, di)\"\n using assms(1) by cases (auto dest!: assms(2-3))\n\nfun pnet :: \"(ip \\ ('s, 'm seq_action) automaton)\n \\ net_tree \\ ('s net_state, 'm node_action) automaton\"\nwhere\n \"pnet np (\\i; R\\<^sub>i\\) = \\i : np i : R\\<^sub>i\\\"\n | \"pnet np (p\\<^sub>1 \\ p\\<^sub>2) = \\ init = {SubnetS s\\<^sub>1 s\\<^sub>2 |s\\<^sub>1 s\\<^sub>2. s\\<^sub>1 \\ init (pnet np p\\<^sub>1)\n \\ s\\<^sub>2 \\ init (pnet np p\\<^sub>2)},\n trans = pnet_sos (trans (pnet np p\\<^sub>1)) (trans (pnet np p\\<^sub>2)) \\\"\n\nlemma pnet_node_init [elim, simp]:\n assumes \"s \\ init (pnet np \\i; R\\)\"\n shows \"s \\ { NodeS i s R |s. s \\ init (np i)}\"\n using assms by (simp add: node_comp_def)\n\nlemma pnet_node_init' [elim]:\n assumes \"s \\ init (pnet np \\i; R\\)\"\n obtains ns where \"s = NodeS i ns R\"\n and \"ns \\ init (np i)\"\n using assms by (auto simp add: node_comp_def)\n\nlemma pnet_node_trans [elim, simp]:\n assumes \"(s, a, s') \\ trans (pnet np \\i; R\\)\"\n shows \"(s, a, s') \\ node_sos (trans (np i))\"\n using assms by (simp add: trans_node_comp)\n\nlemma pnet_never_newpkt':\n assumes \"(s, a, s') \\ trans (pnet np n)\"\n shows \"\\i d di. a \\ i:newpkt(d, di)\"\n using assms proof (induction n arbitrary: s a s')\n fix n1 n2 s a s'\n assume IH1: \"\\s a s'. (s, a, s') \\ trans (pnet np n1) \\ \\i d di. a \\ i:newpkt(d, di)\"\n and IH2: \"\\s a s'. (s, a, s') \\ trans (pnet np n2) \\ \\i d di. a \\ i:newpkt(d, di)\"\n and \"(s, a, s') \\ trans (pnet np (n1 \\ n2))\"\n show \"\\i d di. a \\ i:newpkt(d, di)\"\n proof (intro allI)\n fix i d di\n from \\(s, a, s') \\ trans (pnet np (n1 \\ n2))\\\n have \"(s, a, s') \\ pnet_sos (trans (pnet np n1)) (trans (pnet np n2))\"\n by simp\n thus \"a \\ i:newpkt(d, di)\"\n by (rule pnet_sos_never_newpkt) (auto dest!: IH1 IH2)\n qed\n qed (simp add: node_comps)\n\nlemma pnet_never_newpkt:\n assumes \"(s, a, s') \\ trans (pnet np n)\"\n shows \"a \\ i:newpkt(d, di)\"\n proof -\n from assms have \"\\i d di. a \\ i:newpkt(d, di)\"\n by (rule pnet_never_newpkt')\n thus ?thesis by clarsimp\n qed\n\nsubsection \"Table 5: Structural operational semantics for complete network expressions \"\n\ninductive_set\n cnet_sos :: \"('s, ('m::msg) node_action) transition set\n \\ ('s, 'm node_action) transition set\"\n for S :: \"('s, 'm node_action) transition set\"\nwhere\n cnet_connect: \"(s, connect(i, i'), s') \\ S \\ (s, connect(i, i'), s') \\ cnet_sos S\"\n | cnet_disconnect: \"(s, disconnect(i, i'), s') \\ S \\ (s, disconnect(i, i'), s') \\ cnet_sos S\"\n | cnet_cast: \"(s, R:*cast(m), s') \\ S \\ (s, \\, s') \\ cnet_sos S\"\n | cnet_tau: \"(s, \\, s') \\ S \\ (s, \\, s') \\ cnet_sos S\"\n | cnet_deliver: \"(s, i:deliver(d), s') \\ S \\ (s, i:deliver(d), s') \\ cnet_sos S\"\n | cnet_newpkt: \"(s, {i}\\K:arrive(newpkt(d, di)), s') \\ S \\ (s, i:newpkt(d, di), s') \\ cnet_sos S\"\n\ninductive_cases connect_completeTE: \"(s, connect(i, i'), s') \\ cnet_sos S\"\n and disconnect_completeTE: \"(s, disconnect(i, i'), s') \\ cnet_sos S\"\n and tau_completeTE: \"(s, \\, s') \\ cnet_sos S\"\n and deliver_completeTE: \"(s, i:deliver(d), s') \\ cnet_sos S\"\n and newpkt_completeTE: \"(s, i:newpkt(d, di), s') \\ cnet_sos S\"\n\nlemmas completeTEs = connect_completeTE\n disconnect_completeTE\n tau_completeTE\n deliver_completeTE\n newpkt_completeTE\n\nlemma complete_no_cast [simp]:\n \"(s, R:*cast(m), s') \\ cnet_sos T\"\n proof\n assume \"(s, R:*cast(m), s') \\ cnet_sos T\"\n hence \"R:*cast(m) \\ R:*cast(m)\"\n by (rule cnet_sos.cases) auto\n thus False by simp\n qed\n\nlemma complete_no_arrive [simp]:\n \"(s, ii\\ni:arrive(m), s') \\ cnet_sos T\"\n proof\n assume \"(s, ii\\ni:arrive(m), s') \\ cnet_sos T\"\n hence \"ii\\ni:arrive(m) \\ ii\\ni:arrive(m)\"\n by (rule cnet_sos.cases) auto\n thus False by simp\n qed\n\nabbreviation\n closed :: \"('s net_state, ('m::msg) node_action) automaton \\ ('s net_state, 'm node_action) automaton\"\nwhere\n \"closed \\ (\\A. A \\ trans := cnet_sos (trans A) \\)\"\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AWN/AWN_SOS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.2917034689353762}} {"text": "theory Proofs2\n imports Requirements VCTheoryLemmas\nbegin\n\ndefinition inv2 where \"inv2 s \\ R2 s \\ extraInv s\"\n\ntheorem proof_2_1: \"VC1 inv2 s0\"\n apply(unfold VC1_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_338: \"VC338 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC338_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_339: \"VC339 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC339_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_340: \"VC340 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC340_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_341: \"VC341 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC341_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_342: \"VC342 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC342_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_343: \"VC343 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC343_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_344: \"VC344 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC344_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_345: \"VC345 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC345_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_346: \"VC346 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC346_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_347: \"VC347 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC347_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_348: \"VC348 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC348_def inv2_def R2_def extraInv_def)\n by auto\n\ntheorem proof_2_362: \"VC362 R2 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC362_def inv2_def R2_def extraInv_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n apply((rule allI)+)\n apply(rule impI)\n apply(simp split: if_splits)\n using substate_toEnvNum_id apply blast\n by auto\n\nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proofs2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.29170346893537613}} {"text": "(* Title: HOL/Extraction.thy\n Author: Stefan Berghofer, TU Muenchen\n*)\n\nsection {* Program extraction for HOL *}\n\ntheory Extraction\nimports Option\nbegin\n\nML_file \"Tools/rewrite_hol_proof.ML\"\n\nsubsection {* Setup *}\n\nsetup {*\n Extraction.add_types\n [(\"bool\", ([], NONE))] #>\n Extraction.set_preprocessor (fn thy =>\n Proofterm.rewrite_proof_notypes\n ([], RewriteHOLProof.elim_cong :: ProofRewriteRules.rprocs true) o\n Proofterm.rewrite_proof thy\n (RewriteHOLProof.rews,\n ProofRewriteRules.rprocs true @ [ProofRewriteRules.expand_of_class thy]) o\n ProofRewriteRules.elim_vars (curry Const @{const_name default}))\n*}\n\nlemmas [extraction_expand] =\n meta_spec atomize_eq atomize_all atomize_imp atomize_conj\n allE rev_mp conjE Eq_TrueI Eq_FalseI eqTrueI eqTrueE eq_cong2\n notE' impE' impE iffE imp_cong simp_thms eq_True eq_False\n induct_forall_eq induct_implies_eq induct_equal_eq induct_conj_eq\n induct_atomize induct_atomize' induct_rulify induct_rulify'\n induct_rulify_fallback induct_trueI\n True_implies_equals TrueE\n\nlemmas [extraction_expand_def] =\n induct_forall_def induct_implies_def induct_equal_def induct_conj_def\n induct_true_def induct_false_def\n\ndatatype (plugins only: code extraction) sumbool = Left | Right\n\nsubsection {* Type of extracted program *}\n\nextract_type\n \"typeof (Trueprop P) \\ typeof P\"\n\n \"typeof P \\ Type (TYPE(Null)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('Q))\"\n\n \"typeof Q \\ Type (TYPE(Null)) \\ typeof (P \\ Q) \\ Type (TYPE(Null))\"\n\n \"typeof P \\ Type (TYPE('P)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('P \\ 'Q))\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE(Null))) \\\n typeof (\\x. P x) \\ Type (TYPE(Null))\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE('P))) \\\n typeof (\\x::'a. P x) \\ Type (TYPE('a \\ 'P))\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE(Null))) \\\n typeof (\\x::'a. P x) \\ Type (TYPE('a))\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE('P))) \\\n typeof (\\x::'a. P x) \\ Type (TYPE('a \\ 'P))\"\n\n \"typeof P \\ Type (TYPE(Null)) \\ typeof Q \\ Type (TYPE(Null)) \\\n typeof (P \\ Q) \\ Type (TYPE(sumbool))\"\n\n \"typeof P \\ Type (TYPE(Null)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('Q option))\"\n\n \"typeof P \\ Type (TYPE('P)) \\ typeof Q \\ Type (TYPE(Null)) \\\n typeof (P \\ Q) \\ Type (TYPE('P option))\"\n\n \"typeof P \\ Type (TYPE('P)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('P + 'Q))\"\n\n \"typeof P \\ Type (TYPE(Null)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('Q))\"\n\n \"typeof P \\ Type (TYPE('P)) \\ typeof Q \\ Type (TYPE(Null)) \\\n typeof (P \\ Q) \\ Type (TYPE('P))\"\n\n \"typeof P \\ Type (TYPE('P)) \\ typeof Q \\ Type (TYPE('Q)) \\\n typeof (P \\ Q) \\ Type (TYPE('P \\ 'Q))\"\n\n \"typeof (P = Q) \\ typeof ((P \\ Q) \\ (Q \\ P))\"\n\n \"typeof (x \\ P) \\ typeof P\"\n\nsubsection {* Realizability *}\n\nrealizability\n \"(realizes t (Trueprop P)) \\ (Trueprop (realizes t P))\"\n\n \"(typeof P) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\ (realizes Null P \\ realizes t Q)\"\n\n \"(typeof P) \\ (Type (TYPE('P))) \\\n (typeof Q) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\ (\\x::'P. realizes x P \\ realizes Null Q)\"\n\n \"(realizes t (P \\ Q)) \\ (\\x. realizes x P \\ realizes (t x) Q)\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE(Null))) \\\n (realizes t (\\x. P x)) \\ (\\x. realizes Null (P x))\"\n\n \"(realizes t (\\x. P x)) \\ (\\x. realizes (t x) (P x))\"\n\n \"(\\x. typeof (P x)) \\ (\\x. Type (TYPE(Null))) \\\n (realizes t (\\x. P x)) \\ (realizes Null (P t))\"\n\n \"(realizes t (\\x. P x)) \\ (realizes (snd t) (P (fst t)))\"\n\n \"(typeof P) \\ (Type (TYPE(Null))) \\\n (typeof Q) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\\n (case t of Left \\ realizes Null P | Right \\ realizes Null Q)\"\n\n \"(typeof P) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\\n (case t of None \\ realizes Null P | Some q \\ realizes q Q)\"\n\n \"(typeof Q) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\\n (case t of None \\ realizes Null Q | Some p \\ realizes p P)\"\n\n \"(realizes t (P \\ Q)) \\\n (case t of Inl p \\ realizes p P | Inr q \\ realizes q Q)\"\n\n \"(typeof P) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\ (realizes Null P \\ realizes t Q)\"\n\n \"(typeof Q) \\ (Type (TYPE(Null))) \\\n (realizes t (P \\ Q)) \\ (realizes t P \\ realizes Null Q)\"\n\n \"(realizes t (P \\ Q)) \\ (realizes (fst t) P \\ realizes (snd t) Q)\"\n\n \"typeof P \\ Type (TYPE(Null)) \\\n realizes t (\\ P) \\ \\ realizes Null P\"\n\n \"typeof P \\ Type (TYPE('P)) \\\n realizes t (\\ P) \\ (\\x::'P. \\ realizes x P)\"\n\n \"typeof (P::bool) \\ Type (TYPE(Null)) \\\n typeof Q \\ Type (TYPE(Null)) \\\n realizes t (P = Q) \\ realizes Null P = realizes Null Q\"\n\n \"(realizes t (P = Q)) \\ (realizes t ((P \\ Q) \\ (Q \\ P)))\"\n\nsubsection {* Computational content of basic inference rules *}\n\ntheorem disjE_realizer:\n assumes r: \"case x of Inl p \\ P p | Inr q \\ Q q\"\n and r1: \"\\p. P p \\ R (f p)\" and r2: \"\\q. Q q \\ R (g q)\"\n shows \"R (case x of Inl p \\ f p | Inr q \\ g q)\"\nproof (cases x)\n case Inl\n with r show ?thesis by simp (rule r1)\nnext\n case Inr\n with r show ?thesis by simp (rule r2)\nqed\n\ntheorem disjE_realizer2:\n assumes r: \"case x of None \\ P | Some q \\ Q q\"\n and r1: \"P \\ R f\" and r2: \"\\q. Q q \\ R (g q)\"\n shows \"R (case x of None \\ f | Some q \\ g q)\"\nproof (cases x)\n case None\n with r show ?thesis by simp (rule r1)\nnext\n case Some\n with r show ?thesis by simp (rule r2)\nqed\n\ntheorem disjE_realizer3:\n assumes r: \"case x of Left \\ P | Right \\ Q\"\n and r1: \"P \\ R f\" and r2: \"Q \\ R g\"\n shows \"R (case x of Left \\ f | Right \\ g)\"\nproof (cases x)\n case Left\n with r show ?thesis by simp (rule r1)\nnext\n case Right\n with r show ?thesis by simp (rule r2)\nqed\n\ntheorem conjI_realizer:\n \"P p \\ Q q \\ P (fst (p, q)) \\ Q (snd (p, q))\"\n by simp\n\ntheorem exI_realizer:\n \"P y x \\ P (snd (x, y)) (fst (x, y))\" by simp\n\ntheorem exE_realizer: \"P (snd p) (fst p) \\\n (\\x y. P y x \\ Q (f x y)) \\ Q (let (x, y) = p in f x y)\"\n by (cases p) (simp add: Let_def)\n\ntheorem exE_realizer': \"P (snd p) (fst p) \\\n (\\x y. P y x \\ Q) \\ Q\" by (cases p) simp\n\nrealizers\n impI (P, Q): \"\\pq. pq\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq (h: _). allI \\ _ \\ c \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h \\ x))\"\n\n impI (P): \"Null\"\n \"\\<^bold>\\(c: _) P Q (h: _). allI \\ _ \\ c \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h \\ x))\"\n\n impI (Q): \"\\q. q\" \"\\<^bold>\\(c: _) P Q q. impI \\ _ \\ _\"\n\n impI: \"Null\" \"impI\"\n\n mp (P, Q): \"\\pq. pq\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq (h: _) p. mp \\ _ \\ _ \\ (spec \\ _ \\ p \\ c \\ h)\"\n\n mp (P): \"Null\"\n \"\\<^bold>\\(c: _) P Q (h: _) p. mp \\ _ \\ _ \\ (spec \\ _ \\ p \\ c \\ h)\"\n\n mp (Q): \"\\q. q\" \"\\<^bold>\\(c: _) P Q q. mp \\ _ \\ _\"\n\n mp: \"Null\" \"mp\"\n\n allI (P): \"\\p. p\" \"\\<^bold>\\(c: _) P (d: _) p. allI \\ _ \\ d\"\n\n allI: \"Null\" \"allI\"\n\n spec (P): \"\\x p. p x\" \"\\<^bold>\\(c: _) P x (d: _) p. spec \\ _ \\ x \\ d\"\n\n spec: \"Null\" \"spec\"\n\n exI (P): \"\\x p. (x, p)\" \"\\<^bold>\\(c: _) P x (d: _) p. exI_realizer \\ P \\ p \\ x \\ c \\ d\"\n\n exI: \"\\x. x\" \"\\<^bold>\\P x (c: _) (h: _). h\"\n\n exE (P, Q): \"\\p pq. let (x, y) = p in pq x y\"\n \"\\<^bold>\\(c: _) (d: _) P Q (e: _) p (h: _) pq. exE_realizer \\ P \\ p \\ Q \\ pq \\ c \\ e \\ d \\ h\"\n\n exE (P): \"Null\"\n \"\\<^bold>\\(c: _) P Q (d: _) p. exE_realizer' \\ _ \\ _ \\ _ \\ c \\ d\"\n\n exE (Q): \"\\x pq. pq x\"\n \"\\<^bold>\\(c: _) P Q (d: _) x (h1: _) pq (h2: _). h2 \\ x \\ h1\"\n\n exE: \"Null\"\n \"\\<^bold>\\P Q (c: _) x (h1: _) (h2: _). h2 \\ x \\ h1\"\n\n conjI (P, Q): \"Pair\"\n \"\\<^bold>\\(c: _) (d: _) P Q p (h: _) q. conjI_realizer \\ P \\ p \\ Q \\ q \\ c \\ d \\ h\"\n\n conjI (P): \"\\p. p\"\n \"\\<^bold>\\(c: _) P Q p. conjI \\ _ \\ _\"\n\n conjI (Q): \"\\q. q\"\n \"\\<^bold>\\(c: _) P Q (h: _) q. conjI \\ _ \\ _ \\ h\"\n\n conjI: \"Null\" \"conjI\"\n\n conjunct1 (P, Q): \"fst\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq. conjunct1 \\ _ \\ _\"\n\n conjunct1 (P): \"\\p. p\"\n \"\\<^bold>\\(c: _) P Q p. conjunct1 \\ _ \\ _\"\n\n conjunct1 (Q): \"Null\"\n \"\\<^bold>\\(c: _) P Q q. conjunct1 \\ _ \\ _\"\n\n conjunct1: \"Null\" \"conjunct1\"\n\n conjunct2 (P, Q): \"snd\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq. conjunct2 \\ _ \\ _\"\n\n conjunct2 (P): \"Null\"\n \"\\<^bold>\\(c: _) P Q p. conjunct2 \\ _ \\ _\"\n\n conjunct2 (Q): \"\\p. p\"\n \"\\<^bold>\\(c: _) P Q p. conjunct2 \\ _ \\ _\"\n\n conjunct2: \"Null\" \"conjunct2\"\n\n disjI1 (P, Q): \"Inl\"\n \"\\<^bold>\\(c: _) (d: _) P Q p. iffD2 \\ _ \\ _ \\ (sum.case_1 \\ P \\ _ \\ p \\ arity_type_bool \\ c \\ d)\"\n\n disjI1 (P): \"Some\"\n \"\\<^bold>\\(c: _) P Q p. iffD2 \\ _ \\ _ \\ (option.case_2 \\ _ \\ P \\ p \\ arity_type_bool \\ c)\"\n\n disjI1 (Q): \"None\"\n \"\\<^bold>\\(c: _) P Q. iffD2 \\ _ \\ _ \\ (option.case_1 \\ _ \\ _ \\ arity_type_bool \\ c)\"\n\n disjI1: \"Left\"\n \"\\<^bold>\\P Q. iffD2 \\ _ \\ _ \\ (sumbool.case_1 \\ _ \\ _ \\ arity_type_bool)\"\n\n disjI2 (P, Q): \"Inr\"\n \"\\<^bold>\\(d: _) (c: _) Q P q. iffD2 \\ _ \\ _ \\ (sum.case_2 \\ _ \\ Q \\ q \\ arity_type_bool \\ c \\ d)\"\n\n disjI2 (P): \"None\"\n \"\\<^bold>\\(c: _) Q P. iffD2 \\ _ \\ _ \\ (option.case_1 \\ _ \\ _ \\ arity_type_bool \\ c)\"\n\n disjI2 (Q): \"Some\"\n \"\\<^bold>\\(c: _) Q P q. iffD2 \\ _ \\ _ \\ (option.case_2 \\ _ \\ Q \\ q \\ arity_type_bool \\ c)\"\n\n disjI2: \"Right\"\n \"\\<^bold>\\Q P. iffD2 \\ _ \\ _ \\ (sumbool.case_2 \\ _ \\ _ \\ arity_type_bool)\"\n\n disjE (P, Q, R): \"\\pq pr qr.\n (case pq of Inl p \\ pr p | Inr q \\ qr q)\"\n \"\\<^bold>\\(c: _) (d: _) (e: _) P Q R pq (h1: _) pr (h2: _) qr.\n disjE_realizer \\ _ \\ _ \\ pq \\ R \\ pr \\ qr \\ c \\ d \\ e \\ h1 \\ h2\"\n\n disjE (Q, R): \"\\pq pr qr.\n (case pq of None \\ pr | Some q \\ qr q)\"\n \"\\<^bold>\\(c: _) (d: _) P Q R pq (h1: _) pr (h2: _) qr.\n disjE_realizer2 \\ _ \\ _ \\ pq \\ R \\ pr \\ qr \\ c \\ d \\ h1 \\ h2\"\n\n disjE (P, R): \"\\pq pr qr.\n (case pq of None \\ qr | Some p \\ pr p)\"\n \"\\<^bold>\\(c: _) (d: _) P Q R pq (h1: _) pr (h2: _) qr (h3: _).\n disjE_realizer2 \\ _ \\ _ \\ pq \\ R \\ qr \\ pr \\ c \\ d \\ h1 \\ h3 \\ h2\"\n\n disjE (R): \"\\pq pr qr.\n (case pq of Left \\ pr | Right \\ qr)\"\n \"\\<^bold>\\(c: _) P Q R pq (h1: _) pr (h2: _) qr.\n disjE_realizer3 \\ _ \\ _ \\ pq \\ R \\ pr \\ qr \\ c \\ h1 \\ h2\"\n\n disjE (P, Q): \"Null\"\n \"\\<^bold>\\(c: _) (d: _) P Q R pq. disjE_realizer \\ _ \\ _ \\ pq \\ (\\x. R) \\ _ \\ _ \\ c \\ d \\ arity_type_bool\"\n\n disjE (Q): \"Null\"\n \"\\<^bold>\\(c: _) P Q R pq. disjE_realizer2 \\ _ \\ _ \\ pq \\ (\\x. R) \\ _ \\ _ \\ c \\ arity_type_bool\"\n\n disjE (P): \"Null\"\n \"\\<^bold>\\(c: _) P Q R pq (h1: _) (h2: _) (h3: _).\n disjE_realizer2 \\ _ \\ _ \\ pq \\ (\\x. R) \\ _ \\ _ \\ c \\ arity_type_bool \\ h1 \\ h3 \\ h2\"\n\n disjE: \"Null\"\n \"\\<^bold>\\P Q R pq. disjE_realizer3 \\ _ \\ _ \\ pq \\ (\\x. R) \\ _ \\ _ \\ arity_type_bool\"\n\n FalseE (P): \"default\"\n \"\\<^bold>\\(c: _) P. FalseE \\ _\"\n\n FalseE: \"Null\" \"FalseE\"\n\n notI (P): \"Null\"\n \"\\<^bold>\\(c: _) P (h: _). allI \\ _ \\ c \\ (\\<^bold>\\x. notI \\ _ \\ (h \\ x))\"\n\n notI: \"Null\" \"notI\"\n\n notE (P, R): \"\\p. default\"\n \"\\<^bold>\\(c: _) (d: _) P R (h: _) p. notE \\ _ \\ _ \\ (spec \\ _ \\ p \\ c \\ h)\"\n\n notE (P): \"Null\"\n \"\\<^bold>\\(c: _) P R (h: _) p. notE \\ _ \\ _ \\ (spec \\ _ \\ p \\ c \\ h)\"\n\n notE (R): \"default\"\n \"\\<^bold>\\(c: _) P R. notE \\ _ \\ _\"\n\n notE: \"Null\" \"notE\"\n\n subst (P): \"\\s t ps. ps\"\n \"\\<^bold>\\(c: _) s t P (d: _) (h: _) ps. subst \\ s \\ t \\ P ps \\ d \\ h\"\n\n subst: \"Null\" \"subst\"\n\n iffD1 (P, Q): \"fst\"\n \"\\<^bold>\\(d: _) (c: _) Q P pq (h: _) p.\n mp \\ _ \\ _ \\ (spec \\ _ \\ p \\ d \\ (conjunct1 \\ _ \\ _ \\ h))\"\n\n iffD1 (P): \"\\p. p\"\n \"\\<^bold>\\(c: _) Q P p (h: _). mp \\ _ \\ _ \\ (conjunct1 \\ _ \\ _ \\ h)\"\n\n iffD1 (Q): \"Null\"\n \"\\<^bold>\\(c: _) Q P q1 (h: _) q2.\n mp \\ _ \\ _ \\ (spec \\ _ \\ q2 \\ c \\ (conjunct1 \\ _ \\ _ \\ h))\"\n\n iffD1: \"Null\" \"iffD1\"\n\n iffD2 (P, Q): \"snd\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq (h: _) q.\n mp \\ _ \\ _ \\ (spec \\ _ \\ q \\ d \\ (conjunct2 \\ _ \\ _ \\ h))\"\n\n iffD2 (P): \"\\p. p\"\n \"\\<^bold>\\(c: _) P Q p (h: _). mp \\ _ \\ _ \\ (conjunct2 \\ _ \\ _ \\ h)\"\n\n iffD2 (Q): \"Null\"\n \"\\<^bold>\\(c: _) P Q q1 (h: _) q2.\n mp \\ _ \\ _ \\ (spec \\ _ \\ q2 \\ c \\ (conjunct2 \\ _ \\ _ \\ h))\"\n\n iffD2: \"Null\" \"iffD2\"\n\n iffI (P, Q): \"Pair\"\n \"\\<^bold>\\(c: _) (d: _) P Q pq (h1 : _) qp (h2 : _). conjI_realizer \\\n (\\pq. \\x. P x \\ Q (pq x)) \\ pq \\\n (\\qp. \\x. Q x \\ P (qp x)) \\ qp \\\n (arity_type_fun \\ c \\ d) \\\n (arity_type_fun \\ d \\ c) \\\n (allI \\ _ \\ c \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h1 \\ x))) \\\n (allI \\ _ \\ d \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h2 \\ x)))\"\n\n iffI (P): \"\\p. p\"\n \"\\<^bold>\\(c: _) P Q (h1 : _) p (h2 : _). conjI \\ _ \\ _ \\\n (allI \\ _ \\ c \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h1 \\ x))) \\\n (impI \\ _ \\ _ \\ h2)\"\n\n iffI (Q): \"\\q. q\"\n \"\\<^bold>\\(c: _) P Q q (h1 : _) (h2 : _). conjI \\ _ \\ _ \\\n (impI \\ _ \\ _ \\ h1) \\\n (allI \\ _ \\ c \\ (\\<^bold>\\x. impI \\ _ \\ _ \\ (h2 \\ x)))\"\n\n iffI: \"Null\" \"iffI\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Extraction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526368038302, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.29160305648697193}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ML_Goal_Test\nimports\n ML_Goal\n ML_Utils.ML_Utils\nbegin\nexperiment begin\n\n\\\\\n Basic usage.\n\\\nML_goal test: \\\n [@{term \"(P \\ Q) \\ P \\ Q\"}]\n\\\n apply clarsimp\n done\n\nthm test\n\n\\\\\n A goal that we definitely don't want to write out by hand.\n\n In this case, we're going to show that if x is less than 10,\n we \"only\" need to consider the cases when x = 0, or x = 1, or...\n\\\nML_goal big_goal: \\\n let\n val var_x = Free (\"x\", @{typ nat});\n val var_P = Free (\"P\", @{typ bool});\n val max = 10;\n\n \\\\\n @{ML \"HOLogic.mk_nat\"} produces nested Suc's, which are pretty\n ugly, so we use this instead.\n \\\n val mk_nat = HOLogic.mk_number @{typ nat};\n\n \\\\\n Turns (i: int) into @{term \"x = i \\ P\"}.\n \\\n fun mk_case i =\n let\n val prem = HOLogic.mk_eq (var_x, mk_nat i) |> HOLogic.mk_Trueprop;\n val conc = var_P |> HOLogic.mk_Trueprop;\n in Logic.mk_implies (prem, conc) end\n\n val x_cases =\n ListExtras.range 0 max\n |> map mk_case;\n\n val assm =\n HOLogic.mk_binrel @{const_name \"less\"}\n (var_x,\n (mk_nat max))\n |> HOLogic.mk_Trueprop;\n\n val goal =\n Logic.list_implies (assm :: x_cases, var_P |> HOLogic.mk_Trueprop)\n\n in [goal] end\n\\\n by force\n\n\\\\\n Names are optional.\n\\\nML_goal \\\n [@{term \"True\"}]\n\\\n by (rule TrueI)\n\n\\\\\n Multiple goals are supported, and result in similar\n \"list of fact\" lemmas\n\\\nML_goal multiple_goals: \\\n [@{term \"(P \\ Q \\ P)\"}, @{term \"(P \\ Q \\ Q)\"}]\n\\\n by simp+\n\nthm multiple_goals[OF TrueI]\n\n\\\\\n Handles mixes of @{typ bool} and @{typ prop}.\n\\\nML_goal \\\n [@{term \"PROP A \\ PROP A\"}, @{term \"B \\ B\"}]\n\\\n by simp+\n\n\\\\\n Turns out a lemma name can refer to nothing as well!\n\\\nML_goal nothing: \\[]\\\n done\n\nthm nothing[OF TrueI]\n\n\\\\\n Attributes can be applied, just like normal lemmas.\n\\\ndefinition magic where \"magic = (5 :: nat)\"\n\nML_goal declared_with_an_attribute[folded magic_def, simp]: \\\n [@{term \"(5 :: nat) = 2 + 3\"}]\n\\\n by simp\n\nlemma uses_our_new_magic_simp_rule:\n \"magic = 1 + 4\"\n by simp\n\nend\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/ML_Goal_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558603, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2913722142483306}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_rep_par\nimports CSP_F_law_alpha_par CSP_F_op_rep_par CSP_T_law_rep_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*****************************************************************\n\n 1. associativity of [||]:I\n 2. commutativity of [||]:I\n 3. \n 4. \n\n *****************************************************************)\n\n(*****************************************************\n replace an index set with another equal index set\n *****************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Rep_parallel_index_eq_lm1:\n \"[| inj_on f I1 ; ALL i:I1. PXf2 (f i) = PXf1 i |] ==>\n Union {(Yf i Int insert Tick (Ev ` snd (PXf1 i))) |i. i : I1} =\n Union {(Yf (inv_on I1 f i) Int insert Tick (Ev ` snd (PXf2 i))) |i. i : f ` I1}\"\napply (rule) \n\n (* => *)\n apply (rule, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(Yf i) Int insert Tick (Ev ` snd (PXf2 (f i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"f i\" in exI)\n apply (simp add: inv_f_f_on)\n\n (* <= *)\n apply (rule, simp)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (rule_tac x=\n \"(Yf xb) Int insert Tick (Ev ` snd (PXf1 xb))\" in exI)\n apply (simp)\n apply (simp add: inv_f_f_on)\n apply (rule_tac x=\"xb\" in exI)\n apply (simp)\ndone\n\nlemma cspF_Rep_parallel_index_eq_lm2:\n \"ALL i:I1. PXf2 (f i) = PXf1 i ==>\n Union {(Yf i Int insert Tick (Ev ` snd (PXf2 i))) |i. i : f ` I1} =\n Union {(Yf (f i) Int insert Tick (Ev ` snd (PXf1 i))) |i. i : I1}\"\napply (rule) \n\n (* => *)\n apply (rule, simp)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"xb\" in exI)\n apply (simp)\n\n (* <= *)\n apply (rule, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"f i\" in exI)\n apply (simp)\ndone\n\n(* main *)\n\nlemma cspF_Rep_parallel_index_eq:\n \"[| finite I1 ;\n EX f. I2 = f ` I1 & inj_on f I1 &\n (ALL i:I1. PXf2 (f i) = PXf1 i) |]\n ==> [||]:I1 PXf1 =F[M,M] [||]:I2 PXf2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_parallel_index_eq)\napply (case_tac \"I1 = {}\", simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_failures_Rep_parallel)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(%i. Yf (inv_on I1 f i))\" in exI)\n apply (simp add: inv_f_f_on)\n apply (simp add: cspF_Rep_parallel_index_eq_lm1)\n apply (simp add: Union_index_fun)\n\n (* => *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_failures_Rep_parallel)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(%i. Yf (f i))\" in exI)\n apply (simp)\n apply (simp add: cspF_Rep_parallel_index_eq_lm2)\n apply (simp add: Union_index_fun)\ndone\n\n(*********************************************************\n [||]:I PXf ==> [||] PXs\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Index_to_Inductive_parallel:\n \"[| finite I ; Is isListOf I |] ==>\n [||]:I PXf =F[M,M] [||] (map PXf Is)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Index_to_Inductive_parallel)\napply (case_tac \"I = {}\", simp)\n\napply (case_tac \"map PXf Is = []\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_failures_Rep_parallel)\n apply (simp add: in_failures_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (elim conjE exE)\n apply (rule_tac x= \"map Yf Is\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (rule in_failures_Rep_parallel_lm2, simp)\n apply (intro allI impI)\n apply (drule_tac x=\"Is ! i\" in bspec)\n apply (simp add: isListOf_nth_in_index)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Rep_parallel)\n apply (simp add: in_failures_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (elim conjE exE)\n apply (rule_tac x= \"(%i. (Ys!(THE n. (Is!n) = i & n\n insert Tick (Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I})\n = Union {(insert Tick (Yf i Int Ev ` snd (PXf i))) |i. i : I}\"\nby (auto)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_SKIP_Rep_parallel_right:\n \"finite I ==>\n (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP) =F[M,M]\n ([||]:I PXf)\"\napply (case_tac \"I={}\")\napply (simp add: cspF_SKIP_Alpha_parallel)\n\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Rep_parallel_right)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n\n apply (case_tac \"Tick ~: Z\")\n apply (simp)\n apply (rule_tac x=\"Yf\" in exI)\n apply (rule conjI)\n apply (subgoal_tac \"Z Int {Tick} = {}\")\n apply (simp (no_asm_simp))\n apply (simp)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n apply (simp add: in_failures)\n apply (erule disjE)\n apply (simp add: Evset_def)\n apply (force)\n\n apply (rule_tac x=\"(%i. insert Tick (Yf i))\" in exI)\n apply (simp)\n apply (subgoal_tac \"Z Int {Tick} = {Tick}\", simp)\n apply (simp add: cspF_SKIP_Rep_parallel_right_lm1)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n\n apply (simp add: rest_tr_Tick_sett)\n apply (elim conjE exE)\n apply (simp)\n apply (rule proc_T2_T3)\n apply (simp)\n apply (simp)\n apply (force)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (rule_tac x=\"X\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp)\n\n apply (simp add: in_failures)\n apply (simp add: rest_tr_empty)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Yf\" in exI)\n apply (simp)\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n\n apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\ndone\n\n(************************************\n | SKIP and [||]:I PXf |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_SKIP_Rep_parallel_left:\n \"finite I ==>\n (SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =F[M,M]\n ([||]:I PXf)\"\napply (subgoal_tac \n \"(SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =F[M,M]\n (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP)\")\napply (rule cspF_trans)\napply (simp)\napply (simp add: cspF_SKIP_Rep_parallel_right)\napply (simp add: cspF_Alpha_parallel_commut)\ndone\n\n(*** left and right ***)\n\nlemmas cspF_SKIP_Rep_parallel = cspF_SKIP_Rep_parallel_left\n cspF_SKIP_Rep_parallel_right\n\n(************************************\n | associativity |\n ************************************)\n\nlemma cspF_Rep_parallel_ass_lm1:\n \"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I} Int\n insert Tick (Ev ` Union (snd ` PXf ` I))\n = Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I}\"\nby (auto)\n\nlemma cspF_Rep_parallel_ass_lm2:\n \"I1 Int I2 = {} ==>\n Union {(Yf1 i Int insert Tick (Ev ` snd (PXf i))) |i. i : I1} Un\n Union {(Yf2 i Int insert Tick (Ev ` snd (PXf i))) |i. i : I2} =\n Union {(if i : I1 then Yf1 i else Yf2 i) Int insert Tick (Ev ` snd (PXf i)) |i.\n i : I1 | i : I2}\"\napply (rule)\n\n apply (rule)\n apply (simp)\n apply (elim disjE conjE exE)\n\n apply (rule_tac x=\"Yf1 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n apply (rule_tac x=\"Yf2 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n apply (force)\n\n apply (rule)\n apply (simp)\n apply (elim disjE conjE exE)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Yf1 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n apply (rule disjI2)\n apply (case_tac \"i ~: I1\")\n apply (rule_tac x=\"Yf2 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n apply (force)\ndone\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Rep_parallel_assoc:\n \"[| I1 Int I2 = {} ; finite I1 ; finite I2 |] ==>\n [||]:(I1 Un I2) PXf =F[M,M]\n [||]:I1 PXf |[Union (snd ` PXf ` I1), Union (snd ` PXf ` I2)]| [||]:I2 PXf\"\n\napply (case_tac \"I1 = {}\")\napply (case_tac \"I2 = {}\")\napply (rule cspF_sym)\napply (simp add: cspF_SKIP_Alpha_parallel)\napply (rule cspF_sym)\napply (simp add: cspF_SKIP_Rep_parallel)\n\napply (case_tac \"I2 = {}\")\napply (rule cspF_sym)\napply (simp add: cspF_SKIP_Rep_parallel)\n\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_parallel_assoc)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n\n apply (rule_tac x=\"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I1}\" in exI)\n apply (rule_tac x=\"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I2}\" in exI)\n apply (simp add: Union_snd_Un)\n apply (rule conjI)\n apply (simp add: cspF_Rep_parallel_ass_lm1)\n apply (blast)\n\n apply (rule conjI)\n\n (* I1 *)\n apply (rule_tac x=\"Yf\" in exI)\n apply (simp add: cspF_Rep_parallel_ass_lm1)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n (* I2 *)\n apply (rule_tac x=\"Yf\" in exI)\n apply (simp add: cspF_Rep_parallel_ass_lm1)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim exE conjE)\n apply (simp add: Union_snd_Un)\n apply (rename_tac s X Y Z Yf1 Yf2)\n\n apply (rule_tac x=\"(%i. if i:I1 then Yf1 i else Yf2 i)\" in exI)\n (* the necessity of the condition \"I1 Int I2 = {}\" *)\n apply (simp add: cspF_Rep_parallel_ass_lm2)\n\n apply (intro ballI)\n apply (simp)\n apply (erule disjE)\n\n apply (drule_tac x=\"i\" in bspec, simp, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (case_tac \"i ~: I1\")\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n apply (blast)\ndone\n\n(************************************\n | induct |\n ************************************)\n\n(*------------------*\n | csp law |\n | (derivable) |\n *------------------*)\n\nlemma cspF_Rep_parallel_induct:\n \"[| finite I ; i ~: I |] ==>\n [||]:(insert i I) PXf =F[M,M]\n fst (PXf i) |[snd (PXf i), Union (snd ` PXf ` I)]| [||]:I PXf\"\napply (insert cspF_Rep_parallel_assoc[of \"{i}\" I PXf M])\napply (simp add: Rep_parallel_one)\napply (rule cspF_rw_left)\napply (simp)\n\napply (insert cspF_Alpha_parallel_assoc\n [of \"fst (PXf i)\" \"snd (PXf i)\" \"{}\" \"SKIP\" \"Union (snd ` PXf ` I)\" \"[||]:I PXf\" M])\napply (rule cspF_trans)\napply (simp)\n\napply (rule cspF_decompo_Alpha_parallel)\napply (simp_all)\n\napply (simp add: cspF_SKIP_Rep_parallel)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\nend\n\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2913722074991481}} {"text": "theory IICF_MS_Array_List\nimports \n \"../Intf/IICF_List\" IICF_Array\nbegin\n definition \"ms_irel M N \\ br (\\(l,xs). take l xs) (\\(l,xs). l\\N \\ N = length xs \\ N RETURN (0::nat,replicate N init)\"\n definition \"ms_is_empty \\ \\(l,_). RETURN (l=0)\"\n definition \"ms_length \\ \\(l,_). RETURN l\"\n definition \"ms_push_back \\ \\(l,xs) x. doN {ASSERT (l < length xs); RETURN (l+1,xs[l:=x])}\"\n definition \"ms_last \\ \\(l,xs). doN {ASSERT (0 l\\length xs); RETURN (xs!(l-1))}\"\n definition \"ms_butlast \\ \\(l,xs). doN {ASSERT (l>0); RETURN (l-1,xs)}\"\n definition \"ms_get \\ \\(l,xs) i. doN {ASSERT (i \\(l,xs) i x. doN {ASSERT (i (ms_empty N,mop_list_empty) \\ \\ms_irel M N\\nres_rel\"\n unfolding ms_empty_def by ms_prove_refine\n \n lemma ms_is_empty_correct: \"(ms_is_empty,mop_list_is_empty) \\ ms_irel M N \\ \\bool_rel\\nres_rel\" \n unfolding ms_is_empty_def by ms_prove_refine\n\n lemma ms_length_correct: \"(ms_length,mop_list_length) \\ ms_irel M N \\ \\nat_rel\\nres_rel\" \n unfolding ms_length_def by ms_prove_refine\n \n lemma ms_push_back_correct: \"(uncurry ms_push_back,uncurry mop_list_append) \n \\ [\\(xs,x). length xs < N]\\<^sub>f (ms_irel M N \\\\<^sub>r Id) \\ \\ms_irel M N\\nres_rel\" \n unfolding ms_push_back_def \n supply [simp] = take_update_last\n by ms_prove_refine \n \n lemma ms_last_correct: \"(ms_last,mop_list_last)\\ms_irel M N \\ \\Id\\nres_rel\" \n unfolding ms_last_def supply [simp] = last_take_nth_conv by ms_prove_refine\n\n lemma ms_butlast_correct: \"(ms_butlast,mop_list_butlast)\\ms_irel M N \\ \\ms_irel M N\\nres_rel\" \n unfolding ms_butlast_def supply [simp] = butlast_take by ms_prove_refine\n \n lemma ms_get_correct: \"(ms_get,mop_list_get)\\ms_irel M N \\ nat_rel \\ \\Id\\nres_rel\" \n unfolding ms_get_def by ms_prove_refine\n\n lemma ms_set_correct: \"(ms_set,mop_list_set)\\ms_irel M N \\ nat_rel \\ Id \\ \\ms_irel M N\\nres_rel\" \n unfolding ms_set_def by ms_prove_refine\n \n end\n\n type_synonym ('l,'a) marl = \"'l word \\ 'a ptr\"\n\n lemma ms_irel_prenorm: \n assumes \"((l,xs),xs')\\ms_irel M N\"\n shows \"length xs = N \\ l=length xs' \\ length xs'\\N \\ N < M\"\n using assms\n unfolding ms_irel_def\n by (auto simp: in_br_conv)\n \n \n context\n fixes M :: nat\n defines \"M \\ max_snat (LENGTH ('l::len2))\"\n notes [fcomp_prenorm_simps] = ms_irel_prenorm[where M=M]\n begin\n abbreviation \"marl2_assn \\ snat_assn' TYPE('l) \\\\<^sub>a array_assn id_assn\"\n \n \n sepref_definition marl_empty_impl [llvm_inline] is \"ms_empty\" :: \"(snat_assn' TYPE('l))\\<^sup>k \\\\<^sub>a marl2_assn\"\n unfolding ms_empty_def\n supply [sepref_import_param] = IdI[of init]\n apply (annot_snat_const \"TYPE('l)\")\n apply (rewrite array_fold_custom_replicate)\n by sepref\n\n \n definition [simp]: \"marl_empty_aux (N::nat) \\ op_list_empty\" \n \n sepref_decl_op marl_empty: marl_empty_aux :: \"nat_rel \\ \\A\\list_rel\" .\n \n lemma ms_empty_correct': \"(ms_empty,RETURN o op_marl_empty) \n \\ [\\N. Nf\\<^sub>d nat_rel \\ (\\N. \\ms_irel M N\\nres_rel)\"\n apply (rule frefI) using ms_empty_correct by auto\n\n (* \n definition \"marl_assn' TYPE('l) N A \\ hr_comp (hr_comp marl2_assn (ms_irel (max_snat LENGTH('l)) N))\n (\\the_pure A\\list_rel)\" \n *)\n \n definition \"marl_assn' TYPE('l) A N \\ hrr_comp nat_rel\n (\\N _. hr_comp marl2_assn (ms_irel M N))\n (\\_. \\the_pure A\\list_rel) N ()\"\n \n lemmas [fcomp_norm_unfold] = marl_assn'_def[symmetric, abs_def]\n \n lemma marl_assn'_fold''[fcomp_norm_unfold]:\n \"hrr_comp nat_rel (\\x _. hr_comp (snat_assn \\\\<^sub>a array_assn id_assn) (ms_irel M x)) (\\x. \\the_pure A\\list_rel)\n = (\\N _. marl_assn' TYPE('l) A N)\"\n unfolding marl_assn'_def\n by auto\n \n lemma marl_assn'_fold'[fcomp_norm_unfold]: \n \"hr_comp (hr_comp (snat_assn \\\\<^sub>a array_assn id_assn) (ms_irel M N)) (\\the_pure A\\list_rel)\n = marl_assn' TYPE('l) A N\"\n unfolding marl_assn'_def\n unfolding hrr_comp_def \n apply (auto simp: fun_eq_iff sep_algebra_simps pred_lift_extract_simps)\n unfolding non_dep2_def by metis+\n \n sepref_decl_impl marl_empty: marl_empty_impl.refine[FCOMP ms_empty_correct'] by simp \n \n sepref_definition marl_is_empty_impl [llvm_inline] is ms_is_empty :: \"marl2_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n unfolding ms_is_empty_def\n apply (annot_snat_const \"TYPE('l)\")\n apply sepref_dbg_keep\n done\n \n sepref_decl_impl (ismop) marl_is_empty_impl.refine[FCOMP ms_is_empty_correct[of M]] .\n \n sepref_definition marl_length_impl [llvm_inline] is ms_length :: \"marl2_assn\\<^sup>k \\\\<^sub>a snat_assn' TYPE('l)\"\n unfolding ms_length_def\n by sepref\n sepref_decl_impl (ismop) marl_length_impl.refine[FCOMP ms_length_correct[of M]] .\n\n \n sepref_definition marl_push_back_impl [llvm_code] is \n \"uncurry ms_push_back\" :: \"[\\((l,a),_). length a < M ]\\<^sub>a marl2_assn\\<^sup>d*\\<^sub>aid_assn\\<^sup>k \\ marl2_assn\"\n unfolding ms_push_back_def M_def\n apply (annot_snat_const \"TYPE('l)\")\n apply sepref_dbg_keep\n done\n\n sepref_decl_impl (ismop) marl_push_back_impl.refine[FCOMP ms_push_back_correct[where M=M]] \n by (parametricity add: IdI[of N])\n \n \n sepref_definition marl_last_impl [llvm_code] is \n \"ms_last\" :: \"marl2_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding ms_last_def M_def\n apply (annot_snat_const \"TYPE('l)\")\n apply sepref_dbg_keep\n done\n sepref_decl_impl (ismop) marl_last_impl.refine[FCOMP ms_last_correct[where M=M]] .\n \n sepref_definition marl_butlast_impl [llvm_code] is \n \"ms_butlast\" :: \"marl2_assn\\<^sup>d \\\\<^sub>a marl2_assn\"\n unfolding ms_butlast_def M_def\n apply (annot_snat_const \"TYPE('l)\")\n apply sepref_dbg_keep\n done\n sepref_decl_impl (ismop) marl_butlast_impl.refine[FCOMP ms_butlast_correct[where M=M]] .\n \n \n sepref_definition marl_get_impl [llvm_inline] is \n \"uncurry ms_get\" :: \"marl2_assn\\<^sup>k *\\<^sub>a (snat_assn' TYPE('l))\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding ms_get_def M_def\n apply sepref_dbg_keep\n done\n sepref_decl_impl (ismop) marl_get_impl.refine[FCOMP ms_get_correct[where M=M]] .\n \n sepref_definition marl_set_impl [llvm_inline] is \n \"uncurry2 ms_set\" :: \"marl2_assn\\<^sup>d *\\<^sub>a (snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a marl2_assn\"\n unfolding ms_set_def M_def\n apply sepref_dbg_keep\n done\n sepref_decl_impl (ismop) marl_set_impl.refine[FCOMP ms_set_correct[where M=M]] .\n end\n \n \n lemma fold_marl_empty:\n \"[] = op_marl_empty N\"\n \"RETURN [] = mop_marl_empty N\" \n \"op_list_empty = op_marl_empty N\"\n \"mop_list_empty = mop_marl_empty N\"\n by auto\n\n\n (* TODO: Move *) \n \n schematic_goal [sepref_frame_free_rules]: \"MK_FREE (marl_assn' TYPE('l::len2) A N) ?f\"\n unfolding marl_assn'_fold'[symmetric]\n by sepref_dbg_side\n \n lemma marl_assn'_boundsD[sepref_bounds_dest]:\n \"rdomp (marl_assn' TYPE('l::len2) A N) xs \\ length xs \\ N \\ N < max_snat LENGTH('l)\" \n unfolding marl_assn'_def\n supply [sepref_bounds_dest] = ms_irel_prenorm\n by sepref_bounds\n \n lemma bind_assoc_tagged: \"bind$(bind$m$f)$g = bind$m$(\\\\<^sub>2x. bind$(f$x)$g)\" \n unfolding autoref_tag_defs by simp \n \n \n \nexperiment begin \n\n sepref_definition test is \"\\N. (do {\n let x = op_marl_empty N;\n RETURN (x@[1::nat])\n })\" :: \"[\\N. N\\10]\\<^sub>a\\<^sub>d (snat_assn' TYPE(64))\\<^sup>k \\ (\\N _. marl_assn' TYPE(64) (snat_assn' TYPE(64)) N)\"\n apply (annot_snat_const \"TYPE(64)\")\n by sepref\n \n\nend\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/IICF/Impl/IICF_MS_Array_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2913323791780663}} {"text": "theory \"Ids\"\n imports Complex_Main\n \"HOL-Library.Code_Target_Int\"\n \"Syntax\"\nbegin\n\n(*Differential dynamic logic can be defined for any finite types, given a \n few elements of those types (so that we can generate axioms). *)\n(*locale ids =\n fixes vid1 :: ident\n fixes vid2 :: ident\n fixes vid3 :: ident\n fixes is_vid1 :: \"ident \\ bool\"\n fixes fid1 :: ident\n fixes fid2 :: ident\n fixes fid3 :: ident\n fixes pid1 :: ident\n fixes pid2 :: ident\n fixes pid3 :: ident\n fixes pid4 :: ident\n assumes vne12:\"vid1 \\ vid2\"\n assumes vne23:\"vid2 \\ vid3\"\n assumes vne13:\"vid1 \\ vid3\"\n assumes fne12:\"fid1 \\ fid2\"\n assumes fne23:\"fid2 \\ fid3\"\n assumes fne13:\"fid1 \\ fid3\"\n assumes pne12:\"pid1 \\ pid2\"\n assumes pne23:\"pid2 \\ pid3\"\n assumes pne13:\"pid1 \\ pid3\"\n assumes pne14:\"pid1 \\ pid4\"\n assumes pne24:\"pid2 \\ pid4\"\n assumes pne34:\"pid3 \\ pid4\"\ncontext ids begin*)\n lemma vne12:\"Ix \\ Iy\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma vne23:\"Iy \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma vne13:\"Ix \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma fne12:\"Ix \\ Iy\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma fne23:\"Iy \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma fne13:\"Ix \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne12:\"Ix \\ Iy\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne23:\"Iy \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne13:\"Ix \\ Iz\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne14:\"Ix \\ Iw\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne24:\"Iy \\ Iw\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n lemma pne34:\"Iz \\ Iw\" apply (auto simp add: Ix_def Iy_def Iz_def Iw_def)using Ix.abs_eq Ix.rep_eq Iy.abs_eq Iy.rep_eq Iz.abs_eq Iz.rep_eq Iw.abs_eq Iw.rep_eq by auto\n\n lemma id_simps:\n \"(Ix = Iy) = False\" \"(Iy = Iz) = False\" \"(Ix = Iz) = False\"\n \"(Ix = Iy) = False\" \"(Iy = Iz) = False\" \"(Ix = Iz) = False\"\n \"(Ix = Iy) = False\" \"(Iy = Iz) = False\" \"(Ix = Iz) = False\" \n \"(Ix = Iw) = False\" \"(Iy = Iw) = False\" \"(Iz = Iw) = False\"\n \"(Iy = Ix) = False\" \"(Iz = Iy) = False\" \"(Iz = Ix) = False\"\n \"(Iy = Ix) = False\" \"(Iz = Iy) = False\" \"(Iz = Ix) = False\"\n \"(Iy = Ix) = False\" \"(Iz = Iy) = False\" \"(Iz = Ix) = False\" \n \"(Iw = Ix) = False\" \"(Iw = Iy) = False\" \"(Iw = Iz) = False\"\n using vne12 vne23 vne13 fne12 fne23 fne13 pne12 pne23 pne13 pne14 pne24 pne34 by auto\n\n(* Function applied to one argument *)\ndefinition f1::\"ident \\ ident \\ trm\"\nwhere \"f1 f x = Function f (singleton (Var x))\"\n\n(* Function applied to zero arguments (simulates a constant symbol given meaning by the interpretation) *)\ndefinition f0::\"ident \\ trm\"\nwhere \"f0 f = Function f empty\"\n\n(* Predicate applied to one argument *)\ndefinition p1::\"ident \\ ident \\ formula\"\nwhere \"p1 p x = Prop p (singleton (Var x))\"\n\n(* Predicational *)\ndefinition P::\"ident \\ formula\"\nwhere \"P p = Predicational p\"\n\nend\n", "meta": {"author": "LS-Lab", "repo": "Isabelle-dL", "sha": "97770ed9ca8d6a633c59d11d799247f44cc62dc2", "save_path": "github-repos/isabelle/LS-Lab-Isabelle-dL", "path": "github-repos/isabelle/LS-Lab-Isabelle-dL/Isabelle-dL-97770ed9ca8d6a633c59d11d799247f44cc62dc2/Ids.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.29132070158518397}} {"text": "section \\Lemmas of Picore-SIMP\\\n\ntheory picore_SIMP_lemma\nimports \"picore_SIMP_Syntax\" \"picore_SIMP\"\n\nbegin\n\nlemma id_belong[simp]: \"Id \\\\\\x= \\x\\\"\n by (simp add: Collect_mono Id_fstsnd_eq)\n\nlemma allpre_eq_pre: \"(\\v\\U. \\\\<^sub>I P sat\\<^sub>p [{v}, rely, guar, post]) \\ \\\\<^sub>I P sat\\<^sub>p [U, rely, guar, post]\"\n apply auto using Allprecond apply blast\n using Conseq[of _ _ rely rely guar guar post post P] by auto\n\nlemma sat_pre_imp_allinpre: \" \\\\<^sub>I P sat\\<^sub>p [U, rely, guar, post] \\ v\\U \\ \\\\<^sub>I P sat\\<^sub>p [{v}, rely, guar, post]\"\n using Conseq[of _ _ rely rely guar guar post post P] by auto\n\nlemma stable_int_col2: \"stable \\s\\ r \\ stable \\t\\ r \\ stable \\s \\ t\\ r\"\n by auto\n\nlemma stable_int_col3: \"stable \\k\\ r \\ stable \\s\\ r \\ stable \\t\\ r \\ stable \\k \\ s \\ t\\ r\"\n by auto\n\nlemma stable_int_col4: \"stable \\m\\ r \\ stable \\k\\ r \\ stable \\s\\ r \n \\ stable \\t\\ r \\ stable \\m \\ k \\ s \\ t\\ r\"\n by auto\n\nlemma stable_int_col5: \"stable \\q\\ r \\ stable \\m\\ r \\ stable \\k\\ r \n \\ stable \\s\\ r \\ stable \\t\\ r \\ stable \\q \\ m \\ k \\ s \\ t\\ r\"\n by auto\n\nlemma stable_un2: \"stable s r \\ stable t r \\ stable (s \\ t) r\"\n by (simp add: stable_def)\n\nlemma stable_un_R: \"stable s r \\ stable s r' \\ stable s (r \\ r')\"\n by (meson UnE stable_def) \n\nlemma stable_un_S: \"\\t. stable s (P t) \\ stable s (\\t. P t)\" \napply(simp add:stable_def) by auto\n\nlemma stable_un_S2: \"\\t x. stable s (P t x) \\ stable s (\\t x. P t x)\" \napply(simp add:stable_def) by auto\n\nlemma pairv_IntI:\n\"y \\ \\\\(Pair V) \\ A\\ \\ y \\ \\\\(Pair V) \\ B\\ \\ y \\ \\\\(Pair V) \\ A \\ B\\\"\nby auto\n\nlemma pairv_rId:\n\"y \\ \\\\(Pair V) \\ A\\ \\ y \\ \\\\(Pair V) \\ A \\ Id\\\"\nby auto\n\nend", "meta": {"author": "SunHuan321", "repo": "uc-OS-verification", "sha": "760e159857c4015d6a9e3ccbe9f8247e4518862a", "save_path": "github-repos/isabelle/SunHuan321-uc-OS-verification", "path": "github-repos/isabelle/SunHuan321-uc-OS-verification/uc-OS-verification-760e159857c4015d6a9e3ccbe9f8247e4518862a/picore_SIMP_lemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.29132070158518397}} {"text": "subsection {* Relational Hoare calculus *}\n\ntheory utp_hoare_helper\nimports utp_hoare_total \nbegin\nnamed_theorems utp_hoare_hp\n\nsubsection {*Try Catch Laws*}\n\ntext{*In this section we introduce the algebraic laws of programming related to the assignment\n statement.*}\n\n\nlemma try_catch_unfold_hoare: (*because seq is assoc*)\n \"\\p\\try R ;; P catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\R ;; try P catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp\n apply auto\n apply smt+\ndone\n\nlemma try_catch_abr_fold_hoare[utp_hoare_hp]: (*because seq is assoc*)\n \"\\p\\R ;; try P catch Q end \\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\try R ;; P catch Q end \\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp\n apply auto\n apply smt+\ndone\n\nlemma try_catch_abr_throw_abr_hoare [utp_hoare_hp]:\n \"\\p\\ try THROW\\<^sub>A\\<^sub>B\\<^sub>R catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\ Q \\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp\n apply auto\n apply smt+\ndone\n\nlemma try_catch_abr_skip_abr_hoare [utp_hoare_hp]:\n \"\\p\\try SKIP\\<^sub>A\\<^sub>B\\<^sub>R catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\SKIP\\<^sub>A\\<^sub>B\\<^sub>R\\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp\n apply auto\n apply smt\ndone\n\nlemma try_catch_abr_assigns_abr_hoare [utp_hoare_hp]:\n \"\\p\\try \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \\p\\ \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R\\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp\n apply auto\n apply smt+\ndone\n\nsubsection {*Examples*}\n\nlemma\n \"\\p\\ try THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \\p\\Q\\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp only: utp_hoare_hp uabr_comp)\n\nlemma \n \"\\p\\THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; try \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\Q \\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp only: utp_hoare_hp uabr_comp)\n\nlemma\n \"\\p\\THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; try Simpl\\<^sub>A\\<^sub>B\\<^sub>R P catch Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \\p\\Q\\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp only: utp_hoare_hp uabr_comp)\n\nlemma \n \"\\p\\ try THROW\\<^sub>A\\<^sub>B\\<^sub>R;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P catch Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q end\\q\\\\<^sub>A\\<^sub>B\\<^sub>R = \n \\p\\Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q \\q\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp only: utp_hoare_hp uabr_comp)\n\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/HoareLogic/TotalCorrectness/Abrupt/utp_hoare_helper.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.29132070158518397}} {"text": "(*<*)\n\n(* Author: Kyndylan Nienhuis *)\n\ntheory Examples\n\nimports \n \"CHERI-instantiation.CheriInstantiation\"\n \"TraceProperties\"\nbegin\n(*>*)\n\nsection \\Reference monitor\\\n\ndefinition CapabilityAligned :: \"('a::len) word set \\ bool\" where\n \"CapabilityAligned addresses \\\n \\a b. (a AND NOT mask 5 = b AND NOT mask 5) \\\n a \\ addresses \\\n b \\ addresses\"\n\nlemma CapabilityAlignedE:\n fixes addresses :: \"('a::len) word set\"\n assumes \"CapabilityAligned addresses\"\n and \"a AND NOT mask 5 = b AND NOT mask 5\"\n and \"a \\ addresses\"\n shows \"b \\ addresses\"\nusing assms\nunfolding CapabilityAligned_def\nby blast\n\nlemma CapabilityAligned_CapAddressE:\n fixes addresses :: \"40 word set\"\n assumes \"CapabilityAligned addresses\"\n and \"GetCapAddress a = GetCapAddress b\"\n and \"a \\ addresses\"\n shows \"b \\ addresses\"\nproof -\n have \"a AND NOT mask 5 = b AND NOT mask 5\"\n using `GetCapAddress a = GetCapAddress b`\n unfolding GetCapAddress_def\n using slice_eq_imp_and_not_mask_eq[where x=a and y=b and n=5 and 'b=35]\n by auto\n thus ?thesis\n using assms CapabilityAlignedE\n by metis\nqed\n\nlemma TranslationCapabilityAligned:\n assumes \"CapabilityAligned segment\"\n shows \"CapabilityAligned (getTranslateAddresses segment t s)\"\nunfolding CapabilityAligned_def\nproof clarify\n fix a b :: PhysicalAddress\n assume aligned: \"a AND NOT mask 5 = b AND NOT mask 5\"\n and \"a \\ getTranslateAddresses segment t s\"\n then obtain virtA where \"virtA \\ segment\" \n and a: \"getTranslateAddr (virtA, t) s = Some a\"\n by auto\n define virtB where \"virtB \\ (virtA AND NOT mask 12) OR ((ucast b) AND mask 12)\"\n have virtB_upper: \"virtB AND NOT mask 12 = virtA AND NOT mask 12\"\n unfolding virtB_def\n by (simp add: word_ao_dist word_bool_alg.conj_assoc)\n have virtB_lower: \"ucast virtB AND mask 12 = b AND mask 12\"\n unfolding virtB_def\n by (auto simp: word_ao_dist word_bool_alg.conj_assoc ucast_and ucast_or ucast_not)\n have \"getTranslateAddr (virtA AND NOT mask 12, t) s = Some (a AND NOT mask 12)\"\n using a\n unfolding getTranslateAddr_and_not_mask\n by simp\n hence \"getTranslateAddr (virtB AND NOT mask 12, t) s = Some (b AND NOT mask 12)\"\n using arg_cong[OF aligned, where f=\"\\x. x AND NOT mask 12\"]\n by (simp add: virtB_upper)\n hence b: \"getTranslateAddr (virtB, t) s = Some b\"\n unfolding getTranslateAddr_split[where vAddr=virtB]\n by (auto simp: virtB_lower)\n have \"virtA AND NOT mask 5 = virtB AND NOT mask 5\"\n proof (intro word_eqI, simp add: word_size, intro impI)\n fix n :: nat\n assume \"n < 64\"\n thus \"(virtA AND NOT mask 5) !! n = (virtB AND NOT mask 5) !! n\"\n using word_eqD[OF aligned, where x=n]\n using word_eqD[OF virtB_upper, where x=n]\n using word_eqD[OF getTranslateAddr_ucast12[OF a], where x=n]\n using word_eqD[OF getTranslateAddr_ucast12[OF b], where x=n]\n by (cases \"n < 12\") (simp_all add: nth_ucast word_ops_nth_size word_size)\n qed \n from CapabilityAlignedE[OF assms this]\n have \"virtB \\ segment\"\n using `virtA \\ segment` \n by auto\n thus \"b \\ getTranslateAddresses segment t s\"\n using b\n unfolding getTranslateAddresses_def\n by auto\nqed\n\ndefinition AuthorityOfSegment where\n \"AuthorityOfSegment segment types \\\n \\SystemRegisterAccess = False,\n ExecutableAddresses = segment,\n LoadableAddresses = segment,\n CapLoadableAddresses = segment,\n StorableAddresses = segment,\n CapStorableAddresses = segment,\n LocalCapStorableAddresses = segment,\n SealableTypes = types,\n UnsealableTypes = types\\\"\n\nlemma AuthorityOfSegment_simp [simp]:\n shows \"SystemRegisterAccess (AuthorityOfSegment segment types) = False\"\n and \"ExecutableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"LoadableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"CapLoadableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"StorableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"CapStorableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"LocalCapStorableAddresses (AuthorityOfSegment segment types) = segment\"\n and \"SealableTypes (AuthorityOfSegment segment types) = types\"\n and \"UnsealableTypes (AuthorityOfSegment segment types) = types\"\nunfolding AuthorityOfSegment_def\nby simp_all\n\ndefinition GrantedCaps where \n \"GrantedCaps segment s \\\n {getCapReg r s |r. RegisterIsAlwaysAccessible r} \\\n {getMemCap (GetCapAddress a) s |a. a \\ getTranslateAddresses segment LOAD s}\"\n\nlemma ReadableCaps_AuthorityOfSegment:\n shows \"ReadableCaps (AuthorityOfSegment segment types) s = \n {cap. cap \\ GrantedCaps segment s \\ getTag cap}\"\nproof (intro equalityI; clarify, (intro conjI)?)\n fix cap\n assume \"cap \\ GrantedCaps segment s\"\n and \"getTag cap\"\n thus \"cap \\ ReadableCaps (AuthorityOfSegment segment types) s\"\n unfolding GrantedCaps_def\n proof (elim UnE; clarify)\n fix r\n assume \"RegisterIsAlwaysAccessible r\"\n and \"getTag (getCapReg r s)\"\n thus \"getCapReg r s \\ ReadableCaps (AuthorityOfSegment segment types) s\"\n by (auto intro!: ReadableCapsI[where loc=\"LocReg r\"])\n next\n fix a\n assume \"a \\ getTranslateAddresses segment LOAD s\"\n and \"getTag (getMemCap (GetCapAddress a) s)\"\n thus \"getMemCap (GetCapAddress a) s \\ ReadableCaps (AuthorityOfSegment segment types) s\"\n by (auto intro!: ReadableCapsI[where loc=\"LocMem (GetCapAddress a)\"]\n simp: getTranslateCapAddresses_def)\n qed\nnext\n fix cap\n assume readable: \"cap \\ ReadableCaps (AuthorityOfSegment segment types) s\"\n thus \"getTag cap\" by auto\n show \"cap \\ GrantedCaps segment s\"\n using readable\n unfolding ReadableCaps_def\n proof clarify\n fix loc\n assume loc: \"loc \\ ReadableLocations (AuthorityOfSegment segment types) s\"\n and tag: \"getTag (getCap loc s)\"\n show \"getCap loc s \\ GrantedCaps segment s\"\n proof (cases loc)\n case (LocReg r)\n hence \"RegisterIsAlwaysAccessible r\"\n using loc\n by auto\n thus ?thesis\n using loc tag LocReg\n unfolding GrantedCaps_def\n by auto\n next\n case (LocMem a)\n then obtain a' where \"a = GetCapAddress a'\" \"a' \\ getTranslateAddresses segment LOAD s\"\n using loc\n by (auto simp: getTranslateCapAddresses_def)\n thus ?thesis\n using loc tag LocMem\n unfolding GrantedCaps_def\n by auto\n qed\n qed\nqed\n\ndefinition UsableCaps where \n \"UsableCaps segment types s \\\n {cap\\GrantedCaps segment s. \n getTag cap \\\n (\\ getSealed cap \\ getType cap \\ types)}\"\n\ndefinition InvokableCaps where \n \"InvokableCaps segment s \\\n {cap\\GrantedCaps segment s. \n getTag cap \\ Permit_CCall (getPerms cap)}\"\n\nlemma Authority_le_AuthorityOfSegment:\n shows \"(GetAuthority cap \\ AuthorityOfSegment segment types) =\n (\\ getTag cap \\\n ((Permit_Seal (getPerms cap) \\\n Permit_Unseal (getPerms cap)) \\\n (\\t. ucast t \\ RegionOfCap cap \\ t \\ types)) \\\n ((Permit_Execute (getPerms cap) \\\n Permit_Load (getPerms cap) \\\n Permit_Load_Capability (getPerms cap) \\\n Permit_Store (getPerms cap) \\\n Permit_Store_Capability (getPerms cap) \\\n Permit_Store_Local_Capability (getPerms cap)) \\\n RegionOfCap cap \\ segment) \\\n \\ Access_System_Registers (getPerms cap))\"\nunfolding less_eq_CompartmentAuthority_ext_def\nunfolding GetAuthority_accessors\nby auto\n\ndefinition NoSystemRegisterAccess where\n \"NoSystemRegisterAccess segment types s \\\n \\cap. cap \\ UsableCaps segment types s \\ \n \\ Access_System_Registers (getPerms cap)\"\n\ndefinition ContainedCapBounds where\n \"ContainedCapBounds segment types s \\\n \\cap. (cap \\ UsableCaps segment types s \\\n (Permit_Execute (getPerms cap) \\\n Permit_Load (getPerms cap) \\\n Permit_Load_Capability (getPerms cap) \\\n Permit_Store (getPerms cap) \\\n Permit_Store_Capability (getPerms cap) \\\n Permit_Store_Local_Capability (getPerms cap))) \\\n RegionOfCap cap \\ segment\"\n\ndefinition ContainedObjectTypes where \n \"ContainedObjectTypes segment types s \\\n \\cap. (cap \\ UsableCaps segment types s \\\n (Permit_Seal (getPerms cap) \\\n Permit_Unseal (getPerms cap))) \\\n (\\t. ucast t \\ RegionOfCap cap \\ t \\ types)\"\n\ndefinition InvokableCapsSetup where \n \"InvokableCapsSetup segment types exit s == \n \\cap. cap \\ InvokableCaps segment s \\ \n getSealed cap \\ getType cap \\ types \\ getBase cap + getOffset cap \\ exit\"\n\ndefinition CapabilitySetup where\n \"CapabilitySetup segment types exit s \\\n NoSystemRegisterAccess segment types s \\\n ContainedCapBounds segment types s \\\n ContainedObjectTypes segment types s \\\n InvokableCapsSetup segment types exit s\"\n\ndefinition IsolationGuarantees where\n \"IsolationGuarantees segment exit s s' \\\n (getBase (getPCC s') + getPC s' \\ exit) \\\n (\\a. a \\ getTranslateAddresses segment STORE s \\ \n (getMemByte a s' = getMemByte a s \\\n getMemTag (GetCapAddress a) s' = getMemTag (GetCapAddress a) s)) \\\n (\\cd. (cd \\ 0 \\ cd \\ 1 \\ cd \\ 31) \\ \n getSCAPR cd s' = getSCAPR cd s)\"\n\nlemma CompartmentIsolation:\n assumes abstraction: \"CanBeSimulated sem\"\n and valid: \"getStateIsValid s\"\n and aligned: \"CapabilityAligned segment\"\n and ex: \"ExceptionPCs \\ exit\"\n and caps: \"CapabilitySetup segment types exit s\"\n and trace: \"(step # trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and inter: \"\\ PreservesDomain step\"\n shows \"IsolationGuarantees segment exit s s'\"\nunfolding IsolationGuarantees_def\nproof (intro conjI allI impI)\n have systemreg: \"\\cap. cap \\ UsableCaps segment types s \\ \n \\ Access_System_Registers (getPerms cap)\"\n using caps\n unfolding CapabilitySetup_def NoSystemRegisterAccess_def\n by simp\n have segment: \"\\cap. (cap \\ UsableCaps segment types s \\\n (Permit_Execute (getPerms cap) \\\n Permit_Load (getPerms cap) \\\n Permit_Load_Capability (getPerms cap) \\\n Permit_Store (getPerms cap) \\\n Permit_Store_Capability (getPerms cap) \\\n Permit_Store_Local_Capability (getPerms cap))) \\\n RegionOfCap cap \\ segment\"\n using caps\n unfolding CapabilitySetup_def ContainedCapBounds_def\n by simp\n have types: \"\\cap. (cap \\ UsableCaps segment types s \\\n (Permit_Seal (getPerms cap) \\\n Permit_Unseal (getPerms cap))) \\\n (\\t. ucast t \\ RegionOfCap cap \\ t \\ types)\"\n using caps\n unfolding CapabilitySetup_def ContainedObjectTypes_def\n by simp\n have invokable: \"\\cap. cap \\ InvokableCaps segment s \\ \n getSealed cap \\ getType cap \\ types \\ getBase cap + getOffset cap \\ exit\"\n using caps\n unfolding CapabilitySetup_def InvokableCapsSetup_def\n by simp\n define gPerm where \"gPerm = AuthorityOfSegment segment types\"\n note [simp] = ReadableCaps_AuthorityOfSegment\n have closed: \"PermIsClosed gPerm s\"\n unfolding gPerm_def PermIsClosed_def ReadableCaps_AuthorityOfSegment\n proof clarsimp\n fix cap\n assume \"cap \\ GrantedCaps segment s\"\n \"getTag cap\"\n \"getSealed cap \\ getType cap \\ types\"\n hence \"cap \\ UsableCaps segment types s\"\n unfolding UsableCaps_def\n by auto\n thus \"GetAuthority cap \\ AuthorityOfSegment segment types\"\n using systemreg[THEN spec[where x=cap]]\n using segment[THEN spec[where x=cap]]\n using types[THEN spec[where x=cap]]\n unfolding Authority_le_AuthorityOfSegment\n by simp\n qed\n note gPerm_def [simp]\n note gperm = AvailableAuthorityInClosedPerm[OF closed]\n have no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n using SystemRegisterAccess_le[OF gperm]\n by auto\n obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n using trace by auto\n note r_valid = TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n obtain crossing where [simp]: \"step = SwitchDomain crossing\"\n using inter by (cases step) auto\n show \"getMemByte a s' = getMemByte a s\"\n if \"a \\ getTranslateAddresses segment STORE s\" for a\n proof -\n have \"a \\ StorablePhysAddresses gPerm s\"\n using that\n unfolding StorablePhysAddresses_def\n by auto\n hence \"a \\ StorablePhysAddresses (AvailableAuthority s) s\"\n using StorablePhysAddresses_le[OF gperm]\n by auto\n thus ?thesis\n using MemoryInvariant[OF abstraction trace intra inter _ no_sys valid]\n by metis\n qed\n show \"getMemTag (GetCapAddress a) s' = getMemTag (GetCapAddress a) s\" \n if \"a \\ getTranslateAddresses segment STORE s\" for a\n proof -\n have \"GetCapAddress a \\ StorablePhysCapAddresses gPerm s\"\n proof\n assume \"GetCapAddress a \\ StorablePhysCapAddresses gPerm s\"\n then obtain b where \"b \\ getTranslateAddresses segment STORE s\"\n and \"GetCapAddress b = GetCapAddress a\"\n unfolding StorablePhysCapAddresses_def\n unfolding getTranslateCapAddresses_def\n by auto\n hence \"a \\ getTranslateAddresses segment STORE s\"\n using TranslationCapabilityAligned[OF aligned, where s=s and t=STORE]\n using CapabilityAligned_CapAddressE[where a=b and b=a]\n by auto\n thus False\n using that\n by auto\n qed\n hence \"GetCapAddress a \\ StorablePhysCapAddresses (AvailableAuthority s) s\"\n using StorablePhysCapAddresses_le[OF gperm]\n by auto\n hence \"getMemCap (GetCapAddress a) s' = getMemCap (GetCapAddress a) s\" \n using MemCapInvariant[OF abstraction trace intra inter _ no_sys valid]\n by metis\n thus ?thesis\n unfolding getMemTag_def\n by auto\n qed\n show \"getSCAPR cd s' = getSCAPR cd s\" if \"cd \\ 0 \\ cd \\ 1 \\ cd \\ 31\" for cd\n using SpecialCapRegisterInvariant[OF abstraction trace intra inter no_sys _ _ _ valid]\n using that\n by metis \n show \"getBase (getPCC s') + getPC s' \\ exit\"\n proof (cases crossing)\n case RaiseException\n hence \"(SwitchDomain RaiseException, s') \\ sem r\"\n using r\\<^sub>2 by auto\n from CanBeSimulatedE_Exception[OF abstraction this _ r_valid]\n have \"getBase (getPCC s') + getPC s' \\ ExceptionPCs\"\n by auto\n thus ?thesis\n using ex\n by auto\n next\n case (InvokeCapability cd cd')\n hence \"(SwitchDomain (InvokeCapability cd cd'), s') \\ sem r\"\n using r\\<^sub>2 by auto\n note invoke = CanBeSimulatedE_InvokeCap[OF abstraction this _ r_valid, \n where cd=cd and cd'=cd']\n have \"getCAPR cd r \\ AvailableCaps r\"\n using invoke by auto\n hence available: \"getCAPR cd r \\ AvailableCaps s\"\n using MonotonicityAvailableCaps[OF abstraction r\\<^sub>1 intra no_sys valid]\n by auto\n have \"InvokableCapsNotUnsealable gPerm s\"\n using invokable\n unfolding gPerm_def InvokableCapsNotUnsealable_def\n unfolding InvokableCaps_def\n by auto\n from InvokableCapsNotUnsealable_le[OF gperm this]\n have \"getCAPR cd r \\ ReadableCaps (AvailableAuthority s) s\"\n using AvailableInvokableCapsAreReadable[OF available]\n using invoke\n by metis\n hence \"getCAPR cd r \\ InvokableCaps segment s\"\n using ReadableCaps_le[OF gperm] invoke\n unfolding InvokableCaps_def\n by auto\n hence \"getBase (getCAPR cd r ) + getOffset (getCAPR cd r ) \\ exit\"\n using invokable\n by auto\n hence \"getBase (getPCC s') + getPC s' \\ exit\"\n using invoke\n by auto\n thus ?thesis\n by simp\n qed\nqed\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/properties/Examples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.29123481789530364}} {"text": "header {*\\subsection{Formulation of a subject-subject communication policy and an information flow \npolicy, and showing both can be derived from subject-object configuration data}*}\n\ntheory Step_policies\n imports Step_configuration\nbegin\n\nsubsubsection {* Specification\\label{sect:policy_specification} *}\n\ntext {* In order to use CISK, we need an information flow policy @{term ifp}\n relation. \n We also express a static subject-subject @{term sp_spec_subj_obj} and subject-object @{term sp_spec_subj_subj} access control policy\n for the implementation of the model. The following locale summarizes\n all properties we need. *}\n\nlocale policy_axioms =\n fixes sp_spec_subj_obj :: \"'a \\ obj_id_t \\ mode_t \\ bool\"\n and sp_spec_subj_subj :: \"'a \\ 'a \\ bool\"\n and ifp :: \"'a \\ 'a \\ bool\"\n\n assumes sp_spec_file_provider: \"\\ p1 p2 f m1 m2 .\n sp_spec_subj_obj p1 (FILEP f) m1 \\\n sp_spec_subj_obj p2 (FILEP f) m2 \\ sp_spec_subj_subj p1 p2\"\n\n and sp_spec_no_wronly_pages:\n \"\\ p x . sp_spec_subj_obj p (PAGE x) WRITE \\ sp_spec_subj_obj p (PAGE x) READ\"\n\n and ifp_reflexive:\n \"\\ p . ifp p p\"\n\n and ifp_compatible_with_sp_spec:\n \"\\ a b . sp_spec_subj_subj a b \\ ifp a b \\ ifp b a\"\n\n and ifp_compatible_with_ipc:\n \"\\ a b c x . (sp_spec_subj_subj a b\n \\ sp_spec_subj_obj b (PAGE x) WRITE \\ sp_spec_subj_obj c (PAGE x) READ)\n \\ ifp a c\"\nbegin (* empty *) end\n\nsubsubsection {* Derivation *}\n\ntext {* The configuration data only consists of a subject-object policy. \nWe derive the subject-subject policy and the information flow policy from the configuration data and prove that properties we specified in Section~\\ref{sect:policy_specification} are satisfied. *}\n\nlocale abstract_policy_derivation =\n fixes configuration_subj_obj :: \"'a \\ obj_id_t \\ mode_t \\ bool\"\nbegin\n\n definition \"sp_spec_subj_obj a x m \\\n configuration_subj_obj a x m \\ (\\ y . x = PAGE y \\ m = READ \\ configuration_subj_obj a x WRITE)\"\n\n definition \"sp_spec_subj_subj a b \\\n \\ f m1 m2 . sp_spec_subj_obj a (FILEP f) m1 \\ sp_spec_subj_obj b (FILEP f) m2\"\n\n definition \"ifp a b \\\n sp_spec_subj_subj a b\n \\ sp_spec_subj_subj b a\n \\ (\\ c y . sp_spec_subj_subj a c\n \\ sp_spec_subj_obj c (PAGE y) WRITE\n \\ sp_spec_subj_obj b (PAGE y) READ)\n \\ (a = b)\"\n\ntext {* Show that the policies specified in Section~\\ref{sect:policy_specification} can be derived from the configuration and their definitions. *}\n\n lemma correct:\n shows \"policy_axioms sp_spec_subj_obj sp_spec_subj_subj ifp\"\n proof (unfold_locales)\n show sp_spec_file_provider:\n \"\\ p1 p2 f m1 m2 .\n sp_spec_subj_obj p1 (FILEP f) m1 \\\n sp_spec_subj_obj p2 (FILEP f) m2 \\ sp_spec_subj_subj p1 p2\"\n unfolding sp_spec_subj_subj_def by auto\n show sp_spec_no_wronly_pages:\n \"\\ p x . sp_spec_subj_obj p (PAGE x) WRITE \\ sp_spec_subj_obj p (PAGE x) READ\"\n unfolding sp_spec_subj_obj_def by auto\n show ifp_reflexive:\n \"\\ p . ifp p p\"\n unfolding ifp_def by auto\n show ifp_compatible_with_sp_spec:\n \"\\ a b . sp_spec_subj_subj a b \\ ifp a b \\ ifp b a\"\n unfolding ifp_def by auto\n show ifp_compatible_with_ipc:\n \"\\ a b c x . (sp_spec_subj_subj a b\n \\ sp_spec_subj_obj b (PAGE x) WRITE \\ sp_spec_subj_obj c (PAGE x) READ)\n \\ ifp a c\"\n unfolding ifp_def by auto\n qed\nend\n\ntype_synonym sp_subj_subj_t = \"partition_id_t \\ partition_id_t \\ bool\"\ntype_synonym sp_subj_obj_t = \"partition_id_t \\ obj_id_t \\ mode_t \\ bool\"\n\ninterpretation Policy: abstract_policy_derivation \"configured_subj_obj\".\ninterpretation Policy_properties: policy_axioms Policy.sp_spec_subj_obj Policy.sp_spec_subj_subj Policy.ifp\n using Policy.correct by auto\n\nlemma example_how_to_use_properties_in_proofs:\n shows \"\\ p . Policy.ifp p p\"\n using Policy_properties.ifp_reflexive by auto\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CISC-Kernel/step/Step_policies.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.291210165906773}} {"text": "theory flash11Bra imports flash11Rev\n \n begin\nlemma onInv11:\n\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" and \n\n b1:\"r \\ rules N\" and b2:\"invf=inv11 iInv1 iInv2 \"\n shows \"invHoldForRule' s invf r (invariants N)\" \n proof - \nhave c1:\"ex1P N (% iRule1 . r=NI_Local_GetX_PutX1 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_GetX iRule1 )\\ex1P N (% iRule1 . r=NI_Replace iRule1 )\\ex0P N ( r=NI_ShWb N )\\ex0P N ( r=PI_Local_GetX_GetX2 )\\ex0P N ( r=NI_Local_PutXAcksDone )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX7 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak2 iRule1 )\\ex0P N ( r=NI_ReplaceHomeShrVld )\\ex1P N (% iRule1 . r=NI_Remote_Put iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX5 N iRule1 )\\ex0P N ( r=NI_Wb )\\ex1P N (% iRule1 . r=NI_Local_Get_Get iRule1 )\\ex0P N ( r=PI_Local_Replace )\\ex1P N (% iRule1 . r=NI_ReplaceShrVld iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX8 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_InvAck_2 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Nak2 iRule1 iRule2 )\\ex1P N (% iRule1 . r=PI_Remote_Replace iRule1 )\\ex0P N ( r=NI_Nak_Home )\\ex1P N (% iRule1 . r=NI_Local_Get_Put2 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_InvAck_1 iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX11 N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX6 N iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_Get_Put2 iRule1 iRule2 )\\ex0P N ( r=PI_Local_Get_Put )\\ex0P N ( r=PI_Local_GetX_PutX1 N )\\ex1P N (% iRule1 . r=NI_InvAck_1_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak1 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak2 iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX10_home N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_Get iRule1 )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak3 iRule1 )\\ex2P N (% iRule1 iRule2 . r=NI_Local_GetX_PutX10 N iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX2 N iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_Get_Put1 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_PutX iRule1 )\\ex1P N (% iRule1 . r=Store iRule1 )\\ex0P N ( r=NI_FAck )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX3 N iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX3 )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_PutX iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX8_home N iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put1 N iRule1 )\\ex0P N ( r=PI_Local_GetX_GetX1 )\\ex0P N ( r=StoreHome )\\ex2P N (% iRule1 iRule2 . r=NI_Remote_GetX_Nak iRule1 iRule2 )\\ex1P N (% iRule1 . r=NI_Inv iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_PutX iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX4 )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX4 N iRule1 )\\ex1P N (% iRule1 . r=NI_Nak iRule1 )\\ex0P N ( r=PI_Local_GetX_PutX2 N )\\ex0P N ( r=NI_Local_Put )\\ex1P N (% iRule1 . r=NI_Local_GetX_Nak1 iRule1 )\\ex0P N ( r=NI_Nak_Clear )\\ex0P N ( r=PI_Local_PutX )\\ex1P N (% iRule1 . r=NI_Local_Get_Nak3 iRule1 )\\ex1P N (% iRule1 . r=NI_Remote_GetX_Nak_Home iRule1 )\\ex0P N ( r=PI_Local_Get_Get )\\ex1P N (% iRule1 . r=NI_Local_GetX_PutX9 N iRule1 )\\ex1P N (% iRule1 . r=PI_Remote_GetX iRule1 )\\ex0P N ( r=NI_ReplaceHome )\\ex1P N (% iRule1 . r=NI_Remote_GetX_PutX_Home iRule1 )\\ex1P N (% iRule1 . r=NI_Local_Get_Put3 iRule1 )\" \n\n apply(cut_tac b1)\n apply auto\n done moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_GetXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ShWb N )\n\"\n \n from c1 have c2:\" r= NI_ShWb N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ShWb N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ShWbVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX2 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_PutXAcksDone )\n\"\n \n from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutXAcksDoneVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX7 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX7 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX7VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHomeShrVld )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeShrVldVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Put iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Put iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX5 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX5 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX5VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Wb )\n\"\n \n from c1 have c2:\" r= NI_Wb \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Wb ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_WbVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_GetVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Replace )\n\"\n \n from c1 have c2:\" r= PI_Local_Replace \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_ReplaceVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_ReplaceShrVld iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_ReplaceShrVld iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_ReplaceShrVldVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX8 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX8 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Nak2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Nak2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Replace iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Replace iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_ReplaceVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Home )\n\"\n \n from c1 have c2:\" r= NI_Nak_Home \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_HomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_InvAck_1 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_InvAck_1 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX11 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX11 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX11VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX6 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX6 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX6VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_Get_Put2 iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_Get_Put2 iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Put )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_PutVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX1 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_InvAck_1_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_InvAck_1_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvAck_1_HomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Nak1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak2 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak2 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX10_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX10_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10_homeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_Get iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_Get iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak3VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Local_GetX_PutX10 N iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Local_GetX_PutX10 N iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX10VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX2 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX2 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_Get_Put1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_Get_Put1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_Get_Put1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_PutXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= Store iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= Store iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (Store iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis StoreVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_FAck )\n\"\n \n from c1 have c2:\" r= NI_FAck \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_FAck ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_FAckVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX3 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX3 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX3VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX3 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX3VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_PutX iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_PutX iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX8_home N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX8_home N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX8_homeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put1 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put1 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_GetX1 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_GetX1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= StoreHome )\n\"\n \n from c1 have c2:\" r= StoreHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (StoreHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis StoreHomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iRule1 iRule2 . r= NI_Remote_GetX_Nak iRule1 iRule2 )\n\"\n \n from c1 obtain iRule1 iRule2 where c2:\" iRule1~=iRule2 \\ iRule1 \\ N \\ iRule2 \\ N \\ r= NI_Remote_GetX_Nak iRule1 iRule2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_NakVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Inv iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Inv iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_InvVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_PutX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_PutX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_PutXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX4 )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX4VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX4 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX4 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX4VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Nak iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Nak iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_NakVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_GetX_PutX2 N )\n\"\n \n from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_GetX_PutX2VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= NI_Local_Put )\n\"\n \n from c1 have c2:\" r= NI_Local_Put \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Put ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Local_PutVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_Nak1 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_Nak1 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_Nak1VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_Nak_Clear )\n\"\n \n from c1 have c2:\" r= NI_Nak_Clear \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_Nak_ClearVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( r= PI_Local_PutX )\n\"\n \n from c1 have c2:\" r= PI_Local_PutX \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_PutXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Nak3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Nak3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Nak3VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_Nak_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_Nak_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_Nak_HomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= PI_Local_Get_Get )\n\"\n \n from c1 have c2:\" r= PI_Local_Get_Get \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis PI_Local_Get_GetVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_GetX_PutX9 N iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_GetX_PutX9 N iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_GetX_PutX9VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= PI_Remote_GetX iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= PI_Remote_GetX iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis PI_Remote_GetXVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex0P N ( r= NI_ReplaceHome )\n\"\n \n from c1 have c2:\" r= NI_ReplaceHome \" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n apply(cut_tac a1 a2 a3 b2 c2 )\n by (metis NI_ReplaceHomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Remote_GetX_PutX_Home iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Remote_GetX_PutX_Home iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Remote_GetX_PutX_HomeVsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n } moreover\n {assume c1: \"ex1P N (% iRule1 . r= NI_Local_Get_Put3 iRule1 )\n\"\n \n from c1 obtain iRule1 where c2:\" iRule1 \\ N \\ r= NI_Local_Get_Put3 iRule1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N) \"\n apply(cut_tac c2 a1 a2 a3 )\n by (metis NI_Local_Get_Put3VsInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 b2, metis) \n }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n by blast \n qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash11Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.29121016590677296}} {"text": "section {*FUNCTION\\_\\_SDPDA\\_TO\\_LR1\\_STD*}\ntheory\n FUNCTION__SDPDA_TO_LR1_STD\n\nimports\n PRJ_12_04_06_07__ENTRY\n\nbegin\n\ndefinition F_SDPDA_TO_LR1_STD__SpecInput :: \"\n ('nonterminal, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_SDPDA_TO_LR1_STD__SpecInput G \\\n valid_simple_dpda G\n \\ \\ duplicate_marking G\"\n\ndefinition F_SDPDA_TO_LR1_STD__SpecOutput :: \"\n ('state, 'event, 'stack) epda\n \\ ('nonterminal, 'event) cfg option\n \\ bool\"\n where\n \"F_SDPDA_TO_LR1_STD__SpecOutput Gi Go \\\n case Go of\n None \\ epdaS.marked_language Gi = {}\n | Some Go \\\n valid_cfg Go\n \\ cfgLM.marked_language Go = epdaS.marked_language Gi\n \\ cfg_LRk Go (Suc 0)\"\n\ntheorem F_SDPDA_TO_LR1_STD__SOUND: \"\n F_SDPDA_TO_LR1_STD__SpecInput G\n \\ F_SDPDA_TO_LR1_STD__SpecOutput G (F_SDPDA_TO_LR1_STD G)\"\n apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_STD__SOUND)\n apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac G=\"F_SDPDA_TO_CFG_STD G\" in F_CFG_TRIM__SOUND)\n apply(simp add: F_CFG_TRIM__SpecInput_def F_SDPDA_TO_CFG_STD__SpecOutput_def)\n apply(case_tac \"F_SDPDA_TO_LR1_STD G\")\n apply(clarsimp)\n apply(simp add: F_SDPDA_TO_LR1_STD_def)\n apply(simp add: F_CFG_TRIM__SpecOutput_def F_CFG_TRIM__SpecInput_def F_SDPDA_TO_CFG_STD__SpecOutput_def)\n apply (metis CFG_lang_lm_lang_equal)\n apply(clarsimp)\n apply(simp add: F_SDPDA_TO_LR1_STD_def)\n apply(simp add: F_CFG_TRIM__SpecOutput_def F_CFG_TRIM__SpecInput_def F_SDPDA_TO_CFG_STD__SpecOutput_def)\n apply(rename_tac Go)\n apply(rule conjI)\n apply (metis CFG_lang_lm_lang_equal)\n apply(rule F_SDPDA_TO_CFG_STD__enforces_cfg_LRk)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_07/FUNCTION__SDPDA_TO_LR1_STD.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2912101596065428}} {"text": "theory Sequential_Composition_Ref\n imports \"Basic_Modules/Component_Types/Electoral_Module_Ref\"\n Verified_Voting_Rule_Construction.Sequential_Composition\n Refine_Imperative_HOL.Sepref\nbegin\n\ndefinition seq_opt :: \"'a :: {default, heap, hashable} Electoral_Module \\ \n 'a Electoral_Module\n \\ 'a set \\ 'a Profile \\ \n 'a Result nres\" \n where \"seq_opt m n A p \\ do {\n let (e, r, d) = m A p;\n ASSERT (finite d);\n let newA = d;\n ASSERT(newA \\ A);\n ASSERT (finite_profile A p);\n let newp = limit_profile newA p;\n ASSERT (finite_profile newA newp);\n let (ne, nr, nd) = n newA newp;\n RETURN (e \\ ne, r \\ nr, nd) }\"\n\nlemma seq_opt_correct: \n fixes m n :: \"'a :: {default, heap, hashable} Electoral_Module\"\n assumes em_m: \"electoral_module m\" and\n em_n: \"electoral_module n\"\nshows \"(uncurry (seq_opt m n), uncurry (RETURN oo (sequential_composition' m n))) \\\n [\\ (A, p). finite_profile A p]\\<^sub>f (\\Id\\set_rel \\\\<^sub>r \\\\Id \\\\<^sub>r Id\\set_rel\\list_rel) \\ \n \\\\Id\\set_rel \\\\<^sub>r \\Id\\set_rel \\\\<^sub>r \\Id\\set_rel\\nres_rel\"\n unfolding comp_apply seq_opt_def\n apply (intro frefI) apply clarsimp\n using assms apply (refine_vcg)\n apply auto\n subgoal unfolding electoral_module_def\n by (metis def_presv_fin_prof em_m snd_conv)\n apply (metis defer_in_alts snd_conv subsetD) \n by (metis def_presv_fin_prof limit_profile.elims snd_conv)\n\nlocale Seqcomp_Impl =\n fixes m n :: \"'a :: {default, heap, hashable} Electoral_Module\"\n fixes m_sep n_sep :: \"'a :: {default, heap, hashable} Electoral_Module_Sep\"\nassumes em_m: \"electoral_module m\" and\n em_n: \"electoral_module n\"\n assumes m_sep_correct: \"(uncurry m_sep, uncurry (RETURN oo m)) \\ elec_mod_seprel id_assn\"\n assumes n_sep_correct: \"(uncurry n_sep, uncurry (RETURN oo n)) \\ elec_mod_seprel id_assn\"\nbegin\n\n lemma this_loc: \"Seqcomp_Impl m n m_sep n_sep\" by unfold_locales\n\n sepref_register m\n sepref_register n\n\n declare m_sep_correct[sepref_fr_rules]\n declare n_sep_correct[sepref_fr_rules]\n\nschematic_goal seqcomp_sepimpl:\n \"(uncurry ?f2, uncurry (seq_opt m n)) \\ elec_mod_seprel id_assn\"\n unfolding seq_opt_def\n by sepref\n\nconcrete_definition (in -) seqcomp_sep_uc uses Seqcomp_Impl.seqcomp_sepimpl\n prepare_code_thms (in -) seqcomp_sep_uc_def\nlemmas seqcomp_sep_ucp_refine = seqcomp_sep_uc.refine[OF this_loc]\n\nschematic_goal seqcomp_sepcurried:\n \"?curried = curry (seqcomp_sep_uc m_sep n_sep)\" by auto\n\nconcrete_definition (in -) seqcomp_sep uses Seqcomp_Impl.seqcomp_sepcurried\n\ntheorem seqcomp_sep_correct:\n shows \"(uncurry (seqcomp_sep m_sep n_sep), uncurry (RETURN oo (PR_CONST (m \\ n)))) \n\\ elec_mod_seprel id_assn\"\n using seqcomp_sep_ucp_refine[FCOMP seq_opt_correct, OF em_m em_n]\n unfolding seqcomp_alt_eq seqcomp_sep_def\n by (simp)\n\nend\n\nabbreviation comp4 (infixl \"oooo\" 55) where \"f oooo g \\ \\x. f ooo (g x)\"\n\n(*theorem seqcomp_sep_correct [sepref_fr_rules]:\n shows \"(uncurry3 (seqcomp_sep), uncurry3 (RETURN oooo sequential_composition))\n \\ [\\ (((m,n),a),b). electoral_module m \\\n electoral_module n \\ finite_profile a b]\\<^sub>a (elec_mod_assn_atom nat_assn)\\<^sup>k *\\<^sub>a \n (elec_mod_assn_atom nat_assn)\\<^sup>k \n *\\<^sub>a (alts_set_impl_assn nat_assn)\\<^sup>k *\\<^sub>a (list_assn (ballot_assn nat_assn))\\<^sup>k \n \\ (result_impl_assn nat_assn)\"\n apply (intro hfrefI)\n using Seqcomp_Impl.seqcomp_sep_correct\n unfolding Seqcomp_Impl_def\n unfolding hn_refine_def hfref_def elec_mod_assn_atom_def hfref_def\n apply (sep_auto simp del: sequential_composition.simps) done\n\nsepref_register \"sequential_composition\"\n\ndeclare seqcomp_sep_correct [sepref_fr_rules]\n\nsepref_decl_op seqi: \"(uncurry3 sequential_composition)\" :: \n \"\\elec_mod_rel_orig R, \\elec_mod_rel_orig R, elec_mod_rel_orig R\\fun_rel\\fun_rel\" where \n \"R = (Id)\" apply standard apply (rule nres_relI) unfolding elec_mod_rel_orig_def apply auto\n done*)\n\n\nabbreviation sequence_opt\n (infix \"\\sep\" 50) where\n \"m \\sep n \\ seqcomp_sep m n\"\n\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Compositional_Structures/Sequential_Composition_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.2911157538784282}} {"text": "(* Title: HOL/Auth/OtwayRees_AN.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection\\The Otway-Rees Protocol as Modified by Abadi and Needham\\\n\ntheory OtwayRees_AN imports Public begin\n\ntext\\\nThis simplified version has minimal encryption and explicit messages.\n\nNote that the formalization does not even assume that nonces are fresh.\nThis is because the protocol does not rely on uniqueness of nonces for\nsecurity, only for freshness, and the proof script does not prove freshness\nproperties.\n\nFrom page 11 of\n Abadi and Needham (1996). \n Prudent Engineering Practice for Cryptographic Protocols.\n IEEE Trans. SE 22 (1)\n\\\n\ninductive_set otway :: \"event list set\"\n where\n Nil: \\\\The empty trace\\\n \"[] \\ otway\"\n\n | Fake: \\\\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"[| evsf \\ otway; X \\ synth (analz (knows Spy evsf)) |]\n ==> Says Spy B X # evsf \\ otway\"\n\n \n | Reception: \\\\A message that has been sent can be received by the\n intended recipient.\\\n \"[| evsr \\ otway; Says A B X \\set evsr |]\n ==> Gets B X # evsr \\ otway\"\n\n | OR1: \\\\Alice initiates a protocol run\\\n \"evs1 \\ otway\n ==> Says A B \\Agent A, Agent B, Nonce NA\\ # evs1 \\ otway\"\n\n | OR2: \\\\Bob's response to Alice's message.\\\n \"[| evs2 \\ otway;\n Gets B \\Agent A, Agent B, Nonce NA\\ \\set evs2 |]\n ==> Says B Server \\Agent A, Agent B, Nonce NA, Nonce NB\\\n # evs2 \\ otway\"\n\n | OR3: \\\\The Server receives Bob's message. Then he sends a new\n session key to Bob with a packet for forwarding to Alice.\\\n \"[| evs3 \\ otway; Key KAB \\ used evs3;\n Gets Server \\Agent A, Agent B, Nonce NA, Nonce NB\\\n \\set evs3 |]\n ==> Says Server B\n \\Crypt (shrK A) \\Nonce NA, Agent A, Agent B, Key KAB\\,\n Crypt (shrK B) \\Nonce NB, Agent A, Agent B, Key KAB\\\\\n # evs3 \\ otway\"\n\n | OR4: \\\\Bob receives the Server's (?) message and compares the Nonces with\n those in the message he previously sent the Server.\n Need @{term \"B \\ Server\"} because we allow messages to self.\\\n \"[| evs4 \\ otway; B \\ Server;\n Says B Server \\Agent A, Agent B, Nonce NA, Nonce NB\\ \\set evs4;\n Gets B \\X, Crypt(shrK B)\\Nonce NB,Agent A,Agent B,Key K\\\\\n \\set evs4 |]\n ==> Says B A X # evs4 \\ otway\"\n\n | Oops: \\\\This message models possible leaks of session keys. The nonces\n identify the protocol run.\\\n \"[| evso \\ otway;\n Says Server B\n \\Crypt (shrK A) \\Nonce NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\Nonce NB, Agent A, Agent B, Key K\\\\\n \\set evso |]\n ==> Notes Spy \\Nonce NA, Nonce NB, Key K\\ # evso \\ otway\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\ntext\\A \"possibility property\": there are traces that reach the end\\\nlemma \"[| B \\ Server; Key K \\ used [] |]\n ==> \\evs \\ otway.\n Says B A (Crypt (shrK A) \\Nonce NA, Agent A, Agent B, Key K\\)\n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n [THEN otway.OR1, THEN otway.Reception,\n THEN otway.OR2, THEN otway.Reception,\n THEN otway.OR3, THEN otway.Reception, THEN otway.OR4])\napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n \"[| Gets B X \\ set evs; evs \\ otway |] ==> \\A. Says A B X \\ set evs\"\nby (erule rev_mp, erule otway.induct, auto)\n\n\n\ntext\\For reasoning about the encrypted portion of messages\\\n\nlemma OR4_analz_knows_Spy:\n \"[| Gets B \\X, Crypt(shrK B) X'\\ \\ set evs; evs \\ otway |]\n ==> X \\ analz (knows Spy evs)\"\nby blast\n\n\ntext\\Theorems of the form @{term \"X \\ parts (spies evs)\"} imply that\nNOBODY sends messages containing X!\\\n\ntext\\Spy never sees a good agent's shared key!\\\nlemma Spy_see_shrK [simp]:\n \"evs \\ otway ==> (Key (shrK A) \\ parts (knows Spy evs)) = (A \\ bad)\"\nby (erule otway.induct, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ otway ==> (Key (shrK A) \\ analz (knows Spy evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"[|Key (shrK A) \\ parts (knows Spy evs); evs \\ otway|] ==> A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection\\Proofs involving analz\\\n\ntext\\Describes the form of K and NA when the Server sends this message.\\\nlemma Says_Server_message_form:\n \"[| Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs;\n evs \\ otway |]\n ==> K \\ range shrK & (\\i. NA = Nonce i) & (\\j. NB = Nonce j)\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\n\n(****\n The following is to prove theorems of the form\n\n Key K \\ analz (insert (Key KAB) (knows Spy evs)) ==>\n Key K \\ analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext\\Session keys are not used to encrypt other session keys\\\n\ntext\\The equality makes the induction hypothesis easier to apply\\\nlemma analz_image_freshK [rule_format]:\n \"evs \\ otway ==>\n \\K KK. KK <= -(range shrK) -->\n (Key K \\ analz (Key`KK Un (knows Spy evs))) =\n (K \\ KK | Key K \\ analz (knows Spy evs))\"\napply (erule otway.induct) \napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n \"[| evs \\ otway; KAB \\ range shrK |] ==>\n (Key K \\ analz (insert (Key KAB) (knows Spy evs))) =\n (K = KAB | Key K \\ analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\The Key K uniquely identifies the Server's message.\\\nlemma unique_session_keys:\n \"[| Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, K\\\\\n \\ set evs;\n Says Server B'\n \\Crypt (shrK A') \\NA', Agent A', Agent B', K\\,\n Crypt (shrK B') \\NB', Agent A', Agent B', K\\\\\n \\ set evs;\n evs \\ otway |]\n ==> A=A' & B=B' & NA=NA' & NB=NB'\"\napply (erule rev_mp, erule rev_mp, erule otway.induct, simp_all)\napply blast+ \\\\OR3 and OR4\\\ndone\n\n\nsubsection\\Authenticity properties relating to NA\\\n\ntext\\If the encrypted message appears then it originated with the Server!\\\nlemma NA_Crypt_imp_Server_msg [rule_format]:\n \"[| A \\ bad; A \\ B; evs \\ otway |]\n ==> Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\ \\ parts (knows Spy evs)\n --> (\\NB. Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs)\"\napply (erule otway.induct, force)\napply (simp_all add: ex_disj_distrib)\napply blast+ \\\\Fake, OR3\\\ndone\n\n\ntext\\Corollary: if A receives B's OR4 message then it originated with the\n Server. Freshness may be inferred from nonce NA.\\\nlemma A_trusts_OR4:\n \"[| Says B' A (Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\) \\ set evs;\n A \\ bad; A \\ B; evs \\ otway |]\n ==> \\NB. Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs\"\nby (blast intro!: NA_Crypt_imp_Server_msg)\n\n\ntext\\Crucial secrecy property: Spy does not see the keys sent in msg OR3\n Does not in itself guarantee security: an attack could violate\n the premises, e.g. by having @{term \"A=Spy\"}\\\nlemma secrecy_lemma:\n \"[| A \\ bad; B \\ bad; evs \\ otway |]\n ==> Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs -->\n Notes Spy \\NA, NB, Key K\\ \\ set evs -->\n Key K \\ analz (knows Spy evs)\"\napply (erule otway.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (drule_tac [6] OR4_analz_knows_Spy)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes)\napply spy_analz \\\\Fake\\\napply (blast dest: unique_session_keys)+ \\\\OR3, OR4, Oops\\\ndone\n\n\nlemma Spy_not_see_encrypted_key:\n \"[| Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs;\n Notes Spy \\NA, NB, Key K\\ \\ set evs;\n A \\ bad; B \\ bad; evs \\ otway |]\n ==> Key K \\ analz (knows Spy evs)\"\n by (metis secrecy_lemma)\n\n\ntext\\A's guarantee. The Oops premise quantifies over NB because A cannot know\n what it is.\\\nlemma A_gets_good_key:\n \"[| Says B' A (Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\) \\ set evs;\n \\NB. Notes Spy \\NA, NB, Key K\\ \\ set evs;\n A \\ bad; B \\ bad; A \\ B; evs \\ otway |]\n ==> Key K \\ analz (knows Spy evs)\"\n by (metis A_trusts_OR4 secrecy_lemma)\n\n\n\nsubsection\\Authenticity properties relating to NB\\\n\ntext\\If the encrypted message appears then it originated with the Server!\\\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n \"[| B \\ bad; A \\ B; evs \\ otway |]\n ==> Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\ \\ parts (knows Spy evs)\n --> (\\NA. Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs)\"\napply (erule otway.induct, force, simp_all add: ex_disj_distrib)\napply blast+ \\\\Fake, OR3\\\ndone\n\n\n\ntext\\Guarantee for B: if it gets a well-formed certificate then the Server\n has sent the correct message in round 3.\\\nlemma B_trusts_OR3:\n \"[| Says S B \\X, Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs;\n B \\ bad; A \\ B; evs \\ otway |]\n ==> \\NA. Says Server B\n \\Crypt (shrK A) \\NA, Agent A, Agent B, Key K\\,\n Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs\"\nby (blast intro!: NB_Crypt_imp_Server_msg)\n\n\ntext\\The obvious combination of \\B_trusts_OR3\\ with \n \\Spy_not_see_encrypted_key\\\\\nlemma B_gets_good_key:\n \"[| Gets B \\X, Crypt (shrK B) \\NB, Agent A, Agent B, Key K\\\\\n \\ set evs;\n \\NA. Notes Spy \\NA, NB, Key K\\ \\ set evs;\n A \\ bad; B \\ bad; A \\ B; evs \\ otway |]\n ==> Key K \\ analz (knows Spy evs)\"\nby (blast dest: B_trusts_OR3 Spy_not_see_encrypted_key)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/OtwayRees_AN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512488, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.2911157538784281}} {"text": "theory Semantics_Ternary\nimports Matching_Ternary \"../Common/List_Misc\"\nbegin\n\nsection\\Embedded Ternary-Matching Big Step Semantics\\\n\nsubsection\\Ternary Semantics (Big Step)\\\n\ninductive approximating_bigstep :: \"('a, 'p) match_tac \\ 'p \\ 'a rule list \\ state \\ state \\ bool\"\n (\"_,_\\ \\_, _\\ \\\\<^sub>\\ _\" [60,60,20,98,98] 89)\n for \\ and p where\nskip: \"\\,p\\ \\[], t\\ \\\\<^sub>\\ t\" |\naccept: \"\\matches \\ m Accept p\\ \\ \\,p\\ \\[Rule m Accept], Undecided\\ \\\\<^sub>\\ Decision FinalAllow\" |\ndrop: \"\\matches \\ m Drop p\\ \\ \\,p\\ \\[Rule m Drop], Undecided\\ \\\\<^sub>\\ Decision FinalDeny\" |\nreject: \"\\matches \\ m Reject p\\ \\ \\,p\\ \\[Rule m Reject], Undecided\\ \\\\<^sub>\\ Decision FinalDeny\" |\nlog: \"\\matches \\ m Log p\\ \\ \\,p\\ \\[Rule m Log], Undecided\\ \\\\<^sub>\\ Undecided\" |\nempty: \"\\matches \\ m Empty p\\ \\ \\,p\\ \\[Rule m Empty], Undecided\\ \\\\<^sub>\\ Undecided\" |\nnomatch: \"\\\\ matches \\ m a p\\ \\ \\,p\\ \\[Rule m a], Undecided\\ \\\\<^sub>\\ Undecided\" | \ndecision: \"\\,p\\ \\rs, Decision X\\ \\\\<^sub>\\ Decision X\" |\nseq: \"\\\\,p\\ \\rs\\<^sub>1, Undecided\\ \\\\<^sub>\\ t; \\,p\\ \\rs\\<^sub>2, t\\ \\\\<^sub>\\ t'\\ \\ \\,p\\ \\rs\\<^sub>1@rs\\<^sub>2, Undecided\\ \\\\<^sub>\\ t'\" \n\n\n\nthm approximating_bigstep.induct[of \\ p rs s t P]\n(*tuned induction rule*)\nlemma approximating_bigstep_induct[case_names Skip Allow Deny Log Nomatch Decision Seq, induct pred: approximating_bigstep] : \"\\,p\\ \\rs,s\\ \\\\<^sub>\\ t \\\n(\\t. P [] t t) \\\n(\\m a. matches \\ m a p \\ a = Accept \\ P [Rule m a] Undecided (Decision FinalAllow)) \\\n(\\m a. matches \\ m a p \\ a = Drop \\ a = Reject \\ P [Rule m a] Undecided (Decision FinalDeny)) \\\n(\\m a. matches \\ m a p \\ a = Log \\ a = Empty \\ P [Rule m a] Undecided Undecided) \\\n(\\m a. \\ matches \\ m a p \\ P [Rule m a] Undecided Undecided) \\\n(\\rs X. P rs (Decision X) (Decision X)) \\\n(\\rs rs\\<^sub>1 rs\\<^sub>2 t t'. rs = rs\\<^sub>1 @ rs\\<^sub>2 \\ \\,p\\ \\rs\\<^sub>1,Undecided\\ \\\\<^sub>\\ t \\ P rs\\<^sub>1 Undecided t \\ \\,p\\ \\rs\\<^sub>2,t\\ \\\\<^sub>\\ t' \\ P rs\\<^sub>2 t t' \\ P rs Undecided t')\n \\ P rs s t\"\nby (induction rule: approximating_bigstep.induct) (simp_all)\n\n\nlemma skipD: \"\\,p\\ \\[], s\\ \\\\<^sub>\\ t \\ s = t\"\nby (induction \"[]::'a rule list\" s t rule: approximating_bigstep_induct) (simp_all)\n\nlemma decisionD: \"\\,p\\ \\rs, Decision X\\ \\\\<^sub>\\ t \\ t = Decision X\"\nby (induction rs \"Decision X\" t rule: approximating_bigstep_induct) (simp_all)\n\nlemma acceptD: \"\\,p\\ \\[Rule m Accept], Undecided\\ \\\\<^sub>\\ t \\ matches \\ m Accept p \\ t = Decision FinalAllow\"\nproof (induction \"[Rule m Accept]\" Undecided t rule: approximating_bigstep_induct)\n case Seq thus ?case by (metis list_app_singletonE skipD)\nqed(simp_all)\n\n\n\nlemma rejectD: \"\\,p\\ \\[Rule m Reject], Undecided\\ \\\\<^sub>\\ t \\ matches \\ m Reject p \\ t = Decision FinalDeny\"\napply (induction \"[Rule m Reject]\" Undecided t rule: approximating_bigstep_induct)\nby(auto dest: skipD elim!: rules_singleton_rev_E)\n\nlemma logD: \"\\,p\\ \\[Rule m Log], Undecided\\ \\\\<^sub>\\ t \\ t = Undecided\"\napply (induction \"[Rule m Log]\" Undecided t rule: approximating_bigstep_induct)\nby(auto dest: skipD elim!: rules_singleton_rev_E)\n\nlemma emptyD: \"\\,p\\ \\[Rule m Empty], Undecided\\ \\\\<^sub>\\ t \\ t = Undecided\"\napply (induction \"[Rule m Empty]\" Undecided t rule: approximating_bigstep_induct)\nby(auto dest: skipD elim!: rules_singleton_rev_E)\n\nlemma nomatchD: \"\\,p\\ \\[Rule m a], Undecided\\ \\\\<^sub>\\ t \\ \\ matches \\ m a p \\ t = Undecided\"\napply (induction \"[Rule m a]\" Undecided t rule: approximating_bigstep_induct)\nby(auto dest: skipD elim!: rules_singleton_rev_E)\n\nlemmas approximating_bigstepD = skipD acceptD dropD rejectD logD emptyD nomatchD decisionD\n\nlemma approximating_bigstep_to_undecided: \"\\,p\\ \\rs, s\\ \\\\<^sub>\\ Undecided \\ s = Undecided\"\n by (metis decisionD state.exhaust)\n\nlemma approximating_bigstep_to_decision1: \"\\,p\\ \\rs, Decision Y\\ \\\\<^sub>\\ Decision X \\ Y = X\"\n by (metis decisionD state.inject)\n\nlemma nomatch_fst: \"\\ matches \\ m a p \\ \\,p\\ \\rs, s\\ \\\\<^sub>\\ t \\ \\,p\\ \\Rule m a # rs, s\\ \\\\<^sub>\\ t\"\n apply(cases s)\n apply(clarify)\n apply(drule nomatch)\n apply(drule(1) seq)\n apply (simp; fail)\n apply(clarify)\n apply(drule decisionD)\n apply(clarify)\n apply(simp add: decision)\ndone\n\nlemma seq':\n assumes \"rs = rs\\<^sub>1 @ rs\\<^sub>2\" \"\\,p\\ \\rs\\<^sub>1,s\\ \\\\<^sub>\\ t\" \"\\,p\\ \\rs\\<^sub>2,t\\ \\\\<^sub>\\ t'\"\n shows \"\\,p\\ \\rs,s\\ \\\\<^sub>\\ t'\"\nusing assms by (cases s) (auto intro: seq decision dest: decisionD)\n\nlemma seq_split:\n assumes \"\\,p\\ \\rs, s\\ \\\\<^sub>\\ t\" \"rs = rs\\<^sub>1@rs\\<^sub>2\"\n obtains t' where \"\\,p\\ \\rs\\<^sub>1,s\\ \\\\<^sub>\\ t'\" \"\\,p\\ \\rs\\<^sub>2,t'\\ \\\\<^sub>\\ t\"\n using assms\n proof (induction rs s t arbitrary: rs\\<^sub>1 rs\\<^sub>2 thesis rule: approximating_bigstep_induct)\n case Allow thus ?case by (auto dest: skipD elim!: rules_singleton_rev_E intro: approximating_bigstep.intros)\n next\n case Deny thus ?case by (auto dest: skipD elim!: rules_singleton_rev_E intro: approximating_bigstep.intros)\n next\n case Log thus ?case by (auto dest: skipD elim!: rules_singleton_rev_E intro: approximating_bigstep.intros)\n next\n case Nomatch thus ?case by (auto dest: skipD elim!: rules_singleton_rev_E intro: approximating_bigstep.intros)\n next\n case (Seq rs rsa rsb t t')\n hence rs: \"rsa @ rsb = rs\\<^sub>1 @ rs\\<^sub>2\" by simp\n note List.append_eq_append_conv_if[simp]\n from rs show ?case\n proof (cases rule: list_app_eq_cases)\n case longer\n with Seq have t1: \"\\,p\\ \\take (length rsa) rs\\<^sub>1, Undecided\\ \\\\<^sub>\\ t\"\n by simp\n from Seq longer obtain t2\n where t2a: \"\\,p\\ \\drop (length rsa) rs\\<^sub>1,t\\ \\\\<^sub>\\ t2\"\n and rs2_t2: \"\\,p\\ \\rs\\<^sub>2,t2\\ \\\\<^sub>\\ t'\"\n by blast\n with t1 rs2_t2 have \"\\,p\\ \\take (length rsa) rs\\<^sub>1 @ drop (length rsa) rs\\<^sub>1,Undecided\\ \\\\<^sub>\\ t2\"\n by (blast intro: approximating_bigstep.seq)\n with Seq rs2_t2 show ?thesis\n by simp\n next\n case shorter\n with rs have rsa': \"rsa = rs\\<^sub>1 @ take (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n by (metis append_eq_conv_conj length_drop)\n from shorter rs have rsb': \"rsb = drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n by (metis append_eq_conv_conj length_drop)\n from Seq rsa' obtain t1\n where t1a: \"\\,p\\ \\rs\\<^sub>1,Undecided\\ \\\\<^sub>\\ t1\"\n and t1b: \"\\,p\\ \\take (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t1\\ \\\\<^sub>\\ t\"\n by blast\n from rsb' Seq.hyps have t2: \"\\,p\\ \\drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t\\ \\\\<^sub>\\ t'\"\n by blast\n with seq' t1b have \"\\,p\\ \\rs\\<^sub>2,t1\\ \\\\<^sub>\\ t'\" by (metis append_take_drop_id)\n with Seq t1a show ?thesis\n by fast\n qed\n qed (auto intro: approximating_bigstep.intros)\n\n\nlemma seqE_fst:\n assumes \"\\,p\\ \\r#rs, s\\ \\\\<^sub>\\ t\"\n obtains t' where \"\\,p\\ \\[r],s\\ \\\\<^sub>\\ t'\" \"\\,p\\ \\rs,t'\\ \\\\<^sub>\\ t\"\n using assms seq_split by (metis append_Cons append_Nil)\n\nlemma seq_fst: assumes \"\\,p\\ \\[r], s\\ \\\\<^sub>\\ t\" and \"\\,p\\ \\rs, t\\ \\\\<^sub>\\ t'\" shows \"\\,p\\ \\r # rs, s\\ \\\\<^sub>\\ t'\"\nproof(cases s)\n case Undecided with assms seq show \"\\,p\\ \\r # rs, s\\ \\\\<^sub>\\ t'\" by fastforce\n next\n case Decision with assms show \"\\,p\\ \\r # rs, s\\ \\\\<^sub>\\ t'\"\n by(auto simp: decision dest!: decisionD)\nqed\n\n\nsubsection\\wf ruleset\\\n text\\\n A @{typ \"'a rule list\"} here is well-formed (for a packet) if\n \\<^item> either the rules do not match\n \\<^item> or the action is not @{const Call}, not @{const Return}, not @{const Unknown}\n\\\n definition wf_ruleset :: \"('a, 'p) match_tac \\ 'p \\ 'a rule list \\ bool\" where\n \"wf_ruleset \\ p rs \\ \\r \\ set rs. \n (\\ matches \\ (get_match r) (get_action r) p) \\ \n (\\(\\chain. get_action r = Call chain) \\ get_action r \\ Return \\ \\(\\chain. get_action r = Goto chain) \\ get_action r \\ Unknown)\"\n\n lemma wf_ruleset_append: \"wf_ruleset \\ p (rs1@rs2) \\ wf_ruleset \\ p rs1 \\ wf_ruleset \\ p rs2\"\n by(auto simp add: wf_ruleset_def)\n lemma wf_rulesetD: assumes \"wf_ruleset \\ p (r # rs)\" shows \"wf_ruleset \\ p [r]\" and \"wf_ruleset \\ p rs\"\n using assms by(auto simp add: wf_ruleset_def)\n lemma wf_ruleset_fst: \"wf_ruleset \\ p (Rule m a # rs) \\ wf_ruleset \\ p [Rule m a] \\ wf_ruleset \\ p rs\"\n by(auto simp add: wf_ruleset_def)\n lemma wf_ruleset_stripfst: \"wf_ruleset \\ p (r # rs) \\ wf_ruleset \\ p (rs)\"\n by(simp add: wf_ruleset_def)\n lemma wf_ruleset_rest: \"wf_ruleset \\ p (Rule m a # rs) \\ wf_ruleset \\ p [Rule m a]\"\n by(simp add: wf_ruleset_def)\n\nsubsection\\Ternary Semantics (Function)\\\n\nfun approximating_bigstep_fun :: \"('a, 'p) match_tac \\ 'p \\ 'a rule list \\ state \\ state\" where\n \"approximating_bigstep_fun \\ p [] s = s\" |\n \"approximating_bigstep_fun \\ p rs (Decision X) = (Decision X)\" |\n \"approximating_bigstep_fun \\ p ((Rule m a)#rs) Undecided = (if \n \\ matches \\ m a p\n then\n approximating_bigstep_fun \\ p rs Undecided\n else\n case a of Accept \\ Decision FinalAllow\n | Drop \\ Decision FinalDeny\n | Reject \\ Decision FinalDeny\n | Log \\ approximating_bigstep_fun \\ p rs Undecided\n | Empty \\ approximating_bigstep_fun \\ p rs Undecided\n (*unhalndled cases*)\n )\"\n\n\n\n(*tuned induction rule*)\nlemma approximating_bigstep_fun_induct[case_names Empty Decision Nomatch Match] : \"\n(\\\\ p s. P \\ p [] s) \\\n(\\\\ p r rs X. P \\ p (r # rs) (Decision X)) \\\n(\\\\ p m a rs.\n \\ matches \\ m a p \\ P \\ p rs Undecided \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ (a = Log \\ P \\ p rs Undecided) \\ (a = Empty \\ P \\ p rs Undecided) \\ P \\ p (Rule m a # rs) Undecided) \\\nP \\ p rs s\"\napply (rule approximating_bigstep_fun.induct[of P \\ p rs s])\n apply (simp_all)\nby metis\n\nlemma Decision_approximating_bigstep_fun: \"approximating_bigstep_fun \\ p rs (Decision X) = Decision X\"\n by(induction rs) (simp_all)\n\n \nlemma approximating_bigstep_fun_induct_wf[case_names Empty Decision Nomatch MatchAccept MatchDrop MatchReject MatchLog MatchEmpty, consumes 1]:\n \"wf_ruleset \\ p rs \\\n(\\\\ p s. P \\ p [] s) \\\n(\\\\ p r rs X. P \\ p (r # rs) (Decision X)) \\\n(\\\\ p m a rs.\n \\ matches \\ m a p \\ P \\ p rs Undecided \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ a = Accept \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ a = Drop \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ a = Reject \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ a = Log \\ P \\ p rs Undecided \\ P \\ p (Rule m a # rs) Undecided) \\\n(\\\\ p m a rs.\n matches \\ m a p \\ a = Empty \\ P \\ p rs Undecided \\ P \\ p (Rule m a # rs) Undecided) \\\nP \\ p rs s\"\n proof(induction \\ p rs s rule: approximating_bigstep_fun_induct)\n case Empty thus ?case by blast\n next\n case Decision thus ?case by blast\n next\n case Nomatch thus ?case by(simp add: wf_ruleset_def)\n next\n case (Match \\ p m a) thus ?case\n apply -\n apply(frule wf_rulesetD(1), drule wf_rulesetD(2))\n apply(simp)\n apply(cases a)\n apply(simp_all)\n apply(auto simp add: wf_ruleset_def)\n done\n qed\n\nlemma just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided[case_names Undecided]: \n assumes \"s = Undecided \\ approximating_bigstep_fun \\ p rs1 s = approximating_bigstep_fun \\ p rs2 s\"\n shows \"approximating_bigstep_fun \\ p rs1 s = approximating_bigstep_fun \\ p rs2 s\"\n proof(cases s)\n case Undecided thus ?thesis using assms by simp\n next\n case Decision thus ?thesis by (simp add: Decision_approximating_bigstep_fun)\n qed\n\nsubsubsection\\Append, Prepend, Postpend, Composition\\\n lemma approximating_bigstep_fun_seq_wf: \"\\ wf_ruleset \\ p rs\\<^sub>1\\ \\\n approximating_bigstep_fun \\ p (rs\\<^sub>1 @ rs\\<^sub>2) s = approximating_bigstep_fun \\ p rs\\<^sub>2 (approximating_bigstep_fun \\ p rs\\<^sub>1 s)\"\n proof(induction \\ p rs\\<^sub>1 s rule: approximating_bigstep_fun_induct)\n qed(simp_all add: wf_ruleset_def Decision_approximating_bigstep_fun split: action.split)\n\n text\\The state transitions from @{const Undecided} to @{const Undecided} if all intermediate states are @{const Undecided}\\\n lemma approximating_bigstep_fun_seq_Undecided_wf: \"\\ wf_ruleset \\ p (rs1@rs2)\\ \\ \n approximating_bigstep_fun \\ p (rs1@rs2) Undecided = Undecided \\ \n approximating_bigstep_fun \\ p rs1 Undecided = Undecided \\ approximating_bigstep_fun \\ p rs2 Undecided = Undecided\"\n proof(induction \\ p rs1 Undecided rule: approximating_bigstep_fun_induct)\n qed(simp_all add: wf_ruleset_def split: action.split)\n\n\n lemma approximating_bigstep_fun_seq_Undecided_t_wf: \"\\ wf_ruleset \\ p (rs1@rs2)\\ \\ \n approximating_bigstep_fun \\ p (rs1@rs2) Undecided = t \\ \n approximating_bigstep_fun \\ p rs1 Undecided = Undecided \\ approximating_bigstep_fun \\ p rs2 Undecided = t \\\n approximating_bigstep_fun \\ p rs1 Undecided = t \\ t \\ Undecided\"\n proof(induction \\ p rs1 Undecided rule: approximating_bigstep_fun_induct)\n case Empty thus ?case by(cases t) simp_all\n next\n case Nomatch thus ?case by(simp add: wf_ruleset_def)\n next\n case Match thus ?case by(auto simp add: wf_ruleset_def split: action.split)\n qed\n \n\n lemma approximating_bigstep_fun_wf_postpend: \"wf_ruleset \\ p rsA \\ wf_ruleset \\ p rsB \\ \n approximating_bigstep_fun \\ p rsA s = approximating_bigstep_fun \\ p rsB s \\ \n approximating_bigstep_fun \\ p (rsA@rsC) s = approximating_bigstep_fun \\ p (rsB@rsC) s\"\n apply(induction \\ p rsA s rule: approximating_bigstep_fun_induct_wf)\n apply(simp_all add: approximating_bigstep_fun_seq_wf)\n apply (metis Decision_approximating_bigstep_fun)+\n done\n\n\nlemma approximating_bigstep_fun_singleton_prepend:\n assumes \"approximating_bigstep_fun \\ p rsB s = approximating_bigstep_fun \\ p rsC s\"\n shows \"approximating_bigstep_fun \\ p (r#rsB) s = approximating_bigstep_fun \\ p (r#rsC) s\"\n proof(cases s)\n case Decision thus ?thesis by(simp add: Decision_approximating_bigstep_fun)\n next\n case Undecided\n with assms show ?thesis by(cases r)(simp split: action.split)\n qed\n\nsubsection\\Equality with @{term \"\\,p\\ \\rs, s\\ \\\\<^sub>\\ t\"} semantics\\\n lemma approximating_bigstep_wf: \"\\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Undecided \\ wf_ruleset \\ p rs\"\n unfolding wf_ruleset_def\n proof(induction rs Undecided Undecided rule: approximating_bigstep_induct)\n case Skip thus ?case by simp\n next\n case Log thus ?case by auto\n next\n case Nomatch thus ?case by simp\n next\n case (Seq rs rs1 rs2 t)\n from Seq approximating_bigstep_to_undecided have \"t = Undecided\" by fast\n from this Seq show ?case by auto\n qed\n \n\n text\\only valid actions appear in this ruleset\\\n definition good_ruleset :: \"'a rule list \\ bool\" where\n \"good_ruleset rs \\ \\r \\ set rs. (\\(\\chain. get_action r = Call chain) \\ get_action r \\ Return \\ \\(\\chain. get_action r = Goto chain) \\ get_action r \\ Unknown)\"\n\n \n\n lemma good_ruleset_alt: \"good_ruleset rs = (\\r\\set rs. get_action r = Accept \\ get_action r = Drop \\\n get_action r = Reject \\ get_action r = Log \\ get_action r = Empty)\"\n unfolding good_ruleset_def\n apply(rule Set.ball_cong)\n apply(simp_all)\n apply(rename_tac r)\n by(case_tac \"get_action r\")(simp_all)\n\n\n lemma good_ruleset_append: \"good_ruleset (rs\\<^sub>1 @ rs\\<^sub>2) \\ good_ruleset rs\\<^sub>1 \\ good_ruleset rs\\<^sub>2\"\n by(simp add: good_ruleset_alt, blast)\n\n lemma good_ruleset_fst: \"good_ruleset (r#rs) \\ good_ruleset [r]\"\n by(simp add: good_ruleset_def)\n lemma good_ruleset_tail: \"good_ruleset (r#rs) \\ good_ruleset rs\"\n by(simp add: good_ruleset_def)\n\n text\\\n @{term good_ruleset} is stricter than @{term wf_ruleset}. It can be easily checked with running code!\n\\\n lemma good_imp_wf_ruleset: \"good_ruleset rs \\ wf_ruleset \\ p rs\" by (metis good_ruleset_def wf_ruleset_def)\n\n lemma simple_imp_good_ruleset: \"simple_ruleset rs \\ good_ruleset rs\"\n by(simp add: simple_ruleset_def good_ruleset_def, fastforce)\n\n\nlemma approximating_bigstep_fun_seq_semantics: \"\\ \\,p\\ \\rs\\<^sub>1, s\\ \\\\<^sub>\\ t \\ \\ \n approximating_bigstep_fun \\ p (rs\\<^sub>1 @ rs\\<^sub>2) s = approximating_bigstep_fun \\ p rs\\<^sub>2 t\"\n proof(induction rs\\<^sub>1 s t arbitrary: rs\\<^sub>2 rule: approximating_bigstep.induct)\n qed(simp_all add: Decision_approximating_bigstep_fun)\n\nlemma approximating_semantics_imp_fun: \"\\,p\\ \\rs, s\\ \\\\<^sub>\\ t \\ approximating_bigstep_fun \\ p rs s = t\"\n proof(induction rs s t rule: approximating_bigstep_induct)\n qed(auto simp add: approximating_bigstep_fun_seq_semantics Decision_approximating_bigstep_fun)\n\nlemma approximating_fun_imp_semantics: assumes \"wf_ruleset \\ p rs\"\n shows \"approximating_bigstep_fun \\ p rs s = t \\ \\,p\\ \\rs, s\\ \\\\<^sub>\\ t\"\n using assms proof(induction \\ p rs s rule: approximating_bigstep_fun_induct_wf)\n case (Empty \\ p s)\n thus \"\\,p\\ \\[], s\\ \\\\<^sub>\\ t\" using skip by(simp)\n next\n case (Decision \\ p r rs X)\n hence \"t = Decision X\" by simp\n thus \"\\,p\\ \\r # rs, Decision X\\ \\\\<^sub>\\ t\" using decision by fast\n next\n case (Nomatch \\ p m a rs)\n thus \"\\,p\\ \\Rule m a # rs, Undecided\\ \\\\<^sub>\\ t\"\n apply(rule_tac t=Undecided in seq_fst)\n apply(simp add: nomatch)\n apply(simp add: Nomatch.IH)\n done\n next\n case (MatchAccept \\ p m a rs)\n hence \"t = Decision FinalAllow\" by simp\n thus ?case by (metis MatchAccept.hyps accept decision seq_fst)\n next\n case (MatchDrop \\ p m a rs)\n hence \"t = Decision FinalDeny\" by simp\n thus ?case by (metis MatchDrop.hyps drop decision seq_fst)\n next\n case (MatchReject \\ p m a rs)\n hence \"t = Decision FinalDeny\" by simp\n thus ?case by (metis MatchReject.hyps reject decision seq_fst)\n next\n case (MatchLog \\ p m a rs)\n thus ?case\n apply(simp)\n apply(rule_tac t=Undecided in seq_fst)\n apply(simp add: log)\n apply(simp add: MatchLog.IH)\n done\n next\n case (MatchEmpty \\ p m a rs)\n thus ?case\n apply(simp)\n apply(rule_tac t=Undecided in seq_fst)\n apply(simp add: empty)\n apply(simp add: MatchEmpty.IH)\n done\n qed\n\n\ntext\\Henceforth, we will use the @{term approximating_bigstep_fun} semantics, because they are easier.\nWe show that they are equal.\n\\\ntheorem approximating_semantics_iff_fun: \"wf_ruleset \\ p rs \\\n \\,p\\ \\rs, s\\ \\\\<^sub>\\ t \\ approximating_bigstep_fun \\ p rs s = t\"\nby (metis approximating_fun_imp_semantics approximating_semantics_imp_fun)\n\ncorollary approximating_semantics_iff_fun_good_ruleset: \"good_ruleset rs \\\n \\,p\\ \\rs, s\\ \\\\<^sub>\\ t \\ approximating_bigstep_fun \\ p rs s = t\"\n by (metis approximating_semantics_iff_fun good_imp_wf_ruleset)\n\nlemma approximating_bigstep_deterministic: \"\\ \\,p\\ \\rs, s\\ \\\\<^sub>\\ t; \\,p\\ \\rs, s\\ \\\\<^sub>\\ t' \\ \\ t = t'\"\n proof(induction arbitrary: t' rule: approximating_bigstep_induct)\n case Seq thus ?case\n by (metis (hide_lams, mono_tags) append_Nil2 approximating_bigstep_fun.simps(1) approximating_bigstep_fun_seq_semantics)\n qed(auto dest: approximating_bigstepD)\n\n\n\nlemma rm_LogEmpty_fun_semantics: \n \"approximating_bigstep_fun \\ p (rm_LogEmpty rs) s = approximating_bigstep_fun \\ p rs s\"\n proof(induction \\ p rs s rule: approximating_bigstep_fun_induct)\n case Empty thus ?case by(simp)\n next\n case Decision thus ?case by(simp add: Decision_approximating_bigstep_fun)\n next\n case (Nomatch \\ p m a rs) thus ?case by(cases a,simp_all)\n next\n case (Match \\ p m a rs) thus ?case by(cases a,simp_all)\n qed\n\n\n(*we probably don't need the following*)\nlemma \"\\,p\\ \\rm_LogEmpty rs, s\\ \\\\<^sub>\\ t \\ \\,p\\ \\rs, s\\ \\\\<^sub>\\ t\"\napply(rule iffI)\n apply(induction rs arbitrary: s t)\n apply(simp_all)\n apply(rename_tac r rs s t)\n apply(case_tac r)\n apply(simp)\n apply(rename_tac m a)\n apply(case_tac a)\n apply(simp_all)\n apply(auto intro: approximating_bigstep.intros )\n apply(erule seqE_fst, simp add: seq_fst)\n apply(erule seqE_fst, simp add: seq_fst)\n apply (metis decision log nomatch_fst seq_fst state.exhaust)\n apply(erule seqE_fst, simp add: seq_fst)\n apply(erule seqE_fst, simp add: seq_fst)\n apply(erule seqE_fst, simp add: seq_fst)\n apply(erule seqE_fst, simp add: seq_fst)\n apply (metis decision empty nomatch_fst seq_fst state.exhaust)\n apply(erule seqE_fst, simp add: seq_fst)\napply(induction rs s t rule: approximating_bigstep_induct)\n apply(auto intro: approximating_bigstep.intros)\n apply(rename_tac m a)\n apply(case_tac a)\n apply(auto intro: approximating_bigstep.intros)\napply(rename_tac rs\\<^sub>1 rs\\<^sub>2 t t')\napply(drule_tac rs\\<^sub>1=\"rm_LogEmpty rs\\<^sub>1\" and rs\\<^sub>2=\"rm_LogEmpty rs\\<^sub>2\" in seq)\n apply(simp_all)\nusing rm_LogEmpty_seq apply metis\ndone\n\n\nlemma rm_LogEmpty_simple_but_Reject: \n \"good_ruleset rs \\ \\r \\ set (rm_LogEmpty rs). get_action r = Accept \\ get_action r = Reject \\ get_action r = Drop\"\n proof(induction rs)\n case Nil thus ?case by(simp add: good_ruleset_def)\n next\n case (Cons r rs) thus ?case\n apply(clarify)\n apply(cases r, rename_tac m a, simp)\n by(case_tac a) (auto simp add: good_ruleset_def)\n qed\n\n\n\nlemma rw_Reject_fun_semantics: \n \"wf_unknown_match_tac \\ \\ \n (approximating_bigstep_fun (\\, \\) p (rw_Reject rs) s = approximating_bigstep_fun (\\, \\) p rs s)\"\n proof(induction rs)\n case Nil thus ?case by simp\n next\n case (Cons r rs)\n thus ?case\n apply(case_tac r, rename_tac m a, simp)\n apply(case_tac a)\n apply(case_tac [!] s)\n apply(auto dest: wf_unknown_match_tacD_False1 wf_unknown_match_tacD_False2)\n done\n qed\n\nlemma rmLogEmpty_rwReject_good_to_simple: \"good_ruleset rs \\ simple_ruleset (rw_Reject (rm_LogEmpty rs))\"\n apply(drule rm_LogEmpty_simple_but_Reject)\n apply(simp add: simple_ruleset_def)\n apply(induction rs)\n apply(simp_all)\n apply(rename_tac r rs)\n apply(case_tac r)\n apply(rename_tac m a)\n apply(case_tac a)\n apply(simp_all)\n done\n\nsubsection\\Matching\\\nlemma optimize_matches_option_generic:\n assumes \"\\ r \\ set rs. P (get_match r) (get_action r)\"\n and \"(\\m m' a. P m a \\ f m = Some m' \\ matches \\ m' a p = matches \\ m a p)\"\n and \"(\\m a. P m a \\ f m = None \\ \\ matches \\ m a p)\"\n shows \"approximating_bigstep_fun \\ p (optimize_matches_option f rs) s = approximating_bigstep_fun \\ p rs s\"\n using assms proof(induction \\ p rs s rule: approximating_bigstep_fun_induct)\n case Decision thus ?case by (simp add: Decision_approximating_bigstep_fun)\n next\n case (Nomatch \\ p m a rs) thus ?case\n apply(simp)\n apply(cases \"f m\")\n apply(simp; fail)\n apply(simp del: approximating_bigstep_fun.simps)\n apply(rename_tac m')\n apply(subgoal_tac \"\\ matches \\ m' a p\")\n apply(simp; fail)\n using assms by blast\n next\n case (Match \\ p m a rs) thus ?case\n apply(cases \"f m\")\n apply(simp; fail)\n apply(simp del: approximating_bigstep_fun.simps)\n apply(rename_tac m')\n apply(subgoal_tac \"matches \\ m' a p\")\n apply(simp split: action.split; fail)\n using assms by blast\n qed(simp)\n\n\nlemma optimize_matches_generic: \"\\ r \\ set rs. P (get_match r) (get_action r) \\ \n (\\m a. P m a \\ matches \\ (f m) a p = matches \\ m a p) \\\n approximating_bigstep_fun \\ p (optimize_matches f rs) s = approximating_bigstep_fun \\ p rs s\"\n unfolding optimize_matches_def\n apply(rule optimize_matches_option_generic)\n apply(simp; fail)\n apply(simp split: if_split_asm)\n apply blast\n apply(simp split: if_split_asm)\n using matcheq_matchNone_not_matches by fast\n\n\nlemma optimize_matches_matches_fst: \"matches \\ (f m) a p \\ optimize_matches f (Rule m a # rs) = (Rule (f m) a)# optimize_matches f rs\"\n apply(simp add: optimize_matches_def)\n by (meson matcheq_matchNone_not_matches)\n\n\nlemma optimize_matches: \"\\m a. matches \\ (f m) a p = matches \\ m a p \\ approximating_bigstep_fun \\ p (optimize_matches f rs) s = approximating_bigstep_fun \\ p rs s\"\n using optimize_matches_generic[where P=\"\\_ _. True\"] by metis\n\n\nlemma optimize_matches_opt_MatchAny_match_expr: \"approximating_bigstep_fun \\ p (optimize_matches opt_MatchAny_match_expr rs) s = approximating_bigstep_fun \\ p rs s\"\nusing optimize_matches opt_MatchAny_match_expr_correct by metis\n\n\nlemma optimize_matches_a: \"\\a m. matches \\ m a = matches \\ (f a m) a \\ approximating_bigstep_fun \\ p (optimize_matches_a f rs) s = approximating_bigstep_fun \\ p rs s\"\n proof(induction \\ p rs s rule: approximating_bigstep_fun_induct)\n case (Match \\ p m a rs) thus ?case by(case_tac a)(simp_all add: optimize_matches_a_def)\n qed(simp_all add: optimize_matches_a_def)\n\n\nlemma optimize_matches_a_simplers:\n assumes \"simple_ruleset rs\" and \"\\a m. a = Accept \\ a = Drop \\ matches \\ (f a m) a = matches \\ m a\"\n shows \"approximating_bigstep_fun \\ p (optimize_matches_a f rs) s = approximating_bigstep_fun \\ p rs s\"\nproof -\n from assms(1) have \"wf_ruleset \\ p rs\" by(simp add: simple_imp_good_ruleset good_imp_wf_ruleset)\n from \\wf_ruleset \\ p rs\\ assms show \"approximating_bigstep_fun \\ p (optimize_matches_a f rs) s = approximating_bigstep_fun \\ p rs s\"\n proof(induction \\ p rs s rule: approximating_bigstep_fun_induct_wf)\n case Nomatch thus ?case\n apply(simp add: optimize_matches_a_def simple_ruleset_def)\n apply(safe)\n apply(simp_all)\n done\n next\n case MatchReject thus ?case by(simp add: optimize_matches_a_def simple_ruleset_def)\n qed(simp_all add: optimize_matches_a_def simple_ruleset_tail)\nqed\n\n\n\nlemma not_matches_removeAll: \"\\ matches \\ m a p \\\n approximating_bigstep_fun \\ p (removeAll (Rule m a) rs) Undecided = approximating_bigstep_fun \\ p rs Undecided\"\n apply(induction \\ p rs Undecided rule: approximating_bigstep_fun.induct)\n apply(simp)\n apply(simp split: action.split)\n apply blast\n done\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Semantics_Ternary/Semantics_Ternary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.29111574776707544}} {"text": "theory Ex_CFG\nimports Monad2\nbegin\n term fold\n\n\n\n datatype err = STATIC_ERROR\n\n\n\n\n\n\n\n\n type_synonym state = \"string \\ int\"\n type_synonym label = string\n type_synonym proc_name = string\n type_synonym val = \"int\"\n\n datatype nt_instr = I_BASIC \"state \\ state\" | I_CALL proc_name\n\n datatype t_instr = TI_RETURN | TI_BR label | TI_CBR \"state\\bool\" label label\n\n datatype bblock = BBLOCK (nt_instrs: \"nt_instr list\") (t_instr: \"t_instr\")\n\n\n type_synonym proc_body = \"label \\ bblock\"\n type_synonym prog = \"proc_name \\ proc_body\"\n\n\n context\n fixes \\ :: prog\n begin\n\n context\n fixes execute :: \"proc_body \\ label \\ (unit,unit,state,err) M\"\n begin\n\n definition \"exec_nt_instr ins \\ case ins of\n I_BASIC f \\ doM { s\\get; set (f s)}\n | I_CALL p \\ doM {\n \\ \\ lookup STATIC_ERROR \\ p;\n handle (doM {execute (\\,''__start''); fail STATIC_ERROR}) (\\_. return ());\n return ()\n }\"\n\n fun exec_t_instr where\n \"exec_t_instr (TI_RETURN) = doM {\n raise ()\n }\"\n | \"exec_t_instr (TI_BR l) = return l\"\n | \"exec_t_instr (TI_CBR c l1 l2) = doM {\n s\\get;\n if c s then return l1 else return l2\n }\"\n\n definition \"execute_body \\ \\(\\,l). doM {\n bb \\ lookup STATIC_ERROR \\ l;\n mfold' exec_nt_instr (nt_instrs bb);\n l \\ exec_t_instr (t_instr bb);\n execute (\\,l)\n }\"\n end\n\n definition \"execute \\ REC execute_body\"\n\n lemma mono_mfold[partial_function_mono]:\n \"\\\\x s. M.mono_body (\\f. F f x s)\\ \\ M.mono_body (\\f. mfold (F f) xs s)\"\n apply (induction xs arbitrary: s)\n apply simp_all\n apply pf_mono_prover\n apply pf_mono_prover\n apply simp_all\n done\n\n lemma mono_exec_ntinstr[partial_function_mono]: \"M.mono_body (\\f. local.exec_nt_instr f ins)\"\n by (cases ins; simp add: exec_nt_instr_def; pf_mono_prover)\n\n lemma mono_execute_body[partial_function_mono]: \"\\x. M.mono_body (\\fa. local.execute_body fa x)\"\n unfolding execute_body_def\n by pf_mono_prover\n\n end\n\n lemmas\n execute_unfold[code] = REC_unfold[OF execute_def, discharge_monos]\n and execute_partial = lrmwpe_REC_partial[OF execute_def, discharge_monos, consumes 1, case_names nonterm step]\n and execute_total = lrmwpe_REC_total[OF execute_def, discharge_monos, consumes 1, case_names wf step]\n and execute_sim[sim_rules] = sim_REC[OF execute_def execute_def, discharge_monos]\n\n term execute\n\n thm sim_rules\n\n lemma execute_sm_sim[sim_rules]:\n assumes \"\\ \\\\<^sub>m \\'\"\n shows \"sim (execute \\ \\l) (execute \\' \\l)\"\n using assms\n by (auto intro!: sim_rules split!: nt_instr.split simp: execute_body_def exec_nt_instr_def)\n\n\n fun wf_nt_instr where\n \"wf_nt_instr \\ (I_BASIC f) \\ True\"\n | \"wf_nt_instr \\ (I_CALL p) \\ p\\dom \\\"\n\n fun wf_t_instr where\n \"wf_t_instr \\ \\ (TI_RETURN) \\ True\"\n | \"wf_t_instr \\ \\ (TI_BR l) \\ l\\dom \\\"\n | \"wf_t_instr \\ \\ (TI_CBR c l1 l2) \\ l1\\dom \\ \\ l2\\dom \\\"\n\n fun wf_basic_block where\n \"wf_basic_block \\ \\ (BBLOCK ntis ti) \\ (\\nti\\List.set ntis. wf_nt_instr \\ nti) \\ wf_t_instr \\ \\ ti\"\n\n definition \"wf_proc_body \\ b \\ ''__start''\\dom b \\ (\\bb\\ran b. wf_basic_block \\ b bb)\"\n\n definition \"wf_prog \\ \\ \\b\\ran \\. wf_proc_body \\ b\"\n\n definition \"wf_pos \\ \\ \\(\\,l). \\ \\ ran \\ \\ l\\dom \\\"\n\n\n\n\n lemma\n assumes \"run (execute \\ \\l) s = r\"\n assumes \"wf_pos \\ \\l\"\n assumes \"wf_prog \\\"\n shows \"mwp r True bot top bot\"\n using assms(1,2)\n proof (induction rule: execute_partial)\n case (nonterm x s)\n then show ?case by simp\n next\n case (step f x s r)\n\n note step.IH[OF refl, THEN mwp_cons, intro!]\n\n obtain \\ l where [simp]: \"x = (\\,l)\" by (cases x)\n with \\wf_pos \\ x\\ obtain ntis ti where [simp]: \"\\ l = Some (BBLOCK ntis ti)\" and \"\\\\ran \\\"\n apply (auto simp: wf_pos_def)\n using bblock.exhaust by blast\n\n have [THEN mwp_cons, intro!]:\n \"mwp (run (exec_nt_instr \\ f i) s) top bot bot top\" if \"wf_nt_instr \\ i\" for i s\n using that\n apply (auto simp: run_simps exec_nt_instr_def split: nt_instr.splits option.split)\n by (metis (mono_tags, lifting) assms(3) old.prod.case ranI wf_pos_def wf_proc_body_def wf_prog_def)\n\n\n from \\wf_prog \\\\ \\\\\\ran \\\\ have \"wf_basic_block \\ \\ (BBLOCK ntis ti)\"\n unfolding wf_prog_def wf_proc_body_def apply (auto)\n apply (meson \\\\ l = Some (BBLOCK ntis ti)\\ ranI wf_basic_block.simps)\n apply (meson \\\\ l = Some (BBLOCK ntis ti)\\ ranI wf_basic_block.simps)\n done\n hence WF_NTI: \"(\\nti\\List.set ntis. wf_nt_instr \\ nti)\"\n and WF_TI: \"wf_t_instr \\ \\ ti\" by simp_all\n\n from WF_NTI have [THEN mwp_cons, intro!]:\n \"mwp (run (mfold' (exec_nt_instr \\ f) ntis) s) top bot bot top\"\n apply (induction ntis arbitrary: s)\n by (auto simp: run_simps)\n\n from WF_TI have [THEN mwp_cons, intro!]: \"mwp (run (exec_t_instr ti) s) top bot top (\\l _. l\\dom \\)\" for s\n apply (cases ti)\n apply (auto simp: run_simps)\n done\n\n from step.hyps step.prems show ?case\n by (auto simp: execute_body_def run_simps wf_pos_def split: prod.splits option.splits)\n\n qed\n\n\nend\n\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/others/simple/Ex_CFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.29111574776707544}} {"text": "section \\Random Permutation Cache\\\n\ntheory CM_RpSpec\n imports Main CM_SecurityModel\nbegin\n\nsubsection \\Data type, Basic components\\\n\n(*Basic data structures*)\ntype_synonym tagmask = nat\ntype_synonym setbits = nat\ntype_synonym setindex = nat\ntype_synonym wayindex = nat\n\ndatatype cachehit = Hit | Miss\n\ndatatype secure = H | L\n\ndatatype event = RP_READ\n\n(*Memory blocks*)\nrecord memory_request =\n tag :: tagmask\n index :: setbits\n protect :: bool\n thread :: secure\n\n(*Cache structure*)\nrecord cache_line =\n ca_tag :: tagmask\n ca_set :: setindex\n ca_way :: wayindex\n valid :: bool\n lock :: bool\n owned :: \"secure option\"\n\ntype_synonym cache = \"(cache_line set) list\"\n\ntype_synonym mapping = \"setbits \\ setindex\"\n\n(*State Machine*)\nrecord state =\n sram :: cache\n map_H :: mapping\n map_L :: mapping\n\nsubsection \\Random permutation cache model specifications\\\n\ndefinition replace_policy :: \"cache_line set \\ cache_line\"\n where \"replace_policy cs \\ SOME l. l \\ cs\"\n\ndefinition probe_line :: \"cache_line set \\ memory_request \\ bool\"\n where \"probe_line cs mr \\ \\b. b \\ cs \\ ca_tag b = tag mr \\ valid b \\ owned b = Some (thread mr)\"\n\ndefinition replace_line :: \"cache_line \\ memory_request \\ cache_line\"\n where \"replace_line cl mr \\ cl\\ca_tag := tag mr, valid := True, lock := protect mr, owned := Some (thread mr)\\\"\n\ndefinition drop_line :: \"cache_line \\ cache_line\"\n where \"drop_line cl \\ cl\\valid := False, lock := False, owned := None\\\"\n\ndefinition fix_line :: \"cache_line set \\ memory_request \\ cache_line set\"\n where \"fix_line cs mr \\ {t. \\r \\ cs. t = (if owned r = Some (thread mr) then r\\valid := False, lock := False, owned := None\\ else r)}\"\n\ndefinition swap_map :: \"mapping \\ setindex \\ setindex \\ mapping\"\n where \"swap_map pt ra rb \\ let sa = {t. pt t = Some ra}; sb = {t. pt t = Some rb} in\n (\\t. if t \\ sa then Some rb else if t \\ sb then Some ra else pt t)\"\n\ndefinition rp_read :: \"state \\ memory_request \\ state set\" where\n \"rp_read s mr \\\n let map = (if thread mr = H then map_H s else map_L s);\n redir_set = the (map (index mr));\n redir_ca = (sram s) ! redir_set in\n if probe_line redir_ca mr then {s}\n else let r_line = replace_policy redir_ca;\n policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)} in\n if owned r_line = Some (thread mr) then\n if lock r_line = protect mr then\n let newset = insert (replace_line r_line mr) (redir_ca - {r_line}) in\n {s\\sram := list_update (sram s) redir_set newset\\}\n else {t. \\r'_line \\ policy_line. let newset = insert (drop_line r'_line) (((sram s) ! (ca_set r'_line)) - {r'_line}) in\n t = s\\sram := list_update (sram s) (ca_set r'_line) newset\\}\n else\n if thread mr = H then\n {t. \\r'_line \\ policy_line.\n if ca_set r'_line = redir_set then\n let newset = insert (replace_line r'_line mr) (fix_line (((sram s) ! (ca_set r'_line)) - {r'_line}) mr) in\n t = s\\sram := list_update (sram s) (ca_set r'_line) newset,\n map_H := swap_map (map_H s) redir_set (ca_set r'_line)\\\n else let newset = insert (replace_line r'_line mr) (fix_line (((sram s) ! (ca_set r'_line)) - {r'_line}) mr);\n new_redir_ca = fix_line redir_ca mr in\n t = s\\sram := list_update (list_update (sram s) (ca_set r'_line) newset) redir_set new_redir_ca,\n map_H := swap_map (map_H s) redir_set (ca_set r'_line)\\}\n else {t. \\r'_line \\ policy_line.\n if ca_set r'_line = redir_set then\n let newset = insert (replace_line r'_line mr) (fix_line (((sram s) ! (ca_set r'_line)) - {r'_line}) mr) in\n t = s\\sram := list_update (sram s) (ca_set r'_line) newset,\n map_L := swap_map (map_L s) redir_set (ca_set r'_line)\\\n else let newset = insert (replace_line r'_line mr) (fix_line (((sram s) ! (ca_set r'_line)) - {r'_line}) mr);\n new_redir_ca = fix_line redir_ca mr in\n t = s\\sram := list_update (list_update (sram s) (ca_set r'_line) newset) redir_set new_redir_ca,\n map_L := swap_map (map_L s) redir_set (ca_set r'_line)\\}\"\n\n\nsubsection \\Instantiation\\\n\nrecord cache_NE =\n ca_N :: \"cache set\"\n ca_E :: \"cache set\"\n\nconsts cache_comp :: cache_NE\n\ndefinition cache_comp_witness :: \"cache_NE\"\n where \"cache_comp_witness \\ \\ca_N = {[{(\\ca_tag = 0, ca_set = 0, ca_way = 0, valid = True, lock = False, owned = Some L\\)}]},\n ca_E = {[{(\\ca_tag = 0, ca_set = 0, ca_way = 0, valid = True, lock = False, owned = Some L\\)}]}\\\"\n\nspecification (cache_comp)\n caN_finite: \"finite (ca_N cache_comp)\"\n caN_nonempty: \"(ca_N cache_comp) \\ {}\"\n\n ca_length: \"\\c \\ (ca_N cache_comp). length c > 0\"\n ca_length2: \"\\c1 c2. c1 \\ (ca_N cache_comp) \\ c2 \\ (ca_N cache_comp) \\ c1 \\ c2 \\ length c1 = length c2\"\n ca_finite: \"\\c \\ (ca_N cache_comp). finite (set c)\"\n ca_set_nonempty: \"\\c \\ (ca_N cache_comp). (\\l < length c. c!l \\ {})\"\n ca_set_finite: \"\\c \\ (ca_N cache_comp). (\\l < length c. finite (c!l))\"\n ca_set_num: \"\\c \\ (ca_N cache_comp). (\\l < length c. \\e \\ (c!l). ca_set e = l)\"\n ca_way_num: \"\\c \\ (ca_N cache_comp). (\\l1 l2. l1 < length c \\ l2 < length c \\ l1 \\ l2 \\ card(c!l1) = card(c!l2))\"\n ca_way_num2: \"\\c \\ (ca_N cache_comp). (\\l < length c. \\e1 e2. e1 \\ (c!l) \\ e2 \\ (c!l) \\ e1 \\ e2 \\ ca_way e1 \\ ca_way e2)\"\n\n caE_init: \"(ca_E cache_comp) \\ (ca_N cache_comp)\"\n caE_nonempty: \"(ca_E cache_comp) \\ {}\"\n caE_occupy: \"\\c \\ (ca_E cache_comp). (\\l < length c. \\e \\ (c!l). owned e = Some L)\"\n apply(intro exI[of _ cache_comp_witness])\n unfolding cache_comp_witness_def by auto\n\nrecord mem_map =\n map_conf :: \"mapping\"\n mem_req :: \"(memory_request \\ real) set\"\n\nconsts mm_comp :: mem_map\n\ndefinition mm_comp_witness :: \"mem_map\"\n where \"mm_comp_witness \\ \\map_conf = (\\t. if t = 0 then Some 0 else None),\n mem_req = {(\\tag = 0, index = 0, protect = False, thread = H\\, 1)}\\\"\n\nspecification (mm_comp)\n map_range: \"\\c \\ (ca_N cache_comp). (\\i. (map_conf mm_comp) i \\ None \\ the ((map_conf mm_comp) i) < length c)\"\n map_diff: \"\\i j. i \\ j \\ (map_conf mm_comp) i \\ None \\ (map_conf mm_comp) j \\ None \\ the ((map_conf mm_comp) i) \\ the ((map_conf mm_comp) j)\"\n mem_finite: \"finite (mem_req mm_comp)\"\n mem_nonempty: \"card (mem_req mm_comp) > 0\"\n mem_unique: \"\\i j. i \\ (mem_req mm_comp) \\ j \\ (mem_req mm_comp) \\ i \\ j \\ index (fst i) \\ index (fst j)\"\n mem_positive: \"\\i \\ (mem_req mm_comp). snd i > 0\"\n mem_sum_one: \"folds (\\t p. snd t + p) 0 (mem_req mm_comp) = 1\"\n mem_occupy: \"\\i \\ (mem_req mm_comp). thread (fst i) = H\"\n mem_mapping: \"\\i \\ (mem_req mm_comp). (map_conf mm_comp) (index (fst i)) \\ None\"\n apply(intro exI[of _ \"mm_comp_witness\"])\n unfolding mm_comp_witness_def apply auto\n using ca_length by auto\n\n(*state N*)\nconsts state_N :: \"state set\"\n\ndefinition state_N_witness :: \"state set\"\n where \"state_N_witness \\ {t. \\c \\ (ca_N cache_comp). t = \\sram = c, map_H = (map_conf mm_comp), map_L = (map_conf mm_comp)\\}\"\n\nspecification (state_N)\n state_N_init: \"state_N = state_N_witness\"\n by simp\n\nlemma stateN_finite: \"finite state_N\"\n proof -\n {\n have \"\\c \\ (ca_N cache_comp). finite {t. \\c \\ (ca_N cache_comp). t = \\sram = c, map_H = (map_conf mm_comp), map_L = (map_conf mm_comp)\\}\"\n using caN_finite by auto\n then show ?thesis\n using state_N_init state_N_witness_def by auto \n }\n qed\n\nlemma stateN_nonempty: \"state_N \\ {}\"\n using state_N_init state_N_witness_def caN_nonempty\n by blast\n\n(*state E*)\nconsts state_E :: \"state set\"\n\ndefinition state_E_witness :: \"state set\"\n where \"state_E_witness \\ {t. \\c \\ (ca_E cache_comp). t = \\sram = c, map_H = (map_conf mm_comp), map_L = (map_conf mm_comp)\\}\"\n\nspecification (state_E)\n state_E_init: \"state_E = state_E_witness\"\n by simp\n\nlemma stateE_nonempty: \"state_E \\ {}\"\n using state_E_init state_E_witness_def caE_nonempty\n by blast\n\nlemma stateE_subset: \"state_E \\ state_N\"\n using state_N_init state_N_witness_def state_E_init state_E_witness_def\n by (smt Collect_mono_iff caE_init subset_eq)\n \nlemma cache_set_size:\n \"\\s \\ state_N. card {0..length (sram s) - 1} = length (sram s)\"\n proof -\n {\n fix s\n assume \"s \\ state_N\"\n have \"card {0..length (sram s) - 1} = length (sram s)\"\n proof -\n {\n have \"sram s \\ ca_N cache_comp\"\n using state_N_init unfolding state_N_witness_def\n proof -\n assume \"state_N = {t. \\c\\ca_N cache_comp. t = \\sram = c, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n then have \"state_N = {s. \\Cs. Cs \\ ca_N cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n by meson\n then have \"\\Cs. Cs \\ ca_N cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\\"\n using \\s \\ state_N\\ by blast\n then show ?thesis\n by force\n qed\n then show ?thesis\n using ca_length by simp\n }\n qed\n }\n then show ?thesis by auto\n qed\n \nlemma cache_set_size2:\n assumes a_finite: \"finite (w::((nat \\ cachehit) \\ real) set)\"\n and a_nonempty: \"w \\ {}\"\n and a0: \"\\d \\ w. P d = (i::real)\"\n shows \"folds (\\s p. P s + p) 0 w = i * card w\"\n proof -\n show ?thesis using a_finite a_nonempty a0\n proof(induct arbitrary: i rule: finite_ne_induct)\n case (singleton x)\n then have \"P x = i\"\n by auto\n moreover have \"folds (\\s p. P s + p) 0 {x} = P x\"\n by force\n ultimately show ?case by auto\n next\n case (insert x F)\n have p0: \"folds (\\s p. P s + p) 0 (insert x F) = P x + folds (\\s p. P s + p) 0 F\"\n using plus_comp_fun_commute_P.fold_insert\n by (simp add: insert.hyps(1) insert.hyps(3)) \n have p1: \"folds (\\s p. P s + p) 0 F = i * card F\"\n using insert.hyps(4) insert.prems by blast\n have p2: \"P x + folds (\\s p. P s + p) 0 F = i * Suc (card F)\"\n by (simp add: insert.prems p1 ring_class.ring_distribs(1))\n then show ?case using p0\n by (simp add: insert.hyps(1) insert.hyps(3)) \n qed\n qed\n\nlemma policy_line_length:\n assumes a0: \"finite A\"\n and a1: \"A \\ {}\"\n and a2: \"\\a1 a2. a1 \\ A \\ a2 \\ A \\ a1 \\ a2 \\ f a1 \\ f a2\"\n shows \"card {t. \\a \\ A. t = f a} = card A\"\n proof -\n show ?thesis using a0 a1 a2\n proof(induct rule: finite_ne_induct)\n case (singleton x)\n then show ?case by auto\n next\n case (insert x F)\n have insert_length: \"card (insert x F) = card F + 1\"\n by (simp add: insert.hyps(1) insert.hyps(3))\n have \"{t. \\a \\ (insert x F). t = f a} = {t. \\a \\ {x}. t = f a} \\ {t. \\a \\ F. t = f a}\"\n by auto\n moreover have \"f x \\ {t. \\a \\ F. t = f a}\"\n using insert.hyps(3) insert.prems by blast\n ultimately have \"card {t. \\a \\ (insert x F). t = f a} = card {t. \\a \\ F. t = f a} + 1\"\n using insert.hyps(1) by auto\n then show ?case\n using insert_length by (simp add: insert.hyps(4) insert.prems) \n qed\n qed\n\n(*Observation*)\ndefinition rp_read_observe :: \"state \\ memory_request \\ ((setindex \\ cachehit) \\ real) set\" where\n \"rp_read_observe s mr \\\n let maps = map_H s;\n redir_set = the (maps (index mr));\n redir_ca = (sram s) ! redir_set in\n if probe_line redir_ca mr then {((redir_set, Hit), 1)}\n else let r_line = replace_policy redir_ca;\n policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)} in\n if owned r_line = Some (thread mr) then\n if lock r_line = protect mr then {((redir_set, Miss), 1)}\n else {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\n else\n {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\"\n\nlemma mem_cache_miss:\n \"\\i \\ mem_req mm_comp. \\s0 \\ state_E. rp_read_observe s0 (fst i) = {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n proof -\n {\n fix i\n assume t0: \"i \\ mem_req mm_comp\"\n have \"\\s0 \\ state_E. rp_read_observe s0 (fst i) = {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n proof -\n {\n fix s0\n assume t00: \"s0 \\ state_E\"\n have \"rp_read_observe s0 (fst i) = {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n proof -\n {\n have iowned: \"thread (fst i) = H\"\n by (simp add: mem_occupy t0)\n let ?maps = \"map_H s0\"\n let ?redir_set = \"the (?maps (index (fst i)))\"\n have exi_redir: \"?redir_set < length (sram s0)\"\n using state_E_init unfolding state_E_witness_def using mem_mapping\n by (smt caE_init map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) subsetD t0 t00)\n let ?redir_ca = \"(sram s0) ! ?redir_set\"\n have t000: \"sram s0 \\ ca_E cache_comp\"\n using state_E_init unfolding state_E_witness_def\n proof -\n assume \"state_E = {t. \\c\\ca_E cache_comp. t = \\sram = c, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n then have \"state_E = {s. \\Cs. Cs \\ ca_E cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n by meson\n then have \"\\Cs. Cs \\ ca_E cache_comp \\ s0 = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\\"\n using t00 by blast\n then show ?thesis\n by fastforce\n qed\n then have setowned: \"\\l < length (sram s0). \\e \\ ((sram s0)!l). owned e = Some L\"\n using caE_occupy by blast\n then have \"\\b. b \\ ?redir_ca \\ ca_tag b = tag (fst i) \\ valid b \\ owned b = Some (thread (fst i))\"\n using iowned exi_redir by auto\n then have c1: \"\\ probe_line ?redir_ca (fst i)\"\n unfolding probe_line_def by blast\n let ?r_line = \"replace_policy ?redir_ca\"\n have \"?r_line \\ ?redir_ca\"\n unfolding replace_policy_def\n using caE_init ca_set_nonempty some_in_eq t000 exi_redir by blast\n then have \"owned ?r_line = Some L\"\n using setowned exi_redir by blast\n then have c2: \"owned ?r_line \\ Some (thread (fst i))\"\n using iowned by auto\n let ?policy_line = \"{t. \\l \\ {0..length (sram s0) - 1}. t = replace_policy ((sram s0) ! l)}\"\n have out: \"rp_read_observe s0 (fst i) = {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/card ?policy_line)}\"\n unfolding rp_read_observe_def Let_def\n using c1 c2 by (simp add: iowned)\n have length_finite: \"finite {0..length (sram s0) - 1}\"\n by blast\n have length_nonempty: \"{0..length (sram s0) - 1} \\ {}\"\n using atLeastatMost_empty_iff by blast\n have caset_line: \"\\l \\ {0..length (sram s0) - 1}. ca_set (replace_policy ((sram s0) ! l)) = l\"\n unfolding replace_policy_def\n proof -\n { \n fix nn :: nat\n have \"sram s0 \\ ca_N cache_comp\"\n using caE_init t000 by blast\n then have \"nn \\ {0..length (sram s0) - 1} \\ ca_set (SOME c. c \\ sram s0 ! nn) = nn\"\n by (metis (no_types) Suc_pred' atLeastAtMost_iff atLeastatMost_empty_iff2 ca_length ca_set_nonempty ca_set_num card_0_eq card_atLeastAtMost finite_atLeastAtMost neq0_conv some_in_eq zero_less_diff) \n }\n then show \"\\n\\{0..length (sram s0) - 1}. ca_set (SOME c. c \\ sram s0 ! n) = n\"\n by blast\n qed\n then have line_diff: \"\\l1 l2. l1 \\ {0..length (sram s0) - 1} \\ l2 \\ {0..length (sram s0) - 1} \\ l1 \\ l2 \\\n (replace_policy ((sram s0) ! l1)) \\ (replace_policy ((sram s0) ! l2))\"\n proof -\n show ?thesis\n by (metis (no_types) caset_line)\n qed\n have policy_length: \"card ?policy_line = card {0..length (sram s0) - 1}\"\n using length_finite length_nonempty line_diff\n by (simp add: policy_line_length)\n then have policy_length2: \"card ?policy_line = length (sram s0)\"\n using cache_set_size t00 stateE_subset by auto\n then have out1: \"{t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/card ?policy_line)} =\n {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}\" \n by auto\n have s1: \"\\e \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}.\n e \\ {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n proof -\n {\n fix e\n assume e0: \"e \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}\"\n have \"fst (fst e) \\ {0..length (sram s0) - 1}\"\n using e0 caset_line by auto\n then have \"\\d \\ {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}. d = e\"\n using e0 by auto\n then have \"e \\ {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have s2: \"\\e \\ {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}.\n e \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}\"\n proof -\n {\n fix e\n assume e1: \"e \\ {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n have \"fst (fst e) \\ {0..length (sram s0) - 1}\"\n using e1 by auto\n moreover have \"\\d \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}. fst (fst d) \\ {0..length (sram s0) - 1}\"\n using caset_line by auto\n ultimately have \"\\d \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}. d = e\"\n by (smt caset_line e1 mem_Collect_eq)\n then have \"e \\ {t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have out_equal: \"{t. \\r'_line \\ ?policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s0))} =\n {t. \\r \\ {0..length (sram s0) - 1}. t = ((r, Miss), 1/length (sram s0))}\"\n using s1 s2 by blast \n show ?thesis\n using out out_equal policy_length2 by presburger\n }\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\n(*pmf instantiate*)\ndefinition execution :: \"memory_request \\ state \\ event \\ ((setindex \\ cachehit) \\ real) set\"\n where \"execution mr s e \\ rp_read_observe s mr\"\n\nlemma read_finite:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_N. finite (execution (fst mr) s e)\"\n unfolding execution_def rp_read_observe_def Let_def\n by simp\n\nlemma read_nonempty_h1:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"probe_line redir_ca (fst mr)\"\n shows \"execution (fst mr) s e \\ {}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 a0 a1 a2 a3 by auto\n\nlemma read_nonempty_h2:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"owned r_line = Some (thread (fst mr))\"\n and a6: \"lock r_line = protect (fst mr)\"\n shows \"execution (fst mr) s e \\ {}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 a0 a1 a2 a3 a4 a5 a6 by auto\n\nlemma read_nonempty_h3:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)}\"\n and a6: \"owned r_line = Some (thread (fst mr))\"\n and a7: \"lock r_line \\ protect (fst mr)\"\n shows \"execution (fst mr) s e \\ {}\"\n proof -\n {\n have exi_redir: \"redir_set < length (sram s)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t1)\n have out: \"execution (fst mr) s e = {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 t1 a0 a1 a2 a3 a4 a5 a6 a7 by auto\n have length_finite: \"finite {0..length (sram s) - 1}\"\n by blast\n have length_nonempty: \"{0..length (sram s) - 1} \\ {}\"\n using atLeastatMost_empty_iff by blast\n have caset_line: \"\\l \\ {0..length (sram s) - 1}. ca_set (replace_policy ((sram s) ! l)) = l\"\n unfolding replace_policy_def\n proof -\n { \n fix nn :: nat\n have \"sram s \\ ca_N cache_comp\"\n by (smt mem_Collect_eq state.select_convs(1) state_N_init state_N_witness_def t0)\n then have \"nn \\ {0..length (sram s) - 1} \\ ca_set (SOME c. c \\ sram s ! nn) = nn\"\n by (metis (no_types) Suc_pred' atLeastAtMost_iff atLeastatMost_empty_iff2 ca_length ca_set_nonempty ca_set_num card_0_eq card_atLeastAtMost finite_atLeastAtMost neq0_conv some_in_eq zero_less_diff) \n }\n then show \"\\n\\{0..length (sram s) - 1}. ca_set (SOME c. c \\ sram s ! n) = n\"\n by blast\n qed\n then have line_diff: \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n (replace_policy ((sram s) ! l1)) \\ (replace_policy ((sram s) ! l2))\"\n proof -\n show ?thesis\n by (metis (no_types) caset_line)\n qed\n have policy_length: \"card policy_line = card {0..length (sram s) - 1}\"\n using length_finite length_nonempty line_diff a5\n by (simp add: policy_line_length)\n then have policy_length2: \"card policy_line = length (sram s)\"\n using cache_set_size t0 by auto\n then have out1: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)} =\n {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n have s1: \"\\e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}.\n e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e0: \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e0 caset_line a5 by auto\n then have \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. d = e\"\n using e0 by auto\n then have \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have s2: \"\\e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}.\n e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e1: \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e1 by auto\n moreover have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. fst (fst d) \\ {0..length (sram s) - 1}\"\n using caset_line a5 by auto\n ultimately have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. d = e\"\n by (smt caset_line e1 a5 mem_Collect_eq)\n then have \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have out_equal: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))} =\n {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using s1 s2 by blast\n then have out2: \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using out out1 by auto\n have finite_out: \"finite {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n have nonempty_out: \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} \\ {}\"\n by auto\n have value_out: \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. snd d = 1/length (sram s)\"\n by auto\n have \"folds (\\t p. snd t + p) 0 {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} =\n 1/length (sram s) * card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using cache_set_size2[where ?w = \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\" and\n ?P = \"snd\" and\n ?i = \"1/length (sram s)\"]\n finite_out nonempty_out value_out by blast\n moreover have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} = length (sram s)\"\n proof -\n {\n have \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n ((l1, Miss), 1/length (sram s)) \\ ((l2, Miss), 1/length (sram s))\"\n by auto\n then have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1 / real (length (sram s)))} =\n card {0..length (sram s) - 1}\"\n using length_finite length_nonempty\n by (simp add: policy_line_length)\n then show ?thesis\n using cache_set_size t0 by auto\n }\n qed\n ultimately show ?thesis\n using of_nat_0 out2 by force \n }\n qed\n\nlemma read_nonempty_h4:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)}\"\n and a6: \"owned r_line \\ Some (thread (fst mr))\"\n shows \"execution (fst mr) s e \\ {}\"\n proof -\n {\n have exi_redir: \"redir_set < length (sram s)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t1)\n have out: \"execution (fst mr) s e = {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 t1 a0 a1 a2 a3 a4 a5 a6 by auto\n have length_finite: \"finite {0..length (sram s) - 1}\"\n by blast\n have length_nonempty: \"{0..length (sram s) - 1} \\ {}\"\n using atLeastatMost_empty_iff by blast\n have caset_line: \"\\l \\ {0..length (sram s) - 1}. ca_set (replace_policy ((sram s) ! l)) = l\"\n unfolding replace_policy_def\n proof -\n { \n fix nn :: nat\n have \"sram s \\ ca_N cache_comp\"\n by (smt mem_Collect_eq state.select_convs(1) state_N_init state_N_witness_def t0)\n then have \"nn \\ {0..length (sram s) - 1} \\ ca_set (SOME c. c \\ sram s ! nn) = nn\"\n by (metis (no_types) Suc_pred' atLeastAtMost_iff atLeastatMost_empty_iff2 ca_length ca_set_nonempty ca_set_num card_0_eq card_atLeastAtMost finite_atLeastAtMost neq0_conv some_in_eq zero_less_diff) \n }\n then show \"\\n\\{0..length (sram s) - 1}. ca_set (SOME c. c \\ sram s ! n) = n\"\n by blast\n qed\n then have line_diff: \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n (replace_policy ((sram s) ! l1)) \\ (replace_policy ((sram s) ! l2))\"\n proof -\n show ?thesis\n by (metis (no_types) caset_line)\n qed\n have policy_length: \"card policy_line = card {0..length (sram s) - 1}\"\n using length_finite length_nonempty line_diff a5\n by (simp add: policy_line_length)\n then have policy_length2: \"card policy_line = length (sram s)\"\n using cache_set_size t0 by auto\n then have out1: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)} =\n {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n have s1: \"\\e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}.\n e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e0: \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e0 caset_line a5 by auto\n then have \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. d = e\"\n using e0 by auto\n then have \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have s2: \"\\e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}.\n e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e1: \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e1 by auto\n moreover have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. fst (fst d) \\ {0..length (sram s) - 1}\"\n using caset_line a5 by auto\n ultimately have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. d = e\"\n by (smt caset_line e1 a5 mem_Collect_eq)\n then have \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have out_equal: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))} =\n {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using s1 s2 by blast\n then have out2: \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using out out1 by auto\n have finite_out: \"finite {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n have nonempty_out: \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} \\ {}\"\n by auto\n have value_out: \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. snd d = 1/length (sram s)\"\n by auto\n have \"folds (\\t p. snd t + p) 0 {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} =\n 1/length (sram s) * card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using cache_set_size2[where ?w = \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\" and\n ?P = \"snd\" and\n ?i = \"1/length (sram s)\"]\n finite_out nonempty_out value_out by blast\n moreover have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} = length (sram s)\"\n proof -\n {\n have \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n ((l1, Miss), 1/length (sram s)) \\ ((l2, Miss), 1/length (sram s))\"\n by auto\n then have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1 / real (length (sram s)))} =\n card {0..length (sram s) - 1}\"\n using length_finite length_nonempty\n by (simp add: policy_line_length)\n then show ?thesis\n using cache_set_size t0 by auto\n }\n qed\n ultimately show ?thesis\n using of_nat_0 out2 by force \n }\n qed\n\nlemma read_nonempty:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_N. execution (fst mr) s e \\ {}\"\n proof -\n {\n fix e\n have \"\\mr \\ mem_req mm_comp. \\s \\ state_N. execution (fst mr) s e \\ {}\"\n proof -\n {\n fix mr\n assume t0: \"mr \\ mem_req mm_comp\"\n have \"\\s \\ state_N. execution (fst mr) s e \\ {}\"\n proof -\n {\n fix s\n assume t1: \"s \\ state_N\"\n have \"execution (fst mr) s e \\ {}\"\n using read_nonempty_h1 read_nonempty_h2 read_nonempty_h3 read_nonempty_h4 t0 t1\n by meson \n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\nlemma read_unique:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_N. \\m n. m \\ (execution (fst mr) s e) \\ n \\ (execution (fst mr) s e) \\ m \\ n \\ fst m \\ fst n\"\n unfolding execution_def rp_read_observe_def Let_def\n by auto\n\nlemma read_positive:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_N. \\d \\ (execution (fst mr) s e). snd d \\ 0\"\n unfolding execution_def rp_read_observe_def Let_def\n by (smt mem_Collect_eq of_nat_0_le_iff singletonD snd_conv zero_le_divide_1_iff)\n\nlemma read_sum_one_h1:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"probe_line redir_ca (fst mr)\"\n shows \"folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 a0 a1 a2 a3 by auto\n\nlemma read_sum_one_h2:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"owned r_line = Some (thread (fst mr))\"\n and a6: \"lock r_line = protect (fst mr)\"\n shows \"folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 a0 a1 a2 a3 a4 a5 a6 by auto\n\nlemma read_sum_one_h3:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)}\"\n and a6: \"owned r_line = Some (thread (fst mr))\"\n and a7: \"lock r_line \\ protect (fst mr)\"\n shows \"folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n proof -\n {\n have exi_redir: \"redir_set < length (sram s)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t1)\n have out: \"execution (fst mr) s e = {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 t1 a0 a1 a2 a3 a4 a5 a6 a7 by auto\n have length_finite: \"finite {0..length (sram s) - 1}\"\n by blast\n have length_nonempty: \"{0..length (sram s) - 1} \\ {}\"\n using atLeastatMost_empty_iff by blast\n have caset_line: \"\\l \\ {0..length (sram s) - 1}. ca_set (replace_policy ((sram s) ! l)) = l\"\n unfolding replace_policy_def\n proof -\n { \n fix nn :: nat\n have \"sram s \\ ca_N cache_comp\"\n by (smt mem_Collect_eq state.select_convs(1) state_N_init state_N_witness_def t0)\n then have \"nn \\ {0..length (sram s) - 1} \\ ca_set (SOME c. c \\ sram s ! nn) = nn\"\n by (metis (no_types) Suc_pred' atLeastAtMost_iff atLeastatMost_empty_iff2 ca_length ca_set_nonempty ca_set_num card_0_eq card_atLeastAtMost finite_atLeastAtMost neq0_conv some_in_eq zero_less_diff) \n }\n then show \"\\n\\{0..length (sram s) - 1}. ca_set (SOME c. c \\ sram s ! n) = n\"\n by blast\n qed\n then have line_diff: \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n (replace_policy ((sram s) ! l1)) \\ (replace_policy ((sram s) ! l2))\"\n proof -\n show ?thesis\n by (metis (no_types) caset_line)\n qed\n have policy_length: \"card policy_line = card {0..length (sram s) - 1}\"\n using length_finite length_nonempty line_diff a5\n by (simp add: policy_line_length)\n then have policy_length2: \"card policy_line = length (sram s)\"\n using cache_set_size t0 by auto\n then have out1: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)} =\n {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n have s1: \"\\e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}.\n e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e0: \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e0 caset_line a5 by auto\n then have \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. d = e\"\n using e0 by auto\n then have \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have s2: \"\\e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}.\n e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e1: \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e1 by auto\n moreover have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. fst (fst d) \\ {0..length (sram s) - 1}\"\n using caset_line a5 by auto\n ultimately have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. d = e\"\n by (smt caset_line e1 a5 mem_Collect_eq)\n then have \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have out_equal: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))} =\n {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using s1 s2 by blast\n then have out2: \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using out out1 by auto\n have finite_out: \"finite {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n have nonempty_out: \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} \\ {}\"\n by auto\n have value_out: \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. snd d = 1/length (sram s)\"\n by auto\n have \"folds (\\t p. snd t + p) 0 {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} =\n 1/length (sram s) * card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using cache_set_size2[where ?w = \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\" and\n ?P = \"snd\" and\n ?i = \"1/length (sram s)\"]\n finite_out nonempty_out value_out by blast\n moreover have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} = length (sram s)\"\n proof -\n {\n have \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n ((l1, Miss), 1/length (sram s)) \\ ((l2, Miss), 1/length (sram s))\"\n by auto\n then have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1 / real (length (sram s)))} =\n card {0..length (sram s) - 1}\"\n using length_finite length_nonempty\n by (simp add: policy_line_length)\n then show ?thesis\n using cache_set_size t0 by auto\n }\n qed\n ultimately show ?thesis\n using of_nat_0 out2 by force \n }\n qed\n\nlemma read_sum_one_h4:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"policy_line = {t. \\l \\ {0..length (sram s) - 1}. t = replace_policy ((sram s) ! l)}\"\n and a6: \"owned r_line \\ Some (thread (fst mr))\"\n shows \"folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n proof -\n {\n have exi_redir: \"redir_set < length (sram s)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t1)\n have out: \"execution (fst mr) s e = {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)}\"\n unfolding execution_def rp_read_observe_def Let_def\n using t0 t1 a0 a1 a2 a3 a4 a5 a6 by auto\n have length_finite: \"finite {0..length (sram s) - 1}\"\n by blast\n have length_nonempty: \"{0..length (sram s) - 1} \\ {}\"\n using atLeastatMost_empty_iff by blast\n have caset_line: \"\\l \\ {0..length (sram s) - 1}. ca_set (replace_policy ((sram s) ! l)) = l\"\n unfolding replace_policy_def\n proof -\n { \n fix nn :: nat\n have \"sram s \\ ca_N cache_comp\"\n by (smt mem_Collect_eq state.select_convs(1) state_N_init state_N_witness_def t0)\n then have \"nn \\ {0..length (sram s) - 1} \\ ca_set (SOME c. c \\ sram s ! nn) = nn\"\n by (metis (no_types) Suc_pred' atLeastAtMost_iff atLeastatMost_empty_iff2 ca_length ca_set_nonempty ca_set_num card_0_eq card_atLeastAtMost finite_atLeastAtMost neq0_conv some_in_eq zero_less_diff) \n }\n then show \"\\n\\{0..length (sram s) - 1}. ca_set (SOME c. c \\ sram s ! n) = n\"\n by blast\n qed\n then have line_diff: \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n (replace_policy ((sram s) ! l1)) \\ (replace_policy ((sram s) ! l2))\"\n proof -\n show ?thesis\n by (metis (no_types) caset_line)\n qed\n have policy_length: \"card policy_line = card {0..length (sram s) - 1}\"\n using length_finite length_nonempty line_diff a5\n by (simp add: policy_line_length)\n then have policy_length2: \"card policy_line = length (sram s)\"\n using cache_set_size t0 by auto\n then have out1: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/card policy_line)} =\n {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n have s1: \"\\e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}.\n e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e0: \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e0 caset_line a5 by auto\n then have \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. d = e\"\n using e0 by auto\n then have \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have s2: \"\\e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}.\n e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n proof -\n {\n fix e\n assume e1: \"e \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n have \"fst (fst e) \\ {0..length (sram s) - 1}\"\n using e1 by auto\n moreover have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. fst (fst d) \\ {0..length (sram s) - 1}\"\n using caset_line a5 by auto\n ultimately have \"\\d \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}. d = e\"\n by (smt caset_line e1 a5 mem_Collect_eq)\n then have \"e \\ {t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))}\"\n by auto\n }\n then show ?thesis by blast\n qed\n have out_equal: \"{t. \\r'_line \\ policy_line. t = ((ca_set r'_line, Miss), 1/length (sram s))} =\n {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using s1 s2 by blast\n then have out2: \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using out out1 by auto\n have finite_out: \"finite {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n by auto\n have nonempty_out: \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} \\ {}\"\n by auto\n have value_out: \"\\d \\ {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}. snd d = 1/length (sram s)\"\n by auto\n have \"folds (\\t p. snd t + p) 0 {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} =\n 1/length (sram s) * card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n using cache_set_size2[where ?w = \"{t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\" and\n ?P = \"snd\" and\n ?i = \"1/length (sram s)\"]\n finite_out nonempty_out value_out by blast\n moreover have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))} = length (sram s)\"\n proof -\n {\n have \"\\l1 l2. l1 \\ {0..length (sram s) - 1} \\ l2 \\ {0..length (sram s) - 1} \\ l1 \\ l2 \\\n ((l1, Miss), 1/length (sram s)) \\ ((l2, Miss), 1/length (sram s))\"\n by auto\n then have \"card {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1 / real (length (sram s)))} =\n card {0..length (sram s) - 1}\"\n using length_finite length_nonempty\n by (simp add: policy_line_length)\n then show ?thesis\n using cache_set_size t0 by auto\n }\n qed\n ultimately show ?thesis\n using of_nat_0 out2 by force \n }\n qed\n\nlemma read_sum_one:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_N. folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n proof -\n {\n fix e\n have \"\\mr \\ mem_req mm_comp. \\s \\ state_N. folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n proof -\n {\n fix mr\n assume t0: \"mr \\ mem_req mm_comp\"\n have \"\\s \\ state_N. folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n proof -\n {\n fix s\n assume t1: \"s \\ state_N\"\n have \"folds (\\t p. snd t + p) 0 (execution (fst mr) s e) = 1\"\n using read_sum_one_h1 read_sum_one_h2 read_sum_one_h3 read_sum_one_h4 t0 t1\n by meson \n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\ninterpretation CM state_N state_E \"mem_req mm_comp\" execution\n apply standard\n using mem_finite mem_nonempty mem_unique mem_positive mem_sum_one\n read_finite read_nonempty read_unique read_positive read_sum_one\n stateN_finite stateN_nonempty stateE_nonempty stateE_subset\n by auto\n\n\nsubsection \\Proofs of Correctness\\\n\nlemma one_changed1:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"owned r_line = Some (thread (fst mr))\"\n and a6: \"lock r_line = protect (fst mr)\"\n and a7: \"r_line' = replace_line r_line (fst mr)\"\n and a8: \"newset = insert r_line' (redir_ca - {r_line})\"\n shows \"card ((sram (the_elem (rp_read s (fst mr))))!redir_set \\ (sram s)!redir_set) =\n card ((sram s)!redir_set) - 1\"\n proof -\n {\n have exi_redir: \"redir_set < length (sram s)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t1)\n have t2: \"sram s \\ ca_N cache_comp\"\n using state_N_init t0 unfolding state_N_witness_def\n proof -\n assume \"state_N = {t. \\c\\ca_N cache_comp. t = \\sram = c, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n then have \"state_N = {s. \\Cs. Cs \\ ca_N cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n by meson\n then have \"\\Cs. Cs \\ ca_N cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\\"\n using t0 by blast\n then show ?thesis\n by force\n qed\n have probe_fails: \"\\b. b \\ redir_ca \\ ca_tag b = tag (fst mr) \\ valid b \\ owned b = Some (thread (fst mr))\"\n using a3 unfolding probe_line_def by force\n have t3: \"r_line \\ redir_ca\"\n using a2 exi_redir a4 unfolding replace_policy_def\n by (simp add: ca_set_nonempty some_in_eq t2) \n then have tag_diff: \"\\ (ca_tag r_line = tag (fst mr) \\ valid r_line \\ owned r_line = Some (thread (fst mr)))\"\n using probe_fails by auto\n have tag_same: \"ca_tag r_line' = tag (fst mr) \\ valid r_line' \\ owned r_line' = Some (thread (fst mr))\"\n using a7 unfolding replace_line_def by simp\n have t4: \"r_line' \\ redir_ca\"\n using probe_fails tag_same by blast\n then have \"newset \\ redir_ca = redir_ca - {r_line}\"\n using a8 by blast\n then have re: \"card (newset \\ redir_ca) = card redir_ca - 1\"\n by (simp add: card_Diff_subset_Int t3)\n have \"rp_read s (fst mr) = {s\\sram := list_update (sram s) redir_set newset\\}\"\n unfolding rp_read_def Let_def\n using a0 a1 a2 a3 a4 a5 a6 a7 a8 mem_occupy t1 by auto\n then have \"the_elem (rp_read s (fst mr)) = s\\sram := list_update (sram s) redir_set newset\\\"\n unfolding the_elem_def by auto\n then have \"(sram (the_elem (rp_read s (fst mr))))!redir_set = newset\"\n using exi_redir by simp\n then show ?thesis\n using re a2 by blast \n }\n qed\n\nlemma remain_same1:\n assumes t0: \"s \\ state_N\"\n and t1: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"owned r_line = Some (thread (fst mr))\"\n and a6: \"lock r_line = protect (fst mr)\"\n and a7: \"newset = insert (replace_line r_line (fst mr)) (redir_ca - {r_line})\"\n shows \"\\l \\ redir_set. (sram s)!l = (sram (the_elem (rp_read s (fst mr))))!l\"\n proof -\n {\n fix l assume tl: \"l \\ redir_set\"\n have \"(sram s)!l = (sram (the_elem (rp_read s (fst mr))))!l\"\n proof -\n {\n have \"rp_read s (fst mr) = {s\\sram := list_update (sram s) redir_set newset\\}\"\n unfolding rp_read_def Let_def\n using a0 a1 a2 a3 a4 a5 a6 a7 mem_occupy t1 by auto \n then show ?thesis using tl by auto\n }\n qed\n }\n then show ?thesis by blast\n qed\n\nlemma one_changed_remain_same2:\n assumes t0: \"s0 \\ state_N\"\n and t1: \"\\l < length (sram s0). \\e \\ (sram s0)!l. valid e\"\n and t2: \"mr \\ mem_req mm_comp\"\n and a0: \"maps = map_H s0\"\n and a1: \"redir_set = the (maps (index (fst mr)))\"\n and a2: \"redir_ca = (sram s0) ! redir_set\"\n and a3: \"\\ (probe_line redir_ca (fst mr))\"\n and a4: \"r_line = replace_policy redir_ca\"\n and a5: \"policy_line = {t. \\l \\ {0..length (sram s0) - 1}. t = replace_policy ((sram s0) ! l)}\"\n and a6: \"owned r_line = Some (thread (fst mr))\"\n and a7: \"lock r_line \\ protect (fst mr)\"\n shows \"\\s' \\ rp_read s0 (fst mr). \\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n fix s' assume ts: \"s' \\ rp_read s0 (fst mr)\"\n have \"\\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n have iowned: \"thread (fst mr) = H\"\n by (simp add: mem_occupy t2)\n have exi_redir: \"redir_set < length (sram s0)\"\n using state_N_init unfolding state_N_witness_def using mem_mapping\n by (smt a0 a1 map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) t0 t2)\n have t3: \"sram s0 \\ ca_N cache_comp\"\n using state_N_init t0 unfolding state_N_witness_def\n proof -\n assume \"state_N = {t. \\c\\ca_N cache_comp. t = \\sram = c, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n then have \"state_N = {s. \\Cs. Cs \\ ca_N cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n by meson\n then have \"\\Cs. Cs \\ ca_N cache_comp \\ s0 = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\\"\n using t0 by blast\n then show ?thesis\n by force\n qed\n have probe_fails: \"\\b. b \\ redir_ca \\ ca_tag b = tag (fst mr) \\ valid b \\ owned b = Some (thread (fst mr))\"\n using a3 unfolding probe_line_def by force\n have t4: \"r_line \\ redir_ca\"\n using a2 exi_redir a4 unfolding replace_policy_def\n by (simp add: ca_set_nonempty some_in_eq t3) \n then have tag_diff: \"\\ (ca_tag r_line = tag (fst mr) \\ valid r_line \\ owned r_line = Some (thread (fst mr)))\"\n using probe_fails by auto\n have out: \"rp_read s0 (fst mr) = {t. \\r'_line \\ policy_line. let newset = insert (drop_line r'_line) (((sram s0) ! (ca_set r'_line)) - {r'_line}) in\n t = s0\\sram := list_update (sram s0) (ca_set r'_line) newset\\}\"\n unfolding rp_read_def Let_def\n using a0 a1 a2 a3 a4 a5 a6 a7 iowned by auto\n then have \"\\r'_line \\ policy_line.\n s' = (let newset = insert (drop_line r'_line) (((sram s0) ! (ca_set r'_line)) - {r'_line}) in\n s0\\sram := list_update (sram s0) (ca_set r'_line) newset\\)\"\n using ts by auto\n then obtain r'_line where t5: \"r'_line \\ policy_line \\\n s' = (let newset = insert (drop_line r'_line) (((sram s0) ! (ca_set r'_line)) - {r'_line}) in\n s0\\sram := list_update (sram s0) (ca_set r'_line) newset\\)\"\n by auto\n have r'_length: \"ca_set r'_line < length (sram s0)\"\n using t5 by (smt Suc_pred' a5 atLeastAtMost_iff ca_length ca_set_nonempty ca_set_num less_Suc_eq_le mem_Collect_eq replace_policy_def some_in_eq t3)\n have r'_belong: \"r'_line \\ (sram s0) ! (ca_set r'_line)\"\n using t5 by (smt Suc_pred' a5 atLeastAtMost_iff ca_length ca_set_nonempty ca_set_num less_Suc_eq_le mem_Collect_eq replace_policy_def some_in_eq t3)\n have tag_valid: \"valid r'_line\"\n using t1 r'_belong r'_length by blast\n let ?r'_line' = \"drop_line r'_line\"\n have tag_drop: \"valid ?r'_line' = False \\ lock ?r'_line' = False \\ owned ?r'_line' = None\"\n unfolding drop_line_def by simp\n have t6: \"?r'_line' \\ (sram s0) ! (ca_set r'_line)\"\n using r'_length t1 tag_drop by blast\n let ?newset = \"insert ?r'_line' (((sram s0) ! (ca_set r'_line)) - {r'_line})\"\n have \"?newset \\ ((sram s0) ! (ca_set r'_line)) = ((sram s0) ! (ca_set r'_line)) - {r'_line}\"\n using t6 by auto\n then have re: \"card (?newset \\ ((sram s0) ! (ca_set r'_line))) = card ((sram s0) ! (ca_set r'_line)) - 1\"\n by (simp add: card_Diff_subset_Int r'_belong)\n have out1: \"s' = s0\\sram := list_update (sram s0) (ca_set r'_line) ?newset\\\"\n using t5 by simp\n then have \"sram s' = list_update (sram s0) (ca_set r'_line) ?newset\"\n by auto\n then have \"\\!l. l = ca_set r'_line \\ (\\l' \\ l. sram s0 ! l' = sram s' ! l') \\\n card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1\"\n using re nth_list_update_eq r'_length by auto \n then show ?thesis\n by (metis \\sram s' = (sram s0) [ca_set r'_line := insert (drop_line r'_line) (sram s0 ! ca_set r'_line - {r'_line})]\\ insertI1 nth_list_update_eq r'_length t6) \n }\n qed\n }\n then show ?thesis by auto\n qed\n\nlemma one_changed_remain_same3:\n \"\\i \\ mem_req mm_comp. \\s0 \\ state_E. \\s' \\ rp_read s0 (fst i).\n \\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n fix i assume t0: \"i \\ mem_req mm_comp\"\n have \"\\s0 \\ state_E. \\s' \\ rp_read s0 (fst i).\n \\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n fix s0 assume t1: \"s0 \\ state_E\"\n have \"\\s' \\ rp_read s0 (fst i).\n \\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n fix s' assume t2: \"s' \\ rp_read s0 (fst i)\"\n have \"\\!l. (\\l' \\ l. (sram s0)!l' = (sram s')!l') \\ (card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1)\"\n proof -\n {\n have iowned: \"thread (fst i) = H\"\n by (simp add: mem_occupy t0)\n then have \"(if thread (fst i) = H then map_H s0 else map_L s0) = map_H s0\"\n by auto\n let ?maps = \"map_H s0\"\n let ?redir_set = \"the (?maps (index (fst i)))\"\n have exi_redir: \"?redir_set < length (sram s0)\"\n using state_E_init unfolding state_E_witness_def using mem_mapping\n by (smt caE_init map_range mem_Collect_eq state.select_convs(1) state.select_convs(2) subsetD t0 t1)\n let ?redir_ca = \"(sram s0) ! ?redir_set\"\n have t3: \"sram s0 \\ ca_E cache_comp\"\n using state_E_init unfolding state_E_witness_def\n proof -\n assume \"state_E = {t. \\c\\ca_E cache_comp. t = \\sram = c, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n then have \"state_E = {s. \\Cs. Cs \\ ca_E cache_comp \\ s = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\}\"\n by meson\n then have \"\\Cs. Cs \\ ca_E cache_comp \\ s0 = \\sram = Cs, map_H = map_conf mm_comp, map_L = map_conf mm_comp\\\"\n using t1 by blast\n then show ?thesis\n by fastforce\n qed\n then have setowned: \"\\l < length (sram s0). \\e \\ ((sram s0)!l). owned e = Some L\"\n using caE_occupy by blast\n then have \"\\b. b \\ ?redir_ca \\ ca_tag b = tag (fst i) \\ valid b \\ owned b = Some (thread (fst i))\"\n using iowned exi_redir by auto\n then have c1: \"\\ probe_line ?redir_ca (fst i)\"\n unfolding probe_line_def by blast\n let ?r_line = \"replace_policy ?redir_ca\"\n have \"?r_line \\ ?redir_ca\"\n unfolding replace_policy_def\n using caE_init ca_set_nonempty some_in_eq t3 exi_redir by blast\n then have \"owned ?r_line = Some L\"\n using setowned exi_redir by blast\n then have c2: \"owned ?r_line \\ Some (thread (fst i))\"\n using iowned by auto\n let ?policy_line = \"{t. \\l \\ {0..length (sram s0) - 1}. t = replace_policy ((sram s0) ! l)}\"\n have out: \"rp_read s0 (fst i) = {t. \\r'_line \\ ?policy_line.\n if ca_set r'_line = ?redir_set then\n let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i)) in\n t = s0\\sram := list_update (sram s0) (ca_set r'_line) newset,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\\n else let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i));\n new_redir_ca = fix_line ?redir_ca (fst i) in\n t = s0\\sram := list_update (list_update (sram s0) (ca_set r'_line) newset) ?redir_set new_redir_ca,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\}\"\n unfolding rp_read_def Let_def\n using c1 c2 by (simp add: iowned)\n then have \"\\r'_line \\ ?policy_line.\n s' = (if ca_set r'_line = ?redir_set then\n let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i)) in\n s0\\sram := list_update (sram s0) (ca_set r'_line) newset,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\\n else let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i));\n new_redir_ca = fix_line ?redir_ca (fst i) in\n s0\\sram := list_update (list_update (sram s0) (ca_set r'_line) newset) ?redir_set new_redir_ca,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\)\"\n using t2 by auto \n then obtain r'_line where t4: \"r'_line \\ ?policy_line \\\n s' = (if ca_set r'_line = ?redir_set then\n let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i)) in\n s0\\sram := list_update (sram s0) (ca_set r'_line) newset,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\\n else let newset = insert (replace_line r'_line (fst i)) (fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i));\n new_redir_ca = fix_line ?redir_ca (fst i) in\n s0\\sram := list_update (list_update (sram s0) (ca_set r'_line) newset) ?redir_set new_redir_ca,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\)\"\n by auto\n have r'_length: \"ca_set r'_line < length (sram s0)\"\n using t4\n proof -\n obtain nn :: \"cache_line \\ nat\" where\n \"(r'_line \\ {c. \\n. n \\ {0..length (sram s0) - 1} \\ c = replace_policy (sram s0 ! n)} \\ nn r'_line \\ {0..length (sram s0) - 1} \\ r'_line = (SOME c. c \\ sram s0 ! nn r'_line)) \\ (r'_line \\ {c. \\n. n \\ {0..length (sram s0) - 1} \\ c = replace_policy (sram s0 ! n)} \\ (\\n. n \\ {0..length (sram s0) - 1} \\ r'_line \\ (SOME c. c \\ sram s0 ! n)))\"\n using replace_policy_def by moura\n then have f1: \"nn r'_line \\ {0..length (sram s0) - 1} \\ r'_line = (SOME c. c \\ sram s0 ! nn r'_line)\"\n using t4 by blast\n then have f2: \"nn r'_line \\ Collect ((\\) 0) \\ length (sram s0) - 1 \\ Collect ((\\) (nn r'_line))\"\n using atLeastAtMost_iff by blast\n have f3: \"sram s0 \\ ca_N cache_comp\"\n using caE_init t3 by blast\n then have f4: \"length (sram s0) = Suc (length (sram s0) - 1)\"\n by (meson Suc_pred' ca_length)\n have \"\\n na. (Suc na \\ Collect ((<) n)) = (na \\ Collect ((\\) n))\"\n by (simp add: less_Suc_eq_le)\n then show ?thesis\n using f4 f3 f2 f1 by (metis ca_set_nonempty ca_set_num mem_Collect_eq some_in_eq)\n qed\n have r'_belong: \"r'_line \\ (sram s0) ! (ca_set r'_line)\"\n using t4\n proof -\n have f1: \"sram s0 \\ ca_N cache_comp\"\n using caE_init t3 by blast\n obtain nn :: \"cache_line \\ nat\" where\n \"(r'_line \\ {c. \\n. n \\ {0..length (sram s0) - 1} \\ c = replace_policy (sram s0 ! n)} \\ nn r'_line \\ {0..length (sram s0) - 1} \\ r'_line = (SOME c. c \\ sram s0 ! nn r'_line)) \\ (r'_line \\ {c. \\n. n \\ {0..length (sram s0) - 1} \\ c = replace_policy (sram s0 ! n)} \\ (\\n. n \\ {0..length (sram s0) - 1} \\ r'_line \\ (SOME c. c \\ sram s0 ! n)))\"\n using replace_policy_def by moura\n then have f2: \"nn r'_line \\ {0..length (sram s0) - 1} \\ r'_line = (SOME c. c \\ sram s0 ! nn r'_line)\"\n using t4 by blast\n then have f3: \"length (sram s0) \\ Collect ((<) (nn r'_line))\"\n using f1 by (metis Suc_pred' atLeastAtMost_iff ca_length less_Suc_eq_le mem_Collect_eq)\n then have f4: \"(SOME c. c \\ sram s0 ! nn r'_line) \\ sram s0 ! nn r'_line\"\n using f1 by (simp add: ca_set_nonempty some_in_eq)\n then have \"nn r'_line = ca_set r'_line\"\n using f3 f2 f1 by (simp add: ca_set_num)\n then show ?thesis\n using f4 f2 by auto\n qed\n then have tag_diff: \"the (owned r'_line) \\ thread (fst i)\"\n using setowned r'_length iowned by auto \n {\n assume r0: \"ca_set r'_line = ?redir_set\"\n have fix_l: \"fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i) = ((sram s0) ! (ca_set r'_line)) - {r'_line}\"\n unfolding fix_line_def using r'_length setowned iowned by auto\n let ?r'_line' = \"replace_line r'_line (fst i)\"\n have tag_same: \"ca_tag ?r'_line' = tag (fst i) \\ valid ?r'_line' \\ owned ?r'_line' = Some (thread (fst i))\"\n unfolding replace_line_def by simp\n have t5: \"?r'_line' \\ (sram s0) ! (ca_set r'_line)\"\n using c1 probe_line_def r0 tag_same by auto\n let ?newset = \"insert ?r'_line' (((sram s0) ! (ca_set r'_line)) - {r'_line})\"\n have \"?newset \\ ((sram s0) ! (ca_set r'_line)) = ((sram s0) ! (ca_set r'_line)) - {r'_line}\"\n using t5 by auto\n then have re: \"card (?newset \\ ((sram s0) ! (ca_set r'_line))) = card ((sram s0) ! (ca_set r'_line)) - 1\"\n by (simp add: card_Diff_subset_Int r'_belong)\n have out1: \"s' = s0\\sram := list_update (sram s0) (ca_set r'_line) ?newset,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\\"\n using t4 fix_l r0 by auto\n then have \"sram s' = list_update (sram s0) (ca_set r'_line) ?newset\"\n by auto\n then have \"\\!l. l = ca_set r'_line \\ (\\l' \\ l. sram s0 ! l' = sram s' ! l') \\\n card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1\"\n using re nth_list_update_eq r'_length by auto \n then have ?thesis\n by (metis \\sram s' = (sram s0) [ca_set r'_line := insert (replace_line r'_line (fst i)) (sram s0 ! ca_set r'_line - {r'_line})]\\ insertI1 nth_list_update_eq r'_length t5) \n }\n moreover\n {\n assume r1: \"ca_set r'_line \\ ?redir_set\"\n have fix_l: \"fix_line (((sram s0) ! (ca_set r'_line)) - {r'_line}) (fst i) = ((sram s0) ! (ca_set r'_line)) - {r'_line}\"\n unfolding fix_line_def using r'_length setowned iowned by auto\n let ?r'_line' = \"replace_line r'_line (fst i)\"\n have tag_same: \"ca_tag ?r'_line' = tag (fst i) \\ valid ?r'_line' \\ owned ?r'_line' = Some (thread (fst i))\"\n unfolding replace_line_def by simp\n have t5: \"?r'_line' \\ (sram s0) ! (ca_set r'_line)\"\n using \\owned (replace_policy (sram s0 ! the (map_H s0 (index (fst i))))) = Some L\\ c2 r'_length setowned tag_same by force\n let ?newset = \"insert ?r'_line' (((sram s0) ! (ca_set r'_line)) - {r'_line})\"\n \n have \"?newset \\ ((sram s0) ! (ca_set r'_line)) = ((sram s0) ! (ca_set r'_line)) - {r'_line}\"\n using t5 by auto\n then have re: \"card (?newset \\ ((sram s0) ! (ca_set r'_line))) = card ((sram s0) ! (ca_set r'_line)) - 1\"\n by (simp add: card_Diff_subset_Int r'_belong)\n \n have fix_ll: \"fix_line ?redir_ca (fst i) = ?redir_ca\"\n unfolding fix_line_def using setowned iowned exi_redir by auto\n let ?new_redir_ca = \"?redir_ca\"\n have out2: \"s' = s0\\sram := list_update (list_update (sram s0) (ca_set r'_line) ?newset) ?redir_set ?new_redir_ca,\n map_H := swap_map (map_H s0) ?redir_set (ca_set r'_line)\\\"\n using t4\n by (simp add: \\fix_line (sram s0 ! the (map_H s0 (index (fst i)))) (fst i) = sram s0 ! the (map_H s0 (index (fst i)))\\ fix_l r1) \n have \"list_update (list_update (sram s0) (ca_set r'_line) ?newset) ?redir_set ?new_redir_ca = list_update (sram s0) (ca_set r'_line) ?newset\"\n using fix_ll by (simp add: list_update_swap r1)\n then have \"sram s' = list_update (sram s0) (ca_set r'_line) ?newset\"\n using out2 by auto\n then have \"\\!l. l = ca_set r'_line \\ (\\l' \\ l. sram s0 ! l' = sram s' ! l') \\\n card (((sram s') ! l) \\ ((sram s0) ! l)) = card ((sram s0) ! l) - 1\"\n using re nth_list_update_eq r'_length by auto \n have ?thesis\n by (metis \\\\!l. l = ca_set r'_line \\ (\\l'. l' \\ l \\ sram s0 ! l' = sram s' ! l') \\ card (sram s' ! l \\ sram s0 ! l) = card (sram s0 ! l) - 1\\ \\sram s' = (sram s0) [ca_set r'_line := insert (replace_line r'_line (fst i)) (sram s0 ! ca_set r'_line - {r'_line})]\\ insertI1 nth_list_update_eq r'_length t5)\n }\n ultimately have ?thesis\n by linarith \n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\n\nsubsection \\Proofs of Security Model\\\n\nlemma read_not_zero:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_E. \\d \\ execution (fst mr) s e. snd d \\ 0\"\n proof -\n {\n fix e\n have \"\\mr \\ mem_req mm_comp. \\s \\ state_E. \\d \\ execution (fst mr) s e. snd d \\ 0\"\n proof -\n {\n fix mr\n assume t0: \"mr \\ mem_req mm_comp\"\n have \"\\s \\ state_E. \\d \\ execution (fst mr) s e. snd d \\ 0\"\n proof -\n {\n fix s\n assume t1: \"s \\ state_E\"\n have \"\\d \\ execution (fst mr) s e. snd d \\ 0\"\n proof -\n {\n have \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n unfolding execution_def using mem_cache_miss t0 t1 by auto\n moreover have \"length (sram s) \\ 0\"\n using cache_set_size stateE_subset t1 by fastforce\n ultimately show ?thesis\n by simp \n }\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\nlemma read_uniform:\n \"\\e. \\mr \\ mem_req mm_comp. \\s \\ state_E. \\d \\ execution (fst mr) s e.\n snd d = folds (\\t p. snd t + p) 0 {u. u \\ makeDist s e \\ snd (fst u) = fst d}\"\n proof -\n {\n fix e\n have \"\\mr \\ mem_req mm_comp. \\s \\ state_E. \\d \\ execution (fst mr) s e.\n snd d = folds (\\t p. snd t + p) 0 {u. u \\ makeDist s e \\ snd (fst u) = fst d}\"\n proof -\n {\n fix mr assume t0: \"mr \\ mem_req mm_comp\"\n have \"\\s \\ state_E. \\d \\ execution (fst mr) s e.\n snd d = folds (\\t p. snd t + p) 0 {u. u \\ makeDist s e \\ snd (fst u) = fst d}\"\n proof -\n {\n fix s assume t1: \"s \\ state_E\"\n have \"\\d \\ execution (fst mr) s e.\n snd d = folds (\\t p. snd t + p) 0 {u. u \\ makeDist s e \\ snd (fst u) = fst d}\"\n proof -\n {\n fix d assume \"d \\ execution (fst mr) s e\"\n have emr: \"execution (fst mr) s e = {t. \\r \\ {0..length (sram s) - 1}. t = ((r, Miss), 1/length (sram s))}\"\n unfolding execution_def using mem_cache_miss\n using t0 t1 by blast\n have pmf_m: \"\\m \\ mem_req mm_comp. \\!t \\ execution (fst m) s e. t = (fst d, snd d)\"\n using \\d \\ execution (fst mr) s e\\ execution_def mem_cache_miss t0 t1 by auto\n then have makedist_m: \"\\m \\ mem_req mm_comp. ((fst m, fst d), snd m * snd d) \\ makeDist s e\"\n unfolding makeDist_def using emr by fastforce\n then have set_equal: \"{u. u \\ makeDist s e \\ snd (fst u) = fst d} =\n {t. \\m \\ mem_req mm_comp. t = ((fst m, fst d), snd m * snd d)}\"\n by (smt Collect_cong Pair_inject execution_def makeDist_def mem_Collect_eq mem_cache_miss pmf_m surjective_pairing t1)\n have sum1: \"folds (\\t p. snd t + p) 0 {t. \\m \\ mem_req mm_comp. t = ((fst m, fst d), snd m * snd d)} =\n folds (\\t p. snd t * snd d + p) 0 (mem_req mm_comp)\" \n using folds_plus_times_input2[where ?w = \"mem_req mm_comp\" and ?d = \"d\"]\n mem_finite mem_nonempty mem_unique inputdist_nonempty by auto \n have sum2: \"folds (\\t p. snd t * snd d + p) 0 (mem_req mm_comp) = snd d * (folds (\\t p. snd t + p) 0 (mem_req mm_comp))\"\n using folds_plus_times_input[where ?w = \"mem_req mm_comp\" and ?i = \"snd d\"]\n mem_finite mem_nonempty mem_unique inputdist_nonempty by auto\n have \"snd d = folds (\\t p. snd t + p) 0 {u. u \\ makeDist s e \\ snd (fst u) = fst d}\"\n using set_equal sum1 sum2 mem_sum_one by simp\n }\n then show ?thesis by auto\n qed\n }\n then show ?thesis by auto\n qed\n }\n then show ?thesis by blast\n qed\n }\n then show ?thesis by blast\n qed\n\nend\n", "meta": {"author": "johnakeke", "repo": "Microarchitecture-Side-Channel-Verification", "sha": "0b0bac7f86752ad40c601e2244a92a90af628aea", "save_path": "github-repos/isabelle/johnakeke-Microarchitecture-Side-Channel-Verification", "path": "github-repos/isabelle/johnakeke-Microarchitecture-Side-Channel-Verification/Microarchitecture-Side-Channel-Verification-0b0bac7f86752ad40c601e2244a92a90af628aea/CM_RpSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.29111574776707544}} {"text": "theory SM_Sticky\nimports \n SM_Indep\n DFS_Framework.Reachable_Nodes\n DFS_Framework.Feedback_Arcs\n Partial_Order_Reduction.Ample_Analysis\nbegin\n\n lemma eq_conv_sym: \n assumes \"(a=b) = c\"\n shows \"(b=a) = c\"\n using assms by auto\n\n lemma neq_conv_sym: \n assumes \"(a\\b) = c\"\n shows \"(b\\a) = c\"\n using assms by auto\n\n lemmas [iff] = not_None_eq[THEN neq_conv_sym]\n\n lemma none_notin_set_map_Some_conv: \"None \\ set w \\ (\\w'. w=map Some w')\"\n apply rule\n apply (induction w)\n apply (auto simp: map_eq_Cons_conv[THEN eq_conv_sym]) [2]\n\n apply auto []\n done\n\n context cprog begin \n definition \"cfgc_V0 \\ comp.\\ ` cfg_V0 prog\"\n definition \"cfgc_V0_list \\ map comp.\\ (cfg_V0_list prog)\"\n\n lemma cfgc_V0_list_refine: \"(cfgc_V0_list, cfgc_V0) \\ \\Id\\list_set_rel\"\n unfolding cfgc_V0_def cfgc_V0_list_def list_set_rel_def br_def\n using cfg_V0_list_invar cfg_V0_list_refine\n apply (auto simp: distinct_map intro!: inj_onI)\n using comp.\\_\\_inverse comp.rl_reachable\n apply auto\n by (meson Image_iff comp.\\_inj inj_onD inj_on_subset rtrancl.rtrancl_refl)\n\n definition \"cfgc_E \\ {(c,c'). \\a. cfgc c a c'}\"\n definition \"cfgc_E_succ \\ remdups o map snd o comp.succ_impl\"\n\n lemma cfgc_E_succ_refine: \"(cfgc_E_succ, cfgc_E) \\ \\nat_rel\\slg_rel\"\n unfolding cfgc_E_def cfgc_E_succ_def comp.astep_impl_def\n unfolding slg_rel_def build_rel_def\n apply (rule relcompI[where b=\"\\c. snd`set (comp.succ_impl c)\"])\n apply (auto simp: list_set_rel_def build_rel_def comp.succ_impl_invar)\n done\n\n definition \"cfgc_G \\ \\ g_V = UNIV, g_E = cfgc_E, g_V0 = cfgc_V0 \\\"\n definition \"cfgc_G_impl \\ \\ gi_V = \\ _. True, gi_E = cfgc_E_succ, gi_V0 = cfgc_V0_list \\\"\n\n lemma cfg_G_simps[simp]:\n \"g_V cfgc_G = UNIV\"\n \"g_E cfgc_G = cfgc_E\"\n \"g_V0 cfgc_G = cfgc_V0\"\n unfolding cfgc_G_def by auto\n\n lemma cfgc_G_impl_refine: \"(cfgc_G_impl, cfgc_G) \\ \\unit_rel, nat_rel\\g_impl_rel_ext\"\n unfolding cfgc_G_def cfgc_G_impl_def\n by (parametricity add: fun_set_UNIV_refine cfgc_V0_list_refine cfgc_E_succ_refine)\n\n lemma cfgc_V0_invarc: \"c\\cfgc_V0 \\ comp.invar c\"\n unfolding cfgc_V0_def comp.invar_def\n apply auto\n apply (rule comp.\\_invar)\n apply (auto simp: approx_reachable_list_refine cfg_V0_def approx_reachable_prog0)\n done\n\n lemma cfgc_Estar_invarc: \"\\comp.invar c; (c,c')\\cfgc_E\\<^sup>*\\ \\ comp.invar c'\"\n apply (rotate_tac)\n apply (induction rule: rtrancl_induct)\n apply (auto simp: cfgc_E_def comp.astep_impl_invarc)\n done\n \n end\n\n context visible_prog\n begin\n\n lemma pid_valid_preserve[simp]: \"pid_valid (ga_ex a gc) pid = pid_valid gc pid\" \n by (auto \n simp: ga_ex_def ga_gex_def stutter_extend_ex_def\n split: option.splits prod.splits\n )\n\n lemma pid_valid_preserve_fold[simp]: \"pid_valid (fold ga_ex w gc) pid = pid_valid gc pid\" \n by (induction w arbitrary: gc) auto\n\n lemma pid_valid_ga_gen: \"(pid,cac)\\ga_gen gc \\ pid_valid gc pid\"\n by (auto simp: ga_gen_def)\n\n lemma pid_valid_ga_en: \"Some (pid,cac)\\ga_en gc \\ pid_valid gc pid\"\n by (auto simp: some_ga_en_eq pid_valid_ga_gen)\n\n sublocale sys_graph: fb_graph cfgc_G\n apply unfold_locales\n apply (simp_all add: cfgc_V0_def cfg_V0_def cfgc_E_def)\n done\n\n lemma finite_cfgE_reachable[simp, intro!]: \"finite (cfgc_E\\<^sup>* `` cfgc_V0)\"\n apply (rule finite_ImageI)\n using sys_graph.finite_V0\n apply simp\n apply (rule finite_subset[where B=\"Collect comp.invar\"])\n apply (auto intro: cfgc_V0_invarc cfgc_Estar_invarc) []\n apply (simp add: comp.invar_def[abs_def]) \n done\n\n definition \"vis_edges \\ {(c,c'). \\a. cfgc c a c' \\ write_globals a \\ vis_vars \\ {}}\"\n\n fun ga_is_pid :: \"global_action option \\ pid \\ bool\" where\n \"ga_is_pid None _ \\ True\"\n | \"ga_is_pid (Some (pid',_)) pid \\ pid'=pid\"\n\n\n lemma \n assumes \"(pid,c,a,c') \\ ga_gen gc\"\n shows \n ga_gen_cmd: \"cmd_of_pid gc pid = c\" and \n ga_gen_cmd': \"cmd_of_pid (ga_gex (pid,c,a,c') gc) pid = c'\" and \n ga_gen_edge: \"(c,c')\\cfgc_E\"\n using assms\n apply -\n apply (cases a)\n apply (auto \n simp: cfgc_E_def\n simp: ga_gen_def la_en'_def\n simp: ga_gex_def la_ex'_def\n split: option.splits\n ) [5]\n apply (cases a)\n apply (auto \n simp: cfgc_E_def\n simp: ga_gen_def la_en'_def\n simp: ga_gex_def la_ex'_def\n split: option.splits\n ) [5]\n apply (cases a)\n apply (auto \n simp: cfgc_E_def\n simp: ga_gen_def la_en'_def\n simp: ga_gex_def la_ex'_def\n split: option.splits\n ) [5]\n done \n\n lemmas ga_gen_cmd_cfg = ga_gen_cmd ga_gen_cmd' ga_gen_edge\n\n lemma ga_gex_other: \n assumes \"pid'\\pid\"\n shows \"cmd_of_pid (ga_gex (pid',c,a,c') gc) pid = cmd_of_pid gc pid\"\n using assms\n apply (cases a)\n apply (auto \n simp: ga_gex_def la_ex'_def\n split: option.splits\n ) [5]\n done\n\n lemma proj_word_fin_to_cfg_E:\n assumes \"jsys.path (map Some w) gc\"\n assumes \"fold ga_gex w gc = gc'\"\n shows \"(cmd_of_pid gc pid, cmd_of_pid gc' pid) \n \\ (cfgc_E \\ (\\(_,c,_,c'). (c,c'))`set w)\\<^sup>*\" (is \"_\\(?E w)\\<^sup>*\")\n using assms\n proof (induction w arbitrary: gc)\n case (Cons ga w)\n from Cons.prems have \n EN: \"ga \\ ga_gen gc\" and\n WF': \"jsys.path (map Some w) (ga_gex ga gc)\" and\n EX': \"fold ga_gex w (ga_gex ga gc) = gc'\"\n by (auto simp: some_ga_en_eq some_ga_ex_eq)\n obtain pid' c a c' where [simp]: \"ga = (pid',c,a,c')\"\n by (cases ga)\n\n have \"(cmd_of_pid gc pid, cmd_of_pid (ga_gex ga gc) pid) \\ (?E (ga#w))\\<^sup>*\"\n proof (cases \"pid'=pid\") \n case True\n note True[simp]\n from EN have \"(pid,c,a,c')\\ga_gen gc\" by simp\n from ga_gen_cmd_cfg[OF this] \n have \"(cmd_of_pid gc pid, cmd_of_pid (ga_gex ga gc) pid) \\ ?E (ga#w)\" \n by auto\n thus ?thesis ..\n next\n case False\n hence \"cmd_of_pid (ga_gex ga gc) pid = cmd_of_pid gc pid\"\n by (simp add: ga_gex_other)\n thus ?thesis by auto\n qed\n also from Cons.IH[OF WF' EX'] have \n \"(cmd_of_pid (ga_gex ga gc) pid, cmd_of_pid gc' pid) \\ (?E (ga#w))\\<^sup>*\"\n apply (rule set_rev_mp[OF _ rtrancl_mono])\n by auto\n finally show ?case .\n qed simp\n\n lemma words_fin_None_fmt:\n assumes \"jsys.path w gc\"\n obtains w' n where \"w=map Some w'@replicate n None\"\n using assms\n proof (induction arbitrary: thesis)\n case nil thus ?case by simp\n next\n case (cons a gc w)\n from cons.IH obtain w' n where [simp]: \"w=map Some w'@replicate n None\" .\n show ?case proof (cases a)\n case None\n note None[simp] \n from cons.hyps have [simp]: \"w'=[]\" \n by (cases w') (auto simp: none_ga_en_eq some_ga_en_eq) \n show ?thesis apply (rule cons.prems[of \"[]\" \"Suc n\"]) by simp\n next\n case (Some aa)\n note Some[simp]\n show ?thesis apply (rule cons.prems[of \"aa#w'\" n]) by simp\n qed\n qed\n\n lemma proj_reachable_to_cfgE:\n assumes R: \"gc\\jsys.nodes\"\n assumes PIDV: \"pid_valid gc pid\"\n shows \"\\c0\\cfgc_V0. (c0,cmd_of_pid gc pid)\\cfgc_E\\<^sup>*\"\n proof -\n from R obtain w where \n WF: \"jsys.path w pid_init_gc\"\n and EX: \"fold ga_ex w (pid_init_gc) = gc\"\n by rule auto\n from words_fin_None_fmt[OF WF] obtain w' n where \n [simp]: \"w = map Some w'@replicate n None\" .\n\n from EX have \"fold ga_ex (map Some w') (pid_init_gc) = gc\" \n by simp \n hence EX': \"fold ga_gex w' (pid_init_gc) = gc\"\n by (simp add: fold_map some_ga_ex_eq)\n\n from WF have WF': \"jsys.path (map Some w') pid_init_gc\" \n by auto\n \n from proj_word_fin_to_cfg_E[OF WF' EX', of pid] have\n G: \"(cmd_of_pid (pid_init_gc) pid,cmd_of_pid gc pid) \\ cfgc_E\\<^sup>*\"\n by (rule set_rev_mp[OF _ rtrancl_mono]) auto\n \n show ?thesis proof (cases \"pid_valid (pid_init_gc) pid\")\n case True \n hence \"cmd_of_pid (pid_init_gc) pid \\ cfgc_V0\"\n by (auto simp: cfgc_V0_def cfg_V0_def pid_init_gc_def init_pc_def)\n with G show ?thesis ..\n next\n case False \n hence \"\\pid_valid gc pid\"\n unfolding EX[symmetric] by simp \n with PIDV have False by blast thus ?thesis ..\n qed\n qed\n\n lemma proj_ne_word_fin_to_cfg_E:\n assumes WF: \"jsys.path (map Some w) gc\"\n assumes EX: \"fold ga_gex w gc = gc'\"\n assumes [simp]: \"w=(pid,cac)#w'\" (is \"w=?ga#_\")\n shows \"(cmd_of_pid gc pid, cmd_of_pid gc' pid) \n \\ (cfgc_E \\ (\\(_,c,_,c'). (c,c'))`set w)\\<^sup>+\" (is \"_\\?E\\<^sup>+\")\n proof -\n from WF EX have \n EN: \"?ga \\ ga_gen gc\" and\n WF': \"jsys.path (map Some w') (ga_gex ?ga gc)\" and\n EX': \"fold ga_gex w' (ga_gex ?ga gc) = gc'\"\n by (auto simp: some_ga_en_eq some_ga_ex_eq)\n\n obtain c a c' where [simp]: \"cac = (c,a,c')\" by (cases cac)\n\n from EN have \"(pid,c,a,c')\\ga_gen gc\" by simp\n from ga_gen_cmd_cfg[OF this] \n have \"(cmd_of_pid gc pid, cmd_of_pid (ga_gex ?ga gc) pid) \\ ?E\" \n by auto\n also from proj_word_fin_to_cfg_E[OF WF' EX'] \n have \"(cmd_of_pid (ga_gex ?ga gc) pid, cmd_of_pid gc' pid) \\ ?E\\<^sup>*\"\n apply (rule set_rev_mp[OF _ rtrancl_mono])\n by auto\n finally (rtrancl_into_trancl2) show ?thesis .\n qed\n\n end\n\n locale sticky_prog = visible_prog +\n fixes sticky_E\n assumes sticky_E_fas: \"is_fas cfgc_G sticky_E\" \n assumes sticky_E_vis: \"vis_edges \\ sticky_E\"\n begin\n\n definition \"sticky_ga \\ Collect (\n \\None \\ True \n | Some (pid,c,a,c') \\ (c,c')\\sticky_E)\"\n\n lemma sticky_ga_approx_visible: \"jsys.visible \\ sticky_ga\"\n proof -\n have aux: \"\\s s'. sm_props s \\ sm_props s' \\ s \\ s'\"\n by auto\n\n show ?thesis\n apply (clarsimp simp: sticky_ga_def split: option.split)\n apply (rule set_mp[OF sticky_E_vis])\n apply (clarsimp \n elim!: jsys.visibleE \n simp: sticky_ga_def\n split: option.split)\n apply (clarsimp \n split: prod.splits\n simp: ga_en_def ga_gen_def ga_ex_def ga_gex_def\n simp: pid_interp_gc_def interp_gs_def\n simp: vis_edges_def)\n apply (intro exI conjI, assumption) \n apply (drule ex_mod_limit)\n \n apply (drule aux)\n apply (fastforce simp: eq_on_def restrict_map_def)\n done\n qed \n\n lemma sticky_ga_breaks_cycles:\n assumes \"gc\\jsys.nodes\"\n assumes \"w\\jsys.cycles gc\"\n assumes \"w\\[]\"\n shows \"set w \\ sticky_ga \\ {}\"\n proof (cases \"None \\ set w\")\n case True\n thus ?thesis\n by (auto simp: sticky_ga_def)\n next\n case False\n then obtain w' where [simp]: \"w=map Some w'\"\n by (auto simp: none_notin_set_map_Some_conv)\n\n have aux1: \"Some ` set w' \\ sticky_ga \n = Some ` (set w' \\ {(pid,c,a,c'). (c,c')\\sticky_E})\"\n by (auto simp: sticky_ga_def)\n \n\n show ?thesis \n proof (cases \"\\(pid,c,a,c')\\set w'. (c,c')\\sticky_E\")\n case True thus ?thesis by (auto simp: aux1)\n next \n case False \n let ?E = \"(cfgc_E \\ (\\(_, c, _, c'). (c, c')) ` set w')\"\n\n from False have NO_STICKY: \"?E \\ sticky_E = {}\" by auto\n\n from \\w\\[]\\ obtain pid cac w'' where W'_FMT[simp]: \"w'=(pid,cac)#w''\"\n by (auto simp: neq_Nil_conv)\n\n from \\w\\jsys.cycles gc\\ have PIDV: \"pid_valid gc pid\"\n by (auto simp: pid_valid_ga_en)\n\n have \"(cmd_of_pid gc pid, cmd_of_pid gc pid)\\ ?E\\<^sup>+\"\n apply (rule proj_ne_word_fin_to_cfg_E[OF _ _ W'_FMT])\n using \\w\\jsys.cycles gc\\\n by (auto simp: fold_map some_ga_ex_eq)\n hence CYC: \"(cmd_of_pid gc pid, cmd_of_pid gc pid) \\ (cfgc_E-sticky_E)\\<^sup>+\"\n apply (rule trancl_mono)\n using NO_STICKY by blast\n\n from proj_reachable_to_cfgE[OF \\gc\\jsys.nodes\\ PIDV] obtain\n c0 where C0: \"c0\\cfgc_V0\" and REACH: \"(c0,cmd_of_pid gc pid)\\cfgc_E\\<^sup>*\" ..\n\n from CYC C0 REACH sticky_E_fas[unfolded is_fas_def]\n have False by force\n thus ?thesis ..\n qed\n qed\n \n sublocale jsys: transition_system_sticky \n ga_ex \"\\ a p. a \\ ga_en p\" \"\\ p. p = pid_init_gc\" pid_interp_gc sticky_ga\n apply unfold_locales\n using sticky_ga_breaks_cycles apply blast\n using sticky_ga_approx_visible apply blast\n done\n\n sublocale jsys: transition_system_ample ga_ex \"\\ a p. a \\ ga_en p\" \"\\ p. p = pid_init_gc\"\n pid_interp_gc sticky_ga ind\n by unfold_locales\n\n end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Analysis/SM_Sticky.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521102, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.2911157477670754}} {"text": "theory ExclLemma\n imports RedSafeCV ProcCVars ProcDef\nbegin\n \ndefinition can_access where\n \"can_access e x = (x \\ ref_vars e)\"\n \n (*thm proper_exp_def*)\n \nlemma well_typed_deref_ex: \"\\ well_typed env r_s1 e tau r_s2 rx; Loc x \\ res_vars e; x \\ ref_vars e \\ \\ (\\ z. (z, x) \\ own_pairs e)\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac xa)\n apply (auto)\n (* pair case. *)\n apply (blast)\n apply (blast)\n (* if case. *)\n apply (blast)\n apply (blast)\n apply (blast)\n (* lam case. *)\n apply (blast)\n (* app case. *)\n apply (blast)\n done\n \nlemma well_typed_deref_ref_use: \"\\ well_typed env r_s1 e tau r_s2 rx; (x, y) \\ own_pairs e \\ \\ x \\ ref_vars e\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac xa)\n apply (auto)\n (* other cases. *) \n apply (blast)\n apply (blast)\n apply (blast)\n apply (blast)\n done\n \nlemma well_typed_deref_npv_use: \"\\ well_typed env r_s1 e tau r_s2 rx; (x, y) \\ own_pairs e \\ \\ Loc x \\ non_prim_vars env e\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac xa)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n (* other cases. *)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n (* lam case *)\n apply (simp add: non_prim_entry_def)\n apply (case_tac \"\\ t. add_env env (Var x1a) t1 (Loc x) = Some t \\ req_type t \\ Prim\")\n apply (simp add: add_env_def)\n apply (auto)\n (* app case *)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n done\n \nfun in_path where\n \"in_path x [] = False\"\n| \"in_path x (y # t) = (x = y \\ in_path x t)\" \n \n \n (* if x \\ z and y \\ z, and x is in the path from y \\ z, then y \\ a \\ x \\ z *)\nlemma path_lookup_cross_ih: \"\\ path_lookup rs_map x l z; in_path x m; path_lookup rs_map y m z \\ \\\n (\\ a m'. path_lookup rs_map y m' a \\ nres_lookup rs_map a (Loc x) \\ NoPerm \\ path_lookup rs_map x l z \\ (a = y \\ in_path a m))\"\n apply (induct m arbitrary: y) \n apply (auto)\n (* case where x = a (the top of the path) *)\n apply (case_tac \"rs_map y\")\n apply (auto)\n apply (rule_tac x=\"y\" in exI)\n apply (auto)\n apply (rule_tac x=\"[]\" in exI)\n apply (simp)\n apply (simp add: nres_lookup_def)\n (* inductive case *)\n apply (case_tac \"rs_map y\")\n apply (auto)\n apply (case_tac \"\\b. (\\m'. path_lookup rs_map a m' b) \\ nres_lookup rs_map b (Loc x) \\ NoPerm \\ (b = a \\ in_path b m)\")\n apply (erule_tac exE)\n apply (auto)\n apply (rule_tac x=\"a\" in exI)\n apply (auto)\n apply (rule_tac x=\"[a]\" in exI)\n apply (auto)\n apply (rule_tac x=\"b\" in exI)\n apply (auto)\n apply (rule_tac x=\"a # m'\" in exI)\n apply (auto)\n done\n \nlemma lookup_in_path: \"\\ in_path z l; path_lookup rs_map x l y \\ \\ (\\ a. nres_lookup rs_map a (Loc z) \\ NoPerm)\" \n apply (induct l arbitrary: x)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (rule_tac x=\"x\" in exI)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n done\n \nlemma end_in_path: \"\\ x \\ y; path_lookup rs_map x l y \\ \\ in_path y l\" \n apply (induct l arbitrary: x)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n apply (case_tac \"a = y\")\n apply (auto)\n done\n \n (* if x \\ z and y \\ z, then x \\ a \\ c \\ z, and y \\ b \\ c \\ z, a \\ b *)\nlemma path_lookup_cross: \"\\ x \\ y; \\ in_path x m; \\ in_path y l; path_lookup rs_map x l z; path_lookup rs_map y m z \\ \\\n (\\ a b c l' m' lx. a \\ b \\ path_lookup rs_map x l' a \\ path_lookup rs_map y m' b \\\n nres_lookup rs_map a (Loc c) \\ NoPerm \\ nres_lookup rs_map b (Loc c) \\ NoPerm \\ path_lookup rs_map c lx z)\"\n (* we induct over the l, attempting to apply the induction lemma, when x is in_path m *)\n apply (induct l arbitrary: x)\n apply (auto)\n (* empty list case is impossible, since z must be in m *)\n apply (cut_tac y=\"z\" and l=\"m\" in end_in_path)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n (* if a is in_path m, by lemma we can get y \\ ? \\ a \\ z. we can select x \\ x \\ a \\ z, y \\ ? \\ a \\ z *)\n apply (case_tac \"in_path a m\")\n apply (case_tac \"\\ (\\aa m'. path_lookup rs_map y m' aa \\ nres_lookup rs_map aa (Loc a) \\ NoPerm \\ path_lookup rs_map a l z \\ (aa \\ x))\")\n apply (cut_tac x=\"a\" and rs_map=\"rs_map\" and l=\"l\" and y=\"y\" and z=\"z\" and m=\"m\" in path_lookup_cross_ih)\n apply (auto)\n apply (rule_tac x=\"x\" in exI)\n apply (rule_tac x=\"aaa\" in exI)\n apply (auto)\n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n apply (rule_tac x=\"a\" in exI)\n apply (simp add: nres_lookup_def)\n apply (case_tac \"rs_map aaa\")\n apply (auto)\n (* otherwise, we can induct. *)\n apply (case_tac \"\\a' b. a' \\ b \\ (\\l'. path_lookup rs_map a l' a') \\\n (\\m'. path_lookup rs_map y m' b) \\\n (\\c. nres_lookup rs_map a' (Loc c) \\ NoPerm \\ nres_lookup rs_map b (Loc c) \\ NoPerm \\ (\\lx. path_lookup rs_map c lx z))\")\n apply (erule_tac exE)\n apply (auto)\n (* - we take x \\ a' \\ c \\ z, y \\ b \\ c \\ z *)\n apply (rule_tac x=\"a'\" in exI)\n apply (rule_tac x=\"b\" in exI)\n apply (auto)\n apply (rule_tac x=\"a # l'\" in exI)\n apply (auto)\n done\n \ndefinition close_dom_use_env where\n \"close_dom_use_env env rs_map e = (\\ x. if x \\ { Loc x | x. \\ l z. Loc z \\ non_prim_vars env e \\ path_lookup rs_map z l x }\n then OwnPerm else NoPerm)\"\n \nlemma full_close_dom_use_env: \"\\ well_typed_system env rs_map p_map s p_set; p_set u = Some e \\ \\\n close_dom_use_env env rs_map e = full_dom_use_env env rs_map e\"\n (* we want to prove these two definitions are equivalent in a well-typed system *)\n apply (case_tac \"\\ x. close_dom_use_env env rs_map e x = full_dom_use_env env rs_map e x\")\n apply (auto)\n apply (simp add: close_dom_use_env_def)\n apply (simp add: full_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n (* the only part where they would differ would be if x was in the set of non-prim vars, but not in the closure *)\n apply (case_tac \"\\xa. x = Loc xa \\ (\\l z. Loc z \\ non_prim_vars env e \\ path_lookup rs_map z l xa)\")\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e\")\n apply (auto)\n (* x cannot be a var since the env is contained in the state *)\n apply (case_tac x)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_state_def)\n apply (simp add: sub_env_def)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (auto)\n (* since x is a location, we need only demonstrate a path to it. it should lead to itself *)\n apply (erule_tac x=\"[]\" in allE)\n apply (erule_tac x=\"x2\" in allE)\n apply (auto)\n done\n \nlemma wts_excl_dom_use_env: \"\\ well_typed_system env rs_map p_map s p_set; u \\ v; p_set u = Some e; p_set v = Some e';\n p_map u = Some r_sa; p_map v = Some r_sb; well_typed env r_sa e UnitTy r_se r_xe; well_typed env r_sb e' UnitTy r_se' r_xe' \\ \\\n strong_disj_use_env (full_dom_use_env env rs_map e) (full_dom_use_env env rs_map e')\"\n (* first, we use a weaker definition of dominator, to cancel out some edge cases *)\n apply (rule_tac t=\"full_dom_use_env env rs_map e\" and s=\"close_dom_use_env env rs_map e\" in subst)\n apply (simp add: full_close_dom_use_env)\n apply (rule_tac t=\"full_dom_use_env env rs_map e'\" and s=\"close_dom_use_env env rs_map e'\" in subst)\n apply (simp add: full_close_dom_use_env)\n (* if they are not disjoint, there is some z \\ xa, za \\ x *)\n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n apply (simp add: close_dom_use_env_def)\n apply (auto)\n apply (case_tac \"\\l z. Loc z \\ non_prim_vars env e' \\ path_lookup rs_map z l xa\")\n apply (auto)\n (* we can establish r_sa z \\ None, and r_sb za \\ None *)\n apply (case_tac \"r_sa (Loc z) = NoPerm\")\n apply (cut_tac x=\"Loc z\" and ?r_s1.0=\"r_sa\" and e=\"e\" in well_typed_no_npv_use)\n apply (auto)\n apply (case_tac \"r_sb (Loc za) = NoPerm\") \n apply (cut_tac x=\"Loc za\" and ?r_s1.0=\"r_sb\" and e=\"e'\" in well_typed_no_npv_use)\n apply (auto)\n (* if z = za, we have a contradiction by map exclusion. *)\n apply (case_tac \"z = za\")\n apply (case_tac \"\\ disj_nres_map p_map\")\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"v\" in allE)\n apply (auto)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc za\" in allE)\n apply (simp add: nres_lookup_def)\n (* if za is in l, we have a contradiction by map separation. *)\n apply (case_tac \"in_path za l\")\n apply (simp add: well_typed_system_def)\n apply (auto)\n apply (erule_tac x=\"v\" in allE)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and z=\"za\" and l=\"l\" in lookup_in_path)\n apply (auto)\n apply (simp add: sep_nres_map_def)\n apply (erule_tac x=\"a\" in allE)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc za\" in allE)\n apply (auto)\n (* similarly, we can show z is not in la *)\n apply (case_tac \"in_path z la\")\n apply (simp add: well_typed_system_def)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and l=\"la\" in lookup_in_path)\n apply (auto)\n apply (simp add: sep_nres_map_def)\n apply (erule_tac x=\"a\" in allE)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc z\" in allE)\n apply (auto)\n (* otherwise we should be able to find a, b, c where z \\ a \\ c \\ xa and za \\ b \\ c \\ xa*)\n apply (cut_tac rs_map=\"rs_map\" and x=\"z\" and y=\"za\" and z=\"xa\" in path_lookup_cross)\n apply (auto)\n (* this is a contradiction by res map exclusion on the maps of a + b containing c *)\n apply (case_tac \"\\ disj_nres_map rs_map\")\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_state_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"a\" in allE)\n apply (erule_tac x=\"b\" in allE)\n apply (auto)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc c\" in allE)\n apply (auto)\n done\n \n \nlemma well_typed_no_dom_use: \"\\ well_typed_state s env rs_map; p_set u = Some e; p_map u = Some r_s;\n well_typed env r_s e UnitTy r_se r_xe; x \\ ref_vars e; proper_exp rs_map e \\ \\ full_dom_use_env env rs_map e (Loc x) \\ NoPerm\"\n (* res_var case. in this case it is in the dominator since it is non-prim *)\n apply (case_tac \"Loc x \\ res_vars e\")\n apply (case_tac \"env (Loc x) = None\")\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" in well_typed_rv_env_use)\n apply (auto)\n apply (case_tac \"Loc x \\ non_prim_vars env e\")\n apply (cut_tac s=\"s\" and env=\"env\" and rs_map=\"rs_map\" in wts_mem_val_env)\n apply (simp)\n apply (simp add: mem_val_env_def)\n apply (erule_tac x=\"Loc x\" in allE)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (case_tac y)\n apply (auto)\n apply (simp add: full_dom_use_env_def)\n apply (simp add: dom_use_env_def)(*\n apply (case_tac \"\\ l z. z \\ non_prim_vars env e \\ path_lookup rs_map z l x\")\n apply (auto)\n apply (erule_tac x=\"[]\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)*)\n (* otherwise, we presume that it has an owner with permissions in r_s. since e is proper, there is a lookup between them *)\n apply (cut_tac x=\"x\" and e=\"e\" in well_typed_deref_ex)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (erule_tac x=\"z\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: full_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (case_tac \"\\ l z. Loc z \\ non_prim_vars env e \\ path_lookup rs_map z l x\")\n apply (auto)\n apply (erule_tac x=\"l\" in allE)\n apply (erule_tac x=\"z\" in allE)\n apply (auto)\n apply (cut_tac x=\"z\" and y=\"x\" and e=\"e\" in well_typed_deref_npv_use)\n apply (auto)\n done\n \nlemma excl_safe_lemma: \"\\ well_typed_system env rs_map p_map s p_set; p_set u = Some e; can_access e x;\n p_set v = Some e'; u \\ v \\ \\ \\ can_access e' x\"\n (* prelim: p_map u + v has an entry *)\n apply (case_tac \"p_map u = None \\ p_map v = None\")\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: full_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (erule_tac x=\"v\" in allE)\n apply (auto)\n (* prelim: e must be well-typed + proper *)\n apply (case_tac \"\\ (\\ r_s rx. well_typed env y e UnitTy r_s rx \\ proper_exp rs_map e)\")\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n (* prelim: e' is also well-typed + proper *)\n apply (case_tac \"\\ (\\ r_s rx. well_typed env ya e' UnitTy r_s rx \\ proper_exp rs_map e')\")\n apply (simp add: well_typed_system_def)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"v\" in allE)\n apply (auto)\n apply (erule_tac x=\"v\" in allE)\n apply (auto)\n (* from here, we know that x is in the completion of y + ya *)\n apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e\" and x=\"x\" and r_s=\"y\" and s=\"s\" in well_typed_no_dom_use)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (simp add: can_access_def)\n apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e'\" and x=\"x\" and r_s=\"ya\" and s=\"s\" in well_typed_no_dom_use)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (simp add: can_access_def)\n (* this is a contradiction by dominator exlcusion *)\n apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e\" and e'=\"e'\" and u=\"u\" and v=\"v\" and p_map=\"p_map\" and s=\"s\" and\n p_set=\"p_set\" in wts_excl_dom_use_env)\n apply (auto)\n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n done\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ExclLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.29108611386830824}} {"text": "theory Proof_5_5\n imports Requirements VCTheoryLemmas\nbegin\n\nabbreviation s where \"s s0 requestButton_value \\ (toEnv (setVarAny s0 requestButton_value)) \"\n\nlemma VC5_R5_aux1: \"toEnvP s2 \\ toEnvP s0 \\ substate s2 s0 \\ toEnvNum s2 s3 < T1 \\ s3 = s s0 requestButton_value \\\ntoEnvNum s2 s0 < T1\"\n apply auto\n apply(simp split: if_splits)\n using substate_refl substate_asym[of s0 \"s s0 requestButton_value\"] by auto\n\nlemma VC5_R5: \" (toEnvP s0 \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T1 \\ getVarBool s1 minimalRed \\ NOT_PRESSED \\ getVarBool s2 minimalRed = NOT_PRESSED \\\n getVarBool s3 minimalRed = NOT_PRESSED)) \\\n env (setVarAny s0 requestButton_value) requestButton_value \\\n getPstate (setVarAny s0 requestButton_value) Ctrl = minimalRed \\\n \\ getVarBool (setVarAny s0 requestButton_value) Ctrl \\\n \\ MINIMAL_RED_TIME_LIMIT \\ ltimeEnv (setVarAny s0 requestButton_value) Ctrl \\\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (s s0 requestButton_value) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T1 \\ getVarBool s1 minimalRed \\ NOT_PRESSED \\ getVarBool s2 minimalRed = NOT_PRESSED \\\n getVarBool s3 minimalRed = NOT_PRESSED\"\n apply(cases \"s3 = s s0 requestButton_value\")\n apply(cases \"s2 = s s0 requestButton_value\")\n apply blast\n apply(rule cut_rl[of \"substate s2 s0\"])\n apply(rule cut_rl[of \"getVarBool s0 trafficLight = RED\"])\n apply (metis getVarBool.simps(2) getVarBool.simps(4) getVarBool.simps(6) getVarBool.simps(7) numeral_eq_iff one_eq_numeral_iff semiring_norm(85) semiring_norm(89))\n apply(drule conjE)\n prefer 2\n apply assumption\napply(drule conjE)\n prefer 2\n apply assumption\napply(drule conjE)\n prefer 2\n apply assumption\napply(drule allE[of _ s1])\n prefer 2\n apply assumption\n apply(drule allE[of _ s2])\n prefer 2\n apply assumption \napply(drule allE[of _ s0])\n prefer 2\n apply assumption\n apply(rule cut_rl[of \"toEnvNum s2 s0 < T1\"])\n using substate_refl apply fast\n apply((rule VC5_R5_aux1);fast)\n apply (metis substate.simps(2) substate.simps(4) substate.simps(6) substate.simps(7) toEnvP.simps(4) toEnvP.simps(6) toEnvP.simps(7))\n apply(rule cut_rl [of \"substate s3 s0\"])\n apply blast\n by (metis substate.simps(2) substate.simps(4) substate.simps(6) substate.simps(7) toEnvP.simps(4) toEnvP.simps(6) toEnvP.simps(7))\n\n\ntheorem proof_5_5: \"VC5 R5 s0 requestButton_value\"\n apply(simp only: VC5_def R5_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n apply((rule allI);(rule allI);(rule allI))\n apply(rule impI)\n by ((rule VC5_R5);assumption)\n ", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/Proof_5_5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.2908052364552688}} {"text": "theory SC_Depth_Limit\nimports SC_Sema SC_Depth\nbegin\n \nlemma SC_completeness: \"\\ \\ \\ \\ \\ \\ \\ \\ \\ sequent_cost \\ \\\"\nproof(induction \"sequent_cost \\ \\\" arbitrary: \\ \\)\n case 0 hence False by(simp add: sequent_cost_def) thus ?case by clarify\nnext\n case (Suc n)\n from Suc(3) show ?case\n using SCc.cases[OF Suc.hyps(1)]\noops\ntext\\Making this proof of completeness go through should be possible,\n but finding the right way to split the cases could get verbose.\nThe variant with the search procedure is a lot more elegant.\\\n \n\nlemma sc_sim_depth:\n assumes \"sc \\ A \\ B = {}\"\n shows \"image_mset Atom (mset A) + mset \\ \\ image_mset Atom (mset B) + mset \\ \\ sum_list (map size (\\@\\)) + (if set A \\ set B = {} then 0 else 1)\"\nproof -\n have [simp]: \"image_mset Atom (mset A) \\ image_mset Atom (mset B) \\ Suc 0\" (is ?k) if \"set A \\ set B \\ {}\" for A B \n proof -\n from that obtain a where \"a \\ set A\" \"a \\ set B\" by blast\n thus ?k by(force simp: in_image_mset intro: SCc.Ax[where k=a])\n qed\n note SCc.intros(3-)[intro]\n have [elim!]: \"\\ \\ \\ \\ n \\ n \\ m \\ \\ \\ \\ \\ m\" for \\ \\ n m using dec_induct by(fastforce elim!: deeper_suc) (* sledgehammer is flippin' using induction. *)\n from assms show ?thesis\n by(induction \\ A \\ B rule: sc.induct)\n (auto\n simp add: list_sequent_cost_def add.assoc deeper_suc weakenR'\n split: if_splits option.splits)\nqed\n\ncorollary sc_depth_complete:\n assumes s: \"\\ \\ \\ \\\"\n shows \"\\ \\ \\ \\ sum_mset (image_mset size (\\+\\))\"\nproof -\n obtain \\' \\' where p: \"\\ = mset \\'\" \"\\ = mset \\'\" by (metis ex_mset)\n with s have sl: \"\\ mset \\' \\ mset \\'\" by simp\n let ?d = \"sum_mset (image_mset size (\\+\\))\"\n have d: \"?d = sum_list (map size (\\'@\\'))\"\n unfolding p by (metis mset_append mset_map sum_mset_sum_list)\n have \"mset \\' \\ mset \\' \\ ?d\"\n proof cases\n assume \"sc \\' [] \\' [] = {}\"\n from sc_sim_depth[OF this] show \"mset \\' \\ mset \\' \\ ?d\" unfolding d by auto\n next\n assume \"sc \\' [] \\' [] \\ {}\"\n with SC_counterexample have \"\\ \\ mset \\' \\ mset \\'\" by fastforce\n moreover note s[unfolded p]\n ultimately have False ..\n thus \"mset \\' \\ mset \\' \\ ?d\" ..\n qed\n thus ?thesis unfolding p .\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Propositional_Proof_Systems/SC_Depth_Limit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5, "lm_q1q2_score": 0.29065154532215665}} {"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System *)\n(* File: utp_circus_tutorial_ex.thy *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK) *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk *)\n(******************************************************************************)\n\nsection {* {\\Circus} Tutorial *}\n\ntheory utp_circus_tutorial_ex\nimports \"../theories/utp_circus\" Transitive_Closure\nbegin recall_syntax\n\nsubsection {* Preliminaries *}\n\nno_translations\n \"a \\<^bold>\\ P\" == \"CONST PrefixCSP \\a\\ P\"\n\ntranslations\n \"a \\<^bold>\\ P\" == \"CONST PrefixCSP \\a()\\ P\"\n\ntext \\Hints for the tutorial exercise.\\\n\nconsts COMPLETE :: \"'a\" (\"\\<^bold>C\\<^bold>O\\<^bold>M\\<^bold>P\\<^bold>L\\<^bold>E\\<^bold>T\\<^bold>E\")\n\nparagraph \\Additional proof support\\\n\ndeclare list_concat_minus_list_concat [simp]\n\nlemma list_Cons_minus [simp]:\n\"(x # y) - (x # z) = y - z\"\n by (simp add: minus_list_def)\n\nsubsection {* Time Types *}\n\ntext \\Below we define synonyms for the types \\TIME\\ and \\PERIOD\\.\\\n\ntype_synonym TIME = \"nat\"\ntype_synonym PERIOD = \"nat\"\n\nsubsection {* Channel Declarations *}\n\ndatatype timer_evt =\n setT \"TIME\" |\n updateSS \"PERIOD\" |\n step \"TIME \\ PERIOD\" |\n endc \"unit\"\n\nabbreviation timer_prefix ::\n \"('a, timer_evt) chan \\\n ('a, timer_evt + 'ext) chan\" where\n\"timer_prefix c \\ Inl o c\"\n\nnotation timer_prefix (\"tm:_\" [1000] 1000)\n\nabbreviation \"tm_events \\\n \\(tm:setT) \\ \\(tm:updateSS) \\ \\(tm:step) \\ \\(tm:endc)\"\n\nsubsection {* Process Definition *}\n\nalphabet timer_state =\n currentTime :: \"TIME\"\n stepSize :: \"PERIOD\"\n\ntype_synonym timer_action =\n \"(timer_state, timer_evt) action\"\n\ndefinition [rdes]:\n\"process Timer(ct::TIME, hc::PERIOD, tN::TIME) \\ begin\n state(timer_state)\n Step = (\n (tm:setT?(t : \\t \\ tN\\) \\<^bold>\\ currentTime :=\\<^sub>C \\t\\) \\\n (tm:updateSS?(ss) \\<^bold>\\ stepSize :=\\<^sub>C \\ss\\) \\\n \\<^bold>C\\<^bold>O\\<^bold>M\\<^bold>P\\<^bold>L\\<^bold>E\\<^bold>T\\<^bold>E) ;; Step\n \\ \\<^bold>C\\<^bold>O\\<^bold>M\\<^bold>P\\<^bold>L\\<^bold>E\\<^bold>T\\<^bold>E\nend\"\n\ntext \\The same process definition using deep variables.\\\n\ndefinition [rdes]:\n\"process DvarTimer(ct::TIME, hc::PERIOD, tN::TIME) \\ begin\n state(vstore)\n Step = (\n (tm:setT?(t : \\t \\ tN\\) \\<^bold>\\ :=\\<^sub>C \\t\\) \\\n (tm:updateSS?(ss) \\<^bold>\\ :=\\<^sub>C \\ss\\) \\\n (tm:step!(&)!(&) \\<^bold>\\\n :=\\<^sub>C min\\<^sub>u(& + &, \\tN\\)) \\\n (& =\\<^sub>u \\tN\\) &\\<^sub>u tm:endc \\<^bold>\\ Stop) ;; Step\n \\ (, ) :=\\<^sub>C (\\ct\\, \\hc\\) ;; Step\nend\"\n\ntext \\Proof that the @{const Timer} process does not diverge.\\\n\nlemma \"pre\\<^sub>R(Timer(ct, hc, tN)) = true\\<^sub>r\"\n-- \\TODO: try to complete this prove using the @{method rdes_calc} tactic.\\\noops\n\ntext \\Proof about the initial refusal set of the @{const Timer} process.\\\n\ntext \\\n Simplified encoding of the @{const Timer} process action. The simplification\n does not consider hiding of the state in the process semantics and neither\n uses the extensible event type. The @{const setT} communication is slightly\n more restrictive, requiring \\t < tN\\ rather than \\t \\ tN\\.\n\\\n\ndefinition StepBody :: \"TIME \\ timer_action\" where\n\"StepBody tN =\n (setT?(t : \\t\\ <\\<^sub>u \\tN\\) \\<^bold>\\ currentTime :=\\<^sub>C \\t\\) \\\n (updateSS?(ss) \\<^bold>\\ stepSize :=\\<^sub>C \\ss\\) \\\n (step!(¤tTime)!(&stepSize) \\<^bold>\\\n currentTime :=\\<^sub>C min\\<^sub>u(¤tTime + &stepSize, \\tN\\)) \\\n (¤tTime =\\<^sub>u \\tN\\) &\\<^sub>u endc \\<^bold>\\ Stop\"\n\nfun MainAction :: \"(TIME \\ PERIOD \\ TIME) \\ timer_action\" where\n\"MainAction (ct, hc, tN) =\n (currentTime, stepSize) :=\\<^sub>C (\\ct\\, \\hc\\) ;; (\\\\<^sub>C Step \\ StepBody(tN) ;; Step)\"\n\ntext \\Additional lemma needed for the proof below.\\\n\nlemma wpR_assign [wp]:\n assumes \"P is NCSP\"\n shows \"($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S) wp\\<^sub>R pre\\<^sub>R P = \\\\\\\\<^sub>S\\<^sub>\\ \\ pre\\<^sub>R(P)\"\napply (simp add: wpR_def unrest rdes assms rea_not_not closure usubst)\ndone\n\ntext \\Communications on @{const setT} are initially not refused.\\\n\nlemma StepBody_muI:\n\"[true \\ \\<^bold>\\ t \\ \\t\\ <\\<^sub>u \\tN\\ \\ \\trace\\ =\\<^sub>u \\\\ \\ (setT\\\\t\\)\\<^sub>u \\\\<^sub>u \\refs\\ | false]\\<^sub>C\n \\ (\\\\<^sub>C X \\ StepBody tN ;; X)\"\napply (unfold StepBody_def)\napply (rule CRD_mu_basic_refine)\n-- \\TODO: Can you finalise the rest of the proof?\\\n-- {* Subgoal 1 *}\n-- {* Subgoal 2 *}\n-- {* Subgoal 3 *}\n-- {* Subgoal 4 *}\n-- {* Subgoal 5 *}\noops\n\ntext \\@{const setT} is only enabled when \\t < tN\\.\\\n\nlemma StepBody_muI2:\n\"[true \\ \\<^bold>\\ t \\ \\trace\\ =\\<^sub>u \\(setT\\\\t\\)\\<^sub>u\\ \\ \\t\\ <\\<^sub>u \\tN\\ | false]\\<^sub>C\n \\ (\\\\<^sub>C X \\ StepBody tN ;; X)\"\napply (unfold StepBody_def)\napply (rule CRD_mu_basic_refine)\n-- {* Subgoal 1 *}\napply (simp add: closure unrest alpha)\n-- {* Subgoal 2 *}\napply (simp add: closure unrest alpha)\n-- {* Subgoal 3 *}\napply (rdes_calc)\n-- {* Subgoal 4 *}\napply (rdes_calc)\napply (rel_simp)\n-- {* Subgoal 5 *}\napply (rdes_calc)\napply (rel_auto)\ndone\n\nlemma StepBody_muI3:\n\"[true \\ \\<^bold>\\ (ct, ss) \\ \\ct\\ <\\<^sub>u \\tN\\ \\\n \\trace\\ =\\<^sub>u \\(setT\\\\ct\\)\\<^sub>u, (updateSS\\\\ss\\)\\<^sub>u\\ \\ (step\\\\(ct, ss)\\)\\<^sub>u \\\\<^sub>u \\refs\\\n | false]\\<^sub>C\n \\ (\\\\<^sub>C X \\ StepBody tN ;; X)\"\napply (unfold StepBody_def)\napply (rule CRD_mu_basic_refine)\n-- {* Subgoal 1 *}\napply (simp add: closure unrest alpha)\n-- {* Subgoal 2 *}\napply (simp add: closure unrest alpha)\n-- {* Subgoal 3 *}\napply (rdes_calc)\n-- {* Subgoal 4 *}\napply (rdes_calc)\napply (rel_simp)\n-- {* Subgoal 5 *}\napply (rdes_calc)\napply (rel_simp)\napply (erule prefixE)\napply (auto)\noops\n\ntext \\A simpler version of \\Timer\\ with fewer communications and no recursion.\\\n\ndefinition [rdes]:\n\"process SimpleTimer(ct::TIME, hc::PERIOD, tN::TIME) \\ begin\n state(timer_state)\n Step = (\n (step!(¤tTime)!(&stepSize) \\<^bold>\\\n currentTime :=\\<^sub>C min\\<^sub>u(¤tTime + &stepSize, \\tN\\)) \\\n (¤tTime =\\<^sub>u \\tN\\) &\\<^sub>u endc \\<^bold>\\ Stop)\n \\ (currentTime, stepSize) :=\\<^sub>C (\\ct\\, \\hc\\) ;; Step\nend\"\n\nlemma\n\"SimpleTimer(ct, hc, tN) \\ step!(\\ct\\)!(\\hc\\) \\<^bold>\\ Skip\"\napply (unfold SimpleTimer_def)\napply (unfold circus_syntax)\napply (simp add: Let_def)\napply (rule_tac SRD_refine_intro)\n-- {* Subgoal 1 *}\napply (simp add: closure)\n-- {* Subgoal 2 *}\napply (simp add: closure)\n-- {* Subgoal 3 *}\napply (rdes_calc)\napply (rel_simp)\n-- {* Subgoal 4 *}\napply (rdes_calc)\napply (rel_simp)\napply (erule_tac Q = \"endc () \\ ref\\<^sub>v\" in contrapos_pp)\napply (simp) defer\n-- {* Subgoal 4 *}\napply (rdes_calc)\napply (rel_simp)\noops\n\nmethod rdes_refine_auto =\n (rule_tac SRD_refine_intro;\n (simp add: closure rdes unrest usubst; (rdes_calc, rel_auto?)))\n\nlemma\n\"ct < tN \\ SimpleTimer(ct, hc, tN) \\ step!(\\ct\\)!(\\hc\\) \\<^bold>\\ Skip\"\napply (unfold SimpleTimer_def)\napply (unfold circus_syntax)\napply (simp add: Let_def)\napply (rdes_refine_auto)\ndone\n\ntext \\Simpler version of the Timer communicating only on channel @{const step}.\\\n\ndefinition [rdes]: -- \\@{const Timer} with only @{const step} recursion\\\n\"process SimpleTimer2(ct::TIME, hc::PERIOD, tN::TIME) \\ begin\n state(timer_state)\n Step = (step!(¤tTime)!(&stepSize) \\<^bold>\\\n currentTime :=\\<^sub>C min\\<^sub>u(¤tTime + &stepSize, \\tN\\)) ;; Step\n \\ (currentTime, stepSize) :=\\<^sub>C (\\ct\\, \\hc\\) ;; Step\nend\"\n\ntext \\Let us try proving something about @{const step} events.\\\n\nlemma \"`peri\\<^sub>R(SimpleTimer2(ct, hc, tN)) \\ $tr =\\<^sub>u $tr\\ \\ \\step(ct, hc)\\ \\\\<^sub>u $ref\\`\"\napply (rdes_calc)\napply (rel_simp)\napply (erule_tac Q = \"step (ct, hc) \\ ref\\<^sub>v\" in contrapos_pp; simp)\napply (subgoal_tac \"currentTime\\<^sub>v' = ct \\ stepSize\\<^sub>v' = hc\")\n-- {* Subgoal 1 *}\napply (clarsimp)\n-- {* Subgoal 2 *}\napply (thin_tac \"\\ step (currentTime\\<^sub>v', stepSize\\<^sub>v') \\ ref\\<^sub>v\")\napply (rename_tac n)\napply (case_tac \"n = 0\")\n-- {* Subgoal 2.1 *}\napply (clarsimp)\n-- {* Subgoal 2.2 *}\napply (clarify)\napply (erule contrapos_pp; simp)\n-- \\@{command sledgehammer}\\\n-- \\We need additional lemmas here to make progress..!\\\noops\n\nlemma nat_one_induct:\n\"0 < n \\ (P 1 \\ (\\n. P n \\ P (Suc n)) \\ P n)\"\napply (induction n)\napply (simp_all)\napply (blast)\ndone\n\nlemma tr_in_relpow_grows:\n\"0 < n \\\n (\\ok1 ok2 wait1 wait2 (tr1::'\\ list) (tr2::'\\ list) (st1::'\\) (st2::'\\)\n (ref1::'\\ set) (ref2::'\\ set).\n (\\ok\\<^sub>v = ok1, wait\\<^sub>v = wait1, tr\\<^sub>v = tr1, st\\<^sub>v = st1, ref\\<^sub>v = ref1\\,\n \\ok\\<^sub>v = ok2, wait\\<^sub>v = wait2, tr\\<^sub>v = tr2, st\\<^sub>v = st2, ref\\<^sub>v = ref2\\) \\ r \\\n tr1 < tr2) \\\n (\\ok1 ok2 wait1 wait2 (tr1::'\\ list) (tr2::'\\ list) (st1::'\\) (st2::'\\)\n (ref1::'\\ set) (ref2::'\\ set).\n (\\ok\\<^sub>v = ok1, wait\\<^sub>v = wait1, tr\\<^sub>v = tr1, st\\<^sub>v = st1, ref\\<^sub>v = ref1\\,\n \\ok\\<^sub>v = ok2, wait\\<^sub>v = wait2, tr\\<^sub>v = tr2, st\\<^sub>v = st2, ref\\<^sub>v = ref2\\) \\ (r ^^ n)\n \\ tr1 < tr2)\"\napply (erule nat_one_induct)\napply (simp_all)\napply (clarsimp)\napply (case_tac y)\napply (case_tac more)\napply (case_tac morea)\napply (case_tac moreb)\napply (clarsimp)\nusing dual_order.strict_trans by (blast)\n\nlemma empty_trace_neq_relpowI [rule_format]:\n\"0 < n \\\n (\\ok1 ok2 wait1 wait2 (tr1::'\\ list) (tr2::'\\ list) (st1::'\\) (st2::'\\)\n (ref1::'\\ set) (ref2::'\\ set).\n (\\ok\\<^sub>v = ok1, wait\\<^sub>v = wait1, tr\\<^sub>v = tr1, st\\<^sub>v = st1, ref\\<^sub>v = ref1\\,\n \\ok\\<^sub>v = ok2, wait\\<^sub>v = wait2, tr\\<^sub>v = tr2, st\\<^sub>v = st2, ref\\<^sub>v = ref2\\) \\ r \\\n tr1 < tr2) \\\n (\\ok1 ok2 wait1 wait2 tr st1 st2 ref1 ref2.\n (\\ok\\<^sub>v = ok1, wait\\<^sub>v = wait1, tr\\<^sub>v = tr, st\\<^sub>v = st1, ref\\<^sub>v = ref1\\,\n \\ok\\<^sub>v = ok2, wait\\<^sub>v = wait2, tr\\<^sub>v = tr, st\\<^sub>v = st2, ref\\<^sub>v = ref2\\) \\ (r ^^ n))\"\napply (drule_tac tr_in_relpow_grows)\napply (assumption)\napply (clarsimp)\napply (subgoal_tac \"tr < tr\")\napply (clarsimp)\napply (blast)\ndone\n\ntext \\Let us try again with those two lemmas above.\\\n\nlemma \"`peri\\<^sub>R(SimpleTimer2(ct, hc, tN)) \\ $tr =\\<^sub>u $tr\\ \\ \\step(ct, hc)\\ \\\\<^sub>u $ref\\`\"\napply (rdes_calc)\napply (rel_simp)\napply (erule_tac Q = \"step (ct, hc) \\ ref\\<^sub>v\" in contrapos_pp; simp)\napply (subgoal_tac \"currentTime\\<^sub>v' = ct \\ stepSize\\<^sub>v' = hc\")\n-- {* Subgoal 1 *}\napply (clarsimp)\n-- {* Subgoal 2 *}\napply (thin_tac \"\\ step (currentTime\\<^sub>v', stepSize\\<^sub>v') \\ ref\\<^sub>v\")\napply (rename_tac n)\napply (case_tac \"n = 0\")\n-- {* Subgoal 2.1 *}\napply (clarsimp)\n-- {* Subgoal 2.2 *}\napply (clarify)\napply (erule contrapos_pp; simp)\napply (erule empty_trace_neq_relpowI)\napply (clarsimp)\napply (simp add: Prefix_Order.strict_prefixI')\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/tutorial/utp_circus_tutorial_ex.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.2905029121828687}} {"text": "(* Title: HOL/Auth/Guard/Analz.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2001 University of Cambridge\n*)\n\nsection\\Decomposition of Analz into two parts\\\n\ntheory Analz imports Extensions begin\n\ntext\\decomposition of \\<^term>\\analz\\ into two parts: \n \\<^term>\\pparts\\ (for pairs) and analz of \\<^term>\\kparts\\\\\n\nsubsection\\messages that do not contribute to analz\\\n\ninductive_set\n pparts :: \"msg set => msg set\"\n for H :: \"msg set\"\nwhere\n Inj [intro]: \"[| X \\ H; is_MPair X |] ==> X \\ pparts H\"\n| Fst [dest]: \"[| \\X,Y\\ \\ pparts H; is_MPair X |] ==> X \\ pparts H\"\n| Snd [dest]: \"[| \\X,Y\\ \\ pparts H; is_MPair Y |] ==> Y \\ pparts H\"\n\nsubsection\\basic facts about \\<^term>\\pparts\\\\\n\nlemma pparts_is_MPair [dest]: \"X \\ pparts H \\ is_MPair X\"\nby (erule pparts.induct, auto)\n\nlemma Crypt_notin_pparts [iff]: \"Crypt K X \\ pparts H\"\nby auto\n\nlemma Key_notin_pparts [iff]: \"Key K \\ pparts H\"\nby auto\n\nlemma Nonce_notin_pparts [iff]: \"Nonce n \\ pparts H\"\nby auto\n\nlemma Number_notin_pparts [iff]: \"Number n \\ pparts H\"\nby auto\n\nlemma Agent_notin_pparts [iff]: \"Agent A \\ pparts H\"\nby auto\n\nlemma pparts_empty [iff]: \"pparts {} = {}\"\nby (auto, erule pparts.induct, auto)\n\nlemma pparts_insertI [intro]: \"X \\ pparts H \\ X \\ pparts (insert Y H)\"\nby (erule pparts.induct, auto)\n\nlemma pparts_sub: \"[| X \\ pparts G; G \\ H |] ==> X \\ pparts H\"\nby (erule pparts.induct, auto)\n\nlemma pparts_insert2 [iff]: \"pparts (insert X (insert Y H))\n= pparts {X} Un pparts {Y} Un pparts H\"\nby (rule eq, (erule pparts.induct, auto)+)\n\nlemma pparts_insert_MPair [iff]: \"pparts (insert \\X,Y\\ H)\n= insert \\X,Y\\ (pparts ({X,Y} \\ H))\"\napply (rule eq, (erule pparts.induct, auto)+)\napply (rule_tac Y=Y in pparts.Fst, auto)\napply (erule pparts.induct, auto)\nby (rule_tac X=X in pparts.Snd, auto)\n\nlemma pparts_insert_Nonce [iff]: \"pparts (insert (Nonce n) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Crypt [iff]: \"pparts (insert (Crypt K X) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Key [iff]: \"pparts (insert (Key K) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Agent [iff]: \"pparts (insert (Agent A) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Number [iff]: \"pparts (insert (Number n) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Hash [iff]: \"pparts (insert (Hash X) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert: \"X \\ pparts (insert Y H) \\ X \\ pparts {Y} \\ pparts H\"\nby (erule pparts.induct, blast+)\n\nlemma insert_pparts: \"X \\ pparts {Y} \\ pparts H \\ X \\ pparts (insert Y H)\"\nby (safe, erule pparts.induct, auto)\n\nlemma pparts_Un [iff]: \"pparts (G \\ H) = pparts G \\ pparts H\"\nby (rule eq, erule pparts.induct, auto dest: pparts_sub)\n\nlemma pparts_pparts [iff]: \"pparts (pparts H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_eq: \"pparts (insert X H) = pparts {X} Un pparts H\"\nby (rule_tac A=H in insert_Un, rule pparts_Un)\n\nlemmas pparts_insert_substI = pparts_insert_eq [THEN ssubst]\n\nlemma in_pparts: \"Y \\ pparts H \\ \\X. X \\ H \\ Y \\ pparts {X}\"\nby (erule pparts.induct, auto)\n\nsubsection\\facts about \\<^term>\\pparts\\ and \\<^term>\\parts\\\\\n\nlemma pparts_no_Nonce [dest]: \"[| X \\ pparts {Y}; Nonce n \\ parts {Y} |]\n==> Nonce n \\ parts {X}\"\nby (erule pparts.induct, simp_all)\n\nsubsection\\facts about \\<^term>\\pparts\\ and \\<^term>\\analz\\\\\n\nlemma pparts_analz: \"X \\ pparts H \\ X \\ analz H\"\nby (erule pparts.induct, auto)\n\nlemma pparts_analz_sub: \"[| X \\ pparts G; G \\ H |] ==> X \\ analz H\"\nby (auto dest: pparts_sub pparts_analz)\n\nsubsection\\messages that contribute to analz\\\n\ninductive_set\n kparts :: \"msg set => msg set\"\n for H :: \"msg set\"\nwhere\n Inj [intro]: \"[| X \\ H; not_MPair X |] ==> X \\ kparts H\"\n| Fst [intro]: \"[| \\X,Y\\ \\ pparts H; not_MPair X |] ==> X \\ kparts H\"\n| Snd [intro]: \"[| \\X,Y\\ \\ pparts H; not_MPair Y |] ==> Y \\ kparts H\"\n\nsubsection\\basic facts about \\<^term>\\kparts\\\\\n\nlemma kparts_not_MPair [dest]: \"X \\ kparts H \\ not_MPair X\"\nby (erule kparts.induct, auto)\n\nlemma kparts_empty [iff]: \"kparts {} = {}\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insertI [intro]: \"X \\ kparts H \\ X \\ kparts (insert Y H)\"\nby (erule kparts.induct, auto dest: pparts_insertI)\n\nlemma kparts_insert2 [iff]: \"kparts (insert X (insert Y H))\n= kparts {X} \\ kparts {Y} \\ kparts H\"\nby (rule eq, (erule kparts.induct, auto)+)\n\nlemma kparts_insert_MPair [iff]: \"kparts (insert \\X,Y\\ H)\n= kparts ({X,Y} \\ H)\"\nby (rule eq, (erule kparts.induct, auto)+)\n\nlemma kparts_insert_Nonce [iff]: \"kparts (insert (Nonce n) H)\n= insert (Nonce n) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Crypt [iff]: \"kparts (insert (Crypt K X) H)\n= insert (Crypt K X) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Key [iff]: \"kparts (insert (Key K) H)\n= insert (Key K) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Agent [iff]: \"kparts (insert (Agent A) H)\n= insert (Agent A) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Number [iff]: \"kparts (insert (Number n) H)\n= insert (Number n) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Hash [iff]: \"kparts (insert (Hash X) H)\n= insert (Hash X) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert: \"X \\ kparts (insert X H) \\ X \\ kparts {X} \\ kparts H\"\nby (erule kparts.induct, (blast dest: pparts_insert)+)\n\nlemma kparts_insert_fst [rule_format,dest]: \"X \\ kparts (insert Z H) \\\nX \\ kparts H \\ X \\ kparts {Z}\"\nby (erule kparts.induct, (blast dest: pparts_insert)+)\n\nlemma kparts_sub: \"[| X \\ kparts G; G \\ H |] ==> X \\ kparts H\"\nby (erule kparts.induct, auto dest: pparts_sub)\n\nlemma kparts_Un [iff]: \"kparts (G \\ H) = kparts G \\ kparts H\"\nby (rule eq, erule kparts.induct, auto dest: kparts_sub)\n\nlemma pparts_kparts [iff]: \"pparts (kparts H) = {}\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma kparts_kparts [iff]: \"kparts (kparts H) = kparts H\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_eq: \"kparts (insert X H) = kparts {X} \\ kparts H\"\nby (rule_tac A=H in insert_Un, rule kparts_Un)\n\nlemmas kparts_insert_substI = kparts_insert_eq [THEN ssubst]\n\nlemma in_kparts: \"Y \\ kparts H \\ \\X. X \\ H \\ Y \\ kparts {X}\"\nby (erule kparts.induct, auto dest: in_pparts)\n\nlemma kparts_has_no_pair [iff]: \"has_no_pair (kparts H)\"\nby auto\n\nsubsection\\facts about \\<^term>\\kparts\\ and \\<^term>\\parts\\\\\n\nlemma kparts_no_Nonce [dest]: \"[| X \\ kparts {Y}; Nonce n \\ parts {Y} |]\n==> Nonce n \\ parts {X}\"\nby (erule kparts.induct, auto)\n\nlemma kparts_parts: \"X \\ kparts H \\ X \\ parts H\"\nby (erule kparts.induct, auto dest: pparts_analz)\n\nlemma parts_kparts: \"X \\ parts (kparts H) \\ X \\ parts H\"\nby (erule parts.induct, auto dest: kparts_parts\nintro: parts.Fst parts.Snd parts.Body)\n\nlemma Crypt_kparts_Nonce_parts [dest]: \"[| Crypt K Y \\ kparts {Z};\nNonce n \\ parts {Y} |] ==> Nonce n \\ parts {Z}\"\nby auto\n\nsubsection\\facts about \\<^term>\\kparts\\ and \\<^term>\\analz\\\\\n\nlemma kparts_analz: \"X \\ kparts H \\ X \\ analz H\"\nby (erule kparts.induct, auto dest: pparts_analz)\n\nlemma kparts_analz_sub: \"[| X \\ kparts G; G \\ H |] ==> X \\ analz H\"\nby (erule kparts.induct, auto dest: pparts_analz_sub)\n\nlemma analz_kparts [rule_format,dest]: \"X \\ analz H \\\nY \\ kparts {X} \\ Y \\ analz H\"\nby (erule analz.induct, auto dest: kparts_analz_sub)\n\nlemma analz_kparts_analz: \"X \\ analz (kparts H) \\ X \\ analz H\"\nby (erule analz.induct, auto dest: kparts_analz)\n\nlemma analz_kparts_insert: \"X \\ analz (kparts (insert Z H)) \\ X \\ analz (kparts {Z} \\ kparts H)\"\nby (rule analz_sub, auto)\n\nlemma Nonce_kparts_synth [rule_format]: \"Y \\ synth (analz G)\n\\ Nonce n \\ kparts {Y} \\ Nonce n \\ analz G\"\nby (erule synth.induct, auto)\n\nlemma kparts_insert_synth: \"[| Y \\ parts (insert X G); X \\ synth (analz G);\nNonce n \\ kparts {Y}; Nonce n \\ analz G |] ==> Y \\ parts G\"\napply (drule parts_insert_substD, clarify)\napply (drule in_sub, drule_tac X=Y in parts_sub, simp)\napply (auto dest: Nonce_kparts_synth)\ndone\n\nlemma Crypt_insert_synth:\n \"[| Crypt K Y \\ parts (insert X G); X \\ synth (analz G); Nonce n \\ kparts {Y}; Nonce n \\ analz G |] \n ==> Crypt K Y \\ parts G\"\nby (metis Fake_parts_insert_in_Un Nonce_kparts_synth UnE analz_conj_parts synth_simps(5))\n\n\nsubsection\\analz is pparts + analz of kparts\\\n\nlemma analz_pparts_kparts: \"X \\ analz H \\ X \\ pparts H \\ X \\ analz (kparts H)\"\nby (erule analz.induct, auto) \n\nlemma analz_pparts_kparts_eq: \"analz H = pparts H Un analz (kparts H)\"\nby (rule eq, auto dest: analz_pparts_kparts pparts_analz analz_kparts_analz)\n\nlemmas analz_pparts_kparts_substI = analz_pparts_kparts_eq [THEN ssubst]\nlemmas analz_pparts_kparts_substD = analz_pparts_kparts_eq [THEN sym, THEN ssubst]\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Guard/Analz.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2904852897846908}} {"text": "(*by Lammich*)\nsection \\Imperative Interface\\\ntheory VEBT_Intf_Imperative\n imports \n VEBT_Definitions\n VEBT_Uniqueness\n VEBT_Member \n VEBT_Insert VEBT_InsertCorrectness \n VEBT_MinMax \n VEBT_Pred VEBT_Succ \n VEBT_Delete VEBT_DeleteCorrectness \n VEBT_Bounds\n VEBT_DeleteBounds\n VEBT_Space\n VEBT_Intf_Functional\n VEBT_List_Assn\n VEBT_BuildupMemImp \n VEBT_SuccPredImperative\n VEBT_DelImperative\nbegin\n\n subsection \\Code Export\\\n\n context begin \n interpretation VEBT_internal .\n \n lemmas [code] = replicatei.simps vebt_memberi.simps highi_def lowi_def vebt_inserti.simps\n minNulli.simps vebt_succi.simps vebt_predi.simps vebt_deletei.simps\n \n greater.simps \n \n end \n \n \n export_code \n vebt_buildupi\n vebt_memberi\n vebt_inserti\n vebt_maxti vebt_minti\n vebt_predi vebt_succi \n vebt_deletei\n \n checking SML_imp\n \n subsection \\Interface\\ \n \ndefinition vebt_assn::\"nat \\ nat set \\ VEBTi \\ assn\" where\n\"vebt_assn n s ti \\ \\\\<^sub>A t. vebt_assn_raw t ti * \\(s = set_vebt t \\ invar_vebt t n)\"\n \n \nsubsubsection \\Buildup\\\n\ncontext begin\n interpretation VEBT_internal .\n \n interpretation vebt_inst for n . \n\n\nlemma vebt_buildupi_rule_basic[sep_heap_rules]: \"n > 0 \\ vebt_buildupi n <\\ r. vebt_assn n {} r >\"\n unfolding vebt_assn_def \n apply(rule post_exI_rule[where x = \"vebt_buildup n\"])\n using builupicorr[of n] invar_vebt_buildup[of n] set_vebt_buildup[of n]\n apply simp\n done\n\nlemma vebt_buildupi_rule: \"<\\ (n > 0)> vebt_buildupi n <\\ r. vebt_assn n {} r > T[10 * 2^n]\" \n unfolding vebt_assn_def htt_def\n apply rule\n apply(rule post_exI_rule[where x = \"vebt_buildup n\"])\n using vebt_buildupi_rule[of n] invar_vebt_buildup[of n] set_vebt_buildup[of n] \n unfolding htt_def \n apply simp\n using TBOUND_buildupi[of n] unfolding TBOUND_def\n apply simp\n done\n\nsubsubsection \\Member\\\nlemma vebt_memberi_rule: \" vebt_memberi ti x <\\ r. vebt_assn n s ti * \\(r = (x \\ s))>T[5 + 5 * (nat \\lb n \\)]\"\n unfolding vebt_assn_def \n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF htt_vebt_memberi_invar_vebt])\n apply assumption\n apply simp\n apply (sep_auto simp: member_correct)\n apply simp\n done\n\n \nsubsubsection \\Insert\\ \nlemma vebt_inserti_rule: \"x < 2^n \\ vebt_inserti ti x <\\ r. vebt_assn n (s \\ {x}) r >T[13 + 13 * (nat \\lb n \\)]\"\n apply(sep_auto simp: norm_pre_pure_iff_htt)\n unfolding vebt_assn_def\n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF htt_vebt_inserti_invar_vebt])\n apply assumption\n apply simp\n apply sep_auto\n apply (auto simp add: insert_correct) \n apply (simp add: valid_insert_both_member_options_add set_vebt_def)\n apply (metis UnCI insert_correct)\n apply (metis UnE insert_correct singletonD)\n using valid_pres_insert by presburger\n\n\nsubsubsection \\Maximum\\ \nlemma vebt_maxti_rule: \" vebt_maxti ti <\\ r. vebt_assn n s ti * \\( r = Some y \\ max_in_set s y)>T[1]\"\n unfolding vebt_assn_def \n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF vebt_maxti_hT])\n apply(rule ent_refl)\n apply (sep_auto simp: set_vebt_maxt)\n by simp\n \nsubsubsection \\Minimum\\ \nlemma vebt_minti_rule: \" vebt_minti ti <\\ r. vebt_assn n s ti * \\( r = Some y \\ min_in_set s y)>T[1]\"\n unfolding vebt_assn_def \n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF vebt_minti_hT])\n apply(rule ent_refl)\n apply (sep_auto simp: set_vebt_mint)\n by auto\n \n \nsubsubsection \\Successor\\ \nlemma vebt_succi_rule: \" vebt_succi ti x <\\ r. vebt_assn n s ti * \\( r = Some y \\ is_succ_in_set s x y)>T[7 + 7 * (nat \\lb n \\)]\"\n unfolding vebt_assn_def \n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF htt_vebt_succi])\n apply assumption\n apply simp\n apply (sep_auto simp: set_vebt_succ)\n apply simp\n done\n\nsubsubsection \\Predecessor\\ \nlemma vebt_predi_rule: \" vebt_predi ti x <\\ r. vebt_assn n s ti * \\( r = Some y \\ is_pred_in_set s x y)>T[7 + 7 * (nat \\lb n \\)]\"\n unfolding vebt_assn_def \n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF htt_vebt_predi])\n apply assumption\n apply simp\n apply (sep_auto simp: set_vebt_pred)\n apply simp\n done\n\nsubsubsection \\Delete\\ \nlemma vebt_deletei_rule: \" vebt_deletei ti x <\\ r. vebt_assn n (s - {x}) r >T[20 + 20 * (nat \\lb n \\)]\"\n unfolding vebt_assn_def\n apply(rule norm_pre_ex_rule_htt) \n apply(clarsimp simp: norm_pre_pure_iff_htt)\n apply(rule htt_cons_rule[OF htt_vebt_deletei])\n apply assumption\n apply simp\n apply sep_auto\n apply (auto simp add: set_vebt_delete invar_vebt_delete) \n done\n\nsubsection \\Setup of VCG\\ \nlemmas vebt_heap_rules[THEN htt_htD,sep_heap_rules] = \n vebt_buildupi_rule\n vebt_memberi_rule\n vebt_inserti_rule\n vebt_maxti_rule\n vebt_minti_rule\n vebt_succi_rule\n vebt_predi_rule\n vebt_deletei_rule\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Van_Emde_Boas_Trees/VEBT_Intf_Imperative.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2904324311152722}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | July 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2009-2 |\n | October 2010 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Domain_T_cms\nimports Domain_T CSP.RS\nbegin\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(**********************************************************\n Definitions (Restriction in domT)\n **********************************************************)\n\n(*\ninstance domT :: (type) ms0\nby (intro_classes)\n*)\n\ndefinition\n restT :: \"'a domT => nat => 'a trace set\" (\"_ restT _\" [84,900] 84)\n where\n restT_def : \"T restT n == {s. s :t T & (lengtht s) <= n}\"\n\n(* (\"_ restT _\" [55,56] 55) in Isabelle 2005 *)\n\ndefinition\n LimitT :: \"'a domT infinite_seq => 'a trace set\"\n where\n LimitT_def : \"LimitT Ts == {s. s :t Ts (lengtht s)}\"\n \ndefinition \n Limit_domT :: \"'a domT infinite_seq => 'a domT\"\n where\n Limit_domT_def : \"Limit_domT Ts == Abs_domT (LimitT Ts)\"\n\n(* isabelle 2009-2 *)\n\ninstantiation domT :: (type) rs0\nbegin\n\ndefinition\n rest_domT_def : \"T .|. n == Abs_domT (T restT n)\"\n\n instance ..\n\nend\n\n(* isabelle 2009-1\ndefs (overloaded)\n rest_domT_def : \"T .|. n == Abs_domT (T restT n)\"\n*)\n\n\n\n(**********************************************************\n Lemmas (Restriction in Dom_T)\n **********************************************************)\n\n(*** restT_def in domT ***)\n\nlemma restT_in[simp] : \"T restT n : domT\"\napply (simp add: restT_def)\napply (simp add: domT_def HC_T1_def)\napply (rule conjI)\napply (rule_tac x=\"<>\" in exI, simp)\n\napply (simp add: prefix_closed_def)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (rule conjI)\napply (rule memT_prefix_closed, simp_all)\n\napply (subgoal_tac \"lengtht s <= lengtht t\", simp)\napply (rule length_of_prefix)\napply (simp)\ndone\n\n(*** restT in domT ***)\n\nlemmas restT_def_in = restT_in[simplified memT_def restT_def]\n\n(*********************************************************\n .|. on dom_T\n *********************************************************)\n\nlemma rest_domT_iff: \"T .|. n = {s. s :t T & lengtht s <= n}t\"\napply (simp add: rest_domT_def)\napply (simp add: restT_in[simplified restT_def] Abs_domT_inject)\napply (simp add: restT_def)\ndone\n\nlemma in_rest_domT: \"s :t T .|. n = (s :t T & lengtht s <= n)\"\napply (simp add: memT_def rest_domT_def)\napply (simp add: Abs_domT_inverse)\napply (simp add: memT_def restT_def)\ndone\n\nlemma rest_domT_eq_iff:\n \"(T .|. n = S .|. m) =\n (ALL s. (s :t T & lengtht s <= n) = (s :t S & lengtht s <= m))\"\napply (simp add: rest_domT_def Abs_domT_inject)\napply (simp add: restT_def)\nby (auto)\n\n(*********************************************************\n Dom_T --> RS\n *********************************************************)\n\n(*******************************\n zero_eq_rs_domT\n *******************************)\n\n(*** restT 0 ***)\n\nlemma zero_domT: \"T restT 0 = {<>}\"\napply (simp add: restT_def)\napply (rule order_antisym)\n\napply (rule subsetI)\napply (simp)\napply (erule conjE)\napply (simp add: lengtht_zero)\nby (simp)\n\n(*** zero_eq_rs_domT ***)\n\nlemma zero_rs_domT: \"T .|. 0 = {<>}t\"\napply (simp add: rest_domT_def)\napply (simp add: Abs_domT_inject)\napply (simp add: zero_domT)\ndone\n\nlemma zero_eq_rs_domT: \"(T::'a domT) .|. 0 = S .|. 0\"\napply (simp add: zero_rs_domT)\ndone\n\n(*******************************\n min_rs_domT\n *******************************)\n\nlemma min_rs_domT: \"((T::'a domT) .|. m) .|. n = T .|. (min m n)\"\napply (simp add: rest_domT_def)\napply (simp add: Abs_domT_inject)\n\napply (simp add: restT_def memT_def)\napply (simp add: restT_in[simplified memT_def restT_def]\n Abs_domT_inverse)\ndone\n\n(*******************************\n diff_rs_domT\n *******************************)\n\n(*** contra = ***)\n\nlemma contra_diff_rs_domT: \n \"(ALL n. (T::'a domT) .|. n = S .|. n) ==> T = S\"\napply (simp add: rest_domT_eq_iff)\napply (rule order_antisym)\nby (auto)\n\n(*** diff_rs_domT ***)\n\nlemma diff_rs_domT: \n \"(T::'a domT) ~= S ==> (EX n. T .|. n ~= S .|. n)\"\napply (erule contrapos_pp)\napply (simp)\napply (rule contra_diff_rs_domT, simp)\ndone\n\n(***************************************************************\n domT ==> RS\n ***************************************************************)\n\ninstance domT :: (type) rs\napply (intro_classes)\napply (simp add: zero_eq_rs_domT)\napply (simp add: min_rs_domT)\napply (simp add: diff_rs_domT)\ndone\n\n(************************************************************\n domT ==> MS\n ************************************************************)\n\n\ninstantiation domT :: (type) ms0\nbegin\n\ndefinition\n domT_distance_def:\n \"distance (TT::('a domT * 'a domT)) = distance_rs TT\"\n instance ..\nend\n\ninstance domT :: (type) ms\napply (intro_classes)\napply (simp_all add: domT_distance_def)\napply (simp add: diagonal_rs)\napply (simp add: symmetry_rs)\napply (simp add: triangle_inequality_rs)\ndone\n\n(************************************************************\n i.e. domT ==> MS & RS \n ************************************************************)\n\ninstance domT :: (type) ms_rs\napply (intro_classes)\napply (simp add: domT_distance_def)\ndone\n\n(***********************************************************\n lemmas (Limit)\n ***********************************************************)\n\n(*** normal_seq lemma ***)\n\nlemma normal_seq_domT:\n \"[| normal Ts ; lengtht s <= n |]\n ==> (s :t Ts (lengtht s)) = (s :t Ts n)\"\napply (simp add: normal_def)\napply (drule_tac x=\"lengtht s\" in spec)\napply (drule_tac x=\"n\" in spec)\napply (simp add: min_is)\n\napply (simp add: to_distance_rs)\napply (simp add: distance_rs_le_1[THEN sym])\napply (simp add: rest_domT_eq_iff)\napply (drule_tac x=\"s\" in spec)\nby (simp)\n\nlemma normal_seq_domT_only_if:\n \"[| normal Ts ; lengtht s <= n ; s :t Ts (lengtht s) |]\n ==> s :t Ts n\"\nby (simp add: normal_seq_domT)\n\nlemma normal_seq_domT_if:\n \"[| normal Ts ; lengtht s <= n ; s :t Ts n |]\n ==> s :t Ts (lengtht s)\"\nby (simp add: normal_seq_domT)\n\n(*** LimitT_def in domT ***)\n\nlemma LimitT_in[simp]:\n \"normal (Ts::'a domT infinite_seq) ==> LimitT Ts : domT\"\napply (simp add: domT_def HC_T1_def)\napply (rule conjI)\n\napply (simp add: LimitT_def)\napply (rule_tac x=\"<>\" in exI)\napply (simp)\n\napply (simp add: prefix_closed_def LimitT_def)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (subgoal_tac \"lengtht s <= lengtht t\")\napply (rule normal_seq_domT_if)\napply (simp_all)\napply (rule memT_prefix_closed, simp_all)\napply (rule length_of_prefix)\napply (simp)\ndone\n\n(*** :t Limit_domT ***)\n\nlemma Limit_domT_memT: \n \"normal (Ts::'a domT infinite_seq)\n ==> (s :t Limit_domT Ts) = (s :t Ts (lengtht s))\"\napply (simp add: memT_def)\napply (simp add: Limit_domT_def)\napply (simp add: Abs_domT_inverse)\napply (simp add: LimitT_def memT_def)\ndone\n\n(*** Limit_domT lemma ***)\n\nlemma Limit_domT_Limit_lm:\n \"normal (Ts::'a domT infinite_seq)\n ==> (ALL n. (Limit_domT Ts) .|. n = (Ts n) .|. n)\"\napply (intro allI)\napply (simp add: rest_domT_eq_iff)\napply (simp add: Limit_domT_memT)\nby (auto simp add: normal_seq_domT)\n\n(*** (normal) Ts converges to (Limit_domT Ts) ***)\n\nlemma Limit_domT_Limit:\n \"normal (Ts::'a domT infinite_seq) ==> Ts convergeTo (Limit_domT Ts)\"\nby (simp add: to_distance_rs Limit_domT_Limit_lm rest_Limit)\n\n(*** (cauchy) Ts converges to (Limit_domT NF Ts) ***)\n\nlemma cauchy_Limit_domT_Limit:\n \"cauchy (Ts::'a domT infinite_seq) ==> Ts convergeTo (Limit_domT (NF Ts))\"\napply (simp add: normal_form_seq_same_Limit)\napply (simp add: Limit_domT_Limit normal_form_seq_normal)\ndone\n\n(***************************************\n Dom_T --> Complete Metric Space\n ***************************************)\n\nlemma domT_cms:\n \"cauchy (Ts::'a domT infinite_seq) ==> (EX T. Ts convergeTo T)\"\napply (rule_tac x=\"Limit_domT (NF Ts)\" in exI)\nby (simp add: cauchy_Limit_domT_Limit)\n\n(************************************************************\n domT ==> CMS and RS\n ************************************************************)\n\ninstance domT :: (type) cms\napply (intro_classes)\nby (simp add: domT_cms)\n\ninstance domT :: (type) cms_rs\nby (intro_classes)\n\n(*** (normal) Limit Ts = Limit_domT Ts ***)\n\nlemma Limit_domT_Limit_eq:\n \"normal (Ts::'a domT infinite_seq) ==> Limit Ts = Limit_domT Ts\"\napply (insert unique_convergence[of Ts \"Limit Ts\" \"Limit_domT Ts\"])\nby (simp add: Limit_domT_Limit Limit_is normal_cauchy)\n\n(*----------------------------------------------------------*\n | |\n | cms rs order |\n | |\n *----------------------------------------------------------*)\n\ninstance domT :: (type) ms_rs_order0\napply (intro_classes)\ndone\n\ninstance domT :: (type) ms_rs_order\napply (intro_classes)\napply (intro allI)\napply (rule iffI)\napply (simp add: rest_domT_def)\napply (simp add: subdomT_def)\napply (simp add: Abs_domT_inverse)\napply (fold subdomT_def)\napply (rule)\napply (drule_tac x=\"lengtht t\" in spec)\napply (simp add: restT_def)\napply (force)\n\napply (intro allI)\napply (simp add: rest_domT_def)\napply (simp add: subdomT_def)\napply (simp add: Abs_domT_inverse)\napply (fold subdomT_def)\napply (rule)\napply (simp add: restT_def)\napply (force)\ndone\n\ninstance domT :: (type) cms_rs_order\nby (intro_classes)\n\n(*----------------------------------------------------------*\n | |\n | i.e. lemma \"continuous_rs (Ref_fun (S::'a domT))\" |\n | by (simp add: continuous_rs_Ref_fun) |\n | |\n | see RS.thy |\n | |\n *----------------------------------------------------------*)\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/Domain_T_cms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2904324311152722}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Bisim_Subst_SC\n imports Strong_Early_Bisim Strong_Late_Bisim_Subst_SC Strong_Early_Late_Comp\nbegin\n\n(******** Structural Congruence **********)\n\n(******** The \\-operator *****************)\n\nlemma resComm:\n fixes P :: pi\n \n shows \"<\\a><\\b>P \\\\<^sup>s\\<^sub>e <\\b><\\a>P\"\nproof -\n have \"<\\a><\\b>P \\\\<^sup>s\\<^sub>l <\\b><\\a>P\"\n by(rule Strong_Late_Bisim_Subst_SC.resComm)\n thus ?thesis by(rule lateEarlyCong) \nqed\n\n(******** The Match *********)\n\nlemma matchId:\n fixes a :: name\n and P :: pi\n\n shows \"[a\\a]P \\\\<^sup>s\\<^sub>e P\"\nproof -\n have \"[a\\a]P \\\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.matchId)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\n(******** Mismatch *********)\n\n\n\n(******** The +-operator *********)\n\nlemma sumSym:\n fixes P :: pi\n and Q :: pi\n \n shows \"P \\ Q \\\\<^sup>s\\<^sub>e Q \\ P\"\nproof -\n have \"P \\ Q \\\\<^sup>s\\<^sub>l Q \\ P\" by(rule Strong_Late_Bisim_Subst_SC.sumSym)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n\n\n(******** The |-operator *********)\n\nlemma parZero:\n fixes P :: pi\n\n shows \"P \\ \\ \\\\<^sup>s\\<^sub>e P\"\nproof -\n have \"P \\ \\ \\\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.parZero)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma parSym:\n fixes P :: pi\n and Q :: pi\n\n shows \"P \\ Q \\\\<^sup>s\\<^sub>e Q \\ P\"\nproof -\n have \"P \\ Q \\\\<^sup>s\\<^sub>l Q \\ P\" by(rule Strong_Late_Bisim_Subst_SC.parSym)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n assumes \"x \\ P\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>e P \\ <\\x>Q\"\nproof -\n from `x \\ P` have \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>l P \\ <\\x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma scopeExtPar':\n fixes P :: pi\n and Q :: pi\n and x :: name\n\n assumes xFreshQ: \"x \\ Q\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>e (<\\x>P) \\ Q\"\nproof -\n from `x \\ Q` have \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>l (<\\x>P) \\ Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar')\n thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n shows \"(P \\ Q) \\ R \\\\<^sup>s\\<^sub>e P \\ (Q \\ R)\"\nproof -\n have \"(P \\ Q) \\ R \\\\<^sup>s\\<^sub>l P \\ (Q \\ R)\" by(rule Strong_Late_Bisim_Subst_SC.parAssoc)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma freshRes:\n fixes P :: pi\n and a :: name\n\n assumes a \\ P\"\n\n shows \"<\\a>P \\\\<^sup>s\\<^sub>e P\"\nproof -\n from a \\ P` have \"<\\a>P \\\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.freshRes)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma scopeExtSum:\n fixes P :: pi\n and Q :: pi\n and x :: name\n \n assumes \"x \\ P\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>e P \\ <\\x>Q\"\nproof -\n from `x \\ P` have \"<\\x>(P \\ Q) \\\\<^sup>s\\<^sub>l P \\ <\\x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtSum)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma bangSC:\n fixes P\n\n shows \"!P \\\\<^sup>s\\<^sub>e P \\ !P\"\nproof -\n have \"!P \\\\<^sup>s\\<^sub>l P \\ !P\" by(rule Strong_Late_Bisim_Subst_SC.bangSC)\n thus ?thesis by(rule lateEarlyCong)\nqed\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Strong_Early_Bisim_Subst_SC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2903757914696488}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory BinarySearch\nimports \"AutoCorres.AutoCorres\" \"../../DataStructures\"\nbegin\n\nexternal_file \"binary_search.c\"\ninstall_C_file \"binary_search.c\"\n\nautocorres [ts_rules = nondet, unsigned_word_abs=binary_search] \"binary_search.c\"\n\ncontext binary_search begin\n\nlemma uint_of_nat:\n \"uint (of_nat x :: 'a::len word) = (int x) mod 2^ len_of TYPE('a)\"\n apply (clarsimp simp only: uint_nat unat_of_nat)\n apply (metis of_nat_numeral semiring_1_class.of_nat_power zmod_int)\n done\n\nlemma ptr_add_uint_of_nat [simp]:\n \"p +\\<^sub>p uint (of_nat x :: addr) = p +\\<^sub>p int x\"\n apply (subst uint_of_nat)\n apply (unfold CTypesDefs.ptr_add_def)\n apply (metis (hide_lams, no_types) uint_of_nat of_int_of_nat_eq of_int_uint)\n done\n\nlemmas [simp] = sint_ucast_eq_uint is_up is_down\n\n\nprimrec\n array :: \"lifted_globals \\ word32 ptr \\ word32 list \\ bool\"\nwhere\n \"array s p [] = True\"\n | \"array s p (x#xs) = ((heap_w32 s p = x) \\ (is_valid_w32 s p) \\ array s (p +\\<^sub>p 1) xs)\"\n\ndefinition\n \"is_array s p n \\ \\l. array s p l \\ length l = n\"\n\ndefinition\n \"the_array s p n \\ (THE l. length l = n \\ array s p l)\"\n\nlemma array_unique:\n \"\\ array s p l; array s p l'; length l = length l' \\ \\ l = l'\"\n apply (induct l arbitrary: l' p)\n apply clarsimp\n apply (case_tac l')\n apply clarsimp\n apply clarsimp\n done\n\nlemma array_concat [simp]:\n \"array s p (a @ b) = (array s p a \\ array s (p +\\<^sub>p int (length a)) b)\"\n apply (induct a arbitrary: p)\n apply clarsimp\n apply clarsimp\n apply atomize\n apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps)\n done\n\nlemma array_is_array: \"array s p a \\ is_array s p (length a)\"\n apply (clarsimp simp: is_array_def)\n apply force\n done\n\nlemma array_the_array: \"\\ array s p a; length a = n \\ \\ the_array s p n = a\"\n apply (simp add: the_array_def)\n apply (metis (lifting, mono_tags) array_unique the_equality)\n done\n\nlemma length_the_array [simp]: \"is_array s p n \\ length (the_array s p n) = n\"\n apply (induct n arbitrary: n)\n apply (clarsimp simp: is_array_def)\n apply (metis array_the_array)\n apply (clarsimp simp: is_array_def)\n done\n\nlemma the_array_Suc:\n \"\\ is_array s p n; n > 0 \\ \\ the_array s p n = (heap_w32 s p) # (the_array s (p +\\<^sub>p 1) (n - 1))\"\n apply (clarsimp simp: is_array_def)\n apply (case_tac l)\n apply clarsimp\n apply clarsimp\n apply (metis One_nat_def Suc_eq_plus1 list.size(4) array.simps(2) array_the_array)\n done\n\nlemma the_array_0 [simp]:\n \"the_array s p 0 = []\"\n by (metis list.size(3) array.simps(1) array_the_array)\n\nlemma is_array_0 [simp]:\n \"is_array s p 0\"\n apply (clarsimp simp: is_array_def)\n done\n\nlemma is_array_Suc:\n \"\\ is_array s p n; is_valid_w32 s (p +\\<^sub>p int n) \\ \\\n is_array s p (Suc n)\"\n apply (clarsimp simp: is_array_def)\n apply (rule_tac x=\"l @ [heap_w32 s (p +\\<^sub>p int (length l))]\" in exI)\n apply clarsimp\n done\n\nlemma array_expand: \"array s p n \\ array s (p +\\<^sub>p 1) (tl n)\"\n apply (case_tac n)\n apply clarsimp\n apply clarsimp\n done\n\nlemma array_Ex:\n \"\\ array s p n; 0 \\ i; i < int (length n) \\ \\ is_valid_w32 s (p +\\<^sub>p i)\"\n apply (induct n arbitrary: p i)\n apply clarsimp\n apply clarsimp\n apply atomize\n apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n apply (erule_tac x=\"i - 1\" in allE)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n done\n\nlemma sorted_index_lt:\n \"\\ sorted xs; unat (xs ! m) < v; n \\ m; m < length xs \\ \\ unat (xs ! n) < v\"\n by (meson le_less_trans sorted_nth_mono unat_arith_simps(1))\n\nlemma sorted_index_gt:\n \"\\ sorted xs; v < unat (xs ! m); m \\ n; n < length xs \\ \\ v < unat (xs ! n)\"\n by (metis le_less_linear le_less_trans less_irrefl sorted_nth_mono word_less_nat_alt)\n\nlemma array_access_to_list_access:\n \"\\ array s p data; n < length data \\ \\ (heap_w32 s (p +\\<^sub>p int n)) = data ! n\"\n apply (induct data arbitrary: n p)\n apply clarsimp\n apply (case_tac \"n = 0\")\n apply clarsimp\n apply atomize\n apply (erule_tac x=\"n - 1\" in allE)\n apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n apply (erule impE)\n apply clarsimp\n apply (erule impE)\n apply clarsimp\n apply arith\n apply (clarsimp simp: field_simps CTypesDefs.ptr_add_def)\n done\n\nlemma binary_search_correct:\n \"\\ \\s. array s arr data \\ length data < 1000000000 \\ n = length data \\ sorted data \\\n binary_search' arr n v\n \\ \\r s. r \\ 0 \\ v \\ unat ` set data \\!\"\n apply (rule validNF_assume_pre)\n apply (unfold binary_search'_def)\n apply (case_tac \"n = 0\")\n apply (subst whileLoop_add_inv [where I=\"\\(f, l, r) _. f = 0 \\ l = 0 \\ r = 0\" and M=\"\\_. 0\"])\n apply ((wp | clarsimp)+)[1]\n apply (subst whileLoop_add_inv [where\n I=\"\\(found, l, r) s. array s arr data \\ (r \\ n)\n \\ (\\i. i < l \\ i < n \\ unat (data ! i) < v)\n \\ (\\i. i \\ r \\ i < n \\ v < unat (data ! i))\n \\ (found \\ 0 \\ v \\ unat ` set data)\"\n and M=\"\\((found, l, r), s). if found = 0 then 1 + (r - l) else 0\" ])\n apply wp\n apply (clarsimp split del: if_split cong: if_cong\n simp: field_simps array_access_to_list_access array_Ex UINT_MAX_def)\n apply (subgoal_tac \"aa \\ ((aa + b) div 2) \\ ((aa + b) div 2) \\ b\")\n apply (case_tac \"unat (data ! ((aa + b) div 2)) = v\")\n apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n apply (case_tac \"unat (data ! ((aa + b) div 2)) < v\")\n apply (auto elim: sorted_index_lt simp: UINT_MAX_def INT_MAX_def cong: if_cong)[1]\n apply (subgoal_tac \"unat (data ! ((aa + b) div 2)) > v\")\n apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n apply (fastforce elim: sorted_index_gt)\n apply force\n apply force\n apply (clarsimp split del: if_split simp: field_simps cong: if_cong)\n apply rule\n apply clarsimp\n apply clarsimp\n apply (metis (no_types) in_set_conv_nth le_less_trans neq_iff not_less)\n apply clarsimp\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/autocorres/tests/examples/BinarySearch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.29034436174122547}} {"text": "theory Bool_Kernel_Isabelle\nimports Postkernel_Isabelle \"splice/Splice\"\nbegin\n\ndeclare [[ML_environment=\"HOL4\"]]\nML \\Context_Var.bind_ref \"Bool_Kernel_Isabelle\"\\\n\ndeclare [[ML_environment=\"HOL4\"]]\n\ntext \\ Theory bool and Kernel intertwined, because of strange HOL4-bootstrap (Suspend etc...)\\\n\nsubsection \\bool\\\n\nML \\Holmake build_heap (make_modules [\"boolpp\", \"TexTokenMap\"]) \"HOL/src/bool\"\\\n\nML \\Context_Var.start_temp()\\\nML \\\nstructure Bool1 = struct\n(* bool Script part 1 (building up \"suspended\" (why the hell?) kernel primitives)*)\nlocal\nopen HolKernel Parse\nopen Unicode TexTokenMap\nin\n\nval _ = new_theory \"bool\";\n\n(*---------------------------------------------------------------------------*\n * BASIC DEFINITIONS *\n *---------------------------------------------------------------------------*)\n\n(* parsing/printing support for theory min *)\nval _ = unicode_version {u = UChar.imp, tmnm = \"==>\"}\nval _ = TeX_notation {hol = \"==>\", TeX = (\"\\\\HOLTokenImp{}\", 1)}\nval _ = TeX_notation {hol = UChar.imp, TeX = (\"\\\\HOLTokenImp{}\", 1)}\n\nval _ = TeX_notation {hol = \"\\\\\", TeX = (\"\\\\HOLTokenLambda{}\", 1)}\nval _ = TeX_notation {hol = UChar.lambda, TeX = (\"\\\\HOLTokenLambda{}\", 1)}\n\nval _ = TeX_notation {hol = \"@\", TeX = (\"\\\\HOLTokenHilbert{}\", 1)}\n\n(* iff *)\nval _ = overload_on (\"<=>\", “(=) : bool -> bool -> bool”)\nval _ = set_fixity \"<=>\" (Infix(NONASSOC, 100))\nval _ = unicode_version {u = UChar.iff, tmnm = \"<=>\"}\nval _ = TeX_notation {hol = \"<=>\", TeX = (\"\\\\HOLTokenEquiv{}\",3)}\nval _ = TeX_notation {hol = UChar.iff, TeX = (\"\\\\HOLTokenEquiv{}\",3)}\n\n(* records *)\nval _ = TeX_notation {hol = \"<|\", TeX = (\"\\\\HOLTokenLeftrec{}\", 2)}\nval _ = TeX_notation {hol = \"|>\", TeX = (\"\\\\HOLTokenRightrec{}\", 2)}\n\n(* case expressions *)\nval _ = TeX_notation {hol = \"case\", TeX = (\"\\\\HOLKeyword{case}\", 4)}\nval _ = TeX_notation {hol = \"of\", TeX = (\"\\\\HOLKeyword{of}\", 2)}\nval _ = TeX_notation {hol = \"=>\", TeX = (\"\\\\HOLTokenImp{}\", 1)}\n\n(* let expressions *)\nval _ = TeX_notation {hol = \"let\", TeX = (\"\\\\HOLKeyword{let}\", 3)}\nval _ = TeX_notation {hol = \"and\", TeX = (\"\\\\HOLKeyword{and}\", 2)}\nval _ = TeX_notation {hol = \"in\", TeX = (\"\\\\HOLKeyword{in}\", 2)}\n\n(* if statements *)\nval _ = TeX_notation {hol = \"if\", TeX = (\"\\\\HOLKeyword{if}\", 2)}\nval _ = TeX_notation {hol = \"then\", TeX = (\"\\\\HOLKeyword{then}\", 4)}\nval _ = TeX_notation {hol = \"else\", TeX = (\"\\\\HOLKeyword{else}\", 4)}\n\nval T_DEF =\n Definition.new_definition\n (\"T_DEF\", ``T = ((\\x:bool. x) = \\x:bool. x)``);\n\nval FORALL_DEF =\n Definition.new_definition\n (\"FORALL_DEF\", ``! = \\P:'a->bool. P = \\x. T``);\n\nval _ = set_fixity \"!\" Binder\nval _ = unicode_version {u = UChar.forall, tmnm = \"!\"};\nval _ = TeX_notation {hol = \"!\", TeX = (\"\\\\HOLTokenForall{}\",1)}\nval _ = TeX_notation {hol = UChar.forall, TeX = (\"\\\\HOLTokenForall{}\",1)}\n\nval EXISTS_DEF =\n Definition.new_definition\n (\"EXISTS_DEF\", ``? = \\P:'a->bool. P ($@ P)``);\n\nval _ = set_fixity \"?\" Binder\nval _ = unicode_version {u = UChar.exists, tmnm = \"?\"}\nval _ = TeX_notation {hol = \"?\", TeX = (\"\\\\HOLTokenExists{}\",1)}\nval _ = TeX_notation {hol = UChar.exists, TeX = (\"\\\\HOLTokenExists{}\",1)}\n\nval AND_DEF =\n Definition.new_definition\n (\"AND_DEF\", ``/\\ = \\t1 t2. !t. (t1 ==> t2 ==> t) ==> t``);\n\nval _ = set_fixity \"/\\\\\" (Infixr 400);\nval _ = unicode_version {u = UChar.conj, tmnm = \"/\\\\\"};\nval _ = TeX_notation {hol = \"/\\\\\", TeX = (\"\\\\HOLTokenConj{}\",1)}\nval _ = TeX_notation {hol = UChar.conj, TeX = (\"\\\\HOLTokenConj{}\",1)}\n\n\nval OR_DEF =\n Definition.new_definition\n (\"OR_DEF\", ``\\/ = \\t1 t2. !t. (t1 ==> t) ==> (t2 ==> t) ==> t``)\n\nval _ = set_fixity \"\\\\/\" (Infixr 300)\nval _ = unicode_version {u = UChar.disj, tmnm = \"\\\\/\"}\nval _ = TeX_notation {hol = \"\\\\/\", TeX = (\"\\\\HOLTokenDisj{}\",1)}\nval _ = TeX_notation {hol = UChar.disj, TeX = (\"\\\\HOLTokenDisj{}\",1)}\n\n\nval F_DEF =\n Definition.new_definition\n (\"F_DEF\", ``F = !t. t``);\n\nval NOT_DEF =\n Definition.new_definition\n (\"NOT_DEF\", ``~ = \\t. t ==> F``);\n\n(* now allows parsing of not equal *)\nval _ = overload_on (\"<>\", “\\x:'a y:'a. ~(x = y)”)\nval _ = set_fixity \"<>\" (Infix(NONASSOC, 450))\nval _ = TeX_notation {hol=\"<>\", TeX = (\"\\\\HOLTokenNotEqual{}\",1)}\n\nval _ = set_fixity UChar.neq (Infix(NONASSOC, 450))\nval _ = overload_on (UChar.neq, “\\x:'a y:'a. ~(x = y)”)\nval _ = TeX_notation {hol=UChar.neq, TeX = (\"\\\\HOLTokenNotEqual{}\",1)}\n\nval EXISTS_UNIQUE_DEF =\nDefinition.new_definition\n(\"EXISTS_UNIQUE_DEF\", ``?! = \\P:'a->bool.\n $? P /\\ !x y. P x /\\ P y ==> (x=y)``);\n\nval _ = set_fixity \"?!\" Binder\n\nval _ = unicode_version { u = UChar.exists ^ \"!\", tmnm = \"?!\"}\nval _ = TeX_notation {hol = \"?!\", TeX = (\"\\\\HOLTokenUnique{}\",2)}\nval _ = TeX_notation {hol = UChar.exists ^ \"!\", TeX = (\"\\\\HOLTokenUnique{}\",2)}\n\nval LET_DEF =\n Definition.new_definition\n (\"LET_DEF\", ``LET = \\(f:'a->'b) x. f x``);\n\nval COND_DEF =\n Definition.new_definition\n (\"COND_DEF\", ``COND = \\t t1 t2.\n @x:'a. ((t=T) ==> (x=t1)) /\\\n ((t=F) ==> (x=t2))``);\nval _ = overload_on (\"case\", ``COND``)\n\nval ONE_ONE_DEF =\n Definition.new_definition\n (\"ONE_ONE_DEF\", ``ONE_ONE = \\f:'a->'b. !x1 x2.\n (f x1 = f x2) ==> (x1 = x2)``);\n\nval ONTO_DEF =\n Definition.new_definition\n (\"ONTO_DEF\", ``ONTO = \\f:'a->'b. !y. ?x. y = f x``);\n\nval TYPE_DEFINITION =\n Definition.new_definition\n (\"TYPE_DEFINITION\",\n ``TYPE_DEFINITION = \\P:'a->bool. \\rep:'b->'a.\n (!x' x''. (rep x' = rep x'') ==> (x' = x'')) /\\\n (!x. P x = (?x'. x = rep x'))``);\n\n\n(*---------------------------------------------------------------------------*\n * Parsing directives for some of the basic operators. *\n *---------------------------------------------------------------------------*)\n\nlocal\nopen Portable\nin\nval _ = add_rule {term_name = \"~\",\n fixity = Prefix 900,\n pp_elements = [TOK \"~\"],\n paren_style = OnlyIfNecessary,\n block_style = (AroundEachPhrase, (CONSISTENT, 0))};\nval _ = unicode_version { u = UChar.neg, tmnm = \"~\"};\nval _ = TeX_notation {hol = \"~\", TeX = (\"\\\\HOLTokenNeg{}\",1)}\nval _ = TeX_notation {hol = UChar.neg, TeX = (\"\\\\HOLTokenNeg{}\",1)}\n\n(* prettyprinting information here for \"let\" and \"and\" is completely ignored;\n the pretty-printer handles these specially. These declarations are only\n for the parser's benefit. *)\nval _ = add_rule {\n pp_elements = [TOK \"let\",\n ListForm {\n separator = [TOK \";\"],\n cons = GrammarSpecials.letcons_special,\n nilstr = GrammarSpecials.letnil_special,\n block_info = (INCONSISTENT, 0)\n },\n TOK \"in\"],\n term_name = GrammarSpecials.let_special,\n paren_style = OnlyIfNecessary, fixity = Prefix 8,\n block_style = (AroundEachPhrase, (CONSISTENT, 0))};\n\nval _ = add_rule {term_name = GrammarSpecials.and_special,\n fixity = Infixl 9,\n pp_elements = [TOK \"and\"],\n paren_style = OnlyIfNecessary,\n block_style = (AroundEachPhrase, (INCONSISTENT, 0))}\n\nval _ = add_rule{term_name = \"COND\",\n fixity = Prefix 70,\n pp_elements = [PPBlock([TOK \"if\", BreakSpace(1,2), TM,\n BreakSpace(1,0),\n TOK \"then\"], (CONSISTENT, 0)),\n BreakSpace(1,2), TM, BreakSpace(1,0),\n TOK \"else\", BreakSpace(1,2)],\n paren_style = OnlyIfNecessary,\n block_style = (AroundEachPhrase, (CONSISTENT, 0))};\nend\nend\nend\n\\\n\n\nsubsection \\Prove HOL4 axioms\\\n\ndeclare [[ML_environment = \"Isabelle\"]]\n\nlemmas hol4_T_def = [[hol4_thm\\Bool1.T_DEF\\]]\n and hol4_F_def = [[hol4_thm\\Bool1.F_DEF\\]]\n and hol4_ex_def = [[hol4_thm\\Bool1.EXISTS_DEF\\]]\n and hol4_all_def = [[hol4_thm\\Bool1.FORALL_DEF\\]]\n and hol4_and_def = [[hol4_thm\\Bool1.AND_DEF\\]]\n and hol4_or_def = [[hol4_thm\\Bool1.OR_DEF\\]]\n and hol4_not_def = [[hol4_thm\\Bool1.NOT_DEF\\]]\n and hol4_one_one_def = [[hol4_thm\\Bool1.ONE_ONE_DEF\\]]\n and hol4_onto_def = [[hol4_thm\\Bool1.ONTO_DEF\\]]\n and hol4_type_def = [[hol4_thm\\Bool1.TYPE_DEFINITION\\]]\n\nlemma bool_T_equiv: \"HOL4\\T\\ \\ True\"\n apply(unfold hol4_T_def)\n apply(unfold True_def)\n ..\nlemma bool_all_equiv: \"HOL4\\! x. P x\\ = (\\ x. P x)\"\n thm hol4_all_def\n apply(unfold hol4_all_def)\n apply(subst bool_T_equiv)\n apply(unfold All_def)\n ..\n\nlemma bool_ex_equiv: \"HOL4\\? x. P x\\ = (\\ x. P x)\"\n apply(unfold hol4_ex_def)\n apply(unfold Hilbert_Choice.some_eq_ex)\n ..\n\nML \\val bool_exE = @{thm exE[folded bool_ex_equiv]}\\\nML \\val bool_exI = @{thm exI[folded bool_ex_equiv]}\\\nML \\val bool_allI = @{thm allI[folded bool_all_equiv]}\\\nML \\val bool_allE = @{thm allE[folded bool_all_equiv]}\\\n\nlemma bool_F_equiv: \"HOL4\\F\\ \\ False\"\n apply(unfold hol4_F_def)\n apply(subst bool_all_equiv)\n apply(unfold False_def)\n ..\n\nlemma bool_or_equiv: \"HOL4\\x \\\\/ y\\ = (x \\ y)\"\n apply(unfold hol4_or_def)\n apply(subst bool_all_equiv)\n apply(subst or_def)\n ..\n\nlemma bool_and_equiv: \"HOL4\\x /\\\\ y\\ = (x \\ y)\"\n apply(unfold hol4_and_def)\n apply(subst bool_all_equiv)\n apply(subst and_def)\n ..\n\nlemma bool_not_equiv: \"HOL4\\~x\\ = (\\ x)\"\n apply(unfold hol4_not_def)\n apply(subst bool_F_equiv)\n apply(subst not_def)\n ..\n\nlemma bool_one_one_equiv: \"HOL4\\ONE_ONE\\ f = inj f\"\n apply(unfold hol4_one_one_def)\n apply(unfold bool_all_equiv)\n apply(subst inj_def)\n ..\n\nlemma bool_onto_equiv: \"HOL4\\ONTO\\ f = surj f\"\n apply(unfold hol4_onto_def)\n apply(subst bool_all_equiv)\n apply(subst bool_ex_equiv)\n apply(subst surj_def)\n ..\n\nlemma hol4_rep_inject: \"type_definition r a A \\ r x = r x' \\ x = x'\"\n by (simp add: type_definition.Rep_inject)\n\nlemma hol4_abs_inverse:\nassumes tydef:\"type_definition r a A\"\n and P:\"P = (\\x. x \\ A)\"\n shows \"P x = (\\ x'. x = r x')\"\nproof \n fix x\n assume \"P x\" \n then have \"r (a x) = x\" by (meson P tydef type_definition.Abs_inverse)\n then show \"\\ x'. x = r x'\" by metis\nnext\n assume \"\\x'. x = r x'\"\n then show \"P x\" by (meson P tydef type_definition.Rep)\nqed \n\nlemma type_definition_equiv:\n assumes tydef:\"type_definition r a A\"\n shows \"HOL4\\TYPE_DEFINITION\\ (\\x. x \\ A) r\" \n unfolding hol4_type_def bool_all_equiv bool_and_equiv bool_ex_equiv \n using hol4_rep_inject[OF tydef] hol4_abs_inverse[OF tydef]\n by blast\n\nlemma bool_cases_ax_transfer: \"HOL4\\!t. (t = T) \\\\/ (t = F)\\\"\n apply(subst bool_all_equiv)\n apply(subst bool_or_equiv)\n apply(subst bool_T_equiv)\n apply(subst bool_F_equiv)\n by simp\n\nlemma eta_ax_transfer: \"HOL4\\!t. (\\\\x. t x) = t\\\"\n apply(subst bool_all_equiv)\n by simp\n\nlemma select_ax_transfer: \"HOL4\\!P x. P x ==> P ($@ P)\\\"\n apply(unfold bool_all_equiv)\n apply(unfold Hilbert_Choice.some_eq_ex)\n by simp\n\nlemma suc_infinity: \"(inj Suc_Rep) \\ (\\ surj Suc_Rep)\"\n using Suc_Rep_inject Suc_Rep_not_Zero_Rep\n by (metis injI surjE)\n\nlemma infinity_ax_transfer: \"HOL4\\?f:ind->ind. ONE_ONE f /\\\\ ~ONTO f\\\"\n apply(subst bool_one_one_equiv)\n apply(subst bool_onto_equiv)\n apply(subst bool_ex_equiv)\n apply(subst bool_and_equiv)\n apply(subst bool_not_equiv)\n apply(rule exI)\n apply(insert suc_infinity)\n .\n\nlemma bool_ex_Ex: \"bool\\036\\063 \\ Ex\"\n by (simp add: bool_ex_equiv[abs_def])\n\nML \\\n\nstructure IsaHOLThmTransfer =\nstruct\nval T = Thm.unvarify_global @{theory} @{thm bool_T_equiv}\nval F = Thm.unvarify_global @{theory} @{thm bool_F_equiv}\nval all = Thm.unvarify_global @{theory} @{thm bool_all_equiv}\nval exists = Thm.unvarify_global @{theory} @{thm bool_ex_equiv}\n(* Needed for typedef proof *)\nval exists_schematic = @{thm bool_ex_equiv[symmetric]}\nval bool_ex_Ex = @{thm bool_ex_Ex}\nval type_definition_equiv = @{thm type_definition_equiv}\nval disj = Thm.unvarify_global @{theory} @{thm bool_or_equiv}\nval conj = Thm.unvarify_global @{theory} @{thm bool_and_equiv}\nval not = Thm.unvarify_global @{theory} @{thm bool_not_equiv}\nval one_one = Thm.unvarify_global @{theory} @{thm bool_one_one_equiv}\nval onto = Thm.unvarify_global @{theory} @{thm bool_onto_equiv}\nval cases_ax = Thm.unvarify_global @{theory} @{thm bool_cases_ax_transfer}\nval eta_ax = Thm.unvarify_global @{theory} @{thm eta_ax_transfer}\nval select_ax = Thm.unvarify_global @{theory} @{thm select_ax_transfer}\nval infinity_ax = Thm.unvarify_global @{theory} @{thm infinity_ax_transfer}\nend\n\\\n\n\ndeclare [[ML_environment = \"Isabelle>HOL4\"]]\n\nML \\\nstructure IsaHOLThmTransfer = IsaHOLThmTransfer\nval bool_exE = bool_exE\nval bool_exI = bool_exI\nval bool_allE = bool_allE\nval bool_allI = bool_allI\n\\\n\ndeclare [[ML_environment = \"HOL4\"]]\n\nML \\\nval _ = transfer_thms := \n SOME {ex_equiv = IsaHOLThmTransfer.exists_schematic,\n bool_ex_Ex = IsaHOLThmTransfer.bool_ex_Ex,\n bool_exI = bool_exI, \n typedef_equiv = IsaHOLThmTransfer.type_definition_equiv}\n\\\n\n\nML \\\nstructure Bool2 = struct\n(* bool Script part 2 continue building up kernel primitives using Isabelle/HOL axioms*)\nlocal\nopen HolKernel Parse\nopen Unicode TexTokenMap\nopen Bool1\nin\n\n(*---------------------------------------------------------------------------*\n * AXIOMS *\n * *\n * Bruno Barras noticed that the axiom IMP_ANTISYM_AX from the original *\n * HOL logic was provable. *\n *---------------------------------------------------------------------------*)\n\nval BOOL_CASES_AX = save_thm (\"BOOL_CASES_AX\", Thm\n IsaHOLThmTransfer.cases_ax);\n\nval ETA_AX = save_thm (\"ETA_AX\", Thm\n IsaHOLThmTransfer.eta_ax);\n\nval SELECT_AX = save_thm (\"SELECT_AX\", Thm\n IsaHOLThmTransfer.select_ax);\n\nval INFINITY_AX = save_thm (\"INFINITY_AX\", Thm\n IsaHOLThmTransfer.infinity_ax);\n\n\n(*---------------------------------------------------------------------------*\n * Miscellaneous utility definitions, of use in some packages. *\n *---------------------------------------------------------------------------*)\n\nval arb = new_constant(\"ARB\",alpha); (* Doesn't have to be defined at all. *)\n\nval literal_case_DEF =\n Definition.new_definition\n (\"literal_case_DEF\", ``literal_case = \\(f:'a->'b) x. f x``);\n\nval _ = overload_on (\"case\", ``bool$literal_case``);\n\nval IN_DEF =\n Definition.new_definition\n (\"IN_DEF\", ``IN = \\x (f:'a->bool). f x``);\n\nval _ = set_fixity \"IN\" (Infix(NONASSOC, 425))\nval _ = unicode_version {u = UChar.setelementof, tmnm = \"IN\"};\nval _ = TeX_notation {hol = \"IN\", TeX = (\"\\\\HOLTokenIn{}\",1)}\nval _ = TeX_notation {hol = UChar.setelementof, TeX = (\"\\\\HOLTokenIn{}\",1)}\n\nval RES_FORALL_DEF =\n Definition.new_definition\n (\"RES_FORALL_DEF\", ``RES_FORALL = \\p m. !x : 'a. x IN p ==> m x``);\n\nval _ = associate_restriction (\"!\", \"RES_FORALL\")\n\nval RES_EXISTS_DEF =\n Definition.new_definition\n (\"RES_EXISTS_DEF\", ``RES_EXISTS = \\p m. ?x : 'a. x IN p /\\ m x``);\n\nval _ = associate_restriction (\"?\", \"RES_EXISTS\")\n\nval RES_EXISTS_UNIQUE_DEF =\n Definition.new_definition\n (\"RES_EXISTS_UNIQUE_DEF\",\n ``RES_EXISTS_UNIQUE =\n \\p m. (?(x : 'a) :: p. m x) /\\ !x y :: p. m x /\\ m y ==> (x = y)``);\n\nval _ = associate_restriction (\"?!\", \"RES_EXISTS_UNIQUE\");\n\nval RES_SELECT_DEF =\n Definition.new_definition\n (\"RES_SELECT_DEF\", ``RES_SELECT = \\p m. @x : 'a. x IN p /\\ m x``);\n\nval _ = associate_restriction (\"@\", \"RES_SELECT\")\n\n(* Note: RES_ABSTRACT comes later, defined by new_specification *)\n\n(*---------------------------------------------------------------------------*)\n(* Experimental rewriting directives *)\n(*---------------------------------------------------------------------------*)\n\nval BOUNDED_DEF =\n Definition.new_definition\n (\"BOUNDED_DEF\",\n ``BOUNDED = \\(v:bool). T``);\n\n(*---------------------------------------------------------------------------*)\n(* Support for detecting datatypes in theory files *)\n(*---------------------------------------------------------------------------*)\n\nval DATATYPE_TAG_DEF =\n Definition.new_definition\n (\"DATATYPE_TAG_DEF\",\n ``DATATYPE = \\x. T``);\n\n(*---------------------------------------------------------------------------*\n * THEOREMS *\n *---------------------------------------------------------------------------*)\n\nlocal\nval op --> = Type.-->\ninfix ## |->\ninfixr ==>\ninfix ==\n\n\nval ERR = Feedback.mk_HOL_ERR \"boolScript\"\nin\nval F = ``F``\nval T = ``T``;\nval implication = prim_mk_const{Name=\"==>\", Thy=\"min\"}\nval select = prim_mk_const{Name=\"@\", Thy=\"min\"}\nval conjunction = prim_mk_const{Name=\"/\\\\\", Thy=\"bool\"}\nval disjunction = prim_mk_const{Name=\"\\\\/\", Thy=\"bool\"}\nval negation = prim_mk_const{Name=\"~\", Thy=\"bool\"}\nval universal = prim_mk_const{Name=\"!\", Thy=\"bool\"}\nval existential = prim_mk_const{Name=\"?\", Thy=\"bool\"}\nval exists1 = prim_mk_const{Name=\"?!\", Thy=\"bool\"}\nval in_tm = prim_mk_const{Name=\"IN\", Thy=\"bool\"};\n\n\nval dest_neg = sdest_monop(\"~\",\"bool\") (ERR\"dest_neg\" \"\");\nval dest_eq = sdest_binop(\"=\",\"min\") (ERR\"dest_eq\" \"\");\nval dest_disj = sdest_binop(\"\\\\/\",\"bool\") (ERR\"dest_disj\" \"\");\nval dest_conj = sdest_binop(\"/\\\\\",\"bool\") (ERR\"dest_conj\" \"\");\nval dest_forall = sdest_binder(\"!\",\"bool\") (ERR\"dest_forall\" \"\");\nval dest_exists = sdest_binder(\"?\",\"bool\") (ERR\"dest_exists\" \"\");\nfun strip_forall fm =\n if can dest_forall fm\n then let val (Bvar,Body) = dest_forall fm\n val (bvs,core) = strip_forall Body\n in ((Bvar::bvs), core)\n end\n else ([],fm);\nval lhs = fst o dest_eq;\nval rhs = snd o dest_eq;\n\nfun mk_eq (lhs,rhs) =\n let val ty = type_of lhs\n val eq = mk_thy_const{Name=\"=\",Thy=\"min\",Ty=ty-->ty-->bool}\n in list_mk_comb(eq,[lhs,rhs])\n end;\nfun mk_imp(ant,conseq) = Term.prim_mk_imp ant conseq;\n\nfun mk_exists (absrec as (Bvar,_)) =\n mk_comb(mk_thy_const{Name=\"?\",Thy=\"bool\", Ty= (type_of Bvar-->bool)-->bool},\n mk_abs absrec)\n\nfun mk_exists1 (absrec as (Bvar,_)) =\n mk_comb(mk_thy_const{Name=\"?!\",Thy=\"bool\", Ty= (type_of Bvar-->bool)-->bool},\n mk_abs absrec)\n\n\n\nval F = mk_thy_const{Name=\"F\", Thy=\"bool\", Ty=bool};\n\nval mk_neg =\n let val notc = mk_thy_const{Name=\"~\",Thy=\"bool\",Ty=bool --> bool}\n in fn M => mk_comb(notc,M)\n end;\n\nval mk_forall =\n let val forallc = prim_mk_const{Name=\"!\", Thy=\"bool\"}\n in fn (v, tm) =>\n mk_comb(inst[alpha |-> type_of v] forallc, mk_abs(v,tm))\n end;\n\nval mk_conj =\n let val conjc = prim_mk_const{Name=\"/\\\\\", Thy=\"bool\"}\n in fn (M,N) => list_mk_comb(conjc,[M,N])\n end;\n\nval mk_disj =\n let val disjc = prim_mk_const{Name=\"\\\\/\", Thy=\"bool\"}\n in fn (M,N) => list_mk_comb(disjc,[M,N])\n end;\n\nval list_mk_forall = itlist (curry mk_forall)\nval list_mk_exists = itlist (curry mk_exists)\n\nlocal val DEST_IMP_ERR = thm_err \"dest_imp\" \"\"\nopen Term KernelTypes\nin\nfun dest_imp M =\n let val (Rator,conseq) = with_exn dest_comb M DEST_IMP_ERR\n in if is_comb Rator\n then let val (Rator,ant) = dest_comb Rator\n in if (Isabelle.Thm.term_of (dest_Ht Rator)) = (Isabelle.Thm.term_of (dest_Ht imp)) then (ant,conseq) else raise DEST_IMP_ERR\n end\n else case with_exn dest_thy_const Rator DEST_IMP_ERR\n of {Name=\"~\", Thy=\"bool\",...} => (conseq, F)\n | otherwise => raise DEST_IMP_ERR\n end\nend\n\nfun Av s = mk_var(s, alpha)\nfun Bv s = mk_var(s, bool)\nval tb = Bv \"t\"\nval t1b = Bv \"t1\"\nval t2b = Bv \"t2\"\nval Pb = Bv \"P\"\nval Qb = Bv \"Q\"\nval Pab = mk_var(\"P\", alpha --> bool)\nval Qab = mk_var(\"Q\", alpha --> bool)\n\nval fabt = mk_var(\"f\", alpha --> beta)\nval xa = Av \"x\"\nval ya = Av \"y\"\n\nval TRUTH = save_thm(\"TRUTH\", EQ_MP (SYM T_DEF) (REFL ``\\x:bool. x``));\n\nfun RIGHT_BETA th = TRANS th (BETA_CONV(snd(dest_eq(concl th))));\n\nfun UNFOLD_OR_CONV tm =\n let val (disj1,disj2) = dest_disj tm in\n RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM OR_DEF disj1)) disj2)\n end;\n\nfun CUT_EQUAL P x y t thm =\n let val e = mk_eq(y,t) in\n DISCH e (SUBST [(x|->SYM (ASSUME e))] P thm)\n end;\n\nfun EQT_ELIM th = EQ_MP (SYM th) TRUTH;\n\n(*\nfun SPEC t th =\n let\n val _ = (t, th)\n val (F,body) = dest_comb(concl th)\n in\n if (not(#1(dest_const F) = #1(dest_const universal)))\n then raise ERR \"SPEC\" \"\"\n else let val (x, _) = dest_abs body\n and v1 = genvar(type_of F)\n and v2 = genvar(type_of body)\n val th1 = SUBST[v1 |-> INST_TYPE[{redex = alpha,\n residue = type_of x}] FORALL_DEF]\n (mk_comb (v1,body)) th\n (* th1 = |- (\\P. P = (\\x. T))(\\x. t1 x) *)\n val th2 = BETA_CONV(concl th1)\n (* th2 = |- (\\P. P = (\\x. T))(\\x. t1 x) = ((\\x. t1 x) = (\\x. T)) *)\n val th3 = EQ_MP th2 th1\n (* th3 = |- (\\x. t1 x) = (\\x. T) *)\n val th4 = SUBST [v2 |->th3]\n (mk_eq ((mk_comb (body,t)), (mk_comb (v2,t))))\n (REFL (mk_comb (body,t)))\n (* th4 = |- (\\x. t1 x)t = (\\x. T)t *)\n val (ls, rs) = dest_eq(concl th4)\n val th5 = TRANS(TRANS(SYM(BETA_CONV ls))th4)(BETA_CONV rs)\n (* th5 = |- t1 t = T *)\n in\n EQT_ELIM th5\n end\n end\n handle Feedback.HOL_ERR _ => raise ERR \"SPEC\" \"\";\n*)\n\nlocal open Isabelle KernelTypes\nin\nfun SPEC (KernelTypes.Ht t) th =\n let\n val th = Thm' th\n val P = Thm.cconcl_of th\n |> Thm.dest_arg (* Trueprop *)\n |> Thm.dest_arg (* forall *)\n val tv = Thm.apply P t\n val ctv = mk_cTrueprop tv\n val P_argty = Thm.ctyp_of_cterm t\n val tv_btv = Thm.beta_conversion false tv\n |> Drule.arg_cong_rule cTrueprop\n val btv = Thm.cconcl_of tv_btv |> Thm.dest_equals |> snd\n val thm1 = Thm.instantiate ([(((\"'a\", 0), Isabelle.sort), P_argty)],\n [(((\"x\",0),Thm.typ_of P_argty),t),\n (((\"P\", 0), Isabelle.Term.-->(P_argty |> Thm.typ_of, bool)), P),\n (((\"R\", 0), bool), btv |> Thm.dest_arg)]) bool_allE\n val thm2 = Thm.implies_elim thm1 th\n val h1 = Thm.assume ctv (* tv |- tv*)\n val h2 = h1 |> Thm.equal_elim tv_btv (* tv |- btv *)\n val h3 = h2 |> Thm.implies_intr ctv (* |- tv ==> btv *)\n in\n Thm.implies_elim thm2 h3 |> Thm\n end\n handle _ => raise ERR \"SPEC\" \"\";\nend\n\n\nfun BOOL_CASE P x t pt pf =\n let val th0 = SPEC t BOOL_CASES_AX\n val th1 = EQ_MP (UNFOLD_OR_CONV (concl th0)) th0\n val th2 = SPEC (subst[(x|->t)] P) th1 in\n MP_imp (MP_imp (th2) (CUT_EQUAL P x t T pt)) (CUT_EQUAL P x t F pf)\n end;\n\nfun FALSITY_CONV tm = DISCH F (SPEC tm (EQ_MP F_DEF (ASSUME F)))\n\nfun EQT_INTRO th =\n let val t = concl th\n val x = genvar bool\n in\n BOOL_CASE (mk_eq (x,T)) x t (REFL T)\n (MP_imp (FALSITY_CONV (mk_eq (F,T))) (EQ_MP (ASSUME (mk_eq(t,F))) th))\n end;\n\n(*\nfun GEN x th =\n let\n val _ = (\"GEN\", x, th)\n val th1 = ABS x (EQT_INTRO th)\n val abs = mk_abs (x,concl th)\n and v1 = genvar (((type_of x) --> bool) --> bool)\n and v2 = genvar bool \n val th2 = SUBST [v1 |-> INST_TYPE[alpha|-> (type_of x)]FORALL_DEF]\n (mk_eq (mk_forall (x,concl th), mk_comb (v1,abs)))\n (REFL (mk_forall (x,concl th)))\n val th3 = TRANS th2 (BETA_CONV(snd(dest_eq(concl th2))))\n in\n SUBST [v2 |-> SYM th3] v2 th1\n end\n handle Feedback.HOL_ERR _ => raise ERR \"GEN\" \"\"\n*)\n\nlocal open Isabelle KernelTypes in\nfun GEN (Ht x) th =\n let val (vn, _) = Thm.term_of x |> Term.dest_Free\n val P = Thm.lambda x (Thm.cconcl_of (Thm' th) |> Thm.dest_arg)\n val tv = Thm.apply P x\n val tyx = Thm.ctyp_of_cterm x\n val all_inst = Thm.instantiate ([(((\"'a\",0),sort), tyx)],[(((\"P\",0),Isabelle.Term.-->(tyx |> Thm.typ_of, bool)), P)]) bool_allI\n\n val btv_tv = Thm.beta_conversion false tv\n |> Drule.arg_cong_rule cTrueprop |> Thm.symmetric\n val btv = Thm.cconcl_of btv_tv |> Thm.dest_equals |> fst\n val h1 = Thm.assume btv (* btv |- btv *)\n val h2 = h1 |> Thm.equal_elim btv_tv (* btv |- tv *)\n val h3 = h2 |> Thm.implies_intr (Thm.cprop_of (Thm' th)) (* |- btv ==> tv *)\n val h4 = Thm.implies_elim h3 (Thm' th) (* |- tv *)\n val h5 = h4 |> Thm.forall_intr_name (vn,x)\n in Thm.implies_elim all_inst h5 |> Thm\n handle _ => raise ERR \"GEN\" \"\"\n end\nend\n\nval FALSITY = save_thm(\"FALSITY\", GEN tb (FALSITY_CONV tb))\n\nval op==> = mk_imp\nval op== = mk_eq\n\nval IMP_ANTISYM_AX = Theory.save_thm(\n \"IMP_ANTISYM_AX\",\n let fun dsch t1 t2 th = DISCH (t2 ==> t1) (DISCH (t1 ==> t2) th)\n fun sch t1 t2 = (t1==>t2) ==> (t2==>t1) ==> (t1 == t2)\n val abs = MP_imp (FALSITY_CONV (F == T)) (MP_imp (ASSUME (T ==> F)) TRUTH)\n val tht = BOOL_CASE (sch T t2b) t2b t2b\n (dsch T T (REFL T)) (dsch F T (SYM abs))\n val thf = BOOL_CASE (sch F t2b) t2b t2b\n (dsch T F abs) (dsch F F (REFL F))\n in\n GEN t1b (GEN t2b (BOOL_CASE (sch t1b t2b) t1b t1b tht thf))\n end);\n\nval OR_ELIM_THM = Theory.save_thm(\"OR_ELIM_THM\",\n let val th1 = ASSUME (mk_disj (t1b,t2b))\n val th2 = UNFOLD_OR_CONV (concl th1)\n val th3 = SPEC tb (EQ_MP th2 th1)\n val th4 = MP_imp (MP_imp th3 (ASSUME (mk_imp (t1b,tb))))\n (ASSUME (mk_imp (t2b,tb)))\n val th4 = DISCH (mk_imp (t1b,tb)) (DISCH (mk_imp (t2b,tb)) th4)\n in\n GEN tb (GEN t1b (GEN t2b (DISCH (mk_disj (t1b,t2b)) th4)))\n end);\n\nfun DISJ_CASES th1 th2 th3 =\n let val (t1,t2) = dest_disj(concl th1)\n and t = concl th2\n val th4 = SPEC t2 (SPEC t1 (SPEC t OR_ELIM_THM))\n in\n MP_imp (MP_imp (MP_imp th4 th1) (DISCH t1 th2)) (DISCH t2 th3)\n end\n handle Feedback.HOL_ERR _ => raise ERR \"DISJ_CASES\" \"\";\n\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. t1 ==> t2 ==> t1 /\\ t2\n *---------------------------------------------------------------------------*)\n\nval AND_INTRO_THM = Theory.save_thm(\n \"AND_INTRO_THM\",\n let val t12 = mk_imp (t1b, mk_imp (t2b, tb))\n val th1 = GEN tb (DISCH t12 (MP_imp (MP_imp (ASSUME t12)\n (ASSUME t1b))\n (ASSUME t2b)))\n val th2 = RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM AND_DEF t1b)) t2b)\n in\n GEN t1b (GEN t2b (DISCH t1b (DISCH t2b (EQ_MP (SYM th2) th1))))\n end);\n\nfun CONJ th1 th2 = MP_imp (MP_imp (SPEC (concl th2)\n (SPEC (concl th1) AND_INTRO_THM))\n th1)\n th2\n\nfun ADD_ASSUM t th = MP_imp (DISCH t th) (ASSUME t);\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. t1 /\\ t2 ==> t1\n *---------------------------------------------------------------------------*)\n\nval AND1_THM = Theory.save_thm(\n \"AND1_THM\",\n let val t12 = mk_conj(t1b, t2b)\n val th2 = RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM AND_DEF t1b)) t2b)\n val th3 = SPEC t1b (EQ_MP th2 (ASSUME t12))\n val th4 = DISCH t1b (DISCH t2b (ADD_ASSUM t2b (ASSUME t1b)))\n in\n GEN t1b (GEN t2b (DISCH t12 (MP_imp th3 th4)))\n end);\n\nfun CONJUNCT1 th =\n let val (t1,t2) = dest_conj(concl th)\n in\n MP_imp (SPEC t2 (SPEC t1 AND1_THM)) th\n end\n handle Feedback.HOL_ERR _ => raise ERR \"CONJUNCT1\" \"\";\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. t1 /\\ t2 ==> t2\n *---------------------------------------------------------------------------*)\n\nval AND2_THM = Theory.save_thm(\"AND2_THM\",\n let val t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val th1 = ASSUME ``^t1 /\\ ^t2``\n val th2 = RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM AND_DEF t1)) t2)\n val th3 = SPEC t2 (EQ_MP th2 th1)\n val th4 = DISCH t1 (DISCH t2 (ADD_ASSUM t1 (ASSUME t2)))\n in\n GEN t1 (GEN t2 (DISCH ``^t1 /\\ ^t2`` (MP_imp th3 th4)))\n end);\n\nfun CONJUNCT2 th =\n let val (t1,t2) = dest_conj(concl th)\n in\n MP_imp (SPEC t2 (SPEC t1 AND2_THM)) th\n end\n handle Feedback.HOL_ERR _ => raise ERR \"CONJUNCT2\" \"\";\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. t1 ==> t1 \\/ t2\n *---------------------------------------------------------------------------*)\n\nval OR_INTRO_THM1 = Theory.save_thm(\"OR_INTRO_THM1\",\n let val t = ``t:bool``\n and t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val th1 = ADD_ASSUM ``^t2 ==> ^t`` (MP_imp (ASSUME ``^t1 ==> ^t``)\n (ASSUME t1))\n val th2 = GEN t (DISCH ``^t1 ==> ^t`` (DISCH ``^t2 ==> ^t`` th1))\n val th3 = RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM OR_DEF t1)) t2)\n in\n GEN t1 (GEN t2 (DISCH t1 (EQ_MP (SYM th3) th2)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. t2 ==> t1 \\/ t2\n *---------------------------------------------------------------------------*)\n\nval OR_INTRO_THM2 = Theory.save_thm(\"OR_INTRO_THM2\",\n let val t = ``t:bool``\n and t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val th1 = ADD_ASSUM ``^t1 ==> ^t``\n (MP_imp (ASSUME ``^t2 ==> ^t``) (ASSUME t2))\n val th2 = GEN t (DISCH ``^t1 ==> ^t`` (DISCH ``^t2 ==> ^t`` th1))\n val th3 = RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM OR_DEF t1)) t2)\n in\n GEN t1 (GEN t2 (DISCH t2 (EQ_MP (SYM th3) th2)))\n end);\n\nfun DISJ1 th t2 = MP_imp (SPEC t2 (SPEC (concl th) OR_INTRO_THM1)) th\n handle Feedback.HOL_ERR _ => raise ERR \"DISJ1\" \"\";\n\nfun DISJ2 t1 th = MP_imp (SPEC (concl th) (SPEC t1 OR_INTRO_THM2)) th\n handle Feedback.HOL_ERR _ => raise ERR \"DISJ2\" \"\";\n\nfun SELECT_INTRO th =\n let\n val (Rator, Rand) = dest_comb (concl th)\n val SELECT_AX' = INST_TYPE [alpha |-> type_of Rand] SELECT_AX\n in\n MP_imp (SPEC Rand (SPEC Rator SELECT_AX')) th\n end\n handle Feedback.HOL_ERR _ => raise ERR \"SELECT_INTRO\" \"\"\n\n(*\nfun EXISTS (fm,tm) th =\n let val (x,t) = dest_exists fm\n val th1 = BETA_CONV (mk_comb (mk_abs (x,t), tm))\n (* th1 = |- (\\x. t x)t' = t t' *)\n val th2 = EQ_MP (SYM th1) th\n (* th2 = |- (\\x. t x)t' *)\n val th3 = SELECT_INTRO th2\n (* th3 = |- (\\x. t x)(@x. t x) *)\n val th4 = AP_THM(INST_TYPE[alpha|-> type_of x]EXISTS_DEF) (mk_abs (x,t))\n (* th4 = |- (?x. t x) = (\\P. P($@ P))(\\x. t x) *)\n val th5 = TRANS th4 (BETA_CONV(snd(dest_eq(concl th4))))\n (* th5 = |- (?x. t x) = (\\x. t x)(@x. t x) *)\n in\n EQ_MP (SYM th5) th3\n end\n handle Feedback.HOL_ERR _ => raise ERR \"EXISTS\" \"\";\n*)\n\nlocal open Isabelle Isabelle.Term KernelTypes\nin\nfun EXISTS (Ht fm,Ht tm) th =\n let val P = fm |> Thm.dest_arg (* Trueprop *)\n val tv = Thm.apply P tm\n val tyx = Thm.ctyp_of_cterm tm\n val ex_inst = Thm.instantiate ([(((\"'a\",0),Isabelle.sort),tyx)],\n [(((\"P\",0), (Thm.typ_of tyx) --> bool),P),(((\"x\",0), (Thm.typ_of tyx)), tm)]) bool_exI\n val btv_tv = Thm.beta_conversion false tv\n |> Drule.arg_cong_rule cTrueprop |> Thm.symmetric\n val btv = Thm.cconcl_of btv_tv |> Thm.dest_equals |> fst\n val h1 = Thm.assume btv (* btv |- btv *)\n val h2 = h1 |> Thm.equal_elim btv_tv (* btv |- tv *)\n val h3 = h2 |> Thm.implies_elim ex_inst (* btv |- thm *)\n val h4 = h3 |> Thm.implies_intr (Thm.cprop_of th) (* |- btv ==> thm *)\n in Thm.implies_elim h4 th\n end\nend\n\nval F_IMP = Theory.save_thm(\"F_IMP\",\n let val t = ``t:bool``\n val th1 = RIGHT_BETA(AP_THM NOT_DEF t)\n in\n GEN t (DISCH ``~^t``\n (EQ_MP th1 (ASSUME ``~^t``)))\n end);\n\nfun NOT_ELIM th =\n let val (_,t) = dest_comb(concl th)\n in MP_imp (SPEC t F_IMP) th\n end\n handle Feedback.HOL_ERR _ => raise ERR \"NOT_ELIM\" \"\";\n\nval IMP_F = Theory.save_thm(\"IMP_F\",\n let val t = ``t:bool``\n val th1 = RIGHT_BETA (AP_THM NOT_DEF t)\n in\n GEN t (DISCH ``^t ==> F``\n (EQ_MP (SYM th1) (ASSUME ``^t ==> F``)))\n end);\n\nfun SELECT_ELIM th1 (v, th2) =\n let val _ = (th1, v, th2)\n val (Rator, Rand) = dest_comb (concl th1)\n val th3 = DISCH (mk_comb (Rator, v)) th2\n val _ = (v, th3)\n val _ = GEN v th3\n (* th3 = |- P v ==> t *)\n in\n MP_imp (SPEC Rand (GEN v th3)) th1\n end\n handle Feedback.HOL_ERR _ => raise ERR \"SELECT_ELIM\" \"\"\n\n(*\nfun CHOOSE (v,th1) th2 =\n let val (x,body) = dest_exists(concl th1)\n and t' = concl th2\n and v1 = genvar bool\n val th3 = AP_THM((INST_TYPE[alpha |-> type_of v]EXISTS_DEF)) (mk_abs (x,body))\n (* th3 = |- (?x. t x) = (\\P. P($@ P))(\\x. t x) *)\n val th4 = EQ_MP th3 th1\n (* th4 = |- (\\P. P($@ P))(\\x. t x) *)\n val th5 = EQ_MP (BETA_CONV(concl th4)) th4\n (* th5 = |- (\\x. t x)(@x. t x) *)\n val th6 = BETA_CONV (mk_comb (mk_abs (x,body), v))\n (* th6 = |- (\\x. t x)v = t v *)\n val Pa = snd(dest_eq(concl th6))\n val dth = DISCH Pa th2\n val th7 = (SUBST [v1 |-> (SYM th6)](mk_imp (v1,t')) dth)\n val th8 = MP_imp th7 (ASSUME (fst (dest_eq(concl th6))))\n in\n SELECT_ELIM th5 (v,th8)\n end\n handle Feedback.HOL_ERR _ => raise ERR \"CHOOSE \" \"\";\n*)\nlocal\n open Isabelle\nin\n(*\nfun CHOOSE (KernelTypes.Ht v, ex_thm) thm =\n let\n val (vn, _) = Thm.term_of v |> Term.dest_Free\n val tv = Thm.cconcl_of ex_thm\n |> Thm.dest_arg (* Trueprop *)\n |> Thm.dest_arg (* exists *)\n |> Thm.dest_abs (SOME vn)\n |> snd\n |> mk_cTrueprop\n in\n Thm.implies_elim\n (Drule.RS (ex_thm, bool_exE)\n |> Thm.instantiate ([],[(((\"Q\", 0), bool), Thm.cconcl_of thm |> Thm.dest_arg)]))\n (Thm.implies_intr tv thm |> Thm.forall_intr v)\n end\n*)\nfun CHOOSE (KernelTypes.Ht v, ex_thm) thm =\n let\n val (vn, _) = Thm.term_of v |> Term.dest_Free\n val P = Thm.cconcl_of ex_thm\n |> Thm.dest_arg (* Trueprop *)\n |> Thm.dest_arg (* exists *)\n val tv = Thm.apply P v\n val ctv = mk_cTrueprop tv\n val P_argty = P |> Thm.dest_abs (SOME vn) |> fst |> Thm.ctyp_of_cterm\n val thm1 = Thm.instantiate ([(((\"'a\", 0), Isabelle.sort), P_argty)],\n [(((\"P\", 0), Isabelle.Term.-->(P_argty |> Thm.typ_of, bool)), P),\n (((\"Q\", 0), bool), Thm.cconcl_of thm |> Thm.dest_arg)]) bool_exE\n val thm2 = Thm.implies_elim thm1 ex_thm\n val tv_btv = Thm.beta_conversion false tv (* TODO: handle if this fails*)\n |> Drule.arg_cong_rule cTrueprop\n val btv = Thm.cconcl_of tv_btv |> Thm.dest_equals |> snd\n val thm3 = Thm.implies_intr btv thm (* |- btv ==> thm *)\n val h1 = Thm.assume (ctv) (* tv |- tv*)\n val h2 = h1 |> Thm.equal_elim (tv_btv) (* tv |- btv *)\n val h3 = h2 |> Thm.implies_elim thm3 (* tv |- thm *)\n val h4 = h3 |> Thm.implies_intr (ctv) (* |- tv ==> thm *)\n val thm4 = h4 |> Thm.forall_intr v\n in\n Thm.implies_elim thm2 thm4\n end\nend\n\n(* MP has this weird special case... *)\nfun MP thm1 thm2 = MP_imp thm1 thm2\n handle Isabelle.Thm.CTERM _ => MP (MP (SPEC (concl thm2) F_IMP) thm1) thm2\n\nfun IMP_ANTISYM_RULE th1 th2 =\n let val (ant,conseq) = dest_imp(concl th1)\n in\n MP (MP (SPEC conseq (SPEC ant IMP_ANTISYM_AX)) th1) th2\n end;\n\nval IMP_CLAUSE4 =\n let val tImpF = mk_imp (T,F)\n val th1 = DISCH tImpF (MP (ASSUME tImpF) TRUTH)\n and th2 = SPEC tImpF FALSITY\n and th3 = EQT_INTRO(DISCH F (ASSUME F))\n in\n CONJ(IMP_ANTISYM_RULE th1 th2) th3\n end;\n\nfun CCONTR t th =\nlet val th1 = Beta(AP_THM NOT_DEF t)\n and v = genvar bool\n val th2 = EQT_ELIM (ASSUME (mk_eq (t,T)))\n val th3 = SUBST [v |-> th1] (mk_imp (v,F)) (DISCH (mk_neg t) th)\n val th4 = SUBST[v |-> ASSUME(mk_eq (t,F))] (mk_imp (mk_imp (v,F), F)) th3\n val th5 = MP th4 (EQT_ELIM (CONJUNCT2 IMP_CLAUSE4))\n val th6 = EQ_MP (SYM(ASSUME (mk_eq (t,F)))) th5\nin \nDISJ_CASES (SPEC t BOOL_CASES_AX) th2 th6\nend handle Feedback.HOL_ERR _ => raise ERR \"CCONTR\" \"\"\n\nfun NOT_INTRO th =\n let val (t,_) = dest_imp(concl th)\n in MP (SPEC t IMP_F) th\n end\n handle Feedback.HOL_ERR _ => raise ERR \"NOT_INTRO\" \"\";\n\nend\nend\nend\n\\\n\nML \\\nstructure Thm : sig\n include Thm\n val Thm: Isabelle.Thm.thm -> thm\n val Thm': thm -> Isabelle.Thm.thm\nend =\n struct\nopen Lib Bool2 Map_Functions Thm\n\ntype depdisk = Thm.depdisk\ntype tag = Tag.tag\ntype hol_type = KernelTypes.hol_type\ntype term = KernelTypes.term\nval kernelid = Thm.kernelid\n\nval NOT_ELIM = NOT_ELIM\nval CHOOSE = ((I ** Thm') ==> Thm' ==> Thm) CHOOSE\nval EXISTS = (I ==> Thm' ==> Thm) EXISTS\nval Specialize = SPEC\nfun add_tag (x, thm) = add_tag (x, thm)\nval GENL = itlist GEN\nend\n\\\n\nsubsection \\now the rest of bool theory\\\nML \\structure HolKernel = struct open HolKernel open Thm end\\\\ \\add the additional Thm stuff on bool\\\n\nML \\\nlocal\nopen Bool1 Bool2\n(*bool script part 3*)\nopen HolKernel Parse\nopen Unicode TexTokenMap\nopen Thm\n(* also implemented in Drule *)\nfun ETA_CONV t =\n let val (var, cmb) = dest_abs t\n val tysubst = [alpha |-> type_of var, beta |-> type_of cmb]\n val th = SPEC (rator cmb) (INST_TYPE tysubst (ETA_AX))\n in\n TRANS (ALPHA t (lhs (concl th))) th\n end;\n\nfun EXT th =\n let val (Bvar,_) = dest_forall(concl th)\n val th1 = SPEC Bvar th\n val (t1x, t2x) = dest_eq(concl th1)\n val x = rand t1x\n val th2 = ABS x th1\n in\n TRANS (TRANS(SYM(ETA_CONV (mk_abs(x, t1x)))) th2)\n (ETA_CONV (mk_abs(x,t2x)))\n end;\n\nlocal\nfun DISCH_ALL_rec (t::ts) th = DISCH_ALL_rec ts (DISCH t th)\n | DISCH_ALL_rec [] th = th\nin\nfun DISCH_ALL th = DISCH_ALL_rec (hyp th) th\nend\n\nfun PROVE_HYP ath bth = MP (DISCH (concl ath) bth) ath;\n\nfun CONV_RULE conv th = EQ_MP (conv(concl th)) th;\n\nfun RAND_CONV conv tm =\n let val (Rator,Rand) = dest_comb tm\n in AP_TERM Rator (conv Rand)\n end;\n\nfun RATOR_CONV conv tm =\n let val (Rator,Rand) = dest_comb tm in AP_THM (conv Rator) Rand end;\n\nfun ABS_CONV conv tm =\n let val (Bvar,Body) = dest_abs tm in ABS Bvar (conv Body) end;\n\nfun QUANT_CONV conv = RAND_CONV(ABS_CONV conv);\n\nfun UNDISCH th = MP th (ASSUME(fst(dest_imp(concl th))));\n\ninfixr ==>\nval op==> = mk_imp\ninfix ==\nval op== = mk_eq\n\n(*---------------------------------------------------------------------------\n * |- !t. F ==> t\n *---------------------------------------------------------------------------*)\n\nfun CONTR tm th = MP (SPEC tm FALSITY) th\n\nfun DISJ_IMP dth =\n let val (disj1,disj2) = dest_disj (concl dth)\n val nota = mk_neg disj1\n in\n DISCH nota\n (DISJ_CASES dth\n (CONTR disj2 (MP (ASSUME nota) (ASSUME disj1)))\n (ASSUME disj2))\n end\n\nfun EQF_INTRO th = IMP_ANTISYM_RULE (NOT_ELIM th)\n (DISCH ``F`` (CONTR (dest_neg (concl th)) (ASSUME ``F``)));\n\nfun SELECT_EQ x =\n let val ty = type_of x\n val choose = mk_const(\"@\", (ty --> Type.bool) --> ty)\n in\n fn th => AP_TERM choose (ABS x th)\n end\n\nval GENL = Thm.GENL;\n\nfun SPECL tm_list th = rev_itlist SPEC tm_list th\n\nfun GEN_ALL th =\n itlist GEN (op_set_diff aconv (free_vars(concl th)) (free_varsl (hyp th))) th;\n\nlocal fun f v (vs,l) = let val v' = variant vs v in (v'::vs, v'::l) end\nin\nfun SPEC_ALL th =\n let val (hvs,con) = (free_varsl ## I) (hyp th, concl th)\n val fvs = free_vars con\n and vars = fst(strip_forall con)\n in\n SPECL (snd(itlist f vars (hvs@fvs,[]))) th\n end\nend;\n\nfun SUBST_CONV theta template tm =\n let fun retheta {redex,residue} = (redex |-> genvar(type_of redex))\n val theta0 = map retheta theta\n val theta1 = map (op |-> o (#residue ## #residue)) (zip theta0 theta)\n in\n SUBST theta1 (mk_eq(tm,subst theta0 template)) (REFL tm)\n end;\n\nlocal fun combine [] [] = []\n | combine (v::rst1) (t::rst2) = (v |-> t) :: combine rst1 rst2\n | combine _ _ = raise Fail \"SUBS\"\nin\nfun SUBS ths th =\n let val ls = map (lhs o concl) ths\n val vars = map (genvar o type_of) ls\n val w = subst (combine ls vars) (concl th)\n in\n SUBST (combine vars ths) w th\n end\nend;\n\nfun IMP_TRANS th1 th2 =\n let val (ant,conseq) = dest_imp(concl th1)\n in DISCH ant (MP th2 (MP th1 (ASSUME ant))) end;\n\nfun SPEC_VAR th =\n let val (Bvar,_) = dest_forall (concl th)\n val bv' = variant (free_varsl (hyp th)) Bvar\n in (bv', SPEC bv' th)\n end;\n\nfun MK_EXISTS bodyth =\n let val (x, sth) = SPEC_VAR bodyth\n val (a,b) = dest_eq (concl sth)\n val (abimp,baimp) = EQ_IMP_RULE sth\n fun HALF (p,q) pqimp =\n let val xp = mk_exists(x,p)\n and xq = mk_exists(x,q)\n in DISCH xp\n (CHOOSE (x, ASSUME xp) (EXISTS (xq,x) (MP pqimp (ASSUME p))))\n end\n in\n IMP_ANTISYM_RULE (HALF (a,b) abimp) (HALF (b,a) baimp)\n end;\n\nfun SELECT_RULE th =\n let val (tm as (Bvar, Body)) = dest_exists(concl th)\n val v = genvar(type_of Bvar)\n val P = mk_abs tm\n val SELECT_AX' = INST_TYPE[alpha |-> type_of Bvar] SELECT_AX\n val th1 = SPEC v (SPEC P SELECT_AX')\n val (ant,conseq) = dest_imp(concl th1)\n val th2 = BETA_CONV ant\n and th3 = BETA_CONV conseq\n val th4 = EQ_MP th3 (MP th1 (EQ_MP(SYM th2) (ASSUME (rhs(concl th2)))))\n in\n CHOOSE (v,th) th4\n end;\n\n\n(*---------------------------------------------------------------------------\n ETA_THM = |- !M. (\\x. M x) = M\n ---------------------------------------------------------------------------*)\n\nval ETA_THM = save_thm(\"ETA_THM\", GEN_ALL(ETA_CONV ``\\x:'a. (M x:'b)``));\n\n(*---------------------------------------------------------------------------\n * |- !t. t \\/ ~t\n *---------------------------------------------------------------------------*)\n\nval EXCLUDED_MIDDLE = save_thm(\n \"EXCLUDED_MIDDLE\",\n let val th1 = RIGHT_BETA(AP_THM NOT_DEF tb)\n val th2 = DISJ1 (EQT_ELIM (ASSUME (tb == T))) (mk_neg tb)\n and th3 = DISJ2 tb (EQ_MP (SYM th1)\n (DISCH tb (EQ_MP (ASSUME (tb == F))\n (ASSUME tb))))\n in\n GEN tb (DISJ_CASES (SPEC tb BOOL_CASES_AX) th2 th3)\n end)\n\nfun IMP_ELIM th =\n let val (ant,conseq) = dest_imp (concl th)\n val not_t1 = mk_neg ant\n in\n DISJ_CASES (SPEC ant EXCLUDED_MIDDLE)\n (DISJ2 not_t1 (MP th (ASSUME ant)))\n (DISJ1 (ASSUME not_t1) conseq)\n end;\n\n(*---------------------------------------------------------------------------*\n * |- !f y. (\\x. f x) y = f y *\n *---------------------------------------------------------------------------*)\n\nval BETA_THM = save_thm(\n \"BETA_THM\",\n GENL [fabt, ya] (BETA_CONV ``(\\x. (f:'a->'b) x) y``))\n\n(*---------------------------------------------------------------------------\n LET_THM = |- !f x. LET f x = f x\n ---------------------------------------------------------------------------*)\n\nval LET_THM = save_thm(\n \"LET_THM\",\n GEN fabt (GEN xa\n (RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM LET_DEF fabt)) xa))))\n\n(* |- $! f <=> !x. f x *)\nval FORALL_THM = save_thm(\n \"FORALL_THM\",\n SYM (AP_TERM ``$! :('a->bool)->bool``\n (ETA_CONV ``\\x:'a. f x:bool``)))\n\n(* |- $? f <=> ?x. f x *)\nval EXISTS_THM = save_thm(\n \"EXISTS_THM\",\n SYM (AP_TERM ``$? :('a->bool)->bool``\n (ETA_CONV ``\\x:'a. f x:bool``)));\n\n(*---------------------------------------------------------------------------*\n * |- !t1:'a. !t2:'b. (\\x. t1) t2 = t1 *\n *---------------------------------------------------------------------------*)\n\nval ABS_SIMP = save_thm(\"ABS_SIMP\",\n GENL [``t1:'a``, ``t2:'b``]\n (BETA_CONV ``(\\x:'b. t1:'a) t2``));\n\n(*---------------------------------------------------------------------------\n * |- !t. (!x.t) = t\n *---------------------------------------------------------------------------*)\n\nval FORALL_SIMP = save_thm(\n \"FORALL_SIMP\",\n GEN tb (IMP_ANTISYM_RULE\n (DISCH ``!^xa. ^tb`` (SPEC xa (ASSUME ``!^xa.^tb``)))\n (DISCH tb (GEN xa (ASSUME tb)))));\n\n(*---------------------------------------------------------------------------\n * |- !t. (?x.t) = t\n *---------------------------------------------------------------------------*)\nval EXISTS_SIMP = save_thm(\n \"EXISTS_SIMP\",\n let val ext = mk_exists(xa,tb)\n in\n GEN tb (IMP_ANTISYM_RULE\n (DISCH ext (CHOOSE(Av \"p\", ASSUME ext) (ASSUME tb)))\n (DISCH tb (EXISTS(ext, Av \"r\") (ASSUME tb))))\n end);\n\n(* CONJ, CONJUNCT1 and CONJUNCT2 should be built here.*)\n\nfun CONJ_PAIR thm = (CONJUNCT1 thm, CONJUNCT2 thm);\n\nfun CONJUNCTS th =\n (CONJUNCTS (CONJUNCT1 th) @ CONJUNCTS (CONJUNCT2 th)) handle _ => [th];\n\nval LIST_CONJ = end_itlist CONJ\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2. (t1 /\\ t2) = (t2 /\\ t1)\n *---------------------------------------------------------------------------*)\n\nval CONJ_SYM = save_thm(\"CONJ_SYM\",\n let val t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val th1 = ASSUME ``^t1 /\\ ^t2``\n and th2 = ASSUME ``^t2 /\\ ^t1``\n in\n GEN t1 (GEN t2 (IMP_ANTISYM_RULE\n (DISCH ``^t1 /\\ ^t2``\n (CONJ(CONJUNCT2 th1)(CONJUNCT1 th1)))\n (DISCH ``^t2 /\\ ^t1``\n (CONJ(CONJUNCT2 th2)(CONJUNCT1 th2)))))\n end);\n\nval CONJ_COMM = save_thm(\"CONJ_COMM\", CONJ_SYM);\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2 t3. t1 /\\ (t2 /\\ t3) = (t1 /\\ t2) /\\ t3\n *---------------------------------------------------------------------------*)\n\nval CONJ_ASSOC = save_thm(\"CONJ_ASSOC\",\n let val t1 = ``t1:bool``\n and t2 = ``t2:bool``\n and t3 = ``t3:bool``\n val th1 = ASSUME ``^t1 /\\ (^t2 /\\ ^t3)``\n val th2 = ASSUME ``(^t1 /\\ ^t2) /\\ ^t3``\n val th3 = DISCH ``^t1 /\\ (^t2 /\\ ^t3)``\n (CONJ (CONJ(CONJUNCT1 th1)\n (CONJUNCT1(CONJUNCT2 th1)))\n (CONJUNCT2(CONJUNCT2 th1)))\n and th4 = DISCH ``(^t1 /\\ ^t2) /\\ ^t3``\n (CONJ (CONJUNCT1(CONJUNCT1 th2))\n (CONJ(CONJUNCT2(CONJUNCT1 th2))\n (CONJUNCT2 th2)))\n in\n GEN t1 (GEN t2 (GEN t3 (IMP_ANTISYM_RULE th3 th4)))\n end);\n\n\n(*---------------------------------------------------------------------------\n * |- !t t1 t2. (t1 \\/ t2) ==> (t1 ==> t) ==> (t2 ==> t) ==> t\n *---------------------------------------------------------------------------*)\n\nval OR_ELIM_THM = save_thm(\"OR_ELIM_THM\",\n let val t = ``t:bool``\n and t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val th1 = ASSUME ``^t1 \\/ ^t2``\n val th2 = UNFOLD_OR_CONV (concl th1)\n val th3 = SPEC t (EQ_MP th2 th1)\n val th4 = MP (MP th3 (ASSUME ``^t1 ==> ^t``))\n (ASSUME ``^t2 ==> ^t``)\n val th4 = DISCH ``^t1 ==> ^t`` (DISCH ``^t2 ==> ^t`` th4)\n in\n GEN t (GEN t1 (GEN t2 (DISCH ``^t1 \\/ ^t2`` th4)))\n end);\n\n(* DISJ1, DISJ2, DISJ_CASES should be built here. *)\n\nfun DISJ_CASES_UNION dth ath bth =\n DISJ_CASES dth (DISJ1 ath (concl bth)) (DISJ2 (concl ath) bth);\n\n(*---------------------------------------------------------------------------\n * |- !t. (t ==> F) ==> ~t\n *---------------------------------------------------------------------------*)\n\nval IMP_F = save_thm(\"IMP_F\",\n let val t = ``t:bool``\n val th1 = RIGHT_BETA (AP_THM NOT_DEF t)\n in\n GEN t (DISCH ``^t ==> F``\n (EQ_MP (SYM th1) (ASSUME ``^t ==> F``)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. ~t ==> (t ==> F)\n *---------------------------------------------------------------------------*)\n\nval F_IMP = save_thm(\"F_IMP\",\n let val t = ``t:bool``\n val th1 = RIGHT_BETA(AP_THM NOT_DEF t)\n in\n GEN t (DISCH ``~^t``\n (EQ_MP th1 (ASSUME ``~^t``)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. ~t ==> (t=F)\n *---------------------------------------------------------------------------*)\n\nval NOT_F = save_thm(\"NOT_F\",\n let val t = ``t:bool``\n val th1 = MP (SPEC t F_IMP) (ASSUME ``~ ^t``)\n and th2 = SPEC t FALSITY\n val th3 = IMP_ANTISYM_RULE th1 th2\n in\n GEN t (DISCH ``~^t`` th3)\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. ~(t /\\ ~t)\n *---------------------------------------------------------------------------*)\n\nval NOT_AND = save_thm(\"NOT_AND\",\n let val th = ASSUME ``t /\\ ~t``\n in NOT_INTRO(DISCH ``t /\\ ~t``\n (MP (CONJUNCT2 th) (CONJUNCT1 th)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. (T /\\ t) = t\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSE1 =\n let val t = ``t:bool``\n val th1 = DISCH ``T /\\ ^t`` (CONJUNCT2(ASSUME ``T /\\ ^t``))\n and th2 = DISCH t (CONJ TRUTH (ASSUME t))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t /\\ T) = t\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSE2 =\n let val t = ``t:bool``\n val th1 = DISCH ``^t /\\ T`` (CONJUNCT1(ASSUME ``^t /\\ T``))\n and th2 = DISCH t (CONJ (ASSUME t) TRUTH)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (F /\\ t) = F\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSE3 =\n let val t = ``t:bool``\n val th1 = IMP_TRANS (SPEC t (SPEC ``F`` AND1_THM))\n (SPEC ``F`` FALSITY)\n and th2 = SPEC ``F /\\ ^t`` FALSITY\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t /\\ F) = F\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSE4 =\n let val t = ``t:bool``\n val th1 = IMP_TRANS (SPEC ``F`` (SPEC t AND2_THM))\n (SPEC ``F`` FALSITY)\n and th2 = SPEC ``^t /\\ F`` FALSITY\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t /\\ t) = t\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSE5 =\n let val t = ``t:bool``\n val th1 = DISCH ``^t /\\ ^t`` (CONJUNCT1(ASSUME ``^t /\\ ^t``))\n and th2 = DISCH t (CONJ(ASSUME t)(ASSUME t))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (T /\\ t) = t /\\\n * (t /\\ T) = t /\\\n * (F /\\ t) = F /\\\n * (t /\\ F) = F /\\\n * (t /\\ t) = t\n *---------------------------------------------------------------------------*)\n\nval AND_CLAUSES = save_thm(\"AND_CLAUSES\",\n let val t = ``t:bool``\n in\n GEN t (LIST_CONJ [SPEC t AND_CLAUSE1, SPEC t AND_CLAUSE2,\n SPEC t AND_CLAUSE3, SPEC t AND_CLAUSE4,\n SPEC t AND_CLAUSE5])\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. (T \\/ t) = T\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSE1 =\n let val t = ``t:bool``\n val th1 = DISCH ``T \\/ ^t`` TRUTH\n and th2 = DISCH ``T`` (DISJ1 TRUTH t)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t \\/ T) = T\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSE2 =\n let val t = ``t:bool``\n val th1 = DISCH ``^t \\/ T`` TRUTH\n and th2 = DISCH ``T`` (DISJ2 t TRUTH)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- (F \\/ t) = t\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSE3 =\n let val t = ``t:bool``\n val th1 = DISCH ``F \\/ ^t`` (DISJ_CASES (ASSUME ``F \\/ ^t``)\n (UNDISCH (SPEC t FALSITY))\n (ASSUME t))\n and th2 = SPEC t (SPEC ``F`` OR_INTRO_THM2)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t \\/ F) = t\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSE4 =\n let val t = ``t:bool``\n val th1 = DISCH ``^t \\/ F`` (DISJ_CASES (ASSUME ``^t \\/ F``)\n (ASSUME t)\n (UNDISCH (SPEC t FALSITY)))\n and th2 = SPEC ``F`` (SPEC t OR_INTRO_THM1)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t \\/ t) = t\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSE5 =\n let val t = ``t:bool``\n val th1 = DISCH ``^t \\/ ^t``\n (DISJ_CASES(ASSUME ``^t \\/ ^t``) (ASSUME t) (ASSUME t))\n and th2 = DISCH t (DISJ1(ASSUME t)t)\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (T \\/ t) = T /\\\n * (t \\/ T) = T /\\\n * (F \\/ t) = t /\\\n * (t \\/ F) = t /\\\n * (t \\/ t) = t\n *---------------------------------------------------------------------------*)\n\nval OR_CLAUSES = save_thm(\"OR_CLAUSES\",\n let val t = ``t:bool``\n in\n GEN t (LIST_CONJ [SPEC t OR_CLAUSE1, SPEC t OR_CLAUSE2,\n SPEC t OR_CLAUSE3, SPEC t OR_CLAUSE4,\n SPEC t OR_CLAUSE5])\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. (T ==> t) = t\n *---------------------------------------------------------------------------*)\n\nval IMP_CLAUSE1 =\n let val t = ``t:bool``\n val th1 = DISCH ``T ==> ^t`` (MP (ASSUME ``T ==> ^t``) TRUTH)\n and th2 = DISCH t (DISCH ``T`` (ADD_ASSUM ``T`` (ASSUME t)))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (F ==> t) = T\n *---------------------------------------------------------------------------*)\n\nval IMP_CLAUSE2 =\n let val t = ``t:bool``\n in GEN t (EQT_INTRO(SPEC t FALSITY))\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t ==> T) = T\n *---------------------------------------------------------------------------*)\n\nval IMP_CLAUSE3 =\n let val t = ``t:bool``\n in GEN t (EQT_INTRO(DISCH t (ADD_ASSUM t TRUTH)))\n end;\n\n(*---------------------------------------------------------------------------\n * |- ((T ==> F) = F) /\\ ((F ==> F) = T)\n *---------------------------------------------------------------------------*)\nval IMP_CLAUSE4 = IMP_CLAUSE4\n\n(*---------------------------------------------------------------------------\n * |- !t. (t ==> F) = ~t\n *---------------------------------------------------------------------------*)\n\nval IMP_CLAUSE5 =\n let val t = ``t:bool``\n val th1 = SPEC t IMP_F\n and th2 = SPEC t F_IMP\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (T ==> t) = t /\\\n * (t ==> T) = T /\\\n * (F ==> t) = T /\\\n * (t ==> t) = t /\\\n * (t ==> F) = ~t\n *---------------------------------------------------------------------------*)\n\nval IMP_CLAUSES = save_thm(\"IMP_CLAUSES\",\n let val t = ``t:bool``\n in GEN t\n (LIST_CONJ [SPEC t IMP_CLAUSE1, SPEC t IMP_CLAUSE3,\n SPEC t IMP_CLAUSE2, EQT_INTRO(DISCH t (ASSUME t)),\n SPEC t IMP_CLAUSE5])\n end);\n\n(*----------------------------------------------------------------------------\n * |- (~~t = t) /\\ (~T = F) /\\ (~F = T)\n *---------------------------------------------------------------------------*)\n\nval NOT_CLAUSES = save_thm(\"NOT_CLAUSES\",\n CONJ\n (GEN ``t:bool``\n (IMP_ANTISYM_RULE\n (DISJ_IMP(IMP_ELIM(DISCH ``t:bool`` (ASSUME ``t:bool``))))\n (DISCH ``t:bool``\n (NOT_INTRO(DISCH ``~t`` (UNDISCH (NOT_ELIM(ASSUME ``~t``))))))))\n (CONJ (IMP_ANTISYM_RULE\n (DISCH ``~T``\n (MP (MP (SPEC ``T`` F_IMP) (ASSUME ``~T``)) TRUTH))\n (SPEC ``~T`` FALSITY))\n (IMP_ANTISYM_RULE (DISCH ``~F`` TRUTH)\n (DISCH ``T`` (MP (SPEC ``F`` IMP_F)\n (SPEC ``F`` FALSITY))))));\n\n(*---------------------------------------------------------------------------\n * |- !x. x=x\n *---------------------------------------------------------------------------*)\n\nval EQ_REFL = save_thm(\"EQ_REFL\", GEN ``x : 'a`` (REFL ``x : 'a``));\n\n(*---------------------------------------------------------------------------\n * |- !x. (x=x) = T\n *---------------------------------------------------------------------------*)\n\nval REFL_CLAUSE = save_thm(\"REFL_CLAUSE\",\n GEN ``x: 'a`` (EQT_INTRO(SPEC ``x:'a`` EQ_REFL)));\n\n(*---------------------------------------------------------------------------\n * |- !x y. x=y ==> y=x\n *---------------------------------------------------------------------------*)\n\nval EQ_SYM = save_thm(\"EQ_SYM\",\n let val x = ``x:'a``\n and y = ``y:'a``\n in\n GEN x (GEN y (DISCH ``^x = ^y`` (SYM(ASSUME ``^x = ^y``))))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !x y. (x = y) = (y = x)\n *---------------------------------------------------------------------------*)\n\nval EQ_SYM_EQ = save_thm(\"EQ_SYM_EQ\",\n GEN ``x:'a``\n (GEN ``y:'a``\n (IMP_ANTISYM_RULE (SPEC ``y:'a`` (SPEC ``x:'a`` EQ_SYM))\n (SPEC ``x:'a`` (SPEC ``y:'a`` EQ_SYM)))));\n\n(*---------------------------------------------------------------------------\n * |- !f g. (!x. f x = g x) ==> f=g\n *---------------------------------------------------------------------------*)\n\nval EQ_EXT = save_thm(\"EQ_EXT\",\n let val f = ``f:'a->'b``\n and g = ``g: 'a -> 'b``\n in\n GEN f (GEN g (DISCH ``!x:'a. ^f (x:'a) = ^g (x:'a)``\n (EXT(ASSUME ``!x:'a. ^f (x:'a) = ^g (x:'a)``))))\n end);\n\n(*---------------------------------------------------------------------------\n FUN_EQ_THM |- !f g. (f = g) = !x. f x = g x\n ---------------------------------------------------------------------------*)\n\nval FUN_EQ_THM = save_thm(\"FUN_EQ_THM\",\n let\n val f = ``f:'a->'b``\n val g = ``g: 'a -> 'b``\n val x = ``x: 'a``\n val f_eq_g = mk_eq(f,g)\n val fx_eq_gx = mk_eq(mk_comb(f,x),mk_comb(g,x))\n val uq_f_eq_g = mk_forall (x, fx_eq_gx)\n val th1 = GEN x (AP_THM (ASSUME f_eq_g) x)\n val th2 = MP (SPEC_ALL EQ_EXT) (ASSUME uq_f_eq_g);\n in\n GEN f (GEN g\n (IMP_ANTISYM_RULE (DISCH_ALL th1) (DISCH_ALL th2)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !x y z. x=y /\\ y=z ==> x=z\n *---------------------------------------------------------------------------*)\n\nval EQ_TRANS = save_thm(\"EQ_TRANS\",\n let val x = ``x:'a``\n and y = ``y:'a``\n and z = ``z:'a``\n val xyyz = ``(^x = ^y) /\\ (^y = ^z)``\n in\n GEN x\n (GEN y\n (GEN z\n (DISCH xyyz\n (TRANS (CONJUNCT1(ASSUME xyyz))\n (CONJUNCT2(ASSUME xyyz))))))\n end);\n\n(*---------------------------------------------------------------------------\n * |- ~(T=F) /\\ ~(F=T)\n *---------------------------------------------------------------------------*)\n\nval BOOL_EQ_DISTINCT = save_thm(\"BOOL_EQ_DISTINCT\",\n let val TF = ``T = F``\n and FT = ``F = T``\n in\n CONJ\n (NOT_INTRO(DISCH TF (EQ_MP (ASSUME TF) TRUTH)))\n (NOT_INTRO(DISCH FT (EQ_MP (SYM(ASSUME FT)) TRUTH)))\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t. (T = t) = t\n *---------------------------------------------------------------------------*)\n\nval EQ_CLAUSE1 =\n let val t = ``t:bool``\n val Tt = ``T = ^t``\n val th1 = DISCH Tt (EQ_MP (ASSUME Tt) TRUTH)\n and th2 = DISCH t (SYM(EQT_INTRO(ASSUME t)))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t = T) = t\n *---------------------------------------------------------------------------*)\n\nval EQ_CLAUSE2 =\n let val t = ``t:bool``\n val tT = ``^t = T``\n val th1 = DISCH tT (EQ_MP (SYM (ASSUME tT)) TRUTH)\n and th2 = DISCH t (EQT_INTRO(ASSUME t))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (F = t) = ~t\n *---------------------------------------------------------------------------*)\n\nval EQ_CLAUSE3 =\n let val t = ``t:bool``\n val Ft = ``F = ^t``\n val tF = ``^t = F``\n val th1 = DISCH Ft (MP (SPEC t IMP_F)\n (DISCH t (EQ_MP(SYM(ASSUME Ft))\n (ASSUME t))))\n and th2 = IMP_TRANS (SPEC t NOT_F)\n (DISCH tF (SYM(ASSUME tF)))\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (t = F) = ~t\n *---------------------------------------------------------------------------*)\n\nval EQ_CLAUSE4 =\n let val t = ``t:bool``\n val tF = ``^t = F``\n val th1 = DISCH tF (MP (SPEC t IMP_F)\n (DISCH t (EQ_MP(ASSUME tF)\n (ASSUME t))))\n and th2 = SPEC t NOT_F\n in\n GEN t (IMP_ANTISYM_RULE th1 th2)\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t. (T = t) = t /\\\n * (t = T) = t /\\\n * (F = t) = ~t /\\\n * (t = F) = ~t\n *---------------------------------------------------------------------------*)\n\nval EQ_CLAUSES = save_thm(\"EQ_CLAUSES\",\n let val t = ``t:bool``\n in\n GEN t (LIST_CONJ [SPEC t EQ_CLAUSE1, SPEC t EQ_CLAUSE2,\n SPEC t EQ_CLAUSE3, SPEC t EQ_CLAUSE4])\n end);\n\n(*---------------------------------------------------------------------------\n * |- !t1 t2 :'a. COND T t1 t2 = t1\n *---------------------------------------------------------------------------*)\n\nval COND_CLAUSE1 =\n let val (x,t1,t2,v) = (``x:'a``, ``t1:'a``,\n ``t2:'a``, genvar Type.bool)\n val th1 = RIGHT_BETA(AP_THM\n (RIGHT_BETA(AP_THM\n (RIGHT_BETA(AP_THM COND_DEF ``T``)) t1))t2)\n val TT = EQT_INTRO(REFL ``T``)\n val th2 = SUBST [v |-> SYM TT]\n ``(^v ==> (^x=^t1)) = (^x=^t1)``\n (CONJUNCT1 (SPEC ``^x=^t1`` IMP_CLAUSES))\n and th3 = DISCH ``T=F``\n (MP (SPEC ``^x=^t2`` FALSITY)\n (UNDISCH(MP (SPEC ``T=F`` F_IMP)\n (CONJUNCT1 BOOL_EQ_DISTINCT))))\n val th4 = DISCH ``^x=^t1``\n (CONJ(EQ_MP(SYM th2)(ASSUME ``^x=^t1``))th3)\n and th5 = DISCH ``((T=T) ==> (^x=^t1))/\\((T=F) ==> (^x=^t2))``\n (MP (CONJUNCT1(ASSUME ``((T=T) ==> (^x=^t1))/\\\n ((T=F) ==> (^x=^t2))``))\n (REFL ``T``))\n val th6 = IMP_ANTISYM_RULE th4 th5\n val th7 = TRANS th1 (SYM(SELECT_EQ x th6))\n val th8 = EQ_MP (SYM(BETA_CONV ``(\\ ^x.^x = ^t1) ^t1``)) (REFL t1)\n val th9 = MP (SPEC t1 (SPEC ``\\ ^x.^x = ^t1`` SELECT_AX)) th8\n in\n GEN t1 (GEN t2 (TRANS th7 (EQ_MP (BETA_CONV(concl th9)) th9)))\n end;\n\n(*---------------------------------------------------------------------------\n * |- !tm1 tm2:'a. COND F tm1 tm2 = tm2\n *\n * Note that there is a bound variable conflict if we use use t1\n * and t2 as the variable names. That would be a good test of the\n * substitution algorithm.\n *---------------------------------------------------------------------------*)\n\nval COND_CLAUSE2 =\n let val (x,t1,t2,v) = (``x:'a``, ``tm1:'a``, ``tm2:'a``,\n genvar Type.bool)\n val th1 = RIGHT_BETA(AP_THM\n (RIGHT_BETA(AP_THM\n (RIGHT_BETA(AP_THM COND_DEF ``F``)) t1))t2)\n val FF = EQT_INTRO(REFL ``F``)\n val th2 = SUBST [v |-> SYM FF]\n ``(^v ==> (^x=^t2))=(^x=^t2)``\n (CONJUNCT1(SPEC ``^x=^t2`` IMP_CLAUSES))\n and th3 = DISCH ``F=T`` (MP (SPEC ``^x=^t1`` FALSITY)\n (UNDISCH (MP (SPEC ``F=T`` F_IMP)\n (CONJUNCT2 BOOL_EQ_DISTINCT))))\n val th4 = DISCH ``^x=^t2``\n (CONJ th3 (EQ_MP(SYM th2)(ASSUME ``^x=^t2``)))\n and th5 = DISCH ``((F=T) ==> (^x=^t1)) /\\ ((F=F) ==> (^x=^t2))``\n (MP (CONJUNCT2(ASSUME ``((F=T) ==> (^x=^t1)) /\\\n ((F=F) ==> (^x=^t2))``))\n (REFL ``F``))\n val th6 = IMP_ANTISYM_RULE th4 th5\n val th7 = TRANS th1 (SYM(SELECT_EQ x th6))\n val th8 = EQ_MP (SYM(BETA_CONV ``(\\ ^x.^x = ^t2) ^t2``))\n (REFL t2)\n val th9 = MP (SPEC t2 (SPEC ``\\ ^x.^x = ^t2`` SELECT_AX)) th8\n in\n GEN t1 (GEN t2 (TRANS th7 (EQ_MP (BETA_CONV(concl th9)) th9)))\n end;\n\n(*---------------------------------------------------------------------------\n * |- !t1:'a.!t2:'a. ((T => t1 | t2) = t1) /\\ ((F => t1 | t2) = t2)\n *---------------------------------------------------------------------------*)\n\nval COND_CLAUSES = save_thm(\"COND_CLAUSES\",\n let val (t1,t2) = (``t1:'a``, ``t2:'a``)\n in\n GEN t1 (GEN t2 (CONJ(SPEC t2(SPEC t1 COND_CLAUSE1))\n (SPEC t2(SPEC t1 COND_CLAUSE2))))\n end);\n\n(*--------------------------------------------------------------------- *)\n(* |- b. !t. (b => t | t) = t *)\n(* TFM 90.07.23 *)\n(*--------------------------------------------------------------------- *)\n\nval COND_ID = save_thm(\"COND_ID\",\n let val b = ``b:bool``\n and t = ``t:'a``\n val def = INST_TYPE [beta |-> alpha] COND_DEF\n val th1 = itlist (fn x => RIGHT_BETA o (C AP_THM x))\n [t,t,b] def\n val p = genvar bool\n val asm1 = ASSUME ``((^b=T)==>^p) /\\ ((^b=F)==>^p)``\n val th2 = DISJ_CASES (SPEC b BOOL_CASES_AX)\n (UNDISCH (CONJUNCT1 asm1))\n (UNDISCH (CONJUNCT2 asm1))\n val imp1 = DISCH (concl asm1) th2\n val asm2 = ASSUME p\n val imp2 = DISCH p (CONJ (DISCH ``^b=T``\n (ADD_ASSUM ``^b=T`` asm2))\n (DISCH ``^b=F``\n (ADD_ASSUM ``^b=F`` asm2)))\n val lemma = SPEC ``x:'a = ^t``\n (GEN p (IMP_ANTISYM_RULE imp1 imp2))\n val th3 = TRANS th1 (SELECT_EQ ``x:'a`` lemma)\n val th4 = EQ_MP (SYM(BETA_CONV ``(\\x.x = ^t) ^t``))\n (REFL t)\n val th5 = MP (SPEC t (SPEC ``\\x.x = ^t`` SELECT_AX)) th4\n val lemma2 = EQ_MP (BETA_CONV(concl th5)) th5\n in\n GEN b (GEN t (TRANS th3 lemma2))\n end);\n\n(*---------------------------------------------------------------------------\n SELECT_THM = |- !P. P (@x. P x) = ?x. P x\n ---------------------------------------------------------------------------*)\n\nval SELECT_THM = save_thm(\"SELECT_THM\",\n GEN ``P:'a->bool``\n (SYM (RIGHT_BETA(RIGHT_BETA\n (AP_THM EXISTS_DEF ``\\x:'a. P x:bool``)))));\n\n(* ---------------------------------------------------------------------*)\n(* SELECT_REFL = |- !x. (@y. y = x) = x *)\n(* ---------------------------------------------------------------------*)\n\nval SELECT_REFL = save_thm(\"SELECT_REFL\",\n let val th1 = SPEC ``x:'a`` (SPEC ``\\y:'a. y = x`` SELECT_AX)\n val ths = map BETA_CONV [``(\\y:'a. y = x) x``,\n ``(\\y:'a. y = x)(@y. y = x)``]\n val th2 = SUBST[``u:bool`` |-> el 1 ths, ``v:bool`` |-> el 2 ths]\n ``u ==> v`` th1\n in\n GEN ``x:'a`` (MP th2 (REFL ``x:'a``))\n end);\n\nval SELECT_REFL_2 = save_thm(\"SELECT_REFL_2\",\n let val x = mk_var(\"x\", Type.alpha)\n val y = mk_var(\"y\", Type.alpha)\n val th1 = REFL x\n val th2 = EXISTS (mk_exists(y,mk_eq(x,y)),x) th1\n val th3 = SPEC y (SPEC (mk_abs(y,mk_eq(x,y))) SELECT_AX)\n val th4 = UNDISCH th3\n val th5 = DISCH_ALL(SYM (EQ_MP (BETA_CONV (concl th4)) th4))\n val th6 = UNDISCH(CONV_RULE (RATOR_CONV (RAND_CONV BETA_CONV)) th5)\n in\n GEN x (CHOOSE(y,th2) th6)\n end);\n\n(*---------------------------------------------------------------------------*)\n(* SELECT_UNIQUE = |- !P x. (!y. P y = (y = x)) ==> ($@ P = x) *)\n(*---------------------------------------------------------------------------*)\n\nval SELECT_UNIQUE = save_thm(\"SELECT_UNIQUE\",\n let fun mksym tm = DISCH tm (SYM(ASSUME tm))\n val th0 = IMP_ANTISYM_RULE (mksym ``y:'a = x``)\n (mksym ``x:'a = y``)\n val th1 = SPEC ``y:'a`` (ASSUME ``!y:'a. P y = (y = x)``)\n val th2 = EXT(GEN ``y:'a`` (TRANS th1 th0))\n val th3 = AP_TERM ``$@ :('a->bool)->'a`` th2\n val th4 = TRANS (BETA_CONV ``(\\y:'a. y = x) y``) th0\n val th5 = AP_TERM ``$@ :('a->bool)->'a`` (EXT(GEN ``y:'a`` th4))\n val th6 = TRANS (TRANS th3 (SYM th5)) (SPEC ``x:'a`` SELECT_REFL)\n in\n GENL [``P:'a->bool``, ``x:'a``]\n (DISCH ``!y:'a. P y = (y = x)`` th6)\n end);\n\n(* ----------------------------------------------------------------------\n SELECT_ELIM_THM = |- !P Q. (?x. P x) /\\ (!x. P x ==> Q x) ==> Q ($@ P)\n ---------------------------------------------------------------------- *)\n\nval SELECT_ELIM_THM = let\n val P = mk_var(\"P\", alpha --> bool)\n val Q = mk_var(\"Q\", alpha --> bool)\n val x = mk_var(\"x\", alpha)\n val Px = mk_comb(P, x)\n val Qx = mk_comb(Q, x)\n val PimpQ = mk_imp(Px, Qx)\n val allPimpQ = mk_forall (x, PimpQ)\n val exPx = mk_exists (x, Px)\n val selP = mk_comb(prim_mk_const{Thy = \"min\", Name = \"@\"}, P)\n val asm_t = mk_conj(exPx, allPimpQ)\n val asm = ASSUME asm_t\n val (ex_th, forall_th) = CONJ_PAIR asm\n val imp_th = SPEC selP forall_th\n val Px_th = ASSUME Px\n val PselP_th0 = UNDISCH (SPEC_ALL SELECT_AX)\n val PselP_th = CHOOSE(x, ex_th) PselP_th0\nin\n save_thm(\"SELECT_ELIM_THM\", GENL [P, Q] (DISCH_ALL (MP imp_th PselP_th)))\nend\n\n(* -------------------------------------------------------------------------*)\n(* NOT_FORALL_THM = |- !P. ~(!x. P x) = ?x. ~P x *)\n(* -------------------------------------------------------------------------*)\n\nval NOT_FORALL_THM = save_thm(\"NOT_FORALL_THM\",\n let val f = ``P:'a->bool``\n val x = ``x:'a``\n val t = mk_comb(f,x)\n val all = mk_forall (x, t)\n and exists = mk_exists(x,mk_neg t)\n val nott = ASSUME (mk_neg t)\n val th1 = DISCH all (MP nott (SPEC x (ASSUME all)))\n val imp1 = DISCH exists (CHOOSE (x, ASSUME exists) (NOT_INTRO th1))\n val th2 = CCONTR t (MP (ASSUME(mk_neg exists)) (EXISTS(exists,x)nott))\n val th3 = CCONTR exists (MP (ASSUME (mk_neg all)) (GEN x th2))\n val imp2 = DISCH (mk_neg all) th3\n in\n GEN f (IMP_ANTISYM_RULE imp2 imp1)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* NOT_EXISTS_THM = |- !P. ~(?x. P x) = (!x. ~P x) *)\n(* ------------------------------------------------------------------------- *)\n\nval NOT_EXISTS_THM = save_thm(\"NOT_EXISTS_THM\",\n let val f = ``P:'a->bool``\n val x = ``x:'a``\n val t = mk_comb(f,x)\n val tm = mk_neg(mk_exists(x,t))\n val all = mk_forall (x, mk_neg t)\n val asm1 = ASSUME t\n val thm1 = MP (ASSUME tm) (EXISTS (rand tm, x) asm1)\n val imp1 = DISCH tm (GEN x (NOT_INTRO (DISCH t thm1)))\n val asm2 = ASSUME all and asm3 = ASSUME (rand tm)\n val thm2 = DISCH (rand tm) (CHOOSE (x,asm3) (MP (SPEC x asm2) asm1))\n val imp2 = DISCH all (NOT_INTRO thm2)\n in\n GEN f (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* FORALL_AND_THM |- !P Q. (!x. P x /\\ Q x) = ((!x. P x) /\\ (!x. Q x)) *)\n(* ------------------------------------------------------------------------- *)\n\nval FORALL_AND_THM = save_thm(\"FORALL_AND_THM\",\n let val f = ``P:'a->bool``\n val g = ``Q:'a->bool``\n val x = ``x:'a``\n val th1 = ASSUME ``!x:'a. (P x) /\\ (Q x)``\n val imp1 = (uncurry CONJ) ((GEN x ## GEN x) (CONJ_PAIR (SPEC x th1)))\n val th2 = ASSUME ``(!x:'a. P x) /\\ (!x:'a. Q x)``\n val imp2 = GEN x (uncurry CONJ ((SPEC x ## SPEC x) (CONJ_PAIR th2)))\n in\n GENL [f,g] (IMP_ANTISYM_RULE (DISCH_ALL imp1) (DISCH_ALL imp2))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_AND_FORALL_THM = |- !P Q. (!x. P x) /\\ Q = (!x. P x /\\ Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_AND_FORALL_THM = save_thm(\"LEFT_AND_FORALL_THM\",\n let val x = ``x:'a``\n val f = ``P:'a->bool``\n val Q = ``Q:bool``\n val th1 = ASSUME ``(!x:'a. P x) /\\ Q``\n val imp1 = GEN x ((uncurry CONJ) ((SPEC x ## I) (CONJ_PAIR th1)))\n val th2 = ASSUME ``!x:'a. P x /\\ Q``\n val imp2 = (uncurry CONJ) ((GEN x ## I) (CONJ_PAIR (SPEC x th2)))\n in\n GENL [f,Q] (IMP_ANTISYM_RULE (DISCH_ALL imp1) (DISCH_ALL imp2))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_AND_FORALL_THM = |- !P Q. P /\\ (!x. Q x) = (!x. P /\\ Q x) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_AND_FORALL_THM = save_thm(\"RIGHT_AND_FORALL_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val th1 = ASSUME ``P /\\ (!x:'a. Q x)``\n val imp1 = GEN x ((uncurry CONJ) ((I ## SPEC x) (CONJ_PAIR th1)))\n val th2 = ASSUME ``!x:'a. P /\\ Q x``\n val imp2 = (uncurry CONJ) ((I ## GEN x) (CONJ_PAIR (SPEC x th2)))\n in\n GENL [P,g] (IMP_ANTISYM_RULE (DISCH_ALL imp1) (DISCH_ALL imp2))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* EXISTS_OR_THM |- !P Q. (?x. P x \\/ Q x) = ((?x. P x) \\/ (?x. Q x)) *)\n(* ------------------------------------------------------------------------- *)\n\nval EXISTS_OR_THM = save_thm(\"EXISTS_OR_THM\",\n let val f = ``P:'a->bool``\n val g = ``Q:'a->bool``\n val x = ``x:'a``\n val P = mk_comb(f,x)\n val Q = mk_comb(g,x)\n val tm = mk_exists (x,mk_disj(P,Q))\n val ep = mk_exists (x,P)\n and eq = mk_exists(x,Q)\n val Pth = EXISTS(ep,x)(ASSUME P)\n and Qth = EXISTS(eq,x)(ASSUME Q)\n val thm1 = DISJ_CASES_UNION (ASSUME(mk_disj(P,Q))) Pth Qth\n val imp1 = DISCH tm (CHOOSE (x,ASSUME tm) thm1)\n val t1 = DISJ1 (ASSUME P) Q and t2 = DISJ2 P (ASSUME Q)\n val th1 = EXISTS(tm,x) t1 and th2 = EXISTS(tm,x) t2\n val e1 = CHOOSE (x,ASSUME ep) th1 and e2 = CHOOSE (x,ASSUME eq) th2\n val thm2 = DISJ_CASES (ASSUME(mk_disj(ep,eq))) e1 e2\n val imp2 = DISCH (mk_disj(ep,eq)) thm2\n in\n GENL [f,g] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_OR_EXISTS_THM = |- (?x. P x) \\/ Q = (?x. P x \\/ Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_OR_EXISTS_THM = save_thm(\"LEFT_OR_EXISTS_THM\",\n let val x = ``x:'a``\n val Q = ``Q:bool``\n val f = ``P:'a->bool``\n val P = mk_comb(f,x)\n val ep = mk_exists(x,P)\n val tm = mk_disj(ep,Q)\n val otm = mk_exists(x,mk_disj(P,Q))\n val t1 = DISJ1 (ASSUME P) Q\n val t2 = DISJ2 P (ASSUME Q)\n val th1 = EXISTS(otm,x) t1 and th2 = EXISTS(otm,x) t2\n val thm1 = DISJ_CASES (ASSUME tm) (CHOOSE(x,ASSUME ep)th1) th2\n val imp1 = DISCH tm thm1\n val Pth = EXISTS(ep,x)(ASSUME P) and Qth = ASSUME Q\n val thm2 = DISJ_CASES_UNION (ASSUME(mk_disj(P,Q))) Pth Qth\n val imp2 = DISCH otm (CHOOSE (x,ASSUME otm) thm2)\n in\n GENL [f,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_OR_EXISTS_THM = |- P \\/ (?x. Q x) = (?x. P \\/ Q x) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_OR_EXISTS_THM = save_thm(\"RIGHT_OR_EXISTS_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val Q = mk_comb(g,x)\n val eq = mk_exists(x,Q)\n val tm = mk_disj(P,eq)\n val otm = mk_exists(x,mk_disj(P,Q))\n val t1 = DISJ1 (ASSUME P) Q and t2 = DISJ2 P (ASSUME Q)\n val th1 = EXISTS(otm,x) t1 and th2 = EXISTS(otm,x) t2\n val thm1 = DISJ_CASES (ASSUME tm) th1 (CHOOSE(x,ASSUME eq)th2)\n val imp1 = DISCH tm thm1\n val Qth = EXISTS(eq,x)(ASSUME Q) and Pth = ASSUME P\n val thm2 = DISJ_CASES_UNION (ASSUME(mk_disj(P,Q))) Pth Qth\n val imp2 = DISCH otm (CHOOSE (x,ASSUME otm) thm2)\n in\n GENL [P,g] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* BOTH_EXISTS_AND_THM = |- !P Q. (?x. P /\\ Q) = (?x. P) /\\ (?x. Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval BOTH_EXISTS_AND_THM = save_thm(\"BOTH_EXISTS_AND_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val Q = ``Q:bool``\n val t = mk_conj(P,Q)\n val exi = mk_exists(x,t)\n val (t1,t2) = CONJ_PAIR (ASSUME t)\n val t11 = EXISTS ((mk_exists(x,P)),x) t1\n val t21 = EXISTS ((mk_exists(x,Q)),x) t2\n val imp1 = DISCH_ALL (CHOOSE (x,\n ASSUME (mk_exists(x,mk_conj(P,Q))))\n (CONJ t11 t21))\n val th21 = EXISTS (exi,x) (CONJ (ASSUME P) (ASSUME Q))\n val th22 = CHOOSE(x,ASSUME(mk_exists(x,P))) th21\n val th23 = CHOOSE(x,ASSUME(mk_exists(x,Q))) th22\n val (u1,u2) =\n CONJ_PAIR (ASSUME (mk_conj(mk_exists(x,P),mk_exists(x,Q))))\n val th24 = PROVE_HYP u1 (PROVE_HYP u2 th23)\n val imp2 = DISCH_ALL th24\n in\n GENL [P,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_EXISTS_AND_THM = |- !P Q. (?x. P x /\\ Q) = (?x. P x) /\\ Q *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_EXISTS_AND_THM = save_thm(\"LEFT_EXISTS_AND_THM\",\n let val x = ``x:'a``\n val f = ``P:'a->bool``\n val P = mk_comb(f,x)\n val Q = ``Q:bool``\n val t = mk_conj(P,Q)\n val exi = mk_exists(x,t)\n val (t1,t2) = CONJ_PAIR (ASSUME t)\n val t11 = EXISTS ((mk_exists(x,P)),x) t1\n val imp1 =\n DISCH_ALL\n (CHOOSE\n (x, ASSUME (mk_exists(x,mk_conj(P,Q))))\n (CONJ t11 t2))\n val th21 = EXISTS (exi,x) (CONJ (ASSUME P) (ASSUME Q))\n val th22 = CHOOSE(x,ASSUME(mk_exists(x,P))) th21\n val (u1,u2) = CONJ_PAIR(ASSUME(mk_conj(mk_exists(x,P), Q)))\n val th23 = PROVE_HYP u1 (PROVE_HYP u2 th22)\n val imp2 = DISCH_ALL th23\n in\n GENL [f,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_EXISTS_AND_THM = |- !P Q. (?x. P /\\ Q x) = P /\\ (?x. Q x) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_EXISTS_AND_THM = save_thm(\"RIGHT_EXISTS_AND_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val Q = mk_comb(g,x)\n val t = mk_conj(P,Q)\n val exi = mk_exists(x,t)\n val (t1,t2) = CONJ_PAIR (ASSUME t)\n val t21 = EXISTS ((mk_exists(x,Q)),x) t2\n val imp1 =\n DISCH_ALL\n (CHOOSE\n (x, ASSUME (mk_exists(x,mk_conj(P,Q)))) (CONJ t1 t21))\n val th21 = EXISTS (exi,x) (CONJ (ASSUME P) (ASSUME Q))\n val th22 = CHOOSE(x,ASSUME(mk_exists(x,Q))) th21\n val (u1,u2) = CONJ_PAIR (ASSUME (mk_conj(P, mk_exists(x,Q))))\n val th23 = PROVE_HYP u1 (PROVE_HYP u2 th22)\n val imp2 = DISCH_ALL th23\n in\n GENL [P,g] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* BOTH_FORALL_OR_THM = |- !P Q. (!x. P \\/ Q) = (!x. P) \\/ (!x. Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval BOTH_FORALL_OR_THM = save_thm(\"BOTH_FORALL_OR_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val Q = ``Q:bool``\n val imp11 = DISCH_ALL (SPEC x (ASSUME (mk_forall (x, P))))\n val imp12 = DISCH_ALL (GEN x (ASSUME P))\n val fath = IMP_ANTISYM_RULE imp11 imp12\n val th1 = REFL (mk_forall (x, mk_disj(P,Q)))\n val th2 = CONV_RULE (RAND_CONV\n (K (INST [P |-> mk_disj(P,Q)] fath))) th1\n val th3 = CONV_RULE(RAND_CONV(RATOR_CONV(RAND_CONV(K(SYM fath))))) th2\n val th4 = CONV_RULE(RAND_CONV(RAND_CONV(K(SYM(INST[P|->Q] fath))))) th3\n in\n GENL [P,Q] th4\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_FORALL_OR_THM = |- !P Q. (!x. P x \\/ Q) = (!x. P x) \\/ Q *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_FORALL_OR_THM = save_thm(\"LEFT_FORALL_OR_THM\",\n let val x = ``x:'a``\n val f = ``P:'a->bool``\n val P = mk_comb(f,x)\n val Q = ``Q:bool``\n val tm = mk_forall (x, mk_disj(P,Q))\n val thm1 = SPEC x (ASSUME tm)\n val thm2 = CONTR P (MP (ASSUME (mk_neg Q)) (ASSUME Q))\n val thm3 = DISJ1 (GEN x (DISJ_CASES thm1 (ASSUME P) thm2)) Q\n val thm4 = DISJ2 (mk_forall (x, P)) (ASSUME Q)\n val imp1 = DISCH tm (DISJ_CASES (SPEC Q EXCLUDED_MIDDLE) thm4 thm3)\n val thm5 = SPEC x (ASSUME (mk_forall(x,P)))\n val thm6 = ASSUME Q\n val imp2 = DISCH_ALL (GEN x (DISJ_CASES_UNION\n (ASSUME(mk_disj(mk_forall(x,P), Q))) thm5 thm6))\n in\n GENL [Q,f] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_FORALL_OR_THM = |- !P Q. (!x. P \\/ Q x) = P \\/ (!x. Q x) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_FORALL_OR_THM = save_thm(\"RIGHT_FORALL_OR_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val Q = mk_comb(g,x)\n val tm = mk_forall(x,mk_disj(P,Q))\n val thm1 = SPEC x (ASSUME tm)\n val thm2 = CONTR Q (MP (ASSUME (mk_neg P)) (ASSUME P))\n val thm3 = DISJ2 P (GEN x (DISJ_CASES thm1 thm2 (ASSUME Q)))\n val thm4 = DISJ1 (ASSUME P) (mk_forall(x,Q))\n val imp1 = DISCH tm (DISJ_CASES (SPEC P EXCLUDED_MIDDLE) thm4 thm3)\n val thm5 = ASSUME P\n val thm6 = SPEC x (ASSUME (mk_forall(x,Q)))\n val imp2 = DISCH_ALL (GEN x (DISJ_CASES_UNION\n (ASSUME (mk_disj(P, mk_forall(x,Q))))\n thm5 thm6))\n in\n GENL [P,g] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* BOTH_FORALL_IMP_THM = |- (!x. P ==> Q) = ((?x.P) ==> (!x.Q)) *)\n(* ------------------------------------------------------------------------- *)\n\nval BOTH_FORALL_IMP_THM = save_thm(\"BOTH_FORALL_IMP_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val Q = ``Q:bool``\n val tm = mk_forall(x, mk_imp(P,Q))\n val asm = mk_exists(x,P)\n val th1 = GEN x (CHOOSE(x,ASSUME asm)(UNDISCH(SPEC x (ASSUME tm))))\n val imp1 = DISCH tm (DISCH asm th1)\n val cncl = rand(concl imp1)\n val th2 = SPEC x (MP (ASSUME cncl) (EXISTS (asm,x) (ASSUME P)))\n val imp2 = DISCH cncl (GEN x (DISCH P th2))\n in\n GENL [P,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_FORALL_IMP_THM = |- (!x. P[x]==>Q) = ((?x.P[x]) ==> Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_FORALL_IMP_THM = save_thm(\"LEFT_FORALL_IMP_THM\",\n let val x = ``x:'a``\n val f = ``P:'a->bool``\n val P = mk_comb(f,x)\n val Q = ``Q:bool``\n val tm = mk_forall(x, mk_imp(P,Q))\n val asm = mk_exists(x,P)\n val th1 = CHOOSE(x,ASSUME asm)(UNDISCH(SPEC x (ASSUME tm)))\n val imp1 = DISCH tm (DISCH asm th1)\n val cncl = rand(concl imp1)\n val th2 = MP (ASSUME cncl) (EXISTS (asm,x) (ASSUME P))\n val imp2 = DISCH cncl (GEN x (DISCH P th2))\n in\n GENL [f,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_FORALL_IMP_THM = |- (!x. P==>Q[x]) = (P ==> (!x.Q[x])) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_FORALL_IMP_THM = save_thm(\"RIGHT_FORALL_IMP_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val Q = mk_comb(g,x)\n val tm = mk_forall(x, mk_imp(P,Q))\n val imp1 = DISCH P(GEN x(UNDISCH(SPEC x(ASSUME tm))))\n val cncl = concl imp1\n val imp2 = GEN x (DISCH P(SPEC x(UNDISCH (ASSUME cncl))))\n in\n GENL [P,g] (IMP_ANTISYM_RULE (DISCH tm imp1) (DISCH cncl imp2))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* BOTH_EXISTS_IMP_THM = |- (?x. P ==> Q) = ((!x.P) ==> (?x.Q)) *)\n(* ------------------------------------------------------------------------- *)\n\nval BOTH_EXISTS_IMP_THM = save_thm(\"BOTH_EXISTS_IMP_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val Q = ``Q:bool``\n val tm = mk_exists(x,mk_imp(P,Q))\n val eQ = mk_exists(x,Q)\n val aP = mk_forall(x,P)\n val thm1 = EXISTS(eQ,x)(UNDISCH(ASSUME(mk_imp(P,Q))))\n val thm2 = DISCH aP (PROVE_HYP (SPEC x (ASSUME aP)) thm1)\n val imp1 = DISCH tm (CHOOSE(x,ASSUME tm) thm2)\n val thm2 = CHOOSE(x,UNDISCH (ASSUME (rand(concl imp1)))) (ASSUME Q)\n val thm3 = DISCH P (PROVE_HYP (GEN x (ASSUME P)) thm2)\n val imp2 = DISCH (rand(concl imp1)) (EXISTS(tm,x) thm3)\n in\n GENL [P,Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* LEFT_EXISTS_IMP_THM = |- (?x. P[x] ==> Q) = ((!x.P[x]) ==> Q) *)\n(* ------------------------------------------------------------------------- *)\n\nval LEFT_EXISTS_IMP_THM = save_thm(\"LEFT_EXISTS_IMP_THM\",\n let val x = ``x:'a``\n val f = ``P:'a->bool``\n val P = mk_comb(f,x)\n val Q = ``Q:bool``\n val tm = mk_exists(x, mk_imp(P,Q))\n val allp = mk_forall(x,P)\n val th1 = SPEC x (ASSUME allp)\n val thm1 = MP (ASSUME(mk_imp(P,Q))) th1\n val imp1 = DISCH tm (CHOOSE(x,ASSUME tm)(DISCH allp thm1))\n val otm = rand(concl imp1)\n val thm2 = EXISTS(tm,x)(DISCH P (UNDISCH(ASSUME otm)))\n val nex = mk_exists(x,mk_neg P)\n val asm1 = EXISTS (nex, x) (ASSUME (mk_neg P))\n val th2 = CCONTR P (MP (ASSUME (mk_neg nex)) asm1)\n val th3 = CCONTR nex (MP (ASSUME (mk_neg allp)) (GEN x th2))\n val thm4 = DISCH P (CONTR Q (UNDISCH (ASSUME (mk_neg P))))\n val thm5 = CHOOSE(x,th3)(EXISTS(tm,x)thm4)\n val thm6 = DISJ_CASES (SPEC allp EXCLUDED_MIDDLE) thm2 thm5\n val imp2 = DISCH otm thm6\n in\n GENL [f, Q] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* RIGHT_EXISTS_IMP_THM = |- (?x. P ==> Q[x]) = (P ==> (?x.Q[x])) *)\n(* ------------------------------------------------------------------------- *)\n\nval RIGHT_EXISTS_IMP_THM = save_thm(\"RIGHT_EXISTS_IMP_THM\",\n let val x = ``x:'a``\n val P = ``P:bool``\n val g = ``Q:'a->bool``\n val Q = mk_comb(g,x)\n val tm = mk_exists(x,mk_imp(P,Q))\n val thm1 = EXISTS (mk_exists(x,Q),x)\n (UNDISCH(ASSUME(mk_imp(P,Q))))\n val imp1 = DISCH tm (CHOOSE(x,ASSUME tm) (DISCH P thm1))\n val thm2 = UNDISCH (ASSUME (rand(concl imp1)))\n val thm3 = CHOOSE (x,thm2) (EXISTS (tm,x) (DISCH P (ASSUME Q)))\n val thm4 = EXISTS(tm,x)(DISCH P(CONTR Q(UNDISCH(ASSUME(mk_neg P)))))\n val thm5 = DISJ_CASES (SPEC P EXCLUDED_MIDDLE) thm3 thm4\n val imp2 = DISCH(rand(concl imp1)) thm5\n in\n GENL [P,g] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* --------------------------------------------------------------------- *)\n(* OR_IMP_THM = |- !A B. (A = B \\/ A) = (B ==> A) *)\n(* [TFM 90.06.28] *)\n(* --------------------------------------------------------------------- *)\n\nval OR_IMP_THM = save_thm(\"OR_IMP_THM\",\n let val t1 = ``A:bool`` and t2 = ``B:bool``\n val asm1 = ASSUME ``^t1 = (^t2 \\/ ^t1)``\n and asm2 = EQT_INTRO(ASSUME t2)\n val th1 = SUBST [t2 |-> asm2] (concl asm1) asm1\n val th2 = TRANS th1 (CONJUNCT1 (SPEC t1 OR_CLAUSES))\n val imp1 = DISCH (concl asm1) (DISCH t2 (EQT_ELIM th2))\n val asm3 = ASSUME ``^t2 ==> ^t1``\n and asm4 = ASSUME ``^t2 \\/ ^t1``\n val th3 = DISJ_CASES asm4 (MP asm3 (ASSUME t2)) (ASSUME t1)\n val th4 = DISCH (concl asm4) th3\n and th5 = DISCH t1 (DISJ2 t2 (ASSUME t1))\n val imp2 = DISCH ``^t2 ==> ^t1`` (IMP_ANTISYM_RULE th5 th4)\n in\n GEN t1 (GEN t2 (IMP_ANTISYM_RULE imp1 imp2))\n end);\n\n(* --------------------------------------------------------------------- *)\n(* NOT_IMP = |- !A B. ~(A ==> B) = A /\\ ~B *)\n(* [TFM 90.07.09] *)\n(* --------------------------------------------------------------------- *)\n\nval NOT_IMP = save_thm(\"NOT_IMP\",\nlet val t1 = ``A:bool`` and t2 = ``B:bool``\n val asm1 = ASSUME ``~(^t1 ==> ^t2)``\n val thm1 = SUBST [t1 |-> EQF_INTRO (ASSUME (mk_neg t1))] (concl asm1) asm1\n val thm2 = CCONTR t1 (MP thm1 (DISCH``F``(CONTR t2 (ASSUME``F``))))\n val thm3 = SUBST [t2 |-> EQT_INTRO (ASSUME t2)] (concl asm1) asm1\n val thm4 = NOT_INTRO(DISCH t2 (MP thm3 (DISCH t1 (ADD_ASSUM t1 TRUTH))))\n val imp1 = DISCH (concl asm1) (CONJ thm2 thm4)\n val conj = ASSUME ``^t1 /\\ ~^t2``\n val (asm2,asm3) = (CONJUNCT1 conj, CONJUNCT2 conj)\n val asm4 = ASSUME ``^t1 ==> ^t2``\n val thm5 = MP (SUBST [t2 |-> EQF_INTRO asm3] (concl asm4) asm4) asm2\n val imp2 = DISCH ``^t1 /\\ ~ ^t2``\n (NOT_INTRO(DISCH ``^t1 ==> ^t2`` thm5))\n in\n GEN t1 (GEN t2 (IMP_ANTISYM_RULE imp1 imp2))\n end);\n\n(* --------------------------------------------------------------------- *)\n(* DISJ_ASSOC: |- !A B C. A \\/ B \\/ C = (A \\/ B) \\/ C *)\n(* --------------------------------------------------------------------- *)\n\nval DISJ_ASSOC = save_thm(\"DISJ_ASSOC\",\nlet val t1 = ``A:bool`` and t2 = ``B:bool`` and t3 = ``C:bool``\n val at1 = DISJ1 (DISJ1 (ASSUME t1) t2) t3 and\n at2 = DISJ1 (DISJ2 t1 (ASSUME t2)) t3 and\n at3 = DISJ2 (mk_disj(t1,t2)) (ASSUME t3)\n val thm = DISJ_CASES (ASSUME (mk_disj(t2,t3))) at2 at3\n val thm1 = DISJ_CASES (ASSUME (mk_disj(t1,mk_disj(t2,t3)))) at1 thm\n val at1 = DISJ1 (ASSUME t1) (mk_disj(t2,t3)) and\n at2 = DISJ2 t1 (DISJ1 (ASSUME t2) t3) and\n at3 = DISJ2 t1 (DISJ2 t2 (ASSUME t3))\n val thm = DISJ_CASES (ASSUME (mk_disj(t1,t2))) at1 at2\n val thm2 = DISJ_CASES (ASSUME (mk_disj(mk_disj(t1,t2),t3))) thm at3\n val imp1 = DISCH (mk_disj(t1,mk_disj(t2,t3))) thm1 and\n imp2 = DISCH (mk_disj(mk_disj(t1,t2),t3)) thm2\n in\n GENL [t1,t2,t3] (IMP_ANTISYM_RULE imp1 imp2)\n end);\n\n(* --------------------------------------------------------------------- *)\n(* DISJ_SYM: |- !A B. A \\/ B = B \\/ A *)\n(* --------------------------------------------------------------------- *)\n\nval DISJ_SYM = save_thm(\"DISJ_SYM\",\nlet val t1 = ``A:bool`` and t2 = ``B:bool``\n val th1 = DISJ1 (ASSUME t1) t2 and th2 = DISJ2 t1 (ASSUME t2)\n val thm1 = DISJ_CASES (ASSUME(mk_disj(t2,t1))) th2 th1\n val th1 = DISJ1 (ASSUME t2) t1 and th2 = DISJ2 t2 (ASSUME t1)\n val thm2 = DISJ_CASES (ASSUME(mk_disj(t1,t2))) th2 th1\n val imp1 = DISCH (mk_disj(t2,t1)) thm1 and\n imp2 = DISCH (mk_disj(t1,t2)) thm2\n in\n GENL [t1,t2] (IMP_ANTISYM_RULE imp2 imp1)\n end);\n\nval DISJ_COMM = save_thm(\"DISJ_COMM\", DISJ_SYM);\n\n(* --------------------------------------------------------------------- *)\n(* DE_MORGAN_THM: *)\n(* |- !A B. (~(t1 /\\ t2) = ~t1 \\/ ~t2) /\\ (~(t1 \\/ t2) = ~t1 /\\ ~t2) *)\n(* --------------------------------------------------------------------- *)\n\nval DE_MORGAN_THM = save_thm(\"DE_MORGAN_THM\",\nlet val t1 = ``A:bool`` and t2 = ``B:bool``\n val thm1 =\n let val asm1 = ASSUME ``~(^t1 /\\ ^t2)``\n val cnj = MP asm1 (CONJ (ASSUME t1) (ASSUME t2))\n val imp1 =\n let val case1 = DISJ2 ``~^t1`` (NOT_INTRO(DISCH t2 cnj))\n val case2 = DISJ1 (ASSUME ``~ ^t1``) ``~ ^t2``\n in DISJ_CASES (SPEC t1 EXCLUDED_MIDDLE) case1 case2\n end\n val th1 = MP (ASSUME ``~^t1``)\n (CONJUNCT1 (ASSUME ``^t1 /\\ ^t2``))\n val th2 = MP (ASSUME ``~^t2``)\n (CONJUNCT2 (ASSUME ``^t1 /\\ ^t2``))\n val imp2 =\n let val fth = DISJ_CASES (ASSUME ``~^t1 \\/ ~^t2``) th1 th2\n in DISCH ``~^t1 \\/ ~^t2``\n (NOT_INTRO(DISCH ``^t1 /\\ ^t2`` fth))\n end\n in\n IMP_ANTISYM_RULE (DISCH ``~(^t1 /\\ ^t2)`` imp1) imp2\n end\n val thm2 =\n let val asm1 = ASSUME ``~(^t1 \\/ ^t2)``\n val imp1 =\n let val th1 = NOT_INTRO (DISCH t1(MP asm1 (DISJ1 (ASSUME t1) t2)))\n val th2 = NOT_INTRO (DISCH t2 (MP asm1 (DISJ2 t1 (ASSUME t2))))\n in DISCH ``~(^t1 \\/ ^t2)`` (CONJ th1 th2)\n end\n val imp2 =\n let val asm = ASSUME ``^t1 \\/ ^t2``\n val a1 = CONJUNCT1(ASSUME ``~^t1 /\\ ~^t2``) and\n a2 = CONJUNCT2(ASSUME ``~^t1 /\\ ~^t2``)\n val fth = DISJ_CASES asm (UNDISCH a1) (UNDISCH a2)\n in DISCH ``~^t1 /\\ ~^t2``\n (NOT_INTRO(DISCH ``^t1 \\/ ^t2`` fth))\n end\n in IMP_ANTISYM_RULE imp1 imp2\n end\n in GEN t1 (GEN t2 (CONJ thm1 thm2))\n end);\n\n(* -------------------------------------------------------------------------*)\n(* Distributive laws: *)\n(* *)\n(* LEFT_AND_OVER_OR |- !A B C. A /\\ (B \\/ C) = A /\\ B \\/ A /\\ C *)\n(* *)\n(* RIGHT_AND_OVER_OR |- !A B C. (B \\/ C) /\\ A = B /\\ A \\/ C /\\ A *)\n(* *)\n(* LEFT_OR_OVER_AND |- !A B C. A \\/ B /\\ C = (A \\/ B) /\\ (A \\/ C) *)\n(* *)\n(* RIGHT_OR_OVER_AND |- !A B C. B /\\ C \\/ A = (B \\/ A) /\\ (C \\/ A) *)\n(* -------------------------------------------------------------------------*)\n\nval LEFT_AND_OVER_OR = save_thm(\"LEFT_AND_OVER_OR\",\n let val t1 = ``A:bool``\n and t2 = ``B:bool``\n and t3 = ``C:bool``\n val (th1,th2) = CONJ_PAIR(ASSUME (mk_conj(t1,mk_disj(t2,t3))))\n val th3 = CONJ th1 (ASSUME t2) and th4 = CONJ th1 (ASSUME t3)\n val th5 = DISJ_CASES_UNION th2 th3 th4\n val imp1 = DISCH (mk_conj(t1,mk_disj(t2,t3))) th5\n val (th1,th2) = (I ## C DISJ1 t3) (CONJ_PAIR (ASSUME (mk_conj(t1,t2))))\n val (th3,th4) = (I ## DISJ2 t2) (CONJ_PAIR (ASSUME (mk_conj(t1,t3))))\n val th5 = CONJ th1 th2 and th6 = CONJ th3 th4\n val th6 = DISJ_CASES (ASSUME (rand(concl imp1))) th5 th6\n val imp2 = DISCH (rand(concl imp1)) th6\n in\n GEN t1 (GEN t2 (GEN t3 (IMP_ANTISYM_RULE imp1 imp2)))\n end);\n\nval RIGHT_AND_OVER_OR = save_thm(\"RIGHT_AND_OVER_OR\",\n let val t1 = ``A:bool``\n and t2 = ``B:bool``\n and t3 = ``C:bool``\n val (th1,th2) = CONJ_PAIR(ASSUME (mk_conj(mk_disj(t2,t3),t1)))\n val th3 = CONJ (ASSUME t2) th2 and th4 = CONJ (ASSUME t3) th2\n val th5 = DISJ_CASES_UNION th1 th3 th4\n val imp1 = DISCH (mk_conj(mk_disj(t2,t3),t1)) th5\n val (th1,th2) = (C DISJ1 t3 ## I) (CONJ_PAIR (ASSUME (mk_conj(t2,t1))))\n val (th3,th4) = (DISJ2 t2 ## I) (CONJ_PAIR (ASSUME (mk_conj(t3,t1))))\n val th5 = CONJ th1 th2 and th6 = CONJ th3 th4\n val th6 = DISJ_CASES (ASSUME (rand(concl imp1))) th5 th6\n val imp2 = DISCH (rand(concl imp1)) th6\n in\n GEN t1 (GEN t2 (GEN t3 (IMP_ANTISYM_RULE imp1 imp2)))\n end);\n\nval LEFT_OR_OVER_AND = save_thm(\"LEFT_OR_OVER_AND\",\n let val t1 = ``A:bool``\n and t2 = ``B:bool``\n and t3 = ``C:bool``\n val th1 = ASSUME (mk_disj(t1,mk_conj(t2,t3)))\n val th2 = CONJ (DISJ1 (ASSUME t1) t2) (DISJ1 (ASSUME t1) t3)\n val (th3,th4) = CONJ_PAIR (ASSUME(mk_conj(t2,t3)))\n val th5 = CONJ (DISJ2 t1 th3) (DISJ2 t1 th4)\n val imp1 = DISCH (concl th1) (DISJ_CASES th1 th2 th5)\n val (th1,th2) = CONJ_PAIR (ASSUME (rand(concl imp1)))\n val th3 = DISJ1 (ASSUME t1) (mk_conj(t2,t3))\n val (th4,th5) = CONJ_PAIR (ASSUME (mk_conj(t2,t3)))\n val th4 = DISJ2 t1 (CONJ (ASSUME t2) (ASSUME t3))\n val th5 = DISJ_CASES th2 th3 (DISJ_CASES th1 th3 th4)\n val imp2 = DISCH (rand(concl imp1)) th5\n in\n GEN t1 (GEN t2 (GEN t3 (IMP_ANTISYM_RULE imp1 imp2)))\n end);\n\nval RIGHT_OR_OVER_AND = save_thm(\"RIGHT_OR_OVER_AND\",\n let val t1 = ``A:bool``\n and t2 = ``B:bool``\n and t3 = ``C:bool``\n val th1 = ASSUME (mk_disj(mk_conj(t2,t3),t1))\n val th2 = CONJ (DISJ2 t2 (ASSUME t1)) (DISJ2 t3 (ASSUME t1))\n val (th3,th4) = CONJ_PAIR (ASSUME(mk_conj(t2,t3)))\n val th5 = CONJ (DISJ1 th3 t1) (DISJ1 th4 t1)\n val imp1 = DISCH (concl th1) (DISJ_CASES th1 th5 th2)\n val (th1,th2) = CONJ_PAIR (ASSUME (rand(concl imp1)))\n val th3 = DISJ2 (mk_conj(t2,t3)) (ASSUME t1)\n val (th4,th5) = CONJ_PAIR (ASSUME (mk_conj(t2,t3)))\n val th4 = DISJ1 (CONJ (ASSUME t2) (ASSUME t3)) t1\n val th5 = DISJ_CASES th2 (DISJ_CASES th1 th4 th3) th3\n val imp2 = DISCH (rand(concl imp1)) th5\n in\n GEN t1 (GEN t2 (GEN t3 (IMP_ANTISYM_RULE imp1 imp2)))\n end);\n\n(*---------------------------------------------------------------------------*\n * IMP_DISJ_THM = |- !A B. A ==> B = ~A \\/ B *\n *---------------------------------------------------------------------------*)\n\nval IMP_DISJ_THM = save_thm(\"IMP_DISJ_THM\",\nlet val A = ``A:bool``\n val B = ``B:bool``\n val th1 = ASSUME ``A ==> B``\n val th2 = ASSUME A\n val th3 = MP th1 th2\n val th4 = DISJ2 ``~A`` th3\n val th5 = ASSUME ``~A``;\n val th6 = ADD_ASSUM ``A ==> B`` th5\n val th7 = DISJ1 th6 B\n val th8 = SPEC A EXCLUDED_MIDDLE\n val th9 = DISJ_CASES th8 th4 th7\n val th10 = EQT_INTRO th2\n val th11 = ASSUME ``~A \\/ B``\n val th12 = SUBST [A |-> th10] (concl th11) th11\n val th13 = CONJUNCT1 (CONJUNCT2 NOT_CLAUSES)\n val th14 = SUBST [A |-> th13] (subst [``~T`` |-> A] (concl th12)) th12\n val th15 = CONJUNCT1 (CONJUNCT2(CONJUNCT2 (SPEC B OR_CLAUSES)))\n val th16 = SUBST [A |-> th15] A th14\n val th17 = DISCH A th16\n val th18 = DISCH (concl th11) th17\n in\n GENL [A,B] (IMP_ANTISYM_RULE (DISCH (hd(hyp th9)) th9) th18)\n end);\n\n(*----------------------------------------------------------------------*)\n(* DISJ_IMP_THM = |- !P Q R. P \\/ Q ==> R = (P ==> R) /\\ (Q ==> R) *)\n(* MN 99.05.06 *)\n(*----------------------------------------------------------------------*)\n\nval DISJ_IMP_THM = let\n val P = ``P:bool``\n val Q = ``Q:bool``\n val R = ``R:bool``\n val lhs = ``P \\/ Q ==> R``\n val rhs = ``(P ==> R) /\\ (Q ==> R)``\n val ass_lhs = ASSUME lhs\n val ass_P = ASSUME P\n val ass_Q = ASSUME Q\n val p_imp_r = DISCH P (MP ass_lhs (DISJ1 ass_P Q))\n val q_imp_r = DISCH Q (MP ass_lhs (DISJ2 P ass_Q))\n val lr_imp = DISCH lhs (CONJ p_imp_r q_imp_r)\n (* half way there! *)\n val ass_rhs = ASSUME rhs\n val porq = ``P \\/ Q``\n val ass_porq = ASSUME porq\n val my_and1 = SPECL [``P ==> R``, ``Q ==> R``] AND1_THM\n val p_imp_r = MP my_and1 ass_rhs\n val r_from_p = MP p_imp_r ass_P\n val my_and2 = SPECL [``P ==> R``, ``Q ==> R``] AND2_THM\n val q_imp_r = MP my_and2 ass_rhs\n val r_from_q = MP q_imp_r ass_Q\n val rl_imp = DISCH rhs (DISCH porq (DISJ_CASES ass_porq r_from_p r_from_q))\nin\n save_thm(\"DISJ_IMP_THM\", GENL [P,Q,R] (IMP_ANTISYM_RULE lr_imp rl_imp))\nend\n\n(* ----------------------------------------------------------------------\n IMP_CONJ_THM = |- !P Q R. P ==> Q /\\ R = (P ==> Q) /\\ (P ==> R)\n MN 2002.10.06\n ---------------------------------------------------------------------- *)\n\nval IMP_CONJ_THM = let\n val P = mk_var(\"P\", bool)\n val Q = mk_var(\"Q\", bool)\n val R = mk_var(\"R\", bool)\n val QandR = mk_conj(Q,R)\n val PimpQandR = mk_imp(P, QandR)\n val PiQaR_th = ASSUME PimpQandR\n val P_th = ASSUME P\n val QaR_th = MP PiQaR_th P_th\n val (Q_th, R_th) = CONJ_PAIR QaR_th\n val PQ_th = DISCH P Q_th\n val PR_th = DISCH P R_th\n val L2R = DISCH PimpQandR (CONJ PQ_th PR_th)\n val PiQ = mk_imp(P, Q)\n val PiR = mk_imp(P, R)\n val PiQaPiR = mk_conj(PiQ, PiR)\n val PiQaPiR_th = ASSUME PiQaPiR\n val (PiQ_th, PiR_th) = CONJ_PAIR PiQaPiR_th\n val Q_th = MP PiQ_th P_th\n val R_th = MP PiR_th P_th\n val QaR_th = CONJ Q_th R_th\n val R2L = DISCH PiQaPiR (DISCH P QaR_th)\nin\n save_thm(\"IMP_CONJ_THM\", GENL [P,Q,R] (IMP_ANTISYM_RULE L2R R2L))\nend\n\n(* ---------------------------------------------------------------------*)\n(* IMP_F_EQ_F *)\n(* *)\n(* |- !t. t ==> F = (t = F) *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nlocal fun nthCONJUNCT n cth =\n let val th = funpow (n-1) CONJUNCT2 cth\n in if (can dest_conj (concl th))\n then CONJUNCT1 th else th\n end\nin\nval IMP_F_EQ_F = save_thm(\"IMP_F_EQ_F\",\n GEN ``t:bool``\n (TRANS (nthCONJUNCT 5 (SPEC_ALL IMP_CLAUSES))\n (SYM (nthCONJUNCT 4 (SPEC_ALL EQ_CLAUSES)))))\nend;\n\n(* ---------------------------------------------------------------------*)\n(* AND_IMP_INTRO *)\n(* *)\n(* |- !t1 t2 t3. t1 ==> t2 ==> t3 = t1 /\\ t2 ==> t3 *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval AND_IMP_INTRO = save_thm(\"AND_IMP_INTRO\",\nlet val t1 = ``t1:bool``\n and t2 = ``t2:bool``\n and t3 = ``t3:bool``\n and imp = ``$==>``\n val [IMP1,IMP2,IMP3,_,IMP4] = map GEN_ALL(CONJUNCTS (SPEC_ALL IMP_CLAUSES))\n and [AND1,AND2,AND3,AND4,_] = map GEN_ALL(CONJUNCTS (SPEC_ALL AND_CLAUSES))\n val thTl = SPEC ``t2 ==> t3`` IMP1\n and thFl = SPEC ``t2 ==> t3`` IMP3\n val thTr = AP_THM (AP_TERM imp (SPEC t2 AND1)) t3\n and thFr = TRANS (AP_THM (AP_TERM imp (SPEC t2 AND3)) t3)(SPEC t3 IMP3)\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``t1 ==> t2 ==> t3 <=> t1 /\\ t2 ==> t3``\n val thT2 = SUBST_CONV [t1 |-> ASSUME ``t1 = T``] tm tm\n and thF2 = SUBST_CONV [t1 |-> ASSUME ``t1 = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [t1,t2,t3] (DISJ_CASES (SPEC t1 BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* EQ_IMP_THM *)\n(* *)\n(* |- !t1 t2. (t1 = t2) = (t1 ==> t2) /\\ (t2 ==> t1) *)\n(* *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval EQ_IMP_THM = save_thm(\"EQ_IMP_THM\",\nlet val t1 = ``t1:bool``\n and t2 = ``t2:bool``\n val conj = ``$/\\``\n val [IMP1,IMP2,IMP3,_,IMP4] = map GEN_ALL(CONJUNCTS (SPEC_ALL IMP_CLAUSES))\n and [AND1,AND2,AND3,AND4,_] = map GEN_ALL(CONJUNCTS (SPEC_ALL AND_CLAUSES))\n and [EQ1,EQ2,EQ3,EQ4] = map GEN_ALL (CONJUNCTS (SPEC_ALL EQ_CLAUSES))\n val thTl = SPEC t2 EQ1\n and thFl = SPEC t2 EQ3\n val thTr = TRANS (MK_COMB (AP_TERM conj (SPEC t2 IMP1), SPEC t2 IMP2))\n (SPEC t2 AND2)\n and thFr = TRANS (MK_COMB (AP_TERM conj (SPEC t2 IMP3), SPEC t2 IMP4))\n (SPEC (mk_neg t2) AND1)\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(t1 = t2) <=> (t1 ==> t2) /\\ (t2 ==> t1)``\n val thT2 = SUBST_CONV [t1 |-> ASSUME ``t1 = T``] tm tm\n and thF2 = SUBST_CONV [t1 |-> ASSUME ``t1 = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [t1,t2] (DISJ_CASES (SPEC t1 BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* EQ_EXPAND = |- !t1 t2. (t1 = t2) = ((t1 /\\ t2) \\/ (~t1 /\\ ~t2)) *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval EQ_EXPAND = save_thm(\"EQ_EXPAND\",\nlet val t1 = ``t1:bool`` and t2 = ``t2:bool``\n val conj = ``$/\\`` and disj = ``$\\/``\n val [NOT1,NOT2] = tl (CONJUNCTS NOT_CLAUSES)\n and [EQ1,EQ2,EQ3,EQ4] = map GEN_ALL (CONJUNCTS (SPEC_ALL EQ_CLAUSES))\n and [OR1,OR2,OR3,OR4,_] = map GEN_ALL (CONJUNCTS (SPEC_ALL OR_CLAUSES))\n and [AND1,AND2,AND3,AND4,_] = map GEN_ALL (CONJUNCTS(SPEC_ALL AND_CLAUSES))\n val thTl = SPEC t2 EQ1\n and thFl = SPEC t2 EQ3\n val thTr = TRANS (MK_COMB (AP_TERM disj (SPEC t2 AND1),\n TRANS (AP_THM (AP_TERM conj NOT1) (mk_neg t2))\n (SPEC (mk_neg t2) AND3)))\n (SPEC t2 OR4)\n and thFr = TRANS (MK_COMB (AP_TERM disj (SPEC t2 AND3),\n TRANS (AP_THM (AP_TERM conj NOT2) (mk_neg t2))\n (SPEC (mk_neg t2) AND1)))\n (SPEC (mk_neg t2) OR3)\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(t1 = t2) <=> ((t1 /\\ t2) \\/ (~t1 /\\ ~t2))``\n val thT2 = SUBST_CONV [t1 |-> ASSUME ``t1 = T``] tm tm\n and thF2 = SUBST_CONV [t1 |-> ASSUME ``t1 = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [t1,t2] (DISJ_CASES (SPEC t1 BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* COND_RATOR |- !b (f:'a->'b) g x. (b => f | g) x = (b => f x | g x) *)\n(* *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_RATOR = save_thm(\"COND_RATOR\",\nlet val f = ``f: 'a -> 'b``\n val g = ``g: 'a -> 'b``\n val x = ``x:'a``\n and b = ``b:bool``\n val fx = ``^f ^x`` and gx = ``^g ^x``\n val t1 = ``t1:'a``\n val t2 = ``t2:'a``\n val theta1 = [``:'a`` |-> ``:'a -> 'b``]\n val theta2 = [``:'a`` |-> ``:'b``]\n val (COND_T,COND_F) = (GENL[t1,t2]##GENL[t1,t2])\n (CONJ_PAIR(SPEC_ALL COND_CLAUSES))\n val thTl = AP_THM (SPECL [f,g] (INST_TYPE theta1 COND_T)) x\n and thFl = AP_THM (SPECL [f,g] (INST_TYPE theta1 COND_F)) x\n val thTr = SPECL [fx,gx] (INST_TYPE theta2 COND_T)\n and thFr = SPECL [fx,gx] (INST_TYPE theta2 COND_F)\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(if b then (f:'a->'b ) else g) x = (if b then f x else g x)``\n val thT2 = SUBST_CONV [b |-> ASSUME ``b = T``] tm tm\n and thF2 = SUBST_CONV [b |-> ASSUME ``b = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [b,f,g,x] (DISJ_CASES (SPEC b BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* COND_RAND *)\n(* *)\n(* |- !(f:'a->'b) b x y. f (b => x | y) = (b => f x | f y) *)\n(* *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_RAND = save_thm(\"COND_RAND\",\nlet val f = ``f: 'a -> 'b``\n val x = ``x:'a``\n val y = ``y:'a``\n and b = ``b:bool``\n val fx = ``^f ^x`` and fy = ``^f ^y``\n val t1 = ``t1:'a``\n val t2 = ``t2:'a``\n val theta = [Type.alpha |-> Type.beta]\n val (COND_T,COND_F) = (GENL[t1,t2]##GENL[t1,t2])\n (CONJ_PAIR (SPEC_ALL COND_CLAUSES))\n val thTl = AP_TERM f (SPECL [x,y] COND_T)\n and thFl = AP_TERM f (SPECL [x,y] COND_F)\n val thTr = SPECL [fx,fy] (INST_TYPE theta COND_T)\n and thFr = SPECL [fx,fy] (INST_TYPE theta COND_F)\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(f:'a->'b ) (if b then x else y) = (if b then f x else f y)``\n val thT2 = SUBST_CONV [b |-> ASSUME ``b = T``] tm tm\n and thF2 = SUBST_CONV [b |-> ASSUME ``b = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [f,b,x,y] (DISJ_CASES (SPEC b BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* COND_ABS *)\n(* *)\n(* |- !b (f:'a->'b) g. (\\x. (b => f(x) | g(x))) = (b => f | g) *)\n(* *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_ABS = save_thm(\"COND_ABS\",\nlet val b = ``b:bool``\n val f = ``f:'a->'b``\n val g = ``g:'a->'b``\n val x = ``x:'a``\n in\n GENL [b,f,g]\n (TRANS (ABS x (SYM (SPECL [b,f,g,x] COND_RATOR)))\n (ETA_CONV ``\\ ^x. (if ^b then ^f else ^g) ^x``))\n end);\n\n(* ---------------------------------------------------------------------*)\n(* COND_EXPAND *)\n(* *)\n(* |- !b t1 t2. (b => t1 | t2) = ((~b \\/ t1) /\\ (b \\/ t2)) *)\n(* *)\n(* RJB 92.09.26 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_EXPAND = save_thm(\"COND_EXPAND\",\nlet val b = ``b:bool``\n val t1 = ``t1:bool``\n val t2 = ``t2:bool``\n val conj = ``$/\\``\n val disj = ``$\\/``\n val theta = [``:'a`` |-> Type.bool]\n val (COND_T,COND_F) =\n let val t1 = ``t1:'a`` and t2 = ``t2:'a``\n in (GENL[t1,t2]##GENL[t1,t2]) (CONJ_PAIR(SPEC_ALL COND_CLAUSES))\n end\n and [NOT1,NOT2] = tl (CONJUNCTS NOT_CLAUSES)\n and [OR1,OR2,OR3,OR4,_] = map GEN_ALL (CONJUNCTS (SPEC_ALL OR_CLAUSES))\n and [AND1,AND2,AND3,AND4,_] = map GEN_ALL (CONJUNCTS(SPEC_ALL AND_CLAUSES))\n val thTl = SPECL [t1,t2] (INST_TYPE theta COND_T)\n and thFl = SPECL [t1,t2] (INST_TYPE theta COND_F)\n val thTr =\n let val th1 = TRANS (AP_THM (AP_TERM disj NOT1) t1) (SPEC t1 OR3)\n and th2 = SPEC t2 OR1\n in\n TRANS (MK_COMB (AP_TERM conj th1,th2)) (SPEC t1 AND2)\n end\n and thFr =\n let val th1 = TRANS (AP_THM (AP_TERM disj NOT2) t1) (SPEC t1 OR1)\n and th2 = SPEC t2 OR3\n in\n TRANS (MK_COMB (AP_TERM conj th1,th2)) (SPEC t2 AND1)\n end\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(if b then t1 else t2) = ((~b \\/ t1) /\\ (b \\/ t2))``\n val thT2 = SUBST_CONV [b |-> ASSUME ``b = T``] tm tm\n and thF2 = SUBST_CONV [b |-> ASSUME ``b = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [b, t1, t2] (DISJ_CASES (SPEC b BOOL_CASES_AX) thT3 thF3)\n end);\n\n(* ---------------------------------------------------------------------*)\n(* COND_EXPAND_IMP *)\n(* *)\n(* |- !b t1 t2. (b => t1 | t2) = ((b ==> t1) /\\ (~b ==> t2)) *)\n(* *)\n(* TT 09.03.18 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_EXPAND_IMP = save_thm(\"COND_EXPAND_IMP\",\nlet val b = ``b:bool``\n val t1 = ``t1:bool``\n val t2 = ``t2:bool``\n val nb = mk_neg b;\n val nnb = mk_neg nb;\n val imp_th1 = SPECL [b, t1] IMP_DISJ_THM;\n val imp_th2a = SPECL [nb, t2] IMP_DISJ_THM\n val imp_th2b = SUBST_CONV [nnb |-> (SPEC b (CONJUNCT1 NOT_CLAUSES))]\n (mk_disj (nnb, t2)) (mk_disj (nnb, t2))\n val imp_th2 = TRANS imp_th2a imp_th2b\n val new_rhs = ``(b ==> t1) /\\ (~b ==> t2)``;\n val subst = [mk_imp(b,t1) |-> imp_th1,\n mk_imp(nb,t2) |-> imp_th2]\n val th1 = SUBST_CONV subst new_rhs new_rhs\n val th2 = TRANS (SPECL [b,t1,t2] COND_EXPAND) (SYM th1)\nin\n GENL [b,t1,t2] th2\nend);\n\n(* ---------------------------------------------------------------------*)\n(* COND_EXPAND_OR *)\n(* *)\n(* |- !b t1 t2. (b => t1 | t2) = ((b /\\ t1) \\/ (~b /\\ t2)) *)\n(* *)\n(* TT 09.03.18 *)\n(* ---------------------------------------------------------------------*)\n\nval COND_EXPAND_OR = save_thm(\"COND_EXPAND_OR\",\nlet val b = ``b:bool``\n val t1 = ``t1:bool``\n val t2 = ``t2:bool``\n val conj = ``$/\\``\n val disj = ``$\\/``\n val theta = [``:'a`` |-> Type.bool]\n val (COND_T,COND_F) =\n let val t1 = ``t1:'a`` and t2 = ``t2:'a``\n in (GENL[t1,t2]##GENL[t1,t2]) (CONJ_PAIR(SPEC_ALL COND_CLAUSES))\n end\n and [NOT1,NOT2] = tl (CONJUNCTS NOT_CLAUSES)\n and [OR1,OR2,OR3,OR4,_] = map GEN_ALL (CONJUNCTS (SPEC_ALL OR_CLAUSES))\n and [AND1,AND2,AND3,AND4,_] = map GEN_ALL (CONJUNCTS(SPEC_ALL AND_CLAUSES))\n val thTl = SPECL [t1,t2] (INST_TYPE theta COND_T)\n and thFl = SPECL [t1,t2] (INST_TYPE theta COND_F)\n val thTr =\n let val th2 = TRANS (AP_THM (AP_TERM conj NOT1) t2) (SPEC t2 AND3)\n and th1 = SPEC t1 AND1\n in\n TRANS (MK_COMB (AP_TERM disj th1,th2)) (SPEC t1 OR4)\n end\n and thFr =\n let val th2 = TRANS (AP_THM (AP_TERM conj NOT2) t2) (SPEC t2 AND1)\n and th1 = SPEC t1 AND3\n in\n TRANS (MK_COMB (AP_TERM disj th1,th2)) (SPEC t2 OR3)\n end\n val thT1 = TRANS thTl (SYM thTr)\n and thF1 = TRANS thFl (SYM thFr)\n val tm = ``(if b then t1 else t2) = ((b /\\ t1) \\/ (~b /\\ t2))``\n val thT2 = SUBST_CONV [b |-> ASSUME ``b = T``] tm tm\n and thF2 = SUBST_CONV [b |-> ASSUME ``b = F``] tm tm\n val thT3 = EQ_MP (SYM thT2) thT1\n and thF3 = EQ_MP (SYM thF2) thF1\n in\n GENL [b, t1, t2] (DISJ_CASES (SPEC b BOOL_CASES_AX) thT3 thF3)\n end);\n\n\nval TYPE_DEFINITION_THM = save_thm(\"TYPE_DEFINITION_THM\",\n let val P = ``P:'a-> bool``\n val rep = ``rep :'b -> 'a``\n in\n GEN P (GEN rep\n (RIGHT_BETA(AP_THM\n (RIGHT_BETA (AP_THM TYPE_DEFINITION P)) rep)))\n end);\n\nval ONTO_THM = save_thm(\n \"ONTO_THM\",\n let val f = mk_var(\"f\", Type.alpha --> Type.beta)\n in\n GEN f (RIGHT_BETA (AP_THM ONTO_DEF f))\n end);\n\nval ONE_ONE_THM = save_thm(\n \"ONE_ONE_THM\",\n let val f = mk_var(\"f\", Type.alpha --> Type.beta)\n in\n GEN f (RIGHT_BETA (AP_THM ONE_ONE_DEF f))\n end);\n\n(*---------------------------------------------------------------------------*\n * ABS_REP_THM *\n * |- !P. (?rep. TYPE_DEFINITION P rep) ==> *\n * ?rep abs. (!a. abs (rep a) = a) /\\ !r. P r = (rep (abs r) = r) *\n *---------------------------------------------------------------------------*)\n\nval ABS_REP_THM = save_thm(\"ABS_REP_THM\",\n let val th1 = ASSUME ``?rep:'b->'a. TYPE_DEFINITION P rep``\n val th2 = MK_EXISTS (SPEC ``P:'a->bool`` TYPE_DEFINITION_THM)\n val def = EQ_MP th2 th1\n val asm = ASSUME (snd(dest_exists(concl def)))\n val (asm1,asm2) = CONJ_PAIR asm\n val rep_eq =\n let val th1 = DISCH ``a:'b=a'``\n (AP_TERM ``rep:'b->'a`` (ASSUME ``a:'b=a'``))\n in IMP_ANTISYM_RULE (SPECL [``a:'b``,``a':'b``] asm1) th1\n end\n val ABS = ``\\r:'a. @a:'b. r = rep a``\n val absd = RIGHT_BETA (AP_THM (REFL ABS) ``rep (a:'b):'a``)\n val lem = SYM(SELECT_RULE(EXISTS (``?a':'b.a=a'``,``a:'b``)\n (REFL ``a:'b``)))\n val TH1 = GEN ``a:'b``\n (TRANS(TRANS absd (SELECT_EQ ``a':'b`` rep_eq)) lem)\n val t1 = SELECT_RULE(EQ_MP (SPEC ``r:'a`` asm2)\n (ASSUME ``(P:'a->bool) r``))\n val absd2 = RIGHT_BETA (AP_THM (REFL ABS) ``r:'a``)\n val v = mk_var(\"v\",type_of(rhs (concl absd2)))\n val (t1l,t1r) = dest_eq (concl t1)\n (* val rep = fst(strip_comb t1r) *)\n val rep = rator t1r\n val template = mk_eq(t1l, mk_comb(rep,v))\n val imp1 = DISCH ``(P:'a->bool) r``\n (SYM (SUBST [v |-> SYM absd2] template t1))\n val t2 = EXISTS (``?a:'b. r:'a = rep a``, ``^ABS r``)\n (SYM(ASSUME ``rep(^ABS (r:'a):'b) = r``))\n val imp2 = DISCH ``rep(^ABS (r:'a):'b) = r``\n (EQ_MP (SYM (SPEC ``r:'a`` asm2)) t2)\n val TH2 = GEN ``r:'a`` (IMP_ANTISYM_RULE imp1 imp2)\n val CTH = CONJ TH1 TH2\n val ath = subst [ABS |-> ``abs:'a->'b``] (concl CTH)\n val eth1 = EXISTS (``?abs:'a->'b. ^ath``, ABS) CTH\n val eth2 = EXISTS (``?rep:'b->'a. ^(concl eth1)``,\n ``rep:'b->'a``) eth1\n val result = DISCH (concl th1) (CHOOSE (``rep:'b->'a``,def) eth2)\n in\n GEN ``P:'a->bool`` result\n end);\n\n(*---------------------------------------------------------------------------\n LET_RAND = P (let x = M in N x) = (let x = M in P (N x))\n ---------------------------------------------------------------------------*)\n\nval LET_RAND = save_thm(\"LET_RAND\",\n let val tm1 = ``\\x:'a. P (N x:'b):bool``\n val tm2 = ``M:'a``\n val tm3 = ``\\x:'a. N x:'b``\n val P = ``P:'b -> bool``\n val LET_THM1 = RIGHT_BETA (SPEC tm2 (SPEC tm1\n (Thm.INST_TYPE [beta |-> bool] LET_THM)))\n val LET_THM2 = AP_TERM P (RIGHT_BETA (SPEC tm2 (SPEC tm3 LET_THM)))\n in TRANS LET_THM2 (SYM LET_THM1)\n end);\n\n\n(*---------------------------------------------------------------------------\n LET_RATOR = (let x = M in N x) b = (let x = M in N x b)\n ---------------------------------------------------------------------------*)\n\nval LET_RATOR = save_thm(\"LET_RATOR\",\n let val M = ``M:'a``\n val b = ``b:'b``\n val tm1 = ``\\x:'a. N x:'b->'c``\n val tm2 = ``\\x:'a. N x ^b:'c``\n val LET_THM1 = AP_THM (RIGHT_BETA (SPEC M (SPEC tm1\n (Thm.INST_TYPE [beta |-> (beta --> gamma)] LET_THM)))) b\n val LET_THM2 = RIGHT_BETA (SPEC M (SPEC tm2\n (Thm.INST_TYPE [beta |-> gamma] LET_THM)))\n in TRANS LET_THM1 (SYM LET_THM2)\n end);\n\n\n(*---------------------------------------------------------------------------\n !P. (!x y. P x y) = (!y x. P x y)\n ---------------------------------------------------------------------------*)\n\nval SWAP_FORALL_THM = save_thm(\"SWAP_FORALL_THM\",\n let val P = mk_var(\"P\", ``:'a->'b->bool``)\n val x = mk_var(\"x\", Type.alpha)\n val y = mk_var(\"y\", Type.beta)\n val Pxy = list_mk_comb (P,[x,y])\n val th1 = ASSUME (list_mk_forall [x,y] Pxy)\n val th2 = DISCH_ALL (GEN y (GEN x (SPEC y (SPEC x th1))))\n val th3 = ASSUME (list_mk_forall [y,x] Pxy)\n val th4 = DISCH_ALL (GEN x (GEN y (SPEC x (SPEC y th3))))\n in\n GEN P (IMP_ANTISYM_RULE th2 th4)\n end);\n\n(*---------------------------------------------------------------------------\n !P. (?x y. P x y) = (?y x. P x y)\n ---------------------------------------------------------------------------*)\n\nval SWAP_EXISTS_THM = save_thm(\"SWAP_EXISTS_THM\",\n let val P = mk_var(\"P\", ``:'a->'b->bool``)\n val x = mk_var(\"x\", Type.alpha)\n val y = mk_var(\"y\", Type.beta)\n val Pxy = list_mk_comb (P,[x,y])\n val tm1 = list_mk_exists[x] Pxy\n val tm2 = list_mk_exists[y] tm1\n val tm3 = list_mk_exists[y] Pxy\n val tm4 = list_mk_exists[x] tm3\n val th1 = ASSUME Pxy\n val th2 = EXISTS(tm2,y) (EXISTS (tm1,x) th1)\n val th3 = ASSUME (list_mk_exists [y] Pxy)\n val th4 = CHOOSE(y,th3) th2\n val th5 = CHOOSE(x,ASSUME (list_mk_exists [x,y] Pxy)) th4\n val th6 = EXISTS(tm4,x) (EXISTS (tm3,y) th1)\n val th7 = ASSUME (list_mk_exists[x] Pxy)\n val th8 = CHOOSE(x,th7) th6\n val th9 = CHOOSE(y,ASSUME (list_mk_exists [y,x] Pxy)) th8\n in\n GEN P (IMP_ANTISYM_RULE (DISCH_ALL th5) (DISCH_ALL th9))\n end);\n\n(*---------------------------------------------------------------------------\n EXISTS_UNIQUE_THM\n\n (?!x. P x) = (?x. P x) /\\ (!x y. P x /\\ P y ==> (x = y))\n ---------------------------------------------------------------------------*)\n\nval EXISTS_UNIQUE_THM = save_thm(\"EXISTS_UNIQUE_THM\",\n let val th1 = RIGHT_BETA (AP_THM EXISTS_UNIQUE_DEF ``\\x:'a. P x:bool``)\n val th2 = CONV_RULE (RAND_CONV (RAND_CONV\n (QUANT_CONV (QUANT_CONV (RATOR_CONV\n (RAND_CONV (RAND_CONV BETA_CONV))))))) th1\n in\n CONV_RULE (RAND_CONV (RAND_CONV (QUANT_CONV (QUANT_CONV (RATOR_CONV\n (RAND_CONV (RATOR_CONV (RAND_CONV BETA_CONV)))))))) th2\n end);\n\n(* ----------------------------------------------------------------------\n EXISTS_UNIQUE_ALT'\n |- !P. (?!x. P x) <=> ?x. !y. P y <=> (y = x)\n ---------------------------------------------------------------------- *)\n\nval EXISTS_UNIQUE_ALT' = save_thm(\n \"EXISTS_UNIQUE_ALT'\",\n let\n val eu_r = ASSUME (rhs (concl EXISTS_UNIQUE_THM))\n val (eu1, eu2) = CONJ_PAIR eu_r\n val P = mk_var(\"P\", alpha --> bool)\n val x = mk_var(\"x\", alpha)\n val y = mk_var(\"y\", alpha)\n val c = mk_var(\"c\", alpha)\n val yeqx = mk_eq(y,x)\n val Px = mk_comb(P, x)\n val Py = mk_comb(P, y)\n val th1a = MP (SPECL [y,x] eu2) (CONJ (ASSUME Py) (ASSUME Px)) |> DISCH Py\n val th1b = EQ_MP (SYM (AP_TERM P (ASSUME yeqx))) (ASSUME Px) |> DISCH yeqx\n val th1_noex = IMP_ANTISYM_RULE th1a th1b |> GEN y\n val th1_noch = EXISTS(mk_exists(x,concl th1_noex), x) th1_noex\n val th1 = CHOOSE(x,eu1) th1_noch\n val pyyeq = concl th1\n val pyyeqc = subst [x |-> c] (#2 (dest_exists pyyeq))\n val pyyeqc_th = ASSUME pyyeqc\n val th2a = pyyeqc_th |> SPEC c |> C EQ_MP (REFL c) o SYM\n |> EXISTS(mk_exists(x,Px), c)\n val (pxy_x,pxy_y) = ASSUME (mk_conj(Px,Py)) |> CONJ_PAIR\n val th2b1 = pyyeqc_th |> SPEC x |> C EQ_MP (ASSUME Px) |> PROVE_HYP pxy_x\n val th2b2 = pyyeqc_th |> SPEC y |> C EQ_MP (ASSUME Py) |> PROVE_HYP pxy_y\n val th2b = TRANS th2b1 (SYM th2b2) |> DISCH (mk_conj(Px,Py)) |> GENL [x,y]\n val th2 = CHOOSE (c, ASSUME pyyeq) (CONJ th2a th2b)\n val eqn = IMP_ANTISYM_RULE (DISCH_ALL th1) (DISCH_ALL th2)\n in\n TRANS EXISTS_UNIQUE_THM eqn\n end);\n\n(*---------------------------------------------------------------------------\n LET_CONG =\n |- !f g M N. (M = N) /\\ (!x. (x = N) ==> (f x = g x))\n ==>\n (LET f M = LET g N)\n ---------------------------------------------------------------------------*)\n\nval LET_CONG = save_thm(\"LET_CONG\",\n let val f = mk_var(\"f\",alpha-->beta)\n val g = mk_var(\"g\",alpha-->beta)\n val M = mk_var(\"M\",alpha)\n val N = mk_var(\"N\",alpha)\n val x = mk_var (\"x\",alpha)\n val MeqN = mk_eq(M,N)\n val x_eq_N = mk_eq(x,N)\n val fx_eq_gx = mk_eq(mk_comb(f,x),mk_comb(g,x))\n val ctm = mk_forall(x, mk_imp(x_eq_N,fx_eq_gx))\n val th = RIGHT_BETA(AP_THM(RIGHT_BETA(AP_THM LET_DEF f)) M)\n val th1 = ASSUME MeqN\n val th2 = MP (SPEC N (ASSUME ctm)) (REFL N)\n val th3 = SUBS [SYM th1] th2\n val th4 = TRANS (TRANS th th3) (MK_COMB (REFL g,th1))\n val th5 = RIGHT_BETA(AP_THM(RIGHT_BETA(AP_THM LET_DEF g)) N)\n val th6 = TRANS th4 (SYM th5)\n val th7 = SUBS [SPECL [MeqN, ctm, concl th6] AND_IMP_INTRO]\n (DISCH MeqN (DISCH ctm th6))\n in\n GENL [f,g,M,N] th7\n end);\n\n(*---------------------------------------------------------------------------\n IMP_CONG =\n |- !x x' y y'. (x = x') /\\ (x' ==> (y = y'))\n ==>\n (x ==> y = x' ==> y')\n ---------------------------------------------------------------------------*)\n\nval IMP_CONG = save_thm(\"IMP_CONG\",\n let val x = mk_var(\"x\",Type.bool)\n val x' = mk_var(\"x'\",Type.bool)\n val y = mk_var(\"y\",Type.bool)\n val y' = mk_var(\"y'\",Type.bool)\n val x_eq_x' = mk_eq(x,x')\n val ctm = mk_imp(x', mk_eq(y,y'))\n val x_imp_y = mk_imp(x,y)\n val x'_imp_y' = mk_imp(x',y')\n val th = ASSUME x_eq_x'\n val th1 = UNDISCH(ASSUME ctm)\n val th2 = ASSUME x_imp_y\n val th3 = DISCH x_imp_y (DISCH x' (UNDISCH(SUBS [th,th1] th2)))\n val th4 = ASSUME x'_imp_y'\n val th5 = UNDISCH (SUBS [SYM th] (DISCH x' th1))\n val th6 = DISCH x'_imp_y' (DISCH x (UNDISCH(SUBS [SYM th,SYM th5] th4)))\n val th7 = IMP_ANTISYM_RULE th3 th6\n val th8 = DISCH x_eq_x' (DISCH ctm th7)\n val th9 = SUBS [SPECL [x_eq_x', ctm, concl th7] AND_IMP_INTRO] th8\n in\n GENL [x,x',y,y'] th9\n end);\n\n(*---------------------------------------------------------------------------\n AND_CONG = |- !P P' Q Q'.\n (Q ==> (P = P')) /\\ (P' ==> (Q = Q'))\n ==>\n (P /\\ Q = P' /\\ Q')\n ---------------------------------------------------------------------------*)\n\nval AND_CONG = save_thm(\"AND_CONG\",\n let val P = mk_var(\"P\",Type.bool)\n val P' = mk_var(\"P'\",Type.bool)\n val Q = mk_var(\"Q\",Type.bool)\n val Q' = mk_var(\"Q'\",Type.bool)\n val PandQ = mk_conj(P,Q)\n val P'andQ' = mk_conj(P',Q')\n val ctm1 = mk_imp(Q, mk_eq(P,P'))\n val ctm2 = mk_imp(P', mk_eq(Q,Q'))\n val th1 = ASSUME PandQ\n val th2 = MP (ASSUME ctm1) (CONJUNCT2 th1)\n val th3 = MP (ASSUME ctm2) (SUBS [th2] (CONJUNCT1 th1))\n val th4 = DISCH PandQ (SUBS[th2,th3] th1)\n val th5 = ASSUME P'andQ'\n val th6 = MP (ASSUME ctm2) (CONJUNCT1 th5)\n val th7 = MP (ASSUME ctm1) (SUBS [SYM th6] (CONJUNCT2 th5))\n val th8 = DISCH P'andQ' (SUBS[SYM th6,SYM th7] th5)\n val th9 = IMP_ANTISYM_RULE th4 th8\n val th10 = SUBS [SPECL [ctm1,ctm2,concl th9] AND_IMP_INTRO]\n (DISCH ctm1 (DISCH ctm2 th9))\n in\n GENL [P,P',Q,Q'] th10\n end);\n\n(*---------------------------------------------------------------------------\n LEFT_AND_CONG =\n |- !P P' Q Q'.\n (P = P') /\\ (P' ==> (Q = Q'))\n ==>\n (P /\\ Q = P' /\\ Q')\n ---------------------------------------------------------------------------*)\n\nval LEFT_AND_CONG = save_thm(\"LEFT_AND_CONG\",\n let val P = mk_var(\"P\",Type.bool)\n val P' = mk_var(\"P'\",Type.bool)\n val Q = mk_var(\"Q\",Type.bool)\n val Q' = mk_var(\"Q'\",Type.bool)\n val PandQ = mk_conj(P,Q)\n val P'andQ' = mk_conj(P',Q')\n val ctm1 = mk_eq(P,P')\n val ctm2 = mk_imp(P', mk_eq(Q,Q'))\n val th1 = ASSUME PandQ\n val th2 = ASSUME ctm1\n val th3 = SUBS [th2] (CONJUNCT1 th1)\n val th3a = MP (ASSUME ctm2) th3\n val th4 = DISCH PandQ (SUBS[th2,th3a] th1)\n val th5 = ASSUME P'andQ'\n val th6 = SUBS [SYM th2] (CONJUNCT1 th5)\n val th7 = SYM(MP (ASSUME ctm2) (CONJUNCT1 th5))\n val th8 = DISCH P'andQ' (SUBS[SYM th2,th7] th5)\n val th9 = IMP_ANTISYM_RULE th4 th8\n val th10 = SUBS [SPECL [ctm1,ctm2,concl th9] AND_IMP_INTRO]\n (DISCH ctm1 (DISCH ctm2 th9))\n in\n GENL [P,P',Q,Q'] th10\n end);\n\n(*---------------------------------------------------------------------------\n val OR_CONG =\n |- !P P' Q Q'.\n (~Q ==> (P = P')) /\\ (~P' ==> (Q = Q'))\n ==>\n (P \\/ Q = P' \\/ Q')\n ---------------------------------------------------------------------------*)\n\nval OR_CONG = save_thm(\"OR_CONG\",\n let val P = mk_var(\"P\",Type.bool)\n val P' = mk_var(\"P'\",Type.bool)\n val Q = mk_var(\"Q\",Type.bool)\n val Q' = mk_var(\"Q'\",Type.bool)\n val notQ = mk_neg Q\n val notP' = mk_neg P'\n val PorQ = mk_disj(P,Q)\n val P'orQ' = mk_disj(P',Q')\n val PeqP'= mk_eq(P,P')\n val QeqQ'= mk_eq(Q,Q')\n val ctm1 = mk_imp(notQ,PeqP')\n val ctm2 = mk_imp(notP',QeqQ')\n val th1 = ASSUME PorQ\n val th2 = ASSUME P\n val th3 = ASSUME Q\n val th4 = ASSUME ctm1\n val th5 = ASSUME ctm2\n val th6 = SUBS [SPEC Q (CONJUNCT1 NOT_CLAUSES)]\n (SUBS [SPECL[notQ, PeqP'] IMP_DISJ_THM] th4)\n val th7 = SUBS [SPEC P' (CONJUNCT1 NOT_CLAUSES)]\n (SUBS [SPECL[notP', QeqQ'] IMP_DISJ_THM] th5)\n val th8 = ASSUME P'\n val th9 = DISJ1 th8 Q'\n val th10 = ASSUME QeqQ'\n val th11 = SUBS [th10] th3\n val th12 = DISJ2 P' th11\n val th13 = ASSUME PeqP'\n val th14 = MK_COMB(REFL(mk_const(\"\\\\/\",bool-->bool-->bool)),th13)\n val th15 = EQ_MP (MK_COMB (th14,th10)) th1\n val th16 = DISJ_CASES th6 th12 th15\n val th17 = DISCH PorQ (DISJ_CASES th7 th9 th16)\n val th18 = ASSUME P'orQ'\n val th19 = DISJ2 P th3\n val th20 = DISJ1 (SUBS [SYM th13] th8) Q\n val th21 = EQ_MP (SYM (MK_COMB(th14,th10))) th18\n val th22 = DISJ_CASES th7 th20 th21\n val th23 = DISCH P'orQ' (DISJ_CASES th6 th19 th22)\n val th24 = IMP_ANTISYM_RULE th17 th23\n val th25 = SUBS [SPECL [ctm1,ctm2,concl th24] AND_IMP_INTRO]\n (DISCH ctm1 (DISCH ctm2 th24))\n in\n GENL [P,P',Q,Q'] th25\n end);\n\n(*---------------------------------------------------------------------------\n val LEFT_OR_CONG =\n |- !P P' Q Q'.\n (P = P') /\\ (~P' ==> (Q = Q'))\n ==>\n (P \\/ Q = P' \\/ Q')\n ---------------------------------------------------------------------------*)\n\nval LEFT_OR_CONG = save_thm(\"LEFT_OR_CONG\",\n let fun mk_boolvar s = mk_var(s,Type.bool)\n val [P,P',Q,Q'] = map mk_boolvar [\"P\",\"P'\",\"Q\",\"Q'\"]\n val notP = mk_neg P\n val notP' = mk_neg P'\n val PorQ = mk_disj(P,Q)\n val P'orQ' = mk_disj(P',Q')\n val PeqP' = mk_eq(P,P')\n val ctm = mk_imp(notP',mk_eq(Q,Q'))\n val th1 = ASSUME ctm\n val th2 = ASSUME PeqP'\n val th3 = DISJ1 (SUBS [th2] (ASSUME P)) Q'\n val th4 = MP th1 (SUBS [th2] (ASSUME notP))\n val th5 = DISJ2 P' (SUBS [th4] (ASSUME Q))\n val th6 = DISJ_CASES (SPEC P EXCLUDED_MIDDLE) th3 th5\n val th7 = DISCH PorQ (DISJ_CASES (ASSUME PorQ) th3 th6)\n val th8 = DISJ1 (SUBS [SYM th2] (ASSUME P')) Q\n val th9 = MP th1 (ASSUME notP')\n val th10 = DISJ2 P (SUBS [SYM th9] (ASSUME Q'))\n val th11 = DISJ_CASES (SPEC P' EXCLUDED_MIDDLE) th8 th10\n val th12 = DISCH P'orQ' (DISJ_CASES (ASSUME P'orQ') th8 th11)\n val th13 = DISCH PeqP' (DISCH ctm (IMP_ANTISYM_RULE th7 th12))\n val th14 = SUBS[SPECL [PeqP',ctm,mk_eq(PorQ,P'orQ')] AND_IMP_INTRO] th13\n in\n GENL [P,P',Q,Q'] th14\n end);\n\n(*---------------------------------------------------------------------------\n val COND_CONG =\n |- !P Q x x' y y'.\n (P = Q) /\\ (Q ==> (x = x')) /\\ (~Q ==> (y = y'))\n ==>\n ((if P then x else y) = (if Q then x' else y'))\n ---------------------------------------------------------------------------*)\n\nfun mk_cond {cond,larm,rarm} = ``if ^cond then ^larm else ^rarm``;\n\nval COND_CONG = save_thm(\"COND_CONG\",\n let val P = mk_var(\"P\",Type.bool)\n val Q = mk_var(\"Q\",Type.bool)\n val x = mk_var(\"x\",alpha)\n val x' = mk_var(\"x'\",alpha)\n val y = mk_var(\"y\",alpha)\n val y' = mk_var(\"y'\",alpha)\n val PeqQ = mk_eq(P,Q)\n val ctm1 = mk_imp(Q, mk_eq(x,x'))\n val ctm2 = mk_imp(mk_neg Q, mk_eq(y,y'))\n val target = mk_eq(mk_cond{cond=P,larm=x,rarm=y},\n mk_cond{cond=Q,larm=x',rarm=y'})\n val OR_ELIM = MP (SPECL[target,P,mk_neg P] OR_ELIM_THM)\n (SPEC P EXCLUDED_MIDDLE)\n val th1 = ASSUME P\n val th2 = EQT_INTRO th1\n val th3 = CONJUNCT1 (SPECL [x,y] COND_CLAUSES)\n val th3a = CONJUNCT1 (SPECL [x',y'] COND_CLAUSES)\n val th4 = SUBS [SYM th2] th3\n val th4a = SUBS [SYM th2] th3a\n val th5 = ASSUME PeqQ\n val th6 = ASSUME ctm1\n val th7 = ASSUME ctm2\n val th8 = UNDISCH (SUBS [SYM th5] th6)\n val th9 = TRANS th4 th8\n val th10 = TRANS th9 (SYM (SUBS [th5] th4a))\n val th11 = EQF_INTRO (ASSUME (mk_neg P))\n val th12 = CONJUNCT2 (SPECL [x,y] COND_CLAUSES)\n val th13 = CONJUNCT2 (SPECL [x',y'] COND_CLAUSES)\n val th14 = SUBS [SYM th11] th12\n val th15 = SUBS [SYM th11] th13\n val th16 = UNDISCH (SUBS [SYM th5] th7)\n val th17 = TRANS th14 th16\n val th18 = TRANS th17 (SYM (SUBS [th5] th15))\n val th19 = MP (MP OR_ELIM (DISCH P th10)) (DISCH (mk_neg P) th18)\n val th20 = DISCH PeqQ (DISCH ctm1 (DISCH ctm2 th19))\n val th21 = SUBS [SPECL [ctm1, ctm2,concl th19] AND_IMP_INTRO] th20\n val cnj = mk_conj(ctm1,ctm2)\n val th22 = SUBS [SPECL [PeqQ,cnj,concl th19] AND_IMP_INTRO] th21\n in\n GENL [P,Q,x,x',y,y'] th22\n end);\n\n(* ----------------------------------------------------------------------\n\n RES_FORALL_CONG\n |- (P = Q) ==> (!x. x IN Q ==> (f x = g x)) ==>\n (RES_FORALL P f = RES_FORALL Q g)\n\n RES_EXISTS_CONG\n |- (P = Q) ==> (!x. x IN Q ==> (f x = g x)) ==>\n (RES_EXISTS P f = RES_EXISTS P g)\n ---------------------------------------------------------------------- *)\n\nval (RES_FORALL_CONG, RES_EXISTS_CONG) = let\n (* stuff in common to both *)\n val aset_ty = alpha --> bool\n val [P,Q,f,g] = map (fn s => mk_var(s, aset_ty)) [\"P\", \"Q\", \"f\", \"g\"]\n val PeqQ_t = mk_eq(P, Q)\n val PeqQ_th = ASSUME PeqQ_t\n val x = mk_var(\"x\", alpha)\n val fx_t = mk_comb(f, x)\n val gx_t = mk_comb(g, x)\n val IN_t = prim_mk_const {Thy = \"bool\", Name = \"IN\"}\n val xINP_t = list_mk_comb(IN_t, [x, P])\n val xINP_th = ASSUME xINP_t\n val xINQ_t = list_mk_comb(IN_t, [x, Q])\n val xINQ_th = ASSUME xINQ_t\n val xINP_eq_xINQ_th = AP_TERM (mk_comb(IN_t, x)) PeqQ_th\n val (xINP_imp_xINQ, xINQ_imp_xINP) = EQ_IMP_RULE xINP_eq_xINQ_th\n val feqg_t = mk_forall(x, mk_imp(xINQ_t, mk_eq(mk_comb(f,x), mk_comb(g, x))))\n val feqg_th = SPEC x (ASSUME feqg_t)\n val feqg_th = MP feqg_th xINQ_th\n val (f_imp_g_th, g_imp_f_th) = EQ_IMP_RULE feqg_th\n\n fun mk_res th args =\n List.foldl (RIGHT_BETA o uncurry (C AP_THM)) th args\n\n (* forall thm *)\n val resfa_t = prim_mk_const {Thy = \"bool\", Name = \"RES_FORALL\"}\n val res_pf_t = list_mk_comb(resfa_t, [P, f])\n val res_qg_t = list_mk_comb(resfa_t, [Q, g])\n val resfa_pf_eqn = mk_res RES_FORALL_DEF [P, f]\n val resfa_qg_eqn = mk_res RES_FORALL_DEF [Q, g]\n\n val resfa_pf_eq_th = SPEC x (EQ_MP resfa_pf_eqn (ASSUME res_pf_t))\n val g_th = MP f_imp_g_th (MP resfa_pf_eq_th xINP_th)\n val xinq_imp_g_th =\n GEN x (DISCH xINQ_t (PROVE_HYP (UNDISCH xINQ_imp_xINP) g_th))\n val rfa_pf_imp_rfa_qg =\n DISCH res_pf_t (EQ_MP (SYM resfa_qg_eqn) xinq_imp_g_th)\n\n val resfa_qg_eq_th = SPEC x (EQ_MP resfa_qg_eqn (ASSUME res_qg_t))\n val f_th = MP g_imp_f_th (MP resfa_qg_eq_th xINQ_th)\n val xinp_imp_f_th =\n GEN x (DISCH xINP_t (PROVE_HYP (UNDISCH xINP_imp_xINQ) f_th))\n val rfa_qg_imp_rfa_pf =\n DISCH res_qg_t (EQ_MP (SYM resfa_pf_eqn) xinp_imp_f_th)\n val fa_eqn = IMP_ANTISYM_RULE rfa_pf_imp_rfa_qg rfa_qg_imp_rfa_pf\n\n (* exists thm *)\n val resex_t = prim_mk_const {Thy = \"bool\", Name = \"RES_EXISTS\"}\n val res_pf_t = list_mk_comb(resex_t, [P, f])\n val res_qg_t = list_mk_comb(resex_t, [Q, g])\n val resex_pf_eqn = mk_res RES_EXISTS_DEF [P, f]\n val resex_qg_eqn = mk_res RES_EXISTS_DEF [Q, g]\n\n val pf_exbody_th = EQ_MP resex_pf_eqn (ASSUME res_pf_t)\n val pf_body_th = ASSUME(mk_conj(xINP_t, fx_t))\n val (new_xINP_th, fx_th) = CONJ_PAIR pf_body_th\n val new_xINQ_th = MP xINP_imp_xINQ new_xINP_th\n val new_gx_th = PROVE_HYP new_xINQ_th (MP f_imp_g_th fx_th)\n val qg_exists =\n EXISTS(rhs (concl resex_qg_eqn), x) (CONJ new_xINQ_th new_gx_th)\n val pf_chosen = CHOOSE(x,EQ_MP resex_pf_eqn (ASSUME res_pf_t)) qg_exists\n val ex_pf_imp_qg = DISCH res_pf_t (EQ_MP (SYM resex_qg_eqn) pf_chosen)\n\n val qg_exbody_th = EQ_MP resex_qg_eqn (ASSUME res_qg_t)\n val qg_body_th = ASSUME(mk_conj(xINQ_t, gx_t))\n val (new_xINQ_th, gx_th) = CONJ_PAIR qg_body_th\n val new_xINP_th = MP xINQ_imp_xINP new_xINQ_th\n val new_fx_th = PROVE_HYP new_xINQ_th (MP g_imp_f_th gx_th)\n val pf_exists =\n EXISTS (rhs (concl resex_pf_eqn), x) (CONJ new_xINP_th new_fx_th)\n val qg_chosen = CHOOSE(x, EQ_MP resex_qg_eqn (ASSUME res_qg_t)) pf_exists\n val ex_qg_imp_pf = DISCH res_qg_t (EQ_MP (SYM resex_pf_eqn) qg_chosen)\n\n val ex_eqn = IMP_ANTISYM_RULE ex_pf_imp_qg ex_qg_imp_pf\n\nin\n (save_thm(\"RES_FORALL_CONG\", DISCH PeqQ_t (DISCH feqg_t fa_eqn)),\n save_thm(\"RES_EXISTS_CONG\", DISCH PeqQ_t (DISCH feqg_t ex_eqn)))\nend\n\n(* ------------------------------------------------------------------------- *)\n(* Monotonicity. *)\n(* ------------------------------------------------------------------------- *)\n\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_AND |- (x ==> y) /\\ (z ==> w) ==> (x /\\ z ==> y /\\ w) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_AND = save_thm(\"MONO_AND\",\n let val tm1 = ``x ==> y``\n val tm2 = ``z ==> w``\n val tm3 = ``x /\\ z``\n val tm4 = ``y /\\ w``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = ASSUME tm3\n val th4 = CONJUNCT1 th3\n val th5 = CONJUNCT2 th3\n val th6 = MP th1 th4\n val th7 = MP th2 th5\n val th8 = CONJ th6 th7\n val th9 = itlist DISCH [tm1,tm2,tm3] th8\n val th10 = SPEC ``^tm3 ==> ^tm4`` (SPEC tm2 (SPEC tm1 AND_IMP_INTRO))\n in\n EQ_MP th10 th9\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_OR |- (x ==> y) /\\ (z ==> w) ==> (x \\/ z ==> y \\/ w) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_OR = save_thm(\"MONO_OR\",\n let val tm1 = ``x ==> y``\n val tm2 = ``z ==> w``\n val tm3 = ``x \\/ z``\n val tm4 = ``y \\/ w``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = ASSUME tm3\n val th4 = DISJ1 (MP th1 (ASSUME ``x:bool``)) ``w:bool``\n val th5 = DISJ2 ``y:bool`` (MP th2 (ASSUME ``z:bool``))\n val th6 = DISJ_CASES th3 th4 th5\n val th7 = DISCH tm1 (DISCH tm2 (DISCH tm3 th6))\n val th8 = SPEC ``^tm3 ==> ^tm4`` (SPEC tm2 (SPEC tm1 AND_IMP_INTRO))\n in\n EQ_MP th8 th7\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_IMP |- (y ==> x) /\\ (z ==> w) ==> ((x ==> z) ==> (y ==> w)) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_IMP = save_thm(\"MONO_IMP\",\n let val tm1 = ``y ==> x``\n val tm2 = ``z ==> w``\n val tm3 = ``x ==> z``\n val tm4 = ``y ==> w``\n val tm5 = ``y:bool``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = ASSUME tm3\n val th4 = MP th1 (ASSUME tm5)\n val th5 = MP th3 th4\n val th6 = MP th2 th5\n val th7 = DISCH tm1 (DISCH tm2 (DISCH tm3 (DISCH tm5 th6)))\n val th8 = SPEC ``^tm3 ==> ^tm4`` (SPEC tm2 (SPEC tm1 AND_IMP_INTRO))\n in\n EQ_MP th8 th7\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_NOT |- (y ==> x) ==> (~x ==> ~y) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_NOT = save_thm(\"MONO_NOT\",\n let val tm1 = ``y ==> x``\n val tm2 = ``~x``\n val tm3 = ``y:bool``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = ASSUME tm3\n val th4 = MP th1 th3\n val th5 = DISCH tm3 (MP th2 th4)\n val th6 = EQ_MP (SYM (RIGHT_BETA (AP_THM NOT_DEF tm3))) th5\n in\n DISCH tm1 (DISCH tm2 th6)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_NOT_EQ |- (y ==> x) = (~x ==> ~y) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_NOT_EQ = save_thm(\"MONO_NOT_EQ\",\n let val tm1 = ``x:bool``\n val tm2 = ``y:bool``\n val th1 = INST [tm1 |-> mk_neg tm2, tm2 |-> mk_neg tm1] MONO_NOT\n\n val th2 = SUBST [``x1:bool`` |-> SPEC tm1 (CONJUNCT1 NOT_CLAUSES),\n ``x2:bool`` |-> SPEC tm2 (CONJUNCT1 NOT_CLAUSES)]\n ``(~x ==> ~y) ==> (x2 ==> x1)`` th1\n\n val th3 = IMP_ANTISYM_RULE MONO_NOT th2\n in\n th3\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_ALL |- (!x. P x ==> Q x) ==> (!x. P x) ==> !x. Q x *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_ALL = save_thm(\"MONO_ALL\",\n let val tm1 = ``!x:'a. P x ==> Q x``\n val tm2 = ``!x:'a. P x``\n val tm3 = ``x:'a``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = SPEC tm3 th1\n val th4 = SPEC tm3 th2\n val th5 = GEN tm3 (MP th3 th4)\n in\n DISCH tm1 (DISCH tm2 th5)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_EXISTS = [] |- (!x. P x ==> Q x) ==> (?x. P x) ==> ?x. Q x *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_EXISTS = save_thm(\"MONO_EXISTS\",\n let val tm1 = ``!x:'a. P x ==> Q x``\n val tm2 = ``?x:'a. P x``\n val tm3 = ``@x:'a. P x``\n val tm4 = ``\\x:'a. P x:bool``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = SPEC tm3 th1\n val th4 = RIGHT_BETA(RIGHT_BETA (AP_THM EXISTS_DEF tm4))\n val th5 = EQ_MP th4 th2\n val th6 = MP th3 th5\n in\n DISCH tm1 (DISCH tm2 (EXISTS (``?x:'a. Q x``, tm3) th6))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* MONO_COND |- (x ==> y) ==> (z ==> w) *)\n(* ==> (if b then x else z) ==> (if b then y else w) *)\n(* ------------------------------------------------------------------------- *)\n\nval MONO_COND = save_thm(\"MONO_COND\",\n let val tm1 = ``x ==> y``\n val tm2 = ``z ==> w``\n val tm3 = ``if b then x else z:bool``\n val tm4 = ``b:bool``\n val tm5 = ``x:bool``\n val tm6 = ``z:bool``\n val tm7 = ``y:bool``\n val tm8 = ``w:bool``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = ASSUME tm3\n val th4 = SPEC tm6 (SPEC tm5 (INST_TYPE [alpha |-> bool] COND_CLAUSES))\n val th5 = CONJUNCT1 th4\n val th6 = CONJUNCT2 th4\n val th7 = SPEC tm4 BOOL_CASES_AX\n val th8 = ASSUME ``b = T``\n val th9 = ASSUME ``b = F``\n val th10 = SUBST [tm4 |-> th8] (concl th3) th3\n val th11 = SUBST [tm4 |-> th9] (concl th3) th3\n val th12 = EQ_MP th5 th10\n val th13 = EQ_MP th6 th11\n val th14 = MP th1 th12\n val th15 = MP th2 th13\n val th16 = INST [tm5 |-> tm7, tm6 |-> tm8] th4\n val th17 = SYM (CONJUNCT1 th16)\n val th18 = SYM (CONJUNCT2 th16)\n val th19 = EQ_MP th17 th14\n val th20 = EQ_MP th18 th15\n val th21 = DISCH tm3 th19\n val th22 = DISCH tm3 th20\n val th23 = SUBST [tm4 |-> th8] (concl th21) th21\n val th24 = SUBST [tm4 |-> th9] (concl th22) th22\n val v = ``v:bool``\n val T = mk_const(\"T\",bool)\n val template = subst [T |-> v] (concl th23)\n val th25 = SUBST [v |-> SYM th8] template th23\n val th26 = SUBST [v |-> SYM th9] template th24\n in\n DISCH tm1 (DISCH tm2 (DISJ_CASES th7 th25 th26))\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* EXISTS_REFL |- !a. ?x. x = a *)\n(* ------------------------------------------------------------------------- *)\n\nval EXISTS_REFL = save_thm(\"EXISTS_REFL\",\n let val a = ``a:'a``\n val th1 = REFL a\n val th2 = EXISTS (``?x:'a. x = a``, a) th1\n in GEN a th2\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* EXISTS_UNIQUE_REFL |- !a. ?!x. x = a *)\n(* ------------------------------------------------------------------------- *)\n\nval EXISTS_UNIQUE_REFL = save_thm(\"EXISTS_UNIQUE_REFL\",\n let val a = ``a:'a``\n val P = ``\\x:'a. x = a``\n val tmx = ``^P x``\n val tmy= ``^P y``\n val ex = ``?x. ^P x``\n val th1 = SPEC a EXISTS_REFL\n val th2 = ABS ``x:'a`` (BETA_CONV tmx)\n val th3 = AP_TERM ``$? :('a->bool)->bool`` th2\n val th4 = EQ_MP (SYM th3) th1\n val th5 = ASSUME (mk_conj(tmx,tmy))\n val th6 = CONJUNCT1 th5\n val th7 = CONJUNCT2 th5\n val th8 = EQ_MP (BETA_CONV (concl th6)) th6\n val th9 = EQ_MP (BETA_CONV (concl th7)) th7\n val th10 = TRANS th8 (SYM th9)\n val th11 = DISCH (hd(hyp th10)) th10\n val th12 = GEN ``x:'a`` (GEN ``y:'a`` th11)\n val th13 = INST [``P:'a->bool`` |-> P] EXISTS_UNIQUE_THM\n val th14 = EQ_MP (SYM th13) (CONJ th4 th12)\n val th15 = AP_TERM ``$?! :('a->bool)->bool`` th2\n in\n GEN a (EQ_MP th15 th14)\n end);\n\n\n(* ------------------------------------------------------------------------- *)\n(* Unwinding. *)\n(* ------------------------------------------------------------------------- *)\n\n\n(* ------------------------------------------------------------------------- *)\n(* UNWIND1_THM |- !P a. (?x. (a = x) /\\ P x) = P a *)\n(* ------------------------------------------------------------------------- *)\n\nval UNWIND_THM1 = save_thm(\"UNWIND_THM1\",\n let val P = ``P:'a->bool``\n val a = ``a:'a``\n val Pa = ``^P ^a``\n val v = ``v:'a``\n val tm1 = ``?x:'a. (a = x) /\\ P x``\n val th1 = ASSUME tm1\n val th2 = ASSUME ``(a:'a = v) /\\ P v``\n val th3 = CONJUNCT1 th2\n val th4 = CONJUNCT2 th2\n val th5 = SUBST [v |-> SYM th3] (concl th4) th4\n val th6 = DISCH tm1 (CHOOSE (v,th1) th5)\n val th7 = ASSUME Pa\n val th8 = CONJ (REFL a) th7\n val th9 = EXISTS (tm1,a) th8\n val th10 = DISCH Pa th9\n val th11 = SPEC Pa (SPEC tm1 IMP_ANTISYM_AX)\n in\n GEN P (GEN a (MP (MP th11 th6) th10))\n end);\n\n\n(* ------------------------------------------------------------------------- *)\n(* UNWIND_THM2 |- !P a. (?x. (x = a) /\\ P x) = P a *)\n(* ------------------------------------------------------------------------- *)\n\nval UNWIND_THM2 = save_thm(\"UNWIND_THM2\",\n let val P = ``P:'a->bool``\n val a = ``a:'a``\n val Px = ``^P x``\n val Pa = ``^P ^a``\n val u = ``u:'a``\n val v = ``v:'a``\n val a_eq_x = ``a:'a = x``\n val x_eq_a = ``x:'a = a``\n val th1 = SPEC a (SPEC P UNWIND_THM1)\n val th2 = REFL Pa\n val th3 = DISCH a_eq_x (SYM (ASSUME a_eq_x))\n val th4 = DISCH x_eq_a (SYM (ASSUME x_eq_a))\n val th5 = SPEC a_eq_x (SPEC x_eq_a IMP_ANTISYM_AX)\n val th6 = MP (MP th5 th4) th3\n val th7 = MK_COMB (MK_COMB (REFL ``$/\\``, th6), REFL Px)\n val th8 = MK_COMB (REFL``$? :('a->bool)->bool``,\n ABS ``x:'a`` th7)\n val th9 = MK_COMB(MK_COMB (REFL``$= :bool->bool->bool``, th8),th2)\n val th10 = EQ_MP (SYM th9) th1\n in\n GEN P (GEN a th10)\n end);\n\n\n(* ------------------------------------------------------------------------- *)\n(* UNWIND_FORALL_THM1 |- !f v. (!x. (v = x) ==> f x) = f v *)\n(* ------------------------------------------------------------------------- *)\n\nval UNWIND_FORALL_THM1 = save_thm(\"UNWIND_FORALL_THM1\",\n let val f = ``f : 'a -> bool``\n val v = ``v:'a``\n val fv = ``^f ^v``\n val tm1 = ``!x:'a. (v = x) ==> f x``\n val tm2 = ``v:'a = x``\n val th1 = ASSUME tm1\n val th2 = ASSUME fv\n val th3 = DISCH tm1 (MP (SPEC v th1) (REFL v))\n val th4 = ASSUME tm2\n val th5 = SUBST [v |-> th4] (concl th2) th2\n val th6 = DISCH fv (GEN ``x:'a`` (DISCH tm2 th5))\n val th7 = MP (MP (SPEC tm1 (SPEC fv IMP_ANTISYM_AX)) th6) th3\n in\n GEN f (GEN v (SYM th7))\n end);\n\n\n(* ------------------------------------------------------------------------- *)\n(* UNWIND_FORALL_THM2 |- !f v. (!x. (x = v) ==> f x) = f v *)\n(* ------------------------------------------------------------------------- *)\n\nval UNWIND_FORALL_THM2 = save_thm(\"UNWIND_FORALL_THM2\",\n let val f = ``f:'a->bool``\n val v = ``v:'a``\n val fv = ``^f ^v``\n val tm1 = ``!x:'a. (x = v) ==> f x``\n val tm2 = ``x:'a = v``\n val th1 = ASSUME tm1\n val th2 = ASSUME fv\n val th3 = DISCH tm1 (MP (SPEC v th1) (REFL v))\n val th4 = ASSUME tm2\n val th5 = SUBST [v |-> SYM th4] (concl th2) th2\n val th6 = DISCH fv (GEN ``x:'a`` (DISCH tm2 th5))\n val th7 = MP (MP (SPEC tm1 (SPEC fv IMP_ANTISYM_AX)) th6) th3\n in\n GEN f (GEN v (SYM th7))\n end);\n\n\n(* ------------------------------------------------------------------------- *)\n(* Skolemization: |- !P. (!x. ?y. P x y) <=> ?f. !x. P x (f x) *)\n(* ------------------------------------------------------------------------- *)\n\nval SKOLEM_THM = save_thm(\"SKOLEM_THM\",\n let val P = ``P:'a -> 'b -> bool``\n val x = ``x:'a``\n val y = ``y:'b``\n val f = ``f:'a->'b``\n val tm1 = ``!x. ?y. ^P x y``\n val tm2 = ``?f. !x. ^P x (f x)``\n val tm4 = ``\\x. @y. ^P x y``\n val tm5 = ``(\\x. @y. ^P x y) x``\n val th1 = ASSUME tm1\n val th2 = ASSUME tm2\n val th3 = SPEC x th1\n val th4 = INST_TYPE [alpha |-> beta] SELECT_AX\n val th5 = SPEC y (SPEC ``\\y. ^P x y`` th4)\n val th6 = BETA_CONV (fst(dest_imp(concl th5)))\n val th7 = BETA_CONV (snd(dest_imp(concl th5)))\n val th8 = MK_COMB (MK_COMB (REFL ``$==>``,th6),th7)\n val th9 = EQ_MP th8 th5\n val th10 = MP th9 (ASSUME(fst(dest_imp(concl th9))))\n val th11 = CHOOSE (y,th3) th10\n val th12 = SYM (BETA_CONV tm5)\n val th13 = SUBST [``v:'b`` |-> th12] ``^P x v`` th11\n val th14 = DISCH tm1 (EXISTS (tm2,tm4) (GEN x th13))\n val th15 = ASSUME ``!x. ^P x (f x)``\n val th16 = SPEC x th15\n val th17 = GEN x (EXISTS(``?y. ^P x y``,``f (x:'a):'b``) th16)\n val th18 = DISCH tm2 (CHOOSE (f,th2) th17)\n val th19 = MP (MP (SPEC tm1 (SPEC tm2 IMP_ANTISYM_AX)) th18) th14\n in\n GEN P (SYM th19)\n end);\n\n\n(*---------------------------------------------------------------------------\n Support for pattern matching on booleans.\n\n bool_case_thm =\n |- (!e0 e1. bool_case e0 e1 T = e0) /\\\n !e0 e1. bool_case e0 e1 F = e1\n ---------------------------------------------------------------------------*)\n\nval bool_case_thm = let\n val (vs,_) = strip_forall (concl COND_CLAUSES)\nin\n save_thm(\"bool_case_thm\",\n COND_CLAUSES |> SPECL vs |> CONJUNCTS |> map (GENL vs) |> LIST_CONJ)\nend\n\n(* ------------------------------------------------------------------------- *)\n(* bool_case_ID = |- !x b. bool_case x x b = x *)\n(* ------------------------------------------------------------------------- *)\n\nval bool_case_ID = save_thm(\"bool_case_ID\", COND_ID)\n\n\n(* ------------------------------------------------------------------------- *)\n(* boolAxiom |- !e0 e1. ?fn. (fn T = e0) /\\ (fn F = e1) *)\n(* ------------------------------------------------------------------------- *)\n\nval boolAxiom = save_thm(\"boolAxiom\",\n let\n val ([e0,e1], _) = strip_forall (concl COND_CLAUSES)\n val (th2, th3) = CONJ_PAIR (SPECL [e0, e1] COND_CLAUSES)\n val f_t = ``\\b. if b then ^e0 else ^e1``\n val f_T = TRANS (BETA_CONV (mk_comb(f_t, T))) th2\n val f_F = TRANS (BETA_CONV (mk_comb(f_t, F))) th3\n val th4 = CONJ f_T f_F\n val th5 = EXISTS (``?fn. (fn T = ^e0) /\\ (fn F = ^e1)``, f_t) th4\n in\n GEN e0 (GEN e1 th5)\n end);\n\n(* ------------------------------------------------------------------------- *)\n(* bool_INDUCT |- !P. P T /\\ P F ==> !b. P b *)\n(* ------------------------------------------------------------------------- *)\n\nval bool_INDUCT = save_thm(\"bool_INDUCT\",\n let val P = ``P:bool -> bool``\n val b = ``b:bool``\n val v = ``v:bool``\n val tm1 = ``^P T /\\ ^P F``\n val th1 = SPEC b BOOL_CASES_AX\n val th2 = ASSUME tm1\n val th3 = CONJUNCT1 th2\n val th4 = CONJUNCT2 th2\n val th5 = ASSUME ``b = T``\n val th6 = ASSUME ``b = F``\n val th7 = SUBST [v |-> SYM th5] ``^P ^v`` th3\n val th8 = SUBST [v |-> SYM th6] ``^P ^v`` th4\n val th9 = GEN b (DISJ_CASES th1 th7 th8)\n in\n GEN P (DISCH tm1 th9)\n end);\n\n(* ---------------------------------------------------------------------------\n |- !P Q x x' y y'.\n (P = Q) /\\ (Q ==> (x = x')) /\\ (~Q ==> (y = y')) ==>\n ((case P of T -> x || F -> y) = (case Q of T -> x' || F -> y'))\n --------------------------------------------------------------------------- *)\n\nval bool_case_CONG = save_thm(\"bool_case_CONG\", COND_CONG)\n\nval FORALL_BOOL = save_thm\n(\"FORALL_BOOL\",\n let val tm1 = ``!b:bool. P b``\n val tm2 = ``P T /\\ P F``\n val th1 = ASSUME tm1\n val th2 = CONJ (SPEC T th1) (SPEC F th1)\n val th3 = DISCH tm1 th2\n val th4 = ASSUME tm2\n val th5 = MP (SPEC ``P:bool->bool`` bool_INDUCT) th4\n val th6 = DISCH tm2 th5\n in\n IMP_ANTISYM_RULE th3 th6\n end);\n\n\n(*---------------------------------------------------------------------------\n Results about Unique existence.\n ---------------------------------------------------------------------------*)\n\nlocal\n val LAND_CONV = RATOR_CONV o RAND_CONV\n val P = mk_var(\"P\", Type.alpha --> Type.bool)\n val p = mk_var(\"p\", Type.bool)\n val q = mk_var(\"q\", Type.bool)\n val Q = mk_var(\"Q\", Type.alpha --> Type.bool)\n val x = mk_var(\"x\", Type.alpha)\n val y = mk_var(\"y\", Type.alpha)\n val Px = mk_comb(P, x)\n val Py = mk_comb(P, y)\n val Qx = mk_comb(Q, x)\n val Qy = mk_comb(Q, y)\n val uex_t = mk_const(\"?!\", (alpha --> bool) --> bool)\n val exP = mk_exists(x, Px)\n val exQ = mk_exists(x, Qx)\n val uexP = mk_exists1(x, Px)\n val uexQ = mk_exists1(x, Qx)\n val pseudo_mp = let\n val lhs_t = mk_conj(p, mk_imp(p, q))\n val rhs_t = mk_conj(p, q)\n val lhs_thm = ASSUME lhs_t\n val (p_thm, pimpq) = CONJ_PAIR lhs_thm\n val dir1 = DISCH_ALL (CONJ p_thm (MP pimpq p_thm))\n val rhs_thm = ASSUME rhs_t\n val (p_thm, q_thm) = CONJ_PAIR rhs_thm\n val dir2 = DISCH_ALL (CONJ p_thm (DISCH p q_thm))\n in\n IMP_ANTISYM_RULE dir1 dir2\n end\nin\n val UEXISTS_OR_THM = let\n val subdisj_t = mk_abs(x, mk_disj(Px, Qx))\n val lhs_t = mk_comb(uex_t, subdisj_t)\n val lhs_thm = ASSUME lhs_t\n val lhs_eq = AP_THM EXISTS_UNIQUE_DEF subdisj_t\n val lhs_expanded = CONV_RULE BETA_CONV (EQ_MP lhs_eq lhs_thm)\n val (expq0, univ) = CONJ_PAIR lhs_expanded\n val expq = EQ_MP (SPEC_ALL EXISTS_OR_THM) expq0\n val univ1 = SPEC_ALL univ\n val univ2 = CONV_RULE (LAND_CONV (LAND_CONV BETA_CONV)) univ1\n val univ3 = CONV_RULE (LAND_CONV (RAND_CONV BETA_CONV)) univ2\n val P_half = let\n val asm = ASSUME (mk_conj(Px,Py))\n val (Px_thm, Py_thm) = CONJ_PAIR asm\n val PxQx_thm = DISJ1 Px_thm Qx\n val PyQy_thm = DISJ1 Py_thm Qy\n val resolvent = CONJ PxQx_thm PyQy_thm\n val rhs =\n GENL [x,y]\n (DISCH (mk_conj(Px,Py)) (PROVE_HYP resolvent (UNDISCH univ3)))\n in\n DISJ1 (EQ_MP (SYM EXISTS_UNIQUE_THM) (CONJ (ASSUME exP) rhs)) uexQ\n end\n val Q_half = let\n val asm = ASSUME (mk_conj(Qx,Qy))\n val (Qx_thm, Qy_thm) = CONJ_PAIR asm\n val PxQx_thm = DISJ2 Px Qx_thm\n val PyQy_thm = DISJ2 Py Qy_thm\n val resolvent = CONJ PxQx_thm PyQy_thm\n val rhs =\n GENL [x,y]\n (DISCH (mk_conj(Qx,Qy)) (PROVE_HYP resolvent (UNDISCH univ3)))\n val uex_expanded = SYM (INST [P |-> Q] EXISTS_UNIQUE_THM)\n in\n DISJ2 uexP (EQ_MP uex_expanded (CONJ (ASSUME exQ) rhs))\n end\n in\n save_thm(\"UEXISTS_OR_THM\",\n GENL [P, Q] (DISCH_ALL (DISJ_CASES expq P_half Q_half)))\n end;\n\n val UEXISTS_SIMP = let\n fun mCONV_RULE c thm = TRANS thm (c (rhs (concl thm)))\n val xeqy = mk_eq(x,y)\n val t = mk_var(\"t\", bool)\n val abst = mk_abs(x, t)\n val uext_t = mk_exists1(x,t)\n val exp0 = AP_THM EXISTS_UNIQUE_DEF abst\n val exp1 = mCONV_RULE BETA_CONV exp0\n val exp2 = mCONV_RULE (LAND_CONV (K (SPEC t EXISTS_SIMP))) exp1\n val exp3 =\n mCONV_RULE (RAND_CONV\n (QUANT_CONV\n (QUANT_CONV (LAND_CONV (LAND_CONV BETA_CONV))))) exp2\n val exp4 =\n mCONV_RULE (RAND_CONV\n (QUANT_CONV\n (QUANT_CONV (LAND_CONV (RAND_CONV BETA_CONV))))) exp3\n val exp5 =\n mCONV_RULE (RAND_CONV\n (QUANT_CONV\n (QUANT_CONV (LAND_CONV (K (SPEC t AND_CLAUSE5)))))) exp4\n val pushy0 =\n SPECL [t, mk_abs(y,xeqy)]\n RIGHT_FORALL_IMP_THM\n val pushy1 =\n CONV_RULE (LAND_CONV (QUANT_CONV (RAND_CONV BETA_CONV))) pushy0\n val pushy2 =\n CONV_RULE (RAND_CONV (RAND_CONV (QUANT_CONV BETA_CONV))) pushy1\n val exp6 =\n mCONV_RULE (RAND_CONV (QUANT_CONV (K pushy2))) exp5\n val pushx0 = SPECL [t, mk_abs(x, mk_forall(y,xeqy))]\n RIGHT_FORALL_IMP_THM\n val pushx1 =\n CONV_RULE (LAND_CONV (QUANT_CONV (RAND_CONV BETA_CONV))) pushx0\n val pushx2 =\n CONV_RULE (RAND_CONV (RAND_CONV (QUANT_CONV BETA_CONV))) pushx1\n val exp7 =\n mCONV_RULE (RAND_CONV (K pushx2)) exp6\n val mp' = Thm.INST [p |-> t, q |-> list_mk_forall [x,y] xeqy] pseudo_mp\n in\n save_thm(\"UEXISTS_SIMP\", mCONV_RULE (K mp') exp7)\n end\nend\n\n\n(*---------------------------------------------------------------------------\n The definition of restricted abstraction.\n ---------------------------------------------------------------------------*)\n\nval RES_ABSTRACT_EXISTS =\n let\n fun B_CONV n = funpow n RATOR_CONV BETA_CONV\n fun RHS th = rhs (concl th)\n val p = ``p : 'a -> bool``\n val m = ``m : 'a -> 'b``\n val m1 = ``m1 : 'a -> 'b``\n val m2 = ``m2 : 'a -> 'b``\n val x = ``x : 'a``\n val witness = ``\\p m x. if x IN p then ^m x else ARB x``\n val A1 = B_CONV 2 ``^witness ^p ^m ^x``\n val A2 = TRANS A1 (B_CONV 1 (RHS A1))\n val A3 = TRANS A2 (BETA_CONV (RHS A2))\n val A4 = EQT_INTRO (ASSUME ``^x IN ^p``)\n val A5 = RATOR_CONV (RATOR_CONV (RAND_CONV (K A4))) (RHS A3)\n val A6 = INST_TYPE [alpha |-> beta] COND_CLAUSE1\n val A7 = SPECL [``^m ^x``, ``ARB ^x : 'b``] A6\n val A8 = DISCH ``^x IN ^p`` (TRANS (TRANS A3 A5) A7)\n val A9 = GENL [``^p``, ``^m``, ``^x``] A8\n (* Completed the first clause of the definition *)\n val B1 = SPEC ``^x IN ^p`` EXCLUDED_MIDDLE\n val B2 = UNDISCH A8\n val B3 = INST [m |-> m1] B2\n val B4 = INST [m |-> m2] B2\n val B5 = SPEC_ALL (ASSUME ``!x. x IN ^p ==> (^m1 x = ^m2 x)``)\n val B6 = TRANS B3 (TRANS (UNDISCH B5) (SYM B4))\n val B7 = INST [m |-> m1] A3\n val B8 = INST [m |-> m2] A3\n val B9 = SYM (SPEC ``^x IN ^p`` EQ_CLAUSE4)\n val B10 = EQ_MP B9 (ASSUME ``~(^x IN ^p)``)\n val B11 = INST_TYPE [alpha |-> beta] COND_CLAUSE2\n val B12 = RATOR_CONV (RATOR_CONV (RAND_CONV (K B10))) (RHS B7)\n val B13 = TRANS B12 (SPECL [``^m1 ^x``, ``ARB ^x : 'b``] B11)\n val B14 = RATOR_CONV (RATOR_CONV (RAND_CONV (K B10))) (RHS B8)\n val B15 = TRANS B14 (SPECL [``^m2 ^x``, ``ARB ^x : 'b``] B11)\n val B16 = TRANS (TRANS B7 B13) (SYM (TRANS B8 B15))\n val B17 = DISJ_CASES B1 B6 B16\n val B18 = ABS x B17\n val B19 = CONV_RULE (RATOR_CONV (RAND_CONV ETA_CONV)) B18\n val B20 = CONV_RULE (RAND_CONV ETA_CONV) B19\n val B21 = DISCH ``!x. x IN ^p ==> (^m1 x = ^m2 x)`` B20\n val B22 = GENL [p, m1, m2] B21\n (* Cleaning up *)\n val C1 = CONJ A9 B22\n val C2 = EXISTS\n (``?f.\n (!p (m : 'a -> 'b) x. x IN p ==> (f p m x = m x)) /\\\n (!p m1 m2.\n (!x. x IN p ==> (m1 x = m2 x)) ==> (f p m1 = f p m2))``,\n ``\\p (m : 'a -> 'b) x. (if x IN p then m x else ARB x)``) C1\n in\n C2\n end;\n\nval RES_ABSTRACT_DEF =\n Definition.new_specification\n (\"RES_ABSTRACT_DEF\", [\"RES_ABSTRACT\"], RES_ABSTRACT_EXISTS);\n\nval _ = associate_restriction (\"\\\\\", \"RES_ABSTRACT\");\n\n\nval (RES_FORALL_THM, RES_EXISTS_THM, RES_EXISTS_UNIQUE_THM, RES_SELECT_THM) =\n let\n val Pf = map (fn s => mk_var(s, alpha --> bool)) [\"P\", \"f\"]\n fun mk_eq th =\n GENL Pf (List.foldl (RIGHT_BETA o uncurry (C AP_THM)) th Pf)\n in\n (save_thm(\"RES_FORALL_THM\", mk_eq RES_FORALL_DEF),\n save_thm(\"RES_EXISTS_THM\", mk_eq RES_EXISTS_DEF),\n save_thm(\"RES_EXISTS_UNIQUE_THM\", mk_eq RES_EXISTS_UNIQUE_DEF),\n save_thm(\"RES_SELECT_THM\", mk_eq RES_SELECT_DEF))\n end\n\n\n(* (!x::P. T) = T *)\nval RES_FORALL_TRUE = let\n val x = mk_var(\"x\", alpha)\n val T = concl TRUTH\n val KT = mk_abs(x, T)\n val P = mk_var(\"P\", alpha --> bool)\n val th0 = SPECL[P,KT] RES_FORALL_THM\n val th1 = CONV_RULE (RAND_CONV (QUANT_CONV (RAND_CONV BETA_CONV))) th0\n val xINP_t = (rand o rator o #2 o dest_forall o rhs o concl) th1\n val timpT_th = List.nth(CONJUNCTS (SPEC xINP_t IMP_CLAUSES), 1)\n val th2 = CONV_RULE (RAND_CONV (QUANT_CONV (K timpT_th))) th1\nin\n save_thm(\"RES_FORALL_TRUE\", TRANS th2 (SPEC T FORALL_SIMP))\nend\n\n(* (?x::P. F) = F *)\nval RES_EXISTS_FALSE = let\n val x = mk_var(\"x\", alpha)\n val F = prim_mk_const{Thy = \"bool\", Name = \"F\"}\n val KF = mk_abs(x, F)\n val P = mk_var(\"P\", alpha --> bool)\n val th0 = SPECL [P, KF] RES_EXISTS_THM\n val th1 = CONV_RULE (RAND_CONV (QUANT_CONV (RAND_CONV BETA_CONV))) th0\n val xINP_t = (rand o rator o #2 o dest_exists o rhs o concl) th1\n val tandF_th = List.nth(CONJUNCTS (SPEC xINP_t AND_CLAUSES), 3)\n val th2 = CONV_RULE (RAND_CONV (QUANT_CONV (K tandF_th))) th1\nin\n save_thm(\"RES_EXISTS_FALSE\", TRANS th2 (SPEC F EXISTS_SIMP))\nend\n\n(*---------------------------------------------------------------------------\n From Joe Hurd : case analysis on the (4) functions in the\n type :bool -> bool.\n\n val BOOL_FUN_CASES_THM =\n |- !f. (f = \\b. T) \\/ (f = \\b. F) \\/ (f = \\b. b) \\/ (f = \\b. ~b)\n ---------------------------------------------------------------------------*)\n\nval BOOL_FUN_CASES_THM =\n let val x = mk_var(\"x\",bool)\n val f = mk_var(\"f\",bool-->bool)\n val KF = ``\\b:bool.F``\n val KT = ``\\b:bool.T``\n val Ibool = ``\\b:bool.b``\n val dual = ``\\b. ~b``\n val fT = mk_comb(f,T)\n val fF = mk_comb(f,F)\n val fT_eq_T = mk_eq(fT,T)\n val fF_eq_T = mk_eq(fF,T)\n val fT_eq_F = mk_eq(fT,F)\n val fF_eq_F = mk_eq(fF,F)\n val final = ``(f = ^KT) \\/ (f = ^KF) \\/ (f = ^Ibool) \\/ (f = ^dual)``\n val a0 = TRANS (ASSUME fT_eq_T) (SYM (BETA_CONV (mk_comb(KT,T))))\n val a1 = TRANS (ASSUME fF_eq_T) (SYM (BETA_CONV (mk_comb(KT,F))))\n val a2 = BOOL_CASE ``f x = ^KT x`` x x a0 a1\n val a3 = EXT (GEN x a2)\n val a = DISJ1 a3 ``(f = \\b. F) \\/ (f = \\b. b) \\/ (f = \\b. ~b)``\n val b0 = TRANS (ASSUME fT_eq_F) (SYM (BETA_CONV (mk_comb(KF,T))))\n val b1 = TRANS (ASSUME fF_eq_F) (SYM (BETA_CONV (mk_comb(KF,F))))\n val b2 = BOOL_CASE ``f x = ^KF x`` x x b0 b1\n val b3 = EXT (GEN x b2)\n val b4 = DISJ1 b3 ``(f = ^Ibool) \\/ (f = \\b. ~b)``\n val b = DISJ2 ``f = ^KT`` b4\n val c0 = TRANS (ASSUME fT_eq_T) (SYM (BETA_CONV (mk_comb(Ibool,T))))\n val c1 = TRANS (ASSUME fF_eq_F) (SYM (BETA_CONV (mk_comb(Ibool,F))))\n val c2 = BOOL_CASE ``f x = ^Ibool x`` x x c0 c1\n val c3 = EXT (GEN x c2)\n val c4 = DISJ1 c3 ``f = ^dual``\n val c5 = DISJ2 ``f = ^KF`` c4\n val c = DISJ2 ``f = ^KT`` c5\n val d0 = TRANS (ASSUME fT_eq_F)\n (TRANS (SYM (CONJUNCT1 (CONJUNCT2 NOT_CLAUSES)))\n (SYM (BETA_CONV (mk_comb(dual,T)))))\n val d1 = TRANS (ASSUME fF_eq_T)\n (TRANS (SYM (CONJUNCT2 (CONJUNCT2 NOT_CLAUSES)))\n (SYM (BETA_CONV (mk_comb(dual,F)))))\n val d2 = BOOL_CASE ``f x = ^dual x`` x x d0 d1\n val d3 = EXT (GEN x d2)\n val d4 = DISJ2 ``f = ^Ibool`` d3\n val d5 = DISJ2 ``f = ^KF`` d4\n val d = DISJ2 ``f = ^KT`` d5\n val ad0 = DISCH fT_eq_T a\n val ad1 = DISCH fT_eq_F d\n val ad2 = BOOL_CASE ``(f T = x) ==> ^final`` x x ad0 ad1\n val ad3 = SPEC fT (GEN x ad2)\n val ad = MP ad3 (REFL fT)\n val bc0 = DISCH fT_eq_T c\n val bc1 = DISCH fT_eq_F b\n val bc2 = BOOL_CASE ``(f T = x) ==> ^final`` x x bc0 bc1\n val bc3 = SPEC fT (GEN x bc2)\n val bc = MP bc3 (REFL fT)\n val abcd0 = DISCH fF_eq_T ad\n val abcd1 = DISCH fF_eq_F bc\n val abcd2 = BOOL_CASE ``(f F = x) ==> ^final`` x x abcd0 abcd1\n val abcd3 = SPEC fF (GEN x abcd2)\n val abcd = MP abcd3 (REFL fF)\nin\n save_thm(\"BOOL_FUN_CASES_THM\", GEN f abcd)\nend;\n\n(*---------------------------------------------------------------------------\n Another from Joe Hurd : consequence of BOOL_FUN_CASES_THM\n\n BOOL_FUN_INDUCT =\n |- !P. P (\\b. T) /\\ P (\\b. F) /\\ P (\\b. b) /\\ P (\\b. ~b) ==> !f. P f\n ---------------------------------------------------------------------------*)\n\n fun or_imp th0 =\n let val (disj1, disj2) = dest_disj (concl th0)\n val th1 = SYM (SPEC disj1 (CONJUNCT1 NOT_CLAUSES))\n val th2 = MK_COMB (REFL disjunction, th1)\n val th3 = MK_COMB (th2, REFL disj2)\n val th4 = EQ_MP th3 th0\n val th5 = SYM (SPECL [mk_neg disj1, disj2] IMP_DISJ_THM)\n in\n EQ_MP th5 th4\n end\n\n fun imp_and th0 =\n let val (ant, conseq) = dest_imp (concl th0)\n val (ant', conseq') = dest_imp conseq\n val th1 = SPECL [ant, ant', conseq'] AND_IMP_INTRO\n in\n EQ_MP th1 th0\n end\n\n\nval BOOL_FUN_INDUCT =\n let val f = mk_var(\"f\",bool-->bool)\n val g = mk_var(\"g\",bool-->bool)\n val f_eq_g = mk_eq(f,g)\n val P = mk_var(\"P\",(bool-->bool) --> bool)\n val KF = ``\\b:bool.F``\n val KT = ``\\b:bool.T``\n val Ibool = ``\\b:bool.b``\n val dual = ``\\b. ~b``\n val f0 = ASSUME (mk_neg(mk_comb(P,f)))\n val f1 = ASSUME (mk_neg(mk_neg(f_eq_g)))\n val f2 = EQ_MP (SPEC f_eq_g (CONJUNCT1 NOT_CLAUSES)) f1\n val f3 = MK_COMB (REFL P, f2)\n val f4 = MK_COMB (REFL negation, f3)\n val f5 = UNDISCH (NOT_ELIM (EQ_MP f4 f0))\n val f6 = CCONTR (mk_neg(f_eq_g)) f5\n val f7 = GEN g (DISCH (mk_comb(P,g)) f6)\n val a0 = SPEC f BOOL_FUN_CASES_THM\n val a1 = MP (or_imp a0) (UNDISCH (SPEC KT f7))\n val a2 = MP (or_imp a1) (UNDISCH (SPEC KF f7))\n val a3 = MP (or_imp a2) (UNDISCH (SPEC Ibool f7))\n val a = MP (NOT_ELIM (UNDISCH (SPEC dual f7))) a3\n val b0 = CCONTR (mk_comb(P,f)) a\n val b1 = GEN f b0\n val b2 = DISCH (mk_comb(P,dual)) b1\n val b3 = imp_and (DISCH (mk_comb(P,Ibool)) b2)\n val b4 = imp_and (DISCH (mk_comb(P,KF)) b3)\n val b = imp_and (DISCH (mk_comb(P,KT)) b4)\nin\n save_thm(\"BOOL_FUN_INDUCT\", GEN P b)\nend;\n\n(*---------------------------------------------------------------------------\n literal_case_THM = |- !f x. literal_case f x = f x\n ---------------------------------------------------------------------------*)\n\nval literal_case_THM = save_thm(\"literal_case_THM\",\n let val f = ``f:'a->'b``\n val x = ``x:'a``\n in\n GEN f (GEN x\n (RIGHT_BETA(AP_THM (RIGHT_BETA(AP_THM literal_case_DEF f)) x)))\n end);\n\n(*---------------------------------------------------------------------------*)\n(* literal_case_RAND = *)\n(* |- P (literal_case (\\x. N x) M) = (literal_case (\\x. P (N x)) M) *)\n(*---------------------------------------------------------------------------*)\n\nval literal_case_RAND = save_thm(\"literal_case_RAND\",\n let val tm1 = ``\\x:'a. P (N x:'b):'c``\n val tm2 = ``M:'a``\n val tm3 = ``\\x:'a. N x:'b``\n val P = ``P:'b ->'c``\n val literal_case_THM1 = RIGHT_BETA (SPEC tm2 (SPEC tm1\n (Thm.INST_TYPE [beta |-> gamma] literal_case_THM)))\n val literal_case_THM2 = AP_TERM P (RIGHT_BETA (SPEC tm2 (SPEC tm3 literal_case_THM)))\n in TRANS literal_case_THM2 (SYM literal_case_THM1)\n end);\n\n(*---------------------------------------------------------------------------*)\n(* literal_case_RATOR = *)\n(* |- (literal_case (\\x. N x) M) b = (literal_case (\\x. N x b) M) *)\n(*---------------------------------------------------------------------------*)\n\nval literal_case_RATOR = save_thm(\"literal_case_RATOR\",\n let val M = ``M:'a``\n val b = ``b:'b``\n val tm1 = ``\\x:'a. N x:'b->'c``\n val tm2 = ``\\x:'a. N x ^b:'c``\n val literal_case_THM1 = AP_THM (RIGHT_BETA (SPEC M (SPEC tm1\n (Thm.INST_TYPE [beta |-> (beta --> gamma)] literal_case_THM)))) b\n val literal_case_THM2 = RIGHT_BETA (SPEC M (SPEC tm2\n (Thm.INST_TYPE [beta |-> gamma] literal_case_THM)))\n in TRANS literal_case_THM1 (SYM literal_case_THM2)\n end);\n\n(*---------------------------------------------------------------------------\n literal_case_CONG =\n |- !f g M N. (M = N) /\\ (!x. (x = N) ==> (f x = g x))\n ==>\n (literal_case f M = literal_case g N)\n ---------------------------------------------------------------------------*)\n\nval literal_case_CONG = save_thm(\"literal_case_CONG\",\n let val f = mk_var(\"f\",alpha-->beta)\n val g = mk_var(\"g\",alpha-->beta)\n val M = mk_var(\"M\",alpha)\n val N = mk_var(\"N\",alpha)\n val x = mk_var (\"x\",alpha)\n val MeqN = mk_eq(M,N)\n val x_eq_N = mk_eq(x,N)\n val fx_eq_gx = mk_eq(mk_comb(f,x),mk_comb(g,x))\n val ctm = mk_forall(x, mk_imp(x_eq_N,fx_eq_gx))\n val th = RIGHT_BETA(AP_THM(RIGHT_BETA(AP_THM literal_case_DEF f)) M)\n val th1 = ASSUME MeqN\n val th2 = MP (SPEC N (ASSUME ctm)) (REFL N)\n val th3 = SUBS [SYM th1] th2\n val th4 = TRANS (TRANS th th3) (MK_COMB (REFL g,th1))\n val th5 = RIGHT_BETA(AP_THM(RIGHT_BETA(AP_THM literal_case_DEF g)) N)\n val th6 = TRANS th4 (SYM th5)\n val th7 = SUBS [SPECL [MeqN, ctm, concl th6] AND_IMP_INTRO]\n (DISCH MeqN (DISCH ctm th6))\n in\n GENL [f,g,M,N] th7\n end);\n\n(*---------------------------------------------------------------------------*)\n(* Sometime useful rewrite, but you will want a higher-order version. *)\n(* |- literal_case (\\x. bool_case t u (x=a)) a = t *)\n(*---------------------------------------------------------------------------*)\n\nval literal_case_id = save_thm\n(\"literal_case_id\",\n let val a = mk_var(\"a\", alpha)\n val x = mk_var(\"x\", alpha)\n val t = mk_var(\"t\",beta)\n val u = mk_var(\"u\",beta)\n val eq = mk_eq(x,a)\n val bcase = inst [alpha |-> beta]\n (prim_mk_const{Name = \"COND\",Thy=\"bool\"})\n val g = mk_abs(x,list_mk_comb(bcase,[eq, t, u]))\n val lit_thm = RIGHT_BETA(SPEC a (SPEC g literal_case_THM))\n val Teq = SYM (EQT_INTRO(REFL a))\n val ifT = CONJUNCT1(SPECL[t,u] (INST_TYPE[alpha |-> beta] COND_CLAUSES))\n val ifeq = SUBS [Teq] ifT\n in\n TRANS lit_thm ifeq\n end);\n\n(*---------------------------------------------------------------------------\n Support for parsing \"case\" expressions\n ---------------------------------------------------------------------------*)\n\nval _ = new_constant(GrammarSpecials.core_case_special,\n ``:'a -> ('a -> 'b) -> 'b``);\n\nval _ = new_constant(GrammarSpecials.case_split_special,\n ``:('a -> 'b) -> ('a -> 'b) -> 'a -> 'b``);\nval _ = new_constant(GrammarSpecials.case_arrow_special,\n ``:'a -> 'b -> 'a -> 'b``);\n\nval _ = let open GrammarSpecials\n in app (fn s => remove_ovl_mapping s {Name=s,Thy=\"bool\"})\n [case_split_special, case_arrow_special]\n end\n\nval _ = add_rule{pp_elements = [HardSpace 1, TOK \"=>\", BreakSpace(1,2)],\n fixity = Infix(NONASSOC, 12),\n (* allowing for insertion of .| infix at looser precedence\n level *)\n block_style = (AroundEachPhrase, (PP.CONSISTENT, 0)),\n paren_style = OnlyIfNecessary,\n term_name = GrammarSpecials.case_arrow_special}\n\nval _ = add_rule{pp_elements = [PPBlock([TOK \"case\", BreakSpace(1,2),\n TM, BreakSpace(1,2), TOK \"of\"],\n (PP.CONSISTENT, 0)),\n BreakSpace(1,2)],\n fixity = Prefix 1,\n block_style = (AroundEachPhrase, (PP.CONSISTENT, 0)),\n paren_style = Always,\n term_name = GrammarSpecials.core_case_special};\n\nval _ = add_rule{pp_elements = [PPBlock([TOK \"case\", BreakSpace(1,2),\n TM, BreakSpace(1,2), TOK \"of\"],\n (PP.CONSISTENT, 0)),\n BreakSpace(1,2), TM, BreakSpace(1,0),\n TOK \"|\", HardSpace 1],\n fixity = Prefix 1,\n block_style = (AroundEachPhrase, (PP.CONSISTENT, 0)),\n paren_style = Always,\n term_name = GrammarSpecials.core_case_special};\n\nval _ = add_rule{pp_elements = [PPBlock([TOK \"case\", BreakSpace(1,2),\n TM, BreakSpace(1,2), TOK \"of\"],\n (PP.CONSISTENT, 0)),\n TOK \"|\", HardSpace 1],\n fixity = Prefix 1,\n block_style = (AroundEachPhrase, (PP.CONSISTENT, 0)),\n paren_style = Always,\n term_name = GrammarSpecials.core_case_special};\n\n\nval _ = add_rule{pp_elements = [PPBlock([TOK \"case\", BreakSpace(1,2),\n TM, BreakSpace(1,2), TOK \"of\"],\n (PP.CONSISTENT, 0)),\n BreakSpace(1,2), TM, BreakSpace(1,0),\n TOK \"|\", HardSpace 1, TM, BreakSpace(1,0),\n TOK \"|\", HardSpace 1],\n fixity = Prefix 1,\n block_style = (AroundEachPhrase, (PP.CONSISTENT, 0)),\n paren_style = Always,\n term_name = GrammarSpecials.core_case_special};\n\nval BOUNDED_THM = save_thm(\"BOUNDED_THM\",\n let val v = ``v:bool``\n in\n GEN v (RIGHT_BETA(AP_THM BOUNDED_DEF v))\n end);\n\n(*---------------------------------------------------------------------------*)\n(* LCOMM_THM : derive \"left-commutativity\" from associativity and *)\n(* commutativity. Used in permutative rewriting, e.g., simpLib entrypoints *)\n(* *)\n(* LCOMM_THM |- !f. (!x y. f x y = f y x) ==> *)\n(* (!x y z. f x (f y z) = f (f x y) z) ==> *)\n(* (!x y z. f x (f y z) = f y (f x z)) *)\n(*---------------------------------------------------------------------------*)\n\nval LCOMM_THM = save_thm(\"LCOMM_THM\",\n let val x = mk_var(\"x\",alpha)\n val y = mk_var(\"y\",alpha)\n val z = mk_var(\"z\",alpha)\n val f = mk_var(\"f\",alpha --> alpha --> alpha)\n val comm = ``!x y. ^f x y = f y x``\n val assoc = ``!x y z. ^f x (f y z) = f (f x y) z``\n val comm_thm = ASSUME comm\n val assoc_thm = ASSUME assoc\n val th0 = SPEC (list_mk_comb(f,[y,z])) (SPEC x comm_thm)\n val th1 = SYM (SPECL [y,z,x] assoc_thm)\n val th2 = TRANS th0 th1\n val th3 = AP_TERM (mk_comb(f,y)) (SPECL[z,x] comm_thm)\n in\n GEN f (DISCH assoc (DISCH comm (GENL [x,y,z] (TRANS th2 th3))))\n end);\n\n\nval DATATYPE_TAG_THM = save_thm(\"DATATYPE_TAG_THM\",\n let val x = mk_var(\"x\",alpha)\n in GEN x (RIGHT_BETA (AP_THM DATATYPE_TAG_DEF x))\n end);\n\n\nval DATATYPE_BOOL = save_thm(\"DATATYPE_BOOL\",\n let val thm1 = INST_TYPE [alpha |-> bool] DATATYPE_TAG_THM\n val bvar = mk_var(\"bool\",bool--> bool-->bool)\n in\n SPEC (list_mk_comb(bvar,[T,F])) thm1\n end);\n\n(* ----------------------------------------------------------------------\n Set up the \"itself\" type constructor and its one value\n ---------------------------------------------------------------------- *)\n\nval ITSELF_TYPE_DEF = let\n val itself_exists = SPEC ``ARB:'a`` EXISTS_REFL\n val eq_sym_eq' =\n AP_TERM ``$? :('a -> bool) -> bool``\n (ABS ``x:'a`` (SPECL [``x:'a``, ``ARB:'a``] EQ_SYM_EQ))\nin\n new_type_definition(\"itself\", EQ_MP eq_sym_eq' itself_exists)\nend\nval _ = new_constant(\"the_value\", ``:'a itself``)\n\n(* prove uniqueness of the itself value:\n |- !i:'a itself. i = (:'a)\n*)\nval ITSELF_UNIQUE = let\n val typedef_asm = ASSUME (#2 (dest_exists (concl ITSELF_TYPE_DEF)))\n val typedef_eq0 =\n AP_THM (INST_TYPE [beta |-> ``:'a itself``] TYPE_DEFINITION)\n ``$= (ARB:'a)``\n val typedef_eq0 = RIGHT_BETA typedef_eq0\n val typedef_eq = AP_THM typedef_eq0 ``rep:'a itself -> 'a``\n val typedef_eq = RIGHT_BETA typedef_eq\n val (typedef_11, typedef_onto) = CONJ_PAIR (EQ_MP typedef_eq typedef_asm)\n val onto' = INST [``x:'a`` |-> ``(rep:'a itself -> 'a) i``]\n (#2 (EQ_IMP_RULE (SPEC_ALL typedef_onto)))\n val allreps_arb = let\n val ex' = EXISTS (``?x':'a itself. rep i = rep x':'a``, ``i:'a itself``)\n (REFL ``(rep:'a itself -> 'a) i``)\n in\n SYM (MP onto' ex')\n end\n val allreps_repthevalue =\n TRANS allreps_arb\n (SYM (INST [``i:'a itself`` |-> ``bool$the_value``] allreps_arb))\n val all_eq_thevalue =\n GEN_ALL (MP (SPECL [``i:'a itself``, ``bool$the_value``] typedef_11)\n allreps_repthevalue)\nin\n save_thm(\"ITSELF_UNIQUE\",\n CHOOSE (``rep:'a itself -> 'a``, ITSELF_TYPE_DEF) all_eq_thevalue)\nend\n\n(* prove a datatype axiom for the type, allowing definitions of the form\n f (:'a) = ...\n*)\nval itself_Axiom = let\n val witness = ``(\\x:'a itself. e : 'b)``\n val fn_behaves = BETA_CONV (mk_comb(witness, ``(:'a)``))\n val fn_exists = EXISTS (``?f:'a itself -> 'b. f (:'a) = e``, witness)\n fn_behaves\nin\n save_thm(\"itself_Axiom\", GEN_ALL fn_exists)\nend\n\n(* prove induction *)\nval itself_induction = let\n val pval = ASSUME ``P (:'a) : bool``\n val pi =\n EQ_MP (SYM (AP_TERM ``P:'a itself -> bool`` (SPEC_ALL ITSELF_UNIQUE)))\n pval\nin\n save_thm(\"itself_induction\", GEN_ALL (DISCH_ALL (GEN_ALL pi)))\nend\n\n(* define case operator *)\nval itself_case_thm = let\n val witness = ``\\(i:'a itself) (b:'b). b``\n val witness_applied1 = BETA_CONV (mk_comb(witness, ``(:'a)``))\n val witness_applied2 = RIGHT_BETA (AP_THM witness_applied1 ``b:'b``)\nin\n new_specification(\"itself_case_thm\",\n [\"itself_case\"],\n EXISTS (``?f:'a itself -> 'b -> 'b. !b. f (:'a) b = b``,\n witness)\n (GEN_ALL witness_applied2))\nend\nval _ = overload_on(\"case\", ``itself_case``)\n\n(* FORALL_itself : |- (!x:'a itself. P x) <=> P (:'a)\n EXISTS_itself : |- (?x:'a itself. P x) <=> P (:'a)\n*)\nlocal\n val P = mk_var(\"P\", “:'a itself -> bool”)\n val x = mk_var(\"x\", “:'a itself”)\n val Px = mk_comb(P, x)\n val APx = mk_forall(x, Px)\n val itself = “(:'a)”\n val Pitself = mk_comb(P, itself)\n val imp1 = APx |> ASSUME |> SPEC itself |> DISCH_ALL\n val unique = AP_TERM P (ITSELF_UNIQUE |> SPEC x |> SYM)\n val imp2 = EQ_MP unique (ASSUME Pitself) |> GEN x |> DISCH_ALL\n val fa = IMP_ANTISYM_RULE imp1 imp2\n val not_not = NOT_CLAUSES |> CONJUNCT1 |> SPEC Px\n (* exists half *)\n val imp1 = CHOOSE (x, ASSUME (mk_exists(x,Px)))\n (EQ_MP (SYM unique) (ASSUME Px)) |> DISCH_ALL\n val imp2 = EXISTS(mk_exists(x,Px),itself) (ASSUME Pitself) |> DISCH_ALL\nin\n val FORALL_itself = save_thm(\"FORALL_itself\", fa)\n val EXISTS_itself = save_thm(\"EXISTS_itself\", IMP_ANTISYM_RULE imp1 imp2)\nend;\n\n(*---------------------------------------------------------------------------*)\n(* Pulling FORALL and EXISTS up through /\\ and ==> *)\n(*---------------------------------------------------------------------------*)\n\nlocal\n val flip = INST [Pb |-> Qb, Qab |-> Pab]\n val PULL_EXISTS1 = LEFT_FORALL_IMP_THM |> SPEC_ALL |> SYM\n val PULL_EXISTS2 = LEFT_EXISTS_AND_THM |> SPEC_ALL |> SYM\n val PULL_EXISTS3 = RIGHT_EXISTS_AND_THM |> SPEC_ALL |> SYM |> flip\n val PULL_FORALL1 = RIGHT_FORALL_IMP_THM |> SPEC_ALL |> SYM |> flip\n val PULL_FORALL2 = LEFT_AND_FORALL_THM |> SPEC_ALL\n val PULL_FORALL3 = RIGHT_AND_FORALL_THM |> SPEC_ALL |> flip\nin\n val PULL_EXISTS = save_thm(\"PULL_EXISTS\",\n LIST_CONJ [PULL_EXISTS1, PULL_EXISTS2, PULL_EXISTS3] |> GENL [Pab, Qb])\n val PULL_FORALL = save_thm(\"PULL_FORALL\",\n LIST_CONJ [PULL_FORALL1, PULL_FORALL2, PULL_FORALL3] |> GENL [Pab, Qb])\nend\n\n(*---------------------------------------------------------------------------*)\n(* PEIRCE = |- ((P ==> Q) ==> P) ==> P *)\n(*---------------------------------------------------------------------------*)\n\nval PEIRCE = save_thm\n(\"PEIRCE\",\n let val th1 = ASSUME ``(P ==> Q) ==> P``\n val th2 = ASSUME ``P:bool``\n val th3 = ASSUME ``~P``\n val th4 = MP th3 th2\n val th5 = MP (SPEC ``Q:bool`` FALSITY) th4\n val th6 = DISCH ``P:bool`` th5\n val th7 = MP th1 th6\n val th8 = MP th3 th7\n val th9 = DISCH ``~P`` th8\n val th10 = MP (SPEC ``~P`` IMP_F) th9\n val th11 = SUBS [SPEC ``P:bool`` (CONJUNCT1 NOT_CLAUSES)] th10\n in\n DISCH ``(P ==> Q) ==> P`` th11\n end);\n\n(* ----------------------------------------------------------------------\n JRH_INDUCT_UTIL : !P t. (!x. (x = t) ==> P x) ==> $? P\n\n Used multiple times in places relevant to inductive definitions and/or\n algebraic types.\n ---------------------------------------------------------------------- *)\n\nval JRH_INDUCT_UTIL = let\n val asm_t = ``!x:'a. (x = t) ==> P x``\n val asm = ASSUME asm_t\n val t = ``t:'a``\n val P = ``P : 'a -> bool``\n val Pt = MP (SPEC t asm) (REFL t)\n val ExPx = EXISTS (``?x:'a. P x``, t) Pt\n val P_eta = SPEC P (INST_TYPE [beta |-> bool] ETA_AX)\n val ExP_eta = AP_TERM ``(?) : ('a -> bool) -> bool`` P_eta\nin\n save_thm(\"JRH_INDUCT_UTIL\", GENL [P, t] (DISCH asm_t (EQ_MP ExP_eta ExPx)))\nend\n(* Parsing additions *)\n\n(* not an element of *)\nval _ = overload_on (\"NOTIN\", ``\\x:'a y:('a -> bool). ~(x IN y)``)\nval _ = set_fixity \"NOTIN\" (Infix(NONASSOC, 425))\nval _ = unicode_version {u = UChar.not_elementof, tmnm = \"NOTIN\"}\nval _ = TeX_notation {hol=\"NOTIN\", TeX = (\"\\\\HOLTokenNotIn{}\",1)}\nval _ = TeX_notation {hol=UChar.not_elementof,\n TeX = (\"\\\\HOLTokenNotIn{}\",1)}\n\n(* not iff *)\nval _ = overload_on (\"<=/=>\", ``$<> : bool -> bool -> bool``)\nval _ = set_fixity \"<=/=>\" (Infix(NONASSOC, 100))\nval _ = unicode_version {u = UChar.not_iff, tmnm = \"<=/=>\"}\nval _ = TeX_notation {hol=\"<=/=>\", TeX = (\"\\\\HOLTokenNotEquiv{}\",3)}\nval _ = TeX_notation {hol=UChar.not_iff,\n TeX = (\"\\\\HOLTokenNotEquiv{}\",3)}\n\nlocal open boolpp in end\nval _ = add_ML_dependency \"boolpp\"\nval _ = add_user_printer (\"bool.COND\", ``COND gd tr fl``)\nval _ = add_user_printer (\"bool.LET\", ``LET f x``)\nval _ = add_absyn_postprocessor \"bool.LET\"\n\nval DISJ_EQ_IMP = save_thm(\"DISJ_EQ_IMP\",\n let\n val lemma = NOT_CLAUSES |> CONJUNCT1 |> SPEC ``A:bool``\n in\n IMP_DISJ_THM\n |> SPECL [``~A:bool``,``B:bool``]\n |> SYM\n |> CONV_RULE\n ((RATOR_CONV o RAND_CONV o RATOR_CONV o RAND_CONV)\n (fn tm => lemma))\n |> GENL [``A:bool``,``B:bool``]\n end);\n\nval _ = export_theory()\nin end\n\\\nML \\Context_Var.reset_temp()\\\nML \\\nval _ = transfer_thms :=\n SOME {ex_equiv = IsaHOLThmTransfer.exists_schematic,\n bool_ex_Ex = IsaHOLThmTransfer.bool_ex_Ex,\n bool_exI = bool_exI, \n typedef_equiv = IsaHOLThmTransfer.type_definition_equiv}\n\\\n\nML \\Holmake build_heap (make_modules [\"boolTheory\"]) \"HOL/src/bool\"\\\n\n\nsubsection \\Different ML types (and therefore pretty printing (set up in \\HOL4_Core_Isabelle\\)) for Theorems\\\nML \\val Thm = Thm.Thm\\\nML \\val Thm' = Thm.Thm'\\\nML \\boolTheory.IMP_F_EQ_F\\\nML \\Thm' boolTheory.IMP_F_EQ_F\\\nML \\Thm (Thm' boolTheory.IMP_F_EQ_F)\\\n\nend", "meta": {"author": "immler", "repo": "hol4isabelle", "sha": "e4c53d70ed1354b152bc3b65126a1b4a849288c9", "save_path": "github-repos/isabelle/immler-hol4isabelle", "path": "github-repos/isabelle/immler-hol4isabelle/hol4isabelle-e4c53d70ed1354b152bc3b65126a1b4a849288c9/Bool_Kernel_Isabelle.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.29034436174122547}} {"text": "section \\Operational Semantics\\\n\ntheory RG_Tran\nimports RG_Com\nbegin\n\nsubsection \\Semantics of Component Programs\\\n\nsubsubsection \\Environment transitions\\\n\ntype_synonym 'a conf = \"(('a com) option) \\ 'a\"\n\ninductive_set\n etran :: \"('a conf \\ 'a conf) set\" \n and etran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -e\\ _\" [81,81] 80)\nwhere\n \"P -e\\ Q \\ (P,Q) \\ etran\"\n| Env: \"(P, s) -e\\ (P, t)\"\n\nlemma etranE: \"c -e\\ c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule etran.cases, blast)\n\nsubsubsection \\Component transitions\\\n\ninductive_set\n ctran :: \"('a conf \\ 'a conf) set\"\n and ctran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c\\ _\" [81,81] 80)\n and ctrans :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c*\\ _\" [81,81] 80)\nwhere\n \"P -c\\ Q \\ (P,Q) \\ ctran\"\n| \"P -c*\\ Q \\ (P,Q) \\ ctran^*\"\n\n| Basic: \"(Some(Basic f), s) -c\\ (None, f s)\"\n\n| Seq1: \"(Some P0, s) -c\\ (None, t) \\ (Some(Seq P0 P1), s) -c\\ (Some P1, t)\"\n\n| Seq2: \"(Some P0, s) -c\\ (Some P2, t) \\ (Some(Seq P0 P1), s) -c\\ (Some(Seq P2 P1), t)\"\n\n| CondT: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P1, s)\"\n| CondF: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P2, s)\"\n\n| WhileF: \"s\\b \\ (Some(While b P), s) -c\\ (None, s)\"\n| WhileT: \"s\\b \\ (Some(While b P), s) -c\\ (Some(Seq P (While b P)), s)\"\n\n| Await: \"\\s\\b; (Some P, s) -c*\\ (None, t)\\ \\ (Some(Await b P), s) -c\\ (None, t)\" \n\nmonos \"rtrancl_mono\"\n\nsubsection \\Semantics of Parallel Programs\\\n\ntype_synonym 'a par_conf = \"('a par_com) \\ 'a\"\n\ninductive_set\n par_etran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_etran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pe\\ _\" [81,81] 80)\nwhere\n \"P -pe\\ Q \\ (P,Q) \\ par_etran\"\n| ParEnv: \"(Ps, s) -pe\\ (Ps, t)\"\n\ninductive_set\n par_ctran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_ctran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pc\\ _\" [81,81] 80)\nwhere\n \"P -pc\\ Q \\ (P,Q) \\ par_ctran\"\n| ParComp: \"\\i (r, t)\\ \\ (Ps, s) -pc\\ (Ps[i:=r], t)\"\n\nlemma par_ctranE: \"c -pc\\ c' \\\n (\\i Ps s r t. c = (Ps, s) \\ c' = (Ps[i := r], t) \\ i < length Ps \\\n (Ps ! i, s) -c\\ (r, t) \\ P) \\ P\"\n by (induct c, induct c', erule par_ctran.cases, blast)\n\nsubsection \\Computations\\\n\nsubsubsection \\Sequential computations\\\n\ntype_synonym 'a confs = \"'a conf list\"\n\ninductive_set cptn :: \"'a confs set\"\nwhere\n CptnOne: \"[(P,s)] \\ cptn\"\n| CptnEnv: \"(P, t)#xs \\ cptn \\ (P,s)#(P,t)#xs \\ cptn\"\n| CptnComp: \"\\(P,s) -c\\ (Q,t); (Q, t)#xs \\ cptn \\ \\ (P,s)#(Q,t)#xs \\ cptn\"\n\ndefinition cp :: \"('a com) option \\ 'a \\ ('a confs) set\" where\n \"cp P s \\ {l. l!0=(P,s) \\ l \\ cptn}\" \n\nsubsubsection \\Parallel computations\\\n\ntype_synonym 'a par_confs = \"'a par_conf list\"\n\ninductive_set par_cptn :: \"'a par_confs set\"\nwhere\n ParCptnOne: \"[(P,s)] \\ par_cptn\"\n| ParCptnEnv: \"(P,t)#xs \\ par_cptn \\ (P,s)#(P,t)#xs \\ par_cptn\"\n| ParCptnComp: \"\\ (P,s) -pc\\ (Q,t); (Q,t)#xs \\ par_cptn \\ \\ (P,s)#(Q,t)#xs \\ par_cptn\"\n\ndefinition par_cp :: \"'a par_com \\ 'a \\ ('a par_confs) set\" where\n \"par_cp P s \\ {l. l!0=(P,s) \\ l \\ par_cptn}\" \n\nsubsection\\Modular Definition of Computation\\\n\ndefinition lift :: \"'a com \\ 'a conf \\ 'a conf\" where\n \"lift Q \\ \\(P, s). (if P=None then (Some Q,s) else (Some(Seq (the P) Q), s))\"\n\ninductive_set cptn_mod :: \"('a confs) set\"\nwhere\n CptnModOne: \"[(P, s)] \\ cptn_mod\"\n| CptnModEnv: \"(P, t)#xs \\ cptn_mod \\ (P, s)#(P, t)#xs \\ cptn_mod\"\n| CptnModNone: \"\\(Some P, s) -c\\ (None, t); (None, t)#xs \\ cptn_mod \\ \\ (Some P,s)#(None, t)#xs \\cptn_mod\"\n| CptnModCondT: \"\\(Some P0, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P0, s)#ys \\ cptn_mod\"\n| CptnModCondF: \"\\(Some P1, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P1, s)#ys \\ cptn_mod\"\n| CptnModSeq1: \"\\(Some P0, s)#xs \\ cptn_mod; zs=map (lift P1) xs \\\n \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n| CptnModSeq2: \n \"\\(Some P0, s)#xs \\ cptn_mod; fst(last ((Some P0, s)#xs)) = None; \n (Some P1, snd(last ((Some P0, s)#xs)))#ys \\ cptn_mod; \n zs=(map (lift P1) xs)@ys \\ \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n\n| CptnModWhile1: \n \"\\ (Some P, s)#xs \\ cptn_mod; s \\ b; zs=map (lift (While b P)) xs \\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n| CptnModWhile2: \n \"\\ (Some P, s)#xs \\ cptn_mod; fst(last ((Some P, s)#xs))=None; s \\ b; \n zs=(map (lift (While b P)) xs)@ys; \n (Some(While b P), snd(last ((Some P, s)#xs)))#ys \\ cptn_mod\\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n\nsubsection \\Equivalence of Both Definitions.\\\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n by (induct xs) auto\n\nlemma div_seq [rule_format]: \"list \\ cptn_mod \\\n (\\s P Q zs. list=(Some (Seq P Q), s)#zs \\\n (\\xs. (Some P, s)#xs \\ cptn_mod \\ (zs=(map (lift Q) xs) \\\n ( fst(((Some P, s)#xs)!length xs)=None \\ \n (\\ys. (Some Q, snd(((Some P, s)#xs)!length xs))#ys \\ cptn_mod \n \\ zs=(map (lift (Q)) xs)@ys)))))\"\napply(erule cptn_mod.induct)\napply simp_all\n apply clarify\n apply(force intro:CptnModOne)\n apply clarify\n apply(erule_tac x=Pa in allE)\n apply(erule_tac x=Q in allE)\n apply simp\n apply clarify\n apply(erule disjE)\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply clarify\n apply(erule CptnModEnv)\n apply(rule disjI1)\n apply(simp add:lift_def)\n apply clarify\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply(erule CptnModEnv)\n apply(rule disjI2)\n apply(rule conjI)\n apply(case_tac xsa,simp,simp)\n apply(rule_tac x=\"ys\" in exI)\n apply(rule conjI)\n apply simp\n apply(simp add:lift_def)\n apply clarify\n apply(erule ctran.cases,simp_all)\n apply clarify\n apply(rule_tac x=\"xs\" in exI)\n apply simp\n apply clarify\napply(rule_tac x=\"xs\" in exI)\napply(simp add: last_length)\ndone\n\nlemma cptn_onlyif_cptn_mod_aux [rule_format]:\n \"\\s Q t xs.((Some a, s), Q, t) \\ ctran \\ (Q, t) # xs \\ cptn_mod \n \\ (Some a, s) # (Q, t) # xs \\ cptn_mod\"\napply(induct a)\napply simp_all\n\\\\basic\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,rule Basic,simp)\napply clarify\napply(erule ctran.cases,simp_all)\n\\\\Seq1\\\napply(rule_tac xs=\"[(None,ta)]\" in CptnModSeq2)\n apply(erule CptnModNone)\n apply(rule CptnModOne)\n apply simp\napply simp\napply(simp add:lift_def)\n\\\\Seq2\\\napply(erule_tac x=sa in allE)\napply(erule_tac x=\"Some P2\" in allE)\napply(erule allE,erule impE, assumption)\napply(drule div_seq,simp)\napply clarify\napply(erule disjE)\n apply clarify\n apply(erule allE,erule impE, assumption)\n apply(erule_tac CptnModSeq1)\n apply(simp add:lift_def)\napply clarify \napply(erule allE,erule impE, assumption)\napply(erule_tac CptnModSeq2)\n apply (simp add:last_length)\n apply (simp add:last_length)\napply(simp add:lift_def)\n\\\\Cond\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(force elim: CptnModCondT)\napply(force elim: CptnModCondF)\n\\\\While\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule WhileF,simp)\napply(drule div_seq,force)\napply clarify\napply (erule disjE)\n apply(force elim:CptnModWhile1)\napply clarify\napply(force simp add:last_length elim:CptnModWhile2)\n\\\\await\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule Await,simp+)\ndone\n\nlemma cptn_onlyif_cptn_mod [rule_format]: \"c \\ cptn \\ c \\ cptn_mod\"\napply(erule cptn.induct)\n apply(rule CptnModOne)\n apply(erule CptnModEnv)\napply(case_tac P)\n apply simp\n apply(erule ctran.cases,simp_all)\napply(force elim:cptn_onlyif_cptn_mod_aux)\ndone\n\nlemma lift_is_cptn: \"c\\cptn \\ map (lift P) c \\ cptn\"\napply(erule cptn.induct)\n apply(force simp add:lift_def CptnOne)\n apply(force intro:CptnEnv simp add:lift_def)\napply(force simp add:lift_def intro:CptnComp Seq2 Seq1 elim:ctran.cases)\ndone\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\b a. b#c1\\cptn \\ a#c2\\cptn \\ (b#c1)!length c1=a \\ b#c1@c2\\cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\n apply(force intro:CptnEnv)\napply(force elim:CptnComp)\ndone\n\nlemma last_lift: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=None\\ \n \\ fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=(Some P)\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\ \\P a \\ P (x!(length x - (Suc 0)))\" \n by (induct x) simp_all\n\nlemma last_fst_esp: \n \"fst(((Some a,s)#xs)!(length xs))=None \\ fst(xs!(length xs - (Suc 0)))=None\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\[] \\ \n snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma Cons_lift: \"(Some (Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((Some P, s) # xs)\"\n by (simp add:lift_def)\n\nlemma Cons_lift_append: \n \"(Some (Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((Some P, s) # xs)@ ys \"\n by (simp add:lift_def)\n\nlemma lift_nth: \"i map (lift Q) xs ! i = lift Q (xs! i)\"\n by (simp add:lift_def)\n\nlemma snd_lift: \"i< length xs \\ snd(lift Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_def)\n\nlemma cptn_if_cptn_mod: \"c \\ cptn_mod \\ c \\ cptn\"\napply(erule cptn_mod.induct)\n apply(rule CptnOne)\n apply(erule CptnEnv)\n apply(erule CptnComp,simp)\n apply(rule CptnComp)\n apply(erule CondT,simp)\n apply(rule CptnComp)\n apply(erule CondF,simp)\n\\\\Seq1\\\napply(erule cptn.cases,simp_all)\n apply(rule CptnOne)\n apply clarify\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply(rule CptnEnv,simp)\napply clarify\napply(simp add:lift_def)\napply(rule conjI)\n apply clarify\n apply(rule CptnComp)\n apply(rule Seq1,simp)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\napply clarify\napply(rule CptnComp)\n apply(rule Seq2,simp)\napply(drule_tac P=P1 in lift_is_cptn)\napply(simp add:lift_def)\n\\\\Seq2\\\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=P1 in last_lift)\n apply(rule last_fst_esp)\n apply (simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\n\\\\While1\\\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(drule_tac P=\"While b P\" in lift_is_cptn)\napply(simp add:lift_def)\n\\\\While2\\\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=\"While b P\" in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=\"While b P\" in last_lift)\n apply(rule last_fst_esp,simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\ndone\n\ntheorem cptn_iff_cptn_mod: \"(c \\ cptn) = (c \\ cptn_mod)\"\napply(rule iffI)\n apply(erule cptn_onlyif_cptn_mod)\napply(erule cptn_if_cptn_mod)\ndone\n\nsection \\Validity of Correctness Formulas\\\n\nsubsection \\Validity for Component Programs.\\\n\ntype_synonym 'a rgformula =\n \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set\"\n\ndefinition assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a confs) set\" where\n \"assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -e\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a confs) set\" where\n \"comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -c\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (fst (last c) = None \\ snd (last c) \\ post)}\"\n\ndefinition com_validity :: \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set \\ bool\" \n (\"\\ _ sat [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ P sat [pre, rely, guar, post] \\ \n \\s. cp (Some P) s \\ assum(pre, rely) \\ comm(guar, post)\"\n\nsubsection \\Validity for Parallel Programs.\\\n\ndefinition All_None :: \"(('a com) option) list \\ bool\" where\n \"All_None xs \\ \\c\\set xs. c=None\"\n\ndefinition par_assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a par_confs) set\" where\n \"par_assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -pe\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition par_comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a par_confs) set\" where\n \"par_comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -pc\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (All_None (fst (last c)) \\ snd( last c) \\ post)}\"\n\ndefinition par_com_validity :: \"'a par_com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \n\\ 'a set \\ bool\" (\"\\ _ SAT [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ Ps SAT [pre, rely, guar, post] \\ \n \\s. par_cp Ps s \\ par_assum(pre, rely) \\ par_comm(guar, post)\"\n\nsubsection \\Compositionality of the Semantics\\\n\nsubsubsection \\Definition of the conjoin operator\\\n\ndefinition same_length :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"same_length c clist \\ (\\i ('a confs) list \\ bool\" where\n \"same_state c clist \\ (\\i j ('a confs) list \\ bool\" where\n \"same_program c clist \\ (\\jx. fst(nth x j)) clist)\"\n\ndefinition compat_label :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"compat_label c clist \\ (\\j. Suc j \n (c!j -pc\\ c!Suc j \\ (\\i (clist!i)! Suc j \\ \n (\\li \\ (clist!l)!j -e\\ (clist!l)! Suc j))) \\ \n (c!j -pe\\ c!Suc j \\ (\\i (clist!i)! Suc j)))\"\n\ndefinition conjoin :: \"'a par_confs \\ ('a confs) list \\ bool\" (\"_ \\ _\" [65,65] 64) where\n \"c \\ clist \\ (same_length c clist) \\ (same_state c clist) \\ (same_program c clist) \\ (compat_label c clist)\"\n\nsubsubsection \\Some previous lemmas\\\n\nlemma list_eq_if [rule_format]: \n \"\\ys. xs=ys \\ (length xs = length ys) \\ (\\i (\\i ys!0=a; ys\\[] \\ \\ ys=(a#(tl ys))\"\n by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\[] \\ ys!0=a \\ P ys \\ P (a#(tl ys))\"\n by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) \\ P ys\"\n by (induct ys) simp_all\n\nlemma seq_not_eq1: \"Seq c1 c2\\c1\"\n by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\c2\"\n by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\c1\"\n by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\c2\"\n by (induct c2) auto\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\n\nlemma prog_not_eq_in_ctran_aux:\n assumes c: \"(P,s) -c\\ (Q,t)\"\n shows \"P\\Q\" using c\n by (induct x1 \\ \"(P,s)\" x2 \\ \"(Q,t)\" arbitrary: P s Q t) auto\n\nlemma prog_not_eq_in_ctran [simp]: \"\\ (P,s) -c\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_ctran_aux)\napply simp\ndone\n\nlemma prog_not_eq_in_par_ctran_aux [rule_format]: \"(P,s) -pc\\ (Q,t) \\ (P\\Q)\"\napply(erule par_ctran.induct)\napply(drule prog_not_eq_in_ctran_aux)\napply clarify\napply(drule list_eq_if)\n apply simp_all\napply force\ndone\n\nlemma prog_not_eq_in_par_ctran [simp]: \"\\ (P,s) -pc\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_par_ctran_aux)\napply simp\ndone\n\nlemma tl_in_cptn: \"\\ a#xs \\cptn; xs\\[] \\ \\ xs\\cptn\"\n by (force elim: cptn.cases)\n\nlemma tl_zero[rule_format]: \n \"P (ys!Suc j) \\ Suc j ys\\[] \\ P (tl(ys)!j)\"\n by (induct ys) simp_all\n\nsubsection \\The Semantics is Compositional\\\n\nlemma aux_if [rule_format]: \n \"\\xs s clist. (length clist = length xs \\ (\\i cptn) \n \\ ((xs, s)#ys \\ map (\\i. (fst i,s)#snd i) (zip xs clist)) \n \\ (xs, s)#ys \\ par_cptn)\"\napply(induct ys)\n apply(clarify)\n apply(rule ParCptnOne)\napply(clarify)\napply(simp add:conjoin_def compat_label_def)\napply clarify\napply(erule_tac x=\"0\" and P=\"\\j. H j \\ (P j \\ Q j)\" for H P Q in all_dupE, simp)\napply(erule disjE)\n\\\\first step is a Component step\\\n apply clarify \n apply simp\n apply(subgoal_tac \"a=(xs[i:=(fst(clist!i!0))])\")\n apply(subgoal_tac \"b=snd(clist!i!0)\",simp)\n prefer 2\n apply(simp add: same_state_def)\n apply(erule_tac x=i in allE,erule impE,assumption, \n erule_tac x=1 and P=\"\\j. (H j) \\ (snd (d j))=(snd (e j))\" for H d e in allE, simp)\n prefer 2\n apply(simp add:same_program_def)\n apply(erule_tac x=1 and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(rule ParCptnComp)\n apply(erule ParComp,simp)\n\\\\applying the induction hypothesis\\\n apply(erule_tac x=\"xs[i := fst (clist ! i ! 0)]\" in allE)\n apply(erule_tac x=\"snd (clist ! i ! 0)\" in allE)\n apply(erule mp)\n apply(rule_tac x=\"map tl clist\" in exI,simp)\n apply(rule conjI,clarify)\n apply(case_tac \"i=ia\",simp)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply simp\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_state_def)\n apply(erule_tac x=ia in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_length_def same_state_def)\n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\n apply(rule allI,rule impI)\n apply(erule_tac x=\"Suc j\" and P=\"\\j. H j \\ (I j \\ J j)\" for H I J in allE,simp)\n apply(erule disjE) \n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(case_tac \"i=ia\",simp)\n apply(rule conjI)\n apply(force simp add: length_Suc_conv)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption)\n apply simp\n apply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=l in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. (H j) \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply force\n apply simp\n apply(rule tl_zero)\n apply(erule tl_zero)\n apply force\n apply force\n apply force\n apply force\n apply(rule conjI,simp)\n apply(rule nth_tl_if)\n apply force\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule tl_zero)\n apply force\n apply force\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(erule_tac P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption,erule impE,assumption)\n apply(erule tl_zero,force)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE, assumption,simp)\n apply(erule etranE,simp)\n apply(rule tl_zero)\n apply force\n apply force\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(rule disjI2)\n apply(case_tac j,simp)\n apply clarify\n apply(rule tl_zero)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j\\etran\" for H I in allE,erule impE, assumption)\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE, assumption,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply clarify\n apply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n\\\\first step is an environmental step\\\napply clarify\napply(erule par_etran.cases)\napply simp\napply(rule ParCptnEnv)\napply(erule_tac x=\"Ps\" in allE)\napply(erule_tac x=\"t\" in allE)\napply(erule mp)\napply(rule_tac x=\"map tl clist\" in exI,simp)\napply(rule conjI)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ I j \\ cptn\" for H I in allE,simp)\n apply(erule cptn.cases)\n apply(simp add:same_length_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(simp add:same_state_def)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ J j \\etran\" for H J in allE,simp)\n apply(erule etranE,simp)\napply(simp add:same_state_def same_length_def)\napply(rule conjI,clarify)\n apply(case_tac j,simp,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule tl_zero)\n apply(simp)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply simp\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\napply(rule allI,rule impI)\napply(erule_tac x=\"Suc j\" and P=\"\\j. H j \\ (I j \\ J j)\" for H I J in allE,simp)\napply(erule disjE) \n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(erule tl_zero,force) \n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply clarify\n apply(erule_tac x=l and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply(rule disjI2)\napply simp\napply clarify\napply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply simp\napply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\napply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\ndone\n\nlemma aux_onlyif [rule_format]: \"\\xs s. (xs, s)#ys \\ par_cptn \\ \n (\\clist. (length clist = length xs) \\ \n (xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist) \\ \n (\\i cptn))\"\napply(induct ys)\n apply(clarify)\n apply(rule_tac x=\"map (\\i. []) [0..j. (P!j, t)#(clist!j)) [0..j. (Ps!j, ta)#(clist!j)) [0..j. H j \\ (I j \\ cptn)\" for H I in allE,simp)\n apply simp\n apply(erule_tac x=ia in allE)\n apply(rule CptnEnv,simp)\napply(simp add:conjoin_def)\napply (rule conjI)\n apply(simp add:same_length_def)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(case_tac j, simp, simp (no_asm_simp))\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp,simp)\n apply simp\n apply(rule nth_equalityI,simp,simp)\n apply(erule_tac x=nat and P=\"\\j. H j \\ (fst (a j))=((b j))\" for H a b in allE)\n apply(case_tac nat)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(simp add:compat_label_def)\napply clarify\napply(case_tac j)\n apply(rule conjI,simp)\n apply(erule ParComp,assumption)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply clarify\n apply(rule Env)\napply simp\napply(erule_tac x=nat and P=\"\\j. H j \\ (P j \\ Q j)\" for H P Q in allE,simp)\napply(erule disjE)\n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(rule conjI)\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(case_tac \"l=ia\",simp,simp)\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply simp\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\napply clarify\napply(erule_tac x=ia and P=\"\\j. H j \\ (P j)\\etran\" for H P in allE, erule impE, assumption)\napply(case_tac \"i=ia\",simp,simp)\ndone\n\nlemma one_iff_aux: \"xs\\[] \\ (\\ys. ((xs, s)#ys \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist)) \\ \n (\\i cptn))) = \n (par_cp (xs) s = {c. \\clist. (length clist)=(length xs) \\\n (\\i cp(xs!i) s) \\ c \\ clist})\" \napply (rule iffI)\n apply(rule subset_antisym)\n apply(rule subsetI) \n apply(clarify)\n apply(simp add:par_cp_def cp_def)\n apply(case_tac x)\n apply(force elim:par_cptn.cases)\n apply simp\n apply(rename_tac a list)\n apply(erule_tac x=\"list\" in allE)\n apply clarify\n apply simp\n apply(rule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in exI,simp)\n apply(rule subsetI) \n apply(clarify)\n apply(case_tac x)\n apply(erule_tac x=0 in allE)\n apply(simp add:cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule cptn.cases,force,force,force)\n apply(simp add:par_cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule_tac x=0 and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in all_dupE)\n apply(subgoal_tac \"a = xs\")\n apply(subgoal_tac \"b = s\",simp)\n prefer 3\n apply(erule_tac x=0 and P=\"\\j. H j \\ (fst (s j))=((t j))\" for H s t in allE)\n apply (simp add:cp_def)\n apply(rule nth_equalityI,simp,simp)\n prefer 2\n apply(erule_tac x=0 in allE)\n apply (simp add:cp_def)\n apply(erule_tac x=0 and P=\"\\j. H j \\ (\\i. T i \\ (snd (d j i))=(snd (e j i)))\" for H T d e in allE,simp)\n apply(erule_tac x=0 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=list in allE)\n apply(rule_tac x=\"map tl clist\" in exI,simp) \n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"0\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc nat\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply clarify\n apply simp\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(thin_tac \"H = (\\i. J i)\" for H J)\n apply(rule conjI)\n apply clarify\n apply(erule_tac x=j in allE,erule impE, assumption,erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(case_tac j,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply clarify\n apply(simp add:cp_def)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply simp\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp)\n apply(rule nth_tl_if,simp,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (P j)\\etran\" for H P in allE, erule impE, assumption,simp)\n apply(simp add:cp_def)\n apply clarify\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply force\n apply force\napply clarify\napply(rule iffI)\n apply(simp add:par_cp_def)\n apply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply simp\n apply clarify\n apply(rule_tac x=\"map tl clist\" in exI)\n apply simp\n apply (rule conjI)\n apply(simp add:conjoin_def cp_def)\n apply(rule conjI)\n apply clarify\n apply(unfold same_length_def)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,simp)\n apply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=j and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j,simp)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(simp add:compat_label_def)\n apply(rule allI,rule impI)\n apply(erule_tac x=j in allE,erule impE, assumption)\n apply(erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply(erule_tac x=l in allE,simp)\n apply(rule disjI2)\n apply clarify\n apply(rule tl_zero)\n apply(case_tac j,simp,simp)\n apply(rule tl_zero,force) \n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(rule nth_tl_if)\n apply(simp add:conjoin_def)\n apply clarify\n apply(simp add:same_length_def)\n apply(erule_tac x=i in allE,simp)\n apply simp\n apply simp\n apply simp\napply clarify\napply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply(simp add:par_cp_def)\napply simp\napply(erule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in allE)\napply simp\napply clarify\napply(simp add:cp_def)\ndone\n\ntheorem one: \"xs\\[] \\ \n par_cp xs s = {c. \\clist. (length clist)=(length xs) \\ \n (\\i cp(xs!i) s) \\ c \\ clist}\"\napply(frule one_iff_aux)\napply(drule sym)\napply(erule iffD2)\napply clarify\napply(rule iffI)\n apply(erule aux_onlyif)\napply clarify\napply(force intro:aux_if)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Hoare_Parallel/RG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2902650793947616}} {"text": "theory Mapping_Code\n imports \"Containers.Mapping_Impl\"\nbegin\n\nlift_definition set_of_idx :: \"('a, 'b set) mapping \\ 'b set\" is\n \"\\m. \\(ran m)\" .\n\nlemma set_of_idx_code[code]:\n fixes t :: \"('a :: ccompare, 'b set) mapping_rbt\"\n shows \"set_of_idx (RBT_Mapping t) =\n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''set_of_idx RBT_Mapping: ccompare = None'') (\\_. set_of_idx (RBT_Mapping t))\n | Some _ \\ \\(snd ` set (RBT_Mapping2.entries t)))\"\n unfolding RBT_Mapping_def\n by transfer (auto simp: ran_def rbt_comp_lookup[OF ID_ccompare'] ord.is_rbt_def linorder.rbt_lookup_in_tree[OF comparator.linorder[OF ID_ccompare']] split: option.splits)+\n\nlemma mapping_combine[code]:\n fixes t :: \"('a :: ccompare, 'b) mapping_rbt\"\n shows \"Mapping.combine f (RBT_Mapping t) (RBT_Mapping u) =\n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''combine RBT_Mapping: ccompare = None'') (\\_. Mapping.combine f (RBT_Mapping t) (RBT_Mapping u))\n | Some _ \\ RBT_Mapping (RBT_Mapping2.join (\\_. f) t u))\"\n by (auto simp add: Mapping.combine.abs_eq Mapping_inject lookup_join split: option.split)\n\nlift_definition mapping_join :: \"('b \\ 'b \\ 'b) \\ ('a, 'b) mapping \\ ('a, 'b) mapping \\ ('a, 'b) mapping\" is\n \"\\f m m' x. case m x of None \\ None | Some y \\ (case m' x of None \\ None | Some y' \\ Some (f y y'))\" .\n\nlemma mapping_join_code[code]:\n fixes t :: \"('a :: ccompare, 'b) mapping_rbt\"\n shows \"mapping_join f (RBT_Mapping t) (RBT_Mapping u) =\n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''mapping_join RBT_Mapping: ccompare = None'') (\\_. mapping_join f (RBT_Mapping t) (RBT_Mapping u))\n | Some _ \\ RBT_Mapping (RBT_Mapping2.meet (\\_. f) t u))\"\n by (auto simp add: mapping_join.abs_eq Mapping_inject lookup_meet split: option.split)\n\ncontext fixes dummy :: \"'a :: ccompare\" begin\n\nlift_definition diff ::\n \"('a, 'b) mapping_rbt \\ ('a, 'b) mapping_rbt \\ ('a, 'b) mapping_rbt\" is \"rbt_comp_minus ccomp\"\n by (auto 4 3 intro: linorder.rbt_minus_is_rbt ID_ccompare ord.is_rbt_rbt_sorted simp: rbt_comp_minus[OF ID_ccompare'])\n\nend\n\ncontext assumes ID_ccompare_neq_None: \"ID CCOMPARE('a :: ccompare) \\ None\"\nbegin\n\nlemma lookup_diff:\n \"RBT_Mapping2.lookup (diff (t1 :: ('a, 'b) mapping_rbt) t2) =\n (\\k. case RBT_Mapping2.lookup t1 k of None \\ None | Some v1 \\ (case RBT_Mapping2.lookup t2 k of None \\ Some v1 | Some v2 \\ None))\"\n by transfer (auto simp add: fun_eq_iff linorder.rbt_lookup_rbt_minus[OF mapping_linorder] ID_ccompare_neq_None restrict_map_def split: option.splits)\n\nend\n\nlift_definition mapping_antijoin :: \"('a, 'b) mapping \\ ('a, 'b) mapping \\ ('a, 'b) mapping\" is\n \"\\m m' x. case m x of None \\ None | Some y \\ (case m' x of None \\ Some y | Some y' \\ None)\" .\n\nlemma mapping_antijoin_code[code]:\n fixes t :: \"('a :: ccompare, 'b) mapping_rbt\"\n shows \"mapping_antijoin (RBT_Mapping t) (RBT_Mapping u) =\n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''mapping_antijoin RBT_Mapping: ccompare = None'') (\\_. mapping_antijoin (RBT_Mapping t) (RBT_Mapping u))\n | Some _ \\ RBT_Mapping (diff t u))\"\n by (auto simp add: mapping_antijoin.abs_eq Mapping_inject lookup_diff split: option.split)\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Eval_FO/Mapping_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.29026507221653597}} {"text": "theory LaunchburyMoreFree\nimports Terms Heap Launchbury\nbegin\n\ntext {*\nThis variant of the original semantics allocates an additional free variable in the application case.\nThis is a prelimary step towards the equivalence of the original and the stacked semantics.\n*}\n\ninductive\n reds :: \"heap \\ exp \\ var list \\ heap \\ exp \\ bool\"\n (\"_ : _ \\*\\<^bsub>_\\<^esub> _ : _\" [50,50,50,50] 50)\nwhere\n Lambda:\n \"\\ : (Lam [x]. e) \\*\\<^bsub>L\\<^esub> \\ : (Lam [x]. e)\" \n | Application: \"\\\n atom y \\ (\\,e,x,L,\\,\\,z) ;\n atom (n::var) \\ (\\,e,x,L,\\,\\,z) ;\n n \\ y;\n \\ : e \\*\\<^bsub>n#x#L\\<^esub> \\ : (Lam [y]. e');\n \\ : e'[y ::= x] \\*\\<^bsub>L\\<^esub> \\ : z\n \\ \\\n \\ : App e x \\*\\<^bsub>L\\<^esub> \\ : z\" \n | Variable: \"\\\n (x,e) \\ set \\; delete x \\ : e \\*\\<^bsub>x#L\\<^esub> \\ : z \\ \\ \\ : Var x \\*\\<^bsub>L\\<^esub> (x, z) # \\ : z\"\n | Let: \"\\\n set (bn as) \\* (\\, L);\n distinctVars (asToHeap as);\n asToHeap as @ \\ : body \\*\\<^bsub>L\\<^esub> \\ : z\n \\ \\\n \\ : Let as body \\*\\<^bsub>L\\<^esub> \\ : z\"\n\nequivariance reds\n\nnominal_inductive reds\n avoids Application: \"y\" and \"n\"\n by(auto simp add: fresh_star_def fresh_Pair)\n\nlemma reds_less_free:\n \"\\ : e \\*\\<^bsub>L\\<^esub> \\ : z \\ \\ : e \\\\<^bsub>L\\<^esub> \\ : z\"\nproof(induct rule: LaunchburyMoreFree.reds.induct)\ncase (Application y \\ e x L \\ \\ z n e')\n show ?case\n proof(rule Launchbury.reds.Application)\n show \"atom y \\ (\\, e, x, L, \\, \\, z)\"\n by fact\n show \"\\ : e \\\\<^bsub>x # L\\<^esub> \\ : Lam [y]. e'\"\n apply (rule reds_smaller_L[OF Application.hyps(5)])\n by auto\n show \"\\ : e'[y::=x] \\\\<^bsub>L\\<^esub> \\ : z\"\n by fact\n qed\nqed (auto intro: reds_smaller_L Launchbury.reds.intros simp add: fresh_star_Pair)\n\n\nlemma reds_with_n_doesnt_forget:\n \"\\ : e \\*\\<^bsub>L\\<^esub> \\ : z \\ heapVars \\ \\ heapVars \\\"\nby (metis reds_less_free reds_doesnt_forget)\n\nlemma reds_with_n_fresh:\" \\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z;\n atom (x::var) \\ (\\, e)\n \\ \\ atom x \\ (\\, z) \\ x \\ (heapVars \\ - set L)\"\n by (metis reds_less_free reds_fresh)\n\nlemma reds_with_n_add_var_L: \"\\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z;\n atom (x::var) \\ (\\, e, \\, z);\n set L' = insert x (set L)\n \\ \\ \\ : e \\*\\<^bsub>L'\\<^esub> \\ : z\"\nproof(nominal_induct avoiding : L' rule: reds.strong_induct)\ncase (Lambda \\ x e L L')\n show ?case\n by (rule reds.Lambda)\nnext\ncase (Application y \\ e xa L \\ \\ z n e' L')\n show ?case\n proof(rule reds.Application)\n show \"atom y \\ (\\, e, xa, L', \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n \n show \"atom n \\ (\\, e, xa, L', \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n\n show \"n \\ y\" by fact\n\n have \"x \\ heapVars \\\"\n using `atom x \\ (\\, App e xa, \\, z)`\n apply (simp add: fresh_Pair)\n by (metis heapVars_not_fresh)\n hence \"x \\ heapVars \\\"\n by (metis set_mp reds_with_n_doesnt_forget[OF Application.hyps(20)])\n\n have \"atom x \\ (\\, e)\"\n using `atom x \\ (\\, App e xa, \\, z)`\n by (simp add: fresh_Pair)\n from reds_with_n_fresh[OF Application.hyps(18) this] `x \\ heapVars \\`\n have \"atom x \\ (\\, Lam [y]. e')\"\n by auto\n hence \"atom x \\ (\\, e, \\, Lam [y]. e')\"\n using `atom x \\ (\\, App e xa, \\, z)`\n by (simp add: fresh_Pair)\n moreover\n have \"set (n # xa # L') = insert x (set (n # xa # L))\"\n using `set L' = _` by auto\n ultimately\n show \"\\ : e \\*\\<^bsub>n # xa # L'\\<^esub> \\ : Lam [y]. e'\"\n by (rule Application.hyps(19))\n\n have \"atom x \\ (\\, e'[y::=xa])\"\n using `atom x \\ (\\, Lam [y]. e')` `atom x \\ (\\, App e xa, \\, z)` `atom y \\ xa`\n apply (auto simp add: fresh_Pair)\n apply (rule subst_pres_fresh[rule_format])\n apply simp\n done\n from reds_with_n_fresh[OF Application.hyps(20) this] `x \\ heapVars \\`\n have \"atom x \\ (\\, z)\" by auto\n hence \"atom x \\ (\\, e'[y::=xa], \\, z)\"\n using `atom x \\ (\\, e'[y::=xa])`\n by (simp add: fresh_Pair)\n then\n show \"\\ : e'[y::=xa] \\*\\<^bsub>L'\\<^esub> \\ : z \"\n by (rule Application.hyps(21)[OF _ `set L' = _`])\n qed\nnext \ncase (Variable xa e \\ L \\ z L')\n have \"atom x \\ (delete xa \\, e, \\, z)\"\n using Variable.prems(1)\n by (auto simp add: fresh_Pair fresh_Cons intro: fresh_delete fresh_heap_expr[OF _ Variable(1)])\n moreover\n have \"set (xa # L') = insert x (set (xa # L))\"\n using Variable.prems(2) by auto\n ultimately\n show ?case\n by (rule reds.Variable[OF Variable(1) Variable.hyps(3)])\nnext\ncase (Let as \\ L body \\ z L')\n have \"x \\ heapVars \\\"\n using Let.prems(1)\n apply (auto simp add: fresh_Pair)\n by (metis heapVars_not_fresh)+\n hence \"x \\ heapVars (asToHeap as @ \\)\"\n by (metis set_mp reds_with_n_doesnt_forget[OF Let.hyps(4)])\n hence \"atom x \\ set (bn as)\"\n by (auto simp add: set_bn_to_atom_heapVars)\n hence \"set (bn as) \\* x\"\n by (auto simp add: fresh_star_def fresh_at_base)\n \n hence \"set (bn as) \\* set L'\"\n using Let(2) Let.prems(2)\n by (auto simp add: fresh_star_def fresh_finite_insert fresh_set)\n hence \"set (bn as) \\* (\\, L')\" \n using Let(1-4)\n by (simp add: fresh_star_Pair fresh_star_set )\n moreover\n have \"atom x \\ (asToHeap as @ \\, body, \\, z)\"\n using Let.prems(1) `atom x \\ set (bn as)`\n by (auto simp add: fresh_Pair fresh_append fresh_fun_eqvt_app[OF asToHeap_eqvt])\n ultimately\n show ?case\n by (rule reds.Let[OF _ Let.hyps(3) Let.hyps(5)[OF _ Let.prems(2)]])\nqed\n\nlemma reds_more_free:\n \"\\ : e \\\\<^bsub>L\\<^esub> \\ : z \\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z\"\nproof(nominal_induct rule: Launchbury.reds.strong_induct)\ncase (Application y \\ e x L \\ \\ z e')\n obtain n :: var where\n fresh: \"atom n \\ (\\, e, x, L, \\, \\, z, y, Lam [y]. e')\" \n by (rule obtain_fresh)\n\n show ?case\n proof (rule reds.Application)\n show \"atom y \\ (\\, e, x, L, \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n show \"atom n \\ (\\, e, x, L, \\, \\, z)\"\n using fresh\n by (auto simp add: fresh_Pair)\n show \"n \\ y\"\n using fresh\n by (auto simp add: fresh_Pair fresh_at_base)\n\n note `\\ : e \\*\\<^bsub>x # L\\<^esub> \\ : Lam [y]. e'`\n moreover\n have \"atom n \\ (\\, e, \\, Lam [y]. e')\"\n using fresh by (auto simp add: fresh_Pair)\n ultimately\n show \"\\ : e \\*\\<^bsub>n # x # L\\<^esub> \\ : Lam [y]. e'\"\n by (rule reds_with_n_add_var_L, simp)\n\n show \"\\ : e'[y::=x] \\*\\<^bsub>L\\<^esub> \\ : z\"\n by fact\n qed\nqed (auto intro: reds.intros simp add: fresh_star_Pair)\n\nlemma reds_more_free_eq:\n \"(\\ : e \\*\\<^bsub>L\\<^esub> \\ : z) \\ (\\ : e \\\\<^bsub>L\\<^esub> \\ : z)\"\n by (metis reds_less_free reds_more_free)\n\nlemmas reds_with_n_strong_induct = LaunchburyMoreFree.reds.strong_induct[unfolded reds_more_free_eq, consumes 1, case_names Lambda Application Variable Let]\nlemmas reds_with_n_induct = LaunchburyMoreFree.reds.induct[unfolded reds_more_free_eq, consumes 1, case_names Lambda Application Variable Let]\n\n(* This can be shown for reds directly, but we needed it here, and after we got the equality we can transfer it easily. *)\nlemmas reds_add_var_L = reds_with_n_add_var_L[unfolded reds_more_free_eq]\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/LaunchburyMoreFree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604274, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2902211242444728}} {"text": "(* Title: BDD\n\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* \nShareReduceRepListProof.thy\n\nCopyright (C) 2004 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Proof of Procedure ShareReduceRepList\\\ntheory ShareReduceRepListProof imports ShareRepProof begin\n\nlemma (in ShareReduceRepList_impl) ShareReduceRepList_modifies:\n shows \"\\\\. \\\\{\\} PROC ShareReduceRepList (\\nodeslist)\n {t. t may_only_modify_globals \\ in [rep]}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\nlemma hd_filter_app: \"\\filter P xs \\ []; zs=xs@ys\\ \\ \n hd (filter P zs) = hd (filter P xs)\"\n by (induct xs arbitrary: n m) auto\n\n\nlemma (in ShareReduceRepList_impl) ShareReduceRepList_spec_total: \ndefines \"var_eq \\ (\\ns var. (\\no1 \\ set ns. \\no2 \\ set ns. no1\\var = no2\\var))\"\nshows\n \"\\\\ ns. \\\\\\<^sub>t\n \\\\. List \\nodeslist \\next ns \\\n (\\no \\ set ns.\n no \\ Null \\ ((no\\\\low = Null) = (no\\\\high = Null)) \\ \n no\\\\low \\ set ns \\ no\\\\high \\ set ns \\\n (isLeaf_pt no \\low \\high = (no\\\\var \\ 1)) \\\n (no\\\\low \\ Null \\ (no\\\\low)\\\\rep \\ Null) \\\n ((\\rep \\ \\low) no \\ set ns)) \\\n var_eq ns \\var\\ \n PROC ShareReduceRepList (\\nodeslist)\n \\(\\no. no \\ set ns \\ no\\\\<^bsup>\\\\<^esup>rep = no\\\\rep) \\\n (\\no \\ set ns. no\\\\rep \\ Null \\ \n (if ((\\rep \\ \\<^bsup>\\\\<^esup>low) no = (\\rep \\ \\<^bsup>\\\\<^esup>high) no \\ no\\ \\<^bsup>\\\\<^esup>low \\ Null) \n then (no\\\\rep = (\\rep \\ \\<^bsup>\\\\<^esup>low) no )\n else ((no\\\\rep) \\ set ns \\ no\\\\rep\\\\rep = no\\\\rep \\ \n (\\ no1 \\ set ns. \n ((\\rep \\ \\<^bsup>\\\\<^esup>high) no1 = (\\rep \\ \\<^bsup>\\\\<^esup>high) no \\ \n (\\rep \\ \\<^bsup>\\\\<^esup>low) no1 = (\\rep \\ \\<^bsup>\\\\<^esup>low) no) = (no\\\\rep = no1\\\\rep)))))\\\"\napply (hoare_rule HoareTotal.ProcNoRec1)\napply (hoare_rule anno=\n \" \\node :== \\nodeslist;;\n WHILE (\\node \\ Null ) \n INV \\\\prx sfx. List \\node \\next sfx \\ \n List \\nodeslist \\next ns \\ ns=prx@sfx \\ \n (\\no \\ set ns.\n no \\ Null \\ ((no\\\\<^bsup>\\\\<^esup>low = Null) = (no\\\\<^bsup>\\\\<^esup>high = Null)) \\ \n no\\\\<^bsup>\\\\<^esup>low \\ set ns \\ no\\\\<^bsup>\\\\<^esup>high \\ set ns \\\n (isLeaf_pt no \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high = (no\\\\<^bsup>\\\\<^esup>var \\ 1)) \\\n (no\\\\<^bsup>\\\\<^esup>low \\ Null \\ (no\\\\<^bsup>\\\\<^esup>low)\\\\<^bsup>\\\\<^esup>rep \\ Null) \\\n ((\\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>low) no \\ set ns)) \\\n var_eq ns \\var \\\n (\\no. no \\ set prx \\ no\\\\<^bsup>\\\\<^esup>rep = no \\\\rep) \\\n (\\ no \\ set prx. no\\\\rep \\ Null \\ \n (if ((\\rep \\ \\<^bsup>\\\\<^esup>low) no = (\\rep \\ \\<^bsup>\\\\<^esup>high) no \\ no\\\\<^bsup>\\\\<^esup>low \\ Null) \n then (no\\\\rep = (\\rep \\ \\<^bsup>\\\\<^esup>low) no )\n else ((no\\\\rep)=hd (filter (\\sn. repNodes_eq sn no \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\rep) \n prx) \\ \n ((no\\\\rep)\\\\rep) = no\\\\rep \\ \n (\\no1 \\ set prx. \n ((\\rep \\ \\<^bsup>\\\\<^esup>high) no1 = (\\rep \\ \\<^bsup>\\\\<^esup>high) no \\ \n (\\rep \\ \\<^bsup>\\\\<^esup>low) no1 = (\\rep \\ \\<^bsup>\\\\<^esup>low) no) = \n (no\\\\rep = no1\\\\rep))))) \\\n \\nodeslist= \\<^bsup>\\\\<^esup>nodeslist \\ \\high=\\<^bsup>\\\\<^esup>high \\ \\low=\\<^bsup>\\\\<^esup>low \\ \\var=\\<^bsup>\\\\<^esup>var\\\n VAR MEASURE (length (list \\node \\next))\n DO\n IF (\\ isLeaf_pt \\node \\low \\high \\ \n \\node \\ \\low \\ \\rep = \\node \\ \\high \\ \\rep )\n THEN \\node \\ \\rep :== \\node \\ \\low \\ \\rep\n ELSE CALL ShareRep (\\nodeslist , \\node) \n FI;;\n \\node :==\\node \\ \\next\n OD\" in HoareTotal.annotateI)\napply (vcg spec=spec_total)\napply (rule_tac x=\"[]\" in exI)\napply (rule_tac x=\"ns\" in exI)\nusing [[simp_depth_limit = 2]]\napply (simp (no_asm_use))\nprefer 2\nusing [[simp_depth_limit = 4]]\napply (clarsimp)\nprefer 2\napply (rule conjI)\napply clarify\napply (rule conjI)\napply (clarsimp simp add: List_list) (* termination *)\napply (simp only: List_not_Null simp_thms triv_forall_equality)\napply clarify\napply (simp only: triv_forall_equality)\napply (rename_tac sfx)\napply (rule_tac x=\"prx@[node]\" in exI)\napply (rule_tac x=\"sfx\" in exI)\napply (rule conjI)\napply assumption\napply (rule conjI)\napply (simp (no_asm))\napply (rule conjI)\napply (assumption)\nprefer 2\napply clarify\napply (simp only: List_not_Null simp_thms triv_forall_equality)\napply clarify\napply (simp only: triv_forall_equality)\napply (rename_tac sfx)\napply (rule_tac x=\"prx@node#sfx\" in exI) (* Precondition for ShareRep *)\napply (rule conjI)\napply assumption\napply (rule conjI)\napply (rule ballI)\napply (frule_tac x=no in bspec, assumption)\napply (drule_tac x=node in bspec)\napply (simp (no_asm_use))\napply (elim conjE)\napply (rule conjI)\napply assumption\napply (rule conjI)\napply assumption\napply (unfold var_eq_def)\napply (drule_tac x=node in bspec, simp)\napply (drule_tac x=no in bspec,assumption)\napply (simp add: isLeaf_pt_def )\napply (rule conjI)\napply (simp (no_asm))\napply (clarify)\napply (rule conjI)\napply (subgoal_tac \"List node next (node#sfx)\") (* termination *)\napply (simp only: List_list)\napply (simp (no_asm))\napply (simp (no_asm_simp))\napply (rule_tac x=\"prx@[node]\" in exI)\napply (rule_tac x=\"sfx\" in exI)\napply (rule conjI)\napply assumption\napply (rule conjI)\napply (simp (no_asm))\napply (rule conjI)\napply (assumption)\nusing [[simp_depth_limit = 100]]\nproof - (* From invariant to postcondition *)\n fix var low high rep nodeslist ns repa \"next\" no\n assume ns: \"List nodeslist next ns\"\n assume no_in_ns: \"no \\ set ns\"\n assume while_inv: \"\\no\\set ns.\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ high no \\ Null\n then repa no = (repa \\ low) no\n else repa no = hd [sn\\ns . repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\\n (\\no1\\set ns.\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))\"\n assume pre: \"\\no\\set ns.\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set ns \\\n high no \\ set ns \\\n isLeaf_pt no low high = (var no \\ Suc 0) \\\n (low no \\ Null \\ rep (low no) \\ Null) \\ (rep \\ low) no \\ set ns\"\n assume same_var: \"\\no1\\set ns. \\no2\\set ns. var no1 = var no2\"\n assume share_case: \"(repa \\ low) no = (repa \\ high) no \\ high no = Null\"\n assume unmodif: \"\\no. no \\ set ns \\ rep no = repa no\"\n show \"hd [sn\\ns . repNodes_eq sn no low high repa] \\ set ns \\\n repa (hd [sn\\ns . repNodes_eq sn no low high repa]) =\n hd [sn\\ns . repNodes_eq sn no low high repa]\"\n proof -\n from no_in_ns pre obtain\n no_nNull: \" no \\ Null\" and\n no_balanced: \"(low no = Null) = (high no = Null)\" and\n isLeaf_var: \"isLeaf_pt no low high = (var no \\ Suc 0)\"\n by blast\n have repNodes_eq_same_node: \"repNodes_eq no no low high repa\"\n by (simp add: repNodes_eq_def)\n from no_in_ns have ns_nempty: \"ns \\ []\"\n by auto\n from no_in_ns repNodes_eq_same_node \n have repNodes_not_empty: \"[sn\\ns . repNodes_eq sn no low high repa] \\ []\"\n by (rule filter_not_empty)\n then have hd_term_in_ns: \"hd [sn\\ns . repNodes_eq sn no low high repa] \\ set ns\"\n by (rule hd_filter_in_list)\n with while_inv obtain \n repa_hd_nNull: \"repa (hd [sn\\ns . repNodes_eq sn no low high repa]) \\ Null\"\n by auto\n let ?hd = \"hd [sn\\ns . repNodes_eq sn no low high repa]\"\n from hd_term_in_ns pre obtain\n hd_nNull: \" ?hd \\ Null\" and\n hd_balanced: \n \"(low (hd [sn\\ns . repNodes_eq sn no low high repa]) = Null) = \n (high (hd [sn\\ns . repNodes_eq sn no low high repa]) = Null)\" and\n hd_isLeaf_var: \n \"isLeaf_pt (hd [sn\\ns . repNodes_eq sn no low high repa]) low high = \n (var (hd [sn\\ns . repNodes_eq sn no low high repa]) \\ Suc 0)\"\n by blast\n have \"repa (hd [sn\\ns . repNodes_eq sn no low high repa]) = \n hd [sn\\ns . repNodes_eq sn no low high repa]\"\n proof (cases \"high no = Null\")\n case True\n with no_balanced have \"low no = Null\"\n by simp\n with True have no_Leaf: \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n with isLeaf_var have varno: \"var no <= 1\"\n by simp\n from same_var [rule_format, OF no_in_ns hd_term_in_ns] varno\n have \"var (hd [sn\\ns . repNodes_eq sn no low high repa]) \\ 1\"\n by simp\n with hd_isLeaf_var have \n \"isLeaf_pt (hd [sn\\ns . repNodes_eq sn no low high repa]) low high\"\n by simp\n with while_inv hd_term_in_ns repNodes_not_empty show ?thesis\n apply (simp add: isLeaf_pt_def)\n apply (erule_tac x=\n \"hd [sn\\ns . repNodes_eq sn no low high repa]\" in ballE)\n prefer 2\n apply simp\n apply (simp (no_asm_use) add: repNodes_eq_def)\n apply (rule filter_hd_P_rep_indep)\n apply (simp (no_asm_simp))\n apply (simp (no_asm_simp))\n apply assumption\n done\n next\n assume hno_nNull: \"high no \\ Null\"\n with share_case have repchildren_neq: \"(repa \\ low) no \\ (repa \\ high) no\"\n by simp\n from repNodes_not_empty have \n \"repNodes_eq (hd [sn\\ns . repNodes_eq sn no low high repa]) no low high repa\"\n by (rule hd_filter_prop)\n then \n have \"(repa \\ low) (hd [sn\\ns . repNodes_eq sn no low high repa]) = \n (repa \\ low) no \\ \n (repa \\ high) (hd [sn\\ns . repNodes_eq sn no low high repa]) = \n (repa \\ high) no\"\n by (simp add: repNodes_eq_def)\n with repchildren_neq have \n \"(repa \\ low) (hd [sn\\ns . repNodes_eq sn no low high repa])\n \\ (repa \\ high) (hd [sn\\ns . repNodes_eq sn no low high repa])\"\n by simp\n with while_inv hd_term_in_ns repNodes_not_empty show ?thesis\n apply (simp add: isLeaf_pt_def)\n apply (erule_tac x=\n \"hd [sn\\ns . repNodes_eq sn no low high repa]\" in ballE)\n prefer 2\n apply simp\n apply (simp (no_asm_use) add: repNodes_eq_def)\n apply (rule filter_hd_P_rep_indep)\n apply simp\n apply fastforce\n apply fastforce\n done\n qed\n with hd_term_in_ns\n show ?thesis\n by simp\n qed\nnext\n (* invariant to invariant, THEN part -- REDUCING*)\n fix var low high rep nodeslist repa \"next\" node prx sfx\n assume ns: \"List nodeslist next (prx @ node # sfx)\"\n assume sfx: \"List (next node) next sfx\"\n assume node_not_Null: \"node \\ Null\"\n assume nodes_balanced_ordered: \"\\no\\set (prx @ node # sfx).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (prx @ node # sfx) \\\n high no \\ set (prx @ node # sfx) \\\n isLeaf_pt no low high = (var no \\ (1::nat)) \\\n (low no \\ Null \\ rep (low no) \\ Null) \\\n (rep \\ low) no \\ set (prx @ node # sfx)\"\n assume all_nodes_same_var: \"\\no1\\set (prx @ node # sfx).\n \\no2\\set (prx @ node # sfx). var no1 = var no2\"\n assume rep_repa_nc: \"\\no. no \\ set prx \\ rep no = repa no\"\n assume while_inv: \"\\no\\set prx.\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\\n (\\no1\\set prx.\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))\"\n assume not_Leaf: \"\\ isLeaf_pt node low high\" \n assume repchildren_eq_nln: \"repa (low node) = repa (high node)\"\n show \"(\\no. no \\ set (prx @ [node]) \\\n rep no = (repa(node := repa (high node))) no) \\\n (\\no\\set (prx @ [node]).\n (repa(node := repa (high node))) no \\ Null \\\n (if (repa(node := repa (high node)) \\ low) no =\n (repa(node := repa (high node)) \\ high) no \\\n low no \\ Null\n then (repa(node := repa (high node))) no =\n (repa(node := repa (high node)) \\ low) no\n else (repa(node := repa (high node))) no =\n hd [sn\\prx @ [node] .\n repNodes_eq sn no low high\n (repa(node := repa (high node)))] \\\n (repa(node := repa (high node)))\n ((repa(node := repa (high node))) no) =\n (repa(node := repa (high node))) no \\\n (\\no1\\set (prx @ [node]).\n ((repa(node := repa (high node)) \\ high) no1 =\n (repa(node := repa (high node)) \\ high) no \\\n (repa(node := repa (high node)) \\ low) no1 =\n (repa(node := repa (high node)) \\ low) no) =\n ((repa(node := repa (high node))) no =\n (repa(node := repa (high node))) no1))))\"\n (is \"?NodesUnmodif \\ ?NodesModif\")\n proof -\n \\ \\This proof was originally conducted without the\n substitution @{term \"repa (low node) = repa (high node)\"} preformed.\n So don't be confused if we show everythin for @{text \"repa (low node)\"}.\\\n from rep_repa_nc\n have nodes_unmodif: ?NodesUnmodif\n by auto\n hence rep_Sucna_nc:\n \"(\\no. no \\ set (prx @ [node]) \n \\ rep no = (repa(node := repa (low (node )))) no)\"\n by auto\n have nodes_modif: ?NodesModif (is \"\\no\\set (prx @ [node]). ?P no \\ ?Q no\")\n proof (rule ballI)\n fix no\n assume no_in_take_Sucna: \" no \\ set (prx @ [node])\"\n show \"?P no \\ ?Q no\"\n proof (cases \"no = node\")\n case False\n note no_noteq_nln=this\n with no_in_take_Sucna \n have no_in_take_n: \"no \\ set prx\"\n by auto\n with no_in_take_n while_inv obtain \n repa_no_nNull: \" repa no \\ Null\" and\n repa_cases: \"(if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null \n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \n \\ repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) \n = (repa no = repa no1)))\"\n using [[simp_depth_limit = 2]]\n by auto \n from no_in_take_n \n have no_in_nodeslist: \"no \\ set (prx @ node # sfx)\"\n by auto\n from repa_no_nNull no_noteq_nln have ext_repa_nNull: \"?P no\"\n by auto\n from no_in_nodeslist nodes_balanced_ordered obtain\n nln_nNull: \"node \\ Null\" and\n nln_balanced_children: \"(low node = Null) = (high node = Null)\" and\n lnln_notin_nodeslist: \"low node \\ set (prx @ node # sfx)\" and\n hnln_notin_nodeslist: \"high node \\ set (prx @ node # sfx)\" and\n isLeaf_var_nln: \"isLeaf_pt node low high = (var node \\ 1)\" and\n node_nNull_rap_nNull_nln: \"(low node \\ Null \n \\ rep (low node) \\ Null)\" and\n nln_varrep_le_var: \"(rep \\ low) node \\ set (prx @ node # sfx)\"\n apply (erule_tac x=\"node\" in ballE)\n apply auto\n done\n from no_in_nodeslist nodes_balanced_ordered no_in_take_Sucna \n obtain \n no_nNull: \"no \\ Null\" and\n balanced_children: \"(low no = Null) = (high no = Null)\" and\n lno_notin_nodeslist: \"low no \\ set (prx @ node # sfx)\" and\n hno_notin_nodeslist: \"high no \\ set (prx @ node # sfx)\" and\n isLeaf_var_no: \"isLeaf_pt no low high = (var no \\ 1)\" and\n node_nNull_rep_nNull: \"(low no \\ Null \\ rep (low no) \\ Null)\" and\n varrep_le_var: \"(rep \\ low) no \\ set (prx @ node # sfx)\"\n apply -\n apply (erule_tac x=no in ballE)\n apply auto\n done\n from lno_notin_nodeslist \n have ext_rep_null_comp_low: \n \"(repa (node := repa (low node)) \\ low) no = (repa \\ low) no\"\n by (auto simp add: null_comp_def)\n from hno_notin_nodeslist \n have ext_rep_null_comp_high: \n \"(repa (node := repa (low node)) \\ high) no = (repa \\ high) no\"\n by (auto simp add: null_comp_def)\n have share_reduce_if: \"?Q no\"\n proof (cases \"(repa (node := repa (low node)) \\ low) no = \n (repa(node := repa (low node)) \\ high) no \\ low no \\ Null\")\n case True\n then obtain \n red_case: \"(repa (node := repa (low node)) \\ low) no = \n (repa(node := repa (low node)) \\ high) no\" and\n lno_nNull: \"low no \\ Null\"\n by simp\n from lno_nNull balanced_children have hno_nNull: \"high no \\ Null\"\n by simp\n from True ext_rep_null_comp_low ext_rep_null_comp_high \n have repchildren_eq_no: \"(repa \\ low) no = (repa \\ high) no\"\n by simp\n with repa_cases lno_nNull have \"repa no = (repa \\ low) no\"\n by auto\n with ext_rep_null_comp_low no_noteq_nln \n have \"(repa(node := repa (low node))) no = \n (repa (node := repa (low node)) \\ low) no\"\n by simp\n with True repchildren_eq_nln show ?thesis\n by auto\n next\n assume share_case_ext: \n \" \\ ((repa(node := repa (low node)) \\ low) no = \n (repa(node := repa (low node)) \\ high) no \\ low no \\ Null)\"\n from not_Leaf isLeaf_var_nln \n have \"1 < var node\"\n by simp\n with all_nodes_same_var \n have all_nodes_nl_Suc0_l_var: \"\\x \\ set (prx @ node # sfx). 1 < var x\"\n using [[simp_depth_limit=1]]\n by auto\n with nodes_balanced_ordered \n have all_nodes_nl_noLeaf: \n \"\\x \\ set (prx @ node # sfx). \\ isLeaf_pt x low high\"\n apply -\n apply rule\n apply (drule_tac x=x in bspec,assumption)\n apply (drule_tac x=x in bspec,assumption)\n apply auto\n done\n from nodes_balanced_ordered \n have all_nodes_nl_balanced: \n \"\\x \\ set (prx @ node # sfx). (low x = Null) = (high x = Null)\"\n apply -\n apply rule\n apply (drule_tac x=x in bspec,assumption)\n apply auto\n done\n from all_nodes_nl_Suc0_l_var no_in_nodeslist \n have Suc0_l_var_no: \"1 < var no\"\n by auto\n with isLeaf_var_no have no_nLeaf: \" \\ isLeaf_pt no low high\"\n by simp\n with balanced_children have lno_nNull: \"low no \\ Null\"\n by (simp add: isLeaf_pt_def)\n with balanced_children have hno_nNull: \"high no \\ Null\"\n by simp\n with share_case_ext ext_rep_null_comp_low ext_rep_null_comp_high lno_nNull \n have repchildren_neq_no: \"(repa \\ low) no \\ (repa \\ high) no\"\n by (simp add: null_comp_def)\n with repa_cases \n have share_case_inv: \n \"repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \\ \n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \\ \n (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1))\"\n by auto\n then have repa_no: \"repa no = hd [sn\\prx . repNodes_eq sn no low high repa]\"\n by simp\n from Suc0_l_var_no have \"\\x \\ set (prx @ node # sfx). 1 < var no\"\n by auto\n from no_in_take_n have \"[sn\\prx . repNodes_eq sn no low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have \"repNodes_eq \n (hd [sn\\prx. repNodes_eq sn no low high repa]) no low high repa\"\n by (rule hd_filter_prop)\n with repa_no \n have rep_children_eq_no_repa_no: \n \"(repa \\ low) (repa no) = (repa \\ low) no \\ \n (repa \\ high) (repa no) = (repa \\ high) no\"\n by (simp add: repNodes_eq_def) \n from lno_notin_nodeslist rep_repa_nc \n have rep_repa_nc_low_no: \"rep (low no) = repa (low no)\"\n apply -\n apply (erule_tac x=\"low no\" in allE)\n apply auto\n done\n have \"\\x \\ set (prx @ [node]). \n repNodes_eq x no low high (repa(node := repa (low node))) = \n repNodes_eq x no low high repa\"\n proof (rule ballI, unfold repNodes_eq_def)\n fix x\n assume x_in_take_Sucn: \" x \\ set (prx @ [node])\"\n hence x_in_nodeslist: \"x \\ set (prx @ node # sfx)\"\n by auto\n with all_nodes_nl_noLeaf nodes_balanced_ordered \n have children_nNull_x: \"low x \\ Null \\ high x \\ Null\"\n apply -\n apply (drule_tac x=x in bspec,assumption)\n apply (drule_tac x=x in bspec,assumption)\n apply (auto simp add: isLeaf_pt_def) \n done\n from x_in_nodeslist nodes_balanced_ordered \n have \"low x \\ set (prx @ node # sfx) \\ high x \\ set (prx @ node # sfx)\"\n apply -\n apply (drule_tac x=x in bspec,assumption)\n apply auto\n done\n with lno_notin_nodeslist hno_notin_nodeslist \n children_nNull_x lno_nNull hno_nNull\n show \"((repa(node := repa (low node)) \\ high) x = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) x = \n (repa(node := repa (low node)) \\ low) no) =\n ((repa \\ high) x = (repa \\ high) no \\ \n (repa \\ low) x = (repa \\ low) no)\"\n by (simp add: null_comp_def)\n qed\n then have filter_extrep_rep: \n \"[sn\\(prx @ [node]). repNodes_eq sn no low high \n (repa(node := repa (low node)))] = \n [sn\\(prx @ [node]) . repNodes_eq sn no low high repa]\"\n by (rule P_eq_list_filter)\n from no_in_take_n \n have filter_n_notempty: \"[sn\\prx. repNodes_eq sn no low high repa] \\ []\"\n apply (rule filter_not_empty)\n apply (simp add: repNodes_eq_def)\n done\n then have \"hd [sn\\prx. repNodes_eq sn no low high repa] = \n hd [sn\\prx@[node]. repNodes_eq sn no low high repa]\"\n by auto\n with no_noteq_nln filter_extrep_rep repa_no \n have ext_repa_no: \"(repa(node:= repa (low node))) no = \n hd [sn\\prx@[node] . repNodes_eq sn no low high \n (repa(node := repa (low node)))]\"\n by simp\n have \"(repa(node := repa (low node))) (repa no) = repa no\"\n proof (cases \"repa no = node\")\n case True\n note rno_nln=this\n from rep_repa_nc_low_no rep_children_eq_no_repa_no lno_nNull \n node_nNull_rep_nNull \n have low_rep_no_nNull: \"low (repa no) \\ Null\"\n apply (simp add: null_comp_def)\n apply auto\n done\n with nodes_balanced_ordered rno_nln \n have high_rap_no_nNull: \"high (repa no) \\ Null\"\n apply -\n apply (drule_tac x=\"repa no\" in bspec)\n apply auto\n done\n with low_rep_no_nNull rno_nln rep_children_eq_no_repa_no \n have \"repa (low node) = (repa \\ low) no \\ \n repa (high node) = (repa \\ high) no\" \n by (simp add: null_comp_def)\n with repchildren_eq_nln have \" (repa \\ low) no = (repa \\ high) no\"\n by simp\n with repchildren_neq_no show ?thesis\n by simp\n next\n assume rno_not_nln: \"repa no \\ node\"\n from share_case_inv have \"repa (repa no) = repa no\"\n by auto\n with rno_not_nln show ?thesis\n by simp\n qed\n with no_noteq_nln have ext_repa_ext_repa: \n \"(repa(node := repa (low node))) \n ((repa(node := repa (low node))) no) \n = (repa(node := repa (low node))) no\" \n by simp\n have \"(\\no1\\set (prx@[node]).\n ((repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no) =\n ((repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1))\"\n proof (rule ballI)\n fix no1\n assume no1_in_take_Sucn: \" no1 \\ set (prx@[node])\"\n hence no1_in_nodeslist: \"no1 \\ set (prx @ node # sfx)\"\n by auto\n show \"((repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no) =\n ((repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1)\"\n proof (cases \"no1 = node\")\n case True\n show ?thesis\n proof (rule, elim conjE)\n assume ext_repa_no_no1: \n \"(repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1\"\n with True no_noteq_nln \n have repa_no_repa_low_nln: \"repa no = repa (low node)\"\n by simp\n from filter_n_notempty \n have repa_no_in_take_n: \n \"hd [sn\\prx. repNodes_eq sn no low high repa] \n \\ set prx \"\n apply -\n apply (rule hd_filter_in_list)\n apply auto\n done\n with repa_no \n have repa_no_in_nodeslist: \"repa no \\ set (prx @ node # sfx)\"\n by auto\n from lnln_notin_nodeslist rep_repa_nc \n have rep_repa_low_nln: \"rep (low node) = repa (low node)\"\n by auto\n from all_nodes_nl_noLeaf nln_balanced_children\n have \"low node \\ Null\"\n by (auto simp add: isLeaf_pt_def)\n with rep_repa_low_nln lnln_notin_nodeslist lno_nNull \n nln_varrep_le_var \n have \"repa (low node) \\ set (prx @ node # sfx)\"\n by (simp add: null_comp_def) \n with repa_no_repa_low_nln repa_no_in_nodeslist \n show \"(repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no\"\n by simp\n next\n assume no_no1_high: \n \"(repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no\"\n assume no_no1_low: \n \"(repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no\"\n from True repchildren_eq_nln \n have repachildren_eq_no1: \" repa (low no1) = repa (high no1)\"\n by simp\n from not_Leaf True nln_balanced_children \n have children_nNull_no1: \"(low no1) \\ Null \\ high no1 \\ Null\"\n by (simp add: isLeaf_pt_def)\n with repachildren_eq_no1 \n have repchildren_eq_no1: \"(repa \\ low) no1 = (repa \\ high) no1\"\n by (simp add: null_comp_def)\n from no_no1_low children_nNull_no1 lno_nNull \n lnln_notin_nodeslist lno_notin_nodeslist True \n have rep_low_eq_no_no1: \"(repa \\ low) no1 = (repa \\ low) no\"\n by (simp add: null_comp_def)\n from no_no1_high children_nNull_no1 hno_nNull \n hnln_notin_nodeslist hno_notin_nodeslist True \n have rep_high_eq_no_no1: \"(repa \\ high) no1 = (repa \\ high) no\"\n by (simp add: null_comp_def)\n with rep_low_eq_no_no1 repchildren_eq_no1 \n have \"(repa \\ low) no = (repa \\ high) no\"\n by simp\n with repchildren_neq_no \n show \"(repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1\"\n by simp\n qed\n next\n assume no1_neq_nln: \"no1 \\ node\"\n from no1_in_nodeslist nodes_balanced_ordered \n have children_notin_nl_no1: \n \"low no1 \\ set (prx @ node # sfx) \\ high no1 \\ set (prx @ node # sfx)\"\n apply -\n apply (drule_tac x=no1 in bspec,assumption)\n by auto\n from no1_neq_nln no1_in_take_Sucn \n have no1_in_take_n: \"no1 \\ set prx\"\n by auto\n from no1_in_nodeslist all_nodes_nl_noLeaf all_nodes_nl_balanced \n have children_nNull_no1: \"(low no1) \\ Null \\ high no1 \\ Null\"\n by (auto simp add: isLeaf_pt_def)\n show ?thesis\n proof (rule, elim conjE)\n assume ext_repa_high_no1_no: \n \"(repa(node := repa (low node)) \\ high) no1 \n = (repa(node := repa (low node)) \\ high) no\" \n assume ext_repa_low_no1_no: \n \"(repa(node := repa (low node)) \\ low) no1 \n = (repa(node := repa (low node)) \\ low) no\"\n from children_nNull_no1 hno_nNull ext_repa_high_no1_no \n children_notin_nl_no1 \n hno_notin_nodeslist \n have repa_high_no1_no: \"(repa \\ high) no1 = (repa \\ high) no\"\n by (simp add: null_comp_def)\n from children_nNull_no1 lno_nNull ext_repa_low_no1_no \n children_notin_nl_no1 lno_notin_nodeslist \n have repa_low_no1_no: \"(repa \\ low) no1 = (repa \\ low) no\"\n by (simp add: null_comp_def)\n from repchildren_neq_no repa_high_no1_no repa_low_no1_no \n have \"(repa \\ low) no1 \\ (repa \\ high) no1\"\n by simp\n from no1_in_take_n share_case_inv repa_high_no1_no repa_low_no1_no \n have \"repa no = repa no1\"\n by auto\n with no_noteq_nln no1_neq_nln \n show \" (repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1\"\n by simp\n next\n assume \"(repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1\"\n with no_noteq_nln no1_neq_nln \n have \"repa no = repa no1\"\n by simp\n with share_case_inv no1_in_take_n \n have \"((repa \\ high) no1 = (repa \\ high) no \\ \n (repa \\ low) no1 = (repa \\ low) no)\"\n by auto\n with children_notin_nl_no1 children_nNull_no1 lno_notin_nodeslist \n hno_notin_nodeslist lno_nNull hno_nNull \n show \"(repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no\"\n by (auto simp add: null_comp_def)\n qed \n qed\n qed\n from ext_repa_ext_repa ext_repa_no share_case_ext repchildren_eq_nln this \n show ?thesis\n using [[simp_depth_limit=4]]\n by auto \n qed\n with ext_repa_nNull show ?thesis\n by auto\n next\n assume no_nln: \"no = node\"\n hence no_in_nodeslist: \"no \\ set (prx @ node # sfx)\"\n by simp\n from no_nln not_Leaf no_in_nodeslist \n nodes_balanced_ordered [rule_format, OF this] obtain \n low_no_nNull: \"low no \\ Null\" and\n high_no_nNull: \"high no \\ Null\" and\n rep_low_no_nNull: \"rep (low no) \\ Null\" and\n lno_notin_nl: \"low no \\ set (prx @ node # sfx)\" and\n hno_notin_nl: \"high no \\ set (prx @ node # sfx)\" and\n children_nNull_no: \"(low no \\ Null) \\ (high no \\ Null)\"\n apply (unfold isLeaf_pt_def)\n apply blast\n done\n then have \"low no \\ set prx\"\n by auto\n with rep_repa_nc no_nln rep_low_no_nNull \n have \"(repa(node := repa (low node))) no \\ Null\"\n by simp\n moreover\n have \"(if (repa(node := repa (low node)) \\ low) no = \n (repa(node := repa (low node)) \\ high) no \\ low no \\ Null\n then (repa(node := repa (low node))) no = \n (repa(node := repa (low node)) \\ low) no\n else (repa(node := repa (low node))) no =\n hd [sn\\prx@[node]. repNodes_eq sn no low high \n (repa(node := repa (low node)))] \\\n (repa(node := repa (low node))) \n ((repa(node := repa (low node))) no) =\n (repa(node := repa (low node))) no \\\n (\\no1\\set (prx@[node]).\n ((repa(node := repa (low node)) \\ high) no1 = \n (repa(node := repa (low node)) \\ high) no \\\n (repa(node := repa (low node)) \\ low) no1 = \n (repa(node := repa (low node)) \\ low) no) =\n ((repa(node := repa (low node))) no = \n (repa(node := repa (low node))) no1)))\"\n proof (cases \"(repa(node := repa (low node)) \\ low) no = \n (repa(node := repa (low node)) \\ high) no \\ low no \\ Null\")\n case True\n note red_case=this\n with children_nNull_no lno_notin_nl hno_notin_nl \n have \"(repa \\ low) no = (repa \\ high) no\"\n by (auto simp add: null_comp_def)\n from children_nNull_no lno_notin_nl \n have ext_repa_eq_repa_low: \"(repa(node := repa (low node)) \\ low) no \n = (repa \\ low) no \"\n by (auto simp add: null_comp_def)\n from children_nNull_no hno_notin_nl \n have ext_repa_eq_repa_high: \n \"(repa(node := repa (low node)) \\ high) no \n = (repa \\ high) no \"\n by (auto simp add: null_comp_def)\n from no_nln children_nNull_no \n have \"repa (low node) = (repa \\ low) no\"\n by (simp add: null_comp_def)\n with red_case ext_repa_eq_repa_high ext_repa_eq_repa_low no_nln \n show ?thesis \n using [[simp_depth_limit=2]]\n by (auto simp del: null_comp_not_Null)\n next\n assume share_case: \" \\ ((repa(node := repa (low node)) \\ low) no \n = (repa(node := repa (low node)) \\ high) no \\ low no \\ Null)\"\n with low_no_nNull have \"(repa(node := repa (low node)) \\ low) no \n \\ (repa(node := repa (low node)) \\ high) no\"\n by simp\n with children_nNull_no lno_notin_nl hno_notin_nl \n have \"(repa \\ low) no \\ (repa \\ high) no\"\n by (auto simp add: null_comp_def)\n with children_nNull_no have \"repa (low no) \\ repa (high no)\"\n by (simp add: null_comp_def)\n with repchildren_eq_nln no_nln show ?thesis\n by simp\n qed\n ultimately show ?thesis\n using repchildren_eq_nln\n apply -\n apply (simp only:)\n apply (simp (no_asm))\n done\n qed\n qed\n from nodes_unmodif nodes_modif\n show ?thesis by iprover\n qed\nnext\n fix var low high rep nodeslist repa \"next\" node prx sfx repb\n assume ns: \"List nodeslist next (prx @ node # sfx)\"\n assume sfx: \"List (next node) next sfx\"\n assume nodes_balanced_ordered: \"\\no\\set (prx @ node # sfx).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (prx @ node # sfx) \\\n high no \\ set (prx @ node # sfx) \\\n isLeaf_pt no low high = (var no \\ (1::nat)) \\\n (low no \\ Null \\ rep (low no) \\ Null) \\\n (rep \\ low) no \\ set (prx @ node # sfx)\"\n assume all_nodes_same_var: \"\\no1\\set (prx @ node # sfx).\n \\no2\\set (prx @ node # sfx). var no1 = var no2\"\n assume rep_repa_nc: \"\\no. no \\ set prx \\ rep no = repa no\"\n assume while_inv: \"\\no\\set prx.\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\\n (\\no1\\set prx.\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))\"\n assume share_cond: \n \"\\ (\\ isLeaf_pt node low high \\ repa (low node) = repa (high node))\"\n assume repb_node: \n \"repb node = hd [sn\\prx @ node # sfx . repNodes_eq sn node low high repa]\"\n assume repa_repb_nc: \"\\pt. pt \\ node \\ repa pt = repb pt\" \n assume var_repb_node: \"var (repb node) = var node\"\n show \"(\\no. no \\ set (prx @ [node]) \\ rep no = repb no) \\\n (\\no\\set (prx @ [node]).\n repb no \\ Null \\\n (if (repb \\ low) no = (repb \\ high) no \\ low no \\ Null\n then repb no = (repb \\ low) no\n else repb no =\n hd [sn\\prx @ [node] . repNodes_eq sn no low high repb] \\\n repb (repb no) = repb no \\\n (\\no1\\set (prx @ [node]).\n ((repb \\ high) no1 = (repb \\ high) no \\\n (repb \\ low) no1 = (repb \\ low) no) =\n (repb no = repb no1))))\"\n proof -\n have rep_repb_nc: \"(\\no. no \\ set (prx @ [node]) \\ rep no = repb no)\"\n proof (intro allI impI)\n fix no\n assume no_notin_take_Sucn: \"no \\ set (prx @ [node])\"\n with rep_repa_nc \n have rep_repa_nc_Sucn: \"rep no = repa no\"\n by auto\n from no_notin_take_Sucn have \"no \\ node\"\n by auto\n with repa_repb_nc have \"repa no = repb no\"\n by auto\n with rep_repa_nc_Sucn show \"rep no = repb no\"\n by simp\n qed\n moreover\n have repb_no_share_def: \n \"(\\no\\set (prx @ [node]). \n \\ ((repb \\ low) no = (repb \\ high) no \\ low no \\ Null) \\ \n repb no = hd [sn\\(prx @ [node]) . repNodes_eq sn no low high repb])\" \n proof (intro ballI impI)\n fix no\n assume no_in_take_Sucn: \" no \\ set (prx @ [node])\"\n assume share_prop: \"\\ ((repb \\ low) no = (repb \\ high) no \\ low no \\ Null)\"\n from share_prop have share_or: \n \"(repb \\ low) no \\ (repb \\ high) no \\ low no = Null\"\n using [[simp_depth_limit=2]]\n by simp\n from no_in_take_Sucn have no_in_nl: \"no \\ set (prx @ node # sfx)\"\n by auto\n from nodes_balanced_ordered [rule_format, OF this] obtain\n no_nNull: \"no \\ Null\" and\n balanced_no: \"(low no = Null) = (high no = Null)\" and\n lno_notin_nl: \"low no \\ set (prx @ node # sfx)\" and\n hno_notin_nl: \"high no \\ set (prx @ node # sfx)\" and\n isLeaf_var_no: \"isLeaf_pt no low high = (var no \\ 1)\"\n by auto\n have nodes_notin_nl_neq_nln: \"\\p. p \\ set (prx @ node # sfx) \\ p \\ node \"\n by auto \n show \" repb no = hd [sn\\(prx @ [node]). repNodes_eq sn no low high repb]\"\n proof (cases \"no = node\")\n case False\n note no_notin_nl=this\n with no_in_take_Sucn have no_in_take_n: \"no \\ set prx\"\n by auto\n from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n by auto\n with while_inv [rule_format, OF no_in_take_n] no_in_take_n obtain \n repa_no_nNull: \"repa no \\ Null\" and\n while_share_red_exp: \n \"(if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null \n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \\ \n (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1)))\"\n using [[simp_depth_limit = 2]]\n by auto \n from no_in_take_n \n have filter_take_n_notempty: \"[sn\\prx. \n repNodes_eq sn no low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have hd_term_n_Sucn: \n \"hd [sn\\prx. repNodes_eq sn no low high repa] \n = hd [sn\\prx@[node] . repNodes_eq sn no low high repa]\"\n by auto\n thus ?thesis\n proof (cases \"low no = Null\")\n case True\n note lno_Null=this\n with balanced_no have hno_Null: \"high no = Null\" \n by simp\n from lno_Null hno_Null have isLeaf_no: \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n from True while_share_red_exp \n have while_low_Null: \n \"repa no = hd [sn\\prx. repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1))\"\n by auto\n have all_nodes_in_nl_Leafs: \n \"\\x \\ set (prx @ node # sfx). isLeaf_pt x low high\"\n proof (intro ballI)\n fix x\n assume x_in_nodeslist: \"x \\ set (prx @ node # sfx)\"\n from isLeaf_no isLeaf_var_no have \"var no \\ 1\"\n by simp\n with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n have \"var x \\ 1\"\n by simp\n with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n show \"isLeaf_pt x low high\"\n by (auto simp add: isLeaf_pt_def) \n qed\n have \"\\ x \\ set (prx@[node]). repNodes_eq x no low high repb \n = repNodes_eq x no low high repa\"\n proof (rule ballI)\n fix x\n assume x_in_take_Sucn: \"x \\ set (prx@[node])\"\n hence x_in_nodeslist: \"x \\ set (prx @ node # sfx)\"\n by auto\n with all_nodes_in_nl_Leafs have \"isLeaf_pt x low high\"\n by auto\n with isLeaf_no repa_repb_nc show \"repNodes_eq x no low high repb \n = repNodes_eq x no low high repa\"\n by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n qed\n then have \" [sn\\(prx@[node]). repNodes_eq sn no low high repa] \n = [sn\\(prx@[node]) . repNodes_eq sn no low high repb]\"\n apply -\n apply (rule P_eq_list_filter)\n apply simp\n done\n with hd_term_n_Sucn while_low_Null repb_repa_no show ?thesis \n by auto\n next\n assume lno_nNull: \" low no \\ Null\"\n with balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull have no_nLeaf: \"\\ isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n with isLeaf_var_no have Sucn_s_varno: \"1 < var no\"\n by auto\n with no_in_nl all_nodes_same_var \n have all_nodes_nl_var: \"\\ x \\ set (prx @ node # sfx). 1 < var x\"\n apply -\n apply (rule ballI)\n apply (drule_tac x=no in bspec,assumption)\n apply (drule_tac x=x in bspec,assumption)\n apply auto\n done\n with nodes_balanced_ordered \n have all_nodes_nl_nLeaf: \n \"\\x \\ set (prx @ node # sfx). \\ isLeaf_pt x low high\"\n apply -\n apply (rule ballI)\n apply (drule_tac x=x in bspec,assumption)\n apply (drule_tac x=x in bspec,assumption)\n apply auto\n done\n from lno_nNull share_or \n have repbchildren_eq_no: \"(repb \\ low) no \\ (repb \\ high) no\"\n by simp\n with lno_nNull hno_nNull lno_notin_nl hno_notin_nl repa_repb_nc \n nodes_notin_nl_neq_nln \n have repachildren_eq_no: \"(repa \\ low) no \\ (repa \\ high) no\"\n using [[simp_depth_limit=2]]\n by (simp add: null_comp_def) \n with while_share_red_exp \n have repa_no_def: \n \"repa no = hd [sn\\prx . repNodes_eq sn no low high repa] \"\n by auto\n with no_notin_nl repa_repb_nc \n have \"repb no = hd [sn\\prx. repNodes_eq sn no low high repa] \"\n by simp\n with hd_term_n_Sucn \n have repb_no_hd_term_repa: \"repb no = \n hd [sn\\prx@[node] . repNodes_eq sn no low high repa] \"\n by simp\n have \"\\x \\ set (prx@[node]). \n repNodes_eq x no low high repa = repNodes_eq x no low high repb\" \n proof (intro ballI)\n fix x\n assume x_in_take_Sucn: \"x \\ set (prx@[node]) \"\n hence x_in_nodeslist: \"x \\ set (prx @ node # sfx)\"\n by auto\n with all_nodes_nl_nLeaf have x_nLeaf: \"\\ isLeaf_pt x low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF x_in_nodeslist] obtain\n balanced_x: \"(low x = Null) = (high x = Null)\" and\n lx_notin_nl: \"low x \\ set (prx @ node # sfx)\" and\n hx_notin_nl: \"high x \\ set (prx @ node # sfx)\" \n by auto\n with nodes_notin_nl_neq_nln lno_notin_nl hno_notin_nl lno_nNull \n hno_nNull repa_repb_nc \n show \" repNodes_eq x no low high repa = repNodes_eq x no low high repb\"\n by (simp add: repNodes_eq_def null_comp_def)\n qed\n then have \" [sn\\(prx@[node]). repNodes_eq sn no low high repa] = \n [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n apply -\n apply (rule P_eq_list_filter)\n apply auto\n done\n with repb_no_hd_term_repa show ?thesis\n by simp\n qed\n next \n assume no_nln: \"no = node\"\n with repb_node have repb_no_def: \"repb no = \n hd [sn\\(prx @ node # sfx). repNodes_eq sn node low high repa]\" \n by simp\n show ?thesis\n proof (cases \"isLeaf_pt no low high\")\n case True\n note isLeaf_no=this\n have \"\\x \\ set (prx @ node # sfx). repNodes_eq x no low high repb \n = repNodes_eq x no low high repa\"\n proof (rule ballI)\n fix x\n assume x_in_nodeslist: \"x \\ set (prx @ node # sfx)\"\n have all_nodes_in_nl_Leafs: \n \"\\x \\ set (prx @ node # sfx). isLeaf_pt x low high\"\n proof (intro ballI)\n fix x\n assume x_in_nodeslist: \" x \\ set (prx @ node # sfx)\"\n from isLeaf_no isLeaf_var_no have \"var no \\ 1\"\n by simp\n with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n have \"var x \\ 1\"\n by simp\n with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n show \"isLeaf_pt x low high\"\n by (auto simp add: isLeaf_pt_def)\n qed\n with x_in_nodeslist have \"isLeaf_pt x low high\"\n by auto\n with isLeaf_no repa_repb_nc \n show \"repNodes_eq x no low high repb = repNodes_eq x no low high repa\"\n by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n qed\n with repb_no_def no_nln have repb_no_whole_nl: \"repb no = \n hd [sn\\ (prx @ node # sfx). repNodes_eq sn node low high repb]\"\n apply -\n apply (subgoal_tac \n \"[sn\\ (prx@node#sfx). repNodes_eq sn node low high repa] \n = [sn\\(prx @ node # sfx) . repNodes_eq sn node low high repb]\")\n apply simp\n apply (rule P_eq_list_filter)\n apply auto\n done\n from no_in_take_Sucn no_nln \n have \"[sn\\ (prx@[node]). repNodes_eq sn node low high repb] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then\n have \"hd [sn\\(prx@[node]). repNodes_eq sn node low high repb] = \n hd [sn\\(prx @ node # sfx). repNodes_eq sn node low high repb]\"\n apply -\n apply (rule hd_filter_app [symmetric])\n apply auto\n done\n with repb_no_whole_nl no_nln show ?thesis\n by simp \n next\n assume no_nLeaf: \" \\ isLeaf_pt no low high\"\n with share_or balanced_no have \"(repb \\ low) no \\ (repb \\ high) no\"\n using [[simp_depth_limit=2]]\n by (simp add: isLeaf_pt_def)\n from no_nLeaf share_cond no_nln have \"repa (low no) \\ repa (high no)\"\n by auto\n with no_nLeaf balanced_no have \"(repa \\ low) no \\ (repa \\ high) no \"\n by (simp add: null_comp_def isLeaf_pt_def)\n have \"\\ x \\ set (prx@node#sfx). repNodes_eq x no low high repb \n = repNodes_eq x no low high repa\"\n proof (rule ballI)\n fix x\n assume x_in_nodeslist: \" x \\ set (prx@node#sfx)\"\n have all_nodes_in_nl_Leafs: \n \"\\x \\ set (prx@node#sfx). \\ isLeaf_pt x low high\"\n proof (intro ballI)\n fix x\n assume x_in_nodeslist: \" x \\ set (prx@node#sfx)\"\n from no_nLeaf isLeaf_var_no have \"1 < var no \"\n by simp\n with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n have \"1 < var x\" \n by auto\n with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n show \"\\ isLeaf_pt x low high\"\n apply (unfold isLeaf_pt_def)\n apply fastforce\n done\n qed\n with x_in_nodeslist have x_nLeaf: \"\\ isLeaf_pt x low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n have \"(low x = Null) = (high x = Null) \n \\ low x \\ set (prx@node#sfx) \\ high x \\ set (prx@node#sfx)\"\n by auto\n with x_nLeaf balanced_no no_nLeaf repa_repb_nc \n nodes_notin_nl_neq_nln lno_notin_nl hno_notin_nl\n show \"repNodes_eq x no low high repb = repNodes_eq x no low high repa\"\n using [[simp_depth_limit=2]]\n by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n qed\n with repb_no_def no_nln \n have repb_no_whole_nl: \n \"repb no = hd [sn\\(prx@node#sfx). repNodes_eq sn node low high repb]\"\n apply -\n apply (subgoal_tac \n \"[sn\\(prx@node#sfx). repNodes_eq sn node low high repa] \n = [sn\\(prx@node#sfx). repNodes_eq sn node low high repb]\")\n apply simp\n apply (rule P_eq_list_filter)\n apply auto\n done\n from no_in_take_Sucn no_nln \n have \"[sn\\(prx@[node]) . repNodes_eq sn node low high repb] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have \n \"hd [sn\\ (prx@[node]) . repNodes_eq sn node low high repb] = \n hd [sn\\(prx@node#sfx) . repNodes_eq sn node low high repb]\"\n apply -\n apply (rule hd_filter_app [symmetric])\n apply auto\n done\n with repb_no_whole_nl no_nln show ?thesis\n by simp \n qed\n qed\n qed\n have repb_no_red_def: \"(\\no\\set (prx@[node]).(repb \\ low) no = (repb \\ high) no \n \\ low no \\ Null \\ repb no = (repb \\ low) no)\" \n proof (intro ballI impI)\n fix no\n assume no_in_take_Sucn: \"no \\ set (prx@[node])\"\n assume red_cond_no: \" (repb \\ low) no = (repb \\ high) no \\ low no \\ Null\"\n from no_in_take_Sucn have no_in_nl: \"no \\ set (prx@node#sfx)\"\n by auto\n from nodes_balanced_ordered [rule_format, OF this]obtain\n no_nNull: \"no \\ Null\" and\n balanced_no: \"(low no = Null) = (high no = Null)\" and\n lno_notin_nl: \"low no \\ set (prx@node#sfx)\" and\n hno_notin_nl: \"high no \\ set (prx@node#sfx)\" and\n isLeaf_var_no: \"isLeaf_pt no low high = (var no \\ 1)\"\n by auto\n have nodes_notin_nl_neq_nln: \"\\ p. p \\ set (prx@node#sfx) \\ p \\ node\"\n by auto\n show \" repb no = (repb \\ low) no\"\n proof (cases \"no = node\")\n case False\n note no_notin_nl=this\n with no_in_take_Sucn have no_in_take_n: \"no \\ set prx\"\n by auto\n from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n by auto\n with while_inv [rule_format, OF no_in_take_n] obtain \n repa_no_nNull: \"repa no \\ Null\" and\n while_share_red_exp: \n \"(if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null \n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx. repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \\ \n (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1)))\"\n using [[simp_depth_limit=2]]\n by auto\n from red_cond_no nodes_notin_nl_neq_nln lno_notin_nl \n hno_notin_nl while_share_red_exp balanced_no repa_repb_nc \n have red_repa_no: \"repa no = (repa \\ low) no\"\n by (auto simp add: null_comp_def)\n from red_cond_no nodes_notin_nl_neq_nln lno_notin_nl repa_repb_nc \n have \"(repb \\ low) no = (repa \\ low) no\"\n by (auto simp add: null_comp_def)\n with red_repa_no no_notin_nl balanced_no repa_repb_nc \n have \"repb no = (repb \\ low) no\"\n by auto\n with red_cond_no show ?thesis\n by auto\n next\n assume \"no = node\"\n with share_cond \n have share_cond_pre: \n \"isLeaf_pt no low high \\ repa (low no) \\ repa (high no)\" \n by simp\n show ?thesis\n proof (cases \"isLeaf_pt no low high\")\n case True\n with red_cond_no show ?thesis\n by (simp add: isLeaf_pt_def)\n next\n assume no_nLeaf: \"\\ isLeaf_pt no low high\"\n with share_cond_pre \n have \"repa (low no) \\ repa (high no)\"\n by simp\n with no_nLeaf lno_notin_nl hno_notin_nl nodes_notin_nl_neq_nln \n balanced_no repa_repb_nc\n have \"repb (low no) \\ repb (high no)\"\n using [[simp_depth_limit=2]]\n by (auto simp add: isLeaf_pt_def)\n with no_nLeaf balanced_no have \"(repb \\ low) no \\ (repb \\ high) no\"\n by (simp add: null_comp_def isLeaf_pt_def)\n with red_cond_no show ?thesis\n by simp\n qed\n qed\n qed\n have while_while: \"(\\no\\set (prx@[node]).\n repb no \\ Null \\\n (if (repb \\ low) no = (repb \\ high) no \\ low no \\ Null \n then repb no = (repb \\ low) no\n else repb no = hd [sn\\(prx@[node]). repNodes_eq sn no low high repb] \\\n repb (repb no) = repb no \\\n (\\no1\\set ((prx@[node])). ((repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1))))\"\n (is \"\\no\\set (prx@[node]). ?P no \\ ?Q no\")\n proof (intro ballI)\n fix no\n assume no_in_take_Sucn: \"no \\ set (prx@[node])\"\n hence no_in_nl: \"no \\ set (prx@node#sfx)\"\n by auto\n from nodes_balanced_ordered [rule_format, OF this] obtain\n no_nNull: \"no \\ Null\" and\n balanced_no: \"(low no = Null) = (high no = Null)\" and\n lno_notin_nl: \"low no \\ set (prx@node#sfx)\" and\n hno_notin_nl: \"high no \\ set (prx@node#sfx)\" and\n isLeaf_var_no: \"isLeaf_pt no low high = (var no \\ 1)\"\n by auto\n from no_in_take_Sucn \n have filter_take_Sucn_not_empty: \n \"[sn\\(prx@[node]). repNodes_eq sn no low high repb] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have hd_filter_Sucn_in_Sucn: \n \"hd [sn\\(prx@[node]). repNodes_eq sn no low high repb] \\ \n set (prx@[node])\"\n by (rule hd_filter_in_list)\n have nodes_notin_nl_neq_nln: \"\\p. p \\ set (prx@node#sfx) \\ p \\ node\"\n by auto\n show \"?P no \\ ?Q no\"\n proof (cases \"no = node\")\n case False\n note no_notin_nl=this\n with no_in_take_Sucn \n have no_in_take_n: \"no \\ set prx\"\n by auto\n from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n by auto\n with while_inv [rule_format, OF no_in_take_n] obtain \n repa_no_nNull: \"repa no \\ Null\" and\n while_share_red_exp: \n \"(if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null \n then repa no = (repa \\ low) no\n else repa no = hd [sn\\prx. repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \\ \n (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1)))\"\n using [[simp_depth_limit=2]]\n by auto\n from repb_repa_no repa_no_nNull have repb_no_nNull: \"?P no\"\n by simp\n have \"?Q no\"\n proof (cases \"(repb \\ low) no = (repb \\ high) no \\ low no \\ Null\")\n case True\n with no_in_take_Sucn repb_no_red_def show ?thesis\n by auto\n next\n assume share_case_repb: \n \" \\ ((repb \\ low) no = (repb \\ high) no \\ low no \\ Null)\"\n with repb_no_share_def no_in_take_Sucn \n have repb_no_def: \"repb no = hd [sn\\ (prx@[node]). \n repNodes_eq sn no low high repb]\"\n by auto\n with share_case_repb \n have \"(repb \\ low) no \\ (repb \\ high) no \\ low no = Null\"\n using [[simp_depth_limit=2]]\n by simp\n thus ?thesis\n proof (cases \"low no = Null\")\n case True\n note lno_Null=this\n with balanced_no have hno_Null: \"high no = Null\" \n by simp\n from lno_Null hno_Null have isLeaf_no: \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n from True while_share_red_exp \n have while_low_Null: \n \"repa no = hd [sn\\prx. repNodes_eq sn no low high repa] \\\n repa (repa no) = repa no \\ \n (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1))\"\n by auto\n from no_in_take_n \n have \"[sn\\prx. repNodes_eq sn no low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have hd_term_n_Sucn: \"hd [sn\\prx. repNodes_eq sn no low high repa] = \n hd [sn\\(prx@[node]) . repNodes_eq sn no low high repa]\"\n apply -\n apply (rule hd_filter_app [symmetric])\n apply auto\n done\n have all_nodes_in_nl_Leafs: \n \"\\x \\ set (prx@node#sfx). isLeaf_pt x low high\"\n proof (intro ballI)\n fix x\n assume x_in_nodeslist: \" x \\ set (prx@node#sfx)\"\n from isLeaf_no isLeaf_var_no have \"var no \\ 1\"\n by simp\n with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl] \n have \"var x \\ 1\" \n by simp\n with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n show \"isLeaf_pt x low high\"\n by (auto simp add: isLeaf_pt_def)\n qed\n from no_in_take_Sucn have \n filter_Sucn_no_notempty: \n \"[sn\\(prx@[node]). repNodes_eq sn no low high repb] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have hd_term_in_take_Sucn: \n \"hd [sn\\(prx@[node]) . repNodes_eq sn no low high repb] \n \\ set (prx@[node])\"\n by (rule hd_filter_in_list)\n then have hd_term_in_nl: \n \"hd [sn\\(prx@[node]) . repNodes_eq sn no low high repb] \n \\ set (prx@node#sfx)\"\n by auto \n with all_nodes_in_nl_Leafs \n have hd_term_Leaf: \"isLeaf_pt (hd [sn\\ (prx@[node]). \n repNodes_eq sn no low high repb]) low high \"\n by auto \n from while_low_Null have \"repa (repa no) = repa no\"\n by auto\n with no_notin_nl repa_repb_nc \n have repa_repb_no_repb: \"repa (repb no) = repb no\"\n by auto\n have repb_repb_no: \"repb (repb no) = repb no\" \n proof (cases \"repb no = node\")\n case False\n with repa_repb_nc repa_repb_no_repb show ?thesis\n by auto\n next\n assume repb_no_nln: \" repb no = node\"\n with hd_term_Leaf isLeaf_no all_nodes_in_nl_Leafs \n have nested_hd_repa_repb: \n \"hd [sn\\(prx@node#sfx). repNodes_eq sn \n (hd [sn\\(prx@[node]) . repNodes_eq sn no low high repb]) \n low high repa] = \n hd [sn\\(prx@node#sfx). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb]\"\n by (simp add: isLeaf_pt_def repNodes_eq_def null_comp_def)\n from hd_term_in_take_Sucn \n have \"[sn\\(prx@[node]). repNodes_eq sn \n (hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have \"hd [sn\\(prx@[node]). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb] = \n hd [sn\\(prx@node#sfx). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb]\"\n apply -\n apply (rule hd_filter_app [symmetric])\n apply auto\n done\n then have hd_term_nodeslist_Sucn: \n \"hd [sn\\(prx@node#sfx). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb] =\n hd [sn\\(prx@[node]). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb]\"\n by simp\n from no_in_take_Sucn filter_Sucn_no_notempty \n have filter_filter: \"hd [sn\\(prx@[node]). repNodes_eq sn \n (hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb] = \n hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n apply -\n apply (rule filter_hd_P_rep_indep)\n apply (auto simp add: repNodes_eq_def)\n done\n from repb_no_def repb_no_nln repb_node \n have \"repb (repb no) = hd [sn\\(prx@node#sfx). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repa]\"\n by simp\n with nested_hd_repa_repb \n have \"repb (repb no) = hd [sn\\(prx@node#sfx). repNodes_eq sn \n (hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb]\"\n by simp\n with hd_term_nodeslist_Sucn \n have \"repb (repb no) = hd [sn\\(prx@[node]). repNodes_eq sn \n ( hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]) \n low high repb]\"\n by simp\n with filter_filter \n have \"repb (repb no) = hd [sn\\(prx@[node]). \n repNodes_eq sn no low high repb]\"\n by simp\n with repb_no_def show ?thesis\n by simp\n qed\n have two_nodes_repb: \"(\\no1\\set (prx@[node]). \n ((repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1))\"\n proof (intro ballI)\n fix no1\n assume no1_in_take_Sucn: \" no1 \\ set (prx@[node])\"\n then have \"no1 \\ set (prx@node#sfx)\" by auto\n with all_nodes_in_nl_Leafs \n have isLeaf_no1: \"isLeaf_pt no1 low high\"\n by auto\n with isLeaf_no \n have repbchildren_eq_no_no1: \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n by (simp add: null_comp_def isLeaf_pt_def)\n from isLeaf_no1 isLeaf_no \n have repachildren_eq_no_no1: \"(repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no\"\n by (simp add: null_comp_def isLeaf_pt_def)\n from while_low_Null \n have while_low_same_rep: \"(\\no1\\set prx. \n ((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1))\"\n by auto\n show \"((repb \\ high) no1 = (repb \\ high) no \\ \n (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1)\"\n proof (cases \"no1 = node\")\n case False\n with no1_in_take_Sucn have \"no1 \\ set prx\"\n by auto\n with while_low_same_rep repachildren_eq_no_no1 \n have \"repa no = repa no1\"\n by auto\n with repa_repb_nc no_notin_nl False repbchildren_eq_no_no1 \n show ?thesis \n by auto\n next\n assume no1_nln: \"no1 = node\"\n hence no1_in_take_Sucn: \"no1 \\ set (prx@[node])\"\n by auto\n hence no1_in_nl: \"no1 \\ set (prx@node#sfx)\"\n by auto\n from nodes_balanced_ordered [rule_format, OF this] have \n balanced_no1: \"(low no1 = Null) = (high no1 = Null)\"\n by auto\n with no1_in_take_Sucn repb_no_share_def isLeaf_no1 \n have repb_no1: \"repb no1 = hd [sn\\(prx@[node]). \n repNodes_eq sn no1 low high repb]\"\n by (auto simp add: isLeaf_pt_def)\n from balanced_no1 isLeaf_no1 isLeaf_no balanced_no \n have repbchildren_eq_no1_no: \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n by (simp add: null_comp_def isLeaf_pt_def)\n have \"\\ x \\ set (prx@[node]). repNodes_eq x no low high repb \n = repNodes_eq x no1 low high repb\"\n proof (intro ballI)\n fix x\n assume x_in_take_Sucn: \" x \\ set (prx@[node])\"\n with repbchildren_eq_no1_no show \"repNodes_eq x no low high repb \n = repNodes_eq x no1 low high repb\"\n by (simp add: repNodes_eq_def)\n qed\n then have \" [sn\\(prx@[node]). repNodes_eq sn no low high repb] \n = [sn\\(prx@[node]). repNodes_eq sn no1 low high repb]\"\n by (rule P_eq_list_filter)\n with repb_no_def repb_no1 have repb_no_no1: \"repb no = repb no1\"\n by simp\n with repbchildren_eq_no1_no show ?thesis\n by simp\n qed\n qed\n with repb_repb_no repb_no_share_def no_in_take_Sucn share_case_repb \n show ?thesis\n using [[simp_depth_limit=4]]\n by auto\n next\n assume lno_nNull: \"low no \\ Null\"\n with share_case_repb \n have repbchildren_neq_no: \"(repb \\ low) no \\ (repb \\ high) no\"\n by auto\n from balanced_no lno_nNull \n have hno_nNull: \"high no \\ Null\"\n by simp\n with repbchildren_neq_no lno_nNull repa_repb_nc \n lno_notin_nl hno_notin_nl nodes_notin_nl_neq_nln \n have repachildren_neq_no: \"(repa \\ low) no \\ (repa \\ high) no\"\n using [[simp_depth_limit=2]]\n by (auto simp add: null_comp_def)\n with while_share_red_exp \n have repa_while_inv: \"repa (repa no) = repa no \n \\ (\\no1\\set prx. ((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1))\"\n by auto\n from lno_nNull hno_nNull \n have no_nLeaf: \"\\ isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n have all_nodes_in_nl_nLeafs: \n \"\\x \\ set (prx@node#sfx). \\ isLeaf_pt x low high\"\n proof (intro ballI)\n fix x\n assume x_in_nodeslist: \" x \\ set (prx@node#sfx)\"\n from no_nLeaf isLeaf_var_no have \"1 < var no \"\n by simp\n with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl] \n have \"1 < var x\"\n by simp\n with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n show \" \\ isLeaf_pt x low high\"\n using [[simp_depth_limit = 2]]\n by (auto simp add: isLeaf_pt_def)\n qed\n have repb_repb_no: \"repb (repb no) = repb no\"\n proof -\n from repa_while_inv no_notin_nl repa_repb_nc \n have \"repa (repb no) = repb no\"\n by simp\n from hd_filter_Sucn_in_Sucn repb_no_def \n have repb_no_in_take_Sucn: \"repb no \\ set (prx@[node])\"\n by simp\n hence repb_no_in_nl: \"repb no \\ set (prx@node#sfx)\"\n by auto\n from all_nodes_in_nl_nLeafs repb_no_in_nl \n have repb_no_nLeaf: \"\\ isLeaf_pt (repb no) low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF repb_no_in_nl]\n have \"(low (repb no) = Null) = (high (repb no) = Null) \n \\ low (repb no) \\ set (prx@node#sfx) \\ \n high (repb no) \\ set (prx@node#sfx)\"\n by auto\n from filter_take_Sucn_not_empty \n have \" repNodes_eq (hd [sn\\(prx@[node]). \n repNodes_eq sn no low high repb]) no low high repb\"\n by (rule hd_filter_prop)\n with repb_no_def have \"repNodes_eq (repb no) no low high repb\"\n by simp\n then have \"(repb \\ low) (repb no) = (repb \\ low) no \n \\ (repb \\ high) (repb no) = (repb \\ high) no\"\n by (simp add: repNodes_eq_def)\n with repbchildren_neq_no have \"(repb \\ low) (repb no) \n \\ (repb \\ high) (repb no)\"\n by simp\n with repb_no_in_take_Sucn repb_no_share_def \n have repb_repb_no_double_hd: \n \"repb (repb no) = hd [sn\\(prx@[node]). \n repNodes_eq sn (repb no) low high repb]\"\n by auto\n from filter_take_Sucn_not_empty \n have \" hd [sn\\(prx@[node]). \n repNodes_eq sn (repb no) low high repb] = repb no\"\n apply (simp only: repb_no_def )\n apply (rule filter_hd_P_rep_indep)\n apply (auto simp add: repNodes_eq_def)\n done\n with repb_repb_no_double_hd show ?thesis\n by simp\n qed\n have \"(\\no1\\set (prx@[node]). \n ((repb \\ high) no1 = (repb \\ high) no \\ \n (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1))\"\n proof (intro ballI)\n fix no1\n assume no1_in_take_Sucn: \"no1 \\ set (prx@[node])\"\n hence no1_in_nl: \"no1 \\ set (prx@node#sfx)\"\n by auto\n from all_nodes_in_nl_nLeafs no1_in_nl \n have no1_nLeaf: \"\\ isLeaf_pt no1 low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF no1_in_nl]\n have no1_props: \"(low no1 = Null) = (high no1 = Null) \n \\ low no1 \\ set (prx@node#sfx) \\ high no1 \\ set (prx@node#sfx)\"\n by auto\n show \"((repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1)\"\n proof (cases \"no1 = node\")\n case False\n note no1_neq_nln=this\n with no1_in_take_Sucn \n have no1_in_take_n: \"no1 \\ set prx\"\n by auto\n with repa_while_inv have \"((repa \\ high) no1 = (repa \\ high) no \n \\ (repa \\ low) no1 = (repa \\ low) no) = (repa no = repa no1)\"\n by fastforce\n with no1_props no1_nLeaf no_nLeaf balanced_no lno_notin_nl \n hno_notin_nl nodes_notin_nl_neq_nln no_notin_nl \n no1_neq_nln repa_repb_nc\n show ?thesis\n using [[simp_depth_limit=1]]\n by (auto simp add: null_comp_def isLeaf_pt_def)\n next\n assume no1_nln: \" no1 = node\"\n show ?thesis\n proof\n assume repbchildren_eq_no1_no: \n \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n with repbchildren_neq_no \n have \"(repb \\ high) no1 \\ (repb \\ low) no1\"\n by auto\n with repb_no_share_def no1_in_take_Sucn \n have repb_no1_def: \" repb no1 = hd [sn\\(prx@[node]). \n repNodes_eq sn no1 low high repb]\"\n by auto\n have filter_no1_eq_filter_no: \"[sn\\(prx@[node]). \n repNodes_eq sn no1 low high repb] = \n [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n proof -\n have \"\\x \\ set (prx@[node]). \n repNodes_eq x no1 low high repb = \n repNodes_eq x no low high repb\"\n proof (intro ballI)\n fix x\n assume x_in_take_Sucn: \"x \\ set (prx@[node])\"\n with repbchildren_eq_no1_no \n show \"repNodes_eq x no1 low high repb = \n repNodes_eq x no low high repb\"\n by (simp add: repNodes_eq_def)\n qed\n then show ?thesis\n by (rule P_eq_list_filter)\n qed\n with repb_no1_def repb_no_def show \" repb no = repb no1\"\n by simp\n next\n assume repb_no_no1_eq: \"repb no = repb no1\"\n from no1_nln repb_node repb_no_def have repb_no1_def: \n \"repb no1 = \n hd [sn\\(prx@node#sfx). repNodes_eq sn node low high repa]\"\n by auto\n with no1_nln repb_no_def repb_no_no1_eq \n have repb_Sucn_repa_nl_hd: \" hd [sn\\(prx@[node]). \n repNodes_eq sn no low high repb] = \n hd [sn\\(prx@node#sfx). repNodes_eq sn no1 low high repa]\"\n by simp\n from filter_take_Sucn_not_empty \n have \" hd [sn\\(prx@[node]). repNodes_eq sn no low high repb] \n = hd [sn\\(prx@node#sfx) . repNodes_eq sn no low high repb]\"\n apply -\n apply (rule hd_filter_app [symmetric])\n apply auto\n done\n then have hd_Sucn_hd_whole_list: \n \"hd [sn\\(prx@[node]) . \n repNodes_eq sn no low high repb] = \n hd [sn\\ (prx@node#sfx). repNodes_eq sn no low high repb]\"\n by simp\n have hd_nl_repb_repa: \n \"[sn\\ (prx@node#sfx). repNodes_eq sn no low high repb] \n = [sn\\(prx@node#sfx). repNodes_eq sn no low high repa]\"\n proof -\n have \"\\x \\ set (prx@node#sfx). \n repNodes_eq x no low high repb = \n repNodes_eq x no low high repa\"\n proof (intro ballI)\n fix x\n assume x_in_nl: \"x \\ set (prx@node#sfx)\"\n from all_nodes_in_nl_nLeafs x_in_nl \n have x_nLeaf: \"\\ isLeaf_pt x low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF x_in_nl]\n have x_props: \"(low x = Null) = (high x = Null) \\ \n low x \\ set (prx@node#sfx) \\ high x \\ set (prx@node#sfx)\"\n by auto\n with x_nLeaf lno_nNull hno_nNull lno_notin_nl hno_notin_nl \n nodes_notin_nl_neq_nln repa_repb_nc \n show \"repNodes_eq x no low high repb = \n repNodes_eq x no low high repa\"\n using [[simp_depth_limit=1]]\n by (simp add: repNodes_eq_def isLeaf_pt_def null_comp_def)\n qed\n then show ?thesis\n by (rule P_eq_list_filter)\n qed\n with repb_Sucn_repa_nl_hd hd_Sucn_hd_whole_list \n have filter_nl_no_no1: \n \"hd [sn\\(prx@node#sfx). repNodes_eq sn no low high repa] \n = hd [sn\\(prx@node#sfx). repNodes_eq sn no1 low high repa]\"\n by simp\n from no_in_nl have filter_no_not_empty: \n \"[sn\\(prx@node#sfx). repNodes_eq sn no low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n from no1_in_nl have filter_no1_not_empty: \n \"[sn\\(prx@node#sfx). repNodes_eq sn no1 low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n from repb_no_def hd_Sucn_hd_whole_list hd_nl_repb_repa \n have \"repb no =\n hd [sn\\(prx@node#sfx). repNodes_eq sn no low high repa]\" \n by simp\n with hd_filter_prop [OF filter_no_not_empty ]\n have repNodes_no_repa: \"repNodes_eq (repb no) no low high repa\"\n by auto\n from repb_no1_def no1_nln \n have \n \"repb no1 = hd [sn\\(prx@node#sfx). repNodes_eq sn no1 \n low high repa]\"\n by simp\n with hd_filter_prop [OF filter_no1_not_empty ]\n have \"repNodes_eq (repb no1) no1 low high repa\"\n by auto\n with filter_nl_no_no1 repNodes_no_repa repb_no_no1_eq \n have \"(repa \\ high) no1 = \n (repa \\ high) no \\ (repa \\ low) no1 = (repa \\ low) no\"\n by (simp add: repNodes_eq_def)\n with hno_nNull no1_props no1_nLeaf lno_nNull lno_notin_nl \n hno_notin_nl nodes_notin_nl_neq_nln repa_repb_nc\n show \"(repb \\ high) no1 = \n (repb \\ high) no \\ (repb \\ low) no1 = (repb \\ low) no\"\n using [[simp_depth_limit=1]]\n by (auto simp add: isLeaf_pt_def null_comp_def)\n qed\n qed\n qed\n with repb_repb_no repb_no_share_def share_case_repb no_in_take_Sucn \n show ?thesis\n using [[simp_depth_limit=1]]\n by auto\n qed\n qed\n with repb_no_nNull show ?thesis\n by simp\n next\n assume no_nln: \"no = node\"\n with repb_node have repb_no_def: \n \"repb no = hd [sn\\(prx@node#sfx). repNodes_eq sn no low high repa]\"\n by simp\n from no_nln have \"no \\ set (prx@node#sfx)\"\n by auto\n then have filter_nl_repa_not_empty: \n \"[sn\\(prx@node#sfx). repNodes_eq sn no low high repa] \\ []\"\n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then have hd_filter_nl_in_nl: \n \"hd [sn\\(prx@node#sfx). repNodes_eq sn no low high repa] \\ set (prx@node#sfx)\"\n by (rule hd_filter_in_list)\n with repb_no_def \n have repb_no_in_nodeslist: \"repb no \\ set (prx@node#sfx)\"\n by simp\n from nodes_balanced_ordered [rule_format,OF this]\n have repb_no_nNull: \"repb no \\ Null\"\n by auto\n from share_cond no_nln have share_cond_or: \n \"isLeaf_pt no low high \\ repa (low no) \\ repa (high no)\"\n by auto\n have share_reduce_if: \" (if (repb \\ low) no = (repb \\ high) no \\ low no \\ Null \n then repb no = (repb \\ low) no\n else repb no = hd [sn\\(prx@[node]). repNodes_eq sn no low high repb] \\\n repb (repb no) = repb no \n \\ (\\no1\\set (prx@[node]). ((repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1)))\"\n proof (cases \"isLeaf_pt no low high\")\n case True\n note isLeaf_no=this\n then have lno_Null: \"low no = Null\" by (simp add: isLeaf_pt_def)\n from isLeaf_no no_in_take_Sucn repb_no_share_def \n have repb_no_repb_def: \"repb no \n = hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n by (auto simp add: isLeaf_pt_def)\n from isLeaf_no nodes_balanced_ordered [rule_format, OF no_in_nl]\n have var_no: \"var no \\ 1\" \n by auto\n have all_nodes_nl_var_l_1: \"\\x \\ set (prx@node#sfx). var x \\ 1\"\n proof (intro ballI)\n fix x\n assume x_in_nl: \" x \\ set (prx@node#sfx)\"\n from all_nodes_same_var [rule_format, OF x_in_nl no_in_nl] var_no \n show \" var x \\ 1\"\n by auto\n qed \n have all_nodes_nl_Leafs: \"\\x \\ set (prx@node#sfx). isLeaf_pt x low high\" \n proof (intro ballI)\n fix x\n assume x_in_nl: \" x \\ set (prx@node#sfx)\"\n with all_nodes_nl_var_l_1 have \"var x \\ 1\"\n by auto\n with nodes_balanced_ordered [rule_format, OF x_in_nl ]\n show \"isLeaf_pt x low high\"\n by auto\n qed \n have repb_repb_no: \"repb (repb no) = repb no\"\n proof -\n from repb_no_share_def no_in_take_Sucn lno_Null \n have repb_no_def: \" repb no = \n hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n by auto\n with hd_filter_Sucn_in_Sucn \n have repb_no_in_take_Sucn: \"repb no \\ set (prx@[node])\"\n by simp\n hence repb_no_in_nl: \"repb no \\ set (prx@[node])\"\n by auto\n with all_nodes_nl_Leafs \n have repb_no_Leaf: \"isLeaf_pt (repb no) low high\" \n by auto\n with repb_no_in_take_Sucn repb_no_share_def \n have repb_repb_no_def: \"repb (repb no) = \n hd [sn\\(prx@[node]). repNodes_eq sn (repb no) low high repb] \"\n by (auto simp add: isLeaf_pt_def)\n from filter_take_Sucn_not_empty \n show ?thesis\n apply (simp only: repb_repb_no_def )\n apply (simp only: repb_no_def)\n apply (rule filter_hd_P_rep_indep)\n apply (auto simp add: repNodes_eq_def)\n done\n qed\n have two_nodes_repb: \"(\\no1\\set (prx@[node]). \n ((repb \\ high) no1 = (repb \\ high) no \\ \n (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1))\"\n proof (intro ballI)\n fix no1 \n assume no1_in_take_Sucn: \"no1 \\ set (prx@[node])\"\n from no1_in_take_Sucn \n have \"no1 \\ set (prx@node#sfx)\"\n by auto\n with all_nodes_nl_Leafs \n have isLeaf_no1: \"isLeaf_pt no1 low high\"\n by auto\n with repb_no_share_def no1_in_take_Sucn \n have repb_no1_def: \"repb no1 = \n hd [sn\\(prx@[node]). repNodes_eq sn no1 low high repb]\" \n by (auto simp add: isLeaf_pt_def)\n show \"((repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1)\"\n proof \n assume repbchildren_eq_no1_no: \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n have \"[sn\\(prx@[node]). repNodes_eq sn no1 low high repb] \n = [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n proof -\n have \"\\x \\ set (prx@[node]). \n repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n proof (intro ballI)\n fix x\n assume x_in_take_Sucn: \" x \\ set (prx@[node])\"\n with repbchildren_eq_no1_no \n show \" repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n by (simp add: repNodes_eq_def)\n qed\n then show ?thesis\n by (rule P_eq_list_filter)\n qed\n with repb_no1_def repb_no_repb_def \n show \"repb no = repb no1\"\n by simp\n next\n assume repb_no_no1: \"repb no = repb no1\"\n with isLeaf_no isLeaf_no1 \n show \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n by (simp add: null_comp_def isLeaf_pt_def)\n qed\n qed\n with repb_repb_no lno_Null no_in_take_Sucn repb_no_share_def show ?thesis\n by auto\n next\n assume no_nLeaf: \"\\ isLeaf_pt no low high\"\n with balanced_no obtain \n lno_nNull: \"low no \\ Null\" and \n hno_nNull: \"high no \\ Null\"\n by (simp add: isLeaf_pt_def)\n from no_nLeaf nodes_balanced_ordered [rule_format, OF no_in_nl]\n have var_no: \"1 < var no\" \n by auto\n have all_nodes_nl_var_l_1: \"\\x \\ set (prx@node#sfx). 1 < var x\"\n proof (intro ballI)\n fix x\n assume x_in_nl: \" x \\ set (prx@node#sfx)\"\n with all_nodes_same_var [rule_format, OF x_in_nl no_in_nl] var_no \n show \"1 < var x\"\n by simp\n qed \n have all_nodes_nl_nLeafs: \"\\ x \\ set (prx@node#sfx). \\ isLeaf_pt x low high\" \n proof (intro ballI)\n fix x\n assume x_in_nl: \" x \\ set (prx@node#sfx)\"\n with all_nodes_nl_var_l_1 have \"1 < var x\"\n by auto\n with nodes_balanced_ordered [rule_format, OF x_in_nl] show \" \\ isLeaf_pt x low high\"\n by auto\n qed \n from no_nLeaf share_cond_or \n have repachildren_neq_no: \"repa (low no) \\ repa (high no)\"\n by auto\n with lno_nNull hno_nNull \n have \"(repa \\ low) no \\ (repa \\ high) no\"\n by (simp add: null_comp_def)\n with repa_repb_nc lno_notin_nl hno_notin_nl \n nodes_notin_nl_neq_nln lno_nNull hno_nNull \n have repbchildren_neq_no: \"(repb \\ low) no \\ (repb \\ high) no\"\n using [[simp_depth_limit=1]]\n by (auto simp add: null_comp_def)\n have repb_repb_no: \"repb (repb no) = repb no\"\n proof -\n from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n have repb_no_def: \"repb no = \n hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n by auto\n from filter_take_Sucn_not_empty \n have \"repNodes_eq (repb no) no low high repb\"\n apply (simp only: repb_no_def)\n apply (rule hd_filter_prop)\n apply simp\n done\n with repbchildren_neq_no \n have repbchildren_neq_repb_no: \"(repb \\ low) (repb no) \\ (repb \\ high) (repb no)\"\n by (simp add: repNodes_eq_def)\n from filter_take_Sucn_not_empty \n have \"repb no \\ set (prx@[node])\"\n apply (simp only: repb_no_def )\n apply (rule hd_filter_in_list)\n apply simp\n done\n with repbchildren_neq_repb_no repb_no_share_def \n have repb_repb_no_def: \" repb (repb no) = \n hd [sn\\(prx@[node]) . repNodes_eq sn (repb no) low high repb] \"\n by auto\n from filter_take_Sucn_not_empty show ?thesis\n apply (simp only: repb_repb_no_def )\n apply (simp only: repb_no_def)\n apply (rule filter_hd_P_rep_indep)\n apply (auto simp add: repNodes_eq_def)\n done\n qed\n have two_nodes_repb: \"(\\no1\\set (prx@[node]). \n ((repb \\ high) no1 = (repb \\ high) no \\ \n (repb \\ low) no1 = (repb \\ low) no) = (repb no = repb no1))\"\n (is \"(\\no1\\set (prx@[node]). ?P no1)\")\n proof (intro ballI)\n fix no1\n assume no1_in_take_Sucn: \" no1 \\ set (prx@[node])\"\n hence no1_in_nodeslist: \"no1 \\ set (prx@node#sfx)\"\n by auto\n with all_nodes_nl_nLeafs \n have no1_nLeaf: \"\\ isLeaf_pt no1 low high\"\n by auto\n show \"?P no1\"\n proof\n assume repbchildren_eq_no1_no: \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n with repbchildren_neq_no have \"(repb \\ high) no1 \\ (repb \\ low) no1\"\n by auto\n with no1_in_take_Sucn repb_no_share_def have repb_no1_def: \"repb no1 = \n hd [sn\\(prx@[node]). repNodes_eq sn no1 low high repb]\"\n by auto\n from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n have repb_no_def: \"repb no = \n hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n by auto\n have \"[sn\\(prx@[node]). repNodes_eq sn no1 low high repb] = \n [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n proof -\n have \"\\ x \\ set (prx@[node]). \n repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n proof (intro ballI)\n fix x\n assume x_in_take_Sucn: \" x \\ set (prx@[node])\"\n with repbchildren_eq_no1_no \n show \" repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n by (simp add: repNodes_eq_def)\n qed\n then show ?thesis\n by (rule P_eq_list_filter)\n qed\n with repb_no_def repb_no1_def show \" repb no = repb no1\"\n by simp\n next\n assume repb_no_no1: \"repb no = repb no1\"\n from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n have repb_no_def: \"repb no = \n hd [sn\\(prx@[node]). repNodes_eq sn no low high repb]\"\n by auto\n from filter_take_Sucn_not_empty \n have \"repb no \\ set (prx@[node])\"\n apply (simp only: repb_no_def)\n apply (rule hd_filter_in_list)\n apply simp\n done\n then have repb_no_in_nl: \"repb no \\ set (prx@node#sfx)\"\n by auto\n from filter_take_Sucn_not_empty \n have repNodes_repb_no: \"repNodes_eq (repb no) no low high repb\"\n apply (simp only: repb_no_def)\n apply (rule hd_filter_prop)\n apply simp\n done\n show \"(repb \\ high) no1 = (repb \\ high) no \n \\ (repb \\ low) no1 = (repb \\ low) no\"\n proof (cases \"(repb \\ low) no1 = (repb \\ high) no1\")\n case True\n note red_cond=this\n from no1_in_nodeslist all_nodes_nl_nLeafs\n have no1_nLeaf: \"\\ isLeaf_pt no1 low high\"\n by auto\n from nodes_balanced_ordered [rule_format, OF no1_in_nodeslist]\n have no1_props: \"(low no1 \\ set (prx@node#sfx)) \n \\ (high no1 \\ set (prx@node#sfx)) \\(low no1 = Null) = (high no1 = Null) \n \\ ((rep \\ low) no1 \\ set (prx@node#sfx))\"\n by auto\n with red_cond no1_nLeaf no1_in_take_Sucn repb_no_red_def \n have repb_no1_def: \"repb no1 = (repb \\ low) no1\"\n by (auto simp add: isLeaf_pt_def)\n with no1_nLeaf no1_props have \"repb no1 = repb (low no1)\"\n by (simp add: null_comp_def isLeaf_pt_def)\n from no1_props no1_nLeaf have \"rep (low no1) \\ set (prx@node#sfx)\"\n by (auto simp add: isLeaf_pt_def null_comp_def)\n with rep_repb_nc no1_props \n have \"repb (low no1) \\ set (prx@node#sfx)\"\n by auto\n with repb_no1_def repb_no_no1 no1_props no1_nLeaf \n have \"repb no \\ set (prx@node#sfx)\"\n by (simp add: isLeaf_pt_def null_comp_def)\n with repb_no_in_nl show ?thesis\n by simp\n next\n assume \"(repb \\ low) no1 \\ (repb \\ high) no1\"\n with repb_no_share_def no1_in_take_Sucn \n have repb_no1_def: \" repb no1 = \n hd [sn\\(prx@[node]). repNodes_eq sn no1 low high repb]\"\n by auto\n from no1_in_take_Sucn \n have \"[sn\\(prx@[node]). repNodes_eq sn no1 low high repb] \\ []\" \n apply -\n apply (rule filter_not_empty)\n apply (auto simp add: repNodes_eq_def)\n done\n then \n have repNodes_repb_no1: \"repNodes_eq (repb no1) no1 low high repb\"\n apply (simp only: repb_no1_def ) \n apply (rule hd_filter_prop)\n apply simp\n done\n with repNodes_repb_no repb_no_no1 \n have \"repNodes_eq no1 no low high repb\"\n by (simp add: repNodes_eq_def)\n then show ?thesis\n by (simp add: repNodes_eq_def)\n qed\n qed\n qed\n with repb_repb_no repb_no_share_def no_in_take_Sucn repbchildren_neq_no\n show ?thesis\n using [[simp_depth_limit=2]]\n by fastforce\n qed\n with repb_no_nNull show ?thesis\n by simp\n qed\n qed\n with rep_repb_nc show ?thesis\n by (intro conjI)\n qed\nqed\n\nend\n\n\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BDD/ShareReduceRepListProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2902211242444727}} {"text": "theory RingBuffer_BD_latest_2\nimports Main HOL.List\nbegin \n\n\n(*\n W_step_side R_step_side\n\nLOCAL preserves inv (2) LOCAL preserves inv (1) \n\nLOCAL shows preW (done) LOCAL shows preR (done) \n\nGLOBAL preserves preR (done) GLOBAL preserves preW (done) \n*)\n\n\ndatatype PCW =\n A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8\n| Enqueue | idleW | OOM | FinishedW | Write | BTS\n\ndatatype PCR =\n Release | idleR | Read\n\ndatatype F = W | R | Q | B | D | None\ndatatype Pointer = Head | Tail\nconsts N :: nat (*size of buffer, input*)\nconsts n :: nat (*number of Arr\\<^sub>W entries*)\n\ndefinition \"F1_set={W,B,Q,R}\"\ndefinition \"W_pre_acquire_set={A1,A2,A3,A4,A5,A6,A7,A8,idleW,FinishedW,OOM,BTS}\"\ndefinition \"W_post_acquire_set={Write,Enqueue}\"\ndefinition \"R_pre_dequeue_set={idleR}\"\ndefinition \"R_post_dequeue_set={Read, Release}\"\n\nlemmas sets [simp]= F1_set_def W_pre_acquire_set_def W_post_acquire_set_def\n R_pre_dequeue_set_def R_post_dequeue_set_def\n\n(*Recorded variables*)\nrecord rb_state =\n H :: nat\n T :: nat\n hW :: nat (*local copy of W*)\n tW :: nat (*local copy of W*)\n offset :: nat\n q :: \"(nat \\ nat) list\"\n tempR :: \"(nat \\ nat)\" (*local copy of word by R*)\n\n\n data_index :: \"(nat \\ nat) \\ nat\" (*state of the buffer contents*)\n pcW :: PCW (*records program counter of W*)\n pcR :: PCR (*records program counter of W*)\n Data:: \"nat \\ nat\" (*returns a word Data_i*)\n\n tR :: nat\n numReads :: nat (* how many words the reader has read *)\n numWrites :: nat (* how many words the writer has written *)\n numEnqs :: nat (* how many words from Data the writer has enqueued *)\n numDeqs :: nat (* how many words from Data the reader has retrieved *)\n ownT :: F\n ownD :: \"nat \\ F\" (* ownership of Data indices *)\n ownB :: \"nat \\ F\" (* ownership of bytes in buffer *)\n\n \n\ndefinition \"con_assms s \\ 0 < N \\ 0 N>n \\ numEnqs s\\n \\ (numDeqs s\\numEnqs s)\n \\ (\\i.(iData s i\\N \\ Data s i>0 )\"\n\ndefinition push_H :: \"nat \\ rb_state \\ rb_state\" (\"`H := _\" [200])\n where \n \"push_H v \\ \\s. s \\H := v\\\"\ndefinition push_T :: \"nat \\ rb_state \\ rb_state\" (\"`T := _\" [200])\n where \n \"push_T v \\ \\s. s \\T := v\\\"\ndefinition write_data_index :: \"nat \\ nat \\ nat \\ rb_state \\ rb_state\" (\"`B.write _ := _\" [200]) where\n \"write_data_index a v \\ \n \\s. s \\ data_index := \\ x. if a = x then v else data_index s x \\\" \ndefinition change_writes :: \"nat \\ rb_state \\ rb_state\" (\"`numWrites := _\" [200])\n where \n \"change_writes v \\ \\s. s \\numWrites := v\\\"\ndefinition change_reads :: \"nat \\ rb_state \\ rb_state\" (\"`numReads := _\" [200])\n where \n \"change_reads v \\ \\s. s \\numReads := v\\\"\ndefinition push_offset :: \"nat \\ rb_state \\ rb_state\" (\"`offset := _\" [200])\n where \n \"push_offset v \\ \\s. s \\offset := v\\\"\n\n\ndefinition trans_ownT :: \"F \\ F \\ rb_state \\ rb_state \\ rb_state\" (\"transownT [_ _ _]\" [200]) where\n \"trans_ownT a b s \\ if ownT s = a then (\\s. s \\ ownT := b \\)\n else (\\s. s \\ ownT := ownT s\\)\"\n\ndefinition transfer_ownB :: \"F \\ F \\ rb_state \\ rb_state\" (\"transownB [_ _]\" [200]) where\n \"transfer_ownB a b \\ (\\s. s \\ ownB := \\ i. if (ownB s i = a)\\i\\N then b else (ownB s) i\\)\"\n\ndefinition set_ownB :: \"nat\\nat\\ F \\ rb_state \\ rb_state\" (\"setownB [_ _]\" [200]) where\n \"set_ownB x a \\ (\\s. s \\ ownB := \\ i. if ((i\\fst(x)) \\ (i)\"\n\ndefinition transfer_ownD :: \"nat\\ F \\ rb_state \\ rb_state\" (\"transownD [_ _]\" [200]) where\n \"transfer_ownD x a \\ (\\s. s \\ ownD := \\ i. if i=x then a else (ownD s) i\\)\"\n\n\n\n\n(*-----------------------*)\n\ndefinition set_hW :: \"nat \\ rb_state \\ rb_state\" (\"`hW := _\" [200]) where\n \"set_hW v \\ \\s. s \\ hW := v\\\"\ndefinition set_tW :: \"nat \\ rb_state \\ rb_state\" (\"`tW := _\" [200]) where\n \"set_tW v \\ \\s. s \\ tW := v\\\"\ndefinition set_tR :: \"nat \\ rb_state \\ rb_state\" (\"`tR := _\" [200]) where\n \"set_tR v \\ \\s. s \\ tR := v\\\"\ndefinition set_tempR :: \"(nat \\ nat) \\ rb_state \\ rb_state\" (\"`tempR := _\" [200]) where\n \"set_tempR v \\ \\s. s \\ tempR := v\\\"\ndefinition update_numEnqs :: \"nat \\ rb_state \\ rb_state\" (\"`numEnqs := _\" [200]) where\n \"update_numEnqs v\\ \\s. s \\ numEnqs := v\\\"\ndefinition update_numDeqs :: \"nat \\ rb_state \\ rb_state\" (\"`numDeqs := _\" [200]) where\n \"update_numDeqs v\\ \\s. s \\ numDeqs := v\\\"\ndefinition update_pcW :: \"PCW \\ rb_state \\ rb_state\" (\"`pcW := _\" [200]) where\n \"update_pcW v \\ \\s. s \\ pcW := v\\\"\ndefinition update_pcR :: \"PCR \\ rb_state \\ rb_state\" (\"`pcR := _\" [200]) where\n \"update_pcR v \\ \\s. s \\ pcR := v\\\"\nabbreviation update_b_err :: \"rb_state \\ rb_state\" (\"ERROOM\") where\n \"update_b_err \\ \\s. s \\ pcW := OOM \\\"\nabbreviation update_bts_err :: \"rb_state \\ rb_state\" (\"ERRBTS\") where\n \"update_bts_err \\ \\s. s \\ pcW := BTS \\\"\ndefinition update_q :: \"(nat \\ nat) list \\ rb_state \\ rb_state\" (\"`q := _\" [200])\n where \n \"update_q v \\ \\s. s \\q := v\\\"\nlemmas functs [simp] = push_H_def push_T_def set_hW_def set_tW_def\n update_numEnqs_def update_numDeqs_def\n set_tempR_def \n update_pcW_def update_pcR_def\n transfer_ownB_def transfer_ownD_def trans_ownT_def\n update_q_def\n push_offset_def write_data_index_def\n change_writes_def change_reads_def\n set_tR_def set_ownB_def\n\n\n\n\n\n(* Define the if statement \"guards\" *)\n\ndefinition \"off bo \\ fst bo\"\ndefinition \"len bo \\ snd bo\"\ndefinition \"grd1 s \\ (tW s = hW s) \\ (Data s (numEnqs s) \\ N)\"\ndefinition \"grd2 s \\ (tW s > hW s) \\ (Data s (numEnqs s) < (tW s - hW s))\"\ndefinition \"grd3 s \\ tW s < hW s\"\ndefinition \"grd4 s \\ Data s (numEnqs s) \\ N - hW s\"\ndefinition \"grd5 s \\ Data s (numEnqs s) < tW s\"\ndefinition \"no_space_for_word s \\ (grd1 s \\ \\(Data s (numEnqs s) \\ N))\\\n (grd2 s \\ \\(Data s (numEnqs s) < (tW s - hW s)))\\\n (grd3 s \\ \\(Data s (numEnqs s) \\ N - hW s \\ Data s (numEnqs s) < tW s))\"\nlemmas grd_simps [simp] = off_def len_def grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def \n(***********************************************************************)\n\n\n\n\n\n(* Initial State *)\n\ndefinition \"init s \\ (H s = 0) \\ (T s = 0) \\ (offset s = 0) \\ q s = [] \\ (hW s = 0) \\ (tW s = 0) \\ (tR s = 0)\n \\ numReads s = 0 \\ numWrites s = 0 \\ (numEnqs s = 0) \\ (numDeqs s = 0)\n \\ ( pcW s = idleW)\n \\ ( pcR s = idleR)\n \\ (\\l. (l ((Data s l > 0)\\(Data s l \\ N)))\n \\ (\\i. (i ownD s i = W)\n \\ (\\i. (i ownB s i = B)\n \\ (ownB s N = None)\n \\ (ownT s = Q)\n \\ (tempR s = (0,0))\n \\ (\\i. (i\\N)\\(\\j.(j\\N)\\data_index s (i,j) \\a b c d. (0\\a \\ a\\b \\ b\\c \\ c\\d \\ d\\N \n \\(\\i.(0\\i \\ iownB s i = B)\n \\(\\i.(a\\i \\ iownB s i = R)\n \\(\\i.(b\\i \\ iownB s i = Q)\n \\(\\i.(c\\i \\ iownB s i = W)\n \\(\\i.(d\\i \\ iownB s i = B)\n \\(ownB s N = None)\n \\\\general case rules\\\n \\\\rules are simple\\\n \\\\describe T using ownB\\\n \\(T s = a)\n \\\\describe H using ownB\\\n \\(H s = d)\n \\\\describe W view (tempW) using ownB\\\n \\(d>c\\offset s=c)\n \\(d>c\\Data s (numEnqs s)=d-c)\n \\\\describe R view (tempR) using ownB\\\n \\(b>a\\fst(tempR s)=a)\n \\(b>a\\snd(tempR s)=b-a)\n \\\\describe Q view (hd(Q), last(Q)) using ownB\\\n \\(length(q s)\\c-b)\n \\(c>b\\length(q s)>0)\n \\(c>b\\fst(hd(q s)) =b)\n \\(c>b\\fst(last(q s))+snd(last(q s)) =c)\n \\\\describe ownT using ownB\\\n \\(ownT s = R\\b>a)\n \\((b=a\\c>b)\\ownT s = Q)\n \\((b=a\\c=b)\\ownT s \\ {Q,W})\n \\ (ownT s=W\\((c=0\\d>0)\\(H s=T s)))\n)\"\n\n\nlemma can_a_equal_d:\n assumes \"\\i.(iownB s i=B\"\n and \"ownT s=Q\"\n and \"H s=k\"\n and \"T s=k\"\n and \"kN*)\n and \"q s=[]\"\n and \"ownB s N=None\"\n shows \"case_1 s\"\n using assms apply (simp add:case_1_def)\n apply (rule_tac exI [where x =\"k\"])\n apply (rule_tac exI [where x =\"k\"])\n apply simp\n apply (rule_tac exI [where x =\"k\"])\n by simp\n\n\n\ndefinition \"case_2 s \\ \\a b c d e f. (0\\a \\ a\\b \\ b\\c \\ c d\\e \\ e\\f \\ f\\N\n \\(\\i.(0\\i \\ iownB s i = R)\n \\(\\i.(a\\i \\ iownB s i = Q)\n \\(\\i.(b\\i \\ iownB s i = W)\n \\(\\i.(c\\i \\ iownB s i = B)\n \\(\\i.(d\\i \\ iownB s i = R)\n \\(\\i.(e\\i \\ iownB s i = Q)\n \\(\\i.(f\\i \\ iownB s i = D)\n \\(ownB s N = None)\n \\\\general case rules\\\n \\(a>0\\e=d) \\\\only 1 continuous read\\ \n \\(e>d\\a=0) \\\\only 1 continuous read\\ \n \\(f>e\\a=0) \\\\only 1 continuous queue\\ \n \\(c>0) \\\\create the overlap, any way possible\\ \n \\\\describe T using ownB\\\n \\(T s = d)\n \\\\describe H using ownB\\\n \\(H s = c)\n \\\\describe W view (tempW) using ownB\\\n \\(c>b\\offset s = b)\n \\(c>b\\Data s (numEnqs s) = c-b)\n \\\\describe R view (tempR) using ownB\\\n \\(a>0\\fst(tempR s)=0) \n \\(a>0\\snd(tempR s)=a) \n \\(e>d\\fst(tempR s)=d) \n \\(e>d\\snd(tempR s)=e-d) \n \\\\describe Q view (hd(Q), last(Q)) using ownB\\\n \\(length(q s)\\(f-e+b-a))\n \\((f>e\\b>a)\\length(q s)>0)\n \\(f>e\\fst(hd(q s)) =e)\n \\((f=e\\b>a)\\fst(hd(q s)) =a)\n \\(b>a\\fst(last(q s))+snd(last(q s)) =b)\n \\((b=a\\f>e)\\fst(last(q s))+snd(last(q s)) =f)\n \\\\describe ownT using ownB\\\n \\(ownT s = R\\(a>0\\e>d))\n \\((a=0\\e=d)\\ownT s = Q)\n \\(ownT s\\W)\n)\"\n\n\n\nlemma natural:\n assumes \"a\\{0,3,4}\"\n shows \"a\\\\\"\n using assms apply simp\n by auto\n\n\n\nlemma case_split:\n shows \"H s\\T s\\ (case_1 s \\ case_2 s) \\ case_1 s\"\n apply (simp add:case_1_def case_2_def) apply clarify\n by linarith\n\n\nlemma case_split_2:\n shows \"H s\\T s\\ (case_1 s \\ case_2 s) \\\\ case_2 s\"\n by (simp add:case_1_def case_2_def) \n\nlemma case_split_3:\n shows \"H s (case_1 s \\ case_2 s) \\ case_2 s\"\n apply (simp add:case_1_def case_2_def) apply clarify\n by linarith\n\n\nlemma case_split_4:\n shows \"H s (case_1 s \\ case_2 s) \\\\ case_1 s\"\n by (simp add:case_1_def case_2_def)\n\n\nlemma case_split_5:\n shows \"(case_1 s \\ case_2 s) \\False\"\n apply (simp add:case_1_def case_2_def) \n apply clarify\n apply (case_tac \"H s\\T s\") \n apply(subgoal_tac \"case_1 s\") prefer 2 \n apply (metis leD)\n apply (metis case_split_4)\n apply(subgoal_tac \"T s>H s\") prefer 2\n apply blast\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply (metis le_trans)\n using case_split_2 [where s=s] \n by (metis le_trans)\n\n\n\n\n(*\ndeclare [[show_types]]\n*)\n\n\n\n\n(* State of the queue *)\n(* What Q should look like *)\n\ndefinition \"end x \\ fst x + snd x\"\n\nlemmas end_simp [simp] = end_def \n\ndefinition \"Q_boundness s \\ (\\x. (x \\ set (q s)) \\ end x \\ N)\" \n\ndefinition \"Q_offsets_differ s \\ (\\i j.(i j i\\j)\\(fst(q s!i)\\fst(q s!j)))\"\n\ndefinition \"Q_gap_structure s \\ \n (\\i. (i < length(q s) \\ i > 0) \\((end(q s!(i-1)) = fst(q s!i))\\ (fst(q s!i) =0)))\"\n\ndefinition \"Q_has_no_uroboros s \\\n(\\x. x \\ set (q s)\\ fst x \\ end (last (q s)))\"\n\ndefinition \"Q_has_no_overlaps s \\\n(\\ x y. (x \\ set (q s) \\ y \\ set (q s)) \\ (fst(x) < fst(y) \\ end x \\ fst y))\"\n\ndefinition \"Q_elem_size s \\ \\x.(x\\set(q s))\\snd(x)>0\"\n\ndefinition \"Q_basic_struct s \\ Q_boundness s \\ Q_gap_structure s \\ Q_offsets_differ s\n \\ Q_has_no_overlaps s \\ Q_has_no_uroboros s \\ Q_elem_size s\"\n\n\nlemmas Q_basic_lemmas = Q_basic_struct_def Q_has_no_overlaps_def \n Q_gap_structure_def Q_has_no_uroboros_def\n Q_boundness_def Q_offsets_differ_def\n Q_elem_size_def\n\nlemma proof_no_overlaps:\n assumes \"Q_gap_structure s\"\n and \"Q_offsets_differ s\"\n and \"\\i.(i snd(q s!i)>0\"\n and \"length(q s)>1\"\n and \"Q_has_no_overlaps s\"\nshows \"\\x y.(x\\set(q s)\\y\\set(q s)\\length(q s)>1\\fst(x)\\fst(y))\\\n (\\j.(fst(x)\\j \\ j(jj\\end(y)))\"\n using assms apply (simp add:Q_basic_lemmas) \n apply safe \n by (smt (verit, best) bot_nat_0.not_eq_extremum diff_is_0_eq le_trans linorder_neqE_nat zero_less_diff)\n\nlemma tail_preserves_Q_boundness:\n assumes \"Q_boundness s\"\n and \"tl(q s)\\[]\"\nshows \"(\\x. (x \\ set (tl(q s))) \\ end x \\ N)\"\n using assms apply (simp add:Q_boundness_def)\n by (simp add: list.set_sel(2) tl_Nil)\n\nlemma tail_preserves_Q_offsets_differ:\n assumes \"Q_offsets_differ s\"\n and \"tl(q s)\\[]\"\nshows \"(\\i j.(i j i\\j)\\(fst((tl(q s))!i)\\fst((tl(q s))!j)))\"\n using assms apply (simp add:Q_offsets_differ_def) \n by (simp add: Nitpick.size_list_simp(2) nth_tl tl_Nil)\n\nlemma tail_preserves_Q_gap_structure:\n assumes \"Q_gap_structure s\"\n and \"tl(q s)\\[]\"\nshows \"(\\i. (i < length(tl(q s)) \\ i > 0) \\((end((tl(q s))!(i-1)) = fst((tl(q s))!i))\\ (fst((tl(q s))!i) =0)))\"\n using assms apply (simp add:Q_gap_structure_def) \n by (smt (verit) One_nat_def Suc_pred add_diff_cancel_left' length_tl less_Suc_eq less_diff_conv not_less_eq nth_tl plus_1_eq_Suc)\n\nlemma tail_preserves_Q_has_no_uroboros:\n assumes \"Q_has_no_uroboros s\"\n and \"tl(q s)\\[]\"\nshows \"(\\x. x \\ set (tl(q s)) \\ fst x \\ end (last (tl(q s))))\"\n using assms apply (simp add:Q_has_no_uroboros_def)\n by (metis last_tl list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_has_no_overlaps:\n assumes \"Q_has_no_overlaps s\"\n and \"tl(q s)\\[]\"\nshows \"(\\ x y. (fst(x) < fst(y) \\ x \\ set (tl(q s)) \\ y \\ set (tl(q s))) \\ (end x \\ fst y))\"\n using assms apply (simp add:Q_has_no_overlaps_def) \n by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_basic_struct:\n assumes \"Q_basic_struct s\"\n and \"tl(q s)\\[]\"\nshows \"(\\x. (x \\ set (tl(q s))) \\ end x \\ N) \\ \n (\\i j.(i j i\\j)\\(fst((tl(q s))!i)\\fst((tl(q s))!j))) \\\n (\\i. (i < length(tl(q s)) \\ i > 0) \\((end((tl(q s))!(i-1)) = fst((tl(q s))!i))\\ (fst((tl(q s))!i) =0)))\\\n (\\x. x \\ set (tl(q s)) \\ fst x \\ end (last (tl(q s)))) \\\n (\\ x y. (fst(x) < fst(y) \\ x \\ set (tl(q s)) \\ y \\ set (tl(q s))) \\ (end x \\ fst y))\"\n using assms apply (simp add:Q_basic_lemmas)\n apply(intro conjI impI)\n apply (metis list.sel(2) list.set_sel(2))\n using tail_preserves_Q_offsets_differ apply (metis One_nat_def Q_basic_struct_def assms(1) length_tl)\n using tail_preserves_Q_gap_structure apply (metis One_nat_def Q_basic_struct_def assms(1) end_simp length_tl)\n using tail_preserves_Q_has_no_uroboros apply (metis Q_basic_struct_def assms(1) end_simp old.prod.inject prod.collapse)\n by (metis list.sel(2) list.set_sel(2))\n\n\n\n\n\n\n\n\n\n\n\n(*\n(*have the idea of \"can fit between T-N or not\"*)\ndefinition \"T_is_outside_Q s \\ (\\i.(i q s\\[])\\(end(q s!i) ((fst(tempR s) =0) \\ (T s=0 \\ T_is_outside_Q s))\n \\((fst(tempR s) >0) \\ (T s=fst(tempR s)))\"\n\ndefinition \"Q_describes_T s \\ ((fst(hd(q s)) =0) \\ (T s=0 \\ T_is_outside_Q s))\n \\((fst(hd(q s)) >0) \\ (T s=fst(hd(q s))))\"\n*)\n\n\n(*have the idea of \"can we describe ownB s i=R\"*)\n(*\ndefinition \"R_owns_no_bytes s \\ (\\i.(i\\0)\\ownB s i\\R)\"\n\ndefinition \"tempR_describes_ownB s \\ (\\i.(iownB s i\\R)\n \\(\\i.(i\\end(tempR s))\\ownB s i\\R)\n \\(\\i.(fst(tempR s)\\i \\ iownB s i=R)\"\n*)\n\n\n\n\n\n\ndefinition \"tempR_bounded s \\ end(tempR s)\\N\"\ndefinition \"Q_no_overlap_tempR s\\ (\\x. (x \\ set (q s))\\\n ((fst(tempR s)end(tempR s)\\ fst(x))\n \\(fst(x)end(x) (end(tempR s) = fst(hd (q s))) \\ (fst(hd(q s)) = 0)\"\nlemmas tmepR_extra_lemmas [simp] = tempR_bounded_def Q_no_overlap_tempR_def Q_relates_tempR_def\n\n\n(* Relating Q to other variables *)\n(*\ndefinition \"Q_bytes s \\ {i . \\ k l. (k, l) \\ set(q s) \\ k \\ i \\ i < k+l}\"\n\ndefinition \"Q_bytes_inv s \\ \\ i. i \\ Q_bytes s \\ ownB s i = Q\"\n\n*)\n\n\n\n \n\n\n\n\ndefinition \"Q_holds_bytes s \\ q s\\[]\\(\\i.(i\\set(q s))\\(\\j.(fst(i)\\j \\ jownB s j=Q))\"\n\ndefinition \"Q_reflects_writes s \\ (\\i.(idata_index s (q s!i) = ((numDeqs s) +i))\"\n\ndefinition \"Q_elem_rel s \\ (\\i.(isnd(q s!i) =Data s ((numDeqs s) +i))\"\n\ndefinition \"Q_reflects_ownD s \\ (\\i.(iownD s (i+(numDeqs s)) =B)\"\n\n\n\n\n\nlemma tail_preserves_Q_holds_bytes:\n assumes \"Q_holds_bytes s\"\n and \"(tl(q s))\\[]\"\nshows \"(tl(q s))\\[]\\(\\i.(i\\set(tl(q s)))\\(\\j.(fst(i)\\j \\ jownB s j=Q))\"\n using assms apply (simp add:Q_holds_bytes_def)\n by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_reflects_writes:\n assumes \"Q_reflects_writes s\"\n and \"(tl(q s))\\[]\"\nshows \"(\\i.(idata_index s ((tl(q s))!i) = ((numDeqs s) +i +1))\"\n using assms apply (simp add:Q_reflects_writes_def)\n by (simp add: nth_tl)\n\nlemma tail_preserves_Q_elem_size:\n assumes \"Q_elem_rel s\"\n and \"(tl(q s))\\[]\"\nshows \"(\\i.(isnd((tl(q s))!i) =Data s ((numDeqs s) +i +1))\"\n using assms apply (simp add:Q_elem_size_def)\n by (simp add: Q_elem_rel_def nth_tl)\n\nlemma tail_preserves_Q_reflects_ownD:\n assumes \"Q_reflects_ownD s\"\n and \"(tl(q s))\\[]\"\nshows \"(\\i.(iownD s (i+(numDeqs s) +1) =B)\"\n using assms apply (simp add:Q_reflects_ownD_def) \n by (metis One_nat_def Suc_eq_plus1 add.assoc less_diff_conv plus_1_eq_Suc)\n\nlemma Q_offsets_imply_tail_offsets:\n assumes \"Q_offsets_differ s\"\n shows \"(\\i j.(i j i\\j)\\(fst(tl(q s)!i)\\fst(tl(q s)!j)))\"\n using assms apply (simp add:Q_offsets_differ_def)\n by (metis (no_types, lifting) Nat.lessE One_nat_def Suc_pred length_tl less_Suc_eq_0_disj nth_tl old.nat.inject zero_less_diff)\n\nlemma Q_head_relates_tail:\n assumes \"Q_offsets_differ s\"\n shows \"\\i.(ifst(q s!0)\\ fst(tl(q s)!i)\"\n using assms apply (simp add:Q_offsets_differ_def)\n by (metis One_nat_def Suc_pred length_tl less_Suc_eq_0_disj not_less_eq nth_tl zero_less_diff)\n\nlemma Exists_one_implies_exist_no_more:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\nshows \"if \\j.(fst(q s!j) =0 \\ jj.(\\i.(i i\\j \\ i>0)\\(end(q s!(i-1)) =fst(q s!i))))\n else (\\i.(i>0 \\ iend(q s!(i-1)) = fst(q s!i))\"\n using assms apply (simp add:Q_basic_lemmas)\n apply (case_tac \"\\j.(fst(q s!j) =0 \\ ji.(i>0 \\ iend(q s!(i-1)) =fst(q s!i)\"\n using assms apply(simp add:Q_basic_lemmas)\n by (metis drop0 hd_drop_conv_nth less_Suc_eq_0_disj less_imp_Suc_add not_gr_zero)\n\nlemma data_index_preserved_lemma:\n assumes \"Q_reflects_writes s\"\n and \"length(q s)>0\"\n shows \"data_index s(q s!0) = numDeqs s\"\n using assms by (simp add:Q_reflects_writes_def)\n\n\ndefinition \"Q_structure s \\q s\\[]\\(Q_basic_struct s \\ \n \\ \\Q_holds_bytes s \\\\\n Q_reflects_writes s \\ \n Q_elem_rel s \\ \n Q_reflects_ownD s)\"\n\n\n \nlemmas Q_lemmas = Q_holds_bytes_def Q_reflects_writes_def Q_reflects_ownD_def\n Q_structure_def Q_relates_tempR_def Q_elem_rel_def\n Q_elem_size_def Q_no_overlap_tempR_def\n\n\n\nlemma head_q0:\n assumes \"length(q s)>0\"\n shows \"hd(q s) = (q s!0)\"\n using assms apply (simp add:Q_reflects_writes_def)\n by (simp add: hd_conv_nth)\n\nlemma overlap:\n assumes \"Q_structure s \\ length(q s)>1\"\n shows \"\\k.(\\i j.(i j i\\j)\\(k\\fst(q s!i)\\ kk\\fst(q s!j)\\k(\\i.(i i>0)\\end(q s!(i-1)) =fst(q s!i))\"\n using assms apply auto\n apply (simp add:Q_gap_structure_def Q_offsets_differ_def)\n by (metis gr_implies_not_zero head_q0 not_gr_zero old.prod.inject prod.collapse)\n\n\nlemma Q_gap_lemmas_1:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"last(q s)\\set(q s)\"\n using assms by (simp add:con_assms_def)\n\nlemma Q_gap_lemmas_2:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\i.(i(q s!i)\\set(q s)\"\n using assms by (simp add:con_assms_def)\n\nlemma Q_gap_lemmas_3:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)\\fst(x))\\(fst(x)>fst(y)\\fst(y)>fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by linarith\n\n\nlemma Q_gap_lemmas_4:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)>fst(x))\\end(y)>fst(x)\"\n using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\nlemma Q_gap_lemmas_5:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)>fst(x))\\(fst(y)\\end(x))\"\n using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\nlemma Q_gap_lemmas_6:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)>fst(x))\\(end(y)>end(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (smt (verit, best) diff_add_inverse diff_is_0_eq le_add1 le_neq_implies_less le_trans length_greater_0_conv list.size(3))\n\nlemma Q_gap_lemmas_7:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)\\end(x))\\(end(y)>fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis add_leD1 le_neq_implies_less less_add_same_cancel1 trans_less_add1)\n\nlemma Q_gap_lemmas_8:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)\\end(x))\\(fst(y)>fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis add_leD1 diff_add_0 diff_add_inverse diff_diff_cancel minus_nat.diff_0 nat_less_le)\n\nlemma Q_gap_lemmas_9:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ fst(y)\\end(x))\\(end(y)>end(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis le_eq_less_or_eq less_add_same_cancel1 trans_less_add1)\n\nlemma Q_gap_lemmas_10:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>fst(x) \\ fst(y)\\fst(x))\\(fst(y)>fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis le_antisym less_or_eq_imp_le nat_neq_iff)\n\nlemma Q_gap_lemmas_11:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>fst(x) \\ fst(y)\\fst(x))\\(end(y)>end(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (smt (verit, ccfv_SIG) diff_add_inverse diff_is_0_eq le_antisym le_trans less_or_eq_imp_le nat_neq_iff)\n\n\nlemma Q_gap_lemmas_12:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>fst(x) \\ fst(y)\\fst(x))\\(fst(y)\\end(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis le_antisym less_or_eq_imp_le nat_neq_iff)\n\n\nlemma Q_gap_lemmas_13:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>end(x))\\(end(y)>fst(x))\"\n using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\n\n\nlemma Q_gap_lemmas_14:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>end(x) \\ fst(y)\\fst(x))\\(fst(y)\\end(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis diff_diff_left diff_is_0_eq less_nat_zero_code linorder_neqE_nat zero_less_diff)\n\n\nlemma Q_gap_lemmas_15:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>end(x))\\(fst(y)\\fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis fst_conv in_set_conv_nth nat_neq_iff old.prod.inject)\n\nlemma Q_gap_lemmas_16_B:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n and \"x\\set(q s)\" \n and \"y\\set(q s)\" \n and \"end(y)>end(x)\"\nshows \"fst(y)\\end(x)\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n using Q_gap_lemmas_14 Q_gap_lemmas_15\n by (metis assms(1) assms(2) end_simp fst_conv snd_conv)\n\n\nlemma Q_gap_lemmas_16:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>end(x))\\(fst(y)\\end(x))\"\n using Q_gap_lemmas_16_B assms by blast\n\n\n\nlemma Q_gap_lemmas_17:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n shows \"\\x y.(x\\set(q s) \\ y\\set(q s) \\ end(y)>end(x))\\(fst(y)>fst(x))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis Q_gap_lemmas_15 Q_gap_lemmas_10 add_lessD1 assms(1) assms(2) end_simp fst_conv snd_conv)\n\n\n\n\n\nlemma Q_gap_lemmas_1_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j i\\j)\\(fst(q s!i)>fst(q s!j) \\\n fst(q s!i)0\"\nshows \"\\i j.(i j fst(q s!i)>fst(q s!j))\\\n (end(q s!i)>fst(q s!j))\"\n using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n\n\nlemma Q_gap_lemmas_3_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j fst(q s!i)>fst(q s!j))\\\n (end(q s!i)>end(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis Q_gap_lemmas_6 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_4_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j fst(q s!i)>fst(q s!j))\\\n (fst(q s!i)\\end(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis Q_gap_lemmas_2 assms(1) assms(2) prod.collapse)\n\n\n\nlemma Q_gap_lemmas_5_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j fst(q s!i)\\end(q s!j))\\\n (fst(q s!i)>fst(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis Q_gap_lemmas_8 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\n\nlemma Q_gap_lemmas_6_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j fst(q s!i)\\end(q s!j))\\\n (end(q s!i)>fst(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis Q_gap_lemmas_7 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_7_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j fst(q s!i)\\end(q s!j))\\\n (end(q s!i)>end(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis le_eq_less_or_eq less_add_same_cancel1 nth_mem surjective_pairing trans_less_add1)\n\n\nlemma Q_gap_lemmas_8_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>fst(q s!j) \\ i\\j)\\\n (fst(q s!i)>fst(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n using Q_gap_lemmas_10\n by (metis assms(1) end_simp length_pos_if_in_set nth_mem)\n\nlemma Q_gap_lemmas_9_list_B:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n and \"ifst(q s!j)\" \n and \"i\\j\"\nshows \"end(q s!i)>end(q s!j)\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n by (metis Q_gap_lemmas_11 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_9_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>fst(q s!j) \\ i\\j)\\\n (end(q s!i)>end(q s!j))\"\n using assms Q_gap_lemmas_9_list_B by blast\n\n\nlemma Q_gap_lemmas_10_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>fst(q s!j) \\ i\\j)\\\n (fst(q s!i)\\end(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n using Q_gap_lemmas_12\n by (metis assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\n\nlemma Q_gap_lemmas_11_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>end(q s!j))\\\n (end(q s!i)>fst(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n by (metis add_lessD1)\n\n\nlemma Q_gap_lemmas_12_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>end(q s!j))\\\n (fst(q s!i)\\end(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n using Q_gap_lemmas_16 \n by (metis Q_gap_lemmas_2 assms(1) assms(2) end_simp)\n\n\nlemma Q_gap_lemmas_13_list:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\nshows \"\\i j.(i j end(q s!i)>end(q s!j))\\\n (fst(q s!i)>fst(q s!j))\"\n using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n using Q_gap_lemmas_17\n by (metis Q_gap_lemmas_2 assms(1) assms(2) end_simp)\n\n\n\n\n \n\n\n\n(**********)\nlemma ownB_lemma:\n assumes \"length(q s) =2\"\n and \"Q_holds_bytes s\"\n and \"Q_has_no_overlaps s\"\n and \"Q_offsets_differ s\"\n and \"s' = (`q:= (tl(q s)) \\ (setownB [(fst(hd(q s)),(end(hd(q s)))) R])) s\"\nshows \"Q_holds_bytes s' \"\n using assms apply (simp add:Q_lemmas Q_basic_lemmas)\n apply (intro conjI impI) apply clarify apply safe\n apply simp\n apply simp\n apply auto[1]\n apply(case_tac \"ai.(iData s i>0\"\n and \"q s\\[]\"\n and \"s' = (`q:= (tl(q s)) \\ (setownB [(fst(hd(q s)),(end(hd(q s)))) R]) \\ (`tempR := (hd(q s))) \n \\ (transownT [Q R s])\n \\ (`numDeqs :=(numDeqs s+1))) s\"\nshows \"Q_holds_bytes s'\"\n using assms apply (simp add:Q_lemmas Q_basic_lemmas)\n apply(elim conjE impE) \n apply(case_tac \"ownT s=Q\", simp_all)\n apply(case_tac \"length(q s) =1\", simp_all)\n apply (metis diff_Suc_1 length_pos_if_in_set length_tl less_numeral_extra(3))\n apply(case_tac \"length(q s) =2\", simp_all)\n apply (smt Suc_1 add_diff_cancel_left' fst_conv fst_def hd_conv_nth in_set_conv_nth le_less_trans length_tl less_2_cases_iff less_Suc0 nat_arith.rule0 not_less nth_tl plus_1_eq_Suc prod.collapse)\n apply clarify apply safe\n apply(case_tac \"fst(hd(q s)) >a\", simp add:fst_def snd_def)\n apply (smt fst_def hd_in_set le_imp_less_Suc le_less_trans list.set_sel(2) not_less_eq prod.collapse)\n defer\n apply(case_tac \"fst(hd(q s))fst(hd(q s))\", simp_all add:fst_def snd_def)\n apply (smt fst_def hd_in_set le_less_trans list.set_sel(2) not_less prod.collapse snd_def)\n by (smt One_nat_def Suc_mono Suc_pred fst_conv fst_def hd_conv_nth in_set_conv_nth length_greater_0_conv length_tl less_antisym not_less_zero nth_tl zero_induct)\n \nlemma Q_type_1:\n assumes \"q s=[(3,2),(5,2),(0,1)] \\ N=10\"\n shows \"Q_basic_struct s\"\n using assms apply(simp add:Q_basic_struct_def) \n apply(intro conjI impI)\n apply(simp add:Q_boundness_def)\n apply(simp add:Q_gap_structure_def)\n using less_Suc_eq apply force\n apply(simp add:Q_offsets_differ_def)\n using less_Suc_eq apply fastforce\n apply(simp add:Q_has_no_overlaps_def)\n using less_Suc_eq apply force\n by(simp add:Q_has_no_uroboros_def) \n\nlemma Q_tail_props:\n shows \"\\i.(i i>0)\\(((q s)!i) = (tl(q s)!(i-1)))\"\n apply simp\n by (simp add: diff_less_mono nth_tl)\n\nlemma Q_basic_preserved:\n assumes \"Q_basic_struct s\"\n and \"s' = (`q:= (tl(q s))) s\"\n shows \"Q_basic_struct s'\"\n using assms apply(simp add:Q_basic_struct_def)\n apply(intro conjI impI)\n apply(simp add:Q_basic_struct_def Q_boundness_def) \n apply (metis list.sel(2) list.set_sel(2))\n apply(simp add:Q_basic_struct_def Q_gap_structure_def)\n defer\n apply(simp add:Q_offsets_differ_def)\n apply (metis One_nat_def Suc_eq_plus1 diff_Suc_1 length_tl less_diff_conv nth_tl)\n apply(simp add:Q_has_no_overlaps_def)\n apply (metis list.sel(2) list.set_sel(2))\n prefer 2 \n apply (metis One_nat_def assms(1) end_simp length_tl less_nat_zero_code list.size(3) tail_preserves_Q_basic_struct)\n using assms Q_tail_props apply (simp add:Q_has_no_uroboros_def Q_basic_struct_def)\n by (smt (z3) assms(1) empty_iff end_simp fst_conv in_set_butlastD list.set(1) tail_preserves_Q_basic_struct)\n(*\nlemma Q_basic_preserved2:\n assumes \"Q_structure s\"\n and \"ownT s=Q\"\n and \"s' =((`q:= (tl(q s)))\n \\ (`pcR := Read) \n \\ (`tempR := (hd(q s))) \n \\ (transownT [Q R s])\n \\ (`numDeqs :=(numDeqs s+1))\n \\ (setownB [(fst(hd(q s)),(end(hd(q s)))) R])) s\"\n shows \"Q_structure s'\"\n using assms apply simp\n apply(simp add:Q_structure_def) \n apply(intro conjI impI)\n apply(simp add:Q_basic_struct_def)\n apply(intro conjI impI)\n apply(simp add:Q_boundness_def)\n apply (metis list.sel(2) list.set_sel(2))\n apply(simp add:Q_gap_structure_def)\n apply (smt One_nat_def Q_tail_props Suc_diff_le Suc_leI Suc_mono Suc_pred length_greater_0_conv less_SucI list.sel(2))\n apply(simp add:Q_offsets_differ_def)\n apply (metis (no_types, lifting) Nitpick.size_list_simp(2) One_nat_def Suc_mono length_tl list.sel(2) nat.inject nth_tl)\n apply(simp add:Q_has_no_overlaps_def) \n apply (metis (no_types, lifting) list.sel(2) list.set_sel(2))\n apply(simp add:Q_has_no_uroboros_def)\n apply (metis butlast_tl last_tl list.sel(2) list.set_sel(2))\n using ownB_lemma2 apply (simp add:Q_holds_bytes_def)\n apply clarify\n apply safe \n apply simp_all apply(case_tac \"fst(hd(q s))>a\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas fst_def snd_def)\n apply (smt fst_def hd_in_set le_imp_less_Suc le_less_trans list.sel(2) list.set_sel(2) not_less_eq prod.collapse)\n defer\n apply(case_tac \"fst(hd(q s)) (end (tempR s) \\ N)\" \n\ndefinition \"tempR_offsets_differ s \\ (\\i.(i(fst(q s!i)\\fst(tempR s)))\"\n\ndefinition \"tempR_gap_structure s \\ (end(tempR s) = fst(hd(q s)))\\ (fst(hd(q s)) =0)\"\n\ndefinition \"tempR_has_no_uroboros s \\ (fst (tempR s) \\ end (last (q s)))\"\n\ndefinition \"tempR_has_no_overlaps s \\(\\i.(i((fst(tempR s)end(tempR s)\\fst(q s!i))\n \\(fst(tempR s)>fst(q s!i)\\end(q s!i)\\fst(tempR s))))\"\n\ndefinition \"tempR_basic_struct s \\ tempR_boundness s \\ (q s\\[]\\ (tempR_gap_structure s \\ tempR_offsets_differ s\n \\ tempR_has_no_overlaps s \\ tempR_has_no_uroboros s)) \"\n\n\nlemmas tempR_basic_lemmas = tempR_basic_struct_def tempR_has_no_overlaps_def \n tempR_gap_structure_def tempR_has_no_uroboros_def\n tempR_boundness_def tempR_offsets_differ_def\n\n\ndefinition \"tempR_holds_bytes s \\ (\\j.(fst(tempR s)\\j \\ jownB s j=R)\"\n\ndefinition \"tempR_reflects_writes s \\ (data_index s (tempR s) = ((numDeqs s) -1))\"\n\ndefinition \"tempR_elem_size s \\ (snd(tempR s) =Data s ((numDeqs s) -1))\"\n\n\ndefinition \"tempR_structure s \\(tempR_basic_struct s \\ \n tempR_holds_bytes s \\ tempR_reflects_writes s \\ tempR_elem_size s)\"\n\n\nlemmas tempR_lemmas = tempR_holds_bytes_def tempR_reflects_writes_def \n tempR_elem_size_def tempR_structure_def\n \n\n\n(*tempW will be part of Q so:.....*)\ndefinition \"tempW s \\ (offset s, Data s (numEnqs s))\"\n\n definition \"tempW_boundness s \\ (end (tempW s) \\ N)\" \n\ndefinition \"tempW_offsets_differ s \\ (\\i.(i(fst(q s!i)\\fst(tempW s)))\"\n\ndefinition \"tempW_gap_structure s \\ (fst(tempW s) = end(last(q s)))\\ (fst(tempW s) =0)\"\n\ndefinition \"tempW_has_no_uroboros s \\ (end((tempW s)) \\ fst (hd (q s)))\"\n\ndefinition \"tempW_has_no_overlaps s \\(\\i.(i((fst(tempW s)end(tempW s)(fst(tempW s)>fst(q s!i)\\end(q s!i)\\fst(tempW s))))\"\n\ndefinition \"tempW_basic_struct s \\ tempW_boundness s \\ (q s\\[]\\ (tempW_gap_structure s \\ tempW_offsets_differ s\n \\ tempW_has_no_overlaps s \\ tempW_has_no_uroboros s))\"\n\n\nlemmas tempW_basic_lemmas = tempW_basic_struct_def tempW_has_no_overlaps_def \n tempW_gap_structure_def tempW_has_no_uroboros_def\n tempW_boundness_def tempW_offsets_differ_def\n tempW_def\n\n\ndefinition \"tempW_holds_bytes s \\ (\\j.(fst(tempW s)\\j \\ jownB s j=W)\"\n\ndefinition \"tempW_reflects_writes s \\ (data_index s (offset s, Data s (numEnqs s)) = numEnqs s)\"\n\ndefinition \"tempW_structure s \\(tempW_basic_struct s \\ \n tempW_holds_bytes s )\"\n\n\nlemmas tempW_lemmas = tempW_holds_bytes_def tempW_reflects_writes_def \n tempW_structure_def\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*Writer Thread Behaviour*)\n\n\nfun rbW_step :: \"PCW \\ rb_state \\ rb_state\" where\n \"rbW_step A1 s = ((`hW := (H s)) \\ (`tW := (T s)) \\ (`pcW := A2)) s \"\n| \"rbW_step A2 s = (if grd1 s then ((`pcW := A3) \\ (transownT [Q W s]))\n else if grd2 s then (`pcW := A4) \n else if grd3 s then (`pcW := A5) \n else (`pcW :=A8)) s\"\n| \"rbW_step A3 s = ((`T := 0) \\ (`H := (Data s (numEnqs s))) \\ (`offset := 0) \\ (`pcW := Write) \n \\ setownB [(0,(Data s (numEnqs s))) W]) s\" \n| \"rbW_step A4 s = ((`H := ((hW s) + (Data s (numEnqs s)))) \\ (`offset := (hW s)) \\ (`pcW := Write)\n \\ setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n| \"rbW_step A5 s = (if grd4 s then (`pcW := A6) \n else if grd5 s then (`pcW := A7)\n else (`pcW := A8)) s\"\n| \"rbW_step A6 s = (`H := ((hW s) + (Data s (numEnqs s))) \\ (`offset := (hW s)) \\ (`pcW := Write)\n \\ setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n| \"rbW_step A7 s = ((`H := (Data s (numEnqs s))) \\ (`offset := 0) \\ (`pcW := Write)\n \\ (setownB [(hW s,N) D])\n \\ (setownB [(0,Data s (numEnqs s)) W])) s\"\n| \"rbW_step A8 s = (if ((Data s (numEnqs s))>N) then ERRBTS s\n else (ERROOM \\ (`tW := (T s))) s)\"\n\n| \"rbW_step Write s = s\"\n| \"rbW_step Enqueue s = s\"| \"rbW_step idleW s = s\" | \"rbW_step FinishedW s = s\"| \"rbW_step BTS s = s\"| \"rbW_step OOM s = s\"\n\n\n\ndefinition \"B_acquire s s' \\ s' = (`pcW := A1) s\"\n\ndefinition \"Q_enqueue s s' \\ s' = (`q:=(append (q s) [(offset s,Data s (numEnqs s))])\n \\ `pcW := idleW\n \\ transownB [W Q]\n \\ `numEnqs := (numEnqs s + 1)\n \\ transownT [W Q s]) s\"\n\ndefinition \"B_write s s' \\ s' = ((`B.write ((offset s), (Data s (numEnqs s))):= (numEnqs s))\n \\ (transownD [(numWrites s) B]) \\ `pcW := Enqueue \\ (`numWrites := ((numWrites s )+1))) s\"\n\ndefinition cW_step :: \"PCW \\ rb_state \\ rb_state \\ bool\" where\n \"cW_step pcw s s' \\ \n case pcw of\n idleW \\ if ((numEnqs s) < n) then B_acquire s s'\n else s' = (`pcW := FinishedW ) s\n | Write \\ B_write s s' \n | Enqueue \\ Q_enqueue s s'\n | OOM \\ if tW s \\ T s then s' = (`pcW := idleW ) s else s = s'\n | FinishedW \\ s = s'\n | BTS \\ s = s'\n | _ \\ s' = rbW_step pcw s \"\n\n\nlemmas W_functs [simp] = B_acquire_def B_write_def Q_enqueue_def\n(*---------Tailored assertions to Writer-------*)\ndefinition \"pre_acquire_inv s \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\ W)\n \\ (T s=H s \\ (\\i.(i\\0 \\ iownB s i=B) \\ ownT s = Q \\ q s= [] \\ numDeqs s = numEnqs s)\n \\ (T s>H s \\ (\\i.(i\\H s \\ iownB s i=B))\n \\ (T s (\\i.((i\\H s \\ i iownB s i=B))\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s=0\\q s=[]) \n \\ (numEnqs s\\n)\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n\"\ndefinition \"pre_A1_inv s \\ (T s=H s\\((\\i.(i\\0 \\ iownB s i=B) \\ ownT s =Q \\ q s=[]))\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (T s>H s \\ (\\i.(i\\H s \\ iownB s i=B))\n \\ (T s (\\i.((i\\H s \\ i iownB s i=B))\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A2_inv s \\ (tW s=hW s\\((\\i.(i\\0 \\ iownB s i=B) \\ ownT s =Q \\ q s=[] \\ tW s=T s))\n \\ (tW s>hW s \\ ((\\i.(i\\hW s \\ iownB s i=B) \\ (T s\\tW s \\ T s\\H s)))\n \\ (tW s ((\\i.((i\\hW s \\ i iownB s i=B) \\ T s\\tW s \\ H s\\T s))\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A3_inv s \\ ((\\i.(i\\0 \\ iownB s i=B))\n \\ (grd1 s)\n \\ (ownT s =W)\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (H s=hW s) \\ q s=[]\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s=tW s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A4_inv s \\ (\\i.(i\\hW s \\ iownB s i=B)\n \\ (grd2 s) \\ (\\grd1 s)\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s) \n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s\\tW s \\ T s\\H s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A5_inv s \\ (\\i.((i\\hW s \\ i iownB s i=B)\n \\ (grd3 s) \\ (\\grd1 s) \\ (\\grd2 s)\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s\\tW s \\ T s\\H s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A6_inv s \\ (\\i.((i\\hW s \\ i iownB s i=B)\n \\ (grd4 s) \\ (grd3 s) \\ (\\grd1 s) \\ (\\grd2 s)\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s) \n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s\\tW s \\ T s\\H s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A7_inv s \\ (\\i.((i\\hW s \\ i iownB s i=B)\n \\ (grd5 s) \\ (grd3 s) \\ (\\grd1 s) \\ (\\grd2 s) \\ (\\grd4 s)\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s) \n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s\\tW s \\ T s\\H s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_A8_inv s \\ (tW s\\hW s \\(\\i.((i\\hW s \\ i iownB s i=B))\n \\ (tW s>hW s \\(\\i.(hW s \\i \\ iownB s i=B))\n \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s)\n \\ (no_space_for_word s) \n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[])\n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s\\tW s \\ T s\\H s)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n\"\ndefinition \"pre_write_inv s \\ (\\i.(i\\offset s \\ i< ((offset s)+(Data s (numEnqs s))))\\ownB s i=W)\n \\ ((tW s>hW s)\\(\\i.(i\\((offset s)+(Data s (numEnqs s)))\\iownB s i =B))\n \\ ((tW s offset s\\0)\\(\\i.((i\\((offset s)+(Data s (numEnqs s))) \\ iiownB s i =B))\n \\ ((tW s offset s=0)\\((\\i.(i\\((offset s)+(Data s (numEnqs s))) \\ iownB s i =B) \\ (\\i.(i\\hW s \\ iownB s i=D)))\n \\ (tW s=hW s\\(ownT s=W \\ q s=[]))\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (tempW_structure s)\n \\ (ownD s(numWrites s) =W)\n \\ (numEnqs s=0\\q s=[]) \n \\ (offset s=hW s \\ offset s=0)\n \\ (H s=offset s + Data s (numEnqs s))\n \" \ndefinition \"pre_enqueue_inv s \\ (\\i.(i\\offset s \\ i< end(tempW s))\\ownB s i=W)\n \\ (\\i.(i (i\\ end(tempW s)\\i\\N))\\ownB s i\\W)\n \\ ((tW s>hW s)\\(\\i.(i\\end(tempW s)\\iownB s i =B))\n \\ ((tW s offset s\\0)\\(\\i.((i\\end(tempW s) \\ iiownB s i =B))\n \\ ((tW s offset s=0)\\((\\i.(i\\end(tempW s) \\ iownB s i =B) \\ (\\i.(i\\hW s \\ iownB s i=D)))\n \\ (tW s=hW s\\(ownT s=W \\ q s=[]))\n \\ (numWrites s=numEnqs s +1)\n \\ (numEnqs s ((ownT s = W)\\q s=[])\n \\ (tempW_structure s)\n \\ (tempW_reflects_writes s)\n \\ (ownD s(numEnqs s) =B)\n \\ (numEnqs s=0\\q s=[]) \n \\ (offset s=hW s \\ offset s=0)\n \\ (H s=offset s + Data s (numEnqs s))\n \" \ndefinition \"pre_OOM_inv s \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (tW s>hW s \\ (\\i.(i\\tW s \\ iownB s i=B))\n \\ (tW s (\\i.((i\\hW s \\ i iownB s i=B))\n \\ (numWrites s=numEnqs s) \n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[]) \n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \ndefinition \"pre_finished_inv s \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s=n)\n \\ (H s>0)\n \" \ndefinition \"pre_BTS_inv s \\ (\\j.(j\\0\\ j\\N)\\ownB s j\\W)\n \\ (ownT s \\W)\n \\ (numWrites s=numEnqs s)\n \\ (numEnqs s (H s=hW s)\n \\ (numEnqs s=0\\q s=[]) \n \\ (numEnqs s>0\\H s>0)\n \\ (numEnqs s=0\\H s=0)\n \\ (T s = 0 \\ H s = 0) = (numWrites s = 0)\n \" \n\nlemmas writer_lemmas = pre_A1_inv_def pre_A2_inv_def pre_A3_inv_def pre_A4_inv_def\n pre_A5_inv_def pre_A6_inv_def pre_A7_inv_def pre_A8_inv_def\n pre_BTS_inv_def pre_OOM_inv_def pre_acquire_inv_def\n pre_finished_inv_def pre_enqueue_inv_def pre_write_inv_def\n(***********************************************************************)\n\n\n(*Reader Thread Behaviour*)\n\ndefinition \"B_release s s' \\ s' = (`T := (end(tempR s)) \n \\ (`pcR := idleR) \n \\ (`tempR := (0,0))\n \\ (transownB [R B]) \n \\ (if tR s\\ fst(tempR s) then setownB [(tR s,N) B] else id) \n \\ transownT [R Q s]) s\"\n\ndefinition \"B_read s s' \\ s' = (((transownD [(data_index s (tempR s)) R]) \n \\ (`pcR := Release)) \n \\ (`numReads := (numReads s+1)) \n \\ (`tR := (T s))) s\"\n\ndefinition \"Q_dequeue s s' \\ s' = ((`q:= (tl(q s)))\n \\ (`pcR := Read)\n \\ (`tempR := (hd(q s)))\n \\ (transownT [Q R s])\n \\ (`numDeqs :=(numDeqs s+1))\n \\ (setownB [(off(hd(q s)),(end(hd(q s)))) R])) s\"\n\ndefinition cR_step :: \"PCR \\ rb_state \\ rb_state \\ bool\" where\n \"cR_step pcr s s' \\ \n case pcr of\n idleR \\ if (q s=[]) then (s=s') else (Q_dequeue s s')\n | Read \\ B_read s s' \n | Release \\ B_release s s'\"\n\n\nlemmas R_functs [simp] = B_release_def B_read_def Q_dequeue_def\n(*---------Tailored assertions to Reader-------*)\ndefinition \"pre_dequeue_inv s \\ (tempR s = (0,0))\n \\ (numDeqs s \\ n)\n \\ (numDeqs s \\ 0)\n \\ (numDeqs s = numReads s)\n \\ (numDeqs s \\ numEnqs s)\n \\ (pcR s = idleR)\n \\ (q s\\[] \\ ownT s=Q)\n \\ (q s\\[] \\ H s>0)\n \\ ((T s\\fst(hd(q s))\\q s\\[])\\(\\x j.(x\\set(q s) \\ j j\\T s)\\end(x) (q s\\[]\\(\\i.(fst(hd(q s))\\i \\ iownB s i = Q))\n \\ (\\i.(i (i\\end(tempR s)\\ i\\N))\\ownB s i \\ R)\n\n\"\n\ndefinition \"pre_Read_inv s \\ (snd(tempR s) = Data s (numReads s))\n \\ (numReads s=data_index s (tempR s))\n \\ (numDeqs s\\n) \n \\ (numDeqs s\\0) \n \\ (numReads s+1=numDeqs s)\n \\ (numDeqs s\\1)\n \\ (numEnqs s\\numDeqs s) \n \\ (pcR s=Read)\n \\ (ownT s = R)\n \\ (ownD s (numReads s) = B)\n \\ (tempR s\\(0,0))\n \\ (tempR_structure s)\n \\ (\\i.(fst(tempR s)\\i \\ iownB s i = R)\n \\ (\\i.(i (i\\end(tempR s)\\ i\\N))\\ownB s i \\ R)\n\n \\ (H s>0)\n\"\n\ndefinition \"pre_Release_inv s \\ (snd(tempR s) = Data s (numReads s -1))\n \\ (data_index s (tempR s) = numReads s -1)\n \\ (q s\\[]\\(numReads s=data_index s (hd(q s))))\n \\ (ownT s = R)\n \\ (numEnqs s\\numDeqs s)\n \\ (ownD s (numReads s -1) = R)\n \\ (numDeqs s\\n \\ numDeqs s\\1)\n \\ (numDeqs s = numReads s)\n \\ (pcR s=Release)\n \\ (tR s=T s)\n \\ (tempR s\\(0,0))\n \\ (tempR_structure s)\n \\ (\\i.(fst(tempR s)\\i \\ iownB s i = R)\n \\ (\\i.(i (i\\end(tempR s)\\ i\\N))\\ownB s i \\ R)\n\n\n \\ (H s>0)\n\" \n\n\n\nlemmas reader_lemmas = pre_Release_inv_def pre_Read_inv_def pre_dequeue_inv_def\n(***********************************************************************)\n\n\n\nlemma Q_structure_preserved1:\n assumes \"Q_structure s\"\n and \"pre_dequeue_inv s\"\n and \"q s\\[]\"\n and \"Q_dequeue s s'\"\n shows \"Q_structure s'\"\n using assms apply(simp add:Q_structure_def pre_dequeue_inv_def)\n apply (intro conjI impI)\n apply(simp add:Q_basic_struct_def)\n apply(intro conjI impI)\n apply(simp add:Q_boundness_def )\n apply (metis list.set_sel(2))\n apply(simp add:Q_gap_structure_def) \n apply (metis (no_types, hide_lams) One_nat_def Q_gap_structure_def end_simp length_tl tail_preserves_Q_gap_structure)\n apply(simp add:Q_offsets_differ_def)\n apply (metis (no_types, lifting) One_nat_def add.commute add_right_cancel length_tl less_diff_conv nth_tl plus_1_eq_Suc)\n apply(simp add:Q_has_no_overlaps_def)\n apply (metis (no_types, lifting) list.set_sel(2))\n apply(simp add:Q_has_no_uroboros_def)\n apply (metis butlast_tl last_tl list.sel(2) list.set_sel(2))\n apply(simp add:Q_reflects_writes_def) apply(simp add:Q_elem_size_def)\n apply (meson list.set_sel(2)) apply(simp add:Q_reflects_writes_def)\n apply (metis One_nat_def Suc_eq_plus1 add_Suc_right length_tl less_diff_conv nth_tl)\n apply(simp add:Q_reflects_ownD_def) apply(simp add:Q_elem_rel_def) \n apply (metis (no_types, hide_lams) One_nat_def Q_structure_def Suc_eq_plus1_left add.commute assms(1) length_tl tail_preserves_Q_elem_size)\n apply(simp add:Q_reflects_ownD_def)\n by (metis Nat.add_0_right add_Suc add_Suc_right less_diff_conv)\n\nlemma Q_structure_preserved2:\n assumes \"Q_structure s\"\n and \"ownT s=R\"\n and \"pre_Read_inv s\"\n and \"B_read s s'\"\n shows \"Q_structure s'\"\n using assms apply(simp add:Q_structure_def)\n apply(intro conjI impI) apply(simp add:Q_basic_struct_def) apply(intro conjI impI)\n apply(simp add:Q_boundness_def)\n apply(simp add:Q_gap_structure_def)\n apply(simp add:Q_offsets_differ_def)\n apply(simp add:Q_has_no_overlaps_def)\n apply(simp add:Q_has_no_uroboros_def)\n apply(simp add:Q_elem_size_def)\n apply(simp add:Q_holds_bytes_def)\n apply(simp add:Q_reflects_writes_def)\n apply(simp add:Q_elem_size_def)\n apply(simp add:Q_reflects_ownD_def)\n apply(simp add:Q_elem_rel_def)\n apply(simp add:Q_reflects_ownD_def)\n by(simp add:Q_structure_def pre_Read_inv_def)\n\nlemma Q_structure_preserved3:\n assumes \"Q_structure s\"\n and \"pre_Release_inv s\"\n and \"s' = (`T := (off(tempR s) +len(tempR s)) \n \\ (`pcR := idleR) \n \\ (`tempR := (0,0))\n \\ (transownB [R B]) \n \\ (if tR s\\ fst(tempR s) then setownB [(tR s,N) B] else id) \n \\ transownT [R Q s]) s\"\n shows \"Q_structure s'\"\n using assms \n apply (simp add:Q_structure_def) \n apply(intro conjI impI)\n apply(simp add:Q_basic_struct_def)\n apply(intro conjI impI) \n apply(simp add:pre_Release_inv_def Q_boundness_def)\n apply(simp add:pre_Release_inv_def Q_gap_structure_def)\n apply(simp add:pre_Release_inv_def Q_offsets_differ_def)\n apply(simp add:pre_Release_inv_def Q_has_no_overlaps_def)\n apply(simp add:pre_Release_inv_def Q_has_no_uroboros_def)\n apply(simp add:pre_Release_inv_def Q_holds_bytes_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n apply(simp add:pre_Release_inv_def Q_elem_size_def)\n apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n by(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n\n \n\n\n\n\n\ndefinition \"inRange v \\ 0 \\ v \\ v \\ N\"\ndefinition \"inRangeHT s \\ inRange (H s) \\ inRange (T s)\"\ndefinition \"H0_T0 s \\ H s = 0 \\ T s = 0\"\ndefinition \"inRangeht s \\ inRange (hW s) \\ inRange (tW s)\"\ndefinition \"basic_pointer_movement s \\ inRangeHT s \\ inRangeht s \\ H0_T0 s \"\n\nlemmas basic_pointer_movement_lemmas [simp] = basic_pointer_movement_def inRangeHT_def inRangeht_def H0_T0_def inRange_def\n\n\ndefinition \"mainInv s \\ \\ i. (i ownD s i=R) \n \\ (numReads s \\ i \\ i < numWrites s \\ ownD s i = B) \n \\ (numWrites s \\ i \\ i < n \\ ownD s i = W) \"\ndefinition \"counter_bounds s \\ numReads s \\n \\ numWrites s\\n \\ numEnqs s\\n \\ numDeqs s \\ n\"\ndefinition \"counter_q_rel s \\ (numEnqs s-numDeqs s=length(q s))\\ numWrites s\\numReads s \\ numEnqs s\\numDeqs s\" \n\n\n(*new lemmas, take 2*)\ndefinition \"data_index_bouded s \\ \\i. (i\\N)\\(\\j.(j\\N)\\data_index s (i,j) \\j.(ownB s j=Q \\ j(\\a b. ((a, b)\\set(q s)\\ a\\j \\ j {i . a \\ i \\ i < b}\"\n\ndefinition \"Q_indices s \\ \\ {ran_indices a (a + b) | a b. (a, b) \\ set(q s)}\"\n\ndefinition \"Q_tail_indices s \\ \\ {ran_indices a (a + b) | a b. (a, b) \\ set(tl(q s))}\"\n\nlemma ran_ind_imp_Q_ind:\n \"\\i a b. (i\\ ran_indices a b \\ (a, b)\\set(q s))\\i\\Q_indices s\"\n apply(simp add:Q_indices_def ran_indices_def) \n by (smt (z3) add.assoc add_lessD1 less_add_eq_less mem_Collect_eq)\n\nlemma Q_ind_imp_tail_ind_1:\n \"tl(q s)\\[] \\ hd(q s) = (q s!0)\"\n apply (simp add:hd_def) \n by (metis Nil_tl hd_conv_nth hd_def)\n\nlemma Q_ind_imp_tail_ind_2:\n \"tl(q s)\\ [] \\i\\Q_indices s\\ \\a b.((a,b)\\set(tl(q s))\\a\\i \\ ii\\Q_tail_indices s\"\n apply(simp add:Q_indices_def ran_indices_def Q_tail_indices_def) \n by (metis (no_types, lifting) leD leI le_iff_add mem_Collect_eq nat_add_left_cancel_less trans_le_add2)\n\nlemma Q_ind_imp_tail_ind_3:\n \"tl(q s)\\ [] \\i\\Q_indices s\\ s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n \\\\a b.((a,b)\\set(tl(q s))\\a\\i \\ ii\\Q_indices s'\"\n apply(simp add:Q_indices_def ran_indices_def Q_tail_indices_def) \n by (metis (no_types, lifting) leD leI le_iff_add mem_Collect_eq nat_add_left_cancel_less trans_le_add2)\n\n\n\n(*\n[(1, 3), (4,1)]\nran_indices 1 4 = {1,2,3}\nran_indicies 4,5 = {4}\nQ_indicies s = {1,2,3,4}\n*)\n\ndefinition \"Q_owns_bytes s \\ \\i.(i\\Q_indices s)\\(i\\N \\ ownB s i=Q)\"\n\ndefinition \"Q_tail_owns_bytes s \\ \\i.(i\\Q_tail_indices s)\\(i\\N \\ ownB s i=Q \\ i\\ran_indices (fst(hd(q s))) (end(hd(q s))))\"\n\n\n\n(*------------------------ Invariant ------------------------------------*)\ndefinition inv where\n\"inv s \\ basic_pointer_movement s \n \\ mainInv s\n \\ counter_q_rel s\n \\ counter_bounds s \n \\ Q_structure s\n \\ data_index_bouded s\n \\ (case_1 s \\ case_2 s)\n \\ Q_owns_bytes s\n\"\n\ndefinition pre_W where\n \"pre_W pcw s \\ (case pcw of\n idleW \\ pre_acquire_inv s \n | A1 \\ pre_A1_inv s \n | A2 \\ pre_A2_inv s \n | A3 \\ pre_A3_inv s \n | A4 \\ pre_A4_inv s \n | A5 \\ pre_A5_inv s \n | A6 \\ pre_A6_inv s \n | A7 \\ pre_A7_inv s \n | A8 \\ pre_A8_inv s \n | Write \\ pre_write_inv s \n | OOM \\ pre_OOM_inv s \n | BTS \\ pre_BTS_inv s \n | Enqueue \\ pre_enqueue_inv s \n | FinishedW \\ pre_finished_inv s)\"\n\ndefinition pre_R where\n \"pre_R pcr s \\\n (case pcr of\n idleR \\ pre_dequeue_inv s \n | Read \\ pre_Read_inv s \n | Release \\ pre_Release_inv s)\"\n\n\nlemmas inv_simps = inv_def cW_step_def cR_step_def init_def\n\n\n\n\n\nlemma Q_not_empty:\n \"q s \\ [] \\ \\x.(x\\set(q s))\\snd(x)>0 \\ Q_indices s\\{}\"\n apply (simp add: Q_indices_def ran_indices_def)\n apply (rule_tac exI [where x =\"{i. fst(hd(q s)) \\ i \\ i < end(hd(q s))}\"])\n apply safe defer apply(simp add:end_def)\n apply auto \n apply (metis add.commute le_refl less_add_same_cancel2 list.set_sel(1) prod.exhaust_sel)\n apply (rule_tac exI [where x =\"fst(hd(q s))\"])\n apply (rule_tac exI [where x =\"snd(hd(q s))\"])\n by simp\n\n\nlemma case_1_Q_struct:\n assumes \"case_1 s\"\n and \"Q_structure s\"\n and \"Q_owns_bytes s\"\nshows \"\\i.(i>0 \\ ifst(q s!i) = end(q s!(i-1))\"\n apply (cases \"q s = []\")\n apply simp\n using assms apply (simp add:Q_lemmas Q_basic_lemmas case_1_def Q_owns_bytes_def Q_indices_def ran_indices_def) \n apply clarify\n apply(subgoal_tac \"fst(q s!0) = b\") prefer 2 \n apply (metis Zero_not_Suc diff_self_eq_0 hd_conv_nth le_neq_implies_less less_natE)\n apply(subgoal_tac \"end(q s!(length(q s)-1)) = c\") prefer 2\n apply (metis Suc_diff_Suc Zero_not_Suc diff_0_eq_0 diff_self_eq_0 end_simp last_conv_nth le_neq_implies_less)\n apply(subgoal_tac \"\\a b aa. (a,b)\\set(q s) \\ (\\b.(aa, b)\\set(q s)) \\ aa+b\\aa\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\a b. (a,b)\\set(q s)\\(\\i.(i (q s!i) = (a,b)))\") prefer 2\n apply (metis in_set_conv_nth)\n apply(subgoal_tac \"\\i j.(ij(\\a b aa bb.((a,b)\\set(q s)\\(aa,bb)\\set(q s)))\")\n prefer 2 \n apply (metis last_in_set surjective_pairing)\n apply(subgoal_tac \"\\i.(i i>0)\\(fst(q s!i) = 0 \\ fst(q s!i) = end(q s!(i-1)))\")\n prefer 2 \n apply (metis (no_types, lifting) One_nat_def end_simp)\n apply(case_tac \"ownB s 0 = Q\") \n apply (metis (no_types, lifting) F.distinct(11) F.distinct(19) le_numeral_extra(3) length_greater_0_conv not_gr0)\n apply(subgoal_tac \"ownB s 0\\Q\") prefer 2 apply blast\n (*trying to use the fact that ownB s 0\\Q and Q_gap_structure to show that all \n Q entries start where the last left off, rather than any starting from 0*)\n apply(subgoal_tac \"(\\a b.((a,b)\\set(q s) \\ a = 0))\\ownB s 0=Q\")\n prefer 2\n apply (metis (no_types, lifting) add_gr_0 mem_Collect_eq nat_le_linear)\n apply(subgoal_tac \"ownB s 0\\Q\\(\\a b.((a,b)\\set(q s) \\ a = 0))\")\n prefer 2 \n apply meson\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a\\0\") prefer 2\n apply metis\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\(\\i.(i (a,b)=(q s!i)))\") prefer 2\n apply metis\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s)\\(q s!i) = (a, b))\\a=fst(q s!i)\") prefer 2\n apply (metis fst_conv)\n apply(subgoal_tac \"\\i.(ifst(q s!i)\\0\") prefer 2\n apply (metis nth_mem prod.collapse)\n apply(subgoal_tac \"\\i.(ii>0)\\(fst(q s!i) =end(q s!(i-1)) \\ fst(q s!i) =0)\")\n prefer 2 \n apply (metis (no_types, hide_lams))\n apply(subgoal_tac \"(\\i.(ifst(q s!i)\\0) \\ (\\i.(ii>0)\\(fst(q s!i) =end(q s!(i-1)) \\ fst(q s!i) =0))\n \\(\\i.(ii>0)\\(fst(q s!i) =end(q s!(i-1))))\")\n prefer 2 \n apply (metis (no_types, hide_lams))\n by (metis (no_types, lifting))\n\nlemma ran_indices_lem:\n \"Q_structure s \\ \\i.(i fst(q s!i) \\ ran_indices (fst(q s ! i)) (fst(q s!i)+snd(q s!i))\"\n apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def)\n by (metis bot_nat_0.not_eq_extremum length_0_conv length_pos_if_in_set nth_mem prod.exhaust_sel)\n\nlemma ran_indices_lem2:\n \"q s \\ [] \\ Q_structure s \\ case_1 s \\ \\i.(i\\end(last(q s)) \\ i\\N)\\ownB s i\\Q\"\n apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def)\n by (metis F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) diff_is_0_eq length_greater_0_conv less_nat_zero_code linorder_neqE_nat zero_less_diff)\n \n\nlemma ran_indices_lem3: \n \"q s \\ [] \\ Q_structure s \\ case_1 s \\ end(last(q s)) \\ N \\ ownB s (end(last(q s))) \\Q\"\n apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def) \n by (metis F.distinct(19) F.distinct(23) F.distinct(3) diff_self_eq_0 eq_imp_le le_neq_implies_less le_zero_eq length_0_conv)\n \nlemma ran_indices_lem4:\n \"q s \\ [] \\ Q_structure s \\ case_1 s \\ end(last(q s))\\N\"\n by (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def)\n\nlemma ran_indices_lem5:\n \"q s\\[] \\Q_structure s \\ case_1 s \\ Q_owns_bytes s \\ \\i.(i fst(q s!i)\\Q_indices s\"\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (mono_tags, lifting) mem_Collect_eq nth_mem prod.collapse ran_indices_def ran_indices_lem)\n\n\nlemma case_1_Q_struct_inf:\n assumes \"Q_structure s\"\n and \"case_1 s\"\n and \"Q_owns_bytes s\"\nshows \"\\ii.(i i\\end(last(q s)))\\ ownB s i\\Q\") prefer 2\n apply(simp add:case_1_def) \n apply (metis assms(2) end_simp less_or_eq_imp_le ran_indices_lem2)\n apply(simp add:case_1_def)\n apply clarify\n apply(subgoal_tac \"end(last(q s)) = c\") prefer 2\n apply (metis diff_self_eq_0 end_simp le_zero_eq nat_less_le)\n apply(subgoal_tac \"\\i.(iownB s (fst(q s!i)) = Q\") prefer 2\n using ran_indices_lem [where s = s] \n defer \n apply(subgoal_tac \"ownB s c \\Q\") prefer 2 \n apply (metis assms(2) ran_indices_lem3 ran_indices_lem4)\n apply clarify\n apply(subgoal_tac \"\\i.(ownB s i =Q \\ i\\N)\\ii.(i\\end(last(q s)) \\ i\\N)\\ownB s i\\Q)\\(\\i.(ownB s i=Q \\ i\\N)\\ii.(iownB s (fst(q s!i)) =Q\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\i.(ownB s i=Q \\ i\\N)\\ii.(i(\\a b. (a,b)\\set(q s) \\ a=fst(q s!i))\") prefer 2\n apply (metis nth_mem prod.exhaust_sel)\n apply(unfold Q_lemmas Q_basic_lemmas)\n apply(subgoal_tac \"\\j.(j ownB s (fst(q s!j))\\Q)\") prefer 2\n apply metis\n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N)\\ii.(i fst(q s!i) \\ {j. ownB s j = Q}\") prefer 2\n apply (metis (mono_tags, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\i.(i end(q s!i)\\N\") prefer 2\n apply (metis nth_mem)\n apply(subgoal_tac \"\\i.(isnd(q s!i)>0\") prefer 2\n apply (metis nth_mem)\n apply(subgoal_tac \"\\i.(ifst(q s!i)i.(ifst(q s!i)i.(i fst(q s!i) \\ {j. ji.(ifst(q s!i) \\ {j. ownB s j = Q \\ jownT := W, pcW := A3\\) \\ case_1 s \n \\ (i\\N)\\ownB s' i = ownB s i\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A3_2:\n shows \"s'=(s\\ownT := W, pcW := A3\\) \\ T s=H s\\ case_1 s \n \\ case_1 s'\"\n apply (simp add:case_1_def cW_step_def)\n apply clarify\n by (smt (z3) diff_is_0_eq le_trans less_irrefl_nat zero_less_diff)\n\n\nlemma case_trans_A2_to_A4_1:\n shows \"s'=(s\\pcW := A4\\) \\ case_1 s \n \\ (i\\N)\\ownB s' i = ownB s i\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A4_2:\n shows \"s'=(s\\pcW := A4\\) \\ case_1 s \n \\ case_1 s'\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A4_3:\n shows \"s'=(s\\pcW := A4\\) \\ case_2 s \\ T s>H s\n \\ case_2 s'\"\n by (simp add:case_2_def cW_step_def)\n\n\n\n\nlemma case_trans_A2_to_A5_1:\n shows \"s'=(s\\pcW := A5\\) \\ case_1 s \n \\ (i\\N)\\ownB s' i = ownB s i\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A5_2:\n shows \"s'=(s\\pcW := A5\\) \\ case_1 s \n \\ case_1 s'\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A5_3:\n shows \"s'=(s\\pcW := A5\\) \\ case_2 s \\ T s\\H s\n \\ case_2 s'\"\n by (simp add:case_2_def cW_step_def)\n\n\n\n\n\n\n\nlemma case_trans_A2_to_A8_1:\n shows \"s'=(s\\pcW := A8\\) \\ case_1 s \n \\ (i\\N)\\ownB s' i = ownB s i\"\n by (simp add:case_1_def cW_step_def)\n\n\nlemma case_trans_A2_to_A8_2:\n shows \"s'=(s\\pcW := A8\\) \\ case_1 s \n \\ case_1 s'\"\n by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A8_3:\n shows \"s'=(s\\pcW := A8\\) \\ case_2 s \\ T s\\H s\n \\ case_2 s'\"\n by (simp add:case_2_def cW_step_def)\n\nlemma case_trans_A2_to_A8_4:\n shows \"s'=(s\\pcW := A8\\) \\ case_2 s \\ T s>H s\n \\ case_2 s'\"\n by (simp add:case_2_def cW_step_def)\n\nlemma case_trans_A3_1:\n shows \"pre_A3_inv s \\ case_2 s \\ False\"\n by (simp add:case_2_def pre_A3_inv_def)\n\nlemma case_trans_A3_2:\n shows \"pre_A3_inv s \\con_assms s\\inv s\\ case_1 s\"\n apply (simp add:pre_A3_inv_def con_assms_def basic_pointer_movement_def inv_def)\n apply(subgoal_tac \"H s=T s\") prefer 2\n apply simp apply clarify \n apply(subgoal_tac \"\\case_2 s\") prefer 2\n apply (metis case_split_2 less_or_eq_imp_le)\n by blast\n\nlemma case_trans_A3_to_write_1:\n shows \"pre_A3_inv s \\s'=(s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\)\\inv s\\ H s'\\T s'\"\n by (simp add:pre_A3_inv_def inv_def)\n\nlemma case_trans_A3_to_write_2:\n shows \"pre_A3_inv s \\s'=(s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\)\\inv s\\ \\case_2 s'\"\n by (simp add:pre_A3_inv_def inv_def case_2_def)\n\nlemma case_trans_A3_to_write_3:\n shows \"pre_A3_inv s \\s'=(s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\)\\inv s\\ con_assms s\\ (i\\T s' \\ iownB s' i=W\"\n by (simp add:pre_A3_inv_def inv_def case_1_def)\n\nlemma case_trans_A3_to_write_4:\n shows \"pre_A3_inv s \\s'=(s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\)\\inv s\\ con_assms s\\ (i\\H s'\\ iownB s' i=B\"\n by (simp add:pre_A3_inv_def inv_def case_1_def)\n\nlemma case_trans_A3_to_write_7:\n shows \"pre_A3_inv s \\s'=(s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\)\\inv s\\ con_assms s\\ case_1 s'\"\n apply (simp add:pre_A3_inv_def inv_def case_1_def)\n apply (rule_tac exI [where x =\"0\"])\n apply (rule_tac exI [where x =\"0\"]) apply simp\n apply (subgoal_tac \"Data s (numEnqs s)\\N\")\n apply (metis case_split_2 le_refl)\n by blast\n\n\nlemma case_trans_A4_1:\n shows \"pre_A4_inv s \\ T s\\tW s\\ case_1 s \\ False\"\n apply (simp add:case_1_def pre_A4_inv_def)\n by (metis diff_is_0_eq le_trans less_nat_zero_code)\n\nlemma case_trans_A4_2:\n shows \"pre_A4_inv s \\ T s\\hW s\\ case_2 s \\ False\"\n apply (simp add:case_2_def pre_A4_inv_def) \n by (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n\nlemma case_trans_A4_3:\n shows \"pre_A4_inv s \\ T s>hW s \\ T s False\"\n by (simp add:case_2_def pre_A4_inv_def) \n\nlemma case_trans_A4_4:\n shows \"pre_A4_inv s \\ inv s\\ T s\\tW s\\ case_2 s\"\n apply (simp add: pre_A4_inv_def inv_def) using case_trans_A4_1 [where s=s]\n by (metis case_split_4 less_eqE trans_less_add1) \n\n\nlemma case_trans_A4_5:\n shows \"pre_A4_inv s \\ inv s\\ T s\\hW s\\ case_1 s\"\n apply (simp add: pre_A4_inv_def inv_def) using case_trans_A4_2 [where s=s]\n by (metis RingBuffer_BD_latest_2.case_split) \n\n\nlemma case_trans_A4_to_write_1:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\ inv s \\\n (iownB s i=ownB s' i\"\n by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_2:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\ inv s \\\n (i\\H s')\\ownB s i=ownB s' i\"\n by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_3:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\ inv s \\\n (hW s \\i \\ iW=ownB s' i\"\n by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_4:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\ inv s \\\n T s'=T s\"\n by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_5:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\ inv s \\ con_assms s \\\n T s'> H s' \\ H s T s=T s' \\ offset s'=hW s \\ Data s (numEnqs s) = Data s' (numEnqs s') \\ H s'-H s=Data s (numEnqs s) \\ tempR s=tempR s' \\ q s=q s' \\ ownT s=ownT s'\"\n apply (simp add:case_2_def pre_A4_inv_def inv_def) \n by (simp add: le_Suc_ex less_diff_conv) \n\n\nlemma case_trans_A4_to_write_6:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\con_assms s \\ inv s \\\n case_2 s\"\n using case_trans_A4_4 [where s=s] \n by blast\n\nlemma case_trans_A4_to_write_7:\n shows \"pre_A4_inv s \\ T s\\tW s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\con_assms s \\ inv s \\\n case_2 s'\"\n apply(subgoal_tac \"H s'i.(iownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply blast\n apply(subgoal_tac \"\\i.(hW s \\i \\ iW=ownB s' i\") prefer 2\n using case_trans_A4_to_write_3 [where s=s and s'=s']\n apply blast\n apply(subgoal_tac \"\\i.(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_2 [where s=s and s'=s']\n apply blast\n apply(subgoal_tac \"offset s'=hW s\") prefer 2\n using case_trans_A4_to_write_5 [where s=s and s'=s']\n apply blast\n apply(subgoal_tac \"tempR s = tempR s'\") prefer 2\n using case_trans_A4_to_write_5 [where s=s and s'=s']\n apply blast\n apply(unfold inv_def)[1]\n apply(subgoal_tac \"case_2 s\") prefer 2\n using case_trans_A4_to_write_6 [where s=s and s'=s']\n using RingBuffer_BD_latest_2.inv_def apply blast \n apply(subgoal_tac \"\\case_1 s\") prefer 2\n using case_trans_A4_1 apply blast\n apply(unfold pre_A4_inv_def grd1_def grd2_def basic_pointer_movement_def)[1]\n apply(clarify) \n apply(thin_tac \"case_2 s\")\n apply(thin_tac \"\\case_1 s\")\n apply(thin_tac \"mainInv s\")\n apply(unfold case_2_def)[1]\n (*apply instance*) apply clarify\n apply(rule_tac ?x = \"a\" in exI)\n apply(rule_tac ?x = \"b\" in exI) \n apply(rule_tac exI [where x =\"H s'\"])\n apply(rule_tac exI [where x =\"T s'\"])\n apply(rule_tac ?x = \"e\" in exI)\n apply(rule_tac ?x = \"f\" in exI)\n apply (intro conjI impI)\n apply blast \n apply meson\n apply (metis le_trans less_imp_le_nat)\n apply meson\n apply metis\n apply blast\n apply meson\n apply clarify\n apply(subgoal_tac \"iownB s i=R\") prefer 2\n apply (metis zero_le)\n apply(subgoal_tac \"hW s = b\") prefer 2\n apply (metis F.distinct(17) F.distinct(23) nat_le_linear nat_less_le zero_le)\n apply(subgoal_tac \"(iownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans nat_less_le)\n apply(subgoal_tac \"i\\a \\ iownB s i=Q\") prefer 2\n apply (metis zero_le)\n apply(subgoal_tac \"(iownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans nat_less_le)\n apply (metis le_eq_less_or_eq le_trans)\n apply(subgoal_tac \"(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"(i\\H s')\\ownB s i=ownB s' i\") prefer 2\n using case_trans_A4_to_write_1 [where s=s and s'=s']\n apply metis\n apply (metis le_trans less_or_eq_imp_le)\n apply meson\n apply metis\n apply metis\n apply (metis gr_zeroI less_nat_zero_code)\n apply meson\n apply force\n apply (metis F.distinct(17) F.distinct(23) less_eq_nat.simps(1) nat_le_linear nat_less_le)\n apply(subgoal_tac \"b=H s\") prefer 2\n apply (metis F.distinct(17) F.distinct(23) less_eq_nat.simps(1) nat_le_linear nat_less_le)\n apply(subgoal_tac \"H s'-H s=Data s (numEnqs s)\") prefer 2\n apply meson\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n apply metis\n by metis\n\n\n\n\nlemma case_trans_A4_to_write_8:\n shows \"pre_A4_inv s \\ T s\\H s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\con_assms s \\ inv s \\\n case_1 s\"\n using case_trans_A4_5 [where s=s] apply (simp add:case_1_def)\n by (simp add: pre_A4_inv_def)\n\n\nlemma case_trans_A4_to_write_9:\n shows \"pre_A4_inv s \\ T s\\H s \\ s'=(s\\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n offset := hW s, H := hW s + Data s (numEnqs s)\\) \\con_assms s \\ inv s \\\n case_1 s'\"\n apply(simp add:inv_def)\n using case_trans_A4_to_write_8 [where s=s] \n apply (meson case_split_2) apply(simp add:pre_A4_inv_def)\n apply(simp add:case_1_def)\n apply(intro conjI impI) prefer 2\n apply clarify\n apply(rule_tac ?x = \"T s\" in exI)\n apply(rule_tac ?x = b in exI) apply(intro conjI impI) prefer 2\n apply(rule_tac ?x = \"hW s\" in exI)\n apply(intro conjI impI)\n apply(linarith)\n apply(linarith)\n apply clarify apply(intro conjI impI) apply clarify\n apply linarith\n apply metis\n apply (metis le_neq_implies_less le_trans less_imp_le_nat)\n apply (metis le_eq_less_or_eq)\n apply blast\n apply (metis add_leE)\n apply blast\n apply blast\n apply blast\n apply (metis add_diff_cancel_left')\n apply meson\n apply meson\n apply (metis le_refl nat_less_le)\n apply (metis nat_less_le)\n apply (metis le_neq_implies_less)\n apply (metis le_refl nat_less_le)\n apply meson\n apply (metis nat_less_le)\n apply (metis le_antisym)\n apply blast\n by (metis (no_types, lifting) add.commute add_lessD1 less_diff_conv less_eqE less_imp_add_positive not_add_less1)\n\n\n\n\n\n\nlemma case_trans_A5_1:\n shows \"pre_A5_inv s \\ inv s\\ case_1 s\"\n apply (simp add: pre_A5_inv_def inv_def)\n by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A5_2:\n shows \"pre_A5_inv s \\ inv s\\ \\case_2 s\"\n apply (simp add: pre_A5_inv_def inv_def)\n by (metis case_split_2)\n\n\nlemma case_trans_A5_to_A6_1:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A6\\) \\con_assms s \\ inv s \\\n i\\N\\ownB s i=ownB s' i\"\n by(simp add:case_1_def pre_A5_inv_def inv_def)\n\n\nlemma case_trans_A5_to_A6_2:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A6\\) \\con_assms s \\ inv s \\\n case_1 s' = case_1 s\"\n by(simp add:case_1_def)\n\nlemma case_trans_A5_to_A6_3:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A6\\) \\con_assms s \\ inv s \\\n case_1 s'\"\n using case_trans_A5_to_A6_2 [where s=s and s'=s']\n using case_trans_A5_1 by blast\n\n\nlemma case_trans_A5_to_A6_4:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A7\\) \\con_assms s \\ inv s \\\n i\\N\\ownB s i=ownB s' i\"\n by(simp add:case_1_def pre_A5_inv_def inv_def)\n\nlemma case_trans_A5_to_A6_5:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A7\\) \\con_assms s \\ inv s \\\n case_1 s' = case_1 s\"\n by(simp add:case_1_def)\n\nlemma case_trans_A5_to_A6_6:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A7\\) \\con_assms s \\ inv s \\\n case_1 s'\"\n using case_trans_A5_to_A6_5 [where s=s and s'=s']\n using case_trans_A5_1 by blast\n\n\nlemma case_trans_A5_to_A6_7:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A8\\) \\con_assms s \\ inv s \\\n i\\N\\ownB s i=ownB s' i\"\n by(simp add:case_1_def pre_A5_inv_def inv_def)\n\n\nlemma case_trans_A5_to_A6_8:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A8\\) \\con_assms s \\ inv s \\\n case_1 s' = case_1 s\"\n by(simp add:case_1_def)\n\n\nlemma case_trans_A5_to_A6_9:\n shows \"pre_A5_inv s \\ s'=(s\\pcW := A8\\) \\con_assms s \\ inv s \\\n case_1 s'\"\n using case_trans_A5_to_A6_7 [where s=s and s'=s']\n by (metis case_trans_A2_to_A8_2 case_trans_A5_1)\n\n\nlemma case_trans_A6_1:\n shows \"pre_A6_inv s \\ inv s\\ case_1 s\"\n apply (simp add: pre_A6_inv_def inv_def) \n by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A6_2:\n shows \"pre_A6_inv s \\ inv s\\ case_2 s \\ False\"\n apply (simp add: pre_A6_inv_def inv_def)\n by (metis case_split_2)\n\n\n\nlemma case_trans_A6_to_write_1:\n shows \"pre_A6_inv s \\ s' = s\n \\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\\\inv s\\ H s'\\T s'\"\n by (simp add:pre_A6_inv_def inv_def)\n\nlemma case_trans_A6_to_write_2:\n shows \"pre_A6_inv s \\ s' = s\n \\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\\\inv s\\con_assms s\\ \\case_2 s'\"\n by (simp add:pre_A6_inv_def inv_def case_2_def)\n\nlemma case_trans_A6_to_write_3:\n shows \"pre_A6_inv s \\ s' = s\n \\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\\\inv s\\ con_assms s\\ (i\\hW s' \\ iownB s' i=W\"\n by (simp add:pre_A6_inv_def inv_def case_1_def)\n\nlemma case_trans_A6_to_write_4:\n shows \"pre_A6_inv s \\ s' = s\n \\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\\\inv s\\ con_assms s\\ (i\\H s'\\ iownB s' i=B\"\n by (simp add:pre_A6_inv_def inv_def case_1_def)\n\nlemma case_trans_A6_to_write_7:\n shows \"pre_A6_inv s \\ s' = s\n \\ownB := \\i. if hW s \\ i \\ i < hW s + Data s (numEnqs s) then W else ownB s i,\n pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\\\inv s\\ con_assms s\\ case_1 s'\"\n apply(subgoal_tac \"\\case_2 s\") prefer 2\n using case_trans_A6_to_write_2 [where s=s and s'=s']\n using case_trans_A6_2 apply blast\n apply (simp add:pre_A6_inv_def inv_def case_1_def)\n apply(intro conjI impI) \n apply (metis (no_types, lifting) add_le_cancel_left le_add_diff_inverse le_antisym less_imp_le_nat nat_neq_iff)\n apply clarify\n apply (rule_tac exI [where x =\"T s\"]) \n apply(rule_tac ?x = \"b\" in exI) apply (intro conjI impI)\n apply blast \n apply(rule_tac ?x = \"c\" in exI)\n apply (intro conjI impI)\n apply linarith\n apply linarith \n apply (metis le_trans nat_less_le)\n apply (metis le_trans nat_less_le)\n apply (metis le_trans nat_less_le)\n apply (metis F.distinct(17) F.distinct(23) le_refl nat_less_le nat_neq_iff)\n apply (metis)\n apply (metis le_trans nat_less_le)\n apply (metis le_neq_implies_less le_refl le_trans)\n apply (metis Nat.add_diff_assoc2 diff_self_eq_0 le_refl le_trans nat_less_le plus_nat.add_0)\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n by meson\n\n\nlemma case_trans_A7_1:\n shows \"pre_A7_inv s \\ inv s\\ case_1 s\"\n apply (simp add: pre_A7_inv_def inv_def) \n by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A7_2:\n shows \"pre_A7_inv s \\ inv s\\ case_2 s \\ False\"\n apply (simp add: pre_A7_inv_def inv_def)\n by (metis case_split_2)\n\nlemma case_trans_A7_to_write_1:\n shows \"pre_A7_inv s \\ s' = (s\\ownB :=\n \\i. if hW s \\ i \\ i < N then D\n else ownB (s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i\\) i,\n pcW := Write, offset := 0, H := Data s (numEnqs s)\\)\\inv s\\ H s' s' = (s\\ownB :=\n \\i. if hW s \\ i \\ i < N then D\n else ownB (s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i\\) i,\n pcW := Write, offset := 0, H := Data s (numEnqs s)\\)\\inv s\\con_assms s\\ \\case_1 s'\"\n by (simp add:pre_A7_inv_def inv_def case_1_def)\n \n\n\n\nlemma case_trans_A7_to_write_3:\n shows \"pre_A7_inv s \\ s' = (s\\ownB :=\n \\i. if hW s \\ i \\ i < N then D\n else ownB (s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i\\) i,\n pcW := Write, offset := 0, H := Data s (numEnqs s)\\)\\inv s\\ con_assms s\\ (i\\0 \\ iownB s' i=W\"\n by (simp add:pre_A7_inv_def inv_def case_2_def)\n\nlemma case_trans_A7_to_write_4:\n shows \"pre_A7_inv s \\ s' = (s\\ownB :=\n \\i. if hW s \\ i \\ i < N then D\n else ownB (s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i\\) i,\n pcW := Write, offset := 0, H := Data s (numEnqs s)\\)\\inv s\\ con_assms s\\ (i\\hW s\\ iownB s' i=D\"\n by (simp add:pre_A7_inv_def inv_def case_2_def)\n\nlemma case_trans_A7_to_write_7:\n shows \"pre_A7_inv s \\ s' = (s\\ownB :=\n \\i. if hW s \\ i \\ i < N then D\n else ownB (s\\ownB := \\i. if i < Data s (numEnqs s) then W else ownB s i\\) i,\n pcW := Write, offset := 0, H := Data s (numEnqs s)\\)\\inv s\\ con_assms s\\ case_2 s'\"\n apply(subgoal_tac \"\\case_2 s\") prefer 2\n using case_trans_A7_to_write_2 [where s=s and s'=s']\n using case_trans_A7_2 apply blast \n apply (simp add:pre_A7_inv_def inv_def) apply(thin_tac \"\\case_2 s\") apply(simp add:case_1_def case_2_def)\n \n apply clarify\n apply(rule_tac ?x = \"0\" in exI) \n apply(rule_tac ?x = \"0\" in exI) apply (intro conjI impI)\n apply blast \n apply(rule_tac ?x = \"Data s (numEnqs s)\" in exI)\n apply (intro conjI impI)\n apply linarith\n apply(rule_tac ?x = \"T s\" in exI)\n apply (intro conjI impI) \n apply linarith \n apply(rule_tac ?x = \"b\" in exI) \n apply (intro conjI impI) \n apply linarith \n apply(rule_tac ?x = \"c\" in exI) \n apply (intro conjI impI) \n apply linarith \n apply (metis le_trans)\n apply blast\n apply blast\n apply blast \n apply (metis le_antisym le_trans nat_less_le) \n apply (metis le_antisym le_trans nat_less_le)\n apply (metis le_antisym le_trans nat_less_le)\n apply (metis le_trans nat_le_linear nat_less_le)\n apply blast\n apply fastforce\n apply blast \n apply blast \n apply metis\n apply blast\n apply blast\n apply blast \n apply (metis diff_zero) \n apply force\n apply fastforce\n apply meson\n apply meson\n apply (metis add_implies_diff)\n apply meson\n apply force\n apply meson\n apply force\n apply fastforce\n apply meson\n apply meson\n by (metis le_neq_implies_less)\n \n\n\n\n\nlemma case_trans_Enqueue_to_idleW_case_1_1:\n shows \"pre_enqueue_inv s \\ inv s\\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\ H s\\T s\"\n apply (simp add: pre_enqueue_inv_def inv_def case_1_def) \n by (metis le_trans)\n\nlemma case_trans_Enqueue_to_idleW_case_1_2:\n shows \"pre_enqueue_inv s \\ inv s\\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\ H s'\\T s'\"\n apply (simp add: pre_enqueue_inv_def inv_def case_1_def) \n by (metis le_trans)\n\nlemma case_trans_Enqueue_to_idleW_case_1_3:\n shows \"pre_enqueue_inv s \\ inv s\\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\ iownB s i=ownB s' i\"\n by (simp add: pre_enqueue_inv_def inv_def case_1_def) \n\nlemma case_trans_Enqueue_to_idleW_case_1_4:\n shows \"pre_enqueue_inv s \\ inv s\\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\ i\\H s'\\ i\\N\\ownB s i=ownB s' i\"\n apply (simp add: pre_enqueue_inv_def inv_def case_1_def)\n by (metis F.distinct(5) F.distinct(9) nat_less_le)\n\nlemma case_trans_Enqueue_to_idleW_case_1_5:\n shows \"pre_enqueue_inv s \\ inv s\\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\ offset s \\ i \\ i < offset s + Data s (numEnqs s) \\Q=ownB s' i\"\n by (simp add: pre_enqueue_inv_def inv_def case_1_def tempW_def) \n\n\n\n\n\nlemma case_trans_Enqueue_to_idleW_case_1_6:\n shows \"pre_enqueue_inv s \\ inv s\\ q s = [] \\ s'= (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W \\ i \\ N then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\) \\case_1 s \\ con_assms s\n \\case_1 s'\"\n apply(simp add:inv_def)\n apply(subgoal_tac \"\\case_2 s \") prefer 2\n apply (meson case_split_5) apply(thin_tac \"\\ case_2 s\")\n apply (simp add: pre_enqueue_inv_def inv_def case_1_def tempW_def) \n apply clarify apply simp\n apply(rule_tac ?x = \"T s\" in exI)\n apply(rule_tac ?x = \"b\" in exI) apply (intro conjI impI)\n apply meson\n apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n apply (intro conjI impI)\n apply (metis F.distinct(5))\n apply (metis (mono_tags, hide_lams) le_trans less_or_eq_imp_le linorder_neqE_nat) \n apply (metis F.distinct(5)) \n apply (metis F.distinct(1))\n apply (metis le_trans less_or_eq_imp_le)\n apply (metis Suc_leI not_less_eq_eq)\n apply blast\n apply (metis less_irrefl_nat)\n apply (metis less_irrefl_nat)\n apply meson\n apply meson \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis F.distinct(1) F.distinct(5) Suc_pred bot_nat_0.not_eq_extremum diff_0_eq_0 diff_Suc_Suc diff_diff_cancel diff_diff_left diff_is_0_eq diff_is_0_eq' diff_self_eq_0 le_refl less_nat_zero_code linorder_neqE_nat nat_add_left_cancel_less nat_le_linear not0_implies_Suc old.nat.inject zero_less_Suc zero_less_diff)\n apply metis\n by metis\n \n \n\n\n\n\n\nlemma case_trans_Write_to_Enqueue_case_1:\n shows \"pre_write_inv s \\ inv s\\ s'=s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i,\n data_index :=\n \\x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n else data_index\n (s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i\\)\n x\\ \\case_1 s \\ con_assms s\n \\case_1 s'\"\n by (simp add:pre_write_inv_def case_1_def)\n\n\nlemma case_trans_Write_to_Enqueue_case_2:\n shows \"pre_write_inv s \\ inv s\\ s'=s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i,\n data_index :=\n \\x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n else data_index\n (s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i\\)\n x\\ \\case_2 s \\ con_assms s\n \\case_2 s'\"\n by (simp add:pre_write_inv_def case_2_def)\n\nlemma case_trans_Write_to_Enqueue_case_3:\n shows \"pre_write_inv s \\ inv s\\ s'=s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i,\n data_index :=\n \\x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n else data_index\n (s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i\\)\n x\\ \\case_1 s \\ case_2 s \\ con_assms s\n \\case_1 s' \\ case_2 s'\"\n by (simp add:pre_write_inv_def case_1_def case_2_def)\n\nlemma case_trans_Write_to_Enqueue_case_4:\n shows \" s'=s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i,\n data_index :=\n \\x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n else data_index\n (s\\numWrites := Suc (numWrites s), pcW := Enqueue,\n ownD :=\n \\i. if i = numWrites s then B\n else ownD (s\\numWrites := Suc (numWrites s), pcW := Enqueue\\) i\\)\n x\\ \n \\\\i::nat. ownB s i=ownB s' i \\ T s = T s' \\ H s = H s' \\ offset s = offset s' \\ tempR s=tempR s' \\ q s=q s'\"\n by simp \n\n(************************************* queue transition lemmas **************************************************)\n\n\n\nlemma peculiar_1:\n assumes \"Q_gap_structure s\"\n and \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\n shows \"fst(q s!1) = end(q s!0) \\ fst(q s!1) =0\"\n using assms apply(simp add:Q_gap_structure_def Q_offsets_differ_def Q_structure_def) \n by (metis One_nat_def diff_add_zero length_greater_0_conv length_tl less_numeral_extra(1) plus_1_eq_Suc zero_less_diff)\n \nlemma peculiar_2:\n assumes \"Q_gap_structure s\"\n and \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\n shows \"(end(hd(q s)) = fst(hd(tl(q s)))\\ fst(hd(tl(q s)))\\0) \\ fst(hd(tl(q s))) =0\"\n using assms apply(simp add:Q_gap_structure_def Q_offsets_differ_def Q_structure_def) \n by (metis Nitpick.size_list_simp(2) One_nat_def diff_add_zero hd_conv_nth less_Suc_eq_0_disj not_gr_zero nth_tl plus_1_eq_Suc)\n \nlemma peculiar_3:\n assumes \"Q_structure s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"(end(hd(q s)) = fst(hd(tl(q s)))\\ fst(hd(tl(q s)))\\0) \\ fst(hd(tl(q s))) =0\"\n using peculiar_1 peculiar_2 Q_structure_def Q_basic_struct_def \nproof -\n have \"Q_basic_struct s\"\nby (metis (no_types) Nil_tl Q_structure_def assms(1) assms(3))\nthen show ?thesis\nby (metis Nil_tl Q_basic_struct_def assms(3) peculiar_2)\nqed\n\nlemma peculiar_4:\n assumes \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(i i>0)\\fst(q s!0) \\ fst(q s!i)\"\n using assms by (simp add:Q_offsets_differ_def) \n\nlemma peculiar_5:\n assumes \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(i i>0)\\fst(hd(q s)) \\ fst(q s!i)\"\n using assms peculiar_4 \n by (simp add: peculiar_4 hd_conv_nth)\n\nlemma peculiar_6:\n assumes \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(ifst(hd(q s)) \\ fst(tl(q s)!i)\"\n using peculiar_4 peculiar_5 \n by (simp add: Q_head_relates_tail assms(1) assms(2) hd_conv_nth)\n\nlemma peculiar_7:\n assumes \"Q_offsets_differ s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(i<(length((q s))-1))\\fst(hd(q s)) \\ fst(tl(q s)!i)\"\n using assms peculiar_6 \n by (simp add: peculiar_6)\n\nlemma peculiar_8:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\x.(x\\set(q s) \\ x\\hd(q s) \\ fst(hd(q s))end(hd(q s))\\fst(x)\"\n using assms Q_has_no_overlaps_def Q_has_no_uroboros_def\n using hd_in_set by blast\n\nlemma peculiar_9:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\x.(x\\set(tl(q s)) \\ fst(hd(q s))end(hd(q s))\\fst(x)\"\n using peculiar_8 \n by (metis assms(1) assms(2) assms(3) assms(4) dual_order.irrefl list.set_sel(2))\n\nlemma peculiar_10:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(i<(length(q s)-1) \\ fst(hd(q s))end(hd(q s))\\fst(tl(q s)!i)\"\n by (metis assms(1) assms(2) assms(3) assms(4) length_tl nth_mem peculiar_9)\n\nlemma peculiar_11:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\x.(x\\set(q s) \\ x\\hd(q s) \\ fst(hd(q s))>fst(x))\\fst(hd(q s))\\end(x)\"\n using assms Q_has_no_overlaps_def Q_has_no_uroboros_def \n using hd_in_set by blast\n\nlemma peculiar_12:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\x.(x\\set(tl(q s)) \\ fst(hd(q s))>fst(x))\\fst(hd(q s))\\end(x)\"\n using assms Q_has_no_overlaps_def peculiar_11 \n by (metis list.set_sel(2))\n\nlemma peculiar_13:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i.(i<(length(q s)-1) \\ fst(hd(q s))>fst(tl(q s)!i))\\fst(hd(q s))\\end(tl(q s)!i)\"\n using assms peculiar_12 \n by (metis length_tl nth_mem)\n\nlemma peculiar_14:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"(\\i.(i<(length(q s)-1) \\ fst(hd(q s))>fst(tl(q s)!i))\\fst(hd(q s))\\end(tl(q s)!i))\n \\(\\i.(i<(length(q s)-1) \\ fst(hd(q s))end(hd(q s))\\fst(tl(q s)!i))\"\n using peculiar_13 peculiar_10 \n using assms(1) assms(2) assms(3) assms(4) by blast\n\nlemma peculiar_15:\n assumes \"Q_has_no_overlaps s\"\n and \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i\n fst (hd (q s)) + snd (hd (q s)) \\ fst (tl (q s) ! i)) \\\n (fst (tl (q s) ! i) < fst (hd (q s)) \\\n fst (tl (q s) ! i) + snd (tl (q s) ! i) \\ fst (hd (q s)))\"\n using peculiar_14 \n by (metis One_nat_def assms(1) assms(2) assms(3) assms(4) end_simp)\n\n\nlemma peculiar_16:\n assumes \"Q_structure s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i\n fst (hd (q s)) + snd (hd (q s)) \\ fst (tl (q s) ! i)) \\\n (fst (tl (q s) ! i) < fst (hd (q s)) \\\n fst (tl (q s) ! i) + snd (tl (q s) ! i) \\ fst (hd (q s)))\"\n using peculiar_15 Q_structure_def \n using Q_basic_struct_def assms(1) assms(2) assms(3) by auto\n\nlemma peculiar_17 :\n assumes \"inv s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"\\i\n fst (hd (q s)) + snd (hd (q s)) \\ fst (tl (q s) ! i)) \\\n (fst (tl (q s) ! i) < fst (hd (q s)) \\\n fst (tl (q s) ! i) + snd (tl (q s) ! i) \\ fst (hd (q s)))\"\n using peculiar_16 inv_def Q_structure_def \n using assms(1) assms(2) assms(3) by blast\n\nlemma peculiar_18:\n assumes \"Q_has_no_uroboros s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"fst (q s!0) \\ end (last (q s))\"\n using Q_has_no_uroboros_def \n by (metis assms(1) assms(2) assms(3) butlast.simps(2) list.exhaust_sel list.set_intros(1) nth_Cons_0)\n\nlemma peculiar_19:\n assumes \"Q_structure s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"fst (q s!0) \\ end (last (q s))\"\n using Q_has_no_uroboros_def Q_structure_def peculiar_18 \n using Q_basic_struct_def assms(1) assms(2) assms(3) by blast\n\nlemma peculiar_20:\n assumes \"Q_structure s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"fst (hd(q s)) \\ end (last (q s))\"\n using peculiar_19\n by (metis assms(1) assms(2) assms(3) hd_conv_nth)\n\nlemma peculiar_21:\n assumes \"Q_structure s\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"fst (hd(q s)) \\ end (last (tl(q s)))\"\n using peculiar_20\n by (metis assms(1) assms(2) assms(3) last_tl)\n\nlemma peculiar_22:\n assumes \"Q_structure s\"\n and \"tempR_structure s\"\n and \"fst(tempR s) =0\"\nshows \"\\i.(i i>0)\\fst(q s!i) = end(q s!(i-1))\"\n using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n by (metis length_0_conv less_nat_zero_code)\n\nlemma peculiar_23:\n assumes \"Q_structure s\"\n and \"tempR_structure s\"\n and \"fst(tempR s) =0\"\nshows \"\\i.(ifst(q s!i) >0\"\n using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n by (metis length_0_conv less_nat_zero_code)\n\nlemma peculiar_24:\n assumes \"Q_structure s\"\n and \"tempR_structure s\"\n and \"fst(tempR s) =0\"\n and \"q s\\[]\" and \"tl(q s)\\[]\"\nshows \"fst(q s!0) =end(tempR s)\"\n using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n by (metis hd_conv_nth length_greater_0_conv zero_less_iff_neq_zero)\n\nlemma peculiar_25:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\nshows \"\\i.(ii>0)\\fst(q s!i) = end(q s!(i-1))\"\n using assms \n by (metis Q_hd_zero_implies_structure)\n\nlemma peculiar_26:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\nshows \"\\i.(ii>0)\\(q s!i) = (tl(q s)!(i-1))\"\n using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n by (metis Nitpick.size_list_simp(2) Suc_pred add_less_cancel_left list.sel(2) nth_tl plus_1_eq_Suc)\n\n\nlemma peculiar_27:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\nshows \"\\i.(ii>1)\\fst(tl(q s)!(i-1)) = end(tl(q s)!(i-2))\"\n using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n by (smt (verit, ccfv_SIG) Nitpick.size_list_simp(2) Suc_diff_Suc add_less_cancel_left assms(1) assms(2) diff_less less_trans_Suc list.sel(2) nth_tl numeral_1_eq_Suc_0 numeral_2_eq_2 numerals(1) peculiar_26 peculiar_5 plus_1_eq_Suc zero_less_two)\n\n\n\n\nlemma peculiar_28:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"Q_has_no_uroboros s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\n and \"butlast(tl(q s))\\[]\"\nshows \"last(tl(q s)) =last(q s)\"\n using assms \n by (simp add: last_tl)\n\n\n\nlemma peculiar_29:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"Q_has_no_uroboros s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\n and \"butlast(tl(q s))\\[]\"\nshows \"\\i.(i(tl(q s)!i) = (q s!(i+1))\"\n using assms \n by (simp add: peculiar_26)\n\nlemma peculiar_30:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"Q_has_no_uroboros s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\n and \"butlast(tl(q s))\\[]\"\nshows \"end(last(q s)) = end(last(tl(q s)))\"\n using assms \n by (simp add: last_tl)\n\n\nlemma peculiar_31:\n assumes \"Q_offsets_differ s\"\n and \"Q_gap_structure s\"\n and \"Q_has_no_uroboros s\"\n and \"fst(hd(q s)) =0\"\n and \"tl(q s)\\[]\"\n and \"butlast(tl(q s))\\[]\"\nshows \"\\i.(i<(length(tl(q s))-1))\\fst(tl(q s)!i) \\end(last(tl(q s)))\"\n using assms peculiar_30 peculiar_29 apply simp\n unfolding Q_lemmas Q_basic_lemmas apply safe apply(subgoal_tac \"last(tl(q s)) =(tl(q s)!(length(tl(q s))-1))\")\n prefer 2 \n apply (simp add: last_conv_nth) apply simp\n by (metis One_nat_def Suc_eq_plus1 Suc_lessD assms(5) diff_Suc_eq_diff_pred in_set_conv_nth last_tl length_butlast length_tl less_diff_conv nth_butlast nth_tl prod.exhaust_sel)\n\n\n\nlemma tail_preserves_struct:\n \"Q_gap_structure s \\ fst (q s ! 0) = 0 \\\\ i . i snd(q s ! i) > 0 \\\n Q_offsets_differ s \\ length(q s)>0 \\\n\\ i . (i i>0)\\ fst(q s ! i) > fst (q s ! 0)\"\n apply(simp add:Q_gap_structure_def Q_offsets_differ_def)\n by (metis gr_implies_not_zero not_gr_zero)\n\n\nlemma queue_is_finite_set:\n assumes \"con_assms s\"\n and \"Q_structure s\"\nshows \"\\a b.((a,b)\\set(q s))\\(\\i.(i (a, b) =(q s!i)))\"\n using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n by (metis in_set_conv_nth)\n \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows inv s'*************************************)\n\n\nlemma W_inv_A1_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A1\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def)\n apply (intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\")\n apply(simp add:case_1_def)\n apply(simp add:case_2_def)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\nlemma W_inv_A2_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A2\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def)\n apply(case_tac \"tW s = hW s\", simp_all)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (elim conjE disjE)\n apply(case_tac \"case_1 s'\") \n using case_trans_A2_to_A3_2 [where s=s]\n apply blast \n using \\\\s'. \\s' = s\\ownT := W, pcW := A3\\; T s = H s; case_1 s\\ \\ case_1 s'\\ apply presburger\n apply (metis case_split_2 le_refl)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (elim conjE disjE)\n apply(subgoal_tac \"\\case_1 s\") prefer 2\n apply (metis case_split_4 less_eqE trans_less_add1)\n apply meson\n apply(subgoal_tac \"case_2 s'\")\n apply blast apply simp\n using case_trans_A2_to_A4_3 [where s=s]\n apply (meson case_split_2 not_less)\n apply (metis case_trans_A2_to_A4_2)\n apply (metis case_split_2)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(case_tac \"tW s < hW s\", simp_all)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis case_split_2 case_trans_A2_to_A5_2)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (elim conjE disjE)\n apply (metis case_split_4 less_eqE linorder_neqE_nat trans_less_add1)\n apply (metis case_split_2 case_trans_A2_to_A8_4 linear nat_less_le)\n apply (metis case_trans_A2_to_A8_2)\n apply (metis case_split_2)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\nlemma W_inv_A3_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A3\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A3_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas) defer\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n apply(subgoal_tac \"case_1 s\") prefer 2 \n apply (metis RingBuffer_BD_latest_2.case_split le_refl)\n apply(subgoal_tac \"\\case_2 s'\") prefer 2 \n using case_trans_A3_to_write_2 [where s=s and s'=s'] \n apply (simp add: assms(1) pre_A3_inv_def)\n apply simp\n using case_trans_A3_to_write_7 [where s=s]\n by (simp add: assms(1) pre_A3_inv_def)\n\n\nlemma W_inv_A4_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A4\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def)\n apply(intro conjI impI) apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n apply (simp add: less_diff_conv) apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas) defer apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 canonically_ordered_monoid_add_class.lessE less_diff_conv) \n apply(case_tac \"T s\\tW s\")\n apply(subgoal_tac \"case_2 s'\") prefer 2 \n using case_trans_A4_to_write_7 [where s=s and s'=s'] \n apply (simp add: assms(1) assms(2) pre_A4_inv_def)\n apply meson \n using case_trans_A4_to_write_9 [where s=s and s'=s'] \n using assms(1) pre_A4_inv_def by auto\n\n\n\nlemma W_inv_A5_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A5\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def)\n apply(case_tac \"Data s (numEnqs s) \\ N - hW s\", simp_all) defer\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all) defer defer\n apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n prefer 2 \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n prefer 2 \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n prefer 2 \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n using case_trans_A5_to_A6_3 [where s=s and s'=s'] \n apply (metis PCW.simps(187) assms(1) assms(2) assms(4) pre_W_def)\n using case_trans_A5_to_A6_6 [where s=s and s'=s']\n apply (simp add: assms(1) pre_A5_inv_def)\n using case_trans_A5_to_A6_9 [where s=s and s'=s']\n by (metis case_split_2 case_trans_A2_to_A8_2)\n\n\n\nlemma W_inv_A6_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A6\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A6_inv_def)\n apply(intro conjI impI)\n apply (metis Nat.le_diff_conv2 add.commute)\n apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) prefer 2 \n using case_trans_A6_to_write_7 [where s=s and s'=s']\n apply (metis (no_types, lifting) PCW.simps(188) assms(1) assms(2) assms(4) pre_W_def)\n by (smt (z3) F.distinct(19) diff_add_inverse le_diff_iff le_neq_implies_less le_trans less_imp_add_positive less_or_eq_imp_le not_add_less1)\n\n\n\nlemma W_inv_A7_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A7\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A7_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n using case_trans_A7_to_write_7 [where s=s and s'=s'] \n by (metis (no_types, lifting) PCW.simps(189) assms(1) assms(2) assms(4) pre_W_def)\n \n\n\n\n\nlemma W_inv_A8_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A8\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A8_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply (metis leD)\n apply (metis leD)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n apply(simp add:case_2_def)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\n\nlemma W_inv_Enqueue_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = Enqueue\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n apply(intro conjI impI)\n apply (metis Suc_diff_le length_0_conv)\n defer\n defer \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(simp add:tempW_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:case_1_def) apply clarify apply(intro conjI impI)\n apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n apply (metis (mono_tags, hide_lams) F.distinct(5) F.distinct(9) le_antisym less_Suc_eq_le minus_nat.diff_0 not_less_eq plus_nat.add_0)\n apply(subgoal_tac \"i ownB s i=W\\offset s\\i \\ iN \\ ownB s i=W\\i>offset s + Data s (numEnqs s)\")\n apply (metis (no_types, lifting) diff_is_0_eq le_eq_less_or_eq linorder_neqE_nat zero_less_diff)\n apply(subgoal_tac \"end(tempW s)\\N\", unfold tempW_def)[1] prefer 2\n apply (metis end_simp fst_conv snd_conv) \n apply (metis (no_types, lifting) less_trans_Suc nat_less_le nat_neq_iff not_less_eq_eq)\n apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\case_1 s\")[1]\n prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:case_2_def) apply clarify \n using Suc_diff_le apply presburger\n defer defer\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply clarify\n apply(intro conjI impI)\n apply(rule_tac ?x = \"{i. offset s \\ i \\ i < offset s + Data s (numEnqs s)}\" in exI)\n apply (intro conjI impI)\n apply metis\n apply(case_tac \"case_1 s\") apply(simp)\n apply(simp add:case_1_def) apply clarify apply(intro conjI impI)\n apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n apply (metis (no_types, lifting) Suc_le_lessD fst_conv not_less_eq_eq snd_conv tempW_def)\n apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\case_1 s\")[1]\n prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:case_2_def) apply clarify \n apply (intro conjI impI)\n apply (metis le_eq_less_or_eq nat_le_linear)\n apply(subgoal_tac \"i\\H s\\iownB s i=B\") prefer 2\n apply metis\n apply(subgoal_tac \"i\\T s\\iownB s i=R\") prefer 2\n apply metis\n apply(subgoal_tac \"i\\e\\iownB s i=Q\") prefer 2\n apply metis\n apply(subgoal_tac \"i\\f\\iownB s i=D\") prefer 2\n apply metis\n apply(subgoal_tac \"i\\H s\\iownB s i\\W\") prefer 2 \n apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) diff_is_0_eq neq0_conv zero_less_diff)\n apply (metis (no_types, lifting) diff_is_0_eq gr0I zero_less_diff)\n apply(clarsimp)\n apply(intro iffI)\n apply clarify apply simp\n apply(case_tac \"(a, b) \\ set (q s)\") apply simp \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"(i\\N \\ ownB s i\\Q)\\(\\a b. ((a,b)\\set(q s)\\ a\\i \\ i b = Data s (numEnqs s)\") prefer 2\n apply meson\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply clarify apply simp\n apply(subgoal_tac \"ownB s i=Q \\ i\\N\\(\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x)\")\n prefer 2 \n apply presburger\n apply simp\n apply metis\n apply clarify\n\n\n sorry\n\n\n\n\n\nlemma W_inv_idleW_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = idleW\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_acquire_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply (metis leD)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n apply(simp add:case_2_def)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n apply(subgoal_tac \"case_2 (s\\pcW := FinishedW\\)\")\n apply blast apply simp apply(thin_tac \"\\ case_1 s \") \n apply(simp add:case_2_def)\n prefer 2 \n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply clarify\n apply(rule_tac ?x = \"a\" in exI)\n apply(rule_tac ?x = \"b\" in exI)\n apply(intro conjI impI) apply metis\n apply(rule_tac ?x = \"H s\" in exI)\n apply(intro conjI impI) \n apply blast\n apply(rule_tac ?x = \"T s\" in exI)\n apply(intro conjI impI) \n apply blast\n apply(rule_tac ?x = \"e\" in exI)\n apply(intro conjI impI) \n apply blast\n apply(rule_tac ?x = \"f\" in exI)\n apply(intro conjI impI) \n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast\n apply blast \n apply meson\n apply metis\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n apply meson\n by meson\n\n\n\n\n\n\n\nlemma W_inv_OOM_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = OOM\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply(simp add:case_2_def)\n apply(case_tac \"tW s \\ T s\", simp_all)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\n\nlemma W_inv_FinishedW_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = FinishedW\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\n\n\n\nlemma W_inv_Write_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = Write\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms apply simp\n apply(subgoal_tac \"case_1 s \\ case_2 s\") prefer 2 using inv_def pre_W_def\n apply blast\n apply(subgoal_tac \"pre_write_inv s\") prefer 2 using inv_def pre_W_def assms\n apply (metis PCW.simps(195))\n apply(simp add:pre_W_def cW_step_def)\n apply(simp add:inv_def)\n apply(intro conjI impI) \n apply (simp add: pre_write_inv_def) defer\n apply (simp add: pre_write_inv_def) defer defer defer \n apply(subgoal_tac \"case_1 s' \\ case_2 s'\")\n apply meson using case_trans_Write_to_Enqueue_case_3 [where s=s and s'=s']\n using assms(1) assms(2) apply blast\n apply(simp add:Q_indices_def ran_indices_def Q_owns_bytes_def)\n sorry\n\n\n\n\nlemma W_inv_BTS_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = BTS\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\" \nshows \"inv s'\"\n using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\n\n\n\nlemma local_pre_W_inv: \n assumes \"con_assms s\"\n and \"pcw = pcW s\"\n and \"pre_W pcw s\"\n and \"inv s\"\n and \"cW_step pcw s s'\"\nshows \"inv s'\"\n using assms apply(case_tac \"pcW s\") \n using W_inv_A1_lemma [where s=s and s'=s'] apply blast\n using W_inv_A2_lemma [where s=s and s'=s'] apply blast\n using W_inv_A3_lemma [where s=s and s'=s'] apply blast\n using W_inv_A4_lemma [where s=s and s'=s'] apply blast\n using W_inv_A5_lemma [where s=s and s'=s'] apply blast\n using W_inv_A6_lemma [where s=s and s'=s'] apply blast \n using W_inv_A7_lemma [where s=s and s'=s'] apply blast\n using W_inv_A8_lemma [where s=s and s'=s'] apply blast \n using W_inv_Enqueue_lemma [where s=s and s'=s'] apply blast (*hard- Queue*)\n using W_inv_idleW_lemma [where s=s and s'=s'] apply blast \n using W_inv_OOM_lemma [where s=s and s'=s'] apply blast \n using W_inv_FinishedW_lemma [where s=s and s'=s'] apply blast \n using W_inv_Write_lemma [where s=s and s'=s'] apply blast (*Queue*)\n using W_inv_BTS_lemma [where s=s and s'=s'] by blast \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows preW*************************************)\n\n\nlemma W_local_A1_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A1\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n by(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def pre_A2_inv_def)\n\nlemma W_local_A2_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A2\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def pre_A3_inv_def)\n apply(case_tac \"tW s = hW s\") apply simp_all \n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\") \n apply(simp_all add: pre_A4_inv_def)\n apply metis\n apply(case_tac \"tW s < hW s\", simp_all) \n apply(simp add:pre_A5_inv_def) \n apply(simp add:pre_A8_inv_def)\n by metis\n\n\n\n\nlemma W_local_A3_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A3\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:inv_def pre_W_def cW_step_def pre_A3_inv_def pre_write_inv_def)\n by(simp add:tempW_lemmas tempW_basic_lemmas)\n\n\n\nlemma W_local_A4_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A4\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def pre_write_inv_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(intro conjI impI)\n apply (simp add: less_diff_conv)\n apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\case_2 s\") apply simp \n apply(thin_tac \"\\ case_2 s\")\n apply(simp add:case_1_def)\n apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq length_0_conv less_nat_zero_code)\n apply (metis case_split_5)\n apply(subgoal_tac \"case_2 s\") apply simp \n apply(thin_tac \"\\case_1 s\") \n apply(simp add:case_2_def) \n apply (metis (no_types, lifting) add_diff_cancel_left' cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq diff_zero le_trans length_greater_0_conv nat_less_le)\n apply (metis)\n apply(simp add:Q_lemmas Q_basic_lemmas tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\case_2 s\") apply simp\n apply(thin_tac \"\\ case_2 s\")\n apply(simp add:case_1_def)\n apply (metis (no_types, hide_lams) diff_is_0_eq' le_eq_less_or_eq length_pos_if_in_set nth_mem prod.exhaust_sel zero_less_diff)\n apply (metis case_split_5)\n apply(subgoal_tac \"case_2 s\") apply simp \n apply(thin_tac \"\\case_1 s\") \n apply(simp add:case_2_def)\n apply clarify \n apply(subgoal_tac \"ownB s (H s) \\ Q\") prefer 2 \n apply (metis F.distinct(19) le_refl)\n apply(subgoal_tac \"\\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\") prefer 2\n apply blast\n apply(subgoal_tac \"i snd(q s!i) > 0\") prefer 2\n apply (metis nth_mem prod.collapse)\n apply(subgoal_tac \"hW s = end(last(q s))\") prefer 2 \n apply (metis add.commute add_diff_inverse_nat diff_is_0_eq' end_simp le_eq_less_or_eq le_trans minus_nat.diff_0 nat_less_le)\n apply (metis end_simp nth_mem prod.collapse)\n apply metis\n apply(simp add:Q_lemmas Q_basic_lemmas) (*doable*)\n defer \n apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\case_2 s\") apply simp \n apply(thin_tac \"\\ case_2 s\")\n apply(simp add:case_1_def)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply (metis (no_types, lifting) add_leD1 cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv)\n apply (metis case_split_5)\n apply(subgoal_tac \"case_2 s\") apply simp \n apply(thin_tac \"\\case_1 s\") \n apply(simp add:case_2_def)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(clarify)\n apply(case_tac \"fst(hd(q s)) = 0\") \n apply (metis add_is_0)\n apply(subgoal_tac \"fst(hd(q s)) = e\") prefer 2\n apply (metis (no_types, lifting) add_diff_cancel_right' add_lessD1 cancel_comm_monoid_add_class.diff_cancel le_neq_implies_less length_greater_0_conv not_add_less1 ordered_cancel_comm_monoid_diff_class.add_diff_inverse)\n apply(subgoal_tac \"hW s fst(hd(q s))\") prefer 2\n apply meson\n apply(subgoal_tac \"d> Data s (numEnqs s) + hW s \") prefer 2 \n apply (metis add.commute less_add_same_cancel2)\n apply(subgoal_tac \"d=e\") prefer 2 \n apply (metis less_add_same_cancel1)\n apply (metis not_add_less2)\n apply blast\n apply(clarify)\n apply(intro conjI impI)\n apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\case_2 s\") apply simp \n apply(thin_tac \"\\ case_2 s\")\n apply(simp add:case_1_def)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(subgoal_tac \"\\j. j hW s > fst(q s!j)\")\n apply (metis Suc_lessD less_natE not_add_less1)\n apply(subgoal_tac \"\\ a b j. ((a,b)\\set(q s) \\ a\\j \\ j ownB s (j) = Q\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(clarify)\n apply(subgoal_tac \"\\i.(ownB s i=Q \\ i\\N) \\ ii.(i ownB s (fst(q s!0)) = Q\") prefer 2\n apply (metis cancel_comm_monoid_add_class.diff_cancel hd_conv_nth le_eq_less_or_eq less_nat_zero_code)\n apply(subgoal_tac \"c\\hW s\") prefer 2\n apply blast\n apply(subgoal_tac \"fst(q s!j) + snd(q s!j) \\N\") prefer 2 \n apply (metis nth_mem prod.collapse)\n apply(subgoal_tac \"fst(q s!j) \\N\") prefer 2 \n apply (metis add_leD1)\n apply (metis (no_types, lifting) le_eq_less_or_eq less_add_same_cancel1 nth_mem prod.collapse)\n apply (metis case_split_5)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\case_2 s\") apply simp \n apply (metis case_split_5)\n apply(simp add:case_2_def)\n apply(thin_tac \"\\ case_1 s\")\n apply clarify\n apply(case_tac \"H s \\ T s\") \n apply (metis le_imp_less_Suc less_or_eq_imp_le not_less_eq)\n apply(subgoal_tac \"H s < T s \") prefer 2\n apply metis\n apply(thin_tac \"\\ T s \\ H s\")\n apply(subgoal_tac \"\\i.(hW s \\i \\ i ownB s i = B\") prefer 2 \n apply (metis (no_types, lifting) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n apply(case_tac \"e=f\") \n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N)\\ia b j.((a,b)\\set(q s) \\ a\\j \\ jownB s j = Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\i. i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2\n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\i. (i (\\a b. ((a,b)\\set(q s) \\ a=fst(q s!i) \\ b = snd(q s!i)))\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"\\i. i ownB s (fst(q s!i)) = Q\") prefer 2 \n apply (metis (no_types, hide_lams))\n apply(subgoal_tac \"\\i.(i fst(q s!i) < N)\\ fst(q s!i)N\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse)\n apply(subgoal_tac \"\\i.(i fst(q s!i)a b j.((a,b)\\set(q s) \\ a\\j \\ jownB s j = Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\i. i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2\n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\i. (i (\\a b. ((a,b)\\set(q s) \\ a=fst(q s!i) \\ b = snd(q s!i)))\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"\\i. i ownB s (fst(q s!i)) = Q\") prefer 2 \n apply (metis (no_types, hide_lams))\n apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\N\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse)\n apply(subgoal_tac \"fst(q s!i) \\e\") \n apply (metis (no_types, lifting) F.distinct(19) add.commute less_diff_conv less_or_eq_imp_le linorder_neqE_nat)\n apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) bot_nat_0.not_eq_extremum diff_is_0_eq diff_self_eq_0 zero_less_diff)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply clarify \n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ jownB s j = Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\i. i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2\n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\i. (i (\\a b. ((a,b)\\set(q s) \\ a=fst(q s!i) \\ b = snd(q s!i)))\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j\\a+b-1)\\ownB s j = Q\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a+b\\hW s\")\n apply (metis (no_types, lifting) less_or_eq_imp_le)\n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N) \\ ia b.((a,b)\\set(q s))\\a+b\\N\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\b>0\") prefer 2\n apply blast\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s) \\ a\\a+b-1 \\ a+b-1\\a+b-1)\\ownB s (a+b-1) = Q\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a\\a+b-1 \\ a+b-1\\a+b-1\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\ownB s (a+b-1) = Q\") prefer 2 \n apply (metis (no_types, lifting))\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a+b-1 a b.((a,b)\\set(q s))\\a+b-1 c\") prefer 2\n apply blast\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a+b-1 case_1 s\")\n apply(clarify)\n apply(case_tac \"e=f\") \n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N)\\ia b j.((a,b)\\set(q s) \\ a\\j \\ jownB s j = Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j\\a+b-1)\\ownB s j = Q\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n apply(subgoal_tac \"\\i. i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ b>0\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a\\a+b-1 \\ a+b-1\\a+b\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 diff_le_self less_Suc_eq_le less_add_same_cancel1)\n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ ownB s (a+b-1) = Q\") prefer 2\n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\i. (i (\\a b. ((a,b)\\set(q s) \\ a=fst(q s!i) \\ b = snd(q s!i)))\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"\\i. i ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n apply (metis (no_types, lifting))\n apply(subgoal_tac \"\\i.(i fst(q s!i)+snd(q s!i)-1 \\ N)\\ fst(q s!i)+snd(q s!i)-1N\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse)\n apply(subgoal_tac \"fst(q s!i) + snd(q s!i)-1\\N\") prefer 2 \n apply linarith\n apply(subgoal_tac \"i hW s\") \n apply linarith\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ jownB s j = Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j\\a+b-1)\\ownB s j = Q\") prefer 2 \n apply (metis Suc_pred' add_gr_0 le_imp_less_Suc)\n apply(subgoal_tac \"\\i. i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2\n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\a b. (a,b)\\set(q s) \\ b>0\") prefer 2\n apply meson\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s))\\a\\a+b-1\\ a+b-1\\a+b-1\") prefer 2 \n apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s))\\ownB s (a+b-1) = Q\") prefer 2 \n apply (metis (no_types, lifting))\n apply(subgoal_tac \"\\i. (i (\\a b. ((a,b)\\set(q s) \\ a=fst(q s!i) \\ b = snd(q s!i)))\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"\\i. i ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n apply (metis (no_types, hide_lams))\n apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\N\") prefer 2 \n apply (metis less_add_same_cancel1 prod.collapse) \n apply(subgoal_tac \"fst(q s!i) < hW s\") prefer 2 \n apply blast\n by (metis (no_types, hide_lams) F.distinct(19) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\n\n \n\n\nlemma W_local_A5_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A5\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def pre_write_inv_def)\n apply(case_tac \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(simp_all add: pre_A6_inv_def)\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n apply(simp_all add: pre_A7_inv_def) \n by(simp_all add: pre_A8_inv_def)\n\n\nlemma W_local_A6_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A6\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_A6_inv_def)\n apply(subgoal_tac \"H s\\T s\") prefer 2 \n apply meson apply(subgoal_tac \"\\case_2 s\") prefer 2\n apply (metis case_split_2)\n apply(subgoal_tac \"case_1 s\") prefer 2\n apply blast\n apply(thin_tac \"\\case_2 s\") \n apply(simp add:pre_write_inv_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(intro conjI impI)\n apply (metis Nat.le_diff_conv2 add.commute)\n apply(simp add:case_1_def)\n apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv)\n apply (metis (no_types, hide_lams) F.distinct(19) Q_owns_bytes_def diff_self_eq_0 le_eq_less_or_eq less_nat_zero_code ran_indices_lem5)\n apply(simp add:case_1_def)\n defer\n apply(simp add:case_1_def)\n apply (metis (no_types, lifting) cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv trans_le_add1)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(subgoal_tac \"hW s = H s\") prefer 2 \n apply presburger\n apply(clarify)\n apply(intro conjI impI)\n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N)\\ia b j.((a,b)\\set(q s)\\a \\ j \\ j ownB s j = Q\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2 \n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ aa b.(a,b)\\set(q s) \\ ai.(ownB s i = Q \\ i\\N)\\ia b j.((a,b)\\set(q s)\\a \\ j \\ j ownB s j = Q\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s)\\a \\ a+b-1 \\ a+b-1a b.(a,b)\\set(q s) \\ ownB s (a+b-1) = Q\") prefer 2\n apply (metis (no_types, lifting))\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s) \\ a=fst(q s!i) \\ b=Data s (numDeqs s + i))\") prefer 2\n apply (metis nth_mem prod.collapse)\n by (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\n\n\nlemma W_local_A7_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A7\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_A7_inv_def)\n apply(subgoal_tac \"H s\\T s\") prefer 2 \n apply meson apply(subgoal_tac \"\\case_2 s\") prefer 2\n apply (metis case_split_2)\n apply(subgoal_tac \"case_1 s\") prefer 2\n apply blast\n apply(thin_tac \"\\case_2 s\") \n apply(simp add:pre_write_inv_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(intro conjI impI)\n apply (metis (no_types, hide_lams) F.distinct(19) Q_owns_bytes_def bot_nat_0.not_eq_extremum less_nat_zero_code ran_indices_lem5)\n apply(simp add:case_1_def) \n defer\n apply(simp add:case_1_def)\n apply (metis F.distinct(19) cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq le_neq_implies_less le_zero_eq length_0_conv)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(subgoal_tac \"hW s = H s\") prefer 2 \n apply presburger\n apply(clarify)\n apply(subgoal_tac \"\\i.(ownB s i = Q \\ i\\N)\\i\\b\") prefer 2 \n apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n apply(subgoal_tac \"\\a b j.((a,b)\\set(q s)\\a \\ j \\ j ownB s j = Q\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ ownB s (a) = Q\") prefer 2 \n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ ai.(i\\Data s (numEnqs s))\\ownB s i = B\") prefer 2 \n apply (metis add_lessD1 nat_le_iff_add)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ a>Data s (numEnqs s)\") prefer 2\n apply (metis F.distinct(19) Suc_le_lessD not_less_eq_eq)\n by (metis nth_mem prod.collapse)\n \n \n\n\n\nlemma W_local_A8_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = A8\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_A8_inv_def)\n apply(case_tac \"N < Data s (numEnqs s)\") \n apply (metis leD) apply(intro conjI impI) \n apply linarith apply(simp add:pre_OOM_inv_def) apply(intro conjI impI)\n defer \n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply metis\n apply meson apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply metis\n apply(simp add:case_2_def)\n by (metis le_antisym less_or_eq_imp_le)\n\n\n\n\n\nlemma W_local_Enqueue_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = Enqueue\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_enqueue_inv_def)\n apply(intro conjI impI) \n apply(simp add:pre_acquire_inv_def) apply(intro conjI impI)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis F.distinct(5) eq_imp_le less_add_same_cancel1)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply clarify\n apply(intro conjI impI)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply (metis add_cancel_left_left less_imp_le_nat old.prod.inject prod.collapse tempW_def)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:pre_acquire_inv_def)\n apply(intro conjI impI) \n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n by (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq' less_or_eq_imp_le)\n\n\n\nlemma W_local_idleW_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = idleW\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_acquire_inv_def) \n apply(case_tac \" numEnqs s < n\", simp_all)\n apply(simp add: pre_A1_inv_def) \n apply blast\n by(simp add: pre_finished_inv_def) \n\n\n\nlemma W_local_OOM_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = OOM\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:cW_step_def pre_W_def)\n apply(simp add:inv_def pre_OOM_inv_def)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(simp add:inv_def pre_acquire_inv_def)\n apply(case_tac \"case_1 s\") apply(simp ) apply(simp add:case_1_def)\n apply(intro conjI impI) \n apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat)\n apply (metis le_neq_implies_less le_refl)\n apply (metis diff_self_eq_0 le_neq_implies_less le_refl le_zero_eq length_0_conv)\n apply (metis diff_self_eq_0 le_antisym le_refl nat_less_le zero_less_diff)\n apply metis\n apply metis\n apply(simp add:case_2_def)\n apply(intro conjI impI) \n apply (metis)\n apply (metis)\n apply (metis)\n apply (metis)\n apply metis \n apply (metis le_antisym nat_less_le)\n apply(simp add:pre_OOM_inv_def)\n by blast\n\n\n\nlemma W_local_FinishedW_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = FinishedW\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n by(simp add:cW_step_def pre_W_def)\n\n\n\n\nlemma W_local_Write_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = Write\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(simp add:pre_W_def cW_step_def)\n apply(simp add:inv_def pre_write_inv_def)\n apply(simp add:pre_enqueue_inv_def)\n apply(intro conjI impI)\n apply clarify\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) apply clarify\n apply(intro conjI impI)\n apply(subgoal_tac \"iownB s i=B\") prefer 2\n apply metis\n apply(subgoal_tac \"T s\\i \\ iownB s i = R\") prefer 2 \n apply metis\n apply(subgoal_tac \"b\\i \\ iownB s i = Q\") prefer 2 \n apply metis\n apply (metis (mono_tags, lifting) F.distinct(1) F.distinct(3) F.distinct(5) Suc_le_lessD le_eq_less_or_eq not_less_eq_eq trans_less_add1)\n apply(subgoal_tac \"end(tempW s)\\i \\ i ownB s i = B\") prefer 2\n apply metis\n apply (metis F.distinct(5) F.distinct(9) le_neq_implies_less)\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(clarify)\n apply(intro conjI impI) \n apply (metis F.distinct(1) F.distinct(3) eq_imp_le linorder_neqE_nat nat_less_le trans_less_add1)\n apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) F.distinct(9) le_neq_implies_less less_or_eq_imp_le linorder_neqE_nat)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply(subgoal_tac \"case_2 s\") prefer 2 \n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply(subgoal_tac \"case_2 s\") prefer 2 \n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply (metis bot_nat_0.extremum_unique diff_is_0_eq le_trans length_0_conv)\n apply(subgoal_tac \"case_2 s\") prefer 2 \n apply blast apply(simp) apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n by(simp add:tempW_lemmas tempW_basic_lemmas)\n\n\n\n\n\nlemma W_local_BTS_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcW s = BTS\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n by(simp add:cW_step_def pre_W_def)\n\n\n\nlemma local_pre_W_pre: \n assumes \"con_assms s\"\n and \"pcw = pcW s\"\n and \"pre_W pcw s\"\n and \"inv s\"\n and \"cW_step pcw s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply(case_tac \"pcW s\") \n using W_local_A1_lemma [where s=s and s'=s'] apply blast \n using W_local_A2_lemma [where s=s and s'=s'] apply blast \n using W_local_A3_lemma [where s=s and s'=s'] apply blast \n using W_local_A4_lemma [where s=s and s'=s'] apply blast \n using W_local_A5_lemma [where s=s and s'=s'] apply blast \n using W_local_A6_lemma [where s=s and s'=s'] apply blast \n using W_local_A7_lemma [where s=s and s'=s'] apply blast \n using W_local_A8_lemma [where s=s and s'=s'] apply blast \n using W_local_Enqueue_lemma [where s=s and s'=s'] apply blast \n using W_local_idleW_lemma [where s=s and s'=s'] apply blast \n using W_local_OOM_lemma [where s=s and s'=s'] apply blast \n using W_local_FinishedW_lemma [where s=s and s'=s'] apply blast \n using W_local_Write_lemma [where s=s and s'=s'] apply blast \n using W_local_BTS_lemma [where s=s and s'=s'] by blast \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(**********************Supporting lemmas for R trans*********************************)\nlemma R_idle_to_nidle_lemma_case_1_1:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s\n\\iownB s i=ownB s' i\"\n by(simp add:case_1_def) \n\n\nlemma R_idle_to_nidle_lemma_case_1_2:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s\n\\i>end(hd(q s))\\ownB s i=ownB s' i\"\n by(simp add:case_1_def) \n\n\n\nlemma R_idle_to_nidle_lemma_case_1_3:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s\n\\fst(hd(q s))\\i \\ iR=ownB s' i\"\n by(simp add:case_1_def) \n\n\n\nlemma R_idle_to_nidle_lemma_case_1_4:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s\n\\T s=T s'\\H s=H s'\\offset s=offset s'\\ownT s'=R\"\n by(simp add:case_1_def) \n\n\nlemma sum_of_things:\n \"q s!0 = (2,3) \\ (length(q s) = 1)\\\\{j. j=(snd(q s!0))} = 3\"\n by simp \n\nlemma sum_of_things_2:\n \"q s=[(0,1)] \\ length(q s) = 1\"\n by simp\n\n\nlemma sum_of_things_3:\n \" length(q s)>0 \\ \\i. i snd(q s!i) =1\\ (\\i::nat=0..length(q s)-1. 1) = length(q s)\"\n by auto \n\nlemma sum_of_things_4:\n \" length(q s)>1 \\ \\i. i snd(q s!i) =1\\ (\\i::nat=0..(length(q s)-1). snd(q s!i)) = length(q s)\"\n by auto\n\nlemma sum_of_things_5:\n \"n>0\\ (\\i::nat=0..n. k) = (\\i::nat=1..n. k) + k \"\nproof (induct n)\n show \"0 = n \\\n 0 < n \\\n (\\i = 0..n. k) = (\\i = 1..n. k) + k\" by simp\nnext show \"\\x. (x = n \\\n 0 < n \\\n (\\i = 0..n. k) =\n (\\i = 1..n. k) + k) \\\n Suc x = n \\\n 0 < n \\\n (\\i = 0..n. k) =\n (\\i = 1..n. k) + k\" \n by (metis add.commute add_diff_cancel_left' le_add1 plus_1_eq_Suc sum.atLeast0_atMost_Suc_shift sum.atLeastAtMost_shift_0)\nqed\n\n\n\nlemma sum_of_things_6:\n \"length(q s) =n+2\\ (\\i::nat=0..(length(q s)-1). 1) = (\\i::nat=1..(length(q s)-1). 1) + 1 \"\n apply auto\nproof (induct n)\n case 0\n then show ?case \n by simp\nnext\n case (Suc x)\n then show ?case \n by (metis add.commute add.right_neutral nat.distinct(1) not_gr_zero plus_1_eq_Suc sum_of_things_5)\nqed\n\n\nlemma sum_of_things_7:\n \"length(q s) =n+2\\ \\i. (i snd(q s!i) =1\\\n (\\i::nat=0..(length(q s)-1). snd(q s!i)) = (\\i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n by auto\n\n\nlemma sum_of_things_8:\n \"length(q s) =n+2\\\n (\\i::nat=0..(length(q s)-1). snd(q s!i)) = (\\i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n apply auto\nproof (induct n)\n case 0\n then show ?case \n by auto\nnext \n case (Suc x)\n then show ?case\n by (simp add: sum.atLeast_Suc_atMost)\nqed\n\n\nlemma sum_of_things_9:\n \" length(q s)=n+2 \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=0..(length(q s)-1). snd(q s!i)) = (\\i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n apply auto \nproof (induct n) case 0 then show ?case by auto\nnext case (Suc x) then show ?case by (simp add: sum.atLeast_Suc_atMost)\nqed \n\n\nlemma sum_of_things_10:\n \" length(q s)\\2 \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=0..(length(q s)-1). snd(q s!i)) = (\\i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n apply auto\n by (metis add.commute sum.atLeast_Suc_atMost zero_le)\n\nlemma sum_of_things_11:\n \" length(q s) = n+2 \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=0..(length(q s)-1). snd(q s!i)) = length(q s)-1 + snd(q s!0) \"\n apply auto \nproof (induct n) case 0 then show ?case by auto\nnext case (Suc x) then show ?case by (simp add: sum.atLeast_Suc_atMost)\nqed \n\n\nlemma sum_of_things_12:\n \" length(q s) = n+2 \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1 \"\n by auto \n\nlemma sum_of_things_13:\n \" \\n.(n\\0) \\length(q s) = n+2 \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1 \"\n using sum_of_things_12 [where s=s] \n by blast\n\nlemma sum_of_things_14:\n \" \\k.(k\\2)\\length(q s) = k \\ \\i. (i i>0) \\ snd(q s!i) =1\\ \n(\\i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1 \"\n using sum_of_things_13 [where s=s]\n using le_add2 by blast\n\n\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_5_preliminary:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\inv s \\q s\\[] \\ tl(q s)\\[]\n\\length (q s) - Suc 0 \\ end(last(q s)) - end(hd (q s))\"\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(simp add:pre_R_def pre_dequeue_inv_def)\n apply(simp add:case_1_def)\n apply clarify\n apply(subgoal_tac \"i j fst(q s!j)>fst(q s!i)\\ fst(q s!j)\\end(q s!i)\") prefer 2 \n apply (metis (no_types, lifting) end_simp nth_mem prod.collapse)\n apply(subgoal_tac \"\\i.(ownB s i = Q \\ ia b j. ((a,b)\\set(q s) \\ j\\a \\ j ownB s (j) = Q\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\a b j. ((a,b)\\set(q s) \\ j=a ) \\ ownB s (j) = Q\") prefer 2 \n apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply(subgoal_tac \"\\a b.(a,b)\\set(q s) \\ (\\i.(i fst(q s!i) = a))\") prefer 2\n apply (metis fst_conv in_set_conv_nth)\n apply(subgoal_tac \"(i ownB s (fst(q s!i)) =Q\") prefer 2 \n apply (metis nth_mem prod.collapse)\n apply(subgoal_tac \"i i>0 \\ fst(q s!0) < fst(q s!i)\") prefer 2 \n apply (metis (no_types, lifting) Q_ind_imp_tail_ind_1 diff_self_eq_0 le_0_eq le_eq_less_or_eq nat_neq_iff)\n apply(subgoal_tac \"i i>0 \\ end(q s!0) \\ fst(q s!i)\") prefer 2 \n apply (metis (no_types, lifting) Q_ind_imp_tail_ind_1 end_simp list.set_sel(1) nth_mem prod.collapse)\n \n apply(subgoal_tac \"length(q s)>1\") prefer 2 \n apply (metis Suc_le_eq diff_is_0_eq length_0_conv length_tl not_less_eq_eq)\n\n apply(subgoal_tac \"\\i.(i ownB s (fst(q s!i)) = Q\") prefer 2\n apply (metis nth_mem prod.collapse)\n apply(subgoal_tac \"\\i.(i i>0)\\fst(q s!i)>fst(q s!0)\") prefer 2 \n apply (metis (no_types, lifting) Q_ind_imp_tail_ind_1 diff_self_eq_0 le_neq_implies_less less_nat_zero_code linorder_neqE_nat)\n apply(subgoal_tac \"\\i.(i i>0)\\fst(q s!i)\\end(q s!0)\") prefer 2\n apply (metis (no_types, lifting) Q_ind_imp_tail_ind_1 end_simp list.set_sel(1) nth_mem prod.collapse)\n apply(subgoal_tac \"i ownB s (fst(q s!i)) = Q\") prefer 2\n apply blast\n (*split cases for ownB s 0 = Q and ownB s 0 \\ Q*)\n apply(case_tac \"b=0\")\n apply(subgoal_tac \"ownB s 0 = Q\") prefer 2 \n apply (metis le_neq_implies_less less_nat_zero_code minus_nat.diff_0)\n apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n apply (metis F.distinct(3) Q_ind_imp_tail_ind_1 le_neq_implies_less)\n apply(subgoal_tac \"\\i. i < length (q s) \\ 0 < i \\\n fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i)\")\n prefer 2 \n apply (metis (no_types, lifting))\n apply(thin_tac \"\\i. i < length (q s) \\ 0 < i \\ fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\fst (q s ! i) = 0\")\n sorry\n\n\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_5:\n \"case_1 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s \\q s\\[]\n\\case_1 s'\"\n apply(simp add:case_1_def inv_def) \n apply(clarify) apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"c\\N\") prefer 2\n apply linarith\n apply(subgoal_tac \"q s\\[]\\hd(q s) \\set(q s)\") prefer 2 \n apply (metis list.set_sel(1))\n apply(subgoal_tac \"q s\\[]\") prefer 2 \n apply blast\n apply (metis diff_is_0_eq less_nat_zero_code prod.collapse zero_less_diff)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(rule_tac ?x = \"T s\" in exI)\n apply(rule_tac ?x = \"end(hd(q s))\" in exI)\n apply(intro conjI impI)\n apply (metis cancel_comm_monoid_add_class.diff_cancel end_simp le_0_eq le_neq_implies_less length_0_conv trans_le_add1)\n apply(rule_tac ?x = \"c\" in exI)\n apply(simp add:pre_R_def pre_dequeue_inv_def) \n apply(intro conjI impI)\n apply (metis (no_types, lifting) F.distinct(19) F.distinct(3) diff_is_0_eq le_0_eq le_neq_implies_less length_0_conv nat_le_linear)\n apply (metis Suc_leI diff_is_0_eq' le_0_eq le_neq_implies_less le_trans length_0_conv not_less_eq_eq) \n apply (metis (no_types, lifting) cancel_comm_monoid_add_class.diff_cancel end_simp le_0_eq le_neq_implies_less length_0_conv nat_le_linear)\n apply (metis diff_is_0_eq end_simp le_0_eq le_add1 le_eq_less_or_eq le_trans length_0_conv zero_less_diff)\n apply (metis (no_types, hide_lams) F.distinct(3))\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply (metis diff_self_eq_0 le_0_eq le_eq_less_or_eq length_0_conv)\n apply (metis diff_add_inverse diff_self_eq_0 le_0_eq le_eq_less_or_eq length_0_conv)\n defer\n defer\n apply(subgoal_tac \"i<(length(q s))\\i>0\\ fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i) \\ fst(q s!i) = 0\") prefer 2\n apply (metis (no_types, lifting) One_nat_def)\n apply(subgoal_tac \"T s \\ 0\") prefer 2\n apply blast\n apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2 \n apply (metis (no_types, lifting) One_nat_def bot_nat_0.extremum_uniqueI diff_add_inverse2 diff_self_eq_0 hd_conv_nth last_conv_nth le_neq_implies_less length_greater_0_conv length_tl less_diff_conv list.size(3) nth_tl)\n apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n apply (metis hd_conv_nth)\n apply(case_tac \"b = 0\") \n apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n apply force \n apply(subgoal_tac \"i j i\\j \\ fst(q s!i) \\fst(q s!j)\") prefer 2 \n apply (metis (no_types, lifting))\n apply(subgoal_tac \"i<(length(q s))\\i>0\\ fst(q s!0) = 0\\ fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n apply (metis (no_types, lifting) length_greater_0_conv)\n apply(case_tac \"length(q s) > 1\") \n apply(subgoal_tac \"fst(q s!0) = 0\\ fst(q s!(0)) + snd(q s!(0)) = fst(q s!1)\") prefer 2\n apply (metis (no_types, lifting) One_nat_def diff_Suc_1 length_greater_0_conv less_one)\n apply presburger\n apply (metis diff_self_eq_0 last_conv_nth length_0_conv less_nat_zero_code less_one nat_neq_iff)\n apply(subgoal_tac \"b>0\") prefer 2 \n apply force\n apply(subgoal_tac \"ownB s 0 \\ Q\") prefer 2 \n apply (metis F.distinct(19) le_neq_implies_less)\n apply(subgoal_tac \" \\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\") prefer 2 \n apply blast\n apply(subgoal_tac \"0\\N\") prefer 2\n apply blast\n apply(subgoal_tac \"(\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ 0 \\ x)\")\n prefer 2\n apply presburger\n apply(subgoal_tac \"\\a b. (a,b) \\ set(q s) \\ a=0\") prefer 2 \n apply (metis (no_types, lifting) bot_nat_0.extremum mem_Collect_eq plus_nat.add_0)\n apply(subgoal_tac \"i (q s!i) \\ set(q s)\") prefer 2 \n apply (metis nth_mem)\n apply(subgoal_tac \"(sta,wlength)\\set(q s) \\ (\\i.(i (sta,wlength) = q s!i))\") prefer 2\n apply (metis in_set_conv_nth)\n apply(subgoal_tac \"\\sta wlength. (sta,wlength)\\set(q s) \\ sta\\0\") prefer 2 \n apply metis\n apply(subgoal_tac \"ifst(q s!i)\\0\") prefer 2\n apply (metis prod.collapse)\n apply(subgoal_tac \"i<(length(q s))\\i>0\\ fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n apply (metis prod.collapse)\n apply(case_tac \"length(q s)>1\") \n apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one nth_mem prod.collapse)\n apply(case_tac \"length(q s) = 0\")\n apply fastforce\n apply(subgoal_tac \"length(q s) = 1\") prefer 2\n apply linarith\n apply(subgoal_tac \"length(tl(q s)) = 0\") prefer 2\n apply (metis diff_self_eq_0 length_tl)\n apply (metis diff_self_eq_0 last_conv_nth le_neq_implies_less less_irrefl_nat not_one_le_zero)\n apply(case_tac \"length(q s) \\1\")\n apply (metis bot_nat_0.extremum_uniqueI diff_add_inverse2 diff_is_0_eq' head_q0 last_conv_nth le_neq_implies_less length_greater_0_conv less_diff_conv less_numeral_extra(3))\n apply (metis (no_types, lifting) One_nat_def diff_is_0_eq last_tl le_Suc_eq le_neq_implies_less length_tl list.size(3))\n apply (metis (no_types, lifting) diff_add_inverse diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv linorder_neqE_nat list.set_sel(1) nat_less_le not_add_less1 prod.collapse)\n apply (metis diff_add_inverse diff_is_0_eq' le_eq_less_or_eq less_nat_zero_code list.set_sel(1) prod.collapse)\n apply (metis diff_is_0_eq le_zero_eq length_0_conv)\n defer\n apply(subgoal_tac \"i\\end(hd(q s)) \\ i ownB s i = Q \\ i\\N\") prefer 2 \n apply (metis add_leD1 diff_self_eq_0 end_simp le_0_eq le_eq_less_or_eq le_trans length_0_conv)\n apply(subgoal_tac \"\\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\")\n prefer 2\n apply blast\n apply(subgoal_tac \"ownB s (end(hd(q s))) = Q\") prefer 2 \n apply (metis diff_self_eq_0 end_simp le_0_eq le_add1 le_eq_less_or_eq length_0_conv)\n (*difficult and time consuming, need help here*)\n apply(subgoal_tac \"numEnqs s - numDeqs s >1\") \n using One_nat_def apply presburger\n apply(case_tac \"tl(q s) = []\") \n apply (metis bot_nat_0.extremum_uniqueI diff_add_inverse2 diff_self_eq_0 hd_conv_nth last_conv_nth le_neq_implies_less length_0_conv length_tl less_diff_conv)\n apply (metis Suc_le_eq diff_is_0_eq length_0_conv length_tl not_less_eq_eq)\n apply(case_tac \"tl(q s) = []\") \n apply (metis Nitpick.size_list_simp(2) diff_0_eq_0 diff_Suc_Suc zero_le) \n\n apply(subgoal_tac \"i\\end(hd(q s)) \\ i ownB s i = Q \\ i\\N\") prefer 2 \n apply (metis add_leD1 diff_self_eq_0 end_simp le_0_eq le_eq_less_or_eq le_trans length_0_conv)\n apply(subgoal_tac \"\\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\")\n prefer 2\n apply blast\n (*difficult and time consuming, need help here*)\n apply(subgoal_tac \"numEnqs s - numDeqs s >1\") prefer 2\n apply (metis Suc_le_eq diff_is_0_eq length_0_conv length_tl not_less_eq_eq)\n apply(subgoal_tac \"hd(q s) \\ set(q s) \\ hd(q s) = (q s!0)\") prefer 2 \n apply (metis Q_ind_imp_tail_ind_1 list.set_sel(1))\n apply(subgoal_tac \"\\i.(i i>0) \\ end((q s)!(i-1)) = fst(q s!i) \\ fst(q s!i) = 0\") prefer 2 \n apply (metis (no_types, lifting) One_nat_def end_simp)\n apply(subgoal_tac \"\\i. (i\\N \\ ownB s i = Q)\\ i\\0\") prefer 2 \n apply blast\n apply(case_tac \"ownB s 0 = Q\")\n apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n apply (metis F.distinct(19) bot_nat_0.not_eq_extremum diff_0_eq_0 le_eq_less_or_eq)\n apply(subgoal_tac \"i i>0 \\ fst(q s!i) > 0\") prefer 2\n apply (metis (no_types, lifting) gr0I length_greater_0_conv)\n apply(subgoal_tac \"(a,wlen)\\set(q s) \\ (aa,bb)\\set(q s) \\ aa>a\\ a+wlen\\aa\")\n prefer 2 \n apply (metis (no_types, lifting))\n apply(subgoal_tac \"length(q s) = length(tl(q s)) + 1\") prefer 2\n apply (metis Nat.add_0_right One_nat_def Suc_diff_1 add_Suc_right length_pos_if_in_set length_tl)\n apply(subgoal_tac \"tl(q s) \\ []\") prefer 2\n apply blast\n apply(subgoal_tac \"c = end(last(q s))\") prefer 2 \n apply (metis diff_self_eq_0 end_simp le_neq_implies_less less_nat_zero_code)\n \n sorry\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6:\n \"case_2 s\\con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s \\q s\\[]\n\\case_2 s'\"\n apply(simp add:case_2_def inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas) apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(clarify) apply(intro conjI impI)\n apply (metis (no_types, lifting) le_antisym less_imp_le_nat list.set_sel(1) nat_neq_iff prod.collapse)\n sorry\n\n\nlemma R_idle_to_nidle_lemma_case_1_7:\n \"con_assms s \\ pcR s = idleR\\pre_R (pcR s) s\n \\s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\\inv s \\q s\\[]\n\\Q_owns_bytes s'\"\n sorry\n\n\nlemma R_read_to_release_lemma_1:\n \"con_assms s \\ pcR s = Read\\pre_Read_inv s\n \\s'=(s\\tR := T s, numReads := Suc (data_index s (tempR s)),\n pcR := Release,\n ownD :=\n \\i. if i = data_index s (tempR s) then R\n else ownD\n (s\\tR := T s,\n numReads := Suc (data_index s (tempR s)),\n pcR := Release\\)\n i\\)\n\\inv s \n\\i>0\\ownB s' i = ownB s i \\ T s = T s' \\ H s = H s' \\\n tempR s = tempR s' \\ offset s = offset s' \\ Data s (numEnqs s) = Data s' (numEnqs s')\n \\ q s = q s' \\ ownT s = ownT s'\"\n by simp\n\n\nlemma R_read_to_release_lemma_case_1:\n \"con_assms s \\ pcR s = Read\\pre_Read_inv s\n \\s'=(s\\tR := T s, numReads := Suc (data_index s (tempR s)),\n pcR := Release,\n ownD :=\n \\i. if i = data_index s (tempR s) then R\n else ownD\n (s\\tR := T s,\n numReads := Suc (data_index s (tempR s)),\n pcR := Release\\)\n i\\)\n\\inv s \n\\case_1 s\n\\case_1 s'\"\n by(simp add:case_1_def)\n\nlemma R_read_to_release_lemma_case_2:\n \"con_assms s \\ pcR s = Read\\pre_Read_inv s\n \\s'=(s\\tR := T s, numReads := Suc (data_index s (tempR s)),\n pcR := Release,\n ownD :=\n \\i. if i = data_index s (tempR s) then R\n else ownD\n (s\\tR := T s,\n numReads := Suc (data_index s (tempR s)),\n pcR := Release\\)\n i\\)\n\\inv s \n\\case_2 s\n\\case_2 s'\"\n by(simp add:case_2_def)\n\nlemma R_read_to_release_lemma_2:\n \"con_assms s \\ pcR s = Read\\pre_Read_inv s\n \\s'=(s\\tR := T s, numReads := Suc (data_index s (tempR s)),\n pcR := Release,\n ownD :=\n \\i. if i = data_index s (tempR s) then R\n else ownD\n (s\\tR := T s,\n numReads := Suc (data_index s (tempR s)),\n pcR := Release\\)\n i\\)\n\\inv s \n\\Q_owns_bytes s\n\\Q_owns_bytes s'\"\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\nlemma T_modification_rule:\n \"s'=(s\\T := fst (tempR s) + Data s (numReads s - Suc 0)\\) \\ T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n by simp\n\nlemma T_modification_rule_2:\n \"s'=(s\\ownT := Q,\n ownB :=\n \\i. if (if T s \\ i \\ i < N then B else ownB (s\\ownT := Q\\) i) = R \\ i \\ N then B\n else ownB (setownB [(tR s, N) B] (s\\ownT := Q\\)) i,\n tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\) \\ T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n by simp\n\nlemma T_push:\n \" T s = fst (tempR s) \\s'=s \\ownT := Q,\n ownB :=\n \\i. if ownB s i = R \\ i \\ N then B\n else ownB ((if T s \\ fst (tempR s) then setownB [(tR s, N) B] else id) (s\\ownT := Q\\)) i,\n tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\ \\\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n by simp\n\nlemma T_push_2 :\n \" T s = fst (tempR s) \\s'=(s\\ownT := Q, ownB := \\i. if ownB s i = R \\ i \\ N then B else ownB (id (s\\ownT := Q\\)) i, tempR := (0, 0), pcR := idleR,\n T := fst (tempR s) + Data s (numReads s - Suc 0)\\) \\\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n by simp\n\nlemma R_release_to_idle_lemma_1:\n \"con_assms s \\ pcR s = Release \\ pre_Release_inv s\n \\ s'=s \\ownT := Q,\n ownB :=\n \\i. if ownB s i = R \\ i \\ N then B\n else ownB ((if T s \\ fst (tempR s) then setownB [(tR s, N) B] else id) (s\\ownT := Q\\)) i,\n tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\\n\\inv s \\ T s = fst (tempR s)\n\\case_1 s\n\\case_1 s'\"\n apply (simp add:inv_def) \n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n using T_push [where s =s and s'=s'] \n apply fastforce\n apply(simp add:case_1_def)\n apply clarify \n apply(rule_tac ?x = \"b\" in exI)\n apply(rule_tac ?x = \"b\" in exI) \n apply(intro conjI impI)\n apply fastforce \n apply(rule_tac ?x = \"c\" in exI) \n apply(intro conjI impI) \n apply blast\n apply blast \n apply (metis (no_types, lifting) le_trans less_or_eq_imp_le linorder_neqE_nat)\n apply (metis Suc_leI not_less_eq_eq)\n apply (metis F.distinct(11)) \n apply (metis F.distinct(1)) \n apply metis \n apply meson\n apply (metis le_add_diff_inverse)\n apply meson\n apply meson\n apply fastforce\n apply blast\n apply blast\n apply meson\n apply meson\n by meson\n\n\nlemma R_release_nequal_case_2:\n \"con_assms s \\ pcR s = Release \\ pre_Release_inv s\n\\inv s \\ T s \\ fst (tempR s)\n\\case_2 s\"\n apply (simp add:inv_def) \n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) \n apply(simp add:case_1_def)\n apply(subgoal_tac \"H s>T s\") prefer 2 \n apply metis\n apply(simp add:case_2_def)\n by metis\n\n\nlemma R_release_nequal_case_2_2:\n \"con_assms s \\ pcR s = Release \\ pre_Release_inv s\n\\inv s \\ T s \\ fst (tempR s) \\ s' = s\n \\ownT := Q,\n ownB :=\n \\i. if (if T s \\ i \\ i < N then B else ownB (s\\ownT := Q\\) i) = R \\ i \\ N then B\n else ownB ((if T s \\ fst (tempR s) then setownB [(tR s, N) B] else id) (s\\ownT := Q\\)) i,\n tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\\n\\case_1 s'\"\n apply(subgoal_tac \"case_2 s\") prefer 2 using R_release_nequal_case_2 [where s=s]\n apply blast\n apply (simp add:inv_def)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"H s < T s\") prefer 2 \n apply(simp add:case_2_def)\n apply meson\n apply(simp add:case_2_def case_1_def)\n apply clarify\n apply(rule_tac ?x = \"a\" in exI)\n apply(rule_tac ?x = \"a\" in exI)\n apply(intro conjI impI)\n apply blast\n apply(rule_tac ?x = \"b\" in exI)\n apply(intro conjI impI)\n apply blast\n apply blast\n apply (metis add_cancel_left_left le_trans less_or_eq_imp_le)\n apply (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n apply (metis F.distinct(11) F.distinct(21) gr0_conv_Suc nat.discI nat_less_le)\n apply (metis F.distinct(1))\n apply (metis nat_le_linear nat_less_le)\n apply meson\n apply (metis add_cancel_right_left)\n apply fastforce\n apply meson\n apply force\n apply blast\n apply (metis add_cancel_left_left diff_self_eq_0 le_neq_implies_less)\n apply meson\n apply (metis le_neq_implies_less)\n by meson\n\n\nlemma R_release_nequal_case_1_1:\n \"con_assms s \\ pcR s = Release \\ pre_Release_inv s\n\\inv s \\ T s = fst (tempR s) \\ s'=(s\\ownT := Q, ownB := \\i. if ownB s i = R \\ i \\ N then B else ownB (id (s\\ownT := Q\\)) i, tempR := (0, 0), pcR := idleR,\n T := fst (tempR s) + Data s (numReads s - Suc 0)\\) \\ case_1 s\n\\case_1 s'\"\n apply (simp add:inv_def) \n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n using T_push_2 [where s=s and s'=s']\n apply fastforce\n apply(simp add:case_1_def) \n apply clarify \n apply(rule_tac ?x = \"b\" in exI)\n apply(rule_tac ?x = \"b\" in exI) \n apply(intro conjI impI)\n apply fastforce \n apply(rule_tac ?x = \"c\" in exI) \n apply(intro conjI impI) \n apply blast\n apply blast\n apply (metis diff_commute diff_diff_cancel diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n apply (metis le_imp_less_Suc not_less_eq)\n apply (metis F.distinct(11))\n apply (metis F.distinct(1))\n apply metis\n apply blast\n apply (metis le_add_diff_inverse)\n apply meson\n apply fastforce\n apply fastforce\n apply force\n apply blast\n apply meson\n apply fastforce\n by meson\n\n\n\nlemma R_release_equal_case_2_3:\n \"con_assms s \\ pcR s = Release \\ pre_Release_inv s\n\\inv s \\ T s = fst (tempR s) \\ s'=(s\\ownT := Q, ownB := \\i. if ownB s i = R \\ i \\ N then B else ownB (id (s\\ownT := Q\\)) i, tempR := (0, 0), pcR := idleR,\n T := fst (tempR s) + Data s (numReads s - Suc 0)\\) \\ case_2 s\n\\case_2 s'\"\n apply (simp add:inv_def) \n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n using T_push_2 [where s =s and s'=s'] \n apply fastforce apply(simp_all)\n apply(simp add:case_2_def)\n apply clarify \n apply(rule_tac ?x = \"0\" in exI)\n apply(rule_tac ?x = \"b\" in exI) \n apply(intro conjI impI)\n apply fastforce \n apply(rule_tac ?x = \"H s\" in exI) \n apply(intro conjI impI) \n apply fastforce\n apply(rule_tac ?x = \"e\" in exI)\n apply(intro conjI impI) \n apply (metis le_add_diff_inverse trans_less_add1)\n apply(rule_tac ?x = \"e\" in exI)\n apply(intro conjI impI) \n apply fastforce\n apply(rule_tac ?x = \"f\" in exI)\n apply(intro conjI impI) \n apply fastforce\n apply blast\n apply blast\n apply (metis F.distinct(11) less_nat_zero_code)\n apply (metis F.distinct(1))\n apply (metis (mono_tags, hide_lams) diff_is_0_eq' le_trans linorder_neqE_nat nat_le_linear zero_less_diff)\n apply (metis le_imp_less_Suc not_less_eq)\n apply (metis F.distinct(11))\n apply (metis F.distinct(15))\n apply fastforce\n apply blast\n apply blast\n apply blast\n apply blast\n apply (metis gr_implies_not_zero le_add_diff_inverse)\n apply blast\n apply meson\n apply meson\n apply blast\n apply fastforce\n apply blast\n apply (metis less_nat_zero_code)\n apply meson\n apply (metis less_nat_zero_code)\n apply meson\n apply (metis less_nat_zero_code)\n apply (metis less_nat_zero_code)\n by force\n\n\n\n \n\n\n\n\nlemma Q_continues_to_own_through_release:\n \"Q_owns_bytes s \\ inv s \\ cR_step (pcR s) s s' \\ pcR s = Release \n \\ pre_Release_inv s\n \\ Q_owns_bytes s'\"\n apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply metis\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n by (metis F.distinct(21) nat_less_le)\n\n\n\nlemma Q_structure_continues_to_own_through_release:\n \"Q_structure s \\ inv s \\ cR_step (pcR s) s s' \\ pcR s = Release \n \\ pre_Release_inv s\n \\ Q_structure s'\"\n apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n by(simp add:cR_step_def)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(************************************Local R_step shows inv *********************************************)\n\n\nlemma R_local_release_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = Release\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n using assms apply simp \n apply(subgoal_tac \"Q_owns_bytes s\") prefer 2\n using inv_def\n apply blast\n apply(subgoal_tac \"inv s\") prefer 2 \n apply blast\n apply(subgoal_tac \"cR_step (pcR s) s s'\") prefer 2\n apply metis\n apply(subgoal_tac \"pcR s = Release \") prefer 2\n apply metis \n apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n apply(simp add:pre_R_def)\n apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n using Q_continues_to_own_through_release [where s=s and s'=s'] \n apply blast\n apply(subgoal_tac \"Q_structure s\") prefer 2 using inv_def\n apply blast\n apply(subgoal_tac \"Q_structure s'\") prefer 2 \n using Q_structure_continues_to_own_through_release [where s=s and s'=s']\n apply blast\n(*prelimiaries go here*)\n apply(simp add:inv_def)\n apply(subgoal_tac \"inv s\") prefer 2 \n using assms(1) apply linarith\n apply(simp add:pre_R_def)\n apply(subgoal_tac \"B_release s s'\") prefer 2 using B_release_def [where s=s and s'=s']\n apply (metis PCR.simps(7) cR_step_def) \n apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Release_inv_def [where s=s] \n apply presburger\n apply(subgoal_tac \"Q_structure s'\")\n using Q_structure_preserved3 [where s=s and s'=s'] prefer 2 \n apply (metis \\B_release s s' \\ s' = (`T := end (tempR s) \\ `pcR := idleR \\ `tempR := (0, 0) \\ transownB [R B] \\ (if tR s \\ fst (tempR s) then setownB [(tR s, N) B] else id) \\ transownT [R Q s]) s\\ end_simp len_def off_def)\n apply(simp add:pre_Release_inv_def)\n apply(intro conjI impI) apply(simp add:tempR_lemmas tempR_basic_lemmas) prefer 2\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(subgoal_tac \"T s \\ fst (tempR s)\") prefer 2 \n apply blast\n apply(subgoal_tac \"pre_R Release s\") prefer 2 using assms \n apply presburger\n apply(simp add:pre_R_def)\n apply(subgoal_tac \"pre_Release_inv s\") prefer 2\n apply blast\n apply(subgoal_tac \"case_2 s\") prefer 2\n using R_release_nequal_case_2 [where s=s]\n using assms(2) apply fastforce\n apply(simp_all)\n apply(subgoal_tac \"case_1 s'\") prefer 2 using R_release_nequal_case_2_2 [where s'=s' and s=s] \n using assms(2) apply blast\n apply presburger\n apply(case_tac \"case_1 s\", simp_all)\n apply(case_tac[!] \"T s = fst(tempR s)\") apply(simp_all)\n apply(subgoal_tac \"case_1 s'\") \n using R_release_nequal_case_1_1 [where s=s and s'=s'] \n apply presburger\n apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n using assms(4) apply blast\n apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n apply blast\n using R_release_nequal_case_1_1 [where s=s and s'=s']\n using assms(2) apply presburger\n apply(subgoal_tac \"case_2 s'\")\n using R_release_equal_case_2_3 [where s=s and s'=s']\n apply presburger\n apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n using assms(4) apply blast\n apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n apply blast\n using R_release_equal_case_2_3 [where s=s and s'=s']\n using assms(2) by presburger\n\n\n\nlemma R_local_idle_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = idleR\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n using assms apply simp\n apply(simp add:pre_R_def cR_step_def)\n apply(case_tac \"q s=[]\") apply(case_tac \"pcR s'\") apply (simp,simp,simp)\n apply(subgoal_tac \"Q_structure s'\") prefer 2 \n using Q_structure_preserved1 [where s=s and s'=s'] inv_def\n apply meson \n apply (simp add: RingBuffer_BD_latest_2.inv_def) apply simp\n apply(simp add:pre_dequeue_inv_def)\n apply(subgoal_tac \"s'=(s\\ownB := \\i. if fst (hd (q s)) \\ i \\ i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\)\n\") prefer 2 \n apply presburger\n apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n using R_idle_to_nidle_lemma_case_1_7 [where s=s and s'=s'] assms\n apply fastforce\n apply(simp add:inv_def)\n apply(clarify)\n apply(intro conjI impI)\n apply (metis add.right_neutral add_Suc_right diff_diff_left)\n apply (metis diff_is_0_eq length_0_conv not_less_eq_eq)\n apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n apply(case_tac \"case_1 s\") apply simp \n apply(subgoal_tac \"case_1 s'\\case_1 s' \\ case_2 s'\") prefer 2\n apply linarith\n apply(subgoal_tac \"case_1 s'\") \n apply blast\n apply simp \n using R_idle_to_nidle_lemma_case_1_5 [where s=s and s'=s'] \n using assms(1) assms(2) assms(4) \n apply presburger\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast\n apply(thin_tac \"\\case_1 s\") apply simp \n using R_idle_to_nidle_lemma_case_1_6 [where s=s and s'=s'] \n using assms(1) assms(2) assms(4) by presburger\n\n\n\nlemma R_local_read_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = Read\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n using assms apply simp\n apply(simp add:inv_def)\n apply(simp add:pre_R_def)\n apply(subgoal_tac \"B_read s s'\") prefer 2 using B_read_def [where s=s and s'=s'] \n apply (metis PCR.simps(9) cR_step_def)\n apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Read_inv_def [where s=s] \n apply presburger\n apply(subgoal_tac \"Q_structure s'\")\n using Q_structure_preserved2 [where s=s and s'=s'] prefer 2\n apply blast\n apply(simp add:pre_Read_inv_def)\n apply(intro conjI impI)\n apply (metis F.distinct(5) le_antisym le_eq_less_or_eq not_less_eq_eq)\n apply (metis F.distinct(5) Suc_leI le_eq_less_or_eq not_less_eq_eq)\n apply(case_tac \"case_1 s\")\n apply(subgoal_tac \"case_1 s'\")\n apply fastforce\n apply(subgoal_tac \"pre_Read_inv s\") prefer 2\n apply (metis PCR.simps(9) assms(4) pre_R_def)\n using R_read_to_release_lemma_case_1 [where s=s and s'=s']\n using assms(1) assms(2) apply fastforce\n apply(subgoal_tac \"case_2 s\") prefer 2\n apply blast\n apply(thin_tac \"\\case_1 s\") \n apply(subgoal_tac \"case_2 s'\")\n apply force\n using R_read_to_release_lemma_case_2 [where s=s and s'=s']\n apply (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n using R_read_to_release_lemma_2 [where s=s and s'=s']\n by (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n\n\nlemma R_step_preserves_inv:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n using assms apply(case_tac \"pcR s\") \n using R_local_release_lemma [where s=s and s'=s'] apply blast (*done*)\n using R_local_idle_lemma [where s=s and s'=s'] apply blast (*done, check preliminaries*)\n using R_local_read_lemma [where s=s and s'=s'] by blast (*done*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************Local R pre post lemmas*************************************)\nlemma R_local_release_pre_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = Release\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n using assms apply(simp add:pre_R_def) apply clarify\n apply(subgoal_tac \"ownT s' \\ R\") prefer 2 \n apply(simp add:pre_dequeue_inv_def)\n apply(simp add:cR_step_def)\n apply(subgoal_tac \"ownT s = R\") prefer 2 \n apply(simp add:pre_Release_inv_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s = fst(tempR s)\") apply simp_all\n apply(simp add:pre_dequeue_inv_def)\n apply(intro conjI impI)\n apply(simp add:pre_Release_inv_def)\n apply(simp add:pre_Release_inv_def)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(subgoal_tac \"hd(q s)\\set(q s)\") prefer 2 \n apply (metis hd_in_set)\n apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n apply (metis hd_conv_nth)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(case_tac \"case_1 s \") apply simp apply(simp add:case_1_def)\n apply (metis diff_self_eq_0 le_neq_implies_less length_pos_if_in_set less_nat_zero_code)\n apply(simp) apply(thin_tac \"\\ case_1 s\") apply(simp add:case_2_def)\n apply(clarify)\n apply(subgoal_tac \"e=f\") prefer 2\n apply (metis gr_implies_not0 le_neq_implies_less)\n apply(subgoal_tac \"(i ownB s i = Q )\\ iba\")\n apply (metis (no_types, lifting) Suc_le_eq le_add1 le_trans not_less_eq_eq)\n apply(subgoal_tac \"(a\\i \\ i (ownB s i = Q)\") prefer 2\n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"a = i\\ ownB s i = Q\") prefer 2\n apply (metis le_refl less_add_same_cancel1)\n apply(subgoal_tac \"fst(tempR s) = T s \\ ownB s (T s) =R\") prefer 2\n apply (metis gr_implies_not0 le_refl)\n apply(subgoal_tac \"T s > ba\") prefer 2\n apply (metis le0 less_nat_zero_code nat_neq_iff)\n apply(subgoal_tac \"a=i\\iownB s i=Q\") prefer 2\n apply (metis Suc_diff_1 add_gr_0 lessI less_Suc_eq_le less_add_same_cancel1)\n apply(subgoal_tac \"\\i.(i\\ba \\ ownB s i = Q \\ i\\N)\") prefer 2 \n apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_self_eq_0 zero_less_diff)\n apply(subgoal_tac \"a=i \\ ownB s i = Q \\ icase_1 s\")\n apply (metis head_q0 length_greater_0_conv)\n prefer 3 \n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def pre_Release_inv_def)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(clarify) apply(intro conjI impI)\n apply (metis (no_types, lifting) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n apply(subgoal_tac \"hd(q s) \\ set(q s)\") prefer 2\n apply (metis hd_in_set)\n apply(subgoal_tac \"i\\N\") prefer 2\n apply (metis (no_types, lifting) le_trans less_or_eq_imp_le prod.collapse)\n apply(subgoal_tac \"\\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\") prefer 2 apply blast\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply (metis (no_types, lifting) prod.collapse)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply(simp add:case_1_def pre_Release_inv_def)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(clarify) apply(intro conjI impI) \n apply(subgoal_tac \"\\i. (\\x. (\\a b. x = {i. a \\ i \\ i < a + b} \\ (a, b) \\ set (q s)) \\ i \\ x) = (i \\ N \\ ownB s i = Q)\") prefer 2 apply blast\n apply(subgoal_tac \"hd(q s) \\ set(q s)\") prefer 2\n apply (metis hd_in_set)\n apply(subgoal_tac \"a = 0\") prefer 2 \n apply (metis less_nat_zero_code)\n apply(case_tac \"fst(hd(q s)) = e\") \n apply (metis gr_implies_not0)\n apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n apply metis\n apply(subgoal_tac \"b\\H s\") prefer 2\n apply fastforce\n apply(subgoal_tac \"H s< T s\") prefer 2\n apply fastforce\n apply(subgoal_tac \"b< T s\") prefer 2\n apply (metis le0 le_refl less_nat_zero_code nat_neq_iff)\n apply(subgoal_tac \"i\\end(hd(q s))\") \n apply (metis Suc_leI end_simp not_less_eq_eq)\n apply(subgoal_tac \"e = f\") prefer 2 \n apply (metis le_neq_implies_less)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"i\\T s\") prefer 2\n apply (metis less_Suc_eq_le not_less_eq)\n apply(subgoal_tac \"\\i.(i\\a \\ i ownB s i = Q\")\n prefer 2 \n apply (metis (no_types, lifting) end_simp prod.collapse)\n apply (metis F.distinct(11) less_Suc_eq_le not_less_eq)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\") apply simp \n apply(simp add:case_1_def pre_Release_inv_def)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply metis\n apply(simp add:case_2_def pre_Release_inv_def) apply(thin_tac \"\\case_1 s\")\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(clarify)\n apply(intro conjI impI)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply (metis (no_types, hide_lams) F.distinct(21) less_imp_Suc_add list.set_sel(1) nat.distinct(1) nat_less_le prod.exhaust_sel)\n apply (metis head_q0 length_greater_0_conv)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"aa=0\") prefer 2\n apply blast\n apply(subgoal_tac \"\\a b.((a,b)\\set(q s)) \\ a+b\\N\") prefer 2\n apply meson\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i ownB s i=Q\") prefer 2 \n apply (metis (no_types, lifting) mem_Collect_eq)\n apply(subgoal_tac \"\\j.(a\\j \\ j ownB s j = Q\") prefer 2\n apply (metis add.commute)\n by (metis (no_types, hide_lams) Suc_eq_plus1 add_diff_inverse_nat add_leD1 diff_add_inverse2 diff_le_self less_eq_Suc_le zero_less_diff)\n\n\n\n\nlemma R_local_idle_pre_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = idleR\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n using assms apply(simp add:pre_R_def) apply clarify\n apply(case_tac \"q s=[]\") \n using cR_step_def apply auto[1] apply(subgoal_tac \"ownT s = Q\") prefer 2 \n apply(simp add:pre_dequeue_inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_Read_inv_def)\n apply(intro conjI impI)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis diff_is_0_eq' length_0_conv not_less_eq_eq)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis length_greater_0_conv plus_nat.add_0)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis hd_in_set less_nat_zero_code)\n apply(simp add:inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_dequeue_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI) \n apply(subgoal_tac \"(\\i. i < length (q s) \\ 0 < i \\\n fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\ fst (q s ! i) = 0)\") prefer 2\n apply presburger\n apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n apply (metis Q_ind_imp_tail_ind_1)\n apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n apply (metis (no_types, lifting) One_nat_def Q_ind_imp_tail_ind_1 diff_Suc_1 length_greater_0_conv length_tl less_one zero_less_diff)\n apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n apply (metis Q_ind_imp_tail_ind_1)\n apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n apply (metis (no_types, lifting) One_nat_def Suc_eq_plus1 Suc_neq_Zero length_greater_0_conv length_tl less_diff_conv nth_tl)\n apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n apply (metis Q_ind_imp_tail_ind_1)\n apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n apply(subgoal_tac \"i (tl (q s) ! i )\\set (q s)\") prefer 2\n apply (metis One_nat_def length_tl list.set_sel(2) nth_mem)\n apply(subgoal_tac \"(hd (q s))\\set (q s)\") prefer 2\n apply (metis hd_in_set)\n apply simp apply clarify\n apply (intro conjI impI) apply(subgoal_tac \"snd(hd(q s)) = snd(q s!0)\") prefer 2 \n apply (metis Q_ind_imp_tail_ind_1) apply simp \n apply(subgoal_tac \"\\a b aa. (a, b) \\ set (q s) \\ (\\b. (aa, b) \\ set (q s)) \\ a < aa \\ a + b \\ aa\") prefer 2\n apply blast\n apply(subgoal_tac \"\\i.(i(tl(q s)!i)\\set(q s)\") prefer 2\n apply (metis length_tl list.set_sel(2) nth_mem)\n apply(subgoal_tac \"tl(q s)!ia \\set(q s)\") prefer 2\n apply (metis One_nat_def)\n apply(subgoal_tac \"fst(tl(q s)!ia) >fst(hd(q s))\") prefer 2\n apply presburger\n apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n apply(subgoal_tac \"\\a b aa. (a, b) \\ set (q s) \\ (\\b. (aa, b) \\ set (q s)) \\ a < aa \\ a + b \\ aa\") prefer 2\n apply blast\n apply(subgoal_tac \"\\i.(i(tl(q s)!i)\\set(q s)\") prefer 2\n apply (metis length_tl list.set_sel(2) nth_mem)\n apply(subgoal_tac \"tl(q s)!ia \\set(q s)\") prefer 2\n apply (metis One_nat_def)\n apply(subgoal_tac \"fst(tl(q s)!ia) set(q s)\") prefer 2 \n apply (metis hd_in_set)\n apply(subgoal_tac \"last (tl (q s))\\set(q s)\") prefer 2\n apply (metis last_in_set last_tl) \n apply (metis fst_conv last_tl surj_pair)\n apply (metis Nat.add_0_right hd_conv_nth length_greater_0_conv)\n apply (metis add_cancel_right_right head_q0 length_greater_0_conv) defer\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n apply (metis bot_nat_0.extremum_uniqueI bot_nat_0.not_eq_extremum diff_is_0_eq' length_greater_0_conv)\n apply(simp) apply(thin_tac \"\\ case_1 s\") apply(simp add:case_2_def)\n apply meson\n apply(simp add:inv_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"hd(q s)\\set(q s)\") prefer 2 \n apply (metis hd_in_set) \n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis F.distinct(13) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n apply simp apply(thin_tac \"\\case_1 s\") apply(simp add:case_2_def)\n apply(simp add:pre_dequeue_inv_def)\n by (metis diff_self_eq_0 fst_conv le0 le_trans length_greater_0_conv nat_less_le plus_nat.add_0 snd_conv)\n\n\n\n\nlemma R_local_read_pre_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pcR s = Read\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n using assms apply(simp add:pre_R_def) apply clarify\n apply(simp add:cR_step_def)\n apply(simp add:pre_Release_inv_def)\n apply(intro conjI impI)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:inv_def) apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"hd(q s)\\set(q s)\")\n prefer 2 \n apply (meson list.set_sel(1))\n apply (metis Nat.add_0_right hd_conv_nth length_pos_if_in_set)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(intro conjI impI)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n apply blast\n apply metis\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n apply blast \n apply force\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n by(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n\n\nlemma R_local_pre_lemma:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n using assms apply(case_tac \"pcR s\") \n using R_local_release_pre_lemma [where s=s and s'=s'] apply blast (*done*)\n using R_local_idle_pre_lemma [where s=s and s'=s'] apply blast (*done*)\n using R_local_read_pre_lemma [where s=s and s'=s'] by blast (*done*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL W_step shows preR*************************************)\n\n\nlemma pcR_doesnt_change_with_W:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pcR s'=pcR s\"\n using assms apply simp\n apply(case_tac \"pcW s \", simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def)\n apply(simp add:cW_step_def) apply(cases \"numEnqs s < n\") \n apply(simp add:B_acquire_def) apply(simp add:B_acquire_def) \n apply(simp add:cW_step_def) apply(cases \"tW s \\ T s\") \n apply(simp add:cW_step_def) \n apply(simp add:cW_step_def) \n apply(simp add:cW_step_def) \n apply(simp add:cW_step_def) \n by(simp add:cW_step_def) \n\n\nlemma supporting_strange:\n \"\\i<(length (q s)).\n (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\\n fst (tempR s) + snd (tempR s) \\ fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\\n (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n \\ fst (tempR s)) \\ \n (fst (tempR s) < fst ((offset s, Data s (numEnqs s))) \\\n fst (tempR s) + snd (tempR s) \\ fst ((offset s, Data s (numEnqs s)))) \\\n (fst ((offset s, Data s (numEnqs s))) < fst (tempR s) \\\n fst ((offset s, Data s (numEnqs s))) +\n snd ((offset s, Data s (numEnqs s)))\n \\ fst (tempR s))\n\\\n \\i\n fst (tempR s) + snd (tempR s) \\ fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\\n (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n \\ fst (tempR s))\"\n by (metis less_SucE nth_append_length)\n\n\n\nlemma preRead_doesnt_change_with_W:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_Read_inv s\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_Read_inv s'\"\n using assms apply simp\n apply(simp add:pre_Read_inv_def) \n apply(intro conjI impI)\n apply(simp add:pre_W_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(cases \"pcW s\", simp_all)\n apply(simp_all add:cW_step_def)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(simp add:pre_W_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(simp add:pre_write_inv_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def)\n apply (metis F.distinct(1) eq_imp_le fst_eqD less_add_same_cancel1 snd_eqD)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply(cases \"numEnqs s T s\", simp_all)\n apply(cases \"pcW s\", simp_all)\n apply metis\n apply(case_tac \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply metis\n apply(case_tac \" hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all, metis)\n apply(case_tac \"tW s < hW s\", simp_all, metis, metis, metis, metis)\n apply(case_tac \" Data s (numEnqs s) \\ N - hW s\", simp_all, metis)\n apply(case_tac \" Data s (numEnqs s) < tW s\", simp_all, metis, metis, metis, metis, metis, metis)\n apply(case_tac \"numEnqs s < n\", simp_all, metis, metis)\n apply(cases \"tW s \\ T s\", simp_all, metis, metis, metis, metis, metis)\n apply(case_tac \"pcW s\", simp_all add:cW_step_def)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all) \n apply(cases \"pcW s\", simp_all) \n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(case_tac \" tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all) \n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(case_tac \"tW s < hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n apply(case_tac \" Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(simp add:pre_W_def pre_A5_inv_def)\n apply metis\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(simp add:pre_W_def pre_A5_inv_def)\n apply metis\n apply(simp add:pre_W_def pre_A5_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(clarify)\n apply(intro conjI impI)\n apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(simp add:pre_W_def pre_A8_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_A8_inv_def) defer\n apply(cases \"numEnqs s < n\", simp_all)\n apply(simp add:pre_W_def pre_acquire_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_acquire_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_OOM_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(cases \"tW s \\ T s\", simp_all)\n apply metis\n apply metis\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n defer\n defer\n defer \n apply(simp add:pre_W_def pre_enqueue_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(intro conjI impI)\n apply(simp add: tempW_def)\n apply(case_tac \"q s\\[]\") \n apply (metis (no_types, hide_lams) hd_append2)\n apply(subgoal_tac \"q s=[]\") prefer 2 \n apply force\n apply(subgoal_tac \"tempR s \\(0,0)\") prefer 2 \n apply blast\n apply(case_tac \"offset s = 0\")\n apply (metis append_Nil fst_conv list.sel(1))\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify \n apply(subgoal_tac \"c=b\") prefer 2 \n apply (metis le_neq_implies_less)\n apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n apply (metis end_simp le_add_diff_inverse)\n apply(subgoal_tac \"offset s = hW s\") prefer 2\n apply meson \n apply(subgoal_tac \"i\\c \\ iownB s i = W\") prefer 2\n apply metis\n apply(subgoal_tac \"H s\\N\") prefer 2 \n apply metis\n apply(subgoal_tac \"(i i\\H s \\ i\\N) \\ownB s i\\W\") prefer 2 \n apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le) \n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply clarify \n apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n apply(simp add: tempW_def)\n apply(case_tac \"q s=[]\")\n apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n apply(subgoal_tac \"q s\\[]\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\i fst (tempR s)\") prefer 2\n apply presburger\n apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\ fst(tempR s)\") \n apply (metis less_SucE nth_append nth_append_length)\n apply(subgoal_tac \"offset s \\ fst(tempR s)\") prefer 2 \n apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n apply(case_tac \"case_1 s\", simp_all) \n apply(subgoal_tac \"Data s (numReads s) = snd(tempR s)\") prefer 2 \n apply presburger\n apply(subgoal_tac \"Data s (numDeqs s - Suc 0) = snd(tempR s)\") prefer 2\n apply presburger \n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(subgoal_tac \"\\i\n fst (tempR s) + Data s (numDeqs s - Suc 0) \\ fst ((q s ) ! i)) \\\n (fst ((q s) ! i) < fst (tempR s) \\\n fst ((q s) ! i) + snd ((q s ) ! i)\n \\ fst (tempR s))\")\n prefer 2 \n apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\\n fst (tempR s) + Data s (numDeqs s - Suc 0) \\ fst(offset s, Data s (numEnqs s))) \\\n (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\\n fst(offset s, Data s (numEnqs s)) +\n snd(offset s, Data s (numEnqs s))\n \\ fst (tempR s))\") \n apply(subgoal_tac \"((q s @ [(offset s, Data s (numEnqs s))]) ! length (q s)) = (offset s, Data s (numEnqs s))\") prefer 2 \n apply (metis nth_append_length)\n apply(subgoal_tac \"\\i<(length (q s)).\n (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\\n fst (tempR s) + snd (tempR s) \\ fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\\n (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n \\ fst (tempR s))\") prefer 2 \n apply (metis (no_types, hide_lams) nth_append)\n using supporting_strange [where s=s] \n apply presburger\n apply(intro conjI impI)\n apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_def)\n apply(clarify)\n apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply clarify\n apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n apply(simp add: tempW_def)\n apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) + snd((offset s, Data s (numEnqs s))) \\ fst(tempR s)\")\n apply (metis fst_eqD snd_eqD)\n apply(subgoal_tac \"offset s \\ fst(tempR s)\") prefer 2 \n apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all)\n apply(simp add:case_1_def)\n apply(clarify)\n apply linarith\n apply(simp add:case_2_def) apply (thin_tac \"\\case_1 s\") \n apply(clarify)\n apply (metis add_gr_0 nat_neq_iff)\n apply(case_tac \"pcW s\", simp_all add:inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:case_2_def)\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply (metis (no_types, lifting) le_add_diff_inverse le_eq_less_or_eq less_trans_Suc not_less_eq_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\ case_1 s\")\n apply(simp add:pre_W_def pre_A4_inv_def) \n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(clarify)\n apply(subgoal_tac \"fst(tempR s) = 0 \\ fst(tempR s) = T s\") prefer 2\n apply meson\n apply(case_tac \"fst(tempR s) = T s\")\n apply(subgoal_tac \"hW s = b\") prefer 2 \n apply (metis le_imp_less_Suc le_refl le_trans not_less_less_Suc_eq)\n apply(subgoal_tac \"T s > hW s + Data s (numEnqs s)\") prefer 2 \n apply(subgoal_tac \"ownB s (T s) = R\") prefer 2\n apply (metis gr_implies_not0 le_refl)\n apply(subgoal_tac \"tW s = T s\") prefer 2\n apply (metis (no_types, lifting) add.commute le_trans less_diff_conv nat_less_le)\n apply(subgoal_tac \"Data s (numEnqs s) < (tW s - hW s)\") prefer 2 \n apply fastforce\n apply (metis add.commute less_diff_conv)\n apply (metis Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq)\n apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2\n apply fastforce\n apply(subgoal_tac \"end(tempR s) = a\") prefer 2 \n apply (metis add_cancel_left_left end_simp)\n apply(subgoal_tac \"hW s\\a\") prefer 2 \n apply (metis le_trans)\n apply (metis Suc_leI end_simp le_trans not_less_eq_eq)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(simp add:pre_W_def pre_A6_inv_def) \n apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n apply(simp add:case_2_def)\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(simp add:pre_W_def pre_A7_inv_def) \n apply clarify\n apply(intro conjI impI)\n apply linarith\n apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n apply(simp add:case_2_def)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply clarify\n apply(intro conjI impI)\n apply linarith\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n prefer 2\n apply(case_tac \"pcW s\", simp_all)\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"pcW s \", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n by(case_tac \"tW s \\ T s\", simp_all)\n \n\n\n\nlemma preIdleR_doesnt_change_with_W:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_dequeue_inv s\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_dequeue_inv s'\"\n using assms apply simp\n apply(simp add:pre_dequeue_inv_def) \n apply(intro conjI impI)\n apply(simp add:pre_W_def)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def pre_W_def)\n apply(cases \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply(cases \"ownT s = Q\", simp_all)\n apply(simp add:pre_A2_inv_def)\n apply(cases \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(cases \"tW s < hW s\", simp_all)\n apply(cases \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n apply(cases \"N < Data s (numEnqs s)\", simp_all)\n apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply (metis nat_less_le)\n apply simp apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis nat_less_le)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n apply(cases \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(cases \"tW s < hW s\", simp_all)\n apply(simp add:pre_A3_inv_def)\n apply(simp add:pre_A4_inv_def)\n apply(simp add:pre_A5_inv_def)\n apply(simp add:pre_A6_inv_def)\n apply(simp add:pre_A7_inv_def)\n apply(simp add:pre_A8_inv_def)\n apply(cases \"N < Data s (numEnqs s)\", simp_all)\n apply(simp add:pre_acquire_inv_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all) defer\n apply(cases \"pcW s\", simp_all add:cW_step_def B_acquire_def)\n apply(cases \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all add:pre_enqueue_inv_def inv_def)\n apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n apply(cases \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(cases \"tW s < hW s\", simp_all)\n apply(simp add:pre_A3_inv_def)\n apply(simp add:pre_A4_inv_def)\n apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 less_diff_conv less_imp_add_positive)\n apply(simp add:pre_A5_inv_def)\n apply(cases \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n apply(simp add:pre_A6_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify\n apply(subgoal_tac \"offset s = hW s\") prefer 2\n apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n apply (metis (no_types, lifting) F.distinct(19) add_lessD1 diff_self_eq_0 le_0_eq le_add_diff_inverse le_neq_implies_less length_0_conv)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply (metis Suc_leI not_less_eq_eq)\n apply(simp add:pre_A7_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify\n apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply (metis Suc_leI not_less_eq_eq)\n apply(simp add:pre_A8_inv_def)\n apply(cases \"N < Data s (numEnqs s)\", simp_all)\n apply(cases \"ownT s = W\", simp_all)\n apply (metis fst_conv le_trans nat_less_le snd_conv tempW_def)\n apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(case_tac \"case_1 s\", simp_all)\n apply(simp add:case_1_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"q s=[]\")\n apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n apply (metis le_trans less_imp_le_nat)\n apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n apply (metis (no_types, lifting) hd_append2)\n apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n apply (metis (no_types, lifting) hd_append2)\n apply presburger\n apply(simp add:case_2_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"q s=[]\")\n apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n apply (metis le_trans less_imp_le_nat)\n apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n apply (metis (no_types, lifting) hd_append2)\n apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n apply (metis (no_types, lifting) hd_append2)\n apply presburger\n apply(case_tac \"numEnqs s< n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s< n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \" hW s < tW s \\ Data s (numEnqs s) < tW s - hW s \", simp_all)\n apply(case_tac \"tW s < hW s\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply (simp add: pre_A3_inv_def)\n apply(case_tac \" Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(case_tac \"ownT s = W\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(simp add:pre_enqueue_inv_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify\n apply (metis (no_types, hide_lams) Nat.add_0_right diff_is_0_eq le_refl nat_add_left_cancel_less nat_neq_iff zero_less_diff)\n apply(simp add:case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n apply(simp add:pre_enqueue_inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify\n apply (metis (no_types, hide_lams) diff_self_eq_0 fst_eqD hd_append le_zero_eq length_0_conv less_add_same_cancel1 less_or_eq_imp_le list.sel(1) nat_less_le snd_eqD tempW_def)\n apply(simp add:case_2_def) \n apply(subgoal_tac \"\\a b j.\n ((a, b) \\ set (q s)) \\ j < N \\ T s \\ j \\\n a + b < j\") prefer 2\n apply (metis (no_types, lifting) hd_append length_greater_0_conv length_pos_if_in_set)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(subgoal_tac \"offset s + Data s (numEnqs s) j. T s \\ j \\\n offset s + Data s (numEnqs s) < j\") prefer 2 \n apply (metis (mono_tags, hide_lams) diff_is_0_eq le_trans nat_less_le zero_less_diff)\n apply (metis (no_types, lifting))\n apply(case_tac \"numEnqs s < n\", simp_all)\n by(case_tac \"tW s \\ T s\", simp_all)\n \n\n\n\n\n\n\n\nlemma preRelease_doesnt_change_with_W:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_Release_inv s\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_Release_inv s'\"\n using assms apply simp\n apply(simp add:pre_Release_inv_def) \n apply(intro conjI impI)\n apply(simp add:cW_step_def)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(simp_all add:cW_step_def)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply (metis F.distinct(1) fst_eqD less_add_same_cancel1 nat_le_linear snd_eqD)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply(cases \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(cases \"tW s < hW s\", simp_all)\n apply(case_tac \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(simp add:pre_W_def pre_enqueue_inv_def)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply (metis Nat.le_imp_diff_is_add hd_append length_0_conv list.sel(1) plus_nat.add_0 tempW_reflects_writes_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis fst_eqD head_q0 length_greater_0_conv)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply (metis F.distinct(1))\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all) defer\n apply(cases \"pcW s\", simp_all) \n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc) \n apply(simp add:pre_W_def pre_A6_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply (metis (mono_tags, hide_lams) F.distinct(13) le_antisym le_trans less_or_eq_imp_le nat_neq_iff)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply (metis (no_types, hide_lams) F.distinct(13) Suc_lessD less_trans_Suc) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all)\n apply(cases \"pcW s\", simp_all) \n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(cases \"numEnqs s < n\", simp_all)\n apply(cases \"tW s \\ T s\", simp_all) (*tempR doesnt change:*)\n apply(cases \"pcW s\", simp_all) \n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(case_tac \" tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all) \n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(case_tac \"tW s < hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n apply(case_tac \" Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(simp add:pre_W_def pre_A5_inv_def)\n apply metis\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(simp add:pre_W_def pre_A5_inv_def)\n apply metis\n apply(simp add:pre_W_def pre_A5_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply metis\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas) \n apply(intro conjI impI)\n apply metis\n apply (metis (no_types, lifting))\n apply(clarify)\n apply(intro conjI impI)\n apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(simp add:pre_W_def pre_A8_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_A8_inv_def) defer\n apply(cases \"numEnqs s < n\", simp_all)\n apply(simp add:pre_W_def pre_acquire_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_acquire_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply metis\n apply(simp add:pre_W_def pre_OOM_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(cases \"tW s \\ T s\", simp_all)\n apply metis\n apply metis\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n apply(simp add:pre_W_def pre_enqueue_inv_def) \n apply(simp add:tempR_lemmas tempR_basic_lemmas)\n apply(intro conjI impI)\n (*solved trivially by case ownership observation*)\n apply(simp add: tempW_def)\n apply(case_tac \"q s\\[]\") \n apply (metis (no_types, hide_lams) hd_append2)\n apply(subgoal_tac \"q s=[]\") prefer 2 \n apply force\n apply(subgoal_tac \"tempR s \\(0,0)\") prefer 2 \n apply blast\n apply(case_tac \"offset s = 0\")\n apply (metis append_Nil fst_conv list.sel(1))\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply clarify \n apply(subgoal_tac \"c=b\") prefer 2 \n apply (metis le_neq_implies_less)\n apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n apply (metis end_simp le_add_diff_inverse)\n apply(subgoal_tac \"offset s = hW s\") prefer 2\n apply meson \n apply(subgoal_tac \"i\\c \\ iownB s i = W\") prefer 2\n apply metis\n apply(subgoal_tac \"H s\\N\") prefer 2 \n apply metis\n apply(subgoal_tac \"(i i\\H s \\ i\\N) \\ownB s i\\W\") prefer 2 \n apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le) \n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply clarify \n apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n apply(simp add: tempW_def)\n apply(case_tac \"q s=[]\")\n apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n apply(subgoal_tac \"q s\\[]\") prefer 2 \n apply blast\n apply(subgoal_tac \"\\i fst (tempR s)\") prefer 2\n apply presburger\n apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\ fst(tempR s)\") \n apply (metis less_SucE nth_append nth_append_length)\n apply(subgoal_tac \"offset s \\ fst(tempR s)\") prefer 2 \n apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n apply(case_tac \"case_1 s\", simp_all) \n apply(subgoal_tac \"\\i\n fst (tempR s) + Data s (numReads s - Suc 0) \\ fst ((q s ) ! i)) \\\n (fst ((q s) ! i) < fst (tempR s) \\\n fst ((q s) ! i) + snd ((q s ) ! i)\n \\ fst (tempR s))\")\n prefer 2 \n apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\\n fst (tempR s) + Data s (numReads s - Suc 0) \\ fst(offset s, Data s (numEnqs s))) \\\n (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\\n end(offset s, Data s (numEnqs s))\n \\ fst (tempR s))\")\n apply (smt (z3) end_simp less_SucE nth_append nth_append_length)\n apply(intro conjI impI)\n apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_def)\n apply(clarify)\n apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\") \n apply clarify\n apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n apply(simp add: tempW_def)\n apply(subgoal_tac \"end((offset s, Data s (numEnqs s))) \\ fst(tempR s)\") \n apply (metis end_simp fst_conv snd_conv)\n apply(subgoal_tac \"offset s \\ fst(tempR s)\") prefer 2 \n apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n apply(simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all)\n apply(simp add:case_1_def)\n apply(clarify)\n apply linarith\n apply(simp add:case_2_def) apply (thin_tac \"\\case_1 s\") \n apply(clarify)\n by (metis add_gr_0 nat_neq_iff)\n\n\n\n\nlemma GLOBAL_W_step_shows_preR:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"pre_W (pcW s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"pre_R (pcR s') s'\"\n using assms apply simp\n apply(subgoal_tac \"pcR s' = pcR s\") prefer 2\n using pcR_doesnt_change_with_W [where s=s and s'=s']\n apply simp\n apply(simp add:pre_R_def) apply(case_tac \"pcR s\") apply simp_all\n using preRelease_doesnt_change_with_W [where s=s and s'=s'] apply simp \n using preIdleR_doesnt_change_with_W [where s=s and s'=s'] apply simp \n using preRead_doesnt_change_with_W [where s=s and s'=s'] \n by simp\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL R_step shows preW*************************************)\n\nlemma pcW_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"pre_W (pcW s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pcW s'=pcW s\"\n using assms apply simp\n apply(case_tac \"pcR s \", simp_all add:cR_step_def)\n by(case_tac \"q s=[]\", simp_all)\n\n\nlemma ownB_by_W_doesnt_change_after_release:\n \"inv s \\ con_assms s \\ pre_Release_inv s \\ cR_step Release s s'\n \\ownB s i = W \\ i\\N \\ ownB s' i = W \\ i\\N\"\n apply(simp add:inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_Release_inv_def)\n apply(case_tac \"T s \\ fst (tempR s)\") \n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply metis\n apply simp apply(simp add:case_2_def)\n apply (metis F.distinct(7) nat_less_le) \n apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_def)\n \nlemma ownB_not_by_W_doesnt_change_after_release:\n \"inv s \\ con_assms s \\ pre_Release_inv s \\ cR_step Release s s'\n \\ownB s i \\ W \\ i\\N \\ ownB s' i \\ W \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_read:\n \"inv s \\ con_assms s \\ pre_Read_inv s \\ cR_step Read s s'\n \\ownB s i = W \\ i\\N \\ ownB s' i = W \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\nlemma ownB_not_by_W_doesnt_change_after_read:\n \"inv s \\ con_assms s \\ pre_Read_inv s \\ cR_step Read s s'\n \\ownB s i \\ W \\ i\\N \\ ownB s' i \\ W \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_dequeue:\n \"inv s \\ con_assms s \\ pre_dequeue_inv s \\ cR_step idleR s s'\n \\ownB s i = W \\ i\\N \\ ownB s' i = W \\ i\\N\"\n apply(simp add:inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\")\n apply presburger\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis (no_types, hide_lams) F.distinct(3))\n apply simp apply(simp add:case_2_def)\n by (metis (no_types, hide_lams) F.distinct(3))\n\n\nlemma ownB_not_by_W_doesnt_change_after_dequeue:\n \"inv s \\ con_assms s \\ pre_dequeue_inv s \\ cR_step idleR s s'\n \\ownB s i \\ W \\ i\\N \\ ownB s' i \\ W \\ i\\N\"\n apply(simp add:inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\")\n apply presburger\n apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_def) \n\nlemma ownB_by_W_doesnt_change_with_R:\n \"inv s \\ con_assms s \\ cR_step (pcR s) s s' \\ pcR s = Release \\ pre_Release_inv s \\\n pcR s = Read \\ pre_Read_inv s \\ pcR s = idleR \\ pre_dequeue_inv s\n \\ownB s i = W \\ i\\N \\ ownB s' i = W \\ i\\N\"\n apply(case_tac \"pcR s \") apply simp_all\n using ownB_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n apply auto[1] \n using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n apply auto[1]\n using ownB_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n by auto[1]\n\nlemma ownB_not_by_W_doesnt_change_with_R:\n \"inv s \\ con_assms s \\ cR_step (pcR s) s s' \\ pcR s = Release \\ pre_Release_inv s \\\n pcR s = Read \\ pre_Read_inv s \\ pcR s = idleR \\ pre_dequeue_inv s\n \\ownB s i \\ W \\ i\\N \\ ownB s' i \\ W \\ i\\N\"\n apply(case_tac \"pcR s \") apply simp_all\n using ownB_not_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n apply auto[1] \n using ownB_not_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n apply auto[1]\n using ownB_not_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n by auto[1]\n\n\nlemma ownB_by_B_doesnt_change_after_release:\n \"inv s \\ con_assms s \\ pre_Release_inv s \\ cR_step Release s s'\n \\ownB s i = B \\ i\\N \\ ownB s' i = B \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_read:\n \"inv s \\ con_assms s \\ pre_Read_inv s \\ cR_step Read s s'\n \\ownB s i = B \\ i\\N \\ ownB s' i = B \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_dequeue:\n \"inv s \\ con_assms s \\ pre_dequeue_inv s \\ cR_step idleR s s'\n \\ownB s i = B \\ i\\N \\ ownB s' i = B \\ i\\N\"\n apply(simp add:inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\")\n apply presburger\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n by force\n\nlemma ownB_by_B_doesnt_change_with_R:\n \"inv s \\ con_assms s \\ cR_step (pcR s) s s' \\ pcR s = Release \\ pre_Release_inv s \\\n pcR s = Read \\ pre_Read_inv s \\ pcR s = idleR \\ pre_dequeue_inv s\n \\ownB s i = B \\ i\\N \\ ownB s' i = B \\ i\\N\"\n apply(case_tac \"pcR s \") apply simp_all\n using ownB_by_B_doesnt_change_after_release [where s=s and s'=s' and i=i]\n apply auto[1] \n using ownB_by_B_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n apply auto[1]\n using ownB_by_B_doesnt_change_after_read [where s=s and s'=s' and i=i]\n by auto[1]\n\n\n\nlemma ownB_by_D_doesnt_change_after_release:\n \"inv s \\ con_assms s \\ pre_Release_inv s \\ cR_step Release s s' \\tR s = fst(tempR s)\n \\ownB s i = D \\ i\\N \\ ownB s' i = D \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n \n\nlemma ownB_by_D_doesnt_change_after_read:\n \"inv s \\ con_assms s \\ pre_Read_inv s \\ cR_step Read s s'\n \\ownB s i = D \\ i\\N \\ ownB s' i = D \\ i\\N\"\n apply(simp add:inv_def)\n by(simp add:cR_step_def)\n\n\n\nlemma ownB_by_D_doesnt_change_after_dequeue:\n \"inv s \\ con_assms s \\ pre_dequeue_inv s \\ cR_step idleR s s'\n \\ownB s i = D \\ i\\N \\ ownB s' i = D \\ i\\N\"\n apply(simp add:inv_def)\n apply(simp add:cR_step_def)\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\", simp_all) \n by force\n\n\nlemma W_items_dont_change_with_R:\n \"cR_step (pcR s) s s' \n \\offset s = offset s' \\ Data s (numEnqs s) = Data s' (numEnqs s') \\ numEnqs s = numEnqs s' \"\n apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def)\n by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_2:\n \"cR_step (pcR s) s s' \n \\tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\"\n apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_3:\n \"cR_step (pcR s) s s' \n \\numWrites s=numWrites s' \\ H s= H s'\"\n apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n by(cases \"q s=[]\", simp_all) \n\nlemma ownB_by_D_relation_with_R:\n \"inv s \\con_assms s \\ pre_Read_inv s \\ pre_enqueue_inv s \\ \noffset s \\ fst(tempR s)\"\n apply (simp add:inv_def pre_Read_inv_def pre_enqueue_inv_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(clarify)\n apply(case_tac \"q s=[]\")\n apply(subgoal_tac \"b=c\") prefer 2\n apply (metis nat_less_le) apply(unfold tempW_lemmas tempW_basic_lemmas)\n apply(subgoal_tac \"offset s = c\") prefer 2\n apply (metis F.distinct(1) F.distinct(5) fst_conv le_iff_add less_or_eq_imp_le nat_less_le snd_conv)\n apply(subgoal_tac \"offset s = b\") prefer 2 \n apply force\n apply(subgoal_tac \"fst(tempR s )\\T s\") prefer 2 \n apply linarith apply(unfold tempR_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"snd( tempR s )>0\")\n apply metis\n apply metis\n apply(subgoal_tac \"b0\") \n apply (metis end_simp)\n apply (metis end_simp)\n apply simp\n apply(simp add:case_2_def)\n apply clarify\n apply(case_tac \"q s=[]\")\n apply(subgoal_tac \"d = fst(tempR s)\") prefer 2 \n apply (metis F.distinct(1) Nat.add_0_right le0 less_nat_zero_code nat_add_left_cancel_less)\n apply(subgoal_tac \"fst(tempW s) = b\") prefer 2 \n apply (metis F.distinct(1) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n apply(subgoal_tac \"snd(tempW s) > 0\") prefer 2\n apply (metis snd_eqD tempW_def)\n apply (metis fst_eqD le_neq_implies_less tempW_def)\n by (metis F.distinct(1) add_gr_0 le0)\n\n\nlemma R_doesnt_change_q_read_release:\n \"inv s \\ cR_step (pcR s) s s' \\ pcR s\\idleR \\ q s=q s'\"\n apply(simp add:inv_def cR_step_def)\n by(case_tac \"pcR s\", simp_all)\n\nlemma R_changes_q_dequeue:\n \"inv s \\ cR_step (pcR s) s s' \\ pcR s=idleR \\q s\\[] \\ tl(q s)=q s'\"\n by(simp add:inv_def cR_step_def)\n\nlemma strange_but_Q_1:\n \"q s\\[] \\ hd(q s) = q s!0\"\n by (simp add: hd_conv_nth)\n\nlemma strange_but_Q_2:\n \"length(q s)>1 \\hd(tl(q s)) = tl(q s)!0\"\n by (metis One_nat_def hd_conv_nth length_tl less_nat_zero_code list.size(3) zero_less_diff)\n\nlemma strange_but_Q_3:\n \"length(q s)>1 \\tl(q s)\\[]\"\n by (metis Nitpick.size_list_simp(2) One_nat_def less_numeral_extra(4) not_one_less_zero)\n\nlemma strange_but_Q_4:\n \"length(q s)>1 \\hd(tl(q s)) = q s!1\"\n by (simp add: nth_tl strange_but_Q_2)\n\nlemma R_doesnt_change_ownD_release_dequeue:\n \"cR_step (pcR s) s s'\\ pcR s\\Read \\\n ownD s= ownD s'\"\n apply(simp add: cR_step_def) \n apply(case_tac \"pcR s\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n\nlemma R_doesnt_change_ownD_read_except:\n \"cR_step (pcR s) s s'\\ pcR s=Read \\ \n i\\0 \\ i\\ data_index s (tempR s) \\ ownD s i= ownD s' i\"\n by(simp add: cR_step_def) \n\nlemma Q_empty_R_step_result:\n \"cR_step (pcR s) s s' \\ q s=[] \\ pcR s=idleR \\\nq s'=[]\"\n by (simp add:cR_step_def)\n\nlemma Q_W_relation_through_R_1:\n \"cR_step (pcR s) s s' \\ q s'\\[] \\ q s\\[] \\ pcR s = idleR \\\n\\i offset s + Data s (numEnqs s) < fst (q s ! i)) \\\n (fst (q s ! i) < offset s \\ fst (q s ! i) + snd (q s ! i) \\ offset s)\n\\\n\\i offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\\n (fst (q s' ! i) < offset s' \\ fst (q s' ! i) + snd (q s' ! i) \\ offset s')\"\n apply(simp add:cR_step_def)\n by (simp add: length_greater_0_conv nth_tl)\n\nlemma Q_W_relation_through_R_2:\n \"cR_step (pcR s) s s' \\ pcR s = Read \\\n\\i offset s + Data s (numEnqs s) < fst (q s ! i)) \\\n (fst (q s ! i) < offset s \\ fst (q s ! i) + snd (q s ! i) \\ offset s)\n\\\n\\i offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\\n (fst (q s' ! i) < offset s' \\ fst (q s' ! i) + snd (q s' ! i) \\ offset s')\"\n by(simp add:cR_step_def)\n\n\nlemma Q_W_relation_through_R_3:\n \"cR_step (pcR s) s s' \\ pcR s = Release \\\n\\i offset s + Data s (numEnqs s) < fst (q s ! i)) \\\n (fst (q s ! i) < offset s \\ fst (q s ! i) + snd (q s ! i) \\ offset s)\n\\\n\\i offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\\n (fst (q s' ! i) < offset s' \\ fst (q s' ! i) + snd (q s' ! i) \\ offset s')\"\n by(simp add:cR_step_def) \n\n\n\n\nlemma pre_write_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_write_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_write_inv s'\"\n using assms apply simp\n apply(simp add:pre_write_inv_def)\n apply(subgoal_tac \"end(tempW s )\\N\") prefer 2 apply(simp_all add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:pre_R_def)\n apply(intro conjI impI)\n apply(case_tac[!] \"pcR s\")\n apply simp_all apply(subgoal_tac \"\\i. offset s \\ i \\ i < fst (tempW s) + snd (tempW s) \\ ownB s i = W\") prefer 2 \n apply (metis fst_eqD snd_eqD tempW_def)\n apply(subgoal_tac \"hW s = hW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s = tW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply clarify \n apply(intro conjI impI)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(1) assms(2) less_or_eq_imp_le)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_add_same_cancel1 le_trans less_or_eq_imp_le not_gr_zero)\n apply clarify\n apply(intro conjI impI) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify\n apply(intro conjI impI) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply clarify \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply clarify\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply(case_tac \"tR s = fst(tempR s)\")\n using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) nat_less_le)\n apply (simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all)\n apply(simp add: case_1_def) \n apply (metis (no_types, hide_lams) F.distinct(25) F.distinct(7) \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ le0 le_refl nat_less_le nat_neq_iff prod.inject tempW_def)\n apply(thin_tac \"\\case_1 s\")\n apply(simp add:pre_Release_inv_def)\n apply(subgoal_tac \"T s\\fst(tempR s)\") prefer 2 \n apply blast\n apply(simp add:case_2_def)\n apply clarify\n apply(subgoal_tac \"fst(tempR s) = T s \\ fst(tempR s) = 0\") prefer 2 \n apply meson\n apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n apply presburger\n apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n apply metis\n apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n apply (metis Nat.add_0_right le_refl nat_add_left_cancel_less)\n apply (metis F.distinct(1) W_items_dont_change_with_R)\n using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n using W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) less_or_eq_imp_le \n apply presburger\n using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n using W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) less_or_eq_imp_le \n apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply (simp add: pre_Release_inv_def) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(simp add: pre_Read_inv_def) \n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply (metis last_tl)\n apply (metis last_tl)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis assms(5))\n apply(subgoal_tac \"(\\i offset s)\") prefer 2 \n apply presburger\n apply(subgoal_tac \"(\\i offset s)\") prefer 2\n apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n apply(subgoal_tac \"length(q s) - Suc 0 = length(tl(q s))\") prefer 2 \n apply (metis One_nat_def length_tl)\n apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis assms(5))\n apply(subgoal_tac \"(\\i offset s)\") prefer 2 \n apply presburger\n apply(subgoal_tac \"(\\i offset s)\") prefer 2 \n apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n apply (metis One_nat_def length_tl)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis assms(5))\n apply(subgoal_tac \"(\\i offset s)\") prefer 2 \n apply (metis length_0_conv less_nat_zero_code)\n apply(subgoal_tac \"offset s' = offset s\") prefer 2\n apply (metis fst_conv tempW_def)\n apply(subgoal_tac \"q s= q s'\") \n apply metis\n using R_doesnt_change_q_read_release [where s=s and s'=s']\n apply (metis PCR.distinct(5) assms(5)) \n using Q_W_relation_through_R_3 [where s=s and s'=s'] \n apply (simp add: \\\\RingBuffer_BD_latest_2.inv s; cR_step (pcR s) s s'; pcR s \\ idleR\\ \\ q s = q s'\\)\n apply(subgoal_tac \"q s\\[]\") prefer 2 \n apply (metis Q_empty_R_step_result)\n using Q_W_relation_through_R_1 [where s=s and s'=s']\n apply presburger \n using Q_W_relation_through_R_2 [where s=s and s'=s']\n apply (simp add: \\\\RingBuffer_BD_latest_2.inv s; cR_step (pcR s) s s'; pcR s \\ idleR\\ \\ q s = q s'\\)\n apply(subgoal_tac \"q s=q s'\") prefer 2 \n using R_doesnt_change_q_read_release [where s=s and s'=s']\n using PCR.distinct(1) apply presburger\n apply(subgoal_tac \"offset s + Data s (numEnqs s) \\ fst (hd (q s))\") prefer 2 \n apply metis\n apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis)\n apply (metis W_items_dont_change_with_R)\n apply(subgoal_tac \"offset s + Data s (numEnqs s) \\ fst (hd (q s))\") prefer 2 \n using cR_step_def apply force\n apply(subgoal_tac \"ioffset s + Data s (numEnqs s) \\ fst(q s ! i)\") prefer 2 \n apply (metis diff_add_zero length_0_conv less_irrefl_nat less_nat_zero_code linordered_semidom_class.add_diff_inverse)\n apply(subgoal_tac \"q s\\[]\") prefer 2 \n using PCR.simps(8) cR_step_def apply force\n apply(subgoal_tac \"fst(hd(q s')) = fst(hd(tl(q s)))\") prefer 2 \n using R_changes_q_dequeue apply presburger\n apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"offset s' = offset s\") prefer 2\n apply (metis fst_conv tempW_def)\n apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2\n using strange_but_Q_4 [where s=s] fst_def \n apply (metis R_changes_q_dequeue length_greater_0_conv length_tl zero_less_diff)\n apply (metis R_changes_q_dequeue cancel_comm_monoid_add_class.diff_cancel le_iff_add length_0_conv length_tl less_one linorder_neqE_nat nat_less_le snd_conv tempW_def)\n apply(subgoal_tac \"q s=q s'\") prefer 2 \n using R_doesnt_change_q_read_release [where s=s and s'=s']\n using PCR.distinct(5) apply presburger\n apply(subgoal_tac \"offset s + Data s (numEnqs s) \\ fst (hd (q s))\") prefer 2 \n apply metis\n apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis)\n apply (metis W_items_dont_change_with_R)\n apply clarify\n using W_items_dont_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n apply (metis \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ assms(1) assms(2) le_trans less_imp_le_nat)\n apply clarify\n using W_items_dont_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n apply (metis PCR.distinct(1) PCR.distinct(5) \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\ pre_Release_inv s; pcR s = Read \\ pre_Read_inv s; pcR s = idleR \\ pre_dequeue_inv s; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ assms(2) le_trans less_imp_le_nat)\n using W_items_dont_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n apply (metis PCR.distinct(3) PCR.distinct(5) \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\ pre_Release_inv s; pcR s = Read \\ pre_Read_inv s; pcR s = idleR \\ pre_dequeue_inv s; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ assms(2) le_trans less_imp_le_nat)\n apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n apply (metis W_items_dont_change_with_R_3 assms(5))\n using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n apply (metis PCR.distinct(3))\n apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n apply (metis W_items_dont_change_with_R_3 assms(5))\n using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n apply (metis PCR.distinct(5))\n apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n apply (metis W_items_dont_change_with_R_3 assms(5))\n apply(subgoal_tac \"numWrites s \\ data_index s (tempR s) \") prefer 2 \n apply(simp add:pre_Read_inv_def)\n using R_doesnt_change_ownD_read_except [where s=s and s'=s']\n apply (metis less_eq_nat.simps(1))\n apply(subgoal_tac \"q s=q s'\") prefer 2\n using R_doesnt_change_q_read_release [where s=s and s'=s']\n using PCR.distinct(1) apply presburger\n apply (metis W_items_dont_change_with_R)\n apply(simp add:inv_def pre_dequeue_inv_def)\n apply(subgoal_tac \"numEnqs s= 0\") prefer 2\n using W_items_dont_change_with_R apply presburger\n apply(subgoal_tac \"numDeqs s = 0\") prefer 2\n apply (metis less_nat_zero_code nat_less_le)\n apply(subgoal_tac \"q s=[]\") prefer 2\n apply meson\n apply(simp add:cR_step_def) \n apply(subgoal_tac \"q s=q s'\") prefer 2\n using R_doesnt_change_q_read_release [where s=s and s'=s']\n using PCR.distinct(5) apply presburger\n apply (metis W_items_dont_change_with_R)\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply metis\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply metis\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply metis\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using W_items_dont_change_with_R_3 [where s=s and s'=s']\n apply (metis)\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using W_items_dont_change_with_R_3 [where s=s and s'=s']\n apply (metis)\n using W_items_dont_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using W_items_dont_change_with_R_3 [where s=s and s'=s']\n by (metis)\n\n\n\nlemma pre_enqueue_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_enqueue_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_enqueue_inv s'\"\n using assms apply simp\n apply(simp add:pre_enqueue_inv_def)\n apply(subgoal_tac \"end(tempW s )\\N\") prefer 2 apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:pre_R_def)\n apply(intro conjI impI)\n apply(case_tac[!] \"pcR s\")\n apply simp_all apply(subgoal_tac \"\\i. offset s \\ i \\ i < fst (tempW s) + snd (tempW s) \\ ownB s i = W\") prefer 2\n apply metis apply(subgoal_tac \"\\i. offset s > i \\ i \\ fst (tempW s) + snd (tempW s) \\ i\\N \\ ownB s i \\ W\") prefer 2\n apply metis\n apply(subgoal_tac \"hW s = hW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s = tW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) end_simp le_trans less_or_eq_imp_le)\n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n apply clarify\n apply (intro conjI impI)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply clarify\n apply (intro conjI impI)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n apply clarify\n apply (intro conjI impI) \n apply(subgoal_tac \"iownB s i\\W\") prefer 2 \n apply presburger\n apply(subgoal_tac \"offset s = offset s'\") prefer 2 \n using PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) apply presburger\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(3) assms(2) le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(1) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(3) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n apply clarify\n apply(intro conjI impI) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def)\n apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_release prod.inject tempW_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify\n apply(intro conjI impI) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify\n apply(intro conjI impI) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply clarify\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(subgoal_tac \"tW s \\N\") prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:inv_def) \n using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n apply(case_tac \"tR s = fst(tempR s)\")\n using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) nat_less_le)\n apply (simp add:inv_def)\n apply(case_tac \"case_1 s\", simp_all)\n apply(simp add: case_1_def)\n apply (metis F.distinct(15) F.distinct(21) F.distinct(25) F.distinct(7) W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ less_eq_Suc_le not_less_eq_eq)\n apply(thin_tac \"\\case_1 s\")\n apply(simp add:pre_Release_inv_def)\n apply(subgoal_tac \"T s\\fst(tempR s)\") prefer 2 \n apply blast\n apply(simp add:case_2_def)\n apply clarify\n apply(subgoal_tac \"fst(tempR s) = T s \\ fst(tempR s) = 0\") prefer 2 \n apply meson\n apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n apply presburger\n apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n apply metis\n apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n apply (metis \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ fst_eqD nat_le_iff_add plus_nat.add_0 snd_eqD tempW_def)\n apply (metis F.distinct(1) W_items_dont_change_with_R)\n using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n using W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) less_or_eq_imp_le \n apply presburger\n using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n using W_items_dont_change_with_R \\cR_step (pcR s) s s' \\ tempW s = tempW s' \\ tW s = tW s' \\ hW s = hW s' \\ data_index s = data_index s'\\ assms(2) less_or_eq_imp_le \n apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply (simp add: pre_Release_inv_def) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(simp add: pre_Read_inv_def) \n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(intro conjI impI)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n apply (metis fst_conv snd_conv tempW_def)\n apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n apply (metis (no_types, lifting) PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R) \n apply (metis W_items_dont_change_with_R \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ assms(2) le_trans less_imp_le_nat)\n prefer 2\n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(intro conjI impI)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n apply (metis fst_conv snd_conv tempW_def) \n apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n apply (metis (no_types, lifting) PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\ pre_Release_inv s; pcR s = Read \\ pre_Read_inv s; pcR s = idleR \\ pre_dequeue_inv s; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\ pre_Release_inv s; pcR s = Read \\ pre_Read_inv s; pcR s = idleR \\ pre_dequeue_inv s; ownB s i \\ W \\ i \\ N\\ \\ ownB s' i \\ W \\ i \\ N\\ assms(2) le_trans less_imp_le_nat)\n apply(simp add:tempW_lemmas tempW_basic_lemmas) \n apply(intro conjI impI) apply(simp add:pre_dequeue_inv_def)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply (metis fst_conv snd_conv tempW_def) \n apply(case_tac \"length(q s)>1\", simp_all)\n apply(subgoal_tac \"last(q s) = last(tl(q s))\") prefer 2 \n apply (metis R_changes_q_dequeue last_tl)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply(subgoal_tac \"q s\\[]\") prefer 2\n apply (metis length_0_conv less_nat_zero_code)\n apply (simp add: R_changes_q_dequeue W_items_dont_change_with_R)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply(subgoal_tac \"length(q s) = 1 \\ tl(q s) = []\") prefer 2 \n apply (metis cancel_comm_monoid_add_class.diff_cancel length_greater_0_conv length_tl not_gr0)\n apply(case_tac \"q s=[]\") prefer 2 \n apply (metis One_nat_def R_changes_q_dequeue Suc_lessI length_greater_0_conv)\n apply(simp add:pre_dequeue_inv_def)\n apply(subgoal_tac \"q s= []\") prefer 2\n apply blast\n apply(subgoal_tac \"q s'=[]\") prefer 2\n using Q_empty_R_step_result [where s=s and s'=s'] \n apply presburger\n apply linarith\n apply(subgoal_tac \"q s\\[]\") prefer 2\n using \\\\cR_step (pcR s) s s'; q s = []; pcR s = idleR\\ \\ q s' = []\\ apply presburger\n apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n using R_changes_q_dequeue apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply (metis in_set_conv_nth list.set_sel(2) prod.inject tempW_def)\n using Q_W_relation_through_R_1 [where s=s and s'=s']\n using \\\\cR_step (pcR s) s s'; q s = []; pcR s = idleR\\ \\ q s' = []\\ apply presburger\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n using R_changes_q_dequeue \n using \\\\cR_step (pcR s) s s'; q s = []; pcR s = idleR\\ \\ q s' = []\\ apply presburger\n apply(subgoal_tac \"offset s = offset s' \\ numEnqs s = numEnqs s'\") prefer 2\n using W_items_dont_change_with_R [where s=s and s'=s']\n apply presburger\n apply (metis Nat.add_0_right \\\\cR_step (pcR s) s s'; q s = []; pcR s = idleR\\ \\ q s' = []\\ \\cR_step (pcR s) s s' \\ offset s = offset s' \\ Data s (numEnqs s) = Data s' (numEnqs s') \\ numEnqs s = numEnqs s'\\ hd_in_set in_set_conv_nth less_not_refl list.set_sel(2) nat_add_left_cancel_less)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply presburger \n apply(subgoal_tac \"offset s = offset s'\") prefer 2\n using \\cR_step (pcR s) s s' \\ offset s = offset s' \\ Data s (numEnqs s) = Data s' (numEnqs s') \\ numEnqs s = numEnqs s'\\ apply presburger\n apply(subgoal_tac \"Data s' (numEnqs s') = Data s (numEnqs s)\") prefer 2 \n apply (metis \\cR_step (pcR s) s s' \\ offset s = offset s' \\ Data s (numEnqs s) = Data s' (numEnqs s') \\ numEnqs s = numEnqs s'\\)\n apply(subgoal_tac \"\\j. offset s \\ j \\ j < offset s + Data s (numEnqs s) \\ ownB s j = W\") prefer 2 \n apply presburger\n apply(clarify) \n using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=j]\n apply (metis PCR.distinct(1) PCR.distinct(5) \\\\i. \\RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\ pre_Release_inv s; pcR s = Read \\ pre_Read_inv s; pcR s = idleR \\ pre_dequeue_inv s; ownB s i = W \\ i \\ N\\ \\ ownB s' i = W \\ i \\ N\\ assms(2) le_trans less_or_eq_imp_le)\n apply(simp add:tempW_reflects_writes_def)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n apply(simp add: pre_Read_inv_def)\n apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n apply meson\n apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R)\n apply(simp add:tempW_reflects_writes_def)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n apply(simp add: pre_Read_inv_def)\n apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n apply meson\n apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R)\n apply(simp add:tempW_reflects_writes_def)\n apply(subgoal_tac \"hW s = hW s' \\ tW s = tW s' \\ tempW s = tempW s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n apply(simp add: pre_Read_inv_def)\n apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n apply meson\n apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n using W_items_dont_change_with_R_2 [where s=s and s'=s']\n apply (metis)\n using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n apply (metis W_items_dont_change_with_R)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:pre_Read_inv_def)\n apply(simp add:cR_step_def)\n apply(case_tac \" tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \" ownT s = R\", simp_all)\n apply(case_tac \" ownT s = R\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \" ownT s = Q\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n by(simp add:cR_step_def)\n\n\n\n\n\n\n\n\nlemma pre_A1_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A1_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A1_inv s'\"\n using assms apply simp\n apply(simp add:pre_A1_inv_def) \n apply(intro conjI impI)\n apply(simp add:cR_step_def)\n apply(cases \"pcR s\", simp_all) \n apply(cases \" tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def) \n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis Nat.add_diff_assoc diff_diff_left diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis not_add_less1)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \" ownT s = Q \", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n apply(cases \"pcR s\", simp_all)\n apply(simp add:cR_step_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n apply(simp add:cR_step_def)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis diff_self_eq_0 le_antisym le_neq_implies_less length_greater_0_conv less_imp_Suc_add nat.distinct(1) plus_nat.add_0)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis not_add_less1)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \" ownT s = Q \", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_refl)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \" ownT s = Q \", simp_all)\n apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n apply (metis le_antisym nat_less_le)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, lifting) F.distinct(19))\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis F.distinct(13) F.distinct(17) le_eq_less_or_eq)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply (metis le_eq_less_or_eq nat_le_linear)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \" ownT s = Q \", simp_all)\n apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(cases \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n by(case_tac \"q s = []\", simp_all)\n\n\n\nlemma pre_A2_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A2_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A2_inv s'\"\n using assms apply simp\n apply(simp add:pre_A2_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"ownT s = R\", simp_all) \n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def) \n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def) \n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply metis\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"q s = []\", simp_all)\n apply metis\n apply metis\n apply metis\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply(case_tac \"q s = []\", simp_all)\n apply blast\n by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n\n\n\n\n\nlemma pre_A3_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A3_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A3_inv s'\"\n using assms apply simp\n apply(simp add:pre_A3_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n by(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n\n\n\n\nlemma pre_A4_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A4_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A4_inv s'\"\n using assms apply simp\n apply(simp add:pre_A4_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"q s=[]\", simp_all)\n apply metis+\n apply(case_tac \"q s=[]\", simp_all)\n by metis+\n \n\n\n\nlemma pre_A5_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A5_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A5_inv s'\"\n using assms apply simp\n apply(simp add:pre_A5_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_trans)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"q s=[]\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n \n\n\n\nlemma pre_A6_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A6_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A6_inv s'\"\n using assms apply simp\n apply(simp add:pre_A6_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_trans)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"q s=[]\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\n\nlemma pre_A7_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A7_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A7_inv s'\"\n using assms apply simp\n apply(simp add:pre_A7_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_trans)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq)\n apply(case_tac \"q s=[]\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\nlemma pre_A8_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_A8_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_A8_inv s'\"\n using assms apply simp\n apply(simp add:pre_A8_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis (no_types, hide_lams) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all) \n apply (metis (no_types, lifting) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply metis\n apply metis\n apply(case_tac \"ownT s = R\", simp_all)\n apply metis\n apply metis\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis (no_types, lifting) F.distinct(19))\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left le_trans)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n apply(case_tac \"q s=[]\", simp_all) \n apply metis+\n apply(case_tac \"q s=[]\", simp_all)\n by metis+\n\n\n\n\n\nlemma pre_acquire_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_acquire_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_acquire_inv s'\"\n using assms apply simp\n apply(simp add:pre_acquire_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply metis\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis add_cancel_right_left diff_add_inverse2 le_0_eq le_antisym length_0_conv nat_less_le)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis not_add_less1)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis le_antisym le_neq_implies_less less_imp_Suc_add nat.distinct(1) ordered_cancel_comm_monoid_diff_class.le_imp_diff_is_add plus_nat.add_0)\n apply(case_tac \"ownT s =R\", simp_all) \n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def) \n apply (metis Nat.add_0_right diff_self_eq_0 le_add_diff_inverse le_antisym le_zero_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis not_add_less1)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis less_or_eq_imp_le plus_nat.add_0)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis (mono_tags, hide_lams) F.distinct(19))\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply (metis le_add_diff_inverse le_eq_less_or_eq)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply (metis plus_nat.add_0)\n apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp add:pre_dequeue_inv_def)\n apply (metis (mono_tags, hide_lams) F.distinct(19))\n apply(simp add:pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n\n\n\nlemma pre_OOM_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_OOM_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_OOM_inv s'\"\n using assms apply simp\n apply(simp add:pre_OOM_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all) \n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp add:case_2_def) apply(thin_tac \"\\case_1 s\")\n apply(case_tac \"ownT s =R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"q s=[]\", simp_all) \n apply (metis (no_types, lifting) F.distinct(19))\n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"T s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all) \n apply blast\n by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n \n\n\n\n\nlemma pre_finished_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_finished_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_finished_inv s'\"\n using assms apply simp\n apply(simp add:pre_finished_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\n\nlemma pre_BTS_doesnt_change_with_R:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_BTS_inv s\"\n and \"pre_R (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_BTS_inv s'\"\n using assms apply simp\n apply(simp add:pre_BTS_inv_def) \n apply(intro conjI impI)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s =R\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all)\n apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"q s=[]\", simp_all)\n apply(case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply(case_tac \"ownT s = R\", simp_all)\n apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply blast\n by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n \n\n\n\n(*******************************GLOBAL R_step preserves preW*************************************)\n\n\n\nlemma GLOBAL_R_step_shows_preW:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"pre_R (pcR s) s\"\n and \"pre_W (pcW s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"pre_W (pcW s') s'\"\n using assms apply simp\n apply(subgoal_tac \"pcW s' = pcW s\") prefer 2\n using pcW_doesnt_change_with_R [where s=s and s'=s']\n apply simp\n apply(simp add:pre_W_def) apply(case_tac \"pcW s\") apply simp_all\n using pre_A1_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A2_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A3_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A4_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A5_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A6_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A7_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_A8_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_enqueue_doesnt_change_with_R [where s=s and s'=s'] apply simp \n using pre_acquire_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_OOM_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_finished_doesnt_change_with_R [where s=s and s'=s'] apply simp\n using pre_write_doesnt_change_with_R [where s=s and s'=s'] apply simp \n using pre_BTS_doesnt_change_with_R [where s=s and s'=s'] by simp\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*writer side enqueue------------------------*)\nlemma enqueue_preserves_Q_n_n:\n assumes \"q s\\[]\"\n and \"Q_structure s\"\n and \"Q_enqueue s s'\"\n and \"numDeqs sW\"\n and \"numWrites s\\numReads s\"\nshows \"Q_structure s'\"\n using assms apply (simp)\n apply (case_tac \"ownT s = W\", simp_all)\n apply(simp add:Q_structure_def) apply(intro conjI impI)\n apply(simp add:Q_basic_lemmas) apply(intro conjI impI)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(subgoal_tac \"\\i. i < length (q s) \\ 0 < i \\\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! (i - Suc 0)) +\n snd ((q s @ [(offset s, Data s (numEnqs s))]) ! (i - Suc 0)) =\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\\n fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) = 0\") prefer 2 apply clarify \n apply (smt (z3) Suc_lessD Suc_pred nat_neq_iff nth_append)\n apply(subgoal_tac \"fst(tempW s) =end(last(q s)) \\ fst(tempW s) =0\")\n prefer 2 \n apply (metis end_simp fst_conv tempW_def)\n apply(subgoal_tac \"last(q s) =(q s!(length(q s)-1))\") prefer 2\n apply (metis last_conv_nth)\n apply clarify\n apply(subgoal_tac \"offset s =0\\(\\i.(ifst(q s!i)\\0)\") prefer 2\n apply metis\n apply(subgoal_tac \"(\\i.(ifst(q s!i) =0))\\offset s\\0\") prefer 2\n apply blast\n apply(case_tac \"offset s=0\")\n apply (metis (no_types, lifting) One_nat_def diff_Suc_less end_simp less_antisym nat_neq_iff nth_append nth_append_length tempW_def)\n apply (metis (no_types, lifting) One_nat_def diff_Suc_less end_simp less_antisym nat_neq_iff nth_append nth_append_length tempW_def)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply (smt (z3) less_antisym nth_append nth_append_length prod.collapse prod.inject)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas) apply clarify\n apply(case_tac \"a = offset s \\ b = Data s (numEnqs s)\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis (no_types, lifting) fst_eqD in_set_conv_nth less_imp_le_nat)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"aa = offset s \\ ba = Data s (numEnqs s)\", simp_all)\n apply (metis (no_types, lifting) fst_conv in_set_conv_nth snd_conv)\n apply (metis (no_types, hide_lams))\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas) \n apply (metis (no_types, lifting) fst_eqD in_set_conv_nth nat_neq_iff not_add_less1)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(subgoal_tac \"\\i[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s numWrites s\\numReads s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\"\n shows \"Q_structure s'\"\n using assms apply (simp)\n apply (case_tac \"ownT s = W\", simp_all)\n apply(simp add:Q_structure_def)\n apply(intro conjI impI)\n apply(simp add:Q_basic_lemmas)\n apply(intro conjI impI) apply(simp add:pre_enqueue_inv_def)\n apply blast\n apply(simp add:pre_enqueue_inv_def)\n apply blast\n apply(simp add:pre_enqueue_inv_def)\n apply blast\n apply(simp add:pre_enqueue_inv_def)\n apply(simp add:pre_enqueue_inv_def)\n apply(simp add:pre_enqueue_inv_def)\n apply meson\n apply(simp add:pre_enqueue_inv_def)\n apply blast\n apply(simp add:pre_enqueue_inv_def)\n apply blast\n apply(simp add:pre_enqueue_inv_def)\n by blast\n\n\nlemma enqueue_preserves_Q_e_o:\n assumes \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s=numEnqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\"\n shows \"Q_structure s'\"\n using assms apply simp\n apply(case_tac \"ownT s = W\", simp_all)\n apply(simp add:Q_structure_def) apply(intro conjI impI)\n apply(simp add:Q_basic_lemmas) apply(intro conjI impI)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply (metis gr0I)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_holds_bytes_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_reflects_writes_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_elem_size_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n by(simp add:Q_reflects_ownD_def)\n\n\nlemma enqueue_preserves_Q_e_n:\n assumes \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s=numEnqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s \\W\"\n shows \"Q_structure s'\"\n using assms apply simp\n apply(case_tac \"ownT s = W\", simp_all)\n apply(simp add:Q_structure_def) apply(intro conjI impI)\n apply(simp add:Q_basic_lemmas) apply(intro conjI impI)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply (metis gr0I)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_holds_bytes_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_reflects_writes_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n apply(simp add:Q_elem_size_def)\n apply(simp add:pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n by(simp add:Q_reflects_ownD_def)\n\n\nlemma enqueue_preserves_Q:\n assumes \"Q_structure s\n \\ Q_enqueue s s'\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ numEnqs s\\numDeqs s\n \\ ownD s(numEnqs s) =B\"\n shows \"Q_structure s'\"\n using assms apply simp\n apply(case_tac \"q s=[]\")\n apply(case_tac[!] \"ownT s = W\", simp_all) \n defer defer defer\n(*4*)\n apply(subgoal_tac \"q s\\[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s \\W\") using enqueue_preserves_Q_n_n \n apply presburger\n apply (metis assms length_greater_0_conv zero_less_diff) defer defer\n(*3*)\n apply(subgoal_tac \"q s\\[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\") prefer 2 \n apply (metis assms length_greater_0_conv zero_less_diff) using enqueue_preserves_Q_n_o\nproof -\nassume a1: \"Q_structure s \\ s' = s \\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\ \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\nassume \"q s \\ []\"\n assume a2: \"ownT s = W\"\n assume a3: \"q s \\ [] \\ Q_structure s \\ Q_enqueue s s' \\ numDeqs s < numEnqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ ownD s (numEnqs s) = B \\ ownT s = W\"\n have \"\\r. W \\ ownT s \\ B \\ ownD s (numEnqs s) \\ \\ pre_enqueue_inv s \\ Q_structure r \\ \\ numReads s \\ numWrites s \\ \\ numDeqs s < numEnqs s \\ \\ Q_enqueue s r \\ \\ Q_structure s \\ [] = q s\"\n using a1 by (smt (z3) enqueue_preserves_Q_n_o)\n then have \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\)\"\n using a3 a1 by (metis (full_types))\n then show \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\)\"\n using a2 by presburger\nnext\n show \"Q_structure s \\\n s' = s\n \\numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB\n ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\))\n s\n \\numEnqs := Suc (numEnqs s)\\)\n i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\\n numEnqs s \\ numDeqs s \\\n pre_enqueue_inv s \\\n numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B \\\n q s = [] \\\n ownT s \\ W \\\n (\\s s'.\n q s \\ [] \\\n Q_structure s \\\n Q_enqueue s s' \\\n numDeqs s < numEnqs s \\\n numReads s \\ numWrites s \\\n length (q s) = numEnqs s - numDeqs s \\\n pre_enqueue_inv s \\ ownD s (numEnqs s) = B \\ ownT s = W \\\n Q_structure s') \\\n Q_structure\n (s\\numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB (s\\ownT := ownT s, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n(*2*)\n apply(subgoal_tac \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numEnqs s = numDeqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s \\W\") prefer 2 \n apply(subgoal_tac \"q s=[]\") prefer 2 apply blast\n apply(subgoal_tac \"ownT s \\W\") prefer 2 apply blast\n apply(subgoal_tac \"ownD s(numEnqs s) =B\") prefer 2 apply blast\n apply(subgoal_tac \"pre_enqueue_inv s\") prefer 2 apply blast\n apply(subgoal_tac \"length(q s) = numEnqs s-numDeqs s\") prefer 2 using assms apply blast \n apply(subgoal_tac \"Q_structure s\") prefer 2 apply blast\n apply(subgoal_tac \"Q_enqueue s s'\") prefer 2 using assms apply blast\n apply(subgoal_tac \"q s=[]\\length(q s) = 0\") prefer 2 \n apply blast\n apply(subgoal_tac \"numEnqs s = numDeqs s\") \n apply blast\n apply(subgoal_tac \"q s\\[]\\length(q s)\\0\") prefer 2 \n apply blast\n apply(subgoal_tac \"q s=[]\\length(q s) =0\") prefer 2\n apply blast \n apply(subgoal_tac \"length(q s)\\0\") prefer 2\n apply blast\n apply(subgoal_tac \"numEnqs s \\0\") prefer 2\n apply blast\n apply(subgoal_tac \"numDeqs s \\0\") prefer 2\n apply blast\n apply(subgoal_tac \"(length(q s) = numEnqs s-numDeqs s \\ length(q s)\\0 \\ \n numEnqs s\\0 \\ numDeqs s\\0 \\ length(q s) = 0)\\numEnqs s-numDeqs s=0\") prefer 2\n apply presburger \n using dual_order.antisym apply blast\n using enqueue_preserves_Q_e_n \n proof -\n assume a1: \"Q_structure s \\ s' = s \\numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\ numEnqs s \\ numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\n assume \"q s = []\"\n assume a2: \"ownT s \\ W\"\n assume a3: \"q s = [] \\ Q_structure s \\ Q_enqueue s s' \\ numEnqs s = numDeqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ ownD s (numEnqs s) = B \\ ownT s \\ W\"\n then have \"\\r. numDeqs s - numDeqs s \\ length (q s) \\ B \\ ownD s (numEnqs s) \\ Q_structure r \\ \\ Q_enqueue s r \\ [] \\ q s\"\n by (metis (full_types) enqueue_preserves_Q_e_n)\n then have \"Q_structure (s\\numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n using a3 a1 by (metis (full_types))\n then show ?thesis\n using a2 by presburger\n qed\nnext \n(*1*)\n show \"Q_structure s \\\n s' = s\n \\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB\n ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\))\n s\n \\numEnqs := Suc (numEnqs s)\\)\n i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\\n numEnqs s \\ numDeqs s \\\n pre_enqueue_inv s \\\n numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B \\\n q s = [] \\\n ownT s = W \\\n (\\s s'.\n q s \\ [] \\\n Q_structure s \\\n Q_enqueue s s' \\\n numDeqs s < numEnqs s \\\n numReads s \\ numWrites s \\\n length (q s) = numEnqs s - numDeqs s \\\n pre_enqueue_inv s \\ ownD s (numEnqs s) = B \\ ownT s = W \\\n Q_structure s') \\\n Q_structure\n (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n apply(subgoal_tac \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s=numEnqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\") prefer 2 \n using assms verit_la_disequality apply blast using enqueue_preserves_Q_e_o\nproof -\nassume a1: \"Q_structure s \\ s' = s \\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\ numEnqs s \\ numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\n assume \"q s = []\"\nassume a2: \"ownT s = W\"\nassume a3: \"q s = [] \\ Q_structure s \\ Q_enqueue s s' \\ numDeqs s = numEnqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ ownD s (numEnqs s) = B \\ ownT s = W\"\nthen have \"\\r. B \\ ownD s (numEnqs s) \\ Q_structure r \\ \\ Q_enqueue s r\"\nusing a1 enqueue_preserves_Q_e_o by blast\n then have \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\nusing a3 a1 by (metis (full_types))\n then show ?thesis\n using a2 by presburger\nqed\nqed\n\n\n\n\n(*----------enqueue end-----------------------*)\n\n\n\n\n\n\n(*****************old stuff************************************************************)\n\n\n\n(*\n\nlemma Q_no_buffer_overlap_lemma_2:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\b c.(b c\\N \\ (\\i.(b\\i\\cownB s i=Q) \\ b=fst(q s ! 0) \\ c=end(last(q s)))\"\n using assms apply simp\n apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas case_1_def) \n by (metis (no_types, lifting) assms(2) diff_is_0_eq' head_q0 le_eq_less_or_eq less_trans_Suc not_less_eq_eq)\n\nlemma Q_no_buffer_overlap_lemma_3:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"fst(hd(q s))0\"\n and \"con_assms s\"\n and \"case_1 s\"\n and \"ownB s 0 = Q\"\nshows \"\\i.(i i>0)\\fst(q s!i) = end(q s!(i-1))\"\n using assms apply simp\n apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas case_1_def)\n by (metis F.distinct(11) F.distinct(19) F.distinct(3) assms(2) head_q0 le_add2 le_add_same_cancel2 not_gr0)\n\n\n\nlemma Q_no_buffer_overlap_lemma_5:\n assumes \"Q_structure s\"\n and \"length(q s) >0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\i.(i i>0)\\fst(q s!i) = end(q s!(i-1))\"\n using assms apply simp\n apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas case_1_def inv_def) \n using case_1_Q_struct [where s=s]\n by (metis One_nat_def assms(1) assms(5) end_simp)\n\n\nlemma Q_no_buffer_overlap_lemma_6:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\i j.(i=j+1 \\ i j\\0)\\fst(q s!i) = end(q s!j)\"\n using Q_no_buffer_overlap_lemma_5 \n by (metis add_diff_cancel_right' add_nonneg_pos assms(1) assms(2) assms(3) assms(4) assms(5) zero_less_one)\n\n\nlemma Q_no_buffer_overlap_lemma_7:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\i j.(i=j+1 \\ i j\\0)\\fst(q s!i) > fst(q s!j)\"\n by (metis Q_gap_lemmas_5_list Q_no_buffer_overlap_lemma_6 add_lessD1 assms(1) assms(2) assms(3) assms(4) assms(5) nat_le_linear)\n \n\nlemma Q_no_buffer_overlap_lemma_8:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\i j.( i j>0 \\ i>j \\ fst(q s!i)>fst(q s!j))\\fst(q s!i) > fst(q s!(j-1))\"\n using Q_no_buffer_overlap_lemma_5 assms(1) assms(3) assms(4) assms(5) by fastforce\n\n\n\nlemma Q_no_buffer_overlap_lemma_9:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\i.(ownB s i = Q \\ i(\\a b.((a,b)\\set(q s)\\ a\\i \\ i0\"\n and \"inv s\"\n and \"con_assms s\"\nshows \"\\i.(ownB s i = Q \\ i(\\a b.((a,b)\\set(q s)\\ a\\i \\ i0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_1 s\"\nshows \"\\a b.((a,b)\\set(q s))\\(\\j.(a\\j \\ jownB s j = Q)\"\n using assms apply simp\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas con_assms_def case_1_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def butlast_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\n\nlemma Q_overlap_lemma_3:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"case_2 s\"\nshows \"\\a b.((a,b)\\set(q s))\\(\\j.(a\\j \\ jownB s j = Q)\"\n using assms apply simp\n apply(simp add:inv_def Q_lemmas Q_basic_lemmas con_assms_def case_2_def)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def butlast_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\nlemma Q_overlap_lemma_4_B:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\n and \"(a,b)\\set(q s)\"\n and \"a\\j\" \n and \"j0\"\n and \"inv s\"\n and \"con_assms s\"\nshows \"\\a b.((a,b)\\set(q s))\\(\\j.(a\\j \\ jownB s j = Q)\"\n using Q_overlap_lemma_4_B \n using assms(1) assms(2) assms(3) assms(4) by blast\n\n\nlemma Q_overlap_lemma_5:\n assumes \"Q_structure s\"\n and \"length(q s)>0\"\n and \"inv s\"\n and \"con_assms s\"\nshows \"\\i.(i(\\j.(fst(q s!i)\\j \\ jownB s j = Q)\"\n using assms Q_overlap_lemma_4 [where s=s]\n by (metis Q_gap_lemmas_2 end_simp prod.collapse)\n \n\n\n\n\n\nlemma Q_buffer_overlap_lemma_A4_1:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"length(q s)>0\"\nshows \"\\i j.(i jfst(q s!i)end(q s!i)\\fst(q s!j)\"\n using Q_gap_lemmas_4_list assms(3) assms(5)\n by auto\n\n\nlemma Q_buffer_overlap_lemma_A4_2:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\nshows \"hW s = end(last(q s))\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def)\n by (metis (no_types, hide_lams) F.distinct(23) assms(7) diff_add_inverse2 le_antisym le_eq_less_or_eq linorder_neqE_nat zero_less_iff_neq_zero)\n\n\nlemma Q_buffer_overlap_lemma_A4_3:\n assumes \"inv s\"\n and \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\nshows \"tW s>hW s\"\n using assms by(simp add:inv_def pre_A4_inv_def case_2_def) \n\n\n\nlemma Q_buffer_overlap_lemma_A4_4:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\nshows \"(\\i.(ownB s i=R\\iownB s (T s) = R\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply clarify apply(subgoal_tac \"T s=c\") prefer 2\n apply (metis F.distinct(13) bot_nat_0.extremum bot_nat_0.not_eq_extremum)\n apply clarify\n apply(case_tac \"T s \\d\") prefer 2 \n apply (metis F.distinct(13) F.distinct(15) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n by (metis le_neq_implies_less le_refl)\n\n\n\nlemma Q_buffer_overlap_lemma_A4_5:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\nshows \"\\i j.(jij0\"\nshows \"\\a b.((a,b)\\set(q s))\\a\\ran_indices a (a+b)\"\n by (metis assms(2) fst_conv in_set_conv_nth ran_indices_lem snd_conv)\n\n\nlemma Q_buffer_overlap_lemma_A4_7:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\nshows \"\\a b.((a,b)\\set(q s))\\a\\Q_indices s\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_indices_def ran_indices_def)\n apply(subgoal_tac \"\\l k.((l,k)\\set(q s))\") prefer 2 \n apply (metis list.set_sel(1) surjective_pairing)\n using Q_buffer_overlap_lemma_A4_6 \n by (metis assms(1) assms(2) assms(3) assms(5) assms(6) ran_indices_def)\n\n\nlemma Q_buffer_overlap_lemma_A4_8:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b.((a,b)\\set(q s))\\ownB s a=Q\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n using Q_buffer_overlap_lemma_A4_7\n by (metis Q_owns_bytes_def assms(1) assms(2) assms(3) assms(5) assms(6))\n\n\n\nlemma Q_buffer_overlap_lemma_A4_9:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"t\\Q_indices s\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n using Q_owns_bytes_def\n by metis\n\nlemma Q_buffer_overlap_lemma_A4_10:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"\\a b.((a,b)\\set(q s))\\(a>t\\t>a)\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n using Q_buffer_overlap_lemma_A4_9 Q_buffer_overlap_lemma_A4_7 Q_buffer_overlap_lemma_A4_8 \n Q_owns_bytes_def Q_indices_def\n by (metis assms(1) assms(2) assms(3) assms(5) assms(6) linorder_neqE_nat)\n\n\nlemma Q_buffer_overlap_lemma_A4_11:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j<(a+b))\\j\\ran_indices a (a+b)\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n by(simp add:Q_lemmas Q_basic_lemmas ran_indices_def)\n\n\nlemma Q_buffer_overlap_lemma_A4_12:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j<(a+b))\\j\\Q_indices s\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\nlemma Q_buffer_overlap_lemma_A4_13:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j<(a+b))\\ownB s j=Q\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\n\n\nlemma Q_buffer_overlap_lemma_A4_14:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ a\\j \\ j<(a+b))\\ownB s j=Q\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\n\n\nlemma Q_buffer_overlap_lemma_A4_15:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"\\a b.((a,b)\\set(q s))\\t\\Q_indices s\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n by(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\nlemma Q_buffer_overlap_lemma_A4_16:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"\\a b.((a,b)\\set(q s))\\t\\ran_indices a (a+b)\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (no_types, lifting) mem_Collect_eq)\n\n\nlemma if_not_in_ran_indices_then:\n assumes \"iran_indices l k\"\nshows \"i\\k \\ i0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"\\a b.((a,b)\\set(q s)\\ t\\ran_indices a (a+b))\\(t t\\(a+b))\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis Suc_le_lessD not_less_eq_eq)\n\n\n\nlemma Q_buffer_overlap_lemma_A4_18:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pcW s = A4\"\n and \"pre_A4_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"t Q\"\nshows \"\\a b.((a,b)\\set(q s))\\(t t\\(a+b))\"\n using assms apply(simp add:inv_def pre_A4_inv_def case_2_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add: Q_owns_bytes_def Q_indices_def ran_indices_def) \n using Q_buffer_overlap_lemma_A4_16 Q_buffer_overlap_lemma_A4_17\n by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) assms(6) assms(7))\n\n\n\n\n\nlemma Q_no_buffer_overlap_lemma_19:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(ownB s j=Q \\ j(j\\Q_indices s)\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\nlemma Q_buffer_overlap_lemma_20:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s)\\a\\j \\ jj\\ran_indices a (a+b)\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\nlemma Q_buffer_overlap_lemma_21_B:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"(a,b)\\set(q s)\" \n and \"j\\ran_indices a (a+b)\"\nshows \"j\\Q_indices s\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by auto\n\n\nlemma Q_buffer_overlap_lemma_21:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s)\\j\\ran_indices a (a+b))\\j\\Q_indices s\"\n using Q_buffer_overlap_lemma_21_B assms(1) assms(2) assms(3) assms(4) assms(5) by blast\n\n\nlemma Q_buffer_overlap_lemma_22:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s)\\j\\ran_indices a (a+b))\\ownB s j=Q\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by auto\n\n\n\nlemma Q_buffer_overlap_lemma_23:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\a b j.((a,b)\\set(q s)\\ownB s j=Q\\j\\ran_indices a (a+b))\\jtW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(j\\Q_indices s\\j(\\a b.((a,b)\\set(q s)\\ a\\j \\ j<(a+b)))\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (mono_tags, lifting) mem_Collect_eq)\n\n\nlemma Q_buffer_overlap_lemma_25:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j a b.((a,b)\\set(q s)\\ a\\j \\ j<(a+b))\\jtW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(j\\Q_indices s)\\(\\a b.((a,b)\\set(q s)\\ a\\j \\ j<(a+b)))\"\n using assms apply simp\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (metis (mono_tags, lifting) mem_Collect_eq)\n\n\nlemma Q_buffer_overlap_lemma_27:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(j\\Q_indices s)\\(jtW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(j\\Q_indices s)\\(ownB s j=Q)\"\n using assms apply simp\n using Q_buffer_overlap_lemma_26 [where s=s]\n using Q_buffer_overlap_lemma_25 [where s=s]\n using assms(1) \n using Q_owns_bytes_def by blast\n\n\nlemma Q_buffer_overlap_lemma_29:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"hW s>tW s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\nshows \"\\j.(j\\Q_indices s\\j(ownB s j\\Q)\"\n using assms apply simp\n using Q_buffer_overlap_lemma_26 [where s=s]\n using Q_buffer_overlap_lemma_25 [where s=s]\n using assms(1) \n using Q_owns_bytes_def by blast\n\n\n\n\nlemma Q_buffer_overlap_lemma_35:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"hW s>tW s\"\n and \"\\i.(iownB s i\\W\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(i\\hW s \\ iownB s i\\Q\"\n using assms apply simp\n apply(simp add:case_1_def)\n apply clarify\n by (metis F.distinct(19) F.distinct(21) diff_is_0_eq less_nat_zero_code linorder_neqE_nat zero_less_diff)\n\n\n\nlemma Q_buffer_overlap_lemma_36:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"\\i.(iownB s i\\W\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(iownB s i\\Q\"\n using assms apply simp\n apply(simp add:case_1_def)\n apply clarify\n by (smt (z3) F.distinct(19) pre_A6_inv_def)\n \n\nlemma Q_buffer_overlap_lemma_37:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(ownB s i=Q)\\i\\tW s\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp\n by (smt (verit, best) F.distinct(19) leI pre_A6_inv_def)\n\n\n\nlemma Q_buffer_overlap_lemma_38:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(ownB s i=Q \\ ii\\Q_indices s\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n using Q_owns_bytes_def by auto\n\n\nlemma Q_buffer_overlap_lemma_39:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(i\\Q_indices s)\\(ownB s i=Q \\ i0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(i\\hW s \\ iownB s i = B\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n using pre_A6_inv_def\n by auto\n\n\nlemma Q_buffer_overlap_lemma_41:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j\\fst(q s!i) \\ jownB s j = Q\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, hide_lams) nth_mem prod.collapse)\n\n\n\nlemma Q_buffer_overlap_lemma_42:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j ownB s j \\ Q)\\ja b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, lifting) eq_imp_le less_imp_le_nat linorder_neqE_nat nth_mem surjective_pairing)\n\n\n\nlemma Q_buffer_overlap_lemma_43:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j\\fst(q s!i) \\ ownB s j \\ Q)\\j\\end(q s!i)\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, lifting) eq_imp_le less_imp_le_nat linorder_neqE_nat nth_mem surjective_pairing)\n\n\nlemma Q_buffer_overlap_lemma_44:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_1 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i ownB s j \\ Q \\ hW s < end(q s!i) \\ j> hW s)\\ja b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast \n apply(simp add:pre_A6_inv_def case_1_def)\n apply clarify\n apply(subgoal_tac \"hW s = c\") prefer 2\n apply (metis le_neq_implies_less le_refl le_trans)\n apply(subgoal_tac \"\\i.(i>hW s \\ iownB s i\\Q\") prefer 2\n apply (metis F.distinct(19) less_imp_le_nat)\n apply(subgoal_tac \"\\i.(ifst(q s!i)a b i. (a, b) \\ set (q s) \\ a \\ i \\ i < a + b \\ ownB s i = Q\"\nassume a3: \"\\i. (H s \\ i \\ i < N \\ ownB s i = B) \\ (i < tW s \\ ownB s i = B)\"\nassume a4: \"Data s (numEnqs s) \\ N - H s\"\n assume a5: \"\\i N \\ 0 < Data s i\"\n assume a6: \"c \\ H s\"\n assume a7: \"H s \\ e\"\n assume a8: \"e \\ N\"\n assume a9: \"numEnqs s < n\"\n assume a10: \"\\i. H s \\ i \\ i < e \\ ownB s i = B\"\n assume a11: \"e < N \\ 0 < H s \\ H s < e \\ a = 0\"\n assume a12: \"i < length (q s)\"\n assume a13: \"H s < fst (q s ! i) + snd (q s ! i)\"\n assume a14: \"hW s = c\"\n assume a15: \"\\i0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i hW s < end(q s!i))\\hW sa b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast \n apply(simp add:pre_A6_inv_def case_1_def)\n apply clarify\n apply(subgoal_tac \"hW s = c\") prefer 2\n apply (metis le_neq_implies_less le_refl le_trans)\n apply(subgoal_tac \"\\i.(i>hW s \\ iownB s i\\Q\") prefer 2\n apply (metis F.distinct(19) less_imp_le_nat)\n apply(subgoal_tac \"\\i.(ifst(q s!i)0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i hW s < fst(q s!i))\\hW s + Data s (numEnqs s)a b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast \n apply(simp add:pre_A6_inv_def case_1_def)\n apply clarify\n apply(subgoal_tac \"hW s = c\") prefer 2\n apply (metis le_neq_implies_less le_refl le_trans)\n apply(subgoal_tac \"\\i.(i>hW s \\ iownB s i\\Q\") prefer 2\n apply (metis F.distinct(19) less_imp_le_nat)\n apply(subgoal_tac \"\\i.(ifst(q s!i)0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j\\fst(q s!i) \\ jownB s j = Q\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, hide_lams) nth_mem prod.collapse)\n\n\n\nlemma Q_buffer_overlap_lemma_48:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j ownB s j \\ Q)\\ja b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, lifting) eq_imp_le less_imp_le_nat linorder_neqE_nat nth_mem surjective_pairing)\n\n\n\nlemma Q_buffer_overlap_lemma_49:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i j.(i j\\fst(q s!i) \\ ownB s j \\ Q)\\j\\end(q s!i)\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n apply(subgoal_tac \"\\a b i.((a,b)\\set(q s) \\ i\\a \\ i<(a+b))\\ownB s i=Q\") prefer 2\n apply blast\n by (metis (mono_tags, lifting) eq_imp_le less_imp_le_nat linorder_neqE_nat nth_mem surjective_pairing)\n\n\nlemma Q_buffer_overlap_lemma_50:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\i.(i\\ hW s)\\ownB s i\\Q\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n by (smt (verit) F.distinct(19) Q_buffer_overlap_lemma_39 Q_owns_bytes_def assms(1) assms(5) assms(6) pre_A6_inv_def)\n \n\n\nlemma Q_buffer_overlap_lemma_51:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b.((a,b)\\set(q s))\\(\\j.(a\\j \\ jownB s j = Q)\"\n using Q_buffer_overlap_lemma_36 [where s=s] assms \n apply simp \n apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n using Q_overlap_lemma_4 [where s=s]\n using assms(1) by blast\n \n \n\nlemma Q_buffer_overlap_lemma_52:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ (a\\j \\ jownB s j = Q\"\n using Q_buffer_overlap_lemma_51 [where s=s] assms\n by blast\n\n\nlemma Q_buffer_overlap_lemma_53:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b.((a,b)\\set(q s) \\ b>0)\\ownB s a = Q\"\n using Q_buffer_overlap_lemma_52 [where s=s] assms apply simp\n by (meson le_refl less_add_same_cancel1)\n\nlemma Q_buffer_overlap_lemma_54:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b.((a,b)\\set(q s))\\b>0\"\n using Q_buffer_overlap_lemma_52 [where s=s] assms apply simp\n by(simp add:Q_lemmas Q_basic_lemmas)\n\n\nlemma Q_buffer_overlap_lemma_55:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b.((a,b)\\set(q s))\\ownB s a = Q\"\n using Q_buffer_overlap_lemma_52 [where s=s] Q_buffer_overlap_lemma_54 [where s=s] assms\n by (meson le_refl less_add_same_cancel1)\n\n\nlemma Q_buffer_overlap_lemma_56:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ ownB s j\\ Q )\\a\\j\"\n using Q_buffer_overlap_lemma_52 [where s=s] Q_buffer_overlap_lemma_54 [where s=s] assms\n by (meson le_refl less_add_same_cancel1)\n\n\nlemma Q_buffer_overlap_lemma_57:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ ownB s j\\ Q \\ j\\hW s \\ ja\\j\"\n using Q_buffer_overlap_lemma_52 [where s=s] Q_buffer_overlap_lemma_54 [where s=s] assms\n by (meson le_refl less_add_same_cancel1)\n\nlemma Q_buffer_overlap_lemma_58:\n assumes \"con_assms s\"\n and \"Q_structure s\"\n and \"case_2 s\"\n and \"pre_A6_inv s\"\n and \"length(q s)>0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ ownB s j\\ Q \\ j\\hW s \\ ja>j \\ a0\"\n and \"Q_owns_bytes s\"\n and \"hW s=H s\"\nshows \"\\a b j.((a,b)\\set(q s) \\ ownB s j\\ Q \\ j\\hW s \\ ja>j \\ ai.((i\\hW s \\ i iownB s i=B)\"\nshows \"tW s=0\"\n using assms apply(simp add:case_2_def)\n apply(clarify) apply(subgoal_tac \"\\i.(i>a\\iownB s i=B\")\n prefer 2 sledgehammer\n*)\n\n\n\n\n\n(*\nlemma inv_holds_for_W: \n assumes \"con_assms s\"\n and \"pcw = pcW s\"\n and \"pre_W pcw s\"\n and \"inv s\"\n and \"cW_step pcw s s'\"\nshows \"inv s'\"\n using assms apply(simp add:inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply (metis (no_types, hide_lams) F.distinct(3) PCW.simps(185) pre_A3_inv_def pre_W_def)\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply (simp add: le_add_diff_inverse2 less_diff_conv)\n apply(simp add:pre_W_def pre_A6_inv_def)\n apply (metis Nat.le_diff_conv2 add.commute)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(case_tac \"numEnqs s T s\", simp_all)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s T s\", simp_all)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s T s\", simp_all)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s T s\", simp_all)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def) (*11*)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"tW s = hW s \\ Data s (numEnqs s) \\ N\", simp_all)\n apply(case_tac \"ownT s = Q\", simp_all) \n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(case_tac \"tW s < hW s\", simp_all)\n apply (metis pre_A4_inv_def)\n apply(case_tac \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all) \n apply (simp add: pre_A6_inv_def) \n apply (simp add: pre_A7_inv_def) \n apply (simp add: pre_A8_inv_def) \n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(case_tac \"ownT s = W\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*10*)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all)\n apply(simp add:pre_W_def pre_A7_inv_def) (*9*)\n apply(simp add:Q_lemmas Q_basic_lemmas cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"ownT s = W\", simp_all)\n using Suc_diff_le apply presburger\n using Suc_diff_le apply presburger\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*8*)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*7*)\n apply(simp add:pre_W_def pre_A7_inv_def)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*6*)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*5*)\n apply(simp add:pre_W_def cW_step_def) apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(simp add:pre_write_inv_def) (*4*)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"ownT s = W\", simp_all)\n apply(simp add:pre_enqueue_inv_def) \n apply(simp add:pre_enqueue_inv_def) \n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*3*)\n apply(simp add:pre_W_def pre_write_inv_def)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \" tW s \\ T s\", simp_all) (*2*)\n defer\n apply(simp add:cW_step_def)\n apply(simp add:pre_W_def) apply(case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"tW s \\ T s\", simp_all)\n using pre_write_inv_def apply auto[1] (*1*)\n apply(simp add:cW_step_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(simp add:pre_W_def pre_A1_inv_def)\n apply(subgoal_tac \"Q_structure s=Q_structure s'\")\n apply meson apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_W_def pre_A2_inv_def)\n apply(case_tac \"tW s = hW s\", simp_all)\n apply(subgoal_tac \"Q_structure s=Q_structure s'\")\n apply meson apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"hW s < tW s \\ Data s (numEnqs s) < tW s - hW s\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \" tW s < hW s\", simp_all)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_W_def pre_A3_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis F.distinct(3))\n apply(simp add:pre_W_def pre_A4_inv_def)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis (no_types, lifting) F.distinct(11) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n apply(case_tac \"Data s (numEnqs s) \\ N - hW s\", simp_all)\n apply(simp add:pre_W_def pre_A5_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_W_def pre_A6_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis F.distinct(11) le_trans less_eq_Suc_le)\n apply(simp add:pre_W_def pre_A7_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis (no_types, hide_lams) F.distinct(11) less_Suc_eq less_trans_Suc not_less_eq)\n apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n apply(simp add:pre_W_def pre_A8_inv_def) \n apply (metis leD)\n apply(simp add:pre_W_def pre_A8_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n defer\n apply(case_tac \"numEnqs s < n\", simp_all) \n apply(simp add:pre_W_def pre_acquire_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(simp add:pre_W_def pre_acquire_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply(case_tac \"tW s \\ T s\", simp_all)\n apply(simp add:pre_W_def pre_OOM_inv_def) \n apply(simp add:Q_lemmas Q_basic_lemmas) (*this case is concerning pre_write *)\n apply(simp add:pre_W_def pre_write_inv_def)\n \n apply(subgoal_tac \"con_assms s\n \\ pcw = Write\n \\ pre_write_inv s\n \\ Q_structure s\n \\ numEnqs s - numDeqs s = length (q s)\n \\ (\\i. (i < numReads s \\ ownD s i = R) \\\n (numReads s \\ i \\ i < numWrites s \\ ownD s i = B) \\ \n (numWrites s \\ i \\ i < n \\ ownD s i = W))\n \\ numReads s \\ numWrites s \\ numReads s \\ n \\ numWrites s \\ n\n \\ B_write s s'\n \\ tempW_structure s\") \n using write_doesnt_change_Q_struct\n apply (metis (no_types, lifting))\n apply (intro conjI impI)\n using assms(1) apply blast\n using assms(1) apply blast\n apply (metis (mono_tags, hide_lams) PCW.simps(195) assms(3) pre_W_def)\n apply meson\n apply fastforce\n apply presburger\n using less_imp_le_nat apply presburger\n apply meson apply simp prefer 2 \n apply meson\n apply(simp add:B_write_def)\n apply presburger \n \n(*last subgoal!!!\napply (insert data_index_reduce2[where s = s])\n*) \n apply(subgoal_tac \"Q_structure s\n \\ Q_enqueue s s'\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ numEnqs s\\numDeqs s\n \\ ownD s(numEnqs s) =B\") prefer 2 \n apply(intro conjI impI)\n apply blast \n apply simp\n apply presburger\n apply (simp add: pre_W_def)\n apply blast\n apply blast\n apply (simp add: pre_W_def pre_enqueue_inv_def)\n apply(intro conjI impI)\n apply(case_tac \"ownT s = W \", simp_all)\n apply(case_tac[!] \"q s=[]\", simp_all )\n defer defer defer\n(*4*)\n apply(subgoal_tac \"q s\\[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s \\W\") using enqueue_preserves_Q_n_n \n apply presburger\n apply(intro conjI impI)\n apply blast\n apply blast apply simp\n apply (metis length_greater_0_conv zero_less_diff)\n apply linarith\n apply blast\n apply blast\n apply blast\n apply blast\n defer\n(*3*)\n apply(subgoal_tac \"q s\\[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\") prefer 2\n apply(intro conjI impI)\n apply blast\n apply blast apply simp\n apply (simp add: pre_enqueue_inv_def)\n apply linarith\n apply blast\n apply linarith\n apply linarith\n apply blast\n using enqueue_preserves_Q_n_o\nproof -\nassume a1: \"s' = s \\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\\"\nassume \"Q_structure s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\nassume a2: \"ownT s = W\"\nassume \"q s \\ []\"\n assume \"q s \\ [] \\ Q_structure s \\ Q_enqueue s s' \\ numDeqs s < numEnqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ ownD s (numEnqs s) = B \\ ownT s = W\"\n then have \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\)\"\n using a1 enqueue_preserves_Q_n_o by blast\n then show \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\)\"\n using a2 by presburger\nnext\n\n show \"0 < N \\ 0 < n \\ n < N \\ numEnqs s \\ n \\ (\\i N \\ 0 < Data s i) \\\n pcw = Enqueue \\\n pre_W Enqueue s \\\n H s \\ N \\\n T s \\ N \\\n hW s \\ N \\\n tW s \\ N \\\n (H s = 0 \\ T s = 0) \\\n (\\i. (i < numReads s \\ ownD s i = R) \\\n (numReads s \\ i \\ i < numWrites s \\ ownD s i = B) \\\n (numWrites s \\ i \\ i < n \\ ownD s i = W)) \\\n numReads s \\ n \\ numWrites s \\ n \\ (\\i\\N. \\j\\N. data_index s (i, j) < n) \\\n s' = s\n \\numEnqs := Suc (numEnqs s),\n ownB := \\i. if ownB s i = W then Q else ownB (s\\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW,\n q := [(offset s, Data s (numEnqs s))]\\ \\\n pcW s = Enqueue \\\n Q_structure s \\\n s\\numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB\n ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s\n \\numEnqs := Suc (numEnqs s)\\)\n i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ =\n s\\numEnqs := Suc (numEnqs s),\n ownB := \\i. if ownB s i = W then Q else ownB (s\\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW,\n q := [(offset s, Data s (numEnqs s))]\\ \\\n numEnqs s \\ numDeqs s \\\n pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B \\\n ownT s \\ W \\\n q s = [] \\\n Q_structure\n (s\\numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q else ownB (s\\ownT := ownT s, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n(*2*)\n apply(subgoal_tac \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numEnqs s = numDeqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ numWrites s\\numReads s\n \\ ownD s(numEnqs s) =B\n \\ ownT s \\W\") prefer 2 \n apply(intro conjI impI)\n apply blast\n apply blast \n apply simp\n apply linarith\n apply (metis diff_is_0_eq' list.size(3))\n apply linarith\n apply blast\n apply blast\n apply blast\n using enqueue_preserves_Q_e_n\nproof -\n assume a1: \"s' = s \\numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB (s\\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\\"\n assume a2: \"Q_structure s \\ s\\numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ = s\\numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB (s\\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\ numEnqs s \\ numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\n assume a3: \"ownT s \\ W\"\n assume \"q s = []\"\n assume a4: \"q s = [] \\ Q_structure s \\ Q_enqueue s s' \\ numEnqs s = numDeqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ ownD s (numEnqs s) = B \\ ownT s \\ W\"\n then have \"\\r. numDeqs s - numDeqs s \\ length (q s) \\ B \\ ownD s (numEnqs s) \\ Q_structure r \\ \\ Q_enqueue s r \\ [] \\ q s\"\n by (metis (no_types) enqueue_preserves_Q_e_n)\n then have \"Q_structure (s\\numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n using a4 a2 a1 by metis\n then show ?thesis\n using a3 by presburger\nnext\nqed\n(*1*)\n show \"0 < N \\ 0 < n \\ n < N \\ numEnqs s \\ n \\ (\\i N \\ 0 < Data s i) \\\n pcw = Enqueue \\\n pre_W Enqueue s \\\n H s \\ N \\\n T s \\ N \\\n hW s \\ N \\\n tW s \\ N \\\n (H s = 0 \\ T s = 0) \\\n (\\i. (i < numReads s \\ ownD s i = R) \\\n (numReads s \\ i \\ i < numWrites s \\ ownD s i = B) \\\n (numWrites s \\ i \\ i < n \\ ownD s i = W)) \\\n numReads s \\ n \\ numWrites s \\ n \\ (\\i\\N. \\j\\N. data_index s (i, j) < n) \\\n s' = s\n \\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB :=\n \\i. if ownB s i = W then Q\n else ownB\n ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s\n \\numEnqs := Suc (numEnqs s)\\)\n i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\ \\\n pcW s = Enqueue \\\n Q_structure s \\\n numEnqs s \\ numDeqs s \\\n pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B \\\n ownT s = W \\\n q s = [] \\\n Q_structure\n (s\\ownT := Q, numEnqs := Suc (numEnqs s),\n ownB := \\i. if ownB s i = W then Q else ownB (s\\ownT := Q, numEnqs := Suc (numEnqs s)\\) i,\n pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\n apply(subgoal_tac \"q s=[]\n \\ Q_structure s\n \\ Q_enqueue s s'\n \\ numDeqs s=numEnqs s\n \\ length(q s) = numEnqs s-numDeqs s\n \\ pre_enqueue_inv s\n \\ ownD s(numEnqs s) =B\n \\ ownT s =W\") prefer 2 \n apply(intro conjI impI)\n apply blast \n apply blast \n apply simp\n apply linarith\n apply (metis diff_is_0_eq' list.size(3))\n apply linarith\n apply blast\n apply blast\n using enqueue_preserves_Q_e_o\nproof -\n assume a1: \"s' = s \\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\i. if ownB s i = W then Q else ownB ((if ownT s = W then ownT_update (\\_. Q) else (\\s. s\\ownT := ownT s\\)) s \\numEnqs := Suc (numEnqs s)\\) i, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\\"\nassume a2: \"Q_structure s \\ numEnqs s \\ numDeqs s \\ pre_enqueue_inv s \\ numReads s \\ numWrites s \\ numDeqs s \\ numEnqs s \\ ownD s (numEnqs s) = B\"\nassume a3: \"ownT s = W\"\nassume \"q s = []\"\nassume \"q s = [] \\ Q_structure s \\ Q_enqueue s s' \\ numDeqs s = numEnqs s \\ length (q s) = numEnqs s - numDeqs s \\ pre_enqueue_inv s \\ ownD s (numEnqs s) = B \\ ownT s = W\"\nthen have \"Q_structure (s\\ownT := Q, numEnqs := Suc (numEnqs s), ownB := \\n. if ownB s n = W then Q else ownB ((if ownT s = W then ownT_update (\\f. Q) else (\\r. r\\ownT := ownT r\\)) s \\numEnqs := Suc (numEnqs s)\\) n, pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\)\"\nusing a2 a1 by (meson enqueue_preserves_Q_e_o)\nthen show ?thesis\nusing a3 by presburger\nqed\nqed\n\n*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*\n\n\nlemma local_pre_R:\n assumes \"con_assms s\"\n and \"pcr = pcR s\"\n and \"pre_R pcr s\"\n and \"inv s\"\n and \"cR_step pcr s s'\"\nshows \"pre_R (pcR s') s'\"\nproof (cases \"pcR s\")\n case Release\n then show ?thesis \n apply (simp add: pre_R_def)\n proof (cases \"pcR s'\")\n show \"pcR s = Release \\\n pcR s' = Release \\\n case pcR s' of\n Release \\ pre_Release_inv s'\n | idleR \\ pre_dequeue_inv s'\n | Read \\ pre_Read_inv s'\" \n using assms by(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def)\n next \n show \"pcR s = Release \\\n pcR s' = Read \\\n case pcR s' of Release \\ pre_Release_inv s'\n | idleR \\ pre_dequeue_inv s' | Read \\ pre_Read_inv s'\"\n using assms by(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def)\n next\n show \"pcR s = Release \\\n pcR s' = idleR \\\n case pcR s' of Release \\ pre_Release_inv s'\n | idleR \\ pre_dequeue_inv s'\n | Read \\ pre_Read_inv s'\"\n using assms apply(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def)\n apply (case_tac \"tR s \\ fst (tempR s)\", simp_all)\n apply (case_tac[!] \"ownT s = R\", simp_all)\n apply (intro conjI impI)\n apply(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def RingBuffer_BD.inv_def pre_R_def)\n apply(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def RingBuffer_BD.inv_def pre_R_def)\n \n apply(simp add:cR_step_def pre_Read_inv_def pre_Release_inv_def pre_dequeue_inv_def RingBuffer_BD.inv_def pre_R_def)\n apply(simp add:Q_lemmas Q_basic_lemmas) \n apply(subgoal_tac \"(\\a b j. (a, b) \\ set (q s) \\ j < N \\ tR s \\ j \\ a + b < j)\")\n prefer 2 \n apply presburger\n apply(subgoal_tac \"end(tempR s)i. i < length (q s) \\ 0 < i \\\n fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) =\n fst (q s ! i)\") prefer 2\n apply (metis (no_types, lifting) less_irrefl_nat)\n apply(subgoal_tac \"fst(q s!(length(q s)-1)) = fst(last(q s))\") prefer 2\n apply (metis last_conv_nth)\n apply (subgoal_tac \"fst (last (q s)) + snd (last (q s)) > fst (hd (q s))\")\n apply (meson less_or_eq_imp_le)\n apply (metis (no_types, lifting) diff_less le_add1 le_trans length_greater_0_conv less_one)\n apply (metis end_simp tempR_describes_ownB_def)\n apply(simp add:tempR_describes_ownB_def tempR_describes_T_def T_is_outside_Q_def Tail_and_ownB_not_idleR_1_def Tail_and_ownB_not_idleR_2_def)\n apply clarify\n apply(subgoal_tac \"\\i. i < length (q s) \\ 0 < i \\\n fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) =\n fst (q s ! i)\") prefer 2\n apply (metis (no_types, lifting) gr_implies_not0)\n defer\n apply (metis (mono_tags, hide_lams) add_less_same_cancel1 hd_conv_nth length_0_conv less_nat_zero_code linorder_neqE_nat tempR_describes_T_def)\n apply (metis end_simp tempR_describes_ownB_def)\n apply (metis diff_less_Suc hd_conv_nth length_0_conv less_diff_conv linorder_neqE_nat not_less_eq tempR_describes_T_def zero_less_diff)\n apply(simp add:inv_def pre_R_def pre_Release_inv_def)\n prefer 2\n apply(simp add:inv_def pre_R_def pre_Release_inv_def)\n apply(intro conjI impI)\n apply(simp add:inv_def pre_R_def pre_Release_inv_def)\n apply(simp add:inv_def pre_R_def pre_Release_inv_def) \n apply(subgoal_tac \"con_assms s\n \\ q s\\[]\n \\ fst(hd(q s)) =0\n \\ fst(tempR s) \\0\n \\ pre_Release_inv s\n \\ snd(tempR s) = Data s (numReads s -1)\n \\ data_index s (tempR s) = numReads s -1\n \\ ownT s = R\n \\ numEnqs s\\numDeqs s\n \\ ownD s (numReads s -1) = R\n \\ numDeqs s\\n \\ numDeqs s\\1\n \\ numDeqs s = numReads s\n \\ pcR s=Release\n \\ tR s=T s\n \\ tempR_structure s\n \\ Q_structure s\n \\ B_release s s'\") apply(unfold pre_Release_inv_def)[1] \n using Release_wrap_1 inv_def \n apply (smt (z3) add_diff_inverse_nat add_lessD1 le_add_diff_inverse not_add_less1 struct_of_wrap_1)\n apply(intro conjI impI)\n using assms(1) apply blast\n using assms(1) apply blast \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas) \n apply (metis end_simp tempR_basic_struct_def tempR_gap_structure_def)\n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply (metis end_simp head_q0 length_0_conv less_nat_zero_code linorder_neqE_nat tempR_basic_struct_def tempR_gap_structure_def tempR_offsets_differ_def)\n apply (metis PCR.simps(7) pre_R_def)\n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:inv_def pre_R_def pre_Release_inv_def tempR_lemmas tempR_describes_T_def T_is_outside_Q_def) \n apply (metis (no_types, lifting) PCR.simps(7) assms(5) cR_step_def)\n (**)\n defer\n apply(simp add:R_owns_no_bytes_def)\n apply(simp add:Tail_and_ownB_idleR_def)\n apply(intro conjI impI) apply clarify apply(intro conjI impI)\n apply(simp add:pre_R_def pre_Release_inv_def)\n apply (metis end_simp tempR_describes_ownB_def)\n apply(simp add:pre_R_def pre_Release_inv_def tempR_describes_ownB_def Tail_and_ownB_not_idleR_1_def Tail_and_ownB_not_idleR_2_def)\n apply(subgoal_tac \"fst (last (q s)) + snd (last (q s)) < T s\")\n apply presburger apply(simp add:inv_def Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n apply clarify\n apply(subgoal_tac \"end(q s!(length(q s)-1)) = end(last(q s))\") prefer 2\n apply (metis last_conv_nth) \n\n(*should be solved by:\napply (smt (z3) Nat.add_0_right diff_add_inverse diff_is_0_eq' diff_less last_conv_nth le_neq_implies_less le_trans length_greater_0_conv less_numeral_extra(1) less_or_eq_imp_le nat_neq_iff)\nso defer*) \n defer\n apply simp apply(subgoal_tac \"end(last(q s)) = (T s -1)\") \n apply (metis Suc_diff_1 Suc_leI bot_nat_0.extremum bot_nat_0.not_eq_extremum end_simp le_trans)\n apply (metis add_lessD1 diff_Suc_1 gr0_conv_Suc last_conv_nth le_less_Suc_eq length_greater_0_conv less_or_eq_imp_le)\n \n(*1st subgoal is left to check, should be trivially solved outside of the proof*)\n sorry qed\n\nnext\n case Read\n then show ?thesis using assms apply (simp add:pre_R_def inv_def pre_Read_inv_def)\n apply(case_tac \"pcR s'\", simp_all add:cR_step_def)\n apply(simp add:pre_Release_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (metis Nat.add_0_right hd_conv_nth length_greater_0_conv)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n apply (metis (no_types, hide_lams))\n apply(simp add:tempR_describes_T_def T_is_outside_Q_def) \n apply(simp add:tempR_describes_ownB_def)\n apply(simp add:Tail_and_ownB_not_idleR_1_def)\n apply(simp add:Tail_and_ownB_not_idleR_2_def)\n by metis\nnext\n case idleR\n then show ?thesis using assms apply (simp add:pre_R_def inv_def pre_dequeue_inv_def)\n apply(case_tac \"pcR s'\", simp_all add:cR_step_def Q_dequeue_def)\n apply(case_tac \"q s=[]\", simp_all) \n apply(case_tac \"q s=[]\", simp_all)\n apply (metis assms(1) con_assms_def le_antisym less_eq_nat.simps(1) pre_dequeue_inv_def)\n apply(case_tac \"q s=[]\", simp_all)\n apply(simp add:pre_Read_inv_def)\n apply(intro conjI impI)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (simp add: hd_conv_nth)\n apply(simp add:Q_lemmas Q_basic_lemmas)\n apply (simp add: hd_conv_nth)\n apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n apply (metis Suc_leI length_greater_0_conv zero_less_diff)\n apply (metis Q_reflects_ownD_def Q_structure_def le_iff_add length_0_conv nat_less_le plus_nat.add_0)\n apply (metis Q_elem_size_def Q_reflects_writes_def Q_structure_def head_q0 length_pos_if_in_set less_SucI list.set_sel(1) not_less_eq snd_conv zero_le)\n apply(simp add:tempR_structure_def)\n apply(intro conjI impI)\n apply(simp add:tempR_basic_struct_def) apply(intro conjI impI) \n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"hd(q s) = (q s!0) \\ hd(tl(q s)) = (q s!1)\")\n apply (metis (no_types, lifting) One_nat_def diff_Suc_1 length_greater_0_conv length_tl less_one zero_less_diff)\n apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n apply(simp add:tempR_offsets_differ_def)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply(subgoal_tac \"\\i.(i<(length(q s)-1))\\fst(tl(q s)!i) = fst(q s!(i+1))\")\n apply (metis (no_types, lifting) One_nat_def add_diff_inverse_nat hd_conv_nth length_greater_0_conv lessI less_add_eq_less less_diff_conv less_nat_zero_code less_numeral_extra(3))\n apply (metis Suc_eq_plus1 length_tl nth_tl)\n apply(simp add:tempR_has_no_overlaps_def)\n using peculiar_16 apply auto[1]\n apply(simp add:tempR_has_no_uroboros_def)\n using peculiar_21 apply auto[1]\n apply(simp add:tempR_holds_bytes_def)\n apply(simp add:tempR_reflects_writes_def)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply (metis Nat.add_0_right hd_conv_nth length_greater_0_conv)\n apply(simp add:tempR_elem_size_def)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply (metis add_cancel_right_right hd_conv_nth length_greater_0_conv)\n apply(simp add:tempR_describes_T_def T_is_outside_Q_def Q_describes_T_def)\n apply(simp add:Q_lemmas Q_basic_lemmas tempR_basic_lemmas)\n apply(case_tac \"fst(hd(q s)) \\0\")\n apply blast\n apply clarify\n apply(simp add: Tail_and_ownB_idleR_def)\n apply(subgoal_tac \"fst(hd(q s)) \\ T s\") prefer 2\n apply linarith\n apply(subgoal_tac \"last(q s) = (q s!(length(q s)-1))\") prefer 2\n apply (metis last_conv_nth)\n apply (metis (no_types, lifting) One_nat_def Q_tail_props add_diff_cancel_right' add_gr_0 less_diff_conv zero_less_Suc)\n apply(simp add:tempR_describes_ownB_def)\n apply (metis R_owns_no_bytes_def zero_le)\n apply(simp add:Tail_and_ownB_not_idleR_1_def Tail_and_ownB_idleR_def R_owns_no_bytes_def Q_lemmas Q_basic_lemmas) \n apply clarify\n apply(intro conjI impI)\n apply (metis (no_types, lifting) hd_in_set less_Suc_eq not_less_eq prod.collapse)\n apply(simp add:Q_describes_T_def)\n apply(simp add:Tail_and_ownB_not_idleR_2_def Tail_and_ownB_idleR_def Q_describes_T_def R_owns_no_bytes_def Q_lemmas Q_basic_lemmas) \n apply (metis (no_types, lifting) add_leD1 add_less_same_cancel2 bot_nat_0.not_eq_extremum last_tl not_add_less2)\n apply (meson list.set_sel(2))\n apply(simp add:Q_lemmas Q_basic_lemmas Q_describes_T_def T_is_outside_Q_def)\n by (metis hd_conv_nth length_greater_0_conv plus_nat.add_0)\nqed\n\n*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*(*\n\n(*------------------------showing progress----------------------*)\n(*\nlemma tries_are_bounded:\n assumes \"con_assms s\"\n and \"cW_step pcw s s'\"\n and \"inv pcw pcr s\"\nshows \"tries s'\\N\"\n using assms\n apply (simp_all add:cW_step_def)\n using less_le_trans apply auto[1]\n apply (case_tac \"pcw\", simp_all)\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n using less_imp_le_nat apply blast\n apply(case_tac \"numEnqs s < n\", simp_all add:less_imp_le)\n apply(case_tac \"tW s \\ T s\", simp_all)\n using Suc_leI apply blast\n by (meson less_imp_le_nat)\n\n\nlemma when_W_moves_prog_less:\n assumes \"con_assms s\"\n and \"inv (pcW s) (pcR s) s\"\n and \"cW_step (pcW s) s s'\"\nshows \"lex_prog s s'\"\nproof - \n from assms(1) have sp1: \"numEnqs s \\ n \\ numDeqs s \\ n\"\n using con_assms_def by auto\n from assms show ?thesis\n apply (simp_all add:cW_step_def inv_def progress_lemmas tries_left_def)\n apply(case_tac \"pcW s\", simp_all)\n apply(case_tac[!] \"pcR s\", simp_all)\n apply (simp_all add: diff_less_mono2)\n apply (case_tac[!] \"tW s = T s\", simp_all add:cW_step_def)\n apply(case_tac[1-6] \"numEnqs s < n\", simp_all)\n using diff_less_mono2 by auto\nqed\n\nlemma W_counter_implies_notown:\n assumes \"con_assms s\"\n and \"mainInv s\"\nshows \"\\i.(iownD s i \\ {R,B}\"\n using assms\n apply (simp_all add:inv_def)\n by (meson le_less_linear)\n\n\nlemma least_prog_W_implies:\n assumes \"con_assms s\"\n and \"inv (pcW s) pcr s\"\n and \"cW_step (pcW s) s s'\"\n and \"inv (pcW s') pcr s'\"\n and \"lex_prog s s'\"\nshows \"end_W_prog s'=True\\end_W_prog s \\ ((\\i.(iownD s' i\\W) \\ (pcW s=idleW) \\ numEnqs s=n)\"\n using assms W_counter_implies_notown\n apply (simp_all add: end_W_prog_def progress_lemmas tries_left_def cW_step_def inv_def)\n apply (case_tac \"pcW s\", simp_all)\n apply(case_tac \"numEnqs s < n\", simp_all)\n apply(case_tac \"pcr\", simp_all)\n apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n by(case_tac \"tW s \\ T s\", simp_all)\n\n\nlemma when_R_moves_prog_less:\n assumes \"con_assms s\"\n and \"inv (pcW s) (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\nshows \"lex_prog s s'\"\n using assms apply (simp_all add:inv_def cR_step_def progress_lemmas)\n apply(case_tac \"pcR s\", simp_all add:tries_left_def)\n apply(case_tac[!] \"pcW s\", simp_all)\n apply(case_tac[!] \"q s=[]\", simp_all add: Let_def)\n apply clarify\noops\n apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n apply (metis (no_types, lifting) add_less_mono diff_less_mono2 diff_self_eq_0 length_greater_0_conv lessI less_le_trans mult_2 nat_add_left_cancel_less nat_less_le)\n apply (metis (no_types, lifting) add_less_mono diff_less_mono2 diff_self_eq_0 length_greater_0_conv lessI less_le_trans mult_2 nat_add_left_cancel_less nat_less_le)\n apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n apply (metis diff_less_mono2 length_greater_0_conv lessI zero_less_diff)\n apply (metis diff_less_mono2 diff_self_eq_0 le_eq_less_or_eq length_0_conv lessI)\n sorry\n\n\n\n\nlemma least_prog_R_implies:\n assumes \"con_assms s\"\n and \"inv (pcW s) (pcR s) s\"\n and \"cR_step (pcR s) s s'\"\n and \"inv (pcW s) (pcR s) s'\"\n and \"lex_prog s s'\"\nshows \"end_R_prog s'=True\\(end_R_prog s \\ ((\\i.(iownD s' i=R) \\ pcR s=Release))\\end_W_prog s\"\n using assms apply (simp_all add: end_R_prog_def end_W_prog_def tries_left_def cR_step_def inv_def)\n apply(case_tac \"pcR s\", simp_all)\n by(case_tac \"q s=[]\", simp_all add:Let_def)\n\n\nlemma initial_progress:\n assumes \"cR_step (pcR s) s s' \\ cW_step (pcW s) s s'\"\n and \"inv (pcW s) (pcR s) s\"\n and \"init s'\"\n and \"con_assms s\"\nshows \"lex_prog s s'\\s=s'\"\n using assms apply(simp_all add:cR_step_def cW_step_def init_def progress_lemmas tries_left_def inv_def)\n apply(case_tac \"pcR s\", simp_all)\n apply(case_tac \"pcW s\", simp_all)\n apply (metis add.commute add_less_mono diff_less less_le_trans less_nat_zero_code mult.commute mult_2_right nat_le_iff_add order_less_irrefl zero_less_iff_neq_zero)\n apply (metis add.commute add_cancel_right_left add_cancel_right_right add_is_0 diff_less diff_zero le_iff_add length_0_conv length_greater_0_conv less_add_eq_less less_irrefl_nat less_le_trans mult.commute mult_2_right nat_diff_split zero_less_iff_neq_zero)\n apply (metis (no_types, hide_lams) add.commute diff_less le_iff_add le_less_trans less_eq_nat.simps(1) less_le_trans mult.commute mult_2_right order_less_irrefl trans_less_add2)\n apply (metis add.commute add_strict_mono diff_less le_iff_add less_le_trans less_nat_zero_code less_not_refl mult.commute mult_2_right zero_less_iff_neq_zero)\n apply (metis add_is_0 diff_diff_cancel diff_le_self nat_0_less_mult_iff nat_less_le not_le zero_less_diff zero_less_numeral)\n apply (metis add.commute diff_less le0 le_less_trans less_le_trans mult.commute mult_2_right nat_le_iff_add order_less_irrefl trans_less_add2)\n apply (metis add.commute diff_less le_iff_add le_less_trans less_eq_nat.simps(1) less_le_trans less_not_refl mult.commute mult_2_right trans_less_add2)\n apply (metis add.commute diff_less le0 le_less_trans less_le_trans less_not_refl mult.commute mult_2_right nat_le_iff_add trans_less_add1)\n apply (metis add.commute add_cancel_right_right diff_less gr_implies_not0 le0 le_iff_add le_less_trans le_neq_implies_less less_add_eq_less less_le_trans mult.commute mult_2_right order_less_irrefl zero_le)\n apply (metis add_is_0 diff_diff_cancel diff_self_eq_0 nat_0_less_mult_iff nat_less_le zero_less_diff zero_less_numeral)\n apply (metis add.commute diff_less le_iff_add le_less_trans less_le_trans mult.commute mult_2_right order_less_irrefl trans_less_add2 zero_le)\n apply (metis diff_add_zero diff_diff_cancel less_numeral_extra(3) mult_2)\n apply (metis add.commute diff_less le_iff_add less_le_trans mult.commute mult_2_right order_less_irrefl)\n apply (metis add.commute diff_less le_iff_add less_le_trans less_not_refl mult.commute mult_2_right)\n apply (simp add: leD)\n by (simp add: leD)\n \n\n\n\n(*--------------------------------------------------------------*)\n\n\n\n(*--------------lexicographical progress------------------------------*)\ndefinition \"ltpcW i j \\ \n(i \\ j \\\n(i=FinishedW)\n\\(i \\ {Enqueue, OOM, BTS} \\ j\\FinishedW)\n\\ (i \\ {A8, Write} \\ j \\ {Enqueue, OOM, BTS, FinishedW})\n\\ (i \\ {A6, A7} \\ j \\ {idleW, A1, A2, A3, A4, A5})\n\\ (i \\ {A3, A4, A5} \\ j \\ {idleW, A1, A2})\n\\ (i = A2 \\ j \\ {idleW, A1})\n\\ (i = A1 \\ j = idleW)) \n\"\n\ndefinition \"ltpcR i j \\ \ni = idleR \\ j =Release \\ i=Release \\ j=Read \\ i=Read \\ j=idleR\"\n\ndefinition \"state_pv s \\ (2*n - numEnqs s - numDeqs s)\"\ndefinition \"tries_left s \\ N-tries s\"\n\ndefinition \"lex_prog s s' \\ s = s' \\ \n(state_pv s' < state_pv s \n\\ (state_pv s' = state_pv s \\ tries_left s' < tries_left s)\n\\ (state_pv s' = state_pv s \\ tries_left s' = tries_left s \\ ltpcR (pcR s') (pcR s)) \n\\ (state_pv s' = state_pv s \\ tries_left s' = tries_left s \\ ltpcW (pcW s') (pcW s)))\"\n\nlemmas progress_lemmas = ltpcW_def ltpcR_def state_pv_def lex_prog_def \n\ndefinition \"end_W_prog s \\ ((n-numEnqs s)=0) \\ tries_left s=N \\ pcW s=FinishedW\" \ndefinition \"end_R_prog s \\ end_W_prog s\\ pcR s=idleR \\ numDeqs s=numEnqs s\"\ndefinition \"start_state_prog s\\ state_pv s=2*n \\ pcR s=idleR \\ pcW s=idleW \\ tries_left s=N\"\n*)\n(*a\n\\ right_to_addresses s\n \\ no_ownB s\n \\ H_T_ownB s\n \\ Buff_entries_transfer_numDeqs s*)*)*)\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RingBuffer_BD_latest_2_____________backup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.29019783603099414}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory PolicySystemSAC\nimports\n ArchNoninterference\n \"Access.ExampleSystem\"\nbegin\n\ntext \\\n Reads/Affects sets:\n - NicA, NicB, NicD: reads all except T\n affects {RM, R, NicA, NicB, NicD}\n - NicC: reads all except T, affects self only\n - R: reads all except T\n affects {NicA, NicB, NicD, R, RM, NTFN3}\n - RM: reads all except T\n affects {SC, EP, RM, R, NicA, NicB, NicD, NTFN2}\n - SC: reads all except T\n affects {EP, SC, NicC, RM, R, NicA, NicB, NicD, NTFN1}\n - EP: reads all except T\n affects {EP, SC, NicC, RM, R, NicA, NicB, NicD}\n - NTFN1: reads all except T, affects {NTFN1, SC, NicC}\n - NTFN2: '' , affects {NTFN2, RM, R, NicA, NicB, NicD}\n - NTFN3: '' , affects {NTFN3, R, NicB, NicD}\n - T: reads T, affects all except EP\n\\\n\nsubsection \\Definitions\\\n\ndatatype SACLabels =\n NicA | NicB | NicC | NicD\n | R | RM | SC | EP\n | T | NTFN1 | NTFN2 | NTFN3\n\ndefinition complete_AgentAuthGraph where\n \"complete_AgentAuthGraph g \\\n g \\ {(y,a,y) | a y. True}\n \\ {(x,a,y) | x a y. (x,Control,y) \\ g }\n \\ {(x,a,y)|x a y. \\z. (x,Control,z) \\ g \\ (z, Control,y) \\ g} \"\ndeclare complete_AgentAuthGraph_def [simp]\n\nabbreviation partition_label where\n \"partition_label l \\ OrdinaryLabel l\"\n\ndefinition SACGraph where\n \"SACGraph \\\n { (partition_label R, Read, partition_label NicB), (partition_label R, Write, partition_label NicB),\n (partition_label R, Read, partition_label NicD), (partition_label R, Write, partition_label NicD),\n (partition_label SC, Read, partition_label NicC), (partition_label SC, Write, partition_label NicC),\n (partition_label SC, SyncSend, partition_label EP),\n (partition_label RM, Receive, partition_label EP),\n (partition_label RM, Control, partition_label R),\n (partition_label RM, Control, partition_label NicA),\n (partition_label RM, Control, partition_label NicB),\n (partition_label RM, Control, partition_label NicD),\n (partition_label T, Notify, partition_label NTFN1),\n (partition_label T, Notify, partition_label NTFN2),\n (partition_label T, Notify, partition_label NTFN3),\n (partition_label SC, Receive, partition_label NTFN1),\n (partition_label RM, Receive, partition_label NTFN2),\n (partition_label R, Receive, partition_label NTFN3)\n }\"\ndeclare SACGraph_def [simp]\n\ndefinition SACAuthGraph where\n \"SACAuthGraph = complete_AgentAuthGraph SACGraph\"\ndeclare SACAuthGraph_def [simp]\n\ndefinition SACAllLabels where\n \"SACAllLabels \\ {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC}\"\n\ndefinition RMControls where\n \"RMControls = {partition_label RM, partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\"\ndeclare RMControls_def [simp]\n\nlemma reads_all_rm_controlled_subjects : \"\\partition_label RM \\ subjectReads SACAuthGraph (partition_label x); l \\ RMControls\\ \\ l \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (simp only:RMControls_def)\n apply (erule insertE, rule_tac t=\"partition_label RM\" in reads_read_thread_read_pages, simp, simp)+\n apply simp\ndone\n\nlemma reads_ntfn3_via_r : \"partition_label R \\ subjectReads SACAuthGraph (partition_label x) \\ partition_label NTFN3 \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac ep=\"partition_label NTFN3\" and t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n apply simp_all\ndone\n\nlemma reads_ntfn2_via_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label x) \\ partition_label NTFN2 \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac ep=\"partition_label NTFN2\" and t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n apply simp_all\ndone\n\nlemma reads_ntfn1_via_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label x) \\ partition_label NTFN1 \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac ep=\"partition_label NTFN1\" and t=\"partition_label SC\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n apply simp_all\ndone\n\nsubsection \\NicA, NicB, NicD reads/affects\\\n\nlemma reads_Control_rev':\n \"(x,Control,y) \\ aag \\\n x \\ subjectReads (complete_AgentAuthGraph aag) y\"\n apply(rule reads_read_page_read_thread)\n apply(rule reads_lrefl)\n apply simp\n done\n\nlemma reads_Control_rev:\n \"(x,Control,y) \\ SACGraph \\\n x \\ subjectReads SACAuthGraph y\"\n apply(subst SACAuthGraph_def)\n apply(erule reads_Control_rev')\n done\n\n\nlemma abdrm_reads_ep : \"x \\ {NicA, NicB, NicD, RM} \\ partition_label EP \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac t = \"partition_label RM\" and a = \"partition_label SC\" and auth' = \"SyncSend\" and auth = \"Receive\" in reads_read_queued_thread_read_ep)\n apply (simp+)[4]\n apply safe\n apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n done\n\nlemma abdrm_reads_sc : \"x \\ {NicA, NicB, NicD, RM} \\ partition_label SC \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac b = \"partition_label SC\" and ep = \"partition_label EP\" in read_sync_ep_read_senders)\n apply (simp del: SACAuthGraph_def add: abdrm_reads_ep, simp)\ndone\n\nlemma abd_reads_rm : \"x \\ {NicA, NicB, NicD} \\ partition_label RM \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule reads_Control_rev)\n apply auto\ndone\n\nlemma abd_reads_c : \"x \\ {NicA, NicB, NicD} \\ partition_label NicC \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac t = \"partition_label SC\" in reads_read_thread_read_pages)\n apply (rule abdrm_reads_sc, simp, blast, simp)\ndone\n\nlemma abd_reads_r : \"x \\ {NicA, NicB, NicD} \\ partition_label R \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac p=\"partition_label R\" and t=\"partition_label RM\" in reads_read_thread_read_pages)\n apply (rule abd_reads_rm, simp, simp)\ndone\n\nlemma abd_reads_ntfn3 : \"x \\ {NicA, NicB, NicD} \\ partition_label NTFN3 \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac ep=\"partition_label NTFN3\" and t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n apply (simp_all add: abd_reads_r del:SACAuthGraph_def, simp_all)\ndone\n\nlemma abd_reads_all_bw : \"x \\ {NicA, NicB, NicD} \\ {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule subsetI)\n (* refl cases *)\n apply (case_tac \"partition_label x = xa\")\n apply simp\n (* non refl cases *)\n apply (case_tac \"xa \\ RMControls\")\n apply (rule reads_all_rm_controlled_subjects, rule abd_reads_rm, simp, simp)\n apply (erule_tac a = xa in insertE, simp)\n apply (erule_tac a = xa in insertE, simp only:, rule abd_reads_rm, simp)\n apply (erule_tac a = xa in insertE, simp)\n apply (erule_tac a = xa in insertE, simp)\n apply (erule_tac a = xa in insertE, simp)\n apply (erule_tac a = xa in insertE, simp only:, rule abdrm_reads_ep, simp, blast)\n apply (erule_tac a = xa in insertE, simp only:, rule abdrm_reads_sc, simp, blast)\n apply (erule_tac a = xa in insertE, simp only:, rule abd_reads_c, simp)\n apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn1_via_sc, rule abdrm_reads_sc, simp, blast)\n apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn2_via_rm, rule abd_reads_rm, simp)\n apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn3_via_r, rule abd_reads_r, simp)\n apply simp\ndone\n\nlemma abd_reads : \"x \\ {NicA, NicB, NicD} \\ subjectReads SACAuthGraph (partition_label x) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n apply (rule abd_reads_all_bw)\n apply (simp)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n (* warning: slow *)\n by (simp, blast?)+\n\n\ndefinition abd_affects_set where\n \"abd_affects_set \\ {NicB, RM, R, NicA, NicD,\n EP, NTFN2}\" (* these two added for NTFN binding *)\ndeclare abd_affects_set_def[simp]\n\nlemma abd_affects_bw : \"x \\ {NicA, NicB, NicD} \\ partition_label ` abd_affects_set \\ subjectAffects SACAuthGraph (partition_label x)\"\n apply (simp only:abd_affects_set_def)\n apply (rule subsetI)\n (* refl cases *)\n apply (case_tac \"partition_label x = xa\")\n apply (simp add: affects_lrefl)\n (* non-refl cases *)\n apply (simp only: image_insert)\n apply (erule_tac a = xa in insertE)\n apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n apply (simp, simp, simp, simp)\n apply (erule_tac a = xa in insertE)\n apply (simp only:)\n apply (rule_tac ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_recv)\n apply (simp)\n apply (auto)[1]\n apply (erule_tac a = xa in insertE)\n apply (simp only:)\n apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n apply (simp, simp, simp, simp)\n apply (erule_tac a = xa in insertE)\n apply (simp only:)\n apply (clarify)\n apply (erule notE)\n apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n apply (simp, simp, simp, simp)\n apply (erule_tac a = xa in insertE)\n apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n apply (simp, simp, simp, simp)\n apply (erule_tac a = xa in insertE)\n apply (rule_tac ep = \"xa\" and l = \"partition_label x\" in affects_ep_bound_trans)\n apply (rule_tac x = \"partition_label RM\" in exI)\n apply (rule_tac x = \"partition_label x\" in exI)\n apply (intro conjI)\n apply (simp,simp,simp)\n apply (erule_tac a = xa in insertE)\n apply (rule_tac ep = \"xa\" and l = \"partition_label x\" in affects_ep_bound_trans)\n apply (rule_tac x = \"partition_label RM\" in exI)\n apply (rule_tac x = \"partition_label x\" in exI)\n apply (intro conjI)\n apply (simp,simp,simp,simp)\n done\n\nlemma abd_affects : \"x \\ {NicA, NicB, NicD} \\ subjectAffects SACAuthGraph (partition_label x) = partition_label ` abd_affects_set\"\n apply (rule subset_antisym)\n defer\n apply (rule abd_affects_bw)\n apply (simp)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by auto\n\nsubsection \\NicC reads/affects\\\n\nlemma c_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label NicC)\"\n apply (rule_tac b = \"partition_label NicC\" in reads_read_page_read_thread)\n apply (rule reads_lrefl)\n apply (simp)\ndone\n\nlemma c_reads_ep : \"partition_label EP \\ subjectReads SACAuthGraph (partition_label NicC)\"\n apply (rule_tac a = \"partition_label EP\" and ep = \"partition_label EP\" and t = \"partition_label SC\" and auth = \"SyncSend\" and auth' = \"Reset\" in reads_read_queued_thread_read_ep)\n apply (simp,simp,simp,simp)\n apply (rule c_reads_sc)\ndone\n\nlemma c_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label NicC)\"\n apply (rule_tac ep = \"partition_label EP\" in read_sync_ep_read_receivers)\n apply (rule c_reads_ep)\n apply (simp)\ndone\n\nlemma c_reads_any_controlled_by_rm : \"x \\ {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD} \\ x \\ subjectReads SACAuthGraph (partition_label NicC)\"\n apply (rule_tac t = \"partition_label RM\" in reads_read_thread_read_pages)\n apply (rule c_reads_rm)\n apply auto\ndone\n\nlemma c_reads : \"subjectReads SACAuthGraph (partition_label NicC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (case_tac \"x \\ {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\")\n apply (rule c_reads_any_controlled_by_rm, assumption)\n apply (erule insertE, simp)\n apply (erule insertE, simp only:, rule c_reads_rm)\n apply (erule insertE, simp, erule insertE, simp, erule insertE, simp)\n apply (erule insertE, simp only:, rule c_reads_ep)\n apply (erule insertE, simp only:, rule c_reads_sc)\n apply (erule insertE, simp only:, rule reads_lrefl)\n apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule c_reads_sc)\n apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule c_reads_rm)\n apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule c_reads_any_controlled_by_rm, simp)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n by (simp, blast?)+\n\nlemma c_affects_self_only : \"x \\ {partition_label NicC} \\ x \\ subjectAffects SACAuthGraph (partition_label NicC)\"\n apply (erule insertE)\n apply (simp only:, rule affects_lrefl)\n apply simp\ndone\n\nlemma c_affects : \"subjectAffects SACAuthGraph (partition_label NicC) = {partition_label NicC}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (rule c_affects_self_only, assumption)\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by (simp, blast?)+\n\nsubsection \\R reads/affects\\\n\nlemma r_reads_bd : \"x \\ {partition_label NicB, partition_label NicD} \\ x \\ subjectReads SACAuthGraph (partition_label R)\"\n apply (rule reads_read)\n apply auto\ndone\n\nlemma r_reads_ep : \"partition_label EP \\ subjectReads SACAuthGraph (partition_label R)\"\n apply (rule_tac a=\"partition_label SC\" and auth'=\"SyncSend\" and ep=\"partition_label EP\" and t=\"partition_label RM\" and auth=\"Receive\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp, rule reads_Control_rev, simp)\ndone\n\nlemma r_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label R)\"\n apply (rule_tac ep=\"partition_label EP\" and b=\"partition_label SC\" in read_sync_ep_read_senders)\n apply (rule r_reads_ep, simp)\ndone\n\nlemma r_reads_a : \"partition_label NicA \\ subjectReads SACAuthGraph (partition_label R)\"\n apply (rule_tac a=\"partition_label NicA\" and auth'=\"Reset\" and ep=\"partition_label NicA\" and t=\"partition_label RM\" and auth=\"Receive\" in reads_read_queued_thread_read_ep)\n apply (simp_all add:reads_Control_rev[simplified])\ndone\n\nlemma r_reads_c : \"partition_label NicC \\ subjectReads SACAuthGraph (partition_label R)\"\n apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n apply (rule r_reads_sc, simp)\ndone\n\nlemma r_reads : \"subjectReads SACAuthGraph (partition_label R) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, rule r_reads_bd, simp)\n apply (erule insertE, rule reads_Control_rev, simp)\n apply (erule insertE, simp only:, rule reads_lrefl)\n apply (erule insertE, simp only:, rule r_reads_a)\n apply (erule insertE, rule r_reads_bd, simp)\n apply (erule insertE, simp only:, rule r_reads_ep)\n apply (erule insertE, simp only:, rule r_reads_sc)\n apply (erule insertE, simp only:, rule r_reads_c)\n apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule r_reads_sc)\n apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule reads_Control_rev, simp)\n apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_lrefl)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n by (simp, blast?)+\n\nlemma r_affects_bd : \"x \\ {partition_label NicB, partition_label NicD} \\ x \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac auth=\"Write\" in affects_write)\n apply auto\ndone\n\nlemma r_affects_rm : \"partition_label RM \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac l=\"partition_label R\" and ep=\"partition_label R\" in affects_recv)\n apply simp_all\ndone\n\nlemma r_affects_a : \"partition_label NicA \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac l=\"partition_label R\" and ep=\"partition_label R\" and l'=\"partition_label RM\" and auth=\"Receive\" in affects_reset)\n apply auto\ndone\n\nlemma r_affects_ntfn3 : \"partition_label NTFN3 \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac l=\"partition_label R\" and auth=\"Receive\" in affects_ep)\n apply simp_all\ndone\n\nlemma r_affects_ntfn2 : \"partition_label NTFN2 \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac l=\"partition_label R\" in affects_ep_bound_trans)\n by auto\n\nlemma r_affects_ep : \"partition_label EP \\ subjectAffects SACAuthGraph (partition_label R)\"\n apply (rule_tac l=\"partition_label R\" in affects_ep_bound_trans)\n by auto\n\nlemma r_affects : \"subjectAffects SACAuthGraph (partition_label R) =\n {partition_label NicB, partition_label NicD, partition_label R,\n partition_label RM, partition_label NicA, partition_label NTFN3,\n partition_label EP, partition_label NTFN2 \\ \\these 2 added for NTFN binding\\ }\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, rule r_affects_bd, simp)\n apply (erule insertE, rule r_affects_bd, simp)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule r_affects_rm)\n apply (erule insertE, simp only:, rule r_affects_a)\n apply (erule insertE, simp only:, rule r_affects_ntfn3)\n apply (erule insertE, simp only:, rule r_affects_ep)\n apply (erule insertE, simp only:, rule r_affects_ntfn2)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by (simp, blast?)+\n\nsubsection \\RM reads/affects\\\n\nlemma rm_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label RM)\"\n apply (rule_tac ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply (simp_all add:reads_ep)\ndone\n\nlemma rm_reads_c : \"partition_label NicC \\ subjectReads SACAuthGraph (partition_label RM)\"\n apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n apply (rule rm_reads_sc, simp)\ndone\n\nlemma rm_reads : \"subjectReads SACAuthGraph (partition_label RM) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, simp only:, rule reads_read, simp)\n apply (erule insertE, simp only:, rule reads_lrefl)\n apply (erule insertE, simp only:, rule reads_read, simp)\n apply (erule insertE, simp only:, rule reads_read, simp)\n apply (erule insertE, simp only:, rule reads_read, simp)\n apply (erule insertE, simp only:, rule reads_ep, simp, simp)\n apply (erule insertE, simp only:, rule rm_reads_sc)\n apply (erule insertE, simp only:, rule rm_reads_c)\n apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule rm_reads_sc)\n apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule reads_lrefl)\n apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_read, simp)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n by (simp, blast?)+\n\nlemma rm_affects_via_control : \"x \\ {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD} \\ x \\ subjectAffects SACAuthGraph (partition_label RM)\"\n apply (rule_tac l=\"partition_label RM\" and auth=\"Control\" in affects_write)\n apply (simp, simp)\ndone\n\nlemma rm_affects_ep : \"partition_label EP \\ subjectAffects SACAuthGraph (partition_label RM)\"\n apply (rule_tac auth=\"Receive\" in affects_ep)\n apply simp_all\ndone\n\nlemma rm_affects_sc : \"partition_label SC \\ subjectAffects SACAuthGraph (partition_label RM)\"\n apply (rule_tac l=\"partition_label RM\" and ep=\"partition_label EP\" in affects_recv)\n apply simp_all\ndone\n\nlemma rm_affects_ntfn2 : \"partition_label NTFN2 \\ subjectAffects SACAuthGraph (partition_label RM)\"\n apply (rule_tac l=\"partition_label RM\" and auth=\"Receive\" in affects_ep)\n apply simp_all\ndone\n\nlemma rm_affects_ntfn3 : \"partition_label NTFN3 \\ subjectAffects SACAuthGraph (partition_label RM)\"\n apply (rule_tac l=\"partition_label RM\" in affects_ep_bound_trans)\n apply clarsimp\n by auto\n\n\nlemma rm_affects : \"subjectAffects SACAuthGraph (partition_label RM) =\n {partition_label NicA, partition_label NicB, partition_label NicD,\n partition_label R, partition_label SC, partition_label EP,\n partition_label RM, partition_label NTFN2,\n partition_label NTFN3 \\ \\added for NTFN binding\\}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n apply (erule insertE, simp only:, rule rm_affects_sc)\n apply (erule insertE, simp only:, rule rm_affects_ep)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule rm_affects_ntfn2)\n apply (erule insertE, simp only:, rule rm_affects_ntfn3)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by (simp, blast?)+\n\nsubsection \\SC\\\n\nlemma sc_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label SC)\"\n apply (rule_tac ep=\"partition_label EP\" and b=\"partition_label RM\" in read_sync_ep_read_receivers)\n apply (simp_all add:reads_ep)\ndone\n\nlemma sc_reads : \"subjectReads SACAuthGraph (partition_label SC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\n apply (erule insertE, simp only:, rule_tac auth=\"SyncSend\" in reads_ep, simp, simp)\n apply (erule insertE, simp only:, rule reads_lrefl)\n apply (erule insertE, simp only:, rule reads_read, simp)\n apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule reads_lrefl)\n apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule sc_reads_rm)\n apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (simp, blast?)+\ndone\n\nlemma sc_affects_all_rm_controls : \"l \\ RMControls \\ l \\ subjectAffects SACAuthGraph (partition_label SC)\"\n apply (simp only:RMControls_def)\n apply (erule insertE, rule_tac l=\"partition_label SC\" and auth=\"SyncSend\" and ep=\"partition_label EP\" and l'=\"partition_label RM\" in affects_send, simp, simp, simp, simp)+\n apply simp\ndone\n\nlemma sc_affects : \"subjectAffects SACAuthGraph (partition_label SC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"SyncSend\" in affects_ep, simp, simp)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"Write\" in affects_write, simp, simp)\n apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"Receive\" in affects_ep, simp, simp)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n apply (simp, blast?)+\ndone\n\nsubsection \\EP\\\n\nlemma ep_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label EP)\"\n apply (rule_tac ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply (rule reads_lrefl, simp_all)\ndone\n\nlemma ep_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label EP)\"\n apply (rule_tac ep=\"partition_label EP\" and b=\"partition_label RM\" in read_sync_ep_read_receivers)\n apply (rule reads_lrefl, simp)\ndone\n\nlemma ep_reads_c : \"partition_label NicC \\ subjectReads SACAuthGraph (partition_label EP)\"\n apply (rule_tac t=\"partition_label SC\" and p=\"partition_label NicC\" in reads_read_thread_read_pages)\n apply (rule ep_reads_sc, simp)\ndone\n\nlemma ep_reads : \"subjectReads SACAuthGraph (partition_label EP) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n apply (erule insertE, simp only:, rule ep_reads_rm)\n apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n apply (erule insertE, simp only:, rule reads_lrefl)\n apply (erule insertE, simp only:, rule ep_reads_sc)\n apply (erule insertE, simp only:, rule ep_reads_c)\n apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule ep_reads_sc)\n apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule ep_reads_rm)\n apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (simp, blast?)+\ndone\n\nlemma ep_affects_sc : \"partition_label SC \\ subjectAffects SACAuthGraph (partition_label EP)\"\n apply (rule_tac l=\"partition_label EP\" and ep=\"partition_label EP\" in affects_recv)\n apply simp_all\ndone\n\nlemma ep_affects_c : \"partition_label NicC \\ subjectAffects SACAuthGraph (partition_label EP)\"\n apply (rule_tac l=\"partition_label EP\" and l'=\"partition_label SC\" and auth=\"SyncSend\" and ep=\"partition_label EP\" in affects_reset)\n apply simp_all\ndone\n\nlemma ep_affects_ntfn2 : \"partition_label NTFN2 \\ subjectAffects SACAuthGraph (partition_label EP)\"\n apply (rule_tac ep=\"partition_label NTFN2\" in affects_ep_bound_trans)\n by auto\n\nlemma ep_affects_rm_controls : \"x \\ RMControls \\ x \\ subjectAffects SACAuthGraph (partition_label EP)\"\n apply (rule_tac l=\"partition_label EP\" and ep=\"partition_label EP\" and auth=\"SyncSend\" and l'=\"partition_label RM\" in affects_send)\n apply (simp_all)\ndone\n\nlemma ep_affects: \"subjectAffects SACAuthGraph (partition_label EP) = {partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN2} \\ RMControls\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule UnE)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule ep_affects_sc)\n apply (erule insertE, simp only:, rule ep_affects_c)\n apply (erule insertE, simp only:, rule ep_affects_ntfn2)\n apply simp\n apply (rule ep_affects_rm_controls, simp)\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by (simp, blast?)+\n\nsubsection \\NTFN1,2,3\\\n\nsubsubsection \\NTFN1 reads SC, EP, RM, R\\\n\nlemma ntfn1_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label NTFN1)\"\n apply (rule_tac ep=\"partition_label NTFN1\" in read_sync_ep_read_receivers)\n apply (rule reads_lrefl, simp)\ndone\n\nlemma ntfn1_reads_ep : \"partition_label EP \\ subjectReads SACAuthGraph (partition_label NTFN1)\"\n apply (rule_tac ep=\"partition_label EP\" and auth=\"SyncSend\" and t=\"partition_label SC\" and auth'=\"Reset\" and a=\"partition_label EP\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp, rule ntfn1_reads_sc)\ndone\n\nlemma ntfn1_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label NTFN1)\"\n apply (rule_tac b=\"partition_label RM\" and ep=\"partition_label EP\" in read_sync_ep_read_receivers)\n apply (rule ntfn1_reads_ep, simp)\ndone\n\nsubsubsection \\NTFN2 reads SC, EP, RM, R\\\n\nlemma ntfn2_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label NTFN2)\"\n apply (rule_tac ep=\"partition_label NTFN2\" in read_sync_ep_read_receivers)\n apply (rule reads_lrefl, simp)\ndone\n\nlemma ntfn2_reads_ep : \"partition_label EP \\ subjectReads SACAuthGraph (partition_label NTFN2)\"\n apply (rule_tac ep=\"partition_label EP\" and auth=\"Receive\" and t=\"partition_label RM\" and auth'=\"Reset\" and a=\"partition_label EP\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp, rule ntfn2_reads_rm)\ndone\n\nlemma ntfn2_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label NTFN2)\"\n apply (rule_tac b=\"partition_label SC\" and ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply (rule ntfn2_reads_ep, simp)\ndone\n\nsubsubsection \\NTFN3 reads SC, EP, RM, R\\\n\nlemma ntfn3_reads_r : \"partition_label R \\ subjectReads SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac ep=\"partition_label NTFN3\" in read_sync_ep_read_receivers)\n apply (rule reads_lrefl, simp)\ndone\n\nlemma ntfn3_reads_rm : \"partition_label RM \\ subjectReads SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac b=\"partition_label R\" in reads_read_page_read_thread)\n apply (rule ntfn3_reads_r, simp)\ndone\n\nlemma ntfn3_reads_ep : \"partition_label EP \\ subjectReads SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"SyncSend\" and a=\"partition_label SC\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp, rule ntfn3_reads_rm)\ndone\n\nlemma ntfn3_reads_sc : \"partition_label SC \\ subjectReads SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply (rule ntfn3_reads_ep, simp)\ndone\n\nsubsubsection \\NTFN1,2,3 reads C\\\n\nlemma ntfn123_reads_c : \"x \\ {NTFN1, NTFN2, NTFN3} \\ partition_label NicC \\ subjectReads SACAuthGraph (partition_label x)\"\n apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n apply (erule insertE, simp only:, rule ntfn1_reads_sc, erule insertE, simp only:, rule ntfn2_reads_sc, erule insertE, simp only:, rule ntfn3_reads_sc, simp)\n apply simp\ndone\n\nsubsubsection \\NTFN1,2,3 reads each other\\\n\nlemma ntfn13_reads_ntfn2 : \"l \\ {NTFN1, NTFN3} \\ partition_label NTFN2 \\ subjectReads SACAuthGraph (partition_label l)\"\n apply (rule_tac t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN2\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp)\n apply (erule insertE, simp only:, rule ntfn1_reads_rm, erule insertE, simp only:, rule ntfn3_reads_rm, simp)\ndone\n\nlemma ntfn12_reads_ntfn3 : \"l \\ {NTFN1, NTFN2} \\ partition_label NTFN3 \\ subjectReads SACAuthGraph (partition_label l)\"\n apply (rule_tac t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN3\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp)\n apply (erule insertE, simp only:, rule reads_all_rm_controlled_subjects, rule ntfn1_reads_rm, simp, erule insertE, simp only:, rule reads_all_rm_controlled_subjects, rule ntfn2_reads_rm, simp_all)\ndone\n\nlemma ntfn23_reads_ntfn1 : \"l \\ {NTFN2, NTFN3} \\ partition_label NTFN1 \\ subjectReads SACAuthGraph (partition_label l)\"\n apply (rule_tac t=\"partition_label SC\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN1\" in reads_read_queued_thread_read_ep)\n apply (simp, simp, simp, simp)\n apply (erule insertE, simp only:, rule ntfn2_reads_sc, erule insertE, simp only:, rule ntfn3_reads_sc, simp)\ndone\n\nsubsubsection \\NTFN1,2,3 reads\\\ndeclare SACAuthGraph_def[simp del]\n\nlemma ntfn123_reads_rm : \"l \\ {NTFN1, NTFN2, NTFN3} \\ partition_label RM \\ subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_rm ntfn2_reads_rm ntfn3_reads_rm)\n\nlemma ntfn123_reads_sc : \"l \\ {NTFN1, NTFN2, NTFN3} \\ partition_label SC \\ subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_sc ntfn2_reads_sc ntfn3_reads_sc)\n\nlemma ntfn123_reads_ep : \"l \\ {NTFN1, NTFN2, NTFN3} \\ partition_label EP \\ subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_ep ntfn2_reads_ep ntfn3_reads_ep)\n\nlemma ntfn123_reads_ntfn123 : \"\\l \\ {NTFN1, NTFN2, NTFN3}; x \\ {NTFN1, NTFN2, NTFN3}\\ \\ partition_label l \\ subjectReads SACAuthGraph (partition_label x)\"\nby (auto simp:ntfn12_reads_ntfn3 ntfn13_reads_ntfn2 ntfn23_reads_ntfn1)\n\nlemma ntfn123_reads : \"l \\ {NTFN1, NTFN2, NTFN3} \\ subjectReads SACAuthGraph (partition_label l) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_rm, simp)\n apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_ep, simp)\n apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_sc, simp)\n apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_c, simp)\n apply (auto simp:ntfn123_reads_ntfn123)[1]\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n by (simp add:SACAuthGraph_def, blast?)+\n\nsubsubsection \\NTFN1,2,3 affects\\\n\nlemma ntfn1_affects_sc : \"partition_label SC \\ subjectAffects SACAuthGraph (partition_label NTFN1)\"\n apply (rule_tac l''=\"partition_label SC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label NTFN1\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn1_affects_c : \"partition_label NicC \\ subjectAffects SACAuthGraph (partition_label NTFN1)\"\n apply (rule_tac l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and l=\"partition_label NTFN1\" and auth=\"Notify\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn1_affects : \"subjectAffects SACAuthGraph (partition_label NTFN1) = {partition_label NTFN1, partition_label SC, partition_label NicC}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule ntfn1_affects_sc)\n apply (erule insertE, simp only:, rule ntfn1_affects_c)\n apply simp\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma ntfn2_affects_rm : \"partition_label RM \\ subjectAffects SACAuthGraph (partition_label NTFN2)\"\n apply (rule_tac l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label NTFN2\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn2_affects_ep : \"partition_label EP \\ subjectAffects SACAuthGraph (partition_label NTFN2)\"\n apply (rule affects_ep_bound_trans)\n by (auto simp: SACAuthGraph_def)\n\nlemma ntfn2_affects_rm_controls : \"x \\ RMControls \\ x \\ subjectAffects SACAuthGraph (partition_label NTFN2)\"\n apply (rule_tac l=\"partition_label NTFN2\" and ep=\"partition_label NTFN2\" and auth=\"SyncSend\" and l'=\"partition_label RM\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn2_affects : \"subjectAffects SACAuthGraph (partition_label NTFN2) = {partition_label NTFN2, partition_label RM, partition_label EP} \\ RMControls\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI)\n apply (erule UnE)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule ntfn2_affects_rm)\n apply (erule insertE, simp only:, rule ntfn2_affects_ep)\n apply simp\n apply (rule ntfn2_affects_rm_controls, simp)\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n by (simp add:SACAuthGraph_def, blast?)+\n\nlemma ntfn3_affects_r : \"partition_label R \\ subjectAffects SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label NTFN3\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn3_affects_bd : \"l \\ {NicB, NicD} \\ partition_label l \\ subjectAffects SACAuthGraph (partition_label NTFN3)\"\n apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and l=\"partition_label NTFN3\" and auth=\"Notify\" in affects_send)\n apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma ntfn3_affects : \"subjectAffects SACAuthGraph (partition_label NTFN3) = {partition_label NTFN3, partition_label R} \\ {partition_label NicB, partition_label NicD}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI, erule UnE)\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule ntfn3_affects_r, simp)\n apply (auto simp:ntfn3_affects_bd)[1]\n (* forward *)\n apply (rule subsetI)\n apply (erule subjectAffects.induct)\n apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nsubsection \\T\\\n\nlemma t_reads : \"subjectReads SACAuthGraph (partition_label T) = {partition_label T}\"\n apply (rule subset_antisym)\n defer\n apply (rule subsetI, erule insertE, simp only:, rule reads_lrefl, simp)\n apply (rule subsetI, erule subjectReads.induct)\n apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma t_affects_ntfn123 : \"l \\ {NTFN1, NTFN2, NTFN3} \\ partition_label l \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac auth=\"Notify\" in affects_ep)\n apply (simp_all add:SACAuthGraph_def, blast)\ndone\n\nlemma t_affects_sc : \"partition_label SC \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l''=\"partition_label SC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_rm : \"partition_label RM \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l''=\"partition_label RM\" and l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_r : \"partition_label R \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l''=\"partition_label R\" and l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_ep : \"partition_label EP \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule affects_ep_bound_trans)\n by (auto simp: SACAuthGraph_def)\n\nlemma t_affects_c : \"partition_label NicC \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l''=\"partition_label NicC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_a : \"partition_label NicA \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l''=\"partition_label NicA\" and l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_bd : \"l \\ {NicB, NicD} \\ partition_label l \\ subjectAffects SACAuthGraph (partition_label T)\"\n apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n apply (simp_all add:SACAuthGraph_def, blast)\ndone\n\nlemma t_affects : \"subjectAffects SACAuthGraph (partition_label T) = {partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \\ {partition_label T, partition_label SC, partition_label RM, partition_label R, partition_label NicA, partition_label NicB, partition_label NicD, partition_label NicC, partition_label EP}\"\n apply (rule subset_antisym)\n defer\n (* backward *)\n apply (rule subsetI, erule UnE)\n apply (auto simp:t_affects_ntfn123)[1]\n apply (erule insertE, simp only:, rule affects_lrefl)\n apply (erule insertE, simp only:, rule t_affects_sc)\n apply (erule insertE, simp only:, rule t_affects_rm)\n apply (erule insertE, simp only:, rule t_affects_r)\n apply (erule insertE, simp only:, rule t_affects_a)\n apply (erule insertE, simp only:, rule t_affects_bd, simp)\n apply (erule insertE, simp only:, rule t_affects_bd, simp)\n apply (erule insertE, simp only:, rule t_affects_c)\n apply (erule insertE, simp only:, rule t_affects_ep)\n apply simp\n (* forward *)\n apply (rule subsetI, erule subjectAffects.induct)\n by (simp add:SACAuthGraph_def, blast?)+\n\nsubsection \\Policy\\\n\nlemmas SAC_reads = sc_reads ep_reads c_reads rm_reads r_reads abd_reads ntfn123_reads t_reads\n\nlemmas SAC_affects = sc_affects ep_affects c_affects rm_affects r_affects abd_affects ntfn1_affects ntfn2_affects ntfn3_affects t_affects\n\ndefinition SACFlowDoms where\n \"SACFlowDoms \\ {Partition EP, Partition SC, Partition NicC, Partition RM, Partition R, Partition NicA, Partition NicB, Partition NicD, Partition NTFN1, Partition NTFN2, Partition NTFN3}\"\ndeclare SACFlowDoms_def [simp]\n\ndefinition SACPolicyFlows :: \"(SACLabels partition \\ SACLabels partition) set\" where\n \"SACPolicyFlows \\\n {(PSched,d)| d. True}\n \\ {(Partition l, Partition k)| l k. (k = T \\ l = T)}\"\n\nlemma SAC_partsSubjectAffects_exceptT : \"x \\ T \\ partsSubjectAffects SACAuthGraph x = SACFlowDoms\"\n apply (rule equalityI)\n defer\n apply (rule subsetI)\n apply (simp add:partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply (case_tac x)\n apply ((erule disjE, clarify, simp add:SAC_affects SAC_reads, blast?)+, simp add:SAC_affects SAC_reads, blast?)+\n apply (rule subsetI)\n apply (simp add:partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply (clarify)\n apply (case_tac x)\n apply (case_tac[!] xaa)\n apply (auto simp: SAC_affects SAC_reads)\ndone\n\nlemma SAC_partsSubjectAffects_T : \"(partsSubjectAffects SACAuthGraph T) = {Partition NTFN1, Partition NTFN2, Partition NTFN3} \\ {Partition T, Partition SC, Partition RM, Partition R, Partition NicA, Partition NicB, Partition NicD, Partition NicC, Partition EP}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply (simp add: partsSubjectAffects_def image_def label_can_affect_partition_def SAC_affects SAC_reads)\n apply (clarify)\n apply (case_tac xa, simp_all)[1]\n apply (rule subsetI)\n apply (simp add: partsSubjectAffects_def image_def label_can_affect_partition_def SAC_affects SAC_reads)\n apply (erule disjE, simp add: SAC_reads) (* Do not collapse this in with a blast? because attempting blast takes too long *)\n apply ((erule disjE)?, simp add: SAC_reads, blast)+\ndone\n\nlemma SAC_policyFlows : \"policyFlows SACAuthGraph = SACPolicyFlows\"\n apply (rule subset_antisym)\n (* forward *)\n apply (rule subsetI)\n apply clarify\n apply (erule policyFlows.cases)\n (* subject case *)\n apply (clarsimp simp:SACPolicyFlows_def)\n apply (case_tac \"d = Partition T\")\n apply (case_tac l, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)[1]\n apply (case_tac l, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)[1]\n (* scheduler case *)\n apply (simp add:SACPolicyFlows_def)\n (* backward *)\n apply (rule subsetI)\n apply (clarsimp simp:SACPolicyFlows_def)\n apply (erule disjE)\n (* scheduler flows to all *)\n apply (simp add:PSched_flows_to_all)\n (* all subjects flow to all subjects *)\n apply (clarify, simp)\n apply (rule policy_affects)\n apply (case_tac l, case_tac[1-12] k, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/PolicySystemSAC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832805, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.29017637595003615}} {"text": "theory AltCutEnv\n imports PermEnvMisc LiftEnv AltNormEnv\nbegin\n\n (* ##### cut-family lemmas *) \n \ndefinition cut_use_env where\n \"cut_use_env r_s = (\\ x. if r_s x = UsePerm then NoPerm else r_s x)\"\n \nlemma self_cut_leq_use_env: \"leq_use_env (cut_use_env r_s) r_s\" \n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n\nlemma cut_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\ leq_use_env (cut_use_env r_x) r_s\" \n apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac self_cut_leq_use_env)\n done\n \nlemma strong_cut_use_env: \"strong_use_env (cut_use_env r_s)\"\n apply (simp add: strong_use_env_def)\n apply (simp add: cut_use_env_def)\n done\n \nlemma mini_disj_strong_use_env: \"\\ leq_use_env r_x (diff_use_env r_s r_ex); strong_use_env r_ex \\ \\ mini_disj_use_env r_x r_ex\" \n apply (simp add: leq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: strong_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n \nlemma diff_cut_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\ leq_use_env (diff_use_env r_x (cut_use_env r_ex)) (diff_use_env r_s r_ex)\"\n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done \n \nlemma dist_diff_leq_use_env_cut: \"\\ leq_use_env r_x r_s; leq_use_env (cut_use_env r_exb) r_exa \\ \\ leq_use_env (diff_use_env r_x r_exa) (diff_use_env r_s r_exb)\"\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: diff_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n done \n \nlemma lhs_diff_leq_use_env: \"\\ leq_use_env (diff_use_env r_x r_ex) r_s; leq_use_env (cut_use_env r_ex) r_s \\ \\ leq_use_env r_x r_s\" \n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: diff_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto) \n done \n \nlemma lift_cut_leq_use_env: \"\\ is_own r; leq_use_env r_x (lift_use_env r_s r) \\ \\ leq_use_env r_x (cut_use_env (lift_use_env r_s r))\" \n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp add: is_own_def)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \n (* -- unsorted *)\n \nlemma strong_lift_use_env: \"\\ is_own r \\ \\ strong_use_env (lift_use_env r_s r)\" \n apply (simp add: is_own_def)\n apply (simp add: strong_use_env_def)\n done \n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/AltCutEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.29017636909969685}} {"text": "\\<^marker>\\creator Andreas Vollert\\\n\ntheory IMP_Minus_To_IMP_Minus_Minus_State_Translations_IMP\n imports\n Primitives_IMP_Minus\n Binary_Arithmetic_IMP\n IMP_Minus_To_IMP_Minus_Minus_State_Translations_nat\n IMP_Minus.Com\nbegin\n\nunbundle IMP_Minus_Minus_Com.no_com_syntax\n\n\nsubsection \\Useful Definitions and Lemmas\\\n\nabbreviation \"hash_encode_char_as_nat \\ 35\"\nlemma hash_encode_char_val: \"encode_char (CHR ''#'') = hash_encode_char_as_nat\"\n by (simp add: encode_char_def)\n\nabbreviation \"dollar_encode_char_as_nat \\ 36\"\nlemma dollar_encode_char_val: \"encode_char (CHR ''$'') = dollar_encode_char_as_nat\"\n by (simp add: encode_char_def)\n\nabbreviation \"dollar_vname_encode_as_nat \\ 703\"\nlemma dollar_vname_encode_val: \"vname_encode ''$'' = dollar_vname_encode_as_nat\"\n by (simp add: vname_encode_def encode_char_def prod_encode_def triangle_def)\n\nlemma hd_nat_noteq_zero: \"hd_nat n \\ 0 \\ n > 0\"\n by (induction n)\n (simp add: hd_nat_def fst_nat_def prod_decode_def prod_decode_aux.simps, simp)\n\nsubsection \\dropWhile_char\\\n\nsubsubsection \\dropWhile_char_loop\\\n\nrecord dropWhile_char_loop_state =\n dropWhile_char_loop_n::nat\n dropWhile_char_loop_ret::nat\n\nabbreviation \"dropWhile_char_loop_prefix \\ ''dropWhile_char_loop.''\"\nabbreviation \"dropWhile_char_loop_n_str \\ ''n''\"\nabbreviation \"dropWhile_char_loop_ret_str \\ ''ret''\"\n\nfunction dropWhile_char_loop:: \"nat \\ nat\" where\n \"dropWhile_char_loop n =\n (if hd_nat n = encode_char (CHR ''#'')\n then dropWhile_char_loop (tl_nat n)\n else n\n )\"\n by simp+\ntermination\n by (relation \"measure id\", simp)\n (simp add: hash_encode_char_val pos_tl_less hd_nat_noteq_zero)\n\ndefinition \"dropWhile_char_loop_state_upd s \\\n let\n tl_xs' = dropWhile_char_loop_n s;\n tl_ret' = 0;\n tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n dropWhile_char_loop_n' = tl_ret tl_ret_state;\n dropWhile_char_loop_ret' = dropWhile_char_loop_ret s;\n ret = \\dropWhile_char_loop_n = dropWhile_char_loop_n',\n dropWhile_char_loop_ret = dropWhile_char_loop_ret'\\\n in\n ret\"\n\ndefinition \"dropWhile_char_loop_imp_compute_loop_condition s \\\n (let hd_xs' = dropWhile_char_loop_n s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n EQUAL_neq_zero_ret' = 0;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n condition = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state\n in condition\n )\"\n\ndefinition \"dropWhile_char_loop_imp_after_loop s \\\n (let\n dropWhile_char_loop_n' = dropWhile_char_loop_n s;\n dropWhile_char_loop_ret' = dropWhile_char_loop_n s;\n ret = \\dropWhile_char_loop_n = dropWhile_char_loop_n',\n dropWhile_char_loop_ret = dropWhile_char_loop_ret'\\\n in ret\n )\"\n\nlemmas dropWhile_char_loop_imp_subprogram_simps =\n dropWhile_char_loop_imp_after_loop_def\n dropWhile_char_loop_state_upd_def\n dropWhile_char_loop_imp_compute_loop_condition_def\n\nfunction dropWhile_char_loop_imp:: \"dropWhile_char_loop_state \\ dropWhile_char_loop_state\" where\n \"dropWhile_char_loop_imp s =\n (if dropWhile_char_loop_imp_compute_loop_condition s \\ 0\n then (let next_iteration = dropWhile_char_loop_imp (dropWhile_char_loop_state_upd s)\n in next_iteration)\n else (let ret = dropWhile_char_loop_imp_after_loop s in ret))\"\n by simp+\ntermination\n by (relation \"measure dropWhile_char_loop_n\", simp)\n (simp add: dropWhile_char_loop_imp_subprogram_simps tl_imp_correct EQUAL_neq_zero_imp_correct\n hd_imp_correct split:if_splits, simp only: hd_nat_noteq_zero pos_tl_less)\n\ndeclare dropWhile_char_loop_imp.simps [simp del]\n\nlemma dropWhile_char_loop_imp_correct[let_function_correctness]:\n \"dropWhile_char_loop_ret (dropWhile_char_loop_imp s) =\n dropWhile_char_loop (dropWhile_char_loop_n s)\"\n by (induction \"dropWhile_char_loop_n s\" arbitrary: s rule: dropWhile_char_loop.induct)\n (subst dropWhile_char_loop_imp.simps, simp add: dropWhile_char_loop_imp_subprogram_simps\n tl_imp_correct hd_imp_correct EQUAL_neq_zero_imp_correct hash_encode_char_val)\n\ndefinition \"dropWhile_char_loop_state_upd_time t s \\\n let\n tl_xs' = dropWhile_char_loop_n s;\n t = t + 2;\n tl_ret' = 0;\n t = t + 2;\n tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n t = t + tl_imp_time 0 tl_state;\n dropWhile_char_loop_n' = tl_ret tl_ret_state;\n t = t + 2;\n dropWhile_char_loop_ret' = dropWhile_char_loop_ret s;\n t = t + 2;\n ret = t\n in\n ret\"\n\ndefinition \"dropWhile_char_loop_imp_compute_loop_condition_time t s \\\n (let hd_xs' = dropWhile_char_loop_n s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n t = t + 2;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n t = t + 2;\n EQUAL_neq_zero_ret' = 0;\n t = t + 2;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n t = t + EQUAL_neq_zero_imp_time 0 EQUAL_neq_zero_state;\n condition = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n t = t + 2;\n ret = t\n in ret\n )\"\n\ndefinition \"dropWhile_char_loop_imp_after_loop_time (t::nat) (s::dropWhile_char_loop_state) \\\n (let\n dropWhile_char_n' = dropWhile_char_loop_n s;\n t = t + 2;\n dropWhile_char_ret' = dropWhile_char_loop_n s;\n t = t + 2;\n ret = t\n in ret\n )\"\n\nlemmas dropWhile_char_loop_imp_subprogram_simps_time =\n dropWhile_char_loop_imp_after_loop_time_def\n dropWhile_char_loop_state_upd_time_def\n dropWhile_char_loop_imp_compute_loop_condition_time_def\n\nfunction dropWhile_char_loop_imp_time:: \"nat \\ dropWhile_char_loop_state \\ nat\" where\n \"dropWhile_char_loop_imp_time t s =\n dropWhile_char_loop_imp_compute_loop_condition_time 0 s +\n (if dropWhile_char_loop_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration\n = dropWhile_char_loop_imp_time (t + dropWhile_char_loop_state_upd_time 0 s)\n (dropWhile_char_loop_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + dropWhile_char_loop_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n apply (relation \"measure (dropWhile_char_loop_n \\ snd)\", simp)\n apply (subst dropWhile_char_loop_state_upd_def)\n apply (simp add: dropWhile_char_loop_imp_compute_loop_condition_def tl_imp_correct\n EQUAL_neq_zero_imp_correct hd_imp_correct split: if_splits)\n by (simp only: pos_tl_less hd_nat_noteq_zero)\n\ndeclare dropWhile_char_loop_imp_time.simps [simp del]\n\nlemmas dropWhile_char_loop_imp_subprogram_time_simps =\n dropWhile_char_loop_imp_subprogram_simps\n dropWhile_char_loop_imp_after_loop_time_def\n dropWhile_char_loop_state_upd_time_def\n dropWhile_char_loop_imp_compute_loop_condition_time_def\n\nlemma dropWhile_char_loop_imp_time_acc:\n \"(dropWhile_char_loop_imp_time (Suc t) s) = Suc (dropWhile_char_loop_imp_time t s)\"\n by (induction t s rule: dropWhile_char_loop_imp_time.induct)\n ((subst (1 2) dropWhile_char_loop_imp_time.simps);\n (simp add: dropWhile_char_loop_state_upd_def))\n\nlemma dropWhile_char_loop_imp_time_acc_2_aux:\n \"(dropWhile_char_loop_imp_time t s) =\n t + (dropWhile_char_loop_imp_time 0 s)\"\n by (induction t arbitrary: s)\n (simp add: dropWhile_char_loop_imp_time_acc)+\n\nlemma dropWhile_char_loop_imp_time_acc_2:\n \"t \\ 0 \\ (dropWhile_char_loop_imp_time t s) =\n t + (dropWhile_char_loop_imp_time 0 s)\"\n by (rule dropWhile_char_loop_imp_time_acc_2_aux)\n\nlemma dropWhile_char_loop_imp_time_acc_3:\n \"(dropWhile_char_loop_imp_time (a + b) s) =\n a + (dropWhile_char_loop_imp_time b s)\"\n by (induction a arbitrary: b s)\n (simp add: dropWhile_char_loop_imp_time_acc)+\n\nabbreviation \"dropWhile_char_loop_while_cond \\ ''condition''\"\n\ndefinition \"dropWhile_char_loop_IMP_init_while_cond \\\n (hd_prefix @ hd_xs_str) ::= (A (V dropWhile_char_loop_n_str));;\n \\ \\(hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\(hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\\\n \\ \\(hd_ret_state = hd_imp hd_state;\\\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n \\ \\(EQUAL_neq_zero_a' = hd_ret hd_ret_state;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_a_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\(EQUAL_neq_zero_b' = hash_encode_char_as_nat;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_b_str) ::= (A (N hash_encode_char_as_nat));;\n \\ \\(EQUAL_neq_zero_ret' = 0;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\(EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\\\n \\ \\( EQUAL_neq_zero_b = EQUAL_neq_zero_b',\\\n \\ \\( EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\\\n \\ \\(EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\\\n invoke_subprogram EQUAL_neq_zero_prefix EQUAL_neq_zero_IMP_Minus;;\n dropWhile_char_loop_while_cond ::= (A (V (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str)))\n \"\n\ndefinition \"dropWhile_char_loop_IMP_loop_body \\\n \\ \\tl_xs' = dropWhile_char_loop_n s;\\\n (tl_prefix @ tl_xs_str) ::= (A (V dropWhile_char_loop_n_str));;\n \\ \\tl_ret' = 0;\\\n (tl_prefix @ tl_ret_str) ::= (A (N 0));;\n \\ \\tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\\\n \\ \\tl_ret_state = tl_imp tl_state;\\\n invoke_subprogram tl_prefix tl_IMP_Minus;;\n \\ \\dropWhile_char_loop_n' = tl_ret tl_ret_state;\\\n dropWhile_char_loop_n_str ::= (A (V (tl_prefix @ tl_ret_str)));;\n \\ \\dropWhile_char_loop_ret' = dropWhile_char_ret s;\\\n dropWhile_char_loop_ret_str ::= (A (V dropWhile_char_loop_ret_str))\n \"\n\ndefinition \"dropWhile_char_loop_IMP_after_loop \\\n \\ \\ dropWhile_char_loop_n' = dropWhile_char_loop_n s;\\\n dropWhile_char_loop_n_str ::= (A (V dropWhile_char_loop_n_str));;\n \\ \\ dropWhile_char_loop_ret' = dropWhile_char_loop_n s;\\\n dropWhile_char_loop_ret_str ::= (A (V dropWhile_char_loop_n_str))\n \"\n\ndefinition dropWhile_char_loop_IMP_Minus where\n \"dropWhile_char_loop_IMP_Minus \\\n dropWhile_char_loop_IMP_init_while_cond;;\n WHILE dropWhile_char_loop_while_cond \\0 DO (\n dropWhile_char_loop_IMP_loop_body;;\n dropWhile_char_loop_IMP_init_while_cond\n );;\n dropWhile_char_loop_IMP_after_loop\"\n\nabbreviation\n \"dropWhile_char_loop_IMP_vars \\\n {dropWhile_char_loop_n_str, dropWhile_char_loop_ret_str}\"\n\nlemmas dropWhile_char_loop_IMP_subprogram_simps =\n dropWhile_char_loop_IMP_init_while_cond_def\n dropWhile_char_loop_IMP_loop_body_def\n dropWhile_char_loop_IMP_after_loop_def\n\ndefinition \"dropWhile_char_loop_imp_to_HOL_state p s =\n \\dropWhile_char_loop_n = (s (add_prefix p dropWhile_char_loop_n_str)),\n dropWhile_char_loop_ret = (s (add_prefix p dropWhile_char_loop_ret_str))\\\"\n\nlemmas dropWhile_char_loop_state_translators =\n hd_imp_to_HOL_state_def\n tl_imp_to_HOL_state_def\n dropWhile_char_loop_imp_to_HOL_state_def\n AND_neq_zero_imp_to_HOL_state_def\n EQUAL_neq_zero_imp_to_HOL_state_def\n NOTEQUAL_neq_zero_imp_to_HOL_state_def\n\nlemmas dropWhile_char_loop_complete_simps =\n dropWhile_char_loop_IMP_subprogram_simps\n dropWhile_char_loop_imp_subprogram_simps\n dropWhile_char_loop_state_translators\n\nlemmas dropWhile_char_loop_complete_time_simps =\n dropWhile_char_loop_imp_subprogram_time_simps\n dropWhile_char_loop_imp_time_acc_2\n dropWhile_char_loop_imp_time_acc_3\n dropWhile_char_loop_state_translators\n\nlemma dropWhile_char_loop_IMP_Minus_correct_function:\n \"(invoke_subprogram p dropWhile_char_loop_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p dropWhile_char_loop_ret_str) =\n dropWhile_char_loop_ret (dropWhile_char_loop_imp (dropWhile_char_loop_imp_to_HOL_state p s))\"\n apply(induction \"dropWhile_char_loop_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: dropWhile_char_loop_imp.induct)\n apply(subst dropWhile_char_loop_imp.simps)\n apply(simp only: dropWhile_char_loop_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_E)+\n apply(erule While_tE)\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(13) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(15) by fastforce\n by(force simp: dropWhile_char_loop_complete_simps Let_def)\n\n apply(erule Seq_E)+\n apply(dest_com_gen)\n\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(20) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(22) by fastforce\n by(fastforce_sorted_premises simp: dropWhile_char_loop_complete_simps Let_def)\n\n subgoal\n\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps\n dropWhile_char_loop_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(24) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(26) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n by(fastforce_sorted_premises simp: dropWhile_char_loop_complete_simps Let_def)\n\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps\n dropWhile_char_loop_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(24) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(26) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n by(fastforce_sorted_premises simp: dropWhile_char_loop_complete_simps Let_def)\n\n done\n\nlemma dropWhile_char_loop_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ dropWhile_char_loop_pref) dropWhile_char_loop_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix dropWhile_char_loop_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma dropWhile_char_loop_IMP_Minus_correct_time_loop_condition:\n \"(invoke_subprogram p dropWhile_char_loop_IMP_init_while_cond, s) \\\\<^bsup>t\\<^esup> s' \\\n t = dropWhile_char_loop_imp_compute_loop_condition_time\n 0 (dropWhile_char_loop_imp_to_HOL_state p s)\"\n by (fastforce elim: EQUAL_neq_zero_IMP_Minus_correct hd_IMP_Minus_correct simp: Let_def\n dropWhile_char_loop_imp_compute_loop_condition_time_def invoke_subprogram_append\n dropWhile_char_loop_IMP_init_while_cond_def EQUAL_neq_zero_IMP_Minus_correct_time\n dropWhile_char_loop_imp_subprogram_simps dropWhile_char_loop_imp_time_acc\n dropWhile_char_loop_state_translators)\n\nlemma dropWhile_char_loop_IMP_Minus_correct_time:\n \"(invoke_subprogram p dropWhile_char_loop_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = dropWhile_char_loop_imp_time 0 (dropWhile_char_loop_imp_to_HOL_state p s)\"\n apply(induction \"dropWhile_char_loop_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: dropWhile_char_loop_imp.induct)\n apply(subst dropWhile_char_loop_imp_time.simps)\n apply(simp only: dropWhile_char_loop_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_subprogram_simps prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(24) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(26) by fastforce\n by (force simp: dropWhile_char_loop_imp_subprogram_time_simps Let_def\n dropWhile_char_loop_state_translators)\n\n apply(erule Seq_tE)+\n apply(simp add: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(37) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(39) by fastforce\n by (fastforce_sorted_premises simp: dropWhile_char_loop_complete_simps Let_def)\n\n subgoal\n\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps\n dropWhile_char_loop_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(45) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(47) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(49) by fastforce\n by (fastforce_sorted_premises simp: Let_def dropWhile_char_loop_complete_time_simps)\n\n subgoal\n apply(simp only: dropWhile_char_loop_IMP_init_while_cond_def prefix_simps\n dropWhile_char_loop_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(45) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(47) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"dropWhile_char_loop_IMP_vars\"])\n subgoal premises p using p(49) by fastforce\n by (fastforce_sorted_premises simp: dropWhile_char_loop_complete_time_simps Let_def)\n\n done\n\nlemma dropWhile_char_loop_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) dropWhile_char_loop_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (dropWhile_char_loop_imp_time 0 (dropWhile_char_loop_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) dropWhile_char_loop_ret_str) =\n dropWhile_char_loop_ret (dropWhile_char_loop_imp\n (dropWhile_char_loop_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\ \\ P\\\n \\ P\"\n using dropWhile_char_loop_IMP_Minus_correct_function\n by (auto simp: dropWhile_char_loop_IMP_Minus_correct_time)\n (meson dropWhile_char_loop_IMP_Minus_correct_effects set_mono_prefix)\n\n\nsubsubsection \\dropWhile_char\\\n\nrecord dropWhile_char_state =\n dropWhile_char_n::nat\n dropWhile_char_ret::nat\n\nabbreviation \"dropWhile_char_prefix \\ ''dropWhile_char_loop.''\"\nabbreviation \"dropWhile_char_n_str \\ ''n''\"\nabbreviation \"dropWhile_char_ret_str \\ ''ret''\"\n\nfun dropWhile_char':: \"nat \\ nat\" where\n \"dropWhile_char' n =\n (if n \\ 0\n then dropWhile_char_loop n\n else n)\"\n\nlemma dropWhile_char'_correct: \"dropWhile_char n = dropWhile_char' n\"\n by (induction n rule: dropWhile_char.induct)\n (simp add: fst_nat_0 hash_encode_char_val hd_nat_def split: if_splits)\n\ndefinition \"dropWhile_char_state_upd s \\\n let\n dropWhile_char_loop_n' = dropWhile_char_n s;\n dropWhile_char_loop_ret' = 0;\n dropWhile_char_loop_state = \\dropWhile_char_loop_n = dropWhile_char_loop_n',\n dropWhile_char_loop_ret = dropWhile_char_loop_ret'\\;\n dropWhile_char_loop_ret_state = dropWhile_char_loop_imp dropWhile_char_loop_state;\n dropWhile_char_n' = dropWhile_char_n s;\n dropWhile_char_ret' = dropWhile_char_loop_ret dropWhile_char_loop_ret_state;\n ret = \\dropWhile_char_n = dropWhile_char_n',\n dropWhile_char_ret = dropWhile_char_ret'\\\n in\n ret\"\n\nfun dropWhile_char_imp:: \"dropWhile_char_state \\ dropWhile_char_state\" where\n \"dropWhile_char_imp s =\n (if dropWhile_char_n s \\ 0\n then dropWhile_char_state_upd s\n else \\dropWhile_char_n = dropWhile_char_n s,\n dropWhile_char_ret = dropWhile_char_n s\\)\"\n\ndeclare dropWhile_char_imp.simps [simp del]\n\nlemma dropWhile_char_imp_correct[let_function_correctness]:\n \"dropWhile_char_ret (dropWhile_char_imp s) = dropWhile_char' (dropWhile_char_n s)\"\n by(simp add: dropWhile_char_imp.simps dropWhile_char_state_upd_def Let_def\n dropWhile_char_loop_imp_correct)\n\nlemmas dropWhile_char_imp_subprogram_simps = dropWhile_char_state_upd_def\n\ndefinition \"dropWhile_char_state_upd_time t s \\\n let\n dropWhile_char_loop_n' = dropWhile_char_n s;\n t = t + 2;\n dropWhile_char_loop_ret' = 0;\n t = t + 2;\n dropWhile_char_loop_state = \\dropWhile_char_loop_n = dropWhile_char_loop_n',\n dropWhile_char_loop_ret = dropWhile_char_loop_ret'\\;\n dropWhile_char_loop_ret_state = dropWhile_char_loop_imp dropWhile_char_loop_state;\n t = t + dropWhile_char_loop_imp_time 0 dropWhile_char_loop_state;\n dropWhile_char_n' = dropWhile_char_n s;\n t = t + 2;\n dropWhile_char_ret' = dropWhile_char_loop_ret dropWhile_char_loop_ret_state;\n t = t + 2;\n ret = t\n in\n ret\"\n\nfun dropWhile_char_imp_time:: \"nat \\ dropWhile_char_state \\ nat\" where\n \"dropWhile_char_imp_time t s =\n (if dropWhile_char_n s \\ 0\n then (let t = t + 1;\n next = dropWhile_char_state_upd s;\n t = t + dropWhile_char_state_upd_time 0 s;\n ret = t\n in ret)\n else (let t = t + 1;\n dropWhile_char_n' = dropWhile_char_n s;\n t = t + 2;\n dropWhile_char_ret' = dropWhile_char_n s;\n t = t + 2;\n ret = t\n in ret))\"\n\ndeclare dropWhile_char_imp_time.simps [simp del]\n\nlemmas dropWhile_char_imp_subprogram_simps_time = dropWhile_char_state_upd_time_def\n\nlemma dropWhile_char_imp_time_acc:\n \"(dropWhile_char_imp_time (Suc t) s) = Suc (dropWhile_char_imp_time t s)\"\n by (induction t s rule: dropWhile_char_imp_time.induct)\n (simp add: dropWhile_char_imp_time.simps)\n\nlemma dropWhile_char_imp_time_acc_2:\n \"(dropWhile_char_imp_time x s) = x + (dropWhile_char_imp_time 0 s)\"\n by (induction x arbitrary: s) (simp add: dropWhile_char_imp_time_acc)+\n\nlemma dropWhile_char_imp_time_acc_2_simp:\n \"(dropWhile_char_imp_time (dropWhile_char_state_upd_time 0 s) s') =\n (dropWhile_char_state_upd_time 0 s) + (dropWhile_char_imp_time 0 s')\"\n by (rule dropWhile_char_imp_time_acc_2)\n\nlemmas dropWhile_char_complete_time_simps =\n dropWhile_char_imp_subprogram_simps\n dropWhile_char_state_upd_time_def\n dropWhile_char_imp_time_acc\n dropWhile_char_imp_time_acc_2_simp\n\ndefinition dropWhile_char_IMP_Minus where\n \"dropWhile_char_IMP_Minus \\\n IF dropWhile_char_n_str \\0\n THEN (\n (dropWhile_char_loop_prefix @ dropWhile_char_loop_n_str) ::= (A (V dropWhile_char_n_str));;\n (dropWhile_char_loop_prefix @ dropWhile_char_loop_ret_str) ::= (A (N 0));;\n invoke_subprogram dropWhile_char_loop_prefix dropWhile_char_loop_IMP_Minus;;\n dropWhile_char_n_str ::= (A (V dropWhile_char_n_str));;\n dropWhile_char_ret_str ::= (A (V (dropWhile_char_loop_prefix @ dropWhile_char_loop_ret_str)))\n )\n ELSE (\n dropWhile_char_n_str ::= (A (V dropWhile_char_n_str));;\n dropWhile_char_ret_str ::= (A (V dropWhile_char_n_str))\n )\"\n\nabbreviation\n \"dropWhile_char_IMP_vars \\\n {dropWhile_char_n_str, dropWhile_char_ret_str}\"\n\ndefinition \"dropWhile_char_imp_to_HOL_state p s =\n \\dropWhile_char_n = (s (add_prefix p dropWhile_char_n_str)),\n dropWhile_char_ret = (s (add_prefix p dropWhile_char_ret_str))\\\"\n\nlemmas dropWhile_char_state_translators =\n dropWhile_char_imp_to_HOL_state_def\n dropWhile_char_loop_imp_to_HOL_state_def\n\nlemmas dropWhile_char_complete_simps =\n dropWhile_char_imp_subprogram_simps\n dropWhile_char_state_translators\n\nlemma dropWhile_char_IMP_Minus_correct_function:\n \"(invoke_subprogram p dropWhile_char_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p dropWhile_char_ret_str) =\n dropWhile_char_ret (dropWhile_char_imp (dropWhile_char_imp_to_HOL_state p s))\"\n by (fastforce elim: dropWhile_char_loop_IMP_Minus_correct simp: dropWhile_char_IMP_Minus_def\n dropWhile_char_complete_simps invoke_subprogram_append dropWhile_char_imp.simps)\n\nlemma dropWhile_char_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ dropWhile_char_pref) dropWhile_char_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix dropWhile_char_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma dropWhile_char_IMP_Minus_correct_time:\n \"(invoke_subprogram p dropWhile_char_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = dropWhile_char_imp_time 0 (dropWhile_char_imp_to_HOL_state p s)\"\n by (fastforce elim: dropWhile_char_loop_IMP_Minus_correct simp: dropWhile_char_imp_time.simps\n dropWhile_char_IMP_Minus_def invoke_subprogram_append dropWhile_char_complete_time_simps\n dropWhile_char_state_translators Let_def)\n\nlemma dropWhile_char_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) dropWhile_char_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (dropWhile_char_imp_time 0 (dropWhile_char_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) dropWhile_char_ret_str) =\n dropWhile_char_ret (dropWhile_char_imp (dropWhile_char_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using dropWhile_char_IMP_Minus_correct_function\n by (auto simp: dropWhile_char_IMP_Minus_correct_time)\n (meson dropWhile_char_IMP_Minus_correct_effects set_mono_prefix)\n\n\nsubsection \\takeWhile_char\\\n\nsubsubsection \\takeWhile_char_acc\\\n\nfun takeWhile_char_acc' :: \"nat \\ nat \\ nat\" where\n \"takeWhile_char_acc' acc n =\n (if n \\ 0 \\ hd_nat n = encode_char (CHR ''#'')\n then takeWhile_char_acc ((hd_nat n) ## acc) (tl_nat n)\n else acc\n )\"\n\nlemma takeWhile_char_acc'_correct: \n \"takeWhile_char_acc acc n = takeWhile_char_acc' acc n\"\n by (induction acc n rule: takeWhile_char_acc.induct) simp\n\nrecord takeWhile_char_acc_state =\n takeWhile_char_acc_acc::nat\n takeWhile_char_acc_n::nat\n takeWhile_char_acc_ret::nat\n\nabbreviation \"takeWhile_char_acc_prefix \\ ''takeWhile_char_acc.''\"\nabbreviation \"takeWhile_char_acc_acc_str \\ ''acc''\"\nabbreviation \"takeWhile_char_acc_n_str \\ ''n''\"\nabbreviation \"takeWhile_char_acc_ret_str \\ ''ret''\"\n\ndefinition \"takeWhile_char_acc_state_upd s \\\n (let\n hd_xs' = takeWhile_char_acc_n s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n cons_h' = hd_ret hd_ret_state;\n cons_t' = takeWhile_char_acc_acc s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h',\n cons_t = cons_t',\n cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n takeWhile_char_acc_acc' = cons_ret cons_ret_state;\n tl_xs' = takeWhile_char_acc_n s;\n tl_ret' = 0;\n tl_state = \\tl_xs = tl_xs',\n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n takeWhile_char_acc_n' = tl_ret tl_ret_state;\n ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\n takeWhile_char_acc_n = takeWhile_char_acc_n',\n takeWhile_char_acc_ret = takeWhile_char_acc_ret s\\\n in\n ret\n)\"\n\ndefinition \"takeWhile_char_acc_imp_compute_loop_condition s \\\n (let\n hd_xs' = takeWhile_char_acc_n s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n EQUAL_neq_zero_ret' = 0;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n AND_neq_zero_a' = takeWhile_char_acc_n s;\n AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n AND_neq_zero_ret' = 0;\n AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\n AND_neq_zero_b = AND_neq_zero_b',\n AND_neq_zero_ret = AND_neq_zero_ret'\\;\n AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\n condition = AND_neq_zero_ret AND_neq_zero_ret_state\n in\n condition\n)\"\n\ndefinition \"takeWhile_char_acc_imp_after_loop s \\\n (let\n takeWhile_char_acc_ret' = takeWhile_char_acc_acc s;\n ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc s,\n takeWhile_char_acc_n = takeWhile_char_acc_n s,\n takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\\n in\n ret\n)\"\n\nlemmas takeWhile_char_acc_imp_subprogram_simps = \n takeWhile_char_acc_state_upd_def\n takeWhile_char_acc_imp_compute_loop_condition_def\n takeWhile_char_acc_imp_after_loop_def\n\nfunction takeWhile_char_acc_imp :: \"takeWhile_char_acc_state \\ takeWhile_char_acc_state\" where\n \"takeWhile_char_acc_imp s =\n (if takeWhile_char_acc_imp_compute_loop_condition s \\ 0\n then let next_iteration = takeWhile_char_acc_imp (takeWhile_char_acc_state_upd s)\n in next_iteration\n else let ret = takeWhile_char_acc_imp_after_loop s\n in ret\n )\"\n by simp+\ntermination\n apply (relation \"measure takeWhile_char_acc_n\")\n apply (simp add: takeWhile_char_acc_imp_subprogram_simps tl_imp_correct\n EQUAL_neq_zero_imp_correct AND_neq_zero_imp_correct split: if_splits)+\n done\n\ndeclare takeWhile_char_acc_imp.simps [simp del]\n\nlemma takeWhile_char_acc_imp_correct[let_function_correctness]:\n \"takeWhile_char_acc_ret (takeWhile_char_acc_imp s) =\n takeWhile_char_acc (takeWhile_char_acc_acc s) (takeWhile_char_acc_n s)\"\n apply (induction s rule: takeWhile_char_acc_imp.induct)\n apply (subst takeWhile_char_acc_imp.simps)\n apply (subst takeWhile_char_acc.simps)\n apply (simp del: takeWhile_char_acc.simps add: takeWhile_char_acc_imp_subprogram_simps Let_def\n AND_neq_zero_imp_correct EQUAL_neq_zero_imp_correct hd_imp_correct tl_imp_correct\n cons_imp_correct hash_encode_char_val)\n by fastforce\n\ndefinition \"takeWhile_char_acc_state_upd_time t s \\\n (let\n hd_xs' = takeWhile_char_acc_n s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n cons_h' = hd_ret hd_ret_state;\n t = t + 2;\n cons_t' = takeWhile_char_acc_acc s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h',\n cons_t = cons_t',\n cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n takeWhile_char_acc_acc' = cons_ret cons_ret_state;\n t = t + 2;\n tl_xs' = takeWhile_char_acc_n s;\n t = t + 2;\n tl_ret' = 0;\n t = t + 2;\n tl_state = \\tl_xs = tl_xs',\n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n t = t + tl_imp_time 0 tl_state;\n takeWhile_char_acc_n' = tl_ret tl_ret_state;\n t = t + 2;\n ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\n takeWhile_char_acc_n = takeWhile_char_acc_n',\n takeWhile_char_acc_ret = takeWhile_char_acc_ret s\\\n in\n t\n)\"\n\ndefinition \"takeWhile_char_acc_imp_compute_loop_condition_time t s \\\n (let\n hd_xs' = takeWhile_char_acc_n s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n t = t + 2;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n t = t + 2;\n EQUAL_neq_zero_ret' = 0;\n t = t + 2;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n t = t + EQUAL_neq_zero_imp_time 0 EQUAL_neq_zero_state;\n AND_neq_zero_a' = takeWhile_char_acc_n s;\n t = t + 2;\n AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n t = t + 2;\n AND_neq_zero_ret' = 0;\n t = t + 2;\n AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\n AND_neq_zero_b = AND_neq_zero_b',\n AND_neq_zero_ret = AND_neq_zero_ret'\\;\n AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\n t = t + AND_neq_zero_imp_time 0 AND_neq_zero_state;\n condition = AND_neq_zero_ret AND_neq_zero_ret_state;\n t = t + 2\n in\n t\n)\"\n\ndefinition \"takeWhile_char_acc_imp_after_loop_time t s \\\n (let\n takeWhile_char_acc_ret' = takeWhile_char_acc_acc s;\n t = t + 2;\n ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc s,\n takeWhile_char_acc_n = takeWhile_char_acc_n s,\n takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\\n in\n t\n)\"\n\nlemmas takeWhile_char_acc_imp_subprogram_time_simps = \n takeWhile_char_acc_state_upd_time_def\n takeWhile_char_acc_imp_compute_loop_condition_time_def\n takeWhile_char_acc_imp_after_loop_time_def\n takeWhile_char_acc_imp_subprogram_simps\n\nfunction takeWhile_char_acc_imp_time :: \"nat \\ takeWhile_char_acc_state \\ nat\" where\n \"takeWhile_char_acc_imp_time t s =\n takeWhile_char_acc_imp_compute_loop_condition_time 0 s +\n (if takeWhile_char_acc_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration =\n takeWhile_char_acc_imp_time (t + takeWhile_char_acc_state_upd_time 0 s)\n (takeWhile_char_acc_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + takeWhile_char_acc_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n apply (relation \"measure (takeWhile_char_acc_n \\ snd)\")\n by (simp add: takeWhile_char_acc_imp_subprogram_time_simps Let_def AND_neq_zero_imp_correct\n EQUAL_neq_zero_imp_correct hd_imp_correct tl_imp_correct\n cons_imp_correct hash_encode_char_val split: if_splits)+\n\ndeclare takeWhile_char_acc_imp_time.simps [simp del] \n\nlemma takeWhile_char_acc_imp_time_acc:\n \"(takeWhile_char_acc_imp_time (Suc t) s) = Suc (takeWhile_char_acc_imp_time t s)\"\n by (induction t s rule: takeWhile_char_acc_imp_time.induct)\n ((subst (1 2) takeWhile_char_acc_imp_time.simps);\n (simp add: takeWhile_char_acc_state_upd_def)) \n\nlemma takeWhile_char_acc_imp_time_acc_2_aux:\n \"(takeWhile_char_acc_imp_time t s) = t + (takeWhile_char_acc_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: takeWhile_char_acc_imp_time_acc)+ \n\nlemma takeWhile_char_acc_imp_time_acc_2:\n \"t \\ 0 \\ (takeWhile_char_acc_imp_time t s) = t + (takeWhile_char_acc_imp_time 0 s)\"\n by (rule takeWhile_char_acc_imp_time_acc_2_aux) \n\nlemma takeWhile_char_acc_imp_time_acc_3:\n \"(takeWhile_char_acc_imp_time (a + b) s) = a + (takeWhile_char_acc_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: takeWhile_char_acc_imp_time_acc)+ \n\nabbreviation \"takeWhile_char_acc_while_cond \\ ''condition''\"\n\ndefinition \"takeWhile_char_acc_IMP_init_while_cond \\\n \\ \\ hd_xs' = takeWhile_char_acc_n s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V takeWhile_char_acc_n_str));;\n \\ \\ hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\ hd_state = \\hd_xs = hd_xs',\\\n \\ \\ hd_ret = hd_ret'\\;\\\n \\ \\ hd_ret_state = hd_imp hd_state;\\\n (invoke_subprogram hd_prefix hd_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_a' = hd_ret hd_ret_state;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_a_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\ EQUAL_neq_zero_b' = hash_encode_char_as_nat;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_b_str) ::= (A (N hash_encode_char_as_nat));;\n \\ \\ EQUAL_neq_zero_ret' = 0;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\\\n \\ \\ EQUAL_neq_zero_b = EQUAL_neq_zero_b',\\\n \\ \\ EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\\\n \\ \\ EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\\\n (invoke_subprogram EQUAL_neq_zero_prefix EQUAL_neq_zero_IMP_Minus);;\n \\ \\ AND_neq_zero_a' = takeWhile_char_acc_n s;\\\n (AND_neq_zero_prefix @ AND_neq_zero_a_str) ::= (A (V takeWhile_char_acc_n_str));;\n \\ \\ AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\\\n (AND_neq_zero_prefix @ AND_neq_zero_b_str) ::= (A (V (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str)));;\n \\ \\ AND_neq_zero_ret' = 0;\\\n (AND_neq_zero_prefix @ AND_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\\\n \\ \\ AND_neq_zero_b = AND_neq_zero_b',\\\n \\ \\ AND_neq_zero_ret = AND_neq_zero_ret'\\;\\\n \\ \\ AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\\\n (invoke_subprogram AND_neq_zero_prefix AND_neq_zero_IMP_Minus);;\n \\ \\ condition = AND_neq_zero_ret AND_neq_zero_ret_state\\\n (takeWhile_char_acc_while_cond) ::= (A (V (AND_neq_zero_prefix @ AND_neq_zero_ret_str)))\n\"\n\ndefinition \"takeWhile_char_acc_IMP_loop_body \\\n \\ \\ hd_xs' = takeWhile_char_acc_n s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V takeWhile_char_acc_n_str));;\n \\ \\ hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\ hd_state = \\hd_xs = hd_xs',\\\n \\ \\ hd_ret = hd_ret'\\;\\\n \\ \\ hd_ret_state = hd_imp hd_state;\\\n (invoke_subprogram hd_prefix hd_IMP_Minus);;\n \\ \\ cons_h' = hd_ret hd_ret_state;\\\n (cons_prefix @ cons_h_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\ cons_t' = takeWhile_char_acc_acc s;\\\n (cons_prefix @ cons_t_str) ::= (A (V takeWhile_char_acc_acc_str));;\n \\ \\ cons_ret' = 0;\\\n (cons_prefix @ cons_ret_str) ::= (A (N 0));;\n \\ \\ cons_state = \\cons_h = cons_h',\\\n \\ \\ cons_t = cons_t',\\\n \\ \\ cons_ret = cons_ret'\\;\\\n \\ \\ cons_ret_state = cons_imp cons_state;\\\n (invoke_subprogram cons_prefix cons_IMP_Minus);;\n \\ \\ takeWhile_char_acc_acc' = cons_ret cons_ret_state;\\\n (takeWhile_char_acc_acc_str) ::= (A (V (cons_prefix @ cons_ret_str)));;\n \\ \\ tl_xs' = takeWhile_char_acc_n s;\\\n (tl_prefix @ tl_xs_str) ::= (A (V takeWhile_char_acc_n_str));;\n \\ \\ tl_ret' = 0;\\\n (tl_prefix @ tl_ret_str) ::= (A (N 0));;\n \\ \\ tl_state = \\tl_xs = tl_xs',\\\n \\ \\ tl_ret = tl_ret'\\;\\\n \\ \\ tl_ret_state = tl_imp tl_state;\\\n (invoke_subprogram tl_prefix tl_IMP_Minus);;\n \\ \\ takeWhile_char_acc_n' = tl_ret tl_ret_state;\\\n (takeWhile_char_acc_n_str) ::= (A (V (tl_prefix @ tl_ret_str)))\n \\ \\ ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\\\n \\ \\ takeWhile_char_acc_n = takeWhile_char_acc_n',\\\n \\ \\ takeWhile_char_acc_ret = takeWhile_char_acc_ret s\\\\\n\"\n\ndefinition \"takeWhile_char_acc_IMP_after_loop \\\n \\ \\ takeWhile_char_acc_ret' = takeWhile_char_acc_acc s;\\\n (takeWhile_char_acc_ret_str) ::= (A (V takeWhile_char_acc_acc_str))\n \\ \\ ret = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc s,\\\n \\ \\ takeWhile_char_acc_n = takeWhile_char_acc_n s,\\\n \\ \\ takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\\\\n\"\n\ndefinition takeWhile_char_acc_IMP_Minus where\n \"takeWhile_char_acc_IMP_Minus \\\n takeWhile_char_acc_IMP_init_while_cond;;\n WHILE takeWhile_char_acc_while_cond \\0 DO (\n takeWhile_char_acc_IMP_loop_body;;\n takeWhile_char_acc_IMP_init_while_cond\n );;\n takeWhile_char_acc_IMP_after_loop\"\n\nabbreviation \"takeWhile_char_acc_IMP_vars \\\n {takeWhile_char_acc_acc_str, takeWhile_char_acc_n_str, takeWhile_char_acc_ret_str}\"\n\nlemmas takeWhile_char_acc_IMP_subprogram_simps =\n takeWhile_char_acc_IMP_init_while_cond_def\n takeWhile_char_acc_IMP_loop_body_def\n takeWhile_char_acc_IMP_after_loop_def\n\ndefinition \"takeWhile_char_acc_imp_to_HOL_state p s =\n \\takeWhile_char_acc_acc = (s (add_prefix p takeWhile_char_acc_acc_str)),\n takeWhile_char_acc_n = (s (add_prefix p takeWhile_char_acc_n_str)),\n takeWhile_char_acc_ret = (s (add_prefix p takeWhile_char_acc_ret_str))\\\"\n\nlemmas takeWhile_char_acc_state_translators =\n takeWhile_char_acc_imp_to_HOL_state_def\n EQUAL_neq_zero_imp_to_HOL_state_def\n AND_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n tl_imp_to_HOL_state_def\n\nlemmas takeWhile_char_acc_complete_simps =\n takeWhile_char_acc_IMP_subprogram_simps\n takeWhile_char_acc_imp_subprogram_simps\n takeWhile_char_acc_state_translators\n\nlemma takeWhile_char_acc_IMP_Minus_correct_function:\n \"(invoke_subprogram p takeWhile_char_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p takeWhile_char_acc_ret_str)\n = takeWhile_char_acc_ret\n (takeWhile_char_acc_imp (takeWhile_char_acc_imp_to_HOL_state p s))\"\n apply(induction \"takeWhile_char_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: takeWhile_char_acc_imp.induct)\n apply(subst takeWhile_char_acc_imp.simps)\n apply(simp only: takeWhile_char_acc_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule While_tE)\n\n subgoal\n apply(simp only: takeWhile_char_acc_IMP_subprogram_simps prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n by(fastforce simp: takeWhile_char_acc_IMP_subprogram_simps\n takeWhile_char_acc_imp_subprogram_simps\n takeWhile_char_acc_state_translators)\n\n apply(erule Seq_E)+\n apply(dest_com_gen)\n\n subgoal\n apply(simp only: takeWhile_char_acc_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n by(fastforce simp add: takeWhile_char_acc_complete_simps)\n\n subgoal\n apply(subst (asm) takeWhile_char_acc_IMP_init_while_cond_def)\n apply(simp only: takeWhile_char_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(36) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(38) by fastforce\n by (fastforce_sorted_premises2 simp: takeWhile_char_acc_imp_subprogram_simps Let_def\n takeWhile_char_acc_state_translators)\n\n subgoal\n apply(simp only: takeWhile_char_acc_IMP_init_while_cond_def prefix_simps\n takeWhile_char_acc_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(39) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(41) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(43) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(45) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(47) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(49) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(51) by fastforce\n by (fastforce_sorted_premises2 simp: takeWhile_char_acc_imp_subprogram_simps Let_def\n takeWhile_char_acc_state_translators)\n done\n\nlemma takeWhile_char_acc_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ takeWhile_char_acc_pref) takeWhile_char_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix takeWhile_char_acc_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemmas takeWhile_char_acc_complete_time_simps =\n takeWhile_char_acc_imp_subprogram_time_simps\n takeWhile_char_acc_imp_time_acc\n takeWhile_char_acc_imp_time_acc_2\n takeWhile_char_acc_imp_time_acc_3\n takeWhile_char_acc_state_translators\n\nlemma takeWhile_char_acc_IMP_Minus_correct_time:\n \"(invoke_subprogram p takeWhile_char_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = takeWhile_char_acc_imp_time 0 (takeWhile_char_acc_imp_to_HOL_state p s)\"\n apply(induction \"takeWhile_char_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: takeWhile_char_acc_imp.induct)\n apply(subst takeWhile_char_acc_imp_time.simps)\n apply(simp only: takeWhile_char_acc_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n\n subgoal\n apply(simp only: takeWhile_char_acc_IMP_subprogram_simps prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n by (force simp: takeWhile_char_acc_imp_subprogram_time_simps Let_def \n takeWhile_char_acc_state_translators)\n\n apply(erule Seq_tE)+\n apply(simp add: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(simp only: takeWhile_char_acc_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(53) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(55) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(57) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(59) by fastforce\n by(fastforce simp add: takeWhile_char_acc_complete_simps)\n\n subgoal\n apply(subst (asm) takeWhile_char_acc_IMP_init_while_cond_def)\n apply(simp only: takeWhile_char_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(53) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(55) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(57) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(59) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(61) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(63) by fastforce\n by (fastforce_sorted_premises simp: Let_def\n takeWhile_char_acc_complete_time_simps)\n\n subgoal\n apply(simp only: prefix_simps takeWhile_char_acc_IMP_init_while_cond_def\n takeWhile_char_acc_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(75) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(77) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(79) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(81) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(83) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(85) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(87) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(89) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"takeWhile_char_acc_IMP_vars\"])\n subgoal premises p using p(91) by fastforce\n apply(simp only: takeWhile_char_acc_complete_time_simps Let_def)\n by (fastforce_sorted_premises simp: Let_def\n takeWhile_char_acc_complete_time_simps)\n\n done \n\nlemma takeWhile_char_acc_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) takeWhile_char_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (takeWhile_char_acc_imp_time 0 (takeWhile_char_acc_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) takeWhile_char_acc_ret_str) =\n takeWhile_char_acc_ret (takeWhile_char_acc_imp\n (takeWhile_char_acc_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using takeWhile_char_acc_IMP_Minus_correct_function\n takeWhile_char_acc_IMP_Minus_correct_time\n takeWhile_char_acc_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\nsubsubsection \\takeWhile_char_tail\\\n\nrecord takeWhile_char_tail_state =\n takeWhile_char_tail_ys::nat\n takeWhile_char_tail_ret::nat\n\nabbreviation \"takeWhile_char_tail_prefix \\ ''takeWhile_char_tail.''\"\nabbreviation \"takeWhile_char_tail_ys_str \\ ''ys''\"\nabbreviation \"takeWhile_char_tail_ret_str \\ ''ret''\"\n\ndefinition \"takeWhile_char_tail_state_upd s =\n (let\n takeWhile_char_acc_acc' = 0;\n takeWhile_char_acc_n' = takeWhile_char_tail_ys s;\n takeWhile_char_acc_ret' = 0;\n takeWhile_char_acc_state = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\n takeWhile_char_acc_n = takeWhile_char_acc_n',\n takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\;\n takeWhile_char_acc_ret_state = takeWhile_char_acc_imp takeWhile_char_acc_state;\n reverse_nat_n' = takeWhile_char_acc_ret takeWhile_char_acc_ret_state;\n reverse_nat_ret' = 0;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n takeWhile_char_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n ret = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys s,\n takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\\n in\n ret\n )\"\n\nfunction takeWhile_char_tail_imp:: \"takeWhile_char_tail_state \\ takeWhile_char_tail_state\" where\n \"takeWhile_char_tail_imp s =\n (let\n ret = takeWhile_char_tail_state_upd s\n in\n ret\n )\"\n by simp+\ntermination\n by (relation \"measure takeWhile_char_tail_ys\") simp\n\ndeclare takeWhile_char_tail_imp.simps [simp del]\n\nlemma takeWhile_char_tail_imp_correct:\n \"takeWhile_char_tail_ret (takeWhile_char_tail_imp s) =\n takeWhile_char_tail (takeWhile_char_tail_ys s)\"\n apply (simp only: takeWhile_char_acc_imp_correct takeWhile_char_tail_def \n takeWhile_char_tail_imp.simps takeWhile_char_tail_state_upd_def \n reverse_nat_imp_correct Let_def)\n by simp\n\nfunction takeWhile_char_tail_imp_time :: \"nat \\ takeWhile_char_tail_state \\ nat\" where\n \"takeWhile_char_tail_imp_time t s =\n (let\n takeWhile_char_acc_acc' = 0;\n t = t + 2;\n takeWhile_char_acc_n' = takeWhile_char_tail_ys s;\n t = t + 2;\n takeWhile_char_acc_ret' = 0;\n t = t + 2;\n takeWhile_char_acc_state = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\n takeWhile_char_acc_n = takeWhile_char_acc_n',\n takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\;\n takeWhile_char_acc_ret_state = takeWhile_char_acc_imp takeWhile_char_acc_state;\n t = t + takeWhile_char_acc_imp_time 0 takeWhile_char_acc_state;\n reverse_nat_n' = takeWhile_char_acc_ret takeWhile_char_acc_ret_state;\n t = t + 2;\n reverse_nat_ret' = 0;\n t = t + 2;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n t = t + reverse_nat_imp_time 0 reverse_nat_state;\n takeWhile_char_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n t = t + 2;\n ret = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys s,\n takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\\n in\n t\n )\"\n by auto\ntermination\n by (relation \"measure (takeWhile_char_tail_ys \\ snd)\") simp\n\ndeclare takeWhile_char_tail_imp_time.simps [simp del]\n\nlemma takeWhile_char_tail_imp_time_acc:\n \"(takeWhile_char_tail_imp_time (Suc t) s) = Suc (takeWhile_char_tail_imp_time t s)\"\n by (induction t s rule: takeWhile_char_tail_imp_time.induct)\n ((subst (1 2) takeWhile_char_tail_imp_time.simps);\n (simp add: takeWhile_char_tail_state_upd_def Let_def)) \n\nlemma takeWhile_char_tail_imp_time_acc_2_aux:\n \"(takeWhile_char_tail_imp_time t s) = t + (takeWhile_char_tail_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: takeWhile_char_tail_imp_time_acc)+ \n\nlemma takeWhile_char_tail_imp_time_acc_2:\n \"t \\ 0 \\ (takeWhile_char_tail_imp_time t s) = t + (takeWhile_char_tail_imp_time 0 s)\"\n by (rule takeWhile_char_tail_imp_time_acc_2_aux) \n\nlemma takeWhile_char_tail_imp_time_acc_3:\n \"(takeWhile_char_tail_imp_time (a + b) s) = a + (takeWhile_char_tail_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: takeWhile_char_tail_imp_time_acc)+ \n\ndefinition takeWhile_char_tail_IMP_Minus where\n \"takeWhile_char_tail_IMP_Minus \\\n \\ \\ takeWhile_char_acc_acc' = 0;\\\n (takeWhile_char_acc_prefix @ takeWhile_char_acc_acc_str) ::= (A (N 0));;\n \\ \\ takeWhile_char_acc_n' = takeWhile_char_tail_ys s;\\\n (takeWhile_char_acc_prefix @ takeWhile_char_acc_n_str) ::= (A (V takeWhile_char_tail_ys_str));;\n \\ \\ takeWhile_char_acc_ret' = 0;\\\n (takeWhile_char_acc_prefix @ takeWhile_char_acc_ret_str) ::= (A (N 0));;\n \\ \\ takeWhile_char_acc_state = \\takeWhile_char_acc_acc = takeWhile_char_acc_acc',\\\n \\ \\ takeWhile_char_acc_n = takeWhile_char_acc_n',\\\n \\ \\ takeWhile_char_acc_ret = takeWhile_char_acc_ret'\\;\\\n \\ \\ takeWhile_char_acc_ret_state = takeWhile_char_acc_imp takeWhile_char_acc_state;\\\n (invoke_subprogram takeWhile_char_acc_prefix takeWhile_char_acc_IMP_Minus);;\n \\ \\ reverse_nat_n' = takeWhile_char_acc_ret takeWhile_char_acc_ret_state;\\\n (reverse_nat_prefix @ reverse_nat_n_str) ::= (A (V (takeWhile_char_acc_prefix @ takeWhile_char_acc_ret_str)));;\n \\ \\ reverse_nat_ret' = 0;\\\n (reverse_nat_prefix @ reverse_nat_ret_str) ::= (A (N 0));;\n \\ \\ reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\\\n \\ \\ reverse_nat_ret = reverse_nat_ret'\\;\\\n \\ \\ reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\\\n (invoke_subprogram reverse_nat_prefix reverse_nat_IMP_Minus);;\n \\ \\ takeWhile_char_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\\\n (takeWhile_char_tail_ret_str) ::= (A (V (reverse_nat_prefix @ reverse_nat_ret_str)))\n \\ \\ ret = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys s,\\\n \\ \\ takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\\\\n\"\n\nabbreviation \"takeWhile_char_tail_IMP_vars \\\n {takeWhile_char_tail_ys_str, takeWhile_char_tail_ret_str}\"\n\ndefinition \"takeWhile_char_tail_imp_to_HOL_state p s =\n \\takeWhile_char_tail_ys = (s (add_prefix p takeWhile_char_tail_ys_str)),\n takeWhile_char_tail_ret = (s (add_prefix p takeWhile_char_tail_ret_str))\\\"\n\nlemmas takeWhile_char_tail_state_translators =\n takeWhile_char_tail_imp_to_HOL_state_def\n takeWhile_char_acc_imp_to_HOL_state_def\n reverse_nat_imp_to_HOL_state_def\n\nlemma takeWhile_char_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p takeWhile_char_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p takeWhile_char_tail_ret_str)\n = takeWhile_char_tail_ret\n (takeWhile_char_tail_imp (takeWhile_char_tail_imp_to_HOL_state p s))\"\n apply(subst takeWhile_char_tail_imp.simps)\n apply(simp only: takeWhile_char_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule takeWhile_char_acc_IMP_Minus_correct[where vars = \"takeWhile_char_tail_IMP_vars\"])\n subgoal premises p using p(8) by fastforce\n apply(erule reverse_nat_IMP_Minus_correct[where vars = \"takeWhile_char_tail_IMP_vars\"])\n subgoal premises p using p(10) by fastforce\n by (fastforce simp: takeWhile_char_tail_state_translators takeWhile_char_tail_state_upd_def)\n\nlemma takeWhile_char_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ takeWhile_char_tail_pref) takeWhile_char_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix takeWhile_char_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma takeWhile_char_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p takeWhile_char_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = takeWhile_char_tail_imp_time 0 (takeWhile_char_tail_imp_to_HOL_state p s)\"\n apply(subst takeWhile_char_tail_imp_time.simps)\n apply(simp only: takeWhile_char_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule takeWhile_char_acc_IMP_Minus_correct[where vars = \"takeWhile_char_tail_IMP_vars\"])\n subgoal premises p using p(15) by fastforce\n apply(erule reverse_nat_IMP_Minus_correct[where vars = \"takeWhile_char_tail_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n by (fastforce simp add: Let_def takeWhile_char_tail_state_translators)\n\nlemma takeWhile_char_tail_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) takeWhile_char_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (takeWhile_char_tail_imp_time 0 (takeWhile_char_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) takeWhile_char_tail_ret_str) =\n takeWhile_char_tail_ret (takeWhile_char_tail_imp\n (takeWhile_char_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using takeWhile_char_tail_IMP_Minus_correct_function\n takeWhile_char_tail_IMP_Minus_correct_time\n takeWhile_char_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\nsubsection \\var_to_var_bit\\\n\nsubsubsection \\var_to_var_bit_tail_aux1\\\n\nfun var_to_var_bit_tail_aux1 :: \"nat \\ nat \\ nat\" where\n \"var_to_var_bit_tail_aux1 t l = \n (if length_nat t > 0 \\ hd_nat t = encode_char (CHR ''$'')\n then some_nat (prod_encode(tl_nat t, l))\n else 0\n )\"\n\nlemma var_to_var_bit_tail_aux1_correct: \n \"var_to_var_bit_tail_aux1 (dropWhile_char v) (length_nat (takeWhile_char_tail v) - 1) =\n (if length_nat (dropWhile_char v) > 0 \\ hd_nat (dropWhile_char v) = encode_char (CHR ''$'')\n then some_nat (prod_encode(tl_nat (dropWhile_char v), (length_nat (takeWhile_char_tail v) - 1)))\n else 0\n )\"\n using var_to_var_bit_tail_aux1.simps by blast\n\nlemma var_to_var_bit_tail_aux1_correct2:\n \"var_to_var_bit_tail_aux1 (dropWhile_char v) (length_nat (takeWhile_char_tail v) - 1) =\n (let t = dropWhile_char v;\n l = length_nat (takeWhile_char_tail v) - 1\n in (if length_nat t > 0 \\ hd_nat t = encode_char (CHR ''$'')\n then some_nat (prod_encode(tl_nat t, l))\n else 0))\"\n using var_to_var_bit_tail_aux1_correct \n by (smt (verit, best))\n\nrecord var_to_var_bit_tail_aux1_state =\n var_to_var_bit_tail_aux1_t::nat\n var_to_var_bit_tail_aux1_l::nat\n var_to_var_bit_tail_aux1_ret::nat\n\nabbreviation \"var_to_var_bit_tail_aux1_prefix \\ ''var_to_var_bit_tail_aux1.''\"\nabbreviation \"var_to_var_bit_tail_aux1_t_str \\ ''t''\"\nabbreviation \"var_to_var_bit_tail_aux1_l_str \\ ''l''\"\nabbreviation \"var_to_var_bit_tail_aux1_ret_str \\ ''ret''\"\n\ndefinition \"var_to_var_bit_tail_aux1_state_upd s \\\n (let\n length_xs' = var_to_var_bit_tail_aux1_t s;\n length_ret' = 0;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n length_result = length_ret length_ret_state;\n hd_xs' = var_to_var_bit_tail_aux1_t s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n EQUAL_neq_zero_b' = dollar_encode_char_as_nat;\n EQUAL_neq_zero_ret' = 0;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n AND_neq_zero_a' = length_result;\n AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n AND_neq_zero_ret' = 0;\n AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\n AND_neq_zero_b = AND_neq_zero_b',\n AND_neq_zero_ret = AND_neq_zero_ret'\\;\n AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\n AND_neq_zero_result = AND_neq_zero_ret AND_neq_zero_ret_state\n in\n (if AND_neq_zero_result \\ 0 then\n (let\n tl_xs' = var_to_var_bit_tail_aux1_t s;\n tl_ret' = 0;\n tl_state = \\tl_xs = tl_xs',\n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n prod_encode_a' = tl_ret tl_ret_state;\n prod_encode_b' = var_to_var_bit_tail_aux1_l s;\n prod_encode_ret' = 0;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n some_nat_n' = prod_encode_ret prod_encode_ret_state;\n some_nat_ret' = 0;\n some_nat_state = \\some_nat_n = some_nat_n',\n some_nat_ret = some_nat_ret'\\;\n some_nat_ret_state = some_nat_imp some_nat_state;\n var_to_var_bit_tail_aux1_ret' = some_nat_ret some_nat_ret_state;\n ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\n in\n ret\n )\n else\n (let\n var_to_var_bit_tail_aux1_ret' = 0;\n ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\n in\n ret\n )\n )\n)\"\n\nfunction var_to_var_bit_tail_aux1_imp ::\n \"var_to_var_bit_tail_aux1_state \\ var_to_var_bit_tail_aux1_state\" where\n \"var_to_var_bit_tail_aux1_imp s =\n (let \n ret = var_to_var_bit_tail_aux1_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_to_var_bit_tail_aux1_t\") simp\n\ndeclare var_to_var_bit_tail_aux1_imp.simps [simp del]\n\nlemma var_to_var_bit_tail_aux1_imp_correct[let_function_correctness]:\n \"var_to_var_bit_tail_aux1_ret (var_to_var_bit_tail_aux1_imp s) =\n var_to_var_bit_tail_aux1 (var_to_var_bit_tail_aux1_t s) (var_to_var_bit_tail_aux1_l s)\"\n by (simp add: var_to_var_bit_tail_aux1_imp.simps Let_def var_to_var_bit_tail_aux1_state_upd_def\n length_imp_correct2 dollar_encode_char_val hd_imp_correct EQUAL_neq_zero_imp_correct AND_neq_zero_imp_correct\n tl_imp_correct prod_encode_imp_correct some_nat_imp_correct) \n\nfunction var_to_var_bit_tail_aux1_imp_time ::\n \"nat \\ var_to_var_bit_tail_aux1_state \\ nat\" where\n \"var_to_var_bit_tail_aux1_imp_time t s =\n (let\n length_xs' = var_to_var_bit_tail_aux1_t s;\n t = t + 2;\n length_ret' = 0;\n t = t + 2;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n t = t + length_imp_time 0 length_state;\n length_result = length_ret length_ret_state;\n t = t + 2;\n hd_xs' = var_to_var_bit_tail_aux1_t s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n t = t + 2;\n EQUAL_neq_zero_b' = dollar_encode_char_as_nat;\n t = t + 2;\n EQUAL_neq_zero_ret' = 0;\n t = t + 2;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n t = t + EQUAL_neq_zero_imp_time 0 EQUAL_neq_zero_state;\n AND_neq_zero_a' = length_result;\n t = t + 2;\n AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n t = t + 2;\n AND_neq_zero_ret' = 0;\n t = t + 2;\n AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\n AND_neq_zero_b = AND_neq_zero_b',\n AND_neq_zero_ret = AND_neq_zero_ret'\\;\n AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\n t = t + AND_neq_zero_imp_time 0 AND_neq_zero_state;\n AND_neq_zero_result = AND_neq_zero_ret AND_neq_zero_ret_state;\n t = t + 2\n in\n (if AND_neq_zero_result \\ 0 then\n (let\n t = t + 1;\n tl_xs' = var_to_var_bit_tail_aux1_t s;\n t = t + 2;\n tl_ret' = 0;\n t = t + 2;\n tl_state = \\tl_xs = tl_xs',\n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n t = t + tl_imp_time 0 tl_state;\n prod_encode_a' = tl_ret tl_ret_state;\n t = t + 2;\n prod_encode_b' = var_to_var_bit_tail_aux1_l s;\n t = t + 2;\n prod_encode_ret' = 0;\n t = t + 2;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n t = t + prod_encode_imp_time 0 prod_encode_state;\n some_nat_n' = prod_encode_ret prod_encode_ret_state;\n t = t + 2;\n some_nat_ret' = 0;\n t = t + 2;\n some_nat_state = \\some_nat_n = some_nat_n',\n some_nat_ret = some_nat_ret'\\;\n some_nat_ret_state = some_nat_imp some_nat_state;\n t = t + some_nat_imp_time 0 some_nat_state;\n var_to_var_bit_tail_aux1_ret' = some_nat_ret some_nat_ret_state;\n t = t + 2;\n ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\n in\n t\n )\n else\n (let\n t = t + 1;\n var_to_var_bit_tail_aux1_ret' = 0;\n t = t + 2;\n ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\n in\n t\n )\n )\n)\"\n by auto\ntermination\n by (relation \"measure (var_to_var_bit_tail_aux1_t \\ snd)\") simp\n\ndeclare var_to_var_bit_tail_aux1_imp_time.simps [simp del]\n\nlemma var_to_var_bit_tail_aux1_imp_time_acc:\n \"(var_to_var_bit_tail_aux1_imp_time (Suc t) s) = Suc (var_to_var_bit_tail_aux1_imp_time t s)\"\n by (induction t s rule: var_to_var_bit_tail_aux1_imp_time.induct)\n ((subst (1 2) var_to_var_bit_tail_aux1_imp_time.simps);\n (simp add: var_to_var_bit_tail_aux1_state_upd_def Let_def)) \n\nlemma var_to_var_bit_tail_aux1_imp_time_acc_2_aux:\n \"(var_to_var_bit_tail_aux1_imp_time t s) = t + (var_to_var_bit_tail_aux1_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: var_to_var_bit_tail_aux1_imp_time_acc)+ \n\nlemma var_to_var_bit_tail_aux1_imp_time_acc_2:\n \"t \\ 0 \\ (var_to_var_bit_tail_aux1_imp_time t s) = t + (var_to_var_bit_tail_aux1_imp_time 0 s)\"\n by (rule var_to_var_bit_tail_aux1_imp_time_acc_2_aux) \n\nlemma var_to_var_bit_tail_aux1_imp_time_acc_3:\n \"(var_to_var_bit_tail_aux1_imp_time (a + b) s) = a + (var_to_var_bit_tail_aux1_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: var_to_var_bit_tail_aux1_imp_time_acc)+ \n\nabbreviation \"var_to_var_bit_tail_aux1_length_result \\ ''length_result''\"\nabbreviation \"var_to_var_bit_tail_aux1_AND_neq_zero_result \\ ''AND_neq_zero_result''\"\n\nabbreviation \"var_to_var_bit_tail_aux1_IMP_if \\\n \\ \\ tl_xs' = var_to_var_bit_tail_aux1_t s;\\\n (tl_prefix @ tl_xs_str) ::= (A (V var_to_var_bit_tail_aux1_t_str));;\n \\ \\ tl_ret' = 0;\\\n (tl_prefix @ tl_ret_str) ::= (A (N 0));;\n \\ \\ tl_state = \\tl_xs = tl_xs',\\\n \\ \\ tl_ret = tl_ret'\\;\\\n \\ \\ tl_ret_state = tl_imp tl_state;\\\n (invoke_subprogram tl_prefix tl_IMP_Minus);;\n \\ \\ prod_encode_a' = tl_ret tl_ret_state;\\\n (prod_encode_prefix @ prod_encode_a_str) ::= (A (V (tl_prefix @ tl_ret_str)));;\n \\ \\ prod_encode_b' = var_to_var_bit_tail_aux1_l s;\\\n (prod_encode_prefix @ prod_encode_b_str) ::= (A (V var_to_var_bit_tail_aux1_l_str));;\n \\ \\ prod_encode_ret' = 0;\\\n (prod_encode_prefix @ prod_encode_ret_str) ::= (A (N 0));;\n \\ \\ prod_encode_state = \\prod_encode_a = prod_encode_a',\\\n \\ \\ prod_encode_b = prod_encode_b',\\\n \\ \\ prod_encode_ret = prod_encode_ret'\\;\\\n \\ \\ prod_encode_ret_state = prod_encode_imp prod_encode_state;\\\n (invoke_subprogram prod_encode_prefix prod_encode_IMP_Minus);;\n \\ \\ some_nat_n' = prod_encode_ret prod_encode_ret_state;\\\n (some_nat_prefix @ some_nat_n_str) ::= (A (V (prod_encode_prefix @ prod_encode_ret_str)));;\n \\ \\ some_nat_ret' = 0;\\\n (some_nat_prefix @ some_nat_ret_str) ::= (A (N 0));;\n \\ \\ some_nat_state = \\some_nat_n = some_nat_n',\\\n \\ \\ some_nat_ret = some_nat_ret'\\;\\\n \\ \\ some_nat_ret_state = some_nat_imp some_nat_state;\\\n (invoke_subprogram some_nat_prefix some_nat_IMP_Minus);;\n \\ \\ var_to_var_bit_tail_aux1_ret' = some_nat_ret some_nat_ret_state;\\\n (var_to_var_bit_tail_aux1_ret_str) ::= (A (V (some_nat_prefix @ some_nat_ret_str)))\n \\ \\ ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\\\n \\ \\ var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\\\n \\ \\ var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\\\n\"\n\nabbreviation \"var_to_var_bit_tail_aux1_IMP_else \\\n \\ \\ var_to_var_bit_tail_aux1_ret' = 0;\\\n (var_to_var_bit_tail_aux1_ret_str) ::= (A (N 0))\n \\ \\ ret = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t s,\\\n \\ \\ var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l s,\\\n \\ \\ var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\\\\n\"\n\ndefinition var_to_var_bit_tail_aux1_IMP_Minus where\n \"var_to_var_bit_tail_aux1_IMP_Minus \\\n \\ \\ length_xs' = var_to_var_bit_tail_aux1_t s;\\\n (length_prefix @ length_xs_str) ::= (A (V var_to_var_bit_tail_aux1_t_str));;\n \\ \\ length_ret' = 0;\\\n (length_prefix @ length_ret_str) ::= (A (N 0));;\n \\ \\ length_state = \\length_xs = length_xs',\\\n \\ \\ length_ret = length_ret'\\;\\\n \\ \\ length_ret_state = length_imp length_state;\\\n (invoke_subprogram length_prefix length_IMP_Minus);;\n \\ \\ length_result = length_ret length_ret_state;\\\n (var_to_var_bit_tail_aux1_length_result) ::= (A (V (length_prefix @ length_ret_str)));;\n \\ \\ hd_xs' = var_to_var_bit_tail_aux1_t s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V var_to_var_bit_tail_aux1_t_str));;\n \\ \\ hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\ hd_state = \\hd_xs = hd_xs',\\\n \\ \\ hd_ret = hd_ret'\\;\\\n \\ \\ hd_ret_state = hd_imp hd_state;\\\n (invoke_subprogram hd_prefix hd_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_a' = hd_ret hd_ret_state;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_a_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\ EQUAL_neq_zero_b' = dollar_encode_char_as_nat;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_b_str) ::= (A (N dollar_encode_char_as_nat));;\n \\ \\ EQUAL_neq_zero_ret' = 0;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\\\n \\ \\ EQUAL_neq_zero_b = EQUAL_neq_zero_b',\\\n \\ \\ EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\\\n \\ \\ EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\\\n (invoke_subprogram EQUAL_neq_zero_prefix EQUAL_neq_zero_IMP_Minus);;\n \\ \\ AND_neq_zero_a' = length_result;\\\n (AND_neq_zero_prefix @ AND_neq_zero_a_str) ::= (A (V var_to_var_bit_tail_aux1_length_result));;\n \\ \\ AND_neq_zero_b' = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\\\n (AND_neq_zero_prefix @ AND_neq_zero_b_str) ::= (A (V (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str)));;\n \\ \\ AND_neq_zero_ret' = 0;\\\n (AND_neq_zero_prefix @ AND_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ AND_neq_zero_state = \\AND_neq_zero_a = AND_neq_zero_a',\\\n \\ \\ AND_neq_zero_b = AND_neq_zero_b',\\\n \\ \\ AND_neq_zero_ret = AND_neq_zero_ret'\\;\\\n \\ \\ AND_neq_zero_ret_state = AND_neq_zero_imp AND_neq_zero_state;\\\n (invoke_subprogram AND_neq_zero_prefix AND_neq_zero_IMP_Minus);;\n \\ \\ AND_neq_zero_result = AND_neq_zero_ret AND_neq_zero_ret_state\\\n (var_to_var_bit_tail_aux1_AND_neq_zero_result) ::= (A (V (AND_neq_zero_prefix @ AND_neq_zero_ret_str)));;\n \\ \\(if AND_neq_zero_result \\ 0 then\\\n (IF var_to_var_bit_tail_aux1_AND_neq_zero_result \\0 THEN\n var_to_var_bit_tail_aux1_IMP_if\n \\ \\else\\\n ELSE\n var_to_var_bit_tail_aux1_IMP_else\n )\n\"\n\nabbreviation \"var_to_var_bit_tail_aux1_IMP_vars \\\n {var_to_var_bit_tail_aux1_t_str, var_to_var_bit_tail_aux1_l_str, var_to_var_bit_tail_aux1_ret_str, \n var_to_var_bit_tail_aux1_length_result, var_to_var_bit_tail_aux1_AND_neq_zero_result}\"\n\ndefinition \"var_to_var_bit_tail_aux1_imp_to_HOL_state p s =\n \\var_to_var_bit_tail_aux1_t = (s (add_prefix p var_to_var_bit_tail_aux1_t_str)),\n var_to_var_bit_tail_aux1_l = (s (add_prefix p var_to_var_bit_tail_aux1_l_str)),\n var_to_var_bit_tail_aux1_ret = (s (add_prefix p var_to_var_bit_tail_aux1_ret_str))\\\"\n\nlemmas var_to_var_bit_tail_aux1_state_translators =\n var_to_var_bit_tail_aux1_imp_to_HOL_state_def\n length_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n EQUAL_neq_zero_imp_to_HOL_state_def\n AND_neq_zero_imp_to_HOL_state_def\n tl_imp_to_HOL_state_def\n prod_encode_imp_to_HOL_state_def\n some_nat_imp_to_HOL_state_def\n\nlemma var_to_var_bit_tail_aux1_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_to_var_bit_tail_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_to_var_bit_tail_aux1_ret_str)\n = var_to_var_bit_tail_aux1_ret\n (var_to_var_bit_tail_aux1_imp (var_to_var_bit_tail_aux1_imp_to_HOL_state p s))\"\n apply(subst var_to_var_bit_tail_aux1_imp.simps)\n apply(simp only: var_to_var_bit_tail_aux1_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(23) by fastforce\n apply(erule If_E)\n subgoal\n apply(erule Seq_E)+\n apply(erule tl_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(36) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(38) by fastforce\n apply(erule some_nat_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(40) by fastforce\n by (fastforce_sorted_premises2 simp: var_to_var_bit_tail_aux1_state_translators Let_def\n var_to_var_bit_tail_aux1_state_upd_def)\n subgoal\n by (fastforce_sorted_premises2 simp: var_to_var_bit_tail_aux1_state_translators Let_def\n var_to_var_bit_tail_aux1_state_upd_def)\n done\n\nlemma var_to_var_bit_tail_aux1_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_to_var_bit_tail_aux1_pref) var_to_var_bit_tail_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_to_var_bit_tail_aux1_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma var_to_var_bit_tail_aux1_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_to_var_bit_tail_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_to_var_bit_tail_aux1_imp_time 0 (var_to_var_bit_tail_aux1_imp_to_HOL_state p s)\"\n apply(subst var_to_var_bit_tail_aux1_imp_time.simps)\n apply(simp only: var_to_var_bit_tail_aux1_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(33) by fastforce\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(35) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(37) by fastforce\n apply(erule AND_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(39) by fastforce\n apply(erule If_tE)\n subgoal\n apply(erule Seq_tE)+\n apply(erule tl_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(63) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(65) by fastforce\n apply(erule some_nat_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux1_IMP_vars\"])\n subgoal premises p using p(67) by fastforce\n by (fastforce_sorted_premises2 simp: Let_def var_to_var_bit_tail_aux1_state_translators)\n subgoal\n by (fastforce_sorted_premises2 simp: Let_def var_to_var_bit_tail_aux1_state_translators)\n done \n\nlemma var_to_var_bit_tail_aux1_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_to_var_bit_tail_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_to_var_bit_tail_aux1_imp_time 0 (var_to_var_bit_tail_aux1_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_to_var_bit_tail_aux1_ret_str) =\n var_to_var_bit_tail_aux1_ret (var_to_var_bit_tail_aux1_imp\n (var_to_var_bit_tail_aux1_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_to_var_bit_tail_aux1_IMP_Minus_correct_function\n var_to_var_bit_tail_aux1_IMP_Minus_correct_time\n var_to_var_bit_tail_aux1_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\nsubsubsection \\var_to_var_bit_tail_aux2\\\n\nfun var_to_var_bit_tail_aux2 :: \"nat \\ nat\" where\n \"var_to_var_bit_tail_aux2 v = \n (if hd_nat v = encode_char (CHR ''#'')\n then var_to_var_bit_tail_aux1 (dropWhile_char v) (length_nat (takeWhile_char_tail v) - 1)\n else 0\n )\"\n\nlemma var_to_var_bit_tail_aux2_correct: \n \"var_to_var_bit_tail_aux2 v =\n (if hd_nat v = encode_char (CHR ''#'')\n then (let t = dropWhile_char v;\n l = length_nat (takeWhile_char_tail v) - 1\n in (if length_nat t > 0 \\ hd_nat t = encode_char (CHR ''$'')\n then some_nat (prod_encode(tl_nat t, l))\n else 0))\n else 0)\"\n using var_to_var_bit_tail_aux1_correct\n by (smt (verit, best) var_to_var_bit_tail_aux2.elims)\n\nrecord var_to_var_bit_tail_aux2_state =\n var_to_var_bit_tail_aux2_v::nat\n var_to_var_bit_tail_aux2_ret::nat\n\nabbreviation \"var_to_var_bit_tail_aux2_prefix \\ ''var_to_var_bit_tail_aux2.''\"\nabbreviation \"var_to_var_bit_tail_aux2_v_str \\ ''v''\"\nabbreviation \"var_to_var_bit_tail_aux2_ret_str \\ ''ret''\"\n\ndefinition \"var_to_var_bit_tail_aux2_state_upd s \\\n (let\n hd_xs' = var_to_var_bit_tail_aux2_v s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n EQUAL_neq_zero_ret' = 0;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state\n in\n (if EQUAL_neq_zero_result \\ 0 then\n (let\n dropWhile_char_n' = var_to_var_bit_tail_aux2_v s;\n dropWhile_char_ret' = 0;\n dropWhile_char_state = \\dropWhile_char_n = dropWhile_char_n',\n dropWhile_char_ret = dropWhile_char_ret'\\;\n dropWhile_char_ret_state = dropWhile_char_imp dropWhile_char_state;\n dropWhile_char_result = dropWhile_char_ret dropWhile_char_ret_state;\n takeWhile_char_tail_ys' = var_to_var_bit_tail_aux2_v s;\n takeWhile_char_tail_ret' = 0;\n takeWhile_char_tail_state = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys',\n takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\;\n takeWhile_char_tail_ret_state = takeWhile_char_tail_imp takeWhile_char_tail_state;\n length_xs' = takeWhile_char_tail_ret takeWhile_char_tail_ret_state;\n length_ret' = 0;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n var_to_var_bit_tail_aux1_t' = dropWhile_char_result;\n var_to_var_bit_tail_aux1_l' = length_ret length_ret_state - 1;\n var_to_var_bit_tail_aux1_ret' = 0;\n var_to_var_bit_tail_aux1_state = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t',\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l',\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\;\n var_to_var_bit_tail_aux1_ret_state = var_to_var_bit_tail_aux1_imp var_to_var_bit_tail_aux1_state;\n var_to_var_bit_tail_aux2_ret' = var_to_var_bit_tail_aux1_ret var_to_var_bit_tail_aux1_ret_state;\n ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\n in\n ret\n )\n else\n (let\n var_to_var_bit_tail_aux2_ret' = 0;\n ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\n in\n ret\n )\n )\n)\"\n\nfunction var_to_var_bit_tail_aux2_imp ::\n \"var_to_var_bit_tail_aux2_state \\ var_to_var_bit_tail_aux2_state\" where\n \"var_to_var_bit_tail_aux2_imp s =\n (let \n ret = var_to_var_bit_tail_aux2_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_to_var_bit_tail_aux2_v\") simp\n\ndeclare var_to_var_bit_tail_aux2_imp.simps [simp del]\n\nlemma var_to_var_bit_tail_aux2_imp_correct[let_function_correctness]:\n \"var_to_var_bit_tail_aux2_ret (var_to_var_bit_tail_aux2_imp s) =\n var_to_var_bit_tail_aux2 (var_to_var_bit_tail_aux2_v s)\"\n apply (simp only: var_to_var_bit_tail_aux2_imp.simps Let_def var_to_var_bit_tail_aux2_state_upd_def\n hd_imp_correct hash_encode_char_val EQUAL_neq_zero_imp_correct dropWhile_char_imp_correct\n takeWhile_char_tail_imp_correct length_imp_correct2 var_to_var_bit_tail_aux1_imp_correct\n var_to_var_bit_tail_aux2.simps)\n by (smt (verit, best) EQUAL_neq_zero_state.select_convs(1) EQUAL_neq_zero_state.select_convs(2)\n dropWhile_char'_correct dropWhile_char_state.select_convs(1) hd_state.select_convs(1) length_imp_correct\n length_state.select_convs(1) length_state.select_convs(2) minus_nat.diff_0\n takeWhile_char_tail_state.select_convs(1) var_to_var_bit_tail_aux1_state.select_convs(1)\n var_to_var_bit_tail_aux1_state.select_convs(2) var_to_var_bit_tail_aux2_state.select_convs(2) zero_neq_one) \n\nfunction var_to_var_bit_tail_aux2_imp_time ::\n \"nat \\ var_to_var_bit_tail_aux2_state \\ nat\" where\n \"var_to_var_bit_tail_aux2_imp_time t s =\n (let\n hd_xs' = var_to_var_bit_tail_aux2_v s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n EQUAL_neq_zero_a' = hd_ret hd_ret_state;\n t = t + 2;\n EQUAL_neq_zero_b' = hash_encode_char_as_nat;\n t = t + 2;\n EQUAL_neq_zero_ret' = 0;\n t = t + 2;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n t = t + EQUAL_neq_zero_imp_time 0 EQUAL_neq_zero_state;\n EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n t = t + 2\n in\n (if EQUAL_neq_zero_result \\ 0 then\n (let\n t = t + 1;\n dropWhile_char_n' = var_to_var_bit_tail_aux2_v s;\n t = t + 2;\n dropWhile_char_ret' = 0;\n t = t + 2;\n dropWhile_char_state = \\dropWhile_char_n = dropWhile_char_n',\n dropWhile_char_ret = dropWhile_char_ret'\\;\n dropWhile_char_ret_state = dropWhile_char_imp dropWhile_char_state;\n t = t + dropWhile_char_imp_time 0 dropWhile_char_state;\n dropWhile_char_result = dropWhile_char_ret dropWhile_char_ret_state;\n t = t + 2;\n takeWhile_char_tail_ys' = var_to_var_bit_tail_aux2_v s;\n t = t + 2;\n takeWhile_char_tail_ret' = 0;\n t = t + 2;\n takeWhile_char_tail_state = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys',\n takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\;\n takeWhile_char_tail_ret_state = takeWhile_char_tail_imp takeWhile_char_tail_state;\n t = t + takeWhile_char_tail_imp_time 0 takeWhile_char_tail_state;\n length_xs' = takeWhile_char_tail_ret takeWhile_char_tail_ret_state;\n t = t + 2;\n length_ret' = 0;\n t = t + 2;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n t = t + length_imp_time 0 length_state;\n var_to_var_bit_tail_aux1_t' = dropWhile_char_result;\n t = t + 2;\n var_to_var_bit_tail_aux1_l' = length_ret length_ret_state - 1;\n t = t + 2;\n var_to_var_bit_tail_aux1_ret' = 0;\n t = t + 2;\n var_to_var_bit_tail_aux1_state = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t',\n var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l',\n var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\;\n var_to_var_bit_tail_aux1_ret_state = var_to_var_bit_tail_aux1_imp var_to_var_bit_tail_aux1_state;\n t = t + var_to_var_bit_tail_aux1_imp_time 0 var_to_var_bit_tail_aux1_state;\n var_to_var_bit_tail_aux2_ret' = var_to_var_bit_tail_aux1_ret var_to_var_bit_tail_aux1_ret_state;\n t = t + 2;\n ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\n in\n t\n )\n else\n (let\n t = t + 1;\n var_to_var_bit_tail_aux2_ret' = 0;\n t = t + 2;\n ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\n in\n t\n )\n )\n)\"\n by auto\ntermination\n by (relation \"measure (var_to_var_bit_tail_aux2_v \\ snd)\") simp\n\ndeclare var_to_var_bit_tail_aux2_imp_time.simps [simp del]\n\nlemma var_to_var_bit_tail_aux2_imp_time_acc:\n \"(var_to_var_bit_tail_aux2_imp_time (Suc t) s) = Suc (var_to_var_bit_tail_aux2_imp_time t s)\"\n by (induction t s rule: var_to_var_bit_tail_aux2_imp_time.induct)\n ((subst (1 2) var_to_var_bit_tail_aux2_imp_time.simps);\n (simp add: var_to_var_bit_tail_aux2_state_upd_def Let_def)) \n\nlemma var_to_var_bit_tail_aux2_imp_time_acc_2_aux:\n \"(var_to_var_bit_tail_aux2_imp_time t s) = t + (var_to_var_bit_tail_aux2_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: var_to_var_bit_tail_aux2_imp_time_acc)+ \n\nlemma var_to_var_bit_tail_aux2_imp_time_acc_2:\n \"t \\ 0 \\ (var_to_var_bit_tail_aux2_imp_time t s) = t + (var_to_var_bit_tail_aux2_imp_time 0 s)\"\n by (rule var_to_var_bit_tail_aux2_imp_time_acc_2_aux) \n\nlemma var_to_var_bit_tail_aux2_imp_time_acc_3:\n \"(var_to_var_bit_tail_aux2_imp_time (a + b) s) = a + (var_to_var_bit_tail_aux2_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: var_to_var_bit_tail_aux2_imp_time_acc)+ \n\nabbreviation \"var_to_var_bit_tail_aux2_EQUAL_neq_zero_result \\ ''EQUAL_neq_zero_result''\"\nabbreviation \"var_to_var_bit_tail_aux2_dropWhile_char_result \\ ''dropWhile_char_result''\"\n\nabbreviation \"var_to_var_bit_tail_aux2_IMP_if \\\n \\ \\ dropWhile_char_n' = var_to_var_bit_tail_aux2_v s;\\\n (dropWhile_char_prefix @ dropWhile_char_n_str) ::= (A (V var_to_var_bit_tail_aux2_v_str));;\n \\ \\ dropWhile_char_ret' = 0;\\\n (dropWhile_char_prefix @ dropWhile_char_ret_str) ::= (A (N 0));;\n \\ \\ dropWhile_char_state = \\dropWhile_char_n = dropWhile_char_n',\\\n \\ \\ dropWhile_char_ret = dropWhile_char_ret'\\;\\\n \\ \\ dropWhile_char_ret_state = dropWhile_char_imp dropWhile_char_state;\\\n (invoke_subprogram dropWhile_char_prefix dropWhile_char_IMP_Minus);;\n \\ \\ dropWhile_char_result = dropWhile_char_ret dropWhile_char_ret_state;\\\n (var_to_var_bit_tail_aux2_dropWhile_char_result) ::=\n (A (V (dropWhile_char_prefix @ dropWhile_char_ret_str)));;\n \\ \\ takeWhile_char_tail_ys' = var_to_var_bit_tail_aux2_v s;\\\n (takeWhile_char_tail_prefix @ takeWhile_char_tail_ys_str) ::= (A (V var_to_var_bit_tail_aux2_v_str));;\n \\ \\ takeWhile_char_tail_ret' = 0;\\\n (takeWhile_char_tail_prefix @ takeWhile_char_tail_ret_str) ::= (A (N 0));;\n \\ \\ takeWhile_char_tail_state = \\takeWhile_char_tail_ys = takeWhile_char_tail_ys',\\\n \\ \\ takeWhile_char_tail_ret = takeWhile_char_tail_ret'\\;\\\n \\ \\ takeWhile_char_tail_ret_state = takeWhile_char_tail_imp takeWhile_char_tail_state;\\\n (invoke_subprogram takeWhile_char_tail_prefix takeWhile_char_tail_IMP_Minus);;\n \\ \\ length_xs' = takeWhile_char_tail_ret takeWhile_char_tail_ret_state;\\\n (length_prefix @ length_xs_str) ::= (A (V (takeWhile_char_tail_prefix @ takeWhile_char_tail_ret_str)));;\n \\ \\ length_ret' = 0;\\\n (length_prefix @ length_ret_str) ::= (A (N 0));;\n \\ \\ length_state = \\length_xs = length_xs',\\\n \\ \\ length_ret = length_ret'\\;\\\n \\ \\ length_ret_state = length_imp length_state;\\\n (invoke_subprogram length_prefix length_IMP_Minus);;\n \\ \\ var_to_var_bit_tail_aux1_t' = dropWhile_char_result;\\\n (var_to_var_bit_tail_aux1_prefix @ var_to_var_bit_tail_aux1_t_str) ::=\n (A (V var_to_var_bit_tail_aux2_dropWhile_char_result));; \n \\ \\ var_to_var_bit_tail_aux1_l' = length_ret length_ret_state - 1;\\\n (var_to_var_bit_tail_aux1_prefix @ var_to_var_bit_tail_aux1_l_str) ::=\n (Sub (V (length_prefix @ length_ret_str)) (N 1));;\n \\ \\ var_to_var_bit_tail_aux1_ret' = 0;\\\n (var_to_var_bit_tail_aux1_prefix @ var_to_var_bit_tail_aux1_ret_str) ::= (A (N 0));;\n \\ \\ var_to_var_bit_tail_aux1_state = \\var_to_var_bit_tail_aux1_t = var_to_var_bit_tail_aux1_t',\\\n \\ \\ var_to_var_bit_tail_aux1_l = var_to_var_bit_tail_aux1_l',\\\n \\ \\ var_to_var_bit_tail_aux1_ret = var_to_var_bit_tail_aux1_ret'\\;\\\n \\ \\ var_to_var_bit_tail_aux1_ret_state = var_to_var_bit_tail_aux1_imp var_to_var_bit_tail_aux1_state;\\\n (invoke_subprogram var_to_var_bit_tail_aux1_prefix var_to_var_bit_tail_aux1_IMP_Minus);;\n \\ \\ var_to_var_bit_tail_aux2_ret' = var_to_var_bit_tail_aux1_ret var_to_var_bit_tail_aux1_ret_state;\\\n (var_to_var_bit_tail_aux2_ret_str) ::=\n (A (V (var_to_var_bit_tail_aux1_prefix @ var_to_var_bit_tail_aux1_ret_str)))\n \\ \\ ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\\\n \\ \\ var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\\\n\"\n\nabbreviation \"var_to_var_bit_tail_aux2_IMP_else \\\n \\ \\ var_to_var_bit_tail_aux2_ret' = 0;\\\n (var_to_var_bit_tail_aux2_ret_str) ::= (A (N 0))\n \\ \\ ret = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v s,\\\n \\ \\ var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\\\\n\"\n\ndefinition var_to_var_bit_tail_aux2_IMP_Minus where\n \"var_to_var_bit_tail_aux2_IMP_Minus \\\n \\ \\ hd_xs' = var_to_var_bit_tail_aux2_v s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V var_to_var_bit_tail_aux2_v_str));;\n \\ \\ hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\ hd_state = \\hd_xs = hd_xs',\\\n \\ \\ hd_ret = hd_ret'\\;\\\n \\ \\ hd_ret_state = hd_imp hd_state;\\\n (invoke_subprogram hd_prefix hd_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_a' = hd_ret hd_ret_state;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_a_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\ EQUAL_neq_zero_b' = hash_encode_char_as_nat;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_b_str) ::= (A (N hash_encode_char_as_nat));;\n \\ \\ EQUAL_neq_zero_ret' = 0;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\\\n \\ \\ EQUAL_neq_zero_b = EQUAL_neq_zero_b',\\\n \\ \\ EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\\\n \\ \\ EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\\\n (invoke_subprogram EQUAL_neq_zero_prefix EQUAL_neq_zero_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state\\\n (var_to_var_bit_tail_aux2_EQUAL_neq_zero_result) ::=\n (A (V (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str)));;\n \\ \\(if EQUAL_neq_zero_result \\ 0 then\\\n (IF var_to_var_bit_tail_aux2_EQUAL_neq_zero_result \\0 THEN\n var_to_var_bit_tail_aux2_IMP_if\n \\ \\else\\\n ELSE\n var_to_var_bit_tail_aux2_IMP_else\n )\n\"\n\nabbreviation \"var_to_var_bit_tail_aux2_IMP_vars \\\n {var_to_var_bit_tail_aux2_v_str, var_to_var_bit_tail_aux2_ret_str,\n var_to_var_bit_tail_aux2_EQUAL_neq_zero_result, var_to_var_bit_tail_aux2_dropWhile_char_result}\"\n\ndefinition \"var_to_var_bit_tail_aux2_imp_to_HOL_state p s =\n \\var_to_var_bit_tail_aux2_v = (s (add_prefix p var_to_var_bit_tail_aux2_v_str)),\n var_to_var_bit_tail_aux2_ret = (s (add_prefix p var_to_var_bit_tail_aux2_ret_str))\\\"\n\nlemmas var_to_var_bit_tail_aux2_state_translators =\n var_to_var_bit_tail_aux2_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n EQUAL_neq_zero_imp_to_HOL_state_def\n dropWhile_char_imp_to_HOL_state_def\n takeWhile_char_tail_imp_to_HOL_state_def\n length_imp_to_HOL_state_def\n var_to_var_bit_tail_aux1_imp_to_HOL_state_def\n\nlemma var_to_var_bit_tail_aux2_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_to_var_bit_tail_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_to_var_bit_tail_aux2_ret_str)\n = var_to_var_bit_tail_aux2_ret\n (var_to_var_bit_tail_aux2_imp (var_to_var_bit_tail_aux2_imp_to_HOL_state p s))\"\n apply(subst var_to_var_bit_tail_aux2_imp.simps)\n apply(simp only: var_to_var_bit_tail_aux2_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(9) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(11) by fastforce\n apply(erule If_E)\n subgoal\n apply(erule Seq_E)+\n apply(erule dropWhile_char_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n apply(erule takeWhile_char_tail_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule var_to_var_bit_tail_aux1_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n by (fastforce_sorted_premises2 simp: var_to_var_bit_tail_aux2_state_translators Let_def\n var_to_var_bit_tail_aux2_state_upd_def) \n subgoal\n by (fastforce_sorted_premises2 simp: var_to_var_bit_tail_aux2_state_translators Let_def\n var_to_var_bit_tail_aux2_state_upd_def)\n done\n\nlemma var_to_var_bit_tail_aux2_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_to_var_bit_tail_aux2_pref) var_to_var_bit_tail_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_to_var_bit_tail_aux2_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemma var_to_var_bit_tail_aux2_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_to_var_bit_tail_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_to_var_bit_tail_aux2_imp_time 0 (var_to_var_bit_tail_aux2_imp_to_HOL_state p s)\"\n apply(subst var_to_var_bit_tail_aux2_imp_time.simps)\n apply(simp only: var_to_var_bit_tail_aux2_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n apply(erule If_tE)\n subgoal\n apply(erule Seq_tE)+\n apply(erule dropWhile_char_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(51) by fastforce\n apply(erule takeWhile_char_tail_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(53) by fastforce\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(55) by fastforce\n apply(erule var_to_var_bit_tail_aux1_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_aux2_IMP_vars\"])\n subgoal premises p using p(57) by fastforce\n by (fastforce_sorted_premises2 simp: Let_def var_to_var_bit_tail_aux2_state_translators) \n subgoal\n by (fastforce_sorted_premises2 simp: Let_def var_to_var_bit_tail_aux2_state_translators)\n done\n\nlemma var_to_var_bit_tail_aux2_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_to_var_bit_tail_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_to_var_bit_tail_aux2_imp_time 0 (var_to_var_bit_tail_aux2_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_to_var_bit_tail_aux2_ret_str) =\n var_to_var_bit_tail_aux2_ret (var_to_var_bit_tail_aux2_imp\n (var_to_var_bit_tail_aux2_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_to_var_bit_tail_aux2_IMP_Minus_correct_function\n var_to_var_bit_tail_aux2_IMP_Minus_correct_time\n var_to_var_bit_tail_aux2_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\nsubsubsection \\var_to_var_bit_tail\\\n\nfun var_to_var_bit_tail' :: \"nat \\ nat\" where\n \"var_to_var_bit_tail' v =\n (if length_nat v > 0\n then var_to_var_bit_tail_aux2 v\n else 0\n )\"\n\nlemma var_to_var_bit_tail'_correct: \n \"var_to_var_bit_tail v = var_to_var_bit_tail' v\"\n using var_to_var_bit_tail_aux2_correct var_to_var_bit_tail_def by simp\n\nrecord var_to_var_bit_tail_state =\n var_to_var_bit_tail_v::nat\n var_to_var_bit_tail_ret::nat\n\nabbreviation \"var_to_var_bit_tail_prefix \\ ''var_to_var_bit_tail.''\"\nabbreviation \"var_to_var_bit_tail_v_str \\ ''v''\"\nabbreviation \"var_to_var_bit_tail_ret_str \\ ''ret''\"\n\ndefinition \"var_to_var_bit_tail_state_upd s \\\n (let\n length_xs' = var_to_var_bit_tail_v s;\n length_ret' = 0;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n length_result = length_ret length_ret_state\n in\n (if length_result \\ 0 then\n (let\n var_to_var_bit_tail_aux2_v' = var_to_var_bit_tail_v s;\n var_to_var_bit_tail_aux2_ret' = 0;\n var_to_var_bit_tail_aux2_state = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v',\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\;\n var_to_var_bit_tail_aux2_ret_state = var_to_var_bit_tail_aux2_imp var_to_var_bit_tail_aux2_state;\n var_to_var_bit_tail_ret' = var_to_var_bit_tail_aux2_ret var_to_var_bit_tail_aux2_ret_state;\n ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\n var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\n in\n ret\n )\n else\n (let\n var_to_var_bit_tail_ret' = 0;\n ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\n var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\n in\n ret\n )\n )\n)\"\n\nfunction var_to_var_bit_tail_imp ::\n \"var_to_var_bit_tail_state \\ var_to_var_bit_tail_state\" where\n \"var_to_var_bit_tail_imp s =\n (let \n ret = var_to_var_bit_tail_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_to_var_bit_tail_v\") simp\n\ndeclare var_to_var_bit_tail_imp.simps [simp del]\n\nlemma var_to_var_bit_tail_imp_correct_aux:\n \"var_to_var_bit_tail_ret (var_to_var_bit_tail_imp s) =\n var_to_var_bit_tail' (var_to_var_bit_tail_v s)\"\n apply (simp only: var_to_var_bit_tail_imp.simps Let_def var_to_var_bit_tail_state_upd_def\n length_imp_correct2 var_to_var_bit_tail_aux2_imp_correct var_to_var_bit_tail'.simps)\n by (simp add: length_imp_correct2) \n\nlemma var_to_var_bit_tail_imp_correct[let_function_correctness]:\n \"var_to_var_bit_tail_ret (var_to_var_bit_tail_imp s) =\n var_to_var_bit_tail (var_to_var_bit_tail_v s)\"\n using var_to_var_bit_tail_imp_correct_aux var_to_var_bit_tail'_correct\n by simp\n\nfunction var_to_var_bit_tail_imp_time ::\n \"nat \\ var_to_var_bit_tail_state \\ nat\" where\n \"var_to_var_bit_tail_imp_time t s =\n (let\n length_xs' = var_to_var_bit_tail_v s;\n t = t + 2;\n length_ret' = 0;\n t = t + 2;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n t = t + length_imp_time 0 length_state;\n length_result = length_ret length_ret_state;\n t = t + 2\n in\n (if length_result \\ 0 then\n (let\n t = t + 1;\n var_to_var_bit_tail_aux2_v' = var_to_var_bit_tail_v s;\n t = t + 2;\n var_to_var_bit_tail_aux2_ret' = 0;\n t = t + 2;\n var_to_var_bit_tail_aux2_state = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v',\n var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\;\n var_to_var_bit_tail_aux2_ret_state = var_to_var_bit_tail_aux2_imp var_to_var_bit_tail_aux2_state;\n t = t + var_to_var_bit_tail_aux2_imp_time 0 var_to_var_bit_tail_aux2_state;\n var_to_var_bit_tail_ret' = var_to_var_bit_tail_aux2_ret var_to_var_bit_tail_aux2_ret_state;\n t = t + 2;\n ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\n var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\n in\n t\n )\n else\n (let\n t = t + 1;\n var_to_var_bit_tail_ret' = 0;\n t = t + 2;\n ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\n var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\n in\n t\n )\n )\n)\"\n by auto\ntermination\n by (relation \"measure (var_to_var_bit_tail_v \\ snd)\") simp\n\ndeclare var_to_var_bit_tail_imp_time.simps [simp del]\n\nlemma var_to_var_bit_tail_imp_time_acc:\n \"(var_to_var_bit_tail_imp_time (Suc t) s) = Suc (var_to_var_bit_tail_imp_time t s)\"\n by (induction t s rule: var_to_var_bit_tail_imp_time.induct)\n ((subst (1 2) var_to_var_bit_tail_imp_time.simps);\n (simp add: var_to_var_bit_tail_state_upd_def Let_def)) \n\nlemma var_to_var_bit_tail_imp_time_acc_2_aux:\n \"(var_to_var_bit_tail_imp_time t s) = t + (var_to_var_bit_tail_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: var_to_var_bit_tail_imp_time_acc)+ \n\nlemma var_to_var_bit_tail_imp_time_acc_2:\n \"t \\ 0 \\ (var_to_var_bit_tail_imp_time t s) = t + (var_to_var_bit_tail_imp_time 0 s)\"\n by (rule var_to_var_bit_tail_imp_time_acc_2_aux) \n\nlemma var_to_var_bit_tail_imp_time_acc_3:\n \"(var_to_var_bit_tail_imp_time (a + b) s) = a + (var_to_var_bit_tail_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: var_to_var_bit_tail_imp_time_acc)+ \n\nabbreviation \"var_to_var_bit_tail_length_result \\ ''length_result''\"\n\nabbreviation \"var_to_var_bit_tail_IMP_if \\\n \\ \\ var_to_var_bit_tail_aux2_v' = var_to_var_bit_tail_v s;\\\n (var_to_var_bit_tail_aux2_prefix @ var_to_var_bit_tail_aux2_v_str) ::=\n (A (V var_to_var_bit_tail_v_str));;\n \\ \\ var_to_var_bit_tail_aux2_ret' = 0;\\\n (var_to_var_bit_tail_aux2_prefix @ var_to_var_bit_tail_aux2_ret_str) ::= (A (N 0));;\n \\ \\ var_to_var_bit_tail_aux2_state = \\var_to_var_bit_tail_aux2_v = var_to_var_bit_tail_aux2_v',\\\n \\ \\ var_to_var_bit_tail_aux2_ret = var_to_var_bit_tail_aux2_ret'\\;\\\n \\ \\ var_to_var_bit_tail_aux2_ret_state = var_to_var_bit_tail_aux2_imp var_to_var_bit_tail_aux2_state;\\\n (invoke_subprogram var_to_var_bit_tail_aux2_prefix var_to_var_bit_tail_aux2_IMP_Minus);;\n \\ \\ var_to_var_bit_tail_ret' = var_to_var_bit_tail_aux2_ret var_to_var_bit_tail_aux2_ret_state;\\\n (var_to_var_bit_tail_ret_str) ::=\n (A (V (var_to_var_bit_tail_aux2_prefix @ var_to_var_bit_tail_aux2_ret_str)))\n \\ \\ ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\\\n \\ \\ var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\\\n\"\n\nabbreviation \"var_to_var_bit_tail_IMP_else \\\n \\ \\ var_to_var_bit_tail_ret' = 0;\\\n (var_to_var_bit_tail_ret_str) ::= (A (N 0))\n \\ \\ ret = \\var_to_var_bit_tail_v = var_to_var_bit_tail_v s,\\\n \\ \\ var_to_var_bit_tail_ret = var_to_var_bit_tail_ret'\\\\\n\"\n\ndefinition var_to_var_bit_tail_IMP_Minus where\n \"var_to_var_bit_tail_IMP_Minus \\\n \\ \\ length_xs' = var_to_var_bit_tail_v s;\\\n (length_prefix @ length_xs_str) ::= (A (V var_to_var_bit_tail_v_str));;\n \\ \\ length_ret' = 0;\\\n (length_prefix @ length_ret_str) ::= (A (N 0));;\n \\ \\ length_state = \\length_xs = length_xs',\\\n \\ \\ length_ret = length_ret'\\;\\\n \\ \\ length_ret_state = length_imp length_state;\\\n (invoke_subprogram length_prefix length_IMP_Minus);;\n \\ \\ length_result = length_ret length_ret_state\\\n (var_to_var_bit_tail_length_result) ::= (A (V (length_prefix @ length_ret_str)));;\n \\ \\(if length_result \\ 0 then\\\n (IF var_to_var_bit_tail_length_result \\0 THEN\n var_to_var_bit_tail_IMP_if\n \\ \\else\\\n ELSE\n var_to_var_bit_tail_IMP_else\n )\n\"\n\nabbreviation \"var_to_var_bit_tail_IMP_vars \\\n {var_to_var_bit_tail_v_str, var_to_var_bit_tail_ret_str, var_to_var_bit_tail_length_result}\"\n\ndefinition \"var_to_var_bit_tail_imp_to_HOL_state p s =\n \\var_to_var_bit_tail_v = (s (add_prefix p var_to_var_bit_tail_v_str)),\n var_to_var_bit_tail_ret = (s (add_prefix p var_to_var_bit_tail_ret_str))\\\"\n\nlemmas var_to_var_bit_tail_state_translators =\n var_to_var_bit_tail_imp_to_HOL_state_def\n length_imp_to_HOL_state_def\n var_to_var_bit_tail_aux2_imp_to_HOL_state_def\n\nlemma var_to_var_bit_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_to_var_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_to_var_bit_tail_ret_str)\n = var_to_var_bit_tail_ret\n (var_to_var_bit_tail_imp (var_to_var_bit_tail_imp_to_HOL_state p s))\"\n apply(subst var_to_var_bit_tail_imp.simps)\n apply(simp only: var_to_var_bit_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_IMP_vars\"])\n subgoal premises p using p(5) by fastforce\n apply(erule If_E)\n subgoal\n apply(erule Seq_E)+\n apply(erule var_to_var_bit_tail_aux2_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_IMP_vars\"])\n subgoal premises p using p(11) by fastforce\n by(fastforce simp: var_to_var_bit_tail_state_translators\n var_to_var_bit_tail_state_upd_def) \n subgoal\n by(fastforce simp: var_to_var_bit_tail_state_translators\n var_to_var_bit_tail_state_upd_def) \n done\n\nlemma var_to_var_bit_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_to_var_bit_tail_pref) var_to_var_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_to_var_bit_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma var_to_var_bit_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_to_var_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_to_var_bit_tail_imp_time 0 (var_to_var_bit_tail_imp_to_HOL_state p s)\"\n apply(subst var_to_var_bit_tail_imp_time.simps)\n apply(simp only: var_to_var_bit_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_IMP_vars\"])\n subgoal premises p using p(9) by fastforce\n apply(erule If_tE)\n subgoal\n apply(erule Seq_tE)+\n apply(erule var_to_var_bit_tail_aux2_IMP_Minus_correct[where vars = \"var_to_var_bit_tail_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n by(fastforce simp add: Let_def var_to_var_bit_tail_state_translators)\n subgoal\n by(fastforce simp add: Let_def var_to_var_bit_tail_state_translators)\n done\n\nlemma var_to_var_bit_tail_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_to_var_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_to_var_bit_tail_imp_time 0 (var_to_var_bit_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_to_var_bit_tail_ret_str) =\n var_to_var_bit_tail_ret (var_to_var_bit_tail_imp\n (var_to_var_bit_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_to_var_bit_tail_IMP_Minus_correct_function\n var_to_var_bit_tail_IMP_Minus_correct_time\n var_to_var_bit_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\nsubsection \\n_hashes\\\n\nsubsubsection \\n_hashes_acc\\\n\nrecord n_hashes_acc_state =\n n_hashes_acc_acc::nat\n n_hashes_acc_n::nat\n n_hashes_acc_ret::nat\n\nabbreviation \"n_hashes_acc_prefix \\ ''n_hashes_acc.''\"\nabbreviation \"n_hashes_acc_acc_str \\ ''acc''\"\nabbreviation \"n_hashes_acc_n_str \\ ''n''\"\nabbreviation \"n_hashes_acc_ret_str \\ ''ret''\"\n\ndefinition \"n_hashes_acc_state_upd s \\\n let\n cons_h' = hash_encode_char_as_nat;\n cons_t' = n_hashes_acc_acc s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n n_hashes_acc_acc' = cons_ret cons_ret_state;\n n_hashes_acc_n' = n_hashes_acc_n s - 1;\n ret = \\n_hashes_acc_acc = n_hashes_acc_acc',\n n_hashes_acc_n = n_hashes_acc_n',\n n_hashes_acc_ret = n_hashes_acc_ret s\\\n in\n ret\n\"\n\ndefinition \"n_hashes_acc_imp_compute_loop_condition s \\\n (let\n condition = n_hashes_acc_n s\n in condition\n )\"\n\ndefinition \"n_hashes_acc_imp_after_loop s \\\n (let\n ret = \\n_hashes_acc_acc = n_hashes_acc_acc s,\n n_hashes_acc_n = n_hashes_acc_n s,\n n_hashes_acc_ret = n_hashes_acc_acc s\\\n in ret\n )\"\n\nlemmas n_hashes_acc_imp_subprogram_simps =\n n_hashes_acc_imp_after_loop_def\n n_hashes_acc_state_upd_def\n n_hashes_acc_imp_compute_loop_condition_def\n\nfunction n_hashes_acc_imp:: \"n_hashes_acc_state \\ n_hashes_acc_state\" where\n \"n_hashes_acc_imp s =\n (if n_hashes_acc_imp_compute_loop_condition s \\ 0\n then\n (let next_iteration = n_hashes_acc_imp (n_hashes_acc_state_upd s)\n in next_iteration)\n else\n (let ret = n_hashes_acc_imp_after_loop s in ret)\n )\"\n by simp+\ntermination by (relation \"measure (\\s. n_hashes_acc_n s)\")\n (simp add: n_hashes_acc_imp_subprogram_simps)+\n\ndeclare n_hashes_acc_imp.simps [simp del]\n\nlemma n_hashes_acc_imp_correct[let_function_correctness]:\n \"n_hashes_acc_ret (n_hashes_acc_imp s) = n_hashes_acc (n_hashes_acc_acc s) (n_hashes_acc_n s)\"\n apply(induction s rule: n_hashes_acc_imp.induct)\n apply(subst n_hashes_acc_imp.simps)\n apply(simp add: n_hashes_acc_imp_subprogram_simps cons_imp_correct)\n by (metis Suc_pred hash_encode_char_val n_hashes_acc.simps(2))\n\ndefinition \"n_hashes_acc_state_upd_time t s \\\n let\n cons_h' = hash_encode_char_as_nat;\n t = t + 2;\n cons_t' = n_hashes_acc_acc s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n n_hashes_acc_acc' = cons_ret cons_ret_state;\n t = t + 2;\n n_hashes_acc_n' = n_hashes_acc_n s - 1;\n t = t + 2;\n ret = t\n in\n ret\n\"\n\ndefinition \"n_hashes_acc_imp_compute_loop_condition_time t s \\\n (let\n condition = n_hashes_acc_n s;\n t = t + 2;\n ret = t\n in ret\n )\"\n\ndefinition \"n_hashes_acc_imp_after_loop_time t s \\\n (let\n t = t + 2;\n ret = t\n in ret\n )\"\n\nfunction n_hashes_acc_imp_time:: \"nat \\ n_hashes_acc_state \\ nat\" where\n \"n_hashes_acc_imp_time t s =\n n_hashes_acc_imp_compute_loop_condition_time 0 s +\n (if n_hashes_acc_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration\n = n_hashes_acc_imp_time (t + n_hashes_acc_state_upd_time 0 s) (n_hashes_acc_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + n_hashes_acc_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n by (relation \"measure (\\(t,s). n_hashes_acc_n s)\")\n (simp add: n_hashes_acc_imp_subprogram_simps)+\n\nlemmas n_hashes_acc_imp_subprogram_time_simps =\n n_hashes_acc_imp_subprogram_simps\n n_hashes_acc_imp_after_loop_time_def\n n_hashes_acc_state_upd_time_def\n n_hashes_acc_imp_compute_loop_condition_time_def\n\nlemmas [simp del] = n_hashes_acc_imp_time.simps\n\nlemma n_hashes_acc_imp_time_acc:\n \"(n_hashes_acc_imp_time (Suc t) s) = Suc (n_hashes_acc_imp_time t s)\"\n by (induction t s rule: n_hashes_acc_imp_time.induct)\n ((subst (1 2) n_hashes_acc_imp_time.simps); (simp add: n_hashes_acc_state_upd_def))\n\nlemma n_hashes_acc_imp_time_acc_2_aux:\n \"(n_hashes_acc_imp_time t s) = t + (n_hashes_acc_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: n_hashes_acc_imp_time_acc)+\n\nlemma n_hashes_acc_imp_time_acc_2:\n \"t \\ 0 \\ (n_hashes_acc_imp_time t s) = t + (n_hashes_acc_imp_time 0 s)\"\n by (rule n_hashes_acc_imp_time_acc_2_aux)\n\nlemma n_hashes_acc_imp_time_acc_3:\n \"(n_hashes_acc_imp_time (a + b) s) = a + (n_hashes_acc_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: n_hashes_acc_imp_time_acc)+\n\nabbreviation \"n_hashes_acc_while_cond \\ ''condition''\"\n\ndefinition \"n_hashes_acc_IMP_init_while_cond \\\n \\ \\condition = n_hashes_n s\\\n n_hashes_acc_while_cond ::= (A (V n_hashes_acc_n_str))\"\n\ndefinition \"n_hashes_acc_IMP_loop_body \\\n \\ \\cons_h' = hash_encode_char_as_nat;\\\n ((cons_prefix @ cons_h_str) ::= (A (N hash_encode_char_as_nat)));;\n \\ \\cons_t' = n_hashes_acc_acc s;\\\n ((cons_prefix @ cons_t_str) ::= (A (V n_hashes_acc_acc_str)));;\n \\ \\cons_ret' = 0;\\\n ((cons_prefix @ cons_ret_str) ::= (A (N 0)));;\n \\ \\cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\\\n \\ \\cons_ret_state = cons_imp cons_state;\\\n (invoke_subprogram cons_prefix cons_IMP_Minus);;\n \\ \\n_hashes_acc_acc' = cons_ret cons_ret_state;\\\n ((n_hashes_acc_acc_str) ::= (A (V (cons_prefix @ cons_ret_str))));;\n \\ \\n_hashes_acc_n' = n_hashes_acc_n s - 1\\\n ((n_hashes_acc_n_str) ::= (Sub (V n_hashes_acc_n_str) (N 1)))\"\n\ndefinition \"n_hashes_acc_IMP_after_loop \\\n \\ \\ret = \\n_hashes_acc_acc = n_hashes_acc_acc s,\n n_hashes_acc_n = n_hashes_acc_n s,\n n_hashes_acc_ret = n_hashes_acc_acc s\\\\\n ((n_hashes_acc_ret_str) ::= (A (V n_hashes_acc_acc_str)))\"\n\ndefinition n_hashes_acc_IMP_Minus where\n \"n_hashes_acc_IMP_Minus \\\n n_hashes_acc_IMP_init_while_cond;;\n WHILE n_hashes_acc_while_cond \\0 DO (\n n_hashes_acc_IMP_loop_body;;\n n_hashes_acc_IMP_init_while_cond\n );;\n n_hashes_acc_IMP_after_loop\"\n\nabbreviation\n \"n_hashes_acc_IMP_vars \\\n {n_hashes_acc_acc_str, n_hashes_acc_n_str, n_hashes_acc_ret_str}\"\n\nlemmas n_hashes_acc_IMP_subprogram_simps =\n n_hashes_acc_IMP_init_while_cond_def\n n_hashes_acc_IMP_loop_body_def\n n_hashes_acc_IMP_after_loop_def\n\ndefinition \"n_hashes_acc_imp_to_HOL_state p s =\n \\n_hashes_acc_acc = (s (add_prefix p n_hashes_acc_acc_str)),\n n_hashes_acc_n = (s (add_prefix p n_hashes_acc_n_str)),\n n_hashes_acc_ret = (s (add_prefix p n_hashes_acc_ret_str))\\\"\n\nlemmas n_hashes_acc_state_translators =\n cons_imp_to_HOL_state_def\n n_hashes_acc_imp_to_HOL_state_def\n\nlemmas n_hashes_acc_complete_simps =\n n_hashes_acc_IMP_subprogram_simps\n n_hashes_acc_imp_subprogram_simps\n n_hashes_acc_state_translators\n\nlemma n_hashes_acc_IMP_Minus_correct_function:\n \"(invoke_subprogram p n_hashes_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p n_hashes_acc_ret_str)\n = n_hashes_acc_ret (n_hashes_acc_imp (n_hashes_acc_imp_to_HOL_state p s))\"\n apply(induction \"n_hashes_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: n_hashes_acc_imp.induct)\n apply(subst n_hashes_acc_imp.simps)\n apply(simp only: n_hashes_acc_IMP_Minus_def prefix_simps)\n apply (subst n_hashes_acc_imp_subprogram_simps)\n apply(vcg n_hashes_acc_IMP_vars)\n apply (subst n_hashes_acc_imp_to_HOL_state_def)+\n subgoal\n by (fastforce simp: n_hashes_acc_complete_simps Let_def)\n subgoal\n by (fastforce simp: n_hashes_acc_complete_simps Let_def)\n subgoal\n apply(subst n_hashes_acc_imp_subprogram_simps)\n apply(simp only: prefix_simps n_hashes_acc_IMP_loop_body_def)\n apply(vcg n_hashes_acc_IMP_vars)\n by (fastforce_sorted_premises simp: n_hashes_acc_complete_simps Let_def)\n subgoal\n apply(simp only: prefix_simps n_hashes_acc_IMP_loop_body_def)\n apply(vcg n_hashes_acc_IMP_vars)\n by (fastforce_sorted_premises simp: n_hashes_acc_complete_simps Let_def)\n done\n\nlemma n_hashes_acc_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ n_hashes_acc_pref) n_hashes_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix n_hashes_acc_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma n_hashes_acc_IMP_Minus_correct_time_loop_condition:\n \"(invoke_subprogram p n_hashes_acc_IMP_init_while_cond, s) \\\\<^bsup>t\\<^esup> s' \\\n t = n_hashes_acc_imp_compute_loop_condition_time 0 (n_hashes_acc_imp_to_HOL_state p s)\"\n by (subst n_hashes_acc_imp_compute_loop_condition_time_def)\n (auto simp: n_hashes_acc_IMP_init_while_cond_def)\n\nlemmas n_hashes_acc_complete_time_simps =\n n_hashes_acc_imp_subprogram_time_simps\n n_hashes_acc_imp_time_acc_2\n n_hashes_acc_imp_time_acc_3\n n_hashes_acc_state_translators\n\nlemma n_hashes_acc_IMP_Minus_correct_time:\n \"(invoke_subprogram p n_hashes_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = n_hashes_acc_imp_time 0 (n_hashes_acc_imp_to_HOL_state p s)\"\n apply(induction \"n_hashes_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: n_hashes_acc_imp.induct)\n apply(subst n_hashes_acc_imp_time.simps)\n apply(simp only: n_hashes_acc_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n subgoal\n by (fastforce simp: n_hashes_acc_IMP_subprogram_simps n_hashes_acc_imp_subprogram_time_simps\n n_hashes_acc_state_translators)\n\n apply(erule Seq_tE)+\n apply(clarsimp simp: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(simp only: n_hashes_acc_IMP_init_while_cond_def\n n_hashes_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule cons_IMP_Minus_correct[where vars = \"n_hashes_acc_IMP_vars\"], fastforce)\n by (fastforce_sorted_premises simp: n_hashes_acc_complete_time_simps)\n\n subgoal\n apply(subst (asm) n_hashes_acc_IMP_init_while_cond_def)\n apply(simp only: prefix_simps n_hashes_acc_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule cons_IMP_Minus_correct[where vars = \"n_hashes_acc_IMP_vars\"], fastforce)\n by (fastforce_sorted_premises simp: n_hashes_acc_complete_time_simps)\n\n subgoal\n apply(simp only: n_hashes_acc_IMP_init_while_cond_def prefix_simps\n n_hashes_acc_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule cons_IMP_Minus_correct[where vars = \"n_hashes_acc_IMP_vars\"], fastforce)\n by (fastforce_sorted_premises simp: n_hashes_acc_complete_time_simps)\n done\n\nlemma n_hashes_acc_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) n_hashes_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (n_hashes_acc_imp_time 0 (n_hashes_acc_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) n_hashes_acc_ret_str) =\n n_hashes_acc_ret (n_hashes_acc_imp (n_hashes_acc_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using n_hashes_acc_IMP_Minus_correct_function\n by (auto simp: n_hashes_acc_IMP_Minus_correct_time)\n (meson n_hashes_acc_IMP_Minus_correct_effects set_mono_prefix)\n\n\nsubsubsection \\n_hashes_tail\\\n\nrecord n_hashes_tail_state =\n n_hashes_tail_n::nat\n n_hashes_tail_ret::nat\n\nabbreviation \"n_hashes_tail_prefix \\ ''n_hashes_tail.''\"\nabbreviation \"n_hashes_tail_n_str \\ ''n''\"\nabbreviation \"n_hashes_tail_ret_str \\ ''ret''\"\n\ndefinition \"n_hashes_tail_state_upd s =\n (let\n n_hashes_acc_acc' = 0;\n n_hashes_acc_n' = n_hashes_tail_n s;\n n_hashes_acc_ret' = 0;\n n_hashes_acc_state = \\n_hashes_acc_acc = n_hashes_acc_acc',\n n_hashes_acc_n = n_hashes_acc_n',\n n_hashes_acc_ret = n_hashes_acc_ret'\\;\n n_hashes_acc_ret_state = n_hashes_acc_imp n_hashes_acc_state;\n reverse_nat_n' = n_hashes_acc_ret n_hashes_acc_ret_state;\n reverse_nat_ret' = 0;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n n_hashes_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n n_hashes_tail_n' = n_hashes_tail_n s;\n ret = \\n_hashes_tail_n = n_hashes_tail_n',\n n_hashes_tail_ret = n_hashes_tail_ret'\\\n in\n ret\n )\"\n\nfunction n_hashes_tail_imp:: \"n_hashes_tail_state \\ n_hashes_tail_state\" where\n \"n_hashes_tail_imp s =\n (let\n ret = n_hashes_tail_state_upd s\n in\n ret\n )\"\n by simp+\ntermination\n by (relation \"measure (\\s. n_hashes_tail_n s)\") simp\n\ndeclare n_hashes_tail_imp.simps [simp del]\n\nlemma n_hashes_tail_imp_correct[let_function_correctness]:\n \"n_hashes_tail_ret (n_hashes_tail_imp s) = n_hashes_tail (n_hashes_tail_n s)\"\n by (simp add: n_hashes_acc_imp_correct n_hashes_tail_def n_hashes_tail_imp.simps\n n_hashes_tail_state_upd_def reverse_nat_imp_correct)\n\nfunction n_hashes_tail_imp_time:: \"nat \\ n_hashes_tail_state \\ nat\" where\n \"n_hashes_tail_imp_time t s =\n (let\n n_hashes_acc_acc' = 0;\n t = t + 2;\n n_hashes_acc_n' = n_hashes_tail_n s;\n t = t + 2;\n n_hashes_acc_ret' = 0;\n t = t + 2;\n n_hashes_acc_state = \\n_hashes_acc_acc = n_hashes_acc_acc',\n n_hashes_acc_n = n_hashes_acc_n',\n n_hashes_acc_ret = n_hashes_acc_ret'\\;\n n_hashes_acc_ret_state = n_hashes_acc_imp n_hashes_acc_state;\n t = t + n_hashes_acc_imp_time 0 n_hashes_acc_state;\n reverse_nat_n' = n_hashes_acc_ret n_hashes_acc_ret_state;\n t = t + 2;\n reverse_nat_ret' = 0;\n t = t + 2;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n t = t + reverse_nat_imp_time 0 reverse_nat_state;\n n_hashes_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n t = t + 2;\n ret = t\n in\n ret\n )\"\n by auto\ntermination\n by (relation \"measure (\\(t, s). n_hashes_tail_n s)\") simp\n\nlemmas [simp del] = n_hashes_tail_imp_time.simps\n\nlemma n_hashes_tail_imp_time_acc:\n \"(n_hashes_tail_imp_time (Suc t) s) = Suc (n_hashes_tail_imp_time t s)\"\n by (simp add: n_hashes_tail_imp_time.simps Let_def)\n\nlemma n_hashes_tail_imp_time_acc_2:\n \"(n_hashes_tail_imp_time x s) = x + (n_hashes_tail_imp_time 0 s)\"\n by (simp add: n_hashes_tail_imp_time.simps Let_def)\n\ndefinition n_hashes_tail_IMP_Minus where\n \"n_hashes_tail_IMP_Minus \\\n \\ \\n_hashes_acc_acc' = 0;\\\n (n_hashes_acc_prefix @ n_hashes_acc_acc_str) ::= (A (N 0));;\n \\ \\n_hashes_acc_n' = n_hashes_tail_n s;\\\n (n_hashes_acc_prefix @ n_hashes_acc_n_str) ::= (A (V n_hashes_tail_n_str));;\n \\ \\n_hashes_acc_ret' = 0;\\\n (n_hashes_acc_prefix @ n_hashes_acc_ret_str) ::= (A (N 0));;\n \\ \\n_hashes_acc_state = \\n_hashes_acc_acc = n_hashes_acc_acc',\\\n \\ \\ n_hashes_acc_n = n_hashes_acc_n',\\\n \\ \\ n_hashes_acc_ret = n_hashes_acc_ret'\\;\\\n \\ \\n_hashes_acc_ret_state = n_hashes_acc_imp n_hashes_acc_state;\\\n invoke_subprogram n_hashes_acc_prefix n_hashes_acc_IMP_Minus;;\n \\ \\reverse_nat_n' = n_hashes_acc_ret n_hashes_acc_ret_state;\\\n (reverse_nat_prefix @ reverse_nat_n_str)\n ::= (A (V (n_hashes_acc_prefix @ n_hashes_acc_ret_str)));;\n \\ \\reverse_nat_ret' = 0;\\\n (reverse_nat_prefix @ reverse_nat_ret_str) ::= (A (N 0));;\n \\ \\reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\\\n \\ \\ reverse_nat_ret = reverse_nat_ret'\\;\\\n \\ \\reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\\\n invoke_subprogram reverse_nat_prefix reverse_nat_IMP_Minus;;\n \\ \\n_hashes_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\\\n n_hashes_tail_ret_str ::= (A (V (reverse_nat_prefix @ reverse_nat_ret_str)))\n\"\n\nabbreviation\n \"n_hashes_tail_IMP_vars \\\n {n_hashes_tail_n_str, n_hashes_tail_ret_str}\"\n\ndefinition \"n_hashes_tail_imp_to_HOL_state p s =\n \\n_hashes_tail_n = (s (add_prefix p n_hashes_tail_n_str)),\n n_hashes_tail_ret = (s (add_prefix p n_hashes_tail_ret_str))\\\"\n\nlemmas n_hashes_tail_state_translators =\n n_hashes_acc_imp_to_HOL_state_def\n reverse_nat_imp_to_HOL_state_def\n n_hashes_tail_imp_to_HOL_state_def\n\nlemma n_hashes_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p n_hashes_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p n_hashes_tail_ret_str)\n = n_hashes_tail_ret (n_hashes_tail_imp (n_hashes_tail_imp_to_HOL_state p s))\"\n by (fastforce elim: reverse_nat_IMP_Minus_correct n_hashes_acc_IMP_Minus_correct\n simp: n_hashes_tail_state_translators n_hashes_tail_state_upd_def\n n_hashes_tail_IMP_Minus_def invoke_subprogram_append n_hashes_tail_imp.simps)\n\nlemma n_hashes_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ n_hashes_tail_pref) n_hashes_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix n_hashes_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma n_hashes_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p n_hashes_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = n_hashes_tail_imp_time 0 (n_hashes_tail_imp_to_HOL_state p s)\"\n by (fastforce elim: n_hashes_acc_IMP_Minus_correct reverse_nat_IMP_Minus_correct\n simp: n_hashes_tail_imp_time.simps n_hashes_tail_imp_time_acc n_hashes_tail_imp_time_acc_2\n n_hashes_tail_state_translators Let_def n_hashes_tail_IMP_Minus_def invoke_subprogram_append)\n\nlemma n_hashes_tail_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) n_hashes_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (n_hashes_tail_imp_time 0 (n_hashes_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) n_hashes_tail_ret_str) =\n n_hashes_tail_ret (n_hashes_tail_imp (n_hashes_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using n_hashes_tail_IMP_Minus_correct_time n_hashes_tail_IMP_Minus_correct_function\n n_hashes_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\nsubsection \\var_bit_to_var_nat\\\n\nrecord var_bit_to_var_nat_state =\n var_bit_to_var_nat_n::nat\n var_bit_to_var_nat_ret::nat\n\nabbreviation \"var_bit_to_var_nat_prefix \\ ''var_bit_to_var_nat.''\"\nabbreviation \"var_bit_to_var_nat_n_str \\ ''n''\"\nabbreviation \"var_bit_to_var_nat_ret_str \\ ''ret''\"\n\ndefinition \"var_bit_to_var_nat_state_upd s =\n (let\n snd'_state_p' = var_bit_to_var_nat_n s;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n n_hashes_tail_n' = snd'_state_p snd'_ret_state + 1;\n n_hashes_tail_ret' = 0;\n n_hashes_tail_state = \\n_hashes_tail_n = n_hashes_tail_n',\n n_hashes_tail_ret = n_hashes_tail_ret'\\;\n n_hashes_tail_ret_state = n_hashes_tail_imp n_hashes_tail_state;\n append_nat_xs' = n_hashes_tail_ret n_hashes_tail_ret_state;\n append_nat_ys' = dollar_vname_encode_as_nat;\n append_nat_ret' = 0;\n append_nat_state = \\append_nat_xs = append_nat_xs',\n append_nat_ys = append_nat_ys',\n append_nat_ret = append_nat_ret'\\;\n append_nat_ret_state = append_nat_imp append_nat_state;\n fst'_state_p' = var_bit_to_var_nat_n s;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n append_nat_xs' = append_nat_ret append_nat_ret_state;\n append_nat_ys' = fst'_state_p fst'_ret_state;\n append_nat_ret' = 0;\n append_nat_state = \\append_nat_xs = append_nat_xs',\n append_nat_ys = append_nat_ys',\n append_nat_ret = append_nat_ret'\\;\n append_nat_ret_state = append_nat_imp append_nat_state;\n var_bit_to_var_nat_n' = var_bit_to_var_nat_n s;\n var_bit_to_var_nat_ret' = append_nat_ret append_nat_ret_state;\n ret = \\var_bit_to_var_nat_n = var_bit_to_var_nat_n',\n var_bit_to_var_nat_ret = var_bit_to_var_nat_ret'\\\n in\n ret\n )\"\n\nfunction var_bit_to_var_nat_imp:: \"var_bit_to_var_nat_state \\ var_bit_to_var_nat_state\" where\n \"var_bit_to_var_nat_imp s =\n (let\n ret = var_bit_to_var_nat_state_upd s\n in\n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_bit_to_var_nat_n\") simp\n\ndeclare var_bit_to_var_nat_imp.simps [simp del]\n\nlemma var_bit_to_var_nat_imp_correct[let_function_correctness]:\n \"var_bit_to_var_nat_ret (var_bit_to_var_nat_imp s) = var_bit_to_var_nat (var_bit_to_var_nat_n s)\"\n by (simp add: n_hashes_tail_imp_correct var_bit_to_var_nat_def var_bit_to_var_nat_imp.simps\n fst_nat_fst'_nat snd_nat_snd'_nat var_bit_to_var_nat_state_upd_def subtail_n_hashes\n snd'_imp_correct fst'_imp_correct append_nat_imp_correct dollar_vname_encode_val)\n\nfunction var_bit_to_var_nat_imp_time:: \"nat \\ var_bit_to_var_nat_state \\ nat\" where\n \"var_bit_to_var_nat_imp_time t s =\n (let\n snd'_state_p' = var_bit_to_var_nat_n s;\n t = t + 2;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n t = t + snd'_imp_time 0 snd'_state;\n n_hashes_tail_n' = snd'_state_p snd'_ret_state + 1;\n t = t + 2;\n n_hashes_tail_ret' = 0;\n t = t + 2;\n n_hashes_tail_state = \\n_hashes_tail_n = n_hashes_tail_n',\n n_hashes_tail_ret = n_hashes_tail_ret'\\;\n n_hashes_tail_ret_state = n_hashes_tail_imp n_hashes_tail_state;\n t = t + n_hashes_tail_imp_time 0 n_hashes_tail_state;\n append_nat_xs' = n_hashes_tail_ret n_hashes_tail_ret_state;\n t = t + 2;\n append_nat_ys' = dollar_vname_encode_as_nat;\n t = t + 2;\n append_nat_ret' = 0;\n t = t + 2;\n append_nat_state = \\append_nat_xs = append_nat_xs',\n append_nat_ys = append_nat_ys',\n append_nat_ret = append_nat_ret'\\;\n append_nat_ret_state = append_nat_imp append_nat_state;\n t = t + append_nat_imp_time 0 append_nat_state;\n fst'_state_p' = var_bit_to_var_nat_n s;\n t = t + 2;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n t = t + fst'_imp_time 0 fst'_state;\n append_nat_xs' = append_nat_ret append_nat_ret_state;\n t = t + 2;\n append_nat_ys' = fst'_state_p fst'_ret_state;\n t = t + 2;\n append_nat_ret' = 0;\n t = t + 2;\n append_nat_state = \\append_nat_xs = append_nat_xs',\n append_nat_ys = append_nat_ys',\n append_nat_ret = append_nat_ret'\\;\n append_nat_ret_state = append_nat_imp append_nat_state;\n t = t + append_nat_imp_time 0 append_nat_state;\n var_bit_to_var_nat_n' = var_bit_to_var_nat_n s;\n t = t + 2;\n var_bit_to_var_nat_ret' = append_nat_ret append_nat_ret_state;\n t = t + 2;\n ret = t\n in\n ret\n )\"\n by auto\ntermination\n by (relation \"measure (var_bit_to_var_nat_n \\ snd)\") simp\n\nlemmas [simp del] = var_bit_to_var_nat_imp_time.simps\n\nlemma var_bit_to_var_nat_imp_time_acc:\n \"(var_bit_to_var_nat_imp_time (Suc t) s) = Suc (var_bit_to_var_nat_imp_time t s)\"\n by (simp add: var_bit_to_var_nat_imp_time.simps Let_def)\n\nlemma var_bit_to_var_nat_imp_time_acc_2:\n \"(var_bit_to_var_nat_imp_time x s) = x + (var_bit_to_var_nat_imp_time 0 s)\"\n by (simp add: var_bit_to_var_nat_imp_time.simps Let_def)\n\ndefinition var_bit_to_var_nat_IMP_Minus where\n \"var_bit_to_var_nat_IMP_Minus \\\n \\ \\snd'_state_p' = var_bit_to_var_nat_n s;\\\n (snd'_prefix @ snd'_p_str) ::= (A (V var_bit_to_var_nat_n_str));;\n \\ \\snd'_state = \\snd'_state_p = snd'_state_p'\\;\\\n \\ \\snd'_ret_state = snd'_imp snd'_state;\\\n invoke_subprogram snd'_prefix snd'_IMP_Minus;;\n \\ \\n_hashes_tail_n' = snd'_state_p snd'_ret_state + 1;\\\n (n_hashes_tail_prefix @ n_hashes_tail_n_str) ::= (Plus (V (snd'_prefix @ snd'_p_str)) (N 1));;\n \\ \\n_hashes_tail_ret' = 0;\\\n (n_hashes_tail_prefix @ n_hashes_tail_ret_str) ::= (A (N 0));;\n \\ \\n_hashes_tail_state = \\n_hashes_tail_n = n_hashes_tail_n',\\\n \\ \\ n_hashes_tail_ret = n_hashes_tail_ret'\\;\\\n \\ \\n_hashes_tail_ret_state = n_hashes_tail_imp n_hashes_tail_state;\\\n invoke_subprogram n_hashes_tail_prefix n_hashes_tail_IMP_Minus;;\n \\ \\append_nat_xs' = n_hashes_tail_ret n_hashes_tail_ret_state;\\\n (append_nat_prefix @ append_nat_xs_str)\n ::= (A (V (n_hashes_tail_prefix @ n_hashes_tail_ret_str)));;\n \\ \\append_nat_ys' = dollar_vname_encode_as_nat;\\\n (append_nat_prefix @ append_nat_ys_str) ::= (A (N dollar_vname_encode_as_nat));;\n \\ \\append_nat_ret' = 0;\\\n (append_nat_prefix @ append_nat_ret_str) ::= (A (N 0));;\n \\ \\append_nat_state = \\append_nat_xs = append_nat_xs',\\\n \\ \\ append_nat_ys = append_nat_ys',\\\n \\ \\ append_nat_ret = append_nat_ret'\\;\\\n \\ \\append_nat_ret_state = append_nat_imp append_nat_state;\\\n invoke_subprogram append_nat_prefix append_nat_IMP_Minus;;\n \\ \\fst'_state_p' = var_bit_to_var_nat_n s;\\\n (fst'_prefix @ fst'_p_str) ::= (A (V var_bit_to_var_nat_n_str));;\n \\ \\fst'_state = \\fst'_state_p = fst'_state_p'\\;\\\n \\ \\fst'_ret_state = fst'_imp fst'_state;\\\n invoke_subprogram fst'_prefix fst'_IMP_Minus;;\n \\ \\append_nat_xs' = append_nat_ret append_nat_ret_state;\\\n (append_nat_prefix @ append_nat_xs_str) ::= (A (V (append_nat_prefix @ append_nat_ret_str)));;\n \\ \\append_nat_ys' = fst'_state_p fst'_ret_state;\\\n (append_nat_prefix @ append_nat_ys_str) ::= (A (V (fst'_prefix @ fst'_p_str)));;\n \\ \\append_nat_ret' = 0;\\\n (append_nat_prefix @ append_nat_ret_str) ::= (A (N 0));;\n \\ \\append_nat_state = \\append_nat_xs = append_nat_xs',\\\n \\ \\ append_nat_ys = append_nat_ys',\\\n \\ \\ append_nat_ret = append_nat_ret'\\;\\\n \\ \\append_nat_ret_state = append_nat_imp append_nat_state;\\\n invoke_subprogram append_nat_prefix append_nat_IMP_Minus;;\n \\ \\var_bit_to_var_nat_n' = var_bit_to_var_nat_n s;\\\n var_bit_to_var_nat_n_str ::= (A (V var_bit_to_var_nat_n_str));;\n \\ \\var_bit_to_var_nat_ret' = append_nat_ret append_nat_ret_state;\\\n var_bit_to_var_nat_ret_str ::= (A (V (append_nat_prefix @ append_nat_ret_str)))\n\"\n\nabbreviation\n \"var_bit_to_var_nat_IMP_vars \\\n {var_bit_to_var_nat_n_str, var_bit_to_var_nat_ret_str}\"\n\ndefinition \"var_bit_to_var_nat_imp_to_HOL_state p s =\n \\var_bit_to_var_nat_n = (s (add_prefix p var_bit_to_var_nat_n_str)),\n var_bit_to_var_nat_ret = (s (add_prefix p var_bit_to_var_nat_ret_str))\\\"\n\nlemmas var_bit_to_var_nat_state_translators =\n fst'_imp_to_HOL_state_def\n snd'_imp_to_HOL_state_def\n n_hashes_tail_imp_to_HOL_state_def\n append_nat_imp_to_HOL_state_def\n var_bit_to_var_nat_imp_to_HOL_state_def\n\nlemma var_bit_to_var_nat_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_bit_to_var_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_bit_to_var_nat_ret_str)\n = var_bit_to_var_nat_ret (var_bit_to_var_nat_imp (var_bit_to_var_nat_imp_to_HOL_state p s))\"\n apply (subst var_bit_to_var_nat_imp.simps)\n apply (simp only: var_bit_to_var_nat_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n\n apply (erule snd'_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply (erule n_hashes_tail_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n apply (erule append_nat_IMP_Minus_correct[where vars = \"var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n apply (erule fst'_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(23) by fastforce\n apply (erule append_nat_IMP_Minus_correct[where vars = \"var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(25) by fastforce\n\n by (fastforce simp: var_bit_to_var_nat_state_translators var_bit_to_var_nat_state_upd_def)\n\nlemma var_bit_to_var_nat_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_bit_to_var_nat_pref) var_bit_to_var_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_bit_to_var_nat_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma var_bit_to_var_nat_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_bit_to_var_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_bit_to_var_nat_imp_time 0 (var_bit_to_var_nat_imp_to_HOL_state p s)\"\n apply (subst var_bit_to_var_nat_imp_time.simps)\n apply (simp only: var_bit_to_var_nat_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n\n apply (erule snd'_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(33) by fastforce\n apply (erule n_hashes_tail_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(35) by fastforce\n apply (erule append_nat_IMP_Minus_correct[where vars = \"var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(37) by fastforce\n apply (erule fst'_IMP_Minus_correct[where\n vars = \"insert (append_nat_prefix @ append_nat_ret_str) var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(39) by fastforce\n apply (erule append_nat_IMP_Minus_correct[where vars = \"var_bit_to_var_nat_IMP_vars\"])\n subgoal premises p using p(41) by fastforce\n\n by (fastforce simp add: Let_def var_bit_to_var_nat_state_translators)\n\nlemma var_bit_to_var_nat_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_bit_to_var_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_bit_to_var_nat_imp_time 0 (var_bit_to_var_nat_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_bit_to_var_nat_ret_str) =\n var_bit_to_var_nat_ret\n (var_bit_to_var_nat_imp (var_bit_to_var_nat_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_bit_to_var_nat_IMP_Minus_correct_time var_bit_to_var_nat_IMP_Minus_correct_function\n var_bit_to_var_nat_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\nsubsection \\operand_bit_to_var\\\n\nsubsubsection \\operand_bit_to_var_acc\\\n\nfun operand_bit_to_var_acc':: \"nat \\ nat \\ nat\" where\n \"operand_bit_to_var_acc' acc p =\n (if snd_nat p \\ 0\n then (operand_bit_to_var_acc' ((fst_nat p) ## acc) (prod_encode (fst_nat p, snd_nat p - 1)))\n else acc\n )\"\n\nlemma operand_bit_to_var_acc'_correct:\n \"operand_bit_to_var_acc' acc n = operand_bit_to_var_acc acc n\"\n by (induction acc n rule : operand_bit_to_var_acc.induct) simp\n\nrecord operand_bit_to_var_acc_state =\n operand_bit_to_var_acc_acc::nat\n operand_bit_to_var_acc_n::nat\n operand_bit_to_var_acc_ret::nat\n\nabbreviation \"operand_bit_to_var_acc_prefix \\ ''operand_bit_to_var_acc.''\"\nabbreviation \"operand_bit_to_var_acc_acc_str \\ ''acc''\"\nabbreviation \"operand_bit_to_var_acc_n_str \\ ''n''\"\nabbreviation \"operand_bit_to_var_acc_ret_str \\ ''ret''\"\n\ndefinition \"operand_bit_to_var_acc_state_upd s \\\n let\n fst'_state_p' = operand_bit_to_var_acc_n s;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n snd'_state_p' = operand_bit_to_var_acc_n s;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n snd'_result = snd'_state_p snd'_ret_state;\n prod_encode_a' = fst'_result;\n prod_encode_b' = snd'_result - 1;\n prod_encode_ret' = 0;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n prod_result = prod_encode_ret prod_encode_ret_state;\n cons_h' = fst'_result;\n cons_t' = operand_bit_to_var_acc_acc s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n cons_result = cons_ret cons_ret_state;\n operand_bit_to_var_acc_acc' = cons_result;\n operand_bit_to_var_acc_n' = prod_result;\n operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_ret s;\n ret = \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\n operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\n operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\\n in\n ret\n\"\n\ndefinition \"operand_bit_to_var_acc_imp_compute_loop_condition s \\\n let\n snd'_state_p' = operand_bit_to_var_acc_n s;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n condition = snd'_state_p snd'_ret_state\n in condition\n\"\n\ndefinition \"operand_bit_to_var_acc_imp_after_loop s \\\n let\n operand_bit_to_var_acc_acc' = operand_bit_to_var_acc_acc s;\n operand_bit_to_var_acc_n' = operand_bit_to_var_acc_n s;\n operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_acc s;\n ret = \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\n operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\n operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\\n in ret\n\"\n\nlemmas operand_bit_to_var_acc_imp_subprogram_simps =\n operand_bit_to_var_acc_imp_after_loop_def\n operand_bit_to_var_acc_state_upd_def\n operand_bit_to_var_acc_imp_compute_loop_condition_def\n\nfunction operand_bit_to_var_acc_imp::\n \"operand_bit_to_var_acc_state \\ operand_bit_to_var_acc_state\" where\n \"operand_bit_to_var_acc_imp s =\n (if operand_bit_to_var_acc_imp_compute_loop_condition s \\ 0\n then\n (let next_iteration = operand_bit_to_var_acc_imp (operand_bit_to_var_acc_state_upd s)\n in next_iteration)\n else\n (let ret = operand_bit_to_var_acc_imp_after_loop s in ret)\n )\"\n by simp+\ntermination\n apply (relation \"measure operand_bit_to_var_acc_n\")\n apply (simp add: operand_bit_to_var_acc_imp_subprogram_simps Let_def snd'_imp_correct\n fst'_imp_correct prod_encode_imp_correct fst'_nat_def snd'_nat_def prod_encode_def\n nat_less_le triangle_tsqrt_le triangle_nat_le_eq_le le_diff_conv)+\n by (metis add_cancel_right_left add_diff_cancel_left' diff_diff_cancel diff_is_0_eq less_Suc0\n nat_le_linear not_gr_zero triangle_tsqrt_le tsqrt_alt_inverse_triangle)\n\ndeclare operand_bit_to_var_acc_imp.simps [simp del]\n\nlemma operand_bit_to_var_acc_imp_correct[let_function_correctness]:\n \"operand_bit_to_var_acc_ret (operand_bit_to_var_acc_imp s) =\n operand_bit_to_var_acc' (operand_bit_to_var_acc_acc s) (operand_bit_to_var_acc_n s)\"\n apply (induction s rule: operand_bit_to_var_acc_imp.induct)\n apply (subst operand_bit_to_var_acc_imp.simps)\n apply (subst operand_bit_to_var_acc'.simps)\n by (simp del: operand_bit_to_var_acc'.simps add: operand_bit_to_var_acc_imp_subprogram_simps\n snd'_imp_correct fst'_imp_correct prod_encode_imp_correct cons_imp_correct fst_nat_fst'_nat\n snd_nat_snd'_nat Let_def)\n\ndefinition \"operand_bit_to_var_acc_state_upd_time t s \\\n let\n fst'_state_p' = operand_bit_to_var_acc_n s;\n t = t + 2;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n t = t + fst'_imp_time 0 fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n t = t + 2;\n snd'_state_p' = operand_bit_to_var_acc_n s;\n t = t + 2;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n t = t + snd'_imp_time 0 snd'_state;\n snd'_result = snd'_state_p snd'_ret_state;\n t = t + 2;\n prod_encode_a' = fst'_result;\n t = t + 2;\n prod_encode_b' = snd'_result - 1;\n t = t + 2;\n prod_encode_ret' = 0;\n t = t + 2;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n t = t + prod_encode_imp_time 0 prod_encode_state;\n prod_result = prod_encode_ret prod_encode_ret_state;\n t = t + 2;\n cons_h' = fst'_result;\n t = t + 2;\n cons_t' = operand_bit_to_var_acc_acc s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n cons_result = cons_ret cons_ret_state;\n t = t + 2;\n operand_bit_to_var_acc_acc' = cons_result;\n t = t + 2;\n operand_bit_to_var_acc_n' = prod_result;\n t = t + 2;\n operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_ret s;\n t = t + 2;\n ret = t\n in\n ret\n\"\n\ndefinition \"operand_bit_to_var_acc_imp_compute_loop_condition_time t s \\\n (let\n snd'_state_p' = operand_bit_to_var_acc_n s;\n t = t + 2;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n t = t + snd'_imp_time 0 snd'_state;\n condition = snd'_state_p snd'_ret_state;\n t = t + 2;\n ret = t\n in ret\n )\"\n\ndefinition \"operand_bit_to_var_acc_imp_after_loop_time t s \\\n (let\n operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_acc s;\n t = t + 2;\n ret = t\n in ret\n )\"\n\nlemmas operand_bit_to_var_acc_imp_subprogram_time_simps =\n operand_bit_to_var_acc_imp_subprogram_simps\n operand_bit_to_var_acc_imp_after_loop_time_def\n operand_bit_to_var_acc_state_upd_time_def\n operand_bit_to_var_acc_imp_compute_loop_condition_time_def\n\nfunction operand_bit_to_var_acc_imp_time:: \"nat \\ operand_bit_to_var_acc_state \\ nat\" where\n \"operand_bit_to_var_acc_imp_time t s =\n operand_bit_to_var_acc_imp_compute_loop_condition_time 0 s +\n (if operand_bit_to_var_acc_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration\n = operand_bit_to_var_acc_imp_time (t + operand_bit_to_var_acc_state_upd_time 0 s)\n (operand_bit_to_var_acc_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + operand_bit_to_var_acc_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n apply (relation \"measure (operand_bit_to_var_acc_n \\ snd)\")\n apply (simp add: operand_bit_to_var_acc_imp_subprogram_time_simps Let_def snd'_imp_correct\n fst'_imp_correct prod_encode_imp_correct fst'_nat_def snd'_nat_def prod_encode_def\n nat_less_le triangle_tsqrt_le triangle_nat_le_eq_le le_diff_conv)+\n by (metis add_cancel_right_left add_diff_cancel_left' diff_diff_cancel diff_is_0_eq less_Suc0\n nat_le_linear not_gr_zero triangle_tsqrt_le tsqrt_alt_inverse_triangle)\n\nlemmas [simp del] = operand_bit_to_var_acc_imp_time.simps\n\nlemma operand_bit_to_var_acc_imp_time_acc:\n \"(operand_bit_to_var_acc_imp_time (Suc t) s) = Suc (operand_bit_to_var_acc_imp_time t s)\"\n by (induction t s rule: operand_bit_to_var_acc_imp_time.induct)\n ((subst (1 2) operand_bit_to_var_acc_imp_time.simps);\n (simp add: operand_bit_to_var_acc_state_upd_def))\n\nlemma operand_bit_to_var_acc_imp_time_acc_2_aux:\n \"(operand_bit_to_var_acc_imp_time x s) = x + (operand_bit_to_var_acc_imp_time 0 s)\"\n by (induction x arbitrary: s)\n (simp add: operand_bit_to_var_acc_imp_time_acc)+\n\nlemma operand_bit_to_var_acc_imp_time_acc_2:\n \"x \\ 0 \\ (operand_bit_to_var_acc_imp_time x s) = x + (operand_bit_to_var_acc_imp_time 0 s)\"\n by (rule operand_bit_to_var_acc_imp_time_acc_2_aux)\n\nlemma operand_bit_to_var_acc_imp_time_acc_3:\n \"operand_bit_to_var_acc_imp_time (a + b) s = a + (operand_bit_to_var_acc_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: operand_bit_to_var_acc_imp_time_acc)+\n\nabbreviation \"operand_bit_to_var_acc_while_cond \\ ''condition''\"\nabbreviation \"operand_bit_to_var_acc_fst'_result \\ ''fst'_result''\"\nabbreviation \"operand_bit_to_var_acc_snd'_result \\ ''snd'_result''\"\nabbreviation \"operand_bit_to_var_acc_prod_encode_result \\ ''prod_encode_result''\"\nabbreviation \"operand_bit_to_var_acc_cons_result \\ ''cons_result''\"\n\ndefinition \"operand_bit_to_var_acc_IMP_init_while_cond \\\n \\ \\ snd'_state_p' = operand_bit_to_var_acc_n s;\\\n (snd'_prefix @ snd'_p_str) ::= (A (V operand_bit_to_var_acc_n_str));;\n \\ \\ snd'_state = \\snd'_state_p = snd'_state_p'\\;\\\n \\ \\ snd'_ret_state = snd'_imp snd'_state;\\\n invoke_subprogram snd'_prefix snd'_IMP_Minus;;\n \\ \\ condition = snd'_state_p snd'_ret_state\\\n operand_bit_to_var_acc_while_cond ::= (A (V (snd'_prefix @ snd'_p_str)))\n\"\n\ndefinition \"operand_bit_to_var_acc_IMP_loop_body \\\n \\ \\fst'_state_p' = operand_bit_to_var_acc_n s;\\\n (fst'_prefix @ fst'_p_str) ::= (A (V operand_bit_to_var_acc_n_str));;\n \\ \\fst'_state = \\fst'_state_p = fst'_state_p'\\;\\\n \\ \\fst'_ret_state = fst'_imp fst'_state;\\\n invoke_subprogram fst'_prefix fst'_IMP_Minus;;\n operand_bit_to_var_acc_fst'_result ::= (A (V (fst'_prefix @ fst'_p_str)));;\n \\ \\snd'_state_p' = operand_bit_to_var_acc_n s;\\\n (snd'_prefix @ snd'_p_str) ::= (A (V operand_bit_to_var_acc_n_str));;\n \\ \\snd'_state = \\snd'_state_p = snd'_state_p'\\;\\\n \\ \\snd'_ret_state = snd'_imp snd'_state;\\\n invoke_subprogram snd'_prefix snd'_IMP_Minus;;\n operand_bit_to_var_acc_snd'_result ::= (A (V (snd'_prefix @ snd'_p_str)));;\n \\ \\prod_encode_a' = fst'_state_p fst'_ret_state;\\\n (prod_encode_prefix @ prod_encode_a_str) ::= (A (V operand_bit_to_var_acc_fst'_result));;\n \\ \\prod_encode_b' = snd'_state_p snd'_ret_state - 1;\\\n (prod_encode_prefix @ prod_encode_b_str) ::= (Sub (V operand_bit_to_var_acc_snd'_result) (N 1));;\n \\ \\prod_encode_ret' = 0;\\\n (prod_encode_prefix @ prod_encode_ret_str) ::= (A (N 0));;\n \\ \\prod_encode_state = \\prod_encode_a = prod_encode_a',\\\n \\ \\ prod_encode_b = prod_encode_b',\\\n \\ \\ prod_encode_ret = prod_encode_ret'\\;\\\n \\ \\prod_encode_ret_state = prod_encode_imp prod_encode_state;\\\n invoke_subprogram prod_encode_prefix prod_encode_IMP_Minus;;\n operand_bit_to_var_acc_prod_encode_result ::= (A (V (prod_encode_prefix @ prod_encode_ret_str)));;\n \\ \\cons_h' = fst'_state_p fst'_ret_state;\\\n (cons_prefix @ cons_h_str) ::= (A (V operand_bit_to_var_acc_fst'_result));;\n \\ \\cons_t' = operand_bit_to_var_acc_acc s;\\\n (cons_prefix @ cons_t_str) ::= (A (V operand_bit_to_var_acc_acc_str));;\n \\ \\cons_ret' = 0;\\\n (cons_prefix @ cons_ret_str) ::= (A (N 0));;\n \\ \\cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\\\n \\ \\cons_ret_state = cons_imp cons_state;\\\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n operand_bit_to_var_acc_cons_result ::= (A (V (cons_prefix @ cons_ret_str)));;\n \\ \\operand_bit_to_var_acc_acc' = cons_ret cons_ret_state;\\\n operand_bit_to_var_acc_acc_str ::= (A (V operand_bit_to_var_acc_cons_result));;\n \\ \\operand_bit_to_var_acc_n' = prod_encode_ret prod_encode_ret_state;\\\n operand_bit_to_var_acc_n_str ::= (A (V operand_bit_to_var_acc_prod_encode_result));;\n \\ \\operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_ret s;\\\n operand_bit_to_var_acc_ret_str ::= (A (V operand_bit_to_var_acc_ret_str))\n \\ \\ret = \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\\\n \\ \\ operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\\\n \\ \\ operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\\\\n\"\n\ndefinition \"operand_bit_to_var_acc_IMP_after_loop \\\n \\ \\operand_bit_to_var_acc_ret' = operand_bit_to_var_acc_acc s;\\\n operand_bit_to_var_acc_ret_str ::= (A (V operand_bit_to_var_acc_acc_str))\n \\ \\ret = \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\\\n \\ \\ operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\\\n \\ \\ operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\\\\n\"\n\ndefinition operand_bit_to_var_acc_IMP_Minus where\n \"operand_bit_to_var_acc_IMP_Minus \\\n operand_bit_to_var_acc_IMP_init_while_cond;;\n WHILE operand_bit_to_var_acc_while_cond \\0 DO (\n operand_bit_to_var_acc_IMP_loop_body;;\n operand_bit_to_var_acc_IMP_init_while_cond\n );;\n operand_bit_to_var_acc_IMP_after_loop\"\n\nabbreviation\n \"operand_bit_to_var_acc_IMP_vars \\\n {operand_bit_to_var_acc_acc_str, operand_bit_to_var_acc_n_str, operand_bit_to_var_acc_ret_str,\n operand_bit_to_var_acc_fst'_result, operand_bit_to_var_acc_snd'_result,\n operand_bit_to_var_acc_prod_encode_result, operand_bit_to_var_acc_cons_result}\"\n\nlemmas operand_bit_to_var_acc_IMP_subprogram_simps =\n operand_bit_to_var_acc_IMP_init_while_cond_def\n operand_bit_to_var_acc_IMP_loop_body_def\n operand_bit_to_var_acc_IMP_after_loop_def\n\ndefinition \"operand_bit_to_var_acc_imp_to_HOL_state p s =\n \\operand_bit_to_var_acc_acc = (s (add_prefix p operand_bit_to_var_acc_acc_str)),\n operand_bit_to_var_acc_n = (s (add_prefix p operand_bit_to_var_acc_n_str)),\n operand_bit_to_var_acc_ret = (s (add_prefix p operand_bit_to_var_acc_ret_str))\\\"\n\nlemmas operand_bit_to_var_acc_state_translators =\n fst'_imp_to_HOL_state_def\n snd'_imp_to_HOL_state_def\n prod_encode_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n operand_bit_to_var_acc_imp_to_HOL_state_def\n\nlemmas operand_bit_to_var_acc_complete_simps =\n operand_bit_to_var_acc_IMP_subprogram_simps\n operand_bit_to_var_acc_imp_subprogram_simps\n operand_bit_to_var_acc_state_translators\n\nlemma operand_bit_to_var_acc_IMP_Minus_correct_function:\n \"(invoke_subprogram p operand_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p operand_bit_to_var_acc_ret_str)\n = operand_bit_to_var_acc_ret\n (operand_bit_to_var_acc_imp (operand_bit_to_var_acc_imp_to_HOL_state p s))\"\n apply(induction \"operand_bit_to_var_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: operand_bit_to_var_acc_imp.induct)\n apply(subst operand_bit_to_var_acc_imp.simps)\n apply(simp only: operand_bit_to_var_acc_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule While_tE)\n\n subgoal\n apply(simp only: operand_bit_to_var_acc_IMP_subprogram_simps)\n apply(simp only: prefix_simps)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(8) by fastforce\n by(fastforce simp: operand_bit_to_var_acc_IMP_subprogram_simps\n operand_bit_to_var_acc_imp_subprogram_simps\n operand_bit_to_var_acc_state_translators)\n\n apply(erule Seq_E)+\n apply(dest_com_gen)\n\n subgoal\n apply(simp only: operand_bit_to_var_acc_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(10) by fastforce\n by(fastforce_sorted_premises simp: operand_bit_to_var_acc_complete_simps)\n\n subgoal\n apply(subst (asm) operand_bit_to_var_acc_IMP_init_while_cond_def)\n apply(simp only: operand_bit_to_var_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(26) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n by (fastforce_sorted_premises simp: operand_bit_to_var_acc_imp_subprogram_simps\n operand_bit_to_var_acc_state_translators Let_def)\n\n subgoal\n apply(simp only: operand_bit_to_var_acc_IMP_init_while_cond_def prefix_simps\n operand_bit_to_var_acc_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(28) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(30) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(32) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(34) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(36) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(38) by fastforce\n by (fastforce_sorted_premises simp: operand_bit_to_var_acc_imp_subprogram_simps\n operand_bit_to_var_acc_state_translators Let_def)\n done\n\nlemma operand_bit_to_var_acc_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ operand_bit_to_var_acc_pref)\n operand_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix operand_bit_to_var_acc_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemmas operand_bit_to_var_acc_complete_time_simps =\n operand_bit_to_var_acc_imp_subprogram_time_simps\n operand_bit_to_var_acc_imp_time_acc_2\n operand_bit_to_var_acc_imp_time_acc_3\n operand_bit_to_var_acc_state_translators\n\nlemma operand_bit_to_var_acc_IMP_Minus_correct_time:\n \"(invoke_subprogram p operand_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = operand_bit_to_var_acc_imp_time 0 (operand_bit_to_var_acc_imp_to_HOL_state p s)\"\n apply(induction \"operand_bit_to_var_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: operand_bit_to_var_acc_imp.induct)\n apply(subst operand_bit_to_var_acc_imp_time.simps)\n apply(simp only: operand_bit_to_var_acc_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n\n subgoal\n apply(simp only: operand_bit_to_var_acc_IMP_subprogram_simps prefix_simps)\n apply(erule Seq_tE)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(12) by fastforce\n by (force simp: operand_bit_to_var_acc_IMP_subprogram_simps\n operand_bit_to_var_acc_imp_subprogram_time_simps operand_bit_to_var_acc_state_translators)\n\n apply(erule Seq_tE)+\n apply(simp add: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(simp only: operand_bit_to_var_acc_IMP_init_while_cond_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(13) by fastforce\n by(fastforce_sorted_premises simp: operand_bit_to_var_acc_complete_simps)\n\n subgoal\n apply(subst (asm) operand_bit_to_var_acc_IMP_init_while_cond_def)\n apply(simp only: operand_bit_to_var_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(29) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(31) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(33) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(35) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(37) by fastforce\n by(fastforce_sorted_premises simp: operand_bit_to_var_acc_complete_time_simps Let_def)\n\n subgoal\n apply(simp only: prefix_simps operand_bit_to_var_acc_IMP_init_while_cond_def\n operand_bit_to_var_acc_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(53) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(55) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(57) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(59) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(61) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"operand_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(63) by fastforce\n by(fastforce_sorted_premises simp: Let_def operand_bit_to_var_acc_complete_time_simps)\n done\n\nlemma operand_bit_to_var_acc_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) operand_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (operand_bit_to_var_acc_imp_time 0 (operand_bit_to_var_acc_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) operand_bit_to_var_acc_ret_str) =\n operand_bit_to_var_acc_ret (operand_bit_to_var_acc_imp\n (operand_bit_to_var_acc_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using operand_bit_to_var_acc_IMP_Minus_correct_function\n by (auto simp: operand_bit_to_var_acc_IMP_Minus_correct_time)\n (meson operand_bit_to_var_acc_IMP_Minus_correct_effects set_mono_prefix)\n\n\nsubsubsection \\operand_bit_to_var_tail\\\n\nrecord operand_bit_to_var_tail_state =\n operand_bit_to_var_tail_n::nat\n operand_bit_to_var_tail_ret::nat\n\nabbreviation \"operand_bit_to_var_tail_prefix \\ ''operand_bit_to_var_tail.''\"\nabbreviation \"operand_bit_to_var_tail_n_str \\ ''n''\"\nabbreviation \"operand_bit_to_var_tail_ret_str \\ ''ret''\"\n\ndefinition \"operand_bit_to_var_tail_state_upd s =\n (let\n fst'_state_p' = operand_bit_to_var_tail_n s;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n cons_h' = fst'_result;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n cons_result = cons_ret cons_ret_state;\n operand_bit_to_var_acc_acc' = cons_result;\n operand_bit_to_var_acc_n' = operand_bit_to_var_tail_n s;\n operand_bit_to_var_acc_ret' = 0;\n operand_bit_to_var_acc_state =\n \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\n operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\n operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\;\n operand_bit_to_var_acc_ret_state = operand_bit_to_var_acc_imp operand_bit_to_var_acc_state;\n operand_bit_to_var_acc_result = operand_bit_to_var_acc_ret operand_bit_to_var_acc_ret_state;\n operand_bit_to_var_tail_n' = operand_bit_to_var_tail_n s;\n operand_bit_to_var_tail_ret' = operand_bit_to_var_acc_result;\n ret = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\n operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\\n in\n ret\n )\"\n\nfunction operand_bit_to_var_tail_imp::\n \"operand_bit_to_var_tail_state \\ operand_bit_to_var_tail_state\" where\n \"operand_bit_to_var_tail_imp s =\n (let\n ret = operand_bit_to_var_tail_state_upd s\n in\n ret\n )\"\n by simp+\ntermination\n by (relation \"measure (\\s. operand_bit_to_var_tail_n s)\") simp\n\ndeclare operand_bit_to_var_tail_imp.simps [simp del]\n\nlemma operand_bit_to_var_tail_imp_correct[let_function_correctness]:\n \"operand_bit_to_var_tail_ret (operand_bit_to_var_tail_imp s) =\n operand_bit_to_var_tail (operand_bit_to_var_tail_n s)\"\n by(simp add: operand_bit_to_var_tail_imp.simps operand_bit_to_var_tail_state_upd_def\n fst'_imp_correct cons_imp_correct)\n (simp only: operand_bit_to_var_tail_def operand_bit_to_var_acc_imp_correct\n operand_bit_to_var_acc'_correct operand_bit_to_var_acc_state.simps fst_nat_fst'_nat)\n\nfunction operand_bit_to_var_tail_imp_time:: \"nat \\ operand_bit_to_var_tail_state \\ nat\" where\n \"operand_bit_to_var_tail_imp_time t s =\n (let\n fst'_state_p' = operand_bit_to_var_tail_n s;\n t = t + 2;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n t = t + fst'_imp_time 0 fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n t = t + 2;\n cons_h' = fst'_result;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n cons_result = cons_ret cons_ret_state;\n t = t + 2;\n operand_bit_to_var_acc_acc' = cons_result;\n t = t + 2;\n operand_bit_to_var_acc_n' = operand_bit_to_var_tail_n s;\n t = t + 2;\n operand_bit_to_var_acc_ret' = 0;\n t = t + 2;\n operand_bit_to_var_acc_state =\n \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\n operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\n operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\;\n operand_bit_to_var_acc_ret_state = operand_bit_to_var_acc_imp operand_bit_to_var_acc_state;\n t = t + operand_bit_to_var_acc_imp_time 0 operand_bit_to_var_acc_state;\n operand_bit_to_var_acc_result = operand_bit_to_var_acc_ret operand_bit_to_var_acc_ret_state;\n t = t + 2;\n operand_bit_to_var_tail_n' = operand_bit_to_var_tail_n s;\n t = t + 2;\n operand_bit_to_var_tail_ret' = operand_bit_to_var_acc_result;\n t = t + 2;\n ret = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\n operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\\n in\n t\n )\"\n by auto\ntermination\n by (relation \"measure (\\(t, s). operand_bit_to_var_tail_n s)\") simp\n\nlemmas [simp del] = operand_bit_to_var_tail_imp_time.simps\n\nlemma operand_bit_to_var_tail_imp_time_acc:\n \"(operand_bit_to_var_tail_imp_time (Suc t) s) = Suc (operand_bit_to_var_tail_imp_time t s)\"\n by (induction t s rule: operand_bit_to_var_tail_imp_time.induct)\n ((subst (1 2) operand_bit_to_var_tail_imp_time.simps); (simp add: Let_def))\n\nlemma operand_bit_to_var_tail_imp_time_acc_2_aux:\n \"(operand_bit_to_var_tail_imp_time x s) = x + (operand_bit_to_var_tail_imp_time 0 s)\"\n by (induction x arbitrary: s)\n (simp add: operand_bit_to_var_tail_imp_time_acc)+\n\nlemma operand_bit_to_var_tail_imp_time_acc_2:\n \"x \\ 0 \\ (operand_bit_to_var_tail_imp_time x s) = x + (operand_bit_to_var_tail_imp_time 0 s)\"\n by (rule operand_bit_to_var_tail_imp_time_acc_2_aux)\n\nlemma operand_bit_to_var_tail_imp_time_acc_3:\n \"operand_bit_to_var_tail_imp_time (a + b) s = a + (operand_bit_to_var_tail_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: operand_bit_to_var_tail_imp_time_acc)+\n\nabbreviation \"operand_bit_to_var_tail_fst'_result \\ ''fst'_result''\"\nabbreviation \"operand_bit_to_var_tail_cons_result \\ ''cons_result''\"\nabbreviation\n \"operand_bit_to_var_tail_operand_bit_to_var_tail_result \\ ''operand_bit_to_var_tail_result''\"\n\ndefinition \"operand_bit_to_var_tail_IMP_Minus \\\n \\ \\ fst'_state_p' = operand_bit_to_var_tail_n s;\\\n (fst'_prefix @ fst'_p_str) ::= (A (V operand_bit_to_var_tail_n_str));;\n \\ \\ fst'_state = \\fst'_state_p = fst'_state_p'\\;\\\n \\ \\ fst'_ret_state = fst'_imp fst'_state;\\\n invoke_subprogram fst'_prefix fst'_IMP_Minus;;\n \\ \\ fst'_result = fst'_state_p fst'_ret_state;\\\n operand_bit_to_var_tail_fst'_result ::= (A (V (fst'_prefix @ fst'_p_str)));;\n \\ \\ cons_h' = fst'_result;\\\n (cons_prefix @ cons_h_str) ::= (A (V operand_bit_to_var_tail_fst'_result));;\n \\ \\ cons_t' = 0;\\\n (cons_prefix @ cons_t_str) ::= (A (N 0));;\n \\ \\ cons_ret' = 0;\\\n (cons_prefix @ cons_ret_str) ::= (A (N 0));;\n \\ \\ cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\\\n \\ \\ cons_ret_state = cons_imp cons_state;\\\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n \\ \\ cons_result = cons_ret cons_ret_state;\\\n operand_bit_to_var_tail_cons_result ::= (A (V (cons_prefix @ cons_ret_str)));;\n \\ \\ operand_bit_to_var_acc_acc' = cons_result;\\\n (operand_bit_to_var_acc_prefix @ operand_bit_to_var_acc_acc_str) ::=\n (A (V operand_bit_to_var_tail_cons_result));;\n \\ \\ operand_bit_to_var_acc_n' = operand_bit_to_var_tail_n s;\\\n (operand_bit_to_var_acc_prefix @ operand_bit_to_var_acc_n_str) ::=\n (A (V operand_bit_to_var_tail_n_str));;\n \\ \\ operand_bit_to_var_acc_ret' = 0;\\\n (operand_bit_to_var_acc_prefix @ operand_bit_to_var_acc_ret_str) ::= (A (N 0));;\n \\ \\ operand_bit_to_var_acc_state =\\\n \\ \\ \\operand_bit_to_var_acc_acc = operand_bit_to_var_acc_acc',\\\n \\ \\ operand_bit_to_var_acc_n = operand_bit_to_var_acc_n',\\\n \\ \\ operand_bit_to_var_acc_ret = operand_bit_to_var_acc_ret'\\;\\\n \\ \\ operand_bit_to_var_acc_ret_state =\n operand_bit_to_var_acc_imp operand_bit_to_var_acc_state;\\\n invoke_subprogram operand_bit_to_var_acc_prefix operand_bit_to_var_acc_IMP_Minus;;\n \\ \\ operand_bit_to_var_acc_result =\n operand_bit_to_var_acc_ret operand_bit_to_var_acc_ret_state;\\\n operand_bit_to_var_tail_operand_bit_to_var_tail_result ::=\n (A (V (operand_bit_to_var_acc_prefix @ operand_bit_to_var_acc_ret_str)));;\n \\ \\ operand_bit_to_var_tail_n' = operand_bit_to_var_tail_n s;\\\n operand_bit_to_var_tail_n_str ::= (A (V operand_bit_to_var_tail_n_str));;\n \\ \\ operand_bit_to_var_tail_ret' = operand_bit_to_var_acc_result;\\\n operand_bit_to_var_tail_ret_str ::= (A (V operand_bit_to_var_tail_operand_bit_to_var_tail_result))\n \\ \\ ret = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\\\n \\ \\ operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\\\\n \"\n\nabbreviation\n \"operand_bit_to_var_tail_IMP_vars \\\n {operand_bit_to_var_tail_n_str, operand_bit_to_var_tail_ret_str,\n operand_bit_to_var_tail_fst'_result, operand_bit_to_var_tail_cons_result,\n operand_bit_to_var_tail_operand_bit_to_var_tail_result}\"\n\ndefinition \"operand_bit_to_var_tail_imp_to_HOL_state p s =\n \\operand_bit_to_var_tail_n = (s (add_prefix p operand_bit_to_var_tail_n_str)),\n operand_bit_to_var_tail_ret = (s (add_prefix p operand_bit_to_var_tail_ret_str))\\\"\n\nlemmas operand_bit_to_var_tail_state_translators =\n fst'_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n operand_bit_to_var_acc_imp_to_HOL_state_def\n operand_bit_to_var_tail_imp_to_HOL_state_def\n\nlemma operand_bit_to_var_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p operand_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p operand_bit_to_var_tail_ret_str)\n = operand_bit_to_var_tail_ret\n (operand_bit_to_var_tail_imp (operand_bit_to_var_tail_imp_to_HOL_state p s))\"\n apply(simp only: operand_bit_to_var_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule fst'_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(15) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(17) by fastforce\n apply(erule operand_bit_to_var_acc_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(19) by fastforce\n by (fastforce simp: operand_bit_to_var_tail_state_translators operand_bit_to_var_tail_imp.simps\n operand_bit_to_var_tail_state_upd_def)\n\nlemma operand_bit_to_var_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ operand_bit_to_var_tail_pref) operand_bit_to_var_tail_IMP_Minus, s)\n \\\\<^bsup>t\\<^esup> s'; v \\ vars; \\ (prefix operand_bit_to_var_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemma operand_bit_to_var_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p operand_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = operand_bit_to_var_tail_imp_time 0 (operand_bit_to_var_tail_imp_to_HOL_state p s)\"\n apply(simp only: operand_bit_to_var_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule fst'_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(29) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(31) by fastforce\n apply(erule operand_bit_to_var_acc_IMP_Minus_correct[where vars=operand_bit_to_var_tail_IMP_vars])\n subgoal premises p using p(33) by fastforce\n by (fastforce simp: operand_bit_to_var_tail_state_translators Let_def\n operand_bit_to_var_tail_imp_time.simps operand_bit_to_var_tail_state_upd_def )\n\nlemma operand_bit_to_var_tail_IMP_Minus_correct[functional_correctness]:\n \"\\(invoke_subprogram (p1 @ p2) operand_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (operand_bit_to_var_tail_imp_time 0\n (operand_bit_to_var_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) operand_bit_to_var_tail_ret_str) =\n operand_bit_to_var_tail_ret\n (operand_bit_to_var_tail_imp (operand_bit_to_var_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using operand_bit_to_var_tail_IMP_Minus_correct_time\n operand_bit_to_var_tail_IMP_Minus_correct_function\n operand_bit_to_var_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\nsubsection \\var_to_operand_bit_nat\\\n\nfun var_to_operand_bit_tail':: \"nat \\ nat\" where\n \"var_to_operand_bit_tail' v =\n (let l = length_nat v in\n (if l \\ 0 then (\n let r = (prod_encode (hd_nat v, l - 1)) in\n if v = operand_bit_to_var_tail r then\n r + 1\n else 0)\n else 0))\"\n\nlemma var_to_operand_bit_tail'_correct:\n \"var_to_operand_bit_tail' v = var_to_operand_bit_tail v\"\n unfolding var_to_operand_bit_tail_def\n using some_nat_def var_to_operand_bit_tail'.simps\n by (smt (verit, del_insts) Zero_not_Suc add.commute length_nat.elims plus_1_eq_Suc)\n\n\nsubsubsection \\var_to_operand_bit_tail_aux\\\n\nfun var_to_operand_bit_tail_aux :: \"nat \\ nat \\ nat\" where\n \"var_to_operand_bit_tail_aux v l =\n (let r = (prod_encode (hd_nat v, l - 1))\n in if v = operand_bit_to_var_tail r\n then r + 1\n else 0\n )\"\n\nrecord var_to_operand_bit_tail_aux_state =\n var_to_operand_bit_tail_aux_v::nat\n var_to_operand_bit_tail_aux_l::nat\n var_to_operand_bit_tail_aux_ret::nat\n\nabbreviation \"var_to_operand_bit_tail_aux_prefix \\ ''var_to_operand_bit_tail_aux.''\"\nabbreviation \"var_to_operand_bit_tail_aux_v_str \\ ''v''\"\nabbreviation \"var_to_operand_bit_tail_aux_l_str \\ ''l''\"\nabbreviation \"var_to_operand_bit_tail_aux_ret_str \\ ''ret''\"\n\ndefinition \"var_to_operand_bit_tail_aux_state_upd s =\n (let\n hd_xs' = var_to_operand_bit_tail_aux_v s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', \n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n prod_encode_a' = hd_ret hd_ret_state;\n prod_encode_b' = var_to_operand_bit_tail_aux_l s - 1;\n prod_encode_ret' = 0;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n prod_encode_result = prod_encode_ret prod_encode_ret_state;\n operand_bit_to_var_tail_n' = prod_encode_result;\n operand_bit_to_var_tail_ret' = 0;\n operand_bit_to_var_tail_state = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\n operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\;\n operand_bit_to_var_tail_ret_state = operand_bit_to_var_tail_imp operand_bit_to_var_tail_state;\n EQUAL_neq_zero_a' = var_to_operand_bit_tail_aux_v s;\n EQUAL_neq_zero_b' = operand_bit_to_var_tail_ret operand_bit_to_var_tail_ret_state;\n EQUAL_neq_zero_ret' = 0;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state\n in\n (if EQUAL_neq_zero_result \\ 0 then\n (let\n var_to_operand_bit_tail_aux_ret' = prod_encode_result + 1;\n ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\n in\n ret\n )\n else\n (let\n var_to_operand_bit_tail_aux_ret' = 0;\n ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\n in\n ret\n )\n )\n)\"\n\nfunction var_to_operand_bit_tail_aux_imp ::\n \"var_to_operand_bit_tail_aux_state \\ var_to_operand_bit_tail_aux_state\" where\n \"var_to_operand_bit_tail_aux_imp s =\n (let \n ret = var_to_operand_bit_tail_aux_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_to_operand_bit_tail_aux_v\") simp\n\ndeclare var_to_operand_bit_tail_aux_imp.simps [simp del]\n\nlemma var_to_operand_bit_tail_aux_imp_correct[let_function_correctness]:\n \"var_to_operand_bit_tail_aux_ret (var_to_operand_bit_tail_aux_imp s) =\n var_to_operand_bit_tail_aux (var_to_operand_bit_tail_aux_v s) (var_to_operand_bit_tail_aux_l s)\"\n apply (simp only: var_to_operand_bit_tail_aux_imp.simps Let_def prod_encode_imp_correct hd_imp_correct\n EQUAL_neq_zero_imp_correct operand_bit_to_var_tail_imp_correct var_to_operand_bit_tail_aux_state_upd_def)\n by simp \n\nfunction var_to_operand_bit_tail_aux_imp_time ::\n \"nat \\ var_to_operand_bit_tail_aux_state \\ nat\" where\n \"var_to_operand_bit_tail_aux_imp_time t s =\n (let\n hd_xs' = var_to_operand_bit_tail_aux_v s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', \n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state; \n t = t + hd_imp_time 0 hd_state;\n prod_encode_a' = hd_ret hd_ret_state;\n t = t + 2;\n prod_encode_b' = var_to_operand_bit_tail_aux_l s - 1;\n t = t + 2;\n prod_encode_ret' = 0;\n t = t + 2;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n t = t + prod_encode_imp_time 0 prod_encode_state;\n prod_encode_result = prod_encode_ret prod_encode_ret_state;\n t = t + 2;\n operand_bit_to_var_tail_n' = prod_encode_result;\n t = t + 2;\n operand_bit_to_var_tail_ret' = 0;\n t = t + 2;\n operand_bit_to_var_tail_state = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\n operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\;\n operand_bit_to_var_tail_ret_state = operand_bit_to_var_tail_imp operand_bit_to_var_tail_state;\n t = t + operand_bit_to_var_tail_imp_time 0 operand_bit_to_var_tail_state;\n EQUAL_neq_zero_a' = var_to_operand_bit_tail_aux_v s;\n t = t + 2;\n EQUAL_neq_zero_b' = operand_bit_to_var_tail_ret operand_bit_to_var_tail_ret_state;\n t = t + 2;\n EQUAL_neq_zero_ret' = 0;\n t = t + 2;\n EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\n EQUAL_neq_zero_b = EQUAL_neq_zero_b',\n EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\n EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\n t = t + EQUAL_neq_zero_imp_time 0 EQUAL_neq_zero_state;\n EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state;\n t = t + 2\n in\n (if EQUAL_neq_zero_result \\ 0 then\n (let\n t = t + 1;\n var_to_operand_bit_tail_aux_ret' = prod_encode_result + 1;\n t = t + 2;\n ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\n in\n t\n )\n else\n (let\n t = t + 1;\n var_to_operand_bit_tail_aux_ret' = 0;\n t = t + 2;\n ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\n in\n t\n )\n )\n)\"\n by auto\ntermination\n by (relation \"measure (var_to_operand_bit_tail_aux_v \\ snd)\") simp\n\ndeclare var_to_operand_bit_tail_aux_imp_time.simps [simp del]\n\nlemma var_to_operand_bit_tail_aux_imp_time_acc:\n \"(var_to_operand_bit_tail_aux_imp_time (Suc t) s) = Suc (var_to_operand_bit_tail_aux_imp_time t s)\"\n by (induction t s rule: var_to_operand_bit_tail_aux_imp_time.induct)\n ((subst (1 2) var_to_operand_bit_tail_aux_imp_time.simps);\n (simp add: var_to_operand_bit_tail_aux_state_upd_def Let_def)) \n\nlemma var_to_operand_bit_tail_aux_imp_time_acc_2_aux:\n \"(var_to_operand_bit_tail_aux_imp_time t s) = t + (var_to_operand_bit_tail_aux_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: var_to_operand_bit_tail_aux_imp_time_acc)+ \n\nlemma var_to_operand_bit_tail_aux_imp_time_acc_2:\n \"t \\ 0 \\ (var_to_operand_bit_tail_aux_imp_time t s) = t + (var_to_operand_bit_tail_aux_imp_time 0 s)\"\n by (rule var_to_operand_bit_tail_aux_imp_time_acc_2_aux) \n\nlemma var_to_operand_bit_tail_aux_imp_time_acc_3:\n \"(var_to_operand_bit_tail_aux_imp_time (a + b) s) = a + (var_to_operand_bit_tail_aux_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: var_to_operand_bit_tail_aux_imp_time_acc)+ \n\nabbreviation \"var_to_operand_bit_tail_aux_prod_encode_result \\ ''prod_encode_result''\"\nabbreviation \"var_to_operand_bit_tail_aux_EQUAL_neq_zero_result \\ ''EQUAL_neq_zero_result''\"\n\nabbreviation \"var_to_operand_bit_tail_aux_IMP_if \\\n \\ \\ var_to_operand_bit_tail_aux_ret' = prod_encode_result + 1;\\\n (var_to_operand_bit_tail_aux_ret_str) ::= (Plus (V var_to_operand_bit_tail_aux_prod_encode_result) (N 1))\n \\ \\ ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\\\n \\ \\ var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\\\n \\ \\ var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\\\n\"\n\nabbreviation \"var_to_operand_bit_tail_aux_IMP_else \\\n \\ \\ var_to_operand_bit_tail_aux_ret' = 0;\\\n (var_to_operand_bit_tail_aux_ret_str) ::= (A (N 0))\n \\ \\ ret = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v s,\\\n \\ \\ var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l s,\\\n \\ \\ var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\\\\n\"\n\ndefinition var_to_operand_bit_tail_aux_IMP_Minus where\n \"var_to_operand_bit_tail_aux_IMP_Minus \\\n \\ \\ hd_xs' = var_to_operand_bit_tail_aux_v s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V var_to_operand_bit_tail_aux_v_str));;\n \\ \\ hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\ hd_state = \\hd_xs = hd_xs',\\\n \\ \\ hd_ret = hd_ret'\\;\\\n \\ \\ hd_ret_state = hd_imp hd_state;\\\n (invoke_subprogram hd_prefix hd_IMP_Minus);;\n \\ \\ prod_encode_a' = hd_ret hd_ret_state;\\\n (prod_encode_prefix @ prod_encode_a_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\ prod_encode_b' = var_to_operand_bit_tail_aux_l s - 1;\\\n (prod_encode_prefix @ prod_encode_b_str) ::= (Sub (V var_to_operand_bit_tail_aux_l_str) (N 1));;\n \\ \\ prod_encode_ret' = 0;\\\n (prod_encode_prefix @ prod_encode_ret_str) ::= (A (N 0));;\n \\ \\ prod_encode_state = \\prod_encode_a = prod_encode_a',\\\n \\ \\ prod_encode_b = prod_encode_b',\\\n \\ \\ prod_encode_ret = prod_encode_ret'\\;\\\n \\ \\ prod_encode_ret_state = prod_encode_imp prod_encode_state;\\\n (invoke_subprogram prod_encode_prefix prod_encode_IMP_Minus);;\n \\ \\ prod_encode_result = prod_encode_ret prod_encode_ret_state;\\\n (var_to_operand_bit_tail_aux_prod_encode_result) ::= (A (V (prod_encode_prefix @ prod_encode_ret_str)));;\n \\ \\ operand_bit_to_var_tail_n' = prod_encode_result;\\\n (operand_bit_to_var_tail_prefix @ operand_bit_to_var_tail_n_str) ::=\n (A (V var_to_operand_bit_tail_aux_prod_encode_result));;\n \\ \\ operand_bit_to_var_tail_ret' = 0;\\\n (operand_bit_to_var_tail_prefix @ operand_bit_to_var_tail_ret_str) ::= (A (N 0));;\n \\ \\ operand_bit_to_var_tail_state = \\operand_bit_to_var_tail_n = operand_bit_to_var_tail_n',\\\n \\ \\ operand_bit_to_var_tail_ret = operand_bit_to_var_tail_ret'\\;\\\n \\ \\ operand_bit_to_var_tail_ret_state = operand_bit_to_var_tail_imp operand_bit_to_var_tail_state;\\\n (invoke_subprogram operand_bit_to_var_tail_prefix operand_bit_to_var_tail_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_a' = var_to_operand_bit_tail_aux_v s;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_a_str) ::= (A (V var_to_operand_bit_tail_aux_v_str));;\n \\ \\ EQUAL_neq_zero_b' = operand_bit_to_var_tail_ret operand_bit_to_var_tail_ret_state;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_b_str) ::=\n (A (V (operand_bit_to_var_tail_prefix @ operand_bit_to_var_tail_ret_str)));;\n \\ \\ EQUAL_neq_zero_ret' = 0;\\\n (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str) ::= (A (N 0));;\n \\ \\ EQUAL_neq_zero_state = \\EQUAL_neq_zero_a = EQUAL_neq_zero_a',\\\n \\ \\ EQUAL_neq_zero_b = EQUAL_neq_zero_b',\\\n \\ \\ EQUAL_neq_zero_ret = EQUAL_neq_zero_ret'\\;\\\n \\ \\ EQUAL_neq_zero_ret_state = EQUAL_neq_zero_imp EQUAL_neq_zero_state;\\\n (invoke_subprogram EQUAL_neq_zero_prefix EQUAL_neq_zero_IMP_Minus);;\n \\ \\ EQUAL_neq_zero_result = EQUAL_neq_zero_ret EQUAL_neq_zero_ret_state\\\n (var_to_operand_bit_tail_aux_EQUAL_neq_zero_result) ::=\n (A (V (EQUAL_neq_zero_prefix @ EQUAL_neq_zero_ret_str)));;\n \\ \\(if EQUAL_neq_zero_result \\ 0 then\\\n (IF var_to_operand_bit_tail_aux_EQUAL_neq_zero_result \\0 THEN\n var_to_operand_bit_tail_aux_IMP_if\n \\ \\else\\\n ELSE\n var_to_operand_bit_tail_aux_IMP_else\n )\n\"\n\nabbreviation \"var_to_operand_bit_tail_aux_IMP_vars \\\n {var_to_operand_bit_tail_aux_v_str, var_to_operand_bit_tail_aux_l_str, var_to_operand_bit_tail_aux_ret_str,\n var_to_operand_bit_tail_aux_prod_encode_result, var_to_operand_bit_tail_aux_EQUAL_neq_zero_result}\"\n\ndefinition \"var_to_operand_bit_tail_aux_imp_to_HOL_state p s =\n \\var_to_operand_bit_tail_aux_v = (s (add_prefix p var_to_operand_bit_tail_aux_v_str)),\n var_to_operand_bit_tail_aux_l = (s (add_prefix p var_to_operand_bit_tail_aux_l_str)),\n var_to_operand_bit_tail_aux_ret = (s (add_prefix p var_to_operand_bit_tail_aux_ret_str))\\\"\n\nlemmas var_to_operand_bit_tail_aux_state_translators =\n var_to_operand_bit_tail_aux_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n prod_encode_imp_to_HOL_state_def\n operand_bit_to_var_tail_imp_to_HOL_state_def\n EQUAL_neq_zero_imp_to_HOL_state_def\n\nlemma var_to_operand_bit_tail_aux_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_to_operand_bit_tail_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_to_operand_bit_tail_aux_ret_str)\n = var_to_operand_bit_tail_aux_ret\n (var_to_operand_bit_tail_aux_imp (var_to_operand_bit_tail_aux_imp_to_HOL_state p s))\"\n apply(subst var_to_operand_bit_tail_aux_imp.simps)\n apply(simp only: var_to_operand_bit_tail_aux_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n apply(erule operand_bit_to_var_tail_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(23) by fastforce\n apply(erule If_E)\n subgoal\n by (fastforce_sorted_premises2 simp: var_to_operand_bit_tail_aux_state_translators Let_def\n var_to_operand_bit_tail_aux_state_upd_def) \n subgoal\n by (fastforce_sorted_premises2 simp: var_to_operand_bit_tail_aux_state_translators Let_def\n var_to_operand_bit_tail_aux_state_upd_def) \n done\n\nlemma var_to_operand_bit_tail_aux_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_to_operand_bit_tail_aux_pref) var_to_operand_bit_tail_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_to_operand_bit_tail_aux_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemma var_to_operand_bit_tail_aux_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_to_operand_bit_tail_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_to_operand_bit_tail_aux_imp_time 0 (var_to_operand_bit_tail_aux_imp_to_HOL_state p s)\"\n apply(subst var_to_operand_bit_tail_aux_imp_time.simps)\n apply(simp only: var_to_operand_bit_tail_aux_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule hd_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(33) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(35) by fastforce\n apply(erule operand_bit_to_var_tail_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(37) by fastforce\n apply(erule EQUAL_neq_zero_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_aux_IMP_vars\"])\n subgoal premises p using p(39) by fastforce\n apply(erule If_tE)\n subgoal \n by (fastforce_sorted_premises2 simp: Let_def var_to_operand_bit_tail_aux_state_translators)\n subgoal \n by (fastforce_sorted_premises2 simp: Let_def var_to_operand_bit_tail_aux_state_translators)\n done\n\nlemma var_to_operand_bit_tail_aux_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_to_operand_bit_tail_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_to_operand_bit_tail_aux_imp_time 0 (var_to_operand_bit_tail_aux_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_to_operand_bit_tail_aux_ret_str) =\n var_to_operand_bit_tail_aux_ret (var_to_operand_bit_tail_aux_imp\n (var_to_operand_bit_tail_aux_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_to_operand_bit_tail_aux_IMP_Minus_correct_function\n var_to_operand_bit_tail_aux_IMP_Minus_correct_time\n var_to_operand_bit_tail_aux_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\nsubsubsection \\var_to_operand_bit_tail\\\n\nfun var_to_operand_bit_tail'' :: \"nat \\ nat\" where\n \"var_to_operand_bit_tail'' v =\n (let l = length_nat v \n in (if l \\ 0 \n then var_to_operand_bit_tail_aux v l\n else 0)\n )\"\n\nlemma var_to_operand_bit_tail''_correct:\n \"var_to_operand_bit_tail'' v = var_to_operand_bit_tail v\"\n unfolding var_to_operand_bit_tail_def\n using some_nat_def var_to_operand_bit_tail''.simps\n var_to_operand_bit_tail'_correct\n by (metis var_to_operand_bit_tail''.elims var_to_operand_bit_tail'.simps\n var_to_operand_bit_tail_aux.elims var_to_operand_bit_tail_def)\n\nrecord var_to_operand_bit_tail_state =\n var_to_operand_bit_tail_v::nat\n var_to_operand_bit_tail_ret::nat\n\nabbreviation \"var_to_operand_bit_tail_prefix \\ ''var_to_operand_bit_tail.''\"\nabbreviation \"var_to_operand_bit_tail_v_str \\ ''v''\"\nabbreviation \"var_to_operand_bit_tail_ret_str \\ ''ret''\"\n\ndefinition \"var_to_operand_bit_tail_state_upd s =\n (let\n length_xs' = var_to_operand_bit_tail_v s;\n length_ret' = 0;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n length_result = length_ret length_ret_state\n in\n (if length_result \\ 0 then\n (let\n var_to_operand_bit_tail_aux_v' = var_to_operand_bit_tail_v s;\n var_to_operand_bit_tail_aux_l' = length_result;\n var_to_operand_bit_tail_aux_ret' = 0;\n var_to_operand_bit_tail_aux_state = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v',\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l',\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\;\n var_to_operand_bit_tail_aux_ret_state = var_to_operand_bit_tail_aux_imp var_to_operand_bit_tail_aux_state;\n var_to_operand_bit_tail_ret' = var_to_operand_bit_tail_aux_ret var_to_operand_bit_tail_aux_ret_state;\n ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\n var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\n in\n ret\n )\n else\n (let\n var_to_operand_bit_tail_ret' = 0;\n ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\n var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\n in\n ret\n )\n )\n)\"\n\nfunction var_to_operand_bit_tail_imp ::\n \"var_to_operand_bit_tail_state \\ var_to_operand_bit_tail_state\" where\n \"var_to_operand_bit_tail_imp s =\n (let \n ret = var_to_operand_bit_tail_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure var_to_operand_bit_tail_v\") simp\n\ndeclare var_to_operand_bit_tail_imp.simps [simp del]\n\nlemma var_to_operand_bit_tail_imp_correct_aux:\n \"var_to_operand_bit_tail_ret (var_to_operand_bit_tail_imp s) =\n var_to_operand_bit_tail'' (var_to_operand_bit_tail_v s)\"\n by (simp add: var_to_operand_bit_tail_imp.simps Let_def length_imp_correct2\n var_to_operand_bit_tail_aux_imp_correct var_to_operand_bit_tail_state_upd_def)\n\nlemma var_to_operand_bit_tail_imp_correct[let_function_correctness]:\n \"var_to_operand_bit_tail_ret (var_to_operand_bit_tail_imp s) =\n var_to_operand_bit_tail (var_to_operand_bit_tail_v s)\"\n using var_to_operand_bit_tail_imp_correct_aux var_to_operand_bit_tail''_correct\n by simp\n\nfunction var_to_operand_bit_tail_imp_time ::\n \"nat \\ var_to_operand_bit_tail_state \\ nat\" where\n \"var_to_operand_bit_tail_imp_time t s =\n (let\n length_xs' = var_to_operand_bit_tail_v s;\n t = t + 2;\n length_ret' = 0;\n t = t + 2;\n length_state = \\length_xs = length_xs',\n length_ret = length_ret'\\;\n length_ret_state = length_imp length_state;\n t = t + length_imp_time 0 length_state;\n length_result = length_ret length_ret_state;\n t = t + 2\n in\n (if length_result \\ 0 then\n (let\n t = t + 1;\n var_to_operand_bit_tail_aux_v' = var_to_operand_bit_tail_v s;\n t = t + 2;\n var_to_operand_bit_tail_aux_l' = length_result;\n t = t + 2;\n var_to_operand_bit_tail_aux_ret' = 0;\n t = t + 2;\n var_to_operand_bit_tail_aux_state = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v',\n var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l',\n var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\;\n var_to_operand_bit_tail_aux_ret_state = var_to_operand_bit_tail_aux_imp var_to_operand_bit_tail_aux_state;\n t = t + var_to_operand_bit_tail_aux_imp_time 0 var_to_operand_bit_tail_aux_state;\n var_to_operand_bit_tail_ret' = var_to_operand_bit_tail_aux_ret var_to_operand_bit_tail_aux_ret_state;\n t = t + 2;\n ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\n var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\n in\n t\n )\n else\n (let\n t = t + 1;\n var_to_operand_bit_tail_ret' = 0;\n t = t + 2;\n ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\n var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\n in\n t\n )\n )\n)\"\n by auto\ntermination\n by (relation \"measure (var_to_operand_bit_tail_v \\ snd)\") simp\n\ndeclare var_to_operand_bit_tail_imp_time.simps [simp del]\n\nlemma var_to_operand_bit_tail_imp_time_acc:\n \"(var_to_operand_bit_tail_imp_time (Suc t) s) = Suc (var_to_operand_bit_tail_imp_time t s)\"\n by (induction t s rule: var_to_operand_bit_tail_imp_time.induct)\n ((subst (1 2) var_to_operand_bit_tail_imp_time.simps);\n (simp add: var_to_operand_bit_tail_state_upd_def Let_def)) \n\nlemma var_to_operand_bit_tail_imp_time_acc_2_aux:\n \"(var_to_operand_bit_tail_imp_time t s) = t + (var_to_operand_bit_tail_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: var_to_operand_bit_tail_imp_time_acc)+ \n\nlemma var_to_operand_bit_tail_imp_time_acc_2:\n \"t \\ 0 \\ (var_to_operand_bit_tail_imp_time t s) = t + (var_to_operand_bit_tail_imp_time 0 s)\"\n by (rule var_to_operand_bit_tail_imp_time_acc_2_aux) \n\nlemma var_to_operand_bit_tail_imp_time_acc_3:\n \"(var_to_operand_bit_tail_imp_time (a + b) s) = a + (var_to_operand_bit_tail_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: var_to_operand_bit_tail_imp_time_acc)+ \n\nabbreviation \"var_to_operand_bit_tail_length_result \\ ''length_result''\"\n\nabbreviation \"var_to_operand_bit_tail_IMP_if \\\n \\ \\ var_to_operand_bit_tail_aux_v' = var_to_operand_bit_tail_v s;\\\n (var_to_operand_bit_tail_aux_prefix @ var_to_operand_bit_tail_aux_v_str) ::= \n (A (V var_to_operand_bit_tail_v_str));;\n \\ \\ var_to_operand_bit_tail_aux_l' = length_result;\\\n (var_to_operand_bit_tail_aux_prefix @ var_to_operand_bit_tail_aux_l_str) ::= \n (A (V var_to_operand_bit_tail_length_result));;\n \\ \\ var_to_operand_bit_tail_aux_ret' = 0;\\\n (var_to_operand_bit_tail_aux_prefix @ var_to_operand_bit_tail_aux_ret_str) ::= (A (N 0));;\n \\ \\ var_to_operand_bit_tail_aux_state = \\var_to_operand_bit_tail_aux_v = var_to_operand_bit_tail_aux_v',\\\n \\ \\ var_to_operand_bit_tail_aux_l = var_to_operand_bit_tail_aux_l',\\\n \\ \\ var_to_operand_bit_tail_aux_ret = var_to_operand_bit_tail_aux_ret'\\;\\\n \\ \\ var_to_operand_bit_tail_aux_ret_state = var_to_operand_bit_tail_aux_imp var_to_operand_bit_tail_aux_state;\\\n (invoke_subprogram var_to_operand_bit_tail_aux_prefix var_to_operand_bit_tail_aux_IMP_Minus);;\n \\ \\ var_to_operand_bit_tail_ret' = var_to_operand_bit_tail_aux_ret var_to_operand_bit_tail_aux_ret_state;\\\n (var_to_operand_bit_tail_ret_str) ::= \n (A (V (var_to_operand_bit_tail_aux_prefix @ var_to_operand_bit_tail_aux_ret_str)))\n \\ \\ ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\\\n \\ \\ var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\\\n\"\n\nabbreviation \"var_to_operand_bit_tail_IMP_else \\\n \\ \\ var_to_operand_bit_tail_ret' = 0;\\\n (var_to_operand_bit_tail_ret_str) ::= (A (N 0))\n \\ \\ ret = \\var_to_operand_bit_tail_v = var_to_operand_bit_tail_v s,\\\n \\ \\ var_to_operand_bit_tail_ret = var_to_operand_bit_tail_ret'\\\\\n\"\n\ndefinition var_to_operand_bit_tail_IMP_Minus where\n \"var_to_operand_bit_tail_IMP_Minus \\\n \\ \\ length_xs' = var_to_operand_bit_tail_v s;\\\n (length_prefix @ length_xs_str) ::= (A (V var_to_operand_bit_tail_v_str));;\n \\ \\ length_ret' = 0;\\\n (length_prefix @ length_ret_str) ::= (A (N 0));;\n \\ \\ length_state = \\length_xs = length_xs',\\\n \\ \\ length_ret = length_ret'\\;\\\n \\ \\ length_ret_state = length_imp length_state;\\\n (invoke_subprogram length_prefix length_IMP_Minus);;\n \\ \\ length_result = length_ret length_ret_state\\\n (var_to_operand_bit_tail_length_result) ::= (A (V (length_prefix @ length_ret_str)));;\n \\ \\(if length_result \\ 0 then\\\n (IF var_to_operand_bit_tail_length_result \\0 THEN\n var_to_operand_bit_tail_IMP_if\n \\ \\else\\\n ELSE\n var_to_operand_bit_tail_IMP_else\n )\n\"\n\nabbreviation \"var_to_operand_bit_tail_IMP_vars \\\n {var_to_operand_bit_tail_v_str, var_to_operand_bit_tail_ret_str,\n var_to_operand_bit_tail_length_result}\"\n\ndefinition \"var_to_operand_bit_tail_imp_to_HOL_state p s =\n \\var_to_operand_bit_tail_v = (s (add_prefix p var_to_operand_bit_tail_v_str)),\n var_to_operand_bit_tail_ret = (s (add_prefix p var_to_operand_bit_tail_ret_str))\\\"\n\nlemmas var_to_operand_bit_tail_state_translators =\n var_to_operand_bit_tail_imp_to_HOL_state_def\n length_imp_to_HOL_state_def\n var_to_operand_bit_tail_aux_imp_to_HOL_state_def\n\nlemma var_to_operand_bit_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p var_to_operand_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p var_to_operand_bit_tail_ret_str)\n = var_to_operand_bit_tail_ret\n (var_to_operand_bit_tail_imp (var_to_operand_bit_tail_imp_to_HOL_state p s))\"\n apply(subst var_to_operand_bit_tail_imp.simps)\n apply(simp only: var_to_operand_bit_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_IMP_vars\"])\n subgoal premises p using p(5) by fastforce\n apply(erule If_E)\n subgoal\n apply(erule Seq_E)+\n apply(erule var_to_operand_bit_tail_aux_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_IMP_vars\"])\n subgoal premises p using p(12) by fastforce\n by (fastforce_sorted_premises2 simp: var_to_operand_bit_tail_state_translators Let_def\n var_to_operand_bit_tail_state_upd_def) \n subgoal\n by (fastforce_sorted_premises2 simp: var_to_operand_bit_tail_state_translators Let_def\n var_to_operand_bit_tail_state_upd_def)\n done\n\nlemma var_to_operand_bit_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ var_to_operand_bit_tail_pref) var_to_operand_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix var_to_operand_bit_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemma var_to_operand_bit_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p var_to_operand_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = var_to_operand_bit_tail_imp_time 0 (var_to_operand_bit_tail_imp_to_HOL_state p s)\"\n apply(subst var_to_operand_bit_tail_imp_time.simps)\n apply(simp only: var_to_operand_bit_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule length_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_IMP_vars\"])\n subgoal premises p using p(9) by fastforce\n apply(erule If_tE)\n subgoal \n apply(erule Seq_tE)+\n apply(erule var_to_operand_bit_tail_aux_IMP_Minus_correct[where vars = \"var_to_operand_bit_tail_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n by (fastforce_sorted_premises2 simp: Let_def var_to_operand_bit_tail_state_translators)\n subgoal \n by (fastforce_sorted_premises2 simp: Let_def var_to_operand_bit_tail_state_translators)\n done\n\nlemma var_to_operand_bit_tail_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) var_to_operand_bit_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (var_to_operand_bit_tail_imp_time 0 (var_to_operand_bit_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) var_to_operand_bit_tail_ret_str) =\n var_to_operand_bit_tail_ret (var_to_operand_bit_tail_imp\n (var_to_operand_bit_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using var_to_operand_bit_tail_IMP_Minus_correct_function\n var_to_operand_bit_tail_IMP_Minus_correct_time\n var_to_operand_bit_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\n\n\nsubsection \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial\\\n\nsubsubsection \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc\\\n\nfun map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc':: \"nat \\ nat \\ nat \\ nat\" where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc' acc k n =\n (if n \\ 0\n then\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'\n ((prod_encode (fst_nat (hd_nat n), nth_bit_tail (snd_nat (hd_nat n)) k)) ## acc) k (tl_nat n)\n else acc\n )\"\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'_correct:\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc' acc k n =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc acc k n\"\n by(induction acc k n rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc.induct)\n (simp add: subtail_nth_bit)\n\nrecord map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc::nat\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k::nat\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n::nat\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret::nat\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix \\\n ''map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc.''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str \\ ''acc''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str \\ ''k''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str \\ ''n''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str \\ ''ret''\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd s \\\n let\n hd_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n hd_result = hd_ret hd_ret_state;\n tl_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n tl_ret' = 0;\n tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n tl_result = tl_ret tl_ret_state;\n fst'_state_p' = hd_result;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n snd'_state_p' = hd_result;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n snd'_result = snd'_state_p snd'_ret_state;\n nth_bit_tail_acc' = snd'_result;\n nth_bit_tail_n' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n nth_bit_tail_ret' = 0;\n nth_bit_tail_state = \\nth_bit_tail_acc = nth_bit_tail_acc',\n nth_bit_tail_n = nth_bit_tail_n',\n nth_bit_tail_ret = nth_bit_tail_ret'\\;\n nth_bit_tail_ret_state = nth_bit_tail_imp nth_bit_tail_state;\n nth_bit_tail_result = nth_bit_tail_ret nth_bit_tail_ret_state;\n prod_encode_a' = fst'_result;\n prod_encode_b' = nth_bit_tail_result;\n prod_encode_ret' = 0;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n prod_result = prod_encode_ret prod_encode_ret_state;\n cons_h' = prod_result;\n cons_t' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n cons_result = cons_ret cons_ret_state;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = cons_result;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' = tl_result;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret s;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\\n in ret\n\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition s \\\n let\n condition = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s\n in condition\n\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop s \\\n let\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\\n in ret\n\"\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop_def\n\nfunction map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp::\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state \\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state\"\n where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp s =\n (if map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition s \\ 0\n then\n let next_iteration =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd s)\n in next_iteration\n else\n let ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop s\n in ret\n )\"\n by simp+\ntermination\n apply (relation \"measure map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n\")\n by (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n hd_imp_correct tl_imp_correct fst'_imp_correct snd'_imp_correct nth_bit_tail_imp_correct\n prod_encode_imp_correct cons_imp_correct Let_def)+\n\ndeclare map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.simps [simp del]\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_correct[let_function_correctness]:\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp s) =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s)\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s)\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s)\"\n apply (induction s rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.induct)\n apply (subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.simps)\n apply (subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'.simps)\n by (simp del: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'.simps\n add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps Let_def\n fst_nat_fst'_nat snd_nat_snd'_nat hd_imp_correct tl_imp_correct fst'_imp_correct\n snd'_imp_correct nth_bit_tail_imp_correct prod_encode_imp_correct cons_imp_correct\n nth_bit_tail'_correct)\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd_time t s \\\n let\n hd_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n hd_result = hd_ret hd_ret_state;\n t = t + 2;\n tl_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n t = t + 2;\n tl_ret' = 0;\n t = t + 2;\n tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n t = t + tl_imp_time 0 tl_state;\n tl_result = tl_ret tl_ret_state;\n t = t + 2;\n fst'_state_p' = hd_result;\n t = t + 2;\n fst'_state = \\fst'_state_p = fst'_state_p'\\;\n fst'_ret_state = fst'_imp fst'_state;\n t = t + fst'_imp_time 0 fst'_state;\n fst'_result = fst'_state_p fst'_ret_state;\n t = t + 2;\n snd'_state_p' = hd_result;\n t = t + 2;\n snd'_state = \\snd'_state_p = snd'_state_p'\\;\n snd'_ret_state = snd'_imp snd'_state;\n t = t + snd'_imp_time 0 snd'_state;\n snd'_result = snd'_state_p snd'_ret_state;\n t = t + 2;\n nth_bit_tail_acc' = snd'_result;\n t = t + 2;\n nth_bit_tail_n' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n t = t + 2;\n nth_bit_tail_ret' = 0;\n t = t + 2;\n nth_bit_tail_state = \\nth_bit_tail_acc = nth_bit_tail_acc',\n nth_bit_tail_n = nth_bit_tail_n',\n nth_bit_tail_ret = nth_bit_tail_ret'\\;\n nth_bit_tail_ret_state = nth_bit_tail_imp nth_bit_tail_state;\n t = t + nth_bit_tail_imp_time 0 nth_bit_tail_state;\n nth_bit_tail_result = nth_bit_tail_ret nth_bit_tail_ret_state;\n t = t + 2;\n prod_encode_a' = fst'_result;\n t = t + 2;\n prod_encode_b' =nth_bit_tail_result;\n t = t + 2;\n prod_encode_ret' = 0;\n t = t + 2;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n t = t + prod_encode_imp_time 0 prod_encode_state;\n prod_result = prod_encode_ret prod_encode_ret_state;\n t = t + 2;\n cons_h' = prod_result;\n t = t + 2;\n cons_t' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n cons_result = cons_ret cons_ret_state;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = cons_result;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' = tl_result;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret s;\n t = t + 2;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\\n in\n t\n\"\n\ndefinition\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition_time t s \\\n let\n condition = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n t = t + 2\n in\n t\n\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop_time t s \\\n let\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\n t = t + 2;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\\n in\n t\n\"\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_time_simps =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd_time_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition_time_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop_time_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n\nfunction map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time::\n \"nat \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state \\ nat\" where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time t s =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition_time 0 s +\n (if map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time\n (t + map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd_time 0 s)\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n by (relation \"measure (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n \\ snd)\")\n (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_time_simps\n tl_imp_correct Let_def)+\n\ndeclare map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time.simps [simp del]\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time (Suc t) s) =\n Suc (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time t s)\"\n by (induction t s rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time.induct)\n ((subst (1 2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time.simps);\n (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_upd_def))\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_2_aux:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time t s) =\n t + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time 0 s)\"\n by (induction t arbitrary: s)\n (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc)+\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_2:\n \"t \\ 0 \\ (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time t s) =\n t + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time 0 s)\"\n by (rule map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_2_aux)\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_3:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time (a + b) s) =\n a + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time b s)\"\n by (induction a arbitrary: b s)\n (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc)+\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_while_cond \\ ''condition''\"\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_hd_result \\ ''hd_result''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_tl_result \\ ''tl_result''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_fst'_result \\ ''fst'_result''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_snd'_result \\ ''snd'_result''\"\nabbreviation\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_nth_bit_tail_result \\ ''nth_bit_tail_result''\"\nabbreviation\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prod_encode_result \\ ''prod_encode_result''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_cons_result \\ ''cons_result''\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond \\\n \\ \\condition = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_while_cond ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str))\n\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body \\\n \\ \\hd_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\\\n (hd_prefix @ hd_xs_str) ::= (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str));;\n \\ \\hd_ret' = 0;\\\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n \\ \\hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\\\n \\ \\hd_ret_state = hd_imp hd_state;\\\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n \\ \\hd_result = hd_ret hd_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_hd_result ::=\n (A (V (hd_prefix @ hd_ret_str)));;\n \\ \\tl_xs' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\\\n (tl_prefix @ tl_xs_str) ::= (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str));;\n \\ \\tl_ret' = 0;\\\n (tl_prefix @ tl_ret_str) ::= (A (N 0));;\n \\ \\tl_state = \\tl_xs = tl_xs', tl_ret = tl_ret'\\;\\\n \\ \\tl_ret_state = tl_imp tl_state;\\\n invoke_subprogram tl_prefix tl_IMP_Minus;;\n \\ \\tl_result = tl_ret tl_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_tl_result ::=\n (A (V (tl_prefix @ tl_ret_str)));;\n \\ \\fst'_state_p' = hd_result;\\\n (fst'_prefix @ fst'_p_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_hd_result));;\n \\ \\fst'_state = \\fst'_state_p = fst'_state_p'\\;\\\n \\ \\fst'_ret_state = fst'_imp fst'_state;\\\n invoke_subprogram fst'_prefix fst'_IMP_Minus;;\n \\ \\fst'_result = fst'_state_p fst'_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_fst'_result ::=\n (A (V (fst'_prefix @ fst'_p_str)));;\n \\ \\snd'_state_p' = hd_result;\\\n (snd'_prefix @ snd'_p_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_hd_result));;\n \\ \\snd'_state = \\snd'_state_p = snd'_state_p'\\;\\\n \\ \\snd'_ret_state = snd'_imp snd'_state;\\\n invoke_subprogram snd'_prefix snd'_IMP_Minus;;\n \\ \\snd'_result = snd'_state_p snd'_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_snd'_result ::=\n (A (V (snd'_prefix @ snd'_p_str)));;\n \\ \\nth_bit_tail_acc' = snd'_result;\\\n (nth_bit_tail_prefix @ nth_bit_tail_acc_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_snd'_result));;\n \\ \\nth_bit_tail_n' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\\\n (nth_bit_tail_prefix @ nth_bit_tail_n_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str));;\n \\ \\nth_bit_tail_ret' = 0;\\\n (nth_bit_tail_prefix @ nth_bit_tail_ret_str) ::= (A (N 0));;\n \\ \\nth_bit_tail_state = \\nth_bit_tail_acc = nth_bit_tail_acc',\\\n \\ \\ nth_bit_tail_n = nth_bit_tail_n',\\\n \\ \\ nth_bit_tail_ret = nth_bit_tail_ret'\\;\\\n \\ \\nth_bit_tail_ret_state = nth_bit_tail_imp nth_bit_tail_state;\\\n invoke_subprogram nth_bit_tail_prefix nth_bit_tail_IMP_Minus;;\n \\ \\nth_bit_tail_result = nth_bit_tail_ret nth_bit_tail_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_nth_bit_tail_result ::=\n (A (V (nth_bit_tail_prefix @ nth_bit_tail_ret_str)));;\n \\ \\prod_encode_a' = fst'_result;\\\n (prod_encode_prefix @ prod_encode_a_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_fst'_result));;\n \\ \\prod_encode_b' =nth_bit_tail_result;\\\n (prod_encode_prefix @ prod_encode_b_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_nth_bit_tail_result));;\n \\ \\prod_encode_ret' = 0;\\\n (prod_encode_prefix @ prod_encode_ret_str) ::= (A (N 0));;\n \\ \\prod_encode_state = \\prod_encode_a = prod_encode_a',\\\n \\ \\ prod_encode_b = prod_encode_b',\\\n \\ \\ prod_encode_ret = prod_encode_ret'\\;\\\n \\ \\prod_encode_ret_state = prod_encode_imp prod_encode_state;\\\n invoke_subprogram prod_encode_prefix prod_encode_IMP_Minus;;\n \\ \\prod_result = prod_encode_ret prod_encode_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prod_encode_result ::=\n (A (V (prod_encode_prefix @ prod_encode_ret_str)));;\n \\ \\cons_h' = prod_result;\\\n (cons_prefix @ cons_h_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prod_encode_result));;\n \\ \\cons_t' = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\\\n (cons_prefix @ cons_t_str) ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str));;\n \\ \\cons_ret' = 0;\\\n (cons_prefix @ cons_ret_str) ::= (A (N 0));;\n \\ \\cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\\\n \\ \\cons_ret_state = cons_imp cons_state;\\\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n \\ \\cons_result = cons_ret cons_ret_state;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_cons_result ::=\n (A (V (cons_prefix @ cons_ret_str)));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = cons_result;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_cons_result));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' = tl_result;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_tl_result));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str))\n\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_after_loop \\\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str));;\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc s;\\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str ::=\n (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str))\n\"\n\ndefinition map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus \\\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond;;\n WHILE map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_while_cond \\0 DO (\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body;;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond\n );;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_after_loop\"\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars \\\n {map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_hd_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_tl_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_fst'_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_snd'_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_nth_bit_tail_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prod_encode_result,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_cons_result}\"\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_subprogram_simps =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_after_loop_def\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state p s =\n \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc =\n (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str)),\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k =\n (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str)),\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n =\n (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str)),\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret =\n (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str))\\\"\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n tl_imp_to_HOL_state_def\n fst'_imp_to_HOL_state_def\n snd'_imp_to_HOL_state_def\n nth_bit_tail_imp_to_HOL_state_def\n prod_encode_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_complete_simps =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_subprogram_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators\n\ndeclare nth_bit_tail_IMP_Minus_correct[functional_correctness]\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_cong:\n \"\\a1 = a2; b1 = b2; c1 = c2; d1 = d2\\\n \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc = a1,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k = b1,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n = c1,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret = d1 \\ =\n \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc = a2,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k = b2,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n = c2,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret = d2 \\\"\n by blast\n\ndeclare\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_cong[let_lemmas]\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state.simps[state_simps]\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state.defs(1)[symmetric, state_defs]\n arg_cong4[where f=map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state.make, state_congs]\n arg_cong[where f=map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp, let_lemmas]\n arg_cong[where f=map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret, let_lemmas]\n arg_cong[where f=map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp, state_congs]\n arg_cong[where f=map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret, state_congs]\n\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_function:\n \"(invoke_subprogram p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s'\n \\ s' (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str)\n = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state p s))\"\n apply(induction \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.induct)\n apply(subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.simps)\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule While_tE)\n\n subgoal\n by(fastforce simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_subprogram_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators)\n\n apply(erule Seq_E)+\n apply(dest_com_gen)\n\n subgoal\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def prefix_simps)\n by(fastforce simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_complete_simps)\n\n subgoal\n apply(subst (asm) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def)\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(38) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(40) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(42) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(44) by fastforce\n apply(erule nth_bit_tail_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(46) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(48) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(50) by fastforce\n by (fastforce_sorted_premises2 simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n Let_def map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators)\n\n subgoal\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def prefix_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule hd_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(38) by fastforce\n apply(erule tl_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(40) by fastforce\n apply(erule fst'_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(42) by fastforce\n apply(erule snd'_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(44) by fastforce\n apply(erule nth_bit_tail_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(46) by fastforce\n apply(erule prod_encode_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(48) by fastforce\n apply(erule cons_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars\"])\n subgoal premises p using p(50) by fastforce\n by (fastforce_sorted_premises2 simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps\n Let_def map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators)\n done\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_pref)\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_complete_time_simps =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_time_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_2\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time_acc_3\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_time:\n \"(invoke_subprogram p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s'\n \\ t = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time 0\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state p s)\"\n apply(induction \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state p s\"\n arbitrary: s s' t rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp.induct)\n apply(subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time.simps)\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n\n subgoal\n apply(subst (asm) (3) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def)\n apply(subst (asm) (2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_after_loop_def)\n apply(simp only: prefix_simps)\n apply(erule Seq_tE)+\n by (force simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_subprogram_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_time_simps\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators)\n\n apply(erule Seq_tE)+\n apply(simp add: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(subst (asm) (1) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def)\n apply(simp only: prefix_simps)\n by(fastforce simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_complete_simps)\n\n subgoal\n apply(subst (asm) (1) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def)\n apply(subst (asm) (1) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body_def)\n apply(simp only: prefix_simps)\n apply(vcg map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars)\n subgoal\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_subprogram_simps Let_def)\n by(timeit \\propagate_state_pipeline p state_translators: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state_translators\\)\n done\n\n subgoal\n apply(subst (asm) (1) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_init_while_cond_def)\n apply(subst (asm) (1) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_loop_body_def)\n apply(simp only: prefix_simps)\n apply(vcg_time map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_vars)\n by(timeit \\fastforce_sorted_premises simp: Let_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_complete_time_simps\\)\n done\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2)\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time 0\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str) =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_function\n by (auto simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_time)\n (meson map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct_effects\n set_mono_prefix)\n\nsubsubsection \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail\\\n\nrecord map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k::nat\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys::nat\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret::nat\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_prefix \\\n ''map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail.''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k_str \\ ''k''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys_str \\ ''ys''\"\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str \\ ''ret''\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_upd s =\n (let\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = 0;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' = 0;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state =\n \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state;\n reverse_nat_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state;\n reverse_nat_ret' = 0;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret'\\\n in\n ret\n )\"\n\nfunction map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp ::\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state\" where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp s =\n (let \n ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_upd s\n in \n ret\n )\"\n by simp+\ntermination\n by (relation \"measure map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k\") simp\n\ndeclare map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp.simps [simp del]\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_correct[let_function_correctness]:\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp s) =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail \n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s)\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s)\"\n apply (simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp.simps Let_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_correct reverse_nat_imp_correct\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_upd_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc'_correct)\n by (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_def)\n\nfunction map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time ::\n \"nat \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state \\ nat\" where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time t s =\n (let\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = 0;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' = 0;\n t = t + 2;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state =\n \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state;\n t = t + \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_time 0 map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state;\n reverse_nat_n' =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state;\n t = t + 2;\n reverse_nat_ret' = 0;\n t = t + 2;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n t = t + reverse_nat_imp_time 0 reverse_nat_state;\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n t = t + 2;\n ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret'\\\n in\n t\n )\"\n by auto\ntermination\n by (relation \"measure (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k \\ snd)\") simp\n\ndeclare map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time.simps [simp del]\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time (Suc t) s) = Suc (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time t s)\"\n by (induction t s rule: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time.induct)\n ((subst (1 2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time.simps);\n (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_upd_def Let_def)) \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc_2_aux:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time t s) = t + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc)+ \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc_2:\n \"t \\ 0 \\ (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time t s) = t + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time 0 s)\"\n by (rule map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc_2_aux) \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc_3:\n \"(map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time (a + b) s) = a + (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time_acc)+ \n\ndefinition map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus where\n \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus \\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc' = 0;\\\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix @ \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc_str) ::= (A (N 0));;\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k' =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s;\\\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix @ \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k_str) ::= (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k_str));;\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n' =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s;\\\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix @ \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n_str) ::= (A (V map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys_str));;\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret' = 0;\\\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix @ \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str) ::= (A (N 0));;\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state =\\\n \\ \\ \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_acc',\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_k',\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_n',\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret'\\;\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_state;\\\n (invoke_subprogram map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix \n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus);;\n \\ \\ reverse_nat_n' =\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_state;\\\n (reverse_nat_prefix @ reverse_nat_n_str) ::= (A (V (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_prefix @\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_ret_str)));;\n \\ \\ reverse_nat_ret' = 0;\\\n (reverse_nat_prefix @ reverse_nat_ret_str) ::= (A (N 0));;\n \\ \\ reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\\\n \\ \\ reverse_nat_ret = reverse_nat_ret'\\;\\\n \\ \\ reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\\\n (invoke_subprogram reverse_nat_prefix reverse_nat_IMP_Minus);;\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\\\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str) ::= (A (V (reverse_nat_prefix @ reverse_nat_ret_str)))\n \\ \\ ret = \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k s,\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys s,\\\n \\ \\ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret'\\\\\n\"\n\nabbreviation \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_vars \\\n {map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k_str, map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys_str,\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str}\"\n\ndefinition \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state p s =\n \\map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k = (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_k_str)),\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys = (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ys_str)),\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret = (s (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str))\\\"\n\nlemmas map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_translators =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state_def\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_imp_to_HOL_state_def\n reverse_nat_imp_to_HOL_state_def\n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_function:\n \"(invoke_subprogram p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str)\n = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state p s))\"\n apply(subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp.simps)\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_vars\"])\n subgoal premises p using p(9) by fastforce\n apply(erule reverse_nat_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_vars\"])\n subgoal premises p using p(11) by fastforce\n by(fastforce simp: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_translators\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_upd_def) \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_pref) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time 0 (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state p s)\"\n apply(subst map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time.simps)\n apply(simp only: map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule map_IMP_Minus_State_To_IMP_Minus_Minus_partial_acc_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_vars\"])\n subgoal premises p using p(17) by fastforce\n apply(erule reverse_nat_IMP_Minus_correct[where vars = \"map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_vars\"])\n subgoal premises p using p(19) by fastforce\n by(fastforce simp add: Let_def map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_state_translators) \n\nlemma map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_time 0 (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret_str) =\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_ret (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp\n (map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_function\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_time\n map_IMP_Minus_State_To_IMP_Minus_Minus_partial_tail_IMP_Minus_correct_effects\n by (meson set_mono_prefix)\n\nsubsection \\IMP_Minus_State_To_IMP_Minus_Minus_partial\\\n\nsubsubsection \\IMP_Minus_State_To_IMP_Minus_Minus_partial_tail\\\n\n(* TODO *)\n\n\nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP-_To_IMP--/IMP_Minus_To_IMP_Minus_Minus_State_Translations_IMP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2901763622493575}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory StringMap\n\n(* assumes CParser or AutoCorres to find StaticFun *)\nimports StaticFun\n\nbegin\n\ndatatype LexOrdString = LexOrdString \"string\"\n\ninstantiation LexOrdString :: linorder begin\n\ndefinition\n less_LexOrdString_def[simp]:\n \"(s < t) = (case s of LexOrdString s' \\ case t of LexOrdString t' \\\n (s', t') \\ lexord {(c, c'). nat_of_char c < nat_of_char c'})\"\n\ndefinition\n le_LexOrdString_def[simp]:\n \"(s \\ t) = ((s :: LexOrdString) < t \\ s = t)\"\n\nlemma nat_of_char_trans:\n \"transP (\\c c'. nat_of_char c < nat_of_char c')\"\n by (auto intro!: transI)\n\ninstance\n apply intro_classes\n apply (clarsimp split: LexOrdString.split)\n apply safe[1]\n apply (drule(1) lexord_trans[OF _ _ nat_of_char_trans])\n apply (simp add: lexord_irreflexive)\n apply (simp add: lexord_irreflexive)\n apply (clarsimp)\n apply (clarsimp split: LexOrdString.split_asm)\n apply safe[1]\n apply (erule(1) lexord_trans)\n apply (rule nat_of_char_trans)\n apply (clarsimp split: LexOrdString.split_asm)\n apply safe[1]\n apply (drule(1) lexord_trans[OF _ _ nat_of_char_trans])\n apply (simp add: lexord_irreflexive)\n apply (clarsimp split: LexOrdString.split)\n apply (cut_tac x=list and y=lista in lexord_linear)\n defer\n apply blast\n apply (auto simp: nat_of_char_eq_iff)\n done\n\nend\n\nML {*\n\nstructure StringMap = struct\n\nfun define_string_map name assocs ctxt = let\n val th_names = map (prefix (Binding.name_of name ^ \"_\") o fst) assocs\n val mappings = map (apfst HOLogic.mk_string) assocs\n in StaticFun.define_tree_and_save_thms name th_names mappings\n @{term LexOrdString} @{thms nat_of_char_def} ctxt end\n\nend\n\n*}\n\ntext {* Testing *}\n\n(*\nlocal_setup {* StringMap.define_string_map @{binding foo}\n [(\"x\", @{term \"1 :: nat\"}), (\"y\", @{term \"2 :: nat\"})]\n #> snd\n*}\n*)\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/cogent/isa/StringMap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6187804478040617, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2900784738701338}} {"text": "theory Incredible_Completeness\nimports Natural_Deduction Incredible_Deduction Build_Incredible_Tree\nbegin\n\ntext \\\nThis theory takes the tree produced in @{theory Incredible_Proof_Machine.Build_Incredible_Tree}, globalizes it using\n@{term globalize}, and then builds the incredible proof graph out of it.\n\\\n\ntype_synonym 'form vertex = \"('form \\ nat list)\"\ntype_synonym ('form, 'var) edge'' = \"('form vertex, 'form, 'var) edge'\"\n\nlocale Solved_Task =\n Abstract_Task freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP antecedent consequent rules assumptions conclusions\n for freshenLC :: \"nat \\ 'var \\ 'var\" \n and renameLCs :: \"('var \\ 'var) \\ 'form \\ 'form\" \n and lconsts :: \"'form \\ 'var set\" \n and closed :: \"'form \\ bool\"\n and subst :: \"'subst \\ 'form \\ 'form\" \n and subst_lconsts :: \"'subst \\ 'var set\" \n and subst_renameLCs :: \"('var \\ 'var) \\ ('subst \\ 'subst)\"\n and anyP :: \"'form\"\n and antecedent :: \"'rule \\ ('form, 'var) antecedent list\" \n and consequent :: \"'rule \\ 'form list\" \n and rules :: \"'rule stream\" \n and assumptions :: \"'form list\" \n and conclusions :: \"'form list\" +\n assumes solved: solved\nbegin\n\ntext \\Let us get our hand on concrete trees.\\\n\ndefinition ts :: \"'form \\ (('form entailment) \\ ('rule \\ 'form) NatRule) tree\" where\n \"ts c = (SOME t. snd (fst (root t)) = c \\ fst (fst (root t)) |\\| ass_forms \\ wf t \\ tfinite t)\"\n\nlemma\n assumes \"c |\\| conc_forms\"\n shows ts_conc: \"snd (fst (root (ts c))) = c\"\n and ts_context: \"fst (fst (root (ts c))) |\\| ass_forms\"\n and ts_wf: \"wf (ts c)\"\n and ts_finite[simp]: \"tfinite (ts c)\"\n unfolding atomize_conj conj_assoc ts_def\n apply (rule someI_ex)\n using solved assms\n by (force simp add: solved_def)\n\nabbreviation it' where\n \"it' c \\ globalize [fidx conc_forms c, 0] (freshenLC v_away) (to_it (ts c))\"\n\n\n\ndefinition vertices :: \"'form vertex fset\" where\n \"vertices = Abs_fset (Union ( set (map (\\ c. insert (c, []) ((\\ p. (c, 0 # p)) ` (it_paths (it' c)))) conclusions)))\"\n\nlemma mem_vertices: \"v |\\| vertices \\ (fst v \\ set conclusions \\ (snd v = [] \\ snd v \\ ((#) 0) ` it_paths (it' (fst v))))\"\n unfolding vertices_def fmember.rep_eq ffUnion.rep_eq \n by (cases v)(auto simp add: Abs_fset_inverse Bex_def )\n\nlemma prefixeq_vertices: \"(c,is) |\\| vertices \\ prefix is' is \\ (c, is') |\\| vertices\"\n by (cases is') (auto simp add: mem_vertices intro!: imageI elim: it_paths_prefix)\n\nlemma none_vertices[simp]: \"(c, []) |\\| vertices \\ c \\ set conclusions\"\n by (simp add: mem_vertices)\n\nlemma some_vertices[simp]: \"(c, i#is) |\\| vertices \\ c \\ set conclusions \\ i = 0 \\ is \\ it_paths (it' c)\"\n by (auto simp add: mem_vertices)\n\nlemma vertices_cases[consumes 1, case_names None Some]:\n assumes \"v |\\| vertices\"\n obtains c where \"c \\ set conclusions\" and \"v = (c, [])\"\n | c \"is\" where \"c \\ set conclusions\" and \"is \\ it_paths (it' c)\" and \"v = (c, 0#is)\"\nusing assms by (cases v; rename_tac \"is\"; case_tac \"is\"; auto)\n\nlemma vertices_induct[consumes 1, case_names None Some]:\n assumes \"v |\\| vertices\"\n assumes \"\\ c. c \\ set conclusions \\ P (c, [])\"\n assumes \"\\ c is . c \\ set conclusions \\ is \\ it_paths (it' c) \\ P (c, 0#is)\"\n shows \"P v\"\nusing assms by (cases v; rename_tac \"is\"; case_tac \"is\"; auto)\n\nfun nodeOf :: \"'form vertex \\ ('form, 'rule) graph_node\" where\n \"nodeOf (pf, []) = Conclusion pf\"\n| \"nodeOf (pf, i#is) = iNodeOf (tree_at (it' pf) is)\"\n\nfun inst where\n \"inst (c,[]) = empty_subst\"\n |\"inst (c, i#is) = iSubst (tree_at (it' c) is)\" \n\nlemma terminal_is_nil[simp]: \"v |\\| vertices \\ outPorts (nodeOf v) = {||} \\ snd v = []\"\n by (induction v rule: nodeOf.induct)\n (auto elim: iNodeOf_outPorts[rotated] iwf_it)\n\nsublocale Vertex_Graph nodes inPorts outPorts vertices nodeOf.\n\ndefinition edge_from :: \"'form \\ nat list => ('form vertex \\ ('form,'var) out_port)\" where \n \"edge_from c is = ((c, 0 # is), Reg (iOutPort (tree_at (it' c) is)))\"\n\nlemma fst_edge_from[simp]: \"fst (edge_from c is) = (c, 0 # is)\"\n by (simp add: edge_from_def)\n\nfun in_port_at :: \"('form \\ nat list) \\ nat \\ ('form,'var) in_port\" where\n \"in_port_at (c, []) _ = plain_ant c\"\n | \"in_port_at (c, _#is) i = inPorts' (iNodeOf (tree_at (it' c) is)) ! i\"\n\ndefinition edge_to :: \"'form \\ nat list => ('form vertex \\ ('form,'var) in_port)\" where\n \"edge_to c is =\n (case rev is of [] \\ ((c, []), in_port_at (c, []) 0)\n | i#is \\ ((c, 0 # (rev is)), in_port_at (c, (0#rev is)) i))\"\n\nlemma edge_to_Nil[simp]: \"edge_to c [] = ((c, []), plain_ant c)\"\n by (simp add: edge_to_def)\n\nlemma edge_to_Snoc[simp]: \"edge_to c (is@[i]) = ((c, 0 # is), in_port_at ((c, 0 # is)) i)\"\n by (simp add: edge_to_def)\n\ndefinition edge_at :: \"'form \\ nat list => ('form, 'var) edge''\" where\n \"edge_at c is = (edge_from c is, edge_to c is)\"\n\nlemma fst_edge_at[simp]: \"fst (edge_at c is) = edge_from c is\" by (simp add: edge_at_def)\nlemma snd_edge_at[simp]: \"snd (edge_at c is) = edge_to c is\" by (simp add: edge_at_def)\n\n\nlemma hyps_exist':\n assumes \"c \\ set conclusions\"\n assumes \"is \\ it_paths (it' c)\"\n assumes \"tree_at (it' c) is = (HNode i s ants)\"\n shows \"subst s (freshen i anyP) \\ hyps_along (it' c) is\"\nproof-\n from assms(1)\n have \"plain_iwf (it' c) (fst (root (ts c)))\" by (rule iwf_it)\n moreover\n note assms(2,3)\n moreover\n have \"fst (fst (root (ts c))) |\\| ass_forms\"\n by (simp add: assms(1) ts_context)\n ultimately\n show ?thesis by (rule iwf_hyps_exist)\nqed\n\n\ndefinition hyp_edge_to :: \"'form \\ nat list => ('form vertex \\ ('form,'var) in_port)\" where\n \"hyp_edge_to c is = ((c, 0 # is), plain_ant anyP)\"\n\n(* TODO: Replace n and s by \"subst s (freshen n anyP)\" *)\ndefinition hyp_edge_from :: \"'form \\ nat list => nat \\ 'subst \\ ('form vertex \\ ('form,'var) out_port)\" where\n \"hyp_edge_from c is n s = \n ((c, 0 # hyp_port_path_for (it' c) is (subst s (freshen n anyP))),\n hyp_port_h_for (it' c) is (subst s (freshen n anyP)))\"\n\ndefinition hyp_edge_at :: \"'form \\ nat list => nat \\ 'subst \\ ('form, 'var) edge''\" where\n \"hyp_edge_at c is n s = (hyp_edge_from c is n s, hyp_edge_to c is)\"\n\nlemma fst_hyp_edge_at[simp]:\n \"fst (hyp_edge_at c is n s) = hyp_edge_from c is n s\" by (simp add:hyp_edge_at_def) \nlemma snd_hyp_edge_at[simp]:\n \"snd (hyp_edge_at c is n s) = hyp_edge_to c is\" by (simp add:hyp_edge_at_def)\n\ninductive_set edges where\n regular_edge: \"c \\ set conclusions \\ is \\ it_paths (it' c) \\ edge_at c is \\ edges\"\n | hyp_edge: \"c \\ set conclusions \\ is \\ it_paths (it' c) \\ tree_at (it' c) is = HNode n s ants \\ hyp_edge_at c is n s \\ edges\"\n\nsublocale Pre_Port_Graph nodes inPorts outPorts vertices nodeOf edges.\n\nlemma edge_from_valid_out_port:\n assumes \"p \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n shows \"valid_out_port (edge_from c p)\"\nusing assms\nby (auto simp add: edge_from_def intro: iwf_outPort iwf_it)\n\nlemma edge_to_valid_in_port:\n assumes \"p \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n shows \"valid_in_port (edge_to c p)\"\n using assms\n apply (auto simp add: edge_to_def inPorts_fset_of split: list.split elim!: it_paths_SnocE)\n apply (rule nth_mem)\n apply (drule (1) iwf_length_inPorts[OF iwf_it])\n apply auto\n done\n\nlemma hyp_edge_from_valid_out_port:\n assumes \"is \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n assumes \"tree_at (it' c) is = HNode n s ants\"\n shows \"valid_out_port (hyp_edge_from c is n s)\"\nusing assms\nby(auto simp add: hyp_edge_from_def intro: hyp_port_outPort it_paths_strict_prefix hyp_port_strict_prefix hyps_exist')\n\nlemma hyp_edge_to_valid_in_port:\n assumes \"is \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n assumes \"tree_at (it' c) is = HNode n s ants\"\n shows \"valid_in_port (hyp_edge_to c is)\"\nusing assms by (auto simp add: hyp_edge_to_def)\n\n\ninductive scope' :: \"'form vertex \\ ('form,'var) in_port \\ 'form \\ nat list \\ bool\" where\n \"c \\ set conclusions \\\n is' \\ ((#) 0) ` it_paths (it' c) \\\n prefix (is@[i]) is' \\ \n ip = in_port_at (c,is) i \\\n scope' (c, is) ip (c, is')\"\n\ninductive_simps scope_simp: \"scope' v i v'\"\ninductive_cases scope_cases: \"scope' v i v'\"\n\nlemma scope_valid:\n \"scope' v i v' \\ v' |\\| vertices\"\nby (auto elim: scope_cases)\n\nlemma scope_valid_inport:\n \"v' |\\| vertices \\ scope' v ip v' \\ (\\ i. fst v = fst v' \\ prefix (snd v@[i]) (snd v') \\ ip = in_port_at v i)\"\nby (cases v; cases v') (auto simp add: scope'.simps mem_vertices)\n\ndefinition terminal_path_from :: \"'form \\ nat list => ('form, 'var) edge'' list\" where\n \"terminal_path_from c is = map (edge_at c) (rev (prefixes is))\"\n\nlemma terminal_path_from_Nil[simp]:\n \"terminal_path_from c [] = [edge_at c []]\"\n by (simp add: terminal_path_from_def)\n\nlemma terminal_path_from_Snoc[simp]:\n \"terminal_path_from c (is @ [i]) = edge_at c (is@[i]) # terminal_path_from c is\"\n by (simp add: terminal_path_from_def)\n\nlemma path_terminal_path_from:\n \"c \\ set conclusions \\\n is \\ it_paths (it' c) \\\n path (c, 0 # is) (c, []) (terminal_path_from c is)\"\nby (induction \"is\" rule: rev_induct)\n (auto simp add: path_cons_simp intro!: regular_edge elim: it_paths_SnocE)\n\nlemma edge_step:\n assumes \"(((a, b), ba), ((aa, bb), bc)) \\ edges\"\n obtains \n i where \"a = aa\" and \"b = bb@[i]\" and \"bc = in_port_at (aa,bb) i\" and \"hyps (nodeOf (a, b)) ba = None\"\n | i where \"a = aa\" and \"prefix (b@[i]) bb\" and \"hyps (nodeOf (a, b)) ba = Some (in_port_at (a,b) i)\"\nusing assms\nproof(cases rule: edges.cases[consumes 1, case_names Reg Hyp])\n case (Reg c \"is\")\n then obtain i where \"a = aa\" and \"b = bb@[i]\" and \"bc = in_port_at (aa,bb) i\" and \"hyps (nodeOf (a, b)) ba = None\"\n by (auto elim!: edges.cases simp add: edge_at_def edge_from_def edge_to_def split: list.split list.split_asm)\n thus thesis by (rule that)\nnext\n case (Hyp c \"is\" n s)\n let ?i = \"hyp_port_i_for (it' c) is (subst s (freshen n anyP))\"\n from Hyp have \"a = aa\" and \"prefix (b@[?i]) bb\" and\n \"hyps (nodeOf (a, b)) ba = Some (in_port_at (a,b) ?i)\"\n by (auto simp add: edge_at_def edge_from_def edge_to_def hyp_edge_at_def hyp_edge_to_def hyp_edge_from_def\n intro: hyp_port_prefix hyps_exist' hyp_port_hyps)\n thus thesis by (rule that)\nqed\n\nlemma path_has_prefixes:\n assumes \"path v v' pth\"\n assumes \"snd v' = []\"\n assumes \"prefix (is' @ [i]) (snd v)\"\n shows \"((fst v, is'), (in_port_at (fst v, is') i)) \\ snd ` set pth\"\n using assms\n by (induction rule: path.induct)(auto elim!: edge_step dest: prefix_snocD)\n \nlemma in_scope: \"valid_in_port (v', p') \\ v \\ scope (v', p') \\ scope' v' p' v\"\nproof\n assume \"v \\ scope (v', p')\"\n hence \"v |\\| vertices\" and \"\\ pth t. path v t pth \\ terminal_vertex t \\ (v', p') \\ snd ` set pth\"\n by (auto simp add: scope.simps)\n from this\n show \"scope' v' p' v\"\n proof (induction rule: vertices_induct)\n case (None c)\n from None(2)[of \"(c, [])\" \"[]\", simplified, OF None(1)]\n have False.\n thus \"scope' v' p' (c, [])\"..\n next\n case (Some c \"is\")\n\n from \\c \\ set conclusions\\ \\is \\ it_paths (it' c)\\\n have \"path (c, 0#is) (c, []) (terminal_path_from c is)\"\n by (rule path_terminal_path_from)\n moreover\n from \\c \\ set conclusions\\\n have \"terminal_vertex (c, [])\" by simp\n ultimately\n have \"(v', p') \\ snd ` set (terminal_path_from c is)\"\n by (rule Some(3))\n hence \"(v',p') \\ set (map (edge_to c) (prefixes is))\"\n unfolding terminal_path_from_def by auto\n then obtain is' where \"prefix is' is\" and \"(v',p') = edge_to c is'\"\n by auto\n show \"scope' v' p' (c, 0#is)\"\n proof(cases \"is'\" rule: rev_cases)\n case Nil\n with \\(v',p') = edge_to c is'\\\n have \"v' = (c, [])\" and \"p' = plain_ant c\"\n by (auto simp add: edge_to_def)\n with \\c \\ set conclusions\\ \\is \\ it_paths (it' c)\\\n show ?thesis by (auto intro!: scope'.intros)\n next\n case (snoc is'' i)\n with \\(v',p') = edge_to c is'\\\n have \"v' = (c, 0 # is'')\" and \"p' = in_port_at v' i\"\n by (auto simp add: edge_to_def)\n with \\c \\ set conclusions\\ \\is \\ it_paths (it' c)\\ \\prefix is' is\\[unfolded snoc]\n show ?thesis\n by (auto intro!: scope'.intros)\n qed\n qed\nnext\n assume \"valid_in_port (v', p')\"\n assume \"scope' v' p' v\"\n then obtain c is' i \"is\" where\n \"v' = (c, is')\" and \"v = (c, is)\" and \"c \\ set conclusions\" and\n \"p' = in_port_at v' i\" and\n \"is \\ (#) 0 ` it_paths (it' c)\" and \"prefix (is' @ [i]) is\"\n by (auto simp add: scope'.simps)\n\n from \\scope' v' p' v\\\n have \"(c, is) |\\| vertices\" unfolding \\v = _\\ by (rule scope_valid)\n hence \"(c, is) \\ scope ((c, is'), p')\"\n proof(rule scope.intros)\n fix pth t\n assume \"path (c,is) t pth\"\n \n assume \"terminal_vertex t\"\n hence \"snd t = []\" by auto\n\n from path_has_prefixes[OF \\path (c,is) t pth\\ \\snd t = []\\, simplified, OF \\prefix (is' @ [i]) is\\]\n show \"((c, is'), p') \\ snd ` set pth\" unfolding \\p' = _ \\ \\v' = _ \\.\n qed\n thus \"v \\ scope (v', p')\" using \\v =_\\ \\v' = _\\ by simp\nqed\n\nsublocale Port_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n show \"nodeOf ` fset vertices \\ sset nodes\"\n apply (auto simp add: fmember.rep_eq[symmetric] mem_vertices)\n apply (auto simp add: stream.set_map dest: iNodeOf_tree_at[OF iwf_it])\n done\n next\n\n have \"\\ e \\ edges. valid_out_port (fst e) \\ valid_in_port (snd e)\"\n by (auto elim!: edges.cases simp add: edge_at_def\n dest: edge_from_valid_out_port edge_to_valid_in_port\n dest: hyp_edge_from_valid_out_port hyp_edge_to_valid_in_port)\n \n thus \"\\(ps1, ps2)\\edges. valid_out_port ps1 \\ valid_in_port ps2\" by auto\nqed\n \n\nsublocale Scoped_Graph nodes inPorts outPorts vertices nodeOf edges hyps..\n\nlemma hyps_free_path_length:\n assumes \"path v v' pth\"\n assumes \"hyps_free pth\"\n shows \"length pth + length (snd v') = length (snd v)\"\nusing assms by induction (auto elim!: edge_step )\n\nfun vidx :: \"'form vertex \\ nat\" where\n \"vidx (c, []) = isidx [fidx conc_forms c]\"\n |\"vidx (c, _#is) = iAnnot (tree_at (it' c) is)\"\n\nlemma my_vidx_inj: \"inj_on vidx (fset vertices)\"\n by (rule inj_onI)\n (auto simp add: mem_vertices[unfolded fmember.rep_eq] iAnnot_globalize simp del: iAnnot.simps)\n\nlemma vidx_not_v_away[simp]: \"v |\\| vertices \\ vidx v \\ v_away\"\n by (cases v rule:vidx.cases) (auto simp add: iAnnot_globalize simp del: iAnnot.simps)\n\nsublocale Instantiation inPorts outPorts nodeOf hyps nodes edges vertices labelsIn labelsOut freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP vidx inst\nproof\n show \"inj_on vidx (fset vertices)\" by (rule my_vidx_inj)\nqed\n\nsublocale Well_Scoped_Graph nodes inPorts outPorts vertices nodeOf edges hyps\nproof\n fix v\\<^sub>1 p\\<^sub>1 v\\<^sub>2 p\\<^sub>2 p'\n assume assms: \"((v\\<^sub>1, p\\<^sub>1), (v\\<^sub>2, p\\<^sub>2)) \\ edges\" \"hyps (nodeOf v\\<^sub>1) p\\<^sub>1 = Some p'\"\n from assms(1) hyps_correct[OF assms(2)]\n have \"valid_out_port (v\\<^sub>1, p\\<^sub>1)\" and \"valid_in_port (v\\<^sub>2, p\\<^sub>2)\" and \"valid_in_port (v\\<^sub>1, p')\" and \"v\\<^sub>2 |\\| vertices\"\n using valid_edges by auto\n\n from assms\n have \"\\ i. fst v\\<^sub>1 = fst v\\<^sub>2 \\ prefix (snd v\\<^sub>1@[i]) (snd v\\<^sub>2) \\ p' = in_port_at v\\<^sub>1 i\"\n by (cases v\\<^sub>1; cases v\\<^sub>2; auto elim!: edge_step)\n hence \"scope' v\\<^sub>1 p' v\\<^sub>2\"\n unfolding scope_valid_inport[OF \\v\\<^sub>2 |\\| vertices\\].\n hence \"v\\<^sub>2 \\ scope (v\\<^sub>1, p')\"\n unfolding in_scope[OF \\valid_in_port (v\\<^sub>1, p')\\].\n thus \"(v\\<^sub>2, p\\<^sub>2) = (v\\<^sub>1, p') \\ v\\<^sub>2 \\ scope (v\\<^sub>1, p')\" ..\nqed\n\nsublocale Acyclic_Graph nodes inPorts outPorts vertices nodeOf edges hyps \nproof\n fix v pth\n assume \"path v v pth\" and \"hyps_free pth\"\n from hyps_free_path_length[OF this]\n show \"pth = []\" by simp\nqed\n\nsublocale Saturated_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n fix v p\n assume \"valid_in_port (v, p)\"\n thus \"\\e\\edges. snd e = (v, p)\"\n proof(induction v)\n fix c cis\n assume \"valid_in_port ((c, cis), p)\"\n hence \"c \\ set conclusions\" by (auto simp add: mem_vertices)\n\n show \"\\e\\edges. snd e = ((c, cis), p)\"\n proof(cases cis)\n case Nil\n with \\valid_in_port ((c, cis), p)\\\n have [simp]: \"p = plain_ant c\" by simp\n\n have \"[] \\ it_paths (it' c)\" by simp\n with \\c \\ set conclusions\\\n have \"edge_at c [] \\ edges\" by (rule regular_edge)\n moreover\n have \"snd (edge_at c []) = ((c, []), plain_ant c)\"\n by (simp add: edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Nil simp del: snd_edge_at)\n next\n case (Cons c' \"is\")\n with \\valid_in_port ((c, cis), p)\\\n have [simp]: \"c' = 0\" and \"is \\ it_paths (it' c)\"\n and \"p |\\| inPorts (iNodeOf (tree_at (it' c) is))\" by auto\n \n from this(3) obtain i where\n \"i < length (inPorts' (iNodeOf (tree_at (it' c) is)))\" and\n \"p = inPorts' (iNodeOf (tree_at (it' c) is)) ! i\"\n by (auto simp add: inPorts_fset_of in_set_conv_nth)\n\n show ?thesis\n proof (cases \"tree_at (it' c) is\")\n case [simp]: (RNode r ants)\n show ?thesis\n proof(cases r)\n case I\n hence \"\\ isHNode (tree_at (it' c) is)\" by simp\n from iwf_length_inPorts_not_HNode[OF iwf_it[OF \\c \\ set conclusions\\] \\is \\ it_paths (it' c)\\ this]\n \\i < length (inPorts' (iNodeOf (tree_at (it' c) is)))\\\n have \"i < length (children (tree_at (it' c) is))\" by simp\n with \\is \\ it_paths (it' c)\\\n have \"is@[i] \\ it_paths (it' c)\" by (rule it_path_SnocI)\n from \\c \\ set conclusions\\ this\n have \"edge_at c (is@[i]) \\ edges\" by (rule regular_edge)\n moreover\n have \"snd (edge_at c (is@[i])) = ((c, 0 # is), inPorts' (iNodeOf (tree_at (it' c) is)) ! i)\"\n by (simp add: edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Cons \\p = _\\ simp del: snd_edge_at)\n next\n case (H n s)\n hence \"tree_at (it' c) is = HNode n s ants\" by simp\n from \\c \\ set conclusions\\ \\is \\ it_paths (it' c)\\ this\n have \"hyp_edge_at c is n s \\ edges\"..\n moreover\n from H \\p |\\| inPorts (iNodeOf (tree_at (it' c) is))\\\n have [simp]: \"p = plain_ant anyP\" by simp\n \n have \"snd (hyp_edge_at c is n s) = ((c, 0 # is), p)\"\n by (simp add: hyp_edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Cons simp del: snd_hyp_edge_at)\n qed\n qed\n qed\n qed\nqed\n\nsublocale Pruned_Port_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n fix v \n assume \"v |\\| vertices\"\n thus \"\\pth v'. path v v' pth \\ terminal_vertex v'\"\n proof(induct rule: vertices_induct)\n case (None c)\n hence \"terminal_vertex (c,[])\" by simp\n with path.intros(1)\n show ?case by blast\n next\n case (Some c \"is\")\n hence \"path (c, 0 # is) (c, []) (terminal_path_from c is)\"\n by (rule path_terminal_path_from)\n moreover\n have \"terminal_vertex (c,[])\" using Some(1) by simp\n ultimately\n show ?case by blast\n qed\nqed\n\nsublocale Well_Shaped_Graph nodes inPorts outPorts vertices nodeOf edges hyps..\n\nsublocale sol:Solution inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP vidx inst edges\nproof\n fix v\\<^sub>1 p\\<^sub>1 v\\<^sub>2 p\\<^sub>2\n assume \"((v\\<^sub>1, p\\<^sub>1), (v\\<^sub>2, p\\<^sub>2)) \\ edges\"\n thus \"labelAtOut v\\<^sub>1 p\\<^sub>1 = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n proof(cases rule:edges.cases)\n case (regular_edge c \"is\")\n \n from \\((v\\<^sub>1, p\\<^sub>1), v\\<^sub>2, p\\<^sub>2) = edge_at c is\\\n have \"(v\\<^sub>1,p\\<^sub>1) = edge_from c is\" using fst_edge_at by (metis fst_conv)\n hence [simp]: \"v\\<^sub>1 = (c, 0 # is)\" by (simp add: edge_from_def)\n\n show ?thesis\n proof(cases \"is\" rule:rev_cases)\n case Nil\n let \"?t'\" = \"it' c\"\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t') (freshen (vidx v\\<^sub>1) (iOutPort ?t'))\"\n using regular_edge Nil by (simp add: labelAtOut_def edge_at_def edge_from_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t'\" by (simp add: Nil)\n also have \"subst (iSubst ?t') (freshen (iAnnot ?t') (iOutPort ?t')) = snd (fst (root (ts c)))\"\n unfolding iwf_subst_freshen_outPort[OF iwf_it[OF \\c \\ set conclusions\\]]..\n also have \"\\ = c\" using \\c \\ set conclusions\\ by (simp add: ts_conc)\n also have \"\\ = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using \\c \\ set conclusions\\ regular_edge Nil\n by (simp add: labelAtIn_def edge_at_def freshen_closed conclusions_closed closed_no_lconsts)\n finally show ?thesis.\n next\n case (snoc is' i)\n let \"?t1\" = \"tree_at (it' c) (is'@[i])\"\n let \"?t2\" = \"tree_at (it' c) is'\"\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t1) (freshen (vidx v\\<^sub>1) (iOutPort ?t1))\"\n using regular_edge snoc by (simp add: labelAtOut_def edge_at_def edge_from_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t1\" using snoc regular_edge(3) by simp\n also have \"subst (iSubst ?t1) (freshen (iAnnot ?t1) (iOutPort ?t1))\n = subst (iSubst ?t2) (freshen (iAnnot ?t2) (a_conc (inPorts' (iNodeOf ?t2) ! i)))\"\n by (rule iwf_edge_match[OF iwf_it[OF \\c \\ set conclusions\\] \\is \\ it_paths (it' c)\\[unfolded snoc]])\n also have \"iAnnot ?t2 = vidx (c, 0 # is')\" by simp\n also have \"subst (iSubst ?t2) (freshen (vidx (c, 0 # is')) (a_conc (inPorts' (iNodeOf ?t2) ! i))) = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using regular_edge snoc by (simp add: labelAtIn_def edge_at_def)\n finally show ?thesis.\n qed\n next\n case (hyp_edge c \"is\" n s ants)\n let ?f = \"subst s (freshen n anyP)\"\n let ?h = \"hyp_port_h_for (it' c) is ?f\"\n let ?his = \"hyp_port_path_for (it' c) is ?f\"\n let \"?t1\" = \"tree_at (it' c) ?his\"\n let \"?t2\" = \"tree_at (it' c) is\"\n\n from \\c \\ set conclusions\\ \\is \\ it_paths (it' c)\\ \\tree_at (it' c) is = HNode n s ants\\\n have \"?f \\ hyps_along (it' c) is\"\n by (rule hyps_exist')\n\n from \\((v\\<^sub>1, p\\<^sub>1), v\\<^sub>2, p\\<^sub>2) = hyp_edge_at c is n s\\\n have \"(v\\<^sub>1,p\\<^sub>1) = hyp_edge_from c is n s\" using fst_hyp_edge_at by (metis fst_conv)\n hence [simp]: \"v\\<^sub>1 = (c, 0 # ?his)\" by (simp add: hyp_edge_from_def)\n\n\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t1) (freshen (vidx v\\<^sub>1) (labelsOut (iNodeOf ?t1) ?h))\"\n using hyp_edge by (simp add: hyp_edge_at_def hyp_edge_from_def labelAtOut_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t1\" by simp\n also have \"subst (iSubst ?t1) (freshen (iAnnot ?t1) (labelsOut (iNodeOf ?t1) ?h)) = ?f\" using \\?f \\ hyps_along (it' c) is\\ by (rule local.hyp_port_eq[symmetric])\n also have \"\\ = subst (iSubst ?t2) (freshen (iAnnot ?t2) anyP)\" using hyp_edge by simp\n also have \"subst (iSubst ?t2) (freshen (iAnnot ?t2) anyP) = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using hyp_edge by (simp add: labelAtIn_def hyp_edge_at_def hyp_edge_to_def)\n finally show ?thesis.\n qed\nqed\n\n\nlemma node_disjoint_fresh_vars:\n assumes \"n \\ sset nodes\"\n assumes \"i < length (inPorts' n)\"\n assumes \"i' < length (inPorts' n)\"\n shows \"a_fresh (inPorts' n ! i) \\ a_fresh (inPorts' n ! i') = {} \\ i = i'\"\n using assms no_multiple_local_consts\n by (fastforce simp add: nodes_def stream.set_map)\n\nsublocale Well_Scoped_Instantiation freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut vidx inst edges local_vars\nproof\n fix v p var v'\n assume \"valid_in_port (v, p)\"\n hence \"v |\\| vertices\" by simp\n \n obtain c \"is\" where \"v = (c,is)\" by (cases v, auto)\n\n from \\valid_in_port (v, p)\\ \\v= _\\\n have \"(c,is) |\\| vertices\" and \"p |\\| inPorts (nodeOf (c, is))\" by simp_all\n hence \"c \\ set conclusions\" by (simp add: mem_vertices)\n \n from \\p |\\| _\\ obtain i where\n \"i < length (inPorts' (nodeOf (c, is)))\" and\n \"p = inPorts' (nodeOf (c, is)) ! i\" by (auto simp add: inPorts_fset_of in_set_conv_nth)\n hence \"p = in_port_at (c, is) i\" by (cases \"is\") auto\n\n assume \"v' |\\| vertices\"\n then obtain c' is' where \"v' = (c',is')\" by (cases v', auto)\n\n assume \"var \\ local_vars (nodeOf v) p\"\n hence \"var \\ a_fresh p\" by simp\n\n assume \"freshenLC (vidx v) var \\ subst_lconsts (inst v')\"\n then obtain is'' where \"is' = 0#is''\" and \"is'' \\ it_paths (it' c')\"\n using \\v' |\\| vertices\\\n by (cases is') (auto simp add: \\v'=_\\)\n\n note \\freshenLC (vidx v) var \\ subst_lconsts (inst v')\\\n also\n have \"subst_lconsts (inst v') = subst_lconsts (iSubst (tree_at (it' c') is''))\"\n by (simp add: \\v'=_\\ \\is'=_\\)\n also\n from \\is'' \\ it_paths (it' c')\\\n have \"\\ \\ fresh_at_path (it' c') is'' \\ range (freshenLC v_away)\"\n by (rule globalize_local_consts)\n finally\n have \"freshenLC (vidx v) var \\ fresh_at_path (it' c') is''\"\n using \\v |\\| vertices\\ by auto\n then obtain is''' where \"prefix is''' is''\" and \"freshenLC (vidx v) var \\ fresh_at (it' c') is'''\"\n unfolding fresh_at_path_def by auto\n then obtain i' is'''' where \"prefix (is''''@[i']) is''\" \n and \"freshenLC (vidx v) var \\ fresh_at (it' c') (is''''@[i'])\"\n using append_butlast_last_id[where xs = is''', symmetric]\n apply (cases \"is''' = []\")\n apply (auto simp del: fresh_at_snoc append_butlast_last_id)\n apply metis\n done\n\n from \\is'' \\ it_paths (it' c')\\ \\prefix (is''''@[i']) is''\\\n have \"(is''''@[i']) \\ it_paths (it' c')\" by (rule it_paths_prefix)\n hence \"is'''' \\ it_paths (it' c')\" using append_prefixD it_paths_prefix by blast\n\n from this \\freshenLC (vidx v) var \\ fresh_at (it' c') (is''''@[i'])\\\n have \"c = c' \\ is = 0 # is'''' \\ var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')\"\n unfolding fresh_at_def' using \\v |\\| vertices\\ \\v' |\\| vertices\\\n apply (cases \"is\")\n apply (auto split: if_splits simp add: iAnnot_globalize it_paths_butlast \\v=_\\ \\v'=_\\ \\is'=_\\ simp del: iAnnot.simps)\n done\n hence \"c' = c\" and \"is = 0 # is''''\" and \"var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')\" by simp_all\n\n from \\(is''''@[i']) \\ it_paths (it' c')\\\n have \"i' < length (inPorts' (nodeOf (c, is)))\"\n using iwf_length_inPorts[OF iwf_it[OF \\c \\ set conclusions\\]]\n by (auto elim!: it_paths_SnocE simp add: \\is=_\\ \\c' = _\\ order.strict_trans2)\n\n have \"nodeOf (c, is) \\ sset nodes\"\n unfolding \\is = _\\ \\c' = _\\ nodeOf.simps\n by (rule iNodeOf_tree_at[OF iwf_it[OF \\c \\ set conclusions\\] \\is'''' \\ it_paths (it' c')\\[unfolded \\c' = _\\]])\n \n from \\var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')\\\n \\var \\ a_fresh p\\ \\p = inPorts' (nodeOf (c, is)) ! i\\\n node_disjoint_fresh_vars[OF\n \\nodeOf (c, is) \\ sset nodes\\\n \\i < length (inPorts' (nodeOf (c, is)))\\ \\i' < length (inPorts' (nodeOf (c, is)))\\]\n have \"i' = i\" by (auto simp add: \\is=_\\ \\c'=c\\)\n \n from \\prefix (is''''@[i']) is''\\\n have \"prefix (is @ [i']) is'\" by (simp add: \\is'=_\\ \\is=_\\)\n\n \n from \\c \\ set conclusions\\ \\is'' \\ it_paths (it' c')\\ \\prefix (is @ [i']) is'\\\n \\p = in_port_at (c, is) i\\\n have \"scope' v p v'\"\n unfolding \\v=_\\ \\v'=_\\ \\c' = _\\ \\is' = _\\ \\i'=_\\ by (auto intro: scope'.intros)\n thus \"v' \\ scope (v, p)\" using \\valid_in_port (v, p)\\ by (simp add: in_scope)\nqed\n\nsublocale Scoped_Proof_Graph freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut vidx inst edges local_vars..\n\n(* interpretation of @{term Tasked_Proof_Graph} has to be named to avoid name clashes in @{term Abstract_Task}. *)\nsublocale tpg:Tasked_Proof_Graph freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP antecedent consequent rules assumptions conclusions\n vertices nodeOf edges vidx inst\nproof\n show \"set (map Conclusion conclusions) \\ nodeOf ` fset vertices\"\n proof-\n {\n fix c\n assume \"c \\ set conclusions\"\n hence \"(c, []) |\\| vertices\" by simp\n hence \"nodeOf (c, []) \\ nodeOf ` fset vertices\"\n unfolding fmember.rep_eq by (rule imageI)\n hence \"Conclusion c \\ nodeOf ` fset vertices\" by simp\n } thus ?thesis by auto\n qed\nqed \n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Incredible_Proof_Machine/Incredible_Completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2900627858147763}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Cong_Subst_Pres\n imports Weak_Late_Cong_Subst Weak_Late_Cong_Pres\nbegin\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"\\.(P) \\\\<^sup>s \\.(Q)\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.tauPres)\n\nlemma inputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and x :: name\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n\n shows \"a.P \\\\<^sup>s a.Q\"\nproof(auto simp add: substClosed_def)\n fix \\ :: \"(name \\ name) list\"\n {\n fix P Q a x \\\n assume \"P \\\\<^sup>s Q\"\n then have \"P[<\\>] \\\\<^sup>s Q[<\\>]\" by(rule partUnfold)\n then have \"\\y. (P[<\\>])[x::=y] \\ (Q[<\\>])[x::=y]\"\n apply(auto simp add: substClosed_def)\n by(erule_tac x=\"[(x, y)]\" in allE) auto\n moreover assume \"x \\ \\\"\n ultimately have \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" using weakBisimEqvt\n by(force intro: Weak_Late_Cong_Pres.inputPres)\n }\n note Goal = this\n\n obtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ \\\"\n by(generate_fresh \"name\") auto\n from `P \\\\<^sup>s Q` have \"([(x, y)] \\ P) \\\\<^sup>s ([(x, y)] \\ Q)\" by(rule eqvtI)\n hence \"(a.([(x, y)] \\ P))[<\\>] \\ (a.([(x, y)] \\ Q))[<\\>]\" using `y \\ \\` by(rule Goal)\n moreover from `y \\ P` `y \\ Q` have \"a.P = a.([(x, y)] \\ P)\" and \"a.Q = a.([(x, y)] \\ Q)\"\n by(simp add: pi.alphaInput)+\n\n ultimately show \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" by simp\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"a{b}.P \\\\<^sup>s a{b}.Q\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.outputPres)\n\n\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"[a\\b]P \\\\<^sup>s [a\\b]Q\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.matchPres)\n\nlemma sumPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"P \\ R \\\\<^sup>s Q \\ R\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.sumPres)\n\nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"P \\ R \\\\<^sup>s Q \\ R\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.parPres)\n\n\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n \n shows \"<\\x>P \\\\<^sup>s <\\x>Q\"\nproof(auto simp add: substClosed_def)\n fix s::\"(name \\ name) list\"\n\n have Goal: \"\\P Q x s. \\P[] \\ Q[]; x \\ s\\ \\ (<\\x>P)[] \\ (<\\x>Q)[]\"\n by(force intro: Weak_Late_Step_Sim_Pres.resPres Weak_Late_Bisim_Pres.resPres Weak_Late_Bisim.eqvt)\n \n have \"\\c::name. c \\ (P, Q, s)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshP: \"c \\ P\" and cFreshQ: \"c \\ Q\" and cFreshs: \"c \\ s\"\n by(force simp add: fresh_prod)\n\n from PeqQ have \"P[<([(x, c)] \\ s)>] \\ Q[<([(x, c)] \\ s)>]\" and \n \"Q[<([(x, c)] \\ s)>] \\ P[<([(x, c)] \\ s)>]\"\n by(force simp add: congruenceSubstDef)+\n\n hence \"([(x, c)] \\ (P[<([(x, c)] \\ s)>])) \\ ([(x, c)] \\ (Q[<([(x, c)] \\ s)>]))\" and \n \"([(x, c)] \\ (Q[<([(x, c)] \\ s)>])) \\ ([(x, c)] \\ (P[<([(x, c)] \\ s)>]))\"\n by(blast intro: Weak_Late_Step_Sim.eqvtI Weak_Late_Bisim.eqvt)+\n\n hence \"([(x, c)] \\ P)[] \\ ([(x, c)] \\ Q)[]\" and\n \"([(x, c)] \\ Q)[] \\ ([(x, c)] \\ P)[]\" by simp+\n\n with cFreshs have \"(<\\c>([(x, c)] \\ P))[] \\ (<\\c>([(x, c)] \\ Q))[]\" and\n \"(<\\c>([(x, c)] \\ Q))[] \\ (<\\c>([(x, c)] \\ P))[]\"\n by(blast intro: Goal)+\n\n moreover from cFreshP cFreshQ have \"<\\x>P = <\\c>([(x, c)] \\ P)\" and \"<\\x>Q = <\\c>([(x, c)] \\ Q)\"\n by(simp add: alphaRes)+\n\n ultimately show \"(<\\x>P)[] \\ (<\\x>Q)[]\"\n by(simp add: congruence_def)\nqed\n\nlemma congruenceBang:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"!P \\\\<^sup>s !Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Cong_Pres.congruenceBang)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Late_Cong_Subst_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.29006277817865245}} {"text": " (*-------------------------------------------*\n | 2 Buffers |\n | |\n | June 2009 |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory TwoBuff\nimports CSP_F\nbegin\n\n(*=============================================================*\n | |\n | Process |\n | |\n *=============================================================*)\n\n(*********************************************************\n process names and events\n *********************************************************)\n\ndatatype Event = inC | outC | midC\ndatatype PN = Buff1 | Buff1' | Buff2 | Buff2' | Buff2''\n\n(*********************************************************\n Recursivey Process\n *********************************************************)\n\nprimrec\t\n PNdef :: \"PN => (PN, Event) proc\"\nwhere\n \"PNdef (Buff1) = inC -> $Buff1'\"\n|\"PNdef (Buff1') = outC -> $Buff1\"\n\n|\"PNdef (Buff2) = inC -> $Buff2'\"\n|\"PNdef (Buff2') = inC -> $Buff2'' [+] outC -> $Buff2\"\n|\"PNdef (Buff2'') = outC -> $Buff2'\"\n\n(*\ndefs (overloaded) Set_PNfun_def [simp]: \"PNfun == PNdef\"\n*)\n\n\noverloading Set_PNdef == \n \"PNfun :: (PN, Event) pnfun\"\nbegin\n definition \"PNfun == PNdef\"\nend\n \ndeclare Set_PNdef_def [simp]\n\n(* ------------------ *\n guardedness\n * ------------------ *)\n\nlemma guardedfun_PN[simp]:\n \"guardedfun PNdef\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)\n(*\ndefs FPmode_def [simp]: \"FPmode == CMSmode\"\n*)\n\noverloading FPmode == \n \"FPmode :: fpmode\"\nbegin\n definition \"FPmode == CMSmode\"\nend\n\ndeclare FPmode_def [simp]\n\n(*********************************************************\n Composition\n *********************************************************)\n\nabbreviation\n Link :: \"(PN, Event) proc => (PN, Event) proc => (PN, Event) proc\"\n (\"(1_ /<---> _)\" [76,77] 76)\nwhere \"P <---> Q == (P[[outC<-->midC]] |[{midC}]| \n Q[[inC<-->midC]]) -- {midC}\"\n\nabbreviation\n LinkBuff2 :: \"(PN, Event) proc\"\nwhere \"LinkBuff2 == $Buff1 <---> $Buff1\"\n\n(*********************************************************\n for automatising\n *********************************************************)\n\ndeclare simp_event_set [simp]\n\nlemma Link_cong: \"Q =F R ==> P <---> Q =F P <---> R\"\nby (simp)\n\n(*********************************************************\n verification\n *********************************************************)\n\nprimrec\n Buff2_to_LinkBuff2 :: \"PN => (PN, Event) proc\"\nwhere\n \"Buff2_to_LinkBuff2 (Buff1) = $Buff1\"\n |\"Buff2_to_LinkBuff2 (Buff1') = $Buff1'\"\n |\"Buff2_to_LinkBuff2 (Buff2) = LinkBuff2\"\n |\"Buff2_to_LinkBuff2 (Buff2') = $Buff1' <---> $Buff1\"\n |\"Buff2_to_LinkBuff2 (Buff2'') = $Buff1' <---> $Buff1'\"\n\ntheorem Buff2_eq_LinkBuff2:\n \"$Buff2 =F LinkBuff2\"\n\n(* by finxed point induction *)\napply (rule cspF_fp_induct_left[of _ \"Buff2_to_LinkBuff2\"])\napply (simp+, induct_tac p, auto, cspF_unwind+)\n\n(* by sequentialising *)\napply (cspF_auto | auto)+\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/NBuff/TwoBuff.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2900627705425286}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Close_Subst\n imports Agent\nbegin\n\ncontext substPsi\nbegin\n\ndefinition closeSubst :: \"('b::fs_name \\ ('a::fs_name, 'b, 'c::fs_name) psi \\ ('a, 'b, 'c) psi) set \\ ('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\nwhere \"closeSubst Rel \\ {(\\, P, Q) | \\ P Q. (\\\\. wellFormedSubst \\ \\ (\\, P[<\\>], Q[<\\>]) \\ Rel)}\"\n\nlemma closeSubstI:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\\\. wellFormedSubst \\ \\ (\\, P[<\\>], Q[<\\>]) \\ Rel\"\n\n shows \"(\\, P, Q) \\ closeSubst Rel\"\nusing assms\nby(unfold closeSubst_def) auto\n\nlemma closeSubstE:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n assumes \"(\\, P, Q) \\ closeSubst Rel\"\n and \"wellFormedSubst \\\"\n\n shows \"(\\, P[<\\>], Q[<\\>]) \\ Rel\"\nusing assms\nby(unfold closeSubst_def) auto\n\nlemma closeSubstClosed:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"eqvt Rel\"\n and \"(\\, P, Q) \\ closeSubst Rel\"\n\n shows \"(p \\ \\, p \\ P, p \\ Q) \\ closeSubst Rel\"\nproof(rule closeSubstI)\n fix \\\n assume \"wellFormedSubst(\\::(name list \\ 'a list) list)\"\n with `(\\, P, Q) \\ closeSubst Rel` `wellFormedSubst \\`\n have \"(\\, P[<(rev p \\ \\)>], Q[<(rev p \\ \\)>]) \\ Rel\"\n by(rule_tac closeSubstE) auto\n hence \"(p \\ \\, p \\ (P[<(rev p \\ \\)>]), p \\ (Q[<(rev p \\ \\)>])) \\ Rel\"\n by(drule_tac p=p in eqvtI[OF `eqvt Rel`]) (simp add: eqvts)\n thus \"(p \\ \\, (p \\ P)[<\\>], (p \\ Q)[<\\>]) \\ Rel\"\n by(simp del: seqSubs_def add: eqvts)\nqed\n\nlemma closeSubstEqvt:\n assumes \"eqvt Rel\"\n\n shows \"eqvt(closeSubst Rel)\"\nproof(auto simp add: eqvt_def)\n fix \\ P Q p\n assume \"(\\, P, Q) \\ closeSubst Rel\"\n thus \"((p::name prm) \\ \\, p \\ P, p \\ Q) \\ closeSubst Rel\"\n by(drule_tac p=p in closeSubstClosed[OF `eqvt Rel`]) (simp add: eqvts)\nqed\n\nlemma closeSubstUnfold:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n assumes \"(\\, P, Q) \\ closeSubst Rel\"\n and \"wellFormedSubst \\\"\n\n shows \"(\\, P[<\\>], Q[<\\>]) \\ closeSubst Rel\"\nproof(rule closeSubstI)\n fix \\'::\"(name list \\ 'a list) list\"\n assume \"wellFormedSubst \\'\"\n with `wellFormedSubst \\` have \"wellFormedSubst(\\@\\')\" by simp\n with `(\\, P, Q) \\ closeSubst Rel` have \"(\\, P[<(\\@\\')>], Q[<(\\@\\')>]) \\ Rel\"\n by(rule closeSubstE)\n thus \"(\\, P[<\\>][<\\'>], Q[<\\>][<\\'>]) \\ Rel\"\n by simp\nqed\n\nend\n\nend\n \n\n \n\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Close_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.28986940757271795}} {"text": "(*\n * Copyright Florian Haftmann\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \\Ancient comprehensive Word Library\\\n\ntheory Word_Lib_Sumo\nimports\n \"HOL-Library.Word\"\n Aligned\n Bit_Comprehension\n Bit_Comprehension_Int\n Bit_Shifts_Infix_Syntax\n Bits_Int\n Bitwise_Signed\n Bitwise\n Enumeration_Word\n Generic_set_bit\n Hex_Words\n Least_significant_bit\n More_Arithmetic\n More_Divides\n More_Sublist\n Even_More_List\n More_Misc\n Strict_part_mono\n Legacy_Aliases\n Most_significant_bit\n Next_and_Prev\n Norm_Words\n Reversed_Bit_Lists\n Rsplit\n Signed_Words\n Syntax_Bundles\n Typedef_Morphisms\n Type_Syntax\n Word_EqI\n Word_Lemmas\n Word_8\n Word_16\n Word_32\n Word_Syntax\n Signed_Division_Word\n Singleton_Bit_Shifts\n More_Word_Operations\n Many_More\n Word_Lemmas_Internal\n Word_Lemmas_Prefix\nbegin\n\nunbundle bit_operations_syntax\nunbundle bit_projection_infix_syntax\n\ndeclare word_induct2[induct type]\ndeclare word_nat_cases[cases type]\n\ndeclare signed_take_bit_Suc [simp]\n\n(* these generate take_bit terms, which we often don't want for concrete lengths *)\nlemmas of_int_and_nat = unsigned_of_nat unsigned_of_int signed_of_int signed_of_nat\n\nbundle no_take_bit\nbegin\ndeclare of_int_and_nat[simp del]\nend\n\nlemmas bshiftr1_def = bshiftr1_eq\nlemmas is_down_def = is_down_eq\nlemmas is_up_def = is_up_eq\nlemmas mask_def = mask_eq\nlemmas scast_def = scast_eq\nlemmas shiftl1_def = shiftl1_eq\nlemmas shiftr1_def = shiftr1_eq\nlemmas sshiftr1_def = sshiftr1_eq\nlemmas sshiftr_def = sshiftr_eq_funpow_sshiftr1\nlemmas to_bl_def = to_bl_eq\nlemmas ucast_def = ucast_eq\nlemmas unat_def = unat_eq_nat_uint\nlemmas word_cat_def = word_cat_eq\nlemmas word_reverse_def = word_reverse_eq_of_bl_rev_to_bl\nlemmas word_roti_def = word_roti_eq_word_rotr_word_rotl\nlemmas word_rotl_def = word_rotl_eq\nlemmas word_rotr_def = word_rotr_eq\nlemmas word_sle_def = word_sle_eq\nlemmas word_sless_def = word_sless_eq\n\nlemmas uint_0 = uint_nonnegative\nlemmas uint_lt = uint_bounded\nlemmas uint_mod_same = uint_idem\nlemmas of_nth_def = word_set_bits_def\n\nlemmas of_nat_word_eq_iff = word_of_nat_eq_iff\nlemmas of_nat_word_eq_0_iff = word_of_nat_eq_0_iff\nlemmas of_int_word_eq_iff = word_of_int_eq_iff\nlemmas of_int_word_eq_0_iff = word_of_int_eq_0_iff\n\nlemmas word_next_def = word_next_unfold\n\nlemmas word_prev_def = word_prev_unfold\n\nlemmas is_aligned_def = is_aligned_iff_dvd_nat\n\nlemmas word_and_max_simps =\n word8_and_max_simp\n word16_and_max_simp\n word32_and_max_simp\n\nlemma distinct_lemma: \"f x \\ f y \\ x \\ y\" by auto\n\nlemmas and_bang = word_and_nth\n\nlemmas sdiv_int_def = signed_divide_int_def\nlemmas smod_int_def = signed_modulo_int_def\n\n(* shortcut for some specific lengths *)\nlemma word_fixed_sint_1[simp]:\n \"sint (1::8 word) = 1\"\n \"sint (1::16 word) = 1\"\n \"sint (1::32 word) = 1\"\n \"sint (1::64 word) = 1\"\n by (auto simp: sint_word_ariths)\n\ndeclare of_nat_diff [simp]\n\n(* Haskellish names/syntax *)\nnotation (input)\n bit (\"testBit\")\n\nlemmas cast_simps = cast_simps ucast_down_bl\n\n(* shadows the slightly weaker Word.nth_ucast *)\nlemma nth_ucast:\n \"(ucast (w::'a::len word)::'b::len word) !! n =\n (w !! n \\ n < min LENGTH('a) LENGTH('b))\"\n by (auto simp add: bit_simps not_le dest: bit_imp_le_length)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Word_Lib/Word_Lib_Sumo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2898694075727179}} {"text": "(* Title: Conflict analysis/Flowgraphs\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nheader \"Flowgraphs\"\ntheory Flowgraph\nimports Main Misc\nbegin\ntext_raw {*\\label{thy:Flowgraph}*}\n\ntext {*\n We use a flowgraph-based program model that extends the one we used previously \\cite{LM07}. \n A program is represented as an edge annotated graph and a set of procedures. The nodes of the graph are partitioned by the procedures, i.e. every node belongs to exactly one procedure. There are no edges\n between nodes of different procedures. Every procedure has a distinguished entry and return node and a set of monitors it synchronizes on. Additionally, the program has a distinguished {\\em main} procedure.\n The edges are annotated with statements. A statement is either a base statement, a procedure call or a thread creation (spawn). Procedure calls and thread creations refer to the called procedure or to the initial procedure\n of the spawned thread, respectively.\n\n We require that the main procedure and any initial procedure of a spawned thread does not to synchronize on any monitors. This avoids that spawning of a procedure together with entering a monitor is available in our \n model as an atomic step, which would be an unrealistic assumption for practical problems. Technically, our model would become strictly more powerful without this assumption.\n\n\n If we allowed this, our model would become strictly more powerful, \n*}\n\nsubsection \"Definitions\"\n \ndatatype ('p,'ba) edgeAnnot = Base 'ba | Call 'p | Spawn 'p\ntype_synonym ('n,'p,'ba) edge = \"('n \\ ('p,'ba) edgeAnnot \\ 'n)\"\n\nrecord ('n,'p,'ba,'m) flowgraph_rec =\n edges :: \"('n,'p,'ba) edge set\" -- \"Set of annotated edges\"\n main :: \"'p\" -- \"Main procedure\"\n entry :: \"'p \\ 'n\" -- \"Maps a procedure to its entry point\"\n return :: \"'p \\ 'n\" -- \"Maps a procedure to its return point\"\n mon :: \"'p \\ 'm set\" -- \"Maps procedures to the set of monitors they allocate\"\n proc_of :: \"'n \\ 'p\" -- \"Maps a node to the procedure it is contained in\"\n\ndefinition \n \"initialproc fg p == p=main fg \\ (\\u v. (u,Spawn p,v)\\edges fg)\"\n\nlemma main_is_initial[simp]: \"initialproc fg (main fg)\"\n by (unfold initialproc_def) simp\n\nlocale flowgraph =\n fixes fg :: \"('n,'p,'ba,'m,'more) flowgraph_rec_scheme\" (structure)\n (* Type annotation unnecessary, but perhaps makes it more readable\n for the unaware reader ;) *)\n -- \"Edges are inside procedures only\"\n assumes edges_part: \"(u,a,v)\\edges fg \\ proc_of fg u = proc_of fg v\" \n -- \"The entry point of a procedure must be in that procedure\"\n assumes entry_valid[simp]: \"proc_of fg (entry fg p) = p\" \n -- \"The return point of a procedure must be in that procedure\"\n assumes return_valid[simp]: \"proc_of fg (return fg p) = p\" \n -- \"Initial procedures do not synchronize on any monitors\"\n assumes initial_no_mon[simp]: \"initialproc fg p \\ mon fg p = {}\" \n\nsubsection \"Basic properties\"\nlemma (in flowgraph) spawn_no_mon[simp]: \n \"(u, Spawn p, v) \\ edges fg \\ mon fg p = {}\" \n using initial_no_mon by (unfold initialproc_def, blast)\nlemma (in flowgraph) main_no_mon[simp]: \"mon fg (main fg) = {}\" \n using initial_no_mon by (unfold initialproc_def, blast)\n\n\n\nlemma (in flowgraph) entry_entry_same_proc[simp]: \n \"entry fg p = entry fg p' \\ p=p'\"\n apply (subgoal_tac \"proc_of fg (entry fg p) = proc_of fg (entry fg p')\")\n apply (simp (no_asm_use))\n by simp\n\nlemma (in flowgraph) return_return_same_proc[simp]: \n \"return fg p = return fg p' \\ p=p'\"\n apply (subgoal_tac \"proc_of fg (return fg p) = proc_of fg (entry fg p')\")\n apply (simp (no_asm_use))\n by simp\n\nsubsection \"Extra assumptions for flowgraphs\"\ntext_raw {*\\label{sec:Flowgraph:extra_asm}*}\ntext {*\n In order to simplify the definition of our restricted schedules (cf. Section~\\ref{thy:Normalization}), we make some extra constraints on flowgraphs. \n Note that these are no real restrictions, as we can always rewrite flowgraphs to match these constraints, preserving the set of conflicts. We leave it to future work to consider such a rewriting formally. \n\n The background of this restrictions is that we want to start an execution of a thread with a procedure call that never returns. This will allow easier technical treatment in Section~\\ref{thy:Normalization}. Here we enforce this\n semantic restrictions by syntactic properties of the flowgraph.\n*}\n\ntext {* The return node of a procedure is called {\\em isolated}, if it has no incoming edges and is different from the entry node. A procedure with an isolated return node will never return. \n See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this. *}\ndefinition \n \"isolated_ret fg p == \n (\\u l. \\(u,l,return fg p)\\edges fg) \\ entry fg p \\ return fg p\"\n\ntext {* The following syntactic restrictions guarantee that each thread's execution starts with a non-returning call. See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this. *}\nlocale eflowgraph = flowgraph +\n -- \"Initial procedure's entry node isn't equal to its return node\"\n assumes initial_no_ret: \"initialproc fg p \\ entry fg p \\ return fg p\" \n -- \"The only outgoing edges of initial procedures' entry nodes are call edges to procedures with isolated return node\"\n assumes initial_call_no_ret: \"\\initialproc fg p; (entry fg p,l,v)\\edges fg\\ \n \\ \\p'. l=Call p' \\ isolated_ret fg p'\" \n\nsubsection {* Example Flowgraph*}\ntext_raw {* \\label{sec:Flowgraph:ex_flowgraph} *}\ntext {* This section contains a check that there exists a (non-trivial) flowgraph, i.e. that the assumptions made in the @{text flowgraph} and @{text eflowgraph} \n locales are consistent and have at least one non-trivial model. *}\ndefinition \n \"example_fg == \\ \n edges = {((0::nat,0::nat),Call 1,(0,1)), ((1,0),Spawn 0,(1,0)), \n ((1,0),Call 0, (1,0))}, \n main = 0, \n entry = \\p. (p,0), \n return = \\p. (p,1), \n mon = \\p. if p=1 then {0} else {}, \n proc_of= \\ (p,x). p \\\"\n\nlemma exists_eflowgraph: \"eflowgraph example_fg\"\n apply (unfold_locales)\n apply (unfold example_fg_def)\n apply simp\n apply fast\n apply simp\n apply simp\n apply (simp add: initialproc_def)\n apply (simp add: initialproc_def)\n apply (simp add: initialproc_def isolated_ret_def)\n done\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Program-Conflict-Analysis/Flowgraph.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2898694075727179}} {"text": "(* Title: HOL/Auth/WooLam.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection\\The Woo-Lam Protocol\\\n\ntheory WooLam imports Public begin\n\ntext\\Simplified version from page 11 of\n Abadi and Needham (1996). \n Prudent Engineering Practice for Cryptographic Protocols.\n IEEE Trans. S.E. 22(1), pages 6-15.\n\nNote: this differs from the Woo-Lam protocol discussed by Lowe (1996):\n Some New Attacks upon Security Protocols.\n Computer Security Foundations Workshop\n\\\n\ninductive_set woolam :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ woolam\"\n\n (** These rules allow agents to send messages to themselves **)\n\n (*The spy MAY say anything he CAN say. We do not expect him to\n invent new nonces here, but he can also use NS1. Common to\n all similar protocols.*)\n | Fake: \"[| evsf \\ woolam; X \\ synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf \\ woolam\"\n\n (*Alice initiates a protocol run*)\n | WL1: \"evs1 \\ woolam ==> Says A B (Agent A) # evs1 \\ woolam\"\n\n (*Bob responds to Alice's message with a challenge.*)\n | WL2: \"[| evs2 \\ woolam; Says A' B (Agent A) \\ set evs2 |]\n ==> Says B A (Nonce NB) # evs2 \\ woolam\"\n\n (*Alice responds to Bob's challenge by encrypting NB with her key.\n B is *not* properly determined -- Alice essentially broadcasts\n her reply.*)\n | WL3: \"[| evs3 \\ woolam;\n Says A B (Agent A) \\ set evs3;\n Says B' A (Nonce NB) \\ set evs3 |]\n ==> Says A B (Crypt (shrK A) (Nonce NB)) # evs3 \\ woolam\"\n\n (*Bob forwards Alice's response to the Server. NOTE: usually\n the messages are shown in chronological order, for clarity.\n But here, exchanging the two events would cause the lemma\n WL4_analz_spies to pick up the wrong assumption!*)\n | WL4: \"[| evs4 \\ woolam;\n Says A' B X \\ set evs4;\n Says A'' B (Agent A) \\ set evs4 |]\n ==> Says B Server \\Agent A, Agent B, X\\ # evs4 \\ woolam\"\n\n (*Server decrypts Alice's response for Bob.*)\n | WL5: \"[| evs5 \\ woolam;\n Says B' Server \\Agent A, Agent B, Crypt (shrK A) (Nonce NB)\\\n \\ set evs5 |]\n ==> Says Server B (Crypt (shrK B) \\Agent A, Nonce NB\\)\n # evs5 \\ woolam\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"\\NB. \\evs \\ woolam.\n Says Server B (Crypt (shrK B) \\Agent A, Nonce NB\\) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] woolam.Nil\n [THEN woolam.WL1, THEN woolam.WL2, THEN woolam.WL3,\n THEN woolam.WL4, THEN woolam.WL5], possibility)\ndone\n\n(*Could prove forwarding lemmas for WL4, but we do not need them!*)\n\n(**** Inductive proofs about woolam ****)\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\n(*Spy never sees a good agent's shared key!*)\nlemma Spy_see_shrK [simp]:\n \"evs \\ woolam ==> (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\nby (erule woolam.induct, force, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ woolam ==> (Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"[|Key (shrK A) \\ parts (knows Spy evs); evs \\ woolam|] ==> A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\n(**** Autheticity properties for Woo-Lam ****)\n\n(*** WL4 ***)\n\n(*If the encrypted message appears then it originated with Alice*)\nlemma NB_Crypt_imp_Alice_msg:\n \"[| Crypt (shrK A) (Nonce NB) \\ parts (spies evs);\n A \\ bad; evs \\ woolam |]\n ==> \\B. Says A B (Crypt (shrK A) (Nonce NB)) \\ set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*Guarantee for Server: if it gets a message containing a certificate from\n Alice, then she originated that certificate. But we DO NOT know that B\n ever saw it: the Spy may have rerouted the message to the Server.*)\nlemma Server_trusts_WL4 [dest]:\n \"[| Says B' Server \\Agent A, Agent B, Crypt (shrK A) (Nonce NB)\\\n \\ set evs;\n A \\ bad; evs \\ woolam |]\n ==> \\B. Says A B (Crypt (shrK A) (Nonce NB)) \\ set evs\"\nby (blast intro!: NB_Crypt_imp_Alice_msg)\n\n\n(*** WL5 ***)\n\n(*Server sent WL5 only if it received the right sort of message*)\nlemma Server_sent_WL5 [dest]:\n \"[| Says Server B (Crypt (shrK B) \\Agent A, NB\\) \\ set evs;\n evs \\ woolam |]\n ==> \\B'. Says B' Server \\Agent A, Agent B, Crypt (shrK A) NB\\\n \\ set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*If the encrypted message appears then it originated with the Server!*)\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n \"[| Crypt (shrK B) \\Agent A, NB\\ \\ parts (spies evs);\n B \\ bad; evs \\ woolam |]\n ==> Says Server B (Crypt (shrK B) \\Agent A, NB\\) \\ set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*Guarantee for B. If B gets the Server's certificate then A has encrypted\n the nonce using her key. This event can be no older than the nonce itself.\n But A may have sent the nonce to some other agent and it could have reached\n the Server via the Spy.*)\nlemma B_trusts_WL5:\n \"[| Says S B (Crypt (shrK B) \\Agent A, Nonce NB\\) \\ set evs;\n A \\ bad; B \\ bad; evs \\ woolam |]\n ==> \\B. Says A B (Crypt (shrK A) (Nonce NB)) \\ set evs\"\nby (blast dest!: NB_Crypt_imp_Server_msg)\n\n\n(*B only issues challenges in response to WL1. Not used.*)\nlemma B_said_WL2:\n \"[| Says B A (Nonce NB) \\ set evs; B \\ Spy; evs \\ woolam |]\n ==> \\A'. Says A' B (Agent A) \\ set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n\n(**CANNOT be proved because A doesn't know where challenges come from...*)\nlemma \"[| A \\ bad; B \\ Spy; evs \\ woolam |]\n ==> Crypt (shrK A) (Nonce NB) \\ parts (spies evs) \\\n Says B A (Nonce NB) \\ set evs\n \\ Says A B (Crypt (shrK A) (Nonce NB)) \\ set evs\"\napply (erule rev_mp, erule woolam.induct, force, simp_all, blast, auto)\noops\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/WooLam.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.289869400008195}} {"text": "theory a3\nimports\n \"AutoCorres.AutoCorres\"\n \"AutoCorres.TypHeapSimple\"\nbegin\n\n(* To run this file you need the AutoCorres tool used\n in the lecture.\n\n 1. Download AutoCorres from \n \\url{http://www.cse.unsw.edu.au/~cs4161/autocorres-1.6.1.tar}\n\n 2. Unpack the .tar.gz file, which will create the directory autocorres-1.6.1\n tar -xzf autocorres-1.6.1.tar.gz\n\n 3. Build the AutoCorres heap\n L4V_ARCH=X64 isabelle build -v -b -d autocorres-1.6.1 AutoCorres\n\n 4. Load this file using the AutoCorres heap\n L4V_ARCH=X64 isabelle jedit -d autocorres-1.6.1 -l AutoCorres a3.thy\n\n*)\n\nsection \"Question: Reverse \"\n\n(* Hints: \n - use find_theorems to find Isabelle library theorems about existing concepts.\n - you are allowed to use sledgehammer and other automation\n - if you can't prove one of the lemmas below, you can still assume it in the rest of the proof\n - the function @{const int} converts an Isabelle nat to an int\n - the function @{const nat} converts an Isabelle int to a nat\n - If you want to use apply style, you could the tactic @{text insert assms} \n to insert assumptions into your proof.\n*)\n\n(* Parse the input file. *)\ninstall_C_file \"reverse.c\"\n\n(* Abstract the input file. *)\nautocorres[unsigned_word_abs=reverse] \"reverse.c\"\n\n\nsection \\utility lemmas\\\n\n(* This makes an intro rule which can be used with rule_tac, as opposed to\n using whileLoop_add_inv and subst. *)\nlemma whileLoop_add_invI:\n assumes \"\\ P \\ whileLoop_inv c b init I (measure M) \\ Q \\!\"\n shows \"\\ P \\ whileLoop c b init \\ Q \\!\"\n by (metis assms whileLoop_inv_def)\n\nlemma pointer_add_ldistrib_add:\n \"p +\\<^sub>p (a + b) = (p +\\<^sub>p a) +\\<^sub>p b\"\n unfolding ptr_add_def\n by (simp add: algebra_simps)\n\nlemma heap_w32_update_comp: \n \"heap_w32_update (f \\ g) s = heap_w32_update f (heap_w32_update g s)\"\n by simp\n\ntext \\ This assumes that pointers are wellbehaved \\\ndefinition wellbehaved_pointers :: \"('a :: c_type) ptr \\ nat \\ bool\" where\n \"wellbehaved_pointers p n \\ \n \\i j :: int. i < n \\ j < n \\ ((p +\\<^sub>p i :: 'a ptr) = p +\\<^sub>p j) \\ (i = j)\"\n\nlemma wellbehaved_pointers_D:\n fixes n :: nat\n and i j :: int\n assumes\n \"wellbehaved_pointers p n\"\n \"i < n\"\n \"j < n\"\n shows\n \"(p +\\<^sub>p i = p +\\<^sub>p j) \\ (i = j)\"\n using assms\n by (simp add: wellbehaved_pointers_def)\n\nlemma int_geq_0_less_Suc_eq_0_disj:\n fixes a b :: int\n assumes\n \"0 \\ a\"\n \"0 \\ b\"\n shows\n \"a < 1 + b \\ a = 0 \\ (\\a'. a = 1 + a' \\ 0 \\ a' \\ a' < b)\"\n using assms\n by presburger\n\nlemma geq_step_Suc:\n \"(\\x\\m. P x) = (P m \\ (\\x\\Suc m. P x))\"\n by (metis Suc_leD dual_order.antisym not_less_eq_eq)\n\nlemma gr_is_geq_Suc:\n \"(\\x>m. P x) = ((\\x\\Suc m. P x))\"\n by (simp add: Suc_le_eq)\n\nlemma leq_minus_split:\n \"i \\ n - m \\ i \\ n - Suc m \\ i = n - m\"\n by linarith\n\nlemma gr_minus_Suc:\n assumes\n \"m > n\"\n shows\n \"(\\x>m - Suc n. P x) \\ P (m - n) \\ (\\x>m - n. P x)\"\n using assms\n apply (simp add: gr_is_geq_Suc Suc_diff_Suc)\n apply (subst (1) le_less)\n apply (simp add: Suc_le_eq split_all_conj)\n apply fast\n done\n\n\n(*******************************************************************************)\n\nprimrec\n arr_is_valid :: \"lifted_globals \\ word32 ptr \\ nat \\ bool\"\nwhere\n \"arr_is_valid s p 0 = True\"\n | \"arr_is_valid s p (Suc n) = (is_valid_w32 s p \\ arr_is_valid s (p +\\<^sub>p 1) n)\"\n\n\nlemma arr_is_valid_update_heap:\n \"arr_is_valid (heap_w32_update f s) p n \\ arr_is_valid s p n\"\n by (induct n arbitrary: p) simp+\n\nlemma arr_is_valid_conv_all_nth:\n \"arr_is_valid s p n \\ (\\ip int i))\"\n by (induct n arbitrary: p) \n (simp add: All_less_Suc2 pointer_add_ldistrib_add)+\n\nlemma arr_is_validD:\n \"arr_is_valid s p n \\ i < n \\ is_valid_w32 s (p +\\<^sub>p int i)\"\n using arr_is_valid_conv_all_nth\n by blast\n\nlemma arr_is_valid_intD:\n \"arr_is_valid s p n \\ 0 \\ i \\ nat i < n \\ is_valid_w32 s (p +\\<^sub>p i)\"\n using arr_is_valid_conv_all_nth\n by auto\n\nlemma arr_is_valid_smaller:\n \"arr_is_valid s p n \\ m \\ n \\ arr_is_valid s p m\"\n by (simp add: arr_is_valid_conv_all_nth)\n\n\nsubsection \\ arr_is_valid \\\n\nprimrec\n arr_list :: \"lifted_globals \\ word32 ptr \\ nat \\ word32 list\"\nwhere\n \"arr_list s p 0 = []\"\n | \"arr_list s p (Suc n) = (heap_w32 s p) # arr_list s (p +\\<^sub>p 1) n\"\n\n\nlemma heap_to_arr_list_lookup:\n fixes i :: int\n assumes\n \"0 \\ i\"\n \"i < n\"\n shows \"heap_w32 s (p +\\<^sub>p i) = arr_list s p n ! nat i\"\n using assms\n apply (induct n arbitrary: p i)\n apply simp\n apply (clarsimp simp add: nth_Cons int_geq_0_less_Suc_eq_0_disj split: nat.splits)\n apply (force simp add: pointer_add_ldistrib_add dest: Suc_nat_eq_nat_zadd1)\n done\n\nlemma arr_list_to_heap_lookup:\n assumes \"i < n\"\n shows \"arr_list s p n ! i = heap_w32 s (p +\\<^sub>p int i)\"\n using assms\n by (induct n arbitrary: p i) (force simp: less_Suc_eq_0_disj pointer_add_ldistrib_add)+\n\n\nlemma arr_list_length: \"length (arr_list s p n) = n\"\n by (induct n arbitrary: p) force+\n\nlemma arr_list_empty_iff: \"arr_list s p n = [] \\ n = 0\"\n by (metis arr_list.simps(1) arr_list_length)\n\nlemma arr_list_heap_update:\n assumes\n \"wellbehaved_pointers p n\"\n \"0 \\ i\"\n \"nat i < n\"\n \"arr_is_valid s p n\"\n shows\n \"arr_list (heap_w32_update (\\h. h(p +\\<^sub>p i := v)) s) p n = (arr_list s p n)[nat i := v]\"\n using assms\n by (force simp add:\n list_eq_iff_nth_eq arr_list_to_heap_lookup fun_upd_def\n arr_list_length wellbehaved_pointers_def)\n\nlemma arr_list_heap_update_comp:\n assumes\n \"wellbehaved_pointers p n\"\n \"0 \\ i\"\n \"nat i < n\"\n \"arr_is_valid s p n\"\n shows\n \"arr_list (heap_w32_update ((\\a. a(p +\\<^sub>p i := v)) \\ f) s) p n = (arr_list (heap_w32_update f s) p n)[nat i := v]\"\n using assms\n apply -\n apply (subst heap_w32_update_comp)\n apply (subst arr_list_heap_update)\n apply blast\n apply blast\n apply blast\n apply (simp add: arr_is_valid_update_heap)\n apply blast\n done\n\nlemmas arr_list_heap_update_simps = arr_list_heap_update arr_list_heap_update_comp\n\n(*******************************************************************************)\n\ncontext reverse begin\n\n\nsection \\ Reverse \\\n\n\n(* The monadic definition that autocorres produces for the C code: *)\nthm reverse'_def\n\nsubsection \\ Reverse invariant \\\n\n(* Hint: The invariant for the reverse function is split into three parts.\n In the following three definitions xs is the input list, \n xs' is the modified list, and i, j are list indices. *)\n\n(* Replace True with the correct invariant in each of the following three definitions. *)\n\ndefinition left_invariant :: \"word32 list \\ word32 list \\ nat \\ nat \\ bool\" where\n \"left_invariant xs xs' i j \\ \\k. k < i \\ xs' ! k = xs ! (length xs - k - 1)\"\n\ndefinition middle_invariant :: \"word32 list \\ word32 list \\ nat \\ nat \\ bool\" where\n \"middle_invariant xs xs' i j \\ \\k. i \\ k \\ k \\ j \\ xs' ! k = xs ! k\"\n\ndefinition right_invariant :: \"word32 list \\ word32 list \\ nat \\ nat \\ bool\" where\n \"right_invariant xs xs' i j \\ \\k. j < k \\ k < length xs \\ xs'!k = xs!(length xs - k - 1)\"\n\ndefinition reverse_inv :: \"word32 list \\ word32 list \\ nat \\ nat \\ bool\" where\n \"reverse_inv xs xs' i j \\\n left_invariant xs xs' i j \\ \\ \\ everything less than i is ... \\\n middle_invariant xs xs' i j \\ \\ \\ everything between i and j is ... \\\n right_invariant xs xs' i j\" \\ \\ everything larger than j is ... \\ \n\nlemmas reverse_invariant_def = left_invariant_def middle_invariant_def right_invariant_def reverse_inv_def\n\n\n(* Replace SOMETHING in the following lemmas by something that would allow you \n to prove reverse_correct. *)\n\n\nlemma left_invariant_step:\n assumes\n \"length xs' = length xs\"\n \"i < length xs - Suc i\"\n \"middle_invariant xs xs' i (length xs - Suc i)\"\n \"left_invariant xs xs' i (length xs - Suc i)\"\n shows\n \"left_invariant xs \n (xs'[i := xs' ! (length xs - Suc i),length xs - Suc i:= xs'! i])\n (Suc i) (length xs - Suc (Suc i))\"\n using assms \n unfolding left_invariant_def middle_invariant_def \n apply clarsimp\n by (metis (no_types, hide_lams) less_imp_diff_less linorder_neqE_nat not_less_eq nth_list_update_eq nth_list_update_neq)\n\nlemma right_invariant_step:\n assumes\n \"length xs' = length xs\"\n \"i < length xs - Suc i\"\n \"middle_invariant xs xs' i (length xs - Suc i)\"\n \"right_invariant xs xs' i (length xs - Suc i)\"\n shows\n \"right_invariant xs \n (xs'[i := xs' ! (length xs - Suc i),length xs - Suc i:= xs'! i]) \n (Suc i) (length xs - Suc (Suc i))\"\n using assms \n unfolding middle_invariant_def right_invariant_def \n apply clarsimp \n proof -\n fix k :: nat\n assume a1: \"length xs - Suc (Suc i) < k\"\n assume a2: \"\\k>length xs - Suc i. k < length xs \\ xs' ! k = xs ! (length xs - Suc k)\"\n assume a3: \"k < length xs\"\n have f4: \"length xs - Suc i = k \\ \\ k < length xs - Suc i\"\n using a1 by (metis (no_types) leq_minus_split less_Suc_eq_le nat_less_le not_less_eq)\n have \"\\ length xs - Suc i \\ i\"\n by (meson assms(2) less_Suc_eq_le not_less_eq)\n then have f5: \"i \\ length xs\"\n by (meson i_hate_words_helper nat_le_linear)\n have f6: \"\\ length xs < i\"\n by (meson assms(2) less_Suc_eq less_imp_diff_less not_less_eq)\n have \"\\n. n - Suc n = 0\"\n by simp\n then show \"xs'[i := xs ! (length xs - Suc i), length xs - Suc i := xs ! i] ! k = xs ! (length xs - Suc k)\"\n using f6 f5 f4 a3 a2 by (metis (no_types) Suc_diff_Suc assms(1) assms(2) diff_diff_cancel length_list_update linorder_neqE_nat not_less_zero nth_list_update_eq nth_list_update_neq)\n qed\n\nlemma middle_invariant_step:\n assumes\n \"length xs' = length xs\"\n \"i < length xs - Suc i\"\n \"middle_invariant xs xs' i (length xs - Suc i)\"\n shows\n \"middle_invariant xs \n (xs'[i := xs' ! (length xs - Suc i),length xs - Suc i:= xs'! i])\n (Suc i) (length xs - Suc (Suc i))\"\n using assms unfolding middle_invariant_def by clarsimp \n\n\ntext \\ Show the precondition implies the invariant \\\nlemma pre_impl_inv:\n assumes\n \"n < UINT_MAX\"\n \"arr_is_valid s p n\"\n \"xs = arr_list s p n\"\n \"0 < n\"\n shows\n \"xs \\ []\"\n \"reverse_inv (arr_list s p n) (arr_list s p n) 0 (n - Suc 0)\"\n using assms\n unfolding reverse_inv_def left_invariant_def middle_invariant_def right_invariant_def\n by (auto simp add: arr_list_empty_iff arr_list_length)\n \ntext \\ Show the invariant implies the postcondition \\\n\nlemma left_all_is_rev:\n \"left_invariant xs (rev(xs)) (length xs - 1) 0\"\n unfolding left_invariant_def \n by (simp add: nth_rev)\n\nlemma \n \"i < length xs \\ left_invariant xs (rev(xs)) i (length xs -i -1)\"\n unfolding left_invariant_def\n by (simp add: nth_rev)\n\nlemma for_k_impl_rev:\n \"length xs = length ys \\ \\k. k < length xs \\ ys! k = xs ! (length xs - k - 1) \\ ys = rev xs\"\n apply clarsimp\n apply (induct xs arbitrary:ys )\n apply simp \n by (metis length_rev nth_equalityI nth_rev_alt rev_rev_ident) \n\nlemma inv_impl_post:\n assumes\n \"reverse_inv xs (arr_list s p (length xs)) r (length xs - Suc r)\"\n \"arr_is_valid s p (length xs)\"\n \"length xs - Suc r \\ r\"\n shows \"arr_list s p (length xs) = rev xs\"\n using assms\n unfolding reverse_inv_def left_invariant_def middle_invariant_def right_invariant_def\n apply clarsimp\n using for_k_impl_rev \n by (smt arr_list_length diff_diff_cancel length_rev less_imp_diff_less linorder_neqE_nat\n nat_less_le nth_equalityI rev_nth) \n \n\ntext \\ Show the invariant is preserved by the loop \\\nlemma invariant_preservation:\n assumes\n \"i < length xs - Suc i\"\n \"arr_is_valid s p (length xs)\"\n \"reverse_inv xs (arr_list s p (length xs)) i (length xs - Suc i)\"\n shows\n \"reverse_inv xs\n ((arr_list s p (length xs))[i := xs ! (length xs - Suc i),length xs - Suc i:= xs! i])\n (Suc i) (length xs - Suc (Suc i))\"\n using assms \n unfolding reverse_inv_def left_invariant_def middle_invariant_def right_invariant_def\n apply safe \n apply clarsimp \n apply (metis (no_types, hide_lams) arr_list_length less_antisym less_imp_diff_less not_less_eq nth_list_update_eq nth_list_update_neq)\n apply simp \n apply clarsimp \n proof -\n fix k :: nat\n assume a1: \"\\k>length xs - Suc i. k < length xs \\ arr_list s p (length xs) ! k = xs ! (length xs - Suc k)\"\n assume a2: \"k < length xs\"\n assume a3: \"length xs - Suc (Suc i) < k\"\n have f4: \"\\n na. \\ (n::nat) \\ na \\ \\ na < n\"\n using less_Suc_eq_le not_less_eq by presburger\n then have f5: \"length xs - Suc i = k \\ \\ k \\ length xs - Suc i\"\n using a3 by (metis (no_types) leq_minus_split)\n have f6: \"i \\ length xs\"\n using assms(1) by linarith\n have f7: \"Suc i \\ length xs\"\n by (meson assms(1) less_Suc_eq_le less_imp_diff_less not_less_eq)\n have \"\\ k \\ i\"\n using f5 f4 by (meson assms(1) le_trans nat_less_le)\n moreover\n { assume \"length xs - k \\ i \\ k \\ i\"\n then have \"(arr_list s p (length xs)) [i := xs ! (length xs - Suc i), length xs - Suc i := xs ! i] ! k = xs ! (length xs - Suc k) \\ length xs - Suc i \\ k \\ k \\ i\"\n using f6 f4 a2 by (metis (no_types) arr_list_length diff_diff_cancel length_list_update leq_minus_split nat_less_le not_less_eq_eq nth_list_update_eq) }\n ultimately show \"(arr_list s p (length xs)) [i := xs ! (length xs - Suc i), length xs - Suc i := xs ! i] ! k = xs ! (length xs - Suc k)\"\n using f7 f5 a2 a1 by (metis (no_types) diff_diff_cancel nat_le_linear nat_less_le not_less_eq_eq nth_list_update_neq)\n qed\n\ntext \\ Show reverse is correct \\\n\nlemma inv_impl_mid: \"reverse_inv xs xs' i j \\ middle_invariant xs xs' i j\"\n unfolding reverse_inv_def by blast \n\nlemma mid_impl_access_origin: \n \"\\middle_invariant xs xs' i j ; ine \\ i ; ine \\ j\\ \\ xs ! ine = xs'! ine\"\n unfolding middle_invariant_def by simp \n\n\nlemma state_access_is_arr_access: \n \"xs = arr_list s p n \\ x < n \\ x \\ 0 \\ xs ! x = heap_w32 s (p +\\<^sub>p int (x))\"\n by (simp add: arr_list_to_heap_lookup)\n\nlemma mid_impl_access_state_origin:\n \"\\i < j; i \\ 0; j < n;length xs = n;xs' = arr_list s p n;\n middle_invariant xs xs' i j ; ine \\ i ; ine \\ j\\\n \\ heap_w32 s (p +\\<^sub>p int (ine)) = xs ! ine \"\n unfolding middle_invariant_def \n by (simp add: arr_list_to_heap_lookup)\n\nlemma mid_impl_access_heap : \"\\\n i < j; i \\ 0; j < n;length xs = n;xs' = arr_list s p n;n < UINT_MAX;\n middle_invariant xs xs' i j ; ine \\ i ; ine \\ j; k \\0 ; k < n \\\n \\ xs [k := heap_w32 s (p +\\<^sub>p int (ine)) ] = xs [k := xs ! ine]\" \n unfolding middle_invariant_def \n apply clarsimp \n by (simp add: arr_list_to_heap_lookup)\n\nlemma pointer_add_simp:\n fixes r :: nat\n and s :: lifted_globals\n assumes a1: \"r < length xs - Suc r\"\n assumes a2: \"n = length xs\"\n assumes a3: \"arr_is_valid s p (length xs)\"\n shows \"is_valid_w32 s (p +\\<^sub>p (int (length xs) - (1 + int r)))\" \n proof - \n have f4: \"r < n - Suc r\"\n using a2 a1 by meson\n then have \"Suc r < n\"\n by linarith\n then have f5: \"\\ n < Suc r\"\n by linarith\n have \"n - Suc r < n\"\n using f4 by linarith\n then show \"is_valid_w32 s (p +\\<^sub>p (int (length xs) - (1 + int r)))\"\n using f5 a3 a2 by (metis (no_types) add_diff_cancel_left' add_diff_inverse_nat arr_is_validD of_nat_Suc of_nat_add)\n qed \n\nlemma reverse_correct:\n \"\\ \\s. wellbehaved_pointers p n \\\n length xs < UINT_MAX \\\n arr_is_valid s p (length xs) \\\n arr_list s p n = xs \\\n n = length xs \\\n n > 0\n \\\n reverse' p n\n \\ \\r s. arr_is_valid s p (length xs) \\ \n arr_list s p n = rev xs \\!\"\n unfolding reverse'_def\n apply (wp | clarsimp)+\n apply (rule_tac\n I= \"\\ i s. \n wellbehaved_pointers p n \\\n n = length xs \\\n n < UINT_MAX \\\n n > 0 \\\n i < n \\\n n - i - 1 < n \\\n arr_is_valid s p (length xs) \\\n reverse_inv xs (arr_list s p n) i (length xs - i - 1) \n \"\n and M = \"\\ (i,_) . length xs - i\"\n in whileLoop_add_invI)\n apply (wp | clarsimp )+\n apply (auto simp add: arr_list_heap_update_simps)[2]\n using arr_is_valid_update_heap apply blast\n apply (frule invariant_preservation) \n apply simp+\n apply (frule inv_impl_mid, subst heap_to_arr_list_lookup[where ?n = \"length xs\"], fastforce+) +\n apply (simp add: nat_minus_as_int reverse_invariant_def(2)) \n apply (simp add: pointer_add_simp)\n using arr_is_validD apply auto[1]\n using reverse.inv_impl_post apply auto[1]\n apply (wp| clarsimp)\n using reverse.pre_impl_inv(2) by fastforce\n\nend\n", "meta": {"author": "tecty", "repo": "COMP4161-Ass3", "sha": "da85f3f4d0bfcfb118913bd77a937e982f991351", "save_path": "github-repos/isabelle/tecty-COMP4161-Ass3", "path": "github-repos/isabelle/tecty-COMP4161-Ass3/COMP4161-Ass3-da85f3f4d0bfcfb118913bd77a937e982f991351/a3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.289869400008195}} {"text": "section \\Map Interface\\\ntheory IICF_Map \nimports \"../../Sepref\"\nbegin\n \nsubsection \\Parametricity for Maps\\\ndefinition [to_relAPP]: \"map_rel K V \\ (K \\ \\V\\option_rel)\n \\ { (mi,m). dom mi \\ Domain K \\ dom m \\ Range K }\"\n(*\ndefinition [to_relAPP]: \"map_rel K V \\ (K \\ \\V\\option_rel)\n \\ { (mi,m). dom mi \\ Domain K \\ dom m \\ Range K \n \\ ran mi \\ Domain V \\ ran m \\ Range V }\"\n*)\n\nlemma bi_total_map_rel_eq:\n \"\\IS_RIGHT_TOTAL K; IS_LEFT_TOTAL K\\ \\ \\K,V\\map_rel = K \\ \\V\\option_rel\"\n unfolding map_rel_def IS_RIGHT_TOTAL_def IS_LEFT_TOTAL_def\n by (auto dest: fun_relD)\n \n\n\nlemma map_rel_empty1_simp[simp]: \n \"(Map.empty,m)\\\\K,V\\map_rel \\ m=Map.empty\"\n apply (auto simp: map_rel_def)\n by (meson RangeE domIff option_rel_simp(1) subsetCE tagged_fun_relD_none)\n\nlemma map_rel_empty2_simp[simp]: \n \"(m,Map.empty)\\\\K,V\\map_rel \\ m=Map.empty\"\n apply (auto simp: map_rel_def)\n by (meson Domain.cases domIff fun_relD2 option_rel_simp(2) subset_eq)\n\nlemma map_rel_obtain1:\n assumes 1: \"(m,n)\\\\K,V\\map_rel\"\n assumes 2: \"n l = Some w\"\n obtains k v where \"m k = Some v\" \"(k,l)\\K\" \"(v,w)\\V\"\n using 1 unfolding map_rel_def\nproof clarsimp\n assume R: \"(m, n) \\ K \\ \\V\\option_rel\"\n assume \"dom n \\ Range K\"\n with 2 obtain k where \"(k,l)\\K\" by auto\n moreover from fun_relD[OF R this] have \"(m k, n l) \\ \\V\\option_rel\" .\n with 2 obtain v where \"m k = Some v\" \"(v,w)\\V\" by (cases \"m k\"; auto)\n ultimately show thesis by - (rule that)\nqed\n\nlemma map_rel_obtain2:\n assumes 1: \"(m,n)\\\\K,V\\map_rel\"\n assumes 2: \"m k = Some v\"\n obtains l w where \"n l = Some w\" \"(k,l)\\K\" \"(v,w)\\V\"\n using 1 unfolding map_rel_def\nproof clarsimp\n assume R: \"(m, n) \\ K \\ \\V\\option_rel\"\n assume \"dom m \\ Domain K\"\n with 2 obtain l where \"(k,l)\\K\" by auto\n moreover from fun_relD[OF R this] have \"(m k, n l) \\ \\V\\option_rel\" .\n with 2 obtain w where \"n l = Some w\" \"(v,w)\\V\" by (cases \"n l\"; auto)\n ultimately show thesis by - (rule that)\nqed\n\n\n\nsubsection \\Interface Type\\\n\nsepref_decl_intf ('k,'v) i_map is \"'k \\ 'v\"\n\n\n\nsubsection \\Operations\\\n\n\ncontext\n fixes t :: \"unit \\ nat\"\nbegin\n definition \"mop_map_empty = SPECT [ Map.empty \\ t ()]\"\n\n lemma mop_map_empty: \"tt \\ lst (SPECT [ Map.empty \\ t () ]) Q \n \\ tt \\ lst (mop_map_empty ) Q\" unfolding mop_map_empty_def by simp\n\n sepref_register \"mop_map_empty\" \nend\n\n\ncontext\n fixes t :: \"(( 'a \\ 'b option) * 'a) * 'b \\ nat\"\nbegin\n definition \"mop_map_update m k v = SPECT [ m(k \\ v) \\ t ((m,k),v)]\"\n\n\n lemma mop_map_update: \"tt \\ lst (SPECT [ m(k \\ v) \\ t ((m,k),v)]) Q\n \\ tt \\ lst (mop_map_update m k v) Q\" unfolding mop_map_update_def by simp\n\n sepref_register \"mop_map_update\" \nend\n\n\ncontext\n fixes t :: \"('a \\ 'b option) * 'a \\ nat\"\nbegin\n definition \"mop_map_dom_member m x = SPECT (emb (\\b. b \\ x\\dom m) (t (m,x)))\"\n\n\n lemma mop_map_dom_member: \"tt \\ lst (SPECT (emb (\\b. b \\ x\\dom m) (t (m,x)))) Q\n \\ tt \\ lst (mop_map_dom_member m x) Q\" unfolding mop_map_dom_member_def by simp\n\n sepref_register \"mop_map_dom_member\" \nend\n\ncontext\n fixes t :: \"('a \\ 'b option) * 'a \\ nat\"\nbegin\n definition \"mop_map_lookup m x = do {\n ASSERT (x\\dom m);\n SPECT [ (the (m x)) \\ t (m,x)]\n }\"\n\n\n lemma mop_map_lookup: \"tt \\ lst (SPECT [ (the (m x)) \\ t (m,x)]) Q\n \\ x : dom m \n \\ tt \\ lst (mop_map_lookup m x) Q\" unfolding mop_map_lookup_def by simp\n\n lemma progress_mop_map_lookup[progress_rules]: \"t (m,x) > 0 \\ progress (mop_map_lookup m x)\"\n unfolding mop_map_lookup_def by (auto intro!: progress_rules simp add: zero_enat_def) \n\n sepref_register \"mop_map_lookup\"\nend\n\nend\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/IICF/Intf/IICF_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2898442505212363}} {"text": "(* Title: Conflict analysis/Flowgraphs\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nsection \"Flowgraphs\"\ntheory Flowgraph\nimports Main Misc\nbegin\ntext_raw \\\\label{thy:Flowgraph}\\\n\ntext \\\n We use a flowgraph-based program model that extends the one we used previously \\cite{LM07}. \n A program is represented as an edge annotated graph and a set of procedures. The nodes of the graph are partitioned by the procedures, i.e. every node belongs to exactly one procedure. There are no edges\n between nodes of different procedures. Every procedure has a distinguished entry and return node and a set of monitors it synchronizes on. Additionally, the program has a distinguished {\\em main} procedure.\n The edges are annotated with statements. A statement is either a base statement, a procedure call or a thread creation (spawn). Procedure calls and thread creations refer to the called procedure or to the initial procedure\n of the spawned thread, respectively.\n\n We require that the main procedure and any initial procedure of a spawned thread does not to synchronize on any monitors. This avoids that spawning of a procedure together with entering a monitor is available in our \n model as an atomic step, which would be an unrealistic assumption for practical problems. Technically, our model would become strictly more powerful without this assumption.\n\n\n If we allowed this, our model would become strictly more powerful, \n\\\n\nsubsection \"Definitions\"\n \ndatatype ('p,'ba) edgeAnnot = Base 'ba | Call 'p | Spawn 'p\ntype_synonym ('n,'p,'ba) edge = \"('n \\ ('p,'ba) edgeAnnot \\ 'n)\"\n\nrecord ('n,'p,'ba,'m) flowgraph_rec =\n edges :: \"('n,'p,'ba) edge set\" \\ \\Set of annotated edges\\\n main :: \"'p\" \\ \\Main procedure\\\n entry :: \"'p \\ 'n\" \\ \\Maps a procedure to its entry point\\\n return :: \"'p \\ 'n\" \\ \\Maps a procedure to its return point\\\n mon :: \"'p \\ 'm set\" \\ \\Maps procedures to the set of monitors they allocate\\\n proc_of :: \"'n \\ 'p\" \\ \\Maps a node to the procedure it is contained in\\\n\ndefinition \n \"initialproc fg p == p=main fg \\ (\\u v. (u,Spawn p,v)\\edges fg)\"\n\nlemma main_is_initial[simp]: \"initialproc fg (main fg)\"\n by (unfold initialproc_def) simp\n\nlocale flowgraph =\n fixes fg :: \"('n,'p,'ba,'m,'more) flowgraph_rec_scheme\" (structure)\n (* Type annotation unnecessary, but perhaps makes it more readable\n for the unaware reader ;) *)\n \\ \\Edges are inside procedures only\\\n assumes edges_part: \"(u,a,v)\\edges fg \\ proc_of fg u = proc_of fg v\" \n \\ \\The entry point of a procedure must be in that procedure\\\n assumes entry_valid[simp]: \"proc_of fg (entry fg p) = p\" \n \\ \\The return point of a procedure must be in that procedure\\\n assumes return_valid[simp]: \"proc_of fg (return fg p) = p\" \n \\ \\Initial procedures do not synchronize on any monitors\\\n assumes initial_no_mon[simp]: \"initialproc fg p \\ mon fg p = {}\" \n\nsubsection \"Basic properties\"\nlemma (in flowgraph) spawn_no_mon[simp]: \n \"(u, Spawn p, v) \\ edges fg \\ mon fg p = {}\" \n using initial_no_mon by (unfold initialproc_def, blast)\nlemma (in flowgraph) main_no_mon[simp]: \"mon fg (main fg) = {}\" \n using initial_no_mon by (unfold initialproc_def, blast)\n\n\n\nlemma (in flowgraph) entry_entry_same_proc[simp]: \n \"entry fg p = entry fg p' \\ p=p'\"\n apply (subgoal_tac \"proc_of fg (entry fg p) = proc_of fg (entry fg p')\")\n apply (simp (no_asm_use))\n by simp\n\nlemma (in flowgraph) return_return_same_proc[simp]: \n \"return fg p = return fg p' \\ p=p'\"\n apply (subgoal_tac \"proc_of fg (return fg p) = proc_of fg (entry fg p')\")\n apply (simp (no_asm_use))\n by simp\n\nsubsection \"Extra assumptions for flowgraphs\"\ntext_raw \\\\label{sec:Flowgraph:extra_asm}\\\ntext \\\n In order to simplify the definition of our restricted schedules (cf. Section~\\ref{thy:Normalization}), we make some extra constraints on flowgraphs. \n Note that these are no real restrictions, as we can always rewrite flowgraphs to match these constraints, preserving the set of conflicts. We leave it to future work to consider such a rewriting formally. \n\n The background of this restrictions is that we want to start an execution of a thread with a procedure call that never returns. This will allow easier technical treatment in Section~\\ref{thy:Normalization}. Here we enforce this\n semantic restrictions by syntactic properties of the flowgraph.\n\\\n\ntext \\The return node of a procedure is called {\\em isolated}, if it has no incoming edges and is different from the entry node. A procedure with an isolated return node will never return. \n See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this.\\\ndefinition \n \"isolated_ret fg p == \n (\\u l. \\(u,l,return fg p)\\edges fg) \\ entry fg p \\ return fg p\"\n\ntext \\The following syntactic restrictions guarantee that each thread's execution starts with a non-returning call. See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this.\\\nlocale eflowgraph = flowgraph +\n \\ \\Initial procedure's entry node isn't equal to its return node\\\n assumes initial_no_ret: \"initialproc fg p \\ entry fg p \\ return fg p\" \n \\ \\The only outgoing edges of initial procedures' entry nodes are call edges to procedures with isolated return node\\\n assumes initial_call_no_ret: \"\\initialproc fg p; (entry fg p,l,v)\\edges fg\\ \n \\ \\p'. l=Call p' \\ isolated_ret fg p'\" \n\nsubsection \\Example Flowgraph\\\ntext_raw \\\\label{sec:Flowgraph:ex_flowgraph}\\\ntext \\This section contains a check that there exists a (non-trivial) flowgraph, i.e. that the assumptions made in the \\flowgraph\\ and \\eflowgraph\\ \n locales are consistent and have at least one non-trivial model.\\\ndefinition \n \"example_fg == \\ \n edges = {((0::nat,0::nat),Call 1,(0,1)), ((1,0),Spawn 0,(1,0)), \n ((1,0),Call 0, (1,0))}, \n main = 0, \n entry = \\p. (p,0), \n return = \\p. (p,1), \n mon = \\p. if p=1 then {0} else {}, \n proc_of= \\ (p,x). p \\\"\n\nlemma exists_eflowgraph: \"eflowgraph example_fg\"\n apply (unfold_locales)\n apply (unfold example_fg_def)\n apply simp\n apply fast\n apply simp\n apply simp\n apply (simp add: initialproc_def)\n apply (simp add: initialproc_def)\n apply (simp add: initialproc_def isolated_ret_def)\n done\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Program-Conflict-Analysis/Flowgraph.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891307678321, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.28984424341885906}} {"text": "theory LaunchburyMoreFree\nimports Terms Heap Launchbury\nbegin\n\ntext {*\nThis variant of the original semantics allocates an additional free variable in the application case.\nThis is a prelimary step towards the equivalence of the original and the stacked semantics.\n*}\n\ninductive\n reds :: \"heap \\ exp \\ var list \\ heap \\ exp \\ bool\"\n (\"_ : _ \\*\\<^bsub>_\\<^esub> _ : _\" [50,50,50,50] 50)\nwhere\n Lambda:\n \"\\ : (Lam [x]. e) \\*\\<^bsub>L\\<^esub> \\ : (Lam [x]. e)\" \n | Application: \"\\\n atom y \\ (\\,e,x,L,\\,\\,z) ;\n atom (n::var) \\ (\\,e,x,L,\\,\\,z) ;\n n \\ y;\n \\ : e \\*\\<^bsub>n#x#L\\<^esub> \\ : (Lam [y]. e');\n \\ : e'[y ::= x] \\*\\<^bsub>L\\<^esub> \\ : z\n \\ \\\n \\ : App e x \\*\\<^bsub>L\\<^esub> \\ : z\" \n | Variable: \"\\\n (x,e) \\ set \\; delete x \\ : e \\*\\<^bsub>x#L\\<^esub> \\ : z \\ \\ \\ : Var x \\*\\<^bsub>L\\<^esub> (x, z) # \\ : z\"\n | Let: \"\\\n set (bn as) \\* (\\, L);\n asToHeap as @ \\ : body \\*\\<^bsub>L\\<^esub> \\ : z\n \\ \\\n \\ : Let as body \\*\\<^bsub>L\\<^esub> \\ : z\"\n\nequivariance reds\n\nnominal_inductive reds\n avoids Application: \"y\" and \"n\"\n by(auto simp add: fresh_star_def fresh_Pair)\n\nlemma reds_less_free:\n \"\\ : e \\*\\<^bsub>L\\<^esub> \\ : z \\ \\ : e \\\\<^bsub>L\\<^esub> \\ : z\"\nproof(induct rule: LaunchburyMoreFree.reds.induct)\ncase (Application y \\ e x L \\ \\ z n e')\n show ?case\n proof(rule Launchbury.reds.Application)\n show \"atom y \\ (\\, e, x, L, \\, \\, z)\"\n by fact\n show \"\\ : e \\\\<^bsub>x # L\\<^esub> \\ : Lam [y]. e'\"\n apply (rule reds_smaller_L[OF Application.hyps(5)])\n by auto\n show \"\\ : e'[y::=x] \\\\<^bsub>L\\<^esub> \\ : z\"\n by fact\n qed\nqed (auto intro: reds_smaller_L Launchbury.reds.intros simp add: fresh_star_Pair)\n\n\nlemma reds_with_n_doesnt_forget:\n \"\\ : e \\*\\<^bsub>L\\<^esub> \\ : z \\ heapVars \\ \\ heapVars \\\"\nby (metis reds_less_free reds_doesnt_forget)\n\nlemma reds_with_n_fresh:\" \\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z;\n atom (x::var) \\ (\\, e)\n \\ \\ atom x \\ (\\, z) \\ x \\ (heapVars \\ - set L)\"\n by (metis reds_less_free reds_fresh)\n\nlemma reds_with_n_add_var_L: \"\\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z;\n atom (x::var) \\ (\\, e, \\, z);\n set L' = insert x (set L)\n \\ \\ \\ : e \\*\\<^bsub>L'\\<^esub> \\ : z\"\nproof(nominal_induct avoiding : L' rule: reds.strong_induct)\ncase (Lambda \\ x e L L')\n show ?case\n by (rule reds.Lambda)\nnext\ncase (Application y \\ e xa L \\ \\ z n e' L')\n show ?case\n proof(rule reds.Application)\n show \"atom y \\ (\\, e, xa, L', \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n \n show \"atom n \\ (\\, e, xa, L', \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n\n show \"n \\ y\" by fact\n\n have \"x \\ heapVars \\\"\n using `atom x \\ (\\, App e xa, \\, z)`\n apply (simp add: fresh_Pair)\n by (metis heapVars_not_fresh)\n hence \"x \\ heapVars \\\"\n by (metis set_mp reds_with_n_doesnt_forget[OF Application.hyps(20)])\n\n have \"atom x \\ (\\, e)\"\n using `atom x \\ (\\, App e xa, \\, z)`\n by (simp add: fresh_Pair)\n from reds_with_n_fresh[OF Application.hyps(18) this] `x \\ heapVars \\`\n have \"atom x \\ (\\, Lam [y]. e')\"\n by auto\n hence \"atom x \\ (\\, e, \\, Lam [y]. e')\"\n using `atom x \\ (\\, App e xa, \\, z)`\n by (simp add: fresh_Pair)\n moreover\n have \"set (n # xa # L') = insert x (set (n # xa # L))\"\n using `set L' = _` by auto\n ultimately\n show \"\\ : e \\*\\<^bsub>n # xa # L'\\<^esub> \\ : Lam [y]. e'\"\n by (rule Application.hyps(19))\n\n have \"atom x \\ (\\, e'[y::=xa])\"\n using `atom x \\ (\\, Lam [y]. e')` `atom x \\ (\\, App e xa, \\, z)` `atom y \\ xa`\n by (auto simp add: fresh_Pair subst_pres_fresh)\n from reds_with_n_fresh[OF Application.hyps(20) this] `x \\ heapVars \\`\n have \"atom x \\ (\\, z)\" by auto\n hence \"atom x \\ (\\, e'[y::=xa], \\, z)\"\n using `atom x \\ (\\, e'[y::=xa])`\n by (simp add: fresh_Pair)\n then\n show \"\\ : e'[y::=xa] \\*\\<^bsub>L'\\<^esub> \\ : z \"\n by (rule Application.hyps(21)[OF _ `set L' = _`])\n qed\nnext \ncase (Variable xa e \\ L \\ z L')\n have \"atom x \\ (delete xa \\, e, \\, z)\"\n using Variable.prems(1)\n by (auto simp add: fresh_Pair fresh_Cons intro: fresh_delete fresh_heap_expr[OF _ Variable(1)])\n moreover\n have \"set (xa # L') = insert x (set (xa # L))\"\n using Variable.prems(2) by auto\n ultimately\n show ?case\n by (rule reds.Variable[OF Variable(1) Variable.hyps(3)])\nnext\ncase (Let as \\ L body \\ z L')\n have \"x \\ heapVars \\\"\n using Let.prems(1)\n apply (auto simp add: fresh_Pair)\n by (metis heapVars_not_fresh)+\n hence \"x \\ heapVars (asToHeap as @ \\)\"\n by (metis set_mp reds_with_n_doesnt_forget[OF Let.hyps(3)])\n hence \"atom x \\ set (bn as)\"\n by (auto simp add: set_bn_to_atom_heapVars)\n hence \"set (bn as) \\* x\"\n by (auto simp add: fresh_star_def fresh_at_base)\n \n hence \"set (bn as) \\* set L'\"\n using Let(2) Let.prems(2)\n by (auto simp add: fresh_star_def fresh_finite_insert fresh_set)\n hence \"set (bn as) \\* (\\, L')\" \n using Let(1-4)\n by (simp add: fresh_star_Pair fresh_star_set )\n moreover\n have \"atom x \\ (asToHeap as @ \\, body, \\, z)\"\n using Let.prems(1) `atom x \\ set (bn as)`\n by (auto simp add: fresh_Pair fresh_append fresh_fun_eqvt_app[OF asToHeap_eqvt])\n ultimately\n show ?case\n by (rule reds.Let[OF _ Let.hyps(4)[OF _ Let.prems(2)]])\nqed\n\nlemma reds_more_free:\n \"\\ : e \\\\<^bsub>L\\<^esub> \\ : z \\ \\ : e \\*\\<^bsub>L\\<^esub> \\ : z\"\nproof(nominal_induct rule: Launchbury.reds.strong_induct)\ncase (Application y \\ e x L \\ \\ z e')\n obtain n :: var where\n fresh: \"atom n \\ (\\, e, x, L, \\, \\, z, y, Lam [y]. e')\" \n by (rule obtain_fresh)\n\n show ?case\n proof (rule reds.Application)\n show \"atom y \\ (\\, e, x, L, \\, \\, z)\"\n using Application\n by (auto simp add: fresh_Pair)\n show \"atom n \\ (\\, e, x, L, \\, \\, z)\"\n using fresh\n by (auto simp add: fresh_Pair)\n show \"n \\ y\"\n using fresh\n by (auto simp add: fresh_Pair fresh_at_base)\n\n note `\\ : e \\*\\<^bsub>x # L\\<^esub> \\ : Lam [y]. e'`\n moreover\n have \"atom n \\ (\\, e, \\, Lam [y]. e')\"\n using fresh by (auto simp add: fresh_Pair)\n ultimately\n show \"\\ : e \\*\\<^bsub>n # x # L\\<^esub> \\ : Lam [y]. e'\"\n by (rule reds_with_n_add_var_L, simp)\n\n show \"\\ : e'[y::=x] \\*\\<^bsub>L\\<^esub> \\ : z\"\n by fact\n qed\nqed (auto intro: reds.intros simp add: fresh_star_Pair)\n\nlemma reds_more_free_eq:\n \"(\\ : e \\*\\<^bsub>L\\<^esub> \\ : z) \\ (\\ : e \\\\<^bsub>L\\<^esub> \\ : z)\"\n by (metis reds_less_free reds_more_free)\n\nlemmas reds_with_n_strong_induct = LaunchburyMoreFree.reds.strong_induct[unfolded reds_more_free_eq, consumes 1, case_names Lambda Application Variable Let]\nlemmas reds_with_n_induct = LaunchburyMoreFree.reds.induct[unfolded reds_more_free_eq, consumes 1, case_names Lambda Application Variable Let]\n\n(* This can be shown for reds directly, but we needed it here, and after we got the equality we can transfer it easily. *)\nlemmas reds_add_var_L = reds_with_n_add_var_L[unfolded reds_more_free_eq]\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/LaunchburyMoreFree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.28984424341885906}} {"text": "section {*I\\_epda\\_lemmas*}\ntheory\n I_epda_lemmas\n\nimports\n I_epda_main\n\nbegin\n\nlemma epda_read_in_epda_events: \"\n valid_epda M\n \\ e \\ epda_delta M\n \\ Some a = edge_event e\n \\ a \\ epda_events M\"\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"e\"\n in ballE)\n apply(auto)\n apply(simp add: valid_epda_step_label_def)\n apply(erule conjE)+\n apply(simp add: option_to_set_def)\n apply(force)\n done\n\nlemma valid_epda_initial_in_states: \"\n valid_epda M\n \\ epda_initial M \\ epda_states M\"\n apply(simp add: valid_epda_def)\n done\n\nlemma valid_epda_box_in_gamma: \"\n valid_epda G\n \\ epda_box G \\ epda_gamma G\"\n apply(simp add: valid_epda_def)\n done\n\ndefinition valid_pda :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"valid_pda G \\\n valid_epda G\n \\ (\\e \\ epda_delta G. length (edge_pop e) = 1)\"\n\ndefinition valid_dpda :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"valid_dpda G \\\n valid_pda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\"\n\ndefinition empty_push_edge :: \"\n ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"empty_push_edge e \\\n edge_push e = []\"\n\ndefinition strict_empty_push_edge :: \"\n ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"strict_empty_push_edge e \\\n edge_push e = []\n \\ edge_event e = None\"\n\ndefinition multiple_push_edge :: \"\n ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"multiple_push_edge e \\\n length (edge_push e) > Suc 0\"\n\ndefinition strict_multiple_push_edge :: \"\n ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"strict_multiple_push_edge e \\\n suffix (edge_push e) (edge_pop e)\n \\ edge_event e = None\"\n\ndefinition pop_edges_seperated :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"pop_edges_seperated G \\\n \\e \\ epda_delta G.\n empty_push_edge e\n \\ strict_empty_push_edge e\"\n\ndefinition pop_edges_seperated_ALT :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"pop_edges_seperated_ALT G \\\n \\e \\ epda_delta G.\n edge_push e = [] \\ edge_event e = None\"\n\nlemma pop_edges_seperated_ALT_vs_pop_edges_seperated: \"\n pop_edges_seperated_ALT G = pop_edges_seperated G\"\n apply(simp add: pop_edges_seperated_ALT_def pop_edges_seperated_def empty_push_edge_def strict_empty_push_edge_def)\n done\n\ndefinition push_edges_seperated :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"push_edges_seperated G \\\n \\e \\ epda_delta G.\n multiple_push_edge e\n \\ strict_multiple_push_edge e\"\n\ndefinition push_edges_seperated_ALT :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"push_edges_seperated_ALT G \\\n \\e \\ epda_delta G.\n length (edge_push e) > Suc 0\n \\ (suffix (edge_push e) (edge_pop e) \\ edge_event e = None)\"\n\nlemma push_edges_seperated_ALT_vs_push_edges_seperated: \"\n push_edges_seperated_ALT G = push_edges_seperated G\"\n apply(simp add: multiple_push_edge_def strict_multiple_push_edge_def push_edges_seperated_ALT_def push_edges_seperated_def)\n done\n\ndefinition valid_simple_dpda :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"valid_simple_dpda G \\\n valid_dpda G\n \\ (\\e \\ epda_delta G.\n case edge_event e of\n Some a \\\n edge_pop e = edge_push e\n | None \\\n edge_push e = []\n \\ (\\w. edge_push e = w # edge_pop e))\"\n\ndefinition valid_dfa :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"valid_dfa G \\\n valid_dpda G\n \\ (\\e \\ epda_delta G.\n edge_event e \\ None\n \\ edge_pop e = [epda_box G]\n \\ edge_push e = [epda_box G])\"\n\n(*prevention can occur due to stacks; designed for DFA only*)\ndefinition some_step_from_every_configuration :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"some_step_from_every_configuration G \\\n \\q \\ epda_states G.\n \\A \\ epda_events G.\n \\e \\ epda_delta G.\n edge_src e = q\n \\ edge_event e = Some A\"\n\ndefinition epdaS_accessible_states :: \"\n ('state, 'event, 'stack) epda\n \\ 'state set\"\n where\n \"epdaS_accessible_states G \\\n {q \\ epda_states G.\n \\d n.\n epdaS.derivation G d\n \\ (case get_configuration (d n) of\n None \\ False\n | Some c \\ epdaS_conf_state c = q)\n \\ (case get_configuration (d 0) of\n None \\ False\n | Some c \\ c \\ epdaS_initial_configurations G)}\"\n\ndefinition n_step_epdaS_accessible_states :: \"\n ('state, 'event, 'stack) epda\n \\ nat\n \\ 'state set\"\n where\n \"n_step_epdaS_accessible_states G n \\\n {q. \\d c.\n epdaS.derivation_initial G d\n \\ get_configuration (d n) = Some c\n \\ epdaS_conf_state c = q}\"\n\ndefinition at_most_n_epdaS_accessible_states :: \"\n ('state, 'event, 'stack) epda\n \\ nat\n \\ 'state set\"\n where\n \"at_most_n_epdaS_accessible_states G n \\\n {q. \\d c k.\n k \\ n\n \\ epdaS.derivation_initial G d\n \\ get_configuration (d k) = Some c\n \\ epdaS_conf_state c = q}\"\n\ndefinition all_states_accessible :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"all_states_accessible G \\\n epda_states G \\ epdaS_accessible_states G\"\n\ndefinition epdaS_accessible_edges :: \"\n ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda_step_label set\"\n where\n \"epdaS_accessible_edges G \\\n {e \\ epda_delta G.\n \\d n c.\n epdaS.derivation_initial G d\n \\ d n = Some (pair (Some e) c)}\"\n\ndefinition all_edges_accessible :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"all_edges_accessible G \\\n epda_delta G \\ epdaS_accessible_edges G\"\n\ndefinition accessible :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"accessible G \\\n all_states_accessible G\n \\ all_edges_accessible G\"\n\nlemma valid_epda_accessible_implies_accessible: \"\n valid_epda G\n \\ accessible G\n \\ epdaS.accessible G\"\n apply(simp add: epdaS.accessible_def accessible_def all_states_accessible_def all_edges_accessible_def epda_destinations_def epdaS.get_accessible_destinations_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"epda_delta G \\ epdaS_accessible_edges G\")\n apply(subgoal_tac \"xa \\ epdaS_accessible_states G\")\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"epda_states G \\ epdaS_accessible_states G\")\n apply(simp add: epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac xa d n)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac xa d n)(*strict*)\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac xa d n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c e ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac d n c e ca)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d n c e ca)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(rule_tac\n x = \"e\"\n in exI)\n apply(rule_tac\n x = \"ca\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaS_get_destinations_def)\n apply(rename_tac xa d n)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac xa d n)(*strict*)\n apply(force)\n apply(rename_tac xa d n a)(*strict*)\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac xa d n a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"n\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac xa d n a)(*strict*)\n apply(force)\n apply(rename_tac xa d n a)(*strict*)\n apply(force)\n apply(rename_tac xa d n a)(*strict*)\n apply(force)\n apply(rename_tac xa d n a)(*strict*)\n apply(force)\n apply(rename_tac xa d n)(*strict*)\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"epda_states G \\ epdaS_accessible_states G\")\n apply(subgoal_tac \"xa \\ epdaS_accessible_edges G\")\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"epda_delta G \\ epdaS_accessible_edges G\")\n apply(simp add: epdaS_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac xa d n c)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(rule_tac\n x = \"Some xa\"\n in exI)\n apply(rule_tac\n x = \"c\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaS_get_destinations_def)\n apply(rename_tac xa)(*strict*)\n apply(force)\n done\n\nlemma at_most_n_epdaS_accessible_states_by_n_step_epdaS_accessible_states: \"\n at_most_n_epdaS_accessible_states G n = \\{n_step_epdaS_accessible_states G k | k. k\\n}\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: at_most_n_epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac d c k)(*strict*)\n apply(rule_tac\n x = \"n_step_epdaS_accessible_states G k\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d c k)(*strict*)\n apply(rule_tac\n x = \"k\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d c k)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(clarsimp)\n apply(clarsimp)\n apply(rename_tac x k)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def at_most_n_epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac k d c)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x = \"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x = \"k\"\n in exI)\n apply(clarsimp)\n done\n\nlemma epdaS_accessible_states_by_n_step_epdaS_accessible_states: \"\n valid_epda G\n \\ epdaS_accessible_states G = \\{n_step_epdaS_accessible_states G k | k. True}\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(simp add: epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac x d n)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac x d n)(*strict*)\n prefer 2\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac x d n)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac x d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac x d n c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option b)(*strict*)\n apply(rule_tac\n x = \"n_step_epdaS_accessible_states G n\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d n c option b)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(rule order_antisym)\n apply(rename_tac d n c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option b x)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac d n c option b da ca)(*strict*)\n apply(rule_tac\n x = \"da\"\n in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option b da ca)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(rule_tac\n x = \"da\"\n in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c option b)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac x k)(*strict*)\n apply(simp add: n_step_epdaS_accessible_states_def epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac k d c)(*strict*)\n apply(rule conjI)\n apply(rename_tac k d c)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations G\")\n apply(rename_tac k d c)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac k d c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d k\")\n apply(rename_tac k d c)(*strict*)\n apply(force)\n apply(rename_tac k d c a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac k d c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac k d c option)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac k d c option)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac k d c option)(*strict*)\n apply(force)\n apply(rename_tac k d c option)(*strict*)\n apply(force)\n apply(rename_tac k d c option)(*strict*)\n apply(force)\n apply(rename_tac k d c)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(rule conjI)\n apply(rename_tac k d c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac k d c)(*strict*)\n apply(rule conjI)\n apply(rename_tac k d c)(*strict*)\n apply(rule_tac\n x = \"k\"\n in exI)\n apply(clarsimp)\n apply(rename_tac k d c)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac k d c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac k d c)(*strict*)\n apply(clarsimp)\n apply(rename_tac k d c ca)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n done\n\nlemma n_step_epdaS_accessible_states_are_states: \"\n valid_epda G\n \\ n_step_epdaS_accessible_states G n \\ epda_states G\"\n apply(simp add: n_step_epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac d c)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations G\")\n apply(rename_tac d c)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac d c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac d c)(*strict*)\n apply(force)\n apply(rename_tac d c a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac d c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c option)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac d c option)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac d c option)(*strict*)\n apply(force)\n apply(rename_tac d c option)(*strict*)\n apply(force)\n apply(rename_tac d c option)(*strict*)\n apply(force)\n done\n\nlemma at_most_n_epdaS_accessible_states_are_states: \"\n valid_epda G\n \\ at_most_n_epdaS_accessible_states G n \\ epda_states G\"\n apply(simp add: at_most_n_epdaS_accessible_states_def)\n apply(clarsimp)\n apply(rename_tac d c k)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations G\")\n apply(rename_tac d c k)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac d c k)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d k\")\n apply(rename_tac d c k)(*strict*)\n apply(force)\n apply(rename_tac d c k a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac d c k a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c k option)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac d c k option)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac d c k option)(*strict*)\n apply(force)\n apply(rename_tac d c k option)(*strict*)\n apply(force)\n apply(rename_tac d c k option)(*strict*)\n apply(force)\n done\n\nlemma derivation_stays_in_states: \"\n valid_epda M\n \\ set w \\ epda_events M\n \\ set s \\ epda_gamma M\n \\ set h1 \\ epda_events M\n \\ epdaS.derivation M d\n \\ d 0 = Some (pair None \\epdaS_conf_state = q, epdaS_conf_scheduler = w, epdaS_conf_stack = s\\)\n \\ q \\ epda_states M\n \\ d i = Some (pair e1 \\epdaS_conf_state = qi, epdaS_conf_scheduler = wi, epdaS_conf_stack = si\\)\n \\ qi\\ epda_states M\"\n apply(subgoal_tac \"\\epdaS_conf_state = qi, epdaS_conf_scheduler = wi, epdaS_conf_stack = si\\ \\ epdaS_configurations M\")\n prefer 2\n apply(rule epdaS.stays_in_configuration)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: epdaS_configurations_def)\n apply(force)\n apply(force)\n apply(simp add: epdaS_configurations_def)\n done\n\nlemma epda_is_is_forward_target_deterministic_accessible: \"\n valid_epda M\n \\ epdaS.is_forward_target_deterministic_accessible M\"\n apply(simp add: epdaS.is_forward_target_deterministic_accessible_def)\n apply(auto)\n apply(rename_tac c c1 c2 e)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(auto)\n done\n\nlemma epda_is_is_forward_target_deterministic: \"\n valid_epda M\n \\ epdaS.is_forward_target_deterministic M\"\n apply(simp add: epdaS.is_forward_target_deterministic_def)\n apply(auto)\n apply(rename_tac c c1 c2 e)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(auto)\n done\n\nlemma epda_is_backward_target_deterministic: \"\n valid_epda M\n \\ epdaS.is_backward_target_deterministic M\"\n apply(simp add: epdaS.is_backward_target_deterministic_def)\n apply(auto)\n apply(rename_tac c c1 c2 e)(*strict*)\n apply(unfold epdaS_step_relation_def)\n apply(force)\n done\n\nlemma DFA_derivation_drops_stepwise: \"\n valid_dfa M\n \\ epdaS.derivation M d\n \\ maximum_of_domain d m\n \\ n\\m\n \\ d 0 = Some (pair None c1)\n \\ d n = Some (pair e c2)\n \\ (epdaS_conf_scheduler c2 = drop n (epdaS_conf_scheduler c1))\n \\ (length (epdaS_conf_scheduler c1) = n + (length (epdaS_conf_scheduler c2)))\"\n apply(subgoal_tac \"\\d c1 e c2 m. epdaS.derivation M d \\ maximum_of_domain d m \\ n\\m \\ d 0 = Some (pair None c1) \\ d n = Some (pair e c2) \\ ((epdaS_conf_scheduler c2 = drop n (epdaS_conf_scheduler c1)) \\(length (epdaS_conf_scheduler c1) = n + (length (epdaS_conf_scheduler c2))))\")\n apply(force)\n apply(thin_tac \"epdaS.derivation M d\")\n apply(thin_tac \"maximum_of_domain d m\")\n apply(thin_tac \"n\\m\")\n apply(thin_tac \"d 0 = Some (pair None c1)\")\n apply(thin_tac \"d n = Some (pair e c2)\")\n apply(induct n)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 e c2 m)(*strict*)\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac n d c1 e c2 m)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom)\n apply(rename_tac n d c1 e c2 m)(*strict*)\n apply(blast)\n apply(rename_tac n d c1 e c2 m)(*strict*)\n apply(blast)\n apply(rename_tac n d c1 e c2 m)(*strict*)\n apply(arith)\n apply(rename_tac n d c1 e c2 m)(*strict*)\n apply(erule exE)+\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(erule_tac\n x = \"derivation_take d n\"\n in allE)\n apply(erule_tac\n x = \"c1\"\n in allE)\n apply(erule_tac\n x = \"ea\"\n in allE)\n apply(erule_tac\n x = \"c\"\n in allE)\n apply(erule impE)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(rule conjI)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(rule_tac epdaS.derivation_take_preserves_derivation)\n apply(blast)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(rule conjI)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(rule_tac\n m = \"m-n\"\n in epdaS.derivation_take_preserves_generates_maximum_of_domain)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(blast)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(erule conjE)+\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(subgoal_tac \"\\e'. e = Some e'\")\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n prefer 2\n apply(subgoal_tac \"\\e c. d (Suc n) = Some (pair (Some e) c)\")\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom_after_0)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(blast)+\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 e c2 m ea c)(*strict*)\n apply(erule exE)+\n apply(rename_tac n d c1 e c2 m ea c e')(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(subgoal_tac \"epdaS_step_relation M c e' c2\")\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n prefer 2\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(blast)+\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(subgoal_tac \"\\a. edge_event e' = Some a\")\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n prefer 2\n apply(simp add: valid_dfa_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"e'\"\n in ballE)\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac n d c1 c2 m ea c e')(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e' a)(*strict*)\n apply(rule conjI)\n apply(rename_tac n d c1 c2 m ea c e' a)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e' a w)(*strict*)\n apply(case_tac c2)\n apply(rename_tac n d c1 c2 m ea c e' a w epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 m ea c e' a w epdaS_conf_schedulera)(*strict*)\n apply(case_tac c)\n apply(rename_tac n d c1 m ea c e' a w epdaS_conf_schedulera epdaS_conf_statea epdaS_conf_scheduleraa epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 m ea e' a w epdaS_conf_schedulera)(*strict*)\n apply(case_tac e')\n apply(rename_tac n d c1 m ea e' a w epdaS_conf_schedulera edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 m ea a w epdaS_conf_schedulera edge_src edge_pop edge_push edge_trg)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n t = \"drop (Suc n) (epdaS_conf_scheduler c1)\"\n and s = \"drop (Suc 0) (drop n (epdaS_conf_scheduler c1))\"\n in ssubst)\n apply(rename_tac n d c1 m ea a w epdaS_conf_schedulera edge_src edge_pop edge_push edge_trg)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t = \"Suc n\"\n and s = \"Suc 0+n\"\n in ssubst)\n apply(rename_tac n d c1 m ea a w epdaS_conf_schedulera edge_src edge_pop edge_push edge_trg)(*strict*)\n apply(arith)\n apply(rename_tac n d c1 m ea a w epdaS_conf_schedulera edge_src edge_pop edge_push edge_trg)(*strict*)\n apply(rule drop_drop)\n apply(rename_tac n d c1 m ea a w epdaS_conf_schedulera edge_src edge_pop edge_push edge_trg)(*strict*)\n apply(force)\n apply(rename_tac n d c1 c2 m ea c e' a)(*strict*)\n apply(subgoal_tac \"length (epdaS_conf_scheduler c) = Suc (length(epdaS_conf_scheduler c2))\")\n apply(rename_tac n d c1 c2 m ea c e' a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e' a)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n d c1 c2 m ea c e' a w)(*strict*)\n apply(simp add: option_to_list_def)\n done\n\nlemma InductOverReachables: \"\n valid_epda M\n \\ P (epda_initial M)\n \\ (\\p e q cp cq. cp \\ epdaS_configurations M \\ cq \\ epdaS_configurations M \\ p\\ (epdaS_accessible_states M) \\ P p \\ epdaS_conf_state cp = p \\ epdaS_conf_state cq = q \\ epdaS_step_relation M cp e cq \\ e \\ epda_step_labels M \\ P q)\n \\ p \\ (epdaS_accessible_states M)\n \\ P p\"\n apply(subgoal_tac \"\\n. p\\ (epda_states M) \\ (\\d. epdaS.derivation M d \\ (case get_configuration (d n) of None \\ False | Some c \\ epdaS_conf_state c = p)\\ (case get_configuration (d 0) of None \\ False | Some c \\ c \\ epdaS_initial_configurations M))\")\n prefer 2\n apply(simp add: epdaS_accessible_states_def)\n apply(force)\n apply(erule exE)\n apply(rename_tac n)(*strict*)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac n d)(*strict*)\n apply(erule conjE)+\n apply(rule_tac\n n = \"n\"\n and f = \"\\n. {q\\ (epda_states M). \\d. epdaS.derivation M d \\ (case get_configuration (d n) of None \\ False | Some c \\ epdaS_conf_state c = q)\\ (case get_configuration (d 0) of None \\ False | Some c \\ c \\ epdaS_initial_configurations M)}\"\n in BEST_INDUCT2)\n apply(rename_tac n d)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(force)\n apply(rename_tac n d)(*strict*)\n apply(rule allI)\n apply(rename_tac n d k)(*strict*)\n apply(rule impI)+\n apply(rule allI)+\n apply(rename_tac n d k x l)(*strict*)\n apply(rule impI)+\n apply(clarsimp)\n apply(rename_tac n d k x l da)(*strict*)\n apply(case_tac \"lx. \\l epda_states M \\ (\\d. epdaS.derivation M d \\ (case get_configuration (d l) of None \\ False | Some c \\ epdaS_conf_state c = x) \\ (case get_configuration (d 0) of None \\ False | Some c \\ c \\ epdaS_initial_configurations M)) \\ P x\"\n in allE)\n apply(rename_tac n d k x l da)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"l\"\n and P = \"\\l. l < k \\ (\\d. epdaS.derivation M d \\ (case get_configuration (d l) of None \\ False | Some c \\ epdaS_conf_state c = x) \\ (case get_configuration (d 0) of None \\ False | Some c \\ c \\ epdaS_initial_configurations M)) \\ P x\"\n in allE)\n apply(rename_tac n d k x l da)(*strict*)\n apply(erule impE)\n apply(rename_tac n d k x l da)(*strict*)\n apply(arith)\n apply(rename_tac n d k x l da)(*strict*)\n apply(force)\n apply(rename_tac n d k x l da)(*strict*)\n apply(subgoal_tac \"l = k\")\n apply(rename_tac n d k x l da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n d k x l da)(*strict*)\n apply(thin_tac \"\\ l < k\")\n apply(thin_tac \"l \\ k\")\n apply(clarsimp)\n apply(rename_tac n d k x da)(*strict*)\n apply(case_tac k)\n apply(rename_tac n d k x da)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d x da)(*strict*)\n apply(subgoal_tac \"x = epda_initial M\")\n apply(rename_tac n d x da)(*strict*)\n apply(force)\n apply(rename_tac n d x da)(*strict*)\n apply(case_tac \"get_configuration (da 0)\")\n apply(rename_tac n d x da)(*strict*)\n apply(force)\n apply(rename_tac n d x da a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da a)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(rename_tac n d k x da nat)(*strict*)\n apply(subgoal_tac \"\\ek ck. da k = Some (pair (Some ek) ck)\")\n apply(rename_tac n d k x da nat)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(case_tac \"da k\")\n apply(rename_tac n d k x da nat)(*strict*)\n apply(force)\n apply(rename_tac n d k x da nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d x da nat a)(*strict*)\n apply(case_tac a)\n apply(rename_tac n d x da nat a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat option b)(*strict*)\n apply(case_tac option)\n apply(rename_tac n d da nat option b)(*strict*)\n apply(rule_tac\n d = \"da\"\n in epdaS.derivation_Always_PreEdge_prime)\n apply(rename_tac n d da nat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat option b a)(*strict*)\n apply(force)\n apply(rename_tac n d k x da nat)(*strict*)\n apply(subgoal_tac \"\\enat cnat. da nat = Some (pair enat cnat)\")\n apply(rename_tac n d k x da nat)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac n d x da nat ek ck)(*strict*)\n apply(case_tac \"da nat\")\n apply(rename_tac n d x da nat ek ck)(*strict*)\n apply(rule_tac\n d = \"da\"\n and n = \"nat\"\n in epdaS.derivationNoFromNone)\n apply(rename_tac n d x da nat ek ck)(*strict*)\n apply(force)\n apply(rename_tac n d x da nat ek ck)(*strict*)\n apply(force)\n apply(rename_tac n d x da nat ek ck)(*strict*)\n apply(force)\n apply(rename_tac n d x da nat ek ck a)(*strict*)\n apply(case_tac a)\n apply(rename_tac n d x da nat ek ck a option b)(*strict*)\n apply(force)\n apply(rename_tac n d k x da nat)(*strict*)\n apply(erule exE)+\n apply(rename_tac n d k x da nat ek enat ck cnat)(*strict*)\n apply(subgoal_tac \"\\q. q \\ epda_states M \\ (epdaS.derivation M da \\ (case get_configuration (da nat) of None \\ False | Some c \\ epdaS_conf_state c = q)\\ (case get_configuration (da 0) of None \\ False | Some c \\ epdaS_conf_state c = epda_initial M))\")\n apply(rename_tac n d k x da nat ek enat ck cnat)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(case_tac \"da 0\")\n apply(rename_tac n d k x da nat ek enat ck cnat)(*strict*)\n apply(force)\n apply(rename_tac n d k x da nat ek enat ck cnat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat a)(*strict*)\n apply(case_tac \"da nat\")\n apply(rename_tac n d da nat ek enat ck cnat a)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat a)(*strict*)\n apply(case_tac a)\n apply(rename_tac n d da nat ek enat ck cnat a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(rule conjI)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(subgoal_tac \"cnat \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"da\"\n and m = \"0\"\n in epdaS.stays_in_configuration)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(subgoal_tac \"epdaS_initial_configurations M \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(rule epdaS.AX_initial_configuration_belongs)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(case_tac cnat)\n apply(rename_tac n d da nat ek enat ck cnat option b epdaS_conf_statea epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck option b epdaS_conf_statea epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(rename_tac n d da nat ek enat ck cnat option b)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(rename_tac n d k x da nat ek enat ck cnat)(*strict*)\n apply(erule exE)+\n apply(rename_tac n d k x da nat ek enat ck cnat q)(*strict*)\n apply(erule conjE)+\n apply(simp add: get_configuration_def)\n apply(case_tac \"d 0\")\n apply(rename_tac n d k x da nat ek enat ck cnat q)(*strict*)\n apply(force)\n apply(rename_tac n d k x da nat ek enat ck cnat q a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat a)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac n d da nat ek enat ck cnat a)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac n d da nat ek enat ck cnat a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat aa option b)(*strict*)\n apply(case_tac \"aa\")\n apply(rename_tac n d da nat ek enat ck cnat aa option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba)(*strict*)\n apply(case_tac \"da 0\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"da nat\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba a)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba a)(*strict*)\n apply(case_tac \"a\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba a optionb bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule_tac\n x = \"epdaS_conf_state cnat\"\n and P = \"\\x. \\l epda_states M \\ (\\d. epdaS.derivation M d \\ (case case_option None (case_derivation_configuration (\\e. Some)) (d l) of None \\ False | Some c \\ epdaS_conf_state c = x) \\ (case case_option None (case_derivation_configuration (\\e. Some)) (d 0) of None \\ False | Some c \\ c \\ epdaS_initial_configurations M)) \\ P x\"\n in allE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule_tac\n x = \"nat\"\n in allE)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x = \"da\"\n in exI)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule_tac\n x = \"epdaS_conf_state cnat\"\n in allE)\n apply(erule_tac\n x = \"ek\"\n in allE)\n apply(erule_tac\n x = \"epdaS_conf_state ck\"\n in allE)\n apply(erule_tac\n x = \"cnat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"cnat \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"da\"\n and m = \"0\"\n in epdaS.stays_in_configuration)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(subgoal_tac \"epdaS_initial_configurations M \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule epdaS.AX_initial_configuration_belongs)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule_tac\n d = \"da\"\n in epdaS.belongs_configurations)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(simp add: epdaS.derivation_def)\n apply(erule_tac\n x = \"0\"\n and P = \"\\x. case x of 0 \\ case da 0 of None \\ False | Some (pair None c) \\ True | Some (pair (Some e) c) \\ False | Suc i' \\ case da x of None \\ True | Some (pair i1 i2) \\ case da i' of None \\ False | Some (pair i'1 i'2) \\ case i1 of None \\ False | Some i1v \\ epdaS_step_relation M i'2 i1v i2\"\n in allE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"optionb\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule_tac\n x = \"ck\"\n in allE)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule_tac\n d = \"da\"\n and m = \"0\"\n in epdaS.stays_in_configuration)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(subgoal_tac \"epdaS_initial_configurations M \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule epdaS.AX_initial_configuration_belongs)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(simp add: epdaS_accessible_states_def)\n apply(rule_tac\n x = \"da\"\n in exI)\n apply(rule conjI)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule conjI)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule_tac\n x = \"nat\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation M cnat ek ck\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"da\"\n in epdaS.position_change_due_to_step_relation)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(erule impE)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(subgoal_tac \"ek \\ epda_step_labels M \\ ck \\ epdaS_configurations M\")\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(rule epdaS.AX_step_relation_preserves_belongs)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac n d da nat ek enat ck cnat option b optiona ba optionb bb)(*strict*)\n apply(force)\n done\n\nlemma epda_earliest_word_removal_position: \"\n epdaS.derivation G d\n \\ d 0 = Some (pair None c)\n \\ d n = Some (pair e cn)\n \\ \\ P c\n \\ P cn\n \\ P = (\\c. \\(\\z. w@z = epdaS_conf_scheduler c))\n \\ \\k\\n. (\\i (case d i of None \\ False | Some (pair e c) \\ P c)) \\\n (case d k of None \\ False | Some (pair e c) \\ P c)\"\n apply(rule epdaS.existence_of_earliest_satisfaction_point)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epda_drop_terminals: \"\n valid_epda G\n \\ epdaS.derivation G d\n \\ d i = Some (pair e c)\n \\ case d (i+j) of None \\ True | Some (pair e' c') \\ \\w. w@(epdaS_conf_scheduler c') = (epdaS_conf_scheduler c)\"\n apply(rule_tac\n m = \"i\"\n and n = \"j\"\n in epdaS.property_preseved_under_steps_is_invariant2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac ia)(*strict*)\n apply(case_tac \"d (Suc ia)\")\n apply(rename_tac ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac ia a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia option b)(*strict*)\n apply(case_tac option)\n apply(rename_tac ia option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia b)(*strict*)\n apply(rule epdaS.derivation_Always_PreEdge_prime)\n apply(rename_tac ia b)(*strict*)\n apply(force)\n apply(rename_tac ia b)(*strict*)\n apply(force)\n apply(rename_tac ia option b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia b a)(*strict*)\n apply(case_tac \"d ia\")\n apply(rename_tac ia b a)(*strict*)\n apply(rule epdaS.derivationNoFromNone)\n apply(rename_tac ia b a)(*strict*)\n apply(force)\n apply(rename_tac ia b a)(*strict*)\n apply(force)\n apply(rename_tac ia b a)(*strict*)\n apply(force)\n apply(rename_tac ia b a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac ia b a aa option ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia b a option ba w)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation G ba a b\")\n apply(rename_tac ia b a option ba w)(*strict*)\n prefer 2\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac ia b a option ba w)(*strict*)\n apply(force)\n apply(rename_tac ia b a option ba w)(*strict*)\n apply(force)\n apply(rename_tac ia b a option ba w)(*strict*)\n apply(force)\n apply(rename_tac ia b a option ba w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ia b a option ba w wa)(*strict*)\n apply(rule_tac\n t = \"epdaS_conf_scheduler c\"\n and s = \"w @ option_to_list (edge_event a) @ epdaS_conf_scheduler b\"\n in ssubst)\n apply(rename_tac ia b a option ba w wa)(*strict*)\n apply(force)\n apply(rename_tac ia b a option ba w wa)(*strict*)\n apply(simp (no_asm))\n done\n\nlemma epda_Nonblockingness2: \"\n valid_epda G\n \\ Nonblockingness2 (epdaS.unmarked_language G) (epdaS.marked_language G)\"\n apply(simp add: Nonblockingness2_def)\n apply(simp add: epdaS.marked_language_def epdaS.unmarked_language_def prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac x d c)(*strict*)\n apply(simp add: epdaS_initial_configurations_def epdaS_marked_effect_def epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac x d c ca i e cb)(*strict*)\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(case_tac \"x\")\n apply(rename_tac x d c ca i e cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(rule_tac\n x = \"der1 (ca\\epdaS_conf_scheduler:= []\\)\"\n in exI)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(rule conjI)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(simp add: der1_def)\n apply(simp add: epdaS_initial_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(rule conjI)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(simp add: epdaS_unmarked_effect_def)\n apply(simp add: der1_def)\n apply(rename_tac d ca i e cb)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n apply(subgoal_tac \"\\k\\i. (\\i (case d i of None \\ False | Some (pair e c') \\ (\\x. length (epdaS_conf_scheduler x) \\ length c)c')) \\ (case d k of None \\ False | Some (pair e c') \\ (\\x. length (epdaS_conf_scheduler x) \\ length c) c')\")\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n prefer 2\n apply(rule epdaS.existence_of_earliest_satisfaction_point)\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n apply(force)\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n apply(force)\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n apply(force)\n apply(rename_tac x d c ca i e cb a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k)(*strict*)\n apply(case_tac \"d k\")\n apply(rename_tac d c ca i e cb a list k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k aa)(*strict*)\n apply(case_tac aa)\n apply(rename_tac d c ca i e cb a list k aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(rule_tac\n x = \"\\n. (case (derivation_take d k) n of None \\ None | Some (pair e c') \\ Some (pair e (c'\\epdaS_conf_scheduler:= take (length (epdaS_conf_scheduler c') - length c) (epdaS_conf_scheduler c')\\)))\"\n in exI)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(subgoal_tac \"epdaS.derivation G (\\n. case_option None (case_derivation_configuration (\\e c'. Some (pair e (c'\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c') - length c) (epdaS_conf_scheduler c')\\)))) (derivation_take d k n)) \\ (case case_option None (case_derivation_configuration (\\e c'. Some (pair e (c'\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c') - length c) (epdaS_conf_scheduler c')\\)))) (derivation_take d k 0) of None \\ False | Some (pair a b) \\ b \\ epdaS_initial_configurations G \\ a = None)\")\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(rule conjI)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(rule conjI)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(simp add: epdaS_unmarked_effect_def)\n apply(rule_tac\n x = \"ca\\epdaS_conf_scheduler:= a#list\\\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(simp add: derivation_take_def)\n apply(case_tac ca)\n apply(rename_tac d c ca i e cb a list k option b epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(rule_tac\n x = \"b\\epdaS_conf_scheduler:= []\\\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x = \"k\"\n in exI)\n apply(rule_tac\n x = \"option\"\n in exI)\n apply(simp add: derivation_take_def)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(simp add: derivation_take_def)\n apply(simp (no_asm) add: epdaS.derivation_def)\n apply(rule conjI)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n prefer 2\n apply(case_tac ca)\n apply(rename_tac d c ca i e cb a list k option b epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c i e cb a list k option b epdaS_conf_statea epdaS_conf_stack)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(simp add: epdaS_initial_configurations_def)\n apply(simp add: epdaS_configurations_def)\n apply(rule conjI)\n apply(rename_tac d c i e cb a list k option b epdaS_conf_statea epdaS_conf_stack)(*strict*)\n apply(rule valid_epda_initial_in_states)\n apply(force)\n apply(rename_tac d c i e cb a list k option b epdaS_conf_statea epdaS_conf_stack)(*strict*)\n apply(rule valid_epda_box_in_gamma)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b ia)(*strict*)\n apply(rule conjI)\n apply(rename_tac d c ca i e cb a list k option b ia)(*strict*)\n apply(clarsimp)\n apply(case_tac ia)\n apply(rename_tac d c ca i e cb a list k option b ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(case_tac \"Suc nat = k\")\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(rule_tac\n M = \"G\"\n and d = \"d\"\n and n = \"k\"\n and i = \"Suc nat\"\n in epdaS.derivationNoFromNone2)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(case_tac \"d nat\")\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(rule_tac\n M = \"G\"\n and d = \"d\"\n and n = \"k\"\n and i = \"nat\"\n in epdaS.derivationNoFromNone2)\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat aa ab)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac d c ca i e cb a list k option b nat aa ab optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ab optiona ba)(*strict*)\n apply(case_tac ab)\n apply(rename_tac d c ca i e cb a list k option b nat ab optiona ba optionb bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat optiona ba optionb bb)(*strict*)\n apply(case_tac optiona)\n apply(rename_tac d c ca i e cb a list k option b nat optiona ba optionb bb)(*strict*)\n apply(rule epdaS.derivation_Always_PreEdge_prime)\n apply(rename_tac d c ca i e cb a list k option b nat optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat optiona ba optionb bb)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat optiona ba optionb bb aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation G bb aa ba\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n prefer 2\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(subgoal_tac \"\\a z. a#z@c = epdaS_conf_scheduler bb\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa ab z)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa ab z w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac aa)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa ab z w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb ab z w edge_event edge_pop edge_push)(*strict*)\n apply(case_tac edge_event)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb ab z w edge_event edge_pop edge_push)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb ab z w edge_event edge_pop edge_push aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb z w edge_pop edge_push aa)(*strict*)\n apply(rule List.take_all)\n apply(erule_tac\n x = \"nat\"\n in allE)\n apply(clarsimp)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(erule_tac\n x = \"nat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\w. w@epdaS_conf_scheduler bb = a#list@c\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n prefer 2\n apply(subgoal_tac \"case d (0+nat) of None \\ True | Some (pair e' c') \\ \\w. w@(epdaS_conf_scheduler c') = (epdaS_conf_scheduler ca)\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n prefer 2\n apply(rule epda_drop_terminals)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w)(*strict*)\n apply(subgoal_tac \"prefix (a#list) w \\ prefix w (a#list) \")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w)(*strict*)\n apply(simp add: prefix_def)\n apply(erule disjE)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa cc)(*strict*)\n apply(subgoal_tac \"a#list@cc@epdaS_conf_scheduler bb = a#list@c\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa cc)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa cc)(*strict*)\n apply(subgoal_tac \"cc @ epdaS_conf_scheduler bb = c\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa cc)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa cc)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(subgoal_tac \"a#list@c = w @ epdaS_conf_scheduler bb\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(subgoal_tac \"w@cc@c = w @ epdaS_conf_scheduler bb\")\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n prefer 2\n apply(rule_tac\n t = \"w@cc@c\"\n and s = \"(w@cc)@c\"\n in ssubst)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(simp (no_asm_use))\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(rule_tac\n t = \"w@cc\"\n and s = \"a#list\"\n in ssubst)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(case_tac cc)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w cc ab lista)(*strict*)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b nat ba optionb bb aa w)(*strict*)\n apply(rule_tac\n b = \"c\"\n and d = \"epdaS_conf_scheduler bb\"\n in mutual_prefix_prefix)\n apply(force)\n apply(rename_tac d c ca i e cb a list k option b ia)(*strict*)\n apply(clarsimp)\n apply(case_tac ia)\n apply(rename_tac d c ca i e cb a list k option b ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c ca i e cb a list k option b ia nat)(*strict*)\n apply(clarsimp)\n done\n\nlemma epda_earliest_word_removal_position_prime: \"\n epdaS.derivation G d\n \\ d 0 = Some (pair None c)\n \\ d n = Some (pair e cn)\n \\ \\ P c\n \\ P cn\n \\ P = (\\c. \\(\\z. z@ca@epdaS_conf_scheduler cn = epdaS_conf_scheduler c))\n \\ \\k\\n. (\\i (case d i of None \\ False | Some (pair e c) \\ P c)) \\\n (case d k of None \\ False | Some (pair e c) \\ P c)\"\n apply(rule epdaS.existence_of_earliest_satisfaction_point)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epda_maximal_context_preserves_derivation_prime: \"\n valid_epda M\n \\ dh 0 = Some (pair None c)\n \\ epdaS.belongs M dh\n \\ epdaS.derivation M dh\n \\ maximum_of_domain dh n\n \\ dh n = Some (pair e ca)\n \\ epdaS_conf_scheduler c = w @ epdaS_conf_scheduler ca\n \\ epdaS.derivation M\n (derivation_map dh\n (\\c. c\\epdaS_conf_scheduler :=\n take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler ca)) (epdaS_conf_scheduler c) @ v\\))\"\n apply(simp (no_asm_simp) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: derivation_map_def)\n apply(case_tac \"dh (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e c. dh nat = Some (pair e c)\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(subgoal_tac \"\\e c. dh (Suc nat) = Some (pair (Some e) c)\")\n apply(rename_tac nat a ea cb)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaS.pre_some_position_is_some_position_prime)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation M cb eaa caa\")\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(simp add: derivation_map_def)\n apply(simp add: epda_step_labels_def epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa wa)(*strict*)\n apply(case_tac \"edge_event eaa\")\n apply(rename_tac nat ea cb eaa caa wa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"Suc (length (epdaS_conf_scheduler caa)) - length (epdaS_conf_scheduler ca) \\ Suc 0\")\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(subgoal_tac \"length (epdaS_conf_scheduler caa) \\ length (epdaS_conf_scheduler ca)\")\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(subgoal_tac \"Suc nat\\n\")\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state caa = w @ (epdaS_string_state ca)\")\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"n-(Suc nat)\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa wa a waa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(case_tac \"Suc nat > n\")\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(rule_tac\n m = \"Suc nat\"\n and n = \"n\"\n in epdaS.no_some_beyond_maximum_of_domain)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa wa a)(*strict*)\n apply(force)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(force)+\n done\n\nlemma epda_maximal_context_preserves_derivation_with_Crop: \"\n valid_epda M\n \\ dh 0 = Some (pair None c)\n \\ epdaS.belongs M dh\n \\ epdaS.derivation M dh\n \\ maximum_of_domain dh n\n \\ dh n = Some (pair e ca)\n \\ epdaS_conf_scheduler c = w @ epdaS_conf_scheduler ca\n \\ dh n1 = Some (pair e2 c2)\n \\ n1\\n\n \\ dh (n1 + min n2 (n - n1)) = Some (pair e1 c1)\n \\ epdaS.derivation M\n (derivation_map (derivation_take (derivation_drop dh n1) (min n2 (n - n1)))\n (\\c. c\\epdaS_conf_scheduler :=\n take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler ca)) (epdaS_conf_scheduler c)\\))\"\n apply(simp (no_asm_simp) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(clarsimp)\n apply(case_tac \"dh (Suc (nat + n1))\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e c. dh ((nat + n1)) = Some (pair e c)\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"(Suc (nat + n1))\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(subgoal_tac \"\\e c. dh (Suc (nat + n1)) = Some (pair (Some e) c)\")\n apply(rename_tac nat a ea cb)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"(Suc (nat + n1))\"\n in epdaS.pre_some_position_is_some_position_prime)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(subgoal_tac \"epdaS_step_relation M cb eaa caa\")\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(case_tac nat)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ea caa wa)(*strict*)\n apply(case_tac \"edge_event ea\")\n apply(rename_tac ea caa wa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"length (epdaS_conf_scheduler caa) \\ length (epdaS_conf_scheduler ca)\")\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state caa = w @ (epdaS_string_state ca)\")\n apply(rename_tac ea caa wa a)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"n-(Suc n1)\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea caa wa a waa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rename_tac nat ea cb eaa caa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata wa)(*strict*)\n apply(case_tac \"edge_event eaa\")\n apply(rename_tac ea cb eaa caa nata wa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"length (epdaS_conf_scheduler caa) \\ length (epdaS_conf_scheduler ca)\")\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state caa = w @ (epdaS_string_state ca)\")\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"n-(Suc (Suc (nata + n1)))\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(rule_tac\n t = \"(Suc (Suc (nata + n1)) + (n - Suc (Suc (nata + n1))))\"\n and s = \"n\"\n in ssubst)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata wa a waa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(force)+\n done\n\nlemma epda_maximal_context_preserves_derivation_with_Crop_prime: \"\n valid_epda M\n \\ dh 0 = Some (pair None c)\n \\ epdaS.belongs M dh\n \\ epdaS.derivation M dh\n \\ maximum_of_domain dh n\n \\ dh n = Some (pair e ca)\n \\ epdaS_conf_scheduler c = w @ epdaS_conf_scheduler ca\n \\ dh n1 = Some (pair e2 c2)\n \\ n1\\n\n \\ dh (n1 + min n2 (n - n1)) = Some (pair e1 c1)\n \\ epdaS.derivation M\n (derivation_map (derivation_take (derivation_drop dh n1) (min n2 (n - n1)))\n (\\c. c\\epdaS_conf_scheduler :=\n take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler ca)) (epdaS_conf_scheduler c)@v\\))\"\n apply(simp (no_asm_simp) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(clarsimp)\n apply(case_tac \"dh (Suc (nat + n1))\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e c. dh ((nat + n1)) = Some (pair e c)\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"(Suc (nat + n1))\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(subgoal_tac \"\\e c. dh (Suc (nat + n1)) = Some (pair (Some e) c)\")\n apply(rename_tac nat a ea cb)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"(Suc (nat + n1))\"\n in epdaS.pre_some_position_is_some_position_prime)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(force)\n apply(rename_tac nat a ea cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(subgoal_tac \"epdaS_step_relation M cb eaa caa\")\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(case_tac nat)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ea caa wa)(*strict*)\n apply(case_tac \"edge_event ea\")\n apply(rename_tac ea caa wa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"length (epdaS_conf_scheduler caa) \\ length (epdaS_conf_scheduler ca)\")\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state caa = w @ (epdaS_string_state ca)\")\n apply(rename_tac ea caa wa a)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"n-(Suc n1)\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(force)\n apply(rename_tac ea caa wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea caa wa a waa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rename_tac nat ea cb eaa caa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata wa)(*strict*)\n apply(case_tac \"edge_event eaa\")\n apply(rename_tac ea cb eaa caa nata wa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"length (epdaS_conf_scheduler caa) \\ length (epdaS_conf_scheduler ca)\")\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state caa = w @ (epdaS_string_state ca)\")\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"n-(Suc (Suc (nata + n1)))\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(rule_tac\n t = \"(Suc (Suc (nata + n1)) + (n - Suc (Suc (nata + n1))))\"\n and s = \"n\"\n in ssubst)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(force)\n apply(rename_tac ea cb eaa caa nata wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea cb eaa caa nata wa a waa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac nat ea cb eaa caa)(*strict*)\n apply(force)+\n done\n\nlemma epda_maximal_context_preserves_belongs: \"\n valid_epda M\n \\ dh 0 = Some (pair None c)\n \\ epdaS.belongs M dh\n \\ epdaS.derivation M dh\n \\ maximum_of_domain dh n\n \\ dh n = Some (pair e ca)\n \\ epdaS_conf_scheduler c = w @ epdaS_conf_scheduler ca\n \\ dh n1 = Some (pair e2 c2)\n \\ n1\\n\n \\ dh (n1 + min n2 (n - n1)) = Some (pair e1 c1)\n \\ epdaS.belongs M (derivation_map (derivation_take (derivation_drop dh n1) (min n2 (n - n1))) (\\c. c\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler ca)) (epdaS_conf_scheduler c)\\))\"\n apply(rule epdaS.derivation_belongs)\n apply(force)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(simp add: epdaS.belongs_def)\n apply(erule_tac\n x = \"n1\"\n in allE)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s x)(*strict*)\n apply(rule_tac\n A = \"set (take (length i - length (epdaS_conf_scheduler ca)) i)\"\n in set_mp)\n apply(rename_tac q i s x)(*strict*)\n apply(rule_tac\n B = \"set i\"\n in subset_trans)\n apply(rename_tac q i s x)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac q i s x)(*strict*)\n apply(force)\n apply(rename_tac q i s x)(*strict*)\n apply(force)\n apply(rule epda_maximal_context_preserves_derivation_with_Crop)\n apply(force)+\n done\n\nlemma epda_maximal_context_preserves_belongs_prime: \"\n valid_epda M\n \\ dh 0 = Some (pair None c)\n \\ epdaS.belongs M dh\n \\ epdaS.derivation M dh\n \\ maximum_of_domain dh n\n \\ dh n = Some (pair e ca)\n \\ epdaS_conf_scheduler c = w @ epdaS_conf_scheduler ca\n \\ dh n1 = Some (pair e2 c2)\n \\ n1\\n\n \\ dh (n1 + min n2 (n - n1)) = Some (pair e1 c1)\n \\ set v \\ epda_events M\n \\ epdaS.belongs M (derivation_map (derivation_take (derivation_drop dh n1) (min n2 (n - n1))) (\\c. c\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler ca)) (epdaS_conf_scheduler c) @ v\\))\"\n apply(rule epdaS.derivation_belongs)\n apply(force)\n apply(simp add: derivation_map_def derivation_take_def derivation_drop_def)\n apply(simp add: epdaS.belongs_def)\n apply(erule_tac\n x = \"n1\"\n in allE)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s x)(*strict*)\n apply(rule_tac\n A = \"set (take (length i - length (epdaS_conf_scheduler ca)) i)\"\n in set_mp)\n apply(rename_tac q i s x)(*strict*)\n apply(rule_tac\n B = \"set i\"\n in subset_trans)\n apply(rename_tac q i s x)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac q i s x)(*strict*)\n apply(force)\n apply(rename_tac q i s x)(*strict*)\n apply(force)\n apply(rule epda_maximal_context_preserves_derivation_with_Crop_prime)\n apply(force)+\n done\n\nlemma may_terminated_by_EndStrY: \"\n w \\ may_terminated_by A y\n \\ \\x. w = x@[y]\n \\ w \\ must_terminated_by A y\"\n apply(simp add: must_terminated_by_def may_terminated_by_def kleene_star_def append_language_def)\n apply(force)\n done\n\nlemma epda_push_also_must_terminated_by: \"\n valid_epda G\n \\ e \\ epda_delta G\n \\ edge_pop e \\ must_terminated_by (epda_gamma G) (epda_box G)\n \\ edge_push e \\ must_terminated_by (epda_gamma G) (epda_box G)\"\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"e\"\n in ballE)\n apply(simp add: valid_epda_step_label_def)\n apply(force)\n done\n\nlemma epda_box_stays_at_bottom_prime: \"\n valid_epda G\n \\ epdaS.derivation_initial G d\n \\ d i = Some (pair e c)\n \\ \\w. epdaS_conf_stack c = w @ [epda_box G]\"\n apply(induct i arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac i e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G e2\")\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(case_tac wa)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"edge_push e2 \\ must_terminated_by (epda_gamma G) (epda_box G)\")\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(rule epda_push_also_must_terminated_by)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(rule may_terminated_by_EndStrY)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(rule_tac\n x = \"w\"\n in exI)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n apply(thin_tac \"wa = a # list\")\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(simp add: valid_epda_def)\n done\n\nlemma epda_box_stays_at_bottom: \"\n valid_epda G\n \\ c \\ epdaS.get_accessible_configurations G\n \\ \\w. epdaS_conf_stack c = w@[epda_box G]\"\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac d i e)(*strict*)\n apply(rule epda_box_stays_at_bottom_prime)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n done\n\nlemma epda_stack_is_must_terminated_by_prime: \"\n valid_epda G\n \\ epdaS.derivation_initial G d\n \\ d i = Some (pair e c)\n \\ epdaS_conf_stack c \\ must_terminated_by (epda_gamma G) (epda_box G)\"\n apply(induct i arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac i e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G e2\")\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w a)(*strict*)\n apply(case_tac w)\n apply(rename_tac i c e1 e2 c1 w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 a)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. w = w' @ [x']\")\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n apply(thin_tac \"w = aa # list\")\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w' x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w' x a aa)(*strict*)\n apply(force)\n done\n\nlemma epda_stack_is_must_terminated_by: \"\n valid_epda G\n \\ c \\ epdaS.get_accessible_configurations G\n \\ epdaS_conf_stack c \\ must_terminated_by (epda_gamma G) (epda_box G)\"\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac d i e)(*strict*)\n apply(rule epda_stack_is_must_terminated_by_prime)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n done\n\nlemma valid_epda_push_in_gamma: \"\n valid_epda G\n \\ e \\ epda_delta G\n \\ set(edge_push e) \\ epda_gamma G\"\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x = \"e\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(force)\n done\n\nlemma valid_epda_pop_in_gamma: \"\n valid_epda G\n \\ e \\ epda_delta G\n \\ set(edge_pop e) \\ epda_gamma G\"\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x = \"e\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(force)\n done\n\nlemma valid_simple_dpda_to_valid_dpda: \"\n valid_simple_dpda G\n \\ valid_dpda G\"\n apply(simp add: valid_simple_dpda_def)\n done\n\nlemma valid_dpda_to_valid_pda: \"\n valid_dpda G\n \\ valid_pda G\"\n apply(simp add: valid_dpda_def)\n done\n\nlemma valid_pda_to_valid_epda: \"\n valid_pda G\n \\ valid_epda G\"\n apply(simp add: valid_pda_def)\n done\n\nlemma DPDA_to_epdaH_determinism: \"\n valid_dpda G\n \\ epdaH.is_forward_edge_deterministicHist_DB_long G\"\n apply(subgoal_tac \"epdaH.is_forward_edge_deterministicHist_DB_long G\")\n prefer 2\n apply(rule epdaHS2HF_FEdetermHist)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rule_tac\n ?G1.0 = \"G\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(clarsimp)\n apply(simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(force)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(force)\n apply(force)\n done\n\nlemma epda_is_forward_edge_deterministicHist_DB_long_from_epdaH_to_epdaHS: \"\n valid_epda M\n \\ epdaH.is_forward_edge_deterministicHist_DB_long M\n \\ epdaHS.is_forward_edge_deterministicHist_DB_long M\"\n apply(simp add: epdaH.is_forward_edge_deterministicHist_DB_long_def epdaHS.is_forward_edge_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(erule_tac\n x = \"epdaHvHS_Lin2BraConf c\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule_tac\n x = \"epdaH_vs_epdaHS.Lin2BraDer d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_initiality_lift)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 option)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(erule_tac\n x = \"epdaHvHS_Lin2BraConf c1\"\n in allE)\n apply(erule_tac\n x = \"epdaHvHS_Lin2BraConf c2\"\n in allE)\n apply(erule_tac\n x = \"e1\"\n in allE)\n apply(erule_tac\n x = \"e2\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule_tac\n x = \"w1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(subgoal_tac \"c1 \\ epdaHS_configurations M\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(rule epdaHS.get_accessible_configurations_are_configurations)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(subgoal_tac \"c \\ epdaHS_configurations M\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(rule_tac A=\"ATS.get_accessible_configurations epdaHS_initial_configurations\n epdaHS_step_relation M\" in set_mp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaHS.get_accessible_configurations_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 option)(*strict*)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rule_tac x=\"n\" in exI)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule epdaHS.AX_step_relation_preserves_belongsC)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epda_effects_def epdaHS_configurations_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule_tac\n x = \"w2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(subgoal_tac \"c2 \\ epdaHS_configurations M\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(rule epdaHS.get_accessible_configurations_are_configurations)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(subgoal_tac \"c \\ epdaHS_configurations M\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n prefer 2\n apply(rule_tac A=\"ATS.get_accessible_configurations epdaHS_initial_configurations\n epdaHS_step_relation M\" in set_mp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaHS.get_accessible_configurations_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"a\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 option)(*strict*)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rule_tac x=\"n\" in exI)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule epdaHS.AX_step_relation_preserves_belongsC)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epda_effects_def epdaHS_configurations_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaH_step_relation_def epdaHvHS_Lin2BraConf_def epdaHS_step_relation_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaH_step_relation_def epdaHvHS_Lin2BraConf_def epdaHS_step_relation_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaH_step_relation_def epdaHvHS_Lin2BraConf_def epdaHS_step_relation_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: epdaH_step_relation_def epdaHvHS_Lin2BraConf_def epdaHS_step_relation_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(force)\n done\n\nlemma epda_epdaS_is_forward_edge_deterministic_accessible_equal_to_epdaH_is_forward_edge_deterministicHist_DB_long: \"\n valid_epda M\n \\ epdaS.is_forward_edge_deterministic_accessible M \\ epdaH.is_forward_edge_deterministicHist_DB_long M\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(rule epdaHS2HF_DEdetermR_FEdetermHist_DB)\n apply(force)\n apply(rule_tac\n ?G1.0 = \"M\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule epdaS_vs_epdaHS.preserve_FEdetermR2)\n apply(force)\n apply(rule_tac\n t = \"epdaHS.is_forward_edge_deterministic_accessible M\"\n in ssubst)\n apply(rule I_epda_HS.epdaHS.AX_is_forward_edge_deterministic_correspond_SB)\n apply(force)\n apply(rule_tac\n t = \"ATS_determHIST_SB.is_forward_edge_deterministicHist_SB_long epdaHS_initial_configurations epdaHS_step_relation epda_effects (@) (@) epdaHS_conf_history epda_fixed_scheduler_extendable epdaHS_get_fixed_scheduler M\"\n in ssubst)\n apply(rule I_epda_HS.epdaHS.AX_is_forward_edge_deterministic_correspond_DB_SB)\n apply(force)\n apply(rule epda_is_forward_edge_deterministicHist_DB_long_from_epdaH_to_epdaHS)\n apply(force)\n apply(force)\n done\n\nlemma DPDA_is_is_forward_deterministicHist_SB: \"\n valid_dpda G\n \\ epdaH.is_forward_deterministicHist_SB G\"\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t = \"epdaH.is_forward_deterministicHist_SB G\"\n and s = \"epdaH.is_forward_deterministicHist_DB G\"\n in ssubst)\n apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n apply(force)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply (metis epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rule epdaHS2HF_FEdetermHist)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply (simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(rule epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(force)\n apply(force)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n prefer 2\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(force)\n done\n\ntheorem Nonblockingness_DPDA_without_empty_steps_from_final_states_is_Livelock_free: \"\n valid_dpda M\n \\ epdaH_no_livelocks_from_marking_states M\n \\ epdaH.Nonblockingness_branching_restricted M\n \\ \\ epdaH_livelock M\"\n apply(simp add: epdaH_livelock_def)\n apply(clarsimp)\n apply(rename_tac d N)(*strict*)\n apply(rule ccontr)\n apply(clarsimp)\n apply(rename_tac d N)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d N)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"N\"\n and P = \"\\N. \\n\\N. epdaH_conf_history (the (get_configuration (d n))) = epdaH_conf_history (the (get_configuration (d N))) \"\n in ex_least_nat_le_prime)\n apply(rename_tac d N)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac d N)(*strict*)\n apply(thin_tac \"\\n\\N. epdaH_conf_history (the (get_configuration (d n))) = epdaH_conf_history (the (get_configuration (d N)))\")\n apply(rename_tac d N)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N k)(*strict*)\n apply(thin_tac \"k\\N\")\n apply(rename_tac d N k)(*strict*)\n apply(subgoal_tac \"\\i\\k. epdaH_conf_state (the (get_configuration (d i))) \\ epda_marking M\")\n apply(rename_tac d N k)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d k i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d k i)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"d\"\n and n = \"i\"\n and m = \"Suc i\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d k i)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d k i)(*strict*)\n apply(force)\n apply(rename_tac d k i)(*strict*)\n apply(force)\n apply(rename_tac d k i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaH_no_livelocks_from_marking_states_def)\n apply(erule_tac\n x = \"d\"\n in allE)\n apply(erule_tac\n x = \"Suc i\"\n and P = \"\\x. epdaH.derivation_initial M d \\ (\\e. (\\c. d x = Some (pair (Some e) c)) \\ edge_src e \\ epda_marking M \\ edge_event e = None) \\ (\\m>x. d m = None \\ (\\e'. (\\c'. d m = Some (pair (Some e') c')) \\ (\\y. edge_event e' = Some y)))\"\n in allE)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(erule impE)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 w)(*strict*)\n apply(erule_tac x = \"i\" and P = \"\\i. k \\ i \\ epdaH_conf_history (the (case d i of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history (the (case d k of None \\ None | Some (pair e c) \\ Some c))\" in allE')\n apply(rename_tac d k i e1 e2 c1 c2 w)(*strict*)\n apply(erule_tac\n x = \"Suc i\"\n and P = \"\\i. k \\ i \\ epdaH_conf_history (the (case d i of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history (the (case d k of None \\ None | Some (pair e c) \\ Some c))\"\n in allE)\n apply(rename_tac d k i e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(case_tac e2)\n apply(rename_tac d k i e1 e2 c1 c2 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac edge_eventa)\n apply(rename_tac d k i e1 e2 c1 c2 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 w edge_srca edge_eventa edge_popa edge_pusha edge_trga a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 c1 c2 w edge_pop edge_push a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac d k i e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 m)(*strict*)\n apply(erule disjE)\n apply(rename_tac d k i e1 e2 c1 c2 m)(*strict*)\n apply(erule_tac\n x = \"m\"\n in allE)+\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 m e' c' y)(*strict*)\n apply(case_tac m)\n apply(rename_tac d k i e1 e2 c1 c2 m e' c' y)(*strict*)\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2 m e' c' y nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(erule_tac x = \"nat\" and P = \"\\i. k \\ i \\ epdaH_conf_history (the (case d i of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history (the (case d k of None \\ None | Some (pair e c) \\ Some c))\" in allE')\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(erule_tac\n x = \"Suc nat\"\n and P = \"\\i. k \\ i \\ epdaH_conf_history (the (case d i of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history (the (case d k of None \\ None | Some (pair e c) \\ Some c))\"\n in allE)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"d\"\n and n = \"nat\"\n and m = \"Suc nat\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(force)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat e1a c1a)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d k i e1 e2 c1 c2 e' c' y nat e1a c1a w wa)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac d N k)(*strict*)\n apply(thin_tac \"epdaH_no_livelocks_from_marking_states M\")\n apply(erule_tac x = \"0\" and P = \"\\x. \\y. d x = Some y\" in allE')\n apply(erule exE)+\n apply(rename_tac d N k y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d N k y option b)(*strict*)\n apply(subgoal_tac \"option = None \\ b \\ epdaH_initial_configurations M\")\n apply(rename_tac d N k y option b)(*strict*)\n prefer 2\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d N k y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k b)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac b)\n apply(rename_tac d k b epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k)(*strict*)\n apply(case_tac \"\\j epda_marking M\")\n apply(rename_tac d k)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d k)(*strict*)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_def)\n apply(erule_tac\n x = \"derivation_take d k\"\n in allE)\n apply(erule_tac\n x = \"k\"\n and P = \"\\n. epdaH.derivation_initial M (derivation_take d k) \\ maximum_of_domain (derivation_take d k) n \\ (\\dc. epdaH.derivation M dc \\ epdaH.belongs M dc \\ (\\n'. maximum_of_domain dc n') \\ derivation_append_fit (derivation_take d k) dc n \\ epdaH_marking_condition M (derivation_append (derivation_take d k) dc n))\"\n in allE)\n apply(rename_tac d k)(*strict*)\n apply(erule impE)\n apply(rename_tac d k)(*strict*)\n apply(rule conjI)\n apply(rename_tac d k)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d k)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k dc n')(*strict*)\n apply(simp add: epdaH_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e c)(*strict*)\n apply(thin_tac \"\\j e' c'. i < j \\ derivation_append (derivation_take d k) dc k j = Some (pair e' c') \\ epdaH_string_state c = epdaH_string_state c'\")\n apply(rename_tac d k dc n' i e c)(*strict*)\n apply(simp add: epdaH_marking_configurations_def)\n apply(clarsimp)\n apply(thin_tac \"c \\ epdaH_configurations M\")\n apply(case_tac c)\n apply(rename_tac d k dc n' i e c epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac d k dc n' i e q1 h1 s1)(*strict*)\n apply(case_tac \"i\\k\")\n apply(rename_tac d k dc n' i e q1 h1 s1)(*strict*)\n apply(erule_tac\n x = \"i\"\n and P = \"\\i. \\y. d i = Some y\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 y)(*strict*)\n apply(erule_tac\n x = \"i\"\n and P = \"\\i. k \\ i \\ epdaH_conf_state (the (get_configuration (d i))) \\ epda_marking M\"\n in allE)\n apply(erule_tac\n x = \"i\"\n and P = \"\\i. i < k \\ epdaH_conf_state (the (get_configuration (d i))) \\ epda_marking M\"\n in allE)\n apply(clarsimp)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1)(*strict*)\n apply(case_tac \"k = i\")\n apply(rename_tac d k dc n' i e q1 h1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d dc n' i e q1 h1 s1)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d k dc n' i e q1 h1 s1)(*strict*)\n apply(subgoal_tac \"ij epda_marking M\")\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and ?d1.0 = \"d\"\n and ?d2.0 = \"derivation_append (derivation_take d k) dc k\"\n and x = \"k\"\n and y = \"k\"\n and n = \"i-k\"\n and m = \"i-k\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(simp add: derivation_take_def)\n apply(case_tac \"d k\")\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(erule_tac\n x = \"k\"\n in allE)+\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d k dc n' i e q1 h1 s1 c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c option b)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(subgoal_tac \"epdaH.is_forward_deterministicHist_SB M\")\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule DPDA_is_is_forward_deterministicHist_SB)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule_tac\n t = \"k+(i-k)\"\n and s = \"i\"\n in ssubst)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(rule_tac\n t = \"epdaH_conf_history (the (get_configuration (d i)))\"\n and s = \"epdaH_conf_history (the (get_configuration (d k)))\"\n in ssubst)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(erule_tac\n x = \"i\"\n and P = \"\\i. k \\ i \\ epdaH_conf_history (the (get_configuration (d i))) = epdaH_conf_history (the (get_configuration (d k)))\"\n in allE)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(erule_tac x = \"k\" and P = \"\\k. \\y. d k = Some y\" in allE')\n apply(clarify)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(rule_tac\n t = \"epdaH_conf_history (the (get_configuration (d k)))\"\n and s = \"epdaH_conf_history (the (get_configuration (dc 0)))\"\n in ssubst)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def)\n apply(simp (no_asm_use))\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c option)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(rule_tac\n t = \"epdaH_conf_history (the (get_configuration (derivation_append (derivation_take d k) dc k i)))\"\n and s = \"epdaH_conf_history (the (get_configuration (dc (i-k))))\"\n in ssubst)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"dc\"\n and n = \"0\"\n and m = \"i-k\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(rule_tac\n d = \"dc\"\n in epdaH.belongs_configurations)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c option)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d k dc n' i e q1 h1 s1 c y option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 s1 c option b h)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(force)\n apply(rename_tac d k dc n' i e q1 h1 s1 c)(*strict*)\n apply(erule_tac\n x = \"i\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d k j)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d k j)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"k\"\n and x = \"j\"\n and P = \"\\j. epdaH_conf_state (the (get_configuration (d j))) \\ epda_marking M\"\n in ex_max_limited)\n apply(rename_tac d k j)(*strict*)\n apply(force)\n apply(rename_tac d k j)(*strict*)\n apply(force)\n apply(rename_tac d k j)(*strict*)\n apply(thin_tac \"j < k\")\n apply(thin_tac \"epdaH_conf_state (the (get_configuration (d j))) \\ epda_marking M\")\n apply(clarsimp)\n apply(rename_tac d k ka)(*strict*)\n apply(case_tac k)\n apply(rename_tac d k ka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d)(*strict*)\n apply(simp add: get_configuration_def)\n apply(erule_tac\n x = \"0\"\n in allE)+\n apply(clarsimp)\n apply(rename_tac d k ka nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka nat)(*strict*)\n apply(rename_tac k)\n apply(rename_tac d ka k)(*strict*)\n apply(subgoal_tac \"epdaH_conf_history (the (get_configuration (d k))) \\ epdaH_conf_history (the (get_configuration (d (Suc k))))\")\n apply(rename_tac d ka k)(*strict*)\n prefer 2\n apply(erule_tac\n x = \"k\"\n and P = \"\\x. x < Suc k \\ (\\n\\x. epdaH_conf_history (the (get_configuration (d n))) \\ epdaH_conf_history (the (get_configuration (d x))))\"\n in allE)\n apply(rename_tac d ka k)(*strict*)\n apply(erule impE)\n apply(rename_tac d ka k)(*strict*)\n apply(force)\n apply(rename_tac d ka k)(*strict*)\n apply(erule exE)+\n apply(rename_tac d ka k n)(*strict*)\n apply(erule conjE)+\n apply(case_tac \"n = k\")\n apply(rename_tac d ka k n)(*strict*)\n apply(force)\n apply(rename_tac d ka k n)(*strict*)\n apply(erule_tac\n x = \"n\"\n and P = \"\\n. Suc k \\ n \\ epdaH_conf_history (the (get_configuration (d n))) = epdaH_conf_history (the (get_configuration (d (Suc k))))\"\n in allE)\n apply(rename_tac d ka k n)(*strict*)\n apply(erule impE)\n apply(rename_tac d ka k n)(*strict*)\n apply(force)\n apply(rename_tac d ka k n)(*strict*)\n apply(force)\n apply(rename_tac d ka k)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"d\"\n and n = \"k\"\n and m = \"Suc k\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d ka k)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d ka k)(*strict*)\n apply(erule_tac\n x = \"Suc k\"\n in allE)+\n apply(force)\n apply(rename_tac d ka k)(*strict*)\n apply(force)\n apply(rename_tac d ka k)(*strict*)\n apply(erule exE)+\n apply(rename_tac d ka k e1 e2 c1 c2)(*strict*)\n apply(erule conjE)+\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 e2 c1 c2 w)(*strict*)\n apply(case_tac c1)\n apply(rename_tac d ka k e1 e2 c1 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c2)\n apply(rename_tac d ka k e1 e2 c1 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(case_tac e2)\n apply(rename_tac d ka k e1 e2 c1 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(rename_tac h src read pop push trg)\n apply(rename_tac d ka k e1 w h src read pop push trg)(*strict*)\n apply(case_tac \"read\")\n apply(rename_tac d ka k e1 w h src read pop push trg)(*strict*)\n apply(simp add: get_configuration_def option_to_list_def)\n apply(rename_tac d ka k e1 w h src read pop push trg a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(thin_tac \"epdaH_conf_history (the (get_configuration (Some (pair e1 \\epdaH_conf_state = src, epdaH_conf_history = h, epdaH_conf_stack = pop @ w\\)))) \\ epdaH_conf_history (the (get_configuration (Some (pair (Some \\edge_src = src, edge_event = Some a, edge_pop = pop, edge_push = push, edge_trg = trg\\) \\epdaH_conf_state = trg, epdaH_conf_history = h @ option_to_list (Some a), epdaH_conf_stack = push @ w\\))))\")\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_def)\n apply(erule_tac\n x = \"derivation_take d (Suc k)\"\n in allE)\n apply(erule_tac\n x = \"Suc k\"\n and P = \"\\n. epdaH.derivation_initial M (derivation_take d (Suc k)) \\ maximum_of_domain (derivation_take d (Suc k)) n \\ (\\dc. epdaH.derivation M dc \\ epdaH.belongs M dc \\ (\\n'. maximum_of_domain dc n') \\ derivation_append_fit (derivation_take d (Suc k)) dc n \\ epdaH_marking_condition M (derivation_append (derivation_take d (Suc k)) dc n))\"\n in allE)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(erule impE)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(rule conjI)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n')(*strict*)\n apply(simp add: epdaH_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e c)(*strict*)\n apply(simp add: epdaH_marking_configurations_def)\n apply(clarsimp)\n apply(thin_tac \"c \\ epdaH_configurations M\")\n apply(case_tac c)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e c epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(case_tac \"i = Suc k\")\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1)(*strict*)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push a dc n' q1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k e1 w h src pop push a dc n' q1)(*strict*)\n prefer 2\n apply(rule_tac\n M = \"M\"\n and g = \"dc\"\n in epdaH.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push a dc n' q1)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"Suc k\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(case_tac \"ij. \\e' c'. i < j \\ derivation_append (derivation_take d (Suc k)) dc (Suc k) j = Some (pair e' c') \\ epdaH_string_state \\epdaH_conf_state = q1, epdaH_conf_history = h1, epdaH_conf_stack = s1\\ = epdaH_string_state c'\"\n in allE)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(simp add: epdaH_string_state_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"d\"\n and n = \"i\"\n and m = \"k - i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(rule_tac\n d = \"d\"\n in epdaH.belongs_configurations)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(subgoal_tac \"Suc kx. Suc k+Suc x = i\")\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n prefer 2\n apply (metis add_Suc_right add_Suc_shift less_iff_Suc_add)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' i e q1 h1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n prefer 2\n apply(rule_tac\n M = \"M\"\n and g = \"dc\"\n in epdaH.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x c)(*strict*)\n apply(subgoal_tac \"c = \\epdaH_conf_state = trg, epdaH_conf_history = h @ [a], epdaH_conf_stack = push @ w\\\")\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x c)(*strict*)\n prefer 2\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and ?d1.0 = \"d\"\n and ?d2.0 = \"derivation_append (derivation_take d (Suc k)) dc (Suc k)\"\n and x = \"Suc k\"\n and y = \"Suc k\"\n and n = \"(Suc ((x)))\"\n and m = \"(Suc ((x)))\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule DPDA_is_is_forward_deterministicHist_SB)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: derivation_append_def derivation_append_fit_def derivation_take_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"M\"\n and d = \"dc\"\n and n = \"0\"\n and m = \"Suc x\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(rule_tac\n d = \"dc\"\n in epdaH.belongs_configurations)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(simp (no_asm_use) only: derivation_append_fit_def derivation_take_def derivation_append_def)\n apply(force)\n apply(rename_tac d ka k e1 w h src pop push trg a dc n' e q1 h1 s1 x)(*strict*)\n apply(erule_tac\n x = \"Suc (Suc(k+x))\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n done\n\ntheorem epdaS_to_epdaHS_accessible: \"\n valid_epda G\n \\ epdaS.accessible G\n \\ epdaHS.accessible G\"\n apply(simp add: epdaHS.accessible_def epdaS.accessible_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ epdaS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"epda_destinations G \\ epdaS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ epda_destinations G\")\n apply(simp add: epdaS.get_accessible_destinations_def epdaHS.get_accessible_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(simp add: epdaS_get_destinations_def)\n apply(case_tac c)\n apply(rename_tac x d i e c epdaS_conf_statea epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e epdaS_conf_state epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply(rename_tac n e q i s)\n apply(rename_tac x d n e q i s)(*strict*)\n apply(rule_tac\n x = \"epdaS2epdaHS_derivation G d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n e q i s)(*strict*)\n apply(rule epdaS2epdaHS_derivation_preserves_derivation_initial)\n apply(rename_tac x d n e q i s)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac x d n e q i s)(*strict*)\n apply(force)\n apply(rename_tac x d n e q i s)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(simp add: epdaS2epdaHS_derivation_def epdaHS_get_destinations_def)\n done\n\ntheorem epdaHS_to_epdaH_accessible: \"\n valid_epda G\n \\ epdaHS.accessible G\n \\ epdaH.accessible G\"\n apply(simp add: epdaHS.accessible_def epdaH.accessible_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ epdaHS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"epda_destinations G \\ epdaHS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ epda_destinations G\")\n apply(simp add: epdaH.get_accessible_destinations_def epdaHS.get_accessible_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(simp add: epdaHS_get_destinations_def)\n apply(case_tac c)\n apply(rename_tac x d i e c epdaHS_conf_statea epdaHS_conf_history epdaHS_conf_scheduler epdaHS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e epdaHS_conf_state epdaHS_conf_history epdaHS_conf_scheduler epdaHS_conf_stack)(*strict*)\n apply(rename_tac n e q i s)\n apply(rename_tac x d ia n e q i s)(*strict*)\n apply(rule_tac\n x = \"epdaH_vs_epdaHS.Lin2BraDer d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d ia n e q i s)(*strict*)\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_initiality_lift)\n apply(rename_tac x d ia n e q i s)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac x d ia n e q i s)(*strict*)\n apply(force)\n apply(rename_tac x d ia n e q i s)(*strict*)\n apply(rule_tac\n x = \"ia\"\n in exI)\n apply(simp add: epdaHvHS_Lin2BraConf_def derivation_map_def epdaH_vs_epdaHS.Lin2BraDer_def epdaH_get_destinations_def)\n done\n\ntheorem epdaS_to_epdaH_accessible: \"\n valid_epda G\n \\ epdaS.accessible G\n \\ epdaH.accessible G\"\n apply (metis epdaHS_to_epdaH_accessible epdaS_to_epdaHS_accessible)\n done\n\ndefinition only_executing_edges_from_marking_states :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"only_executing_edges_from_marking_states G \\\n \\e \\ epda_delta G.\n edge_event e = None\n \\ edge_src e \\ epda_marking G\"\n\nlemma epda_no_empty_steps_from_marking_states__vs__only_executing_edges_from_marking_states: \"\n valid_epda G\n \\ epda_no_empty_steps_from_marking_states G \\ only_executing_edges_from_marking_states G\"\n apply(simp add: epda_no_empty_steps_from_marking_states_def only_executing_edges_from_marking_states_def)\n apply(rule antisym)\n apply(clarsimp)\n apply(force)\n apply(clarsimp)\n apply(force)\n done\n\nlemma DPDA_only_executing_edges_from_marking_states_implies_epdaH_non_ambiguous_hlp: \"\n valid_dpda G\n \\ only_executing_edges_from_marking_states G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ q1 \\ epda_marking G\n \\ q2 \\ epda_marking G\n \\ d1 0 = d2 0\n \\ d1 n1 = Some (pair option \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1\\)\n \\ d2 n2 = Some (pair optiona \\epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2\\)\n \\ n1 \\ n2\n \\ d2 n1 = Some (pair option \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1\\)\n \\ n1 < n2\n \\ False\"\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n d = \"d2\"\n and n = \"n1\"\n and m = \"n2\"\n in epdaH.step_detail_before_some_position)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e2 c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac e2 c2)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and n = \"Suc n1\"\n and m = \"n2-Suc n1\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac e2 c2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac e2 c2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac e2 c2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac e2 c2)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac e2 c2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac e2 c2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac e2 c2)(*strict*)\n apply(force)\n apply(rename_tac e2 c2)(*strict*)\n apply(force)\n apply(rename_tac e2 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2 c2 h)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac e2 c2 w)(*strict*)\n apply(case_tac c2)\n apply(rename_tac e2 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2 w epdaH_conf_history)(*strict*)\n apply(rename_tac h)\n apply(rename_tac e2 w h)(*strict*)\n apply(case_tac e2)\n apply(rename_tac e2 w h edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac w h edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(rename_tac qs re po pu qt)\n apply(rename_tac w h qs re po pu qt)(*strict*)\n apply(case_tac re)\n apply(rename_tac w h qs re po pu qt)(*strict*)\n prefer 2\n apply(rename_tac w h qs re po pu qt a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac w h qs re po pu qt)(*strict*)\n apply(clarsimp)\n apply(rename_tac w h qs po pu qt)(*strict*)\n apply(simp add: only_executing_edges_from_marking_states_def)\n apply(erule_tac\n x = \"\\edge_src = qs, edge_event = None, edge_pop = po, edge_push = pu, edge_trg = qt\\\"\n in ballE)\n apply(rename_tac w h qs po pu qt)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w h qs po pu qt)(*strict*)\n apply(force)\n done\n\ntheorem DPDA_only_executing_edges_from_marking_states_implies_epdaH_non_ambiguous: \"\n valid_dpda G\n \\ only_executing_edges_from_marking_states G\n \\ epdaH_non_ambiguous G\"\n apply(simp add: epdaH_non_ambiguous_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2)(*strict*)\n apply(subgoal_tac \"d1 0 = d2 0\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2)(*strict*)\n prefer 2\n apply(simp add: epdaH.derivation_initial_def)\n apply(case_tac \"d1 0\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 b)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 b a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 b a option ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 b ba)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2)(*strict*)\n apply(case_tac \"d1 n1\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b)(*strict*)\n apply(case_tac \"d2 n2\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b a optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b optiona ba)(*strict*)\n apply(subgoal_tac \"b = \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1\\\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b optiona ba)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona ba)(*strict*)\n apply(thin_tac \"get_configuration (Some (pair option \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1\\)) = Some \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1\\\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona ba)(*strict*)\n apply(subgoal_tac \"ba = \\epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2\\\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona ba)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona)(*strict*)\n apply(thin_tac \"get_configuration (Some (pair optiona \\epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2\\)) = Some \\epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2\\\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 option optiona)(*strict*)\n apply(rename_tac e1 e2)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(subgoal_tac \"n1 = n2\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n prefer 2\n apply(case_tac \"n1 n1 < n2\")\n apply(subgoal_tac \"False\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and x = \"0\"\n and y = \"0\"\n and n = \"n2\"\n and m = \"n1\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(simp add: epda_effects_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(simp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d1 n2\")\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(rule_tac\n ?q1.0 = \"q2\"\n and ?q2.0 = \"q1\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and ?n1.0 = \"n2\"\n and ?n2.0 = \"n1\"\n in DPDA_only_executing_edges_from_marking_states_implies_epdaH_non_ambiguous_hlp)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n1 n2 q1 q2 h s1 s2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d1\"\n and n = \"i\"\n and m = \"n2\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d2\"\n and n = \"i\"\n and m = \"n2\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and n = \"i\"\n and m = \"n2-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca ha)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d1 d2 n2 q1 q2 h s1 s2 e1 e2 i e ea c ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and n = \"0\"\n and m = \"i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and d = \"d1\"\n and n = \"i\"\n and m = \"n2-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(case_tac \"d1 0\")\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha a optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and n = \"0\"\n and m = \"i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb)(*strict*)\n apply(clarsimp)\n apply(case_tac ca)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(case_tac b)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c ca option b ha h hb epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c option ha h hb epdaH_conf_state epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea c option ha h hb epdaH_conf_state epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateb epdaH_conf_historyb epdaH_conf_stackb)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1 e2 i e ea option ha h hb epdaH_conf_state epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateb epdaH_conf_history epdaH_conf_stackb)(*strict*)\n apply(rename_tac e1 ha h hb qx1 sx1 qx2 hx2 sx3 qs5 h4 s3)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 hx2 sx3 qs5 h4 s3)(*strict*)\n apply(subgoal_tac \"hx2 = []\")\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 hx2 sx3 qs5 h4 s3)(*strict*)\n prefer 2\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 hx2 sx3 qs5 h4 s3)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 sx3 qs5 h4 s3)(*strict*)\n apply(subgoal_tac \"prefix h h4 \\ SSX\" for SSX)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 sx3 qs5 h4 s3)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 sx3 qs5 h4 s3)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 sx3 qs5 h4 s3)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d1\"\n and ?d2.0 = \"d2\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(clarsimp)\n apply(simp add: epda_effects_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha qx1 sx1 qx2 sx3 qs5 h4 s3 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 ha h hb qx1 sx1 qx2 sx3 qs5 h4 s3)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(clarsimp)\n apply(simp add: epda_effects_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 n2 q1 q2 s1 s2 e1a e2 i e ea e1 h hb qx1 sx1 qx2 sx3 qs5 s3 c)(*strict*)\n apply(clarsimp)\n done\n\nlemma DFA_one_symbol_per_step: \"\n valid_dfa G\n \\ epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ length(epdaH_conf_history c) = n\"\n apply(induct n arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and d = \"d\"\n and n = \"n\"\n and m = \"Suc n\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n e c)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac c e1 e2 c1 w)(*strict*)\n apply(case_tac e2)\n apply(rename_tac c e1 e2 c1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n apply(case_tac edge_event)\n apply(rename_tac c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n prefer 2\n apply(rename_tac c e1 c1 w edge_event edge_pop edge_push a)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 c1 w edge_pop edge_push a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 c1 w edge_pop edge_push)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: valid_dfa_def)\n apply(rename_tac c e1 c1 w edge_popa edge_pusha)(*strict*)\n apply(force)\n done\n\nlemma DFA_stack_consists_only_of_box: \"\n valid_dfa G\n \\ epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ epdaH_conf_stack c = [epda_box G]\"\n apply(induct n arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and d = \"d\"\n and n = \"n\"\n and m = \"Suc n\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n e c)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(case_tac e2)\n apply(rename_tac n c e1 e2 c1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac n c e1 c1 w edge_eventa edge_popa edge_pusha)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"\\edge_src = epdaH_conf_state c1, edge_event = edge_eventa, edge_pop = edge_popa, edge_push = edge_pusha, edge_trg = epdaH_conf_state c\\\"\n in ballE)\n apply(rename_tac n c e1 c1 w edge_eventa edge_popa edge_pusha)(*strict*)\n prefer 2\n apply(rename_tac n c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n apply(force)\n apply(rename_tac n c e1 c1 w edge_eventa edge_popa edge_pusha)(*strict*)\n apply(clarsimp)\n done\n\ndefinition epda_operational_controllable ::\n \"('spec_state, 'event, 'gamma) epda\n \\ ('plant_state, 'event, 'gamma_unused) epda\n \\ 'event set\n \\ bool\"\n where\n \"epda_operational_controllable S P SigmaUC \\\n \\d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u.\n epdaH.derivation_initial S d1\n \\ d1 n1 = Some (pair e1 c1)\n \\ epdaH.derivation_initial P d2\n \\ d2 n2 = Some (pair e2 c2)\n \\ d2 (Suc n2) = Some (pair e2' c2')\n \\ epdaH_conf_history c1 = epdaH_conf_history c2\n \\ epdaH_conf_history c2' = epdaH_conf_history c2 @ [u]\n \\ u \\ SigmaUC\n \\ (\\dc nC eC cC.\n epdaH.derivation S dc\n \\ dc 0 = Some (pair None c1)\n \\ dc nC = Some (pair eC cC)\n \\ epdaH_conf_history cC = epdaH_conf_history c2')\"\n\ndefinition epda_to_des :: \"\n ('state, 'event, 'stack) epda\n \\ 'event DES\"\n where\n \"epda_to_des G \\\n DES (epdaH.unmarked_language G) (epdaH.marked_language G)\"\n\nlemma epdaS_epda_sub_preserves_derivation: \"\n valid_epda G1\n \\ valid_epda G2\n \\ epda_sub G1 G2\n \\ epdaS.derivation G1 d\n \\ epdaS.derivation G2 d\"\n apply(simp (no_asm) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(simp add: epdaS.derivation_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"0\"\n in allE)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(case_tac \"d(Suc nat)\")\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i nat a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac i nat a)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"nat\"\n and m = \"Suc nat\"\n and G = \"G1\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac i nat a)(*strict*)\n apply(force)\n apply(rename_tac i nat a)(*strict*)\n apply(force)\n apply(rename_tac i nat a)(*strict*)\n apply(force)\n apply(rename_tac i nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def epda_sub_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(force)\n done\n\nlemma epdaS_epda_sub_preserves_derivation_initial: \"\n valid_epda G1\n \\ valid_epda G2\n \\ epda_sub G1 G2\n \\ epdaS.derivation_initial G1 d\n \\ epdaS.derivation_initial G2 d\"\n apply(subgoal_tac \"epdaS.derivation G2 d\")\n prefer 2\n apply(rule epdaS_epda_sub_preserves_derivation)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: epdaS.derivation_initial_def)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac b)(*strict*)\n apply(simp add: epdaS_initial_configurations_def epdaS_configurations_def epda_sub_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(force)\n done\n\nlemma epda_sub_preserves_is_forward_edge_deterministic_accessible: \"\n valid_dpda G\n \\ valid_pda G'\n \\ epda_sub G' G\n \\ epdaS.is_forward_edge_deterministic_accessible G'\"\n apply(simp add: valid_dpda_def epdaS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x = \"c\"\n in ballE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x = \"c1\"\n in allE)\n apply(erule_tac\n x = \"c2\"\n in allE)\n apply(erule_tac\n x = \"e1\"\n in allE)\n apply(erule_tac\n x = \"e2\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 w wa)(*strict*)\n apply(simp add: epda_sub_def)\n apply(clarsimp)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(erule_tac\n x = \"d\"\n in allE)\n apply(case_tac \"d i\")\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c c1 c2 e1 e2 d i a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac c c1 c2 e1 e2 d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n apply(erule impE)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n prefer 2\n apply(erule_tac\n x = \"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n apply(rule epdaS_epda_sub_preserves_derivation_initial)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n apply(force)\n done\n\nlemma epdaS_to_epdaHS_unmarked_language: \"\n valid_epda G\n \\ epdaS.unmarked_language G = epdaHS.unmarked_language G\"\n apply(rule order_antisym)\n apply(rule_tac\n t = \"epdaS.unmarked_language G\"\n and s = \"epdaS.finite_unmarked_language G\"\n in ssubst)\n apply (metis epdaS_inst_AX_unmarked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule_tac\n ?o1.0 = \"x\"\n in epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_unmarked_language_translation1)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"epdaHS.unmarked_language G\"\n and s = \"epdaHS.finite_unmarked_language G\"\n in ssubst)\n apply (metis epdaHS_inst_AX_unmarked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule_tac\n ?o2.0 = \"x\"\n in epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_unmarked_language_translation2)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaH_to_epdaHS_unmarked_language: \"\n valid_epda G\n \\ epdaH.unmarked_language G = epdaHS.unmarked_language G\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_to_epdaH_unmarked_language: \"\n valid_epda G\n \\ epdaS.unmarked_language G = epdaH.unmarked_language G\"\n apply(rule_tac\n t = \"epdaS.unmarked_language G\"\n and s = \"epdaHS.unmarked_language G\"\n in ssubst)\n apply(rule epdaS_to_epdaHS_unmarked_language)\n apply(force)\n apply(rule sym)\n apply(rule epdaH_to_epdaHS_unmarked_language)\n apply(force)\n done\n\nlemma epdaS_to_epdaHS_mlang: \"\n valid_epda G\n \\ epdaS.marked_language G = epdaHS.marked_language G\"\n apply(rule order_antisym)\n apply(rule_tac\n t = \"epdaS.marked_language G\"\n and s = \"epdaS.finite_marked_language G\"\n in ssubst)\n apply (metis epdaS_inst_lang_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule_tac\n ?o1.0 = \"x\"\n in epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_marked_language_translation1)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"epdaHS.marked_language G\"\n and s = \"epdaHS.finite_marked_language G\"\n in ssubst)\n apply (metis epdaHS_inst_lang_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule_tac\n ?o2.0 = \"x\"\n in epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_marked_language_translation2)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaH_to_epdaHS_mlang: \"\n valid_epda G\n \\ epdaH.marked_language G = epdaHS.marked_language G\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_to_epdaH_mlang: \"\n valid_epda G\n \\ epdaS.marked_language G = epdaH.marked_language G\"\n apply(rule_tac\n t = \"epdaS.marked_language G\"\n and s = \"epdaHS.marked_language G\"\n in ssubst)\n apply(rule epdaS_to_epdaHS_mlang)\n apply(force)\n apply(rule sym)\n apply(rule epdaH_to_epdaHS_mlang)\n apply(force)\n done\n\nlemma epdaS_to_epdaH_nonblockingness_language: \"\n valid_epda G\n \\ (nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)) \\ (nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G))\"\n apply(rule_tac\n t = \"epdaS.unmarked_language G\"\n and s = \"epdaH.unmarked_language G\"\n in ssubst)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply(force)\n apply(rule_tac\n t = \"epdaS.marked_language G\"\n and s = \"epdaH.marked_language G\"\n in ssubst)\n apply(rule epdaS_to_epdaH_mlang)\n apply(force)\n apply(force)\n done\n\nlemma epda_empty_in_epdaH_unmarked_language: \"\n valid_epda G\n \\ [] \\ epdaH.unmarked_language G\"\n apply(simp (no_asm) add: epdaH.unmarked_language_def)\n apply(rule_tac\n x = \"der1 \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\\"\n in exI)\n apply(rule conjI)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rule conjI)\n apply(simp add: epdaH.der1_is_derivation)\n apply(simp add: der1_def)\n apply(simp add: epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rule_tac\n x = \"0\"\n in exI)\n apply(simp add: der1_def)\n apply(simp add: epdaH.der1_is_derivation)\n done\n\nlemma epdaH_unmarked_languageuage_prefix_closed: \"\n valid_epda G\n \\ x@v \\ epdaH.unmarked_language G\n \\ x \\ epdaH.unmarked_language G\"\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac d)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e c)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"i\"\n and P = \"\\n. n\\i \\ prefix x (epdaH_conf_history (the(get_configuration(d n)))) \"\n in ex_least_nat_le_prime)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c k)(*strict*)\n apply(case_tac k)\n apply(rename_tac d i e c k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(case_tac \"d 0\")\n apply(rename_tac d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d i e c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c b)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rule_tac\n x = \"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d i e c k nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e c nat)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d\"\n and n = \"nat\"\n and m = \"i\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d i e c nat)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e c nat)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def prefix_def)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 c2 ca)(*strict*)\n apply(case_tac c2)\n apply(rename_tac d i e c nat e1 e2 c1 c2 ca epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 ca epdaH_conf_state epdaH_conf_stack)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(rename_tac d i e c nat e1 e2 c1 ca epdaH_conf_statea epdaH_conf_stacka)(*strict*)\n apply(rename_tac q2 s2)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2)(*strict*)\n apply(case_tac c1)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2 q1 h1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 ca h1 w)(*strict*)\n apply(case_tac e2)\n apply(rename_tac d i e c nat e1 e2 ca h1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca h1 w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(rename_tac qs re po pu qt)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt)(*strict*)\n apply(case_tac re)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca w qs po pu qt)(*strict*)\n apply(rule_tac\n x = \"nat\"\n in exI)\n apply(clarsimp)\n apply(erule_tac\n x = \"nat\"\n in allE)\n apply(force)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n xs = \"ca\"\n in rev_cases)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n prefer 2\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 w qs po pu qt a ys)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 h1 w qs po pu qt a)(*strict*)\n apply(rule_tac\n x = \"Suc nat\"\n in exI)\n apply(clarsimp)\n done\n\nlemma epdaH_coincide_strict_prefix: \"\n valid_dpda G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ get_configuration (d1 i1) = Some c1\n \\ get_configuration (d2 i2) = Some c2\n \\ strict_prefix (epdaH_conf_history c1) (epdaH_conf_history c2)\n \\ i1 \\ i2 \\ (\\i. i\\i1 \\ d1 i = d2 i)\"\n apply(case_tac \"d1 0\")\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac a)(*strict*)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac option b)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac option b a)(*strict*)\n apply(case_tac a)\n apply(rename_tac option b a optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b optiona ba)(*strict*)\n apply(case_tac option)\n apply(rename_tac option b optiona ba)(*strict*)\n prefer 2\n apply(rename_tac option b optiona ba a)(*strict*)\n apply(simp add: epdaH.derivation_def epdaH.derivation_initial_def)\n apply(rename_tac option b optiona ba)(*strict*)\n apply(case_tac optiona)\n apply(rename_tac option b optiona ba)(*strict*)\n prefer 2\n apply(rename_tac option b optiona ba a)(*strict*)\n apply(simp add: epdaH.derivation_def epdaH.derivation_initial_def)\n apply(rename_tac option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac b ba)(*strict*)\n apply(subgoal_tac \"b = ba \\ b \\ epdaH_initial_configurations G\")\n apply(rename_tac b ba)(*strict*)\n prefer 2\n apply(simp add: epdaH_initial_configurations_def epdaH.derivation_initial_def)\n apply(rename_tac b ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ba)(*strict*)\n apply(case_tac \"d1 i1 \")\n apply(rename_tac ba)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac ba a)(*strict*)\n apply(case_tac \"d2 i2 \")\n apply(rename_tac ba a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac ba a aa)(*strict*)\n apply(case_tac a)\n apply(rename_tac ba a aa option b)(*strict*)\n apply(case_tac aa)\n apply(rename_tac ba a aa option b optiona bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ba option b optiona bb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac ba option optiona)(*strict*)\n apply(rename_tac c0 e1 e2)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(case_tac \"i2 < i1\")\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d1\"\n and n = \"i2\"\n and m = \"i1\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 e c)(*strict*)\n apply(case_tac c1)\n apply(rename_tac c0 e1 e2 e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c0 e1 e2 e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 e c epdaH_conf_state epdaH_conf_history epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac qx1 hx1 sx1 qx2 hx2 sx2)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d1\"\n and ?d2.0 = \"d2\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i2\"\n and m = \"i2\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d1\"\n and G = \"G\"\n and n = \"i2\"\n and m = \"i1-i2\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 sx2 ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(simp add: epda_effects_def)\n apply(subgoal_tac \"\\epdaH_conf_state = qx2, epdaH_conf_history = epdaH_conf_history c @ h @ ca, epdaH_conf_stack = sx2\\ \\ epdaH_configurations G\")\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 sx1 qx2 sx2 ca h)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 e c qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d1\"\n and G = \"G\"\n and n = \"i2\"\n and m = \"i1-i2\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 qx1 hx1 sx1 qx2 hx2 sx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 qx1 sx1 qx2 hx2 sx2 h)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d1\"\n and n = \"i\"\n and m = \"i1\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d2\"\n and n = \"i\"\n and m = \"i2\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d1\"\n and G = \"G\"\n and n = \"i\"\n and m = \"i1-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d2\"\n and G = \"G\"\n and n = \"i\"\n and m = \"i2-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h cb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(subgoal_tac \"prefix (epdaH_conf_history c) (epdaH_conf_history ca) \\ SSX\" for SSX)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(erule disjE)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d1\"\n and ?d2.0 = \"d2\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n x = \"cc\"\n in bexI)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(subgoal_tac \"ca \\ epdaH_configurations G\")\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c h ha cb cc q s)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(rule_tac\n x = \"cc\"\n in bexI)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(subgoal_tac \"c \\ epdaH_configurations G\")\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac c0 e1 e2 i e ea ca h cb cc q s)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb cc)(*strict*)\n apply(force)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c0 e1 e2 i e ea c ca h ha cb)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaH_first_time_shorter_than_some_time: \"\n valid_dpda G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ get_configuration (d1 n1) = Some c1\n \\ get_configuration (d2 n2) = Some c2\n \\ epdaH_conf_history c1 = epdaH_conf_history c2\n \\ (\\k epdaH_conf_history c1)\n \\ n1\\n2\"\n apply(subgoal_tac \"\\c. c \\ epdaH_initial_configurations G \\ d1 0 = Some (pair None c) \\ d2 0 = Some (pair None c)\")\n prefer 2\n apply(case_tac \"d1 0\")\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(rename_tac a)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(rename_tac a aa)(*strict*)\n apply(case_tac a)\n apply(rename_tac a aa option b)(*strict*)\n apply(case_tac aa)\n apply(rename_tac a aa option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b optiona ba)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(clarsimp)\n apply(rename_tac b ba)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(case_tac \"d1 n1\")\n apply(rename_tac c)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c a)(*strict*)\n apply(case_tac \"d2 n2\")\n apply(rename_tac c a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c a aa)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac c a aa option b)(*strict*)\n apply(case_tac aa)\n apply(rename_tac c a aa option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac c option optiona)(*strict*)\n apply(rename_tac e1 e2)\n apply(rename_tac c e1 e2)(*strict*)\n apply(case_tac \"n2 epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ get_configuration (d1 n1) = Some c1\n \\ get_configuration (d2 n2) = Some c2\n \\ (\\e\\ epda_delta G. edge_event e = None \\ (\\c'. \\epdaH_step_relation G c1 e c'))\n \\ (\\e\\ epda_delta G. edge_event e = None \\ (\\c'. \\epdaH_step_relation G c2 e c'))\n \\ epdaH_conf_history c1 = epdaH_conf_history c2\n \\ n1 = n2 \\ (\\i\\n1. d1 i = d2 i)\"\n apply(subgoal_tac \"\\c. c \\ epdaH_initial_configurations G \\ d1 0 = Some (pair None c) \\ d2 0 = Some (pair None c)\")\n prefer 2\n apply(case_tac \"d1 0\")\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(rename_tac a)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(rename_tac a aa)(*strict*)\n apply(case_tac a)\n apply(rename_tac a aa option conf)(*strict*)\n apply(case_tac aa)\n apply(rename_tac a aa option conf optiona confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac option conf optiona confa)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH.derivation_def)\n apply(clarsimp)\n apply(rename_tac conf confa)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(case_tac \"d1 n1\")\n apply(rename_tac c)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c a)(*strict*)\n apply(case_tac \"d2 n2\")\n apply(rename_tac c a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c a aa)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac c a aa option conf)(*strict*)\n apply(case_tac aa)\n apply(rename_tac c a aa option conf optiona confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c option optiona)(*strict*)\n apply(rename_tac e1 e2)\n apply(rename_tac c e1 e2)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac c e1 e2)(*strict*)\n apply(case_tac \"n1edge_src = epdaH_conf_state c1, edge_event = None, edge_pop = po, edge_push = pu, edge_trg = epdaH_conf_state c2a\\\"\n and P = \"\\e. edge_event e = None \\ (\\c'. epdaH_conf_history c' = epdaH_conf_history c2a \\ epdaH_conf_state c' = edge_trg e \\ epdaH_conf_state c1 = edge_src e \\ (\\wa. po @ w = edge_pop e @ wa \\ epdaH_conf_stack c' \\ edge_push e @ wa))\"\n in ballE)\n apply(rename_tac c e2 e1a c2a w po pu)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e2 e1a c2a w po pu)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(case_tac \"n2 n1 < n2\")\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and x = \"0\"\n and y = \"0\"\n and n = \"n2\"\n and m = \"n1\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c e1 e2)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c e1 e2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(clarsimp)\n apply(simp add: epda_effects_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2)(*strict*)\n apply(simp)\n apply(rename_tac c e1 e2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d1\"\n and n = \"n2\"\n and m = \"n1\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac c e1 e2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and d = \"d1\"\n and n = \"Suc n2\"\n and m = \"n1-Suc n2\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(force)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(force)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e1a e2a c2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e1a e2a c2a h)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c e1 e1a e2a c2a w)(*strict*)\n apply(case_tac \"e2a\")\n apply(rename_tac c e1 e1a e2a c2a w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(rename_tac qs re po pu qt)\n apply(rename_tac c e1 e1a e2a c2a w qs re po pu qt)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e1a c2a w re po pu)(*strict*)\n apply(case_tac re)\n apply(rename_tac c e1 e1a c2a w re po pu)(*strict*)\n prefer 2\n apply(rename_tac c e1 e1a c2a w re po pu a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac c e1 e1a c2a w re po pu)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac c e1 e1a c2a w po pu)(*strict*)\n apply(erule_tac\n x = \"\\edge_src = epdaH_conf_state c2, edge_event = None, edge_pop = po, edge_push = pu, edge_trg = epdaH_conf_state c2a\\\"\n and P = \"\\x. edge_event x = None \\ (\\c'. epdaH_conf_history c' = epdaH_conf_history c2a \\ epdaH_conf_state c' = edge_trg x \\ epdaH_conf_state c2 = edge_src x \\ (\\wa. po @ w = edge_pop x @ wa \\ epdaH_conf_stack c' \\ edge_push x @ wa))\"\n in ballE)\n apply(rename_tac c e1 e1a c2a w po pu)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e1a c2a w po pu)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d1\"\n and n = \"i\"\n and m = \"n2\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i)(*strict*)\n prefer 2\n apply(rule_tac\n g = \"d2\"\n and n = \"i\"\n and m = \"n2\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d1\"\n and G = \"G\"\n and n = \"i\"\n and m = \"n2-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d2\"\n and G = \"G\"\n and n = \"i\"\n and m = \"n2-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb h)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(subgoal_tac \"prefix (epdaH_conf_history ca) (epdaH_conf_history cb) \\ SSX\" for SSX)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(erule disjE)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d1\"\n and ?d2.0 = \"d2\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n x = \"cc\"\n in bexI)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(subgoal_tac \"cb \\ epdaH_configurations G\")\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca ha cc q s)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(rule_tac\n d = \"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d2\"\n and ?d2.0 = \"d1\"\n and x = \"0\"\n and y = \"0\"\n and n = \"i\"\n and m = \"i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(rule_tac\n x = \"cc\"\n in bexI)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(subgoal_tac \"ca \\ epdaH_configurations G\")\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac c e1 e2 i e ea cb h cc q s)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha cc)(*strict*)\n apply(force)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c e1 e2 i e ea ca cb h ha)(*strict*)\n apply(clarsimp)\n done\n\nlemma DPDA_conflicting_edges: \"\n valid_dpda G\n \\ epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ epdaH_step_relation G c e1 c1\n \\ epdaH_step_relation G c e2 c2\n \\ edge_event e1 = None\n \\ edge_event e2 \\ None\n \\ Q\"\n apply(subgoal_tac \" epdaH.is_forward_deterministicHist_SB G\")\n prefer 2\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(simp add: epdaH.is_forward_edge_deterministicHist_SB_long_def epdaH.is_forward_deterministicHist_SB_def)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(erule_tac\n x = \"c\"\n in ballE)\n apply(rename_tac y)(*strict*)\n prefer 2\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(erule_tac\n x = \"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"n\"\n in allE)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac y)(*strict*)\n apply(erule_tac\n x = \"c1\"\n in allE)\n apply(erule_tac\n x = \"c2\"\n in allE)\n apply(erule_tac\n x = \"e1\"\n in allE)\n apply(erule_tac\n x = \"e2\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y)(*strict*)\n apply(rule_tac\n x = \"[]\"\n in exI)\n apply(rule conjI)\n apply(rename_tac y)(*strict*)\n apply(simp add: epdaH_step_relation_def option_to_list_def epda_effects_def)\n apply(rename_tac y)(*strict*)\n apply(rule_tac\n x = \"[y]\"\n in exI)\n apply(rule conjI)\n apply(rename_tac y)(*strict*)\n apply(simp add: epdaH_step_relation_def option_to_list_def epda_effects_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac y w)(*strict*)\n apply(erule_tac\n x = \"e2\"\n in ballE)\n apply(rename_tac y w)(*strict*)\n apply(simp add: valid_epda_step_label_def may_terminated_by_def option_to_set_def)\n apply(rename_tac y w)(*strict*)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(simp add: epdaH_step_relation_def option_to_list_def)\n apply(rule_tac\n t = \"ATS_History.history_fragment_prefixes epda_effects (@) G [y] = ATS_History.history_fragment_prefixes epda_effects (@) G []\"\n and s = \"ATS_History.history_fragment_prefixes epda_effects (@) G [] \\ ATS_History.history_fragment_prefixes epda_effects (@) G [y] \\ ATS_History.history_fragment_prefixes epda_effects (@) G [y] \\ ATS_History.history_fragment_prefixes epda_effects (@) G []\"\n in ssubst)\n apply(rename_tac y)(*strict*)\n apply(force)\n apply(rename_tac y)(*strict*)\n apply(rule_tac\n t = \"ATS_History.history_fragment_prefixes epda_effects (@) G [] \\ ATS_History.history_fragment_prefixes epda_effects (@) G [y]\"\n in subst)\n apply(rename_tac y)(*strict*)\n apply(rule I_epda_HS_H.prefix_to_history_fragment_prefixes)\n apply(rename_tac y)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac y)(*strict*)\n apply(simp add: epda_effects_def)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def valid_epda_step_label_def)\n apply(clarsimp)\n apply(rename_tac y w)(*strict*)\n apply(erule_tac\n x = \"e2\"\n and P = \"\\e2. edge_src e2 \\ epda_states G \\ edge_trg e2 \\ epda_states G \\ option_to_set (edge_event e2) \\ epda_events G \\ edge_pop e2 \\ may_terminated_by (epda_gamma G) (epda_box G) \\ edge_push e2 \\ may_terminated_by (epda_gamma G) (epda_box G) \\ (edge_pop e2 \\ must_terminated_by (epda_gamma G) (epda_box G)) = (edge_push e2 \\ must_terminated_by (epda_gamma G) (epda_box G))\"\n in ballE)\n apply(rename_tac y w)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_set_def)\n apply(rename_tac y w)(*strict*)\n apply(simp add: epdaH_step_relation_def option_to_list_def)\n apply(rename_tac y)(*strict*)\n apply(rule_tac\n t = \"ATS_History.history_fragment_prefixes epda_effects (@) G [y] \\ ATS_History.history_fragment_prefixes epda_effects (@) G []\"\n in subst)\n apply(rename_tac y)(*strict*)\n apply(rule I_epda_HS_H.prefix_to_history_fragment_prefixes)\n apply(rename_tac y)(*strict*)\n apply(simp add: epda_effects_def)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def valid_epda_step_label_def)\n apply(clarsimp)\n apply(rename_tac y w)(*strict*)\n apply(erule_tac\n x = \"e2\"\n and P = \"\\e2. edge_src e2 \\ epda_states G \\ edge_trg e2 \\ epda_states G \\ option_to_set (edge_event e2) \\ epda_events G \\ edge_pop e2 \\ may_terminated_by (epda_gamma G) (epda_box G) \\ edge_push e2 \\ may_terminated_by (epda_gamma G) (epda_box G) \\ (edge_pop e2 \\ must_terminated_by (epda_gamma G) (epda_box G)) = (edge_push e2 \\ must_terminated_by (epda_gamma G) (epda_box G))\"\n in ballE)\n apply(rename_tac y w)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_set_def)\n apply(rename_tac y w)(*strict*)\n apply(simp add: epdaH_step_relation_def option_to_list_def)\n apply(rename_tac y)(*strict*)\n apply(simp add: epda_effects_def)\n apply(rename_tac y)(*strict*)\n apply(simp add: prefix_def)\n done\n\ntheorem epda_Cont_to_epda_operational_controllable: \"\n valid_dpda G\n \\ valid_dfa P\n \\ controllable_sublanguage (epdaH.unmarked_language G) (alphabet_to_language SigmaUC) (epdaH.unmarked_language P) (epdaH.unmarked_language G)\n \\ epda_operational_controllable G P SigmaUC\"\n apply(simp add: epda_operational_controllable_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(case_tac c1)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(case_tac c2)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(case_tac c2')\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka epdaH_conf_stateb epdaH_conf_historyb epdaH_conf_stackb)(*strict*)\n apply(rename_tac q1 h1 s1 q2 h2 s2 q2' h2' s2')\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u q1 h1 s1 q2 h2 s2 q2' h2' s2')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(simp add: controllable_sublanguage_def)\n apply(erule_tac\n x = \"h2\"\n in ballE)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n prefer 2\n apply(subgoal_tac \"h2 \\ epdaH.unmarked_language G\")\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(thin_tac \"h2 \\ epdaH.unmarked_language G\")\n apply(simp add: epdaH.unmarked_language_def)\n apply(rule_tac\n x = \"d1\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rule_tac\n x = \"n1\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(simp add: controllable_word_def)\n apply(erule_tac\n x = \"[u]\"\n in ballE)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n prefer 2\n apply(simp add: alphabet_to_language_def)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(simp add: epdaH.unmarked_language_def)\n apply(rule_tac\n x = \"d2\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rule_tac\n x = \"Suc n2\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2')(*strict*)\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2' d)(*strict*)\n apply(thin_tac \"epdaH.derivation_initial P d2\")\n apply(thin_tac \"d2 n2 = Some (pair e2 \\epdaH_conf_state = q2, epdaH_conf_history = h2, epdaH_conf_stack = s2\\)\")\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2' d)(*strict*)\n apply(thin_tac \"d2 (Suc n2) = Some (pair e2' \\epdaH_conf_state = q2', epdaH_conf_history = h2 @ [u], epdaH_conf_stack = s2'\\)\")\n apply(rename_tac d1 n1 e1 d2 n2 e2 e2' u q1 s1 q2 h2 s2 q2' s2' d)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e c)(*strict*)\n apply(case_tac c)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e c q h s)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"G\"\n and ?d1.0 = \"d1\"\n and ?d2.0 = \"d\"\n and ?i1.0 = \"n1\"\n and ?i2.0 = \"i\"\n in epdaH_coincide_strict_prefix)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"n1\"\n in allE)\n apply(clarsimp)\n apply(case_tac \"i = n1\")\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n prefer 2\n apply(rule_tac\n x = \"derivation_drop d n1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(rule_tac\n m = \"i-n1\"\n in epdaH.derivation_drop_preserves_derivation_prime)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(simp add: derivation_drop_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(rule_tac\n x = \"i-n1\"\n in exI)\n apply(simp add: derivation_drop_def)\n apply(rename_tac d1 n1 e1 u q1 s1 h2 d i e q s)(*strict*)\n apply(clarsimp)\n done\n\ntheorem epda_epda_operational_controllable_to_Cont: \"\n valid_dpda G\n \\ valid_dfa P\n \\ epda_operational_controllable G P SigmaUC\n \\ controllable_sublanguage (epdaH.unmarked_language G) (alphabet_to_language SigmaUC) (epdaH.unmarked_language P) (epdaH.unmarked_language G)\"\n apply(simp add: controllable_sublanguage_def controllable_word_def)\n apply(clarsimp)\n apply(rename_tac w' u)(*strict*)\n apply(simp add: alphabet_to_language_def)\n apply(clarsimp)\n apply(rename_tac w' v)(*strict*)\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac w' v d da)(*strict*)\n apply(thin_tac \"epdaH.derivation G d\")\n apply(thin_tac \"epdaH.derivation P da\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac v d da i ia e ea c ca)(*strict*)\n apply(case_tac c)\n apply(rename_tac v d da i ia e ea c ca epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(case_tac ca)\n apply(rename_tac v d da i ia e ea c ca epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(rename_tac q1 h1 s1 q2 h2 s2)\n apply(rename_tac v d da i ia e ea c ca q1 h1 s1 q2 h2 s2)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i ia e ea q1 h1 s1 q2 s2)(*strict*)\n apply(case_tac ia)\n apply(rename_tac v d da i ia e ea q1 h1 s1 q2 s2)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2)(*strict*)\n apply(case_tac \"da 0\")\n apply(rename_tac v d da i e q1 h1 s1 q2 s2)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(rename_tac v d da i ia e ea q1 h1 s1 q2 s2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 nat)(*strict*)\n apply(rename_tac ia)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n apply(simp add: epda_operational_controllable_def)\n apply(erule_tac\n x = \"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"i\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"da\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"ia\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"ia\"\n and m = \"Suc ia\"\n and G = \"P\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n apply(force)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n apply(force)\n apply(rename_tac v d da i e ea q1 h1 s1 q2 s2 ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 c1)(*strict*)\n apply(case_tac c1)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 c1 epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q3 h3 s3)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 c1 q3 h3 s3)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 q3 h3 s3)(*strict*)\n apply(subgoal_tac \"h1 = h3\")\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 q3 h3 s3)(*strict*)\n prefer 2\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 e2 h3 w)(*strict*)\n apply(case_tac \"e2\")\n apply(rename_tac v d da i e q1 h1 s1 ia e1 e2 h3 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(rename_tac qs re po pu qt)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 e2 h3 w qs re po pu qt)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 h3 w qs re po pu qt)(*strict*)\n apply(case_tac re)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 h3 w qs re po pu qt)(*strict*)\n apply(simp add: valid_dfa_def)\n apply(force)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 h3 w qs re po pu qt a)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 h1 s1 ia e1 h3 w qs po pu qt a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac v d da i e q1 h1 s1 q2 s2 ia e1 e2 q3 h3 s3)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC)(*strict*)\n apply(case_tac nC)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC)(*strict*)\n apply(clarsimp)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule_tac\n x = \"derivation_append d dc i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(force)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(force)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(force)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule_tac\n x = \"i+nC\"\n in exI)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac v d da i e q1 s1 q2 s2 ia e1 e2 q3 h3 s3 dc nC eC cC nat)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n done\n\ntheorem epda_epda_operational_controllable_vs_Cont: \"\n valid_dpda G\n \\ valid_dfa P\n \\ epda_operational_controllable G P SigmaUC \\ controllable_sublanguage (epdaH.unmarked_language G) (alphabet_to_language SigmaUC) (epdaH.unmarked_language P) (epdaH.unmarked_language G)\"\n apply (metis epda_Cont_to_epda_operational_controllable epda_epda_operational_controllable_to_Cont)\n done\n\ntheorem epda_Cont_eq_to_epda_operational_controllable_eq: \"\n valid_dpda G\n \\ valid_dpda G'\n \\ valid_dfa P\n \\ controllable_sublanguage (epdaH.unmarked_language G) (alphabet_to_language SigmaUC) (epdaH.unmarked_language P) (epdaH.unmarked_language G) \\\n controllable_sublanguage (epdaH.unmarked_language G') (alphabet_to_language SigmaUC) (epdaH.unmarked_language P) (epdaH.unmarked_language G')\n \\ epda_operational_controllable G P SigmaUC \\ epda_operational_controllable G' P SigmaUC\"\n apply(metis epda_Cont_to_epda_operational_controllable epda_epda_operational_controllable_to_Cont)\n done\n\ntheorem epda_Cont_eq_to_epda_operational_controllable_eq2: \"\n valid_dpda G\n \\ valid_dpda G'\n \\ valid_dfa P\n \\ epdaH.unmarked_language G = epdaH.unmarked_language G'\n \\ epda_operational_controllable G P SigmaUC \\ epda_operational_controllable G' P SigmaUC\"\n apply(rule epda_Cont_eq_to_epda_operational_controllable_eq)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epda_marking_states_change_preserves_determinism: \"\n valid_dpda G\n \\ epdaS.is_forward_edge_deterministic_accessible (G\\epda_marking:= Q\\)\"\n apply(simp add: valid_dpda_def epdaS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x = \"c\"\n in ballE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x = \"c1\"\n in allE)\n apply(erule_tac\n x = \"c2\"\n in allE)\n apply(erule_tac\n x = \"e1\"\n in allE)\n apply(erule_tac\n x = \"e2\"\n in allE)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(erule_tac\n x = \"d\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(thin_tac \"epdaS_step_relation (G\\epda_marking := Q\\) c e1 c1\")\n apply(thin_tac \"epdaS_step_relation (G\\epda_marking := Q\\) c e2 c2\")\n apply(thin_tac \"get_configuration (d i) = Some c\")\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac d)(*strict*)\n apply(clarsimp)\n apply(rename_tac d a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d b)(*strict*)\n apply(rule conjI)\n apply(rename_tac d b)(*strict*)\n prefer 2\n apply(simp add: epdaS_initial_configurations_def epdaS_configurations_def)\n apply(rename_tac d b)(*strict*)\n apply(thin_tac \"b \\ epdaS_initial_configurations (G\\epda_marking := Q\\)\")\n apply(simp (no_asm) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac d b i)(*strict*)\n apply(case_tac i)\n apply(rename_tac d b i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d b i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d b nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac d b nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d b nat a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d b nat a)(*strict*)\n prefer 2\n apply(rule_tac\n n = \"nat\"\n and m = \"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac d b nat a)(*strict*)\n apply(force)\n apply(rename_tac d b nat a)(*strict*)\n apply(force)\n apply(rename_tac d b nat a)(*strict*)\n apply(force)\n apply(rename_tac d b nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d b nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n done\n\nlemma epdaH_epda_stack_is_must_terminated_by_prime: \"\n valid_epda G\n \\ epdaH.derivation_initial G d\n \\ d i = Some (pair e c)\n \\ epdaH_conf_stack c \\ must_terminated_by (epda_gamma G) (epda_box G)\"\n apply(induct i arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c)(*strict*)\n prefer 2\n apply(rule epdaH.step_detail_before_some_position)\n apply(rename_tac i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G e2\")\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w a)(*strict*)\n apply(case_tac w)\n apply(rename_tac i c e1 e2 c1 w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 a)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. w = w' @ [x']\")\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w a aa list)(*strict*)\n apply(thin_tac \"w = aa # list\")\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w' x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w' x a aa)(*strict*)\n apply(force)\n done\n\nlemma epdaH_epda_stack_is_must_terminated_by: \"\n valid_epda G\n \\ c \\ epdaH.get_accessible_configurations G\n \\ epdaH_conf_stack c \\ must_terminated_by (epda_gamma G) (epda_box G)\"\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH_epda_stack_is_must_terminated_by_prime)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n done\n\nlemma DPDA_to_epdaH_determinism_SB_FE: \"\n valid_dpda G\n \\ epdaH.is_forward_edge_deterministicHist_SB_long G\"\n apply(subgoal_tac \"epdaH.is_forward_edge_deterministicHist_DB_long G\")\n prefer 2\n apply(rule DPDA_to_epdaH_determinism)\n apply(force)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(rule_tac\n t = \"epdaH.is_forward_edge_deterministicHist_SB_long G\"\n in ssubst)\n apply(rule epdaH.AX_is_forward_edge_deterministic_correspond_DB_SB)\n apply(force)\n apply(force)\n done\n\nlemma DPDA_to_epdaH_determinism_SB_F: \"\n valid_dpda G\n \\ epdaH.is_forward_deterministicHist_SB G\"\n apply(rule I_epda_lemmas.DPDA_is_is_forward_deterministicHist_SB)\n apply(force)\n done\n\ninterpretation \"epdaH_vs_epdaH\" : L_Controllable\n (* TSstructure *)\n \"valid_epda\"\n (* configurations *)\n \"epdaH_configurations\"\n (* initial_configurations *)\n \"epdaH_initial_configurations\"\n (* step_labels *)\n \"epda_step_labels\"\n (* step_relation *)\n \"epdaH_step_relation\"\n (* effects *)\n \"epda_effects\"\n (* marking_condition *)\n \"epdaH_marking_condition\"\n (* marked_effect *)\n \"epdaH_marked_effect\"\n (* unmarked_effect *)\n \"epdaH_unmarked_effect\"\n (* TSstructure *)\n \"valid_epda\"\n (* configurations *)\n \"epdaH_configurations\"\n (* initial_configurations *)\n \"epdaH_initial_configurations\"\n (* step_labels *)\n \"epda_step_labels\"\n (* step_relation *)\n \"epdaH_step_relation\"\n (* effects *)\n \"epda_effects\"\n (* marking_condition *)\n \"epdaH_marking_condition\"\n (* marked_effect *)\n \"epdaH_marked_effect\"\n (* unmarked_effect *)\n \"epdaH_unmarked_effect\"\n apply(simp add: L_Controllable_def LOCALE_DEFS_ALL LOCALE_DEFS_autHF)\n apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs epdaH_inst_ATS_axioms)\n done\n\nlemma epda_unmarked_language_is_prefix_closure: \"\n valid_epda G\n \\ epdaH.derivation_initial G d\n \\ maximum_of_domain d n\n \\ d n = Some (pair e c)\n \\ epdaH_unmarked_effect G d = prefix_closure {epdaH_conf_history c}\"\n apply(induct n arbitrary: d e c)\n apply(rename_tac d e c)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def epdaH.derivation_initial_def epdaH_initial_configurations_def prefix_def prefix_closure_def)\n apply(clarsimp)\n apply(rename_tac d c)(*strict*)\n apply(rule antisym)\n apply(rename_tac d c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c i e ca)(*strict*)\n apply(case_tac i)\n apply(rename_tac d c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c i e ca nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c e ca nat)(*strict*)\n apply (metis Suc_le_D Zero_not_Suc epdaH.allPreMaxDomSome_prime option.discI)\n apply(rename_tac d c)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x = \"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac n d e c)(*strict*)\n apply(erule_tac\n x = \"derivation_take d n\"\n in meta_allE)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac n d e c)(*strict*)\n prefer 2\n apply(rule epdaH.step_detail_before_some_position)\n apply(rename_tac n d e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac n d e c)(*strict*)\n apply(force)\n apply(rename_tac n d e c)(*strict*)\n apply(force)\n apply(rename_tac n d e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(erule meta_impE)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply (metis maximum_of_domain_derivation_take option.discI)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac n d c e1 e2 c1)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n d c e1 e2 c1 w)(*strict*)\n apply(case_tac c1)\n apply(rename_tac n d c e1 e2 c1 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac n d c e1 e2 c1 w q1 h1 s1)(*strict*)\n apply(case_tac c)\n apply(rename_tac n d c e1 e2 c1 w q1 h1 s1 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q2 h2 s2)\n apply(rename_tac n d c e1 e2 c1 w q1 h1 s1 q2 h2 s2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rule antisym)\n apply(rename_tac n d e1 e2 w h1)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(case_tac \"i = Suc n\")\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def epdaH.derivation_initial_def epdaH_initial_configurations_def prefix_def prefix_closure_def)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(case_tac \"i = n\")\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e2 w h1 e)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def epdaH.derivation_initial_def epdaH_initial_configurations_def prefix_def prefix_closure_def)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(subgoal_tac \"i\\Suc n\")\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d\"\n and i = \"i\"\n and n = \"Suc n\"\n in epdaH.allPreMaxDomSome_prime)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(force)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(force)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(subgoal_tac \"ih\\ epda_effects G. epdaH_conf_history \\epdaH_conf_state = edge_src e2, epdaH_conf_history = h1, epdaH_conf_stack = edge_pop e2 @ w\\ = epdaH_conf_history c @ h\")\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d\"\n and n = \"i\"\n and m = \"n-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(force)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply (metis (no_types, hide_lams) epdaH.derivation_initial_configurations)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac n d e1 e2 w h1 i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w i e c h)(*strict*)\n apply(simp add: epda_effects_def)\n apply(simp add: prefix_closure_def prefix_def)\n apply(rename_tac n d e1 e2 w h1)(*strict*)\n apply(simp (no_asm) add: prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1 x c)(*strict*)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac n d e1 e2 w h1 x c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w x c)(*strict*)\n apply(subgoal_tac \"x\\ {w. \\i e c. derivation_take d n i = Some (pair e c) \\ w = epdaH_conf_history c}\")\n apply(rename_tac n d e1 e2 w x c)(*strict*)\n prefer 2\n apply(rule_tac\n A = \"prefix_closure {x @ c}\"\n in set_mp)\n apply(rename_tac n d e1 e2 w x c)(*strict*)\n apply(force)\n apply(rename_tac n d e1 e2 w x c)(*strict*)\n apply(simp (no_asm) add: prefix_closure_def prefix_def)\n apply(rename_tac n d e1 e2 w x c)(*strict*)\n apply(thin_tac \"{w. \\i e c. derivation_take d n i = Some (pair e c) \\ w = epdaH_conf_history c} = prefix_closure {x @ c}\")\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w c i e ca)(*strict*)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(simp add: derivation_take_def)\n apply(case_tac \"i\\n\")\n apply(rename_tac n d e1 e2 w c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1 x c a)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n xs = \"c\"\n in rev_cases)\n apply(rename_tac n d e1 e2 w h1 x c a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1 a)(*strict*)\n apply(rule_tac\n x = \"Suc n\"\n in exI)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w h1 x c a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w x a ys)(*strict*)\n apply(subgoal_tac \"x\\ {w. \\i e c. derivation_take d n i = Some (pair e c) \\ w = epdaH_conf_history c}\")\n apply(rename_tac n d e1 e2 w x a ys)(*strict*)\n prefer 2\n apply(rule_tac\n A = \"prefix_closure {x @ ys}\"\n in set_mp)\n apply(rename_tac n d e1 e2 w x a ys)(*strict*)\n apply(force)\n apply(rename_tac n d e1 e2 w x a ys)(*strict*)\n apply(simp (no_asm) add: prefix_closure_def prefix_def)\n apply(rename_tac n d e1 e2 w x a ys)(*strict*)\n apply(thin_tac \"{w. \\i e c. derivation_take d n i = Some (pair e c) \\ w = epdaH_conf_history c} = prefix_closure {x @ ys}\")\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w a ys i e c)(*strict*)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(simp add: derivation_take_def)\n apply(case_tac \"i\\n\")\n apply(rename_tac n d e1 e2 w a ys i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n d e1 e2 w a ys i e c)(*strict*)\n apply(clarsimp)\n done\n\ntheorem DES_controllability_vs_controllable_sublanguage: \"\n DES_controllability \\UC P C \\\n controllable_sublanguage (des_langUM C) (alphabet_to_language \\UC) (des_langUM P) (des_langUM C)\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(simp add: DES_controllability_def controllable_sublanguage_def controllable_language_def controllable_word_def alphabet_to_language_def append_alphabet_def append_language_def)\n apply(force)\n apply(clarsimp)\n apply(simp add: DES_controllability_def controllable_sublanguage_def controllable_language_def controllable_word_def alphabet_to_language_def append_alphabet_def append_language_def)\n apply(force)\n done\n\ntheorem DES_controllability_implies_operational_controllability: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\ DES_controllability \\UC (epda_to_des P) (epda_to_des C)\n \\ epdaH_vs_epdaH.controllable C P ucont\"\n apply(simp add: epdaH_vs_epdaH.controllable_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"v @ [x] \\ epdaH_unmarked_effect P dP\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"edge_event eP' = Some x\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(thin_tac \"epdaH_unmarked_effect P dP = epdaH_unmarked_effect C dC\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(case_tac \"i = Suc nP\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x e c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x c)(*strict*)\n apply(case_tac c)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x epdaH_conf_state epdaH_conf_stack)(*strict*)\n apply(rename_tac q s)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x q s)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x w)(*strict*)\n apply(simp add: valid_dfa_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"eP'\"\n in ballE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x w)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' v x w y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(case_tac \"Suc nP < i\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i - nP = Suc 0\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(subgoal_tac \"ii'. i+i' = nP\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n prefer 2\n apply(rule_tac\n x = \"nP-i\"\n in exI)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e c i')(*strict*)\n apply(case_tac c)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e c i' epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' epdaH_conf_state epdaH_conf_stack)(*strict*)\n apply(rename_tac q s)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' q s)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' q s w)(*strict*)\n apply(simp add: valid_dfa_def)\n apply(clarsimp)\n apply(erule_tac\n x = \"eP'\"\n in ballE)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' q s w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' q s w)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP eP cP dC nC eC cC eP' cP' v x i e i' q s w y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(erule_tac\n x = \"i\"\n in allE)+\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"v @ [x] \\ epdaH.unmarked_language C\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule_tac\n A = \"{w. \\a\\ epdaH.unmarked_language C. \\b. (\\v\\ \\UC. b = [v]) \\ w = a @ b} \\ epdaH.unmarked_language P\"\n in set_mp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: DES_controllability_def epda_to_des_def des_langUM_def des_langM_def controllable_language_def append_alphabet_def append_language_def alphabet_to_language_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(thin_tac \"DES_controllability \\UC (epda_to_des P) (epda_to_des C)\")\n apply(simp (no_asm))\n apply(rule propSym)\n apply(rule context_conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(thin_tac \"epdaH_unmarked_effect P dP = epdaH_unmarked_effect C dC\")\n apply(simp add: epdaH_unmarked_effect_def epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule_tac\n x = \"derivation_append dP (der2 cP eP' cP') nP\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule epdaH.der2_is_derivation)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(rule_tac\n x = \"Suc nP\"\n in exI)\n apply(simp add: derivation_append_def der2_def)\n apply(erule_tac\n x = \"i\"\n in allE)+\n apply(case_tac \"i epdaH.unmarked_language P\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x i e c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(erule_tac\n x = \"i\"\n in allE)+\n apply(case_tac \"inP\")\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"i\"\n in allE)\n apply(force)\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n apply(clarsimp)\n apply(case_tac \"i-nP = Suc 0\")\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n apply(subgoal_tac \"i = Suc nP\")\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP nP eP dC nC eC eP' v x i d e ia ea w epdaH_conf_state epdaH_conf_stack epdaH_conf_historya epdaH_conf_statec epdaH_conf_stackc epdaH_conf_stated epdaH_conf_stackd)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: epdaH.unmarked_language_def epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"C\"\n and ?d1.0 = \"dC\"\n and ?d2.0 = \"d\"\n and ?i1.0 = \"nC\"\n and ?i2.0 = \"ia\"\n in epdaH_coincide_strict_prefix)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: strict_prefix_def)\n apply(rule_tac\n x = \"[x]\"\n in exI)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n x = \"map the (drop nC (get_labels d ia))\"\n in exI)\n apply(rule_tac\n x = \"ea\"\n in exI)\n apply(rule_tac\n x = \"ca\"\n in exI)\n apply(rule_tac\n x = \"derivation_drop (derivation_take d ia) nC\"\n in exI)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n m = \"ia-nC\"\n in epdaH.derivation_drop_preserves_derivation_prime)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac epdaH.derivation_take_preserves_derivation)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: derivation_take_def derivation_drop_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"length (get_labels d ia)\"\n and s = \"ia\"\n in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: derivation_take_def derivation_drop_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"length (get_labels d ia)\"\n and s = \"ia\"\n in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: maximum_of_domain_def derivation_take_def derivation_drop_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"length (get_labels d ia)\"\n and s = \"ia\"\n in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n t = \"map (Some \\ the) (drop nC (get_labels d ia))\"\n and s = \"drop nC (map (Some \\ the) (get_labels d ia))\"\n in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply (metis drop_map)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n t = \"map (Some \\ the) (get_labels d ia)\"\n in subst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n t = \"get_labels (derivation_drop (derivation_take d ia) nC) (ia - nC)\"\n in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule get_labels_derivation_drop)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"get_labels (derivation_take d ia) ia\"\n in subst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n G = \"C\"\n in epdaH.get_labels_derivation_take)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' x i d e c ia ea ca)(*strict*)\n apply(rule_tac\n x = \"ia\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n apply(clarsimp)\n done\n\ntheorem epda_operational_controllable_implies_operational_controllabilityX: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\ epda_operational_controllable C P \\UC\n \\ epdaH_vs_epdaH.controllableX C P ucont\"\n apply(simp add: epdaH_vs_epdaH.controllableX_def epda_operational_controllable_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"dC\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"nC\" in allE)\n apply(clarsimp)\n apply(subgoal_tac \"ATS.derivation_initial epdaH_initial_configurations\n epdaH_step_relation P (derivation_append dP (der2 cP eP' cP') nP)\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(rule epdaH.der2_is_derivation)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"derivation_append dP (der2 cP eP' cP') nP\" in allE)\n apply(erule impE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"nP\" in allE)\n apply(erule_tac x=\"eP\" in allE)\n apply(erule_tac x=\"cP\" in allE)\n apply(erule impE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"Some eP'\" in allE)\n apply(erule_tac x=\"cP'\" in allE)\n apply(erule impE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule impE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(thin_tac \"v @ [x]\n \\ epdaH_unmarked_effect P\n (derivation_append dP (der2 cP eP' cP') nP)\")\n apply(thin_tac \"v @ [x] \\ epdaH_unmarked_effect C dC\")\n apply(subgoal_tac \"epdaH_unmarked_effect P dP = prefix_closure {epdaH_conf_history cP}\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule epda_unmarked_language_is_prefix_closure)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"epdaH_unmarked_effect C dC = prefix_closure {epdaH_conf_history cC}\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule epda_unmarked_language_is_prefix_closure)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(rule prefix_closure_single_eq)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"x\" in allE)\n apply(clarsimp)\n apply(subgoal_tac \"epdaH_unmarked_effect P (derivation_append dP (der2 cP eP' cP') nP) = prefix_closure {epdaH_conf_history cP'}\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule epda_unmarked_language_is_prefix_closure)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(rule concat_has_max_dom)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"epdaH_unmarked_effect C dC = prefix_closure {epdaH_conf_history cC}\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule epda_unmarked_language_is_prefix_closure)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"epdaH_conf_history cP @ [x] = epdaH_conf_history cP'\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(subgoal_tac \"v @ [x] \\ epdaH_unmarked_effect P dP\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(thin_tac \"v @ [x] \\ epdaH_unmarked_effect C dC\")\n apply(thin_tac \"ATS.derivation_initial epdaH_initial_configurations\n epdaH_step_relation C dC\")\n apply(thin_tac \"maximum_of_domain dC nC\")\n apply(thin_tac \"dC nC = Some (pair eC cC)\")\n apply(thin_tac \"epdaH_unmarked_effect P dP = epdaH_unmarked_effect C dC\")\n apply(thin_tac \"epdaH_unmarked_effect C dC = prefix_closure {epdaH_conf_history cC}\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rename_tac dP nP eP cP cC eP' cP' v x)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n apply(case_tac \"i\\nP\")\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n apply(erule_tac x=\"i\" in allE)\n apply(simp add: derivation_append_def)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n apply(case_tac \"i=Suc nP\")\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(simp add: der2_def)\n apply(case_tac \"i-nP\")\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c nat)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP cC eP' cP' v x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP cC eP' cP' v x e c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: der2_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP cC eP' v x c)(*strict*)\n apply(case_tac c)\n apply(rename_tac dP nP eP cP cC eP' v x c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(case_tac cP)\n apply(rename_tac dP nP eP cP cC eP' v x c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac dP nP eP cC eP' v x epdaH_conf_state epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cC eP' v x epdaH_conf_historya w)(*strict*)\n apply(case_tac \"edge_event eP'\")\n apply(rename_tac dP nP eP cC eP' v x epdaH_conf_historya w)(*strict*)\n prefer 2\n apply(rename_tac dP nP eP cC eP' v x epdaH_conf_historya w a)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac dP nP eP cC eP' v x epdaH_conf_historya w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP eP' v x w)(*strict*)\n apply(erule_tac x=\"nP\" in allE)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(subgoal_tac \"epdaH_conf_history cP' = epdaH_conf_history cP @ [x]\")\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(rule prefix_closure_single_eq)\n apply(rule_tac t=\"epdaH_conf_history cP @ [x]\" and s=\"epdaH_conf_history cP'\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule impE)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(clarify)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac x=\"map the (get_labels dc nCa)\" in exI)\n apply(rule_tac x=\"eCa\" in exI)\n apply(rule_tac x=\"cCa\" in exI)\n apply(rule_tac x=\"derivation_take dc nCa\" in exI)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"length (get_labels dc nCa)\" and s=\"nCa\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule get_labels_length)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(simp (no_asm) add: derivation_take_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"length(map the (get_labels dc nCa))\" and s=\"length((get_labels dc nCa))\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule length_map)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"length (get_labels dc nCa)\" and s=\"nCa\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule get_labels_length)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(simp (no_asm) add: derivation_take_def)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"get_labels (derivation_take dc nCa) nCa\" and s=\"get_labels dc nCa\" in subst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac G=\"C\" in epdaH.get_labels_derivation_take)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold valid_dfa_def valid_dpda_def valid_pda_def)[1]\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(simp (no_asm))\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"epdaH_unmarked_effect P (derivation_append dP (der2 cP eP' cP') nP)\" and s=\"prefix_closure {epdaH_conf_history cP'}\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"epdaH_unmarked_effect C dC\" and s=\"prefix_closure {epdaH_conf_history cC}\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"epdaH_unmarked_effect C\n (derivation_append dC (derivation_take dc nCa) nC)\" and s=\"prefix_closure {epdaH_conf_history cCa}\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac e=\"if nCa = 0 then eC else eCa\" and G=\"C\" and n=\"nC+nCa\" in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold valid_dfa_def valid_pda_def valid_dpda_def)[1]\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold valid_dfa_def valid_pda_def valid_dpda_def)[1]\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac epdaH.derivation_append_preserves_derivation)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold epdaH.derivation_initial_def)[1]\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac epdaH.derivation_take_preserves_derivation)\n apply(unfold epdaH.derivation_initial_def)[1]\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold maximum_of_domain_def derivation_take_def)[1]\n apply(simp (no_asm))\n apply(clarify)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa y ya)(*strict*)\n apply(simp (no_asm_simp))\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule concat_has_max_dom)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(blast)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(unfold derivation_append_def derivation_take_def)[1]\n apply(simp (no_asm))\n apply(rule conjI)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(clarify)\n apply(simp (no_asm_simp))\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc eCa cCa)(*strict*)\n apply(thin_tac \"v @ [x]\n \\ epdaH_unmarked_effect P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP))\")\n apply(thin_tac \"ATS.derivation_initial epdaH_initial_configurations\n epdaH_step_relation P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP))\")\n apply(thin_tac \"epdaH_unmarked_effect P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP)) =\n prefix_closure {epdaH_conf_history cP'}\")\n apply(thin_tac \"epdaH_unmarked_effect C dC =\n prefix_closure {epdaH_conf_history cC}\")\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(thin_tac \"v @ [x]\n \\ epdaH_unmarked_effect P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP))\")\n apply(thin_tac \"ATS.derivation_initial epdaH_initial_configurations\n epdaH_step_relation P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP))\")\n apply(thin_tac \"epdaH_unmarked_effect P\n (\\x. if x \\ nP then dP x else der2 cP eP' cP' (x - nP)) =\n prefix_closure {epdaH_conf_history cP'}\")\n apply(thin_tac \"epdaH_unmarked_effect C dC =\n prefix_closure {epdaH_conf_history cC}\")\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"epdaH_conf_history cCa\" and s=\"epdaH_conf_history cP @ [x]\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(rule_tac t=\"epdaH_conf_history cP'\" and s=\"epdaH_conf_history cP @ [x]\" in ssubst)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x dc nCa eCa cCa)(*strict*)\n apply(force)\n done\n\ntheorem operational_controllability_implies_DES_controllability: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\ epdaH_vs_epdaH.controllable C P ucont\n \\ epda_operational_controllable C P \\UC\"\n apply(simp add: epda_operational_controllable_def epdaH_vs_epdaH.controllable_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"derivation_take d2 n2\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"n2\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"e2\"\n in allE)\n apply(erule_tac\n x = \"c2\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"derivation_take d1 n1\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"n1\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in allE)\n apply(erule_tac\n x = \"c1\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule_tac\n t = \"epdaH_unmarked_effect P (derivation_take d2 n2)\"\n in ssubst)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule_tac\n n = \"n2\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule_tac\n t = \"epdaH_unmarked_effect C (derivation_take d1 n1)\"\n in ssubst)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule_tac\n n = \"n1\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(rule_tac\n t = \"epdaH_conf_history c2\"\n and s = \"epdaH_conf_history c1\"\n in ssubst)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d2 n2 = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc n2\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 e2' c2' u)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(erule_tac\n x = \"e2a\"\n in allE)\n apply(erule_tac\n x = \"c2'\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(erule_tac\n x = \"epdaH_conf_history c2 @ [u]\"\n in allE)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(erule impE)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rule_tac\n x = \"Suc n2\"\n in exI)\n apply(simp add: derivation_append_def derivation_take_def der2_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(rule_tac\n t = \"epdaH_unmarked_effect C (derivation_take d1 n1)\"\n in ssubst)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(rule_tac\n n = \"n1\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(simp (no_asm) add: prefix_closure_def prefix_def)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC')(*strict*)\n apply(rule_tac\n x = \"dC'\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(case_tac \"i\\n1\")\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n prefer 2\n apply(rule_tac\n x = \"i-n1\"\n in exI)\n apply(simp add: derivation_append_def derivation_take_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(subgoal_tac \"d1 i = Some (pair ea c)\")\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def derivation_take_def get_configuration_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n prefer 2\n apply(rule_tac\n G = \"C\"\n and d = \"d1\"\n and n = \"i\"\n and m = \"n1-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_dfa_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def derivation_take_def get_configuration_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(rule_tac\n d = \"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_dfa_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(simp add: derivation_append_def derivation_take_def get_configuration_def)\n apply(rename_tac d1 n1 e1 c1 d2 n2 e2 c2 c2' u e2a \\P' e cC' dC' i ea c)(*strict*)\n apply(clarsimp)\n done\n\ntheorem controllable_vs_controllableX_part1: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\ epdaH_vs_epdaH.controllableX C P ucont\n \\ epdaH_vs_epdaH.controllable C P ucont\"\n apply(simp add: epdaH_vs_epdaH.controllable_def epdaH_vs_epdaH.controllableX_def)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x)(*strict*)\n apply(erule_tac x=\"dP\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"nP\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"dC\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"nC\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"eP'\" in allE)\n apply(erule_tac x=\"cP'\" in allE)\n apply(clarsimp)\n apply(erule_tac x=\"v@[x]\" in allE)\n apply(clarsimp)\n apply(rename_tac dP nP eP cP dC nC eC cC eP' cP' v x \\P' e cC' dC')(*strict*)\n apply(rule_tac x=\"\\P'\" in exI)\n apply(rule_tac x=\"e\" in exI)\n apply(rule_tac x=\"cC'\" in exI)\n apply(rule_tac x=\"dC'\" in exI)\n apply(clarsimp)\n apply (metis Diff_iff)\n done\n\ntheorem DES_controllability_implies_operational_controllabilityX: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\ DES_controllability \\UC (epda_to_des P) (epda_to_des C)\n \\ epdaH_vs_epdaH.controllableX C P ucont\"\n apply(rule epda_operational_controllable_implies_operational_controllabilityX)\n apply(force)\n apply(force)\n apply(force)\n prefer 2\n apply(force)\n apply(force)\n apply(rule operational_controllability_implies_DES_controllability)\n apply(force)\n apply(force)\n apply(force)\n prefer 2\n apply(force)\n apply(force)\n apply(rule DES_controllability_implies_operational_controllability)\n apply(force)\n apply(force)\n apply(force)\n prefer 2\n apply(force)\n apply(force)\n apply(force)\n done\n\ntheorem EPDA_relationship_among_controllability_notions: \"\n valid_dfa P\n \\ valid_dpda C\n \\ epda_events P = epda_events C\n \\ \\UC \\ epda_events P\n \\ ucont = (\\w. (\\v. \\x\\ \\UC. w = v@[x]))\n \\\n (epdaH_vs_epdaH.controllable C P ucont\n \\ epdaH_vs_epdaH.controllableX C P ucont)\n \\ (epdaH_vs_epdaH.controllable C P ucont\n \\ epda_operational_controllable C P \\UC)\n \\ (epda_operational_controllable C P \\UC\n \\ DES_controllability \\UC (epda_to_des P) (epda_to_des C))\n \\ (DES_controllability \\UC (epda_to_des P) (epda_to_des C)\n \\ controllable_sublanguage (epdaH.unmarked_language C) (alphabet_to_language \\UC) (epdaH.unmarked_language P) (epdaH.unmarked_language C))\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule impI)\n apply(rule_tac \\UC=\"\\UC\" in epda_operational_controllable_implies_operational_controllabilityX)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule impI)\n apply(rule_tac \\UC=\"\\UC\" in operational_controllability_implies_DES_controllability)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule impI)\n apply(rule_tac \\UC=\"\\UC\" in DES_controllability_implies_operational_controllability)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac \\UC=\"\\UC\" and P=\"(epda_to_des P)\" and C=\"(epda_to_des C)\" in DES_controllability_vs_controllable_sublanguage)\n apply(simp add: epda_to_des_def des_langUM_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac SigmaUC=\"\\UC\" in epda_epda_operational_controllable_vs_Cont)\n apply(force)\n apply(force)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac P=\"L_Controllable.controllableX epdaH_initial_configurations epdaH_step_relation\n epdaH_unmarked_effect epdaH_initial_configurations epdaH_step_relation\n epdaH_unmarked_effect C P ucont\" in impI)\n apply(rule_tac \\UC=\"\\UC\" in controllable_vs_controllableX_part1)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(rule context_conjI)\n apply(rule antisym)\n apply(simp (no_asm))\n apply(rule impI)\n apply(rule_tac P=\"epda_operational_controllable C P \\UC\" in mp)\n prefer 2\n apply(force)\n apply(force)\n apply(simp (no_asm))\n apply(rule impI)\n apply(force)\n apply(rule context_conjI)\n apply(rule antisym)\n apply(simp (no_asm))\n apply(simp (no_asm))\n apply(force)\n apply(rule antisym)\n apply(simp (no_asm))\n apply(force)\n apply(simp (no_asm))\n apply(force)\n done\n\ntheorem livelock_implies_epdaH_has_livelock: \"\n valid_epda G\n \\ epdaH_livelock G\n \\ epdaH.has_livelock G\"\n apply(simp add: epdaH_livelock_def epdaH.has_livelock_def epdaH.derivation_livelock_def)\n apply(erule exE)+\n apply(rename_tac d)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d)(*strict*)\n apply(force)\n apply(rename_tac d)(*strict*)\n apply(rule conjI)\n apply(rename_tac d)(*strict*)\n apply(force)\n apply(rename_tac d)(*strict*)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac d N)(*strict*)\n apply(rule_tac\n x = \"N\"\n in exI)\n apply(rule allI)\n apply(rename_tac d N n)(*strict*)\n apply(case_tac \"d N\")\n apply(rename_tac d N n)(*strict*)\n apply(erule_tac\n x = \"N\"\n in allE)+\n apply(force)\n apply(rename_tac d N n a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d N n a option conf)(*strict*)\n apply(rename_tac eN cN)\n apply(rename_tac d N n a eN cN)(*strict*)\n apply(erule_tac\n x = \"n\"\n in allE)+\n apply(clarsimp)\n apply(rename_tac d N n eN cN y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d N n eN cN y option conf)(*strict*)\n apply(rename_tac en cn)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule_tac\n t = \"epdaH_unmarked_effect G (derivation_take d N)\"\n in ssubst)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule_tac\n n = \"N\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply (metis epdaH.derivation_initial_is_derivation maximum_of_domain_derivation_take epdaH.pre_some_position_is_some_position option.distinct(1))\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule_tac\n t = \"epdaH_unmarked_effect G (derivation_take d n)\"\n in ssubst)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule_tac\n n = \"n\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply (metis epdaH.derivation_initial_is_derivation maximum_of_domain_derivation_take epdaH.pre_some_position_is_some_position option.distinct(1))\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule_tac\n t = \"epdaH_conf_history cN\"\n and s = \"epdaH_conf_history cn\"\n in ssubst)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: get_configuration_def)\n done\n\ntheorem epdaH_has_livelock_implies_livelock: \"\n valid_epda G\n \\ epdaH.has_livelock G\n \\ epdaH_livelock G\"\n apply(simp add: epdaH_livelock_def epdaH.has_livelock_def epdaH.derivation_livelock_def)\n apply(erule exE)+\n apply(rename_tac d)(*strict*)\n apply(rule_tac\n x = \"d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d)(*strict*)\n apply(force)\n apply(rename_tac d)(*strict*)\n apply(rule conjI)\n apply(rename_tac d)(*strict*)\n apply(force)\n apply(rename_tac d)(*strict*)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac d N)(*strict*)\n apply(rule_tac\n x = \"N\"\n in exI)\n apply(rule allI)\n apply(rename_tac d N n)(*strict*)\n apply(case_tac \"d N\")\n apply(rename_tac d N n)(*strict*)\n apply(erule_tac\n x = \"N\"\n in allE)+\n apply(force)\n apply(rename_tac d N n a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d N n a option conf)(*strict*)\n apply(rename_tac eN cN)\n apply(rename_tac d N n a eN cN)(*strict*)\n apply(erule_tac\n x = \"n\"\n in allE)+\n apply(clarsimp)\n apply(rename_tac d N n eN cN y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d N n eN cN y option conf)(*strict*)\n apply(rename_tac en cn)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"derivation_take d N\"\n and n = \"N\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply (metis epdaH.derivation_initial_is_derivation maximum_of_domain_derivation_take epdaH.pre_some_position_is_some_position option.distinct(1))\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"derivation_take d n\"\n and n = \"n\"\n in epda_unmarked_language_is_prefix_closure)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply (metis epdaH.derivation_initial_is_derivation maximum_of_domain_derivation_take epdaH.pre_some_position_is_some_position option.distinct(1))\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d N n eN cN y en cn)(*strict*)\n apply (metis prefix_closure_single_eq)\n done\n\ncorollary epda_inter_semantic_relationship: \"\n valid_epda G\n \\ epdaS.marked_language G = epdaH.marked_language G\n \\ epdaS.marked_language G = epdaHS.marked_language G\n \\ epdaS.unmarked_language G = epdaH.unmarked_language G\n \\ epdaS.unmarked_language G = epdaHS.unmarked_language G\n \\ (epdaS.is_forward_edge_deterministic_accessible G \\ epdaH.is_forward_edge_deterministicHist_SB G)\n \\ (epdaS.is_forward_edge_deterministic_accessible G \\ epdaHS.is_forward_edge_deterministic_accessible G)\n \\ (epdaS.Nonblockingness_linear_DB G \\ epdaHS.Nonblockingness_linear_DB G)\n \\ (epdaS.Nonblockingness_linear_DB G \\ epdaH.Nonblockingness_branching G)\"\n apply(rule conjI)\n apply (metis epdaS_to_epdaH_mlang)\n apply(rule conjI)\n apply (metis epdaS_to_epdaHS_mlang)\n apply(rule conjI)\n apply (metis epdaS_to_epdaH_unmarked_language)\n apply(rule conjI)\n apply (metis epdaS_to_epdaHS_unmarked_language)\n apply(rule conjI)\n apply(metis epdaH.AX_is_forward_edge_deterministic_correspond_DB_SB epdaH.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long epda_epdaS_is_forward_edge_deterministic_accessible_equal_to_epdaH_is_forward_edge_deterministicHist_DB_long)\n apply(rule conjI)\n apply(metis epdaS_vs_epdaHS.preservation_of_determinism epdaS_vs_epdaHS_TSstructure_rel_def)\n apply(rule context_conjI)\n apply (metis epdaS_vs_epdaHS.preservation_of_Nonblockingnessness epdaS_vs_epdaHS_TSstructure_rel_def)\n apply (metis epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n done\n\ntheorem epdaH_dependency_between_determinism_properties: \"\n valid_epda G\n \\\n epdaH.is_forward_target_deterministic_accessible G\n \\ (epdaH.is_forward_target_deterministic_accessible G\n \\ epdaH.is_forward_target_deterministicHist_SB G)\n \\ (epdaH.is_forward_target_deterministic_accessible G\n \\ epdaH.is_forward_target_deterministicHist_DB G)\n \\ (epdaH.is_forward_target_deterministicHist_SB G\n \\ epdaH.is_forward_target_deterministicHist_DB G)\n \\ (epdaH.is_forward_edge_deterministic_accessible G\n \\ epdaH.is_forward_edge_deterministicHist_SB G)\n \\ (epdaH.is_forward_edge_deterministic_accessible G\n \\ epdaH.is_forward_edge_deterministicHist_DB G)\n \\ (epdaH.is_forward_edge_deterministicHist_SB G\n \\ epdaH.is_forward_edge_deterministicHist_DB G)\"\n apply(rule conjI)\n apply (metis epdaH_inst_AX_is_forward_target_deterministic_correspond_DB epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rule conjI)\n apply (metis epdaH.AX_is_forward_target_deterministic_correspond_SB epdaH.is_forward_target_deterministicHist_SB_vs_is_forward_target_deterministicHist_SB_long)\n apply(rule conjI)\n apply (metis epdaH.AX_is_forward_target_deterministic_correspond_DB epdaH.is_forward_target_deterministicHist_DB_vs_is_forward_target_deterministicHist_DB_long)\n apply(rule context_conjI)\n apply (metis epdaH.is_forward_target_deterministicHist_DB_vs_is_forward_target_deterministicHist_DB_long epdaH.is_forward_target_deterministicHist_SB_vs_is_forward_target_deterministicHist_SB_long epdaH_inst_AX_is_forward_target_deterministic_correspond_DB epdaH_inst_AX_is_forward_target_deterministic_correspond_SB)\n apply(rule context_conjI)\n apply (metis epdaH.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_SB)\n apply(rule conjI)\n apply (metis epdaH.is_forward_edge_deterministicHist_DB_vs_is_forward_edge_deterministicHist_DB_long epdaH.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply (metis epdaH.AX_is_forward_edge_deterministic_correspond_DB_SB epdaH.is_forward_edge_deterministicHist_DB_vs_is_forward_edge_deterministicHist_DB_long epdaH.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long)\n done\n\ncorollary epdaH_operational_Nonblockingness_SB_DB_Restriction: \"\n valid_epda G\n \\ (epdaH.Nonblockingness_branching_restricted G \\ epdaH.Nonblockingness_branching G)\n \\ (epdaH.Nonblockingness_branching_restricted_DB G \\ epdaH.Nonblockingness_branching G)\"\n apply(rule conjI)\n apply(rule antisym)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_def epdaH.Nonblockingness_branching_def)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_def epdaH.Nonblockingness_branching_def)\n apply(rule antisym)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_DB_def epdaH.Nonblockingness_branching_def)\n apply(simp add: epdaH.Nonblockingness_branching_restricted_DB_def epdaH.Nonblockingness_branching_def)\n done\n\ncorollary epdaH_language_Nonblockingness_from_operational_Nonblockingness: \"\n valid_epda G\n \\ epdaH.Nonblockingness_branching G\n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G)\"\n apply(metis epdaH.AX_BF_Bra_OpLa)\n done\n\ncorollary epdaH_operational_Nonblockingness_from_language_Nonblockingness: \"\n valid_epda G\n \\ epdaH.is_forward_edge_deterministicHist_SB G\n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G)\n \\ epdaH.Nonblockingness_branching G\"\n apply (metis epdaH.is_forward_deterministicHist_SB_def epdaH.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long epdaH_inst_AX_BF_BraSBRest_DetHSB_LaOp_axioms epdaH_inst_AX_is_forward_target_deterministic_correspond_SB epdaH_is_forward_target_deterministic_accessible epdaH_operational_Nonblockingness_SB_DB_Restriction)\n done\n\ntheorem epdaHS_dependency_between_determinism_properties: \"\n valid_epda G\n \\\n epdaHS.is_forward_target_deterministic_accessible G\n \\ (epdaHS.is_forward_target_deterministic_accessible G\n \\ epdaHS.is_forward_target_deterministicHist_SB G)\n \\ (epdaHS.is_forward_target_deterministic_accessible G\n \\ epdaHS.is_forward_target_deterministicHist_DB G)\n \\ (epdaHS.is_forward_target_deterministicHist_SB G\n \\ epdaHS.is_forward_target_deterministicHist_DB G)\n \\ (epdaHS.is_forward_edge_deterministic_accessible G\n \\ epdaHS.is_forward_edge_deterministicHist_SB G)\n \\ (epdaHS.is_forward_edge_deterministic_accessible G\n \\ epdaHS.is_forward_edge_deterministicHist_DB G)\n \\ (epdaHS.is_forward_edge_deterministicHist_SB G\n \\ epdaHS.is_forward_edge_deterministicHist_DB G)\"\n apply(rule conjI)\n apply(rule epdaHS_is_forward_target_deterministic_accessible)\n apply(force)\n apply(rule conjI)\n apply (metis epdaHS.is_forward_target_deterministicHist_SB_vs_is_forward_target_deterministicHist_SB_long epdaHS.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_SB_long epdaHS_is_forward_target_deterministic_accessible)\n apply(rule conjI)\n apply (metis epdaHS.is_forward_target_deterministicHist_DB_vs_is_forward_target_deterministicHist_DB_long epdaHS.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_DB_long epdaHS_is_forward_target_deterministic_accessible)\n apply(rule conjI)\n apply (metis epdaHS.is_forward_target_deterministicHist_DB_vs_is_forward_target_deterministicHist_DB_long epdaHS.is_forward_target_deterministicHist_SB_vs_is_forward_target_deterministicHist_SB_long epdaHS_inst_AX_is_forward_target_deterministic_correspond_DB epdaHS_inst_AX_is_forward_target_deterministic_correspond_SB)\n apply(rule conjI)\n apply (metis epdaHS.AX_is_forward_edge_deterministic_correspond_SB epdaHS.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long)\n apply(rule conjI)\n apply (metis epdaHS.AX_is_forward_edge_deterministic_correspond_DB epdaHS.is_forward_edge_deterministicHist_DB_vs_is_forward_edge_deterministicHist_DB_long)\n apply (metis epdaHS.AX_is_forward_edge_deterministic_correspond_DB_SB epdaHS.is_forward_edge_deterministicHist_DB_vs_is_forward_edge_deterministicHist_DB_long epdaHS.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long)\n done\n\ncorollary epdaHS_operational_Nonblockingness_SB_DB_Restriction: \"\n valid_epda G\n \\ (epdaHS.Nonblockingness_linear G\n \\ epdaHS.Nonblockingness_linear_restricted G)\n \\ (epdaHS.Nonblockingness_linear_DB G\n \\ epdaHS.Nonblockingness_linear_restricted_DB G)\n \\ (epdaHS.Nonblockingness_linear G\n \\ epdaHS.Nonblockingness_linear_DB G)\n \\ (epdaHS.Nonblockingness_linear_restricted G\n \\ epdaHS.Nonblockingness_linear_restricted_DB G)\"\n apply(rule conjI)\n apply(simp add: epdaHS.Nonblockingness_linear_restricted_DB_def epdaHS.Nonblockingness_linear_restricted_def epdaHS.Nonblockingness_linear_def epdaHS.Nonblockingness_linear_DB_def)\n apply(rule conjI)\n apply(simp add: epdaHS.Nonblockingness_linear_restricted_DB_def epdaHS.Nonblockingness_linear_restricted_def epdaHS.Nonblockingness_linear_def epdaHS.Nonblockingness_linear_DB_def)\n apply(rule conjI)\n apply (metis epdaHS.Nonblockingness_linear_vs_Nonblockingness_linear_DB)\n apply(metis epdaHS.Nonblockingness_linear_restricted_SB_vs_Nonblockingness_linear_restricted_DB_1 epdaHS.Nonblockingness_linear_restricted_SB_vs_Nonblockingness_linear_restricted_DB_2)\n done\n\ncorollary epdaHS_language_Nonblockingness_from_operational_Nonblockingness: \"\n valid_epda G\n \\ epdaHS.Nonblockingness_linear G\n \\ nonblockingness_language (epdaHS.unmarked_language G) (epdaHS.marked_language G)\"\n apply(metis epdaHS.AX_BF_LinSB_OpLa)\n done\n\ncorollary epdaHS_operational_Nonblockingness_from_language_Nonblockingness: \"\n valid_epda G\n \\ epdaHS.is_forward_edge_deterministic_accessible G\n \\ nonblockingness_language (epdaHS.unmarked_language G) (epdaHS.marked_language G)\n \\ epdaHS.Nonblockingness_linear G\"\n apply(subgoal_tac \"epdaHS.is_forward_deterministic_accessible G\")\n apply(thin_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n apply (metis epdaHS.AX_BF_LinSBRest_DetR_LaOp epdaHS_operational_Nonblockingness_SB_DB_Restriction)\n apply (metis epdaHS.is_forward_deterministic_accessible_def epdaHS_is_forward_target_deterministic_accessible)\n done\n\ntheorem epdaS_dependency_between_determinism_properties: \"\n valid_epda G\n \\ epdaS.is_forward_target_deterministic_accessible G\"\n apply (metis epda_is_is_forward_target_deterministic_accessible)\n done\n\ncorollary epdaS_operational_Nonblockingness_SB_DB_Restriction: \"\n valid_epda G\n \\ epdaS.Nonblockingness_linear_DB G \\ epdaS.Nonblockingness_linear_restricted_DB G\"\n apply(simp add: epdaS.Nonblockingness_linear_restricted_DB_def epdaS.Nonblockingness_linear_DB_def)\n done\n\ncorollary epdaS_language_Nonblockingness_from_operational_Nonblockingness: \"\n valid_epda G\n \\ epdaS.Nonblockingness_linear_DB G\n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\"\n apply(metis epdaS.AX_BF_LinDB_OpLa)\n done\n\ncorollary epdaS_operational_Nonblockingness_from_language_Nonblockingness: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n \\ epdaS.Nonblockingness_linear_DB G\n \\ epdaS.Nonblockingness_linear_restricted_DB G\"\n apply(subgoal_tac \"epdaS.is_forward_deterministic_accessible G\")\n apply(rule_tac\n t=\"epdaS.Nonblockingness_linear_DB G\"\n and s=\"epdaS.Nonblockingness_linear_restricted_DB G\"\n in ssubst)\n apply(simp add: epdaS.Nonblockingness_linear_DB_def epdaS.Nonblockingness_linear_restricted_DB_def)\n apply(metis epdaS.AX_BF_LinDBRest_DetR_LaOp)\n apply(simp only: epdaS.is_forward_deterministic_accessible_def)\n apply(rule conjI)\n prefer 2\n apply(force)\n apply(thin_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(thin_tac \"nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\")\n apply(metis epda_is_is_forward_target_deterministic_accessible)\n done\n\ncorollary epda_inter_semantics_determinsim_relationship: \"\n valid_epda G\n \\\n (epdaS.is_forward_target_deterministic_accessible G\n \\ epdaHS.is_forward_target_deterministic_accessible G)\n \\ (epdaS.is_forward_target_deterministic_accessible G\n \\ epdaH.is_forward_target_deterministic_accessible G)\n \\ (epdaS.is_forward_edge_deterministic_accessible G\n \\ epdaHS.is_forward_edge_deterministic_accessible G)\n \\ (epdaH.is_forward_edge_deterministicHist_SB G\n \\ epdaHS.is_forward_edge_deterministicHist_SB G)\"\n apply(rule_tac\n t=\"epdaS.is_forward_target_deterministic_accessible G\"\n and s=\"True\"\n in ssubst)\n apply (metis epdaS_dependency_between_determinism_properties)\n apply(rule_tac\n t=\"epdaHS.is_forward_target_deterministic_accessible G\"\n and s=\"True\"\n in ssubst)\n apply (metis epdaHS_is_forward_target_deterministic_accessible)\n apply(rule_tac\n t=\"epdaH.is_forward_target_deterministic_accessible G\"\n and s=\"True\"\n in ssubst)\n apply (metis epdaH_dependency_between_determinism_properties)\n apply(rule conjI)\n apply(force)\n apply(rule conjI)\n apply(force)\n apply(rule conjI)\n apply (metis epdaS_vs_epdaHS.preservation_of_determinism epdaS_vs_epdaHS_TSstructure_rel_def)\n apply (metis epdaHS.AX_is_forward_edge_deterministic_correspond_SB epdaHS.is_forward_edge_deterministicHist_SB_vs_is_forward_edge_deterministicHist_SB_long epdaH_vs_epdaHS.is_forward_edge_deterministic_accessible_vs_is_forward_edge_deterministicHist_SB)\n done\n\nlemma epda_unmarked_language_prefix_closed: \"\n valid_epda P\n \\ Nonblockingness2 (epdaH.unmarked_language P) (epdaH.unmarked_language P)\"\n apply(simp add: Nonblockingness2_def)\n apply(simp add: epdaH.marked_language_def epdaH.unmarked_language_def prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac x d c)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac x d c)(*strict*)\n prefer 2\n apply(rule epdaH.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac x d c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c ca)(*strict*)\n apply(subgoal_tac \"ca \\ epdaH_initial_configurations P\")\n apply(rename_tac x d c ca)(*strict*)\n prefer 2\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac x d c ca)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac ca)\n apply(rename_tac x d c ca epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac x d c i e ca)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"\\k\\i. (\\i (\\k. \\c' e. d k = Some (pair e c') \\ length(epdaH_conf_history c')\\(length x)) i) \\ (\\k. \\c' e. d k = Some (pair e c') \\ length(epdaH_conf_history c')\\(length x)) k\")\n apply(rename_tac x d c i e ca)(*strict*)\n prefer 2\n apply(rule ex_least_nat_le_prime)\n apply(clarsimp)\n apply(case_tac ca)\n apply(rename_tac x d c i e ca epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca k c' ea)(*strict*)\n apply(case_tac k)\n apply(rename_tac x d c i e ca k c' ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e ca)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x d c i e ca k c' ea nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"nat\"\n and m=\"i\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' ea nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\w. epdaH_conf_history ca = (epdaH_conf_history c1)@w\")\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"nat\"\n and m=\"i-nat\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"\\w. epdaH_conf_history c' = (epdaH_conf_history c1)@w\")\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"nat\"\n and m=\"Suc 0\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"\\w. epdaH_conf_history ca = (epdaH_conf_history c')@w\")\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc nat\"\n and m=\"i-Suc nat\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w wa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wa wb)(*strict*)\n apply(rule_tac\n x=\"Suc nat\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH_step_relation_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w)(*strict*)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w)(*strict*)\n apply(case_tac ca)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w q h s)(*strict*)\n apply(case_tac c1)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w q h s epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w q h s q1 h1 s1)(*strict*)\n apply(case_tac c')\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w q h s q1 h1 s1 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q2 h2 s2)\n apply(rename_tac x d c i e ca c' nat e1 e2 c1 wb w q h s q1 h1 s1 q2 h2 s2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1)(*strict*)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"length x = Suc (length h1)\")\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n prefer 2\n apply (metis le_SucE)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"prefix h1 x \\ prefix x h1\")\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(rule sym)\n apply(force)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n apply(erule disjE)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac x d c i e nat e1 e2 wb w q s h1 a)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac d c i e nat e1 e2 wb w q s h1 a ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac d c i e nat e1 e2 wb w q s h1 a ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c i e nat e1 e2 wb w q s h1 a ca aa list)(*strict*)\n apply(clarsimp)\n done\n\ncorollary epda_inter_semantics_language_relationship: \"\n valid_epda G\n \\\n (epdaH.marked_language G \\ epdaH.unmarked_language G)\n \\ (epdaS.marked_language G = epdaHS.marked_language G)\n \\ (epdaHS.marked_language G = epdaH.marked_language G)\n \\ (epdaS.unmarked_language G = epdaHS.unmarked_language G)\n \\ (epdaHS.unmarked_language G = epdaH.unmarked_language G)\n \\ (epdaH.unmarked_language G = prefix_closure (epdaH.unmarked_language G))\"\n apply(rule context_conjI)\n apply (metis epdaH.lang_inclusion)\n apply(rule context_conjI)\n apply (metis epdaS_to_epdaHS_mlang)\n apply(rule context_conjI)\n apply (metis epdaH_to_epdaHS_mlang)\n apply(rule context_conjI)\n apply (metis epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(rule context_conjI)\n apply (metis epdaS_to_epdaH_unmarked_language)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule epda_unmarked_language_prefix_closed)\n apply(force)\n apply(simp add: Nonblockingness2_def)\n apply(rule antisym)\n apply(simp add: prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(force)\n done\n\ncorollary epda_inter_semantics_Nonblockingnessness_relationship: \"\n valid_epda G\n \\ (epdaHS.Nonblockingness_linear G \\ epdaH.Nonblockingness_branching G)\n \\ (epdaH.Nonblockingness_branching G \\ epdaS.Nonblockingness_linear_DB G)\"\n apply(rule context_conjI)\n apply (metis epdaH_vs_epdaHS.bfbra_to_bflin epdaH_vs_epdaHS.bflin_to_bfbra)\n apply(subgoal_tac \"(epdaHS.Nonblockingness_linear G \\ epdaS.Nonblockingness_linear_DB G)\")\n prefer 2\n apply(subgoal_tac \"(epdaHS.Nonblockingness_linear_DB G \\ epdaS.Nonblockingness_linear_DB G) \\ epdaHS.unmarked_language G = epdaS.unmarked_language G \\ epdaHS.marked_language G = epdaS.marked_language G\")\n prefer 2\n apply(rule epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(force)\n apply(rule_tac\n t=\"epdaHS.Nonblockingness_linear G\"\n and s=\"epdaHS.Nonblockingness_linear_DB G\"\n in ssubst)\n prefer 2\n apply(force)\n apply (metis epdaHS_operational_Nonblockingness_SB_DB_Restriction)\n apply(rule_tac\n t=\"epdaHS.Nonblockingness_linear G\"\n and s=\"epdaS.Nonblockingness_linear_DB G\"\n in ssubst)\n apply(force)\n apply(metis)\n done\n\ndefinition epdaHS_accessible_edges :: \"('q,'a,'b)epda \\ ('q,'a,'b)epda_step_label set\" where\n \"epdaHS_accessible_edges M \\ {e\\ (epda_delta M). \\d n c. epdaHS.derivation_initial M d \\ d n = Some (pair (Some e) c)}\"\n\nlemma epdaHS_accessible_edges_vs_epdaH_accessible_edges_1: \"\n valid_epda G\n \\ epdaHS_accessible_edges G \\ epdaH_accessible_edges G\"\n apply(simp add: epdaHS_accessible_edges_def epdaH_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"ATS_Branching_Versus_Linear1.Lin2BraDer epdaHvHS_Lin2BraConf d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c)(*strict*)\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_initiality_lift)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(simp add: epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def)\n done\n\nlemma epdaHS_accessible_edges_vs_epdaH_accessible_edges_2: \"\n valid_epda G\n \\ epdaH_accessible_edges G \\ epdaHS_accessible_edges G\"\n apply(simp add: epdaHS_accessible_edges_def epdaH_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"epdaH_vs_epdaHS.Bra2LinDer G d n\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c)(*strict*)\n apply(rule epdaH_vs_epdaHS.AX_Bra2LinConf_preserves_initiality_lift)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(simp add: epdaH_vs_epdaHS.Bra2LinDer_def)\n done\n\nlemma epdaH_accessible_edges_vs_epdaHS_accessible_edges: \"\n valid_epda G\n \\ epdaH_accessible_edges G = epdaHS_accessible_edges G\"\n apply (metis epdaHS_accessible_edges_vs_epdaH_accessible_edges_1 epdaHS_accessible_edges_vs_epdaH_accessible_edges_2 equalityI)\n done\n\nlemma epdaHS_accessible_edges_vs_epdaS_accessible_edges_1: \"\n valid_epda G\n \\ epdaHS_accessible_edges G \\ epdaS_accessible_edges G\"\n apply(simp add: epdaS_accessible_edges_def epdaHS_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"epdaHS2epdaS_derivation d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c)(*strict*)\n apply(rule epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n done\n\nlemma epdaHS_accessible_edges_vs_epdaS_accessible_edges_2: \"\n valid_epda G\n \\ epdaS_accessible_edges G \\ epdaHS_accessible_edges G\"\n apply(simp add: epdaS_accessible_edges_def epdaHS_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(rule_tac\n x=\"epdaS2epdaHS_derivation G d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c)(*strict*)\n apply(rule epdaS2epdaHS_derivation_preserves_derivation_initial)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n done\n\nlemma epdaS_accessible_edges_vs_epdaHS_accessible_edges: \"\n valid_epda G\n \\ epdaS_accessible_edges G = epdaHS_accessible_edges G\"\n apply (metis epdaHS_accessible_edges_vs_epdaS_accessible_edges_1 epdaHS_accessible_edges_vs_epdaS_accessible_edges_2 equalityI)\n done\n\nlemma epdaH_accessible_edges_vs_epdaS_accessible_edges: \"\n valid_epda G\n \\ epdaS_accessible_edges G = epdaH_accessible_edges G\"\n apply (metis epdaH_accessible_edges_vs_epdaHS_accessible_edges epdaS_accessible_edges_vs_epdaHS_accessible_edges)\n done\n\nlemma accessible_implies_accessible: \"\n valid_epda G\n \\ epdaS.accessible G\n \\ accessible G\"\n apply(simp add: accessible_def)\n apply(rule conjI)\n apply(simp add: all_states_accessible_def epdaS.accessible_def epda_destinations_def)\n apply(erule conjE)\n apply(thin_tac \"edge ` epda_delta G\n \\ ATS_Destinations.get_accessible_destinations epdaS_initial_configurations\n epdaS_step_relation epda_destinations epdaS_get_destinations G\")\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"state x \\ epdaS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"state ` epda_states G\n \\ ATS_Destinations.get_accessible_destinations epdaS_initial_configurations\n epdaS_step_relation epda_destinations epdaS_get_destinations G\")\n apply(simp add: epdaS.get_accessible_destinations_def epdaS_get_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(erule_tac disjE)\n apply(rename_tac x d i e c)(*strict*)\n prefer 2\n apply(case_tac e)\n apply(rename_tac x d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e c a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: epdaS_accessible_states_def)\n apply(rule_tac x=\"d\" in exI)\n apply(rule conjI)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d i e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e c)(*strict*)\n apply(rule_tac x=\"i\" in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d 0\")\n apply(rename_tac d i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d i e c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i e c a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c option conf)(*strict*)\n apply(simp add: epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(simp add: all_edges_accessible_def epdaS.accessible_def epda_destinations_def)\n apply(erule conjE)\n apply(thin_tac \"state ` epda_states G\n \\ ATS_Destinations.get_accessible_destinations epdaS_initial_configurations\n epdaS_step_relation epda_destinations epdaS_get_destinations G \")\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"edge x \\ epdaS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"edge ` epda_delta G\n \\ ATS_Destinations.get_accessible_destinations epdaS_initial_configurations\n epdaS_step_relation epda_destinations epdaS_get_destinations G\")\n apply(simp add: epdaS.get_accessible_destinations_def epdaS_get_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(case_tac e)\n apply(rename_tac x d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e c a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i c a)(*strict*)\n apply(simp add: epdaS_accessible_edges_def)\n apply(rule_tac x=\"d\" in exI)\n apply(rule conjI)\n apply(rename_tac d i c a)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac d i c a)(*strict*)\n apply(rule_tac x=\"i\" in exI)\n apply(clarsimp)\n done\n\ntheorem epdaH_to_epdaHS_accessible: \"\n valid_epda G\n \\ epdaH.accessible G\n \\ epdaHS.accessible G\"\n apply(simp add: epdaHS.accessible_def epdaH.accessible_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ epdaH.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"epda_destinations G \\ epdaH.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ epda_destinations G\")\n apply(simp add: epdaHS.get_accessible_destinations_def epdaH.get_accessible_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(simp add: epdaH_get_destinations_def)\n apply(case_tac c)\n apply(rename_tac x d i e c epdaH_conf_statea epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(rule_tac\n x = \"epdaH_vs_epdaHS.Bra2LinDer G d i\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(rule epdaH_vs_epdaHS.AX_Bra2LinConf_preserves_initiality_lift)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(simp add: epda_destinations_def)\n apply(rename_tac x d i e q h s)(*strict*)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(simp add: epdaHvHS_Bra2LinConf_def derivation_map_def epdaH_vs_epdaHS.Bra2LinDer_def epdaHS_get_destinations_def)\n done\n\ntheorem epdaHS_to_epdaS_accessible: \"\n valid_epda G\n \\ epdaHS.accessible G\n \\ epdaS.accessible G\"\n apply(simp add: epdaS.accessible_def epdaHS.accessible_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"x \\ epdaHS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"epda_destinations G \\ epdaHS.get_accessible_destinations G\")\n apply(rename_tac x)(*strict*)\n apply(thin_tac \"x \\ epda_destinations G\")\n apply(simp add: epdaS.get_accessible_destinations_def epdaHS.get_accessible_destinations_def)\n apply(clarsimp)\n apply(rename_tac x d i e c)(*strict*)\n apply(simp add: epdaHS_get_destinations_def)\n apply(case_tac c)\n apply(rename_tac x d i e c epdaHS_conf_statea epdaHS_conf_history epdaHS_conf_scheduler epdaHS_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n e q h i s)(*strict*)\n apply(rule_tac\n x = \"epdaHS2epdaS_derivation d\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n e q h i s)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x d n e q h i s)(*strict*)\n apply(rule_tac\n x = \"n\"\n in exI)\n apply(simp add: epdaS_get_destinations_def epdaHS2epdaS_derivation_def epdaHS_get_destinations_def)\n done\n\ntheorem accessible_vs_accessible: \"\n valid_epda G\n \\\n (epdaS.accessible G \\ accessible G)\n \\ (epdaS.accessible G \\ epdaHS.accessible G)\n \\ (epdaHS.accessible G \\ epdaH.accessible G)\"\n apply(rule conjI)\n apply(rule antisym)\n apply(clarsimp)\n apply(rule accessible_implies_accessible)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule valid_epda_accessible_implies_accessible)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule antisym)\n apply(clarsimp)\n apply(rule epdaS_to_epdaHS_accessible)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule epdaHS_to_epdaS_accessible)\n apply(force)\n apply(force)\n apply(rule antisym)\n apply(clarsimp)\n apply(rule epdaHS_to_epdaH_accessible)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule epdaH_to_epdaHS_accessible)\n apply(force)\n apply(force)\n done\n\nlemma epda_box_stays_at_bottom_epdaH: \"\n valid_epda G\n \\ epdaH.derivation_initial G d\n \\ d i = Some (pair e c)\n \\ \\w. epdaH_conf_stack c = w @ [epda_box G]\"\n apply(induct i arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c)(*strict*)\n prefer 2\n apply(rule epdaH.step_detail_before_some_position)\n apply(rename_tac i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G e2\")\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(case_tac wa)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(subgoal_tac \"edge_push e2 \\ must_terminated_by (epda_gamma G) (epda_box G)\")\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(rule epda_push_also_must_terminated_by)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(rule may_terminated_by_EndStrY)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(rule_tac\n x=\"w\"\n in exI)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w wa a list)(*strict*)\n apply(thin_tac \"wa = a # list\")\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w wa)(*strict*)\n apply(simp add: valid_epda_def)\n done\n\nlemma never_not_present_implies_always_present: \"\n valid_simple_dpda G\n \\ epdaH.derivation_initial G d\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e1 c1)\n \\ epdaH_conf_stack c1 = v1 @ x1 # w\n \\ (\\xa \\ nX. n \\ xa \\ (\\e c. d xa = Some (pair e c) \\ epdaH_conf_stack c \\ x1 # w))\n \\ (\\e2 c2. d (n+k) = Some (pair e2 c2) \\ (\\v2. epdaH_conf_stack c2 = v2 @ x1 # w))\"\n apply(induct k)\n apply(clarsimp)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e2 c2)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (n+k) = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac k e2 c2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"(Suc(n+k))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac k e2 c2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac k e2 c2)(*strict*)\n apply(force)\n apply(rename_tac k e2 c2)(*strict*)\n apply(force)\n apply(rename_tac k e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e2a=[x]\")\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2a\"\n and P=\"\\e2a. length (edge_pop e2a) = Suc 0\"\n in ballE)\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n prefer 2\n apply(simp add: epdaH_step_relation_def)\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n apply(case_tac \"edge_pop e2a\")\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac k c2 e1a e2a c1a v2 a list)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2 x)(*strict*)\n apply(simp add: valid_simple_dpda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2a\"\n in ballE)\n apply(rename_tac k c2 e1a e2a c1a v2 x)(*strict*)\n prefer 2\n apply(simp add: epdaH_step_relation_def)\n apply(rename_tac k c2 e1a e2a c1a v2 x)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(case_tac v1)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(erule impE)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply (rule epdaH.allPreMaxDomSome_prime)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_event e2a\")\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2 x a list)(*strict*)\n apply(case_tac v2)\n apply(rename_tac k c2 e1a e2a c1a v2 x a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(erule_tac\n x=\"(n+k)\"\n in allE)\n apply(erule impE)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply (metis epdaH.allPreMaxDomSome_prime epdaH.derivation_initial_is_derivation not_None_eq)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(erule impE)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(erule_tac\n x=\"e1a\"\n in allE)\n apply(erule_tac\n x=\"c1a\"\n in allE)\n apply(erule impE)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a a list)(*strict*)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a x a list lista)(*strict*)\n apply(case_tac c2)\n apply(rename_tac k c2 e1a e2a c1a x a list lista epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list xa)(*strict*)\n apply(rule_tac\n x=\"xa # v2\"\n in exI)\n apply(force)\n apply(rename_tac k c2 e1a e2a c1a v2 x wa a list aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"v2\"\n in exI)\n apply(force)\n done\n\nlemma existence_of_removal: \"\n valid_pda G\n \\ epdaH.derivation G d\n \\ epdaH.belongs G d\n \\ d n1 = Some (pair e1 c1)\n \\ d n2 = Some (pair e2 c2)\n \\ n1 \\ n2\n \\ epdaH_conf_stack c1 = w1 @ x # w2 @ w3\n \\ epdaH_conf_stack c2 = w3\n \\ \\n e c. d n = Some (pair e c) \\ n1 \\ n \\ n \\ n2 \\ epdaH_conf_stack c = x # w2 @ w3\"\n apply(case_tac \"n1=n2\")\n apply(clarsimp)\n apply(subgoal_tac \"\\k \\ (n2-n1). (\\i(\\n. (case (derivation_drop d n1) n of None \\ False| Some (pair e c) \\ SSP c)) i) & ((\\n. (case (derivation_drop d n1) n of None \\ False| Some (pair e c) \\ SSP c)))k\" for SSP)\n prefer 2\n apply(rule_tac\n P=\"\\c. \\(suffix (epdaH_conf_stack c) (x # w2@w3))\"\n in epdaH.existence_of_earliest_satisfaction_point)\n apply(rule_tac\n m=\"n2-n1\"\n in epdaH.derivation_drop_preserves_derivation_prime)\n apply(force)\n apply(force)\n apply(simp add: derivation_drop_def)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac k)(*strict*)\n apply(simp add: derivation_drop_def)\n apply(case_tac k)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(simp add: suffix_def)\n apply(rename_tac k nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d(Suc (nat+n1))\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac nat a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat option b)(*strict*)\n apply(simp add: suffix_def)\n apply(subgoal_tac \"\\k. Suc nat+k+n1=n2\")\n apply(rename_tac nat option b)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"n2-n1-Suc nat\"\n in exI)\n apply(force)\n apply(rename_tac nat option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat option b k)(*strict*)\n apply(subgoal_tac \"\\i case_option False (case_derivation_configuration (\\e c. \\ epdaH_conf_stack c \\ (x # w2 @ epdaH_conf_stack c2))) (d (i + n1))\")\n apply(rename_tac nat option b k)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac nat option b k i)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(case_tac i)\n apply(rename_tac nat option b k i)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat option b k i nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat option b k)(*strict*)\n apply(thin_tac \"\\i case_option False (case_derivation_configuration (\\e c. \\ epdaH_conf_stack c \\ (x # w2 @ epdaH_conf_stack c2))) (if i = 0 then case_option undefined (case_derivation_configuration (\\e c. Some (pair None c))) (d n1) else d (i + n1))\")\n apply(rename_tac nat option b k)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (nat+n1) = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaH_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac nat option b k)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc(nat+n1)\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac nat option b k)(*strict*)\n apply(force)\n apply(rename_tac nat option b k)(*strict*)\n apply(force)\n apply(rename_tac nat option b k)(*strict*)\n apply(force)\n apply(rename_tac nat option b k)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat b k e1a e2a c1a)(*strict*)\n apply(rule_tac\n x=\"nat+n1\"\n in exI)\n apply(clarsimp)\n apply(simp add: suffix_def)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e2a=[x] \")\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2a\"\n in ballE)\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n apply(case_tac \"edge_pop e2a\")\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n apply(force)\n apply(rename_tac nat b k e1a e2a c1a c w a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac nat b k e1a e2a c1a c w a list)(*strict*)\n apply(force)\n apply(rename_tac nat b k e1a e2a c1a c w a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat b k e1a e2a c1a c w)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat b k e1a e2a c1a c w xa)(*strict*)\n apply(case_tac c)\n apply(rename_tac nat b k e1a e2a c1a c w xa)(*strict*)\n apply(force)\n apply(rename_tac nat b k e1a e2a c1a c w xa a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma successor_min_stack_is_not_empty: \"\n valid_simple_dpda G\n \\ epdaH.derivation_initial G d\n \\ d (Suc n) = Some (pair (Some e2) c)\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e1 cn)\n \\ epdaH_step_relation G cn e2 c\n \\ edge_event e2 = None\n \\ edge_pop e2 = [x]\n \\ edge_push e2 = [xa, x]\n \\ Some q2 = min_stack d (tl (epdaH_conf_stack cn)) n nX\n \\ min_stack d (tl (epdaH_conf_stack c)) (Suc n) nX = None\n \\ P\"\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: min_stack_def)\n apply(case_tac \"\\x \\ nX. n \\ x \\ (\\e c. d x = Some (pair e c) \\ epdaH_conf_stack c \\ w)\")\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac xb e ca)(*strict*)\n apply(case_tac \"\\xa \\ nX. Suc n \\ xa \\ (\\e c. d xa = Some (pair e c) \\ epdaH_conf_stack c \\ x # epdaH_conf_stack ca)\")\n apply(rename_tac xb e ca)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac xb e ca)(*strict*)\n apply(clarsimp)\n apply(case_tac \"n=xb\")\n apply(rename_tac xb e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac xb e ca)(*strict*)\n apply(case_tac \"Suc n=xb\")\n apply(rename_tac xb e ca)(*strict*)\n apply(clarify)\n apply(case_tac c)\n apply(rename_tac xb e ca epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac cn)\n apply(rename_tac xb e ca epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(case_tac ca)\n apply(rename_tac xb e ca epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa epdaH_conf_stateb epdaH_conf_historyb epdaH_conf_stackb)(*strict*)\n apply(clarsimp)\n apply(rename_tac xb e ca)(*strict*)\n apply(subgoal_tac \"\\k e c. d k= Some (pair e c) \\ Suc n \\ k \\ k \\ xb \\ epdaH_conf_stack c=x # []@(epdaH_conf_stack ca)\")\n apply(rename_tac xb e ca)(*strict*)\n prefer 2\n apply(rule existence_of_removal)\n apply(rename_tac xb e ca)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac xb e ca)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(force)\n apply(rename_tac xb e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac xb e ca k ea caa)(*strict*)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n done\n\nlemma min_stack_is_in_states: \"\n valid_epda G\n \\ epdaH.derivation_initial G d\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e c)\n \\ min_stack d (tl (epdaH_conf_stack c)) n nX = Some qs\n \\ qs \\ epda_states G\"\n apply(simp add: min_stack_def)\n apply(case_tac \"\\x \\ nX. n \\ x \\ (\\e ca. d x = Some (pair e ca) \\ epdaH_conf_stack ca \\ tl (epdaH_conf_stack c))\")\n apply(clarsimp)\n apply(clarsimp)\n apply(rename_tac x ea ca)(*strict*)\n apply(subgoal_tac \"\\e cx. d (Min ({ i. (n \\ i \\ i \\ nX \\ (\\e cx. d i = Some (pair e cx) \\ epdaH_conf_stack cx = tl (epdaH_conf_stack c)))})) = Some (pair e cx)\")\n apply(rename_tac x ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"cx \\ epdaH_configurations G\")\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(force)\n apply(rename_tac x ea ca eaa cx)(*strict*)\n apply(force)\n apply(rename_tac x ea ca)(*strict*)\n apply(rule_tac\n m=\"x\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac x ea ca)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x ea ca)(*strict*)\n apply(force)\n apply(rename_tac x ea ca)(*strict*)\n apply(rule Min_le)\n apply(rename_tac x ea ca)(*strict*)\n apply(rule_tac\n B=\"{i. n \\ i \\ i \\ nX}\"\n in finite_subset)\n apply(rename_tac x ea ca)(*strict*)\n apply(force)\n apply(rename_tac x ea ca)(*strict*)\n apply (metis finite_Collect_conjI finite_Collect_le_nat)\n apply(rename_tac x ea ca)(*strict*)\n apply(clarsimp)\n done\n\nlemma min_stack_preserved1: \"\n valid_simple_dpda G\n \\ epdaH.derivation_initial G d\n \\ d (Suc n) = Some (pair e2 c2)\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e1 c1)\n \\ epdaH_conf_stack c1 \\ wb\n \\ epdaH_conf_stack c2 \\ wb\n \\ Some q2 = min_stack d wb n nX\n \\ min_stack d wb n nX = min_stack d wb (Suc n) nX\"\n apply(simp add: min_stack_def)\n apply(clarsimp)\n apply(rename_tac x e c)(*strict*)\n apply(case_tac \"\\x \\ nX. n \\ x \\ (\\e ca. d x = Some (pair e ca) \\ epdaH_conf_stack ca \\ epdaH_conf_stack c)\")\n apply(rename_tac x e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca)(*strict*)\n apply(case_tac \"x=n\")\n apply(rename_tac x e c xa ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac x e c xa ea ca)(*strict*)\n apply(rule_tac\n x=\"x\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca xb eb cb)(*strict*)\n apply(rule_tac\n f=\"\\x. epdaH_conf_state (the (get_configuration (d (Min x))))\"\n in HOL.arg_cong)\n apply(rename_tac x e c xa ea ca xb eb cb)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac x e c xa ea ca xb eb cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca xb eb cb xc ec cc)(*strict*)\n apply(case_tac \"xc=n\")\n apply(rename_tac x e c xa ea ca xb eb cb xc ec cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac x e c xa ea ca xb eb cb xc ec cc)(*strict*)\n apply(force)\n apply(rename_tac x e c xa ea ca xb eb cb)(*strict*)\n apply(clarsimp)\n done\n\nlemma min_stack_preserved2: \"\n valid_simple_dpda G\n \\ epdaH.derivation_initial G d\n \\ d (Suc n) = Some (pair e2 c2)\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e1 c1)\n \\ epdaH_conf_stack c1 \\ wb\n \\ epdaH_conf_stack c2 \\ wb\n \\ None = min_stack d wb n nX\n \\ min_stack d wb n nX = min_stack d wb (Suc n) nX\"\n apply(simp add: min_stack_def)\n apply(clarsimp)\n apply(rename_tac x e c)(*strict*)\n apply(case_tac \"\\x \\ nX. n \\ x \\ (\\e ca. d x = Some (pair e ca) \\ epdaH_conf_stack ca \\ epdaH_conf_stack c)\")\n apply(rename_tac x e c)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac x e c)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(force)\n done\n\nlemma min_stack_preserved: \"\n valid_simple_dpda G\n \\ epdaH.derivation_initial G d\n \\ d (Suc n) = Some (pair e2 c2)\n \\ maximum_of_domain d nX\n \\ d n = Some (pair e1 c1)\n \\ epdaH_conf_stack c1 \\ wb\n \\ epdaH_conf_stack c2 \\ wb\n \\ min_stack d wb n nX = min_stack d wb (Suc n) nX\"\n apply(case_tac \"min_stack d wb n nX\")\n apply(rule min_stack_preserved2)\n apply(force)+\n apply(rename_tac a)(*strict*)\n apply(rule min_stack_preserved1)\n apply(rename_tac a)(*strict*)\n apply(force)+\n done\n\nlemma valid_pda_edge_pop_single: \"\n valid_pda G\n \\ e \\ epda_delta G\n \\ \\x. edge_pop e = [x]\"\n apply(simp add: valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_pop e\")\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_unused_stack_modification_preserves_derivation2: \"\n valid_pda G\n \\ epdaS.derivation G d\n \\ epdaS.belongs G d\n \\ \\k \\ j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ aa # s)\n \\ epdaS.derivation G (derivation_map (derivation_take d j) (\\c. c\\epdaS_conf_stack := butn (epdaS_conf_stack c) (length s) @ s'\\))\"\n apply(simp (no_asm) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(clarsimp)\n apply (rule epdaS.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(subgoal_tac \"\\e c. d nat = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ aa # s)\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(subgoal_tac \"\\e c. d (Suc nat) = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ aa # s)\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n apply(simp add: butn_def)\n apply(subgoal_tac \"\\x. edge_pop e2 = [x]\")\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n prefer 2\n apply(rule valid_pda_edge_pop_single)\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa x)(*strict*)\n apply(case_tac wa)\n apply(rename_tac nat e1 e2 c1 c2 w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa x a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(erule_tac\n x=\"Suc nat\"\n in allE)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(force)\n done\n\nlemma F_SDPDA_TO_CFG_STD__minimal_stack_does_not_occur: \"\n valid_simple_dpda G\n \\ epdaS.derivation G d\n \\ d (Suc k) \\ None\n \\ i < Suc k\n \\ \\i < Suc k. epdaS_conf_stack (the (get_configuration (d (Suc i)))) \\ A # s\n \\ epdaS_conf_stack (the (get_configuration (d (Suc 0)))) = w @ B # A # s\n \\ \\w. epdaS_conf_stack (the (get_configuration (d (Suc i)))) = w @ B # A # s\"\n apply(induct i)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y)(*strict*)\n apply(erule_tac\n x=\"Suc i\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (Suc i) = Some (pair e1 c1) \\ d (Suc (Suc i)) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac i wa y)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc k\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac i wa y)(*strict*)\n apply(force)\n apply(rename_tac i wa y)(*strict*)\n apply(force)\n apply(rename_tac i wa y)(*strict*)\n apply(force)\n apply(rename_tac i wa y)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(simp add: valid_simple_dpda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e2=[x]\")\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n prefer 2\n apply(rename_tac i wa y e1 e2 c1 c2 waa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2 waa a x)(*strict*)\n apply(rule_tac\n x=\"wa\"\n in exI)\n apply(force)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2 waa x)(*strict*)\n apply(erule disjE)\n apply(rename_tac i wa y e1 e2 c1 c2 waa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2 x)(*strict*)\n apply(case_tac wa)\n apply(rename_tac i wa y e1 e2 c1 c2 x)(*strict*)\n apply(force)\n apply(rename_tac i wa y e1 e2 c1 c2 x a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i y e1 e2 c1 c2 x list)(*strict*)\n apply(rule_tac\n x=\"list\"\n in exI)\n apply(force)\n apply(rename_tac i wa y e1 e2 c1 c2 waa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i wa y e1 e2 c1 c2 waa x xa)(*strict*)\n apply(rule_tac\n x=\"xa # wa\"\n in exI)\n apply(force)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(rule_tac\n G=\"G\"\n in valid_pda_edge_pop_single)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(rename_tac i wa y e1 e2 c1 c2 waa)(*strict*)\n apply(force)\n done\n\nlemma epdaS_unused_stack_modification_preserves_derivation: \"\n valid_pda G\n \\ epdaS.derivation G d1\n \\ epdaS.belongs G d1\n \\ maximum_of_domain d1 (Suc j)\n \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # s\\)\n \\ \\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)\n \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\n \\ epdaS.derivation G (derivation_map d1 (\\c. c\\epdaS_conf_stack := butn (epdaS_conf_stack c) (length s) @ A # sa\\))\"\n apply(simp (no_asm) add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d1 (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(simp add: derivation_map_def)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1 nat = Some (pair e1 c1) \\ d1 (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: derivation_map_def)\n apply(subgoal_tac \"Suc nat \\ Suc j\")\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(\\e c. d1 nat = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s))\")\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule impE)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(erule exE)+\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(rule_tac\n t=\"butn (epdaS_conf_stack c1) (length s)\"\n and s=\"w @ [B]\"\n in ssubst)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(simp add: butn_def)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\w. epdaS_conf_stack c2 = w @ s\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa)(*strict*)\n apply(simp add: butn_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e2=[x]\")\n apply(rename_tac nat e1 e2 c1 c2 w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb x)(*strict*)\n apply(case_tac w)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb x)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb x a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb)(*strict*)\n apply(rule_tac\n G=\"G\"\n in valid_pda_edge_pop_single)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(rename_tac nat e1 e2 c1 c2 w wa wb)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(case_tac \"nat=j\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(erule_tac\n x=\"Suc nat\"\n in allE)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply (metis epdaS.allPreMaxDomSome_prime not_None_eq)\n done\n\nlemma epdaS_produce_from_before_pop_append: \"\n valid_pda G\n \\ \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\ \\ epda_delta G\n \\ x1 \\ epdaS_produce_from_before_pop G trg B qs\n \\ x2 \\ epdaS_produce_from_before_pop G qs A qt\n \\ x1 @ x2 \\ epdaS_produce_from_before_pop G src A qt\"\n apply(simp add: epdaS_produce_from_before_pop_def)\n apply(clarsimp)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(subgoal_tac \"\\d1. epdaS.derivation G d1 \\ epdaS.belongs G d1 \\ maximum_of_domain d1 (Suc j) \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # s\\) \\ d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\) \\ (\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)) \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\) \")\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_take d (Suc j)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule epdaS.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule epdaS.derivation_take_preserves_belongs)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event k eb c)(*strict*)\n apply(erule_tac\n x=\"k\"\n and P=\"\\x. x \\ j \\ (\\e c. d x = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s))\"\n in allE)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event k eb c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(subgoal_tac \"\\d2. epdaS.derivation G d2 \\ epdaS.belongs G d2 \\ maximum_of_domain d2 (Suc ja) \\ d2 0 = Some (pair None \\epdaS_conf_state = qs, epdaS_conf_scheduler = x2, epdaS_conf_stack = A # sa\\) \\ d2 ja = Some (pair ea \\epdaS_conf_state = qa, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\) \\ (\\k \\ ja. \\e c. d2 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa)) \\ d2 (Suc ja) = Some (pair e'event \\epdaS_conf_state = qt, epdaS_conf_scheduler = [], epdaS_conf_stack = sa\\) \")\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_take da (Suc ja)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule epdaS.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule epdaS.derivation_take_preserves_belongs)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(rule conjI)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event d1 k eb c)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da q s qa sa j ja e ea e' e'event)(*strict*)\n apply(thin_tac \"epdaS.derivation G d\")\n apply(thin_tac \"epdaS.derivation G da\")\n apply(thin_tac \"epdaS.belongs G d\")\n apply(thin_tac \"epdaS.belongs G da\")\n apply(thin_tac \"d 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # s\\)\")\n apply(thin_tac \"da 0 = Some (pair None \\epdaS_conf_state = qs, epdaS_conf_scheduler = x2, epdaS_conf_stack = A # sa\\)\")\n apply(thin_tac \"d j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\)\")\n apply(thin_tac \"da ja = Some (pair ea \\epdaS_conf_state = qa, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\)\")\n apply(thin_tac \"\\k \\ j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)\")\n apply(thin_tac \"d (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(thin_tac \"\\k \\ ja. \\e c. da k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa)\")\n apply(thin_tac \"da (Suc ja) = Some (pair e'event \\epdaS_conf_state = qt, epdaS_conf_scheduler = [], epdaS_conf_stack = sa\\)\")\n apply(clarsimp)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(subgoal_tac \"\\d1. epdaS.derivation G d1 \\ epdaS.belongs G d1 \\ maximum_of_domain d1 (Suc j) \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # A # sa\\) \\ d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # A # sa\\) \\ (\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # A # sa)) \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\) \")\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_map d1 (\\c. c\\epdaS_conf_stack := butn (epdaS_conf_stack c) (length s) @ (A # sa)\\)\"\n in exI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule epdaS_unused_stack_modification_preserves_derivation)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: derivation_map_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: butn_def)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # s\\ \\ epdaS_configurations G\")\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = qs, epdaS_conf_scheduler = x2, epdaS_conf_stack = A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaS.belongs_configurations)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule_tac\n d=\"d1\"\n in epdaS.belongs_configurations)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule derivation_map_preserves_maximum_of_domain)\n apply(force)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(rule conjI)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(clarsimp)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2 k eb c)(*strict*)\n apply(erule_tac\n x=\"k\"\n and P=\"\\x. x \\ j \\ (\\e c. d1 x = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s))\"\n in allE)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2 k eb c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_map_def butn_def)\n apply(case_tac \"d1 k\")\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2 k eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2 k eb c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2 k eb c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac q s qa sa j ja e ea e' e'event d1 d2)(*strict*)\n apply(thin_tac \"epdaS.derivation G d1\")\n apply(thin_tac \"epdaS.belongs G d1\")\n apply(thin_tac \"maximum_of_domain d1 (Suc j)\")\n apply(thin_tac \"d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # s\\)\")\n apply(thin_tac \"d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\)\")\n apply(thin_tac \"\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)\")\n apply(thin_tac \"d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n x=\"derivation_append (der2 \\epdaS_conf_state = src, epdaS_conf_scheduler = x1 @ x2, epdaS_conf_stack = A # sa\\ \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\ \\epdaS_conf_state = trg, epdaS_conf_scheduler = x1 @ x2, epdaS_conf_stack = B # A # sa\\) (derivation_append (derivation_map d1 (\\c. c\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\)) (epdaS_conf_scheduler c) @ x2\\)) d2 (Suc j)) (Suc 0)\"\n in exI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: option_to_list_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule epda_maximal_context_preserves_derivation_prime)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n ca=\"\\epdaS_conf_state = src, epdaS_conf_scheduler = x1 @ x2, epdaS_conf_stack = A # sa\\\"\n in epdaS.derivation_belongs)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = x1, epdaS_conf_stack = B # A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = qs, epdaS_conf_scheduler = x2, epdaS_conf_stack = A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: epdaS_configurations_def valid_epda_step_label_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaS.belongs_configurations)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n d=\"d1\"\n in epdaS.belongs_configurations)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: valid_pda_def valid_epda_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n x=\"qa\"\n in exI)\n apply(rule_tac\n x=\"sa\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n x=\"Suc j+ja+Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule_tac\n x=\"if ja=0 then e' else ea\"\n in exI)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 k eb c)(*strict*)\n apply(case_tac k)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 k eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 k eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(case_tac \"nat \\ j\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n and P=\"\\nat. nat \\ j \\ (\\e c. d1 nat = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # A # sa))\"\n in allE)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(case_tac nat)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nata)(*strict*)\n apply(case_tac \"d1 (Suc nata)\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nata a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nata a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(case_tac \"Suc nat=j\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(case_tac \"nat \\ Suc j\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat=Suc j\")\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat - Suc j\"\n and P=\"\\x. x \\ ja \\ (\\e c. d2 x = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa))\"\n in allE)\n apply(rename_tac q qa sa j ja e ea e' e'event d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n done\n\ndefinition epdaS_produce_and_eliminate_from :: \"\n ('state, 'event, 'stack) epda\n \\ 'state\n \\ 'stack\n \\ 'event list set\"\n where\n \"epdaS_produce_and_eliminate_from G qi A \\\n {w. \\d qf s.\n qf \\ epda_marking G\n \\ epdaS.derivation G d\n \\ epdaS.belongs G d\n \\ d 0 = Some (pair None\n \\epdaS_conf_state = qi,\n epdaS_conf_scheduler = w,\n epdaS_conf_stack = A # s\\)\n \\ (\\j e s'.\n d j = Some (pair e\n \\epdaS_conf_state = qf,\n epdaS_conf_scheduler = [],\n epdaS_conf_stack = s' @ A # s\\)\n \\ (\\k \\ j. \\e c.\n d k = Some (pair e c)\n \\ (\\w. epdaS_conf_stack c = w @ [A] @ s)))}\"\n\nlemma epdaS_produce_and_eliminate_from_Cons: \"\n valid_epda G\n \\ \\edge_src = src, edge_event = Some a, edge_pop = [y], edge_push = [y], edge_trg = trg\\ \\ epda_delta G\n \\ w \\ epdaS_produce_and_eliminate_from G trg y\n \\ a # w \\ epdaS_produce_and_eliminate_from G src y\"\n apply(simp add: epdaS_produce_and_eliminate_from_def)\n apply(clarsimp)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule_tac\n x=\"derivation_append (der2 \\epdaS_conf_state = src, epdaS_conf_scheduler = a # w, epdaS_conf_stack = y # s\\ \\edge_src = src, edge_event = Some a, edge_pop = [y], edge_push = [y], edge_trg = trg\\ \\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = y # s\\) d (Suc 0)\"\n in exI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule_tac\n x=\"qf\"\n in exI)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def option_to_list_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = y # s\\ \\ epdaS_configurations G\")\n apply(rename_tac d qf s j e s')(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G \\edge_src = src, edge_event = Some a, edge_pop = [y], edge_push = [y], edge_trg = trg\\\")\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: epdaS_configurations_def valid_epda_step_label_def option_to_set_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: valid_epda_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule_tac\n x=\"s\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule_tac\n x=\"Suc j\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(clarsimp)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' k ea c)(*strict*)\n apply(case_tac k)\n apply(rename_tac d qf s j e s' k ea c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' k ea c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' ea c nat)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac nat)\n apply(rename_tac d qf s j e s' ea c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' ea c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_produce_and_eliminate_from_Cons2: \"\n valid_pda G\n \\ \\edge_src = src, edge_event = None, edge_pop = [y], edge_push = [aa, y], edge_trg = trg\\ \\ epda_delta G\n \\ w \\ epdaS_produce_and_eliminate_from G trg aa\n \\ w \\ epdaS_produce_and_eliminate_from G src y\"\n apply(simp add: epdaS_produce_and_eliminate_from_def)\n apply(clarsimp)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(subgoal_tac \"\\d. epdaS.derivation G d \\ epdaS.belongs G d \\ maximum_of_domain d j \\ d 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = aa # y # s\\) \\ (\\k \\ j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ aa # y # s)) \\ d j = Some (pair e \\epdaS_conf_state = qf, epdaS_conf_scheduler = [], epdaS_conf_stack = s' @ aa # y # s\\) \")\n apply(rename_tac d qf s j e s')(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_map (derivation_take d j) (\\c. c\\epdaS_conf_stack := butn (epdaS_conf_stack c) (length s) @ y # s\\)\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS_unused_stack_modification_preserves_derivation2)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: butn_def)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = aa # s\\ \\ epdaS_configurations G\")\n apply(rename_tac d qf s j e s')(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G \\edge_src = src, edge_event = None, edge_pop = [y], edge_push = [aa, y], edge_trg = trg\\\")\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: valid_epda_step_label_def epdaS_configurations_def)\n apply(rule_tac\n w=\"[y]\"\n in may_terminated_by_decompose2)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: valid_pda_def valid_epda_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule derivation_map_preserves_maximum_of_domain)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(simp add: butn_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' k ea c)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n apply(case_tac \"d k\")\n apply(rename_tac d qf s j e s' k ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' k ea c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d qf s j e s' k ea c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d qf s j e s' k ea b wa)(*strict*)\n apply(simp add: butn_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(simp add: butn_def)\n apply(rename_tac d qf s j e s')(*strict*)\n apply(thin_tac \"epdaS.derivation G d\")\n apply(thin_tac \"epdaS.belongs G d\")\n apply(thin_tac \"d 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = aa # s\\)\")\n apply(thin_tac \"\\k \\ j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ aa # s)\")\n apply(thin_tac \"d j = Some (pair e \\epdaS_conf_state = qf, epdaS_conf_scheduler = [], epdaS_conf_stack = s' @ aa # s\\)\")\n apply(clarsimp)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule_tac\n x=\"derivation_append (der2 \\epdaS_conf_state = src, epdaS_conf_scheduler = w, epdaS_conf_stack = y # s\\ \\edge_src = src, edge_event = None, edge_pop = [y], edge_push = [aa, y], edge_trg = trg\\ \\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = aa # y # s\\) d (Suc 0)\"\n in exI)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule_tac\n x=\"qf\"\n in exI)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def option_to_list_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(force)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule conjI)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = w, epdaS_conf_stack = aa # y # s\\ \\ epdaS_configurations G\")\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G \\edge_src = src, edge_event = None, edge_pop = [y], edge_push = [aa, y], edge_trg = trg\\\")\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: valid_epda_step_label_def epdaS_configurations_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: valid_pda_def valid_epda_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(force)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(force)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(force)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule_tac\n x=\"s\"\n in exI)\n apply(rule conjI)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(rule_tac\n x=\"Suc j\"\n in exI)\n apply(rule conjI)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(clarsimp)\n apply(rename_tac qf s j e s' d)(*strict*)\n apply(clarsimp)\n apply(rename_tac qf s j e s' d k ea c)(*strict*)\n apply(case_tac k)\n apply(rename_tac qf s j e s' d k ea c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(clarsimp)\n apply(rename_tac qf s j e s' d k ea c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac qf s j e s' d ea c nat)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac nat)\n apply(rename_tac qf s j e s' d ea c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac qf s j e s' d ea c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_produce_and_eliminate_from_epdaS_produce_from_before_pop_append: \"\n valid_simple_dpda G\n \\ \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\ \\ epda_delta G\n \\ r' \\ epdaS_produce_and_eliminate_from G qs A\n \\ l' \\ epdaS_produce_from_before_pop G trg B qs\n \\ l' @ r' \\ epdaS_produce_and_eliminate_from G src A\"\n apply(simp add: epdaS_produce_and_eliminate_from_def epdaS_produce_from_before_pop_def)\n apply(clarsimp)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(subgoal_tac \"\\d1. epdaS.derivation G d1 \\ epdaS.belongs G d1 \\ maximum_of_domain d1 (Suc j) \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # s\\) \\ d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\) \\ (\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)) \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\) \")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_take da (Suc j)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule epdaS.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule epdaS.derivation_take_preserves_belongs)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(clarsimp)\n apply(rename_tac d da qf q s j sa e ja e' ea s' k eb c)(*strict*)\n apply(erule_tac\n x=\"k\"\n and P=\"\\k. k \\ j \\ (\\e c. da k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s))\"\n in allE)\n apply(rename_tac d da qf q s j sa e ja e' ea s' k eb c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \"epdaS.belongs G da\")\n apply(thin_tac \" da 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # s\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \" da j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \" \\k \\ j. \\e c. da k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)\")\n apply(thin_tac \" da (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(subgoal_tac \"\\d2. epdaS.derivation G d2 \\ epdaS.belongs G d2 \\ maximum_of_domain d2 ja \\ d2 0 = Some (pair None \\epdaS_conf_state = qs, epdaS_conf_scheduler = r', epdaS_conf_stack = A # sa\\) \\ d2 ja = Some (pair ea \\epdaS_conf_state = qf, epdaS_conf_scheduler = [], epdaS_conf_stack = s' @A # sa\\) \\ (\\k \\ ja. \\e c. d2 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa)) \")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n prefer 2\n apply(rule_tac\n x=\"derivation_take d ja\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule epdaS.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule epdaS.derivation_take_preserves_belongs)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(rule conjI)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(clarsimp)\n apply(rename_tac d da qf q s j sa e ja e' ea s' d1 k eb c)(*strict*)\n apply(erule_tac\n x=\"k\"\n and P=\"\\k. k \\ ja \\ (\\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa))\"\n in allE)\n apply(rename_tac d da qf q s j sa e ja e' ea s' d1 k eb c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \"epdaS.derivation G d\")\n apply(thin_tac \" epdaS.belongs G d\")\n apply(thin_tac \" d 0 = Some (pair None \\epdaS_conf_state = qs, epdaS_conf_scheduler = r', epdaS_conf_stack = A # sa\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \" \\k \\ ja. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa)\")\n apply(thin_tac \" d ja = Some (pair ea \\epdaS_conf_state = qf, epdaS_conf_scheduler = [], epdaS_conf_stack = s' @ A # sa\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(subgoal_tac \"\\d1. epdaS.derivation G d1 \\ epdaS.belongs G d1 \\ maximum_of_domain d1 (Suc j) \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # A # sa\\) \\ d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # A # sa\\) \\ (\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # A # sa)) \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\) \")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n prefer 2\n apply(subgoal_tac \"\\epdaS_conf_state = qs, epdaS_conf_scheduler = r', epdaS_conf_stack = A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac da qf q s j sa e ja e' ea s' d1 d2)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaS.belongs_configurations)\n apply(rename_tac da qf q s j sa e ja e' ea s' d1 d2)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e ja e' ea s' d1 d2)(*strict*)\n apply(force)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \"\\d2. epdaS.derivation G d2 \\ epdaS.belongs G d2 \\ maximum_of_domain d2 ja \\ d2 0 = Some (pair None \\epdaS_conf_state = qs, epdaS_conf_scheduler = r', epdaS_conf_stack = A # sa\\) \\ d2 ja = Some (pair ea \\epdaS_conf_state = qf, epdaS_conf_scheduler = [], epdaS_conf_stack = s' @ A # sa\\) \\ (\\k \\ ja. \\e c. d2 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa))\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule_tac\n x=\"derivation_map d1 (\\c. c\\epdaS_conf_stack := butn (epdaS_conf_stack c) (length s) @ (A # sa)\\)\"\n in exI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule epdaS_unused_stack_modification_preserves_derivation)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: derivation_map_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: butn_def)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # s\\ \\ epdaS_configurations G\")\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule_tac\n d=\"d1\"\n in epdaS.belongs_configurations)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule derivation_map_preserves_maximum_of_domain)\n apply(force)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q s j sa e e' d1 k ea c)(*strict*)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n apply(simp add: derivation_map_def butn_def)\n apply(case_tac \"d1 k\")\n apply(rename_tac da qf q s j sa e e' d1 k ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q s j sa e e' d1 k ea c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac da qf q s j sa e e' d1 k ea c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q s j sa e e' d1)(*strict*)\n apply(simp add: derivation_map_def butn_def)\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(thin_tac \"\\d1. epdaS.derivation G d1 \\ epdaS.belongs G d1 \\ maximum_of_domain d1 (Suc j) \\ d1 0 = Some (pair None \\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # s\\) \\ d1 j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = B # s\\) \\ (\\k \\ j. \\e c. d1 k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # s)) \\ d1 (Suc j) = Some (pair e' \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(rename_tac d da qf q s j sa e ja e' ea s')(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n x=\"derivation_append (der2 \\epdaS_conf_state = src, epdaS_conf_scheduler = l'@r', epdaS_conf_stack = A # sa\\ \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\ \\epdaS_conf_state = trg, epdaS_conf_scheduler = l'@r', epdaS_conf_stack = B # A # sa\\) (derivation_append (derivation_map d1 (\\c. c\\epdaS_conf_scheduler := take (length (epdaS_conf_scheduler c) - length (epdaS_conf_scheduler \\epdaS_conf_state = qs, epdaS_conf_scheduler = [], epdaS_conf_stack = A # sa\\)) (epdaS_conf_scheduler c) @ r'\\)) d2 (Suc j)) (Suc 0)\"\n in exI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n x=\"qf\"\n in exI)\n apply(rule conjI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: option_to_list_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule epda_maximal_context_preserves_derivation_prime)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: derivation_map_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule conjI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n ca=\"\\epdaS_conf_state = src, epdaS_conf_scheduler = l'@r', epdaS_conf_stack = A # sa\\\"\n in epdaS.derivation_belongs)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G \\edge_src = src, edge_event = None, edge_pop = [A], edge_push = [B, A], edge_trg = trg\\\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = trg, epdaS_conf_scheduler = l', epdaS_conf_stack = B # A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(subgoal_tac \"\\epdaS_conf_state = qs, epdaS_conf_scheduler = r', epdaS_conf_stack = A # sa\\ \\ epdaS_configurations G\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: epdaS_configurations_def valid_epda_step_label_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaS.belongs_configurations)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n d=\"d1\"\n in epdaS.belongs_configurations)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n x=\"sa\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n x=\"Suc j+ja+Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(rule_tac\n x=\"if ja=0 then e' else ea\"\n in exI)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 k eb c)(*strict*)\n apply(case_tac k)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 k eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c)(*strict*)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 k eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(case_tac \"nat \\ j\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n and P=\"\\nat. nat \\ j \\ (\\e c. d1 nat = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ B # A # sa))\"\n in allE)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(case_tac nat)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nata)(*strict*)\n apply(case_tac \"d1 (Suc nata)\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nata a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nata a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(case_tac \"Suc nat=j\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def derivation_append_def derivation_map_def)\n apply(case_tac \"nat \\ Suc j\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat=Suc j\")\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat - Suc j\"\n and P=\"\\x. x \\ ja \\ (\\e c. d2 x = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ A # sa))\"\n in allE)\n apply(rename_tac da qf q j sa e ja e' ea s' d2 d1 eb c nat)(*strict*)\n apply(clarsimp)\n done\n\ntheorem epda_sub_preserves_epdaH_marked_language: \"\n valid_epda G\n \\ valid_epda G'\n \\ epda_sub G' G\n \\ epdaH.marked_language G' \\ epdaH.marked_language G\"\n apply(simp add: epdaH.marked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac x=\"d\" in exI)\n apply(rule context_conjI)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac epda_sub_preserves_derivation_initial)\n apply(rename_tac x d)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaH_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(rule_tac x=\"i\" in exI)\n apply(rule_tac x=\"e\" in exI)\n apply(rule_tac x=\"c\" in exI)\n apply(clarsimp)\n apply(simp add: epdaH_marking_configurations_def epdaH_configurations_def epda_sub_def)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac x d a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d conf)(*strict*)\n apply(simp add: epdaH_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac x d conf i e c)(*strict*)\n apply(rule_tac x=\"i\" in exI)\n apply(rule_tac x=\"e\" in exI)\n apply(rule_tac x=\"c\" in exI)\n apply(clarsimp)\n apply(simp add: epdaH_marking_configurations_def epdaH_configurations_def epda_sub_def)\n apply(force)\n done\n\ntheorem epda_sub_preserves_epdaH_unmarked_language: \"\n valid_epda G\n \\ valid_epda G'\n \\ epda_sub G' G\n \\ epdaH.unmarked_language G' \\ epdaH.unmarked_language G\"\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac x=\"d\" in exI)\n apply(rule context_conjI)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac epda_sub_preserves_derivation_initial)\n apply(rename_tac x d)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(force)\n apply(rename_tac x d)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaH_unmarked_effect_def)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n done\n\ndefinition epdaH_accessible_states :: \"\n ('state, 'event, 'stack) epda\n \\ 'state set\"\n where\n \"epdaH_accessible_states G \\\n {epdaH_conf_state c | d n e c.\n epdaH.derivation_initial G d\n \\ d n = Some (pair e c)}\"\n\nlemma epda_initial_in_epdaH_accessible_states: \"\n valid_epda G\n \\ epda_initial G \\ epdaH_accessible_states G\"\n apply(simp add: epdaH_accessible_states_def)\n apply(rule_tac x=\"der1 \\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\\" in exI)\n apply(rule_tac x=\"0\" in exI)\n apply(rule_tac x=\"None\" in exI)\n apply(rule_tac x=\"\\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\\" in exI)\n apply(rule conjI)\n apply(force)\n apply(rule conjI)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rule conjI)\n apply(rule epdaH.der1_is_derivation)\n apply(simp add: der1_def epdaH_initial_configurations_def epdaH_configurations_def valid_epda_def)\n apply(simp add: der1_def epdaH_initial_configurations_def epdaH_configurations_def valid_epda_def)\n done\n\nlemma epdaS_step_relation_injective_on_edge: \"\n valid_pda G\n \\ epdaS_step_relation G c e1 c'\n \\ epdaS_step_relation G c e2 c'\n \\ e1 = e2\"\n apply(subgoal_tac \"\\x. edge_pop e1 = [x]\")\n prefer 2\n apply(simp add: valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply (metis insert_Nil last_triv)\n apply(subgoal_tac \"\\x. edge_pop e2 = [x]\")\n prefer 2\n apply(simp add: valid_pda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac x)(*strict*)\n apply (metis insert_Nil last_triv)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x w)(*strict*)\n apply(case_tac e1)\n apply(rename_tac x w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac e2)\n apply(rename_tac x w edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x w edge_event edge_push edge_eventa)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac \"edge_event\")\n apply(rename_tac x w edge_event edge_push edge_eventa)(*strict*)\n apply(case_tac \"edge_eventa\")\n apply(rename_tac x w edge_event edge_push edge_eventa)(*strict*)\n apply(force)\n apply(rename_tac x w edge_event edge_push edge_eventa a)(*strict*)\n apply(force)\n apply(rename_tac x w edge_event edge_push edge_eventa a)(*strict*)\n apply(case_tac \"edge_eventa\")\n apply(rename_tac x w edge_event edge_push edge_eventa a)(*strict*)\n apply(force)\n apply(rename_tac x w edge_event edge_push edge_eventa a aa)(*strict*)\n apply(force)\n done\n\nlemma epda_edge_event_in_effects: \"\n valid_epda G\n \\ e \\ epda_delta G\n \\ option_to_list (edge_event e) \\ epda_effects G\"\n apply(simp add: valid_epda_def valid_epda_step_label_def option_to_list_def option_to_set_def epda_effects_def)\n done\n\nlemma apply_epdaS_is_forward_edge_deterministic_accessible_with_compatible_post_configurations: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ epdaH_step_relation G c e1 c1\n \\ epdaH_step_relation G c e2 c2\n \\ epdaH_conf_history c1@v1=epdaH_conf_history c2@v2\n \\ e1=e2\"\n apply(subgoal_tac \"epdaH.is_forward_edge_deterministicHist_DB_long SSG\" for SSG)\n prefer 2\n apply(rule I_epda_HS_H.epdaHS2HF_DEdetermR_FEdetermHist_DB)\n apply(force)\n apply(subgoal_tac \"epdaHS.is_forward_deterministic_accessible G\")\n apply(simp add: epdaHS.is_forward_deterministic_accessible_def)\n apply(rule epdaS_vs_epdaHS_is_forward_deterministic_accessible_preserved)\n apply(force)\n apply(simp add: epdaS.is_forward_deterministic_accessible_def)\n apply (metis epda_is_is_forward_target_deterministic_accessible)\n apply(simp add: epdaH.is_forward_edge_deterministicHist_DB_long_def)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(erule impE)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"e2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"option_to_list (edge_event e1)\"\n in allE)\n apply(erule impE)\n apply(rule epda_edge_event_in_effects)\n apply(force)\n apply(simp add: epdaH_step_relation_def)\n apply(erule_tac\n x=\"option_to_list (edge_event e2)\"\n in allE)\n apply(erule impE)\n apply(simp add: epdaH_step_relation_def)\n apply(erule impE)\n apply(simp add: epdaH_step_relation_def)\n apply(erule impE)\n apply(rule epda_edge_event_in_effects)\n apply(force)\n apply(simp add: epdaH_step_relation_def)\n apply(simp add: epdaH_step_relation_def)\n apply(simp add: epdaH.history_fragment_prefixes_def)\n apply(clarsimp)\n apply(rename_tac x xa w wa hf'' hf''a)(*strict*)\n apply(simp add: option_to_list_def epda_effects_def)\n apply(case_tac \"edge_event e1\")\n apply(rename_tac x xa w wa hf'' hf''a)(*strict*)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac x xa w wa hf'' hf''a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa w wa hf'' hf''a a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa w wa hf'' hf''a a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac x xa w wa hf'' hf''a a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x w wa hf'' a)(*strict*)\n apply(case_tac x)\n apply(rename_tac x w wa hf'' a)(*strict*)\n apply(clarsimp)\n apply(rename_tac x w wa hf'' a aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa w wa hf'' hf''a a aa)(*strict*)\n apply(clarsimp)\n done\n\nlemma EDPDA_derivations_coincide: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ d2 (n1 + n) = Some (pair e2 c2)\n \\ epdaH_conf_history c1 = epdaH_conf_history c2\n \\ i\\n1\n \\ d1 i = d2 i\"\n apply(induct i)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(case_tac \"d1 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d2 0\")\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(rename_tac a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa b)(*strict*)\n apply(case_tac aa)\n apply(rename_tac aa b option ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac b ba)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\ d1 (Suc i) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n1\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac i)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d2 i = Some (pair e1 c1) \\ d2 (Suc i) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\")\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n1+n\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(subgoal_tac \"e2a=e2aa\")\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e1a c1a c2a e2a c2aa)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history c1 = epdaH_conf_history c2a @ h\")\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"Suc i\"\n and m=\"n1-Suc i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(rule_tac\n d=\"d1\"\n in epdaH.belongs_configurations)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history c2 = epdaH_conf_history c2aa @ h\")\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"Suc i\"\n and m=\"n1+n-Suc i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa)(*strict*)\n apply(simp add: epda_effects_def)\n apply(clarsimp)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(subgoal_tac \"e2a=e2aa\")\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n prefer 2\n apply(rule_tac\n ?v2.0=\"ha\"\n and ?v1.0=\"h\"\n and d=\"d1\"\n and n=\"i\"\n in apply_epdaS_is_forward_edge_deterministic_accessible_with_compatible_post_configurations)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n apply(rename_tac i e1a e2a c1a c2a e2aa c2aa h ha)(*strict*)\n apply(force)\n done\n\nlemma SDPDA_derivations_coincide2: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ d1 (Suc n1) = Some (pair e1' c1')\n \\ d2 n2 = Some (pair e2 c2)\n \\ d2 (Suc n2) = Some (pair e2' c2')\n \\ epdaH_conf_history c1=epdaH_conf_history c2\n \\ epdaH_conf_history c1'=epdaH_conf_history c2'\n \\ epdaH_conf_history c1'=epdaH_conf_history c1@[a]\n \\ n1\\n2\n \\ n1=n2 \\ (\\i\\n1. d1 i = d2 i)\"\n apply(clarsimp)\n apply(subgoal_tac \"\\n. n1+n=n2\")\n prefer 2\n apply(rule_tac\n x=\"n2-n1\"\n in exI)\n apply(force)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"(\\i\\n1. d1 i = d2 i)\")\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"n1\"\n in allE)\n apply(clarsimp)\n apply(case_tac n)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1 n1 = Some (pair e1 c1) \\ d1 (Suc n1) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\")\n apply(rename_tac nat)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n1\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac nat)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d2 n1 = Some (pair e1 c1) \\ d2 (Suc n1) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\")\n apply(rename_tac nat e2a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc (n1+nat)\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac nat e2a)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac nat e2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history c2 = epdaH_conf_history c2a @ h\")\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"Suc n1\"\n and m=\"nat\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in epdaH.belongs_configurations)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac nat e2a e2aa c2a)(*strict*)\n apply(simp add: epda_effects_def)\n apply(clarsimp)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(subgoal_tac \"e2a=e2aa\")\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n prefer 2\n apply(rule_tac\n ?v2.0=\"h@[a]\"\n and ?v1.0=\"[]\"\n and d=\"d1\"\n and n=\"n1\"\n in apply_epdaS_is_forward_edge_deterministic_accessible_with_compatible_post_configurations)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(rule_tac\n t=\"epdaH_conf_history c1'\"\n and s=\"epdaH_conf_history c2'\"\n in ssubst)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(rule_tac\n t=\"epdaH_conf_history c2'\"\n and s=\"epdaH_conf_history c2a @ h @ [a]\"\n in ssubst)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(force)\n apply(rename_tac nat e2a e2aa c2a h)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2a c2a h)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n i)(*strict*)\n apply(rule EDPDA_derivations_coincide)\n apply(rename_tac n i)(*strict*)\n apply(force)+\n done\n\nlemma SDPDA_derivations_coincide3: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ d1 (Suc n1) = Some (pair e1' c1')\n \\ d2 n2 = Some (pair e2 c2)\n \\ d2 (Suc n2) = Some (pair e2' c2')\n \\ epdaH_conf_history c1=epdaH_conf_history c2\n \\ epdaH_conf_history c1'=epdaH_conf_history c2'\n \\ epdaH_conf_history c1'=epdaH_conf_history c1@[a]\n \\ n1=n2 \\ (\\i\\n1. d1 i = d2 i)\"\n apply(case_tac \"n1\\n2\")\n apply(rule_tac\n a=\"a\"\n in SDPDA_derivations_coincide2)\n apply(force)+\n apply(subgoal_tac \"n2 = n1 \\ (\\i\\n2. d2 i = d1 i)\")\n apply(force)\n apply(rule_tac\n a=\"a\"\n in SDPDA_derivations_coincide2)\n apply(force)+\n done\n\ndefinition duplicate_markingH :: \"('q,'a,'b)epda \\ bool\" where\n \"duplicate_markingH G \\ (\\d. epdaH.derivation_initial G d \\ (\\i j.\n d (i+j+Suc 0) \\ None\n \\ epdaH_conf_state (the(get_configuration (d i))) \\ epda_marking G\n \\ epdaH_conf_state (the(get_configuration (d (i+j+Suc 0)))) \\ epda_marking G\n \\ epdaH_conf_history (the(get_configuration (d i))) = epdaH_conf_history (the(get_configuration (d (i+j+Suc 0))))\n ))\"\n\nlemma EDPDA_derivations_coincide4: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ \\ duplicate_markingH G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ c1 \\ epdaH_marking_configurations G\n \\ d2 n2 = Some (pair e2 c2)\n \\ c2 \\ epdaH_marking_configurations G\n \\ epdaH_conf_history c1=epdaH_conf_history c2\n \\ n1\\n2\n \\ n1=n2 \\ (\\i\\n1. d1 i = d2 i)\"\n apply(subgoal_tac \"\\n. n1+n=n2\")\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"(\\i\\n1. d1 i = d2 i)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac n i)(*strict*)\n apply(rule EDPDA_derivations_coincide)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n i)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"n1\"\n in allE)\n apply(clarsimp)\n apply(simp add: duplicate_markingH_def)\n apply(erule_tac\n x=\"d2\"\n in allE)\n apply(clarsimp)\n apply(case_tac n)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n nat)(*strict*)\n apply(erule_tac\n x=\"n1\"\n in allE)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaH_marking_configurations_def)\n apply(rule_tac\n x=\"n2-n1\"\n in exI)\n apply(force)\n done\n\nlemma EDPDA_derivations_coincide5: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ \\ duplicate_markingH G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ c1 \\ epdaH_marking_configurations G\n \\ d2 n2 = Some (pair e2 c2)\n \\ c2 \\ epdaH_marking_configurations G\n \\ epdaH_conf_history c1=epdaH_conf_history c2\n \\ n1=n2 \\ (\\i\\n1. d1 i = d2 i)\"\n apply(case_tac \"n1\\n2\")\n apply(rule EDPDA_derivations_coincide4)\n apply(force)+\n apply(subgoal_tac \"n2 = n1 \\ (\\i\\n2. d2 i = d1 i)\")\n apply(force)\n apply(rule EDPDA_derivations_coincide4)\n apply(force)+\n done\n\nlemma epdaS_apply_is_forward_edge_deterministic_accessible: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ c \\ epdaS.get_accessible_configurations G\n \\ x \\ epda_delta G\n \\ y \\ epda_delta G\n \\ edge_src x=edge_src y\n \\ edge_src x=epdaS_conf_state c\n \\ prefix (edge_pop x) (epdaS_conf_stack c)\n \\ prefix (edge_pop y) (epdaS_conf_stack c)\n \\ prefix (option_to_list(edge_event x)) (epdaS_conf_scheduler c)\n \\ prefix (option_to_list(edge_event y)) (epdaS_conf_scheduler c)\n \\ x=y\"\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(erule_tac\n x=\"c\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"\\epdaS_conf_state=edge_trg x,epdaS_conf_scheduler=drop(length(option_to_list (edge_event x)))(epdaS_conf_scheduler c),epdaS_conf_stack=(edge_push x)@(drop(length(edge_pop x))(epdaS_conf_stack c))\\\"\n in allE)\n apply(erule_tac\n x=\"\\epdaS_conf_state=edge_trg y,epdaS_conf_scheduler=drop(length(option_to_list (edge_event y)))(epdaS_conf_scheduler c),epdaS_conf_stack=(edge_push y)@(drop(length(edge_pop y))(epdaS_conf_stack c))\\\"\n in allE)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"y\"\n in allE)\n apply(erule impE)\n prefer 2\n apply(force)\n apply(simp add: epdaS_step_relation_def)\n apply(case_tac c)\n apply(rename_tac epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c ca cb cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac c ca cb cc)(*strict*)\n apply (metis List.drop_append dropPrecise)\n apply(rename_tac c ca cb cc)(*strict*)\n apply (metis List.drop_append dropPrecise)\n done\n\nlemma valid_simple_dpda_edge_alt: \"\n valid_simple_dpda G\n \\ x \\ epda_delta G\n \\ (\\s1 s2. edge_pop x=[s1] \\\n ((edge_event x \\ None \\ edge_push x=[s1])\n \\ (edge_event x = None \\ edge_push x=[s2,s1])\n \\ (edge_event x = None \\ edge_push x=[])))\"\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. length (edge_pop x) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_event x\")\n apply(clarsimp)\n apply(case_tac \"edge_pop x\")\n apply(clarsimp)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_push x\")\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(rename_tac a aa list)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_apply_is_forward_edge_deterministic_accessibleE_with_ReachableEdge: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ x \\ epdaS_accessible_edges G\n \\ y \\ epda_delta G\n \\ edge_src x=edge_src y\n \\ edge_pop x = edge_pop y\n \\ prefix (option_to_list (edge_event y)) (option_to_list (edge_event x))\n \\ x=y\"\n apply(simp add: epdaS_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac d n c)(*strict*)\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(case_tac n)\n apply(rename_tac d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(rename_tac d n c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c nat)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac d c nat)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac d c nat)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d c nat)(*strict*)\n apply(force)\n apply(rename_tac d c nat)(*strict*)\n apply(force)\n apply(rename_tac d c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c nat e1 c1)(*strict*)\n apply(erule_tac\n x=\"c1\"\n in ballE)\n apply(rename_tac d c nat e1 c1)(*strict*)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(subgoal_tac \"\\c. epdaS_step_relation G c1 y c\")\n apply(rename_tac d c nat e1 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c nat e1 c1)(*strict*)\n prefer 2\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(simp add: get_configuration_def)\n apply(rename_tac d c nat e1 c1)(*strict*)\n apply(rule_tac\n x=\"\\epdaS_conf_state=edge_trg y,epdaS_conf_scheduler=drop(length(option_to_list (edge_event y)))(epdaS_conf_scheduler c1),epdaS_conf_stack=(edge_push y)@(drop(length(edge_pop y))(epdaS_conf_stack c1))\\\"\n in exI)\n apply(simp add: epdaS_step_relation_def prefix_def)\n apply(clarsimp)\n apply(rename_tac d c nat e1 c1 ca w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac \"edge_event x\")\n apply(rename_tac d c nat e1 c1 ca w)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c nat e1 c1 ca w a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_event y\")\n apply(rename_tac d c nat e1 c1 ca w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c nat e1 c1 ca w a aa)(*strict*)\n apply(clarsimp)\n done\n\ndefinition duplicate_marking :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"duplicate_marking G \\\n \\d. epdaS.derivation_initial G d\n \\ (\\i j. d (i + j + Suc 0) \\ None\n \\ epdaS_conf_state (the (get_configuration (d i))) \\ epda_marking G\n \\ epdaS_conf_state (the (get_configuration (d (i + j + Suc 0))))\n \\ epda_marking G\n \\ epdaS_conf_scheduler (the (get_configuration (d i)))\n = epdaS_conf_scheduler (the (get_configuration (d (i + j + Suc 0)))))\"\n\ndefinition duplicate_marking_ALT :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"duplicate_marking_ALT G \\\n \\d i j.\n epdaS.derivation_initial G d\n \\ d (i + j + Suc 0) \\ None\n \\ epdaS_conf_state (the (get_configuration (d i)))\n \\ epda_marking G\n \\ epdaS_conf_state (the (get_configuration (d (i + j + Suc 0))))\n \\ epda_marking G\n \\ epdaS_conf_scheduler (the (get_configuration (d i)))\n = epdaS_conf_scheduler (the (get_configuration (d (i + j + Suc 0))))\"\n\nlemma duplicate_marking_ALT_vs_duplicate_marking: \"\n duplicate_marking_ALT G = duplicate_marking G\"\n apply(simp add: duplicate_marking_ALT_def duplicate_marking_def)\n done\n\nlemma duplicate_marking_to_duplicate_markingH: \"\n valid_epda G\n \\ \\ duplicate_marking G\n \\ \\ duplicate_markingH G\"\n apply(simp add: duplicate_marking_def duplicate_markingH_def)\n apply(clarsimp)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in epdaH_vs_epdaHS.Bra2LinDer_preserves_derivation)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in epdaH_vs_epdaHS.Bra2LinDer_preserves_belongs)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"epdaS.derivation_initial G (epdaHS2epdaS_derivation (epdaH_vs_epdaHS.Bra2LinDer G d (Suc (i + j))))\")\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaHS.derivation_initialI)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j y c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"c \\ epdaHS_configurations G\")\n apply(rename_tac d i j y c)(*strict*)\n prefer 2\n apply(rule epdaHS.belongs_configurations)\n apply(rename_tac d i j y c)(*strict*)\n apply(force)\n apply(rename_tac d i j y c)(*strict*)\n apply(force)\n apply(rename_tac d i j y c)(*strict*)\n apply(simp add: epdaH_vs_epdaHS.Bra2LinDer_def)\n apply(case_tac y)\n apply(rename_tac d i j y c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j c option b)(*strict*)\n apply(case_tac \"d 0\")\n apply(rename_tac d i j c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j c option b a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i j c option b a optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j option b ba)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def)\n apply(simp add: epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(simp add: epdaHS_initial_configurations_def)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(simp add: epdaH_initial_configurations_def)\n apply(rename_tac d i j y)(*strict*)\n apply(erule_tac\n x=\"(epdaHS2epdaS_derivation (epdaH_vs_epdaHS.Bra2LinDer G d (Suc (i + j))))\"\n in allE)\n apply(rename_tac d i j y)(*strict*)\n apply(erule impE)\n apply(rename_tac d i j y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j y)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule_tac\n x=\"j\"\n in allE)\n apply(erule impE)\n apply(rename_tac d i j y)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(case_tac y)\n apply(rename_tac d i j y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j option b)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def get_configuration_def)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"\\e c. d i = Some (pair e c)\")\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc (i+j)\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j y e c)(*strict*)\n apply(erule impE)\n apply(rename_tac d i j y e c)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(case_tac y)\n apply(rename_tac d i j y e c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c option b)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def get_configuration_def)\n apply(rename_tac d i j y e c)(*strict*)\n apply(erule disjE)\n apply(rename_tac d i j y e c)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(case_tac y)\n apply(rename_tac d i j y e c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j y e c)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(case_tac y)\n apply(rename_tac d i j y e c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c option b)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinConf_def epdaH_vs_epdaHS.Bra2LinDer_def get_configuration_def epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer'_def get_configuration_def)\n apply(subgoal_tac \"nat_seq (Suc (i + j)) (i + j)=[]\")\n apply(rename_tac d i j e c option b)(*strict*)\n prefer 2\n apply (metis lessI nat_seqEmpty)\n apply(rename_tac d i j e c option b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"foldl (@) [] (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ epdaHvHS_Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq i (i + j)))=[]\")\n apply(rename_tac d i j e c option b)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b)(*strict*)\n apply(rule foldl_empty)\n apply(rename_tac d i j e c option b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(subgoal_tac \"i\\n \\ n\\ i+j\")\n apply(rename_tac d i j e c option b n)(*strict*)\n prefer 2\n apply (metis nat_seq_in_interval)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\")\n apply(rename_tac d i j e c option b n)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc (i+j)\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaHvHS_Bra2LinStep_def)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSc' SSc)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"i\"\n and m=\"n-i\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSc' SSc)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"n\"\n and m=\"Suc 0\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects G. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSc' SSc)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"Suc n\"\n and m=\"(i+j) - n\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(erule bexE)+\n apply(rename_tac d i j e c option b n e1 e2 c1 c2 h ha hb)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c option b n e1 e2 c1 c2)(*strict*)\n apply(simp add: epda_effects_def)\n apply(simp add: epdaH_step_relation_def)\n done\n\nlemma equal_configurations_at_identical_position_in_marking_derivations: \"\n valid_epda G\n \\ epdaS.is_forward_edge_deterministic_accessible G\n \\ \\ duplicate_markingH G\n \\ epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ maximum_of_domain d2 m2\n \\ d2 m2 = Some (pair e2' c2')\n \\ c2' \\ epdaH_marking_configurations G\n \\ d1 n1 = Some (pair e1 c)\n \\ d2 n2 = Some (pair e2 c)\n \\ n1\\n2\n \\ n1=n2\"\n apply(subgoal_tac \"d1 n1=d2 n1\")\n prefer 2\n apply(rule_tac\n ?n1.0=\"n1\"\n and ?n.0=\"n2-n1\"\n in EDPDA_derivations_coincide)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(thin_tac \"epdaH.derivation_initial G d1\")\n apply(thin_tac \"d1 n1 = Some (pair e1 c)\")\n apply(subgoal_tac \"\\n. n1+n=n2\")\n prefer 2\n apply(rule_tac\n x=\"n2-n1\"\n in exI)\n apply(force)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"n1+n\\m2\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply (metis epdaH.allPreMaxDomSome_prime epdaH.derivation_initial_is_derivation not_None_eq)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"\\m. n1+n+m=m2\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"m2-n1-n\"\n in exI)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n m)(*strict*)\n apply(case_tac m)\n apply(rename_tac n m)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(case_tac n)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n nat)(*strict*)\n apply(simp add: duplicate_markingH_def)\n apply(erule_tac\n x=\"d2\"\n in allE)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(erule_tac\n x=\"n1\"\n in allE)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaH_marking_configurations_def)\n apply(rename_tac n m nat)(*strict*)\n apply(subgoal_tac \" n1+m=n1+n+m \\ (\\i\\n1+m. (derivation_append (derivation_take d2 n1) (derivation_drop d2 (n1+n)) n1) i = d2 i)\")\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(rule_tac\n ?e1.0=\"e2'\"\n and ?c1.0=\"c2'\"\n in EDPDA_derivations_coincide5)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac n m nat)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(rule_tac\n m=\"m\"\n in epdaH.derivation_drop_preserves_derivation)\n apply(rename_tac n m nat)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac n m nat)(*strict*)\n apply(simp add: derivation_take_def derivation_drop_def)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(simp add: derivation_append_def derivation_take_def derivation_drop_def)\n apply(clarsimp)\n apply(rename_tac n nat)(*strict*)\n apply(rule_tac\n t=\"Suc (nat + (n1 + n))\"\n and s=\"Suc (n1 + n + nat)\"\n in ssubst)\n apply(rename_tac n nat)(*strict*)\n apply(force)\n apply(rename_tac n nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n apply(rename_tac n m nat)(*strict*)\n apply(force)\n done\n\ndefinition every_state_in_some_accessible_configuration :: \"('q,'a,'b)epda \\ bool\" where\n \"every_state_in_some_accessible_configuration G = (\\q\\ epda_states G. \\w. set w \\ epda_events G \\ \\epdaS_conf_state=q,epdaS_conf_scheduler=w,epdaS_conf_stack=[epda_box G]\\\\ epdaS.get_accessible_configurations G)\"\n\ndefinition every_state_in_some_accessible_configurationEx :: \"('q,'a,'b)epda \\ bool\" where\n \"every_state_in_some_accessible_configurationEx G = (\\q\\ epda_states G. \\w. set w \\ epda_events G \\ \\epdaS_conf_state=q,epdaS_conf_scheduler=w,epdaS_conf_stack=[epda_box G]\\\\ epdaS.get_accessible_configurations G)\"\n\nlemma epda_input_replacement_preserves_derivation: \"\n valid_epda G\n \\ set w \\ epda_events G\n \\ set wa \\ epda_events G\n \\ epdaS.derivation_initial G d\n \\ d i = Some (derivation_configuration.pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = wa, epdaS_conf_stack = s\\)\n \\ d 0 = Some (pair None c)\n \\ epdaS_conf_scheduler c = wb @ wa\n \\ epdaS.derivation G (derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler := the (right_quotient_word (epdaS_conf_scheduler c) wa) @ w\\))\"\n apply(induct i arbitrary: e q wa wb s)\n apply(rename_tac e q wa wb s)(*strict*)\n apply(simp add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac q wa s i)(*strict*)\n apply(case_tac i)\n apply(rename_tac q wa s i)(*strict*)\n apply(clarsimp)\n apply(rename_tac q wa s)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac q wa s i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q wa s nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac i e q wa wb s)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac i e q wa wb s)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc i\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac i e q wa wb s)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i e q wa wb s)(*strict*)\n apply(force)\n apply(rename_tac i e q wa wb s)(*strict*)\n apply(force)\n apply(rename_tac i e q wa wb s)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ epdaS_string_state c1\")\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_monotonically_dec)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c1 = w @ epdaS_string_state \\epdaS_conf_state = q, epdaS_conf_scheduler = wa, epdaS_conf_stack = s\\\")\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"i\"\n and j=\"Suc 0\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa wb s e1 e2 c1 wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa wb s e1 e2 c1 wc wca)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"epdaS_conf_state c1\"\n in meta_allE)\n apply(erule_tac\n x=\"epdaS_conf_scheduler c1\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"wb\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"epdaS_conf_stack c1\"\n in meta_allE)\n apply(erule meta_impE)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(subgoal_tac \"c1 \\ epdaS_configurations G\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 wb wc x qa sa)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(case_tac \"ia\\i\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(erule_tac\n x=\"ia\"\n in allE)\n apply(case_tac ia)\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(subgoal_tac \"\\w. epdaS_string_state c1a = w @ epdaS_string_state c2\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"nat\"\n and j=\"Suc 0\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ epdaS_string_state c1a\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"0\"\n and j=\"nat\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(subgoal_tac \"\\w. epdaS_string_state c2 = w @ epdaS_string_state c1\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"Suc nat\"\n and j=\"i-Suc nat\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(subgoal_tac \"right_quotient_word (wba @ we @ wc @ wa) wa = Some(wba @ we @ wc)\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"wba @ we @ wc @ wa\"\n and s=\"(wba @ we @ wc) @ wa\"\n in ssubst)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(subgoal_tac \"right_quotient_word (we @ wc @ wa) wa = Some(we @ wc)\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"we @ wc @ wa\"\n and s=\"(we @ wc) @ wa\"\n in ssubst)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(subgoal_tac \"right_quotient_word (wba @ we @ wc @ wa) (wc@wa) = Some(wba @ we)\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"wba @ we @ wc @ wa\"\n and s=\"(wba @ we) @ (wc @ wa)\"\n in ssubst)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(subgoal_tac \"right_quotient_word (we @ wc @ wa) (wc@wa) = Some we\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"we @ wc @ wa\"\n and s=\"we @ (wc @ wa)\"\n in ssubst)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat e1a e2a c1a c2 wba wd we)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wc nat e1a e2a c1a c2 wb wd we)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(thin_tac \"\\ia. case ia of 0 \\ (case derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler := the (right_quotient_word (epdaS_conf_scheduler c) (wc @ wa)) @ w\\) 0 of None \\ False | Some (pair None c) \\ True | Some (pair (Some e) c) \\ False) | Suc i' \\ (case derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler := the (right_quotient_word (epdaS_conf_scheduler c) (wc @ wa)) @ w\\) ia of None \\ True | Some (pair i1 i2) \\ (case derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler := the (right_quotient_word (epdaS_conf_scheduler c) (wc @ wa)) @ w\\) i' of None \\ False | Some (pair i'1 i'2) \\ (case i1 of None \\ False | Some i1v \\ epdaS_step_relation G i'2 i1v i2)))\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(case_tac \"ia\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(case_tac \"Suc nat > Suc i\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(subgoal_tac \"nat=i\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i q wa s e1 e2 c1 wb wc nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(subgoal_tac \"right_quotient_word (wc @ wa) wa = Some wc\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n prefer 2\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"right_quotient_word wa wa = Some []\")\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n prefer 2\n apply (metis right_quotient_word_full)\n apply(rename_tac i q wa s e1 e2 c1 wb wc)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n done\n\nlemma epda_input_replacement_preserves_derivation_initial: \"\n valid_epda G\n \\ set w \\ epda_events G\n \\ set wa \\ epda_events G\n \\ epdaS.derivation_initial G d\n \\ d i = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = wa, epdaS_conf_stack = [epda_box G]\\)\n \\ d 0 = Some (pair None c)\n \\ epdaS_conf_scheduler c = wb @ wa\n \\ epdaS.derivation_initial G (derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler := the (right_quotient_word (epdaS_conf_scheduler c) wa) @ w\\))\"\n apply(simp (no_asm) add: epdaS.derivation_initial_def)\n apply(rule conjI)\n prefer 2\n apply(simp add: epdaS.derivation_initial_def)\n apply(simp add: derivation_map_def)\n apply(simp add: derivation_take_def)\n apply(clarsimp)\n apply(simp add: epdaS_initial_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"right_quotient_word (wb @ wa) wa = Some wb\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply (metis right_quotient_word_removes_right_addition)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rule epda_input_replacement_preserves_derivation)\n apply(force)+\n done\n\nlemma DFA_Connected_from_ConnectedEx: \"\n valid_dfa G\n \\ every_state_in_some_accessible_configurationEx G\n \\ every_state_in_some_accessible_configuration G\"\n apply(simp add: every_state_in_some_accessible_configurationEx_def)\n apply(simp add: every_state_in_some_accessible_configuration_def)\n apply(clarsimp)\n apply(rename_tac q w)(*strict*)\n apply(erule_tac\n x=\"q\"\n in ballE)\n apply(rename_tac q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w wa)(*strict*)\n prefer 2\n apply(rename_tac q w)(*strict*)\n apply(force)\n apply(rename_tac q w wa)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac q w wa d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac q w wa d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac q w wa d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac q w wa d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w wa d i option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac q w wa d i option)(*strict*)\n apply(fold get_configuration_def)\n apply(rename_tac e)\n apply(rename_tac q w wa d i e)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac q w wa d i e)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac q w wa d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ epdaS_string_state \\epdaS_conf_state = q, epdaS_conf_scheduler = wa, epdaS_conf_stack = [epda_box G]\\\")\n apply(rename_tac q w wa d i e c)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_monotonically_dec)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rule_tac\n x=\"derivation_map (derivation_take d i) (\\c. c\\epdaS_conf_scheduler:=the(right_quotient_word (epdaS_conf_scheduler c) wa) @ w\\)\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(rule epda_input_replacement_preserves_derivation_initial)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(force)\n apply(rename_tac q w wa d i e c wb)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(simp add: get_configuration_def derivation_map_def derivation_take_def)\n apply (metis right_quotient_word_full option.sel)\n done\n\nlemma DFA_not_none_read: \"\n valid_dfa M\n \\ e \\ epda_delta M\n \\ edge_event e \\ None\"\n apply(simp add: valid_dfa_def)\n done\n\nlemma DFA_push_pop_eq: \"\n valid_dfa M\n \\ e \\ epda_delta M\n \\ edge_push e = edge_pop e\"\n apply(simp add: valid_dfa_def)\n done\n\nlemma DFA_derivation_input_restriction_still_simulates: \"\n valid_dfa M\n \\ epdaS.derivation M d1\n \\ epdaS.derivation M d2\n \\ every_state_in_some_accessible_configuration M\n \\ maximum_of_domain d1 n1\n \\ maximum_of_domain d2 n2\n \\ d1 0 = Some (pair None c)\n \\ d2 0 = Some (pair None (c\\epdaS_conf_scheduler:=take i (epdaS_conf_scheduler c)\\))\n \\ i \\ length (epdaS_conf_scheduler c)\n \\ j\\ i\n \\ i\\ n1\n \\ i\\ n2\n \\ case_option undefined (\\x. x) (get_configuration (d2 j)) =\n case_option undefined (\\c. c\\epdaS_conf_scheduler:=take (i - j) (epdaS_conf_scheduler c)\\) (get_configuration (d1 j))\"\n apply(induct j)\n apply(simp add: get_configuration_def)\n apply(rename_tac j)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\e c. d1 j = Some (pair e c)\")\n apply(rename_tac j)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(subgoal_tac \"\\e c. d2 j = Some (pair e c)\")\n apply(rename_tac j)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(subgoal_tac \"\\e c. d1 (Suc j) = Some (pair (Some e) c)\")\n apply(rename_tac j)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom_after_0)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(subgoal_tac \"\\e c. d2 (Suc j) = Some (pair (Some e) c)\")\n apply(rename_tac j)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_before_max_dom_after_0)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(erule exE)+\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation M ca eb cb\")\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n prefer 2\n apply(rule epdaS.position_change_due_to_step_relation)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(subgoal_tac \"epdaS_step_relation M caa ec cc\")\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n in epdaS.position_change_due_to_step_relation)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca caa cb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(subgoal_tac \"edge_event eb \\ None \\ edge_pop eb = [epda_box M] \\ edge_push eb = [epda_box M]\")\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n prefer 2\n apply(simp only: valid_dfa_def)\n apply(erule conjE)+\n apply(erule_tac\n x=\"eb\"\n in ballE)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(subgoal_tac \"edge_event ec \\ None \\ edge_pop ec = [epda_box M] \\ edge_push ec = [epda_box M]\")\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n prefer 2\n apply(simp only: valid_dfa_def)\n apply(erule conjE)+\n apply(erule_tac\n x=\"ec\"\n in ballE)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(force)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac j e ea eb ec ca cb cc)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ca cb cc y ya w)(*strict*)\n apply(case_tac cc)\n apply(rename_tac j e ea eb ec ca cb cc y ya w epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ca cb y ya w epdaS_conf_schedulera)(*strict*)\n apply(rename_tac i1)\n apply(rename_tac j e ea eb ec ca cb y ya w i1)(*strict*)\n apply(case_tac cb)\n apply(rename_tac j e ea eb ec ca cb y ya w i1 epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ca y ya w i1 epdaS_conf_schedulera)(*strict*)\n apply(rename_tac i2)\n apply(rename_tac j e ea eb ec ca y ya w i1 i2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ca ya w i2)(*strict*)\n apply(case_tac ca)\n apply(rename_tac j e ea eb ec ca ya w i2 epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea eb ec ya w i2)(*strict*)\n apply(rename_tac h1)\n apply(rename_tac j e ea eb ec ya w h1)(*strict*)\n apply(case_tac ec)\n apply(rename_tac j e ea eb ec ya w h1 edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea eb ya w h1 edge_trga)(*strict*)\n apply(rename_tac pop1 push1 trg1)\n apply(rename_tac j e ea eb ya pop1 push1 trg1)(*strict*)\n apply(case_tac eb)\n apply(rename_tac j e ea eb ya pop1 push1 trg1 edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ea ya pop1 push1 trg1 edge_src edge_trg)(*strict*)\n apply(rename_tac src2 trg2)\n apply(rename_tac j e ea ya pop1 push1 trg1 src2 trg2)(*strict*)\n apply(thin_tac \"d1 j = Some (pair e \\epdaS_conf_state = src2, epdaS_conf_scheduler = ya # push1, epdaS_conf_stack = epda_box M # pop1\\)\")\n apply(rename_tac j e ea ya pop1 push1 trg1 src2 trg2)(*strict*)\n apply(thin_tac \"d1 (Suc j) = Some (pair (Some \\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg2\\) \\epdaS_conf_state = trg2, epdaS_conf_scheduler = push1, epdaS_conf_stack = epda_box M # pop1\\)\")\n apply(rename_tac j e ea ya pop1 push1 trg1 src2 trg2)(*strict*)\n apply(thin_tac \"d2 j = Some (pair ea \\epdaS_conf_state = src2, epdaS_conf_scheduler = ya # take (i - Suc j) push1, epdaS_conf_stack = epda_box M # pop1\\)\")\n apply(rename_tac j e ea ya pop1 push1 trg1 src2 trg2)(*strict*)\n apply(thin_tac \"d2 (Suc j) = Some (pair (Some \\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg1\\) \\epdaS_conf_state = trg1, epdaS_conf_scheduler = take (i - Suc j) push1, epdaS_conf_stack = epda_box M # pop1\\)\")\n apply(rename_tac j e ea ya pop1 push1 trg1 src2 trg2)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def epdaS.is_forward_edge_deterministic_accessible_def)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\epdaS_conf_state = src2, epdaS_conf_scheduler = [ya], epdaS_conf_stack = [epda_box M]\\\"\n in ballE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n prefer 2\n apply(simp add: every_state_in_some_accessible_configuration_def)\n apply(erule_tac\n x=\"src2\"\n in ballE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n prefer 2\n apply(simp add: valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg2\\\"\n and P=\"\\x. valid_epda_step_label M x\"\n in ballE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(force)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule_tac\n x=\"[ya]\"\n in allE)\n apply(erule impE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(simp add: valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg2\\\"\n and P=\"\\x. valid_epda_step_label M x\"\n in ballE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: option_to_set_def)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(force)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(force)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule_tac\n x=\"\\epdaS_conf_state = trg1, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box M]\\\"\n in allE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule_tac\n x=\"\\epdaS_conf_state = trg2, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box M]\\\"\n in allE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule_tac\n x=\"\\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg1\\\"\n in allE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule_tac\n x=\"\\edge_src = src2, edge_event = Some ya, edge_pop = [epda_box M], edge_push = [epda_box M], edge_trg = trg2\\\"\n in allE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(erule impE)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac j ya trg1 src2 trg2)(*strict*)\n apply(simp add: epdaS_step_relation_def option_to_list_def)\n done\n\nlemma valid_dfa_Connected_use_FEdetermR: \"\n valid_dfa G\n \\ every_state_in_some_accessible_configuration G\n \\ e1 \\ epda_delta G\n \\ e2 \\ epda_delta G\n \\ edge_src e1=edge_src e2\n \\ edge_event e1=edge_event e2\n \\ edge_trg e1=p\n \\ edge_trg e2=q\n \\ p=q\"\n apply(simp add: valid_dfa_def valid_dpda_def epdaS.is_forward_edge_deterministic_accessible_def)\n apply(simp add: every_state_in_some_accessible_configuration_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"edge_src e1\"\n in ballE)\n prefer 2\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n and P=\"\\e1. (\\y. edge_event e1 = Some y) \\ edge_pop e1 = [epda_box G] \\ edge_push e1 = [epda_box G]\"\n in ballE)\n apply(simp add: valid_epda_step_label_def)\n apply(force)\n apply(erule_tac\n x=\"case edge_event e1 of None \\ [] | Some x \\ [x]\"\n in allE)\n apply(erule_tac\n x=\"\\epdaS_conf_state = edge_src e1, epdaS_conf_scheduler = case edge_event e1 of None \\ [] | Some x \\ [x], epdaS_conf_stack = [epda_box G]\\\"\n in ballE)\n prefer 2\n apply(erule impE)\n prefer 2\n apply(force)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"e1\"\n and P=\"\\e1. valid_epda_step_label G e1\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_epda_step_label_def option_to_set_def)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(erule_tac\n x=\"\\epdaS_conf_state = edge_trg e1, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box G]\\\"\n in allE)\n apply(erule_tac\n x=\"\\epdaS_conf_state = edge_trg e2, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box G]\\\"\n in allE)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"e2\"\n in allE)\n apply(erule_tac\n P=\"epdaS_step_relation G \\epdaS_conf_state = edge_src e1, epdaS_conf_scheduler = case edge_event e1 of None \\ [] | Some x \\ [x], epdaS_conf_stack = [epda_box G]\\ e1 \\epdaS_conf_state = edge_trg e1, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box G]\\ \\ epdaS_step_relation G \\epdaS_conf_state = edge_src e1, epdaS_conf_scheduler = case edge_event e1 of None \\ [] | Some x \\ [x], epdaS_conf_stack = [epda_box G]\\ e2 \\epdaS_conf_state = edge_trg e2, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box G]\\\"\n in impE)\n prefer 2\n apply(force)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: option_to_list_def)\n done\n\nlemma DFA_always_box_stack: \"\n valid_dfa G\n \\ epdaS.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ epdaS_conf_stack c = [epda_box G]\"\n apply(induct n arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac n e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac n e c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n apply(unfold valid_dfa_def)\n apply(erule conjE)+\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n apply(clarify)\n apply(rename_tac n c e1 e2 c1 w y)(*strict*)\n apply(thin_tac \"valid_dpda G\")\n apply(thin_tac \"epdaS.derivation_initial G d\")\n apply(rename_tac n c e1 e2 c1 w y)(*strict*)\n apply(thin_tac \"epdaS_conf_stack c1 = edge_pop e2 @ w\")\n apply(force)\n done\n\nlemma epda_no_use_epda_box_implies_stack_content: \"\n valid_epda G\n \\ (\\r\\ epda_delta G. epda_box G \\ set (edge_pop r) \\ epda_box G \\ set (edge_push r))\n \\ epdaS.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ \\w. epda_box G \\ set w \\ epdaS_conf_stack c = w @ [epda_box G]\"\n apply(induct n arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac n e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac n e c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 w wa)(*strict*)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac n c e1 e2 c1 w wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n c e1 e2 c1 w wa)(*strict*)\n apply(clarsimp)\n apply(case_tac wa)\n apply(rename_tac n c e1 e2 c1 w wa)(*strict*)\n apply (metis append_self_conv in_set_conv_decomp)\n apply(rename_tac n c e1 e2 c1 w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac n c e1 e2 c1 w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac n c e1 e2 c1 w wa a list)(*strict*)\n apply(thin_tac \"wa=a#list\")\n apply(clarsimp)\n done\n\ndefinition epda_no_nil_popping_edges :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epda_no_nil_popping_edges M \\\n \\e \\ epda_delta M. edge_pop e \\ []\"\n\nlemma epda_preserves_epda_box: \"\n valid_epda G\n \\ epdaS.derivation_initial G d\n \\ d i = Some (pair e c)\n \\ suffix (epdaS_conf_stack c) [epda_box G]\"\n apply(induct i arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: suffix_def)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac i e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc i\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac i e c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(force)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i c e1 e2 c1 w)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w ca)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e2) ca \\ prefix ca (edge_pop e2)\")\n apply(rename_tac i c e1 e2 c1 w ca)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac i c e1 e2 c1 w ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac i c e1 e2 c1 w ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac i c e1 e2 c1 w ca cb)(*strict*)\n apply(case_tac e2)\n apply(rename_tac i c e1 e2 c1 w ca cb edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 c1 w ca cb edge_event edge_push)(*strict*)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(case_tac cb)\n apply(rename_tac i c e1 c1 w ca cb edge_event edge_push)(*strict*)\n apply(force)\n apply(rename_tac i c e1 c1 w ca cb edge_event edge_push a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c e1 c1 ca edge_event aa ab)(*strict*)\n apply(force)\n done\n\nlemma epda_nonempty_stack: \"\n valid_epda G\n \\ c \\ epdaS.get_accessible_configurations G\n \\ epdaS_conf_stack c \\ []\"\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(subgoal_tac \"suffix (epdaS_conf_stack c) [epda_box G]\")\n apply(rename_tac d i option)(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac d i option)(*strict*)\n apply(metis epda_preserves_epda_box)\n done\n\ndefinition epda_no_mass_popping_edges :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epda_no_mass_popping_edges M \\\n \\e \\ epda_delta M. length (edge_pop e) \\ Suc 0\"\n\nlemma epda_stack_in_gamma: \"\n valid_epda G\n \\ c \\ epdaS_configurations G\n \\ set (epdaS_conf_stack c) \\ epda_gamma G\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac x q i s)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_EB_Nonblockingness_branching_restricted_hlp: \"\n valid_dpda G\n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n \\ epdaS.accessible G\n \\ epdaH.Nonblockingness_branching_restricted G\"\n apply(rule epdaH.AX_BF_BraSBRest_DetHDB_LaOp)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply(simp add: epdaH.is_forward_target_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e w1 w2)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply (metis DPDA_to_epdaH_determinism)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n done\n\ndefinition epda_to_des_opt :: \"\n ('states, 'event, 'stack) epda option\n \\ 'event DES\"\n where\n \"epda_to_des_opt M \\ (case M of None \\ bot | Some M \\ epda_to_des M)\"\n\nlemma epda_to_des_not_empty: \"\n valid_epda C\n \\ epda_to_des C = DES {} {}\n \\ Q\"\n apply(simp add: epda_to_des_def)\n apply(clarsimp)\n apply(subgoal_tac \"[] \\ epdaH.unmarked_language C\")\n apply(force)\n apply(rule epda_empty_in_epdaH_unmarked_language)\n apply(simp add: valid_dpda_def valid_pda_def)\n done\n\nlemma epda_to_des_enforces_IsDES: \"\n valid_epda G\n \\ IsDES (epda_to_des G)\"\n apply(simp add: IsDES_def)\n apply(simp add: DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def nonblockingness_language_def DES_nonblockingness_def)\n apply(rule conjI)\n apply(rule epdaH.lang_inclusion)\n apply(force)\n apply(rule antisym)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac x c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x c)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"x\"\n and v=\"c\"\n in epdaH_unmarked_languageuage_prefix_closed)\n apply(rename_tac x c)(*strict*)\n apply(force)\n apply(rename_tac x c)(*strict*)\n apply(force)\n apply(rename_tac x c)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: prefix_closure_def prefix_def)\n apply(rule_tac\n x=\"x\"\n in exI)\n apply(clarsimp)\n done\n\nlemma epdaH_prefixes_of_marked_words_are_unmarked_words: \"\n valid_epda G\n \\ x@v \\ epdaH.marked_language G\n \\ x \\ epdaH.unmarked_language G\"\n apply(simp add: epdaH.unmarked_language_def)\n apply(simp add: epdaH.marked_language_def)\n apply(clarsimp)\n apply(rename_tac d)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH_marked_effect_def epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(thin_tac \"\\j e' c'. i < j \\ d j = Some (pair e' c') \\ epdaH_string_state c = epdaH_string_state c'\")\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e c)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"i\"\n and P=\"\\n. n\\i \\ prefix x (epdaH_conf_history (the(get_configuration(d n)))) \"\n in ex_least_nat_le_prime)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c k)(*strict*)\n apply(case_tac k)\n apply(rename_tac d i e c k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(case_tac \"d 0\")\n apply(rename_tac d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d i e c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c b)(*strict*)\n apply(simp add: epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d i e c k nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e c nat)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"nat\"\n and m=\"i\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d i e c nat)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e c nat)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def prefix_def)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 c2 ca)(*strict*)\n apply(case_tac c2)\n apply(rename_tac d i e c nat e1 e2 c1 c2 ca epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 c1 ca epdaH_conf_state epdaH_conf_stack)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(rename_tac d i e c nat e1 e2 c1 ca epdaH_conf_statea epdaH_conf_stacka)(*strict*)\n apply(rename_tac q2 s2)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2)(*strict*)\n apply(case_tac c1)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac q1 h1 s1)\n apply(rename_tac d i e c nat e1 e2 c1 ca q2 s2 q1 h1 s1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 e2 ca h1 w)(*strict*)\n apply(case_tac e2)\n apply(rename_tac d i e c nat e1 e2 ca h1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca h1 w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(rename_tac qs re po pu qt)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt)(*strict*)\n apply(case_tac re)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca w qs po pu qt)(*strict*)\n apply(rule_tac\n x=\"nat\"\n in exI)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(force)\n apply(rename_tac d i e c nat e1 ca h1 w qs re po pu qt a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n xs=\"ca\"\n in rev_cases)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n prefer 2\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 w qs po pu qt a ys)(*strict*)\n apply(force)\n apply(rename_tac d i e c nat e1 ca h1 w qs po pu qt a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e c nat e1 h1 w qs po pu qt a)(*strict*)\n apply(rule_tac\n x=\"Suc nat\"\n in exI)\n apply(clarsimp)\n done\n\nlemma duplicate_markingH_to_duplicate_marking: \"\n valid_epda G\n \\ \\ duplicate_markingH G\n \\ \\ duplicate_marking G\"\n apply(simp add: duplicate_markingH_def duplicate_marking_def)\n apply(clarsimp)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"epdaHS.derivation_initial SSP (epdaS2epdaHS_derivation SSP SSd)\" for SSP SSd)\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule epdaS2epdaHS_derivation_preserves_derivation_initial)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(subgoal_tac \"epdaH.derivation_initial SSG (ATS_Branching_Versus_Linear1.Lin2BraDer epdaHvHS_Lin2BraConf SSd)\" for SSG SSd)\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_initiality_lift)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(erule_tac\n x=\"(ATS_Branching_Versus_Linear1.Lin2BraDer epdaHvHS_Lin2BraConf (epdaS2epdaHS_derivation G d))\"\n in allE)\n apply(rename_tac d i j y)(*strict*)\n apply(erule impE)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule_tac\n x=\"j\"\n in allE)\n apply(subgoal_tac \"\\e c. d i = Some (pair e c)\")\n apply(rename_tac d i j y)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc (i+j)\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac d i j y)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(force)\n apply(rename_tac d i j y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j y e c)(*strict*)\n apply(subgoal_tac \"\\e c. d (Suc (i+j)) = Some (pair e c)\")\n apply(rename_tac d i j y e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc (i+j)\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac d i j y e c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i j y e c)(*strict*)\n apply(force)\n apply(rename_tac d i j y e c)(*strict*)\n apply(force)\n apply(rename_tac d i j y e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(erule impE)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i j e c ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca b)(*strict*)\n apply(simp add: get_configuration_def epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def epdaHvHS_Lin2BraConf_def)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(erule impE)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i j e c ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca b)(*strict*)\n apply(simp add: get_configuration_def epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def epdaHvHS_Lin2BraConf_def)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i j e c ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca b)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def epdaHvHS_Lin2BraConf_def)\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac d i j e c ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i j e c ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i j e c ea ca b)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def get_configuration_def ATS_Branching_Versus_Linear1.Lin2BraDer_def epdaS.derivation_initial_def epdaS_initial_configurations_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def epdaHvHS_Lin2BraConf_def)\n done\n\nlemma epdaH_trans_der_context: \"\n valid_epda G\n \\ epdaH.trans_der G d c \\ c'\n \\ C = (\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\)\n \\ set s \\ epda_gamma G\n \\ set h \\ epda_events G\n \\ C c = c0\n \\ C c' = c0'\n \\ epdaH.trans_der G (derivation_map d C) c0 \\ c0'\"\n apply(rule epdaH.trans_der_context)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac a e b)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(clarsimp)\n apply(rename_tac ca)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(force)\n apply(force)\n done\n\nlemma epdaH_trans_der_concatExtend: \"\n valid_epda G\n \\ epdaH.trans_der G d1 c1 \\1 c1'\n \\ epdaH.trans_der G d2 c2 \\2 c2'\n \\ epdaH_conf_state c1'=epdaH_conf_state c2\n \\ epdaH_conf_history c1'=h@epdaH_conf_history c2\n \\ epdaH_conf_stack c1'=epdaH_conf_stack c2@s\n \\ epdaH.trans_der G (derivation_append d1 (derivation_map d2 (\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\)) (length \\1)) c1 (\\1@\\2) ((\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\) c2')\"\n apply(subgoal_tac \"epdaH.trans_der G (derivation_map d2 (\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\)) ((\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\) c2) \\2 ((\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\) c2')\")\n prefer 2\n apply(rule epdaH_trans_der_context)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"c1' \\ epdaH_configurations G\")\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(simp add: epdaH.trans_der_def)\n apply(clarsimp)\n apply(rename_tac e ea)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac e ea)(*strict*)\n apply(force)\n apply(rename_tac e ea)(*strict*)\n apply(force)\n apply(subgoal_tac \"c1' \\ epdaH_configurations G\")\n apply(simp add: epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(simp add: epdaH.trans_der_def)\n apply(clarsimp)\n apply(rename_tac e ea)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac e ea)(*strict*)\n apply(force)\n apply(rename_tac e ea)(*strict*)\n apply(force)\n apply(force)\n apply(force)\n apply(thin_tac \"epdaH.trans_der G d2 c2 \\2 c2'\")\n apply(subgoal_tac \"epdaH.trans_der SSG (derivation_append SSd1 SSd2 (length SSrenPI10)) SSc1 (SSrenPI10 @ SSrenPI20) SSc2'\" for SSG SSd1 SSd2 SSc1 SSrenPI10 SSrenPI20 SSc2')\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1\"\n and ?d2.0=\"(derivation_map d2 (\\c. c\\epdaH_conf_history := h @ epdaH_conf_history c, epdaH_conf_stack := epdaH_conf_stack c @ s\\))\"\n in epdaH.trans_der_concat)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epdaH_trans_der_concatExtend_prime: \"\n valid_epda G\n \\ epdaH.trans_der G d1 c1 \\1 c1'\n \\ epdaH.trans_der G d2 c2 \\2 c2'\n \\ epdaH_conf_state c1'=epdaH_conf_state c2\n \\ epdaH_conf_history c1'=h@epdaH_conf_history c2\n \\ epdaH_conf_stack c1'=epdaH_conf_stack c2@s\n \\ \\d. epdaH.trans_der G d c1 (\\1@\\2) ((\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\) c2')\"\n apply(rule_tac\n x=\"(derivation_append d1 (derivation_map d2 (\\c. c\\epdaH_conf_history:=h@(epdaH_conf_history c),epdaH_conf_stack:=(epdaH_conf_stack c)@s\\)) (length \\1))\"\n in exI)\n apply(rule epdaH_trans_der_concatExtend)\n apply(force)+\n done\n\nlemma epdaH_nonconflicting_reachable_derivations_are_mutual_prefixing: \"\n valid_dpda G\n \\ epdaH.trans_der G d \\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\ \\ \\epdaH_conf_state=q,epdaH_conf_history=h,epdaH_conf_stack=[X]@s\\\n \\ epdaH.trans_der G d1 \\epdaH_conf_state=q,epdaH_conf_history=[],epdaH_conf_stack=[X]\\ \\1 \\epdaH_conf_state=q',epdaH_conf_history=[],epdaH_conf_stack=s1\\\n \\ epdaH.trans_der G d2 \\epdaH_conf_state=q,epdaH_conf_history=[],epdaH_conf_stack=[X]\\ \\2 \\epdaH_conf_state=q',epdaH_conf_history=b#h',epdaH_conf_stack=s2\\\n \\ strict_prefix \\1 \\2\"\n apply(subgoal_tac \"\\d1'. epdaH.trans_der G d1' \\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\ (\\@\\1) \\epdaH_conf_state=q',epdaH_conf_history=h,epdaH_conf_stack=s1@s\\\")\n apply(subgoal_tac \"\\d2'. epdaH.trans_der G d2' \\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\ (\\@\\2) \\epdaH_conf_state=q',epdaH_conf_history=h@b#h',epdaH_conf_stack=s2@s\\\")\n apply(thin_tac \"epdaH.trans_der G d \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ \\ \\epdaH_conf_state = q, epdaH_conf_history = h, epdaH_conf_stack = [X] @ s\\\")\n apply(thin_tac \"epdaH.trans_der G d1 \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [X]\\ \\1 \\epdaH_conf_state = q', epdaH_conf_history = [], epdaH_conf_stack = s1\\\")\n apply(thin_tac \"epdaH.trans_der G d2 \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [X]\\ \\2 \\epdaH_conf_state = q', epdaH_conf_history = b # h', epdaH_conf_stack = s2\\\")\n apply(clarsimp)\n apply(rename_tac d1' d2')(*strict*)\n apply(simp add: epdaH.trans_der_def)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(case_tac \"length \\ + length \\1 = length \\ + length \\2\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"Some (pair e \\epdaH_conf_state = q', epdaH_conf_history = h, epdaH_conf_stack = s1 @ s\\)=Some (pair ea \\epdaH_conf_state = q', epdaH_conf_history = h @ b # h', epdaH_conf_stack = s2 @ s\\)\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n x=\"0\"\n and m=\"length \\+length \\2\"\n and n=\"length \\+length \\1\"\n and y=\"0\"\n and G=\"G\"\n and ?d1.0=\"d1'\"\n and ?d2.0=\"d2'\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaH.is_forward_deterministicHist_SB G\"\n and s=\"epdaH.is_forward_deterministicHist_DB G\"\n in ssubst)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply (metis epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule epdaHS2HF_FEdetermHist)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"b#h'\"\n in bexI)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epda_effects_def)\n apply(subgoal_tac \"\\epdaH_conf_state = q', epdaH_conf_history = h @ b # h', epdaH_conf_stack = s2 @ s\\ \\ epdaH_configurations G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n d=\"d2'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(case_tac \"length \\ + length \\1 < length \\ + length \\2\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"drop 0 (get_labels d1' (0+((length \\ + length \\1)))) = drop 0 (get_labels d2' (0+(length \\ + length \\1))) \\ (\\i\\(length \\ + length \\1). d1' (0+i) = d2' (0+i))\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(rule_tac\n x=\"drop(length \\1) \\2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"get_labels d2' (length \\ + length \\1) = map Some \\ @ map Some (take(length \\1) \\2)\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply (metis append_Nil append_take_drop_id_hlp length_append length_map length_map_Some length_shorter_append2 map_append takeShorter)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n m=\"length \\2-length \\1\"\n and v=\"map Some (drop(length \\1)\\2)\"\n in get_labels_drop_tail)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply (metis append_Nil append_take_drop_id_hlp length_append length_map length_map_Some length_shorter_append2 map_append takeShorter)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n x=\"0\"\n and m=\"length \\+length \\2\"\n and n=\"length \\+length \\1\"\n and y=\"0\"\n and G=\"G\"\n and ?d1.0=\"d1'\"\n and ?d2.0=\"d2'\"\n in epdaH.same_steps_for_compatible_histories)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaH.is_forward_deterministicHist_SB G\"\n and s=\"epdaH.is_forward_deterministicHist_DB G\"\n in ssubst)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply (metis epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule epdaHS2HF_FEdetermHist)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply (simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"b#h'\"\n in bexI)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epda_effects_def)\n apply(subgoal_tac \"\\epdaH_conf_state = q', epdaH_conf_history = h @ b # h', epdaH_conf_stack = s2 @ s\\ \\ epdaH_configurations G\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(rule_tac\n d=\"d2'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length \\2 < length \\1\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(subgoal_tac \"\\k\\(length \\+length \\2). (\\i (case SSd i of None \\ False | Some (pair e c) \\ SSP c)) \\ (case SSd k of None \\ False | Some (pair e c) \\ SSP c)\" for SSd SSP)\n apply(rename_tac d1' d2' e ea)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2'\"\n and P=\"\\c. \\w. epdaH_conf_history c=h@[b]@w\"\n in epdaH.existence_of_earliest_satisfaction_point)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(case_tac k)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea nat)(*strict*)\n apply(rename_tac k)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d2' k = Some (pair e1 c1) \\ SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\" for SSd SSn)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"length \\+length \\2\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w)(*strict*)\n apply(subgoal_tac \"epdaH_conf_history c1 = h \\ w = []\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w)(*strict*)\n prefer 2\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa)(*strict*)\n apply(case_tac \"edge_event e2\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa)(*strict*)\n apply(simp add: option_to_list_def)\n apply(erule_tac\n x=\"w\"\n in allE)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"w=[] \\ (\\w' a'. w=w'@[a'])\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa a)(*strict*)\n prefer 2\n apply(rule case_list)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa a)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w wa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 wa a w')(*strict*)\n apply(erule_tac\n x=\"w'\"\n in allE)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 w)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1' k = Some (pair e1 c1) \\ SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\ epdaH_step_relation G c1 e2 c2\" for SSd SSn)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"length \\+length \\1\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects SSG. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSG SSc' SSc)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc 0\"\n and n=\"k\"\n and d=\"d1'\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule_tac\n d=\"d1'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(subgoal_tac \"\\h\\ epda_effects SSG. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSG SSc' SSc)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"length \\+length \\1-Suc k\"\n and n=\"Suc k\"\n and d=\"d1'\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(rule_tac\n d=\"d1'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(rule_tac\n t=\"(Suc k + (length \\ + length \\1 - Suc k))\"\n and s=\"length \\ + length \\1\"\n in ssubst)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(subgoal_tac \"d1' k = d2' k\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n prefer 2\n apply(subgoal_tac \"drop 0 (get_labels d1' (0+k)) = drop 0 (get_labels d2' (0+(k))) \\ (\\i\\(k). d1' (0+i) = d2' (0+i))\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(rule_tac\n x=\"0\"\n and m=\"length \\+length \\2\"\n and n=\"k\"\n and y=\"0\"\n and G=\"G\"\n and ?d1.0=\"d1'\"\n and ?d2.0=\"d2'\"\n in epdaH.same_steps_for_compatible_histories)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaH.is_forward_deterministicHist_SB G\"\n and s=\"epdaH.is_forward_deterministicHist_DB G\"\n in ssubst)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply (metis epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(rule epdaHS2HF_FEdetermHist)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epda_effects_def)\n apply(subgoal_tac \"\\epdaH_conf_state = q', epdaH_conf_history = epdaH_conf_history c1a @ h @ ha @ b # h', epdaH_conf_stack = s2 @ s\\ \\ epdaH_configurations G\")\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(rule_tac\n d=\"d2'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e1 e2 c1 c2 e1a e2a c1a c2a h ha)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"d1' (Suc k) = d2' (Suc k)\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(subgoal_tac \"drop 0 (get_labels d1' (0+(Suc k))) = drop 0 (get_labels d2' (0+(Suc k))) \\ (\\i\\(Suc k). d1' (0+i) = d2' (0+i))\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule_tac\n x=\"0\"\n and m=\"length \\+length \\2\"\n and n=\"Suc k\"\n and y=\"0\"\n and G=\"G\"\n and ?d1.0=\"d1'\"\n and ?d2.0=\"d2'\"\n in epdaH.same_steps_for_compatible_histories)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaH.is_forward_deterministicHist_SB G\"\n and s=\"epdaH.is_forward_deterministicHist_DB G\"\n in ssubst)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n apply(rule conjI)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply (metis epdaH_is_forward_target_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule epdaHS2HF_FEdetermHist)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(simp add: valid_simple_dpda_def valid_dpda_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: valid_dpda_to_valid_pda valid_pda_to_valid_epda valid_simple_dpda_to_valid_dpda)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"epdaHS.is_forward_edge_deterministicHist_DB_long G\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis epdaHS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epda_effects_def)\n apply(subgoal_tac \"\\epdaH_conf_state = q', epdaH_conf_history = epdaH_conf_history c1a @ b # h', epdaH_conf_stack = s2 @ s\\ \\ epdaH_configurations G\")\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule_tac\n d=\"d2'\"\n in epdaH.belongs_configurations)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac d1' d2' e ea k e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"\\d1'. epdaH.trans_der G d1' \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ (\\ @ \\1) \\epdaH_conf_state = q', epdaH_conf_history = h, epdaH_conf_stack = s1 @ s\\\")\n apply(thin_tac \"epdaH.trans_der G d1 \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [X]\\ \\1 \\epdaH_conf_state = q', epdaH_conf_history = [], epdaH_conf_stack = s1\\\")\n apply(subgoal_tac \"\\d. epdaH.trans_der SSG d SSc1 (SSrenPI10 @ SSrenPI20) (SSc2'\\epdaH_conf_history := SSh @ epdaH_conf_history SSc2', epdaH_conf_stack := epdaH_conf_stack SSc2' @ SSs\\)\" for SSG SSc1 SSrenPI10 SSrenPI20 SSh SSc2' SSs)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d\"\n and ?d2.0=\"d2\"\n and h=\"h\"\n and s=\"s\"\n in epdaH_trans_der_concatExtend_prime)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(thin_tac \"epdaH.trans_der G d2 \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [X]\\ \\2 \\epdaH_conf_state = q', epdaH_conf_history = b # h', epdaH_conf_stack = s2\\\")\n apply(subgoal_tac \"\\d. epdaH.trans_der SSG d SSc1 (SSrenPI10 @ SSrenPI20) (SSc2'\\epdaH_conf_history := SSh @ epdaH_conf_history SSc2', epdaH_conf_stack := epdaH_conf_stack SSc2' @ SSs\\)\" for SSG SSc1 SSrenPI10 SSrenPI20 SSh SSc2' SSs)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d\"\n and ?d2.0=\"d1\"\n and h=\"h\"\n and s=\"s\"\n in epdaH_trans_der_concatExtend_prime)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n done\n\nlemma epda_is_forward_target_deterministic: \"\n valid_epda G\n \\ epdaH.is_forward_target_deterministic G\"\n apply(simp add: epdaH.is_forward_target_deterministic_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n done\n\nlemma epdaHS2epdaS_derivation_preserves_derivation: \"\n valid_epda P\n \\ epdaHS.derivation P d\n \\ epdaS.derivation P (epdaHS2epdaS_derivation d)\"\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS.derivation_def)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b)(*strict*)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaHS_step_relation P c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def)\n done\n\nlemma epdaS2epdaHS_derivation_preserves_derivation: \"\n valid_epda P\n \\ epdaS.belongs P d\n \\ epdaS.derivation P d\n \\ epdaHS.derivation P (epdaS2epdaHS_derivation P d)\"\n apply(simp add: epdaS2epdaHS_derivation_def)\n apply(simp add: epdaHS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS.derivation_def)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(force)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b)(*strict*)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(force)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation P c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label P e2\")\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ (epdaS_string_state c1)\")\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"nat\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c1 = w @ (epdaS_string_state c2)\")\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"Suc 0\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations P\")\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n prefer 2\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rule_tac\n t=\"right_quotient_word (wa @ option_to_list (edge_event e2) @ epdaS_conf_scheduler c2) (epdaS_conf_scheduler c2)\"\n and s=\"Some(wa @ option_to_list (edge_event e2))\"\n in ssubst)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule_tac\n t=\"right_quotient_word (wa @ option_to_list (edge_event e2) @ epdaS_conf_scheduler c2) (option_to_list (edge_event e2) @ epdaS_conf_scheduler c2)\"\n and s=\"Some wa\"\n in ssubst)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n done\n\nlemma epdaS2epdaHS_derivation_preserves_belongs: \"\n valid_epda P\n \\ epdaS.belongs P d\n \\ epdaS.derivation P d\n \\ epdaHS.belongs P (epdaS2epdaHS_derivation P d)\"\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(force)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(rule_tac epdaHS.derivation_belongs)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n prefer 3\n apply(rule epdaS2epdaHS_derivation_preserves_derivation)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def)\n apply(rename_tac c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n t=\"right_quotient_word (epdaS_conf_scheduler c) (epdaS_conf_scheduler c)\"\n and s=\"Some []\"\n in ssubst)\n apply(rename_tac c)(*strict*)\n apply (metis right_quotient_word_full)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations P\")\n apply(rename_tac c)(*strict*)\n apply(simp add: epdaHS_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n done\n\nlemma translate_epdaS_der_to_epdaH_der: \"\nvalid_dpda G\n \\ epdaS.derivation G d\n \\ epdaS.belongs G d\n \\ d 0 = Some (pair None \\epdaS_conf_state = q1, epdaS_conf_scheduler = hx, epdaS_conf_stack = ba # s\\)\n \\ d j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # s\\)\n \\ \\k\\j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ ba # s)\n \\ d (Suc j) = Some (pair e' \\epdaS_conf_state = q2, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\n \\ \\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = hx, epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = hx, epdaH_conf_stack = s\\)\"\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n x=\"epdaH_vs_epdaHS.Lin2BraDer (epdaS2epdaHS_derivation G d)\"\n in exI)\n apply(rule context_conjI)\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_steps_lift)\n apply(force)\n apply(rule epdaS2epdaHS_derivation_preserves_derivation)\n apply(force)\n apply(force)\n apply(force)\n apply(rule epdaS2epdaHS_derivation_preserves_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule epdaH_vs_epdaHS.Lin2BraDer_preserves_belongs)\n apply(force)\n apply(rule epdaS2epdaHS_derivation_preserves_derivation)\n apply(force)\n apply(force)\n apply(force)\n apply(rule epdaS2epdaHS_derivation_preserves_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(simp add: get_configuration_def epdaHvHS_Lin2BraConf_def epdaH_vs_epdaHS.Lin2BraDer_def epdaS2epdaHS_derivation_def derivation_map_def)\n apply(rule_tac\n t=\"right_quotient_word hx hx\"\n and s=\"Some []\"\n in ssubst)\n apply (metis right_quotient_word_full)\n apply(force)\n apply(rule conjI)\n apply(simp add: get_configuration_def epdaHvHS_Lin2BraConf_def epdaH_vs_epdaHS.Lin2BraDer_def epdaS2epdaHS_derivation_def derivation_map_def)\n apply(rule_tac\n t=\"right_quotient_word hx []\"\n and s=\"Some hx\"\n in ssubst)\n apply (metis right_quotient_word_neutral)\n apply(force)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac k ea c)(*strict*)\n apply(subgoal_tac \"\\e c. d k = Some (pair e c)\")\n apply(rename_tac k ea c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"j\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac k ea c)(*strict*)\n apply(force)\n apply(rename_tac k ea c)(*strict*)\n apply(force)\n apply(rename_tac k ea c)(*strict*)\n apply(force)\n apply(rename_tac k ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac k ea c eaa ca)(*strict*)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n apply(rename_tac k ea c eaa ca w)(*strict*)\n apply(simp add: get_configuration_def epdaHvHS_Lin2BraConf_def epdaH_vs_epdaHS.Lin2BraDer_def epdaS2epdaHS_derivation_def derivation_map_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def epdaHvHS_Lin2BraConf_def epdaH_vs_epdaHS.Lin2BraDer_def epdaS2epdaHS_derivation_def derivation_map_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"right_quotient_word hx []\"\n and s=\"Some hx\"\n in ssubst)\n apply (metis right_quotient_word_neutral)\n apply(force)\n done\n\nlemma DPDA_edge_pop_single: \"\n valid_dpda G\n \\ e \\ epda_delta G\n \\ \\x. edge_pop e=[x]\"\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(case_tac \"e\")\n apply(rename_tac edge_src edge_event edge_popa edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(case_tac edge_pop)\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg a list)(*strict*)\n apply(clarsimp)\n apply(force)\n done\n\nlemma epdaH_drop_unused_stack: \"\n valid_dpda G\n \\ \\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = \\, epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = \\, epdaH_conf_stack = s\\)\n \\ \\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = \\, epdaH_conf_stack = [ba]\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ [ba])) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = \\, epdaH_conf_stack = []\\)\"\n apply(clarsimp)\n apply(rename_tac d1')(*strict*)\n apply(rule_tac\n x=\"derivation_map (derivation_take d1' (Suc j)) (\\c. c\\epdaH_conf_stack:=butn(epdaH_conf_stack c)(length s)\\)\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac d1')(*strict*)\n apply(rule_tac\n P=\"\\c. (\\w. epdaH_conf_stack c = w @ ba # s)\"\n in epdaH.derivation_map_preserves_derivation23_VAR2)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' i ea c)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d1')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' a ea b w)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1' a ea b w wa)(*strict*)\n apply(case_tac a)\n apply(rename_tac d1' a ea b w wa epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' ea b w wa epdaH_conf_historya)(*strict*)\n apply(case_tac b)\n apply(rename_tac d1' ea b w wa epdaH_conf_historya epdaH_conf_statea epdaH_conf_historyaa epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(rule_tac\n t=\"edge_pop ea @ wa\"\n and s=\"w @ ba # s\"\n in ssubst)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(force)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(rule_tac\n t=\"butn (w @ ba # s) (length s)\"\n and s=\"w@[ba]\"\n in ssubst)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(rule_tac\n t=\"w@ba#s\"\n and s=\"(w@[ba])@s\"\n in ssubst)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(force)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop ea=[x]\")\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' ea w wa x)(*strict*)\n apply(case_tac w)\n apply(rename_tac d1' ea w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' ea)(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1' ea w wa x a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' ea x list)(*strict*)\n apply(rule_tac\n t=\"edge_push ea @ list @ ba # s\"\n and s=\"(edge_push ea @ list @ [ba]) @ s\"\n in ssubst)\n apply(rename_tac d1' ea x list)(*strict*)\n apply(force)\n apply(rename_tac d1' ea x list)(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(rule DPDA_edge_pop_single)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(force)\n apply(rename_tac d1' ea w wa)(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule conjI)\n apply(rename_tac d1')(*strict*)\n apply(rule epdaH.derivation_belongs)\n apply(rename_tac d1')(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d1')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rename_tac d1')(*strict*)\n apply(subgoal_tac \"\\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\ \\ epdaH_configurations G\")\n apply(rename_tac d1')(*strict*)\n apply(simp add: epdaH_configurations_def)\n apply(rule_tac\n t=\"ba#s\"\n and s=\"[ba]@s\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule_tac\n t=\"butn ([ba] @ s) (length s)\"\n and s=\"[ba]\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule conjI)\n apply(rename_tac d1')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rule_tac\n t=\"ba#s\"\n and s=\"[ba]@s\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule_tac\n t=\"butn ([ba] @ s) (length s)\"\n and s=\"[ba]\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule conjI)\n apply(rename_tac d1')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(rule_tac\n t=\"ba#s\"\n and s=\"[ba]@s\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule_tac\n t=\"butn ([ba] @ s) (length s)\"\n and s=\"[ba]\"\n in ssubst)\n apply(rename_tac d1')(*strict*)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1')(*strict*)\n apply(force)\n apply(rename_tac d1')(*strict*)\n apply(rule conjI)\n apply(rename_tac d1')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac d1' k ea c)(*strict*)\n apply(erule_tac\n x=\"k\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e c. d1' k = Some (pair e c)\")\n apply(rename_tac d1' k ea c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc j\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac d1' k ea c)(*strict*)\n apply(force)\n apply(rename_tac d1' k ea c)(*strict*)\n apply(force)\n apply(rename_tac d1' k ea c)(*strict*)\n apply(force)\n apply(rename_tac d1' k ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1' k ea ca w)(*strict*)\n apply(rule_tac\n t=\"w@ba#s\"\n and s=\"(w@[ba])@s\"\n in ssubst)\n apply(rename_tac d1' k ea ca w)(*strict*)\n apply(force)\n apply(rename_tac d1' k ea ca w)(*strict*)\n apply(rule_tac\n x=\"w\"\n in exI)\n apply (metis butn_prefix_closureise)\n apply(rename_tac d1')(*strict*)\n apply(simp add: derivation_map_def derivation_take_def)\n apply (metis butn_empty_prime_prime)\n done\n\nlemma lessI_X: \"\n n\\(0::nat)\n \\ a+n=b\n \\ a epdaH.trans_der G dX \\epdaH_conf_state=epda_initial G,epdaH_conf_history=[],epdaH_conf_stack=[epda_box G]\\ \\ \\epdaH_conf_state=q1,epdaH_conf_history=h,epdaH_conf_stack=[ba]@sX\\\n \\ [] \\ epdaS_produce_from_before_pop G q1 ba q2\n \\ \\\\. b#\\ \\ epdaS_produce_from_before_pop G q1 ba q2\n \\ Q\"\n apply(simp add: epdaS_produce_from_before_pop_def)\n apply(clarsimp)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(subgoal_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n prefer 2\n apply(thin_tac \"da 0 = Some (pair None \\epdaS_conf_state = q1, epdaS_conf_scheduler = b # \\, epdaS_conf_stack = ba # sa\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaS.derivation G da\")\n apply(thin_tac \"epdaS.belongs G da\")\n apply(thin_tac \"da ja = Some (pair ea \\epdaS_conf_state = qa, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # sa\\)\")\n apply(thin_tac \"\\k\\ja. \\e c. da k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ ba # sa)\")\n apply(thin_tac \"da (Suc ja) = Some (pair e'a \\epdaS_conf_state = q2, epdaS_conf_scheduler = [], epdaS_conf_stack = sa\\)\")\n apply(thin_tac \"epdaH.trans_der G dX \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ \\ \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = ba # sX\\\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(rule translate_epdaS_der_to_epdaH_der)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(subgoal_tac \"\\d2'. epdaH.derivation G d2' \\ epdaH.belongs G d2' \\ d2' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # sa\\) \\ d2' ja = Some (pair ea \\epdaH_conf_state = qa, epdaH_conf_history = b#\\, epdaH_conf_stack = ba # sa\\) \\ (\\k\\ja. \\e c. d2' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # sa)) \\ d2' (Suc ja) = Some (pair e'a \\epdaH_conf_state = q2, epdaH_conf_history = b#\\, epdaH_conf_stack = sa\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n prefer 2\n apply(thin_tac \"epdaS.derivation G d\")\n apply(thin_tac \"epdaS.belongs G d\")\n apply(thin_tac \"d 0 = Some (pair None \\epdaS_conf_state = q1, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"d j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\k\\j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ ba # s)\")\n apply(thin_tac \"d (Suc j) = Some (pair e' \\epdaS_conf_state = q2, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaH.trans_der G dX \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ \\ \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = ba # sX\\\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(rule translate_epdaS_der_to_epdaH_der)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaS.derivation G d\")\n apply(thin_tac \"epdaS.belongs G d\")\n apply(thin_tac \"d 0 = Some (pair None \\epdaS_conf_state = q1, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"d j = Some (pair e \\epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\k\\j. \\e c. d k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ ba # s)\")\n apply(thin_tac \"d (Suc j) = Some (pair e' \\epdaS_conf_state = q2, epdaS_conf_scheduler = [], epdaS_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"da 0 = Some (pair None \\epdaS_conf_state = q1, epdaS_conf_scheduler = b # \\, epdaS_conf_stack = ba # sa\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaS.derivation G da\")\n apply(thin_tac \"epdaS.belongs G da\")\n apply(thin_tac \"da ja = Some (pair ea \\epdaS_conf_state = qa, epdaS_conf_scheduler = [], epdaS_conf_stack = ba # sa\\)\")\n apply(thin_tac \"\\k\\ja. \\e c. da k = Some (pair e c) \\ (\\w. epdaS_conf_stack c = w @ ba # sa)\")\n apply(thin_tac \"da (Suc ja) = Some (pair e'a \\epdaS_conf_state = q2, epdaS_conf_scheduler = [], epdaS_conf_stack = sa\\)\")\n apply(subgoal_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ [ba])) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = []\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n prefer 2\n apply(thin_tac \"\\d2'. epdaH.derivation G d2' \\ epdaH.belongs G d2' \\ d2' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # sa\\) \\ d2' ja = Some (pair ea \\epdaH_conf_state = qa, epdaH_conf_history = b # \\, epdaH_conf_stack = ba # sa\\) \\ (\\k\\ja. \\e c. d2' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # sa)) \\ d2' (Suc ja) = Some (pair e'a \\epdaH_conf_state = q2, epdaH_conf_history = b # \\, epdaH_conf_stack = sa\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaH.trans_der G dX \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ \\ \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = ba # sX\\\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(rule_tac\n s=\"s\"\n in epdaH_drop_unused_stack)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(subgoal_tac \"\\d2'. epdaH.derivation G d2' \\ epdaH.belongs G d2' \\ d2' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ d2' ja = Some (pair ea \\epdaH_conf_state = qa, epdaH_conf_history = b#\\, epdaH_conf_stack = [ba]\\) \\ (\\k\\ja. \\e c. d2' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ [ba])) \\ d2' (Suc ja) = Some (pair e'a \\epdaH_conf_state = q2, epdaH_conf_history = b#\\, epdaH_conf_stack = []\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n prefer 2\n apply(thin_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = [ba]\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ [ba])) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = []\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"epdaH.trans_der G dX \\epdaH_conf_state = epda_initial G, epdaH_conf_history = [], epdaH_conf_stack = [epda_box G]\\ \\ \\epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = ba # sX\\\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(rule_tac\n s=\"sa\"\n in epdaH_drop_unused_stack)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(force)\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\d1'. epdaH.derivation G d1' \\ epdaH.belongs G d1' \\ d1' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ d1' j = Some (pair e \\epdaH_conf_state = q, epdaH_conf_history = [], epdaH_conf_stack = ba # s\\) \\ (\\k\\j. \\e c. d1' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # s)) \\ d1' (Suc j) = Some (pair e' \\epdaH_conf_state = q2, epdaH_conf_history = [], epdaH_conf_stack = s\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(thin_tac \"\\d2'. epdaH.derivation G d2' \\ epdaH.belongs G d2' \\ d2' 0 = Some (pair None \\epdaH_conf_state = q1, epdaH_conf_history = [], epdaH_conf_stack = ba # sa\\) \\ d2' ja = Some (pair ea \\epdaH_conf_state = qa, epdaH_conf_history = b # \\, epdaH_conf_stack = ba # sa\\) \\ (\\k\\ja. \\e c. d2' k = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ ba # sa)) \\ d2' (Suc ja) = Some (pair e'a \\epdaH_conf_state = q2, epdaH_conf_history = b # \\, epdaH_conf_stack = sa\\)\")\n apply(rename_tac d \\ da q s qa sa j ja e ea e' e'a)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(subgoal_tac \"strict_prefix (map the (get_labels d1' (Suc j))) (map the (get_labels d2' (Suc ja)))\")\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(subgoal_tac \"Suc j q qa j ja e ea e' e'a d1' d2')(*strict*)\n prefer 2\n apply(simp only: strict_prefix_def)\n apply(erule exE)+\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n n=\"length c\"\n in lessI_X)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"Suc j + length c\"\n and s=\"length(map the (get_labels d1' (Suc j)) @ c)\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(simp (no_asm))\n apply (metis get_labels_length)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"map the (get_labels d1' (Suc j)) @ c\"\n and s=\"map the (get_labels d2' (Suc ja))\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(simp (no_asm))\n apply (metis get_labels_length)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"d1' (Suc j) = d2' (Suc j)\")\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc j\"\n and P=\"\\X. X \\ ja \\ (\\e c. d2' X = Some (pair e c) \\ (\\w. epdaH_conf_stack c = w @ [ba]))\"\n in allE)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(erule impE)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(subgoal_tac \"(\\i\\Suc j. d1' i = d2' i)\")\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(rule_tac\n x=\"0\"\n and y=\"ja-j\"\n and n=\"Suc j\"\n in epdaH.equal_labels_is_forward_target_deterministic_coinciding_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(rule epda_is_forward_target_deterministic)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(subgoal_tac \"get_labels SSd (SSn + SSm) = get_labels SSd SSn @ drop SSn (get_labels SSd (SSn + SSm))\" for SSd SSn SSm)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2'\"\n and n=\"Suc j\"\n and m=\"Suc ja-Suc j\"\n in get_labels_decomp)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"get_labels d1' (Suc j) = map (Some \\ the) (get_labels SSd SSn)\" for SSd SSn)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n prefer 2\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(subgoal_tac \"get_labels d2' (Suc j) = map (Some \\ the) (get_labels SSd SSn)\" for SSd SSn)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n prefer 2\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(subgoal_tac \"\\e c. d2' (Suc j) = Some (pair e c)\")\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc ja\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(subgoal_tac \"get_labels d2' (Suc ja) = map (Some \\ the) (get_labels SSd SSn)\" for SSd SSn)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n prefer 2\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n v=\"drop (Suc j) (get_labels d2' (Suc ja))\"\n in append_injr)\n apply(rule_tac\n t=\"get_labels d2' (Suc j) @ drop (Suc j) (get_labels d2' (Suc ja))\"\n and s=\"get_labels d2' (Suc ja)\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"get_labels d2' (Suc ja)\"\n and s=\"map (Some \\ the) (get_labels d2' (Suc ja))\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"map (Some \\ the) (get_labels d2' (Suc ja))\"\n and s=\" map Some (map the (get_labels d2' (Suc ja))) \"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"map the (get_labels d2' (Suc ja))\"\n and s=\"map the (get_labels d1' (Suc j)) @ c\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"map Some (map the (get_labels d1' (Suc j)) @ c)\"\n and s=\" (map Some (map the (get_labels d1' (Suc j)))) @ map Some c\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply (metis map_append)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"map Some (map the (get_labels d1' (Suc j)))\"\n and s=\"get_labels d1' (Suc j)\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(rule_tac\n t=\"drop (Suc j) (get_labels d1' (Suc j) @ map Some c)\"\n and s=\"map Some c\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(subgoal_tac \"length (get_labels d1' (Suc j)) = Suc j\")\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' c)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(rule_tac\n d=\"dX\"\n and ?d1.0=\"d1'\"\n and ?d2.0=\"d2'\"\n and b=\"b\"\n and h'=\"\\\"\n and ?s2.0=\"[]\"\n in epdaH_nonconflicting_reachable_derivations_are_mutual_prefixing)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(simp add: epdaH.trans_der_def)\n apply(clarsimp)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule_tac\n t=\"length (get_labels d1' (Suc j))\"\n and s=\"Suc j\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule conjI)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2')(*strict*)\n apply(simp add: epdaH.trans_der_def)\n apply(clarsimp)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule_tac\n t=\"length (get_labels d2' (Suc ja))\"\n and s=\"Suc ja\"\n in ssubst)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule conjI)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(rule epdaH.get_labels_the_Some_on_defined_positions)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n apply(rename_tac \\ q qa j ja e ea e' e'a d1' d2' eb)(*strict*)\n apply(force)\n done\n\nlemma epdaS_required_edges__vs__epdaH_required_edges__part1: \"\n valid_epda G\n \\ epdaS_required_edges G \\ epdaH_required_edges G\"\n apply(simp add: epdaS_required_edges_def epdaH_required_edges_def)\n apply(clarsimp)\n apply(rule_tac\n x=\"epdaH_vs_epdaHS.Lin2BraDer (epdaS2epdaHS_derivation G d)\"\n in exI)\n apply(rule context_conjI)\n apply(rule epdaH_vs_epdaHS.Lin2BraConf_preserves_initiality_lift)\n apply(force)\n apply (metis epdaS2epdaHS_derivation_preserves_derivation_initial)\n apply(rule_tac x=\"n\" in exI)\n apply(rule context_conjI)\n apply(simp add: epdaS2epdaHS_derivation_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def)\n apply(clarsimp)\n apply(rule_tac x=\"k\" in exI)\n apply(rule context_conjI)\n apply(simp add: epdaS2epdaHS_derivation_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def)\n apply(simp add: epdaS2epdaHS_derivation_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def)\n apply(clarsimp)\n apply(simp add: epdaS2epdaHS_derivation_def epdaH_vs_epdaHS.Lin2BraDer_def derivation_map_def epdaHvHS_Lin2BraConf_def epdaS_marking_configurations_def epdaH_marking_configurations_def epdaH_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(subgoal_tac \"right_quotient_word (epdaS_conf_scheduler (the (get_configuration (d 0))))\n [] =Some (epdaS_conf_scheduler (the (get_configuration (d 0))))\")\n prefer 2\n apply (metis right_quotient_word_neutral)\n apply(clarsimp)\n apply(subgoal_tac \"\\e c. d 0 = Some (pair e c)\")\n apply(rename_tac k ea c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in epdaS.pre_some_position_is_some_position)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"cb \\ epdaS_configurations G\")\n apply(simp add: epdaS_configurations_def)\n apply(force)\n apply(rule epdaS.belongs_configurations)\n apply(rule epdaS.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_required_edges__vs__epdaH_required_edges__part2: \"\n valid_epda G\n \\ epdaH_required_edges G \\ epdaS_required_edges G\"\n apply(simp add: epdaS_required_edges_def epdaH_required_edges_def)\n apply(clarsimp)\n apply(rule_tac x=\"epdaHS2epdaS_derivation (epdaH_vs_epdaHS.Bra2LinDer G d k)\" in exI)\n apply(rule context_conjI)\n apply(rule epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(force)\n apply(rule epdaHS.derivation_initialI)\n apply(rule epdaH_vs_epdaHS.Bra2LinDer_preserves_derivation)\n apply(force)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rule epdaH.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n d=\"d\" and n=\"k\"\n in epdaH_vs_epdaHS.Bra2LinDer_preserves_belongs)\n apply(force)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rule epdaH.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"cb \\ epdaHS_configurations G\")\n prefer 2\n apply(rule_tac e=\"None\" and i=\"0\" in epdaHS.belongs_configurations)\n apply(force)\n apply(force)\n apply(simp add: epdaH_vs_epdaHS.Bra2LinDer_def)\n apply(case_tac cb)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac a)\n apply(clarsimp)\n apply(simp add: epdaHvHS_Bra2LinConf_def)\n apply(simp add: epdaH_vs_epdaHS.Bra2LinDer'_def)\n apply(simp add: epdaHS_initial_configurations_def)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(simp add: epdaH_initial_configurations_def)\n apply(rule_tac x=\"n\" in exI)\n apply(rule conjI)\n apply(simp add: epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer_def)\n apply(rule_tac x=\"k\" in exI)\n apply(clarsimp)\n apply(simp add: epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer_def epdaHvHS_Bra2LinConf_def epdaS_marking_configurations_def epdaH_marking_configurations_def)\n apply(rule context_conjI)\n apply(simp add: epdaHS2epdaS_derivation_def epdaH_vs_epdaHS.Bra2LinDer_def epdaH_vs_epdaHS.Bra2LinDer'_def epdaHvHS_Bra2LinConf_def epdaS_marking_configurations_def epdaH_marking_configurations_def)\n apply(case_tac k)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq (Suc (nat)) (nat)=[]\")\n prefer 2\n apply (metis lessI nat_seqEmpty)\n apply(force)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def epdaH_configurations_def)\n apply(clarsimp)\n done\n\nlemma epdaS_required_edges__vs__epdaH_required_edges: \"\n valid_epda G\n \\ epdaS_required_edges G = epdaH_required_edges G\"\n apply(rule antisym)\n apply(simp add: epdaS_required_edges__vs__epdaH_required_edges__part1 epdaS_required_edges__vs__epdaH_required_edges__part2)\n apply(simp add: epdaS_required_edges__vs__epdaH_required_edges__part1 epdaS_required_edges__vs__epdaH_required_edges__part2)\n done\n\nlemma stable_configuration_can_be_reached: \"\n valid_dpda G \n \\ \\ epdaH_livelock G \n \\ c \\ epdaH.get_accessible_configurations G \n \\ \\d n e c'. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d n = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c' \\ (\\e' c''. epdaH_step_relation G c' e' c'' \\ edge_event e' \\ None)\"\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac d i e)(*strict*)\n apply(case_tac \"\\n. \\c' e d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d n = Some (pair e c') \\ epdaH_conf_history c=epdaH_conf_history c' \")\n apply(rename_tac d i e)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: epdaH_livelock_def)\n apply(erule_tac\n x=\"derivation_append d (\\x. SOME y. \\c' e d. y=Some (pair e c') \\ epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d x = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c') i\"\n in allE)\n apply(rename_tac d i e)(*strict*)\n apply(erule impE)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(simp (no_asm) add: epdaH.derivation_def)\n apply(fold epdaH.derivation_def)\n apply(clarsimp)\n apply(rename_tac d i e ia)(*strict*)\n apply(case_tac ia)\n apply(rename_tac d i e ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e)(*strict*)\n apply(case_tac \"d 0\")\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i e a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e b)(*strict*)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d i e b da)(*strict*)\n apply(rule_tac\n t=\"(SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d 0 = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c'))\"\n and s=\"Some(pair None c)\"\n in ssubst)\n apply(rename_tac d i e b da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e b da)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e b da)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"der1 c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e b da)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac d i e b da)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e b da)(*strict*)\n apply(rule epdaH.der1_belongs)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i e b da)(*strict*)\n apply(force)\n apply(rename_tac d i e b da)(*strict*)\n apply(force)\n apply(rename_tac d i e b da)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac d i e b da y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat)(*strict*)\n apply(erule_tac x=\"Suc nat\" in allE')\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(rule_tac\n t=\"(SOME y. \\c'event e. y = Some (pair e c'event) \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d (Suc nat) = Some (pair e c'event) \\ epdaH_conf_history c' = epdaH_conf_history c'event))\"\n and s=\"Some (pair ea c')\"\n in ssubst)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"derivation_append d da i\"\n and ?d2.0=\"derivation_append d dc i\"\n and x=\"i\"\n and y=\"i\"\n and n=\"Suc nat\"\n and m=\"Suc nat\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(SOME y. \\c'event e. y = Some (pair e c'event) \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d nat = Some (pair e c'event) \\ epdaH_conf_history c' = epdaH_conf_history c'event))\"\n and s=\"Some (pair eb c'event)\"\n in ssubst)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"db\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"derivation_append d db i\"\n and ?d2.0=\"derivation_append d dc i\"\n and x=\"i\"\n and y=\"i\"\n and n=\"nat\"\n and m=\"nat\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(case_tac nat)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db c'eventa ec dc nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and n=\"nat\"\n and m=\"Suc nat\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event ea eb da db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(subgoal_tac \"epdaH_conf_history c1 = epdaH_conf_history c'\")\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"derivation_append d db i\"\n and ?d2.0=\"derivation_append d da i\"\n and x=\"i\"\n and y=\"i\"\n and n=\"nat\"\n and m=\"nat\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(case_tac nat)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"da\"\n and n=\"nat\"\n and m=\"Suc 0\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(rule_tac\n d=\"da\"\n in epdaH.belongs_configurations)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"da\"\n and n=\"0\"\n and m=\"nat\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(rule_tac\n d=\"da\"\n in epdaH.belongs_configurations)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(force)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e nat c' c'event eb da db e1 e2 c1 h)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d 0 = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c'))\"\n and s=\"Some(pair None c)\"\n in ssubst)\n apply(rename_tac d i e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"der1 c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac d i e)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH.der1_belongs)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i e)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac d i e y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n)(*strict*)\n apply(simp add: derivation_append_def)\n apply(case_tac \"n\\i\")\n apply(rename_tac d i e n)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e n)(*strict*)\n prefer 2\n apply(rule_tac\n g=\"d\"\n and n=\"n\"\n and m=\"i\"\n in epdaH.pre_some_position_is_some_position)\n apply(rename_tac d i e n)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"n-i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(subgoal_tac \"(SOME y. \\c'event e. y = Some (pair e c'event) \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d (n - i) = Some (pair e c'event) \\ epdaH_conf_history c' = epdaH_conf_history c'event)) = Some (pair ea c')\")\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"derivation_append d da i\"\n and ?d2.0=\"derivation_append d db i\"\n and x=\"i\"\n and y=\"i\"\n and n=\"n-i\"\n and m=\"n-i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(thin_tac \"(SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d (n - i) = Some (pair e c') \\ epdaH_conf_history c'event = epdaH_conf_history c')) = None\")\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(erule_tac\n x=\"i\"\n and P=\"\\N. \\n\\N. epdaH_conf_history (the (get_configuration (derivation_append d (\\x. SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d x = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c')) i n))) \\ epdaH_conf_history (the (get_configuration (derivation_append d (\\x. SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d x = Some (pair e c') \\ epdaH_conf_history c = epdaH_conf_history c')) i N)))\"\n in allE)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n)(*strict*)\n apply(simp add: derivation_append_def get_configuration_def)\n apply(case_tac \"n=i\")\n apply(rename_tac d i e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n)(*strict*)\n apply(subgoal_tac \"ic'event e. y = Some (pair e c'event) \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d (n - i) = Some (pair e c'event) \\ epdaH_conf_history c' = epdaH_conf_history c'event)) = Some (pair ea c')\")\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(rule some_equality)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"derivation_append d da i\"\n and ?d2.0=\"derivation_append d db i\"\n and x=\"i\"\n and y=\"i\"\n and n=\"n-i\"\n and m=\"n-i\"\n in epdaH.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation_initial)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(thin_tac \"epdaH_conf_history (the (case_option None (case_derivation_configuration (\\e. Some)) (SOME y. \\c' e. y = Some (pair e c') \\ (\\d. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d (n - i) = Some (pair e c') \\ epdaH_conf_history c'event = epdaH_conf_history c')))) \\ epdaH_conf_history c'event\")\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply (metis DPDA_is_is_forward_deterministicHist_SB)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: get_configuration_def epda_effects_def)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e n c' ea da c'event eb db)(*strict*)\n apply(force)\n apply(rename_tac d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e n)(*strict*)\n prefer 2\n apply(rule_tac\n P=\"\\n. \\d e c'. epdaH.derivation G d \\ epdaH.belongs G d \\ d 0 = Some (pair None c) \\ d n = Some (pair e c') \\ epdaH_conf_history c=epdaH_conf_history c' \"\n and x=\"0\"\n and n=\"n\"\n in ex_max_limited)\n apply(rename_tac d i e n)(*strict*)\n apply(rule_tac\n x=\"der1 c\"\n in exI)\n apply(rule_tac\n x=\"None\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e n)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac d i e n)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e n)(*strict*)\n apply(rule epdaH.der1_belongs)\n apply(rule_tac\n d=\"d\"\n in epdaH.belongs_configurations)\n apply(rename_tac d i e n)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i e n)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n)(*strict*)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(force)\n apply(rename_tac d i e n)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac d i e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n k da ea c')(*strict*)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"k\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d i e n k da ea c' e' x)(*strict*)\n apply(case_tac e')\n apply(rename_tac d i e n k da ea c' e' x edge_src edge_eventa edge_pop edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n k da ea c' x edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(rename_tac qs r po pu qt)\n apply(rename_tac d i e n k da ea c' x qs r po pu qt)(*strict*)\n apply(case_tac r)\n apply(rename_tac d i e n k da ea c' x qs r po pu qt)(*strict*)\n prefer 2\n apply(rename_tac d i e n k da ea c' x qs r po pu qt a)(*strict*)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs r po pu qt)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(case_tac \"k=n\")\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e n da ea c' x qs po pu qt)(*strict*)\n apply(erule_tac\n x=\"c'\"\n in allE)\n apply(erule_tac\n x=\"ea\"\n in allE)\n apply(erule_tac\n x=\"da\"\n in allE)\n apply(clarsimp)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(subgoal_tac \"kedge_src = qs, edge_event = None, edge_pop = po, edge_push = pu, edge_trg = qt\\ x) k\"\n in allE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(erule impE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(erule impE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(rule epdaH.derivation_append_preserves_belongs)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(rule epdaH.der2_is_derivation)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(erule impE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(rule epdaH.derivation_append_preserves_derivation)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(rule epdaH.der2_is_derivation)\n apply(force)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(erule_tac\n x=\"Some \\edge_src = qs, edge_event = None, edge_pop = po, edge_push = pu, edge_trg = qt\\\"\n in allE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(thin_tac \"\\c'event e d. d n = Some (pair e c'event) \\ d 0 = Some (pair None c) \\ epdaH.belongs G d \\ epdaH.derivation G d \\ epdaH_conf_history c' \\ epdaH_conf_history c'event\")\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule impE)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d i e n k da ea c' x qs po pu qt)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(simp add: option_to_list_def)\n done\n\nlemma epda_to_des__of__valid_epda__not_empty: \"\n valid_epda G\n \\ epda_to_des G \\ bot\"\n apply(simp add: epda_to_des_def botDES_def bot_DES_ext_def)\n apply(clarsimp)\n apply (metis empty_iff epda_empty_in_epdaH_unmarked_language)\n done\n\ndefinition epdaH_livelock_freedom :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epdaH_livelock_freedom G \\\n \\ epdaH.has_livelock G\"\n\ndefinition epdaH_deadlock_freedom :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epdaH_deadlock_freedom G \\\n \\d n e c.\n epdaH.derivation_initial G d\n \\ maximum_of_domain d n\n \\ (\\ epdaH_marking_condition G d)\n \\ d n = Some (pair e c)\n \\ (\\e' c'. epdaH_step_relation G c e' c')\"\n\ndefinition epdaH_accessible :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epdaH_accessible G \\\n (\\e \\ epda_delta G. \\d n c. \n epdaH.derivation_initial G d \n \\ d n = Some (pair (Some e) c))\n \\ (\\q \\ epda_states G. \\d n e c. \n epdaH.derivation_initial G d \n \\ d n = Some (pair e c)\n \\ q = epdaH_conf_state c)\"\n\nlemma epdaH_accessible__to__epdaHaccessible: \"\n epdaH_accessible G\n \\ epdaH.accessible G\" \n apply(simp add: epdaH.accessible_def epdaH_accessible_def epdaH.get_accessible_destinations_def epda_destinations_def epdaH_get_destinations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(clarsimp)\n apply(erule_tac x=\"xa\" in ballE)\n apply(clarsimp)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n\" in exI)\n apply(clarsimp)\n apply(force)\n apply(clarsimp)\n apply(erule_tac x=\"xa\" in ballE)\n apply(clarsimp)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n\" in exI)\n apply(clarsimp)\n apply(force)\n done\n\nlemma epdaHaccessible__to__epdaH_accessible: \"\n epdaH.accessible G\n \\ epdaH_accessible G\" \n apply(simp add: epdaH.accessible_def epdaH_accessible_def epdaH.get_accessible_destinations_def epda_destinations_def epdaH_get_destinations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(clarsimp)\n apply(subgoal_tac \"edge e \\ {x. (x \\ epda_destinations.state ` epda_states G \\ x \\ edge ` epda_delta G) \\\n (\\d. ATS.derivation_initial epdaH_initial_configurations epdaH_step_relation G d \\\n (\\i e c. d i = Some (pair e c) \\\n (x = epda_destinations.state (epdaH_conf_state c) \\\n x \\ (case e of None \\ {} | Some e' \\ {edge e'}))))}\")\n prefer 2\n apply(rule_tac A=\"edge ` epda_delta G\" in set_mp)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"i\" in exI)\n apply(clarsimp)\n apply(case_tac ea)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"epda_destinations.state q \\ {x. (x \\ epda_destinations.state ` epda_states G \\ x \\ edge ` epda_delta G) \\\n (\\d. ATS.derivation_initial epdaH_initial_configurations epdaH_step_relation G d \\\n (\\i e c. d i = Some (pair e c) \\\n (x = epda_destinations.state (epdaH_conf_state c) \\\n x \\ (case e of None \\ {} | Some e' \\ {edge e'}))))}\")\n prefer 2\n apply(rule_tac A=\"epda_destinations.state ` epda_states G\" in set_mp)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"d\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"i\" in exI)\n apply(clarsimp)\n apply(case_tac c)\n apply(clarsimp)\n apply(case_tac e)\n apply(clarsimp)\n apply(force)\n done\n\nlemma epdaH_Nonblockingness2: \"\n valid_epda G\n \\ Nonblockingness2 (epdaH.unmarked_language G) (epdaH.marked_language G)\"\n apply(subgoal_tac \"Nonblockingness2 (epdaS.unmarked_language G) (epdaS.marked_language G)\")\n prefer 2\n apply(rule epda_Nonblockingness2)\n apply(force)\n apply (metis epdaS_to_epdaH_mlang epdaS_to_epdaH_unmarked_language)\n done\n\nlemma cfg_like_characterization_of_determinism_for_epda_part1: \"\n valid_epda G\n \\ epdaH.is_forward_deterministicHist_SB G\n \\ epdaH.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 c1)\n \\ epdaH_conf_history c1 = v\n \\ d1 (Suc n1) = Some (pair e1' c1')\n \\ epdaH_conf_history c1' = v @ [b]\n \\ epdaH.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 c2)\n \\ epdaH_conf_history c2 = v\n \\ d2 (Suc n2) = Some (pair e2' c2')\n \\ epdaH_conf_history c2' = v @ [b]\n \\ n1 = n2 \\ (\\i\\n1. d1 i = d2 i)\"\n oops\n\nlemma cfg_like_characterization_of_determinism_for_epda_part2: \"\n valid_epda G\n \\ epdaH.is_forward_deterministicHist_SB G\n \\ epdaH.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 c1)\n \\ epdaH_conf_history c1 = v\n \\ epdaH.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 c2)\n \\ epdaH_conf_history c2 = v\n \\ d2 (Suc n2) = Some (pair e2' c2')\n \\ epdaH_conf_history c2' = v @ [b]\n \\ n1 \\ n2 \\ (\\i\\n1. d1 i = d2 i)\"\n oops\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_07/I_epda_lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2896410905224101}} {"text": "\nheader {* Abstract syntax for Hybrid CSP. *}\n\ntheory HCSP_Com \n imports Main\n\"DCSequents/DCSequent\"\nbegin\n\n\n\ntype_synonym cname = string\ntype_synonym time = real\ntype_synonym bexp = fform\ntype_synonym Inv = fform\ntype_synonym Rg = fform\ntype_synonym mid = \"fform * fform\"\n\ndatatype typeid = R | S | B\n\ndatatype proc\n= \"Skip\"\n| \"Stop\"\n| Ass \"exp\" \"exp\" (\"_ := _\" [99, 95] 94) \n| Send \"cname\" \"exp\" (\"_!!_\" [110,108] 100) \n| Receive \"cname\" \"exp\" (\"_??_\" [110,108] 100) \n| Seq \"proc\" \"mid\" \" proc\" (\"_; _ ; _\" [91,90 ] 90)\n| Cond \"bexp\" \"proc\" (\"IF _ _\" [95,94]93)\n| Nondeter \"typeid\" \"string\" \"bexp\" \"proc\" (\"NON _ _ : _ _\" [95,94]93)\n| Pref \"proc\" \"proc\" (\"_\\_\" [95,94]93) \n| join \"proc\" \"proc\" (infixr \"[[\" 90)\n| meet \"proc\" \"proc\" (\"_<<_\" [90,90] 90)\n| Par \"proc\" \"proc\" (infixr \"||\" 89)\n| Rep \"proc\" (\"_*\"[91] 90)\n| RepA \"proc\" (\"_***\"[91] 90)\n| RepN \"proc\" \"nat\" (\"_**_\"[91,92] 90)\n| Cont \"Inv\" \"bexp\" \"Rg\" (\"<_&&_> : _\" [95,96]94)\n| TimeOut \"proc\" \"time\" \"proc\" (\"_|>_ _\" [95,96,94]94)\n| Interp \"proc\" \"proc\" (\"_[[>_\"[95,94]94)\n| empty \"exp\" (\"empty _\" 94)\n| addL \"exp\" \"exp\" (\"addL _ _\" 94)\n| delL \"exp\" (\"delL _\" 94)\n\ndefinition isEmpty :: \"exp => fform\" where\n\"isEmpty(e1) == (case e1 of\n (List ls) => (case ls of [] => WTrue | _ => WFalse) |\n _ => WFalse)\"\n\ndefinition readL :: \"exp => exp\" where\n\"readL(e1) == (case e1 of\n (List ls) => hd(ls) |\n _ => (Real 0))\"\n\ntype_synonym pair = \"exp * exp\"\n\n\nprimrec map :: \"pair list => exp => exp\" where\n\"map ([]) (a) = a\" |\n\"map (x#xs) (a) = (if (fst (x) = a) then (snd (x)) else (map (xs) (a)))\"\n\n\nlemma \"map ([(RVar ''x'', Real 2), (RVar ''y'', RVar z)], RVar ''x'') = (Real 2)\"\napply (induct, auto)\ndone\n\nlemma fact1 : \"map ([(RVar ''x'', Real 2), (RVar ''y'', RVar z)]) (RVar ''z'') = RVar ''z''\"\napply (induct, auto)\ndone\n\n(*Expression substitution: \"map\" records the substitution mapping.*)\nprimrec substE :: \"pair list => exp => exp\" where\n\"substE (mp, (RVar x)) = map (mp, (RVar x))\" |\n\"substE (mp, (SVar x)) = map (mp, (SVar x))\" |\n\"substE (mp, (BVar x)) = map (mp, (BVar x))\" |\n\"substE (mp, (List x)) = List x\" |\n\"substE (mp, (Real m)) = map (mp, (Real m))\" |\n\"substE (mp, (Bool b)) = map (mp, (Bool b))\" |\n\"substE (mp, (String s)) = map (mp, (String s))\" |\n\"substE (mp, (e1 [+] e2)) = substE (mp, e1) [+] substE (mp, e2)\" |\n\"substE (mp, (e1 [-] e2)) = substE (mp, e1) [-] substE (mp, e2)\"|\n\"substE (mp, (e1 [*] e2)) = substE (mp, e1) [*] substE (mp, e2)\"|\n\"substE (mp, (e1 [**] e2)) = substE (mp, e1) [**] substE (mp, e2)\"\n\nlemma \"(% x. x [+] x = RVar ''z'' [+] RVar ''z'') (RVar ''z'')\"\napply auto\ndone\n\nlemma \"substE ([(RVar ''x'', Real 1), (RVar ''y'', RVar ''z'')], (RVar ''y'' [+] RVar ''z'')) \n = RVar ''z'' [+] RVar ''z''\"\napply (induct, auto)\ndone \n\n\n(*Tip: for theory built on Pure, application is written by f(x) rather than f x as usual. *)\n\nprimrec lVarE :: \"pair list => string => pair list\" where\n\"lVarE ([],s) = []\" |\n\"lVarE (x#xs,s) = (if (fst (x) = (RVar s)) then xs else x#lVarE(xs, s))\"\n\nprimrec inExp :: \"string => exp => bool\" where\n\"inExp (s, (RVar x)) = (s=x)\" |\n\"inExp (s, (SVar x)) = (s=x)\" |\n\"inExp (s, (BVar x)) = (s=x)\" |\n\"inExp (s, (Real m)) = (False)\" |\n\"inExp (s, (Bool b)) = (False)\" |\n\"inExp (s, (String r)) = (False)\" |\n\"inExp (s, (e1 [+] e2)) = (inExp (s, e1) | inExp (s, e2))\" |\n\"inExp (s, (e1 [-] e2)) = (inExp (s, e1) | inExp (s, e2))\"|\n\"inExp (s, (e1 [*] e2)) = (inExp (s, e1) | inExp (s, e2))\"\n\nprimrec inPairL :: \"pair list => string => bool\" where\n\"inPairL ([],s) = False\" |\n\"inPairL (x#xs,s) = (if (inExp (s, fst (x))) then True else inPairL(xs, s))\"\n\nprimrec inPairR :: \"pair list => string => bool\" where\n\"inPairR ([],s) = False\" |\n\"inPairR (x#xs,s) = (if (inExp (s, snd (x))) then True else inPairR(xs, s))\"\n\n(*Check if the quantifiers of a formula occur in mp*)\nprimrec inPairForm :: \"pair list => fform => bool\" where\n \"inPairForm (mp) (WTrue) = False\" |\n \"inPairForm (mp) (WFalse) = False\" |\n \"inPairForm (mp) (e1 [=] e2) =False\" |\n \"inPairForm (mp) (e1 [<] e2) = False\" |\n \"inPairForm (mp) (e1 [>] e2) =False\" |\n \"inPairForm (mp) ([~]p) = (inPairForm (mp) (p))\" |\n \"inPairForm (mp) (p [&] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [|] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [-->] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [<->] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (WALL i p) = (inPairL (mp, i) | inPairR (mp, i) | inPairForm (mp)(p))\" |\n \"inPairForm (mp) (WEX i p) = (inPairL (mp, i) | inPairR (mp, i) | inPairForm (mp)(p))\"\n\n(*Formula sustitution.*)\nprimrec substF :: \"pair list => fform => fform\" where\n \"substF (mp) (WTrue) = WTrue\" |\n \"substF (mp) (WFalse) = WFalse\" |\n \"substF (mp) (e1 [=] e2) = ((substE (mp, e1)) [=] (substE (mp, e2)))\" |\n \"substF (mp) (e1 [<] e2) = ((substE (mp, e1)) [<] (substE (mp, e2)))\" |\n \"substF (mp) (e1 [>] e2) = (substE (mp, e1) [>] substE (mp, e2))\" |\n \"substF (mp) ([~]p) = ([~](substF (mp) (p)))\" |\n \"substF (mp) (p [&] q) = ((substF (mp) (p)) [&] (substF (mp) (q)))\" |\n \"substF (mp) (p [|] q) = ((substF (mp) (p)) [|] (substF (mp) (q)))\" |\n \"substF (mp) (p [-->] q) = ((substF (mp) (p)) [-->] (substF (mp) (q)))\" |\n \"substF (mp) (p [<->] q) = ((substF (mp) (p)) [<->] (substF (mp) (q)))\" |\n \"substF (mp) (WALL i p) = (if ((~inPairL (mp, i)) & (~inPairR (mp, i))) then (WALL i (substF (mp)(p))) \n else WFalse)\" |\n \"substF (mp) (WEX i p) = (if ((~inPairL (mp, i)) & (~inPairR (mp, i))) then (WEX i (substF (mp)(p))) \n else WFalse)\"\n\nlemma allEX : \"substF([(RVar ''x'', RVar ''m''), (RVar ''y'', RVar ''z'')], \n ((RVar ''x'')[=]Real 2) [&] (WALL ''w'' ((RVar ''w'') [>] (RVar ''z''))))\n = (((RVar ''m'')[=]Real 2) [&] (WALL ''w'' ((RVar ''w'') [>] (RVar ''z''))))\"\napply auto\ndone\n\n\nlemma fact : \"substF ([(RVar ''x'', Real 2), (RVar ''y'', RVar ''z'')]) (RVar ''x'' [>] Real 1) = (Real 2 [>] Real 1)\"\napply (induct, auto)\ndone\n\n\nend\n\n\n\n\n", "meta": {"author": "submission", "repo": "Sim2HCSP", "sha": "b30be89b32d4468091e0c62613db5027f249dbc4", "save_path": "github-repos/isabelle/submission-Sim2HCSP", "path": "github-repos/isabelle/submission-Sim2HCSP/Sim2HCSP-b30be89b32d4468091e0c62613db5027f249dbc4/HHLProver/HCSP_Com.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.28964108303017416}} {"text": "section \\Lasso Finding Algorithm for Generalized B\\\"uchi Graphs \\label{sec:gbg}\\\ntheory Gabow_GBG\nimports \n Gabow_Skeleton \n CAVA_Automata.Lasso\n Find_Path\nbegin\n\n(* TODO: convenience locale, consider merging this with invariants *)\nlocale igb_fr_graph = \n igb_graph G + fr_graph G\n for G :: \"('Q,'more) igb_graph_rec_scheme\"\n\nlemma igb_fr_graphI:\n assumes \"igb_graph G\"\n assumes \"finite ((g_E G)\\<^sup>* `` g_V0 G)\"\n shows \"igb_fr_graph G\"\nproof -\n interpret igb_graph G by fact\n show ?thesis using assms(2) by unfold_locales\nqed\n\ntext \\\n We implement an algorithm that computes witnesses for the \n non-emptiness of Generalized B\\\"uchi Graphs (GBG).\n\\\n\nsection \\Specification\\\ncontext igb_graph\nbegin\n definition ce_correct \n \\ \\Specifies a correct counter-example\\\n where\n \"ce_correct Vr Vl \\ (\\pr pl. \n Vr \\ E\\<^sup>*``V0 \\ Vl \\ E\\<^sup>*``V0 \\ \\Only reachable nodes are covered\\\n \\ set pr\\Vr \\ set pl\\Vl \\ \\The paths are inside the specified sets\\\n \\ Vl\\Vl \\ (E \\ Vl\\Vl)\\<^sup>* \\ \\\\Vl\\ is mutually connected\\\n \\ Vl\\Vl \\ E \\ {} \\ \\\\Vl\\ is non-trivial\\\n \\ is_lasso_prpl (pr,pl)) \\ \\Paths form a lasso\\\n \" \n\n definition find_ce_spec :: \"('Q set \\ 'Q set) option nres\" where\n \"find_ce_spec \\ SPEC (\\r. case r of\n None \\ (\\prpl. \\is_lasso_prpl prpl)\n | Some (Vr,Vl) \\ ce_correct Vr Vl\n )\"\n\n definition find_lasso_spec :: \"('Q list \\ 'Q list) option nres\" where\n \"find_lasso_spec \\ SPEC (\\r. case r of\n None \\ (\\prpl. \\is_lasso_prpl prpl)\n | Some prpl \\ is_lasso_prpl prpl\n )\"\n\nend\n\nsection \\Invariant Extension\\\n\ntext \\Extension of the outer invariant:\\\ncontext igb_fr_graph\nbegin\n definition no_acc_over\n \\ \\Specifies that there is no accepting cycle touching a set of nodes\\\n where\n \"no_acc_over D \\ \\(\\v\\D. \\pl. pl\\[] \\ path E v pl v \\ \n (\\iq\\set pl. i\\acc q))\"\n\n definition \"fgl_outer_invar_ext \\ \\it (brk,D). \n case brk of None \\ no_acc_over D | Some (Vr,Vl) \\ ce_correct Vr Vl\"\n\n definition \"fgl_outer_invar \\ \\it (brk,D). case brk of \n None \\ outer_invar it D \\ no_acc_over D\n | Some (Vr,Vl) \\ ce_correct Vr Vl\"\n \nend\n\ntext \\Extension of the inner invariant:\\\nlocale fgl_invar_loc = \n invar_loc G v0 D0 p D pE \n + igb_graph G\n for G :: \"('Q, 'more) igb_graph_rec_scheme\"\n and v0 D0 and brk :: \"('Q set \\ 'Q set) option\" and p D pE +\n assumes no_acc: \"brk=None \\ \\(\\v pl. pl\\[] \\ path lvE v pl v \\ \n (\\iq\\set pl. i\\acc q))\" \\ \\No accepting cycle over \n visited edges\\\n assumes acc: \"brk=Some (Vr,Vl) \\ ce_correct Vr Vl\"\nbegin\n lemma locale_this: \"fgl_invar_loc G v0 D0 brk p D pE\"\n by unfold_locales\n lemma invar_loc_this: \"invar_loc G v0 D0 p D pE\" by unfold_locales\n lemma eas_gba_graph_this: \"igb_graph G\" by unfold_locales\nend\n\ndefinition (in igb_graph) \"fgl_invar v0 D0 \\ \n \\(brk, p, D, pE). fgl_invar_loc G v0 D0 brk p D pE\"\n\nsection \\Definition of the Lasso-Finding Algorithm\\\n\ncontext igb_fr_graph\nbegin\n definition find_ce :: \"('Q set \\ 'Q set) option nres\" where\n \"find_ce \\ do {\n let D = {};\n (brk,_)\\FOREACHci fgl_outer_invar V0 \n (\\(brk,_). brk=None) \n (\\v0 (brk,D0). do {\n if v0\\D0 then do {\n let s = (None,initial v0 D0);\n\n (brk,p,D,pE) \\ WHILEIT (fgl_invar v0 D0)\n (\\(brk,p,D,pE). brk=None \\ p \\ []) (\\(_,p,D,pE). \n do {\n \\ \\Select edge from end of path\\\n (vo,(p,D,pE)) \\ select_edge (p,D,pE);\n\n ASSERT (p\\[]);\n case vo of \n Some v \\ do {\n if v \\ \\(set p) then do {\n \\ \\Collapse\\\n let (p,D,pE) = collapse v (p,D,pE);\n\n ASSERT (p\\[]);\n\n if \\iq\\last p. i\\acc q then\n RETURN (Some (\\(set (butlast p)),last p),p,D,pE)\n else\n RETURN (None,p,D,pE)\n } else if v\\D then do {\n \\ \\Edge to new node. Append to path\\\n RETURN (None,push v (p,D,pE))\n } else RETURN (None,p,D,pE)\n }\n | None \\ do {\n \\ \\No more outgoing edges from current node on path\\\n ASSERT (pE \\ last p \\ UNIV = {});\n RETURN (None,pop (p,D,pE))\n }\n }) s;\n ASSERT (brk=None \\ (p=[] \\ pE={}));\n RETURN (brk,D)\n } else \n RETURN (brk,D0)\n }) (None,D);\n RETURN brk\n }\"\nend\n\nsection \\Invariant Preservation\\\n\n\ncontext igb_fr_graph\nbegin\n\n definition \"fgl_invar_part \\ \\(brk, p, D, pE). \n fgl_invar_loc_axioms G brk p D pE\"\n\n lemma fgl_outer_invarI[intro?]:\n \"\\\n brk=None \\ outer_invar it D; \n \\brk=None \\ outer_invar it D\\ \\ fgl_outer_invar_ext it (brk,D)\\ \n \\ fgl_outer_invar it (brk,D)\"\n unfolding outer_invar_def fgl_outer_invar_ext_def fgl_outer_invar_def\n apply (auto split: prod.splits option.splits)\n done\n\n lemma fgl_invarI[intro?]:\n \"\\ invar v0 D0 PDPE; \n invar v0 D0 PDPE \\ fgl_invar_part (B,PDPE)\\ \n \\ fgl_invar v0 D0 (B,PDPE)\"\n unfolding invar_def fgl_invar_part_def fgl_invar_def\n apply (simp split: prod.split_asm)\n apply intro_locales\n apply (simp add: invar_loc_def)\n apply assumption\n done\n\n\n lemma fgl_invar_initial: \n assumes OINV: \"fgl_outer_invar it (None,D0)\"\n assumes A: \"v0\\it\" \"v0\\D0\"\n shows \"fgl_invar_part (None, initial v0 D0)\"\n proof -\n from OINV interpret outer_invar_loc G it D0 \n by (simp add: fgl_outer_invar_def outer_invar_def)\n\n from OINV have no_acc: \"no_acc_over D0\"\n by (simp add: fgl_outer_invar_def fgl_outer_invar_ext_def)\n\n {\n fix v pl\n\n assume \"pl \\ []\" and P: \"path (vE [{v0}] D0 (E \\ {v0} \\ UNIV)) v pl v\"\n hence 1: \"v\\D0\"\n by (cases pl) (auto simp: path_cons_conv vE_def touched_def)\n have 2: \"path E v pl v\" using path_mono[OF vE_ss_E P] .\n note 1 2\n } note AUX1=this\n\n\n show ?thesis\n unfolding fgl_invar_part_def\n apply (simp split: prod.splits add: initial_def)\n apply unfold_locales\n using \\v0\\D0\\\n using AUX1 no_acc unfolding no_acc_over_def apply blast\n by simp\n qed\n\n lemma fgl_invar_pop:\n assumes INV: \"fgl_invar v0 D0 (None,p,D,pE)\"\n assumes INV': \"invar v0 D0 (pop (p,D,pE))\"\n assumes NE[simp]: \"p\\[]\"\n assumes NO': \"pE \\ last p \\ UNIV = {}\"\n shows \"fgl_invar_part (None, pop (p,D,pE))\"\n proof -\n from INV interpret fgl_invar_loc G v0 D0 None p D pE \n by (simp add: fgl_invar_def)\n\n show ?thesis\n apply (unfold fgl_invar_part_def pop_def)\n apply (simp split: prod.splits)\n apply unfold_locales\n unfolding vE_pop[OF NE]\n\n using no_acc apply auto []\n apply simp\n done\n qed\n\n lemma fgl_invar_collapse_ce_aux:\n assumes INV: \"invar v0 D0 (p, D, pE)\"\n assumes NE[simp]: \"p\\[]\"\n assumes NONTRIV: \"vE p D pE \\ (last p \\ last p) \\ {}\"\n assumes ACC: \"\\iq\\last p. i\\acc q\"\n shows \"fgl_invar_part (Some (\\(set (butlast p)), last p), p, D, pE)\"\n proof -\n from INV interpret invar_loc G v0 D0 p D pE by (simp add: invar_def)\n txt \\The last collapsed node on the path contains states from all \n accepting sets.\n As it is strongly connected and reachable, we get a counter-example. \n Here, we explicitely construct the lasso.\\\n\n let ?Er = \"E \\ (\\(set (butlast p)) \\ UNIV)\"\n\n txt \\We choose a node in the last Cnode, that is reachable only using\n former Cnodes.\\\n\n obtain w where \"(v0,w)\\?Er\\<^sup>*\" \"w\\last p\"\n proof cases\n assume \"length p = 1\"\n hence \"v0\\last p\"\n using root_v0 \n by (cases p) auto\n thus thesis by (auto intro: that)\n next\n assume \"length p\\1\"\n hence \"length p > 1\" by (cases p) auto\n hence \"Suc (length p - 2) < length p\" by auto\n from p_connected'[OF this] obtain u v where\n UIP: \"u\\p!(length p - 2)\" and VIP: \"v\\p!(length p - 1)\" and \"(u,v)\\lvE\"\n using \\length p > 1\\ by auto\n from root_v0 have V0IP: \"v0\\p!0\" by (cases p) auto\n \n from VIP have \"v\\last p\" by (cases p rule: rev_cases) auto\n\n from pathI[OF V0IP UIP] \\length p > 1\\ have \n \"(v0,u)\\(lvE \\ \\(set (butlast p)) \\ \\(set (butlast p)))\\<^sup>*\"\n (is \"_ \\ \\\\<^sup>*\") \n by (simp add: path_seg_butlast)\n also have \"\\ \\ ?Er\" using lvE_ss_E by auto\n finally (rtrancl_mono_mp[rotated]) have \"(v0,u)\\?Er\\<^sup>*\" .\n also note \\(u,v)\\lvE\\ UIP hence \"(u,v)\\?Er\" using lvE_ss_E \\length p > 1\\ \n apply (auto simp: Bex_def in_set_conv_nth)\n by (metis One_nat_def Suc_lessE \\Suc (length p - 2) < length p\\ \n diff_Suc_1 length_butlast nth_butlast)\n finally show ?thesis by (rule that) fact \n qed\n then obtain \"pr\" where \n P_REACH: \"path E v0 pr w\" and \n R_SS: \"set pr \\ \\(set (butlast p))\"\n apply -\n apply (erule rtrancl_is_path)\n apply (frule path_nodes_edges)\n apply (auto \n dest!: order_trans[OF _ image_Int_subset] \n dest: path_mono[of _ E, rotated])\n done\n\n have [simp]: \"last p = p!(length p - 1)\" by (cases p rule: rev_cases) auto\n\n txt \\From that node, we construct a lasso by inductively appending a path\n for each accepting set\\\n {\n fix na\n assume na_def: \"na = num_acc\"\n\n have \"\\pl. pl\\[] \n \\ path (lvE \\ last p\\last p) w pl w \n \\ (\\iq\\set pl. i\\acc q)\"\n using ACC\n unfolding na_def[symmetric]\n proof (induction na)\n case 0 \n\n from NONTRIV obtain u v \n where \"(u,v)\\lvE \\ last p \\ last p\" \"u\\last p\" \"v\\last p\"\n by auto\n from cnode_connectedI \\w\\last p\\ \\u\\last p\\ \n have \"(w,u)\\(lvE \\ last p \\ last p)\\<^sup>*\"\n by auto\n also note \\(u,v)\\lvE \\ last p \\ last p\\\n also (rtrancl_into_trancl1) from cnode_connectedI \\v\\last p\\ \\w\\last p\\ \n have \"(v,w)\\(lvE \\ last p \\ last p)\\<^sup>*\"\n by auto\n finally obtain pl where \"pl\\[]\" \"path (lvE \\ last p \\ last p) w pl w\"\n by (rule trancl_is_path)\n thus ?case by auto\n next\n case (Suc n)\n from Suc.prems have \"\\iq\\last p. i\\acc q\" by auto\n with Suc.IH obtain pl where IH: \n \"pl\\[]\" \n \"path (lvE \\ last p \\ last p) w pl w\" \n \"\\iq\\set pl. i\\acc q\" \n by blast\n \n from Suc.prems obtain v where \"v\\last p\" and \"n\\acc v\" by auto\n from cnode_connectedI \\w\\last p\\ \\v\\last p\\ \n have \"(w,v)\\(lvE \\ last p \\ last p)\\<^sup>*\" by auto\n then obtain pl1 where P1: \"path (lvE \\ last p \\ last p) w pl1 v\" \n by (rule rtrancl_is_path)\n also from cnode_connectedI \\w\\last p\\ \\v\\last p\\ \n have \"(v,w)\\(lvE \\ last p \\ last p)\\<^sup>*\" by auto\n then obtain pl2 where P2: \"path (lvE \\ last p \\ last p) v pl2 w\"\n by (rule rtrancl_is_path)\n also (path_conc) note IH(2)\n finally (path_conc) have \n P: \"path (lvE \\ last p \\ last p) w (pl1@pl2@pl) w\"\n by simp\n moreover from IH(1) have \"pl1@pl2@pl \\ []\" by simp\n moreover have \"\\i'q\\set (pl1@pl2@pl). i'\\acc q\" using IH(3) by auto\n moreover have \"v\\set (pl1@pl2@pl)\" using P1 P2 P IH(1)\n apply (cases pl2, simp_all add: path_cons_conv path_conc_conv)\n apply (cases pl, simp_all add: path_cons_conv)\n apply (cases pl1, simp_all add: path_cons_conv)\n done\n with \\n\\acc v\\ have \"\\q\\set (pl1@pl2@pl). n\\acc q\" by auto\n ultimately show ?case\n apply (intro exI conjI)\n apply assumption+\n apply (auto elim: less_SucE)\n done\n qed\n }\n then obtain pl where pl: \"pl\\[]\" \"path (lvE \\ last p\\last p) w pl w\" \n \"\\iq\\set pl. i\\acc q\" by blast\n hence \"path E w pl w\" and L_SS: \"set pl \\ last p\"\n apply -\n apply (frule path_mono[of _ E, rotated])\n using lvE_ss_E\n apply auto [2]\n\n apply (drule path_nodes_edges)\n apply (drule order_trans[OF _ image_Int_subset])\n apply auto []\n done\n\n have LASSO: \"is_lasso_prpl (pr,pl)\"\n unfolding is_lasso_prpl_def is_lasso_prpl_pre_def\n using \\path E w pl w\\ P_REACH pl by auto\n \n from p_sc have \"last p \\ last p \\ (lvE \\ last p \\ last p)\\<^sup>*\" by auto\n with lvE_ss_E have VL_CLOSED: \"last p \\ last p \\ (E \\ last p \\ last p)\\<^sup>*\"\n apply (erule_tac order_trans)\n apply (rule rtrancl_mono)\n by blast\n\n have NONTRIV': \"last p \\ last p \\ E \\ {}\"\n by (metis Int_commute NONTRIV disjoint_mono lvE_ss_E subset_refl)\n\n from order_trans[OF path_touched touched_reachable]\n have LP_REACH: \"last p \\ E\\<^sup>*``V0\" \n and BLP_REACH: \"\\(set (butlast p)) \\ E\\<^sup>*``V0\"\n apply -\n apply (cases p rule: rev_cases)\n apply simp\n apply auto []\n\n apply (cases p rule: rev_cases)\n apply simp\n apply auto []\n done\n \n show ?thesis\n apply (simp add: fgl_invar_part_def)\n apply unfold_locales\n apply simp\n\n using LASSO R_SS L_SS VL_CLOSED NONTRIV' LP_REACH BLP_REACH\n unfolding ce_correct_def \n apply simp \n apply blast\n done\n\n qed\n\n lemma fgl_invar_collapse_ce:\n fixes u v\n assumes INV: \"fgl_invar v0 D0 (None,p,D,pE)\"\n defines \"pE' \\ pE - {(u,v)}\"\n assumes CFMT: \"(p',D',pE'') = collapse v (p,D,pE')\"\n assumes INV': \"invar v0 D0 (p',D',pE'')\"\n assumes NE[simp]: \"p\\[]\"\n assumes E: \"(u,v)\\pE\" and \"u\\last p\"\n assumes BACK: \"v\\\\(set p)\"\n assumes ACC: \"\\iq\\last p'. i\\acc q\"\n defines i_def: \"i \\ idx_of p v\"\n shows \"fgl_invar_part (\n Some (\\(set (butlast p')), last p'), \n collapse v (p,D,pE'))\"\n proof -\n\n from CFMT have p'_def: \"p' = collapse_aux p i\" and [simp]: \"D'=D\" \"pE''=pE'\"\n by (simp_all add: collapse_def i_def)\n\n from INV interpret fgl_invar_loc G v0 D0 None p D pE \n by (simp add: fgl_invar_def)\n\n from idx_of_props[OF BACK] have \"ip!i\" \n by (simp_all add: i_def)\n\n have \"u\\last p'\" \n using \\u\\last p\\ \\i \n unfolding p'_def collapse_aux_def\n apply (simp add: last_drop last_snoc)\n by (metis Misc.last_in_set drop_eq_Nil last_drop not_le)\n moreover have \"v\\last p'\" \n using \\v\\p!i\\ \\i \n unfolding p'_def collapse_aux_def\n by (metis UnionI append_Nil Cons_nth_drop_Suc in_set_conv_decomp last_snoc)\n ultimately have \"vE p' D pE' \\ last p' \\ last p' \\ {}\" \n unfolding p'_def pE'_def by (auto simp: E)\n \n have \"p'\\[]\" by (simp add: p'_def collapse_aux_def)\n\n have [simp]: \"collapse v (p,D,pE') = (p',D,pE')\" \n unfolding collapse_def p'_def i_def\n by simp\n\n show ?thesis\n apply simp\n apply (rule fgl_invar_collapse_ce_aux) \n using INV' apply simp\n apply fact+\n done\n qed\n\n lemma fgl_invar_collapse_nce:\n fixes u v\n assumes INV: \"fgl_invar v0 D0 (None,p,D,pE)\"\n defines \"pE' \\ pE - {(u,v)}\"\n assumes CFMT: \"(p',D',pE'') = collapse v (p,D,pE')\"\n assumes INV': \"invar v0 D0 (p',D',pE'')\"\n assumes NE[simp]: \"p\\[]\"\n assumes E: \"(u,v)\\pE\" and \"u\\last p\"\n assumes BACK: \"v\\\\(set p)\"\n assumes NACC: \"jq\\last p'. j\\acc q\"\n defines \"i \\ idx_of p v\"\n shows \"fgl_invar_part (None, collapse v (p,D,pE'))\"\n proof -\n from CFMT have p'_def: \"p' = collapse_aux p i\" and [simp]: \"D'=D\" \"pE''=pE'\"\n by (simp_all add: collapse_def i_def)\n\n have [simp]: \"collapse v (p,D,pE') = (p',D,pE')\" \n by (simp add: collapse_def p'_def i_def)\n\n from INV interpret fgl_invar_loc G v0 D0 None p D pE \n by (simp add: fgl_invar_def)\n\n from INV' interpret inv': invar_loc G v0 D0 p' D pE' by (simp add: invar_def)\n\n define vE' where \"vE' = vE p' D pE'\"\n\n have vE'_alt: \"vE' = insert (u,v) lvE\"\n by (simp add: vE'_def p'_def pE'_def E)\n\n from idx_of_props[OF BACK] have \"ip!i\" \n by (simp_all add: i_def)\n\n have \"u\\last p'\" \n using \\u\\last p\\ \\i\n unfolding p'_def collapse_aux_def\n apply (simp add: last_drop last_snoc)\n by (metis Misc.last_in_set drop_eq_Nil last_drop leD)\n moreover have \"v\\last p'\" \n using \\v\\p!i\\ \\i \n unfolding p'_def collapse_aux_def\n by (metis UnionI append_Nil Cons_nth_drop_Suc in_set_conv_decomp last_snoc)\n ultimately have \"vE' \\ last p' \\ last p' \\ {}\" \n unfolding vE'_alt by (auto)\n \n have \"p'\\[]\" by (simp add: p'_def collapse_aux_def)\n\n {\n txt \\\n We show that no visited strongly connected component contains states\n from all acceptance sets.\\\n fix w pl\n txt \\For this, we chose a non-trivial loop inside the visited edges\\\n assume P: \"path vE' w pl w\" and NT: \"pl\\[]\"\n txt \\And show that there is one acceptance set disjoint with the nodes\n of the loop\\\n have \"\\iq\\set pl. i\\acc q\"\n proof cases\n assume \"set pl \\ last p' = {}\" \n \\ \\Case: The loop is outside the last Cnode\\\n with path_restrict[OF P] \\u\\last p'\\ \\v\\last p'\\ have \"path lvE w pl w\"\n apply -\n apply (drule path_mono[of _ lvE, rotated])\n unfolding vE'_alt\n by auto\n with no_acc NT show ?thesis by auto\n next\n assume \"set pl \\ last p' \\ {}\" \n \\ \\Case: The loop touches the last Cnode\\\n txt \\Then, the loop must be completely inside the last CNode\\\n from inv'.loop_in_lastnode[folded vE'_def, OF P \\p'\\[]\\ this] \n have \"w\\last p'\" \"set pl \\ last p'\" .\n with NACC show ?thesis by blast\n qed\n } note AUX_no_acc = this\n\n show ?thesis\n apply (simp add: fgl_invar_part_def)\n apply unfold_locales\n using AUX_no_acc[unfolded vE'_def] apply auto []\n \n apply simp\n done\n qed\n\n lemma collapse_ne: \"([],D',pE') \\ collapse v (p,D,pE)\"\n by (simp add: collapse_def collapse_aux_def Let_def)\n\n lemma fgl_invar_push:\n assumes INV: \"fgl_invar v0 D0 (None,p,D,pE)\"\n assumes BRK[simp]: \"brk=None\" \n assumes NE[simp]: \"p\\[]\"\n assumes E: \"(u,v)\\pE\" and UIL: \"u\\last p\"\n assumes VNE: \"v\\\\(set p)\" \"v\\D\"\n assumes INV': \"invar v0 D0 (push v (p,D,pE - {(u,v)}))\"\n shows \"fgl_invar_part (None, push v (p,D,pE - {(u,v)}))\"\n proof -\n from INV interpret fgl_invar_loc G v0 D0 None p D pE \n by (simp add: fgl_invar_def)\n\n define pE' where \"pE' = (pE - {(u,v)} \\ E\\{v}\\UNIV)\"\n\n have [simp]: \"push v (p,D,pE - {(u,v)}) = (p@[{v}],D,pE')\"\n by (simp add: push_def pE'_def)\n\n from INV' interpret inv': invar_loc G v0 D0 \"(p@[{v}])\" D \"pE'\"\n by (simp add: invar_def)\n\n note defs_fold = vE_push[OF E UIL VNE, folded pE'_def]\n\n {\n txt \\We show that there still is no loop that contains all accepting\n nodes. For this, we choose some loop.\\\n fix w pl\n assume P: \"path (insert (u,v) lvE) w pl w\" and [simp]: \"pl\\[]\"\n have \"\\iq\\set pl. i\\acc q\" \n proof cases\n assume \"v\\set pl\" \\ \\Case: The newly pushed last cnode is on the loop\\\n txt \\Then the loop is entirely on the last cnode\\\n with inv'.loop_in_lastnode[unfolded defs_fold, OF P]\n have [simp]: \"w=v\" and SPL: \"set pl = {v}\" by auto\n txt \\However, we then either have that the last cnode is contained in\n the last but one cnode, or that there is a visited edge inside the\n last cnode.\\\n from P SPL have \"u=v \\ (v,v)\\lvE\" \n apply (cases pl) apply (auto simp: path_cons_conv)\n apply (case_tac list)\n apply (auto simp: path_cons_conv)\n done\n txt \\Both leads to a contradiction\\\n hence False proof\n assume \"u=v\" \\ \\This is impossible, as @{text \"u\"} was on the \n original path, but @{text \"v\"} was not\\\n with UIL VNE show False by auto\n next\n assume \"(v,v)\\lvE\" \\ \\This is impossible, as all visited edges are\n from touched nodes, but @{text \"v\"} was untouched\\\n with vE_touched VNE show False unfolding touched_def by auto\n qed\n thus ?thesis ..\n next\n assume A: \"v\\set pl\" \n \\ \\Case: The newly pushed last cnode is not on the loop\\\n txt \\Then, the path lays inside the old visited edges\\\n have \"path lvE w pl w\" \n proof -\n have \"w\\set pl\" using P by (cases pl) (auto simp: path_cons_conv)\n with A show ?thesis using path_restrict[OF P]\n apply -\n apply (drule path_mono[of _ lvE, rotated])\n apply (cases pl, auto) []\n \n apply assumption\n done\n qed\n txt \\And thus, the proposition follows from the invariant on the old\n state\\\n with no_acc show ?thesis \n apply simp\n using \\pl\\[]\\ \n by blast\n qed\n } note AUX_no_acc = this\n\n show ?thesis\n unfolding fgl_invar_part_def\n apply simp\n apply unfold_locales\n unfolding defs_fold\n\n using AUX_no_acc apply auto []\n \n apply simp\n done\n qed\n\n\n lemma fgl_invar_skip:\n assumes INV: \"fgl_invar v0 D0 (None,p,D,pE)\"\n assumes BRK[simp]: \"brk=None\" \n assumes NE[simp]: \"p\\[]\"\n assumes E: \"(u,v)\\pE\" and UIL: \"u\\last p\"\n assumes VID: \"v\\D\"\n assumes INV': \"invar v0 D0 (p, D, (pE - {(u,v)}))\"\n shows \"fgl_invar_part (None, p, D, (pE - {(u,v)}))\"\n proof -\n from INV interpret fgl_invar_loc G v0 D0 None p D pE \n by (simp add: fgl_invar_def)\n from INV' interpret inv': invar_loc G v0 D0 p D \"(pE - {(u,v)})\" \n by (simp add: invar_def)\n\n {\n txt \\We show that there still is no loop that contains all accepting\n nodes. For this, we choose some loop.\\\n fix w pl\n assume P: \"path (insert (u,v) lvE) w pl w\" and [simp]: \"pl\\[]\"\n from P have \"\\iq\\set pl. i\\acc q\" \n proof (cases rule: path_edge_rev_cases)\n case no_use \\ \\Case: The loop does not use the new edge\\\n txt \\The proposition follows from the invariant for the old state\\\n with no_acc show ?thesis \n apply simp\n using \\pl\\[]\\ \n by blast\n next\n case (split p1 p2) \\ \\Case: The loop uses the new edge\\\n txt \\As done is closed under transitions, the nodes of the edge have\n already been visited\\\n from split(2) D_closed_vE_rtrancl \n have WID: \"w\\D\" \n using VID by (auto dest!: path_is_rtrancl)\n from split(1) WID D_closed_vE_rtrancl have \"u\\D\"\n apply (cases rule: path_edge_cases)\n apply (auto dest!: path_is_rtrancl)\n done\n txt \\Which is a contradition to the assumptions\\\n with UIL p_not_D have False by (cases p rule: rev_cases) auto\n thus ?thesis ..\n qed\n } note AUX_no_acc = this\n\n\n show ?thesis \n apply (simp add: fgl_invar_part_def)\n apply unfold_locales\n unfolding vE_remove[OF NE E]\n\n using AUX_no_acc apply auto []\n\n apply simp\n done\n\n qed\n\n lemma fgl_outer_invar_initial: \n \"outer_invar V0 {} \\ fgl_outer_invar_ext V0 (None, {})\"\n unfolding fgl_outer_invar_ext_def\n apply (simp add: no_acc_over_def)\n done\n\n lemma fgl_outer_invar_brk:\n assumes INV: \"fgl_invar v0 D0 (Some (Vr,Vl),p,D,pE)\"\n shows \"fgl_outer_invar_ext anyIt (Some (Vr,Vl), anyD)\"\n proof -\n from INV interpret fgl_invar_loc G v0 D0 \"Some (Vr,Vl)\" p D pE\n by (simp add: fgl_invar_def)\n\n from acc show ?thesis by (simp add: fgl_outer_invar_ext_def)\n qed\n\n lemma fgl_outer_invar_newnode_nobrk:\n assumes A: \"v0\\D0\" \"v0\\it\" \n assumes OINV: \"fgl_outer_invar it (None,D0)\"\n assumes INV: \"fgl_invar v0 D0 (None,[],D',pE)\"\n shows \"fgl_outer_invar_ext (it-{v0}) (None,D')\"\n proof -\n from OINV interpret outer_invar_loc G it D0 \n unfolding fgl_outer_invar_def outer_invar_def by simp\n\n from INV interpret inv: fgl_invar_loc G v0 D0 None \"[]\" D' pE \n unfolding fgl_invar_def by simp\n\n from inv.pE_fin have [simp]: \"pE = {}\" by simp\n\n { fix v pl\n assume A: \"v\\D'\" \"path E v pl v\"\n have \"path (E \\ D' \\ UNIV) v pl v\"\n apply (rule path_mono[OF _ path_restrict_closed[OF inv.D_closed A]])\n by auto\n } note AUX1=this\n\n show ?thesis\n unfolding fgl_outer_invar_ext_def\n apply simp\n using inv.no_acc AUX1 \n apply (auto simp add: vE_def touched_def no_acc_over_def) []\n done\n qed\n\n lemma fgl_outer_invar_newnode:\n assumes A: \"v0\\D0\" \"v0\\it\" \n assumes OINV: \"fgl_outer_invar it (None,D0)\"\n assumes INV: \"fgl_invar v0 D0 (brk,p,D',pE)\"\n assumes CASES: \"(\\Vr Vl. brk = Some (Vr, Vl)) \\ p = []\"\n shows \"fgl_outer_invar_ext (it-{v0}) (brk,D')\"\n using CASES\n apply (elim disjE1)\n using fgl_outer_invar_brk[of v0 D0 _ _ p D' pE] INV \n apply - \n apply (auto, assumption) []\n using fgl_outer_invar_newnode_nobrk[OF A] OINV INV apply auto []\n done\n\n lemma fgl_outer_invar_Dnode:\n assumes \"fgl_outer_invar it (None, D)\" \"v\\D\"\n shows \"fgl_outer_invar_ext (it - {v}) (None, D)\"\n using assms\n by (auto simp: fgl_outer_invar_def fgl_outer_invar_ext_def)\n\n \n lemma fgl_fin_no_lasso:\n assumes A: \"fgl_outer_invar {} (None, D)\"\n assumes B: \"is_lasso_prpl prpl\"\n shows \"False\"\n proof -\n obtain \"pr\" pl where [simp]: \"prpl = (pr,pl)\" by (cases prpl)\n from A have NA: \"no_acc_over D\" \n by (simp add: fgl_outer_invar_def fgl_outer_invar_ext_def)\n\n from A have \"outer_invar {} D\" by (simp add: fgl_outer_invar_def)\n with fin_outer_D_is_reachable have [simp]: \"D=E\\<^sup>*``V0\" by simp\n\n from NA B show False\n apply (simp add: no_acc_over_def is_lasso_prpl_def is_lasso_prpl_pre_def)\n apply clarsimp\n apply (blast dest: path_is_rtrancl)\n done\n qed\n\n lemma fgl_fin_lasso:\n assumes A: \"fgl_outer_invar it (Some (Vr,Vl), D)\"\n shows \"ce_correct Vr Vl\"\n using A by (simp add: fgl_outer_invar_def fgl_outer_invar_ext_def)\n\n\n lemmas fgl_invar_preserve = \n fgl_invar_initial fgl_invar_push fgl_invar_pop \n fgl_invar_collapse_ce fgl_invar_collapse_nce fgl_invar_skip\n fgl_outer_invar_newnode fgl_outer_invar_Dnode\n invar_initial outer_invar_initial fgl_invar_initial fgl_outer_invar_initial\n fgl_fin_no_lasso fgl_fin_lasso\n\nend\n\nsection \\Main Correctness Proof\\\n\ncontext igb_fr_graph\nbegin\n lemma outer_invar_from_fgl_invarI: \n \"fgl_outer_invar it (None,D) \\ outer_invar it D\"\n unfolding fgl_outer_invar_def outer_invar_def\n by (simp split: prod.splits)\n\n lemma invar_from_fgl_invarI: \"fgl_invar v0 D0 (B,PDPE) \\ invar v0 D0 PDPE\"\n unfolding fgl_invar_def invar_def\n apply (simp split: prod.splits)\n unfolding fgl_invar_loc_def by simp\n \n theorem find_ce_correct: \"find_ce \\ find_ce_spec\"\n proof -\n note [simp del] = Union_iff\n\n show ?thesis\n unfolding find_ce_def find_ce_spec_def select_edge_def select_def\n apply (refine_rcg\n WHILEIT_rule[where R=\"inv_image (abs_wf_rel v0) snd\" for v0]\n refine_vcg \n )\n \n using [[goals_limit = 5]]\n\n apply (vc_solve\n rec: fgl_invarI fgl_outer_invarI\n intro: invar_from_fgl_invarI outer_invar_from_fgl_invarI\n dest!: sym[of \"collapse a b\" for a b]\n simp: collapse_ne\n simp: pE_fin'[OF invar_from_fgl_invarI] finite_V0\n solve: invar_preserve \n solve: asm_rl[of \"_ \\ _ = {}\"]\n solve: fgl_invar_preserve)\n done\n qed\nend\n\nsection \"Emptiness Check\"\ntext \\Using the lasso-finding algorithm, we can define an emptiness check\\\n\ncontext igb_fr_graph\nbegin\n definition \"abs_is_empty \\ do {\n ce \\ find_ce;\n RETURN (ce = None)\n }\"\n\n theorem abs_is_empty_correct: \n \"abs_is_empty \\ SPEC (\\res. res \\ (\\r. \\is_acc_run r))\"\n unfolding abs_is_empty_def\n apply (refine_rcg refine_vcg \n order_trans[OF find_ce_correct, unfolded find_ce_spec_def])\n unfolding ce_correct_def\n using lasso_accepted accepted_lasso\n apply (clarsimp split: option.splits)\n apply (metis is_lasso_prpl_of_lasso surj_pair)\n by (metis is_lasso_prpl_conv)\n\n definition \"abs_is_empty_ce \\ do {\n ce \\ find_ce;\n case ce of\n None \\ RETURN None\n | Some (Vr,Vl) \\ do {\n ASSERT (\\pr pl. set pr \\ Vr \\ set pl \\ Vl \\ Vl \\ Vl \\ (E \\ Vl\\Vl)\\<^sup>* \n \\ is_lasso_prpl (pr,pl));\n (pr,pl) \\ SPEC (\\(pr,pl). \n set pr \\ Vr \n \\ set pl \\ Vl \n \\ Vl \\ Vl \\ (E \\ Vl\\Vl)\\<^sup>*\n \\ is_lasso_prpl (pr,pl));\n RETURN (Some (pr,pl))\n }\n }\"\n\n theorem abs_is_empty_ce_correct: \"abs_is_empty_ce \\ SPEC (\\res. case res of\n None \\ (\\r. \\is_acc_run r)\n | Some (pr,pl) \\ is_acc_run (pr\\pl\\<^sup>\\)\n )\"\n unfolding abs_is_empty_ce_def\n apply (refine_rcg refine_vcg \n order_trans[OF find_ce_correct, unfolded find_ce_spec_def])\n\n apply (clarsimp_all simp: ce_correct_def)\n\n using accepted_lasso finite_reachableE_V0 apply (metis is_lasso_prpl_of_lasso surj_pair)\n apply blast\n apply (simp add: lasso_prpl_acc_run)\n done\n\nend\n\nsection \\Refinement\\\ntext \\\n In this section, we refine the lasso finding algorithm to use efficient\n data structures. First, we explicitely keep track of the set of acceptance\n classes for every c-node on the path. Second, we use Gabow's data structure\n to represent the path.\n\\\n\nsubsection \\Addition of Explicit Accepting Sets\\\ntext \\In a first step, we explicitely keep track of the current set of\n acceptance classes for every c-node on the path.\\\n\ntype_synonym 'a abs_gstate = \"nat set list \\ 'a abs_state\"\ntype_synonym 'a ce = \"('a set \\ 'a set) option\"\ntype_synonym 'a abs_gostate = \"'a ce \\ 'a set\"\n\ncontext igb_fr_graph\nbegin\n\n definition gstate_invar :: \"'Q abs_gstate \\ bool\" where \n \"gstate_invar \\ \\(a,p,D,pE). a = map (\\V. \\(acc`V)) p\"\n\n definition \"gstate_rel \\ br snd gstate_invar\"\n\n lemma gstate_rel_sv[relator_props,simp,intro!]: \"single_valued gstate_rel\"\n by (simp add: gstate_rel_def)\n\n definition (in -) gcollapse_aux \n :: \"nat set list \\ 'a set list \\ nat \\ nat set list \\ 'a set list\"\n where \"gcollapse_aux a p i \\ \n (take i a @ [\\(set (drop i a))],take i p @ [\\(set (drop i p))])\"\n\n definition (in -) gcollapse :: \"'a \\ 'a abs_gstate \\ 'a abs_gstate\" \n where \"gcollapse v APDPE \\ \n let \n (a,p,D,pE)=APDPE; \n i=idx_of p v;\n (a,p) = gcollapse_aux a p i\n in (a,p,D,pE)\"\n\n definition \"gpush v s \\ \n let\n (a,s) = s\n in\n (a@[acc v],push v s)\"\n\n definition \"gpop s \\\n let (a,s) = s in (butlast a,pop s)\"\n\n definition ginitial :: \"'Q \\ 'Q abs_gostate \\ 'Q abs_gstate\" \n where \"ginitial v0 s0 \\ ([acc v0], initial v0 (snd s0))\"\n\n definition goinitial :: \"'Q abs_gostate\" where \"goinitial \\ (None,{})\"\n definition go_is_no_brk :: \"'Q abs_gostate \\ bool\" \n where \"go_is_no_brk s \\ fst s = None\"\n definition goD :: \"'Q abs_gostate \\ 'Q set\" where \"goD s \\ snd s\"\n definition goBrk :: \"'Q abs_gostate \\ 'Q ce\" where \"goBrk s \\ fst s\"\n definition gto_outer :: \"'Q ce \\ 'Q abs_gstate \\ 'Q abs_gostate\" \n where \"gto_outer brk s \\ let (A,p,D,pE)=s in (brk,D)\"\n\n definition \"gselect_edge s \\ do {\n let (a,s)=s; \n (r,s)\\select_edge s;\n RETURN (r,a,s) \n }\"\n\n definition gfind_ce :: \"('Q set \\ 'Q set) option nres\" where\n \"gfind_ce \\ do {\n let os = goinitial;\n os\\FOREACHci fgl_outer_invar V0 (go_is_no_brk) (\\v0 s0. do {\n if v0\\goD s0 then do {\n let s = (None,ginitial v0 s0);\n\n (brk,a,p,D,pE) \\ WHILEIT (\\(brk,a,s). fgl_invar v0 (goD s0) (brk,s))\n (\\(brk,a,p,D,pE). brk=None \\ p \\ []) (\\(_,a,p,D,pE). \n do {\n \\ \\Select edge from end of path\\\n (vo,(a,p,D,pE)) \\ gselect_edge (a,p,D,pE);\n\n ASSERT (p\\[]);\n case vo of \n Some v \\ do {\n if v \\ \\(set p) then do {\n \\ \\Collapse\\\n let (a,p,D,pE) = gcollapse v (a,p,D,pE);\n\n ASSERT (p\\[]);\n ASSERT (a\\[]);\n\n if last a = {0..(set (butlast p)),last p),a,p,D,pE)\n else\n RETURN (None,a,p,D,pE)\n } else if v\\D then do {\n \\ \\Edge to new node. Append to path\\\n RETURN (None,gpush v (a,p,D,pE))\n } else RETURN (None,a,p,D,pE)\n }\n | None \\ do {\n \\ \\No more outgoing edges from current node on path\\\n ASSERT (pE \\ last p \\ UNIV = {});\n RETURN (None,gpop (a,p,D,pE))\n }\n }) s;\n ASSERT (brk=None \\ (p=[] \\ pE={}));\n RETURN (gto_outer brk (a,p,D,pE))\n } else RETURN s0\n }) os;\n RETURN (goBrk os)\n }\"\n\n lemma gcollapse_refine:\n \"\\(v',v)\\Id; (s',s)\\gstate_rel\\ \n \\ (gcollapse v' s',collapse v s)\\gstate_rel\"\n unfolding gcollapse_def collapse_def collapse_aux_def gcollapse_aux_def \n apply (simp add: gstate_rel_def br_def Let_def)\n unfolding gstate_invar_def[abs_def]\n apply (auto split: prod.splits simp: take_map drop_map)\n done\n\n \n\n lemma gpop_refine:\n \"\\(s',s)\\gstate_rel\\ \\ (gpop s',pop s)\\gstate_rel\"\n unfolding gpop_def pop_def \n apply (simp add: gstate_rel_def br_def)\n unfolding gstate_invar_def[abs_def]\n apply (auto split: prod.splits simp: map_butlast)\n done\n\n lemma ginitial_refine:\n \"(ginitial x (None, b), initial x b) \\ gstate_rel\"\n unfolding ginitial_def gstate_rel_def br_def gstate_invar_def initial_def\n by auto\n\n lemma oinitial_b_refine: \"((None,{}),(None,{}))\\Id\\\\<^sub>rId\" by simp\n\n lemma gselect_edge_refine: \"\\(s',s)\\gstate_rel\\ \\ gselect_edge s' \n \\\\(\\Id\\option_rel \\\\<^sub>r gstate_rel) (select_edge s)\"\n unfolding gselect_edge_def select_edge_def\n apply (simp add: pw_le_iff refine_pw_simps prod_rel_sv\n split: prod.splits option.splits)\n\n apply (auto simp: gstate_rel_def br_def gstate_invar_def)\n done\n\n lemma last_acc_impl:\n assumes \"p\\[]\"\n assumes \"((a',p',D',pE'),(p,D,pE))\\gstate_rel\"\n shows \"(last a' = {0..iq\\last p. i\\acc q)\"\n using assms acc_bound unfolding gstate_rel_def br_def gstate_invar_def\n by (auto simp: last_map)\n\n lemma fglr_aux1:\n assumes V: \"(v',v)\\Id\" and S: \"(s',s)\\gstate_rel\" \n and P: \"\\a' p' D' pE' p D pE. ((a',p',D',pE'),(p,D,pE))\\gstate_rel \n \\ f' a' p' D' pE' \\\\R (f p D pE)\"\n shows \"(let (a',p',D',pE') = gcollapse v' s' in f' a' p' D' pE') \n \\ \\R (let (p,D,pE) = collapse v s in f p D pE)\"\n apply (auto split: prod.splits)\n apply (rule P)\n using gcollapse_refine[OF V S]\n apply simp\n done\n\n lemma gstate_invar_empty: \n \"gstate_invar (a,[],D,pE) \\ a=[]\"\n \"gstate_invar ([],p,D,pE) \\ p=[]\"\n by (auto simp add: gstate_invar_def)\n\n lemma find_ce_refine: \"gfind_ce \\\\Id find_ce\"\n unfolding gfind_ce_def find_ce_def\n unfolding goinitial_def go_is_no_brk_def[abs_def] goD_def goBrk_def \n gto_outer_def\n using [[goals_limit = 1]]\n apply (refine_rcg \n gselect_edge_refine prod_relI[OF IdI gpop_refine]\n prod_relI[OF IdI gpush_refine]\n fglr_aux1 last_acc_impl oinitial_b_refine\n inj_on_id\n )\n apply refine_dref_type\n apply (simp_all add: ginitial_refine)\n apply (vc_solve (nopre) \n solve: asm_rl \n simp: gstate_rel_def br_def gstate_invar_empty)\n done\nend\n\nsubsection \\Refinement to Gabow's Data Structure\\\n\nsubsubsection \\Preliminaries\\\ndefinition Un_set_drop_impl :: \"nat \\ 'a set list \\ 'a set nres\"\n \\ \\Executable version of @{text \"\\set (drop i A)\"}, using indexing to\n access @{text \"A\"}\\\n where \"Un_set_drop_impl i A \\ \n do {\n (_,res) \\ WHILET (\\(i,res). i < length A) (\\(i,res). do {\n ASSERT (i res;\n let i = i + 1;\n RETURN (i,res)\n }) (i,{});\n RETURN res\n }\"\n\nlemma Un_set_drop_impl_correct: \n \"Un_set_drop_impl i A \\ SPEC (\\r. r=\\(set (drop i A)))\"\n unfolding Un_set_drop_impl_def\n apply (refine_rcg \n WHILET_rule[where I=\"\\(i',res). res=\\(set ((drop i (take i' A)))) \\ i\\i'\" \n and R=\"measure (\\(i',_). length A - i')\"] \n refine_vcg)\n apply (auto simp: take_Suc_conv_app_nth)\n done\n\nschematic_goal Un_set_drop_code_aux: \n assumes [autoref_rules]: \"(es_impl,{})\\\\R\\Rs\"\n assumes [autoref_rules]: \"(un_impl,(\\))\\\\R\\Rs\\\\R\\Rs\\\\R\\Rs\"\n shows \"(?c,Un_set_drop_impl)\\nat_rel \\ \\\\R\\Rs\\as_rel \\ \\\\R\\Rs\\nres_rel\"\n unfolding Un_set_drop_impl_def[abs_def]\n apply (autoref (trace, keep_goal))\n done\nconcrete_definition Un_set_drop_code uses Un_set_drop_code_aux\n\nschematic_goal Un_set_drop_tr_aux: \n \"RETURN ?c \\ Un_set_drop_code es_impl un_impl i A\"\n unfolding Un_set_drop_code_def\n by refine_transfer\nconcrete_definition Un_set_drop_tr for es_impl un_impl i A \n uses Un_set_drop_tr_aux \n\nlemma Un_set_drop_autoref[autoref_rules]: \n assumes \"GEN_OP es_impl {} (\\R\\Rs)\"\n assumes \"GEN_OP un_impl (\\) (\\R\\Rs\\\\R\\Rs\\\\R\\Rs)\"\n shows \"(\\i A. RETURN (Un_set_drop_tr es_impl un_impl i A),Un_set_drop_impl)\n \\nat_rel \\ \\\\R\\Rs\\as_rel \\ \\\\R\\Rs\\nres_rel\"\n apply (intro fun_relI nres_relI)\n apply (rule order_trans[OF Un_set_drop_tr.refine])\n using Un_set_drop_code.refine[of es_impl Rs R un_impl, \n param_fo, THEN nres_relD]\n using assms\n by simp\n\n\nsubsubsection \\Actual Refinement\\\n\ntype_synonym 'Q gGS = \"nat set list \\ 'Q GS\"\n\ntype_synonym 'Q goGS = \"'Q ce \\ 'Q oGS\"\n\ncontext igb_graph\nbegin\n\ndefinition gGS_invar :: \"'Q gGS \\ bool\"\n where \"gGS_invar s \\ \n let (a,S,B,I,P) = s in \n GS_invar (S,B,I,P)\n \\ length a = length B\n \\ \\(set a) \\ {0.. :: \"'Q gGS \\ 'Q abs_gstate\"\n where \"gGS_\\ s \\ let (a,s)=s in (a,GS.\\ s)\"\n\ndefinition \"gGS_rel \\ br gGS_\\ gGS_invar\"\n\nlemma gGS_rel_sv[relator_props,intro!,simp]: \"single_valued gGS_rel\"\n unfolding gGS_rel_def by auto\n\n\ndefinition goGS_invar :: \"'Q goGS \\ bool\" where\n \"goGS_invar s \\ let (brk,ogs)=s in brk=None \\ oGS_invar ogs\"\n\ndefinition \"goGS_\\ s \\ let (brk,ogs)=s in (brk,oGS_\\ ogs)\"\n\ndefinition \"goGS_rel \\ br goGS_\\ goGS_invar\"\n\nlemma goGS_rel_sv[relator_props,intro!,simp]: \"single_valued goGS_rel\"\n unfolding goGS_rel_def by auto\n\nend\n\n\ncontext igb_fr_graph\nbegin\n lemma gGS_relE:\n assumes \"(s',(a,p,D,pE))\\gGS_rel\"\n obtains S' B' I' P' where \"s'=(a,S',B',I',P')\" \n and \"((S',B',I',P'),(p,D,pE))\\GS_rel\" \n and \"length a = length B'\"\n and \"\\(set a) \\ {0.._def GS.\\_def)\n apply (rule that)\n apply (simp only:)\n apply (auto simp: GS_rel_def br_def gGS_invar_def GS.\\_def)\n done\n\n\n definition goinitial_impl :: \"'Q goGS\" \n where \"goinitial_impl \\ (None,Map.empty)\"\n lemma goinitial_impl_refine: \"(goinitial_impl,goinitial)\\goGS_rel\"\n by (auto \n simp: goinitial_impl_def goinitial_def goGS_rel_def br_def \n simp: goGS_\\_def goGS_invar_def oGS_\\_def oGS_invar_def)\n\n definition gto_outer_impl :: \"'Q ce \\ 'Q gGS \\ 'Q goGS\"\n where \"gto_outer_impl brk s \\ let (A,S,B,I,P)=s in (brk,I)\"\n\n lemma gto_outer_refine:\n assumes A: \"brk = None \\ (p=[] \\ pE={})\"\n assumes B: \"(s, (A,p, D, pE)) \\ gGS_rel\"\n assumes C: \"(brk',brk)\\Id\"\n shows \"(gto_outer_impl brk' s,gto_outer brk (A,p,D,pE))\\goGS_rel\"\n proof (cases s)\n fix A S B I P\n assume [simp]: \"s=(A,S,B,I,P)\"\n show ?thesis\n using C\n apply (cases brk)\n using assms I_to_outer[of S B I P D]\n apply (auto \n simp: goGS_rel_def br_def goGS_\\_def gto_outer_def \n gto_outer_impl_def goGS_invar_def \n simp: gGS_rel_def oGS_rel_def GS_rel_def gGS_\\_def gGS_invar_def \n GS.\\_def) []\n\n using B apply (auto \n simp: gto_outer_def gto_outer_impl_def\n simp: br_def goGS_rel_def goGS_invar_def goGS_\\_def oGS_\\_def\n simp: gGS_rel_def gGS_\\_def GS.\\_def GS.D_\\_def\n )\n\n done\n qed\n\n definition \"gpush_impl v s \\ let (a,s)=s in (a@[acc v], push_impl v s)\"\n\n\n lemma gpush_impl_refine:\n assumes B: \"(s',(a,p,D,pE))\\gGS_rel\"\n assumes A: \"(v',v)\\Id\" \n assumes PRE: \"v' \\ \\(set p)\" \"v' \\ D\"\n shows \"(gpush_impl v' s', gpush v (a,p,D,pE))\\gGS_rel\"\n proof -\n from B obtain S' B' I' P' where [simp]: \"s'=(a,S',B',I',P')\" \n and OSR: \"((S',B',I',P'),(p,D,pE))\\GS_rel\" and L: \"length a = length B'\" \n and R: \"\\(set a) \\ {0.._def GS_rel_def br_def\n apply (auto dest: AUX1)\n done\n qed\n \n definition gpop_impl :: \"'Q gGS \\ 'Q gGS nres\" \n where \"gpop_impl s \\ do {\n let (a,s)=s;\n s\\pop_impl s;\n ASSERT (a\\[]);\n let a = butlast a;\n RETURN (a,s)\n }\"\n\n lemma gpop_impl_refine:\n assumes A: \"(s',(a,p,D,pE))\\gGS_rel\"\n assumes PRE: \"p \\ []\" \"pE \\ last p \\ UNIV = {}\"\n shows \"gpop_impl s' \\ \\gGS_rel (RETURN (gpop (a,p,D,pE)))\"\n proof -\n from A obtain S' B' I' P' where [simp]: \"s'=(a,S',B',I',P')\" \n and OSR: \"((S',B',I',P'),(p,D,pE))\\GS_rel\" and L: \"length a = length B'\"\n and R: \"\\(set a) \\ {0..[]\" using L\n by (auto simp add: GS_rel_def br_def GS.\\_def GS.p_\\_def)\n\n {\n fix S B I P S' B' I' P'\n assume \"nofail (pop_impl ((S, B, I, P)::'a GS))\"\n \"inres (pop_impl ((S, B, I, P)::'a GS)) (S', B', I', P')\"\n hence \"length B' = length B - Suc 0\"\n apply (simp add: pop_impl_def GS.pop_impl_def Let_def\n refine_pw_simps)\n apply auto\n done\n } note AUX1=this\n\n from A L show ?thesis\n unfolding gpop_impl_def gpop_def gGS_rel_def gGS_\\_def br_def\n apply (simp add: Let_def)\n using pop_refine[OF OSR PRE]\n apply (simp add: pw_le_iff refine_pw_simps split: prod.splits)\n unfolding gGS_rel_def gGS_invar_def gGS_\\_def GS_rel_def GS.\\_def br_def\n apply (auto dest!: AUX1 in_set_butlastD iff: Sup_le_iff)\n done\n qed\n \n definition gselect_edge_impl :: \"'Q gGS \\ ('Q option \\ 'Q gGS) nres\" \n where \"gselect_edge_impl s \\ \n do { \n let (a,s)=s; \n (vo,s)\\select_edge_impl s; \n RETURN (vo,a,s)\n }\"\n\n thm select_edge_refine\n lemma gselect_edge_impl_refine:\n assumes A: \"(s', a, p, D, pE) \\ gGS_rel\" \n assumes PRE: \"p \\ []\"\n shows \"gselect_edge_impl s' \\ \\(Id \\\\<^sub>r gGS_rel) (gselect_edge (a, p, D, pE))\"\n proof -\n from A obtain S' B' I' P' where [simp]: \"s'=(a,S',B',I',P')\" \n and OSR: \"((S',B',I',P'),(p,D,pE))\\GS_rel\" and L: \"length a = length B'\"\n and R: \"\\(set a) \\ {0.._def gGS_invar_def GS_rel_def GS.\\_def\n apply (simp split: prod.splits)\n apply clarsimp\n using R\n apply (auto simp: L dest: AUX1)\n done\n qed\n\n\n term GS.idx_of_impl\n\n thm GS_invar.idx_of_correct\n\n\n definition gcollapse_impl_aux :: \"'Q \\ 'Q gGS \\ 'Q gGS nres\" where \n \"gcollapse_impl_aux v s \\ \n do { \n let (A,s)=s;\n \\<^cancel>\\ASSERT (v\\\\set (GS.p_\\ s));\\\n i \\ GS.idx_of_impl s v;\n s \\ collapse_impl v s;\n ASSERT (i < length A);\n us \\ Un_set_drop_impl i A;\n let A = take i A @ [us];\n RETURN (A,s)\n }\"\n\n term collapse\n lemma gcollapse_alt:\n \"gcollapse v APDPE = ( \n let \n (a,p,D,pE)=APDPE; \n i=idx_of p v;\n s=collapse v (p,D,pE);\n us=\\(set (drop i a));\n a = take i a @ [us]\n in (a,s))\"\n unfolding gcollapse_def gcollapse_aux_def collapse_def collapse_aux_def\n by auto\n\n thm collapse_refine\n lemma gcollapse_impl_aux_refine:\n assumes A: \"(s', a, p, D, pE) \\ gGS_rel\" \n assumes B: \"(v',v)\\Id\"\n assumes PRE: \"v\\\\(set p)\"\n shows \"gcollapse_impl_aux v' s' \n \\ \\ gGS_rel (RETURN (gcollapse v (a, p, D, pE)))\"\n proof -\n note [simp] = Let_def\n\n from A obtain S' B' I' P' where [simp]: \"s'=(a,S',B',I',P')\" \n and OSR: \"((S',B',I',P'),(p,D,pE))\\GS_rel\" and L: \"length a = length B'\"\n and R: \"\\(set a) \\ {0.. (S',B',I',P') = p\"\n by (simp add: GS_rel_def br_def GS.\\_def)\n\n from OSR PRE have PRE': \"v \\ \\(set (GS.p_\\ (S',B',I',P')))\"\n by (simp add: GS_rel_def br_def GS.\\_def)\n\n from OSR have GS_invar: \"GS_invar (S',B',I',P')\" \n by (simp add: GS_rel_def br_def)\n\n term GS.B\n {\n fix s\n assume \"collapse v (p, D, pE) = (GS.p_\\ s, GS.D_\\ s, GS.pE_\\ s)\"\n hence \"length (GS.B s) = Suc (idx_of p v)\"\n unfolding collapse_def collapse_aux_def Let_def\n apply (cases s)\n apply (auto simp: GS.p_\\_def)\n apply (drule arg_cong[where f=length])\n using GS_invar.p_\\_disjoint_sym[OF GS_invar]\n and PRE \\GS.p_\\ (S', B', I', P') = p\\ idx_of_props(1)[of p v]\n by simp\n } note AUX1 = this\n\n show ?thesis\n unfolding gcollapse_alt gcollapse_impl_aux_def\n apply simp\n apply (rule RETURN_as_SPEC_refine)\n apply (refine_rcg\n order_trans[OF GS_invar.idx_of_correct[OF GS_invar PRE']] \n order_trans[OF collapse_refine[OF OSR B PRE, simplified]]\n refine_vcg\n )\n using PRE' apply simp\n \n apply (simp add: L)\n\n using Un_set_drop_impl_correct acc_bound R\n apply (simp add: refine_pw_simps pw_le_iff)\n unfolding gGS_rel_def GS_rel_def GS.\\_def br_def gGS_\\_def gGS_invar_def\n apply (clarsimp simp: L dest!: AUX1)\n apply (auto dest!: AUX1 simp: L)\n apply (force dest!: in_set_dropD) []\n apply (force dest!: in_set_takeD) []\n done\n qed\n\n definition gcollapse_impl :: \"'Q \\ 'Q gGS \\ 'Q gGS nres\" \n where \"gcollapse_impl v s \\ \n do { \n let (A,S,B,I,P)=s;\n i \\ GS.idx_of_impl (S,B,I,P) v;\n ASSERT (i+1 \\ length B);\n let B = take (i+1) B;\n ASSERT (i < length A);\n us\\Un_set_drop_impl i A;\n let A = take i A @ [us];\n RETURN (A,S,B,I,P)\n }\"\n\n lemma gcollapse_impl_aux_opt_refine: \n \"gcollapse_impl v s \\ gcollapse_impl_aux v s\"\n unfolding gcollapse_impl_def gcollapse_impl_aux_def collapse_impl_def \n GS.collapse_impl_def\n apply (simp add: refine_pw_simps pw_le_iff split: prod.splits) \n apply blast\n done\n \n lemma gcollapse_impl_refine:\n assumes A: \"(s', a, p, D, pE) \\ gGS_rel\" \n assumes B: \"(v',v)\\Id\"\n assumes PRE: \"v\\\\(set p)\"\n shows \"gcollapse_impl v' s' \n \\ \\ gGS_rel (RETURN (gcollapse v (a, p, D, pE)))\"\n using order_trans[OF \n gcollapse_impl_aux_opt_refine \n gcollapse_impl_aux_refine[OF assms]]\n .\n\n definition ginitial_impl :: \"'Q \\ 'Q goGS \\ 'Q gGS\" \n where \"ginitial_impl v0 s0 \\ ([acc v0],initial_impl v0 (snd s0))\"\n lemma ginitial_impl_refine: \n assumes A: \"v0\\goD s0\" \"go_is_no_brk s0\"\n assumes REL: \"(s0i,s0)\\goGS_rel\" \"(v0i,v0)\\Id\" \n shows \"(ginitial_impl v0i s0i,ginitial v0 s0)\\gGS_rel\"\n unfolding ginitial_impl_def ginitial_def \n using REL initial_refine[OF A(1) _ REL(2), of \"snd s0i\"] A(2)\n apply (auto \n simp: gGS_rel_def br_def gGS_\\_def gGS_invar_def goGS_rel_def goGS_\\_def\n simp: go_is_no_brk_def goD_def oGS_rel_def GS_rel_def goGS_invar_def\n split: prod.splits\n\n )\n using acc_bound\n apply (fastforce simp: initial_impl_def GS_initial_impl_def)+\n done\n\n definition gpath_is_empty_impl :: \"'Q gGS \\ bool\"\n where \"gpath_is_empty_impl s = path_is_empty_impl (snd s)\"\n\n lemma gpath_is_empty_refine: \n \"(s,(a,p,D,pE))\\gGS_rel \\ gpath_is_empty_impl s \\ p=[]\"\n unfolding gpath_is_empty_impl_def \n using path_is_empty_refine\n by (fastforce simp: gGS_rel_def br_def gGS_invar_def gGS_\\_def GS.\\_def)\n\n definition gis_on_stack_impl :: \"'Q \\ 'Q gGS \\ bool\" \n where \"gis_on_stack_impl v s = is_on_stack_impl v (snd s)\"\n\n lemma gis_on_stack_refine: \n \"\\(s,(a,p,D,pE))\\gGS_rel\\ \\ gis_on_stack_impl v s \\ v\\\\(set p)\"\n unfolding gis_on_stack_impl_def \n using is_on_stack_refine\n by (fastforce simp: gGS_rel_def br_def gGS_invar_def gGS_\\_def GS.\\_def)\n\n definition gis_done_impl :: \"'Q \\ 'Q gGS \\ bool\"\n where \"gis_done_impl v s \\ is_done_impl v (snd s)\"\n thm is_done_refine\n lemma gis_done_refine: \"(s,(a,p,D,pE))\\gGS_rel \n \\ gis_done_impl v s \\ (v \\ D)\"\n using is_done_refine[of \"(snd s)\" v]\n by (auto \n simp: gGS_rel_def br_def gGS_\\_def gGS_invar_def GS.\\_def \n gis_done_impl_def)\n\n\n definition (in -) \"on_stack_less I u v \\ \n case I v of \n Some (STACK j) \\ j False\"\n\n definition (in -) \"on_stack_ge I l v \\ \n case I v of \n Some (STACK j) \\ l\\j\n | _ \\ False\"\n\n\n lemma (in GS_invar) set_butlast_p_refine:\n assumes PRE: \"p_\\\\[]\"\n shows \"Collect (on_stack_less I (last B)) = \\(set (butlast p_\\))\" (is \"?L=?R\")\n proof (intro equalityI subsetI)\n from PRE have [simp]: \"B\\[]\" by (auto simp: p_\\_def)\n\n have [simp]: \"S\\[]\"\n by (simp add: empty_eq)\n\n {\n fix v\n assume \"v\\?L\"\n then obtain j where [simp]: \"I v = Some (STACK j)\" and \"jj have \"jj] find_seg_correct[OF \\j]\n have \"v\\seg (find_seg j)\" \"find_seg j < length B\" by auto\n moreover with \\j have \"find_seg j < length B - 1\"\n (* What follows is an unreadable, auto-generated structured proof\n that replaces the following smt-call:\n by (smt GS.seg_start_def `seg_start (find_seg j) \\ j`)*)\n proof -\n have f1: \"\\x\\<^sub>1 x. \\ (x\\<^sub>1::nat) < x\\<^sub>1 - x\"\n using less_imp_diff_less by blast\n have \"j \\ last B\"\n by (metis \\j < last B\\ less_le)\n hence f2: \"\\x\\<^sub>1. \\ last B < x\\<^sub>1 \\ \\ x\\<^sub>1 \\ j\"\n using f1 by (metis diff_diff_cancel le_trans)\n have \"\\x\\<^sub>1. seg_end x\\<^sub>1 \\ j \\ \\ x\\<^sub>1 < find_seg j\"\n by (metis \\seg_start (find_seg j) \\ j\\ calculation(2) \n le_trans seg_end_less_start)\n thus \"find_seg j < length B - 1\"\n using f1 f2 \n by (metis GS.seg_start_def \\B \\ []\\ \\j < B ! (length B - 1)\\\n \\seg_start (find_seg j) \\ j\\ calculation(2) diff_diff_cancel \n last_conv_nth nat_neq_iff seg_start_less_end)\n qed\n ultimately show \"v\\?R\" \n by (auto simp: p_\\_def map_butlast[symmetric] butlast_upt)\n }\n\n {\n fix v\n assume \"v\\?R\"\n then obtain i where \"iseg i\"\n by (auto simp: p_\\_def map_butlast[symmetric] butlast_upt)\n then obtain j where \"j < seg_end i\" and \"v=S!j\"\n by (auto simp: seg_def)\n hence \"j length B - 1\" using \\i\n by (auto simp: seg_end_def last_conv_nth split: if_split_asm)\n with sorted_nth_mono[OF B_sorted \\i+1 \\ length B - 1\\] have \"jj < seg_end i\\ have \"ji + 1 \\ length B - 1\\\n add_lessD1 less_imp_diff_less less_le_not_le nat_neq_iff \n seg_end_bound)\n (*by (smt `i < length B - 1` seg_end_bound)*)\n with I_consistent \\v=S!j\\ have \"I v = Some (STACK j)\" by auto\n ultimately show \"v\\?L\"\n by (auto simp: on_stack_less_def)\n }\n qed\n\n lemma (in GS_invar) set_last_p_refine:\n assumes PRE: \"p_\\\\[]\"\n shows \"Collect (on_stack_ge I (last B)) = last p_\\\" (is \"?L=?R\")\n proof (intro equalityI subsetI)\n from PRE have [simp]: \"B\\[]\" by (auto simp: p_\\_def)\n\n have [simp]: \"S\\[]\" by (simp add: empty_eq)\n\n {\n fix v\n assume \"v\\?L\"\n then obtain j where [simp]: \"I v = Some (STACK j)\" and \"j\\last B\"\n by (auto simp: on_stack_ge_def split: option.splits node_state.splits)\n\n from I_consistent[of v j] have [simp]: \"jseg (length B - 1)\" using \\j\\last B\\\n by (auto simp: seg_def last_conv_nth seg_start_def seg_end_def)\n thus \"v\\last p_\\\" by (auto simp: p_\\_def last_map)\n }\n\n {\n fix v\n assume \"v\\?R\"\n hence \"v\\seg (length B - 1)\"\n by (auto simp: p_\\_def last_map)\n then obtain j where \"v=S!j\" \"j\\last B\" \"jj\\last B\\ show \"v\\?L\" by (auto simp: on_stack_ge_def)\n }\n qed\n\n definition ce_impl :: \"'Q gGS \\ (('Q set \\ 'Q set) option \\ 'Q gGS) nres\"\n where \"ce_impl s \\ \n do {\n let (a,S,B,I,P) = s;\n ASSERT (B\\[]);\n let bls = Collect (on_stack_less I (last B));\n let ls = Collect (on_stack_ge I (last B));\n RETURN (Some (bls, ls),a,S,B,I,P)\n }\"\n\n lemma ce_impl_refine:\n assumes A: \"(s,(a,p,D,pE))\\gGS_rel\"\n assumes PRE: \"p\\[]\"\n shows \"ce_impl s \\ \\(Id\\\\<^sub>rgGS_rel) \n (RETURN (Some (\\(set (butlast p)),last p),a,p,D,pE))\"\n proof -\n from A obtain S' B' I' P' where [simp]: \"s=(a,S',B',I',P')\" \n and OSR: \"((S',B',I',P'),(p,D,pE))\\GS_rel\" and L: \"length a = length B'\"\n by (rule gGS_relE)\n\n from OSR have [simp]: \"GS.p_\\ (S',B',I',P') = p\"\n by (simp add: GS_rel_def br_def GS.\\_def)\n\n from PRE have NE': \"GS.p_\\ (S', B', I', P') \\ []\" by simp\n hence BNE[simp]: \"B'\\[]\" by (simp add: GS.p_\\_def)\n\n from OSR have GS_invar: \"GS_invar (S',B',I',P')\" \n by (simp add: GS_rel_def br_def)\n\n show ?thesis\n using GS_invar.set_butlast_p_refine[OF GS_invar NE']\n using GS_invar.set_last_p_refine[OF GS_invar NE']\n unfolding ce_impl_def\n using A\n by auto\n qed\n\n definition \"last_is_acc_impl s \\ \n do {\n let (a,_)=s;\n ASSERT (a\\[]);\n RETURN (\\ilast a)\n }\"\n\n lemma last_is_acc_impl_refine:\n assumes A: \"(s,(a,p,D,pE))\\gGS_rel\"\n assumes PRE: \"a\\[]\"\n shows \"last_is_acc_impl s \\ RETURN (last a = {0.. {0.._def by auto\n hence C: \"(\\ilast a) \\ (last a = {0.._def br_def split: prod.splits)\n\n show ?thesis\n unfolding last_is_acc_impl_def \n by (auto simp: gGS_rel_def br_def gGS_\\_def C PRE split: prod.splits)\n qed\n\n definition go_is_no_brk_impl :: \"'Q goGS \\ bool\" \n where \"go_is_no_brk_impl s \\ fst s = None\"\n lemma go_is_no_brk_refine: \n \"(s,s')\\goGS_rel \\ go_is_no_brk_impl s \\ go_is_no_brk s'\"\n unfolding go_is_no_brk_def go_is_no_brk_impl_def\n by (auto simp: goGS_rel_def br_def goGS_\\_def split: prod.splits)\n\n definition goD_impl :: \"'Q goGS \\ 'Q oGS\" where \"goD_impl s \\ snd s\"\n lemma goD_refine: \n \"go_is_no_brk s' \\ (s,s')\\goGS_rel \\ (goD_impl s, goD s')\\oGS_rel\"\n unfolding goD_impl_def goD_def\n by (auto \n simp: goGS_rel_def br_def goGS_\\_def goGS_invar_def oGS_rel_def \n go_is_no_brk_def) \n\n definition go_is_done_impl :: \"'Q \\ 'Q goGS \\ bool\" \n where \"go_is_done_impl v s \\ is_done_oimpl v (snd s)\"\n thm is_done_orefine\n lemma go_is_done_impl_refine: \"\\go_is_no_brk s'; (s,s')\\goGS_rel; (v,v')\\Id\\ \n \\ go_is_done_impl v s \\ (v'\\goD s')\"\n using is_done_orefine\n unfolding go_is_done_impl_def goD_def go_is_no_brk_def\n apply (fastforce simp: goGS_rel_def br_def goGS_invar_def goGS_\\_def)\n done\n\n\n definition goBrk_impl :: \"'Q goGS \\ 'Q ce\" where \"goBrk_impl \\ fst\"\n\n \n\n definition find_ce_impl :: \"('Q set \\ 'Q set) option nres\" where\n \"find_ce_impl \\ do {\n stat_start_nres;\n let os=goinitial_impl;\n os\\FOREACHci (\\it os. fgl_outer_invar it (goGS_\\ os)) V0 \n (go_is_no_brk_impl) (\\v0 s0. \n do {\n if \\go_is_done_impl v0 s0 then do {\n\n let s = (None,ginitial_impl v0 s0);\n\n (brk,s)\\WHILEIT \n (\\(brk,s). fgl_invar v0 (oGS_\\ (goD_impl s0)) (brk,snd (gGS_\\ s)))\n (\\(brk,s). brk=None \\ \\gpath_is_empty_impl s) (\\(l,s).\n do {\n \\ \\Select edge from end of path\\\n (vo,s) \\ gselect_edge_impl s;\n\n case vo of \n Some v \\ do {\n if gis_on_stack_impl v s then do {\n s\\gcollapse_impl v s;\n b\\last_is_acc_impl s;\n if b then\n ce_impl s\n else \n RETURN (None,s)\n } else if \\gis_done_impl v s then do {\n \\ \\Edge to new node. Append to path\\\n RETURN (None,gpush_impl v s)\n } else do {\n \\ \\Edge to done node. Skip\\\n RETURN (None,s)\n }\n }\n | None \\ do {\n \\ \\No more outgoing edges from current node on path\\\n s\\gpop_impl s;\n RETURN (None,s)\n }\n }) (s);\n RETURN (gto_outer_impl brk s)\n } else RETURN s0\n }) os;\n stat_stop_nres;\n RETURN (goBrk_impl os)\n }\"\n\n lemma find_ce_impl_refine: \"find_ce_impl \\ \\Id gfind_ce\"\n proof -\n note [refine2] = prod_relI[OF IdI[of None] ginitial_impl_refine]\n\n have [refine]: \"\\s a p D pE. \\\n (s,(a,p,D,pE))\\gGS_rel;\n p \\ []; pE \\ last p \\ UNIV = {}\n \\ \\\n gpop_impl s \\ (\\s. RETURN (None, s))\n \\ SPEC (\\c. (c, None, gpop (a,p,D,pE)) \\ Id \\\\<^sub>r gGS_rel)\"\n apply (drule (2) gpop_impl_refine)\n apply (fastforce simp add: pw_le_iff refine_pw_simps)\n done\n\n note [[goals_limit = 1]]\n\n note FOREACHci_refine_rcg'[refine del]\n\n show ?thesis\n unfolding find_ce_impl_def gfind_ce_def\n apply (refine_rcg\n bind_refine'\n prod_relI IdI\n inj_on_id\n\n gselect_edge_impl_refine gpush_impl_refine \n oinitial_refine ginitial_impl_refine \n bind_Let_refine2[OF gcollapse_impl_refine]\n if_bind_cond_refine[OF last_is_acc_impl_refine]\n ce_impl_refine\n goinitial_impl_refine\n gto_outer_refine\n goBrk_refine\n FOREACHci_refine_rcg'[where R=goGS_rel, OF inj_on_id]\n )\n\n apply refine_dref_type\n \n apply (simp_all add: go_is_no_brk_refine go_is_done_impl_refine)\n apply (auto simp: goGS_rel_def br_def) []\n apply (auto simp: goGS_rel_def br_def goGS_\\_def gGS_\\_def gGS_rel_def \n goD_def goD_impl_def) []\n\n apply (auto dest: gpath_is_empty_refine ) []\n apply (auto dest: gis_on_stack_refine) []\n apply (auto dest: gis_done_refine) []\n done\n qed\n\nend\n\nsection \\Constructing a Lasso from Counterexample\\\n\nsubsection \\Lassos in GBAs\\\n\ncontext igb_fr_graph begin\n\n definition reconstruct_reach :: \"'Q set \\ 'Q set \\ ('Q list \\ 'Q) nres\"\n \\ \\Reconstruct the reaching path of a lasso\\\n where \"reconstruct_reach Vr Vl \\ do {\n res \\ find_path (E\\Vr\\UNIV) V0 (\\v. v\\Vl);\n ASSERT (res \\ None);\n RETURN (the res)\n }\"\n\n lemma reconstruct_reach_correct:\n assumes CEC: \"ce_correct Vr Vl\"\n shows \"reconstruct_reach Vr Vl \n \\ SPEC (\\(pr,va). \\v0\\V0. path E v0 pr va \\ va\\Vl)\"\n proof -\n have FIN_aux: \"finite ((E \\ Vr \\ UNIV)\\<^sup>* `` V0)\"\n by (metis finite_reachableE_V0 finite_subset inf_sup_ord(1) inf_sup_ord(2)\n inf_top.left_neutral reachable_mono)\n \n {\n fix u p v\n assume P: \"path E u p v\" and SS: \"set p \\ Vr\"\n have \"path (E \\ Vr\\UNIV) u p v\"\n apply (rule path_mono[OF _ path_restrict[OF P]])\n using SS by auto\n } note P_CONV=this\n\n from CEC obtain v0 \"pr\" va where \"v0\\V0\" \"set pr \\ Vr\" \"va\\Vl\" \n \"path (E \\ Vr\\UNIV) v0 pr va\"\n unfolding ce_correct_def is_lasso_prpl_def is_lasso_prpl_pre_def\n by (force simp: neq_Nil_conv path_simps dest: P_CONV)\n hence 1: \"va \\ (E \\ Vr \\ UNIV)\\<^sup>* `` V0\" \n by (auto dest: path_is_rtrancl)\n \n show ?thesis\n using assms unfolding reconstruct_reach_def\n apply (refine_rcg refine_vcg order_trans[OF find_path_ex_rule])\n apply (clarsimp_all simp: FIN_aux finite_V0)\n\n using \\va\\Vl\\ 1 apply auto []\n\n apply (auto dest: path_mono[of \"E \\ Vr \\ UNIV\" E, simplified]) []\n done\n qed\n\n definition \"rec_loop_invar Vl va s \\ let (v,p,cS) = s in \n va \\ E\\<^sup>*``V0 \\\n path E va p v \\\n cS = acc v \\ (\\(acc`set p)) \\\n va \\ Vl \\ v \\ Vl \\ set p \\ Vl\"\n\n definition reconstruct_lasso :: \"'Q set \\ 'Q set \\ ('Q list \\ 'Q list) nres\"\n \\ \\Reconstruct lasso\\\n where \"reconstruct_lasso Vr Vl \\ do {\n (pr,va) \\ reconstruct_reach Vr Vl;\n \n let cS_full = {0.. UNIV\\Vl;\n \n (vd,p,_) \\ WHILEIT (rec_loop_invar Vl va) \n (\\(_,_,cS). cS \\ cS_full) \n (\\(v,p,cS). do {\n ASSERT (\\v'. (v,v')\\E\\<^sup>* \\ \\ (acc v' \\ cS));\n sr \\ find_path E {v} (\\v. \\ (acc v \\ cS));\n ASSERT (sr \\ None);\n let (p_seg,v) = the sr;\n RETURN (v,p@p_seg,cS \\ acc v)\n }) (va,[],acc va);\n\n p_close_r \\ (if p=[] then \n find_path1 E vd ((=) va)\n else\n find_path E {vd} ((=) va));\n\n ASSERT (p_close_r \\ None);\n let (p_close,_) = the p_close_r;\n\n RETURN (pr, p@p_close)\n }\"\n\n\nlemma (in igb_fr_graph) reconstruct_lasso_correct:\n assumes CEC: \"ce_correct Vr Vl\"\n shows \"reconstruct_lasso Vr Vl \\ SPEC (is_lasso_prpl)\"\nproof -\n\n let ?E = \"E \\ UNIV \\ Vl\"\n\n have E_SS: \"E \\ Vl \\ Vl \\ ?E\" by auto\n\n from CEC have\n REACH: \"Vl \\ E\\<^sup>*``V0\"\n and CONN: \"Vl\\Vl \\ (E \\ Vl\\Vl)\\<^sup>*\"\n and NONTRIV: \"Vl\\Vl \\ E \\ {}\"\n and NES[simp]: \"Vl\\{}\"\n and ALL: \"\\(acc`Vl) = {0..(_::'Q,_::'Q list,cS). cS))\"\n hence WF: \"wf term_rel\" by simp\n\n { fix va\n assume \"va \\ Vl\"\n hence \"rec_loop_invar Vl va (va, [], acc va)\"\n unfolding rec_loop_invar_def using REACH by auto\n } note INVAR_INITIAL = this\n\n {\n fix v p cS va\n assume \"rec_loop_invar Vl va (v, p, cS)\"\n hence \"finite ((?E)\\<^sup>* `` {v})\"\n apply -\n apply (rule finite_subset[where B=\"E\\<^sup>*``V0\"])\n unfolding rec_loop_invar_def\n using REACH\n apply (clarsimp_all dest!: path_is_rtrancl)\n apply (drule rtrancl_mono_mp[where U=\"?E\" and V=E, rotated], (auto) [])\n by (metis rev_ImageI rtrancl_trans)\n } note FIN1 = this\n\n {\n fix va v :: 'Q and p cS\n assume INV: \"rec_loop_invar Vl va (v,p,cS)\"\n and NC: \"cS \\ {0..cS\" \n unfolding rec_loop_invar_def by auto blast\n\n with ALL obtain v' where \"v'\\Vl\" \"\\ acc v' \\ cS\"\n by simp (smt UN_iff atLeastLessThan_iff le0 subsetCE)\n \n moreover with CONN INV have \"(v,v')\\(E \\ Vl \\ Vl)\\<^sup>*\"\n unfolding rec_loop_invar_def by auto\n hence \"(v,v')\\?E\\<^sup>*\" using rtrancl_mono_mp[OF E_SS] by blast\n ultimately have \"\\v'. (v,v')\\(?E)\\<^sup>* \\ \\ acc v' \\ cS\" by auto\n } note ASSERT1 = this\n\n {\n fix va v p cS v' p'\n assume \"rec_loop_invar Vl va (v, p, cS)\"\n and \"path (?E) v p' v'\"\n and \"\\ (acc v' \\ cS)\"\n and \"\\v\\set p'. acc v \\ cS\"\n hence \"rec_loop_invar Vl va (v', p@p', cS \\ acc v')\"\n unfolding rec_loop_invar_def\n apply simp\n apply (intro conjI)\n apply (auto simp: path_simps dest: path_mono[of \"?E\" E, simplified]) []\n\n apply (cases p')\n apply (auto simp: path_simps) [2]\n\n apply (cases p' rule: rev_cases)\n apply (auto simp: path_simps) [2]\n\n apply (erule path_set_induct)\n apply auto [2]\n done\n } note INV_PRES = this\n\n {\n fix va v p cS v' p'\n assume \"rec_loop_invar Vl va (v, p, cS)\"\n and \"path ?E v p' v'\"\n and \"\\ (acc v' \\ cS)\"\n and \"\\v\\set p'. acc v \\ cS\"\n hence \"((v', p@p', cS \\ acc v'), (v,p,cS)) \\ term_rel\"\n unfolding term_rel_def rec_loop_invar_def\n by (auto simp: finite_psupset_def)\n } note VAR = this\n\n have CONN1: \"Vl \\ Vl \\ (?E)\\<^sup>+\"\n proof clarify\n fix a b\n assume \"a\\Vl\" \"b\\Vl\"\n from NONTRIV obtain u v where E: \"(u,v)\\(E \\ Vl\\Vl)\" by auto\n from CONN \\a\\Vl\\ E have \"(a,u)\\(E\\Vl\\Vl)\\<^sup>*\" by auto\n also note E\n also (rtrancl_into_trancl1) from CONN \\b\\Vl\\ E have \"(v,b)\\(E\\Vl\\Vl)\\<^sup>*\"\n by auto\n finally show \"(a,b)\\(?E)\\<^sup>+\" using trancl_mono[OF _ E_SS] by auto\n qed\n \n {\n fix va v p cS\n assume \"rec_loop_invar Vl va (v, p, cS)\"\n hence \"(v,va) \\ (?E)\\<^sup>+\"\n unfolding rec_loop_invar_def\n using CONN1\n by auto\n } note CLOSE1 = this\n\n {\n fix va v p cS\n assume \"rec_loop_invar Vl va (v, p, cS)\"\n hence \"(v,va) \\ (?E)\\<^sup>*\"\n unfolding rec_loop_invar_def\n using CONN rtrancl_mono[OF E_SS]\n by auto\n } note CLOSE2 = this\n\n {\n fix \"pr\" vd pl va v0\n assume \"rec_loop_invar Vl va (vd, [], {0.. Vl\" \"v0 \\ V0\"\n \"path E v0 pr va\" \"pl \\ []\" \"path ?E vd pl va\"\n hence \"is_lasso_prpl (pr, pl)\"\n unfolding is_lasso_prpl_def is_lasso_prpl_pre_def rec_loop_invar_def\n by (auto simp: neq_Nil_conv path_simps\n dest!: path_mono[of \"?E\" E, simplified]) []\n } note INV_POST1 = this\n\n {\n fix va v p p' \"pr\" v0\n assume INV: \"rec_loop_invar Vl va (v,p,{0..[]\" \"path ?E v p' va\"\n and PR: \"v0\\V0\" \"path E v0 pr va\"\n\n from INV have \"\\iq\\insert v (set p). i \\ acc q\"\n unfolding rec_loop_invar_def\n by auto\n moreover from INV 1 have \"insert v (set p) \\ set p \\ set p'\"\n unfolding rec_loop_invar_def\n apply (cases p, simp)\n apply (cases p')\n apply (auto simp: path_simps)\n done\n ultimately have ACC: \"\\iq\\set p \\ set p'. i \\ acc q\" by blast\n \n from INV 1 have PL: \"path E va (p @ p') va\"\n by (auto simp: rec_loop_invar_def path_simps \n dest!: path_mono[of \"?E\" E, simplified]) []\n\n have \"is_lasso_prpl (pr,p@p')\"\n unfolding is_lasso_prpl_def is_lasso_prpl_pre_def\n apply (clarsimp simp: ACC)\n using PR PL \\p\\[]\\ by auto\n } note INV_POST2 = this\n\n show ?thesis\n unfolding reconstruct_lasso_def\n apply (refine_rcg \n WF\n order_trans[OF reconstruct_reach_correct]\n order_trans[OF find_path_ex_rule]\n order_trans[OF find_path1_ex_rule]\n refine_vcg \n )\n\n apply (vc_solve \n del: subsetI\n solve: ASSERT1 INV_PRES asm_rl VAR CLOSE1 CLOSE2 INV_POST1 INV_POST2\n simp: INVAR_INITIAL FIN1 CEC)\n done\nqed\n\ndefinition find_lasso where \"find_lasso \\ do {\n ce \\ find_ce_spec;\n case ce of \n None \\ RETURN None\n | Some (Vr,Vl) \\ do {\n l \\ reconstruct_lasso Vr Vl;\n RETURN (Some l)\n }\n}\"\n\nlemma (in igb_fr_graph) find_lasso_correct: \"find_lasso \\ find_lasso_spec\"\n unfolding find_lasso_spec_def find_lasso_def find_ce_spec_def\n apply (refine_rcg refine_vcg order_trans[OF reconstruct_lasso_correct])\n apply auto\n done\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Gabow_SCC/Gabow_GBG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185205547238, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.28964107553793805}} {"text": "section {*L\\_ATS\\_Branching\\_Versus\\_Linear1*}\ntheory\n L_ATS_Branching_Versus_Linear1\n\nimports\n L_ATS_Linear\n L_ATS_Branching\n\nbegin\n\nlemma tl_nth_shift: \"\n length w>i\n \\ tl w ! i = w!(Suc i)\"\n apply(case_tac w)\n apply(clarsimp)\n apply(rename_tac a list)(*strict*)\n apply(force)\n done\n\nlemma bexI_conj: \"\n P \\ Q a \\ a \\ A\n \\ P \\ (\\x\\ A. Q x)\"\n apply(force)\n done\n\nlocale ATS_Branching_Versus_Linear1 =\n GLIN : ATS_Linear\n \"TSstructure :: 'TSstructure \\ bool\"\n \"lin_configurations :: 'TSstructure \\ 'lin_conf set\"\n \"lin_initial_configurations :: 'TSstructure \\ 'lin_conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"lin_step_relation :: 'TSstructure \\ 'lin_conf \\ 'label \\ 'lin_conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event list set\"\n \"lin_marking_condition :: 'TSstructure \\ ('label, 'lin_conf) derivation \\ bool\"\n \"lin_marked_effect :: 'TSstructure \\ ('label, 'lin_conf) derivation \\ 'event list set\"\n \"lin_unmarked_effect :: 'TSstructure \\ ('label, 'lin_conf) derivation \\ 'event list set\"\n \"lin_fixed_schedulers :: 'TSstructure \\ 'lin_fixed_scheduler set\"\n \"lin_empty_fixed_scheduler :: 'TSstructure \\ 'lin_fixed_scheduler\"\n \"lin_fixed_scheduler_extendable :: 'TSstructure \\ 'lin_fixed_scheduler \\ bool\"\n \"lin_scheduler_fragments :: 'TSstructure \\ 'lin_scheduler_fragment set\"\n \"lin_empty_scheduler_fragment :: 'TSstructure \\ 'lin_scheduler_fragment\"\n \"lin_join_scheduler_fragments :: 'lin_scheduler_fragment \\ 'lin_scheduler_fragment \\ 'lin_scheduler_fragment\"\n \"lin_unfixed_schedulers :: 'TSstructure \\ 'lin_unfixed_scheduler set\"\n \"lin_empty_unfixed_scheduler :: 'TSstructure \\ 'lin_unfixed_scheduler\"\n \"lin_unfixed_scheduler_right_quotient :: 'lin_unfixed_scheduler \\ 'lin_unfixed_scheduler \\ 'lin_scheduler_fragment option\"\n \"lin_extend_unfixed_scheduler :: 'lin_scheduler_fragment \\ 'lin_unfixed_scheduler \\ 'lin_unfixed_scheduler\"\n \"lin_unfixed_scheduler_extendable :: 'TSstructure \\ 'lin_unfixed_scheduler \\ bool\"\n \"lin_schedulers :: 'TSstructure \\ 'lin_scheduler set\"\n \"lin_initial_schedulers :: 'TSstructure \\ 'lin_scheduler set\"\n \"lin_empty_scheduler :: 'TSstructure \\ 'lin_scheduler\"\n \"lin_get_scheduler :: 'lin_conf \\ 'lin_scheduler\"\n \"lin_join_fixed_scheduler_unfixed_scheduler :: 'lin_fixed_scheduler \\ 'lin_unfixed_scheduler \\ 'lin_scheduler\"\n \"lin_extend_scheduler :: 'lin_scheduler_fragment \\ 'lin_scheduler \\ 'lin_scheduler\"\n \"lin_get_unfixed_scheduler :: 'lin_conf \\ 'lin_unfixed_scheduler\"\n \"lin_set_unfixed_scheduler :: 'lin_conf \\ 'lin_unfixed_scheduler \\ 'lin_conf\"\n \"lin_get_fixed_scheduler :: 'lin_conf \\ 'lin_fixed_scheduler\"\n \"histories :: 'TSstructure \\ 'history set\"\n \"history_fragments :: 'TSstructure \\ 'history_fragment set\"\n \"empty_history :: 'TSstructure \\ 'history\"\n \"empty_history_fragment :: 'TSstructure \\ 'history_fragment\"\n \"lin_set_history :: 'lin_conf \\ 'history \\ 'lin_conf\"\n \"extend_history :: 'history \\ 'history_fragment \\ 'history\"\n \"join_history_fragments :: 'history_fragment \\ 'history_fragment \\ 'history_fragment\"\n \"lin_get_history :: 'lin_conf \\ 'history\"\n + GBRA : ATS_Branching\n \"TSstructure :: 'TSstructure \\ bool\"\n \"bra_configurations :: 'TSstructure \\ 'bra_conf set\"\n \"bra_initial_configurations :: 'TSstructure \\ 'bra_conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"bra_step_relation :: 'TSstructure \\ 'bra_conf \\ 'label \\ 'bra_conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event list set\"\n \"bra_marking_condition :: 'TSstructure \\ ('label, 'bra_conf) derivation \\ bool\"\n \"bra_marked_effect :: 'TSstructure \\ ('label, 'bra_conf) derivation \\ 'event list set\"\n \"bra_unmarked_effect :: 'TSstructure \\ ('label, 'bra_conf) derivation \\ 'event list set\"\n \"bra_fixed_schedulers :: 'TSstructure \\ 'bra_fixed_scheduler set\"\n \"bra_empty_fixed_scheduler :: 'TSstructure \\ 'bra_fixed_scheduler\"\n \"bra_fixed_scheduler_extendable :: 'TSstructure \\ 'bra_fixed_scheduler \\ bool\"\n \"bra_get_fixed_scheduler :: 'bra_conf \\ 'bra_fixed_scheduler\"\n \"histories :: 'TSstructure \\ 'history set\"\n \"history_fragments :: 'TSstructure \\ 'history_fragment set\"\n \"empty_history :: 'TSstructure \\ 'history\"\n \"empty_history_fragment :: 'TSstructure \\ 'history_fragment\"\n \"bra_set_history :: 'bra_conf \\ 'history \\ 'bra_conf\"\n \"extend_history :: 'history \\ 'history_fragment \\ 'history\"\n \"join_history_fragments :: 'history_fragment \\ 'history_fragment \\ 'history_fragment\"\n \"bra_get_history :: 'bra_conf \\ 'history\"\n for\n TSstructure lin_configurations lin_initial_configurations step_labels lin_step_relation effects lin_marking_condition lin_marked_effect lin_unmarked_effect lin_fixed_schedulers lin_empty_fixed_scheduler lin_fixed_scheduler_extendable lin_scheduler_fragments lin_empty_scheduler_fragment lin_join_scheduler_fragments lin_unfixed_schedulers lin_empty_unfixed_scheduler lin_unfixed_scheduler_right_quotient lin_extend_unfixed_scheduler lin_unfixed_scheduler_extendable lin_schedulers lin_initial_schedulers lin_empty_scheduler lin_get_scheduler lin_join_fixed_scheduler_unfixed_scheduler lin_extend_scheduler lin_get_unfixed_scheduler lin_set_unfixed_scheduler lin_get_fixed_scheduler histories history_fragments empty_history empty_history_fragment lin_set_history extend_history join_history_fragments lin_get_history bra_configurations bra_initial_configurations bra_step_relation bra_marking_condition bra_marked_effect bra_unmarked_effect bra_fixed_schedulers bra_empty_fixed_scheduler bra_fixed_scheduler_extendable bra_get_fixed_scheduler bra_set_history bra_get_history\n +\n\nfixes Lin2BraConf :: \"'lin_conf \\ 'bra_conf\"\n\nfixes Bra2LinConf :: \"'bra_conf \\ 'lin_scheduler \\ 'lin_conf\"\n\nfixes Bra2LinStep :: \"'bra_conf \\ 'label \\ 'bra_conf \\ 'lin_scheduler_fragment\"\n\nfixes Bra2LinFin :: \"'TSstructure \\ 'bra_fixed_scheduler \\ 'lin_scheduler\"\n\nassumes AX_Lin2BraConf_preserves_steps: \"\n TSstructure G\n \\ c1l \\ lin_configurations G\n \\ lin_step_relation G c1l e c2l\n \\ bra_step_relation G (Lin2BraConf c1l) e (Lin2BraConf c2l)\"\n\nassumes AX_Lin2BraConf_preserves_initiality: \"\n TSstructure G\n \\ cl \\ lin_initial_configurations G\n \\ Lin2BraConf cl \\ bra_initial_configurations G\"\n\nassumes AX_Lin2BraConf_preserves_configurations: \"\n TSstructure G\n \\ cl \\ lin_configurations G\n \\ Lin2BraConf cl \\ bra_configurations G\"\n\nassumes AX_Bra2LinStep_closed: \"\n TSstructure G\n \\ c1B \\ bra_configurations G\n \\ bra_step_relation G c1B e c2B\n \\ Bra2LinStep c1B e c2B \\ lin_scheduler_fragments G\"\n\nassumes AX_Bra2LinFin_closed: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ Bra2LinFin G (bra_get_fixed_scheduler cB) \\ lin_schedulers G\"\n\nassumes AX_Bra2LinConf_schedl_get: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ s1L \\ lin_schedulers G\n \\ lin_get_scheduler (Bra2LinConf cB s1L) = s2L\n \\ s1L = s2L\"\n\nassumes AX_Bra2LinFin_creates_proper_extension: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ Bra2LinConf cB (Bra2LinFin G (bra_get_fixed_scheduler cB)) \\ lin_configurations G\"\n\nassumes AX_Bra2LinStep_translates_backwards_Bra2LinConf_closed: \"\n TSstructure G\n \\ c1B \\ bra_configurations G\n \\ bra_step_relation G c1B e c2B\n \\ Bra2LinConf c2B sL \\ lin_configurations G\n \\ Bra2LinConf c1B (lin_extend_scheduler (Bra2LinStep c1B e c2B) sL) \\ lin_configurations G\"\n\nassumes AX_lin_step_relation_from_Bra2LinStep: \"\n TSstructure G\n \\ c1B \\ bra_configurations G\n \\ bra_step_relation G c1B e c2B\n \\ Bra2LinConf c2B sL \\ lin_configurations G\n \\ lin_step_relation G (Bra2LinConf c1B (lin_extend_scheduler (Bra2LinStep c1B e c2B) sL)) e (Bra2LinConf c2B sL)\"\n\nassumes AX_Bra2LinConf_only_modifies_lin_unfixed_scheduler: \"\n TSstructure G\n \\ Bra2LinConf (Lin2BraConf cL) sL \\ lin_configurations G\n \\ lin_set_unfixed_scheduler cL (lin_get_unfixed_scheduler (Bra2LinConf (Lin2BraConf cL) sL)) = Bra2LinConf (Lin2BraConf cL) sL\"\n\nassumes AX_Bra2LinConf_inj: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ Bra2LinConf cB s1L = Bra2LinConf cB s2L\n \\ s1L = s2L\"\n\nassumes AX_equal_by_fixed_unfixed_and_nonscheduler_part: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ cL \\ lin_configurations G\n \\ lin_set_unfixed_scheduler (Bra2LinConf cB (Bra2LinFin G (bra_get_fixed_scheduler cB))) (lin_get_unfixed_scheduler cL) = cL\n \\ cB = Lin2BraConf cL\"\n\nassumes AX_Bra2LinConf_preserves_initiality: \"\n TSstructure G\n \\ sL \\ lin_schedulers G\n \\ cB \\ bra_initial_configurations G\n \\ Bra2LinConf cB sL \\ lin_initial_configurations G\"\n\nassumes AX_Bra2LinConf_preserves_history: \"\n TSstructure G\n \\ cB \\ bra_configurations G\n \\ sL \\ lin_schedulers G\n \\ Bra2LinConf cB sL \\ lin_configurations G\n \\ lin_get_history (Bra2LinConf cB sL) = bra_get_history cB\"\n\nassumes AX_Lin2BraConf_preserves_history: \"\n TSstructure G\n \\ cL \\ lin_configurations G\n \\ lin_get_history cL = bra_get_history (Lin2BraConf cL)\"\n\ncontext ATS_Branching_Versus_Linear1 begin\n\ndefinition Lin2BraDer :: \"\n ('label,'lin_conf) derivation\n \\ ('label,'bra_conf) derivation\"\n where\n \"Lin2BraDer d \\\n derivation_map d Lin2BraConf\"\n\ndefinition Bra2LinDer' :: \"\n 'TSstructure\n \\ ('label, 'bra_conf) derivation\n \\ nat\n \\ nat\n \\ 'lin_scheduler_fragment\"\n where\n \"Bra2LinDer' G d m n \\\n foldl\n lin_join_scheduler_fragments\n (lin_empty_scheduler_fragment G)\n (map\n (\\n.\n case d n of Some (pair e1 c1) \\\n (case d (Suc n) of Some (pair (Some e2) c2) \\\n Bra2LinStep c1 e2 c2))\n (case m of 0 \\ [] | Suc m' \\ nat_seq n m'))\"\n\nlemma Bra2LinDer_prime_modificiation_for_presentation: \"\n (case m of 0 \\ [] | Suc m' \\ nat_seq n m') = butlast(nat_seq n m)\"\n apply(case_tac \"n ('label, 'bra_conf) derivation\n \\ nat\n \\ ('label, 'lin_conf) derivation\"\n where\n \"Bra2LinDer G d m \\\n (\\n.\n if n > m\n then None\n else\n case d m of\n None \\ None\n | Some (pair em cm) \\\n (case d n of\n None \\ None\n | Some (pair en cn) \\\n Some (pair en (Bra2LinConf cn (lin_extend_scheduler (Bra2LinDer' G d m n) (Bra2LinFin G (bra_get_fixed_scheduler cm)))))))\"\n\nlemma Lin2BraConf_preserves_steps_lift: \"\n TSstructure G\n \\ GLIN.derivation G d\n \\ GLIN.belongs G d\n \\ GBRA.derivation G (Lin2BraDer d)\"\n apply(simp add: GBRA.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n prefer 2\n apply(rule GLIN.some_position_has_details_at_0)\n apply(force)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ lin_step_relation G c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in GLIN.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n apply(rule AX_Lin2BraConf_preserves_steps)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(rule GLIN.belongs_configurations)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(force)\n done\n\nlemma Lin2BraConf_preserves_initiality_lift: \"\n TSstructure G\n \\ GLIN.derivation_initial G d\n \\ GBRA.derivation_initial G (Lin2BraDer d)\"\n apply(subgoal_tac \"GLIN.belongs G d\")\n prefer 2\n apply(rule GLIN.derivation_initial_belongs)\n apply(force)\n apply(force)\n apply(simp add: GLIN.derivation_initial_def GBRA.derivation_initial_def)\n apply(clarsimp)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n prefer 2\n apply(rule GLIN.some_position_has_details_at_0)\n apply(force)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac c)(*strict*)\n apply(rule Lin2BraConf_preserves_steps_lift)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n apply(rule AX_Lin2BraConf_preserves_initiality)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n done\n\nlemma Lin2BraConf_preserves_maximum_of_domain: \"\n TSstructure G\n \\ GLIN.derivation G d\n \\ maximum_of_domain d n\n \\ maximum_of_domain (Lin2BraDer d) n\"\n apply(simp add: Lin2BraDer_def derivation_map_def maximum_of_domain_def)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(case_tac y)\n apply(rename_tac y option b)(*strict*)\n apply(clarsimp)\n done\n\nlemma Bra2LinDer_defined0: \"\n derivation G d\n \\ Bra2LinDer G d n x \\ None\n \\ x\\n\"\n apply(simp add: Bra2LinDer_def)\n apply (metis option.simps(3) trivNat)\n done\n\nlemma Bra2LinDer_defined1: \"\n derivation G d\n \\ Bra2LinDer G d n x \\ None\n \\ d n \\ None\n \\ d x \\ None\"\n apply(subgoal_tac \"x\\n\")\n prefer 2\n apply(rule Bra2LinDer_defined0)\n apply(force)\n apply(force)\n apply(simp add: Bra2LinDer_def)\n apply(clarsimp)\n apply(rename_tac y ya)(*strict*)\n apply(case_tac \"d x\")\n apply(rename_tac y ya)(*strict*)\n apply(clarsimp)\n apply(case_tac ya)\n apply(rename_tac y ya option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac y ya a)(*strict*)\n apply(clarsimp)\n done\n\nlemma Bra2LinDer_defined2: \"\n derivation G d\n \\ d x \\ None\n \\ d n \\ None\n \\ x \\ n\n \\ Bra2LinDer G d n x \\ None\"\n apply(simp add: Bra2LinDer_def)\n apply(clarsimp)\n apply(rename_tac y ya)(*strict*)\n apply(case_tac \"d x\")\n apply(rename_tac y ya)(*strict*)\n apply(clarsimp)\n apply(rename_tac y ya a)(*strict*)\n apply(clarsimp)\n apply(rename_tac y ya)(*strict*)\n apply(case_tac y)\n apply(rename_tac y ya option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac ya option b)(*strict*)\n apply(case_tac ya)\n apply(rename_tac ya option b optiona ba)(*strict*)\n apply(clarsimp)\n done\n\nlemma Bra2LinDer_preserves_step_labels: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ d n \\ None\n \\ d m = Some (pair e c)\n \\ m \\ n\n \\ \\c. Bra2LinDer G d n m = Some (pair e c)\"\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(simp add: Bra2LinDer_def)\n apply(case_tac y)\n apply(rename_tac y option b)(*strict*)\n apply(clarsimp)\n done\n\nlemma schedE_generated: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n \\ None\n \\ m foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G)\n (map (\\n. case_option undefined\n (case_derivation_configuration\n (\\e1 c1.\n case_option undefined\n (case_derivation_configuration\n (\\a c2.\n case a of Some e2 \\ Bra2LinStep c1 e2 c2))\n (d (Suc n))))\n (d n))\n (nat_seq (Suc m) (n - Suc 0)))\n \\ lin_scheduler_fragments G\"\n apply(induct n)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n y)(*strict*)\n apply(case_tac \"m=n\")\n apply(rename_tac n y)(*strict*)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(rule_tac\n t=\"nat_seq (Suc m) m\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac y)(*strict*)\n apply (metis lessI nat_seqEmpty)\n apply(rename_tac y)(*strict*)\n apply(clarsimp)\n apply(rule GLIN.AX_empty_scheduler_fragment_in_scheduler_fragments)\n apply(force)\n apply(rename_tac n y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"mn. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0) @ [n])\"\n and s=\"map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0))@map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) ([n])\"\n in ssubst)\n apply(rename_tac n y)(*strict*)\n apply(rule map_append)\n apply(rename_tac n y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac n y)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac n y)(*strict*)\n apply(force)\n apply(rename_tac n y)(*strict*)\n apply(force)\n apply(rename_tac n y)(*strict*)\n apply(force)\n apply(rename_tac n y)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_closed)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_preserves_configurations: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n = Some (pair en cn)\n \\ d m = Some (pair em cm)\n \\ m \\ n\n \\ Bra2LinDer G d n m = Some (pair em c')\n \\ c' \\ lin_configurations G\n \\ (\\sE \\ lin_scheduler_fragments G. c' = Bra2LinConf cm (lin_extend_scheduler sE (Bra2LinFin G (bra_get_fixed_scheduler cn))))\"\n apply(subgoal_tac \"cn \\ bra_configurations G\")\n prefer 2\n apply(rule GBRA.belongs_configurations)\n apply(force)\n apply(force)\n apply(subgoal_tac \"cm \\ bra_configurations G\")\n prefer 2\n apply(rule GBRA.belongs_configurations)\n apply(force)\n apply(force)\n apply(induct \"n-m\" arbitrary: n m en cn em cm c')\n apply(rename_tac n m en cn em cm c')(*strict*)\n apply(clarsimp)\n apply(rename_tac m en cn c')(*strict*)\n apply(simp add: Bra2LinDer_def Bra2LinDer'_def)\n apply(clarsimp)\n apply(rename_tac m en cn)(*strict*)\n apply(rule_tac\n t=\"case_nat [] (nat_seq m) m\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac m en cn)(*strict*)\n apply(case_tac m)\n apply(rename_tac m en cn)(*strict*)\n apply(clarsimp)\n apply(rename_tac m en cn nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac en cn nat)(*strict*)\n apply (metis lessI nat_seqEmpty)\n apply(rename_tac m en cn)(*strict*)\n apply(rule conjI)\n apply(rename_tac m en cn)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_empty_scheduler_fragment G) (Bra2LinFin G (bra_get_fixed_scheduler cn))\"\n and s=\"Bra2LinFin G (bra_get_fixed_scheduler cn)\"\n in ssubst)\n apply(rename_tac m en cn)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_left_neutral)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(rule AX_Bra2LinFin_creates_proper_extension)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"lin_empty_scheduler_fragment G\"\n in bexI)\n apply(rename_tac m en cn)(*strict*)\n apply(force)\n apply(rename_tac m en cn)(*strict*)\n apply(rule GLIN.AX_empty_scheduler_fragment_in_scheduler_fragments)\n apply(force)\n apply(rename_tac x n m en cn em cm c')(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"n\"\n in meta_allE)\n apply(erule_tac\n x=\"Suc m\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"me c. d (Suc m) = Some (pair e c)\")\n apply(rename_tac x n m en cn em cm c')(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in GBRA.pre_some_position_is_some_position)\n apply(rename_tac x n m en cn em cm c')(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c')(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c')(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c')(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(subgoal_tac \"Bra2LinDer G d n (Suc m) \\ None\")\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_defined2)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c' e c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac x n m en cn em cm c' e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(erule_tac\n x=\"en\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"cn\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"c\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"b\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(simp add: Bra2LinDer_def Bra2LinDer'_def)\n apply(subgoal_tac \"c \\ bra_configurations G\")\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n prefer 2\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c' e c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(subgoal_tac \"case_nat [] (nat_seq (Suc m)) n = nat_seq (Suc m) (n - 1)\")\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n prefer 2\n apply(case_tac n)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE nat)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"case_nat [] (nat_seq m) n = nat_seq m (n - 1)\")\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n prefer 2\n apply(case_tac n)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE nat)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"case_nat [] (nat_seq (Suc m)) n = nat_seq (Suc m) (n - Suc 0)\")\n apply(thin_tac \"case_nat [] (nat_seq m) n = nat_seq m (n - Suc 0)\")\n apply(subgoal_tac \"foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq (Suc m) (n - Suc 0))) = sE\")\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n prefer 2\n apply(rule_tac\n s=\"Bra2LinFin G (bra_get_fixed_scheduler cn)\"\n in GLIN.AX_extend_scheduler_left_injective)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(rule schedE_generated)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(rule_tac\n cB=\"c\"\n in AX_Bra2LinConf_inj)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(rule_tac\n A=\"lin_scheduler_fragments G\"\n and a=\"((foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration(\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq m (n - Suc 0)))))\"\n in bexI_conj)\n apply(rename_tac x n m en cn em cm c option sE)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(subgoal_tac \"nat_seq m (n-Suc 0) = [m]@(nat_seq (Suc m) (n-Suc 0))\")\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n prefer 2\n apply(rule nat_seq_drop_first2)\n apply(force)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e c. d (Suc m) = Some (pair (Some e) c)\")\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc m\"\n in GBRA.pre_some_position_is_some_position_prime)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c option)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule_tac\n t=\"lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (Bra2LinStep cm e c)\"\n and s=\"Bra2LinStep cm e c\"\n in ssubst)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule_tac\n t=\"foldl lin_join_scheduler_fragments (Bra2LinStep cm e c) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0)))\"\n and s=\" lin_join_scheduler_fragments (Bra2LinStep cm e c) (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0))))\"\n in ssubst)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GLIN.AX_foldl_join_scheduler_fragments)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(subgoal_tac \"Suc m\\na \\ na \\ n-Suc 0\")\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n prefer 2\n apply(rule nat_seq_in_interval)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d na = Some (pair e1 c1) \\ d (Suc na) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e na e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_join_scheduler_fragments (Bra2LinStep cm e c) (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0))))) (Bra2LinFin G (bra_get_fixed_scheduler cn))\"\n and s=\"lin_extend_scheduler (Bra2LinStep cm e c) (lin_extend_scheduler (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc m) (n - Suc 0)))) (Bra2LinFin G (bra_get_fixed_scheduler cn)))\"\n in ssubst)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_compatible_to_join_scheduler_fragments)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule conjI)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinStep_translates_backwards_Bra2LinConf_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n apply(rename_tac x n m en cn em cm c e)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_preserves_configurations_prime: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n = Some (pair en cn)\n \\ d m = Some (pair em cm)\n \\ m \\ n\n \\ Bra2LinDer G d n m = Some (pair em c')\n \\ c' \\ lin_configurations G\"\n apply(subgoal_tac \"c' \\ lin_configurations G \\ (\\sE \\ lin_scheduler_fragments G. c' = Bra2LinConf cm (lin_extend_scheduler sE (Bra2LinFin G (bra_get_fixed_scheduler cn))))\")\n apply(force)\n apply(rule Bra2LinDer_preserves_configurations)\n apply(force)+\n done\n\nlemma Bra2LinDer_preserves_derivation: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n \\ None\n \\ GLIN.derivation G (Bra2LinDer G d n)\"\n apply(simp add: GLIN.derivation_def)\n apply(clarsimp)\n apply(rename_tac y i)(*strict*)\n apply(case_tac i)\n apply(rename_tac y i)(*strict*)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac y)(*strict*)\n prefer 2\n apply(rule GBRA.some_position_has_details_at_0)\n apply(force)\n apply(rename_tac y)(*strict*)\n apply(clarsimp)\n apply(rename_tac y c)(*strict*)\n apply(subgoal_tac \"\\c. Bra2LinDer G d n 0 = Some (pair None c)\")\n apply(rename_tac y c)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_preserves_step_labels)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(clarsimp)\n apply(rename_tac y i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat)(*strict*)\n apply(case_tac \"Bra2LinDer G d n (Suc nat)\")\n apply(rename_tac y nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc nat\\n\")\n apply(rename_tac y nat a)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_defined0)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac y nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(rule Bra2LinDer_defined1)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(force)\n apply(rename_tac y nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"\\c. Bra2LinDer G d n (Suc nat) = Some (pair (Some e2) c)\")\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_preserves_step_labels)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac y nat a e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(subgoal_tac \"Bra2LinDer G d n nat \\ None\")\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_defined2)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat e1 e2 c1 c2 c ya)(*strict*)\n apply(case_tac ya)\n apply(rename_tac y nat e1 e2 c1 c2 c ya option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat e1 e2 c1 c2 c option b)(*strict*)\n apply(case_tac y)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(subgoal_tac \"c \\ lin_configurations G \\ (\\sE \\ lin_scheduler_fragments G. c = Bra2LinConf c2 (lin_extend_scheduler sE (Bra2LinFin G (bra_get_fixed_scheduler ba))))\")\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_preserves_configurations)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(subgoal_tac \"b \\ lin_configurations G \\ (\\sE \\ lin_scheduler_fragments G. b = Bra2LinConf c1 (lin_extend_scheduler sE (Bra2LinFin G (bra_get_fixed_scheduler ba))))\")\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"nat\"\n in Bra2LinDer_preserves_configurations)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(force)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(simp add: Bra2LinDer_def)\n apply(rename_tac y nat e1 e2 c1 c2 c option b optiona ba)(*strict*)\n apply(simp add: Bra2LinDer_def Bra2LinDer'_def)\n apply(clarsimp)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(subgoal_tac \"case_nat [] (nat_seq (Suc nat)) n = nat_seq (Suc nat) (n - 1)\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n prefer 2\n apply(case_tac n)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa nata)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"case_nat [] (nat_seq nat) n = nat_seq nat (n - 1)\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n prefer 2\n apply(case_tac n)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa nata)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"case_nat [] (nat_seq (Suc nat)) n = nat_seq (Suc nat) (n - Suc 0)\")\n apply(thin_tac \"case_nat [] (nat_seq nat) n = nat_seq nat (n - Suc 0)\")\n apply(subgoal_tac \"\\x. Suc x=n-nat\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"n-Suc nat\"\n in exI)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa)(*strict*)\n apply(erule exE)+\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(subgoal_tac \"nat_seq nat (n-Suc 0) = [nat]@(nat_seq (Suc nat) (n-Suc 0))\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n prefer 2\n apply(rule nat_seq_drop_first2)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"sEa = (foldl lin_join_scheduler_fragments (lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (Bra2LinStep c1 e2 c2)) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq (Suc nat) (n - Suc 0))))\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(subgoal_tac \"sE = foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq (Suc nat) (n - Suc 0)))\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(clarify)\n apply(rule_tac\n t=\"lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (Bra2LinStep c1 e2 c2)\"\n and s=\"Bra2LinStep c1 e2 c2\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n t=\" (foldl lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))) \"\n and s=\" lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) ((foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))))\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_foldl_join_scheduler_fragments)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(subgoal_tac \"Suc nat\\na \\ na \\ n-Suc 0\")\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n prefer 2\n apply(rule nat_seq_in_interval)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d na = Some (pair e1 c1) \\ d (Suc na) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0))))) (Bra2LinFin G (bra_get_fixed_scheduler ba))\"\n and s=\" lin_extend_scheduler (Bra2LinStep c1 e2 c2) (lin_extend_scheduler (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))) (Bra2LinFin G (bra_get_fixed_scheduler ba)))\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_compatible_to_join_scheduler_fragments)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule schedE_generated)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_lin_step_relation_from_Bra2LinStep)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n s=\"Bra2LinFin G (bra_get_fixed_scheduler ba)\"\n in GLIN.AX_extend_scheduler_left_injective)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule schedE_generated)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n cB=\"c2\"\n in AX_Bra2LinConf_inj)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n s=\"Bra2LinFin G (bra_get_fixed_scheduler ba)\"\n in GLIN.AX_extend_scheduler_left_injective)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n t=\"lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (Bra2LinStep c1 e2 c2)\"\n and s=\"Bra2LinStep c1 e2 c2\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n t=\" (foldl lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))) \"\n and s=\" lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) ((foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))))\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_foldl_join_scheduler_fragments)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(subgoal_tac \"Suc nat\\na \\ na \\ n-Suc 0\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n prefer 2\n apply(rule nat_seq_in_interval)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d na = Some (pair e1 c1) \\ d (Suc na) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x na e1 e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0))))) (Bra2LinFin G (bra_get_fixed_scheduler ba))\"\n and s=\" lin_extend_scheduler (Bra2LinStep c1 e2 c2) (lin_extend_scheduler (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (nat_seq (Suc nat) (n - Suc 0)))) (Bra2LinFin G (bra_get_fixed_scheduler ba)))\"\n in ssubst)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_compatible_to_join_scheduler_fragments)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule schedE_generated)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule schedE_generated)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule_tac\n cB=\"c1\"\n in AX_Bra2LinConf_inj)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n apply(rename_tac nat e2 c1 c2 option optiona ba sE sEa x)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_preserves_belongs: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n \\ None\n \\ GLIN.belongs G (Bra2LinDer G d n)\"\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n prefer 2\n apply(rule GBRA.some_position_has_details_at_0)\n apply(force)\n apply(clarsimp)\n apply(rename_tac y c)(*strict*)\n apply(subgoal_tac \"\\c. Bra2LinDer G d n 0 = Some (pair None c)\")\n apply(rename_tac y c)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_preserves_step_labels)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(force)\n apply(rename_tac y c)(*strict*)\n apply(clarsimp)\n apply(rename_tac y c ca)(*strict*)\n apply(case_tac y)\n apply(rename_tac y c ca option b)(*strict*)\n apply(subgoal_tac \"ca \\ lin_configurations G \\ (\\sE \\ lin_scheduler_fragments G. ca = Bra2LinConf SScm (lin_extend_scheduler sE (Bra2LinFin G (bra_get_fixed_scheduler SScn))))\" for SScm SScn)\n apply(rename_tac y c ca option b)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"0\"\n and n=\"n\"\n in Bra2LinDer_preserves_configurations)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n prefer 4\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(force)\n apply(rename_tac y c ca option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c option b sE)(*strict*)\n apply(rule GLIN.derivation_belongs)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(rule Bra2LinDer_preserves_derivation)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n apply(rename_tac c option b sE)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_preserves_maximum_of_domain: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n \\ None\n \\ maximum_of_domain (Bra2LinDer G d n) n\"\n apply(simp add: maximum_of_domain_def)\n apply(simp add: Bra2LinDer_def)\n apply(case_tac \"d n\")\n apply(force)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n done\n\nlemma Lin2BraDer_preserves_belongs: \"\n TSstructure G\n \\ GLIN.derivation G d\n \\ GLIN.belongs G d\n \\ GBRA.belongs G (Lin2BraDer d)\"\n apply(simp add: GBRA.belongs_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n apply(case_tac \"d i\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac i option b)(*strict*)\n apply(simp add: GLIN.belongs_def)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rule AX_Lin2BraConf_preserves_configurations)\n apply(rename_tac i option b)(*strict*)\n apply(force)\n apply(rename_tac i option b)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_prime_pullout_head: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ n d m \\ None\n \\ d n = Some (pair e1 c1)\n \\ d (Suc n) = Some (pair (Some e2) c2)\n \\ c1 \\ bra_configurations G\n \\ Bra2LinDer' G d m n = lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (Bra2LinDer' G d m (Suc n))\"\n apply(subgoal_tac \"Bra2LinStep c1 e2 c2 \\ lin_scheduler_fragments G\")\n prefer 2\n apply(rule AX_Bra2LinStep_closed)\n apply(force)\n apply(force)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(force)\n apply(force)\n apply(force)\n apply(rule_tac\n t=\"Bra2LinDer' G d m n\"\n and s=\"foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case d n of Some (pair e1 c1) \\ case d (Suc n) of Some (pair (Some e2) c2) \\ Bra2LinStep c1 e2 c2) (case m of 0 \\ [] | Suc m' \\ nat_seq n m'))\"\n in ssubst)\n apply(simp add: Bra2LinDer'_def)\n apply(case_tac m)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat y)(*strict*)\n apply(rule_tac\n t=\"nat\"\n and s=\"(Suc nat)-(Suc 0)\"\n in ssubst)\n apply(rename_tac nat y)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(rule_tac\n t=\"nat_seq n ((Suc nat)-Suc 0)\"\n and s=\"[n]@(nat_seq (Suc n) ((Suc nat)-Suc 0))\"\n in ssubst)\n apply(rename_tac nat y)(*strict*)\n apply(rule_tac\n x=\"nat-n\"\n in nat_seq_drop_first2)\n apply(arith)\n apply(rename_tac nat y)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat y)(*strict*)\n apply(rule_tac\n t=\"lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (Bra2LinStep c1 e2 c2)\"\n and s=\"Bra2LinStep c1 e2 c2\"\n in ssubst)\n apply(rename_tac nat y)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac nat y)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(rule_tac\n t=\"foldl lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq (Suc n) nat))\"\n and s=\"lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (foldl lin_join_scheduler_fragments (lin_empty_scheduler_fragment G) (map (\\n. case_option undefined (case_derivation_configuration (\\e1 c1. case_option undefined (case_derivation_configuration (\\a c2. case a of Some e2 \\ Bra2LinStep c1 e2 c2)) (d (Suc n)))) (d n)) (nat_seq (Suc n) nat)))\"\n in ssubst)\n apply(rename_tac nat y)(*strict*)\n apply(rule GLIN.AX_foldl_join_scheduler_fragments)\n apply(rename_tac nat y)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat y na)(*strict*)\n apply(subgoal_tac \"Suc n\\na \\ na \\ nat\")\n apply(rename_tac nat y na)(*strict*)\n prefer 2\n apply(rule nat_seq_in_interval)\n apply(force)\n apply(rename_tac nat y na)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d na = Some (pair e1 c1) \\ d (Suc na) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac nat y na)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc nat\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac nat y na)(*strict*)\n apply(force)\n apply(rename_tac nat y na)(*strict*)\n apply(force)\n apply(rename_tac nat y na)(*strict*)\n apply(force)\n apply(rename_tac nat y na)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat y na e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac nat y)(*strict*)\n apply(simp add: Bra2LinDer'_def)\n done\n\nlemma Bra2LinDer_prime_closed: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d n \\ None\n \\ m\\n\n \\ Bra2LinDer' G d n m \\ lin_scheduler_fragments G\"\n apply(induct \"n-m\" arbitrary: n m)\n apply(rename_tac n m)(*strict*)\n apply(clarsimp)\n apply(rename_tac m y)(*strict*)\n apply(simp add: Bra2LinDer'_def)\n apply(rule_tac\n t=\"case m of 0 \\ [] | Suc m' \\ nat_seq m m'\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac m y)(*strict*)\n apply(case_tac m)\n apply(rename_tac m y)(*strict*)\n apply(clarsimp)\n apply(rename_tac m y nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y nat)(*strict*)\n apply (metis lessI nat_seqEmpty)\n apply(rename_tac m y)(*strict*)\n apply(rule_tac\n t=\"nat_seq m m\"\n and s=\"[m]\"\n in ssubst)\n apply(rename_tac m y)(*strict*)\n apply (metis natUptTo_n_n)\n apply(rename_tac m y)(*strict*)\n apply(clarsimp)\n apply (metis GLIN.AX_empty_scheduler_fragment_in_scheduler_fragments)\n apply(rename_tac x n m)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m y)(*strict*)\n apply(erule_tac\n x=\"n\"\n in meta_allE)\n apply(erule_tac\n x=\"Suc m\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d m = Some (pair e1 c1) \\ d (Suc m) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac x n m y)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac x n m y)(*strict*)\n apply(force)\n apply(rename_tac x n m y)(*strict*)\n apply(force)\n apply(rename_tac x n m y)(*strict*)\n apply(force)\n apply(rename_tac x n m y)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(case_tac \"n=m\")\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule_tac\n t=\"Bra2LinDer' G d n m\"\n and s=\"lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (Bra2LinDer' G d n (Suc m))\"\n in ssubst)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule Bra2LinDer_prime_pullout_head)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule GLIN.AX_join_scheduler_fragments_closed)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m y e1 e2 c1 c2)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinDer_prime_split: \"\n TSstructure G\n \\ y\\n\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d (n+x) \\ None\n \\ Bra2LinDer' G d (n + x) y = lin_join_scheduler_fragments (Bra2LinDer' G d n y) (Bra2LinDer' G d (n + x) n)\"\n apply(subgoal_tac \"Bra2LinDer' G d (n + x) y \\ lin_scheduler_fragments G\")\n prefer 2\n apply(rule Bra2LinDer_prime_closed)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"Bra2LinDer' G d n y \\ lin_scheduler_fragments G\")\n prefer 2\n apply(rule Bra2LinDer_prime_closed)\n apply(force)\n apply(force)\n apply(force)\n apply (metis GBRA.allPreMaxDomSome GBRA.derivationNoFromNone2_prime maximum_of_domain_def le_iff_add less_iff_Suc_add)\n apply(force)\n apply(subgoal_tac \"Bra2LinDer' G d (n + x) n \\ lin_scheduler_fragments G\")\n prefer 2\n apply(rule Bra2LinDer_prime_closed)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(induct \"n-y\" arbitrary: n y)\n apply(rename_tac n y)(*strict*)\n apply(simp add: Bra2LinDer'_def)\n apply(clarsimp)\n apply(rename_tac y ya)(*strict*)\n apply(case_tac \"y+x\")\n apply(rename_tac y ya)(*strict*)\n apply(clarsimp)\n apply(rename_tac ya)(*strict*)\n apply (metis GLIN.AX_join_scheduler_fragments_neutral_left)\n apply(rename_tac y ya nat)(*strict*)\n apply(clarsimp)\n apply(case_tac y)\n apply(rename_tac y ya nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac ya nat)(*strict*)\n apply(rule sym)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac ya nat)(*strict*)\n apply(force)\n apply(rename_tac ya nat)(*strict*)\n apply(force)\n apply(rename_tac y ya nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac ya nata)(*strict*)\n apply(rule_tac\n t=\"nat_seq (Suc nata) nata\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac ya nata)(*strict*)\n apply (metis le_refl less_eq_Suc_le_raw nat_seqEmpty)\n apply(rename_tac ya nata)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule GLIN.AX_join_scheduler_fragments_neutral_right)\n apply(rename_tac ya nata)(*strict*)\n apply(force)\n apply(rename_tac ya nata)(*strict*)\n apply(force)\n apply(rename_tac xa n y)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa n y ya)(*strict*)\n apply(erule_tac\n x=\"n\"\n in meta_allE)\n apply(erule_tac\n x=\"Suc y\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac xa n y ya)(*strict*)\n apply(rule Bra2LinDer_prime_closed)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac xa n y ya)(*strict*)\n apply(rule Bra2LinDer_prime_closed)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply (metis GBRA.allPreMaxDomSome GBRA.derivationNoFromNone_prime GBRA.derivationNoFromNone2 maximum_of_domain_def le_iff_add less_iff_Suc_add)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d y = Some (pair e1 c1) \\ d (Suc y) = Some (pair (Some e2) c2) \\ bra_step_relation G c1 e2 c2\")\n apply(rename_tac xa n y ya)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n+x\"\n in GBRA.step_detail_before_some_position)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"Bra2LinDer' G d (n+x) y = lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (Bra2LinDer' G d (n+x) (Suc y))\")\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_prime_pullout_head)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Bra2LinDer' G d n y = lin_join_scheduler_fragments (Bra2LinStep c1 e2 c2) (Bra2LinDer' G d n (Suc y))\")\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule Bra2LinDer_prime_pullout_head)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply (metis GBRA.allPreMaxDomSome GBRA.derivationNoFromNone_prime GBRA.derivationNoFromNone2 maximum_of_domain_def le_iff_add less_iff_Suc_add)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rule GLIN.AX_join_scheduler_fragments_associative)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply (metis AX_Bra2LinStep_closed GBRA.belongs_configurations)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(rule Bra2LinDer_prime_closed)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply (metis GBRA.allPreMaxDomSome GBRA.derivationNoFromNone_prime GBRA.derivationNoFromNone2 maximum_of_domain_def le_iff_add less_iff_Suc_add)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(rule Bra2LinDer_prime_closed)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac xa n y ya e1 e2 c1 c2)(*strict*)\n apply(force)\n done\n\nlemma Bra2LinConf_closed_wrt_Bra2LinDer_prime: \"\n TSstructure G\n \\ GBRA.derivation G db\n \\ GBRA.belongs G db\n \\ db n = Some (pair e1 c1)\n \\ n\\m\n \\ db m = Some (pair e2 c2)\n \\ Bra2LinConf c1 (lin_extend_scheduler (Bra2LinDer' G db m n) (Bra2LinFin G (bra_get_fixed_scheduler c2))) \\ lin_configurations G\"\n apply(induct \"m-n\" arbitrary: n m e1 c1 e2 c2)\n apply(rename_tac n m e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e2 c2)(*strict*)\n apply(simp add: Bra2LinDer'_def)\n apply(rule_tac\n t=\"case n of 0 \\ [] | Suc m' \\ nat_seq n m'\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac n e2 c2)(*strict*)\n apply(case_tac n)\n apply(rename_tac n e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e2 c2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2 c2 nat)(*strict*)\n apply (metis lessI nat_seqEmpty)\n apply(rename_tac n e2 c2)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_empty_scheduler_fragment G) (Bra2LinFin G (bra_get_fixed_scheduler c2))\"\n and s=\"(Bra2LinFin G (bra_get_fixed_scheduler c2))\"\n in ssubst)\n apply(rename_tac n e2 c2)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_left_neutral)\n apply(rename_tac n e2 c2)(*strict*)\n apply(force)\n apply(rename_tac n e2 c2)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac n e2 c2)(*strict*)\n apply(force)\n apply(rename_tac n e2 c2)(*strict*)\n apply (metis GBRA.belongs_configurations)\n apply(rename_tac n e2 c2)(*strict*)\n apply (metis AX_Bra2LinFin_creates_proper_extension GBRA.belongs_configurations)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(erule_tac\n x=\"Suc n\"\n in meta_allE)\n apply(erule_tac\n x=\"m\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e c. db (Suc n) = Some (pair (Some e) c)\")\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(erule_tac\n x=\"Some e\"\n in meta_allE)\n apply(erule_tac\n x=\"c\"\n in meta_allE)\n apply(erule_tac\n x=\"e2\"\n in meta_allE)\n apply(erule_tac\n x=\"c2\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule_tac\n t=\"Bra2LinDer' G db m n\"\n and s=\"lin_join_scheduler_fragments (Bra2LinStep c1 e (c)) (Bra2LinDer' G db m (Suc n))\"\n in ssubst)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule Bra2LinDer_prime_pullout_head)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule_tac\n t=\"lin_extend_scheduler (lin_join_scheduler_fragments (Bra2LinStep c1 e (c)) (Bra2LinDer' G db m (Suc n))) (Bra2LinFin G (bra_get_fixed_scheduler c2)) \"\n and s=\" lin_extend_scheduler (Bra2LinStep c1 e (c)) (lin_extend_scheduler (Bra2LinDer' G db m (Suc n)) (Bra2LinFin G (bra_get_fixed_scheduler c2)))\"\n in ssubst)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GLIN.AX_extend_scheduler_compatible_to_join_scheduler_fragments)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule AX_Bra2LinStep_closed)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule Bra2LinDer_prime_closed)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule AX_Bra2LinFin_closed)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule AX_Bra2LinStep_translates_backwards_Bra2LinConf_closed)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.belongs_configurations)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(rule GBRA.position_change_due_to_step_relation)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2 e c)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(subgoal_tac \"\\e c. db (Suc n) = Some (pair (Some e) c)\")\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"m\"\n in GBRA.pre_some_position_is_some_position_prime)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e1 c1 e2 c2)(*strict*)\n apply(simp add: Lin2BraDer_def derivation_map_def)\n done\n\nlemma AX_Bra2LinConf_preserves_history_lift: \"\n TSstructure G\n \\ GBRA.derivation G d\n \\ GBRA.belongs G d\n \\ d i = Some (pair e c)\n \\ d n \\ None\n \\ i\\n\n \\ lin_get_history (the(get_configuration(Bra2LinDer G d n i))) = bra_get_history c\"\n apply(simp add: Bra2LinDer_def get_configuration_def)\n apply(case_tac \"d n\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac option b)(*strict*)\n apply(rule AX_Bra2LinConf_preserves_history)\n apply(rename_tac option b)(*strict*)\n apply(force)\n apply(rename_tac option b)(*strict*)\n apply (metis GBRA.belongs_configurations)\n apply(rename_tac option b)(*strict*)\n apply (metis Bra2LinDer_prime_closed AX_Bra2LinFin_closed GBRA.belongs_configurations GBRA.derivationNoFromNone GBRA.derivationNoFromNone2 GLIN.AX_extend_scheduler_closed lessI)\n apply(rename_tac option b)(*strict*)\n apply (metis Bra2LinConf_closed_wrt_Bra2LinDer_prime)\n done\n\nlemma AX_Lin2BraConf_preserves_history_lift: \"\n TSstructure G\n \\ GLIN.derivation G d\n \\ GLIN.belongs G d\n \\ d n = Some (pair e c)\n \\ lin_get_history c = bra_get_history (Lin2BraConf c)\"\n apply(rule AX_Lin2BraConf_preserves_history)\n apply(force)+\n apply (metis GLIN.belongs_configurations)\n done\n\nend\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Branching_Versus_Linear1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2895998946708848}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory ClockView\nimports\n KBPsAlg\n Eval\n List_local\n ODList\n Trie2\n \"Transitive-Closure.Transitive_Closure_List_Impl\"\n \"HOL-Library.Mapping\"\nbegin\n(*>*)\n\nsubsection\\The Clock View\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view}\n\nThe \\emph{clock view} records the current time and the observation for\nthe most recent state:\n\n\\\n\ndefinition (in Environment)\n clock_jview :: \"('a, 's, nat \\ 'obs) JointView\"\nwhere\n \"clock_jview \\ \\a t. (tLength t, envObs a (tLast t))\"\n(*<*)\n\ncontext Environment\nbegin\n\nlemma clock_jview_tInit:\n \"clock_jview a (tInit s) = (0, envObs a s)\"\n unfolding clock_jview_def by simp\n\nlemma clock_jview_tStep:\n \"clock_jview a (t \\ s) = (Suc (tLength t), envObs a s)\"\n unfolding clock_jview_def by simp\n\nlemma clock_jview_tStepI[intro]:\n \"\\ tLength t = Suc n; envObs a (tLast t) = obs \\\n \\ clock_jview a t = (Suc n, obs)\"\n unfolding clock_jview_def by (cases t) simp_all\n\nlemma clock_jview_inv:\n \"clock_jview a t = (n, obs) \\ envObs a (tLast t) = obs\"\n unfolding clock_jview_def by (cases t) simp_all\n\nlemmas clock_jview_simps =\n clock_jview_tInit\n clock_jview_tStep\n clock_jview_inv\n\nlemma clock_jview_eq_inv[iff]:\n \"clock_jview a t' = clock_jview a t\n \\ tLength t' = tLength t \\ envObs a (tLast t') = envObs a (tLast t)\"\n by (fastforce simp: clock_jview_def)\n\nend(*>*)\n\ntext\\\n\nThis is the least-information synchronous view, given the requirements\nof \\S\\ref{sec:kbps-views}. We show that finite-state implementations\nexist for all environments with respect to this view as per\n\\citet{Ron:1996}.\n\nThe corresponding incremental view simply increments the counter\nrecords the new observation.\n\n\\\n\ndefinition (in Environment)\n clock_jviewInit :: \"'a \\ 'obs \\ nat \\ 'obs\"\nwhere\n \"clock_jviewInit \\ \\a obs. (0, obs)\"\n\ndefinition (in Environment)\n clock_jviewIncr :: \"'a \\ 'obs \\ nat \\ 'obs \\ nat \\ 'obs\"\nwhere\n \"clock_jviewIncr \\ \\a obs' (l, obs). (l + 1, obs')\"\n\ntext\\\n\nIt is straightforward to demonstrate the assumptions of the\nincremental environment locale (\\S\\ref{sec:kbps-environments}) with\nrespect to an arbitrary environment.\n\n\\\n\nsublocale Environment\n < Clock: IncrEnvironment jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n(*<*)\n apply (unfold_locales)\n apply (simp_all add: clock_jviewInit_def clock_jviewIncr_def clock_jview_def)\n done\n\n(*>*)\ntext\\\n\nAs we later show, satisfaction of a formula at a trace \\t \\\nClock.jkbpC\\<^bsub>n\\<^esub>\\ is determined by the set of final states of traces in\n\\Clock.jkbpCn\\:\n\n\\\n\ncontext Environment\nbegin\n\nabbreviation clock_commonAbs :: \"'s Trace \\ 's set\" where\n \"clock_commonAbs t \\ tLast ` Clock.jkbpCn (tLength t)\"\n\ntext\\\n\nIntuitively this set contains the states that the agents commonly\nconsider possible at time @{term \"n\"}, which is sufficient for\ndetermining knowledge as the clock view ignores paths. Therefore we\ncan simulate trace @{term \"t\"} by pairing this abstraction of @{term\n\"t\"} with its final state:\n\n\\\n\ntype_synonym (in -) 's clock_simWorlds = \"'s set \\ 's\"\n\ndefinition clock_sim :: \"'s Trace \\ 's clock_simWorlds\" where\n \"clock_sim \\ \\t. (clock_commonAbs t, tLast t)\"\n\ntext\\\n\nIn the Kripke structure for our simulation, we relate worlds for\n@{term \"a\"} if the sets of commonly-held states coincide, and the\nobservation of the final states of the traces is the\nsame. Propositions are evaluated at the final state.\n\n\\\n\ndefinition clock_simRels :: \"'a \\ 's clock_simWorlds Relation\" where\n \"clock_simRels \\ \\a. { ((X, s), (X', s')) |X X' s s'.\n X = X' \\ {s, s'} \\ X \\ envObs a s = envObs a s' }\"\n\ndefinition clock_simVal :: \"'s clock_simWorlds \\ 'p \\ bool\" where\n \"clock_simVal \\ envVal \\ snd\"\n\nabbreviation clock_simMC :: \"('a, 'p, 's clock_simWorlds) KripkeStructure\" where\n \"clock_simMC \\ mkKripke (clock_sim ` Clock.jkbpC) clock_simRels clock_simVal\"\n(*<*)\n\nlemma clock_simVal_def2[iff]: \"clock_simVal (clock_sim t) = envVal (tLast t)\"\n unfolding clock_sim_def clock_simVal_def by simp\n\nlemma clock_sim_range:\n \"sim_range Clock.MC clock_simMC clock_sim\"\n by (rule sim_rangeI) (simp_all add: clock_sim_def)\n\nlemma clock_simVal:\n \"sim_val Clock.MC clock_simMC clock_sim\"\n by (rule sim_valI) (simp add: clock_simVal_def clock_sim_def)\n\nlemma clock_sim_f:\n \"sim_f Clock.MC clock_simMC clock_sim\"\napply (rule sim_fI)\napply (simp add: clock_simRels_def clock_sim_def)\napply (intro conjI)\n apply (fastforce intro!: imageI)\n apply (fastforce intro!: imageI)\n apply (fastforce dest: Clock.mkM_simps(2))\napply (rule_tac x=v in image_eqI)\n apply simp_all\ndone\n\nlemma clock_sim_r:\n \"sim_r Clock.MC clock_simMC clock_sim\"\n apply (rule sim_rI)\n apply (clarsimp simp: clock_simRels_def clock_sim_def cong del: image_cong_simp)\n apply (rule_tac x=xa in exI)\n unfolding Clock.mkM_def\n apply auto\n done\n\n(*>*)\ntext\\\n\nThat this is in fact a simulation\n(\\S\\ref{sec:kripke-theory-simulations}) is entirely straightforward.\n\n\\\n\nlemma clock_sim:\n \"sim Clock.MC clock_simMC clock_sim\"\n(*<*)\n using clock_sim_range clock_simVal clock_sim_f clock_sim_r\n unfolding sim_def\n by blast\n(*>*)\n\nend (* context Environment *)\n\ntext\\\n\nThe \\SimIncrEnvironment\\ of\n\\S\\ref{sec:kbps-theory-automata-env-sims} only requires that we\nprovide it an @{term \"Environment\"} and a simulation.\n\n\\\n\nsublocale Environment\n < Clock: SimIncrEnvironment jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n clock_sim clock_simRels clock_simVal\n(*<*)\n by (unfold_locales, simp_all add: clock_sim)\n(*>*)\n\ntext\\\n\nWe next consider algorithmic issues.\n\n\\\n\n(* **************************************** *)\n\nsubsubsection\\Representations\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-rep}\n\nWe now turn to the issue of how to represent equivalence classes of\nstates. As these are used as map keys, it is easiest to represent them\ncanonically. A simple approach is to use \\emph{ordered distinct lists}\nof type @{typ \"'a odlist\"} for the sets and \\emph{tries} for the\nmaps. Therefore we ask that environment states @{typ \"'s\"} belong to\nthe class \\linorder\\ of linearly-ordered types, and moreover\nthat the set \\agents\\ be effectively presented. We introduce a\nnew locale capturing these requirements:\n\n\\\n\nlocale FiniteLinorderEnvironment =\n Environment jkbp envInit envAction envTrans envVal envObs\n for jkbp :: \"('a::{finite, linorder}, 'p, 'aAct) JKBP\"\n and envInit :: \"('s::{finite, linorder}) list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n and envObs :: \"'a \\ 's \\ 'obs\"\n+ fixes agents :: \"'a odlist\"\n assumes agents: \"ODList.toSet agents = UNIV\"\n\ncontext FiniteLinorderEnvironment\nbegin\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-algops}\n\nFor a fixed agent @{term \"a\"}, we can reduce the number of worlds in\n@{term \"clock_simMC\"} by taking its quotient with respect to the\nequivalence relation for @{term \"a\"}. In other words, we represent a\nsimulated equivalence class by a pair of the set of all states\nreachable at a particular time, and the subset of these that @{term\n\"a\"} considers possible. The worlds in our representational Kripke\nstructure are therefore a pair of ordered, distinct lists:\n\n\\\n\ntype_synonym (in -) 's clock_simWorldsRep = \"'s odlist \\ 's odlist\"\n\ntext\\\n\nWe can readily abstract a representation to a set of simulated\nequivalence classes:\n\n\\\n\ndefinition (in -)\n clock_simAbs :: \"'s::linorder clock_simWorldsRep \\ 's clock_simWorlds set\"\nwhere\n \"clock_simAbs X \\ { (ODList.toSet (fst X), s) |s. s \\ ODList.toSet (snd X) }\"\n\ntext\\\n\nAssuming @{term \"X\"} represents a simulated equivalence class for\n@{term \"t \\ jkbpC\"}, @{term \"clock_simAbs X\"} decomposes into these\ntwo functions:\n\n\\\n\ndefinition\n agent_abs :: \"'a \\ 's Trace \\ 's set\"\nwhere\n \"agent_abs a t \\\n { tLast t' |t'. t' \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t}\"\n\ndefinition\n common_abs :: \"'s Trace \\ 's set\"\nwhere\n \"common_abs t \\ tLast ` Clock.jkbpCn (tLength t)\"\n(*<*)\n\nlemma aec_refl[intro, simp]:\n \"t \\ Clock.jkbpC \\ tLast t \\ agent_abs a t\"\n unfolding agent_abs_def by auto\n\nlemma aec_cec_subset:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"x \\ ODList.toSet aec \\ x \\ ODList.toSet cec\"\n using assms\n unfolding agent_abs_def common_abs_def\n by fastforce\n\nlemma clock_simAbs_refl:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_sim t \\ clock_simAbs ec\"\n using assms by simp\n\nlemma common_abs:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (fst ec) = common_abs t\"\n using tC clock_simAbs_refl[OF tC ec]\n unfolding clock_sim_def clock_simAbs_def common_abs_def\n by (auto simp: ODList.toSet_def[symmetric])\n\nlemma agent_abs:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (snd ec) = agent_abs a t\"\n using assms\n unfolding clock_sim_def clock_simAbs_def agent_abs_def\n apply auto\n apply (subgoal_tac \"(ODList.toSet (fst ec), x) \\ {(ODList.toSet (fst ec), s) |s. s \\ ODList.toSet (snd ec)}\")\n apply auto (* FIXME filthy *)\n done\n\n(*>*)\ntext\\\n\nThis representation is canonical on the domain of interest (though not\nin general):\n\n\\\n\nlemma clock_simAbs_inj_on:\n \"inj_on clock_simAbs { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n(*<*)\nproof(rule inj_onI)\n fix x y\n assume x: \"x \\ { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n and y: \"y \\ { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n and xy: \"clock_simAbs x = clock_simAbs y\"\n from x obtain a t\n where tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs x = Clock.sim_equiv_class a t\"\n by auto\n from common_abs[OF tC ec] common_abs[OF tC trans[OF xy[symmetric] ec], symmetric]\n have \"fst x = fst y\" by (blast intro: injD[OF toSet_inj])\n moreover\n from agent_abs[OF tC ec] agent_abs[OF tC trans[OF xy[symmetric] ec], symmetric]\n have \"snd x = snd y\" by (blast intro: injD[OF toSet_inj])\n ultimately show \"x = y\" by (simp add: prod_eqI)\nqed\n(*>*)\ntext\\\n\nWe could further compress this representation by labelling each\nelement of the set of states reachable at time $n$ with a bit to\nindicate whether the agent considers that state possible. Note,\nhowever, that the representation would be non-canonical: if \\(s, True)\\ is in the representation, indicating that the agent\nconsiders \\s\\ possible, then \\(s, False)\\ may or may\nnot be. The associated abstraction function is not injective and hence\nwould obfuscate the following. Repairing this would entail introducing\na new type, which would again complicate this development.\n\n\n\nThe following lemmas make use of this Kripke structure, constructed\nfrom the set of final states of a temporal slice @{term \"X\"}:\n\n\\\n\ndefinition\n clock_repRels :: \"'a \\ ('s \\ 's) set\"\nwhere\n \"clock_repRels \\ \\a. { (s, s'). envObs a s = envObs a s' }\"\n\nabbreviation\n clock_repMC :: \"'s set \\ ('a, 'p, 's) KripkeStructure\"\nwhere\n \"clock_repMC \\ \\X. mkKripke X clock_repRels envVal\"\n(*<*)\n\nlemma clock_repMC_kripke[intro, simp]: \"kripke (clock_repMC X)\"\n by (rule kripkeI) simp\n\nlemma clock_repMC_S5n[intro, simp]: \"S5n (clock_repMC X)\"\n unfolding clock_repRels_def\n by (intro S5nI equivI refl_onI symI transI) auto\n\n(*>*)\ntext\\\n\nWe can show that this Kripke structure retains sufficient information\nfrom @{term \"Clock.MCS\"} by showing simulation. This is eased by\nintroducing an intermediary structure that focusses on a particular\ntrace:\n\n\\\n\nabbreviation\n clock_jkbpCSt :: \"'b Trace \\ 's clock_simWorlds set\"\nwhere\n \"clock_jkbpCSt t \\ clock_sim ` Clock.jkbpCn (tLength t)\"\n\nabbreviation\n clock_simMCt :: \"'b Trace \\ ('a, 'p, 's clock_simWorlds) KripkeStructure\"\nwhere\n \"clock_simMCt t \\ mkKripke (clock_jkbpCSt t) clock_simRels clock_simVal\"\n\ndefinition clock_repSim :: \"'s clock_simWorlds \\ 's\" where\n \"clock_repSim \\ snd\"\n(*<*)\n\nlemma jkbpCSt_jkbpCS_subset:\n \"clock_jkbpCSt t \\ clock_sim ` Clock.jkbpC\"\n by auto\n\nlemma jkbpCSt_refl[iff]:\n \"t \\ Clock.jkbpC \\ clock_sim t \\ clock_jkbpCSt t\"\n by blast\n\nlemma fst_clock_sim[iff]:\n \"t \\ Clock.jkbpC \\ fst (clock_sim t) = tLast ` Clock.jkbpCn (tLength t)\"\n by (simp add: clock_sim_def)\n\nlemma clock_repSim_simps[simp]:\n \"clock_repSim ` clock_sim ` T = tLast ` T\"\n \"clock_repSim (clock_sim t) = tLast t\"\n unfolding clock_repSim_def clock_sim_def\n by (auto intro!: image_eqI)\n\n(*>*)\ntext\\\\\n\nlemma clock_repSim:\n assumes tC: \"t \\ Clock.jkbpC\"\n shows \"sim (clock_simMCt t)\n ((clock_repMC \\ fst) (clock_sim t))\n clock_repSim\"\n(*<*) (is \"sim ?M ?M' ?f\")\nproof\n show \"sim_range ?M ?M' ?f\"\n proof\n show \"worlds ?M' = ?f ` worlds ?M\"\n unfolding clock_sim_def clock_repSim_def by force\n next\n fix a\n show \"relations ?M' a \\ worlds ?M' \\ worlds ?M'\"\n by (simp add: clock_sim_def clock_repSim_def)\n qed\nnext\n show \"sim_val ?M ?M' ?f\"\n by (rule, simp add: clock_sim_def clock_simVal_def clock_repSim_def split: prod.split)\nnext\n show \"sim_f ?M ?M' ?f\"\n apply rule\n unfolding clock_repRels_def clock_repSim_def clock_simRels_def\n apply (auto iff: clock_sim_def)\n done\nnext\n show \"sim_r ?M ?M' ?f\"\n apply rule\n unfolding clock_repRels_def clock_repSim_def clock_simRels_def clock_sim_def\n apply clarsimp\n done\nqed\n\n(*>*)\ntext\\\n\nThe following sections show how we satisfy the remaining requirements\nof the \\Algorithm\\ locale of\nFigure~\\ref{fig:kbps-alg-alg-locale}. Where the proof is routine, we\nsimply present the lemma without proof or comment.\n\nDue to a limitation in the code generator in the present version of\nIsabelle (2011), we need to define the equations we wish to execute\noutside of a locale; the syntax \\(in -)\\ achieves this by\nmaking definitons at the theory top-level. We then define (but elide)\nlocale-local abbreviations that supply the locale-bound variables to\nthese definitions.\n\n\\\n\n(* **************************************** *)\n\nsubsubsection\\Initial states\\\n\ntext\\\n\nThe initial states of the automaton for an agent is simply @{term\n\"envInit\"} paired with the partition of @{term \"envInit\"} under the\nagent's observation.\n\n\\\n\ndefinition (in -)\n clock_simInit :: \"('s::linorder) list \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 'obs \\ 's clock_simWorldsRep\"\nwhere\n \"clock_simInit envInit envObs \\ \\a iobs.\n let cec = ODList.fromList envInit\n in (cec, ODList.filter (\\s. envObs a s = iobs) cec)\"\n(*<*)\n\nabbreviation\n clock_simInit :: \"'a \\ 'obs \\ 's clock_simWorldsRep\"\nwhere\n \"clock_simInit \\ ClockView.clock_simInit envInit envObs\"\n\n(*>*)\ntext\\\\\n\nlemma clock_simInit:\n assumes \"iobs \\ envObs a ` set envInit\"\n shows \"clock_simAbs (clock_simInit a iobs)\n = clock_sim ` { t' \\ Clock.jkbpC.\n clock_jview a t' = clock_jviewInit a iobs }\"\n(*<*)\n using assms\n unfolding clock_simInit_def clock_simAbs_def clock_sim_def [abs_def] Let_def\n apply clarsimp\n apply rule\n apply clarsimp\n apply (rule_tac x=\"tInit s\" in image_eqI)\n apply (auto simp: Set.image_def Clock.jviewInit)[2]\n apply clarsimp\n apply (case_tac xa)\n apply clarsimp\n apply rule\n apply rule\n apply clarsimp\n apply clarsimp\n apply (rule_tac x=\"tInit xa\" in image_eqI)\n apply (auto intro!: image_eqI simp: Clock.jviewInit)\n done\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated observations\\\n\ntext\\\n\nAgent @{term \"a\"} will make the same observation at any of the worlds\nthat it considers possible, so we choose the first one in the list:\n\n\\\n\ndefinition (in -)\n clock_simObs :: \"('a \\ ('s :: linorder) \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 'obs\"\nwhere\n \"clock_simObs envObs \\ \\a. envObs a \\ ODList.hd \\ snd\"\n(*<*)\n\nabbreviation\n clock_simObs :: \"'a \\ 's clock_simWorldsRep \\ 'obs\"\nwhere\n \"clock_simObs \\ ClockView.clock_simObs envObs\"\n\n(*>*)\ntext\\\\\n\nlemma clock_simObs:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_simObs a ec = envObs a (tLast t)\"\n(*<*)\nproof -\n have A: \"\\s \\ set (toList (snd ec)). envObs a s = envObs a (tLast t)\"\n using agent_abs[OF tC ec]\n by (clarsimp simp: agent_abs_def toSet_def)\n have B: \"tLast t \\ set (toList (snd ec))\"\n using clock_simAbs_refl[OF assms]\n unfolding clock_simAbs_def clock_sim_def\n by (simp add: toSet_def snd_def)\n show ?thesis\n unfolding clock_simObs_def by (simp add: list_choose_hd[OF A B] ODList.hd_def)\nqed\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Evaluation\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-eval}\n\nWe define our \\eval\\ function in terms of @{term \"evalS\"},\nwhich implements boolean logic over @{typ \"'s odlist\"} in the usual\nway -- see \\S\\ref{sec:kbps-spr-single-agent-eval} for the relevant\nclauses. It requires three functions specific to the representation:\none each for propositions, knowledge and common knowledge.\n\nPropositions define subsets of the worlds considered possible:\n\n\\\n\nabbreviation (in -)\n clock_evalProp :: \"(('s::linorder) \\ 'p \\ bool)\n \\ 's odlist \\ 'p \\ 's odlist\"\nwhere\n \"clock_evalProp envVal \\ \\X p. ODList.filter (\\s. envVal s p) X\"\n\ntext\\\n\nThe knowledge relation computes the subset of the\ncommonly-held-possible worlds \\cec\\ that agent @{term \"a\"}\nconsiders possible at world @{term \"s\"}:\n\n\\\n\ndefinition (in -)\n clock_knowledge :: \"('a \\ ('s :: linorder) \\ 'obs) \\ 's odlist\n \\ 'a \\ 's \\ 's odlist\"\nwhere\n \"clock_knowledge envObs cec \\ \\a s.\n ODList.filter (\\s'. envObs a s = envObs a s') cec\"\n\ntext\\\n\n\nSimilarly the common knowledge operation computes the transitive\nclosure of the union of the knowledge relations for the agents \\as\\:\n\n\\\n\ndefinition (in -)\n clock_commonKnowledge :: \"('a \\ ('s :: linorder) \\ 'obs) \\ 's odlist\n \\ 'a list \\ 's \\ 's odlist\"\nwhere\n \"clock_commonKnowledge envObs cec \\ \\as s.\n let r = \\a. ODList.fromList [ (s', s'') . s' \\ toList cec, s'' \\ toList cec,\n envObs a s' = envObs a s'' ];\n R = toList (ODList.big_union r as)\n in ODList.fromList (memo_list_trancl R s)\"\n\ntext\\\n\nThe function \\memo_list_trancl\\ comes from the executable\ntransitive closure theory of \\citep{AFP:TRANCL}.\n\nThe evaluation function evaluates a subjective knowledge formula on\nthe representation of an equivalence class:\n\n\\\n\ndefinition (in -)\n eval :: \"(('s :: linorder) \\ 'p \\ bool)\n \\ ('a \\ 's \\ 'obs)\n \\ 's clock_simWorldsRep \\ ('a, 'p) Kform \\ bool\"\nwhere\n \"eval envVal envObs \\ \\(cec, aec). evalS (clock_evalProp envVal)\n (clock_knowledge envObs cec)\n (clock_commonKnowledge envObs cec)\n aec\"\n\ntext\\\n\nThis function corresponds with the standard semantics:\n\n\\\n(*<*)\n\nlemma clock_coEC_relation_image:\n \"s \\ ODList.toSet Y\n \\ ODList.toSet (clock_knowledge envObs Y a s) = relations (clock_repMC (ODList.toSet Y)) a `` {s}\"\n unfolding clock_knowledge_def clock_repRels_def Image_def\n by auto\n\nlemma clock_commonKnowledge_relation_image_aux:\n \"(\\x\\set as. \\a\\ODList.toSet Y. \\aa\\ODList.toSet Y \\ {s''. envObs x a = envObs x s''}. {(a, aa)})\n = ((\\a\\set as. {(s, s'). envObs a s = envObs a s'}) \\ ODList.toSet Y \\ ODList.toSet Y)\"\n by auto\n\nlemma clock_commonKnowledge_relation_image:\n \"s \\ ODList.toSet Y\n \\ ODList.toSet (clock_commonKnowledge envObs Y as s) = (\\a \\ set as. relations (clock_repMC (ODList.toSet Y)) a)\\<^sup>+ `` {s}\"\n unfolding clock_commonKnowledge_def clock_repRels_def Let_def\n apply (simp add: memo_list_trancl toSet_def[symmetric] Image_def clock_commonKnowledge_relation_image_aux)\n done\n\nlemma eval_rec_models:\n assumes XY: \"ODList.toSet X \\ ODList.toSet Y\"\n and s: \"s \\ ODList.toSet X\"\n shows \"s \\ ODList.toSet (eval_rec (clock_evalProp envVal) (clock_knowledge envObs Y) (clock_commonKnowledge envObs Y) X \\)\n \\ clock_repMC (ODList.toSet Y), s \\ \\\"\nusing XY s\nproof(induct \\ arbitrary: X s)\n case (Kknows a' \\ X s)\n from \\s \\ ODList.toSet X\\ clock_coEC_relation_image[OF subsetD[OF Kknows(2) Kknows(3)], where a=a']\n show ?case\n apply simp\n apply rule\n apply (drule arg_cong[where f=\"ODList.toSet\"])\n apply (clarsimp simp: odlist_all_iff)\n apply (cut_tac s3=\"w'\" and X3=\"clock_knowledge envObs Y a' s\" in Kknows.hyps)\n using Kknows(2) Kknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])[3]\n\n apply (clarsimp simp: toSet_eq_iff odlist_all_iff)\n apply (subst Kknows.hyps)\n using Kknows(2) Kknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])\n done\nnext\n case (Kcknows as \\ X s)\n show ?case\n proof(cases \"as = Nil\")\n case True with \\s \\ ODList.toSet X\\ show ?thesis by clarsimp\n next\n case False\n with \\s \\ ODList.toSet X\\ clock_commonKnowledge_relation_image[OF subsetD[OF Kcknows(2) Kcknows(3)], where as=as]\n show ?thesis\n apply simp\n apply rule\n apply (drule arg_cong[where f=\"ODList.toSet\"])\n apply (clarsimp simp: odlist_all_iff)\n apply (cut_tac s3=\"w'\" and X3=\"clock_commonKnowledge envObs Y as s\" in Kcknows.hyps)\n using Kcknows(2) Kcknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])[3]\n apply (subst (asm) trancl_unfold) back back back\n apply auto[1] (* FIXME disgusting *)\n\n apply (clarsimp simp: toSet_eq_iff odlist_all_iff)\n apply (subst Kcknows.hyps)\n using Kcknows(2) Kcknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])\n apply (subst (asm) trancl_unfold) back back back\n apply auto[1] (* FIXME disgusting *)\n\n done\n qed\nqed simp_all\n\nlemma trc_aux:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"ODList.toSet (big_union (clock_commonKnowledge envObs cec as) (toList aec)) \\ ODList.toSet cec\"\n apply (clarsimp simp: toSet_def[symmetric])\n apply (subst (asm) clock_commonKnowledge_relation_image)\n apply (erule aec_cec_subset[OF tC aec cec])\n apply (subst (asm) trancl_unfold)\n using assms\n apply (auto simp: agent_abs_def)\n done\n\nlemma clock_repMC_aec:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and x: \"x \\ ODList.toSet aec\"\n and xy: \"(x, y) \\ relations (clock_repMC (ODList.toSet cec)) a\"\n shows \"y \\ ODList.toSet aec\"\n using assms\n unfolding clock_repRels_def agent_abs_def common_abs_def\n by auto\n\nlemma clock_repMC_cec:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and x: \"x \\ ODList.toSet aec\"\n and y: \"y \\ ODList.toSet aec\"\n shows \"(x, y) \\ relations (clock_repMC (ODList.toSet cec)) a\"\n using assms\n unfolding clock_repRels_def agent_abs_def common_abs_def\n by auto\n\nlemma evalS_models:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and subj_phi: \"subjective a \\\"\n and s: \"s \\ ODList.toSet aec\"\n shows \"evalS (clock_evalProp envVal) (clock_knowledge envObs cec) (clock_commonKnowledge envObs cec) aec \\\n \\ clock_repMC (ODList.toSet cec), s \\ \\\" (is \"?lhs \\ = ?rhs \\\")\nusing subj_phi s aec cec\nproof(induct \\ rule: subjective.induct[case_names Kprop Knot Kand Kknows Kcknows])\n case (Kknows a a' \\) show ?case\n apply (clarsimp simp: toSet_eq_iff)\n apply rule\n apply clarsimp\n apply (subgoal_tac \"w' \\ ODList.toSet aec\")\n apply (drule_tac c=\"w'\" in subsetD)\n apply assumption\n apply (simp add: eval_rec_models[OF subsetI[OF aec_cec_subset[OF tC aec cec]]])\n apply (rule clock_repMC_aec[OF tC Kknows(3) Kknows(4), rotated, where x=s])\n using Kknows\n apply simp\n using Kknows\n apply simp\n\n apply clarsimp\n apply (simp add: eval_rec_models[OF subsetI[OF aec_cec_subset[OF tC aec cec]]])\n using tC Kknows\n apply (clarsimp simp: agent_abs_def)\n apply (erule (1) ballE)\n using Kknows\n apply (cut_tac x=\"tLast t'\" and y=\"tLast t'a\" in clock_repMC_cec[OF tC Kknows(3) Kknows(4)])\n unfolding clock_repRels_def\n apply auto\n done\nnext\n case (Kcknows a as \\)\n have \"?lhs (Kcknows as \\)\n = (\\y\\ODList.toSet aec.\n \\x\\(\\a\\set as. relations (clock_repMC (ODList.toSet cec)) a)\\<^sup>+ `` {y}.\n x \\ ODList.toSet (eval_rec (clock_evalProp envVal) (clock_knowledge envObs cec) (clock_commonKnowledge envObs cec)\n (big_union (clock_commonKnowledge envObs cec as) (toList aec)) \\))\"\n (* FIXME dreaming of a cong rule here. *)\n using toSet_def[symmetric]\n apply (clarsimp simp: toSet_eq_iff toSet_def[symmetric] subset_eq)\n apply (rule ball_cong[OF refl])\n apply (rule ball_cong)\n apply (subst clock_commonKnowledge_relation_image[OF aec_cec_subset[OF tC Kcknows(3) Kcknows(4)]])\n apply simp_all\n done\n also have \"... = (\\s\\ODList.toSet aec. clock_repMC (ODList.toSet cec), s \\ Kcknows as \\)\"\n apply (rule ball_cong[OF refl])\n apply simp\n apply (rule ball_cong[OF refl])\n apply (subst eval_rec_models[OF trc_aux[OF tC Kcknows(3) Kcknows(4), where as=as], symmetric])\n apply (simp add: toSet_def[symmetric])\n apply (rule_tac x=y in bexI)\n apply (subst clock_commonKnowledge_relation_image[OF aec_cec_subset[OF tC Kcknows(3) Kcknows(4)]])\n apply assumption\n apply simp\n apply (rule refl)\n done\n also have \"... = clock_repMC (ODList.toSet cec), s \\ Kknows a (Kcknows as \\)\"\n using clock_repMC_aec[OF tC Kcknows(3) Kcknows(4) Kcknows(2)]\n clock_repMC_cec[OF tC Kcknows(3) Kcknows(4) Kcknows(2)]\n by (auto cong: ball_cong)\n also have \"... = clock_repMC (ODList.toSet cec), s \\ Kcknows as \\\"\n apply (rule S5n_common_knowledge_fixed_point_simpler[symmetric])\n using Kcknows\n apply (auto intro: aec_cec_subset[OF tC Kcknows(3) Kcknows(4) Kcknows(2)])\n done\n finally show ?case .\nqed simp_all\n\n(*>*)\nlemma eval_models:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and subj_phi: \"subjective a \\\"\n and s: \"s \\ ODList.toSet aec\"\n shows \"eval envVal envObs (cec, aec) \\\n \\ clock_repMC (ODList.toSet cec), s \\ \\\"\n(*<*)\n unfolding eval_def\n using evalS_models[OF tC aec cec subj_phi s]\n apply (simp add: Let_def)\n done\n\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated actions\\\n\ntext\\\n\nFrom a common equivalence class and a subjective equivalence class for\nagent @{term \"a\"}, we can compute the actions enabled for @{term \"a\"}:\n\n\\\n\ndefinition (in -)\n clock_simAction :: \"('a, 'p, 'aAct) JKBP \\ (('s :: linorder) \\ 'p \\ bool)\n \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 'aAct list\"\nwhere\n \"clock_simAction jkbp envVal envObs \\ \\a (Y, X).\n [ action gc. gc \\ jkbp a, eval envVal envObs (Y, X) (guard gc) ]\"\n(*<*)\n\nabbreviation\n clock_simAction :: \"'a \\ 's clock_simWorldsRep \\ 'aAct list\"\nwhere\n \"clock_simAction \\ ClockView.clock_simAction jkbp envVal envObs\"\n\n(*>*)\ntext\\\n\nUsing the above result about evaluation, we can relate \\clock_simAction\\ to @{term \"jAction\"}. Firstly, \\clock_simAction\\ behaves the same as @{term \"jAction\"} using the\n@{term \"clock_repMC\"} structure:\n\n\\\n\nlemma clock_simAction_jAction:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"set (clock_simAction a (cec, aec))\n = set (jAction (clock_repMC (ODList.toSet cec)) (tLast t) a)\"\n(*<*)\n unfolding clock_simAction_def jAction_def\n apply clarsimp\n apply rule\n apply clarsimp\n apply (rule_tac x=xa in bexI)\n apply simp\n apply clarsimp\n apply (subst eval_models[OF tC aec cec, symmetric])\n using tC aec cec subj\n apply simp_all\n apply clarsimp\n apply (rule_tac x=xa in bexI)\n apply (rule refl)\n apply clarsimp\n apply (subst eval_models[OF tC aec cec])\n using tC aec cec subj\n apply simp_all\n done\n\nlemma clock_submodel_aux:\n assumes tC: \"t \\ Clock.jkbpC\"\n and s: \"s \\ worlds (clock_simMCt t)\"\n shows \"gen_model Clock.MCS s = gen_model (clock_simMCt t) s\"\nproof(rule gen_model_subset[where T=\"clock_jkbpCSt t\"])\n fix a\n let ?X = \"clock_sim ` Clock.jkbpCn (tLength t)\"\n show \"relations Clock.MCS a \\ ?X \\ ?X\n = relations (clock_simMCt t) a \\ ?X \\ ?X\"\n by (simp add: Int_ac Int_absorb1\n relation_mono[OF jkbpCSt_jkbpCS_subset jkbpCSt_jkbpCS_subset])\nnext\n let ?X = \"clock_sim ` Clock.jkbpCn (tLength t)\"\n from s show \"(\\a. relations (clock_simMCt t) a)\\<^sup>* `` {s} \\ ?X\"\n apply (clarsimp simp del: mkKripke_simps)\n apply (erule kripke_rels_trc_worlds)\n apply auto\n done\nnext\n let ?Y = \"Clock.jkbpCn (tLength t)\"\n let ?X = \"clock_sim ` ?Y\"\n from s obtain t'\n where st': \"s = clock_sim t'\"\n and t'C: \"t' \\ Clock.jkbpC\"\n and t'O: \"tLength t = tLength t'\"\n by fastforce\n { fix t''\n assume tt': \"(t', t'') \\ (\\a. relations Clock.MC a)\\<^sup>*\"\n from t'C tt' have t''C: \"t'' \\ Clock.jkbpC\"\n by - (erule kripke_rels_trc_worlds, simp_all)\n from t'O tt' have t''O: \"tLength t = tLength t''\"\n by (simp add: Clock.sync_tLength_eq_trc)\n from t''C t''O have \"t'' \\ ?Y\" by fastforce }\n hence \"(\\a. relations Clock.MC a)\\<^sup>* `` {t'} \\ ?Y\"\n by clarsimp\n hence \"clock_sim ` ((\\a. relations Clock.MC a)\\<^sup>* `` {t'}) \\ ?X\"\n by (rule image_mono)\n with st' t'C\n show \"(\\a. relations Clock.MCS a)\\<^sup>* `` {s} \\ ?X\"\n using sim_trc_commute[OF Clock.mkM_kripke clock_sim, where t=t'] by simp\nqed (insert s, auto)\n\n(*>*)\ntext\\\n\nWe can connect the agent's choice of actions on the \\clock_repMC\\ structure to those on the \\Clock.MC\\\nstructure using our earlier results about actions being preserved by\ngenerated models and simulations.\n\n\\\n\nlemma clock_simAction':\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes aec: \"ODList.toSet aec = agent_abs a t\"\n assumes cec: \"ODList.toSet cec = common_abs t\"\n shows \"set (clock_simAction a (cec, aec)) = set (jAction Clock.MC t a)\"\n(*<*) (is \"?lhs = ?rhs\")\nproof -\n from tC aec cec\n have \"?lhs = set (jAction (clock_repMC (ODList.toSet cec)) (tLast t) a)\"\n by (rule clock_simAction_jAction)\n also from tC aec cec\n have \"... = set (jAction (clock_simMCt t) (clock_sim t) a)\"\n by (simp add: simulation_jAction_eq[OF _ clock_repSim] common_abs_def)\n also from tC\n have \"... = set (jAction Clock.MCS (clock_sim t) a)\"\n using gen_model_jAction_eq[OF clock_submodel_aux[OF tC, where s=\"clock_sim t\"], where w'=\"clock_sim t\"]\n gen_model_world_refl[where w=\"clock_sim t\" and M=\"clock_simMCt t\"]\n by simp\n also from tC have \"... = set (jAction Clock.MC t a)\"\n by (simp add: simulation_jAction_eq[OF _ clock_sim])\n finally show ?thesis .\nqed\n\n(*>*)\ntext\\\n\nThe @{term \"Algorithm\"} locale requires a specialisation of this\nlemma:\n\n\\\n\nlemma clock_simAction:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"set (clock_simAction a ec) = set (jAction Clock.MC t a)\"\n(*<*)\n using assms clock_simAction'[OF tC, where cec=\"fst ec\" and aec=\"snd ec\"]\n apply (simp add: common_abs agent_abs)\n done\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated transitions\\\n\ntext\\\n\nWe need to determine the image of the set of commonly-held-possible\nstates under the transition function, and also for the agent's\nsubjective equivalence class. We do this with the \\clock_trans\\ function:\n\n\\\n\ndefinition (in -)\n clock_trans :: \"('a :: linorder) odlist \\ ('a, 'p, 'aAct) JKBP\n \\ (('s :: linorder) \\ 'eAct list)\n \\ ('eAct \\ ('a \\ 'aAct) \\ 's \\ 's)\n \\ ('s \\ 'p \\ bool) \\ ('a \\ 's \\ 'obs)\n \\ 's odlist \\ 's odlist \\ 's odlist\"\nwhere\n \"clock_trans agents jkbp envAction envTrans envVal envObs \\ \\cec X.\n ODList.fromList (concat\n [ [ envTrans eact aact s .\n eact \\ envAction s,\n aact \\ listToFuns (\\a. clock_simAction jkbp envVal envObs a\n (cec, clock_knowledge envObs cec a s))\n (toList agents) ] .\n s \\ toList X ])\"\n(*<*)\n\nabbreviation\n clock_trans :: \"'s odlist \\ 's odlist \\ 's odlist\"\nwhere\n \"clock_trans \\ ClockView.clock_trans agents jkbp envAction envTrans envVal envObs\"\n\nlemma clock_trans_aux:\n assumes t'C: \"t' \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a' t'\"\n and tC: \"t \\ Clock.jkbpCn (tLength t')\"\n and eact: \"eact \\ set (envAction (tLast t))\"\n shows \"(aact \\ set (listToFuns (\\a. clock_simAction a (fst ec, clock_knowledge envObs (fst ec) a (tLast t)))\n (toList agents)))\n \\ (\\a. aact a \\ set (jAction (Clock.MCn (tLength t')) t a))\"\n using assms\n apply -\n apply (frule Clock.jkbpCn_jkbpC_inc)\n apply (clarsimp simp: listToFuns_ext[OF agents[unfolded toSet_def]])\n apply (subst clock_simAction')\n apply (erule Clock.jkbpCn_jkbpC_inc)\n apply (subst clock_coEC_relation_image)\n apply (simp add: common_abs common_abs_def toSet_def[symmetric])\n apply (fastforce simp: common_abs agent_abs_def common_abs_def clock_repRels_def)\n apply (simp add: common_abs common_abs_def)\n apply (simp add: Clock.jkbpC_jkbpCn_jAction_eq)\n done\n\n(*>*)\ntext\\\n\nThe function @{term \"listToFuns\"} exhibits the isomorphism between @{typ\n\"('a \\ 'b list) list\"} and @{typ \"('a \\ 'b) list\"} for finite types\n@{typ \"'a\"}.\n\nWe can show that the transition function works for both the\ncommonly-held set of states and the agent subjective one. The proofs\nare straightforward.\n\n\\\n\nlemma clock_trans_common:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (clock_trans (fst ec) (fst ec))\n = { s |t' s. t' \\ s \\ Clock.jkbpC \\ tLength t' = tLength t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n show \"?lhs \\ ?rhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] common_abs_def)\n apply (rule_tac x=xa in exI)\n apply clarsimp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] common_abs_def)\n apply (drule Clock.jkbpC_tLength_inv[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nqed\n\n(*>*)\ntext\\\\\n\nlemma clock_trans_agent:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (clock_trans (fst ec) (snd ec))\n = { s |t' s. t' \\ s \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n show \"?lhs \\ ?rhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] agent_abs[OF assms] common_abs_def agent_abs_def)\n apply (rule_tac x=t' in exI)\n apply clarsimp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] agent_abs[OF assms] common_abs_def agent_abs_def)\n apply (drule Clock.jkbpC_tLength_inv[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nqed\n\n(*>*)\ntext\\\n\nNote that the clock semantics disregards paths, so we simply compute\nthe successors of the temporal slice and partition that. Similarly the\nsuccessors of the agent's subjective equivalence class tell us what\nthe set of possible observations are:\n\n\\\n\ndefinition (in -)\n clock_mkSuccs :: \"('s :: linorder \\ 'obs) \\ 'obs \\ 's odlist\n \\ 's clock_simWorldsRep\"\nwhere\n \"clock_mkSuccs envObs obs Y' \\ (Y', ODList.filter (\\s. envObs s = obs) Y')\"\n\ntext\\\n\nFinally we can define our transition function on simulated states:\n\n\\\n\ndefinition (in -)\n clock_simTrans :: \"('a :: linorder) odlist \\ ('a, 'p, 'aAct) JKBP\n \\ (('s :: linorder) \\ 'eAct list)\n \\ ('eAct \\ ('a \\ 'aAct) \\ 's \\ 's)\n \\ ('s \\ 'p \\ bool) \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 's clock_simWorldsRep list\"\nwhere\n \"clock_simTrans agents jkbp envAction envTrans envVal envObs \\ \\a (Y, X).\n let X' = clock_trans agents jkbp envAction envTrans envVal envObs Y X;\n Y' = clock_trans agents jkbp envAction envTrans envVal envObs Y Y\n in [ clock_mkSuccs (envObs a) obs Y' .\n obs \\ map (envObs a) (toList X') ]\"\n(*<*)\n\nabbreviation\n clock_simTrans :: \"'a \\ 's clock_simWorldsRep \\ 's clock_simWorldsRep list\"\nwhere\n \"clock_simTrans \\ ClockView.clock_simTrans agents jkbp envAction envTrans envVal envObs\"\n\n(*>*)\ntext\\\n\nShowing that this respects the property asked of it by the @{term\n\"Algorithm\"} locale is straightforward:\n\n\\\n\nlemma clock_simTrans:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_simAbs ` set (clock_simTrans a ec)\n = { Clock.sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n note image_cong_simp [cong del]\n show \"?lhs \\ ?rhs\"\n unfolding clock_simTrans_def clock_mkSuccs_def\n using clock_trans_common[OF tC ec] clock_trans_agent[OF tC ec]\n apply (clarsimp simp: toSet_def[symmetric] clock_simAbs_def Let_def)\n\n apply (rule_tac x=t' in exI)\n apply (rule_tac x=xa in exI)\n\n apply (clarsimp simp: clock_sim_def)\n apply safe\n\n apply clarsimp\n apply (rule_tac x=\"t'a \\ s\" in image_eqI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply safe\n apply (rule_tac x=\"t'b \\ x\" in exI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply (drule_tac t=\"t'b \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (auto simp: Let_def)[1]\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[3]\n\n apply (rule_tac x=\"tLast ta\" in exI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply safe\n apply (rule_tac x=\"taa\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"t'a \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (rule_tac x=\"t'a \\ x\" in exI)\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"ta\" in Clock.jkbpC_tLength_inv)\n apply blast\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_simTrans_def Let_def\n apply (cases ec)\n using clock_trans_common[OF tC ec] clock_trans_agent[OF tC ec]\n apply (clarsimp simp: toSet_def[symmetric] Set.image_def clock_simAbs_def\n simp del: split_paired_Ex)\n\n apply (rule_tac x=\"clock_mkSuccs (envObs a) (envObs a s) (clock_trans aa aa)\" in exI)\n apply safe\n apply auto[1]\n apply (rule_tac x=\"tLast x\" in exI)\n apply (clarsimp simp: clock_trans_common[OF tC ec] clock_mkSuccs_def)\n apply safe\n apply (clarsimp simp: clock_sim_def simp del: Clock.jkbpCn.simps)\n apply rule\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: Let_def)\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=eact in exI)\n apply (rule_tac x=aact in exI)\n apply clarsimp\n apply (clarsimp simp: Let_def Set.image_def)\n apply (drule_tac t=\"t'a \\ xa\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (rule_tac x=\"t'a \\ xa\" in exI)\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (simp only: Let_def Clock.jkbpCn.simps)\n apply clarify\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[1]\n apply (clarsimp simp: clock_trans_common[OF tC ec] clock_mkSuccs_def)\n apply (rule_tac x=\"t'a \\ sa\" in exI)\n apply (clarsimp simp: clock_sim_def Let_def)\n (* FIXME similar to above *)\n apply rule\n apply (clarsimp simp: Set.image_def)\n apply (rule_tac x=\"t'b \\ x\" in exI)\n apply (drule_tac t=\"t'b \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (auto simp: Let_def)[1]\n apply clarsimp\n apply (rule_tac x=\"ta\" in exI)\n apply auto\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)\n done\nqed\n(*>*)\n\nend (* context FiniteLinorderEnvironment *)\n\n(* **************************************** *)\n\nsubsubsection\\Maps\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-maps}\n\nAs mentioned above, the canonicity of our ordered, distinct list\nrepresentation of automaton states allows us to use them as keys in a\ndigital trie; a value of type @{typ \"('key, 'val) trie\"} maps keys of\ntype @{typ \"'key list\"} to values of type @{typ \"'val\"}.\n\nIn this specific case we track automaton transitions using a two-level\nstructure mapping sets of states to an association list mapping\nobservations to sets of states, and for actions automaton states map\ndirectly to agent actions.\n\n\\\n\ntype_synonym ('s, 'obs) clock_trans_trie\n = \"('s, ('s, ('obs, 's clock_simWorldsRep) mapping) trie) trie\"\ntype_synonym ('s, 'aAct) clock_acts_trie = \"('s, ('s, 'aAct) trie) trie\"\n(*<*)\n\ndefinition\n trans_MapOps_lookup :: \"('s :: linorder, 'obs) clock_trans_trie\n \\ 's clock_simWorldsRep \\ 'obs\n \\ 's clock_simWorldsRep\"\nwhere\n \"trans_MapOps_lookup \\ \\m k.\n Option.bind (trie_odlist_lookup m (fst (fst k))) (\\m.\n (Option.bind (trie_odlist_lookup m (snd (fst k))) (\\m.\n Mapping.lookup m (snd k))))\"\n\ndefinition\n trans_MapOps_update :: \"('s :: linorder) clock_simWorldsRep \\ 'obs \\ 's clock_simWorldsRep\n \\ ('s :: linorder, 'obs) clock_trans_trie\n \\ ('s :: linorder, 'obs) clock_trans_trie\"\nwhere\n \"trans_MapOps_update \\ \\k v m.\n trie_odlist_update_with (fst (fst k)) m empty_trie (\\m.\n trie_odlist_update_with (snd (fst k)) m Mapping.empty (\\m.\n Mapping.update (snd k) v m))\"\n\ndefinition\n trans_MapOps :: \"(('s :: linorder, 'obs) clock_trans_trie,\n 's clock_simWorldsRep \\ 'obs, 's clock_simWorldsRep) MapOps\"\nwhere\n \"trans_MapOps \\\n \\ MapOps.empty = empty_trie,\n lookup = trans_MapOps_lookup,\n update = trans_MapOps_update \\\"\n\nlemma (in FiniteLinorderEnvironment) trans_MapOps:\n \"MapOps (\\k. (clock_simAbs (fst k), snd k)) (Clock.jkbpSEC \\ UNIV) trans_MapOps\"\nproof\n fix k show \"MapOps.lookup trans_MapOps (MapOps.empty trans_MapOps) k = None\"\n unfolding trans_MapOps_def trans_MapOps_lookup_def trie_odlist_lookup_def\n by (auto split: prod.split)\nnext\n fix e k k' M\n assume k: \"(clock_simAbs (fst k), snd k) \\ Clock.jkbpSEC \\ (UNIV :: 'z set)\"\n and k': \"(clock_simAbs (fst k'), snd k') \\ Clock.jkbpSEC \\ (UNIV :: 'z set)\"\n show \"MapOps.lookup trans_MapOps (MapOps.update trans_MapOps k e M) k'\n = (if (clock_simAbs (fst k'), snd k') = (clock_simAbs (fst k), snd k)\n then Some e else MapOps.lookup trans_MapOps M k')\"\n proof(cases \"(clock_simAbs (fst k'), snd k') = (clock_simAbs (fst k), snd k)\")\n case True hence \"k = k'\"\n using inj_onD[OF clock_simAbs_inj_on] k k' by (auto iff: prod_eqI)\n thus ?thesis\n unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n by (simp add: lookup_trie_update_with lookup_update split: option.split prod.split) \n next\n case False thus ?thesis\n unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n by (cases \"fst k = fst k'\")\n (auto simp add: lookup_empty lookup_update_neq prod_eq_iff lookup_trie_update_with split: option.split prod.split)\n qed\nqed\n\n(* A map for the agent actions. *)\n\ndefinition\n acts_MapOps_lookup :: \"('s :: linorder, 'aAct) clock_acts_trie\n \\ 's clock_simWorldsRep\n \\ 'aAct\"\nwhere\n \"acts_MapOps_lookup \\ \\m k.\n Option.bind (trie_odlist_lookup m (fst k)) (\\m.\n (trie_odlist_lookup m (snd k)))\"\n\ndefinition\n acts_MapOps_update :: \"('s :: linorder) clock_simWorldsRep \\ 'aAct\n \\ ('s :: linorder, 'aAct) clock_acts_trie\n \\ ('s :: linorder, 'aAct) clock_acts_trie\"\nwhere\n \"acts_MapOps_update \\ \\k v m.\n trie_odlist_update_with (fst k) m empty_trie (\\m.\n trie_odlist_update (snd k) v m)\"\n\ndefinition\n acts_MapOps :: \"(('s :: linorder, 'aAct) clock_acts_trie, 's clock_simWorldsRep, 'aAct) MapOps\"\nwhere\n \"acts_MapOps \\\n \\ MapOps.empty = empty_trie,\n lookup = acts_MapOps_lookup,\n update = acts_MapOps_update \\\"\n\nlemma (in FiniteLinorderEnvironment) acts_MapOps:\n \"MapOps clock_simAbs Clock.jkbpSEC acts_MapOps\"\nproof\n fix k show \"MapOps.lookup acts_MapOps (MapOps.empty acts_MapOps) k = None\"\n unfolding acts_MapOps_def acts_MapOps_lookup_def trie_odlist_lookup_def\n by auto\nnext\n fix e k k' M\n assume k: \"clock_simAbs k \\ Clock.jkbpSEC\"\n and k': \"clock_simAbs k' \\ Clock.jkbpSEC\"\n show \"MapOps.lookup acts_MapOps (MapOps.update acts_MapOps k e M) k'\n = (if clock_simAbs k' = clock_simAbs k\n then Some e else MapOps.lookup acts_MapOps M k')\"\n proof(cases \"clock_simAbs k' = clock_simAbs k\")\n case True hence \"k = k'\"\n using inj_onD[OF clock_simAbs_inj_on] k k' by (auto iff: prod_eqI)\n thus ?thesis\n unfolding acts_MapOps_def acts_MapOps_lookup_def acts_MapOps_update_def\n by (auto simp: lookup_trie_update lookup_trie_update_with\n trie_odlist_update_with_def trie_odlist_update_def trie_odlist_lookup_def)\n next\n case False thus ?thesis\n unfolding acts_MapOps_def acts_MapOps_lookup_def acts_MapOps_update_def\n by (auto simp: lookup_trie_update lookup_trie_update_with\n trie_odlist_update_with_def trie_odlist_update_def trie_odlist_lookup_def\n dest: prod_eqI\n split: option.split)\n qed\nqed\n\n(*>*)\ntext\\\n\nWe define two records @{term \"acts_MapOps\"} and @{term \"trans_MapOps\"}\nsatisfying the @{term \"MapOps\"} predicate\n(\\S\\ref{sec:kbps-theory-map-ops}). Discharging the obligations in the\n@{term \"Algorithm\"} locale is routine, leaning on the work of\n\\citet{DBLP:conf/itp/LammichL10}.\n\n\\\n\nsubsubsection\\Locale instantiation\\\n\ntext\\\n\nFinally we assemble the algorithm and discharge the proof obligations.\n\n\\\n\nsublocale FiniteLinorderEnvironment\n < Clock: Algorithm\n jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n clock_sim clock_simRels clock_simVal\n clock_simAbs clock_simObs clock_simInit clock_simTrans clock_simAction\n acts_MapOps trans_MapOps\n(*<*)\n apply (unfold_locales)\n\n apply clarify\n apply (rule clock_simInit)\n apply simp\n\n apply clarify\n apply (erule (1) clock_simObs)\n\n apply clarify\n apply (erule (1) clock_simAction)\n\n apply clarify\n apply (erule (1) clock_simTrans)\n\n apply (rule acts_MapOps)\n apply (rule trans_MapOps)\n\n done\n\n(*>*)\ntext\\\n\nExplicitly, the algorithm for this case is:\n\n\\\n\ndefinition\n \"mkClockAuto \\ \\agents jkbp envInit envAction envTrans envVal envObs.\n mkAlgAuto acts_MapOps\n trans_MapOps\n (clock_simObs envObs)\n (clock_simInit envInit envObs)\n (clock_simTrans agents jkbp envAction envTrans envVal envObs)\n (clock_simAction jkbp envVal envObs)\n (\\a. map (clock_simInit envInit envObs a \\ envObs a) envInit)\"\n\nlemma (in FiniteLinorderEnvironment) mkClockAuto_implements:\n \"Clock.implements\n (mkClockAuto agents jkbp envInit envAction envTrans envVal envObs)\"\n(*<*)\n using Clock.k_mkAlgAuto_implements\n unfolding mkClockAuto_def mkAlgAuto_def Clock.k_frontier_def\n by simp\n\n(*\n\nWe actually run this unfolding of the algorithm. The lemma is keeping\nus honest.\n\n*)\n\ndefinition\n \"ClockAutoDFS \\ \\agents jkbp envInit envAction envTrans envVal envObs. \\a.\n alg_dfs acts_MapOps\n trans_MapOps\n (clock_simObs envObs a)\n (clock_simTrans agents jkbp envAction envTrans envVal envObs a)\n (clock_simAction jkbp envVal envObs a)\n (map (clock_simInit envInit envObs a \\ envObs a) envInit)\"\n\nlemma (in FiniteLinorderEnvironment)\n \"mkClockAuto agents jkbp envInit envAction envTrans envVal envObs\n = (\\a. alg_mk_auto acts_MapOps trans_MapOps (clock_simInit a) (ClockAutoDFS agents jkbp envInit envAction envTrans envVal envObs a))\"\n unfolding mkClockAuto_def ClockAutoDFS_def mkAlgAuto_def alg_mk_auto_def by (simp add: Let_def)\n\n(*>*)\ntext\\\n\nWe discuss the clock semantics further in \\S\\ref{sec:kbps-alg-clock}.\n\n\\\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/KBPs/ClockView.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2895998946708848}} {"text": "(*****************************************************************************\n * Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.4\n * for the OMG Standard.\n * http://www.brucker.ch/projects/hol-testgen/\n *\n * OCL_core.thy --- Core definitions.\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2012-2013 Université Paris-Sud, France\n * 2013 IRT SystemX, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\nheader{* Formalization I: Core Definitions *}\n\ntheory\n OCL_core\nimports\n Main\nbegin\n\nsection{* Preliminaries *}\nsubsection{* Notations for the Option Type *}\n\ntext{*\n First of all, we will use a more compact notation for the library\n option type which occur all over in our definitions and which will make\n the presentation more like a textbook:\n*}\nnotation Some (\"\\(_)\\\")\nnotation None (\"\\\")\n\ntext{*\n The following function (corresponding to @{term the} in the Isabelle/HOL library)\n is defined as the inverse of the injection @{term Some}.\n*}\nfun drop :: \"'\\ option \\ '\\\" (\"\\(_)\\\")\nwhere drop_lift[simp]: \"\\\\v\\\\ = v\"\n\n\nsubsection{* Minimal Notions of State and State Transitions *}\ntext{* Next we will introduce the foundational concept of an object id (oid),\nwhich is just some infinite set. *}\n\ntext{* In order to assure executability of as much as possible formulas, we fixed the\ntype of object id's to just natural numbers.*}\ntype_synonym oid = nat\n\ntext{* We refrained from the alternative:\n\\begin{isar}[mathescape]\n$\\text{\\textbf{type-synonym}}$ $\\mathit{oid = ind}$\n\\end{isar}\nwhich is slightly more abstract but non-executable.\n*}\n\ntext{*\n States are just a partial map from oid's to elements of an object\n universe @{text \"'\\\"}, and state transitions pairs of states\n \\ldots\n*}\nrecord ('\\)state =\n heap :: \"oid \\ '\\ \"\n assocs\\<^sub>2 :: \"oid \\ (oid \\ oid) list\" (* binary associations *)\n assocs\\<^sub>3 :: \"oid \\ (oid \\ oid \\ oid) list\" (* ternary associations *)\n\n\ntype_synonym ('\\)st = \"'\\ state \\ '\\ state\"\n\nsubsection{* Prerequisite: An Abstract Interface for OCL Types *}\n\ntext {*\n To have the possibility to nest collection types,\n such that we can give semantics to expressions like @{text \"Set{Set{\\},null}\"},\n it is necessary to introduce a uniform interface for types having\n the @{text \"invalid\"} (= bottom) element. The reason is that we impose\n a data-invariant on raw-collection \\inlineisar|types_code| which assures\n that the @{text \"invalid\"} element is not allowed inside the collection;\n all raw-collections of this form were identified with the @{text \"invalid\"} element\n itself. The construction requires that the new collection type is\n not comparable with the raw-types (consisting of nested option type constructions),\n such that the data-invariant must be expressed in terms of the interface.\n In a second step, our base-types will be shown to be instances of this interface.\n *}\n\ntext{*\n This uniform interface consists in a type class requiring the existence\n of a bot and a null element. The construction proceeds by\n abstracting the null (defined by @{text \"\\ \\ \\\"} on\n @{text \"'a option option\"}) to a @{text null} element, which may\n have an arbitrary semantic structure, and an undefinedness element @{text \"\\ \"}\n to an abstract undefinedness element @{text \"bot\"} (also written\n @{text \"\\ \"} whenever no confusion arises). As a consequence, it is necessary\n to redefine the notions of invalid, defined, valuation etc.\n on top of this interface. *}\n\ntext{*\n This interface consists in two abstract type classes @{text bot}\n and @{text null} for the class of all types comprising a bot and a\n distinct null element. *}\n\nclass bot =\n fixes bot :: \"'a\"\n assumes nonEmpty : \"\\ x. x \\ bot\"\n \n\nclass null = bot +\n fixes null :: \"'a\"\n assumes null_is_valid : \"null \\ bot\"\n\n\nsubsection{* Accommodation of Basic Types to the Abstract Interface *}\n\ntext{*\n In the following it is shown that the ``option-option'' type is\n in fact in the @{text null} class and that function spaces over these\n classes again ``live'' in these classes. This motivates the default construction\n of the semantic domain for the basic types (\\inlineocl{Boolean},\n \\inlineocl{Integer}, \\inlineocl{Real}, \\ldots).\n*}\n\ninstantiation option :: (type)bot\nbegin\n definition bot_option_def: \"(bot::'a option) \\ (None::'a option)\"\n instance proof show \"\\x\\'a option. x \\ bot\"\n by(rule_tac x=\"Some x\" in exI, simp add:bot_option_def)\n qed\nend \n\n\ninstantiation option :: (bot)null\nbegin\n definition null_option_def: \"(null::'a\\bot option) \\ \\ bot \\\"\n instance proof show \"(null::'a\\bot option) \\ bot\"\n by( simp add:null_option_def bot_option_def)\n qed\nend\n\n\ninstantiation \"fun\" :: (type,bot) bot\nbegin\n definition bot_fun_def: \"bot \\ (\\ x. bot)\"\n\n instance proof show \"\\(x::'a \\ 'b). x \\ bot\"\n apply(rule_tac x=\"\\ _. (SOME y. y \\ bot)\" in exI, auto)\n apply(drule_tac x=x in fun_cong,auto simp:bot_fun_def)\n apply(erule contrapos_pp, simp)\n apply(rule some_eq_ex[THEN iffD2])\n apply(simp add: nonEmpty)\n done\n qed\nend\n\n\ninstantiation \"fun\" :: (type,null) null\nbegin\n definition null_fun_def: \"(null::'a \\ 'b::null) \\ (\\ x. null)\"\n\n instance proof\n show \"(null::'a \\ 'b::null) \\ bot\"\n apply(auto simp: null_fun_def bot_fun_def)\n apply(drule_tac x=x in fun_cong)\n apply(erule contrapos_pp, simp add: null_is_valid)\n done\n qed\nend\n\ntext{* A trivial consequence of this adaption of the interface is that\nabstract and concrete versions of null are the same on base types\n(as could be expected). *}\n\nsubsection{* The Semantic Space of OCL Types: Valuations *}\n\ntext{* Valuations are now functions from a state pair (built upon\ndata universe @{typ \"'\\\"}) to an arbitrary null-type (\\ie, containing\nat least a destinguished @{text \"null\"} and @{text \"invalid\"} element). *}\n\ntype_synonym ('\\,'\\) val = \"'\\ st \\ '\\::null\"\n\ntext{* The definitions for the constants and operations based on valuations\nwill be geared towards a format that Isabelle can check to be a ``conservative''\n(\\ie, logically safe) axiomatic definition. By introducing an explicit\ninterpretation function (which happens to be defined just as the identity\nsince we are using a shallow embedding of OCL into HOL), all these definitions\ncan be rewritten into the conventional semantic textbook format as follows: *}\n\ndefinition Sem :: \"'a \\ 'a\" (\"I\\_\\\")\nwhere \"I\\x\\ \\ x\"\n\ntext{* As a consequence of semantic domain definition, any OCL type will\nhave the two semantic constants @{text \"invalid\"} (for exceptional, aborted\ncomputation) and @{text \"null\"}:\n *}\n\ndefinition invalid :: \"('\\,'\\::bot) val\"\nwhere \"invalid \\ \\ \\. bot\"\n\ntext{* This conservative Isabelle definition of the polymorphic constant\n@{const invalid} is equivalent with the textbook definition: *}\n\nlemma textbook_invalid: \"I\\invalid\\\\ = bot\"\nby(simp add: invalid_def Sem_def)\n\n\ntext {* Note that the definition :\n{\\small\n\\begin{isar}[mathescape]\ndefinition null :: \"('$\\mathfrak{A}$,'\\::null) val\"\nwhere \"null \\ \\ \\. null\"\n\\end{isar}\n} is not necessary since we defined the entire function space over null types\nagain as null-types; the crucial definition is @{thm \"null_fun_def\"}.\nThus, the polymorphic constant @{const null} is simply the result of\na general type class construction. Nevertheless, we can derive the\nsemantic textbook definition for the OCL null constant based on the\nabstract null:\n*}\n\nlemma textbook_null_fun: \"I\\null::('\\,'\\::null) val\\ \\ = (null::'\\::null)\"\nby(simp add: null_fun_def Sem_def)\n\n\nsection{* Definition of the Boolean Type *}\n\ntext{* The semantic domain of the (basic) boolean type is now defined as the Standard:\nthe space of valuation to @{typ \"bool option option\"}:*}\n\ntype_synonym ('\\)Boolean = \"('\\,bool option option) val\"\n\nsubsection{* Basic Constants *}\n\nlemma bot_Boolean_def : \"(bot::('\\)Boolean) = (\\ \\. \\)\"\nby(simp add: bot_fun_def bot_option_def)\n\nlemma null_Boolean_def : \"(null::('\\)Boolean) = (\\ \\. \\\\\\)\"\nby(simp add: null_fun_def null_option_def bot_option_def)\n\ndefinition true :: \"('\\)Boolean\"\nwhere \"true \\ \\ \\. \\\\True\\\\\"\n\n\ndefinition false :: \"('\\)Boolean\"\nwhere \"false \\ \\ \\. \\\\False\\\\\"\n\nlemma bool_split: \"X \\ = invalid \\ \\ X \\ = null \\ \\\n X \\ = true \\ \\ X \\ = false \\\"\napply(simp add: invalid_def null_def true_def false_def)\napply(case_tac \"X \\\",simp_all add: null_fun_def null_option_def bot_option_def)\napply(case_tac \"a\",simp)\napply(case_tac \"aa\",simp)\napply auto\ndone\n\n\n\n\n\nlemma [simp]: \"true (a, b) = \\\\True\\\\\"\nby(simp add:true_def)\n\nlemma textbook_true: \"I\\true\\ \\ = \\\\True\\\\\"\nby(simp add: Sem_def true_def)\n\nlemma textbook_false: \"I\\false\\ \\ = \\\\False\\\\\"\nby(simp add: Sem_def false_def)\n\ntext {*\n\\begin{table}[htbp]\n \\centering\n \\begin{tabu}{lX[,c,]}\n \\toprule\n Name & Theorem \\\\\n \\midrule\n @{thm [source] textbook_invalid} & @{thm [display=false] textbook_invalid} \\\\\n @{thm [source] textbook_null_fun} & @{thm [display=false] textbook_null_fun} \\\\\n @{thm [source] textbook_true} & @{thm [display=false] textbook_true} \\\\\n @{thm [source] textbook_false} & @{thm [display=false] textbook_false} \\\\\n \\bottomrule\n \\end{tabu}\n \\caption{Basic semantic constant definitions of the logic (except @{term null})}\n \\label{tab:sem_basic_constants}\n\\end{table}\n*}\n\nsubsection{* Validity and Definedness *}\n\ntext{* However, this has also the consequence that core concepts like definedness,\nvalidness and even cp have to be redefined on this type class:*}\n\ndefinition valid :: \"('\\,'a::null)val \\ ('\\)Boolean\" (\"\\ _\" [100]100)\nwhere \"\\ X \\ \\ \\ . if X \\ = bot \\ then false \\ else true \\\"\n\nlemma valid1[simp]: \"\\ invalid = false\"\n by(rule ext,simp add: valid_def bot_fun_def bot_option_def\n invalid_def true_def false_def)\n\nlemma valid2[simp]: \"\\ null = true\"\n by(rule ext,simp add: valid_def bot_fun_def bot_option_def null_is_valid\n null_fun_def invalid_def true_def false_def)\n\nlemma valid3[simp]: \"\\ true = true\"\n by(rule ext,simp add: valid_def bot_fun_def bot_option_def null_is_valid\n null_fun_def invalid_def true_def false_def)\n\nlemma valid4[simp]: \"\\ false = true\"\n by(rule ext,simp add: valid_def bot_fun_def bot_option_def null_is_valid\n null_fun_def invalid_def true_def false_def)\n\n\nlemma cp_valid: \"(\\ X) \\ = (\\ (\\ _. X \\)) \\\"\nby(simp add: valid_def)\n\n\n\ndefinition defined :: \"('\\,'a::null)val \\ ('\\)Boolean\" (\"\\ _\" [100]100)\nwhere \"\\ X \\ \\ \\ . if X \\ = bot \\ \\ X \\ = null \\ then false \\ else true \\\"\n\ntext{* The generalized definitions of invalid and definedness have the same\nproperties as the old ones : *}\nlemma defined1[simp]: \"\\ invalid = false\"\n by(rule ext,simp add: defined_def bot_fun_def bot_option_def\n null_def invalid_def true_def false_def)\n\nlemma defined2[simp]: \"\\ null = false\"\n by(rule ext,simp add: defined_def bot_fun_def bot_option_def\n null_def null_option_def null_fun_def invalid_def true_def false_def)\n\n\nlemma defined3[simp]: \"\\ true = true\"\n by(rule ext,simp add: defined_def bot_fun_def bot_option_def null_is_valid null_option_def\n null_fun_def invalid_def true_def false_def)\n\nlemma defined4[simp]: \"\\ false = true\"\n by(rule ext,simp add: defined_def bot_fun_def bot_option_def null_is_valid null_option_def\n null_fun_def invalid_def true_def false_def)\n\n\nlemma defined5[simp]: \"\\ \\ X = true\"\n by(rule ext,\n auto simp: defined_def true_def false_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\nlemma defined6[simp]: \"\\ \\ X = true\"\n by(rule ext,\n auto simp: valid_def defined_def true_def false_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\nlemma valid5[simp]: \"\\ \\ X = true\"\n by(rule ext,\n auto simp: valid_def true_def false_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\nlemma valid6[simp]: \"\\ \\ X = true\"\n by(rule ext,\n auto simp: valid_def defined_def true_def false_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\n\nlemma cp_defined:\"(\\ X)\\ = (\\ (\\ _. X \\)) \\\"\nby(simp add: defined_def)\n\ntext{* The definitions above for the constants @{const defined} and @{const valid}\ncan be rewritten into the conventional semantic \"textbook\" format as follows: *}\n\nlemma textbook_defined: \"I\\\\(X)\\ \\ = (if I\\X\\ \\ = I\\bot\\ \\ \\ I\\X\\ \\ = I\\null\\ \\\n then I\\false\\ \\\n else I\\true\\ \\)\"\nby(simp add: Sem_def defined_def)\n\nlemma textbook_valid: \"I\\\\(X)\\ \\ = (if I\\X\\ \\ = I\\bot\\ \\\n then I\\false\\ \\\n else I\\true\\ \\)\"\nby(simp add: Sem_def valid_def)\n\n\ntext {* \n\\autoref{tab:sem_definedness} and \\autoref{tab:alglaws_definedness}\nsummarize the results of this section. \n\\begin{table}[htbp]\n \\centering\n \\begin{tabu}{lX[,c,]}\n \\toprule\n Name & Theorem \\\\\n \\midrule\n @{thm [source] textbook_defined} & @{thm [show_question_marks=false,display=false,margin=45] textbook_defined} \\\\\n @{thm [source] textbook_valid} & @{thm [show_question_marks=false,display=false,margin=45] textbook_valid} \\\\\n \\bottomrule\n \\end{tabu}\n \\caption{Basic predicate definitions of the logic.}\n \\label{tab:sem_definedness}\n\\end{table}\n\\begin{table}[htbp]\n \\centering\n \\begin{tabu}{lX[,c,]}\n \\toprule\n Name & Theorem \\\\\n \\midrule\n @{thm [source] defined1} & @{thm defined1} \\\\\n @{thm [source] defined2} & @{thm [display=false,margin=35] defined2} \\\\\n @{thm [source] defined3} & @{thm [display=false,margin=35] defined3} \\\\\n @{thm [source] defined4} & @{thm [display=false,margin=35] defined4} \\\\\n @{thm [source] defined5} & @{thm [display=false,margin=35] defined5} \\\\\n @{thm [source] defined6} & @{thm [display=false,margin=35] defined6} \\\\\n \\bottomrule\n \\end{tabu}\n \\caption{Laws of the basic predicates of the logic.}\n \\label{tab:alglaws_definedness}\n\\end{table}\n*}\n\nsection{* The Equalities of OCL *}\ntext{*\n The OCL contains a particular version of equality, written in\n Standard documents \\inlineocl+_ = _+ and \\inlineocl+_ <> _+ for its\n negation, which is referred as \\emph{weak referential equality}\n hereafter and for which we use the symbol \\inlineisar+_ \\ _+\n throughout the formal part of this document. Its semantics is\n motivated by the desire of fast execution, and similarity to\n languages like Java and C, but does not satisfy the needs of logical\n reasoning over OCL expressions and specifications. We therefore\n introduce a second equality, referred as \\emph{strong equality} or\n \\emph{logical equality} and written \\inlineisar+_ \\ _+\n which is not present in the current standard but was discussed in\n prior texts on OCL like the Amsterdam\n Manifesto~\\cite{cook.ea::amsterdam:2002} and was identified as\n desirable extension of OCL in the Aachen\n Meeting~\\cite{brucker.ea:summary-aachen:2013} in the future 2.5 OCL\n Standard. The purpose of strong equality is to define and reason\n over OCL. It is therefore a natural task in Featherweight OCL to\n formally investigate the somewhat quite complex relationship between\n these two. *} text{* Strong equality has two motivations: a\n pragmatic one and a fundamental one.\n \\begin{enumerate}\n \\item The pragmatic reason is fairly simple: users of object-oriented languages want \n something like a ``shallow object value equality''.\n You will want to say\n \\inlineisar+ a.boss \\ b.boss@pre +\n instead of\n\\begin{isar}\n a.boss \\ b.boss@pre and (* just the pointers are equal! *)\n a.boss.name \\ b.boss@pre.name@pre and\n a.boss.age \\ b.boss@pre.age@pre\n\\end{isar}\n Breaking a shallow-object equality down to referential equality\n of attributes is cumbersome, error-prone, and makes\n specifications difficult to extend (add for example an attribute\n sex to your class, and check in your OCL specification\n everywhere that you did it right with your simulation of strong\n equality). Therefore, languages like Java offer facilities\n to handle two different equalities, and it is problematic even\n in an execution oriented specification language to ignore\n shallow object equality because it is so common in the code.\n \\item The fundamental reason goes as follows: whatever you do to\n reason consistently over a language, you need the concept of\n equality: you need to know what expressions can be replaced by\n others because they \\emph{mean the same thing.} People call\n this also ``Leibniz Equality'' because this philosopher brought\n this principle first explicitly to paper and shed some light\n over it. It is the theoretic foundation of what you do in an\n optimizing compiler: you replace expressions by \\emph{equal}\n ones, which you hope are easier to evaluate. In a typed\n language, strong equality exists uniformly over all types, it is\n ``polymorphic'' $\\_ = \\_ :: \\alpha * \\alpha \\rightarrow\n bool$---this is the way that equality is defined in HOL itself.\n We can express Leibniz principle as one logical rule of\n surprising simplicity and beauty:\n \\begin{gather}\n s = t \\Longrightarrow P(s) = P(t)\n \\end{gather}\n ``Whenever we know, that $s$ is equal to $t$, we can replace the\n sub-expression $s$ in a term $P$ by $t$ and we have that the\n replacement is equal to the original.''\n\\end{enumerate}\n*}\ntext{*\n While weak referential equality is defined to be strict in the OCL\n standard, we will define strong equality as non-strict. It is quite\n nasty (but not impossible) to define the logical equality in a\n strict way (the substitutivity rule above would look more complex),\n however, whenever references were used, strong equality is needed\n since references refer to particular states (pre or post), and that\n they mean the same thing can therefore not be taken for granted.\n*}\n\nsubsection{* Definition *}\ntext{*\n The strict equality on basic types (actually on all types) must be\n exceptionally defined on @{term \"null\"}---otherwise the entire\n concept of null in the language does not make much sense. This is an\n important exception from the general rule that null\n arguments---especially if passed as ``self''-argument---lead to\n invalid results.\n*}\n\n\ntext{*\n We define strong equality extremely generic, even for types that\n contain a @{text \"null\"} or @{text \"\\\"} element. Strong\n equality is simply polymorphic in Featherweight OCL, \\ie, is\n defined identical for all types in OCL and HOL.\n*}\ndefinition StrongEq::\"['\\ st \\ '\\,'\\ st \\ '\\] \\ ('\\)Boolean\" (infixl \"\\\" 30)\nwhere \"X \\ Y \\ \\ \\. \\\\X \\ = Y \\ \\\\\"\n\ntext{*\n From this follow already elementary properties like:\n*}\n\n\nlemma [simp,code_unfold]: \"(false \\ true) = false\"\nby(rule ext, auto simp: StrongEq_def)\n\n\ntext{*\n In contrast, referential equality behaves differently for all\n types---on value types, it is basically strong equality for defined\n values, but on object types it will compare references---we\n introduce it as an \\emph{overloaded} concept and will handle it for\n each type instance individually.\n*}\nconsts StrictRefEq :: \"[('\\,'a)val,('\\,'a)val] \\ ('\\)Boolean\" (infixl \"\\\" 30)\n\n\ntext{*\n Here is a first instance of a definition of weak equality---for\n the special case of the type @{typ \"('\\)Boolean\"}, it is just\n the strict extension of the logical\n equality:\n*}\ndefs (overloaded) StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n[code_unfold] :\n \"(x::('\\)Boolean) \\ y \\ \\ \\. if (\\ x) \\ = true \\ \\ (\\ y) \\ = true \\\n then (x \\ y)\\\n else invalid \\\"\n\ntext{* which implies elementary properties like: *} \nlemma [simp,code_unfold] : \"(true \\ false) = false\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n)\nlemma [simp,code_unfold] : \"(false \\ true) = false\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n)\n\nlemma [simp,code_unfold] : \"(invalid \\ false) = invalid\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n false_def true_def)\nlemma [simp,code_unfold] : \"(invalid \\ true) = invalid\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n false_def true_def)\n\nlemma [simp,code_unfold] : \"(false \\ invalid) = invalid\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n false_def true_def)\nlemma [simp,code_unfold] : \"(true \\ invalid) = invalid\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n false_def true_def)\n\nlemma [simp,code_unfold] : \"((invalid::('\\)Boolean) \\ invalid) = invalid\"\nby(simp add:StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n false_def true_def)\ntext{* Thus, the weak equality is \\emph{not} reflexive. *}\n\nlemma null_non_false [simp,code_unfold]:\"(null \\ false) = false\"\n apply(rule ext, simp add: StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n StrongEq_def false_def)\nby (metis OCL_core.drop.simps cp_valid false_def is_none_code(2) is_none_def valid4\n bot_option_def null_fun_def null_option_def)\n\nlemma null_non_true [simp,code_unfold]:\"(null \\ true) = false\"\n apply(rule ext, simp add: StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n StrongEq_def false_def)\nby(simp add: true_def bot_option_def null_fun_def null_option_def)\n\nlemma false_non_null [simp,code_unfold]:\"(false \\ null) = false\"\n apply(rule ext, simp add: StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n StrongEq_def false_def)\nby (metis OCL_core.drop.simps cp_valid false_def is_none_code(2) is_none_def valid4\n bot_option_def null_fun_def null_option_def )\n\nlemma true_non_null [simp,code_unfold]:\"(true \\ null) = false\"\n apply(rule ext, simp add: StrictRefEq\\<^sub>B\\<^sub>o\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>a\\<^sub>n StrongEq_def false_def)\nby(simp add: true_def bot_option_def null_fun_def null_option_def)\n\nsubsection{* Fundamental Predicates on Strong Equality *}\n\ntext{* Equality reasoning in OCL is not humpty dumpty. While strong equality\nis clearly an equivalence: *}\nlemma StrongEq_refl [simp]: \"(X \\ X) = true\"\nby(rule ext, simp add: null_def invalid_def true_def false_def StrongEq_def)\n\nlemma StrongEq_sym: \"(X \\ Y) = (Y \\ X)\"\nby(rule ext, simp add: eq_sym_conv invalid_def true_def false_def StrongEq_def)\n\nlemma StrongEq_trans_strong [simp]:\n assumes A: \"(X \\ Y) = true\"\n and B: \"(Y \\ Z) = true\"\n shows \"(X \\ Z) = true\"\n apply(insert A B) apply(rule ext)\n apply(simp add: null_def invalid_def true_def false_def StrongEq_def)\n apply(drule_tac x=x in fun_cong)+\n by auto\n\ntext{*\n it is only in a limited sense a congruence, at least from the\n point of view of this semantic theory. The point is that it is\n only a congruence on OCL expressions, not arbitrary HOL\n expressions (with which we can mix Featherweight OCL expressions). A\n semantic---not syntactic---characterization of OCL expressions is\n that they are \\emph{context-passing} or \\emph{context-invariant},\n \\ie, the context of an entire OCL expression, \\ie the pre and\n post state it referes to, is passed constantly and unmodified to\n the sub-expressions, \\ie, all sub-expressions inside an OCL\n expression refer to the same context. Expressed formally, this\n boils down to:\n*}\nlemma StrongEq_subst :\n assumes cp: \"\\X. P(X)\\ = P(\\ _. X \\)\\\"\n and eq: \"(X \\ Y)\\ = true \\\"\n shows \"(P X \\ P Y)\\ = true \\\"\n apply(insert cp eq)\n apply(simp add: null_def invalid_def true_def false_def StrongEq_def)\n apply(subst cp[of X])\n apply(subst cp[of Y])\n by simp\n\nlemma defined7[simp]: \"\\ (X \\ Y) = true\"\n by(rule ext,\n auto simp: defined_def true_def false_def StrongEq_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\nlemma valid7[simp]: \"\\ (X \\ Y) = true\"\n by(rule ext,\n auto simp: valid_def true_def false_def StrongEq_def\n bot_fun_def bot_option_def null_option_def null_fun_def)\n\nlemma cp_StrongEq: \"(X \\ Y) \\ = ((\\ _. X \\) \\ (\\ _. Y \\)) \\\"\nby(simp add: StrongEq_def)\n\nsection{* Logical Connectives and their Universal Properties *}\ntext{*\n It is a design goal to give OCL a semantics that is as closely as\n possible to a ``logical system'' in a known sense; a specification\n logic where the logical connectives can not be understood other that\n having the truth-table aside when reading fails its purpose in our\n view.\n\n Practically, this means that we want to give a definition to the\n core operations to be as close as possible to the lattice laws; this\n makes also powerful symbolic normalization of OCL specifications\n possible as a pre-requisite for automated theorem provers. For\n example, it is still possible to compute without any definedness\n and validity reasoning the DNF of an OCL specification; be it for\n test-case generations or for a smooth transition to a two-valued\n representation of the specification amenable to fast standard\n SMT-solvers, for example.\n\n Thus, our representation of the OCL is merely a 4-valued\n Kleene-Logics with @{term \"invalid\"} as least, @{term \"null\"} as\n middle and @{term \"true\"} resp. @{term \"false\"} as unrelated\n top-elements.\n*}\n\n\ndefinition OclNot :: \"('\\)Boolean \\ ('\\)Boolean\" (\"not\")\nwhere \"not X \\ \\ \\ . case X \\ of\n \\ \\ \\\n | \\ \\ \\ \\ \\ \\ \\\n | \\\\ x \\\\ \\ \\\\ \\ x \\\\\"\n\ntext{* with {term \"not\"} we can express the notation:*}\n \nsyntax\n \"notequal\" :: \"('\\)Boolean \\ ('\\)Boolean \\ ('\\)Boolean\" (infix \"<>\" 40)\ntranslations\n \"a <> b\" == \"CONST OclNot( a \\ b)\"\n\n\n \nlemma cp_OclNot: \"(not X)\\ = (not (\\ _. X \\)) \\\"\nby(simp add: OclNot_def)\n\nlemma OclNot1[simp]: \"not invalid = invalid\"\n by(rule ext,simp add: OclNot_def null_def invalid_def true_def false_def bot_option_def)\n\nlemma OclNot2[simp]: \"not null = null\"\n by(rule ext,simp add: OclNot_def null_def invalid_def true_def false_def\n bot_option_def null_fun_def null_option_def )\n\nlemma OclNot3[simp]: \"not true = false\"\n by(rule ext,simp add: OclNot_def null_def invalid_def true_def false_def)\n\nlemma OclNot4[simp]: \"not false = true\"\n by(rule ext,simp add: OclNot_def null_def invalid_def true_def false_def)\n\n\nlemma OclNot_not[simp]: \"not (not X) = X\"\n apply(rule ext,simp add: OclNot_def null_def invalid_def true_def false_def)\n apply(case_tac \"X x\", simp_all)\n apply(case_tac \"a\", simp_all)\n done\n\nlemma OclNot_inject: \"\\ x y. not x = not y \\ x = y\"\n by(subst OclNot_not[THEN sym], simp)\n\ndefinition OclAnd :: \"[('\\)Boolean, ('\\)Boolean] \\ ('\\)Boolean\" (infixl \"and\" 30)\nwhere \"X and Y \\ (\\ \\ . case X \\ of\n \\\\False\\\\ \\ \\\\False\\\\\n | \\ \\ (case Y \\ of\n \\\\False\\\\ \\ \\\\False\\\\\n | _ \\ \\)\n | \\\\\\ \\ (case Y \\ of\n \\\\False\\\\ \\ \\\\False\\\\\n | \\ \\ \\\n | _ \\ \\\\\\)\n | \\\\True\\\\ \\ Y \\)\"\n\n\ntext{*\n Note that @{term \"not\"} is \\emph{not} defined as a strict function;\n proximity to lattice laws implies that we \\emph{need} a definition\n of @{term \"not\"} that satisfies @{text \"not(not(x))=x\"}.\n*}\n\ntext{*\n In textbook notation, the logical core constructs @{const\n \"OclNot\"} and @{const \"OclAnd\"} were represented as follows:\n*}\nlemma textbook_OclNot:\n \"I\\not(X)\\ \\ = (case I\\X\\ \\ of \\ \\ \\\n | \\ \\ \\ \\ \\ \\ \\\n | \\\\ x \\\\ \\ \\\\ \\ x \\\\)\"\nby(simp add: Sem_def OclNot_def)\n\nlemma textbook_OclAnd:\n \"I\\X and Y\\ \\ = (case I\\X\\ \\ of\n \\ \\ (case I\\Y\\ \\ of\n \\ \\ \\\n | \\\\\\ \\ \\\n | \\\\True\\\\ \\ \\\n | \\\\False\\\\ \\ \\\\False\\\\)\n | \\ \\ \\ \\ (case I\\Y\\ \\ of\n \\ \\ \\\n | \\\\\\ \\ \\\\\\\n | \\\\True\\\\ \\ \\\\\\\n | \\\\False\\\\ \\ \\\\False\\\\)\n | \\\\True\\\\ \\ (case I\\Y\\ \\ of\n \\ \\ \\\n | \\\\\\ \\ \\\\\\\n | \\\\y\\\\ \\ \\\\y\\\\)\n | \\\\False\\\\ \\ \\\\ False \\\\)\"\nby(simp add: OclAnd_def Sem_def split: option.split bool.split)\n\ndefinition OclOr :: \"[('\\)Boolean, ('\\)Boolean] \\ ('\\)Boolean\" (infixl \"or\" 25)\nwhere \"X or Y \\ not(not X and not Y)\"\n\ndefinition OclImplies :: \"[('\\)Boolean, ('\\)Boolean] \\ ('\\)Boolean\" (infixl \"implies\" 25)\nwhere \"X implies Y \\ not X or Y\"\n\nlemma cp_OclAnd:\"(X and Y) \\ = ((\\ _. X \\) and (\\ _. Y \\)) \\\"\nby(simp add: OclAnd_def)\n\nlemma cp_OclOr:\"((X::('\\)Boolean) or Y) \\ = ((\\ _. X \\) or (\\ _. Y \\)) \\\"\napply(simp add: OclOr_def)\napply(subst cp_OclNot[of \"not (\\_. X \\) and not (\\_. Y \\)\"])\napply(subst cp_OclAnd[of \"not (\\_. X \\)\" \"not (\\_. Y \\)\"])\nby(simp add: cp_OclNot[symmetric] cp_OclAnd[symmetric] )\n\n\nlemma cp_OclImplies:\"(X implies Y) \\ = ((\\ _. X \\) implies (\\ _. Y \\)) \\\"\napply(simp add: OclImplies_def)\napply(subst cp_OclOr[of \"not (\\_. X \\)\" \"(\\_. Y \\)\"])\nby(simp add: cp_OclNot[symmetric] cp_OclOr[symmetric] )\n\nlemma OclAnd1[simp]: \"(invalid and true) = invalid\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def)\nlemma OclAnd2[simp]: \"(invalid and false) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def)\nlemma OclAnd3[simp]: \"(invalid and null) = invalid\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\nlemma OclAnd4[simp]: \"(invalid and invalid) = invalid\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def)\n\nlemma OclAnd5[simp]: \"(null and true) = null\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\nlemma OclAnd6[simp]: \"(null and false) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\nlemma OclAnd7[simp]: \"(null and null) = null\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\nlemma OclAnd8[simp]: \"(null and invalid) = invalid\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\n\nlemma OclAnd9[simp]: \"(false and true) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\nlemma OclAnd10[simp]: \"(false and false) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\nlemma OclAnd11[simp]: \"(false and null) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\nlemma OclAnd12[simp]: \"(false and invalid) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\n\nlemma OclAnd13[simp]: \"(true and true) = true\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\nlemma OclAnd14[simp]: \"(true and false) = false\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\nlemma OclAnd15[simp]: \"(true and null) = null\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\nlemma OclAnd16[simp]: \"(true and invalid) = invalid\"\n by(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def bot_option_def\n null_fun_def null_option_def)\n\nlemma OclAnd_idem[simp]: \"(X and X) = X\"\n apply(rule ext,simp add: OclAnd_def null_def invalid_def true_def false_def)\n apply(case_tac \"X x\", simp_all)\n apply(case_tac \"a\", simp_all)\n apply(case_tac \"aa\", simp_all)\n done\n\nlemma OclAnd_commute: \"(X and Y) = (Y and X)\"\n by(rule ext,auto simp:true_def false_def OclAnd_def invalid_def\n split: option.split option.split_asm\n bool.split bool.split_asm)\n\n\nlemma OclAnd_false1[simp]: \"(false and X) = false\"\n apply(rule ext, simp add: OclAnd_def)\n apply(auto simp:true_def false_def invalid_def\n split: option.split option.split_asm)\n done\n\nlemma OclAnd_false2[simp]: \"(X and false) = false\"\n by(simp add: OclAnd_commute)\n\n\nlemma OclAnd_true1[simp]: \"(true and X) = X\"\n apply(rule ext, simp add: OclAnd_def)\n apply(auto simp:true_def false_def invalid_def\n split: option.split option.split_asm)\n done\n\nlemma OclAnd_true2[simp]: \"(X and true) = X\"\n by(simp add: OclAnd_commute)\n\nlemma OclAnd_bot1[simp]: \"\\\\. X \\ \\ false \\ \\ (bot and X) \\ = bot \\\"\n apply(simp add: OclAnd_def)\n apply(auto simp:true_def false_def bot_fun_def bot_option_def\n split: option.split option.split_asm)\ndone\n\nlemma OclAnd_bot2[simp]: \"\\\\. X \\ \\ false \\ \\ (X and bot) \\ = bot \\\"\n by(simp add: OclAnd_commute)\n\nlemma OclAnd_null1[simp]: \"\\\\. X \\ \\ false \\ \\ X \\ \\ bot \\ \\ (null and X) \\ = null \\\"\n apply(simp add: OclAnd_def)\n apply(auto simp:true_def false_def bot_fun_def bot_option_def null_fun_def null_option_def\n split: option.split option.split_asm)\ndone\n\n\n\nlemma OclAnd_assoc: \"(X and (Y and Z)) = (X and Y and Z)\"\n apply(rule ext, simp add: OclAnd_def)\n apply(auto simp:true_def false_def null_def invalid_def\n split: option.split option.split_asm\n bool.split bool.split_asm)\ndone\n\n\nlemma OclOr1[simp]: \"(invalid or true) = true\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def)\nlemma OclOr2[simp]: \"(invalid or false) = invalid\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def)\nlemma OclOr3[simp]: \"(invalid or null) = invalid\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def null_fun_def null_option_def)\nlemma OclOr4[simp]: \"(invalid or invalid) = invalid\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def)\n\nlemma OclOr5[simp]: \"(null or true) = true\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def null_fun_def null_option_def)\nlemma OclOr6[simp]: \"(null or false) = null\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def null_fun_def null_option_def)\nlemma OclOr7[simp]: \"(null or null) = null\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def\n bot_option_def null_fun_def null_option_def)\nlemma OclOr8[simp]: \"(null or invalid) = invalid\"\nby(rule ext, simp add: OclOr_def OclNot_def OclAnd_def null_def invalid_def true_def false_def \n bot_option_def null_fun_def null_option_def)\n\n\n\nlemma OclOr_commute: \"(X or Y) = (Y or X)\"\n by(simp add: OclOr_def OclAnd_commute)\n\nlemma OclOr_false1[simp]: \"(false or Y) = Y\"\n by(simp add: OclOr_def)\n\nlemma OclOr_false2[simp]: \"(Y or false) = Y\"\n by(simp add: OclOr_def)\n\nlemma OclOr_true1[simp]: \"(true or Y) = true\"\n by(simp add: OclOr_def)\n\nlemma OclOr_true2: \"(Y or true) = true\"\n by(simp add: OclOr_def)\n\nlemma OclOr_bot1[simp]: \"\\\\. X \\ \\ true \\ \\ (bot or X) \\ = bot \\\"\n apply(simp add: OclOr_def OclAnd_def OclNot_def)\n apply(auto simp:true_def false_def bot_fun_def bot_option_def\n split: option.split option.split_asm)\ndone\n\nlemma OclOr_bot2[simp]: \"\\\\. X \\ \\ true \\ \\ (X or bot) \\ = bot \\\"\n by(simp add: OclOr_commute)\n\nlemma OclOr_null1[simp]: \"\\\\. X \\ \\ true \\ \\ X \\ \\ bot \\ \\ (null or X) \\ = null \\\"\n apply(simp add: OclOr_def OclAnd_def OclNot_def)\n apply(auto simp:true_def false_def bot_fun_def bot_option_def null_fun_def null_option_def\n split: option.split option.split_asm)\n apply (metis (full_types) bool.simps(3) bot_option_def null_is_valid null_option_def)\nby (metis (full_types) bool.simps(3) option.distinct(1) option.sel)\n\nlemma OclOr_null2[simp]: \"\\\\. X \\ \\ true \\ \\ X \\ \\ bot \\ \\ (X or null) \\ = null \\\"\n by(simp add: OclOr_commute)\n\nlemma OclOr_assoc: \"(X or (Y or Z)) = (X or Y or Z)\"\n by(simp add: OclOr_def OclAnd_assoc)\n\nlemma OclImplies_true: \"(X implies true) = true\"\n by (simp add: OclImplies_def OclOr_true2)\n\nlemma deMorgan1: \"not(X and Y) = ((not X) or (not Y))\"\n by(simp add: OclOr_def)\n\nlemma deMorgan2: \"not(X or Y) = ((not X) and (not Y))\"\n by(simp add: OclOr_def)\n\n\nsection{* A Standard Logical Calculus for OCL *}\ndefinition OclValid :: \"[('\\)st, ('\\)Boolean] \\ bool\" (\"(1(_)/ \\ (_))\" 50)\nwhere \"\\ \\ P \\ ((P \\) = true \\)\"\n\nvalue \"\\ \\ true <> false\"\nvalue \"\\ \\ false <> true\"\n\nsubsection{* Global vs. Local Judgements*}\nlemma transform1: \"P = true \\ \\ \\ P\"\nby(simp add: OclValid_def)\n\n\nlemma transform1_rev: \"\\ \\. \\ \\ P \\ P = true\"\nby(rule ext, auto simp: OclValid_def true_def)\n\nlemma transform2: \"(P = Q) \\ ((\\ \\ P) = (\\ \\ Q))\"\nby(auto simp: OclValid_def)\n\nlemma transform2_rev: \"\\ \\. (\\ \\ \\ P) \\ (\\ \\ \\ Q) \\ (\\ \\ P) = (\\ \\ Q) \\ P = Q\"\napply(rule ext,auto simp: OclValid_def true_def defined_def)\napply(erule_tac x=a in allE)\napply(erule_tac x=b in allE)\napply(auto simp: false_def true_def defined_def bot_Boolean_def null_Boolean_def\n split: option.split_asm HOL.split_if_asm)\ndone\n(* Something stronger is possible here (consider P null, Q invalid),\n but this thingi should do for our purpose *)\n\ntext{* However, certain properties (like transitivity) can not\n be \\emph{transformed} from the global level to the local one,\n they have to be re-proven on the local level. *}\n\nlemma (*transform3:*)\nassumes H : \"P = true \\ Q = true\"\nshows \"\\ \\ P \\ \\ \\ Q\"\napply(simp add: OclValid_def)\napply(rule H[THEN fun_cong])\napply(rule ext)\noops\n\nsubsection{* Local Validity and Meta-logic*}\ntext{* \\label{sec:localVal} *}\n\nlemma foundation1[simp]: \"\\ \\ true\"\nby(auto simp: OclValid_def)\n\nlemma foundation2[simp]: \"\\(\\ \\ false)\"\nby(auto simp: OclValid_def true_def false_def)\n\nlemma foundation3[simp]: \"\\(\\ \\ invalid)\"\nby(auto simp: OclValid_def true_def false_def invalid_def bot_option_def)\n\nlemma foundation4[simp]: \"\\(\\ \\ null)\"\nby(auto simp: OclValid_def true_def false_def null_def null_fun_def null_option_def bot_option_def)\n\nlemma bool_split_local[simp]:\n\"(\\ \\ (x \\ invalid)) \\ (\\ \\ (x \\ null)) \\ (\\ \\ (x \\ true)) \\ (\\ \\ (x \\ false))\"\napply(insert bool_split[of x \\], auto)\napply(simp_all add: OclValid_def StrongEq_def true_def null_def invalid_def)\ndone\n\nlemma def_split_local:\n\"(\\ \\ \\ x) = ((\\(\\ \\ (x \\ invalid))) \\ (\\ (\\ \\ (x \\ null))))\"\nby(simp add:defined_def true_def false_def invalid_def null_def\n StrongEq_def OclValid_def bot_fun_def null_fun_def)\n\nlemma foundation5:\n\"\\ \\ (P and Q) \\ (\\ \\ P) \\ (\\ \\ Q)\"\nby(simp add: OclAnd_def OclValid_def true_def false_def defined_def\n split: option.split option.split_asm bool.split bool.split_asm)\n\nlemma foundation6:\n\"\\ \\ P \\ \\ \\ \\ P\"\nby(simp add: OclNot_def OclValid_def true_def false_def defined_def\n null_option_def null_fun_def bot_option_def bot_fun_def\n split: option.split option.split_asm)\n\n\nlemma foundation7[simp]:\n\"(\\ \\ not (\\ x)) = (\\ (\\ \\ \\ x))\"\nby(simp add: OclNot_def OclValid_def true_def false_def defined_def\n split: option.split option.split_asm)\n\nlemma foundation7'[simp]:\n\"(\\ \\ not (\\ x)) = (\\ (\\ \\ \\ x))\"\nby(simp add: OclNot_def OclValid_def true_def false_def valid_def\n split: option.split option.split_asm)\n\n\ntext{*\n Key theorem for the $\\delta$-closure: either an expression is\n defined, or it can be replaced (substituted via @{text \"StrongEq_L_subst2\"};\n see below) by @{text invalid} or @{text null}. Strictness-reduction rules will\n usually reduce these substituted terms drastically.\n*}\nlemma foundation8:\n\"(\\ \\ \\ x) \\ (\\ \\ (x \\ invalid)) \\ (\\ \\ (x \\ null))\"\nproof -\n have 1 : \"(\\ \\ \\ x) \\ (\\(\\ \\ \\ x))\" by auto\n have 2 : \"(\\(\\ \\ \\ x)) = ((\\ \\ (x \\ invalid)) \\ (\\ \\ (x \\ null)))\"\n by(simp only: def_split_local, simp)\n show ?thesis by(insert 1, simp add:2)\nqed\n\nlemma foundation9:\n\"\\ \\ \\ x \\ (\\ \\ not x) = (\\ (\\ \\ x))\"\napply(simp add: def_split_local )\nby(auto simp: OclNot_def null_fun_def null_option_def bot_option_def\n OclValid_def invalid_def true_def null_def StrongEq_def)\n\n\nlemma foundation10:\n\"\\ \\ \\ x \\ \\ \\ \\ y \\ (\\ \\ (x and y)) = ( (\\ \\ x) \\ (\\ \\ y))\"\napply(simp add: def_split_local)\nby(auto simp: OclAnd_def OclValid_def invalid_def\n true_def null_def StrongEq_def null_fun_def null_option_def bot_option_def\n split:bool.split_asm)\n\n\nlemma foundation11:\n\"\\ \\ \\ x \\ \\ \\ \\ y \\ (\\ \\ (x or y)) = ( (\\ \\ x) \\ (\\ \\ y))\"\napply(simp add: def_split_local)\nby(auto simp: OclNot_def OclOr_def OclAnd_def OclValid_def invalid_def\n true_def null_def StrongEq_def null_fun_def null_option_def bot_option_def\n split:bool.split_asm bool.split)\n\n\n\nlemma foundation12:\n\"\\ \\ \\ x \\ \\ \\ \\ y \\ (\\ \\ (x implies y)) = ( (\\ \\ x) \\ (\\ \\ y))\"\napply(simp add: def_split_local)\nby(auto simp: OclNot_def OclOr_def OclAnd_def OclImplies_def bot_option_def\n OclValid_def invalid_def true_def null_def StrongEq_def null_fun_def null_option_def\n split:bool.split_asm bool.split)\n\nlemma foundation13:\"(\\ \\ A \\ true) = (\\ \\ A)\"\nby(auto simp: OclNot_def OclValid_def invalid_def true_def null_def StrongEq_def\n split:bool.split_asm bool.split)\n\nlemma foundation14:\"(\\ \\ A \\ false) = (\\ \\ not A)\"\nby(auto simp: OclNot_def OclValid_def invalid_def false_def true_def null_def StrongEq_def\n split:bool.split_asm bool.split option.split)\n\nlemma foundation15:\"(\\ \\ A \\ invalid) = (\\ \\ not(\\ A))\"\nby(auto simp: OclNot_def OclValid_def valid_def invalid_def false_def true_def null_def\n StrongEq_def bot_option_def null_fun_def null_option_def bot_option_def bot_fun_def\n split:bool.split_asm bool.split option.split)\n\n\n(* ... and the usual rules on strictness, definedness propoagation, and cp ... *)\nlemma foundation16: \"\\ \\ (\\ X) = (X \\ \\ bot \\ X \\ \\ null)\"\nby(auto simp: OclValid_def defined_def false_def true_def bot_fun_def null_fun_def\n split:split_if_asm)\n\n(* correcter rule; the previous is deprecated *)\nlemma foundation16': \"(\\ \\ (\\ X)) = (X \\ \\ invalid \\ \\ X \\ \\ null \\)\"\napply(simp add:invalid_def null_def null_fun_def)\nby(auto simp: OclValid_def defined_def false_def true_def bot_fun_def null_fun_def\n split:split_if_asm)\n\nlemmas foundation17 = foundation16[THEN iffD1]\n(* correcter rule; the previous is deprecated *)\nlemmas foundation17' = foundation16'[THEN iffD1]\n\nlemma foundation18: \"\\ \\ (\\ X) = (X \\ \\ invalid \\)\"\nby(auto simp: OclValid_def valid_def false_def true_def bot_fun_def invalid_def\n split:split_if_asm)\n\n(*legacy*)\nlemma foundation18': \"\\ \\ (\\ X) = (X \\ \\ bot)\"\nby(auto simp: OclValid_def valid_def false_def true_def bot_fun_def\n split:split_if_asm)\n\n\nlemmas foundation19 = foundation18[THEN iffD1]\n\nlemma foundation20 : \"\\ \\ (\\ X) \\ \\ \\ \\ X\"\nby(simp add: foundation18 foundation16 invalid_def)\n\nlemma foundation21: \"(not A \\ not B) = (A \\ B)\"\nby(rule ext, auto simp: OclNot_def StrongEq_def\n split: bool.split_asm HOL.split_if_asm option.split)\n\nlemma foundation22: \"(\\ \\ (X \\ Y)) = (X \\ = Y \\)\"\nby(auto simp: StrongEq_def OclValid_def true_def)\n\nlemma foundation23: \"(\\ \\ P) = (\\ \\ (\\ _ . P \\))\"\nby(auto simp: OclValid_def true_def)\n\nlemmas cp_validity=foundation23\n\nlemma foundation24:\"(\\ \\ not(X \\ Y)) = (X \\ \\ Y \\)\"\nby(simp add: StrongEq_def OclValid_def OclNot_def true_def)\n\n\nlemma defined_not_I : \"\\ \\ \\ (x) \\ \\ \\ \\ (not x)\"\n by(auto simp: OclNot_def null_def invalid_def defined_def valid_def OclValid_def\n true_def false_def bot_option_def null_option_def null_fun_def bot_fun_def\n split: option.split_asm HOL.split_if_asm)\n\nlemma valid_not_I : \"\\ \\ \\ (x) \\ \\ \\ \\ (not x)\"\n by(auto simp: OclNot_def null_def invalid_def defined_def valid_def OclValid_def\n true_def false_def bot_option_def null_option_def null_fun_def bot_fun_def\n split: option.split_asm option.split HOL.split_if_asm)\n\nlemma defined_and_I : \"\\ \\ \\ (x) \\ \\ \\ \\ (y) \\ \\ \\ \\ (x and y)\"\n apply(simp add: OclAnd_def null_def invalid_def defined_def valid_def OclValid_def\n true_def false_def bot_option_def null_option_def null_fun_def bot_fun_def\n split: option.split_asm HOL.split_if_asm)\n apply(auto simp: null_option_def split: bool.split)\n by(case_tac \"ya\",simp_all)\n\nlemma valid_and_I : \"\\ \\ \\ (x) \\ \\ \\ \\ (y) \\ \\ \\ \\ (x and y)\"\n apply(simp add: OclAnd_def null_def invalid_def defined_def valid_def OclValid_def\n true_def false_def bot_option_def null_option_def null_fun_def bot_fun_def\n split: option.split_asm HOL.split_if_asm)\n by(auto simp: null_option_def split: option.split bool.split)\n\n\n\nsubsection{* Local Judgements and Strong Equality *}\n\nlemma StrongEq_L_refl: \"\\ \\ (x \\ x)\"\nby(simp add: OclValid_def StrongEq_def)\n\n\nlemma StrongEq_L_sym: \"\\ \\ (x \\ y) \\ \\ \\ (y \\ x)\"\nby(simp add: StrongEq_sym)\n\nlemma StrongEq_L_trans: \"\\ \\ (x \\ y) \\ \\ \\ (y \\ z) \\ \\ \\ (x \\ z)\"\nby(simp add: OclValid_def StrongEq_def true_def)\n\n\n\ntext{* In order to establish substitutivity (which does not\nhold in general HOL formulas) we introduce the following\npredicate that allows for a calculus of the necessary side-conditions.*}\ndefinition cp :: \"(('\\,'\\) val \\ ('\\,'\\) val) \\ bool\"\nwhere \"cp P \\ (\\ f. \\ X \\. P X \\ = f (X \\) \\)\"\n\n\ntext{* The rule of substitutivity in Featherweight OCL holds only\nfor context-passing expressions, \\ie those that pass\nthe context @{text \"\\\"} without changing it. Fortunately, all\noperators of the OCL language satisfy this property\n(but not all HOL operators).*}\n\nlemma StrongEq_L_subst1: \"\\ \\. cp P \\ \\ \\ (x \\ y) \\ \\ \\ (P x \\ P y)\"\nby(auto simp: OclValid_def StrongEq_def true_def cp_def)\n\nlemma StrongEq_L_subst2:\n\"\\ \\. cp P \\ \\ \\ (x \\ y) \\ \\ \\ (P x) \\ \\ \\ (P y)\"\nby(auto simp: OclValid_def StrongEq_def true_def cp_def)\n\nlemma StrongEq_L_subst2_rev: \"\\ \\ y \\ x \\ cp P \\ \\ \\ P x \\ \\ \\ P y\"\napply(erule StrongEq_L_subst2)\napply(erule StrongEq_L_sym)\nby assumption\n\nlemma StrongEq_L_subst3:\nassumes cp: \"cp P\"\nand eq: \"\\ \\ x \\ y\"\nshows \"(\\ \\ P x) = (\\ \\ P y)\"\napply(rule iffI)\napply(rule OCL_core.StrongEq_L_subst2[OF cp,OF eq],simp)\napply(rule OCL_core.StrongEq_L_subst2[OF cp,OF eq[THEN StrongEq_L_sym]],simp)\ndone\n\n\nlemma cpI1:\n\"(\\ X \\. f X \\ = f(\\_. X \\) \\) \\ cp P \\ cp(\\X. f (P X))\"\napply(auto simp: true_def cp_def)\napply(rule exI, (rule allI)+)\nby(erule_tac x=\"P X\" in allE, auto)\n\nlemma cpI2:\n\"(\\ X Y \\. f X Y \\ = f(\\_. X \\)(\\_. Y \\) \\) \\\n cp P \\ cp Q \\ cp(\\X. f (P X) (Q X))\"\napply(auto simp: true_def cp_def)\napply(rule exI, (rule allI)+)\nby(erule_tac x=\"P X\" in allE, auto)\n \nlemma cpI3:\n\"(\\ X Y Z \\. f X Y Z \\ = f(\\_. X \\)(\\_. Y \\)(\\_. Z \\) \\) \\\n cp P \\ cp Q \\ cp R \\ cp(\\X. f (P X) (Q X) (R X))\"\napply(auto simp: cp_def)\napply(rule exI, (rule allI)+)\nby(erule_tac x=\"P X\" in allE, auto)\n\nlemma cpI4:\n\"(\\ W X Y Z \\. f W X Y Z \\ = f(\\_. W \\)(\\_. X \\)(\\_. Y \\)(\\_. Z \\) \\) \\\n cp P \\ cp Q \\ cp R \\ cp S \\ cp(\\X. f (P X) (Q X) (R X) (S X))\"\napply(auto simp: cp_def)\napply(rule exI, (rule allI)+)\nby(erule_tac x=\"P X\" in allE, auto)\n\nlemma cp_const : \"cp(\\_. c)\"\n by (simp add: cp_def, fast)\n\nlemma cp_id : \"cp(\\X. X)\"\n by (simp add: cp_def, fast)\n\nlemmas cp_intro[intro!,simp,code_unfold] =\n cp_const\n cp_id\n cp_defined[THEN allI[THEN allI[THEN cpI1], of defined]]\n cp_valid[THEN allI[THEN allI[THEN cpI1], of valid]]\n cp_OclNot[THEN allI[THEN allI[THEN cpI1], of not]]\n cp_OclAnd[THEN allI[THEN allI[THEN allI[THEN cpI2]], of \"op and\"]]\n cp_OclOr[THEN allI[THEN allI[THEN allI[THEN cpI2]], of \"op or\"]]\n cp_OclImplies[THEN allI[THEN allI[THEN allI[THEN cpI2]], of \"op implies\"]]\n cp_StrongEq[THEN allI[THEN allI[THEN allI[THEN cpI2]],\n of \"StrongEq\"]]\n\nsubsection{* Laws to Establish Definedness ($\\delta$-closure) *}\n\ntext{* For the logical connectives, we have --- beyond\n@{thm foundation6} --- the following facts: *}\nlemma OclNot_defargs:\n\"\\ \\ (not P) \\ \\ \\ \\ P\"\nby(auto simp: OclNot_def OclValid_def true_def invalid_def defined_def false_def\n bot_fun_def bot_option_def null_fun_def null_option_def\n split: bool.split_asm HOL.split_if_asm option.split option.split_asm)\n\nlemma OclNot_contrapos_nn:\n assumes \"\\ \\ \\ A\"\n assumes \"\\ \\ not B\"\n assumes \"\\ \\ A \\ \\ \\ B\"\n shows \"\\ \\ not A\"\nproof -\n have change_not : \"\\a b. (not a \\ = b \\) = (a \\ = not b \\)\"\n by (metis OclNot_not cp_OclNot)\n show ?thesis\n apply(insert assms, simp add: OclValid_def, subst change_not, subst (asm) change_not)\n apply(simp add: OclNot_def true_def)\n by (metis OclValid_def bool_split defined_def false_def foundation2 true_def\n bot_fun_def invalid_def)\nqed\n\ntext{* So far, we have only one strict Boolean predicate (-family): the strict equality. *}\n\nsection{* Miscellaneous *}\n\nsubsection{* OCL's if then else endif *}\n\ndefinition OclIf :: \"[('\\)Boolean , ('\\,'\\::null) val, ('\\,'\\) val] \\ ('\\,'\\) val\"\n (\"if (_) then (_) else (_) endif\" [10,10,10]50)\nwhere \"(if C then B\\<^sub>1 else B\\<^sub>2 endif) = (\\ \\. if (\\ C) \\ = true \\\n then (if (C \\) = true \\\n then B\\<^sub>1 \\\n else B\\<^sub>2 \\)\n else invalid \\)\"\n\n\nlemma cp_OclIf:\"((if C then B\\<^sub>1 else B\\<^sub>2 endif) \\ =\n (if (\\ _. C \\) then (\\ _. B\\<^sub>1 \\) else (\\ _. B\\<^sub>2 \\) endif) \\)\"\nby(simp only: OclIf_def, subst cp_defined, rule refl)\n\nlemmas cp_intro'[intro!,simp,code_unfold] =\n cp_intro\n cp_OclIf[THEN allI[THEN allI[THEN allI[THEN allI[THEN cpI3]]], of \"OclIf\"]]\n\nlemma OclIf_invalid [simp]: \"(if invalid then B\\<^sub>1 else B\\<^sub>2 endif) = invalid\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclIf_null [simp]: \"(if null then B\\<^sub>1 else B\\<^sub>2 endif) = invalid\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclIf_true [simp]: \"(if true then B\\<^sub>1 else B\\<^sub>2 endif) = B\\<^sub>1\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclIf_true' [simp]: \"\\ \\ P \\ (if P then B\\<^sub>1 else B\\<^sub>2 endif)\\ = B\\<^sub>1 \\\"\napply(subst cp_OclIf,auto simp: OclValid_def)\nby(simp add:cp_OclIf[symmetric])\n\nlemma OclIf_false [simp]: \"(if false then B\\<^sub>1 else B\\<^sub>2 endif) = B\\<^sub>2\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclIf_false' [simp]: \"\\ \\ not P \\ (if P then B\\<^sub>1 else B\\<^sub>2 endif)\\ = B\\<^sub>2 \\\"\napply(subst cp_OclIf)\napply(auto simp: foundation14[symmetric] foundation22)\nby(auto simp: cp_OclIf[symmetric])\n\n\nlemma OclIf_idem1[simp]:\"(if \\ X then A else A endif) = A\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclIf_idem2[simp]:\"(if \\ X then A else A endif) = A\"\nby(rule ext, auto simp: OclIf_def)\n\nlemma OclNot_if[simp]:\n\"not(if P then C else E endif) = (if P then not C else not E endif)\"\n (* non-trivial but elementary *)\n apply(rule OclNot_inject, simp)\n apply(rule ext)\n apply(subst cp_OclNot, simp add: OclIf_def)\n apply(subst cp_OclNot[symmetric])+\nby simp\n\n\nsubsection{* A Side-calculus for (Boolean) Constant Terms *}\n\ndefinition \"const X \\ \\ \\ \\'. X \\ = X \\'\"\n\nlemma const_charn: \"const X \\ X \\ = X \\'\"\nby(auto simp: const_def)\n\nlemma const_subst:\n assumes const_X: \"const X\"\n and const_Y: \"const Y\"\n and eq : \"X \\ = Y \\\"\n and cp_P: \"cp P\"\n and pp : \"P Y \\ = P Y \\'\"\n shows \"P X \\ = P X \\'\"\nproof -\n have A: \"\\Y. P Y \\ = P (\\_. Y \\) \\\"\n apply(insert cp_P, unfold cp_def)\n apply(elim exE, erule_tac x=Y in allE', erule_tac x=\\ in allE)\n apply(erule_tac x=\"(\\_. Y \\)\" in allE, erule_tac x=\\ in allE)\n by simp\n have B: \"\\Y. P Y \\' = P (\\_. Y \\') \\'\"\n apply(insert cp_P, unfold cp_def)\n apply(elim exE, erule_tac x=Y in allE', erule_tac x=\\' in allE)\n apply(erule_tac x=\"(\\_. Y \\')\" in allE, erule_tac x=\\' in allE)\n by simp \n have C: \"X \\' = Y \\'\"\n apply(rule trans, subst const_charn[OF const_X],rule eq)\n by(rule const_charn[OF const_Y])\n show ?thesis\n apply(subst A, subst B, simp add: eq C)\n apply(subst A[symmetric],subst B[symmetric])\n by(simp add:pp)\nqed\n\n\nlemma const_imply2 :\n assumes \"\\\\1 \\2. P \\1 = P \\2 \\ Q \\1 = Q \\2\"\n shows \"const P \\ const Q\"\nby(simp add: const_def, insert assms, blast)\n\nlemma const_imply3 :\n assumes \"\\\\1 \\2. P \\1 = P \\2 \\ Q \\1 = Q \\2 \\ R \\1 = R \\2\"\n shows \"const P \\ const Q \\ const R\"\nby(simp add: const_def, insert assms, blast)\n\nlemma const_imply4 :\n assumes \"\\\\1 \\2. P \\1 = P \\2 \\ Q \\1 = Q \\2 \\ R \\1 = R \\2 \\ S \\1 = S \\2\"\n shows \"const P \\ const Q \\ const R \\ const S\"\nby(simp add: const_def, insert assms, blast)\n\nlemma const_lam : \"const (\\_. e)\"\nby(simp add: const_def)\n\n\nlemma const_true : \"const true\"\nby(simp add: const_def true_def)\n\nlemma const_false : \"const false\"\nby(simp add: const_def false_def)\n\nlemma const_null : \"const null\"\nby(simp add: const_def null_fun_def)\n\nlemma const_invalid : \"const invalid\"\nby(simp add: const_def invalid_def)\n\nlemma const_bot : \"const bot\"\nby(simp add: const_def bot_fun_def)\n\n\n\nlemma const_defined :\n assumes \"const X\"\n shows \"const (\\ X)\"\nby(rule const_imply2[OF _ assms],\n simp add: defined_def false_def true_def bot_fun_def bot_option_def null_fun_def null_option_def)\n\nlemma const_valid :\n assumes \"const X\"\n shows \"const (\\ X)\"\nby(rule const_imply2[OF _ assms],\n simp add: valid_def false_def true_def bot_fun_def null_fun_def assms)\n\nlemma const_OclValid1:\n assumes \"const x\"\n shows \"(\\ \\ \\ x) = (\\' \\ \\ x)\"\n apply(simp add: OclValid_def)\n apply(subst const_defined[OF assms, THEN const_charn])\n by(simp add: true_def)\n\nlemma const_OclValid2:\n assumes \"const x\"\n shows \"(\\ \\ \\ x) = (\\' \\ \\ x)\"\n apply(simp add: OclValid_def)\n apply(subst const_valid[OF assms, THEN const_charn])\n by(simp add: true_def)\n\n \nlemma const_OclAnd :\n assumes \"const X\"\n assumes \"const X'\"\n shows \"const (X and X')\"\nby(rule const_imply3[OF _ assms], subst (1 2) cp_OclAnd, simp add: assms OclAnd_def)\n\n\n\nlemma const_OclNot :\n assumes \"const X\"\n shows \"const (not X)\"\nby(rule const_imply2[OF _ assms],subst cp_OclNot,simp add: assms OclNot_def)\n\nlemma const_OclOr :\n assumes \"const X\"\n assumes \"const X'\"\n shows \"const (X or X')\"\nby(simp add: assms OclOr_def const_OclNot const_OclAnd)\n\nlemma const_OclImplies :\n assumes \"const X\"\n assumes \"const X'\"\n shows \"const (X implies X')\"\nby(simp add: assms OclImplies_def const_OclNot const_OclOr)\n\nlemma const_StrongEq:\n assumes \"const X\"\n assumes \"const X'\"\n shows \"const(X \\ X')\"\n apply(simp only: StrongEq_def const_def, intro allI)\n apply(subst assms(1)[THEN const_charn])\n apply(subst assms(2)[THEN const_charn])\n by simp\n \nlemma const_OclIf :\n assumes \"const B\"\n and \"const C1\"\n and \"const C2\"\n shows \"const (if B then C1 else C2 endif)\"\n apply(rule const_imply4[OF _ assms], \n subst (1 2) cp_OclIf, simp only: OclIf_def cp_defined[symmetric])\n apply(simp add: const_defined[OF assms(1), simplified const_def, THEN spec, THEN spec]\n const_true[simplified const_def, THEN spec, THEN spec]\n assms[simplified const_def, THEN spec, THEN spec]\n const_invalid[simplified const_def, THEN spec, THEN spec])\nby (metis (no_types) OCL_core.bot_fun_def OclValid_def const_def const_true defined_def foundation17 \n null_fun_def)\n\nlemmas const_ss = const_bot const_null const_invalid const_false const_true const_lam\n const_defined const_valid const_StrongEq const_OclNot const_OclAnd \n const_OclOr const_OclImplies const_OclIf\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Featherweight_OCL/OCL_core.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6791787121629466, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2895485501936609}} {"text": "header {* \\isaheader{Dynamic Backward Slice} *}\n\ntheory DynSlice imports DependentLiveVariables BitVector \"../Basic/SemanticsCFG\" begin\n\nsubsection {* Backward slice of paths *}\n\ncontext DynPDG begin\n\nfun slice_path :: \"'edge list \\ bit_vector\"\n where \"slice_path [] = []\"\n | \"slice_path (a#as) = (let n' = last(targetnodes (a#as)) in\n (sourcenode a -a#as\\\\<^sub>d* n')#slice_path as)\"\n\n(*<*)declare Let_def [simp](*>*)\n\nlemma slice_path_length:\n \"length(slice_path as) = length as\"\nby(induct as) auto\n\n\nlemma slice_path_right_Cons:\n assumes slice:\"slice_path as = x#xs\"\n obtains a' as' where \"as = a'#as'\" and \"slice_path as' = xs\"\nproof(atomize_elim)\n from slice show \"\\a' as'. as = a'#as' \\ slice_path as' = xs\"\n by(induct as) auto\nqed\n\n\nsubsection {* The proof of the fundamental property of (dynamic) slicing *}\n\nfun select_edge_kinds :: \"'edge list \\ bit_vector \\ 'state edge_kind list\"\nwhere \"select_edge_kinds [] [] = []\"\n | \"select_edge_kinds (a#as) (b#bs) = (if b then kind a\n else (case kind a of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))#select_edge_kinds as bs\"\n\n\ndefinition slice_kinds :: \"'edge list \\ 'state edge_kind list\"\n where \"slice_kinds as = select_edge_kinds as (slice_path as)\"\n\n\nlemma select_edge_kinds_max_bv:\n \"select_edge_kinds as (replicate (length as) True) = kinds as\"\nby(induct as,auto simp:kinds_def)\n\n\nlemma slice_path_leqs_information_same_Uses:\n \"\\n -as\\* n'; bs \\\\<^sub>b bs'; slice_path as = bs;\n select_edge_kinds as bs = es; select_edge_kinds as bs' = es'; \n \\V xs. (V,xs,as) \\ dependent_live_vars n' \\ state_val s V = state_val s' V;\n preds es' s'\\ \n \\ (\\V \\ Use n'. state_val (transfers es s) V =\n state_val (transfers es' s') V) \\ preds es s\"\nproof(induct bs bs' arbitrary:as es es' n s s' rule:bv_leqs.induct)\n case 1\n from `slice_path as = []` have \"as = []\" by(cases as) auto\n with `select_edge_kinds as [] = es` `select_edge_kinds as [] = es'`\n have \"es = []\" and \"es' = []\" by simp_all\n { fix V assume \"V \\ Use n'\"\n hence \"(V,[],[]) \\ dependent_live_vars n'\" by(rule dep_vars_Use)\n with `\\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V` `V \\ Use n'` `as = []`\n have \"state_val s V = state_val s' V\" by blast }\n with `es = []` `es' = []` show ?case by simp\nnext\n case (2 x xs y ys)\n note all = `\\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V`\n note IH = `\\as es es' n s s'. \\n -as\\* n'; xs \\\\<^sub>b ys; slice_path as = xs; \n select_edge_kinds as xs = es; select_edge_kinds as ys = es';\n \\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V; \n preds es' s'\\\n \\ (\\V \\ Use n'. state_val (transfers es s) V =\n state_val (transfers es' s') V) \\ preds es s`\n from `x#xs \\\\<^sub>b y#ys` have \"x \\ y\" and \"xs \\\\<^sub>b ys\" by simp_all\n from `slice_path as = x#xs` obtain a' as' where \"as = a'#as'\"\n and \"slice_path as' = xs\" by(erule slice_path_right_Cons)\n from `as = a'#as'` `select_edge_kinds as (x#xs) = es`\n obtain ex esx where \"es = ex#esx\"\n and ex:\"ex = (if x then kind a'\n else (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))\"\n and \"select_edge_kinds as' xs = esx\" by auto\n from `as = a'#as'` `select_edge_kinds as (y#ys) = es'` obtain ex' esx' \n where \"es' = ex'#esx'\"\n and ex':\"ex' = (if y then kind a'\n else (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))\"\n and \"select_edge_kinds as' ys = esx'\" by auto\n from `n -as\\* n'` `as = a'#as'` have [simp]:\"n = sourcenode a'\" \n and \"valid_edge a'\" and \"targetnode a' -as'\\* n'\"\n by(auto elim:path_split_Cons)\n from `n -as\\* n'` `as = a'#as'` have \"last(targetnodes as) = n'\"\n by(fastforce intro:path_targetnode)\n from `preds es' s'` `es' = ex'#esx'` have \"pred ex' s'\"\n and \"preds esx' (transfer ex' s')\" by simp_all\n show ?case\n proof(cases \"as' = []\")\n case True\n hence [simp]:\"as' = []\" by simp\n with `slice_path as' = xs` `xs \\\\<^sub>b ys` \n have [simp]:\"xs = [] \\ ys = []\" by auto(cases ys,auto)+\n with `select_edge_kinds as' xs = esx` `select_edge_kinds as' ys = esx'`\n have [simp]:\"esx = []\" and [simp]:\"esx' = []\" by simp_all\n from True `targetnode a' -as'\\* n'` \n have [simp]:\"n' = targetnode a'\" by(auto elim:path.cases)\n show ?thesis\n proof(cases x)\n case True\n with `x \\ y` ex ex' have [simp]:\"ex = kind a' \\ ex' = kind a'\" by simp\n have \"pred ex s\"\n proof(cases ex)\n case (Predicate Q)\n with ex ex' True `x \\ y` have [simp]:\"transfer ex s = s\" \n and [simp]:\"transfer ex' s' = s'\"\n by(cases \"kind a'\",auto)+\n show ?thesis\n proof(cases \"n -[a']\\\\<^bsub>cd\\<^esub> n'\")\n case True\n { fix V' assume \"V' \\ Use n\"\n with True `valid_edge a'`\n have \"(V',[],a'#[]@[]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_cdep DynPDG_path_Nil \n simp:targetnodes_def)\n with all `as = a'#as'` have \"state_val s V' = state_val s' V'\"\n by fastforce }\n with `pred ex' s'` `valid_edge a'`\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n next\n case False\n from ex True Predicate have \"kind a' = (Q)\\<^sub>\\\" by(auto split:split_if_asm)\n from True `slice_path as = x#xs` `as = a'#as'` have \"n -[a']\\\\<^sub>d* n'\"\n by(auto simp:targetnodes_def)\n thus ?thesis\n proof(induct rule:DynPDG_path.cases)\n case (DynPDG_path_Nil nx)\n hence False by simp\n thus ?case by simp\n next\n case (DynPDG_path_Append_cdep nx asx n'' asx' nx')\n from `[a'] = asx@asx'` \n have \"(asx = [a'] \\ asx' = []) \\ (asx = [] \\ asx' = [a'])\"\n by (cases asx) auto\n hence False\n proof\n assume \"asx = [a'] \\ asx' = []\"\n with `n'' -asx'\\\\<^bsub>cd\\<^esub> nx'` show False\n by(fastforce elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n next\n assume \"asx = [] \\ asx' = [a']\"\n with `nx -asx\\\\<^sub>d* n''` have \"nx = n''\" and \"asx' = [a']\"\n by(auto intro:DynPDG_empty_path_eq_nodes)\n with `n = nx` `n' = nx'` `n'' -asx'\\\\<^bsub>cd\\<^esub> nx'` False\n show False by simp\n qed\n thus ?thesis by simp\n next\n case (DynPDG_path_Append_ddep nx asx n'' V asx' nx')\n from `[a'] = asx@asx'` \n have \"(asx = [a'] \\ asx' = []) \\ (asx = [] \\ asx' = [a'])\"\n by (cases asx) auto\n thus ?case\n proof\n assume \"asx = [a'] \\ asx' = []\"\n with `n'' -{V}asx'\\\\<^bsub>dd\\<^esub> nx'` have False\n by(fastforce elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n thus ?thesis by simp\n next\n assume \"asx = [] \\ asx' = [a']\"\n with `nx -asx\\\\<^sub>d* n''` have \"nx = n''\"\n by(simp add:DynPDG_empty_path_eq_nodes)\n { fix V' assume \"V' \\ Use n\"\n from `n'' -{V}asx'\\\\<^bsub>dd\\<^esub> nx'` `asx = [] \\ asx' = [a']` `n' = nx'`\n have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Use elim:DynPDG_edge.cases\n simp:dyn_data_dependence_def)\n with `V' \\ Use n` `n'' -{V}asx'\\\\<^bsub>dd\\<^esub> nx'` `asx = [] \\ asx' = [a']`\n `n = nx` `nx = n''` `n' = nx'`\n have \"(V',[],[a']) \\ dependent_live_vars n'\"\n by(auto elim:dep_vars_Cons_ddep simp:targetnodes_def)\n with all `as = a'#as'` have \"state_val s V' = state_val s' V'\"\n by fastforce }\n with `pred ex' s'` `valid_edge a'` ex ex' True `x \\ y` show ?thesis\n by(fastforce elim:CFG_edge_Uses_pred_equal)\n qed\n qed\n qed\n qed simp\n { fix V assume \"V \\ Use n'\"\n from `V \\ Use n'` have \"(V,[],[]) \\ dependent_live_vars n'\" \n by(rule dep_vars_Use)\n have \"state_val (transfer ex s) V = state_val (transfer ex' s') V\"\n proof(cases \"n -{V}[a']\\\\<^bsub>dd\\<^esub> n'\")\n case True\n hence \"V \\ Def n\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n have \"\\V. V \\ Use n \\ state_val s V = state_val s' V\"\n proof -\n fix V' assume \"V' \\ Use n\"\n with `(V,[],[]) \\ dependent_live_vars n'` True\n have \"(V',[],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_ddep simp:targetnodes_def)\n with all `as = a'#as'` show \"state_val s V' = state_val s' V'\" by auto\n qed\n with `valid_edge a'` `pred ex' s'` `pred ex s`\n have \"\\V \\ Def n. state_val (transfer (kind a') s) V =\n state_val (transfer (kind a') s') V\"\n by simp(rule CFG_edge_transfer_uses_only_Use,auto)\n with `V \\ Def n` have \"state_val (transfer (kind a') s) V = \n state_val (transfer (kind a') s') V\"\n by simp\n thus ?thesis by fastforce\n next\n case False\n with `last(targetnodes as) = n'` `as = a'#as'`\n `(V,[],[]) \\ dependent_live_vars n'`\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n from `(V,[a'],[a']) \\ dependent_live_vars n'` all `as = a'#as'`\n have states_eq:\"state_val s V = state_val s' V\"\n by auto\n from `valid_edge a'` `V \\ Use n'` False `pred ex s`\n have \"state_val (transfers (kinds [a']) s) V = state_val s V\"\n apply(auto intro!:no_ddep_same_state path_edge simp:targetnodes_def)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n moreover\n from `valid_edge a'` `V \\ Use n'` False `pred ex' s'`\n have \"state_val (transfers (kinds [a']) s') V = state_val s' V\"\n apply(auto intro!:no_ddep_same_state path_edge simp:targetnodes_def)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n ultimately show ?thesis using states_eq by(auto simp:kinds_def)\n qed }\n hence \"\\V \\ Use n'. state_val (transfer ex s) V = \n state_val (transfer ex' s') V\" by simp\n with `pred ex s` `es = ex#esx` `es' = ex'#esx'` show ?thesis by simp\n next\n case False\n with ex have cases_x:\"ex = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n from cases_x have \"pred ex s\" by(cases \"kind a'\",auto)\n show ?thesis\n proof(cases y)\n case True\n with ex' have [simp]:\"ex' = kind a'\" by simp\n { fix V assume \"V \\ Use n'\"\n from `V \\ Use n'` have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(rule dep_vars_Use)\n from `slice_path as = x#xs` `as = a'#as'` `\\ x` \n have \"\\ n -[a']\\\\<^sub>d* n'\" by(simp add:targetnodes_def)\n hence \"\\ n -{V}[a']\\\\<^bsub>dd\\<^esub> n'\" by(fastforce dest:DynPDG_path_ddep)\n with `last(targetnodes as) = n'` `as = a'#as'`\n `(V,[],[]) \\ dependent_live_vars n'`\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with all `as = a'#as'` have \"state_val s V = state_val s' V\" by auto\n from `valid_edge a'` `V \\ Use n'` `pred ex' s'`\n `\\ n -{V}[a']\\\\<^bsub>dd\\<^esub> n'` `last(targetnodes as) = n'` `as = a'#as'`\n have \"state_val (transfers (kinds [a']) s') V = state_val s' V\"\n apply(auto intro!:no_ddep_same_state path_edge)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n with `state_val s V = state_val s' V` cases_x\n have \"state_val (transfer ex s) V =\n state_val (transfer ex' s') V\"\n by(cases \"kind a'\",simp_all add:kinds_def) }\n hence \"\\V \\ Use n'. state_val (transfer ex s) V =\n state_val (transfer ex' s') V\" by simp\n with `as = a'#as'` `es = ex#esx` `es' = ex'#esx'` `pred ex s` \n show ?thesis by simp\n next\n case False\n with ex' have cases_y:\"ex' = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n with cases_x have [simp]:\"ex = ex'\" by(cases \"kind a'\") auto\n { fix V assume \"V \\ Use n'\"\n from `V \\ Use n'` have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(rule dep_vars_Use)\n from `slice_path as = x#xs` `as = a'#as'` `\\ x` \n have \"\\ n -[a']\\\\<^sub>d* n'\" by(simp add:targetnodes_def)\n hence no_dep:\"\\ n -{V}[a']\\\\<^bsub>dd\\<^esub> n'\" by(fastforce dest:DynPDG_path_ddep)\n with `last(targetnodes as) = n'` `as = a'#as'`\n `(V,[],[]) \\ dependent_live_vars n'`\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with all `as = a'#as'` have \"state_val s V = state_val s' V\" by auto }\n with `as = a'#as'` cases_x `es = ex#esx` `es' = ex'#esx'` `pred ex s`\n show ?thesis by(cases \"kind a'\",auto)\n qed\n qed\n next\n case False\n show ?thesis\n proof(cases \"\\V xs. (V,xs,as') \\ dependent_live_vars n' \\\n state_val (transfer ex s) V = state_val (transfer ex' s') V\")\n case True\n hence imp':\"\\V xs. (V,xs,as') \\ dependent_live_vars n' \\\n state_val (transfer ex s) V = state_val (transfer ex' s') V\" .\n from IH[OF `targetnode a' -as'\\* n'` `xs \\\\<^sub>b ys` `slice_path as' = xs`\n `select_edge_kinds as' xs = esx` `select_edge_kinds as' ys = esx'` \n this `preds esx' (transfer ex' s')`]\n have all':\"\\V\\Use n'. state_val (transfers esx (transfer ex s)) V =\n state_val (transfers esx' (transfer ex' s')) V\"\n and \"preds esx (transfer ex s)\" by simp_all\n have \"pred ex s\"\n proof(cases ex)\n case (Predicate Q)\n with `slice_path as = x#xs` `as = a'#as'` `last(targetnodes as) = n'` ex \n have \"ex = (\\s. True)\\<^sub>\\ \\ n -a'#as'\\\\<^sub>d* n'\"\n by(cases \"kind a'\",auto split:split_if_asm) \n thus ?thesis\n proof\n assume \"ex = (\\s. True)\\<^sub>\\\" thus ?thesis by simp\n next\n assume \"n -a'#as'\\\\<^sub>d* n'\"\n with `slice_path as = x#xs` `as = a'#as'` `last(targetnodes as) = n'` ex\n have [simp]:\"ex = kind a'\" by clarsimp\n with `x \\ y` ex ex' have [simp]:\"ex' = ex\" by(cases x) auto\n from `n -a'#as'\\\\<^sub>d* n'` show ?thesis\n proof(induct rule:DynPDG_path_rev_cases)\n case DynPDG_path_Nil\n hence False by simp\n thus ?thesis by simp\n next\n case (DynPDG_path_cdep_Append n'' asx asx')\n from `n -asx\\\\<^bsub>cd\\<^esub> n''`have \"asx \\ []\"\n by(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n with `n -asx\\\\<^bsub>cd\\<^esub> n''` `n'' -asx'\\\\<^sub>d* n'` `a'#as' = asx@asx'`\n have cdep:\"\\as1 as2 n''. n -a'#as1\\\\<^bsub>cd\\<^esub> n'' \\ \n n'' -as2\\\\<^sub>d* n' \\ as' = as1@as2\"\n by(cases asx) auto \n { fix V assume \"V \\ Use n\"\n with cdep `last(targetnodes as) = n'` `as = a'#as'`\n have \"(V,[],as) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_cdep)\n with all have \"state_val s V = state_val s' V\" by blast }\n with `valid_edge a'` `pred ex' s'`\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n next\n case (DynPDG_path_ddep_Append V n'' asx asx')\n from `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` obtain ai ais where \"asx = ai#ais\"\n by(cases asx)(auto dest:DynPDG_ddep_edge_CFG_path)\n with `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` have \"sourcenode ai = n\"\n by(fastforce dest:DynPDG_ddep_edge_CFG_path elim:path.cases)\n from `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` `asx = ai#ais`\n have \"last(targetnodes asx) = n''\"\n by(fastforce intro:path_targetnode dest:DynPDG_ddep_edge_CFG_path)\n { fix V' assume \"V' \\ Use n\"\n from `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` have \"(V,[],[]) \\ dependent_live_vars n''\"\n by(fastforce elim:DynPDG_edge.cases dep_vars_Use \n simp:dyn_data_dependence_def)\n with `n'' -asx'\\\\<^sub>d* n'` have \"(V,[],[]@asx') \\ dependent_live_vars n'\"\n by(rule dependent_live_vars_dep_dependent_live_vars)\n have \"(V',[],as) \\ dependent_live_vars n'\"\n proof(cases \"asx' = []\")\n case True\n with `n'' -asx'\\\\<^sub>d* n'` have \"n'' = n'\"\n by(fastforce intro:DynPDG_empty_path_eq_nodes)\n with `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` `V' \\ Use n` True `as = a'#as'`\n `a'#as' = asx@asx'`\n show ?thesis by(fastforce intro:dependent_live_vars_ddep_empty_fst)\n next\n case False\n with `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` `asx = ai#ais`\n `(V,[],[]@asx') \\ dependent_live_vars n'`\n have \"(V,ais@[],ais@asx') \\ dependent_live_vars n'\"\n by(fastforce intro:ddep_dependent_live_vars_keep_notempty)\n from `n'' -asx'\\\\<^sub>d* n'` False have \"last(targetnodes asx') = n'\"\n by -(rule path_targetnode,rule DynPDG_path_CFG_path)\n with `(V,ais@[],ais@asx') \\ dependent_live_vars n'`\n `V' \\ Use n` `n -{V}asx\\\\<^bsub>dd\\<^esub> n''` `asx = ai#ais`\n `sourcenode ai = n` `last(targetnodes asx) = n''` False\n have \"(V',[],ai#ais@asx') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_ddep simp:targetnodes_def)\n with `asx = ai#ais` `a'#as' = asx@asx'` `as = a'#as'`\n show ?thesis by simp\n qed\n with all have \"state_val s V' = state_val s' V'\" by blast }\n with `pred ex' s'` `valid_edge a'`\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n qed\n qed\n qed simp\n with all' `preds esx (transfer ex s)` `es = ex#esx` `es' = ex'#esx'`\n show ?thesis by simp\n next\n case False\n then obtain V' xs' where \"(V',xs',as') \\ dependent_live_vars n'\"\n and \"state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\"\n by auto\n show ?thesis\n proof(cases \"n -a'#as'\\\\<^sub>d* n'\")\n case True\n with `slice_path as = x#xs` `as = a'#as'` `last(targetnodes as) = n'` ex\n have [simp]:\"ex = kind a'\" by clarsimp\n with `x \\ y` ex ex' have [simp]:\"ex' = ex\" by(cases x) auto\n { fix V assume \"V \\ Use (sourcenode a')\"\n hence \"(V,[],[]) \\ dependent_live_vars (sourcenode a')\"\n by(rule dep_vars_Use)\n with `n -a'#as'\\\\<^sub>d* n'` have \"(V,[],[]@a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dependent_live_vars_dep_dependent_live_vars)\n with all `as = a'#as'` have \"state_val s V = state_val s' V\"\n by fastforce }\n with `pred ex' s'` `valid_edge a'` have \"pred ex s\"\n by(fastforce intro:CFG_edge_Uses_pred_equal)\n show ?thesis\n proof(cases \"V' \\ Def n\")\n case True\n with `state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'`\n `valid_edge a'` `pred ex' s'` `pred ex s`\n CFG_edge_transfer_uses_only_Use[of a' s s']\n obtain V'' where \"V'' \\ Use n\"\n and \"state_val s V'' \\ state_val s' V''\"\n by auto\n from True `(V',xs',as') \\ dependent_live_vars n'`\n `targetnode a' -as'\\* n'` `last(targetnodes as) = n'` `as = a'#as'`\n `valid_edge a'` `n = sourcenode a'`[THEN sym]\n have \"n -{V'}a'#xs'\\\\<^bsub>dd\\<^esub> last(targetnodes (a'#xs'))\"\n by -(drule dependent_live_vars_dependent_edge,\n auto dest!: dependent_live_vars_dependent_edge \n dest:DynPDG_ddep_edge_CFG_path path_targetnode \n simp del:`n = sourcenode a'`)\n with `(V',xs',as') \\ dependent_live_vars n'` `V'' \\ Use n`\n `last(targetnodes as) = n'` `as = a'#as'`\n have \"(V'',[],as) \\ dependent_live_vars n'\" \n by(fastforce intro:dep_vars_Cons_ddep)\n with all have \"state_val s V'' = state_val s' V''\" by blast\n with `state_val s V'' \\ state_val s' V''` have False by simp\n thus ?thesis by simp\n next\n case False\n with `valid_edge a'` `pred ex s`\n have \"state_val (transfer (kind a') s) V' = state_val s V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n moreover\n from False `valid_edge a'` `pred ex' s'`\n have \"state_val (transfer (kind a') s') V' = state_val s' V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n ultimately have \"state_val s V' \\ state_val s' V'\"\n using `state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'`\n by simp\n from False have \"\\ n -{V'}a'#xs'\\\\<^bsub>dd\\<^esub> \n last(targetnodes (a'#xs'))\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with `(V',xs',as') \\ dependent_live_vars n'` `last(targetnodes as) = n'`\n `as = a'#as'`\n have \"(V',a'#xs',a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with `as = a'#as'` all have \"state_val s V' = state_val s' V'\" by auto\n with `state_val s V' \\ state_val s' V'` have False by simp\n thus ?thesis by simp\n qed\n next\n case False\n { assume \"V' \\ Def n\"\n with `(V',xs',as') \\ dependent_live_vars n'` `targetnode a' -as'\\* n'`\n `valid_edge a'`\n have \"n -a'#as'\\\\<^sub>d* n'\"\n by -(drule dependent_live_vars_dependent_edge,\n auto dest:DynPDG_path_ddep DynPDG_path_Append)\n with False have \"False\" by simp }\n hence \"V' \\ Def (sourcenode a')\" by fastforce\n from False `slice_path as = x#xs` `as = a'#as'`\n `last(targetnodes as) = n'` `as' \\ []`\n have \"\\ x\" by(auto simp:targetnodes_def)\n with ex have cases:\"ex = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n have \"state_val s V' \\ state_val s' V'\"\n proof(cases y)\n case True\n with ex' have [simp]:\"ex' = kind a'\" by simp\n from `V' \\ Def (sourcenode a')` `valid_edge a'` `pred ex' s'`\n have states_eq:\"state_val (transfer (kind a') s') V' = state_val s' V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n from cases have \"state_val s V' = state_val (transfer ex s) V'\"\n by(cases \"kind a'\") auto\n with states_eq\n `state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'`\n show ?thesis by simp\n next\n case False\n with ex' have \"ex' = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n with cases have \"state_val s V' = state_val (transfer ex s) V'\"\n and \"state_val s' V' = state_val (transfer ex' s') V'\"\n by(cases \"kind a'\",auto)+\n with `state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'` \n show ?thesis by simp\n qed\n from `V' \\ Def (sourcenode a')` \n have \"\\ n -{V'}a'#xs'\\\\<^bsub>dd\\<^esub> last(targetnodes (a'#xs'))\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with `(V',xs',as') \\ dependent_live_vars n'` `last(targetnodes as) = n'`\n `as = a'#as'`\n have \"(V',a'#xs',a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with `as = a'#as'` all have \"state_val s V' = state_val s' V'\" by auto\n with `state_val s V' \\ state_val s' V'` have False by simp\n thus ?thesis by simp\n qed\n qed\n qed\nqed simp_all\n\n\ntheorem fundamental_property_of_path_slicing:\n assumes \"n -as\\* n'\" and \"preds (kinds as) s\"\n shows \"(\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V = \n state_val (transfers (kinds as) s) V)\" \n and \"preds (slice_kinds as) s\"\nproof -\n have \"length as = length (slice_path as)\" by(simp add:slice_path_length)\n hence \"slice_path as \\\\<^sub>b replicate (length as) True\"\n by(simp add:maximal_element)\n have \"select_edge_kinds as (replicate (length as) True) = kinds as\"\n by(rule select_edge_kinds_max_bv)\n with `n -as\\* n'` `slice_path as \\\\<^sub>b replicate (length as) True`\n `preds (kinds as) s` \n have \"(\\V\\Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V) \\ preds (slice_kinds as) s\"\n by -(rule slice_path_leqs_information_same_Uses,simp_all add:slice_kinds_def)\n thus \"\\V\\Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V\" and \"preds (slice_kinds as) s\"\n by simp_all\nqed\n\nend\n\n\nsubsection {* The fundamental property of (dynamic) slicing related to the semantics *}\n\nlocale BackwardPathSlice_wf = \n DynPDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n dyn_control_dependence +\n CFG_semantics_wf sourcenode targetnode kind valid_edge Entry sem identifies\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and dyn_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\" \n (\"_ controls _ via _\" [51, 0, 0] 1000)\n and Exit :: \"'node\" (\"'('_Exit'_')\") \n and sem :: \"'com \\ 'state \\ 'com \\ 'state \\ bool\" \n (\"((1\\_,/_\\) \\/ (1\\_,/_\\))\" [0,0,0,0] 81)\n and identifies :: \"'node \\ 'com \\ bool\" (\"_ \\ _\" [51, 0] 80) \n\nbegin\n\ntheorem fundamental_property_of_path_slicing_semantically:\n assumes \"n \\ c\" and \"\\c,s\\ \\ \\c',s'\\\"\n obtains n' as where \"n -as\\* n'\" and \"preds (slice_kinds as) s\" \n and \"n' \\ c'\" \n and \"\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V = \n state_val s' V\"\nproof(atomize_elim)\n from `n \\ c` `\\c,s\\ \\ \\c',s'\\` obtain n' as where \"n -as\\* n'\"\n and \"transfers (kinds as) s = s'\"\n and \"preds (kinds as) s\"\n and \"n' \\ c'\"\n by(fastforce dest:fundamental_property)\n with `n -as\\* n'` `preds (kinds as) s` \n have \"\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V\" and \"preds (slice_kinds as) s\"\n by -(rule fundamental_property_of_path_slicing,simp_all)+\n with `transfers (kinds as) s = s'` have \"\\V \\ Use n'. \n state_val (transfers (slice_kinds as) s) V =\n state_val s' V\" by simp\n with `n -as\\* n'` `preds (slice_kinds as) s` `n' \\ c'`\n show \"\\as n'. n -as\\* n' \\ preds (slice_kinds as) s \\ n' \\ c' \\\n (\\V\\Use n'. state_val (transfers (slice_kinds as) s) V = state_val s' V)\"\n by blast\nqed\n\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/Dynamic/DynSlice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863695, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.28951001779224994}} {"text": "theory flash11Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Put2VsInv11: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv11: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv11: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv11 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash11Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2893892597040113}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory PackedTypes\nimports \"Word_Lib.WordSetup\" CProof\nbegin\n\nsection \\Underlying definitions for the class axioms\\\n\ntext \\field_access / field_update is the identity for packed types\\\n\ndefinition fa_fu_idem :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext \\field_access is independent of the underlying bytes\\\n\ndefinition fa_heap_indep :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection \\Lemmas about td_fafu_idem\\\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: if_split_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover\n have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover\n have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have updeq:\n \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n by (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n using mlt nlex xln lbs lbs' wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply (cases p')\n apply (simp split: if_split_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using \\field_lookup_list (p' # ts') f 0 = Some (s, n)\\ by (simp split: option.splits)\nqed (clarsimp split: if_split_asm)+\n\nsubsection \\td_fa_hi\\\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"(@)\"])\n apply (erule Cons_typ_desc.hyps; simp)\n apply (erule Cons_typ_desc.hyps; simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection \\Simp rules for deriving packed props from the type combinators\\\n\nsubsection \\td_fafu_idem\\\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fafu_idem_list_append)\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\\n field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply (rule iffI)\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self; simp)\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\\n fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\ td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\\n td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def)\n (simp add: td_fafu_idem_ti_typ_combine)\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp: typ_info_array array_tag_def fa_fu_idem_def td_fafu_idem_array_n)\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection \\td_fa_hi\\\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append)\n\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm\n have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def Let_def using tda tds\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append td_fa_hi_adjust_ti[OF fg wf_fd])\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def td_fa_hi_ti_typ_combine)\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def td_fa_hi_array_n)\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection \\The type class and simp sets\\\n\ntext \\Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity\\\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n \\ \\Axioms\\\n td_fafu_idem\n \\ \\Combinators\\\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n \\ \\Constructors\\\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n \\ \\Axioms\\\n td_fa_hi\n \\ \\Combinators\\\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n \\ \\Constructors\\\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection \\Instances\\\n\ntext \\Words (of multiple of 8 size) are packed\\\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n by (intro_classes; rule td_fafu_idem_word td_fa_hi_word)\nend\n\ntext \\Pointers are always packed\\\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n by (intro_classes; simp add: fa_fu_idem_def word_rsplit_rcat_size word_size fa_heap_indep_def)\nend\n\ntext \\Arrays of packed types are in turn packed\\\n\nclass array_outer_packed = packed_type + array_outer_max_size\nclass array_inner_packed = array_outer_packed + array_inner_max_size\n\ninstance word :: (len8)array_outer_packed ..\ninstance word :: (len8)array_inner_packed ..\n\ninstance array :: (array_outer_packed, array_max_count) packed_type\n by (intro_classes; simp add: td_fafu_idem_intro_simps td_fa_hi_intro_simps)\n\ninstance array :: (array_inner_packed, array_max_count) array_outer_packed ..\n\nsection \\Theorems about packed types\\\n\nsubsection \\td_fa_hi\\\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows \"heap_update p v (heap_update p u h) = heap_update p v h\"\n unfolding heap_update_def\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: heap_update_mem_same_point)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence, simp)\n prefer 2\n apply(rule refl)\n apply(simp)\n apply(simp add: heap_update_nmem_same)\n done\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp) =\n hrs_mem_update (heap_update p v) hp\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection \\td_fafu_idem\\\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right; assumption?)\n apply (rule of_nat_mono_maybe_le; simp)\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def\n by (rule heap_independence; simp add: lbs size_of_def)\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n show ?case\n proof (cases n')\n case 0 thus ?thesis using \\Suc m' < n'\\ by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using \\Suc m' < n'\\ by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: addr_bitsize word) = n\" using szn szb\n by (simp add: nat_less_le unat_of_nat_eq)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n by (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n apply -\n apply (drule c_guard_no_wrap)\n apply (simp add: std)\n done\n\n have szt': \"size_td t < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (subst std)\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n from xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n by (rule intvl_le_lower)\n next\n from szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: addr_bitsize word)\"\n apply -\n apply (rule of_nat_mono_maybe_le)\n apply simp_all\n done\n with al show \"ptr_val p \\ ptr_val p + of_nat n\"\n by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n by (simp add: word_le_nat_alt uofn)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (drule (2) intvl_less_upper)\n apply (simp add: add.assoc)\n done\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n apply -\n apply (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n apply (metis (hide_lams, mono_tags) add.commute of_nat_add)\n apply (erule (2) intvl_le_lower)\n done\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: addr_bitsize word) = n + size_td t - 1\"\n using t0 order_le_less_trans [OF szt1 szb]\n apply (subst Abs_fnat_homs(1))\n apply (subst unat_of_nat)\n apply simp\n done\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n by (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n by simp\n\n show \"td_fafu_idem t\"\n by (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n by (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n by (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n by (simp add: unat_sub [OF ofn] uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n by simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n (update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n have \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n proof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n by (subst add.commute, rule intvl_less_upper)\n show \"ptr_val p \\ x\" using xin al szb\n by (rule intvl_le_lower)\n qed\n thus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n by (simp add: word_le_nat_alt size_of_def unat_of_nat)\n\n show \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (erule intvl_cut)\n apply simp\n apply (rule max_size)\n done\n\n show \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n (* clag *)\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n apply (subst heap_list_nth)\n apply (rule unx)\n apply simp\n done\n\n thus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n unfolding h_val_def\n by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nsubsection \\Proof automation for packed types\\\n\ndefinition td_packed :: \"'a field_desc typ_desc \\ nat \\ nat \\ bool\"\n where \"td_packed t sz al \\\n td_fafu_idem t \\ td_fa_hi t \\ aggregate t \\ size_td t = sz \\ align_td t = al\"\n\nlemma packed_type_class_intro:\n \"td_packed (typ_info_t TYPE('a::mem_type)) s a\n \\ OFCLASS('a::mem_type, packed_type_class)\"\n by standard (simp_all add: td_packed_def)\n\nlemma td_packed_final_pad:\n \"\\td_packed t s a; 2 ^ a dvd s\\ \\ td_packed (final_pad t) s a\"\n by (simp add: padup_dvd [symmetric] td_packed_def final_pad_def)\n\nlemma td_packed_ti_typ_combine:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_combine TYPE('b) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)))\n (max a (align_td (typ_info_t TYPE('b))))\"\n unfolding td_packed_def\n apply safe\n apply (rule td_fafu_idem_ti_typ_combine; assumption?)\n apply (rule td_fafu_idem)\n apply (rule td_fa_hi_ti_typ_combine; assumption?)\n apply (rule td_fa_hi)\n apply simp\n apply (simp only: size_td_lt_ti_typ_combine)\n apply (simp only: align_of_ti_typ_combine)\n done\n\nlemma td_packed_ti_typ_pad_combine:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_pad_combine TYPE('b) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)))\n (max a (align_td (typ_info_t TYPE('b))))\"\n apply (subgoal_tac \"padup (align_of TYPE('b)) (size_td td) = 0\")\n apply (simp add: ti_typ_pad_combine_def Let_def td_packed_ti_typ_combine)\n apply (simp add: align_of_def padup_dvd td_packed_def)\n done\n\nlemma td_packed_ti_typ_combine_array:\n \"\\td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu\\\n \\ td_packed\n (ti_typ_combine TYPE('b ['n :: finite]) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)) * CARD('n))\n (max a (align_td (typ_info_t TYPE('b))))\"\n by (clarsimp simp: ti_typ_combine_def td_packed_def\n packed_type_intro_simps td_fafu_idem_extend_ti\n td_fa_hi_extend_ti td_fa_hi_adjust_ti\n size_td_extend_ti size_of_def\n td_fafu_idem_adjust_ti)\n\nlemma td_packed_ti_typ_pad_combine_array:\n \"\\ td_packed (td::'a::c_type field_desc typ_desc) s a;\n align_of TYPE('b::packed_type) dvd s; fg_cons xf xfu \\\n \\ td_packed (ti_typ_pad_combine TYPE('b ['n :: finite]) xf xfu nm td)\n (s + size_td (typ_info_t TYPE('b)) * CARD('n))\n (max a (align_td (typ_info_t TYPE('b))))\"\n apply (subgoal_tac \"padup (align_of TYPE('b['n])) (size_td td) = 0\")\n apply (simp add: ti_typ_pad_combine_def Let_def)\n apply (simp add: td_packed_ti_typ_combine_array)\n apply (simp add: align_of_def padup_dvd td_packed_def align_td_array)\n done\n\nlemma td_packed_empty_typ_info:\n \"td_packed (empty_typ_info fn) 0 0\"\n apply (unfold td_packed_def, safe)\n apply (rule td_fafu_idem_empty_typ_info)\n apply (rule td_fa_hi_empty_typ_info)\n apply (rule aggregate_empty_typ_info)\n apply (rule size_td_empty_typ_info)\n apply (rule align_of_empty_typ_info)\n done\n\nlemmas td_packed_intros =\n td_packed_final_pad\n td_packed_empty_typ_info\n td_packed_ti_typ_combine\n td_packed_ti_typ_pad_combine\n td_packed_ti_typ_combine_array\n td_packed_ti_typ_pad_combine_array\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.28938232119177065}} {"text": "section {* \\isaheader{Generic Map To Set Converter} *}\ntheory Gen_Map2Set\nimports \n \"../Intf/Intf_Map\"\n \"../Intf/Intf_Set\"\n \"../Intf/Intf_Comp\"\n \"../../Iterator/Iterator\"\nbegin\n\nlemma map_fst_unit_distinct_eq[simp]:\n fixes l :: \"('k\\unit) list\"\n shows \"distinct (map fst l) \\ distinct l\"\n by (induct l) auto\n\ndefinition \n map2set_rel :: \"\n (('ki\\'k) set \\ (unit\\unit) set \\ ('mi\\('k\\unit))set) \\ \n ('ki\\'k) set \\ \n ('mi\\('k set)) set\"\n where \n map2set_rel_def_internal: \n \"map2set_rel R Rk \\ \\Rk,Id::(unit\\_) set\\R O {(m,dom m)| m. True}\"\n\nlemma map2set_rel_def: \"\\Rk\\(map2set_rel R) \n = \\Rk,Id::(unit\\_) set\\R O {(m,dom m)| m. True}\"\n unfolding map2set_rel_def_internal[abs_def] by (simp add: relAPP_def)\n\nlemma map2set_relI:\n assumes \"(s,m')\\\\Rk,Id\\R\" and \"s'=dom m'\"\n shows \"(s,s')\\\\Rk\\map2set_rel R\"\n using assms unfolding map2set_rel_def by blast\n\nlemma map2set_relE:\n assumes \"(s,s')\\\\Rk\\map2set_rel R\"\n obtains m' where \"(s,m')\\\\Rk,Id\\R\" and \"s'=dom m'\"\n using assms unfolding map2set_rel_def by blast\n\nlemma map2set_rel_sv[relator_props]:\n \"single_valued (\\Rk,Id\\Rm) \\ single_valued (\\Rk\\map2set_rel Rm)\"\n unfolding map2set_rel_def\n by (auto intro: single_valuedI dest: single_valuedD)\n\nlemma map2set_empty[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP e op_map_empty (\\Rk,Id\\R)\"\n shows \"(e,{})\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by auto\n\nlemmas [autoref_rel_intf] = \n REL_INTFI[of \"map2set_rel R\" i_set] for R\n\n\ndefinition \"map2set_insert i k s \\ i k () s\"\nlemma map2set_insert[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP i op_map_update (Rk \\ Id \\ \\Rk,Id\\R \\ \\Rk,Id\\R)\"\n shows \n \"(map2set_insert i,Set.insert)\\Rk\\\\Rk\\map2set_rel R \\ \\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def map2set_insert_def[abs_def]\n by (force dest: fun_relD)\n\ndefinition \"map2set_memb l k s \\ case l k s of None \\ False | Some _ \\ True\"\nlemma map2set_memb[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP l op_map_lookup (Rk \\ \\Rk,Id\\R \\ \\Id\\option_rel)\"\n shows \"(map2set_memb l ,op\\)\n \\ Rk\\\\Rk\\map2set_rel R\\Id\"\n using assms\n unfolding map2set_rel_def map2set_memb_def[abs_def]\n by (force dest: fun_relD split: option.splits)\n \nlemma map2set_delete[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP d op_map_delete (Rk\\\\Rk,Id\\R\\\\Rk,Id\\R)\"\n shows \"(d,op_set_delete)\\Rk\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by (force dest: fun_relD)\n\nlemma map2set_to_sorted_list[autoref_ga_rules]:\n fixes it :: \"'m \\ ('k\\unit) list\"\n assumes A: \"GEN_ALGO_tag (is_map_to_sorted_list ordR Rk Id R it)\"\n shows \"is_set_to_sorted_list ordR Rk (map2set_rel R) \n (it_to_list (map_iterator_dom o (foldli o it)))\"\nproof -\n { \n fix l::\"('k\\unit) list\"\n have \"\\l0. foldli l (\\_. True) (\\x \\. \\ @ [fst x]) l0 = l0@map fst l\"\n by (induct l) auto\n }\n hence S: \"it_to_list (map_iterator_dom o (foldli o it)) = map fst o it\"\n unfolding it_to_list_def[abs_def] map_iterator_dom_def[abs_def]\n set_iterator_image_def set_iterator_image_filter_def\n by (auto)\n show ?thesis\n unfolding S\n using assms\n unfolding is_map_to_sorted_list_def is_set_to_sorted_list_def\n apply clarsimp\n apply (erule map2set_relE)\n apply (drule spec, drule spec)\n apply (drule (1) mp)\n apply (elim exE conjE)\n apply (rule_tac x=\"map fst l'\" in exI)\n apply (rule conjI)\n apply parametricity\n\n unfolding it_to_sorted_list_def\n apply (simp add: map_to_set_dom)\n apply (simp add: sorted_by_rel_map key_rel_def[abs_def])\n done\nqed\n\nlemma map2set_to_list[autoref_ga_rules]:\n fixes it :: \"'m \\ ('k\\unit) list\"\n assumes A: \"GEN_ALGO_tag (is_map_to_list Rk Id R it)\"\n shows \"is_set_to_list Rk (map2set_rel R) \n (it_to_list (map_iterator_dom o (foldli o it)))\"\n using assms unfolding is_set_to_list_def is_map_to_list_def\n by (rule map2set_to_sorted_list)\n\n\n(*lemma map2set_it_simp[iterator_simps]:\n \"foldli ((map fst o it) x) c f s = foldli (it x) c (\\(k,v) s. f k s) s\" \n by (simp add: foldli_map comp_def fn_fst_conv)\n*)\n\ntext {* Transfering also non-basic operations results in specializations\n of map-algorithms to also be used for sets *}\nlemma map2set_union[autoref_rules_raw]:\n assumes \"MINOR_PRIO_TAG (- 9)\"\n assumes \"GEN_OP u op ++ (\\Rk,Id\\R\\\\Rk,Id\\R\\\\Rk,Id\\R)\"\n shows \"(u,op \\)\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by (force dest: fun_relD)\n\nlemmas [autoref_ga_rules] = cmp_unit_eq_linorder \nlemmas [autoref_rules_raw] = param_cmp_unit\n\nlemma cmp_lex_zip_unit[simp]:\n \"cmp_lex (cmp_prod cmp cmp_unit) (map (\\k. (k, ())) l)\n (map (\\k. (k, ())) m) =\n cmp_lex cmp l m\"\n apply (induct cmp l m rule: cmp_lex.induct)\n apply (auto split: comp_res.split)\n done\n\nlemma cmp_img_zip_unit[simp]:\n \"cmp_img (\\m. map (\\k. (k,())) (f m)) (cmp_lex (cmp_prod cmp1 cmp_unit))\n = cmp_img f (cmp_lex cmp1)\"\n unfolding cmp_img_def[abs_def]\n apply (intro ext)\n apply simp\n done\n\n(* TODO: Move *)\n\nlemma map2set_finite[relator_props]:\n assumes \"finite_map_rel (\\Rk,Id\\R)\"\n shows \"finite_set_rel (\\Rk\\map2set_rel R)\"\n using assms\n unfolding map2set_rel_def finite_set_rel_def finite_map_rel_def\n by auto\n\nlemma map2set_cmp[autoref_rules_raw]:\n assumes ELO: \"SIDE_GEN_ALGO (eq_linorder cmpk)\"\n assumes MPAR:\n \"GEN_OP cmp (cmp_map cmpk cmp_unit) (\\Rk,Id\\R \\ \\Rk,Id\\R \\ Id)\"\n assumes FIN: \"PREFER finite_map_rel (\\Rk, Id\\R)\"\n shows \"(cmp,cmp_set cmpk)\\\\Rk\\map2set_rel R \\ \\Rk\\map2set_rel R \\ Id\"\nproof -\n interpret linorder \"comp2le cmpk\" \"comp2lt cmpk\"\n using ELO by (simp add: eq_linorder_class_conv)\n\n show ?thesis\n using MPAR\n unfolding cmp_map_def cmp_set_def\n apply simp\n apply parametricity\n apply (drule cmp_extend_paramD)\n apply (insert FIN, fastforce simp add: finite_map_rel_def) []\n apply (simp add: sorted_list_of_map_def[abs_def])\n apply (auto simp: map2set_rel_def cmp_img_def[abs_def] dest: fun_relD) []\n\n apply (insert map2set_finite[OF FIN[unfolded autoref_tag_defs]],\n fastforce simp add: finite_set_rel_def)\n done\nqed\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/GenCF/Gen/Gen_Map2Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.28937793727907074}} {"text": "(* Title: JinjaThreads/MM/MM.thy\n Author: Andreas Lochbihler\n*)\n\nchapter \\Memory Models\\\n\ntheory MM\nimports\n \"../Common/Heap\"\nbegin\n\ntype_synonym addr = nat\ntype_synonym thread_id = addr\n\nabbreviation (input) \n addr2thread_id :: \"addr \\ thread_id\"\nwhere \"addr2thread_id \\ \\x. x\"\n\nabbreviation (input)\n thread_id2addr :: \"thread_id \\ addr\"\nwhere \"thread_id2addr \\ \\x. x\"\n\ninstantiation nat :: addr begin\ndefinition \"hash_addr \\ int\"\ndefinition \"monitor_finfun_to_list \\ (finfun_to_list :: nat \\f nat \\ nat list)\"\ninstance\nby(intro_classes)(simp add: monitor_finfun_to_list_nat_def)\nend\n\ndefinition new_Addr :: \"(addr \\ 'b) \\ addr option\"\nwhere \"new_Addr h \\ if \\a. h a = None then Some(LEAST a. h a = None) else None\"\n\nlemma new_Addr_SomeD:\n \"new_Addr h = Some a \\ h a = None\"\nby(auto simp add:new_Addr_def split:if_splits intro: LeastI)\n\nlemma new_Addr_SomeI:\n \"finite (dom h) \\ \\a. new_Addr h = Some a\"\nby(simp add: new_Addr_def) (metis finite_map_freshness infinite_UNIV_nat)\n\nsubsection \\Code generation\\\n\ndefinition gen_new_Addr :: \"(addr \\ 'b) \\ addr \\ addr option\"\nwhere \"gen_new_Addr h n \\ if \\a. a \\ n \\ h a = None then Some(LEAST a. a \\ n \\ h a = None) else None\"\n\nlemma new_Addr_code_code [code]:\n \"new_Addr h = gen_new_Addr h 0\"\nby(simp add: new_Addr_def gen_new_Addr_def)\n\nlemma gen_new_Addr_code [code]:\n \"gen_new_Addr h n = (if h n = None then Some n else gen_new_Addr h (Suc n))\"\napply(simp add: gen_new_Addr_def)\napply(rule impI)\napply(rule conjI)\n apply safe[1]\n apply(auto intro: Least_equality)[2]\n apply(rule arg_cong[where f=Least])\n apply(rule ext)\n apply auto[1]\n apply(case_tac \"n = ab\")\n apply simp\n apply simp\napply clarify\napply(subgoal_tac \"a = n\")\n apply simp\n apply(rule Least_equality)\n apply auto[2]\napply(rule ccontr)\napply(erule_tac x=\"a\" in allE)\napply simp\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/MM/MM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.289249323369957}} {"text": "(* \n Title: Psi-calculi \n Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weaken_Transition\n imports Weakening\nbegin\n\ncontext weak\nbegin\n\ndefinition weakenTransition :: \"'b \\ ('a, 'b, 'c) psi \\ 'a frame frame option \\ 'a action \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\_ @ _ \\ _\" [80, 80, 80, 80, 80] 80)\nwhere\n \"\\ \\ P \\\\ @ \\ \\ P' \\ (\\P''' P''. \\ \\ P \\\\<^sup>^\\<^sub>\\ P''' \\ \\ \\ P''' \\\\ @ \\ \\ P'' \\ \\ \\ P'' \\\\<^sup>^\\<^sub>\\ P') \\ (P = P' \\ \\ = \\)\"\n\nlemma weakenTransitionCases[consumes 1, case_names cBase cStep]:\n assumes \"\\ \\ P \\\\ @ \\ \\ P'\"\n and \"Prop (\\) \\ P\"\n and \"\\P''' P''. \\\\ \\ P \\\\<^sup>^\\<^sub>\\ P'''; \\ \\ P''' \\\\ @ \\ \\ P''; \\ \\ P'' \\\\<^sup>^\\<^sub>\\ P'\\ \\ Prop \\ \\ P'\"\n\n shows \"Prop \\ \\ P'\"\nusing assms\nby(auto simp add: weakenTransition_def)\n\nlemma statImpTauChainDerivative:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n\n shows \"insert_assertion (extract_frame P) \\ \\\\<^sub>F insert_assertion (extract_frame P') \\\"\nusing assms\nby(induct rule: tau_chain_induct) (auto intro: statImpTauDerivative dest: Frame_stat_imp_trans)\n\nlemma weakenTauChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n shows \"\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nusing assms\nproof(induct rule: tau_chain_induct)\n case(tau_base P)\n thus ?case by simp\nnext\n case(tau_step P P' P'')\n note `\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P'`\n moreover from `\\ \\ P' \\None @ \\ \\ P''` have \"\\ \\ \\' \\ P' \\None @ \\ \\ P''\" by(rule weakenTransition)\n ultimately show ?case by(auto dest: tau_act_tau_chain)\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weaken_Transition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710234, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.289249317420134}} {"text": "(* Title: JinjaThreads/MM/MM.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\chapter{Memory Models} *}\n\ntheory MM\nimports\n \"../Common/Heap\"\nbegin\n\ntype_synonym addr = nat\ntype_synonym thread_id = addr\n\nabbreviation (input) \n addr2thread_id :: \"addr \\ thread_id\"\nwhere \"addr2thread_id \\ \\x. x\"\n\nabbreviation (input)\n thread_id2addr :: \"thread_id \\ addr\"\nwhere \"thread_id2addr \\ \\x. x\"\n\ninstantiation nat :: addr begin\ndefinition \"hash_addr \\ int\"\ndefinition \"monitor_finfun_to_list \\ (finfun_to_list :: nat \\f nat \\ nat list)\"\ninstance\nby(intro_classes)(simp add: monitor_finfun_to_list_nat_def)\nend\n\ndefinition new_Addr :: \"(addr \\ 'b) \\ addr option\"\nwhere \"new_Addr h \\ if \\a. h a = None then Some(LEAST a. h a = None) else None\"\n\nlemma new_Addr_SomeD:\n \"new_Addr h = Some a \\ h a = None\"\nby(auto simp add:new_Addr_def split:if_splits intro: LeastI)\n\nlemma new_Addr_SomeI:\n \"finite (dom h) \\ \\a. new_Addr h = Some a\"\nby(simp add: new_Addr_def) (metis finite_map_freshness infinite_UNIV_nat)\n\nsubsection {* Code generation *}\n\ndefinition gen_new_Addr :: \"(addr \\ 'b) \\ addr \\ addr option\"\nwhere \"gen_new_Addr h n \\ if \\a. a \\ n \\ h a = None then Some(LEAST a. a \\ n \\ h a = None) else None\"\n\nlemma new_Addr_code_code [code]:\n \"new_Addr h = gen_new_Addr h 0\"\nby(simp add: new_Addr_def gen_new_Addr_def)\n\nlemma gen_new_Addr_code [code]:\n \"gen_new_Addr h n = (if h n = None then Some n else gen_new_Addr h (Suc n))\"\napply(simp add: gen_new_Addr_def)\napply(rule impI)\napply(rule conjI)\n apply safe[1]\n apply(auto intro: Least_equality)[2]\n apply(rule arg_cong[where f=Least])\n apply(rule ext)\n apply auto[1]\n apply(case_tac \"n = ab\")\n apply simp\n apply simp\napply clarify\napply(subgoal_tac \"a = n\")\n apply simp\n apply(rule Least_equality)\n apply auto[2]\napply(rule ccontr)\napply(erule_tac x=\"a\" in allE)\napply simp\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/MM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316860482762, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.28920169212391533}} {"text": "section {* Refinement calculus *}\n\ntheory utp_refcalc\n imports utp_designs\nbegin\n\nabbreviation spec_stat :: \"('\\ \\ '\\) \\ '\\ upred \\ '\\ upred \\ '\\ hrel_des\" where\n\"spec_stat w pre post \\ (pre \\\\<^sub>n w:[\\post\\\\<^sub>>])\"\n\nsyntax\n \"_spec_stat\" :: \"salpha \\ '\\ upred \\ '\\ upred \\ '\\ hrel_des\" (\"_:[_,_]\\<^sub>u\" [70,0,0] 70)\n\ntranslations\n \"_spec_stat w pre post\" \\ \"CONST spec_stat w pre post\"\n\nlemma rc_strengthen_post:\n assumes \"`post' \\ post`\"\n shows \"w:[pre, post]\\<^sub>u \\ w:[pre, post']\\<^sub>u\"\n using assms by (rel_auto)\n\nlemma rc_weaken_pre:\n assumes \"`pre \\ pre'`\"\n shows \"w:[pre, post]\\<^sub>u \\ w:[pre', post]\\<^sub>u\"\n using assms by (rel_auto)\n\nlemma rc_skip:\n assumes \"`pre \\ post`\"\n shows \"w:[pre, post]\\<^sub>u \\ II\\<^sub>D\"\n using assms by (rel_auto)\n\nlemma rc_seq:\n assumes \"vwb_lens w\"\n shows \"w:[pre, post]\\<^sub>u \\ w:[pre, mid]\\<^sub>u ;; w:[mid, post]\\<^sub>u\"\n using assms\n by (rel_auto, metis vwb_lens.put_eq)\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/theories/utp_refcalc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.28908008941461566}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ArraysMemInstance\nimports Arrays CompoundCTypes\nbegin\n\nprimrec\n array_tag_n :: \"nat \\ ('a::c_type,'b::finite) array typ_info\"\nwhere\n atn_base:\n \"array_tag_n 0 = ((empty_typ_info (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @\n nat_to_bin_string (CARD('b::finite))))::('a::c_type,'b) array\n typ_info)\"\n| atn_rec:\n \"array_tag_n (Suc n) = ((ti_typ_combine TYPE('a::c_type)\n (\\x. index x n) (\\x f. update f n x) (replicate n CHR ''1'')\n (array_tag_n n))::('a,'b::finite) array typ_info)\"\n\ndefinition\n array_tag :: \"('a::c_type,'b::finite) array itself \\ ('a,'b) array typ_info\" where\n \"array_tag t \\ array_tag_n (CARD('b))\"\n\ninstantiation array :: (c_type,finite) c_type\nbegin\ninstance ..\nend\n\ndefs (overloaded)\n typ_info_array: \"typ_info_t (w::('a::c_type,'b::finite) array itself) \\ array_tag w\"\n\nlemma field_names_array_tag_length [rule_format]:\n \"x \\ set (field_names_list (array_tag_n n)) \\ length x < n\"\napply(induct_tac n)\n apply simp\napply clarsimp\ndone\n\nlemma replicate_mem_field_names_array_tag [simp]:\n \"replicate n x \\ set (field_names_list (array_tag_n n))\"\napply clarsimp\napply(drule field_names_array_tag_length)\napply simp\ndone\n\nlemma aggregate_array_tag [simp]:\n \"aggregate (array_tag_n n)\"\napply(case_tac n)\n apply simp+\ndone\n\nlemma wf_desc_array_tag [simp]:\n \"wf_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp+\napply(erule wf_desc_ti_typ_combine)\napply simp\ndone\n\nlemma wf_size_desc_array_tag [simp, rule_format]:\n \"0 < n \\ wf_size_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct n)\n apply simp+\napply(case_tac \"n=0\")\n apply simp\napply(rule wf_size_desc_ti_typ_combine)\napply simp\ndone\n\nlemma g_ind_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n g_ind (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule g_ind_ti_typ_combine)\n apply clarsimp+\ndone\n\nlemma fc_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n fu_commutes (update_ti_t ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fc_ti_typ_combine)\n apply(clarsimp simp: fg_cons_def)\n apply clarsimp+\ndone\n\nlemma f_ind_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n f_ind (\\x. index x m) (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule f_ind_ti_typ_combine)\n apply clarsimp\napply simp\ndone\n\nlemma fa_fu_g_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n fa_ind (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fa_ind_ti_typ_combine)\napply clarsimp+\ndone\n\nlemma wf_fdp_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\\n wf_lf (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule wf_lf_ti_typ_combine)\n apply simp+\ndone\n\nlemma upd_local_update [simp]:\n \"upd_local (\\x f. update f n x)\"\napply(auto simp: upd_local_def)\napply(subst cart_eq)\napply clarsimp\napply(subst (asm) cart_eq)\napply(drule_tac x=i in spec)\napply clarsimp\napply(case_tac \"i=n\")\n apply simp+\ndone\n\nlemma fu_eq_mask_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\ (\\m. (\\k v. k < CARD('b) \\\n index ((m v)::('a,'b) array) k = (if n \\ k then\n index (undefined::('a::mem_type,'b::finite) array) k\n else index v k)) \\ fu_eq_mask (array_tag_n n) m)\"\napply(induct n)\n apply clarsimp\n apply(rule fu_eq_mask_empty_typ_info)\n apply clarsimp\n apply(subst cart_eq)\n apply simp\napply clarsimp\napply(rule fu_eq_mask_ti_typ_combine)\n apply(drule_tac x=\"\\v. update (m v) n (index undefined n)\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(drule_tac x=k in spec)\n apply clarsimp\n apply(case_tac \"k=n\")\n apply simp\n apply clarsimp\n apply(subgoal_tac \"\\v bs. m (update v n bs) = update (m v) n bs\")\n apply clarsimp+\n apply(subst cart_eq)\n apply clarsimp\n apply(drule_tac x=i in spec)\n apply clarsimp\n apply(case_tac \"i=n\")\n apply clarsimp+\n apply(frule_tac x=\"update v n bs\" in spec)\n apply(drule_tac x=\"v\" in spec)\n apply clarsimp\n apply(case_tac \"Suc n \\ i\")\n apply clarsimp+\n apply(clarsimp simp: fg_cons_def)\n apply(clarsimp)\n apply simp\ndone\n\nlemma size_td_array_tag [simp]:\n \"size_td (((array_tag_n n)::('a,'b::finite) array typ_info)) =\n n * size_of TYPE('a::c_type)\"\napply(induct_tac n)\n apply simp\napply simp\napply(simp add: size_td_lt_ti_typ_combine size_of_def)\ndone\n\nlemma align_td_array_tag [rule_format]:\n \"0 < n \\ align_td ((array_tag_n n)::('a,'b::finite) array typ_info) = (align_td (typ_info_t (TYPE('a::c_type))))\"\napply(induct_tac n)\n apply simp\napply(clarsimp simp: ti_typ_combine_def Let_def)\napply(case_tac \"n = 0\")\n apply(clarsimp simp: align_of_def max_def)+\ndone\n\nlemma align_field_array [simp]:\n \"align_field ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply(erule align_field_ti_typ_combine)\napply simp\napply(rule dvd_mult)\napply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp add: align_of_def)\napply(rule align_size_of)\ndone\n\ninstantiation array :: (mem_type,finite) mem_type_sans_size\nbegin\n\ninstance\napply intro_classes\n apply(simp_all add: typ_info_array array_tag_def size_of_def\n norm_bytes_def)\n\n apply clarsimp\n apply(rule fu_eq_mask)\n apply(simp add: size_of_def)\n apply(rule fu_eq_mask_array_tag)\n apply simp+\n\napply(clarsimp simp: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp\napply(rule dvd_trans)\n apply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp only: align_of_def)\n apply(rule align_size_of)\napply(simp add: size_of_def)\ndone\n\nend\n\ndeclare atn_base [simp del]\ndeclare atn_rec [simp del]\n\nlemma size_of_array [simp]:\n \"size_of TYPE(('a,'b::finite) array) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma size_td_array:\n \"size_td (typ_info_t TYPE(('a,'b::finite) array)) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma align_td_array:\n \"2^align_td (typ_info_t TYPE(('a,'b::finite) array)) = align_of TYPE('a::c_type)\"\napply(simp add: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp+\ndone\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass oneMB_size = mem_type +\n assumes oneMB_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 19\"\n\nclass fourthousand_count = finite +\n assumes fourthousand_count_ax: \"CARD ('a) <= 2 ^ 13\"\n\ninstantiation array :: (oneMB_size, fourthousand_count) mem_type\nbegin\n\ninstance\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ 13 * 2 ^ 19\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 19\"])\n apply (rule mult_less_mono2)\n apply (rule oneMB_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule fourthousand_count_ax)\n apply simp\napply (simp add: addr_card)\ndone\n\nend\n\nclass twoToSix_size = oneMB_size +\n assumes twoToSix_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstantiation array :: (twoToSix_size, fourthousand_count) oneMB_size\nbegin\n\ninstance\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule fourthousand_count_ax)\n apply (rule twoToSix_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\nend\n\ninstantiation word :: (len8) oneMB_size\nbegin\ninstance\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\nend\n\ninstantiation word :: (len8) twoToSix_size\nbegin\ninstance\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\nend\n\ninstantiation ptr :: (c_type) oneMB_size\nbegin\ninstance\napply intro_classes\napply (simp add: size_of_def)\ndone\nend\n\ninstantiation ptr :: (c_type) twoToSix_size\nbegin\ninstance\napply intro_classes\napply (simp add: size_of_def)\ndone\nend\n\nclass lt12 = finite +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 + \n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstantiation bit0 :: (lt12) fourthousand_count\nbegin\ninstance\n by (intro_classes, insert lt12_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt12) fourthousand_count\nbegin\ninstance\n by (intro_classes, insert lt12_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt11) lt12\nbegin\ninstance\n by (intro_classes, insert lt11_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt11) lt12\nbegin\ninstance\n by (intro_classes, insert lt11_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt10) lt11\nbegin\ninstance\n by (intro_classes, insert lt10_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt10) lt11\nbegin\ninstance\n by (intro_classes, insert lt10_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt9) lt10\nbegin\ninstance\n by (intro_classes, insert lt9_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt9) lt10\nbegin\ninstance\n by (intro_classes, insert lt9_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt8) lt9\nbegin\ninstance\n by (intro_classes, insert lt8_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt8) lt9\nbegin\ninstance\n by (intro_classes, insert lt8_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt7) lt8\nbegin\ninstance\n by (intro_classes, insert lt7_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt7) lt8\nbegin\ninstance\n by (intro_classes, insert lt7_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt6) lt7\nbegin\ninstance\n by (intro_classes, insert lt6_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt6) lt7\nbegin\ninstance\n by (intro_classes, insert lt6_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt5) lt6\nbegin\ninstance\n by (intro_classes, insert lt5_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt5) lt6\nbegin\ninstance\n by (intro_classes, insert lt5_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt4) lt5\nbegin\ninstance\n by (intro_classes, insert lt4_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt4) lt5\nbegin\ninstance\n by (intro_classes, insert lt4_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt3) lt4\nbegin\ninstance\n by (intro_classes, insert lt3_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt3) lt4\nbegin\ninstance\n by (intro_classes, insert lt3_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt2) lt3\nbegin\ninstance\n by (intro_classes, insert lt2_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt2) lt3\nbegin\ninstance\n by (intro_classes, insert lt2_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit0 :: (lt1) lt2\nbegin\ninstance\n by (intro_classes, insert lt1_ax[where 'a = 'a], simp)\nend\n\ninstantiation bit1 :: (lt1) lt2\nbegin\ninstance\n by (intro_classes, insert lt1_ax[where 'a = 'a], simp)\nend\n\ninstantiation num1 :: lt1\nbegin\ninstance \n by (intro_classes, simp_all)\nend\n\n(* don't understand why this also seems to be necessary *)\ninstantiation num1 :: fourthousand_count\nbegin\ninstance\n by (intro_classes, simp)\nend\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n fourthousand_count *)\ndatatype ty8192 = ty8192 \"8192\"\n\nlemma univ8192: \"(UNIV::ty8192 set) = image ty8192 (UNIV::8192 set)\"\napply (simp add: set_eq_iff image_iff)\napply (rule_tac allI)\napply (rule_tac ty8192.induct)\napply simp\ndone\n\ninstance \"ty8192\" :: finite\napply intro_classes\napply (simp add: univ8192)\ndone\n\nlemma card8192[simp]: \"CARD(ty8192) = CARD(8192)\"\napply (simp add: univ8192 card_image inj_on_def)\ndone\n\ninstance \"ty8192\" :: fourthousand_count\nby intro_classes simp\n\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/umm_heap/ArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.5039061705290806, "lm_q1q2_score": 0.2890800820688747}} {"text": "theory Channel_Type_Rep\n imports Executable_Universe\nbegin\n\ntext \\ There follows a class for representing channel types \\\n\nclass pre_uchantyperep =\n \\ \\ A mapping from channel names to types \\\n fixes uchans :: \"'a itself \\ (uname \\ utyp)\"\n\n assumes finite_chans: \"finite (pdom (uchans a))\"\n and nonempty_chans: \"\\ n. n \\ pdom (uchans a)\"\nbegin\n\ndefinition unames :: \"'a itself \\ uname set\" where\n\"unames a = pdom (uchans a)\"\n\nlemma finite_names: \"finite (unames a)\"\n by (simp add: local.finite_chans unames_def)\n\nlemma names_nonempty: \"unames a \\ {}\"\n using local.nonempty_chans unames_def by auto\n\ntext \\ The value carried over the channel \\\n \nend\n\ntypedef (overloaded) 'c::pre_uchantyperep name = \n \"{n. n \\ unames TYPE('c)}\"\n by (simp add: nonempty_chans unames_def)\n\n(* The following type should be isomorphic to 'c, but conveys more structure *)\n\ntypedef (overloaded) 'c::pre_uchantyperep event =\n \"{(n, v). n \\ unames TYPE('c) \\ utyp_of v = Some ((uchans TYPE('c))(n)\\<^sub>p)}\"\n morphisms of_event event_of\n using nonempty_chans unames_def utyp_of_default_uval by blast\n\nsetup_lifting type_definition_event\n\nlift_definition ev_name :: \"'c::pre_uchantyperep event \\ uname\" is fst .\ndefinition ev_type :: \"'c::pre_uchantyperep event \\ utyp\"\n where \"ev_type e = (uchans TYPE('c))(ev_name e)\\<^sub>p\"\nlift_definition ev_val :: \"'c::pre_uchantyperep event \\ 'a::uvals\" is \"from_uval \\ snd\" .\nlift_definition mk_event :: \"uname \\ 'a::uvals \\ 'c::pre_uchantyperep event\"\n is \"\\ n v. if (n \\ unames TYPE('c) \\ (uchans TYPE('c))(n)\\<^sub>p = UTYPE('a))\n then (n, to_uval v) \n else (let sn = SOME n. n \\ unames TYPE('c) in (sn, default_uval ((uchans TYPE('c))(sn)\\<^sub>p)))\"\n apply auto\n apply (metis nonempty_chans old.prod.inject someI unames_def)\n apply (metis fst_conv snd_conv utyp_of_default_uval)\n apply (metis nonempty_chans prod.inject someI unames_def)\n apply (metis fst_conv snd_conv utyp_of_default_uval)\n done\n\nlemma \n assumes \"UTYPE('a) = ev_type x\"\n shows \"mk_event (ev_name x) (ev_val x :: 'a::uvals) = x\"\n using assms\n apply (simp add: ev_val_def ev_type_def)\n apply (transfer)\n apply auto\n oops\n\n(*\ntype_synonym 'c chan = unit\n\ndefinition mk_chan :: \"'c name \\ ('a \\\\<^sub>\\ 'c) \\ 'c chan\" where\n\"mk_chan = undefined\"\n*)\n\n(* I want to achieve a type something like \"forall 'a\\unames. (('a, 'c) name, 'a \\\\<^sub>\\ 'c) *)\n\n\nclass uchantyperep = pre_uchantyperep +\n fixes uchan_mk :: \"'a event \\ 'a\"\n and uchan_dest :: \"'a \\ 'a event\"\n assumes \"uchan_dest (uchan_mk x) = x\"\n\nchantype chan = \n Input :: unit\n Output :: integer\n\ninstantiation chan :: pre_uchantyperep\nbegin\n\ndefinition uchans_chan :: \"chan itself \\ String.literal \\ utyp\"\n where \"uchans_chan x = {STR ''Input'' \\ UnitT, STR ''Output'' \\ IntT}\"\n\ninstance\n by (intro_classes, auto simp add: uchans_chan_def)\n\nend\n\n(*\ninstantiation chan :: uchantyperep\nbegin\n\ndefinition uchan_mk_chan :: \"chan event \\ chan\"\n where \"uchan_mk_chan e = (if (ev_name e = STR ''Input'') then Input_C (ev_val e)\n else Output_C (ev_val e))\"\n\nfun uchan_dest_chan :: \"chan \\ chan event\" where\n\"uchan_dest (Input_C v) = mk_event (STR ''Input'', to_uval v)\" |\n\"uchan_dest (Output_C v) = mk_event (STR ''Output'', to_uval v)\" \n\ninstance\n apply (intro_classes)\n apply (auto simp add: uchan_mk_chan_def)\n*)\n\ndatatype ('e, 'b) chf =\n ChanF (chf_chn: \"(uname \\ uval \\ uval \\\\<^sub>\\ 'e)\") \\ \\ The channel, including a name, output value, and input value \\\n (chf_out: \"uname \\ uval\") \\ \\ The value output by the process (displayed in the animator) \\\n (chf_typ: \"utyp\") \\ \\ The type of data requested by the animator \\\n (chf_cont: \"uval \\ 'b\") \\ \\ The continuation for each kind of value received \\\n\ndefinition pfun_of_chfun :: \n \"('e, 'b) chf \\ 'e \\ 'b\" where\n\"pfun_of_chfun chf = \n (\\ e\\{build\\<^bsub>chf_chn chf\\<^esub> (fst (chf_out chf), snd (chf_out chf), v) | v. v \\ uvals (chf_typ chf)} \n \\ (chf_cont chf) (snd (snd (the (match\\<^bsub>chf_chn chf\\<^esub> e)))))\"\n\ndefinition\n \"map_chfun f chf = ChanF (chf_chn chf) (chf_out chf) (chf_typ chf) (f \\ chf_cont chf)\"\n\nlemma map_pfun_pfun_of_chfun: \n \"map_pfun f (pfun_of_chfun chf) = pfun_of_chfun (map_chfun f chf)\"\n by (simp add: map_chfun_def pfun_of_chfun_def pfun_eq_iff)\n\nlemma \"pfun_app (pfun_of_chfun chf) e = undefined\"\n apply (simp add: pfun_of_chfun_def)\n apply (subst pabs_apply)\n apply simp\n oops\n\ndefinition pfun_of_chfuns ::\n \"('e, 'b) chf list \\ 'e \\ 'b\" where\n\"pfun_of_chfuns chfs = foldr (\\ c f. pfun_of_chfun c \\ f) chfs {}\\<^sub>p\"\n\nlemma map_pfun_pfun_of_chfuns [code]:\n \"map_pfun f (pfun_of_chfuns chfs) = pfun_of_chfuns (map (map_chfun f) chfs)\"\n by (induct chfs, simp_all add: pfun_of_chfuns_def map_pfun_pfun_of_chfun)\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/simulation/Channel_Type_Rep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819591324418, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.28899014998573397}} {"text": "section \\Machine\\\ntext \\\n This theory describes the state of an abstract machine on which binary and assembly programs\n can be executed.\n\\\n\ntheory Machine\n imports Main \"HOL-Library.Word\" \"HOL-Library.Stream\"\nbegin\n\nsubsection \\Primitive Values\\\ntext \\Bits and bytes on which the abstract machine operates\\\n\ntype_synonym byte = \"8 word\"\ntype_synonym bytes = \"byte list\"\n\ntype_synonym addr = \"nat\"\n\nsubsection \\Machine State\\\n\nrecord state =\n state_rip :: \"addr\"\n state_mem :: \"addr \\ byte\"\n\ntype_synonym trace = \"state stream\"\n\nsubsection \\ISA\\\n\ntype_synonym instr = string\n\nlocale isa =\n fixes isa_instructions :: \"instr set\"\n and isa_encodings :: \"bytes set\"\n and isa_encode :: \"instr \\ bytes\"\n and isa_decode :: \"bytes \\ instr\"\n and isa_step_instr :: \"(instr \\ state \\ state) set\"\n assumes isa_encode_valid: \"\\ i \\ isa_instructions. \\ bs \\ isa_encodings. isa_encode i = Some bs \\ isa_decode bs = Some i\"\n and isa_decode_valid: \"\\ bs \\ isa_encodings. \\ i \\ isa_instructions. isa_encode i = Some bs \\ isa_decode bs = Some i\" \n\ncontext isa\nbegin\n\ndefinition isa_step_bytes :: \"(bytes \\ state \\ state) set\" where\n \"isa_step_bytes = { (bs, \\\\<^sub>1, \\\\<^sub>2). \\ i. Some i = isa_decode bs \\ (i, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_instr }\"\n\nlemma isa_encode_preserves_instr_semantics:\n assumes \"Some bs = isa_encode i\"\n and \"i \\ isa_instructions\"\n and \"(i, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_instr\"\n shows \"(bs, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_bytes\"\n using assms(1) assms(2) assms(3) isa_encode_valid isa_step_bytes_def by auto\n\nlemma isa_decode_preserves_instr_semantics:\n assumes \"Some i = isa_decode bs\"\n and \"(i, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_instr\"\n shows \"(bs, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_bytes\"\n using assms(1) assms(2) isa_step_bytes_def by auto\n\nlemma isa_encode_preserves_byte_semantics:\n assumes \"Some bs = isa_encode i\"\n and \"i \\ isa_instructions\"\n and \"(bs, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_bytes\"\n shows \"(i, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_instr\"\n using assms(1) assms(2) assms(3) isa_encode_valid isa_step_bytes_def by auto\n\nlemma isa_decode_preserves_byte_semantics:\n assumes \"Some i = isa_decode bs\"\n and \"(bs, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_bytes\"\n shows \"(i, \\\\<^sub>1, \\\\<^sub>2) \\ isa_step_instr\"\n by (smt (verit) assms(1) assms(2) curryI curry_case_prod isa_step_bytes_def mem_Collect_eq option.inject)\n\nend\n\nend", "meta": {"author": "proof-by-sledgehammer", "repo": "disassembly-and-decidability", "sha": "d57c82b789859dccfea06b4bc8c660d759b3a866", "save_path": "github-repos/isabelle/proof-by-sledgehammer-disassembly-and-decidability", "path": "github-repos/isabelle/proof-by-sledgehammer-disassembly-and-decidability/disassembly-and-decidability-d57c82b789859dccfea06b4bc8c660d759b3a866/Machine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.28890034460258746}} {"text": "theory SINVAR_DomainHierarchyNG_impl\nimports SINVAR_DomainHierarchyNG \"../TopoS_Interface_impl\"\nbegin\n\n\nsubsubsection {* SecurityInvariant DomainHierarchy List Implementation *}\n\ncode_identifier code_module SINVAR_DomainHierarchyNG_impl => (Scala) SINVAR_DomainHierarchyNG\n\nfun sinvar :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ bool\" where\n \"sinvar G nP = (\\ (s, r) \\ set (edgesL G). (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s))\"\n\n\nfun verify_globals :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ domainTree \\ bool\" where\n \"verify_globals G nP tree = (\\ v \\ set (nodesL G). \n case (nP v) of Unassigned \\ True | DN (level, trust) \\ valid_hierarchy_pos tree level\n )\"\n\n\n\n\ndefinition DomainHierarchyNG_offending_list:: \"'v list_graph \\ ('v \\ domainNameTrust) \\ ('v \\ 'v) list list\" where\n \"DomainHierarchyNG_offending_list G nP = (if sinvar G nP then\n []\n else \n [ [e \\ edgesL G. case e of (s,r) \\ \\ (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s) ] ])\"\n\n\n\nlemma \"DomainHierarchyNG.node_props P = \n (\\i. case node_properties P i of None \\ SINVAR_DomainHierarchyNG.default_node_properties | Some property \\ property)\"\nby(fact SecurityInvariant.node_props.simps[OF TopoS_DomainHierarchyNG, of \"P\"])\n\ndefinition \"NetModel_node_props P = (\\ i. (case (node_properties P) i of Some property \\ property | None \\ SINVAR_DomainHierarchyNG.default_node_properties))\"\n(*\n\n(*TODO does this work?*)\nlemma[code_unfold]: \"DomainHierarchyNG.node_props P = NetModel_node_props P\"\nby(simp add: NetModel_node_props_def)\n\ndefinition \"DomainHierarchyNG_eval G P = (valid_list_graph G \\ \n verify_globals G (SecurityInvariant.node_props SINVAR_DomainHierarchyNG.default_node_properties P) (model_global_properties P) \\ \n sinvar G (SecurityInvariant.node_props SINVAR_DomainHierarchyNG.default_node_properties P))\"\n\n\ninterpretation DomainHierarchyNG_impl:TopoS_List_Impl \n where default_node_properties=SINVAR_DomainHierarchyNG.default_node_properties\n and sinvar_spec=SINVAR_DomainHierarchyNG.sinvar\n and sinvar_impl=sinvar\n and verify_globals_spec=SINVAR_DomainHierarchyNG.verify_globals\n and verify_globals_impl=verify_globals\n and receiver_violation=SINVAR_DomainHierarchyNG.receiver_violation\n and offending_flows_impl=DomainHierarchyNG_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=DomainHierarchyNG_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(simp add: TopoS_DomainHierarchyNG list_graph_to_graph_def)\n apply(rule conjI)\n apply(simp add: list_graph_to_graph_def DomainHierarchyNG_offending_set DomainHierarchyNG_offending_set_def DomainHierarchyNG_offending_list_def)\n apply(rule conjI)\n apply(simp only: NetModel_node_props_def)\n apply(metis DomainHierarchyNG.node_props.simps DomainHierarchyNG.node_props_eq_node_props_formaldef)\n apply(simp only: DomainHierarchyNG_eval_def)\n apply(intro allI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_DomainHierarchyNG])\n apply(simp_all add: list_graph_to_graph_def)\ndone\n\n\nsubsubsection {* DomainHierarchyNG packing *}\n definition SINVAR_LIB_DomainHierarchyNG :: \"('v::vertex, domainNameTrust, domainTree) TopoS_packed\" where\n \"SINVAR_LIB_DomainHierarchyNG \\ \n \\ nm_name = ''DomainHierarchyNG'', \n nm_receiver_violation = SINVAR_DomainHierarchyNG.receiver_violation,\n nm_default = SINVAR_DomainHierarchyNG.default_node_properties, \n nm_sinvar = sinvar,\n nm_verify_globals = verify_globals,\n nm_offending_flows = DomainHierarchyNG_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = DomainHierarchyNG_eval\n \\\"\n interpretation SINVAR_LIB_DomainHierarchyNG_interpretation: TopoS_modelLibrary SINVAR_LIB_DomainHierarchyNG \n SINVAR_DomainHierarchyNG.sinvar SINVAR_DomainHierarchyNG.verify_globals\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_DomainHierarchyNG_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\n\n\n\n\n\ntext {*Examples:*}\ndefinition example_TUM_net :: \"vString list_graph\" where\n \"example_TUM_net \\ \\ nodesL=[TopoS_Vertices.V ''Gateway'', TopoS_Vertices.V ''LowerSVR'', TopoS_Vertices.V ''UpperSRV''], \n edgesL=[\n (TopoS_Vertices.V ''Gateway'',TopoS_Vertices.V ''LowerSVR''), (TopoS_Vertices.V ''Gateway'',TopoS_Vertices.V ''UpperSRV''), \n (TopoS_Vertices.V ''LowerSVR'', TopoS_Vertices.V ''Gateway''),\n (TopoS_Vertices.V ''UpperSRV'', TopoS_Vertices.V ''Gateway'')\n ] \\\"\nvalue \"valid_list_graph example_TUM_net\"\n\ndefinition example_TUM_config :: \"vString \\ domainNameTrust\" where\n \"example_TUM_config \\ ((\\ e. default_node_properties)\n (TopoS_Vertices.V ''Gateway'':= DN (''ACD''--''AISD''--Leaf, 1),\n TopoS_Vertices.V ''LowerSVR'':= DN (''ACD''--''AISD''--Leaf, 0),\n TopoS_Vertices.V ''UpperSRV'':= DN (''ACD''--Leaf, 0)\n ))\"\n\ndefinition example_TUM_hierarchy :: \"domainTree\" where\n\"example_TUM_hierarchy \\ (Department ''ACD'' [\n Department ''AISD'' []\n ])\"\n\nvalue \"verify_globals example_TUM_net example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net example_TUM_config\"\n\ndefinition example_TUM_net_invalid where\n\"example_TUM_net_invalid \\ example_TUM_net\\edgesL := \n (TopoS_Vertices.V ''LowerSRV'', TopoS_Vertices.V ''UpperSRV'')#(edgesL example_TUM_net)\\\"\n\nvalue \"verify_globals example_TUM_net_invalid example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net_invalid example_TUM_config\"\nvalue \"DomainHierarchyNG_offending_list example_TUM_net_invalid example_TUM_config\"\n\n\nhide_const (open) NetModel_node_props\n\nhide_const (open) sinvar verify_globals \n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_DomainHierarchyNG_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.2888177374365586}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: StateSpace.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* State Space Template *}\ntheory StateSpace imports Hoare\nbegin\n\nrecord 'g state = \"globals\"::'g\n\ndefinition\n upd_globals:: \"('g \\ 'g) \\ ('g,'z) state_scheme \\ ('g,'z) state_scheme\"\nwhere\n \"upd_globals upd s = s\\globals := upd (globals s)\\\" \n\nrecord ('g, 'n, 'val) stateSP = \"'g state\" +\n locals :: \"'n \\ 'val\"\n\nlemma upd_globals_conv: \"upd_globals f = (\\s. s\\globals := f (globals s)\\)\"\n by (rule ext) (simp add: upd_globals_def)\n\nend", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/StateSpace.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5, "lm_q1q2_score": 0.28874768259290584}} {"text": "theory ref_crdt\n imports Main\n \"sorted_list\"\n fmap_functions\nsystem_model\nstandard_crdts\n \"~~/src/HOL/Library/Finite_Map\"\n \"~~/src/HOL/Library/Open_State_Syntax\"\n \"~~/src/HOL/Library/Code_Target_Numeral\"\nbegin\n\n\n\ndatatype operation = \n init ref inref\n | assign ref ref\n | deref ref\n | may_delete inref \"ref list\"\n | reset_inref inref\n | reset_ref ref\n (* TODO resolve *)\n\ndatatype operation_effector = \n effector_inref_inuse_enable inref\n | effector_inref_rev_refs_add inref ref uid\n | effector_inref_rev_refs_rem inref ref uid\n | effector_ref_dest_keys_assign ref \"inref option\" uid \"uid set\"\n\ndatatype operation_result =\n deref_result \"antidoteKey option\"\n | no_result\n | may_delete_result bool\n\n\nrecord ref_state =\n object_key :: \"antidoteKey\"\n dest_keys :: \"inref option mv_register_state\"\n\nrecord inref_state =\n inref_object_key :: \"antidoteKey\"\n rev_refs :: \"(ref \\ uid) two_phase_set_state\"\n inUse :: bool\n\nrecord state =\n state_refs :: \"(ref, ref_state) fmap\"\n state_inrefs :: \"(inref, inref_state) fmap\"\n\n\ndefinition initialState :: state where \n\"initialState \\ \\\n state_refs = fmempty,\n state_inrefs = fmempty\n \\\" \n\ntype_synonym generator_function = \"(operation \\ uid \\ state \\ operation_result \\ (operation_effector list))\"\ntype_synonym effector_function = \"(operation_effector \\ state \\ state)\"\ntype_synonym execution' = \"(operation, operation_result, operation_effector, state) execution\"\ntype_synonym eventInfo' = \"(operation, operation_result, operation_effector, state) eventInfo\"\n\ndefinition return :: \"'a \\ operation_effector list \\ ('a \\ operation_effector list)\" where\n\"return r l = (r,l)\"\n\ndefinition skip :: \"operation_effector list \\ operation_effector list\" where\n\"skip \\ id\"\n\ndefinition forEach :: \"'a list \\ ('a \\ operation_effector list \\ operation_effector list) \\operation_effector list \\ operation_effector list\" where\n\"forEach list f effs \\ foldl (\\es x. f x es) effs list\"\n\ntext {* forEach loop with state: *}\n\ndefinition forEachS :: \"'a list \\ 'b \\ ('a \\ 'b \\ operation_effector list \\ ('b \\ operation_effector list)) \\operation_effector list \\ operation_effector list\" where\n\"forEachS list s f effs \\ foldl (\\(s,es) x. f x s es) (s,effs) list |> snd\"\n\ndefinition set_forEach :: \"('a::linorder) set \\ ('a \\ operation_effector list \\ operation_effector list) \\operation_effector list \\ operation_effector list\" where\n\"set_forEach S \\ forEach (sorted_list_of_set2 S)\"\n\ndefinition set_forEachS :: \"('a::linorder) set \\ 'b \\ ('a \\ 'b \\ operation_effector list \\ ('b \\ operation_effector list)) \\operation_effector list \\ operation_effector list\" where\n\"set_forEachS S \\ forEachS (sorted_list_of_set2 S)\"\n\ndefinition inref_inuse_enable :: \"inref \\ operation_effector list \\ operation_effector list\" where \n\"inref_inuse_enable inref list = list@[effector_inref_inuse_enable inref]\"\n\ndefinition inref_rev_refs_add :: \"inref \\ ref \\ uid \\ operation_effector list \\ operation_effector list\" where \n\"inref_rev_refs_add inref elem uid list = list@[effector_inref_rev_refs_add inref elem uid]\"\n\ndefinition inref_rev_refs_remove :: \"inref \\ ref \\ uid \\ operation_effector list \\ operation_effector list\" where \n\"inref_rev_refs_remove inref elem uid list = list@[effector_inref_rev_refs_rem inref elem uid]\"\n\ndefinition ref_state :: \"state \\ ref \\ ref_state\" where\n\"ref_state state ref \\ case (state_refs state).[ref] of \n Some s \\ s\n | None \\ \\ object_key = D_antidoteKey (ref_number ref), dest_keys = {}\\\"\n\ndefinition ref_get_object_key :: \"state \\ ref \\ antidoteKey\" where\n\"ref_get_object_key state ref \\ object_key (ref_state state ref)\" \n\ndefinition inref_state :: \"state \\ inref \\ inref_state\" where\n\"inref_state state inref \\ case (state_inrefs state).[inref] of \n Some s \\ s\n | None \\ \\ inref_object_key = D_antidoteKey (inref_number inref), rev_refs = ({},{}), inUse = False\\\"\n\ndefinition inref_get_object_key :: \"state \\ inref \\ antidoteKey\" where\n\"inref_get_object_key state ref \\ inref_object_key (inref_state state ref)\" \n\ndefinition ref_dest_keys_assign :: \"ref \\ inref option \\ uid \\ state \\ operation_effector list \\ operation_effector list\" where \n\"ref_dest_keys_assign ref key uid state list \\ list@[effector_ref_dest_keys_assign ref key uid (snd` dest_keys (ref_state state ref))]\"\n\n\n\ndefinition s_update_inref :: \"inref \\ (inref_state \\ inref_state) \\ state \\ state\" where\n\"s_update_inref inref f S \\ S\\state_inrefs := fmupd inref (f (inref_state S inref)) (state_inrefs S)\\\"\n\n\ndefinition s_update_ref :: \"ref \\ (ref_state \\ ref_state) \\ state \\ state\" where\n\"s_update_ref ref f S \\ S\\state_refs := fmupd ref (f (ref_state S ref)) (state_refs S)\\\"\n\n\ndefinition may_delete_check :: \"state \\ inref \\ ref set \\ bool\" where\n\"may_delete_check state inref last_refs \\ \n (*let last_keypairs :: (ref \\ uid) set = \\ ((\\r. dest_keys (ref_state state r)) ` last_refs) in *)\n (fst ` two_phase_set_get (rev_refs (inref_state state inref))) = last_refs\"\n\nsubsection {* Implementation *}\n\ntext {* We now present the implementation of the reference CRDT: *}\n\ndefinition precondition_impl :: \"operation \\ state \\ bool\" where\n\"precondition_impl opr \\ case opr of \n init ref inref \\ Some (\\state. \\ inUse (inref_state state inref))\n | assign x y \\ None\n | deref ref \\ None\n | may_delete inref remaining \\ Some (\\s. True)\n | reset_inref inref \\ Some (\\state. may_delete_check state inref {})\n | reset_ref ref \\ None\n\"\n\ndefinition localPrecondition_impl :: \"operation \\ state \\ bool\" where\n\"localPrecondition_impl opr S \\ case opr of \n init ref inref \\ True\n | assign x y \\ \n mv_reg_count (dest_keys (ref_state S y)) = 1\n \\ mv_reg_get1' (dest_keys (ref_state S y)) \\ None \n | deref ref \\ \n mv_reg_count (dest_keys (ref_state S ref)) = 1\n \\ mv_reg_get1' (dest_keys (ref_state S ref)) \\ None\n | may_delete inref remaining \\ True\n | reset_inref inref \\ True\n | reset_ref ref \\ True\n\"\n\nfind_consts \"'a set \\ 'a\"\n\n\ndefinition effector_impl :: \"effector_function\" where\n\"effector_impl eff S \\ case eff of\n effector_inref_inuse_enable inref \\ \n s_update_inref inref (\\s. s\\ inUse := True\\) S\n | effector_inref_rev_refs_add inref antidoteKey uid \\ \n s_update_inref inref (\\s. s\\\n rev_refs := two_phase_set_add (rev_refs s) (antidoteKey, uid ) \\) S\n | effector_inref_rev_refs_rem inref antidoteKey uid \\ \n s_update_inref inref (\\s. s\\\n rev_refs := two_phase_set_remove (rev_refs s) (antidoteKey, uid ) \\) S\n | effector_ref_dest_keys_assign ref antidoteKey uid oldUids \\ \n s_update_ref ref (\\s. s\\dest_keys := insert (antidoteKey,uid) (Set.filter (\\(x,u). u\\uid \\ u\\oldUids) (dest_keys s)) \\) S\n\"\n\n(** broken version \ndefinition ref_reset_targets :: \"ref \\ inref option \\ uid \\ state \\ operation_effector list \\ operation_effector list\" where \n\"ref_reset_targets ref ignoredInref uid state \\ exec {\n let (outkeys :: (inref option\\uid) set) = (dest_keys (ref_state state ref));\n set_forEachS outkeys True (\\(target,uid) first_time. \n case target of \n None \\ return first_time\n | Some target' => exec {\n (if \\ (target = ignoredInref \\ first_time) then exec {\n inref_rev_refs_remove target' ref uid;\n return first_time\n } else if target = ignoredInref then exec {\n return False\n } else exec {\n return first_time\n })\n })\n }\"\n**)\n\ndefinition ref_reset_targets :: \"ref \\ uid \\ state \\ operation_effector list \\ operation_effector list\" where \n\"ref_reset_targets ref uid state \\ exec {\n let (outkeys :: (inref option\\uid) set) = (dest_keys (ref_state state ref));\n set_forEach outkeys (\\(target,uid). \n case target of \n None \\ skip\n | Some target' => inref_rev_refs_remove target' ref uid\n )\n }\"\n\ndefinition ref_reset :: \"ref \\ inref option \\ uid \\ state \\ operation_effector list \\ operation_effector list\" where \n\"ref_reset ref ignoredInref uid state \\ exec {\n ref_dest_keys_assign ref None uid state;\n ref_reset_targets ref uid state\n }\"\n\ndefinition outref_update :: \"ref \\ inref option \\ state \\ uid \\ operation_effector list \\ operation_effector list\" where\n\"outref_update ref inref state uid \\ exec {\n (* first insert into new target: *)\n (case inref of\n None \\ skip\n | Some inref \\ inref_rev_refs_add inref ref uid);\n (* then: assign source *)\n ref_dest_keys_assign ref inref uid state;\n (* then reset targets: remove from all old targets *)\n ref_reset_targets ref uid state\n}\"\n\ndefinition generator_impl :: generator_function where\n\"generator_impl opr uid state \\ [] |> (case opr of \n init ref inref \\ exec {\n inref_inuse_enable inref;\n outref_update ref (Some inref) state uid;\n return no_result\n }\n | assign outTo outVal \\ exec {\n let new_key = mv_reg_get1' (dest_keys (ref_state state outVal));\n outref_update outTo new_key state uid;\n return no_result\n }\n | deref ref \\ exec {\n let inref = mv_reg_get1' (dest_keys (ref_state state ref));\n let key = (map_option (inref_get_object_key state) inref);\n return (deref_result key)\n }\n | may_delete inref last_refs \\ exec {\n return (may_delete_result (may_delete_check state inref (set last_refs)))\n }\n | reset_inref inref \\ exec {\n return no_result\n }\n | reset_ref ref \\ exec {\n outref_update ref None state uid;\n return no_result\n }\n)\n\"\n\n\n\ndefinition \n\"wellFormed_impl execution \\ wellFormed execution initialState generator_impl effector_impl localPrecondition_impl precondition_impl\"\n\nfind_consts \"('a \\ bool) \\ 'a list \\ 'a option\"\n\nfun find_smaller :: \"'a rel \\ 'a \\ 'a list \\ 'a option\" where\n \"find_smaller R x [] = None\"\n| \"find_smaller R x (y#ys) = None\"\n\n\nlemma find_length[simp]: \"find P xs = Some x \\ length (remove1 x xs) < length xs\"\n by (induct xs, auto split: if_splits)\n\nlemma find_length2[simp]: \"find P xs = Some x \\ Suc (length (remove1 x xs)) = length xs \"\n by (induct xs, auto split: if_splits)\n\n\ndefinition findMinimal :: \"'a rel \\ 'a list \\ 'a\" where \n\"findMinimal R xs \\ case find (\\y. \\x\\set xs. x=y \\ (x,y)\\R) xs of None \\ hd xs | Some x \\ x\"\n\n\nlemma findMinimalIn: \"xs\\[] \\ findMinimal R xs \\ set xs\"\n apply (auto simp add: findMinimal_def split: option.splits)\n by (metis (no_types, lifting) find_Some_iff in_set_conv_nth)\n\n\nlemma findMinimal_termination[simp]: \"xs\\[] \\ length (remove1 (findMinimal R xs) xs) < length xs\"\n by (simp add: findMinimalIn length_remove1)\n\nlemma findMinimal_termination2[simp]: \"findMinimal R (v # va) \\ v \\ length (remove1 (findMinimal R (v # va)) va) < length va\"\n by (metis One_nat_def Suc_pred findMinimalIn length_pos_if_in_set length_remove1 lessI list.discI set_ConsD)\n\n\nfun topSort :: \"'a rel \\ 'a list \\ 'a list\" where\n \"topSort R [] = []\"\n| \"topSort R xs = (let m = findMinimal R xs in m#topSort R (remove1 m xs))\" \n\nfind_consts \"('k, 'v) fmap\"\n\ndefinition \"numberEffectors E e \\ e |> fmlookup (events E) |> the |> event_effectors |> length\"\n\ndefinition execution_addStep :: \"int \\ operation \\ (event,nat) fmap \\ execution' \\ execution'\" where\n\"execution_addStep eId opr preEventsN E \\ \nlet\n e = D_event eId;\n preEvents = fmdom' preEventsN;\n (* only existing events *) \n deps1 :: event set = Set.filter (\\e. e\\fmdom' (events E)) preEvents;\n (* include parallel events which need to be stable *)\n deps2 = Set.filter (\\e. e\\deps1 \\ (precondition_impl (event_operation ((events E)![e])) \\ None \\ (\\e'\\deps1. (e',e)\\happensBefore E ) )) (fmdom' (events E));\n (* include causal dependencies *)\n deps3 = downwards_closure deps2 E; (* TODO could be more precise; at the level of effectors instead of events*)\n (* include parallel events, if stable precondition check required *)\n deps = (if precondition_impl opr = None then deps3 else parallel_closure deps3 (fmdom' (events E)) (happensBefore E));\n snapshot = sorted_list_of_set2 deps \n |> map (\\e. (e, case preEventsN.[e] of \n None \\ numberEffectors E e\n | Some n \\ if precondition_impl opr \\ None \\ (\\e'\\deps. e\\snapshot_events (event_snapshot ((events E)![e']))) \n then numberEffectors E e \n else n\n )) \n |> fmap_of_list\n |> Snapshot ;\n precond = (precondition_impl opr orElse (\\x. True));\n execOrder = topSort (happensBefore E) (sorted_list_of_set2 deps); \n preState :: state = executeEffectors (List.maps (\\e. take (snapshot_num snapshot e) (event_effectors ((events E)![e]))) execOrder) initialState effector_impl\nin if \\(localPrecondition_impl opr preState \\ precond preState) then\n E\nelse\n let (res,eff) = generator_impl opr e preState;\n postState :: state = executeEffectors eff preState effector_impl \n in\n \\\n events = fmupd e \\\n event_operation = opr,\n event_result = res,\n event_effectors = eff,\n event_executionOrder = execOrder,\n event_state_pre = preState,\n event_state_post = postState,\n event_snapshot = snapshot\n \\ (events E)\n \\\n\n\"\n\ndefinition \"emptyExecution \\ \\events = fmempty\\\"\n\nrecord trace_event = \n t_operation :: operation\n t_deps :: \"(event,nat) fmap\"\n\ndefinition execution_run :: \"trace_event list \\ execution'\" where\n\"execution_run ops \\ snd (fold (\\e (n,E). (n+1, execution_addStep n (t_operation e) (t_deps e) E)) ops (0, emptyExecution))\"\n\ndefinition forallEvents :: \"execution' \\ (event \\ eventInfo' \\ bool) \\ bool\" where\n\"forallEvents E P \\ events E |> fmpred P\"\n\ndefinition forallStates :: \"execution' \\ (state \\ bool) \\ bool\" where\n\"forallStates E P \\ forallEvents E (\\e eInfo. P (event_state_pre eInfo) \\ P (event_state_post eInfo))\"\n\n\nsubsection {* Invariants *}\n\n(* if ref exists, inref exists *)\ndefinition invariant1 :: \"execution' \\ bool\" where\n\"invariant1 E \\ forallStates E (\\s. state_refs s |> fmpred (\\r rState. \\(k,u)\\dest_keys rState. case k of None \\ True | Some inref \\ \n (case (state_inrefs s).[inref] of None \\ False | Some inrefState \\ (r,u) \\ two_phase_set_get (rev_refs inrefState) )))\"\n\n(* once an inref is unreachable, it remains unreachable *)\ndefinition invariant2 :: \"execution' \\ bool\" where\n\"invariant2 E \\ \n(\\(e,eInfo)\\events' E. \n \\(inref,inrefState)\\fmap_entries (state_inrefs (event_state_pre eInfo)). \n two_phase_set_get (rev_refs inrefState) = {}\n \\ stable e E\n \\ (\\(e', eInfo')\\events' E. (e,e')\\happensBefore E \\ \n (case (state_inrefs (event_state_post eInfo')).[inref] of\n Some inrefState' \\ two_phase_set_get (rev_refs inrefState') = {}\n | None \\ False\n )))\"\n\n(* if there is a reverse reference, then there is also a forward reference\n(only true, if using transactional semantics )\n *)\ndefinition invariant3 :: \"execution' \\ bool\" where\n\"invariant3 E \\ \nforallStates E (\\S. \n \\(inref,inrefState)\\fmap_entries (state_inrefs S). \n \\(r,u)\\two_phase_set_get (rev_refs inrefState). \n case state_refs S.[r] of\n None \\ False\n | Some rstate \\ (Some inref,u)\\ dest_keys rstate\n)\n\"\n\n(* some simple postconditions for operations*)\ndefinition invariant4 :: \"execution' \\ bool\" where\n\"invariant4 E \\ \n\\(e,eInfo)\\events' E. \ncase event_operation eInfo of\n init x y \\ \n (let S = event_state_post eInfo in\n case state_refs S.[x] of\n None \\ False\n | Some rstate \\ Some y\\fst`dest_keys rstate)\n | _ \\ True\n\"\n\n(* finally: if there is a reverse reference, then there is also a forward reference\n *)\ndefinition invariant5 :: \"execution' \\ bool\" where\n\"invariant5 E \\ \nlet \nexecution_order = sorted_list_of_set2 (fmdom' (events E));\neffectors = execution_order |> List.maps (\\e'.\n case (events E).[e'] of Some eInfo' \\ event_effectors eInfo' | None \\ []);\nS = executeEffectors effectors initialState effector_impl\n in\n \\(inref,inrefState)\\fmap_entries (state_inrefs S). \n \\(r,u)\\two_phase_set_get (rev_refs inrefState). \n case state_refs S.[r] of\n None \\ False\n | Some rstate \\ (Some inref,u)\\ dest_keys rstate\n\"\n\n\nexport_code wf_correct_execution_lists in Haskell\nexport_code execution_run in Haskell\n\n\n\n\ndefinition \"transformOp I \\ let (opr, deps) = I in \\t_operation = opr, t_deps = deps\\\"\ndefinition \"transformOp2 I \\ let (opr, deps,xx) = I in trace_event.extend \\t_operation = opr, t_deps = deps\\ xx\"\n\ninstantiation fmap :: (narrowing,narrowing) narrowing begin\ndefinition \"narrowing_fmap = Quickcheck_Narrowing.apply (Quickcheck_Narrowing.cons fmap_of_list) narrowing\"\ninstance proof qed\nend\n\ninstantiation trace_event_ext :: (narrowing) narrowing begin\ndefinition \"narrowing_trace_event_ext = Quickcheck_Narrowing.apply (Quickcheck_Narrowing.cons transformOp2) narrowing\"\ninstance proof qed\nend\n\n\ndefinition \"execution_run2 ops \\ execution_run (map transformOp ops)\"\n\n\ndefinition fmap_key_list where\n\"fmap_key_list m \\ sorted_list_of_set2 (fmdom' m)\"\n\ndefinition fmap_to_list where\n\"fmap_to_list m \\ map (\\k. (k,m![k])) (fmap_key_list m)\"\n\n\nexport_code sorted_list_of_set2 execution_run2 \ninvariant1 invariant2 invariant3 invariant4 invariant5\n init assign deref may_delete reset_inref reset_ref D_event D_inref D_ref D_antidoteKey \ninteger_of_nat int_of_integer integer_of_nat nat_of_integer fmap_of_list D_event integer_of_int\nevents event_operation event_result event_effectors event_executionOrder event_state_pre event_state_post event_snapshot \nfmlookup fmap_key_list fmap_to_list Snapshot state_refs state_inrefs \nobject_key dest_keys inref_object_key rev_refs inUse\neffector_inref_inuse_enable effector_inref_rev_refs_add effector_inref_rev_refs_rem effector_ref_dest_keys_assign\nin Haskell (*module_name Ref_crdt*) file \"refcrdt-quickcheck/srcgen\"\n\ntypedef operations = \"UNIV :: (trace_event list) set\"\n by force\n\n\nfun cleanRef where\n\"cleanRef (D_ref n) = D_ref (n mod 3)\"\nfun cleanInef where\n\"cleanInef (D_inref n) = D_inref 0\"\n\n\nfun cleanOperations :: \"trace_event list \\ nat \\ trace_event list\" where\n \"cleanOperations [] n = []\"\n| \"cleanOperations (ev#evs) n = (if n > 20 then [] else\n let newOp = (case t_operation ev of\n init x y \\ init (cleanRef x) (cleanInef y)\n | assign x y \\ assign (cleanRef x) (cleanRef y) \n | deref x \\ deref (cleanRef x)\n | may_delete x xs \\ may_delete (cleanInef x) []\n | reset_inref x \\ reset_inref (cleanInef x)\n | reset_ref x \\ reset_ref (cleanRef x)\n)\n in \\t_operation=newOp, deps = fmap_of_list (map (\\x. case x of (D_event x,i) \\ (D_event (x mod (int n)), i)) (fmap_to_list (t_deps ev)))\\#cleanOperations evs (Suc n))\"\n\n(*\ninit ref inref\n | assign ref ref\n | deref ref\n | may_delete inref \"ref list\"\n | reset_inref inref\n | reset_ref ref\n*)\n\n(*\nlemma \"let E = execution_run (cleanOperations ops 0) in invariant2 E\"\n quickcheck[random,size=40,timeout=1000,verbose,timeout=1000]\n oops\n*)\n\nabbreviation \"r1 \\ D_ref 1\"\nabbreviation \"r2 \\ D_ref 2\"\nabbreviation \"r3 \\ D_ref 3\"\n\nabbreviation \"ir1 \\ D_inref 1\"\nabbreviation \"ir2 \\ D_inref 2\"\n\nabbreviation \"e i \\ D_event i\"\n\nvalue \"let ops = [\n (* e0 *) (init r1 ir1, fmap_of_list []),\n (* e1 *) (reset_ref r1, fmap_of_list [(e 0,1)])\n ]; \n E = execution_run (map transformOp ops) \n (*ev = e 4;\n eInfo = the (fmlookup (events E) ev);\n e' = e 6;\n eInfo' = the (fmlookup (events E) e');\n inv = (\n \\(inref,inrefState)\\fmap_entries (state_inrefs (event_state_pre eInfo)). \n two_phase_set_get (rev_refs inrefState) = {}\n \\ stable ev E\n \\ ( (ev,e')\\happensBefore E \\ \n (case (state_inrefs (event_state_post eInfo')).[inref] of\n Some inrefState' \\ two_phase_set_get (rev_refs inrefState') = {}\n | None \\ False\n )))*)\n \n in (invariant3 E, E)\"\n\n\n\nend", "meta": {"author": "peterzeller", "repo": "ref-crdt", "sha": "b5678901b2489d87a7676188d14addf3778e235f", "save_path": "github-repos/isabelle/peterzeller-ref-crdt", "path": "github-repos/isabelle/peterzeller-ref-crdt/ref-crdt-b5678901b2489d87a7676188d14addf3778e235f/ref_crdt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.28874175514888817}} {"text": "theory CompositionalityResults\nimports GeneralizedZippingLemma CompositionSupport\nbegin\n\ncontext Compositionality \nbegin\n\n\n(* Theorem 6.4.1 case 1 *)\ntheorem compositionality_BSD: \n\"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub> \\ \\ BSD \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\nproof -\n assume BSD_Tr1_v1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n assume BSD_Tr2_v2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n {\n fix \\ \\ c\n assume c_in_Cv: \"c \\ C\\<^bsub>\\\\<^esub>\"\n assume \\c\\_in_Tr: \"(\\ @ [c] @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n assume \\_contains_no_c: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\" \n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n from \\c\\_in_Tr \n have \\c\\_E1_in_Tr1: \"((\\ @ [c] @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\c\\_E2_in_Tr2: \"((\\ @ [c] @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (auto, simp add: composeES_def)+\n\n from composeES_yields_ES validES1 validES2 have \"ES_valid (ES1 \\ ES2)\"\n by auto\n\n with \\c\\_in_Tr have \"set \\ \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set (\\ \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover \n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub> = (\\ \\ V\\<^bsub>\\\\<^esub>)\"\n by (simp add: projection_def)\n moreover\n from CSES1.BSD_in_subsystem[OF c_in_Cv \\c\\_E1_in_Tr1 BSD_Tr1_v1]\n obtain \\1' \n where \\1'_1: \"((\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1') \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'_2: \"(\\1' \\ V\\<^bsub>\\1\\<^esub>) = (\\ \\ V\\<^bsub>\\1\\<^esub>)\"\n and \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n moreover\n from \\1'_1 validES1 have \\1'_in_E1: \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\1'_2 propSepViews have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>) = (\\1' \\ V\\<^bsub>\\\\<^esub>)\"\n proof -\n have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>) = \\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp only: projection_def, auto)\n with propSepViews have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>) = (\\ \\ V\\<^bsub>\\1\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from \\1'_2 have \"(\\1' \\ V\\<^bsub>\\1\\<^esub>) = (\\1' \\ V\\<^bsub>\\\\<^esub>)\"\n proof -\n from \\1'_in_E1 have \"\\1' \\ E\\<^bsub>ES1\\<^esub> = \\1'\"\n by (simp add: list_subset_iff_projection_neutral)\n hence \"(\\1' \\ E\\<^bsub>ES1\\<^esub>) \\ V\\<^bsub>\\\\<^esub> = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n by simp\n with Vv_is_Vv1_union_Vv2 have \"(\\1' \\ E\\<^bsub>ES1\\<^esub>) \\ (V\\<^bsub>\\1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>) = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n by simp\n hence \"\\1' \\ (E\\<^bsub>ES1\\<^esub> \\ (V\\<^bsub>\\1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>)) = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n by (simp only: projection_def, auto)\n hence \"\\1' \\ (E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>) = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: Int_Un_distrib)\n moreover \n from validV1 have \"E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub> = V\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\1' \\ (V\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>) = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n by simp\n moreover\n have \"E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>\" \n proof -\n from propSepViews Vv_is_Vv1_union_Vv2 have \"(V\\<^bsub>\\1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by simp\n hence \"(V\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>) = V\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have \"(V\\<^bsub>\\1\\<^esub> \\ V\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>) = V\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by auto\n qed\n ultimately show ?thesis\n by (simp add: Un_absorb2)\n qed\n moreover note \\1'_2\n ultimately show ?thesis\n by auto\n qed \n moreover\n from CSES2.BSD_in_subsystem[OF c_in_Cv \\c\\_E2_in_Tr2 BSD_Tr2_v2]\n obtain \\2' \n where \\2'_1: \"((\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2') \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'_2: \"(\\2' \\ V\\<^bsub>\\2\\<^esub>) = (\\ \\ V\\<^bsub>\\2\\<^esub>)\"\n and \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n moreover\n from \\2'_1 validES2 have \\2'_in_E2: \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\2'_2 propSepViews have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>) = (\\2' \\ V\\<^bsub>\\\\<^esub>)\"\n proof -\n have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>) = \\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp only: projection_def, auto)\n with propSepViews have \"((\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>) = (\\ \\ V\\<^bsub>\\2\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from \\2'_2 have \"(\\2' \\ V\\<^bsub>\\2\\<^esub>) = (\\2' \\ V\\<^bsub>\\\\<^esub>)\"\n proof -\n from \\2'_in_E2 have \"\\2' \\ E\\<^bsub>ES2\\<^esub> = \\2'\"\n by (simp add: list_subset_iff_projection_neutral)\n hence \"(\\2' \\ E\\<^bsub>ES2\\<^esub>) \\ V\\<^bsub>\\\\<^esub> = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n by simp\n with Vv_is_Vv1_union_Vv2 have \"(\\2' \\ E\\<^bsub>ES2\\<^esub>) \\ (V\\<^bsub>\\2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>) = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: Un_commute)\n hence \"\\2' \\ (E\\<^bsub>ES2\\<^esub> \\ (V\\<^bsub>\\2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>)) = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n by (simp only: projection_def, auto)\n hence \"\\2' \\ (E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>) = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: Int_Un_distrib)\n moreover \n from validV2 have \"E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub> = V\\<^bsub>\\2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\2' \\ (V\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>) = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n by simp\n moreover\n have \"E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\1\\<^esub> \\ V\\<^bsub>\\2\\<^esub>\" \n proof -\n from propSepViews Vv_is_Vv1_union_Vv2 have \"(V\\<^bsub>\\2\\<^esub> \\ V\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: Un_commute)\n hence \"(V\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>) = V\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have \"(V\\<^bsub>\\2\\<^esub> \\ V\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>) = V\\<^bsub>\\2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by auto\n qed\n ultimately show ?thesis\n by (simp add: Un_absorb2)\n qed\n moreover note \\2'_2\n ultimately show ?thesis\n by auto\n qed\n moreover note generalized_zipping_lemma\n ultimately have \"\\\\'. ((\\ @ \\') \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ (\\' \\ V\\<^bsub>\\\\<^esub> = (\\ \\ V\\<^bsub>\\\\<^esub>)) \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by blast\n }\n thus ?thesis \n unfolding BSD_def\n by auto\nqed\n\n(* Theorem 6.4.1 case 2 *)\ntheorem compositionality_BSI: \n\"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub>; BSI \\1 Tr\\<^bsub>ES1\\<^esub>; BSI \\2 Tr\\<^bsub>ES2\\<^esub> \\\n \\ BSI \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\nproof -\n assume BSD1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSD2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and BSI1: \"BSI \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSI2: \"BSI \\2 Tr\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\ \\ c\n assume c_in_Cv: \"c \\ C\\<^bsub>\\\\<^esub>\"\n assume \\\\_in_Tr: \"(\\ @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n assume \\_no_Cv: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n \n from \\\\_in_Tr \n have \\\\_E1_in_Tr1: \"((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\\\_E2_in_Tr2: \"((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: composeES_def)+\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\"\n using propSepViews unfolding properSeparationOfViews_def\n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n from CSES1.BSD_in_subsystem2[OF \\\\_E1_in_Tr1 BSD1] obtain \\1'\n where \\E1\\1'_in_Tr1: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Vv1_is_\\Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n from CSES2.BSD_in_subsystem2[OF \\\\_E2_in_Tr2 BSD2] obtain \\2'\n where \\E2\\2'_in_Tr2: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Vv2_is_\\Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n \n have \"\\ \\1''. (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ ((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = [])\"\n proof cases\n assume cE1_empty: \"[c] \\ E\\<^bsub>ES1\\<^esub> = []\"\n \n from \\E1\\1'_in_Tr1 validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from cE1_empty \\E1\\1'_in_Tr1 have \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1'Cv1_empty\n ultimately show ?thesis\n by auto\n next\n assume cE1_not_empty: \"[c] \\ E\\<^bsub>ES1\\<^esub> \\ []\"\n hence c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_def, auto, split if_split_asm, auto)\n\n from c_in_Cv c_in_E1 propSepViews have \"c \\ C\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n note \\E1\\1'_in_Tr1 \\1'Cv1_empty BSI1\n ultimately obtain \\1'' \n where \\E1c\\1''_in_Tr1: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSI_def\n by blast\n \n from validES1 \\E1c\\1''_in_Tr1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E1c\\1''_in_Tr1 c_in_E1 have \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n from \\1''Vv1_is_\\1'Vv1 \\1'Vv1_is_\\Vv1 have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n note \\1''Cv1_empty\n ultimately show ?thesis\n by auto\n qed\n then obtain \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\" \n and \\cE1\\1''_in_Tr1: \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\" \n and \\1''Vv1_is_\\Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n have \"\\ \\2''. (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \n \\ ((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub> \n \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = [])\"\n proof cases\n assume cE2_empty: \"[c] \\ E\\<^bsub>ES2\\<^esub> = []\"\n \n from \\E2\\2'_in_Tr2 validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from cE2_empty \\E2\\2'_in_Tr2 have \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2'Cv2_empty\n ultimately show ?thesis\n by auto\n next\n assume cE2_not_empty: \"[c] \\ E\\<^bsub>ES2\\<^esub> \\ []\"\n hence c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_def, auto, split if_split_asm, auto)\n\n from c_in_Cv c_in_E2 propSepViews have \"c \\ C\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n note \\E2\\2'_in_Tr2 \\2'Cv2_empty BSI2\n ultimately obtain \\2'' \n where \\E2c\\2''_in_Tr2: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSI_def\n by blast\n \n from validES2 \\E2c\\2''_in_Tr2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E2c\\2''_in_Tr2 c_in_E2 have \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n from \\2''Vv2_is_\\2'Vv2 \\2'Vv2_is_\\Vv2 have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n note \\2''Cv2_empty\n ultimately show ?thesis\n by auto\n qed\n then obtain \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\" \n and \\cE2\\2''_in_Tr2: \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\" \n and \\2''Vv2_is_\\Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto \n \n (* apply the generalized zipping lemma *)\n from VIsViewOnE c_in_Cv \\\\_in_Tr have \"set (\\ @ [c]) \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def composeES_def, auto)\n moreover\n have \"set (\\ \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\1''_in_E1star \\2''_in_E2star \\cE1\\1''_in_Tr1 \\cE2\\2''_in_Tr2\n moreover\n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\1''Vv1_is_\\Vv1 propSepViews have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub>) = \\1'' \\ (E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\1''_in_E1star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\2''Vv2_is_\\Vv2 propSepViews have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub>) = \\2'' \\ (E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\2''_in_E2star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n note \\1''Cv1_empty \\2''Cv2_empty generalized_zipping_lemma\n ultimately have \"\\\\'. (\\ @ [c]) @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n }\n thus ?thesis\n unfolding BSI_def\n by auto\nqed\n\n(* Theorem 6.4.1 case 3 *)\ntheorem compositionality_BSIA: \n\"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub>; BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>; \n (\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>; (\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub> \\ \n \\ BSIA \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\nproof -\n assume BSD1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSD2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and BSIA1: \"BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSIA2: \"BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and \\1v1_subset_\\v_inter_E1: \"(\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n and \\2v2_subset_\\v_inter_E2:\"(\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\ \\ c\n assume c_in_Cv: \"c \\ C\\<^bsub>\\\\<^esub>\"\n assume \\\\_in_Tr: \"(\\ @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n assume \\_no_Cv: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n assume Adm: \"(Adm \\ \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \\ c)\"\n then obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from \\\\_in_Tr \n have \\\\_E1_in_Tr1: \"((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\\\_E2_in_Tr2: \"((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: composeES_def)+\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n\n from CSES1.BSD_in_subsystem2[OF \\\\_E1_in_Tr1 BSD1] obtain \\1'\n where \\E1\\1'_in_Tr1: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Vv1_is_\\Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n from CSES2.BSD_in_subsystem2[OF \\\\_E2_in_Tr2 BSD2] obtain \\2'\n where \\E2\\2'_in_Tr2: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Vv2_is_\\Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n\n have \"\\ \\1''. (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \n \\ ((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub> \n \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = [])\"\n proof cases\n assume cE1_empty: \"[c] \\ E\\<^bsub>ES1\\<^esub> = []\"\n \n from \\E1\\1'_in_Tr1 validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from cE1_empty \\E1\\1'_in_Tr1 have \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1'Cv1_empty\n ultimately show ?thesis\n by auto\n next\n assume cE1_not_empty: \"[c] \\ E\\<^bsub>ES1\\<^esub> \\ []\"\n hence c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_def, auto, split if_split_asm, auto)\n\n from c_in_Cv c_in_E1 propSepViews have \"c \\ C\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n note \\E1\\1'_in_Tr1 \\1'Cv1_empty\n moreover\n have \"(Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c)\" \n proof -\n from c_in_E1 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\1v1_subset_\\v_inter_E1 have \"\\ \\ (\\1 \\1) = \\ \\ (\\1 \\1)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed\n moreover\n note BSIA1\n ultimately obtain \\1'' \n where \\E1c\\1''_in_Tr1: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n from validES1 \\E1c\\1''_in_Tr1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E1c\\1''_in_Tr1 c_in_E1 have \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n from \\1''Vv1_is_\\1'Vv1 \\1'Vv1_is_\\Vv1 have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n note \\1''Cv1_empty\n ultimately show ?thesis\n by auto\n qed\n then obtain \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\" \n and \\cE1\\1''_in_Tr1: \"((\\ @ [c]) \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\" \n and \\1''Vv1_is_\\Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n have \"\\ \\2''. (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \n \\ ((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub> \n \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = [])\"\n proof cases\n assume cE2_empty: \"[c] \\ E\\<^bsub>ES2\\<^esub> = []\"\n \n from \\E2\\2'_in_Tr2 validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from cE2_empty \\E2\\2'_in_Tr2 have \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2'Cv2_empty\n ultimately show ?thesis\n by auto\n next\n assume cE2_not_empty: \"[c] \\ E\\<^bsub>ES2\\<^esub> \\ []\"\n hence c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_def, auto, split if_split_asm, auto)\n\n from c_in_Cv c_in_E2 propSepViews have \"c \\ C\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n note \\E2\\2'_in_Tr2 \\2'Cv2_empty\n moreover\n have \"(Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c)\" \n proof -\n from c_in_E2 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\2v2_subset_\\v_inter_E2 have \"\\ \\ (\\2 \\2) = \\ \\ (\\2 \\2)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed\n moreover\n note BSIA2\n ultimately obtain \\2'' \n where \\E2c\\2''_in_Tr2: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n from validES2 \\E2c\\2''_in_Tr2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E2c\\2''_in_Tr2 c_in_E2 have \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n from \\2''Vv2_is_\\2'Vv2 \\2'Vv2_is_\\Vv2 have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n note \\2''Cv2_empty\n ultimately show ?thesis\n by auto\n qed\n then obtain \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\" \n and \\cE2\\2''_in_Tr2: \"((\\ @ [c]) \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\" \n and \\2''Vv2_is_\\Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n \n (* apply the generalized zipping lemma *)\n from VIsViewOnE c_in_Cv \\\\_in_Tr have \"set (\\ @ [c]) \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def composeES_def, auto)\n moreover\n have \"set (\\ \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\1''_in_E1star \\2''_in_E2star \\cE1\\1''_in_Tr1 \\cE2\\2''_in_Tr2\n moreover\n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\1''Vv1_is_\\Vv1 propSepViews \n have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub>) = \\1'' \\ (E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\1''_in_E1star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\2''Vv2_is_\\Vv2 propSepViews \n have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub>) = \\2'' \\ (E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\2''_in_E2star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n note \\1''Cv1_empty \\2''Cv2_empty generalized_zipping_lemma\n ultimately have \"\\\\'. (\\ @ [c]) @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n }\n thus ?thesis\n unfolding BSIA_def\n by auto\nqed\n\n(* Theorem 6.4.1 case 4 *)\ntheorem compositionality_FCD: \n \"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub>; \n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n ( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>;\n N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {}; N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {};\n FCD \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; FCD \\2 \\2 Tr\\<^bsub>ES2\\<^esub> \\ \n \\ FCD \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\nproof -\n assume BSD1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSD2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and Nabla_inter_E1_subset_Nabla1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Nabla_inter_E2_subset_Nabla2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Upsilon_inter_E1_subset_Upsilon1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Upsilon_inter_E2_subset_Upsilon2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Delta1_N1_Delta2_N2_subset_Delta: \"( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>\"\n and N1_Delta1_E2_disjoint: \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {}\"\n and N2_Delta2_E1_disjoint: \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {}\"\n and FCD1: \"FCD \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and FCD2: \"FCD \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\ \\ c v'\n assume c_in_Cv_inter_Upsilon: \"c \\ (C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and v'_in_Vv_inter_Nabla: \"v' \\ (V\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and \\cv'\\_in_Tr: \"(\\ @ [c,v'] @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\" \n and \\Cv_empty: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n\n from \\cv'\\_in_Tr\n have \\cv'\\_E1_in_Tr1: \"(((\\ @ [c,v']) @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\cv'\\_E2_in_Tr2: \"(((\\ @ [c,v']) @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: composeES_def)+\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n from CSES1.BSD_in_subsystem2[OF \\cv'\\_E1_in_Tr1 BSD1] obtain \\1'\n where \\cv'E1\\1'_in_Tr1: \"(\\ @ [c,v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Vv1_is_\\Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n from CSES2.BSD_in_subsystem2[OF \\cv'\\_E2_in_Tr2 BSD2] obtain \\2'\n where \\cv'E2\\2'_in_Tr2: \"(\\ @ [c,v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Vv2_is_\\Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV1\n have \"c \\ E\\<^bsub>ES1\\<^esub> \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>) \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n \n have \"set [] \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by auto\n moreover\n from \\cv'E1\\1'_in_Tr1 c_notin_E1 have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [] @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover\n note \\1'Cv1_empty \n ultimately have \"\\ \\1'' \\1''. set \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_notin_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1 \n have c_in_Cv1_Upsilon1: \"c \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n hence c_in_Cv1: \"c \\ C\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from \\cv'E1\\1'_in_Tr1 c_in_E1 v'_notin_E1 have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n note \\1'Cv1_empty BSD1\n ultimately obtain \\1''\n where first: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and second: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and third: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSD_def\n by blast\n \n have \"set [] \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by auto\n moreover\n from first v'_notin_E1 have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [] @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note second third\n ultimately\n have \"\\ \\1'' \\1''. set \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_in_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n \n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1 \n have c_in_Cv1_Upsilon1: \"c \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E1 v'_in_Vv_inter_Nabla propSepViews Nabla_inter_E1_subset_Nabla1\n have v'_in_Vv1_inter_Nabla1: \"v' \\ (V\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from \\cv'E1\\1'_in_Tr1 c_in_E1 v'_in_E1 have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c,v'] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\1'Cv1_empty FCD1\n ultimately obtain \\1'' \\1'' \n where first: \"set \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n and second: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and third: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and fourth: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCD_def\n by blast\n\n from second v'_in_E1 have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n with first third fourth\n have \"\\ \\1'' \\1''. set \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCD_def\n by blast\n }\n ultimately obtain \\1'' \\1'' \n where \\1''_in_Nv1_Delta1_star: \"set \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n and \\E1\\1''vE1\\1''_in_Tr1: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' @ ([v'] \\ E\\<^bsub>ES1\\<^esub>) @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by blast\n with validV1 have \\1''_in_E1_star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV2\n have \"c \\ E\\<^bsub>ES2\\<^esub> \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>) \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n \n have \"set [] \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by auto\n moreover\n from \\cv'E2\\2'_in_Tr2 c_notin_E2 have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [] @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover\n note \\2'Cv2_empty \n ultimately have \"\\ \\2'' \\2''. set \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_notin_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews Upsilon_inter_E2_subset_Upsilon2 \n have c_in_Cv2_Upsilon2: \"c \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n hence c_in_Cv2: \"c \\ C\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from \\cv'E2\\2'_in_Tr2 c_in_E2 v'_notin_E2 have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute projection_def, auto)\n moreover\n note \\2'Cv2_empty BSD2\n ultimately obtain \\2''\n where first: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and second: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and third: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSD_def\n by blast\n \n have \"set [] \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by auto\n moreover\n from first v'_notin_E2 have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [] @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note second third\n ultimately\n have \"\\ \\2'' \\2''. set \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_in_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n \n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E2_subset_Upsilon2 \n have c_in_Cv2_Upsilon2: \"c \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E2 v'_in_Vv_inter_Nabla propSepViews Nabla_inter_E2_subset_Nabla2\n have v'_in_Vv2_inter_Nabla2: \"v' \\ (V\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from \\cv'E2\\2'_in_Tr2 c_in_E2 v'_in_E2 have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c,v'] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\2'Cv2_empty FCD2\n ultimately obtain \\2'' \\2'' \n where first: \"set \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and second: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and third: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and fourth: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCD_def\n by blast\n\n from second v'_in_E2 have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n with first third fourth\n have \"\\ \\2'' \\2''. set \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \n \\ (\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCD_def\n by blast\n }\n ultimately obtain \\2'' \\2'' \n where \\2''_in_Nv2_Delta2_star: \"set \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and \\E2\\2''vE2\\2''_in_Tr2: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' @ ([v'] \\ E\\<^bsub>ES2\\<^esub>) @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by blast\n with validV2 have \\2''_in_E2_star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n \n from \\1''_in_Nv1_Delta1_star N1_Delta1_E2_disjoint \n have \\1''E2_empty: \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = []\"\n proof -\n from \\1''_in_Nv1_Delta1_star have \"\\1'' = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by (simp only: list_subset_iff_projection_neutral)\n hence \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>\"\n by simp\n moreover\n have \"\\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp only: projection_def, auto)\n with N1_Delta1_E2_disjoint have \"\\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = []\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by simp\n qed\n moreover\n from \\2''_in_Nv2_Delta2_star N2_Delta2_E1_disjoint have \\2''E1_empty: \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = []\"\n proof -\n from \\2''_in_Nv2_Delta2_star have \"\\2'' = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by (simp only: list_subset_iff_projection_neutral)\n hence \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>\"\n by simp\n moreover\n have \"\\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp only: projection_def, auto)\n with N2_Delta2_E1_disjoint have \"\\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = []\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\E1\\1''vE1\\1''_in_Tr1 \\E2\\2''vE2\\2''_in_Tr2 \\1''_in_E1_star \\2''_in_E2_star\n ultimately have \\\\1''\\2''v'E1\\1''_in_Tr1: \"(\\ @ \\1'' @ \\2'' @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\\\1''\\2''v'E2\\2''_in_Tr2: \"(\\ @ \\1'' @ \\2'' @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute list_subset_iff_projection_neutral, auto, \n simp only: projection_concatenation_commute list_subset_iff_projection_neutral, auto)\n\n have \"set (\\ @ \\1'' @ \\2'' @ [v']) \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n proof -\n from \\cv'\\_in_Tr have \"set \\ \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by (simp add: composeES_def)\n moreover\n note \\1''_in_E1_star \\2''_in_E2_star\n moreover\n from v'_in_Vv_inter_Nabla VIsViewOnE\n have \"v' \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n ultimately show ?thesis\n by (simp add: composeES_def, auto)\n qed\n moreover\n have \"set (\\ \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from \\E1\\1''vE1\\1''_in_Tr1 validES1 have \\1''_in_E1_star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E2\\2''vE2\\2''_in_Tr2 validES2 have \\2''_in_E2_star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n note \\\\1''\\2''v'E1\\1''_in_Tr1 \\\\1''\\2''v'E2\\2''_in_Tr2\n moreover \n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\1''Vv1_is_\\1'Vv1 \\1'Vv1_is_\\Vv1 propSepViews \n have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub>) = \\1'' \\ (E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\1''_in_E1_star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n have \"(\\ \\ V\\<^bsub>\\\\<^esub>) \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from \\2''Vv2_is_\\2'Vv2 \\2'Vv2_is_\\Vv2 propSepViews \n have \"\\ \\ (V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub>) = \\2'' \\ (E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>)\"\n unfolding properSeparationOfViews_def by (simp add: Int_commute)\n hence \"\\ \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def)\n with \\2''_in_E2_star show ?thesis\n by (simp add: list_subset_iff_projection_neutral)\n qed\n moreover\n note \\1''Cv1_empty \\2''Cv2_empty generalized_zipping_lemma\n ultimately obtain t\n where first: \"(\\ @ \\1'' @ \\2'' @ [v']) @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n and second: \"t \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub>\"\n and third: \"t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n \n from \\1''_in_Nv1_Delta1_star \\2''_in_Nv2_Delta2_star \n have \"set (\\1'' @ \\2'') \\ (N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n proof -\n have \"set (\\1'' @ \\2'') \\ \\\\<^bsub>\\\\<^esub>\"\n proof -\n from \\1''_in_Nv1_Delta1_star \\2''_in_Nv2_Delta2_star \n have \"set (\\1'' @ \\2'') \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub>\"\n by auto\n with Delta1_N1_Delta2_N2_subset_Delta show ?thesis\n by auto\n qed\n moreover\n have \"set (\\1'' @ \\2'') \\ N\\<^bsub>\\\\<^esub>\"\n proof -\n from \\1''_in_Nv1_Delta1_star \\2''_in_Nv2_Delta2_star \n have \"set (\\1'' @ \\2'') \\ (N\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub>)\"\n by auto\n with Nv1_union_Nv2_subsetof_Nv show ?thesis\n by auto\n qed\n ultimately show ?thesis\n by auto\n qed\n moreover\n from first have \"\\ @ (\\1'' @ \\2'') @ [v'] @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by auto\n moreover \n note second third\n ultimately have \"\\\\'. \\\\'. (set \\') \\ (N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>) \n \\ ((\\ @ \\' @ [v'] @ \\') \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ (\\' \\ V\\<^bsub>\\\\<^esub>) = (\\ \\ V\\<^bsub>\\\\<^esub>) \n \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by blast\n }\n thus ?thesis\n unfolding FCD_def\n by auto\nqed\n\n(* Theorem 6.4.1 case 5 *)\ntheorem compositionality_FCI: \n\"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub>; BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>;\n total ES1 (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>); total ES2 (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>);\n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n ( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>;\n (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {} \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\n \\ ( N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {} \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) ;\n FCI \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; FCI \\2 \\2 Tr\\<^bsub>ES2\\<^esub> \\ \n \\ FCI \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\nproof -\n assume BSD1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\" \n and BSD2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and BSIA1: \"BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSIA2: \"BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and total_ES1_C1_inter_Upsilon1: \"total ES1 (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n and total_ES2_C2_inter_Upsilon2: \"total ES2 (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and Nabla_inter_E1_subset_Nabla1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Nabla_inter_E2_subset_Nabla2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Upsilon_inter_E1_subset_Upsilon1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Upsilon_inter_E2_subset_Upsilon2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Delta1_N1_Delta2_N2_subset_Delta: \"( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>\"\n and very_long_asm: \"(N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {} \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\n \\ ( N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {} \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and FCI1: \"FCI \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and FCI2: \"FCI \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\ \\ c v'\n assume c_in_Cv_inter_Upsilon: \"c \\ (C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and v'_in_Vv_inter_Nabla: \"v' \\ (V\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and \\v'\\_in_Tr: \"(\\ @ [v'] @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\" \n and \\Cv_empty: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n\n from \\v'\\_in_Tr\n have \\v'\\_E1_in_Tr1: \"(((\\ @ [v']) @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\v'\\_E2_in_Tr2: \"(((\\ @ [v']) @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: composeES_def)+\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n from CSES1.BSD_in_subsystem2[OF \\v'\\_E1_in_Tr1 BSD1] obtain \\1'\n where \\v'E1\\1'_in_Tr1: \"(\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Vv1_is_\\Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n from CSES2.BSD_in_subsystem2[OF \\v'\\_E2_in_Tr2 BSD2] obtain \\2'\n where \\v'E2\\2'_in_Tr2: \"(\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Vv2_is_\\Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n\n note very_long_asm\n moreover {\n assume Nv1_inter_Delta1_inter_E2_empty: \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {}\" \n and Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1: \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n\n let ?ALPHA2''_DELTA2'' = \"\\ \\2'' \\2''. (\n set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = [])\"\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV2\n have \"c \\ E\\<^bsub>ES2\\<^esub> \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>) \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n\n from validES2 \\v'E2\\2'_in_Tr2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover \n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover \n from \\v'E2\\2'_in_Tr2 c_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover \n note \\2'Cv2_empty\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_notin_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews \n Upsilon_inter_E2_subset_Upsilon2\n have c_in_Cv2_inter_Upsilon2: \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n hence \"c \\ C\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from \\v'E2\\2'_in_Tr2 v'_notin_E2 have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\2'Cv2_empty\n moreover\n have \"(Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c)\" \n proof -\n from validES2 \\v'E2\\2'_in_Tr2 v'_notin_E2 have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def projection_concatenation_commute)\n with total_ES2_C2_inter_Upsilon2 c_in_Cv2_inter_Upsilon2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: total_def)\n thus ?thesis\n unfolding Adm_def\n by blast\n qed\n moreover \n note BSIA2\n ultimately obtain \\2''\n where one: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n from one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from one c_in_E2 v'_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover \n note two three\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_in_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E2_subset_Upsilon2\n have c_in_Cv2_inter_Upsilon2: \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E2 propSepViews v'_in_Vv_inter_Nabla Nabla_inter_E2_subset_Nabla2\n have \"v' \\ V\\<^bsub>\\2\\<^esub> \\ Nabla \\2\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E2 \\v'E2\\2'_in_Tr2 have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [v'] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\2'Cv2_empty FCI2\n ultimately obtain \\2'' \\2''\n where one: \"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\2'' @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCI_def\n by blast\n\n from two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n note one\n moreover\n from two c_in_E2 v'_in_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note three four\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n ultimately obtain \\2'' \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and \\2''_in_N2_inter_Delta2star:\"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2:\n \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by blast\n\n from c_in_Cv_inter_Upsilon Upsilon_inter_E1_subset_Upsilon1 \n propSepViews \n have cE1_in_Cv1_inter_Upsilon1: \"set ([c] \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_def, auto)\n \n from \\2''_in_N2_inter_Delta2star Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1 \n propSepViews disjoint_Nv2_Vv1 \n have \\2''E1_in_Cv1_inter_Upsilon1star: \"set (\\2'' \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from \\2''_in_N2_inter_Delta2star \n have eq: \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (metis Int_commute Int_left_commute Int_lower1 Int_lower2 \n projection_intersection_neutral subset_trans)\n \n from validV1 Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1 propSepViews\n disjoint_Nv2_Vv1 \n have \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add:isViewOn_def V_valid_def VC_disjoint_def\n VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (subst eq, simp only: projection_def, auto)\n qed\n \n have c\\2''E1_in_Cv1_inter_Upsilon1star: \"set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from cE1_in_Cv1_inter_Upsilon1 \\2''E1_in_Cv1_inter_Upsilon1star\n have \"set (([c] @ \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n thus ?thesis\n by auto\n qed\n\n\n have \"\\ \\1'' \\1''. set \\1'' \\ E\\<^bsub>ES1\\<^esub> \n \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\n\\<^esub> \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof cases\n assume v'_in_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n with Nabla_inter_E1_subset_Nabla1 propSepViews v'_in_Vv_inter_Nabla\n have v'_in_Vv1_inter_Nabla1: \"v' \\ V\\<^bsub>\\1\\<^esub> \\ Nabla \\1\"\n unfolding properSeparationOfViews_def by auto\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub> ; \n \\1' \\ C\\<^bsub>\\1\\<^esub> = []; set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ \n \\ \\ \\1'' \\1''. (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>)\"\n proof (induct \"length ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>)\" arbitrary: \\ \\1' c \\2'')\n case 0\n\n from 0(2) validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n and c\\2''_is_\\c'\\: \"c # \\2'' = \\ @ [c'] @ \\\"\n and \\E1_empty: \"\\ \\ E\\<^bsub>ES1\\<^esub> = []\"\n and n_is_length_\\\\E1: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E1 c\\2''_is_\\c'\\ \n have \"set (\\ \\ E\\<^bsub>ES1\\<^esub> @ [c']) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n projection_def, auto)\n hence c'_in_Cv1_inter_Upsilon1: \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n hence c'_in_Cv1: \"c' \\ C\\<^bsub>\\1\\<^esub>\" and c'_in_Upsilon1: \"c' \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we apply FCI in this case *)\n with c\\2''_is_\\c'\\ have c_is_c': \"c = c'\" and \\2''_is_\\: \"\\2'' = \\\"\n by auto\n with c'_in_Cv1_inter_Upsilon1 have \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note v'_in_Vv1_inter_Nabla1\n moreover\n from v'_in_E1 Suc(3) have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [v'] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4) FCI1\n ultimately obtain \\1'' \\\n where one: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\ @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCI_def\n by blast\n\n (* we choose \\1'' = \\ \\ E\\<^bsub>ES1\\<^esub> @ \\ *)\n let ?DELTA1'' = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\\"\n\n from two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from one \\E1_empty \n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from c_is_c' c'_in_E1 have \"[c] = [c] \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from v'_in_E1 have \"[v'] = [v'] \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\E1_empty two\n ultimately show ?thesis\n by auto\n qed\n moreover\n note three four\n moreover\n have \"?DELTA1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n have \"\\ \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = []\"\n proof -\n from validV1 have \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = {}\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with projection_intersection_neutral[OF one, of \"C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"]\n show ?thesis\n by (simp add: projection_def)\n qed\n with \\2''_is_\\ \\E1_empty show ?thesis\n by (simp add: projection_concatenation_commute)\n qed\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* we apply the inductive hypothesis in this case *)\n with c\\2''_is_\\c'\\ have \\_is_c_xs: \"\\ = [c] @ xs\" \n and \\2''_is_xs_c'_\\: \"\\2'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E1 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\2''_is_\\c'\\ \\_is_c_xs \\E1_empty\n show ?thesis\n by (subst res, simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\2''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover note Suc(1)[of c \"xs @ \\\" \\ \\1']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\1\\<^esub> = []\"\n and six: \"\\ \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = (xs @ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n (* apply FCI to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\\"\n\n note c'_in_Cv1_inter_Upsilon1 v'_in_Vv1_inter_Nabla1\n moreover\n from three v'_in_E1 have \"?BETA @ [v'] @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five FCI1\n ultimately obtain \\1'' \\'\n where fci_one: \"set \\' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and fci_two: \"?BETA @ [c'] @ \\' @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and fci_three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and fci_four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCI_def\n by blast\n \n let ?DELTA1'' = \"\\ @ [c'] @ \\'\"\n\n from fci_two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with two fci_one show ?thesis\n by auto\n qed\n moreover\n from fci_two v'_in_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from fci_three four have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note fci_four\n moreover \n have \"?DELTA1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n have \"\\' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = []\"\n proof -\n from fci_one have \"\\ e \\ set \\'. e \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have \"\\ e \\ set \\'. e \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (simp add: projection_def)\n qed\n with c'_in_E1 c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \\E1_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E1\\1'_in_Tr1 \\1'Cv1_empty c\\2''E1_in_Cv1_inter_Upsilon1star \n c_in_Cv_inter_Upsilon \\2''_in_N2_inter_Delta2star]\n obtain \\1'' \\1''\n where one: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n and four: \"\\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n note one two three\n moreover\n have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\" \n proof -\n from projection_intersection_neutral[OF two, of \"E\\<^bsub>ES2\\<^esub>\"] \n Nv1_inter_Delta1_inter_E2_empty validV2 \n have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp only: Int_Un_distrib2, auto)\n moreover\n from validV2 \n have \"C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by simp\n hence \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by (simp add: projection_def)\n with four have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub> \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by simp\n hence \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_commute)\n with \\2''_in_N2_inter_Delta2star show ?thesis\n by (simp only: list_subset_iff_projection_neutral)\n qed\n ultimately show ?thesis\n by blast\n next\n assume v'_notin_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub> ; \n \\1' \\ C\\<^bsub>\\1\\<^esub> = []; set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ \n \\ \\ \\1'' \\1''. (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \n \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\n\\<^esub> \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>)\"\n proof (induct \"length ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>)\" arbitrary: \\ \\1' c \\2'')\n case 0\n\n from 0(2) validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n and c\\2''_is_\\c'\\: \"c # \\2'' = \\ @ [c'] @ \\\"\n and \\E1_empty: \"\\ \\ E\\<^bsub>ES1\\<^esub> = []\"\n and n_is_length_\\\\E1: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E1 c\\2''_is_\\c'\\ \n have \"set (\\ \\ E\\<^bsub>ES1\\<^esub> @ [c']) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n projection_def, auto)\n hence c'_in_Cv1_inter_Upsilon1: \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n hence c'_in_Cv1: \"c' \\ C\\<^bsub>\\1\\<^esub>\" and c'_in_Upsilon1: \"c' \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we just apply BSIA in this case *)\n with c\\2''_is_\\c'\\ have c_is_c': \"c = c'\" \n and \\2''_is_\\: \"\\2'' = \\\"\n by auto\n with c'_in_Cv1_inter_Upsilon1 have \"c \\ C\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n from v'_notin_E1 Suc(3) have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c\"\n proof -\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from c_is_c' c'_in_Cv1_inter_Upsilon1 \n have \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n from validES1 Suc(3) \n have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: ES_valid_def traces_prefixclosed_def\n projection_concatenation_commute \n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES1_C1_inter_Upsilon1\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA1\n ultimately obtain \\1''\n where one: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n let ?DELTA1'' = \"\\ \\ E\\<^bsub>ES1\\<^esub>\"\n\n from one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E1_empty\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n from c_is_c' c'_in_E1 one v'_notin_E1 \\E1_empty\n have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note two three\n moreover\n from \\E1_empty \\2''_is_\\ have \"?DELTA1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* apply inductive hypothesis, then BSIA *)\n with c\\2''_is_\\c'\\\n have \\_is_c_xs: \"\\ = [c] @ xs\" and \\2''_is_xs_c'_\\: \"\\2'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E1 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\2''_is_\\c'\\ \\_is_c_xs \\E1_empty\n show ?thesis\n by (subst res, simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\2''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover note Suc(1)[of c \"xs @ \\\" \\ \\1']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\1\\<^esub> = []\"\n and six: \"\\ \\ E\\<^bsub>ES2\\<^esub> = (xs @ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n \n (* apply BSIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\\"\n\n from c'_in_Cv1_inter_Upsilon1 have \"c' \\ C\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from three v'_notin_E1 have \"?BETA @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from validES1 three \n have \"?BETA \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: ES_valid_def traces_prefixclosed_def\n projection_concatenation_commute \n prefixclosed_def prefix_def, auto)\n moreover\n note c'_in_Cv1_inter_Upsilon1 total_ES1_C1_inter_Upsilon1\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA1\n ultimately obtain \\1''\n where bsia_one: \"?BETA @ [c'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and bsia_two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and bsia_three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n let ?DELTA1'' = \"\\ @ [c']\"\n\n from bsia_one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add:isViewOn_def ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with two show ?thesis\n by auto\n qed\n moreover\n from bsia_one v'_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from bsia_two four have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note bsia_three\n moreover \n have \"?DELTA1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n from validV2 Suc(7) \\2''_is_xs_c'_\\ \n have \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with c'_in_E1 c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \\E1_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E1\\1'_in_Tr1 \\1'Cv1_empty c\\2''E1_in_Cv1_inter_Upsilon1star \n c_in_Cv_inter_Upsilon \\2''_in_N2_inter_Delta2star]\n show ?thesis \n by blast\n qed\n then obtain \\1'' \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and \\1''_in_N1_inter_Delta1star:\"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1: \n \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n and \\1''E2_is_\\2''E1: \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \n validES1 validES2\n have \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\" and \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp_all add: ES_valid_def traces_contain_events_def, auto)\n with \\1''E2_is_\\2''E1 merge_property[of \\1'' \"E\\<^bsub>ES1\\<^esub>\" \\2'' \"E\\<^bsub>ES2\\<^esub>\"] obtain \\'\n where \\'E1_is_\\1'': \"\\' \\ E\\<^bsub>ES1\\<^esub> = \\1''\"\n and \\'E2_is_\\2'': \"\\' \\ E\\<^bsub>ES2\\<^esub> = \\2''\"\n and \\'_contains_only_\\1''_\\2''_events: \"set \\' \\ set \\1'' \\ set \\2''\"\n unfolding Let_def\n by auto\n\n let ?TAU = \"\\ @ [c] @ \\' @ [v']\"\n let ?LAMBDA = \"\\ \\ V\\<^bsub>\\\\<^esub>\"\n let ?T1 = \\1''\n let ?T2 = \\2''\n\n (* apply the generalized zipping lemma *)\n have \"?TAU \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n proof -\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' validES1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\' \\ E\\<^bsub>ES1\\<^esub> @ [v'] \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover \n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' validES2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\' \\ E\\<^bsub>ES2\\<^esub> @ [v'] \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from \\v'\\_in_Tr c_in_Cv_inter_Upsilon VIsViewOnE\n \\'_contains_only_\\1''_\\2''_events \\1''_in_E1star \\2''_in_E2star\n have \"set (\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>\"\n unfolding composeES_def isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def\n by auto\n ultimately show ?thesis\n unfolding composeES_def\n by auto\n qed \n hence \"set ?TAU \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding composeES_def\n by auto\n moreover\n have \"set ?LAMBDA \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\1''_in_E1star \\2''_in_E2star\n moreover\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' \n have \"?TAU \\ E\\<^bsub>ES1\\<^esub> @ ?T1 \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' \n have \"?TAU \\ E\\<^bsub>ES2\\<^esub> @ ?T2 \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = ?T1 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_sequence)\n moreover\n from \\1''_in_E1star propSepViews \n have \"?T1 \\ V\\<^bsub>\\\\<^esub> = ?T1 \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def \n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1''Vv1_is_\\1'Vv1\n ultimately show ?thesis\n by simp\n qed\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = ?T2 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews \n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_sequence)\n moreover\n from \\2''_in_E2star propSepViews \n have \"?T2 \\ V\\<^bsub>\\\\<^esub> = ?T2 \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2''Vv2_is_\\2'Vv2\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\1''Cv1_empty \\2''Cv2_empty generalized_zipping_lemma\n ultimately obtain t (* show that the conclusion of FCI holds *)\n where \"?TAU @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n and \"t \\ V\\<^bsub>\\\\<^esub> = ?LAMBDA\"\n and \"t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n moreover\n have \"set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>\"\n proof -\n from \\'_contains_only_\\1''_\\2''_events \n \\1''_in_N1_inter_Delta1star \\2''_in_N2_inter_Delta2star\n have \"set \\' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with Delta1_N1_Delta2_N2_subset_Delta Nv1_union_Nv2_subsetof_Nv \n show ?thesis\n by auto\n qed\n ultimately\n have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by (simp only: append_assoc, blast)\n }\n moreover {\n assume Nv2_inter_Delta2_inter_E1_empty: \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {}\" \n and Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2: \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n\n let ?ALPHA1''_DELTA1'' = \"\\ \\1'' \\1''. (\n set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = [])\"\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV1\n have \"c \\ E\\<^bsub>ES1\\<^esub> \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>) \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n\n from validES1 \\v'E1\\1'_in_Tr1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover \n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover \n from \\v'E1\\1'_in_Tr1 c_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover \n note \\1'Cv1_empty\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_notin_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1\n have c_in_Cv1_inter_Upsilon1: \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n hence \"c \\ C\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from \\v'E1\\1'_in_Tr1 v'_notin_E1 have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\1'Cv1_empty\n moreover\n have \"(Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c)\" \n proof -\n from validES1 \\v'E1\\1'_in_Tr1 v'_notin_E1 have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def projection_concatenation_commute)\n with total_ES1_C1_inter_Upsilon1 c_in_Cv1_inter_Upsilon1\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: total_def)\n thus ?thesis\n unfolding Adm_def\n by blast\n qed\n moreover \n note BSIA1\n ultimately obtain \\1''\n where one: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n from one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from one c_in_E1 v'_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover \n note two three\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_in_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1\n have c_in_Cv1_inter_Upsilon1: \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E1 propSepViews v'_in_Vv_inter_Nabla Nabla_inter_E1_subset_Nabla1\n have \"v' \\ V\\<^bsub>\\1\\<^esub> \\ Nabla \\1\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E1 \\v'E1\\1'_in_Tr1 have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [v'] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\1'Cv1_empty FCI1\n ultimately obtain \\1'' \\1''\n where one: \"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\1'' @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCI_def\n by blast\n\n from two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n note one\n moreover\n from two c_in_E1 v'_in_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note three four\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n ultimately obtain \\1'' \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and \\1''_in_N1_inter_Delta1star:\"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1: \n \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by blast\n\n from c_in_Cv_inter_Upsilon Upsilon_inter_E2_subset_Upsilon2 propSepViews \n have cE2_in_Cv2_inter_Upsilon2: \"set ([c] \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_def, auto)\n \n from \\1''_in_N1_inter_Delta1star Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2 \n propSepViews disjoint_Nv1_Vv2 \n have \\1''E2_in_Cv2_inter_Upsilon2star: \"set (\\1'' \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from \\1''_in_N1_inter_Delta1star have eq: \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (metis Int_commute Int_left_commute Int_lower2 Int_lower1 \n projection_intersection_neutral subset_trans)\n \n from validV2 Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2 \n propSepViews disjoint_Nv1_Vv2 \n have \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (subst eq, simp only: projection_def, auto)\n qed\n \n have c\\1''E2_in_Cv2_inter_Upsilon2star: \"set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from cE2_in_Cv2_inter_Upsilon2 \\1''E2_in_Cv2_inter_Upsilon2star\n have \"set (([c] @ \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n thus ?thesis\n by auto\n qed\n\n\n have \"\\ \\2'' \\2''. set \\2'' \\ E\\<^bsub>ES2\\<^esub> \n \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof cases\n assume v'_in_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n with Nabla_inter_E2_subset_Nabla2 \n propSepViews v'_in_Vv_inter_Nabla\n have v'_in_Vv2_inter_Nabla2: \"v' \\ V\\<^bsub>\\2\\<^esub> \\ Nabla \\2\"\n unfolding properSeparationOfViews_def by auto\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub> ; \n \\2' \\ C\\<^bsub>\\2\\<^esub> = []; set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ \n \\ \\ \\2'' \\2''. (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \n \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>)\"\n proof (induct \"length ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>)\" arbitrary: \\ \\2' c \\1'')\n case 0\n\n from 0(2) validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n and c\\1''_is_\\c'\\: \"c # \\1'' = \\ @ [c'] @ \\\"\n and \\E2_empty: \"\\ \\ E\\<^bsub>ES2\\<^esub> = []\"\n and n_is_length_\\\\E2: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E2 c\\1''_is_\\c'\\ \n have \"set (\\ \\ E\\<^bsub>ES2\\<^esub> @ [c']) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: c\\1''_is_\\c'\\ projection_concatenation_commute \n projection_def, auto)\n hence c'_in_Cv2_inter_Upsilon2: \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n hence c'_in_Cv2: \"c' \\ C\\<^bsub>\\2\\<^esub>\" and c'_in_Upsilon2: \"c' \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we apply FCI in this case *)\n with c\\1''_is_\\c'\\ have c_is_c': \"c = c'\" and \\1''_is_\\: \"\\1'' = \\\"\n by auto\n with c'_in_Cv2_inter_Upsilon2 have \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note v'_in_Vv2_inter_Nabla2\n moreover\n from v'_in_E2 Suc(3) have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [v'] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4) FCI2\n ultimately obtain \\2'' \\\n where one: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\ @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCI_def\n by blast\n\n (* we choose \\2'' = \\ \\ E\\<^bsub>ES2\\<^esub> @ \\ *)\n let ?DELTA2'' = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\\"\n\n from two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from one \\E2_empty\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from c_is_c' c'_in_E2 have \"[c] = [c] \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from v'_in_E2 have \"[v'] = [v'] \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\E2_empty two\n ultimately show ?thesis\n by auto\n qed\n moreover\n note three four\n moreover\n have \"?DELTA2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n have \"\\ \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = []\"\n proof -\n from validV2 have \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = {}\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with projection_intersection_neutral[OF one, of \"C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"]\n show ?thesis\n by (simp add: projection_def)\n qed\n with \\1''_is_\\ \\E2_empty show ?thesis\n by (simp add: projection_concatenation_commute)\n qed\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* we apply the inductive hypothesis in this case *)\n with c\\1''_is_\\c'\\ have \\_is_c_xs: \"\\ = [c] @ xs\" \n and \\1''_is_xs_c'_\\: \"\\1'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E2 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\1''_is_\\c'\\ \\_is_c_xs \\E2_empty\n show ?thesis\n by (subst res, simp only: c\\1''_is_\\c'\\ \n projection_concatenation_commute set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\1''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover note Suc(1)[of c \"xs @ \\\" \\ \\2']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\2\\<^esub> = []\"\n and six: \"\\ \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = (xs @ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n (* apply FCI to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\\"\n\n note c'_in_Cv2_inter_Upsilon2 v'_in_Vv2_inter_Nabla2\n moreover\n from three v'_in_E2 have \"?BETA @ [v'] @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five FCI2\n ultimately obtain \\2'' \\'\n where fci_one: \"set \\' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and fci_two: \"?BETA @ [c'] @ \\' @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and fci_three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and fci_four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCI_def\n by blast\n \n let ?DELTA2'' = \"\\ @ [c'] @ \\'\"\n\n from fci_two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with two fci_one show ?thesis\n by auto\n qed\n moreover\n from fci_two v'_in_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from fci_three four have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note fci_four\n moreover \n have \"?DELTA2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n have \"\\' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = []\"\n proof -\n from fci_one have \"\\ e \\ set \\'. e \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have \"\\ e \\ set \\'. e \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (simp add: projection_def)\n qed\n with c'_in_E2 c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \\E2_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E2\\2'_in_Tr2 \\2'Cv2_empty c\\1''E2_in_Cv2_inter_Upsilon2star \n c_in_Cv_inter_Upsilon \\1''_in_N1_inter_Delta1star]\n obtain \\2'' \\2''\n where one: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n and four: \"\\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n note one two three\n moreover\n have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\" \n proof -\n from projection_intersection_neutral[OF two, of \"E\\<^bsub>ES1\\<^esub>\"] \n Nv2_inter_Delta2_inter_E1_empty validV1 \n have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp only: Int_Un_distrib2, auto)\n moreover\n from validV1 \n have \"C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by simp\n hence \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by (simp add: projection_def)\n with four have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub> \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by simp\n hence \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_commute)\n with \\1''_in_N1_inter_Delta1star show ?thesis\n by (simp only: list_subset_iff_projection_neutral)\n qed\n ultimately show ?thesis\n by blast\n next\n assume v'_notin_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n have \n \"\\ (\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub> ; \\2' \\ C\\<^bsub>\\2\\<^esub> = []; \n set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> ; c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ;\n set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ \n \\ \\ \\2'' \\2''.\n (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2 \\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>)\"\n proof (induct \"length ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>)\" arbitrary: \\ \\2' c \\1'')\n case 0\n\n from 0(2) validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n and c\\1''_is_\\c'\\: \"c # \\1'' = \\ @ [c'] @ \\\"\n and \\E2_empty: \"\\ \\ E\\<^bsub>ES2\\<^esub> = []\"\n and n_is_length_\\\\E2: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E2 c\\1''_is_\\c'\\ have \"set (\\ \\ E\\<^bsub>ES2\\<^esub> @ [c']) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: c\\1''_is_\\c'\\ projection_concatenation_commute projection_def, auto)\n hence c'_in_Cv2_inter_Upsilon2: \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n hence c'_in_Cv2: \"c' \\ C\\<^bsub>\\2\\<^esub>\" and c'_in_Upsilon2: \"c' \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def\n VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we just apply BSIA in this case *)\n with c\\1''_is_\\c'\\ have c_is_c': \"c = c'\" and \\1''_is_\\: \"\\1'' = \\\"\n by auto\n with c'_in_Cv2_inter_Upsilon2 have \"c \\ C\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n from v'_notin_E2 Suc(3) have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c\"\n proof -\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from c_is_c' c'_in_Cv2_inter_Upsilon2 have \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n from validES2 Suc(3) have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: ES_valid_def traces_prefixclosed_def\n projection_concatenation_commute \n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES2_C2_inter_Upsilon2\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA2\n ultimately obtain \\2''\n where one: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n let ?DELTA2'' = \"\\ \\ E\\<^bsub>ES2\\<^esub>\"\n\n from one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E2_empty\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n from c_is_c' c'_in_E2 one v'_notin_E2 \\E2_empty\n have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note two three\n moreover\n from \\E2_empty \\1''_is_\\ have \"?DELTA2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* apply inductive hypothesis, then BSIA *)\n with c\\1''_is_\\c'\\ have \\_is_c_xs: \"\\ = [c] @ xs\" \n and \\1''_is_xs_c'_\\: \"\\1'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E2 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\1''_is_\\c'\\ \\_is_c_xs \\E2_empty\n show ?thesis\n by (subst res, simp only: c\\1''_is_\\c'\\ projection_concatenation_commute \n set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\1''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover note Suc(1)[of c \"xs @ \\\" \\ \\2']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\2\\<^esub> = []\"\n and six: \"\\ \\ E\\<^bsub>ES1\\<^esub> = (xs @ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n \n (* apply BSIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\\"\n\n from c'_in_Cv2_inter_Upsilon2 have \"c' \\ C\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from three v'_notin_E2 have \"?BETA @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from validES2 three have \"?BETA \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: ES_valid_def traces_prefixclosed_def\n projection_concatenation_commute prefixclosed_def prefix_def, auto)\n moreover\n note c'_in_Cv2_inter_Upsilon2 total_ES2_C2_inter_Upsilon2\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA2\n ultimately obtain \\2''\n where bsia_one: \"?BETA @ [c'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and bsia_two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and bsia_three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n let ?DELTA2'' = \"\\ @ [c']\"\n\n from bsia_one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with two show ?thesis\n by auto\n qed\n moreover\n from bsia_one v'_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from bsia_two four have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note bsia_three\n moreover \n have \"?DELTA2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n from validV1 Suc(7) \\1''_is_xs_c'_\\ have \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with c'_in_E2 c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \\E2_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute \n projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E2\\2'_in_Tr2 \\2'Cv2_empty c\\1''E2_in_Cv2_inter_Upsilon2star \n c_in_Cv_inter_Upsilon \\1''_in_N1_inter_Delta1star]\n show ?thesis \n by blast\n qed\n then obtain \\2'' \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and \\2''_in_N2_inter_Delta2star:\"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2: \n \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n and \\2''E1_is_\\1''E2: \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \n validES2 validES1\n have \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\" and \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp_all add: ES_valid_def traces_contain_events_def, auto)\n with \\2''E1_is_\\1''E2 merge_property[of \\2'' \"E\\<^bsub>ES2\\<^esub>\" \\1'' \"E\\<^bsub>ES1\\<^esub>\"] obtain \\'\n where \\'E2_is_\\2'': \"\\' \\ E\\<^bsub>ES2\\<^esub> = \\2''\"\n and \\'E1_is_\\1'': \"\\' \\ E\\<^bsub>ES1\\<^esub> = \\1''\"\n and \\'_contains_only_\\2''_\\1''_events: \"set \\' \\ set \\2'' \\ set \\1''\"\n unfolding Let_def\n by auto\n\n let ?TAU = \"\\ @ [c] @ \\' @ [v']\"\n let ?LAMBDA = \"\\ \\ V\\<^bsub>\\\\<^esub>\"\n let ?T2 = \\2''\n let ?T1 = \\1''\n\n (* apply the generalized zipping lemma *)\n have \"?TAU \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n proof -\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' validES2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\' \\ E\\<^bsub>ES2\\<^esub> @ [v'] \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover \n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' validES1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\' \\ E\\<^bsub>ES1\\<^esub> @ [v'] \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from \\v'\\_in_Tr c_in_Cv_inter_Upsilon VIsViewOnE \\'_contains_only_\\2''_\\1''_events \n \\2''_in_E2star \\1''_in_E1star\n have \"set (\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>\"\n unfolding composeES_def isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def\n by auto\n ultimately show ?thesis\n unfolding composeES_def\n by auto\n qed \n hence \"set ?TAU \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding composeES_def\n by auto\n moreover\n have \"set ?LAMBDA \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\2''_in_E2star \\1''_in_E1star\n moreover\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' \n have \"?TAU \\ E\\<^bsub>ES2\\<^esub> @ ?T2 \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' \n have \"?TAU \\ E\\<^bsub>ES1\\<^esub> @ ?T1 \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = ?T2 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews \n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp only: projection_sequence)\n moreover\n from \\2''_in_E2star propSepViews\n have \"?T2 \\ V\\<^bsub>\\\\<^esub> = ?T2 \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2''Vv2_is_\\2'Vv2\n ultimately show ?thesis\n by simp\n qed\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = ?T1 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews\n have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_sequence)\n moreover\n from \\1''_in_E1star propSepViews\n have \"?T1 \\ V\\<^bsub>\\\\<^esub> = ?T1 \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def \n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1''Vv1_is_\\1'Vv1\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\2''Cv2_empty \\1''Cv1_empty generalized_zipping_lemma\n ultimately obtain t (* show that the conclusion of FCI holds *)\n where \"?TAU @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n and \"t \\ V\\<^bsub>\\\\<^esub> = ?LAMBDA\"\n and \"t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n moreover\n have \"set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>\"\n proof -\n from \\'_contains_only_\\2''_\\1''_events \\2''_in_N2_inter_Delta2star\n \\1''_in_N1_inter_Delta1star\n have \"set \\' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with Delta1_N1_Delta2_N2_subset_Delta Nv1_union_Nv2_subsetof_Nv show ?thesis\n by auto\n qed\n ultimately have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by (simp only: append_assoc, blast)\n }\n ultimately have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by blast\n }\n thus ?thesis\n unfolding FCI_def\n by blast\nqed\n\n\n(* Theorem 6.4.1 case 6 *)\ntheorem compositionality_FCIA: \n \"\\ BSD \\1 Tr\\<^bsub>ES1\\<^esub>; BSD \\2 Tr\\<^bsub>ES2\\<^esub>; BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>;\n (\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>; (\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub>;\n total ES1 (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>); total ES2 (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>);\n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>; \\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n ( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>;\n (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {} \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\n \\ ( N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {} \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) ;\n FCIA \\1 \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; FCIA \\2 \\2 \\2 Tr\\<^bsub>ES2\\<^esub> \\ \n \\ FCIA \\ \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\nproof -\n assume BSD1: \"BSD \\1 Tr\\<^bsub>ES1\\<^esub>\" \n and BSD2: \"BSD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and BSIA1: \"BSIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and BSIA2: \"BSIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and \\1v1_subset_\\v_inter_E1: \"(\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n and \\2v2_subset_\\v_inter_E2: \"(\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n and total_ES1_C1_inter_Upsilon1_inter_N2_inter_Delta2: \n \"total ES1 (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and total_ES2_C2_inter_Upsilon2_inter_N1_inter_Delta1: \n \"total ES2 (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n and Nabla_inter_E1_subset_Nabla1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Nabla_inter_E2_subset_Nabla2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Upsilon_inter_E1_subset_Upsilon1: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and Upsilon_inter_E2_subset_Upsilon2: \"\\\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and Delta1_N1_Delta2_N2_subset_Delta: \"( \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub> ) \\ \\\\<^bsub>\\\\<^esub>\"\n and very_long_asm: \"(N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {} \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\n \\ ( N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {} \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n and FCIA1: \"FCIA \\1 \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and FCIA2: \"FCIA \\2 \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\ \\ c v'\n assume c_in_Cv_inter_Upsilon: \"c \\ (C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and v'_in_Vv_inter_Nabla: \"v' \\ (V\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>)\"\n and \\v'\\_in_Tr: \"(\\ @ [v'] @ \\) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\" \n and \\Cv_empty: \"\\ \\ C\\<^bsub>\\\\<^esub> = []\"\n and Adm: \"Adm \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ c\"\n\n interpret CSES1: CompositionSupport \"ES1\" \"\\\" \"\\1\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES1 validV1)\n\n interpret CSES2: CompositionSupport \"ES2\" \"\\\" \"\\2\"\n using propSepViews unfolding properSeparationOfViews_def \n by (simp add: CompositionSupport_def validES2 validV2)\n\n from \\v'\\_in_Tr\n have \\v'\\_E1_in_Tr1: \"(((\\ @ [v']) @ \\) \\ E\\<^bsub>ES1\\<^esub>) \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\v'\\_E2_in_Tr2: \"(((\\ @ [v']) @ \\) \\ E\\<^bsub>ES2\\<^esub>) \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: composeES_def)+ \n\n from CSES1.BSD_in_subsystem2[OF \\v'\\_E1_in_Tr1 BSD1] obtain \\1'\n where \\v'E1\\1'_in_Tr1: \"(\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Vv1_is_\\Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by auto\n\n from CSES2.BSD_in_subsystem2[OF \\v'\\_E2_in_Tr2 BSD2] obtain \\2'\n where \\v'E2\\2'_in_Tr2: \"(\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Vv2_is_\\Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by auto\n\n note very_long_asm\n moreover {\n assume Nv1_inter_Delta1_inter_E2_empty: \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = {}\" \n and Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1: \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n\n let ?ALPHA2''_DELTA2'' = \"\\ \\2'' \\2''. (\n set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = [])\"\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV2\n have \"c \\ E\\<^bsub>ES2\\<^esub> \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>) \\ (c \\ E\\<^bsub>ES2\\<^esub> \\ v' \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp add: V_valid_def isViewOn_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n\n from validES2 \\v'E2\\2'_in_Tr2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover \n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover \n from \\v'E2\\2'_in_Tr2 c_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover \n note \\2'Cv2_empty\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_notin_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E2_subset_Upsilon2\n have c_in_Cv2_inter_Upsilon2: \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n hence \"c \\ C\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from \\v'E2\\2'_in_Tr2 v'_notin_E2 have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\2'Cv2_empty\n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c\"\n proof -\n from Adm obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_in_E2 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\2v2_subset_\\v_inter_E2 have \"\\ \\ (\\2 \\2) = \\ \\ (\\2 \\2)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover \n note BSIA2\n ultimately obtain \\2''\n where one: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n from one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from one c_in_E2 v'_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover \n note two three\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n moreover {\n assume c_in_E2: \"c \\ E\\<^bsub>ES2\\<^esub>\"\n and v'_in_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n from c_in_E2 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E2_subset_Upsilon2\n have c_in_Cv2_inter_Upsilon2: \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E2 propSepViews v'_in_Vv_inter_Nabla Nabla_inter_E2_subset_Nabla2\n have \"v' \\ V\\<^bsub>\\2\\<^esub> \\ Nabla \\2\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E2 \\v'E2\\2'_in_Tr2 have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [v'] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\2'Cv2_empty \n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c\"\n proof -\n from Adm obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_in_E2 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\2v2_subset_\\v_inter_E2 have \"\\ \\ (\\2 \\2) = \\ \\ (\\2 \\2)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note FCIA2\n ultimately obtain \\2'' \\2''\n where one: \"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\2'' @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n\n from two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n note one\n moreover\n from two c_in_E2 v'_in_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note three four\n ultimately have ?ALPHA2''_DELTA2''\n by blast\n }\n ultimately obtain \\2'' \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and \\2''_in_N2_inter_Delta2star:\"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2:\n \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n by blast\n\n from c_in_Cv_inter_Upsilon Upsilon_inter_E1_subset_Upsilon1 propSepViews\n have cE1_in_Cv1_inter_Upsilon1: \"set ([c] \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_def, auto)\n \n from \\2''_in_N2_inter_Delta2star Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1 \n propSepViews disjoint_Nv2_Vv1 \n have \\2''E1_in_Cv1_inter_Upsilon1star: \"set (\\2'' \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from \\2''_in_N2_inter_Delta2star\n have eq: \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (metis Int_commute Int_left_commute Int_lower1 Int_lower2 \n projection_intersection_neutral subset_trans)\n \n from validV1 Nv2_inter_Delta2_inter_E1_subsetof_Upsilon1 \n propSepViews disjoint_Nv2_Vv1 \n have \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def \n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (subst eq, simp only: projection_def, auto)\n qed\n \n have c\\2''E1_in_Cv1_inter_Upsilon1star: \"set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from cE1_in_Cv1_inter_Upsilon1 \\2''E1_in_Cv1_inter_Upsilon1star\n have \"set (([c] @ \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n thus ?thesis\n by auto\n qed\n\n\n have \n \"\\ \\1'' \\1''. set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof cases\n assume v'_in_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n with Nabla_inter_E1_subset_Nabla1 propSepViews v'_in_Vv_inter_Nabla\n have v'_in_Vv1_inter_Nabla1: \"v' \\ V\\<^bsub>\\1\\<^esub> \\ Nabla \\1\"\n unfolding properSeparationOfViews_def by auto\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub> ; \n \\1' \\ C\\<^bsub>\\1\\<^esub> = []; set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n Adm \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ c \\ \n \\ \\ \\1'' \\1''.\n (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>)\"\n proof (induct \"length ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>)\" arbitrary: \\ \\1' c \\2'')\n case 0\n\n from 0(2) validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n and c\\2''_is_\\c'\\: \"c # \\2'' = \\ @ [c'] @ \\\"\n and \\E1_empty: \"\\ \\ E\\<^bsub>ES1\\<^esub> = []\"\n and n_is_length_\\\\E1: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E1 c\\2''_is_\\c'\\ have \"set (\\ \\ E\\<^bsub>ES1\\<^esub> @ [c']) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n projection_def, auto)\n hence c'_in_Cv1_inter_Upsilon1: \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n hence c'_in_Cv1: \"c' \\ C\\<^bsub>\\1\\<^esub>\" and c'_in_Upsilon1: \"c' \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we apply FCIA in this case *)\n with c\\2''_is_\\c'\\ have c_is_c': \"c = c'\" and \\2''_is_\\: \"\\2'' = \\\"\n by auto\n with c'_in_Cv1_inter_Upsilon1 have \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note v'_in_Vv1_inter_Nabla1\n moreover\n from v'_in_E1 Suc(3) have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [v'] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c\"\n proof -\n from Suc(8) obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_is_c' c'_in_E1 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\1v1_subset_\\v_inter_E1 have \"\\ \\ (\\1 \\1) = \\ \\ (\\1 \\1)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note FCIA1\n ultimately obtain \\1'' \\\n where one: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\ @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n\n (* we choose \\1'' = \\ \\ E\\<^bsub>ES1\\<^esub> @ \\ *)\n let ?DELTA1'' = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\\" \n \n from two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from one \\E1_empty\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from c_is_c' c'_in_E1 have \"[c] = [c] \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from v'_in_E1 have \"[v'] = [v'] \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\E1_empty two\n ultimately show ?thesis\n by auto\n qed\n moreover\n note three four\n moreover\n have \"?DELTA1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n have \"\\ \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = []\"\n proof -\n from validV1 have \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = {}\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with projection_intersection_neutral[OF one, of \"C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"]\n show ?thesis\n by (simp add: projection_def)\n qed\n with \\2''_is_\\ \\E1_empty show ?thesis\n by (simp add: projection_concatenation_commute)\n qed\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* we apply the inductive hypothesis in this case *)\n with c\\2''_is_\\c'\\\n have \\_is_c_xs: \"\\ = [c] @ xs\" and \\2''_is_xs_c'_\\: \"\\2'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E1 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\2''_is_\\c'\\ \\_is_c_xs \\E1_empty\n show ?thesis\n by (subst res, simp only: c\\2''_is_\\c'\\ \n projection_concatenation_commute set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\2''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover note Suc(8) Suc(1)[of c \"xs @ \\\" \\ \\1']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\1\\<^esub> = []\"\n and six: \"\\ \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = (xs @ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n (* apply FCIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\\"\n\n note c'_in_Cv1_inter_Upsilon1 v'_in_Vv1_inter_Nabla1\n moreover\n from three v'_in_E1 have \"?BETA @ [v'] @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\\n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from validES1 three have \"?BETA \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (unfold ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES1_C1_inter_Upsilon1_inter_N2_inter_Delta2\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note FCIA1\n ultimately obtain \\1'' \\'\n where fcia_one: \"set \\' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and fcia_two: \"?BETA @ [c'] @ \\' @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and fcia_three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and fcia_four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n \n let ?DELTA1'' = \"\\ @ [c'] @ \\'\"\n\n from fcia_two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with two fcia_one show ?thesis\n by auto\n qed\n moreover\n from fcia_two v'_in_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from fcia_three four have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note fcia_four\n moreover \n have \"?DELTA1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n have \"\\' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = []\"\n proof -\n from fcia_one have \"\\ e \\ set \\'. e \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have \"\\ e \\ set \\'. e \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (simp add: projection_def)\n qed\n with c'_in_E1 c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \\E1_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E1\\1'_in_Tr1 \\1'Cv1_empty c\\2''E1_in_Cv1_inter_Upsilon1star \n c_in_Cv_inter_Upsilon \\2''_in_N2_inter_Delta2star Adm]\n obtain \\1'' \\1''\n where one: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n and four: \"\\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n note one two three\n moreover\n have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\" \n proof -\n from projection_intersection_neutral[OF two, of \"E\\<^bsub>ES2\\<^esub>\"] \n Nv1_inter_Delta1_inter_E2_empty validV2 \n have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (simp only: Int_Un_distrib2, auto)\n moreover\n from validV2 \n have \"C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by simp\n hence \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by (simp add: projection_def)\n with four have \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub> \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>)\"\n by simp\n hence \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ (N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_commute)\n with \\2''_in_N2_inter_Delta2star show ?thesis\n by (simp only: list_subset_iff_projection_neutral)\n qed\n ultimately show ?thesis\n by blast\n next\n assume v'_notin_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub> ; \n \\1' \\ C\\<^bsub>\\1\\<^esub> = []; set ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>;\n Adm \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ c \\ \n \\ \\ \\1'' \\1''. (set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \n \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = []\n \\ \\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>)\"\n proof (induct \"length ((c # \\2'') \\ E\\<^bsub>ES1\\<^esub>)\" arbitrary: \\ \\1' c \\2'')\n case 0\n\n from 0(2) validES1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n and c\\2''_is_\\c'\\: \"c # \\2'' = \\ @ [c'] @ \\\"\n and \\E1_empty: \"\\ \\ E\\<^bsub>ES1\\<^esub> = []\"\n and n_is_length_\\\\E1: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES1\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E1 c\\2''_is_\\c'\\ have \"set (\\ \\ E\\<^bsub>ES1\\<^esub> @ [c']) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp only: c\\2''_is_\\c'\\ projection_concatenation_commute projection_def, auto)\n hence c'_in_Cv1_inter_Upsilon1: \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n hence c'_in_Cv1: \"c' \\ C\\<^bsub>\\1\\<^esub>\" and c'_in_Upsilon1: \"c' \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with validV1 have c'_in_E1: \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we just apply BSIA in this case *)\n with c\\2''_is_\\c'\\ have c_is_c': \"c = c'\" and \\2''_is_\\: \"\\2'' = \\\"\n by auto\n with c'_in_Cv1_inter_Upsilon1 have \"c \\ C\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n from v'_notin_E1 Suc(3) have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c\"\n proof -\n from Suc(8) obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_is_c' c'_in_E1 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\1v1_subset_\\v_inter_E1 have \"\\ \\ (\\1 \\1) = \\ \\ (\\1 \\1)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note BSIA1\n ultimately obtain \\1''\n where one: \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n let ?DELTA1'' = \"\\ \\ E\\<^bsub>ES1\\<^esub>\"\n\n from one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E1_empty\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n from c_is_c' c'_in_E1 one v'_notin_E1 \\E1_empty\n have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note two three\n moreover\n from \\E1_empty \\2''_is_\\ have \"?DELTA1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* apply inductive hypothesis, then BSIA *)\n with c\\2''_is_\\c'\\\n have \\_is_c_xs: \"\\ = [c] @ xs\" and \\2''_is_xs_c'_\\: \"\\2'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E1 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES1\\<^esub>) \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\2''_is_\\c'\\ \\_is_c_xs \\E1_empty\n show ?thesis\n by (subst res, simp only: c\\2''_is_\\c'\\ projection_concatenation_commute \n set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\2''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover note Suc(8) Suc(1)[of c \"xs @ \\\" \\ \\1']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES1\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\1\\<^esub> = []\"\n and six: \"\\ \\ E\\<^bsub>ES2\\<^esub> = (xs @ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n \n (* apply BSIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\\"\n\n from c'_in_Cv1_inter_Upsilon1 have \"c' \\ C\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from three v'_notin_E1 have \"?BETA @ \\ \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\\n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from validES1 three have \"?BETA \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (unfold ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES1_C1_inter_Upsilon1_inter_N2_inter_Delta2\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA1\n ultimately obtain \\1''\n where bsia_one: \"?BETA @ [c'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and bsia_two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n and bsia_three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n let ?DELTA1'' = \"\\ @ [c']\"\n\n from bsia_one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with two show ?thesis\n by auto\n qed\n moreover\n from bsia_one v'_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ ?DELTA1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from bsia_two four have \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n note bsia_three\n moreover \n have \"?DELTA1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n proof -\n from validV2 Suc(7) \\2''_is_xs_c'_\\ have \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with c'_in_E1 c'_in_Cv1_inter_Upsilon1 \\2''_is_xs_c'_\\ \\E1_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E1\\1'_in_Tr1 \\1'Cv1_empty c\\2''E1_in_Cv1_inter_Upsilon1star \n c_in_Cv_inter_Upsilon \\2''_in_N2_inter_Delta2star Adm]\n show ?thesis \n by blast\n qed\n then obtain \\1'' \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and \\1''_in_N1_inter_Delta1star:\"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1: \n \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n and \\1''E2_is_\\2''E1: \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\2'' \\ E\\<^bsub>ES1\\<^esub>\"\n by blast\n\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 validES1 \n validES2\n have \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\" and \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp_all add: ES_valid_def traces_contain_events_def, auto)\n with \\1''E2_is_\\2''E1 merge_property[of \\1'' \"E\\<^bsub>ES1\\<^esub>\" \\2'' \"E\\<^bsub>ES2\\<^esub>\"] obtain \\'\n where \\'E1_is_\\1'': \"\\' \\ E\\<^bsub>ES1\\<^esub> = \\1''\"\n and \\'E2_is_\\2'': \"\\' \\ E\\<^bsub>ES2\\<^esub> = \\2''\"\n and \\'_contains_only_\\1''_\\2''_events: \"set \\' \\ set \\1'' \\ set \\2''\"\n unfolding Let_def\n by auto\n\n let ?TAU = \"\\ @ [c] @ \\' @ [v']\"\n let ?LAMBDA = \"\\ \\ V\\<^bsub>\\\\<^esub>\"\n let ?T1 = \\1''\n let ?T2 = \\2''\n\n (* apply the generalized zipping lemma *)\n have \"?TAU \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n proof -\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' validES1\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\' \\ E\\<^bsub>ES1\\<^esub> @ [v'] \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover \n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' validES2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\' \\ E\\<^bsub>ES2\\<^esub> @ [v'] \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from \\v'\\_in_Tr c_in_Cv_inter_Upsilon VIsViewOnE \\'_contains_only_\\1''_\\2''_events \n \\1''_in_E1star \\2''_in_E2star\n have \"set (\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>\"\n unfolding composeES_def isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def\n by auto\n ultimately show ?thesis\n unfolding composeES_def\n by auto\n qed \n hence \"set ?TAU \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding composeES_def\n by auto\n moreover\n have \"set ?LAMBDA \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\1''_in_E1star \\2''_in_E2star\n moreover\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' \n have \"?TAU \\ E\\<^bsub>ES1\\<^esub> @ ?T1 \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' \n have \"?TAU \\ E\\<^bsub>ES2\\<^esub> @ ?T2 \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = ?T1 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp only: projection_sequence)\n moreover\n from \\1''_in_E1star propSepViews \n have \"?T1 \\ V\\<^bsub>\\\\<^esub> = ?T1 \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1''Vv1_is_\\1'Vv1\n ultimately show ?thesis\n by simp\n qed\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = ?T2 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp only: projection_sequence)\n moreover\n from \\2''_in_E2star propSepViews have \"?T2 \\ V\\<^bsub>\\\\<^esub> = ?T2 \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2''Vv2_is_\\2'Vv2\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\1''Cv1_empty \\2''Cv2_empty generalized_zipping_lemma\n ultimately obtain t (* show that the conclusion of FCIA holds *)\n where \"?TAU @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n and \"t \\ V\\<^bsub>\\\\<^esub> = ?LAMBDA\"\n and \"t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n moreover\n have \"set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>\"\n proof -\n from \\'_contains_only_\\1''_\\2''_events \\1''_in_N1_inter_Delta1star \n \\2''_in_N2_inter_Delta2star\n have \"set \\' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with Delta1_N1_Delta2_N2_subset_Delta Nv1_union_Nv2_subsetof_Nv \n show ?thesis\n by auto\n qed\n ultimately have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by (simp only: append_assoc, blast)\n }\n moreover {\n assume Nv2_inter_Delta2_inter_E1_empty: \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = {}\" \n and Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2: \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n\n let ?ALPHA1''_DELTA1'' = \"\\ \\1'' \\1''. (\n set \\1'' \\ E\\<^bsub>ES1\\<^esub> \\ set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub> \n \\ \\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub> \\ \\1'' \\ C\\<^bsub>\\1\\<^esub> = [])\"\n\n from c_in_Cv_inter_Upsilon v'_in_Vv_inter_Nabla validV1\n have \"c \\ E\\<^bsub>ES1\\<^esub> \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>) \\ (c \\ E\\<^bsub>ES1\\<^esub> \\ v' \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def)\n moreover {\n assume c_notin_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n\n from validES1 \\v'E1\\1'_in_Tr1 have \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover \n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover \n from \\v'E1\\1'_in_Tr1 c_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n have \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\" ..\n moreover \n note \\1'Cv1_empty\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_notin_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1\n have c_in_Cv1_inter_Upsilon1: \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n hence \"c \\ C\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from \\v'E1\\1'_in_Tr1 v'_notin_E1 have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\1'Cv1_empty\n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c\"\n proof -\n from Adm obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_in_E1 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\1v1_subset_\\v_inter_E1 have \"\\ \\ (\\1 \\1) = \\ \\ (\\1 \\1)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover \n note BSIA1\n ultimately obtain \\1''\n where one: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and two: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and three: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n from one validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from one c_in_E1 v'_notin_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover \n note two three\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n moreover {\n assume c_in_E1: \"c \\ E\\<^bsub>ES1\\<^esub>\"\n and v'_in_E1: \"v' \\ E\\<^bsub>ES1\\<^esub>\"\n\n from c_in_E1 c_in_Cv_inter_Upsilon propSepViews\n Upsilon_inter_E1_subset_Upsilon1\n have c_in_Cv1_inter_Upsilon1: \"c \\ C\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E1 propSepViews v'_in_Vv_inter_Nabla \n Nabla_inter_E1_subset_Nabla1\n have \"v' \\ V\\<^bsub>\\1\\<^esub> \\ Nabla \\1\"\n unfolding properSeparationOfViews_def by auto\n moreover\n from v'_in_E1 \\v'E1\\1'_in_Tr1 have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [v'] @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\1'Cv1_empty \n moreover\n have \"Adm \\1 \\1 Tr\\<^bsub>ES1\\<^esub> (\\ \\ E\\<^bsub>ES1\\<^esub>) c\"\n proof -\n from Adm obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_in_E1 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES1\\<^esub>) @ [c] \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\1 \\1)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES1\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\1v1_subset_\\v_inter_E1 have \"\\ \\ (\\1 \\1) = \\ \\ (\\1 \\1)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note FCIA1\n ultimately obtain \\1'' \\1''\n where one: \"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] @ \\1'' @ [v'] @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and three: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and four: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n\n from two validES1 have \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n note one\n moreover\n from two c_in_E1 v'_in_E1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note three four\n ultimately have ?ALPHA1''_DELTA1''\n by blast\n }\n ultimately obtain \\1'' \\1''\n where \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n and \\1''_in_N1_inter_Delta1star:\"set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1: \n \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' @ [v'] \\ E\\<^bsub>ES1\\<^esub> @ \\1'' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1''Vv1_is_\\1'Vv1: \"\\1'' \\ V\\<^bsub>\\1\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n and \\1''Cv1_empty: \"\\1'' \\ C\\<^bsub>\\1\\<^esub> = []\"\n by blast\n\n from c_in_Cv_inter_Upsilon Upsilon_inter_E2_subset_Upsilon2 propSepViews\n have cE2_in_Cv2_inter_Upsilon2: \"set ([c] \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp add: projection_def, auto)\n \n from \\1''_in_N1_inter_Delta1star Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2 \n propSepViews disjoint_Nv1_Vv2 \n have \\1''E2_in_Cv2_inter_Upsilon2star: \"set (\\1'' \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from \\1''_in_N1_inter_Delta1star \n have eq: \"\\1'' \\ E\\<^bsub>ES2\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub>)\"\n by (metis Int_commute Int_left_commute Int_lower2 Int_lower1 \n projection_intersection_neutral subset_trans)\n \n from validV2 Nv1_inter_Delta1_inter_E2_subsetof_Upsilon2 \n propSepViews disjoint_Nv1_Vv2 \n have \"N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def \n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (subst eq, simp only: projection_def, auto)\n qed\n \n have c\\1''E2_in_Cv2_inter_Upsilon2star: \"set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n from cE2_in_Cv2_inter_Upsilon2 \\1''E2_in_Cv2_inter_Upsilon2star\n have \"set (([c] @ \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n thus ?thesis\n by auto\n qed\n\n\n have \"\\ \\2'' \\2''. set \\2'' \\ E\\<^bsub>ES2\\<^esub> \n \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof cases\n assume v'_in_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n with Nabla_inter_E2_subset_Nabla2 propSepViews v'_in_Vv_inter_Nabla\n have v'_in_Vv2_inter_Nabla2: \"v' \\ V\\<^bsub>\\2\\<^esub> \\ Nabla \\2\"\n unfolding properSeparationOfViews_def by auto\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub> ; \n \\2' \\ C\\<^bsub>\\2\\<^esub> = []; set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>;\n Adm \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ c \\ \n \\ \\ \\2'' \\2''.\n (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>)\"\n proof (induct \"length ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>)\" arbitrary: \\ \\2' c \\1'')\n case 0\n\n from 0(2) validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n and c\\1''_is_\\c'\\: \"c # \\1'' = \\ @ [c'] @ \\\"\n and \\E2_empty: \"\\ \\ E\\<^bsub>ES2\\<^esub> = []\"\n and n_is_length_\\\\E2: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E2 c\\1''_is_\\c'\\ have \"set (\\ \\ E\\<^bsub>ES2\\<^esub> @ [c']) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: c\\1''_is_\\c'\\ projection_concatenation_commute \n projection_def, auto)\n hence c'_in_Cv2_inter_Upsilon2: \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n hence c'_in_Cv2: \"c' \\ C\\<^bsub>\\2\\<^esub>\" and c'_in_Upsilon2: \"c' \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we apply FCIA in this case *)\n with c\\1''_is_\\c'\\ have c_is_c': \"c = c'\" and \\1''_is_\\: \"\\1'' = \\\"\n by auto\n with c'_in_Cv2_inter_Upsilon2 have \"c \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note v'_in_Vv2_inter_Nabla2\n moreover\n from v'_in_E2 Suc(3) have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [v'] @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c\"\n proof -\n from Suc(8) obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_is_c' c'_in_E2 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\2v2_subset_\\v_inter_E2 have \"\\ \\ (\\2 \\2) = \\ \\ (\\2 \\2)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note FCIA2\n ultimately obtain \\2'' \\\n where one: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and two: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] @ \\ @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n\n (* we choose \\2'' = \\ \\ E\\<^bsub>ES2\\<^esub> @ \\ *)\n let ?DELTA2'' = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ \\\" \n \n from two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from one \\E2_empty\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from c_is_c' c'_in_E2 have \"[c] = [c] \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from v'_in_E2 have \"[v'] = [v'] \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note \\E2_empty two\n ultimately show ?thesis\n by auto\n qed\n moreover\n note three four\n moreover\n have \"?DELTA2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n have \"\\ \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = []\"\n proof -\n from validV2 have \"N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = {}\"\n by (simp add: isViewOn_def V_valid_def\n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with projection_intersection_neutral[OF one, of \"C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"]\n show ?thesis\n by (simp add: projection_def)\n qed\n with \\1''_is_\\ \\E2_empty show ?thesis\n by (simp add: projection_concatenation_commute)\n qed\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* we apply the inductive hypothesis in this case *)\n with c\\1''_is_\\c'\\\n have \\_is_c_xs: \"\\ = [c] @ xs\" and \\1''_is_xs_c'_\\: \"\\1'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E2 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\1''_is_\\c'\\ \\_is_c_xs \\E2_empty\n show ?thesis\n by (subst res, simp only: c\\1''_is_\\c'\\ \n projection_concatenation_commute set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\1''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover note Suc(8) Suc(1)[of c \"xs @ \\\" \\ \\2']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\2\\<^esub> = []\"\n and six: \"\\ \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = (xs @ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n (* apply FCIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\\"\n\n note c'_in_Cv2_inter_Upsilon2 v'_in_Vv2_inter_Nabla2\n moreover\n from three v'_in_E2 have \"?BETA @ [v'] @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\\n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from validES2 three have \"?BETA \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (unfold ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES2_C2_inter_Upsilon2_inter_N1_inter_Delta1\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note FCIA2\n ultimately obtain \\2'' \\'\n where fcia_one: \"set \\' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n and fcia_two: \"?BETA @ [c'] @ \\' @ [v'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and fcia_three: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and fcia_four: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding FCIA_def\n by blast\n \n let ?DELTA2'' = \"\\ @ [c'] @ \\'\"\n\n from fcia_two validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with two fcia_one show ?thesis\n by auto\n qed\n moreover\n from fcia_two v'_in_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from fcia_three four have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note fcia_four\n moreover \n have \"?DELTA2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n have \"\\' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = []\"\n proof -\n from fcia_one have \"\\ e \\ set \\'. e \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have \"\\ e \\ set \\'. e \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n thus ?thesis\n by (simp add: projection_def)\n qed\n with c'_in_E2 c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \\E2_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E2\\2'_in_Tr2 \\2'Cv2_empty \n c\\1''E2_in_Cv2_inter_Upsilon2star c_in_Cv_inter_Upsilon \\1''_in_N1_inter_Delta1star Adm]\n obtain \\2'' \\2''\n where one: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n and four: \"\\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n note one two three\n moreover\n have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\" \n proof -\n from projection_intersection_neutral[OF two, of \"E\\<^bsub>ES1\\<^esub>\"] \n Nv2_inter_Delta2_inter_E1_empty validV1 \n have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub>)\"\n by (simp only: Int_Un_distrib2, auto)\n moreover\n from validV1\n have \"C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by simp\n hence \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\2'' \\ (C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>) \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by (simp add: projection_def)\n with four have \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub> \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>)\"\n by simp\n hence \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ (N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>) \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_commute)\n with \\1''_in_N1_inter_Delta1star show ?thesis\n by (simp only: list_subset_iff_projection_neutral)\n qed\n ultimately show ?thesis\n by blast\n next\n assume v'_notin_E2: \"v' \\ E\\<^bsub>ES2\\<^esub>\"\n\n have \"\\ (\\ @ [v']) \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub> ; \n \\2' \\ C\\<^bsub>\\2\\<^esub> = []; set ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> ; \n c \\ C\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> ; set \\1'' \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>;\n Adm \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>) \\ c \\ \n \\ \\ \\2'' \\2''.\n (set \\2'' \\ E\\<^bsub>ES2\\<^esub> \\ set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub> \n \\ \\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub> \n \\ \\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub> \\ \\2'' \\ C\\<^bsub>\\2\\<^esub> = []\n \\ \\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>)\"\n proof (induct \"length ((c # \\1'') \\ E\\<^bsub>ES2\\<^esub>)\" arbitrary: \\ \\2' c \\1'')\n case 0\n\n from 0(2) validES2 have \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set [] \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ [] @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n note 0(2)\n moreover\n from 0(1) have \"c \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n ultimately show ?thesis\n by (simp add: projection_concatenation_commute projection_def)\n qed\n moreover\n have \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\" ..\n moreover\n note 0(3)\n moreover \n from 0(1) have \"[] \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, split if_split_asm, auto)\n ultimately show ?case\n by blast\n next\n case (Suc n)\n\n from projection_split_last[OF Suc(2)] obtain \\ c' \\\n where c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n and c\\1''_is_\\c'\\: \"c # \\1'' = \\ @ [c'] @ \\\"\n and \\E2_empty: \"\\ \\ E\\<^bsub>ES2\\<^esub> = []\"\n and n_is_length_\\\\E2: \"n = length ((\\ @ \\) \\ E\\<^bsub>ES2\\<^esub>)\"\n by blast\n\n from Suc(5) c'_in_E2 c\\1''_is_\\c'\\ have \"set (\\ \\ E\\<^bsub>ES2\\<^esub> @ [c']) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by (simp only: c\\1''_is_\\c'\\ projection_concatenation_commute projection_def, auto)\n hence c'_in_Cv2_inter_Upsilon2: \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n hence c'_in_Cv2: \"c' \\ C\\<^bsub>\\2\\<^esub>\" and c'_in_Upsilon2: \"c' \\ \\\\<^bsub>\\2\\<^esub>\"\n by auto\n with validV2 have c'_in_E2: \"c' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n\n show ?case\n proof (cases \\)\n case Nil (* we just apply BSIA in this case *)\n with c\\1''_is_\\c'\\ have c_is_c': \"c = c'\" and \\1''_is_\\: \"\\1'' = \\\"\n by auto\n with c'_in_Cv2_inter_Upsilon2 have \"c \\ C\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n from v'_notin_E2 Suc(3) have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_concatenation_commute projection_def)\n moreover\n note Suc(4)\n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> (\\ \\ E\\<^bsub>ES2\\<^esub>) c\"\n proof -\n from Suc(8) obtain \\\n where \\\\v_is_\\\\v: \"\\ \\ (\\ \\) = \\ \\ (\\ \\)\"\n and \\c_in_Tr: \"(\\ @ [c]) \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding Adm_def\n by auto\n\n from c_is_c' c'_in_E2 \\c_in_Tr have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def composeES_def)\n moreover\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\2 \\2)\"\n proof -\n from \\\\v_is_\\\\v have \"\\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\) = \\ \\ E\\<^bsub>ES2\\<^esub> \\ (\\ \\)\"\n by (metis projection_commute)\n with \\2v2_subset_\\v_inter_E2 \n have \"\\ \\ (\\2 \\2) = \\ \\ (\\2 \\2)\"\n by (metis Int_subset_iff \\\\v_is_\\\\v projection_subset_elim)\n thus ?thesis\n by (metis projection_commute)\n qed\n ultimately show ?thesis unfolding Adm_def\n by auto\n qed \n moreover\n note BSIA2\n ultimately obtain \\2''\n where one: \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n\n let ?DELTA2'' = \"\\ \\ E\\<^bsub>ES2\\<^esub>\"\n\n from one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\E2_empty\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by simp\n moreover\n from c_is_c' c'_in_E2 one v'_notin_E2 \\E2_empty\n have \"(\\ \\ E\\<^bsub>ES2\\<^esub>) @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note two three\n moreover\n from \\E2_empty \\1''_is_\\ have \"?DELTA2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n ultimately show ?thesis\n by blast\n next\n case (Cons x xs) (* apply inductive hypothesis, then BSIA *)\n with c\\1''_is_\\c'\\ have \\_is_c_xs: \"\\ = [c] @ xs\" \n and \\1''_is_xs_c'_\\: \"\\1'' = xs @ [c'] @ \\\"\n by auto\n with n_is_length_\\\\E2 have \"n = length ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>)\"\n by auto\n moreover\n note Suc(3,4)\n moreover\n have \"set ((c # (xs @ \\)) \\ E\\<^bsub>ES2\\<^esub>) \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub>\"\n proof -\n have res: \"c # (xs @ \\) = [c] @ (xs @ \\)\" \n by auto\n\n from Suc(5) c\\1''_is_\\c'\\ \\_is_c_xs \\E2_empty\n show ?thesis\n by (subst res, simp only: c\\1''_is_\\c'\\ \n projection_concatenation_commute set_append, auto)\n qed\n moreover\n note Suc(6) \n moreover\n from Suc(7) \\1''_is_xs_c'_\\ have \"set (xs @ \\) \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover note Suc(8) Suc(1)[of c \"xs @ \\\" \\ \\2']\n ultimately obtain \\ \\\n where one: \"set \\ \\ E\\<^bsub>ES2\\<^esub>\"\n and two: \"set \\ \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and three: \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\ @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n and four: \"\\ \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and five: \"\\ \\ C\\<^bsub>\\2\\<^esub> = []\"\n and six: \"\\ \\ E\\<^bsub>ES1\\<^esub> = (xs @ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n \n (* apply BSIA to insert c' after \\ *)\n let ?BETA = \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\\"\n\n from c'_in_Cv2_inter_Upsilon2 have \"c' \\ C\\<^bsub>\\2\\<^esub>\"\n by auto\n moreover\n from three v'_notin_E2 have \"?BETA @ \\ \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n note five \n moreover\n have \"Adm \\2 \\2 Tr\\<^bsub>ES2\\<^esub> ?BETA c'\"\n proof -\n have \"?BETA @ [c'] \\ Tr\\<^bsub>ES2\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\\n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n moreover\n from validES2 three have \"?BETA \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (unfold ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def, auto)\n moreover\n note total_ES2_C2_inter_Upsilon2_inter_N1_inter_Delta1\n ultimately show ?thesis\n unfolding total_def\n by blast\n qed\n thus ?thesis\n unfolding Adm_def\n by blast \n qed\n moreover\n note BSIA2\n ultimately obtain \\2''\n where bsia_one: \"?BETA @ [c'] @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and bsia_two: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n and bsia_three: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n unfolding BSIA_def\n by blast\n \n let ?DELTA2'' = \"\\ @ [c']\"\n\n from bsia_one validES2 have \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n have \"set ?DELTA2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n proof -\n from Suc(7) c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \n have \"c' \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with two show ?thesis\n by auto\n qed\n moreover\n from bsia_one v'_notin_E2 \n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ ?DELTA2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from bsia_two four have \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n by simp\n moreover\n note bsia_three\n moreover \n have \"?DELTA2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n proof -\n from validV1 Suc(7) \\1''_is_xs_c'_\\ have \"c' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n with c'_in_E2 c'_in_Cv2_inter_Upsilon2 \\1''_is_xs_c'_\\ \\E2_empty six \n show ?thesis\n by (simp only: projection_concatenation_commute projection_def, auto)\n qed\n ultimately show ?thesis \n by blast \n qed\n qed\n from this[OF \\v'E2\\2'_in_Tr2 \\2'Cv2_empty c\\1''E2_in_Cv2_inter_Upsilon2star \n c_in_Cv_inter_Upsilon \\1''_in_N1_inter_Delta1star Adm]\n show ?thesis \n by blast\n qed\n then obtain \\2'' \\2''\n where \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\"\n and \\2''_in_N2_inter_Delta2star:\"set \\2'' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ C\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n and \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2: \n \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' @ [v'] \\ E\\<^bsub>ES2\\<^esub> @ \\2'' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2''Vv2_is_\\2'Vv2: \"\\2'' \\ V\\<^bsub>\\2\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n and \\2''Cv2_empty: \"\\2'' \\ C\\<^bsub>\\2\\<^esub> = []\"\n and \\2''E1_is_\\1''E2: \"\\2'' \\ E\\<^bsub>ES1\\<^esub> = \\1'' \\ E\\<^bsub>ES2\\<^esub>\"\n by blast\n\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \n validES2 validES1\n have \\2''_in_E2star: \"set \\2'' \\ E\\<^bsub>ES2\\<^esub>\" and \\1''_in_E1star: \"set \\1'' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp_all add: ES_valid_def traces_contain_events_def, auto)\n with \\2''E1_is_\\1''E2 merge_property[of \\2'' \"E\\<^bsub>ES2\\<^esub>\" \\1'' \"E\\<^bsub>ES1\\<^esub>\"] obtain \\'\n where \\'E2_is_\\2'': \"\\' \\ E\\<^bsub>ES2\\<^esub> = \\2''\"\n and \\'E1_is_\\1'': \"\\' \\ E\\<^bsub>ES1\\<^esub> = \\1''\"\n and \\'_contains_only_\\2''_\\1''_events: \"set \\' \\ set \\2'' \\ set \\1''\"\n unfolding Let_def\n by auto\n\n let ?TAU = \"\\ @ [c] @ \\' @ [v']\"\n let ?LAMBDA = \"\\ \\ V\\<^bsub>\\\\<^esub>\"\n let ?T2 = \\2''\n let ?T1 = \\1''\n\n (* apply the generalized zipping lemma *)\n have \"?TAU \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n proof -\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' validES2\n have \"\\ \\ E\\<^bsub>ES2\\<^esub> @ [c] \\ E\\<^bsub>ES2\\<^esub> @ \\' \\ E\\<^bsub>ES2\\<^esub> @ [v'] \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover \n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' validES1 \n have \"\\ \\ E\\<^bsub>ES1\\<^esub> @ [c] \\ E\\<^bsub>ES1\\<^esub> @ \\' \\ E\\<^bsub>ES1\\<^esub> @ [v'] \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_prefixclosed_def\n prefixclosed_def prefix_def)\n hence \"(\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from \\v'\\_in_Tr c_in_Cv_inter_Upsilon VIsViewOnE\n \\'_contains_only_\\2''_\\1''_events \\2''_in_E2star \\1''_in_E1star\n have \"set (\\ @ [c] @ \\' @ [v']) \\ E\\<^bsub>ES2\\<^esub> \\ E\\<^bsub>ES1\\<^esub>\"\n unfolding composeES_def isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def\n by auto\n ultimately show ?thesis\n unfolding composeES_def\n by auto\n qed \n hence \"set ?TAU \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n unfolding composeES_def\n by auto\n moreover\n have \"set ?LAMBDA \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n note \\2''_in_E2star \\1''_in_E1star\n moreover\n from \\E2_cE2_\\2''_v'E2_\\2''_in_Tr2 \\'E2_is_\\2'' \n have \"?TAU \\ E\\<^bsub>ES2\\<^esub> @ ?T2 \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n from \\E1_cE1_\\1''_v'E1_\\1''_in_Tr1 \\'E1_is_\\1'' \n have \"?TAU \\ E\\<^bsub>ES1\\<^esub> @ ?T1 \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp only: projection_concatenation_commute, auto)\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = ?T2 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews have \"?LAMBDA \\ E\\<^bsub>ES2\\<^esub> = \\ \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp only: projection_sequence)\n moreover\n from \\2''_in_E2star propSepViews have \"?T2 \\ V\\<^bsub>\\\\<^esub> = ?T2 \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\2'Vv2_is_\\Vv2 \\2''Vv2_is_\\2'Vv2\n ultimately show ?thesis\n by simp\n qed\n moreover\n have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = ?T1 \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from propSepViews have \"?LAMBDA \\ E\\<^bsub>ES1\\<^esub> = \\ \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def by (simp only: projection_sequence)\n moreover\n from \\1''_in_E1star propSepViews have \"?T1 \\ V\\<^bsub>\\\\<^esub> = ?T1 \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (metis Int_commute projection_intersection_neutral)\n moreover\n note \\1'Vv1_is_\\Vv1 \\1''Vv1_is_\\1'Vv1\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\2''Cv2_empty \\1''Cv1_empty generalized_zipping_lemma\n ultimately obtain t (* show that the conclusion of FCIA holds *)\n where \"?TAU @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n and \"t \\ V\\<^bsub>\\\\<^esub> = ?LAMBDA\"\n and \"t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n moreover\n have \"set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub>\"\n proof -\n from \\'_contains_only_\\2''_\\1''_events \n \\2''_in_N2_inter_Delta2star \\1''_in_N1_inter_Delta1star\n have \"set \\' \\ N\\<^bsub>\\2\\<^esub> \\ \\\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\1\\<^esub> \\ \\\\<^bsub>\\1\\<^esub>\"\n by auto\n with Delta1_N1_Delta2_N2_subset_Delta Nv1_union_Nv2_subsetof_Nv show ?thesis\n by auto\n qed\n ultimately have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by (simp only: append_assoc, blast)\n }\n ultimately have \"\\\\' \\'. (set \\' \\ N\\<^bsub>\\\\<^esub> \\ \\\\<^bsub>\\\\<^esub> \\ \\ @ [c] @ \\' @ [v'] @ \\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \n \\ \\' \\ V\\<^bsub>\\\\<^esub> = \\ \\ V\\<^bsub>\\\\<^esub> \\ \\' \\ C\\<^bsub>\\\\<^esub> = [])\"\n by blast\n }\n thus ?thesis\n unfolding FCIA_def\n by blast\nqed\n\n(* Theorem 6.4.2 *)\ntheorem compositionality_R: \n\"\\ R \\1 Tr\\<^bsub>ES1\\<^esub>; R \\2 Tr\\<^bsub>ES2\\<^esub> \\ \\ R \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\n proof -\n assume R1: \"R \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and R2: \"R \\2 Tr\\<^bsub>ES2\\<^esub>\"\n\n {\n fix \\'\n assume \\'_in_Tr: \"\\' \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n hence \\'E1_in_Tr1: \"\\' \\ E\\<^bsub>ES1\\<^esub> \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\'E2_in_Tr2: \"\\' \\ E\\<^bsub>ES2\\<^esub> \\ Tr\\<^bsub>ES2\\<^esub>\"\n unfolding composeES_def\n by auto\n with R1 R2 obtain \\1' \\2'\n where \\1'_in_Tr1: \"\\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n and \\1'Cv1_empty: \"\\1' \\ C\\<^bsub>\\1\\<^esub> = []\"\n and \\1'Vv1_is_\\'_E1_Vv1: \"\\1' \\ V\\<^bsub>\\1\\<^esub> = \\' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub>\"\n and \\2'_in_Tr2: \"\\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n and \\2'Cv2_empty: \"\\2' \\ C\\<^bsub>\\2\\<^esub> = []\"\n and \\2'Vv2_is_\\'_E2_Vv2: \"\\2' \\ V\\<^bsub>\\2\\<^esub> = \\' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding R_def\n by blast\n\n have \"set [] \\ E\\<^bsub>(ES1 \\ ES2)\\<^esub>\"\n by auto\n moreover\n have \"set (\\' \\ V\\<^bsub>\\\\<^esub>) \\ V\\<^bsub>\\\\<^esub>\"\n by (simp add: projection_def, auto)\n moreover\n from validES1 \\1'_in_Tr1 have \\1'_in_E1: \"set \\1' \\ E\\<^bsub>ES1\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from validES2 \\2'_in_Tr2 have \\2'_in_E2: \"set \\2' \\ E\\<^bsub>ES2\\<^esub>\"\n by (simp add: ES_valid_def traces_contain_events_def, auto)\n moreover\n from \\1'_in_Tr1 have \"[] \\ E\\<^bsub>ES1\\<^esub> @ \\1' \\ Tr\\<^bsub>ES1\\<^esub>\"\n by (simp add: projection_def)\n moreover\n from \\2'_in_Tr2 have \"[] \\ E\\<^bsub>ES2\\<^esub> @ \\2' \\ Tr\\<^bsub>ES2\\<^esub>\"\n by (simp add: projection_def)\n moreover\n have \"\\' \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = \\1' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from projection_intersection_neutral[OF \\1'_in_E1, of \"V\\<^bsub>\\\\<^esub>\"] propSepViews \n have \"\\1' \\ V\\<^bsub>\\\\<^esub> = \\1' \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add: Int_commute)\n moreover\n from propSepViews have \"\\' \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = \\' \\ V\\<^bsub>\\1\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add: projection_sequence)\n moreover {\n have \" \\' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub> = \\' \\ (E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub>)\"\n by (simp add: projection_def)\n moreover\n from validV1 have \"E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub> = V\\<^bsub>\\1\\<^esub>\"\n by (simp add: isViewOn_def V_valid_def \n VC_disjoint_def VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\' \\ E\\<^bsub>ES1\\<^esub> \\ V\\<^bsub>\\1\\<^esub> = \\' \\ V\\<^bsub>\\1\\<^esub>\"\n by simp\n }\n moreover\n note \\1'Vv1_is_\\'_E1_Vv1\n ultimately show ?thesis\n by simp\n qed\n moreover\n have \"\\' \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = \\2' \\ V\\<^bsub>\\\\<^esub>\"\n proof -\n from projection_intersection_neutral[OF \\2'_in_E2, of \"V\\<^bsub>\\\\<^esub>\"] propSepViews\n have \"\\2' \\ V\\<^bsub>\\\\<^esub> = \\2' \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add: Int_commute)\n moreover\n from propSepViews have \"\\' \\ V\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = \\' \\ V\\<^bsub>\\2\\<^esub>\"\n unfolding properSeparationOfViews_def\n by (simp add: projection_sequence)\n moreover {\n have \" \\' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub> = \\' \\ (E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub>)\"\n by (simp add: projection_def)\n moreover\n from validV2 have \"E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub> = V\\<^bsub>\\2\\<^esub>\"\n by (simp add:isViewOn_def V_valid_def VC_disjoint_def \n VN_disjoint_def NC_disjoint_def, auto)\n ultimately have \"\\' \\ E\\<^bsub>ES2\\<^esub> \\ V\\<^bsub>\\2\\<^esub> = \\' \\ V\\<^bsub>\\2\\<^esub>\"\n by simp\n }\n moreover\n note \\2'Vv2_is_\\'_E2_Vv2\n ultimately show ?thesis\n by simp\n qed\n moreover\n note \\1'Cv1_empty \\2'Cv2_empty generalized_zipping_lemma\n ultimately have \"\\t. [] @ t \\ Tr\\<^bsub>(ES1 \\ ES2)\\<^esub> \\ t \\ V\\<^bsub>\\\\<^esub> = \\' \\ V\\<^bsub>\\\\<^esub> \\ t \\ C\\<^bsub>\\\\<^esub> = []\"\n by blast\n }\n thus ?thesis\n unfolding R_def\n by auto\n qed\n\nend\n\nlocale CompositionalityStrictBSPs = Compositionality +\n(*adds the additional assumptions of theorem 6.4.3 in Heiko Mantel's phd thesis*)\nassumes N\\_inter_E1_is_N\\1: \"N\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = N\\<^bsub>\\1\\<^esub>\"\n and N\\_inter_E2_is_N\\2: \"N\\<^bsub>\\\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = N\\<^bsub>\\2\\<^esub>\"\n\n(* sublocale relationship to other compositionality assumptions*)\nsublocale CompositionalityStrictBSPs \\ Compositionality\nby (unfold_locales)\n\ncontext CompositionalityStrictBSPs\nbegin\n(*Theorem 6.4.3 Case 1 in Heiko Mantel's pdh thesis*)\ntheorem compositionality_SR: \n\"\\ SR \\1 Tr\\<^bsub>ES1\\<^esub>; SR \\2 Tr\\<^bsub>ES2\\<^esub> \\ \\ SR \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\" \nproof -\n assume \"SR \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SR \\2 Tr\\<^bsub>ES2\\<^esub>\"\n { \n let ?\\\\<^sub>1'=\"\\V = V\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub>, N = {}, C = C\\<^bsub>\\1\\<^esub>\\\"\n let ?\\\\<^sub>2'=\"\\V = V\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub>, N = {}, C = C\\<^bsub>\\2\\<^esub> \\\"\n let ?\\' =\"\\V=V\\<^bsub>\\\\<^esub> \\ N\\<^bsub>\\\\<^esub>, N={}, C=C\\<^bsub>\\\\<^esub> \\\" \n (*Show ?\\\\<^sub>1' ?\\\\<^sub>2' ?\\' are views on the respective set of events*)\n from validV1 have \\\\<^sub>1'IsViewOnE\\<^sub>1: \"isViewOn ?\\\\<^sub>1' E\\<^bsub>ES1\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from validV2 have \\\\<^sub>2'IsViewOnE\\<^sub>2: \"isViewOn ?\\\\<^sub>2' E\\<^bsub>ES2\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from VIsViewOnE have \\'IsViewOnE: \"isViewOn ?\\' E\\<^bsub>(ES1\\ES2)\\<^esub>\" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n \n (*Show ?\\\\<^sub>1' and ?\\\\<^sub>2' are proper separation of \\ V=\\<^bsub>\\\\<^esub>, N={}, C=\\<^bsub>\\\\<^esub> \\ *)\n from propSepViews N\\_inter_E1_is_N\\1\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n from propSepViews N\\_inter_E2_is_N\\2\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n from propSepViews \n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto \n from propSepViews\n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n have \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\"\n by auto\n \n note properSeparation_\\\\<^sub>1\\\\<^sub>2=\\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \n \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \\N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\\\n \n (*Show ES1\\ES2 is a well behaved composition w.r.t. ?\\\\<^sub>1' and ?\\\\<^sub>2' *)\n have wbc1: \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ E\\<^bsub>ES1\\<^esub>={} \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> \\ E\\<^bsub>ES2\\<^esub>={}\"\n by auto\n \n \n from \\SR \\1 Tr\\<^bsub>ES1\\<^esub>\\ have \"R ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SR_implies_R_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto\n from \\SR \\2 Tr\\<^bsub>ES2\\<^esub>\\ have \"R ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SR_implies_R_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto \n \n from validES1 validES2 composableES1ES2 \\'IsViewOnE \\\\<^sub>1'IsViewOnE\\<^sub>1 \\\\<^sub>2'IsViewOnE\\<^sub>2\n properSeparation_\\\\<^sub>1\\\\<^sub>2 wbc1\n have \"Compositionality ES1 ES2 ?\\' ?\\\\<^sub>1' ?\\\\<^sub>2'\" unfolding Compositionality_def \n by (simp add: properSeparationOfViews_def wellBehavedComposition_def)\n with \\R ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\R ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\ have \"R ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using Compositionality.compositionality_R by blast\n \n from validES1 validES2 composeES_yields_ES validVC\n have \"BSPTaxonomyDifferentCorrections (ES1\\ES2) \\\"\n unfolding BSPTaxonomyDifferentCorrections_def by auto \n with \\R ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\\ have \"SR \\ Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using BSPTaxonomyDifferentCorrections.R_implies_SR_for_modified_view by auto \n }\n thus ?thesis by auto \nqed\n\n(*Theorem 6.4.3 Case 2 in Heiko Mantel's pdh thesis*)\ntheorem compositionality_SD: \n\"\\ SD \\1 Tr\\<^bsub>ES1\\<^esub>; SD \\2 Tr\\<^bsub>ES2\\<^esub> \\ \\ SD \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\" \nproof -\n assume \"SD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n { \n let ?\\\\<^sub>1'=\"\\V = V\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub>, N = {}, C = C\\<^bsub>\\1\\<^esub>\\\"\n let ?\\\\<^sub>2'=\"\\V = V\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub>, N = {}, C = C\\<^bsub>\\2\\<^esub> \\\"\n let ?\\' =\"\\V=V\\<^bsub>\\\\<^esub> \\ N\\<^bsub>\\\\<^esub>, N={}, C=C\\<^bsub>\\\\<^esub> \\\" \n (*Show ?\\\\<^sub>1' ?\\\\<^sub>2' ?\\' are views on the respective set of events*)\n from validV1 have \\\\<^sub>1'IsViewOnE\\<^sub>1: \"isViewOn ?\\\\<^sub>1' E\\<^bsub>ES1\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from validV2 have \\\\<^sub>2'IsViewOnE\\<^sub>2: \"isViewOn ?\\\\<^sub>2' E\\<^bsub>ES2\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from VIsViewOnE have \\'IsViewOnE: \"isViewOn ?\\' E\\<^bsub>(ES1\\ES2)\\<^esub>\" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n \n (*Show ?\\\\<^sub>1' and ?\\\\<^sub>2' are proper separation of \\ V=\\<^bsub>\\\\<^esub>, N={}, C=\\<^bsub>\\\\<^esub> \\ *)\n from propSepViews N\\_inter_E1_is_N\\1\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\" \n unfolding properSeparationOfViews_def by auto\n from propSepViews N\\_inter_E2_is_N\\2\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n from propSepViews \n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto \n from propSepViews\n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n have \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\"\n by auto\n \n note properSeparation_\\\\<^sub>1\\\\<^sub>2=\\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \n \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \\N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\\\n \n (*Show ES1\\ES2 is a well behaved composition w.r.t. ?\\\\<^sub>1' and ?\\\\<^sub>2' *)\n have wbc1: \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ E\\<^bsub>ES1\\<^esub>={} \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> \\ E\\<^bsub>ES2\\<^esub>={}\"\n by auto\n \n \n from \\SD \\1 Tr\\<^bsub>ES1\\<^esub>\\ have \"BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view\n unfolding BSPTaxonomyDifferentCorrections_def by auto\n from \\SD \\2 Tr\\<^bsub>ES2\\<^esub>\\ have \"BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view\n unfolding BSPTaxonomyDifferentCorrections_def by auto \n \n from validES1 validES2 composableES1ES2 \\'IsViewOnE \\\\<^sub>1'IsViewOnE\\<^sub>1 \\\\<^sub>2'IsViewOnE\\<^sub>2\n properSeparation_\\\\<^sub>1\\\\<^sub>2 wbc1\n have \"Compositionality ES1 ES2 ?\\' ?\\\\<^sub>1' ?\\\\<^sub>2'\"\n unfolding Compositionality_def\n by (simp add: properSeparationOfViews_def wellBehavedComposition_def)\n with \\BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\ have \"BSD ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using Compositionality.compositionality_BSD by blast\n \n from validES1 validES2 composeES_yields_ES validVC\n have \"BSPTaxonomyDifferentCorrections (ES1\\ES2) \\\"\n unfolding BSPTaxonomyDifferentCorrections_def by auto \n with \\BSD ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\\ have \"SD \\ Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using BSPTaxonomyDifferentCorrections.BSD_implies_SD_for_modified_view by auto \n }\n thus ?thesis by auto \nqed\n\n(*Theorem 6.4.3 Case 3 in Heiko Mantel's pdh thesis*)\ntheorem compositionality_SI: \n\"\\SD \\1 Tr\\<^bsub>ES1\\<^esub>; SD \\2 Tr\\<^bsub>ES2\\<^esub>; SI \\1 Tr\\<^bsub>ES1\\<^esub>; SI \\2 Tr\\<^bsub>ES2\\<^esub> \\ \n \\ SI \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\" \nproof -\n assume \"SD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and \"SI \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SI \\2 Tr\\<^bsub>ES2\\<^esub>\"\n { \n let ?\\\\<^sub>1'=\"\\V = V\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub>, N = {}, C = C\\<^bsub>\\1\\<^esub>\\\"\n let ?\\\\<^sub>2'=\"\\V = V\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub>, N = {}, C = C\\<^bsub>\\2\\<^esub> \\\"\n let ?\\' =\"\\V=V\\<^bsub>\\\\<^esub> \\ N\\<^bsub>\\\\<^esub>, N={}, C=C\\<^bsub>\\\\<^esub> \\\" \n (*Show ?\\\\<^sub>1' ?\\\\<^sub>2' ?\\' are views on the respective set of events*)\n from validV1 have \\\\<^sub>1'IsViewOnE\\<^sub>1: \"isViewOn ?\\\\<^sub>1' E\\<^bsub>ES1\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from validV2 have \\\\<^sub>2'IsViewOnE\\<^sub>2: \"isViewOn ?\\\\<^sub>2' E\\<^bsub>ES2\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from VIsViewOnE have \\'IsViewOnE: \"isViewOn ?\\' E\\<^bsub>(ES1\\ES2)\\<^esub>\" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n \n (*Show ?\\\\<^sub>1' and ?\\\\<^sub>2' are proper separation of \\ V=\\<^bsub>\\\\<^esub>, N={}, C=\\<^bsub>\\\\<^esub> \\ *)\n from propSepViews N\\_inter_E1_is_N\\1\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\" \n unfolding properSeparationOfViews_def by auto\n from propSepViews N\\_inter_E2_is_N\\2\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\" \n unfolding properSeparationOfViews_def by auto\n from propSepViews \n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\" \n unfolding properSeparationOfViews_def by auto \n from propSepViews\n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\" \n unfolding properSeparationOfViews_def by auto\n have \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\"\n by auto\n \n note properSeparation_\\\\<^sub>1\\\\<^sub>2=\\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \n \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \\N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\\\n \n (*Show ES1\\ES2 is a well behaved composition w.r.t. ?\\\\<^sub>1' and ?\\\\<^sub>2' *)\n have wbc1: \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ E\\<^bsub>ES1\\<^esub>={} \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> \\ E\\<^bsub>ES2\\<^esub>={}\"\n by auto\n \n from \\SD \\1 Tr\\<^bsub>ES1\\<^esub>\\ have \"BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto\n from \\SD \\2 Tr\\<^bsub>ES2\\<^esub>\\ have \"BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto \n from \\SI \\1 Tr\\<^bsub>ES1\\<^esub>\\ have \"BSI ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SI_implies_BSI_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto\n from \\SI \\2 Tr\\<^bsub>ES2\\<^esub>\\ have \"BSI ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SI_implies_BSI_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto \n\n from validES1 validES2 composableES1ES2 \\'IsViewOnE \\\\<^sub>1'IsViewOnE\\<^sub>1 \\\\<^sub>2'IsViewOnE\\<^sub>2\n properSeparation_\\\\<^sub>1\\\\<^sub>2 wbc1\n have \"Compositionality ES1 ES2 ?\\' ?\\\\<^sub>1' ?\\\\<^sub>2'\" unfolding Compositionality_def \n by (simp add: properSeparationOfViews_def wellBehavedComposition_def)\n with \\BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\ \\BSI ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\BSI ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\\n have \"BSI ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using Compositionality.compositionality_BSI by blast\n \n from validES1 validES2 composeES_yields_ES validVC\n have \"BSPTaxonomyDifferentCorrections (ES1\\ES2) \\\"\n unfolding BSPTaxonomyDifferentCorrections_def by auto \n with \\BSI ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\\ have \"SI \\ Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using BSPTaxonomyDifferentCorrections.BSI_implies_SI_for_modified_view by auto \n }\n thus ?thesis by auto \nqed\n\n\n(*Theorem 6.4.3 Case 4 in Heiko Mantel's pdh thesis*)\ntheorem compositionality_SIA: \n\"\\SD \\1 Tr\\<^bsub>ES1\\<^esub>; SD \\2 Tr\\<^bsub>ES2\\<^esub>; SIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>; SIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>; \n (\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>; (\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub> \\\n \\ SIA \\ \\ (Tr\\<^bsub>(ES1 \\ ES2)\\<^esub>)\"\nproof -\n assume \"SD \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SD \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and \"SIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\"\n and \"SIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\"\n and \"(\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>\"\n and \"(\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub>\"\n { \n let ?\\\\<^sub>1' =\"\\V = V\\<^bsub>\\1\\<^esub> \\ N\\<^bsub>\\1\\<^esub>, N = {}, C = C\\<^bsub>\\1\\<^esub>\\\"\n let ?\\\\<^sub>2'=\"\\V = V\\<^bsub>\\2\\<^esub> \\ N\\<^bsub>\\2\\<^esub>, N = {}, C = C\\<^bsub>\\2\\<^esub> \\\"\n let ?\\' =\"\\V=V\\<^bsub>\\\\<^esub> \\ N\\<^bsub>\\\\<^esub>, N={}, C=C\\<^bsub>\\\\<^esub> \\\" \n \n (*Fix some intermediate rho's such that (\\1' ?\\\\<^sub>1') = (\\1 \\1), (\\2' ?\\\\<^sub>2') = (\\2 \\2) and\n (\\' ?\\') = (\\ \\) hold.*)\n let \"?\\1'::'a Rho\" =\"\\\\. if \\=?\\\\<^sub>1' then \\1 \\1 else {}\"\n let \"?\\2'::'a Rho\" =\"\\\\. if \\=?\\\\<^sub>2' then \\2 \\2 else {}\"\n let \"?\\'::'a Rho\" =\"\\\\'. if \\'=?\\' then \\ \\ else {}\"\n \n have \"(?\\1' ?\\\\<^sub>1') = (\\1 \\1)\" by simp \n have \"(?\\2' ?\\\\<^sub>2') = (\\2 \\2)\" by simp\n have \"(?\\' ?\\') = (\\ \\)\" by simp\n\n (*Show ?\\\\<^sub>1' ?\\\\<^sub>2' ?\\' are views on the respective set of events*)\n from validV1 have \\\\<^sub>1'IsViewOnE\\<^sub>1: \"isViewOn ?\\\\<^sub>1' E\\<^bsub>ES1\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from validV2 have \\\\<^sub>2'IsViewOnE\\<^sub>2: \"isViewOn ?\\\\<^sub>2' E\\<^bsub>ES2\\<^esub> \" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n from VIsViewOnE have \\'IsViewOnE: \"isViewOn ?\\' E\\<^bsub>(ES1\\ES2)\\<^esub>\" \n unfolding isViewOn_def V_valid_def VN_disjoint_def NC_disjoint_def VC_disjoint_def by auto\n \n (*Show ?\\\\<^sub>1' and ?\\\\<^sub>2' are proper separation of \\ V=\\<^bsub>\\\\<^esub>, N={}, C=\\<^bsub>\\\\<^esub> \\ *)\n from propSepViews N\\_inter_E1_is_N\\1\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n from propSepViews N\\_inter_E2_is_N\\2\n have \"V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n from propSepViews \n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto \n from propSepViews\n have \"C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\"\n unfolding properSeparationOfViews_def by auto\n have \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\"\n by auto\n \n note properSeparation_\\\\<^sub>1\\\\<^sub>2=\\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> = V\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\V\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> = V\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \n \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES1\\<^esub> \\ C\\<^bsub>?\\\\<^sub>1'\\<^esub>\\ \\C\\<^bsub>?\\'\\<^esub> \\ E\\<^bsub>ES2\\<^esub> \\ C\\<^bsub>?\\\\<^sub>2'\\<^esub>\\ \\N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> ={}\\\n \n (*Show ES1\\ES2 is a well behaved composition w.r.t. ?\\\\<^sub>1' and ?\\\\<^sub>2' *)\n have wbc1: \"N\\<^bsub>?\\\\<^sub>1'\\<^esub> \\ E\\<^bsub>ES1\\<^esub>={} \\ N\\<^bsub>?\\\\<^sub>2'\\<^esub> \\ E\\<^bsub>ES2\\<^esub>={}\" \n by auto\n \n \n from \\SD \\1 Tr\\<^bsub>ES1\\<^esub>\\ have \"BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto\n from \\SD \\2 Tr\\<^bsub>ES2\\<^esub>\\ have \"BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SD_implies_BSD_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by auto \n\n from \\SIA \\1 \\1 Tr\\<^bsub>ES1\\<^esub>\\ \\(?\\1' ?\\\\<^sub>1') = (\\1 \\1)\\ have \"BSIA ?\\1' ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\" \n using validES1 validV1 BSPTaxonomyDifferentCorrections.SIA_implies_BSIA_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by fastforce\n from \\SIA \\2 \\2 Tr\\<^bsub>ES2\\<^esub>\\ \\(?\\2' ?\\\\<^sub>2') = (\\2 \\2)\\ have \"BSIA ?\\2' ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\" \n using validES2 validV2 BSPTaxonomyDifferentCorrections.SIA_implies_BSIA_for_modified_view \n unfolding BSPTaxonomyDifferentCorrections_def by fastforce \n\n from validES1 validES2 composableES1ES2 \\'IsViewOnE \\\\<^sub>1'IsViewOnE\\<^sub>1 \\\\<^sub>2'IsViewOnE\\<^sub>2\n properSeparation_\\\\<^sub>1\\\\<^sub>2 wbc1\n have \"Compositionality ES1 ES2 ?\\' ?\\\\<^sub>1' ?\\\\<^sub>2'\" \n unfolding Compositionality_def \n by (simp add: properSeparationOfViews_def wellBehavedComposition_def)\n from \\(\\1 \\1) \\ (\\ \\) \\ E\\<^bsub>ES1\\<^esub>\\ \\(?\\1' ?\\\\<^sub>1') = (\\1 \\1)\\ \\(?\\' ?\\') = (\\ \\)\\\n have \"?\\1' ?\\\\<^sub>1' \\ ?\\' ?\\' \\ E\\<^bsub>ES1\\<^esub>\"\n by auto \n from \\(\\2 \\2) \\ (\\ \\) \\ E\\<^bsub>ES2\\<^esub>\\ \\(?\\2' ?\\\\<^sub>2') = (\\2 \\2)\\ \\(?\\' ?\\') = (\\ \\)\\\n have \"?\\2' ?\\\\<^sub>2' \\ ?\\' ?\\' \\ E\\<^bsub>ES2\\<^esub>\"\n by auto \n\n from \\Compositionality ES1 ES2 ?\\' ?\\\\<^sub>1' ?\\\\<^sub>2'\\ \\BSD ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\BSD ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\ \n \\BSIA ?\\1' ?\\\\<^sub>1' Tr\\<^bsub>ES1\\<^esub>\\ \\BSIA ?\\2' ?\\\\<^sub>2' Tr\\<^bsub>ES2\\<^esub>\\ \n \\?\\1' ?\\\\<^sub>1' \\ ?\\' ?\\' \\ E\\<^bsub>ES1\\<^esub>\\ \\?\\2' ?\\\\<^sub>2' \\ ?\\' ?\\' \\ E\\<^bsub>ES2\\<^esub>\\\n have \"BSIA ?\\' ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\"\n using Compositionality.compositionality_BSIA by fastforce\n \n from validES1 validES2 composeES_yields_ES validVC \n have \"BSPTaxonomyDifferentCorrections (ES1\\ES2) \\\" \n unfolding BSPTaxonomyDifferentCorrections_def by auto \n with \\BSIA ?\\' ?\\' Tr\\<^bsub>(ES1\\ES2)\\<^esub>\\ \\(?\\' ?\\') = (\\ \\)\\ have \"SIA \\ \\ Tr\\<^bsub>(ES1\\ES2)\\<^esub>\" \n using BSPTaxonomyDifferentCorrections.BSIA_implies_SIA_for_modified_view by fastforce\n }\n thus ?thesis\n by auto \nqed\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Modular_Assembly_Kit_Security/Verification/Compositionality/CompositionalityResults.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.28874175514888806}} {"text": "theory TrivialArityAnal\nimports ArityAnalysisSpec \"Launchbury.Env-Nominal\"\nbegin\n\ndefinition Trivial_Aexp :: \"exp \\ Arity \\ AEnv\"\n where \"Trivial_Aexp e = (\\ n. (\\ x. up\\0) f|` fv e)\"\n\nlemma Trivial_Aexp_simp: \"Trivial_Aexp e \\ n = (\\ x. up\\0) f|` fv e\"\n unfolding Trivial_Aexp_def by simp\n\nlemma edom_Trivial_Aexp[simp]: \"edom (Trivial_Aexp e \\ n) = fv e\"\n by (auto simp add: edom_def env_restr_def Trivial_Aexp_def) \n\nlemma Trivial_Aexp_eq[iff]: \"Trivial_Aexp e \\ n = Trivial_Aexp e' \\ n' \\ fv e = (fv e' :: var set)\"\n apply (auto simp add: Trivial_Aexp_simp env_restr_def)\n apply (metis up_defined)+\n done\n \nlemma below_Trivial_Aexp[simp]: \"(ae \\ Trivial_Aexp e \\ n) \\ edom ae \\ fv e\"\n by (auto dest:fun_belowD intro!: fun_belowI simp add: Trivial_Aexp_def env_restr_def edom_def split:if_splits)\n\n\ninterpretation ArityAnalysis Trivial_Aexp.\ninterpretation EdomArityAnalysis Trivial_Aexp\n by standard simp\n\n\ninterpretation ArityAnalysisSafe Trivial_Aexp\nproof\n(*\n fix \\\n show \"\\ \\ Trivial_Aexp = Trivial_Aexp\" by perm_simp rule\nnext\n*)\n fix n x\n show \"up\\n \\ (Trivial_Aexp (Var x)\\n) x\"\n by (simp add: Trivial_Aexp_simp)\nnext\n fix e x n\n show \"Trivial_Aexp e\\(inc\\n) \\ esing x\\(up\\0) \\ Trivial_Aexp (App e x)\\n\"\n by (auto intro: fun_belowI simp add: Trivial_Aexp_def env_restr_def )\nnext\n fix y e n\n show \"env_delete y (Trivial_Aexp e\\(pred\\n)) \\ Trivial_Aexp (Lam [y]. e)\\n\"\n by (auto simp add: Trivial_Aexp_simp env_delete_restr Diff_eq inf_commute)\nnext\n fix x y :: var and S e a\n assume \"x \\ S\" and \"y \\ S\"\n thus \"Trivial_Aexp e[x::=y]\\a f|` S = Trivial_Aexp e\\a f|` S\"\n by (auto simp add: Trivial_Aexp_simp fv_subst_eq intro!: arg_cong[where f = \"\\ S. env_restr S e\" for e])\nnext\n fix scrut e1 a e2\n show \"Trivial_Aexp scrut\\0 \\ Trivial_Aexp e1\\a \\ Trivial_Aexp e2\\a \\ Trivial_Aexp (scrut ? e1 : e2)\\a\"\n by (auto intro: env_restr_mono2 simp add: Trivial_Aexp_simp join_below_iff )\nqed\n\ndefinition Trivial_Aheap :: \"heap \\ exp \\ Arity \\ AEnv\" where\n \"Trivial_Aheap \\ e = (\\ a. (\\ x. up\\0) f|` domA \\)\"\n\nlemma Trivial_Aheap_eqvt[eqvt]: \"\\ \\ (Trivial_Aheap \\ e) = Trivial_Aheap (\\ \\ \\) (\\ \\ e)\"\n unfolding Trivial_Aheap_def\n apply perm_simp\n apply (simp add: Abs_cfun_eqvt)\n done\n\nlemma Trivial_Aheap_simp: \"Trivial_Aheap \\ e\\ a = (\\ x. up\\0) f|` domA \\\"\n unfolding Trivial_Aheap_def by simp\n\nlemma Trivial_fup_Aexp_below_fv: \"fup\\(Trivial_Aexp e)\\a \\ (\\ x . up\\0) f|` fv e\"\n by (cases a)(auto simp add: Trivial_Aexp_simp)\n\nlemma Trivial_Abinds_below_fv: \"ABinds \\\\ae \\ (\\ x . up\\0) f|` fv \\\"\n by (induction \\ rule:ABinds.induct)\n (auto simp add: join_below_iff intro!: below_trans[OF Trivial_fup_Aexp_below_fv] env_restr_mono2 elim: below_trans dest: subsetD[OF fv_delete_subset] simp del: fun_meet_simp)\n\ninterpretation ArityAnalysisLetSafe Trivial_Aexp Trivial_Aheap\nproof\n fix \\\n show \"\\ \\ Trivial_Aheap = Trivial_Aheap\" by perm_simp rule \nnext\n fix \\ e ae show \"edom (Trivial_Aheap \\ e\\ae) \\ domA \\\"\n by (simp add: Trivial_Aheap_simp)\nnext\n fix \\ :: heap and e and a\n show \"ABinds \\\\(Trivial_Aheap \\ e\\a) \\ Trivial_Aexp e\\a \\ Trivial_Aheap \\ e\\a \\ Trivial_Aexp (Terms.Let \\ e)\\a\"\n by (auto simp add: Trivial_Aheap_simp Trivial_Aexp_simp join_below_iff env_restr_join2 intro!: env_restr_mono2 below_trans[OF Trivial_Abinds_below_fv])\nnext\n fix x y :: var and \\ :: heap and e\n assume \"x \\ domA \\\" and \"y \\ domA \\\"\n thus \"Trivial_Aheap \\[x::h=y] e[x::=y] = Trivial_Aheap \\ e\"\n by (auto intro: cfun_eqI simp add: Trivial_Aheap_simp)\nqed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/TrivialArityAnal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2887417489020611}} {"text": "theory TopoS_Stateful_Policy_Algorithm\nimports TopoS_Stateful_Policy TopoS_Composition_Theory\nbegin\n\nsection\\Stateful Policy -- Algorithm\\\n\nsubsection\\Some unimportant lemmata\\\n lemma False_set: \"{(r, s). False} = {}\" by simp\n lemma valid_reqs_ACS_D: \"valid_reqs M \\ valid_reqs (get_ACS M)\"\n by(simp add: valid_reqs_def get_ACS_def)\n lemma valid_reqs_IFS_D: \"valid_reqs M \\ valid_reqs (get_IFS M)\"\n by(simp add: valid_reqs_def get_IFS_def)\n lemma all_security_requirements_fulfilled_ACS_D: \"all_security_requirements_fulfilled M G \\\n all_security_requirements_fulfilled (get_ACS M) G\"\n by(simp add: all_security_requirements_fulfilled_def get_ACS_def)\n lemma all_security_requirements_fulfilled_IFS_D: \"all_security_requirements_fulfilled M G \\\n all_security_requirements_fulfilled (get_IFS M) G\"\n by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n lemma all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph:\n \"\\ valid_reqs M; E' \\ E; wf_graph \\ nodes = V, edges = Efix \\ E \\ \\ \\ \n all_security_requirements_fulfilled M \n (stateful_policy_to_network_graph \\ hosts = V, flows_fix = Efix, flows_state = E \\)\\\n all_security_requirements_fulfilled M \n (stateful_policy_to_network_graph \\ hosts = V, flows_fix = Efix, flows_state = E' \\)\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n apply(drule all_security_requirements_fulfilled_mono[where E=\"Efix \\ E \\ backflows E\" and E'=\"Efix \\ E' \\ backflows E'\" and V=\"V\"])\n apply(thin_tac \"wf_graph G\" for G)\n apply(thin_tac \"all_security_requirements_fulfilled M G\" for M G)\n apply(simp add: backflows_def, blast)\n apply(thin_tac \"all_security_requirements_fulfilled M G\" for M G)\n apply(simp add: wf_graph_def)\n apply(simp add: backflows_def)\n using [[simproc add: finite_Collect]] apply(auto)[1]\n apply(simp_all)\n done\n\n\nsubsection \\Sketch for generating a stateful policy from a simple directed policy\\\n text\\Having no stateful flows, we trivially get a valid stateful policy.\\\n lemma trivial_stateful_policy_compliance:\n \"\\ wf_graph \\ nodes = V, edges = E \\; valid_reqs M; all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ \\ \\ \n stateful_policy_compliance \\ hosts = V, flows_fix = E, flows_state = {} \\ \\ nodes = V, edges = E \\ M\"\n apply(unfold_locales)\n apply(simp_all add: wf_graph_def stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n apply(simp add: get_IFS_def get_ACS_def all_security_requirements_fulfilled_def)\n apply(clarify)\n apply(drule valid_reqs_ACS_D) \n apply(drule all_security_requirements_fulfilled_ACS_D)\n apply(drule(1) all_security_requirements_fulfilled_imp_get_offending_empty)\n by force\n\n\n text\\trying better\\\n\n text\\First, filtering flows that cause no IFS violations\\\n (*the edges front of the list are more likely to be kept*)\n fun filter_IFS_no_violations_accu :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations_accu G M accu [] = accu\" |\n \"filter_IFS_no_violations_accu G M accu (e#Es) = (if\n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (e#accu) \\)\n then filter_IFS_no_violations_accu G M (e#accu) Es\n else filter_IFS_no_violations_accu G M accu Es)\"\n definition filter_IFS_no_violations :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations G M Es = filter_IFS_no_violations_accu G M [] Es\"\n\n\n lemma filter_IFS_no_violations_subseteq_input: \"set (filter_IFS_no_violations G M Es) \\ set Es\"\n apply(subgoal_tac \"\\ accu. set (filter_IFS_no_violations_accu G M accu Es) \\ set Es \\ set accu\")\n apply(erule_tac x=\"[]\" in allE)\n apply(simp add: filter_IFS_no_violations_def)\n unfolding filter_IFS_no_violations_def\n apply(induct_tac Es)\n apply(simp_all)\n apply force\n done\n lemma filter_IFS_no_violations_accu_correct_induction: \"valid_reqs (get_IFS M) \\ wf_graph \\ nodes = V, edges = E \\ \\\n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (accu) \\) \\ \n (set accu) \\ (set edgesList) \\ E \\ \n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (filter_IFS_no_violations_accu \\ nodes = V, edges = E \\ M accu edgesList) \\)\"\n apply(induction edgesList arbitrary: accu)\n by(simp_all)\n lemma filter_IFS_no_violations_correct: \"\\valid_reqs (get_IFS M); wf_graph G;\n all_security_requirements_fulfilled (get_IFS M) G; \n (set edgesList) \\ edges G \\ \\ \n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList) \\)\"\n unfolding filter_IFS_no_violations_def\n apply(case_tac G, simp)\n apply(drule(1) filter_IFS_no_violations_accu_correct_induction[where accu=\"[]\", simplified])\n apply(simp_all)\n by(simp add: stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n lemma filter_IFS_no_violations_accu_no_IFS: \"valid_reqs (get_IFS M) \\ wf_graph G \\ get_IFS M = [] \\\n (set accu) \\ (set edgesList) \\ edges G \\ \n filter_IFS_no_violations_accu G M accu edgesList = rev(edgesList)@accu\"\n apply(induction edgesList arbitrary: accu)\n by(simp_all add: all_security_requirements_fulfilled_def)\n\n\n lemma filter_IFS_no_violations_accu_maximal_induction: \"valid_reqs (get_IFS M) \\ wf_graph \\ nodes = V, edges = E \\ \\ \n set accu \\ E \\ set edgesList \\ E \\\n \\ e \\ E - (set accu \\ set edgesList).\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = {e} \\ (set accu) \\)\n \\\n let stateful = set (filter_IFS_no_violations_accu \\ nodes = V, edges = E \\ M accu edgesList) in\n (\\ e \\ E - stateful.\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = {e} \\ stateful \\))\"\n proof(induction edgesList arbitrary: accu)\n case Nil thus ?case by(simp add: Let_def)\n next\n case(Cons e Es)\n from Cons.prems(3) Cons.prems(2) have \"fst ` set accu \\ V\" and \"snd ` set accu \\ V\"\n by(auto simp add: wf_graph_def)\n \\ \\@{const wf_graph} for some complicated structures\\\n from Cons.prems(2) this Cons.prems(4) have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = insert e (insert ea (set accu)) \\\"\n by(auto simp add: wf_graph_def)\n from backflows_wf[OF this] wf_graph_union_edges[OF Cons.prems(2)]\n have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = E \\ backflows (insert e (insert ea (set accu))) \\\" by (simp)\n hence \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = E \\ set accu \\ backflows (insert e (insert ea (set accu))) \\\" \n by (metis Cons.prems(3) sup.order_iff)\n from this Cons.prems(4)\n have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu))))) \\\"\n by(simp add: insert_absorb)\n hence validgraph1: \"\\ea. ea\\E - (set (e # accu) \\ set Es) \\ \n wf_graph \\ nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu))))) \\\" by(simp)\n\n have validgraph2: \"\\ ea. \n insert ea (E \\ set accu \\ backflows (insert ea (set accu))) \\ insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu)))))\"\n apply(simp add: backflows_def)\n by blast\n \n from all_security_requirements_fulfilled_mono[OF Cons.prems(1) validgraph2 validgraph1] have neg_mono:\n \"\\ea. ea \\ E - (set (e # accu) \\ set Es) \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n \\nodes = V, edges = insert ea (E \\ set accu \\ backflows (insert ea (set accu)))\\\n \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n \\nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu)))))\\\"\n apply(simp)\n by blast\n\n from Cons.prems(5) have \"\\ea. ea\\E - (set (e # accu) \\ set Es) \\\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \n \\hosts = V, flows_fix = E, flows_state = {ea} \\ set (e # accu)\\)\"\n apply(erule_tac x=\"ea\" in ballE)\n prefer 2\n apply simp\n apply(simp only: stateful_policy_to_network_graph_def all_flows_def stateful_policy.select_convs)\n apply(simp)\n apply(frule(1) neg_mono[simplified])\n by(simp)\n hence goalTrue:\n \"\\ ea\\E - (set (e # accu) \\ set Es). \n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = {ea} \\ set (e # accu)\\)\"\n by simp\n \n show ?case\n apply(simp add: Let_def)\n apply(rule conjI)\n\n apply(rule impI)\n apply(thin_tac \"_\") (*dont't need it*)\n using Cons.IH[where accu=\"e # accu\", OF Cons.prems(1) Cons.prems(2) _ _ goalTrue, simplified Let_def] Cons.prems(3) Cons.prems(4)\n apply(auto) [1]\n\n apply(rule impI)\n using Cons.IH[where accu=\"accu\", OF Cons.prems(1) Cons.prems(2), simplified Let_def] Cons.prems(5) Cons.prems(3) Cons.prems(4)\n apply(auto)\n done\n qed\n lemma filter_IFS_no_violations_maximal: \"\\valid_reqs (get_IFS M); wf_graph G;\n (set edgesList) = edges G \\ \\ \n let stateful = set (filter_IFS_no_violations G M edgesList) in \n \\ e \\ edges G - stateful.\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ stateful \\)\"\n unfolding filter_IFS_no_violations_def\n apply(case_tac G, simp)\n apply(drule(1) filter_IFS_no_violations_accu_maximal_induction[where accu=\"[]\" and edgesList=\"edgesList\"])\n by(simp_all)\n\n \\ \\It is not only maximal for single flows but all non-empty subsets\\\n corollary filter_IFS_no_violations_maximal_allsubsets: \n assumes a1: \"valid_reqs (get_IFS M)\"\n and a2: \"wf_graph G\"\n and a4: \"(set edgesList) = edges G\"\n shows \"let stateful = set (filter_IFS_no_violations G M edgesList) in \n \\ E \\ edges G - stateful. E \\ {} \\\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = E \\ stateful \\)\"\n proof -\n let ?stateful = \"set (filter_IFS_no_violations G M edgesList)\"\n from filter_IFS_no_violations_maximal[OF a1 a2 a4] have not_fulfilled_single: \n \"\\e\\edges G - ?stateful. \\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n by(simp add: Let_def)\n have neg_mono:\n \"\\ e E. e \\ E \\ E \\ edges G - ?stateful \\ E \\ {} \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\) \\ \n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ ?stateful\\)\"\n proof -\n fix e E\n assume h1: \"e \\ E\"\n and h2: \"E \\ edges G - ?stateful\"\n and h3: \"E \\ {}\"\n and h4: \"\\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n \n from filter_IFS_no_violations_subseteq_input a4 have \"?stateful \\ edges G\" by blast\n hence \"edges G \\ (E \\ ?stateful) = edges G\" using h2 by blast\n from a2 this have validgraph1: \"wf_graph \\nodes = nodes G, edges = edges G \\ (E \\ ?stateful)\\\"\n by(case_tac G, simp)\n \n from h1 h2 h3 have subseteq: \"({e} \\ ?stateful) \\ (E \\ ?stateful)\" by blast\n\n have revimp: \"\\A B. (A \\ B) \\ (\\ B \\ \\ A)\" by fast\n \n from all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph[OF a1 subseteq validgraph1] h4\n show \"\\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ ?stateful\\)\" \n apply(rule revimp)\n by assumption\n qed\n \n show ?thesis\n proof(simp add: Let_def,rule allI,rule impI, rule impI)\n fix E\n assume h1: \"E \\ edges G - ?stateful\"\n and h2: \"E \\ {}\"\n\n from h1 h2 obtain e where e_prop1: \"e \\ E\" by blast \n from this h1 have \"e \\ edges G - ?stateful\" by blast\n from this not_fulfilled_single have e_prop2: \"\\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n by simp\n \n from neg_mono[OF e_prop1 h1 h2 e_prop2]\n show \" \\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ set (filter_IFS_no_violations G M edgesList)\\)\"\n .\n qed\n qed\n \n \\ \\soundness and completeness\\\n thm filter_IFS_no_violations_correct filter_IFS_no_violations_maximal\n\n\n\n\n\n text\\Next\\\n (*\"\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ ). F \\ backflows (filternew_flows_state \\)\"*)\n (*first in list are more likely to be kept*)\n fun filter_compliant_stateful_ACS_accu :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS_accu G M accu [] = accu\" |\n \"filter_compliant_stateful_ACS_accu G M accu (e#Es) = (if\n e \\ backflows (edges G) \\ (\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (e#accu) \\). F \\ backflows (set (e#accu)))\n then filter_compliant_stateful_ACS_accu G M (e#accu) Es\n else filter_compliant_stateful_ACS_accu G M accu Es)\"\n definition filter_compliant_stateful_ACS :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS G M Es = filter_compliant_stateful_ACS_accu G M [] Es\"\n\n\n lemma filter_compliant_stateful_ACS_subseteq_input: \"set (filter_compliant_stateful_ACS G M Es) \\ set Es\"\n apply(subgoal_tac \"\\ accu. set (filter_compliant_stateful_ACS_accu G M accu Es) \\ set Es \\ set accu\")\n apply(erule_tac x=\"[]\" in allE)\n apply(simp add: filter_compliant_stateful_ACS_def)\n apply(induct_tac Es)\n apply(simp_all)\n apply (metis Un_insert_right set_simps(2) set_subset_Cons set_union subset_trans)\n done\n lemma filter_compliant_stateful_ACS_accu_correct_induction: \"valid_reqs (get_ACS M) \\ wf_graph \\ nodes = V, edges = E \\ \\\n (set accu) \\ (set edgesList) \\ E \\ \n \\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (accu) \\). F \\ backflows (set accu) \\ \n (\\a \\ set accu. a \\ (backflows E)) \\\n \\ = \\ hosts = V, flows_fix = E, flows_state = set (filter_compliant_stateful_ACS_accu \\ nodes = V, edges = E \\ M accu edgesList) \\ \\\n \\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof(induction edgesList arbitrary: accu)\n case Nil\n from Nil(5) have \"backflows (set accu) = backflows {e \\ set accu. e \\ backflows E}\" by (metis (lifting) Collect_cong Collect_mem_eq)\n from this Nil(4) have \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu\\). F \\ backflows {e \\ set accu. e \\ backflows E}\" by simp\n from this Nil(6) show ?case by(simp add: filternew_flows_state_alt2)\n next\n case (Cons e Es)\n from Cons.IH[OF Cons.prems(1) Cons.prems(2)] Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6)\n show ?case by(simp add: filternew_flows_state_alt2 split: if_split_asm)\n qed\n\n \n lemma filter_compliant_stateful_ACS_accu_no_side_effects: \"valid_reqs (get_ACS M) \\ wf_graph G \\\n \\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G) \\\n (set accu) \\ (set edgesList) \\ edges G \\ \n (\\a \\ set accu. a \\ (backflows (edges G))) \\\n filter_compliant_stateful_ACS_accu G M accu edgesList = rev([ e \\ edgesList. e \\ backflows (edges G)])@accu\"\n apply(simp add: backflows_minus_backflows)\n apply(induction edgesList arbitrary: accu)\n apply(simp)\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n apply(rule impI)\n apply(case_tac G, simp, rename_tac V E)\n thm Un_set_offending_flows_bound_minus_subseteq'[where X=\"backflows E - E\" and E=\"E \\ backflows E\"]\n apply(drule_tac X=\"backflows E - E\" and E=\"E \\ backflows E\" and E'=\"(E \\ backflows E) - (insert a (E \\ set accu \\ backflows (insert a (set accu))))\" in Un_set_offending_flows_bound_minus_subseteq')\n defer\n prefer 2\n apply blast\n apply auto[1]\n apply(subgoal_tac \"E \\ backflows E - (E \\ backflows E - insert a (E \\ set accu \\ backflows (insert a (set accu)))) = insert a (E \\ set accu \\ backflows (insert a (set accu)))\")\n apply(simp)\n prefer 2\n apply (metis Un_assoc Un_least Un_mono backflows_subseteq double_diff insert_def insert_subset subset_refl)\n apply(subgoal_tac \"backflows (insert a (set accu)) \\ backflows E - E - (E \\ backflows E - insert a (E \\ set accu \\ backflows (insert a (set accu))))\")\n apply(blast)\n apply(simp add: backflows_def)\n apply fast\n using FiniteGraph.backflows_wf FiniteGraph.wf_graph_union_edges by metis\n\n\n\n lemma filter_compliant_stateful_ACS_correct: \n assumes a1: \"valid_reqs (get_ACS M)\"\n and a2: \"wf_graph G\"\n and a3: \"set edgesList \\ edges G\" \n and a4: \"all_security_requirements_fulfilled (get_ACS M) G\"\n and a5: \"\\ = \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_compliant_stateful_ACS G M edgesList) \\\"\n shows \"\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof -\n obtain V E where VE: \"G = \\ nodes = V, edges = E \\\" by(case_tac G, blast)\n from VE a2 have wfVE: \"wf_graph \\ nodes = V, edges = E \\\" by simp\n from VE a3 have \"set edgesList \\ E\" by simp\n\n from a5 VE have a5': \"\\ = \\hosts = V, flows_fix = E, flows_state = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M [] edgesList)\\\"\n unfolding filter_compliant_stateful_ACS_def\n by(simp)\n\n from all_security_requirements_fulfilled_imp_get_offending_empty[OF a1 a4] VE\n have \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = {}\\). F \\ backflows {}\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n\n from filter_compliant_stateful_ACS_accu_correct_induction[where accu=\"[]\" and edgesList=\"edgesList\", simplified, OF a1 wfVE \\set edgesList \\ E\\ this a5']\n show ?thesis .\n qed\n\n\n lemma filter_compliant_stateful_ACS_accu_induction_maximal:\"\\ valid_reqs (get_ACS M); wf_graph \\ nodes = V, edges = E \\;\n (set edgesList) \\ E;\n (set accu) \\ E; \n stateful = set (filter_compliant_stateful_ACS_accu \\ nodes = V, edges = E \\ M accu edgesList);\n \\e \\ E - (set edgesList \\ set accu \\ {e \\ E. e \\ backflows E}).\n \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set accu \\ {e} \\))\n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = set accu \\ {e} \\)\n \\ \\\n \\e \\ E - (stateful \\ {e \\ E. e \\ backflows E}). \\<^cancel>\\E - {computed stateful flows plus trivial stateful flows}\\\n \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\))\n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\)\"\n proof(induction edgesList arbitrary: accu E)\n case Nil from Nil(5)[simplified] Nil(6) show ?case by(simp)\n next\n case (Cons a Es)\n \\ \\case distinction\\\n let ?caseDistinction=\"a \\ backflows (E) \\ (\\F\\get_offending_flows (get_ACS M)\n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu)\\).\n F \\ backflows (set (a # accu)))\"\n from Cons.prems(3) have \"set Es \\ E\" by simp\n\n show ?case\n proof(cases ?caseDistinction)\n assume CaseTrue: ?caseDistinction\n from CaseTrue have \n \"set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu (a # Es)) = \n set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M (a # accu) Es)\"\n by(simp)\n from this Cons.prems(5) have statefulsimp:\n \"stateful = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M (a # accu) Es)\" by simp\n from Cons.prems(3) Cons.prems(4) have \"set (a # accu) \\ E\" by simp\n\n have \"\\e\\E - (set Es \\ set (a # accu) \\ {e \\ E. e \\ backflows E}).\n \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\))\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n proof(rule ballI)\n fix e\n assume h1: \"e \\ E - (set Es \\ set (a # accu) \\ {e \\ E. e \\ backflows E})\"\n\n from conjunct1[OF CaseTrue] have filternew_flows_state_moveout_a:\n \"filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\ = \n {a} \\ filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\\"\n apply(simp add: filternew_flows_state_alt) by blast\n\n have backflowssubseta: \"\\X. backflows X \\ backflows ({a} \\ X)\" by(simp add: backflows_def, blast)\n\n from Cons.prems(6) h1 have \n \"\\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\))\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\" by simp\n from this obtain dat_offender where \n dat_in: \"dat_offender \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\))\"\n and dat_offends: \"dat_offender \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\" by blast\n\n have wfGraphA: \"wf_graph (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n proof(simp add: stateful_policy_to_network_graph_def all_flows_def)\n from Cons.prems(2) h1 Cons.prems(3) Cons.prems(4)\n have \"wf_graph \\nodes=V, edges = insert e (insert a (set accu)) \\\" \n apply(auto simp add: wf_graph_def) by force\n from this backflows_wf\n have vgh1: \"wf_graph \\nodes = V, edges = backflows (insert e (insert a (set accu)))\\\" by auto\n from Cons.prems(2) wf_graph_add_subset_edges h1 Cons.prems(3) Cons.prems(4)\n have vgh2: \"wf_graph \\nodes = V, edges = insert e ((insert a E) \\ set accu)\\\"\n proof -\n have f1: \"e \\ E - (set Es \\ insert a (set accu) \\ {R \\ E. R \\ backflows E})\"\n using h1 by simp\n have f2: \"insert a (set accu) \\ E\"\n using \\set (a # accu) \\ E\\ by simp\n have f3: \"e \\ E\"\n using f1 by fastforce\n have \"E \\ insert a (set accu) = E\"\n using f2 by fastforce\n thus \"wf_graph \\nodes = V, edges = insert e (insert a E \\ set accu)\\\"\n using f3 Cons.prems(2) Un_insert_right insert_absorb sup_commute by fastforce\n qed\n from vgh1 vgh2 wf_graph_union_edges\n show \"wf_graph \\nodes = V, edges = insert e (insert a (E \\ set accu \\ backflows (insert e (insert a (set accu)))))\\\" by fastforce\n qed\n \n from dat_in have dat_in_simplified: \n \"dat_offender \\ \\(get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\)\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def)\n\n have subsethlp: \"insert e (E \\ set accu \\ backflows (insert e (set accu))) \\ E \\ (set (a # accu) \\ {e}) \\ backflows (set (a # accu) \\ {e})\"\n apply(simp)\n apply(rule, blast)\n apply(rule, blast)\n apply(rule)\n apply(simp add: backflows_def, fast)\n done\n\n from get_offending_flows_union_mono[OF \n Cons.prems(1) \n wfGraphA[simplified stateful_policy_to_network_graph_def all_flows_def graph.select_convs stateful_policy.select_convs],\n OF subsethlp]\n dat_in_simplified have dat_in_a: \"dat_offender \\ \\(get_offending_flows (get_ACS M) \n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\))\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def, fast)\n\n have \"dat_offender \\ (snd a, fst a)\"\n proof(rule ccontr)\n assume \"\\ dat_offender \\ (snd a, fst a)\"\n hence hlpassm: \"dat_offender = (snd a, fst a)\" by simp\n from this obtain a1 a2 where \"dat_offender = (a2, a1)\" by blast\n \n \n have \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\) \\ \n insert e (E \\ set accu \\ backflows (insert e (set accu)))\"\n by (metis Cons.prems(1) Sup_le_iff get_offending_flows_subseteq_edges)\n from this h1 have UN_get_subset: \n \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\) \\ \n (E \\ set accu \\ backflows (insert e (set accu)))\"\n by blast\n\n from dat_offends have dat_offends_simplified: \n \"dat_offender \\ backflows (insert e (set accu)) - E\"\n by(simp only: filternew_flows_state_alt stateful_policy.select_convs backflows_minus_backflows, simp)\n \n from conjunct1[OF CaseTrue] hlpassm have \"dat_offender \\ E\"\n by(simp add: backflows_def, fastforce)\n from dat_in_simplified UN_get_subset this have \"dat_offender \\ set accu \\ backflows (insert e (set accu))\" by blast\n from this Cons.prems(4) \\dat_offender \\ E\\ have \"dat_offender \\ backflows (insert e (set accu))\" by blast\n from dat_offends_simplified[simplified] this have \"dat_offender \\ E\" by simp\n from \\dat_offender \\ E\\ \\dat_offender \\ E\\ show False by simp\n qed\n\n from this dat_offends have \n \"dat_offender \\ backflows ({a} \\ filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\"\n apply(simp add: backflows_def) by force\n\n from dat_in_a this\n show \"\\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\))\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n apply(subst filternew_flows_state_moveout_a) by blast\n qed\n\n from Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ E\\ \\set (a # accu) \\ E\\ statefulsimp this ] show \"?case\" \n by(simp)\n next\n assume CaseFalse: \"\\ ?caseDistinction\"\n\n from CaseFalse have funapplysimp: \n \"set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu (a # Es)) = \n set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu Es)\"\n by auto\n from this Cons.prems(5) have statefulsimp:\n \"stateful = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu Es)\" by simp\n from Cons.prems(4) have \"set accu \\ E\" .\n\n have \"a \\ E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E})\\ \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\))\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\"\n proof(rule ccontr)\n assume h1: \"a \\ E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E})\"\n and \"\\ \\\\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\"\n hence hccontr: \"\\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\" by simp\n\n moreover from h1 have stateful_to_graph: \"stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\ = \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def, blast)\n moreover have \"backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\) = backflows (insert a (set accu)) - E\"\n by(simp add: filternew_flows_state_alt backflows_minus_backflows)\n ultimately have hccontr_simp:\n \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\) \\ backflows (insert a (set accu)) - E\" by simp\n\n from Cons.prems(3) Cons.prems(4) have backaaccusubE: \"backflows (set (a # accu)) \\ backflows E\" by(simp add: backflows_def, fastforce)\n from h1 have \"a \\ backflows E\" by fastforce\n from backaaccusubE \\a \\ backflows E\\ have \"a \\ backflows (insert a (set accu))\" by auto\n\n\n from \\a \\ backflows E\\ CaseFalse have \"\\ (\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu)\\). F \\ backflows (set (a # accu)))\" by(simp)\n from this stateful_to_graph have \"\\ (\\F\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\. F \\ backflows (insert a (set accu)))\" by(simp)\n from this hccontr_simp show False by blast\n qed\n from Cons.prems(6)[simplified funapplysimp statefulsimp] this\n have \"\\e\\E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E}).\n \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\))\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\"\n by auto\n\n from Cons.IH[OF Cons.prems(1) Cons.prems(2) \\set Es \\ E\\ \\set accu \\ E\\ statefulsimp this]\n show ?case by simp\n qed\n qed\n\n\n\n\n\n\n \n\n lemma filter_compliant_stateful_ACS_maximal: \"\\ valid_reqs (get_ACS M); wf_graph \\ nodes = V, edges = E \\;\n (set edgesList) = E;\n stateful = set (filter_compliant_stateful_ACS \\ nodes = V, edges = E \\ M edgesList)\n \\ \\\n \\e \\ E - (stateful \\ {e \\ E. e \\ backflows E}). \\<^cancel>\\E - {computed stateful flows plus trivial stateful flows}\\\n \\ \\ (get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\))\n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\)\"\n apply(drule(1) filter_compliant_stateful_ACS_accu_induction_maximal[where accu=\"[]\", simplified])\n apply(blast)\n apply(simp add: filter_compliant_stateful_ACS_def)\n apply(simp)\n apply fastforce\n apply(simp add: filter_compliant_stateful_ACS_def)\n done\n\n\n lemma filter_compliant_stateful_ACS_maximal_allsubsets:\n assumes a1: \"valid_reqs (get_ACS M)\" and a2: \"wf_graph \\ nodes = V, edges = E \\\"\n and a3: \"(set edgesList) = E\"\n and a4: \"stateful = set (filter_compliant_stateful_ACS \\ nodes = V, edges = E \\ M edgesList)\"\n and a5: \"X \\ E - (stateful \\ backflows E)\" and a6: \"X \\ {}\"\n shows \"\n \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ X \\))\n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ X \\)\"\n proof(rule ccontr, simp)\n from a5 have \"X \\ E\" by blast\n assume accontr: \"\\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ X\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ X\\)\"\n hence \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ (stateful \\ X) \\ backflows (stateful \\ X)\\) \\ backflows (stateful \\ X) - E\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def filternew_flows_state_alt backflows_minus_backflows)\n hence \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ X \\ backflows (stateful \\ X)\\) \\ backflows (stateful \\ X) - E\"\n using a4 a3 filter_compliant_stateful_ACS_subseteq_input by (metis Diff_subset_conv Un_Diff_cancel Un_assoc a3 bot.extremum_unique sup_bot_right)\n hence accontr_simp: \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ (backflows stateful) \\ (backflows X)\\) \\ backflows (stateful \\ X) - E\"\n using Set.Un_absorb2[OF \\X \\ E\\] backflows_un[of \"stateful\" \"X\"] by (metis Un_assoc)\n \n from a2 a5 have \"finite X\" apply(simp add: wf_graph_def) by (metis (full_types) finite_Diff finite_subset)\n from a6 obtain x where \"x \\ X\" by blast\n\n\n from \\x \\ X\\ a5 have xX_simp1: \"(backflows X) - (backflows (X - {x}) - E) = backflows {x}\"\n apply(simp add: backflows_def) by fast\n from a5 have \"X \\ stateful = {}\" by auto\n from \\x \\ X\\ this have xX_simp2: \"(backflows stateful) - (backflows (X - {x}) - E) = backflows stateful\"\n apply(simp add: backflows_def) by fast\n have xX_simp3:\"backflows (stateful \\ X) - (backflows (X - {x}) - E) = backflows (stateful \\ {x})\"\n apply(simp only: backflows_un)\n using xX_simp1 xX_simp2 by blast\n\n have xX_simp4: \"backflows (stateful \\ X) - E - (backflows (X - {x}) - E) = backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp add: filternew_flows_state_alt backflows_minus_backflows)\n using xX_simp3 by auto\n\n\n have xX_simp5: \"(E \\ backflows stateful \\ backflows X) - (backflows (X - {x}) - E) = E \\ backflows stateful \\ backflows {x}\"\n using xX_simp3[simplified backflows_un] by blast\n\n have Eexpand: \"E \\ stateful \\ {x} = E\" \n using a4 a3 filter_compliant_stateful_ACS_subseteq_input a5 \\x\\X\\ by blast\n\n have \"backflows (stateful \\ X) - E - backflows (X - {x}) = (backflows (stateful \\ X) - E) - backflows (X - {x})\" by simp\n from \\finite X\\ backflows_finite have finite: \"finite (backflows (X - {x}) - E)\" by auto\n from a2 a4 a3 filter_compliant_stateful_ACS_subseteq_input have \"wf_graph \\nodes = V, edges = stateful\\\" by (metis Diff_partition wf_graph_remove_edges_union)\n from backflows_wf[OF this] have \"wf_graph \\nodes = V, edges = backflows stateful\\\" .\n from a2 \\X \\ E\\ have \"wf_graph \\nodes = V, edges = X\\\" by (metis double_diff dual_order.refl wf_graph_remove_edges)\n from backflows_wf[OF this] have \"wf_graph \\nodes = V, edges = backflows X\\\" .\n from this wf_graph_union_edges \\wf_graph \\nodes = V, edges = backflows stateful\\\\ a2 have wfG: \n \"wf_graph \\nodes = V, edges = E \\ backflows stateful \\ backflows X\\\" by metis\n\n from \\x\\X\\ have subset: \"backflows (X - {x}) - E \\ E \\ backflows stateful \\ backflows X\" apply(simp add: backflows_def) by fast\n\n from Un_set_offending_flows_bound_minus_subseteq'[OF a1 wfG subset accontr_simp] have\n \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = (E \\ backflows stateful \\ backflows X) - (backflows (X - {x}) - E)\\) \\ (backflows (stateful \\ X) - E) - (backflows (X - {x}) - E)\" by simp\n from this xX_simp4 xX_simp5 have trans1:\n \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ backflows stateful \\ backflows {x}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\" by simp\n\n hence \"\\(get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ backflows (stateful \\ {x})\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp only: backflows_un) by (metis Un_assoc)\n hence contr1: \"\\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp only: stateful_policy_to_network_graph_def all_flows_def stateful_policy.select_convs)\n using Eexpand by (metis Un_assoc)\n \n\n from filter_compliant_stateful_ACS_maximal[OF a1 a2 a3 a4] have\n \"\\e\\E - (stateful \\ {e \\ E. e \\ backflows E}). \\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {e}\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {e}\\)\" .\n from this a5 \\x \\ X\\ have contr2: \"\\ \\(get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\" by blast\n\n from contr1 contr2\n show \"False\" by simp\n qed\n\n\n text\\@{term filter_compliant_stateful_ACS} is correct and maximal\\\n thm filter_compliant_stateful_ACS_correct filter_compliant_stateful_ACS_maximal\n\n\n text\\Getting those together. We cannot say \\edgesList = E\\ here because one filters first. I guess filtering ACS first is easier, ...\\\n\n\n\n\n\n\n\n\n\n\n definition generate_valid_stateful_policy_IFSACS :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ 'v stateful_policy\" where\n \"generate_valid_stateful_policy_IFSACS G M edgesList \\ (let filterIFS = filter_IFS_no_violations G M edgesList in\n (let filterACS = filter_compliant_stateful_ACS G M filterIFS in \\ hosts = nodes G, flows_fix = edges G, flows_state = set filterACS \\))\"\n\n lemma generate_valid_stateful_policy_IFSACS_wf_stateful_policy: assumes wfG: \"wf_graph G\"\n and edgesList: \"(set edgesList) = edges G\"\n shows \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n proof -\n from wfG show ?thesis\n apply(simp add: generate_valid_stateful_policy_IFSACS_def wf_stateful_policy_def)\n apply(auto simp add: wf_graph_def)\n using edgesList filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by (metis rev_subsetD)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_select_simps:\n shows \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\"\n and \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\"\n and \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ set edgesList\"\n proof -\n show \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n show \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n show \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ set edgesList\"\n apply(simp add: generate_valid_stateful_policy_IFSACS_def)\n using filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by (metis subset_trans)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_all_security_requirements_fulfilled_IFS: assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n shows \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS G M edgesList))\"\n proof -\n have simp3: \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ edges G\" using generate_valid_stateful_policy_IFSACS_select_simps(3) edgesList by fast\n\n have \"set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList)) \\ set (filter_IFS_no_violations G M edgesList)\"\n using filter_compliant_stateful_ACS_subseteq_input edgesList by (metis)\n from backflows_subseteq this have \n \"backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList))) \\ backflows (set (filter_IFS_no_violations G M edgesList))\" by metis\n hence subseteqhlp1:\n \"edges G \\ backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList))) \\ edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\" by blast\n\n from high_level_policy_valid have \"all_security_requirements_fulfilled (get_IFS M) G\" by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n from filter_IFS_no_violations_correct[OF valid_reqs_IFS_D[OF validReqs] wfG this edgesList] have \n \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList)\\)\" .\n from this edgesList have goalIFS:\n \"all_security_requirements_fulfilled (get_IFS M) \\nodes = nodes G, edges = edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\\\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n by (metis Un_absorb2 filter_IFS_no_violations_subseteq_input order_trans)\n\n\n from wfG filter_IFS_no_violations_subseteq_input[where Es=\"edgesList\" and G=\"G\" and M=\"M\"] edgesList have \n \"wf_graph \\nodes = nodes G, edges = set (filter_IFS_no_violations G M edgesList)\\\" \n apply(case_tac G, simp)\n by (metis le_iff_sup wf_graph_remove_edges_union)\n from backflows_wf[OF this] have\n \"wf_graph \\nodes = nodes G, edges = backflows (set (filter_IFS_no_violations G M edgesList))\\\" by(simp)\n from this wf_graph_union_edges wfG have \n \"wf_graph \\nodes = nodes G, edges = edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\\\" \n by (metis graph.cases graph.select_convs(1) graph.select_convs(2))\n\n from all_security_requirements_fulfilled_mono[OF valid_reqs_IFS_D[OF validReqs] subseteqhlp1 this goalIFS]\n have \"all_security_requirements_fulfilled (get_IFS M) \\nodes = nodes G, edges = edges G \\ backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList)))\\\"\n .\n thus ?thesis\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def generate_valid_stateful_policy_IFSACS_select_simps simp3 Un_absorb2)\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n qed\n\n theorem generate_valid_stateful_policy_IFSACS_stateful_policy_compliance:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS G M edgesList\"\n shows \"stateful_policy_compliance \\ G M\"\n proof -\n have 1: \"wf_stateful_policy \\\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 2: \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 3: \"hosts \\ = nodes G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_select_simps(1))\n have 4: \"flows_fix \\ \\ edges G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_select_simps(2))\n have 5: \" all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\)\"\n apply(simp add: Tau)\n using generate_valid_stateful_policy_IFSACS_all_security_requirements_fulfilled_IFS[OF validReqs wfG high_level_policy_valid] edgesList by blast\n have 6: \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n using filter_compliant_stateful_ACS_correct[OF valid_reqs_ACS_D[OF validReqs] wfG _ _ Tau[simplified generate_valid_stateful_policy_IFSACS_def Let_def]] all_security_requirements_fulfilled_ACS_D[OF high_level_policy_valid]\n edgesList filter_IFS_no_violations_subseteq_input by metis\n\n from 1 2 3 4 5 6 validReqs high_level_policy_valid wfG\n show ?thesis\n unfolding stateful_policy_compliance_def by simp\n qed\n\n\n\n\n\n definition generate_valid_stateful_policy_IFSACS_2 :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ 'v stateful_policy\" where\n \"generate_valid_stateful_policy_IFSACS_2 G M edgesList \\ \n \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList) \\ set (filter_compliant_stateful_ACS G M edgesList) \\\"\n\n\n lemma generate_valid_stateful_policy_IFSACS_2_wf_stateful_policy: assumes wfG: \"wf_graph G\"\n and edgesList: \"(set edgesList) = edges G\"\n shows \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS_2 G M edgesList)\"\n proof -\n from wfG show ?thesis\n apply(simp add: generate_valid_stateful_policy_IFSACS_2_def wf_stateful_policy_def)\n apply(auto simp add: wf_graph_def)\n using edgesList filter_IFS_no_violations_subseteq_input by (metis rev_subsetD)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_2_select_simps:\n shows \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\"\n and \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\"\n and \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) \\ set edgesList\"\n proof -\n show \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n show \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n show \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) \\ set edgesList\"\n apply(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n using filter_compliant_stateful_ACS_subseteq_input by (metis inf.coboundedI2)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_2_all_security_requirements_fulfilled_IFS: assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n shows \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList))\"\n proof -\n have subseteq: \"set (filter_IFS_no_violations G M edgesList) \\ set (filter_compliant_stateful_ACS G M edgesList) \\ set (filter_IFS_no_violations G M edgesList)\" by blast\n\n from wfG filter_IFS_no_violations_subseteq_input edgesList\n have wfG': \"wf_graph \\nodes = nodes G, edges = edges G \\ set (filter_IFS_no_violations G M edgesList)\\\" \n by (metis graph_eq_intro Un_absorb2 graph.select_convs(1) graph.select_convs(2) order.trans)\n\n from high_level_policy_valid have \"all_security_requirements_fulfilled (get_IFS M) G\" by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n from filter_IFS_no_violations_correct[OF valid_reqs_IFS_D[OF validReqs] wfG this edgesList] have \n \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList)\\)\" .\n\n\n from all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph[OF valid_reqs_IFS_D[OF validReqs] subseteq wfG' this]\n have \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList))\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n thus ?thesis .\n qed\n\n\n lemma generate_valid_stateful_policy_IFSACS_2_filter_compliant_stateful_ACS:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS_2 G M edgesList\"\n shows \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof- \n let ?filterACS = \"set (filter_compliant_stateful_ACS G M edgesList)\"\n let ?filterIFS = \"set (filter_IFS_no_violations G M edgesList)\"\n from all_security_requirements_fulfilled_ACS_D[OF high_level_policy_valid] have \"all_security_requirements_fulfilled (get_ACS M) G\" .\n\n from filter_compliant_stateful_ACS_correct[OF valid_reqs_ACS_D[OF validReqs] wfG edgesList this] have \n \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = ?filterACS\\). \n F \\ backflows (?filterACS) - edges G\"\n apply(simp)\n apply(simp add: backflows_minus_backflows[symmetric])\n by(simp add: filternew_flows_state_alt)\n hence \"\\F\\get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\. F \\ backflows (?filterACS) - edges G\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n using filter_compliant_stateful_ACS_subseteq_input by (metis (lifting, no_types) Un_absorb2 edgesList order_trans)\n from this validReqs have offending_filterACS_upperbound:\n \"\\m. m \\ set (get_ACS M) \\ \n \\(c_offending_flows m \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\) \\ \n backflows (?filterACS) - edges G\"\n by(simp add: valid_reqs_def get_offending_flows_def, blast)\n\n from wfG filter_compliant_stateful_ACS_subseteq_input edgesList have \"wf_graph \\nodes = nodes G, edges = ?filterACS\\\"\n by (metis graph.cases graph.select_convs(1) graph.select_convs(2) le_iff_sup wf_graph_remove_edges_union)\n from this backflows_wf have \"wf_graph \\nodes = nodes G, edges = backflows (?filterACS)\\\" by blast\n moreover have \"wf_graph \\nodes = nodes G, edges = edges G\\\" using wfG by(case_tac G, simp)\n ultimately have wfG1: \"wf_graph \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\\"\n using wf_graph_union_edges by blast\n \n from edgesList have edgesUnsimp: \"edges G \\ (?filterACS \\ ?filterIFS) = edges G\"\n using filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by blast\n\n \\ \\We set up a ?REM that we use in the @{thm configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq} lemma\\\n let ?REM = \"(backflows (?filterACS) - backflows (?filterIFS)) - edges G\"\n\n have REM_gives_desired_upper_bound: \"(backflows (?filterACS) - edges G) - ?REM = backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: backflows_def, blast)\n\n have REM_gives_desired_edges: \"(edges G \\ backflows (?filterACS)) - ?REM = edges G \\ (backflows (?filterACS \\ ?filterIFS))\"\n by(simp add: backflows_def, blast)\n\n from wfG have \"finite (edges G)\" using wf_graph_def by blast\n hence \"finite (backflows ?filterACS)\" using backflows_finite by (metis List.finite_set)\n hence finite1: \"finite (backflows (?filterACS) - backflows (?filterIFS) - edges G)\" by fast\n\n from configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq[where E'=\"?REM\" and X=\"(backflows (?filterACS) - edges G)\",\n OF _ wfG1 offending_filterACS_upperbound, simplified REM_gives_desired_upper_bound REM_gives_desired_edges\n ] valid_reqs_ACS_D[OF validReqs, unfolded valid_reqs_def]\n have \"\\m. m \\ set (get_ACS M) \\\n \\F\\c_offending_flows m \\nodes = nodes G, edges = edges G \\ backflows (?filterACS \\ ?filterIFS)\\.\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\" by blast\n hence \"\\F\\get_offending_flows (get_ACS M)\n \\nodes = nodes G, edges = edges G \\ (backflows (?filterACS \\ ?filterIFS))\\. F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n using get_offending_flows_def by fast\n hence \"\\F\\get_offending_flows (get_ACS M)\n \\nodes = nodes G, edges = edges G \\ (?filterACS \\ ?filterIFS) \\ (backflows (?filterACS \\ ?filterIFS))\\.\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: edgesUnsimp)\n hence \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = ?filterACS \\ ?filterIFS\\).\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def)\n\n thus ?thesis\n apply(simp add: Tau generate_valid_stateful_policy_IFSACS_2_def)\n apply(simp add: filternew_flows_state_alt backflows_minus_backflows)\n by (metis inf_commute)\n qed\n \n\n\n\n\n theorem generate_valid_stateful_policy_IFSACS_2_stateful_policy_compliance:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS_2 G M edgesList\"\n shows \"stateful_policy_compliance \\ G M\"\n proof -\n have 1: \"wf_stateful_policy \\\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_wf_stateful_policy[OF wfG edgesList])\n have 2: \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 3: \"hosts \\ = nodes G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_select_simps(1))\n have 4: \"flows_fix \\ \\ edges G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_select_simps(2))\n have 5: \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\)\"\n apply(simp add: Tau)\n using generate_valid_stateful_policy_IFSACS_2_all_security_requirements_fulfilled_IFS[OF validReqs wfG high_level_policy_valid] edgesList by blast\n have 6: \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n using generate_valid_stateful_policy_IFSACS_2_filter_compliant_stateful_ACS[OF \n validReqs wfG high_level_policy_valid]\n Tau edgesList by auto\n\n from 1 2 3 4 5 6 validReqs high_level_policy_valid wfG\n show ?thesis\n unfolding stateful_policy_compliance_def by simp\n qed\n\n\n\n\n\n text\\\n If there are no IFS requirements and the ACS requirements cause no side effects,\n effectively, the graph can be considered as undirected graph! \n\\\n lemma generate_valid_stateful_policy_IFSACS_2_noIFS_noACSsideeffects_imp_fullgraph:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and no_ACS_sideeffects: \"\\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G)\"\n and no_IFS: \"get_IFS M = []\"\n shows \"stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = undirected G\"\n proof -\n from filter_IFS_no_violations_accu_no_IFS[OF valid_reqs_IFS_D[OF validReqs] wfG no_IFS] edgesList\n have \"filter_IFS_no_violations G M edgesList = rev edgesList\"\n by(simp add: filter_IFS_no_violations_def)\n from this filter_compliant_stateful_ACS_subseteq_input have flows_state_IFS: \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = set (filter_compliant_stateful_ACS G M edgesList)\"\n by(auto simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n have flowsfix: \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\" by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n have hosts: \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\" by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n from filter_compliant_stateful_ACS_accu_no_side_effects[OF valid_reqs_ACS_D[OF validReqs] wfG no_ACS_sideeffects] have \n \"filter_compliant_stateful_ACS G M edgesList = rev [e\\edgesList . e \\ backflows (edges G)]\"\n by(simp add: filter_compliant_stateful_ACS_def edgesList)\n hence filterACS: \"set (filter_compliant_stateful_ACS G M edgesList) = edges G - (backflows (edges G))\" using edgesList by force\n\n show ?thesis\n apply(simp add: undirected_backflows stateful_policy_to_network_graph_def all_flows_def)\n apply(simp add: hosts filterACS flows_state_IFS flowsfix)\n apply(simp add: backflows_minus_backflows)\n by fast\n qed\n lemma generate_valid_stateful_policy_IFSACS_noIFS_noACSsideeffects_imp_fullgraph:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and no_ACS_sideeffects: \"\\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G)\"\n and no_IFS: \"get_IFS M = []\"\n shows \"stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS G M edgesList) = undirected G\"\n proof -\n from filter_IFS_no_violations_accu_no_IFS[OF valid_reqs_IFS_D[OF validReqs] wfG no_IFS] edgesList\n have \"filter_IFS_no_violations G M edgesList = rev edgesList\"\n by(simp add: filter_IFS_no_violations_def)\n from this filter_compliant_stateful_ACS_subseteq_input have flows_state_IFS: \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) = set (filter_compliant_stateful_ACS G M (rev edgesList))\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n have flowsfix: \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\" by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n have hosts: \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\" by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n from filter_compliant_stateful_ACS_accu_no_side_effects[OF valid_reqs_ACS_D[OF validReqs] wfG no_ACS_sideeffects] have \n \"filter_compliant_stateful_ACS G M (rev edgesList) = [e\\edgesList . e \\ backflows (edges G)]\"\n apply(simp add: filter_compliant_stateful_ACS_def edgesList) by (metis rev_filter rev_swap)\n hence filterACS: \"set (filter_compliant_stateful_ACS G M (rev edgesList)) = edges G - (backflows (edges G))\" using edgesList by force\n\n show ?thesis\n apply(simp add: undirected_backflows stateful_policy_to_network_graph_def all_flows_def)\n apply(simp add: hosts filterACS flows_state_IFS flowsfix)\n apply(simp add: backflows_minus_backflows)\n by fast\n qed\n\n\n(*\ntext{* In the repo history, we see failed attempts which try to prove that under composition, the IFS and ACS filtering is also maximal.\n I guess this does not hold in general. Needs a counter example. *}\n\n*)\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Stateful_Policy_Algorithm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154239957834733, "lm_q2_score": 0.4035668537353746, "lm_q1q2_score": 0.2887214110651262}} {"text": "theory Hoare_Lift_Transform\nimports Hoare_Lift\nbegin\n\n(* Alternative approach to Hoare lifting:\ntransforming predicate transformers. *)\n(* TODO: this probably is no longer needed *)\n(*\n assume\n {P} c {Q(P, c)}\n\n want to derive\n {Pbig} lift(c) {Qbig(P, c)} where\n \nidea:\n Pbig \\ (\\ st . exists rest . Pbig (st + rest))\n*)\n\ndefinition liftt_conc ::\n \"('a1, 'b1) syn_lifting \\\n ('a1, 'a2, 'b2 :: {Pord, Okay}) lifting \\\n 'b1 \\\n (('a2 \\ bool) \\ ('a2 \\ bool)) \\\n (('b2 \\ bool) \\ ('b2 \\ bool))\" where\n\"liftt_conc sl l syn Q1 P2 st_big =\n (\\ old st_small . st_big = LUpd l (sl syn) st_small old \\\n P2 old \\\n Q1 (\\ st . \\ full . LOut l (sl syn) full = st \\ P2 full) st_small)\"\n\nlemma liftt_conc_spec :\n assumes Valid : \"lifting_valid l S\"\n assumes V : \"\\ P . (sem) % {{P}} x {{(Q P)}}\"\n assumes Syn : \"l' x' = x\"\n shows \"\\ P' . (lift_map_s l' l sem) % {{P'}} x' {{liftt_conc l' l x' Q P'}}\"\n using V Syn\n unfolding HTS_def HT_def liftt_conc_def lift_map_s_def \n apply(auto)\n apply(rule_tac x = a in exI)\n apply(rule_tac x = \"(sem (l' x') (LOut l (l' x') a))\" in exI)\n apply(auto)\n apply(atomize)\n apply(drule_tac x = \"(\\st. \\full. LOut l (l' x') full = st \\ P' full)\" in spec)\n apply(auto)\n done\nterm \"LOut\"\n\n (* new idea: a more streamlined version. *)\n(* TODO: give this a better name *)\n(* TODO: do we need Hok? *)\nlemma new_lift :\n fixes P' :: \"_ \\ bool\"\n assumes HP : \"\\ st . P st \\ P' (LOut l x st)\"\n assumes HOk : \"\\ st . P st \\ st \\ ok_S\"\n assumes HV : \"lifting_valid_ok_ext l S\"\n assumes Hsyn : \"l' x' = x\"\n assumes HT : \"sem % {{P'}} x {{Q'}}\"\n shows \"(lift_map_s l' l sem) % \n {{P}} x' \n {{(\\ st . \\ old_big small_new . P old_big \\ Q' small_new \\ st = LUpd l x small_new old_big \\ st \\ ok_S)}}\"\nproof(rule HTSI)\n fix a\n assume H : \"P a\"\n\n then have H' : \"P' (LOut l x a)\"\n using HP\n by blast\n\n have Q' : \"Q' (sem x (LOut l x a))\"\n using HTSE[OF HT H']\n by auto\n\n interpret V : lifting_valid_ok_ext l S\n using HV.\n\n have Ok' : \"LUpd l x (sem x (LOut l x a)) a \\ ok_S\"\n using V.ok_S_put[OF HOk[OF H]]\n by auto\n\n show \" \\old_big small_new.\n P old_big \\\n Q' small_new \\\n lift_map_s l' l sem x' a = LUpd l x small_new old_big \\\n lift_map_s l' l sem x' a \\ ok_S\"\n unfolding lift_map_s_def Hsyn LMap_def\n using H Q' Ok'\n by blast\nqed\n\n\n(*\ndefinition liftt_pred_validx_s ::\n \"('a1, 'b1) syn_lifting \\\n ('a1, 'a2, 'b2 :: {Pord, Okay}, 'z) lifting_scheme \\\n ('a1 \\ 'b2 set) \\\n 'b1 \\\n ('a2 \\ bool) \\\n ('b2 \\ bool)\"\n*)\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Hoare/Hoare_Lift_Transform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2886537516353661}} {"text": "\\<^marker>\\creator \"Kevin Kappelmann\"\\\nparagraph \\Galois Property\\\ntheory Transport_Compositions_Generic_Galois_Property\n imports\n Transport_Compositions_Generic_Base\nbegin\n\ncontext transport_comp\nbegin\n\ninterpretation flip : transport_comp R2 L2 r2 l2 R1 L1 r1 l1\n rewrites \"flip.t2.unit = \\\\<^sub>1\" and \"flip.t1.counit \\ \\\\<^sub>2\"\n by (simp_all only: t1.flip_unit_eq_counit t2.flip_counit_eq_unit)\n\nlemma half_galois_prop_left_left_rightI:\n assumes \"((\\\\<^bsub>L1\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R1\\<^esub>)) l1 r1\"\n and deflationary_counit1: \"deflationary_on (in_codom (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>) \\\\<^sub>1\"\n and trans_R1: \"transitive (\\\\<^bsub>R1\\<^esub>)\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\"\n and \"reflexive_on (in_codom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>)\"\n and \"((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>)) \\ ((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>))\"\n and \"in_codom ((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>)) \\ in_codom (\\\\<^bsub>L2\\<^esub>)\"\n and mono_in_codom_r2: \"([in_codom (\\\\<^bsub>R\\<^esub>)] \\\\<^sub>m in_codom (\\\\<^bsub>R1\\<^esub>)) r2\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R\\<^esub>)) l r\"\nproof (rule half_galois_prop_leftI)\n fix x z assume \"in_codom (\\\\<^bsub>R\\<^esub>) z\" \"x \\\\<^bsub>L\\<^esub> r z\"\n then show \"l x \\\\<^bsub>R\\<^esub> z\"\n proof (intro right_rel_if_left_relI)\n from \\in_codom (\\\\<^bsub>R\\<^esub>) z\\ show \"in_codom (\\\\<^bsub>R2\\<^esub>) z\" by blast\n fix y assume \"y \\\\<^bsub>R1\\<^esub> l1 (r z)\"\n moreover have \"l1 (r z) \\\\<^bsub>R1\\<^esub> r2 z\"\n proof -\n from mono_in_codom_r2 \\in_codom (\\\\<^bsub>R\\<^esub>) z\\ have \"in_codom (\\\\<^bsub>R1\\<^esub>) (r2 z)\" by blast\n with deflationary_counit1 show \"l1 (r z) \\\\<^bsub>R1\\<^esub> r2 z\" by auto\n qed\n ultimately show \"y \\\\<^bsub>R1\\<^esub> r2 z\" using trans_R1 by blast\n next\n fix y assume \"l1 x \\\\<^bsub>L2\\<^esub> y\"\n with \\((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\\ show \"l x \\\\<^bsub>R2\\<^esub> l2 y\" by auto\n qed (insert assms, auto)\nqed\n\nlemma half_galois_prop_left_left_rightI':\n assumes \"((\\\\<^bsub>L1\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R1\\<^esub>)) l1 r1\"\n and deflationary_counit1: \"deflationary_on (in_codom (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>) \\\\<^sub>1\"\n and trans_R1: \"transitive (\\\\<^bsub>R1\\<^esub>)\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\"\n and refl_L2: \"reflexive_on (in_dom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>)\"\n and \"((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>)) \\ ((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>))\"\n and \"in_dom ((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>)) \\ in_dom (\\\\<^bsub>L2\\<^esub>)\"\n and mono_in_codom_r2: \"([in_codom (\\\\<^bsub>R\\<^esub>)] \\\\<^sub>m in_codom (\\\\<^bsub>R1\\<^esub>)) r2\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R\\<^esub>)) l r\"\nproof (rule half_galois_prop_leftI)\n fix x z assume \"in_codom (\\\\<^bsub>R\\<^esub>) z\" \"x \\\\<^bsub>L\\<^esub> r z\"\n then show \"l x \\\\<^bsub>R\\<^esub> z\"\n proof (intro right_rel_if_left_relI')\n from \\in_codom (\\\\<^bsub>R\\<^esub>) z\\ show \"in_codom (\\\\<^bsub>R2\\<^esub>) z\" by blast\n fix y assume \"y \\\\<^bsub>R1\\<^esub> l1 (r z)\"\n moreover have \"l1 (r z) \\\\<^bsub>R1\\<^esub> r2 z\"\n proof -\n from mono_in_codom_r2 \\in_codom (\\\\<^bsub>R\\<^esub>) z\\ have \"in_codom (\\\\<^bsub>R1\\<^esub>) (r2 z)\" by blast\n with deflationary_counit1 show \"l1 (r z) \\\\<^bsub>R1\\<^esub> r2 z\" by auto\n qed\n ultimately show \"y \\\\<^bsub>R1\\<^esub> r2 z\" using trans_R1 by blast\n next\n assume \"in_dom (\\\\<^bsub>L2\\<^esub>) (l1 x)\"\n with refl_L2 have \"l1 x \\\\<^bsub>L2\\<^esub> l1 x\" by blast\n with \\((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\\ show \"in_codom (\\\\<^bsub>L2\\<^esub>) (l1 x)\" \"l x \\\\<^bsub>R2\\<^esub> l2 (l1 x)\"\n by auto\n qed (insert assms, auto)\nqed\n\nlemma half_galois_prop_right_left_rightI:\n assumes \"((\\\\<^bsub>R1\\<^esub>) \\\\<^sub>m (\\\\<^bsub>L1\\<^esub>)) r1\"\n and \"((\\\\<^bsub>L1\\<^esub>) \\\\<^sub>h (\\\\<^bsub>R1\\<^esub>)) l1 r1\"\n and inflationary_counit1: \"inflationary_on (in_codom (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>) \\\\<^sub>1\"\n and \"((\\\\<^bsub>R2\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>L2\\<^esub>)) r2 l2\"\n and inflationary_unit2: \"inflationary_on (in_dom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>) \\\\<^sub>2\"\n and trans_L2: \"transitive (\\\\<^bsub>L2\\<^esub>)\"\n and mono_in_dom_l1: \"([in_dom (\\\\<^bsub>L\\<^esub>)] \\\\<^sub>m in_dom (\\\\<^bsub>L2\\<^esub>)) l1\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>)) \\ ((\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>))\"\n and \"in_codom ((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>)) \\ in_codom (\\\\<^bsub>R1\\<^esub>)\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\\\<^sub>h (\\\\<^bsub>R\\<^esub>)) l r\"\nproof (rule half_galois_prop_rightI)\n fix x z assume \"in_dom (\\\\<^bsub>L\\<^esub>) x\" \"l x \\\\<^bsub>R\\<^esub> z\"\n then show \"x \\\\<^bsub>L\\<^esub> r z\"\n proof (intro flip.right_rel_if_left_relI)\n fix y assume \"r2 (l x) \\\\<^bsub>L2\\<^esub> y\"\n moreover have \"l1 x \\\\<^bsub>L2\\<^esub> r2 (l x)\"\n proof -\n from mono_in_dom_l1 \\in_dom (\\\\<^bsub>L\\<^esub>) x\\ have \"in_dom (\\\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n with inflationary_unit2 show \"l1 x \\\\<^bsub>L2\\<^esub> r2 (l x)\" by auto\n qed\n ultimately show \"l1 x \\\\<^bsub>L2\\<^esub> y\" using trans_L2 by blast\n fix y assume \"l1 x \\\\<^bsub>R1\\<^esub> y\"\n with \\((\\\\<^bsub>L1\\<^esub>) \\\\<^sub>h (\\\\<^bsub>R1\\<^esub>)) l1 r1\\ \\in_dom (\\\\<^bsub>L\\<^esub>) x\\ show \"x \\\\<^bsub>L1\\<^esub> r1 y\" by blast\n next\n assume \"in_codom (\\\\<^bsub>R1\\<^esub>) (r2 z)\"\n with inflationary_counit1 show \"r2 z \\\\<^bsub>R1\\<^esub> l1 (r z)\" by auto\n from \\((\\\\<^bsub>R1\\<^esub>) \\\\<^sub>m (\\\\<^bsub>L1\\<^esub>)) r1\\ \\in_codom (\\\\<^bsub>R1\\<^esub>) (r2 z)\\ show \"in_codom (\\\\<^bsub>L1\\<^esub>) (r z)\"\n by (auto intro: in_codom_if_rel_if_dep_mono_wrt_rel)\n qed (insert assms, auto)\nqed\n\nlemma half_galois_prop_right_left_rightI':\n assumes \"((\\\\<^bsub>R1\\<^esub>) \\\\<^sub>m (\\\\<^bsub>L1\\<^esub>)) r1\"\n and inflationary_unit1: \"inflationary_on (in_dom (\\\\<^bsub>L1\\<^esub>)) (\\\\<^bsub>L1\\<^esub>) \\\\<^sub>1\"\n and inflationary_counit1: \"\\y z. y \\\\<^bsub>R1\\<^esub> r2 z \\ y \\\\<^bsub>R1\\<^esub> l1 (r z)\"\n and \"in_dom (\\\\<^bsub>R1\\<^esub>) \\ in_codom (\\\\<^bsub>R1\\<^esub>)\"\n and \"((\\\\<^bsub>R2\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>L2\\<^esub>)) r2 l2\"\n and inflationary_unit2: \"inflationary_on (in_dom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>) \\\\<^sub>2\"\n and trans_L2: \"transitive (\\\\<^bsub>L2\\<^esub>)\"\n and mono_in_dom_l1: \"([in_dom (\\\\<^bsub>L\\<^esub>)] \\\\<^sub>m in_dom (\\\\<^bsub>L2\\<^esub>)) l1\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>)) \\ ((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>))\"\n and \"in_dom ((\\\\<^bsub>L2\\<^esub>) \\\\ (\\\\<^bsub>R1\\<^esub>) \\\\ (\\\\<^bsub>L2\\<^esub>)) \\ in_dom (\\\\<^bsub>R1\\<^esub>)\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\\\<^sub>h (\\\\<^bsub>R\\<^esub>)) l r\"\nproof (rule half_galois_prop_rightI)\n fix x z assume \"in_dom (\\\\<^bsub>L\\<^esub>) x\" \"l x \\\\<^bsub>R\\<^esub> z\"\n then show \"x \\\\<^bsub>L\\<^esub> r z\"\n proof (intro flip.right_rel_if_left_relI')\n from \\in_dom (\\\\<^bsub>L\\<^esub>) x\\ inflationary_unit1 show \"x \\\\<^bsub>L1\\<^esub> r1 (l1 x)\" by fastforce\n fix y assume \"y \\\\<^bsub>R1\\<^esub> r2 z\"\n with inflationary_counit1 show \"y \\\\<^bsub>R1\\<^esub> l1 (r z)\" by auto\n next\n fix y\n from mono_in_dom_l1 \\in_dom (\\\\<^bsub>L\\<^esub>) x\\ have \"in_dom (\\\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n with inflationary_unit2 have \"l1 x \\\\<^bsub>L2\\<^esub> r2 (l x)\" by auto\n moreover assume \"r2 (l x) \\\\<^bsub>L2\\<^esub> y\"\n ultimately show \"l1 x \\\\<^bsub>L2\\<^esub> y\" using trans_L2 by blast\n qed (insert assms, auto)\nqed\n\nlemma galois_prop_left_rightI:\n assumes \"((\\\\<^bsub>R1\\<^esub>) \\\\<^sub>m (\\\\<^bsub>L1\\<^esub>)) r1\"\n and \"((\\\\<^bsub>L1\\<^esub>) \\ (\\\\<^bsub>R1\\<^esub>)) l1 r1\"\n and \"rel_equivalence_on (in_codom (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>) \\\\<^sub>1\"\n and \"transitive (\\\\<^bsub>R1\\<^esub>)\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\"\n and \"((\\\\<^bsub>R2\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>L2\\<^esub>)) r2 l2\"\n and \"inflationary_on (in_dom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>) \\\\<^sub>2\"\n and \"preorder_on (in_field (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>)\"\n and \"middle_compatible_codom\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\ (\\\\<^bsub>R\\<^esub>)) l r\"\n using assms by (intro galois_propI\n half_galois_prop_left_left_rightI half_galois_prop_right_left_rightI\n flip.mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le\n mono_in_dom_left_rel_left1_if_in_dom_rel_comp_le\n in_dom_right1_left2_right1_le_if_right1_left2_right1_le)\n (auto elim!: preorder_on_in_fieldE\n intro: reflexive_on_if_le_pred_if_reflexive_on in_field_if_in_codom)\n\nlemma galois_prop_left_rightI':\n assumes \"((\\\\<^bsub>R1\\<^esub>) \\\\<^sub>m (\\\\<^bsub>L1\\<^esub>)) r1\"\n and \"((\\\\<^bsub>L1\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R1\\<^esub>)) l1 r1\"\n and \"inflationary_on (in_dom (\\\\<^bsub>L1\\<^esub>)) (\\\\<^bsub>L1\\<^esub>) \\\\<^sub>1\"\n and rel_equiv_counit1: \"rel_equivalence_on (in_field (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>) \\\\<^sub>1\"\n and trans_R1: \"transitive (\\\\<^bsub>R1\\<^esub>)\"\n and \"((\\\\<^bsub>L2\\<^esub>) \\\\<^sub>m (\\\\<^bsub>R2\\<^esub>)) l2\"\n and \"((\\\\<^bsub>R2\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>L2\\<^esub>)) r2 l2\"\n and \"inflationary_on (in_dom (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>) \\\\<^sub>2\"\n and \"preorder_on (in_field (\\\\<^bsub>L2\\<^esub>)) (\\\\<^bsub>L2\\<^esub>)\"\n and \"middle_compatible_dom\"\n shows \"((\\\\<^bsub>L\\<^esub>) \\ (\\\\<^bsub>R\\<^esub>)) l r\"\nproof (rule galois_propI)\n show \"((\\\\<^bsub>L\\<^esub>) \\<^sub>h\\ (\\\\<^bsub>R\\<^esub>)) l r\" using assms\n by (intro half_galois_prop_left_left_rightI'\n flip.mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le\n flip.in_codom_right1_left2_right1_le_if_right1_left2_right1_le)\n (auto elim!: rel_equivalence_onE preorder_on_in_fieldE\n intro: deflationary_on_if_le_pred_if_deflationary_on\n reflexive_on_if_le_pred_if_reflexive_on\n in_field_if_in_dom in_field_if_in_codom)\n have \"y \\\\<^bsub>R1\\<^esub> l1 (r1 (r2 z))\" if \"y \\\\<^bsub>R1\\<^esub> r2 z\" for y z\n proof -\n note \\y \\\\<^bsub>R1\\<^esub> r2 z\\\n moreover with rel_equiv_counit1 have \"r2 z \\\\<^bsub>R1\\<^esub> \\\\<^sub>1 (r2 z)\" by auto\n ultimately show ?thesis using trans_R1 by auto\n qed\n moreover have \"in_dom (\\\\<^bsub>R1\\<^esub>) \\ in_codom (\\\\<^bsub>R1\\<^esub>)\"\n proof -\n from rel_equiv_counit1 trans_R1 have \"reflexive_on (in_field (\\\\<^bsub>R1\\<^esub>)) (\\\\<^bsub>R1\\<^esub>)\"\n by (intro reflexive_on_in_field_if_transitive_if_rel_equivalence_on) auto\n then show ?thesis by (simp only: in_codom_eq_in_dom_if_reflexive_on_in_field)\n qed\n ultimately show \"((\\\\<^bsub>L\\<^esub>) \\\\<^sub>h (\\\\<^bsub>R\\<^esub>)) l r\" using assms\n by (intro half_galois_prop_right_left_rightI'\n mono_in_dom_left_rel_left1_if_in_dom_rel_comp_le)\n auto\nqed\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Compositions/Generic/Transport_Compositions_Generic_Galois_Property.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2886537452027935}} {"text": "(* Title: HOL/HOLCF/IOA/Storage/Impl.thy\n Author: Olaf Müller\n*)\n\nsection \\The implementation of a memory\\\n\ntheory Impl\nimports IOA.IOA Action\nbegin\n\ndefinition\n impl_sig :: \"action signature\" where\n \"impl_sig = (\\l.{Free l} \\ {New},\n \\l.{Loc l},\n {})\"\n\ndefinition\n impl_trans :: \"(action, nat * bool)transition set\" where\n \"impl_trans =\n {tr. let s = fst(tr); k = fst s; b = snd s;\n t = snd(snd(tr)); k' = fst t; b' = snd t\n in\n case fst(snd(tr))\n of\n New \\ k' = k \\ b' |\n Loc l \\ b \\ l= k \\ k'= (Suc k) \\ \\b' |\n Free l \\ k'=k \\ b'=b}\"\n\ndefinition\n impl_ioa :: \"(action, nat * bool)ioa\" where\n \"impl_ioa = (impl_sig, {(0,False)}, impl_trans,{},{})\"\n\nlemma in_impl_asig:\n \"New \\ actions(impl_sig) \\\n Loc l \\ actions(impl_sig) \\\n Free l \\ actions(impl_sig) \"\n by (simp add: impl_sig_def actions_def asig_projections)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/Storage/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2886132449024854}} {"text": "(* Title: JinjaDCI/Common/Type.thy\n\n Author: David von Oheimb, Tobias Nipkow, Susannah Mansky\n Copyright 1999 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory Common/Type.thy by David von Oheimb and Tobias Nipkow\n*)\n\nsection \\ Jinja types \\ \n\ntheory Type imports Auxiliary begin\n\ntype_synonym cname = string \\ \\class names\\\ntype_synonym mname = string \\ \\method name\\\ntype_synonym vname = string \\ \\names for local/field variables\\\n\ndefinition Object :: cname\nwhere\n \"Object \\ ''Object''\"\n\ndefinition this :: vname\nwhere\n \"this \\ ''this''\"\n\ndefinition clinit :: \"string\" where \"clinit = ''''\"\ndefinition init :: \"string\" where \"init = ''''\"\n\ndefinition start_m :: \"string\" where \"start_m = ''''\"\ndefinition Start :: \"string\" where \"Start = ''''\"\n\nlemma start_m_neq_clinit [simp]: \"start_m \\ clinit\" by(simp add: start_m_def clinit_def)\nlemma Object_neq_Start [simp]: \"Object \\ Start\" by(simp add: Object_def Start_def)\nlemma Start_neq_Object [simp]: \"Start \\ Object\" by(simp add: Object_def Start_def)\n\n\\ \\field/method static flag\\\n\ndatatype staticb = Static | NonStatic\n\n\\ \\types\\\ndatatype ty\n = Void \\ \\type of statements\\\n | Boolean\n | Integer\n | NT \\ \\null type\\\n | Class cname \\ \\class type\\\n\ndefinition is_refT :: \"ty \\ bool\"\nwhere\n \"is_refT T \\ T = NT \\ (\\C. T = Class C)\"\n\n\n\nlemma [iff]: \"is_refT(Class C)\"\n(*<*)by(simp add:is_refT_def)(*>*)\n\nlemma refTE:\n \"\\is_refT T; T = NT \\ P; \\C. T = Class C \\ P \\ \\ P\"\n(*<*)by (auto simp add: is_refT_def)(*>*)\n\nlemma not_refTE:\n \"\\ \\is_refT T; T = Void \\ T = Boolean \\ T = Integer \\ P \\ \\ P\"\n(*<*)by (cases T, auto simp add: is_refT_def)(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Common/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.28861323884366746}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_on_inis imports n_mutualExOnI_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__4 p__Inv0 p__Inv1)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__4 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2886132327848495}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\ntheory ArchVSpaceEntries_AI\nimports \"../VSpaceEntries_AI\"\nbegin\n\n\ncontext Arch begin global_naming ARM (*FIXME: arch_split*)\n\nlemma a_type_pdD:\n \"a_type ko = AArch APageDirectory \\ \\pd. ko = ArchObj (PageDirectory pd)\"\n by (clarsimp)\n\nprimrec\n pde_range_sz :: \"pde \\ nat\"\nwhere\n \"pde_range_sz (InvalidPDE) = 0\"\n | \"pde_range_sz (SectionPDE ptr x y z) = 0\"\n | \"pde_range_sz (SuperSectionPDE ptr x z) = 4\"\n | \"pde_range_sz (PageTablePDE ptr x z) = 0\"\n\nprimrec\n pte_range_sz :: \"pte \\ nat\"\nwhere\n \"pte_range_sz (InvalidPTE) = 0\"\n | \"pte_range_sz (LargePagePTE ptr x y) = 4\"\n | \"pte_range_sz (SmallPagePTE ptr x y) = 0\"\n\nprimrec\n pde_range :: \"pde \\ 12 word \\ 12 word set\"\nwhere\n \"pde_range (InvalidPDE) p = {}\"\n | \"pde_range (SectionPDE ptr x y z) p = {p}\"\n | \"pde_range (SuperSectionPDE ptr x z) p =\n (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n | \"pde_range (PageTablePDE ptr x z) p = {p}\"\n\nprimrec\n pte_range :: \"pte \\ word8 \\ word8 set\"\nwhere\n \"pte_range (InvalidPTE) p = {}\"\n | \"pte_range (LargePagePTE ptr x y) p =\n (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n | \"pte_range (SmallPagePTE ptr x y) p = {p}\"\n\nabbreviation \"valid_pt_entries \\ \\pt. valid_entries pte_range pt\"\n\nabbreviation \"valid_pd_entries \\ \\pd. valid_entries pde_range pd\"\n\ndefinition\n obj_valid_pdpt :: \"kernel_object \\ bool\"\nwhere\n \"obj_valid_pdpt obj \\ case obj of\n ArchObj (PageTable pt) \\ valid_pt_entries pt \\ entries_align pte_range_sz pt\n | ArchObj (PageDirectory pd) \\ valid_pd_entries pd \\ entries_align pde_range_sz pd\n | _ \\ True\"\n\nlemmas obj_valid_pdpt_simps[simp]\n = obj_valid_pdpt_def\n [split_simps Structures_A.kernel_object.split\n arch_kernel_obj.split]\n\nabbreviation\n valid_pdpt_objs :: \"'z state \\ bool\"\nwhere\n \"valid_pdpt_objs s \\ \\x \\ ran (kheap s). obj_valid_pdpt x\"\n\nlemma valid_pdpt_init[iff]:\n \"valid_pdpt_objs init_A_st\"\nproof -\n have P: \"valid_pd_entries (global_pd :: 12 word \\ _)\"\n by (clarsimp simp: valid_entries_def)\n also have Q: \"entries_align pde_range_sz (global_pd :: 12 word \\ _)\"\n by (clarsimp simp: entries_align_def)\n thus ?thesis using P\n by (auto simp: init_A_st_def init_kheap_def\n elim!: ranE split: if_split_asm)\nqed\n\nlemma set_object_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and K (obj_valid_pdpt obj)\\\n set_object ptr obj\n \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: set_object_def, wp)\n apply (auto simp: fun_upd_def[symmetric] del: ballI elim: ball_ran_updI)\n done\n\ncrunch valid_pdpt_objs[wp]: cap_insert, cap_swap_for_delete,empty_slot \"valid_pdpt_objs\"\n (wp: crunch_wps simp: crunch_simps ignore:set_object)\n\ncrunch valid_pdpt_objs[wp]: flush_page \"valid_pdpt_objs\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma shift_0x3C_set:\n \"\\ is_aligned p 6; 8 \\ bits; bits < 32; len_of TYPE('a) = bits - 2 \\ \\\n (\\x. ucast (x + p && mask bits >> 2) :: ('a :: len) word) ` set [0 :: word32 , 4 .e. 0x3C]\n = {x. x && ~~ mask 4 = ucast (p && mask bits >> 2)}\"\n apply (clarsimp simp: upto_enum_step_def word_shift_by_2 image_image)\n apply (subst image_cong[where N=\"{x. x < 2 ^ 4}\"])\n apply (safe, simp_all)[1]\n apply (drule plus_one_helper2, simp_all)[1]\n apply (drule minus_one_helper3, simp_all)[1]\n apply (rule_tac f=\"\\x. ucast (x && mask bits >> 2)\" in arg_cong)\n apply (rule trans[OF add.commute is_aligned_add_or], assumption)\n apply (rule shiftl_less_t2n, simp_all)[1]\n apply safe\n apply (frule upper_bits_unset_is_l2p_32[THEN iffD2, rotated])\n apply (simp add: word_bits_conv)\n apply (rule word_eqI)\n apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n nth_shiftl neg_mask_bang\n word_bits_conv)\n apply (safe, simp_all add: is_aligned_nth)[1]\n apply (drule_tac x=\"Suc (Suc n)\" in spec)\n apply simp\n apply (rule_tac x=\"ucast x && mask 4\" in image_eqI)\n apply (rule word_eqI)\n apply (drule_tac x=n in word_eqD)\n apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n nth_shiftl)\n apply (safe, simp_all)\n apply (rule order_less_le_trans, rule and_mask_less_size)\n apply (simp_all add: word_size)\n done\n\nlemma mapM_x_store_pte_updates:\n \"\\x \\ set xs. f x && ~~ mask pt_bits = p \\\n \\\\s. (\\ page_table_at p s \\ Q s) \\\n (\\pt. ko_at (ArchObj (PageTable pt)) p s\n \\ Q (s \\ kheap := (kheap s) (p := Some (ArchObj (PageTable (\\y. if y \\ (\\x.\n ucast (f x && mask pt_bits >> 2)) ` set xs then pte else pt y)))) \\))\\\n mapM_x (\\x. store_pte (f x) pte) xs\n \\\\_. Q\\\"\n apply (induct xs)\n apply (simp add: mapM_x_Nil)\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (simp add: a_type_def fun_upd_idem\n split: Structures_A.kernel_object.split_asm if_split_asm\n arch_kernel_obj.split_asm)\n apply (simp add: mapM_x_Cons)\n apply (rule hoare_seq_ext, assumption)\n apply (thin_tac \"valid P f Q\" for P f Q)\n apply (simp add: store_pte_def set_pt_def set_object_def)\n apply (wp get_pt_wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps)\n apply (erule rsubst[where P=Q])\n apply (rule abstract_state.fold_congs[OF refl refl])\n apply (rule ext, clarsimp)\n apply (rule ext, clarsimp)\n done\n\nlemma valid_pt_entries_invalid[simp]:\n \"valid_pt_entries (\\x. InvalidPTE)\"\n by (simp add:valid_entries_def)\n\nlemma valid_pd_entries_invalid[simp]:\n \"valid_pd_entries (\\x. InvalidPDE)\"\n by (simp add:valid_entries_def)\n\nlemma entries_align_pte_update:\n \"\\entries_align pte_range_sz pt;\n (\\y. (P y) \\ is_aligned y (pte_range_sz pte))\\\n \\ entries_align pte_range_sz (\\y. if (P y) then pte else pt y)\"\n by (simp add:entries_align_def)\n\nlemma entries_align_pde_update:\n \"\\entries_align pde_range_sz pd;\n (\\y. (P y) \\ is_aligned y (pde_range_sz pde))\\\n \\ entries_align pde_range_sz (\\y. if (P y) then pde else pd y)\"\n by (simp add:entries_align_def)\n\n\nlemma valid_pdpt_objs_pdD:\n \"\\valid_pdpt_objs s;\n kheap s ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pd))\\\n \\ valid_pd_entries pd \\ entries_align pde_range_sz pd\"\n by (fastforce simp:ran_def)\n\nlemma valid_pdpt_objs_ptD:\n \"\\valid_pdpt_objs s;\n kheap s ptr = Some (ArchObj (arch_kernel_obj.PageTable pt))\\\n \\ valid_pt_entries pt \\ entries_align pte_range_sz pt\"\n by (fastforce simp:ran_def)\n\nlemma mapM_x_store_invalid_pte_valid_pdpt:\n \"\\valid_pdpt_objs and K (is_aligned p 6) \\\n mapM_x (\\x. store_pte (x + p) InvalidPTE) [0, 4 .e. 0x3C]\n \\\\_. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)+\n apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pt_bits\" in mapM_x_store_pte_updates)\n apply clarsimp\n apply (rule mask_out_first_mask_some[where n=6])\n apply (drule_tac d=x in is_aligned_add_helper)\n apply (drule subsetD[OF upto_enum_step_subset])\n apply simp\n apply (erule order_le_less_trans, simp)\n apply (simp add: field_simps)\n apply (simp add: pt_bits_def pageBits_def)\n apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n apply (intro conjI)\n apply (simp add: shift_0x3C_set pt_bits_def pageBits_def)\n apply (rule valid_entries_overwrite_groups\n [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 10 >> 2)}\"])\n apply (fastforce simp add: obj_at_def ran_def)\n apply simp\n apply clarsimp\n apply (case_tac v)\n apply (simp split:if_splits)+\n apply (clarsimp)\n apply (case_tac v, simp_all split:if_splits)\n apply (intro conjI impI)\n apply (rule disjointI)\n apply (clarsimp)+\n apply (rule entries_align_pte_update)\n apply (clarsimp simp:obj_at_def)\n apply (drule(1) valid_pdpt_objs_ptD)\n apply simp\n apply (simp)\n done\n\nlemma mapM_x_store_pde_updates:\n \"\\x \\ set xs. f x && ~~ mask pd_bits = p \\\n \\\\s. (\\ page_directory_at p s \\ Q s) \\\n (\\pd. ko_at (ArchObj (PageDirectory pd)) p s\n \\ Q (s \\ kheap := (kheap s) (p := Some (ArchObj (PageDirectory (\\y. if y \\ (\\x.\n ucast (f x && mask pd_bits >> 2)) ` set xs then pde else pd y)))) \\))\\\n mapM_x (\\x. store_pde (f x) pde) xs\n \\\\_. Q\\\"\n apply (induct xs)\n apply (simp add: mapM_x_Nil)\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (simp add: a_type_def fun_upd_idem\n split: Structures_A.kernel_object.split_asm if_split_asm\n arch_kernel_obj.split_asm)\n apply (simp add: mapM_x_Cons)\n apply (rule hoare_seq_ext, assumption)\n apply (thin_tac \"valid P f Q\" for P f Q)\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_pd_wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps)\n apply (erule rsubst[where P=Q])\n apply (rule abstract_state.fold_congs[OF refl refl])\n apply (rule ext, clarsimp)\n apply (rule ext, clarsimp)\n done\n\nlemma mapM_x_store_pde_valid_pdpt_objs:\n \"\\valid_pdpt_objs and K (is_aligned p 6)\\\n mapM_x (\\x. store_pde (x + p) InvalidPDE) [0, 4 .e. 0x3C]\n \\\\_. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)+\n apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pd_bits\" in mapM_x_store_pde_updates)\n apply clarsimp\n apply (rule mask_out_first_mask_some[where n=6])\n apply (drule_tac d=x in is_aligned_add_helper)\n apply (drule subsetD[OF upto_enum_step_subset])\n apply simp\n apply (erule order_le_less_trans, simp)\n apply (simp add: field_simps)\n apply (simp add: pd_bits_def pageBits_def)\n apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n apply (simp add: shift_0x3C_set pd_bits_def pageBits_def)\n apply (rule conjI)\n apply (rule_tac valid_entries_overwrite_groups\n [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 14 >> 2)}\"])\n apply (fastforce simp add: obj_at_def ran_def)\n apply fastforce\n apply clarsimp\n apply (case_tac v, simp_all split:if_splits)\n apply clarsimp\n apply (case_tac v, simp_all split:if_splits)\n apply (intro conjI impI allI)\n apply (rule disjointI)\n apply clarsimp\n apply (rule entries_align_pde_update)\n apply (clarsimp simp:obj_at_def)\n apply (drule valid_pdpt_objs_pdD)\n apply (simp add:pd_bits_def pageBits_def)\n apply simp\n apply simp\n done\n\nlemma store_invalid_pde_valid_pdpt:\n \"\\valid_pdpt_objs and\n (\\s. \\pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n \\ pde = InvalidPDE)\\\n store_pde p pde \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (intro conjI)\n apply (rule valid_entries_overwrite_0, simp_all)\n apply (fastforce simp: ran_def)\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pde_update)\n apply (drule(1) valid_pdpt_objs_pdD)\n apply simp\n apply simp\n done\n\nlemma store_pde_non_master_valid_pdpt:\n \"\\valid_pdpt_objs and\n (\\s. \\pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n \\ (pde_range_sz (pd (ucast (p && mask pd_bits >> 2) && ~~ mask 4)) = 0\n \\ pde_range_sz pde = 0))\\\n store_pde p pde \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (intro conjI)\n apply (rule valid_entries_overwrite_0)\n apply (fastforce simp:ran_def)\n apply (drule bspec)\n apply fastforce\n apply (case_tac \"pd pa\")\n apply simp_all\n apply (case_tac pde,simp_all)\n apply (case_tac pde,simp_all)\n apply (case_tac pde,simp_all)\n apply (clarsimp simp: is_aligned_neg_mask_eq)+\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pde_update)\n apply (drule(1) valid_pdpt_objs_pdD,simp)\n apply simp\n done\n\nlemma store_invalid_pte_valid_pdpt:\n \"\\valid_pdpt_objs and\n (\\s. \\pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n \\ pte = InvalidPTE)\\\n store_pte p pte \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (intro conjI)\n apply (rule valid_entries_overwrite_0, simp_all)\n apply (fastforce simp: ran_def)\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pte_update)\n apply (drule (1) valid_pdpt_objs_ptD,simp)\n apply simp\n done\n\nlemma store_pte_non_master_valid_pdpt:\n \"\\valid_pdpt_objs and\n (\\s. \\pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n \\ (pte_range_sz (pt (ucast (p && mask pt_bits >> 2) && ~~ mask 4)) = 0\n \\ pte_range_sz pte = 0))\\\n store_pte p pte \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (intro conjI)\n apply (rule valid_entries_overwrite_0)\n apply (fastforce simp:ran_def)\n apply (drule bspec)\n apply fastforce\n apply (case_tac \"pt pa\")\n apply simp\n apply (case_tac pte,simp_all)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply (case_tac pte,simp_all)\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pte_update)\n apply (drule (1) valid_pdpt_objs_ptD,simp)\n apply simp\n done\n\nlemma unmap_page_valid_pdpt[wp]:\n \"\\valid_pdpt_objs\\ unmap_page sz asid vptr pptr \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: unmap_page_def mapM_discarded\n cong: vmpage_size.case_cong)\n apply (wp)\n prefer 2\n apply (rule valid_validE[OF find_pd_for_asid_inv])\n apply (rule hoare_pre)\n apply (wp get_object_wp get_pte_wp get_pde_wp lookup_pt_slot_inv_any\n store_invalid_pte_valid_pdpt\n store_invalid_pde_valid_pdpt\n mapM_x_store_invalid_pte_valid_pdpt mapM_x_store_pde_valid_pdpt_objs\n | simp add: mapM_x_map\n | wpc | simp add: check_mapping_pptr_def)+\n apply (simp add: fun_upd_def[symmetric] is_aligned_mask[symmetric])\n apply assumption\n done\n\ncrunch valid_pdpt_objs[wp]: flush_table \"valid_pdpt_objs\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch kheap[wp]: flush_table \"\\s. P (kheap s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma unmap_page_table_valid_pdpt_objs[wp]:\n notes hoare_pre [wp_pre del]\n shows \"\\valid_pdpt_objs\\ unmap_page_table asid vptr pt \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: unmap_page_table_def)\n apply (wp get_object_wp store_invalid_pde_valid_pdpt | wpc)+\n apply (simp add: obj_at_def)\n apply (simp add: page_table_mapped_def)\n apply (wp get_pde_wp | wpc)+\n apply simp\n apply (rule hoare_post_impErr, rule valid_validE,\n rule find_pd_for_asid_inv, simp_all)\n done\n\ncrunch valid_pdpt_objs[wp]: finalise_cap, cap_swap_for_delete, empty_slot \"valid_pdpt_objs\"\n (wp: crunch_wps select_wp preemption_point_inv simp: crunch_simps unless_def ignore:set_object)\n\nlemma preemption_point_valid_pdpt_objs[wp]:\n \"\\valid_pdpt_objs\\ preemption_point \\\\rv. valid_pdpt_objs\\\"\n by (wp preemption_point_inv | simp)+\n\nlemmas cap_revoke_preservation_valid_pdpt_objs = cap_revoke_preservation[OF _,\n where E=valid_pdpt_objs,\n simplified, THEN validE_valid]\n\nlemmas rec_del_preservation_valid_pdpt_objs = rec_del_preservation[OF _ _ _ _,\n where P=valid_pdpt_objs, simplified]\n\ncrunch valid_pdpt_objs[wp]: cap_delete, cap_revoke \"valid_pdpt_objs\"\n (wp: rec_del_preservation_valid_pdpt_objs cap_revoke_preservation_valid_pdpt_objs)\n\ncrunch valid_pdpt_objs[wp]: invalidate_tlb_by_asid, page_table_mapped\n \"valid_pdpt_objs\"\n\nlemma mapM_x_copy_pde_updates:\n \"\\ \\x \\ set xs. f x && ~~ mask pd_bits = 0; is_aligned p pd_bits;\n is_aligned p' pd_bits \\ \\\n \\\\s. (\\ page_directory_at p s \\ Q s) \\ (\\ page_directory_at p' s \\ Q s) \\\n (\\pd pd'. ko_at (ArchObj (PageDirectory pd)) p s\n \\ ko_at (ArchObj (PageDirectory pd')) p' s\n \\ Q (s \\ kheap := (kheap s) (p' := Some (ArchObj (PageDirectory (\\y. if y \\ (\\x.\n ucast (f x && mask pd_bits >> 2)) ` set xs then pd y else pd' y)))) \\))\\\n mapM_x (\\x. get_pde (p + f x) >>= store_pde (p' + f x)) xs\n \\\\_. Q\\\"\n apply (induct xs)\n apply (simp add: mapM_x_Nil)\n apply wp\n apply (clarsimp simp: obj_at_def fun_upd_idem dest!: a_type_pdD)\n apply (simp add: mapM_x_Cons)\n apply wp\n apply (thin_tac \"valid P f Q\" for P f Q)\n apply (simp add: store_pde_def set_pd_def set_object_def\n cong: bind_cong split del: if_split)\n apply (wp get_object_wp get_pde_wp)\n apply (clarsimp simp: obj_at_def a_type_simps mask_out_add_aligned[symmetric]\n split del: if_split)\n apply (simp add: a_type_simps, safe)\n apply (erule rsubst[where P=Q])\n apply (rule abstract_state.fold_congs[OF refl refl])\n apply (rule ext, clarsimp)\n apply (rule ext, simp)\n apply (erule rsubst[where P=Q])\n apply (rule abstract_state.fold_congs[OF refl refl])\n apply (rule ext, clarsimp)\n apply (rule ext, simp add: mask_add_aligned)\n done\n\nlemma copy_global_mappings_valid_pdpt_objs[wp]:\n notes hoare_pre [wp_pre del]\n shows\n \"\\valid_pdpt_objs and valid_arch_state and pspace_aligned\n and K (is_aligned p pd_bits)\\\n copy_global_mappings p \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: copy_global_mappings_def)\n apply wp\n apply (rule_tac P=\"is_aligned global_pd pd_bits\" in hoare_gen_asm)\n apply (rule mapM_x_copy_pde_updates, simp_all)\n apply (clarsimp simp: mask_eq_x_eq_0[symmetric])\n apply (rule less_mask_eq, rule shiftl_less_t2n,\n simp_all add: pd_bits_def pageBits_def)[1]\n apply (drule plus_one_helper2, simp+)\n apply wp\n apply (clarsimp simp: invs_aligned_pdD ranI\n elim!: ranE split: if_split_asm)\n apply (intro conjI)\n apply (rule_tac S=\"{x. ucast x \\ (kernel_base >> 20)}\"\n in valid_entries_partial_copy)\n apply (fastforce simp: obj_at_def ran_def)\n apply (fastforce simp: obj_at_def ran_def)\n apply (clarsimp simp:image_def)\n apply (subst (asm) less_mask_eq)\n apply (rule shiftl_less_t2n)\n apply (simp add:pd_bits_def pageBits_def word_le_make_less)\n apply (simp add:pd_bits_def pageBits_def)\n apply (subst (asm) shiftl_shiftr1)\n apply simp\n apply (simp add:word_size)\n apply (subst (asm) less_mask_eq)\n apply (simp add:pd_bits_def pageBits_def le_less_trans)\n apply (case_tac v)\n apply (simp add:ucast_ucast_len pd_bits_def pageBits_def le_less_trans)+\n apply (clarsimp split:if_splits)\n apply (simp add:kernel_base_shift_cast_le)\n apply (simp add:kernel_base_def)\n apply (cut_tac y1 = xb and x1 = \"0xE00::12 word\" in ucast_le_migrate[THEN iffD1,rotated -1])\n apply simp\n apply (simp add:word_size le_less_trans)\n apply (simp add:word_size)\n apply (drule aligned_le_sharp[where n = 4 and a = \"0xE00::12 word\"])\n apply (simp add:kernel_base_def is_aligned_def)\n apply (erule order_trans)\n apply (erule subst)\n apply (simp add:word_and_le2)\n apply (subst ucast_ucast_len)\n apply (simp,word_bitwise)\n apply simp\n apply (clarsimp simp:image_def)\n apply (rule disjointI)\n apply clarsimp\n apply (drule_tac x = \"ucast x\" in spec)\n apply (erule impE)\n apply (simp add:pd_bits_def pageBits_def)\n apply word_bitwise\n apply (subgoal_tac \"kernel_base >> 20 \\ ucast x\")\n apply simp\n apply (subst (asm) less_mask_eq)\n apply (rule shiftl_less_t2n)\n apply (simp add:pd_bits_def pageBits_def word_le_make_less)\n apply word_bitwise\n apply (simp add:pd_bits_def pageBits_def)\n apply (subst (asm) shiftl_shiftr1)\n apply simp\n apply (simp add:word_size)\n apply (subst (asm) less_mask_eq)\n apply (rule less_le_trans[OF ucast_less])\n apply simp\n apply simp\n apply word_bitwise\n apply (case_tac v,simp_all)\n apply (clarsimp split:if_splits)\n apply (drule aligned_le_sharp[where n = 4])\n apply (simp add:kernel_base_def is_aligned_def)\n apply (simp add:word_size kernel_base_def pd_bits_def pageBits_def)\n apply word_bitwise\n apply simp\n apply (clarsimp simp:obj_at_def)\n apply (subst (asm) is_aligned_neg_mask_eq\n [where p = p and n = pd_bits,symmetric])\n apply simp\n apply (drule(1) valid_pdpt_objs_pdD[rotated])+\n apply (clarsimp simp:entries_align_def)\n done\n\nlemma in_pte_rangeD:\n \"x \\ pte_range v y \\ x && ~~ mask 4 = y && ~~ mask 4\"\n by (case_tac v,simp_all split:if_splits)\n\nlemma in_pde_rangeD:\n \"x \\ pde_range v y \\ x && ~~ mask 4 = y && ~~ mask 4\"\n by (case_tac v,simp_all split:if_splits)\n\nlemma mapM_x_store_pte_valid_pdpt2:\n \"\\valid_pdpt_objs and K (is_aligned ptr pt_bits)\\\n mapM_x (\\x. store_pte x InvalidPTE) [ptr, ptr + 4 .e. ptr + 2 ^ pt_bits - 1]\n \\\\_. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)+\n apply (rule mapM_x_wp')\n apply (simp add:store_pte_def set_pt_def)\n apply (wp get_pt_wp get_object_wp)\n apply (clarsimp simp: mask_in_range\n split:Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (rule conjI)\n apply (rule valid_entries_overwrite_0)\n apply (fastforce simp:ran_def obj_at_def)\n apply simp\n apply (simp add:fun_upd_def obj_at_def)\n apply (rule entries_align_pte_update)\n apply (drule (1) valid_pdpt_objs_ptD,simp)\n apply simp\n done\n\nlemma mapM_x_store_pde_valid_pdpt2:\n \"\\valid_pdpt_objs and K (is_aligned pd pd_bits)\\\n mapM_x (\\x. store_pde ((x << 2) + pd) pde.InvalidPDE)\n [0.e.(kernel_base >> 20) - 1]\n \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)\n apply (rule mapM_x_wp')\n apply (simp add:store_pde_def set_pd_def)\n apply (wp get_pd_wp get_object_wp)\n apply (clarsimp simp: mask_in_range\n split:Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (rule conjI)\n apply (rule valid_entries_overwrite_0)\n apply (fastforce simp:ran_def obj_at_def)\n apply simp\n apply (simp add:fun_upd_def obj_at_def)\n apply (rule entries_align_pde_update)\n apply (drule (1) valid_pdpt_objs_pdD,simp)\n apply simp\n done\n\nlemma non_invalid_in_pde_range:\n \"pde \\ InvalidPDE\n \\ x \\ pde_range pde x\"\n by (case_tac pde,simp_all)\n\nlemma non_invalid_in_pte_range:\n \"pte \\ InvalidPTE\n \\ x \\ pte_range pte x\"\n by (case_tac pte,simp_all)\n\ncrunch valid_pdpt_objs[wp]: cancel_badged_sends \"valid_pdpt_objs\"\n (simp: crunch_simps filterM_mapM wp: crunch_wps ignore: filterM)\n\ncrunch valid_pdpt_objs[wp]: cap_move, cap_insert \"valid_pdpt_objs\"\n\nlemma invoke_cnode_valid_pdpt_objs[wp]:\n \"\\valid_pdpt_objs and invs and valid_cnode_inv i\\ invoke_cnode i \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: invoke_cnode_def)\n apply (rule hoare_pre)\n apply (wp get_cap_wp | wpc | simp split del: if_split)+\n done\n\nlemma as_user_valid_pdpt_objs[wp]:\n \"\\valid_pdpt_objs\\ as_user t m \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: as_user_def split_def)\n apply wp\n apply simp\n done\n\ncrunch valid_pdpt_objs[wp]: invoke_tcb \"valid_pdpt_objs\"\n (wp: check_cap_inv crunch_wps simp: crunch_simps\n ignore: check_cap_at)\n\nlemma invoke_domain_valid_pdpt_objs[wp]:\n \"\\valid_pdpt_objs\\ invoke_domain t d \\\\rv. valid_pdpt_objs\\\"\n by (simp add: invoke_domain_def | wp)+\n\ncrunch valid_pdpt_objs[wp]: set_extra_badge, transfer_caps_loop \"valid_pdpt_objs\"\n (wp: transfer_caps_loop_pres)\n\ncrunch valid_pdpt_objs[wp]: send_ipc, send_signal,\n do_reply_transfer, invoke_irq_control, invoke_irq_handler \"valid_pdpt_objs\"\n (wp: crunch_wps simp: crunch_simps\n ignore: clearMemory const_on_failure set_object)\n\nlemma valid_pdpt_objs_trans_state[simp]: \"valid_pdpt_objs (trans_state f s) = valid_pdpt_objs s\"\n apply (simp add: obj_valid_pdpt_def)\n done\n\nlemma retype_region_valid_pdpt[wp]:\n \"\\valid_pdpt_objs\\ retype_region ptr bits o_bits type dev \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: retype_region_def split del: if_split)\n apply (wp | simp only: valid_pdpt_objs_trans_state trans_state_update[symmetric])+\n apply (clarsimp simp: retype_addrs_fold foldr_upd_app_if ranI\n elim!: ranE split: if_split_asm simp del:fun_upd_apply)\n apply (simp add: default_object_def default_arch_object_def\n split: Structures_A.kernel_object.splits\n Structures_A.apiobject_type.split aobject_type.split)+\n apply (simp add:entries_align_def)\n done\n\nlemma detype_valid_pdpt[elim!]:\n \"valid_pdpt_objs s \\ valid_pdpt_objs (detype S s)\"\n by (auto simp add: detype_def ran_def)\n\ncrunch valid_pdpt_objs[wp]: create_cap \"valid_pdpt_objs\"\n (ignore: clearMemory simp: crunch_simps unless_def)\n\nlemma init_arch_objects_valid_pdpt:\n \"\\valid_pdpt_objs and pspace_aligned and valid_arch_state\n and K (\\us sz. orefs = retype_addrs ptr type n us\n \\ range_cover ptr sz (obj_bits_api type us) n)\\\n init_arch_objects type ptr n obj_sz orefs\n \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_gen_asm)+\n apply (clarsimp simp: init_arch_objects_def\n split del: if_split)\n apply (rule hoare_pre)\n apply (wp | wpc)+\n apply (rule_tac Q=\"\\rv. valid_pdpt_objs and pspace_aligned and valid_arch_state\"\n in hoare_post_imp, simp)\n apply (rule mapM_x_wp')\n apply (rule hoare_pre, wp copy_global_mappings_valid_pdpt_objs)\n apply clarsimp\n apply (drule_tac sz=sz in retype_addrs_aligned)\n apply (simp add:range_cover_def)\n apply (drule range_cover.sz,simp add:word_bits_def)\n apply (simp add:range_cover_def)\n apply (clarsimp simp:obj_bits_api_def pd_bits_def pageBits_def\n arch_kobj_size_def default_arch_object_def range_cover_def)+\n apply wp\n apply simp\n done\n\nlemma delete_objects_valid_pdpt:\n \"\\valid_pdpt_objs\\ delete_objects ptr bits \\\\rv. valid_pdpt_objs\\\"\n by (rule delete_objects_reduct) (wp detype_valid_pdpt)\n\ncrunch valid_pdpt[wp]: reset_untyped_cap \"valid_pdpt_objs\"\n (wp: mapME_x_inv_wp crunch_wps simp: crunch_simps unless_def)\n\nlemma invoke_untyped_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and invs and ct_active\n and valid_untyped_inv ui\\\n invoke_untyped ui\n \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_pre, rule invoke_untyped_Q)\n apply (wp init_arch_objects_valid_pdpt | simp)+\n apply (auto simp: post_retype_invs_def split: if_split_asm)[1]\n apply (wp | simp)+\n done\n\ncrunch valid_pdpt_objs[wp]: perform_asid_pool_invocation,\n perform_asid_control_invocation \"valid_pdpt_objs\"\n (ignore: delete_objects wp: delete_objects_valid_pdpt static_imp_wp)\n\nabbreviation (input)\n \"safe_pt_range \\ \\slots s. obj_at (\\ko. \\pt. ko = ArchObj (PageTable pt)\n \\ (\\x\\set (tl slots). pt (ucast (x && mask pt_bits >> 2))\n = pte.InvalidPTE))\n (hd slots && ~~ mask pt_bits) s\"\n\nabbreviation (input)\n \"safe_pd_range \\ \\slots s. obj_at (\\ko. \\pd. ko = ArchObj (PageDirectory pd)\n \\ (\\x\\set (tl slots). pd (ucast (x && mask pd_bits >> 2))\n = pde.InvalidPDE))\n (hd slots && ~~ mask pd_bits) s\"\n\ndefinition\n \"page_inv_entries_pre entries \\\n let slots = (case entries of Inl (pte, slots) \\ slots | Inr (pde, slots) \\ slots)\n in (if \\sl. slots = [sl]\n then case entries of\n Inl (pte, _) \\ obj_at (\\ko. \\pt pte. ko = ArchObj (PageTable pt)\n \\ pt (ucast (hd slots && mask pt_bits >> 2) && ~~ mask 4) = pte\n \\ pte_range_sz pte = 0)\n (hd slots && ~~ mask pt_bits)\n and K (pte_range_sz pte = 0)\n | Inr (pde, _) \\ obj_at (\\ko. \\pd pde. ko = ArchObj (PageDirectory pd)\n \\ pd (ucast (head slots && mask pd_bits >> 2) && ~~ mask 4)\n = pde \\ pde_range_sz pde = 0)\n (hd slots && ~~ mask pd_bits)\n and K (pde_range_sz pde = 0)\n else (\\s. (\\p. is_aligned p 6 \\ slots = map (\\x. x + p) [0, 4 .e. 0x3C])))\n and K (case entries of Inl (pte,slots) \\ pte \\ InvalidPTE\n | Inr (pde,slots) \\ pde \\ InvalidPDE)\"\n\ndefinition\n \"page_inv_entries_safe entries \\\n let slots = (case entries of Inl (pte, slots) \\ slots | Inr (pde, slots) \\ slots)\n in if \\sl. slots = [sl]\n then case entries of\n Inl (pte, _) \\ obj_at (\\ko. \\pt pte. ko = ArchObj (PageTable pt)\n \\ pt (ucast (hd slots && mask pt_bits >> 2) && ~~ mask 4) = pte\n \\ pte_range_sz pte = 0)\n (hd slots && ~~ mask pt_bits)\n and K (pte_range_sz pte = 0)\n | Inr (pde, _) \\ obj_at (\\ko. \\pd pde. ko = ArchObj (PageDirectory pd)\n \\ pd (ucast (head slots && mask pd_bits >> 2) && ~~ mask 4)\n = pde \\ pde_range_sz pde = 0)\n (hd slots && ~~ mask pd_bits)\n and K (pde_range_sz pde = 0)\n else (\\s. (\\p. is_aligned p 6 \\ slots = map (\\x. x + p) [0, 4 .e. 0x3C]\n \\ (case entries of\n Inl (pte, _) \\ safe_pt_range slots s\n | Inr (pde, _) \\ safe_pd_range slots s\n )))\"\n\ndefinition\n \"page_inv_duplicates_valid iv \\ case iv of\n PageMap asid cap ct_slot entries \\\n page_inv_entries_safe entries\n | PageRemap asid entries \\\n page_inv_entries_safe entries\n | _ \\ \\\"\n\nlemma pte_range_interD:\n \"pte_range pte p \\ pte_range pte' p' \\ {}\n \\ pte \\ InvalidPTE \\ pte' \\ InvalidPTE\n \\ p && ~~ mask 4 = p' && ~~ mask 4\"\n apply (drule int_not_emptyD)\n apply (case_tac pte,simp_all split:if_splits)\n apply (case_tac pte',simp_all split:if_splits)\n apply clarsimp\n apply (case_tac pte',simp_all split:if_splits)\n apply (case_tac pte', simp_all split:if_splits)\n done\n\nlemma pde_range_interD:\n \"pde_range pde p \\ pde_range pde' p' \\ {}\n \\ pde \\ InvalidPDE \\ pde' \\ InvalidPDE\n \\ p && ~~ mask 4 = p' && ~~ mask 4\"\n apply (drule int_not_emptyD)\n apply (case_tac pde,simp_all split:if_splits)\n apply (case_tac pde',simp_all split:if_splits)\n apply (case_tac pde',simp_all split:if_splits)\n apply clarsimp\n apply (case_tac pde', simp_all split:if_splits)\n apply (case_tac pde', simp_all split:if_splits)\n done\n\nlemma pte_range_sz_le:\n \"(pte_range_sz pte) \\ 4\"\n by (case_tac pte,simp_all)\n\nlemma pde_range_sz_le:\n \"(pde_range_sz pde) \\ 4\"\n by (case_tac pde,simp_all)\n\n(* BUG , revisit the following lemmas , moved from ArchAcc_R.thy *)\nlemma mask_pd_bits_shift_ucast_align[simp]:\n \"is_aligned (ucast (p && mask pd_bits >> 2)::12 word) 4 =\n is_aligned ((p::word32) >> 2) 4\"\n by (clarsimp simp: is_aligned_mask mask_def pd_bits) word_bitwise\n\nlemma mask_pt_bits_shift_ucast_align[simp]:\n \"is_aligned (ucast (p && mask pt_bits >> 2)::word8) 4 =\n is_aligned ((p::word32) >> 2) 4\"\n by (clarsimp simp: is_aligned_mask mask_def pt_bits_def pageBits_def)\n word_bitwise\n\nlemma store_pte_valid_pdpt:\n \"\\valid_pdpt_objs and page_inv_entries_safe (Inl (pte, slots))\\\n store_pte (hd slots) pte \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n apply (clarsimp simp:store_pte_def set_pt_def)\n apply (wp get_pt_wp get_object_wp)\n apply (clarsimp simp:obj_at_def\n split:pte.splits arch_kernel_obj.splits)\n apply (rule conjI)\n apply (drule(1) valid_pdpt_objs_ptD)\n apply (rule valid_entries_overwrite_0)\n apply simp\n apply (case_tac pte)\n apply simp+\n apply (case_tac \"pta p\",simp_all)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pte_update)\n apply (drule (1) valid_pdpt_objs_ptD,simp)\n apply simp\n apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n apply (clarsimp simp:store_pte_def set_pt_def)\n apply (wp get_pt_wp get_object_wp)\n apply (clarsimp simp:obj_at_def\n split:pte.splits arch_kernel_obj.splits)\n apply (drule(1) valid_pdpt_objs_ptD)\n apply (rule conjI)\n apply (rule valid_entries_overwrite_0)\n apply simp\n apply (rule ccontr)\n apply (drule pte_range_interD)\n apply clarsimp\n apply (simp add:ucast_neg_mask)\n apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n apply simp\n apply (drule_tac x = \"((p && ~~ mask pt_bits) + ((ucast pa) << 2))\" in bspec)\n apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pt_bits >> 2))\" in bexI)\n apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n apply (subst shiftr_shiftl1)\n apply simp+\n apply (subst is_aligned_neg_mask_eq)\n apply (erule is_aligned_andI1[OF is_aligned_weaken])\n apply simp\n apply simp\n apply simp\n apply (drule_tac s = \"ucast (p && mask pt_bits >> 2)\" in sym)\n apply (simp add:mask_out_sub_mask field_simps)\n apply (drule_tac f = \"ucast::(word8\\word32)\" in arg_cong)\n apply (simp add:ucast_pt_index pt_bits_def pageBits_def)\n apply (simp add:unat_ucast_8_32)\n apply (rule conjI)\n apply (subgoal_tac \"unat (pa && mask 4)\\ 0\")\n apply simp\n apply (simp add:unat_gt_0)\n apply (rule unat_less_helper)\n apply (rule le_less_trans[OF word_and_le1])\n apply (simp add:mask_def)\n apply (simp add:field_simps neg_mask_add_mask)\n apply (thin_tac \"ucast y = x\" for y x)\n apply (subst (asm) less_mask_eq[where n = pt_bits])\n apply (rule shiftl_less_t2n)\n apply (simp add:pt_bits_def pageBits_def)\n apply word_bitwise\n apply (simp add:pt_bits_def pageBits_def)\n apply (subst (asm) shiftl_shiftr_id)\n apply simp\n apply (simp,word_bitwise)\n apply (simp add:ucast_ucast_id)\n apply (simp add:fun_upd_def entries_align_def)\n apply (rule is_aligned_weaken[OF _ pte_range_sz_le])\n apply (simp add:is_aligned_shiftr)\n done\n\nlemma store_pde_valid_pdpt:\n \"\\valid_pdpt_objs and page_inv_entries_safe (Inr (pde, slots))\\\n store_pde (hd slots) pde \\\\rv. valid_pdpt_objs\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n apply (clarsimp simp:store_pde_def set_pd_def)\n apply (wp get_pd_wp get_object_wp)\n apply (clarsimp simp:obj_at_def\n split:pde.splits arch_kernel_obj.splits)\n apply (drule(1) valid_pdpt_objs_pdD)\n apply (rule conjI)\n apply (rule valid_entries_overwrite_0)\n apply simp\n apply (case_tac pde,simp_all)\n apply (case_tac \"pda p\",simp_all)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply (case_tac \"pda p\",simp_all)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply (simp add:fun_upd_def)\n apply (rule entries_align_pde_update)\n apply simp+\n apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n apply (clarsimp simp:store_pde_def set_pd_def)\n apply (wp get_pd_wp get_object_wp)\n apply (clarsimp simp:obj_at_def\n split:pde.splits arch_kernel_obj.splits)\n apply (drule(1) valid_pdpt_objs_pdD)\n apply (rule conjI)\n apply (rule valid_entries_overwrite_0)\n apply simp\n apply (rule ccontr)\n apply (drule pde_range_interD)\n apply clarsimp\n apply (simp add:ucast_neg_mask)\n apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n apply simp\n apply (drule_tac x = \"((p && ~~ mask pd_bits) + ((ucast pa) << 2))\" in bspec)\n apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pd_bits >> 2))\" in bexI)\n apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n apply (subst shiftr_shiftl1)\n apply simp+\n apply (subst is_aligned_neg_mask_eq)\n apply (erule is_aligned_andI1[OF is_aligned_weaken])\n apply simp\n apply simp\n apply simp\n apply (drule_tac s = \"ucast (p && mask pd_bits >> 2)\" in sym)\n apply (simp add:mask_out_sub_mask field_simps)\n apply (drule_tac f = \"ucast::(12 word\\word32)\" in arg_cong)\n apply (simp add:ucast_pd_index pd_bits_def pageBits_def)\n apply (simp add:unat_ucast_12_32)\n apply (rule conjI)\n apply (subgoal_tac \"unat (pa && mask 4)\\ 0\")\n apply simp\n apply (simp add:unat_gt_0)\n apply (rule unat_less_helper)\n apply (rule le_less_trans[OF word_and_le1])\n apply (simp add:mask_def)\n apply (simp add:field_simps neg_mask_add_mask)\n apply (thin_tac \"ucast y = x\" for y x)\n apply (subst (asm) less_mask_eq[where n = pd_bits])\n apply (rule shiftl_less_t2n)\n apply (simp add:pd_bits_def pageBits_def)\n apply word_bitwise\n apply (simp add:pd_bits_def pageBits_def)\n apply (subst (asm) shiftl_shiftr_id)\n apply simp\n apply (simp,word_bitwise)\n apply (simp add:ucast_ucast_id)\n apply (simp add:entries_align_def)\n apply (rule is_aligned_weaken[OF _ pde_range_sz_le])\n apply (simp add:is_aligned_shiftr)\n done\n\nlemma set_cap_page_inv_entries_safe:\n \"\\page_inv_entries_safe x\\ set_cap y z \\\\_. page_inv_entries_safe x\\\"\n apply (simp add:page_inv_entries_safe_def set_cap_def split_def\n get_object_def set_object_def)\n apply (wp | wpc)+\n apply (case_tac x)\n apply (auto simp:obj_at_def\n Let_def split:if_splits option.splits)\n done\n\ncrunch valid_pdpt[wp]: pte_check_if_mapped, pde_check_if_mapped \"valid_pdpt_objects\"\n\nlemma perform_page_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and valid_page_inv pinv and page_inv_duplicates_valid pinv\\\n perform_page_invocation pinv \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: perform_page_invocation_def page_inv_duplicates_valid_def)\n apply (cases pinv,\n simp_all add: mapM_discarded page_inv_entries_safe_def\n split: sum.split arch_cap.split option.split,\n safe intro!: hoare_gen_asm hoare_gen_asm[unfolded K_def],\n simp_all add: mapM_x_Nil mapM_x_Cons mapM_x_map)\n apply (wp store_pte_valid_pdpt store_pde_valid_pdpt get_master_pte_wp get_master_pde_wp\n store_pte_non_master_valid_pdpt store_pde_non_master_valid_pdpt\n mapM_x_wp'[OF store_invalid_pte_valid_pdpt\n [where pte=pte.InvalidPTE, simplified]]\n mapM_x_wp'[OF store_invalid_pde_valid_pdpt\n [where pde=pde.InvalidPDE, simplified]]\n set_cap_page_inv_entries_safe\n hoare_vcg_imp_lift[OF set_cap_arch_obj_neg] hoare_vcg_all_lift\n | clarsimp simp: cte_wp_at_weakenE[OF _ TrueI] obj_at_def\n pte_range_sz_def pde_range_sz_def swp_def valid_page_inv_def\n valid_slots_def page_inv_entries_safe_def pte_check_if_mapped_def\n pde_check_if_mapped_def\n split: pte.splits pde.splits\n | wp_once hoare_drop_imps)+\n done\n\ndefinition\n \"pti_duplicates_valid iv \\\n case iv of PageTableMap cap ct_slot pde pd_slot\n \\ obj_at (\\ko. \\pd pde. ko = ArchObj (PageDirectory pd)\n \\ pd (ucast (pd_slot && mask pd_bits >> 2) && ~~ mask 4)\n = pde \\ pde_range_sz pde = 0)\n (pd_slot && ~~ mask pd_bits)\n\n and K (pde_range_sz pde = 0)\n | _ \\ \\\"\n\n\ndefinition\n \"invocation_duplicates_valid i \\\n case i of\n InvokeArchObject (InvokePage pgi) \\ page_inv_duplicates_valid pgi\n | InvokeArchObject (InvokePageTable pti) \\ pti_duplicates_valid pti\n | _ \\ \\\"\n\nlemma perform_page_table_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and valid_pti pinv and pti_duplicates_valid pinv\\\n perform_page_table_invocation pinv \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: perform_page_table_invocation_def split_def\n cong: page_table_invocation.case_cong\n option.case_cong cap.case_cong arch_cap.case_cong)\n apply (rule hoare_pre)\n apply (wp store_pde_non_master_valid_pdpt hoare_vcg_ex_lift\n set_cap_arch_obj mapM_x_store_pte_valid_pdpt2\n | wpc\n | simp add: swp_def\n | strengthen all_imp_ko_at_from_ex_strg)+\n apply (clarsimp simp: pti_duplicates_valid_def valid_pti_def)\n apply (auto simp: obj_at_def cte_wp_at_caps_of_state valid_cap_simps\n cap_aligned_def pt_bits_def pageBits_def\n intro!: inj_onI)\n done\n\nlemma perform_page_directory_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and valid_pdi pinv\\\n perform_page_directory_invocation pinv \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: perform_page_directory_invocation_def split_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp)+\n done\n\nlemma perform_invocation_valid_pdpt[wp]:\n \"\\invs and ct_active and valid_invocation i and valid_pdpt_objs\n and invocation_duplicates_valid i\\\n perform_invocation blocking call i\n \\\\rv. valid_pdpt_objs\\\"\n apply (cases i, simp_all)\n apply (wp send_signal_interrupt_states | simp)+\n apply (clarsimp simp: invocation_duplicates_valid_def)\n apply (wp | wpc | simp)+\n apply (simp add: arch_perform_invocation_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp)+\n apply (auto simp: valid_arch_inv_def invocation_duplicates_valid_def)\n done\n\nlemma neg_mask_pt_6_4:\n \"(ptr && mask pt_bits >> 2) && ~~ mask 4 =\n (ptr::word32) && ~~ mask 6 && mask pt_bits >> 2\"\n apply (simp add:pt_bits_def pageBits_def)\n apply word_bitwise\n apply (simp add:word_size)\n done\n\nlemma neg_mask_pd_6_4:\n \"(ptr && mask pd_bits >> 2) && ~~ mask 4 =\n (ptr::word32) && ~~ mask 6 && mask pd_bits >> 2\"\n apply (simp add:pd_bits_def pageBits_def)\n apply word_bitwise\n apply (simp add:word_size)\n done\n\nlemma mask_out_same_pt:\n \"\\is_aligned p 6; x < 2 ^ 6 \\ \\ p + x && ~~ mask pt_bits = p && ~~ mask pt_bits\"\n apply (subst mask_lower_twice[symmetric,where n = 6])\n apply (simp add:pt_bits_def pageBits_def)\n apply (simp add:is_aligned_add_helper)\n done\n\nlemma mask_out_same_pd:\n \"\\is_aligned p 6; x < 2 ^ 6 \\ \\ p + x && ~~ mask pd_bits = p && ~~ mask pd_bits\"\n apply (subst mask_lower_twice[symmetric,where n = 6])\n apply (simp add:pd_bits_def pageBits_def)\n apply (simp add:is_aligned_add_helper)\n done\n\nlemma ensure_safe_mapping_ensures[wp]:\n \"\\valid_pdpt_objs and (case entries of (Inl (SmallPagePTE _ _ _, [_])) \\ \\\n | (Inl (SmallPagePTE _ _ _, _)) \\ \\\n | (Inl (LargePagePTE _ _ _, [])) \\ \\\n | (Inr (SectionPDE _ _ _ _, [_])) \\ \\\n | (Inr (SuperSectionPDE _ _ _, [])) \\ \\\n | (Inr (SectionPDE _ _ _ _, _)) \\ \\\n | _ \\ page_inv_entries_pre entries)\\\n ensure_safe_mapping entries\n \\\\rv. page_inv_entries_safe entries\\,-\"\n proof -\n have [simp]:\n \"\\s a. page_inv_entries_pre (Inl (pte.InvalidPTE, a)) s \\\n page_inv_entries_safe (Inl (pte.InvalidPTE, a)) s\"\n apply (clarsimp simp:page_inv_entries_pre_def page_inv_entries_safe_def\n split:if_splits)\n done\n have name_pre:\n \"\\F P Q. (\\s. P s \\ \\op = s \\ F \\Q\\, -) \\ \\P\\ F \\Q\\,-\"\n apply (simp add:validE_R_def validE_def)\n apply (rule hoare_name_pre_state)\n apply assumption\n done\n have mask_neg_mask_order[simp]:\n \"\\a m n. a && ~~ mask m && mask n = a && mask n && ~~ mask m\"\n by (simp add:word_bw_comms word_bw_lcs)\n have align_entry_ptD:\n \"\\pt m x xb xc. \\pt m = pte.LargePagePTE x xb xc; entries_align pte_range_sz pt\\\n \\ is_aligned m 4\"\n apply (simp add:entries_align_def)\n apply (drule_tac x = m in spec,simp)\n done\n have align_entry_pdD:\n \"\\pd m x xb xc. \\pd m = pde.SuperSectionPDE x xb xc; entries_align pde_range_sz pd\\\n \\ is_aligned m 4\"\n apply (simp add:entries_align_def)\n apply (drule_tac x = m in spec,simp)\n done\n have pt_offset_bitwise[simp]:\"\\a. (ucast ((a::word32) && mask pt_bits && ~~ mask 6 >> 2)::word8)\n = (ucast (a && mask pt_bits >> 2)::word8) && ~~ mask 4\"\n apply (simp add:pt_bits_def pageBits_def mask_def)\n apply word_bitwise\n done\n have pd_offset_bitwise[simp]:\"\\a. (ucast ((a::word32) && mask pd_bits && ~~ mask 6 >> 2)::12 word)\n = (ucast (a && mask pd_bits >> 2)::12 word) && ~~ mask 4\"\n apply (simp add:pt_bits_def pageBits_def mask_def pd_bits_def)\n apply word_bitwise\n done\n have mask_neq_0:\n \"\\z zs xa p g. \\[0 :: word32, 4 .e. 0x3C] = z # zs; xa \\ set zs; is_aligned p 6; 6 \\ g\\\n \\ (p + xa && mask g >> 2) && mask 4 \\ 0\"\n apply (rule ccontr)\n apply (simp add:is_aligned_mask[symmetric])\n apply (drule is_aligned_shiftl[where n = 6 and m = 2,simplified])\n apply (subst (asm) shiftr_shiftl1)\n apply simp+\n apply (subst (asm) is_aligned_neg_mask_eq)\n apply (rule is_aligned_andI1)\n apply (erule aligned_add_aligned)\n apply (clarsimp simp :upto_enum_def upto_enum_step_def\n Fun.comp_def upto_0_to_n2 is_aligned_mult_triv2[where n = 2,simplified])\n apply simp\n apply (simp add:is_aligned_mask mask_twice\n pt_bits_def pageBits_def min_def)\n apply (subst (asm) is_aligned_mask[symmetric])\n apply (subst (asm) is_aligned_add_helper)\n apply simp\n apply (clarsimp simp :upto_enum_def upto_enum_step_def\n Fun.comp_def upto_0_to_n2)\n apply (subst shiftl_t2n\n [where n = 2,simplified field_simps,simplified,symmetric])+\n apply (rule shiftl_less_t2n[where m = 6,simplified])\n apply (rule word_of_nat_less)\n apply simp\n apply simp\n apply (clarsimp simp :upto_enum_def upto_enum_step_def\n Fun.comp_def upto_0_to_n2)\n apply (cut_tac x = \"of_nat x\" and n = 2 in word_power_nonzero_32)\n apply (simp add:word_of_nat_less word_bits_def)+\n apply (simp add: of_nat_neq_0)\n apply simp\n done \n have neq_pt_offset: \"\\z zs xa (p::word32). \\[0 , 4 .e. 0x3C] = z # zs;\n xa \\ set zs;is_aligned p 6 \\ \\\n ucast (p + xa && mask pt_bits >> 2) && ~~ mask 4 \\ ((ucast (p + xa && mask pt_bits >> 2))::word8)\"\n apply (rule ccontr)\n apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n apply (drule arg_cong[where f = unat])\n apply (simp add:unat_ucast)\n apply (subst (asm) mod_less)\n apply (rule unat_less_helper)\n apply (rule le_less_trans[OF word_and_le1])\n apply (simp add:mask_def)\n apply (simp add:unat_eq_0)\n apply (drule(2) mask_neq_0[of _ _ _ _ pt_bits])\n apply (simp add:pt_bits_def pageBits_def)+\n done\n have neq_pd_offset: \"\\z zs xa (p::word32). \\[0 , 4 .e. 0x3C] = z # zs;\n xa \\ set zs;is_aligned p 6 \\ \\\n ucast (p + xa && mask pd_bits >> 2) && ~~ mask 4 \\ ((ucast (p + xa && mask pd_bits >> 2)) :: 12 word)\"\n apply (simp add:mask_out_sub_mask)\n apply (rule ccontr)\n apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n apply (drule arg_cong[where f = unat])\n apply (simp add:unat_ucast)\n apply (subst (asm) mod_less)\n apply (rule unat_less_helper)\n apply (rule le_less_trans[OF word_and_le1])\n apply (simp add:mask_def)\n apply (simp add:unat_eq_0)\n apply (drule(2) mask_neq_0[of _ _ _ _ pd_bits])\n apply (simp add:pd_bits_def pageBits_def)+\n done\n have invalid_pteI:\n \"\\a pt x y z. \\valid_pt_entries pt; (a && ~~ mask 4) \\ a;\n pt (a && ~~ mask 4) = pte.LargePagePTE x y z \\\n \\ pt a = pte.InvalidPTE\"\n apply (drule(1) valid_entriesD[rotated])\n apply (case_tac \"pt a\"; simp add:mask_lower_twice is_aligned_neg_mask split:if_splits)\n apply fastforce\n done\n have invalid_pdeI:\n \"\\a pd x y z. \\valid_pd_entries pd; (a && ~~ mask 4) \\ a;\n pd (a && ~~ mask 4) = pde.SuperSectionPDE x y z \\\n \\ pd a = pde.InvalidPDE\"\n apply (drule(1) valid_entriesD[rotated])\n apply (case_tac \"pd a\",\n simp_all add:mask_lower_twice is_aligned_neg_mask\n split:if_splits)\n apply fastforce\n done\n have inj[simp]:\n \"\\p. is_aligned (p::word32) 6 \\ inj_on (\\x. toEnum x * 4 + p) {Suc 0..<16}\"\n apply (clarsimp simp:inj_on_def)\n apply (subst (asm) shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])+\n apply (drule arg_cong[where f = \"\\x. x >> 2\"])\n apply (simp add:shiftl_shiftr_id word_of_nat_less)\n apply (simp add:of_nat_inj)\n done\n\n show ?thesis\n apply (rule name_pre)\n apply (case_tac entries)\n apply (case_tac a, case_tac aa)\n apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n | wp | intro conjI impI)+\n apply (simp split:list.splits add:page_inv_entries_pre_def)+\n apply (rename_tac obj_ref vm_attributes cap_rights slot slots)\n apply (elim conjE exE)\n apply (subst mapME_x_Cons)\n apply simp\n apply wp\n apply (rule_tac Q' = \"\\r s. \\x \\ set slots. obj_at\n (\\ko. \\pt. ko = ArchObj (PageTable pt) \\\n pt (ucast (x && mask pt_bits >> 2)) = pte.InvalidPTE)\n (hd (slot # slots) && ~~ mask pt_bits) s\" in hoare_post_imp_R)\n apply (wp mapME_x_accumulate_checks[where Q = \"\\s. valid_pdpt_objs s\"] )\n apply (wp get_master_pte_wp| wpc | simp)+\n apply clarsimp\n apply (frule_tac x = xa in mask_out_same_pt)\n apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n apply (erule notE)\n apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n apply (rule shiftl_less_t2n[where m = 6,simplified])\n apply (simp add:word_of_nat_less)\n apply simp\n apply (frule_tac x = z in mask_out_same_pt)\n apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n apply (clarsimp simp:field_simps obj_at_def\n split:pte.splits)\n apply (intro conjI impI)\n apply (clarsimp)\n apply (drule(1) valid_pdpt_objs_ptD)\n apply (frule align_entry_ptD,simp)\n apply (simp add:is_aligned_neg_mask_eq)\n apply clarsimp\n apply (drule(1) valid_pdpt_objs_ptD,clarify)\n apply (erule(4) invalid_pteI[OF _ neq_pt_offset])\n apply clarsimp\n apply (drule(1) valid_pdpt_objs_ptD,clarify)\n apply (frule align_entry_ptD,simp)\n apply (simp add:is_aligned_neg_mask_eq)\n apply (wp hoare_drop_imps |wpc|simp)+\n apply (clarsimp simp:upto_enum_def upto_enum_step_def\n upto_0_to_n2 Fun.comp_def distinct_map)\n apply (intro exI conjI,fastforce+)\n apply (simp add:obj_at_def hd_map_simp\n upto_0_to_n2 upto_enum_def upto_enum_step_def)\n apply (frule_tac x = 1 in bspec,fastforce+)\n apply ((wp hoare_drop_imps |wpc|simp)+)[1]\n apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n | wp | intro conjI impI)+\n apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n apply (wp get_master_pte_wp |wpc | simp)+\n apply (clarsimp simp:obj_at_def split:pte.splits)\n apply (clarsimp simp:page_inv_entries_safe_def split:list.splits)\n apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n apply (case_tac b,case_tac a)\n apply ((simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n | wp | intro conjI impI)+)[1]\n apply simp\n apply wp[1]\n apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n apply (wp get_master_pde_wp | wpc | simp)+\n apply (clarsimp simp:obj_at_def page_inv_entries_safe_def\n split:pde.splits)\n apply (simp split:list.splits if_splits\n add:page_inv_entries_pre_def Let_def page_inv_entries_safe_def)\n apply (elim conjE exE)\n apply (subst mapME_x_Cons)\n apply simp\n apply wp\n apply (rule_tac Q' = \"\\r s. \\x \\ set x22. obj_at\n (\\ko. \\pd. ko = ArchObj (PageDirectory pd) \\\n pd (ucast (x && mask pd_bits >> 2)) = pde.InvalidPDE)\n (hd (x21 # x22) && ~~ mask pd_bits) s\" in hoare_post_imp_R)\n apply (wp mapME_x_accumulate_checks[where Q = \"\\s. valid_pdpt_objs s\"] )\n apply (wp get_master_pde_wp| wpc | simp)+\n apply clarsimp\n apply (frule_tac x = xa in mask_out_same_pd)\n apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n apply (erule notE)\n apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n apply (rule shiftl_less_t2n[where m = 6,simplified])\n apply (simp add:word_of_nat_less)\n apply simp\n apply (frule_tac x = z in mask_out_same_pd)\n apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n apply (clarsimp simp:field_simps obj_at_def\n split:pde.splits)\n apply (drule(1) valid_pdpt_objs_pdD)\n apply (intro conjI impI)\n apply clarsimp\n apply (frule(1) align_entry_pdD)\n apply (simp add:is_aligned_neg_mask_eq)\n apply clarsimp\n apply (frule(1) align_entry_pdD)\n apply (simp add:is_aligned_neg_mask_eq)\n apply clarsimp\n apply (frule(1) align_entry_pdD)\n apply (simp add:is_aligned_neg_mask_eq)\n apply clarsimp\n apply (erule(4) invalid_pdeI[OF _ neq_pd_offset])\n apply (wp hoare_drop_imps |wpc|simp)+\n apply (clarsimp simp:upto_enum_def upto_enum_step_def\n upto_0_to_n2 Fun.comp_def distinct_map)\n apply (intro exI conjI,fastforce+)\n apply (simp add:obj_at_def hd_map_simp\n upto_0_to_n2 upto_enum_def upto_enum_step_def)\n apply (frule_tac x = 1 in bspec,fastforce+)\n apply (wp get_master_pde_wp | simp | wpc)+\n done\nqed\n\nlemma create_mapping_entries_safe[wp]:\n \"\\\\\\pd and K (vmsz_aligned vptr sz) and K (is_aligned pd pd_bits)\n and K (vptr < kernel_base)\n and valid_arch_objs and pspace_aligned and\n (\\\\ (lookup_pd_slot pd vptr && ~~ mask pd_bits))\\\n create_mapping_entries ptr vptr sz rights attrib pd\n \\\\entries. case entries of (Inl (SmallPagePTE _ _ _, [_])) \\ \\\n | (Inl (SmallPagePTE _ _ _, _)) \\ \\\n | (Inl (LargePagePTE _ _ _, [])) \\ \\\n | (Inr (SectionPDE _ _ _ _, [_])) \\ \\\n | (Inr (SectionPDE _ _ _ _, _)) \\ \\\n | (Inr (SuperSectionPDE _ _ _, [])) \\ \\\n | _ \\ page_inv_entries_pre entries\\,-\"\n apply (cases sz, simp_all)\n defer 2\n apply (wp | simp)+\n apply (simp split:list.split)\n apply (subgoal_tac \"lookup_pd_slot pd vptr \\ lookup_pd_slot pd vptr + 0x3C\")\n apply (clarsimp simp:upto_enum_def not_less upto_enum_step_def\n page_inv_entries_pre_def Let_def)\n apply (clarsimp simp:upto_enum_step_def upto_enum_def\n map_eq_Cons_conv upt_eq_Cons_conv)\n apply (drule_tac x = \"lookup_pd_slot pd vptr\" in spec)\n apply (subst (asm) upto_0_to_n2)\n apply simp\n apply clarsimp\n apply (drule lookup_pd_slot_aligned_6)\n apply (simp add:pd_bits_def pageBits_def)\n apply simp\n apply clarsimp\n apply (erule is_aligned_no_wrap'[OF lookup_pd_slot_aligned_6])\n apply (simp add:pd_bits pageBits_def)\n apply simp\n apply (wp get_pde_wp | simp add:lookup_pt_slot_def | wpc)+\n apply (clarsimp simp:upto_enum_def upto_enum_step_def\n page_inv_entries_pre_def Let_def )\n apply (drule_tac ref = refa in valid_arch_objsD)\n apply (simp add:obj_at_def)\n apply simp\n apply (simp)\n apply (drule_tac x = \"ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2)\"\n in bspec)\n apply simp\n apply (erule(1) less_kernel_base_mapping_slots)\n apply (clarsimp simp:not_less[symmetric] split:list.splits)\n apply (clarsimp simp:page_inv_entries_pre_def\n Let_def upto_enum_step_def upto_enum_def)\n apply (subst (asm) upto_0_to_n2)\n apply simp\n apply (clarsimp simp:not_less[symmetric])\n apply (subgoal_tac\n \"(\\xa xb. pda (ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2))\n = pde.PageTablePDE x xa xb)\n \\ is_aligned (ptrFromPAddr x + ((vptr >> 12) && 0xFF << 2)) 6\")\n apply clarsimp\n apply (subgoal_tac \"\n ptrFromPAddr x + ((vptr >> 12) && 0xFF << 2) \\\n ptrFromPAddr x + ((vptr >> 12) && 0xFF << 2) + 0x3C\")\n apply (clarsimp simp:not_less[symmetric])\n apply (erule is_aligned_no_wrap')\n apply simp\n apply clarsimp\n apply (rule aligned_add_aligned)\n apply (erule(1) pt_aligned)\n apply (rule is_aligned_shiftl[OF is_aligned_andI1])\n apply (rule is_aligned_shiftr)\n apply (simp add:vmsz_aligned_def)\n apply simp\n done\n\nlemma arch_decode_invocation_valid_pdpt[wp]:\n notes find_pd_for_asid_inv[wp del]\n shows\n \"\\invs and valid_cap (cap.ArchObjectCap cap) and valid_pdpt_objs \\\n arch_decode_invocation label args cap_index slot cap excaps\n \\invocation_duplicates_valid o Invocations_A.InvokeArchObject\\,-\"\n proof -\n have bitwise:\"\\a. (ucast (((a::word32) && ~~ mask 6) && mask 14 >> 2)::12 word)\n = (ucast (a && mask 14 >> 2)::12 word) && ~~ mask 4\"\n apply (simp add:mask_def)\n apply word_bitwise\n done\n have sz:\n \"\\vmpage_size. \\args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 < kernel_base;\n vmsz_aligned (args ! 0) vmpage_size\\\n \\ args ! 0 < kernel_base\"\n apply (rule le_less_trans[OF is_aligned_no_overflow])\n apply (simp add:vmsz_aligned_def)\n apply simp\n done\n show ?thesis\n apply (simp add: arch_decode_invocation_def\n Let_def split_def get_master_pde_def\n split del: if_split\n cong: arch_cap.case_cong if_cong cap.case_cong\n option.case_cong)\n apply (rule hoare_pre)\n apply ((wp get_pde_wp\n ensure_safe_mapping_ensures[THEN hoare_post_imp_R]\n create_mapping_entries_safe check_vp_wpR\n find_pd_for_asid_aligned_pd_bits\n [unfolded pd_bits_def pageBits_def,simplified]\n | wpc\n | simp add: invocation_duplicates_valid_def unlessE_def whenE_def\n pti_duplicates_valid_def page_inv_duplicates_valid_def\n mask_lower_twice pd_bits_def bitwise pageBits_def\n not_le sz\n del: hoare_True_E_R\n split del: if_split\n | simp only: obj_at_def)+)\n apply (rule_tac Q'=\"\\rv. \\\\ rv and K (is_aligned rv pd_bits) and\n (\\\\ (lookup_pd_slot rv (args ! 0) && ~~ mask pd_bits)) and\n valid_arch_objs and pspace_aligned and valid_pdpt_objs\"\n and f=\"find_pd_for_asid p\" for p\n in hoare_post_imp_R)\n apply (wp| simp)+\n apply (fastforce simp:pd_bits_def pageBits_def)\n apply ((wp get_pde_wp\n ensure_safe_mapping_ensures[THEN hoare_post_imp_R]\n create_mapping_entries_safe check_vp_wpR\n find_pd_for_asid_aligned_pd_bits\n [unfolded pd_bits_def pageBits_def,simplified]\n | wpc\n | simp add: invocation_duplicates_valid_def unlessE_def whenE_def\n pti_duplicates_valid_def page_inv_duplicates_valid_def\n mask_lower_twice pd_bits_def bitwise pageBits_def\n not_le sz\n del: hoare_True_E_R\n split del: if_split\n | simp only: obj_at_def)+)\n apply (rule_tac Q'=\"\\rv. \\\\ rv and K (is_aligned rv pd_bits) and\n (\\\\ (lookup_pd_slot rv (snd pa) && ~~ mask pd_bits)) and\n valid_arch_objs and pspace_aligned and valid_pdpt_objs and\n K ((snd pa) < kernel_base)\"\n and f=\"find_pd_for_asid p\" for p\n in hoare_post_imp_R)\n apply (wp| simp)+\n apply (auto simp:pd_bits_def pageBits_def)[1]\n apply ((wp get_pde_wp\n ensure_safe_mapping_ensures[THEN hoare_post_imp_R]\n create_mapping_entries_safe check_vp_wpR\n find_pd_for_asid_aligned_pd_bits\n [unfolded pd_bits_def pageBits_def,simplified]\n | wpc\n | simp add: invocation_duplicates_valid_def unlessE_def whenE_def\n pti_duplicates_valid_def page_inv_duplicates_valid_def\n mask_lower_twice pd_bits_def bitwise pageBits_def\n not_le sz\n del: hoare_True_E_R\n split del: if_split\n | simp only: obj_at_def)+)\n apply (rule hoare_post_imp_R[where P=\\])\n apply (rule hoare_True_E_R)\n apply auto[1]\n apply ((wp\n | wpc\n | simp add: invocation_duplicates_valid_def unlessE_def whenE_def\n pti_duplicates_valid_def page_inv_duplicates_valid_def\n del: hoare_True_E_R\n split del: if_split\n | simp only: obj_at_def)+)\n apply (auto simp:valid_cap_simps)\n done\nqed\n\nlemma decode_invocation_valid_pdpt[wp]:\n \"\\invs and valid_cap cap and valid_pdpt_objs\\ decode_invocation label args cap_index slot cap excaps\n \\invocation_duplicates_valid\\,-\"\n apply (simp add: decode_invocation_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp | wpc\n | simp only: invocation_duplicates_valid_def o_def uncurry_def split_def\n Invocations_A.invocation.simps)+\n apply clarsimp\n done\n\ncrunch valid_pdpt_objs[wp]: handle_fault, reply_from_kernel \"valid_pdpt_objs\"\n (simp: crunch_simps wp: crunch_wps)\n\n\nlemma invocation_duplicates_valid_exst_update[simp]:\n \"invocation_duplicates_valid i (trans_state f s) = invocation_duplicates_valid i s\"\n apply (clarsimp simp add: invocation_duplicates_valid_def pti_duplicates_valid_def page_inv_duplicates_valid_def page_inv_entries_safe_def split: sum.splits invocation.splits arch_invocation.splits kernel_object.splits page_table_invocation.splits page_invocation.splits)+\n done\n\n\nlemma set_thread_state_duplicates_valid[wp]:\n \"\\invocation_duplicates_valid i\\ set_thread_state t st \\\\rv. invocation_duplicates_valid i\\\"\n apply (simp add: set_thread_state_def set_object_def)\n apply (wp|simp)+\n apply (clarsimp simp: invocation_duplicates_valid_def pti_duplicates_valid_def\n page_inv_duplicates_valid_def page_inv_entries_safe_def\n Let_def\n dest!: get_tcb_SomeD\n split: Invocations_A.invocation.split arch_invocation.split_asm\n page_table_invocation.split\n page_invocation.split sum.split\n )\n apply (auto simp add: obj_at_def page_inv_entries_safe_def)\n done\n\nlemma handle_invocation_valid_pdpt[wp]:\n \"\\valid_pdpt_objs and invs and ct_active\\\n handle_invocation calling blocking \\\\rv. valid_pdpt_objs\\\"\n apply (simp add: handle_invocation_def)\n apply (wp syscall_valid set_thread_state_ct_st\n | simp add: split_def | wpc\n | wp_once hoare_drop_imps)+\n apply (auto simp: ct_in_state_def elim: st_tcb_ex_cap)\n done\n\n\ncrunch valid_pdpt[wp]: handle_event, activate_thread,switch_to_thread,\n switch_to_idle_thread \"valid_pdpt_objs\"\n (simp: crunch_simps wp: crunch_wps alternative_valid select_wp OR_choice_weak_wp select_ext_weak_wp\n ignore: without_preemption getActiveIRQ resetTimer ackInterrupt\n getFAR getDFSR getIFSR OR_choice set_scheduler_action\n clearExMonitor)\n\nlemma schedule_valid_pdpt[wp]: \"\\valid_pdpt_objs\\ schedule :: (unit,unit) s_monad \\\\_. valid_pdpt_objs\\\"\n apply (simp add: schedule_def allActiveTCBs_def)\n apply (wp alternative_wp select_wp)\n apply simp\n done\n\nlemma call_kernel_valid_pdpt[wp]:\n \"\\invs and (\\s. e \\ Interrupt \\ ct_running s) and valid_pdpt_objs\\\n (call_kernel e) :: (unit,unit) s_monad\n \\\\_. valid_pdpt_objs\\\"\n apply (cases e, simp_all add: call_kernel_def)\n apply (rule hoare_pre)\n apply (wp | simp | wpc\n | rule conjI | clarsimp simp: ct_in_state_def\n | erule pred_tcb_weakenE\n | wp_once hoare_drop_imps)+\n done\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/ARM/ArchVSpaceEntries_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056295505783, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.288610136694303}} {"text": "section \"Implementation Language with Loops\"\ntheory impl_language_loops\n imports Main \n \"HOL-Library.Monad_Syntax\"\n repliss_sem\n ZFC_utils\n \"fuzzyrule.fuzzy_goal_cases\"\nbegin\n\ntext \"We need to hide some ZFC constants so that the normal ones are still visible:\"\n\nhide_const (open) \"ZFC_in_HOL.set\"\n\n\n\ntext \"So far, we have assumed that procedure implementations are given by arbitrary state machines.\nHere we define an implementation language using a shallow embedding with the monad syntax package.\n\"\n\n\ntext_raw \\\\DefineSnippet{io_defs_types}{\\\ntype_synonym iref = nat\ntype_synonym 'v store = \"iref \\ 'v\"\ntext_raw \\}%EndSnippet\\\n\ndatatype 'a ref = Ref (iref:iref)\ninstantiation ref :: (type) small begin\ninstance proof\n obtain V_of :: \"nat \\ V\" and A :: \"V\" where \"inj V_of\" and \"range V_of \\ elts A\"\n by (metis infinite_\\ infinite_countable_subset)\n \n\n have \"\\(V_of::'a ref \\ V) A. inj V_of \\ range V_of \\ elts A\"\n proof (intro conjI exI)\n show \"inj (V_of \\ iref)\"\n by (metis (mono_tags, lifting) \\inj V_of\\ comp_apply injD inj_on_def ref.expand)\n\n show \" range (V_of \\ iref) \\ elts A\"\n using \\range V_of \\ elts A\\ by auto\n qed\n\n show \"small (UNIV::'a ref set)\"\n by (meson \\\\V_of A. inj V_of \\ range V_of \\ elts A\\ down small_image_iff)\n\nqed\nend\n\ntext \\The typeclass natConvert is the dual to the typeclass countable. \nA natConvert type is at least as big as the natural numbers, so any natural number can be converted \nto the type using fromNat.\n\\\nclass natConvert =\n fixes fromNat :: \"nat \\ 'a\"\n assumes fromNat_inj: \"inj fromNat\"\n\ndefinition \"toNat \\ the_inv fromNat\"\n\nlemma \"toNat (fromNat x) = x\"\n by (simp add: fromNat_inj the_inv_f_f toNat_def)\n\ninstantiation ref :: (type) natConvert begin\ndefinition [simp]: \"fromNat_ref = Ref\"\ninstance \n apply standard\n using injI by fastforce\nend\n\n\ndatatype ('c,'b) loopResult = Continue 'c | Break 'b\n\ntext_raw \\\\DefineSnippet{io_defs_datatype}{\\\ndatatype ('a,'op, 'any) io =\n WaitLocalStep \"'any store \\ bool \\ 'any store \\ ('a,'op, 'any) io\"\n | WaitBeginAtomic \"('a,'op, 'any) io\"\n | WaitEndAtomic \"('a,'op, 'any) io\"\n | WaitNewId \"'any \\ bool\" \"'any \\ ('a,'op, 'any) io\"\n | WaitDbOperation 'op \"'any \\ ('a,'op, 'any) io\"\n | WaitReturn \"'a\" \n | Loop 'any \"V\" \"'any \\ ('a,'op, 'any) io\" \ntext_raw \\}%EndSnippet\\\n\n\\ \\body is an @{typ \\'any \\ (('any,'any) loopResult, 'op, 'any) io\\} encoded a type V.\n Had to use dynamic typing here as Isabelle has no GADTs. \\\n\n\n\ntext \"Actually show that we can embedd io into ZFCs V type:\"\n\n\n\nfunction (domintros) io_to_V :: \"('a::embeddable,'op::embeddable, 'any::small) io \\ V\" where\n \"io_to_V (WaitLocalStep n) = to_V (0::nat, to_V (\\s. let (a,b,c) = n s in to_V (a, b, io_to_V c)))\"\n| \"io_to_V (WaitBeginAtomic n) = to_V (1::nat, io_to_V n)\"\n| \"io_to_V (WaitEndAtomic n) = to_V (2::nat, io_to_V n) \"\n| \"io_to_V (WaitNewId P n) = to_V (3::nat, to_V (P, (\\x. io_to_V (n x))))\"\n| \"io_to_V (WaitDbOperation op n) = to_V (4::nat, to_V (op, (\\x. io_to_V (n x))))\"\n| \"io_to_V (WaitReturn s) = to_V (5::nat, to_V s)\"\n| \"io_to_V (Loop i body n) = to_V (6::nat, to_V (i, body, (\\x. io_to_V (n x))))\"\n by (pat_completeness, auto)\ntermination\nproof auto\n show \"io_to_V_dom x\" for x\n apply (induct x, auto simp add: io_to_V.domintros)\n by (metis io_to_V.domintros(1) range_eqI)\nqed\n\n\nlemma fun_cong2: \"f = g \\ \\x. f x = g x\"\n by simp\n\n\n\nlemma io_to_V_inj: \"inj io_to_V\"\nproof\n fix x y :: \"('a::embeddable,'op::embeddable, 'any::small) io\"\n assume a0: \"x \\ UNIV\"\n and a1: \"y \\ UNIV\"\n and a2: \"io_to_V x = io_to_V y\"\n\n from `io_to_V x = io_to_V y`\n show \"x = y\"\n proof (induct x arbitrary: y)\n case (WaitLocalStep a y)\n show ?case\n proof (cases y)\n fix c\n assume \" y = WaitLocalStep c\"\n hence h: \"io_to_V (WaitLocalStep a) = io_to_V (WaitLocalStep c)\"\n using WaitLocalStep.prems by blast\n from h have eq1: \"fst (a x) = fst (c x)\" for x\n by (auto dest!: to_V_use_inj fun_cong[where x=x] split: prod.splits)\n from h have eq2: \"fst (snd (a x)) = fst (snd (c x))\" for x\n by (auto dest!: to_V_use_inj fun_cong[where x=x] split: prod.splits)\n\n from h have \"io_to_V (snd (snd (a x))) = io_to_V (snd (snd (c x)))\" for x\n by (auto dest!: to_V_use_inj fun_cong[where x=x] split: prod.splits)\n have eq3: \"snd (snd (a x)) = snd (snd (c x))\" for x\n\n proof (rule WaitLocalStep)\n show \"io_to_V (snd (snd (a x))) = io_to_V (snd (snd (c x)))\"\n using `io_to_V (snd (snd (a x))) = io_to_V (snd (snd (c x)))` .\n\n show \"snd (snd (a x)) \\ Basic_BNFs.snds (snd (a x))\"\n by (simp add: snds.simps)\n\n show \"snd (a x) \\ Basic_BNFs.snds (a x)\"\n by (simp add: snds.intros)\n\n show \" a x \\ range a\"\n by blast\n qed\n\n have \"a = c\"\n by (auto simp add: prod_eq_iff eq1 eq2 eq3)\n\n thus \" WaitLocalStep a = y\"\n using `y = WaitLocalStep c` by simp\n next\n qed (insert `io_to_V (WaitLocalStep a) = io_to_V y`, auto dest!: to_V_use_inj)\n next\n case (WaitBeginAtomic a)\n thus ?case by (cases y, auto dest!: to_V_use_inj)\n next\n case (WaitEndAtomic a)\n thus ?case by (cases y, auto dest!: to_V_use_inj)\n next\n case (WaitNewId a b)\n thus ?case \n by (cases y, auto dest!: to_V_use_inj, meson HOL.ext rangeI)\n next\n case (WaitDbOperation a b)\n thus ?case by (cases y, auto dest!: to_V_use_inj, meson HOL.ext rangeI)\n next\n case (WaitReturn r)\n thus ?case by (cases y, auto dest!: to_V_use_inj)\n next\n case (Loop i bdy cont)\n thus ?case proof (cases y, auto dest!: to_V_use_inj, rename_tac cont')\n fix cont'\n assume a0: \"y = Loop i bdy cont'\"\n and IH: \"\\x3aa y. \\x3aa \\ range cont; io_to_V x3aa = io_to_V y\\ \\ x3aa = y\"\n and a2: \"(\\x. io_to_V (cont x)) = (\\x. io_to_V (cont' x))\"\n and a3: \"io_to_V (Loop i bdy cont) = io_to_V y\"\n\n from a2\n have \"io_to_V (cont x) = io_to_V (cont' x)\" for x\n by meson\n hence \"(cont x) = (cont' x)\" for x\n by (simp add: IH rangeI)\n thus \"cont = cont' \"\n by blast\n qed\n qed\nqed\n\n\n\ninstance io :: (embeddable, embeddable, small) embeddable\n by (standard, force intro: io_to_V_inj)\n\ndefinition loopResult_to_V :: \"('a::embeddable, 'b::embeddable) loopResult \\ V\" where\n \"loopResult_to_V l = (case l of \n (Break x) \\ to_V (False, x, undefined::'a)\n | (Continue x) \\ to_V (True, undefined::'b, x))\"\n\n\nlemma loopResult_to_V_inj: \"inj loopResult_to_V\"\n by standard (use to_V_use_inj in \\auto simp add: loopResult_to_V_def split: loopResult.splits\\)\n\n\n\ninstance loopResult :: (embeddable, embeddable) embeddable\n by (standard, force intro: loopResult_to_V_inj)\n\n\ninstance loopResult :: (small, small) small\nproof (rule show_small_type_class, intro conjI exI)\n\n have \"\\(f::'a \\ V). inj f \\ small (range f)\"\n using small down to_V_property to_V_small by blast\n\n show \"inj loopResult_to_V\"\n by (simp add: loopResult_to_V_inj)\n\n have \"small (range (to_V :: (bool\\'b\\'a)\\V))\"\n using to_V_small by blast\n\n\n thus \"small (range (loopResult_to_V::('a,'b) loopResult\\V))\"\n proof (rule smaller_than_small)\n\n show \"range (loopResult_to_V::('a,'b) loopResult\\V) \\range (to_V :: (bool\\'b\\'a)\\V)\"\n by (auto simp add: loopResult_to_V_def split: loopResult.splits)\n qed\nqed\n\ndefinition loop_body_from_V :: \"V \\ 'any \\ (('any,'any) loopResult, 'op::embeddable, 'any::small) io\" where\n\"loop_body_from_V \\ from_V\"\n\ndefinition loop_body_to_V :: \"('any \\ (('any,'any) loopResult, 'op::embeddable, 'any::small) io) \\ V\" where\n\"loop_body_to_V \\ to_V\"\n\nlemma loop_body_from_V_rev[simp]: \"loop_body_from_V (loop_body_to_V x) = x\"\n by (simp add: loop_body_from_V_def loop_body_to_V_def)\n\n\ntext_raw \\\\DefineSnippet{io_defs_bind}{\\\nfunction (*<*) (domintros) (*>*) bind (*<*) :: \"('a, 'op, 'any) io \\ ('a \\ ('b, 'op,'any) io) \\ ('b, 'op,'any) io\" (*>*) (infixl \"\\io\" 54) where\n \"WaitLocalStep n \\io f = (WaitLocalStep (\\s. let (a,b,c) = n s \n in (a, b, bind c f)))\"\n| \"WaitBeginAtomic n \\io f = (WaitBeginAtomic (n \\io f))\"\n| \"WaitEndAtomic n \\io f = (WaitEndAtomic (n \\io f))\"\n| \"WaitNewId P n \\io f = (WaitNewId P (\\i. n i \\io f))\"\n| \"WaitDbOperation op n \\io f = (WaitDbOperation op (\\i. n i \\io f))\"\n| \"WaitReturn s \\io f = (f s)\"\n| \"Loop i body n \\io f = (Loop i body (\\x. n x \\io f))\"\ntext_raw \\}%EndSnippet\\\n by (pat_completeness, auto)\ntermination\n using [[show_sorts]]\nproof auto\n show \"bind_dom (i, f)\" for i :: \"('a, 'op, 'any) io\" and f :: \"'a \\ ('d, 'op, 'any) io\"\n apply (induct i, auto simp add: bind.domintros)\n by (metis bind.domintros(1) range_eqI)\nqed\n\n\n\n\n\ntext_raw \\\\DefineSnippet{toImpl}{\\\nfun toImpl :: \"(('val store \\ uniqueId set \\ (('val,'op::{small,valueType}, 'val::{small,valueType}) io)), 'op, 'val) procedureImpl\" where\n \"toImpl (store, knownUids, WaitLocalStep n) = (\n let (ok, store', n') = n store \n in LocalStep (ok \\ (finite (dom store) \\ finite (dom (store')))) \n (store', knownUids, n'))\"\n| \"toImpl (store, knownUids, WaitBeginAtomic n) = \n BeginAtomic (store, knownUids, n)\"\n| \"toImpl (store, knownUids, WaitEndAtomic n) = \n EndAtomic (store, knownUids, n)\"\n| \"toImpl (store, knownUids, WaitNewId P n) = \n NewId (\\i. if P i then Some (store, knownUids \\ uniqueIds i, n i) else None)\"\n| \"toImpl (store, knownUids, WaitDbOperation op n) = (\n if uniqueIds op \\ knownUids then \n DbOperation op (\\r. (store, knownUids \\ uniqueIds r, n r)) \n else \n LocalStep False (store, knownUids, WaitDbOperation op n))\"\n| \"toImpl (store, knownUids, WaitReturn v) = (\n if uniqueIds v \\ knownUids then \n Return v \n else \n LocalStep False (store, knownUids, WaitReturn v))\"\n| \"toImpl (store, knownUids, Loop i body n) = \n LocalStep True \n (store, knownUids, (loop_body_from_V body i) \\io (\\r. \n case r of Break x \\ n x \n| Continue x \\ Loop x body n))\"\ntext_raw \\}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{toImpl_simps}{\n @{thm [display] toImpl.simps}\n}%EndSnippet\\\n\nabbreviation toImpl' where\n \"toImpl' proc (x :: ('val,'op,'val) io) \\ ((Map.empty, uniqueIds proc, x) , toImpl)\"\n\n\nadhoc_overloading Monad_Syntax.bind bind\n\ndefinition pause :: \"(unit,'op,'any) io\" where\n\"pause \\ WaitLocalStep (\\s. (True, s, WaitReturn ()))\"\n\ndefinition beginAtomic :: \"(unit,'op,'any) io\" where\n\"beginAtomic \\ WaitBeginAtomic (WaitReturn ())\"\n\ndefinition endAtomic :: \"(unit,'op,'any) io\" where\n\"endAtomic \\ WaitEndAtomic (WaitReturn ())\"\n\n\ndefinition newId :: \"('any \\ bool) \\ ('any,'op,'any) io\" where\n\"newId P \\ WaitNewId P (\\i. WaitReturn i)\"\n\ndefinition call :: \"'op \\ ('any,'op,'any) io\" where\n\"call op \\ WaitDbOperation op (\\i. WaitReturn i)\"\n\ndefinition return :: \"'a \\ ('a,'op, 'any) io\" where\n\"return x \\ WaitReturn x\"\n\n\ndefinition atomic ::\"('a,'op, 'any) io \\ ('a,'op, 'any) io\" where\n\"atomic f \\ do {\n beginAtomic;\n r \\ f;\n endAtomic;\n return r\n}\"\n\n\ndefinition \n\"skip \\ return default\"\n\n\n\ntext \"Next, we define some operations to work with references: \nWe simply encode references using natural numbers.\"\n\ndefinition \"fromAny x \\ from_nat (toNat x)\"\ndefinition \"intoAny x \\ fromNat (to_nat x)\"\n\nlemma fromAny_intoAny[simp]: \"fromAny (intoAny x) = x\"\n by (simp add: fromAny_def fromNat_inj intoAny_def the_inv_f_f toNat_def)\n\ndefinition freshRefH :: \"nat \\ nat set \\ nat\" where\n\"freshRefH mi D \\ (if finite D then LEAST x. x \\ mi \\ (\\y\\D. x>y) else 0)\"\n\nabbreviation freshRef :: \"nat set \\ nat\" where\n\"freshRef \\ freshRefH 0\"\n\n\nlemma freshRef_empty[simp]: \"freshRefH x {} = x\"\n by (auto simp add: freshRefH_def Least_equality)\n\nlemma freshRef_insert[simp]: \n\"freshRefH mi (insert x S) = freshRefH (max mi (Suc x)) S\"\n by (auto simp add: freshRefH_def intro!: arg_cong[where f=Least])\n \n\ndefinition makeRef :: \"'a::countable \\ ('a ref, 'op, 'any::natConvert) io\" where\n\"makeRef v \\ WaitLocalStep (\\s. let r = freshRef (dom s) in (True, s(r \\ intoAny v), WaitReturn (Ref r)))\"\n\ndefinition s_read :: \"('any::natConvert) store \\ ('a::countable) ref \\ 'a\" where\n\"s_read s ref \\ \n case s (iref ref) of \n Some v \\ fromAny v \n | None \\ from_nat 0\"\n\ndefinition read :: \"'a ref \\ ('a::countable, 'op, 'any::natConvert) io\" where\n\"read ref \\ WaitLocalStep (\\s. case s (iref ref) of \n Some v \\ (True, s, WaitReturn (fromAny v)) \n | None \\ (False, s, WaitReturn (from_nat 0)))\"\n\ndefinition assign :: \"('a::countable) ref \\ 'a \\ (unit, 'op, 'any::natConvert) io\" (infix \":\\\" 60) where\n\"assign ref v \\ WaitLocalStep (\\s. case s (iref ref) of \n Some _ \\ (True, s((iref ref) \\ intoAny v), WaitReturn ()) \n | None \\ (False, s, WaitReturn ())) \"\n\ndefinition update :: \"('a::countable) ref \\ ('a \\ 'a) \\ (unit, 'op, 'any::natConvert) io\" where\n\"update ref upd \\ WaitLocalStep (\\s. case s (iref ref) of \n Some v \\ (True, s((iref ref) \\ intoAny (upd (fromAny v))), WaitReturn ()) \n | None \\ (False, s, WaitReturn ())) \"\n\n\n\n\nlemma toImpl_simps_newId[simp]:\n\"toImpl (store, u, newId P) = NewId (\\i. if P i then Some (store, u \\ uniqueIds i, return i) else None)\"\nby (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\nlemma toImpl_simps_pause[simp]:\n\"toImpl (store, u, pause) = LocalStep True (store, u, return ())\"\nby (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\nlemma toImpl_simps_beginAtomic[simp]:\n\"toImpl (store, u, beginAtomic) = BeginAtomic (store, u, return ())\"\nby (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\nlemma toImpl_simps_endAtomic[simp]:\n\"toImpl (store, u, endAtomic) = EndAtomic (store, u, return ())\"\nby (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\nlemma toImpl_simps_call[simp]:\n \"toImpl (store, u, call op ) = (if uniqueIds op \\ u then DbOperation op (\\r. (store, u \\ uniqueIds r, return r)) else LocalStep False (store, u, call op))\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: HOL.ext split: io.splits)\nlemma toImpl_simps_return[simp]:\n \"toImpl (store, u, return x) = (if uniqueIds x \\ u then Return x else LocalStep False (store, u, return x))\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\n\nschematic_goal \"toImpl (store, u, newId P \\ x) = ?x\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\n\nlemma toImpl_bind_simps_newid[simp]:\n\"toImpl (store, u, newId P \\ x) = NewId (\\i. if P i then Some (store, u \\ uniqueIds i, x i) else None)\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\nlemma toImpl_bind_simps_pause[simp]:\n\"toImpl (store, u, pause \\ x) = LocalStep True (store, u, x ())\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\nlemma toImpl_bind_simps_beginAtomic[simp]:\n\"toImpl (store, u, beginAtomic \\ x) = BeginAtomic (store, u, x ())\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\nlemma toImpl_bind_simps_endAtomic[simp]:\n\" toImpl (store, u, endAtomic \\ x) = EndAtomic (store, u, x ())\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\nlemma toImpl_bind_simps_call[simp]:\n\"toImpl (store, u, call op \\ x) = (if uniqueIds op \\ u then DbOperation op (\\r. (store, u \\ uniqueIds r, x r)) else LocalStep False (store, u, call op \\ x))\"\n by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\n\n\nparagraph \"Monad Laws\"\n\ntext \"We prove the typical monad laws: identity of return and associativity.\"\n\ndeclare Basic_BNFs.snds.simps[simp]\ndeclare Basic_BNFs.fsts.simps[simp]\n\n\nlemma return_left_ident[simp]: \n fixes x and f :: \"'a \\ ('b,'op, 'any) io\"\n shows \"return x \\ f = f x\"\n by (auto simp add: return_def)\n\nlemma right_ident[simp]: \n fixes m :: \"('a,'op, 'any) io\"\n shows \"(m \\ return) = m\"\nproof (induct m)\n case (WaitLocalStep x)\n then show ?case \n by (auto simp add: return_def intro!: HOL.ext split: prod.splits, metis range_eqI)\nnext\n case (WaitBeginAtomic m)\n then show ?case by (auto simp add: return_def)\nnext\n case (WaitEndAtomic m)\n then show ?case by (auto simp add: return_def)\nnext\n case (WaitNewId x1a x2a)\n then show ?case by (auto simp add: return_def)\nnext\n case (WaitDbOperation x1a x2a)\n then show ?case by (auto simp add: return_def)\nnext\n case (WaitReturn x)\n then show ?case by (auto simp add: return_def)\nnext\n case (Loop x1a m)\n then show ?case by (auto simp add: return_def)\nqed\n\n\nlemma bind_assoc[simp]: \n fixes x :: \"('a,'op, 'any) io\"\n and y :: \"'a \\ ('b,'op, 'any) io\"\n and z :: \"'b \\ ('c,'op, 'any) io\"\n shows \"((x \\ y) \\ z) = (x \\ (\\a. y a \\ z))\"\nproof (induct x)\n case (WaitLocalStep x)\n then show ?case \n by (auto simp add: return_def intro!: HOL.ext split: prod.splits, metis rangeI)\nnext\n case (WaitBeginAtomic x)\n then show ?case by auto\nnext\n case (WaitEndAtomic x)\n then show ?case by auto\nnext\n case (WaitNewId x1a x2a)\n then show ?case by auto\nnext\n case (WaitDbOperation x1a x2a)\n then show ?case by auto\nnext\n case (WaitReturn x)\n then show ?case by auto\nnext\n case (Loop x1a x)\n then show ?case by auto\nqed\n\n\n text \\\n \\DefineSnippet{io_bind_monad_rules}{\n @{thm [display] return_left_ident}\n @{thm [display] right_ident}\n @{thm [display] bind_assoc}\n }%EndSnippet\n \\\n\n\n\nlemma atomic_simp1[simp]: \n\"toImpl (s, u, atomic f) = BeginAtomic (s, u, f \\ (\\r. endAtomic \\ (\\_. return r)))\"\n by (auto simp add: atomic_def)\n\nlemma atomic_simp2[simp]: \n\"toImpl (s, u, atomic f \\ x) = BeginAtomic (s, u, f \\ (\\a. endAtomic \\ (\\b. x a)))\"\n by (auto simp add: atomic_def)\n\n\nsubsection \"Syntactic sugar for loops\"\n\ndefinition loop :: \"'a::countable \\ ('a \\ (('a,'b::countable) loopResult, 'op::small, 'any::{small,natConvert} ) io) \\ ('b, 'op, 'any) io\" where\n\"loop init body \\ Loop \n (intoAny init)\n (loop_body_to_V (\\acc. \n body (fromAny acc) \\io (\\res. return (\n case res of Continue x \\ (Continue (intoAny x)) \n | Break x \\ (Break (intoAny x)))))) \n (return \\ fromAny)\"\n\n\ndefinition while :: \"(bool, 'op::small, 'any::small) io \\ (unit, 'op, 'any) io\" where\n\"while body \\ Loop \n ??? \n (loop_body_to_V (\\_. body \\io (\\x. return ((if x then Break else Continue) ???)))) \n (return \\ (\\_. ()))\"\n\n\ndefinition \"forEach\" :: \"'e::countable list \\ ('e \\ ('a::countable, 'op::small, 'any::{small,natConvert}) io) \\ ('a list, 'op, 'any) io\" where\n\"forEach elements body \\ \n loop (elements,[]) (\\(elems, acc).\n case elems of\n [] \\ return (Break (rev acc))\n | (x#xs) \\ body x \\io (\\r. return (Continue (xs, r#acc))) \n )\"\n \n\n\n text \\\n \\DefineSnippet{io_language_constructs}{\n @{thm [display] beginAtomic_def}\n @{thm [display] endAtomic_def}\n @{thm [display] newId_def}\n @{thm [display] call_def}\n @{thm [display] return_def}\n @{thm [display] skip_def}\n @{thm [display] atomic_def}\n }%EndSnippet\n \\\n\n text \\\n \\DefineSnippet{io_language_constructs_refs}{\n @{thm [display] makeRef_def}\n @{thm [display] read_def}\n @{thm [display] assign_def}\n @{thm [display] update_def}\n }%EndSnippet\n \\\n\n text \\\n \\DefineSnippet{io_language_constructs_loops}{\n @{thm [display] loop_def}\n @{thm [display] while_def}\n @{thm [display] forEach_def}\n }%EndSnippet\n \\\n\n\nend\n\n\n", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/impl_language_loops.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2884090823712083}} {"text": "(* Title: HOL/Statespace/StateSpaceLocale.thy\n Author: Norbert Schirmer, TU Muenchen\n*)\n\nsection {* Setup for State Space Locales \\label{sec:StateSpaceLocale}*}\n\ntheory StateSpaceLocale imports StateFun \nkeywords \"statespace\" :: thy_decl\nbegin\n\nML_file \"state_space.ML\"\nML_file \"state_fun.ML\"\n\ntext {* For every type that is to be stored in a state space, an\ninstance of this locale is imported in order convert the abstract and\nconcrete values.*}\n\n\nlocale project_inject =\n fixes project :: \"'value \\ 'a\"\n and inject :: \"'a \\ 'value\"\n assumes project_inject_cancel [statefun_simp]: \"project (inject x) = x\"\nbegin\n\nlemma ex_project [statefun_simp]: \"\\v. project v = x\"\nproof\n show \"project (inject x) = x\"\n by (rule project_inject_cancel)\nqed\n\nlemma project_inject_comp_id [statefun_simp]: \"project \\ inject = id\"\n by (rule ext) (simp add: project_inject_cancel)\n\nlemma project_inject_comp_cancel[statefun_simp]: \"f \\ project \\ inject = f\"\n by (rule ext) (simp add: project_inject_cancel)\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Statespace/StateSpaceLocale.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.28840907444608993}} {"text": "theory AbstractMultiPaxosR2Correctness\nimports AbstractMultiPaxosR1 AbstractMultiPaxosR2 Simulations\nbegin\n\nlocale ampr2_proof = IOA + quorums quorums + ampr2_ioa quorums leader \n + r1:ampr1_ioa quorums leader\n for quorums :: \"'a set set\" and leader :: \"bal \\ 'a\" + \n fixes ampr2_ioa :: \"(('v, 'a, 'l) ampr2_state, 'v paxos_action) ioa\"\n and ampr1_ioa :: \"(('v, 'a, 'l) ampr1_state, 'v paxos_action) ioa\"\n defines \"ampr2_ioa \\ ioa\" and \"ampr1_ioa \\ r1.ioa\"\nbegin\n\ndefinition ref_map where \"ref_map s \\ \\\n ampr1_state.propCmd = propCmd s,\n ampr1_state.ballot = ballot s,\n ampr1_state.vote = (\\ i a . vote s $ a $ i),\n ampr1_state.suggestion = suggestion s,\n ampr1_state.onebs = onebs s,\n ampr1_state.leader = ampr2_state.leader s\\\"\n\nterm \"ampr1_ioa\"\nterm \"ampr2_ioa\"\n\nlemma \"is_ref_map ref_map ampr2_ioa ampr1_ioa\"\nproof (auto simp add:is_ref_map_def simp del:split_paired_Ex)\n fix s\n assume \"s \\ ioa.start ampr2_ioa\"\n thus \"ref_map s \\ ioa.start ampr1_ioa\" \n by (simp add:ref_map_def ampr1.simps ampr2_ioa_def ampr1_ioa_def ioa_def start_def)\nnext\n fix s t a\n assume a1:\"reachable ampr2_ioa s\" and a2:\"s \\a\\ampr2_ioa\\ t\"\n let ?e = \"(ref_map s, [(a, ref_map t)])\"\n have \"refines ?e s a t ampr1_ioa ref_map\"\n proof (auto simp add:refines_def ioa_simps trace_match_def trace_def schedule_def filter_act_def)\n show \"(ref_map s, a, ref_map t) \\ ioa.trans ampr1_ioa\" using a2\n apply (simp add:ampr2_ioa_def ioa_def is_trans_def trans_def)\n apply (simp add:ampr1_ioa_def ampr1.ioa_def ampr1.trans_def)\n apply (induct rule:trans_cases_2)\n apply (simp_all add:simps ampr1.simps ref_map_def)[2]\n (* join_ballot *)\n apply (induct a) apply auto[2]\n apply (auto simp add:ref_map_def ampr1.simps simps)[1]\n (* do_vote *)\n apply (induct a) apply auto[2] \n subgoal premises prems for a i v\n proof -\n have \"ampr1.do_vote a i v (ref_map s) (ref_map t)\" using prems\n by (auto simp add:ref_map_def simps Let_def ampr1.simps fun_eq_iff)\n thus ?thesis by auto\n qed\n (* suggest *)\n apply (induct a) apply auto[2] \n subgoal premises prems for a i b v\n proof -\n have \"ampr1.suggest a i b v (ref_map s) (ref_map t)\" using prems\n by (auto simp add:ref_map_def simps Let_def ampr1.simps fun_eq_iff)\n thus ?thesis by auto\n qed\n (* catch_up *)\n apply (induct a) apply auto[2] \n subgoal premises prems for l1 l2 i v\n proof -\n have \"ampr1.catch_up l1 l2 i v (ref_map s) (ref_map t)\" using prems\n by (auto simp add:ref_map_def simps Let_def ampr1.simps fun_eq_iff)\n thus ?thesis by auto\n qed\n (* acquire_leadership *)\n apply (induct a) apply auto[2] \n subgoal premises prems for aa q\n proof -\n have \"ampr1.acquire_leadership aa q (ref_map s) (ref_map t)\" using prems\n by (auto simp add:ref_map_def simps Let_def ampr1.simps fun_eq_iff)\n thus ?thesis by auto\n qed\n done \n qed\n thus \"\\ e . refines e s a t ampr1_ioa ref_map\" by blast\nqed\n\nend", "meta": {"author": "nano-o", "repo": "dist-systems-verif", "sha": "9826370dd5f1c6df6543e64481bfafc3e164674e", "save_path": "github-repos/isabelle/nano-o-dist-systems-verif", "path": "github-repos/isabelle/nano-o-dist-systems-verif/dist-systems-verif-9826370dd5f1c6df6543e64481bfafc3e164674e/Isabelle2/AbstractMultiPaxosR2Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.28839057184800815}} {"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Properties of Total Correctness Hoare Logic *}\n\ntheory HoareTotalProps imports SmallStep HoareTotalDef HoarePartialProps begin\n\nsubsection {* Soundness *}\n\nlemma hoaret_sound: \n assumes hoare: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ \\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Skip \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ \\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Basic f \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Spec r ,Normal s\\ \\ t\" \n \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n thus \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Spec r \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ r\" and exec_c2: \"\\\\\\c2,r\\ \\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: Fault_end)\n from valid_c1 ctxt exec_c1 P this\n have r: \"r \\ Normal ` R \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: exec_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s\\P\"\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c1,Normal s\\ \\ r\"\n have \"\\\\c2 \\ r\"\n proof (cases r)\n case (Normal r')\n with cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"r\\Normal ` R\"\n by auto\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n show \"\\\\c2 \\ r\"\n by auto\n qed auto \n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ \\ t\"\n by cases auto\n with P True \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ \\ t\"\n by cases auto\n with P False \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n thus \"\\\\Cond b c1 c2 \\ Normal s\"\n using cvalidt_termD [OF valid_c1 ctxt] cvalidt_termD [OF valid_c2 ctxt]\n by (cases \"s \\ b\") (auto intro: terminates.intros)\n qed\nnext\n case (While r \\ F P b c A)\n assume wf: \"wf r\"\n have valid_c: \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n using While.hyps by iprover\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume wprems: \"\\\\\\While b c,Normal s\\ \\ t\" \"s \\ P\" \"t \\ Fault ` F\"\n from wf\n have \"\\t. \\\\\\\\While b c,Normal s\\ \\ t; s \\ P; t \\ Fault ` F\\ \n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (induct)\n fix s t\n assume hyp: \n \"\\s' t. \\(s',s)\\r; \\\\\\While b c,Normal s'\\ \\ t; s' \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n assume exec: \"\\\\\\While b c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume b: \"s\\b\"\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\" \n assume exec_w: \"\\\\\\While b c,s'\\ \\ t\"\n from exec_w t_notin_F have \"s' \\ Fault ` F\"\n by (auto dest: Fault_end)\n from exec_c P b valid_c ctxt this\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P) \\ Abrupt ` A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n show ?thesis\n proof (cases s')\n case Normal \n with exec_w s' t_notin_F\n show ?thesis\n by - (rule hyp,auto)\n next\n case Abrupt\n with exec_w have \"t=s'\"\n by (auto dest: Abrupt_end)\n with Abrupt s' show ?thesis\n by blast\n next\n case Fault\n with exec_w have \"t=s'\"\n by (auto dest: Fault_end)\n with Fault s' show ?thesis\n by blast\n next\n case Stuck\n with exec_w have \"t=s'\"\n by (auto dest: Stuck_end)\n with Stuck s' show ?thesis\n by blast\n qed\n next\n assume \"s\\b\" \"t=Normal s\" with P show ?thesis by simp\n qed\n qed\n with wprems show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\" by blast\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"s \\ P\"\n with wf \n show \"\\\\While b c \\ Normal s\"\n proof (induct)\n fix s\n assume hyp: \"\\s'. \\(s',s)\\r; s' \\ P\\ \n \\ \\\\While b c \\ Normal s'\"\n assume P: \"s \\ P\"\n show \"\\\\While b c \\ Normal s\"\n proof (cases \"s \\ b\")\n case False with P show ?thesis\n by (blast intro: terminates.intros)\n next\n case True\n with valid_c P ctxt\n have \"\\\\c \\ Normal s\"\n by (simp add: cvalidt_def validt_def)\n moreover\n {\n fix s'\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases s')\n case (Normal s'')\n with exec_c P True valid_c ctxt\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P)\"\n by (fastforce simp add: cvalidt_def validt_def valid_def)\n then show ?thesis\n by (blast intro: hyp)\n qed auto\n }\n ultimately\n show ?thesis\n by (blast intro: terminates.intros)\n qed\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ (g \\ P)\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec g have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ P\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (CallRec P p Q A Specs r Specs_wf \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have wf: \"wf r\" by fact\n have Specs_wf: \n \"Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s, q),\\,p) \\ r},q,Q,A)) ` Specs)\" by fact\n from CallRec.hyps\n have valid_body: \n \"\\(P, p, Q, A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) the (\\ p) Q,A)\" by auto\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof -\n {\n fix \\p \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n from wf\n have \"\\\\ p P Q A. \\\\p = (\\,p); (P,p,Q,A) \\ Specs\\ \\ \n \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ (p))) Q,A\" \n proof (induct \\p rule: wf_induct [rule_format, consumes 1, case_names WF])\n case (WF \\p \\ p P Q A)\n have \\p: \"\\p = (\\, p)\" by fact\n have p: \"(P, p, Q, A) \\ Specs\" by fact\n {\n fix q P' Q' A'\n assume q: \"(P',q,Q',A') \\ Specs\"\n have \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' \\ {s. ((s,q), \\,p) \\ r}) (Call q) Q',A'\"\n proof (rule validtI)\n fix s t\n assume exec_q: \n \"\\\\\\Call q,Normal s\\ \\ t\"\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from Pre q \\p\n have valid_bdy: \n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') the (\\ q) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from exec_q show \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ q = Some bdy\"\n assume exec_bdy: \"\\\\\\bdy,Normal s\\ \\ t\"\n from valid_bdy [simplified bdy option.sel] t_notin_F exec_bdy Pre'\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (auto simp add: validt_def valid_def)\n with Pre q \n show ?thesis\n by auto\n next\n assume \"\\ q = None\"\n with q valid_body have False by auto\n thus ?thesis ..\n qed\n next\n fix s\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n from Pre q \\p\n have valid_bdy: \n \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') (the (\\ q)) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from valid_bdy ctxt Pre'\n have \"\\\\the (\\ q) \\ Normal s\"\n by (auto simp add: validt_def)\n with valid_body q \n show \"\\\\Call q\\ Normal s\"\n by (fastforce intro: terminates.Call)\n qed\n }\n hence \"\\(P, p, Q, A)\\Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by (auto simp add: cvalidt_def Specs_wf)\n with ctxt have \"\\(P, p, Q, A)\\\\ \\ Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by auto\n with p valid_body \n show \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (simp add: cvalidt_def) blast\n qed\n }\n note lem = this\n have valid_body': \n \"\\\\. \\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A \\ \n \\(P,p,Q,A)\\Specs. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (auto intro: lem)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_call: \"\\\\\\Call p,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n from exec_body bdy p P t_notin_F \n valid_body' [of \"s\", OF ctxt] \n ctxt\n have \"t \\ Normal ` Q \\ Abrupt ` A\"\n apply (simp only: cvalidt_def validt_def valid_def) \n apply (drule (1) bspec)\n apply auto\n done\n with p P \n show ?thesis\n by simp\n next\n assume \"\\ p = None\"\n with p valid_body have False by auto\n thus ?thesis by simp\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\"\n show \"\\\\Call p \\ Normal s\"\n proof -\n from ctxt P p valid_body' [of \"s\",OF ctxt]\n have \"\\\\(the (\\ p)) \\ Normal s\"\n by (auto simp add: cvalidt_def validt_def)\n with valid_body p show ?thesis\n by (fastforce intro: terminates.Call)\n qed\n qed\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A\" by simp\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ \\ t\" \n from cvalidt_postD [OF valid_c [rule_format, OF P] ctxt this P t_notin_F]\n show ?thesis .\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\DynCom c \\ Normal s\"\n proof -\n from cvalidt_termD [OF valid_c [rule_format, OF P] ctxt P]\n have \"\\\\c s \\ Normal s\" .\n thus ?thesis\n by (rule terminates.intros)\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ \\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n next\n fix s\n show \"\\\\Throw \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt s'\" \n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ \\ t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cvalidt_postD [OF valid_c2 ctxt] exec_c2 t_notin_F\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" \n assume notAbr: \"\\ isAbr t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P] t_notin_F\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s\" \n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt r\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"Abrupt r\\Normal ` Q \\ Abrupt ` R\"\n by auto\n hence \"Abrupt r\\Abrupt ` R\" by fast\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n have \"\\\\c\\<^sub>2 \\ Normal r\"\n by fast\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt: \n \"\\s \\ P. (\\P' Q' A'. (\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\" by blast\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from adapt [rule_format, OF P]\n obtain P' and Q' and A' where \n valid_P'_Q': \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n and weaken: \"s \\ P'\" \"Q' \\ Q\" \"A'\\ A\"\n by blast\n from exec valid_P'_Q' ctxt t_notin_F\n have P'_Q': \"Normal s \\ Normal ` P' \\ \n t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (unfold cvalidt_def validt_def valid_def) blast\n hence \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by blast\n with weaken \n show ?thesis\n by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from P adapt\n obtain P' and Q' and A' where \n \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n \"s \\ P'\"\n by blast\n with ctxt\n show ?thesis\n by (simp add: cvalidt_def validt_def)\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n assume \"(P, p, Q, A) \\ \\\"\n then show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: cvalidt_def )\nnext\n case ExFalso thus ?case by iprover\nqed\n\nlemma hoaret_sound':\n\"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (drule hoaret_sound)\n apply (simp add: cvalidt_def)\n done\n\ntheorem total_to_partial: \n assumes total: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" shows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from total have \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_sound)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cvalidt_def validt_def cvalid_def)\n thus ?thesis\n by (rule hoare_complete)\nqed\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s} c \n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validtI) \n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\" \n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\ \n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n apply (cases t) \n apply (auto simp add: final_notin_def)\n done\nnext\n fix s\n assume \"s \\ {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n thus \"\\\\c\\Normal s\"\n by blast\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s}\n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n shows \"\\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT) \n apply (insert valid)\n apply (auto simp add: validt_def valid_def intro!: final_notinI)\n done\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\nlemma MGT_lemma:\n assumes MGT_Calls: \n \"\\p \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Skip \\ Normal s} \n Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Basic f \\ Normal s} \n Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Basic [THEN conseqPre]) \n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Spec r \\ Normal s} \n Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2) \n have hyp_c1: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s}\n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n have hyp_c2: \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s}\n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n from hyp_c1 \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Seq c1 c2\\Normal s} c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\ \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n elim: terminates_Normal_elim_cases \n intro: exec.intros)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s} \n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoaret.Seq )\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c2 \\ Normal t}\n c2 \n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (rule exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (rule exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2) \n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s} \n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\b) \n c1 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondTrue \n elim: terminates_Normal_elim_cases)\n moreover\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s} \n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\-b) \n c2 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondFalse \n elim: terminates_Normal_elim_cases)\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s} \n (Cond b c1 c2)\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Cond) \nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\"\n let ?A = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n let ?r = \"{(t,s). \\\\(While b c)\\Normal s \\ s\\b \\ \n \\\\\\c,Normal s\\ \\ Normal t}\"\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(While b c)\\Normal s} \n (While b c)\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"\\ Z. ?P' Z\" \n and ?Q'=\"\\ Z. ?P' Z \\ - b\"])\n have wf_r: \"wf ?r\" by (rule wf_terminates_while)\n show \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A Z)\"\n proof (rule allI, rule hoaret.While [OF wf_r])\n fix Z\n from While \n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n show \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ ?P' Z \\ b) c \n ({t. (t, \\) \\ ?r} \\ ?P' Z),(?A Z)\"\n proof (rule allI, rule ConseqMGT [OF hyp_c])\n fix \\ s\n assume \"s\\ {\\} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\n \\ b\"\n then obtain \n s_eq_\\: \"s=\\\" and\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n while_term: \"\\\\(While b c)\\Normal s\" and\n s_in_b: \"s\\b\" \n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal t} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (t,\\) \\ ?r} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b \n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\ \n \\\\(While b c)\\Normal t}) \\ \n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b while_term show ?C1 \n by (blast elim: terminates_Normal_elim_cases)\n next\n {\n fix t \n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n with s_eq_\\ while_term s_in_b have \"(t,\\) \\ ?r\"\n by blast\n moreover\n from Z_s_unroll s_t s_in_b \n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover from while_term s_t s_in_b \n have \"\\\\(While b c)\\Normal t\"\n by (blast elim: terminates_Normal_elim_cases)\n moreover note noabort\n ultimately \n have \"(t,\\) \\ ?r \\ (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\" \n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\While b c \\ Normal s}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\ \n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A s \\ t\\?A Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\" \n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\ \n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n \n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\" \n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body: \n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call p)\n from noStuck_Call\n have \"\\s \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal s}.\n p \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume p_defined: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \n \\\\\\Call p ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\\\Call p\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp: \n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c s'\\Normal s} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s} \n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp]) \n (fastforce simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Guard f g c\\ Normal s} \n Guard f g c \n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s \\ g \\ s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s} )\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Throw \\ Normal s}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>1 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \\\\c\\<^sub>2 \\ Normal t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n elim: terminates_Normal_elim_cases\n simp add: final_notin_def)\n moreover\n have \n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>2 \\ Normal s} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\ \\\\c\\<^sub>2 \\ Normal s \\ \n \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n simp add: noFault_def')\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Catch )\nqed\n\n\n\n\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step \n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n qed\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p, Normal \\) \\\\<^sup>+ (c',Normal s) \\ Throw \\ redexes c')}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp_c1:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ \n c\\<^sub>1 \\ redexes c')}\n c\\<^sub>1 \n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have hyp_c2:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\)\\\\<^sup>+(c',Normal s) \\\n Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault`(-F)) \\ \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\"\n proof (rule ConseqMGT [OF hyp_c1],clarify,safe) \n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c\\<^sub>1,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume c': \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n from steps redexes_subset [OF this]\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c\\<^sub>1 \\ redexes c'\"\n by (auto iff: root_in_redexes)\n next\n fix t\n assume \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c' t\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume red: \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal t) \\ c\\<^sub>2 \\ redexes c'\"\n proof -\n note steps_c'\n also\n from exec_impl_steps_Normal_Abrupt [OF exec_c\\<^sub>1]\n have \"\\\\ (c\\<^sub>1, Normal Z) \\\\<^sup>* (Throw, Normal t)\".\n from steps_redexes_Catch [OF this red] \n obtain c'' where\n steps_c'': \"\\\\ (c', Normal Z) \\\\<^sup>* (c'', Normal t)\" and\n Catch: \"Catch Throw c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps_c''\n also \n have step_Catch: \"\\\\ (Catch Throw c\\<^sub>2,Normal t) \\ (c\\<^sub>2,Normal t)\"\n by (rule step.CatchThrow)\n from step_redexes [OF step_Catch Catch]\n obtain c''' where\n step_c''': \"\\\\ (c'', Normal t) \\ (c''', Normal t)\" and\n c2: \"c\\<^sub>2 \\ redexes c'''\"\n by blast\n note step_c'''\n finally show ?thesis\n using c2\n by blast\n qed\n qed\n moreover\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp_c2]) (fastforce intro: exec.intros)\n ultimately show ?case\n by (rule hoaret.Catch)\nqed\n\n\ntext {* To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n *}\n\nlemma Call_lemma:\n assumes A: \n \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes pdef: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\\\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma' [OF A])\nusing pdef\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] root_in_redexes)\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\nusing p_defined\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] \nroot_in_redexes)\ndone\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext {* Another proof of @{text MGT_Call}, maybe a little more readable *}\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n def Specs == \"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n def Specs_wf == \"(\\p \\. (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs)\"\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format, OF _ defined])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\n\ntheorem hoaret_complete: \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Call])\n\nlemma hoaret_complete': \n assumes cvalid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_complete)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\nsubsection {* And Now: Some Useful Rules *}\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\(Call p),Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr, \n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p) ,Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also \n from exec_body bdy\n have \"\\\\\\Call p ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturnSameFaults_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\n\nsubsubsection {* DynCall *}\n\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.Call)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \n \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturn_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturnSameFaults_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\n assumes valid_Q: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_R: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n moreover\n from valid_R ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cvalidt_postD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nnext \n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from valid_Q ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n assumes deriv_R: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoaret_complete')\napply (rule PostConjI_sound)\napply (rule hoaret_sound [OF deriv_Q])\napply (rule hoaret_sound [OF deriv_R])\ndone\n\n\nlemma Merge_PostConj_sound: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n by (auto intro: validt_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cvalidt_postD [OF validF [rule_format] ctxt exec P t_noFault]\n have \"t \\ Normal ` Q \\ Abrupt ` A\".\n moreover from this have \"t \\ Fault ` G\"\n by auto\n from cvalidt_postD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n ultimately show ?thesis by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from validF ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\n\n\nlemma Merge_PostConj: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoaret_complete')\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoaret_sound)\nusing validG apply (blast intro:hoaret_sound)\ndone\n\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\n assumes valid_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes valid_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def) \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case Abrupt\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case (Fault f)\n assume t: \"t=Fault f\"\n with exec inter_guards_exec_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f\"\n from cvalidt_postD [OF valid_c1 ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n from cvalidD [OF valid_c2 ctxt' this P] t t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1 \\ Normal s\"\n by (rule cvalidt_termD)\n with c show ?thesis\n by (rule inter_guards_terminates)\n qed\nqed\n\nlemma SplitGuards: \n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SplitGuards_sound [OF _ _ c])\napply (rule hoaret_sound [OF deriv_c1])\napply (rule hoare_sound [OF deriv_c2])\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n from ctxt have ctxt'': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt'' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt'' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ \\ Fault f\" \n by (auto intro: exec_to_exec_strip_guards_Fault)\n from cvalidD [OF valid_strip ctxt' this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt'' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt'' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule CombineStrip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n from ctxt have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cvalidD [OF validFlip ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\n\nlemma GuardsFlip: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule GuardsFlip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\mark_guards f c,Normal s\\ \\ t\" \n from exec_mark_guards_to_exec [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\mark_guards f c \\ Normal s\"\n by (rule terminates_to_terminates_mark_guards)\nqed\n\nlemma MarkGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\n\nlemma MarkGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with exec_to_exec_mark_guards_Fault exec\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from exec_to_exec_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n by auto\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\mark_guards f c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_mark_guards_to_terminates)\nqed\n\nlemma MarkGuardsD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\"\n from exec_merge_guards_to_exec [OF exec_merge] \n have exec: \"\\\\\\c,Normal s\\ \\ t\" .\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\merge_guards c \\ Normal s\"\n by (rule terminates_to_terminates_merge_guards)\nqed\n\nlemma MergeGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoaret_complete')\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_merge_guards [OF exec] \n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\".\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\merge_guards c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_merge_guards_to_terminates)\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have termi_c': \"\\\\c' \\ Normal s\".\n from cvalidt_postD [OF valid ctxt _ P]\n have noFault_c': \"\\\\\\c',Normal s\\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def)\n from termi_c' c_c' noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule terminates_fewer_guards)\nqed\n\nlemma SubsetGuards: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n hence exec_norm: \"\\\\\\normalize c,Normal s\\ \\ t\" \n by (rule exec_to_exec_normalize)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\normalize c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_normalize_to_terminates)\nqed\n\nlemma NormalizeD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume \"\\\\\\normalize c,Normal s\\ \\ t\" \n hence exec: \"\\\\\\c,Normal s\\ \\ t\" \n by (rule exec_normalize_to_exec)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\ c \\ Normal s\".\n thus \"\\\\normalize c \\ Normal s\"\n by (rule terminates_to_terminates_normalize)\nqed\n\nlemma NormalizeI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma validt_restrict_to_validt:\nassumes validt_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from validt_c\n have valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\" by (simp add: validt_def)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule valid_restrict_to_valid)\n moreover\n {\n fix s\n assume P: \"s \\ P\"\n have \"\\\\c\\Normal s\"\n proof -\n from P validt_c have \"\\|\\<^bsub>M\\<^esub>\\c\\Normal s\"\n by (auto simp add: validt_def)\n moreover\n from P valid_c\n have \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\\\{Stuck}\"\n by (auto simp add: valid_def final_notin_def)\n ultimately show ?thesis\n by (rule terminates_restrict_to_terminates)\n qed\n }\n ultimately show ?thesis\n by (auto simp add: validt_def)\nqed\n\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_restrict_to_validt)\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nsubsubsection {* Miscellaneous *}\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_augment_Faults [OF _ F])\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nlemma TerminationPartial_sound:\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n assumes partial_corr: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing \"termination\" partial_corr \nby (auto simp add: cvalidt_def validt_def cvalid_def)\n\nlemma TerminationPartial:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete')\n apply (rule TerminationPartial_sound [OF \"termination\"])\n apply (rule hoare_sound [OF partial_deriv])\n done\n\nlemma TerminationPartialStrip:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. strip F' \\\\strip_guards F' c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from \"termination\" have \"\\s \\ P. \\\\c\\Normal s\"\n by (auto intro: terminates_strip_guards_to_terminates \n terminates_strip_to_terminates)\n with partial_deriv\n show ?thesis\n by (rule TerminationPartial)\nqed\n\nlemma SplitTotalPartial:\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nlemma SplitTotalPartial':\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/HoareTotalProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514763, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2883808835179325}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * This file contains theorems for dealing with a \"simply\" lifted\n * heap, where each byte of memory can be accessed as one (and only)\n * type.\n *\n * This is a simpler model of Tuch's \"lift_t\" model, where nested\n * struct fields cannot be directly accessed as pointers.\n *)\n\ntheory TypHeapSimple\nimports\n \"CParser.TypHeapLib\"\nbegin\n\n(*\n * Each address in the heap can contain one of three things:\n *\n * - A type tag, which inidicates that this address is the first\n * byte of an object;\n *\n * - A footprint, which indicates that this address is a latter byte\n * of an object;\n *\n * - Nothing, which indicates that this address does not fall inside\n * an object.\n *)\ndatatype heap_typ_contents =\n HeapType typ_uinfo\n | HeapFootprint\n | HeapEmpty\n\n(*\n * Given a Tuch-style heap representation (where each memory location\n * contains a set of different types, representing nested field types)\n * calculate a single top-level type of the heap.\n *\n * We just want to commit to a single type for this heap location,\n * and nothing more.\n *)\ndefinition\n heap_type_tag :: \"heap_typ_desc \\ addr \\ heap_typ_contents\"\nwhere\n \"heap_type_tag d a \\\n (if fst (d a) = False \\ (\\x. (snd (d a)) x = None) \\ (\\x. (snd (d a)) x \\ None) then\n HeapEmpty\n else\n case (snd (d a)) (GREATEST x. snd (d a) x \\ None) of\n Some (_, False) \\ HeapFootprint\n | Some (x, True) \\ HeapType x\n | None \\ HeapEmpty)\"\n\n(*\n * Determine if the heap has a valid footprint for the given type at\n * the given address.\n *\n * A valid footprint means that the user has committed that the given\n * memory location will only be used for the given type.\n *\n * A \"simple\" footprint differs from the Tuch-style because we only\n * commit to a single type, and have no support for accessing nested\n * structures.\n *)\ndefinition\n valid_simple_footprint :: \"heap_typ_desc \\ addr \\ typ_uinfo \\ bool\"\nwhere\n \"valid_simple_footprint d x t \\\n heap_type_tag d x = HeapType t \\\n (\\y. y \\ {x + 1..+ (size_td t)- Suc 0} \\ heap_type_tag d y = HeapFootprint)\"\n\nlemma valid_simple_footprintI:\n \"\\ heap_type_tag d x = HeapType t; \\y. y \\ {x + 1..+(size_td t) - Suc 0} \\ heap_type_tag d y = HeapFootprint \\\n \\ valid_simple_footprint d x t\"\n by (clarsimp simp: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD:\n \"valid_simple_footprint d x t \\ heap_type_tag d x = HeapType t\"\n by (simp add: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD2:\n \"\\ valid_simple_footprint d x t; y \\ {x + 1..+(size_td t) - Suc 0} \\ \\ heap_type_tag d y = HeapFootprint\"\n by (simp add: valid_simple_footprint_def)\n\nlemma typ_slices_not_empty:\n \"typ_slices (x::('a::{mem_type} itself)) \\ []\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma last_typ_slice_t:\n \"(last (typ_slice_t t 0)) = (t, True)\"\n apply (case_tac t)\n apply clarsimp\n done\n\nlemma if_eqI:\n \"\\ a \\ x = z; \\ a \\ y = z \\ \\ (if a then x else y) = z\"\n by simp\n\nlemma heap_type_tag_ptr_retyp:\n \"snd (s (ptr_val t)) = Map.empty \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) = HeapType (typ_uinfo_t TYPE('a))\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, fastforce, fastforce)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply clarsimp\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) 0)\" in allE)\n apply (clarsimp simp: list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] last_typ_slice_t\n split: option.splits if_split_asm prod.splits)\n done\n\nlemma not_snd_last_typ_slice_t:\n \"k \\ 0 \\ \\ snd (last (typ_slice_t z k))\"\n by (case_tac z, clarsimp)\n\nlemma heap_type_tag_ptr_retyp_rest:\n \"\\ snd (s (ptr_val t + k)) = Map.empty; 0 < k; unat k < size_td (typ_uinfo_t TYPE('a)) \\ \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t + k) = HeapFootprint\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, simp, clarsimp,\n metis intvlI size_of_def word_unat.Rep_inverse)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply (clarsimp simp: size_of_def)\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) (unat k))\" in allE)\n apply (clarsimp simp: size_of_def list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] size_of_def\n split: option.splits if_split_asm prod.splits bool.splits)\n apply (metis surj_pair)\n apply (subst (asm) (2) surjective_pairing)\n apply (subst (asm) not_snd_last_typ_slice_t)\n apply clarsimp\n apply unat_arith\n apply simp\n done\n\nlemma typ_slices_addr_card [simp]:\n \"length (typ_slices (x::('a::{mem_type} itself))) < addr_card\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma htd_update_list_same':\n \"\\0 < unat k; unat k \\ addr_card - length v\\ \\ htd_update_list (p + k) v h p = h p\"\n apply (insert htd_update_list_same [where v=v and p=p and h=h and k=\"unat k\"])\n apply clarsimp\n done\n\nlemma unat_less_impl_less:\n \"unat a < unat b \\ a < b\"\n by unat_arith\n\nlemma valid_simple_footprint_ptr_retyp:\n \"\\ \\k < size_td (typ_uinfo_t TYPE('a)). snd (s (ptr_val t + of_nat k)) = Map.empty;\n 1 \\ size_td (typ_uinfo_t TYPE('a));\n size_td (typ_uinfo_t TYPE('a)) < addr_card \\\n \\ valid_simple_footprint (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) (typ_uinfo_t TYPE('a))\"\n apply (clarsimp simp: valid_simple_footprint_def)\n apply (rule conjI)\n apply (subst heap_type_tag_ptr_retyp)\n apply (erule allE [where x=\"0\"])\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (erule_tac x=\"k + 1\" in allE)\n apply (erule impE)\n apply (metis One_nat_def less_diff_conv)\n apply (subst add.assoc, subst heap_type_tag_ptr_retyp_rest)\n apply clarsimp\n apply (case_tac \"1 + of_nat k = (0 :: addr)\")\n apply (metis add.left_neutral intvlI intvl_Suc_nmem size_of_def)\n apply unat_arith\n apply clarsimp\n apply (metis lt_size_of_unat_simps size_of_def Suc_eq_plus1 One_nat_def less_diff_conv of_nat_Suc)\n apply simp\n done\n\n(* Determine if the given pointer is valid in the given heap. *)\ndefinition\n heap_ptr_valid :: \"heap_typ_desc \\ 'a::c_type ptr \\ bool\"\nwhere\n \"heap_ptr_valid d p \\\n valid_simple_footprint d (ptr_val (p::'a ptr)) (typ_uinfo_t TYPE('a))\n \\ c_guard p\"\n\n(*\n * Lift a heap from raw bytes and a heap description into\n * higher-level objects.\n *\n * This differs from Tuch's \"lift_t\" because we only support\n * simple lifting; that is, each byte in the heap may only\n * be accessed as a single type. Accessing struct fields by\n * their pointers is not supported.\n *)\ndefinition\n simple_lift :: \"heap_raw_state \\ ('a::c_type) ptr \\ 'a option\"\nwhere\n \"simple_lift s p = (\n if (heap_ptr_valid (hrs_htd s) p) then\n (Some (h_val (hrs_mem s) p))\n else\n None)\"\n\nlemma simple_lift_heap_ptr_valid:\n \"simple_lift s p = Some x \\ heap_ptr_valid (hrs_htd s) p\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma simple_lift_c_guard:\n \"simple_lift s p = Some x \\ c_guard p\"\n apply (clarsimp simp: simple_lift_def heap_ptr_valid_def split: if_split_asm)\n done\n\n(* Two valid footprints will either overlap completely or not at all. *)\nlemma valid_simple_footprint_neq:\n assumes valid_p: \"valid_simple_footprint d p s\"\n and valid_q: \"valid_simple_footprint d q t\"\n and neq: \"p \\ q\"\n shows \"p \\ {q..+ (size_td t)}\"\nproof -\n have heap_type_p: \"heap_type_tag d p = HeapType s\"\n apply (metis valid_p valid_simple_footprint_def)\n done\n\n have heap_type_q: \"heap_type_tag d q = HeapType t\"\n apply (metis valid_q valid_simple_footprint_def)\n done\n\n have heap_type_q_footprint:\n \"\\x. x \\ {(q + 1)..+(size_td t - Suc 0)} \\ heap_type_tag d x = HeapFootprint\"\n apply (insert valid_q)\n apply (simp add: valid_simple_footprint_def)\n done\n\n show ?thesis\n using heap_type_q_footprint heap_type_p neq\n intvl_neq_start heap_type_q\n by (metis heap_typ_contents.simps(2))\nqed\n\n(* Two valid footprints with different types will never overlap. *)\nlemma valid_simple_footprint_type_neq:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n p \\ {q..+ (size_td t)}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma valid_simple_footprint_neq_disjoint:\n \"\\ valid_simple_footprint d p s; valid_simple_footprint d q t; p \\ q \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (rule ccontr)\n apply (fastforce simp: valid_simple_footprint_neq dest!: intvl_inter)\n done\n\nlemma valid_simple_footprint_type_neq_disjoint:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq_disjoint, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma heap_ptr_valid_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n ptr_val p \\ ptr_val q \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (clarsimp simp only: size_of_tag [symmetric])\n apply (rule valid_simple_footprint_neq_disjoint [where d=\"d\"])\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply simp\n done\n\nlemma heap_ptr_valid_type_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (subgoal_tac \"ptr_val p \\ ptr_val q\")\n apply (rule heap_ptr_valid_neq_disjoint, auto)[1]\n apply (clarsimp simp: heap_ptr_valid_def valid_simple_footprint_def)\n done\n\n(* If we update one pointer in the heap, other valid pointers will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"ptr_val p \\ ptr_val q\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* If we update one type in the heap, other types will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other_typ:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_type_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* Updating the raw heap is equivalent to updating the lifted heap. *)\nlemma simple_lift_heap_update:\n \"\\ heap_ptr_valid (hrs_htd h) p \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h)\n = (simple_lift h)(p := Some (v::'a::mem_type))\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def hrs_mem_update h_val_heap_update)\n apply (fastforce simp: heap_ptr_valid_heap_update_other)\n done\n\n(* Updating the raw heap of one type doesn't affect the lifted heap of other types. *)\nlemma simple_lift_heap_update_other:\n \"\\ heap_ptr_valid (hrs_htd d) (p::'b::mem_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) d) = ((simple_lift d)::'a::c_type typ_heap)\"\n apply (rule ext)+\n apply (clarsimp simp: simple_lift_def h_val_heap_update hrs_mem_update)\n apply (auto intro: heap_ptr_valid_heap_update_other_typ)\n done\n\nlemma h_val_simple_lift:\n \"simple_lift h p = Some v \\ h_val (hrs_mem h) p = v\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma h_val_field_simple_lift:\n \"\\ simple_lift h (pa :: 'a ptr) = Some (v::'a::mem_type);\n \\t. field_ti TYPE('a) f = Some t;\n export_uinfo (the (field_ti TYPE('a) f)) = export_uinfo (typ_info_t TYPE('b :: mem_type)) \\ \\\n h_val (hrs_mem h) (Ptr &(pa\\f) :: 'b :: mem_type ptr) = from_bytes (access_ti\\<^sub>0 (the (field_ti TYPE('a) f)) v)\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: h_val_field_from_bytes)\n done\n\nlemma simple_lift_heap_update':\n \"simple_lift h p = Some v' \\\n simple_lift (hrs_mem_update (heap_update (p::('a::{mem_type}) ptr) v) h)\n = (simple_lift h)(p := Some v)\"\n apply (rule simple_lift_heap_update)\n apply (erule simple_lift_heap_ptr_valid)\n done\n\nlemma simple_lift_hrs_mem_update_None [simp]:\n \"(simple_lift (hrs_mem_update a hp) x = None) = (simple_lift hp x = None)\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma simple_lift_data_eq:\n \"\\ h_val (hrs_mem h) p = h_val (hrs_mem h') p';\n heap_ptr_valid (hrs_htd h) p = heap_ptr_valid (hrs_htd h') p' \\ \\\n simple_lift h p = simple_lift h' p'\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma h_val_heap_update_disjoint:\n \"\\ {ptr_val p ..+ size_of TYPE('a::c_type)}\n \\ {ptr_val q ..+ size_of TYPE('b::mem_type)} = {} \\ \\\n h_val (heap_update (q :: 'b ptr) r h) (p :: 'a ptr) = h_val h p\"\n apply (clarsimp simp: h_val_def)\n apply (clarsimp simp: heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply blast\n apply clarsimp\n done\n\nlemma update_ti_t_valid_size:\n \"size_of TYPE('b) = size_td t \\\n update_ti_t t (to_bytes_p (val::'b::mem_type)) obj = update_ti t (to_bytes_p val) obj\"\n apply (clarsimp simp: update_ti_t_def to_bytes_p_def)\n done\n\nlemma h_val_field_from_bytes':\n \"\\ field_ti TYPE('a::{mem_type}) f = Some t;\n export_uinfo t = export_uinfo (typ_info_t TYPE('b::{mem_type})) \\ \\\n h_val h (Ptr &(pa\\f) :: 'b ptr) = from_bytes (access_ti\\<^sub>0 t (h_val h pa))\"\n apply (insert h_val_field_from_bytes[where f=f and pa=pa and t=t and h=\"(h,x)\"\n and 'a='a and 'b='b for x])\n apply (clarsimp simp: hrs_mem_def)\n done\n\nlemma simple_lift_super_field_update_lookup:\n fixes dummy :: \"'b :: mem_type\"\n assumes \"field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (s,n)\"\n and \"typ_uinfo_t TYPE('a) = export_uinfo s\"\n and \"simple_lift h p = Some v'\"\n shows \"(super_field_update_t (Ptr (&(p\\f))) (v::'a::mem_type) ((simple_lift h)::'b ptr \\ 'b option)) =\n ((simple_lift h)(p \\ field_update (field_desc s) (to_bytes_p v) v'))\"\nproof -\n from assms have [simp]: \"unat (of_nat n :: addr) = n\"\n apply (subst unat_of_nat)\n apply (subst mod_less)\n apply (drule td_set_field_lookupD)+\n apply (drule td_set_offset_size)+\n apply (subst len_of_addr_card)\n apply (subst (asm) size_of_def [symmetric, where t=\"TYPE('b)\"])+\n apply (subgoal_tac \"size_of TYPE('b) < addr_card\")\n apply arith\n apply simp\n apply simp\n done\n from assms show ?thesis\n apply (clarsimp simp: super_field_update_t_def)\n apply (rule ext)\n apply (clarsimp simp: field_lvalue_def split: option.splits)\n apply (safe, simp_all)\n apply (frule_tac v=v and v'=v' in update_field_update)\n apply (clarsimp simp: field_of_t_def field_of_def typ_uinfo_t_def)\n apply (frule_tac m=0 in field_names_SomeD2)\n apply simp\n apply clarsimp\n apply (simp add: field_typ_def field_typ_untyped_def)\n apply (frule field_lookup_export_uinfo_Some)\n apply (frule_tac s=k in field_lookup_export_uinfo_Some)\n apply simp\n apply (drule (1) field_lookup_inject)\n apply (subst typ_uinfo_t_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\n apply simp\n apply (drule field_of_t_mem)+\n apply (case_tac h)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply fast\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n done\nqed\n\nlemma field_offset_addr_card:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x\n \\ field_offset TYPE('a) f < addr_card\"\n apply (clarsimp simp: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (frule td_set_field_lookupD)\n apply (drule td_set_offset_size)\n apply (insert max_size [where ?'a=\"'a\"])\n apply (clarsimp simp: size_of_def)\n done\n\nlemma unat_of_nat_field_offset:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x \\\n unat (of_nat (field_offset TYPE('a) f) :: addr) = field_offset TYPE('a) f\"\n apply (subst word_unat.Abs_inverse)\n apply (clarsimp simp: unats_def)\n apply (insert field_offset_addr_card [where f=f and ?'a=\"'a\"])[1]\n apply (fastforce simp: addr_card)\n apply simp\n done\n\nlemma field_of_t_field_lookup:\n assumes a: \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n)\"\n assumes b: \"export_uinfo s = typ_uinfo_t TYPE('b::mem_type)\"\n assumes n: \"n = field_offset TYPE('a) f\"\n shows \"field_of_t (Ptr &(ptr\\f) :: ('b ptr)) (ptr :: 'a ptr)\"\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_of_t_def field_of_def)\n apply (subst td_set_field_lookup)\n apply (rule wf_desc_typ_tag)\n apply (rule exI [where x=f])\n using a[simplified n] b\n apply (clarsimp simp: typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_lvalue_def unat_of_nat_field_offset)\n done\n\nlemma simple_lift_field_update':\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('a)) f 0 =\n Some (adjust_ti (typ_info_t TYPE('b)) xf xfu, n)\"\n and xf_xfu: \"fg_cons xf xfu\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu val z)\"\n (is \"?LHS = ?RHS\")\nproof (rule ext)\n fix p\n\n have eui: \"typ_uinfo_t TYPE('b) =\n export_uinfo (adjust_ti (typ_info_t TYPE('b)) xf xfu)\"\n using xf_xfu\n apply (subst export_tag_adjust_ti2 [OF _ wf_lf wf_desc])\n apply (simp add: fg_cons_def )\n apply (rule meta_eq_to_obj_eq [OF typ_uinfo_t_def])\n done\n\n have n_is_field_offset: \"n = field_offset TYPE('a) f\"\n apply (insert field_lookup_offset_eq [OF fl])\n apply (clarsimp)\n done\n\n have equal_case: \"?LHS ptr = ?RHS ptr\"\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: hrs_mem_update)\n apply (subst h_val_super_update_bs)\n apply (rule field_of_t_field_lookup [OF fl])\n apply (clarsimp simp: eui)\n apply (clarsimp simp: n_is_field_offset)\n apply clarsimp\n apply (unfold from_bytes_def)\n apply (subst fi_fu_consistentD [where f=f and s=\"adjust_ti (typ_info_t TYPE('b)) xf xfu\"])\n apply (clarsimp simp: fl)\n apply (clarsimp simp: n_is_field_offset field_lvalue_def)\n apply (metis unat_of_nat_field_offset fl)\n apply clarsimp\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: size_of_def)\n apply clarsimp\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply (subst update_ti_adjust_ti)\n apply (rule xf_xfu)\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: h_val_def)\n done\n\n show \"?LHS p = ?RHS p\"\n apply (case_tac \"p = ptr\")\n apply (erule ssubst)\n apply (rule equal_case)\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule h_val_heap_update_disjoint)\n apply (insert field_tag_sub [OF fl, where p=ptr])\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (frule (1) valid_simple_footprint_neq_disjoint, fastforce)\n apply clarsimp\n apply blast\n done\nqed\n\nlemma simple_lift_field_update:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f =\n Some (adjust_ti (typ_info_t TYPE('b)) xf (xfu o (\\x _. x)))\"\n and xf_xfu: \"fg_cons xf (xfu o (\\x _. x))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu (\\_. val) z)\"\n (is \"?LHS = ?RHS\")\n apply (insert fl [unfolded field_ti_def])\n apply (clarsimp split: option.splits)\n apply (subst simple_lift_field_update' [where xf=xf and xfu=\"xfu o (\\x _. x)\" and z=z])\n apply (clarsimp simp: o_def split: option.splits)\n apply (rule refl)\n apply (rule xf_xfu)\n apply (rule cl)\n apply clarsimp\n done\n\nlemma simple_heap_diff_types_impl_diff_ptrs:\n \"\\ heap_ptr_valid h (p::('a::c_type) ptr);\n heap_ptr_valid h (q::('b::c_type) ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n ptr_val p \\ ptr_val q\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma h_val_update_regions_disjoint:\n \"\\ { ptr_val p ..+ size_of TYPE('a) } \\ { ptr_val x ..+ size_of TYPE('b)} = {} \\ \\\n h_val (heap_update p (v::('a::mem_type)) h) x = h_val h (x::('b::c_type) ptr)\"\n apply (clarsimp simp: heap_update_def)\n apply (clarsimp simp: h_val_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply clarsimp\n done\n\nlemma simple_lift_field_update_t:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f = Some t\"\n and diff: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('c :: c_type)\"\n and eu: \"export_uinfo t = export_uinfo (typ_info_t TYPE('b))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"((simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) :: 'c ptr \\ 'c option) =\n simple_lift hp\"\n apply (rule ext)\n apply (case_tac \"simple_lift hp x\")\n apply clarsimp\n apply (case_tac \"ptr_val x = ptr_val ptr\")\n apply clarsimp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (1) simple_heap_diff_types_impl_diff_ptrs [OF _ _ diff])\n apply simp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule field_ti_field_lookupE [OF fl])\n apply (frule_tac p=ptr in field_tag_sub)\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (2) heap_ptr_valid_neq_disjoint)\n apply (clarsimp simp: export_size_of [unfolded typ_uinfo_t_def, OF eu])\n apply blast\n apply simp\n done\n\nlemma simple_lift_heap_update_other':\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h) = ((simple_lift h)::'a::c_type typ_heap)\"\n apply (rule simple_lift_heap_update_other)\n apply (erule simple_lift_heap_ptr_valid)\n apply simp\n done\n\n(* If you update bytes inside an object of one type, it won't affect\n * heaps of other types. *)\nlemma simple_lift_heap_update_bytes_in_other:\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('b) \\ typ_uinfo_t TYPE('c);\n { ptr_val q ..+ size_of TYPE('a)} \\ {ptr_val p ..+ size_of TYPE('b) } \\ \\\n simple_lift (hrs_mem_update (heap_update (q::'a::mem_type ptr) v) h) = ((simple_lift h)::'c::mem_type typ_heap)\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_type_neq_disjoint, simp)\n apply (clarsimp simp: hrs_mem_update)\n apply (rule h_val_heap_update_disjoint)\n apply blast\n done\n\nlemma typ_name_neq:\n \"typ_name (export_uinfo (typ_info_t TYPE('a::c_type)))\n \\ typ_name (export_uinfo (typ_info_t TYPE('b::c_type)))\n \\ typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n apply (metis typ_uinfo_t_def)\n done\n\nlemma of_nat_mod_div_decomp:\n \"of_nat k\n = of_nat (k div size_of TYPE('b)) * of_nat (size_of TYPE('b::mem_type)) +\n of_nat (k mod size_of TYPE('b))\"\n by (metis mod_div_decomp of_nat_add of_nat_mult)\n\nlemma c_guard_array_c_guard:\n \"\\ \\x. x < CARD('a) \\ c_guard (ptr_coerce p +\\<^sub>p int x :: 'b ptr) \\ \\ c_guard ( p :: ('b :: mem_type, 'a :: finite) array ptr)\"\n apply atomize\n apply (clarsimp simp: c_guard_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: ptr_aligned_def align_of_def align_td_array)\n apply (simp add: c_null_guard_def)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"k div size_of TYPE('b)\" in spec)\n apply (erule impE)\n apply (metis (full_types) less_nat_zero_code mult_is_0 neq0_conv td_gal_lt)\n apply clarsimp\n apply (drule_tac x=\"k mod size_of TYPE('b)\" in spec)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n apply (subst (asm) add.assoc)\n apply (subst (asm) of_nat_mod_div_decomp [symmetric])\n apply clarsimp\n done\n\nlemma heap_list_update_list':\n \"\\ n + x \\ length v; length v < addr_card; q = (p + of_nat x) \\ \\\n heap_list (heap_update_list p v h) n q = take n (drop x v)\"\n by (metis heap_list_update_list)\n\nlemma outside_intvl_range:\n \"p \\ {a ..+ b} \\ p < a \\ p \\ a + of_nat b\"\n apply (clarsimp simp: intvl_def not_le not_less)\n apply (drule_tac x=\"unat (p-a)\" in spec)\n apply clarsimp\n apply (metis add_diff_cancel2 le_less_linear le_unat_uoi\n mpl_lem not_add_less2 unat_mono word_less_minus_mono_left)\n done\n\nlemma first_in_intvl:\n \"b \\ 0 \\ a \\ {a ..+ b}\"\n by (force simp: intvl_def)\n\nlemma zero_not_in_intvl_no_overflow:\n \"0 \\ {a :: 'a::len word ..+ b} \\ unat a + b \\ 2 ^ len_of TYPE('a)\"\n apply (rule ccontr)\n apply (simp add: intvl_def not_le)\n apply (drule_tac x=\"2 ^ len_of TYPE('a) - unat a\" in spec)\n apply (clarsimp simp: not_less)\n apply (erule disjE)\n apply (metis (erased) diff_add_inverse less_imp_add_positive of_nat_2p of_nat_add\n unat_lt2p word_neq_0_conv word_unat.Rep_inverse)\n apply (metis le_add_diff_inverse le_antisym le_diff_conv le_refl\n less_imp_le_nat add.commute not_add_less1 unat_lt2p)\n done\n\nlemma intvl_split:\n \"\\ n \\ a \\ \\ { p :: ('a :: len) word ..+ n } = { p ..+ a } \\ { p + of_nat a ..+ (n - a)}\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=k in exI)\n apply clarsimp\n apply (rule classical)\n apply (drule_tac x=\"k - a\" in spec)\n apply (clarsimp simp: not_less)\n apply (metis diff_less_mono not_less)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=\"unat (x - p)\" in exI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (metis le_unat_uoi less_or_eq_imp_le not_less order_trans)\n apply clarsimp\n apply (metis le_def le_eq_less_or_eq le_unat_uoi less_diff_conv\n add.commute of_nat_add)\n done\n\nlemma heap_ptr_valid_range_not_NULL:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ 0 \\ {ptr_val p ..+ size_of TYPE('a)}\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (metis c_guard_def c_null_guard_def)\n done\n\nlemma heap_ptr_valid_last_byte_no_overflow:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ unat (ptr_val p) + size_of TYPE('a) \\ 2 ^ len_of TYPE(addr_bitsize)\"\n by (metis c_guard_def c_null_guard_def heap_ptr_valid_def\n zero_not_in_intvl_no_overflow)\n\nlemma heap_ptr_valid_intersect_array:\n \"\\ \\j < n. heap_ptr_valid htd (p +\\<^sub>p int j);\n heap_ptr_valid htd (q :: ('a :: c_type) ptr) \\\n \\ (\\m < n. q = (p +\\<^sub>p int m))\n \\ ({ptr_val p ..+ size_of TYPE ('a) * n} \\ {ptr_val q ..+ size_of TYPE ('a :: c_type)} = {})\"\n apply (induct n)\n apply clarsimp\n apply atomize\n apply simp\n apply (case_tac \"n = 0\")\n apply clarsimp\n apply (metis heap_ptr_valid_neq_disjoint ptr_val_inj)\n apply (erule disjE)\n apply (metis less_Suc_eq)\n apply (case_tac \"q = p +\\<^sub>p int n\")\n apply force\n apply (frule_tac x=n in spec)\n apply (erule impE, simp)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply (simp add: CTypesDefs.ptr_add_def)\n apply (rule disjI2)\n apply (cut_tac a=\" of_nat n * of_nat (size_of TYPE('a))\"\n and p=\"ptr_val p\" and n=\"n * size_of TYPE('a) + size_of TYPE('a)\" in intvl_split)\n apply clarsimp\n apply (clarsimp simp: field_simps Int_Un_distrib2)\n apply (metis IntI emptyE intvl_empty intvl_inter intvl_self neq0_conv)\n done\n\n(* Simplification rules for dealing with \"lift_simple\". *)\n\nlemmas simple_lift_simps =\n typ_name_neq\n simple_lift_c_guard\n h_val_simple_lift\n simple_lift_heap_update'\n simple_lift_heap_update_other'\n c_guard_field\n h_val_field_simple_lift\n simple_lift_field_update\n simple_lift_field_update_t\n c_guard_array_field\n nat_to_bin_string_simps\n\n(* Old name for the above simpset. *)\nlemmas typ_simple_heap_simps = simple_lift_simps\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/TypHeapSimple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2883777163093083}} {"text": "(* \n Title: Psi-calculi \n Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Cong_Simulation\n imports Weak_Simulation Tau_Chain\nbegin\n\ncontext env begin\n\ndefinition\n \"weakCongSimulation\" :: \"'b \\ ('a, 'b, 'c) psi \\\n ('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set \\ \n ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\_\\ _\" [80, 80, 80, 80] 80)\nwhere\n \"\\ \\ P \\\\Rel\\ Q \\ \\Q'. \\ \\ Q \\None @ \\ \\ Q' \\ (\\P'. \\ \\ P \\\\<^sub>\\ P' \\ (\\, P', Q') \\ Rel)\"\n\nabbreviation\n weakCongSimulationNilJudge (\"_ \\\\_\\ _\" [80, 80, 80] 80) where \"P \\\\Rel\\ Q \\ \\ \\ P \\\\Rel\\ Q\"\n\nlemma weakCongSimI[case_names c_tau]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assumes rTau: \"\\Q'. \\ \\ Q \\None @ \\ \\ Q' \\ \\P'. \\ \\ P \\\\<^sub>\\ P' \\ (\\, P', Q') \\ Rel\"\n\n shows \"\\ \\ P \\\\Rel\\ Q\"\nusing assms\nby(auto simp add: weakCongSimulation_def)\n\n\nlemma weakCongSimE:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\Rel\\ Q\"\n and \"\\ \\ Q \\None @ \\ \\ Q'\"\n\n obtains P' where \"\\ \\ P \\\\<^sub>\\ P'\" and \"(\\, P', Q') \\ Rel\"\nusing assms\nby(auto simp add: weakCongSimulation_def)\n\nlemma weakCongSimClosedAux:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes EqvtRel: \"eqvt Rel\"\n and PSimQ: \"\\ \\ P \\\\Rel\\ Q\"\n\n shows \"(p \\ \\) \\ (p \\ P) \\\\Rel\\ (p \\ Q)\"\nproof(induct rule: weakCongSimI)\n case(c_tau Q')\n from `p \\ \\ \\ p \\ Q \\None @ \\ \\ Q'` \n have \"(rev p \\ p \\ \\) \\ (rev p \\ p \\ Q) \\(rev p\\ None) @ (rev p \\ (\\ \\ Q'))\"\n by(blast dest: semantics.eqvt)\n hence \"\\ \\ Q \\None @ \\ \\ (rev p \\ Q')\" by(simp add: eqvts)\n with PSimQ obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', rev p \\ Q') \\ Rel\"\n by(blast dest: weakCongSimE)\n from PChain have \"(p \\ \\) \\ (p \\ P) \\\\<^sub>\\ (p \\ P')\" by(rule tau_step_chainEqvt)\n moreover from P'RelQ' EqvtRel have \"(p \\ (\\, P', rev p \\ Q')) \\ Rel\"\n by(simp only: eqvt_def)\n hence \"(p \\ \\, p \\ P', Q') \\ Rel\" by(simp add: eqvts)\n ultimately show ?case\n by blast\nqed\n\nlemma weakCongSimClosed:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes EqvtRel: \"eqvt Rel\"\n\n shows \"\\ \\ P \\\\Rel\\ Q \\ (p \\ \\) \\ (p \\ P) \\\\Rel\\ (p \\ Q)\"\n and \"P \\\\Rel\\ Q \\ (p \\ P) \\\\Rel\\ (p \\ Q)\"\nusing EqvtRel\nby(force dest: weakCongSimClosedAux simp add: perm_bottom)+\n\nlemma weakCongSimReflexive:\n fixes Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"{(\\, P, P) | \\ P. True} \\ Rel\"\n\n shows \"\\ \\ P \\\\Rel\\ P\"\nusing assms\nby(auto simp add: weakCongSimulation_def dest: rtrancl_into_rtrancl)\n\nlemma weakStepSimTauChain:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"\\ \\ Q \\\\<^sub>\\ Q'\"\n and \"\\ \\ P \\\\Rel\\ Q\"\n and Sim: \"\\\\ P Q. (\\, P, Q) \\ Rel \\ \\ \\ P \\ Q\"\n \n obtains P' where \"\\ \\ P \\\\<^sub>\\ P'\" and \"(\\, P', Q') \\ Rel\"\nproof -\n assume A: \"\\P'. \\\\ \\ P \\\\<^sub>\\ P'; (\\, P', Q') \\ Rel\\ \\ thesis\"\n from `\\ \\ Q \\\\<^sub>\\ Q'` `\\ \\ P \\\\Rel\\ Q` A show ?thesis\n proof(induct arbitrary: P thesis rule: tau_step_chain_induct)\n case(tau_base Q Q' P)\n with `\\ \\ P \\\\Rel\\ Q` `\\ \\ Q \\None @ \\ \\ Q'` obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(rule_tac weakCongSimE)\n thus ?case by(rule tau_base)\n next\n case(tau_step Q Q' Q'' P)\n from `\\ \\ P \\\\Rel\\ Q` obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and \"(\\, P', Q') \\ Rel\"\n by(rule tau_step)\n from `(\\, P', Q') \\ Rel` have \"\\ \\ P' \\ Q'\" by(rule Sim)\n then obtain P'' where P'Chain: \"\\ \\ P' \\\\<^sup>^\\<^sub>\\ P''\" and \"(\\, P'', Q'') \\ Rel\"\n using `\\ \\ Q' \\None @ \\ \\ Q''` by(blast dest: weakSimE)\n from PChain P'Chain have \"\\ \\ P \\\\<^sub>\\ P''\" by simp\n thus ?case using `(\\, P'', Q'') \\ Rel` by(rule tau_step)\n qed\nqed\n\nlemma weakCongSimTransitive:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and T :: \"('a, 'b, 'c) psi\"\n and Rel'' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes PRelQ: \"(\\, P, Q) \\ Rel\"\n and PSimQ: \"\\ \\ P \\\\Rel\\ Q\"\n and QSimR: \"\\ \\ Q \\\\Rel'\\ R\"\n and Set: \"{(\\, P, R) | \\ P R. \\Q. (\\, P, Q) \\ Rel \\ (\\, Q, R) \\ Rel'} \\ Rel''\"\n and Sim: \"\\\\ P Q. (\\, P, Q) \\ Rel \\ \\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\\\Rel''\\ R\"\nproof(induct rule: weakCongSimI)\n case(c_tau R')\n from QSimR `\\ \\ R \\None @ \\ \\ R'` obtain Q' where QChain: \"\\ \\ Q \\\\<^sub>\\ Q'\" and Q'RelR': \"(\\, Q', R') \\ Rel'\" \n by(blast dest: weakCongSimE)\n from QChain PSimQ Sim obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(rule weakStepSimTauChain)\n moreover from P'RelQ' Q'RelR' Set have \"(\\, P', R') \\ Rel''\" by blast\n ultimately show ?case by blast\nqed\n\nlemma weakCongSimStatEq:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes PSimQ: \"\\ \\ P \\\\Rel\\ Q\"\n and \"\\ \\ \\'\"\n and C1: \"\\\\ P Q \\'. \\(\\, P, Q) \\ Rel; \\ \\ \\'\\ \\ (\\', P, Q) \\ Rel'\"\n\n shows \"\\' \\ P \\\\Rel'\\ Q\"\nproof(induct rule: weakCongSimI)\n case(c_tau Q')\n from `\\' \\ Q \\None @ \\ \\ Q'` `\\ \\ \\'`\n have \"\\ \\ Q \\None @ \\ \\ Q'\" by(metis stat_eq_transition Assertion_stat_eq_sym)\n with PSimQ obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: weakCongSimE)\n \n from PChain `\\ \\ \\'` have \"\\' \\ P \\\\<^sub>\\ P'\" by(rule tau_step_chain_stat_eq)\n moreover from `(\\, P', Q') \\ Rel` `\\ \\ \\'` have \"(\\', P', Q') \\ Rel'\"\n by(rule C1)\n ultimately show ?case by blast\nqed\n\nlemma weakCongSimMonotonic: \n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and A :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and B :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"\\ \\ P \\\\A\\ Q\"\n and \"A \\ B\"\n\n shows \"\\ \\ P \\\\B\\ Q\"\nusing assms\nby(simp (no_asm) add: weakCongSimulation_def) (blast dest: weakCongSimE)+\n\nlemma strongSimWeakCongSim:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\[Rel] Q\"\n and \"Rel \\ Rel'\"\n \n shows \"\\ \\ P \\\\Rel'\\ Q\"\nusing assms\napply(auto simp add: simulation_def weakCongSimulation_def)\nby(erule_tac x=\\ in allE) (fastforce elim: tau_no_provenance')\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Cong_Simulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883592602049, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.28837770943708557}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoareTotal.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Derived Hoare Rules for Total Correctness\\\n\ntheory HoareTotal imports HoareTotalProps begin \n\nlemma conseq_no_aux:\n \"\\\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A';\n \\s. s \\ P \\ (s\\P' \\ (Q' \\ Q)\\ (A' \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where P'=\"\\Z. P'\" and Q'=\"\\Z. Q'\" and A'=\"\\Z. A'\"]) auto\n\ntext \\If for example a specification for a \"procedure pointer\" parameter \nis in the precondition we can extract it with this rule\\\nlemma conseq_exploit_pre:\n \"\\\\s \\ P. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P) c Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply clarify\n apply (rule_tac x=\"{s} \\ P\" in exI) \n apply (rule_tac x=\"Q\" in exI) \n apply (rule_tac x=\"A\" in exI) \n by simp\n\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q)\\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq') blast\n\n\nlemma Lem:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n P \\ {s. \\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)}\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (unfold lem_def) \n apply (erule conseq)\n apply blast\n done\n\n\nlemma LemAnno:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)}\"\nassumes lem: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ (\\t. t \\ Q' Z \\ t \\ Q)}\"\nassumes lem: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma TrivPost: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n \\\n \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n \\\n \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma DynComConseq:\n assumes \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A}\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n using assms\n apply -\n apply (rule hoaret.DynCom)\n apply clarsimp\n apply (rule hoaret.Conseq)\n apply clarsimp\n apply blast\n done\n\nlemma SpecAnno: \n assumes consequence: \"P \\ {s. (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))}\"\n assumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant: \"\\Z. c Z = c undefined\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n from spec bdy_constant\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c undefined) (Q' Z),(A' Z)\"\n apply - \n apply (rule allI)\n apply (erule_tac x=Z in allE)\n apply (erule_tac x=Z in allE)\n apply simp\n done\n with consequence show ?thesis\n apply (simp add: specAnno_def)\n apply (erule conseq)\n apply blast\n done\nqed\n\n\n\nlemma SpecAnno': \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)};\n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\nlemma SpecAnnoNoAbrupt: \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q)};\n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\ Q \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip Q,A\"\n by (rule hoaret.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\ {s. (f s) \\ Q} \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n by (rule hoaret.Basic [THEN conseqPre])\n\nlemma BasicCond: \n \"\\P \\ {s. (b s \\ f s\\Q) \\ (\\ b s \\ g s\\Q)}\\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Basic (\\s. if b s then f s else g s) Q,A\"\n apply (rule Basic)\n apply auto\n done\n\nlemma Spec: \"P \\ {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoaret.Spec [THEN conseqPre])\n\nlemma SpecIf: \n \"\\P \\ {s. (b s \\ f s \\ Q) \\ (\\ b s \\ g s \\ Q \\ h s \\ Q)}\\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n apply (rule Spec)\n apply (auto simp add: if_rel_def)\n done\n\nlemma Seq [trans, intro?]: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoaret.Seq)\n\nlemma SeqSwap: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n by (rule Seq)\n\nlemma BSeq:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (unfold bseq_def) (rule Seq)\n\nlemma Cond: \n assumes wp: \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoaret.Cond [THEN conseqPre])\n from deriv_c1 \n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ b) c\\<^sub>1 Q,A\"\n by (rule conseqPre) blast\nnext\n from deriv_c2 \n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ - b) c\\<^sub>2 Q,A\"\n by (rule conseqPre) blast\nqed (insert wp)\n\n\nlemma CondSwap: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P2 c2 Q,A; \n P \\ {s. (s\\b \\ s\\P1) \\ (s\\b \\ s\\P2)}\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond)\n\nlemma Cond': \n \"\\P \\ {s. (b \\ P1) \\ (- b \\ P2)};\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P2 c2 Q,A\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule CondSwap) blast+\n\nlemma CondInv: \n assumes wp: \"P \\ Q\" \n assumes inv: \"Q \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from wp inv\n have \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n by blast\n from Cond [OF this deriv_c1 deriv_c2]\n show ?thesis .\nqed\n\nlemma CondInv': \n assumes wp: \"P \\ I\" \n assumes inv: \"I \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes wp': \"I \\ Q\"\n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\" \n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from CondInv [OF wp inv deriv_c1 deriv_c2]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\" .\n from conseqPost [OF this wp' subset_refl]\n show ?thesis .\nqed\n\n\nlemma switchNil:\n \"P \\ Q \\ \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n by (simp add: Skip)\n \nlemma switchCons:\n \"\\P \\ {s. (v s \\ V \\ s \\ P\\<^sub>1) \\ (v s \\ V \\ s \\ P\\<^sub>2)}; \n \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\\n\\ \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n by (simp add: Cond)\n\n \nlemma Guard:\n \"\\P \\ g \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\napply (rule HoareTotalDef.Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n by (rule Guard)\n\nlemma Guarantee:\n \"\\P \\ {s. s \\ g \\ s \\ R}; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\ g \\ s \\ R}\"])\napply assumption\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ {s. s \\ g \\ s \\ R}; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guarantee)\n\n\nlemma GuardStrip:\n \"\\P \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\P \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\P \\ g \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g c Q,A\"\n by (unfold guaranteeStrip_def) (rule Guard)\n\nlemma GuaranteeAsGuardSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g c Q,A\"\n by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While: \n assumes P_I: \"P \\ I\" \n assumes deriv_body: \n \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n assumes I_Q: \"I \\ -b \\ Q\" \n assumes wf: \"wf V\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n from wf deriv_body P_I I_Q\n show ?thesis\n apply (unfold whileAnno_def)\n apply (erule conseqPrePost [OF HoareTotalDef.While]) \n apply auto\n done\nqed\n\n\n\nlemma WhileInvPost: \n assumes P_I: \"P \\ I\" \n assumes termi_body: \n \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ P),A\"\n assumes deriv_body: \n \"\\,\\\\\\<^bsub>/F\\<^esub> (I \\ b) c I,A\"\n assumes I_Q: \"I \\ -b \\ Q\" \n assumes wf: \"wf V\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n have \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n proof \n fix \\\n from hoare_sound [OF deriv_body] hoaret_sound [OF termi_body [rule_format, of \\]]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n then\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n by (rule hoaret_complete')\n qed\n\n from While [OF P_I this I_Q wf]\n show ?thesis .\nqed\n\n(* *)\nlemma \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) (Seq c (Guard f Q Skip)) Q,A\"\noops\n\ntext \\@{term \"J\"} will be instantiated by tactic with @{term \"gs' \\ I\"} for\n those guards that are not stripped.\\ \nlemma WhileAnnoG:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnno b J V (Seq c (guards gs Skip)))) Q,A \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n by (simp add: whileAnnoG_def whileAnno_def while_def)\n\ntext \\This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"}\\ \n\n\n\n\nlemma WhileAnnoFix':\nassumes consequence: \"P \\ {s. (\\ Z. s\\I Z \\ \n (\\t. t \\ I Z \\ -b \\ t \\ Q)) }\"\nassumes bdy: \"\\Z \\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I Z \\ b) (c Z) ({t. (t, \\) \\ V Z} \\ I Z),A\"\nassumes bdy_constant: \"\\Z. c Z = c undefined\"\nassumes wf: \"\\Z. wf (V Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoFix b I V c) Q,A\"\n apply (rule WhileAnnoFix [OF _ bdy bdy_constant wf])\n using consequence by blast\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnnoFix b J V (\\Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n using whileAnnoFix\n by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n assumes adapt: \"P \\ {s. s \\ P' s}\" \n assumes c: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (bind e c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\napply (rule allI)\napply (unfold bind_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule conseqPre)\napply (rule c [rule_format])\napply blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ init s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ R Z t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ A}\" in HoareTotalDef.Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule bdy [rule_format])\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma BlockSwap:\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\n using adapt bdy c\n by (rule Block)\n\nlemma BlockSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes bdy: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ R s t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return s t \\ R s t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ A}\" in HoareTotalDef.Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule conseq [OF bdy])\napply clarsimp\napply blast\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma Throw: \"P \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Throw Q,A\"\n by (rule hoaret.Throw [THEN conseqPre])\n\nlemmas Catch = hoaret.Catch\nlemma CatchSwap: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoaret.Catch)\n\nlemma raise: \"P \\ {s. f s \\ A} \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P raise f Q,A\"\n apply (simp add: raise_def)\n apply (rule Seq)\n apply (rule Basic)\n apply (assumption)\n apply (rule Throw)\n apply (rule subset_refl)\n done\n\nlemma condCatch: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A));\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n apply (simp add: condCatch_def)\n apply (rule Catch)\n apply assumption\n apply (rule CondSwap)\n apply (assumption)\n apply (rule hoaret.Throw)\n apply blast\n done\n\nlemma condCatchSwap: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A))\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n by (rule condCatch)\n\n\nlemma ProcSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def) \nby (rule BlockSpec)\n\nlemma ProcSpec':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\n\nlemma ProcSpecNoAbrupt:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall: \n\"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return (\\s t. c (result t))) Q,A\n\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n by (simp add: fcall_def)\n\nlemma ProcRec:\n assumes deriv_bodies: \n \"\\p\\Procs. \n \\\\ Z. \\,\\\\(\\q\\Procs. \\Z. \n {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n by (intro strip)\n (rule HoareTotalDef.CallRec' \n [OF _ Procs_defined wf deriv_bodies],\n simp_all)\n\nlemma ProcRec':\n assumes ctxt: \n \"\\'=(\\\\ p. \\\\(\\q\\Procs. \n \\Z. {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)}))\"\n assumes deriv_bodies: \n \"\\p\\Procs. \n \\\\ Z. \\,\\' \\ p\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using ctxt deriv_bodies\n apply simp\n apply (erule ProcRec [OF _ wf Procs_defined])\n done\n \n\nlemma ProcRecList:\n assumes deriv_bodies: \n \"\\p\\set Procs. \n \\\\ Z. \\,\\\\(\\q\\set Procs. \\Z. \n {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes dist: \"distinct Procs\"\n assumes Procs_defined: \"set Procs \\ dom \\\"\n shows \"\\p\\set Procs. \\Z. \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using deriv_bodies wf Procs_defined\n by (rule ProcRec)\n\nlemma ProcRecSpecs:\n \"\\\\\\. \\(P,p,Q,A) \\ Specs. \n \\,\\\\ ((\\(P,q,Q,A). (P \\ {s. ((s,q),(\\,p)) \\ r},q,Q,A)) ` Specs)\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A;\n wf r;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\\\\n \\ \\(P,p,Q,A) \\ Specs. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (rule ballI)\napply (case_tac x)\napply (rename_tac x P p Q A)\napply simp\napply (rule hoaret.CallRec)\napply auto\ndone\n\nlemma ProcRec1:\n assumes deriv_body: \n \"\\\\ Z. \\,\\\\(\\Z. {(P Z \\ {s. ((s,p), \\,p) \\ r},p,Q Z,A Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes wf: \"wf r\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n from deriv_body wf p_defined\n have \"\\p\\{p}. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n apply - \n apply (rule ProcRec [where A=\"\\p. A\" and P=\"\\p. P\" and Q=\"\\p. Q\"])\n apply simp_all\n done\n thus ?thesis\n by simp\nqed\n\nlemma ProcNoRec1:\n assumes deriv_body: \n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n have \"\\\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: conseqPre deriv_body [rule_format])\n with p_defined have \"\\\\ Z. \\,\\\\(\\Z. {(P Z \\ {s. ((s,p), \\,p) \\ {}},\n p,Q Z,A Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: hoaret_augment_context)\n from this \n show ?thesis \n by (rule ProcRec1) (auto simp add: p_defined) \nqed\n\nlemma ProcBody:\n assumes WP: \"P \\ P'\"\n assumes deriv_body: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' body Q,A\" \n assumes body: \"\\ p = Some body\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\Z. P'\" and Q=\"\\Z. Q\" and A=\"\\Z. A\"]) \napply (insert body)\napply simp\napply (rule hoaret_augment_context [OF deriv_body])\napply blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\ p = Some body\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\=\\, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoareTotalProps.ProcModifyReturn\nlemmas ProcModifyReturnSameFaults = HoareTotalProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma ProcModifyReturnNoAbrSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc: \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P}\"\n and Q'=\"\\Z. Q\" and A'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply (rule CatchSwap)\napply (rule SeqSwap)\napply (rule Throw) \napply (rule subset_refl)\napply (rule Basic)\napply (rule subset_refl)\napply (rule_tac R=\"{i. i \\ P' Z Z'}\" in Seq)\napply (rule Basic) \napply clarsimp\napply simp\napply (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply clarsimp\napply simp\napply clarsimp\napply (rule_tac P'=\"\\Z''. {t. t=Z'' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z''. Q\" and A'=\"\\Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc': \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t \\ Q' s Z. return s t \\ R s t) \\\n (\\t \\ A' s Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n from adapt have \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n by blast\n from this c p show ?thesis\n by (rule DynProc)\nqed\n\nlemma DynProcStaticSpec: \nassumes adapt: \"P \\ {s. s \\ S \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\s\\S. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from adapt have P_S: \"P \\ S\"\n by blast\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ S) (dynCall init p return c) Q,A\"\n apply (rule DynProc [where P'=\"\\s Z. P' Z\" and Q'=\"\\s Z. Q' Z\" \n and A'=\"\\s Z. A' Z\", OF _ c])\n apply clarsimp\n apply (frule in_mono [rule_format, OF adapt])\n apply clarsimp\n using spec\n apply clarsimp\n done\n thus ?thesis\n by (rule conseqPre) (insert P_S,blast)\nqed\n\n\n\nlemma DynProcProcPar: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n using spec\n apply simp\n done\n\n\nlemma DynProcProcParNoAbrupt: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof - \n have \"P \\ {s. p s = q \\ (\\ Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ {} \\ return s t \\ A))}\"\n (is \"P \\ ?P'\")\n proof \n fix s\n assume P: \"s\\P\"\n with adapt obtain Z where\n Pre: \"p s = q \\ init s \\ P' Z\" and\n adapt_Norm: \"\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\\" \n by blast\n from adapt_Norm \n have \"\\t. t \\ Q' Z \\ return s t \\ R s t\"\n by auto\n then\n show \"s\\?P'\"\n using Pre by blast\n qed\n note P = this\n show ?thesis\n apply -\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n apply (insert spec)\n apply auto\n done\nqed\n\nlemma DynProcModifyReturnNoAbr: \n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then \n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturn)\nqed\n\nlemma ProcDynModifyReturnNoAbrSameFaults: \n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturnSameFaults)\nqed\n\nlemma ProcProcParModifyReturn: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturn) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\n\nlemma ProcProcParModifyReturnSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call q (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma ProcProcParModifyReturnNoAbr: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnNoAbrSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma MergeGuards_iff: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip': \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n from deriv_strip_triv have deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n by (auto intro: hoare_augment_context)\n from deriv_strip [simplified c'']\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n by (rule HoarePartialProps.MarkGuardsD)\n with deriv \n have \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n by (rule CombineStrip)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n by (rule MarkGuardsI)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n by (rule MergeGuardsI)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n by (simp add: c)\n thus ?thesis\n by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'': \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c]) \n apply (insert c'')\n apply (subgoal_tac \"- {True} = {False}\")\n apply auto\n done\n\nlemma AsmUN:\n \"(\\Z. {(P Z, p, Q Z,A Z)}) \\ \\ \n \\ \n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n by (blast intro: hoaret.Asm)\n\n\nlemma hoaret_to_hoarep':\n \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z) \\ \\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: total_to_partial)\n\nlemma augment_context': \n \"\\\\ \\ \\'; \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \n \\ \\Z. \\,\\'\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoaret_augment_context)\n\n\nlemma augment_emptyFaults:\n \"\\\\Z. \\,{}\\\\<^sub>t\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI)\n\nlemma PostConjI' :\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\ \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]: \n assumes conj: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\" \n assumes E: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\ \\ S\"\n shows \"S\"\nproof -\n from conj have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n moreover\n from conj have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n ultimately show \"S\" \n by (rule E)\nqed\n\nsubsubsection \\Rules for Single-Step Proof \\label{sec:hoare-isar}\\\n\ntext \\\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar. \n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates. Reversed order is supported as well.\n\\\n\n\nlemma annotateI [trans]:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P anno Q,A; c = anno\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n by (simp)\n\nlemma annotate_normI:\n assumes deriv_anno: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>P anno Q,A\" \n assumes norm_eq: \"normalize c = normalize anno\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n from HoareTotalProps.NormalizeI [OF deriv_anno] norm_eq\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n by simp\n from NormalizeD [OF this]\n show ?thesis .\nqed\n\n\nlemma annotateWhile:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\ P \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A\"\n by (rule conseqPre)\n \nlemma [trans]: \"Q \\ Q' \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A\"\n by (rule conseqPost) blast+\n\nlemma [trans]:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ (\\s. P' s \\ P s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"(\\s. P' s \\ P s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q s},A \\ (\\s. Q s \\ Q' s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [trans]:\n \"(\\s. Q s \\ Q' s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q s},A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [intro?]: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond) auto\n \nlemma CondConj [trans, intro?]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s \\ b s} c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s \\ \\ b s} c2 Q,A\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n by (rule Cond) auto\nend\n\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoareTotal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.28837770256486284}} {"text": "theory E3_sound\nimports E3 E3_spec \nbegin\n\n(* TODO: show by induction on m that all derivable items are included in Earley at some stage *) \n\ndefinition loop2_inv :: \"'string => 'string ct_params => ty_impl_loop2 => bool\" where\n \"loop2_inv s ps s0 ==\n let nt0 = ps|>ct_nt0 in\n let nt_items_for_nt = ps|>ct_nt_items_for_nt in\n let f = % nt. % n. nt_items_for_nt nt (s,n,n) in\n let tm_items_for_tm = ps|>ct_p_of_tm in\n let g = % tm. %n. List.map (% x. (tm,n,x)) (tm_items_for_tm tm (s,n,n)) in\n let ps' = (| \n sp_nt0=ps|>ct_nt0,\n sp_nt_items_for_nt=f,\n sp_tm_items_for_tm=g |)\n in\n (! x. x : (s0|>todo_done5) --> x : derivable_items ps') &\n\n (! x. x : (set (s0|>todo5)) --> x : derivable_items ps') &\n\n (! (sym::sym) j x. x : ((s0|>blocked5) (j,sym)) --> \n (case x of (nt,aas,bs,i,j') => (bs ~= []) & (List.hd bs = sym) & (j'=j)) &\n (NTITM x) : derivable_items ps') &\n\n (! sym i x. x : ((s0|>complete5) (i,sym)) --> \n (? j. x=(sym,i,j)) &\n (? x'. x' : derivable_items ps' & (sym_item_of_complete_item x' = Some x))) &\n\n (* we dont care about tmoracle and oracle at this point - the correctness of these should follow straightforwardly *)\n\n True\" (* should be some relation from ty_impl loop2 to E3_spec derivable *)\n\nlemma t1: \"blocked5 (init_state s ps) i = {}\"\n apply(unfold init_state_def)\n apply(simp add: impl_mbk_def)\n apply(simp add: rev_apply_def)\n apply(case_tac \" ct_nt_items_for_nt ps (ct_nt0 ps) (s, 0, 0)\")\n apply(simp)\n apply(simp)\n done\n \nlemma t2: \"complete5 (init_state s ps) i = {}\"\n apply(unfold init_state_def)\n apply(simp add: impl_mck_def)\n apply(simp add: rev_apply_def)\n apply(case_tac \" ct_nt_items_for_nt ps (ct_nt0 ps) (s, 0, 0)\")\n apply(simp)\n apply(simp)\n done \n \nlemma t3: \"todo_done5 (init_state s ps) = NTITM ` set (ct_nt_items_for_nt ps (ct_nt0 ps) (s, 0, 0)) \" \n apply(unfold init_state_def)\n apply(simp add: impl_mck_def)\n apply(simp add: rev_apply_def)\n apply(case_tac \" ct_nt_items_for_nt ps (ct_nt0 ps) (s, 0, 0)\")\n apply(simp)\n apply(simp)\n done \n \ndefinition wf_ct_nt_items_for_nt :: \"(nt => 'string substring => nt_item list) \\ bool\"\nwhere \"wf_ct_nt_items_for_nt f \\ \\n ntitem s i j as. ntitem \\ set (f n (s, i, j)) \\\n(ntitem = (n, [], (NT n) # as, i, i))\" \n\ndefinition wf_item_ops :: \"'string ty_ops \\ bool\"\nwhere \"wf_item_ops tyops \\ \\sym i j nt as bs j'. sym_dot_i9 tyops (sym, i, j) = i \\ sym_dot_j9 tyops (sym, i, j) = j \\ sym6 tyops (sym, i, j) = sym \\ with_j9 tyops (nt,as,bs,i,j) j'= (nt,as,bs,i,j') \\ shift_a2_b2_c2 tyops (nt,as,bs,i,j) = (nt,(hd bs) # as, tl bs, i, j) \\ mk_item tyops = id\"\n\ndefinition impl_maps :: \"'string ty_impl_ctxt \\ bool\"\nwhere \"impl_maps ctxt \\ maps ctxt = impl_ctxt_map\"\n\nlemma cut_todo: \"sets ctxt = impl_ctxt_set \\ wf_item_ops (item_ops5 ctxt) \\ E3.cut ctxt (sym1, as, bs, i, j) (sym2, i2, j2) s0 = s1 \\ ( NTITM (sym1, (hd bs) # as, tl bs, i, j2) \\ todo_done5 s0 \\ todo5 s1 = (NTITM (sym1, (hd bs) # as, tl bs, i, j2)) # (todo5 s0)) \\ (NTITM (sym1, (hd bs) # as, tl bs, i, j2) \\ todo_done5 s0 \\ s0 = s1)\"\napply(unfold E3.cut_def add_todo_def impl_ctxt_set_def impl_std_def wf_item_ops_def)\napply(simp add: Let_def rev_apply_def wf_item_ops_def )\napply(case_tac \"NTITM (sym1, (hd bs) # as, tl bs, i, j2) \\ todo_done5 s0\")\napply(clarsimp)\napply(force)\ndone\n\nlemma t: \"sets ctxt = impl_ctxt_set \\ wf_item_ops (item_ops5 ctxt) \\ impl_maps ctxt \\ (sym1, as, bs, i, j) \\ blocked5 s0 (i', sym2) \\(Finite_Set.fold (\\bitm. \\x. E3.cut ctxt bitm (sym2, i', j') x) (s0) (blocked5 s0 (i', sym2))) = s1 \\ NTITM (sym1, (hd bs) # as, tl bs, i, j') \\ set (todo5 s1) \\ NTITM (sym1, (hd bs) # as, tl bs, i, j') \\ todo_done5 s0\"\napply(unfold E3.cut_def wf_item_ops_def impl_maps_def)\napply(simp add: Let_def rev_apply_def)\napply(unfold impl_ctxt_map_def add_todo_def impl_ctxt_set_def impl_std_def impl_mbk_def)\napply(clarsimp)\napply(unfold Finite_Set.fold_def)\napply(unfold fold_graph_def)\napply(clarsimp)\n\n\n\nlemma sound_init: \"wf_ct_nt_items_for_nt (ct_nt_items_for_nt ps) \\ loop2_inv s ps (init_state s ps)\"\n apply(unfold loop2_inv_def)\n apply(induct \"ct_nt_items_for_nt ps (ct_nt0 ps) (s, 0, 0)\")\n apply(simp add: rev_apply_def t1 t2 t3)\n apply(unfold init_state_def derivable_items_def)\n apply(simp add: rev_apply_def t1 t2 t3 derivable_items_def)\n apply(simp add: rev_apply_def t1 t2 t3 wf_ct_nt_items_for_nt_def init_state_def Let_def image_def derivable_items_def impl_mbk_def impl_mck_def )\n apply(clarify)\nby (metis (erased, hide_lams) not_Cons_self2)\n \nlemma sound: \"wf_ct_nt_items_for_nt (ct_nt_items_for_nt ps) \\ wf_item_ops (item_ops5 ctxt) \\ impl_maps ctxt \\ loop2_inv s ps s0 ==> loop2 (ctxt::'string ty_impl_ctxt) s0 = s1 ==> loop2_inv s ps s1\"\n apply(unfold loop2_def loop2_inv_def)\n apply(simp add: rev_apply_def Let_def)\n apply(unfold pop_todo_def)\n apply(induct \"todo5 s0\")\n apply(simp_all)\n apply(case_tac \"dest_item (item_ops5 ctxt) a\")\n apply(case_tac \"b2_nil (item_ops5 ctxt) prod\")\n apply(case_tac \"mk_sym_coord (item_ops5 ctxt) (nt2 (item_ops5 ctxt) prod, nt_dot_i9 (item_ops5 ctxt) prod, nt_dot_j9 (item_ops5 ctxt) prod)\")\n apply(unfold wf_item_ops_def)\n apply(simp add: rev_apply_def)\n apply(unfold impl_maps_def)\n apply(unfold impl_ctxt_map_def)\n apply(unfold impl_mbk_def)\n apply(simp)\n apply(unfold impl_mck_def)\n apply(simp)\n apply(unfold update_oracle_def)\n apply(clarify)\n\n \n lemma complete: \"True (* FIXME *)\"\n\nend\n", "meta": {"author": "tomjridge", "repo": "e3_isa", "sha": "ca857f6de5b4111fa129fdc2257584f5c7157067", "save_path": "github-repos/isabelle/tomjridge-e3_isa", "path": "github-repos/isabelle/tomjridge-e3_isa/e3_isa-ca857f6de5b4111fa129fdc2257584f5c7157067/src/E3_sound.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2883777025648628}} {"text": "theory Preliminary_Library\n imports Main \"HOL-Library.Word\" \"Word_Lib.Word_Lib_Sumo\" \"HOL-Library.Countable\"\nbegin\n\nsection \\Preliminary Theories\\\ntext \\In this subsection, we provide the type and value system used by the CHERI-C Memory Model.\n We also provide proofs for the conversion between large words (i.e. bits) and a list of bytes.\n For primitive bytes that are not $U8_\\tau$ or $S8_\\tau$, we need to be able to convert between\n their normal representation and list of bytes so that storing values work as intended. \n The high-level detail is given in the paper~\\cite{park_2022}.\\\nsubsection \\Types and Values\\\ntext \\We first formalise the capability type. We first define \\textit{memory capabilities} as a record,\n then we define \\textit{tagged capabilities} by extending the record. We state the class \n comp\\_countable for future work, but countable is sufficient for the block\\_id type.\n For the permissions, we present only those used by the memory model.\\\nclass comp_countable = countable + zero + ord\n\nrecord ('a :: comp_countable) mem_capability =\n block_id :: \"'a\" (* block_id *)\n offset :: int (* offset/address *)\n base :: nat (* metadata *)\n len :: nat\n perm_load :: bool\n perm_cap_load :: bool\n perm_store :: bool\n perm_cap_store :: bool\n perm_cap_store_local :: bool\n perm_global :: bool\n\nrecord ('a :: comp_countable) capability = \"'a mem_capability\" + \n tag :: bool (* tag *)\n\ntext \\cctype corresponds to $\\tau$ in the paper~\\cite{park_2022}, where $\\tau$ is the type system.\\\ndatatype cctype = \n Uint8\n | Sint8\n | Uint16\n | Sint16\n | Uint32\n | Sint32\n | Uint64\n | Sint64\n | Cap\n\ntext \\$'a\\ ccval$ corresponds to $\\mathcal{V}_\\mathcal{C}$ in the paper~\\cite{park_2022}. $'a$ in \n this instance must be countable. \\\ndatatype 'a ccval = \n Uint8_v \"8 word\"\n | Sint8_v \"8 sword\"\n | Uint16_v \"16 word\"\n | Sint16_v \"16 sword\"\n | Uint32_v \"32 word\"\n | Sint32_v \"32 sword\"\n | Uint64_v \"64 word\"\n | Sint64_v \"64 sword\"\n | Cap_v \"'a capability\"\n | Cap_v_frag \"'a capability\" \"nat\"\n | Undef\n\ntext \\memval\\_type infers the type of a value. \\\nfun memval_type :: \"'a ccval \\ cctype\"\n where\n \"memval_type v = (case v of \n Uint8_v _ \\ Uint8\n | Sint8_v _ \\ Sint8\n | Uint16_v _ \\ Uint16\n | Sint16_v _ \\ Sint16\n | Uint32_v _ \\ Uint32\n | Sint32_v _ \\ Sint32\n | Uint64_v _ \\ Uint64\n | Sint64_v _ \\ Sint64\n | Cap_v _ \\ Cap\n | Cap_v_frag _ _ \\ Uint8)\"\n\n\nsubsection \\Primitive Value Conversion and Cast Proof\\\ntext \\In this subsection, we provide proofs for the conversion between words and list of words.\n We also provide proofs that casting primitive values is correct. These will be used by the\n \\texttt{load} and \\texttt{store} operations in the memory model.\\\nabbreviation encode_u8 :: \"nat \\ 8 word\"\n where\n \"encode_u8 x \\ word_of_nat x\"\n\nabbreviation decode_u8 :: \"8 word \\ nat\"\n where\n \"decode_u8 b \\ unat b\"\n\nabbreviation encode_u8_list :: \"8 word \\ 8 word list\"\n where\n \"encode_u8_list w \\ [w]\"\n\nabbreviation decode_u8_list :: \"8 word list \\ 8 word\"\n where\n \"decode_u8_list ls \\ hd ls\"\n\nlemma encode_decode_u8_list:\n \"ls = [b] \\ ls = encode_u8_list (decode_u8_list ls)\"\n by simp\n\nlemma decode_encode_u8_list:\n \"w = decode_u8_list (encode_u8_list w)\"\n by simp\n\nlemma encode_decode_u8:\n \"w = encode_u8 (decode_u8 w)\"\n by simp\n\nlemma decode_encode_u8:\n assumes \"i \\ 2 ^ LENGTH(8) - 1\"\n shows \"i = decode_u8 (encode_u8 i)\"\n by (metis assms le_unat_uoi unat_minus_one_word)\n \nabbreviation u64_split :: \"64 word \\ 32 word list\"\n where\n \"u64_split x \\ (word_rsplit :: 64 word \\ 32 word list) x\"\n\nabbreviation u32_split :: \"32 word \\ 16 word list\"\n where\n \"u32_split x \\ (word_rsplit :: 32 word \\ 16 word list) x\"\n\nabbreviation u16_split :: \"16 word \\ 8 word list\"\n where\n \"u16_split x \\ (word_rsplit :: 16 word \\ 8 word list) x\"\n\nabbreviation cat_u16 :: \"8 word list \\ 16 word\"\n where\n \"cat_u16 x \\ (word_rcat :: 8 word list \\ 16 word) x\"\n\nabbreviation encode_u16 :: \"nat \\ 8 word list\"\n where \n \"encode_u16 x \\ u16_split (word_of_nat x)\"\n\nabbreviation decode_u16 :: \"8 word list \\ nat\"\n where\n \"decode_u16 x \\ unat (cat_u16 x)\"\n\nlemma flatten_u16_length:\n \"length (u16_split vs) = 2\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nlemma rsplit_rcat_eq:\n assumes \"LENGTH(('b::len)) mod LENGTH(('a::len)) = 0\"\n and \"length w = LENGTH('b) div LENGTH('a)\"\n shows \"(word_rsplit :: 'b word \\ 'a word list) ((word_rcat :: 'a word list \\ 'b word) w) = w\"\n by (simp add: assms mod_0_imp_dvd size_word.rep_eq word_rsplit_rcat_size)\n\nlemma rsplit_rcat_u16_eq:\n assumes \"w = [a1, a2]\"\n shows \"(word_rsplit :: 16 word \\ 8 word list) ((word_rcat :: 8 word list \\ 16 word) w) = w\"\nproof -\n have l1: \"length w * 8 = 16\"\n using assms by clarsimp\n moreover have l2: \"size ((word_rcat :: 8 word list \\ 16 word) w) = 16\"\n using assms\n by (simp add: size_word.rep_eq)\n from l1 l2 have \"length w * 8 = size ((word_rcat :: 8 word list \\ 16 word) w)\"\n by argo\n thus ?thesis\n by (metis l1 l2 len8 word_rsplit_rcat_size)\nqed\n \n\nlemma encode_decode_u16:\n assumes \"w = [a, b]\"\n shows \"w = encode_u16 (decode_u16 w)\"\n by (simp add: assms rsplit_rcat_eq)\n\nlemma cat_flatten_u16_eq:\n \"cat_u16 (u16_split w) = w\" \n by (simp add: word_rcat_rsplit)\n\nlemma decode_encode_u16:\n assumes \"i \\ 2 ^ LENGTH(16) - 1\"\n shows \"i = decode_u16 (encode_u16 i)\" \n by (metis assms cat_flatten_u16_eq le_unat_uoi unat_minus_one_word)\n\nabbreviation flatten_u32 :: \"32 word \\ 8 word list\"\n where\n \"flatten_u32 x \\ (word_rsplit :: 32 word \\ 8 word list) x\"\n\nabbreviation cat_u32 :: \"8 word list \\ 32 word\"\n where\n \"cat_u32 x \\ (word_rcat :: 8 word list \\ 32 word) x\"\n\nabbreviation encode_u32 :: \"nat \\ 8 word list\"\n where\n \"encode_u32 x \\ flatten_u32 (word_of_nat x)\"\n\nabbreviation decode_u32 :: \"8 word list \\ nat\"\n where\n \"decode_u32 i \\ unat (cat_u32 i)\"\n\nlemma flatten_u32_length:\n \"length (flatten_u32 vs) = 4\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nlemma rsplit_rcat_u32_eq:\n assumes \"w = [a1, a2, b1, b2]\"\n shows \"(word_rsplit :: 32 word \\ 8 word list) ((word_rcat :: 8 word list \\ 32 word) w) = w\" \n using rsplit_rcat_eq assms\n by force\n\nlemma encode_decode_u32:\n assumes \"w = [a1, a2, b1, b2]\"\n shows \"w = encode_u32 (decode_u32 w)\" \n using assms \n by (simp add: rsplit_rcat_u32_eq)\n\nlemma cat_flatten_u32_eq:\n \"cat_u32 (flatten_u32 w) = w\" \n by (simp add: word_rcat_rsplit)\n\nlemma decode_encode_u32:\n assumes \"i \\ 2 ^ LENGTH(32) - 1\"\n shows \"i = decode_u32 (encode_u32 i)\" \n by (metis assms le_unat_uoi unat_minus_one_word word_rcat_rsplit)\n\nabbreviation flatten_u64 :: \"64 word \\ 8 word list\"\n where\n \"flatten_u64 x \\ (word_rsplit :: 64 word \\ 8 word list) x\"\n\nabbreviation cat_u64 :: \"8 word list \\ 64 word\"\n where\n \"cat_u64 x \\ word_rcat x\"\n\nabbreviation encode_u64 :: \"nat \\ 8 word list\"\n where\n \"encode_u64 x \\ flatten_u64 (word_of_nat x)\"\n\nabbreviation decode_u64 :: \"8 word list \\ nat\"\n where\n \"decode_u64 x \\ unat (cat_u64 x)\"\n\nlemma flatten_u64_length:\n \"length (flatten_u64 vs) = 8\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nlemma encode_decode_u64:\n assumes \"w = [a1, a2, b1, b2, c1, c2, d1, d2]\"\n shows \"w = encode_u64 (decode_u64 w)\"\n using assms \n by (simp add: rsplit_rcat_eq)\n\nlemma cat_flatten_u64_eq:\n \"cat_u64 (flatten_u64 w) = w\" \n by (simp add: word_rcat_rsplit)\n\nlemma decode_encode_u64:\n assumes \"i \\ 2 ^ LENGTH(64) - 1\"\n shows \"i = decode_u64 (encode_u64 i)\" \n by (metis assms le_unat_uoi unat_minus_one_word word_rcat_rsplit)\n\nabbreviation encode_s8 :: \"int \\ 8 sword\"\n where\n \"encode_s8 x \\ word_of_int x\"\n\nabbreviation decode_s8 :: \"8 sword \\ int\"\n where\n \"decode_s8 b \\ sint b\"\n\nabbreviation encode_s8_list :: \"8 sword \\ 8 word list\"\n where\n \"encode_s8_list w \\ [SCAST(8 signed \\ 8) w]\"\n\nabbreviation decode_s8_list :: \"8 word list \\ 8 sword\"\n where\n \"decode_s8_list ls \\ UCAST(8 \\ 8 signed) (hd ls)\"\n\nlemma encode_decode_s8_list:\n \"ls = [b] \\ ls = encode_s8_list (decode_s8_list ls)\"\n by simp\n\nlemma decode_encode_s8_list:\n \"w = decode_s8_list (encode_s8_list w)\"\n by simp\n\nlemma encode_decode_s8:\n \"w = encode_s8 (decode_s8 w)\"\n by simp\n\nlemma decode_encode_s8:\n assumes \"- (2 ^ (LENGTH(8) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(8) - 1)\"\n shows \"i = decode_s8 (encode_s8 i)\" \n by (metis assms More_Word.sint_of_int_eq len_signed)\n \nabbreviation s64_split :: \"64 sword \\ 32 word list\"\n where\n \"s64_split x \\ (word_rsplit :: 64 sword \\ 32 word list) x\"\n\nabbreviation s32_split :: \"32 sword \\ 16 word list\"\n where\n \"s32_split x \\ (word_rsplit :: 32 sword \\ 16 word list) x\"\n\nabbreviation s16_split :: \"16 sword \\ 8 word list\"\n where\n \"s16_split x \\ (word_rsplit :: 16 sword \\ 8 word list) x\"\n\nabbreviation cat_s16 :: \"8 word list \\ 16 sword\"\n where\n \"cat_s16 x \\ (word_rcat :: 8 word list \\ 16 sword) x\"\n\nabbreviation encode_s16 :: \"int \\ 8 word list\"\n where \n \"encode_s16 x \\ s16_split (word_of_int x)\"\n\nabbreviation decode_s16 :: \"8 word list \\ int\"\n where\n \"decode_s16 x \\ sint (cat_s16 x)\"\n\nlemma flatten_s16_length:\n \"length (s16_split vs) = 2\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nlemma rsplit_rcat_s16_eq:\n assumes \"w = [a1, a2]\"\n shows \"(word_rsplit :: 16 sword \\ 8 word list) ((word_rcat :: 8 word list \\ 16 sword) w) = w\"\nproof -\n have l1: \"length w * 8 = 16\"\n using assms by clarsimp\n moreover have l2: \"size ((word_rcat :: 8 word list \\ 16 sword) w) = 16\"\n using assms\n by (simp add: size_word.rep_eq)\n from l1 l2 have \"length w * 8 = size ((word_rcat :: 8 word list \\ 16 sword) w)\"\n by argo\n thus ?thesis\n by (simp add: word_rsplit_rcat_size)\nqed\n \n\nlemma encode_decode_s16:\n assumes \"w = [a, b]\"\n shows \"w = encode_s16 (decode_s16 w)\"\n by (simp add: assms rsplit_rcat_eq)\n\nlemma cat_flatten_s16_eq:\n \"cat_s16 (s16_split w) = w\" \n by (simp add: word_rcat_rsplit)\n\nlemma decode_encode_s16:\n assumes \"- (2 ^ (LENGTH(16) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(16) - 1)\"\n shows \"i = decode_s16 (encode_s16 i)\" \n by (metis assms cat_flatten_s16_eq len_signed sint_of_int_eq)\n\nabbreviation flatten_s32 :: \"32 sword \\ 8 word list\"\n where\n \"flatten_s32 x \\ (word_rsplit :: 32 sword \\ 8 word list) x\"\n\nabbreviation cat_s32 :: \"8 word list \\ 32 sword\"\n where\n \"cat_s32 x \\ (word_rcat :: 8 word list \\ 32 sword) x\"\n\nabbreviation encode_s32 :: \"int \\ 8 word list\"\n where\n \"encode_s32 x \\ flatten_s32 (word_of_int x)\"\n\nabbreviation decode_s32 :: \"8 word list \\ int\"\n where\n \"decode_s32 i \\ sint (cat_s32 i)\"\n\nlemma flatten_s32_length:\n \"length (flatten_s32 vs) = 4\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nlemma rsplit_rcat_s32_eq:\n assumes \"w = [a1, a2, b1, b2]\"\n shows \"(word_rsplit :: 32 sword \\ 8 word list) ((word_rcat :: 8 word list \\ 32 sword) w) = w\" \n using rsplit_rcat_eq assms\n by force\n\nlemma encode_decode_s32:\n assumes \"w = [a1, a2, b1, b2]\"\n shows \"w = encode_s32 (decode_s32 w)\" \n using assms \n by (simp add: rsplit_rcat_s32_eq)\n\nlemma decode_encode_s32:\n assumes \"- (2 ^ (LENGTH(32) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(32) - 1)\"\n shows \"i = decode_s32 (encode_s32 i)\" \n by (metis assms len_signed sint_of_int_eq word_rcat_rsplit)\n \nabbreviation flatten_s64 :: \"64 sword \\ 8 word list\"\n where\n \"flatten_s64 x \\ (word_rsplit :: 64 sword \\ 8 word list) x\"\n\nlemma flatten_s64_length:\n \"length (flatten_s64 vs) = 8\"\n by (simp add: length_word_rsplit_even_size wsst_TYs(3))\n\nabbreviation cat_s64 :: \"8 word list \\ 64 sword\"\n where\n \"cat_s64 x \\ word_rcat x\"\n\nabbreviation encode_s64 :: \"int \\ 8 word list\"\n where\n \"encode_s64 x \\ flatten_s64 (word_of_int x)\"\n\nabbreviation decode_s64 :: \"8 word list \\ int\"\n where\n \"decode_s64 x \\ sint (cat_s64 x)\"\n\nlemma encode_decode_s64:\n assumes \"w = [a1, a2, b1, b2, c1, c2, d1, d2]\"\n shows \"w = encode_s64 (decode_s64 w)\"\n using assms \n by (simp add: rsplit_rcat_eq)\n\nlemma decode_encode_s64:\n assumes \"- (2 ^ (LENGTH(64) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(64) - 1)\"\n shows \"i = decode_s64 (encode_s64 i)\" \n by (metis assms len_signed sint_of_int_eq word_rcat_rsplit)\n\ndefinition word_of_integer :: \"integer \\ 'a::len word\"\n where\n \"word_of_integer x \\ word_of_int (int_of_integer x)\"\n\ndefinition sword_of_integer :: \"integer \\ 'a::len sword\"\n where\n \"sword_of_integer x \\ word_of_int (int_of_integer x)\"\n\ndefinition integer_of_word :: \"'a::len word \\ integer\"\n where\n \"integer_of_word x \\ integer_of_int (uint x)\"\n\ndefinition integer_of_sword :: \"'a::len sword \\ integer\"\n where\n \"integer_of_sword x \\ integer_of_int (sint x)\"\n\nlemma word_integer_eq:\n \"word_of_integer (integer_of_word w) = w\"\n unfolding word_of_integer_def integer_of_word_def\n by (metis int_of_integer_of_int integer_of_int_eq_of_int word_uint.Rep_inverse')\n\nlemma sword_integer_eq:\n \"sword_of_integer (integer_of_sword w) = w\"\n unfolding sword_of_integer_def integer_of_sword_def\n by (metis int_of_integer_of_int integer_of_int_eq_of_int word_sint.Rep_inverse')\n\nlemma integer_word_bounded_eq:\n assumes \"0 \\ i\"\n assumes \"i \\ 2 ^ LENGTH('a::len) - 1\"\n shows \"integer_of_word ((word_of_integer :: integer \\ 'a word) i) = i\"\n unfolding integer_of_word_def word_of_integer_def\n using assms \n by (metis integer_less_eq_iff integer_of_int_eq_of_int minus_integer.rep_eq of_int_0_le_iff of_int_eq_1_iff of_int_eq_numeral_power_cancel_iff of_int_integer_of word_of_int_inverse zle_diff1_eq)\n\nlemma integer_sword_bounded_eq:\n assumes \"- (2 ^ (LENGTH('a::len) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH('a) - 1)\"\n shows \"integer_of_sword ((sword_of_integer :: integer \\ 'a sword) i) = i\"\n unfolding integer_of_sword_def sword_of_integer_def\n using signed_take_bit_int_eq_self assms \n by (smt (verit) diff_numeral_special(11) int_of_integer_numeral integer_less_eq_iff integer_of_int_eq_of_int len_signed minus_integer.rep_eq numeral_power_eq_of_int_cancel_iff of_int_integer_of of_int_power_less_of_int_cancel_iff one_integer.rep_eq sint_of_int_eq uminus_integer.rep_eq)\n\ndefinition word8_of_integer :: \"integer \\ 8 word\"\n where\n \"word8_of_integer \\ word_of_integer\"\n\ndefinition word16_of_integer :: \"integer \\ 16 word\"\n where\n \"word16_of_integer \\ word_of_integer\"\n\ndefinition word32_of_integer :: \"integer \\ 32 word\"\n where\n \"word32_of_integer \\ word_of_integer\"\n\ndefinition word64_of_integer :: \"integer \\ 64 word\"\n where\n \"word64_of_integer \\ word_of_integer\"\n\ndefinition integer_of_word8 :: \"8 word \\ integer\"\n where\n \"integer_of_word8 \\ integer_of_word\"\n \ndefinition integer_of_word16 :: \"16 word \\ integer\"\n where\n \"integer_of_word16 \\ integer_of_word\"\n\ndefinition integer_of_word32 :: \"32 word \\ integer\"\n where\n \"integer_of_word32 \\ integer_of_word\"\n\ndefinition integer_of_word64 :: \"64 word \\ integer\"\n where\n \"integer_of_word64 \\ integer_of_word\"\n\nlemma word8_integer_eq:\n \"word8_of_integer (integer_of_word8 w) = w\" \n unfolding word8_of_integer_def integer_of_word8_def\n using word_integer_eq \n by blast\n\nlemma word16_integer_eq:\n \"word16_of_integer (integer_of_word16 w) = w\" \n unfolding word16_of_integer_def integer_of_word16_def\n using word_integer_eq \n by blast\n\nlemma word32_integer_eq:\n \"word32_of_integer (integer_of_word32 w) = w\" \n unfolding word32_of_integer_def integer_of_word32_def\n using word_integer_eq \n by blast\n\nlemma word64_integer_eq:\n \"word64_of_integer (integer_of_word64 w) = w\"\n unfolding word64_of_integer_def integer_of_word64_def\n using word_integer_eq\n by blast\n\nlemma integer_word8_bounded_eq:\n assumes \"0 \\ i\"\n and \"i \\ 2 ^ LENGTH(8) - 1\"\n shows \"integer_of_word8 (word8_of_integer i) = i\"\n unfolding word8_of_integer_def integer_of_word8_def\n using integer_word_bounded_eq assms\n by blast\n\nlemma integer_word16_bounded_eq:\n assumes \"0 \\ i\"\n and \"i \\ 2 ^ LENGTH(16) - 1\"\n shows \"integer_of_word16 (word16_of_integer i) = i\"\n unfolding word16_of_integer_def integer_of_word16_def\n using integer_word_bounded_eq assms\n by blast\n\nlemma integer_word32_bounded_eq:\n assumes \"0 \\ i\"\n and \"i \\ 2 ^ LENGTH(32) - 1\"\n shows \"integer_of_word32 (word32_of_integer i) = i\"\n unfolding word32_of_integer_def integer_of_word32_def\n using integer_word_bounded_eq assms\n by blast\n\nlemma integer_word64_bounded_eq:\n assumes \"0 \\ i\"\n and \"i \\ 2 ^ LENGTH(64) - 1\"\n shows \"integer_of_word64 (word64_of_integer i) = i\"\n unfolding word64_of_integer_def integer_of_word64_def\n using integer_word_bounded_eq assms\n by blast\n\ndefinition sword8_of_integer :: \"integer \\ 8 sword\"\n where\n \"sword8_of_integer \\ sword_of_integer\"\n\ndefinition sword16_of_integer :: \"integer \\ 16 sword\"\n where\n \"sword16_of_integer \\ sword_of_integer\"\n\ndefinition sword32_of_integer :: \"integer \\ 32 sword\"\n where\n \"sword32_of_integer \\ sword_of_integer\"\n\ndefinition sword64_of_integer :: \"integer \\ 64 sword\"\n where\n \"sword64_of_integer \\ sword_of_integer\"\n\ndefinition integer_of_sword8 :: \"8 sword \\ integer\"\n where\n \"integer_of_sword8 \\ integer_of_sword\"\n\ndefinition integer_of_sword16 :: \"16 sword \\ integer\"\n where\n \"integer_of_sword16 \\ integer_of_sword\"\n\ndefinition integer_of_sword32 :: \"32 sword \\ integer\"\n where\n \"integer_of_sword32 \\ integer_of_sword\"\n\ndefinition integer_of_sword64 :: \"64 sword \\ integer\"\n where\n \"integer_of_sword64 \\ integer_of_sword\"\n\nlemma sword8_integer_eq:\n \"sword8_of_integer (integer_of_sword8 w) = w\" \n unfolding sword8_of_integer_def integer_of_sword8_def\n using sword_integer_eq \n by blast\n\nlemma sword16_integer_eq:\n \"sword16_of_integer (integer_of_sword16 w) = w\" \n unfolding sword16_of_integer_def integer_of_sword16_def\n using sword_integer_eq \n by blast\n\nlemma sword32_integer_eq:\n \"sword32_of_integer (integer_of_sword32 w) = w\" \n unfolding sword32_of_integer_def integer_of_sword32_def\n using sword_integer_eq \n by blast\n\nlemma sword64_integer_eq:\n \"sword64_of_integer (integer_of_sword64 w) = w\"\n unfolding sword64_of_integer_def integer_of_sword64_def\n using sword_integer_eq\n by blast\n\nlemma integer_sword8_bounded_eq:\n assumes \"- (2 ^ (LENGTH(8) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(8) - 1)\"\n shows \"integer_of_sword8 (sword8_of_integer i) = i\"\n unfolding sword8_of_integer_def integer_of_sword8_def\n using integer_sword_bounded_eq assms \n by metis \n\nlemma integer_sword16_bounded_eq:\n assumes \"- (2 ^ (LENGTH(16) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(16) - 1)\"\n shows \"integer_of_sword16 (sword16_of_integer i) = i\"\n unfolding sword16_of_integer_def integer_of_sword16_def\n using integer_sword_bounded_eq assms\n by metis\n\nlemma integer_sword32_bounded_eq:\n assumes \"- (2 ^ (LENGTH(32) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(32) - 1)\"\n shows \"integer_of_sword32 (sword32_of_integer i) = i\"\n unfolding sword32_of_integer_def integer_of_sword32_def\n using integer_sword_bounded_eq assms \n by metis\n\nlemma integer_sword64_bounded_eq:\n assumes \"- (2 ^ (LENGTH(64) - 1)) \\ i\"\n and \"i < 2 ^ (LENGTH(64) - 1)\"\n shows \"integer_of_sword64 (sword64_of_integer i) = i\"\n unfolding sword64_of_integer_def integer_of_sword64_def\n using integer_sword_bounded_eq assms\n by metis\n\nlemmas flatten_types_length = flatten_u16_length flatten_s16_length flatten_u32_length flatten_s32_length flatten_u64_length flatten_s64_length\n\ntext \\cast\\_val is an executable code that ensures easy casting of values. This value cast function\n is used within the Gillian \n framework~\\cite{old_gillian_2020, gillian_2021, maksimovic_2021, fragoso_2020}.\\\ndefinition cast_val :: \"String.literal \\ integer \\ integer\"\n where\n \"cast_val s i \\\n if s = STR ''uint8'' then integer_of_word8 (word8_of_integer i) \n else if s = STR ''int8'' then integer_of_sword8 (sword8_of_integer i)\n else if s = STR ''uint16'' then integer_of_word16 (word16_of_integer i)\n else if s = STR ''int16'' then integer_of_sword16 (sword16_of_integer i)\n else if s = STR ''uint32'' then integer_of_word32 (word32_of_integer i)\n else if s = STR ''int32'' then integer_of_sword32 (sword32_of_integer i)\n else if s = STR ''uint64'' then integer_of_word64 (word64_of_integer i)\n else if s = STR ''int64'' then integer_of_sword64 (sword64_of_integer i)\n else i\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CHERI-C_Memory_Model/Preliminary_Library.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.28830406150349597}} {"text": "(* Title: ZF/Inductive.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1993 University of Cambridge\n\nInductive definitions use least fixedpoints with standard products and sums\nCoinductive definitions use greatest fixedpoints with Quine products and sums\n\nSums are used only for mutual recursion;\nProducts are used only to derive \"streamlined\" induction rules for relations\n*)\n\nsection\\Inductive and Coinductive Definitions\\\n\ntheory Inductive\nimports Fixedpt QPair Nat\nkeywords\n \"inductive\" \"coinductive\" \"inductive_cases\" \"rep_datatype\" \"primrec\" :: thy_decl and\n \"domains\" \"intros\" \"monos\" \"con_defs\" \"type_intros\" \"type_elims\"\n \"elimination\" \"induction\" \"case_eqns\" \"recursor_eqns\" :: quasi_command\nbegin\n\nlemma def_swap_iff: \"a == b ==> a = c \\ c = b\"\n by blast\n\nlemma def_trans: \"f == g ==> g(a) = b ==> f(a) = b\"\n by simp\n\nlemma refl_thin: \"!!P. a = a ==> P ==> P\" .\n\nML_file \\ind_syntax.ML\\\nML_file \\Tools/ind_cases.ML\\\nML_file \\Tools/cartprod.ML\\\nML_file \\Tools/inductive_package.ML\\\nML_file \\Tools/induct_tacs.ML\\\nML_file \\Tools/primrec_package.ML\\\n\nML \\\nstructure Lfp =\n struct\n val oper = \\<^Const>\\lfp\\\n val bnd_mono = \\<^Const>\\bnd_mono\\\n val bnd_monoI = @{thm bnd_monoI}\n val subs = @{thm def_lfp_subset}\n val Tarski = @{thm def_lfp_unfold}\n val induct = @{thm def_induct}\n end;\n\nstructure Standard_Prod =\n struct\n val sigma = \\<^Const>\\Sigma\\\n val pair = \\<^Const>\\Pair\\\n val split_name = \\<^const_name>\\split\\\n val pair_iff = @{thm Pair_iff}\n val split_eq = @{thm split}\n val fsplitI = @{thm splitI}\n val fsplitD = @{thm splitD}\n val fsplitE = @{thm splitE}\n end;\n\nstructure Standard_CP = CartProd_Fun (Standard_Prod);\n\nstructure Standard_Sum =\n struct\n val sum = \\<^Const>\\sum\\\n val inl = \\<^Const>\\Inl\\\n val inr = \\<^Const>\\Inr\\\n val elim = \\<^Const>\\case\\\n val case_inl = @{thm case_Inl}\n val case_inr = @{thm case_Inr}\n val inl_iff = @{thm Inl_iff}\n val inr_iff = @{thm Inr_iff}\n val distinct = @{thm Inl_Inr_iff}\n val distinct' = @{thm Inr_Inl_iff}\n val free_SEs = Ind_Syntax.mk_free_SEs\n [distinct, distinct', inl_iff, inr_iff, Standard_Prod.pair_iff]\n end;\n\n\nstructure Ind_Package =\n Add_inductive_def_Fun\n (structure Fp=Lfp and Pr=Standard_Prod and CP=Standard_CP\n and Su=Standard_Sum val coind = false);\n\n\nstructure Gfp =\n struct\n val oper = \\<^Const>\\gfp\\\n val bnd_mono = \\<^Const>\\bnd_mono\\\n val bnd_monoI = @{thm bnd_monoI}\n val subs = @{thm def_gfp_subset}\n val Tarski = @{thm def_gfp_unfold}\n val induct = @{thm def_Collect_coinduct}\n end;\n\nstructure Quine_Prod =\n struct\n val sigma = \\<^Const>\\QSigma\\\n val pair = \\<^Const>\\QPair\\\n val split_name = \\<^const_name>\\qsplit\\\n val pair_iff = @{thm QPair_iff}\n val split_eq = @{thm qsplit}\n val fsplitI = @{thm qsplitI}\n val fsplitD = @{thm qsplitD}\n val fsplitE = @{thm qsplitE}\n end;\n\nstructure Quine_CP = CartProd_Fun (Quine_Prod);\n\nstructure Quine_Sum =\n struct\n val sum = \\<^Const>\\qsum\\\n val inl = \\<^Const>\\QInl\\\n val inr = \\<^Const>\\QInr\\\n val elim = \\<^Const>\\qcase\\\n val case_inl = @{thm qcase_QInl}\n val case_inr = @{thm qcase_QInr}\n val inl_iff = @{thm QInl_iff}\n val inr_iff = @{thm QInr_iff}\n val distinct = @{thm QInl_QInr_iff}\n val distinct' = @{thm QInr_QInl_iff}\n val free_SEs = Ind_Syntax.mk_free_SEs\n [distinct, distinct', inl_iff, inr_iff, Quine_Prod.pair_iff]\n end;\n\n\nstructure CoInd_Package =\n Add_inductive_def_Fun(structure Fp=Gfp and Pr=Quine_Prod and CP=Quine_CP\n and Su=Quine_Sum val coind = true);\n\n\\\n\nend\n", "meta": {"author": "lexbailey", "repo": "itrees_isabelle_fork", "sha": "60e0b4893d0f767483ad3a4e43d2001ca10deef3", "save_path": "github-repos/isabelle/lexbailey-itrees_isabelle_fork", "path": "github-repos/isabelle/lexbailey-itrees_isabelle_fork/itrees_isabelle_fork-60e0b4893d0f767483ad3a4e43d2001ca10deef3/src/ZF/Inductive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.28830406150349597}} {"text": "theory OpSem\nimports Main HOL.Rat \nbegin\n\ntype_synonym TS = rat (* Timestamp *)\ntype_synonym T = nat (* Thread ID *)\ntype_synonym L = nat (* Location *)\n \ndefinition \"null = (0 :: nat)\"\n\ntype_synonym V = nat\n\n(* bool: true = release/aquire or false = relaxed*)\ndatatype action =\n Read bool L V\n | Write bool L V\n | Update L V V\n\nprint_theorems\n\nfun avar :: \"action \\ L\" where\n \"avar (Read _ x v) = x\"\n | \"avar (Write _ x v) = x\"\n | \"avar (Update x e v) = x\"\n\nfun wr_val :: \"action \\ V option\" where\n \"wr_val (Write _ _ v) = Some v\"\n | \"wr_val (Update _ _ v) = Some v\"\n | \"wr_val _ = None\"\n\nfun rd_val :: \"action \\ V option\" where\n \"rd_val (Read _ _ v) = Some v\"\n | \"rd_val (Update _ v _) = Some v\"\n | \"rd_val _ = None\"\n\nfun isRA :: \"action \\ bool\" where\n \"isRA (Read b _ _) = b\" \n | \"isRA (Write b _ _) = b\"\n | \"isRA (Update _ _ _) = True\"\n\nfun isWr :: \"action \\ bool\" where\n \"isWr (Read _ _ _) = False\" \n | \"isWr (Write _ _ _) = True\"\n | \"isWr (Update _ _ _) = False\"\n\nfun isRd :: \"action \\ bool\" where\n \"isRd (Read _ _ _) = True\" \n | \"isRd (Write _ _ _) = False\"\n | \"isRd (Update _ _ _) = False\"\n\nfun isUp :: \"action \\ bool\" where\n \"isUp (Read _ _ _) = False\" \n | \"isUp (Write _ _ _) = False\"\n | \"isUp (Update _ _ _) = True\"\n\n\nabbreviation \"reads a \\ a \\ (dom rd_val)\"\nabbreviation \"writes a \\ a \\ (dom wr_val)\"\n\n\ntype_synonym View = \"L \\ T\"\n\ntype_synonym event = \"TS \\ T \\ action\"\n\ndefinition time_stamp :: \"event \\ TS\" where \"time_stamp e \\ fst e\"\ndefinition tid :: \"event \\ T\" where \"tid e \\ fst (snd e)\"\ndefinition act :: \"event \\ action\" where \"act e \\ snd (snd e)\"\n\ndefinition var :: \"L \\ TS \\ L\" where \"var = fst\"\ndefinition tst :: \"L \\ TS \\ TS\" where \"tst = snd\"\n\n\n\nrecord write_record =\n val :: V\n is_releasing :: bool\n\nrecord surrey_state =\n writes :: \"(L \\ TS) set\"\n thrView :: \"T \\ L \\ (L \\ TS)\"\n modView :: \"(L \\ TS) \\ L \\ (L \\ TS)\"\n mods :: \"(L \\ TS) \\ write_record\"\n covered :: \"(L \\ TS) set\"\n\ndefinition \"value \\ w \\ val (mods \\ w)\"\ndefinition \"releasing \\ w \\ is_releasing (mods \\ w)\"\n\ndefinition \"writes_on \\ x = {w . var w = x \\ w \\ writes \\}\"\ndefinition \"visible_writes \\ t x \\ {w \\ writes_on \\ x . tst(thrView \\ t x) \\ tst w}\"\n\n\n\nlemma writes_on_var [simp]: \"w \\ writes_on \\ x \\ var w = x\"\n by (simp add: writes_on_def)\n\nlemma visible_var [simp]: \"w \\ visible_writes \\ t x \\ var w = x\"\n by (auto simp add: visible_writes_def)\n\nlemma visible_writes_in_writes: \"visible_writes \\ t x \\ writes \\\"\n using visible_writes_def writes_on_def by fastforce\n\ndefinition \"valid_fresh_ts \\ w ts' \\ tst w < ts' \\ (\\ w' \\ writes_on \\ (var w). tst w < tst w' \\ ts' < tst w')\"\n\ndefinition \"ts_oride m m' x \\ if tst (m x) \\ tst (m' x) then m' x else m x\"\n\ndefinition rev_app :: \"'s \\ ('s \\ 't) \\ 't\" (infixl \";;\" 150)\n where\n \"rev_app s f \\ f s\"\n\n\ndefinition \n \"update_thrView t nv \\ \\ \\ \\ thrView := (thrView \\)(t := nv)\\\"\n\ndefinition \n \"update_modView w nv \\ \\ \\ \\ modView := (modView \\)(w := nv) \\\"\n\ndefinition \n \"update_mods w nwr \\ \\ \\ \\ mods := (mods \\)(w := nwr)\\ \\writes := writes \\ \\ {w}\\\"\n\ndefinition \n \"add_cv w \\ \\ \\ \\ covered := covered \\ \\ {w}\\\"\n\ndefinition \"syncing \\ w b \\ releasing \\ w \\ b\"\n\nlemma [simp]: \"syncing \\ w False = False\"\n by (simp add: syncing_def)\n\nlemma [simp]: \"syncing \\ w True = releasing \\ w\"\n by (simp add: syncing_def)\n\ndefinition\n \"read_trans t b w \\ \\\n let new_thr_idx = (thrView \\ t)(var w := w) in\n let new_thr_idx' = \n if syncing \\ w b then ts_oride new_thr_idx (modView \\ w) else new_thr_idx in\n \\ ;; update_thrView t new_thr_idx'\"\n\nlemma [simp]: \"\\ syncing \\ w b \\ thrView (read_trans t b w \\) t = (thrView \\ t)(var w := w)\"\n by (simp add: read_trans_def rev_app_def update_thrView_def)\n\nlemma syncing_thrView_read_trans [simp]: \"syncing \\ w b \\\n thrView (read_trans t b w \\) t = ts_oride ((thrView \\ t)(var w := w)) (modView \\ w)\"\n by (simp add: read_trans_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"t' \\ t \\ thrView (read_trans t b w \\) t' = (thrView \\ t')\"\n apply (simp add: read_trans_def rev_app_def update_thrView_def)\n by (metis fun_upd_other surrey_state.select_convs(2) surrey_state.surjective surrey_state.update_convs(2))\n\nlemma [simp]: \"var w \\ x \\ b = False \\ thrView (read_trans t b w \\) t x = thrView \\ t x\"\n by (simp add: read_trans_def rev_app_def update_thrView_def Let_def ts_oride_def)\n\nlemma [simp]: \"modView (read_trans t b w \\) = modView \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"mods (read_trans t b w \\) = mods \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n \nlemma [simp]: \"covered (read_trans t b w \\) = covered \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes (read_trans t b w \\) = writes \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes_on (read_trans t b w \\) x = writes_on \\ x\"\n apply(unfold writes_on_def)\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"value (read_trans t False w \\) x = value \\ x\"\n apply(unfold value_def)\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\ndefinition\n \"write_trans t b w v \\ ts' \\\n \\ ;; update_thrView t ((thrView \\ t)(var w := (var w, ts'))) \n ;; update_modView (var w, ts') ((thrView \\ t)(var w := (var w, ts')))\n ;; update_mods (var w, ts') \\ val = v, is_releasing = b\\\"\n\n\nlemma [simp]: \"thrView (write_trans t b w v \\ ts') t = (thrView \\ t)(var w := (var w, ts'))\"\n by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"t' \\ t \\ thrView (write_trans t b w v \\ ts') t' = (thrView \\ t')\"\n by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ modView (write_trans t b w v \\ ts') w' = (thrView \\ t)(var w := (var w, ts'))\"\n apply (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\ var w \\ modView (write_trans t b w v \\ ts') w' = modView \\ w'\"\n by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\ var w \\ modView (write_trans t b w v \\ ts') w' y = modView \\ w' y\"\n by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ modView (write_trans t b w v \\ ts') w' = modView \\ w'\"\n by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ mods (write_trans t b w v \\ ts') w' = \\ val = v, is_releasing = b\\\"\n apply (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\ var w \\ mods (write_trans t b w v \\ ts') w' = mods \\ w'\"\n by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ mods (write_trans t b w v \\ ts') w' = mods \\ w'\"\n by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"covered (write_trans t b w v \\ ts') = covered \\\"\n by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"writes (write_trans t b w v \\ ts') = writes \\ \\ {(var w, ts')}\"\n by(simp add: Let_def rev_app_def\n write_trans_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\ writes_on (write_trans t b w v \\ ts') x = writes_on \\ x \\ {(var w, ts')}\"\n apply(unfold writes_on_def)\n apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n using Collect_cong by auto\n\nlemma [simp]: \"y \\ var w \\ writes_on (write_trans t b w v \\ ts') y = writes_on \\ y\"\n apply(unfold writes_on_def)\n by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"w \\ writes_on \\ y \\ w \\ writes_on (write_trans t b w' v \\ ts') y\"\n apply(unfold writes_on_def)\n by simp\n\n\n\n\ndefinition \"update_trans t w v' \\ ts' \\ \n let new_thr_idx = (thrView \\ t)(var w := (var w, ts')) in\n let new_thr_idx' =\n if releasing \\ w\n then\n ts_oride new_thr_idx (modView \\ w) \n else\n new_thr_idx \n in\n \\ ;; update_thrView t new_thr_idx' \n ;; update_modView (var w, ts') new_thr_idx'\n ;; update_mods (var w, ts') \\ val = v', is_releasing = True\\\n ;; add_cv w\"\n\n\nlemma [simp]: \"\\ releasing \\ w \\\n thrView (update_trans t w v' \\ ts') t = (thrView \\ t)(var w := (var w, ts'))\"\n by (simp add: Let_def rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def add_cv_def)\n\nlemma [simp]: \" releasing \\ w \\ \n thrView (update_trans t w v' \\ ts') t = ts_oride ((thrView \\ t)(var w := (var w, ts'))) (modView \\ w)\"\n by (auto simp add: Let_def update_trans_def add_cv_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\nlemma [simp]: \"t' \\ t \\ thrView (update_trans t w v' \\ ts') t' = (thrView \\ t')\"\n by (simp add: Let_def update_trans_def add_cv_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n \\ releasing \\ w \\ modView (update_trans t w v' \\ ts') w' = (thrView \\ t)(var w := (var w, ts'))\"\n apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n releasing \\ w \\ modView (update_trans t w v' \\ ts') w' = ts_oride ((thrView \\ t)(var w := (var w, ts'))) (modView \\ w)\"\n apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\ var w \\ modView (update_trans t w v' \\ ts') w' = modView \\ w'\"\n by (auto simp add: Let_def fun_upd_idem_iff fun_upd_twist rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def add_cv_def)\n \nlemma [simp]: \"tst w' \\ ts' \\ modView (update_trans t w v' \\ ts') w' = modView \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\ var w \\ mods (update_trans t w v' \\ ts') w' = mods \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ mods (update_trans t w v' \\ ts') w' = mods \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n mods (update_trans t w v' \\ ts') w' = \\ val = v', is_releasing = True\\\"\n apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"covered (update_trans t w v' \\ ts') = covered \\ \\ {w}\"\n by (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"writes (update_trans t w v' \\ ts') = writes \\ \\ {(var w, ts')}\"\n by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\ writes_on (update_trans t w v' \\ ts') x = writes_on \\ x \\ {(x, ts')}\"\n apply(unfold writes_on_def)\n apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n using Collect_cong by auto\n\nlemma [simp]: \"y \\ var w \\ writes_on (update_trans t w v' \\ ts') y = writes_on \\ y\"\n apply(unfold writes_on_def)\n by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\ndefinition step :: \"T \\ action \\ surrey_state \\ surrey_state \\ bool\"\n where\n \"step t a \\ \\'\\\n \\ w. w \\ visible_writes \\ t (avar a) \\\n (case a of\n Read b x v \\\n v = value \\ w \\\n \\' = read_trans t b w \\\n | Write b x v \\ \\ ts'.\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\\n \\' = write_trans t b w v \\ ts'\n | Update x v v' \\ \\ ts'.\n v = value \\ w \\ \n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\\n \\' = update_trans t w v' \\ ts')\n \"\n\nlemma step_cases:\n \"step t a \\ \\'\n \\ \n \\\\ w b x v. \\' = read_trans t b w \\ \\ a = Read b x v \\ w \\ visible_writes \\ t (avar a) \\\n v = value \\ w \\ P \\ (read_trans t b w \\)\\\n \\\n \\\\ w b x v ts'. \\' = write_trans t b w v \\ ts' \\ a = Write b x v \\ w \\ visible_writes \\ t (avar a) \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts'\n \\ P \\ (write_trans t b w v \\ ts') \\\n \\\n \\\\ w x v v' ts'. \\' = update_trans t w v' \\ ts' \\ a = Update x v v' \\\n w \\ visible_writes \\ t (avar a) \\\n v = value \\ w \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts'\n \\ P \\ (update_trans t w v' \\ ts')\\\n \\ P \\ \\'\"\n apply(simp add: step_def) apply(case_tac a) by auto\n\n\n\ndefinition \"WrX x v \\ Write False x v\"\ndefinition \"WrR x v \\ Write True x v\"\ndefinition \"RdX x v \\ Read False x v\"\ndefinition \"RdA x v \\ Read True x v\"\n\n\n\nabbreviation WrX_state_abbr:: \" surrey_state \\ L \\ V \\ T \\ surrey_state \\ bool\" (\"_ [_ := _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [x := v]\\<^sub>t \\' \\ step t (WrX x v) \\ \\'\"\n\nabbreviation WrR_state_abbr:: \" surrey_state \\ L \\ V \\ T \\ surrey_state \\ bool\" (\"_ [_ :=\\<^sup>R _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [x :=\\<^sup>R v]\\<^sub>t \\' \\ step t (WrR x v) \\ \\'\"\n\nabbreviation RdX_state_abbr:: \" surrey_state \\ V \\ L \\ T \\ surrey_state \\ bool\" (\"_ [_ \\ _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [r \\ x]\\<^sub>t \\' \\ step t (RdX x r) \\ \\'\"\n\nabbreviation RdA_state_abbr:: \" surrey_state \\ V \\ L \\ T \\ surrey_state \\ bool\" (\"_ [_ \\\\<^sup>A _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [r \\\\<^sup>A x]\\<^sub>t \\' \\ step t (RdA x r) \\ \\'\"\n\nabbreviation Up_state_abbr:: \" surrey_state \\ L \\ V \\ V \\ T \\ surrey_state \\ bool\" (\"_ RMW[_, _, _]\\<^sub>_ _\" [100,100,100,100,100,100])\n where \"\\ RMW[x, u, v]\\<^sub>t \\' \\ step t (Update x u v) \\ \\'\"\n\nabbreviation Swap_state_abbr:: \" surrey_state \\ L \\ V \\ T \\ surrey_state \\ bool\" (\"_ SWAP[_, _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ SWAP[x, v]\\<^sub>t \\' \\ \\u . step t (Update x u v) \\ \\'\"\n\n\ndefinition \"initial_state \\ I \\\n \\ F . writes \\ = {(x, F x) | x. True} \\\n (\\ t x. thrView \\ t x = (x, F x)) \\\n (\\ w x. modView \\ w x = (x, F x)) \\\n (\\ w. mods \\ w = \\ val = I (var w), is_releasing = False \\) \\\n covered \\ = {}\"\n\ndefinition\n \"wfs \\ \\\n (\\ t x. thrView \\ t x \\ writes_on \\ x) \\\n (\\ w x. modView \\ w x \\ writes_on \\ x) \\\n (\\ x. finite(writes_on \\ x)) \\\n (\\ w. w \\ writes \\ \\ modView \\ w (var w) = w) \\\n covered \\ \\ writes \\\"\n\nlemma initially_write_unique: \"initial_state \\ I \\ w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\ w = w'\"\n apply(unfold initial_state_def writes_on_def) by auto\n\nlemma initial_wfs: assumes \"initial_state \\ I\" shows \"wfs \\\"\n apply(simp add: initial_state_def wfs_def)\n apply(rule conjI)\n using assms writes_on_def apply (smt CollectI fst_conv initial_state_def var_def)\n apply(rule conjI)\n using assms writes_on_def initial_state_def apply simp\n apply (smt CollectI fst_conv initial_state_def var_def writes_on_def)\n apply rule using initially_write_unique[OF assms(1)] \n apply (smt CollectI Collect_cong finite.emptyI finite.insertI insert_compr not_finite_existsD singletonD writes_on_def)\n apply(rule conjI)\n apply (smt CollectD Pair_inject assms initial_state_def)\n using assms initial_state_def by fastforce\n\nlemma allI_case: \"\\\\ y. x \\ y \\ P y\\ \\ \\P x\\ \\ \\ y. P y\" by fastforce\n\n\nlemma [simp]: \"wfs \\ \\ writes_on \\ x \\ {}\"\n apply(simp add: wfs_def)\n by (metis empty_iff)\n\nlemma [simp]: \"wfs \\ \\ finite(writes_on \\ x)\"\n by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\ \\ thrView \\ t x \\ writes_on \\ x\"\n by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\ \\ modView \\ w x \\ writes_on \\ x\"\n using wfs_def by blast\n\n\nlemma [simp]: \"wfs \\ \\ modView (read_trans t b w \\) w x \\ writes_on (read_trans t b w \\) x\"\n by auto\n\nlemma [simp]: \"wfs \\ \\ writes_on \\ x = writes_on (read_trans t b w \\) x\"\n by auto\n\n\nlemma own_ModView:\n assumes \"wfs \\\"\n and \"w \\ writes \\\"\n shows \"modView \\ w (var w) = w\"\n using assms apply(unfold wfs_def)\n by blast\n\nlemma ts_oride_same_var:\n assumes \"wfs \\\"\n and \"x = var w\"\n and \"w \\ visible_writes \\ t (var w)\"\n shows \"ts_oride ((thrView \\ t)(var w := w)) (modView \\ w) x = w\"\n apply(simp add: ts_oride_def) apply safe using assms\n apply (meson own_ModView subsetCE visible_writes_in_writes)\n using assms(2) apply blast \n using assms(2) by blast\n\nlemma ts_oride_diff_var:\n assumes \"wfs \\\"\n and \"x \\ var w\"\n and \"w \\ visible_writes \\ t (var w)\"\n shows \"ts_oride ((thrView \\ t)(var w := w')) (modView \\ w) x = ts_oride (thrView \\ t) (modView \\ w) x\"\n apply(simp add: ts_oride_def)\n using assms(2) by blast\n\nlemma ts_oride_split:\n assumes \"tst (m' x) \\ tst (m x) \\ P (m x)\"\n and \"tst (m x) \\ tst (m' x) \\ P (m' x)\"\n shows \"P (ts_oride m m' x)\"\n apply(simp add: ts_oride_def)\n by (simp add: assms(1) assms(2))\n\n\nlemma wfs_covered_preserved:\n assumes \"covered \\ \\ writes \\\"\n and \"step t a \\ \\'\"\n shows \"covered \\' \\ writes \\'\"\n apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) apply blast\n apply (simp add: assms(1) subset_insertI2)\n using assms(1) visible_writes_in_writes by fastforce\n\nlemma wfs_preserved:\n assumes \"wfs \\\"\n and \"step t a \\ \\'\"\n shows \"wfs \\'\"\n apply(unfold wfs_def)\n apply rule defer apply rule defer apply rule defer defer\n apply clarsimp defer\n apply clarsimp\n apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) wfs_def apply auto[1]\n apply(case_tac \"var w = aa\")\n apply(case_tac \"(aa, b) = (x, ts')\") apply simp\n apply simp \n apply(case_tac \"b = ts'\") apply simp using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp \n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def apply blast\n apply(case_tac \"var w = aa\")\n apply(case_tac \"releasing \\ w\")\n apply(case_tac \"(aa, b) = (x, ts')\")\n apply simp apply (metis assms(1) fun_upd_same ts_oride_def wfs_def)\n apply(case_tac \"b = ts'\") apply(case_tac \"var w = x\") apply simp\n apply simp apply(rule ts_oride_split) using assms(1) apply simp\n using assms(1) apply simp\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"(aa, b) = (x, ts')\") apply simp\n apply simp apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"b = ts'\")apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply clarsimp apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply (rule conjI)\n apply clarsimp apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) assms(2) own_ModView step_def apply fastforce\n apply(case_tac \"var w = x\") apply(case_tac \"(aa, b) = (x, ts')\") apply(case_tac \"var w = aa\")\n apply simp apply blast\n apply(case_tac \"b = ts'\") \n apply simp using own_ModView[OF assms(1)] apply auto[1]\n apply simp using own_ModView[OF assms(1)] apply auto[1]\n using visible_var apply fastforce\n apply(case_tac \"var w = x\") apply(case_tac \"(aa, b) = (x, ts')\") apply(case_tac \"var w = aa\")\n apply(case_tac \"releasing \\ w\")\n using own_ModView[OF assms(1)] apply simp apply(rule ts_oride_split) \n apply simp apply simp\n using leD valid_fresh_ts_def visible_writes_in_writes apply fastforce\n apply simp apply(case_tac \"releasing \\ w\") apply simp\n apply blast apply simp \n using own_ModView[OF assms(1)] apply auto[1]\n using visible_var apply force\n using wfs_covered_preserved assms(1) assms(2) wfs_def apply blast\n apply (rule step_cases[OF assms(2)])\n apply(case_tac \"ta = t\") apply(case_tac \"syncing \\ w b\")\n apply simp apply(rule ts_oride_split) \n apply (metis assms(1) fun_upd_apply subsetCE visible_writes_in_writes wfs_def)\n using assms(1) wfs_def apply blast apply simp \n apply (metis assms(1) subsetCE visible_writes_in_writes wfs_def)\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"ta = t\") apply simp\n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"ta = t\") apply simp apply(case_tac \"releasing \\ w\") apply simp\n apply(case_tac \"var w = x\") apply simp \n apply (metis assms(1) fun_upd_same ts_oride_def wfs_def)\n apply simp apply(rule ts_oride_split)\n using assms(1) apply auto[1] \n using assms(1) wfs_def apply blast\n apply simp \n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def by blast\n\ndefinition \"lastWr \\ x \\ (x, Max (tst`(writes_on \\ x)))\"\n\n\n\nlemma [simp]: \"var(lastWr \\ x) = x\" by(simp add: lastWr_def)\n\nlemma last_write_max: \"wfs \\ \\ w \\ writes_on \\ x \\ tst w \\ tst (lastWr \\ x)\"\n by(simp add: lastWr_def)\n\nlemma last_write_write_on [simp]: \"wfs \\ \\ lastWr \\ x \\ writes_on \\ x\"\n apply(simp add: lastWr_def )\n apply(case_tac \"Max (tst`(writes_on \\ x)) \\ tst`(writes_on \\ x)\")\n defer apply simp\n by (auto simp add: tst_def var_def writes_on_def)\n\nlemma lastWr_visible:\n \"wfs \\ \\ lastWr \\ x \\ visible_writes \\ t x\"\n by (metis (no_types, lifting) CollectI last_write_max last_write_write_on visible_writes_def wfs_def)\n\nlemma lastWr_read_pres: \"lastWr (read_trans t b w \\) x = lastWr \\ x\"\n by(simp add: lastWr_def)\n\nlemma write_to_different_var [simp]: \"wfs \\ \\ var w \\ x \\ lastWr (write_trans t b w v \\ ts') x = lastWr \\ x\"\n by(simp add: lastWr_def)\n\nlemma [simp]: \"wfs \\ \\ w = (lastWr \\ x) \\ valid_fresh_ts \\ w ts' \\\n lastWr (write_trans t b w v \\ ts') x = (x, ts')\"\n apply (simp add: valid_fresh_ts_def)\n by (simp add: lastWr_def max.strict_order_iff)\n\nlemma [simp]: \"wfs \\ \\ w \\ lastWr \\ x \\ w \\ writes_on \\ x \\ valid_fresh_ts \\ w ts' \\\n lastWr (write_trans t b w v \\ ts') x = lastWr \\ x\"\n apply (subst lastWr_def) apply(case_tac \"var w = x\") apply simp_all defer\n apply (simp add: lastWr_def)\n apply (simp add: valid_fresh_ts_def)\n by (metis dual_order.order_iff_strict lastWr_def last_write_max last_write_write_on max.absorb2 prod.exhaust_sel sndI tst_def var_def writes_on_var)\n\nlemma [simp]: \" wfs \\ \\ var w \\ x \\ value (write_trans t b w v \\ ts')(lastWr \\ x) = value \\ (lastWr \\ x)\"\n by(simp add: value_def)\n \n\nlemma [simp]: \"wfs \\ \\ w = lastWr \\ x \\ valid_fresh_ts \\ w ts' \\lastWr (update_trans t w v' \\ ts') x = (x, ts')\"\n apply (subst lastWr_def) apply simp\n by (simp add: lastWr_def less_eq_rat_def max.absorb1 valid_fresh_ts_def)\n\nlemma [simp]: \"wfs \\ \\ w \\ lastWr \\ x \\ w \\ writes_on \\ x \\ valid_fresh_ts \\ w ts' \\\n lastWr (update_trans t w v' \\ ts') x = lastWr \\ x\"\n apply (subst lastWr_def) apply(case_tac \"var w = x\") apply simp_all\n by (metis lastWr_def last_write_max last_write_write_on less_eq_rat_def max_def prod.collapse snd_conv tst_def valid_fresh_ts_def var_def writes_on_var)\n\nlemma modView_lte_last: \"wfs \\ \\ tst(modView \\ w x) \\ tst(lastWr \\ x)\"\n using last_write_max wfs_def by blast\n\n \n\n\ndefinition \"p_obs \\ t x u \\ \\ w. w \\ visible_writes \\ t x \\ u = value \\ w\" \n\ndefinition \"d_obs \\ view x u \\ view x = lastWr \\ x \\ value \\ (lastWr \\ x) = u\"\n\ndefinition \"d_obs_t \\ t x u \\ d_obs \\ (thrView \\ t) x u\"\n\ndefinition \"c_obs \\ x u t y v \\ \n \\ w \\ visible_writes \\ t x. value \\ w = u \\\n d_obs \\ (modView \\ w) y v \\\n releasing \\ w\"\n\nlemma c_obs_intro:\n assumes \"\\ w. \\w \\ writes \\ ; var w = x ; tst(thrView \\ t x) \\ tst w; value \\ w = u\\ \\ releasing \\ w\"\n and \"\\ w. \\w \\ writes \\ ; var w = x ; tst(thrView \\ t x) \\ tst w; value \\ w = u\\ \\ modView \\ w y = lastWr \\ y\"\n and \"\\ w. \\w \\ writes \\ ; var w = x ; tst(thrView \\ t x) \\ tst w; value \\ w = u\\ \\ value \\ (lastWr \\ y) = v\"\n shows \"c_obs \\ x u t y v\"\n apply(simp add: c_obs_def d_obs_def)\n using assms apply(simp add: visible_writes_def)\n by (metis (mono_tags, lifting) CollectD prod.sel(2) tst_def writes_on_def) \n\nabbreviation p_obs_abbr:: \"nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100, 100, 100, 100])\n where \"[x \\\\<^sub>t u] \\ \\ p_obs \\ t x u\"\n\nabbreviation d_obs_abbr:: \"nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ =\\<^sub>_ _] _\" [100, 100, 100, 100])\n where \"[x =\\<^sub>t u] \\ \\ d_obs_t \\ t x u\"\n\nabbreviation c_obs_abbr:: \"nat \\ nat \\ nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ = _]\\<^sub>_\\_ = _ \\ _\" [100, 100, 100, 100, 100, 100])\n where \"[x = u]\\<^sub>t\\y = v\\ \\ \\ c_obs \\ x u t y v\"\n\n\n\nlemma d_obs_lastWr_visible: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ w \\ visible_writes \\ t x \\ w = lastWr \\ x\"\n apply (simp add: tst_def d_obs_def d_obs_t_def lastWr_def var_def visible_writes_def, auto)\n by (metis dual_order.antisym lastWr_def last_write_max last_write_write_on prod.collapse tst_def var_def writes_on_var)\n\n\n\nlemma d_obs_implies_p_obs: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ [x \\\\<^sub>t u] \\\"\n apply(simp add: d_obs_t_def d_obs_def p_obs_def) using lastWr_visible\n by (metis lastWr_def)\n\n\nlemma d_obs_p_obs_agree: \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ [x \\\\<^sub>t v] \\ \\ u = v\"\n apply(unfold p_obs_def d_obs_t_def d_obs_def visible_writes_def)apply clarsimp\n by (metis eq_snd_iff fst_conv lastWr_def last_write_max leD order.not_eq_order_implies_strict tst_def var_def writes_on_var)\n\nlemma not_p_obs_implies_c_obs: \"\\ [x \\\\<^sub>t u] \\ \\ [x = u]\\<^sub>t\\y = v\\ \\\"\n by(auto simp add: p_obs_def c_obs_def)\n\nlemma d_obs_same_val: \"[x =\\<^sub>t u] \\ \\ [x =\\<^sub>t v] \\ \\ v = u\"\n by (simp add: d_obs_def d_obs_t_def)\n\nlemmas update_simps = \n valid_fresh_ts_def visible_writes_def \n update_trans_def update_thrView_def update_modView_def \n rev_app_def Let_def add_cv_def update_mods_def\n\n\n\n\n\n(*********** Transition Inference Rules Follow ****************)\n\nlemma d_obs_Wr_set : \\ \\Rule: DV-set\\\n assumes \"wfs \\\"\n and \"wr_val a = Some v\"\n and \"avar a = x\"\n and \"d_obs_t \\ t x u\"\n and \"step t a \\ \\'\"\n shows \"d_obs_t \\' t x v\"\n apply(rule step_cases[OF assms(5)])\n using assms(2) apply simp\n apply(unfold d_obs_t_def d_obs_def) apply simp apply clarsimp\n apply(case_tac \"xa = x\")\n using assms(1) apply simp apply(drule d_obs_lastWr_visible[OF assms(1) assms(4)])\n apply simp using assms(2) apply simp apply(unfold value_def) \n using assms(3) visible_var apply(case_tac \"x = aa\") apply simp apply (simp add: lastWr_def) \n apply clarsimp apply(case_tac \"xa = x\") \n using assms(1) apply simp using assms(3) apply auto[1]\n using assms(1) apply clarsimp apply(case_tac \"xa = x\") apply simp\n apply(drule d_obs_lastWr_visible[OF assms(1) assms(4)])\n using assms(2) apply simp apply(case_tac \"releasing \\ (lastWr \\ x)\")\n apply (simp add: ts_oride_def)using modView_lte_last[OF assms(1)]\n apply (simp add: valid_fresh_ts_def)\n apply (metis dual_order.antisym less_eq_rat_def less_irrefl order_trans)\n apply simp\n using assms(3) visible_var by force\n\ncorollary d_obs_WrX_set : \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ \\ [x := v]\\<^sub>t \\' \\ [x =\\<^sub>t v] \\' \"\n by (metis WrX_def avar.simps(2) d_obs_Wr_set wr_val.simps(1))\n\ncorollary d_obs_WrR_set : \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ \\ [x :=\\<^sup>R v]\\<^sub>t \\' \\ [x =\\<^sub>t v] \\' \"\n by (metis WrR_def avar.simps(2) d_obs_Wr_set wr_val.simps(1))\n\ncorollary d_obs_RMW_set : \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ \\ RMW[x,w,v]\\<^sub>t \\' \\ [x =\\<^sub>t v] \\' \"\n using avar.simps(3) d_obs_Wr_set wr_val.simps(2) by blast\n\n\n\nlemma d_obs_Rd_pres:\n assumes a1: \"wfs \\\"\n and a2: \"isRd a\"\n and a4: \"d_obs_t \\ t x u\"\n and a5: \"step t a \\ \\'\" \n shows \"d_obs_t \\' t x u\"\n apply(rule step_cases[OF a5])\n apply (case_tac \"avar a = x\") apply simp\n apply (unfold d_obs_t_def d_obs_def)\n defer\n defer\n using a2 isRd.simps(2) apply blast\n using a2 isRd.simps(3) apply blast\n apply (unfold read_trans_def Let_def)\n apply (case_tac \"b = False\")\n apply (simp add: d_obs_def d_obs_lastWr_visible d_obs_t_def rev_app_def syncing_def update_thrView_def)\n using a1 a4 \n apply (smt d_obs_def d_obs_lastWr_visible d_obs_t_def fun_upd_triv lastWr_def prod.collapse prod.inject surrey_state.surjective surrey_state.update_convs(2) var_def)\n using a1 a4 apply (simp add: d_obs_def d_obs_t_def lastWr_def rev_app_def ts_oride_def tst_def update_thrView_def value_def var_def wfs_def writes_on_def)\n apply clarsimp\n apply (metis a1 a4 d_obs_lastWr_visible fst_conv lastWr_def snd_conv tst_def var_def visible_var writes_on_def)\n using assms apply (simp add: d_obs_def d_obs_t_def lastWr_def rev_app_def ts_oride_def tst_def update_thrView_def value_def var_def wfs_def writes_on_def)\n apply (intro conjI impI)\n apply (unfold visible_writes_def writes_on_def var_def, simp_all)\n apply (metis (no_types, lifting) a1 a4 d_obs_def d_obs_t_def dual_order.antisym modView_lte_last old.prod.inject prod.collapse tst_def)\n by auto\n\ncorollary d_obs_RdX_pres: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ \\ [v \\ x]\\<^sub>t \\' \\ [x =\\<^sub>t u] \\' \"\n using RdX_def d_obs_Rd_pres by force\n\ncorollary d_obs_RdA_pres: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ \\ [v \\\\<^sup>A x]\\<^sub>t \\' \\ [x =\\<^sub>t u] \\'\"\n using RdA_def d_obs_Rd_pres by force\n\nlemma [simp]: \"var w \\ x \\ lastWr (update_trans t w v' \\ ts') x = lastWr \\ x\"\n by(simp add: lastWr_def)\n\n \n\nlemma \"d_obs_other\": \\ \\Rule: DV-Other\\\n assumes \"wfs \\\"\n and \"avar a \\ x\"\n and \"d_obs_t \\ t x u\"\n and \"step t a \\ \\'\" \n shows \"d_obs_t \\' t x u\"\n apply(rule step_cases[OF assms(4)])\n using assms(2, 3) apply simp\n apply (unfold d_obs_t_def d_obs_def)\n apply (case_tac \"b = False\")\n apply (simp add: lastWr_def read_trans_def rev_app_def syncing_def update_thrView_def value_def)\n apply (unfold writes_on_def)\n apply (metis (no_types, lifting) Collect_cong assms(2) surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(2) visible_var)\n apply (unfold read_trans_def Let_def) \n apply (simp add: lastWr_def rev_app_def ts_oride_def tst_def update_thrView_def value_def var_def wfs_def writes_on_def)\n using assms(1,2,3) apply (unfold tst_def d_obs_def d_obs_t_def wfs_def writes_on_def le_neq_trans modView_lte_last)\n apply clarsimp\n apply (metis (no_types, lifting) assms(1) dual_order.antisym fst_conv modView_lte_last prod.collapse snd_conv tst_def var_def visible_var)\n using assms (2, 3) apply simp \n apply (unfold d_obs_t_def d_obs_def)\n apply (intro conjI) \n using assms(2) apply (metis visible_var)\n using visible_var \n apply(case_tac \"b = False\")\n apply clarsimp \n apply(rule conjI)\n using assms(1) \n apply(unfold visible_writes_def)\n apply clarsimp\n apply simp\n apply simp \n using assms (2,3)\n apply simp \n apply (simp add: d_obs_t_def d_obs_def)\n apply clarsimp\n apply (rule conjI)\n apply (case_tac \"aa = x\")\n apply (simp add: var_def writes_on_def)\n apply simp\n apply (case_tac \"releasing \\ (aa, b)\")\n apply(simp add: ts_oride_def tst_def var_def)\n apply (metis dual_order.antisym modView_lte_last prod.collapse tst_def)\n apply(simp add: ts_oride_def tst_def var_def)\n apply (case_tac \"aa = x\")\n apply (simp add: var_def writes_on_def)\n apply simp\n by(simp add: value_def tst_def)\n\n\ncorollary d_obs_RdX_other: \n \"wfs \\ \\ x \\ y \\ [x =\\<^sub>t u] \\ \\ \\ [v \\ y]\\<^sub>t \\' \\[x =\\<^sub>t u] \\'\"\n by (metis RdX_def avar.simps(1) d_obs_other)\n\ncorollary d_obs_RdA_other: \n \"wfs \\ \\ x \\ y \\ [x =\\<^sub>t u] \\ \\ \\ [v \\\\<^sup>A y]\\<^sub>t \\' \\[x =\\<^sub>t u] \\'\"\n by (metis RdA_def avar.simps(1) d_obs_other)\n\ncorollary d_obs_WrX_other: \n \"wfs \\ \\ x \\ y \\ [x =\\<^sub>t u] \\ \\ \\ [y := v]\\<^sub>t \\' \\[x =\\<^sub>t u] \\'\"\n by (metis WrX_def avar.simps(2) d_obs_other)\n\ncorollary d_obs_WrR_other:\n \"wfs \\ \\ x \\ y \\ [x =\\<^sub>t u] \\ \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\[x =\\<^sub>t u] \\'\"\n by (metis WrR_def avar.simps(2) d_obs_other)\n\ncorollary d_obs_RMW_other:\n \"wfs \\ \\ x \\ y \\ [x =\\<^sub>t u] \\ \\ \\ RMW[y, v, v']\\<^sub>t \\' \\[x =\\<^sub>t u] \\'\"\n using d_obs_other by force\n\n\n\n\nlemma p_obs_Rd_intro: \\ \\Rule: OB-Intro\\\n assumes \"wfs \\\"\n and \"isRd a\"\n and \"rd_val a = Some v\"\n and \"avar a = x\"\n and \"step t a \\ \\'\"\n shows \"p_obs \\' t x v\"\n using assms\n apply (simp add: p_obs_def step_def, auto)\n apply (cases a, auto)\n apply (simp add: read_trans_def rev_app_def)\n apply (unfold value_def rev_app_def valid_fresh_ts_def read_trans_def visible_writes_def wfs_def p_obs_def step_def, auto)\n apply (unfold writes_on_def tst_def update_thrView_def, safe)\n apply (case_tac \"syncing \\ (x, ba) x11\", clarsimp)\n apply (metis (no_types, lifting) eq_refl fun_upd_same sndI ts_oride_def)\n apply clarsimp\n by auto[1]\n\ncorollary p_obs_RdX_intro:\n \"wfs \\ \\ \\ [v \\ x]\\<^sub>t \\' \\ [x \\\\<^sub>t v] \\'\"\n by (metis RdX_def avar.simps(1) isRd.simps(1) p_obs_Rd_intro rd_val.simps(1))\n\ncorollary p_obs_RdA_intro:\n \"wfs \\ \\ \\ [v \\\\<^sup>A x]\\<^sub>t \\' \\ [x \\\\<^sub>t v] \\'\"\n by (metis RdA_def avar.simps(1) isRd.simps(1) p_obs_Rd_intro rd_val.simps(1))\n\n\n\n\n\n\nlemma [simp]: \"var w \\ y \\ lastWr (write_trans t b w u \\ ts') y = lastWr \\ y\"\n by(simp add: lastWr_def)\n\nlemma [simp]:\n \"var w' = var w \\ tst w' = ts' \\ releasing (update_trans t w v' \\ ts') (var w', tst w')\"\n by(simp add: releasing_def)\n\nlemma [simp]:\n \"var w' = var w \\ tst w' = ts' \\ releasing (write_trans t b w v' \\ ts') (var w', tst w') = b\"\n by(simp add: releasing_def)\n\nlemma c_obs_Wr_intro: \n assumes \"wfs \\\"\n and \"wr_val a = Some u\"\n and \"avar a = x\"\n and \"isRA a\"\n and \"isWr a\"\n and \"d_obs_t \\ t y v\"\n and \"\\ p_obs \\ t' x u\" \n and \"x \\ y\" \n and \"step t a \\ \\'\"\n and \"t'\\ t\"\nshows \"c_obs \\' x u t' y v\"\n apply(rule step_cases[OF assms(9)]) \n using assms(2) apply auto[1] defer \n using assms(5) apply auto[1]\n using assms(2,3,4,5,6,7) apply clarsimp\n apply (case_tac \"aa \\ x\")\n using visible_var apply fastforce\n apply clarsimp\n apply(simp add: d_obs_t_def d_obs_def p_obs_def c_obs_def)\n apply clarsimp\n apply (case_tac \"aa \\ x\")\n using visible_var apply fastforce\n apply (case_tac \"bb = ts'\") defer\n apply(case_tac \"value (write_trans t True (x, b) u \\ ts')(x, bb) = value \\ (x, bb)\")\n apply (simp add: visible_writes_def)\n using assms(10) apply simp apply blast\n apply(simp add: value_def)\n apply simp \n apply(rule conjI)\n apply clarsimp\n using assms(8) apply clarsimp \n using assms apply (simp, auto)\n by(simp add: releasing_def)\n\n\ncorollary c_obs_WrR_intro: \n \"wfs \\ \\ x \\ y \\ t' \\ t \n \\ [y =\\<^sub>t v] \\ \\ \\ [x \\\\<^sub>t' u] \\ \n \\ \\ [x :=\\<^sup>R u]\\<^sub>t \\'\n \\ [x = u]\\<^sub>t'\\y = v\\ \\'\"\n by (metis WrR_def avar.simps(2) c_obs_Wr_intro isRA.simps(2) isWr.simps(2) wr_val.simps(1))\n\n\n\nlemma c_obs_Up_intro: \n assumes as1: \"wfs \\\"\n and as2: \"wr_val a = Some u\"\n and as3: \"avar a = x\"\n and as4: \"isUp a\"\n and as5: \"d_obs_t \\ t y v\"\n and as6: \"\\ p_obs \\ t' x u\" \n and as7: \"x \\ y\" \n and as8: \"step t a \\ \\'\"\n and as9: \"t' \\ t\"\nshows \"c_obs \\' x u t' y v\"\n apply(rule step_cases[OF assms(8)]) \n using as2 apply auto[1] \n using as4 apply auto[1] \n using assms apply safe\nproof -\n fix aa b xa va v' ts'\n assume a1: \"wfs \\\" and\n a2: \"wr_val (Update xa (value \\ (aa, b)) v') = Some u\" and\n a3: \"isUp (Update xa (value \\ (aa, b)) v')\" and\n a4: \"[y =\\<^sub>t v] \\\" and\n a5: \"\\ [avar (Update xa (value \\ (aa, b)) v') \\\\<^sub>t' u] \\ \" and\n a6: \"avar (Update xa (value \\ (aa, b)) v') \\ y\" and \n a7: \"\\ RMW[xa, value \\ (aa, b), v']\\<^sub>t (update_trans t (aa, b) v' \\ ts')\" and \n a8: \"t' \\ t\" and\n a9: \"x = avar (Update xa (value \\ (aa, b)) v')\" and \n a10: \"\\' = update_trans t (aa, b) v' \\ ts'\" and \n a11: \"a = Update xa (value \\ (aa, b)) v'\" and \n a12: \"(aa, b) \\ visible_writes \\ t (avar (Update xa (value \\ (aa, b)) v'))\" and\n a13: \"(aa, b) \\ covered \\\" and \n a14: \"valid_fresh_ts \\ (aa, b) ts'\"\n show g: \"[avar (Update xa (value \\ (aa, b)) v') = u]\\<^sub>t'\\y = v \\ (update_trans t (aa, b) v' \\ ts')\"\n using a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 apply (simp add: update_simps step_def d_obs_def p_obs_def d_obs_t_def c_obs_def)\n apply (case_tac \"releasing \\ (aa, b)\", safe)\n apply (simp add: tst_def releasing_def)\n apply ((metis fst_conv var_def writes_on_var)+) [9]\n using as8 dual_order.antisym fun_upd_other \n apply (smt as3 as5 d_obs_def d_obs_other d_obs_t_def fun_upd_eqD fun_upd_triv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\n apply auto[1]\n using as3 as5 as8 d_obs_def d_obs_other d_obs_t_def apply blast\n using as3 as5 as8 d_obs_def d_obs_other d_obs_t_def apply blast\n apply auto[1]\n apply(simp add: releasing_def)\n apply (smt Pair_inject fun_upd_other fun_upd_same surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) write_record.select_convs(2)) \n apply (simp add:tst_def var_def wfs_def wfs_preserved writes_on_def) \n apply clarify\n using as8 fst_conv mem_Collect_eq fun_upd_same not_less_iff_gr_or_eq snd_conv\n apply (smt surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\n apply (metis fst_conv var_def writes_on_var)\n apply (metis fst_conv var_def writes_on_var)\n apply (metis fst_conv var_def writes_on_var)\n apply (simp add: tst_def releasing_def) apply auto[1]\n apply (smt Pair_inject fun_upd_other insert_iff mem_Collect_eq surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(4) surrey_state.update_convs(5) value_def writes_on_def)\n using fst_conv insert_iff fun_upd_apply less_imp_not_less not_less_iff_gr_or_eq \n apply (smt fun_upd_same surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\n apply (case_tac \"releasing \\ (aa, b)\", auto)[1]\n using as3 as5 as8 d_obs_def d_obs_other d_obs_t_def apply blast\n using as3 as5 as8 d_obs_def d_obs_other d_obs_t_def apply blast\n apply (case_tac \"releasing \\ (aa, b)\", auto)[1]\n apply (simp add: tst_def releasing_def value_def) apply auto[1]\n apply (metis fst_conv var_def writes_on_var)\n apply (unfold writes_on_def var_def) [1]\n apply clarsimp apply auto[1]\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp apply blast\n apply ((metis fst_conv var_def writes_on_var)+)[9]\n apply (case_tac \"releasing \\ (aa, b)\", auto)[1]\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n using not_less_iff_gr_or_eq apply blast\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply (smt as5 as8 assms(3) d_obs_def d_obs_other d_obs_t_def fun_upd_same fun_upd_triv fun_upd_twist surrey_state.select_convs(2) surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\n apply auto[1]\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n using not_less_iff_gr_or_eq apply blast\n using as3 as5 as8 d_obs_def d_obs_other d_obs_t_def apply blast\n apply auto[1]\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply blast\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply blast\n apply (metis fst_conv var_def writes_on_var)\n apply (metis fst_conv var_def writes_on_var)\n apply (metis fst_conv var_def writes_on_var)\n apply auto[1]\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply safe[1]\n apply (simp add: tst_def a11 a12 a13)\n apply(simp add: lastWr_def )apply(unfold writes_on_def)apply simp\n apply (smt Collect_cong Pair_inject fst_conv fun_upd_other fun_upd_same surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) var_def)\n apply (simp add: tst_def a11 a12 a13)\n apply(simp add: lastWr_def )apply(unfold writes_on_def)apply simp\n apply (smt leD less_irrefl tst_def)\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply (smt Pair_inject fun_upd_same surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n apply blast\n apply (unfold writes_on_def var_def releasing_def value_def) [1]\n apply clarsimp \n by blast\nqed\n\n\ncorollary c_obs_RMW_intro: \n \"wfs \\ \\ x \\ y \\ t' \\ t \n \\ [y =\\<^sub>t v] \\ \\ \\ [x \\\\<^sub>t' u] \\ \n \\ \\ RMW[x, w, u]\\<^sub>t \\'\n \\ [x = u]\\<^sub>t'\\y = v\\ \\'\"\n using avar.simps(3) c_obs_Up_intro isUp.simps(3) wr_val.simps(2) by blast\n\n\n\n\nlemma c_obs_Rd_d_obs: \\ \\Transfer\\\n assumes \"wfs \\\"\n and \"isRd a\"\n and \"isRA a\"\n and \"rd_val a = Some u\"\n and \"avar a = x\"\n and \"c_obs \\ x u t y v\"\n and \"step t a \\ \\'\"\nshows \"d_obs_t \\' t y v\"\n apply(rule step_cases[OF assms(7)]) \n defer\n using assms(2) apply simp\n using assms(2) apply simp\n using assms(6) apply clarsimp\n using assms(6) apply clarsimp\n apply(case_tac \"aa \\ x\")\n using assms(5) visible_var apply fastforce\n apply clarsimp\n apply (case_tac \"\\ syncing \\ (x,b) True\")\n apply (metis assms(4) c_obs_def option.sel prod.sel(1) rd_val.simps(1) syncing_def var_def visible_var)\n apply clarsimp\n using assms(3, 4, 5) apply clarsimp\n apply (simp add: c_obs_def d_obs_t_def d_obs_def)\n apply (rule conjI)\n using assms(1)\n apply(unfold ts_oride_def visible_writes_def wfs_def)\n apply (simp add: lastWr_def var_def)\n apply(unfold lastWr_def read_trans_def rev_app_def update_thrView_def value_def writes_on_def)\n by auto\n\ncorollary c_obs_RdA_d_obs: \n \"wfs \\ \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ [u \\\\<^sup>A x]\\<^sub>t \\' \\ [y =\\<^sub>t v] \\'\"\n by (metis RdA_def avar.simps(1) c_obs_Rd_d_obs isRA.simps(1) isRd.simps(1) rd_val.simps(1))\n\n\n\nlemma c_obs_Up_d_obs:\n assumes \"wfs \\\"\n and \"isUp a\"\n and \"rd_val a = Some u\"\n and \"avar a = x\"\n and \"c_obs \\ x u t y v\"\n and \"step t a \\ \\'\"\n and \"x \\ y\"\nshows \"d_obs_t \\' t y v\"\n apply(rule step_cases[OF assms(6)]) \n using assms(2) isUp.simps(1) apply blast\n using assms(3) apply auto[1]\n using assms(2,3,4,5,7)\n apply clarsimp\n apply(case_tac \"aa \\ x\")\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def)\n apply(elim conjE)\n apply simp\n apply clarsimp\n apply(simp add: c_obs_def d_obs_t_def d_obs_def)\n apply(intro conjI)\n apply(simp add: ts_oride_def)\n apply(intro conjI impI)\n using assms(1) last_write_max wfs_def apply blast\n apply (simp add: valid_fresh_ts_def)\n apply(simp add: lastWr_def)\n apply(unfold writes_on_def, simp, elim conjE)\n by(simp add: value_def)\n \ncorollary c_obs_UpRA_d_obs: \n \"wfs \\ \\ x\\y \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ RMW[x, u, z]\\<^sub>t \\' \\ [y =\\<^sub>t v] \\'\"\n using avar.simps(3) c_obs_Up_d_obs isUp.simps(3) rd_val.simps(2) by blast\n\n\n\n\n\n\nlemma [simp]: \"z \\ x \\ visible_writes (write_trans t b (z, ts) v \\ ts') t x = visible_writes \\ t x\"\n by(simp add: visible_writes_def)\n\nlemma [simp]: \"var w \\ z \\value (write_trans t ba (z, b) va \\ ts') w = value \\ w\"\n by(simp add: value_def)\n\nlemma [simp]: \"var w \\ z \\ releasing (write_trans t ba (z, b) va \\ ts') w = releasing \\ w \"\n by(simp add: releasing_def)\n\nlemma [simp]: \"var w \\ z \\ z \\ y \\ d_obs(write_trans t ba (z, b) va \\ ts')(modView \\ w) y v = d_obs \\ (modView \\ w) y v\"\n by(simp add: d_obs_def)\n \nlemma c_obs_Rd_pres:\n assumes \"wfs \\\"\n and \"isRd a\"\n and \"c_obs \\ x u t y v\"\n and \"step t' a \\ \\'\"\n and \"x \\ y\"\n and \"\\isRA a\"\n and \"t \\ t'\"\nshows \"c_obs \\' x u t y v\"\n apply(rule step_cases[OF assms(4)]) \n defer\n using assms(2) apply auto[2] \n using assms(1,2,3,5,6,7)\n apply(elim conjE)\n apply(simp add: c_obs_def d_obs_def visible_writes_def)\n apply(unfold writes_on_def, clarsimp)\n apply(intro conjI)\n apply(simp add: read_trans_def rev_app_def Let_def update_modView_def update_thrView_def)\n apply (smt action.simps(10) assms(4) lastWr_read_pres step_def)\n apply (simp add: lastWr_read_pres)\n by(simp add: releasing_def)\n\n\ncorollary c_obs_RdX_pres:\n \"wfs \\ \\ x \\ y \\ t \\ t'\n \\ [x=u]\\<^sub>t\\y=v\\ \\ \\ \\ [k \\ z]\\<^sub>t' \\'\n \\ [x=u]\\<^sub>t\\y=v\\ \\'\"\n by (metis (full_types) RdX_def c_obs_Rd_pres isRA.simps(1) isRd.simps(1))\n\n\n\n\nlemma c_obs_Wr_pres:\n assumes \"wfs \\\"\n and \"avar a = z\"\n and \"isWr a\"\n and \"z \\ y\"\n and \"z \\x\"\n and \"x \\ y\"\n and \"c_obs \\ x u t y v\"\n and \"step t a \\ \\'\"\nshows \"c_obs \\' x u t y v\"\n apply(rule step_cases[OF assms(8)]) \n using assms(3) apply clarsimp defer\n using assms(3) apply clarsimp\n using assms(2,3,4,5,6,7) apply clarsimp\n apply (case_tac \"aa \\ z\")\n using visible_var apply force\n apply clarsimp\n by (simp add: c_obs_def) \n\ncorollary c_obs_WrX_pres:\n \"wfs \\ \\ z \\ y \\ z \\ x \\ x \\ y \n \\ [x=u]\\<^sub>t\\y=v\\ \\ \\ \\ [z:= w]\\<^sub>t \\'\n \\ [x=u]\\<^sub>t\\y=v\\ \\'\"\n by (metis WrX_def avar.simps(2) c_obs_Wr_pres isWr.simps(2))\n\ncorollary c_obs_WrR_pres:\n \"wfs \\ \\ z \\ y \\ z \\ x \\ x \\ y \n \\ [x=u]\\<^sub>t\\y=v\\ \\ \\ \\ [z:=\\<^sup>R w]\\<^sub>t \\'\n \\ [x=u]\\<^sub>t\\y=v\\ \\'\"\n by (metis WrR_def avar.simps(2) c_obs_Wr_pres isWr.simps(2))\n\n\n\nlemma d_obs_c_obs: \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ x \\ y \\ u \\ m \\ [x = m]\\<^sub>t\\y = v\\ \\\"\n apply(simp add: d_obs_t_def d_obs_def c_obs_def)\n using d_obs_def d_obs_p_obs_agree d_obs_t_def p_obs_def by blast\n\n\nlemma [simp]: \"tst (x,b) < ts' \\ writes_on (write_trans t ba (x, b) va \\ ts') x = (writes_on \\ x) \\ {(x,ts')}\"\n by(simp add: visible_writes_def)\n\nlemma visible_writes_write_trans [simp]: \"wfs \\ \\ valid_fresh_ts \\ w ts' \\ t \\ t' \\ var w \\ x \\ \n visible_writes \\ t x = visible_writes (write_trans t' b w v \\ ts') t x\"\n apply(unfold visible_writes_def) by simp\n\nlemma value_not_change_write_to_different_var [simp]: \"wfs \\ \\ t \\ t' \\ w \\ visible_writes \\ t x \\ valid_fresh_ts \\ w' ts' \\\n var w \\ var w' \\ u = value \\ w \\ u = value (write_trans t' b w' v \\ ts') w\"\n apply (unfold write_trans_def rev_app_def value_def add_cv_def update_mods_def) apply simp\n apply (rule conjI)\n using visible_var apply fastforce\n by (simp add: update_modView_def update_thrView_def)\n\nlemma \"wfs \\ \\ valid_fresh_ts \\ w ts' \\ t \\ t' \\ var w \\ x \\ p_obs \\ t x u = p_obs (write_trans t' b w v \\ ts') t x u\"\n apply (unfold p_obs_def)\n apply (case_tac \" visible_writes \\ t x \\ visible_writes (write_trans t' b w v \\ ts') t x\") \n apply simp\n using value_not_change_write_to_different_var\n by (metis (full_types) visible_var) \n\n\nlemma not_p_obs_Wr_pres : \n assumes a1: \"wfs \\\"\n and a2: \"isWr a\"\n and a3: \"avar a \\ x\"\n and a4: \"t \\ t'\"\n and a5: \"\\ p_obs \\ t x u\"\n and a6: \"step t' a \\ \\'\"\n shows a7: \"\\ p_obs \\' t x u\"\n apply(rule step_cases[OF a6]) \n using a2 apply auto[1]\n defer\n using a2 apply auto[1]\n using assms\n apply simp\n apply(unfold p_obs_def) \n apply(case_tac \"var w = x\")\n apply simp \n using visible_var apply fastforce\n apply clarsimp\n apply (case_tac \"var (aa, b) = x\")\n using var_def apply auto[1]\n using visible_writes_write_trans apply simp\n using visible_var by fastforce\n\ncorollary not_p_obs_WrX_pres:\n \"wfs \\ \\ y \\ x \\ t \\ t' \n \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y := v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrX_def avar.simps(2) isWr.simps(2) not_p_obs_Wr_pres)\n\ncorollary not_p_obs_WrR_pres:\n \"wfs \\ \\ y \\ x \\ t \\ t' \n \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y :=\\<^sup>R v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrR_def avar.simps(2) isWr.simps(2) not_p_obs_Wr_pres)\n\nlemma not_p_obs_Up_pres : \n assumes a1: \"wfs \\\"\n and a2: \"isUp a\"\n and a3: \"avar a \\ x\"\n and a4: \"t \\ t'\"\n and a5: \"\\ p_obs \\ t x u\"\n and a6: \"step t' a \\ \\'\"\n shows \"\\ p_obs \\' t x u\"\n apply(rule step_cases[OF a6]) \n using a2 apply auto[2]\n apply (elim conjE)\nproof - \n fix w xa v v' ts'\n assume p1: \"\\' = update_trans t' w v' \\ ts'\" and \n p2: \"a = Update xa v v'\" and \n p3: \"w \\ visible_writes \\ t' (avar a)\" and \n p4: \"v = value \\ w\" and \n p5: \"w \\ covered \\\" and\n p6: \"valid_fresh_ts \\ w ts'\"\n show \"\\ (p_obs (update_trans t' w v' \\ ts') t x u) \"\n using p3 p4 p5 p6 \n apply(simp add: p_obs_def) \n apply (simp add: Let_def update_trans_def step_def rev_app_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply (case_tac \"releasing \\ w\", auto)\n apply (simp add:visible_writes_def valid_fresh_ts_def ts_oride_def, auto)\n apply(unfold writes_on_def tst_def tst_def value_def var_def visible_var visible_writes_def writes_on_def)\n apply clarsimp\n apply (smt a3 a4 a5 fst_conv fun_upd_other fun_upd_other insert_iff mem_Collect_eq old.prod.inject p3 p_obs_def snd_conv surrey_state.select_convs(1) surrey_state.select_convs(2) surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) tst_def value_def var_def visible_var visible_writes_def writes_on_def)\n using a1 a2 a3 a4 a5 a6 apply auto\n apply (simp add: tst_def value_def var_def p_obs_def is_releasing_def visible_writes_def valid_fresh_ts_def ts_oride_def, auto)\n apply(unfold wfs_def writes_on_def tst_def tst_def value_def var_def visible_var visible_writes_def writes_on_def)\n apply clarsimp\n by (smt Pair_inject fun_upd_other insert_iff surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5))\nqed\n\ncorollary not_p_obs_RMW_pres:\n \"wfs \\ \\ y \\ x \\ t \\ t' \n \\ \\ [x \\\\<^sub>t u] \\ \\ \\ RMW[y, v, w]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n using not_p_obs_Up_pres by force\n\nlemma neg_pobs_val:\n assumes \"isRd a\"\n and \"\\ p_obs \\ t x u\"\n and \"step t a \\ \\''\"\n and \"avar a = x\"\n shows \"rd_val a \\ Some u\"\n using assms \n apply (simp add: step_def)\n apply (elim exE conjE)\n apply (cases rule: action.exhaust[where y = a], auto) \n using p_obs_def by blast \n\nlemma visible_writes_subset:\n assumes \"wfs \\\" \n and \"isRd a\"\n and \"step t a \\ \\'\"\n and \"avar a = x\"\n shows \"visible_writes \\' t x \\ visible_writes \\ t x\"\n using assms \n apply (simp add: step_def)\n apply (elim exE conjE)\n apply (cases rule: action.exhaust[where y = a], auto) \n apply (simp add: visible_writes_def)\n apply (elim conjE)\n apply (cases \"isRA a\", auto)\n apply (unfold writes_on_def wfs_def read_trans_def ts_oride_def tst_def update_thrView_def rev_app_def, auto)\n by (smt fun_upd_same order_trans snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2))\n\nlemma not_pobs_Rd_pres:\n assumes \"isRd a\"\n and \"\\ p_obs \\ t x u \"\n and \"step t' a \\ \\'\"\n shows \"\\ p_obs \\' t x u\"\n using assms \n apply (cases \"t = t'\", auto)\n apply(rule step_cases[OF assms(3)]) \n apply simp\n apply (unfold p_obs_def read_trans_def update_thrView_def value_def visible_writes_def writes_on_def)\n apply auto \n apply (smt action.simps(10) dual_order.trans fun_upd_same fun_upd_triv fun_upd_twist mem_Collect_eq read_trans_def rev_app_def step_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) ts_oride_def update_thrView_def visible_writes_def writes_on_var)\n by (smt action.simps(10) fun_upd_other isRd.elims(2) read_trans_def rev_app_def step_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def) \n\ncorollary not_pobs_RdX_pres:\n \"\\ [x \\\\<^sub>t u] \\ \\ \\ [v \\ y]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis RdX_def not_pobs_Rd_pres isRd.simps(1))\n\ncorollary not_pobs_RdA_pres:\n \"\\ [x \\\\<^sub>t u] \\ \\ \\ [v \\\\<^sup>A y]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis RdA_def isRd.simps(1) not_pobs_Rd_pres)\n\n\n\nlemma not_p_obs_Wr_val_pres:\n assumes \"isWr a\"\n and \"\\ p_obs \\ t x u\"\n and \"step t' a \\ \\'\"\n and \"wr_val a = Some v\"\n and \"u \\ v\"\n shows \"\\ p_obs \\' t x u\"\n using assms \n apply (cases \"t = t'\", auto)\n apply(rule step_cases[OF assms(3)]) \n apply (simp, auto)\n apply (unfold p_obs_def write_trans_def update_thrView_def step_def update_modView_def)\n apply auto \n apply (unfold rev_app_def tst_def update_mods_def add_cv_def valid_fresh_ts_def value_def writes_on_def visible_writes_def)\n apply safe\n apply (cases \"avar a = x\", safe, clarsimp)\n apply (smt dual_order.strict_implies_order dual_order.trans write_record.select_convs(1))\n apply clarsimp\n apply blast\n apply (cases \"a\", auto)\n by (smt write_record.select_convs(1))\n\ncorollary not_p_obs_WrX_val_pres:\n \"u \\ v \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y := v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrX_def isWr.simps(2) not_p_obs_Wr_val_pres wr_val.simps(1))\n\ncorollary not_p_obs_WrR_val_pres:\n \"u \\ v \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y :=\\<^sup>R v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrR_def isWr.simps(2) not_p_obs_Wr_val_pres wr_val.simps(1))\n\n\nlemma not_p_obs_Wr_diff_var_pres:\n assumes \"isWr a\"\n and \"\\ p_obs \\ t x u\"\n and \"step t' a \\ \\'\"\n and \"avar a = y\"\n and \"x \\ y\"\n shows \"\\ p_obs \\' t x u\"\n using assms \n apply (cases \"t = t'\", auto)\n apply(rule step_cases[OF assms(3)]) \n apply (simp, auto)\n apply (unfold p_obs_def write_trans_def update_thrView_def step_def update_modView_def)\n apply auto \n apply (unfold rev_app_def tst_def update_mods_def add_cv_def valid_fresh_ts_def value_def writes_on_def visible_writes_def)\n apply safe\n apply clarsimp\n apply blast\n by (cases \"a\", auto)\n\ncorollary not_p_obs_WrX_diff_var_pres:\n \"x \\ y \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y := v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrX_def avar.simps(2) isWr.simps(2) not_p_obs_Wr_diff_var_pres)\n\ncorollary not_p_obs_WrA_diff_var_pres:\n \"x \\ y \\ \\ [x \\\\<^sub>t u] \\ \\ \\ [y :=\\<^sup>R v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n by (metis WrR_def avar.simps(2) isWr.simps(2) not_p_obs_Wr_diff_var_pres)\n\n\nlemma not_p_obs_Up_val_pres:\n assumes \"isUp a\"\n and \"\\ p_obs \\ t x u\"\n and \"step t' a \\ \\'\"\n and \"wr_val a = Some v\"\n and \"u \\ v\"\n shows \"\\ p_obs \\' t x u\"\n using assms \n apply (cases \"t = t'\", auto)\n apply(rule step_cases[OF assms(3)]) \n apply (simp, auto)\n apply (unfold p_obs_def update_trans_def update_thrView_def step_def update_modView_def)\n apply auto \n apply (unfold ts_oride_def Let_def tst_def rev_app_def tst_def update_mods_def add_cv_def valid_fresh_ts_def value_def writes_on_def visible_writes_def)\n apply safe\n apply (cases \"avar a = x\", safe, clarsimp)\n apply (smt Pair_inject dual_order.trans fun_upd_same fun_upd_triv fun_upd_twist insert_iff leD less_eq_rat_def not_le prod.collapse surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) write_record.select_convs(1))\n apply clarsimp\n apply (case_tac \"releasing \\ (aa, ba)\", clarsimp) \n apply (smt fun_upd_other order_trans)\n apply auto[1]\n apply(rule step_cases[OF assms(3)]) \n apply (simp, auto)\n apply (unfold p_obs_def update_trans_def update_thrView_def step_def update_modView_def)\n apply auto \n apply (unfold ts_oride_def Let_def tst_def rev_app_def tst_def update_mods_def add_cv_def valid_fresh_ts_def value_def writes_on_def visible_writes_def)\n apply safe\n apply (cases \"avar a = x\", safe, clarsimp)\n apply (smt Pair_inject dual_order.trans fun_upd_same fun_upd_triv fun_upd_twist insert_iff leD less_eq_rat_def not_le prod.collapse surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) write_record.select_convs(1))\n apply clarsimp\n by (smt write_record.select_convs(1))\n\n\ncorollary not_p_obs_RMW_val_pres:\n \"u \\ v \\ \\ [x \\\\<^sub>t u] \\ \\ \\ RMW[y, w, v]\\<^sub>t' \\' \\ \\ [x \\\\<^sub>t u] \\'\"\n using isUp.simps(3) not_p_obs_Up_val_pres wr_val.simps(2) by blast\n\n\nlemma dobs_Rd_pres:\n assumes \"isRd a\"\n and \"d_obs_t \\ t x v\"\n and \"step t' a \\ \\'\"\n and \"t \\ t'\"\n shows \"d_obs_t \\' t x v\"\n apply(rule step_cases[OF assms(3)]) \n apply (simp add: step_def d_obs_t_def d_obs_def)\n apply (elim exE conjE) \n apply (smt Collect_cong assms(2) assms(4) d_obs_def d_obs_t_def fun_upd_other lastWr_def read_trans_def rev_app_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def writes_on_def)\n using assms by auto\n\nlemma dobs_RdX_pres:\n \"t \\ t' \\ [x =\\<^sub>t v] \\ \\ \\ [u \\ y]\\<^sub>t' \\' \\ [x =\\<^sub>t v] \\'\"\n by (metis RdX_def dobs_Rd_pres isRd.simps(1))\n\nlemma dobs_RdA_pres:\n \"t \\ t' \\ [x =\\<^sub>t v] \\ \\ \\ [u \\\\<^sup>A y]\\<^sub>t' \\' \\ [x =\\<^sub>t v] \\'\"\n by (metis RdA_def dobs_Rd_pres isRd.simps(1))\n\nlemma dobs_Wr_pres:\n assumes \"isWr a\"\n and \"d_obs_t \\ t x v\"\n and \"avar a \\ x\" \n and \"step t' a \\ \\'\"\n and \"t \\ t'\"\n shows \"d_obs_t \\' t x v\"\n apply(rule step_cases[OF assms(4)]) \n using assms(1) apply auto[1]\n defer\n using assms(1) apply auto[1]\n apply(unfold d_obs_t_def d_obs_def)\n using assms\n apply simp\n apply(case_tac \"var w = x\")\n using visible_var apply fastforce\n apply (rule conjI) \n apply(unfold d_obs_def d_obs_t_def) apply simp\n by clarsimp\n\nlemma dobs_WrX_pres:\n \"t \\ t' \\ x \\ y \\ [x =\\<^sub>t v] \\ \\ \\ [y:= u]\\<^sub>t' \\' \\ [x =\\<^sub>t v] \\'\"\n by (metis WrX_def avar.simps(2) dobs_Wr_pres isWr.simps(2))\n\nlemma dobs_WrR_pres:\n \"t \\ t' \\ x \\ y \\ [x =\\<^sub>t v] \\ \\ \\ [y:=\\<^sup>R u]\\<^sub>t' \\' \\ [x =\\<^sub>t v] \\'\"\n by (metis WrR_def avar.simps(2) dobs_Wr_pres isWr.simps(2))\n\n\nlemma dobs_Up_pres:\n assumes \"isUp a\"\n and \"d_obs_t \\ t x v\"\n and \"avar a \\ x\" \n and \"step t' a \\ \\'\"\n and \"t \\ t'\"\n shows \"d_obs_t \\' t x v\"\n apply(rule step_cases[OF assms(4)]) \n using assms(1) apply auto[2]\n apply(unfold d_obs_t_def d_obs_def)\n using assms\n apply simp\n apply(case_tac \"var w = x\")\n using visible_var apply fastforce\n apply (rule conjI) \n apply(unfold d_obs_def d_obs_t_def) apply simp\n apply(unfold Let_def step_def update_mods_def valid_fresh_ts_def tst_def lastWr_def add_cv_def update_trans_def update_thrView_def update_modView_def rev_app_def) \n apply(case_tac \"releasing \\ w\") apply clarsimp\n apply (case_tac \"releasing \\ (aaa, ba)\") apply auto \n apply (simp_all add: value_def var_def writes_on_def)\n by (smt Collect_cong fst_conv var_def visible_var)+\n\n\nlemma dobs_RMW_pres:\n \"t \\ t' \\ x \\ y \\ [x =\\<^sub>t v] \\ \\ \\ RMW[y, w, u]\\<^sub>t' \\' \\ [x =\\<^sub>t v] \\'\"\n using dobs_Up_pres by force\n \n\nlemma cobs_pres:\n assumes \"c_obs \\ x u t y v\"\n and \"x \\ y\" \n and \"wfs \\\"\n and \"v' \\ u\"\n and \"step t (Read m x v') \\ \\'\"\n shows \"c_obs \\' x u t y v\"\n using assms apply (simp add: c_obs_def)\n apply (cases \"m\")\n apply (simp add: d_obs_def) apply safe[1]\n apply (smt Collect_cong action.simps(10) avar.simps(1) in_mono isRd.simps(1) lastWr_def read_trans_def rev_app_def step_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def visible_writes_subset writes_on_def)\n apply (smt Collect_cong action.simps(10) avar.simps(1) in_mono isRd.simps(1) lastWr_def read_trans_def rev_app_def step_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def visible_writes_subset writes_on_def)\n apply (simp add:visible_writes_def releasing_def step_def, clarify)\n apply (smt assms(5) avar.simps(1) in_mono isRd.simps(1) mem_Collect_eq read_trans_def rev_app_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) tst_def update_thrView_def value_def visible_writes_def visible_writes_subset)\n apply auto\n apply (simp add:visible_writes_def releasing_def step_def d_obs_def lastWr_def, auto)\n apply (smt dual_order.trans read_trans_def rev_app_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) tst_def update_thrView_def value_def)\n apply (smt dual_order.trans read_trans_def rev_app_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) tst_def update_thrView_def value_def)\n by (smt action.simps(10) avar.simps(1) in_mono isRd.simps(1) read_trans_def releasing_def rev_app_def step_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def visible_writes_subset)\n\n\nlemma cobs_Rd_pres:\n assumes \"c_obs \\ x u t y v\"\n and \"isRd a\"\n and \"rd_val a = Some w\"\n and \"x \\ y\" \n and \"wfs \\\"\n and \"w \\ u\"\n and \"step t a \\ \\'\"\n shows \"c_obs \\' x u t y v\"\n using assms apply (simp add: c_obs_def step_def)\n apply (cases \"a\", auto)\n apply (simp_all add: Let_def lastWr_def rev_app_def d_obs_def step_def read_trans_def) apply auto\n apply (unfold writes_on_def tst_def value_def visible_writes_def update_thrView_def) \n apply auto\n apply (smt dual_order.trans fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n apply (smt dual_order.trans fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n using dual_order.trans apply fastforce\n using dual_order.trans apply fastforce\n apply (smt dual_order.trans fun_upd_other fun_upd_same releasing_def snd_conv surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) ts_oride_def tst_def)\n by (smt dual_order.trans releasing_def snd_conv surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2))\n\n\nlemma cobs_RdX_pres:\n \"wfs \\ \\ x \\ y \\ w \\ u \n \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ [w \\ z]\\<^sub>t \\' \\ [x = u]\\<^sub>t\\y = v\\ \\'\"\n by (metis RdX_def cobs_Rd_pres isRd.simps(1) rd_val.simps(1))\n\nlemma cobs_RdA_pres:\n \"wfs \\ \\ x \\ y \\ w \\ u \n \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ [w \\\\<^sup>A z]\\<^sub>t \\' \\ [x = u]\\<^sub>t\\y = v\\ \\'\"\n by (metis RdA_def cobs_Rd_pres isRd.simps(1) rd_val.simps(1))\n\nlemma cobs_Rd_diff_var_pres:\n assumes \"c_obs \\ x u t y v\"\n and \"isRd a\"\n and \"avar a \\ x\"\n and \"x \\ y\" \n and \"wfs \\\"\n and \"step t' a \\ \\'\"\n shows \"c_obs \\' x u t y v\"\n apply(rule step_cases[OF assms(6)]) \n defer\n using assms(2) apply auto[2]\n using assms(1,2,3,4,5)\n apply (simp add: c_obs_def)\n apply (simp_all add: Let_def lastWr_def rev_app_def d_obs_def step_def read_trans_def)\n apply (unfold writes_on_def tst_def value_def visible_writes_def update_thrView_def)\n apply simp\n by (smt fun_upd_other order.trans releasing_def surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) ts_oride_def tst_def)\n\nlemma cobs_RdX_diff_var_pres:\n \"wfs \\ \\ x \\ y \\ x \\ z\n \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ [w \\ z]\\<^sub>t' \\' \\ [x = u]\\<^sub>t\\y = v\\ \\'\"\n by (metis RdX_def avar.simps(1) cobs_Rd_diff_var_pres isRd.simps(1))\n\nlemma cobs_RdA_diff_var_pres:\n \"wfs \\ \\ x \\ y \\ x \\ z\n \\ [x = u]\\<^sub>t\\y = v\\ \\ \\ \\ [w \\\\<^sup>A z]\\<^sub>t' \\' \\ [x = u]\\<^sub>t\\y = v\\ \\'\"\n by (metis RdA_def avar.simps(1) cobs_Rd_diff_var_pres isRd.simps(1))\n\n\n(*\n\n y \\ x \\\n wfs (state s) \\\n [y = Suc 0]\\<^sub>t2\\x = Suc 0 \\ state s \\\n state s [a s' \\ x]\\<^sub>t3 state s' \\\n [y = Suc 0]\\<^sub>t2\\x = Suc 0 \\ state s'*)\n\n\nlemma p_obs_Rd_intro2:\n assumes \"step t (Read m x v) \\ \\'\"\n shows \"p_obs \\ t x v\"\n apply(rule step_cases[OF assms(1)])\n defer\n apply simp\n apply blast\n using p_obs_def by fastforce\n\n\n\n\n\nlemma init_d_obs: \"wfs \\ \\ initial_state \\ I \\ I x = u \\ [x =\\<^sub>t u] \\\"\n apply(simp add: initial_state_def d_obs_def d_obs_t_def)\n apply(elim exE conjE, intro conjI)\n defer\n apply(simp add: value_def)\n apply (simp add: lastWr_def)\n using last_write_write_on\nproof -\n fix F :: \"nat \\ rat\"\n assume a1: \"wfs \\\"\n assume a3: \"\\t x. thrView \\ t x = (x, F x)\"\n assume a4: \"\\a b x. modView \\ (a, b) x = (x, F x)\"\n have f5: \"\\n. var (lastWr \\ n) = n \\ lastWr \\ n \\ surrey_state.writes \\\"\n using a1 writes_on_def by fastforce\n then have \"\\n. \\na. lastWr \\ n = (na, F na)\"\n by (metis a1 a4 old.prod.exhaust own_ModView)\n then show \"thrView \\ t x = lastWr \\ x\"\n using f5 a4 a3 a1 by (metis (no_types) own_ModView)\nqed\n\n \n \n\ndefinition \"covered_v \\ x v \\ \\ w . w \\ writes_on \\ x \\ w \\ covered \\ \\ w = lastWr \\ x \\ value \\ w = v\"\n\nabbreviation covered_v_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"cvd[_, _] _\" [100, 100,100])\n where \"cvd[x, u] \\ \\ covered_v \\ x u\"\n\n\nlemma init_covered_v: \"initial_state \\ I \\ covered_v \\ x (I x)\"\n apply(simp add: covered_v_def)\n apply clarsimp\n using initially_write_unique\n apply(intro conjI)\n apply (simp add: initial_wfs initially_write_unique)\n apply(unfold writes_on_def)\n proof -\n fix a :: nat and b :: rat\n assume a1: \"initial_state \\ I\"\n assume a2: \"(a, b) \\ {w. var w = x \\ w \\ surrey_state.writes \\}\"\n have \"\\p. I (var p) = value \\ p\"\n using a1 by (metis (no_types) initial_state_def value_def write_record.select_convs(1))\n then show \"value \\ (a, b) = I x\"\n using a2 by auto\n qed\n\nlemma covered_update_v_pres:\n assumes \"covered_v \\ x u\"\n and \"wfs \\\"\n and \"step t a \\ \\'\"\n and \"isUp a\"\n and \"avar a = x\"\n and \"wr_val a = Some v\"\nshows \"covered_v \\' x v\"\n apply(rule step_cases[OF assms(3)])\n using assms(4) apply auto[1]\n using assms(4) isUp.simps(2) apply blast\n using assms(1,2,4,5)\n apply(simp add: covered_v_def)\n apply(intro allI impI, elim conjE)\n apply(unfold writes_on_def)\n apply simp\n apply(elim conjE)\n apply clarsimp\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def)\n apply clarsimp\n apply(simp add: valid_fresh_ts_def)\n apply(unfold writes_on_def)\n apply(elim conjE)\n apply(case_tac \"ba = b\", simp)\n apply(case_tac \"ba < b\", simp)\n apply (metis dual_order.irrefl prod.inject)\n apply clarsimp\n apply(simp add: update_trans_def rev_app_def Let_def update_mods_def add_cv_def update_modView_def update_thrView_def)\n apply (auto simp add: value_def)\n using assms(6) apply auto[1]\n apply (metis Pair_inject)\n by (metis Pair_inject)\n\n\ncorollary cvd_RMW_new_cvd:\n \"wfs \\ \\ cvd[x,u] \\ \\ \\ RMW[x, z, v]\\<^sub>t \\' \\ cvd[x,v] \\' \"\n by (simp add: covered_update_v_pres)\n\ncorollary cvd_SWAP_new_cvd:\n \"wfs \\ \\ cvd[x,u] \\ \\ \\ SWAP[x, v]\\<^sub>t \\' \\ cvd[x,v] \\' \"\n using cvd_RMW_new_cvd by blast\n\n\nlemma covered_read_v_pres:\n assumes \"covered_v \\ x u\"\n and \"wfs \\\"\n and \"step t a \\ \\'\"\n and \"isRd a\"\nshows \"covered_v \\' x u\"\n apply(rule step_cases[OF assms(3)])\n defer\n using assms(4) apply auto[1]\n using assms(4) apply auto[1]\n using assms(1,2,4)\n apply(simp add: covered_v_def)\n apply(intro allI impI conjI, elim conjE)\n apply(unfold writes_on_def, simp)\n apply(simp add: read_trans_def rev_app_def Let_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply(intro conjI impI, elim conjE)\n apply(unfold wfs_def)\n apply(case_tac \"syncing \\ w b\", clarsimp)\n apply(simp add: visible_writes_def)\n apply(unfold lastWr_def writes_on_def, clarsimp)\n apply blast\n apply auto[1]\n apply(simp add: value_def)\n apply(elim conjE)\n apply clarsimp\n done\n\nlemma covered_v_RMW_d_obs:\n assumes \"covered_v \\ x v\"\n and \"wfs \\\"\n and \"step t a \\ \\'\"\n and \"isUp a\"\n and \"avar a = x\"\n and \"wr_val a = Some u\"\nshows \"d_obs_t \\' t x u\"\n apply(rule step_cases[OF assms(3)])\n using assms(4) isUp.simps(1) apply blast\n using assms(4) isUp.simps(2) apply blast\n using assms(1,2, 4, 5, 6)\n apply(simp add: covered_v_def d_obs_t_def d_obs_def)\n apply(intro conjI)\n defer\n apply(elim conjE)\n apply(simp add: value_def)\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def, clarsimp)\n apply(unfold visible_writes_def writes_on_def, clarsimp)\n apply(simp add: update_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n apply(simp add: add_cv_def update_modView_def update_mods_def)\n apply(case_tac \"releasing \\ (x, b)\", clarsimp)\n defer\n apply blast\n apply(simp add: ts_oride_def valid_fresh_ts_def)\n apply(intro impI)\n apply(unfold wfs_def lastWr_def writes_on_def, clarsimp)\n done\n\ncorollary cvd_RMW_d_obs:\n \"wfs \\ \\ cvd[x,v] \\ \\ \\ RMW[x, w, u]\\<^sub>t \\' \\ [x =\\<^sub>t u] \\' \"\n by (simp add: covered_v_RMW_d_obs)\n\ncorollary cvd_SWAP_d_obs:\n \"wfs \\ \\ cvd[x,v] \\ \\ \\ SWAP[x, u]\\<^sub>t \\' \\ [x =\\<^sub>t u] \\' \"\n using cvd_RMW_d_obs by auto\n\n\nlemma covered_diff_var_pres:\n assumes \"covered_v \\ x v\"\n and \"wfs \\\"\n and \"step t a \\ \\'\"\n and \"avar a \\ x\"\nshows \"covered_v \\' x v\"\n apply(rule step_cases[OF assms(3)])\n using assms(1,2,4)\n apply(simp add: covered_v_def)\n apply(unfold writes_on_def, clarsimp)\n apply (intro conjI)\n apply(case_tac \"xa \\ aa\")\n apply(simp add: visible_writes_def)\n apply clarsimp\n apply(unfold wfs_def writes_on_def, simp)\n apply clarsimp\n apply(simp add: read_trans_def rev_app_def Let_def update_thrView_def)\n apply(intro conjI impI)\n apply(simp add: lastWr_def ts_oride_def)\n apply(unfold writes_on_def, simp) \n apply(simp add: lastWr_def ts_oride_def)\n apply(unfold writes_on_def, simp) \n apply (smt read_trans_def rev_app_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def)\n using assms(1,2,4)\n apply(simp add: covered_v_def)\n apply(unfold writes_on_def, clarsimp)\n apply (intro conjI) \n apply(case_tac \"xa \\ aa\")\n apply(simp add: visible_writes_def)\n apply clarsimp\n apply(unfold wfs_def writes_on_def, simp)\n apply clarsimp\n apply(simp add: write_trans_def rev_app_def update_thrView_def value_def)\n apply(simp add: update_mods_def update_thrView_def update_modView_def add_cv_def)\n apply(intro conjI impI)\n apply (metis assms(2) last_write_write_on subset_iff visible_var visible_writes_in_writes writes_on_var)\n apply auto[1]\n using assms(1,2,4)\n apply(simp add: covered_v_def)\n apply(intro allI impI conjI)\n apply clarsimp\n apply(unfold writes_on_def, clarsimp)\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def, clarsimp)\n apply clarsimp\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def value_def, clarsimp)\n done\n\n\n\n\ncorollary cvd_WrX_other_var_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ x\\y \\ \\ [y := v]\\<^sub>t \\' \\ cvd[x,u] \\' \"\n using WrX_def avar.simps(2) covered_diff_var_pres by auto\n\n\ncorollary cvd_WrR_other_var_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ x\\y \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ cvd[x,u] \\' \"\n using WrR_def avar.simps(2) covered_diff_var_pres by auto\n\n\ncorollary cvd_RMW_other_val_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ x\\y \\ \\ RMW[y, u, v]\\<^sub>t \\' \\ cvd[x,u] \\' \"\n using avar.simps(3) covered_diff_var_pres by blast\n\n\ncorollary cvd_RMW_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ \\ RMW[x, z, v]\\<^sub>t \\' \\ cvd[x,v] \\' \"\n using avar.simps(3) covered_update_v_pres isUp.simps(3) wr_val.simps(2) by blast\n\n\ncorollary cvd_Rdx_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ \\ [a \\ y]\\<^sub>t \\' \\ cvd[x,u] \\' \"\n by (simp add: RdX_def covered_read_v_pres)\n\ncorollary cvd_RdA_pres:\n \"wfs \\ \\ cvd[x,u] \\ \\ \\ [a \\\\<^sup>A y]\\<^sub>t \\' \\ cvd[x,u] \\' \"\n by (simp add: RdA_def covered_read_v_pres)\n\n\n\nlemma backward_cvd:\n assumes \"cvd[x, u] \\'\"\n and \"wfs \\\"\n and \"avar a \\ x\"\n and \"step t a \\ \\'\"\n and \"\\isUp a\"\nshows \"cvd[x, u] \\\"\n apply(rule step_cases[OF assms(4)])\n using assms (1,2,3)\n apply(simp add: covered_v_def read_trans_def visible_writes_def rev_app_def Let_def update_thrView_def)\n apply(unfold writes_on_def)\n apply clarsimp\n apply(intro conjI)\n apply(unfold lastWr_def writes_on_def)\n apply simp\n apply(simp add: value_def)\n using assms(1,2,3)\n apply(simp add: covered_v_def)\n apply(case_tac \"lastWr (write_trans t b w v \\ ts') x \\ lastWr \\ x\")\n apply (metis assms(3) visible_var write_to_different_var)\n apply simp\n apply(case_tac \"value (write_trans t b w v \\ ts') (lastWr \\ x) \\ value \\ (lastWr \\ x)\")\n apply (metis avar.simps(2) lastWr_visible value_not_change_write_to_different_var visible_var)\n apply simp\n apply(intro allI impI conjI)\n apply (unfold writes_on_def)\n apply(elim conjE)\n apply clarsimp\n apply(simp add: visible_writes_def)\n apply (unfold writes_on_def)\n apply(elim conjE)\n apply clarsimp\n using assms(5) by auto\n\n\n\n\n\ncorollary cvd_backwards_WrX: \n \"wfs \\ \\ cvd[x, u] \\' \\ y \\ x \\ \\ [y := v]\\<^sub>t \\' \\ cvd[x, u] \\ \"\n by (metis WrX_def avar.simps(2) backward_cvd isUp.simps(2))\n\ncorollary cvd_backwards_WrR:\n \"wfs \\ \\ cvd[x, u] \\' \\ y \\ x \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ cvd[x, u] \\ \"\n by (metis WrR_def avar.simps(2) backward_cvd isUp.simps(2))\n\ncorollary cvd_backwards_RdX:\n \"wfs \\ \\ cvd[x, u] \\' \\ y \\ x \\ \\ [v \\ y]\\<^sub>t \\' \\ cvd[x, u] \\ \"\n by (metis RdX_def avar.simps(1) backward_cvd isUp.simps(1))\n\ncorollary cvd_backwards_RdA:\n \"wfs \\ \\ cvd[x, u] \\' \\ y \\ x \\ \\ [v \\\\<^sup>A y]\\<^sub>t \\' \\ cvd[x, u] \\ \"\n by (metis RdA_def avar.simps(1) backward_cvd isUp.simps(1))\n\n\n\nlemma not_cvd_pres:\n assumes \"\\cvd[x, u] \\\"\n and \"wfs \\\"\n and \"step t a \\ \\'\"\n and \"\\isUp a\"\nshows \"\\cvd[x, u] \\'\"\n apply(rule step_cases[OF assms(3)])\n using assms(1,2)\n apply(simp add: covered_v_def visible_writes_def read_trans_def Let_def rev_app_def)\n apply(simp add: add_cv_def update_mods_def update_modView_def update_thrView_def lastWr_def value_def)\n apply(unfold wfs_def writes_on_def)\n apply simp\n using assms(1,2)\n apply(case_tac \"xa \\ x\")\n using assms(3) backward_cvd apply force\n apply(simp add: covered_v_def visible_writes_def write_trans_def Let_def rev_app_def valid_fresh_ts_def)\n apply(simp add: add_cv_def update_mods_def update_modView_def update_thrView_def lastWr_def value_def)\n apply(unfold wfs_def writes_on_def, clarsimp)\n apply(intro conjI)\n using neq_iff apply blast\n apply (metis less_irrefl subsetCE)\n using assms(4) isUp.simps(3) by blast\n\ncorollary not_cvd_RdX_pres:\n \"wfs \\ \\ \\cvd[x, u] \\ \\ \\ [v \\ y]\\<^sub>t \\' \\ \\cvd[x, u] \\' \"\n using RdX_def not_cvd_pres by auto\n\ncorollary not_cvd_RdA_pres:\n \"wfs \\ \\ \\cvd[x, u] \\ \\ \\ [v \\\\<^sup>A y]\\<^sub>t \\' \\ \\cvd[x, u] \\' \"\n using RdA_def not_cvd_pres by auto\n\n\ncorollary not_cvd_WrX_pres:\n \"wfs \\ \\ \\cvd[x, u] \\ \\ \\ [y := v]\\<^sub>t \\' \\ \\cvd[x, u] \\' \"\n using WrX_def not_cvd_pres by auto\n\ncorollary not_cvd_WrR_pres:\n \"wfs \\ \\ \\cvd[x, u] \\ \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ \\cvd[x, u] \\' \"\n using WrR_def not_cvd_pres by auto\n\n\n\nlemma cvd_u_not_cvd_v: \"w \\ writes_on \\ x \\ w \\ covered \\ \\ value \\ w = u \\ cvd[x, u] \\ \\ u \\ v \\ \\cvd[x, v]\\\"\n apply(simp add: covered_v_def)\n by (metis surj_pair)\n\n\nlemma new_update_not_covered:\n assumes \"wfs \\\"\n and \"w \\ visible_writes \\ t x\"\n and \"v = value \\ w\"\n and \"w \\ covered \\\"\n and \"valid_fresh_ts \\ w ts'\"\n shows \"(var w, ts') \\ covered (update_trans t w v' \\ ts')\"\n apply(subgoal_tac \"(var w, ts') \\ writes \\\")\n apply(subgoal_tac \"w \\ writes \\\")\n apply simp using assms(1)\n using wfs_def apply fastforce\n apply (meson assms(2) subsetCE visible_writes_in_writes)\n by (metis assms(1) assms(5) fst_conv less_irrefl prod.sel(2) tst_def valid_fresh_ts_def var_def wfs_def)\n\nlemma RMW_exist_w_in_post: \"wfs \\ \\ \\ RMW[x, u, v]\\<^sub>t \\' \\ \\ w . w \\ writes_on \\' x \\ value \\' w = v \\ w \\ covered \\'\"\n apply(simp add: step_def visible_writes_def valid_fresh_ts_def update_trans_def Let_def rev_app_def)\n apply(simp add: add_cv_def update_mods_def update_thrView_def update_modView_def value_def)\n apply(unfold writes_on_def)\n apply clarsimp \n by (metis less_irrefl subsetCE wfs_def)\n\n\nlemma update_reads_cvd_v:\n assumes \"cvd[x, u] \\\"\n and \"isUp a\"\n and \"avar a = x\"\n and \"rd_val a = Some v\"\n and \"wr_val a = Some z\"\n and \"step t a \\ \\'\"\nshows \"u = v\"\n apply(rule step_cases[OF assms(6)])\n using assms(2) isUp.simps(1) apply blast\n using assms(2) isUp.simps(2) apply blast\n using assms(1,2,3,4)\n by (smt covered_v_def mem_Collect_eq option.inject rd_val.simps(2) visible_writes_def)\n\n\ncorollary Up_reads_cvd_v:\n \"cvd[x, u] \\ \\ \\ RMW[x, v, z]\\<^sub>t \\' \\ v = u \"\n using avar.simps(3) isUp.simps(3) rd_val.simps(2) update_reads_cvd_v wr_val.simps(2) by blast\n\n(*****************************************************)\n\ndefinition \"mo w w'\\ var(w) = var(w') \\ tst(w) < tst(w')\" \n\ndefinition \"enc \\ view x u \\ \\ w . w \\ writes_on \\ x \\ tst(w) \\ tst(view x) \\ value \\ w = u\"\n\ndefinition \"enc_t \\ t x u \\ enc \\ (thrView \\ t) x u\"\n\ndefinition \"p_vorder \\ u x v \\ \\ w w'. w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\\n value \\ w = u \\ value \\ w' = v \\\n mo w w' \"\n\ndefinition \"d_vorder \\ u x v \\ (\\ w w'. w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\\n value \\ w = u \\ value \\ w' = v \\\n mo w w') \\ p_vorder \\ u x v\"\n\ndefinition \"init_val \\ x v \\ \n \\ w . w \\ writes_on \\ x \\ \n (\\w'\\ writes_on \\ x . w \\ w' \\ mo w w') \\ \n value \\ w = v\"\n\ndefinition \"amo \\ x u \\ \\ p_vorder \\ u x u\"\n\ndefinition \"no_val \\ x i u \\ init_val \\ x i \\ \\ p_vorder \\ i x u\"\n\ndefinition \"last_val \\ x u i \\ \n init_val \\ x i \\ p_vorder \\ i x u \n \\ (\\ w. w \\ u \\ \\ p_vorder \\ u x w)\"\n\n\n\nabbreviation p_vorder_abbr:: \"V \\ L \\ V \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100,100,100,100])\n where \"[u \\\\<^sub>x v] \\ \\ p_vorder \\ u x v\"\n\nabbreviation d_vorder_abbr:: \"V \\ L \\ V \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100,100,100,100])\n where \"[u \\\\<^sub>x v] \\ \\ d_vorder \\ u x v\"\n\nabbreviation amo_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"[\\\\<^sub>_ _] _\" [100,100,100])\n where \"[\\\\<^sub>x u] \\ \\ amo \\ x u\"\n\nabbreviation no_abbr:: \"L \\ V \\ V \\ surrey_state \\ bool\" (\"[\\\\<^sub>_ _]\\<^sub>_ _\" [100,100,100,100])\n where \"[\\\\<^sub>x u]\\<^sub>i \\ \\ no_val \\ x i u\"\n\nabbreviation enc_abbr:: \"L \\ V \\ T \\ surrey_state \\ bool\" (\"[en _ _]\\<^sub>_ _\" [100,100,100,100])\n where \"[en x u]\\<^sub>t \\ \\ enc_t \\ t x u\"\n\nabbreviation last_abbr:: \"L \\ V \\ V \\ T \\ surrey_state \\ bool\" (\"[last _ _ _]\\<^sub>_ _\" [100, 100,100,100,100])\n where \"[last x i u]\\<^sub>t \\ \\ last_val \\ x u i\"\n\nabbreviation init_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"[init _ _] _\" [100, 100,100])\n where \"[init x v] \\ \\ init_val \\ x v\"\n\nlemmas opsem_def =\n amo_def \n mo_def\n d_vorder_def\n p_vorder_def\n enc_def\n enc_t_def\n no_val_def\n\n\n\n\nlemma pvord_to_dvord:\n assumes \"p_vorder \\ u x v\"\n and \"amo \\ x u\"\n and \"amo \\ x v\"\n shows \"d_vorder \\ u x v\"\n using assms \n apply(simp add: opsem_def)\n by (metis fst_conv linorder_neqE_linordered_idom var_def writes_on_var)\n\n\nlemma enc_read_intro:\n assumes \"isRd a\"\n and \"avar a = x\"\n and \"rd_val a = Some v\"\n and \"step t a \\ \\'\"\nshows \"enc_t \\' t x v\"\n apply(rule step_cases[OF assms(4)])\n defer \n using assms(1) apply auto[1]\n using assms(1) isRd.simps(3) apply blast apply(simp add: enc_t_def enc_def)\n apply(case_tac \"va = v\")\n defer\n using assms(3) apply auto[1]\n apply simp\n apply(elim conjE)\n apply clarsimp\n apply(unfold read_trans_def Let_def rev_app_def)\n apply simp\n apply(case_tac \"syncing \\ (aa, b) ba\")\n defer apply simp\n apply(simp add: update_thrView_def)\n apply (rule conjI)\n apply (smt assms(2) avar.simps(1) mem_Collect_eq order_refl surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) value_def visible_writes_def)\n apply (rule impI) \n apply(unfold value_def writes_on_def visible_writes_def)\n apply simp\n using assms(2) avar.simps(1) apply blast\napply simp\n apply(simp add: update_thrView_def ts_oride_def)\n apply (rule conjI)\n apply blast \n using assms(2) avar.simps(1) by blast\n\ncorollary enc_RdX_intro:\n \"\\ [v \\ x]\\<^sub>t \\' \\ [en x v]\\<^sub>t \\'\"\n by (metis RdX_def avar.simps(1) enc_read_intro isRd.simps(1) rd_val.simps(1))\n\ncorollary enc_RdA_intro:\n \"\\ [v \\\\<^sup>A x]\\<^sub>t \\' \\ [en x v]\\<^sub>t \\'\"\n by (metis RdA_def avar.simps(1) enc_read_intro isRd.simps(1) rd_val.simps(1))\n\n\nlemma enc_write_intro:\n assumes \"isWr a\"\n and \"avar a = x\"\n and \"wr_val a = Some v\"\n and \"step t a \\ \\'\"\nshows \"enc_t \\' t x v\"\n apply(rule step_cases[OF assms(4)])\n using assms(1) isWr.simps(1) apply blast\n defer\n using assms(1) apply auto[1]\n apply(simp add: enc_t_def enc_def)\n apply (elim conjE impE)\n apply (rule conjI)\n defer\n using assms(2) apply auto[1]\n apply (rule impI)\n apply simp\n apply(simp add: valid_fresh_ts_def)\n apply (elim conjE)\n apply clarsimp\n apply(case_tac \"aa \\ x\")\n apply(simp add: visible_writes_def)\n apply(unfold writes_on_def)\n apply simp\n apply clarsimp\n apply(simp add: write_trans_def rev_app_def value_def)\n apply(unfold update_thrView_def add_cv_def update_modView_def update_mods_def)\n apply clarsimp\n using assms(3) by auto\n\ncorollary enc_WrX_intro:\n \"\\ [x := v]\\<^sub>t \\' \\ [en x v]\\<^sub>t \\'\"\n by (metis WrX_def avar.simps(2) enc_write_intro isWr.simps(2) wr_val.simps(1))\n\ncorollary enc_WrR_intro:\n \"\\ [x :=\\<^sup>R v]\\<^sub>t \\' \\ [en x v]\\<^sub>t \\'\"\n by (metis WrR_def avar.simps(2) enc_write_intro isWr.simps(2) wr_val.simps(1))\n\n\nlemma enc_update_intro:\n assumes \"isUp a\"\n and \"avar a = x\"\n and \"wr_val a = Some v\"\n and \"step t a \\ \\'\"\nshows \"enc_t \\' t x v\"\n using assms apply (simp add: enc_t_def step_def enc_def)\n apply (case_tac \"a\", auto)\n apply (simp add: update_simps)\n apply (unfold writes_on_def)\n apply (simp add: value_def ts_oride_def tst_def)\n by blast\n\nlemma not_p_vorder_Write__pres:\n assumes \"\\ p_vorder \\ v x v\"\nand \"isWr a\"\nand \"avar a = x\"\nand \"wr_val a \\ Some v\"\nand \"step t a \\ \\'\"\nshows \"\\ p_vorder \\' v x v\"\n apply(rule step_cases[OF assms(5)])\n using assms(2) isWr.simps(1) apply blast\n defer \n using assms(2) isWr.simps(3) apply blast\n apply (elim conjE)\n apply(case_tac \"xa = x\")\n defer\n using assms(3) apply auto[1]\n using assms\n apply(simp add: valid_fresh_ts_def visible_writes_def opsem_def)\n apply(unfold writes_on_def)\n apply simp\n apply(simp add: write_trans_def rev_app_def)\n apply(unfold update_thrView_def add_cv_def update_modView_def update_mods_def value_def)\n by simp\n\n\n\nlemma amo_intro: \nassumes \"init_val \\ x u\" \nand \"\\ p_vorder \\ u x v\"\nshows \"amo \\ x v\"\n using assms\n apply (simp add: opsem_def) \n by (metis assms(2) init_val_def p_vorder_def)\n\nlemma init_val_pres: \nassumes \"[init x u] \\\" \nand \"step t action \\ \\'\"\nshows \"init_val \\' x u\"\n using assms\n apply (auto simp add: step_def) \n apply (cases action, auto)\n apply (auto simp add: init_val_def)[1] \n apply (metis read_trans_def rev_app_def surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def)\n apply (auto simp add: init_val_def)[1] \n apply (simp add: valid_fresh_ts_def update_thrView_def write_trans_def rev_app_def add_cv_def update_mods_def update_modView_def) \n apply (simp add: visible_writes_def tst_def value_def var_def writes_on_def)\n apply (metis (no_types, lifting) fst_conv less_trans mo_def not_less_iff_gr_or_eq snd_conv tst_def var_def)\n proof -\n fix a b y v ts'\n assume a1: \"init_val \\ x u\" and\n a2: \"(a, b) \\ visible_writes \\ t y\" and \n a5: \"valid_fresh_ts \\ (a, b) ts'\" (*and *)\n show \"init_val (update_trans t (a, b) v \\ ts') x u\"\n using a1 a2 a5 \n apply (simp add: update_trans_def)\n apply (auto simp add: init_val_def value_def valid_fresh_ts_def rev_app_def add_cv_def update_mods_def update_thrView_def update_modView_def)\n by (smt fst_conv fun_upd_other insert_iff less_trans mem_Collect_eq mo_def not_less_iff_gr_or_eq snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) tst_def var_def visible_writes_def writes_on_def) \nqed\n\n\nlemma amo_intro_step: \n assumes \"init_val \\ x u\" \n and \"u \\ v\"\n and \"\\ p_vorder \\ u x v\"\n and \"step t action \\ \\'\"\n shows \"amo \\' x v\"\n using assms\n apply (simp add: opsem_def step_def)\n apply (intro impI allI conjI)\n apply (elim conjE exE)\n apply (cases action, auto)\n apply (auto simp add: update_thrView_def value_def read_trans_def init_val_def rev_app_def)\n apply (metis (no_types, lifting) fst_conv mo_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) tst_def var_def)\n apply (auto simp add: write_trans_def rev_app_def add_cv_def update_mods_def)\n apply (smt dual_order.irrefl fst_conv insert_compr mem_Collect_eq mo_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) tst_def update_modView_def update_thrView_def var_def writes_on_def)\n apply (auto simp add: update_trans_def rev_app_def add_cv_def update_mods_def)\n apply (auto simp add: valid_fresh_ts_def init_val_def write_trans_def rev_app_def update_thrView_def update_modView_def add_cv_def update_mods_def)\n by (smt dual_order.irrefl fst_conv fun_upd_other insert_compr mem_Collect_eq mo_def snd_conv surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(4) surrey_state.update_convs(5) tst_def var_def writes_on_def)\n\nlemma not_pvorder_pres_step_wr: \nassumes \"init_val \\ x u\" \nand \"\\ p_vorder \\ u x v\"\nand \"isWr action\"\nand \"wr_val action \\ Some v\"\nand \"wr_val action \\ Some u\"\nand \"step t action \\ \\'\"\nshows \"\\ p_vorder \\' u x v\"\n using assms\n apply (simp add: step_def opsem_def) \n apply (intro allI impI)\n apply (elim exE)\n apply (cases \"action\", auto)\n apply (auto simp add: update_thrView_def value_def fun_upd_other write_trans_def rev_app_def add_cv_def valid_fresh_ts_def init_val_def update_modView_def update_mods_def)\n by (smt Pair_inject insert_iff mem_Collect_eq surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(4) surrey_state.update_convs(5) write_record.ext_inject write_record.surjective writes_on_def)\n \n\nlemma amo_pres_step_wr: \nassumes \"amo \\ x v\"\nand \"isWr action\" \nand \"wr_val action \\ Some v\"\nand \"step t action \\ \\'\"\nshows \"amo \\' x v\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[1]\n using assms\n apply(simp add: valid_fresh_ts_def visible_writes_def write_trans_def rev_app_def)\n apply(simp add: add_cv_def update_mods_def update_thrView_def update_modView_def)\n apply(elim conjE)\n apply(simp add: opsem_def init_val_def value_def)\n apply(unfold writes_on_def, simp)\n using assms(2) isWr.simps(3) by blast\n\ncorollary amo_Wr_diff_val_pres: \n \"[\\\\<^sub>x u] \\ \\ u \\ v \\ \\ [y := v]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis WrX_def amo_pres_step_wr isWr.simps(2) option.inject wr_val.simps(1))\n\ncorollary amo_WrR_diff_val_pres: \n \"[\\\\<^sub>x u] \\ \\ u \\ v \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis WrR_def amo_pres_step_wr isWr.simps(2) option.inject wr_val.simps(1))\n\n\n\nlemma amo_write_pres: \nassumes \"amo \\ x v\"\nand \"isWr action\" \nand \"avar action \\ x\"\nand \"step t action \\ \\'\"\nshows \"amo \\' x v\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[1] defer\n using assms(2) apply auto[1]\n using assms(1,2,3)\n apply(simp add: valid_fresh_ts_def visible_writes_def write_trans_def rev_app_def)\n apply(simp add: add_cv_def update_mods_def update_thrView_def update_modView_def)\n apply(elim conjE)\n apply(simp add: opsem_def init_val_def value_def)\n by(unfold writes_on_def, simp)\n\ncorollary amo_WrX_pres: \n \"[\\\\<^sub>x u] \\ \\ x \\ y \\ \\ [y := v]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis WrX_def amo_write_pres avar.simps(2) isWr.simps(2))\n\ncorollary amo_WrR_pres: \n \"[\\\\<^sub>x u] \\ \\ x \\ y \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis WrR_def amo_write_pres avar.simps(2) isWr.simps(2))\n\nlemma amo_update_pres: \nassumes \"amo \\ x v\"\nand \"isUp action\" \nand \"avar action \\ x\"\nand \"step t action \\ \\'\"\nshows \"amo \\' x v\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[2] \n using assms(2) apply auto[1]\n using assms(1,2,3)\n apply(simp add: valid_fresh_ts_def visible_writes_def update_trans_def rev_app_def)\n apply(elim conjE)\n apply(simp add: Let_def opsem_def init_val_def value_def)\n apply (case_tac \"releasing \\ (a, b)\", auto)\n apply (simp add: tst_def var_def ts_oride_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply (unfold writes_on_def, simp)\n apply blast\n apply (simp add: tst_def var_def ts_oride_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n by blast\n\n\ncorollary amo_Up_pres: \n \"[\\\\<^sub>x u] \\ \\ x \\ y \\ \\ RMW[y, v, w]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n using amo_update_pres by force\n\n\nlemma amo_read_pres: \nassumes \"amo \\ x v\"\nand \"isRd action\" \nand \"step t action \\ \\'\"\nshows \"amo \\' x v\"\n apply(rule step_cases[OF assms(3)])\n defer \n using assms(2) apply auto[1]\n using assms(2) apply auto[1]\n using assms\n apply(unfold opsem_def read_trans_def Let_def rev_app_def writes_on_def update_thrView_def visible_writes_def value_def)\n by clarsimp\n\ncorollary amo_RdX_pres: \n \"[\\\\<^sub>x u] \\ \\ \\ [v \\ y]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis RdX_def amo_read_pres isRd.simps(1))\n\ncorollary amo_RdA_pres: \n \"[\\\\<^sub>x u] \\ \\ \\ [v \\\\<^sup>A y]\\<^sub>t \\' \\ [\\\\<^sub>x u] \\'\"\n by (metis RdA_def amo_read_pres isRd.simps(1))\n\nlemma d_vorder_intro:\n assumes \"step t action \\ \\'\"\n and \"p_vorder \\ u x v\" \n and \"[init x v'] \\\"\n and np: \"\\ p_vorder \\ v' x v\" \nshows \"d_vorder \\' u x v\"\n using assms\n apply (simp add: opsem_def)\n apply (intro conjI allI impI) \n apply (metis fst_conv var_def writes_on_var)\n apply (metis np init_val_def less_imp_not_less mo_def p_vorder_def snd_conv tst_def)\n by (metis np init_val_def less_imp_not_less mo_def p_vorder_def snd_conv tst_def)\n\nlemma d_vorder_intro_w: \n assumes \"enc_t \\ t xv u\"\nand \"init_val \\ xv z\"\nand \"amo \\ xv u\"\nand \"\\ p_vorder \\ z xv v\"\nand \"amo \\ xv v\"\nand \"v \\ u\"\nand \"v \\ z\"\nand \"u \\ z\"\nand \"avar action = xv\"\nand \"wr_val action = Some v\"\nand \"step t action \\ \\'\"\nand \"isWr action\"\nshows \"d_vorder \\' u xv v\"\n apply(rule step_cases[OF assms(11)])\n using assms(10) apply auto[1]\n defer\n using assms(12) apply auto[1]\n using assms(1, 2, 3,4,5,6,7,8,9,10,12)\n apply clarsimp\n apply(simp add: opsem_def write_trans_def rev_app_def init_val_def valid_fresh_ts_def visible_writes_def)\n apply(simp add: add_cv_def update_modView_def update_thrView_def update_mods_def value_def)\n apply(unfold writes_on_def)\n apply clarsimp\n apply(intro conjI)\n apply clarsimp\n apply(intro conjI impI)\n apply clarsimp\n apply(case_tac \"bb = bd\")\n apply linarith\n apply(case_tac \"bb = bc\")\n apply blast\n apply (metis linorder_cases)\n apply metis\n by (metis dual_order.strict_trans2)\n\n(* assumes \"enc_t \\ t xv u\" enc_t \\ t x u\nand \"init_val \\ xv z\" [\\\\<^sub>x u]\\<^sub>z \\\nand \"amo \\ xv u\" [\\\\<^sub>x u] \\\nand \"\\ p_vorder \\ z xv v\" [\\\\<^sub>x u]\\<^sub>i \\\nand \"amo \\ xv v\" [\\\\<^sub>x v] \\\nand \"v \\ u\"\nand \"v \\ z\"\nand \"u \\ z\"\nand \"avar action = xv\"\nand \"wr_val action = Some v\"\nand \"step t action \\ \\'\"\nand \"isWr action\"\nshows \"d_vorder \\' u xv v\"\n*)\n\ncorollary WrX_d_vorder: \n \"[\\\\<^sub>x v]\\<^sub>z \\ \\ [\\\\<^sub>x u] \\ \\ [\\\\<^sub>x v] \\ \\ [en x u]\\<^sub>t \\ \\ u \\ z \\ v \\ u \\ v \\ z \\ \\ [x := v]\\<^sub>t \\' \\ [u \\\\<^sub>x v] \\'\"\n by (metis WrX_def avar.simps(2) d_vorder_intro_w isWr.simps(2) no_val_def wr_val.simps(1))\n\ncorollary WrR_d_vorder: \n \"[\\\\<^sub>x v]\\<^sub>z \\ \\ [\\\\<^sub>x u] \\ \\ [\\\\<^sub>x v] \\ \\ [en x u]\\<^sub>t \\ \\ u \\ z \\ v \\ u \\ v \\ z \\ \\ [x :=\\<^sup>R v]\\<^sub>t \\' \\ [u \\\\<^sub>x v] \\'\"\n by (metis WrR_def avar.simps(2) d_vorder_intro_w isWr.simps(2) no_val_def wr_val.simps(1))\n\n\nlemma d_vorder_one_way:\n assumes \"d_vorder \\ u x v\" \nshows \"\\ d_vorder \\ v x u\"\n using assms\n apply (unfold opsem_def, safe)\n using not_less_iff_gr_or_eq by blast\n\n\nlemma enc_read_p_vorder1:\n assumes \"enc_t \\ t xv v\"\nand \"isRd action\"\nand \"avar action = xv\"\nand \"rd_val action = Some u\"\nand \"step t action \\ \\'\"\nshows \"v \\ u \\ p_vorder \\ v xv u\"\n apply(rule step_cases[OF assms(5)])\n using assms\n apply(unfold opsem_def read_trans_def Let_def rev_app_def writes_on_def update_thrView_def visible_writes_def)\n apply simp\n apply(case_tac \"syncing \\ w b\")\n apply simp\n apply (elim conjE)\n apply(intro impI)\n apply simp\n apply(case_tac \"v = u\")\n apply linarith\n apply clarsimp\n using le_neq_trans apply fastforce\n apply (metis dual_order.trans order.not_eq_order_implies_strict prod.collapse tst_def var_def)\n using isRd.simps(2) apply blast\n using isRd.simps(3) by blast\n\n\nlemma enc_read_p_vorder:\n assumes \"enc_t \\ t xv v\"\nand \"isRd action\"\nand \"avar action = xv\"\nand \"rd_val action = Some u\"\nand \"step t action \\ \\'\"\nshows \"v \\ u \\ p_vorder \\' v xv u\"\n apply(rule step_cases[OF assms(5)])\n defer\n using assms(2) apply auto[2]\n using assms(1,2,3,4)\n apply(unfold opsem_def read_trans_def Let_def rev_app_def writes_on_def update_thrView_def visible_writes_def)\n apply simp\n apply(case_tac \"syncing \\ w b\")\n apply simp\n apply (elim conjE)\n apply(intro impI)\n apply (simp_all add: value_def)\n apply(case_tac \"v = u\")\n apply linarith\n apply clarsimp\n using less_eq_rat_def apply fastforce\n by (metis dual_order.trans order.not_eq_order_implies_strict prod.collapse tst_def var_def)\n \n\ncorollary enc_RdA_p_vorder: \n \"[en x v]\\<^sub>t \\ \\ \\ [u \\\\<^sup>A x]\\<^sub>t \\' \\ v \\ u \\ [v \\\\<^sub>x u] \\'\"\n by (metis RdA_def avar.simps(1) enc_read_p_vorder isRd.simps(1) rd_val.simps(1))\n\ncorollary enc_Rdx_p_vorder: \n \"[en x v]\\<^sub>t \\ \\ \\ [u \\ x]\\<^sub>t \\' \\ v \\ u \\ [v \\\\<^sub>x u] \\'\"\n by (metis RdX_def avar.simps(1) enc_read_p_vorder isRd.simps(1) rd_val.simps(1))\n\nlemma p_vorder_write_pres:\n assumes \"p_vorder \\ v xv u\"\n and \"isWr action\"\n and \"step t action \\ \\'\"\n shows \"p_vorder \\' v xv u\"\n apply(rule step_cases[OF assms(3)])\n using assms(2) isWr.simps(1) apply blast\n using assms\n apply(simp add: opsem_def value_def write_trans_def rev_app_def visible_writes_def update_thrView_def)\n apply(simp add: update_modView_def update_mods_def add_cv_def)\n apply(unfold writes_on_def valid_fresh_ts_def)\n apply(elim conjE)\n apply clarsimp\n apply (metis (full_types) dual_order.irrefl)\n using assms(2) isWr.simps(3) by blast\n\ncorollary p_vorder_WrX_p_vorder: \n \" [v \\\\<^sub>x u] \\ \\ \\ [y := z]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\"\n by (metis WrX_def isWr.simps(2) p_vorder_write_pres)\n\n\ncorollary p_vorder_WrR_p_vorder: \n \" [v \\\\<^sub>x u] \\ \\ \\ [y :=\\<^sup>R z]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\"\n by (metis WrR_def isWr.simps(2) p_vorder_write_pres)\n\n\nlemma read_pres_not_p_vorder:\n assumes \"\\ p_vorder \\ v xv u\"\n and \"isRd action\"\n and \"step t action \\ \\'\"\n shows \"\\ p_vorder \\' v xv u\"\n apply(rule step_cases[OF assms(3)])\n defer\n using assms(2) apply auto[2]\n using assms\n by(simp add: opsem_def value_def)\n\nlemma read_pres_p_vorder:\n assumes \"p_vorder \\ v xv u\"\n and \"isRd action\"\n and \"step t action \\ \\'\"\n shows \"p_vorder \\' v xv u\"\n apply(rule step_cases[OF assms(3)])\n defer\n using assms(2) apply auto[1]\n using assms(2) apply auto[1]\n using assms\n by(simp add: opsem_def value_def)\n\n\ncorollary p_vorder_RdX_p_vorder: \n \" [v \\\\<^sub>x u] \\ \\ \\ [z \\ y]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\"\n by (metis (full_types) RdX_def isRd.simps(1) read_pres_p_vorder)\n\n\ncorollary p_vorder_RdA_p_vorder: \n \" [v \\\\<^sub>x u] \\ \\ \\ [z \\\\<^sup>A y]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\"\n by (metis (full_types) RdA_def isRd.simps(1) read_pres_p_vorder)\n\n\n\nlemma d_vorder_Read_pres:\n assumes \"d_vorder \\ v x u\"\n and \"isRd action\"\n and \"step t action \\ \\'\"\n shows \"d_vorder \\' v x u\"\n apply(rule step_cases[OF assms(3)])\n defer\n using assms(2) apply auto[1]\n using assms(2) apply auto[1]\n using assms\n apply(simp add: d_vorder_def)\n apply(simp add: value_def)\n apply(unfold opsem_def read_trans_def writes_on_def rev_app_def Let_def, simp)\n apply(elim conjE)\n apply(case_tac \"syncing \\ w b\", simp)\n apply (simp add: update_thrView_def value_def)\n by (simp add: update_thrView_def value_def)\n\ncorollary d_vorder_RdX_pres: \n \" [v \\\\<^sub>x u] \\ \\ \\ [z \\ y]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\" \n by (metis RdX_def isRd.simps(1) d_vorder_Read_pres)\n\n\ncorollary d_vorder_RdA_pres: \n \" [v \\\\<^sub>x u] \\ \\ \\ [z \\\\<^sup>A y]\\<^sub>t \\' \\ [v \\\\<^sub>x u] \\'\"\n by (metis RdA_def isRd.simps(1) d_vorder_Read_pres)\n\n\nlemma d_vorder_Write_pres:\n assumes \"d_vorder \\ v x u\"\n and \"step t a \\ \\'\"\n and \"isWr a\"\n and \"wr_val a \\ Some v\"\n and \"wr_val a \\ Some u\"\n and \"avar a = x\"\n shows \"d_vorder \\' v x u\"\n apply(rule step_cases[OF assms(2)])\n using assms(3) apply auto[1] defer\n using assms(3) isWr.simps(3) apply blast\n using assms(1,3,4,5,6)\n apply simp\n apply(elim conjE)\n apply clarsimp\n apply(simp add: d_vorder_def)\n apply(intro conjI)\n apply clarsimp apply auto\n apply (smt UnE fun_upd_def mem_Collect_eq rev_app_def singletonD surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) update_modView_def update_mods_def update_thrView_def add_cv_def value_def write_record.ext_inject write_record.surjective write_trans_def writes_on_def)\n using assms(2) assms(3) p_vorder_write_pres by blast\n\n\ncorollary d_vorder_WrX_pres: \n \" [v \\\\<^sub>x u] \\ \\ \\ [x := w]\\<^sub>t \\' \\ w \\ u \\ w \\ v \\ [v \\\\<^sub>x u] \\'\" \n by (simp add: WrX_def d_vorder_Write_pres)\n\ncorollary d_vorder_WrR_pres: \n \" [v \\\\<^sub>x u] \\ \\ \\ [x :=\\<^sup>R w]\\<^sub>t \\' \\ w \\ u \\ w \\ v \\ [v \\\\<^sub>x u] \\'\" \n by (simp add: WrR_def d_vorder_Write_pres)\n\n\nlemma enc_pres:\n assumes \"enc_t \\ t xv u\"\n and \"step t' action \\ \\'\"\n shows \"enc_t \\' t xv u\"\n apply(rule step_cases[OF assms(2)])\n using assms \n apply simp\n apply(simp add: enc_t_def enc_def visible_writes_def read_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n apply(case_tac \"syncing \\ w b\")\n apply (unfold writes_on_def) \n apply clarsimp \n apply(auto simp add: tst_def value_def enc_t_def enc_def visible_writes_def read_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n using assms \n apply(simp add: enc_t_def enc_def visible_writes_def write_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n apply (unfold writes_on_def) \n apply clarsimp \n apply(auto simp add: tst_def value_def enc_t_def enc_def visible_writes_def read_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)[1]\n apply(auto simp add: add_cv_def update_mods_def update_modView_def)\n apply (metis dual_order.strict_implies_order dual_order.trans not_le snd_conv tst_def valid_fresh_ts_def)\n apply (smt fst_conv mem_Collect_eq not_less_iff_gr_or_eq snd_conv tst_def valid_fresh_ts_def var_def writes_on_def)\n using assms\n apply(simp add: enc_t_def enc_def visible_writes_def update_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n apply(auto simp add: add_cv_def valid_fresh_ts_def update_mods_def tst_def value_def enc_t_def enc_def visible_writes_def read_trans_def Let_def rev_app_def update_thrView_def ts_oride_def)\n apply (unfold writes_on_def) \n apply auto\n apply (unfold update_modView_def, clarsimp) \n apply (smt dual_order.irrefl dual_order.strict_implies_order dual_order.trans fun_upd_same fun_upd_triv fun_upd_twist snd_conv ts_oride_def tst_def)\n apply auto\n apply (metis leD less_imp_le order_trans)\n by (metis leD order_refl)\n\n\nlemma enc_pvord_step:\n \"enc_t \\ t xv u \\ \n isRd action \\ \n avar action = xv \\\n rd_val action = Some v \\\n step t action \\ \\' \\ u \\ v\\ p_vorder \\' u xv v\"\n apply (frule enc_read_p_vorder[where action = action]) \n by blast+ \n\n\n\nlemma no_val_read_pres:\n assumes \"[\\\\<^sub>x u]\\<^sub>i \\\"\n and \"isRd a\"\n and \"step t a \\ \\'\"\n shows \"[\\\\<^sub>x u]\\<^sub>i \\'\"\n by (meson assms(1) assms(2) assms(3) init_val_pres no_val_def read_pres_not_p_vorder)\n\ncorollary no_val_RdA_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ \\ [r \\\\<^sup>A y]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n using no_val_read_pres \n by (metis RdA_def isRd.simps(1))\n\ncorollary no_val_Rdx_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ \\ [r \\ y]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n using no_val_read_pres \n by (metis RdX_def isRd.simps(1))\n\nlemma write_no_val:\n assumes \"wr_val a = Some u\"\n and \"[init x i] \\\"\n and \"avar a = x\"\n and \"isWr a\"\n and \"step t a \\ \\'\"\nshows \"\\[\\\\<^sub>x u]\\<^sub>i \\'\"\n apply(rule step_cases[OF assms(5)])\n using assms(4) apply auto[1]\n using assms(1,2,3,4)\n apply(simp add: opsem_def init_val_def visible_writes_def valid_fresh_ts_def value_def)\n apply(simp add: write_trans_def rev_app_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply(unfold writes_on_def)\n apply(elim conjE)\n apply clarsimp\n using order.asym apply blast\n using assms(4) by auto\n\ncorollary WrX_no_val: \n \"[init x i] \\ \\ \\ [x := u]\\<^sub>t \\' \\ \\[\\\\<^sub>x u]\\<^sub>i \\'\"\n using write_no_val \n by (metis WrX_def avar.simps(2) isWr.simps(2) wr_val.simps(1))\n\nlemma no_val_write_diff_value_pres:\n assumes \"[\\\\<^sub>x u]\\<^sub>i \\\"\n and \"isWr a\"\n and \"wr_val a \\ Some u\"\n and \"step t a \\ \\'\"\nshows \"[\\\\<^sub>x u]\\<^sub>i \\'\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[1]\n using assms(1)\n apply(elim conjE)\n apply(simp add: opsem_def init_val_def visible_writes_def valid_fresh_ts_def value_def)\n apply(simp add: write_trans_def rev_app_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply(unfold writes_on_def)\n apply(elim conjE, intro conjI)\n apply simp\n apply(elim conjE)\n apply clarsimp\n apply (smt less_trans order.asym)\n apply clarsimp\n using assms(3) apply auto[1]\n using assms(2) by auto\n\n\ncorollary no_val_WrX_diff_val_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ v \\ u \\ \\ [y := v]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n by (metis WrX_def isWr.simps(2) no_val_write_diff_value_pres option.sel wr_val.simps(1))\n\ncorollary no_val_WrR_diff_val_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ v \\ u \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n by (metis WrR_def isWr.simps(2) no_val_write_diff_value_pres option.sel wr_val.simps(1))\n\nlemma no_val_write_diff_var_pres:\n assumes \"[\\\\<^sub>x u]\\<^sub>i \\\"\n and \"isWr a\"\n and \"avar a \\ x\"\n and \"step t a \\ \\'\"\nshows \"[\\\\<^sub>x u]\\<^sub>i \\'\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[1]\n using assms(1)\n apply(elim conjE)\n apply(simp add: opsem_def init_val_def visible_writes_def valid_fresh_ts_def value_def)\n apply(simp add: write_trans_def rev_app_def add_cv_def update_mods_def update_modView_def update_thrView_def)\n apply(unfold writes_on_def)\n apply(elim conjE, intro conjI)\n apply simp\n apply(elim conjE)\n apply clarsimp\n apply (smt less_trans order.asym)\n apply clarsimp\n using assms(3) apply auto[1]\n using assms(2) by auto\n\ncorollary no_val_Wr_diff_var_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ x \\ y \\ \\ [y := v]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n by (metis WrX_def avar.simps(2) isWr.simps(2) no_val_write_diff_var_pres)\n\ncorollary no_val_WrR_diff_var_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ x \\ y \\ \\ [y :=\\<^sup>R v]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n by (metis WrR_def avar.simps(2) isWr.simps(2) no_val_write_diff_var_pres)\n\n\nlemma d_obs_enc: \"wfs \\ \\ d_obs_t \\ t x v \\ enc_t \\ t x v\"\n apply(simp add: opsem_def d_obs_t_def d_obs_def lastWr_def value_def)\n apply(unfold wfs_def writes_on_def) apply simp\n apply(elim conjE)\n by (metis (no_types, lifting) less_eq_rat_def) \n\n\nlemma no_val_Update_diff_var_pres:\n assumes \"[\\\\<^sub>x u]\\<^sub>i \\\"\n and \"isUp a\"\n and \"avar a \\ x\"\n and \"step t a \\ \\'\"\nshows \"[\\\\<^sub>x u]\\<^sub>i \\'\"\n apply(rule step_cases[OF assms(4)])\n using assms(2) apply auto[1]\n using assms(2) apply auto[1]\n using assms(1)\n apply(elim conjE)\n apply(simp add: update_simps opsem_def)\n apply(unfold writes_on_def)\n apply clarsimp\n apply (intro conjI impI)\n apply(simp add: releasing_def tst_def )\n using assms(4) init_val_pres apply blast\n apply clarsimp\n apply (intro conjI impI)\n apply(simp add: releasing_def tst_def )\n using assms(3) avar.simps(3) apply blast\n apply clarsimp\n apply (intro conjI impI)\n apply(simp add: releasing_def tst_def )\n using assms(3) avar.simps(3) apply blast\n apply(simp add: releasing_def ts_oride_def tst_def value_def)\n apply auto\n using assms(3) apply auto[1]\n using assms(4) init_val_pres apply blast\n using assms(3) avar.simps(3) apply blast\n using assms(3) avar.simps(3) apply blast\n apply(simp add: releasing_def ts_oride_def tst_def value_def)\n using assms(3) by auto\n\ncorollary no_val_RMW_diff_var_pres: \n \" [\\\\<^sub>x u]\\<^sub>i \\ \\ x \\ y \\ \\ RMW[y, v, w]\\<^sub>t \\' \\ [\\\\<^sub>x u]\\<^sub>i \\'\"\n using no_val_Update_diff_var_pres by force\n\n\nend", "meta": {"author": "dalvandi", "repo": "dalvandi.github.io", "sha": "041547a91a9ecce033686db075e66ec9d5768a0b", "save_path": "github-repos/isabelle/dalvandi-dalvandi.github.io", "path": "github-repos/isabelle/dalvandi-dalvandi.github.io/dalvandi.github.io-041547a91a9ecce033686db075e66ec9d5768a0b/ECOOP2020/Isabelle/OpSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.28819909939536564}} {"text": "theory Wasm_Type_Printing imports Wasm_Base_Defs begin\n(* Maps types to Andreas' Ocaml implementation - a thin wrapper over Ocaml ints/floats for the most part. *)\n\ncode_printing\n(* type_constructor i32 \\ (OCaml) \"I32Wrapper.t\" *)\n(*| type_constructor i64 \\ (OCaml) \"I64Wrapper.t\" *)\n type_constructor f32 \\ (OCaml) \"F32Wrapper.t\"\n| type_constructor f64 \\ (OCaml) \"F64Wrapper.t\"\n\n(* zero consts *)\ncode_printing\n(* constant zero_i32_inst.zero_i32 \\ (OCaml) \"I32Wrapper.zero\"\n| constant zero_i64_inst.zero_i64 \\ (OCaml) \"I64Wrapper.zero\" *)\n constant zero_f32_inst.zero_f32 \\ (OCaml) \"F32Wrapper.zero\"\n| constant zero_f64_inst.zero_f64 \\ (OCaml) \"F64Wrapper.zero\"\n\n(* intra-{int,float} conversions *)\ncode_printing\n(* constant wasm_wrap \\ (OCaml) \"(I32Wrapper'_convert.wrap'_i64)\"\n| constant wasm_extend_u \\ (OCaml) \"(I64Wrapper'_convert.extend'_u'_i32)\"\n| constant wasm_extend_s \\ (OCaml) \"(I64Wrapper'_convert.extend'_s'_i32)\" *)\n constant wasm_demote \\ (OCaml) \"(F32Wrapper'_convert.demote'_f64)\"\n| constant wasm_promote \\ (OCaml) \"(F64Wrapper'_convert.promote'_f32)\"\n\ntext\\\nRepeat all code equations explicitly again because the ones like @{const I32.int_clz} do not work\nin export_code. Most of these are simply the original definitions, but we can also do some minor\noptimizations like in @{const int_shl} and others below.\n\\\nlemma[code]: \"int_clz (Abs_i32 x) = Abs_i32 (of_nat (word_clz x))\"\n by (simp add: I32.int_clz_def int_clz_i32.abs_eq)\nlemma[code]: \"int_ctz (Abs_i32 x) = Abs_i32 (of_nat (word_ctz x))\"\n by (simp add: I32.int_ctz_def int_ctz_i32.abs_eq)\nlemma[code]: \"int_popcnt (Abs_i32 x) = Abs_i32 (of_nat (pop_count x))\"\n by (simp add: I32.int_popcnt_def int_popcnt_i32.abs_eq)\nlemma[code]: \"int_add (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x + y)\"\n by (simp add: I32.int_add_def int_add_i32.abs_eq)\nlemma[code]: \"int_sub (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x - y)\"\n by (simp add: I32.int_sub_def int_sub_i32.abs_eq)\nlemma[code]: \"int_mul (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x * y)\"\n by (simp add: I32.int_mul_def int_mul_i32.abs_eq)\nlemma[code]: \"int_div_u (Abs_i32 x) (Abs_i32 y) =\n (if y = 0 then None else Some (Abs_i32 (x div y)))\"\n by (simp add: int_div_u_i32.abs_eq I32.int_div_u_def)\nlemma[code]: \"int_div_s (Abs_i32 x) (Abs_i32 y) =\n (if y = 0 \\ (x = of_int (-(2^(LENGTH(i32) - 1))) \\ y = of_int (-1))\n then None else Some (Abs_i32 (x sdiv y)))\"\n by (simp add: int_div_s_i32.abs_eq I32.int_div_s_def)\nlemma[code]: \"int_rem_u (Abs_i32 x) (Abs_i32 y) =\n (if y = 0 then None else Some (Abs_i32 (x mod y)))\"\n by (simp add: int_rem_u_i32.abs_eq I32.int_rem_u_def)\nlemma[code]: \"int_rem_s (Abs_i32 x) (Abs_i32 y) =\n (if y = 0 then None else Some (Abs_i32 (x smod y)))\"\n by (simp add: int_rem_s_i32.abs_eq I32.int_rem_s_def)\nlemma[code]: \"int_and (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x AND y)\"\n by (simp add: I32.int_and_def int_and_i32.abs_eq)\nlemma[code]: \"int_or (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x OR y)\"\n by (simp add: I32.int_or_def int_or_i32.abs_eq)\nlemma[code]: \"int_xor (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x XOR y)\"\n by (simp add: I32.int_xor_def int_xor_i32.abs_eq)\nlemma mod_i32: \"x AND 31 = x mod LENGTH(i32)\"\nproof -\n have int: \"int x mod (int LENGTH(i32)) = int x AND 31\" using AND_mod[of \"int x\" 5] by simp\n thus ?thesis by (simp add: int int_ops(3) nat_int.Rep_eqD of_nat_and_eq zmod_int)\nqed\nlemma[code]: \"int_shl (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x << (unat y AND 31))\"\n by (simp add: I32.int_shl_def int_shl_i32.abs_eq mod_i32)\nlemma[code]: \"int_shr_u (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x >> (unat y AND 31))\"\n by (simp add: I32.int_shr_u_def int_shr_u_i32.abs_eq mod_i32)\nlemma[code]: \"int_shr_s (Abs_i32 x) (Abs_i32 y) = Abs_i32 (x >>> (unat y AND 31))\"\n by (simp add: I32.int_shr_s_def int_shr_s_i32.abs_eq mod_i32)\nlemma[code]: \"int_rotl (Abs_i32 x) (Abs_i32 y) = Abs_i32 (word_rotl (unat y) x)\"\n by (simp add: I32.int_rotl_def int_rotl_i32.abs_eq)\nlemma[code]: \"int_rotr (Abs_i32 x) (Abs_i32 y) = Abs_i32 (word_rotr (unat y) x)\"\n by (simp add: I32.int_rotr_def int_rotr_i32.abs_eq)\nlemma[code]: \"int_eqz (Abs_i32 x) \\ x = 0\"\nproof -\n have \"x = 0 \\ Abs_i32 x = 0\"\n unfolding zero_i32_def\n by (metis Abs_fnat_hom_0 I32.rep_abs)\n thus ?thesis using I32.int_eqz_def int_eqz_i32.rep_eq by presburger\nqed\nlemma[code]: \"int_eq (Abs_i32 x) (Abs_i32 y) \\ x = y\"\n by (simp add: I32.int_eq_def int_eq_i32.abs_eq)\nlemma[code]: \"int_lt_u (Abs_i32 x) (Abs_i32 y) \\ x < y\"\n by (simp add: I32.int_lt_u_def int_lt_u_i32.abs_eq)\nlemma[code]: \"int_lt_s (Abs_i32 x) (Abs_i32 y) \\ x x > y\"\n by (simp add: I32.int_gt_u_def int_gt_u_i32.abs_eq)\nlemma[code]: \"int_gt_s (Abs_i32 x) (Abs_i32 y) \\ signed.greater x y\"\n by (simp add: I32.int_gt_s_def int_gt_s_i32.abs_eq)\nlemma[code]: \"int_le_u (Abs_i32 x) (Abs_i32 y) \\ x \\ y\"\n by (simp add: I32.int_le_u_def int_le_u_i32.abs_eq)\nlemma[code]: \"int_le_s (Abs_i32 x) (Abs_i32 y) \\ x \\s y\"\n by (simp add: I32.int_le_s_def int_le_s_i32.abs_eq)\nlemma[code]: \"int_ge_u (Abs_i32 x) (Abs_i32 y) \\ x \\ y\"\n by (simp add: I32.int_ge_u_def int_ge_u_i32.abs_eq)\nlemma[code]: \"int_ge_s (Abs_i32 x) (Abs_i32 y) \\ signed.greater_eq x y\"\n by (simp add: I32.int_ge_s_def int_ge_s_i32.abs_eq)\n\nlemma[code]: \"int_clz (Abs_i64 x) = Abs_i64 (of_nat (word_clz x))\"\n by (simp add: I64.int_clz_def int_clz_i64.abs_eq)\nlemma[code]: \"int_ctz (Abs_i64 x) = Abs_i64 (of_nat (word_ctz x))\"\n by (simp add: I64.int_ctz_def int_ctz_i64.abs_eq)\nlemma[code]: \"int_popcnt (Abs_i64 x) = Abs_i64 (of_nat (pop_count x))\"\n by (simp add: I64.int_popcnt_def int_popcnt_i64.abs_eq)\nlemma[code]: \"int_add (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x + y)\"\n by (simp add: I64.int_add_def int_add_i64.abs_eq)\nlemma[code]: \"int_sub (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x - y)\"\n by (simp add: I64.int_sub_def int_sub_i64.abs_eq)\nlemma[code]: \"int_mul (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x * y)\"\n by (simp add: I64.int_mul_def int_mul_i64.abs_eq)\nlemma[code]: \"int_div_u (Abs_i64 x) (Abs_i64 y) =\n (if y = 0 then None else Some (Abs_i64 (x div y)))\"\n by (simp add: int_div_u_i64.abs_eq I64.int_div_u_def)\nlemma[code]: \"int_div_s (Abs_i64 x) (Abs_i64 y) =\n (if y = 0 \\ (x = of_int (-(2^(LENGTH(i64) - 1))) \\ y = of_int (-1))\n then None else Some (Abs_i64 (x sdiv y)))\"\n by (simp add: int_div_s_i64.abs_eq I64.int_div_s_def)\nlemma[code]: \"int_rem_u (Abs_i64 x) (Abs_i64 y) =\n (if y = 0 then None else Some (Abs_i64 (x mod y)))\"\n by (simp add: int_rem_u_i64.abs_eq I64.int_rem_u_def)\nlemma[code]: \"int_rem_s (Abs_i64 x) (Abs_i64 y) =\n (if y = 0 then None else Some (Abs_i64 (x smod y)))\"\n by (simp add: int_rem_s_i64.abs_eq I64.int_rem_s_def)\nlemma[code]: \"int_and (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x AND y)\"\n by (simp add: I64.int_and_def int_and_i64.abs_eq)\nlemma[code]: \"int_or (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x OR y)\"\n by (simp add: I64.int_or_def int_or_i64.abs_eq)\nlemma[code]: \"int_xor (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x XOR y)\"\n by (simp add: I64.int_xor_def int_xor_i64.abs_eq)\nlemma mod_i64: \"x AND 63 = x mod LENGTH(i64)\"\nproof -\n have int: \"int x mod (int LENGTH(i64)) = int x AND 63\" using AND_mod[of \"int x\" 6] by simp\n thus ?thesis by (simp add: int int_ops(3) nat_int.Rep_eqD of_nat_and_eq zmod_int)\nqed\nlemma[code]: \"int_shl (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x << (unat y AND 63))\"\n by (simp add: I64.int_shl_def int_shl_i64.abs_eq mod_i64)\nlemma[code]: \"int_shr_u (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x >> (unat y AND 63))\"\n by (simp add: I64.int_shr_u_def int_shr_u_i64.abs_eq mod_i64)\nlemma[code]: \"int_shr_s (Abs_i64 x) (Abs_i64 y) = Abs_i64 (x >>> (unat y AND 63))\"\n by (simp add: I64.int_shr_s_def int_shr_s_i64.abs_eq mod_i64)\nlemma[code]: \"int_rotl (Abs_i64 x) (Abs_i64 y) = Abs_i64 (word_rotl (unat y) x)\"\n by (simp add: I64.int_rotl_def int_rotl_i64.abs_eq)\nlemma[code]: \"int_rotr (Abs_i64 x) (Abs_i64 y) = Abs_i64 (word_rotr (unat y) x)\"\n by (simp add: I64.int_rotr_def int_rotr_i64.abs_eq)\nlemma[code]: \"int_eqz (Abs_i64 x) \\ x = 0\"\nproof -\n have \"x = 0 \\ Abs_i64 x = 0\"\n unfolding zero_i64_def\n by (metis Abs_fnat_hom_0 I64.rep_abs)\n thus ?thesis using I64.int_eqz_def int_eqz_i64.rep_eq by presburger\nqed\nlemma[code]: \"int_eq (Abs_i64 x) (Abs_i64 y) \\ x = y\"\n by (simp add: I64.int_eq_def int_eq_i64.abs_eq)\nlemma[code]: \"int_lt_u (Abs_i64 x) (Abs_i64 y) \\ x < y\"\n by (simp add: I64.int_lt_u_def int_lt_u_i64.abs_eq)\nlemma[code]: \"int_lt_s (Abs_i64 x) (Abs_i64 y) \\ x x > y\"\n by (simp add: I64.int_gt_u_def int_gt_u_i64.abs_eq)\nlemma[code]: \"int_gt_s (Abs_i64 x) (Abs_i64 y) \\ signed.greater x y\"\n by (simp add: I64.int_gt_s_def int_gt_s_i64.abs_eq)\nlemma[code]: \"int_le_u (Abs_i64 x) (Abs_i64 y) \\ x \\ y\"\n by (simp add: I64.int_le_u_def int_le_u_i64.abs_eq)\nlemma[code]: \"int_le_s (Abs_i64 x) (Abs_i64 y) \\ x \\s y\"\n by (simp add: I64.int_le_s_def int_le_s_i64.abs_eq)\nlemma[code]: \"int_ge_u (Abs_i64 x) (Abs_i64 y) \\ x \\ y\"\n by (simp add: I64.int_ge_u_def int_ge_u_i64.abs_eq)\nlemma[code]: \"int_ge_s (Abs_i64 x) (Abs_i64 y) \\ signed.greater_eq x y\"\n by (simp add: I64.int_ge_s_def int_ge_s_i64.abs_eq)\n\n(* Sometimes to implement conversions we need to indirect through OCaml int types *)\ntypedecl ocaml_i32\ntypedecl ocaml_i64\ntypedecl ocaml_char\n\ncode_printing\n type_constructor ocaml_i32 \\ (OCaml) \"Int32.t\"\n| type_constructor ocaml_i64 \\ (OCaml) \"Int64.t\"\n| type_constructor ocaml_char \\ (OCaml) \"Char.t\"\n\naxiomatization\n ocaml_i32_to_integer :: \"ocaml_i32 \\ integer\" and\n integer_to_ocaml_i32 :: \"integer \\ ocaml_i32\" and\n ocaml_i64_to_integer :: \"ocaml_i64 \\ integer\" and\n integer_to_ocaml_i64 :: \"integer \\ ocaml_i64\" and\n ocaml_char_to_integer :: \"ocaml_char \\ integer\" and\n integer_to_ocaml_char :: \"integer \\ ocaml_char\"\n\ncode_printing\n constant ocaml_i32_to_integer \\ (OCaml) \"LibAux.z'_of'_uint32\"\n| constant integer_to_ocaml_i32 \\ (OCaml) \"LibAux.uint32'_of'_z\"\n| constant ocaml_i64_to_integer \\ (OCaml) \"LibAux.z'_of'_uint64\"\n| constant integer_to_ocaml_i64 \\ (OCaml) \"LibAux.uint64'_of'_z\"\n| constant ocaml_char_to_integer \\ (OCaml) \"LibAux.z'_of'_char\"\n| constant integer_to_ocaml_char \\ (OCaml) \"LibAux.char'_of'_z\"\n\ndefinition ocaml_int32_to_isabelle_int32 :: \"ocaml_i32 \\ i32\" where\n \"ocaml_int32_to_isabelle_int32 n \\ wasm_int_ops_i32_inst.int_of_nat_i32 (nat_of_integer (ocaml_i32_to_integer n))\"\n\ndefinition isabelle_int32_to_ocaml_int32 :: \"i32 \\ ocaml_i32\" where\n \"isabelle_int32_to_ocaml_int32 n \\ integer_to_ocaml_i32 (integer_of_nat (wasm_int_ops_i32_inst.nat_of_int_i32 n))\"\n\ndefinition ocaml_int64_to_isabelle_int64 :: \"ocaml_i64 \\ i64\" where\n \"ocaml_int64_to_isabelle_int64 n \\ wasm_int_ops_i64_inst.int_of_nat_i64 (nat_of_integer (ocaml_i64_to_integer n))\"\n\ndefinition isabelle_int64_to_ocaml_int64 :: \"i64 \\ ocaml_i64\" where\n \"isabelle_int64_to_ocaml_int64 n \\ integer_to_ocaml_i64 (integer_of_nat (wasm_int_ops_i64_inst.nat_of_int_i64 n))\"\n\ndefinition ocaml_char_to_isabelle_byte :: \"ocaml_char \\ byte\" where\n \"ocaml_char_to_isabelle_byte n \\ byte_of_nat (nat_of_integer (ocaml_char_to_integer n))\"\n\ndefinition isabelle_byte_to_ocaml_char :: \"byte \\ ocaml_char\" where\n \"isabelle_byte_to_ocaml_char n \\ integer_to_ocaml_char (integer_of_nat (nat_of_byte n))\"\n\n(* axiomatise the existence of conversions between floats and OCaml ints/char lists *)\naxiomatization\n f32_convert_u_ocaml_i32 :: \"ocaml_i32 \\ f32\" and\n f32_convert_s_ocaml_i32 :: \"ocaml_i32 \\ f32\" and\n f32_convert_u_ocaml_i64 :: \"ocaml_i64 \\ f32\" and\n f32_convert_s_ocaml_i64 :: \"ocaml_i64 \\ f32\" and\n f64_convert_u_ocaml_i32 :: \"ocaml_i32 \\ f64\" and\n f64_convert_s_ocaml_i32 :: \"ocaml_i32 \\ f64\" and\n f64_convert_u_ocaml_i64 :: \"ocaml_i64 \\ f64\" and\n f64_convert_s_ocaml_i64 :: \"ocaml_i64 \\ f64\" and\n ocaml_i32_trunc_u_f32 :: \"f32 \\ ocaml_i32 option\" and\n ocaml_i32_trunc_s_f32 :: \"f32 \\ ocaml_i32 option\" and\n ocaml_i32_trunc_u_f64 :: \"f64 \\ ocaml_i32 option\" and\n ocaml_i32_trunc_s_f64 :: \"f64 \\ ocaml_i32 option\" and\n ocaml_i64_trunc_u_f32 :: \"f32 \\ ocaml_i64 option\" and\n ocaml_i64_trunc_s_f32 :: \"f32 \\ ocaml_i64 option\" and\n ocaml_i64_trunc_u_f64 :: \"f64 \\ ocaml_i64 option\" and\n ocaml_i64_trunc_s_f64 :: \"f64 \\ ocaml_i64 option\" and\n f32_serialise_ocaml_char :: \"f32 \\ ocaml_char list\" and\n f64_serialise_ocaml_char :: \"f64 \\ ocaml_char list\" and\n f32_deserialise_ocaml_char :: \"ocaml_char list \\ f32\" and\n f64_deserialise_ocaml_char :: \"ocaml_char list \\ f64\"\n\ncode_printing\n constant f32_convert_u_ocaml_i32 \\ (OCaml) \"F32Wrapper'_convert.convert'_u'_i32\"\n| constant f32_convert_s_ocaml_i32 \\ (OCaml) \"F32Wrapper'_convert.convert'_s'_i32\"\n| constant f32_convert_u_ocaml_i64 \\ (OCaml) \"F32Wrapper'_convert.convert'_u'_i64\"\n| constant f32_convert_s_ocaml_i64 \\ (OCaml) \"F32Wrapper'_convert.convert'_s'_i64\"\n| constant f64_convert_u_ocaml_i32 \\ (OCaml) \"F64Wrapper'_convert.convert'_u'_i32\"\n| constant f64_convert_s_ocaml_i32 \\ (OCaml) \"F64Wrapper'_convert.convert'_s'_i32\"\n| constant f64_convert_u_ocaml_i64 \\ (OCaml) \"F64Wrapper'_convert.convert'_u'_i64\"\n| constant f64_convert_s_ocaml_i64 \\ (OCaml) \"F64Wrapper'_convert.convert'_s'_i64\"\n| constant ocaml_i32_trunc_u_f32 \\ (OCaml) \"I32Wrapper'_convert.trunc'_u'_f32\"\n| constant ocaml_i32_trunc_s_f32 \\ (OCaml) \"I32Wrapper'_convert.trunc'_s'_f32\"\n| constant ocaml_i32_trunc_u_f64 \\ (OCaml) \"I32Wrapper'_convert.trunc'_u'_f64\"\n| constant ocaml_i32_trunc_s_f64 \\ (OCaml) \"I32Wrapper'_convert.trunc'_s'_f64\"\n| constant ocaml_i64_trunc_u_f32 \\ (OCaml) \"I64Wrapper'_convert.trunc'_u'_f32\"\n| constant ocaml_i64_trunc_s_f32 \\ (OCaml) \"I64Wrapper'_convert.trunc'_s'_f32\"\n| constant ocaml_i64_trunc_u_f64 \\ (OCaml) \"I64Wrapper'_convert.trunc'_u'_f64\"\n| constant ocaml_i64_trunc_s_f64 \\ (OCaml) \"I64Wrapper'_convert.trunc'_s'_f64\"\n| constant f32_serialise_ocaml_char \\ (OCaml) \"ImplWrapper.serialise'_f32\"\n| constant f64_serialise_ocaml_char \\ (OCaml) \"ImplWrapper.serialise'_f64\"\n| constant f32_deserialise_ocaml_char \\ (OCaml) \"ImplWrapper.deserialise'_f32\"\n| constant f64_deserialise_ocaml_char \\ (OCaml) \"ImplWrapper.deserialise'_f64\"\n\ndefinition f32_convert_u_isabelle_i32 :: \"i32 \\ f32\" where\n \"f32_convert_u_isabelle_i32 i = f32_convert_u_ocaml_i32 (isabelle_int32_to_ocaml_int32 i)\"\n\ndefinition f32_convert_s_isabelle_i32 :: \"i32 \\ f32\" where\n \"f32_convert_s_isabelle_i32 i = f32_convert_s_ocaml_i32 (isabelle_int32_to_ocaml_int32 i)\"\n\ndefinition f32_convert_u_isabelle_i64 :: \"i64 \\ f32\" where\n \"f32_convert_u_isabelle_i64 i = f32_convert_u_ocaml_i64 (isabelle_int64_to_ocaml_int64 i)\"\n\ndefinition f32_convert_s_isabelle_i64 :: \"i64 \\ f32\" where\n \"f32_convert_s_isabelle_i64 i = f32_convert_s_ocaml_i64 (isabelle_int64_to_ocaml_int64 i)\"\n\ndefinition f64_convert_u_isabelle_i32 :: \"i32 \\ f64\" where\n \"f64_convert_u_isabelle_i32 i = f64_convert_u_ocaml_i32 (isabelle_int32_to_ocaml_int32 i)\"\n\ndefinition f64_convert_s_isabelle_i32 :: \"i32 \\ f64\" where\n \"f64_convert_s_isabelle_i32 i = f64_convert_s_ocaml_i32 (isabelle_int32_to_ocaml_int32 i)\"\n\ndefinition f64_convert_u_isabelle_i64 :: \"i64 \\ f64\" where\n \"f64_convert_u_isabelle_i64 i = f64_convert_u_ocaml_i64 (isabelle_int64_to_ocaml_int64 i)\"\n\ndefinition f64_convert_s_isabelle_i64 :: \"i64 \\ f64\" where\n \"f64_convert_s_isabelle_i64 i = f64_convert_s_ocaml_i64 (isabelle_int64_to_ocaml_int64 i)\"\n\ndefinition isabelle_i32_trunc_u_f32 :: \"f32 \\i32 option\" where\n \"isabelle_i32_trunc_u_f32 f = map_option ocaml_int32_to_isabelle_int32 (ocaml_i32_trunc_u_f32 f)\"\n\ndefinition isabelle_i32_trunc_s_f32 :: \"f32 \\i32 option\" where\n \"isabelle_i32_trunc_s_f32 f = map_option ocaml_int32_to_isabelle_int32 (ocaml_i32_trunc_s_f32 f)\"\n\ndefinition isabelle_i32_trunc_u_f64 :: \"f64 \\i32 option\" where\n \"isabelle_i32_trunc_u_f64 f = map_option ocaml_int32_to_isabelle_int32 (ocaml_i32_trunc_u_f64 f)\"\n\ndefinition isabelle_i32_trunc_s_f64 :: \"f64 \\i32 option\" where\n \"isabelle_i32_trunc_s_f64 f = map_option ocaml_int32_to_isabelle_int32 (ocaml_i32_trunc_s_f64 f)\"\n\ndefinition isabelle_i64_trunc_u_f32 :: \"f32 \\i64 option\" where\n \"isabelle_i64_trunc_u_f32 f = map_option ocaml_int64_to_isabelle_int64 (ocaml_i64_trunc_u_f32 f)\"\n\ndefinition isabelle_i64_trunc_s_f32 :: \"f32 \\i64 option\" where\n \"isabelle_i64_trunc_s_f32 f = map_option ocaml_int64_to_isabelle_int64 (ocaml_i64_trunc_s_f32 f)\"\n\ndefinition isabelle_i64_trunc_u_f64 :: \"f64 \\i64 option\" where\n \"isabelle_i64_trunc_u_f64 f = map_option ocaml_int64_to_isabelle_int64 (ocaml_i64_trunc_u_f64 f)\"\n\ndefinition isabelle_i64_trunc_s_f64 :: \"f64 \\i64 option\" where\n \"isabelle_i64_trunc_s_f64 f = map_option ocaml_int64_to_isabelle_int64 (ocaml_i64_trunc_s_f64 f)\"\n\ndefinition f32_serialise_isabelle_bytes :: \"f32 \\ bytes\" where\n \"f32_serialise_isabelle_bytes f = List.map ocaml_char_to_isabelle_byte (f32_serialise_ocaml_char f)\"\n\ndefinition f64_serialise_isabelle_bytes :: \"f64 \\ bytes\" where\n \"f64_serialise_isabelle_bytes f = List.map ocaml_char_to_isabelle_byte (f64_serialise_ocaml_char f)\"\n\ndefinition f32_deserialise_isabelle_bytes :: \"bytes \\ f32\" where\n \"f32_deserialise_isabelle_bytes bs = f32_deserialise_ocaml_char (List.map isabelle_byte_to_ocaml_char bs)\"\n\ndefinition f64_deserialise_isabelle_bytes :: \"bytes \\ f64\" where\n \"f64_deserialise_isabelle_bytes bs = f64_deserialise_ocaml_char (List.map isabelle_byte_to_ocaml_char bs)\"\n\naxiomatization where\n f32_convert_ui32_is[code]: \"f32_convert_ui32 \\ f32_convert_u_isabelle_i32\" and\n f32_convert_si32_is[code]: \"f32_convert_si32 \\ f32_convert_s_isabelle_i32\" and\n f32_convert_ui64_is[code]: \"f32_convert_ui64 \\ f32_convert_u_isabelle_i64\" and\n f32_convert_si64_is[code]: \"f32_convert_si64 \\ f32_convert_s_isabelle_i64\" and\n f64_convert_ui32_is[code]: \"f64_convert_ui32 \\ f64_convert_u_isabelle_i32\" and\n f64_convert_si32_is[code]: \"f64_convert_si32 \\ f64_convert_s_isabelle_i32\" and\n f64_convert_ui64_is[code]: \"f64_convert_ui64 \\ f64_convert_u_isabelle_i64\" and\n f64_convert_si64_is[code]: \"f64_convert_si64 \\ f64_convert_s_isabelle_i64\" and\n ui32_trunc_f32_is[code]: \"ui32_trunc_f32 \\ isabelle_i32_trunc_u_f32\" and\n si32_trunc_f32_is[code]: \"si32_trunc_f32 \\ isabelle_i32_trunc_u_f32\" and\n ui32_trunc_f64_is[code]: \"ui32_trunc_f64 \\ isabelle_i32_trunc_u_f64\" and\n si32_trunc_f64_is[code]: \"si32_trunc_f64 \\ isabelle_i32_trunc_u_f64\" and\n ui64_trunc_f32_is[code]: \"ui64_trunc_f32 \\ isabelle_i64_trunc_u_f32\" and\n si64_trunc_f32_is[code]: \"si64_trunc_f32 \\ isabelle_i64_trunc_u_f32\" and\n ui64_trunc_f64_is[code]: \"ui64_trunc_f64 \\ isabelle_i64_trunc_u_f64\" and\n si64_trunc_f64_is[code]: \"si64_trunc_f64 \\ isabelle_i64_trunc_u_f64\" and\n serialise_f32_is[code]: \"serialise_f32 \\ f32_serialise_isabelle_bytes\" and\n serialise_f64_is[code]: \"serialise_f64 \\ f64_serialise_isabelle_bytes\" and\n deserialise_f32_is[code]: \"deserialise_f32 \\ f32_deserialise_isabelle_bytes\" and\n deserialise_f64_is[code]: \"deserialise_f64 \\ f64_deserialise_isabelle_bytes\"\n\n(* arithmetic *)\ncode_printing\n(* INT32 *)\n (* UNOPS *)\n(* constant wasm_int_ops_i32_inst.int_clz_i32 \\ (OCaml) \"I32Wrapper.clz\"\n| constant wasm_int_ops_i32_inst.int_ctz_i32 \\ (OCaml) \"I32Wrapper.ctz\"\n| constant wasm_int_ops_i32_inst.int_popcnt_i32 \\ (OCaml) \"I32Wrapper.popcnt\"\n (* BINOPS - wrap *)\n| constant wasm_int_ops_i32_inst.int_add_i32 \\ (OCaml) \"I32Wrapper.add\"\n| constant wasm_int_ops_i32_inst.int_sub_i32 \\ (OCaml) \"I32Wrapper.sub\"\n| constant wasm_int_ops_i32_inst.int_mul_i32 \\ (OCaml) \"I32Wrapper.mul\"\n| constant wasm_int_ops_i32_inst.int_div_u_i32 \\ (OCaml) \"I32Wrapper.div'_u\"\n| constant wasm_int_ops_i32_inst.int_div_s_i32 \\ (OCaml) \"I32Wrapper.div'_s\"\n| constant wasm_int_ops_i32_inst.int_rem_u_i32 \\ (OCaml) \"I32Wrapper.rem'_u\"\n| constant wasm_int_ops_i32_inst.int_rem_s_i32 \\ (OCaml) \"I32Wrapper.rem'_s\"\n| constant wasm_int_ops_i32_inst.int_and_i32 \\ (OCaml) \"I32Wrapper.and'_\"\n| constant wasm_int_ops_i32_inst.int_or_i32 \\ (OCaml) \"I32Wrapper.or'_\"\n| constant wasm_int_ops_i32_inst.int_xor_i32 \\ (OCaml) \"I32Wrapper.xor\"\n| constant wasm_int_ops_i32_inst.int_shl_i32 \\ (OCaml) \"I32Wrapper.shl\"\n| constant wasm_int_ops_i32_inst.int_shr_u_i32 \\ (OCaml) \"I32Wrapper.shr'_u\"\n| constant wasm_int_ops_i32_inst.int_shr_s_i32 \\ (OCaml) \"I32Wrapper.shr'_s\"\n| constant wasm_int_ops_i32_inst.int_rotl_i32 \\ (OCaml) \"I32Wrapper.rotl\"\n| constant wasm_int_ops_i32_inst.int_rotr_i32 \\ (OCaml) \"I32Wrapper.rotr\"\n (* TESTOPS *)\n| constant wasm_int_ops_i32_inst.int_eqz_i32 \\ (OCaml) \"I32Wrapper.eqz\"\n (* RELOPS *)\n| constant wasm_int_ops_i32_inst.int_eq_i32 \\ (OCaml) \"I32Wrapper.eq\"\n| constant wasm_int_ops_i32_inst.int_lt_u_i32 \\ (OCaml) \"I32Wrapper.lt'_u\"\n| constant wasm_int_ops_i32_inst.int_lt_s_i32 \\ (OCaml) \"I32Wrapper.lt'_s\"\n| constant wasm_int_ops_i32_inst.int_gt_u_i32 \\ (OCaml) \"I32Wrapper.gt'_u\"\n| constant wasm_int_ops_i32_inst.int_gt_s_i32 \\ (OCaml) \"I32Wrapper.gt'_s\"\n| constant wasm_int_ops_i32_inst.int_le_u_i32 \\ (OCaml) \"I32Wrapper.le'_u\"\n| constant wasm_int_ops_i32_inst.int_le_s_i32 \\ (OCaml) \"I32Wrapper.le'_s\"\n| constant wasm_int_ops_i32_inst.int_ge_u_i32 \\ (OCaml) \"I32Wrapper.ge'_u\"\n| constant wasm_int_ops_i32_inst.int_ge_s_i32 \\ (OCaml) \"I32Wrapper.ge'_s\" *)\n (* CONVERSIONS *)\n(*\n constant f32_convert_ui32 \\ (OCaml) \"F32Wrapper'_convert.convert'_u'_i32\"\n| constant f32_convert_si32 \\ (OCaml) \"F32Wrapper'_convert.convert'_s'_i32\"\n| constant f64_convert_ui32 \\ (OCaml) \"F64Wrapper'_convert.convert'_u'_i32\"\n| constant f64_convert_si32 \\ (OCaml) \"F64Wrapper'_convert.convert'_s'_i32\"\n*)\n (* VALUE CONVERSIONS - wrap *)\n(* | constant wasm_int_ops_i32_inst.int_of_nat_i32 \\ (OCaml) \"I32Wrapper.int'_of'_z (integer'_of'_nat _)\"\n| constant wasm_int_ops_i32_inst.nat_of_int_i32 \\ (OCaml) \"Nat (I32Wrapper.z'_of'_int _)\" *)\n (* SIGN EXTENDING DESERIALISATION TODO *)\n\n(* INT64 *)\n (* UNOPS *)\n(*| constant wasm_int_ops_i64_inst.int_clz_i64 \\ (OCaml) \"I64Wrapper.clz\"\n| constant wasm_int_ops_i64_inst.int_ctz_i64 \\ (OCaml) \"I64Wrapper.ctz\"\n| constant wasm_int_ops_i64_inst.int_popcnt_i64 \\ (OCaml) \"I64Wrapper.popcnt\"\n (* BINOPS - wrap *)\n| constant wasm_int_ops_i64_inst.int_add_i64 \\ (OCaml) \"I64Wrapper.add\"\n| constant wasm_int_ops_i64_inst.int_sub_i64 \\ (OCaml) \"I64Wrapper.sub\"\n| constant wasm_int_ops_i64_inst.int_mul_i64 \\ (OCaml) \"I64Wrapper.mul\"\n| constant wasm_int_ops_i64_inst.int_div_u_i64 \\ (OCaml) \"I64Wrapper.div'_u\"\n| constant wasm_int_ops_i64_inst.int_div_s_i64 \\ (OCaml) \"I64Wrapper.div'_s\"\n| constant wasm_int_ops_i64_inst.int_rem_u_i64 \\ (OCaml) \"I64Wrapper.rem'_u\"\n| constant wasm_int_ops_i64_inst.int_rem_s_i64 \\ (OCaml) \"I64Wrapper.rem'_s\"\n| constant wasm_int_ops_i64_inst.int_and_i64 \\ (OCaml) \"I64Wrapper.and'_\"\n| constant wasm_int_ops_i64_inst.int_or_i64 \\ (OCaml) \"I64Wrapper.or'_\"\n| constant wasm_int_ops_i64_inst.int_xor_i64 \\ (OCaml) \"I64Wrapper.xor\"\n| constant wasm_int_ops_i64_inst.int_shl_i64 \\ (OCaml) \"I64Wrapper.shl\"\n| constant wasm_int_ops_i64_inst.int_shr_u_i64 \\ (OCaml) \"I64Wrapper.shr'_u\"\n| constant wasm_int_ops_i64_inst.int_shr_s_i64 \\ (OCaml) \"I64Wrapper.shr'_s\"\n| constant wasm_int_ops_i64_inst.int_rotl_i64 \\ (OCaml) \"I64Wrapper.rotl\"\n| constant wasm_int_ops_i64_inst.int_rotr_i64 \\ (OCaml) \"I64Wrapper.rotr\"\n (* TESTOPS *)\n| constant wasm_int_ops_i64_inst.int_eqz_i64 \\ (OCaml) \"I64Wrapper.eqz\"\n (* RELOPS *)\n| constant wasm_int_ops_i64_inst.int_eq_i64 \\ (OCaml) \"I64Wrapper.eq\"\n| constant wasm_int_ops_i64_inst.int_lt_u_i64 \\ (OCaml) \"I64Wrapper.lt'_u\"\n| constant wasm_int_ops_i64_inst.int_lt_s_i64 \\ (OCaml) \"I64Wrapper.lt'_s\"\n| constant wasm_int_ops_i64_inst.int_gt_u_i64 \\ (OCaml) \"I64Wrapper.gt'_u\"\n| constant wasm_int_ops_i64_inst.int_gt_s_i64 \\ (OCaml) \"I64Wrapper.gt'_s\"\n| constant wasm_int_ops_i64_inst.int_le_u_i64 \\ (OCaml) \"I64Wrapper.le'_u\"\n| constant wasm_int_ops_i64_inst.int_le_s_i64 \\ (OCaml) \"I64Wrapper.le'_s\"\n| constant wasm_int_ops_i64_inst.int_ge_u_i64 \\ (OCaml) \"I64Wrapper.ge'_u\"\n| constant wasm_int_ops_i64_inst.int_ge_s_i64 \\ (OCaml) \"I64Wrapper.ge'_s\" *)\n (* CONVERSIONS *)\n(*\n| constant f32_convert_ui64 \\ (OCaml) \"F32Wrapper'_convert.convert'_u'_i64\"\n| constant f32_convert_si64 \\ (OCaml) \"F32Wrapper'_convert.convert'_s'_i64\"\n| constant f64_convert_ui64 \\ (OCaml) \"F64Wrapper'_convert.convert'_u'_i64\"\n| constant f64_convert_si64 \\ (OCaml) \"F64Wrapper'_convert.convert'_s'_i64\"\n*)\n (* VALUE CONVERSIONS - wrap *)\n(*| constant wasm_int_ops_i64_inst.int_of_nat_i64 \\ (OCaml) \"I64Wrapper.int'_of'_z (integer'_of'_nat _)\"\n| constant wasm_int_ops_i64_inst.nat_of_int_i64 \\ (OCaml) \"Nat (I64Wrapper.z'_of'_int _)\" *)\n(* FLOAT32 *)\n (* UNOPS *)\n constant wasm_float_f32_inst.float_neg_f32 \\ (OCaml) \"F32Wrapper.neg\"\n| constant wasm_float_f32_inst.float_abs_f32 \\ (OCaml) \"F32Wrapper.abs\"\n| constant wasm_float_f32_inst.float_ceil_f32 \\ (OCaml) \"F32Wrapper.ceil\"\n| constant wasm_float_f32_inst.float_floor_f32 \\ (OCaml) \"F32Wrapper.floor\"\n| constant wasm_float_f32_inst.float_trunc_f32 \\ (OCaml) \"F32Wrapper.trunc\"\n| constant wasm_float_f32_inst.float_nearest_f32 \\ (OCaml) \"F32Wrapper.nearest\"\n| constant wasm_float_f32_inst.float_sqrt_f32 \\ (OCaml) \"F32Wrapper.sqrt\"\n (* BINOPS *)\n| constant wasm_float_f32_inst.float_add_f32 \\ (OCaml) \"F32Wrapper.add\"\n| constant wasm_float_f32_inst.float_sub_f32 \\ (OCaml) \"F32Wrapper.sub\"\n| constant wasm_float_f32_inst.float_mul_f32 \\ (OCaml) \"F32Wrapper.mul\"\n| constant wasm_float_f32_inst.float_div_f32 \\ (OCaml) \"F32Wrapper.div\"\n| constant wasm_float_f32_inst.float_min_f32 \\ (OCaml) \"F32Wrapper.min\"\n| constant wasm_float_f32_inst.float_max_f32 \\ (OCaml) \"F32Wrapper.max\"\n| constant wasm_float_f32_inst.float_copysign_f32 \\ (OCaml) \"F32Wrapper.copysign\"\n (* RELOPS *)\n| constant wasm_float_f32_inst.float_eq_f32 \\ (OCaml) \"F32Wrapper.eq\"\n(* | constant wasm_float_f32_inst.float_ne_f32 \\ (OCaml) \"F32Wrapper.ne\" *)\n| constant wasm_float_f32_inst.float_lt_f32 \\ (OCaml) \"F32Wrapper.lt\"\n| constant wasm_float_f32_inst.float_gt_f32 \\ (OCaml) \"F32Wrapper.gt\"\n| constant wasm_float_f32_inst.float_le_f32 \\ (OCaml) \"F32Wrapper.le\"\n| constant wasm_float_f32_inst.float_ge_f32 \\ (OCaml) \"F32Wrapper.ge\"\n (* CONVERSIONS *)\n(*\n| constant ui32_trunc_f32 \\ (OCaml) \"I32Wrapper'_convert.trunc'_u'_f32\"\n| constant si32_trunc_f32 \\ (OCaml) \"I32Wrapper'_convert.trunc'_s'_f32\"\n| constant ui64_trunc_f32 \\ (OCaml) \"I64Wrapper'_convert.trunc'_u'_f32\"\n| constant si64_trunc_f32 \\ (OCaml) \"I64Wrapper'_convert.trunc'_s'_f32\"\n*)\n(* FLOAT64 *)\n (* UNOPS *)\n| constant wasm_float_f64_inst.float_neg_f64 \\ (OCaml) \"F64Wrapper.neg\"\n| constant wasm_float_f64_inst.float_abs_f64 \\ (OCaml) \"F64Wrapper.abs\"\n| constant wasm_float_f64_inst.float_ceil_f64 \\ (OCaml) \"F64Wrapper.ceil\"\n| constant wasm_float_f64_inst.float_floor_f64 \\ (OCaml) \"F64Wrapper.floor\"\n| constant wasm_float_f64_inst.float_trunc_f64 \\ (OCaml) \"F64Wrapper.trunc\"\n| constant wasm_float_f64_inst.float_nearest_f64 \\ (OCaml) \"F64Wrapper.nearest\"\n| constant wasm_float_f64_inst.float_sqrt_f64 \\ (OCaml) \"F64Wrapper.sqrt\"\n (* BINOPS *)\n| constant wasm_float_f64_inst.float_add_f64 \\ (OCaml) \"F64Wrapper.add\"\n| constant wasm_float_f64_inst.float_sub_f64 \\ (OCaml) \"F64Wrapper.sub\"\n| constant wasm_float_f64_inst.float_mul_f64 \\ (OCaml) \"F64Wrapper.mul\"\n| constant wasm_float_f64_inst.float_div_f64 \\ (OCaml) \"F64Wrapper.div\"\n| constant wasm_float_f64_inst.float_min_f64 \\ (OCaml) \"F64Wrapper.min\"\n| constant wasm_float_f64_inst.float_max_f64 \\ (OCaml) \"F64Wrapper.max\"\n| constant wasm_float_f64_inst.float_copysign_f64 \\ (OCaml) \"F64Wrapper.copysign\"\n (* RELOPS *)\n| constant wasm_float_f64_inst.float_eq_f64 \\ (OCaml) \"F64Wrapper.eq\"\n(* | constant wasm_float_f64_inst.float_ne_f64 \\ (OCaml) \"F64Wrapper.ne\" *)\n| constant wasm_float_f64_inst.float_lt_f64 \\ (OCaml) \"F64Wrapper.lt\"\n| constant wasm_float_f64_inst.float_gt_f64 \\ (OCaml) \"F64Wrapper.gt\"\n| constant wasm_float_f64_inst.float_le_f64 \\ (OCaml) \"F64Wrapper.le\"\n| constant wasm_float_f64_inst.float_ge_f64 \\ (OCaml) \"F64Wrapper.ge\"\n (* CONVERSIONS *)\n(*\n| constant ui32_trunc_f64 \\ (OCaml) \"I32Wrapper'_convert.trunc'_u'_f64\"\n| constant si32_trunc_f64 \\ (OCaml) \"I32Wrapper'_convert.trunc'_s'_f64\"\n| constant ui64_trunc_f64 \\ (OCaml) \"I64Wrapper'_convert.trunc'_u'_f64\"\n| constant si64_trunc_f64 \\ (OCaml) \"I64Wrapper'_convert.trunc'_s'_f64\"\n*)\n(*\ncode_printing\n constant serialise_i32 \\ (OCaml) \"ImplWrapper.serialise'_i32\"\n| constant serialise_i64 \\ (OCaml) \"ImplWrapper.serialise'_i64\"\n| constant serialise_f32 \\ (OCaml) \"ImplWrapper.serialise'_f32\"\n| constant serialise_f64 \\ (OCaml) \"ImplWrapper.serialise'_f64\"\n| constant deserialise_i32 \\ (OCaml) \"ImplWrapper.deserialise'_i32\"\n| constant deserialise_i64 \\ (OCaml) \"ImplWrapper.deserialise'_i64\"\n| constant deserialise_f32 \\ (OCaml) \"ImplWrapper.deserialise'_f32\"\n| constant deserialise_f64 \\ (OCaml) \"ImplWrapper.deserialise'_f64\"\n| constant wasm_bool \\ (OCaml) \"ImplWrapper.bool\"\n| constant int32_minus_one \\ (OCaml) \"I32Wrapper.minus'_one\" *)\n\nend", "meta": {"author": "WasmCert", "repo": "WasmCert-Isabelle", "sha": "f61ec8eab5d551347a268e858e83b7ac7da0d8b5", "save_path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle", "path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle/WasmCert-Isabelle-f61ec8eab5d551347a268e858e83b7ac7da0d8b5/WebAssembly/Wasm_Type_Printing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.28819909939536564}} {"text": "theory Termination imports \"Hybrid_Logic.Hybrid_Logic\" Trees begin\n\n(*\nInspired by:\nBolander, T., & Blackburn, P. (2007). Termination for Hybrid Tableaus.\nJournal of Logic and Computation, 17(3), 517-554. https://doi.org/10.1093/logcom/exm014\n\n*)\n\n(* TODO: Maybe do B \\ nominals all labels? (still curious about this) *)\n\n(* TODO: is it nicer if we use sets for the introduced formulas? *)\n\nsection \\Tableau\\\n\ndatatype ('a, 'b) tag\n = Close 'b \\('a, 'b) fm\\\n | Open\n | Block 'b\n | Rule 'b \\('a, 'b) fm list list\\\n | Fresh 'b \\('a, 'b) fm\\ 'b\n\ndatatype ('a, 'b) step =\n Step (getTag: \\('a, 'b) tag\\) (getPotential: nat) (getBranch: \\('a, 'b) branch\\)\n\ntype_synonym ('a, 'b) tableau = \\('a, 'b) step tree\\\n\ncoinductive wft :: \\'b set \\ ('a, 'b) tableau \\ bool\\\n for A :: \\'b set\\ where\n WfClose:\n \\p at i in branch \\ (\\<^bold>\\ p) at i in branch \\\n wft A (Node (Step (Close i p) n branch) [])\\\n | WfOpen: (* TODO: Do I want to enforce that this is saturated? *)\n \\\\p i. p at i in branch \\ (\\<^bold>\\ p) at i in branch \\\n wft A (Node (Step Open n branch) [])\\\n | WfNeg:\n \\(\\<^bold>\\ \\<^bold>\\ p) at a in (ps, a) # branch \\\n new p a ((ps, a) # branch) \\\n getBranch (getLabel s) = (p # ps, a) # branch \\\n getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Rule a [[p]]) n ((ps, a) # branch)) [s])\\\n | WfDisP:\n \\(p \\<^bold>\\ q) at a in (ps, a) # branch \\\n new p a ((ps, a) # branch) \\ new q a ((ps, a) # branch) \\\n getBranch (getLabel sl) = (p # ps, a) # branch \\ getPotential (getLabel sl) = Suc n \\\n getBranch (getLabel sr) = (q # ps, a) # branch \\ getPotential (getLabel sr) = Suc n \\\n wft A sl \\ wft A sr \\\n wft A (Node (Step (Rule a [[p], [q]]) n ((ps, a) # branch)) [sl, sr])\\\n | WfDisN:\n \\(\\<^bold>\\ (p \\<^bold>\\ q)) at a in (ps, a) # branch \\\n new (\\<^bold>\\ p) a ((ps, a) # branch) \\ new (\\<^bold>\\ q) a ((ps, a) # branch) \\\n getBranch (getLabel s) = ((\\<^bold>\\ q) # (\\<^bold>\\ p) # ps, a) # branch \\\n getPotential (getLabel s) = Suc n \\\n wft A s \\\n intro = filter (\\p. new p a ((ps, a) # branch)) [\\<^bold>\\ q, \\<^bold>\\ p] \\\n wft A (Node (Step (Rule a [intro]) n ((ps, a) # branch)) [s])\\\n | WfDiaP:\n \\(\\<^bold>\\ p) at a in (ps, a) # branch \\\n i \\ A \\ branch_nominals ((ps, a) # branch) \\\n \\a. p = Nom a \\ \\ witnessed p a ((ps, a) # branch) \\\n getBranch (getLabel s) = ((\\<^bold>@ i p) # (\\<^bold>\\ Nom i) # ps, a) # branch \\\n getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Fresh a p i) n ((ps, a) # branch)) [s])\\\n | WfDiaN:\n \\(\\<^bold>\\ (\\<^bold>\\ p)) at a in (ps, a) # branch \\\n (\\<^bold>\\ Nom i) at a in (ps, a) # branch \\\n new (\\<^bold>\\ (\\<^bold>@ i p)) a ((ps, a) # branch) \\\n getBranch (getLabel s) = ((\\<^bold>\\ (\\<^bold>@ i p)) # ps, a) # branch \\\n getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Rule a [[\\<^bold>\\ (\\<^bold>@ i p)]]) n ((ps, a) # branch)) [s])\\\n | WfSatP:\n \\(\\<^bold>@ a p) at b in (ps, a) # branch \\\n new p a ((ps, a) # branch) \\\n getBranch (getLabel s) = (p # ps, a) # branch \\ getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Rule a [[p]]) n ((ps, a) # branch)) [s])\\\n | WfSatN:\n \\(\\<^bold>\\ (\\<^bold>@ a p)) at b in (ps, a) # branch \\\n new (\\<^bold>\\ p) a ((ps, a) # branch) \\\n getBranch (getLabel s) = ((\\<^bold>\\ p) # ps, a) # branch \\ getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Rule a [[\\<^bold>\\ p]]) n ((ps, a) # branch)) [s])\\\n | WfGoTo:\n \\i \\ branch_nominals branch \\\n getBranch (getLabel s) = ([], i) # branch \\ getPotential (getLabel s) = n \\\n wft A s \\\n wft A (Node (Step (Block i) (Suc n) branch) [s])\\\n | WfNom:\n \\p at b in (ps, a) # branch \\ Nom a at b in (ps, a) # branch \\\n \\i. p = Nom i \\ p = (\\<^bold>\\ Nom i) \\ i \\ A \\\n new p a ((ps, a) # branch) \\\n getBranch (getLabel s) = (p # ps, a) # branch \\ getPotential (getLabel s) = Suc n \\\n wft A s \\\n wft A (Node (Step (Rule a [[p]]) n ((ps, a) # branch)) [s])\\\n\nlemma example:\n \\wft A (Node (Step (Rule a [[Pro ''p'']]) 0 [([\\<^bold>\\ \\<^bold>\\ Pro ''p'', Pro ''q'', \\<^bold>\\ Pro ''p''], a)])\n [Node (Step (Close a (Pro ''p'')) 1\n [([Pro ''p'', \\<^bold>\\ \\<^bold>\\ Pro ''p'', Pro ''q'', \\<^bold>\\ Pro ''p''], a)]) []])\\\nproof -\n have \\wft A (Node (Step (Close a (Pro ''p'')) 1\n [([Pro ''p'', \\<^bold>\\ \\<^bold>\\ Pro ''p'', Pro ''q'', \\<^bold>\\ Pro ''p''], a)]) [])\\\n using WfClose[where p=\\Pro ''p''\\ and i=a] by simp\n then show ?thesis\n using WfNeg[where p=\\Pro ''p''\\ and a=a] unfolding new_def by simp\nqed\n\nsection \\Soundness\\\n\nlemma fin_no_open_sound:\n assumes \\fin tab\\ \\wft A tab\\ \\alwt (holdst (\\step. getTag step \\ Open)) tab\\\n shows \\A, getPotential (getLabel tab) \\ getBranch (getLabel tab)\\\n using assms\nproof (induct tab rule: fin.induct)\n case (Fin subs l)\n from this(3) show ?case\n proof cases\n case AlwT\n with Fin(2, 1) show ?thesis\n by cases (simp_all add: STA.intros)\n qed\nqed\n\nlemma fin_no_open_sound_labels:\n assumes \\fin tab\\ \\wft A tab\\ \\\\l \\ labels tab. getTag l \\ Open\\\n shows \\A, getPotential (getLabel tab) \\ getBranch (getLabel tab)\\\n using assms fin_no_open_sound labels_alwt_holdst by blast\n\nsection \\LTL\\\n\nlemma alwt_wft: \\alwt (wft A impl nxtt (wft A)) tab\\\n by (coinduction arbitrary: tab) (auto elim: wft.cases)\n\nlemma wft_alwt:\n assumes \\wft A tab\\ \\\\t. wft A t \\ P t\\\n shows \\alwt P tab\\\n using assms by (coinduction arbitrary: tab) (auto elim: wft.cases)\n\nlemma wft_alwt_impl:\n assumes \\wft A tab\\ \\\\t. wft A t \\ P t \\ Q t\\\n shows \\alwt (P impl Q) tab\\\n using assms by (coinduction arbitrary: tab) (auto elim: wft.cases)\n\nlemma wft_ipath:\n assumes \\wft A t\\ \\ipath t s\\\n shows \\\\t. wft A t \\ ipath t (stl s)\\\n using assms\nproof cases\n case (WfClose p i branch n)\n then show ?thesis\n using assms(2) by (auto elim: ipath.cases)\nnext\n case (WfOpen branch n)\n then show ?thesis\n using assms(2) by (auto elim: ipath.cases)\nnext\n case (WfNeg p a ps branch s n)\n from this(1, 6) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfDisP p q a ps branch sl n sr)\n from this(1, 9-10) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfDisN p q a ps branch s n intro)\n from this(1, 6) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfDiaP p a ps branch i s n)\n from this(1, 8) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfDiaN p a ps branch i s n)\n from this(1, 7) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfSatP a p b ps branch s n)\n from this(1, 6) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfSatN a p b ps branch s n)\n from this(1, 6) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfGoTo i branch s n)\n from this(1, 5) show ?thesis\n using assms(2) ipath.cases by fastforce\nnext\n case (WfNom p b ps a branch s n)\n from this(1, 8) show ?thesis\n using assms(2) ipath.cases by fastforce\nqed\n\nlemma wft_alw:\n assumes \\wft A t\\ \\ipath t s\\ \\\\t. wft A t \\ relt r t\\\n shows \\alw (rels r) s\\\n using assms\nproof (coinduction arbitrary: s t)\n case alw\n then have ?case if \\rels r s\\ \\\\t. wft A t \\ ipath t (stl s)\\\n using that by simp\n moreover from alw have \\rels r s\\\n using relt_ipath by fast\n moreover have \\\\t. wft A t \\ ipath t (stl s)\\\n using alw wft_ipath by fast\n ultimately show ?case .\nqed\n\nlemma alwt_aand:\n assumes \\alwt P t\\ \\alwt Q t\\\n shows \\alwt (P aand Q) t\\\n using assms by (coinduction arbitrary: t) (auto elim: alwt.cases)\n\nlemma alwt_nxtt:\n assumes \\alwt P t\\ \\\\t. P t \\ Q t \\ nxtt Q t\\ \\Q t\\\n shows \\alwt Q t\\\n using assms by (coinduction arbitrary: t) (auto elim: alwt.cases)\n\nlemma holds_holdst:\n assumes \\ipath t s\\ \\holdst P t\\\n shows \\holds P s\\\n using assms by (auto elim: ipath.cases)\n\n(* TODO: unused *)\nlemma alw_impl:\n assumes \\alw (P impl Q) s\\ \\P (sdrop k s)\\\n shows \\Q (sdrop k s)\\\n using assms by (simp add: alw_iff_sdrop)\n\nlemma alwt_aand_E1: \\alwt (P aand Q) t \\ alwt P t\\\n by (coinduction arbitrary: t) (auto elim: alwt.cases)\n\nlemma alwt_aand_E2: \\alwt (P aand Q) t \\ alwt Q t\\\n by (coinduction arbitrary: t) (auto elim: alwt.cases)\n\nlemma wft_ipath_sdrop:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\\\tab. wft A tab \\ ipath tab (sdrop n steps)\\\n using assms\nproof (induct n)\n case (Suc n)\n then show ?case\n using wft_ipath by fastforce\nqed auto\n\nsection \\Preservation\\\n\nlemma preservation_Next:\n assumes \\wft A tab\\\n shows \\relt (Impl (\\l. p at a in getBranch l) (Next (Here (\\l. p at a in getBranch l)))) tab\\\n using assms\nproof cases\n case (WfDisP p q a ps branch sl n sr)\n from this(1, 5, 7) show ?thesis\n by fastforce\nnext\n case (WfDisN p q a ps branch s n intro)\n from this(1, 4) show ?thesis\n by fastforce\nnext\n case (WfDiaN p a ps branch i s n)\n from this(1, 5) show ?thesis\n by fastforce\nnext\n case (WfNom p b ps a branch s n)\n from this(1, 6) show ?thesis\n by fastforce\nqed fastforce+\n\nlemma preservation_alw:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\l. p at a in getBranch l)\n impl (nxt (holds (\\l. p at a in getBranch l)))) steps\\\nproof -\n have \\alw (rels (Impl (\\l. p at a in getBranch l)\n (Next (Here (\\l. p at a in getBranch l))))) steps\\\n using wft_alw assms preservation_Next .\n then show ?thesis\n by simp\nqed\n\n(* TODO: is this nice to have on top? *)\nlemma preservation_invar:\n assumes \\wft A tab\\ \\ipath tab steps\\ \\holds (\\l. p at a in getBranch l) steps\\\n shows \\alw (holds (\\l. p at a in getBranch l)) steps\\\nproof -\n have \\alw (holds (\\l. p at a in getBranch l)\n impl (nxt (holds (\\l. p at a in getBranch l)))) steps\\\n using assms preservation_alw by fast\n then show ?thesis\n using alw_invar assms(3) by blast\nqed\n\nsection \\Nominals\\\n\n(* TODO: think about this. It's not local since it uses labels *)\nsubsection \\Generated\\\n\nfun generates :: \\('a, 'b) tag \\ 'b set\\ where\n \\generates (Fresh _ _ b) = {b}\\\n| \\generates _ = {}\\\n\ndefinition generated :: \\('a, 'b) tableau \\ 'b set\\ where\n \\generated tab \\ \\step \\ labels tab. generates (getTag step)\\\n\ndefinition generated_ipath :: \\('a, 'b) step stream \\ 'b set\\ where\n \\generated_ipath steps \\ \\step \\ sset steps. generates (getTag step)\\\n\nlemma nxtt_generated:\n assumes \\wft A tab\\ \\generated tab \\ B\\\n shows \\nxtt (\\t. generated t \\ B) tab\\\n using assms unfolding generated_def\n by (fastforce elim: wft.cases)\n\nlemma alwt_generated:\n assumes \\wft A tab\\\n shows \\alwt ((\\t. generated t \\ B) impl nxtt (\\t. generated t \\ B)) tab\\\n using wft_alwt_impl assms nxtt_generated .\n\nlemma wft_generated_nxtt:\n assumes \\wft A tab\\ \\generated tab \\ B\\\n \\holdst (\\t. \\i \\ branch_nominals (getBranch t). i \\ orig \\ i \\ B) tab\\\n shows \\nxtt (holdst (\\s. \\i \\ branch_nominals (getBranch s). i \\ orig \\ i \\ B)) tab\\\n using assms\nproof cases\n case (WfNeg p a ps branch s n)\n moreover from this(2) have\n \\branch_nominals ((p # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n using WfNeg(2) unfolding branch_nominals_def by fastforce\n ultimately show ?thesis\n using assms(3) by auto\nnext\n case (WfDisP p q a ps branch sl n sr)\n moreover from this(2) have\n \\branch_nominals ((p # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n \\branch_nominals ((q # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n unfolding branch_nominals_def by fastforce+\n ultimately show ?thesis\n using assms(3) by auto\nnext\n case (WfDisN p q a ps branch s n intro)\n moreover from this(2) have\n \\branch_nominals (((\\<^bold>\\ q) # (\\<^bold>\\ p) # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n unfolding branch_nominals_def by fastforce\n ultimately show ?thesis\n using assms(3) by auto\nnext\n case (WfDiaP p a ps branch i s n)\n have \\branch_nominals (((\\<^bold>@ i p) # (\\<^bold>\\ Nom i) # ps, a) # branch) =\n {i} \\ nominals p \\ branch_nominals ((ps, a) # branch)\\\n unfolding branch_nominals_def by auto\n moreover have \\nominals p \\ branch_nominals ((ps, a) # branch)\\\n using WfDiaP(2) unfolding branch_nominals_def by fastforce\n then have \\\\i \\ nominals p. i \\ orig \\ i \\ B\\\n using WfDiaP(1) assms(3) by auto\n ultimately have ?thesis if \\i \\ B\\\n using that WfDiaP(1, 6) assms(3) by auto\n moreover have \\i \\ B\\\n using WfDiaP(1) assms(2) unfolding generated_def by simp\n ultimately show ?thesis\n using WfDiaP(1, 8) by fastforce\nnext\n case (WfDiaN p a ps branch i s n)\n moreover have \\nominals (\\<^bold>\\ (\\<^bold>@ i p)) \\ branch_nominals ((ps, a) # branch)\\\n using WfDiaN(2-3) unfolding branch_nominals_def by fastforce\n then have\n \\branch_nominals (((\\<^bold>\\ (\\<^bold>@ i p)) # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n using WfDiaN(2) unfolding branch_nominals_def by auto\n ultimately show ?thesis\n using assms(3) unfolding generated_def by auto\nnext\n case (WfSatP a p b ps branch s n)\n moreover have \\branch_nominals ((p # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n using WfSatP(2) unfolding branch_nominals_def by fastforce\n ultimately show ?thesis\n using assms(3) unfolding generated_def by auto\nnext\n case (WfSatN a p b ps branch s n)\n moreover have \\branch_nominals (((\\<^bold>\\ p) # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n using WfSatN(2) unfolding branch_nominals_def by fastforce\n ultimately show ?thesis\n using assms(3) unfolding generated_def by auto\nnext\n case (WfGoTo i branch s n)\n moreover have \\branch_nominals (([], i) # branch) \\ branch_nominals branch\\\n using WfGoTo(2) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n using assms(3) unfolding generated_def by auto\nnext\n case (WfNom p b ps a branch s n)\n moreover have \\branch_nominals ((p # ps, a) # branch) \\ branch_nominals ((ps, a) # branch)\\\n using WfNom(2) unfolding branch_nominals_def by fastforce\n ultimately show ?thesis\n using assms(3) unfolding generated_def by (simp add: in_mono)\nqed simp_all\n\nlemma wft_generated':\n assumes \\wft A tab\\ \\generated tab \\ B\\\n \\holdst (\\t. \\i \\ branch_nominals (getBranch t). i \\ orig \\ i \\ B) tab\\\n shows \\alwt (holdst (\\step. \\i \\ branch_nominals (getBranch step). i \\ orig \\ i \\ B)) tab\\\nproof -\n have \\alwt (wft A) tab\\\n using assms(1) wft_alwt by blast\n moreover have \\alwt (\\t. generated t \\ B) tab\\\n using alwt_impl_nxtt alwt_generated assms(1-2) .\n ultimately have \\alwt (wft A aand (\\t. generated t \\ B)) tab\\\n using alwt_aand by blast\n with alwt_nxtt[where Q=\\holdst (\\t. \\i \\ branch_nominals (getBranch t). i \\ orig \\ i \\ B)\\]\n show ?thesis\n using wft_generated_nxtt assms(3) by blast\nqed\n\nlemma wft_generated:\n assumes \\wft A tab\\\n shows \\alwt (holdst (\\step. \\i \\ branch_nominals (getBranch step).\n i \\ branch_nominals (getBranch (getLabel tab)) \\ i \\ generated tab)) tab\\\n using assms wft_generated' by blast\n\nlemma wft_generated_ipath':\n assumes \\ipath tab steps\\ \\wft A tab\\ \\generated_ipath steps \\ B\\\n \\holds (\\l. branch_nominals (getBranch l) \\ orig \\ B) steps\\\n shows \\alw (holds (\\l. branch_nominals (getBranch l) \\ orig \\ B)) steps\\\n using assms\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n proof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using alw(2) by (auto elim: wft.cases)\n\n with alw(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath by simp\n next\n case (WfNeg p a ps branch s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\nominals p \\ orig \\ B\\\n using WfNeg(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfNeg(1, 4) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n next\n case (WfDisP p q a ps branch sl n sr)\n have ?thesis if\n \\branch_nominals (getBranch (getLabel s')) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\s' = sl \\ s' = sr\\\n using WfDisP(1) IPath by simp\n moreover have \\nominals p \\ orig \\ B\\ \\nominals q \\ orig \\ B\\\n using WfDisP(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce+\n then have\n \\branch_nominals (getBranch (getLabel sl)) \\ orig \\ B\\\n \\branch_nominals (getBranch (getLabel sr)) \\ orig \\ B\\\n using WfDisP(1, 5, 7) IPath alw(4) unfolding branch_nominals_def by simp_all\n ultimately show ?thesis\n by blast\n next\n case (WfDisN p q a ps branch s n intro)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\nominals p \\ orig \\ B\\ \\nominals q \\ orig \\ B\\\n using WfDisN(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce+\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfDisN(1, 4) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n next\n case (WfDiaP p a ps branch i s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover {\n have \\nominals p \\ orig \\ B\\\n using WfDiaP(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce\n moreover have \\i \\ B\\\n using WfDiaP(1) IPath alw(3) unfolding generated_ipath_def by simp\n ultimately have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfDiaP(1, 6) IPath alw(4) unfolding branch_nominals_def by simp\n }\n ultimately show ?thesis\n by simp\n next\n case (WfDiaN p a ps branch i s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover {\n have \\nominals p \\ orig \\ B\\\n using WfDiaN(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce\n moreover have \\i \\ orig \\ B\\\n using WfDiaN(1, 3) IPath alw(4) unfolding branch_nominals_def by fastforce\n ultimately have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfDiaN(1, 5) IPath alw(4) unfolding branch_nominals_def by simp\n }\n ultimately show ?thesis\n by simp\n next\n case (WfSatP a p b ps branch s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\nominals p \\ orig \\ B\\\n using WfSatP(1-2) IPath alw(4) unfolding branch_nominals_def by force\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfSatP(1, 4) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n next\n case (WfSatN a p b ps branch s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\nominals p \\ orig \\ B\\\n using WfSatN(1-2) IPath alw(4) unfolding branch_nominals_def by force\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfSatN(1, 4) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n next\n case (WfGoTo i branch s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\i \\ orig \\ B\\\n using WfGoTo(1-2) IPath alw(4) unfolding branch_nominals_def by auto\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfGoTo(1, 3) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n next\n case (WfNom p b ps a branch s n)\n from this(1) have ?thesis if \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using that wft IPath alw(3-) holds_holdst unfolding generated_ipath_def by fastforce\n moreover have \\nominals p \\ orig \\ B\\\n using WfNom(1-2) IPath alw(4) unfolding branch_nominals_def by fastforce\n then have \\branch_nominals (getBranch (getLabel s)) \\ orig \\ B\\\n using WfNom(1, 6) IPath alw(4) unfolding branch_nominals_def by simp\n ultimately show ?thesis\n by simp\n qed\n qed\nqed\n\nlemma wft_generated_ipath:\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows \\alw (holds (\\l. branch_nominals (getBranch l) \\\n branch_nominals (getBranch (shd steps)) \\ generated_ipath steps)) steps\\\n using assms wft_generated_ipath' by fastforce\n\nlemma wft_generated_labels:\n assumes \\wft A tab\\ \\step \\ labels tab\\ \\i \\ branch_nominals (getBranch step)\\\n shows \\i \\ branch_nominals (getBranch (getLabel tab)) \\ i \\ generated tab\\\n using assms wft_generated alwt_holdst_labels by fast\n\nsection \\Quasi subformulas\\\n\nsubsection \\Quasis\\\n\nfun quasis :: \\'b set \\ ('a, 'b) fm \\ ('a, 'b) fm set\\ where\n \\quasis A (\\<^bold>\\ \\<^bold>\\ p) = {p} \\ quasis A p\\\n| \\quasis A (p \\<^bold>\\ q) = {p, q} \\ quasis A p \\ quasis A q\\\n| \\quasis A (\\<^bold>\\ (p \\<^bold>\\ q)) = {\\<^bold>\\ p, \\<^bold>\\ q} \\ quasis A (\\<^bold>\\ p) \\ quasis A (\\<^bold>\\ q)\\\n| \\quasis A (\\<^bold>\\ p) = (if \\a. p = Nom a then {} else {\\<^bold>@ i p |i. i \\ A} \\ {p} \\ quasis A p)\\\n| \\quasis A (\\<^bold>\\ (\\<^bold>\\ p)) = {\\<^bold>\\ (\\<^bold>@ i p) |i. i \\ A} \\ {\\<^bold>\\ p} \\ quasis A (\\<^bold>\\ p)\\\n| \\quasis A (\\<^bold>@ i p) = {p} \\ quasis A p\\\n| \\quasis A (\\<^bold>\\ (\\<^bold>@ i p)) = {\\<^bold>\\ p} \\ quasis A (\\<^bold>\\ p)\\\n| \\quasis _ p = {p}\\\n\nlemma quasis_subset_closed: \\p' \\ quasis A p \\ quasis A p' \\ quasis A p\\\n by (induct p rule: quasis.induct) (auto split: if_splits)\n\nlemma finite_quasis: \\finite A \\ finite (quasis A p)\\\n by (induct p rule: quasis.induct) auto\n\ndefinition branch_formulas :: \\('a, 'b) branch \\ ('a, 'b) fm set\\ where\n \\branch_formulas branch \\ \\(ps, i) \\ set branch. {Nom i} \\ set ps\\\n\nlemma finite_branch_formulas: \\finite (branch_formulas branch)\\\n unfolding branch_formulas_def by auto\n\ndefinition formula_bound :: \\'b set \\ ('a, 'b) branch \\ ('a, 'b) fm set\\ where\n \\formula_bound B branch \\\n branch_formulas branch \\\n (\\p \\ branch_formulas branch. quasis B p) \\\n (\\i \\ B. {Nom i, \\<^bold>\\ Nom i})\\\n\nlemma finite_formula_bound: \\finite B \\ finite (formula_bound B branch)\\\n unfolding formula_bound_def using finite_branch_formulas finite_quasis by auto\n\nlemma formula_bound_quasis: \\\\p \\ formula_bound B branch. quasis B p \\ formula_bound B branch\\\n unfolding formula_bound_def using quasis_subset_closed by fastforce\n\n(* TODO: may not need rest of section *)\n\nlemma branch_formulas_Cons [simp]:\n \\branch_formulas ((p # ps, a) # branch) = {p} \\ branch_formulas ((ps, a) # branch)\\\n unfolding branch_formulas_def by simp\n\nlemma at_in_branch_formulas: \\p at a in branch \\ p \\ branch_formulas branch\\\n unfolding branch_formulas_def by auto\n\nlemma branch_nominals_there:\n assumes \\p' at b in ((ps, a) # branch)\\ \\nominals p \\ nominals p'\\\n \\branch_nominals ((ps, a) # branch) \\ B\\\n shows \\branch_nominals ((p # ps, a) # branch) \\ B\\\nproof -\n have \\nominals p \\ branch_nominals ((ps, a) # branch)\\\n using assms(1-2) unfolding branch_nominals_def by fastforce\n then have \\nominals p \\ B\\\n using assms(3) by simp\n then show ?thesis\n using assms(3) unfolding branch_nominals_def by simp\nqed\n\nlemma branch_nominals_Cons [simp]:\n \\branch_nominals ((p # ps, a) # branch) = nominals p \\ branch_nominals ((ps, a) # branch)\\\n unfolding branch_nominals_def by auto\n\nsection \\Finite Intro Rules\\\n\nfun introduces :: \\('a, 'b) tag \\ (('a, 'b) fm list list \\ 'b) option\\ where\n \\introduces (Rule a ps) = Some (ps, a)\\\n| \\introduces (Fresh a p i) = Some ([[\\<^bold>@ i p, \\<^bold>\\ Nom i]], a)\\\n| \\introduces _ = None\\\n\nsubsection \\Distinct\\\n\nlemma introduces_new:\n assumes \\wft A tab\\\n shows \\relt (Here (\\t. \\pps a. introduces (getTag t) = Some (pps, a) \\\n (\\ps \\ set pps. \\p \\ set ps. new p a (getBranch t)))) tab\\\n using assms\nproof cases\n case (WfDiaP p a ps branch i s n)\n from this(1, 3) show ?thesis\n unfolding branch_nominals_def new_def by fastforce\nqed auto\n\nlemma introduces_new_ipath:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\t. \\pps a. introduces (getTag t) = Some (pps, a) \\\n (\\ps \\ set pps. \\p \\ set ps. new p a (getBranch t)))) steps\\\nproof -\n have \\alw (rels (Here (\\t. \\pps a. introduces (getTag t) = Some (pps, a) \\\n (\\ps \\ set pps. \\p \\ set ps. new p a (getBranch t))))) steps\\\n using wft_alw assms introduces_new .\n then show ?thesis\n by simp\nqed\n\nlemma introduces_Next:\n assumes \\wft A tab\\\n shows \\relt (Impl (\\t. introduces (getTag t) = Some (pps, a))\n (Next (Here (\\s. \\ps \\ set pps. ps \\ [] \\ (\\p \\ set ps. p at a in getBranch s))))) tab\\\n using assms\nproof cases\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis\n by force\nnext\n case (WfNom p b ps a branch s n)\n from this(1, 6) show ?thesis\n by fastforce\nqed fastforce+\n\nlemma introduces_alw_nxt:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\t. introduces (getTag t) = Some (pps, a))\n impl (nxt (holds (\\s. \\ps \\ set pps. ps \\ [] \\ (\\p \\ set ps. p at a in getBranch s))))) steps\\\nproof -\n have \\alw (rels (Impl (\\t. introduces (getTag t) = Some (pps, a))\n (Next (Here (\\s. \\ps \\ set pps. ps \\ [] \\ (\\p \\ set ps. p at a in getBranch s)))))) steps\\\n using wft_alw assms introduces_Next .\n then show ?thesis\n by simp\nqed\n\n(* TODO: preservation-invar requires finding a tab in ipath tab (sdrop m steps)\n [2021-06-10: I don't know what this means anymore]\n*)\n\nlemma distinct_introduces:\n assumes \\wft A tab\\ \\ipath tab steps\\ \\steps !! m = s\\ \\steps !! n = s'\\ \\m < n\\\n \\introduces (getTag s) = Some (pps, a)\\ \\introduces (getTag s') = Some (qqs, b)\\\n shows \\(pps, a) \\ (qqs, b)\\\nproof\n assume \\(pps, a) = (qqs, b)\\\n\n have \\alw (holds (\\t. introduces (getTag t) = Some (pps, a))\n impl nxt (holds (\\s. \\ps\\set pps. ps \\ [] \\ (\\p \\ set ps. p at a in getBranch s)))) steps\\\n using introduces_alw_nxt assms(1-2) .\n then have \\holds (\\s. \\ps\\set pps. ps \\ [] \\\n (\\p \\ set ps. p at a in getBranch s)) (sdrop (Suc m) steps)\\\n using assms(3, 6) by (simp add: alw_iff_sdrop)\n then obtain ps where\n \\ps \\. pps\\\n \\ps \\ []\\\n \\\\p \\ set ps. holds (\\s. p at a in getBranch s) (sdrop (Suc m) steps)\\\n by auto\n moreover have \\alw (holds (\\l. p at a in getBranch l)\n impl nxt (holds (\\l. p at a in getBranch l))) steps\\ for p\n using preservation_alw assms(1-2) .\n then have \\alw (holds (\\l. p at a in getBranch l)\n impl nxt (holds (\\l. p at a in getBranch l))) (sdrop (Suc m) steps)\\ for p\n using alw_sdrop by blast\n ultimately have \\\\p \\ set ps. alw (holds (\\l. p at a in getBranch l)) (sdrop (Suc m) steps)\\\n using alw_invar by blast\n then have \\\\p \\ set ps. holds (\\l. p at a in getBranch l) (sdrop n steps)\\\n using \\m < n\\ by (auto simp: alw_iff_sdrop elim: less_natE)\n\n moreover have \\alw (holds (\\l. \\pps a. introduces (getTag l) = Some (pps, a) \\\n (\\ps \\ set pps. \\p\\set ps. new p a (getBranch l)))) steps\\\n using introduces_new_ipath assms(1-2) .\n then have \\alw (holds (\\l. \\pps a. introduces (getTag l) = Some (pps, a) \\\n (\\ps \\ set pps. \\p\\set ps. new p a (getBranch l)))) (sdrop n steps)\\\n by (simp add: alw_iff_sdrop)\n then have \\\\qs \\ set qqs. \\q\\set qs. holds (\\l. new q b (getBranch l)) (sdrop n steps)\\\n using assms(4, 7) by auto\n then have \\\\p\\set ps. holds (\\l. \\ p at a in (getBranch l)) (sdrop n steps)\\\n unfolding new_def using \\ps \\. pps\\ \\(pps, a) = (qqs, b)\\ by simp\n ultimately show False\n by (cases ps) (auto simp: \\ps \\ []\\) \nqed\n\nsubsection \\Quasi\\\n\nlemma wft_introduces_quasis_ipath':\n assumes\n \\ipath tab steps\\ \\wft A tab\\\n \\generated_ipath steps \\ B\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) steps\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) steps\\\n and X: \\\\x \\ X. quasis B x \\ X\\ and Xi: \\\\i \\ B. {Nom i, \\<^bold>\\ Nom i} \\ X\\\n shows \\alw (holds (\\step.\n (\\pps a. introduces (getTag step) = Some (pps, a) \\ set (concat pps) \\ X) \\\n (\\a p i. getTag step = Fresh a p i \\ (\\a. p = Nom a) \\ (\\<^bold>\\ p) \\ X))) steps\\\n using assms(1-5)\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n proof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using alw(2) wft_alwt by (auto elim: wft.cases)\n from alw(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath by simp\n next\n case (WfNeg p a ps branch s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\p \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfNeg(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(\\<^bold>\\ \\<^bold>\\ p) \\ X\\\n using WfNeg(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\p \\ X\\\n using X by auto\n\n moreover have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfNeg(1-2, 4) IPath alw(4) branch_nominals_there[where p=p] by fastforce\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfNeg(1, 4) alw(5) \\p \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfDisP p q a ps branch sl n sr)\n from this(1) have s: \\s' = sl \\ s' = sr\\\n using IPath by simp\n\n have ?thesis if\n \\p \\ X\\ \\q \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfDisP(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(p \\<^bold>\\ q) \\ X\\\n using WfDisP(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\p \\ X\\ \\q \\ X\\\n using X by auto\n\n moreover {\n have \\holdst (\\l. branch_nominals (getBranch l) \\ B) sl\\\n using WfDisP(1-2, 5) IPath alw(4) branch_nominals_there[where p=p] by fastforce\n moreover have \\holdst (\\l. branch_nominals (getBranch l) \\ B) sr\\\n using WfDisP(1-2, 7) IPath alw(4) branch_nominals_there[where p=q] by fastforce\n ultimately have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n }\n\n moreover have\n \\holdst (\\l. branch_formulas (getBranch l) \\ X) sl\\\n \\holdst (\\l. branch_formulas (getBranch l) \\ X) sr\\\n using WfDisP(1, 5, 7) alw(5) \\p \\ X\\ \\q \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfDisN p q a ps branch s n intro)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\(\\<^bold>\\ p) \\ X\\ \\(\\<^bold>\\ q) \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfDisN(1, 7) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(\\<^bold>\\ (p \\<^bold>\\ q)) \\ X\\\n using WfDisN(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\(\\<^bold>\\ p) \\ X\\ \\(\\<^bold>\\ q) \\ X\\\n using X by auto\n\n moreover {\n have \\branch_nominals (((\\<^bold>\\ q) # (\\<^bold>\\ p) # ps, a) # branch) \\ nominals p \\ nominals q \\ B\\\n using WfDisN(1-2) IPath alw(4) by auto\n moreover have \\nominals p \\ B\\ \\nominals q \\ B\\\n using WfDisN(1-2) IPath(1-2) alw(4) unfolding branch_nominals_def by force+\n ultimately have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfDisN(1, 4) IPath alw(4) by simp\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n }\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfDisN(1, 4) alw(5) \\(\\<^bold>\\ p) \\ X\\ \\(\\<^bold>\\ q) \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfDiaP p a ps branch i s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\(\\<^bold>@ i p) \\ X\\ \\(\\<^bold>\\ Nom i) \\ X\\ \\(\\<^bold>\\ p) \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfDiaP(1, 4) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\i \\ B\\\n using WfDiaP(1) alw(3) IPath unfolding generated_ipath_def by simp\n\n moreover have \\(\\<^bold>\\ p) \\ X\\\n using WfDiaP(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n moreover from this have \\(\\<^bold>@ i p) \\ X\\ \\(\\<^bold>\\ Nom i) \\ X\\\n using \\i \\ B\\ WfDiaP(4) X Xi by fastforce+\n\n moreover {\n have \\branch_nominals (((\\<^bold>@ i p) # (\\<^bold>\\ Nom i) # ps, a) # branch) \\ {i} \\ nominals p \\ B\\\n using WfDiaP(1-2) IPath alw(4) by auto\n moreover have \\nominals p \\ B\\\n using WfDiaP(1-2) IPath(1-2) alw(4) unfolding branch_nominals_def by force\n ultimately have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using \\i \\ B\\ WfDiaP(1, 6) IPath alw(4) by simp\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n }\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfDiaP(1, 6) alw(5) \\(\\<^bold>@ i p) \\ X\\ \\(\\<^bold>\\ Nom i) \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfDiaN p a ps branch i s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have \\i \\ B\\\n using WfDiaN(1, 3) alw(4) IPath unfolding branch_nominals_def by force\n\n have ?thesis if\n \\(\\<^bold>\\ (\\<^bold>@ i p)) \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfDiaN(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(\\<^bold>\\ (\\<^bold>\\ p)) \\ X\\\n using WfDiaN(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\(\\<^bold>\\ (\\<^bold>@ i p)) \\ X\\\n using \\i \\ B\\ X by fastforce\n\n moreover {\n have \\branch_nominals (((\\<^bold>\\ (\\<^bold>@ i p)) # ps, a) # branch) \\ {i} \\ nominals p \\ B\\\n using WfDiaN(1-3) IPath alw(4) by auto\n moreover have \\nominals p \\ B\\\n using WfDiaN(1-2) IPath(1-2) alw(4) unfolding branch_nominals_def by force\n ultimately have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using \\i \\ B\\ WfDiaN(1, 5) IPath alw(4) by simp\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n }\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfDiaN(1, 5) alw(5) \\(\\<^bold>\\ (\\<^bold>@ i p)) \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfSatP a p b ps branch s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\p \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfSatP(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(\\<^bold>@ a p) \\ X\\\n using WfSatP(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\p \\ X\\\n using X by auto\n\n moreover have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfSatP(1-2, 4) IPath alw(4) branch_nominals_there[where p=p] by fastforce\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfSatP(1, 4) alw(5) \\p \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfSatN a p b ps branch s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\(\\<^bold>\\ p) \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfSatN(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\(\\<^bold>\\ (\\<^bold>@ a p)) \\ X\\\n using WfSatN(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n then have \\(\\<^bold>\\ p) \\ X\\\n using X by auto\n\n moreover have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfSatN(1-2, 4) IPath alw(4) branch_nominals_there[where p=\\\\<^bold>\\ p\\] by fastforce\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfSatN(1, 4) alw(5) \\(\\<^bold>\\ p) \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfGoTo i branch s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfGoTo(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\i \\ B\\\n using WfGoTo(1-2) IPath alw(4) by auto\n then have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfGoTo(1, 3) IPath alw(4) unfolding branch_nominals_def by auto \n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfGoTo(1, 3) alw(5) \\i \\ B\\ Xi IPath(1-2) unfolding branch_formulas_def by simp\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n next\n case (WfNom p b ps a branch s n)\n from this(1) have s: \\s' = s\\\n using IPath by simp\n\n have ?thesis if\n \\p \\ X\\\n \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using that wft WfNom(1) alw(3-) IPath unfolding generated_ipath_def by auto\n\n moreover have \\p \\ X\\\n using WfNom(1, 2) IPath alw(5) at_in_branch_formulas\n by (metis holds_Stream insert_subset mk_disjoint_insert step.sel(3) tree.inject)\n\n moreover have \\holdst (\\l. branch_nominals (getBranch l) \\ B) s\\\n using WfNom(1-2, 6) IPath alw(4) branch_nominals_there[where p=p] by fastforce\n then have \\holds (\\l. branch_nominals (getBranch l) \\ B) tail\\\n using s IPath holds_holdst by fast\n\n moreover have \\holdst (\\l. branch_formulas (getBranch l) \\ X) s\\\n using WfNom(1, 6) alw(5) \\p \\ X\\ IPath(1-2) by auto\n then have \\holds (\\l. branch_formulas (getBranch l) \\ X) tail\\\n using s IPath holds_holdst by fast\n\n ultimately show ?thesis\n by simp\n qed\n qed\nqed\n\nlemma wft_introduces_quasis_ipath:\n fixes tab steps\n defines \\B \\ generated_ipath steps \\ branch_nominals (getBranch (shd steps))\\\n defines \\X \\ formula_bound B (getBranch (shd steps))\\\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows\n \\alw (holds (\\l. \\pps a. introduces (getTag l) = Some (pps, a) \\ set (concat pps) \\ X)) steps\\\n \\alw (holds (\\step. \\a p i. getTag step = Fresh a p i \\ (\\a. p = Nom a) \\(\\<^bold>\\ p) \\ X)) steps\\\nproof -\n have \\generated_ipath steps \\ B\\ \\branch_nominals (getBranch (shd steps)) \\ B\\\n unfolding B_def by simp_all\n moreover have \\branch_formulas (getBranch (shd steps)) \\ X\\ \\\\i\\B. {Nom i, \\<^bold>\\ Nom i} \\ X\\\n unfolding B_def X_def formula_bound_def by blast+\n moreover have \\\\x\\X. quasis B x \\ X\\\n unfolding X_def using formula_bound_quasis by blast\n ultimately have \\alw\n (holds (\\step. (\\pps a. introduces (getTag step) = Some (pps, a) \\ set (concat pps) \\ X) \\\n (\\a p i. getTag step = Fresh a p i \\ (\\a. p = Nom a) \\ (\\<^bold>\\ p) \\ X))) steps\\\n using assms(3-4) wft_introduces_quasis_ipath' by fastforce\n then show\n \\alw (holds (\\l. \\pps a. introduces (getTag l) = Some (pps, a) \\ set (concat pps) \\ X)) steps\\\n \\alw (holds (\\step. \\a p i. getTag step = Fresh a p i \\ (\\a. p = Nom a) \\ (\\<^bold>\\ p) \\ X)) steps\\\n by (metis (no_types, lifting) alw_sset sset_alw)+\nqed\n\nsubsection \\Finite\\\n\nlemma finite_introduces_lists:\n fixes X k\n defines \\Y \\ {ps. set ps \\ X \\ length ps \\ k}\\\n assumes \\finite X\\\n shows \\finite {pps. set pps \\ Y \\ length pps \\ m}\\\nproof -\n have \\finite Y\\\n unfolding Y_def using finite_lists_length_le \\finite X\\ .\n then show ?thesis\n using finite_lists_length_le \\finite X\\ by blast\nqed\n\n(* TODO: maybe drop some inner universal quantifiers? *)\nlemma introduces_lengths:\n assumes \\wft A tab\\\n shows \\alwt (holdst (\\l. \\pps a.\n (introduces (getTag l) = Some (pps, a) \\\n length pps \\ 2 \\ (\\ps \\ set pps. length ps \\ 2)))) tab\\\n using assms by (coinduction arbitrary: tab) (fastforce elim: wft.cases)\n\nlemma wft_introduces_nominals:\n assumes \\wft A tab\\\n shows \\relt (Here (\\step. \\ps a. introduces (getTag step) = Some (ps, a) \\\n a \\ branch_nominals (getBranch step))) tab\\\n using assms unfolding branch_nominals_def by (auto elim: wft.cases)\n\nlemma wft_introduces_nominals_ipath:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\step. \\ps a. introduces (getTag step) = Some (ps, a) \\\n a \\ branch_nominals (getBranch step))) steps\\\nproof -\n have \\alw (rels (Here (\\step. \\ps a. introduces (getTag step) = Some (ps, a) \\\n a \\ branch_nominals (getBranch step)))) steps\\\n using wft_alw assms wft_introduces_nominals .\n then show ?thesis\n by simp\nqed\n\nlemma introduces_bound:\n fixes steps\n defines \\B \\ generated_ipath steps \\ branch_nominals (getBranch (shd steps))\\\n assumes \\wft A tab\\ \\ipath tab steps\\ \\finite B\\\n shows \\\\n. \\k \\ n. introduces (getTag (steps !! k)) = None\\\nproof -\n let ?X = \\formula_bound B (getBranch (shd steps))\\\n let ?f = \\introduces o getTag\\\n let ?D = \\?f ` sset steps\\\n\n let ?Y = \\{pps. set pps \\ {ps. set ps \\ ?X \\ length ps \\ 2} \\ length pps \\ 2}\\\n\n have \\alw (holds (\\l. \\pps a. ?f l = Some (pps, a) \\ set (concat pps) \\ ?X)) steps\\\n using assms wft_introduces_quasis_ipath by auto\n then have \\\\intro \\ ?D. \\pps a. intro = Some (pps, a) \\ set (concat pps) \\ ?X\\\n using alw_sset by (smt (verit, best) imageE)\n then have \\\\intro \\ ?D. \\pps a. intro = Some (pps, a) \\ (\\ps \\ set pps. set ps \\ ?X)\\\n by auto\n\n moreover have \\\\intro \\ ?D. \\pps a. intro = Some (pps, a) \\\n length pps \\ 2 \\ (\\ps \\ set pps. length ps \\ 2)\\\n using assms(2-3) alw_sset introduces_lengths alwt_ipath by fastforce\n ultimately have \\\\intro \\ ?D. \\pps a. intro = Some (pps, a) \\ pps \\ ?Y\\\n by auto\n\n (* TODO: pps should be pss? *)\n moreover {\n have \\alw (holds (\\step. \\pps a. ?f step = Some (pps, a) \\\n a \\ branch_nominals (getBranch step))) steps\\\n using assms wft_introduces_nominals_ipath by auto\n then have \\\\step \\ sset steps. \\pps a. ?f step = Some (pps, a) \\\n a \\ branch_nominals (getBranch step)\\\n using alw_sset by (metis (mono_tags, lifting))\n moreover have \\alw (holds (\\l. branch_nominals (getBranch l) \\\n branch_nominals (getBranch (shd steps)) \\ generated_ipath steps)) steps\\\n using assms(2-3) wft_generated_ipath by fast\n then have \\\\step \\ sset steps. branch_nominals (getBranch step) \\\n branch_nominals (getBranch (shd steps)) \\ generated_ipath steps\\\n using alw_sset by (metis (mono_tags, lifting))\n ultimately have \\\\intro \\ ?D. \\pps a. intro = Some (pps, a) \\ a \\ B\\\n unfolding B_def comp_def by fast\n }\n ultimately have \\\\intro \\ ?D. \\x. intro = Some x \\ x \\ ?Y \\ B\\\n by simp\n then have \\?D \\ {None} \\ Some ` (?Y \\ B)\\\n by blast\n\n moreover have \\finite ?X\\\n using assms(4) finite_formula_bound by blast\n then have \\finite ?Y\\\n using finite_introduces_lists by blast\n then have \\finite ({None} \\ Some ` (?Y \\ B))\\\n using \\finite B\\ by blast\n ultimately have \\finite ?D\\\n by (simp add: finite_subset)\n\n then obtain n where n: \\?D \\ ?f ` set (stake n steps)\\\n using stake_finite' by blast\n\n have \\\\k \\ Suc n. ?f (steps !! k) = None\\\n proof (intro allI impI)\n fix k\n assume \\Suc n \\ k\\\n show \\?f (steps !! k) = None\\\n proof (rule ccontr)\n assume \\?f (steps !! k) \\ None\\\n then obtain ps a where ps: \\?f (steps !! k) = Some (ps, a)\\\n by fast\n then have \\Some (ps, a) \\ ?D\\\n by (metis comp_apply imageI snth_sset)\n then have \\Some (ps, a) \\ ?f ` set (stake n steps)\\\n using n by blast\n then obtain m where \\m \\ n\\ \\?f (steps !! m) = Some (ps, a)\\\n using stake_snth by force\n moreover have \\m < k\\\n using \\m \\ n\\ \\Suc n \\ k\\ by simp\n ultimately show False\n using ps assms(2-3) distinct_introduces by fastforce\n qed\n qed\n then show ?thesis\n by auto\nqed\n\nlemma Block_Next_potential:\n assumes \\wft A tab\\\n shows \\relt (Impl (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n)\n (Next (Here (\\t. getPotential t = n)))) tab\\\n using assms by (auto elim: wft.cases)\n\nlemma Block_nxt_potential:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n)\n impl (nxt (holds (\\t. getPotential t = n)))) steps\\\nproof -\n have \\alw (rels (Impl (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n)\n (Next (Here (\\t. getPotential t = n))))) steps\\\n using wft_alw assms Block_Next_potential .\n then show ?thesis\n by simp\nqed\n\nlemma Suc_potential:\n assumes \\wft A tab\\\n shows \\relt (Here (\\l. (\\i. getTag l = Block i) \\ (\\n. getPotential l = Suc n))) tab\\\n using assms(1) by (auto elim: wft.cases)\n\nlemma Suc_potential_ipath:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\l. (\\i. getTag l = Block i) \\ (\\n. getPotential l = Suc n))) steps\\\nproof -\n have \\alw (rels (Here (\\l. (\\i. getTag l = Block i) \\ (\\n. getPotential l = Suc n)))) steps\\\n using wft_alw assms Suc_potential .\n then show ?thesis\n by simp\nqed\n\nlemma ipath_ev_not_Block:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\\\k. \\i. getTag (sdrop m steps !! k) = Block i\\\nproof (rule ccontr)\n assume \\\\ ?thesis\\\n then have *: \\\\k. \\i. getTag (sdrop m steps !! k) = Block i\\\n by blast\n moreover have \\alw (holds (\\l. (\\i. getTag l = Block i) \\ (\\n. getPotential l = Suc n))) steps\\\n using Suc_potential_ipath assms .\n ultimately have suc: \\\\k. \\n. getPotential (sdrop m steps !! k) = Suc n\\\n using alw_snth alw_sdrop by blast\n then obtain n where n: \\getPotential (shd (sdrop m steps)) = Suc n\\\n by (metis snth.simps(1))\n\n have \\alw (holds (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n)\n impl (nxt (holds (\\t. getPotential t = n)))) steps\\ for n\n using Block_nxt_potential assms .\n then have \\alw (holds (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n)\n impl (nxt (holds (\\t. getPotential t = n)))) (sdrop m steps)\\ for n\n by (simp add: alw_iff_sdrop)\n then have \\\\k. ((holds (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n))\n impl (nxt (holds (\\t. getPotential t = n)))) (sdrop (m + k) steps)\\ for n\n by (simp add: alw_iff_sdrop)\n then have \\\\k. holds (\\l. (\\i. getTag l = Block i) \\ getPotential l = Suc n) (sdrop (m + k) steps)\n \\ holds (\\t. getPotential t = n) (sdrop (Suc m + k) steps)\\ for n\n by simp\n moreover from * have \\\\k. holds (\\l. (\\i. getTag l = Block i)) (sdrop (m + k) steps)\\\n by (metis (mono_tags, lifting) holds.elims(1) sdrop_add sdrop_simps(1))\n ultimately have **: \\\\k. (holds (\\l. getPotential l = Suc n)) (sdrop (m + k) steps)\n \\ (holds (\\t. getPotential t = n)) (sdrop (Suc (m + k)) steps)\\ for n\n by (simp add: alw_iff_sdrop)\n\n have \\getPotential (sdrop m steps !! k) = Suc n - k\\ for k\n proof (induct k)\n case 0\n then show ?case\n using n by simp\n next\n case (Suc k)\n moreover obtain x where x: \\getPotential (sdrop m steps !! k) = Suc x\\\n using suc by metis\n then have \\getPotential (sdrop m steps !! Suc k) = x\\\n using ** by (simp add: sdrop_snth)\n ultimately show ?case\n using x by simp\n qed\n then have \\getPotential (sdrop m steps !! Suc n) = 0\\\n by presburger\n then show False\n using suc by (metis Zero_not_Suc)\nqed\n\nlemma ipath_Open_Close:\n assumes \\ipath tab steps\\ \\wft A tab\\ \n shows \\alw (holds (\\l. getTag l \\ Open \\ (\\p i. getTag l = Close p i))) steps\\\n using assms\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n by cases (fastforce elim: wft.cases)\nqed\n\nlemma introduces_None:\n assumes \\introduces t = None\\\n shows \\t = Open \\ (\\p i. t = Close p i) \\ (\\i. t = Block i)\\\n using assms by (cases t) simp_all\n\ntheorem infinite_generated:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\infinite (generated_ipath steps)\\\nproof\n let ?B = \\generated_ipath steps \\ branch_nominals (getBranch (shd steps))\\\n assume \\finite (generated_ipath steps)\\\n then have \\finite ?B\\\n using finite_branch_nominals by blast\n then obtain k where k: \\\\k' \\ k. introduces (getTag (steps !! k')) = None\\\n using assms(1-2) introduces_bound by blast\n then have \\alw (holds (\\l. introduces (getTag l) = None)) (sdrop k steps)\\\n by (simp add: alw_iff_sdrop)\n moreover have \\alw (holds (\\l. getTag l \\ Open \\ (\\p i. getTag l = Close p i))) steps\\\n using ipath_Open_Close assms(2, 1) .\n then have \\alw (holds (\\l. getTag l \\ Open \\ (\\p i. getTag l = Close p i))) (sdrop k steps)\\\n by (simp add: alw_iff_sdrop)\n ultimately have *: \\alw (holds (\\l. \\i. getTag l = Block i)) (sdrop k steps)\\\n using introduces_None by (metis (mono_tags, lifting) alw_sset sset_alw)\n moreover have \\\\x. \\i. getTag (sdrop k steps !! x) = Block i\\\n using ipath_ev_not_Block assms(1-2) .\n ultimately show False\n using alw_snth by blast\nqed\n\nsection \\Infinite Path\\\n\ndefinition propers :: \\('a, 'b) fm set \\ ('a, 'b) fm set\\ where\n \\propers X \\ {p. p \\ X \\ (\\p'. p = (\\<^bold>\\ p') \\ (\\a. p' = Nom a))}\\\n\nlemma finite_propers_quasis: \\finite (propers (quasis A p))\\\nproof (induct p rule: quasis.induct)\n case (1 A p)\n moreover have \\propers (quasis A (\\<^bold>\\ \\<^bold>\\ p)) \\ {p} \\ propers (quasis A p)\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset)\nnext\n case (2 A p q)\n moreover have \\propers (quasis A (p \\<^bold>\\ q)) \\ {p, q} \\ propers (quasis A p) \\ propers (quasis A q)\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset)\nnext\n case (3 A p q)\n moreover have \\propers (quasis A (\\<^bold>\\ (p \\<^bold>\\ q))) \\\n {\\<^bold>\\ p, \\<^bold>\\ q} \\ propers (quasis A (\\<^bold>\\ p)) \\ propers (quasis A (\\<^bold>\\ q))\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset)\nnext\n case (4 A p)\n moreover have \\propers (quasis A (\\<^bold>\\ p)) \\ {p} \\ propers (quasis A p)\\\n unfolding propers_def by auto\n ultimately show ?case\n unfolding propers_def\n by (cases \\\\a. p = Nom a\\) (simp_all add: finite_subset)\nnext\n case (5 A p)\n moreover have \\propers (quasis A (\\<^bold>\\ (\\<^bold>\\ p))) \\ {\\<^bold>\\ p} \\ propers (quasis A (\\<^bold>\\ p))\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset) \nnext\n case (6 A i p)\n moreover have \\propers (quasis A (\\<^bold>@ i p)) \\ {p} \\ propers (quasis A p)\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset) \nnext\n case (7 A i p)\n moreover have \\propers (quasis A (\\<^bold>\\ (\\<^bold>@ i p))) \\ {\\<^bold>\\ p} \\ propers (quasis A (\\<^bold>\\ p))\\\n unfolding propers_def by auto\n ultimately show ?case\n by (simp add: finite_subset) \nqed (simp_all add: propers_def)\n\nlemma propers_Un: \\propers (A \\ B) = propers A \\ propers B\\\n unfolding propers_def by blast\n\nlemma propers_subset: \\propers X \\ X\\\n unfolding propers_def by blast\n\nlemma finite_propers_formula_bound: \\finite (propers (formula_bound B branch))\\\nproof -\n let ?b = \\branch_formulas branch\\\n have b: \\finite ?b\\\n using finite_branch_formulas by blast\n\n let ?X = \\formula_bound B branch\\\n\n have \\propers (\\p \\ ?b. quasis B p) = (\\p \\ ?b. propers (quasis B p))\\\n unfolding propers_def by blast\n moreover have \\finite (propers (quasis B p))\\ for p :: \\('a, 'b) fm\\\n using finite_propers_quasis by blast\n ultimately have \\finite (propers (\\p \\ ?b. quasis B p))\\\n using b by simp\n moreover have \\finite (propers ?b)\\\n using b finite_subset propers_subset by blast\n moreover have \\propers ?X = propers ?b \\ propers (\\p \\ ?b. quasis B p)\\\n unfolding formula_bound_def propers_def by blast\n ultimately show ?thesis\n by simp\nqed\n\nlemma Fresh_unwitnessed:\n assumes \\wft A tab\\\n shows \\relt (Here (\\t. \\a p i. getTag t = Fresh a p i \\ \\ witnessed p a (getBranch t))) tab\\\n using assms by (auto elim: wft.cases)\n\nlemma Fresh_unwitnessed_ipath:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\alw (holds (\\t. \\a p i. getTag t = Fresh a p i \\ \\ witnessed p a (getBranch t))) steps\\\nproof -\n have \\alw (rels (Here (\\t. \\a p i. getTag t = Fresh a p i \\\n \\ witnessed p a (getBranch t)))) steps\\\n using wft_alw assms Fresh_unwitnessed .\n then show ?thesis\n by simp\nqed\n\nlemma distinct_Fresh:\n assumes \\wft A tab\\ \\ipath tab steps\\ \\steps !! m = s\\ \\steps !! n = s'\\ \\m < n\\\n \\getTag s = Fresh a p i\\ \\getTag s' = Fresh a q j\\\n shows \\p \\ q\\\nproof -\n let ?ps = \\[\\<^bold>@ i p, \\<^bold>\\ Nom i]\\\n have \\alw (holds (\\t. introduces (getTag t) = Some ([?ps], a))\n impl nxt (holds (\\s. \\ps \\ set [?ps]. ps \\ [] \\ (\\p\\set ps. p at a in getBranch s)))) steps\\\n using introduces_alw_nxt assms(1-2) .\n then have \\holds (\\s. \\p\\set ?ps. p at a in getBranch s) (sdrop (Suc m) steps)\\\n using assms(3, 6) by (simp add: alw_iff_sdrop)\n then have\n \\holds (\\s. (\\<^bold>@ i p) at a in getBranch s) (sdrop (Suc m) steps)\\\n \\holds (\\s. (\\<^bold>\\ Nom i) at a in getBranch s) (sdrop (Suc m) steps)\\\n by auto\n moreover have \\alw (holds (\\l. p at a in getBranch l)\n impl nxt (holds (\\l. p at a in getBranch l))) steps\\ for p\n using preservation_alw assms(1-2) .\n then have \\alw (holds (\\l. p at a in getBranch l)\n impl nxt (holds (\\l. p at a in getBranch l))) (sdrop (Suc m) steps)\\ for p\n using alw_sdrop by blast\n ultimately have\n \\alw (holds (\\l. (\\<^bold>@ i p) at a in getBranch l)) (sdrop (Suc m) steps)\\\n \\alw (holds (\\l. (\\<^bold>\\ Nom i) at a in getBranch l)) (sdrop (Suc m) steps)\\\n using alw_invar by blast+\n then have\n \\holds (\\l. (\\<^bold>@ i p) at a in getBranch l) (sdrop n steps)\\\n \\holds (\\l. (\\<^bold>\\ Nom i) at a in getBranch l) (sdrop n steps)\\\n using \\m < n\\ by (auto simp: alw_iff_sdrop elim: less_natE)\n then have \\holds (\\l. witnessed p a (getBranch l)) (sdrop n steps)\\\n unfolding witnessed_def by auto\n\n moreover have \\alw (holds (\\t. \\a p i. getTag t = Fresh a p i \\\n \\ witnessed p a (getBranch t))) steps\\\n using Fresh_unwitnessed_ipath assms(1-2) .\n then have \\alw (holds (\\t. \\a p i. getTag t = Fresh a p i \\\n \\ witnessed p a (getBranch t))) (sdrop n steps)\\\n by (simp add: alw_iff_sdrop)\n then have \\holds (\\t. \\ witnessed q a (getBranch t)) (sdrop n steps)\\\n using assms(4, 7) by auto\n ultimately show ?thesis\n unfolding witnessed_def by auto\nqed\n\nlemma labels_sset:\n assumes \\\\l \\ labels t. P l\\ \\ipath t s\\\n shows \\\\l \\ sset s. P l\\\n using assms by (meson alw_sset alwt_ipath labels_alwt_holdst)\n\nlemma finite_inj_preimage:\n assumes \\finite (f ` X)\\ \\inj f\\\n shows \\finite X\\\n using assms by (meson finite.emptyI finite.insertI finite_vimageI inf_img_fin_dom)\n\nlemma Fresh_determined_nominal:\n assumes \\wft A tab\\ \\ipath tab steps\\\n \\Fresh a p i \\ getTag ` sset steps\\ \\Fresh a p i' \\ getTag ` sset steps\\\n shows \\i = i'\\\nproof -\n obtain m where m: \\getTag (steps !! m) = Fresh a p i\\\n using assms(3) sset_range by (metis image_iff)\n obtain n where n: \\getTag (steps !! n) = Fresh a p i'\\\n using assms(4) sset_range by (metis image_iff)\n\n consider (lt) \\m < n\\ | (eq) \\m = n\\ | (gt) \\n < m\\\n by linarith\n then show ?thesis\n proof cases\n case lt\n then show ?thesis\n using assms(1-2) m n distinct_Fresh by fast\n next\n case eq\n then show ?thesis\n using m n by simp\n next\n case gt\n then show ?thesis\n using assms(1-2) m n distinct_Fresh by fast\n qed\nqed\n\nlemma Fresh_determined_nominal_f:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\\\f. \\p i. Fresh a p i \\ getTag ` sset steps \\ f p = i\\\nproof (intro exI allI impI)\n fix p i\n let ?f = \\\\p. THE i. Fresh a p i \\ getTag ` sset steps\\\n assume \\Fresh a p i \\ getTag ` sset steps\\\n then show \\?f p = i\\\n using assms Fresh_determined_nominal by fast\nqed\n\nlemma finite_Fresh_nominal:\n assumes \\wft A tab\\ \\ipath tab steps\\\n \\finite {p |p i. Fresh a p i \\ getTag ` sset steps}\\\n shows \\finite {i |p i. Fresh a p i \\ getTag ` sset steps}\\\nproof -\n obtain f where \\\\p i. Fresh a p i \\ getTag ` sset steps \\ f p = i\\\n using assms(1-2) Fresh_determined_nominal_f by metis\n then have \\{f p |p i. Fresh a p i \\ getTag ` sset steps} =\n {i |p i. Fresh a p i \\ getTag ` sset steps}\\\n by blast\n moreover have \\finite {f p |p i. Fresh a p i \\ getTag ` sset steps}\\\n using assms(3) by simp\n ultimately show ?thesis\n by simp\nqed\n\ntext \\The number of nominals generated by any fixed nominal is finite.\\\n\ntheorem generated_bound:\n assumes \\wft A tab\\ \\ipath tab steps\\\n shows \\finite {(a, i) |p i. Fresh a p i \\ getTag ` sset steps}\\\nproof -\n let ?B = \\generated_ipath steps \\ branch_nominals (getBranch (shd steps))\\\n let ?X = \\formula_bound ?B (getBranch (shd steps))\\\n let ?Y = \\propers ?X\\\n\n have \\alw (holds (\\step. \\a p i. getTag step = Fresh a p i \\\n (\\a. p = Nom a) \\ (\\<^bold>\\ p) \\ ?X)) steps\\\n using assms wft_introduces_quasis_ipath by blast\n then have \\\\l \\ sset steps. \\p i. getTag l = Fresh a p i \\\n (\\a. p = Nom a) \\ (\\<^bold>\\ p) \\ ?X\\\n by (smt alw_sset)\n then have \\\\l \\ sset steps. \\p i. getTag l = Fresh a p i \\ (\\<^bold>\\ p) \\ ?Y\\\n unfolding propers_def by blast\n moreover have \\finite ?Y\\\n using finite_propers_formula_bound by blast\n ultimately have \\finite {\\<^bold>\\ p |p i. Fresh a p i \\ getTag ` sset steps}\\\n by (smt finite_subset imageE mem_Collect_eq subsetI)\n moreover have \\Dia ` {p |p i. Fresh a p i \\ getTag ` sset steps} \\\n {\\<^bold>\\ p |p i. Fresh a p i \\ getTag ` sset steps}\\\n by blast\n ultimately have \\finite (Dia ` {p |p i. Fresh a p i \\ getTag ` sset steps})\\\n by (simp add: finite_subset) \n moreover have \\inj Dia\\\n unfolding inj_def by blast\n ultimately have \\finite {p |p i. Fresh a p i \\ getTag ` sset steps}\\\n using finite_inj_preimage by fast\n then have \\finite {i |p i. Fresh a p i \\ getTag ` sset steps}\\\n using assms finite_Fresh_nominal by fast\n then have \\finite ({a} \\ {i |p i. Fresh a p i \\ getTag ` sset steps})\\\n by blast\n moreover have \\({a} \\ {i |p i. Fresh a p i \\ getTag ` sset steps}) =\n {(a, i) |p i. Fresh a p i \\ getTag ` sset steps}\\\n by fast\n ultimately show ?thesis\n by simp\nqed\n\n(**********************************************************************************)\n\nsection \\CURRENT WORK\\\n\n(* Ignoring Lemma 6.4 / 4.2 for a bit (finite set of well-founded, finitely branching trees) *)\n\n(* Ignoring Lemma 6.5 for a bit (must be an infinite chain) *)\n\n\n(* TODO: not currently used *)\ndefinition set_to_list :: \\'a set \\ 'a list\\ where\n \\set_to_list s = (SOME l. set l = s)\\\n\nlemma set_set_to_list: \\finite s \\ set (set_to_list s) = s\\\n unfolding set_to_list_def by (metis (mono_tags) finite_list some_eq_ex)\n\nprimcorec mkTree :: \\('b \\ 'b) set \\ 'b \\ 'b tree\\ where\n \\getLabel (mkTree T a) = a\\\n| \\getSubs (mkTree T a) = map (mkTree T) (set_to_list {b. (a, b) \\ T})\\\n\n(*\n a h j\n b c i\n d e f\n g\n*)\n\n(* Major TODO\n + We have that ipath \\ infinite nominals generated on that ipath\n + We have that any root has a finite number of subtrees (generated_bound).\n \n - We need to show that infinite nominals on an ipath means an infinite chain\n - We need to show the decreasing measure\n*)\n\nsubsection \\Measure\\\n\nlemma woop1:\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n \\(holds (\\step. \\r'. r' at c in getBranch step \\ size r' \\ size r) impl\n (holds (\\step. \\r'. r' at b in getBranch step \\ size r < size r'))) steps\\\n shows \\alw\n (holds (\\step. \\r'. r' at c in getBranch step \\ size r' \\ size r) impl\n (holds (\\step. \\r'. r' at b in getBranch step \\ size r < size r'))) steps\\\n using assms\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n proof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using alw(2) wft_alwt by (auto elim: wft.cases)\n from alw(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath(1-2) alw(1-2) alw_holds ipath_Open_Close\n by (metis (mono_tags, lifting) step.sel(1) tree.inject)\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath(1-2) alw(1-2) alw_holds ipath_Open_Close\n by (metis (mono_tags, lifting) step.sel(1) tree.inject)\n next\n case (WfNeg p a ps branch s n)\n then have the: ?thesis if\n \\(\\r'. r' at c in getBranch (shd tail) \\ size r' \\ size r) \\\n (\\r'. r' at b in getBranch (shd tail) \\ size r < size r')\\\n using that alw IPath by auto\n\n have *:\n \\(\\r'. r' at c in getBranch l \\ size r' \\ size r) \\\n (\\r'. r' at b in getBranch l \\ size r < size r')\\\n using IPath(2) alw(4) by auto\n\n have \\getBranch (shd tail) = (p # ps, a) # branch\\\n using IPath(1, 3-4) WfNeg(1, 4) by (fastforce elim: ipath.cases)\n moreover have \\getBranch l = (ps, a) # branch\\\n using IPath(1) WfNeg(1) by auto\n moreover note \\(\\<^bold>\\ \\<^bold>\\ p) at a in (ps, a) # branch\\\n moreover have \\size p \\ size (\\<^bold>\\ \\<^bold>\\ p)\\\n by simp\n ultimately have **: \\\\r'. r' at c in getBranch (shd tail) \\\n (\\r''. r'' at c in getBranch l \\ size r' \\ size r'')\\\n \\\\r'. r' at c in getBranch l \\\n (\\r''. r'' at c in getBranch (shd tail) \\ size r' \\ size r'')\\\n by (metis (no_types, opaque_lifting) list.set_intros(1-2) on.simps order_refl prod.inject\n set_ConsD)+\n\n {\n assume assm: \\\\r'. r' at c in getBranch (shd tail) \\ size r' \\ size r\\\n then have \\\\r'. r' at c in getBranch (shd tail) \\\n (\\r''. r'' at c in getBranch l \\ size r' \\ size r'')\\\n using **(1) by blast\n then have \\\\r'. r' at c in getBranch l \\ size r' \\ size r\\\n using **(2) assm by (meson le_trans)\n then have \\\\r'. r' at b in getBranch l \\ size r < size r'\\\n using * by blast\n then have \\\\r'. r' at b in getBranch (shd tail) \\ size r < size r'\\\n using \\getBranch (shd tail) = (p # ps, a) # branch\\ \\getBranch l = (ps, a) # branch\\ \n by (metis list.set_intros(1-2) on.simps prod.inject set_ConsD)\n }\n then show ?thesis\n using the by blast\n next\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis sorry\n next\n case (WfDisN p q a ps branch s n intro)\n then show ?thesis sorry\n next\n case (WfDiaP p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfDiaN p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfSatP a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfSatN a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfGoTo i branch s n)\n then show ?thesis sorry\n next\n case (WfNom p b ps a branch s n)\n then show ?thesis sorry\n qed\n qed\nqed\n\n(* tricky to show this directly by coinduction since we lack the assumption\n but it should hold and it's what we want *)\n(* c is generated, so there cannot be any c blocks initially *)\nlemma woop2:\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n shows \\alw (holds (\\step. \\r. r at b in getBranch step \\\n (\\r'. r' at c in getBranch step \\ size r' < size r))) steps\\\n using assms\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n proof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using alw(2) wft_alwt by (auto elim: wft.cases)\n from alw(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfNeg p a ps branch s n)\n then show ?thesis\n sorry\n next\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis sorry\n next\n case (WfDisN p q a ps branch s n intro)\n then show ?thesis sorry\n next\n case (WfDiaP p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfDiaN p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfSatP a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfSatN a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfGoTo i branch s n)\n then show ?thesis sorry\n next\n case (WfNom p b ps a branch s n)\n then show ?thesis sorry\n qed\n qed\nqed\n\ntext \\\n There is an infinite chain of generated nominals starting with i if\n within some prefix, i generates j and the remaining suffix has a chain from j.\n\\\ncoinductive infgen :: \\'b \\ ('a, 'b) step stream \\ bool\\ where\n InfGen: \\Fresh i p j \\ getTag ` set (stake n xs) \\\n infgen j (sdrop n xs) \\\n infgen i xs\\\n\ntext \\Version that gives us the stream of nominals.\\\ncoinductive infgens :: \\'b stream \\ ('a, 'b) step stream \\ bool\\ where\n InfGens: \\Fresh i p j \\ getTag ` set (stake n xs) \\\n infgens (j ## bs) (sdrop n xs) \\\n infgens (i ## j ## bs) xs\\\n\n(*\n Branch: step step step step\n Some steps are the generation of a nominal\n We know that an infinite branch must have an infinite number of nominals\n We will also show that they must form a chain\n\n Assume we have such a chain in our branch\n We will show that each generated nominal has smaller formulas on it\n This leads to an infinite descent in formula size\n This is a contradiction\n*)\n\ndefinition fms_at :: \\'b \\ ('a, 'b) step stream \\ ('a, 'b) fm set\\ where\n \\fms_at i steps \\ {p |p step. step \\ sset steps \\ p at i in getBranch step}\\\n\n(* TODO: need quasi-root lemmas to show this, I guess *)\nlemma finite_size_fms_at:\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows \\finite (size ` fms_at i steps)\\\n sorry\n\ndefinition M_branch :: \\'b \\ ('a, 'b) step stream \\ nat\\ where\n \\M_branch i steps \\ Max (size ` fms_at i steps)\\\n\nlemma M_branch_le:\n assumes \\p \\ fms_at i steps\\ \\\\q. q \\ fms_at i steps \\ size q \\ size p\\\n shows \\M_branch i steps = size p\\\n using assms unfolding M_branch_def (* TODO: smt *)\n by (smt (verit, del_insts) Max_eqI finite_nat_set_iff_bounded_le image_iff)\n\n(*\n Imagine we have the whole branch in front of us.\n Then we consider a maximal element at c.\n We see what introduced it.\n In each case, we show that there is a bigger element at b.\n \n What kind of principle is this?\n \n Assume it holds.\n Show it keeps holding under extensions.\n alw P steps?\n But P references all of steps\n\n*)\n\n(*\n \\(holds (\\step. \\r'. r' at c in getBranch step \\ size r' \\ size r) impl\n (holds (\\step. \\r'. r' at b in getBranch step \\ size r < size r'))) steps\\\n shows \\alw\n (holds (\\step. \\r'. r' at c in getBranch step \\ size r' \\ size r) impl\n (holds (\\step. \\r'. r' at b in getBranch step \\ size r < size r'))) steps\\\n\nthis isn't good for going to the global M_branch we need for the descent\n\nalw (\\r. r at c in getBranch step \\ size r < M_branch b steps) steps\n*)\n\nlemma fms_at_SCons: \\fms_at i xs \\ fms_at i (x ## xs)\\\n unfolding fms_at_def by auto\n\nlemma M_branch_SCons: \\M_branch i xs \\ M_branch i (x ## xs)\\\n unfolding M_branch_def using fms_at_SCons finite_size_fms_at sorry\n (* TODO: ipath tab xs of wft tab *)\n\nlemma zoop1':\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\M_branch c steps \\ x\\\n shows \\alw (holds (\\step. \\r. r at c in getBranch step \\ size r \\ x)) steps\\\n using assms\nproof (coinduction arbitrary: tab steps)\n case alw\n then show ?case\n proof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using alw(2) wft_alwt by (auto elim: wft.cases)\n from alw(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfNeg p a ps branch s n)\n then have ?thesis if\n \\\\r. r at c in (ps, a) # branch \\ size r \\ x\\\n \\M_branch c tail \\ x\\\n using that IPath(1-2, 4) wft by auto\n \n moreover have \\M_branch c tail \\ x\\\n using alw(3) IPath(2) M_branch_SCons by (metis dual_order.trans)\n\n moreover from alw(3) have \\\\r \\ fms_at c steps. size r \\ x\\\n unfolding M_branch_def using alw(1-2) finite_size_fms_at\n by (metis Max_ge dual_order.trans image_eqI)\n then have \\\\r. r at c in (ps, a) # branch \\ size r \\ x\\\n unfolding fms_at_def using IPath(1-2) WfNeg(1) by fastforce\n\n ultimately show ?thesis\n by blast\n next\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis sorry\n next\n case (WfDisN p q a ps branch s n intro)\n then show ?thesis sorry\n next\n case (WfDiaP p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfDiaN p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfSatP a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfSatN a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfGoTo i branch s n)\n then show ?thesis sorry\n next\n case (WfNom p b ps a branch s n)\n then show ?thesis sorry\n qed\n qed\nqed\n\n(* Trying to work out how to formulate the a < b \\ m b < m a lemma in a way we can prove *)\n\nlemma zoop1:\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows \\alw (holds (\\step. \\p. p at i in getBranch step \\ size p \\ M_branch i steps)) steps\\\n using assms zoop1' by fast\n\nlemma zoop2:\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n \\M_branch b steps \\ bmax\\\n shows \\alw (holds (\\step. \\r. r at c in getBranch step \\ size r < bmax)) steps\\\n (* idea, don't look at a max c-formula, just look at all of them, at all steps.\n we can add that it holds initially if we need to (probably do)\n This gives us something suitable for the coinduction principle\n\n We need to then bound it by M_branch c steps afterwards\n And the bound needs to be tight so it doesn't surpass bmax\n But the bound is only tight in the limit, not at each step\n\n \n at each step, a local (varying) measure is smaller than a global (constant) measure\n l c < m b\n l c \\ m c\n I need m c < m b\n *)\n sorry\n\n(* the induction principle is local but the measure is global\n\n I need to look at a largest formula and see what rule introduced it.\n\n No matter what largest c-formula you look at,\n by looking at what introduced it,\n you can point to a larger b-formula\n when b < c\n\n\n Let's say we show the local property:\n at all steps, all c-formulas are smaller than bmax\n\n Then we get a property about each step.\n But the measure is defined across the steps.\n So we need to show\n - Each step is at most the measure (should be possible)\n - There is a step equal to the measure\n So we get a tight bound.\n*)\n\n\nlemma zoop1a:\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows \\ev (holds (\\step. \\p. p at i in getBranch step \\ M_branch i steps \\ size p)) steps\\\n sorry\n\n\n\nlemma zoop3:\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n \\M_branch b steps \\ bmax\\\n shows \\alw (holds (\\step. M_branch c steps < bmax)) steps\\\nproof -\n have \\alw (holds (\\step. \\r. r at c in getBranch step \\ size r < bmax)) steps\\\n using assms zoop2 by fast\n then have *: \\\\step \\ sset steps. \\r. r at c in getBranch step \\ size r < bmax\\\n using alw_sset by (metis (mono_tags, lifting))\n \n have\n \\alw (holds (\\step. \\p. p at c in getBranch step \\ size p \\ M_branch c steps)) steps\\\n using assms zoop1 by fast\n then have **:\n \\\\step \\ sset steps. \\p. p at c in getBranch step \\ size p \\ M_branch c steps\\\n using alw_sset by (metis (mono_tags, lifting))\n\n have \\\\step \\ sset steps. M_branch c steps \\ bmax\\\n proof\n fix step\n assume step: \\step \\ sset steps\\\n then have \\\\r. r at c in getBranch step \\ size r < bmax\\\n using * by blast\n moreover have \\\\r. r at c in getBranch step \\ size r \\ M_branch c steps\\\n using step ** by blast\n ultimately show \\M_branch c steps \\ bmax\\\n (* this makes no sense *)\n sorry\n qed\n then show ?thesis\n sorry\nqed\n\nlemma\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n \\pc \\ fms_at c steps\\ \\\\q. q \\ fms_at c steps \\ size q \\ size pc\\ (* pc max at c *)\n shows \\size pc < M_branch b steps\\\n using assms\nproof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using assms(2) wft_alwt by (auto elim: wft.cases)\n from assms(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfNeg p a ps branch s n)\n then show ?thesis\n using IPath assms(3-) sorry\n (* if p = pc then \\ \\ p is bigger. Contradiction *)\n (* otherwise we need to know the thesis held before the extension *)\n next\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis sorry\n next\n case (WfDisN p q a ps branch s n intro)\n then show ?thesis sorry\n next\n case (WfDiaP p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfDiaN p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfSatP a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfSatN a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfGoTo i branch s n)\n then show ?thesis sorry\n next\n case (WfNom p b ps a branch s n)\n then show ?thesis sorry\n qed\nqed\n\n\n(* TODO: this is what we want for the infinite descent, question is how easy it is to prove *)\nlemma woop4:\n assumes \\ipath tab steps\\ \\wft A tab\\\n \\Fresh b t c \\ getTag ` sset steps\\ (* b < c *)\n shows \\M_branch c steps < M_branch b steps\\\n using assms\nproof cases\n case (IPath s' subs tail l)\n then have wft: \\wft A s'\\\n using assms(2) wft_alwt by (auto elim: wft.cases)\n from assms(2) show ?thesis\n proof cases\n case (WfClose p i branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfOpen branch n)\n then show ?thesis\n using IPath(1, 3) by simp\n next\n case (WfNeg p a ps branch s n)\n then show ?thesis\n unfolding M_branch_def\n using IPath (* we lack inductive knowledge to build on *)\n sorry\n next\n case (WfDisP p q a ps branch sl n sr)\n then show ?thesis sorry\n next\n case (WfDisN p q a ps branch s n intro)\n then show ?thesis sorry\n next\n case (WfDiaP p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfDiaN p a ps branch i s n)\n then show ?thesis sorry\n next\n case (WfSatP a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfSatN a p b ps branch s n)\n then show ?thesis sorry\n next\n case (WfGoTo i branch s n)\n then show ?thesis sorry\n next\n case (WfNom p b ps a branch s n)\n then show ?thesis sorry\n qed\nqed\n\nlemma ne_sset: \\sset steps \\ {}\\\n by (cases steps) auto\n\nlemma fms_at_sdrop: \\fms_at i (sdrop n steps) \\ fms_at i steps\\\n unfolding fms_at_def (* TODO: smt *)\n by (smt (verit) Collect_mono sdrop_add sdrop_simps(1) snth_sset sset_sdrop)\n\nlemma M_branch_sdrop: \\M_branch i (sdrop n steps) \\ M_branch i steps\\\n unfolding M_branch_def using fms_at_sdrop sorry\n\nlemma ipath_infgens':\n assumes \\ipath tab steps\\ \\wft A tab\\ \\infgens bs steps\\\n (* TODO: derive some infgens from ipath *)\n \\M_branch (shd bs) steps < r\\ \\ \\to less-induct on a natural number (r)\\\n shows \\False\\\n using assms\nproof (induct r arbitrary: tab bs steps rule: less_induct)\n case (less x)\n from less(4) show ?case\n proof cases\n case (InfGens i p j n bs')\n then have \\Fresh i p j \\ getTag ` sset steps\\\n using stake_snth by fastforce\n then have \\M_branch j steps < M_branch i steps\\\n using less(2-3) woop4 by fast\n then have \\M_branch j (sdrop n steps) < M_branch i steps\\\n using M_branch_sdrop by (metis le_less_trans)\n then have \\M_branch j (sdrop n steps) < M_branch (shd bs) steps\\\n using InfGens(1) by simp\n moreover note \\infgens (j ## bs') (sdrop n steps)\\ \\M_branch (shd bs) steps < x\\\n moreover obtain t where \\wft A t\\ \\ipath t (sdrop n steps)\\\n using less(2-3) wft_ipath_sdrop by blast\n ultimately show False\n using less(1) by fastforce \n qed\nqed\n\ntheorem ipath_infgens:\n assumes \\ipath tab steps\\ \\wft A tab\\\n shows \\\\ infgens bs steps\\\n using assms ipath_infgens' by fast\n\n(*\n m turns a branch and a nominal into a natural number\n then we less_induct on that number\n*)\n\nsection \\THINGS I MAY NOT NEED\\\n\n(* TODO: I don't think we actually need the whole (q)subfm machinery, just quasis. *)\n\nprimrec subfm :: \\('a, 'b) fm \\ ('a, 'b) fm \\ bool\\ where\n \\subfm p (Pro x) = (p = Pro x)\\\n| \\subfm p (Nom a) = (p = Nom a)\\\n| \\subfm p (\\<^bold>\\ q) = (p = (\\<^bold>\\ q) \\ subfm p q)\\\n| \\subfm p (q \\<^bold>\\ r) = (p = (q \\<^bold>\\ r) \\ subfm p q \\ subfm p r)\\\n| \\subfm p (\\<^bold>\\ q) = (p = (\\<^bold>\\ q) \\ subfm p q)\\\n| \\subfm p (\\<^bold>@ i q) = (p = (\\<^bold>@ i q) \\ p = Nom i \\ subfm p q)\\\n\nlemma subfm_refl [simp]: \\subfm p p\\\n by (cases p) simp_all\n\nlemma subfm_trans: \\subfm p q \\ subfm q r \\ subfm p r\\\n by (induct r) auto\n\nlemma subfm_reflp: \\reflp subfm\\\n unfolding reflp_def by simp\n\nlemma subfm_transp: \\transp subfm\\\n unfolding transp_def using subfm_trans by blast\n\nlemma nominals_subfm [simp]: \\i \\ nominals p \\ subfm (Nom i) p\\\n by (induct p) auto\n\ninductive qsubfm :: \\('a, 'b) fm \\ ('a, 'b) fm \\ bool\\ where\n (* q is fixed but to express that, I need to put it first which would be annoying *)\n PureSub: \\subfm p q \\ qsubfm p q\\\n| NegPSub: \\subfm p q \\ qsubfm (\\<^bold>\\ p) q\\\n| SatPSub: \\subfm p q \\ qsubfm (\\<^bold>@ i p) q\\\n| SatNSub: \\subfm p q \\ qsubfm (\\<^bold>\\ (\\<^bold>@ i p)) q\\\n\nlemma qsubfm_reflp: \\reflp qsubfm\\\n unfolding reflp_def by (simp add: PureSub)\n\nlemma quasis_qsubfm: \\p' \\ quasis A p \\ qsubfm p' p \\ size p' \\ size p\\\n by (induct p arbitrary: p' rule: quasis.induct)\n (fastforce simp: qsubfm.intros elim: qsubfm.cases split: if_splits)+\n\nsubsection \\Distinct branches\\\n\nlemma fin_finite_branches:\n assumes \\fin tab\\ \\wft A tab\\\n shows \\finite (getBranch ` labels tab)\\\n using assms by induct (fastforce simp: image_UN elim: wft.cases)\n\ncorollary infinite_branches_infin:\n assumes \\infinite (getBranch ` labels tab)\\ \\wft A tab\\\n shows \\infin tab\\\n using assms fin_finite_branches by blast\n\ndefinition nformulas :: \\('a, 'b) branch \\ nat\\ where\n \\nformulas branch \\ sum_list (map (Suc o length o fst) branch)\\\n\nlemma alwt_nformulas:\n assumes \\wft A tab\\ \\nformulas branch' < nformulas (getBranch (getLabel tab))\\\n shows \\alwt (holdst (\\step. nformulas branch' < nformulas (getBranch step))) tab\\\n using assms unfolding nformulas_def\n by (coinduction arbitrary: tab) (fastforce elim: wft.cases)\n\nlemma nformulas_subs:\n assumes \\wft A (Node l subs)\\ \\s \\ set subs\\\n shows \\nformulas (getBranch l) < nformulas (getBranch (getLabel s))\\\n using assms unfolding nformulas_def by (fastforce elim: wft.cases)\n\n(* TODO: may not be useful *)\nlemma wft_potential_bound:\n assumes\n \\wft A tab\\\n \\getPotential (getLabel tab) \\ start + nformulas (getBranch (getLabel tab))\\\n shows \\alwt (holdst (\\step. getPotential step \\ start + nformulas (getBranch step))) tab\\\n using assms unfolding nformulas_def\n by (coinduction arbitrary: tab) (fastforce elim: wft.cases)\n\nsubsection \\Preservation\\\n\nabbreviation preserved :: \\('a, 'b) branch \\ ('a, 'b) branch \\ bool\\ where\n \\preserved branch branch' \\ \\p b. p at b in branch \\ p at b in branch'\\\n\nlemma alwt_preservation':\n assumes \\wft A tab\\ \\preserved branch' (getBranch (getLabel tab))\\\n shows \\alwt (holdst (\\step. preserved branch' (getBranch step))) tab\\\n using assms\nproof (coinduction arbitrary: tab)\n case alwt\n then show ?case\n proof cases\n case (WfNeg p a ps branch s n)\n from this(1, 4, 6) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfDisP p q a ps branch sl n sr)\n from this(1, 5, 7, 9-10) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfDisN p q a ps branch s n)\n from this(1, 4, 6) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfDiaP p a ps branch i s n)\n from this(1, 6, 8) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfDiaN p a ps branch i s n)\n from this(1, 5, 7) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfSatP a p b ps branch s n)\n from this(1, 4, 6) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfSatN a p b ps branch s n)\n from this(1, 4, 6) show ?thesis\n using alwt(2) by fastforce\n next\n case (WfNom p b ps a branch s n)\n from this(1, 6, 8) show ?thesis\n using alwt(2) by fastforce\n qed auto\nqed\n\nlemma alwt_preservation:\n assumes \\wft A tab\\\n shows \\alwt (holdst (\\step. preserved (getBranch (getLabel tab)) (getBranch step))) tab\\\n using assms alwt_preservation' by blast\n\ncorollary alwt_preservation_subs:\n assumes \\wft A tab\\ \\s \\ set (getSubs tab)\\\n shows \\alwt (holdst (\\step. preserved (getBranch (getLabel tab)) (getBranch step))) s\\\n using assms alwt_preservation by (fastforce elim: alwt.cases)\n\nlemma reflp_preserved: \\reflp preserved\\\n unfolding reflp_def by simp\n\nlemma transp_preserved: \\transp preserved\\\n unfolding transp_def by simp\n\nend", "meta": {"author": "astahfrom", "repo": "hybrid_termination", "sha": "90e970d6cfaa7f0a6afa9debb890e5f808275fcb", "save_path": "github-repos/isabelle/astahfrom-hybrid_termination", "path": "github-repos/isabelle/astahfrom-hybrid_termination/hybrid_termination-90e970d6cfaa7f0a6afa9debb890e5f808275fcb/Termination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.28819909939536564}} {"text": "section \\AsynchronousSystem\\\n\ntext \\\n \\file{AsynchronousSystem} defines a message datatype and a transition system locale to\n model asynchronous distributed computation. It establishes a diamond property for a\n special reachability relation within such transition systems.\n\\\n\ntheory AsynchronousSystem\nimports Multiset\nbegin\n\ntext\\\n The formalization is type-parameterized over\n \\begin{description}\n \\item[\\var{'p} process identifiers.] Corresponds to the set $P$ in Völzer.\n Finiteness is not yet demanded, but will be in \\file{FLPSystem}.\n \\item[\\var{'s} process states.] Corresponds to $S$, countability is not\n imposed.\n \\item[\\var{'v} message payloads.] Corresponds to the interprocess\n communication part of $M$ from Völzer. The whole of $M$ is captured by\n \\isb{messageValue}.\n \\end{description}\n\\\n\nsubsection\\Messages\\\n\ntext \\\n A \\isb{message} is either an initial input message telling a process\n which value it should introduce to the consensus negotiation, a message\n to the environment communicating the consensus outcome, or a message\n passed from one process to some other.\n\\\n\ndatatype ('p, 'v) message =\n InMsg 'p bool (\"<_, inM _>\")\n| OutMsg bool (\"<\\, outM _>\")\n| Msg 'p 'v (\"<_, _>\")\n\ntext \\\n A message value is the content of a message, which a process may receive. \n\\\n\ndatatype 'v messageValue = \n Bool bool\n| Value 'v\n\nprimrec unpackMessage :: \"('p, 'v) message \\ 'v messageValue\"\nwhere\n \"unpackMessage = Bool b\"\n| \"unpackMessage = Value v\"\n| \"unpackMessage <\\, outM v> = Bool False\"\n\nprimrec isReceiverOf :: \n \"'p \\ ('p, 'v) message \\ bool\"\nwhere \n \"isReceiverOf p1 () = (p1 = p2)\"\n | \"isReceiverOf p1 () = (p1 = p2)\"\n | \"isReceiverOf p1 (<\\,outM v>) = False\"\n\nlemma UniqueReceiverOf:\nfixes \n msg :: \"('p, 'v) message\" and\n p q :: 'p\nassumes\n \"isReceiverOf q msg\"\n \"p \\ q\"\nshows \n \"\\ isReceiverOf p msg\"\nusing assms by (cases msg, auto)\n\nsubsection\\Configurations\\\n\ntext \\\n Here we formalize a configuration as detailed in section 2 of Völzer's paper.\n\n Note that Völzer imposes the finiteness of the message multiset by\n definition while we do not do so. In \\isb{FiniteMessages}\n We prove the finiteness to follow from the assumption that only\n finitely many messages can be sent at once.\n\\\n\nrecord ('p, 'v, 's) configuration =\n states :: \"'p \\ 's\"\n msgs :: \"(('p, 'v) message) multiset\"\n\ntext \\\n C.f. Völzer: \\textquote{A step is identified with a message $(p, m)$. A step $(p, m)$ is enabled\n in a configuration c if $\\var{msgs}_c$ contains the message $(p, m)$.}\n\\\n\ndefinition enabled ::\n \"('p, 'v, 's) configuration \\ ('p, 'v) message \\ bool\"\nwhere \n \"enabled cfg msg \\ (msg \\# msgs cfg)\"\n\nsubsection \\The system locale\\\n\ntext \\\n The locale describing a system is derived by slight refactoring from the\n following passage of Völzer:\n \\begin{displayquote}\n A process $p$ consists of an initial state $s_p \\in S$ and a step transition\n function, which assigns to each pair $(m, s)$ of a message value $m$ and\n a process state $s$ a follower state and a finite set of messages (the\n messages to be sent by $p$ in a step).\n \\end{displayquote}\n\\\n\nlocale asynchronousSystem =\nfixes \n trans :: \"'p \\ 's \\ 'v messageValue \\ 's\" and\n sends :: \"'p \\ 's \\ 'v messageValue \\ ('p, 'v) message multiset\" and\n start :: \"'p \\ 's\"\nbegin\n\nabbreviation Proc :: \"'p set\"\nwhere \"Proc \\ (UNIV :: 'p set)\"\n\nsubsection \\The step relation\\\n\ntext \\\n The step relation is defined analogously to Völzer:\n \\begin{displayquote}\n {[}If enabled, a step may{]} occur, resulting in a follower\n configuration $c^\\prime$, where $c^\\prime$ is obtained from $c$ by removing\n $(p, m)$ from $\\var{msgs}_c$, changing $p$'s state and adding the set of\n messages to $\\var{msgs}_c$ according to the step transition function\n associated with $p$. We denote this by $c \\xrightarrow{p,m} c^\\prime$.\n \\end{displayquote}\n There are no steps consuming output messages.\n\\\n\nprimrec steps :: \n \"('p, 'v, 's) configuration\n \\ ('p, 'v) message\n \\ ('p, 'v, 's) configuration\n \\ bool\"\n (\"_ \\ _ \\ _\" [70,70,70])\nwhere \n StepInMsg: \"cfg1 \\ \\ cfg2 = (\n (\\ s. ((s = p) \\ states cfg2 p = trans p (states cfg1 p) (Bool v))\n \\ ((s \\ p) \\ states cfg2 s = states cfg1 s))\n \\ enabled cfg1 \n \\ msgs cfg2 = (sends p (states cfg1 p) (Bool v)\n \\# (msgs cfg1 -# )))\"\n| StepMsg: \"cfg1 \\ \\ cfg2 = (\n (\\ s. ((s = p) \\ states cfg2 p = trans p (states cfg1 p) (Value v))\n \\ ((s \\ p) \\ states cfg2 s = states cfg1 s))\n \\ enabled cfg1 \n \\ msgs cfg2 = (sends p (states cfg1 p) (Value v)\n \\# (msgs cfg1 -# )))\"\n| StepOutMsg: \"cfg1 \\ <\\,outM v> \\ cfg2 = \n False\"\n\ntext \\\n The system is distributed and asynchronous in the sense that the processing\n of messages only affects the process the message is directed to while the\n rest stays unchanged.\n\\\nlemma NoReceivingNoChange:\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n m :: \"('p,'v) message\" and\n p :: 'p\nassumes\n Step: \"cfg1 \\ m \\ cfg2\" and\n Rec: \"\\ isReceiverOf p m\"\nshows\n \"states cfg1 p = states cfg2 p \"\nproof(cases m)\n case (OutMsg b')\n thus ?thesis using Step by auto\nnext\n case (InMsg q b')\n assume CaseM: \"m = \"\n with assms have \"p \\ q\" by simp\n with Step CaseM show ?thesis by simp\nnext\n case (Msg q v')\n assume CaseM: \"m = \"\n with assms have \"p \\ q\" by simp\n with Step CaseM show ?thesis by simp\nqed\n\nlemma ExistsMsg:\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n m :: \"('p,'v) message\"\nassumes\n Step: \"cfg1 \\ m \\ cfg2\"\nshows\n \"m \\# (msgs cfg1)\"\nusing assms enabled_def by (cases m, auto)\n\nlemma NoMessageLossStep:\nfixes\n cfg1 :: \"('p,'v,'s) configuration\" and\n cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n m :: \"('p,'v) message\" and\n m' :: \"('p,'v) message\"\nassumes\n Step: \"cfg1 \\ m \\ cfg2\" and\n Rec1: \"isReceiverOf p m\" and\n Rec2: \"\\isReceiverOf p m'\"\nshows \n \"msgs cfg1 m' \\ msgs cfg2 m'\"\nusing assms by (induct m, simp_all, auto)\n\nlemma OutOnlyGrowing:\nfixes \n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n b::bool and\n m::\"('p, 'v) message\" and\n p::'p\nassumes\n \"cfg1 \\ m \\ cfg2\"\n \"isReceiverOf p m\"\nshows \n \"msgs cfg2 <\\, outM b> \n = (msgs cfg1 <\\, outM b>) + \n sends p (states cfg1 p) (unpackMessage m) <\\, outM b>\" \nproof(-)\n have \"m = <\\, outM b> \\ False\" using assms proof(auto) qed\n hence MNotOut: \"m \\ <\\, outM b>\" by auto\n have MsgFunction: \"msgs cfg2 \n = ((sends p (states cfg1 p) (unpackMessage m)) \n \\# ((msgs cfg1) -# m))\"\n proof(cases m) \n case (InMsg pa bool)\n then have PaIsP: \"pa = p\" \"(unpackMessage m) = Bool bool\" \n using isReceiverOf_def assms(2) by (auto simp add: UniqueReceiverOf)\n hence \"cfg1 \\ \\ cfg2\" using assms(1) InMsg by simp\n hence \"msgs cfg2 = (sends p (states cfg1 p) (Bool bool) \n \\# (msgs cfg1 -# ))\" \n by simp\n hence \"msgs cfg2 = (sends p (states cfg1 p) (Bool bool) \n \\# (msgs cfg1 -# m))\" \n using PaIsP(1) InMsg by simp\n thus ?thesis using StepInMsg assms PaIsP by simp\n next case (OutMsg b)\n hence False using assms by auto\n thus ?thesis by simp\n next case (Msg pa va)\n hence PaIsP: \"pa = p\" \"(unpackMessage m) = Value va\" \n using isReceiverOf_def assms(2) by (auto simp add: UniqueReceiverOf)\n hence \"cfg1 \\ \\ cfg2\" using assms(1) Msg by simp\n hence \"msgs cfg2 = (sends p (states cfg1 p) (Value va) \n \\# (msgs cfg1 -# ))\" by simp\n hence \"msgs cfg2 = (sends p (states cfg1 p) (Value va) \n \\# (msgs cfg1 -# m))\" \n using PaIsP(1) Msg by simp\n thus ?thesis using StepInMsg assms PaIsP by simp\n qed\n have \"((sends p (states cfg1 p) (unpackMessage m)) \n \\# ((msgs cfg1) -# m)) <\\, outM b> \n = ((sends p (states cfg1 p) (unpackMessage m)) \n \\# (msgs cfg1)) <\\, outM b>\"\n using MNotOut by auto\n thus \"msgs cfg2 <\\, outM b> \n = (msgs cfg1 <\\, outM b>) + \n sends p (states cfg1 p) (unpackMessage m) <\\, outM b>\" \n using MsgFunction by simp\nqed\n\nlemma OtherMessagesOnlyGrowing:\nfixes\n cfg1 :: \"('p,'v,'s) configuration\" and\n cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n m :: \"('p,'v) message\" and\n m' :: \"('p,'v) message\"\nassumes\n Step: \"cfg1 \\ m \\ cfg2\" and\n \"m \\ m'\"\nshows\n \"msgs cfg1 m' \\ msgs cfg2 m'\"\nusing assms by (cases m, auto)\n\ntext \\\n Völzer: \\textquote{Note that steps are enabled persistently, i.e., an\n enabled step remains enabled as long as it does not occur.}\n\\\nlemma OnlyOccurenceDisables:\nfixes\n cfg1 :: \"('p,'v,'s) configuration\" and\n cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n m :: \"('p,'v) message\" and\n m' :: \"('p,'v) message\"\nassumes\n Step: \"cfg1 \\ m \\ cfg2\" and\n En: \"enabled cfg1 m'\" and\n NotEn: \"\\ (enabled cfg2 m')\"\nshows\n \"m = m'\"\nusing assms proof (cases m) print_cases\n case (InMsg p bool)\n with Step have \"msgs cfg2 = (sends p (states cfg1 p) (Bool bool) \n \\# (msgs cfg1 -# ))\" by auto\n thus \"m = m'\" using InMsg En NotEn \n by (auto simp add: enabled_def, metis less_nat_zero_code)\nnext\n case (OutMsg bool)\n with Step show \"m = m'\" by auto\nnext\n case (Msg p v)\n with Step have \"msgs cfg2 = (sends p (states cfg1 p) (Value v) \n \\# (msgs cfg1 -# ))\" by auto\n thus \"m = m'\" using Msg En NotEn \n by (auto simp add: enabled_def, metis less_nat_zero_code)\nqed\n\nsubsection \\Reachability\\\n\ninductive reachable :: \n \" ('p, 'v, 's) configuration \n \\ ('p, 'v, 's) configuration\n \\ bool\"\nwhere \n init: \"reachable cfg1 cfg1\"\n| step: \"\\ reachable cfg1 cfg2; (cfg2 \\ msg \\ cfg3) \\ \n \\ reachable cfg1 cfg3\"\n\nlemma ReachableStepFirst: \nassumes\n \"reachable cfg cfg'\"\nshows \n \"cfg = cfg' \\ (\\ cfg1 msg p . (cfg \\ msg \\ cfg1) \\ enabled cfg msg \n \\ isReceiverOf p msg \n \\ reachable cfg1 cfg')\" \nusing assms \nby (induct rule: reachable.induct, auto, \n metis StepOutMsg ExistsMsg init enabled_def isReceiverOf.simps(1) \n isReceiverOf.simps(2) message.exhaust, metis asynchronousSystem.step)\n\nlemma ReachableTrans: \nfixes \n cfg1 cfg2 cfg3 :: \"('p, 'v, 's ) configuration\" and \n Q :: \" 'p set\"\nassumes \n \"reachable cfg1 cfg2\" and \n \"reachable cfg2 cfg3\"\nshows \"reachable cfg1 cfg3\"\nproof - \n have \"reachable cfg2 cfg3 \\ reachable cfg1 cfg2 \\ reachable cfg1 cfg3\" \n proof (induct rule: reachable.induct, auto)\n fix cfg1' cfg2' msg cfg3'\n assume \n \"reachable cfg1 cfg2'\"\n \"cfg2' \\ msg \\ cfg3'\"\n thus \"reachable cfg1 cfg3'\" using reachable.simps by metis\n qed\n thus ?thesis using assms by simp\nqed\n\ndefinition stepReachable ::\n \"('p, 'v, 's) configuration\n \\ ('p ,'v) message\n \\ ('p, 'v, 's) configuration\n \\ bool\" \nwhere\n \"stepReachable c1 msg c2 \\ \n \\ c' c''. reachable c1 c' \\ (c' \\ msg \\ c'') \\ reachable c'' c2 \"\n\nlemma StepReachable:\nfixes\n cfg cfg' :: \"('p,'v,'s) configuration\" and\n msg :: \"('p, 'v) message\"\nassumes\n \"reachable cfg cfg'\" and\n \"enabled cfg msg\" and\n \"\\ (enabled cfg' msg)\"\nshows \"stepReachable cfg msg cfg'\" \nusing assms\nproof(induct rule: reachable.induct, simp)\n fix cfg1 cfg2 msga cfg3\n assume Step: \"cfg2 \\ msga \\ cfg3\" and\n ReachCfg1Cfg2: \"reachable cfg1 cfg2\" and\n IV: \"(enabled cfg1 msg \\ \\ enabled cfg2 msg \n \\ stepReachable cfg1 msg cfg2)\" and\n AssumpInduct: \"enabled cfg1 msg\" \"\\ enabled cfg3 msg\"\n have ReachCfg2Cfg3: \"reachable cfg2 cfg3\" using Step \n by (metis reachable.init reachable.step)\n show \"stepReachable cfg1 msg cfg3\" \n proof (cases \"enabled cfg2 msg\")\n assume AssumpEnabled: \"enabled cfg2 msg\"\n hence \"msga = msg\" using OnlyOccurenceDisables Step AssumpInduct(2) by blast\n thus \"stepReachable cfg1 msg cfg3\" using ReachCfg1Cfg2 Step \n unfolding stepReachable_def by (metis init)\n next\n assume AssumpNotEnabled: \"\\ enabled cfg2 msg\"\n hence \"stepReachable cfg1 msg cfg2\" using IV AssumpInduct(1) by simp\n thus \"stepReachable cfg1 msg cfg3\"\n using ReachCfg2Cfg3 ReachableTrans asynchronousSystem.stepReachable_def\n by blast\n qed\nqed\n\nsubsection \\Reachability with special process activity\\\n\ntext \\\n We say that \\isb{qReachable cfg1 Q cfg2} iff cfg2 is reachable from cfg1\n only by activity of processes from Q.\n\\\ninductive qReachable ::\n \"('p,'v,'s) configuration \n \\ 'p set \n \\ ('p,'v,'s) configuration \n \\ bool\"\nwhere \n InitQ: \"qReachable cfg1 Q cfg1\"\n| StepQ: \"\\ qReachable cfg1 Q cfg2; (cfg2 \\ msg \\ cfg3) ;\n \\ p \\ Q . isReceiverOf p msg \\ \n \\ qReachable cfg1 Q cfg3\"\n\ntext \\\n We say that \\isb{withoutQReachable cfg1 Q cfg2} iff cfg2 is reachable from cfg1\n with no activity of processes from Q.\n\\\nabbreviation withoutQReachable ::\n \"('p,'v,'s) configuration \n \\ 'p set \n \\ ('p,'v,'s) configuration \n \\ bool\"\nwhere\n \"withoutQReachable cfg1 Q cfg2 \\ \n qReachable cfg1 ((UNIV :: 'p set ) - Q) cfg2\"\n\ntext\\\n Obviously q-reachability (and thus also without-q-reachability) implies \n reachability.\n\\\nlemma QReachImplReach:\nfixes\n cfg1 cfg2:: \"('p, 'v, 's ) configuration\" and\n Q :: \" 'p set\"\nassumes\n \"qReachable cfg1 Q cfg2\"\nshows \n \"reachable cfg1 cfg2\"\nusing assms \nproof (induct rule: qReachable.induct)\n case InitQ thus ?case using reachable.simps by blast\nnext\n case StepQ thus ?case using reachable.step by simp\nqed\n\nlemma QReachableTrans: \nfixes cfg1 cfg2 cfg3 :: \"('p, 'v, 's ) configuration\" and\n Q :: \" 'p set\"\nassumes \"qReachable cfg2 Q cfg3\" and\n \"qReachable cfg1 Q cfg2\"\nshows \"qReachable cfg1 Q cfg3\"\nusing assms\nproof (induct rule: qReachable.induct, simp)\n case (StepQ)\n thus ?case using qReachable.simps by metis\nqed\n\nlemma NotInQFrozenQReachability: \nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n Q :: \"'p set\"\nassumes\n \"qReachable cfg1 Q cfg2\" and\n \"p \\ Q\"\nshows\n \"states cfg1 p = states cfg2 p\"\nusing assms \nproof(induct rule: qReachable.induct, auto)\n fix cfg1' Q' cfg2' msg cfg3 p'\n assume \"qReachable cfg1' Q' cfg2'\"\n assume Step: \"cfg2' \\ msg \\ cfg3\"\n assume Rec: \"isReceiverOf p' msg\"\n assume \"p' \\ Q'\" \"p \\ Q'\"\n hence notEq: \"p \\ p'\" by blast\n with Rec have \"\\ (isReceiverOf p msg)\" by (cases msg, simp_all)\n thus \"states cfg2' p = states cfg3 p\"\n using Step NoReceivingNoChange by simp\nqed\n\ncorollary WithoutQReachablFrozenQ:\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n Q :: \"'p set\"\nassumes\n Steps: \"withoutQReachable cfg1 Q cfg2\" and\n P: \"p \\ Q\"\nshows\n \"states cfg1 p = states cfg2 p\"\nusing assms NotInQFrozenQReachability by simp\n\nlemma NoActivityNoMessageLoss :\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n Q :: \"'p set\" and\n m' :: \"('p, 'v) message\"\nassumes\n \"qReachable cfg1 Q cfg2\" and\n \"p \\ Q\" and\n \"isReceiverOf p m'\"\nshows\n \"(msgs cfg1 m') \\ (msgs cfg2 m')\"\nusing assms\nproof (induct rule: qReachable.induct, simp)\n case (StepQ cfg1' Q' cfg2' msg cfg3)\n then obtain p' where\n P': \"p' \\ Q'\" \"isReceiverOf p' msg\" \"p \\ p'\" by blast\n with assms(3) have \"\\(isReceiverOf p' m')\" \n by (cases m', simp_all)\n with NoMessageLossStep StepQ(3) P'\n have \"msgs cfg2' m' \\ msgs cfg3 m'\" \n by simp\n with StepQ\n show \"msgs cfg1' m' \\ msgs cfg3 m'\" by simp\nqed\n\nlemma NoMessageLoss:\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n p :: 'p and\n Q :: \"'p set\" and\n m' :: \"('p, 'v) message\"\nassumes\n \"withoutQReachable cfg1 Q cfg2\" and\n \"p \\ Q\" and\n \"isReceiverOf p m'\"\nshows\n \"(msgs cfg1 m') \\ (msgs cfg2 m')\" \nusing assms NoActivityNoMessageLoss by simp\n\nlemma NoOutMessageLoss:\nfixes\n cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n v :: bool\nassumes\n \"reachable cfg1 cfg2\"\nshows\n \"(msgs cfg1 <\\, outM v>) \\ (msgs cfg2 <\\, outM v>)\"\nusing assms \nproof(induct rule: reachable.induct, auto)\n fix cfg1 cfg' msg cfg2\n assume AssInduct:\n \"reachable cfg1 cfg'\"\n \"msgs cfg1 <\\, outM v> \\ msgs cfg' <\\, outM v>\" \n \"cfg' \\ msg \\ cfg2\"\n from AssInduct(3) have \"msgs cfg' <\\, outM v> \\ msgs cfg2 <\\, outM v>\" \n by (cases msg, auto)\n with AssInduct(2) show \" msgs cfg1 <\\, outM v> \\ msgs cfg2 <\\, outM v>\"\n using le_trans by blast\nqed \n\nlemma StillEnabled:\nfixes \n cfg1 cfg2:: \"('p,'v,'s) configuration\" and\n p :: 'p and\n msg :: \"('p,'v) message\" and\n Q :: \"'p set\"\nassumes \n \"withoutQReachable cfg1 Q cfg2\" and\n \"p \\ Q\" and\n \"isReceiverOf p msg\" and\n \"enabled cfg1 msg\"\nshows\n \"enabled cfg2 msg\"\nusing assms enabled_def NoMessageLoss \n by (metis le_0_eq neq0_conv)\n\nsubsection\\Initial reachability\\\n\ndefinition initial :: \n \"('p, 'v, 's) configuration \\ bool\"\nwhere\n \"initial cfg \\\n (\\ p::'p . (\\ v::bool . ((msgs cfg ()) = 1)))\n \\ (\\ p m1 m2 . ((m1 \\# (msgs cfg)) \\ (m2 \\# (msgs cfg)) \n \\ isReceiverOf p m1 \\ isReceiverOf p m2) \\ (m1 = m2))\n \\ (\\ v::bool . (msgs cfg) (<\\, outM v>) = 0)\n \\ (\\ p v. (msgs cfg) () = 0)\n \\ states cfg = start\"\n\ndefinition initReachable ::\n \"('p, 'v, 's) configuration \\ bool\"\nwhere\n \"initReachable cfg \\ \\cfg0 . initial cfg0 \\ reachable cfg0 cfg\"\n\nlemma InitialIsInitReachable :\nassumes \"initial c\"\nshows \"initReachable c\"\n using assms reachable.init\n unfolding initReachable_def by blast\n\nsubsection \\Diamond property of reachability\\\n\nlemma DiamondOne:\nfixes\n cfg cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n p q :: 'p and\n m m' :: \"('p,'v) message\"\nassumes\n StepP: \"cfg \\ m \\ cfg1\" and\n PNotQ: \"p \\ q\" and\n Rec: \"isReceiverOf p m\" \"\\ (isReceiverOf p m')\" and\n Rec': \"isReceiverOf q m'\" \"\\ (isReceiverOf q m)\" and\n StepWithoutP: \"cfg \\ m' \\ cfg2\"\nshows\n \"\\ cfg' :: ('p,'v,'s) configuration . (cfg1 \\ m' \\ cfg')\n \\ (cfg2 \\ m \\ cfg')\"\nproof (cases m)\n case (InMsg p b)\n from StepWithoutP ExistsMsg have \" m' \\# (msgs cfg) \" by simp \n hence \"m' \\# (msgs cfg1)\" \n using StepP Rec NoMessageLossStep le_neq_implies_less le_antisym \n by (metis gr_implies_not0 neq0_conv)\n hence EnM': \"enabled cfg1 m'\" using enabled_def by auto\n from StepP ExistsMsg have \"m \\# (msgs cfg) \" by simp\n hence \"m \\# (msgs cfg2)\"\n using StepWithoutP Rec' NoMessageLossStep\n by (metis le_0_eq neq0_conv)\n hence EnM: \"enabled cfg2 m\" using enabled_def by auto\n assume CaseM: \"m = \"\n \n thus ?thesis \n proof (cases m') \n case (OutMsg b')\n thus ?thesis using StepWithoutP by simp\n next\n case (InMsg q b')\n define cfg' where \"cfg' = \\states = \\s. (\n if s = q then\n trans q (states cfg q) (Bool b')\n else if s = p then\n trans p (states cfg p) (Bool b)\n else\n states cfg s),\n msgs = ((sends q (states cfg q) (Bool b')) \n \\# (((sends p (states cfg p) (Bool b))\n \\# ((msgs cfg)-# m)) -# m'))\\ \"\n have StepP': \"(cfg1 \\ m' \\ cfg')\"\n using StepP EnM' Rec\n unfolding cfg'_def InMsg CaseM by auto\n moreover from EnM have \"(cfg2 \\ m \\ cfg')\"\n using InMsg cfg'_def StepP StepP' StepWithoutP NoReceivingNoChange \n Rec' CaseM EnM'\n proof (simp, clarify)\n assume msgCfg:\n \"msgs cfg1 = (sends p (states cfg p) (Bool b) \n \\# (msgs cfg -# ))\"\n \"msgs cfg2 = (sends q (states cfg q) (Bool b') \n \\# (msgs cfg -# ))\"\n have \"enabled cfg m\" \"enabled cfg m'\" \n using StepP StepWithoutP CaseM InMsg \n by auto\n with msgCfg show \n \"(sends q (states cfg q) (Bool b') \\# (msgs cfg1 -# )) =\n (sends p (states cfg p) (Bool b) \\# (msgs cfg2 -# ))\"\n using CaseM InMsg StepP StepWithoutP Rec' AXc[of \"m'\" \"m\" \"msgs cfg\"\n \"sends q (states cfg q) (Bool b')\" \n \"sends p (states cfg p) (Bool b)\"] \n unfolding enabled_def\n by metis\n qed\n ultimately show ?thesis by blast\n next\n case (Msg q v')\n define cfg' where \"cfg' = \\states = \\s. (\n if s = q then\n trans q (states cfg q) (Value v')\n else if s = p then\n trans p (states cfg p) (Bool b)\n else\n states cfg s),\n msgs = ((sends q (states cfg q) (Value v')) \n \\# (((sends p (states cfg p) (Bool b))\n \\# ((msgs cfg)-# m))\n -# m'))\\\"\n have StepP': \"(cfg1 \\ m' \\ cfg')\"\n using StepP EnM' Rec\n unfolding Msg CaseM cfg'_def by auto\n\n moreover from EnM have \"(cfg2 \\ m \\ cfg')\"\n using Msg cfg'_def StepP StepP' StepWithoutP NoReceivingNoChange Rec' CaseM EnM'\n proof (simp,clarify) \n assume msgCfg1:\n \"msgs cfg1 = (sends p (states cfg p) (Bool b) \n \\# (msgs cfg -# ))\"\n \"msgs cfg2 = (sends q (states cfg q) (Value v') \n \\# (msgs cfg -# ))\" \n have \"enabled cfg m\" \"enabled cfg m'\" \n using StepP StepWithoutP CaseM Msg \n by auto\n with msgCfg1 show \n \"(sends q (states cfg q) (Value v') \\# (msgs cfg1 -# )) =\n (sends p (states cfg p) (Bool b) \\# (msgs cfg2 -# ))\"\n using CaseM Msg StepP StepWithoutP Rec' AXc[of \"m'\" \"m\" \"msgs cfg\"\n \"sends q (states cfg q) (Value v')\" \n \"sends p (states cfg p) (Bool b)\"]\n unfolding enabled_def by metis\n qed\n ultimately show ?thesis by blast\n qed\nnext\n case (OutMsg b)\n thus ?thesis using StepP by simp\nnext\n case (Msg p v)\n from StepWithoutP ExistsMsg have \" m' \\# (msgs cfg) \" by simp\n hence \"m' \\# (msgs cfg1)\" \n using StepP Rec NoMessageLossStep le_neq_implies_less le_antisym \n by (metis gr_implies_not0 neq0_conv)\n hence EnM': \"enabled cfg1 m'\" using enabled_def by auto\n from StepP ExistsMsg have \"m \\# (msgs cfg) \" by simp\n hence \"m \\# (msgs cfg2)\"\n using StepWithoutP Rec' NoMessageLossStep\n by (metis le_0_eq neq0_conv)\n hence EnM: \"enabled cfg2 m\" using enabled_def by auto\n assume CaseM: \"m = \" \n thus ?thesis \n proof (cases m')\n case (OutMsg b')\n thus ?thesis using StepWithoutP by simp\n next\n case (InMsg q b')\n define cfg' where \"cfg' = \\states = \\s. (\n if s = q then\n trans q (states cfg q) (Bool b')\n else if s = p then\n trans p (states cfg p) (Value v)\n else\n states cfg s),\n msgs = ((sends q (states cfg q) (Bool b')) \n \\# (((sends p (states cfg p) (Value v))\n \\# ((msgs cfg)-# m))\n -# m'))\\ \"\n hence StepP': \"(cfg1 \\ m' \\ cfg')\"\n using StepP InMsg EnM' Rec CaseM\n by auto\n moreover from EnM have \"(cfg2 \\ m \\ cfg')\"\n using InMsg cfg'_def StepP StepP' StepWithoutP NoReceivingNoChange Rec' \n CaseM EnM'\n proof (simp, clarify)\n assume msgCfg:\n \"msgs cfg1 = (sends p (states cfg p) (Value v)\n \\# (msgs cfg -# ))\"\n \"msgs cfg2 = (sends q (states cfg q) (Bool b')\n \\# (msgs cfg -# ))\"\n have \"enabled cfg m\" \"enabled cfg m'\"\n using StepP StepWithoutP CaseM InMsg by auto\n with msgCfg show \" (sends q (states cfg q) (Bool b') \n \\# (msgs cfg1 -# )) \n = (sends p (states cfg p) (Value v) \n \\# (msgs cfg2 -# ))\"\n using CaseM StepP StepWithoutP Rec' InMsg AXc[of \"m'\" \"m\" \"msgs cfg\"\n \"sends q (states cfg q) (Bool b')\"\n \"sends p (states cfg p) (Value v)\"]\n unfolding enabled_def by metis\n qed\n ultimately show ?thesis by blast\n next\n case (Msg q v')\n define cfg' where \"cfg' = \\states = \\s. (\n if s = q then\n trans q (states cfg q) (Value v')\n else if s = p then\n trans p (states cfg p) (Value v)\n else\n states cfg s),\n msgs = ((sends q (states cfg q) (Value v')) \n \\# (((sends p (states cfg p) (Value v))\n \\# ((msgs cfg)-# m))\n -# m'))\\ \"\n hence StepP': \"(cfg1 \\ m' \\ cfg')\"\n using StepP Msg EnM' Rec CaseM by auto\n moreover from EnM have \"(cfg2 \\ m \\ cfg')\"\n using Msg cfg'_def StepP StepP' StepWithoutP NoReceivingNoChange Rec' CaseM EnM'\n proof (simp, clarify)\n assume msgCfg:\n \"msgs cfg1 = (sends p (states cfg p) (Value v)\n \\# (msgs cfg -# ))\"\n \"msgs cfg2 = (sends q (states cfg q) (Value v')\n \\# (msgs cfg -# ))\"\n have \"enabled cfg m\" \"enabled cfg m'\"\n using StepP StepWithoutP CaseM Msg by auto\n\n with msgCfg show \" (sends q (states cfg q) (Value v') \n \\# (msgs cfg1 -# )) \n = (sends p (states cfg p) (Value v) \n \\# (msgs cfg2 -# ))\"\n using CaseM StepP StepWithoutP Rec' Msg \n AXc[of \"m'\" \"m\" \"msgs cfg\" \"sends q (states cfg q) (Value v')\"\n \"sends p (states cfg p) (Value v)\"]\n unfolding enabled_def by metis\n qed\n ultimately show ?thesis by blast \n qed\nqed\n\nlemma DiamondTwo:\nfixes\n cfg cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n Q :: \"'p set\" and\n msg :: \"('p, 'v) message\"\nassumes\n QReach: \"qReachable cfg Q cfg1\" and\n Step: \"cfg \\ msg \\ cfg2\"\n \"\\p\\Proc - Q. isReceiverOf p msg\"\nshows\n \"\\ (cfg' :: ('p,'v,'s) configuration) . (cfg1 \\ msg \\ cfg') \n \\ qReachable cfg2 Q cfg'\"\nusing assms \nproof(induct rule: qReachable.induct)\n fix cfg Q\n have \"qReachable cfg2 Q cfg2\" using qReachable.simps(1) by blast\n moreover assume \"cfg \\ msg \\ cfg2\" \"\\p\\UNIV - Q. isReceiverOf p msg\"\n ultimately have \"(cfg \\ msg \\ cfg2) \\ qReachable cfg2 Q cfg2\" by blast\n thus \"\\cfg'.(cfg \\ msg \\ cfg') \\ qReachable cfg2 Q cfg'\" by blast\nnext\n fix cfg Q cfg1' msga cfg1\n assume \"(cfg \\ msg \\ cfg2)\"\n \"(\\p\\UNIV - Q. isReceiverOf p msg)\"\n \"((cfg \\ msg \\ cfg2) \\\n (\\p\\UNIV - Q. isReceiverOf p msg) \\\n (\\cfg'. (cfg1' \\ msg \\ cfg') \\ qReachable cfg2 Q cfg'))\"\n hence \"(\\cfg'. (cfg1' \\ msg \\ cfg') \\ (\\p\\UNIV - Q. isReceiverOf p msg) \n \\ qReachable cfg2 Q cfg')\" by blast\n then obtain cfg' where Cfg': \"(cfg1' \\ msg \\ cfg')\" \n \"(\\p\\UNIV - Q. isReceiverOf p msg)\" \"qReachable cfg2 Q cfg'\" by blast\n then obtain p where P: \"p\\UNIV - Q\" \"isReceiverOf p msg\" by blast\n assume Step2: \"(cfg1' \\ msga \\ cfg1)\"\n \"(\\p\\Q. isReceiverOf p msga)\"\n \"(qReachable cfg Q cfg1')\"\n then obtain p' where P': \"p'\\Q\" \"isReceiverOf p' msga\" by blast\n from P'(1) P(1) have notEq: \"p \\ p'\" by blast\n with P(2) P'(2) have \"\\ isReceiverOf p' msg\" \"\\ isReceiverOf p msga\"\n using UniqueReceiverOf[of p' msga p] UniqueReceiverOf[of p msg p']\n by auto\n with notEq P'(2) P(2) Cfg'(1) Step2(1) have \n \"\\cfg''. (cfg' \\ msga \\ cfg'') \\ (cfg1 \\ msg \\ cfg'')\"\n using DiamondOne by simp\n then obtain cfg'' where Cfg'': \"cfg' \\ msga \\ cfg''\" \"cfg1 \\ msg \\ cfg''\" \n by blast\n from Cfg''(1) Step2(2) Cfg'(3) have \"qReachable cfg2 Q cfg''\" \n using qReachable.simps[of cfg2 Q cfg''] by auto\n with Cfg'(2) Cfg''(2) have \n \"(cfg1 \\ msg \\ cfg'') \\ qReachable cfg2 Q cfg''\" by simp\n thus \"\\cfg'. (cfg1 \\ msg \\ cfg') \\ qReachable cfg2 Q cfg'\" by blast \nqed\n\ntext \\Proposition 1 of Völzer.\\\nlemma Diamond:\nfixes\n cfg cfg1 cfg2 :: \"('p,'v,'s) configuration\" and\n Q :: \"'p set\"\nassumes\n QReach: \"qReachable cfg Q cfg1\" and\n WithoutQReach: \"withoutQReachable cfg Q cfg2\"\nshows \n \"\\ cfg'. withoutQReachable cfg1 Q cfg' \n \\ qReachable cfg2 Q cfg'\"\nproof -\n define notQ where \"notQ \\ UNIV - Q\"\n with WithoutQReach have \"qReachable cfg notQ cfg2\" by simp\n thus ?thesis using QReach notQ_def\n proof (induct rule: qReachable.induct)\n fix cfg2\n assume \"qReachable cfg2 Q cfg1\"\n moreover have \"qReachable cfg1 (UNIV - Q) cfg1\"\n using qReachable.simps by blast\n ultimately show \n \"\\cfg'. qReachable cfg1 (UNIV - Q) cfg' \n \\ qReachable cfg2 Q cfg'\" \n by blast\n next\n fix cfg cfg2' cfg2 msg\n assume Ass1: \" qReachable cfg Q cfg1\" \"qReachable cfg (UNIV - Q) cfg2' \" \n assume Ass2: \"cfg2' \\ msg \\ cfg2\" \"\\p\\UNIV - Q. isReceiverOf p msg\"\n assume \"qReachable cfg Q cfg1 \\ \\cfg'. qReachable cfg1 (UNIV - Q) cfg' \n \\ qReachable cfg2' Q cfg'\"\n with Ass1(1) have \"\\cfg'. qReachable cfg1 (UNIV - Q) cfg' \n \\ qReachable cfg2' Q cfg'\" by blast\n then obtain cfg' where \n Cfg'1: \"qReachable cfg2' Q cfg'\" and \n Cfg': \"qReachable cfg1 (UNIV - Q) cfg'\" by blast\n from Cfg'1 Ass2 have \n \"\\cfg''.(cfg' \\ msg \\ cfg'') \\ qReachable cfg2 Q cfg''\" \n using DiamondTwo by simp\n then obtain cfg'' where\n Cfg'': \"cfg' \\ msg \\ cfg''\" \"qReachable cfg2 Q cfg''\" by blast\n from Cfg' Cfg''(1) Ass2(2) have \"qReachable cfg1 (UNIV - Q) cfg''\" \n using qReachable.simps[of cfg1 \"UNIV-Q\" cfg''] by auto\n with Cfg'' show \n \"\\cfg'. qReachable cfg1 (UNIV - Q) cfg' \n \\ qReachable cfg2 Q cfg'\" by blast\n qed\nqed\n\nsubsection \\Invariant finite message count\\\n\nlemma FiniteMessages:\nfixes \n cfg :: \"('p, 'v, 's) configuration\"\nassumes\n FiniteProcs: \"finite Proc\" and\n FiniteSends: \"\\ p s m. finite {v. v \\# (sends p s m)}\" and\n InitReachable: \"initReachable cfg\"\nshows \"finite {msg . msg \\# msgs cfg}\"\nproof(-)\n have \"\\ init . initial init \\ reachable init cfg\" using assms \n unfolding initReachable_def by simp\n then obtain init where Init: \"initial init\" \"reachable init cfg\" \n by blast\n have InitMsgs:\"{msg . msg \\# msgs init} \n = { msg . (msg \\# msgs init) \\ (\\ p v. = msg)} \n \\ { msg . (msg \\# msgs init) \\ (\\ v. <\\, outM v> = msg)}\n \\ { msg . (msg \\# msgs init) \\ (\\ p v. = msg)}\" \n by (auto,metis message.exhaust)\n have A:\"{ msg . (msg \\# msgs init) \\ (\\ p v. = msg)} = {}\" \n using initial_def[of init] Init(1)by (auto, metis less_not_refl3)\n have B:\"{ msg . (msg \\# msgs init) \\ (\\ v. <\\, outM v> = msg)} = {}\" \n using initial_def[of init] Init(1) by (auto, metis less_not_refl3)\n have \"\\ p . finite {, }\" by auto\n moreover have SubsetMsg:\n \"\\ p. { msg . (msg \\# msgs init) \n \\ (\\ v::bool . = msg)} \n \\ {, }\" by auto\n ultimately have AllFinite:\n \"\\ p. finite { msg . (msg \\# msgs init) \n \\ (\\ v::bool . = msg)}\"\n using finite_subset by (clarify, auto)\n have \" { msg . (msg \\# msgs init) \n \\ (\\ p\\Proc . \\ v::bool. = msg)} \n = (\\ p \\ Proc . { msg . (msg \\# msgs init) \n \\ (\\ v::bool . = msg)})\" by auto\n hence \"finite { msg . (msg \\# msgs init) \n \\ (\\ p\\Proc . \\ v::bool. = msg)}\" \n using AllFinite FiniteProcs by auto\n hence InitFinite:\"finite {msg . msg \\# msgs init}\" \n by (auto simp add: A B InitMsgs) \n show ?thesis using Init(2) InitFinite\n proof(induct rule: reachable.induct, simp_all)\n fix cfg1 cfg2 msg cfg3\n assume assmsInduct:\"reachable cfg1 cfg2\" \n \"finite {msg. msg \\# msgs cfg2}\" \"cfg2 \\ msg \\ cfg3\" \n \"finite {msg. msg \\# msgs cfg1}\" \"reachable init cfg\" \n \"finite {msg. msg \\# msgs init}\"\n from assmsInduct(3) obtain p where \"isReceiverOf p msg \" \n by (metis StepOutMsg isReceiverOf.simps(1) isReceiverOf.simps(2) \n message.exhaust)\n hence \"msgs cfg3 = ((msgs cfg2 -# msg) \\# (sends p (states cfg2 p) \n (unpackMessage msg) ))\" \n using assmsInduct(3) by (cases msg, auto simp add: add.commute)\n hence MsgSet: \"{msg. msg \\# msgs cfg3 } \n = {m. m \\# ((msgs cfg2 -# msg) \\# (sends p (states cfg2 p) \n (unpackMessage msg) )) } \" by simp\n have \"{v. v \\# (msgs cfg2 -# msg)} \\ {msg. msg \\# msgs cfg2}\"\n by auto\n from finite_subset[OF this]\n have \"finite {v. (v \\# sends p (states cfg2 p) (unpackMessage msg))\n \\ (v \\# (msgs cfg2 -# msg))}\"\n using FiniteSends assmsInduct(2) by auto\n thus \"finite {msg. msg \\# msgs cfg3}\"\n unfolding MsgSet by auto\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/FLP/AsynchronousSystem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.28819909939536564}} {"text": "(*<*)\ntheory BTVSubstTypingL\n imports \"HOL-Eisbach.Eisbach_Tools\" ContextSubtypingL SubstMethods\nbegin\n (*>*)\n\nchapter \\Basic Type Variable Substitution Lemmas\\\ntext \\Lemmas that show that types are preserved, in some way, \nunder basic type variable substitution\\\n\nlemma subst_vv_subst_bb_commute:\n fixes bv::bv and b::b and x::x and v::v\n assumes \"atom bv \\ v\"\n shows \"(v'[x::=v]\\<^sub>v\\<^sub>v)[bv::=b]\\<^sub>v\\<^sub>b = (v'[bv::=b]\\<^sub>v\\<^sub>b)[x::=v]\\<^sub>v\\<^sub>v\" \n using assms proof(nominal_induct v' rule: v.strong_induct)\n case (V_lit x)\n then show ?case using subst_vb.simps subst_vv.simps by simp\nnext\n case (V_var y)\n hence \"v[bv::=b]\\<^sub>v\\<^sub>b=v\" using forget_subst subst_b_v_def by metis\n then show ?case unfolding subst_vb.simps(2) subst_vv.simps(2) using V_var by auto\nnext\n case (V_pair x1a x2a)\n then show ?case using subst_vb.simps subst_vv.simps by simp\nnext\n case (V_cons x1a x2a x3)\n then show ?case using subst_vb.simps subst_vv.simps by simp\nnext\n case (V_consp x1a x2a x3 x4)\n then show ?case using subst_vb.simps subst_vv.simps by simp\nqed\n\nlemma subst_cev_subst_bb_commute:\n fixes bv::bv and b::b and x::x and v::v\n assumes \"atom bv \\ v\"\n shows \"(ce[x::=v]\\<^sub>v)[bv::=b]\\<^sub>c\\<^sub>e\\<^sub>b = (ce[bv::=b]\\<^sub>c\\<^sub>e\\<^sub>b)[x::=v]\\<^sub>v\" \n using assms apply (nominal_induct ce rule: ce.strong_induct, (simp add: subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps))\n using assms subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps \n by (simp add: subst_v_ce_def)+\n\nlemma subst_cv_subst_bb_commute:\n fixes bv::bv and b::b and x::x and v::v\n assumes \"atom bv \\ v\"\n shows \"c[x::=v]\\<^sub>c\\<^sub>v[bv::=b]\\<^sub>c\\<^sub>b = (c[bv::=b]\\<^sub>c\\<^sub>b)[x::=v]\\<^sub>c\\<^sub>v\" \n using assms apply (nominal_induct c rule: c.strong_induct )\n using assms subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps \n subst_v_c_def subst_b_c_def apply auto\n using subst_cev_subst_bb_commute subst_v_ce_def by auto+\n\nlemma subst_b_c_of:\n \"(c_of \\ z)[bv::=b]\\<^sub>c\\<^sub>b = c_of (\\[bv::=b]\\<^sub>\\\\<^sub>b) z\"\nproof(nominal_induct \\ avoiding: z rule:\\.strong_induct)\n case (T_refined_type z' b' c')\n moreover have \"atom bv \\ [ z ]\\<^sup>v \" using fresh_at_base v.fresh by auto\n ultimately show ?case using subst_cv_subst_bb_commute[of bv \"V_var z\" c' z' b] c_of.simps subst_tb.simps by metis\nqed\n\nlemma subst_b_b_of:\n \"(b_of \\)[bv::=b]\\<^sub>b\\<^sub>b = b_of (\\[bv::=b]\\<^sub>\\\\<^sub>b)\"\n by(nominal_induct \\ rule:\\.strong_induct, simp add: b_of.simps subst_tb.simps )\n\nlemma subst_b_if:\n \"\\ z : b_of \\[bv::=b]\\<^sub>\\\\<^sub>b | CE_val (v[bv::=b]\\<^sub>v\\<^sub>b) == CE_val (V_lit ll) IMP c_of \\[bv::=b]\\<^sub>\\\\<^sub>b z \\ = \\ z : b_of \\ | CE_val (v) == CE_val (V_lit ll) IMP c_of \\ z \\[bv::=b]\\<^sub>\\\\<^sub>b \"\n unfolding subst_tb.simps subst_cb.simps subst_ceb.simps subst_vb.simps using subst_b_b_of subst_b_c_of by auto\n\nlemma subst_b_top_eq:\n \"\\ z : B_unit | TRUE \\[bv::=b]\\<^sub>\\\\<^sub>b = \\ z : B_unit | TRUE \\\" and \"\\ z : B_bool | TRUE \\[bv::=b]\\<^sub>\\\\<^sub>b = \\ z : B_bool | TRUE \\\" and \"\\ z : B_id tid | TRUE \\ = \\ z : B_id tid | TRUE \\[bv::=b]\\<^sub>\\\\<^sub>b\"\n unfolding subst_tb.simps subst_bb.simps subst_cb.simps by auto\n\nlemmas subst_b_eq = subst_b_c_of subst_b_b_of subst_b_if subst_b_top_eq\n\nlemma subst_cx_subst_bb_commute[simp]:\n fixes bv::bv and b::b and x::x and v'::c\n shows \"(v'[x::=V_var y]\\<^sub>c\\<^sub>v)[bv::=b]\\<^sub>c\\<^sub>b = (v'[bv::=b]\\<^sub>c\\<^sub>b)[x::=V_var y]\\<^sub>c\\<^sub>v\" \n using subst_cv_subst_bb_commute fresh_at_base v.fresh by auto\n\nlemma subst_b_infer_b:\n fixes l::l and b::b\n assumes \" \\ l \\ \\\" and \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\"\n shows \"\\ l \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" \n using assms infer_l_form3 infer_l_form4 wf_b_subst infer_l_wf subst_tb.simps base_for_lit.simps subst_tb.simps\n subst_b_base_for_lit subst_cb.simps(6) subst_ceb.simps(1) subst_vb.simps(1) subst_vb.simps(2) type_l_eq\n by metis\n\nlemma subst_b_subtype:\n fixes s::s and b'::b\n assumes \"\\ ; {|bv|} ; \\ \\ \\1 \\ \\2\" and \"\\ ; {||} \\\\<^sub>w\\<^sub>f b'\" and \"B = {|bv|}\" \n shows \"\\ ; {||} ; \\[bv::=b']\\<^sub>\\\\<^sub>b \\ \\1[bv::=b']\\<^sub>\\\\<^sub>b \\ \\2[bv::=b']\\<^sub>\\\\<^sub>b\"\n using assms proof(nominal_induct \"{|bv|}\" \\ \\1 \\2 rule:subtype.strong_induct)\n case (subtype_baseI x \\ \\ z c z' c' b)\n\n hence **: \"\\ ; {|bv|} ; (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v) #\\<^sub>\\ \\ \\ c'[z'::=V_var x]\\<^sub>c\\<^sub>v \" using validI subst_defs by metis\n\n have \"\\ ; {||} ; \\[bv::=b']\\<^sub>\\\\<^sub>b \\ \\ z : b[bv::=b']\\<^sub>b\\<^sub>b | c[bv::=b']\\<^sub>c\\<^sub>b \\ \\ \\ z' : b[bv::=b']\\<^sub>b\\<^sub>b | c'[bv::=b']\\<^sub>c\\<^sub>b \\\" proof(rule Typing.subtype_baseI)\n show \"\\ ; {||} ; \\[bv::=b']\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\ z : b[bv::=b']\\<^sub>b\\<^sub>b | c[bv::=b']\\<^sub>c\\<^sub>b \\ \" \n using subtype_baseI assms wf_b_subst(4) subst_tb.simps subst_defs by metis\n show \"\\ ; {||} ; \\[bv::=b']\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\ z' : b[bv::=b']\\<^sub>b\\<^sub>b | c'[bv::=b']\\<^sub>c\\<^sub>b \\ \" \n using subtype_baseI assms wf_b_subst(4) subst_tb.simps by metis\n show \"atom x \\(\\, {||}::bv fset, \\[bv::=b']\\<^sub>\\\\<^sub>b, z , c[bv::=b']\\<^sub>c\\<^sub>b , z' , c'[bv::=b']\\<^sub>c\\<^sub>b )\" \n apply(unfold fresh_prodN,auto simp add: * fresh_prodN fresh_empty_fset) \n using subst_b_fresh_x * fresh_prodN \\atom x \\ c\\ \\atom x \\ c'\\ subst_defs subtype_baseI by metis+\n have \"\\ ; {||} ; (x, b[bv::=b']\\<^sub>b\\<^sub>b, c[z::=V_var x]\\<^sub>v[bv::=b']\\<^sub>c\\<^sub>b) #\\<^sub>\\ \\[bv::=b']\\<^sub>\\\\<^sub>b \\ c'[z'::=V_var x]\\<^sub>v[bv::=b']\\<^sub>c\\<^sub>b\" \n using ** subst_b_valid subst_gb.simps assms subtype_baseI by metis\n thus \"\\ ; {||} ; (x, b[bv::=b']\\<^sub>b\\<^sub>b, (c[bv::=b']\\<^sub>c\\<^sub>b)[z::=V_var x]\\<^sub>v) #\\<^sub>\\ \\[bv::=b']\\<^sub>\\\\<^sub>b \\ (c'[bv::=b']\\<^sub>c\\<^sub>b)[z'::=V_var x]\\<^sub>v\" \n using subst_defs subst_cv_subst_bb_commute by (metis subst_cx_subst_bb_commute)\n qed\n thus ?case using subtype_baseI subst_tb.simps subst_defs by metis\nqed\n\nlemma b_of_subst_bv:\n \"(b_of \\)[x::=v]\\<^sub>b\\<^sub>b = b_of (\\[x::=v]\\<^sub>\\\\<^sub>b)\"\nproof -\n obtain z b c where *:\"\\ = \\ z : b | c \\ \\ atom z \\ (x,v)\" using obtain_fresh_z by metis\n thus ?thesis using subst_tv.simps * by auto \nqed\n\nlemma subst_b_infer_v:\n fixes v::v and b::b\n assumes \"\\ ; B ; G \\ v \\ \\\" and \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\"\n shows \"\\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" \n using assms proof(nominal_induct avoiding: b bv rule: infer_v.strong_induct)\n case (infer_v_varI \\ \\ \\ b' c x z)\n show ?case unfolding subst_b_simps proof\n show \"\\ ; {||} \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using infer_v_varI wf_b_subst by metis\n show \"Some (b'[bv::=b]\\<^sub>b\\<^sub>b, c[bv::=b]\\<^sub>c\\<^sub>b) = lookup \\[bv::=b]\\<^sub>\\\\<^sub>b x\" using subst_b_lookup infer_v_varI by metis\n show \"atom z \\ x\" using infer_v_varI by auto\n show \"atom z \\ (\\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b) \" by(fresh_mth add: infer_v_varI subst_b_fresh_x subst_b_\\_def fresh_prodN fresh_empty_fset )\n qed\nnext\n case (infer_v_litI \\ \\ \\ l \\)\n then show ?case using Typing.infer_v_litI subst_b_infer_b \n using wf_b_subst1(3) by auto\nnext\n case (infer_v_pairI z v1 v2 \\ \\ \\ t1 t2)\n show ?case unfolding subst_b_simps b_of_subst_bv proof\n show \"atom z \\ (v1[bv::=b]\\<^sub>v\\<^sub>b, v2[bv::=b]\\<^sub>v\\<^sub>b)\" by(fresh_mth add: infer_v_pairI subst_b_fresh_x)\n show \"atom z \\ (\\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b)\" by(fresh_mth add: infer_v_pairI subst_b_fresh_x subst_b_\\_def fresh_empty_fset)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ t1[bv::=b]\\<^sub>\\\\<^sub>b\" using infer_v_pairI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ t2[bv::=b]\\<^sub>\\\\<^sub>b\" using infer_v_pairI by auto\n qed\nnext\n case (infer_v_consI s dclist \\ dc tc \\ \\ v tv z)\n show ?case unfolding subst_b_simps b_of_subst_bv proof\n show \"AF_typedef s dclist \\ set \\\" using infer_v_consI by auto\n show \"(dc, tc) \\ set dclist\" using infer_v_consI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b\" using infer_v_consI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b \\ tc\" proof -\n have \"atom bv \\ tc\" using wfTh_lookup_supp_empty fresh_def infer_v_consI infer_v_wf by fast\n moreover have \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b \\ tc[bv::=b]\\<^sub>\\\\<^sub>b\" \n using subst_b_subtype infer_v_consI by simp \n ultimately show ?thesis using forget_subst subst_b_\\_def by metis\n qed\n show \"atom z \\ v[bv::=b]\\<^sub>v\\<^sub>b\" using infer_v_consI using subst_b_fresh_x subst_b_v_def by metis\n show \"atom z \\ (\\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b)\" by(fresh_mth add: infer_v_consI subst_b_fresh_x subst_b_\\_def fresh_empty_fset)\n qed\nnext\n case (infer_v_conspI s bv2 dclist2 \\ dc tc \\ \\ v tv ba z)\n\n have \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ V_consp s dc (ba[bv::=b]\\<^sub>b\\<^sub>b) (v[bv::=b]\\<^sub>v\\<^sub>b) \\ \\ z : B_app s (ba[bv::=b]\\<^sub>b\\<^sub>b) | [ [ z ]\\<^sup>v ]\\<^sup>c\\<^sup>e == [ V_consp s dc (ba[bv::=b]\\<^sub>b\\<^sub>b) (v[bv::=b]\\<^sub>v\\<^sub>b) ]\\<^sup>c\\<^sup>e \\\"\n proof(rule Typing.infer_v_conspI)\n show \"AF_typedef_poly s bv2 dclist2 \\ set \\\" using infer_v_conspI by auto\n show \"(dc, tc) \\ set dclist2\" using infer_v_conspI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b\" \n using infer_v_conspI subst_tb.simps by metis\n\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b \\ tc[bv2::=ba[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>\\\\<^sub>b\" proof -\n have \"supp tc \\ { atom bv2 }\" using infer_v_conspI wfTh_poly_lookup_supp wfX_wfY by metis\n moreover have \"bv2 \\ bv\" using \\atom bv2 \\ \\\\ \\\\ = {|bv|} \\ fresh_at_base fresh_def \n using fresh_finsert by fastforce\n ultimately have \"atom bv \\ tc\" unfolding fresh_def by auto\n hence \"tc[bv2::=ba[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>\\\\<^sub>b = tc[bv2::=ba]\\<^sub>\\\\<^sub>b[bv::=b]\\<^sub>\\\\<^sub>b\" \n using subst_tb_commute by metis\n moreover have \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ tv[bv::=b]\\<^sub>\\\\<^sub>b \\ tc[bv2::=ba]\\<^sub>\\\\<^sub>b[bv::=b]\\<^sub>\\\\<^sub>b\" \n using infer_v_conspI(7) subst_b_subtype infer_v_conspI by metis\n ultimately show ?thesis by auto\n qed \n show \"atom z \\ (\\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b, ba[bv::=b]\\<^sub>b\\<^sub>b)\" \n apply(unfold fresh_prodN, intro conjI, auto simp add: infer_v_conspI fresh_empty_fset)\n using \\atom z \\ \\\\ fresh_subst_if subst_b_\\_def x_fresh_b apply metis\n using \\atom z \\ v\\ fresh_subst_if subst_b_v_def x_fresh_b by metis\n show \"atom bv2 \\ (\\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b, ba[bv::=b]\\<^sub>b\\<^sub>b)\" \n apply(unfold fresh_prodN, intro conjI, auto simp add: infer_v_conspI fresh_empty_fset)\n using \\atom bv2 \\ b\\ \\atom bv2 \\ \\\\ fresh_subst_if subst_b_\\_def apply metis\n using \\atom bv2 \\ b\\ \\atom bv2 \\ v\\ fresh_subst_if subst_b_v_def apply metis\n using \\atom bv2 \\ b\\ \\atom bv2 \\ ba\\ fresh_subst_if subst_b_b_def by metis\n show \"\\ ; {||} \\\\<^sub>w\\<^sub>f ba[bv::=b]\\<^sub>b\\<^sub>b \" \n using infer_v_conspI wf_b_subst by metis\n qed\n thus ?case using subst_vb.simps subst_tb.simps subst_bb.simps by simp\n\nqed\n\nlemma subst_b_check_v:\n fixes v::v and b::b\n assumes \"\\ ; B ; G \\ v \\ \\\" and \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\"\n shows \"\\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" \nproof -\n obtain \\' where \"\\ ; B ; G \\ v \\ \\' \\ \\ ; B ; G \\ \\' \\ \\\" using check_v_elims[OF assms(1)] by metis\n thus ?thesis using subst_b_subtype subst_b_infer_v assms \n by (metis (no_types) check_v_subtypeI subst_b_infer_v subst_b_subtype)\nqed\n\nlemma subst_vv_subst_vb_switch:\n shows \"(v'[bv::=b']\\<^sub>v\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>v\\<^sub>v = v'[x::=v]\\<^sub>v\\<^sub>v[bv::=b']\\<^sub>v\\<^sub>b\"\nproof(nominal_induct v' rule:v.strong_induct)\n case (V_lit x)\n then show ?case using subst_vv.simps subst_vb.simps by auto\nnext\n case (V_var x)\n then show ?case using subst_vv.simps subst_vb.simps by auto\nnext\n case (V_pair x1a x2a)\n then show ?case using subst_vv.simps subst_vb.simps v.fresh by auto\nnext\n case (V_cons x1a x2a x3)\n then show ?case using subst_vv.simps subst_vb.simps v.fresh by auto\nnext\n case (V_consp x1a x2a x3 x4)\n then show ?case using subst_vv.simps subst_vb.simps v.fresh pure_fresh \n by (metis forget_subst subst_b_b_def)\nqed\n\nlemma subst_cev_subst_vb_switch:\n shows \"(ce[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>c\\<^sub>e\\<^sub>v = (ce[x::=v]\\<^sub>c\\<^sub>e\\<^sub>v)[bv::=b']\\<^sub>c\\<^sub>e\\<^sub>b\"\n by(nominal_induct ce rule:ce.strong_induct, auto simp add: subst_vv_subst_vb_switch ce.fresh)\n\nlemma subst_cv_subst_vb_switch:\n shows \"(c[bv::=b']\\<^sub>c\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>c\\<^sub>v = c[x::=v]\\<^sub>c\\<^sub>v[bv::=b']\\<^sub>c\\<^sub>b\"\n by(nominal_induct c rule:c.strong_induct, auto simp add: subst_cev_subst_vb_switch c.fresh)\n\nlemma subst_tv_subst_vb_switch:\n shows \"(\\[bv::=b']\\<^sub>\\\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>\\\\<^sub>v = \\[x::=v]\\<^sub>\\\\<^sub>v[bv::=b']\\<^sub>\\\\<^sub>b\"\nproof(nominal_induct \\ avoiding: x v rule:\\.strong_induct)\n case (T_refined_type z b c )\n hence ceq: \"(c[bv::=b']\\<^sub>c\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>c\\<^sub>v = c[x::=v]\\<^sub>c\\<^sub>v[bv::=b']\\<^sub>c\\<^sub>b\" using subst_cv_subst_vb_switch by auto\n\n moreover have \"atom z \\ v[bv::=b']\\<^sub>v\\<^sub>b\" using x_fresh_b fresh_subst_if subst_b_v_def T_refined_type by metis\n\n hence \"\\ z : b | c \\[bv::=b']\\<^sub>\\\\<^sub>b[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>\\\\<^sub>v = \\ z : b[bv::=b']\\<^sub>b\\<^sub>b | (c[bv::=b']\\<^sub>c\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>c\\<^sub>v \\\"\n using subst_tv.simps subst_tb.simps T_refined_type fresh_Pair by metis\n\n moreover have \"\\ z : b[bv::=b']\\<^sub>b\\<^sub>b | (c[bv::=b']\\<^sub>c\\<^sub>b)[x::=v[bv::=b']\\<^sub>v\\<^sub>b]\\<^sub>c\\<^sub>v \\ = \\ z : b | c[x::=v]\\<^sub>c\\<^sub>v \\[bv::=b']\\<^sub>\\\\<^sub>b\"\n using subst_tv.simps subst_tb.simps ceq \\.fresh forget_subst[of \"bv\" b b'] subst_b_b_def T_refined_type by metis\n\n ultimately show ?case using subst_tv.simps subst_tb.simps ceq T_refined_type by auto\nqed\n\nlemma subst_tb_triple:\n assumes \"atom bv \\ \\'\" \n shows \"\\'[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>\\\\<^sub>b[x'::=v'[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>\\\\<^sub>v = \\'[bv'::=b']\\<^sub>\\\\<^sub>b[x'::=v']\\<^sub>\\\\<^sub>v[bv::=b]\\<^sub>\\\\<^sub>b\" \nproof -\n have \"\\'[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>\\\\<^sub>b[x'::=v'[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>\\\\<^sub>v = \\'[bv'::=b']\\<^sub>\\\\<^sub>b[bv::=b]\\<^sub>\\\\<^sub>b [x'::=v'[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>\\\\<^sub>v\"\n using subst_tb_commute \\atom bv \\ \\'\\ by auto\n also have \"... = \\'[bv'::=b']\\<^sub>\\\\<^sub>b [x'::=v']\\<^sub>\\\\<^sub>v[bv::=b]\\<^sub>\\\\<^sub>b\" \n using subst_tv_subst_vb_switch by auto\n finally show ?thesis using fresh_subst_if forget_subst by auto\nqed\n\nlemma subst_b_infer_e:\n fixes s::s and b::b\n assumes \"\\ ; \\ ; B ; G; D \\ e \\ \\\" and \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\" \n shows \"\\ ; \\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b; D[bv::=b]\\<^sub>\\\\<^sub>b \\ (e[bv::=b]\\<^sub>e\\<^sub>b) \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" \n using assms proof(nominal_induct avoiding: b rule: infer_e.strong_induct)\n case (infer_e_valI \\ \\ \\ \\ \\ v \\)\n thus ?case using subst_eb.simps infer_e.intros wf_b_subst subst_db.simps wf_b_subst infer_v_wf subst_b_infer_v \n by (metis forget_subst ms_fresh_all(1) wfV_b_fresh)\nnext\n case (infer_e_plusI \\ \\ \\ \\ \\ v1 z1 c1 v2 z2 c2 z3)\n\n show ?case unfolding subst_b_simps subst_eb.simps proof(rule Typing.infer_e_plusI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_plusI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_plusI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z1 : B_int | c1[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_plusI subst_b_simps by force\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : B_int | c2[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_plusI subst_b_simps by force\n show \"atom z3 \\ AE_op Plus (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\" using subst_b_simps infer_e_plusI subst_b_fresh_x subst_b_e_def by metis\n show \"atom z3 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_plusI by auto\n qed\nnext\n case (infer_e_leqI \\ \\ \\ \\ \\ v1 z1 c1 v2 z2 c2 z3)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_leqI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_leqI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_leqI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z1 : B_int | c1[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_leqI subst_b_simps by force\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : B_int | c2[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_leqI subst_b_simps by force\n show \"atom z3 \\ AE_op LEq (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\" using subst_b_simps infer_e_leqI subst_b_fresh_x subst_b_e_def by metis\n show \"atom z3 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_leqI by auto\n qed\nnext\n case (infer_e_eqI \\ \\ \\ \\ \\ v1 z1 bb c1 v2 z2 c2 z3)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_eqI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_eqI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_eqI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z1 : bb[bv::=b]\\<^sub>b\\<^sub>b | c1[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_eqI subst_b_simps by force\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : bb[bv::=b]\\<^sub>b\\<^sub>b | c2[bv::=b]\\<^sub>c\\<^sub>b \\\" using subst_b_infer_v infer_e_eqI subst_b_simps by force\n show \"atom z3 \\ AE_op Eq (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\" using subst_b_simps infer_e_eqI subst_b_fresh_x subst_b_e_def by metis\n show \"atom z3 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_eqI by auto\n show \"bb[bv::=b]\\<^sub>b\\<^sub>b \\ {B_bool, B_int, B_unit}\" using infer_e_eqI by auto\n qed\nnext\n case (infer_e_appI \\ \\ \\ \\ \\ f x b' c \\' s' v \\)\n show ?case proof(subst subst_eb.simps, rule Typing.infer_e_appI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b\" using wf_b_subst(10) subst_db.simps infer_e_appI wfX_wfY by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_appI by auto\n show \"Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b' c \\' s'))) = lookup_fun \\ f\" using infer_e_appI by auto\n (*show \"\\ ; {||} ; (x, b', c) #\\<^sub>\\ GNil \\\\<^sub>w\\<^sub>f \\'\" using infer_e_appI sory*)\n have \"atom bv \\ b'\" using \\\\ \\\\<^sub>w\\<^sub>f \\ \\ infer_e_appI wfPhi_f_supp fresh_def[of \"atom bv\" b'] by simp\n hence \"b' = b'[bv::=b]\\<^sub>b\\<^sub>b\" using subst_b_simps \n using has_subst_b_class.forget_subst subst_b_b_def by force\n moreover have ceq:\"c = c[bv::=b]\\<^sub>c\\<^sub>b\" using subst_b_simps proof -\n have \"supp c \\ {atom x}\" using infer_e_appI wfPhi_f_simple_supp_c[OF _ \\\\ \\\\<^sub>w\\<^sub>f \\ \\] by simp\n hence \"atom bv \\ c\" using\n fresh_def[of \"atom bv\" c] \n using fresh_def fresh_finsert insert_absorb \n insert_subset ms_fresh_all supp_at_base x_not_in_b_set fresh_prodN by metis\n thus ?thesis \n using forget_subst subst_b_c_def fresh_def[of \"atom bv\" c] by metis \n qed \n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ x : b' | c \\\" \n using subst_b_check_v subst_tb.simps subst_vb.simps infer_e_appI \n proof -\n have \"\\ ; {|bv|} ; \\ \\ v \\ \\ x : b' | c \\\"\n by (metis \\\\ = {|bv|}\\ \\\\ ; \\ ; \\ \\ v \\ \\ x : b' | c \\\\) (* 0.0 ms *)\n then show ?thesis \n by (metis (no_types) \\\\ ; {||} \\\\<^sub>w\\<^sub>f b\\ \\b' = b'[bv::=b]\\<^sub>b\\<^sub>b\\ subst_b_check_v subst_tb.simps ceq) \n qed\n show \"atom x \\ (\\, \\, {||}::bv fset, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b)\"\n apply (fresh_mth add: fresh_prodN subst_g_b_x_fresh infer_e_appI )\n using subst_b_fresh_x infer_e_appI apply metis+\n done \n have \"supp \\' \\ { atom x }\" using wfPhi_f_simple_supp_t infer_e_appI by auto\n hence \"atom bv \\ \\'\" using fresh_def fresh_at_base by force\n then show \"\\'[x::=v[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>v = \\[bv::=b]\\<^sub>\\\\<^sub>b\" using infer_e_appI \n forget_subst subst_b_\\_def subst_tv_subst_vb_switch subst_defs by metis\n qed\nnext\n case (infer_e_appPI \\' \\ \\' \\ \\' b' f' bv' x' b1 c \\' s' v' \\1)\n\n have beq: \"b1[bv'::=b']\\<^sub>b\\<^sub>b[bv::=b]\\<^sub>b\\<^sub>b = b1[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b\\<^sub>b\" \n proof -\n have \"supp b1 \\ { atom bv' }\" using wfPhi_f_poly_supp_b infer_e_appPI \n using supp_at_base by blast\n moreover have \"bv \\ bv'\" using infer_e_appPI fresh_def supp_at_base \n by (simp add: fresh_def supp_at_base)\n ultimately have \"atom bv \\ b1\" using fresh_def fresh_at_base by force\n thus ?thesis by simp\n qed\n\n have ceq: \"(c[bv'::=b']\\<^sub>c\\<^sub>b)[bv::=b]\\<^sub>c\\<^sub>b = c[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>c\\<^sub>b\" proof -\n have \"supp c \\ { atom bv', atom x' }\" using wfPhi_f_poly_supp_c infer_e_appPI \n using supp_at_base by blast\n moreover have \"bv \\ bv'\" using infer_e_appPI fresh_def supp_at_base \n by (simp add: fresh_def supp_at_base)\n moreover have \"atom x' \\ atom bv\" by auto\n ultimately have \"atom bv \\ c\" using fresh_def[of \"atom bv\" c] fresh_at_base by auto\n thus ?thesis by simp\n qed\n\n show ?case proof(subst subst_eb.simps, rule Typing.infer_e_appPI)\n show \"\\' ; {||} ; \\'[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst subst_db.simps infer_e_appPI wfX_wfY by metis\n show \"\\' \\\\<^sub>w\\<^sub>f \\' \" using infer_e_appPI by auto\n show \"Some (AF_fundef f' (AF_fun_typ_some bv' (AF_fun_typ x' b1 c \\' s'))) = lookup_fun \\' f'\" using infer_e_appPI by auto\n thus \"\\' ; {||} ; \\'[bv::=b]\\<^sub>\\\\<^sub>b \\ v'[bv::=b]\\<^sub>v\\<^sub>b \\ \\ x' : b1[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b | c[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b \\\" \n using subst_b_check_v subst_tb.simps subst_b_simps infer_e_appPI \n proof -\n have \"\\' ; {||} ; \\'[bv::=b]\\<^sub>\\\\<^sub>b \\ v'[bv::=b]\\<^sub>v\\<^sub>b \\ \\ x' : b1[bv'::=b']\\<^sub>b[bv::=b]\\<^sub>b\\<^sub>b | (c[bv'::=b']\\<^sub>b)[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using infer_e_appPI subst_b_check_v subst_tb.simps by metis\n thus ?thesis using beq ceq subst_defs by metis\n qed\n show \"atom x' \\ \\'[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_appPI by auto\n show \"\\'[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b[x'::=v'[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>v = \\1[bv::=b]\\<^sub>\\\\<^sub>b\" proof - (* \\'[bv'::=b']\\<^sub>\\\\<^sub>b[x'::=v']\\<^sub>\\\\<^sub>v = \\1 *)\n\n have \"supp \\' \\ { atom x', atom bv' }\" using wfPhi_f_poly_supp_t infer_e_appPI by auto\n moreover hence \"bv \\ bv'\" using infer_e_appPI fresh_def supp_at_base \n by (simp add: fresh_def supp_at_base)\n ultimately have \"atom bv \\ \\'\" using fresh_def by force\n hence \"\\'[bv'::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b[x'::=v'[bv::=b]\\<^sub>v\\<^sub>b]\\<^sub>v = \\'[bv'::=b']\\<^sub>b[x'::=v']\\<^sub>v[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_tb_triple subst_defs by auto \n thus ?thesis using infer_e_appPI by metis\n qed\n show \"atom bv' \\ (\\', \\', {||}, \\'[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, b'[bv::=b]\\<^sub>b\\<^sub>b, v'[bv::=b]\\<^sub>v\\<^sub>b, \\1[bv::=b]\\<^sub>\\\\<^sub>b)\" \n unfolding fresh_prodN apply( auto simp add: infer_e_appPI fresh_empty_fset)\n using fresh_subst_if subst_b_\\_def subst_b_\\_def subst_b_b_def subst_b_v_def subst_b_\\_def infer_e_appPI by metis+\n show \"\\' ; {||} \\\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \" using infer_e_appPI wf_b_subst by simp\n qed\nnext\n case (infer_e_fstI \\ \\ \\ \\ \\ v z' b1 b2 c z)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_fstI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_fstI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_fstI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z' : B_pair b1[bv::=b]\\<^sub>b\\<^sub>b b2[bv::=b]\\<^sub>b\\<^sub>b | c[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_fstI by force\n show \"atom z \\ AE_fst (v[bv::=b]\\<^sub>v\\<^sub>b)\" using infer_e_fstI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \"atom z \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_fstI by auto\n qed\nnext\n case (infer_e_sndI \\ \\ \\ \\ \\ v z' b1 b2 c z)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_sndI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_sndI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_sndI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z' : B_pair b1[bv::=b]\\<^sub>b\\<^sub>b b2[bv::=b]\\<^sub>b\\<^sub>b | c[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_sndI by force\n show \"atom z \\ AE_snd (v[bv::=b]\\<^sub>v\\<^sub>b)\" using infer_e_sndI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \"atom z \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_sndI by auto\n qed\nnext\n case (infer_e_lenI \\ \\ \\ \\ \\ v z' c z)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_lenI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_lenI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_lenI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z' : B_bitvec | c[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_lenI by force\n show \"atom z \\ AE_len (v[bv::=b]\\<^sub>v\\<^sub>b)\" using infer_e_lenI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \"atom z \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_lenI by auto\n qed\nnext\n case (infer_e_mvarI \\ \\ \\ \\ \\ u \\)\n show ?case proof(subst subst subst_eb.simps, rule Typing.infer_e_mvarI)\n show \"\\ ; {||} \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using infer_e_mvarI wf_b_subst by auto\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_mvarI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using infer_e_mvarI using wf_b_subst(10) subst_db.simps infer_e_sndI wfX_wfY \n by (metis wf_b_subst(15))\n show \"(u, \\[bv::=b]\\<^sub>\\\\<^sub>b) \\ setD \\[bv::=b]\\<^sub>\\\\<^sub>b\" using infer_e_mvarI subst_db.simps set_insert \n subst_d_b_member by simp\n qed\nnext\n case (infer_e_concatI \\ \\ \\ \\ \\ v1 z1 c1 v2 z2 c2 z3)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_concatI)\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst(10) subst_db.simps infer_e_concatI wfX_wfY \n by (metis wf_b_subst(15))\n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using infer_e_concatI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z1 : B_bitvec | c1[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_concatI by force\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : B_bitvec | c2[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_concatI by force\n show \"atom z3 \\ AE_concat (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\" using infer_e_concatI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \"atom z3 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_g_b_x_fresh infer_e_concatI by auto\n qed\nnext\n case (infer_e_splitI \\ \\ \\ \\ \\ v1 z1 c1 v2 z2 z3)\n show ?case unfolding subst_b_simps proof(rule Typing.infer_e_splitI)\n show \\ \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \\ using wf_b_subst(10) subst_db.simps infer_e_splitI wfX_wfY \n by (metis wf_b_subst(15))\n show \\ \\ \\\\<^sub>w\\<^sub>f \\ \\ using infer_e_splitI by auto\n show \\ \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v1[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z1 : B_bitvec | c1[bv::=b]\\<^sub>c\\<^sub>b \\\\ \n using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_splitI by force\n show \\\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : B_int | [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ z2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e == [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e AND\n [ leq [ [ z2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [| [ v1[bv::=b]\\<^sub>v\\<^sub>b ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e == [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\\\ \n using subst_b_check_v subst_tb.simps subst_b_simps infer_e_splitI \n proof -\n have \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v2[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z2 : B_int | [ leq [ [ L_num 0 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [ [ z2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e == [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e AND [ leq [ [ z2 ]\\<^sup>v ]\\<^sup>c\\<^sup>e [| [ v1 ]\\<^sup>c\\<^sup>e |]\\<^sup>c\\<^sup>e ]\\<^sup>c\\<^sup>e == [ [ L_true ]\\<^sup>v ]\\<^sup>c\\<^sup>e \\[bv::=b]\\<^sub>\\\\<^sub>b\"\n using infer_e_splitI.hyps(7) infer_e_splitI.prems(1) infer_e_splitI.prems(2) subst_b_check_v by presburger (* 0.0 ms *)\n then show ?thesis\n by simp (* 0.0 ms *)\n qed\n show \\atom z1 \\ AE_split (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\\ using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \\atom z1 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\\ using subst_g_b_x_fresh infer_e_splitI by auto\n\n show \\atom z2 \\ AE_split (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\\ using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis\n\n show \\atom z2 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\\ using subst_g_b_x_fresh infer_e_splitI by auto\n show \\atom z3 \\ AE_split (v1[bv::=b]\\<^sub>v\\<^sub>b) (v2[bv::=b]\\<^sub>v\\<^sub>b)\\ using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis\n show \\atom z3 \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\\ using subst_g_b_x_fresh infer_e_splitI by auto\n qed\nqed\n\ntext \\This is needed for preservation. When we apply a function \"f [b] v\" we need to \nsubstitute into the body of the function f replacing type-variable with b\\\n\nlemma subst_b_c_of_forget:\n assumes \"atom bv \\ const\"\n shows \"(c_of const x)[bv::=b]\\<^sub>c\\<^sub>b = c_of const x\" \n using assms proof(nominal_induct const avoiding: x rule:\\.strong_induct)\n case (T_refined_type x' b' c')\n hence \"c_of \\ x' : b' | c' \\ x = c'[x'::=V_var x]\\<^sub>c\\<^sub>v\" using c_of.simps by metis\n moreover have \"atom bv \\ c'[x'::=V_var x]\\<^sub>c\\<^sub>v\" proof -\n have \"atom bv \\ c'\" using T_refined_type \\.fresh by simp\n moreover have \"atom bv \\ V_var x\" using v.fresh by simp\n ultimately show ?thesis \n using T_refined_type \\.fresh subst_b_c_def fresh_subst_if\n \\_fresh_c fresh_subst_cv_if has_subst_b_class.subst_b_fresh_x ms_fresh_all(37) ms_fresh_all assms by metis\n qed\n ultimately show ?case using forget_subst subst_b_c_def by metis\nqed\n\nlemma subst_b_check_s:\n fixes s::s and b::b and cs::branch_s and css::branch_list and v::v and \\::\\\n assumes \"\\ ; {||} \\\\<^sub>w\\<^sub>f b\" and \"B = {|bv|}\" (*and \"D = []\"*)\n shows \"\\ ; \\ ; B ; G; D \\ s \\ \\ \\ \\ ; \\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b; D[bv::=b]\\<^sub>\\\\<^sub>b \\ (s[bv::=b]\\<^sub>s\\<^sub>b) \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" and\n \"\\ ; \\ ; B ; G; D ; tid ; cons ; const ; v \\ cs \\ \\ \\ \\ ; \\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b; D[bv::=b]\\<^sub>\\\\<^sub>b ; tid ; cons ; const ; v[bv::=b]\\<^sub>v\\<^sub>b \\ (subst_branchb cs bv b) \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" and\n \"\\ ; \\ ; B ; G; D ; tid ; dclist ; v \\ css \\ \\ \\ \\ ; \\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b; D[bv::=b]\\<^sub>\\\\<^sub>b ; tid ; dclist ; v[bv::=b]\\<^sub>v\\<^sub>b \\ (subst_branchlb css bv b ) \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" \n using assms proof(induct rule: check_s_check_branch_s_check_branch_list.inducts)\n note facts = wfD_emptyI wfX_wfY wf_b_subst subst_b_subtype subst_b_infer_v\n case (check_valI \\ \\ \\ \\ \\ v \\' \\)\n show ?case \n apply(subst subst_sb.simps, rule Typing.check_valI) \n using facts check_valI apply metis\n using check_valI subst_b_infer_v wf_b_subst subst_b_subtype apply blast\n using check_valI subst_b_infer_v wf_b_subst subst_b_subtype apply blast \n using check_valI subst_b_infer_v wf_b_subst subst_b_subtype by metis\nnext\n case (check_letI x \\ \\ \\ \\ \\ e \\ z s b' c)\n show ?case proof(subst subst_sb.simps, rule Typing.check_letI) \n\n show \"atom x \\(\\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, e[bv::=b]\\<^sub>e\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b)\" (*using check_letI subst_b_\\_def subst_b_\\_def subst_b_fresh_x fresh_prod4 subst_b_c_def sory*)\n apply(unfold fresh_prodN,auto)\n apply(simp add: check_letI fresh_empty_fset)+\n apply(metis * subst_b_fresh_x check_letI fresh_prodN)+ done\n show \"atom z \\ (x, \\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, e[bv::=b]\\<^sub>e\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, s[bv::=b]\\<^sub>s\\<^sub>b)\" \n apply(unfold fresh_prodN,auto)\n apply(simp add: check_letI fresh_empty_fset)+\n apply(metis * subst_b_fresh_x check_letI fresh_prodN)+ done\n show \"\\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ e[bv::=b]\\<^sub>e\\<^sub>b \\ \\ z : b'[bv::=b]\\<^sub>b\\<^sub>b | c[bv::=b]\\<^sub>c\\<^sub>b \\\" \n using check_letI subst_b_infer_e subst_tb.simps by metis\n have \"c[z::=[ x ]\\<^sup>v]\\<^sub>c\\<^sub>v[bv::=b]\\<^sub>c\\<^sub>b = (c[bv::=b]\\<^sub>c\\<^sub>b)[z::=V_var x]\\<^sub>c\\<^sub>v\" \n using subst_cv_subst_bb_commute[of bv \"V_var x\" c z b] fresh_at_base by simp\n thus \"\\ ; \\ ; {||} ; ((x, b'[bv::=b]\\<^sub>b\\<^sub>b , (c[bv::=b]\\<^sub>c\\<^sub>b)[z::=V_var x]\\<^sub>v) #\\<^sub>\\ \\[bv::=b]\\<^sub>\\\\<^sub>b) ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s[bv::=b]\\<^sub>s\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" \n using check_letI subst_gb.simps subst_defs by metis\n qed\nnext\n case (check_assertI x \\ \\ \\ \\ \\ c \\ s)\n show ?case proof(subst subst_sb.simps, rule Typing.check_assertI)\n show \"atom x \\ (\\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, c[bv::=b]\\<^sub>c\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, s[bv::=b]\\<^sub>s\\<^sub>b)\" \n apply(unfold fresh_prodN,auto)\n apply(simp add: check_assertI fresh_empty_fset)+\n apply(metis * subst_b_fresh_x check_assertI fresh_prodN)+ done\n\n have \"\\ ; \\ ; {||} ; ((x, B_bool, c) #\\<^sub>\\ \\)[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s[bv::=b]\\<^sub>s\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using check_assertI\n by metis\n thus \"\\ ; \\ ; {||} ; (x, B_bool, c[bv::=b]\\<^sub>c\\<^sub>b) #\\<^sub>\\ \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s[bv::=b]\\<^sub>s\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_gb.simps by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ c[bv::=b]\\<^sub>c\\<^sub>b \" using subst_b_valid check_assertI by simp\n show \" \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst2(6) check_assertI by simp\n qed\nnext\n case (check_branch_list_consI \\ \\ \\ \\ \\ tid dclist v cs \\ css)\n then show ?case unfolding subst_branchlb.simps using Typing.check_branch_list_consI by simp\nnext\n case (check_branch_list_finalI \\ \\ \\ \\ \\ tid dclist v cs \\)\n then show ?case unfolding subst_branchlb.simps using Typing.check_branch_list_finalI by simp\nnext\n case (check_branch_s_branchI \\ \\ \\ \\ \\ const x \\ tid cons v s)\n\n show ?case unfolding subst_b_simps proof(rule Typing.check_branch_s_branchI) \n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using check_branch_s_branchI wf_b_subst subst_db.simps by metis\n show \"\\\\<^sub>w\\<^sub>f \\ \" using check_branch_s_branchI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using check_branch_s_branchI wf_b_subst by metis\n\n show \"atom x \\(\\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, tid, cons , const, v[bv::=b]\\<^sub>v\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b)\" \n apply(unfold fresh_prodN,auto)\n apply(simp add: check_branch_s_branchI fresh_empty_fset)+\n apply(metis * subst_b_fresh_x check_branch_s_branchI fresh_prodN)+\n done\n show wft:\"\\ ; {||} ; GNil \\\\<^sub>w\\<^sub>f const\" using check_branch_s_branchI by auto\n hence \"(b_of const) = (b_of const)[bv::=b]\\<^sub>b\\<^sub>b\" \n using wfT_nil_supp fresh_def[of \"atom bv\" ] forget_subst subst_b_b_def \\.supp\n bot.extremum_uniqueI ex_in_conv fresh_def supp_empty_fset \n by (metis b_of_supp)\n moreover have \"(c_of const x)[bv::=b]\\<^sub>c\\<^sub>b = c_of const x\" \n using wft wfT_nil_supp fresh_def[of \"atom bv\" ] forget_subst subst_b_c_def \\.supp\n bot.extremum_uniqueI ex_in_conv fresh_def supp_empty_fset subst_b_c_of_forget by metis\n ultimately show \"\\ ; \\ ; {||} ; (x, b_of const, CE_val (v[bv::=b]\\<^sub>v\\<^sub>b) == CE_val(V_cons tid cons (V_var x)) AND c_of const x) #\\<^sub>\\ \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s[bv::=b]\\<^sub>s\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" \n using check_branch_s_branchI subst_gb.simps by auto\n qed\nnext\n case (check_ifI z \\ \\ \\ \\ \\ v s1 s2 \\)\n show ?case unfolding subst_b_simps proof(rule Typing.check_ifI) \n show \\atom z \\ (\\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b, s1[bv::=b]\\<^sub>s\\<^sub>b, s2[bv::=b]\\<^sub>s\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b)\\ \n by(unfold fresh_prodN,auto, auto simp add: check_ifI fresh_empty_fset subst_b_fresh_x )\n have \"\\ z : B_bool | TRUE \\[bv::=b]\\<^sub>\\\\<^sub>b = \\ z : B_bool | TRUE \\\" by auto\n thus \\\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z : B_bool | TRUE \\\\ using check_ifI subst_b_check_v by metis\n show \\ \\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s1[bv::=b]\\<^sub>s\\<^sub>b \\ \\ z : b_of \\[bv::=b]\\<^sub>\\\\<^sub>b | CE_val (v[bv::=b]\\<^sub>v\\<^sub>b) == CE_val (V_lit L_true) IMP c_of \\[bv::=b]\\<^sub>\\\\<^sub>b z \\\\ \n using subst_b_if check_ifI by metis\n show \\ \\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s2[bv::=b]\\<^sub>s\\<^sub>b \\ \\ z : b_of \\[bv::=b]\\<^sub>\\\\<^sub>b | CE_val (v[bv::=b]\\<^sub>v\\<^sub>b) == CE_val (V_lit L_false) IMP c_of \\[bv::=b]\\<^sub>\\\\<^sub>b z \\\\ \n using subst_b_if check_ifI by metis\n qed\nnext\n case (check_let2I x \\ \\ \\ G \\ t s1 \\ s2 )\n show ?case unfolding subst_b_simps proof (rule Typing.check_let2I)\n have \"atom x \\ b\" using x_fresh_b by auto\n show \\atom x \\ (\\, \\, {||}, G[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, t[bv::=b]\\<^sub>\\\\<^sub>b, s1[bv::=b]\\<^sub>s\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b)\\ \n apply(unfold fresh_prodN, auto, auto simp add: check_let2I fresh_prodN fresh_empty_fset)\n apply(metis subst_b_fresh_x check_let2I fresh_prodN)+\n done\n\n show \\ \\ ; \\ ; {||} ; G[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s1[bv::=b]\\<^sub>s\\<^sub>b \\ t[bv::=b]\\<^sub>\\\\<^sub>b \\ using check_let2I subst_tb.simps by auto\n show \\ \\ ; \\ ; {||} ; (x, b_of t[bv::=b]\\<^sub>\\\\<^sub>b, c_of t[bv::=b]\\<^sub>\\\\<^sub>b x) #\\<^sub>\\ G[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s2[bv::=b]\\<^sub>s\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\\ \n using check_let2I subst_tb.simps subst_gb.simps b_of.simps subst_b_c_of subst_b_b_of by auto\n qed\nnext\n case (check_varI u \\ \\ \\ \\ \\ \\' v \\ s)\n show ?case unfolding subst_b_simps proof(rule Typing.check_varI) \n show \"atom u \\ (\\, \\, {||}, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b, \\'[bv::=b]\\<^sub>\\\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b, \\[bv::=b]\\<^sub>\\\\<^sub>b) \"\n by(unfold fresh_prodN,auto simp add: check_varI fresh_empty_fset subst_b_fresh_u )\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\'[bv::=b]\\<^sub>\\\\<^sub>b\" using check_varI subst_b_check_v by auto\n show \"\\ ; \\ ; {||} ; (subst_gb \\ bv b) ; (u, (\\'[bv::=b]\\<^sub>\\\\<^sub>b)) #\\<^sub>\\ (subst_db \\ bv b) \\ (s[bv::=b]\\<^sub>s\\<^sub>b) \\ (\\[bv::=b]\\<^sub>\\\\<^sub>b)\" using check_varI by auto\n qed\nnext\n case (check_assignI \\ \\ \\ \\ \\ u \\ v z \\')\n show ?case unfolding subst_b_simps proof( rule Typing.check_assignI) \n show \"\\ \\\\<^sub>w\\<^sub>f \\ \" using check_assignI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\\\<^sub>w\\<^sub>f \\[bv::=b]\\<^sub>\\\\<^sub>b \" using wf_b_subst check_assignI by auto\n show \"(u, \\[bv::=b]\\<^sub>\\\\<^sub>b) \\ setD \\[bv::=b]\\<^sub>\\\\<^sub>b\" using check_assignI subst_d_b_member by simp\n show \" \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\" using check_assignI subst_b_check_v by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ \\ z : B_unit | TRUE \\ \\ \\'[bv::=b]\\<^sub>\\\\<^sub>b\" using check_assignI subst_b_subtype subst_b_simps subst_tb.simps by fastforce\n qed\nnext\n case (check_whileI \\ \\ \\ \\ \\ s1 z s2 \\')\n show ?case unfolding subst_b_simps proof(rule Typing.check_whileI) \n show \"\\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s1[bv::=b]\\<^sub>s\\<^sub>b \\ \\ z : B_bool | TRUE \\\" using check_whileI by auto\n show \"\\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ s2[bv::=b]\\<^sub>s\\<^sub>b \\ \\ z : B_unit | TRUE \\\" using check_whileI by auto\n show \"\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ \\ z : B_unit | TRUE \\ \\ \\'[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_b_subtype check_whileI by fastforce\n qed \nnext\n case (check_seqI \\ \\ \\ \\ \\ s1 z s2 \\)\n then show ?case unfolding subst_sb.simps using check_seqI Typing.check_seqI subst_b_eq by metis\nnext\n case (check_caseI \\ \\ \\ \\ \\ tid dclist v cs \\ z)\n show ?case unfolding subst_b_simps proof(rule Typing.check_caseI)\n show \\ \\ ; \\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; \\[bv::=b]\\<^sub>\\\\<^sub>b ; tid ; dclist ; v[bv::=b]\\<^sub>v\\<^sub>b \\ subst_branchlb cs bv b \\ \\[bv::=b]\\<^sub>\\\\<^sub>b\\ using check_caseI by auto\n show \\AF_typedef tid dclist \\ set \\\\ using check_caseI by auto\n show \\\\ ; {||} ; \\[bv::=b]\\<^sub>\\\\<^sub>b \\ v[bv::=b]\\<^sub>v\\<^sub>b \\ \\ z : B_id tid | TRUE \\\\ using check_caseI subst_b_check_v subst_b_simps subst_tb.simps subst_b_simps \n proof -\n have \"\\ z : B_id tid | TRUE \\ = \\ z : B_id tid | TRUE \\[bv::=b]\\<^sub>\\\\<^sub>b\" using subst_b_eq by auto\n then show ?thesis\n by (metis (no_types) check_caseI.hyps(4) check_caseI.prems(1) check_caseI.prems(2) subst_b_check_v) (* 31 ms *)\n qed\n show \\ \\\\<^sub>w\\<^sub>f \\ \\ using check_caseI by auto\n qed\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/MiniSail/BTVSubstTypingL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.28805923658922705}} {"text": "theory Shifts\n imports Frame Append\nbegin\n\n\nlemma shift_entails_prem: \"(As ** A) ** Bs \\ Q \\ As ** A ** Bs \\ Q\"\n by simp\n\n\nlemma shift_entails_conc: \"P \\ (As ** A) ** Bs \\ P \\ As ** A ** Bs\"\n by simp\n\n\nlemma shift_frame_prem: \"((As ** A) ** Bs) -- PR \\ Q -- QR \\ (As ** A ** Bs) -- PR \\ Q -- QR\"\n by simp\n\n\nlemma shift_frame_conc: \"P -- PR \\ ((As ** A) ** Bs) -- QR \\ P -- PR \\ (As ** A ** Bs) -- QR\"\n by simp\n\nmethod_setup no_inst_rule = \n \\Attrib.thms >> (fn thms => fn ctxt => SIMPLE_METHOD' (match_tac ctxt thms THEN_ALL_NEW Goal.norm_hhf_tac ctxt))\\\n\nmethod all_entails_prem_shifts methods M = append \\M\\ \\no_inst_rule shift_entails_prem, all_entails_prem_shifts M\\\nmethod all_entails_conc_shifts methods M = append \\M\\ \\no_inst_rule shift_entails_conc, all_entails_conc_shifts M\\\nmethod all_frame_prem_shifts methods M = append \\M\\ \\no_inst_rule shift_frame_prem, all_frame_prem_shifts M\\\nmethod all_frame_conc_shifts methods M = append \\M\\ \\no_inst_rule shift_frame_conc, all_frame_conc_shifts M\\\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Separation_Logic_Solver/Shifts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.28805922893963276}} {"text": "theory Basic_Assn\n imports\n \"Refine_Imperative_HOL.Sepref_HOL_Bindings\"\n \"Refine_Imperative_HOL.Sepref_Basic\"\nbegin\n\nsection \"Auxilary imperative assumptions\"\n\ntext \"The following auxiliary assertion types and lemmas were provided by Peter Lammich\"\n\nsubsection \\List-Assn\\\n\n\n\nlemma list_assn_cong[fundef_cong]:\n \"\\ xs=xs'; ys=ys'; \\x y. \\ x\\set xs; y\\set ys \\ \\ A x y = A' x y \\ \\ list_assn A xs ys = list_assn A' xs' ys'\"\n by (induction xs ys arbitrary: xs' ys' rule: list_assn.induct) auto\n\n\nlemma list_assn_app_one: \"list_assn P (l1@[x]) (l1'@[y]) = list_assn P l1 l1' * P x y\"\n by simp\n\n(* ------------------ ADDED by NM in course of btree_imp -------- *)\n\n\nlemma list_assn_len: \"h \\ list_assn A xs ys \\ length xs = length ys\"\n using list_assn_aux_ineq_len by fastforce\n\n\nlemma list_assn_append_Cons_left: \"list_assn A (xs@x#ys) zs = (\\\\<^sub>A zs1 z zs2. list_assn A xs zs1 * A x z * list_assn A ys zs2 * \\(zs1@z#zs2 = zs))\"\n by (sep_auto simp add: list_assn_aux_cons_conv list_assn_aux_append_conv1 intro!: ent_iffI)\n\n\nlemma list_assn_aux_append_Cons: \n shows \"length xs = length zsl \\ list_assn A (xs@x#ys) (zsl@z#zsr) = (list_assn A xs zsl * A x z * list_assn A ys zsr) \"\n by (sep_auto simp add: mult.assoc)\n\nlemma list_assn_prod_split: \"list_assn (\\x y. P x y * Q x y) as bs = list_assn P as bs * list_assn Q as bs\"\nproof(cases \"length as = length bs\")\n case True\n then show ?thesis\n proof (induction rule: list_induct2)\n case Nil\n then show ?case by sep_auto\n next\n case (Cons x xs y ys)\n show ?case\n proof (rule ent_iffI, goal_cases)\n case 1\n then show ?case\n using Cons by sep_auto\n next\n case 2\n then show ?case\n using Cons by sep_auto\n qed\n qed\nnext\n case False\n then show ?thesis\n by (simp add: list_assn_aux_ineq_len)\nqed\n\n(* -------------------------------------------- *)\n\nsubsection \\Prod-Assn\\\n\n\nlemma prod_assn_cong[fundef_cong]:\n \"\\ p=p'; pi=pi'; A (fst p) (fst pi) = A' (fst p) (fst pi); B (snd p) (snd pi) = B' (snd p) (snd pi) \\ \n \\ (A\\\\<^sub>aB) p pi = (A'\\\\<^sub>aB') p' pi'\" \n apply (cases p; cases pi)\n by auto\n\nsubsection \\Assertions and Magic Wand\\\n\nlemma entails_preI: \"(\\h. h \\ P \\ P \\\\<^sub>A Q) \\ P \\\\<^sub>A Q\"\n unfolding entails_def\n by auto\n\nlemma ent_true_drop_true: \n \"P*true\\\\<^sub>AQ*true \\ P*R*true\\\\<^sub>AQ*true\"\n using assn_aci(10) ent_true_drop(1) by presburger\n\n(* TODO *)\nlemma rem_true: \"P*true \\\\<^sub>A Q*true \\ P \\\\<^sub>AQ*true\"\n using enttD enttI_true by blast\n\nlemma assn_eq_split:\n assumes \"B = C\"\n shows \"B \\\\<^sub>A C\"\n and \"C \\\\<^sub>A B\"\n by (simp_all add: assms)\n\nlemma ent_ex_inst: \"\\\\<^sub>Ax. P x \\\\<^sub>A Q \\ P y \\\\<^sub>A Q\"\n using ent_trans by blast\n\nlemma ent_ex_inst2: \"\\\\<^sub>Ax y. P x y \\\\<^sub>A Q \\ P x y \\\\<^sub>A Q\"\n using ent_trans by blast\n\nlemma ent_wandI2:\n assumes IMP: \"P \\\\<^sub>A (Q -* R)\"\n shows \"Q*P \\\\<^sub>A R\"\n using assms\n unfolding entails_def \n(* by (meson assms ent_fwd ent_mp ent_refl fr_rot mod_frame_fwd)*)\nproof (clarsimp, goal_cases)\n case (1 h as)\n then obtain as1 as2 where \"as = as1 \\ as2\" \"as1 \\ as2 = {}\" \"(h,as1) \\ Q\" \"(h,as2) \\ P\"\n by (metis mod_star_conv prod.inject)\n then have \"(h,as2) \\ (Q-*R)\"\n by (simp add: \"1\"(1))\n then have \"(h,as1\\as2) \\ Q * (Q-*R)\"\n by (simp add: \\(h, as1) \\ Q\\ \\as1 \\ as2 = {}\\ star_assnI)\n then show ?case \n using \\as = as1 \\ as2\\ ent_fwd ent_mp by blast\nqed\n\nlemma ent_wand: \"(P \\\\<^sub>A (Q -* R)) = (Q*P \\\\<^sub>A R)\"\n using ent_wandI2 ent_wandI by blast\n\nlemma wand_ent_trans:\n assumes \"P' \\\\<^sub>A P\"\n and \"Q \\\\<^sub>A Q'\"\n shows \"P -* Q \\\\<^sub>A P' -* Q'\"\n by (meson assms(1) assms(2) ent_wand ent_frame_fwd ent_refl ent_trans)\n\nlemma wand_elim: \"(P -* Q) * (Q -* R) \\\\<^sub>A (P -* R)\"\n by (metis ent_wand ent_frame_fwd ent_mp ent_refl star_assoc)\n\nlemma emp_wand_same: \"emp \\\\<^sub>A (H -* H)\"\n by (simp add: ent_wandI)\n\nlemma emp_wand_equal: \"(emp -* H) = H\"\n apply(intro ent_iffI)\n apply (metis ent_mp norm_assertion_simps(1))\n by (simp add: ent_wandI)\n\nlemma pure_wand_equal: \"P \\ (\\(P) -* H) = H\"\n by (simp add: emp_wand_equal)\n\nlemma pure_wand_ent: \"(P \\ (H1 \\\\<^sub>A H2)) \\ H1 \\\\<^sub>A \\(P) -* H2\"\n by (simp add: ent_wand)\n\nlemma \"\\(P \\ Q) \\\\<^sub>A (\\(P) -* \\(Q))\"\n by (simp add: pure_wand_ent)\n\nlemma wand_uncurry: \"(P*Q) -* R \\\\<^sub>A P -* (Q -* R)\"\n by (simp add: assn_aci ent_mp ent_wandI fr_rot)\n\nlemma wand_absorb: \"(P -* Q) * R \\\\<^sub>A (P -* (Q * R))\"\n by (smt (z3) ent_mp ent_refl ent_star_mono ent_wandI star_aci(2) star_aci(3))\n\nlemma wand_ent_self: \"P \\\\<^sub>A Q -* (Q * P)\"\n by (simp add: ent_wandI)\n\nlemma wand_ent_cancel: \"P * ((P * Q) -* R) \\\\<^sub>A Q -* R\"\n by (simp add: ent_wandI2 wand_uncurry)\n\n\nlemma \"\\R. Q * R \\\\<^sub>A P\"\n using ent_mp by auto\n\nlemma \"P \\\\<^sub>A Q * true \\ P = Q * (Q -* P)\"\n apply(intro ent_iffI)\nproof(goal_cases)\n case 2\n then show ?case\n by (simp add: ent_mp)\nnext\n case test: 1\n show ?case\n unfolding entails_def\n apply clarsimp\n proof (goal_cases)\n case (1 a b)\n then have \"(a,b) \\ Q * true\"\n using test entails_def\n by blast\n then obtain h as1 as2 where *:\n \"(a,b) = (h, as1 \\ as2) \\ as1 \\ as2 = {} \\ (h, as1) \\ Q \\ (h, as2) \\ true\"\n using mod_star_conv by auto\n then have \"(h, as1 \\ as2) \\ P\" \"(a,b) = (h, as1 \\ as2)\" \n using \"1\" by blast+\n then show ?case \n apply simp\n thm star_assnI\n apply(intro star_assnI)\n apply (simp_all add: *)\n apply(intro wand_assnI)\n apply (meson \"*\" models_in_range)\n apply auto\n oops\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BTree/Basic_Assn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.28805922893963276}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | November 2004 |\n | July 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Trace_seq\nimports Prefix\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\ndefinition\n rmTick:: \"'a trace => 'a trace\"\n where\n rmTick_def : \n \"rmTick s == if noTick s then s else butlastt s\"\n\n(***********************************************************\n nil and Tick\n ***********************************************************)\n\n(*** noTick s --> rmTick s ***)\n\nlemma rmTick_nochange[simp]: \"noTick s ==> rmTick s = s\"\nby (simp add: rmTick_def)\n\n(*** rmTick <> ***)\n\nlemma rmTick_nil[simp]: \"rmTick <> = <>\"\nby (simp add: rmTick_def)\n\n(*** rmTick ***)\n\nlemma rmTick_Tick[simp]: \"rmTick = <>\"\nby (simp add: rmTick_def)\n\n(*** noTick rmTick s ***)\n\nlemma noTick_rmTick[simp]: \"noTick (rmTick s)\"\napply (case_tac \"noTick s\")\napply (simp_all add: rmTick_def)\napply (simp add: noTick_butlast)\ndone\n\nlemma noTick_rmTickE: \"[| t = rmTick s ; noTick t ==> R |] ==> R\"\nby (simp)\n\n(***********************************************************\n appt\n ***********************************************************)\n\n(*-------------------------*\n | rmTick last |\n *-------------------------*)\n\nlemma rmTick_last_Tick[simp]:\n \"noTick s ==> rmTick (s ^^^ ) = s\"\nby (simp add: rmTick_def)\n\n(*** noTick butlast ***)\n\nlemma rmTick_butlastt: \n \"~ noTick s ==> rmTick s = butlastt s\"\nby (simp add: rmTick_def)\n\n(*-------------------------*\n | rmTick distribution |\n *-------------------------*)\n\nlemma rmTick_appt_dist[simp]:\n \"noTick s ==> rmTick (s ^^^ t) = s ^^^ (rmTick t)\"\napply (insert trace_last_nil_or_unnil)\napply (drule_tac x=\"t\" in spec, simp)\napply (erule disjE, simp)\n\napply (elim conjE exE, simp)\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"a\" in spec)\n\napply (erule disjE) (* Tick *)\napply (simp add: appt_assoc_sym)\n\napply (erule exE) (* Ev *)\napply (simp add: appt_assoc_sym)\ndone\n\n(***********************************************************\n prefix\n ***********************************************************)\n\n(*** rmTick prefix ***)\n\n(* only if *)\n\nlemma rmTick_prefix_only_if:\n \"prefix s (rmTick t) ==> (EX u. prefix u t & s = rmTick u)\"\napply (insert trace_last_nil_or_unnil)\napply (drule_tac x=\"t\" in spec, simp)\napply (erule disjE, simp)\n\napply (elim conjE exE, simp)\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"a\" in spec)\n\n apply (erule disjE) (* Tick *)\n apply (rule_tac x=\"s\" in exI)\n apply (simp add: prefix_noTick)\n\n apply (erule exE) (* Ev *)\n apply (simp)\n\n apply (erule disjE) (* same length *)\n apply (rule_tac x=\"sa ^^^ \" in exI, simp)\n\n apply (rule_tac x=\"s\" in exI)\n apply (simp add: prefix_noTick)\ndone\n\n(* if *)\n\nlemma rmTick_prefix_if:\n \"(EX u. prefix u t & s = rmTick u) ==> prefix s (rmTick t)\"\napply (elim conjE exE)\napply (simp)\n\napply (insert trace_last_nil_or_unnil)\napply (drule_tac x=\"t\" in spec, simp)\napply (erule disjE, simp)\napply (elim conjE exE)\napply (simp)\n\n apply (erule disjE, simp)\n apply (case_tac \"~ noTick u\")\n apply (simp add: prefix_noTick)\n\n apply (insert event_Tick_or_Ev)\n apply (drule_tac x=\"a\" in spec)\n\n apply (erule disjE) (* Tick *)\n apply (simp)\n\n apply (elim exE) (* Ev *)\n apply (simp)\ndone\n\n(* iff *)\n\nlemma rmTick_prefix:\n \"prefix s (rmTick t) = (EX u. prefix u t & s = rmTick u)\"\napply (rule iffI)\napply (simp add: rmTick_prefix_only_if)\napply (simp add: rmTick_prefix_if)\ndone\n\n(*--------------*\n | reverse |\n *--------------*)\n\nlemma rmTick_prefix_rev: \"prefix s t ==> prefix (rmTick s) t\"\napply (simp add: rmTick_def)\napply (intro impI)\napply (simp add: prefix_def)\n\napply (rule_tac x=\"\" in exI)\napply (simp add: noTick_butlast)\napply (simp add: Tick_decompo)\ndone\n\nlemma rmTick_prefix_rev_simp[simp]: \"prefix (rmTick s) s\"\nby (simp add: rmTick_prefix_rev)\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp] \n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP/Trace_seq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.28797984629537415}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | December 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_step_ext\nimports CSP_F_law_basic CSP_T_law_step_ext\nbegin\n\n(*****************************************************************\n\n 1. step laws\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n (P1 [> P2) |[X]| (Q1 [> Q2)\n *********************************************************)\n\n(* The following law in p.288 does not hold. *)\n(* (P1 [> P2) |[X]| (Q1 [> Q2) *)\n(* =F (P1 |[X]| Q1) [> ((P2 |[X]| (Q1 [> Q2)) |~| ((P1 [> P2) |[X]| Q2)) *)\n(* *)\n(* a counter example: *)\n(* P1 = a -> STOP, P2 = STOP, Q1 = STOP, Q2 = b -> STOP, X = {} *)\n(* where (a ~= b) *)\n(* *)\n(* check the following lemmas *)\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) ~:f \n failures ((a -> STOP [> STOP) |[{}]| (STOP [> (b -> STOP))) M\"\napply (simp add: in_failures in_traces)\napply (intro allI impI)\napply (simp add: par_tr_Ev)\napply (erule disjE)\napply (auto)\ndone\n\nlemma \"(, {(Ev b)}) :f\n failures (((a -> STOP) |[{}]| STOP) [> \n ((STOP |[{}]| (STOP [> (b -> STOP))) |~| \n (((a -> STOP [> STOP) |[X]| (b -> STOP))))) M\"\napply (simp add: in_failures in_traces)\napply (rule disjI1)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (simp)\napply (rule_tac x=\"\" in exI)\napply (simp add: par_tr_nil_right)\ndone\n\n(*********************************************************\n (P [> Q) |[X]| (? :Y -> Rf)\n *********************************************************)\n\n(* The following law in p.289 does not hold. *)\n(* *)\n(* (P [> Q) |[X]| (? :Y -> Rf) =F[M,M] *)\n(* (? x:(Y - X) -> ((P [> Q) |[X]| Rf x)) *)\n(* [+] ((P |[X]| (? :Y -> Rf)) [> (Q |[X]| (? :Y -> Rf))) *)\n(* *)\n(* a counter example: *)\n(* P = STOP, Q = b -> STOP, Y = {a}, Rf = (%x. STOP), X = {} *)\n(* where (a ~= b) *)\n(* *)\n(* check the following lemmas *)\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) ~:f \n failures ((STOP [> (b -> STOP)) |[{}]| (? x:{a} -> STOP)) M\"\napply (simp add: in_failures in_traces)\napply (intro allI impI)\napply (simp add: par_tr_Ev)\napply (erule disjE)\napply (auto)\ndone\n\nlemma \"a ~= b ==>\n (, {(Ev b)}) :f \n failures ((? x:({a} - {}) -> ((STOP [> (b -> STOP)) |[{}]| STOP))\n [+] ((STOP |[{}]| (? x:{a} -> STOP)) \n [> ((b -> STOP) |[{}]| (? x:{a} -> STOP)))) M\"\napply (fold Timeout_def)\napply (simp add: in_failures in_failures_Timeout in_traces)\napply (rule disjI2)\napply (rule disjI2)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (rule_tac x=\"{(Ev b)}\" in exI)\napply (simp)\napply (rule_tac x=\"\" in exI)\napply (simp add: par_tr_nil_left)\ndone\n\n(*********************************************************\n Parallel expansion & distribbution\n *********************************************************)\n\nlemma cspF_Parallel_Timeout_split:\n \"((? :Y -> Pf) [> P) |[X]| ((? :Z -> Qf) [> Q) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| ((? :Z -> Qf) [> Q)) |~|\n (((? :Y -> Pf) [> P) |[X]| Q)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_Timeout_split)\napply (fold Timeout_def)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (force)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n (* main part *)\n\n apply (case_tac \"s = <>\", simp, simp)\n apply (rule disjI2)\n apply (rule disjI2)\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim exE disjE)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (elim conjE disjE)\n\n (* sync *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* left *)\n apply (simp)\n apply (case_tac \"c:Z\")\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* right *)\n apply (simp)\n apply (case_tac \"c:Y\")\n\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* others *)\n\n apply (simp add: in_traces)\n apply (simp add: in_traces)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* main part *)\n\n (* sync *)\n apply (simp add: in_failures_Parallel)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Z\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Z *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Y\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Y *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* others *)\n\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n Parallel expansion & distribbution 2\n *********************************************************)\n\n(*** left ****)\n\nlemma cspF_Parallel_Timeout_input_l: \n \"((? :Y -> Pf) [> P) |[X]| (? :Z -> Qf) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| (? :Z -> Qf))))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_Timeout_input)\napply (fold Timeout_def)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (force)\n\n apply (rule disjI1)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n apply (simp add: par_tr_nil_right)\n apply (rule disjI2)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (elim conjE)\n apply (simp add: image_iff)\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (simp add: in_traces)\n\n (* main part *)\n\n apply (case_tac \"s = <>\", simp, simp)\n apply (rule disjI2)\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim exE disjE)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (elim conjE disjE)\n\n (* sync *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* left *)\n apply (simp)\n apply (case_tac \"c:Z\")\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* right *)\n apply (simp)\n apply (case_tac \"c:Y\")\n\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* others *)\n\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (force)\n\n (* main part *)\n\n (* sync *)\n apply (simp add: in_failures_Parallel)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Z\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* a ~: Z *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* no_sync *)\n apply (simp add: in_failures_IF)\n apply (case_tac \"a:Y\")\n\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* a ~: Y *)\n apply (simp add: in_failures_Timeout in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces)\n\n (* others *)\n\n apply (simp add: in_traces)\ndone\n\n(*** right ****)\n\nlemma cspF_Parallel_Timeout_input_r: \n \"(? :Y -> Pf) |[X]| ((? :Z -> Qf) [> Q) =F[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| ((? x:Y -> Pf x) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n [> ((? :Y -> Pf) |[X]| Q)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Timeout_input_l)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (force)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\n\napply (case_tac \"a : Z & a : Y\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_True)\napply (rule cspF_rw_right)\napply (rule cspF_IF_True)\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_decompo)\napply (rule cspF_commut)\napply (rule cspF_commut)\n\napply (simp (no_asm_simp))\napply (rule cspF_rw_left)\napply (rule cspF_IF_False)\napply (rule cspF_rw_right)\napply (subgoal_tac \"~ (a : Y & a : Z)\")\napply (simp (no_asm_simp))\napply (rule cspF_IF_False)\napply (force)\n\napply (case_tac \"a : Z\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_True)\napply (rule cspF_rw_right)\napply (rule cspF_IF_False)\napply (rule cspF_commut)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_False)\napply (rule cspF_rw_right)\napply (rule cspF_IF_True)\napply (rule cspF_commut)\n\napply (rule cspF_reflex)\napply (rule cspF_commut)\ndone\n\nlemmas cspF_Parallel_Timeout_input\n = cspF_Parallel_Timeout_input_l\n cspF_Parallel_Timeout_input_r\n\n(*** cspF_step_ext ***)\n\nlemmas cspF_step_ext = cspF_Parallel_Timeout_split\n cspF_Parallel_Timeout_input\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_step_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2879798462953741}} {"text": "theory QuiescentResult\nimports Semantics PositiveAccounts\nbegin\n\nlemma reduceOne_onlyIfNonEmptyState : \"refundOne acc = Some c \\ acc \\ []\"\n by auto\n\nlemma reduceContractStepPayIsQuiescent :\n \"(let moneyToPay = evalValue env sta x23\n in if moneyToPay \\ 0 then Reduced (ReduceNonPositivePay x21 x22 tok moneyToPay) ReduceNoPayment sta x24\n else let balance = moneyInAccount x21 tok (accounts sta); paidMoney = min balance moneyToPay; newBalance = balance - paidMoney;\n newAccs = updateMoneyInAccount x21 tok newBalance (accounts sta);\n warning = if paidMoney < moneyToPay then ReducePartialPay x21 x22 tok paidMoney moneyToPay else ReduceNoWarning;\n (payment, finalAccs) = giveMoney x21 x22 tok paidMoney newAccs\n in Reduced warning payment (sta\\accounts := finalAccs\\) x24) =\n NotReduced \\\n cont = Pay x21 x22 tok x23 x24 \\ False\"\n apply (cases \"evalValue env sta x23 \\ 0\")\n apply simp\n apply (cases \"min (moneyInAccount x21 tok (accounts sta)) (evalValue env sta x23) < (evalValue env sta x23)\")\n apply (cases \"lookup (x21, tok) (accounts sta)\")\n apply simp\n apply (meson ReduceStepResult.distinct(1))\n apply (cases \"evalValue env sta x23 \\ 0\")\n apply simp\n apply (cases \"min (moneyInAccount x21 tok (accounts sta)) (evalValue env sta x23) < evalValue env sta x23\")\n apply simp\n apply (meson ReduceStepResult.distinct(1))\n apply simp\n by (smt ReduceStepResult.distinct(1) case_prod_unfold)\n\nlemma reduceOneIsSomeIfNotEmptyAndPositive : \"accs \\ [] \\ allAccountsPositive accs \\ refundOne accs \\ None\"\n by (metis allAccountsPositiveMeansFirstIsPositive option.distinct(1) refundOne.cases refundOne.simps(1))\n\nlemma reduceContractStepIsQuiescent : \"validAndPositive_state sta \\\n reduceContractStep env sta cont = NotReduced \\ isQuiescent cont sta\"\n apply (cases cont)\n apply (simp only:reduceContractStep.simps)\n apply (cases \"accounts sta\")\n using reduceContractStepPayIsQuiescent apply fastforce\n apply (cases \"refundOne (accounts sta)\")\n apply (simp add: reduceOneIsSomeIfNotEmptyAndPositive)\n apply (simp add: case_prod_beta')\n apply (metis reduceContractStep.simps(2) reduceContractStepPayIsQuiescent)\n apply simp\n using isQuiescent.simps(2) apply blast\n apply (metis ReduceStepResult.distinct(1) reduceContractStep.simps(5))\n by simp\n\nlemma reductionLoopIsQuiescent_aux :\n \"(\\x11 x12 x13 x14 x xa.\n reduceContractStep env state contract = Reduced x11 x12 x13 x14 \\\n x = (if x11 = ReduceNoWarning then warnings else x11 # warnings) \\\n xa = (case x12 of ReduceNoPayment \\ payments | ReduceWithPayment payment \\ payment # payments) \\\n validAndPositive_state x13 \\ reductionLoop True env x13 x14 x xa = ContractQuiescent newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta) \\\n validAndPositive_state state \\ reductionLoop reduced env state contract warnings payments = ContractQuiescent newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta\"\n apply (simp only:reductionLoop.simps [of reduced env state contract warnings payments])\n apply (cases \"reduceContractStep env state contract\")\n apply (metis (no_types, lifting) ReduceStepResult.simps(8) reduceContractStep_preserves_validAndPositive_state)\n apply (simp add: reduceContractStepIsQuiescent)\n by simp\n\nlemma reductionLoopIsQuiescent : \"validAndPositive_state sta \\\n reductionLoop reduced env sta c wa ef = ContractQuiescent newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta\"\n apply (induction reduced env sta c wa ef rule:reductionLoop.induct)\n using reductionLoopIsQuiescent_aux by blast\n\ntheorem reduceContractUntilQuiecentIsQuiescent : \"validAndPositive_state sta \\\n reduceContractUntilQuiescent env sta c = ContractQuiescent newReduced wa ef nsta ncon \\ isQuiescent ncon nsta\"\n by (simp only:reduceContractUntilQuiescent.simps reductionLoopIsQuiescent)\n\nlemma applyAllInputsLoopIsQuiescent_base : \"validAndPositive_state fixSta \\\n applyAllLoop reduced env fixSta cont [] wa ef = ApplyAllSuccess newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta\"\n apply (cases \"reduceContractUntilQuiescent env fixSta cont\")\n by (simp_all del:reduceContractUntilQuiescent.simps validAndPositive_state.simps add:reduceContractUntilQuiecentIsQuiescent)\n\nlemma applyAllInputsLoopIsQuiescent_loop : \"(\\reduced env fixSta cont wa ef.\n validAndPositive_state fixSta \\ applyAllLoop reduced env fixSta cont inps wa ef = ApplyAllSuccess newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta) \\\n validAndPositive_state fixSta \\ applyAllLoop reduced env fixSta cont (a # inps) wa ef = ApplyAllSuccess newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta\"\n apply (cases \"reduceContractUntilQuiescent env fixSta cont\")\n apply (unfold applyAllLoop.simps [of \"reduced\" \"env\" \"fixSta\"])\n apply (simp only:ReduceResult.case list.case)\n subgoal for x11 x12 x13 x14 x15\n apply (cases \"applyInput env x14 a x15\")\n apply (simp only:ApplyResult.case)\n apply (meson applyInput_preserves_preserves_validAndPositive_state reduceContractUntilQuiescent_preserves_validAndPositive_state)\n apply (simp only:ApplyResult.case)\n by blast\n by simp\n\nlemma applyAllInputsLoopIsQuiescent : \"validAndPositive_state fixSta \\\n applyAllLoop reduced env fixSta cont inps wa ef = ApplyAllSuccess newReduced nwa nef nsta ncon \\ isQuiescent ncon nsta\"\n apply (induction inps arbitrary:reduced env fixSta cont wa ef)\n apply (simp add: applyAllInputsLoopIsQuiescent_base)\n using applyAllInputsLoopIsQuiescent_loop by blast\n\nlemma applyAllInputsIsQuiescent : \"validAndPositive_state fixSta \\\n applyAllInputs env fixSta cont inps = ApplyAllSuccess reduced warnings payments newState newCont \\ isQuiescent newCont newState\"\n by (simp add: applyAllInputsLoopIsQuiescent)\n\nlemma computeTransactionIsQuiescent_aux : \"validAndPositive_state sta \\\n computeTransaction (Transaction \\interval = interva, inputs = inps\\) sta cont\n = TransactionOutput \\ txOutWarnings = nwa,\n txOutPayments = nef,\n txOutState = nsta,\n txOutContract = ncont\\ \\\n fixInterval (interval (Transaction \\interval = interva, inputs = inps\\)) sta = IntervalTrimmed x11 x12\n \\ isQuiescent ncont nsta\"\n apply (simp only:computeTransaction.simps)\n by (smt ApplyAllResult.exhaust ApplyAllResult.simps(10) ApplyAllResult.simps(8) ApplyAllResult.simps(9) IntervalResult.simps(5) TransactionOutput.distinct(1) TransactionOutput.inject(1) TransactionOutputRecord.ext_inject applyAllInputs.simps applyAllInputsLoopIsQuiescent fixInterval_preserves_preserves_validAndPositive_state)\n\ntheorem computeTransactionIsQuiescent : \"validAndPositive_state sta \\\n computeTransaction traIn sta cont = TransactionOutput traOut \\\n isQuiescent (txOutContract traOut) (txOutState traOut)\"\n\n apply (cases \"traIn\")\n apply (cases \"traOut\")\n by (smt IntervalResult.exhaust IntervalResult.simps(6) Transaction.update_convs(3) TransactionOutput.distinct(1) TransactionOutputRecord.surjective computeTransaction.simps computeTransactionIsQuiescent_aux old.unit.exhaust)\n\nlemma playTraceAuxIsQuiescent : \"validAndPositive_state (txOutState traIn) \\\n (l \\ Nil \\ isQuiescent (txOutContract traIn) (txOutState traIn)) \\\n playTraceAux traIn l = TransactionOutput traOut \\\n isQuiescent (txOutContract traOut) (txOutState traOut)\"\n apply (induction traIn l arbitrary:traOut rule:playTraceAux.induct)\n apply simp\n apply (simp del:validAndPositive_state.simps isQuiescent.simps computeTransaction.simps)\n subgoal for warnings payments state cont h t traOut\n apply (cases \"computeTransaction h state cont\")\n apply (simp del:validAndPositive_state.simps isQuiescent.simps computeTransaction.simps)\n using computeTransactionIsQuiescent computeTransaction_preserves_validAndPositive_state by simp_all\n done\n\ntheorem playTraceIsQuiescent : \"playTrace sl cont (Cons h t) = TransactionOutput traOut \\\n isQuiescent (txOutContract traOut) (txOutState traOut)\"\n by (metis TransactionOutputRecord.select_convs(3) list.discI playTrace.simps playTraceAuxIsQuiescent validAndPositive_initial_state)\n\n\nlemma reductionLoop_reduce_monotonic : \"reductionLoop True env sta cont wa ef = ContractQuiescent reduce nwa nef newState newCont \\ reduce\"\n apply (induction True env sta cont wa ef arbitrary:reduce nwa nef newState newCont rule:reductionLoop.induct)\n subgoal for env state contract warnings payments reduce nwa nef newState newCont\n apply (cases \"reduceContractStep env state contract\")\n apply (simp only:ReduceStepResult.case)\n subgoal premises fact for x11 x12 x13 x14\n apply (rule fact(1)[of x11 x12 x13 x14 \"(if x11 = ReduceNoWarning then warnings else x11 # warnings)\" \"(case x12 of ReduceNoPayment \\ payments | ReduceWithPayment payment \\ payment # payments)\" reduce nwa nef newState newCont])\n apply simp\n apply simp\n apply simp\n by (metis (lifting) ReduceStepResult.simps(8) fact(2) fact(3) reductionLoop.elims)\n apply simp\n by simp\n done\n\nlemma reduceContractUntilQuiescent_ifDifferentReduced : \"reduceContractUntilQuiescent si sta cont = ContractQuiescent reduce wa ef sta newCont \\ cont \\ newCont \\ reduce\"\n apply (simp only:reduceContractUntilQuiescent.simps)\n apply (simp only:reductionLoop.simps)\n apply (cases \"reduceContractStep si sta cont\")\n apply (simp only:ReduceStepResult.case Let_def)\n using reductionLoop_reduce_monotonic apply blast\n apply simp\n by auto\n\n\nend\n", "meta": {"author": "input-output-hk", "repo": "marlowe", "sha": "d2f7b3108894b7c3169c71214f1a2772716544bf", "save_path": "github-repos/isabelle/input-output-hk-marlowe", "path": "github-repos/isabelle/input-output-hk-marlowe/marlowe-d2f7b3108894b7c3169c71214f1a2772716544bf/isabelle/Core/QuiescentResult.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358548398982, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.28789703453908516}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | July 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2008 |\n | June 2008 (modified) |\n | |\n | CSP-Prover on Isabelle2009-2 |\n | October 2010 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_contraction\nimports CSP_F_domain CSP_T_contraction\nbegin\n\n(*****************************************************************\n\n 1. contraction failuresfun\n 2. contraction failuresFun\n 3. contraction [[ ]]Ffun\n 4. contraction [[ ]]FFun\n\n *****************************************************************)\n\n(*=============================================================*\n | traces fstF |\n *=============================================================*)\n\nlemma non_expanding_traces_fstF:\n \"noHide P ==> non_expanding (%M. traces P (fstF o M))\"\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o (op o fstF)\")\napply (simp)\napply (rule compo_non_expand)\napply (simp add: non_expanding_traces)\napply (simp add: non_expanding_op_fstF)\napply (simp add: fun_eq_iff)\ndone\n\nlemma contraction_alpha_traces_fstF:\n \"guarded P ==> contraction_alpha (%M. traces P (fstF o M)) (1/2)\"\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o (op o fstF)\")\napply (simp)\napply (rule compo_contra_alpha_non_expand)\napply (simp add: contraction_alpha_traces)\napply (simp add: non_expanding_op_fstF)\napply (simp add: fun_eq_iff)\ndone\n\n(*--------------------------------*\n | STOP,SKIP,DIV |\n *--------------------------------*)\n\n(*** STOP ***)\n\nlemma map_alpha_failures_STOP: \n \"0 <= alpha ==> map_alpha (failures (STOP)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_STOP: \n \"non_expanding (failures (STOP))\"\nby (simp add: non_expanding_def map_alpha_failures_STOP)\n\nlemma contraction_alpha_failures_STOP: \n \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (STOP)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*** SKIP ***)\n\nlemma map_alpha_failures_SKIP: \n \"0 <= alpha ==> map_alpha (failures (SKIP)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_SKIP: \n \"non_expanding (failures (SKIP))\"\nby (simp add: non_expanding_def map_alpha_failures_SKIP)\n\nlemma contraction_alpha_failures_SKIP: \n \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (SKIP)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*** DIV ***)\n\nlemma map_alpha_failures_DIV: \n \"0 <= alpha ==> map_alpha (failures (DIV)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_DIV: \n \"non_expanding (failures (DIV))\"\nby (simp add: non_expanding_def map_alpha_failures_DIV)\n\nlemma contraction_alpha_failures_DIV: \n \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (DIV)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*--------------------------------*\n | Act_prefix |\n *--------------------------------*)\n\nlemma contraction_half_failures_Act_prefix_lm: \n \"distance (failures (a -> P) M1, failures (a -> Q) M2) * 2\n = distance (failures P M1, failures Q M2)\"\napply (rule sym)\napply (simp add: to_distance_rs)\napply (rule rest_Suc_dist_half[simplified])\napply (rule allI)\napply (simp add: rest_setF_eq_iff)\napply (rule iffI)\n\n (* => *)\n apply (intro allI)\n apply (simp add: in_failures)\n apply (rule iffI)\n\n (* => *)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp)\n\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp)\n apply (erule iffE, simp)\n apply (insert trace_last_nil_or_unnil)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (simp add: appt_assoc_sym)\n apply (drule mp, fast)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n (* <= *)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp)\n\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp)\n apply (erule iffE, simp)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (simp add: appt_assoc_sym)\n apply (drule mp, fast)\n apply (simp)\n\n (* <= *)\n apply (intro allI)\n apply (drule_tac x=\" ^^^ s\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: in_failures)\n apply (rule iffI)\n\n (* => *)\n apply (elim conjE exE disjE)\n apply (simp)\n apply (erule iffE, simp)\n apply (simp add: appt_assoc_sym)\n apply (drule mp, force)\n apply (force)\n\n (* <= *)\n apply (elim conjE exE disjE)\n apply (simp)\n apply (erule iffE, simp)\n apply (simp add: appt_assoc_sym)\n apply (drule mp, force)\n apply (force)\ndone\n\n(*** contraction_half ***)\n\nlemma contraction_half_failures_Act_prefix: \n \"non_expanding (failures P)\n ==> contraction_alpha (failures (a -> P)) (1 / 2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp add: contraction_half_failures_Act_prefix_lm)\ndone\n\n(*** contraction ***)\n\nlemma contraction_failures_Act_prefix: \n \"non_expanding (failures P)\n ==> contraction (failures (a -> P))\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\nby (simp add: contraction_half_failures_Act_prefix)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Act_prefix: \n \"non_expanding (failures P)\n ==> non_expanding (failures (a -> P))\"\napply (rule contraction_non_expanding)\nby (simp add: contraction_failures_Act_prefix)\n\n(*--------------------------------*\n | Ext_pre_choice |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Ext_pre_choice_Act_prefix_rest_setF_sub:\n \"[| ALL a : X.\n failures (a -> Pf a) M1 .|. n <= failures (a -> Qf a) M2 .|. n |]\n ==> failures (? a:X -> Pf a) M1 .|. n <=\n failures (? a:X -> Qf a) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE disjE, simp_all)\n\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\" ^^^ sa\" in spec)\n apply (drule_tac x=\"Xa\" in spec)\n apply (simp)\n\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"s' ^^^ \" in spec)\n apply (drule_tac x=\"Xa\" in spec)\n apply (auto)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Ext_pre_choice_Act_prefix_rest_setF:\n \"[| ALL a : X.\n failures (a -> Pf a) M1 .|. n = failures (a -> Qf a) M2 .|. n |]\n ==> failures (? a:X -> Pf a) M1 .|. n =\n failures (? a:X -> Qf a) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Ext_pre_choice_Act_prefix_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Ext_pre_choice_Act_prefix_distF_nonempty:\n\"[| X ~= {} ; PQs = {(failures (a -> Pf a) M1, failures (a -> Qf a) M2)|a. a : X} |]\n ==> (EX PQ. PQ:PQs & \n distance(failures (? a:X -> Pf a) M1, failures (? a:X -> Qf a) M2)\n <= distance(fst PQ, snd PQ))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\napply (force)\n\napply (intro allI impI)\napply (rule Ext_pre_choice_Act_prefix_rest_setF)\napply (rule ballI)\napply (simp)\napply (drule_tac x=\"failures (a -> Pf a) M1\" in spec)\napply (drule_tac x=\"failures (a -> Qf a) M2\" in spec)\nby (auto)\n\n(*** contraction lemma ***)\n\nlemma contraction_half_failures_Ext_pre_choice_lm:\n \"[| X ~= {} ; ALL a. distance (failures (Pf a) M1, failures (Qf a) M2)\n <= distance (x1, x2) |]\n ==> distance (failures (? a:X -> Pf a) M1, failures (? a:X -> Qf a) M2) * 2 \n <= distance (x1, x2)\"\napply (insert Ext_pre_choice_Act_prefix_distF_nonempty\n [of X \"{(failures (a -> Pf a) M1, failures (a -> Qf a) M2) |a. a : X}\" \n Pf M1 Qf M2])\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (subgoal_tac \n \"distance (failures (aa -> Pf aa) M1, failures (aa -> Qf aa) M2) * 2\n = distance (failures (Pf aa) M1, failures (Qf aa) M2)\")\napply (drule_tac x=\"aa\" in spec)\napply (force)\nby (simp add: contraction_half_failures_Act_prefix_lm)\n\n(*** contraction_half ***)\n\nlemma contraction_half_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n ==> contraction_alpha (failures (? a:X -> (Pf a))) (1 / 2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (case_tac \"X = {}\")\napply (simp add: failures_iff)\nby (simp add: contraction_half_failures_Ext_pre_choice_lm)\n\n(*** Ext_pre_choice_evalT_contraction ***)\n\nlemma contraction_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n ==> contraction (failures (? a:X -> (Pf a)))\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\nby (simp add: contraction_half_failures_Ext_pre_choice)\n\n(*** Ext_pre_choice_evalT_non_expanding ***)\n\nlemma non_expanding_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n ==> non_expanding (failures (? a:X -> (Pf a)))\"\napply (rule contraction_non_expanding)\nby (simp add: contraction_failures_Ext_pre_choice)\n\n(*--------------------------------*\n | Ext_choice |\n *--------------------------------*)\n\n(*** rest_domT (subset) ***)\n\nlemma Ext_choice_rest_setF_sub:\n \"[| traces P1 (fstF o M1) .|. n <= traces P2 (fstF o M2) .|. n ;\n traces Q1 (fstF o M1) .|. n <= traces Q2 (fstF o M2) .|. n ;\n failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n |]\n ==> failures (P1 [+] Q1) M1 .|. n <= failures (P2 [+] Q2) M2 .|. n\"\napply (simp add: subdomT_iff subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE disjE, simp_all)\n\n apply (rotate_tac 2)\n apply (drule_tac x=\"s' ^^^ \" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule mp, simp, fast)\n apply (simp)\n\n apply (rotate_tac 3)\n apply (drule_tac x=\"s' ^^^ \" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule mp, simp, fast)\n apply (simp)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Ext_choice_rest_setF:\n \"[| traces P1 (fstF o M1) .|. n = traces P2 (fstF o M2) .|. n ;\n traces Q1 (fstF o M1) .|. n = traces Q2 (fstF o M2) .|. n ;\n failures P1 M1 .|. n = failures P2 M2 .|. n ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n |]\n ==> failures (P1 [+] Q1) M1 .|. n = failures (P2 [+] Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Ext_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Ext_choice_distF:\n\"[| PQTs = {(traces P1 (fstF o M1), traces P2 (fstF o M2)), \n (traces Q1 (fstF o M1), traces Q2 (fstF o M2))} ;\n PQFs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)} |]\n ==> (EX PQ. PQ:PQTs & \n distance(failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n <= distance((fst PQ), (snd PQ))) |\n (EX PQ. PQ:PQFs & \n distance(failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair_two)\napply (simp_all)\nby (auto intro: Ext_choice_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Ext_choice_lm:\n \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2))\n <= alpha * distance (x1, x2) ;\n distance (traces Q1 (fstF o M1), traces Q2 (fstF o M2))\n <= alpha * distance (x1, x2) ;\n distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n ==> distance (failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n <= alpha * distance (x1, x2)\"\napply (insert Ext_choice_distF\n [of \"{(traces P1 (fstF o M1), traces P2 (fstF o M2)), \n (traces Q1 (fstF o M1), traces Q2 (fstF o M2))}\"\n P1 M1 P2 M2 Q1 Q2\n \"{(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\"])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Ext_choice:\n \"[| map_alpha (%M. traces P (fstF o M)) alpha ; \n map_alpha (%M. traces Q (fstF o M)) alpha ;\n map_alpha (failures P) alpha ;\n map_alpha (failures Q) alpha |]\n ==> map_alpha (failures (P [+] Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Ext_choice_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Ext_choice:\n \"[| non_expanding (%M. traces P (fstF o M)) ;\n non_expanding (%M. traces Q (fstF o M)) ;\n non_expanding (failures P) ; non_expanding (failures Q) |]\n ==> non_expanding (failures (P [+] Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Ext_choice)\n\n(*** contraction ***)\n\nlemma contraction_alpha_failures_Ext_choice:\n \"[| contraction_alpha (%M. traces P (fstF o M)) alpha ;\n contraction_alpha (%M. traces Q (fstF o M)) alpha ;\n contraction_alpha (failures P) alpha ; \n contraction_alpha (failures Q) alpha|]\n ==> contraction_alpha (failures (P [+] Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Ext_choice)\n\n(*--------------------------------*\n | Int_choice |\n *--------------------------------*)\n\n(*** rest_domT (subset) ***)\n\nlemma Int_choice_rest_setF_sub:\n \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n |]\n ==> failures (P1 |~| Q1) M1 .|. n <= failures (P2 |~| Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim disjE conjE exE)\nby (force)+\n\n(*** rest_setF (equal) ***)\n\nlemma Int_choice_rest_setF:\n \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n |]\n ==> failures (P1 |~| Q1) M1 .|. n = failures (P2 |~| Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Int_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Int_choice_distF:\n\"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n ==> (EX PQ. PQ:PQs & \n distance(failures (P1 |~| Q1) M1, failures (P2 |~| Q2) M2)\n <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: Int_choice_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Int_choice_lm:\n \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n ==> distance (failures (P1 |~| Q1) M1, failures (P2 |~| Q2) M2)\n <= alpha * distance (x1, x2)\"\napply (insert Int_choice_distF\n [of \"{(failures P1 M1, failures P2 M2), \n (failures Q1 M1, failures Q2 M2)}\" P1 M1 P2 M2 Q1 Q2])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Int_choice:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n ==> map_alpha (failures (P |~| Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Int_choice_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Int_choice:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n ==> non_expanding (failures (P |~| Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Int_choice)\n\n(*** contraction ***)\n\nlemma contraction_alpha_failures_Int_choice:\n \"[| contraction_alpha (failures P) alpha ; \n contraction_alpha (failures Q) alpha|]\n ==> contraction_alpha (failures (P |~| Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Int_choice)\n\n(*--------------------------------*\n | Rep_int_choice |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Rep_int_choice_rest_setF_sub:\n \"[| ALL c : sumset C.\n failures (Pf c) M1 .|. n <= failures (Qf c) M2 .|. n |]\n ==> failures (!! :C .. Pf) M1 .|. n <=\n failures (!! :C .. Qf) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE bexE)\napply (rule_tac x=\"c\" in bexI)\nby (auto)\n\n(*** rest_setF (equal) ***)\n\nlemma Rep_int_choice_rest_setF:\n \"[| ALL c : sumset C.\n failures (Pf c) M1 .|. n = failures (Qf c) M2 .|. n |]\n ==> failures (!! :C .. Pf) M1 .|. n =\n failures (!! :C .. Qf) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Rep_int_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Rep_int_choice_distF_nonempty:\n\"[| sumset C ~= {} ; \n PQs = {(failures (Pf c) M1, failures (Qf c) M2)|c. c : sumset C} |]\n ==> (EX PQ. PQ:PQs & \n distance(failures (!! :C .. Pf) M1, failures (!! :C .. Qf) M2)\n <= distance(fst PQ, snd PQ))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\napply (fast)\n\napply (intro allI impI)\napply (rule Rep_int_choice_rest_setF)\nby (auto)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Rep_int_choice_lm:\n\"[| sumset C ~= {} ; \n ALL c. distance (failures (Pf c) M1, failures (Qf c) M2) \n <= alpha * distance (x1, x2) |]\n ==> distance(failures (!! :C .. Pf) M1, failures (!! :C .. Qf) M2)\n <= alpha * distance(x1, x2)\"\napply (insert Rep_int_choice_distF_nonempty)\napply (insert Rep_int_choice_distF_nonempty\n [of C \"{(failures (Pf c) M1, failures (Qf c) M2)|c. c : sumset C}\"\n Pf M1 Qf M2])\napply (simp)\napply (elim conjE exE, simp)\napply (drule_tac x=\"c\" in spec)\nby (force)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Rep_int_choice:\n \"ALL c. map_alpha (failures (Pf c)) alpha\n ==> map_alpha (failures (!! :C .. Pf)) alpha\"\napply (simp add: map_alpha_def)\napply (case_tac \"sumset C = {}\")\n apply (simp add: failures_iff)\n(* apply (simp add: real_mult_order_eq) *)\napply (simp add: map_alpha_failures_Rep_int_choice_lm)\ndone\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Rep_int_choice:\n \"ALL c. non_expanding (failures (Pf c))\n ==> non_expanding (failures (!! :C .. Pf))\"\nby (simp add: non_expanding_def map_alpha_failures_Rep_int_choice)\n\n(*** Rep_int_choice_evalT_contraction_alpha ***)\n\nlemma contraction_alpha_failures_Rep_int_choice:\n \"ALL c. contraction_alpha (failures (Pf c)) alpha \n ==> contraction_alpha (failures (!! :C .. Pf)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Rep_int_choice)\n\n(*--------------------------------*\n | IF |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma IF_rest_setF_sub:\n \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n |]\n ==> failures (IF b THEN P1 ELSE Q1) M1 .|. n <= \n failures (IF b THEN P2 ELSE Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma IF_rest_setF:\n \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n |]\n ==> failures (IF b THEN P1 ELSE Q1) M1 .|. n = \n failures (IF b THEN P2 ELSE Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: IF_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma IF_distF:\n \"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n ==> (EX PQ. PQ:PQs & \n distance(failures (IF b THEN P1 ELSE Q1) M1,\n failures (IF b THEN P2 ELSE Q2) M2)\n <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: IF_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_IF_lm:\n \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n ==> distance(failures (IF b THEN P1 ELSE Q1) M1,\n failures (IF b THEN P2 ELSE Q2) M2)\n <= alpha * distance (x1, x2)\"\napply (insert IF_distF\n [of \"{(failures P1 M1, failures P2 M2), \n (failures Q1 M1, failures Q2 M2)}\"P1 M1 P2 M2 Q1 Q2 b])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_IF:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n ==> map_alpha (failures (IF b THEN P ELSE Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_IF_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_IF:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n ==> non_expanding (failures (IF b THEN P ELSE Q))\"\nby (simp add: non_expanding_def map_alpha_failures_IF)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_IF:\n \"[| contraction_alpha (failures P) alpha ; contraction_alpha (failures Q) alpha|]\n ==> contraction_alpha (failures (IF b THEN P ELSE Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_IF)\n\n(*--------------------------------*\n | Parallel |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Parallel_rest_setF_sub:\n \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n |]\n ==> failures (P1 |[X]| Q1) M1 .|. n <= failures (P2 |[X]| Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE)\n\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (simp)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (simp)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (drule_tac x=\"Z\" in spec)\n\napply (erule disjE, simp) (* lengtht s < n *)\napply (erule par_tr_lengthtE)\napply (simp)\n\napply (elim conjE exE, simp) (* lengtht s = n *)\napply (simp add: par_tr_last)\napply (elim conjE exE, simp)\napply (erule par_tr_lengthtE)\napply (case_tac \"Suc (lengtht s'a) < n\", simp)\n apply (case_tac \"Suc (lengtht t') < n\", simp)\n apply (case_tac \"Suc (lengtht t') = n\", simp)\n apply (drule mp, force)\n apply (simp)\n apply (force) (* contradict *)\n\n apply (case_tac \"Suc (lengtht t') < n\", simp)\n apply (drule mp)\n apply (rule_tac x=\"s'a\" in exI, simp)\n apply (simp)\n\n apply (case_tac \"Suc (lengtht t') = n\", simp)\n apply (drule mp)\n apply (rule_tac x=\"s'a\" in exI, simp)\n apply (drule mp)\n apply (rule_tac x=\"t'\" in exI, simp)\n apply (simp)\n apply (force) (* contradict *)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Parallel_rest_setF:\n \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n |]\n ==> failures (P1 |[X]| Q1) M1 .|. n = failures (P2 |[X]| Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Parallel_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Parallel_distF:\n\"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n ==> (EX PQ. PQ:PQs & \n distance(failures (P1 |[X]| Q1) M1, failures (P2 |[X]| Q2) M2)\n <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: Parallel_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Parallel_lm:\n \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n ==> distance (failures (P1 |[X]| Q1) M1, failures (P2 |[X]| Q2) M2)\n <= alpha * distance (x1, x2)\"\napply (insert Parallel_distF\n [of \"{(failures P1 M1, failures P2 M2), \n (failures Q1 M1, failures Q2 M2)}\" P1 M1 P2 M2 Q1 Q2 X])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Parallel:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n ==> map_alpha (failures (P |[X]| Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Parallel_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Parallel:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n ==> non_expanding (failures (P|[X]| Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Parallel)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Parallel:\n \"[| contraction_alpha (failures P) alpha ; \n contraction_alpha (failures Q) alpha |]\n ==> contraction_alpha (failures (P |[X]| Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Parallel)\n\n(*--------------------------------*\n | Hiding |\n *--------------------------------*)\n\n(* cms rules for Hiding is not necessary \n because processes are guarded. *)\n\n(*--------------------------------*\n | Renaming |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Renaming_rest_setF_sub:\n \"failures P M1 .|. n <= failures Q M2 .|. n\n ==> failures (P [[r]]) M1 .|. n <= failures (Q [[r]]) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE)\n\napply (rule_tac x=\"sa\" in exI)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"[[r]]inv X\" in spec)\napply (simp)\n\napply (erule disjE)\napply (simp add: ren_tr_lengtht)\n\napply (elim conjE exE)\napply (simp add: ren_tr_lengtht)\napply (simp add: ren_tr_appt_decompo_right)\napply (elim conjE exE, simp)\nby (fast)\n\n(*** rest_setF (equal) ***)\n\nlemma Renaming_rest_setF:\n \"failures P M1 .|. n = failures Q M2 .|. n\n ==> failures (P [[r]]) M1 .|. n = failures (Q [[r]]) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Renaming_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Renaming_distF:\n \"distance(failures (P [[r]]) M1, failures (Q [[r]]) M2) <= \n distance(failures P M1, failures Q M2)\"\napply (simp only: to_distance_rs)\napply (rule rest_distance_subset)\nby (auto intro: Renaming_rest_setF)\n\n(*** map_alphaT lemma ***)\n\nlemma map_alpha_failures_Renaming_lm:\n \"distance(failures P M1, failures Q M2) <= alpha * distance (x1, x2)\n ==> distance(failures (P [[r]]) M1, failures (Q [[r]]) M2)\n <= alpha * distance(x1, x2)\"\napply (insert Renaming_distF[of P r M1 Q M2])\nby (simp)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Renaming:\n \"map_alpha (failures P) alpha\n ==> map_alpha (failures (P [[r]])) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Renaming_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Renaming:\n \"non_expanding (failures P)\n ==> non_expanding (failures (P [[r]]))\"\nby (simp add: non_expanding_def map_alpha_failures_Renaming)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Renaming:\n \"contraction_alpha (failures P) alpha\n ==> contraction_alpha (failures (P [[r]])) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Renaming)\n\n(*--------------------------------*\n | Seq_compo |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Seq_compo_rest_setF_sub:\n \"[| traces P1 (fstF o M1) .|. n <= traces P2 (fstF o M2) .|. n ;\n failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n |]\n ==> failures (P1 ;; Q1) M1 .|. n <= failures (P2 ;; Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_rest_domT)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (simp_all)\n\n (* case 1 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n (* case 2 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n apply (drule_tac x=\" sa ^^^ \" in spec)\n apply (simp)\n\n apply (insert trace_last_nil_or_unnil)\n apply (rotate_tac -1)\n apply (drule_tac x=\"t\" in spec)\n apply (erule disjE, simp)\n apply (rotate_tac 2)\n apply (drule sym)\n apply (simp)\n\n apply (elim conjE exE, simp)\n apply (simp add: appt_assoc_sym)\n apply (rotate_tac 1)\n apply (drule_tac x=\"sb ^^^ \" in spec)\n apply (drule_tac x=\"X\" in spec, simp)\n apply (elim conjE)\n\n apply (case_tac \"Suc (lengtht sb) < n\", simp)\n apply (case_tac \"Suc (lengtht sb) = n\", simp)\n apply (drule mp, force)\n apply (simp)\n apply (force)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Seq_compo_rest_setF:\n \"[| traces P1 (fstF o M1) .|. n = traces P2 (fstF o M2) .|. n ;\n failures P1 M1 .|. n = failures P2 M2 .|. n ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n |]\n ==> failures (P1 ;; Q1) M1 .|. n = failures (P2 ;; Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Seq_compo_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Seq_compo_distF:\n\"[| PQTs = {(traces P1 (fstF o M1), traces P2 (fstF o M2))} ;\n PQFs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)} |]\n ==> (EX PQ. PQ:PQTs & \n distance(failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n <= distance((fst PQ), (snd PQ))) |\n (EX PQ. PQ:PQFs & \n distance(failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair_two)\nby (auto intro: Seq_compo_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Seq_compo_lm:\n \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2)) \n <= alpha * distance (x1, x2) ;\n distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n ==> distance (failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n <= alpha * distance (x1, x2)\"\napply (insert Seq_compo_distF\n [of \"{(traces P1 (fstF o M1), traces P2 (fstF o M2))}\" P1 M1 P2 M2\n \"{(failures P1 M1, failures P2 M2), \n (failures Q1 M1, failures Q2 M2)}\" Q1 Q2])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Seq_compo:\n \"[| map_alpha (%M. traces P (fstF o M)) alpha ; \n map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n ==> map_alpha (failures (P ;; Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Seq_compo_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Seq_compo:\n \"[| non_expanding (%M. traces P (fstF o M)) ;\n non_expanding (failures P) ; non_expanding (failures Q) |]\n ==> non_expanding (failures (P ;; Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Seq_compo)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Seq_compo:\n \"[| contraction_alpha (%M. traces P (fstF o M)) alpha ;\n contraction_alpha (failures P) alpha ; \n contraction_alpha (failures Q) alpha|]\n ==> contraction_alpha (failures (P ;; Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Seq_compo)\n\n(*--------------------------------*\n | Seq_compo (gSKIP) |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma gSKIP_Seq_compo_rest_setF_sub:\n \"[| traces P1 (fstF o M1) .|. (Suc n) <= traces P2 (fstF o M2) .|. (Suc n) ;\n failures P1 M1 .|. (Suc n) <= failures P2 M2 .|. (Suc n) ;\n failures Q1 M1 .|. n <= failures Q2 M2 .|. n ;\n ~:t traces P1 (fstF o M1) ;\n ~:t traces P2 (fstF o M2) |]\n ==> failures (P1 ;; Q1) M1 .|. (Suc n) <= failures (P2 ;; Q2) M2 .|. (Suc n)\"\napply (simp add: subsetF_iff)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_rest_domT)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (simp_all)\n\n (* case 1 *)\n apply (insert trace_last_nil_or_unnil)\n apply (rotate_tac -1)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE)\n apply (simp add: gSKIP_to_Tick_notin_traces) (* sa = []t *)\n\n apply (rule disjI2) (* sa ~= []t *)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"(sb ^^^ )\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n (* case 2 *)\n apply (rotate_tac -1)\n apply (drule_tac x=\"t\" in spec)\n apply (erule disjE) \n apply (simp) (* t = []t *)\n apply (rotate_tac 5)\n apply (drule sym)\n apply (simp) (* contradict noTick *)\n\n apply (rule disjI2) (* t ~= []t *)\n apply (elim conjE exE, simp)\n apply (simp add: appt_assoc_sym)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"sb ^^^ \" in exI)\n apply (simp add: appt_assoc)\n\n apply (insert trace_last_nil_or_unnil)\n apply (rotate_tac -1)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE)\n apply (simp add: gSKIP_to_Tick_notin_traces) (* sa = []t *)\n apply (elim conjE exE, simp)\n (* i.e. lengtht sb < n *)\n apply (rotate_tac 2)\n apply (drule_tac x=\"sb ^^^ \" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule mp)\n apply (simp)\n apply (case_tac \"Suc (lengtht sb) < n\", simp)\n apply (case_tac \"Suc (lengtht sb) = n\", fast)\n apply (force)\n apply (simp)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma gSKIP_Seq_compo_rest_setF:\n \"[| traces P1 (fstF o M1) .|. (Suc n) = traces P2 (fstF o M2) .|. (Suc n) ;\n failures P1 M1 .|. (Suc n) = failures P2 M2 .|. (Suc n) ;\n failures Q1 M1 .|. n = failures Q2 M2 .|. n ;\n ~:t traces P1 (fstF o M1) ;\n ~:t traces P2 (fstF o M2) |]\n ==> failures (P1 ;; Q1) M1 .|. (Suc n) = failures (P2 ;; Q2) M2 .|. (Suc n)\"\napply (rule order_antisym)\nby (simp_all add: gSKIP_Seq_compo_rest_setF_sub)\n\n(*** map_alpha F lemma ***)\n\nlemma gSKIP_map_alpha_failures_Seq_compo_lm:\n \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2)) * 2 <= (1/2)^n ;\n distance (failures P1 M1, failures P2 M2) * 2 <= (1/2)^n ;\n distance (failures Q1 M1, failures Q2 M2) <= (1/2)^n ;\n ~:t traces P1 (fstF o M1);\n ~:t traces P2 (fstF o M2) |]\n ==> distance (failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2) * 2\n <= (1/2)^n\"\napply (insert gSKIP_Seq_compo_rest_setF[of P1 M1 n P2 M2 Q1 Q2])\napply (simp only: to_distance_rs)\napply (simp add: distance_rs_le_1)\ndone\n\n(*** map_alpha ***)\n\nlemma gSKIP_contraction_half_failures_Seq_compo:\n \"[| contraction_alpha (%M. traces P (fstF o M)) (1/2) ;\n contraction_alpha (failures P) (1/2) ; non_expanding (failures Q) ;\n gSKIP P |]\n ==> contraction_alpha (failures (P ;; Q)) (1/2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\n\napply (case_tac \"x = y\", simp)\napply (simp only: to_distance_rs)\napply (simp add: distance_iff)\napply (insert gSKIP_to_Tick_notin_traces)\napply (frule_tac x=\"P\" in spec)\napply (drule_tac x=\"P\" in spec)\napply (drule_tac x=\"fstF o x\" in spec)\napply (drule_tac x=\"fstF o y\" in spec)\napply (fold to_distance_rs)\napply (simp add: gSKIP_map_alpha_failures_Seq_compo_lm)\ndone\n\n(*--------------------------------*\n | Depth_rest |\n *--------------------------------*)\n\n(*** rest_setF (equal) ***)\n\nlemma Depth_rest_rest_setF:\n \"failures P M1 .|. n = failures Q M2 .|. n\n ==> failures (P |. m) M1 .|. n = failures (Q |. m) M2 .|. n\"\napply (simp add: failures.simps)\napply (simp add: min_rs)\napply (rule rest_equal_preserve)\napply (simp)\napply (simp add: min_def)\ndone\n\n(*** distF lemma ***)\n\nlemma Depth_rest_distF:\n \"distance(failures (P |. m) M1, failures (Q |. m) M2) <= \n distance(failures P M1, failures Q M2)\"\napply (simp add: to_distance_rs)\napply (rule rest_distance_subset)\nby (auto intro: Depth_rest_rest_setF)\n\n(*** map_alphaT lemma ***)\n\nlemma map_alpha_failures_Depth_rest_lm:\n \"distance(failures P M1, failures Q M2) <= alpha * distance (x1, x2)\n ==> distance(failures (P |. m) M1, failures (Q |. m) M2)\n <= alpha * distance(x1, x2)\"\napply (insert Depth_rest_distF[of P m M1 Q M2])\nby (simp)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Depth_rest:\n \"map_alpha (failures P) alpha\n ==> map_alpha (failures (P |. n)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Depth_rest_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Depth_rest:\n \"non_expanding (failures P)\n ==> non_expanding (failures (P |. n))\"\nby (simp add: non_expanding_def map_alpha_failures_Depth_rest)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Depth_rest:\n \"contraction_alpha (failures P) alpha\n ==> contraction_alpha (failures (P |. n)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Depth_rest)\n\n(*--------------------------------*\n | variable |\n *--------------------------------*)\n\n(*** non_expanding ***)\n\nlemma continuous_failures_variable_lm:\n \"non_expanding (sndF o (%M. M p))\"\napply (rule compo_non_expand)\napply (simp add: non_expanding_sndF)\napply (simp add: non_expanding_prod_variable)\ndone\n\nlemma non_expanding_failures_variable: \n \"non_expanding (failures ($p))\"\napply (simp add: failures_iff)\napply (simp add: continuous_failures_variable_lm[simplified comp_def])\ndone\n\n(*--------------------------------*\n | Procfun |\n *--------------------------------*)\n\n(*****************************************************************\n | non_expanding |\n *****************************************************************)\n\nlemma non_expanding_failures_lm:\n \"noHide P --> non_expanding (failures P)\"\napply (induct_tac P)\napply (simp add: non_expanding_failures_STOP)\napply (simp add: non_expanding_failures_SKIP)\napply (simp add: non_expanding_failures_DIV)\napply (simp add: non_expanding_failures_Act_prefix)\napply (simp add: non_expanding_failures_Ext_pre_choice)\napply (simp add: non_expanding_failures_Ext_choice non_expanding_traces_fstF)\napply (simp add: non_expanding_failures_Int_choice)\napply (simp add: non_expanding_failures_Rep_int_choice)\napply (simp add: non_expanding_failures_IF)\napply (simp add: non_expanding_failures_Parallel)\n\n(* hiding --> const *)\napply (intro impI)\napply (subgoal_tac \"EX F. (failures (x1 -- x2) = (%M. F))\") (* 2012 *)\napply (erule exE)\napply (simp)\napply (simp add: non_expanding_Constant)\napply (rule failures_noPN_Constant)\napply (simp)\n\napply (simp add: non_expanding_failures_Renaming)\napply (simp add: non_expanding_failures_Seq_compo non_expanding_traces_fstF)\n\n(* Depth_res *)\napply (simp add: non_expanding_failures_Depth_rest)\napply (simp add: failures_iff)\napply (simp add: zero_rs_setF)\napply (simp add: non_expanding_Constant)\n\napply (simp add: non_expanding_failures_variable)\ndone\n\nlemma non_expanding_failures: \n \"noHide P ==> non_expanding (failures P)\"\nby (simp add: non_expanding_failures_lm)\n\n(*=============================================================*\n | [[P]]Ff |\n *=============================================================*)\n\nlemma non_expanding_semFf:\n \"noHide P ==> non_expanding ([[P]]Ff)\"\napply (simp add: semFf_def)\napply (simp add: non_expanding_domF_decompo)\napply (simp add: non_expanding_traces_fstF)\napply (simp add: non_expanding_failures)\ndone\n\n(*=============================================================*\n | [[P]]Ffun |\n *=============================================================*)\n\nlemma non_expanding_semFfun: \n \"noHidefun Pf ==> non_expanding ([[Pf]]Ffun)\"\napply (simp add: semFfun_def)\napply (simp add: prod_non_expand)\napply (simp add: proj_fun_def comp_def)\napply (simp add: noHidefun_def)\napply (simp add: non_expanding_semFf)\ndone\n\n(*****************************************************************\n | contraction |\n *****************************************************************)\n\nlemma contraction_alpha_failures_lm: \n \"guarded P --> contraction_alpha (failures P) (1/2)\"\napply (induct_tac P)\napply (simp add: contraction_alpha_failures_STOP)\napply (simp add: contraction_alpha_failures_SKIP)\napply (simp add: contraction_alpha_failures_DIV)\napply (simp add: contraction_half_failures_Act_prefix\n non_expanding_failures)\napply (simp add: contraction_half_failures_Ext_pre_choice\n non_expanding_failures)\napply (simp add: contraction_alpha_failures_Ext_choice\n contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures_Int_choice)\napply (simp add: contraction_alpha_failures_Rep_int_choice)\napply (simp add: contraction_alpha_failures_Rep_int_choice)\napply (simp add: contraction_alpha_failures_IF)\napply (simp add: contraction_alpha_failures_Parallel)\n\n(* hiding --> const *)\napply (intro impI)\napply (subgoal_tac \"EX F. (failures (x1 -- x2) = (%M. F))\") (* 2012 *)\napply (erule exE)\napply (simp add: contraction_alpha_Constant)\napply (rule failures_noPN_Constant)\napply (simp)\n\napply (simp add: contraction_alpha_failures_Renaming)\n\n(* Seq_compo *)\napply (simp)\napply (intro conjI impI)\napply (simp add: gSKIP_contraction_half_failures_Seq_compo\n non_expanding_failures contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures_Seq_compo\n contraction_alpha_traces_fstF)\n\n(* Depth_res *)\napply (simp add: contraction_alpha_failures_Depth_rest)\napply (simp add: failures_iff)\napply (simp add: zero_rs_setF)\napply (simp add: contraction_alpha_Constant)\n\napply (simp add: non_expanding_failures_variable)\ndone\n\nlemma contraction_alpha_failures: \n \"guarded P ==> contraction_alpha (failures P) (1/2)\"\napply (simp add: contraction_alpha_failures_lm)\ndone\n\n(*=============================================================*\n | [[P]]Ff |\n *=============================================================*)\n\nlemma contraction_alpha_semFf:\n \"guarded P ==> contraction_alpha ([[P]]Ff) (1/2)\"\napply (simp add: semFf_def)\napply (simp add: contraction_alpha_domF_decompo)\napply (simp add: contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures)\ndone\n\n(*=============================================================*\n | [[P]]Ffun |\n *=============================================================*)\n\nlemma contraction_alpha_semFfun: \n \"guardedfun Pf ==> contraction_alpha ([[Pf]]Ffun) (1/2)\"\napply (simp add: semFfun_def)\napply (simp add: prod_contra_alpha)\napply (simp add: proj_fun_def comp_def)\napply (simp add: guardedfun_def)\napply (simp add: contraction_alpha_semFf)\ndone\n\n(*=============================================================*\n | contraction |\n *=============================================================*)\n\nlemma contraction_semFfun: \n \"guardedfun Pf ==> contraction ([[Pf]]Ffun)\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\napply (simp add:contraction_alpha_semFfun)\ndone\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_contraction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.287893102723159}} {"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\n\n\ntheory CleanQ_SimpleQ\n imports \n \"AutoCorres.AutoCorres\"\n CleanQ_RB\nbegin\n\n(* ==================================================================================== *)\nsubsection \\Constants and Type Definitions\\\n(* ==================================================================================== *)\n\ntext \\\n We define a few type synonyms and constants to reason about addresses\n\\\ntype_synonym ulong_t = \"64 word\"\ntype_synonym uint_t = \"32 word\"\ntype_synonym ushort_t = \"16 word\"\n\nabbreviation \"addrlimit \\ (0xffffffffffffffff::ulong_t)\"\nabbreviation \"addrlimitnat \\ (0xffffffffffffffff::nat)\"\n\nlemma \"addrlimit = of_nat addrlimitnat\"\n by(auto)\nlemma \"unat (addrlimit) = addrlimitnat\"\n by(auto)\n\n\ndeclare[[show_types ]]\nsledgehammer_params[timeout = 120, provers = cvc4 z3 spass e vampire]\n \n\n(* ==================================================================================== *)\nsubsection \\Helper Lemmas\\\n(* ==================================================================================== *)\n\nlemma unat_64word_eq_lt_lt:\n \"unat (C::ulong_t) = ULONG_MAX \\ (D::ulong_t) < C \\ unat (D) < ULONG_MAX\"\n by(simp add: word_less_nat_alt)\n\nlemma unat_32word_eq_lt_lt:\n \"unat (C::uint_t) = UINT_MAX \\ (D::uint_t) < C \\ unat (D) < UINT_MAX\"\n by(simp add: word_less_nat_alt)\n\nlemma unat_64word_lt_lt_lt:\n \"unat (C::ulong_t) < ULONG_MAX \\ (D::ulong_t) < C \\ unat (D) < ULONG_MAX\"\n by(simp add: word_less_nat_alt)\n\nlemma unat_32word_lt_lt_lt:\n \"unat (C::uint_t) < UINT_MAX \\ (D::uint_t) < C \\ unat (D) < UINT_MAX\"\n by(simp add: word_less_nat_alt)\n\nlemma unat_64word_leq_lt_lt: \n \"unat (C::ulong_t) \\ ULONG_MAX \\ (D::ulong_t) < C \\ unat (D) < ULONG_MAX\"\n using unat_64word_eq_lt_lt unat_64word_lt_lt_lt PackedTypes.order_leE \n by blast\n\nlemma unat_32word_leq_lt_lt: \n \"unat (C::uint_t) \\ UINT_MAX \\ (D::uint_t) < C \\ unat (D) < UINT_MAX\"\n using unat_32word_eq_lt_lt unat_32word_lt_lt_lt PackedTypes.order_leE \n by blast\n\nlemma unat_64word_lt_succ_leq:\n \"unat (C::ulong_t) \\ ULONG_MAX \\ (D::ulong_t) < C \\ Suc (unat (D)) \\ ULONG_MAX\"\n using unat_64word_leq_lt_lt by (simp add: less_eq_Suc_le) \n\nlemma unat_32word_lt_succ_leq:\n \"unat (C::uint_t) \\ ULONG_MAX \\ (D::uint_t) < C \\ Suc (unat (D)) \\ UINT_MAX\"\n using unat_32word_leq_lt_lt by (simp add: less_eq_Suc_le) \n\nlemma unat_64word_succ_mod:\n assumes sz: \"1 < unat N\" and hlt: \"H < N\"\n shows\n \"unat (((H::ulong_t) + 1) mod (N::ulong_t)) = Suc (unat (H)) mod unat (N)\"\n using sz hlt \n by (metis add.commute less_is_non_zero_p1 unatSuc unat_mod)\n\nlemma unat_32word_succ_mod:\n assumes sz: \"1 < unat N\" and hlt: \"H < N\"\n shows\n \"unat (((H::uint_t) + 1) mod (N::uint_t)) = Suc (unat (H)) mod unat (N)\"\n using sz hlt \n by (metis add.commute less_is_non_zero_p1 unatSuc unat_mod)\n\nlemma unat_word_lt: \n \"a < b \\ unat a < unat b\"\n by (simp add: unat_mono)\n\nlemma unat_word_leq: \n \"a \\ b \\ unat a \\ unat b\"\n by (simp add: word_le_nat_alt)\n\nlemma word64_mult_inequality:\n assumes notzero: \"c \\ 0\" \n and inrangex: \"x * unat(c) < 2 ^ 64\"\n and inrangey: \"unat(y) * unat(c) < 2 ^ 64\"\n and neq: \"x \\ unat y\"\n shows \"((of_nat x)::ulong_t) * (c::ulong_t) \\ (y::ulong_t) * (c::ulong_t)\"\nproof -\n from notzero inrangex have xlim:\n \"x < 2 ^ 64\"\n by (metis linorder_neqE_nat multi_lessD not_less0 unat_gt_0)\n\n have xc_limit:\n \"unat ((of_nat x)::ulong_t) * unat c < 2 ^ 64\"\n using xlim unat_of_nat64 word_bits_conv inrangex by(auto)\n\n have xc_equiv:\n \"unat (((of_nat x)::ulong_t) * c) = x * unat c\"\n using xc_limit unat_mult_lem unat_of_nat64 word_bits_conv inrangex by fastforce\n \n have yc_equiv: \n \"unat (y * c) = unat(y) * unat (c)\"\n using inrangey unat_mult_lem by fastforce\n\n show ?thesis\n using xc_equiv yc_equiv neq notzero unat_eq_zero\n by force\nqed\n\nlemma word64_mult_inequality2:\n assumes notzero: \"c \\ 0\" \n and inrangex: \" x * unat(c) \\ unat addrlimit\"\n and inrangey: \"unat (y) * unat (c) \\ unat addrlimit\"\n and neq: \"x \\ unat y\"\n shows \"((of_nat x)::ulong_t) * (c::ulong_t) \\ (y::ulong_t) * (c::ulong_t)\"\nproof -\n from notzero inrangex have xlim0:\n \"x \\ unat addrlimit\"\n using dual_order.trans unat_eq_zero by fastforce\n\n from xlim0 have xlim:\n \"x < 2 ^ 64\"\n by (metis (mono_tags, hide_lams) le_unat_uoi word_bits_conv unat_less_2p_word_bits)\n\n from xlim have xc_limit:\n \"unat ((of_nat x)::ulong_t) * unat c < 2 ^ 64\"\n by (metis (no_types, hide_lams) le_unat_uoi unat_less_2p_word_bits\n unat_of_nat64 word_bits_conv inrangex)\n\n have xc_equiv:\n \"unat (((of_nat x)::ulong_t) * c) = x * unat c\"\n using inrangex le_unat_uoi by fastforce\n have yc_equiv: \n \"unat (y * c) = unat(y) * unat (c)\"\n using inrangey le_unat_uoi by fastforce\n\n show ?thesis\n using xc_equiv yc_equiv neq notzero unat_eq_zero \n by force\nqed\n\nlemma word64_multply_const_equaltiy:\nassumes notzero: \"c \\ (0::ulong_t)\"\n and hclimit: \"unat (h) * unat (c) < 2 ^ 64\"\n and xclimit: \"x * unat (c) < 2 ^ 64\"\nshows \"((of_nat x)::ulong_t) * (c::ulong_t) = (h::ulong_t) * (c::ulong_t) \\ x = unat (h)\"\n using hclimit notzero word64_mult_inequality xclimit by fastforce\n\n(* ==================================================================================== *)\nsubsection \\SimpleQ C Implementation\\\n(* ==================================================================================== *)\n\ntext \\\n Next we load the CleanQ_SimpleQ.c implementation of a shared-memory ring buffer, and\n show that the C implementation refines the abstract ring buffer implementation.\n\\\n\nexternal_file \"CleanQ_SimpleQ.c\"\ninstall_C_file \"CleanQ_SimpleQ.c\"\n\nautocorres [\n\n (* Name compatibility options *)\n lifted_globals_field_prefix=\"c_glbl_\",\n lifted_globals_field_suffix=\"\",\n function_name_prefix=\"\",\n function_name_suffix=\"_c_fun\",\n\n\n (* heap abstraction options *)\n \n (* no_heap_abs = FUNC_NAMES, *)\n (* Disable _heap abstraction_ on the given list of functions. *)\n\n (* force_heap_abs = FUNC_NAMES, *)\n (* Attempt _heap abstraction_ on the given list of functions *)\n\n (* heap_abs_syntax, *)\n (* Enable experimental heap abstraction syntactic sugar. *)\n\n (* skip_heap_abs *)\n (* Completely disable _heap abstraction_ *)\n\n\n (* word abstraction options *)\n\n unsigned_word_abs = rb_can_deq rb_can_enq rb_enq rb_deq rb_deq_unfolded rb_enq_unfolded ,\n (* Use _word abstraction_ on unsigned integers in the given functions. *)\n\n no_signed_word_abs = rb_can_deq rb_can_enq rb_enq rb_deq rb_deq_unfolded rb_enq_unfolded,\n (* Disable signed _word abstraction_ on the given list of functions. *)\n\n (* skip_word_abs, *)\n (* Completely disable _word abstraction_. *)\n\n\n (* type strengthening options *)\n ts_rules = pure option nondet, \n (* Enable _type strengthening_ to the following types. pure, option, gets nondet *)\n\n ts_force nondet = rb_can_deq rb_can_enq rb_enq rb_deq rb_deq_unfolded rb_enq_unfolded,\n (* Force the given functions to be type-strengthened to the given type *)\n\n\n (* translation scoping options *)\n (* scope = FUNC_NAMES, *)\n (* Only translate the given functions and their callees, up to depth `scope_depth`. *)\n\n (* scope_depth = N, *)\n (* Call depth for `scope` *)\n\n\n (* less common, debugging options *)\n\n (*keep_going, *)\n (* Attempt to ignore certain non-critical errors. *)\n\n (* trace_heap_lift = FUNC_NAMES`, *)\n (* Trace the _heap abstraction_ process for each of the given functions. *)\n\n (* trace_word_abs = FUNC_NAMES`: *) \n (* As above, but traces _word abstraction_. *)\n\n (* trace_opt, *)\n (* As above, but traces internal simplification phases (for all functions).*)\n\n (* no_opt, *)\n (* Disable some optimisation passes that simplify the AutoCorres output. *)\n\n gen_word_heaps,\n (* Force _heap abstraction_ to create abstract heaps for standard `word` types *)\n\n\n (* seL4 proof options *)\n\n no_c_termination\n (* Generate SIMPL wrappers and correspondence proofs *)\n\n (* c_locale = Name *)\n (* Run in this locale, rather than the default locale *)\n\n] \"CleanQ_SimpleQ.c\"\n(* skip_word_abs *)\n\ntext \\\n We can now enter the defined context by autocorres. \n\\\n\ncontext CleanQ_SimpleQ begin\n\n(* ==================================================================================== *)\nsubsection \\C Definitions\\\n(* ==================================================================================== *)\n\nabbreviation \"ERR_OK \\ (0)\"\nabbreviation \"ERR_QUEUE_FULL \\ (-1)\"\nabbreviation \"ERR_QUEUE_EMPTY \\ (-2)\"\nabbreviation \"ERR_NO_BUFFERS \\ (-3)\"\n\n(* ==================================================================================== *)\nsubsection \\Invariant\\\n(* ==================================================================================== *)\n\ntext \\\n We now define the validity invariant for the ring buffer struct. We first define\n abbrevations for each of the field\n\\\n\nabbreviation \"c_rb_valid_is_valid s rb \\ is_valid_rb_C s rb\"\nabbreviation \"c_rb_valid_size s rb \\ 1 < (size_C (heap_rb_C s rb))\"\nabbreviation \"c_rb_valid_head s rb \\ head_C (heap_rb_C s rb) < size_C (heap_rb_C s rb)\"\nabbreviation \"c_rb_valid_tail s rb \\ tail_C (heap_rb_C s rb) < size_C (heap_rb_C s rb)\"\nabbreviation \"c_rb_valid_ring s rb \\ (\\i \\ uint (size_C (heap_rb_C s rb)). \n is_valid_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p i) \\\n ptr_val (ring_C (heap_rb_C s rb) +\\<^sub>p i) \\ addrlimit)\"\n\n(* this one should be the pre-condition for the operation *)\ndefinition c_rb_valid :: \"lifted_globals \\ rb_C ptr \\ bool\"\n where \"c_rb_valid s rb \\ c_rb_valid_is_valid s rb \n \\ c_rb_valid_size s rb \\ c_rb_valid_head s rb\n \\ c_rb_valid_tail s rb \\ c_rb_valid_ring s rb\"\n\n\ntext \"We can now define the set of valid entries in the ring buffer\"\n\ndefinition c_rb_valid_entries :: \"lifted_globals \\ rb_C ptr \\ nat list\"\n where \"c_rb_valid_entries s rb = \n (if (tail_C (heap_rb_C s rb)) \\ (head_C (heap_rb_C s rb))\n then [unat (tail_C (heap_rb_C s rb)) ..< unat (head_C (heap_rb_C s rb))]\n else [unat (tail_C (heap_rb_C s rb))..< unat (size_C (heap_rb_C s rb))]\n @ [0.. rb_C ptr \\ bool\"\n where \"c_rb_empty s rb = (tail_C (heap_rb_C s rb) = head_C (heap_rb_C s rb))\"\n\n\n\nlemma c_rb_not_empty_valid_entries:\n \"c_rb_valid s0 rb \\ \\ c_rb_empty s0 rb \\ c_rb_valid_entries s0 rb \\ []\"\n unfolding c_rb_valid_entries_def c_rb_valid_def c_rb_empty_def\n apply(auto simp add: word_le_nat_alt) \n using dual_order.antisym apply fastforce\n using unat_eq_zero apply force\n using leD unat_word_lt by blast\n\n\nlemma c_rb_valid_entries_head_not_in_set:\n \"unat (head_C (heap_rb_C s0 rb)) \\ set (c_rb_valid_entries s0 rb)\"\n unfolding c_rb_valid_entries_def \n by (auto simp: word_le_nat_alt)\n\n\n\nlemma c_rb_valid_entries_tail_first1:\n \"c_rb_valid s0 rb \\ \\ c_rb_empty s0 rb \\\n unat (tail_C (heap_rb_C s0 rb)) = hd (c_rb_valid_entries s0 rb)\"\nproof -\n assume p1: \"c_rb_valid s0 rb\"\n assume p2: \"\\ c_rb_empty s0 rb\"\n\n from p1 have p3: \" unat (tail_C (heap_rb_C s0 rb)) < unat (size_C (heap_rb_C s0 rb))\"\n by(simp add:unat_mono c_rb_valid_def)\n\n show \"unat (tail_C (heap_rb_C s0 rb)) = hd (c_rb_valid_entries s0 rb)\"\n using p3 unfolding c_rb_valid_entries_def apply(auto simp:unat_word_lt) \n by (metis CleanQ_SimpleQ.c_rb_empty_def hd_upt order_leE p2 word_less_nat_alt)\nqed\n \n\n\nlemma c_rb_valid_entries_tail_in_set:\n \"c_rb_valid s0 rb \\ \\ c_rb_empty s0 rb \\\n unat (tail_C (heap_rb_C s0 rb)) \\ set (c_rb_valid_entries s0 rb)\"\n using c_rb_valid_entries_tail_first1 c_rb_not_empty_valid_entries\n by(auto)\n \n\n\n\n(* ==================================================================================== *)\nsubsection \\State Lifting\\\n(* ==================================================================================== *)\n\n\ntext \\\n We now define the lifting function which converts the \\verb+rb_C+ object into a\n \\verb+CleanQ_RB+ record. We use the \\verb+buffer_C+ representation for the buffer \n descriptor type in the record.\n\\\n\n(* \ndefinition\n the_rb :: \"lifted_globals \\ buffer_C ptr \\ nat \\ buffer\"\n where\n \"the_rb s b i = \\ base = unat (offset_C (heap_buffer_C s (b +\\<^sub>p i))),\n length = unat (length_C (heap_buffer_C s (b +\\<^sub>p i))) \\\"\n*)\n\n(* XXX: Should the ring here be taking the size of the ring buffer into account? \n ring = \\i. (if i < size_C (heap_rb_C s rb) then heap_buffer_C s ((ring_C (heap_rb_C s rb)) +\\<^sub>p i)),\n*)\ndefinition rb_C_to_CleanQ_RB :: \"lifted_globals \\ rb_C ptr \\ buffer_C CleanQ_RB\"\n where \"rb_C_to_CleanQ_RB s rb = \\ \n ring = \\i. (if i < unat (size_C (heap_rb_C s rb))\n then Some (heap_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p i))\n else None),\n head = unat (head_C (heap_rb_C s rb)), \n tail = unat (tail_C (heap_rb_C s rb)),\n size = unat (size_C (heap_rb_C s rb)) \\\"\n\ntext \\\n We can now show that if the C ringbuffer is valid, then the lifted state is also\n satisfying the validity predicate of the \\verb+CleanQ_RB+ model.\n\\\n\n\nlemma \"c_rb_valid s rb \\ rb_valid (rb_C_to_CleanQ_RB s rb)\"\n unfolding c_rb_valid_def rb_valid_def rb_C_to_CleanQ_RB_def\n using unat_word_lt\n oops\n\n\n(* ==================================================================================== *)\nsubsection \\Dequeue Operation\\\n(* ==================================================================================== *)\n\ntext \\\n Whether or not the dequeue operation performs the update, depends on whether the\n the ring buffer is empty or not. We first show that the \\verb+rb_can_deq+ function in \n C produces the same result as the corresponding definition in the \\verb+CleanQ_RB+ \n model.\n\\\n\nlemma c_can_deq:\n \"\\ \\s. c_rb_valid s rb \\\n rb_can_deq_c_fun rb\n \\ \\ r s. to_bool r = rb_can_deq (rb_C_to_CleanQ_RB s rb) \\!\"\n apply(subst rb_can_deq_c_fun_def)\n apply(wp)\n apply (simp add:rb_can_deq_def rb_empty_def rb_C_to_CleanQ_RB_def c_rb_valid_def)\n done\n\n\nlemma c_can_deq_return_values:\n \"\\ \\s. is_valid_rb_C s rb \\\n rb_can_deq_c_fun rb \n \\ \\ r s. r = 0 \\ r = 1 \\!\"\n unfolding rb_can_deq_c_fun_def\n by(wp, auto) \n\ntext \\\n For the dequeue operation, we can show that the operation preserves the size of the\n ring buffer, and the head pointer.\n\\\n\nlemma c_rb_deq_preserves_size :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\s0. \\ \\s. c_rb_valid s rb \\ s0 = s \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. size_C (heap_rb_C s rb) = size_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def)\n by (metis less_imp_le uint_0_iff uint_lt_0 unat_gt_0 word_less_def)\n \n\n\nlemma c_rb_deq_preserves_size2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ size_C (heap_rb_C s rb) = k \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. size_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def)\n by (metis less_imp_le uint_0_iff uint_lt_0 unat_gt_0 word_less_def)\n\n\nlemma c_rb_deq_preserves_head :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. head_C (heap_rb_C s rb) = head_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def)\n by (metis less_imp_le uint_0_iff uint_lt_0 unat_gt_0 word_less_def)\n\nlemma c_rb_deq_preserves_head2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ head_C (heap_rb_C s rb) = k \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. head_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def)\n by (metis less_imp_le uint_0_iff uint_lt_0 unat_gt_0 word_less_def)\n\n\ntext \\\n If the queue is empty, and the dequeue operation cannot pull another buffer from\n the ring, then the ring buffer remains in the same state. .\n\\\n\n\nlemma c_rb_deq_preserves_tail :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_deq_c_fun rb = return (0) \\\n rb_deq_c_fun rb b\n \\ \\ r s. tail_C (heap_rb_C s rb) = tail_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\nlemma c_rb_deq_preserves_tail2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ tail_C (heap_rb_C s rb) = k \\ rb_can_deq_c_fun rb = return (0) \\\n rb_deq_c_fun rb b\n \\ \\ r s. tail_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\ntext \\\n The dequeue operation does not change the ring at all\n\\\n\nlemma c_rb_deq_preserves_ring :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. ring_C (heap_rb_C s rb) = ring_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp add:c_rb_valid_def)\n using unat_word_lt apply fastforce\n using word_le_def word_le_less_eq apply blast \n done\n\nlemma c_rb_deq_preserves_ring2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ ring_C (heap_rb_C s rb) = k \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. ring_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp add:c_rb_valid_def)\n using unat_word_lt apply fastforce\n using word_le_def word_le_less_eq apply blast \n done\n\ntext \\\n Also, the ring contents are not changed. \n\\\n\nlemma c_rb_deq_preserves_ring_contents :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ is_valid_buffer_C s0 b \n \\ (\\i < size_C (heap_rb_C s rb). (ring_C (heap_rb_C s rb) +\\<^sub>p uint i) \\ b) \\\n rb_deq_c_fun rb b\n \\ \\ r s. \\i < size_C (heap_rb_C s rb). \n heap_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p uint i) = \n heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint i) \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp add:c_rb_valid_def)\n using unat_word_lt apply fastforce\n using word_le_def word_le_less_eq apply blast \n using unat_word_lt apply fastforce\n using less_imp_le word_le_def apply blast\n done\n\n\ntext \\\n In fact, if the ring buffer is empty, then the state is not altered at all.\n\\\n\nlemma c_rb_deq_empty_preserves_state:\n fixes rb :: \"rb_C ptr\" and b :: buffer_C\n shows \"\n \\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. r \\ 0 \\ s = s0 \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(simp)\n apply (smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\ntext \\\n We can show that the dequeue function preserves the valid predicate.\n\\\n\nlemma c_rb_deq_remains_valid:\n fixes rb :: \"rb_C ptr\" \n shows \"\n \\ \\s. c_rb_valid s rb \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. c_rb_valid s rb \\!\"\n apply(simp add:rb_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def)\n by (metis not_gr_zero not_less0 unat_0 word_le_def word_le_less_eq word_less_nat_alt \n word_mod_less_divisor)\n\n\ntext \\\n Lastly, we can show that the C implementation of the dequeue operation produces the \n same outcome as doing the abstraction operation.\n\\\n\nlemma c_rb_deq_state_update_head:\n\"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \n \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. head (rb_C_to_CleanQ_RB s rb) = head (snd (rb_deq rb0)) \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def rb_deq_equiv rb_deq_alt_def rb_C_to_CleanQ_RB_def)\n using less_imp_le unat_1_0 word_le_def word_le_less_eq by blast\n\n \nlemma c_rb_deq_state_update_tail:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_EMPTY) \\\n (if r = ERR_OK then tail (rb_C_to_CleanQ_RB s rb) = tail (snd (rb_deq rb0)) \n else s = s0) \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(auto simp add:c_rb_valid_def rb_deq_equiv rb_deq_alt_def rb_C_to_CleanQ_RB_def)\n using unat_32word_succ_mod unat_word_lt apply fastforce\n using unat_gt_0 apply fastforce\n using word_le_def word_le_less_eq by blast\n\n\nlemma c_rb_deq_state_update_size:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \n \\ rb0 = rb_C_to_CleanQ_RB s rb \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_EMPTY) \\\n size (rb_C_to_CleanQ_RB s rb) = size (snd (rb_deq rb0)) \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def rb_deq_equiv rb_deq_alt_def rb_C_to_CleanQ_RB_def)\n using less_imp_le unat_1_0 word_le_def word_le_less_eq by blast\n\n\nlemma c_rb_deq_state_update_ring:\n assumes notinring: \"(\\i \\ uint (size_C (heap_rb_C s0 rb)). \n (ring_C (heap_rb_C s0 rb) +\\<^sub>p i) \\ b)\"\n shows \"\n \\ \\s. c_rb_valid s rb \\ s0 = s \n \\ rb0 = rb_C_to_CleanQ_RB s rb \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_EMPTY) \\ \n (if r = ERR_OK then \\ i < uint (size_C (heap_rb_C s rb)). ring (rb_C_to_CleanQ_RB s rb) i = ring (snd (rb_deq rb0)) i\n else s = s0) \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+ \n apply(auto simp:c_rb_valid_def rb_deq_equiv rb_deq_alt_def)\n prefer 3 using word_le_def word_le_less_eq apply blast\n prefer 2 using unat_word_lt apply fastforce\n unfolding rb_C_to_CleanQ_RB_def using notinring by(auto)\n\nlemma c_rb_deq_buffer:\n assumes notinring: \"(\\i \\ uint (size_C (heap_rb_C s0 rb)). \n (ring_C (heap_rb_C s0 rb) +\\<^sub>p i) \\ b)\"\n shows \"\n \\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_EMPTY) \\ \n (if r = ERR_OK then heap_buffer_C s b = fst (rb_deq rb0) else s = s0)\n \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+ \n apply(auto simp:c_rb_valid_def rb_deq_equiv rb_deq_alt_def)\n prefer 3 \n using word_le_def word_le_less_eq apply blast\n prefer 2 \n using unat_word_lt apply fastforce\n unfolding rb_C_to_CleanQ_RB_def rb_deq_def rb_read_tail_def\n apply (simp add: int_unat)\n using unat_word_lt by blast\n\n\nlemma ringhelper:\n \"ring_C (heap_rb_C (heap_rb_C_update (\\a::rb_C ptr \\ rb_C. a(rb := tail_C_update (\\a::32 word. (tail_C (heap_rb_C s0 rb) + (1::32 word)) mod size_C (heap_rb_C s0 rb)) (a rb)))\n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0))\n rb) = ring_C (heap_rb_C s0 rb)\"\n by(auto)\n\nlemma bufferhelper:\n \" heap_buffer_C\n (heap_rb_C_update (\\a::rb_C ptr \\ rb_C. a(rb := tail_C_update (\\a::32 word. (tail_C (heap_rb_C s0 rb) + (1::32 word)) mod size_C (heap_rb_C s0 rb)) (a rb)))\n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0)) = \n heap_buffer_C\n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0)\"\n by(auto)\n\nlemma bufferhelper2:\n \" (i::nat) < uint (size_C (heap_rb_C s0 rb)) \\ (ring_C (heap_rb_C s0 rb) +\\<^sub>p i) \\ b \\\n (heap_buffer_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int i)) \n = (heap_buffer_C (s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int i))\"\n by(auto)\n\nlemma c_rb_deq_correct:\n assumes notinring: \"(\\i < uint (size_C (heap_rb_C s0 rb)). \n (ring_C (heap_rb_C s0 rb) +\\<^sub>p i) \\ b)\"\n shows \"\n \\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\ is_valid_buffer_C s0 b \\\n rb_deq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_EMPTY) \\ \n (if r = ERR_OK then rb_C_to_CleanQ_RB s rb = snd (rb_deq rb0) else s = s0)\n \\!\"\n unfolding rb_deq_c_fun_def\n apply(wp_once)+\n apply(simp add:rb_can_deq_c_fun_def)\n apply(wp_once)+ \n apply(auto simp:c_rb_valid_def rb_deq_equiv rb_deq_alt_def)\n prefer 3 \n using word_le_def word_le_less_eq apply blast\n prefer 2 \n using unat_word_lt apply fastforce\n unfolding rb_C_to_CleanQ_RB_def\n apply(auto)\n prefer 2 \n using unat_32word_succ_mod unat_word_lt apply fastforce\n apply(subst ringhelper)\n apply(subst bufferhelper)\n(* WHOAH.... *)\nproof -\n have \"\\n na. \\ n < unat (size_C (heap_rb_C s0 rb)) \\ \\ na < unat (size_C (heap_rb_C s0 rb)) \\ n < unat (size_C (heap_rb_C s0 rb)) \\ na < unat (size_C (heap_rb_C s0 rb)) \\ Some (heap_buffer_C (heap_buffer_C_update (\\f. f (b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int na)) = Some (heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p int na))\"\n by (metis CleanQ_SimpleQ.bufferhelper2 int_unat notinring of_nat_less_iff)\n then show \"(\\n. if n < unat (size_C (heap_rb_C s0 rb)) then Some (heap_buffer_C (heap_buffer_C_update (\\f. f (b := heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (tail_C (heap_rb_C s0 rb))))) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int n)) else None) = (\\n. if n < unat (size_C (heap_rb_C s0 rb)) then Some (heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p int n)) else None)\"\n by meson\nqed\n\n \nthm rb_enq_c_fun_def\nthm rb_can_enq_c_fun_def\n\n\n(* ==================================================================================== *)\nsubsection \\Enqueue Operation\\\n(* ==================================================================================== *)\n\ntext \\\n Whether or not the enqueue operation performs the update, depends on whether the\n the ring buffer is full or not. We first show that the \\verb+rb_can_enq+ function in \n C produces the same result as the corresponding definition in the \\verb+CleanQ_RB+ \n model.\n\\\n\nlemma c_can_enq:\n fixes rb :: \"rb_C ptr\"\n shows \n \"\\ \\s. c_rb_valid s rb \\\n rb_can_enq_c_fun rb\n \\ \\ r s. to_bool r = rb_can_enq (rb_C_to_CleanQ_RB s rb) \\!\"\n apply(subst rb_can_enq_c_fun_def)\n apply(wp, simp add:rb_can_enq_def rb_full_def rb_C_to_CleanQ_RB_def c_rb_valid_def)\n using Suc_le_eq unat_32word_leq_lt_lt unat_word_lt by fastforce\n\n\nlemma c_can_enq_return_values:\n \"\\ \\s. c_rb_valid s rb \\\n rb_can_enq_c_fun rb \n \\ \\ r s. r = 0 \\ r = 1 \\!\"\n unfolding rb_can_enq_c_fun_def\n apply(wp, simp)\n using c_rb_valid_def unat_32word_leq_lt_lt unat_gt_0 by fastforce\n\n\ntext \\\n For the enqueue operation, we can show that the operation preserves the size of the\n ring buffer, and the tail pointer.\n\\\n\nlemma c_rb_enq_preserves_size :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\\n rb_enq_c_fun rb b\n \\ \\ r s. size_C (heap_rb_C s rb) = size_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def unat_word_leq word_less_nat_alt) \n by (meson INT_MIN_MAX_lemmas(12) Suc_leI le_eq_less_or_eq less_le_trans un_ui_le)\n \n\nlemma c_rb_enq_preserves_size2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ size_C (heap_rb_C s rb) = k \\\n rb_enq_c_fun rb b\n \\ \\ r s. size_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def unat_word_leq word_less_nat_alt) \n by (meson INT_MIN_MAX_lemmas(12) Suc_le_eq less_imp_le_nat less_le_trans un_ui_le)\n\n\nlemma c_rb_enq_preserves_tail :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\\n rb_enq_c_fun rb b\n \\ \\ r s. tail_C (heap_rb_C s rb) = tail_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def word_less_nat_alt) \n by (meson INT_MIN_MAX_lemmas(12) Suc_leI le_eq_less_or_eq less_le_trans un_ui_le)\n\nlemma c_rb_enq_preserves_tail2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ tail_C (heap_rb_C s rb) = k \\\n rb_enq_c_fun rb b\n \\ \\ r s. tail_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def word_less_nat_alt) \n by (meson INT_MIN_MAX_lemmas(12) Suc_le_eq less_imp_le_nat less_le_trans un_ui_le)\n\n\ntext \\\n If the queue is full, and the enqueue operation cannot put another buffer into\n the ring, then the ring buffer remains in the same state. .\n\\\n\n\nlemma c_rb_enq_preserves_head :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. head_C (heap_rb_C s rb) = head_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\nlemma c_rb_enq_preserves_head2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ head_C (heap_rb_C s rb) = k \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. head_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n \nlemma c_rb_enq_preserves_ring :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. ring_C (heap_rb_C s rb) = ring_C (heap_rb_C s0 rb) \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\n\nlemma c_rb_enq_preserves_ring2 :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ ring_C (heap_rb_C s rb) = k \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. ring_C (heap_rb_C s rb) = k \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\ntext \\\n Also, the ring contents are not changed, if we're full\n\\\n\nlemma c_rb_enq_full_preserves_ring_contents :\n fixes rb :: \"rb_C ptr\"\n shows\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. heap_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p uint i) = \n heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p uint i) \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n by(smt hoare_assume_preNF validNF_chain validNF_return)\n\n\ntext \\\n In fact, if the ring buffer is full, then the state is not altered at all.\n\\\n\nlemma c_rb_enq_full_preserves_state:\n fixes rb :: \"rb_C ptr\" and b :: buffer_C\n shows \"\n \\ \\s. c_rb_valid s rb \\ s0 = s \\ rb_can_enq_c_fun rb = return (0) \\\n rb_enq_c_fun rb b\n \\ \\ r s. r \\ 0 \\ s = s0 \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(simp)\n apply (smt hoare_assume_preNF validNF_chain validNF_return)\n done\n\n\ntext \\\n We can show that the enqueue function preserves the valid predicate.\n\\\n\nlemma c_rb_enq_remains_valid:\n fixes rb :: \"rb_C ptr\" and b :: buffer_C\n shows \"\n \\ \\s. c_rb_valid s rb \\\n rb_enq_c_fun rb b\n \\ \\ r s. c_rb_valid s rb \\!\"\n apply(simp add:rb_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(simp add:c_rb_valid_def )\n by (meson INT_MIN_MAX_lemmas(12) less_eq_Suc_le less_trans not_less unat_1_0 \n unat_32word_leq_lt_lt word_le_less_eq word_less_1 word_less_def \n word_mod_less_divisor)\n\n \ntext \\\n Lastly, we can show that the C implementation of the enqueue operation produces the \n same outcome as doing the abstraction operation.\n\\\n\nlemma c_rb_enq_state_update_head:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\\n rb_enq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_FULL) \\ \n (if r = ERR_OK then head (rb_C_to_CleanQ_RB s rb) = head (rb_enq b rb0)\n else s = s0) \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def rb_enq_equiv rb_enq_alt_def\n apply(wp_once)+\n apply(simp add:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:c_rb_valid_def unat_32word_succ_mod Suc_leI unat_32word_leq_lt_lt \n word_less_nat_alt)\n using word_le_def word_le_less_eq word_less_nat_alt by blast\n\nlemma c_rb_enq_state_update_tail:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\\n rb_enq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_FULL) \\ \n tail (rb_C_to_CleanQ_RB s rb) = tail (rb_enq b rb0) \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp: rb_enq_alt_def rb_enq_equiv c_rb_valid_def word_less_nat_alt Suc_leI \n unat_32word_leq_lt_lt)\n by (meson le_eq_less_or_eq un_ui_le)\n\nlemma c_rb_enq_state_update_size:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\\n rb_enq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_FULL) \\ \n size (rb_C_to_CleanQ_RB s rb) = size (rb_enq b rb0) \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def\n apply(wp_once)+\n apply(auto simp:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp: rb_enq_alt_def rb_enq_equiv c_rb_valid_def word_less_nat_alt Suc_leI \n unat_32word_leq_lt_lt)\n by (meson le_eq_less_or_eq un_ui_le)\n \n\n\nlemma c_ring_ptr_different:\nassumes neq: \"x \\ unat (head_C (heap_rb_C s0 rb)) \\ x < unat (size_C (heap_rb_C s0 rb))\" \n and valid: \"c_rb_valid s0 rb\"\n shows \"ring_C (heap_rb_C s0 rb) +\\<^sub>p int x \\ ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb))\"\nproof-\n have sizelimit:\n \"(size_C (heap_rb_C s0 rb)) \\ 0xffffffff\"\n by (metis word_and_le1 word_and_max_simps(3))\n\n have unatsizelimit:\n \"unat (size_C (heap_rb_C s0 rb)) \\ 0xffffffff\"\n using sizelimit UINT_MAX_def by auto\n\n have head_leq_size:\n \"unat (head_C (heap_rb_C s0 rb)) < unat (size_C (heap_rb_C s0 rb))\"\n using valid unfolding c_rb_valid_def\n using unat_word_lt by blast\n\n from head_leq_size unatsizelimit have headlim:\n \"unat (head_C (heap_rb_C s0 rb)) \\ 0xffffffff\"\n by linarith\n\n have clim:\n \"\\(c::64 word). c \\ 0x40 \\ unat c \\ 0x40\"\n using unat_word_leq by fastforce\n\n have xlim:\n \"x \\ 0xffffffff\"\n using neq unatsizelimit by linarith\n\n have inrangex: \n \"\\(c::64 word). (c::64 word)\\ 0x40 \\ x * unat(c::64 word) \\ unat addrlimit\"\n using xlim clim mult_le_mono by fastforce \n\n have inrangey: \n \"\\(c::64 word). c \\ 0x40 \\ unat (head_C (heap_rb_C s0 rb)) * unat (c) \\ unat addrlimit\"\n using headlim clim unat_word_leq mult_le_mono \n by fastforce\n \n have ineq:\n \"\\c. 0 < c \\ c \\ 0x40 \\ of_nat x * (c::ulong_t) \\ of_int (uint (head_C (heap_rb_C s0 rb))) * (c::ulong_t)\"\n proof -\n have f1: \"\\w n. of_int (int n) * (w::64 word) = of_int (int (n * unat w))\"\n by simp\n have \"\\c. 0 < c \\ unat (head_C (heap_rb_C s0 rb)) * unat (c::64 word) \\ x * unat (c::64 word)\"\n using neq clim headlim unat_word_lt by fastforce \n then have \"\\c. 0 < c \\ c \\ 0x40 \\ (of_int (int x)::64 word) * c \\ of_int (int (unat (head_C (heap_rb_C s0 rb)))) * c\"\n using f1 by (metis (no_types) inrangex inrangey le_unat_uoi of_int_of_nat_eq)\n then show \"\\c. 0 < c \\ c \\ 0x40 \\ of_nat x * (c::ulong_t) \\ of_int (uint (head_C (heap_rb_C s0 rb))) * (c::ulong_t)\"\n by (simp add: int_unat)\n qed\n\n thus ?thesis unfolding ptr_add_def\n by(auto)\nqed\n\nlemma c_rb_enq_state_update_ring_other:\nassumes neq: \"x \\ unat (head_C (heap_rb_C s0 rb)) \\ x < unat (size_C (heap_rb_C s0 rb))\"\n and valid: \"c_rb_valid s0 rb\"\n and supd: \"s = heap_buffer_C_update \n (\\a. a(ring_C (heap_rb_C s0 rb) \n +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0\"\n shows \"heap_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p int x)\n = heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p int x)\"\n apply(subst supd)+ \n using neq valid unfolding c_rb_valid_def apply(simp)\n using valid unfolding c_rb_valid_def \n by (simp add: CleanQ_SimpleQ.c_ring_ptr_different valid)\n\n\nlemma c_rb_enq_state_update_ring_head:\n assumes eq: \"x = unat (head_C (heap_rb_C s0 rb))\"\n and supd: \"s = heap_buffer_C_update \n (\\a. a(ring_C (heap_rb_C s0 rb)\n +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0\"\n shows \"heap_buffer_C s (ring_C (heap_rb_C s rb) +\\<^sub>p int x) = b\"\n using eq by (simp add: int_unat supd)\n\nlemma c_rb_enq_state_ring_lifted_head:\n assumes eq: \"x = unat (head_C (heap_rb_C s rb))\"\n shows \"ring (rb_enq b (rb_C_to_CleanQ_RB s rb)) x = Some b\"\n unfolding rb_C_to_CleanQ_RB_def rb_enq_alt_def rb_enq_equiv\n using eq by(auto)\n\nlemma c_rb_enq_state_ring_lifted_other:\n assumes eq: \"x \\ unat (head_C (heap_rb_C s rb))\"\n shows \"ring (rb_enq b (rb_C_to_CleanQ_RB s rb)) x = ring (rb_C_to_CleanQ_RB s rb) x\"\n unfolding rb_C_to_CleanQ_RB_def rb_enq_alt_def rb_enq_equiv\n using eq by(auto)\n\nlemma c_rb_enq_state_ring_head:\n assumes eq: \"x = unat (head_C (heap_rb_C s0 rb))\" \n and supd: \"s = heap_buffer_C_update \n (\\a. a(ring_C (heap_rb_C s0 rb)\n +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0\"\n and hupd: \"s1 = heap_rb_C_update\n (\\a. a(rb := head_C_update (\\a. \n (a + (1)) mod size_C (heap_rb_C s0 rb)) (a rb))) s\"\n and valid: \"c_rb_valid s0 rb\"\n shows \"ring (rb_C_to_CleanQ_RB s1 rb) x = Some b\"\n apply(auto simp:rb_C_to_CleanQ_RB_def)\n unfolding rb_C_to_CleanQ_RB_def using eq valid \n apply(auto simp:supd hupd int_unat c_rb_valid_def)\n using unat_word_lt by blast\n \n\nlemma c_rb_enq_state_update_ring:\n fixes rb :: \"rb_C ptr\" and b :: buffer_C\n assumes notfull: \" rb_can_enq_c_fun rb = return (1) \"\n shows \"\n \\ \\s. rb_can_enq_c_fun rb = return (1) \\ (c_rb_valid s rb \\ s0 = s \n \\ rb0 = rb_C_to_CleanQ_RB s rb) \\\n rb_enq_c_fun rb b\n \\ \\ r s. \\i < size rb0. ring (rb_C_to_CleanQ_RB s rb) i = ring (rb_enq b rb0) i \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def rb_enq_equiv rb_enq_alt_def\n apply(wp_once)+\n apply(subst notfull)+\n apply(wp_once)+\n apply(auto simp:fun_upd_def)\n prefer 6 using c_rb_valid_def apply blast\n prefer 5 using c_rb_valid_def less_imp_le word_le_def apply blast\n prefer 4 using c_rb_valid_def unat_gt_0 apply fastforce \n prefer 3 apply (simp add: int_unat)\n prefer 2 apply (simp add: int_unat)\n using CleanQ_SimpleQ.c_ring_ptr_different by blast\n\n\nlemma c_rb_enq_state_update_ring2:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\\n rb_enq_c_fun rb b\n \\ \\ r s. (r = ERR_OK \\ r = ERR_QUEUE_FULL) \\ \n (if r = ERR_OK then (\\i < size rb0. ring (rb_C_to_CleanQ_RB s rb) i = ring (rb_enq b rb0) i) \n else s = s0) \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def rb_enq_equiv rb_enq_alt_def\n apply(wp_once)+\n apply(simp add:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(auto simp:fun_upd_def)\n using CleanQ_SimpleQ.c_ring_ptr_different apply blast\n unfolding c_rb_valid_def\n apply (simp_all add: int_unat)\n using unat_gt_0 apply fastforce\n using less_imp_le word_le_def apply blast\n using INT_MIN_MAX_lemmas(12) Suc_leI unat_32word_leq_lt_lt apply blast\n using unat_gt_0 by fastforce \n \n lemma enq_bufferhelper :\n \" heap_buffer_C\n (heap_rb_C_update\n (\\a::rb_C ptr \\ rb_C. a\n (rb :=\n head_C_update\n (\\a::32 word.\n (head_C (heap_rb_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) rb) + (1::32 word)) mod\n size_C (heap_rb_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) rb))\n (a rb)))\n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0)) = \n\n\n heap_buffer_C\n \n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0)\"\n\n by(auto)\n\nlemma enq_ringhelper:\n\"\n \n (ring_C\n (heap_rb_C\n (heap_rb_C_update\n (\\a::rb_C ptr \\ rb_C. a\n (rb :=\n head_C_update\n (\\a::32 word.\n (head_C (heap_rb_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) rb) + (1::32 word)) mod\n size_C (heap_rb_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) rb))\n (a rb)))\n (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0))\n rb) +\\<^sub>p\n int i)\n\n = \n (ring_C\n (heap_rb_C s0 rb) +\\<^sub>p int i)\n\n\"\n\n by(auto)\n\nlemma \n ring_upd_helper:\n \"(heap_buffer_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int i))\n = (if i = unat (head_C (heap_rb_C s0 rb)) then b else (heap_buffer_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int i)))\"\n apply(simp add: int_unat)\n\n done\n\nlemmas unat_of_nat32' = unat_of_nat_eq[where 'a=32]\nlemmas unat_of_nat32 = unat_of_nat32'[unfolded word_bits_len_of]\n\nlemma ring_upd_helper2:\n assumes ii:\" j \\ unat (head_C (heap_rb_C s0 rb)) \\ j < unat (size_C (heap_rb_C s0 rb)) \"\nshows \" (heap_buffer_C (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring_C (heap_rb_C s0 rb) +\\<^sub>p uint (head_C (heap_rb_C s0 rb)) := b)) s0) (ring_C (heap_rb_C s0 rb) +\\<^sub>p int j))\n =(heap_buffer_C s0 (ring_C (heap_rb_C s0 rb) +\\<^sub>p int j))\"\nproof -\n from ii have ilimit:\n \"j < UINT_MAX\"\n using INT_MIN_MAX_lemmas(12) less_le_trans by blast\n\n have is64: \n \"unat((0x40::64 word)) = 64\"\n by(auto)\n\n have inrangex: \"j * unat((0x40::64 word)) < 2 ^ 64\"\n using ii ilimit apply(subst is64) by(auto simp:UINT_MAX_def)\n\n have hlim:\n \"unat (of_int (uint (head_C (heap_rb_C s0 rb)))::64 word) \\ UINT_MAX\"\n by (metis (mono_tags, hide_lams) INT_MIN_MAX_lemmas(12) int_unat le_less le_trans of_int_of_nat_eq unat_le_helper)\n \n have inrangey: \"unat (of_int (uint (head_C (heap_rb_C s0 rb)))::64 word) * unat((0x40::64 word)) < 2 ^ 64\"\n using hlim apply(subst is64) by(auto simp:UINT_MAX_def) \n\n have hlim2:\n \"unat (head_C (heap_rb_C s0 rb)) < 2 ^ 32\"\n using unat_lt2p \n by (metis len32)\n\n have \"unat (head_C (heap_rb_C s0 rb)) = unat ((of_int (uint (head_C (heap_rb_C s0 rb)))::64 word))\"\n using hlim2 apply(subst of_int_uint_ucast)\n by(simp add:unat_ucast)\n \n\n have newq: \"j \\ unat ((of_int (uint (head_C (heap_rb_C s0 rb)))::64 word))\"\n using ii hlim2\n apply(subst of_int_uint_ucast)\n by(simp add:unat_ucast)\n\n\n have \"x < 2^ 32 \\ unat ((of_nat x)::64 word) = x\"\n by (simp add: unat_of_nat64 word_bits_conv)\n\n have \"x < 2^ 32 \\ unat ((of_nat x)::32 word) = x\"\n by (simp add: unat_of_nat32 word_bits_conv)\n \n have \"x < 2^ 32 \\ unat ((of_nat x)::64 word) = unat ((of_nat x)::32 word)\"\n by (simp add: unat_of_nat64 unat_of_nat32 word_bits_conv)\n\n show ?thesis \n using ii inrangex inrangey newq apply(auto simp add:ptr_add_def)\n by(simp add:word64_mult_inequality2)\n \nqed\n\n\n\nlemma c_rb_enq_correct:\n \"\\ \\s. c_rb_valid s rb \\ s0 = s \\ rb0 = rb_C_to_CleanQ_RB s rb \\\n rb_enq_c_fun rb b\n \\ \\r s. (r = ERR_OK \\ r = ERR_QUEUE_FULL) \\ \n (if r = ERR_OK then rb_C_to_CleanQ_RB s rb = rb_enq b rb0\n else s = s0) \\!\"\n unfolding rb_enq_c_fun_def rb_C_to_CleanQ_RB_def rb_enq_equiv rb_enq_alt_def\n apply(wp_once)+\n apply(simp add:rb_can_enq_c_fun_def)\n apply(wp_once)+\n apply(auto)\n prefer 8 using c_rb_valid_def apply blast\n prefer 7 using c_rb_valid_def unat_gt_0 apply fastforce\n prefer 6 using INT_MIN_MAX_lemmas(12) Suc_leI c_rb_valid_def unat_32word_leq_lt_lt apply blast\n prefer 5 using c_rb_valid_def apply blast \n prefer 4 using c_rb_valid_def word_le_def word_le_less_eq apply blast\n prefer 3 using c_rb_valid_def unat_gt_0 apply fastforce\n prefer 2 using c_rb_valid_def unat_32word_succ_mod unat_word_lt apply fastforce\n apply(subst enq_bufferhelper)\n apply(subst enq_ringhelper)\n apply(simp add:fun_upd_def)\n apply(subst ring_upd_helper)\n using ring_upd_helper2 c_rb_valid_def unat_word_lt \n by fastforce\n\n \n(* ####################################################### *)\n\n\nlemma \"rb_enq_c_fun rb b = rb_enq_unfolded_c_fun rb b\"\n unfolding rb_enq_c_fun_def rb_enq_unfolded_c_fun_def rb_can_enq_c_fun_def\n apply(monad_eq)\n apply(auto simp add: int_unat)\n done\n\n\nlemma \"rb_deq_c_fun rb b = rb_deq_unfolded_c_fun rb b\"\n unfolding rb_deq_c_fun_def rb_deq_unfolded_c_fun_def rb_can_deq_c_fun_def\n apply(monad_eq) (* seems to take a while... *)\n apply(auto simp add: int_unat) (* seems to take a while... *)\n done\n\n\n\nabbreviation \"rbhead s rb \\ unat (head_C (heap_rb_C s rb))\"\nabbreviation \"rbtail s rb \\ unat (tail_C (heap_rb_C s rb))\"\nabbreviation \"rbsize s rb \\ unat (size_C (heap_rb_C s rb))\"\nabbreviation \"rbring s rb \\ (ring_C (heap_rb_C s rb))\"\n\n\nlemma c_rb_enq_unfolded_ring_size_invariant:\n\"\\ \\s. c_rb_valid s rb \\ sz = rbsize s rb \\ rg = rbring s rb \\\n rb_enq_unfolded_c_fun rb b\n\\ \\r s. sz = rbsize s rb \\ rg = rbring s rb \\!\"\n unfolding rb_enq_unfolded_c_fun_def\n apply(wp_once)+\n by(auto simp:c_rb_valid_def unat_gt_0 Suc_le_eq unat_32word_leq_lt_lt \n int_unat word_less_def)\n\nlemma c_rb_deq_unfolded_ring_size_invariant:\n\"\\ \\s. c_rb_valid s rb \\ sz = rbsize s rb \\ rg = rbring s rb \\ is_valid_buffer_C s b \\\n rb_deq_unfolded_c_fun rb b\n\\ \\r s. sz = rbsize s rb \\ rg = rbring s rb \\!\"\n unfolding rb_deq_unfolded_c_fun_def\n apply(wp_once)+\n by(auto simp:c_rb_valid_def unat_gt_0 Suc_le_eq unat_32word_leq_lt_lt \n int_unat word_less_def)\n\n\n\n\n\n\n\nlemma c_rb_enq_unfolded_pre_post:\n\"\\ \\s. c_rb_valid s rb \n \\ h = rbhead s rb \n \\ t = rbtail s rb \n \\ sz = rbsize s rb \n \\ rg = rbring s rb \\\n rb_enq_unfolded_c_fun rb b\n\\ \\r s. (r = ERR_OK \\ (h + 1) mod sz = rbhead s rb) \n \\ (\\\\. (t + \\) mod sz = rbtail s rb)\n \\ (r \\ ERR_OK \\ h = rbhead s rb)\n \\ sz = rbsize s rb \n \\ rg = rbring s rb \\!\"\n unfolding rb_enq_unfolded_c_fun_def\n apply(wp_once)+\n apply(auto simp:c_rb_valid_def unat_gt_0 unat_32word_leq_lt_lt int_unat \n Suc_leI word_less_def)\n apply (metis mod_div_mult_eq)\n prefer 2 \n apply (metis Euclidean_Division.mod_less int_unat mod_add_self2 of_nat_less_iff)\n by (metis (no_types, hide_lams) int_unat of_nat_less_iff uint_1 unat_1 unat_32word_succ_mod word_less_def)\n\n\ntext \\\n The following two proofs show, using guard annotations, that the size, the ring, \n and the head/tail pointers are invariant after every step in the programm.\n The only thing that is changed by the program is the tail/head pointer. \n -> the other size can do the change!\n\\\n\ndefinition rb_enq_unfolded_c_fun_size_ring_anotate :: \"nat \\ nat \\ buffer_C ptr \\ rb_C ptr \\ buffer_C \\ (lifted_globals, 32 signed word) nondet_monad\"\n where \"rb_enq_unfolded_c_fun_size_ring_anotate sz t rg rb c = \n do guard (\\s::lifted_globals. is_valid_rb_C s rb);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n head::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb);\n tail::nat <- gets (\\s::lifted_globals. unat (tail_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n size::nat <- gets (\\s::lifted_globals. unat (size_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n guard (\\s::lifted_globals. (0::nat) < size);\n guard (\\s::lifted_globals. Suc head \\ UINT_MAX);\n condition (\\s::lifted_globals. Suc head mod size = tail)\n (do guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb ); \n return (-1::32 signed word)\n od)\n (do guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n head2::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n ring::buffer_C ptr <- gets (\\s::lifted_globals. ring_C (heap_rb_C s rb));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n guard (\\s::lifted_globals. is_valid_buffer_C s (ring +\\<^sub>p int head2));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := region_C_update (\\a::64 word. region_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := offset_C_update (\\a::64 word. offset_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := length_C_update (\\a::64 word. length_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := valid_offset_C_update (\\a::64 word. valid_offset_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := valid_length_C_update (\\a::64 word. valid_length_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := flags_C_update (\\a::64 word. flags_C c) (a (ring +\\<^sub>p int head2)))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n head3::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n size3::nat <- gets (\\s::lifted_globals. unat (size_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n modify (heap_rb_C_update (\\a::rb_C ptr \\ rb_C. a(rb := head_C_update (\\a::32 word. (of_nat head3 + (1::32 word)) mod of_nat size3) (a rb))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb );\n return (0::32 signed word)\n od)\n od\n\"\n\nlemma c_rb_enq_unfolded_ring_size_invariant2:\n\"\\ \\s. c_rb_valid s rb \\ sz = rbsize s rb \\ rg = rbring s rb \\ t = rbtail s rb \\\n rb_enq_unfolded_c_fun_size_ring_anotate sz t rg rb b\n\\ \\r s. sz = rbsize s rb \\ rg = rbring s rb \\!\"\n unfolding rb_enq_unfolded_c_fun_size_ring_anotate_def\n apply(wp_once)+\n apply(auto simp:c_rb_valid_def unat_gt_0 Suc_le_eq unat_32word_leq_lt_lt \n int_unat word_less_def)\n done\n\n\ndefinition rb_deq_unfolded_c_fun_size_ring_anotate :: \"nat \\ nat \\ buffer_C ptr \\ rb_C ptr \\ buffer_C ptr \\ (lifted_globals, 32 signed word) nondet_monad\"\n where \"rb_deq_unfolded_c_fun_size_ring_anotate sz h rg rb ret = \ndo guard (\\s::lifted_globals. is_valid_rb_C s rb);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n head::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n tail::nat <- gets (\\s::lifted_globals. unat (tail_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n condition (\\s::lifted_globals. head = tail)\n (do guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb ); \n return (0xFFFFFFFE::32 signed word)\n od)\n (do guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n tail1::nat <- gets (\\s::lifted_globals. unat (tail_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb);\n ring::buffer_C ptr <- gets (\\s::lifted_globals. ring_C (heap_rb_C s rb));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n guard (\\s::lifted_globals. is_valid_buffer_C s ret);\n guard (\\s::lifted_globals. is_valid_buffer_C s (ring +\\<^sub>p int tail1));\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := region_C_update (\\a::64 word. region_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := offset_C_update (\\a::64 word. offset_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := length_C_update (\\a::64 word. length_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := valid_offset_C_update (\\a::64 word. valid_offset_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := valid_length_C_update (\\a::64 word. valid_length_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (\\s::lifted_globals. heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ret := flags_C_update (\\a::64 word. flags_C (heap_buffer_C s (ring +\\<^sub>p int tail1))) (a ret))) s);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n size::nat <- gets (\\s::lifted_globals. unat (size_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n tail2::nat <- gets (\\s::lifted_globals. unat (tail_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n guard (\\s::lifted_globals. (0::nat) < size);\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n modify (heap_rb_C_update (\\a::rb_C ptr \\ rb_C. a(rb := tail_C_update (\\a::32 word. (of_nat tail2 + (1::32 word)) mod of_nat size) (a rb))));\n guard (\\s::lifted_globals. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb );\n return (0::32 signed word)\n od)\nod\"\n\n\nlemma c_rb_deq_unfolded_ring_size_invariant2:\n\"\\ \\s. c_rb_valid s rb \\ sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb \\\n is_valid_buffer_C s b\n \\\n rb_deq_unfolded_c_fun_size_ring_anotate sz h rg rb b\n\\ \\r s. sz = rbsize s rb \\ rg = rbring s rb \\ h = rbhead s rb \\!\"\n unfolding rb_deq_unfolded_c_fun_size_ring_anotate_def\n apply(wp_once)+\n by(auto simp:c_rb_valid_def unat_gt_0 Suc_le_eq unat_32word_leq_lt_lt \n int_unat word_less_def)\n\n\n\n\n\nthm rb_enq_unfolded_c_fun_def\nterm rb_enq_unfolded_c_fun\nthm rb_deq_unfolded_c_fun_def\n\n\ndefinition rb_enq_test :: \"rb_C ptr \\ buffer_C \\ (lifted_globals, 32 signed word) nondet_monad\"\n where \n\"rb_enq_test rb slot \\\n do guard (\\s::lifted_globals. is_valid_rb_C s rb);\n head::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. head \\ UINT_MAX);\n tail::nat <- gets (\\s::lifted_globals. unat (tail_C (heap_rb_C s rb)));\n size::nat <- gets (\\s::lifted_globals. unat (size_C (heap_rb_C s rb)));\n guard (\\s::lifted_globals. (0::nat) < size);\n guard (\\s::lifted_globals. Suc head \\ UINT_MAX);\n condition (\\s::lifted_globals. Suc head mod size = tail)\n (return (- (1::32 signed word)))\n (do head2::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n ring::buffer_C ptr <- gets (\\s::lifted_globals. ring_C (heap_rb_C s rb));\n guard (\\s::lifted_globals. is_valid_buffer_C s (ring +\\<^sub>p int head2));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := region_C_update (\\a::64 word. region_C slot) (a (ring +\\<^sub>p int head2)))));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := offset_C_update (\\a::64 word. offset_C slot) (a (ring +\\<^sub>p int head2)))));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := length_C_update (\\a::64 word. length_C slot) (a (ring +\\<^sub>p int head2)))));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := valid_offset_C_update (\\a::64 word. valid_offset_C slot) (a (ring +\\<^sub>p int head2)))));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := valid_length_C_update (\\a::64 word. valid_length_C slot) (a (ring +\\<^sub>p int head2)))));\n modify (heap_buffer_C_update (\\a::buffer_C ptr \\ buffer_C. a(ring +\\<^sub>p int head2 := flags_C_update (\\a::64 word. flags_C slot) (a (ring +\\<^sub>p int head2)))));\n head3::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n size3::nat <- gets (\\s::lifted_globals. unat (size_C (heap_rb_C s rb)));\n modify (heap_rb_C_update (\\a::rb_C ptr \\ rb_C. a(rb := head_C_update (\\a::32 word. (of_nat head3 + (1::32 word)) mod of_nat size3) (a rb))));\n guard (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)) = ( head3 + 1) mod size3);\n return (0::32 signed word)\n od)\n od\"\n\n\ndefinition rb_enq_e1 :: \"rb_C ptr \\ buffer_C \\ (lifted_globals, 32 signed word) nondet_monad\"\n where \n\"rb_enq_e1 rb slot \\\n do guard (\\s::lifted_globals. is_valid_rb_C s rb);\n head::nat <- gets (\\s::lifted_globals. unat (head_C (heap_rb_C s rb)));\n return (0::32 signed word)\n od\"\n\n\nabbreviation \"rbhead s rb \\ unat (head_C (heap_rb_C s rb))\"\nabbreviation \"rbtail s rb \\ unat (tail_C (heap_rb_C s rb))\"\nabbreviation \"rbsize s rb \\ unat (size_C (heap_rb_C s rb))\"\nabbreviation \"rbring s rb \\ (ring_C (heap_rb_C s rb))\"\n\nlemma test:\n\"\\ \\s. c_rb_valid s rb \\ h = rbhead s rb \\\n do \n head::nat <- gets (\\s. rbhead s rb); return (0)\n od\n \\ \\r s. h = rbhead s rb \\!\"\n unfolding rb_enq_e1_def\n apply(wp_once)+\n by(auto simp:c_rb_valid_def)\n\n\nlemma \"rb_enq_test rb slot = rb_enq_unfolded_c_fun rb slot\"\n unfolding rb_enq_test_def rb_enq_unfolded_c_fun_def\n apply(monad_eq) (* seems to take a while... *)\n apply(auto)\n sledgehammer\n apply (simp add: unat_mod)\n \n apply (simp add: unat_mod)\n done\n\n\nlemma test:\n \"\\ \\s. c_rb_valid s rb \\ h = unat (head_C (heap_rb_C s rb)) \\ is_valid_buffer_C s b \\\n rb_deq_c_fun rb b\n \\ \\r s. h = unat (head_C (heap_rb_C s rb)) \\!\"\n unfolding rb_deq_c_fun_def rb_can_deq_c_fun_def\n apply(wp_once)+\n apply(auto)\n using c_rb_valid_def apply blast\n using c_rb_valid_def unat_gt_0 apply fastforce\n using c_rb_valid_def word_le_def word_le_less_eq apply blast \n using c_rb_valid_def apply blast\n done\n\nlemma \"(a::nat) \\ 64 \\ (b::nat) < 2^32 \\ a * b < 2^64\"\nproof -\n assume p1 :\"(a::nat) \\ 64\"\n assume p2: \"(b::nat) < 2^32\"\n\n have x1: \"(64::nat) * 2^32 \\ 2^64\"\n by(simp)\n\n have x2: \"(a::nat) \\ 64 \\ (b::nat) < 2^32 \\ a * b < 64 * 2^32\" \n by (meson le_less_trans mult_less_cancel1 mult_right_mono zero_le zero_less_numeral)\n\n show ?thesis using order_trans x2 x1 p1 p2 \n by linarith\nqed\n \n\nlemma \"(a::nat) < 2^32 \\ (b::nat) < 2^32 \\ a * b < 2^64\"\nproof -\n assume p1 :\"(a::nat) < 2^32\"\n assume p2: \"(b::nat) < 2^32\"\n \n have X1: \"(0xffffffff::nat) * 0xffffffff \\ 0xffffffffffffffff\"\n by(auto)\n\n have X2: \"(a::nat) \\ 0xffffffff \\ (b::nat) \\ 0xffffffff \\ a * b \\ 0xffffffffffffffff\"\n using X1 mult_le_mono order_trans by blast\n\n have X3: \"(a::nat) < 2^32 \\ (b::nat) < 2^32 \\ a * b < (2^32 * 2^32)\"\n using X2 by simp\n\n show ?thesis\n using p1 p2 X3 by auto\nqed\n\n\n(* SimpleQ C parser output. *)\n\nthm simpleq_enq_body_def\nthm simpleq_deq_body_def\nthm simpleq_enq_x_body_def\nthm simpleq_enq_y_body_def\nthm simpleq_deq_x_body_def\nthm simpleq_deq_y_body_def\n\n(* SimpleQ Init C parser output. *)\nthm init_x_body_def\nthm init_y_body_def\nthm init_queue_body_def\n\n\nend\nend\n", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_SimpleQ.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070808, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.28789309001719704}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Addr_Type\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\ntype_synonym addr_bitsize = \"32\"\ntype_synonym addr = \"addr_bitsize word\"\ndefinition addr_bitsize :: nat where \"addr_bitsize \\ 32\"\ndefinition addr_align :: nat where \"addr_align \\ 2\"\ndeclare addr_align_def[simp]\n\ndefinition addr_card :: nat where\n \"addr_card \\ card (UNIV::addr set)\"\n \n\n\ndeclare addr_bitsize_def[simp]\n\nlemma addr_card:\n \"addr_card = 2^addr_bitsize\"\n by (simp add: addr_card_def card_word)\n\nlemma len_of_addr_card:\n \"2 ^ len_of TYPE(addr_bitsize) = addr_card\"\n by (simp add: addr_card)\n\nlemma of_nat_addr_card [simp]:\n \"of_nat addr_card = (0::addr)\"\n by (simp add: addr_card)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/umm_heap/ARM/Addr_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.28782162258336325}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: Generalise.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2005-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory Generalise imports \"~~/src/HOL/Statespace/DistinctTreeProver\"\nbegin\n\nlemma protectRefl: \"PROP Pure.prop (PROP C) \\ PROP Pure.prop (PROP C)\"\n by (simp add: prop_def)\n\nlemma protectImp: \n assumes i: \"PROP Pure.prop (PROP P \\ PROP Q)\" \n shows \"PROP Pure.prop (PROP Pure.prop P \\ PROP Pure.prop Q)\"\nproof -\n {\n assume P: \"PROP Pure.prop P\"\n from i [unfolded prop_def, OF P [unfolded prop_def]] \n have \"PROP Pure.prop Q\"\n by (simp add: prop_def)\n }\n note i' = this\n show \"PROP ?thesis\" \n apply (rule protectI)\n apply (rule i')\n apply assumption\n done\nqed\n\n\nlemma generaliseConj: \n assumes i1: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\ PROP Pure.prop (Trueprop Q))\"\n assumes i2: \"PROP Pure.prop (PROP Pure.prop (Trueprop P') \\ PROP Pure.prop (Trueprop Q'))\"\n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (P \\ P')) \\ (PROP Pure.prop (Trueprop (Q \\ Q'))))\"\n using i1 i2\n by (auto simp add: prop_def)\n\nlemma generaliseAll: \n assumes i: \"PROP Pure.prop (\\s. PROP Pure.prop (Trueprop (P s)) \\ PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\s. P s)) \\ PROP Pure.prop (Trueprop (\\s. Q s)))\"\n using i\n by (auto simp add: prop_def)\n\nlemma generalise_all: \n assumes i: \"PROP Pure.prop (\\s. PROP Pure.prop (PROP P s) \\ PROP Pure.prop (PROP Q s))\" \n shows \"PROP Pure.prop ((PROP Pure.prop (\\s. PROP P s)) \\ (PROP Pure.prop (\\s. PROP Q s)))\"\n using i\n proof (unfold prop_def)\n assume i1: \"\\s. (PROP P s) \\ (PROP Q s)\"\n assume i2: \"\\s. PROP P s\"\n show \"\\s. PROP Q s\"\n by (rule i1) (rule i2)\n qed\n\nlemma generaliseTrans: \n assumes i1: \"PROP Pure.prop (PROP P \\ PROP Q)\"\n assumes i2: \"PROP Pure.prop (PROP Q \\ PROP R)\" \n shows \"PROP Pure.prop (PROP P \\ PROP R)\"\n using i1 i2\n proof (unfold prop_def)\n assume P_Q: \"PROP P \\ PROP Q\" \n assume Q_R: \"PROP Q \\ PROP R\" \n assume P: \"PROP P\"\n show \"PROP R\"\n by (rule Q_R [OF P_Q [OF P]])\n qed\n\nlemma meta_spec:\n assumes \"\\x. PROP P x\"\n shows \"PROP P x\" by fact\n\nlemma meta_spec_protect:\n assumes g: \"\\x. PROP P x\"\n shows \"PROP Pure.prop (PROP P x)\"\nusing g\nby (auto simp add: prop_def)\n\nlemma generaliseImp: \n assumes i: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\ PROP Pure.prop (Trueprop Q))\"\n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (X \\ P)) \\ PROP Pure.prop (Trueprop (X \\ Q)))\"\n using i\n by (auto simp add: prop_def)\n\nlemma generaliseEx: \n assumes i: \"PROP Pure.prop (\\s. PROP Pure.prop (Trueprop (P s)) \\ PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\s. P s)) \\ PROP Pure.prop (Trueprop (\\s. Q s)))\"\n using i\n by (auto simp add: prop_def)\n\n\nlemma generaliseRefl: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\ PROP Pure.prop (Trueprop P))\"\n by (auto simp add: prop_def)\n\nlemma generaliseRefl': \"PROP Pure.prop (PROP P \\ PROP P)\"\n by (auto simp add: prop_def)\n\nlemma generaliseAllShift:\n assumes i: \"PROP Pure.prop (\\s. P \\ Q s)\"\n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\ PROP Pure.prop (Trueprop (\\s. Q s)))\"\n using i\n by (auto simp add: prop_def)\n\nlemma generalise_allShift:\n assumes i: \"PROP Pure.prop (\\s. PROP P \\ PROP Q s)\"\n shows \"PROP Pure.prop (PROP Pure.prop (PROP P) \\ PROP Pure.prop (\\s. PROP Q s))\"\n using i\n proof (unfold prop_def)\n assume P_Q: \"\\s. PROP P \\ PROP Q s\" \n assume P: \"PROP P\"\n show \"\\s. PROP Q s\"\n by (rule P_Q [OF P])\n qed\n\n\nlemma generaliseImpl:\n assumes i: \"PROP Pure.prop (PROP Pure.prop P \\ PROP Pure.prop Q)\"\n shows \"PROP Pure.prop ((PROP Pure.prop (PROP X \\ PROP P)) \\ (PROP Pure.prop (PROP X \\ PROP Q)))\"\n using i\n proof (unfold prop_def)\n assume i1: \"PROP P \\ PROP Q\"\n assume i2: \"PROP X \\ PROP P\"\n assume X: \"PROP X\"\n show \"PROP Q\"\n by (rule i1 [OF i2 [OF X]])\n qed\n\n\nML_file \"generalise_state.ML\"\n\nend\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/Generalise.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.28767505027774887}} {"text": "(*****************************************************************************\n * ESPL --- an embedded security protocol logic\n * http://people.inf.ethz.ch/meiersi/espl/\n *\n * Copyright (c) 2009-2011, Simon Meier, ETH Zurich, Switzerland\n *\n * All rights reserved. See file LICENCE for more information.\n ******************************************************************************)\n(* Extensions to the standard HOL library *)\ntheory HOL_ext\nimports\n Main\nbegin\n\n\nsection{* Maps *}\n\nlemma dom_upd [simp]: \n \"dom (\\ a. if a = x then Some y else m a) = insert x (dom m)\"\n by(fastforce simp: dom_if)\n\nlemma map_leD: \"\\ m \\\\<^sub>m m'; m x = Some y \\ \\ m' x = Some y\"\n by(force simp: map_le_def)\n\nlemma rev_map_leD: \"\\ m x = Some y; m \\\\<^sub>m m' \\ \\ m' x = Some y\"\n by(force simp: map_le_def)\n\nlemma map_leI: \n \"\\ \\ x y. m x = Some y \\ m' x = Some y \\ \\ m \\\\<^sub>m m'\"\n by(force simp: map_le_def)\n\n\nsection{* Option *}\n\nfun opt_map2 :: \"('a \\ 'b \\ 'c) \\ 'a option \\ 'b option \\ 'c option\"\nwhere\n \"opt_map2 f (Some x) (Some y) = Some (f x y)\"\n| \"opt_map2 f _ _ = None\"\n\nlemma Some_opt_map2 [simp]:\n \"(Some x = opt_map2 f a b) =\n (\\ y z. x = f y z \\ Some y = a \\ Some z = b)\"\n \"(opt_map2 f a b = Some x) =\n (\\ y z. x = f y z \\ Some y = a \\ Some z = b)\"\n by (cases a, simp, cases b, simp_all add: eq_commute)+\n\nlemma Some_if_pushL [simp]:\n \"(Some x = (if b then Some y else None)) = (b \\ x = y)\"\n \"((if b then Some y else None) = Some x) = (b \\ x = y)\"\n by (auto split: if_splits)\n\nlemma Some_if_pushR [simp]:\n \"(Some x = (if b then None else Some y)) = (\\b \\ x = y)\"\n \"((if b then None else Some y) = Some x) = (\\b \\ x = y)\"\n by (auto split: if_splits)\n\nlemma Some_Option_map [simp]:\n \"(Some x = map_option f a) = (\\y. x = f y \\ Some y = a)\"\n \"(map_option f a = Some x) = (\\y. x = f y \\ Some y = a)\"\n by (cases a, auto)+\n\n\nsection{* Variadic Functions *}\n\ndatatype ('a, 'b) varfun = Val 'b | Fun \"'a \\ ('a, 'b) varfun\"\n\nprimrec var_map :: \"('b \\ 'c) \\ ('a, 'b) varfun \\ ('a, 'c) varfun\"\nwhere\n \"var_map f (Val x) = Val (f x)\"\n| \"var_map f (Fun g) = Fun (\\x. var_map f (g x))\"\n\nprimrec var_apply :: \"('a, 'b \\ 'c) varfun \\ ('a, 'b) varfun \\ ('a, 'c) varfun\"\nwhere\n \"var_apply (Val f) v = var_map f v\"\n| \"var_apply (Fun g) v = Fun (\\x. var_apply (g x) v)\"\n\nabbreviation var_lift2 :: \"('b \\ 'c \\ 'd) \\ ('a, 'b) varfun \\ ('a, 'c) varfun \\ ('a, 'd) varfun\"\nwhere \"var_lift2 f v1 v2 \\ var_apply (var_map f v1) v2\"\n\nprimrec var_fold :: \"(('a \\ 'b) \\ 'b) \\ ('a, 'b) varfun \\ 'b\"\nwhere\n \"var_fold f (Val x) = x\"\n| \"var_fold f (Fun g) = f (\\x. var_fold f (g x))\"\n\n\nlemma var_map_map [simp]: \"var_map f (var_map g v) = var_map (f o g) v\"\nby (induct v) (auto)\n\nlemma var_fold_not_all: \"(\\ var_fold All v) = var_fold Ex (var_map Not v)\"\nby (induct v) (auto)\n\nlemma var_fold_not_ex: \"(\\ var_fold Ex v) = var_fold All (var_map Not v)\"\nby (induct v) (auto)\n\n\nsection{* Finite Sets *}\n\ntext{* \n Automating the simplification of differences of finite sets. \n*}\nlemma eq_conj_neq: \n \"y \\ z \\ (x = y \\ x \\ z) = (x = y)\"\n \"y \\ z \\ (x = y \\ (x \\ z \\ P)) = ((x = y) \\ P)\"\n \"y \\ z \\ (x = y \\ (P \\ x \\ z)) = ((x = y) \\ P)\"\n \"y \\ z \\ (x \\ z \\ x = y) = (x = y)\"\n \"y \\ z \\ ((x \\ z \\ P) \\ x = y) = ((x = y) \\ P)\"\n \"y \\ z \\ ((P \\ x \\ z) \\ x = y) = ((x = y) \\ P)\"\n by(auto)\n\nlemmas finite_setdiff_compute =\n conj_disj_distribL \n conj_disj_distribR \n ex_disj_distrib\n eq_conj_neq\n disj_ac\n\n\nsubsection{* Extensions to ML infrastructure for HOL *}\n\nlemma HOL_concl_revcut_rl:\n \"\\ PROP V; PROP V \\ W \\ \\ W\"\n by simp\n\n\nML{*\nsignature HOL_EXT =\nsig\n (* Gather bound variables *)\n val add_bound_list : term -> int list -> int list\n\n (* Permutations of all quantifiers *)\n val invert_perm : int list -> int list\n val forall_permute : Proof.context -> int list -> cterm -> thm\n val forall_permute_conv : Proof.context -> int list -> cterm -> thm\n\n (* Theorem modifications *)\n val beta_norm_thm : thm -> thm\n val make_HOL_elim : thm -> thm\n val protect_concl : thm -> thm\n val lift_ground_thm_mod \n : Proof.context -> (Proof.context -> thm -> thm) -> thm -> thm\n\n (* Applying tactics to theorems *)\n val rule_by_tactic \n : Proof.context -> (Proof.context -> thm -> thm Seq.seq) -> thm -> thm\n val refine_rule \n : Proof.context -> (Proof.context -> thm -> thm Seq.seq) -> thm -> thm\n val track_HOL_term \n : Proof.context -> term -> (thm * (thm -> thm)) * Proof.context\nend;\n\n*}\n\nML{*\n\nstructure HOL_Ext: HOL_EXT =\nstruct\n\n(* gather a list of bound variables *)\nval add_bound_list =\n (fn f => rev o f) o fold_aterms (fn Bound i => (fn is => i::is) | _ => I);\n\n\n(* invert a permutation *)\nfun invert_perm p =\n p ~~ (0 upto (length p - 1))\n |> sort (int_ord o pairself fst)\n |> map snd\n\n\n(* Prove the permutation of the outermost all quantifiers:\n \n !!x0 .. x(n-1). A |- !!x[p0] .. x[p(n-1)]. A\n\n PRE: No meta-variables in the given cterm.\n*)\nfun forall_permute ctxt p ct =\n let\n val cert = Thm.cterm_of (Proof_Context.theory_of ctxt);\n fun mk_cv (_, ty) n = cert (Free (n, ty));\n val string_of_perm = commas o map string_of_int;\n fun err msg = raise CTERM\n ( \"forall_permute: \" ^ msg ^ \" [\" ^ string_of_perm p ^ \"]\"\n , [ct] );\n\n val t = Thm.term_of ct;\n val n = length p;\n val vs = t |> Term.strip_all_vars |> #1 o chop n;\n\n val () = if n <> length vs\n then err \"too many variables referenced\"\n else ();\n\n val (vns', _) = Variable.variant_fixes (map fst vs) ctxt;\n val cvs' = map2 mk_cv vs vns';\n val cpvs' = \n map (nth cvs') p\n handle Subscript => err \"wrong subscript in permutation\";\n in\n ct\n |> Thm.assume\n |> forall_elim_list cvs'\n |> forall_intr_list cpvs'\n end\n\n(* Prove the conversion permuting the variables:\n\n (!!x0 .. x(n-1). A) == (!!x[p0] .. x[p(n-1)]. A)\n*)\nfun forall_permute_conv ctxt p ct =\n let\n val lr = forall_permute ctxt p ct;\n val ct' = Thm.cprop_of lr;\n val rl = forall_permute ctxt (invert_perm p) ct';\n in\n Thm.equal_intr (Thm.implies_intr ct lr) \n (Thm.implies_intr ct' rl)\n end;\n\n\n(* Beta-normal form of a theorem *)\nfun beta_norm_thm th =\n Thm.equal_elim (Thm.beta_conversion true (Thm.cprop_of th)) th\n\n(* make an elim rule with a \"Trueprop ?R\" concluion *)\nfun make_HOL_elim rl = \n zero_var_indexes (rl RS @{thm HOL_concl_revcut_rl})\n\n\n(*\n A ==> ... ==> C\n ---------------- (protect_concl)\n A ==> ... ==> #C\n*)\nfun protect_concl th = \n Drule.comp_no_flatten (th, Thm.nprems_of th) 1 Drule.protectI;\n\n\n(* Modify a theorem using a function thm -> thm that requires the theorem\n to contain no schematic variables.\n*)\nfun lift_ground_thm_mod ctxt f th =\n let\n val ((_, [th']), ctxt') = Variable.import true [th] ctxt;\n in\n f ctxt' th'\n |> singleton (Variable.export ctxt' ctxt)\n |> zero_var_indexes\n end;\n\n\n(*Makes a rule by applying a tactic to an existing rule.\n\n Copied from 'tactic.ML' and fixed such that the current context\n is taken as an argument to avoid clashes with free variables referenced \n by facts used by the tactic.\n*)\nfun rule_by_tactic ctxt tac rl =\n lift_ground_thm_mod ctxt \n (fn ctxt' => fn st => \n case Seq.pull (tac ctxt' st) of\n NONE => raise THM (\"rule_by_tactic\", 0, [rl])\n | SOME (st', _) => st')\n rl;\n\n(* Apply a tactic to the premises of an elim rule *)\nfun refine_rule ctxt tac =\n Goal.conclude o rule_by_tactic ctxt tac o protect_concl\n\n\n(* Returns a theorem of the for \"Q x |- Q x\" together with\n a removal function that can be used to eliminate the \"Q x\"\n assumption by replacing it with (\\y. x = y). The given\n theorem can be used to track the conversions of \"x\" that\n happen when using automatic tools. Just insert the given\n theorem.\n*)\nfun track_HOL_term ctxt x_t =\n let\n val thy = Proof_Context.theory_of ctxt;\n val cert = Thm.cterm_of thy;\n\n val x_ty = Term.fastype_of x_t; \n\n val ([Q_n],ctxt') = Variable.variant_fixes [\"Q\"] ctxt;\n val Q_ty = x_ty --> HOLogic.boolT;\n val Q_t = Free (Q_n, Q_ty);\n \n val Q_ct = cert Q_t;\n val Qx_ct = cert (HOLogic.mk_Trueprop (Q_t $ x_t));\n val eq_x_ct = cert \n (Abs (\"y\", x_ty, \n Const (@{const_name \"HOL.eq\"}, x_ty --> x_ty --> HOLogic.boolT)\n $ x_t $ Bound 0));\n\n fun remove_tracking th' =\n th' \n |> Thm.implies_intr Qx_ct \n |> Thm.forall_intr Q_ct\n |> Thm.forall_elim eq_x_ct\n |> curry (op RS) @{thm refl}\n |> beta_norm_thm\n in\n ((Thm.assume Qx_ct, remove_tracking), ctxt')\n end;\n\n\nend;\n*}\n\n\nend\n", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/ESPLogic/HOL_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.2876750502777488}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Bisim_Subst\n imports Weak_Bisim_Struct_Cong Weak_Bisim_Pres Bisim_Subst\nbegin\n\ncontext env begin\n\nabbreviation\n weakBisimSubstJudge (\"_ \\ _ \\\\<^sub>s _\" [70, 70, 70] 65) where \"\\ \\ P \\\\<^sub>s Q \\ (\\, P, Q) \\ closeSubst weakBisim\"\nabbreviation\n weakBisimSubstNilJudge (\"_ \\\\<^sub>s _\" [70, 70] 65) where \"P \\\\<^sub>s Q \\ \\ \\ P \\\\<^sub>s Q\"\n\nlemmas weakBisimSubstClosed[eqvt] = closeSubstClosed[OF weakBisimEqvt]\nlemmas weakBisimEqvt[simp] = closeSubstEqvt[OF weakBisimEqvt]\n\nlemma strongBisimSubstWeakBisimSubst:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>s Q\"\n\n shows \"\\ \\ P \\\\<^sub>s Q\"\nusing assms\nby(metis closeSubstI closeSubstE strongBisimWeakBisim)\n\nlemma weakBisimSubstOutputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n \n assumes \"\\ \\ P \\\\<^sub>s Q\"\n\n shows \"\\ \\ M\\N\\.P \\\\<^sub>s M\\N\\.Q\"\nusing assms\nby(fastforce intro: closeSubstI closeSubstE weakBisimOutputPres)\n\nlemma bisimSubstInputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"\\ \\ P \\\\<^sub>s Q\"\n and \"xvec \\* \\\"\n and \"distinct xvec\"\n\n shows \"\\ \\ M\\\\*xvec N\\.P \\\\<^sub>s M\\\\*xvec N\\.Q\"\nproof(rule_tac closeSubstI)\n fix yvec Tvec\n assume \"length(yvec::name list) = length (Tvec::'a list)\" and \"distinct yvec\"\n obtain p where \"(p \\ xvec) \\* yvec\" and \"(p \\ xvec) \\* Tvec\"\n and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* N\"\n and S: \"set p \\ set xvec \\ set (p \\ xvec)\"\n by(rule_tac c=\"(yvec, Tvec, P, Q, \\, N)\" in name_list_avoiding) auto\n \n from `\\ \\ P \\\\<^sub>s Q` have \"(p \\ \\) \\ (p \\ P) \\\\<^sub>s (p \\ Q)\"\n by(rule weakBisimSubstClosed)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S have \"\\ \\ (p \\ P) \\\\<^sub>s (p \\ Q)\"\n by simp\n\n {\n fix Tvec' :: \"'a list\"\n\n note `\\ \\ (p \\ P) \\\\<^sub>s (p \\ Q)`\n moreover assume \"length xvec = length Tvec'\"\n with `length yvec = length Tvec` have \"length(yvec@(p \\ xvec)) = length(Tvec@Tvec')\"\n by auto\n moreover from `distinct xvec` `distinct yvec` `(p \\ xvec) \\* yvec` have \"distinct(yvec@(p \\ xvec))\"\n by(auto simp add: fresh_star_def fresh_def name_list_supp)\n ultimately have \"\\ \\ (p \\ P)[(yvec@(p \\ xvec))::=(Tvec@Tvec')] \\ (p \\ Q)[(yvec@(p \\ xvec))::=(Tvec@Tvec')]\"\n by(rule closeSubstE)\n with `length yvec = length Tvec` `length xvec = length Tvec'` `distinct xvec` `distinct yvec` `(p \\ xvec) \\* yvec` `(p \\ xvec) \\* Tvec` have \"\\ \\ ((p \\ P)[yvec::=Tvec])[(p \\ xvec)::=Tvec'] \\ ((p \\ Q)[yvec::=Tvec])[(p \\ xvec)::=Tvec']\"\n by(subst subst5[symmetric], auto)+\n }\n\n with `(p \\ xvec) \\* yvec` `(p \\ xvec) \\* Tvec`\n have \"\\ \\ (M\\\\*(p \\ xvec) (p \\ N)\\.(p \\ P))[yvec::=Tvec] \\ (M\\\\*(p \\ xvec) (p \\ N)\\.(p \\ Q))[yvec::=Tvec]\"\n by(force intro: weakBisimInputPres)\n moreover from `(p \\ xvec) \\* N` `(p \\ xvec) \\* P` S have \"M\\\\*(p \\ xvec) (p \\ N)\\.(p \\ P) = M\\\\*xvec N\\.P\" \n apply(simp add: psi.inject) by(rule inputChainAlpha[symmetric]) auto\n moreover from `(p \\ xvec) \\* N` `(p \\ xvec) \\* Q` S have \"M\\\\*(p \\ xvec) (p \\ N)\\.(p \\ Q) = M\\\\*xvec N\\.Q\"\n apply(simp add: psi.inject) by(rule inputChainAlpha[symmetric]) auto\n ultimately show \"\\ \\ (M\\\\*xvec N\\.P)[yvec::=Tvec] \\ (M\\\\*xvec N\\.Q)[yvec::=Tvec]\"\n by force\nqed\n(*\nlemma bisimSubstCasePresAux:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n \n assumes C1: \"\\\\ P. (\\, P) mem CsP \\ \\Q. (\\, Q) mem CsQ \\ guarded Q \\ \\ \\ P \\\\<^sub>s Q\"\n and C2: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\\\<^sub>s Q\"\n\n shows \"\\ \\ Cases CsP \\\\<^sub>s Cases CsQ\"\nproof -\n {\n fix xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n assume \"length xvec = length Tvec\"\n and \"distinct xvec\"\n\n have \"\\ \\ Cases(caseListSubst CsP xvec Tvec) \\ Cases(caseListSubst CsQ xvec Tvec)\"\n proof(rule bisimCasePres)\n fix \\ P\n assume \"(\\, P) mem (caseListSubst CsP xvec Tvec)\"\n then obtain \\' P' where \"(\\', P') mem CsP\" and \"\\ = substCond \\' xvec Tvec\" and PeqP': \"P = (P'[xvec::=Tvec])\"\n by(induct CsP) force+\n from `(\\', P') mem CsP` obtain Q' where \"(\\', Q') mem CsQ\" and \"guarded Q'\" and \"\\ \\ P' \\\\<^sub>s Q'\" by(blast dest: C1)\n from `(\\', Q') mem CsQ` `\\ = substCond \\' xvec Tvec` obtain Q where \"(\\, Q) mem (caseListSubst CsQ xvec Tvec)\" and \"Q = Q'[xvec::=Tvec]\"\n by(induct CsQ) auto\n with PeqP' `guarded Q'` `\\ \\ P' \\\\<^sub>s Q'` `length xvec = length Tvec` `distinct xvec` show \"\\Q. (\\, Q) mem (caseListSubst CsQ xvec Tvec) \\ guarded Q \\ \\ \\ P \\ Q\"\n by(blast dest: bisimSubstE guardedSubst)\n next\n fix \\ Q\n assume \"(\\, Q) mem (caseListSubst CsQ xvec Tvec)\"\n then obtain \\' Q' where \"(\\', Q') mem CsQ\" and \"\\ = substCond \\' xvec Tvec\" and QeqQ': \"Q = Q'[xvec::=Tvec]\"\n by(induct CsQ) force+\n from `(\\', Q') mem CsQ` obtain P' where \"(\\', P') mem CsP\" and \"guarded P'\" and \"\\ \\ P' \\\\<^sub>s Q'\" by(blast dest: C2)\n from `(\\', P') mem CsP` `\\ = substCond \\' xvec Tvec` obtain P where \"(\\, P) mem (caseListSubst CsP xvec Tvec)\" and \"P = P'[xvec::=Tvec]\"\n by(induct CsP) auto\n with QeqQ' `guarded P'` `\\ \\ P' \\\\<^sub>s Q'` `length xvec = length Tvec` `distinct xvec` show \"\\P. (\\, P) mem (caseListSubst CsP xvec Tvec) \\ guarded P \\ \\ \\ P \\ Q\"\n by(blast dest: bisimSubstE guardedSubst)\n qed\n }\n thus ?thesis\n by(rule_tac bisimSubstI) auto\nqed\n*)\nlemma weakBisimSubstReflexive:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ P \\\\<^sub>s P\"\nby(auto intro: closeSubstI weakBisimReflexive)\n\nlemma bisimSubstTransitive:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>s Q\"\n and \"\\ \\ Q \\\\<^sub>s R\"\n\n shows \"\\ \\ P \\\\<^sub>s R\"\nusing assms\nby(auto intro: closeSubstI closeSubstE weakBisimTransitive)\n\nlemma weakBisimSubstSymmetric:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>s Q\"\n\n shows \"\\ \\ Q \\\\<^sub>s P\"\nusing assms\nby(auto intro: closeSubstI closeSubstE weakBisimE)\n(*\nlemma bisimSubstCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n \n assumes \"length CsP = length CsQ\"\n and C: \"\\(i::nat) \\ P \\' Q. \\i <= length CsP; (\\, P) = nth CsP i; (\\', Q) = nth CsQ i\\ \\ \\ = \\' \\ \\ \\ P \\ Q\"\n\n shows \"\\ \\ Cases CsP \\\\<^sub>s Cases CsQ\"\nproof -\n {\n fix \\ \n and P\n\n assume \"(\\, P) mem CsP\"\n\n with `length CsP = length CsQ` have \"\\Q. (\\, Q) mem CsQ \\ \\ \\ P \\\\<^sub>s Q\"\n apply(induct n==\"length CsP\" arbitrary: CsP CsQ rule: nat.induct)\n apply simp\n apply simp\n apply auto\n\n }\nusing `length CsP = length CsQ`\nproof(induct n==\"length CsP\" rule: nat.induct)\n case zero\n thus ?case by(fastforce intro: bisimSubstReflexive)\nnext\n case(Suc n)\nnext\napply auto\napply(blast intro: bisimSubstReflexive)\napply auto\napply(simp add: nth.simps)\napply(auto simp add: nth.simps)\napply blast\napply(rule_tac bisimSubstCasePresAux)\napply auto\n*)\nlemma weakBisimSubstParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\\\<^sub>s Q\"\n\n shows \"\\ \\ P \\ R \\\\<^sub>s Q \\ R\"\nusing assms\nby(fastforce intro: closeSubstI closeSubstE weakBisimParPres)\n\nlemma weakBisimSubstResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes \"\\ \\ P \\\\<^sub>s Q\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\\\<^sub>s \\\\x\\Q\"\nproof(rule_tac closeSubstI)\n fix xvec Tvec\n assume \"length(xvec::name list) = length(Tvec::'a list)\" and \"distinct xvec\"\n obtain y::name where \"y \\ \\\" and \"y \\ P\" and \"y \\ Q\" and \"y \\ xvec\" and \"y \\ Tvec\"\n by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\n from `\\ \\ P \\\\<^sub>s Q` have \"([(x, y)] \\ \\) \\ ([(x, y)] \\ P) \\\\<^sub>s ([(x, y)] \\ Q)\"\n by(rule weakBisimSubstClosed)\n with `x \\ \\` `y \\ \\` have \"\\ \\ ([(x, y)] \\ P) \\\\<^sub>s ([(x, y)] \\ Q)\"\n by simp\n hence \"\\ \\ ([(x, y)] \\ P)[xvec::=Tvec] \\ ([(x, y)] \\ Q)[xvec::=Tvec]\" using `length xvec = length Tvec` `distinct xvec`\n by(rule closeSubstE)\n hence \"\\ \\ \\\\y\\(([(x, y)] \\ P)[xvec::=Tvec]) \\ \\\\y\\(([(x, y)] \\ Q)[xvec::=Tvec])\" using `y \\ \\`\n by(rule weakBisimResPres)\n with `y \\ P` `y \\ Q` `y \\ xvec` `y \\ Tvec` \n show \"\\ \\ (\\\\x\\P)[xvec::=Tvec] \\ (\\\\x\\Q)[xvec::=Tvec]\"\n by(simp add: alphaRes)\nqed\n(*\nlemma bisimSubstBangPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\\\<^sub>s Q\"\n and \"guarded P\"\n and \"guarded Q\"\n\n shows \"\\ \\ !P \\\\<^sub>s !Q\"\nusing assms\nby(fastforce intro: bisimSubstI bisimSubstE bisimBangPres)\n*)\n\nlemma weakBisimSubstParNil:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ P \\ \\ \\\\<^sub>s P\"\nby(metis strongBisimSubstWeakBisimSubst bisimSubstParNil) \n\nlemma weakBisimSubstParComm:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ P \\ Q \\\\<^sub>s Q \\ P\"\nby(metis strongBisimSubstWeakBisimSubst bisimSubstParComm) \n\nlemma weakBisimSubstParAssoc:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ (P \\ Q) \\ R \\\\<^sub>s P \\ (Q \\ R)\"\nby(metis strongBisimSubstWeakBisimSubst bisimSubstParAssoc) \n\nlemma weakBisimSubstResNil:\n fixes \\ :: 'b\n and x :: name\n\n shows \"\\ \\ \\\\x\\\\ \\\\<^sub>s \\\"\nby(metis strongBisimSubstWeakBisimSubst bisimSubstResNil) \n\nlemma weakBisimSubstScopeExt:\n fixes \\ :: 'b\n and x :: name\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ P\"\n\n shows \"\\ \\ \\\\x\\(P \\ Q) \\\\<^sub>s P \\ \\\\x\\Q\" \nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisimSubstScopeExt) \n\nlemma weakBisimSubstCasePushRes:\n fixes x :: name\n and \\ :: 'b\n and Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes \"x \\ map fst Cs\"\n\n shows \"\\ \\ \\\\x\\(Cases Cs) \\\\<^sub>s Cases map (\\(\\, P). (\\, \\\\x\\P)) Cs\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisimSubstCasePushRes) \n\nlemma weakBisimSubstOutputPushRes:\n fixes x :: name\n and \\ :: 'b\n and M :: 'a\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ \\\"\n and \"x \\ M\"\n and \"x \\ N\"\n\n shows \"\\ \\ \\\\x\\(M\\N\\.P) \\\\<^sub>s M\\N\\.\\\\x\\P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisimSubstOutputPushRes) \n\nlemma weakBisimSubstInputPushRes:\n fixes x :: name\n and \\ :: 'b\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"x \\ M\"\n and \"x \\ xvec\"\n and \"x \\ N\"\n\n shows \"\\ \\ \\\\x\\(M\\\\*xvec N\\.P) \\\\<^sub>s M\\\\*xvec N\\.\\\\x\\P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisimSubstInputPushRes) \n\nlemma weakBisimSubstResComm:\n fixes x :: name\n and y :: name\n\n shows \"\\ \\ \\\\x\\(\\\\y\\P) \\\\<^sub>s \\\\y\\(\\\\x\\P)\"\nby(metis strongBisimSubstWeakBisimSubst bisimSubstResComm) \n\nlemma weakBisimSubstExtBang:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n \n assumes \"guarded P\"\n\n shows \"\\ \\ !P \\\\<^sub>s P \\ !P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisimSubstExtBang) \n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Weak_Bisim_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.28767505027774876}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Plus\nimports\n \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"plus.c\"\ninstall_C_file \"plus.c\"\n\nautocorres [ ts_force nondet = plus2 ] \"plus.c\"\n\ncontext plus begin\n\n(* 3 + 2 should be 5 *)\nlemma \"plus' 3 2 = 5\"\n unfolding plus'_def\n by eval\n\n(* plus does what it says on the box *)\nlemma plus_correct: \"plus' a b = a + b\"\n unfolding plus'_def\n apply (rule refl)\n done\n\n(* Compare pre-lifting to post-lifting *)\nthm plus_global_addresses.plus2_body_def\nthm plus2'_def\n\n(* plus2 does what it says on the box *)\nlemma plus2_correct: \"\\\\s. True\\ plus2' a b \\ \\r s. r = a + b\\\"\n unfolding plus2'_def\n apply (subst whileLoop_add_inv\n [where I=\"\\(a', b') s. a' + b' = a + b\"\n and M=\"\\((a', b'), s). b'\"])\n apply (wp, auto simp: not_less)\n done\n\n(* plus2 does what it says on plus's box *)\nlemma plus2_is_plus: \"\\ \\s. True \\ plus2' a b \\ \\r s. r = plus' a b \\\"\n unfolding plus'_def\n apply (simp add:plus2_correct)\n done\n\n(* Prove plus2 with no failure *)\nlemma plus2_valid:\"\\ \\s. True \\ plus2' a b \\ \\r s. r = a + b \\!\"\n unfolding plus2'_def\n apply (subst whileLoop_add_inv\n [where I=\"\\(a', b') s. a' + b' = a + b\"\n and M=\"\\((a', b'), s). b'\"])\n apply wp\n apply clarsimp\n apply unat_arith\n apply clarsimp\n apply unat_arith\n apply clarsimp\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/Plus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.28754478422412977}} {"text": "(* Title: HOL/Auth/n_germanish_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanish Protocol Case Study*} \n\ntheory n_germanish_lemma_inv__2_on_rules imports n_germanish_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__2 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_t1 i)\\\n (\\ i. i\\N\\r=n_t2 i)\\\n (\\ i. i\\N\\r=n_t3 i)\\\n (\\ i. i\\N\\r=n_t4 i)\\\n (\\ i. i\\N\\r=n_t5 i)\\\n (\\ i. i\\N\\r=n_t6 N i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t2 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t2Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t3 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t3Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t4 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t4Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t5 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t5Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t6 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t6Vsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/germanish/n_germanish_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587585, "lm_q2_score": 0.41111086923216805, "lm_q1q2_score": 0.2874710928559026}} {"text": "(* Author: Florian Haftmann, TU Muenchen *)\n\nsection {* Reflecting Pure types into HOL *}\n\ntheory Typerep\nimports String\nbegin\n\ndatatype typerep = Typerep String.literal \"typerep list\"\n\nclass typerep =\n fixes typerep :: \"'a itself \\ typerep\"\nbegin\n\ndefinition typerep_of :: \"'a \\ typerep\" where\n [simp]: \"typerep_of x = typerep TYPE('a)\"\n\nend\n\nsyntax\n \"_TYPEREP\" :: \"type => logic\" (\"(1TYPEREP/(1'(_')))\")\n\nparse_translation {*\n let\n fun typerep_tr (*\"_TYPEREP\"*) [ty] =\n Syntax.const @{const_syntax typerep} $\n (Syntax.const @{syntax_const \"_constrain\"} $ Syntax.const @{const_syntax Pure.type} $\n (Syntax.const @{type_syntax itself} $ ty))\n | typerep_tr (*\"_TYPEREP\"*) ts = raise TERM (\"typerep_tr\", ts);\n in [(@{syntax_const \"_TYPEREP\"}, K typerep_tr)] end\n*}\n\ntyped_print_translation {*\n let\n fun typerep_tr' ctxt (*\"typerep\"*)\n (Type (@{type_name fun}, [Type (@{type_name itself}, [T]), _]))\n (Const (@{const_syntax Pure.type}, _) :: ts) =\n Term.list_comb\n (Syntax.const @{syntax_const \"_TYPEREP\"} $ Syntax_Phases.term_of_typ ctxt T, ts)\n | typerep_tr' _ T ts = raise Match;\n in [(@{const_syntax typerep}, typerep_tr')] end\n*}\n\nsetup {*\nlet\n\nfun add_typerep tyco thy =\n let\n val sorts = replicate (Sign.arity_number thy tyco) @{sort typerep};\n val vs = Name.invent_names Name.context \"'a\" sorts;\n val ty = Type (tyco, map TFree vs);\n val lhs = Const (@{const_name typerep}, Term.itselfT ty --> @{typ typerep})\n $ Free (\"T\", Term.itselfT ty);\n val rhs = @{term Typerep} $ HOLogic.mk_literal tyco\n $ HOLogic.mk_list @{typ typerep} (map (HOLogic.mk_typerep o TFree) vs);\n val eq = HOLogic.mk_Trueprop (HOLogic.mk_eq (lhs, rhs));\n in\n thy\n |> Class.instantiation ([tyco], vs, @{sort typerep})\n |> `(fn lthy => Syntax.check_term lthy eq)\n |-> (fn eq => Specification.definition (NONE, (Attrib.empty_binding, eq)))\n |> snd\n |> Class.prove_instantiation_exit (K (Class.intro_classes_tac []))\n end;\n\nfun ensure_typerep tyco thy =\n if not (Sorts.has_instance (Sign.classes_of thy) tyco @{sort typerep})\n andalso Sorts.has_instance (Sign.classes_of thy) tyco @{sort type}\n then add_typerep tyco thy else thy;\n\nin\n\nadd_typerep @{type_name fun}\n#> Typedef.interpretation (Local_Theory.background_theory o ensure_typerep)\n#> Code.datatype_interpretation (ensure_typerep o fst)\n#> Code.abstype_interpretation (ensure_typerep o fst)\n\nend\n*}\n\n\n\nlemma [code nbe]:\n \"HOL.equal (x :: typerep) x \\ True\"\n by (fact equal_refl)\n\ncode_printing\n type_constructor typerep \\ (Eval) \"Term.typ\"\n| constant Typerep \\ (Eval) \"Term.Type/ (_, _)\"\n\ncode_reserved Eval Term\n\nhide_const (open) typerep Typerep\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Typerep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.28743092013945154}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__1_on_rules imports n_mutualEx_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6926419831347361, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.287376359352987}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory ClockView\nimports\n KBPsAlg\n Eval\n List_local\n ODList\n Trie2\n \"Transitive-Closure.Transitive_Closure_List_Impl\"\n \"HOL-Library.Mapping\"\nbegin\n(*>*)\n\nsubsection\\The Clock View\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view}\n\nThe \\emph{clock view} records the current time and the observation for\nthe most recent state:\n\n\\\n\ndefinition (in Environment)\n clock_jview :: \"('a, 's, nat \\ 'obs) JointView\"\nwhere\n \"clock_jview \\ \\a t. (tLength t, envObs a (tLast t))\"\n(*<*)\n\ncontext Environment\nbegin\n\nlemma clock_jview_tInit:\n \"clock_jview a (tInit s) = (0, envObs a s)\"\n unfolding clock_jview_def by simp\n\nlemma clock_jview_tStep:\n \"clock_jview a (t \\ s) = (Suc (tLength t), envObs a s)\"\n unfolding clock_jview_def by simp\n\nlemma clock_jview_tStepI[intro]:\n \"\\ tLength t = Suc n; envObs a (tLast t) = obs \\\n \\ clock_jview a t = (Suc n, obs)\"\n unfolding clock_jview_def by (cases t) simp_all\n\nlemma clock_jview_inv:\n \"clock_jview a t = (n, obs) \\ envObs a (tLast t) = obs\"\n unfolding clock_jview_def by (cases t) simp_all\n\nlemmas clock_jview_simps =\n clock_jview_tInit\n clock_jview_tStep\n clock_jview_inv\n\nlemma clock_jview_eq_inv[iff]:\n \"clock_jview a t' = clock_jview a t\n \\ tLength t' = tLength t \\ envObs a (tLast t') = envObs a (tLast t)\"\n by (fastforce simp: clock_jview_def)\n\nend(*>*)\n\ntext\\\n\nThis is the least-information synchronous view, given the requirements\nof \\S\\ref{sec:kbps-views}. We show that finite-state implementations\nexist for all environments with respect to this view as per\n\\<^citet>\\\"Ron:1996\"\\.\n\nThe corresponding incremental view simply increments the counter\nrecords the new observation.\n\n\\\n\ndefinition (in Environment)\n clock_jviewInit :: \"'a \\ 'obs \\ nat \\ 'obs\"\nwhere\n \"clock_jviewInit \\ \\a obs. (0, obs)\"\n\ndefinition (in Environment)\n clock_jviewIncr :: \"'a \\ 'obs \\ nat \\ 'obs \\ nat \\ 'obs\"\nwhere\n \"clock_jviewIncr \\ \\a obs' (l, obs). (l + 1, obs')\"\n\ntext\\\n\nIt is straightforward to demonstrate the assumptions of the\nincremental environment locale (\\S\\ref{sec:kbps-environments}) with\nrespect to an arbitrary environment.\n\n\\\n\nsublocale Environment\n < Clock: IncrEnvironment jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n(*<*)\n apply (unfold_locales)\n apply (simp_all add: clock_jviewInit_def clock_jviewIncr_def clock_jview_def)\n done\n\n(*>*)\ntext\\\n\nAs we later show, satisfaction of a formula at a trace \\t \\\nClock.jkbpC\\<^bsub>n\\<^esub>\\ is determined by the set of final states of traces in\n\\Clock.jkbpCn\\:\n\n\\\n\ncontext Environment\nbegin\n\nabbreviation clock_commonAbs :: \"'s Trace \\ 's set\" where\n \"clock_commonAbs t \\ tLast ` Clock.jkbpCn (tLength t)\"\n\ntext\\\n\nIntuitively this set contains the states that the agents commonly\nconsider possible at time @{term \"n\"}, which is sufficient for\ndetermining knowledge as the clock view ignores paths. Therefore we\ncan simulate trace @{term \"t\"} by pairing this abstraction of @{term\n\"t\"} with its final state:\n\n\\\n\ntype_synonym (in -) 's clock_simWorlds = \"'s set \\ 's\"\n\ndefinition clock_sim :: \"'s Trace \\ 's clock_simWorlds\" where\n \"clock_sim \\ \\t. (clock_commonAbs t, tLast t)\"\n\ntext\\\n\nIn the Kripke structure for our simulation, we relate worlds for\n@{term \"a\"} if the sets of commonly-held states coincide, and the\nobservation of the final states of the traces is the\nsame. Propositions are evaluated at the final state.\n\n\\\n\ndefinition clock_simRels :: \"'a \\ 's clock_simWorlds Relation\" where\n \"clock_simRels \\ \\a. { ((X, s), (X', s')) |X X' s s'.\n X = X' \\ {s, s'} \\ X \\ envObs a s = envObs a s' }\"\n\ndefinition clock_simVal :: \"'s clock_simWorlds \\ 'p \\ bool\" where\n \"clock_simVal \\ envVal \\ snd\"\n\nabbreviation clock_simMC :: \"('a, 'p, 's clock_simWorlds) KripkeStructure\" where\n \"clock_simMC \\ mkKripke (clock_sim ` Clock.jkbpC) clock_simRels clock_simVal\"\n(*<*)\n\nlemma clock_simVal_def2[iff]: \"clock_simVal (clock_sim t) = envVal (tLast t)\"\n unfolding clock_sim_def clock_simVal_def by simp\n\nlemma clock_sim_range:\n \"sim_range Clock.MC clock_simMC clock_sim\"\n by (rule sim_rangeI) (simp_all add: clock_sim_def)\n\nlemma clock_simVal:\n \"sim_val Clock.MC clock_simMC clock_sim\"\n by (rule sim_valI) (simp add: clock_simVal_def clock_sim_def)\n\nlemma clock_sim_f:\n \"sim_f Clock.MC clock_simMC clock_sim\"\napply (rule sim_fI)\napply (simp add: clock_simRels_def clock_sim_def)\napply (intro conjI)\n apply (fastforce intro!: imageI)\n apply (fastforce intro!: imageI)\n apply (fastforce dest: Clock.mkM_simps(2))\napply (rule_tac x=v in image_eqI)\n apply simp_all\ndone\n\nlemma clock_sim_r:\n \"sim_r Clock.MC clock_simMC clock_sim\"\n apply (rule sim_rI)\n apply (clarsimp simp: clock_simRels_def clock_sim_def cong del: image_cong_simp)\n apply (rule_tac x=xa in exI)\n unfolding Clock.mkM_def\n apply auto\n done\n\n(*>*)\ntext\\\n\nThat this is in fact a simulation\n(\\S\\ref{sec:kripke-theory-simulations}) is entirely straightforward.\n\n\\\n\nlemma clock_sim:\n \"sim Clock.MC clock_simMC clock_sim\"\n(*<*)\n using clock_sim_range clock_simVal clock_sim_f clock_sim_r\n unfolding sim_def\n by blast\n(*>*)\n\nend (* context Environment *)\n\ntext\\\n\nThe \\SimIncrEnvironment\\ of\n\\S\\ref{sec:kbps-theory-automata-env-sims} only requires that we\nprovide it an @{term \"Environment\"} and a simulation.\n\n\\\n\nsublocale Environment\n < Clock: SimIncrEnvironment jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n clock_sim clock_simRels clock_simVal\n(*<*)\n by (unfold_locales, simp_all add: clock_sim)\n(*>*)\n\ntext\\\n\nWe next consider algorithmic issues.\n\n\\\n\n(* **************************************** *)\n\nsubsubsection\\Representations\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-rep}\n\nWe now turn to the issue of how to represent equivalence classes of\nstates. As these are used as map keys, it is easiest to represent them\ncanonically. A simple approach is to use \\emph{ordered distinct lists}\nof type @{typ \"'a odlist\"} for the sets and \\emph{tries} for the\nmaps. Therefore we ask that environment states @{typ \"'s\"} belong to\nthe class \\linorder\\ of linearly-ordered types, and moreover\nthat the set \\agents\\ be effectively presented. We introduce a\nnew locale capturing these requirements:\n\n\\\n\nlocale FiniteLinorderEnvironment =\n Environment jkbp envInit envAction envTrans envVal envObs\n for jkbp :: \"('a::{finite, linorder}, 'p, 'aAct) JKBP\"\n and envInit :: \"('s::{finite, linorder}) list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n and envObs :: \"'a \\ 's \\ 'obs\"\n+ fixes agents :: \"'a odlist\"\n assumes agents: \"ODList.toSet agents = UNIV\"\n\ncontext FiniteLinorderEnvironment\nbegin\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-algops}\n\nFor a fixed agent @{term \"a\"}, we can reduce the number of worlds in\n@{term \"clock_simMC\"} by taking its quotient with respect to the\nequivalence relation for @{term \"a\"}. In other words, we represent a\nsimulated equivalence class by a pair of the set of all states\nreachable at a particular time, and the subset of these that @{term\n\"a\"} considers possible. The worlds in our representational Kripke\nstructure are therefore a pair of ordered, distinct lists:\n\n\\\n\ntype_synonym (in -) 's clock_simWorldsRep = \"'s odlist \\ 's odlist\"\n\ntext\\\n\nWe can readily abstract a representation to a set of simulated\nequivalence classes:\n\n\\\n\ndefinition (in -)\n clock_simAbs :: \"'s::linorder clock_simWorldsRep \\ 's clock_simWorlds set\"\nwhere\n \"clock_simAbs X \\ { (ODList.toSet (fst X), s) |s. s \\ ODList.toSet (snd X) }\"\n\ntext\\\n\nAssuming @{term \"X\"} represents a simulated equivalence class for\n@{term \"t \\ jkbpC\"}, @{term \"clock_simAbs X\"} decomposes into these\ntwo functions:\n\n\\\n\ndefinition\n agent_abs :: \"'a \\ 's Trace \\ 's set\"\nwhere\n \"agent_abs a t \\\n { tLast t' |t'. t' \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t}\"\n\ndefinition\n common_abs :: \"'s Trace \\ 's set\"\nwhere\n \"common_abs t \\ tLast ` Clock.jkbpCn (tLength t)\"\n(*<*)\n\nlemma aec_refl[intro, simp]:\n \"t \\ Clock.jkbpC \\ tLast t \\ agent_abs a t\"\n unfolding agent_abs_def by auto\n\nlemma aec_cec_subset:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"x \\ ODList.toSet aec \\ x \\ ODList.toSet cec\"\n using assms\n unfolding agent_abs_def common_abs_def\n by fastforce\n\nlemma clock_simAbs_refl:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_sim t \\ clock_simAbs ec\"\n using assms by simp\n\nlemma common_abs:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (fst ec) = common_abs t\"\n using tC clock_simAbs_refl[OF tC ec]\n unfolding clock_sim_def clock_simAbs_def common_abs_def\n by (auto simp: ODList.toSet_def[symmetric])\n\nlemma agent_abs:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (snd ec) = agent_abs a t\"\n using assms\n unfolding clock_sim_def clock_simAbs_def agent_abs_def\n apply auto\n apply (subgoal_tac \"(ODList.toSet (fst ec), x) \\ {(ODList.toSet (fst ec), s) |s. s \\ ODList.toSet (snd ec)}\")\n apply auto (* FIXME filthy *)\n done\n\n(*>*)\ntext\\\n\nThis representation is canonical on the domain of interest (though not\nin general):\n\n\\\n\nlemma clock_simAbs_inj_on:\n \"inj_on clock_simAbs { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n(*<*)\nproof(rule inj_onI)\n fix x y\n assume x: \"x \\ { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n and y: \"y \\ { x . clock_simAbs x \\ Clock.jkbpSEC }\"\n and xy: \"clock_simAbs x = clock_simAbs y\"\n from x obtain a t\n where tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs x = Clock.sim_equiv_class a t\"\n by auto\n from common_abs[OF tC ec] common_abs[OF tC trans[OF xy[symmetric] ec], symmetric]\n have \"fst x = fst y\" by (blast intro: injD[OF toSet_inj])\n moreover\n from agent_abs[OF tC ec] agent_abs[OF tC trans[OF xy[symmetric] ec], symmetric]\n have \"snd x = snd y\" by (blast intro: injD[OF toSet_inj])\n ultimately show \"x = y\" by (simp add: prod_eqI)\nqed\n(*>*)\ntext\\\n\nWe could further compress this representation by labelling each\nelement of the set of states reachable at time $n$ with a bit to\nindicate whether the agent considers that state possible. Note,\nhowever, that the representation would be non-canonical: if \\(s, True)\\ is in the representation, indicating that the agent\nconsiders \\s\\ possible, then \\(s, False)\\ may or may\nnot be. The associated abstraction function is not injective and hence\nwould obfuscate the following. Repairing this would entail introducing\na new type, which would again complicate this development.\n\n\n\nThe following lemmas make use of this Kripke structure, constructed\nfrom the set of final states of a temporal slice @{term \"X\"}:\n\n\\\n\ndefinition\n clock_repRels :: \"'a \\ ('s \\ 's) set\"\nwhere\n \"clock_repRels \\ \\a. { (s, s'). envObs a s = envObs a s' }\"\n\nabbreviation\n clock_repMC :: \"'s set \\ ('a, 'p, 's) KripkeStructure\"\nwhere\n \"clock_repMC \\ \\X. mkKripke X clock_repRels envVal\"\n(*<*)\n\nlemma clock_repMC_kripke[intro, simp]: \"kripke (clock_repMC X)\"\n by (rule kripkeI) simp\n\nlemma clock_repMC_S5n[intro, simp]: \"S5n (clock_repMC X)\"\n unfolding clock_repRels_def\n by (intro S5nI equivI refl_onI symI transI) auto\n\n(*>*)\ntext\\\n\nWe can show that this Kripke structure retains sufficient information\nfrom @{term \"Clock.MCS\"} by showing simulation. This is eased by\nintroducing an intermediary structure that focusses on a particular\ntrace:\n\n\\\n\nabbreviation\n clock_jkbpCSt :: \"'b Trace \\ 's clock_simWorlds set\"\nwhere\n \"clock_jkbpCSt t \\ clock_sim ` Clock.jkbpCn (tLength t)\"\n\nabbreviation\n clock_simMCt :: \"'b Trace \\ ('a, 'p, 's clock_simWorlds) KripkeStructure\"\nwhere\n \"clock_simMCt t \\ mkKripke (clock_jkbpCSt t) clock_simRels clock_simVal\"\n\ndefinition clock_repSim :: \"'s clock_simWorlds \\ 's\" where\n \"clock_repSim \\ snd\"\n(*<*)\n\nlemma jkbpCSt_jkbpCS_subset:\n \"clock_jkbpCSt t \\ clock_sim ` Clock.jkbpC\"\n by auto\n\nlemma jkbpCSt_refl[iff]:\n \"t \\ Clock.jkbpC \\ clock_sim t \\ clock_jkbpCSt t\"\n by blast\n\nlemma fst_clock_sim[iff]:\n \"t \\ Clock.jkbpC \\ fst (clock_sim t) = tLast ` Clock.jkbpCn (tLength t)\"\n by (simp add: clock_sim_def)\n\nlemma clock_repSim_simps[simp]:\n \"clock_repSim ` clock_sim ` T = tLast ` T\"\n \"clock_repSim (clock_sim t) = tLast t\"\n unfolding clock_repSim_def clock_sim_def\n by (auto intro!: image_eqI)\n\n(*>*)\ntext\\\\\n\nlemma clock_repSim:\n assumes tC: \"t \\ Clock.jkbpC\"\n shows \"sim (clock_simMCt t)\n ((clock_repMC \\ fst) (clock_sim t))\n clock_repSim\"\n(*<*) (is \"sim ?M ?M' ?f\")\nproof\n show \"sim_range ?M ?M' ?f\"\n proof\n show \"worlds ?M' = ?f ` worlds ?M\"\n unfolding clock_sim_def clock_repSim_def by force\n next\n fix a\n show \"relations ?M' a \\ worlds ?M' \\ worlds ?M'\"\n by (simp add: clock_sim_def clock_repSim_def)\n qed\nnext\n show \"sim_val ?M ?M' ?f\"\n by (rule, simp add: clock_sim_def clock_simVal_def clock_repSim_def split: prod.split)\nnext\n show \"sim_f ?M ?M' ?f\"\n apply rule\n unfolding clock_repRels_def clock_repSim_def clock_simRels_def\n apply (auto iff: clock_sim_def)\n done\nnext\n show \"sim_r ?M ?M' ?f\"\n apply rule\n unfolding clock_repRels_def clock_repSim_def clock_simRels_def clock_sim_def\n apply clarsimp\n done\nqed\n\n(*>*)\ntext\\\n\nThe following sections show how we satisfy the remaining requirements\nof the \\Algorithm\\ locale of\nFigure~\\ref{fig:kbps-alg-alg-locale}. Where the proof is routine, we\nsimply present the lemma without proof or comment.\n\nDue to a limitation in the code generator in the present version of\nIsabelle (2011), we need to define the equations we wish to execute\noutside of a locale; the syntax \\(in -)\\ achieves this by\nmaking definitons at the theory top-level. We then define (but elide)\nlocale-local abbreviations that supply the locale-bound variables to\nthese definitions.\n\n\\\n\n(* **************************************** *)\n\nsubsubsection\\Initial states\\\n\ntext\\\n\nThe initial states of the automaton for an agent is simply @{term\n\"envInit\"} paired with the partition of @{term \"envInit\"} under the\nagent's observation.\n\n\\\n\ndefinition (in -)\n clock_simInit :: \"('s::linorder) list \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 'obs \\ 's clock_simWorldsRep\"\nwhere\n \"clock_simInit envInit envObs \\ \\a iobs.\n let cec = ODList.fromList envInit\n in (cec, ODList.filter (\\s. envObs a s = iobs) cec)\"\n(*<*)\n\nabbreviation\n clock_simInit :: \"'a \\ 'obs \\ 's clock_simWorldsRep\"\nwhere\n \"clock_simInit \\ ClockView.clock_simInit envInit envObs\"\n\n(*>*)\ntext\\\\\n\nlemma clock_simInit:\n assumes \"iobs \\ envObs a ` set envInit\"\n shows \"clock_simAbs (clock_simInit a iobs)\n = clock_sim ` { t' \\ Clock.jkbpC.\n clock_jview a t' = clock_jviewInit a iobs }\"\n(*<*)\n using assms\n unfolding clock_simInit_def clock_simAbs_def clock_sim_def [abs_def] Let_def\n apply clarsimp\n apply rule\n apply clarsimp\n apply (rule_tac x=\"tInit s\" in image_eqI)\n apply (auto simp: Set.image_def Clock.jviewInit)[2]\n apply clarsimp\n apply (case_tac xa)\n apply clarsimp\n apply rule\n apply rule\n apply clarsimp\n apply clarsimp\n apply (rule_tac x=\"tInit xa\" in image_eqI)\n apply (auto intro!: image_eqI simp: Clock.jviewInit)\n done\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated observations\\\n\ntext\\\n\nAgent @{term \"a\"} will make the same observation at any of the worlds\nthat it considers possible, so we choose the first one in the list:\n\n\\\n\ndefinition (in -)\n clock_simObs :: \"('a \\ ('s :: linorder) \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 'obs\"\nwhere\n \"clock_simObs envObs \\ \\a. envObs a \\ ODList.hd \\ snd\"\n(*<*)\n\nabbreviation\n clock_simObs :: \"'a \\ 's clock_simWorldsRep \\ 'obs\"\nwhere\n \"clock_simObs \\ ClockView.clock_simObs envObs\"\n\n(*>*)\ntext\\\\\n\nlemma clock_simObs:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_simObs a ec = envObs a (tLast t)\"\n(*<*)\nproof -\n have A: \"\\s \\ set (toList (snd ec)). envObs a s = envObs a (tLast t)\"\n using agent_abs[OF tC ec]\n by (clarsimp simp: agent_abs_def toSet_def)\n have B: \"tLast t \\ set (toList (snd ec))\"\n using clock_simAbs_refl[OF assms]\n unfolding clock_simAbs_def clock_sim_def\n by (simp add: toSet_def snd_def)\n show ?thesis\n unfolding clock_simObs_def by (simp add: list_choose_hd[OF A B] ODList.hd_def)\nqed\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Evaluation\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-eval}\n\nWe define our \\eval\\ function in terms of @{term \"evalS\"},\nwhich implements boolean logic over @{typ \"'s odlist\"} in the usual\nway -- see \\S\\ref{sec:kbps-spr-single-agent-eval} for the relevant\nclauses. It requires three functions specific to the representation:\none each for propositions, knowledge and common knowledge.\n\nPropositions define subsets of the worlds considered possible:\n\n\\\n\nabbreviation (in -)\n clock_evalProp :: \"(('s::linorder) \\ 'p \\ bool)\n \\ 's odlist \\ 'p \\ 's odlist\"\nwhere\n \"clock_evalProp envVal \\ \\X p. ODList.filter (\\s. envVal s p) X\"\n\ntext\\\n\nThe knowledge relation computes the subset of the\ncommonly-held-possible worlds \\cec\\ that agent @{term \"a\"}\nconsiders possible at world @{term \"s\"}:\n\n\\\n\ndefinition (in -)\n clock_knowledge :: \"('a \\ ('s :: linorder) \\ 'obs) \\ 's odlist\n \\ 'a \\ 's \\ 's odlist\"\nwhere\n \"clock_knowledge envObs cec \\ \\a s.\n ODList.filter (\\s'. envObs a s = envObs a s') cec\"\n\ntext\\\n\n\nSimilarly the common knowledge operation computes the transitive\nclosure of the union of the knowledge relations for the agents \\as\\:\n\n\\\n\ndefinition (in -)\n clock_commonKnowledge :: \"('a \\ ('s :: linorder) \\ 'obs) \\ 's odlist\n \\ 'a list \\ 's \\ 's odlist\"\nwhere\n \"clock_commonKnowledge envObs cec \\ \\as s.\n let r = \\a. ODList.fromList [ (s', s'') . s' \\ toList cec, s'' \\ toList cec,\n envObs a s' = envObs a s'' ];\n R = toList (ODList.big_union r as)\n in ODList.fromList (memo_list_trancl R s)\"\n\ntext\\\n\nThe function \\memo_list_trancl\\ comes from the executable\ntransitive closure theory of \\<^citep>\\\"AFP:TRANCL\"\\.\n\nThe evaluation function evaluates a subjective knowledge formula on\nthe representation of an equivalence class:\n\n\\\n\ndefinition (in -)\n eval :: \"(('s :: linorder) \\ 'p \\ bool)\n \\ ('a \\ 's \\ 'obs)\n \\ 's clock_simWorldsRep \\ ('a, 'p) Kform \\ bool\"\nwhere\n \"eval envVal envObs \\ \\(cec, aec). evalS (clock_evalProp envVal)\n (clock_knowledge envObs cec)\n (clock_commonKnowledge envObs cec)\n aec\"\n\ntext\\\n\nThis function corresponds with the standard semantics:\n\n\\\n(*<*)\n\nlemma clock_coEC_relation_image:\n \"s \\ ODList.toSet Y\n \\ ODList.toSet (clock_knowledge envObs Y a s) = relations (clock_repMC (ODList.toSet Y)) a `` {s}\"\n unfolding clock_knowledge_def clock_repRels_def Image_def\n by auto\n\nlemma clock_commonKnowledge_relation_image_aux:\n \"(\\x\\set as. \\a\\ODList.toSet Y. \\aa\\ODList.toSet Y \\ {s''. envObs x a = envObs x s''}. {(a, aa)})\n = ((\\a\\set as. {(s, s'). envObs a s = envObs a s'}) \\ ODList.toSet Y \\ ODList.toSet Y)\"\n by auto\n\nlemma clock_commonKnowledge_relation_image:\n \"s \\ ODList.toSet Y\n \\ ODList.toSet (clock_commonKnowledge envObs Y as s) = (\\a \\ set as. relations (clock_repMC (ODList.toSet Y)) a)\\<^sup>+ `` {s}\"\n unfolding clock_commonKnowledge_def clock_repRels_def Let_def\n apply (simp add: memo_list_trancl toSet_def[symmetric] Image_def clock_commonKnowledge_relation_image_aux)\n done\n\nlemma eval_rec_models:\n assumes XY: \"ODList.toSet X \\ ODList.toSet Y\"\n and s: \"s \\ ODList.toSet X\"\n shows \"s \\ ODList.toSet (eval_rec (clock_evalProp envVal) (clock_knowledge envObs Y) (clock_commonKnowledge envObs Y) X \\)\n \\ clock_repMC (ODList.toSet Y), s \\ \\\"\nusing XY s\nproof(induct \\ arbitrary: X s)\n case (Kknows a' \\ X s)\n from \\s \\ ODList.toSet X\\ clock_coEC_relation_image[OF subsetD[OF Kknows(2) Kknows(3)], where a=a']\n show ?case\n apply simp\n apply rule\n apply (drule arg_cong[where f=\"ODList.toSet\"])\n apply (clarsimp simp: odlist_all_iff)\n apply (cut_tac s3=\"w'\" and X3=\"clock_knowledge envObs Y a' s\" in Kknows.hyps)\n using Kknows(2) Kknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])[3]\n\n apply (clarsimp simp: toSet_eq_iff odlist_all_iff)\n apply (subst Kknows.hyps)\n using Kknows(2) Kknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])\n done\nnext\n case (Kcknows as \\ X s)\n show ?case\n proof(cases \"as = Nil\")\n case True with \\s \\ ODList.toSet X\\ show ?thesis by clarsimp\n next\n case False\n with \\s \\ ODList.toSet X\\ clock_commonKnowledge_relation_image[OF subsetD[OF Kcknows(2) Kcknows(3)], where as=as]\n show ?thesis\n apply simp\n apply rule\n apply (drule arg_cong[where f=\"ODList.toSet\"])\n apply (clarsimp simp: odlist_all_iff)\n apply (cut_tac s3=\"w'\" and X3=\"clock_commonKnowledge envObs Y as s\" in Kcknows.hyps)\n using Kcknows(2) Kcknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])[3]\n apply (subst (asm) trancl_unfold) back back back\n apply auto[1] (* FIXME disgusting *)\n\n apply (clarsimp simp: toSet_eq_iff odlist_all_iff)\n apply (subst Kcknows.hyps)\n using Kcknows(2) Kcknows(3)\n apply (auto simp add: S5n_rels_closed[OF clock_repMC_S5n])\n apply (subst (asm) trancl_unfold) back back back\n apply auto[1] (* FIXME disgusting *)\n\n done\n qed\nqed simp_all\n\nlemma trc_aux:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"ODList.toSet (big_union (clock_commonKnowledge envObs cec as) (toList aec)) \\ ODList.toSet cec\"\n apply (clarsimp simp: toSet_def[symmetric])\n apply (subst (asm) clock_commonKnowledge_relation_image)\n apply (erule aec_cec_subset[OF tC aec cec])\n apply (subst (asm) trancl_unfold)\n using assms\n apply (auto simp: agent_abs_def)\n done\n\nlemma clock_repMC_aec:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and x: \"x \\ ODList.toSet aec\"\n and xy: \"(x, y) \\ relations (clock_repMC (ODList.toSet cec)) a\"\n shows \"y \\ ODList.toSet aec\"\n using assms\n unfolding clock_repRels_def agent_abs_def common_abs_def\n by auto\n\nlemma clock_repMC_cec:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and x: \"x \\ ODList.toSet aec\"\n and y: \"y \\ ODList.toSet aec\"\n shows \"(x, y) \\ relations (clock_repMC (ODList.toSet cec)) a\"\n using assms\n unfolding clock_repRels_def agent_abs_def common_abs_def\n by auto\n\nlemma evalS_models:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and subj_phi: \"subjective a \\\"\n and s: \"s \\ ODList.toSet aec\"\n shows \"evalS (clock_evalProp envVal) (clock_knowledge envObs cec) (clock_commonKnowledge envObs cec) aec \\\n \\ clock_repMC (ODList.toSet cec), s \\ \\\" (is \"?lhs \\ = ?rhs \\\")\nusing subj_phi s aec cec\nproof(induct \\ rule: subjective.induct[case_names Kprop Knot Kand Kknows Kcknows])\n case (Kknows a a' \\) show ?case\n apply (clarsimp simp: toSet_eq_iff)\n apply rule\n apply clarsimp\n apply (subgoal_tac \"w' \\ ODList.toSet aec\")\n apply (drule_tac c=\"w'\" in subsetD)\n apply assumption\n apply (simp add: eval_rec_models[OF subsetI[OF aec_cec_subset[OF tC aec cec]]])\n apply (rule clock_repMC_aec[OF tC Kknows(3) Kknows(4), rotated, where x=s])\n using Kknows\n apply simp\n using Kknows\n apply simp\n\n apply clarsimp\n apply (simp add: eval_rec_models[OF subsetI[OF aec_cec_subset[OF tC aec cec]]])\n using tC Kknows\n apply (clarsimp simp: agent_abs_def)\n apply (erule (1) ballE)\n using Kknows\n apply (cut_tac x=\"tLast t'\" and y=\"tLast t'a\" in clock_repMC_cec[OF tC Kknows(3) Kknows(4)])\n unfolding clock_repRels_def\n apply auto\n done\nnext\n case (Kcknows a as \\)\n have \"?lhs (Kcknows as \\)\n = (\\y\\ODList.toSet aec.\n \\x\\(\\a\\set as. relations (clock_repMC (ODList.toSet cec)) a)\\<^sup>+ `` {y}.\n x \\ ODList.toSet (eval_rec (clock_evalProp envVal) (clock_knowledge envObs cec) (clock_commonKnowledge envObs cec)\n (big_union (clock_commonKnowledge envObs cec as) (toList aec)) \\))\"\n (* FIXME dreaming of a cong rule here. *)\n using toSet_def[symmetric]\n apply (clarsimp simp: toSet_eq_iff toSet_def[symmetric] subset_eq)\n apply (rule ball_cong[OF refl])\n apply (rule ball_cong)\n apply (subst clock_commonKnowledge_relation_image[OF aec_cec_subset[OF tC Kcknows(3) Kcknows(4)]])\n apply simp_all\n done\n also have \"... = (\\s\\ODList.toSet aec. clock_repMC (ODList.toSet cec), s \\ Kcknows as \\)\"\n apply (rule ball_cong[OF refl])\n apply simp\n apply (rule ball_cong[OF refl])\n apply (subst eval_rec_models[OF trc_aux[OF tC Kcknows(3) Kcknows(4), where as=as], symmetric])\n apply (simp add: toSet_def[symmetric])\n apply (rule_tac x=y in bexI)\n apply (subst clock_commonKnowledge_relation_image[OF aec_cec_subset[OF tC Kcknows(3) Kcknows(4)]])\n apply simp_all\n done\n also have \"... = clock_repMC (ODList.toSet cec), s \\ Kknows a (Kcknows as \\)\"\n using clock_repMC_aec[OF tC Kcknows(3) Kcknows(4) Kcknows(2)]\n clock_repMC_cec[OF tC Kcknows(3) Kcknows(4) Kcknows(2)]\n by (auto cong: ball_cong)\n also have \"... = clock_repMC (ODList.toSet cec), s \\ Kcknows as \\\"\n apply (rule S5n_common_knowledge_fixed_point_simpler[symmetric])\n using Kcknows\n apply (auto intro: aec_cec_subset[OF tC Kcknows(3) Kcknows(4) Kcknows(2)])\n done\n finally show ?case .\nqed simp_all\n\n(*>*)\nlemma eval_models:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n and subj_phi: \"subjective a \\\"\n and s: \"s \\ ODList.toSet aec\"\n shows \"eval envVal envObs (cec, aec) \\\n \\ clock_repMC (ODList.toSet cec), s \\ \\\"\n(*<*)\n unfolding eval_def\n using evalS_models[OF tC aec cec subj_phi s]\n apply (simp add: Let_def)\n done\n\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated actions\\\n\ntext\\\n\nFrom a common equivalence class and a subjective equivalence class for\nagent @{term \"a\"}, we can compute the actions enabled for @{term \"a\"}:\n\n\\\n\ndefinition (in -)\n clock_simAction :: \"('a, 'p, 'aAct) JKBP \\ (('s :: linorder) \\ 'p \\ bool)\n \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 'aAct list\"\nwhere\n \"clock_simAction jkbp envVal envObs \\ \\a (Y, X).\n [ action gc. gc \\ jkbp a, eval envVal envObs (Y, X) (guard gc) ]\"\n(*<*)\n\nabbreviation\n clock_simAction :: \"'a \\ 's clock_simWorldsRep \\ 'aAct list\"\nwhere\n \"clock_simAction \\ ClockView.clock_simAction jkbp envVal envObs\"\n\n(*>*)\ntext\\\n\nUsing the above result about evaluation, we can relate \\clock_simAction\\ to @{term \"jAction\"}. Firstly, \\clock_simAction\\ behaves the same as @{term \"jAction\"} using the\n@{term \"clock_repMC\"} structure:\n\n\\\n\nlemma clock_simAction_jAction:\n assumes tC: \"t \\ Clock.jkbpC\"\n and aec: \"ODList.toSet aec = agent_abs a t\"\n and cec: \"ODList.toSet cec = common_abs t\"\n shows \"set (clock_simAction a (cec, aec))\n = set (jAction (clock_repMC (ODList.toSet cec)) (tLast t) a)\"\n(*<*)\n unfolding clock_simAction_def jAction_def\n apply clarsimp\n apply rule\n apply clarsimp\n apply (rule_tac x=xa in bexI)\n apply simp\n apply clarsimp\n apply (subst eval_models[OF tC aec cec, symmetric])\n using tC aec cec subj\n apply simp_all\n apply clarsimp\n apply (rule_tac x=xa in bexI)\n apply (rule refl)\n apply clarsimp\n apply (subst eval_models[OF tC aec cec])\n using tC aec cec subj\n apply simp_all\n done\n\nlemma clock_submodel_aux:\n assumes tC: \"t \\ Clock.jkbpC\"\n and s: \"s \\ worlds (clock_simMCt t)\"\n shows \"gen_model Clock.MCS s = gen_model (clock_simMCt t) s\"\nproof(rule gen_model_subset[where T=\"clock_jkbpCSt t\"])\n fix a\n let ?X = \"clock_sim ` Clock.jkbpCn (tLength t)\"\n show \"relations Clock.MCS a \\ ?X \\ ?X\n = relations (clock_simMCt t) a \\ ?X \\ ?X\"\n by (simp add: Int_ac Int_absorb1\n relation_mono[OF jkbpCSt_jkbpCS_subset jkbpCSt_jkbpCS_subset])\nnext\n let ?X = \"clock_sim ` Clock.jkbpCn (tLength t)\"\n from s show \"(\\a. relations (clock_simMCt t) a)\\<^sup>* `` {s} \\ ?X\"\n apply (clarsimp simp del: mkKripke_simps)\n apply (erule kripke_rels_trc_worlds)\n apply auto\n done\nnext\n let ?Y = \"Clock.jkbpCn (tLength t)\"\n let ?X = \"clock_sim ` ?Y\"\n from s obtain t'\n where st': \"s = clock_sim t'\"\n and t'C: \"t' \\ Clock.jkbpC\"\n and t'O: \"tLength t = tLength t'\"\n by fastforce\n { fix t''\n assume tt': \"(t', t'') \\ (\\a. relations Clock.MC a)\\<^sup>*\"\n from t'C tt' have t''C: \"t'' \\ Clock.jkbpC\"\n by - (erule kripke_rels_trc_worlds, simp_all)\n from t'O tt' have t''O: \"tLength t = tLength t''\"\n by (simp add: Clock.sync_tLength_eq_trc)\n from t''C t''O have \"t'' \\ ?Y\" by fastforce }\n hence \"(\\a. relations Clock.MC a)\\<^sup>* `` {t'} \\ ?Y\"\n by clarsimp\n hence \"clock_sim ` ((\\a. relations Clock.MC a)\\<^sup>* `` {t'}) \\ ?X\"\n by (rule image_mono)\n with st' t'C\n show \"(\\a. relations Clock.MCS a)\\<^sup>* `` {s} \\ ?X\"\n using sim_trc_commute[OF Clock.mkM_kripke clock_sim, where t=t'] by simp\nqed (insert s, auto)\n\n(*>*)\ntext\\\n\nWe can connect the agent's choice of actions on the \\clock_repMC\\ structure to those on the \\Clock.MC\\\nstructure using our earlier results about actions being preserved by\ngenerated models and simulations.\n\n\\\n\nlemma clock_simAction':\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes aec: \"ODList.toSet aec = agent_abs a t\"\n assumes cec: \"ODList.toSet cec = common_abs t\"\n shows \"set (clock_simAction a (cec, aec)) = set (jAction Clock.MC t a)\"\n(*<*) (is \"?lhs = ?rhs\")\nproof -\n from tC aec cec\n have \"?lhs = set (jAction (clock_repMC (ODList.toSet cec)) (tLast t) a)\"\n by (rule clock_simAction_jAction)\n also from tC aec cec\n have \"... = set (jAction (clock_simMCt t) (clock_sim t) a)\"\n by (simp add: simulation_jAction_eq[OF _ clock_repSim] common_abs_def)\n also from tC\n have \"... = set (jAction Clock.MCS (clock_sim t) a)\"\n using gen_model_jAction_eq[OF clock_submodel_aux[OF tC, where s=\"clock_sim t\"], where w'=\"clock_sim t\"]\n gen_model_world_refl[where w=\"clock_sim t\" and M=\"clock_simMCt t\"]\n by simp\n also from tC have \"... = set (jAction Clock.MC t a)\"\n by (simp add: simulation_jAction_eq[OF _ clock_sim])\n finally show ?thesis .\nqed\n\n(*>*)\ntext\\\n\nThe @{term \"Algorithm\"} locale requires a specialisation of this\nlemma:\n\n\\\n\nlemma clock_simAction:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"set (clock_simAction a ec) = set (jAction Clock.MC t a)\"\n(*<*)\n using assms clock_simAction'[OF tC, where cec=\"fst ec\" and aec=\"snd ec\"]\n apply (simp add: common_abs agent_abs)\n done\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\Simulated transitions\\\n\ntext\\\n\nWe need to determine the image of the set of commonly-held-possible\nstates under the transition function, and also for the agent's\nsubjective equivalence class. We do this with the \\clock_trans\\ function:\n\n\\\n\ndefinition (in -)\n clock_trans :: \"('a :: linorder) odlist \\ ('a, 'p, 'aAct) JKBP\n \\ (('s :: linorder) \\ 'eAct list)\n \\ ('eAct \\ ('a \\ 'aAct) \\ 's \\ 's)\n \\ ('s \\ 'p \\ bool) \\ ('a \\ 's \\ 'obs)\n \\ 's odlist \\ 's odlist \\ 's odlist\"\nwhere\n \"clock_trans agents jkbp envAction envTrans envVal envObs \\ \\cec X.\n ODList.fromList (concat\n [ [ envTrans eact aact s .\n eact \\ envAction s,\n aact \\ listToFuns (\\a. clock_simAction jkbp envVal envObs a\n (cec, clock_knowledge envObs cec a s))\n (toList agents) ] .\n s \\ toList X ])\"\n(*<*)\n\nabbreviation\n clock_trans :: \"'s odlist \\ 's odlist \\ 's odlist\"\nwhere\n \"clock_trans \\ ClockView.clock_trans agents jkbp envAction envTrans envVal envObs\"\n\nlemma clock_trans_aux:\n assumes t'C: \"t' \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a' t'\"\n and tC: \"t \\ Clock.jkbpCn (tLength t')\"\n and eact: \"eact \\ set (envAction (tLast t))\"\n shows \"(aact \\ set (listToFuns (\\a. clock_simAction a (fst ec, clock_knowledge envObs (fst ec) a (tLast t)))\n (toList agents)))\n \\ (\\a. aact a \\ set (jAction (Clock.MCn (tLength t')) t a))\"\n using assms\n apply -\n apply (frule Clock.jkbpCn_jkbpC_inc)\n apply (clarsimp simp: listToFuns_ext[OF agents[unfolded toSet_def]])\n apply (subst clock_simAction')\n apply (erule Clock.jkbpCn_jkbpC_inc)\n apply (subst clock_coEC_relation_image)\n apply (simp add: common_abs common_abs_def toSet_def[symmetric])\n apply (fastforce simp: common_abs agent_abs_def common_abs_def clock_repRels_def)\n apply (simp add: common_abs common_abs_def)\n apply (simp add: Clock.jkbpC_jkbpCn_jAction_eq)\n done\n\n(*>*)\ntext\\\n\nThe function @{term \"listToFuns\"} exhibits the isomorphism between @{typ\n\"('a \\ 'b list) list\"} and @{typ \"('a \\ 'b) list\"} for finite types\n@{typ \"'a\"}.\n\nWe can show that the transition function works for both the\ncommonly-held set of states and the agent subjective one. The proofs\nare straightforward.\n\n\\\n\nlemma clock_trans_common:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (clock_trans (fst ec) (fst ec))\n = { s |t' s. t' \\ s \\ Clock.jkbpC \\ tLength t' = tLength t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n show \"?lhs \\ ?rhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] common_abs_def)\n apply (rule_tac x=xa in exI)\n apply clarsimp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] common_abs_def)\n apply (drule Clock.jkbpC_tLength_inv[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nqed\n\n(*>*)\ntext\\\\\n\nlemma clock_trans_agent:\n assumes tC: \"t \\ Clock.jkbpC\"\n assumes ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"ODList.toSet (clock_trans (fst ec) (snd ec))\n = { s |t' s. t' \\ s \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n show \"?lhs \\ ?rhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] agent_abs[OF assms] common_abs_def agent_abs_def)\n apply (rule_tac x=t' in exI)\n apply clarsimp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_trans_def\n apply (clarsimp simp: toSet_def[symmetric] common_abs[OF assms] agent_abs[OF assms] common_abs_def agent_abs_def)\n apply (drule Clock.jkbpC_tLength_inv[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def iff: clock_trans_aux[OF tC ec])\n done\nqed\n\n(*>*)\ntext\\\n\nNote that the clock semantics disregards paths, so we simply compute\nthe successors of the temporal slice and partition that. Similarly the\nsuccessors of the agent's subjective equivalence class tell us what\nthe set of possible observations are:\n\n\\\n\ndefinition (in -)\n clock_mkSuccs :: \"('s :: linorder \\ 'obs) \\ 'obs \\ 's odlist\n \\ 's clock_simWorldsRep\"\nwhere\n \"clock_mkSuccs envObs obs Y' \\ (Y', ODList.filter (\\s. envObs s = obs) Y')\"\n\ntext\\\n\nFinally we can define our transition function on simulated states:\n\n\\\n\ndefinition (in -)\n clock_simTrans :: \"('a :: linorder) odlist \\ ('a, 'p, 'aAct) JKBP\n \\ (('s :: linorder) \\ 'eAct list)\n \\ ('eAct \\ ('a \\ 'aAct) \\ 's \\ 's)\n \\ ('s \\ 'p \\ bool) \\ ('a \\ 's \\ 'obs)\n \\ 'a \\ 's clock_simWorldsRep \\ 's clock_simWorldsRep list\"\nwhere\n \"clock_simTrans agents jkbp envAction envTrans envVal envObs \\ \\a (Y, X).\n let X' = clock_trans agents jkbp envAction envTrans envVal envObs Y X;\n Y' = clock_trans agents jkbp envAction envTrans envVal envObs Y Y\n in [ clock_mkSuccs (envObs a) obs Y' .\n obs \\ map (envObs a) (toList X') ]\"\n(*<*)\n\nabbreviation\n clock_simTrans :: \"'a \\ 's clock_simWorldsRep \\ 's clock_simWorldsRep list\"\nwhere\n \"clock_simTrans \\ ClockView.clock_simTrans agents jkbp envAction envTrans envVal envObs\"\n\n(*>*)\ntext\\\n\nShowing that this respects the property asked of it by the @{term\n\"Algorithm\"} locale is straightforward:\n\n\\\n\nlemma clock_simTrans:\n assumes tC: \"t \\ Clock.jkbpC\"\n and ec: \"clock_simAbs ec = Clock.sim_equiv_class a t\"\n shows \"clock_simAbs ` set (clock_simTrans a ec)\n = { Clock.sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ Clock.jkbpC \\ clock_jview a t' = clock_jview a t }\"\n(*<*) (is \"?lhs = ?rhs\")\nproof\n note image_cong_simp [cong del]\n show \"?lhs \\ ?rhs\"\n unfolding clock_simTrans_def clock_mkSuccs_def\n using clock_trans_common[OF tC ec] clock_trans_agent[OF tC ec]\n apply (clarsimp simp: toSet_def[symmetric] clock_simAbs_def Let_def)\n\n apply (rule_tac x=t' in exI)\n apply (rule_tac x=xa in exI)\n\n apply (clarsimp simp: clock_sim_def)\n apply safe\n\n apply clarsimp\n apply (rule_tac x=\"t'a \\ s\" in image_eqI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply safe\n apply (rule_tac x=\"t'b \\ x\" in exI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply (drule_tac t=\"t'b \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (auto simp: Let_def)[1]\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[3]\n\n apply (rule_tac x=\"tLast ta\" in exI)\n apply (clarsimp simp: Let_def Set.image_def)\n apply safe\n apply (rule_tac x=\"taa\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"t'a \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (rule_tac x=\"t'a \\ x\" in exI)\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"ta\" in Clock.jkbpC_tLength_inv)\n apply blast\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)\n done\nnext\n show \"?rhs \\ ?lhs\"\n unfolding clock_simTrans_def Let_def\n apply (cases ec)\n using clock_trans_common[OF tC ec] clock_trans_agent[OF tC ec]\n apply (clarsimp simp: toSet_def[symmetric] Set.image_def clock_simAbs_def\n simp del: split_paired_Ex)\n\n apply (rule_tac x=\"clock_mkSuccs (envObs a) (envObs a s) (clock_trans aa aa)\" in exI)\n apply safe\n apply auto[1]\n apply (rule_tac x=\"tLast x\" in exI)\n apply (clarsimp simp: clock_trans_common[OF tC ec] clock_mkSuccs_def)\n apply safe\n apply (clarsimp simp: clock_sim_def simp del: Clock.jkbpCn.simps)\n apply rule\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: Let_def)\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (clarsimp simp: Let_def)\n apply (rule_tac x=eact in exI)\n apply (rule_tac x=aact in exI)\n apply clarsimp\n apply (clarsimp simp: Let_def Set.image_def)\n apply (drule_tac t=\"t'a \\ xa\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (rule_tac x=\"t'a \\ xa\" in exI)\n apply (auto simp: Let_def)[1]\n apply (drule_tac t=\"x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (simp only: Let_def Clock.jkbpCn.simps)\n apply clarify\n apply (rule_tac x=\"ta\" in exI)\n apply simp\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)[1]\n apply (clarsimp simp: clock_trans_common[OF tC ec] clock_mkSuccs_def)\n apply (rule_tac x=\"t'a \\ sa\" in exI)\n apply (clarsimp simp: clock_sim_def Let_def)\n (* FIXME similar to above *)\n apply rule\n apply (clarsimp simp: Set.image_def)\n apply (rule_tac x=\"t'b \\ x\" in exI)\n apply (drule_tac t=\"t'b \\ x\" in Clock.jkbpC_tLength_inv[OF _ refl])\n apply (auto simp: Let_def)[1]\n apply clarsimp\n apply (rule_tac x=\"ta\" in exI)\n apply auto\n apply (rule Clock.jkbpCn_jkbpC_inc[where n=\"Suc (tLength t)\"])\n apply (auto simp: Let_def)\n done\nqed\n(*>*)\n\nend (* context FiniteLinorderEnvironment *)\n\n(* **************************************** *)\n\nsubsubsection\\Maps\\\n\ntext\\\n\n\\label{sec:kbps-theory-clock-view-maps}\n\nAs mentioned above, the canonicity of our ordered, distinct list\nrepresentation of automaton states allows us to use them as keys in a\ndigital trie; a value of type @{typ \"('key, 'val) trie\"} maps keys of\ntype @{typ \"'key list\"} to values of type @{typ \"'val\"}.\n\nIn this specific case we track automaton transitions using a two-level\nstructure mapping sets of states to an association list mapping\nobservations to sets of states, and for actions automaton states map\ndirectly to agent actions.\n\n\\\n\ntype_synonym ('s, 'obs) clock_trans_trie\n = \"('s, ('s, ('obs, 's clock_simWorldsRep) mapping) trie) trie\"\ntype_synonym ('s, 'aAct) clock_acts_trie = \"('s, ('s, 'aAct) trie) trie\"\n(*<*)\n\ndefinition\n trans_MapOps_lookup :: \"('s :: linorder, 'obs) clock_trans_trie\n \\ 's clock_simWorldsRep \\ 'obs\n \\ 's clock_simWorldsRep\"\nwhere\n \"trans_MapOps_lookup \\ \\m k.\n Option.bind (trie_odlist_lookup m (fst (fst k))) (\\m.\n (Option.bind (trie_odlist_lookup m (snd (fst k))) (\\m.\n Mapping.lookup m (snd k))))\"\n\ndefinition\n trans_MapOps_update :: \"('s :: linorder) clock_simWorldsRep \\ 'obs \\ 's clock_simWorldsRep\n \\ ('s :: linorder, 'obs) clock_trans_trie\n \\ ('s :: linorder, 'obs) clock_trans_trie\"\nwhere\n \"trans_MapOps_update \\ \\k v m.\n trie_odlist_update_with (fst (fst k)) m empty_trie (\\m.\n trie_odlist_update_with (snd (fst k)) m Mapping.empty (\\m.\n Mapping.update (snd k) v m))\"\n\ndefinition\n trans_MapOps :: \"(('s :: linorder, 'obs) clock_trans_trie,\n 's clock_simWorldsRep \\ 'obs, 's clock_simWorldsRep) MapOps\"\nwhere\n \"trans_MapOps \\\n \\ MapOps.empty = empty_trie,\n lookup = trans_MapOps_lookup,\n update = trans_MapOps_update \\\"\n\nlemma (in FiniteLinorderEnvironment) trans_MapOps:\n \"MapOps (\\k. (clock_simAbs (fst k), snd k)) (Clock.jkbpSEC \\ UNIV) trans_MapOps\"\nproof\n fix k show \"MapOps.lookup trans_MapOps (MapOps.empty trans_MapOps) k = None\"\n unfolding trans_MapOps_def trans_MapOps_lookup_def trie_odlist_lookup_def\n by (auto split: prod.split)\nnext\n fix e k k' M\n assume k: \"(clock_simAbs (fst k), snd k) \\ Clock.jkbpSEC \\ (UNIV :: 'z set)\"\n and k': \"(clock_simAbs (fst k'), snd k') \\ Clock.jkbpSEC \\ (UNIV :: 'z set)\"\n show \"MapOps.lookup trans_MapOps (MapOps.update trans_MapOps k e M) k'\n = (if (clock_simAbs (fst k'), snd k') = (clock_simAbs (fst k), snd k)\n then Some e else MapOps.lookup trans_MapOps M k')\"\n proof(cases \"(clock_simAbs (fst k'), snd k') = (clock_simAbs (fst k), snd k)\")\n case True hence \"k = k'\"\n using inj_onD[OF clock_simAbs_inj_on] k k' by (auto iff: prod_eqI)\n thus ?thesis\n unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n by (simp add: lookup_trie_update_with lookup_update split: option.split prod.split) \n next\n case False thus ?thesis\n unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n by (cases \"fst k = fst k'\")\n (auto simp add: lookup_empty lookup_update_neq prod_eq_iff lookup_trie_update_with split: option.split prod.split)\n qed\nqed\n\n(* A map for the agent actions. *)\n\ndefinition\n acts_MapOps_lookup :: \"('s :: linorder, 'aAct) clock_acts_trie\n \\ 's clock_simWorldsRep\n \\ 'aAct\"\nwhere\n \"acts_MapOps_lookup \\ \\m k.\n Option.bind (trie_odlist_lookup m (fst k)) (\\m.\n (trie_odlist_lookup m (snd k)))\"\n\ndefinition\n acts_MapOps_update :: \"('s :: linorder) clock_simWorldsRep \\ 'aAct\n \\ ('s :: linorder, 'aAct) clock_acts_trie\n \\ ('s :: linorder, 'aAct) clock_acts_trie\"\nwhere\n \"acts_MapOps_update \\ \\k v m.\n trie_odlist_update_with (fst k) m empty_trie (\\m.\n trie_odlist_update (snd k) v m)\"\n\ndefinition\n acts_MapOps :: \"(('s :: linorder, 'aAct) clock_acts_trie, 's clock_simWorldsRep, 'aAct) MapOps\"\nwhere\n \"acts_MapOps \\\n \\ MapOps.empty = empty_trie,\n lookup = acts_MapOps_lookup,\n update = acts_MapOps_update \\\"\n\nlemma (in FiniteLinorderEnvironment) acts_MapOps:\n \"MapOps clock_simAbs Clock.jkbpSEC acts_MapOps\"\nproof\n fix k show \"MapOps.lookup acts_MapOps (MapOps.empty acts_MapOps) k = None\"\n unfolding acts_MapOps_def acts_MapOps_lookup_def trie_odlist_lookup_def\n by auto\nnext\n fix e k k' M\n assume k: \"clock_simAbs k \\ Clock.jkbpSEC\"\n and k': \"clock_simAbs k' \\ Clock.jkbpSEC\"\n show \"MapOps.lookup acts_MapOps (MapOps.update acts_MapOps k e M) k'\n = (if clock_simAbs k' = clock_simAbs k\n then Some e else MapOps.lookup acts_MapOps M k')\"\n proof(cases \"clock_simAbs k' = clock_simAbs k\")\n case True hence \"k = k'\"\n using inj_onD[OF clock_simAbs_inj_on] k k' by (auto iff: prod_eqI)\n thus ?thesis\n unfolding acts_MapOps_def acts_MapOps_lookup_def acts_MapOps_update_def\n by (auto simp: lookup_trie_update lookup_trie_update_with\n trie_odlist_update_with_def trie_odlist_update_def trie_odlist_lookup_def)\n next\n case False thus ?thesis\n unfolding acts_MapOps_def acts_MapOps_lookup_def acts_MapOps_update_def\n by (auto simp: lookup_trie_update lookup_trie_update_with\n trie_odlist_update_with_def trie_odlist_update_def trie_odlist_lookup_def\n dest: prod_eqI\n split: option.split)\n qed\nqed\n\n(*>*)\ntext\\\n\nWe define two records @{term \"acts_MapOps\"} and @{term \"trans_MapOps\"}\nsatisfying the @{term \"MapOps\"} predicate\n(\\S\\ref{sec:kbps-theory-map-ops}). Discharging the obligations in the\n@{term \"Algorithm\"} locale is routine, leaning on the work of\n\\<^citet>\\\"DBLP:conf/itp/LammichL10\"\\.\n\n\\\n\nsubsubsection\\Locale instantiation\\\n\ntext\\\n\nFinally we assemble the algorithm and discharge the proof obligations.\n\n\\\n\nsublocale FiniteLinorderEnvironment\n < Clock: Algorithm\n jkbp envInit envAction envTrans envVal\n clock_jview envObs clock_jviewInit clock_jviewIncr\n clock_sim clock_simRels clock_simVal\n clock_simAbs clock_simObs clock_simInit clock_simTrans clock_simAction\n acts_MapOps trans_MapOps\n(*<*)\n apply (unfold_locales)\n\n apply clarify\n apply (rule clock_simInit)\n apply simp\n\n apply clarify\n apply (erule (1) clock_simObs)\n\n apply clarify\n apply (erule (1) clock_simAction)\n\n apply clarify\n apply (erule (1) clock_simTrans)\n\n apply (rule acts_MapOps)\n apply (rule trans_MapOps)\n\n done\n\n(*>*)\ntext\\\n\nExplicitly, the algorithm for this case is:\n\n\\\n\ndefinition\n \"mkClockAuto \\ \\agents jkbp envInit envAction envTrans envVal envObs.\n mkAlgAuto acts_MapOps\n trans_MapOps\n (clock_simObs envObs)\n (clock_simInit envInit envObs)\n (clock_simTrans agents jkbp envAction envTrans envVal envObs)\n (clock_simAction jkbp envVal envObs)\n (\\a. map (clock_simInit envInit envObs a \\ envObs a) envInit)\"\n\nlemma (in FiniteLinorderEnvironment) mkClockAuto_implements:\n \"Clock.implements\n (mkClockAuto agents jkbp envInit envAction envTrans envVal envObs)\"\n(*<*)\n using Clock.k_mkAlgAuto_implements\n unfolding mkClockAuto_def mkAlgAuto_def Clock.k_frontier_def\n by simp\n\n(*\n\nWe actually run this unfolding of the algorithm. The lemma is keeping\nus honest.\n\n*)\n\ndefinition\n \"ClockAutoDFS \\ \\agents jkbp envInit envAction envTrans envVal envObs. \\a.\n alg_dfs acts_MapOps\n trans_MapOps\n (clock_simObs envObs a)\n (clock_simTrans agents jkbp envAction envTrans envVal envObs a)\n (clock_simAction jkbp envVal envObs a)\n (map (clock_simInit envInit envObs a \\ envObs a) envInit)\"\n\nlemma (in FiniteLinorderEnvironment)\n \"mkClockAuto agents jkbp envInit envAction envTrans envVal envObs\n = (\\a. alg_mk_auto acts_MapOps trans_MapOps (clock_simInit a) (ClockAutoDFS agents jkbp envInit envAction envTrans envVal envObs a))\"\n unfolding mkClockAuto_def ClockAutoDFS_def mkAlgAuto_def alg_mk_auto_def by (simp add: Let_def)\n\n(*>*)\ntext\\\n\nWe discuss the clock semantics further in \\S\\ref{sec:kbps-alg-clock}.\n\n\\\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/KBPs/ClockView.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2872323330138475}} {"text": "theory SINVAR_ACLnotCommunicateWith\nimports \"../TopoS_Helper\" SINVAR_ACLcommunicateWith\nbegin\n\nsubsection {* SecurityInvariant ACLnotCommunicateWith*}\ntext{*An access control list strategy that says that hosts must not transitively access each other.*}\n\ntext{* node properties: a set of hosts this host must not access *}\n\ndefinition default_node_properties :: \"'v set\"\n where \"default_node_properties \\ UNIV\"\n\n\nfun sinvar :: \"'v graph \\ ('v \\ 'v set) \\ bool\" where\n \"sinvar G nP = (\\ v \\ nodes G. \\ a \\ (succ_tran G v). a \\ (nP v))\"\n\ndefinition receiver_violation :: \"bool\" where \n \"receiver_violation \\ False\"\n\ntext{*It is the inverse of @{const SINVAR_ACLcommunicateWith.sinvar}*}\nlemma ACLcommunicateNotWith_inverse_ACLcommunicateWith:\n \"\\v. UNIV - nP' v = set (nP v) \\ SINVAR_ACLcommunicateWith.sinvar G nP \\ sinvar G nP'\"\n by auto\n\n\n\n\n from a3 have \"\\v a. v \\ N \\ a \\ (succ_tran \\nodes = N, edges = E\\ v) \\ a \\ (nP v)\" by fastforce\n from this a2 have g1: \"\\v a. v \\ N \\ a \\ (succ_tran \\nodes = N, edges = E'\\ v) \\ a \\ (nP v)\" \n using succ_tran_mono[OF a1] by blast\n\n thus \"sinvar \\nodes = N, edges = E'\\ nP\"\n by(clarsimp)\nqed\n \n\nlemma succ_tran_empty: \"(succ_tran \\nodes = nodes G, edges = {}\\ v) = {}\"\n by(simp add: succ_tran_def)\n\ninterpretation SecurityInvariant_preliminaries\nwhere sinvar = sinvar\n apply unfold_locales\n apply(frule_tac finite_distinct_list[OF wf_graph.finiteE])\n apply(erule_tac exE)\n apply(rename_tac list_edges)\n apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_mono])\n apply(auto)[4]\n apply(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def graph_ops succ_tran_empty)[1]\n apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_sinvar_mono[OF sinvar_mono])\n apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_mono])\n done\n\n\nlemma unique_default_example: \"succ_tran \\nodes = {vertex_1, vertex_2}, edges = {(vertex_1, vertex_2)}\\ vertex_2 = {}\"\napply (simp add: succ_tran_def)\nby (metis Domain.DomainI Domain_empty Domain_insert distinct_vertices12 singleton_iff trancl_domain)\n\ninterpretation ACLnotCommunicateWith: SecurityInvariant_ACS\nwhere default_node_properties = SINVAR_ACLnotCommunicateWith.default_node_properties\nand sinvar = SINVAR_ACLnotCommunicateWith.sinvar\n unfolding SINVAR_ACLnotCommunicateWith.default_node_properties_def\n apply unfold_locales\n \n apply simp\n apply(subst(asm) SecurityInvariant_withOffendingFlows.set_offending_flows_simp, simp)\n apply(clarsimp)\n apply (metis)\n\n apply(erule default_uniqueness_by_counterexample_ACS)\n apply(simp)\n apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply (simp add:graph_ops)\n apply (simp split: prod.split_asm prod.split)\n apply(case_tac \"otherbot = {}\")\n\n apply(rule_tac x=\"\\ nodes={vertex_1,vertex_2}, edges = {(vertex_1,vertex_2)} \\\" in exI, simp)\n apply(rule conjI)\n apply(simp add: wf_graph_def)\n apply(rule_tac x=\"(\\ x. UNIV)(vertex_1 := {vertex_2}, vertex_2 := {})\" in exI, simp)\n apply(simp add: example_simps)\n apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n apply(simp add: example_simps)\n\n apply(subgoal_tac \"\\canAccess. canAccess \\ UNIV \\ canAccess \\ otherbot\")\n prefer 2\n apply blast\n apply(erule exE)\n apply(rename_tac canAccessThis)\n apply(case_tac \"vertex_1 \\ canAccessThis\")\n\n apply(rule_tac x=\"\\ nodes={vertex_1,canAccessThis}, edges = {(vertex_1,canAccessThis)} \\\" in exI, simp)\n apply(rule conjI)\n apply(simp add: wf_graph_def)\n apply(rule_tac x=\"(\\ x. UNIV)(vertex_1 := UNIV, canAccessThis := {})\" in exI, simp)\n apply(simp add: example_simps)\n apply(rule_tac x=\"{(vertex_1,canAccessThis)}\" in exI, simp)\n apply(simp add: example_simps)\n\n apply(rule_tac x=\"\\ nodes={canAccessThis,vertex_2}, edges = {(vertex_2,canAccessThis)} \\\" in exI, simp)\n apply(rule conjI)\n apply(simp add: wf_graph_def)\n apply(rule_tac x=\"(\\ x. UNIV)(vertex_2 := UNIV, canAccessThis := {})\" in exI, simp)\n apply(simp add: example_simps)\n apply(rule_tac x=\"{(vertex_2,canAccessThis)}\" in exI, simp)\n apply(simp add: example_simps)\n done\n\n lemma TopoS_ACLnotCommunicateWith: \"SecurityInvariant sinvar default_node_properties receiver_violation\"\n unfolding receiver_violation_def by unfold_locales \n\nhide_const (open) sinvar receiver_violation default_node_properties\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Security_Invariants/SINVAR_ACLnotCommunicateWith.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081926, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.2872049167861479}} {"text": "theory WelltypedSubst\nimports ExecMessage\nbegin\n\n\nsubsection{* Well-typed Ground Atomic Substitutions *}\n\ntext{* \n TODO: Revamp proofs and tool setup, because the current setup is too ad-hoc.\n*}\n\ndefinition groundSubst :: \"(execlit \\ execmsg) \\ bool\"\nwhere \"groundSubst s \\ \\ l. s l \\ Lit l \\ ground (s l)\"\n\ndefinition welltyped :: \"(execlit \\ execmsg) \\ bool\"\nwhere \n\"welltyped s \\ \\ l. s l \\ Lit l \\\n (\\ varid tid. l = EVar varid tid \\ \n (\n (\\ a. varid = (AVar a) \\ \n (s l = Lit Eve \\ (\\ n. s l = Lit (EHonest n)))\n ) \\\n (\\ v. varid = (MVar v) \\ \n ((\\ n tid'. s l = Lit (ENonce n tid')) \\\n (\\ n. s l = Lit (EveNonce n)))\n )\n )\n )\"\n\ntypedef wt_subst = \"\\ s. s \\ welltyped \\ s \\ groundSubst\"\n by(auto simp: mem_def welltyped_def groundSubst_def ran_def)\n\n\nfun subst :: \"wt_subst \\ execmsg \\ execmsg\"\nwhere\n \"subst s (Lit l) = Rep_wt_subst s l\"\n| \"subst s (Tup x y) = Tup (subst s x) (subst s y)\"\n| \"subst s (Enc m k) = Enc (subst s m) (subst s k)\"\n| \"subst s (Hash m) = Hash (subst s m)\"\n| \"subst s (K a b) = K (subst s a) (subst s b)\"\n| \"subst s (PK a) = PK (subst s a)\"\n| \"subst s (SK a) = SK (subst s a)\"\n\n\ndefinition empty_wts :: \"wt_subst\"\nwhere \"empty_wts \\ Abs_wt_subst Lit\"\n\ndefinition extend_wts :: \"wt_subst \\ wt_subst \\ wt_subst\"\nwhere \"extend_wts s1 s2 \\ Abs_wt_subst (subst s2 o Rep_wt_subst s1)\"\n\ndefinition dom_wts :: \"wt_subst \\ execlit set\"\nwhere \"dom_wts s \\ { l. Rep_wt_subst s l \\ Lit l }\"\n\ndefinition ran_wts :: \"wt_subst \\ execmsg set\"\nwhere \"ran_wts s \\ { Rep_wt_subst s l | l. Rep_wt_subst s l \\ Lit l }\"\n\n\nsubsubsection{* Properties *}\n\nlemma Rep_wt_subst_welltyped: \"welltyped (Rep_wt_subst s)\"\n by(insert Rep_wt_subst, simp add: wt_subst_def mem_def)\n\n\nlemma Rep_wt_subst_groundSubst: \"groundSubst (Rep_wt_subst s)\"\n by(insert Rep_wt_subst, simp add: wt_subst_def mem_def)\n\nlemma Rep_wt_subst_ground [simp]: \n \"l \\ dom_wts s \\ ground (Rep_wt_subst s l)\"\n apply(insert Rep_wt_subst_groundSubst[of s])\n by(auto simp: dom_wts_def groundSubst_def)\n\nlemma Rep_wt_subst_EVar_notin_dom [simp]: \n \"EVar v tid \\ dom_wts s \\ \n Rep_wt_subst s (EVar v tid) = Lit (EVar v tid)\"\n apply(insert Rep_wt_subst_groundSubst[of s])\n by(auto simp: dom_wts_def groundSubst_def)\n\nlemma Rep_wt_subst_simps [simp]: \n \"Rep_wt_subst s (EConst c) = Lit (EConst c)\"\n \"Rep_wt_subst s (EHonest a) = Lit (EHonest a)\"\n \"Rep_wt_subst s (ENonce n tid) = Lit (ENonce n tid)\"\n \"Rep_wt_subst s (Eve) = Lit (Eve)\"\n \"Rep_wt_subst s (EveNonce n) = Lit (EveNonce n)\"\n by(insert Rep_wt_subst_welltyped[of s], auto simp: welltyped_def)\n\nlemma Rep_wt_subst_MVar_splits:\n \"P (Rep_wt_subst s (EVar (MVar v) tid)) = (\n ( Rep_wt_subst s (EVar (MVar v) tid) = (Lit (EVar (MVar v) tid)) \\ P (Lit (EVar (MVar v) tid))) \\ \n (\\ n tid'. Rep_wt_subst s (EVar (MVar v) tid) = (Lit (ENonce n tid')) \\ P (Lit (ENonce n tid'))) \\\n (\\ n. Rep_wt_subst s (EVar (MVar v) tid) = (Lit (EveNonce n)) \\ P (Lit (EveNonce n))))\"\n apply(insert Rep_wt_subst_welltyped[of s])\n apply(simp add: welltyped_def)\n apply(drule_tac x=\"EVar (MVar v) tid\" in spec)\n by(auto)\n\nlemma Rep_wt_subst_AVar_splits:\n \"P (Rep_wt_subst s (EVar (AVar a) tid)) = (\n ( Rep_wt_subst s (EVar (AVar a) tid) = (Lit (EVar (AVar a) tid)) \\ P (Lit (EVar (AVar a) tid))) \\ \n (\\ n. Rep_wt_subst s (EVar (AVar a) tid) = (Lit (EHonest n)) \\ P (Lit (EHonest n))) \\\n (\\ n. Rep_wt_subst s (EVar (AVar a) tid) = (Lit Eve) \\ P (Lit Eve)))\"\n apply(insert Rep_wt_subst_welltyped[of s])\n apply(simp add: welltyped_def)\n apply(drule_tac x=\"EVar (AVar a) tid\" in spec)\n by(auto)\n\nlemma Rep_wt_subst_AVar_cases:\n \"( Rep_wt_subst s (EVar (AVar a) tid) = (Lit (EVar (AVar a) tid))) \\\n (\\ n. Rep_wt_subst s (EVar (AVar a) tid) = (Lit (EHonest n))) \\\n (Rep_wt_subst s (EVar (AVar a) tid) = (Lit Eve))\"\n apply(insert Rep_wt_subst_welltyped[of s])\n by(auto simp: welltyped_def)\n\nlemma subst_ground_msg [simp]: \"ground m \\ subst s m = m\"\n by(induct m, case_tac lit, auto)\n\nlemma subst_idem [simp]: \"subst s (subst s m) = subst s m\"\n apply(induct m, case_tac lit, simp_all)\n apply(case_tac \"EVar varid nat \\ dom_wts s\", simp+)\n done\n\nlemma subst_Rep_wt_subst_idem [simp]:\n \"subst s (Rep_wt_subst s l) = Rep_wt_subst s l\"\n apply(rule_tac s=\"subst s (Lit l)\" in subst)\n apply(simp, rule subst_idem)\n done\n\nlemma Abs_wt_subst_extend_wts_inverse [simp]:\n \"Rep_wt_subst (Abs_wt_subst (subst s' o Rep_wt_subst s)) = subst s' o Rep_wt_subst s\"\n apply(subst Abs_wt_subst_inverse)\n apply(insert Rep_wt_subst_welltyped[of s])\n apply(insert Rep_wt_subst_welltyped[of s'])\n apply(simp add: welltyped_def groundSubst_def o_def wt_subst_def mem_def)\n apply(safe)\n apply(drule_tac x=l in spec)+\n defer 1\n apply(drule_tac x=l in spec)+\n apply(auto)\n done\n\nlemma extend_wts_conv_subst: \n \"subst (extend_wts s s') m = subst s' (subst s m)\"\n by(induct m, induct_tac lit, auto simp: extend_wts_def)\n\n\nlemma dom_wts_empty_wts [simp]: \"dom_wts empty_wts = {}\"\n by(simp add: dom_wts_def empty_wts_def wt_subst_def\n Abs_wt_subst_inverse welltyped_def groundSubst_def mem_def)\n\nlemma dom_wts_extend_wts [simp]: \"dom_wts (extend_wts s s') = dom_wts s \\ dom_wts s'\"\n apply(auto simp: dom_wts_def extend_wts_def)\n apply(insert Rep_wt_subst_welltyped[of s])\n apply(insert Rep_wt_subst_welltyped[of s'])\n apply(simp add: welltyped_def groundSubst_def o_def wt_subst_def mem_def)\n apply(drule_tac x=x in spec)+\n apply(auto)\n done\n\n\nlemma Abs_wt_subst_empty_wts_inverse [simp]: \n \"Rep_wt_subst (Abs_wt_subst Lit) = Lit\"\n by(simp add: mem_def welltyped_def wt_subst_def \n groundSubst_def Abs_wt_subst_inverse)\n\nlemma subst_empty_wts [simp]: \"subst empty_wts m = m\"\n by(induct m, auto simp: empty_wts_def)\n\nlemma unpair_subst_distr: \"x \\ unpair m \\ subst s x \\ unpair (subst s m)\"\n apply(induct m rule: subst.induct, auto)\n apply(subgoal_tac \"welltyped (Rep_wt_subst s)\") defer 1\n apply(rule Rep_wt_subst_welltyped)\n apply(simp add: welltyped_def)\n apply(drule_tac x=l in spec)\n apply(auto)\n done\n\nlemma inv_subst_comm [simp]: \n \"subst s (inv m) = inv (subst s m)\"\n apply(induct m rule: subst.induct, auto)\n apply(subgoal_tac \"welltyped (Rep_wt_subst s)\")\n apply(simp add: welltyped_def)\n apply(drule_tac x=l in spec)\n apply(auto simp: Rep_wt_subst_welltyped)\n done\n\n\nlemma ground_subst_s2e_conv_FV: \n \"ground (subst s (s2e msg tid)) = (\\ v \\ FV msg. EVar v tid \\ dom_wts s)\"\n apply(induct msg, induct_tac lit)\n apply(simp_all)\n apply(case_tac \"EVar varid tid \\ dom_wts s\")\n apply(auto)\n done\n\nlemma subst_subdomain: \n \"dom_wts s' \\ dom_wts s \\ subst s' (subst s m) = subst s m\"\n apply(induct m rule: subst.induct, simp_all)\n apply(case_tac \"l \\ dom_wts s\")\n apply(auto simp: dom_wts_def)\n done\n\nlemma Rep_wt_subst_atomic: \"\\ l'. Rep_wt_subst s l = Lit l'\"\n apply(insert Rep_wt_subst_welltyped[of s])\n apply(simp add: welltyped_def)\n apply(drule_tac x=l in spec, auto)\n done\n\nlemma Rep_wt_subst_noteq_simps [simp]: \n \"Rep_wt_subst s l \\ Hash m\"\n \"Rep_wt_subst s l \\ Enc m k\"\n \"Rep_wt_subst s l \\ Tup x y\"\n \"Rep_wt_subst s l \\ PK a\"\n \"Rep_wt_subst s l \\ SK a\"\n \"Rep_wt_subst s l \\ K a b\"\n by(insert Rep_wt_subst_atomic[of s l], auto)\n\nlemma Rep_wt_subst_AV_noteq [simp]:\n \"Rep_wt_subst s (EVar (AVar a) tid) \\ Lit (EConst c)\"\n \"Rep_wt_subst s (EVar (AVar a) tid) \\ Lit (ENonce n' tid')\"\n apply(insert Rep_wt_subst_AVar_cases[of \"s\" a tid])\n apply(auto)\n done\n\nlemma subst_notin_dom_wts [iff]:\n \"(Rep_wt_subst s x = Lit x) = (x \\ dom_wts s)\"\n by(auto simp: dom_wts_def)\n\n(* NOTE: makes unfolding dom_wts using simp loop *)\nlemma subst_in_dom_wts [iff]:\n \"(Rep_wt_subst s x \\ Lit x) = (x \\ dom_wts s)\"\n by(simp)\n\nlemma Rep_wt_subst_AVar_in_IK0 [intro!, simp]:\n \"EVar (AVar a) tid \\ dom_wts s \\\n Rep_wt_subst s (EVar (AVar a) tid) \\ IK0\"\n by(insert Rep_wt_subst_AVar_cases[of s a tid], auto)\n\nlemma EVar_ground_imp_in_dom_wts [iff]:\n \"(ground (Rep_wt_subst s (EVar v tid))) = (EVar v tid \\ dom_wts s)\"\n apply(case_tac \"(Rep_wt_subst s (EVar v tid)) = Lit ( (EVar v tid))\")\n apply(auto)\n done\n\nlemma unpair_Rep_wt_subst_AVar [simp]:\n \"unpair (Rep_wt_subst s (EVar (AVar a) tid))= \n {Rep_wt_subst s (EVar (AVar a) tid)}\"\n by(insert Rep_wt_subst_atomic[of s \"EVar (AVar a) tid\"], auto)\n\nlemma unpair_Rep_wt_subst_MVar [simp]:\n \"unpair (Rep_wt_subst s (EVar (MVar n) tid))= \n {Rep_wt_subst s (EVar (MVar n) tid)}\"\n by(insert Rep_wt_subst_atomic[of s \"EVar (MVar n) tid\"], auto)\n\ndeclare Rep_wt_subst_noteq_simps[THEN neq_commute[THEN iffD1], iff]\n\n\nlemma Rep_wt_subst_reorient_Lit [iff]:\n \"(Lit l = Rep_wt_subst s l') = (Rep_wt_subst s l' = Lit l)\"\n by(auto)\n\nlemma pairParts_Rep_wt_subst_AVar [simp]:\n \"pairParts (Rep_wt_subst s (EVar (AVar a) tid))= \n {Rep_wt_subst s (EVar (AVar a) tid)}\"\n by(insert Rep_wt_subst_atomic[of s \"EVar (AVar a) tid\"], auto)\n\nlemma pairParts_Rep_wt_subst_MVar [simp]:\n \"pairParts (Rep_wt_subst s (EVar (MVar n) tid))= \n {Rep_wt_subst s (EVar (MVar n) tid)}\"\n by(insert Rep_wt_subst_atomic[of s \"EVar (MVar n) tid\"], auto)\n\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/experiments/WelltypedSubst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2871522747021847}} {"text": "section {* Tagging of Terms *}\ntheory Autoref_Tagging\nimports \"../Lib/Refine_Lib\" \nbegin\ntext {*\n We provide a mechanism to tag terms, that supports relator annotations,\n and introduces tags to protect operations, function applications, and \n abstractions from automatic beta and eta conversions.\n*}\n\n\nML {*\n structure Autoref_Tag_Defs = Named_Thms (\n val name = @{binding autoref_tag_defs}\n val description = \"Autoref: Definitions of internal tags\"\n )\n*}\nsetup Autoref_Tag_Defs.setup\n\n\ntext {* General protection tag *}\ndefinition PROTECT where [simp, autoref_tag_defs]: \"PROTECT x \\ x\"\n\ntext {* General annotation tag *}\ntypedecl annot\ndefinition ANNOT :: \"'a \\ annot \\ 'a\" \n where [simp, autoref_tag_defs]: \"ANNOT x a \\ x\"\n\ntext {* Operation-tag, Autoref does not look beyond this *}\ndefinition OP where [simp, autoref_tag_defs]: \"OP x \\ x\"\n\ntext {* Protected function application *}\ndefinition APP (infixl \"$\" 900) where [simp, autoref_tag_defs]: \"f$a \\ f a\"\n\ntext {* Protected abstraction *}\nabbreviation ABS :: \"('a\\'b)\\'a\\'b\" (binder \"\\''\" 10)\n where \"ABS f \\ PROTECT (\\x. PROTECT (f x))\"\n\n\nlemma ABS_beta: \"(\\'x. f x)$x \\ f x\" by simp\nlemma ABS_eta: \"\\'x. (f$x) \\ f\" by simp\n\ntext {* This tag is used to highlight failures during operation \n identification *}\ndefinition \"ID_FAIL x \\ x\"\nnotation (output) ID_FAIL (\"FAIL *** _ ***\")\n\n\ntext {* Relator annotation *}\nconsts rel_annot :: \"('c\\'a) set \\ annot\"\nabbreviation rel_ANNOT :: \"'a \\ ('c \\ 'a) set \\ 'a\" (infix \":::\" 10)\n where \"t:::R \\ ANNOT t (rel_annot R)\"\n\nlemma rel_ANNOT_eq: \"t \\ t:::R\" by simp\n\ntext {* Indirect annotation *}\ntypedecl rel_name\nconsts ind_annot :: \"rel_name \\ annot\"\nabbreviation ind_ANNOT :: \"'a \\ rel_name \\ 'a\" (infix \"::#\" 10)\n where \"t::#s \\ ANNOT t (ind_annot s)\"\n\n\n\n\n\nML {*\n signature AUTOREF_TAGGING = sig\n val term_of_tagged: term -> term\n val is_valid_tagged: term -> bool\n\n val mk_APP: term -> term -> term\n val mk_OP: term -> term\n val lambda': string * typ -> term -> term\n\n val list_APP: term * term list -> term\n val strip_app: term -> term * term list\n\n val untag_conv: Proof.context -> conv\n\n val mk_APP_conv: conv\n val mk_OP_conv: conv\n val mk_ABS_conv: Proof.context -> conv\n val mk_ANNOT_conv: cterm -> conv\n val mk_rel_ANNOT_conv: Proof.context -> cterm -> conv\n\n val ABS_beta_conv: Proof.context -> conv\n\n val rhs_conv: (Proof.context -> conv) -> Proof.context -> conv\n end\n\n\n structure Autoref_Tagging :AUTOREF_TAGGING = struct\n fun term_of_tagged (Free v) = Free v\n | term_of_tagged (Var v) = Var v\n | term_of_tagged (Bound i) = Bound i\n | term_of_tagged @{mpat \"OP ?t\"} = t\n | term_of_tagged @{mpat \"ANNOT ?t _\"} = term_of_tagged t\n | term_of_tagged @{mpat \"?f$?x\"} = term_of_tagged f $ term_of_tagged x\n | term_of_tagged @{mpat \"PROTECT (\\x. PROTECT ?t)\"} \n = Abs (x,x_T,term_of_tagged t)\n | term_of_tagged @{mpat (typs) \"PROTECT (PROTECT::?'v_T\\_)\"} \n = Abs (\"x\",T,Bound 0)\n | term_of_tagged t = raise TERM (\"term_of_tagged\",[t])\n\n fun is_valid_tagged (Free _) = true\n | is_valid_tagged (Var _) = true\n | is_valid_tagged (Bound _) = true\n | is_valid_tagged @{mpat \"OP _\"} = true\n | is_valid_tagged @{mpat \"ANNOT ?t _\"} = is_valid_tagged t\n | is_valid_tagged @{mpat \"?f$?x\"} \n = is_valid_tagged f andalso is_valid_tagged x\n | is_valid_tagged @{mpat \"PROTECT (\\_. PROTECT ?t)\"} = is_valid_tagged t\n | is_valid_tagged @{mpat \"PROTECT PROTECT\"} = true\n | is_valid_tagged _ = false\n\n fun mk_APP f x = let\n val fT = fastype_of f\n val xT = fastype_of x\n val rT = range_type fT\n in\n Const (@{const_name APP},fT --> xT --> rT)$f$x\n end;\n\n fun mk_OP x = let \n val T = fastype_of x \n in \n Const(@{const_name OP},T-->T)$x\n end\n\n fun lambda' (name,T) t = let\n val tT = fastype_of t\n val t' = Const (@{const_name PROTECT},tT --> tT)$\n abstract_over (Free (name,T), t)\n val t' = \n Const (@{const_name PROTECT},(T --> tT) --> T --> tT)$Abs (name,T,t')\n in\n t'\n end\n\n val list_APP = Library.foldl (uncurry mk_APP)\n\n (* f$x1$...$xn goes to (f,[x1,...,xn]*)\n fun strip_app t = let\n fun strip_app_aux @{mpat \"?f$?x\"} args = strip_app_aux f (x::args)\n | strip_app_aux t args = (t,args)\n in strip_app_aux t [] end\n \n fun untag_conv ctxt = Raw_Simplifier.rewrite ctxt\n true (Autoref_Tag_Defs.get ctxt)\n\n fun ABS_beta_conv ctxt = Raw_Simplifier.rewrite ctxt\n true @{thms ABS_beta}\n \n val mk_PROTECT_conv = Conv.rewr_conv @{thm PROTECT_def[symmetric]}\n val mk_APP_conv = Conv.rewr_conv @{thm APP_def[symmetric]}\n val mk_OP_conv = Conv.rewr_conv @{thm OP_def[symmetric]}\n fun mk_ABS_conv ctxt = Conv.abs_conv (K mk_PROTECT_conv) ctxt\n then_conv mk_PROTECT_conv\n\n fun mk_ANNOT_conv a ct = let\n val Tt = Thm.ctyp_of_cterm ct\n\n val thm = Thm.instantiate' [SOME Tt] [SOME ct,SOME a] \n @{thm ANNOT_def[symmetric]}\n in\n thm\n end\n\n fun mk_rel_ANNOT_conv ctxt a ct = let\n val T = Thm.typ_of_cterm a\n val (Tc,Ta) = HOLogic.dest_setT T \n |> HOLogic.dest_prodT \n |> apply2 (Thm.ctyp_of ctxt)\n val thm = Thm.instantiate' [SOME Ta, SOME Tc] [SOME ct,SOME a] \n @{thm rel_ANNOT_eq}\n in\n thm\n end\n\n (* Convert right hand side of refinement statement *)\n fun rhs_conv conv ctxt ct = let \n open Conv Refine_Util \n in\n case Logic.strip_imp_concl (Thm.term_of ct) of\n @{mpat \"Trueprop ((_,_)\\_)\"} =>\n HOL_concl_conv (fn ctxt => (arg1_conv (arg_conv (conv ctxt)))) ctxt ct\n | _ => raise CTERM (\"rhs_conv\",[ct])\n end\n end\n\n*}\n\nML_val {*\n Autoref_Tagging.mk_ANNOT_conv @{cterm \"bar::annot\"} @{cterm \"foo::'a::type\"};\n*}\n\nML_val {*\n Autoref_Tagging.mk_rel_ANNOT_conv @{context}\n @{cterm \"bar::('c\\'a) set\"} @{cterm \"foo::'a::type\"}\n*}\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Automatic_Refinement/Tool/Autoref_Tagging.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2871522599777171}} {"text": "theory RB_Relaxed imports RCU_Lems \nbegin\n\ndatatype F = B | W | Q | R\ndatatype Pointer = Head | Tail\n\nconsts n :: nat (*size of buffer, input*)\nconsts N :: nat (*number of Arr\\<^sub>W entries*)\n\n\nlemma pval_val_same:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n using assms\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var apply blast\n defer \n apply (simp add: getVWNC_var)\n apply (simp add: getVWNC_var)\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\nfix a :: nat and ba :: rat\n assume a1: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ t (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := True)\\) (var w)\"\n assume a2: \"x = var w\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"ba \\ getTS \\ (getVWNC \\ t (var w))\"\n have f5: \"\\s n p. var p = n \\ p \\ surrey_state.writes (s::surrey_state) \\ p \\ writes_on s n\"\n using writes_on_def by force\n have \"\\s n p. writes_on (write_available_update p (s::surrey_state)) n = writes_on s n\"\n by (metis (no_types) surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(5) writes_on_def)\n then have f6: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), modView := (modView \\) ((x, getTS \\ (getVWNC \\ t x)) := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), mods := (mods \\) ((x, getTS \\ (getVWNC \\ t x)) := \\val = v, is_releasing = b\\), writes := insert (x, getTS \\ (getVWNC \\ t x)) (surrey_state.writes \\)\\) x\"\n using a2 a1 by blast\n have f7: \"\\s f. surrey_state.writes (writes_update f (s::surrey_state)) = f (surrey_state.writes s)\"\n by auto\n have f8: \"var (a, ba) = x\"\n using f6 f5 by meson\n have \"(a, ba) \\ surrey_state.writes \\\"\n using f7 f6 f5 a4 a2 by (metis insert_iff snd_conv)\n then show False\n using f8 a3 writes_on_def by force\nqed\n\n\n\nlemma pval_val_other:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"t\\s\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v s b \\)\"\n using assms apply simp\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var\n apply (simp add: w_in_writes_on_var getVWNC_var) \n apply (simp add: getVWNC_var)\n\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\n fix a :: nat and ba :: rat\n assume a1: \"ba \\ getTS \\ (getVWNC \\ s (var w))\"\n assume a2: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\) (var w)\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"x = var w\"\n have \"(a, ba) \\ \\\\var = var w \\ \\(\\) (surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\))\\\"\n using a2 writes_on_def by blast\n then have f5: \"var (a, ba) = var w \\ (a, ba) \\ surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\)\"\n by blast\n then have \"(a, ba) \\ surrey_state.writes \\\"\n using a4 a3 writes_on_def by fastforce\n then show False\n using f5 a1 by simp\nqed\n\n\n\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t' b \\)\"\n using assms apply (cases \"t=t'\")\n using pval_val_same apply blast\n using pval_val_other by blast\n\n\n\n\nlemma pval_val_outside:\n assumes \"wfs \\\"\n and \"N\\ \\\"\n and \"\\j.[x \\\\<^sub>t j] \\ \\ jk. k [x \\\\<^sub>t k] \\\"\n and \"u\\\\ \\ uz.(z>N\\\\[x \\\\<^sub>t z] (Wr x u t' b \\))\"\n using assms apply (cases \"t=t'\")\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n by (metis fst_conv not_less_iff_gr_or_eq pval_val)\n\n\n(*Ex (d_obs_t (Wr T 0 2 False (\\ x)) 3 T)*)\n\n\n(*\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n\n\nlemma pval_val_all: \n assumes \"wfs \\\"\n and \"\\i. i > k \\ \\ [x \\\\<^sub>t i] \\\"\n and \"k < j\" \n and \"u \\ k\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t j] (Wr x v t b \\) \"\n using assms\n \n using pval_val sledgehammer\n*)\n\nconsts \n H :: L\n T :: L\n\n\nrecord LB =\n hW :: V (*local copy of W*)\n tW :: V (*local copy of W*)\n q :: \"(nat \\ nat) list\" (*for now assume well synchronised, need to think about weak memory *)\n tempR :: \"(nat \\ nat)\" (*local copy of word by R*)\n\n Data:: \"nat \\ nat\" (*returns a word Data_i*)\n countW :: nat (* the index of the next element of Data to be written *)\n countR :: nat (* how many words from Data the read has read or reading (i.e., retrieved) *)\n\n ownD :: \"nat \\ F\" (* ownership of data indices *)\n ownB :: \"nat \\ F\" (* ownership of bytes in buffer *)\n (* tries :: nat *)\n oom :: bool (*signals W that it was OOM*)\n \\ :: surrey_state\n\ndefinition \"global s \\ wfs s \\ H \\ T\"\n\n\n\n\nlemmas opsemsyntax [simp] = global_def\nlemmas defs_del [simp del] = Rd_def Let_def Wr_def Upd_def st_rd_def val_rd_def\n\n(* thread 2 is the writer *)\n(* thread 3 is the reader *)\n\n(* Omit tries *)\n(* Finish queueu + reader *)\n\n(* We need this one to hold at minimum *)\ndefinition \"arrayInv s \\ \\i. (i ownD s i = R)\\ (countR s \\ i \\ i < countW s \\ ownD s i = B) \\ (countW s \\ i \\ i < n \\ ownD s i = W) \"\n\n\ndefinition \"q_entries_bounded s \\ (\\i. i < length(q s) \\ (fst(q s!i)+snd(q s!i)\\N)\\snd(q s!i)>0)\"\ndefinition \"tempR_bounded s \\ fst (tempR s) + snd (tempR s) \\ N\"\ndefinition \"counter_q_rel s \\ (countW s-countR s=length(q s))\"\ndefinition \"con_assms s \\ 0 < N \\ 0 (countR s\\countW s) \\ (countW s\\n)\n \\ (\\i.(iData s i\\N \\ Data s i>0)\"\n(*new\n(typically)\n\\forall x . P(x) \\ Q(x)\n\\exists x . P(x) \\ Q(x)\n\n[H =\\<^sub>2 i] means thread 2 sees the last write to H and this has value i.\n[H \\\\<^sub>2 i] means that thread 2 can see the value i.\n*)\ndefinition \"bounded_pointers s \\ ((\\i. i > N \\ \\[H \\\\<^sub>2 i] (\\ s)))\\\n ((\\j. j > N \\ \\[T \\\\<^sub>2 j] (\\ s)))\"\n\ndefinition \"basic_pointer_movement s \\ 0\\hW s\\ hW s\\N \\ 0\\tW s\\ tW s\\N\"\n\n\n\ndefinition \"collection s \\ arrayInv s \\ q_entries_bounded s\n \\tempR_bounded s \\counter_q_rel s \\ con_assms s\n \\ bounded_pointers s \\ basic_pointer_movement s\n \"\n\n\ndefinition \"init s \\\n [T =\\<^sub>2 0] (\\ s) \\ [H =\\<^sub>2 0] (\\ s) \\ (q s = []) \\ (hW s = 0) \\ (tW s = 0)\n \\ (\\l. (l ((Data s l > 0)\\(Data s l \\ N)))\n \\ (\\i. (i ownD s i = W)\n \\ (\\i. (i\\N) \\ ownB s i = B)\n \\ (countW s = 0) \\ (countR s = 0)\n \\ (tempR s = (0,0)) \\ \\ oom s \"\n\ndefinition \"grd1 s \\ (tW s = hW s) \\ (Data s (countW s) \\ N) \"\ndefinition \"grd2 s \\ (tW s > hW s) \\ (Data s (countW s) < (tW s - hW s)) \"\ndefinition \"grd3 s \\ tW s < hW s \"\ndefinition \"grd4 s \\ Data s (countW s) \\ N - hW s \"\ndefinition \"grd5 s \\ Data s (countW s) < tW s \"\ndefinition \"no_space_for_word s \\ (grd1 s \\ \\(Data s (countW s) \\ N))\\\n (grd2 s \\ \\(Data s (countW s) < (tW s - hW s)))\\\n (grd3 s \\ \\(Data s (countW s) \\ N - hW s \\ Data s (countW s) < tW s))\"\n\n\n\nlemmas main_invariant_lemmas = collection_def arrayInv_def q_entries_bounded_def \n counter_q_rel_def tempR_bounded_def con_assms_def\n init_def bounded_pointers_def basic_pointer_movement_def\n pval_val_same pval_val_other pval_val \nlemmas guards = grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def\n\n\nlemma LoadBuffering:\n \"\\- \\ global \\\\ \\ \\collection \\ \\init \\\nCOBEGIN\n\\ global \\\\ \\ \\collection \\ \\ \\oom \\ \\init\\\n WHILE \\countW < n \n INV \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\)\\\n DO\n \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\) \\ \\countW < n\\ \\ \\A1\\\n <\\hW \\\\<^sub>2 H\\\\> ;; \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n <\\tW \\\\<^sub>2 T\\\\> ;;\n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n IF \\grd1 \\ \\A2\\\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\ \\ \\A3\\\n 2 0 \\\\> ;; \\ \\This might not need to be releasing\\ \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if 0\\ x \\ x < (\\Data \\countW) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \n IF \\grd2\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd2\\ \\ \\A4\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \\\\grd2\\\n IF \\grd3\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\ \\A5\\\n IF \\grd4\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd4 \\ \\ \\A6\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\\\grd4 \\\n IF \\grd5\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd5 \\ \\ \\A7\\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if ((0 \\ x \\ x < (\\Data \\countW))\\ x\\\\tW)\\x\\N then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\ \\ \\A8\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n FI;;\n \\ global \\\\ \\ \\collection \n \\ ((\\oom=False \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\ ) \\ \\\\ \\hW + \\Data (\\countW) \\ N\\ \n \\ (\\oom=True \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word)) \\ \\countW < n\\\n IF \\oom=True\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word \\ \\countW < n\\ \\ \\OK\\\n SKIP\n ELSE \\ global \\\\ \\ \\collection \\ \\countW < n \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\\\\n \\\\q := \\q @ [(\\hW, (\\Data \\countW))],, \n \\ownD := (\\ x. if x = \\countW then B else \\ownD x),, \n \\ownB := (\\ x. if (\\ownB x = W) then Q else \\ownB x),, \n \\countW := (\\countW+1)\\ \n FI\n OD \n \\ global \\\\ \\ \\collection \\ \\countW = n\\\n\n\\\n \\ global \\\\ \\ \\collection \\ \\tempR = (0, 0) \\\n WHILE \\countR < n\n INV \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\\n DO \\ global \\\\ \\ \\collection \\ \\countR < n \\ \\tempR=(0,0) \\\n IF \\countR < \\countW THEN\n \\ global \\\\ \\ \\collection \\ \\countR < \\countW \\ \\tempR=(0,0) \\ \\ \\retrieve from Q, dequeue\\\n\n \\ \\tempR := (fst(hd \\q),(snd(hd \\q))) ,,\n \\ownD := (\\ x. if x = \\countR then R else \\ownD x),, \n \\countR := \\countR+1,, \n ( IF fst(hd \\q)\\0 THEN (\\ownB := ( \\ x. if fst(hd \\q) \\ x \\ x < (fst(hd \\q)+(snd(hd \\q))) then R else \\ownB x ))\n ELSE (\\ownB := ( \\ x. if (0 \\ x \\ x < (fst(hd \\q)+(snd(hd \\q)))) \\ (\\i.((x+i i\\0)\\\\ownB (x+i) =Q)) then R else \\ownB x )) FI),, \n \\q := (tl \\q) \\;;\n\n \\ global \\\\ \\\\collection \\ \\countR \\ \\countW \\ \\tempR\\(0,0)\\ \\ \\Push T\\\n\n \\3 (fst \\tempR + snd \\tempR) \\\\ >\n ,, \\ tempR := (0,0),, \n \\ownB := (\\ x. if \\ownB x = R then B else \\ownD x) \\ \\ \\Broken\\\n ELSE\n \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\ \\countR < n \\\n SKIP\n FI\n OD\n\\ global \\\\ \\ \\collection \\ \\countR = n\\\n\n\n\nCOEND\n \\ global \\\\ \\ \\collection \\ \\countW = n \\ \\countR = n\\\n \n\n\"\n apply (oghoare)\n apply ((simp add: main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff; force)+)[4]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply (clarify)\n apply (intro conjI impI)\n apply (metis OpSem_ProofRules.d_obs_read_value d_obs_implies_p_obs le_less_linear)\n apply (metis OpSem_ProofRules.d_obs_read_value OpSem_ProofRules.ext_d_obs_rd_pres)\n apply auto[1]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply clarsimp\n apply (meson not_less not_pobs_contradiction)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n using pval_val apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis (no_types, lifting) Suc_diff_le d_obs_implies_p_obs fst_eqD le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply clarsimp\n apply (simp_all add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)\n (*129*)\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis (full_types) diff_is_0_eq hd_conv_nth length_0_conv length_greater_0_conv not_less)\n apply linarith\n apply auto[1]\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_0_conv not_less0 zero_less_diff)\n apply linarith\n apply (metis (full_types) hd_conv_nth length_0_conv not_less0 snd_conv zero_less_diff)\n using main_invariant_lemmas(12) apply auto[1]\n using OpSem_ProofRules.ext_d_obs_d_obs apply blast\n apply clarify\n apply linarith\n using OpSem_ProofRules.p_obs_contradiction apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis One_nat_def Suc_eq_plus1 length_tl less_diff_conv nth_tl)\n apply (metis One_nat_def Suc_eq_plus1 length_tl less_diff_conv nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify \n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis getVWNC_var le_less_trans main_invariant_lemmas(12) nat_neq_iff)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis getVWNC_var leD pval_val) \n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_greater_0_conv zero_less_diff)\n apply linarith\n apply blast\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_greater_0_conv zero_less_diff)\n apply linarith\n apply blast\n apply (metis getVWNC_var leD pval_val)\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val)\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val) \n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply blast\n apply blast\n apply blast\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val) \n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n by simp\n \n\n\n\n\n\n(*(simp add: Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff )?)*)", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RB_Relaxed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.28710070666653087}} {"text": "(*\n * Copyright 2017, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ArchArraysMemInstance\nimports \"../ArraysMemInstance\"\nbegin\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass array_outer_max_size = mem_type +\n assumes array_outer_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 26\"\n\nclass array_max_count = finite +\n assumes array_max_count_ax: \"CARD ('a) <= 2 ^ 20\"\n\ninstance array :: (array_outer_max_size, array_max_count) mem_type\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ (addr_bitsize - 26) * 2 ^ 26\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 26\"])\n apply (rule mult_less_mono2)\n apply (rule array_outer_max_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule le_trans[where j = \"2 ^ 20\"])\n apply (rule array_max_count_ax)\n apply simp\n apply simp\napply (simp add: addr_card)\ndone\n\nclass array_inner_max_size = array_outer_max_size +\n assumes array_inner_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstance array :: (array_inner_max_size, array_max_count) array_outer_max_size\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule array_max_count_ax)\n apply (rule array_inner_max_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\ninstance word :: (len8) array_outer_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance word :: (len8) array_inner_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance ptr :: (c_type) array_outer_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\ninstance ptr :: (c_type) array_inner_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\nclass lt19 = finite +\n assumes lt19_ax: \"CARD ('a) < 2 ^ 19\"\nclass lt18 = lt19 +\n assumes lt18_ax: \"CARD ('a) < 2 ^ 18\"\nclass lt17 = lt18 +\n assumes lt17_ax: \"CARD ('a) < 2 ^ 17\"\nclass lt16 = lt17 +\n assumes lt16_ax: \"CARD ('a) < 2 ^ 16\"\nclass lt15 = lt16 +\n assumes lt15_ax: \"CARD ('a) < 2 ^ 15\"\nclass lt14 = lt15 +\n assumes lt14_ax: \"CARD ('a) < 2 ^ 14\"\nclass lt13 = lt14 +\n assumes lt13_ax: \"CARD ('a) < 2 ^ 13\"\nclass lt12 = lt13 +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 +\n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstance bit0 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance num1 :: lt1\n by (intro_classes, simp_all)\n\n(* don't understand why this also seems to be necessary *)\ninstance num1 :: array_max_count\n by (intro_classes, simp)\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n array_max_count *)\ndatatype array_max_count_ty = array_max_count_ty \"1048576\"\n\n(* ML c-parser code also needs to know at which array size to use this type *)\nML \\\n structure ArchArrayMaxCount = struct\n val array_max_count = 1048576\n end\n\\\n\nlemma univ_array_max_count_ty:\n \"(UNIV::array_max_count_ty set) = image array_max_count_ty (UNIV::1048576 set)\"\n apply (simp add: set_eq_iff image_iff)\n apply (rule_tac allI)\n apply (rule_tac array_max_count_ty.induct)\n apply simp\n done\n\ninstance \"array_max_count_ty\" :: finite\n apply intro_classes\n apply (simp add: univ_array_max_count_ty)\n done\n\nlemma card_array_max_count_ty[simp]: \"CARD(array_max_count_ty) = CARD(1048576)\"\n apply (simp add: univ_array_max_count_ty card_image inj_on_def)\n done\n\ninstance \"array_max_count_ty\" :: array_max_count\n by intro_classes simp\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/X64/ArchArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2871007066665308}} {"text": "(* Title: SSA_CFG.thy\n Author: Sebastian Ullrich, Denis Lohner\n*)\n\ntheory SSA_CFG\nimports Main Relation Graph_path \"~~/src/HOL/Library/Sublist\"\nbegin\n\nsubsection {* CFG *}\n\nlocale CFG_base = graph_Entry_base \\n predecessors Entry\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry :: \"'node\" +\nfixes \"defs\" :: \"'node \\ 'var::linorder set\"\nfixes \"uses\" :: \"'node \\ 'var set\"\nbegin\n definition \"vars \\ fold (op \\) (map uses \\n) {}\"\n definition defAss' :: \"'node \\ 'var \\ bool\" where\n \"defAss' m v \\ (\\ns. Entry\\ns\\m \\ (\\n \\ set ns. v \\ defs n))\"\n definition defAss'Uses :: bool where\n \"defAss'Uses \\ \\m \\ set \\n. \\v \\ uses m. defAss' m v\"\nend\n\nlocale CFG = CFG_base \\n predecessors Entry \"defs\" \"uses\"\n+ graph_Entry \\n predecessors Entry\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry :: \"'node\" and\n \"defs\" :: \"'node \\ 'var::linorder set\" and\n \"uses\" :: \"'node \\ 'var set\" +\nassumes defs_uses_disjoint: \"n \\ set \\n \\ defs n \\ uses n = {}\"\nassumes defs_finite[simp]: \"finite (defs n)\"\nassumes uses_in_\\n: \"v \\ uses n \\ n \\ set \\n\"\nassumes uses_finite[simp, intro!]: \"finite (uses n)\"\nbegin\n lemma vars_finite[simp]: \"finite (vars)\"\n by (auto simp:vars_def)\n\n lemma uses_in_vars[elim, simp]: \"v \\ uses n \\ v \\ vars\"\n by (auto simp add:vars_def uses_in_\\n intro!: fold_union_elemI)\n\n lemma varsE:\n assumes \"v \\ vars\"\n obtains n where \"n \\ set \\n\" \"v \\ uses n\"\n using assms by (auto simp:vars_def elim!:fold_union_elem)\n\n lemma defs_uses_disjoint'[simp]: \"n \\ set \\n \\ v \\ defs n \\ v \\ uses n \\ False\"\n using defs_uses_disjoint by auto\nend\n\ncontext CFG\nbegin\n lemma defAss'E:\n assumes \"defAss' m v\" \"Entry\\ns\\m\"\n obtains n where \"n \\ set ns\" \"v \\ defs n\"\n using assms unfolding defAss'_def by auto\n\n lemmas defAss'I = defAss'_def[THEN iffD2, rule_format]\n\n lemma defAss'_extend:\n assumes \"defAss' m v\"\n assumes \"n\\ns\\m\" \"\\n \\ set (tl ns). v \\ defs n\"\n shows \"defAss' n v\"\n unfolding defAss'_def proof (rule allI, rule impI)\n fix ns'\n assume \"Entry\\ns'\\n\"\n with assms(2) have \"Entry\\ns'@tl ns\\m\" by auto\n with assms(1) obtain n' where n': \"n' \\ set (ns'@tl ns)\" \"v \\ defs n'\" by -(erule defAss'E)\n with assms(3) have \"n' \\ set (tl ns)\" by auto\n with n' show \"\\n \\ set ns'. v \\ defs n\" by auto\n qed\nend\n\ntext {* A CFG is well-formed if it satisfies definite assignment. *}\n\nlocale CFG_wf = CFG \\n predecessors Entry \"defs\" \"uses\"\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n \"defs\" :: \"'node \\ 'var::linorder set\" and\n \"uses\" :: \"'node \\ 'var set\" +\nassumes def_ass_uses: \"\\m \\ set \\n. \\v \\ uses m. defAss' m v\"\n\nsubsection {* SSA CFG *}\n\ntype_synonym ('node, 'val) phis = \"'node \\ 'val \\ 'val list\"\n\ndeclare in_set_zipE[elim]\ndeclare zip_same[simp]\n\nlocale CFG_SSA_base = CFG_base \\n predecessors Entry \"defs\" \"uses\"\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" +\nfixes phis :: \" ('node, 'val) phis\"\nbegin\n definition \"phiDefs n \\ {v. (n,v) \\ dom phis}\"\n definition[code]: \"allDefs n \\ defs n \\ phiDefs n\"\n\n definition[code]: \"phiUses n \\\n \\n' \\ set (successors n). \\v' \\ phiDefs n'. snd ` Set.filter (\\(n'',v). n'' = n) (set (zip (predecessors n') (the (phis (n',v')))))\"\n definition[code]: \"allUses n \\ uses n \\ phiUses n\"\n definition[code]: \"allVars \\ \\n \\ set \\n. allDefs n \\ allUses n\"\n\n definition defAss :: \"'node \\ 'val \\ bool\" where\n \"defAss m v \\ (\\ns. Entry\\ns\\m \\ (\\n \\ set ns. v \\ allDefs n))\"\n\n lemmas CFG_SSA_defs = phiDefs_def allDefs_def phiUses_def allUses_def allVars_def defAss_def\nend\n\nlocale CFG_SSA = CFG \\n predecessors Entry \"defs\" \"uses\" + CFG_SSA_base \\n predecessors Entry \"defs\" \"uses\" phis\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" and\n phis :: \" ('node, 'val) phis\" +\nassumes phis_finite: \"finite (dom phis)\"\nassumes phis_in_\\n: \"phis (n,v) = Some vs \\ n \\ set \\n\"\nassumes phis_wf:\n \"phis (n,v) = Some args \\ length (predecessors n) = length args\"\nassumes simpleDefs_phiDefs_disjoint:\n \"n \\ set \\n \\ defs n \\ phiDefs n = {}\"\nassumes allDefs_disjoint:\n \"\\n \\ set \\n; m \\ set \\n; n \\ m\\ \\ allDefs n \\ allDefs m = {}\"\nbegin\n lemma phis_disj:\n assumes \"phis (n,v) = Some vs\"\n and \"phis (n',v) = Some vs'\"\n shows \"n = n'\" and \"vs = vs'\"\n proof -\n from assms have \"n \\ set \\n\" and \"n' \\ set \\n\"\n by (auto dest: phis_in_\\n)\n from allDefs_disjoint [OF this] assms show \"n = n'\"\n by (auto simp: allDefs_def phiDefs_def)\n with assms show \"vs = vs'\" by simp\n qed\n\n lemma allDefs_disjoint': \"\\n \\ set \\n; m \\ set \\n; v \\ allDefs n; v \\ allDefs m\\ \\ n = m\"\n using allDefs_disjoint by auto\n\n lemma phiUsesI:\n assumes \"n' \\ set \\n\" \"phis (n',v') = Some vs\" \"(n,v) \\ set (zip (predecessors n') vs)\"\n shows \"v \\ phiUses n\"\n proof-\n from assms(3) have \"n \\ set (predecessors n')\" by auto\n hence 1: \"n' \\ set (successors n)\" using assms(1) by simp\n from assms(2) have 2: \"v' \\ phiDefs n'\" by (auto simp add:phiDefs_def)\n from assms(2) have 3: \"the (phis (n',v')) = vs\" by simp\n show ?thesis unfolding phiUses_def by (rule UN_I[OF 1], rule UN_I[OF 2], auto simp:image_def Set.filter_def assms(3) 3)\n qed\n\n lemma phiUsesE:\n assumes \"v \\ phiUses n\"\n obtains n' v' vs where \"n' \\ set (successors n)\" \"(n,v) \\ set (zip (predecessors n') vs)\" \"phis (n', v') = Some vs\"\n proof-\n from assms(1) obtain n' v' where \"n'\\set (successors n)\" \"v'\\phiDefs n'\"\n \"v \\ snd ` Set.filter (\\(n'', v). n'' = n) (set (zip (predecessors n') (the (phis (n', v')))))\" by (auto simp:phiUses_def)\n thus ?thesis by - (rule that[of n' \"the (phis (n',v'))\" v'], auto simp:phiDefs_def)\n qed\n\n lemma defs_in_allDefs[intro]: \"v \\ defs n \\ v \\ allDefs n\" by (simp add:allDefs_def)\n lemma phiDefs_in_allDefs[intro]: \"v \\ phiDefs n \\ v \\ allDefs n\" by (simp add:allDefs_def)\n lemma uses_in_allUses[intro]: \"v \\ uses n \\ v \\ allUses n\" by (simp add:allUses_def)\n lemma phiUses_in_allUses[simp]: \"v \\ phiUses n \\ v \\ allUses n\" by (simp add:allUses_def)\n lemma allDefs_in_allVars[intro]: \"\\v \\ allDefs n; n \\ set \\n\\ \\ v \\ allVars\" by (auto simp:allVars_def)\n lemma allUses_in_allVars[intro]: \"\\v \\ allUses n; n \\ set \\n\\ \\ v \\ allVars\" by (auto simp:allVars_def)\n\n lemma phiDefs_finite[simp]: \"finite (phiDefs n)\"\n unfolding phiDefs_def\n proof (rule finite_surj[where f=snd], rule phis_finite)\n have \"\\x y. phis (n,x) = Some y \\ x \\ snd ` dom phis\" by (metis domI imageI snd_conv)\n thus \"{v. (n, v) \\ dom phis} \\ snd ` dom phis\" by auto\n qed\n\n lemma phiUses_finite[simp]:\n assumes \"n \\ set \\n\"\n shows \"finite (phiUses n)\"\n by (auto simp:phiUses_def Set.filter_def)\n\n lemma allDefs_finite[intro!]: \"n \\ set \\n \\ finite (allDefs n)\" by (auto simp add:allDefs_def)\n lemma allUses_finite[intro!]: \"n \\ set \\n \\ finite (allUses n)\" by (auto simp add:allUses_def)\n lemma allVars_finite[simp]: \"finite (allVars)\" by (auto simp add:allVars_def)\n\n lemmas defAssI = defAss_def[THEN iffD2, rule_format]\n lemmas defAssD = defAss_def[THEN iffD1, rule_format]\n\n lemma defAss_extend:\n assumes \"defAss m v\"\n assumes \"n\\ns\\m\" \"\\n \\ set (tl ns). v \\ allDefs n\"\n shows \"defAss n v\"\n unfolding defAss_def proof (rule allI, rule impI)\n fix ns'\n assume \"Entry\\ns'\\n\"\n with assms(2) have \"Entry\\ns'@tl ns\\m\" by auto\n with assms(1) obtain n' where n': \"n' \\ set (ns'@tl ns)\" \"v \\ allDefs n'\" by (auto dest:defAssD)\n with assms(3) have \"n' \\ set (tl ns)\" by auto\n with n' show \"\\n \\ set ns'. v \\ allDefs n\" by auto\n qed\n\n lemma defAss_dominating:\n assumes[simp]: \"n \\ set \\n\"\n shows \"defAss n v \\ (\\m \\ set \\n. dominates m n \\ v \\ allDefs m)\"\n proof\n assume asm: \"defAss n v\"\n obtain ns where ns: \"Entry\\ns\\n\" by (atomize, auto)\n from defAssD[OF asm this] obtain m where m: \"m \\ set ns\" \"v \\ allDefs m\" by auto\n have \"dominates m n\"\n proof (rule dominatesI)\n fix ns'\n assume ns': \"Entry\\ns'\\n\"\n from defAssD[OF asm this] obtain m' where m': \"m' \\ set ns'\" \"v \\ allDefs m'\" by auto\n with m ns ns' have \"m' = m\" by - (rule allDefs_disjoint', auto)\n with m' show \"m \\ set ns'\" by simp\n qed simp\n with m ns show \"\\m\\set \\n. dominates m n \\ v \\ allDefs m\" by auto\n next\n assume \"\\m \\ set \\n. dominates m n \\ v \\ allDefs m\"\n then obtain m where[simp]: \"m \\ set \\n\" and m: \"dominates m n\" \"v \\ allDefs m\" by auto\n show \"defAss n v\"\n proof (rule defAssI)\n fix ns\n assume \"Entry\\ns\\n\"\n with m(1) have \"m \\ set ns\" by - (rule dominates_mid, auto)\n with m(2) show \"\\n\\set ns. v \\ allDefs n\" by auto\n qed\n qed\nend\n\nlocale CFG_SSA_wf_base = CFG_SSA_base \\n predecessors Entry \"defs\" \"uses\" phis\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" and\n phis :: \" ('node, 'val) phis\"\nbegin\n text {* Using the SSA properties, we can map every value to its unique defining node and\n remove the @{typ 'node} parameter of the @{term phis} map. *}\n\n definition defNode :: \"'val \\ 'node\" where\n defNode_code [code]: \"defNode v \\ hd [n \\ \\n. v \\ allDefs n]\"\n\n abbreviation \"def_dominates v' v \\ dominates (defNode v') (defNode v)\"\n abbreviation \"strict_def_dom v' v \\ defNode v' \\ defNode v \\ def_dominates v' v\"\n\n definition \"phi v = phis (defNode v,v)\"\n definition[simp]: \"phiArg v v' \\ \\vs. phi v = Some vs \\ v' \\ set vs\"\n\n definition[code]: \"isTrivialPhi v v' \\ v' \\ v \\\n (case phi v of\n Some vs \\ set vs = {v,v'} \\ set vs = {v'}\n | None \\ False)\"\n definition[code]: \"trivial v \\ \\v' \\ allVars. isTrivialPhi v v'\"\n definition[code]: \"redundant \\ \\v \\ allVars. trivial v\"\n\n definition \"defAssUses \\ \\n \\ set \\n. \\v \\ allUses n. defAss n v\"\n\n declare [[inductive_internals]]\n inductive liveVal :: \"'val \\ bool\"\n where\n liveSimple: \"\\n \\ set \\n; val \\ uses n\\ \\ liveVal val\"\n | livePhi: \"\\liveVal v; phiArg v v'\\ \\ liveVal v'\"\n\n definition \"pruned = (\\n \\ set \\n. \\val. val \\ phiDefs n \\ liveVal val)\"\n\n lemmas \"CFG_SSA_wf_defs\" = CFG_SSA_defs defNode_code phi_def isTrivialPhi_def trivial_def redundant_def liveVal_def pruned_def\nend\n\nlocale CFG_SSA_wf = CFG_SSA \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA_wf_base \\n predecessors Entry \"defs\" \"uses\" phis\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" and\n phis :: \" ('node, 'val) phis\" +\n assumes allUses_def_ass: \"\\v \\ allUses n; n \\ set \\n\\ \\ defAss n v\"\n assumes Entry_no_phis[simp]: \"phis (Entry,v) = None\"\nbegin\n lemma allVars_in_allDefs: \"v \\ allVars \\ \\n \\ set \\n. v \\ allDefs n\"\n unfolding allVars_def\n apply auto\n apply (drule(1) allUses_def_ass)\n apply (clarsimp simp: defAss_def)\n apply (drule Entry_reaches)\n apply auto[1]\n by fastforce\n\n lemma phiDefs_Entry_empty[simp]: \"phiDefs (Entry) = {}\"\n by (auto simp: phiDefs_def)\n\n lemma phi_Entry_empty[simp]: \"defNode v = Entry \\ phi v = None\"\n by (simp add:phi_def)\n\n lemma defNode_ex1:\n assumes \"v \\ allVars\"\n shows \"\\!n. n \\ set \\n \\ v \\ allDefs n\"\n proof (rule ex_ex1I)\n show \"\\n. n \\ set \\n \\ v \\ allDefs n\"\n proof-\n from assms(1) obtain n where n: \"n \\ set \\n\" \"v \\ allDefs n \\ v \\ allUses n\" by (auto simp:allVars_def)\n thus ?thesis\n proof (cases \"v \\ allUses n\")\n case True\n from n(1) obtain ns where ns: \"Entry\\ns\\n\" by (atomize_elim, rule Entry_reaches)\n with allUses_def_ass[OF True n(1)] obtain m where m: \"m \\ set ns\" \"v \\ allDefs m\" by - (drule defAssD, auto)\n from ns this(1) have \"m \\ set \\n\" by (rule path2_in_\\n)\n with n(1) m show ?thesis by auto\n qed auto\n qed\n show \"\\n m. n \\ set \\n \\ v \\ allDefs n \\ m \\ set \\n \\ v \\ allDefs m \\ n = m\" using allDefs_disjoint by auto\n qed\n\n lemma defNode_def: \"v \\ allVars \\ defNode v = (THE n. n \\ set \\n \\ v \\ allDefs n)\"\n unfolding defNode_code by (rule the1_list[symmetric], rule defNode_ex1)\n\n lemma defNode[simp]:\n assumes \"v \\ allVars\"\n shows \"(defNode v) \\ set \\n\" \"v \\ allDefs (defNode v)\"\n apply (atomize(full))\n unfolding defNode_def[OF assms] using assms\n by - (rule theI', rule defNode_ex1)\n\n lemma defNode_eq[intro]:\n assumes \"n \\ set \\n\" \"v \\ allDefs n\"\n shows \"defNode v = n\"\n apply (subst defNode_def, rule allDefs_in_allVars[OF assms(2) assms(1)])\n by (rule the1_equality, rule defNode_ex1, rule allDefs_in_allVars[where n=n], simp_all add:assms)\n\n lemma defNode_cases[consumes 1]:\n assumes \"v \\ allVars\"\n obtains (simpleDef) \"v \\ defs (defNode v)\"\n | (phi) \"phi v \\ None\"\n proof (cases \"v \\ defs (defNode v)\")\n case True\n thus thesis by (rule simpleDef)\n next\n case False\n with assms[THEN defNode(2)] show thesis\n by - (rule phi, auto simp: allDefs_def phiDefs_def phi_def)\n qed\n\n lemma phi_phiDefs[simp]: \"phi v = Some vs \\ v \\ phiDefs (defNode v)\" by (auto simp:phiDefs_def phi_def)\n\n lemma simpleDef_not_phi:\n assumes \"n \\ set \\n\" \"v \\ defs n\"\n shows \"phi v = None\"\n proof-\n from assms have \"defNode v = n\" by auto\n with assms show ?thesis using simpleDefs_phiDefs_disjoint by (auto simp: phi_def phiDefs_def)\n qed\n\n lemma phi_wf: \"phi v = Some vs \\ length (predecessors (defNode v)) = length vs\"\n by (rule phis_wf) (simp add:phi_def)\n\n lemma phi_finite: \"finite (dom (phi))\"\n proof-\n let ?f = \"\\v. (defNode v,v)\"\n have \"phi = phis \\ ?f\" by (auto simp add:phi_def)\n moreover have \"inj ?f\" by (auto intro:injI)\n hence \"finite (dom (phis \\ ?f))\" by - (rule finite_dom_comp, auto simp add:phis_finite inj_on_def)\n ultimately show ?thesis by simp\n qed\n\n lemma phiUses_exI:\n assumes \"m \\ set (predecessors n)\" \"phis (n,v) = Some vs\" \"n \\ set \\n\"\n obtains v' where \"v' \\ phiUses m\" \"v' \\ set vs\"\n proof-\n from assms(1) obtain i where i: \"m = predecessors n ! i\" \"i < length (predecessors n)\" by (metis in_set_conv_nth)\n with assms(2) phis_wf have[simp]: \"i < length vs\" by (auto simp add:phi_def)\n from i assms(2,3) have \"vs ! i \\ phiUses m\" by - (rule phiUsesI, auto simp add:phiUses_def phi_def set_zip)\n thus thesis by (rule that) (auto simp add:i(2) phis_wf)\n qed\n\n lemma phiArg_exI:\n assumes \"m \\ set (predecessors (defNode v))\" \"phi v \\ None\" and[simp]: \"v \\ allVars\"\n obtains v' where \"v' \\ phiUses m\" \"phiArg v v'\"\n proof-\n from assms(2) obtain vs where \"phi v = Some vs\" by auto\n with assms(1) show thesis\n by - (rule phiUses_exI, auto intro!:that simp: phi_def)\n qed\n\n lemma phiUses_exI':\n assumes \"phiArg p q\" and[simp]: \"p \\ allVars\"\n obtains m where \"q \\ phiUses m\" \"m \\ set (predecessors (defNode p))\"\n proof-\n let ?n = \"defNode p\"\n from assms(1) obtain i vs where vs: \"phi p = Some vs\" and i: \"q = vs ! i\" \"i < length vs\" by (metis in_set_conv_nth phiArg_def)\n with phis_wf have[simp]: \"i < length (predecessors ?n)\" by (auto simp add:phi_def)\n from vs i have \"q \\ phiUses (predecessors ?n ! i)\" by - (rule phiUsesI, auto simp add:phiUses_def phi_def set_zip)\n thus thesis by (rule that) (auto simp add:i(2) phis_wf)\n qed\n\n lemma phiArg_in_allVars[simp]:\n assumes \"phiArg v v'\"\n shows \"v' \\ allVars\"\n proof-\n let ?n = \"defNode v\"\n from assms(1) obtain vs where vs: \"phi v = Some vs\" \"v' \\ set vs\" by auto\n then obtain m where m: \"(m,v') \\ set (zip (predecessors ?n) vs)\" by - (rule set_zip_leftI, rule phi_wf)\n from vs(1) have n: \"?n \\ set \\n\" by (simp add: phi_def phis_in_\\n)\n with m have[simp]: \"m \\ set \\n\" by auto\n from n m vs have \"v' \\ phiUses m\" by - (rule phiUsesI, simp_all add:phi_def)\n thus ?thesis by - (rule allUses_in_allVars, auto simp:allUses_def)\n qed\n\n lemma defAss_defNode:\n assumes \"defAss m v\" \"v \\ allVars\" \"Entry\\ns\\m\"\n shows \"defNode v \\ set ns\"\n proof-\n from assms obtain n where n: \"n \\ set ns\" \"v \\ allDefs n\" by (auto simp:defAss_def)\n with assms(3) have \"n = defNode v\" by - (rule defNode_eq[symmetric], auto)\n with n show \"defNode v \\ set ns\" by (simp add:defAss_def)\n qed\n\n lemma defUse_path_ex:\n assumes \"v \\ allUses m\" \"m \\ set \\n\"\n obtains ns where \"defNode v\\ns\\m\" \"EntryPath ns\"\n proof-\n from assms have \"defAss m v\" by - (rule allUses_def_ass, auto)\n moreover from assms obtain ns where ns: \"Entry\\ns\\m\" \"EntryPath ns\"\n by - (atomize_elim, rule Entry_reachesE, auto)\n ultimately have \"defNode v \\ set ns\" using assms(1)\n by - (rule defAss_defNode, auto)\n with ns(1) obtain ns' where \"defNode v\\ns'\\m\" \"suffixeq ns' ns\"\n by (rule path2_split_ex', auto simp: suffixeq_def)\n thus thesis using ns(2)\n by - (rule that, assumption, rule EntryPath_suffixeq, auto)\n qed\n\n lemma defUse_path_dominated:\n assumes \"defNode v\\ns\\n\" \"defNode v \\ set (tl ns)\" \"v \\ allUses n\" \"n' \\ set ns\"\n shows \"dominates (defNode v) n'\"\n proof (rule dominatesI)\n fix es\n assume asm: \"Entry\\es\\n'\"\n from assms(1,4) obtain ns' where ns': \"n'\\ns'\\n\" \"suffixeq ns' ns\"\n by - (rule path2_split_ex, auto simp: suffixeq_def)\n from assms have \"defAss n v\" by - (rule allUses_def_ass, auto)\n with asm ns'(1) assms(3) have \"defNode v \\ set (es@tl ns')\" by - (rule defAss_defNode, auto)\n with suffixeq_tl_subset[OF ns'(2)] assms(2) show \"defNode v \\ set es\" by auto\n next\n show \"n' \\ set \\n\" using assms(1,4) by auto\n qed\n\n lemma allUses_dominated:\n assumes \"v \\ allUses n\" \"n \\ set \\n\"\n shows \"dominates (defNode v) n\"\n proof-\n from assms obtain ns where \"defNode v\\ns\\n\" \"defNode v \\ set (tl ns)\"\n by - (rule defUse_path_ex, auto elim: simple_path2)\n with assms(1) show ?thesis by - (rule defUse_path_dominated, auto)\n qed\n\n lemma phiArg_path_ex':\n assumes \"phiArg p q\" and[simp]: \"p \\ allVars\"\n obtains ns m where \"defNode q\\ns\\m\" \"EntryPath ns\" \"q \\ phiUses m\" \"m \\ set (predecessors (defNode p))\"\n proof-\n from assms obtain m where m: \"q \\ phiUses m\" \"m \\ set (predecessors (defNode p))\"\n by (rule phiUses_exI')\n then obtain ns where \"defNode q\\ns\\m\" \"EntryPath ns\" by - (rule defUse_path_ex[of q m], auto)\n with m show thesis by - (rule that)\n qed\n\n lemma phiArg_path_ex:\n assumes \"phiArg p q\" and[simp]: \"p \\ allVars\"\n obtains ns where \"defNode q\\ns\\defNode p\" \"length ns > 1\"\n by (rule phiArg_path_ex'[OF assms], rule, auto)\n\n lemma phiArg_tranclp_path_ex:\n assumes \"r\\<^sup>+\\<^sup>+ p q\" \"p \\ allVars\" and[simp]: \"\\p q. r p q \\ phiArg p q\"\n obtains ns where \"defNode q\\ns\\defNode p\" \"length ns > 1\"\n \"\\n \\ set (butlast ns). \\p q m ns'. r p q \\ defNode q\\ns'\\m \\ (defNode q) \\ set (tl ns') \\ q \\ phiUses m \\ m \\ set (predecessors (defNode p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode p \\ set ns\"\n using assms(1,2) proof (induction rule: converse_tranclp_induct)\n case (base p)\n from base.hyps base.prems(2) obtain ns' m where ns': \"defNode q\\ns'\\m\" \"defNode q \\ set (tl ns')\" \"m \\ set (predecessors (defNode p))\" \"q \\ phiUses m\"\n by - (rule phiArg_path_ex', rule assms(3), auto intro: simple_path2)\n hence ns: \"defNode q\\ns'@[defNode p]\\defNode p\" \"length (ns'@[defNode p]) > 1\" by auto\n\n show ?case\n proof (rule base.prems(1)[OF ns, rule_format], rule exI, rule exI, rule exI, rule exI)\n fix n\n assume \"n \\ set (butlast (ns' @ [defNode p]))\"\n with base.hyps ns'\n show \"r p q \\\n defNode q\\ns'\\m \\\n defNode q \\ set (tl ns') \\\n q \\ phiUses m \\\n m \\ set (predecessors (defNode p)) \\ n \\ set ns' \\ set ns' \\ set (ns' @ [defNode p]) \\ defNode p \\ set (ns' @ [defNode p])\"\n by auto\n qed\n next\n case (step p p')\n from step.prems(2) step.hyps(1) obtain ns'\\<^sub>2 m where ns'\\<^sub>2: \"defNode p'\\ns'\\<^sub>2\\m\" \"m \\ set (predecessors (defNode p))\" \"defNode p' \\ set (tl ns'\\<^sub>2)\" \"p' \\ phiUses m\"\n by - (rule phiArg_path_ex', rule assms(3), auto intro: simple_path2)\n then obtain ns\\<^sub>2 where ns\\<^sub>2: \"defNode p'\\ns\\<^sub>2\\defNode p\" \"length ns\\<^sub>2 > 1\" \"ns\\<^sub>2 = ns'\\<^sub>2@[defNode p]\" by (atomize_elim, auto)\n\n show thesis\n proof (rule step.IH)\n fix ns\n assume ns: \"defNode q\\ns\\defNode p'\" \"1 < length ns\"\n assume IH: \"\\n\\set (butlast ns).\n \\p q m ns'.\n r p q \\\n defNode q\\ns'\\m \\\n defNode q \\ set (tl ns') \\\n q \\ phiUses m \\ m \\ set (predecessors (defNode p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode p \\ set ns\"\n\n let ?path = \"ns@tl ns\\<^sub>2\"\n have ns_ns\\<^sub>2: \"defNode q\\?path\\defNode p\" \"1 < length ?path\" using ns ns\\<^sub>2(1,2) by auto\n show thesis\n proof (rule step.prems(1)[OF ns_ns\\<^sub>2, rule_format])\n fix n\n assume n: \"n \\ set (butlast ?path)\"\n show \"\\p q m ns'a.\n r p q \\\n defNode q\\ns'a\\m \\\n defNode q \\ set (tl ns'a) \\\n q \\ phiUses m \\ m \\ set (predecessors (defNode p)) \\ n \\ set ns'a \\ set ns'a \\ set ?path \\ defNode p \\ set ?path\"\n proof (cases \"n \\ set (butlast ns)\")\n case True\n with IH obtain p q m ns' where \"\n r p q \\\n defNode q\\ns'\\m \\\n defNode q \\ set (tl ns') \\\n q \\ phiUses m \\ m \\ set (predecessors (defNode p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode p \\ set ns\" by auto\n thus ?thesis by - (rule exI, rule exI, rule exI, rule exI, auto)\n next\n case False\n from ns ns\\<^sub>2 have 1: \"?path = butlast ns@ns\\<^sub>2\"\n by - (rule concat_join[symmetric], auto simp: path2_def)\n from ns\\<^sub>2(1) n False 1 have \"n \\ set (butlast ns\\<^sub>2)\" by (auto simp: butlast_append path2_not_Nil)\n with step.hyps ns'\\<^sub>2 ns\\<^sub>2(3) show ?thesis\n by - (subst 1, rule exI[where x=p], rule exI[where x=p'], rule exI, rule exI, auto simp: path2_not_Nil)\n qed\n qed\n next\n show \"p' \\ allVars\" using step.prems(2) step.hyps(1)[THEN assms(3)] by auto\n qed\n qed\n\n lemma non_dominated_predecessor:\n assumes \"n \\ set \\n\" \"n \\ Entry\"\n obtains m where \"m \\ set (predecessors n)\" \"\\dominates n m\"\n proof-\n obtain ns where \"Entry\\ns\\n\"\n by (atomize_elim, rule Entry_reaches, auto simp add:assms(1))\n then obtain ns' where ns': \"Entry\\ns'\\n\" \"n \\ set (butlast ns')\"\n by (rule simple_path2)\n let ?m = \"last (butlast ns')\"\n from ns'(1) assms(2) obtain m: \"Entry\\butlast ns'\\?m\" \"?m \\ set (predecessors n)\"\n by - (rule path2_unsnoc, auto)\n with m(1) ns'(2) show thesis\n by - (rule that, auto elim:dominatesE)\n qed\n\n lemma liveVal_in_allVars[simp]: \"liveVal v \\ v \\ allVars\"\n by (induction rule: liveVal.induct, auto intro!: allUses_in_allVars)\n\n lemma phi_no_closed_loop:\n assumes[simp]: \"p \\ allVars\" and \"phi p = Some vs\"\n shows \"set vs \\ {p}\"\n proof (cases \"defNode p = Entry\")\n case True\n with assms(2) show ?thesis by auto\n next\n case False\n show ?thesis\n proof\n assume[simp]: \"set vs = {p}\"\n let ?n = \"defNode p\"\n obtain ns where ns: \"Entry\\ns\\?n\" \"?n \\ set (butlast ns)\" by (rule simple_Entry_path, auto)\n let ?m = \"last (butlast ns)\"\n from ns False obtain m: \"Entry\\butlast ns\\?m\" \"?m \\ set (predecessors ?n)\"\n by - (rule path2_unsnoc, auto)\n hence \"p \\ phiUses ?m\" using assms(2) by - (rule phiUses_exI, auto simp:phi_def)\n hence \"defAss ?m p\" using m by - (rule allUses_def_ass, auto)\n then obtain l where l: \"l \\ set (butlast ns)\" \"p \\ allDefs l\" using m by - (drule defAssD, auto)\n with assms(2) m have \"l = ?n\" by - (rule allDefs_disjoint', auto)\n with ns l m show False by auto\n qed\n qed\n\n lemma phis_phi: \"phis (n, v) = Some vs \\ phi v = Some vs\"\n unfolding phi_def\n apply (subst defNode_eq)\n by (auto simp: allDefs_def phi_def phiDefs_def intro: phis_in_\\n)\n\n lemma trivial_phi: \"trivial v \\ phi v \\ None\"\n by (auto simp: trivial_def isTrivialPhi_def split: option.splits)\n\n lemma trivial_finite: \"finite {v. trivial v}\"\n by (rule finite_subset[OF _ phi_finite]) (auto dest: trivial_phi)\n\n lemma trivial_in_allVars: \"trivial v \\ v \\ allVars\"\n by (drule trivial_phi, auto simp: allDefs_def phiDefs_def image_def phi_def intro: phis_in_\\n intro!: allDefs_in_allVars)\n\n declare phiArg_def [simp del]\nend\n\nsubsection {* Bundling of CFG and Equivalent SSA CFG *}\n\nlocale CFG_SSA_Transformed_base = CFG_SSA_wf_base \\n predecessors Entry \"defs\" \"uses\" phis\n + old: CFG_base \\n predecessors Entry oldDefs oldUses\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n oldDefs :: \"'node \\ 'var::linorder set\" and\n oldUses :: \"'node \\ 'var set\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" and\n phis :: \" ('node, 'val) phis\" +\n fixes var :: \"'val \\ 'var\"\n\nlocale CFG_SSA_Transformed = CFG_SSA_Transformed_base \\n predecessors Entry oldDefs oldUses \"defs\" \"uses\" phis var\n + CFG_SSA_wf \\n predecessors Entry \"defs\" \"uses\" phis\n + old: CFG_wf \\n predecessors Entry oldDefs oldUses\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n oldDefs :: \"'node \\ 'var::linorder set\" and\n oldUses :: \"'node \\ 'var set\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \"'node \\ 'val set\" and\n phis :: \" ('node, 'val) phis\" and\n var :: \"'val \\ 'var\" +\n assumes oldDefs_def: \"oldDefs n = var ` defs n\"\n assumes oldUses_def: \"n \\ set \\n \\ oldUses n = var ` uses n\"\n assumes conventional: \"\n\\n\\ns\\m; n \\ set (tl ns); v \\ allDefs n; v \\ allUses m; x \\ set (tl ns); v' \\ allDefs x\\ \\ var v' \\ var v\"\n assumes phis_same_var[elim]: \"phis (n,v) = Some vs \\ v' \\ set vs \\ var v' = var v\"\n assumes allDefs_var_disjoint: \"\\n \\ set \\n; v \\ allDefs n; v' \\ allDefs n; v \\ v'\\ \\ var v' \\ var v\"\nbegin\n lemma conventional': \"\\n\\ns\\m; n \\ set (tl ns); v \\ allDefs n; v \\ allUses m; v' \\ allDefs x; var v' = var v\\ \\ x \\ set (tl ns)\"\n using conventional by auto\n\n lemma conventional'': \"\\defNode v\\ns\\m; defNode v \\ set (tl ns); v \\ allUses m; var v' = var v; v \\ allVars; v' \\ allVars\\ \\ defNode v' \\ set (tl ns)\"\n by (rule conventional'[where v=v and v'=v'], auto)\n\n lemma phiArg_same_var: \"phiArg p q \\ var q = var p\"\n by (metis phiArg_def phi_def phis_same_var)\n\n lemma oldDef_defAss:\n assumes \"v \\ allUses n\" \"Entry\\ns\\n\"\n obtains m where \"m \\ set ns\" \"var v \\ oldDefs m\"\n using assms proof (induction ns arbitrary: v n rule: length_induct)\n case (1 ns)\n from \"1.prems\"(2-) have 2: \"defNode v \\ set ns\"\n by - (rule defAss_defNode, rule allUses_def_ass, auto)\n let ?V = \"defNode v\"\n from \"1.prems\"(2,3) have[simp]: \"v \\ allVars\" by auto\n thus ?case\n proof (cases v rule: defNode_cases)\n case simpleDef\n with 2 show thesis by - (rule \"1.prems\"(1), auto simp: oldDefs_def)\n next\n case phi\n then obtain vs where vs: \"phi v = Some vs\" by auto\n from \"1.prems\"(3) 2 obtain ns' where ns': \"Entry\\ns'\\?V\" \"prefixeq ns' ns\"\n by (rule path2_split_ex, auto)\n let ?V' = \"last (butlast ns')\"\n from ns' phi have nontriv: \"length ns' \\ 2\"\n by - (rule path2_nontrivial, auto)\n hence 3: \"Entry\\butlast ns'\\?V'\" \"?V' \\ set (predecessors ?V)\"\n using ns'(1) by (auto intro: path2_unsnoc)\n with phi vs obtain v' where v': \"v' \\ phiUses ?V'\" \"var v' = var v\"\n by - (rule phiArg_exI, auto simp: phi_def phis_same_var phiArg_def)\n show thesis\n proof (rule \"1.IH\"[rule_format])\n show \"length (butlast ns') < length ns\" using ns' by (cases ns', auto simp: path2_not_Nil2 dest: prefixeq_length_le)\n show \"v' \\ allUses ?V'\" using v'(1) by simp\n next\n fix n\n assume \"n \\ set (butlast ns')\" \"var v' \\ oldDefs n\"\n thus thesis\n using ns'(2)[THEN set_mono_prefixeq] v'(2) by - (rule \"1.prems\"(1)[of n], auto dest: in_set_butlastD)\n qed (rule 3(1))\n qed\n qed\n\n lemma allDef_path_from_simpleDef:\n assumes[simp]: \"v \\ allVars\"\n obtains n ns where \"n\\ns\\defNode v\" \"EntryPath ns\" \"var v \\ oldDefs n\"\n proof-\n let ?V = \"defNode v\"\n from assms obtain ns where ns: \"Entry\\ns\\?V\" \"EntryPath ns\"\n by - (rule Entry_reachesE, auto)\n from assms show thesis\n proof (cases v rule: defNode_cases)\n case simpleDef\n thus thesis by - (rule that, auto simp: oldDefs_def)\n next\n case phi\n then obtain vs where vs: \"phi v = Some vs\" by auto\n let ?V' = \"last (butlast ns)\"\n from ns phi have nontriv: \"length ns \\ 2\"\n by - (rule path2_nontrivial, auto)\n hence 3: \"Entry\\butlast ns\\?V'\" \"?V' \\ set (predecessors ?V)\"\n using ns(1) by (auto intro: path2_unsnoc)\n with phi vs obtain v' where v': \"v' \\ phiUses ?V'\" \"var v' = var v\"\n by - (rule phiArg_exI, auto simp: phi_def phis_same_var phiArg_def)\n with 3(1) obtain n where n: \"n \\ set (butlast ns)\" \"var v' \\ oldDefs n\"\n by - (rule oldDef_defAss[of v'], auto)\n with ns obtain ns' where \"n\\ns'\\?V\" \"suffixeq ns' ns\"\n by - (rule path2_split_ex'[OF ns(1)], auto intro: in_set_butlastD simp: suffixeq_def)\n with n(2) v'(2) ns(2) show thesis\n by - (rule that, assumption, erule EntryPath_suffixeq, auto)\n qed\n qed\n\n lemma defNode_var_disjoint:\n assumes \"p \\ allVars\" \"q \\ allVars\" \"p \\ q\" \"defNode p = defNode q\"\n shows \"var p \\ var q\"\n proof-\n have \"q \\ allDefs (defNode p)\" using assms(2) assms(4) by (auto)\n thus ?thesis using assms(1-3)\n by - (rule allDefs_var_disjoint[of \"defNode p\"], auto)\n qed\n\n lemma phiArg_distinct_nodes:\n assumes \"phiArg p q\" \"p \\ q\" and[simp]: \"p \\ allVars\"\n shows \"defNode p \\ defNode q\"\n proof\n have \"p \\ allDefs (defNode p)\" by simp\n moreover assume \"defNode p = defNode q\"\n ultimately have \"var p \\ var q\" using assms\n by - (rule defNode_var_disjoint, auto)\n moreover\n from assms(1) have \"var q = var p\" by (rule phiArg_same_var)\n ultimately show False by simp\n qed\n\n lemma phiArgs_def_distinct:\n assumes \"phiArg p q\" \"phiArg p r\" \"q \\ r\" \"p \\ allVars\"\n shows \"defNode q \\ defNode r\"\n proof (rule)\n assume \"defNode q = defNode r\"\n hence \"var q \\ var r\" using assms by - (rule defNode_var_disjoint, auto)\n thus False using phiArg_same_var[OF assms(1)] phiArg_same_var[OF assms(2)] by simp\n qed\n\n lemma defNode_not_on_defUse_path:\n assumes p: \"defNode p\\ns\\n\" \"defNode p \\ set (tl ns)\" \"p \\ allUses n\"\n assumes[simp]: \"q \\ allVars\" \"p \\ q\" \"var p = var q\"\n shows \"defNode q \\ set ns\"\n proof-\n let ?P = \"defNode p\"\n let ?Q = \"defNode q\"\n\n have[simp]: \"p \\ allVars\" using p(1,3) by auto\n have \"?P \\ ?Q\" using defNode_var_disjoint[of p q] by auto\n moreover have \"?Q \\ set (tl ns)\" using p(2,3)\n by - (rule conventional'[OF p(1), of p q], auto)\n ultimately show ?thesis using p(1) by (cases ns, auto simp: path2_def)\n qed\n\n lemma defUse_paths_disjoint:\n assumes p: \"defNode p\\ns\\n\" \"defNode p \\ set (tl ns)\" \"p \\ allUses n\"\n assumes q: \"defNode q\\ms\\m\" \"defNode q \\ set (tl ms)\" \"q \\ allUses m\"\n assumes[simp]: \"p \\ q\" \"var p = var q\"\n shows \"set ns \\ set ms = {}\"\n proof (rule equals0I)\n fix y\n assume y: \"y \\ set ns \\ set ms\"\n\n {\n fix p ns n\n assume p: \"defNode p\\ns\\n\" \"defNode p \\ set (tl ns)\" \"p \\ allUses n\"\n assume y: \"y \\ set ns\"\n from p(1,3) have dom: \"dominates (defNode p) n\" by - (rule allUses_dominated, auto)\n moreover\n obtain ns' where \"y\\ns'\\n\" \"suffixeq ns' ns\"\n by (rule path2_split_first_last[OF p(1) y], auto)\n ultimately have \"dominates (defNode p) y\" using suffixeq_tl_subset[of ns' ns] p(2)\n by - (rule dominates_extend[where ms=ns'], auto)\n }\n with assms y have dom: \"dominates (defNode p) y\" \"dominates (defNode q) y\" by auto\n\n {\n fix p ns n q ms m\n let ?P = \"defNode p\"\n let ?Q = \"defNode q\"\n\n assume p: \"defNode p\\ns\\n\" \"defNode p \\ set (tl ns)\" \"p \\ allUses n\" \"dominates ?P y\" \"y \\ set ns\"\n assume q: \"defNode q\\ms\\m\" \"defNode q \\ set (tl ms)\" \"q \\ allUses m\" \"dominates ?Q y\" \"y \\ set ms\"\n assume[simp]: \"p \\ q\" \"var p = var q\"\n assume dom: \"dominates ?P ?Q\"\n then obtain pqs where pqs: \"?P\\pqs\\?Q\" \"?P \\ set (tl pqs)\" by (rule dominates_path, auto intro: simple_path2)\n from p obtain ns\\<^sub>2 where ns\\<^sub>2: \"y\\ns\\<^sub>2\\n\" \"suffixeq ns\\<^sub>2 ns\" by - (rule path2_split_first_last, auto)\n from q obtain ms\\<^sub>1 where ms\\<^sub>1: \"?Q\\ms\\<^sub>1\\y\" \"prefixeq ms\\<^sub>1 ms\" by - (rule path2_split_first_last, auto)\n have \"var q \\ var p\"\n proof (rule conventional[OF _ _ _ p(3)])\n let ?path = \"(pqs@tl ms\\<^sub>1)@tl ns\\<^sub>2\"\n show \"?P\\?path\\n\" using pqs ms\\<^sub>1 ns\\<^sub>2\n by (auto simp del:append_assoc intro:path2_app)\n have \"?P \\ set (tl ns\\<^sub>2)\" using p(2) ns\\<^sub>2(2)[THEN suffixeq_tl_subset, THEN subsetD] by auto\n moreover\n have[simp]: \"q \\ allVars\" \"p \\ allVars\" using p q by auto\n have \"?P \\ set (tl ms)\" using q\n by - (rule conventional'[where v'=p and v=q], auto)\n hence \"?P \\ set (tl ms\\<^sub>1)\" using ms\\<^sub>1(2)[simplified, THEN prefixeq_tl_subset] by auto\n ultimately\n show \"?P \\ set (tl ?path)\" using pqs(2)\n by - (rule notI, auto dest: subsetD[OF set_tl_append'])\n show \"p \\ allDefs (defNode p)\" by auto\n have \"?P \\ ?Q\" using defNode_var_disjoint[of p q] by auto\n hence 1: \"length pqs > 1\" using pqs by - (rule path2_nontriv)\n hence \"?Q \\ set (tl pqs)\" using pqs unfolding path2_def by (auto intro:last_in_tl)\n moreover from 1 have \"pqs \\ []\" by auto\n ultimately show \"?Q \\ set (tl ?path)\" by simp\n show \"q \\ allDefs ?Q\" by simp\n qed\n hence False by simp\n }\n from this[OF p _ _ q] this[OF q _ _ p] y dom show False\n by - (rule dominates_antitrans[OF dom], auto)\n qed\n\n lemma oldDefsI: \"v \\ defs n \\ var v \\ oldDefs n\" by (simp add: oldDefs_def)\n\n lemma simpleDefs_phiDefs_var_disjoint:\n assumes \"v \\ phiDefs n\" \"n \\ set \\n\"\n shows \"var v \\ oldDefs n\"\n proof\n from assms have[simp]: \"v \\ allVars\" by auto\n assume \"var v \\ oldDefs n\"\n then obtain v'' where v'': \"v'' \\ defs n\" \"var v'' = var v\"\n by (auto simp: oldDefs_def)\n from this(1) assms have \"v'' \\ v\"\n using simpleDefs_phiDefs_disjoint[of n] by (auto simp: phiArg_def)\n with v'' assms show False\n using allDefs_var_disjoint[of n v'' v] by auto\n qed\n\n lemma liveVal_use_path:\n assumes \"liveVal v\"\n obtains ns m where \"defNode v\\ns\\m\" \"var v \\ oldUses m\"\n \"\\x. x \\ set (tl ns) \\ var v \\ oldDefs x\"\n using assms proof (induction)\n case (liveSimple m v)\n from liveSimple.hyps have[simp]: \"v \\ allVars\"\n by - (rule allUses_in_allVars, auto)\n from liveSimple.hyps obtain ns where ns: \"defNode v\\ns\\m\" \"defNode v \\ set (tl ns)\"\n by - (rule defUse_path_ex, auto intro!: uses_in_allUses elim: simple_path2)\n from this(1) show thesis\n proof (rule liveSimple.prems)\n show \"var v \\ oldUses m\" using liveSimple.hyps by (auto simp: oldUses_def)\n {\n fix x\n assume asm: \"x \\ set (tl ns)\" \"var v \\ oldDefs x\"\n then obtain v' where \"v' \\ defs x\" \"var v' = var v\"\n by (auto simp: oldDefs_def)\n with asm liveSimple.hyps have False\n by - (rule conventional[OF ns, of v x v', THEN notE], auto)\n }\n thus \"\\x. x \\ set (tl ns) \\ var v \\ oldDefs x\" by auto\n qed\n next\n case (livePhi v v')\n from livePhi.hyps have[simp]: \"v \\ allVars\" \"v' \\ allVars\" \"var v' = var v\"\n by (auto intro: phiArg_same_var)\n show thesis\n proof (rule livePhi.IH)\n fix ns m\n assume asm: \"defNode v\\ns\\m\" \"var v \\ oldUses m\"\n \"\\x. x \\ set (tl ns) \\ var v \\ oldDefs x\"\n from livePhi.hyps(2) obtain ns' m' where ns': \"defNode v'\\ns'\\m'\" \"v' \\ phiUses m'\"\n \"m' \\ set (predecessors (defNode v))\" \"defNode v' \\ set (tl ns')\"\n by (rule phiArg_path_ex', auto elim: simple_path2)\n show thesis\n proof (rule livePhi.prems)\n show \"defNode v'\\(ns'@[defNode v])@tl ns\\m\"\n apply (rule path2_app)\n apply (rule path2_snoc[OF ns'(1,3)])\n by (rule asm(1))\n show \"var v' \\ oldUses m\" using asm(2) by simp\n {\n fix x\n assume asm: \"x \\ set (tl ns')\" \"var v \\ oldDefs x\"\n then obtain v'' where \"v'' \\ defs x\" \"var v'' = var v\"\n by (auto simp: oldDefs_def)\n with asm ns'(2) have False\n by - (rule conventional[OF ns'(1,4), of v' x v'', THEN notE], auto)\n }\n then show \"\\x. x \\ set (tl ((ns'@[defNode v])@tl ns)) \\ var v' \\ oldDefs x\"\n using simpleDefs_phiDefs_var_disjoint[of v \"defNode v\"] livePhi.hyps(2)\n by (auto dest!: set_tl_append'[THEN subsetD] asm(3) simp: phiArg_def)\n qed\n qed\n qed\nend\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/SSA_CFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2870758976339061}} {"text": "chapter \\Dynamic Slicing\\\n\nsection \\Dynamic Program Dependence Graph\\\n\ntheory DynPDG imports \n \"../Basic/DynDataDependence\" \n \"../Basic/CFGExit_wf\" \n \"../Basic/DynStandardControlDependence\"\n \"../Basic/DynWeakControlDependence\"\nbegin\n\nsubsection \\The dynamic PDG\\\n\nlocale DynPDG = \n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\") +\n fixes dyn_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\" \n(\"_ controls _ via _\" [51,0,0])\n assumes Exit_not_dyn_control_dependent:\"n controls n' via as \\ n' \\ (_Exit_)\"\n assumes dyn_control_dependence_path:\n \"n controls n' via as \\ n -as\\* n' \\ as \\ []\"\n\nbegin\n\ninductive cdep_edge :: \"'node \\ 'edge list \\ 'node \\ bool\" \n (\"_ -_\\\\<^sub>c\\<^sub>d _\" [51,0,0] 80)\n and ddep_edge :: \"'node \\ 'var \\ 'edge list \\ 'node \\ bool\"\n (\"_ -'{_'}_\\\\<^sub>d\\<^sub>d _\" [51,0,0,0] 80)\n and DynPDG_edge :: \"'node \\ 'var option \\ 'edge list \\ 'node \\ bool\"\n\nwhere\n \\ \\Syntax\\\n \"n -as\\\\<^sub>c\\<^sub>d n' == DynPDG_edge n None as n'\"\n | \"n -{V}as\\\\<^sub>d\\<^sub>d n' == DynPDG_edge n (Some V) as n'\"\n\n \\ \\Rules\\\n | DynPDG_cdep_edge:\n \"n controls n' via as \\ n -as\\\\<^sub>c\\<^sub>d n'\"\n\n | DynPDG_ddep_edge:\n \"n influences V in n' via as \\ n -{V}as\\\\<^sub>d\\<^sub>d n'\"\n\n\ninductive DynPDG_path :: \"'node \\ 'edge list \\ 'node \\ bool\"\n(\"_ -_\\\\<^sub>d* _\" [51,0,0] 80) \n\nwhere DynPDG_path_Nil:\n \"valid_node n \\ n -[]\\\\<^sub>d* n\"\n\n | DynPDG_path_Append_cdep:\n \"\\n -as\\\\<^sub>d* n''; n'' -as'\\\\<^sub>c\\<^sub>d n'\\ \\ n -as@as'\\\\<^sub>d* n'\"\n\n | DynPDG_path_Append_ddep:\n \"\\n -as\\\\<^sub>d* n''; n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ \\ n -as@as'\\\\<^sub>d* n'\"\n\n\nlemma DynPDG_empty_path_eq_nodes:\"n -[]\\\\<^sub>d* n' \\ n = n'\"\napply - apply(erule DynPDG_path.cases) \n apply simp\n apply(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\nby(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n\n\nlemma DynPDG_path_cdep:\"n -as\\\\<^sub>c\\<^sub>d n' \\ n -as\\\\<^sub>d* n'\"\napply(subgoal_tac \"n -[]@as\\\\<^sub>d* n'\")\n apply simp\napply(rule DynPDG_path_Append_cdep, rule DynPDG_path_Nil)\nby(auto elim!:DynPDG_edge.cases dest:dyn_control_dependence_path path_valid_node)\n\nlemma DynPDG_path_ddep:\"n -{V}as\\\\<^sub>d\\<^sub>d n' \\ n -as\\\\<^sub>d* n'\"\napply(subgoal_tac \"n -[]@as\\\\<^sub>d* n'\")\n apply simp\napply(rule DynPDG_path_Append_ddep, rule DynPDG_path_Nil)\nby(auto elim!:DynPDG_edge.cases dest:path_valid_node simp:dyn_data_dependence_def)\n\nlemma DynPDG_path_Append:\n \"\\n'' -as'\\\\<^sub>d* n'; n -as\\\\<^sub>d* n''\\ \\ n -as@as'\\\\<^sub>d* n'\"\napply(induct rule:DynPDG_path.induct)\n apply(auto intro:DynPDG_path.intros)\n apply(rotate_tac 1,drule DynPDG_path_Append_cdep,simp+)\napply(rotate_tac 1,drule DynPDG_path_Append_ddep,simp+)\ndone\n\n\nlemma DynPDG_path_Exit:\"\\n -as\\\\<^sub>d* n'; n' = (_Exit_)\\ \\ n = (_Exit_)\"\napply(induct rule:DynPDG_path.induct)\nby(auto elim:DynPDG_edge.cases dest:Exit_not_dyn_control_dependent \n simp:dyn_data_dependence_def)\n\n\nlemma DynPDG_path_not_inner:\n \"\\n -as\\\\<^sub>d* n'; \\ inner_node n'\\ \\ n = n'\"\nproof(induct rule:DynPDG_path.induct)\n case (DynPDG_path_Nil n)\n thus ?case by simp\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n from \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\ \\\\ inner_node n'\\ have False\n apply -\n apply(erule DynPDG_edge.cases) apply(auto simp:inner_node_def)\n apply(fastforce dest:dyn_control_dependence_path path_valid_node)\n apply(fastforce dest:dyn_control_dependence_path path_valid_node)\n by(fastforce dest:Exit_not_dyn_control_dependent)\n thus ?case by simp\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n from \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ \\\\ inner_node n'\\ have False\n apply -\n apply(erule DynPDG_edge.cases) \n by(auto dest:path_valid_node simp:inner_node_def dyn_data_dependence_def)\n thus ?case by simp\nqed\n\n\nlemma DynPDG_cdep_edge_CFG_path:\n assumes \"n -as\\\\<^sub>c\\<^sub>d n'\" shows \"n -as\\* n'\" and \"as \\ []\"\n using \\n -as\\\\<^sub>c\\<^sub>d n'\\\n by(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n\nlemma DynPDG_ddep_edge_CFG_path:\n assumes \"n -{V}as\\\\<^sub>d\\<^sub>d n'\" shows \"n -as\\* n'\" and \"as \\ []\"\n using \\n -{V}as\\\\<^sub>d\\<^sub>d n'\\\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n\nlemma DynPDG_path_CFG_path:\n \"n -as\\\\<^sub>d* n' \\ n -as\\* n'\"\nproof(induct rule:DynPDG_path.induct)\n case DynPDG_path_Nil thus ?case by(rule empty_path)\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n from \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\ have \"n'' -as'\\* n'\"\n by(rule DynPDG_cdep_edge_CFG_path(1))\n with \\n -as\\* n''\\ show ?case by(rule path_Append)\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n from \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ have \"n'' -as'\\* n'\"\n by(rule DynPDG_ddep_edge_CFG_path(1))\n with \\n -as\\* n''\\ show ?case by(rule path_Append)\nqed\n\n\nlemma DynPDG_path_split: \n \"n -as\\\\<^sub>d* n' \\\n (as = [] \\ n = n') \\ \n (\\n'' asx asx'. (n -asx\\\\<^sub>c\\<^sub>d n'') \\ (n'' -asx'\\\\<^sub>d* n') \\ \n (as = asx@asx')) \\\n (\\n'' V asx asx'. (n -{V}asx\\\\<^sub>d\\<^sub>d n'') \\ (n'' -asx'\\\\<^sub>d* n') \\ \n (as = asx@asx'))\"\nproof(induct rule:DynPDG_path.induct)\n case (DynPDG_path_Nil n) thus ?case by auto\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n note IH = \\as = [] \\ n = n'' \\\n (\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\\\n from IH show ?case\n proof\n assume \"as = [] \\ n = n''\"\n with \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\ have \"valid_node n'\"\n by(fastforce intro:path_valid_node(2) DynPDG_path_CFG_path \n DynPDG_path_cdep)\n with \\as = [] \\ n = n''\\ \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\\n have \"\\n'' asx asx'. n -asx\\\\<^sub>c\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by(auto intro:DynPDG_path_Nil)\n thus ?thesis by simp\n next\n assume \"(\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\"\n thus ?thesis\n proof\n assume \"\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx asx asx' where \"n -asx\\\\<^sub>c\\<^sub>d nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\ have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_cdep)\n with \\nx -asx'\\\\<^sub>d* n''\\ have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with \\n -asx\\\\<^sub>c\\<^sub>d nx\\ \\as = asx@asx'\\\n have \"\\n'' asx asx'. n -asx\\\\<^sub>c\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n next\n assume \"\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx V asx asx' where \"n -{V}asx\\\\<^sub>d\\<^sub>d nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from \\n'' -as'\\\\<^sub>c\\<^sub>d n'\\ have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_cdep)\n with \\nx -asx'\\\\<^sub>d* n''\\ have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with \\n -{V}asx\\\\<^sub>d\\<^sub>d nx\\ \\as = asx@asx'\\\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n qed\n qed\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n note IH = \\as = [] \\ n = n'' \\\n (\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\\\n from IH show ?case\n proof\n assume \"as = [] \\ n = n''\"\n with \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ have \"valid_node n'\"\n by(fastforce intro:path_valid_node(2) DynPDG_path_CFG_path \n DynPDG_path_ddep)\n with \\as = [] \\ n = n''\\ \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by(fastforce intro:DynPDG_path_Nil)\n thus ?thesis by simp\n next\n assume \"(\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\"\n thus ?thesis\n proof\n assume \"\\nx asx asx'. n -asx\\\\<^sub>c\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx asx asx' where \"n -asx\\\\<^sub>c\\<^sub>d nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_ddep)\n with \\nx -asx'\\\\<^sub>d* n''\\ have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with \\n -asx\\\\<^sub>c\\<^sub>d nx\\ \\as = asx@asx'\\\n have \"\\n'' asx asx'. n -asx\\\\<^sub>c\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n next\n assume \"\\nx V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx V' asx asx' where \"n -{V'}asx\\\\<^sub>d\\<^sub>d nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from \\n'' -{V}as'\\\\<^sub>d\\<^sub>d n'\\ have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_ddep)\n with \\nx -asx'\\\\<^sub>d* n''\\ have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with \\n -{V'}asx\\\\<^sub>d\\<^sub>d nx\\ \\as = asx@asx'\\\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^sub>d\\<^sub>d n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma DynPDG_path_rev_cases [consumes 1,\n case_names DynPDG_path_Nil DynPDG_path_cdep_Append DynPDG_path_ddep_Append]:\n \"\\n -as\\\\<^sub>d* n'; \\as = []; n = n'\\ \\ Q;\n \\n'' asx asx'. \\n -asx\\\\<^sub>c\\<^sub>d n''; n'' -asx'\\\\<^sub>d* n'; \n as = asx@asx'\\ \\ Q;\n \\V n'' asx asx'. \\n -{V}asx\\\\<^sub>d\\<^sub>d n''; n'' -asx'\\\\<^sub>d* n'; \n as = asx@asx'\\ \\ Q\\\n \\ Q\"\nby(blast dest:DynPDG_path_split)\n\n\n\nlemma DynPDG_ddep_edge_no_shorter_ddep_edge:\n assumes ddep:\"n -{V}as\\\\<^sub>d\\<^sub>d n'\"\n shows \"\\as' a as''. tl as = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\"\nproof -\n from ddep have influence:\"n influences V in n' via as\"\n by(auto elim!:DynPDG_edge.cases)\n then obtain a asx where as:\"as = a#asx\"\n and notin:\"n \\ set (sourcenodes asx)\"\n by(auto dest:dyn_influence_source_notin_tl_edges simp:dyn_data_dependence_def)\n from influence as\n have imp:\"\\nx \\ set (sourcenodes asx). V \\ Def nx\"\n by(auto simp:dyn_data_dependence_def)\n { fix as' a' as'' \n assume eq:\"tl as = as'@a'#as''\"\n and ddep':\"sourcenode a' -{V}a'#as''\\\\<^sub>d\\<^sub>d n'\"\n from eq as notin have noteq:\"sourcenode a' \\ n\" by(auto simp:sourcenodes_def)\n from ddep' have \"V \\ Def (sourcenode a')\"\n by(auto elim!:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with eq as noteq imp have False by(auto simp:sourcenodes_def) }\n thus ?thesis by blast\nqed\n\n\n\nlemma no_ddep_same_state:\n assumes path:\"n -as\\* n'\" and Uses:\"V \\ Use n'\" and preds:\"preds (kinds as) s\"\n and no_dep:\"\\as' a as''. as = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\"\n shows \"state_val (transfers (kinds as) s) V = state_val s V\"\nproof -\n { fix n''\n assume inset:\"n'' \\ set (sourcenodes as)\" and Defs:\"V \\ Def n''\"\n hence \"\\nx \\ set (sourcenodes as). V \\ Def nx\" by auto\n then obtain nx ns' ns'' where nodes:\"sourcenodes as = ns'@nx#ns''\"\n and Defs':\"V \\ Def nx\" and notDef:\"\\nx' \\ set ns''. V \\ Def nx'\"\n by(fastforce elim!:rightmost_element_property)\n from nodes obtain as' a as''\n where as'':\"sourcenodes as'' = ns''\" and as:\"as=as'@a#as''\"\n and source:\"sourcenode a = nx\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from as path have path':\"sourcenode a -a#as''\\* n'\"\n by(fastforce dest:path_split_second)\n from notDef as'' source\n have \"\\n'' \\ set (sourcenodes as''). V \\ Def n''\"\n by(auto simp:sourcenodes_def)\n with path' Defs' Uses source\n have influence:\"nx influences V in n' via (a#as'')\"\n by(simp add:dyn_data_dependence_def)\n hence \"nx \\ set (sourcenodes as'')\" by(rule dyn_influence_source_notin_tl_edges)\n with influence source\n have \"\\asx a'. sourcenode a' -{V}a'#asx\\\\<^sub>d\\<^sub>d n' \\ sourcenode a' = nx \\\n (\\asx'. a#as'' = asx'@a'#asx)\"\n by(fastforce intro:DynPDG_ddep_edge)\n with nodes no_dep as have False by(auto simp:sourcenodes_def) }\n hence \"\\n \\ set (sourcenodes as). V \\ Def n\" by auto\n with wf path preds show ?thesis by(fastforce intro:CFG_path_no_Def_equal)\nqed\n\n\nlemma DynPDG_ddep_edge_only_first_edge:\n \"\\n -{V}a#as\\\\<^sub>d\\<^sub>d n'; preds (kinds (a#as)) s\\ \\ \n state_val (transfers (kinds (a#as)) s) V = state_val (transfer (kind a) s) V\"\n apply -\n apply(erule DynPDG_edge.cases)\n apply auto\n apply(frule dyn_influence_Cons_source)\n apply(frule dyn_influence_source_notin_tl_edges)\n by(erule dyn_influence_only_first_edge)\n\n\nlemma Use_value_change_implies_DynPDG_ddep_edge:\n assumes \"n -as\\* n'\" and \"V \\ Use n'\" and \"preds (kinds as) s\" \n and \"preds (kinds as) s'\" and \"state_val s V = state_val s' V\"\n and \"state_val (transfers (kinds as) s) V \\ \n state_val (transfers (kinds as) s') V\"\n obtains as' a as'' where \"as = as'@a#as''\"\n and \"sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\"\n and \"state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V\"\n and \"state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\nproof(atomize_elim)\n show \"\\as' a as''. as = as'@a#as'' \\\n sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n' \\\n state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V \\\n state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\n proof(cases \"\\as' a as''. as = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\")\n case True\n with \\n -as\\* n'\\ \\V \\ Use n'\\ \\preds (kinds as) s\\ \\preds (kinds as) s'\\\n have \"state_val (transfers (kinds as) s) V = state_val s V\"\n and \"state_val (transfers (kinds as) s') V = state_val s' V\"\n by(auto intro:no_ddep_same_state)\n with \\state_val s V = state_val s' V\\ \n \\state_val (transfers (kinds as) s) V \\ state_val (transfers (kinds as) s') V\\\n show ?thesis by simp\n next\n case False\n then obtain as' a as'' where [simp]:\"as = as'@a#as''\"\n and \"sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\" by auto\n from \\preds (kinds as) s\\ have \"preds (kinds (a#as'')) (transfers (kinds as') s)\"\n by(simp add:kinds_def preds_split)\n with \\sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\\ have all:\n \"state_val (transfers (kinds (a#as'')) (transfers (kinds as') s)) V = \n state_val (transfer (kind a) (transfers (kinds as') s)) V\"\n by(auto dest!:DynPDG_ddep_edge_only_first_edge)\n from \\preds (kinds as) s'\\ \n have \"preds (kinds (a#as'')) (transfers (kinds as') s')\"\n by(simp add:kinds_def preds_split)\n with \\sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\\ have all':\n \"state_val (transfers (kinds (a#as'')) (transfers (kinds as') s')) V = \n state_val (transfer (kind a) (transfers (kinds as') s')) V\"\n by(auto dest!:DynPDG_ddep_edge_only_first_edge)\n hence eq:\"\\s. transfers (kinds as) s =\n transfers (kinds (a#as'')) (transfers (kinds as') s)\"\n by(simp add:transfers_split[THEN sym] kinds_def)\n with all have \"state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V\"\n by(simp add:transfers_split kinds_def)\n moreover\n from eq all' have \"state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\n by(simp add:transfers_split kinds_def)\n ultimately show ?thesis using \\sourcenode a -{V}a#as''\\\\<^sub>d\\<^sub>d n'\\ by simp blast\n qed\nqed\n\n\nend\n\n\nsubsection \\Instantiate dynamic PDG\\\n\nsubsubsection \\Standard control dependence\\\n\nlocale DynStandardControlDependencePDG =\n Postdomination sourcenode targetnode kind valid_edge Entry Exit +\n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\nlemma DynPDG_scd:\n \"DynPDG sourcenode targetnode kind valid_edge (_Entry_) \n Def Use state_val (_Exit_) dyn_standard_control_dependence\"\nproof(unfold_locales)\n fix n n' as assume \"n controls\\<^sub>s n' via as\"\n show \"n' \\ (_Exit_)\"\n proof\n assume \"n' = (_Exit_)\"\n with \\n controls\\<^sub>s n' via as\\ show False\n by(fastforce intro:Exit_not_dyn_standard_control_dependent)\n qed\nnext\n fix n n' as assume \"n controls\\<^sub>s n' via as\"\n thus \"n -as\\* n' \\ as \\ []\"\n by(fastforce simp:dyn_standard_control_dependence_def)\nqed\n\n\nend\n\nsubsubsection \\Weak control dependence\\\n\nlocale DynWeakControlDependencePDG = \n StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit +\n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\n\n\n\nend\n\n\nsubsection \\Data slice\\\n\ndefinition (in CFG) empty_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\"\nwhere \"empty_control_dependence n n' as \\ False\"\n\nlemma (in CFGExit_wf) DynPDG_scd:\n \"DynPDG sourcenode targetnode kind valid_edge (_Entry_)\n Def Use state_val (_Exit_) empty_control_dependence\"\nproof(unfold_locales)\n fix n n' as assume \"empty_control_dependence n n' as\"\n thus \"n' \\ (_Exit_)\" by(simp add:empty_control_dependence_def)\nnext\n fix n n' as assume \"empty_control_dependence n n' as\"\n thus \"n -as\\* n' \\ as \\ []\" by(simp add:empty_control_dependence_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/Dynamic/DynPDG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.28702130606716453}} {"text": "theory Seq_Parametric\n imports \"../Gensyn\" \"../Gensyn_Descend\" \"../Mergeable/Mergeable\" \"../Mergeable/MergeableInstances\"\n \"../Lifting/LiftUtils\" \"../Lifting/LiftInstances\"\n \"../Lifting/AutoLift\" \"../Semantics/Gensyn_Sem_Small\"\n \"../Hoare/CPS_Hoare\"\n\nbegin\n\n(* Variant of sequencing language with extensible syntax instead of skeleton *)\n\ndatatype syn =\n Sseq\n | Sskip\n\n\ntype_synonym 'xext state' = \"gensyn_skel * 'xext gs_result * dir\"\n\nfun getlast :: \"'a list \\ 'a option\" where\n\"getlast [] = None\"\n| \"getlast [h] = Some h\"\n| \"getlast (h1#h2#t) = getlast (h2#t)\"\n\n(* to be strict, we need to check if the returned CP is a suffix of us. *)\n(* TODO: factor out the part about deferring to parent *)\n(*\n(case gensyn_cp_parent sk cp of\n None \\ (sk, GRDone, Up cp)\n | Some cp' \\ (sk, GRPath cp', Up xcp))\n*)\n(*\n Seq will always \"catch-and-rethrow\" exceptions from below\n \n*)\ndefinition seq_sem :: \"syn \\ 'xext state' \\ 'xext state'\" where\n\"seq_sem x st =\n(case st of (sk, GRPath cp, d) \\\n (case x of\n Sskip \\ (case cp_parent cp of\n None \\ (sk, GRDone, Up cp)\n | Some cp' \\ (sk, GRPath cp', Up cp))\n | Sseq \\\n (case d of\n Down \\\n (case gensyn_get sk (cp @ [0]) of\n None \\ (sk, GRPath cp, Up cp)\n | Some _ \\ (sk, GRPath (cp @ [0]), Down))\n | Up xcp \\ \n (case get_suffix cp xcp of\n Some (xcph#xcpt) \\ \n (case gensyn_get sk (cp @ [1+xcph]) of\n None \\ (case cp_parent cp of\n None \\ (sk, GRDone, Up cp)\n | Some cp' \\ (sk, GRPath cp', Up cp))\n | Some _ \\ (sk, GRPath (cp @ [1+xcph]), Down))\n | _ \\ (if cp = xcp \n \\ \\if our signal is not coming from a child, it should come from us,\n otherwise this is an error\\\n then (case cp_parent cp of\n None \\ (sk, GRDone, Up cp)\n | Some cp' \\ (sk, GRPath cp', Up cp))\n else (sk, GRCrash, Up cp)))))\n | _ \\ st)\"\n\n\ntype_synonym 'xext state = \"gensyn_skel md_triv option *\n 'xext gs_result md_triv option md_prio *\n dir md_triv option md_prio\"\n\n\ninstantiation gensyn :: (Bogus) Bogus begin\ndefinition gensyn_bogus :\n\"bogus = G bogus []\"\ninstance proof qed\nend\n\ninstantiation gs_result :: (_) Bogus begin\ndefinition gsx_result_bogus :\n\"bogus = GRUnhandled\"\ninstance proof qed\nend\n\ninstantiation dir :: Bogus begin\ndefinition dir_bogus :\n\"bogus = Down\"\ninstance proof qed\nend\n\ndefinition seq_path :: \"'xext state \\ childpath option\" where\n\"seq_path s =\n (case s of\n (_, (mdp _ (Some (mdt (GRPath p)))), _) \\ Some p\n | _ \\ None)\"\n\n(*\ndefinition seq_sem_l :: \" syn \\ state \\ state\" where\n\"seq_sem_l =\n l_map_s id\n (prod_l (option_l (triv_l (id_l)))\n (prod_l \n (prio_l_inc (option_l (triv_l (id_l))))\n (prio_l_inc (option_l (triv_l (id_l)))))) (seq_sem)\"\n*)\n\n\nterm \"(schem_lift\n (SP NA (SP NB NC)) (SP (SO NA) (SP (SPRI (SO NB)) (SPRI (SO NC)))))\"\n\ndefinition seq_sem_l :: \"syn \\ ('xext :: Bogus) state \\ ('xext :: Bogus) state\" where\n\"seq_sem_l =\n lift_map_s id\n (schem_lift\n (SP NA (SP NB NC)) (SP (SO NA) (SP (SPRI (SO NB)) (SPRI (SO NC)))))\n seq_sem\"\n\ndefinition seq_gsem :: \"(syn, ('xext :: Bogus) state) g_sem\" where\n\"seq_gsem \\\n \\ gs_sem = seq_sem_l\n , gs_getpath = seq_path \\\"\n\n(* we will need to generalize this however *)\nlemma seq_hoare :\n assumes H : \"\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Attic/Old_Examples/Seq_Parametric.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.44552953503957277, "lm_q1q2_score": 0.28702130606716453}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * This file contains theorems for dealing with a \"simply\" lifted\n * heap, where each byte of memory can be accessed as one (and only)\n * type.\n *\n * This is a simpler model of Tuch's \"lift_t\" model, where nested\n * struct fields cannot be directly accessed as pointers.\n *)\n\ntheory TypHeapSimple\nimports\n \"../../lib/TypHeapLib\"\nbegin\n\n(*\n * Each address in the heap can contain one of three things:\n *\n * - A type tag, which inidicates that this address is the first\n * byte of an object;\n *\n * - A footprint, which indicates that this address is a latter byte\n * of an object;\n *\n * - Nothing, which indicates that this address does not fall inside\n * an object.\n *)\ndatatype heap_typ_contents =\n HeapType typ_uinfo\n | HeapFootprint\n | HeapEmpty\n\n(*\n * Given a Tuch-style heap representation (where each memory location\n * contains a set of different types, representing nested field types)\n * calculate a single top-level type of the heap.\n *\n * We just want to commit to a single type for this heap location,\n * and nothing more.\n *)\ndefinition\n heap_type_tag :: \"heap_typ_desc \\ word32 \\ heap_typ_contents\"\nwhere\n \"heap_type_tag d a \\\n (if fst (d a) = False \\ (\\x. (snd (d a)) x = None) \\ (\\x. (snd (d a)) x \\ None) then\n HeapEmpty\n else\n case (snd (d a)) (GREATEST x. snd (d a) x \\ None) of\n Some (_, False) \\ HeapFootprint\n | Some (x, True) \\ HeapType x\n | None \\ HeapEmpty)\"\n\n(*\n * Determine if the heap has a valid footprint for the given type at\n * the given address.\n *\n * A valid footprint means that the user has committed that the given\n * memory location will only be used for the given type.\n *\n * A \"simple\" footprint differs from the Tuch-style because we only\n * commit to a single type, and have no support for accessing nested\n * structures.\n *)\ndefinition\n valid_simple_footprint :: \"heap_typ_desc \\ word32 \\ typ_uinfo \\ bool\"\nwhere\n \"valid_simple_footprint d x t \\\n heap_type_tag d x = HeapType t \\\n (\\y. y \\ {x + 1..+ (size_td t)- Suc 0} \\ heap_type_tag d y = HeapFootprint)\"\n\nlemma valid_simple_footprintI:\n \"\\ heap_type_tag d x = HeapType t; \\y. y \\ {x + 1..+(size_td t) - Suc 0} \\ heap_type_tag d y = HeapFootprint \\\n \\ valid_simple_footprint d x t\"\n by (clarsimp simp: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD:\n \"valid_simple_footprint d x t \\ heap_type_tag d x = HeapType t\"\n by (simp add: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD2:\n \"\\ valid_simple_footprint d x t; y \\ {x + 1..+(size_td t) - Suc 0} \\ \\ heap_type_tag d y = HeapFootprint\"\n by (simp add: valid_simple_footprint_def)\n\nlemma typ_slices_not_empty:\n \"typ_slices (x::('a::{mem_type} itself)) \\ []\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma last_typ_slice_t:\n \"(last (typ_slice_t t 0)) = (t, True)\"\n apply (case_tac t)\n apply clarsimp\n done\n\nlemma if_eqI:\n \"\\ a \\ x = z; \\ a \\ y = z \\ \\ (if a then x else y) = z\"\n by simp\n\nlemma heap_type_tag_ptr_retyp:\n \"snd (s (ptr_val t)) = empty \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) = HeapType (typ_uinfo_t TYPE('a))\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, fastforce, fastforce)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply clarsimp\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) 0)\" in allE)\n apply (clarsimp simp: list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] last_typ_slice_t\n split: option.splits if_split_asm prod.splits)\n done\n\nlemma not_snd_last_typ_slice_t:\n \"k \\ 0 \\ \\ snd (last (typ_slice_t z k))\"\n by (case_tac z, clarsimp)\n\nlemma heap_type_tag_ptr_retyp_rest:\n \"\\ snd (s (ptr_val t + k)) = empty; 0 < k; unat k < size_td (typ_uinfo_t TYPE('a)) \\ \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t + k) = HeapFootprint\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, simp, clarsimp,\n metis intvlI size_of_def word_unat.Rep_inverse)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply (clarsimp simp: typ_slices_index size_of_def)\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) (unat k))\" in allE)\n apply (clarsimp simp: typ_slices_index size_of_def list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] size_of_def\n split: option.splits if_split_asm prod.splits bool.splits)\n apply (metis surj_pair)\n apply (subst (asm) (2) surjective_pairing)\n apply (subst (asm) not_snd_last_typ_slice_t)\n apply clarsimp\n apply unat_arith\n apply simp\n done\n\nlemma typ_slices_addr_card [simp]:\n \"length (typ_slices (x::('a::{mem_type} itself))) < addr_card\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma htd_update_list_same':\n \"\\0 < unat k; unat k \\ addr_card - length v\\ \\ htd_update_list (p + k) v h p = h p\"\n apply (insert htd_update_list_same [where v=v and p=p and h=h and k=\"unat k\"])\n apply clarsimp\n done\n\nlemma unat_less_impl_less:\n \"unat a < unat b \\ a < b\"\n by unat_arith\n\nlemma valid_simple_footprint_ptr_retyp:\n \"\\ \\k < size_td (typ_uinfo_t TYPE('a)). snd (s (ptr_val t + of_nat k)) = Map.empty;\n 1 \\ size_td (typ_uinfo_t TYPE('a));\n size_td (typ_uinfo_t TYPE('a)) < addr_card \\\n \\ valid_simple_footprint (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) (typ_uinfo_t TYPE('a))\"\n apply (clarsimp simp: valid_simple_footprint_def)\n apply (rule conjI)\n apply (subst heap_type_tag_ptr_retyp)\n apply (erule allE [where x=\"0\"])\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (erule_tac x=\"k + 1\" in allE)\n apply (erule impE)\n apply (metis One_nat_def less_diff_conv)\n apply (subst add.assoc, subst heap_type_tag_ptr_retyp_rest)\n apply clarsimp\n apply (case_tac \"1 + of_nat k = (0 :: word32)\")\n apply (metis add.left_neutral intvlI intvl_Suc_nmem size_of_def)\n apply unat_arith\n apply clarsimp\n apply (metis lt_size_of_unat_simps size_of_def Suc_eq_plus1 One_nat_def less_diff_conv of_nat_Suc)\n apply simp\n done\n\n(* Determine if the given pointer is valid in the given heap. *)\ndefinition\n heap_ptr_valid :: \"heap_typ_desc \\ 'a::c_type ptr \\ bool\"\nwhere\n \"heap_ptr_valid d p \\\n valid_simple_footprint d (ptr_val (p::'a ptr)) (typ_uinfo_t TYPE('a))\n \\ c_guard p\"\n\n(*\n * Lift a heap from raw bytes and a heap description into\n * higher-level objects.\n *\n * This differs from Tuch's \"lift_t\" because we only support\n * simple lifting; that is, each byte in the heap may only\n * be accessed as a single type. Accessing struct fields by\n * their pointers is not supported.\n *)\ndefinition\n simple_lift :: \"heap_raw_state \\ ('a::c_type) ptr \\ 'a option\"\nwhere\n \"simple_lift s p = (\n if (heap_ptr_valid (hrs_htd s) p) then\n (Some (h_val (hrs_mem s) p))\n else\n None)\"\n\nlemma simple_lift_heap_ptr_valid:\n \"simple_lift s p = Some x \\ heap_ptr_valid (hrs_htd s) p\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma simple_lift_c_guard:\n \"simple_lift s p = Some x \\ c_guard p\"\n apply (clarsimp simp: simple_lift_def heap_ptr_valid_def split: if_split_asm)\n done\n\n(* Two valid footprints will either overlap completely or not at all. *)\nlemma valid_simple_footprint_neq:\n assumes valid_p: \"valid_simple_footprint d p s\"\n and valid_q: \"valid_simple_footprint d q t\"\n and neq: \"p \\ q\"\n shows \"p \\ {q..+ (size_td t)}\"\nproof -\n have heap_type_p: \"heap_type_tag d p = HeapType s\"\n apply (metis valid_p valid_simple_footprint_def)\n done\n\n have heap_type_q: \"heap_type_tag d q = HeapType t\"\n apply (metis valid_q valid_simple_footprint_def)\n done\n\n have heap_type_q_footprint:\n \"\\x. x \\ {(q + 1)..+(size_td t - Suc 0)} \\ heap_type_tag d x = HeapFootprint\"\n apply (insert valid_q)\n apply (simp add: valid_simple_footprint_def)\n done\n\n show ?thesis\n using heap_type_q_footprint heap_type_p neq\n intvl_neq_start heap_type_q\n by (metis heap_typ_contents.simps(2))\nqed\n\n(* Two valid footprints with different types will never overlap. *)\nlemma valid_simple_footprint_type_neq:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n p \\ {q..+ (size_td t)}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma valid_simple_footprint_neq_disjoint:\n \"\\ valid_simple_footprint d p s; valid_simple_footprint d q t; p \\ q \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (rule ccontr)\n apply (fastforce simp: valid_simple_footprint_neq dest!: intvl_inter)\n done\n\nlemma valid_simple_footprint_type_neq_disjoint:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq_disjoint, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma heap_ptr_valid_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n ptr_val p \\ ptr_val q \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (clarsimp simp only: size_of_tag [symmetric])\n apply (rule valid_simple_footprint_neq_disjoint [where d=\"d\"])\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply simp\n done\n\nlemma heap_ptr_valid_type_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (subgoal_tac \"ptr_val p \\ ptr_val q\")\n apply (rule heap_ptr_valid_neq_disjoint, auto)[1]\n apply (clarsimp simp: heap_ptr_valid_def valid_simple_footprint_def)\n done\n\n(* If we update one pointer in the heap, other valid pointers will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"ptr_val p \\ ptr_val q\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* If we update one type in the heap, other types will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other_typ:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_type_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* Updating the raw heap is equivalent to updating the lifted heap. *)\nlemma simple_lift_heap_update:\n \"\\ heap_ptr_valid (hrs_htd h) p \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h)\n = (simple_lift h)(p := Some (v::'a::mem_type))\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def hrs_mem_update h_val_heap_update)\n apply (fastforce simp: heap_ptr_valid_heap_update_other ptr_val_inj)\n done\n\n(* Updating the raw heap of one type doesn't affect the lifted heap of other types. *)\nlemma simple_lift_heap_update_other:\n \"\\ heap_ptr_valid (hrs_htd d) (p::'b::mem_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) d) = ((simple_lift d)::'a::c_type typ_heap)\"\n apply (rule ext)+\n apply (clarsimp simp: simple_lift_def h_val_heap_update hrs_mem_update)\n apply (auto intro: heap_ptr_valid_heap_update_other_typ)\n done\n\nlemma h_val_simple_lift:\n \"simple_lift h p = Some v \\ h_val (hrs_mem h) p = v\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma h_val_field_simple_lift:\n \"\\ simple_lift h (pa :: 'a ptr) = Some (v::'a::mem_type);\n \\t. field_ti TYPE('a) f = Some t;\n export_uinfo (the (field_ti TYPE('a) f)) = export_uinfo (typ_info_t TYPE('b :: mem_type)) \\ \\\n h_val (hrs_mem h) (Ptr &(pa\\f) :: 'b :: mem_type ptr) = from_bytes (access_ti\\<^sub>0 (the (field_ti TYPE('a) f)) v)\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: h_val_field_from_bytes)\n done\n\nlemma simple_lift_heap_update':\n \"simple_lift h p = Some v' \\\n simple_lift (hrs_mem_update (heap_update (p::('a::{mem_type}) ptr) v) h)\n = (simple_lift h)(p := Some v)\"\n apply (rule simple_lift_heap_update)\n apply (erule simple_lift_heap_ptr_valid)\n done\n\nlemma simple_lift_hrs_mem_update_None [simp]:\n \"(simple_lift (hrs_mem_update a hp) x = None) = (simple_lift hp x = None)\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma simple_lift_data_eq:\n \"\\ h_val (hrs_mem h) p = h_val (hrs_mem h') p';\n heap_ptr_valid (hrs_htd h) p = heap_ptr_valid (hrs_htd h') p' \\ \\\n simple_lift h p = simple_lift h' p'\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma h_val_heap_update_disjoint:\n \"\\ {ptr_val p ..+ size_of TYPE('a::c_type)}\n \\ {ptr_val q ..+ size_of TYPE('b::mem_type)} = {} \\ \\\n h_val (heap_update (q :: 'b ptr) r h) (p :: 'a ptr) = h_val h p\"\n apply (clarsimp simp: h_val_def)\n apply (clarsimp simp: heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply blast\n apply clarsimp\n done\n\nlemma update_ti_t_valid_size:\n \"size_of TYPE('b) = size_td t \\\n update_ti_t t (to_bytes_p (val::'b::mem_type)) obj = update_ti t (to_bytes_p val) obj\"\n apply (clarsimp simp: update_ti_t_def to_bytes_p_def)\n done\n\nlemma h_val_field_from_bytes':\n \"\\ field_ti TYPE('a::{mem_type}) f = Some t;\n export_uinfo t = export_uinfo (typ_info_t TYPE('b::{mem_type})) \\ \\\n h_val h (Ptr &(pa\\f) :: 'b ptr) = from_bytes (access_ti\\<^sub>0 t (h_val h pa))\"\n apply (insert h_val_field_from_bytes [where f=f and pa=pa and t=t and h=\"(h,x)\" and 'a='a and 'b='b])\n apply (clarsimp simp: hrs_mem_def)\n done\n\nlemma simple_lift_super_field_update_lookup:\n fixes dummy :: \"'b :: mem_type\"\n assumes \"field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (s,n)\"\n and \"typ_uinfo_t TYPE('a) = export_uinfo s\"\n and \"simple_lift h p = Some v'\"\n shows \"(super_field_update_t (Ptr (&(p\\f))) (v::'a::mem_type) ((simple_lift h)::'b ptr \\ 'b option)) =\n ((simple_lift h)(p \\ field_update (field_desc s) (to_bytes_p v) v'))\"\nproof -\n from assms have [simp]: \"unat (of_nat n :: 32 word) = n\"\n apply (subst unat_of_nat)\n apply (subst mod_less)\n apply (drule td_set_field_lookupD)+\n apply (drule td_set_offset_size)+\n apply (subst len_of_addr_card)\n apply (subst (asm) size_of_def [symmetric, where t=\"TYPE('b)\"])+\n apply (subgoal_tac \"size_of TYPE('b) < addr_card\")\n apply arith\n apply simp\n apply simp\n done\n from assms show ?thesis\n apply (clarsimp simp: super_field_update_t_def)\n apply (rule ext)\n apply (clarsimp simp: field_lvalue_def split: option.splits)\n apply (safe, simp_all)\n apply (frule_tac v=v and v'=v' in update_field_update)\n apply (clarsimp simp: field_of_t_def field_of_def typ_uinfo_t_def)\n apply (frule_tac m=0 in field_names_SomeD2)\n apply simp\n apply clarsimp\n apply (simp add: field_typ_def field_typ_untyped_def)\n apply (frule field_lookup_export_uinfo_Some)\n apply (frule_tac s=k in field_lookup_export_uinfo_Some)\n apply simp\n apply (drule (1) field_lookup_inject)\n apply (subst typ_uinfo_t_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\n apply simp\n apply (drule field_of_t_mem)+\n apply (case_tac h)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply fast\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n done\nqed\n\nlemma field_offset_addr_card:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x \\ field_offset TYPE('a) f < addr_card\"\n apply (clarsimp simp: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (frule td_set_field_lookupD)\n apply (drule td_set_offset_size)\n apply (insert max_size [where ?'a=\"'a\"])\n apply (clarsimp simp: size_of_def)\n done\n\nlemma unat_of_nat_field_offset:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x \\\n unat (of_nat (field_offset TYPE('a) f) :: word32 ) = field_offset TYPE('a) f\"\n apply (subst word_unat.Abs_inverse)\n apply (clarsimp simp: unats_def)\n apply (insert field_offset_addr_card [where f=f and ?'a=\"'a\"])[1]\n apply (fastforce simp: addr_card)\n apply simp\n done\n\nlemma field_of_t_field_lookup:\n assumes a: \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n)\"\n assumes b: \"export_uinfo s = typ_uinfo_t TYPE('b::mem_type)\"\n assumes n: \"n = field_offset TYPE('a) f\"\n shows \"field_of_t (Ptr &(ptr\\f) :: ('b ptr)) (ptr :: 'a ptr)\"\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_of_t_def field_of_def)\n apply (subst td_set_field_lookup)\n apply (rule wf_desc_typ_tag)\n apply (rule exI [where x=f])\n using a[simplified n] b\n apply (clarsimp simp: typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_lvalue_def unat_of_nat_field_offset)\n done\n\nlemma simple_lift_field_update':\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('a)) f 0 =\n Some (adjust_ti (typ_info_t TYPE('b)) xf xfu, n)\"\n and xf_xfu: \"fg_cons xf xfu\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu val z)\"\n (is \"?LHS = ?RHS\")\nproof (rule ext)\n fix p\n\n have eui: \"typ_uinfo_t TYPE('b) =\n export_uinfo (adjust_ti (typ_info_t TYPE('b)) xf xfu)\"\n using xf_xfu\n apply (subst export_tag_adjust_ti2 [OF _ wf_lf wf_desc])\n apply (simp add: fg_cons_def )\n apply (rule meta_eq_to_obj_eq [OF typ_uinfo_t_def])\n done\n\n have n_is_field_offset: \"n = field_offset TYPE('a) f\"\n apply (insert field_lookup_offset_eq [OF fl])\n apply (clarsimp)\n done\n\n have equal_case: \"?LHS ptr = ?RHS ptr\"\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: hrs_mem_update)\n apply (subst h_val_super_update_bs)\n apply (rule field_of_t_field_lookup [OF fl])\n apply (clarsimp simp: eui)\n apply (clarsimp simp: n_is_field_offset)\n apply clarsimp\n apply (unfold from_bytes_def)\n apply (subst fi_fu_consistentD [where f=f and s=\"adjust_ti (typ_info_t TYPE('b)) xf xfu\"])\n apply (clarsimp simp: fl)\n apply (clarsimp simp: n_is_field_offset field_lvalue_def)\n apply (metis unat_of_nat_field_offset fl)\n apply clarsimp\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: size_of_def)\n apply clarsimp\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply (subst update_ti_adjust_ti)\n apply (rule xf_xfu)\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: h_val_def)\n done\n\n show \"?LHS p = ?RHS p\"\n apply (case_tac \"p = ptr\")\n apply (erule ssubst)\n apply (rule equal_case)\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule h_val_heap_update_disjoint)\n apply (insert field_tag_sub [OF fl, where p=ptr])\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (frule (1) valid_simple_footprint_neq_disjoint, fastforce)\n apply clarsimp\n apply blast\n done\nqed\n\nlemma simple_lift_field_update:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f =\n Some (adjust_ti (typ_info_t TYPE('b)) xf (xfu o (\\x _. x)))\"\n and xf_xfu: \"fg_cons xf (xfu o (\\x _. x))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu (\\_. val) z)\"\n (is \"?LHS = ?RHS\")\n apply (insert fl [unfolded field_ti_def])\n apply (clarsimp split: option.splits)\n apply (subst simple_lift_field_update' [where xf=xf and xfu=\"xfu o (\\x _. x)\" and z=z])\n apply (clarsimp simp: o_def split: option.splits)\n apply (rule refl)\n apply (rule xf_xfu)\n apply (rule cl)\n apply clarsimp\n done\n\nlemma simple_heap_diff_types_impl_diff_ptrs:\n \"\\ heap_ptr_valid h (p::('a::c_type) ptr);\n heap_ptr_valid h (q::('b::c_type) ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n ptr_val p \\ ptr_val q\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma h_val_update_regions_disjoint:\n \"\\ { ptr_val p ..+ size_of TYPE('a) } \\ { ptr_val x ..+ size_of TYPE('b)} = {} \\ \\\n h_val (heap_update p (v::('a::mem_type)) h) x = h_val h (x::('b::c_type) ptr)\"\n apply (clarsimp simp: heap_update_def)\n apply (clarsimp simp: h_val_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply clarsimp\n done\n\nlemma simple_lift_field_update_t:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f = Some t\"\n and diff: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('c :: c_type)\"\n and eu: \"export_uinfo t = export_uinfo (typ_info_t TYPE('b))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"((simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) :: 'c ptr \\ 'c option) =\n simple_lift hp\"\n apply (rule ext)\n apply (case_tac \"simple_lift hp x\")\n apply clarsimp\n apply (case_tac \"ptr_val x = ptr_val ptr\")\n apply clarsimp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (1) simple_heap_diff_types_impl_diff_ptrs [OF _ _ diff])\n apply simp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule field_ti_field_lookupE [OF fl])\n apply (frule_tac p=ptr in field_tag_sub)\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (2) heap_ptr_valid_neq_disjoint)\n apply (clarsimp simp: export_size_of [unfolded typ_uinfo_t_def, OF eu])\n apply blast\n apply simp\n done\n\nlemma simple_lift_heap_update_other':\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h) = ((simple_lift h)::'a::c_type typ_heap)\"\n apply (rule simple_lift_heap_update_other)\n apply (erule simple_lift_heap_ptr_valid)\n apply simp\n done\n\n(* If you update bytes inside an object of one type, it won't affect\n * heaps of other types. *)\nlemma simple_lift_heap_update_bytes_in_other:\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('b) \\ typ_uinfo_t TYPE('c);\n { ptr_val q ..+ size_of TYPE('a)} \\ {ptr_val p ..+ size_of TYPE('b) } \\ \\\n simple_lift (hrs_mem_update (heap_update (q::'a::mem_type ptr) v) h) = ((simple_lift h)::'c::mem_type typ_heap)\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_type_neq_disjoint, simp)\n apply (clarsimp simp: hrs_mem_update)\n apply (rule h_val_heap_update_disjoint)\n apply blast\n done\n\nlemma typ_name_neq:\n \"typ_name (export_uinfo (typ_info_t TYPE('a::c_type)))\n \\ typ_name (export_uinfo (typ_info_t TYPE('b::c_type)))\n \\ typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n apply (metis typ_uinfo_t_def)\n done\n\nlemma of_nat_mod_div_decomp:\n \"of_nat k\n = of_nat (k div size_of TYPE('b)) * of_nat (size_of TYPE('b::mem_type)) +\n of_nat (k mod size_of TYPE('b))\"\n by (metis mod_div_decomp of_nat_add of_nat_mult)\n\nlemma c_guard_array_c_guard:\n \"\\ \\x. x < CARD('a) \\ c_guard (ptr_coerce p +\\<^sub>p int x :: 'b ptr) \\ \\ c_guard ( p :: ('b :: mem_type, 'a :: finite) array ptr)\"\n apply atomize\n apply (clarsimp simp: c_guard_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: ptr_aligned_def align_of_def align_td_array)\n apply (simp add: c_null_guard_def)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"k div size_of TYPE('b)\" in spec)\n apply (erule impE)\n apply (metis (full_types) less_nat_zero_code mult_is_0 neq0_conv td_gal_lt)\n apply clarsimp\n apply (drule_tac x=\"k mod size_of TYPE('b)\" in spec)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n apply (subst (asm) add.assoc)\n apply (subst (asm) of_nat_mod_div_decomp [symmetric])\n apply clarsimp\n done\n\nlemma heap_list_update_list':\n \"\\ n + x \\ length v; length v < addr_card; q = (p + of_nat x) \\ \\\n heap_list (heap_update_list p v h) n q = take n (drop x v)\"\n by (metis heap_list_update_list)\n\nlemma outside_intvl_range:\n \"p \\ {a ..+ b} \\ p < a \\ p \\ a + of_nat b\"\n apply (clarsimp simp: intvl_def not_le not_less)\n apply (drule_tac x=\"unat (p-a)\" in spec)\n apply clarsimp\n apply (metis add_diff_cancel2 le_less_linear le_unat_uoi\n mpl_lem not_add_less2 unat_mono word_less_minus_mono_left)\n done\n\nlemma first_in_intvl:\n \"b \\ 0 \\ a \\ {a ..+ b}\"\n by (force simp: intvl_def)\n\nlemma zero_not_in_intvl_no_overflow:\n \"0 \\ {a :: 'a::len word ..+ b} \\ unat a + b \\ 2 ^ len_of TYPE('a)\"\n apply (rule ccontr)\n apply (simp add: intvl_def not_le)\n apply (drule_tac x=\"2 ^ len_of TYPE('a) - unat a\" in spec)\n apply (clarsimp simp: not_less)\n apply (erule disjE)\n apply (metis (erased, hide_lams) diff_add_inverse less_imp_add_positive of_nat_2p of_nat_add\n unat_lt2p word_neq_0_conv word_unat.Rep_inverse)\n apply (metis le_add_diff_inverse le_antisym le_diff_conv le_refl\n less_imp_le_nat add.commute not_add_less1 unat_lt2p)\n done\n\nlemma intvl_split:\n \"\\ n \\ a \\ \\ { p :: ('a :: len) word ..+ n } = { p ..+ a } \\ { p + of_nat a ..+ (n - a)}\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=k in exI)\n apply clarsimp\n apply (rule classical)\n apply (drule_tac x=\"k - a\" in spec)\n apply (clarsimp simp: not_less)\n apply (metis diff_less_mono not_less)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=\"unat (x - p)\" in exI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (metis le_unat_uoi less_or_eq_imp_le not_less order_trans)\n apply clarsimp\n apply (metis le_def le_eq_less_or_eq le_unat_uoi less_diff_conv\n add.commute of_nat_add)\n done\n\nlemma heap_ptr_valid_range_not_NULL:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ 0 \\ {ptr_val p ..+ size_of TYPE('a)}\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (metis c_guard_def c_null_guard_def)\n done\n\nlemma heap_ptr_valid_last_byte_no_overflow:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ unat (ptr_val p) + size_of TYPE('a) \\ 2 ^ len_of TYPE(32)\"\n by (metis c_guard_def c_null_guard_def heap_ptr_valid_def\n zero_not_in_intvl_no_overflow)\n\nlemma heap_ptr_valid_intersect_array:\n \"\\ \\j < n. heap_ptr_valid htd (p +\\<^sub>p int j);\n heap_ptr_valid htd (q :: ('a :: c_type) ptr) \\\n \\ (\\m < n. q = (p +\\<^sub>p int m))\n \\ ({ptr_val p ..+ size_of TYPE ('a) * n} \\ {ptr_val q ..+ size_of TYPE ('a :: c_type)} = {})\"\n apply (induct n)\n apply clarsimp\n apply atomize\n apply simp\n apply (case_tac \"n = 0\")\n apply clarsimp\n apply (metis heap_ptr_valid_neq_disjoint ptr_val_inj)\n apply (erule disjE)\n apply (metis less_Suc_eq)\n apply (case_tac \"q = p +\\<^sub>p int n\")\n apply force\n apply (frule_tac x=n in spec)\n apply (erule impE, simp)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply (simp add: CTypesDefs.ptr_add_def)\n apply (rule disjI2)\n apply (cut_tac a=\" of_nat n * of_nat (size_of TYPE('a))\"\n and p=\"ptr_val p\" and n=\"n * size_of TYPE('a) + size_of TYPE('a)\" in intvl_split)\n apply clarsimp\n apply (clarsimp simp: field_simps Int_Un_distrib2)\n apply (metis IntI emptyE intvl_empty intvl_inter intvl_self neq0_conv)\n done\n\n(* Simplification rules for dealing with \"lift_simple\". *)\n\nlemmas simple_lift_simps =\n typ_name_neq\n simple_lift_c_guard\n h_val_simple_lift\n simple_lift_heap_update'\n simple_lift_heap_update_other'\n c_guard_field\n h_val_field_simple_lift\n simple_lift_field_update\n simple_lift_field_update_t\n c_guard_array_field\n nat_to_bin_string_simps\n\n(* Old name for the above simpset. *)\nlemmas typ_simple_heap_simps = simple_lift_simps\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/autocorres/TypHeapSimple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.28696419612357715}} {"text": "theory DYNAMIC_Post_ISSUER\n imports\n \"Post_Observation_Setup_ISSUER\"\n DYNAMIC_Post_Value_Setup_ISSUER\n \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\n\nsubsubsection \\Issuer declassification bound\\\n\ntext \\\\label{sec:dynamic-post-issuer}\nWe verify that a group of users of some node \\i\\,\nallowed to take normal actions to the system and observe their outputs\n\\emph{and additionally allowed to observe communication},\ncan learn nothing about the updates to a post located at node \\i\\\nand the sends of that post to other nodes beyond:\n\n(1) the updates that occur during the times when one of the following holds,\nand the \\<^emph>\\last\\ update \\<^emph>\\before\\ one of the following holds\n(because, for example, observers can see the current version of the post when it is made public):\n\\begin{itemize}\n\\item either a user in the group is the post's owner or the administrator\n\\item or a user in the group is a friend of the owner\n\\item or the group has at least one registered user and the post is marked \"public\"\n\\end{itemize}\n\n(2) the presence of the sends (i.e., the number of the sending actions)\n\n(3) the public knowledge that what is being sent is always the last version (modeled as\nthe correlation predicate)\n\nSee \\<^cite>\\\\Appendix C\\ in \"cosmedis-SandP2017\"\\ for more details. This is the dynamic-trigger\n(i.e., trigger-incorporating inductive bound) version of the property proved in\nSection~\\ref{sec:post-issuer}.\nFor a discussion of this ``while-or-last-before'' style of formalizing bounds,\nsee \\<^cite>\\\\Section 3.4\\ in \"cosmed-jar2018\"\\ about the the corresponding property of CoSMed.\n\\\n\ncontext Post\nbegin\n\nfun T :: \"(state,act,out) trans \\ bool\" where \"T _ = False\"\n\ninductive BC :: \"value list \\ value list \\ bool\"\nand BO :: \"value list \\ value list \\ bool\"\nwhere\n BC_PVal[simp,intro!]:\n \"list_all (Not o isOVal) ul \\ list_all (Not o isOVal) ul1 \\\n map tgtAPI (filter isPValS ul) = map tgtAPI (filter isPValS ul1) \\\n (ul = [] \\ ul1 = [])\n \\ BC ul ul1\"\n|BC_BO[intro]:\n \"BO vl vl1 \\\n list_all (Not o isOVal) ul \\ list_all (Not o isOVal) ul1 \\\n map tgtAPI (filter isPValS ul) = map tgtAPI (filter isPValS ul1) \\\n (ul = [] \\ ul1 = []) \\\n (ul \\ [] \\ isPVal (last ul) \\ last ul = last ul1) \\\n list_all isPValS sul\n \\\n BC (ul @ sul @ OVal True # vl)\n (ul1 @ sul @ OVal True # vl1)\"\n(* *)\n|BO_PVal[simp,intro!]:\n \"list_all (Not o isOVal) ul \\ BO ul ul\"\n|BO_BC[intro]:\n \"BC vl vl1 \\\n list_all (Not o isOVal) ul\n \\\n BO (ul @ OVal False # vl) (ul @ OVal False # vl1)\"\n\nlemma list_all_filter_Not_isOVal:\nassumes \"list_all (Not \\ isOVal) ul\"\nand \"filter isPValS ul = []\" and \"filter isPVal ul = []\"\nshows \"ul = []\"\nusing assms value.exhaust_disc by (induct ul) auto\n\nlemma BC_not_Nil: \"BC vl vl1 \\ vl = [] \\ vl1 = []\"\nby(auto elim: BC.cases)\n\nlemma BC_OVal_True:\nassumes \"BC (OVal True # vl') vl1\"\nshows \"\\ vl1'. BO vl' vl1' \\ vl1 = OVal True # vl1'\"\nproof-\n define vl where vl: \"vl \\ OVal True # vl'\"\n have \"BC vl vl1\" using assms unfolding vl by auto\n thus ?thesis proof cases\n case (BC_BO vll vll1 ul ul1 sul)\n hence ul: \"ul = []\" unfolding vl apply simp\n by (metis (no_types) Post.value.disc(9) append_eq_Cons_conv\n list.map(2) list.pred_inject(2) list_all_map)\n have sul: \"sul = []\" using BC_BO unfolding vl ul apply simp\n by (metis Post.value.disc(6) append_eq_Cons_conv list.pred_inject(2))\n show ?thesis\n apply - apply(rule exI[of _ \"vll1\"])\n using BC_BO using list_all_filter_Not_isOVal[of ul1]\n unfolding ul sul vl by auto\n qed(unfold vl, auto)\nqed\n\n(* Correlation is defined to mean: always send what was last uploaded, or emptyPost\nif nothing had been uploaded. This needs the auxiliary notion of \"correlation from\" *)\nfun corrFrom :: \"post \\ value list \\ bool\" where\n \"corrFrom pst [] = True\"\n|\"corrFrom pst (PVal pstt # vl) = corrFrom pstt vl\"\n|\"corrFrom pst (PValS aid pstt # vl) = (pst = pstt \\ corrFrom pst vl)\"\n|\"corrFrom pst (OVal b # vl) = (corrFrom pst vl)\"\n\n\nabbreviation corr :: \"value list \\ bool\" where \"corr \\ corrFrom emptyPost\"\n\ndefinition B where\n\"B vl vl1 \\ BC vl vl1 \\ corr vl1\"\n\n(* lemma vl_Nil_filter_not:\nassumes \"filter (%v. isPVal v \\ isOVal v) Vl = [] \\ filter (Not o isPVal) Vl = []\"\nshows \"Vl = []\"\nusing assms by (induct Vl) auto *)\n\nlemma B_not_Nil:\nassumes B: \"B vl vl1\" and vl: \"vl = []\"\nshows \"vl1 = []\"\nusing B Post.BC_not_Nil Post.B_def vl by blast\n\n\nsublocale BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nsubsubsection \\Issuer unwinding proof\\\n\nlemma reach_PublicV_imples_FriendV[simp]:\nassumes \"reach s\"\nand \"vis s pid \\ PublicV\"\nshows \"vis s pid = FriendV\"\nusing assms reach_vis by auto\n\n\n(* major *) lemma eqButPID_step_\\_out:\nassumes ss1: \"eqButPID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand op: \"\\ open s\"\nand sT: \"reachNT s\" and s1: \"reach s1\"\nand \\: \"\\ (Trans s a ou s')\"\nshows \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\nproof-\n note [simp] = all_defs\n open_def\n note s = reachNT_reach[OF sT]\n note willUse =\n step step1 \\\n not_open_eqButPID[OF op ss1]\n reach_vis[OF s]\n eqButPID_stateSelectors[OF ss1] (* eqButPID_postSelectors[OF ss1] *)\n eqButPID_actions[OF ss1]\n eqButPID_update[OF ss1] (* eqButPID_setTextPost[OF ss1] *) eqButPID_not_PID[OF ss1]\n (* added to cope with extra leak towards the admin, when moving from CoSMed to CosMeDis: *)\n (* eqButPID_eqButT[OF ss1] *) eqButPID_eqButF[OF ss1]\n eqButPID_setShared[OF ss1] eqButPID_updateShared[OF ss1]\n eeqButPID_F_not_PID eqButPID_not_PID_sharedWith\n eqButPID_insert2[OF ss1]\n show ?thesis\n proof (cases a)\n case (Sact x1)\n with willUse show ?thesis by (cases x1) auto\n next\n case (Cact x2)\n with willUse show ?thesis by (cases x2) auto\n next\n case (Dact x3)\n with willUse show ?thesis by (cases x3) auto\n next\n case (Uact x4)\n with willUse show ?thesis by (cases x4) auto\n next\n case (Ract x5)\n with willUse show ?thesis\n proof (cases x5)\n case (rPost uid p pid)\n with Ract willUse show ?thesis by (cases \"pid = PID\") auto\n qed auto\n next\n case (Lact x6)\n with willUse show ?thesis\n proof (cases x6)\n case (lClientsPost uid p pid)\n with Lact willUse show ?thesis by (cases \"pid = PID\") auto\n qed auto\n next\n case (COMact x7)\n with willUse show ?thesis by (cases x7) auto\n qed\nqed\n\n(* major *) lemma eqButPID_step_eq:\nassumes ss1: \"eqButPID s s1\"\nand a: \"a = Uact (uPost uid p PID pst)\" \"ou = outOK\"\nand step: \"step s a = (ou, s')\" and step1: \"step s1 a = (ou', s1')\"\nshows \"s' = s1'\"\nusing ss1 step step1\nusing eqButPID_stateSelectors[OF ss1]\neqButPID_update[OF ss1] (* eqButPID_setTextPost[OF ss1] *) eqButPID_setShared[OF ss1]\nunfolding a by (auto simp: u_defs)\n\n\ndefinition \\0 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\0 s vl s1 vl1 \\\n \\ PID \\\\ postIDs s \\\n s = s1 \\ BC vl vl1 \\\n corr vl1\"\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n list_all (Not o isOVal) vl \\ list_all (Not o isOVal) vl1 \\\n map tgtAPI (filter isPValS vl) = map tgtAPI (filter isPValS vl1) \\\n (vl = [] \\ vl1 = []) \\\n eqButPID s s1 \\ \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\ndefinition \\11 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\11 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n vl = [] \\ list_all isPVal vl1 \\\n eqButPID s s1 \\ \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n list_all (Not o isOVal) vl \\\n vl = vl1 \\\n s = s1 \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\ndefinition \\31 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\31 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n (\\ ul ul1 sul vll vll1.\n BO vll vll1 \\\n list_all (Not o isOVal) ul \\ list_all (Not o isOVal) ul1 \\\n map tgtAPI (filter isPValS ul) = map tgtAPI (filter isPValS ul1) \\\n ul \\ [] \\ ul1 \\ [] \\\n isPVal (last ul) \\ last ul = last ul1 \\\n list_all isPValS sul \\\n vl = ul @ sul @ OVal True # vll \\ vl1 = ul1 @ sul @ OVal True # vll1) \\\n eqButPID s s1 \\ \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\ndefinition \\32 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\32 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n (\\ sul vll vll1.\n BO vll vll1 \\\n list_all isPValS sul \\\n vl = sul @ OVal True # vll \\ vl1 = sul @ OVal True # vll1) \\\n s = s1 \\ \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\ndefinition \\4 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\4 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n (\\ ul vll vll1.\n BC vll vll1 \\\n list_all (Not o isOVal) ul \\\n vl = ul @ OVal False # vll \\ vl1 = ul @ OVal False # vll1) \\\n s = s1 \\ open s \\\n corrFrom (post s1 PID) vl1\"\n\nlemma istate_\\0:\nassumes B: \"B vl vl1\"\nshows \"\\0 istate vl istate vl1\"\nusing assms unfolding \\0_def istate_def B_def by auto\n(* by (auto simp: list_all_isOVal_filter_isPValS)\n(auto intro!: exI[of _ \"[]\"]) *)\n\nlemma list_all_filter[simp]:\nassumes \"list_all PP xs\"\nshows \"filter PP xs = xs\"\nusing assms by (induct xs) auto\n\nlemma unwind_cont_\\0: \"unwind_cont \\0 {\\0,\\1,\\2,\\31,\\32,\\4}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\0 s vl s1 vl1 \\\n \\1 s vl s1 vl1 \\ \\2 s vl s1 vl1 \\\n \\31 s vl s1 vl1 \\ \\32 s vl s1 vl1 \\ \\4 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\0 s vl s1 vl1\"\n hence rs: \"reach s\" and ss1: \"s1 = s\" and BC: \"BC vl vl1\" and PID: \"\\ PID \\\\ postIDs s\"\n and cor1: \"corr vl1\" using reachNT_reach unfolding \\0_def by auto\n have vis: \"vis s PID = FriendV\" using reach_not_postIDs_friendV[OF rs PID] .\n have pPID: \"post s1 PID = emptyPost\" by (simp add: PID reach_not_postIDs_emptyPost rs ss1)\n have vlvl1: \"vl = [] \\ vl1 = []\" using BC_not_Nil BC by auto\n have op: \"\\ open s\" using PID unfolding open_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n hence pPID': \"post s' PID = emptyPost\"\n using step pPID ss1 PID\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by (fastforce simp: d_defs)\n subgoal by (fastforce simp: d_defs)\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match\n proof(cases \"\\ uid p. a = Cact (cPost uid p PID) \\ ou = outOK\")\n case True\n then obtain uid p where a: \"a = Cact (cPost uid p PID)\" and ou: \"ou = outOK\" by auto\n have PID': \"PID \\\\ postIDs s'\"\n using step PID unfolding a ou by (auto simp: c_defs)\n show ?thesis proof(cases\n \"\\ uid' \\ UIDs. uid' \\\\ userIDs s \\\n (uid' = admin s \\ uid' = uid \\ uid' \\\\ friendIDs s uid)\")\n case True note uid = True\n have op': \"open s'\" using uid using step PID' unfolding a ou by (auto simp: c_defs open_def)\n have \\: \"\\ ?trn\" using op op' unfolding \\_def2[OF step] by simp\n then obtain v where vl: \"vl = v # vl'\" and f: \"f ?trn = v\"\n using c unfolding consume_def \\_def2 by(cases vl) auto\n have v: \"v = OVal True\" using f op op' unfolding a by simp\n then obtain ul1 vl1' where BO': \"BO vl' vl1'\" and vl1: \"vl1 = ul1 @ OVal True # vl1'\"\n and ul1: \"list_all (Not \\ isOVal) ul1\"\n using BC_OVal_True[OF BC[unfolded vl v]] by auto\n have ul1: \"ul1 = []\"\n using BC BC_OVal_True list_all_Not_isOVal_OVal_True ul1 v vl vl1 by blast\n hence vl1: \"vl1 = OVal True # vl1'\" using vl1 by simp\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1'\" using \\ f unfolding vl1 v consume_def ss1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1'\" using BO' proof(cases rule: BO.cases)\n case (BO_PVal)\n hence \"\\2 s' vl' s' vl1'\" using PID' op' cor1 unfolding \\2_def vl1 pPID' by auto\n thus ?thesis by simp\n next\n case (BO_BC vll vll1 textl)\n hence \"\\4 s' vl' s' vl1'\" using PID' op' cor1 unfolding \\4_def vl1 pPID' by auto\n thus ?thesis by simp\n qed\n qed\n next\n case False note uid = False\n have op': \"\\ open s'\" using step op uid vis unfolding open_def a by (auto simp: c_defs)\n have \\: \"\\ \\ ?trn\" using op op' a unfolding \\_def2[OF step] by auto\n hence vl': \"vl' = vl\" using c unfolding consume_def by simp\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\ unfolding consume_def ss1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1\" using BC proof(cases rule: BC.cases)\n case (BC_PVal)\n hence \"\\1 s' vl' s' vl1\" using PID' op' cor1 unfolding \\1_def vl' pPID' by auto\n thus ?thesis by simp\n next\n case (BC_BO vll vll1 ul ul1 sul)\n show ?thesis\n proof(cases \"ul \\ [] \\ ul1 \\ []\")\n case True\n hence \"\\31 s' vl' s' vl1\" using BC_BO PID' op' cor1\n unfolding \\31_def vl' pPID' apply auto\n apply (rule exI[of _ \"ul\"]) apply (rule exI[of _ \"ul1\"])\n apply (rule exI[of _ \"sul\"])\n apply (rule exI[of _ \"vll\"]) apply (rule exI[of _ \"vll1\"])\n by auto\n thus ?thesis by simp\n next\n case False\n hence 0: \"ul = [] \\ ul1 = []\" using BC_BO by simp\n hence 1: \"list_all isPValS ul \\ list_all isPValS ul1\"\n using \\list_all (Not \\ isOVal) ul\\ \\list_all (Not \\ isOVal) ul1\\\n using filter_list_all_isPValS_isOVal by auto\n (* have \"map tgtAPI ul = map tgtAPI ul1\" using 1BC_BO by auto *)\n have \"\\32 s' vl' s' vl1\" using BC_BO PID' op' cor1 0 1\n unfolding \\32_def vl' pPID' apply simp\n apply(rule exI[of _ \"sul\"])\n apply(rule exI[of _ vll]) apply(rule exI[of _ vll1])\n by auto\n thus ?thesis by simp\n qed\n qed\n qed\n qed\n next\n case False note a = False\n have op': \"\\ open s'\"\n using a step PID op unfolding open_def\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by (fastforce simp: u_defs)\n subgoal by (fastforce simp: u_defs)\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have \\: \"\\ \\ ?trn\" using PID step op op' unfolding \\_def2[OF step]\n by (auto simp: u_defs com_defs)\n hence vl': \"vl' = vl\" using c unfolding consume_def by simp\n have PID': \"\\ PID \\\\ postIDs s'\"\n using step PID a\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by (fastforce simp: u_defs)\n subgoal by (fastforce simp: u_defs)\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\ unfolding consume_def ss1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\0 s' vl' s' vl1\" using a BC PID' cor1 unfolding \\0_def vl' by simp\n thus \"?\\ s' vl' s' vl1\" by simp\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1,\\11}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\11 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\1 s vl s1 vl1\"\n then obtain\n lvl: \"list_all (Not \\ isOVal) vl\" and lvl1: \"list_all (Not \\ isOVal) vl1\"\n and map: \"map tgtAPI (filter isPValS vl) = map tgtAPI (filter isPValS vl1)\"\n and rs: \"reach s\" and ss1: \"eqButPID s s1\" and op: \"\\ open s\" and PID: \"PID \\\\ postIDs s\"\n and vlvl1: \"vl = [] \\ vl1 = []\" and cor1: \"corrFrom (post s1 PID) vl1\"\n using reachNT_reach unfolding \\1_def by auto\n have PID1: \"PID \\\\ postIDs s1\" using eqButPID_stateSelectors[OF ss1] PID by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n hence own1: \"owner s1 PID \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n hence adm1: \"admin s1 \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have op1: \"\\ open s1\" using op ss1 eqButPID_open by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vll1) note vl1 = Cons\n show ?thesis proof(cases v1)\n case (PVal pst1) note v1 = PVal\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n define a1 where a1: \"a1 \\ Uact (uPost uid p PID pst1)\"\n have uid1: \"uid = owner s1 PID\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a1 = (ou1, s1')\" by(cases \"step s1 a1\") auto\n have ou1: \"ou1 = outOK\" using step1 PID1 own1 unfolding a1 uid1 p1 by (auto simp: u_defs)\n have op1': \"\\ open s1'\" using step1 op1 unfolding a1 ou1 open_def by (auto simp: u_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID own unfolding open_def by auto\n have pPID1': \"post s1' PID = pst1\" using step1 unfolding a1 ou1 by (auto simp: u_defs)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have ?iact proof\n show \"step s1 a1 = (ou1, s1')\" using step1 .\n next\n show \\: \"\\ ?trn1\" unfolding \\_def2[OF step1] a1 ou1 by simp\n show \"consume ?trn1 vl1 vll1\"\n using \\ unfolding vl1 consume_def v1 a1 by auto\n next\n show \"\\ \\ ?trn1\" using uid unfolding a1 by auto\n next\n have \"eqButPID s1 s1'\" using Uact_uPaperC_step_eqButPID[OF _ step1] a1 by auto\n hence ss1': \"eqButPID s s1'\" using eqButPID_trans ss1 by blast\n show \"?\\ s vl s1' vll1\" using PID op ss1' lvl lvl1 map vlvl1 cor1\n unfolding \\1_def vl1 v1 pPID1' by auto\n qed\n thus ?thesis by simp\n next\n case (PValS aid1 pst1) note v1 = PValS\n have pPID1: \"post s1 PID = pst1\" using cor1 unfolding vl1 v1 by auto\n then obtain v vll where vl: \"vl = v # vll\"\n using map unfolding vl1 v1 by (cases vl) auto\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\"\n (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain f: \"f ?trn = v\" and vl': \"vl' = vll\"\n using c unfolding vl consume_def \\_def2 by auto\n show ?thesis\n proof(cases v)\n case (PVal pst) note v = PVal\n have vll: \"vll \\ []\" using map unfolding vl1 v1 vl v by auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n have a: \"a = Uact (uPost uid p PID pst)\"\n using f_eq_PVal[OF step \\ f[unfolded v]] unfolding uid p .\n have \"eqButPID s s'\" using Uact_uPaperC_step_eqButPID[OF a step] by auto\n hence s's1: \"eqButPID s' s1\" using eqButPID_sym eqButPID_trans ss1 by blast\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have ?ignore proof\n show \\: \"\\ \\ ?trn\" using step_open_\\_f_PVal_\\[OF rs step PID op \\ f[unfolded v]] .\n show \"?\\ s' vl' s1 vl1\"\n using lvl1 lvl PID' map s's1 op' vll cor1 unfolding \\1_def vl1 vl vl' v\n by auto\n qed\n thus ?thesis by simp\n next\n case (PValS aid pst) note v = PValS\n define uid where uid: \"uid \\ admin s\" define p where p: \"p \\ pass s uid\"\n have a: \"a = COMact (comSendPost (admin s) p aid PID)\"\n using f_eq_PValS[OF step \\ f[unfolded v]] unfolding uid p .\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have aid1: \"aid1 = aid\" using map unfolding vl1 v1 vl v by simp\n have uid1: \"uid = admin s1\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have pPID1': \"post s1' PID = pst1\" using pPID1 step1 unfolding a\n by (auto simp: com_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID adm unfolding open_def by auto\n have op1': \"\\ open s1'\" using step1 op1 unfolding a open_def\n by (auto simp: u_defs com_defs)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ ?trn1\" using eqButPID_step_\\_imp[OF ss1 step step1 \\] .\n have ou1: \"ou1 =\n O_sendPost (aid, clientPass s1 aid, PID, post s1 PID, owner s1 PID, vis s1 PID)\"\n using \\1 step1 adm1 PID1 unfolding a by (cases ou1, auto simp: com_defs)\n have f1: \"f ?trn1 = v1\" using \\1 unfolding \\_def2[OF step1] v1 a ou1 aid1 pPID1 by auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vll1\" using \\1 unfolding consume_def vl1 f1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n show \"?\\ s' vl' s1' vll1\"\n proof(cases \"vll = []\")\n case True note vll = True\n hence \"filter isPValS vll1 = []\" using map lvl lvl1 unfolding vl vl1 v v1 by simp\n hence lvl1: \"list_all isPVal vll1\"\n using filter_list_all_isPVal_isOVal lvl1 unfolding vl1 v1 by auto\n hence \"\\11 s' vl' s1' vll1\" using s's1' op1' op' PID' lvl lvl1 map cor1 pPID1 pPID1'\n unfolding \\11_def vl vl' vl1 v v1 vll by auto\n thus ?thesis by auto\n next\n case False note vll = False\n hence \"\\1 s' vl' s1' vll1\" using s's1' op1' op' PID' lvl lvl1 map cor1 pPID1 pPID1'\n unfolding \\1_def vl vl' vl1 v v1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis using vl by simp\n qed(insert lvl vl, auto)\n next\n case False note \\ = False\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ \\ ?trn1\" using \\ ss1 by (simp add: eqButPID_step_\\ step step1)\n have pPID1': \"post s1' PID = pst1\" using PID1 pPID1 step1 \\1 (* unfolding \\_def2[OF step1] *)\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by (fastforce simp: u_defs)\n subgoal by (fastforce simp: u_defs)\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\"\n using PID step \\ op unfolding \\_def2[OF step] by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have \"\\1 s' vl' s1' vl1\" using s's1' PID' pPID1 pPID1' lvl lvl1 map cor1 op'\n unfolding \\1_def vl vl' by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed(insert lvl1 vl1, auto)\nnext\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ uid p pstt. a = Uact (uPost uid p PID pstt) \\ ou = outOK\")\n case True then obtain uid p pstt where\n a: \"a = Uact (uPost uid p PID pstt)\" and ou: \"ou = outOK\" by auto\n hence \\: \"\\ ?trn\" unfolding \\_def2[OF step] by auto\n then obtain v where vl: \"vl = v # vl'\" and f: \"f ?trn = v\"\n using c unfolding consume_def \\_def2 by (cases vl) auto\n obtain pst where v: \"v = PVal pst\" using map lvl unfolding vl vl1 by (cases v) auto\n have pstt: \"pstt = pst\" using f unfolding a v by auto\n have uid: \"uid \\ UIDs\" using step op PID unfolding a ou open_def by (auto simp: u_defs)\n have \"eqButPID s s'\" using Uact_uPaperC_step_eqButPID[OF a step] by auto\n hence s's1: \"eqButPID s' s1\" using eqButPID_sym eqButPID_trans ss1 by blast\n have op': \"\\ open s'\" using step PID' op unfolding a ou open_def by (auto simp: u_defs)\n have ?ignore proof\n show \"\\ \\ ?trn\" unfolding a using uid by auto\n next\n show \"?\\ s' vl' s1 vl1\" using PID' s's1 op' lvl map\n unfolding \\1_def vl1 vl by auto\n qed\n thus ?thesis by simp\n next\n case False note a = False\n {assume \\: \"\\ ?trn\"\n then obtain v vl' where vl: \"vl = v # vl'\" and f: \"f ?trn = v\"\n using c unfolding consume_def by (cases vl) auto\n obtain pst where v: \"v = PVal pst\" using map lvl unfolding vl vl1 by (cases v) auto\n have False using f f_eq_PVal[OF step \\, of pst] a \\ v by auto\n }\n hence \\: \"\\ \\ ?trn\" by auto\n have \\1: \"\\ \\ ?trn1\" by (metis \\ eqButPID_step_\\ step ss1 step1)\n have op': \"\\ open s'\" using a op \\ unfolding \\_def2[OF step] by auto\n have vl': \"vl' = vl\" using c \\ unfolding consume_def by auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n have op1': \"\\ open s1'\" using op' eqButPID_open[OF s's1'] by simp\n have \"\\ uid p pst. e_updatePost s1 uid p PID pst \\ e_updatePost s uid p PID pst\"\n using eqButPID_stateSelectors[OF ss1] unfolding u_defs by auto\n hence ou1: \"\\ uid p pst. a = Uact (uPost uid p PID pst) \\ ou1 = ou\"\n using step step1 by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n show \"?\\ s' vl' s1' vl1\" using s's1' op' PID' lvl map\n unfolding \\1_def vl' vl1 by auto\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\11: \"unwind_cont \\11 {\\11}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\11 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\11 s vl s1 vl1\"\n hence vl: \"vl = []\" and lvl1: \"list_all isPVal vl1\"\n and rs: \"reach s\" and ss1: \"eqButPID s s1\" and op: \"\\ open s\" and PID: \"PID \\\\ postIDs s\"\n and cor1: \"corrFrom (post s1 PID) vl1\"\n using reachNT_reach unfolding \\11_def by auto\n have PID1: \"PID \\\\ postIDs s1\" using eqButPID_stateSelectors[OF ss1] PID by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n hence own1: \"owner s1 PID \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n hence adm1: \"admin s1 \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have op1: \"\\ open s1\" using op ss1 eqButPID_open by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vll1) note vl1 = Cons\n then obtain pst1 where v1: \"v1 = PVal pst1\" using lvl1 unfolding vl1 by (cases v1) auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n define a1 where a1: \"a1 \\ Uact (uPost uid p PID pst1)\"\n have uid1: \"uid = owner s1 PID\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a1 = (ou1, s1')\" by(cases \"step s1 a1\") auto\n have ou1: \"ou1 = outOK\" using step1 PID1 own1 unfolding a1 uid1 p1 by (auto simp: u_defs)\n have op1': \"\\ open s1'\" using step1 op1 unfolding a1 ou1 open_def by (auto simp: u_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID own unfolding open_def by auto\n have pPID1': \"post s1' PID = pst1\" using step1 unfolding a1 ou1 by (auto simp: u_defs)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have ?iact proof\n show \"step s1 a1 = (ou1, s1')\" using step1 .\n next\n show \\: \"\\ ?trn1\" unfolding \\_def2[OF step1] a1 ou1 by simp\n show \"consume ?trn1 vl1 vll1\"\n using \\ unfolding vl1 consume_def v1 a1 by auto\n next\n show \"\\ \\ ?trn1\" using uid unfolding a1 by auto\n next\n have \"eqButPID s1 s1'\" using Uact_uPaperC_step_eqButPID[OF _ step1] a1 by auto\n hence ss1': \"eqButPID s s1'\" using eqButPID_trans ss1 by blast\n show \"?\\ s vl s1' vll1\"\n using PID op ss1' lvl1 cor1 unfolding \\11_def vl1 v1 vl pPID1' by auto\n qed\n thus ?thesis by simp\n next\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\: \"\\ \\ ?trn\" using c unfolding consume_def vl by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\"\n (is \"?match \\ ?ignore\")\n proof-\n have vl': \"vl' = vl\" using c unfolding vl consume_def by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ \\ ?trn1\" using \\ ss1 by (simp add: eqButPID_step_\\ step step1)\n have pPID1': \"post s1' PID = post s1 PID\" using PID1 step1 \\1\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have \"?\\ s' vl' s1' vl1\" using s's1' PID' pPID1' lvl1 cor1 op'\n unfolding \\11_def vl vl' by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\31: \"unwind_cont \\31 {\\31,\\32}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\31 s vl s1 vl1 \\ \\32 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\31 s vl s1 vl1\"\n then obtain ul ul1 sul vll vll1 where\n lul: \"list_all (Not \\ isOVal) ul\" and lul1: \"list_all (Not \\ isOVal) ul1\"\n and map: \"map tgtAPI (filter isPValS ul) = map tgtAPI (filter isPValS ul1)\"\n and rs: \"reach s\" and ss1: \"eqButPID s s1\" and op: \"\\ open s\" and PID: \"PID \\\\ postIDs s\"\n and cor1: \"corrFrom (post s1 PID) vl1\"\n and ful: \"ul \\ []\" and ful1: \"ul1 \\ []\"\n and lastul: \"isPVal (last ul)\" and ulul1: \"last ul = last ul1\"\n and lsul: \"list_all isPValS sul\"\n and vl: \"vl = ul @ sul @ OVal True # vll\"\n and vl1: \"vl1 = ul1 @ sul @ OVal True # vll1\"\n and BO: \"BO vll vll1\"\n using reachNT_reach unfolding \\31_def by auto\n have ulNE: \"ul \\ []\" and ul1NE: \"ul1 \\ []\" using ful ful1 by auto\n have PID1: \"PID \\\\ postIDs s1\" using eqButPID_stateSelectors[OF ss1] PID by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n hence own1: \"owner s1 PID \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n hence adm1: \"admin s1 \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n have op1: \"\\ open s1\" using op ss1 eqButPID_open by auto\n obtain v1 ull1 where ul1: \"ul1 = v1 # ull1\" using ful1 by (cases ul1) auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases v1)\n case (PVal pst1) note v1 = PVal\n show ?thesis proof(cases \"list_ex isPVal ull1\")\n case True note lull1 = True\n hence full1: \"filter isPVal ull1 \\ []\" by (induct ull1) auto\n hence ull1NE: \"ull1 \\ []\" by auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n define a1 where a1: \"a1 \\ Uact (uPost uid p PID pst1)\"\n have uid1: \"uid = owner s1 PID\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a1 = (ou1, s1')\" by(cases \"step s1 a1\") auto\n have ou1: \"ou1 = outOK\" using step1 PID1 own1 unfolding a1 uid1 p1 by (auto simp: u_defs)\n have op1': \"\\ open s1'\" using step1 op1 unfolding a1 ou1 open_def by (auto simp: u_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID own unfolding open_def by auto\n have pPID1': \"post s1' PID = pst1\" using step1 unfolding a1 ou1 by (auto simp: u_defs)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n let ?vl1' = \"ull1 @ sul @ OVal True # vll1\"\n have ?iact proof\n show \"step s1 a1 = (ou1, s1')\" using step1 .\n next\n show \\: \"\\ ?trn1\" unfolding \\_def2[OF step1] a1 ou1 by simp\n show \"consume ?trn1 vl1 ?vl1'\"\n using \\ unfolding vl1 ul1 consume_def v1 a1 by simp\n next\n show \"\\ \\ ?trn1\" using uid unfolding a1 by auto\n next\n have \"eqButPID s1 s1'\" using Uact_uPaperC_step_eqButPID[OF _ step1] a1 by auto\n hence ss1': \"eqButPID s s1'\" using eqButPID_trans ss1 by blast\n have \"\\31 s vl s1' ?vl1'\"\n using PID op ss1' lul lul1 map ulul1 cor1 BO ull1NE ful ful1 full1 lastul ulul1 lsul\n unfolding \\31_def vl vl1 ul1 v1 pPID1' apply auto\n apply(rule exI[of _ \"ul\"]) apply(rule exI[of _ \"ull1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s vl s1' ?vl1'\" by auto\n qed\n thus ?thesis by simp\n next\n case False note lull1 = False\n hence ull1: \"ull1 = []\" using lastul unfolding ulul1 ul1 v1 by simp(meson Bex_set last_in_set)\n hence ul1: \"ul1 = [PVal pst1]\" unfolding ul1 v1 by simp\n obtain ulll where ul_ulll: \"ul = ulll ## PVal pst1\" using lastul ulul1 ulNE unfolding ul1 ull1 v1\n by (cases ul rule: rev_cases) auto\n hence ulNE: \"ul \\ []\" by simp\n (* then obtain v ul' where ul: \"ul = v # ul'\" by (cases ul) auto *)\n have \"filter isPValS ulll = []\" using map unfolding ul_ulll ul1 v1 ull1 by simp\n hence lull: \"list_all isPVal ulll\" using lul filter_list_all_isPVal_isOVal\n unfolding ul_ulll by auto\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n obtain ul' where cc: \"consume ?trn ul ul'\" and\n vl': \"vl' = ul' @ sul @ OVal True # vll\" using c ulNE unfolding consume_def vl\n by (cases \"\\ ?trn\") auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\"\n (is \"?match \\ ?ignore\")\n proof(cases ulll)\n case Nil\n hence ul: \"ul = [PVal pst1]\" unfolding ul_ulll by simp\n have ?match proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain f: \"f ?trn = PVal pst1\" and ul': \"ul' = []\"\n using cc unfolding ul consume_def \\_def2 by auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n have a: \"a = Uact (uPost uid p PID pst1)\"\n using f_eq_PVal[OF step \\ f] unfolding uid p .\n have uid1: \"uid = owner s1 PID\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ ?trn1\" using eqButPID_step_\\_imp[OF ss1 step step1 \\] .\n have ou1: \"ou1 = outOK\"\n using \\1 step1 PID1 unfolding a by (cases ou1, auto simp: com_defs)\n have pPID': \"post s' PID = pst1\" using step \\ unfolding a by (auto simp: u_defs)\n have pPID1': \"post s1' PID = pst1\" using step1 \\1 unfolding a by (auto simp: u_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID own unfolding open_def by auto\n have op1': \"\\ open s1'\" using step1 op1 unfolding a open_def\n by (auto simp: u_defs com_defs)\n have f1: \"f ?trn1 = PVal pst1\" using \\1 unfolding \\_def2[OF step1] v1 a ou1 by auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have ou: \"ou = outOK\" using \\ op op' unfolding \\_def2[OF step] a by auto\n let ?vl' = \"sul @ OVal True # vll\"\n let ?vl1' = \"sul @ OVal True # vll1\"\n show ?thesis proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 ?vl1'\"\n using \\1 unfolding consume_def ul1 f1 vl1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n thus \"g ?trn = g ?trn1\" using ou ou1 by (cases a) auto\n next\n have s': \"s' = s1'\" using eqButPID_step_eq[OF ss1 a ou step step1] .\n have corr1: \"corrFrom (post s1' PID) ?vl1'\"\n using cor1 unfolding vl1 ul1 v1 pPID1' by auto\n have \"\\32 s' vl' s1' ?vl1'\"\n using PID' op1 op' s's1' lul lul1 map ulul1 cor1 BO ful ful1 lastul ulul1 lsul corr1\n unfolding \\32_def vl vl1 v1 vl' ul' ul ul1 s' apply simp\n apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1' ?vl1'\" by simp\n qed\n next\n case False note \\ = False\n hence ul': \"ul' = ul\" using cc unfolding consume_def by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ \\ ?trn1\" using \\ ss1 by (simp add: eqButPID_step_\\ step step1)\n have pPID1': \"post s1' PID = post s1 PID\" using PID1 step1 \\1\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have \"\\31 s' vl' s1' vl1\"\n using PID' pPID1' op' s's1' lul lul1 map ulul1 cor1\n BO ful ful1 lastul ulul1 lsul cor1\n unfolding \\31_def vl vl1 v1 vl' ul' apply simp\n apply(rule exI[of _ \"ul\"]) apply(rule exI[of _ \"ul1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n next\n case (Cons v ullll) note ulll = Cons\n then obtain pst where v: \"v = PVal pst\" using lull ul_ulll ulll lul by (cases v) auto\n define ull where ull: \"ull \\ ullll ## PVal pst1\"\n have ul: \"ul = v # ull\" unfolding ul_ulll ull ulll by simp\n show ?thesis proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain f: \"f ?trn = v\" and ul': \"ul' = ull\"\n using cc unfolding ul consume_def \\_def2 by auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n have a: \"a = Uact (uPost uid p PID pst)\"\n using f_eq_PVal[OF step \\ f[unfolded v]] unfolding uid p .\n have \"eqButPID s s'\" using Uact_uPaperC_step_eqButPID[OF a step] by auto\n hence s's1: \"eqButPID s' s1\" using eqButPID_sym eqButPID_trans ss1 by blast\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have ?ignore proof\n show \\: \"\\ \\ ?trn\" using step_open_\\_f_PVal_\\[OF rs step PID op \\ f[unfolded v]] .\n have \"\\31 s' vl' s1 vl1\"\n using PID' op' s's1 lul lul1 map ulul1 cor1 BO ful ful1 lastul ulul1 lsul ull\n unfolding \\31_def vl vl1 v1 vl' ul' ul v apply simp\n apply(rule exI[of _ \"ull\"]) apply(rule exI[of _ \"ul1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1 vl1\" by auto\n qed\n thus ?thesis by simp\n next\n case False note \\ = False\n hence ul': \"ul' = ul\" using cc unfolding consume_def by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ \\ ?trn1\" using \\ ss1 by (simp add: eqButPID_step_\\ step step1)\n have pPID1': \"post s1' PID = post s1 PID\" using PID1 step1 \\1\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have \"\\31 s' vl' s1' vl1\"\n using PID' pPID1' op' s's1' lul lul1 map ulul1 cor1\n BO ful ful1 lastul ulul1 lsul cor1\n unfolding \\31_def vl vl1 v1 vl' ul' apply simp\n apply(rule exI[of _ \"ul\"]) apply(rule exI[of _ \"ul1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n qed\n thus ?thesis using vl by simp\n qed\n next\n case (PValS aid1 pst1) note v1 = PValS\n have pPID1: \"post s1 PID = pst1\" using cor1 unfolding vl1 ul1 v1 by auto\n then obtain v ull where ul: \"ul = v # ull\"\n using map unfolding ul1 v1 by (cases ul) auto\n let ?vl1' = \"ull1 @ sul @ OVal True # vll1\"\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n obtain ul' where cc: \"consume ?trn ul ul'\" and\n vl': \"vl' = ul' @ sul @ OVal True # vll\" using c ul unfolding consume_def vl\n by (cases \"\\ ?trn\") auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\"\n (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain f: \"f ?trn = v\" and ul': \"ul' = ull\"\n using cc unfolding ul consume_def \\_def2 by auto\n show ?thesis\n proof(cases v)\n case (PVal pst) note v = PVal\n have full: \"ull \\ []\" using map unfolding ul1 v1 ul v by auto\n define uid where uid: \"uid \\ owner s PID\" define p where p: \"p \\ pass s uid\"\n have a: \"a = Uact (uPost uid p PID pst)\"\n using f_eq_PVal[OF step \\ f[unfolded v]] unfolding uid p .\n have \"eqButPID s s'\" using Uact_uPaperC_step_eqButPID[OF a step] by auto\n hence s's1: \"eqButPID s' s1\" using eqButPID_sym eqButPID_trans ss1 by blast\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n (* have \"list_ex isPVal ull1\" using lastul not_list_ex_filter\n using ful1 not_list_ex_filter ul1 v1 unfolding ulul1 by auto\n hence lull: \"list_ex isPVal ull\" using lastul ulul1 ull unfolding ul ul1 v v1\n by (metis filter_empty_conv last_ConsR last_in_set not_list_ex_filter)\n hence full: \"filter isPVal ull \\ []\" by (induct ull) auto *)\n have ?ignore proof\n show \\: \"\\ \\ ?trn\" using step_open_\\_f_PVal_\\[OF rs step PID op \\ f[unfolded v]] .\n have \"\\31 s' vl' s1 vl1\"\n using PID' op' s's1 lul lul1 map ulul1 cor1 BO ful ful1 lastul ulul1 lsul full\n unfolding \\31_def vl vl1 v1 vl' ul' ul v apply simp\n apply(rule exI[of _ \"ull\"]) apply(rule exI[of _ \"ul1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1 vl1\" by auto\n qed\n thus ?thesis by simp\n next\n case (PValS aid pst) note v = PValS\n define uid where uid: \"uid \\ admin s\" define p where p: \"p \\ pass s uid\"\n have a: \"a = COMact (comSendPost (admin s) p aid PID)\"\n using f_eq_PValS[OF step \\ f[unfolded v]] unfolding uid p .\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have aid1: \"aid1 = aid\" using map unfolding ul1 v1 ul v by simp\n have uid1: \"uid = admin s1\" and p1: \"p = pass s1 uid\" unfolding uid p\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have pPID1': \"post s1' PID = pst1\" using pPID1 step1 unfolding a\n by (auto simp: com_defs)\n have uid: \"uid \\ UIDs\" unfolding uid using op PID adm unfolding open_def by auto\n have op1': \"\\ open s1'\" using step1 op1 unfolding a open_def\n by (auto simp: u_defs com_defs)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ ?trn1\" using eqButPID_step_\\_imp[OF ss1 step step1 \\] .\n have ou1: \"ou1 =\n O_sendPost (aid, clientPass s1 aid, PID, post s1 PID, owner s1 PID, vis s1 PID)\"\n using \\1 step1 adm1 PID1 unfolding a by (cases ou1, auto simp: com_defs)\n have f1: \"f ?trn1 = v1\" using \\1 unfolding \\_def2[OF step1] v1 a ou1 aid1 pPID1 by auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 ?vl1'\" using \\1 unfolding consume_def ul1 f1 vl1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have corr1: \"corrFrom (post s1' PID) ?vl1'\"\n using cor1 unfolding vl1 ul1 v1 pPID1' by auto\n have ullull1: \"ull1 \\ [] \\ ull \\ []\" using ul ul1 lastul ulul1 unfolding v v1\n by fastforce\n have \"\\31 s' vl' s1' ?vl1'\"\n using PID' op' s's1' lul lul1 map ulul1 cor1 BO ful ful1 lastul ulul1 lsul corr1 ullull1\n unfolding \\31_def vl vl1 v1 vl' ul' ul ul1 v apply auto\n apply(rule exI[of _ \"ull\"]) apply(rule exI[of _ \"ull1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1' ?vl1'\" by simp\n qed\n thus ?thesis using ul by simp\n next\n qed(insert lul ul, auto)\n next\n case False note \\ = False\n hence ul': \"ul' = ul\" using cc unfolding consume_def by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by(cases \"step s1 a\") auto\n have s's1': \"eqButPID s' s1'\" using eqButPID_step[OF ss1 step step1] .\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ \\ ?trn1\" using \\ ss1 by (simp add: eqButPID_step_\\ step step1)\n have pPID1': \"post s1' PID = pst1\" using PID1 pPID1 step1 \\1\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid.\n a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 op rsT rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have \"\\31 s' vl' s1' vl1\"\n using PID' pPID1 pPID1' op' s's1' lul lul1 map ulul1 cor1\n BO ful ful1 lastul ulul1 lsul cor1\n unfolding \\31_def vl vl1 v1 vl' ul' apply simp\n apply(rule exI[of _ \"ul\"]) apply(rule exI[of _ \"ul1\"]) apply(rule exI[of _ sul])\n apply(rule exI[of _ \"vll\"]) apply(rule exI[of _ \"vll1\"]) by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by simp\n qed(insert lul1 ul1, auto)\nqed\n\nlemma unwind_cont_\\32: \"unwind_cont \\32 {\\2,\\32,\\4}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\32 s vl s1 vl1 \\ \\4 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\32 s vl s1 vl1\"\n then obtain ul vll vll1 where\n lul: \"list_all isPValS ul\"\n and rs: \"reach s\" and ss1: \"s1 = s\" and op: \"\\ open s\" and PID: \"PID \\\\ postIDs s\"\n and cor1: \"corrFrom (post s1 PID) vl1\"\n and vl: \"vl = ul @ OVal True # vll\"\n and vl1: \"vl1 = ul @ OVal True # vll1\"\n and BO: \"BO vll vll1\"\n using reachNT_reach unfolding \\32_def by blast\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\"\n (is \"?match \\ ?ignore\")\n proof-\n have ?match proof(cases \"ul = []\")\n case False note ul = False\n then obtain ul' where cc: \"consume ?trn ul ul'\"\n and vl': \"vl' = ul' @ OVal True # vll\" using vl c unfolding consume_def\n by (cases \"\\ ?trn\") auto\n let ?vl1' = \"ul' @ OVal True # vll1\"\n show ?thesis proof\n show \"validTrans ?trn1\" using step unfolding ss1 by simp\n next\n show \"consume ?trn1 vl1 ?vl1'\" using cc ul unfolding vl1 consume_def ss1\n by (cases \"\\ ?trn\") auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\32 s' vl' s' ?vl1'\"\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain v where f: \"f ?trn = v\" and ul: \"ul = v # ul'\"\n using cc unfolding consume_def by (cases ul) auto\n define uid where uid: \"uid \\ admin s\" define p where p: \"p \\ pass s uid\"\n obtain aid pst where v: \"v = PValS aid pst\" using lul unfolding ul by (cases v) auto\n have a: \"a = COMact (comSendPost (admin s) p aid PID)\"\n using f_eq_PValS[OF step \\ f[unfolded v]] unfolding uid p .\n have op': \"\\ open s'\" using uPost_comSendPost_open_eq[OF step] a op by auto\n have pPID': \"post s' PID = post s PID\"\n using step unfolding a by (auto simp: com_defs)\n show ?thesis using PID' pPID' op' cor1 BO lul\n unfolding \\32_def vl1 ul ss1 v vl' by auto\n next\n case False note \\ = False\n hence ul: \"ul = ul'\" using cc unfolding consume_def by (cases ul) auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n show ?thesis using PID' pPID' op' cor1 BO lul\n unfolding \\32_def vl1 ul ss1 vl' by auto\n qed\n thus \"?\\ s' vl' s' ?vl1'\" by simp\n qed\n next\n case True note ul = True\n show ?thesis proof(cases \"\\ ?trn\")\n case True note \\ = True\n hence f: \"f ?trn = OVal True\" and vl': \"vl' = vll\"\n using vl c unfolding consume_def ul by auto\n have op': \"open s'\" using f_eq_OVal[OF step \\ f] op by simp\n show ?thesis proof\n show \"validTrans ?trn1\" using step unfolding ss1 by simp\n next\n show \"consume ?trn1 vl1 vll1\" using ul \\ c\n unfolding vl1 vl' vl ss1 consume_def by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op op' f\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n show \"?\\ s' vl' s' vll1\" using BO proof cases\n case BO_PVal\n hence \"\\2 s' vl' s' vll1\" using PID' pPID' op' cor1 BO lul\n unfolding \\2_def vl1 ul ss1 vl' by auto\n thus ?thesis by simp\n next\n case BO_BC\n hence \"\\4 s' vl' s' vll1\" using PID' pPID' op' cor1 BO lul\n unfolding \\4_def vl1 ul ss1 vl' by auto\n thus ?thesis by simp\n qed\n qed\n next\n case False note \\ = False\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"\\ open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n show ?thesis proof\n show \"validTrans ?trn1\" using step unfolding ss1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" using ul \\ unfolding vl1 consume_def ss1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\32 s' vl' s' vl1\" using PID' pPID' op' cor1 BO lul\n unfolding \\32_def vl vl1 ul ss1 vl' apply simp\n apply(rule exI[of _ \"[]\"])\n apply(rule exI[of _ vll]) apply(rule exI[of _ vll1]) by auto\n thus \"?\\ s' vl' s' vl1\" by simp\n qed\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by simp\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\2 s vl s1 vl1\"\n hence vlvl1: \"vl = vl1\"\n and rs: \"reach s\" and ss1: \"s1 = s\" and op: \"open s\" and PID: \"PID \\\\ postIDs s\"\n and cor1: \"corrFrom (post s1 PID) vl1\" and lvl: \"list_all (Not \\ isOVal) vl\"\n using reachNT_reach unfolding \\2_def by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain v where vl: \"vl = v # vl'\" and f: \"f ?trn = v\"\n using c unfolding consume_def \\_def2 by(cases vl) auto\n show ?thesis proof(cases v)\n case (PVal pst) note v = PVal\n have a: \"a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst)\"\n using f_eq_PVal[OF step \\ f[unfolded v]] .\n have ou: \"ou = outOK\" using step own PID unfolding a by (auto simp: u_defs)\n have op': \"open s'\" using step op PID PID' \\\n unfolding open_def a by (auto simp: u_defs)\n have pPID': \"post s' PID = pst\"\n using step \\ PID op f op' unfolding a by(auto simp: u_defs)\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl'\" using \\ vlvl1 unfolding ss1 consume_def vl f by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl'\" using cor1 PID' pPID' op' lvl vlvl1 ss1\n unfolding \\2_def vl v by auto\n qed\n next\n case (PValS aid pid) note v = PValS\n have a: \"a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID)\"\n using f_eq_PValS[OF step \\ f[unfolded v]] .\n have op': \"open s'\" using step op PID PID' \\\n unfolding open_def a by (auto simp: com_defs)\n have ou: \"ou \\ outErr\" using \\ op op' unfolding \\_def2[OF step] unfolding a by auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op f op' unfolding a by(auto simp: com_defs)\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl'\" using \\ vlvl1 unfolding ss1 consume_def vl f by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl'\" using cor1 PID' pPID' op' lvl vlvl1 ss1\n unfolding \\2_def vl v by auto\n qed\n qed(insert vl lvl, auto)\n next\n case False note \\ = False\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl\" using \\ vlvl1 unfolding ss1 consume_def vl' by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl\" using cor1 PID' op' lvl vlvl1 pPID'\n unfolding \\2_def vl' ss1 by auto\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\4: \"unwind_cont \\4 {\\1,\\31,\\32,\\4}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\31 s vl s1 vl1 \\ \\32 s vl s1 vl1 \\ \\4 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\4 s vl s1 vl1\"\n then obtain ul vll vll1 where vl: \"vl = ul @ OVal False # vll\" and vl1: \"vl1 = ul @ OVal False # vll1\"\n and rs: \"reach s\" and ss1: \"s1 = s\" and op: \"open s\" and PID: \"PID \\\\ postIDs s\"\n and cor1: \"corrFrom (post s1 PID) vl1\" and lul: \"list_all (Not \\ isOVal) ul\"\n and BC: \"BC vll vll1\"\n using reachNT_reach unfolding \\4_def by blast\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n have adm: \"admin s \\ set (userIDs s)\" using reach_admin_userIDs[OF rs own] .\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ postIDs s'\" using reach_postIDs_persist[OF PID step] .\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain v where vl_vl': \"vl = v # vl'\" and f: \"f ?trn = v\"\n using c unfolding consume_def \\_def2 by(cases vl) auto\n show ?thesis proof(cases \"ul = []\")\n case False note ul = False\n then obtain ul' where ul: \"ul = v # ul'\" and vl': \"vl' = ul' @ OVal False # vll\"\n using c \\ f unfolding consume_def vl by (cases ul) auto\n let ?vl1' = \"ul' @ OVal False # vll1\"\n show ?thesis proof(cases v)\n case (PVal pst) note v = PVal\n have a: \"a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst)\"\n using f_eq_PVal[OF step \\ f[unfolded v]] .\n have ou: \"ou = outOK\" using step own PID unfolding a by (auto simp: u_defs)\n have op': \"open s'\" using step op PID PID' \\\n unfolding open_def a by (auto simp: u_defs)\n have pPID': \"post s' PID = pst\"\n using step \\ PID op f op' unfolding a by(auto simp: u_defs)\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 ?vl1'\" using \\\n unfolding ss1 consume_def vl f ul vl1 vl' by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\4 s' vl' s' ?vl1'\" using cor1 PID' pPID' op' vl1 ss1 lul BC\n unfolding \\4_def vl v ul vl' apply simp\n apply(rule exI[of _ ul'])\n apply(rule exI[of _ vll]) apply(rule exI[of _ vll1])\n by auto\n thus \"?\\ s' vl' s' ?vl1'\" by simp\n qed\n next\n case (PValS aid pid) note v = PValS\n have a: \"a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID)\"\n using f_eq_PValS[OF step \\ f[unfolded v]] .\n have op': \"open s'\" using step op PID PID' \\\n unfolding open_def a by (auto simp: com_defs)\n have ou: \"ou \\ outErr\" using \\ op op' unfolding \\_def2[OF step] unfolding a by auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op f op' unfolding a by(auto simp: com_defs)\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 ?vl1'\" using \\\n unfolding ss1 consume_def vl f ul vl1 vl' by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\4 s' vl' s' ?vl1'\" using cor1 PID' pPID' op' vl1 ss1 lul BC\n unfolding \\4_def vl v ul vl' by auto\n thus \"?\\ s' vl' s' ?vl1'\" by simp\n qed\n qed(insert vl lul ul, auto)\n next\n case True note ul = True\n hence f: \"f ?trn = OVal False\" and vl': \"vl' = vll\"\n using vl c f \\ unfolding consume_def ul by auto\n have op': \"\\ open s'\" using f_eq_OVal[OF step \\ f] op by simp\n show ?thesis proof\n show \"validTrans ?trn1\" using step unfolding ss1 by simp\n next\n show \"consume ?trn1 vl1 vll1\" using ul \\ c\n unfolding vl1 vl' vl ss1 consume_def by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" note \\ = this\n thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op op' f\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n show \"?\\ s' vl' s' vll1\" using BC proof cases\n case BC_PVal\n hence \"\\1 s' vl' s' vll1\" using PID' pPID' op' cor1 BC lul\n unfolding \\1_def vl1 ul ss1 vl' by auto\n thus ?thesis by simp\n next\n case (BC_BO Vll Vll1 Ul Ul1 Sul)\n show ?thesis proof(cases \"Ul \\ [] \\ Ul1 \\ []\")\n case True\n hence \"\\31 s' vl' s' vll1\" using PID' pPID' op' cor1 BC BC_BO lul\n unfolding \\31_def vl1 ul ss1 vl' apply simp\n apply(rule exI[of _ Ul]) apply(rule exI[of _ Ul1])\n apply(rule exI[of _ Sul])\n apply(rule exI[of _ Vll]) apply(rule exI[of _ Vll1])\n by auto\n thus ?thesis by simp\n next\n case False\n hence 0: \"Ul = []\" \"Ul1 = []\" using BC_BO by auto\n hence \"\\32 s' vl' s' vll1\" using PID' pPID' op' cor1 BC BC_BO lul\n unfolding \\32_def vl1 ul ss1 vl' apply simp\n apply(rule exI[of _ Sul])\n apply(rule exI[of _ Vll]) apply(rule exI[of _ Vll1])\n by auto\n thus ?thesis by simp\n qed\n qed\n qed\n qed\n next\n case False note \\ = False\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n have pPID': \"post s' PID = post s PID\"\n using step \\ PID op\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by fastforce\n subgoal by fastforce\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n have op': \"open s'\" using PID step \\ op unfolding \\_def2[OF step] by auto\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\ unfolding ss1 consume_def vl' vl vl1 by simp\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\4 s' vl' s' vl1\" using cor1 PID' pPID' op' vl1 ss1 lul BC\n unfolding \\4_def vl vl' by auto\n thus \"?\\ s' vl' s' vl1\" by simp\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by simp\n qed\nqed\n\ndefinition Gr where\n\"Gr =\n {\n (\\0, {\\0,\\1,\\2,\\31,\\32,\\4}),\n (\\1, {\\1,\\11}),\n (\\11, {\\11}),\n (\\2, {\\2}),\n (\\31, {\\31,\\32}),\n (\\32, {\\2,\\32,\\4}),\n (\\4, {\\1,\\31,\\32,\\4})\n }\"\n\n\ntheorem secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing\nistate_\\0 unwind_cont_\\0 unwind_cont_\\1 unwind_cont_\\11\nunwind_cont_\\31 unwind_cont_\\32 unwind_cont_\\2 unwind_cont_\\4\nunfolding Gr_def by auto\n\n\n\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Post_Confidentiality/DYNAMIC_Post_ISSUER.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.28661013836855453}} {"text": "(* Title: HOL/Auth/n_german.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german imports n_german_lemma_invs_on_rules n_german_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\ f. f \\ (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\ f ini s. f \\ (invariants N) --> ini \\ {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n fix f ini s\n assume b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n have b4: \"formEval (andList (allInitSpecs N)) s\"\n apply (cut_tac b2 b3, simp) done\n show \"formEval f s\"\n apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\ f r s. f \\ invariants N --> r \\ rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n fix f r s\n assume b1: \"f \\ invariants N\" and b2: \"r \\ rules N\"\n show \"invHoldForRule s f r (invariants N)\"\n apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\ reachableSet {andList (allInitSpecs N)} (rules N)\"\n apply (metis a1) done\nqed\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.28657340276781285}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartialProps.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Properties of Partial Correctness Hoare Logic\\\n\ntheory HoarePartialProps imports HoarePartialDef begin\n\nsubsection \\Soundness\\\n\nlemma hoare_cnvalid:\n assumes hoare: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cnvalidI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ =n\\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cnvalidI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ =n\\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\n:\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume exec: \"\\\\\\Spec r,Normal s\\ =n\\ t\"\n assume P: \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n from exec P\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ =n\\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ =n\\ r\" and exec_c2: \"\\\\\\c2,r\\ =n\\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: execn_Fault_end)\n with valid_c1 ctxt exec_c1 P\n have r: \"r\\Normal ` R \\ Abrupt ` A\"\n by (rule cnvalidD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: execn_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ =n\\ t\"\n by cases auto\n with P True\n show ?thesis\n by - (rule cnvalidD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ =n\\ t\"\n by cases auto\n with P False\n show ?thesis\n by - (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n qed\nnext\n case (While \\ F P b c A n)\n have valid_c: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> (P \\ b) c P,A\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P While b c (P \\ - b),A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\While b c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases \"s \\ b\")\n case True\n {\n fix d::\"('b,'a,'c) com\" fix s t\n assume exec: \"\\\\\\d,s\\ =n\\ t\"\n assume d: \"d=While b c\"\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n from exec d ctxt\n have \"\\s \\ Normal ` P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt`A\"\n proof (induct)\n case (WhileTrue s b' c' n r t)\n have t_notin_F: \"t \\ Fault ` F\" by fact\n have eqs: \"While b' c' = While b c\" by fact\n note valid_c\n moreover have ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n moreover from WhileTrue\n obtain \"\\\\\\c,Normal s\\ =n\\ r\" and\n \"\\\\\\While b c,r\\ =n\\ t\" and\n \"Normal s \\ Normal `(P \\ b)\" by auto\n moreover with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: execn_Fault_end)\n ultimately\n have r: \"r \\ Normal ` P \\ Abrupt ` A\"\n by - (rule cnvalidD,auto)\n from this _ ctxt\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A \"\n proof (cases r)\n case (Normal r')\n with r ctxt eqs t_notin_F\n show ?thesis\n by - (rule WhileTrue.hyps,auto)\n next\n case (Abrupt r')\n have \"\\\\\\While b' c',r\\ =n\\ t\" by fact\n with Abrupt have \"t=r\"\n by (auto dest: execn_Abrupt_end)\n with r Abrupt show ?thesis\n by blast\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n qed auto\n }\n with exec ctxt P t_notin_F\n show ?thesis\n by auto\n next\n case False\n with exec P have \"t=Normal s\"\n by cases auto\n with P False\n show ?thesis\n by auto\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ =n\\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ =n\\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cnvalidD)\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ =n\\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec P g have \"\\\\\\c,Normal s\\ =n\\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cnvalidD)\n qed\nnext\n case (CallRec P p Q A Specs \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have valid_body:\n \"\\(P,p,Q,A) \\ Specs. p \\ dom \\ \\ (\\n. \\,\\ \\ Specs \\n:\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A)\"\n using CallRec.hyps by blast\n show \"\\,\\\\n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n proof -\n {\n fix n\n have \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n \\ \\(P,p,Q,A) \\Specs. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (induct n)\n case 0\n show \"\\(P,p,Q,A) \\Specs. \\\\0:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (fastforce elim!: execn_elim_cases simp add: nvalid_def)\n next\n case (Suc m)\n have hyp: \"\\(P, p, Q, A)\\\\. \\ \\m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n \\ \\(P,p,Q,A) \\Specs. \\\\m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n have \"\\(P, p, Q, A)\\\\. \\ \\Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n hence ctxt_m: \"\\(P, p, Q, A)\\\\. \\ \\m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (fastforce simp add: nvalid_def intro: execn_Suc)\n hence valid_Proc:\n \"\\(P,p,Q,A) \\Specs. \\\\m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (rule hyp)\n let ?\\'= \"\\ \\ Specs\"\n from valid_Proc ctxt_m\n have \"\\(P, p, Q, A)\\?\\'. \\ \\m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by fastforce\n with valid_body\n have valid_body_m:\n \"\\(P,p,Q,A) \\Specs. \\n. \\ \\m:\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A\"\n by (fastforce simp add: cnvalid_def)\n show \"\\(P,p,Q,A) \\Specs. \\ \\Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (clarify)\n fix P p Q A assume p: \"(P,p,Q,A) \\ Specs\"\n show \"\\ \\Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule nvalidI)\n fix s t\n assume exec_call:\n \"\\\\\\Call p,Normal s\\ =Suc m\\ t\"\n assume Pre: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy m'\n assume m: \"Suc m = Suc m'\"\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ =m'\\ t\"\n from Pre valid_body_m exec_body bdy m p t_notin_F\n show ?thesis\n by (fastforce simp add: nvalid_def)\n next\n assume \"\\ p = None\"\n with valid_body p have False by auto\n thus ?thesis ..\n qed\n qed\n qed\n qed\n }\n with p show ?thesis\n by (fastforce simp add: cnvalid_def)\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. (\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P (c s) Q,A)\" by auto\n show \"\\,\\\\n:\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_Fault: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ =n\\ t\"\n from cnvalidD [OF valid_c [rule_format, OF P] ctxt this P t_notin_Fault]\n show ?thesis .\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ =n\\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_Fault: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ Abrupt s'\"\n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ =n\\ t\"\n from cnvalidD [OF valid_c1 ctxt exec_c1 P ]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cnvalidD [OF valid_c2 ctxt _ _ t_notin_Fault] exec_c2\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ t\"\n assume notAbr: \"\\ isAbr t\"\n from cnvalidD [OF valid_c1 ctxt exec_c1 P t_notin_Fault]\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt: \"\\s \\ P. (\\P' Q' A'. \\,\\ \\n:\\<^bsub>/F\\<^esub> P' c Q',A' \\\n s \\ P' \\ Q' \\ Q \\ A' \\ A)\"\n by blast\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt:\"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from P adapt obtain P' Q' A' Z where\n spec: \"\\,\\\\n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n P': \"s \\ P'\" and strengthen: \"Q' \\ Q \\ A' \\ A\"\n by auto\n from spec [rule_format] ctxt exec P' t_notin_F\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (rule cnvalidD)\n with strengthen show ?thesis\n by blast\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n have asm: \"(P, p, Q, A) \\ \\\" by fact\n show \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Call p,Normal s\\ =n\\ t\"\n from asm ctxt have \"\\ \\n:\\<^bsub>/F\\<^esub> P Call p Q,A\" by auto\n moreover\n assume \"s \\ P\" \"t \\ Fault ` F\"\n ultimately\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n using exec\n by (auto simp add: nvalid_def)\n qed\nnext\n case ExFalso thus ?case by iprover\nqed\n\n\n\nsubsection \\Completeness\\\n\nlemma MGT_valid:\n\"\\\\\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validI)\n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\"\n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\\n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n by (cases t) (auto simp add: final_notin_def)\nqed\n\ntext \\The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of \\MGT_lemma\\.\\\nlemma ConseqMGT:\n assumes modif: \"\\Z. \\,\\ \\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\\n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl\nby - (rule conseq [OF modif],blast)\n\n\nlemma Seq_NoFaultStuckD1:\n assumes noabort: \"\\\\\\Seq c1 c2,s\\ \\\\({Stuck} \\ Fault ` F)\"\n shows \"\\\\\\c1,s\\ \\\\({Stuck} \\ Fault ` F)\"\nproof (rule final_notinI)\n fix t\n assume exec_c1: \"\\\\\\c1,s\\ \\ t\"\n show \"t \\ {Stuck} \\ Fault ` F\"\n proof\n assume \"t \\ {Stuck} \\ Fault ` F\"\n moreover\n {\n assume \"t = Stuck\"\n with exec_c1\n have \"\\\\\\Seq c1 c2,s\\ \\ Stuck\"\n by (auto intro: exec_Seq')\n with noabort have False\n by (auto simp add: final_notin_def)\n hence False ..\n }\n moreover\n {\n assume \"t \\ Fault ` F\"\n then obtain f where\n t: \"t=Fault f\" and f: \"f \\ F\"\n by auto\n from t exec_c1\n have \"\\\\\\Seq c1 c2,s\\ \\ Fault f\"\n by (auto intro: exec_Seq')\n with noabort f have False\n by (auto simp add: final_notin_def)\n hence False ..\n }\n ultimately show False by auto\n qed\nqed\n\nlemma Seq_NoFaultStuckD2:\n assumes noabort: \"\\\\\\Seq c1 c2,s\\ \\\\({Stuck} \\ Fault ` F)\"\n shows \"\\t. \\\\\\c1,s\\ \\ t \\ t\\ ({Stuck} \\ Fault ` F) \\\n \\\\\\c2,t\\ \\\\({Stuck} \\ Fault ` F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,{} \\\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT)\n apply (insert valid)\n apply (auto simp add: valid_def intro!: final_notinI)\n done\n\ntext \\Equipped only with the classic consequence rule @{thm \"conseqPrePost\"}\n we can only derive this syntactically more involved version\n of completeness. But semantically it is equivalent to the \"real\" one\n (see below)\\\nlemma MGT_implies_complete':\n assumes MGT: \"\\Z. \\,{}\\\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,{} \\\\<^bsub>/F\\<^esub> {s. s=Z \\ s \\ P} c {t. Z \\ P \\ t \\ Q},{t. Z \\ P \\ t \\ A}\"\n using MGT [rule_format, of Z]\n apply (rule conseqPrePost)\n apply (insert valid)\n apply (fastforce simp add: valid_def final_notin_def)\n apply (fastforce simp add: valid_def)\n apply (fastforce simp add: valid_def)\n done\n\ntext \\Semantic equivalence of both kind of formulations\\\nlemma valid_involved_to_valid:\n assumes valid:\n \"\\Z. \\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ s \\ P} c {t. Z \\ P \\ t \\ Q},{t. Z \\ P \\ t \\ A}\"\n shows \"\\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\n using valid\n apply (simp add: valid_def)\n apply clarsimp\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"Normal x\" in allE)\n apply (erule_tac x=t in allE)\n apply fastforce\n done\n\ntext \\The sophisticated consequence rule allow us to do this\n semantical transformation on the hoare-level, too.\n The magic is, that it allow us to\n choose the instance of @{term Z} under the assumption of an state @{term \"s \\ P\"}\\\nlemma\n assumes deriv:\n \"\\Z. \\,{}\\\\<^bsub>/F\\<^esub> {s. s=Z \\ s \\ P} c {t. Z \\ P \\ t \\ Q},{t. Z \\ P \\ t \\ A}\"\n shows \"\\,{} \\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule ConseqMGT [OF deriv])\n apply auto\n done\n\nlemma valid_to_valid_involved:\n \"\\ \\\\<^bsub>/F\\<^esub> P c Q,A \\\n \\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ s \\ P} c {t. Z \\ P \\ t \\ Q},{t. Z \\ P \\ t \\ A}\"\nby (simp add: valid_def Collect_conv_if)\n\nlemma\n assumes deriv: \"\\,{} \\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,{}\\\\<^bsub>/F\\<^esub> {s. s=Z \\ s \\ P} c {t. Z \\ P \\ t \\ Q},{t. Z \\ P \\ t \\ A}\"\n apply (rule conseqPrePost [OF deriv])\n apply auto\n done\n\nlemma conseq_extract_state_indep_prop:\n assumes state_indep_prop:\"\\s \\ P. R\"\n assumes to_show: \"R \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\n\nlemma MGT_lemma:\n assumes MGT_Calls:\n \"\\p\\dom \\. \\Z. \\,\\ \\\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoarep.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoarep.Basic [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoarep.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2)\n have hyp_c1: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\"\n using Seq.hyps by iprover\n have hyp_c2: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c2\n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\"\n using Seq.hyps by iprover\n from hyp_c1\n have \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n intro: exec.Seq)\n thus \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoarep.Seq )\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\n c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (iprover intro: exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (iprover intro: exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2)\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\"\n using Cond.hyps by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\\b)\n c1\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.CondTrue simp add: final_notin_def)\n moreover\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c2\n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\"\n using Cond.hyps by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub>({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\\-b)\n c2\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.CondFalse simp add: final_notin_def)\n ultimately\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n Cond b c1 c2\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoarep.Cond)\nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u))}\"\n let ?A' = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n While b c\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"?P'\"\n and ?Q'=\"\\Z. ?P' Z \\ - b\" and ?A'=\"?A'\"])\n show \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A' Z)\"\n proof (rule allI, rule hoarep.While)\n fix Z\n from While\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n then show \"\\,\\\\\\<^bsub>/F\\<^esub> (?P' Z \\ b) c (?P' Z),(?A' Z)\"\n proof (rule ConseqMGT)\n fix s\n assume \"s\\ {t. (Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u))}\n \\ b\"\n then obtain\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n s_in_b: \"s\\b\"\n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u))}) \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b show ?C1 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n moreover\n from Z_s_unroll s_t s_in_b\n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover note noabort\n ultimately\n have \"(Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u))\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\"\n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\\n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A' s \\ t\\?A' Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\\n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\"\n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body:\n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A' s \\ t\\?A' Z\" by simp\n qed\n qed\nnext\n case (Call p)\n let ?P = \"{s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n from noStuck_Call have \"\\s \\ ?P. p \\ dom \\\"\n by (fastforce simp add: final_notin_def )\n then show \"\\,\\\\\\<^bsub>/F\\<^esub> ?P (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n proof (rule conseq_extract_state_indep_prop)\n assume p_definied: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^bsub>/F\\<^esub>{s. s=Z \\\n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp:\n \"\\s'. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>{s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^bsub>/F\\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c Z\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp])\n (fastforce simp add: final_notin_def intro: exec.intros)\n show \"\\,\\\\\\<^bsub>/F\\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoarep.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show ?case\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^bsub>/F \\<^esub>(g \\ {s. s = Z \\\n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (- F))})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^bsub>/F\\<^esub>\n (g \\ {s. s=Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoarep.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoarep.Throw]) (blast intro: exec.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\\n \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros simp add: final_notin_def)\n moreover\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub>{s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\\n \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))}\n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros simp add: final_notin_def)\n ultimately\n show \"\\,\\\\\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoarep.Catch)\nqed\n\nlemma MGT_Calls:\n \"\\p\\dom \\. \\Z.\n \\,{}\\\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z\n assume defined: \"p \\ dom \\\"\n have\n \"\\,(\\p\\dom \\. \\Z.\n {({s. s=Z \\\n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\n \\\\<^bsub>/F\\<^esub>{s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n (is \"\\,?\\ \\\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\ p)) (?Post p Z),(?Abr p Z)\")\n proof -\n have MGT_Calls:\n \"\\p\\dom \\. \\Z. \\,?\\ \\\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (intro ballI allI, rule HoarePartialDef.Asm,auto)\n have \"\\Z. \\,?\\\\\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\the (\\ p) ,Normal s\\ \\\\({Stuck} \\ Fault`(-F))}\n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n by (iprover intro: MGT_lemma [OF MGT_Calls])\n thus \"\\,?\\\\\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\ p)) (?Post p Z),(?Abr p Z)\"\n apply (rule ConseqMGT)\n apply (clarify,safe)\n proof -\n assume \"\\\\\\Call p,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with defined show \"\\\\\\the (\\ p),Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def\n intro: exec.intros)\n next\n fix t\n assume \"\\\\\\the (\\ p),Normal Z\\ \\ Normal t\"\n with defined\n show \"\\\\\\Call p,Normal Z\\ \\Normal t\"\n by (auto intro: exec.Call)\n next\n fix t\n assume \"\\\\\\the (\\ p),Normal Z\\ \\ Abrupt t\"\n with defined\n show \"\\\\\\Call p,Normal Z\\ \\Abrupt t\"\n by (auto intro: exec.Call)\n qed\n qed\n }\n then show ?thesis\n apply -\n apply (intro ballI allI)\n apply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\\n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\"and\n Q=\"\\p Z.\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z.\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"] )\n apply simp+\n done\nqed\n\ntheorem hoare_complete: \"\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Calls])\n\nlemma hoare_complete':\n assumes cvalid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoare_complete)\n thus \"\\,\\\\\\<^bsub>/F \\<^esub>P c Q,A\"\n by (rule hoare_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\n\nlemma hoare_strip_\\:\n assumes deriv: \"\\,{}\\\\<^bsub>/F\\<^esub> P p Q,A\"\n assumes F': \"F' \\ -F\"\n shows \"strip F' \\,{}\\\\<^bsub>/F\\<^esub> P p Q,A\"\nproof (rule hoare_complete)\n from hoare_sound [OF deriv] have \"\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n by (simp add: cvalid_def)\n from this F'\n show \"strip F' \\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n by (rule valid_to_valid_strip)\nqed\n\n\nsubsection \\And Now: Some Useful Rules\\\n\nsubsubsection \\Consequence\\\n\n\nlemma LiberalConseq_sound:\nfixes F::\"'f set\"\nassumes cons: \"\\s \\ P. \\(t::('s,'f) xstate). \\P' Q' A'. (\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P' c Q',A') \\\n ((s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A')\n \\ t \\ Normal ` Q \\ Abrupt ` A)\"\nshows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n fix s t\n assume ctxt:\"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from P cons obtain P' Q' A' where\n spec: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n adapt: \"(s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A')\n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (drule (1) bspec)\n apply (erule_tac x=t in allE)\n apply (elim exE conjE)\n apply iprover\n done\n from exec spec ctxt t_notin_F\n have \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (simp add: cnvalid_def nvalid_def)\n with adapt show ?thesis\n by simp\n qed\nqed\n\nlemma LiberalConseq:\nfixes F:: \"'f set\"\nassumes cons: \"\\s \\ P. \\(t::('s,'f) xstate). \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\\n ((s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A')\n \\ t \\ Normal ` Q \\ Abrupt ` A)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_sound)\nusing cons\napply (clarify)\napply (drule (1) bspec)\napply (erule_tac x=t in allE)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply (rule conjI)\napply (blast intro: hoare_cnvalid)\napply assumption\ndone\n\nlemma \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule LiberalConseq)\n apply (rule ballI)\n apply (drule (1) bspec)\n apply clarify\n apply (rule_tac x=P' in exI)\n apply (rule_tac x=Q' in exI)\n apply (rule_tac x=A' in exI)\n apply auto\n done\n\nlemma\nfixes F:: \"'f set\"\nassumes cons: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\\n (\\(t::('s,'f) xstate). (s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A')\n \\ t \\ Normal ` Q \\ Abrupt ` A)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \"\n apply (rule Conseq)\n apply (rule ballI)\n apply (insert cons)\n apply (drule (1) bspec)\n apply clarify\n apply (rule_tac x=P' in exI)\n apply (rule_tac x=Q' in exI)\n apply (rule_tac x=A' in exI)\n apply (rule conjI)\n apply assumption\n (* no way to get s \\ P' *)\n oops\n\nlemma LiberalConseq':\nfixes F:: \"'f set\"\nassumes cons: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\\n (\\(t::('s,'f) xstate). (s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A')\n \\ t \\ Normal ` Q \\ Abrupt ` A)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (drule (1) bspec)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply iprover\ndone\n\nlemma LiberalConseq'':\nfixes F:: \"'f set\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\s (t::('s,'f) xstate).\n (\\Z. s \\ P' Z \\ t \\ Normal ` Q' Z \\ Abrupt ` A' Z)\n \\ (s \\ P \\ t \\ Normal ` Q \\ Abrupt ` A)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (erule_tac x=s in allE)\napply (erule_tac x=t in allE)\napply (case_tac \"t \\ Normal ` Q \\ Abrupt ` A\")\napply (insert spec)\napply iprover\napply auto\ndone\n\nprimrec procs:: \"('s,'p,'f) com \\ 'p set\"\nwhere\n\"procs Skip = {}\" |\n\"procs (Basic f) = {}\" |\n\"procs (Seq c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\ procs c\\<^sub>2)\" |\n\"procs (Cond b c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\ procs c\\<^sub>2)\" |\n\"procs (While b c) = procs c\" |\n\"procs (Call p) = {p}\" |\n\"procs (DynCom c) = (\\s. procs (c s))\" |\n\"procs (Guard f g c) = procs c\" |\n\"procs Throw = {}\" |\n\"procs (Catch c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\ procs c\\<^sub>2)\"\n\nprimrec noSpec:: \"('s,'p,'f) com \\ bool\"\nwhere\n\"noSpec Skip = True\" |\n\"noSpec (Basic f) = True\" |\n\"noSpec (Spec r) = False\" |\n\"noSpec (Seq c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\ noSpec c\\<^sub>2)\" |\n\"noSpec (Cond b c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\ noSpec c\\<^sub>2)\" |\n\"noSpec (While b c) = noSpec c\" |\n\"noSpec (Call p) = True\" |\n\"noSpec (DynCom c) = (\\s. noSpec (c s))\" |\n\"noSpec (Guard f g c) = noSpec c\" |\n\"noSpec Throw = True\" |\n\"noSpec (Catch c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\ noSpec c\\<^sub>2)\"\n\nlemma exec_noSpec_no_Stuck:\n assumes exec: \"\\\\\\c,s\\ \\ t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\: \"\\p \\ dom \\. noSpec (the (\\ p))\"\n assumes procs_subset: \"procs c \\ dom \\\"\n assumes procs_subset_\\: \"\\p \\ dom \\. procs (the (\\ p)) \\ dom \\\"\n assumes s_no_Stuck: \"s\\Stuck\"\n shows \"t\\Stuck\"\nusing exec noSpec_c procs_subset s_no_Stuck proof induct\n case (Call p bdy s t) with noSpec_\\ procs_subset_\\ show ?case\n by (auto dest!: bspec [of _ _ p])\nnext\n case (DynCom c s t) then show ?case\n by auto blast\nqed auto\n\nlemma execn_noSpec_no_Stuck:\n assumes exec: \"\\\\\\c,s\\ =n\\ t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\: \"\\p \\ dom \\. noSpec (the (\\ p))\"\n assumes procs_subset: \"procs c \\ dom \\\"\n assumes procs_subset_\\: \"\\p \\ dom \\. procs (the (\\ p)) \\ dom \\\"\n assumes s_no_Stuck: \"s\\Stuck\"\n shows \"t\\Stuck\"\nusing exec noSpec_c procs_subset s_no_Stuck proof induct\n case (Call p bdy n s t) with noSpec_\\ procs_subset_\\ show ?case\n by (auto dest!: bspec [of _ _ p])\nnext\n case (DynCom c s t) then show ?case\n by auto blast\nqed auto\n\nlemma LiberalConseq_noguards_nothrows_sound:\nassumes spec: \"\\Z. \\n. \\,\\\\n:\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\s t. (\\Z. s \\ P' Z \\ t \\ Q' Z )\n \\ (s \\ P \\ t \\ Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\: \"\\p \\ dom \\. noguards (the (\\ p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\: \"\\p \\ dom \\. nothrows (the (\\ p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\: \"\\p \\ dom \\. noSpec (the (\\ p))\"\nassumes procs_subset: \"procs c \\ dom \\\"\nassumes procs_subset_\\: \"\\p \\ dom \\. procs (the (\\ p)) \\ dom \\\"\nshows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n fix s t\n assume ctxt:\"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from execn_noguards_no_Fault [OF exec noguards_c noguards_\\]\n execn_nothrows_no_Abrupt [OF exec nothrows_c nothrows_\\ ]\n execn_noSpec_no_Stuck [OF exec\n noSpec_c noSpec_\\ procs_subset\n procs_subset_\\]\n obtain t' where t: \"t=Normal t'\"\n by (cases t) auto\n with exec spec ctxt\n have \"(\\Z. s \\ P' Z \\ t' \\ Q' Z)\"\n by (unfold cnvalid_def nvalid_def) blast\n with cons P t show ?thesis\n by simp\n qed\nqed\n\n\nlemma LiberalConseq_noguards_nothrows:\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\s t. (\\Z. s \\ P' Z \\ t \\ Q' Z )\n \\ (s \\ P \\ t \\ Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\: \"\\p \\ dom \\. noguards (the (\\ p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\: \"\\p \\ dom \\. nothrows (the (\\ p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\: \"\\p \\ dom \\. noSpec (the (\\ p))\"\nassumes procs_subset: \"procs c \\ dom \\\"\nassumes procs_subset_\\: \"\\p \\ dom \\. procs (the (\\ p)) \\ dom \\\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows_sound\n [OF _ cons noguards_c noguards_\\ nothrows_c nothrows_\\\n noSpec_c noSpec_\\\n procs_subset procs_subset_\\])\napply (insert spec)\napply (intro allI)\napply (erule_tac x=Z in allE)\nby (rule hoare_cnvalid)\n\nlemma\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub>{s. s=fst Z \\ P s (snd Z)} c {t. Q (fst Z) (snd Z) t},{}\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\: \"\\p \\ dom \\. noguards (the (\\ p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\: \"\\p \\ dom \\. nothrows (the (\\ p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\: \"\\p \\ dom \\. noSpec (the (\\ p))\"\nassumes procs_subset: \"procs c \\ dom \\\"\nassumes procs_subset_\\: \"\\p \\ dom \\. procs (the (\\ p)) \\ dom \\\"\nshows \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub>{s. s=\\} c {t. \\l. P \\ l \\ Q \\ l t},{}\"\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows\n [OF spec _ noguards_c noguards_\\ nothrows_c nothrows_\\\n noSpec_c noSpec_\\\n procs_subset procs_subset_\\])\napply auto\ndone\n\nsubsubsection \\Modify Return\\\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif:\n \"\\\\. \\n. \\,\\\\n:\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\"\n assumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\n assumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\n shows \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: execn_call_Normal_elim)\n fix bdy m t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ =Suc m\\ t\"\n assume n: \"n = Suc m\"\n from exec_body n bdy\n have \"\\\\\\Call p,Normal (init s)\\ =n\\ Normal t'\"\n by (auto simp add: intro: execn.Call)\n from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') =\n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy n\n have \"\\\\\\call init p return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_call)\n from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Abrupt t'\"\n assume n: \"n = Suc m\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body n bdy\n have \"\\\\\\Call p,Normal (init s)\\ =n\\ Abrupt t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy n\n have \"\\\\\\call init p return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_callAbrupt)\n from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Fault f\" \"n = Suc m\"\n \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callFault)\n from valid_call [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix bdy m\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Stuck\" \"n = Suc m\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callStuck)\n from valid_call [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix m\n assume \"\\ p = None\"\n and \"n = Suc m\" \"t = Stuck\"\n then have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callUndefined)\n from valid_call [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n qed\nqed\n\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes return_conform:\n \"\\s t. t \\ ModifAbr (init s)\n \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturn_sound\n [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ result_conform return_conform] )\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif:\n \"\\\\. \\n. \\,\\\\n:\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\"\n assumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\n assumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\n shows \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\call init p return c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: execn_call_Normal_elim)\n fix bdy m t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ =Suc m\\ t\"\n assume n: \"n = Suc m\"\n from exec_body n bdy\n have \"\\\\\\Call p,Normal (init s)\\ =n\\ Normal t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') =\n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy n\n have \"\\\\\\call init p return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_call)\n from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Abrupt t'\"\n assume n: \"n = Suc m\"\n assume t: \"t = Abrupt (return s t')\"\n also\n from exec_body n bdy\n have \"\\\\\\Call p,Normal (init s)\\ =n \\ Abrupt t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy n\n have \"\\\\\\call init p return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_callAbrupt)\n from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Fault f\" \"n = Suc m\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callFault)\n from cnvalidD [OF valid_call [rule_format] ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Stuck\" \"n = Suc m\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callStuck)\n from valid_call [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix m\n assume \"\\ p = None\"\n and \"n = Suc m\" \"t = Stuck\"\n then have \"\\\\\\call init p return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callUndefined)\n from valid_call [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n qed\nqed\n\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes return_conform:\n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturnSameFaults_sound\n [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ result_conform return_conform])\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection \\DynCall\\\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif:\n \"\\s \\ P. \\\\. \\n.\n \\,\\\\n:\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\nshows \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ =n\\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif\n have valid_modif': \"\\\\. \\n.\n \\,\\\\n:\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ =n\\ t\"\n by (cases rule: execn_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: execn_call_Normal_elim)\n fix bdy m t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ =Suc m\\ t\"\n assume n: \"n = Suc m\"\n from exec_body n bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ =n\\ Normal t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy n\n have \"\\\\\\call init (p s) return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from cnvalidD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Abrupt t'\"\n assume n: \"n = Suc m\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body n bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ =n\\ Abrupt t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy n\n have \"\\\\\\call init (p s) return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from cnvalidD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Fault f\" \"n = Suc m\"\n \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix bdy m\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Stuck\" \"n = Suc m\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix m\n assume \"\\ (p s) = None\"\n and \"n = Suc m\" \"t = Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n qed\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\nassumes modif:\n \"\\s \\ P. \\\\.\n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif:\n \"\\s \\ P. \\\\. \\n.\n \\,\\\\n:\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ =n\\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif\n have valid_modif': \"\\\\. \\n.\n \\,\\\\n:\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ =n\\ t\"\n by (cases rule: execn_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: execn_call_Normal_elim)\n fix bdy m t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ =Suc m\\ t\"\n assume n: \"n = Suc m\"\n from exec_body n bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ =n \\ Normal t'\"\n by (auto simp add: intro: execn.Call)\n from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy n\n have \"\\\\\\call init (p s) return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from cnvalidD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ =m\\ Abrupt t'\"\n assume n: \"n = Suc m\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body n bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ =n \\ Abrupt t'\"\n by (auto simp add: intro: execn.intros)\n from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy n\n have \"\\\\\\call init (p s) return' c,Normal s\\ =n\\ t\"\n by (auto intro: execn_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from cnvalidD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Fault f\" \"n = Suc m\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from cnvalidD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy m\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ =m\\ Stuck\" \"n = Suc m\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n fix m\n assume \"\\ (p s) = None\"\n and \"n = Suc m\" \"t = Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ =n\\ t\"\n by (auto intro: execn_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ =n\\ t\"\n by (rule execn_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n qed\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\nassumes modif:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturnSameFaults_sound\n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\n\nsubsubsection \\Conjunction of Postcondition\\\n\nlemma PostConjI_sound:\nassumes valid_Q: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes valid_R: \"\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> P c R,B\"\nshows \"\\,\\ \\n:\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q [rule_format] ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cnvalidD)\n moreover\n from valid_R [rule_format] ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cnvalidD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_R: \"\\,\\\\\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule PostConjI_sound)\nusing deriv_Q\napply (blast intro: hoare_cnvalid)\nusing deriv_R\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma Merge_PostConj_sound:\n assumes validF: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\n. \\,\\\\n:\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/G\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cnvalidD [OF validF [rule_format] ctxt exec P t_noFault]\n have *: \"t \\ Normal ` Q \\ Abrupt ` A\".\n then have \"t \\ Fault ` G\"\n by auto\n from cnvalidD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n with * show ?thesis by auto\n qed\nqed\n\nlemma Merge_PostConj:\n assumes validF: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoare_cnvalid)\nusing validG apply (blast intro:hoare_cnvalid)\ndone\n\nsubsubsection \\Weaken Context\\\n\n\nlemma WeakenContext_sound:\n assumes valid_c: \"\\n. \\,\\'\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_ctxt: \"\\(P, p, Q, A)\\\\'. \\,\\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n with valid_ctxt\n have ctxt': \"\\(P, p, Q, A)\\\\'. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (simp add: cnvalid_def)\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_c [rule_format] ctxt' exec P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cnvalidD)\nqed\n\nlemma WeakenContext:\n assumes deriv_c: \"\\,\\'\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_ctxt: \"\\(P,p,Q,A)\\\\'. \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule WeakenContext_sound)\nusing deriv_c\napply (blast intro: hoare_cnvalid)\nusing deriv_ctxt\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection \\Guards and Guarantees\\\n\nlemma SplitGuards_sound:\nassumes valid_c1: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\nassumes valid_c2: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\nassumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\nshows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_execn_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ t\" by simp\n from valid_c1 [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n case Abrupt\n with inter_guards_execn_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ t\" by simp\n from valid_c1 [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n next\n case (Fault f)\n with exec inter_guards_execn_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ =n\\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ Fault f\"\n from Fault cnvalidD [OF valid_c1 [rule_format] ctxt this P] t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ =n\\ Fault f\"\n from Fault cnvalidD [OF valid_c2 [rule_format] ctxt this P] t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_execn_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ =n\\ t\" by simp\n from valid_c1 [rule_format] ctxt this P t_notin_F\n show ?thesis\n by (rule cnvalidD)\n qed\nqed\n\nlemma SplitGuards:\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SplitGuards_sound [OF _ _ c])\nusing deriv_c1\napply (blast intro: hoare_cnvalid)\nusing deriv_c2\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\n. \\,\\\\n:\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt\n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ =n\\ Fault f\"\n by (auto intro: execn_to_execn_strip_guards_Fault)\n from cnvalidD [OF valid_strip [rule_format] ctxt this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule CombineStrip_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\n. \\,\\\\n:\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/-F\\<^esub> P (Call p) Q,A\"\n by (auto intro: nvalid_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt\n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cnvalidD [OF validFlip [rule_format] ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nqed\n\nlemma GuardsFlip:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule GuardsFlip_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\mark_guards f c,Normal s\\ =n\\ t\"\n from execn_mark_guards_to_execn [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ =n\\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cnvalidD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nqed\n\nlemma MarkGuardsI:\n assumes deriv: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MarkGuardsD_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with execn_to_execn_mark_guards_Fault [OF exec ]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ =n\\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cnvalidD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from execn_to_execn_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ =n\\ t\"\n by auto\n from cnvalidD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nqed\n\nlemma MarkGuardsD:\n assumes deriv: \"\\,\\\\\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsI_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ =n\\ t\"\n from execn_merge_guards_to_execn [OF exec_merge]\n have exec: \"\\\\\\c,Normal s\\ =n\\ t\" .\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from cnvalidD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nqed\n\nlemma MergeGuardsI:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsD_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n from execn_to_execn_merge_guards [OF exec]\n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ =n\\ t\".\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from cnvalidD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nqed\n\n\n\n\nlemma SubsetGuards_sound:\n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n from execn_to_execn_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ =n\\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n from cnvalidD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nqed\n\nlemma SubsetGuards:\n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeD_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n hence exec_norm: \"\\\\\\normalize c,Normal s\\ =n\\ t\"\n by (rule execn_to_execn_normalize)\n assume P: \"s \\ P\"\n assume noFault: \"t \\ Fault ` F\"\n from cnvalidD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nqed\n\nlemma NormalizeD:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeI_sound:\n assumes valid: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cnvalidI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"\\\\\\normalize c,Normal s\\ =n\\ t\"\n hence exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n by (rule execn_normalize_to_execn)\n assume P: \"s \\ P\"\n assume noFault: \"t \\ Fault ` F\"\n from cnvalidD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nqed\n\nlemma NormalizeI:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\n\nsubsubsection \\Restricting the Procedure Environment\\\n\nlemma nvalid_restrict_to_nvalid:\nassumes valid_c: \"\\|\\<^bsub>M\\<^esub>\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n fix s t\n assume exec: \"\\\\\\c,Normal s\\ =n\\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from execn_to_execn_restrict [OF exec]\n obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ =n\\ t'\" and\n t_Fault: \"\\f. t = Fault f \\ t' \\ {Fault f, Stuck}\" and\n t'_notStuck: \"t'\\Stuck \\ t'=t\"\n by blast\n from t_Fault t_notin_F t'_notStuck have \"t' \\ Fault ` F\"\n by (cases t') auto\n with valid_c exec_res P\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: nvalid_def)\n with t'_notStuck\n show ?thesis\n by auto\n qed\nqed\n\nlemma valid_restrict_to_valid:\nassumes valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n fix s t\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from exec_to_exec_restrict [OF exec]\n obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\ t'\" and\n t_Fault: \"\\f. t = Fault f \\ t' \\ {Fault f, Stuck}\" and\n t'_notStuck: \"t'\\Stuck \\ t'=t\"\n by blast\n from t_Fault t_notin_F t'_notStuck have \"t' \\ Fault ` F\"\n by (cases t') auto\n with valid_c exec_res P\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: valid_def)\n with t'_notStuck\n show ?thesis\n by auto\n qed\nqed\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoare_complete)\n apply (rule valid_restrict_to_valid)\n apply (insert hoare_sound [OF deriv_c])\n by (simp add: cvalid_def)\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoare_complete)\n apply (rule valid_augment_Faults [OF _ F])\n apply (insert hoare_sound [OF deriv_c])\n by (simp add: cvalid_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/HoarePartialProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.28649189443153006}} {"text": "(* File: Maximum_Parallel_Composition.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nsection \\Maximum Parallel Composition\\\n\ntheory Maximum_Parallel_Composition\n imports \"Basic_Modules/Component_Types/Maximum_Aggregator\"\n Parallel_Composition\nbegin\n\ntext\n\\This is a family of parallel compositions. It composes a new electoral module\nfrom two electoral modules combined with the maximum aggregator. Therein, the\ntwo modules each make a decision and then a partition is returned where every\nalternative receives the maximum result of the two input partitions. This means\nthat, if any alternative is elected by at least one of the modules, then it\ngets elected, if any non-elected alternative is deferred by at least one of the\nmodules, then it gets deferred, only alternatives rejected by both modules get\nrejected.\\\n\nsubsection \\Definition\\\n\nfun maximum_parallel_composition :: \"'a Electoral_Module \\\n 'a Electoral_Module \\ 'a Electoral_Module\" where\n \"maximum_parallel_composition m n =\n (let a = max_aggregator in (m \\\\<^sub>a n))\"\n\nabbreviation max_parallel :: \"'a Electoral_Module \\ 'a Electoral_Module \\\n 'a Electoral_Module\" (infix \"\\\\<^sub>\\\" 50) where\n \"m \\\\<^sub>\\ n == maximum_parallel_composition m n\"\n\nsubsection \\Soundness\\\n\ntheorem max_par_comp_sound:\n assumes\n mod_m: \"electoral_module m\" and\n mod_n: \"electoral_module n\"\n shows \"electoral_module (m \\\\<^sub>\\ n)\"\n using mod_m mod_n\n by simp\n\nsubsection \\Lemmata\\\n\nlemma max_agg_eq_result:\n assumes\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n f_prof: \"finite_profile A p\" and\n in_A: \"x \\ A\"\n shows\n \"mod_contains_result (m \\\\<^sub>\\ n) m A p x \\\n mod_contains_result (m \\\\<^sub>\\ n) n A p x\"\nproof cases\n assume a1: \"x \\ elect (m \\\\<^sub>\\ n) A p\"\n have mod_contains_inst:\n \"\\p_mod q_mod a_set prof a.\n mod_contains_result p_mod q_mod a_set prof (a::'a) =\n (electoral_module p_mod \\ electoral_module q_mod \\\n finite a_set \\ profile a_set prof \\ a \\ a_set \\\n (a \\ elect p_mod a_set prof \\ a \\ elect q_mod a_set prof) \\\n (a \\ reject p_mod a_set prof \\ a \\ reject q_mod a_set prof) \\\n (a \\ defer p_mod a_set prof \\ a \\ defer q_mod a_set prof))\"\n by (simp add: mod_contains_result_def)\n have module_mn: \"electoral_module (m \\\\<^sub>\\ n)\"\n by (simp add: module_m module_n)\n have not_defer_mn: \"x \\ defer (m \\\\<^sub>\\ n) A p\"\n using module_mn IntI a1 empty_iff f_prof result_disj\n by (metis (no_types))\n have not_reject_mn: \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n using module_mn IntI a1 empty_iff f_prof result_disj\n by (metis (no_types))\n from a1 have\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n x \\ e1 \\ e2\"\n by auto\n hence union_mn: \"x \\ (elect m A p) \\ (elect n A p)\"\n by auto\n thus ?thesis\n using f_prof in_A module_m module_mn module_n\n not_defer_mn not_reject_mn union_mn\n mod_contains_inst\n by blast\nnext\n assume not_a1: \"x \\ elect (m \\\\<^sub>\\ n) A p\"\n thus ?thesis\n proof cases\n assume x_in_def: \"x \\ defer (m \\\\<^sub>\\ n) A p\"\n thus ?thesis\n proof (safe)\n assume not_mod_cont_mn:\n \"\\ mod_contains_result (m \\\\<^sub>\\ n) n A p x\"\n have par_emod:\n \"\\f g.\n (electoral_module (f::'a set \\ 'a Profile \\ 'a Result) \\\n electoral_module g) \\\n electoral_module (f \\\\<^sub>\\ g)\"\n using max_par_comp_sound\n by blast\n hence \"electoral_module (m \\\\<^sub>\\ n)\"\n using module_m module_n\n by blast\n hence max_par_emod:\n \"electoral_module (m \\\\<^sub>max_aggregator n)\"\n by simp\n have set_intersect:\n \"\\(a::'a) A B. (a \\ A \\ B) = (a \\ A \\ a \\ B)\"\n by blast\n obtain\n s_func :: \"('a set \\ 'a Profile \\ 'a Result) \\ 'a set\" and\n p_func :: \"('a set \\ 'a Profile \\ 'a Result) \\ 'a Profile\" where\n well_f:\n \"\\f.\n (\\ electoral_module f \\\n (\\A prof. (finite A \\ profile A prof) \\ well_formed A (f A prof))) \\\n (electoral_module f \\ finite (s_func f) \\ profile (s_func f) (p_func f) \\\n \\ well_formed (s_func f) (f (s_func f) (p_func f)))\"\n using electoral_module_def\n by moura\n hence wf_n: \"well_formed A (n A p)\"\n using f_prof module_n\n by blast\n have wf_m: \"well_formed A (m A p)\"\n using well_f f_prof module_m\n by blast\n have a_exists: \"\\(a::'a). a \\ {}\"\n by blast\n have e_mod_par:\n \"electoral_module (m \\\\<^sub>\\ n)\"\n using par_emod module_m module_n\n by blast\n hence \"electoral_module (m \\\\<^sub>max_aggregator n)\"\n by simp\n hence result_disj_max:\n \"elect (m \\\\<^sub>max_aggregator n) A p \\ reject (m \\\\<^sub>max_aggregator n) A p = {} \\\n elect (m \\\\<^sub>max_aggregator n) A p \\ defer (m \\\\<^sub>max_aggregator n) A p = {} \\\n reject (m \\\\<^sub>max_aggregator n) A p \\ defer (m \\\\<^sub>max_aggregator n) A p = {}\"\n using f_prof result_disj\n by metis\n have x_not_elect:\n \"x \\ elect (m \\\\<^sub>max_aggregator n) A p\"\n using result_disj_max x_in_def\n by force\n have result_m:\n \"(elect m A p, reject m A p, defer m A p) = m A p\"\n by auto\n have result_n:\n \"(elect n A p, reject n A p, defer n A p) = n A p\"\n by auto\n have max_pq:\n \"\\(A::'a set) p q.\n elect_r (max_aggregator A p q) = elect_r p \\ elect_r q\"\n by force\n have\n \"x \\ elect (m \\\\<^sub>max_aggregator n) A p\"\n using x_not_elect\n by blast\n with max_pq\n have \"x \\ elect m A p \\ elect n A p\"\n by (simp add: max_pq)\n hence x_not_elect_mn:\n \"x \\ elect m A p \\ x \\ elect n A p\"\n by blast\n have x_not_mpar_rej:\n \"x \\ reject (m \\\\<^sub>max_aggregator n) A p\"\n using result_disj_max x_in_def\n by fastforce\n hence x_not_par_rej:\n \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n by auto\n have mod_cont_res_fg:\n \"\\f g A prof (a::'a).\n mod_contains_result f g A prof a =\n (electoral_module f \\ electoral_module g \\\n finite A \\ profile A prof \\ a \\ A \\\n (a \\ elect f A prof \\ a \\ elect g A prof) \\\n (a \\ reject f A prof \\ a \\ reject g A prof) \\\n (a \\ defer f A prof \\ a \\ defer g A prof))\"\n by (simp add: mod_contains_result_def)\n have max_agg_res:\n \"max_aggregator A (elect m A p, reject m A p, defer m A p)\n (elect n A p, reject n A p, defer n A p) = (m \\\\<^sub>max_aggregator n) A p\"\n by simp\n have well_f_max:\n \"\\r2 r1 e2 e1 d2 d1 A.\n well_formed A (e1, r1, d1) \\ well_formed A (e2, r2, d2) \\\n reject_r (max_aggregator A (e1, r1, d1) (e2, r2, d2)) = r1 \\ r2\"\n using max_agg_rej_set\n by metis\n have e_mod_disj:\n \"\\f (A::'a set) prof.\n (electoral_module f \\ finite (A::'a set) \\ profile A prof) \\\n elect f A prof \\ reject f A prof \\ defer f A prof = A\"\n using result_presv_alts\n by blast\n hence e_mod_disj_n:\n \"elect n A p \\ reject n A p \\ defer n A p = A\"\n using f_prof module_n\n by metis\n have\n \"\\f g A prof (a::'a).\n mod_contains_result f g A prof a =\n (electoral_module f \\ electoral_module g \\\n finite A \\ profile A prof \\ a \\ A \\\n (a \\ elect f A prof \\ a \\ elect g A prof) \\\n (a \\ reject f A prof \\ a \\ reject g A prof) \\\n (a \\ defer f A prof \\ a \\ defer g A prof))\"\n by (simp add: mod_contains_result_def)\n with e_mod_disj_n\n have \"x \\ reject n A p\"\n using e_mod_par f_prof in_A module_n not_mod_cont_mn\n x_not_elect x_not_elect_mn x_not_mpar_rej\n by auto\n hence \"x \\ reject m A p\"\n using well_f_max max_agg_res result_m result_n\n set_intersect wf_m wf_n x_not_mpar_rej\n by (metis (no_types))\n with max_agg_res\n have\n \"x \\ defer (m \\\\<^sub>\\ n) A p \\ x \\ defer m A p\"\n using e_mod_disj f_prof in_A module_m x_not_elect_mn\n by blast\n with x_not_mpar_rej\n show \"mod_contains_result (m \\\\<^sub>\\ n) m A p x\"\n using mod_cont_res_fg x_not_par_rej e_mod_par f_prof\n in_A module_m x_not_elect\n by auto\n qed\n next\n assume not_a2: \"x \\ defer (m \\\\<^sub>\\ n) A p\"\n have el_rej_defer:\n \"(elect m A p, reject m A p, defer m A p) = m A p\"\n by auto\n from not_a1 not_a2 have a3:\n \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n using electoral_mod_defer_elem in_A module_m module_n\n f_prof max_par_comp_sound\n by metis\n hence\n \"case snd (m A p) of (Aa, Ab) \\\n case n A p of (Ac, Ad, Ae) \\\n x \\ reject_r\n (max_aggregator A\n (elect m A p, Aa, Ab) (Ac, Ad, Ae))\"\n using el_rej_defer\n by force\n hence\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n x \\ fst (snd (max_aggregator A\n (e1, r1, d1) (e2, r2, d2)))\"\n by (simp add: case_prod_unfold)\n hence\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n x \\ A - (e1 \\ e2 \\ d1 \\ d2)\"\n by simp\n hence\n \"x \\ elect m A p \\ (defer n A p \\ defer m A p)\"\n by force\n thus ?thesis\n using mod_contains_result_comm mod_contains_result_def Un_iff\n a3 f_prof in_A module_m module_n max_par_comp_sound\n by (metis (no_types))\n qed\nqed\n\nlemma max_agg_rej_iff_both_reject:\n assumes\n f_prof: \"finite_profile A p\" and\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\"\n shows\n \"x \\ reject (m \\\\<^sub>\\ n) A p \\\n (x \\ reject m A p \\ x \\ reject n A p)\"\nproof\n assume a: \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n hence\n \"case n A p of (Aa, Ab, Ac) \\\n x \\ reject_r (max_aggregator A\n (elect m A p, reject m A p, defer m A p) (Aa, Ab, Ac))\"\n by auto\n hence\n \"case snd (m A p) of (Aa, Ab) \\\n case n A p of (Ac, Ad, Ae) \\\n x \\ reject_r (max_aggregator A\n (elect m A p, Aa, Ab) (Ac, Ad, Ae))\"\n by force\n with a have\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n x \\ fst (snd (max_aggregator A (e1, r1, d1) (e2, r2, d2)))\"\n by (simp add: prod.case_eq_if)\n hence\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n x \\ A - (e1 \\ e2 \\ d1 \\ d2)\"\n by simp\n hence\n \"x \\ A - (elect m A p \\ elect n A p \\ defer m A p \\ defer n A p)\"\n by auto\n thus \"x \\ reject m A p \\ x \\ reject n A p\"\n using Diff_iff Un_iff electoral_mod_defer_elem\n f_prof module_m module_n\n by metis\nnext\n assume a: \"x \\ reject m A p \\ x \\ reject n A p\"\n hence\n \"x \\ elect m A p \\ x \\ defer m A p \\\n x \\ elect n A p \\ x \\ defer n A p\"\n using IntI empty_iff module_m module_n f_prof result_disj\n by metis\n thus \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n using DiffD1 a f_prof max_agg_eq_result module_m module_n\n mod_contains_result_comm mod_contains_result_def\n reject_not_elec_or_def\n by (metis (no_types))\nqed\n\nlemma max_agg_rej1:\n assumes\n f_prof: \"finite_profile A p\" and\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n rejected: \"x \\ reject n A p\"\n shows\n \"mod_contains_result m (m \\\\<^sub>\\ n) A p x\"\n unfolding mod_contains_result_def\nproof (safe)\n show \"electoral_module m\"\n using module_m\n by simp\nnext\n show \"electoral_module (m \\\\<^sub>\\ n)\"\n using module_m module_n\n by simp\nnext\n show \"finite A\"\n using f_prof\n by simp\nnext\n show \"profile A p\"\n using f_prof\n by simp\nnext\n show \"x \\ A\"\n using f_prof module_n reject_in_alts rejected\n by auto\nnext\n assume\n x_in_elect: \"x \\ elect m A p\"\n hence x_not_reject:\n \"x \\ reject m A p\"\n using disjoint_iff_not_equal f_prof module_m result_disj\n by metis\n have rej_in_A:\n \"reject n A p \\ A\"\n using f_prof module_n\n by (simp add: reject_in_alts)\n have x_in_A: \"x \\ A\"\n using rej_in_A in_mono rejected\n by metis\n with x_in_elect x_not_reject\n show \"x \\ elect (m \\\\<^sub>\\ n) A p\"\n using f_prof max_agg_eq_result module_m module_n rejected\n max_agg_rej_iff_both_reject mod_contains_result_comm\n mod_contains_result_def\n by metis\nnext\n assume \"x \\ reject m A p\"\n hence\n \"x \\ reject m A p \\ x \\ reject n A p\"\n using rejected\n by simp\n thus \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n using f_prof max_agg_rej_iff_both_reject module_m module_n\n by (metis (no_types))\nnext\n assume x_in_defer: \"x \\ defer m A p\"\n hence defer_a:\n \"\\a. a \\ defer m A p \\ x = a\"\n by simp\n then obtain x_inst :: 'a where\n inst_x: \"x = x_inst \\ x_inst \\ defer m A p\"\n by metis\n hence x_not_rej:\n \"x \\ reject m A p\"\n using disjoint_iff_not_equal f_prof inst_x module_m result_disj\n by (metis (no_types))\n have\n \"\\f A prof.\n (electoral_module f \\ finite (A::'a set) \\ profile A prof) \\\n elect f A prof \\ reject f A prof \\ defer f A prof = A\"\n using result_presv_alts\n by metis\n with x_in_defer\n have \"x \\ A\"\n using f_prof module_m\n by blast\n with inst_x x_not_rej\n show \"x \\ defer (m \\\\<^sub>\\ n) A p\"\n using f_prof max_agg_eq_result\n max_agg_rej_iff_both_reject\n mod_contains_result_comm\n mod_contains_result_def\n module_m module_n rejected\n by metis\nqed\n\nlemma max_agg_rej2:\n assumes\n f_prof: \"finite_profile A p\" and\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n rejected: \"x \\ reject n A p\"\n shows\n \"mod_contains_result (m \\\\<^sub>\\ n) m A p x\"\n using mod_contains_result_comm max_agg_rej1\n module_m module_n f_prof rejected\n by metis\n\nlemma max_agg_rej3:\n assumes\n f_prof: \"finite_profile A p\" and\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n rejected: \"x \\ reject m A p\"\n shows\n \"mod_contains_result n (m \\\\<^sub>\\ n) A p x\"\n unfolding mod_contains_result_def\nproof (safe)\n show \"electoral_module n\"\n using module_n\n by simp\nnext\n show \"electoral_module (m \\\\<^sub>\\ n)\"\n using module_m module_n\n by simp\nnext\n show \"finite A\"\n using f_prof\n by simp\nnext\n show \"profile A p\"\n using f_prof\n by simp\nnext\n show \"x \\ A\"\n using f_prof in_mono module_m reject_in_alts rejected\n by (metis (no_types))\nnext\n assume \"x \\ elect n A p\"\n thus \"x \\ elect (m \\\\<^sub>\\ n) A p\"\n using Un_iff combine_ele_rej_def fst_conv\n maximum_parallel_composition.simps\n max_aggregator.simps\n parallel_composition.simps\n by (metis (mono_tags, lifting))\nnext\n assume \"x \\ reject n A p\"\n thus \"x \\ reject (m \\\\<^sub>\\ n) A p\"\n using f_prof max_agg_rej_iff_both_reject module_m module_n rejected\n by metis\nnext\n assume x_in_def: \"x \\ defer n A p\"\n have \"x \\ A\"\n using f_prof max_agg_rej1 mod_contains_result_def module_m rejected\n by metis\n thus \"x \\ defer (m \\\\<^sub>\\ n) A p\"\n using x_in_def disjoint_iff_not_equal f_prof\n max_agg_eq_result max_agg_rej_iff_both_reject\n mod_contains_result_comm mod_contains_result_def\n module_m module_n rejected result_disj\n by metis\nqed\n\nlemma max_agg_rej4:\n assumes\n f_prof: \"finite_profile A p\" and\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n rejected: \"x \\ reject m A p\"\n shows\n \"mod_contains_result (m \\\\<^sub>\\ n) n A p x\"\n using mod_contains_result_comm max_agg_rej3\n module_m module_n f_prof rejected\n by metis\n\nlemma max_agg_rej_intersect:\n assumes\n module_m: \"electoral_module m\" and\n module_n: \"electoral_module n\" and\n f_prof: \"finite_profile A p\"\n shows\n \"reject (m \\\\<^sub>\\ n) A p =\n (reject m A p) \\ (reject n A p)\"\nproof -\n have\n \"A = (elect m A p) \\ (reject m A p) \\ (defer m A p) \\\n A = (elect n A p) \\ (reject n A p) \\ (defer n A p)\"\n by (simp add: module_m module_n f_prof result_presv_alts)\n hence\n \"A - ((elect m A p) \\ (defer m A p)) = (reject m A p) \\\n A - ((elect n A p) \\ (defer n A p)) = (reject n A p)\"\n using module_m module_n f_prof reject_not_elec_or_def\n by auto\n hence\n \"A - ((elect m A p) \\ (elect n A p) \\ (defer m A p) \\ (defer n A p)) =\n (reject m A p) \\ (reject n A p)\"\n by blast\n hence\n \"let (e1, r1, d1) = m A p;\n (e2, r2, d2) = n A p in\n A - (e1 \\ e2 \\ d1 \\ d2) = r1 \\ r2\"\n by fastforce\n thus ?thesis\n by auto\nqed\n\nlemma dcompat_dec_by_one_mod:\n assumes\n compatible: \"disjoint_compatibility m n\" and\n in_A: \"x \\ A\"\n shows\n \"(\\p. finite_profile A p \\\n mod_contains_result m (m \\\\<^sub>\\ n) A p x) \\\n (\\p. finite_profile A p \\\n mod_contains_result n (m \\\\<^sub>\\ n) A p x)\"\n using DiffI compatible disjoint_compatibility_def\n in_A max_agg_rej1 max_agg_rej3\n by metis\n\nsubsection \\Composition Rules\\\n\n(*\n Using a conservative aggregator, the parallel composition\n preserves the property non-electing.\n*)\ntheorem conserv_max_agg_presv_non_electing[simp]:\n assumes\n non_electing_m: \"non_electing m\" and\n non_electing_n: \"non_electing n\"\n shows \"non_electing (m \\\\<^sub>\\ n)\"\n using non_electing_m non_electing_n\n by simp\n\n(*\n Using the max aggregator, composing two compatible\n electoral modules in parallel preserves defer-lift-invariance.\n*)\ntheorem par_comp_def_lift_inv[simp]:\n assumes\n compatible: \"disjoint_compatibility m n\" and\n monotone_m: \"defer_lift_invariance m\" and\n monotone_n: \"defer_lift_invariance n\"\n shows \"defer_lift_invariance (m \\\\<^sub>\\ n)\"\n unfolding defer_lift_invariance_def\nproof (safe)\n have electoral_mod_m: \"electoral_module m\"\n using monotone_m\n by (simp add: defer_lift_invariance_def)\n have electoral_mod_n: \"electoral_module n\"\n using monotone_n\n by (simp add: defer_lift_invariance_def)\n show \"electoral_module (m \\\\<^sub>\\ n)\"\n using electoral_mod_m electoral_mod_n\n by simp\nnext\n fix\n S :: \"'a set\" and\n p :: \"'a Profile\" and\n q :: \"'a Profile\" and\n x :: \"'a\"\n assume\n defer_x: \"x \\ defer (m \\\\<^sub>\\ n) S p\" and\n lifted_x: \"Profile.lifted S p q x\"\n hence f_profs: \"finite_profile S p \\ finite_profile S q\"\n by (simp add: lifted_def)\n from compatible\n obtain A::\"'a set\" where A:\n \"A \\ S \\ (\\x \\ A. indep_of_alt m S x \\\n (\\p. finite_profile S p \\ x \\ reject m S p)) \\\n (\\x \\ S-A. indep_of_alt n S x \\\n (\\p. finite_profile S p \\ x \\ reject n S p))\"\n using disjoint_compatibility_def f_profs\n by (metis (no_types, lifting))\n have\n \"\\x \\ S. prof_contains_result (m \\\\<^sub>\\ n) S p q x\"\n proof cases\n assume a0: \"x \\ A\"\n hence \"x \\ reject m S p\"\n using A f_profs\n by blast\n with defer_x\n have defer_n: \"x \\ defer n S p\"\n using compatible disjoint_compatibility_def\n mod_contains_result_def f_profs max_agg_rej4\n by metis\n have\n \"\\x \\ A. mod_contains_result (m \\\\<^sub>\\ n) n S p x\"\n using A compatible disjoint_compatibility_def\n max_agg_rej4 f_profs\n by metis\n moreover have \"\\x \\ S. prof_contains_result n S p q x\"\n unfolding prof_contains_result_def\n proof (clarify)\n fix x :: \"'a\"\n assume\n x_in_S: \"x \\ S\"\n show\n \"electoral_module n \\\n finite_profile S p \\\n finite_profile S q \\\n x \\ S \\\n (x \\ elect n S p \\ x \\ elect n S q) \\\n (x \\ reject n S p \\ x \\ reject n S q) \\\n (x \\ defer n S p \\ x \\ defer n S q)\"\n proof (safe)\n show \"electoral_module n\"\n using monotone_n defer_lift_invariance_def\n by metis\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S p\"\n using f_profs\n by simp\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S q\"\n using f_profs\n by simp\n next\n show \"x \\ S\"\n using x_in_S\n by simp\n next\n assume \"x \\ elect n S p\"\n thus \"x \\ elect n S q\"\n using defer_n lifted_x monotone_n\n f_profs defer_lift_invariance_def\n by metis\n next\n assume \"x \\ reject n S p\"\n thus \"x \\ reject n S q\"\n using defer_n lifted_x monotone_n\n f_profs defer_lift_invariance_def\n by metis\n next\n assume \"x \\ defer n S p\"\n thus \"x \\ defer n S q\"\n using defer_n lifted_x monotone_n\n f_profs defer_lift_invariance_def\n by metis\n qed\n qed\n moreover have\n \"\\x \\ A. mod_contains_result n (m \\\\<^sub>\\ n) S q x\"\n using A compatible disjoint_compatibility_def\n max_agg_rej3 f_profs\n by metis\n ultimately have 00:\n \"\\x \\ A. prof_contains_result (m \\\\<^sub>\\ n) S p q x\"\n by (simp add: mod_contains_result_def prof_contains_result_def)\n have\n \"\\x \\ S-A. mod_contains_result (m \\\\<^sub>\\ n) m S p x\"\n using A max_agg_rej2 monotone_m monotone_n f_profs\n defer_lift_invariance_def\n by metis\n moreover have \"\\x \\ S. prof_contains_result m S p q x\"\n unfolding prof_contains_result_def\n proof (clarify)\n fix x :: \"'a\"\n assume\n x_in_S: \"x \\ S\"\n show\n \"electoral_module m \\\n finite_profile S p \\\n finite_profile S q \\\n x \\ S \\\n (x \\ elect m S p \\ x \\ elect m S q) \\\n (x \\ reject m S p \\ x \\ reject m S q) \\\n (x \\ defer m S p \\ x \\ defer m S q)\"\n proof (safe)\n show \"electoral_module m\"\n using monotone_m defer_lift_invariance_def\n by metis\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S p\"\n using f_profs\n by simp\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S q\"\n using f_profs\n by simp\n next\n show \"x \\ S\"\n using x_in_S\n by simp\n next\n assume \"x \\ elect m S p\"\n thus \"x \\ elect m S q\"\n using A a0 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n next\n assume \"x \\ reject m S p\"\n thus \"x \\ reject m S q\"\n using A a0 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n next\n assume \"x \\ defer m S p\"\n thus \"x \\ defer m S q\"\n using A a0 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n qed\n qed\n moreover have\n \"\\x \\ S-A. mod_contains_result m (m \\\\<^sub>\\ n) S q x\"\n using A max_agg_rej1 monotone_m monotone_n f_profs\n defer_lift_invariance_def\n by metis\n ultimately have 01:\n \"\\x \\ S-A. prof_contains_result (m \\\\<^sub>\\ n) S p q x\"\n by (simp add: mod_contains_result_def prof_contains_result_def)\n from 00 01\n show ?thesis\n by blast\n next\n assume \"x \\ A\"\n hence a1: \"x \\ S-A\"\n using DiffI lifted_x compatible f_profs\n Profile.lifted_def\n by (metis (no_types, lifting))\n hence \"x \\ reject n S p\"\n using A f_profs\n by blast\n with defer_x\n have defer_m: \"x \\ defer m S p\"\n using DiffD1 DiffD2 compatible dcompat_dec_by_one_mod\n defer_not_elec_or_rej disjoint_compatibility_def\n not_rej_imp_elec_or_def mod_contains_result_def\n max_agg_sound par_comp_sound f_profs\n maximum_parallel_composition.simps\n by metis\n have\n \"\\x \\ A. mod_contains_result (m \\\\<^sub>\\ n) n S p x\"\n using A compatible disjoint_compatibility_def\n max_agg_rej4 f_profs\n by metis\n moreover have \"\\x \\ S. prof_contains_result n S p q x\"\n unfolding prof_contains_result_def\n proof (clarify)\n fix x :: \"'a\"\n assume\n x_in_S: \"x \\ S\"\n show\n \"electoral_module n \\\n finite_profile S p \\\n finite_profile S q \\\n x \\ S \\\n (x \\ elect n S p \\ x \\ elect n S q) \\\n (x \\ reject n S p \\ x \\ reject n S q) \\\n (x \\ defer n S p \\ x \\ defer n S q)\"\n proof (safe)\n show \"electoral_module n\"\n using monotone_n defer_lift_invariance_def\n by metis\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S p\"\n using f_profs\n by simp\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S q\"\n using f_profs\n by simp\n next\n show \"x \\ S\"\n using x_in_S\n by simp\n next\n assume \"x \\ elect n S p\"\n thus \"x \\ elect n S q\"\n using A a1 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n next\n assume \"x \\ reject n S p\"\n thus \"x \\ reject n S q\"\n using A a1 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n next\n assume \"x \\ defer n S p\"\n thus \"x \\ defer n S q\"\n using A a1 indep_of_alt_def lifted_x\n lifted_imp_equiv_prof_except_a\n by metis\n qed\n qed\n moreover have\n \"\\x \\ A. mod_contains_result n (m \\\\<^sub>\\ n) S q x\"\n using A compatible disjoint_compatibility_def\n max_agg_rej3 f_profs\n by metis\n ultimately have 10:\n \"\\x \\ A. prof_contains_result (m \\\\<^sub>\\ n) S p q x\"\n by (simp add: mod_contains_result_def prof_contains_result_def)\n have\n \"\\x \\ S-A. mod_contains_result (m \\\\<^sub>\\ n) m S p x\"\n using A max_agg_rej2 monotone_m monotone_n\n f_profs defer_lift_invariance_def\n by metis\n moreover have \"\\x \\ S. prof_contains_result m S p q x\"\n unfolding prof_contains_result_def\n proof (clarify)\n fix x :: \"'a\"\n assume\n x_in_S: \"x \\ S\"\n show\n \"electoral_module m \\\n finite_profile S p \\\n finite_profile S q \\\n x \\ S \\\n (x \\ elect m S p \\ x \\ elect m S q) \\\n (x \\ reject m S p \\ x \\ reject m S q) \\\n (x \\ defer m S p \\ x \\ defer m S q)\"\n proof (safe)\n show \"electoral_module m\"\n using monotone_m defer_lift_invariance_def\n by metis\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S p\"\n using f_profs\n by simp\n next\n show \"finite S\"\n using f_profs\n by simp\n next\n show \"profile S q\"\n using f_profs\n by simp\n next\n show \"x \\ S\"\n using x_in_S\n by simp\n next\n assume \"x \\ elect m S p\"\n thus \"x \\ elect m S q\"\n using defer_lift_invariance_def defer_m\n lifted_x monotone_m\n by metis\n next\n assume \"x \\ reject m S p\"\n thus \"x \\ reject m S q\"\n using defer_lift_invariance_def defer_m\n lifted_x monotone_m\n by metis\n next\n assume \"x \\ defer m S p\"\n thus \"x \\ defer m S q\"\n using defer_lift_invariance_def defer_m\n lifted_x monotone_m\n by metis\n qed\n qed\n moreover have\n \"\\x \\ S-A. mod_contains_result m (m \\\\<^sub>\\ n) S q x\"\n using A max_agg_rej1 monotone_m monotone_n\n f_profs defer_lift_invariance_def\n by metis\n ultimately have 11:\n \"\\x \\ S-A. prof_contains_result (m \\\\<^sub>\\ n) S p q x\"\n using electoral_mod_defer_elem\n by (simp add: mod_contains_result_def prof_contains_result_def)\n from 10 11\n show ?thesis\n by blast\n qed\n thus \"(m \\\\<^sub>\\ n) S p = (m \\\\<^sub>\\ n) S q\"\n using compatible disjoint_compatibility_def f_profs\n eq_alts_in_profs_imp_eq_results max_par_comp_sound\n by metis\nqed\n\nlemma par_comp_rej_card:\n assumes\n compatible: \"disjoint_compatibility x y\" and\n f_prof: \"finite_profile S p\" and\n reject_sum: \"card (reject x S p) + card (reject y S p) = card S + n\"\n shows \"card (reject (x \\\\<^sub>\\ y) S p) = n\"\nproof -\n from compatible obtain A where A:\n \"A \\ S \\\n (\\a \\ A. indep_of_alt x S a \\\n (\\p. finite_profile S p \\ a \\ reject x S p)) \\\n (\\a \\ S-A. indep_of_alt y S a \\\n (\\p. finite_profile S p \\ a \\ reject y S p))\"\n using disjoint_compatibility_def f_prof\n by metis\n from f_prof compatible\n have reject_representation:\n \"reject (x \\\\<^sub>\\ y) S p = (reject x S p) \\ (reject y S p)\"\n using max_agg_rej_intersect disjoint_compatibility_def\n by blast\n have \"electoral_module x \\ electoral_module y\"\n using compatible disjoint_compatibility_def\n by auto\n hence subsets: \"(reject x S p) \\ S \\ (reject y S p) \\ S\"\n by (simp add: f_prof reject_in_alts)\n hence \"finite (reject x S p) \\ finite (reject y S p)\"\n using rev_finite_subset f_prof reject_in_alts\n by auto\n hence 0:\n \"card (reject (x \\\\<^sub>\\ y) S p) =\n card S + n -\n card ((reject x S p) \\ (reject y S p))\"\n using card_Un_Int reject_representation reject_sum\n by fastforce\n have\n \"\\a \\ S. a \\ (reject x S p) \\ a \\ (reject y S p)\"\n using A f_prof\n by blast\n hence \"S = reject x S p \\ reject y S p\"\n using subsets\n by force\n hence 1: \"card ((reject x S p) \\ (reject y S p)) = card S\"\n by presburger\n from 0 1\n show \"card (reject (x \\\\<^sub>\\ y) S p) = n\"\n by simp\nqed\n\n(*\n Using the max-aggregator for composing two compatible modules in parallel,\n whereof the first one is non-electing and defers exactly one alternative,\n and the second one rejects exactly two alternatives, the composition\n results in an electoral module that eliminates exactly one alternative.\n*)\ntheorem par_comp_elim_one[simp]:\n assumes\n defers_m_1: \"defers 1 m\" and\n non_elec_m: \"non_electing m\" and\n rejec_n_2: \"rejects 2 n\" and\n disj_comp: \"disjoint_compatibility m n\"\n shows \"eliminates 1 (m \\\\<^sub>\\ n)\"\n unfolding eliminates_def\nproof (safe)\n have electoral_mod_m: \"electoral_module m\"\n using non_elec_m\n by (simp add: non_electing_def)\n have electoral_mod_n: \"electoral_module n\"\n using rejec_n_2\n by (simp add: rejects_def)\n show \"electoral_module (m \\\\<^sub>\\ n)\"\n using electoral_mod_m electoral_mod_n\n by simp\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\"\n assume\n min_2_card: \"1 < card A\" and\n fin_A: \"finite A\" and\n prof_A: \"profile A p\"\n have card_geq_1: \"card A \\ 1\"\n using min_2_card dual_order.strict_trans2 less_imp_le_nat\n by blast\n have module: \"electoral_module m\"\n using non_elec_m non_electing_def\n by auto\n have elec_card_0: \"card (elect m A p) = 0\"\n using fin_A prof_A non_elec_m card_eq_0_iff non_electing_def\n by metis\n moreover\n from card_geq_1 have def_card_1:\n \"card (defer m A p) = 1\"\n using defers_m_1 module fin_A prof_A\n by (simp add: defers_def)\n ultimately have card_reject_m:\n \"card (reject m A p) = card A - 1\"\n proof -\n have \"finite A\"\n by (simp add: fin_A)\n moreover have\n \"well_formed A\n (elect m A p, reject m A p, defer m A p)\"\n using fin_A prof_A electoral_module_def module\n by auto\n ultimately have\n \"card A =\n card (elect m A p) + card (reject m A p) +\n card (defer m A p)\"\n using result_count\n by blast\n thus ?thesis\n using def_card_1 elec_card_0\n by simp\n qed\n have case1: \"card A \\ 2\"\n using min_2_card\n by auto\n from case1 have card_reject_n:\n \"card (reject n A p) = 2\"\n using fin_A prof_A rejec_n_2 rejects_def\n by blast\n from card_reject_m card_reject_n\n have\n \"card (reject m A p) + card (reject n A p) =\n card A + 1\"\n using card_geq_1\n by linarith\n with disj_comp prof_A fin_A card_reject_m card_reject_n\n show\n \"card (reject (m \\\\<^sub>\\ n) A p) = 1\"\n using par_comp_rej_card\n by blast\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master - Bevor Range/theories/Compositional_Structures/Maximum_Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.28633032831866884}} {"text": "(*\nTitle: SIFUM-Type-Systems\nAuthors: Sylvia Grewe, Heiko Mantel, Daniel Schoepe\n*)\nsection \\Language for Instantiating the SIFUM-Security Property\\\n\ntheory Language\nimports Main Preliminaries\nbegin\n\nsubsection \\Syntax\\\n\ndatatype 'var ModeUpd = Acq \"'var\" Mode (infix \"+=\\<^sub>m\" 75)\n | Rel \"'var\" Mode (infix \"-=\\<^sub>m\" 75)\n\ndatatype ('var, 'aexp, 'bexp) Stmt = Assign \"'var\" \"'aexp\" (infix \"\\\" 130)\n | Skip\n | ModeDecl \"('var, 'aexp, 'bexp) Stmt\" \"'var ModeUpd\" (\"_@[_]\" [0, 0] 150)\n | Seq \"('var, 'aexp, 'bexp) Stmt\" \"('var, 'aexp, 'bexp) Stmt\" (infixr \";;\" 150)\n | If \"'bexp\" \"('var, 'aexp, 'bexp) Stmt\" \"('var, 'aexp, 'bexp) Stmt\"\n | While \"'bexp\" \"('var, 'aexp, 'bexp) Stmt\"\n | Stop\n\ntype_synonym ('var, 'aexp, 'bexp) EvalCxt = \"('var, 'aexp, 'bexp) Stmt list\"\n\nlocale sifum_lang =\n fixes eval\\<^sub>A :: \"('Var, 'Val) Mem \\ 'AExp \\ 'Val\"\n fixes eval\\<^sub>B :: \"('Var, 'Val) Mem \\ 'BExp \\ bool\"\n fixes aexp_vars :: \"'AExp \\ 'Var set\"\n fixes bexp_vars :: \"'BExp \\ 'Var set\"\n fixes dma :: \"'Var \\ Sec\"\n assumes Var_finite : \"finite {(x :: 'Var). True}\"\n assumes eval_vars_det\\<^sub>A : \"\\ \\ x \\ aexp_vars e. mem\\<^sub>1 x = mem\\<^sub>2 x \\ \\ eval\\<^sub>A mem\\<^sub>1 e = eval\\<^sub>A mem\\<^sub>2 e\"\n assumes eval_vars_det\\<^sub>B : \"\\ \\ x \\ bexp_vars b. mem\\<^sub>1 x = mem\\<^sub>2 x \\ \\ eval\\<^sub>B mem\\<^sub>1 b = eval\\<^sub>B mem\\<^sub>2 b\"\n\ncontext sifum_lang\nbegin\n\n(* To make the examples look a bit nicer in the PDF. *)\n\nnotation (latex output)\n Seq (\"_; _\" 60)\n\nnotation (Rule output)\n Seq (\"_ ; _\" 60)\n\nnotation (Rule output)\n If (\"if _ then _ else _ fi\" 50)\n\nnotation (Rule output)\n While (\"while _ do _ done\")\n\nabbreviation conf\\<^sub>w_abv :: \"('Var, 'AExp, 'BExp) Stmt \\\n 'Var Mds \\ ('Var, 'Val) Mem \\ (_,_,_) LocalConf\"\n (\"\\_, _, _\\\\<^sub>w\" [0, 120, 120] 100)\n where\n \"\\ c, mds, mem \\\\<^sub>w \\ ((c, mds), mem)\"\n\nsubsection \\Semantics\\\n\nprimrec update_modes :: \"'Var ModeUpd \\ 'Var Mds \\ 'Var Mds\"\n where\n \"update_modes (Acq x m) mds = mds (m := insert x (mds m))\" |\n \"update_modes (Rel x m) mds = mds (m := {y. y \\ mds m \\ y \\ x})\"\n\nfun updated_var :: \"'Var ModeUpd \\ 'Var\"\n where\n \"updated_var (Acq x _) = x\" |\n \"updated_var (Rel x _) = x\"\n\nfun updated_mode :: \"'Var ModeUpd \\ Mode\"\n where\n \"updated_mode (Acq _ m) = m\" |\n \"updated_mode (Rel _ m) = m\"\n\ninductive_set eval\\<^sub>w_simple :: \"(('Var, 'AExp, 'BExp) Stmt \\ ('Var, 'Val) Mem) rel\"\nand eval\\<^sub>w_simple_abv :: \"(('Var, 'AExp, 'BExp) Stmt \\ ('Var, 'Val) Mem) \\\n ('Var, 'AExp, 'BExp) Stmt \\ ('Var, 'Val) Mem \\ bool\"\n (infixr \"\\\\<^sub>s\" 60)\n where\n \"c \\\\<^sub>s c' \\ (c, c') \\ eval\\<^sub>w_simple\" |\n assign: \"((x \\ e, mem), (Stop, mem (x := eval\\<^sub>A mem e))) \\ eval\\<^sub>w_simple\" |\n skip: \"((Skip, mem), (Stop, mem)) \\ eval\\<^sub>w_simple\" |\n seq_stop: \"((Seq Stop c, mem), (c, mem)) \\ eval\\<^sub>w_simple\" |\n if_true: \"\\ eval\\<^sub>B mem b \\ \\ ((If b t e, mem), (t, mem)) \\ eval\\<^sub>w_simple\" |\n if_false: \"\\ \\ eval\\<^sub>B mem b \\ \\ ((If b t e, mem), (e, mem)) \\ eval\\<^sub>w_simple\" |\n while: \"((While b c, mem), (If b (c ;; While b c) Stop, mem)) \\ eval\\<^sub>w_simple\"\n\nprimrec cxt_to_stmt :: \"('Var, 'AExp, 'BExp) EvalCxt \\ ('Var, 'AExp, 'BExp) Stmt\n \\ ('Var, 'AExp, 'BExp) Stmt\"\n where\n \"cxt_to_stmt [] c = c\" |\n \"cxt_to_stmt (c # cs) c' = Seq c' (cxt_to_stmt cs c)\"\n\n(* Design decision: Add \"normal\" rule for sequential statements here as well.\n Otherwise, one would have to take care of adding some sort of normalization\n later, so that one doesn't get stuck on expressions of the form (c ;; c') ;; c''.\n*)\n(* Normalization turned out to be more difficult, as it made the proofs of several\n helpful lemmas below quite difficult. *)\n\ninductive_set eval\\<^sub>w :: \"(('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf rel\"\nand eval\\<^sub>w_abv :: \"(('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\\n (('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\ bool\"\n (infixr \"\\\\<^sub>w\" 60)\n where\n \"c \\\\<^sub>w c' \\ (c, c') \\ eval\\<^sub>w\" |\n unannotated: \"\\ (c, mem) \\\\<^sub>s (c', mem') \\\n \\ (\\cxt_to_stmt E c, mds, mem\\\\<^sub>w, \\cxt_to_stmt E c', mds, mem'\\\\<^sub>w) \\ eval\\<^sub>w\" |\n seq: \"\\ \\c\\<^sub>1, mds, mem\\\\<^sub>w \\\\<^sub>w \\c\\<^sub>1', mds', mem'\\\\<^sub>w \\ \\ (\\(c\\<^sub>1 ;; c\\<^sub>2), mds, mem\\\\<^sub>w, \\(c\\<^sub>1' ;; c\\<^sub>2), mds', mem'\\\\<^sub>w) \\ eval\\<^sub>w\" |\n decl: \"\\ \\c, update_modes mu mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ \\\n (\\cxt_to_stmt E (ModeDecl c mu), mds, mem\\\\<^sub>w, \\cxt_to_stmt E c', mds', mem'\\\\<^sub>w) \\ eval\\<^sub>w\"\n\nsubsection \\Semantic Properties\\\n\ntext \\The following lemmas simplify working with evaluation contexts\n in the soundness proofs for the type system(s).\\\n\ninductive_cases eval_elim: \"(((c, mds), mem), ((c', mds'), mem')) \\ eval\\<^sub>w\"\ninductive_cases stop_no_eval' [elim]: \"((Stop, mem), (c', mem')) \\ eval\\<^sub>w_simple\"\ninductive_cases assign_elim' [elim]: \"((x \\ e, mem), (c', mem')) \\ eval\\<^sub>w_simple\"\ninductive_cases skip_elim' [elim]: \"(Skip, mem) \\\\<^sub>s (c', mem')\"\n\nlemma cxt_inv:\n \"\\ cxt_to_stmt E c = c' ; \\ p q. c' \\ Seq p q \\ \\ E = [] \\ c' = c\"\n by (metis cxt_to_stmt.simps(1) cxt_to_stmt.simps(2) neq_Nil_conv)\n\nlemma cxt_inv_assign:\n \"\\ cxt_to_stmt E c = x \\ e \\ \\ c = x \\ e \\ E = []\"\n by (metis Stmt.simps(11) cxt_inv)\n\nlemma cxt_inv_skip:\n \"\\ cxt_to_stmt E c = Skip \\ \\ c = Skip \\ E = []\"\n by (metis Stmt.simps(21) cxt_inv)\n\nlemma cxt_inv_stop:\n \"cxt_to_stmt E c = Stop \\ c = Stop \\ E = []\"\n by (metis Stmt.simps(40) cxt_inv)\n\nlemma cxt_inv_if:\n \"cxt_to_stmt E c = If e p q \\ c = If e p q \\ E = []\"\n by (metis Stmt.simps(37) cxt_inv)\n\nlemma cxt_inv_while:\n \"cxt_to_stmt E c = While e p \\ c = While e p \\ E = []\"\n by (metis Stmt.simps(39) cxt_inv)\n\nlemma skip_elim [elim]:\n \"\\Skip, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ c' = Stop \\ mds = mds' \\ mem = mem'\"\n apply (erule eval_elim)\n apply (metis (lifting) cxt_inv_skip cxt_to_stmt.simps(1) skip_elim')\n apply (metis Stmt.simps(20))\n by (metis Stmt.simps(18) cxt_inv_skip)\n\nlemma assign_elim [elim]:\n \"\\x \\ e, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ c' = Stop \\ mds = mds' \\ mem' = mem (x := eval\\<^sub>A mem e)\"\n apply (erule eval_elim)\n apply (rename_tac c c'a E)\n apply (subgoal_tac \"c = x \\ e \\ E = []\")\n apply auto\n apply (metis cxt_inv_assign)\n apply (metis cxt_inv_assign)\n apply (metis Stmt.simps(8) cxt_inv_assign)\n apply (metis Stmt.simps(8) cxt_inv_assign)\n by (metis Stmt.simps(8) cxt_inv_assign)\n\ninductive_cases if_elim' [elim!]: \"(If b p q, mem) \\\\<^sub>s (c', mem')\"\n\nlemma if_elim [elim]:\n \"\\ P.\n \\ \\If b p q, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w ;\n \\ c' = p; mem' = mem ; mds' = mds ; eval\\<^sub>B mem b \\ \\ P ;\n \\ c' = q; mem' = mem ; mds' = mds ; \\ eval\\<^sub>B mem b \\ \\ P \\ \\ P\"\n apply (erule eval_elim)\n apply (metis (no_types) cxt_inv_if cxt_to_stmt.simps(1) if_elim')\n apply (metis Stmt.simps(36))\n by (metis Stmt.simps(30) cxt_inv_if)\n\ninductive_cases while_elim' [elim!]: \"(While e c, mem) \\\\<^sub>s (c', mem')\"\n\nlemma while_elim [elim]:\n \"\\ \\While e c, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ \\ c' = If e (c ;; While e c) Stop \\ mds' = mds \\ mem' = mem\"\n apply (erule eval_elim)\n apply (metis (no_types) cxt_inv_while cxt_to_stmt.simps(1) while_elim')\n apply (metis Stmt.simps(38))\n by (metis (lifting) Stmt.simps(33) cxt_inv_while)\n\ninductive_cases upd_elim' [elim]: \"(c@[upd], mem) \\\\<^sub>s (c', mem')\"\n\nlemma upd_elim [elim]:\n \"\\c@[upd], mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ \\c, update_modes upd mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w\"\n apply (erule eval_elim)\n apply (metis (lifting) Stmt.simps(28) cxt_inv upd_elim')\n apply (metis Stmt.simps(29))\n by (metis (lifting) Stmt.simps(2) Stmt.simps(29) cxt_inv cxt_to_stmt.simps(1))\n\nlemma cxt_seq_elim [elim]:\n \"c\\<^sub>1 ;; c\\<^sub>2 = cxt_to_stmt E c \\ (E = [] \\ c = c\\<^sub>1 ;; c\\<^sub>2) \\ (\\ c' cs. E = c' # cs \\ c = c\\<^sub>1 \\ c\\<^sub>2 = cxt_to_stmt cs c')\"\n apply (cases E)\n apply (metis cxt_to_stmt.simps(1))\n by (metis Stmt.simps(3) cxt_to_stmt.simps(2))\n\ninductive_cases seq_elim' [elim]: \"(c\\<^sub>1 ;; c\\<^sub>2, mem) \\\\<^sub>s (c', mem')\"\n\nlemma stop_no_eval: \"\\ (\\Stop, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w)\"\n apply auto\n apply (erule eval_elim)\n apply (metis cxt_inv_stop stop_no_eval')\n apply (metis Stmt.simps(41))\n by (metis Stmt.simps(35) cxt_inv_stop)\n\nlemma seq_stop_elim [elim]:\n \"\\Stop ;; c, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w \\ c' = c \\ mds' = mds \\ mem' = mem\"\n apply (erule eval_elim)\n apply clarify\n apply (metis (no_types) cxt_seq_elim cxt_to_stmt.simps(1) seq_elim' stop_no_eval')\n apply (metis Stmt.inject(3) stop_no_eval)\n by (metis Stmt.distinct(23) Stmt.distinct(29) cxt_seq_elim)\n\nlemma cxt_stmt_seq:\n \"c ;; cxt_to_stmt E c' = cxt_to_stmt (c' # E) c\"\n by (metis cxt_to_stmt.simps(2))\n\n\nlemma seq_elim [elim]:\n \"\\ \\c\\<^sub>1 ;; c\\<^sub>2, mds, mem\\\\<^sub>w \\\\<^sub>w \\c', mds', mem'\\\\<^sub>w ; c\\<^sub>1 \\ Stop \\ \\\n (\\ c\\<^sub>1'. \\c\\<^sub>1, mds, mem\\\\<^sub>w \\\\<^sub>w \\c\\<^sub>1', mds', mem'\\\\<^sub>w \\ c' = c\\<^sub>1' ;; c\\<^sub>2)\"\n apply (erule eval_elim)\n apply clarify\n apply (drule cxt_seq_elim)\n apply (erule disjE)\n apply (metis seq_elim')\n apply auto\n apply (metis cxt_to_stmt.simps(1) eval\\<^sub>w.unannotated)\n apply (subgoal_tac \"c\\<^sub>1 = (c@[mu])\")\n apply simp\n apply (drule cxt_seq_elim)\n apply (metis Stmt.distinct(23) cxt_stmt_seq cxt_to_stmt.simps(1) eval\\<^sub>w.decl)\n by (metis Stmt.distinct(23) cxt_seq_elim)\n\nlemma stop_cxt: \"Stop = cxt_to_stmt E c \\ c = Stop\"\n by (metis Stmt.simps(41) cxt_to_stmt.simps(1) cxt_to_stmt.simps(2) neq_Nil_conv)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SIFUM_Type_Systems/Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.28633032038437156}} {"text": "section {* UTP variables *}\n\ntheory utp_urel_laws\n imports \"../../Isabelle-UTP-Extended/theories/Rel/utp_rel_more\"\nbegin\n\nsubsection {* Unrestriction Laws *}\nlemma unrest_iuvar [unrest]: \n \"out\\ \\ $x\" \n by ( rel_auto)\n \nlemma unrest_ouvar [unrest]: \n \"in\\ \\ $x\\\" \n by (rel_auto)\n\nlemma unrest_semir_undash [unrest]:\n fixes x :: \"('a\\ '\\)\"\n assumes \"$x \\ P\"\n shows \"$x \\ P ;; Q\"\n using assms by (rel_auto) \n\nlemma unrest_semir_dash [unrest]:\n fixes x :: \"('a \\ '\\)\"\n assumes \"$x\\ \\ Q\"\n shows \"$x\\ \\ P ;; Q\"\n using assms by (rel_auto)\n\n\nlemma unrest_in\\_var [unrest]:\n \"\\ mwb_lens x; in\\ \\ (P :: ('\\, '\\) rel) \\ \\ $x \\ P\"\n by (pred_auto)\n\nlemma unrest_out\\_var [unrest]:\n \"\\ mwb_lens x; out\\ \\ (P :: ('\\, '\\) rel) \\ \\ $x\\ \\ P\"\n by (pred_auto)\n\nlemma in\\_uvar [simp]: \"vwb_lens in\\\"\n by (unfold_locales, auto simp add: in\\_def)\n\nlemma out\\_uvar [simp]: \"vwb_lens out\\\"\n by (unfold_locales, auto simp add: out\\_def)\n\nlemma unrest_pre_out\\ [unrest]: \"out\\ \\ \\b\\\\<^sub><\"\n by (transfer, auto simp add: out\\_def)\n\nlemma unrest_post_in\\ [unrest]: \"in\\ \\ \\b\\\\<^sub>>\"\n by (transfer, auto simp add: in\\_def)\n\nlemma unrest_pre_in_var [unrest]:\n \"x \\ p1 \\ $x \\ \\p1\\\\<^sub><\"\n by (transfer, simp)\n\nlemma unrest_post_out_var [unrest]:\n \"x \\ p1 \\ $x\\ \\ \\p1\\\\<^sub>>\"\n by (transfer, simp)\n\nlemma unrest_convr_out\\ [unrest]:\n \"in\\ \\ p \\ out\\ \\ p\\<^sup>-\"\n by (pred_auto)\n\nlemma unrest_convr_in\\ [unrest]:\n \"out\\ \\ p \\ in\\ \\ p\\<^sup>-\"\n by (pred_auto)\n\nlemma unrest_in_rel_var_res [unrest]:\n \"vwb_lens x \\ $x \\ (P \\\\<^sub>\\ x)\"\n by (simp add: rel_var_res_def unrest)\n \nlemma unrest_out_rel_var_res [unrest]:\n \"vwb_lens x \\ $x\\ \\ (P \\\\<^sub>\\ x)\"\n by (simp add: rel_var_res_def unrest)\n\nlemma unrest_in_rel_var_res_mwb [unrest]:\n \"mwb_lens x \\ $x \\ (P \\\\<^sub>\\ x)\"\n by (simp add: rel_var_res_def unrest)\n \nlemma unrest_out_rel_var_res_mwb [unrest]:\n \"mwb_lens x \\ $x\\ \\ (P \\\\<^sub>\\ x)\"\n by (simp add: rel_var_res_def unrest)\n\nsubsection {* Substitution laws *}\n\nlemma subst_seq_left [usubst]:\n \"out\\ \\ \\ \\ \\ \\ (P ;; Q) = (\\ \\ P) ;; Q\"\n by transfer (rel_auto, (metis (no_types, lifting) Pair_inject surjective_pairing)+)\n\nlemma subst_seq_right [usubst]:\n \"in\\ \\ \\ \\ \\ \\ (P ;; Q) = P ;; (\\ \\ Q)\"\n by transfer (rel_auto, (metis (no_types, lifting) Pair_inject surjective_pairing)+)\n\ntext {* The following laws support substitution in heterogeneous relations for polymorphically\n types literal expressions. These cannot be supported more generically due to limitations\n in HOL's type system. The laws are presented in a slightly strange way so as to be as \n general as possible. *}\n\nlemma bool_seqr_laws [usubst]:\n \"\\ P Q \\. \\($x \\\\<^sub>s true) \\ (P ;; Q) = \\ \\ (P\\true/$x\\ ;; Q)\"\n \"\\ P Q \\. \\($x \\\\<^sub>s false) \\ (P ;; Q) = \\ \\ (P\\false/$x\\ ;; Q)\"\n \"\\ P Q \\. \\($x\\ \\\\<^sub>s true) \\ (P ;; Q) = \\ \\ (P ;; Q\\true/$x\\\\)\"\n \"\\ P Q \\. \\($x\\ \\\\<^sub>s false) \\ (P ;; Q) = \\ \\ (P ;; Q\\false/$x\\\\)\"\n by (transfer, rel_auto)+\n\nlemma zero_one_seqr_laws [usubst]:\n fixes x :: \"(_ \\ '\\)\"\n shows \n \"\\ P Q \\. \\($x \\\\<^sub>s 0) \\ (P ;; Q) = \\ \\ (P\\0/$x\\ ;; Q)\"\n \"\\ P Q \\. \\($x \\\\<^sub>s 1) \\ (P ;; Q) = \\ \\ (P\\1/$x\\ ;; Q)\"\n \"\\ P Q \\. \\($x\\ \\\\<^sub>s 0) \\ (P ;; Q) = \\ \\ (P ;; Q\\0/$x\\\\)\"\n \"\\ P Q \\. \\($x\\ \\\\<^sub>s 1) \\ (P ;; Q) = \\ \\ (P ;; Q\\1/$x\\\\)\"\n by (transfer, rel_auto)+\n\nlemma numeral_seqr_laws [usubst]:\n fixes x :: \"(_ \\ '\\)\"\n shows \n \"\\ P Q \\. \\($x \\\\<^sub>s numeral n) \\ (P ;; Q) = \\ \\ (P\\numeral n/$x\\ ;; Q)\"\n \"\\ P Q \\. \\($x\\ \\\\<^sub>s numeral n) \\ (P ;; Q) = \\ \\ (P ;; Q\\numeral n/$x\\\\)\"\n by (transfer, rel_auto)+ \n\nlemma usubst_condr [usubst]:\n \"\\ \\ ( P \\ b \\ Q) = (\\ \\ P \\ \\ \\ b \\ \\ \\ Q)\"\n unfolding cond_def\n by rel_auto\n \nlemma subst_skip_r [usubst]:\n \"out\\ \\ \\ \\ \\ \\ II = \\\\\\\\\\<^sub>s\\\\<^sub>a\"\n by (rel_simp, (metis (mono_tags, lifting) prod.sel(1) sndI surjective_pairing)+)\n\nlemma usubst_upd_in_comp [usubst]:\n \"\\(&in\\:x \\\\<^sub>s v) = \\($x \\\\<^sub>s v)\"\n by (pred_auto)\n\nlemma usubst_upd_out_comp [usubst]:\n \"\\(&out\\:x \\\\<^sub>s v) = \\($x\\ \\\\<^sub>s v)\"\n by (pred_auto)\n\nlemma subst_lift_upd [usubst]:\n fixes x :: \"('a \\ '\\)\"\n shows \"\\\\(x \\\\<^sub>s v)\\\\<^sub>s = \\\\\\\\<^sub>s($x \\\\<^sub>s \\v\\\\<^sub><)\"\n by pred_auto\n\nlemma subst_drop_upd [usubst]:\n fixes x :: \"('a \\ '\\)\"\n shows \"\\\\($x \\\\<^sub>s v)\\\\<^sub>s = \\\\\\\\<^sub>s(x \\\\<^sub>s \\v\\\\<^sub><)\"\n by (pred_simp)\n\nlemma subst_lift_pre [usubst]: \"\\\\\\\\<^sub>s \\ \\b\\\\<^sub>< = \\\\ \\ b\\\\<^sub><\"\n by (metis apply_subst_ext fst_vwb_lens in\\_def)\n\nlemma unrest_usubst_lift_in [unrest]:\n \"x \\ P \\ $x \\ \\P\\\\<^sub>s\"\n by (pred_simp)\n\nlemma unrest_usubst_lift_out [unrest]:\n fixes x :: \"('a \\ '\\)\"\n shows \"$x\\ \\ \\P\\\\<^sub>s\"\n by (pred_simp)\n\nsubsection {* Relation laws *}\n\nlemma drop_pre_inv [simp]: \"\\ out\\ \\ p \\ \\ \\\\p\\\\<^sub><\\\\<^sub>< = p\"\n by (pred_simp)\n\nlemma seqr_true_lemma:\n \"(P = (\\ ((\\ P) ;; true))) = (P = (P ;; true))\"\n by (rel_auto)\n theorem precond_equiv:\n \"P = (P ;; true) \\ (out\\ \\ P)\"\n by (rel_auto)\n\ntheorem postcond_equiv:\n \"P = (true ;; P) \\ (in\\ \\ P)\"\n by (rel_auto) \nlemma precond_right_unit: \"out\\ \\ p \\ (p ;; true) = p\"\n by (metis precond_equiv)\n \ntheorem seqr_post_transfer: \"out\\ \\ q \\ (P ;; (q \\ R)) = ((P \\ q\\<^sup>-) ;; R)\"\n by (rel_auto)\n\nlemma seqr_pre_out: \"out\\ \\ p \\ ((p \\ Q) ;; R) = (p \\ (Q ;; R))\"\n by (rel_blast)\n\nlemma postcond_left_unit: \"in\\ \\ p \\ (true ;; p) = p\"\n by (metis postcond_equiv)\n \nlemma seqr_to_conj: \"\\ out\\ \\ P; in\\ \\ Q \\ \\ (P ;; Q) = (P \\ Q)\"\n by (metis postcond_left_unit seqr_pre_out utp_pred_laws.inf_top.right_neutral)\n\nlemma shEx_lift_seq_1 [uquant_lift]:\n \"((\\<^bold>\\ x \\ P x) ;; Q) = (\\<^bold>\\ x \\ (P x ;; Q))\"\n by pred_auto\n\nlemma shEx_lift_seq_2 [uquant_lift]:\n \"(P ;; (\\<^bold>\\ x \\ Q x)) = (\\<^bold>\\ x \\ (P ;; Q x))\"\n by pred_auto \n \nsubsection {* Iterated Sequential Composition Laws *}\n \nlemma iter_seqr_nil [simp]: \"(;; i : [] \\ P(i)) = II\"\n by (simp add: seqr_iter_def)\n \nlemma iter_seqr_cons [simp]: \"(;; i : (x # xs) \\ P(i)) = P(x) ;; (;; i : xs \\ P(i))\"\n by (simp add: seqr_iter_def)\n \ntext {* Quantale laws for relations *}\n\nlemma seq_Sup_distl: \"P ;; (\\ A) = (\\ Q\\A. P ;; Q)\"\n by (transfer, rel_auto)\n \nlemma seq_Sup_distr: \"(\\ A) ;; Q = (\\ P\\A. P ;; Q)\"\n by (transfer, auto)\n \nlemma seq_UINF_distl: \"P ;; (\\ Q\\A \\ F(Q)) = (\\ Q\\A \\ P ;; F(Q))\"\n by (simp add: UINF_as_Sup_collect seq_Sup_distl)\n\nlemma seq_UINF_distl': \"P ;; (\\ Q \\ F(Q)) = (\\ Q \\ P ;; F(Q))\"\n by (metis UINF_mem_UNIV seq_UINF_distl)\n \nlemma seq_UINF_distr: \"(\\ P\\A \\ F(P)) ;; Q = (\\ P\\A \\ F(P) ;; Q)\"\n by (simp add: UINF_as_Sup_collect seq_Sup_distr)\n\nlemma seq_UINF_distr': \"(\\ P \\ F(P)) ;; Q = (\\ P \\ F(P) ;; Q)\"\n by (metis UINF_mem_UNIV seq_UINF_distr)\n\nlemma seq_SUP_distl: \"P ;; (\\i\\A. Q(i)) = (\\i\\A. P ;; Q(i))\"\n by (metis image_image seq_Sup_distl)\n\nlemma seq_SUP_distr: \"(\\i\\A. P(i)) ;; Q = (\\i\\A. P(i) ;; Q)\"\n by (simp add: seq_Sup_distr)\n \nlemma impl_seqr_mono: \"\\ `P \\ Q`; `R \\ S` \\ \\ `(P ;; R) \\ (Q ;; S)`\"\n by transfer (pred_blast)\n\nlemma seqr_mono:\n \"\\ P\\<^sub>1 \\ P\\<^sub>2; Q\\<^sub>1 \\ Q\\<^sub>2 \\ \\ (P\\<^sub>1 ;; Q\\<^sub>1) \\ (P\\<^sub>2 ;; Q\\<^sub>2)\"\n by transfer (rel_blast)\n\nlemma seqr_monotonic: \n \"\\ mono P; mono Q \\ \\ mono (\\ X. P X ;; Q X)\"\n by (simp add: mono_def, transfer ,rel_blast)\n\nlemma cond_mono:\n \"\\ P\\<^sub>1 \\ P\\<^sub>2; Q\\<^sub>1 \\ Q\\<^sub>2 \\ \\ (P\\<^sub>1 \\ b \\ Q\\<^sub>1) \\ (P\\<^sub>2 \\ b \\ Q\\<^sub>2)\"\n unfolding cond_def\n by transfer (rel_auto)\n\nlemma cond_monotonic:\n \"\\ mono P; mono Q \\ \\ mono (\\ X. P X \\ b \\ Q X)\"\n unfolding cond_def\n by (simp add: mono_def, rel_blast)\n\nlemma spec_refine:\n \"Q \\ (P \\ R) \\ (P \\ Q) \\ R\"\n by (rel_auto)\n\nlemma cond_skip: \"out\\ \\ b \\ (b \\ II) = (II \\ b\\<^sup>-)\"\n by (rel_auto)\n\n\nlemma assigns_subst [usubst]:\n \"\\\\\\\\<^sub>s \\ \\\\\\\\<^sub>a = \\\\ \\ \\\\\\<^sub>a\"\n by transfer (rel_auto)\n\nlemma assigns_r_comp: \"(\\\\\\\\<^sub>a ;; P) = (\\\\\\\\<^sub>s \\ P)\"\n by transfer rel_auto\n\nlemma assigns_r_feasible:\n \"(\\\\\\\\<^sub>a ;; true) = true\"\n by (simp add: assigns_r_comp subst_true)\n\nlemma assign_subst [usubst]:\n \"\\ mwb_lens x; mwb_lens y \\ \\ [$x \\\\<^sub>s \\u\\\\<^sub><] \\ (y :== v) = (x, y :== u, [x \\\\<^sub>s u] \\ v)\"\n by rel_auto\n\nlemma assigns_idem: \"mwb_lens x \\ (x,x :== u,v) = (x :== v)\"\n by (simp add: usubst)\n\nlemma assigns_comp: \"(\\f\\\\<^sub>a ;; \\g\\\\<^sub>a) = \\g \\ f\\\\<^sub>a\"\n by (simp add: assigns_r_comp usubst)\n\nlemma assigns_r_conv:\n \"bij f \\ \\f\\\\<^sub>a\\<^sup>- = \\inv f\\\\<^sub>a\"\n by transfer (rel_auto, simp_all add: bij_is_inj bij_is_surj surj_f_inv_f)\n\nlemma assign_pred_transfer:\n fixes x :: \"('a\\ '\\)\"\n assumes \"$x \\ b\" \"out\\ \\ b\"\n shows \"(b \\ x :== v) = (x :== v \\ b\\<^sup>-)\"\n using assms by rel_blast\n\nlemma assigns_r_ufunc: \"ufunctional \\f\\\\<^sub>a\"\n by (rel_auto)\n\nlemma assigns_r_uinj: \"inj f \\ uinj \\f\\\\<^sub>a\"\n by (rel_simp, simp add: inj_eq)\n\nlemma assigns_r_swap_uinj:\n \"\\ vwb_lens x; vwb_lens y; x \\ y \\ \\ uinj (x,y :== &y,&x)\"\n using assigns_r_uinj swap_usubst_inj by rel_auto\n\nlemma skip_r_unfold:\n \"vwb_lens x \\ II = ($x\\ =\\<^sub>u $x \\ II\\\\<^sub>\\x)\"\n by (rel_auto, metis mwb_lens.put_put vwb_lens_mwb vwb_lens_wb wb_lens.get_put)\n\nlemma skip_ra_unfold:\n \"II\\<^bsub>x;y\\<^esub> = ($x\\ =\\<^sub>u $x \\ II\\<^bsub>y\\<^esub>)\"\n by (rel_auto)\n\nlemma skip_res_as_ra:\n \"\\ vwb_lens y; x +\\<^sub>L y \\\\<^sub>L 1\\<^sub>L; x \\ y \\ \\ II\\\\<^sub>\\x = II\\<^bsub>y\\<^esub>\"\n apply (rel_auto)\n apply (metis (no_types, lifting) lens_indep_def)\n apply (metis vwb_lens.put_eq)\ndone\n\nlemma assign_unfold:\n \"vwb_lens x \\ (x :== v) = ($x\\ =\\<^sub>u \\v\\\\<^sub>< \\ II\\\\<^sub>\\x)\"\n apply (rel_auto, auto simp add: comp_def)\n using vwb_lens.put_eq by fastforce\n\nlemma seqr_and_distr_ufunc:\n \"ufunctional P \\ (P ;; (Q \\ R)) = ((P ;; Q) \\ (P ;; R))\"\n by rel_auto\n\nlemma seqr_and_distl_uinj:\n \"uinj R \\ ((P \\ Q) ;; R) = ((P ;; R) \\ (Q ;; R))\"\n by (rel_auto)\n\ntheorem precond_left_zero:\n assumes \"out\\ \\ p\" \"p \\ false\"\n shows \"(true ;; p) = true\"\n using assms by pred_auto\n\nsubsection {* Converse laws *}\n\nlemma convr_invol [simp]: \"p\\<^sup>-\\<^sup>- = p\"\n by pred_auto\n\nlemma lit_convr [simp]: \"\\v\\\\<^sup>- = \\v\\\"\n by pred_auto\n\nlemma uivar_convr [simp]:\n fixes x :: \"('a \\ '\\)\"\n shows \"($x)\\<^sup>- = $x\\\"\n by pred_auto\n\nlemma uovar_convr [simp]:\n fixes x :: \"('a \\ '\\)\"\n shows \"($x\\)\\<^sup>- = $x\"\n by pred_auto\n\nlemma uop_convr [simp]: \"(uop f u)\\<^sup>- = uop f (u\\<^sup>-)\"\n by (pred_auto)\n\nlemma bop_convr [simp]: \"(bop f u v)\\<^sup>- = bop f (u\\<^sup>-) (v\\<^sup>-)\"\n by (pred_auto)\n\nlemma eq_convr [simp]: \"(p =\\<^sub>u q)\\<^sup>- = (p\\<^sup>- =\\<^sub>u q\\<^sup>-)\"\n by (pred_auto)\n\nlemma not_convr [simp]: \"(\\ p)\\<^sup>- = (\\ p\\<^sup>-)\"\n by (pred_auto)\n\nlemma disj_convr [simp]: \"(p \\ q)\\<^sup>- = (q\\<^sup>- \\ p\\<^sup>-)\"\n by (pred_auto)\n\nlemma conj_convr [simp]: \"(p \\ q)\\<^sup>- = (q\\<^sup>- \\ p\\<^sup>-)\"\n by (pred_auto)\n\nlemma seqr_convr [simp]: \"(p ;; q)\\<^sup>- = (q\\<^sup>- ;; p\\<^sup>-)\"\n by rel_auto\n\nlemma pre_convr [simp]: \"\\p\\\\<^sub><\\<^sup>- = \\p\\\\<^sub>>\"\n by (rel_auto)\n\nlemma post_convr [simp]: \"\\p\\\\<^sub>>\\<^sup>- = \\p\\\\<^sub><\"\n by (rel_auto)\n\ntheorem seqr_pre_transfer: \"in\\ \\ q \\ ((P \\ q) ;; R) = (P ;; (q\\<^sup>- \\ R))\"\n by (rel_auto)\n\ntheorem seqr_pre_transfer':\n \"((P \\ \\q\\\\<^sub>>) ;; R) = (P ;; (\\q\\\\<^sub>< \\ R))\"\n by (rel_auto)\n\ntheorem seqr_post_out: \"in\\ \\ r \\ (P ;; (Q \\ r)) = ((P ;; Q) \\ r)\"\n by (rel_blast)\n\nlemma seqr_post_var_out:\n fixes x :: \"(bool \\ '\\)\"\n shows \"(P ;; (Q \\ $x\\)) = ((P ;; Q) \\ $x\\)\"\n by (rel_auto)\n\nlemma seqr_pre_var_out:\n fixes x :: \"(bool \\ '\\)\"\n shows \"(($x \\ P) ;; Q) = ($x \\ (P ;; Q))\"\n by (rel_auto)\n\n\nsubsection {* Relational unrestriction *}\n\ntext {* Relational unrestriction states that a variable is unchanged by a relation. Eventually\n I'd also like to have it state that the relation also does not depend on the variable's\n initial value, but I'm not sure how to state that yet. For now we represent this by\n the parametric healthiness condition RID. *}\n\ndefinition RID :: \"('a \\ '\\) \\ '\\ hrel \\ '\\ hrel\"\nwhere \"RID x P = ((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x)\"\n\ndeclare RID_def [urel_defs]\n\nlemma RID_idem:\n \"mwb_lens x \\ RID(x)(RID(x)(P)) = RID(x)(P)\"\n by (rel_auto)\n\nlemma RID_mono:\n \"P \\ Q \\ RID(x)(P) \\ RID(x)(Q)\"\n by (rel_auto)\n\nlemma RID_skip_r:\n \"vwb_lens x \\ RID(x)(II) = II\"\n apply (rel_auto) using vwb_lens.put_eq by fastforce\n\nlemma RID_disj:\n \"RID(x)(P \\ Q) = (RID(x)(P) \\ RID(x)(Q))\"\n by (rel_auto)\n\nlemma RID_conj:\n \"vwb_lens x \\ RID(x)(RID(x)(P) \\ RID(x)(Q)) = (RID(x)(P) \\ RID(x)(Q))\"\n by (rel_auto)\n\nlemma RID_assigns_r_diff:\n \"\\ vwb_lens x; x \\ \\ \\ \\ RID(x)(\\\\\\\\<^sub>a) = \\\\\\\\<^sub>a\"\n apply (rel_auto)\n apply (metis vwb_lens.put_eq)\n apply (metis vwb_lens_wb wb_lens.get_put wb_lens_weak weak_lens.put_get)\ndone\n\nlemma RID_assign_r_same:\n \"vwb_lens x \\ RID(x)(x :== v) = II\"\n apply (rel_auto)\n using vwb_lens.put_eq apply fastforce\ndone\n\nlemma RID_seq_left:\n assumes \"vwb_lens x\"\n shows \"RID(x)(RID(x)(P) ;; Q) = (RID(x)(P) ;; RID(x)(Q))\"\nproof -\n have \"RID(x)(RID(x)(P) ;; Q) = ((\\ $x \\ \\ $x\\ \\ ((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; Q) \\ $x\\ =\\<^sub>u $x)\"\n by (simp add: RID_def usubst)\n also from assms have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ (\\ $x \\ $x\\ =\\<^sub>u $x)) ;; (\\ $x\\ \\ Q)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_auto)\n also from assms have \"... = (((\\ $x \\ \\ $x\\ \\ P) ;; (\\ $x \\ \\ $x\\ \\ Q)) \\ $x\\ =\\<^sub>u $x)\"\n apply (rel_auto)\n apply (metis vwb_lens.put_eq)\n apply (metis mwb_lens.put_put vwb_lens_mwb)\n done\n also from assms have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; (\\ $x \\ \\ $x\\ \\ Q)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_simp, metis (full_types) mwb_lens.put_put vwb_lens_def wb_lens_weak weak_lens.put_get)\n also have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; ((\\ $x \\ \\ $x\\ \\ Q) \\ $x\\ =\\<^sub>u $x)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_simp, fastforce)\n also have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; ((\\ $x \\ \\ $x\\ \\ Q) \\ $x\\ =\\<^sub>u $x)))\"\n by (rel_auto)\n also have \"... = (RID(x)(P) ;; RID(x)(Q))\"\n by (rel_auto)\n finally show ?thesis .\nqed\n\nlemma RID_seq_right:\n assumes \"vwb_lens x\"\n shows \"RID(x)(P ;; RID(x)(Q)) = (RID(x)(P) ;; RID(x)(Q))\"\nproof -\n have \"RID(x)(P ;; RID(x)(Q)) = ((\\ $x \\ \\ $x\\ \\ P ;; ((\\ $x \\ \\ $x\\ \\ Q) \\ $x\\ =\\<^sub>u $x)) \\ $x\\ =\\<^sub>u $x)\"\n by (simp add: RID_def usubst)\n also from assms have \"... = (((\\ $x \\ P) ;; (\\ $x \\ \\ $x\\ \\ Q) \\ (\\ $x\\ \\ $x\\ =\\<^sub>u $x)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_auto)\n also from assms have \"... = (((\\ $x \\ \\ $x\\ \\ P) ;; (\\ $x \\ \\ $x\\ \\ Q)) \\ $x\\ =\\<^sub>u $x)\"\n apply (rel_auto)\n apply (metis vwb_lens.put_eq)\n apply (metis mwb_lens.put_put vwb_lens_mwb)\n done\n also from assms have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; (\\ $x \\ \\ $x\\ \\ Q)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_simp, metis (full_types) mwb_lens.put_put vwb_lens_def wb_lens_weak weak_lens.put_get)\n also have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; ((\\ $x \\ \\ $x\\ \\ Q) \\ $x\\ =\\<^sub>u $x)) \\ $x\\ =\\<^sub>u $x)\"\n by (rel_simp, fastforce)\n also have \"... = ((((\\ $x \\ \\ $x\\ \\ P) \\ $x\\ =\\<^sub>u $x) ;; ((\\ $x \\ \\ $x\\ \\ Q) \\ $x\\ =\\<^sub>u $x)))\"\n by (rel_auto)\n also have \"... = (RID(x)(P) ;; RID(x)(Q))\"\n by (rel_auto)\n finally show ?thesis .\nqed\n\ndefinition unrest_relation :: \"('a \\ '\\) \\ '\\ hrel \\ bool\" (infix \"\\\\\" 20)\nwhere \"(x \\\\ P) \\ (P = RID(x)(P))\"\n\ndeclare unrest_relation_def [urel_defs]\n\nlemma skip_r_runrest [unrest]:\n \"vwb_lens x \\ x \\\\ II\"\n by (simp add: RID_skip_r unrest_relation_def)\n\nlemma assigns_r_runrest:\n \"\\ vwb_lens x; x \\ \\ \\ \\ x \\\\ \\\\\\\\<^sub>a\"\n by (simp add: RID_assigns_r_diff unrest_relation_def)\n\nlemma seq_r_runrest [unrest]:\n assumes \"vwb_lens x\" \"x \\\\ P\" \"x \\\\ Q\"\n shows \"x \\\\ (P ;; Q)\"\n by (metis RID_seq_left assms unrest_relation_def)\n\nlemma false_runrest [unrest]: \"x \\\\ false\"\n by (rel_auto)\n\nlemma and_runrest [unrest]: \"\\ vwb_lens x; x \\\\ P; x \\\\ Q \\ \\ x \\\\ (P \\ Q)\"\n by (metis RID_conj unrest_relation_def)\n\nlemma or_runrest [unrest]: \"\\ x \\\\ P; x \\\\ Q \\ \\ x \\\\ (P \\ Q)\"\n by (simp add: RID_disj unrest_relation_def)\n\nsubsection {* Alphabet laws *}\n\nlemma aext_cond [alpha]:\n \"(P \\ b \\ Q) \\\\<^sub>p a = ((P \\\\<^sub>p a) \\(b \\\\<^sub>p a)\\(Q \\\\<^sub>p a))\"\n by (rel_auto)\n\nlemma aext_seq [alpha]:\n \"wb_lens a \\ ((P ;; Q) \\\\<^sub>p (a \\\\<^sub>L a)) = ((P \\\\<^sub>p (a \\\\<^sub>L a)) ;; (Q \\\\<^sub>p (a \\\\<^sub>L a)))\"\n by (rel_simp, metis wb_lens_weak weak_lens.put_get)\ntext {* We introduce the power syntax derived from semirings *}\n \nsubsection {* Algebraic Properties *}\n\ninterpretation upred_semiring: semiring_1\n where times = seqr and one = skip_r and zero = false\\<^sub>h and plus = Lattices.sup\n by (unfold_locales, (rel_auto)+)\n\n\nabbreviation upower :: \"'\\ hrel \\ nat \\ '\\ hrel\" (infixr \"\\<^bold>^\" 100) where\n\"upower P n \\ upred_semiring.power P n\"\n\ntranslations\n \"P \\<^bold>^ i\" <= \"CONST power.power II op ;; P i\"\n \"P \\<^bold>^ i\" <= \"(CONST power.power II op ;; P) i\"\n\ntext {* Set up transfer tactic for powers *}\n\nlemma upower_rep_eq:\n \"\\P \\<^bold>^ i\\\\<^sub>e = (\\ b. b \\ ({p. \\P\\\\<^sub>e p} ^^ i))\"\nproof (induct i arbitrary: P)\n case 0\n then show ?case\n by (auto, rel_auto)\nnext\n case (Suc i)\n show ?case\n by (simp add: Suc seqr.rep_eq relpow_commute)\nqed\n\nlemma upower_rep_eq_alt:\n \"\\power.power \\id\\\\<^sub>a op ;; P i\\\\<^sub>e = (\\b. b \\ ({p. \\P\\\\<^sub>e p} ^^ i))\"\n by (metis skip_r_def upower_rep_eq)\n\nupdate_uexpr_rep_eq_thms\n \nlemma Sup_power_expand:\n fixes P :: \"nat \\ 'a::complete_lattice\"\n shows \"P(0) \\ (\\i. P(i+1)) = (\\i. P(i))\"\nproof -\n have \"UNIV = insert (0::nat) {1..}\"\n by auto\n moreover have \"(\\i. P(i)) = \\ (P ` UNIV)\"\n by (blast)\n moreover have \"\\ (P ` insert 0 {1..}) = P(0) \\ SUPREMUM {1..} P\"\n by (simp)\n moreover have \"SUPREMUM {1..} P = (\\i. P(i+1))\"\n by (simp add: atLeast_Suc_greaterThan)\n ultimately show ?thesis\n by (simp only:)\nqed\n\nlemma Sup_upto_Suc: \"(\\i\\{0..Suc n}. P \\<^bold>^ i) = (\\i\\{0..n}. P \\<^bold>^ i) \\ P \\<^bold>^ Suc n\"\nproof -\n have \"(\\i\\{0..Suc n}. P \\<^bold>^ i) = (\\i\\insert (Suc n) {0..n}. P \\<^bold>^ i)\"\n by (simp add: atLeast0_atMost_Suc)\n also have \"... = P \\<^bold>^ Suc n \\ (\\i\\{0..n}. P \\<^bold>^ i)\"\n by (simp)\n finally show ?thesis\n by (simp add: Lattices.sup_commute)\nqed\n\ntext {* The following two proofs are adapted from the AFP entry \n \\href{https://www.isa-afp.org/entries/Kleene_Algebra.shtml}{Kleene Algebra}. \n See also~\\cite{Armstrong2012,Armstrong2015}. *}\n\nlemma seqr_left_unit [simp]:\n \"II ;; P = P\"\n by rel_auto\n\nlemma seqr_right_unit [simp]:\n \"P ;; II = P\"\n by rel_auto\n \nlemma seqr_assoc: \"P ;; (Q ;; R) = (P ;; Q) ;; R\"\n by rel_auto\n\nlemma seqr_assoc': \"(P ;; Q) ;; R = P ;; (Q ;; R) \"\n by rel_auto \n \nlemma upower_inductl: \"Q \\ (P ;; Q \\ R) \\ Q \\ P \\<^bold>^ n ;; R\"\nproof (induct n)\n case 0\n then show ?case by (auto)\nnext\n case (Suc n)\n then show ?case\n by (auto, metis (no_types, hide_lams) dual_order.trans order_refl seqr_assoc seqr_mono)\nqed\n\nlemma upower_inductr:\n assumes \"Q \\ (R \\ Q ;; P)\"\n shows \"Q \\ R ;; (P \\<^bold>^ n)\"\nusing assms proof (induct n)\n case 0\n then show ?case by auto\nnext\n case (Suc n)\n have \"R ;; P \\<^bold>^ Suc n = (R ;; P \\<^bold>^ n) ;; P\"\n by (metis seqr_assoc upred_semiring.power_Suc2)\n also have \"Q ;; P \\ ...\"\n using Suc.hyps assms seqr_mono by auto\n also have \"Q \\ ...\"\n using assms by auto\n finally show ?case .\nqed\n\nlemma SUP_atLeastAtMost_first:\n fixes P :: \"nat \\ 'a::complete_lattice\"\n assumes \"m \\ n\"\n shows \"(\\i\\{m..n}. P(i)) = P(m) \\ (\\i\\{Suc m..n}. P(i))\"\n by (metis SUP_insert assms atLeastAtMost_insertL)\n \nlemma upower_seqr_iter: \"P \\<^bold>^ n = (;; Q : replicate n P \\ Q)\"\n by (induct n) simp_all\n \nsubsubsection {* Kleene Star *}\n\ndefinition ustar :: \"'\\ hrel \\ '\\ hrel\" (\"_\\<^sup>\\\" [999] 999) where\n\"P\\<^sup>\\ = (\\i\\{0..} \\ P\\<^bold>^i)\"\n\nlemma ustar_rep_eq:\n \"\\P\\<^sup>\\\\\\<^sub>e = (\\b. b \\ ({p. \\P\\\\<^sub>e p}\\<^sup>*))\"\n by (simp add: ustar_def, rel_auto, simp_all add: relpow_imp_rtrancl rtrancl_imp_relpow)\n\nupdate_uexpr_rep_eq_thms\n \nsubsubsection {* Omega *}\n\ndefinition uomega :: \"'\\ hrel \\ '\\ hrel\" (\"_\\<^sup>\\\" [999] 999) where\n\"P\\<^sup>\\ = (\\ X \\ P ;; X)\"\n\nsubsection {* Relation Algebra Laws *}\n\ntheorem RA1: \"(P ;; (Q ;; R)) = ((P ;; Q) ;; R)\"\n using seqr_assoc by auto\n\ntheorem RA2: \"(P ;; II) = P\" \"(II ;; P) = P\"\n by simp_all\n\ntheorem RA3: \"P\\<^sup>-\\<^sup>- = P\"\n by simp\n\ntheorem RA4: \"(P ;; Q)\\<^sup>- = (Q\\<^sup>- ;; P\\<^sup>-)\"\n by simp\n\ntheorem RA5: \"(P \\ Q)\\<^sup>- = (P\\<^sup>- \\ Q\\<^sup>-)\"\n by (rel_auto)\n \nnamed_theorems urel_comp \n \nlemma seqr_or_distl[urel_comp]:\n \"((P \\ Q) ;; R) = ((P ;; R) \\ (Q ;; R))\"\n by rel_auto\n \ntheorem RA6: \"((P \\ Q) ;; R) = (P;;R \\ Q;;R)\"\n using seqr_or_distl by blast\n\n\n\nsubsection {* Kleene Algebra Laws *}\n\ntheorem ustar_unfoldl: \"P\\<^sup>\\ \\ II \\ P;;P\\<^sup>\\\"\n by (rel_simp, simp add: rtrancl_into_trancl2 trancl_into_rtrancl)\n\ntheorem ustar_inductl:\n assumes \"Q \\ R\" \"Q \\ P ;; Q\"\n shows \"Q \\ P\\<^sup>\\ ;; R\"\nproof -\n have \"P\\<^sup>\\ ;; R = (\\ i. P \\<^bold>^ i ;; R)\"\n by (simp add: ustar_def UINF_as_Sup_collect' seq_SUP_distr)\n also have \"Q \\ ...\"\n by (simp add: SUP_least assms upower_inductl)\n finally show ?thesis .\nqed\n\ntheorem ustar_inductr:\n assumes \"Q \\ R\" \"Q \\ Q ;; P\"\n shows \"Q \\ R ;; P\\<^sup>\\\"\nproof -\n have \"R ;; P\\<^sup>\\ = (\\ i. R ;; P \\<^bold>^ i)\"\n by (simp add: ustar_def UINF_as_Sup_collect' seq_SUP_distl)\n also have \"Q \\ ...\"\n by (simp add: SUP_least assms upower_inductr)\n finally show ?thesis .\nqed\n\nlemma ustar_refines_nu: \"(\\ X \\ P ;; X \\ II) \\ P\\<^sup>\\\"\n by (metis (no_types, lifting) lfp_greatest semilattice_sup_class.le_sup_iff \n semilattice_sup_class.sup_idem upred_semiring.mult_2_right \n upred_semiring.one_add_one ustar_inductl)\n\nlemma ustar_as_nu: \"P\\<^sup>\\ = (\\ X \\ P ;; X \\ II)\"\nproof (rule antisym)\n show \"(\\ X \\ P ;; X \\ II) \\ P\\<^sup>\\\"\n by (simp add: ustar_refines_nu)\n show \"P\\<^sup>\\ \\ (\\ X \\ P ;; X \\ II)\"\n by (metis lfp_lowerbound upred_semiring.add_commute ustar_unfoldl)\nqed\n \nsubsection {* Omega Algebra Laws *}\n\nlemma uomega_induct:\n \"P ;; P\\<^sup>\\ \\ P\\<^sup>\\\"\n by (simp add: uomega_def, metis eq_refl gfp_unfold monoI seqr_mono)\n\n\nend\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP/utp/utp_urel_laws.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.2862607869528254}} {"text": "theory Construction_Utility\n imports\n Fused_Resource\n State_Isomorphism\nbegin\n\n\\ \\Dummy converters that return a constant value on their external interface\\\n\nprimcorec \n ldummy_converter :: \"('a \\ 'b) \\ ('i_cnv, 'o_cnv, 'i_res, 'o_res) converter \\ \n ('a + 'i_cnv, 'b + 'o_cnv, 'i_res, 'o_res) converter\"\n where\n \"run_converter (ldummy_converter f conv) = (\\inp. case inp of\n Inl x \\ map_gpv (map_prod Inl (\\_. ldummy_converter f conv)) id (Done (f x, ()))\n | Inr x \\ map_gpv (map_prod Inr (\\c. ldummy_converter f c)) id (run_converter conv x))\"\n\nprimcorec \n rdummy_converter :: \"('a \\ 'b) \\ ('i_cnv, 'o_cnv, 'i_res, 'o_res) converter \\ \n ('i_cnv + 'a, 'o_cnv + 'b, 'i_res, 'o_res) converter\"\n where\n \"run_converter (rdummy_converter f conv) = (\\inp. case inp of\n Inl x \\ map_gpv (map_prod Inl (\\c. rdummy_converter f c)) id (run_converter conv x)\n | Inr x \\ map_gpv (map_prod Inr (\\_. rdummy_converter f conv)) id (Done (f x, ())))\"\n\nlemma ldummy_converter_of_callee: \n \"ldummy_converter f (converter_of_callee callee state) = \n converter_of_callee (\\s q. case_sum (\\ql. Done (Inl (f ql), s)) (\\qr. map_gpv (map_prod Inr id) id (callee s qr)) q) state\"\n apply (coinduction arbitrary: callee state)\n apply(clarsimp intro!:rel_funI split!:sum.splits)\n subgoal by blast\n apply (simp add: gpv.rel_map map_prod_def split_def)\n by (rule gpv.rel_mono_strong0[of \"(=)\" \"(=)\"]) (auto simp add: gpv.rel_eq)\n\nlemma rdummy_converter_of_callee: \n \"rdummy_converter f (converter_of_callee callee state) = \n converter_of_callee (\\s q. case_sum (\\ql. map_gpv (map_prod Inl id) id (callee s ql)) (\\qr. Done (Inr (f qr), s)) q) state\"\n apply (coinduction arbitrary: callee state)\n apply(clarsimp intro!:rel_funI split!:sum.splits)\n defer\n subgoal by blast\n apply (simp add: gpv.rel_map map_prod_def split_def)\n by (rule gpv.rel_mono_strong0[of \"(=)\" \"(=)\"]) (auto simp add: gpv.rel_eq)\n\n\n\n\\ \\Commonly used wirings\\\n\ncontext\n fixes\n cnv1 :: \"('icnv_usr1, 'ocnv_usr1, 'iusr1_res1 + 'iusr1_res2, 'ousr1_res1 + 'ousr1_res2) converter\" and\n cnv2 :: \"('icnv_usr2, 'ocnv_usr2, 'iusr2_res1 + 'iusr2_res2, 'ousr2_res1 + 'ousr2_res2) converter\" \nbegin\n\n\\ \\c1r22: a converter that has 1 interface and sends queries to two resources,\n where the first and second resources have 2 and 2 interfaces respectively\\\n \ndefinition \n wiring_c1r22_c1r22 :: \"('icnv_usr1 + 'icnv_usr2, 'ocnv_usr1 + 'ocnv_usr2, \n ('iusr1_res1 + 'iusr2_res1) + 'iusr1_res2 + 'iusr2_res2, \n ('ousr1_res1 + 'ousr2_res1) + 'ousr1_res2 + 'ousr2_res2) converter\"\n where \n \"wiring_c1r22_c1r22 \\ (cnv1 |\\<^sub>= cnv2) \\ parallel_wiring\"\n\nend\n\n\n\\ \\Special wiring converters used for the parallel composition of Fused resources\\\n\ndefinition \n fused_wiring :: \"\n ((('iadv_core1 + 'iadv_core2) + ('iadv_rest1 + 'iadv_rest2)) + \n (('iusr_core1 + 'iusr_core2) + ('iusr_rest1 + 'iusr_rest2)), \n (('oadv_core1 + 'oadv_core2) + ('oadv_rest1 + 'oadv_rest2)) +\n (('ousr_core1 + 'ousr_core2) + ('ousr_rest1 + 'ousr_rest2)),\n (('iadv_core1 + 'iadv_rest1) + ('iusr_core1 + 'iusr_rest1)) + \n (('iadv_core2 + 'iadv_rest2) + ('iusr_core2 + 'iusr_rest2)),\n (('oadv_core1 + 'oadv_rest1) + ('ousr_core1 + 'ousr_rest1)) + \n (('oadv_core2 + 'oadv_rest2) + ('ousr_core2 + 'ousr_rest2))) converter\"\n where\n \"fused_wiring \\ (parallel_wiring |\\<^sub>= parallel_wiring) \\ parallel_wiring\"\n\ndefinition \n fused_wiring\\<^sub>w \n where\n \"fused_wiring\\<^sub>w \\ (parallel_wiring\\<^sub>w |\\<^sub>w parallel_wiring\\<^sub>w) \\\\<^sub>w parallel_wiring\\<^sub>w\"\n\nschematic_goal \n wiring_fused_wiring[wiring_intro]: \"wiring ?\\1 ?\\2 fused_wiring fused_wiring\\<^sub>w\"\n unfolding fused_wiring_def fused_wiring\\<^sub>w_def\n by(rule wiring_intro)+\n\nschematic_goal WT_fused_wiring [WT_intro]: \"?\\1, ?\\2 \\\\<^sub>C fused_wiring \\\"\n unfolding fused_wiring_def\n by(rule WT_intro)+\n\n\n\n\\ \\Commonlu used attachments\\\n\ncontext\n fixes\n cnv1 :: \"('icnv_usr1, 'ocnv_usr1, 'iusr1_core1 + 'iusr1_core2, 'ousr1_core1 + 'ousr1_core2) converter\" and\n cnv2 :: \"('icnv_usr2, 'ocnv_usr2, 'iusr2_core1 + 'iusr2_core2, 'ousr2_core1 + 'ousr2_core2) converter\" and\n res1 :: \"(('iadv_core1 + 'iadv_rest1) + ('iusr1_core1 + 'iusr2_core1) + 'iusr_rest1,\n ('oadv_core1 + 'oadv_rest1) + ('ousr1_core1 + 'ousr2_core1) + 'ousr_rest1) resource\" and\n res2 :: \"(('iadv_core2 + 'iadv_rest2) + ('iusr1_core2 + 'iusr2_core2) + 'iusr_rest2,\n ('oadv_core2 + 'oadv_rest2) + ('ousr1_core2 + 'ousr2_core2) + 'ousr_rest2) resource\"\nbegin\n\n\\ \\Attachement of two c1f22 ('f' instead of 'r' to indicate Fused Resources) converters \n to two 2-interface Fused Resources, the results will be a new 2-interface Fused Resource\\\n\ndefinition \n attach_c1f22_c1f22 :: \"((('iadv_core1 + 'iadv_core2) + 'iadv_rest1 + 'iadv_rest2) + ('icnv_usr1 + 'icnv_usr2) + 'iusr_rest1 + 'iusr_rest2,\n (('oadv_core1 + 'oadv_core2) + 'oadv_rest1 + 'oadv_rest2) + ('ocnv_usr1 + 'ocnv_usr2) + 'ousr_rest1 + 'ousr_rest2) resource\"\n where\n \"attach_c1f22_c1f22 = (((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= ((wiring_c1r22_c1r22 cnv1 cnv2) |\\<^sub>= 1\\<^sub>C)) \\ fused_wiring) \\ (res1 \\ res2)\"\nend\n\n\n\\ \\Properties of Converters attaching to Fused resources\\\ncontext\n fixes\n core1 :: \"('s_core1, 'e1, 'iadv_core1, 'iusr_core1, 'oadv_core1, 'ousr_core1) core\" and\n core2 :: \"('s_core2, 'e2, 'iadv_core2, 'iusr_core2, 'oadv_core2, 'ousr_core2) core\" and\n rest1 :: \"('s_rest1, 'e1, 'iadv_rest1, 'iusr_rest1, 'oadv_rest1, 'ousr_rest1, 'm1) rest_scheme\" and\n rest2 :: \"('s_rest2, 'e2, 'iadv_rest2, 'iusr_rest2, 'oadv_rest2, 'ousr_rest2, 'm2) rest_scheme\"\nbegin\n\nlemma parallel_oracle_fuse:\n \"apply_wiring fused_wiring\\<^sub>w (parallel_oracle (fused_resource.fuse core1 rest1) (fused_resource.fuse core2 rest2)) =\n apply_state_iso parallel_state_iso (fused_resource.fuse (parallel_core core1 core2) (parallel_rest rest1 rest2))\"\n supply fused_resource.fuse.simps[simp]\n apply(rule ext)+\n apply(clarsimp simp add: fused_wiring\\<^sub>w_def apply_state_iso_def parallel_state_iso_def parallel_wiring\\<^sub>w_def)\n apply(simp add: apply_wiring_def comp_wiring_def parallel2_wiring_def lassocr\\<^sub>w_def swap_lassocr\\<^sub>w_def rassocl\\<^sub>w_def swap\\<^sub>w_def)\n subgoal for s_core1 s_rest1 s_core2 s_rest2 i\n apply(cases \"(parallel_rest rest1 rest2, ((s_core1, s_core2), (s_rest1, s_rest2)), i)\" rule: fused_resource.fuse.cases)\n apply(auto split!: sum.splits)\n subgoal for iadv_core\n by (cases iadv_core) (auto simp add: map_spmf_bind_spmf bind_map_spmf intro!: bind_spmf_cong split!: sum.splits)\n subgoal for iadv_rest\n by (cases iadv_rest) (auto simp add: parallel_handler_left parallel_handler_right foldl_spmf_pair_left \n parallel_eoracle_def foldl_spmf_pair_right split_beta o_def map_spmf_bind_spmf bind_map_spmf)\n subgoal for iusr_core\n by (cases iusr_core) (auto simp add: map_spmf_bind_spmf bind_map_spmf intro!: bind_spmf_cong split!: sum.splits)\n subgoal for iusr_rest\n by (cases iusr_rest) (auto simp add: parallel_handler_left parallel_handler_right foldl_spmf_pair_left \n parallel_eoracle_def foldl_spmf_pair_right split_beta o_def map_spmf_bind_spmf bind_map_spmf)\n done\n done\nend\n\nlemma attach_callee_fuse:\n \"attach_callee ((cnv_adv_core \\\\<^sub>I cnv_adv_rest) \\\\<^sub>I cnv_usr_core \\\\<^sub>I cnv_usr_rest) (fused_resource.fuse core rest) =\n apply_state_iso iso_trisplit (fused_resource.fuse (attach_core cnv_adv_core cnv_usr_core core) (attach_rest cnv_adv_rest cnv_usr_rest f_init rest))\"\n (is \"?lhs = ?rhs\")\nproof(intro ext; clarify)\n note fused_resource.fuse.simps [simp]\n let ?tri = \"\\(((s11, s12), s13), (s21, s22), s23). (((s11, s21), s12, s22), s13, s23)\"\n fix q :: \"('g + 'h) + 'i + 'j\"\n consider (ACore) qac where \"q = Inl (Inl qac)\"\n | (ARest) qar where \"q = Inl (Inr qar)\"\n | (UCore) quc where \"q = Inr (Inl quc)\"\n | (URest) qur where \"q = Inr (Inr qur)\"\n using fuse_callee.cases by blast\n then show \"?lhs (((sac, sar), (suc, sur)), (sc, sr)) q = ?rhs (((sac, sar), (suc, sur)), (sc, sr)) q\"\n for sac sar suc sur sc sr\n proof cases\n case ACore\n have \"map_spmf rprodl (exec_gpv (fused_resource.fuse core rest)\n (left_gpv (map_gpv (map_prod Inl (\\s1'. (s1', suc, sur))) id (left_gpv (map_gpv (map_prod Inl (\\s1'. (s1', sar))) id (cnv_adv_core sac qac)))))\n (sc, sr)) =\n (map_spmf (map_prod (Inl \\ Inl) (?tri \\ prod.swap \\ Pair ((sar, sur), sr)))\n (map_spmf (\\((oadv, s_adv'), s_core'). (oadv, (s_adv', suc), s_core'))\n (exec_gpv (cfunc_adv core) (cnv_adv_core sac qac) sc)))\" \n proof(induction arbitrary: sc cnv_adv_core rule: exec_gpv_fixp_parallel_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step execl execr)\n show ?case\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(subst step.IH[unfolded id_def])\n apply(simp add: spmf.map_comp o_def)\n done\n qed\n then show ?thesis using ACore\n by(simp add: apply_state_iso_def iso_trisplit_def map_spmf_conv_bind_spmf[symmetric] spmf.map_comp o_def split_def)\n next\n case ARest\n have \"bind_spmf (foldl_spmf (cpoke core) (return_spmf sc) es) (\\sc'.\n map_spmf rprodl (exec_gpv (fused_resource.fuse core rest)\n (left_gpv (map_gpv (map_prod Inl (\\s1'. (s1', suc, sur))) id (right_gpv (map_gpv (map_prod Inr (Pair sac)) id (cnv_adv_rest sar qar)))))\n (sc', sr))) =\n bind_spmf\n (exec_gpv (\\(s, es) q. map_spmf (\\((out, e), s'). (out, s', es @ e)) (rfunc_adv rest s q)) (cnv_adv_rest sar qar) (sr, es))\n (map_spmf (map_prod id ?tri) \\\n ((\\((o_rfunc, e_lst), s_rfunc). map_spmf (\\s_notify. (Inl (Inr o_rfunc), s_notify, s_rfunc))\n (map_spmf (Pair (sac, suc)) (foldl_spmf (cpoke core) (return_spmf sc) e_lst))) \\\n (\\((oadv, s_adv'), s_rest', es). ((oadv, es), (s_adv', sur), s_rest'))))\"\n for es\n proof(induction arbitrary: sc sr es cnv_adv_rest rule: exec_gpv_fixp_parallel_induct)\n case adm then show ?case by simp\n case bottom then show ?case by simp\n case (step execl execr)\n show ?case \n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf)\n apply(subst bind_commute_spmf)\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf spmf.map_comp o_def map_spmf_conv_bind_spmf[symmetric] intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(subst bind_commute_spmf)\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf spmf.map_comp o_def map_spmf_conv_bind_spmf[symmetric] intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(simp add: bind_spmf_assoc[symmetric] bind_foldl_spmf_return foldl_spmf_append[symmetric] del: bind_spmf_assoc )\n apply(subst step.IH[unfolded id_def])\n apply(simp add: split_def o_def spmf.map_comp)\n done\n qed\n from this[of \"[]\"]\n show ?thesis using ARest\n by(simp add: apply_state_iso_def iso_trisplit_def map_bind_spmf bind_map_spmf map_spmf_conv_bind_spmf[symmetric] foldl_spmf_pair_right)\n next\n case UCore\n have \"map_spmf rprodl (exec_gpv (fused_resource.fuse core rest)\n (right_gpv (map_gpv (map_prod Inr (Pair (sac, sar))) id (left_gpv (map_gpv (map_prod Inl (\\s1'. (s1', sur))) id (cnv_usr_core suc quc)))))\n (sc, sr)) =\n (map_spmf (map_prod (Inr \\ Inl) (?tri \\ prod.swap \\ Pair ((sar, sur), sr)))\n (map_spmf (\\((ousr, s_usr'), s_core'). (ousr, (sac, s_usr'), s_core'))\n (exec_gpv (cfunc_usr core) (cnv_usr_core suc quc) sc)))\"\n proof(induction arbitrary: sc cnv_usr_core rule: exec_gpv_fixp_parallel_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step execl execr)\n show ?case\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(subst step.IH[unfolded id_def])\n apply(simp add: spmf.map_comp o_def)\n done\n qed\n then show ?thesis using UCore\n by(simp add: apply_state_iso_def iso_trisplit_def map_spmf_conv_bind_spmf[symmetric] spmf.map_comp o_def split_def)\n next\n case URest\n have \"bind_spmf (foldl_spmf (cpoke core) (return_spmf sc) es) (\\sc'.\n map_spmf rprodl (exec_gpv (fused_resource.fuse core rest)\n (right_gpv (map_gpv (map_prod Inr (Pair (sac, sar))) id (right_gpv (map_gpv (map_prod Inr (Pair suc)) id (cnv_usr_rest sur qur)))))\n (sc', sr))) =\n bind_spmf\n (exec_gpv (\\(s, es) q. map_spmf (\\((out, e), s'). (out, s', es @ e)) (rfunc_usr rest s q)) (cnv_usr_rest sur qur) (sr, es))\n (map_spmf (map_prod id ?tri) \\\n ((\\((o_rfunc, e_lst), s_rfunc). map_spmf (\\s_notify. (Inr (Inr o_rfunc), s_notify, s_rfunc))\n (map_spmf (Pair (sac, suc)) (foldl_spmf (cpoke core) (return_spmf sc) e_lst))) \\\n (\\((ousr, s_usr'), s_rest', es). ((ousr, es), (sar, s_usr'), s_rest'))))\"\n for es\n proof(induction arbitrary: sc sr es cnv_usr_rest rule: exec_gpv_fixp_parallel_induct)\n case adm then show ?case by simp\n case bottom then show ?case by simp\n case (step execl execr)\n show ?case \n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf)\n apply(subst bind_commute_spmf)\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf spmf.map_comp o_def map_spmf_conv_bind_spmf[symmetric] intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(subst bind_commute_spmf)\n apply(clarsimp simp add: gpv.map_sel map_bind_spmf bind_map_spmf spmf.map_comp o_def map_spmf_conv_bind_spmf[symmetric] intro!: bind_spmf_cong[OF refl] split!: generat.split)\n apply(simp add: bind_spmf_assoc[symmetric] bind_foldl_spmf_return foldl_spmf_append[symmetric] del: bind_spmf_assoc )\n apply(subst step.IH[unfolded id_def])\n apply(simp add: split_def o_def spmf.map_comp)\n done\n qed\n from this[of \"[]\"] show ?thesis using URest\n by(simp add: apply_state_iso_def iso_trisplit_def map_bind_spmf bind_map_spmf map_spmf_conv_bind_spmf[symmetric] foldl_spmf_pair_right)\n qed\nqed\n\nlemma attach_parallel_fuse':\n \"(CNV cnv_adv_core s_a_c |\\<^sub>= CNV cnv_adv_rest s_a_r) |\\<^sub>= (CNV cnv_usr_core s_u_c |\\<^sub>= CNV cnv_usr_rest s_u_r) \\ \n RES (fused_resource.fuse core rest) (s_r_c, s_r_r) = \n RES (fused_resource.fuse (attach_core cnv_adv_core cnv_usr_core core) (attach_rest cnv_adv_rest cnv_usr_rest f_init rest)) (((s_a_c, s_u_c), s_r_c), ((s_a_r, s_u_r), s_r_r))\"\n apply(fold conv_callee_parallel)\n apply(unfold attach_CNV_RES)\n apply(subst attach_callee_fuse)\n apply(subst resource_of_oracle_state_iso)\n apply simp\n apply(simp add: iso_trisplit_def)\n done\n\n\n\\ \\Moving event translators from rest to the core\\\n\ncontext\n fixes\n einit :: 's_event and\n etran :: \"('s_event, 'ievent, 'oevent list) oracle'\" and\n rest :: \"('s_rest, 'ievent, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) rest_wstate\" and\n core :: \"('s_core, 'oevent, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\nbegin\n\nprimcorec\n translate_rest :: \"('s_event \\ 's_rest, 'oevent, 'iadv_rest, 'iusr_rest, 'oadv_rest, 'ousr_rest) rest_wstate\"\n where\n \"rinit translate_rest = (einit, rinit rest)\"\n | \"rfunc_adv translate_rest = translate_eoracle etran (extend_state_oracle (rfunc_adv rest))\"\n | \"rfunc_usr translate_rest = translate_eoracle etran (extend_state_oracle (rfunc_usr rest))\"\n\nprimcorec\n translate_core :: \"('s_event \\ 's_core, 'ievent, 'iadv_core, 'iusr_core, 'oadv_core, 'ousr_core) core\"\n where\n \"cpoke translate_core = (\\(s_event, s_core) event. \n bind_spmf (etran s_event event) (\\(events, s_event'). \n map_spmf (\\s_core'. (s_event', s_core')) (foldl_spmf (cpoke core) (return_spmf s_core) events)))\"\n | \"cfunc_adv translate_core = extend_state_oracle (cfunc_adv core)\"\n | \"cfunc_usr translate_core = extend_state_oracle (cfunc_usr core)\"\n\n\nlemma WT_translate_rest [WT_intro]: \n assumes \"WT_rest \\_adv \\_usr I_rest rest\"\n shows \"WT_rest \\_adv \\_usr (pred_prod (\\_. True) I_rest) translate_rest\"\n by(rule WT_rest.intros)(auto simp add: translate_eoracle_def simp add: WT_restD_rinit[OF assms] dest!: WT_restD(1,2)[OF assms])\n\n\nlemma fused_resource_move_translate:\n \"fused_resource.fuse core translate_rest = apply_state_iso iso_swapar (fused_resource.fuse translate_core rest)\"\nproof -\n note [simp] = exec_gpv_bind spmf.map_comp o_def map_bind_spmf bind_map_spmf bind_spmf_const\n\n show ?thesis\n apply (rule ext)\n apply (rule ext)\n subgoal for s query\n apply (cases s)\n subgoal for s_core s_event s_rest\n apply (cases query)\n subgoal for q_adv\n apply (cases q_adv)\n subgoal for q_acore\n by (simp add: apply_state_iso_def iso_swapar_def fused_resource.fuse.simps split_def map_prod_def)\n subgoal for q_arest\n apply (simp add: apply_state_iso_def iso_swapar_def fused_resource.fuse.simps)\n apply (simp add: translate_eoracle_def split_def)\n apply(rule bind_spmf_cong[OF refl])\n apply(subst foldl_spmf_chain[simplified split_def])\n by simp\n done\n subgoal for q_usr\n apply (cases q_usr)\n subgoal for q_ucore\n by (simp add: apply_state_iso_def iso_swapar_def fused_resource.fuse.simps split_def map_prod_def)\n subgoal for q_urest\n apply (simp add: apply_state_iso_def iso_swapar_def fused_resource.fuse.simps)\n apply (simp add: translate_eoracle_def split_def)\n apply(rule bind_spmf_cong[OF refl])\n apply(subst foldl_spmf_chain[simplified split_def])\n by simp\n done\n done\n done\n done\nqed\n\n\n\nend\n\n\n\\ \\Moving interfaces between rest and core\\\n\nlemma\n fuse_ishift_core_to_rest:\n assumes \"cpoke core' = (\\s. case_sum (\\q. fn s q) (cpoke core s))\"\n and \"cfunc_adv core = cfunc_adv core'\"\n and \"cfunc_usr core = cfunc_usr core' \\\\<^sub>O (\\s i. map_spmf (Pair (h_out i)) (fn s i))\"\n and \"rfunc_adv rest' = (\\s q. map_spmf (apfst (apsnd (map Inr))) (rfunc_adv rest s q))\"\n and \"rfunc_usr rest' = plus_eoracle (\\s i. return_spmf ((h_out i, [i]), s)) (rfunc_usr rest)\"\n shows \"fused_resource.fuse core rest = apply_wiring (1\\<^sub>w |\\<^sub>w lassocr\\<^sub>w) (fused_resource.fuse core' rest')\" (is \"?L = ?R\")\nproof -\n note [simp] = fused_resource.fuse.simps apply_wiring_def lassocr\\<^sub>w_def parallel2_wiring_def \n plus_eoracle_def map_spmf_conv_bind_spmf map_prod_def map_fun_def split_def o_def\n\n have \"?L s q = ?R s q\" for s q\n apply (cases q; cases s)\n subgoal for q_adv\n by (cases q_adv) (simp_all add: assms(1, 2, 4))\n subgoal for q_usr\n apply (cases q_usr)\n subgoal for q_usr_core\n apply (cases q_usr_core)\n subgoal for q_nrm\n by (simp add: assms(3))\n by (simp add: assms(1, 3, 5))\n by (simp add: assms(1, 5))\n done\n\n then show ?thesis\n by blast\nqed\n\n\nlemma move_simulator_interface:\n defines \"x_ifunc \\ (\\ifunc core (se, sc) q. do {\n ((out, es), se') \\ ifunc se q;\n sc' \\ foldl_spmf (cpoke core) (return_spmf sc) es;\n return_spmf (out, se', sc') })\"\n assumes \"cpoke core' = cpoke (translate_core etran core)\"\n and \"cfunc_adv core' = \\(cfunc_adv core) \\\\<^sub>O x_ifunc ifunc core\"\n and \"cfunc_usr core' = cfunc_usr (translate_core etran core)\"\n and \"rinit rest = (einit, rinit rest')\"\n and \"rfunc_adv rest = (\\s q. case q of \n Inl ql \\ map_spmf (apfst (map_prod Inl id)) ((ifunc\\) s ql)\n | Inr qr \\ map_spmf (apfst (map_prod Inr id)) ((translate_eoracle etran (\\(rfunc_adv rest'))) s qr))\"\n and \"rfunc_usr rest = translate_eoracle etran (\\(rfunc_usr rest'))\"\n shows \"fused_resource.fuse core rest = apply_wiring (rassocl\\<^sub>w |\\<^sub>w (id, id))\n (apply_state_iso (rprodl o (apfst prod.swap), (apfst prod.swap) o lprodr)\n (fused_resource.fuse core' rest'))\"\n (is \"?L = ?R\")\nproof -\n note [simp] = fused_resource.fuse.simps apply_wiring_def rassocl\\<^sub>w_def parallel2_wiring_def apply_state_iso_def\n exec_gpv_bind spmf.map_comp map_bind_spmf bind_map_spmf bind_spmf_const o_def split_def\n\n have \"?L (sc, st, sr) q = ?R (sc, st, sr) q\" for sc st sr q\n apply (simp add: map_fun_def map_prod_def prod.swap_def apfst_def lprodr_def rprodl_def id_def)\n using assms apply (cases q)\n subgoal for q_adv\n apply (cases q_adv)\n subgoal for q_adv_core\n by (simp add: map_prod_def)\n subgoal for q_adv_rest\n apply (cases q_adv_rest)\n subgoal for q_adv_rest_ifunc\n by simp\n subgoal for q_adv_rest_etran\n apply (simp add: translate_eoracle_def)\n apply(rule bind_spmf_cong[OF refl])\n apply(subst foldl_spmf_chain[simplified split_def])\n by simp\n done\n done\n subgoal for q_usr\n apply (cases q_usr)\n subgoal for q_usr_core\n by (simp add: map_prod_def)\n subgoal for q_usr_rest\n apply (simp add: translate_eoracle_def extend_state_oracle_def)\n apply(rule bind_spmf_cong[OF refl])\n apply(subst foldl_spmf_chain[simplified split_def])\n by simp\n done\n done\n\n then show ?thesis\n by force\nqed\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Construction_Utility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2862607791529429}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Tactic for solving monadic equalities, such as:\n *\n * (liftE (return 3) = returnOk 3\n *\n * Theorems of the form:\n *\n * ((a, s') \\ fst (A s)) = P a s s'\n *\n * and\n *\n * snd (A s) = P s\n *\n * are added to the \"monad_eq\" set.\n *)\ntheory MonadEq\nimports \"wp/NonDetMonadVCG\"\nbegin\n\n(* Setup \"monad_eq\" attributes. *)\nML {*\nstructure MonadEqThms = Named_Thms (\n val name = Binding.name \"monad_eq\"\n val description = \"monad equality-prover theorems\"\n )\n*}\nattribute_setup monad_eq = {*\n Attrib.add_del\n (Thm.declaration_attribute MonadEqThms.add_thm)\n (Thm.declaration_attribute MonadEqThms.del_thm) *}\n \"Monad equality-prover theorems\"\n\n(* Setup tactic. *)\n\nML {*\nfun monad_eq_tac ctxt =\nlet\n (* Set a simpset as being hidden, so warnings are not printed from it. *)\n val ctxt' = Context_Position.set_visible false ctxt\nin\n CHANGED (clarsimp_tac (ctxt' addsimps (MonadEqThms.get ctxt')) 1)\nend\n*}\n\nmethod_setup monad_eq = {*\n Method.sections Clasimp.clasimp_modifiers >> (K (SIMPLE_METHOD o monad_eq_tac)) *}\n \"prove equality on monads\"\n\nlemma monad_eq_simp_state [monad_eq]:\n \"((A :: ('s, 'a) nondet_monad) s = B s') =\n ((\\r t. (r, t) \\ fst (A s) \\ (r, t) \\ fst (B s'))\n \\ (\\r t. (r, t) \\ fst (B s') \\ (r, t) \\ fst (A s))\n \\ (snd (A s) = snd (B s')))\"\n apply (auto intro!: set_eqI prod_eqI)\n done\n\nlemma monad_eq_simp [monad_eq]:\n \"((A :: ('s, 'a) nondet_monad) = B) =\n ((\\r t s. (r, t) \\ fst (A s) \\ (r, t) \\ fst (B s))\n \\ (\\r t s. (r, t) \\ fst (B s) \\ (r, t) \\ fst (A s))\n \\ (\\x. snd (A x) = snd (B x)))\"\n apply (auto intro!: set_eqI prod_eqI)\n done\n\ndeclare in_monad [monad_eq]\ndeclare in_bindE [monad_eq]\n\n(* Test *)\nlemma \"returnOk 3 = liftE (return 3)\"\n apply monad_eq\n oops\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/MonadEq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.2862607713530605}} {"text": "(* Title: Jive Data and Store Model\n Author: Norbert Schirmer and \n Nicole Rauch , 2005\n Maintainer: Nicole Rauch \n License: LGPL\n*)\n\nsection \\Program-Independent Lemmas on Attributes\\\n\ntheory AttributesIndep\nimports \"../Isa_Counter_Store/Attributes\"\nbegin\n\ntext \\The following lemmas validate the functions defined in the Attributes theory.\nThey also aid in subsequent proving tasks. Since they are\nprogram-independent, it is of no use to add them to the generation process of\nAttributes.thy. Therefore, they have been extracted to this theory.\n\\\n\nlemma cls_catt [simp]: \n \"CClassT c \\ dtype f \\ cls (catt c f) = c\"\n apply (case_tac c)\n apply (case_tac [!] f)\n apply simp_all\n \\ \\solves all goals where @{text \"CClassT c \\ dtype f\"}\\\n apply (fastforce elim: subtype_wrong_elims simp add: subtype_defs)+\n \\ \\solves all the rest where @{text \"\\ CClassT c \\ dtype f\"} can be derived\\\n done\n\nlemma att_catt [simp]: \n \"CClassT c \\ dtype f \\ att (catt c f) = f\"\n apply (case_tac c)\n apply (case_tac [!] f)\n apply simp_all\n \\ \\solves all goals where @{text \"CClassT c \\ dtype f\"}\\\n apply (fastforce elim: subtype_wrong_elims simp add: subtype_defs)+\n \\ \\solves all the rest where @{text \"\\ CClassT c \\ dtype f\"} can be \n derived\\\n done\n\ntext \\The following lemmas are just a demonstration of simplification.\\\n\nlemma rtype_att_catt: \n \"CClassT c \\ dtype f \\ rtype (att (catt c f)) = rtype f\"\n by simp\n\nlemma widen_cls_dtype_att [simp,intro]: \n \"(CClassT (cls cf) \\ dtype (att cf)) \"\n by (cases cf, simp_all)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JiveDataStoreModel/Isabelle_Store/AttributesIndep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2862607710877943}} {"text": "theory RCU\nimports RCU_model\nbegin \n\n(*the following must be included in the proof:\n\ncon_assms ps --- concerns allocation/bounds of C and rcu_0+i for all i\nmain_inv ms --- main invariant has 3 parts\n\nnts::\npsem_rules ps --- how allocation works on the inside\n\ntedious - general_structure ms --- says how n \\ s \\ detaddrs\nallocated_addresses ms ps ********* --- allocation for above are defined here\nsimple - observation_inv_ms ms --- how own\\<^sub>W affects loc status (own\\<^sub>W loc = t \\ loc\\{s,n,det} t)\nhard - observation_inv_sig ms ps \\ --- limits which values can be WM_read from C\nsimple - own\\<^sub>W_n_by_t_imp ms\n\n\nt \\ T_max\nstep ms ps \\ (pc ms t) t ms' ps' \\' --- defines a program step by t\nlast - preCond ms ps \\ (pc ms t) t --- defines preconditions for t to proceed with stepping \n\n\n\n\n*)\n\n\n\n(*the following describes originally reserved addresses*)\ndefinition \"default_locs \\ {i | i a. i=C \\ i = rcu_0+a \\ a\\T_max }\"\n\ndefinition \"reserved_bydef ps \\ \\i. i\\default_locs \\ \\isfree_addr i ps\"\n\ndefinition \"reservations_differ \\ \\i. i\\T_max \\ C\\rcu_0+i\"\n\ndefinition \"con_assms ps \\ reserved_bydef ps \\ reservations_differ \"\n\nlemmas con_lemmas [simp] = reserved_bydef_def reservations_differ_def default_locs_def\n\n\n\n(*----------------Main Invariant Shown--------------------*)\n\nlemma main_invariant_1_preservation:\n \"main_inv ms ps \\ \n t\\T_max \\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n cvd[C,vala] \\ \\\n observation_inv_sig ms ps \\ \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n main_inv_1 ms'\"\n apply simp \n apply(simp add: step_def preCond_def general_structure_lemmas main_inv_lemmas)\n apply(case_tac \"pc ms t\", simp_all add:abbr) apply clarsimp\n apply (metis insert_not_empty option.sel) apply clarsimp\n apply(case_tac \"repeat ms t\", simp_all) \n apply (metis option.sel)\n apply (metis option.sel)\n (*FAAZ*) defer\n apply clarsimp\n apply (metis option.sel)\n apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) ya y \\ ts')\", simp_all)\n apply (metis option.sel)\n apply (metis option.sel)\n apply (metis Diff_empty Diff_insert0 insert_Diff singleton_insert_inj_eq)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply clarsimp\n apply (metis option.sel)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply (metis Diff_empty Diff_insert0 insert_absorb insert_iff)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply clarsimp\n apply (metis option.sel)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply clarsimp\n apply (metis option.sel)\n apply(case_tac \"reg ms t = 1\", simp_all add:abbr)\n apply(simp add: FAAZ_def get_C_val_def)\n apply(clarsimp) (*y \\ value \\ (a, b), where value \\ (a, b) is retrieved from reading C*)\n apply(simp_all add: covered_v_def lastWr_def observation_inv_sig_def visible_writes_def)\n by (metis option.sel own\\<^sub>W_n_by_t_imp_def)\n\n\nlemma main_invariant_2_preservation:\n \"main_inv ms ps \\ \n t\\T_max \\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n cvd[C,vala] \\ \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\\n main_inv_2 ms' ps'\"\n apply simp \n apply(simp add: step_def preCond_def general_structure_lemmas main_inv_lemmas)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n apply clarsimp\n apply clarsimp\n apply(case_tac \"repeat ms t\", simp_all) \n apply (metis subset_singleton_iff) \n (*FAAZ*) defer\n apply clarsimp\n apply clarsimp apply(case_tac \" snd (CAS t (a, b) ya y \\ ts')\", simp_all)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr) \n (*detached rules*) defer\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"reg ms t = 1\", simp_all add:abbr)\n apply(simp add: FAAZ_def get_C_val_def)\n apply(clarsimp) (*y \\ value \\ (a, b), where value \\ (a, b) is retrieved from reading C*)\n apply(simp add: covered_v_def observation_inv_sig_def visible_writes_def)\n apply blast\n (*the detached list property*)\n apply clarify apply(intro conjI impI)\n apply(subgoal_tac \"hd(det ms t) \\ detaddrs ms t\", simp_all) \n apply(subgoal_tac \"det ms t \\ []\") prefer 2\n apply blast\n apply(subgoal_tac \"det ms t!0 = hd(det ms t)\") prefer 2\n apply (metis hd_conv_nth)\n by blast\n\n\n\nlemma main_invariant_3_preservation:\n \"main_inv ms ps \\ \n t\\T_max \\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n psem_rules ps \\\n cvd[C,vala] \\ \\\n own\\<^sub>W_n_by_t_imp ms \\\n main_inv_3 ms' ps'\"\n apply simp \n apply(simp add: step_def preCond_def general_structure_lemmas main_inv_lemmas)\n apply(case_tac \"pc ms t\", simp_all add:abbr Wcap_def Rcap_def)\n apply clarsimp \n apply (meson own\\<^sub>W_n_by_t_imp_def)\n apply clarsimp\n apply(case_tac \"repeat ms t\", simp_all add:own\\<^sub>W_n_by_t_imp_def) \n apply clarsimp \n apply(case_tac \"loc = ya\", simp_all) \n apply (metis less_nat_zero_code list.size(3) option.sel) \n (*FAAZ*) defer\n apply clarsimp apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) ya y \\ ts')\", simp_all) \n apply (meson option.distinct(1)) \n apply (metis option.discI)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"reg ms t = 1\", simp_all add:abbr)\n apply(simp add: FAAZ_def get_C_val_def)\n apply(clarsimp) (*y \\ value \\ (a, b), where value \\ (a, b) is retrieved from reading C*)\n by(case_tac \"loc = value \\ (a, b)\", simp_all) \n\n\n\n\nlemma main_invariant_preservation:\n \"main_inv ms ps \\ \n t\\T_max \\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n cvd[C,vala] \\ \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\ \nmain_inv ms' ps'\"\n unfolding main_inv_def\n apply(intro conjI impI)\n using main_invariant_1_preservation main_inv_def apply blast\n using main_invariant_2_preservation main_inv_def apply blast\n using main_invariant_3_preservation main_inv_def apply blast\n done\n\n(*--------------------------------------------------------------------*)\n\n(*------------------------observation_inv_sig Correctness---------------------------*)\n\nlemma supp1:\n \"cvd[C,vala] \\ \\\n \\ [z \\ ya]\\<^sub>t \\' \\\n cvd[C,vala] \\'\"\n apply(simp add:covered_v_def lastWr_def OpSem.step_def RdX_def visible_writes_def) unfolding writes_on_def\n read_trans_def\n by (smt (z3) Collect_cong rev_app_def surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) update_thrView_def value_def)\n\nlemma supp2:\n \"cvd[C,vala] \\ \\\n \\ [z := ya]\\<^sub>t \\' \\\n z\\C \\\n cvd[C,vala] \\'\"\n apply(simp add:covered_v_def lastWr_def OpSem.step_def WrX_def visible_writes_def value_def) unfolding writes_on_def\n write_trans_def update_thrView_def update_mods_def \n update_modView_def valid_fresh_ts_def \n rev_app_def tst_def \n apply auto\n sledgehammer\n\n\nlemma Local_correctness:\n \"main_inv ms ps \\ \n t\\T_max \\\n general_structure ms \\\n step ms ps \\ (pc ms t) t ms' ps' \\' \\ \n preCond ms ps \\ (pc ms t) t \\ \n observation_inv_sig ms ps \\ \\\n cvd[C,vala] \\ \\\n psem_rules ps \\\n own\\<^sub>W_n_by_t_imp ms \\ \nobservation_inv_sig ms' ps' \\'\"\n apply(simp add:step_def preCond_def)\n apply(case_tac \"pc ms t\")\n apply simp_all \n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply (simp add:abbr)\n apply(simp add:observation_inv_sig_def)\n apply clarsimp apply(simp add:covered_v_def)\n apply metis\n apply(simp add:abbr) \n(*RCU_enter()*)defer\n (*RCU_exit()*) defer\n (*RCU_enter()*)defer\n apply(simp add:abbr FAAZ_def get_C_val_def)\n apply(simp add:covered_v_def visible_writes_def observation_inv_sig_def)\n apply(simp add:lastWr_def) apply clarify\n defer\n apply (simp add: observation_inv_sig_def) apply clarify\n apply(simp add:abbr) apply clarsimp\n apply(simp add:general_structure_lemmas main_inv_lemmas own\\<^sub>W_n_by_t_imp_def Wcap_def Rcap_def)\n unfolding covered_v_def writes_on_def\n apply clarify\n sledgehammer\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*--------------------------------------------------------------------*)\n\n\nlemma preservation_of_variables_1_by_others:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"ta \\ t\"\nshows \"n ms ta = n ms' ta\"\n using assms\n apply(simp add:step_def)\n apply(simp add:preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp_all add:abbr)\n apply clarify\n apply(simp_all add:general_structure_lemmas) apply clarsimp apply(simp add:get_C_val_def)\n apply(simp add:FAAZ_def)\n apply(simp add: visible_writes_def)\n apply clarsimp\n apply clarsimp \n apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts')\", simp_all)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply(clarsimp)\n by(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\n\nlemma preservation_of_variables_2_by_others:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"ta \\ t\"\nshows \"s ms ta = s ms' ta\"\n using assms \n apply(simp add:step_def)\n apply(simp add:preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp_all add:abbr)\n apply clarify\n apply(simp_all add:general_structure_lemmas)apply(simp add:get_C_val_def)\n apply(simp add:FAAZ_def)\n apply(simp add: visible_writes_def) \n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts')\", simp_all)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply(clarsimp)\n by(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\n\nlemma preservation_of_variables_3_by_others:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"ta \\ t\"\nshows \"det ms ta = det ms' ta\"\n using assms\n apply(simp add:step_def)\n apply(simp add:preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp_all add:abbr)\n apply clarify\n apply(simp_all add:general_structure_lemmas)apply(simp add:get_C_val_def)\n apply(simp add:FAAZ_def)\n apply(simp add: visible_writes_def) \n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts')\", simp_all)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(clarsimp)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply(clarsimp)\n by(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\nlemma preservation_of_variables_inset_by_others:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ t\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"own\\<^sub>W ms loc = Some ta\"\n and \"observation_inv_ms ms\"\nshows \"(loc \\ (detaddrs ms' ta) \\ Some loc = s ms' ta \\ Some loc = n ms' ta)\"\n using assms \n apply(subgoal_tac \"(det ms' ta) = (det ms ta)\") prefer 2 \n using preservation_of_variables_3_by_others\n apply force\n apply(subgoal_tac \"the (s ms' ta) = the (s ms ta)\") prefer 2 \n using preservation_of_variables_2_by_others\n apply force\n apply(subgoal_tac \"the (n ms' ta) = the (n ms ta)\") prefer 2 \n using preservation_of_variables_1_by_others\n apply force \n apply(simp add:observation_inv_ms_def) \n by (metis assms(5) preservation_of_variables_1_by_others preservation_of_variables_2_by_others)+\n \n\n\n\n\nlemma preservation_of_variables_ninset_by_others:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ t\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"(loc \\ (detaddrs ms ta) \\ Some loc \\ s ms ta \\ Some loc \\ n ms ta)\"\n and \"observation_inv_ms ms\"\nshows \"(loc \\ (detaddrs ms' ta) \\ Some loc \\ s ms' ta \\ Some loc \\ n ms' ta)\"\n using assms apply simp\n by (simp add: preservation_of_variables_1_by_others \n preservation_of_variables_2_by_others \n preservation_of_variables_3_by_others)\nlemma preservation_of_ownership_by_others:\n \"preCond ms ps \\ (pc ms t) t\n\\ own\\<^sub>W ms loc = Some ta \n\\ ta\\t \n\\ ta\\T_max\n\\ t\\T_max\n\\ main_inv_2 ms ps\n\\ main_inv_3 ms ps\n\\ observation_inv_ms ms\n\\ own\\<^sub>W_n_by_t_imp ms\n\\ general_structure ms\n\\ step ms ps \\ (pc ms t) t ms' ps' \\' \n \\ own\\<^sub>W ms' loc = Some ta\"\n apply(simp add:step_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n (*n:=newint*) defer\n (*FAAZ*) defer\n apply force\n (*cas_step_rcu*) defer\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply force\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t\", simp_all add:abbr)\n (*kill*) defer\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply force\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n apply force\n apply(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\n apply clarsimp\n apply(case_tac \"loc = loca\", simp_all)\n using get_C_val_def mstate.simps(17) apply force apply clarify\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts')\", simp_all)\n apply(simp add:observation_inv_ms_def)\n apply(subgoal_tac \"loc \\ (detaddrs ms ta \\ s_and_n ms ta)\") prefer 2\n apply(simp add:detaddrs_def s_and_n_def)\n apply(simp add:general_structure_lemmas)\n apply(simp add:preCond_def)\n apply meson\n apply(simp add:general_structure_lemmas)\n apply(simp add:preCond_def observation_inv_ms_def own\\<^sub>W_n_by_t_imp_def)\n apply(case_tac \"Some loc = (n ms ta)\") \n apply (metis (no_types, lifting) hd_conv_nth length_greater_0_conv option.distinct(1) option.sel)\n apply (metis (no_types, lifting) option.sel)\n apply(simp add:preCond_def Wcap_def) \n apply (metis option.sel)\n apply(simp add:preCond_def Wcap_def) \n apply(simp add:general_structure_lemmas)\n (*ta cannot own\\<^sub>W ms LOC where LOC \\ det_addrs ms t*) \n sorry\n \n \n\nlemma preservation_of_nownership_by_others:\n \"preCond ms ps \\ (pc ms t) t\n\\ own\\<^sub>W ms loc \\ Some ta \n\\ ta\\t \n\\ t\\T_max \n\\ ta\\T_max\n\\ step ms ps \\ (pc ms t) t ms' ps' \\' \n \\ own\\<^sub>W ms' loc \\ Some ta\"\n apply (simp add:step_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n apply safe\n apply (smt (z3) fun_upd_apply mstate.simps(17) mstate.surjective mstate.update_convs(1) mstate.update_convs(16) mstate.update_convs(17) option.sel)\n apply(simp add:get_C_val_def FAAZ_def)\n apply safe \n apply simp+\n apply(case_tac \"loc = the (n ms t)\", simp_all)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n by(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\n\n\nlemma preservation_of_observation_inv_ms:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"observation_inv_ms ms\"\n and \"main_inv_2 ms ps\"\n and \"main_inv_3 ms ps\"\n and \"observation_inv_sig ms ps \\\"\n and \"own\\<^sub>W_n_by_t_imp ms\"\n and \"general_structure ms\"\n and \"psem_rules ps\"\nshows \"observation_inv_ms ms'\"\n using assms unfolding observation_inv_ms_def apply simp apply clarify\n apply(case_tac \"ta \\ t\")\n (*ta\\t*)\n apply(simp add:step_def preCond_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n apply clarsimp \n apply blast\n apply blast\n apply blast \n apply clarsimp \n apply (meson own\\<^sub>W_n_by_t_imp_def)\n apply (meson own\\<^sub>W_n_by_t_imp_def)\n apply (meson own\\<^sub>W_n_by_t_imp_def)\n apply (meson own\\<^sub>W_n_by_t_imp_def)\n (*FAAZ, ta\\t*) defer\n apply(simp add:Wcap_def own\\<^sub>W_n_by_t_imp_def general_structure_lemmas Rcap_def)\n sledgehammer\n\n\n\n\n\n\n\n sorry\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nlemma own\\<^sub>W_imp_not_free:\n assumes \"main_inv ms ps\"\n and \"own\\<^sub>W ms loc \\ None\"\nshows \"\\isfree_addr loc ps\"\n using assms apply (simp_all add:main_inv_def)\n by blast\n\n\n\n\nlemma global_sig_invariant_preserved:\n \"con_assms ps \\\nmain_inv ms ps\\\nobservation_inv_ms ms\\\nmain_inv_2 ms ps\\ \nmain_inv_3 ms ps\\ \nobservation_inv_sig ms ps \\\\ \nown\\<^sub>W_n_by_t_imp ms\\ \ngeneral_structure ms\\ \npsem_rules ps\\ \nt \\ T_max\\\nstep ms ps \\ (pc ms t) t ms' ps' \\'\\\npreCond ms ps \\ (pc ms t) t\\\nobservation_inv_sig ms' ps' \\'\n\"\n unfolding observation_inv_sig_def step_def preCond_def\n apply(case_tac \"pc ms t\", simp_all add:abbr covered_v_def con_assms_def main_inv_def observation_inv_ms_def)\n apply(simp_all add:own\\<^sub>W_n_by_t_imp_def general_structure_lemmas)\n apply meson\n apply meson\n apply meson\n apply (metis domI domIff) apply clarsimp sledgehammer\n apply (metis domI domIff)\n apply (metis domI domIff)\n apply meson\n apply meson\n apply meson\n\n\n\n\n\n\n\n\n\n\n\n\nlemma ms_observation_lemma_Correctness_supp_4:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"t \\ T_max\"\n and \"ta \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"ta \\ t\" \n and \"own\\<^sub>W ms loc = Some ta\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"main_inv_3 ms ps\"\n and \"observation_inv_ms ms\"\nshows \"own\\<^sub>W ms' loc = Some ta\"\n using assms \n apply(subgoal_tac \"\\isfree_addr loc ps\") prefer 2\n apply (metis option.distinct(1) own_imp_1) apply (simp_all)\n apply(simp add:step_def)\n apply(simp add:preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp_all add:abbr)\n apply clarify\n apply(simp_all add:general_structure_lemmas)\n apply(subgoal_tac \"loc\\loca\", simp_all add:Rcap_def Wcap_def) \n apply clarsimp apply(simp add:get_C_val_def)\n apply(simp add:FAAZ_def)\n apply(simp add: visible_writes_def) apply clarsimp \n apply clarsimp \n apply(simp add: visible_writes_def) apply clarsimp\n apply(case_tac \"(snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts'))\", simp_all)\n apply (metis option.sel)\n apply(case_tac \"CAS_succ ms t\", simp_all add:abbr) apply clarsimp\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr) apply clarsimp\n apply(case_tac \"det ms t\", simp_all add:abbr observation_inv_ms_def) apply clarify\n apply clarsimp\n sorry\n\n\n\n\n\nlemma FAAZ_wm_prelim1:\n assumes \"ms \\ s:=\\<^sup>FC t ms' \\'\"\n and \"wfs \\\"\n and \"cvd[C,valaa] \\\"\nshows \"cvd[C,valaa] \\'\"\n using assms apply (simp add:get_C_val_def FAAZ_def) apply(clarify) \n apply(simp add:update_trans_def covered_v_def Let_def rev_app_def add_cv_def update_mods_def update_modView_def\n update_thrView_def)\n apply(unfold writes_on_def value_def lastWr_def) apply safe\n apply (metis fst_conv var_def)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def)\n apply(simp add:visible_writes_def tst_def var_def valid_fresh_ts_def)\n apply(unfold writes_on_def value_def lastWr_def wfs_def var_def) apply safe\n (*ts; is max, nempty \\ finite*) defer\n apply auto[1] \n apply(simp) apply(intro conjI)\n apply (meson subset_iff visible_writes_in_writes)\n apply presburger\n apply (metis fst_conv)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv)\n (*ts; is max*) defer \n apply(simp) apply(intro conjI)\n apply (meson subset_iff visible_writes_in_writes)\n apply presburger\n sorry\n\nlemma FAAZ_wm_prelim2:\n assumes \"ms \\ s:=\\<^sup>FC t ms' \\'\"\n and \"wfs \\\"\n and \"\\val. cvd[C,val] \\ \\ val\\ loca\"\nshows \"\\val. cvd[C,val] \\' \\ val\\ loca\"\n using assms\n using FAAZ_wm_prelim1 by blast\n\nlemma FAAZ_wm_prelim3:\n assumes \"ms \\ s:=\\<^sup>FC t ms' \\'\"\n and \"wfs \\\"\n and \"cvd[C,valaa] \\\"\n and \"valaa \\ loca\"\nshows \"\\val. cvd[C,val] \\' \\ val\\ loca\"\n using assms \n using FAAZ_wm_prelim1 by blast\n\nlemma FAAZ_wm_prelim4:\n assumes \"ms \\ s:=\\<^sup>FC t ms' \\'\"\n and \"wfs \\\"\n and \"observation_inv_sig ms ps \\\"\n and \"psem_rules ps \"\n and \"general_structure ms\"\nshows \"observation_inv_sig ms' ps' \\'\"\n using assms \n apply(simp add:observation_inv_sig_def general_structure_lemmas)\n apply clarify\n apply(intro conjI impI)\n apply(case_tac \"ta = t\")\n apply(subgoal_tac \"own\\<^sub>W ms loc = Some ta \\ own\\<^sub>W ms' loc = Some ta\", simp_all)\n apply(simp add:get_C_val_def)\n sledgehammer\n\n\n\n\nlemma sigma_observation_lemma_Correctness:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"wfs \\\"\n and \"psem_rules ps\"\n and \"t \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"observation_inv_ms ms\"\n and \"observation_inv_sig ms ps \\\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"main_inv_3 ms ps\"\nshows \"observation_inv_sig ms' ps' \\'\"\n using assms apply (simp_all)\n apply(simp add:preCond_def RCU.step_def)\n apply(case_tac \"pc ms t\", simp_all add:abbr)\n apply(simp add:covered_v_def general_structure_lemmas )\n apply clarify\n apply(unfold observation_inv_sig_def observation_inv_ms_def)\n apply clarify apply(simp_all)\n apply(case_tac \"isfree_addr loc ps\", simp_all)\n apply blast apply clarify\n apply(case_tac \"isfree_addr loc ps\", simp_all)\n apply clarify\n apply(case_tac \"isfree_addr loc ps\", simp_all)\n apply clarify apply(simp add:general_structure_lemmas)\n apply(case_tac \"loc = loca\", simp_all) \n apply metis \n apply meson \n defer (*rcu_enter*)\n defer (*rcu_exit*)\n defer (*rcu_enter*)\n apply clarify\n apply(intro conjI impI)\n using FAAZ_wm_prelim2 [where ms = ms and ms' = ms' and \\ = \\ and \\' = \\' and t=t and loca=loc]\n apply simp\n apply(clarsimp)\n apply(case_tac \"t \\ T_max \\ own\\<^sub>W ms loca = Some t\", simp_all)\n apply (meson FAAZ_wm_prelim1)\n apply(case_tac \"((\\x. (\\a. x = {a} \\ (\\b. (a, b) \\ ran (A ps))) \\ loca \\ x))\")\n apply (metis FAAZ_wm_prelim1)\n apply clarify\n sledgehammer\n\n\n apply metis\n apply(simp add:general_structure_lemmas)\n sledgehammer\n\n\n by (metis (full_types))+\n\n\n\nlemma ms_observation_lemma_Correctnesssss:\n assumes \"preCond ms ps \\ (pc ms t) t\"\n and \"wfs \\\"\n and \"psem_rules ps\"\n and \"t \\ T_max\"\n and \"step ms ps \\ (pc ms t) t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"observation_inv_ms ms ps\"\n and \"observation_inv_sig ms ps \\\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"main_inv_3 ms ps\"\n and \"cvd[C,vala] \\\"\nshows \"observation_inv_ms ms' ps'\"\n using assms apply (simp_all) \n apply(simp add:preCond_def)\n apply(case_tac \"pc ms t\", simp_all)\n apply(simp add:covered_v_def general_structure_lemmas)\n apply clarify\n apply(unfold observation_inv_sig_def observation_inv_ms_def)\n apply(subgoal_tac \"\\loc t. t\\T_max \\ own\\<^sub>W ms' loc = Some t\n \\ loc\\(detaddrs ms' t \\ s_and_n ms' t) \") \n apply clarify\n apply(subgoal_tac \"loc \\ detaddrs ms ta\", simp add:detaddrs_def)\n apply blast\n\n sorry\n\n\n\n\n\n\n\n\n\n\n\nlemma main_invariant_Correctness:\n assumes \"preCond ms ps \\ pcr t\"\n and \"t \\ T_max\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"pcr = pc ms t\"\n and \"step ms ps \\ pcr t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"pcr' = pc ms' t\"\n and \"observation_inv_ms ms ps\"\n and \"observation_inv_sig ms ps \\\"\nshows \"main_inv ms'\"\n using assms apply (simp add:preCond_def step_def)\n apply(case_tac[!] \"pc ms t\", simp_all add:abbr) \n apply(intro allI)\n apply(intro impI) apply(elim conjE exE) apply(simp add:isfree_addr_def) \n apply (metis insert_not_empty option.sel) \n apply(intro allI)\n apply(simp add:general_structure_lemmas)\n apply metis\n defer (*I8*)\n defer (*I9*)\n defer (*I11*)\n apply(simp add:general_structure_lemmas)\n apply metis \n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp_all add:abbr)\n defer (*R2*)\n apply(simp add:general_structure_lemmas) apply(case_tac \"nondet_val ms t = True\", simp_all)\n apply(simp_all add:abbr)\n apply(case_tac \"det ms t \\ []\", simp_all) \n apply(simp_all add:abbr)\n apply(simp add:general_structure_lemmas)\n apply (metis Diff_empty Diff_insert0 insert_absorb insert_iff)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(simp_all add:abbr)\n defer (*S3*)\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp_all add:abbr)\n defer (*S6*)\n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:abbr)\n apply(simp add:abbr)\n apply(clarify) \n apply(simp add:get_C_val_def) \n apply(subgoal_tac \"(snd (FAAZ t (a, b) \\ ts')) \\ the(n ms ta)\", simp add:FAAZ_def) (*need this as pre_cond*)\n \n apply (metis option.sel)\n defer\n apply clarify\n apply(subgoal_tac \"own\\<^sub>R ms (the(n ms ta)) = {ta}\") prefer 2\n apply(simp add:general_structure_lemmas) \n apply (metis option.sel)\n apply(simp add:general_structure_lemmas) \n apply clarify\n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) (the (n ms t)) \\ ts') \")\n apply(subgoal_tac \"n_dec ms' t = False\") prefer 2\n apply(simp add:general_structure_lemmas)\n apply(simp add:general_structure_lemmas) \n apply (metis option.sel)\n apply(simp add:general_structure_lemmas) \n apply (metis option.sel) \n apply(simp add:general_structure_lemmas) \n apply clarify\n apply(case_tac \"b\", simp_all) prefer 2 \n apply (metis option.sel) \n apply (metis option.sel) \n apply(simp add:general_structure_lemmas)\n apply clarify apply(simp add:names_2)\n apply (metis option.sel) \n apply(simp add:general_structure_lemmas)\n apply clarify\n apply(case_tac \"v\", simp_all) prefer 2\n apply (metis option.sel)\n apply (metis option.sel)\n apply(simp add: visible_writes_def) \n apply(simp add:observation_lemma_def general_structure_lemmas covered_v_def FAAZ_def) \n apply(simp add:Wcap_def)\n by (metis option.sel)\n \n\n\n\n\nlemma main_invariant_2_Correctness:\n assumes \"preCond ms ps \\ pcr t\"\n and \"t \\ T_max\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"pcr = pc ms t\"\n and \"step ms ps \\ pcr t ms' ps' \\'\" (*and \"allocated_n_addr ms ps \" seems redundant*)\n and \"general_structure ms\"\n and \"pcr' = pc ms' t\"\n and \"observation_lemma \\ ms\"\nshows \"main_inv_2 ms' ps'\"\n using assms apply simp\n apply(simp add:step_def) apply(case_tac \"pc ms t\", simp_all add:abbr) \n apply(simp add:general_structure_lemmas preCond_def)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n (*FAAZ*)\n defer \n apply(simp add:general_structure_lemmas preCond_def)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n apply(simp add:general_structure_lemmas preCond_def)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n apply(case_tac \"snd (CAS t (a, b) (the (s ms t)) y \\ ts') \") prefer 2\n apply simp\n apply simp\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(case_tac \"det ms t \\ []\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n (*show that own\\<^sub>R ms i \\ det ms t \\ at some point is only held by {t}*)\n defer\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n apply(case_tac \"reg ms t = Suc 0\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n (*FAAZ*)\n apply(simp add:general_structure_lemmas preCond_def abbr)\n apply(elim conjE exE, intro allI impI)\n apply(simp add:names_2) \n defer\n \n sledgehammer\n oops\n\n\n\nlemma General_Structure_Correctness:\n assumes \"preCond ms ps \\ pcr t\"\n and \"t \\ T_max\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"pcr = pc ms t\"\n and \"step ms ps \\ pcr t ms' ps' \\'\" \n and \"general_structure ms\"\n and \"pcr' = pc ms' t\"\n and \"observation_lemma \\ ms\"\n and \"\\prov loc. prov \\ dom(A ps) \\ isfree_addr loc ps\"\nshows \"general_structure ms'\"\n using assms apply simp\n apply(simp add:step_def) apply(case_tac \"pc ms t\", simp_all add:abbr) \n apply(simp_all add:general_structure_lemmas preCond_def names_2)\n apply metis\n apply metis \n defer\n apply metis \n defer\n defer\n defer\n apply metis\n defer\n defer\n apply(elim conjE exE)\n apply(case_tac \"b\", simp_all)\n apply(case_tac \"nondet_val ms t\", simp_all add:abbr)\n apply(case_tac \"det ms t = []\", simp_all add:abbr)\n defer\n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all add:abbr)\n defer\n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all add:abbr)\n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all add:abbr)\n defer\n apply(case_tac \"reg ms t = Suc 0\", simp_all add:abbr)\n prefer 2\n apply(simp add:FAAZ_def)\n apply(simp add:allocated_addresses_def observation_lemma_def)\n apply (metis option.sel)\n apply(intro conjI impI) prefer 2\n apply clarify\n apply(case_tac \"ta = t\", simp_all) prefer 2\n apply (metis option.sel) apply clarify\n apply(intro conjI impI)\n apply(subgoal_tac \"y \\ alloc_addrs ps\") prefer 2\n apply blast\n apply(subgoal_tac \"the (s ms t) \\ alloc_addrs ps\") \n apply blast\n apply(subgoal_tac \"allocated_addresses ms ps\", simp_all add:allocation_lemmas)\n oops\n\n\n\n\nlemma Global_Correctness:\n assumes \"preCond ms ps \\ pcr\\<^sub>t t\"\n and \"preCond ms ps \\ pcr\\<^sub>t\\<^sub>' t'\" \n and \"pcr\\<^sub>t = pc ms t\"\n and \"pcr\\<^sub>t\\<^sub>' = pc ms t'\"\n and \"t \\ t'\"\n and \"main_inv ms\"\n and \"main_inv_2 ms ps\"\n and \"step ms ps \\ pcr\\<^sub>t t ms' ps' \\'\" (*and \"allocated_n_addr ms ps \" seems redundant*)\n and \"general_structure ms\"\n and \"pcr' = pc ms' t\"\nshows \"preCond ms' ps' \\' pcr\\<^sub>t\\<^sub>' t'\"\n using assms apply simp\n apply(simp add:step_def) apply(case_tac \"pc ms t\", simp_all add:abbr) \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n\n (*existential complication*) defer\n apply(simp add:general_structure_lemmas preCond_def) \n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n (*existential complication, FAAZ*) defer\n (*weak memory read s*)defer\n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n (*existential complication, CAS*)defer\n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n\n apply(case_tac \"CAS_succ ms t\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(elim conjE impE exE)\n apply(case_tac \"b\", simp_all)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis \n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2) \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n\n apply(case_tac \"nondet_val ms t\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n apply(case_tac \"det ms t \\ []\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n (*existential complication, kill(x)*)defer\n \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n apply(case_tac \"CTRsync\\<^sub>1 ms t < T_max\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n (*existential complication, (rcu_0 + CTRsync\\<^sub>1) weak memory read*)defer\n \n apply(case_tac \"CTRsync\\<^sub>2 ms t < T_max\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n apply(case_tac \"r ms t (CTRsync\\<^sub>2 ms t) = 0\", simp_all)\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n \n defer\n\n apply(case_tac \"reg ms t = Suc 0\", simp_all) \n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n \n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n apply(simp add:general_structure_lemmas preCond_def)\n apply(case_tac \"pc ms t'\", simp_all add:abbr names_2)\n apply metis apply metis apply metis apply metis apply metis apply metis\n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis apply metis \n apply metis apply metis apply metis apply metis apply metis\n\n(*weak memory guarantees needed, I think (maybe I'm wrong)*)\n oops\n\n\n\n\n\n\n\n(*lemma test2:\n assumes \"wfs \\\"\n and \"get_C_val ms \\ t ms' \\'\"\n and \"cvd[C,u] \\\"\nshows \"cvd[C,u] \\'\"\n using assms apply (simp add:get_C_val_def FAAZ_def) apply(clarify) \n apply(simp add:update_trans_def covered_v_def Let_def rev_app_def add_cv_def update_mods_def update_modView_def\n update_thrView_def)\n apply(unfold writes_on_def value_def lastWr_def) apply safe\n apply (metis fst_conv var_def)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def)\n apply(simp add:visible_writes_def tst_def var_def valid_fresh_ts_def)\n apply(unfold writes_on_def value_def lastWr_def wfs_def var_def) apply safe\n (*ts; is max, nempty \\ finite*) defer\n apply auto[1] \n apply(simp) apply(intro conjI)\n apply (meson subset_iff visible_writes_in_writes)\n apply presburger\n apply (metis fst_conv)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv var_def visible_var)\n apply (metis fst_conv)\n (*ts; is max*) defer \n apply(simp) apply(intro conjI)\n apply (meson subset_iff visible_writes_in_writes)\n apply presburger\n sorry*)\n\n\n\n\n \n(*\nOWNERSHIP IDEAS:\n\n\n\\i. (i\\addrs) \\ (the(own\\<^sub>W ms i)=t)\n\n\nWe have to get to this stage after sync():\n\\s i j. (s\\det\\<^sub>i \\ i\\j) \\ T\\<^sub>j \\ own\\<^sub>R(s)\n\nbecause:\n T\\<^sub>j \\ own\\<^sub>R(s) \\ T\\<^sub>j \\ own\\<^sub>W(s)\n\nThis allows for pop() operation to guarantee that no thread could allocate n:=newint as n:=s\nunless:\n\nown\\<^sub>W(s) = T\\<^sub>i \\ own\\<^sub>R(s) = { T\\<^sub>i }\npop()\nown\\<^sub>W(s) = None \\ own\\<^sub>R(s) = {}\n\n\n(Call threads t, t...)\n\nThis is absolutely guaranteed if sync() occurs deterministically:\n\\j. j |det\\<^sub>j| \\ 1\n\\s j i. (s\\det\\<^sub>j \\ i\\j \\ i1(j) \\ r[i] = 0) \\ T\\<^sub>i \\ own\\<^sub>R(s) (backward sync)\n\\s j i. (s\\det\\<^sub>j \\ i\\j \\ i2(j)) \\ T\\<^sub>i \\ own\\<^sub>R(s) (backward sync)\n\\s j i. (s\\det\\<^sub>j \\ i\\j \\ CTRsync\\<^sub>2(j) < N \\ i = CTRsync\\<^sub>2(j) \\ [rcu[i] \\ 0]\\<^sub>j) \\ T\\<^sub>i \\ own\\<^sub>R(s) (backward sync)\nNo thread i. (j\\i) can allocate n:=newint to have address s, since own\\<^sub>W(s) = T\\<^sub>j\nIf a thread i attemps to read s=C while in rcu[i] (weak memory), this can only happen if:\nCTRsync\\<^sub>1 = N \\ r[i] = 1 \\ i\\CTRsync\\<^sub>2\nIn that case, it should be impossible for CAS\\<^sub>j to succeed, resulting in eventual rcu_exit() by j with no swap,\n(no matter how many times j performs rcu_enter()/rcu_exit() ***careful in WM setting - fence*** )\nwhich should cause {while rcu[j]} to terminate and perform CTRsync\\<^sub>2++\n\nNondeterministically:\n\\j. j |det\\<^sub>j| \\ 0\n\\s j i. (s\\det\\<^sub>j \\ i\\j \\ i2) \\ T\\<^sub>i \\ own\\<^sub>R(s) (backward sync)\n\\s j i. (s\\det\\<^sub>j \\ i\\j \\ i1 \\ r[i] = 0) \\ T\\<^sub>i \\ own\\<^sub>R(s) (backward sync)\n\nonly requirement is that own\\<^sub>W(s) = T\\<^sub>j to limit allocation of n:=newint to s by T\\<^sub>i\nT\\<^sub>j faces the same problem, since n:=newint, where newint=s, requires own\\<^sub>W(s) = Null.\n\n\n\nREASONS FOR OWNERSHIP OVER NO-OWNERSHIP:\nlimited in Deterministic setting.\nno requirement of insert(det\\<^sub>j) to track order of insertion.\nease of visualisation when n:=newint happens\n\n\npop of A\\<^sub>2 doesnt occur.\n*)\n\n(*definition \"FAAZ t w \\ ts' \\ \n (update_trans t w (value \\ w) \\ ts', value \\ w)\"*)\n\n\n\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/RCU (Brijesh Dongol's conflicted copy 2022-11-01).thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2862243507044631}} {"text": "(* Title: BDD\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(*\nLevellistProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Proof of Procedure Levellist\\\ntheory LevellistProof imports ProcedureSpecs Simpl.HeapList begin\n\nhide_const (open) DistinctTreeProver.set_of tree.Node tree.Tip\n\n\n\n(*a well formed levellist is a list that contains all nodes with variable\ni on position i\nbecause the elements of levellist can contain old elements before the call of Levellist,\nsubdag_eq t pt can not be postulated for all elements of the sublists. One has to make\nshure that the initial call of Levellist is parameterized with a levellist with empty sublists.\nOtherwise some problems could arise in the call of Reduce!\n(\\ ptt. (Dag pt low high ptt \\ subdag_eq (Node lt p rt) ptt \\ pt\\var = i))\nconsts wf_levellist :: \"dag \\ ref list list \\ ref list list \\\n (ref \\ nat) \\ (ref \\ ref) \\ (ref \\ ref) \\ bool\"\ndefs wf_levellist_def: \"wf_levellist t levellist_old levellist_new var low high \\\ncase t of Tip \\ levellist_old = levellist_new\n| (Node lt p rt) \\\n (\\ q. q \\ set_of t \\ q \\ set (levellist_new ! (q\\var))) \\\n (\\ i \\ p\\var. (\\ prx. (levellist_new ! i) = prx@(levellist_old ! i)\n \\ (\\ pt \\ set prx. pt \\ set_of t \\ pt\\var = i))) \\\n (\\ i. (p\\var) < i \\ (levellist_new ! i) = (levellist_old ! i)) \\\n (length levellist_new = length levellist_old)\"\n*)\n\n\nlemma all_stop_cong: \"(\\x. P x) = (\\x. P x)\"\n by simp\n\nlemma Dag_RefD:\n \"\\Dag p l r t; p\\Null\\ \\\n \\lt rt. t=Node lt p rt \\ Dag (l p) l r lt \\ Dag (r p) l r rt\"\n by simp\n\nlemma Dag_unique_ex_conjI:\n \"\\Dag p l r t; P t\\ \\ (\\t. Dag p l r t \\ P t)\"\n by simp\n\n(* FIXME: To BinDag *)\nlemma dag_Null [simp]: \"dag Null l r = Tip\"\n by (simp add: dag_def)\n\ndefinition first:: \"ref list \\ ref\" where\n\"first ps = (case ps of [] \\ Null | (p#rs) \\ p)\"\n\nlemma first_simps [simp]:\n \"first [] = Null\"\n \"first (r#rs) = r\"\nby (simp_all add: first_def)\n\ndefinition Levellist:: \"ref list \\ (ref \\ ref) \\ (ref list list) \\ bool\" where\n\"Levellist hds next ll \\ (map first ll = hds) \\\n (\\i < length hds. List (hds ! i) next (ll!i))\"\n\nlemma Levellist_unique:\n assumes ll: \"Levellist hds next ll\"\n assumes ll': \"Levellist hds next ll'\"\n shows \"ll=ll'\"\nproof -\n from ll have \"length ll = length hds\"\n by (clarsimp simp add: Levellist_def)\n moreover\n from ll' have \"length ll' = length hds\"\n by (clarsimp simp add: Levellist_def)\n ultimately have leq: \"length ll = length ll'\" by simp\n show ?thesis\n proof (rule nth_equalityI [OF leq, rule_format])\n fix i\n assume \"i < length ll\"\n with ll ll'\n show \"ll!i = ll'!i\"\n apply (clarsimp simp add: Levellist_def)\n apply (erule_tac x=i in allE)\n apply (erule_tac x=i in allE)\n apply simp\n by (erule List_unique)\n qed\nqed\n\nlemma Levellist_unique_ex_conj_simp [simp]:\n\"Levellist hds next ll \\ (\\ll. Levellist hds next ll \\ P ll) = P ll\"\nby (auto dest: Levellist_unique)\n\n\nlemma in_set_concat_idx:\n \"x \\ set (concat xss) \\ \\i < length xss. x \\ set (xss!i)\"\napply (induct xss)\napply simp\napply clarsimp\napply (erule disjE)\napply (rule_tac x=0 in exI)\napply simp\napply auto\ndone\n\ndefinition wf_levellist :: \"dag \\ ref list list \\ ref list list \\\n (ref \\ nat) \\ bool\" where\n\"wf_levellist t levellist_old levellist_new var =\n(case t of Tip \\ levellist_old = levellist_new\n| (Node lt p rt) \\\n (\\ q. q \\ set_of t \\ q \\ set (levellist_new ! (var q))) \\\n (\\ i \\ var p. (\\ prx. (levellist_new ! i) = prx@(levellist_old ! i)\n \\ (\\ pt \\ set prx. pt \\ set_of t \\ var pt = i))) \\\n (\\ i. (var p) < i \\ (levellist_new ! i) = (levellist_old ! i)) \\\n (length levellist_new = length levellist_old))\"\n\nlemma wf_levellist_subset:\n assumes wf_ll: \"wf_levellist t ll ll' var\"\n shows \"set (concat ll') \\ set (concat ll) \\ set_of t\"\nproof (cases t)\n case Tip with wf_ll show ?thesis by (simp add: wf_levellist_def)\nnext\n case (Node lt p rt)\n show ?thesis\n proof -\n {\n fix n\n assume \"n \\ set (concat ll')\"\n from in_set_concat_idx [OF this]\n obtain i where i_bound: \"i < length ll'\" and n_in: \"n \\ set (ll' ! i)\"\n by blast\n have \"n \\ set (concat ll) \\ set_of t\"\n proof (cases \"i \\ var p\")\n case True\n with wf_ll obtain prx where\n ll'_ll: \"ll' ! i = prx @ ll ! i\" and\n prx: \"\\pt \\ set prx. pt \\ set_of t\" and\n leq: \"length ll' = length ll\"\n apply (clarsimp simp add: wf_levellist_def Node)\n apply (erule_tac x=\"i\" in allE)\n apply clarsimp\n done\n show ?thesis\n proof (cases \"n \\ set prx\")\n case True\n with prx have \"n \\ set_of t\"\n by simp\n thus ?thesis by simp\n next\n case False\n with n_in ll'_ll\n have \"n \\ set (ll ! i)\"\n by simp\n with i_bound leq\n have \"n \\ set (concat ll)\"\n by auto\n thus ?thesis by simp\n qed\n next\n case False\n with wf_ll obtain \"ll'!i = ll!i\" \"length ll' = length ll\"\n by (auto simp add: wf_levellist_def Node)\n with n_in i_bound\n have \"n \\ set (concat ll)\"\n by auto\n thus ?thesis by simp\n qed\n }\n thus ?thesis by auto\n qed\nqed\n(*\n next\n show \"set (concat ll) \\ set_of t \\ set (concat ll')\"\n proof -\n {\n fix n\n assume \"n \\ set (concat ll)\"\n from in_set_concat_idx [OF this]\n obtain i where i_bound: \"i < length ll\" and n_in: \"n \\ set (ll ! i)\"\n by blast\n with wf_ll\n obtain \"n \\ set (ll' ! i)\" \"length ll = length ll'\"\n apply (clarsimp simp add: wf_levellist_def Node)\n apply (case_tac \"i \\ var p\")\n apply fastforce\n apply fastforce\n done\n with i_bound have \"n \\ set (concat ll')\"\n by auto\n }\n moreover\n {\n fix n\n assume \"n \\ set_of t\"\n with wf_ll obtain \"n \\ set (ll' ! var n)\" \"length ll' = length ll\"\n by (auto simp add: wf_levellist_def Node)\n with root\n\n next\n\n proof (cases prx)\n case Nil\n with ll'_ll i_bound leq n_in\n have \"n \\ set (concat ll)\"\n by auto\n thus ?thesis by simp\n next\n case (Cons p prx')\n show ?thesis\n\n apply auto\n *)\n\n\n(*\nconsts wf_levellist :: \"dag \\ ref list \\ ref list \\\n (ref \\ ref) \\ (ref \\ ref) \\\n (ref \\ nat) \\ bool\"\ndefs wf_levellist_def:\n\"wf_levellist t levellist_old levellist_new next_old next_new var \\\ncase t of Tip \\ levellist_old = levellist_new\n| (Node lt p rt) \\\n (\\ q. q \\ set_of t \\ (\\ns. List (levellist_new ! (var q)) next_new ns \\\n q \\ set ns)) \\\n (\\ i \\ var p. (\\ns_new ns_old.\n List (levellist_new ! i) next_new ns_new \\\n List (levellist_old ! i) next_old ns_old \\\n (\\ prx. ns_new = prx@ns_old\n \\ (\\ pt \\ set prx. pt \\ set_of t \\ var pt = i)))) \\\n (\\ i. (var p) < i \\ (\\ns_new ns_old.\n List (levellist_new ! i) next_new ns_new \\\n List (levellist_old ! i) next_old ns_old \\\n ns_new = ns_old)) \\\n (length levellist_new = length levellist_old)\"\n*)\n\nlemma Levellist_ext_to_all: \"((\\ll. Levellist hds next ll \\ P ll) \\ Q)\n =\n (\\ll. Levellist hds next ll \\ P ll \\ Q)\"\napply blast\ndone\n\nlemma Levellist_length: \"Levellist hds p ll \\ length ll = length hds\"\n by (auto simp add: Levellist_def)\n\n\nlemma map_update:\n \"\\i. i < length xss \\ map f (xss[i := xs]) = (map f xss) [i := f xs]\"\napply (induct xss)\napply simp\napply (case_tac i)\napply simp\napply simp\ndone\n\n\nlemma (in Levellist_impl) Levellist_spec_total':\nshows \"\\ll \\ t. \\,\\\\\\<^sub>t\n \\\\. Dag \\p \\low \\high t \\ (\\p \\ Null \\ (\\p\\\\var) < length \\levellist) \\\n ordered t \\var \\ Levellist \\levellist \\next ll \\\n (\\n \\ set_of t.\n (if \\mark n = \\m\n then n \\ set (ll ! \\var n) \\\n (\\nt p. Dag n \\low \\high nt \\ p \\ set_of nt\n \\ \\mark p = \\m)\n else n \\ set (concat ll)))\\\n \\levellist :== PROC Levellist (\\p, \\m, \\levellist)\n \\\\ll'. Levellist \\levellist \\next ll' \\ wf_levellist t ll ll' \\<^bsup>\\\\<^esup>var \\\n wf_marking t \\<^bsup>\\\\<^esup>mark \\mark \\<^bsup>\\\\<^esup>m \\\n (\\p. p \\ set_of t \\ \\<^bsup>\\\\<^esup>next p = \\next p)\n \\\"\napply (hoare_rule HoareTotal.ProcRec1\n [where r=\"measure (\\(s,p). size (dag \\<^bsup>s\\<^esup>p \\<^bsup>s\\<^esup>low \\<^bsup>s\\<^esup>high))\"])\napply vcg\napply (rule conjI)\napply clarify\napply (rule conjI)\napply clarify\napply (clarsimp simp del: BinDag.set_of.simps split del: if_split)\ndefer\napply (rule impI)\napply (clarsimp simp del: BinDag.set_of.simps split del: if_split)\ndefer\napply (clarsimp simp add: wf_levellist_def wf_marking_def) (* p=Null*)\napply (simp only: Levellist_ext_to_all )\nproof -\n fix ll var low high mark \"next\" nexta p levellist m lt rt\n assume pnN: \"p \\ Null\"\n assume mark_p: \"mark p = (\\ m)\"\n assume lt: \"Dag (low p) low high lt\"\n assume rt: \"Dag (high p) low high rt\"\n from pnN lt rt have Dag_p: \"Dag p low high (Node lt p rt)\" by simp\n from Dag_p rt\n have size_rt_dec: \"size (dag (high p) low high) < size (dag p low high)\"\n by (simp only: Dag_dag) simp\n from Dag_p lt\n have size_lt_dec: \"size (dag (low p) low high) < size (dag p low high)\"\n by (simp only: Dag_dag) simp\n assume ll: \"Levellist levellist next ll\"\n\n assume marked_child_ll:\n \"\\n \\ set_of (Node lt p rt).\n if mark n = m\n then n \\ set (ll ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ mark p = m)\n else n \\ set (concat ll)\"\n with mark_p have p_notin_ll: \"p \\ set (concat ll)\"\n by auto\n assume varsll': \"var p < length levellist\"\n with ll have varsll: \"var p < length ll\"\n by (simp add: Levellist_length)\n assume orderedt: \"ordered (Node lt p rt) var\"\n show \"(low p \\ Null \\ var (low p) < length levellist) \\\n ordered lt var \\\n (\\n \\ set_of lt.\n if mark n = m\n then n \\ set (ll ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ mark p = m)\n else n \\ set (concat ll)) \\\n size (dag (low p) low high) < size (dag p low high) \\\n (\\marka nexta levellist lla.\n Levellist levellist nexta lla \\\n wf_levellist lt ll lla var \\ wf_marking lt mark marka m \\\n (\\p. p \\ set_of lt \\ next p = nexta p)\\\n (high p \\ Null \\ var (high p) < length levellist) \\\n ordered rt var \\\n (\\lla. Levellist levellist nexta lla \\\n (\\n \\ set_of rt.\n if marka n = m\n then n \\ set (lla ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\\n marka p = m)\n else n \\ set (concat lla)) \\\n size (dag (high p) low high) < size (dag p low high) \\\n (\\markb nextb levellist llb.\n Levellist levellist nextb llb \\\n wf_levellist rt lla llb var \\\n wf_marking rt marka markb m \\\n (\\p. p \\ set_of rt \\ nexta p = nextb p) \\\n (\\ll'. Levellist (levellist[var p := p])\n (nextb(p := levellist ! var p)) ll' \\\n wf_levellist (Node lt p rt) ll ll' var \\\n wf_marking (Node lt p rt) mark (markb(p := m)) m \\\n (\\pa. pa \\ set_of (Node lt p rt) \\\n next pa =\n (if pa = p then levellist ! var p\n else nextb pa))))))\"\n proof (cases \"lt\")\n case Tip\n note lt_Tip = this\n show ?thesis\n proof (cases \"rt\")\n case Tip\n show ?thesis\n using size_rt_dec Tip lt_Tip Tip lt rt\n apply clarsimp\n subgoal premises prems for marka nexta levellista lla markb nextb levellistb llb\n proof -\n have lla: \"Levellist levellista nexta lla\" by fact\n have llb: \"Levellist levellistb nextb llb\" by fact\n have wfll_lt: \"wf_levellist Tip ll lla var\"\n \"wf_marking Tip mark marka m\" by fact+\n\n then have ll_lla: \"ll = lla\"\n by (simp add: wf_levellist_def)\n\n moreover\n with wfll_lt lt_Tip lt have \"marka = mark\"\n by (simp add: wf_marking_def)\n moreover\n have wfll_rt:\"wf_levellist Tip lla llb var\"\n \"wf_marking Tip marka markb m\" by fact+\n then have lla_llb: \"lla = llb\"\n by (simp add: wf_levellist_def)\n moreover\n with wfll_rt Tip rt have \"markb = marka\"\n by (simp add: wf_marking_def)\n moreover\n from varsll llb ll_lla lla_llb\n obtain \"var p < length levellistb\" \"var p < length llb\"\n by (simp add: Levellist_length)\n with llb pnN\n have llc: \"Levellist (levellistb[var p := p]) (nextb(p := levellistb ! var p))\n (llb[var p := p # llb ! var p])\"\n apply (clarsimp simp add: Levellist_def map_update)\n apply (erule_tac x=i in allE)\n apply clarsimp\n apply (subgoal_tac \"p \\ set (llb ! i) \")\n prefer 2\n using p_notin_ll ll_lla lla_llb\n apply simp\n apply (case_tac \"i=var p\")\n apply simp\n apply simp\n done\n ultimately\n show ?thesis\n using lt_Tip Tip varsll\n apply (clarsimp simp add: wf_levellist_def wf_marking_def)\n proof -\n fix i\n assume varsllb: \"var p < length llb\"\n assume \"i \\ var p\"\n show \"\\prx. llb[var p := p#llb!var p]!i = prx @ llb!i \\\n (\\pt\\set prx. pt = p \\ var pt = i)\"\n proof (cases \"i = var p\")\n case True\n with pnN lt rt varsllb lt_Tip Tip show ?thesis\n apply -\n apply (rule_tac x=\"[p]\" in exI)\n apply (simp add: subdag_eq_def)\n done\n next\n assume \"i \\ var p\"\n with varsllb show ?thesis\n apply -\n apply (rule_tac x=\"[]\" in exI)\n apply (simp add: subdag_eq_def)\n done\n qed\n qed\n qed\n done\n next\n case (Node dag1 a dag2)\n have rt_node: \"rt = Node dag1 a dag2\" by fact\n with rt have high_p: \"high p = a\"\n by simp\n have s: \"\\nexta. (\\p. next p = nexta p) = (next = nexta)\"\n by auto\n show ?thesis\n using size_rt_dec size_lt_dec rt_node lt_Tip Tip lt rt\n apply (clarsimp simp del: set_of_Node split del: if_split simp add: s)\n subgoal premises prems for marka levellista lla\n proof -\n have lla: \"Levellist levellista next lla\" by fact\n have wfll_lt:\"wf_levellist Tip ll lla var\"\n \"wf_marking Tip mark marka m\" by fact+\n from this have ll_lla: \"ll = lla\"\n by (simp add: wf_levellist_def)\n moreover\n from wfll_lt lt_Tip lt have marklrec: \"marka = mark\"\n by (simp add: wf_marking_def)\n from orderedt varsll lla ll_lla rt_node lt_Tip high_p\n have var_highp_bound: \"var (high p) < length levellista\"\n by (auto simp add: Levellist_length)\n from orderedt high_p rt_node lt_Tip\n have ordered_rt: \"ordered (Node dag1 (high p) dag2) var\"\n by simp\n from high_p marklrec marked_child_ll lt rt lt_Tip rt_node ll_lla\n have mark_rt: \"(\\n\\set_of (Node dag1 (high p) dag2).\n if marka n = m\n then n \\ set (lla ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ marka p = m)\n else n \\ set (concat lla))\"\n apply (simp only: BinDag.set_of.simps)\n apply clarify\n apply (drule_tac x=n in bspec)\n apply blast\n apply assumption\n done\n show ?thesis\n apply (rule conjI)\n apply (rule var_highp_bound)\n apply (rule conjI)\n apply (rule ordered_rt)\n apply (rule conjI)\n apply (rule mark_rt)\n apply clarify\n apply clarsimp\n subgoal premises prems for markb nextb levellistb llb\n proof -\n have llb: \"Levellist levellistb nextb llb\" by fact\n have wfll_rt: \"wf_levellist (Node dag1 (high p) dag2) lla llb var\" by fact\n have wfmarking_rt: \"wf_marking (Node dag1 (high p) dag2) marka markb m\" by fact\n from wfll_rt varsll llb ll_lla\n obtain var_p_bounds: \"var p < length levellistb\" \"var p < length llb\"\n by (simp add: Levellist_length wf_levellist_def)\n with p_notin_ll ll_lla wfll_rt\n have p_notin_llb: \"\\i < length llb. p \\ set (llb ! i)\"\n apply -\n apply (intro allI impI)\n apply (clarsimp simp add: wf_levellist_def)\n apply (case_tac \"i \\ var (high p)\")\n apply (drule_tac x=i in spec)\n using orderedt rt_node lt_Tip high_p\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (drule_tac x=i in spec)\n apply clarsimp\n done\n with llb pnN var_p_bounds\n have llc: \"Levellist (levellistb[var p := p])\n (nextb(p := levellistb ! var p))\n (llb[var p := p # llb ! var p])\"\n apply (clarsimp simp add: Levellist_def map_update)\n apply (erule_tac x=i in allE)\n apply (erule_tac x=i in allE)\n apply clarsimp\n apply (case_tac \"i=var p\")\n apply simp\n apply simp\n done\n then show ?thesis\n apply simp\n using wfll_rt wfmarking_rt\n lt_Tip rt_node varsll orderedt lt rt pnN ll_lla marklrec\n apply (clarsimp simp add: wf_levellist_def wf_marking_def)\n apply (intro conjI)\n apply (rule allI)\n apply (rule conjI)\n apply (erule_tac x=\"q\" in allE)\n apply (case_tac \"var p = var q\")\n apply fastforce\n apply fastforce\n apply (case_tac \"var p = var q\")\n apply hypsubst_thin\n apply fastforce\n apply fastforce\n apply (rule allI)\n apply (rotate_tac 4)\n apply (erule_tac x=\"i\" in allE)\n apply (case_tac \"i=var p\")\n apply simp\n apply (case_tac \"var (high p) < i\")\n apply simp\n apply simp\n apply (erule exE)\n apply (rule_tac x=\"prx\" in exI)\n apply (intro conjI)\n apply simp\n apply clarify\n apply (rotate_tac 15)\n apply (erule_tac x=\"pt\" in ballE)\n apply fastforce\n apply fastforce\n done\n qed\n done\n qed\n done\n qed\n next\n case (Node llt l rlt)\n have lt_Node: \"lt = Node llt l rlt\" by fact\n from orderedt lt varsll' lt_Node\n obtain ordered_lt:\n \"ordered lt var\" \"(low p \\ Null \\ var (low p) < length levellist)\"\n by (cases rt) auto\n from lt lt_Node marked_child_ll\n have mark_lt: \"\\n\\set_of lt.\n if mark n = m\n then n \\ set (ll ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ mark p = m)\n else n \\ set (concat ll)\"\n apply (simp only: BinDag.set_of.simps)\n apply clarify\n apply (drule_tac x=n in bspec)\n apply blast\n apply assumption\n done\n show ?thesis\n apply (intro conjI ordered_lt mark_lt size_lt_dec)\n apply (clarify)\n apply (simp add: size_rt_dec split del: if_split)\n apply (simp only: Levellist_ext_to_all)\n subgoal premises prems for marka nexta levellista lla\n proof -\n have lla: \"Levellist levellista nexta lla\" by fact\n have wfll_lt: \"wf_levellist lt ll lla var\" by fact\n have wfmarking_lt:\"wf_marking lt mark marka m\" by fact\n from wfll_lt lt_Node\n have lla_eq_ll: \"length lla = length ll\"\n by (simp add: wf_levellist_def)\n with ll lla have lla_eq_ll': \"length levellista = length levellist\"\n by (simp add: Levellist_length)\n with orderedt rt lt_Node lt varsll'\n obtain ordered_rt:\n \"ordered rt var\" \"(high p \\ Null \\ var (high p) < length levellista)\"\n by (cases rt) auto\n from wfll_lt lt_Node\n have nodes_in_lla: \"\\ q. q \\ set_of lt \\ q \\ set (lla ! (q\\var))\"\n by (simp add: wf_levellist_def)\n from wfll_lt lt_Node lt\n have lla_st: \"(\\i \\ (low p)\\var.\n (\\prx. (lla ! i) = prx@(ll ! i) \\\n (\\pt \\ set prx. pt \\ set_of lt \\ pt\\var = i)))\"\n by (simp add: wf_levellist_def)\n from wfll_lt lt_Node lt\n have lla_nc: \"\\i. ((low p)\\var) < i \\ (lla ! i) = (ll ! i)\"\n by (simp add: wf_levellist_def)\n from wfmarking_lt lt_Node lt\n have mot_nc: \"\\ n. n \\ set_of lt \\ mark n = marka n\"\n by (simp add: wf_marking_def)\n from wfmarking_lt lt_Node lt\n have mit_marked: \"\\n. n \\ set_of lt \\ marka n = m\"\n by (simp add: wf_marking_def)\n from marked_child_ll nodes_in_lla mot_nc mit_marked lla_st\n have mark_rt: \"\\n\\set_of rt.\n if marka n = m\n then n \\ set (lla ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ marka p = m)\n else n \\ set (concat lla)\"\n apply -\n apply (rule ballI)\n apply (drule_tac x=\"n\" in bspec)\n apply (simp)\n proof -\n fix n\n\n assume nodes_in_lla: \"\\q. q \\ set_of lt \\ q \\ set (lla ! var q)\"\n assume mot_nc: \"\\n. n \\ set_of lt \\ mark n = marka n\"\n assume mit_marked: \"\\n. n \\ set_of lt \\ marka n = m\"\n assume marked_child_ll: \"if mark n = m\n then n \\ set (ll ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ mark p = m)\n else n \\ set (concat ll)\"\n\n assume lla_st: \"\\i\\var (low p).\n \\prx. lla ! i = prx @ ll ! i \\\n (\\pt\\set prx. pt \\ set_of lt \\ var pt = i)\"\n\n assume n_in_rt: \" n \\ set_of rt\"\n show n_in_lla_marked: \"if marka n = m\n then n \\ set (lla ! var n) \\\n (\\nt p. Dag n low high nt \\ p \\ set_of nt \\ marka p = m)\n else n \\ set (concat lla)\"\n proof (cases \"n \\ set_of lt\")\n case True\n from True nodes_in_lla have n_in_ll: \"n \\ set (lla ! var n)\"\n by simp\n moreover\n from True wfmarking_lt\n have \"marka n = m\"\n apply (cases lt)\n apply (auto simp add: wf_marking_def)\n done\n moreover\n {\n fix nt p\n assume \"Dag n low high nt\"\n with lt True have subset_nt_lt: \"set_of nt \\ set_of lt\"\n by (rule dag_setof_subsetD)\n moreover assume \" p \\ set_of nt\"\n ultimately have \"p \\ set_of lt\"\n by blast\n with mit_marked have \" marka p = m\"\n by simp\n }\n ultimately show ?thesis\n using n_in_rt\n apply clarsimp\n done\n next\n assume n_notin_lt: \"n \\ set_of lt\"\n show ?thesis\n proof (cases \"marka n = m\")\n case True\n from n_notin_lt mot_nc have marka_eq_mark: \"mark n = marka n\"\n by simp\n from marka_eq_mark True have n_marked: \"mark n = m\"\n by simp\n from rt n_in_rt have nnN: \"n \\ Null\"\n apply -\n apply (rule set_of_nn [rule_format])\n apply fastforce\n apply assumption\n done\n from marked_child_ll n_in_rt marka_eq_mark nnN n_marked\n have n_in_ll: \"n \\ set (ll ! var n)\"\n by fastforce\n from marked_child_ll n_in_rt marka_eq_mark nnN n_marked lt rt\n have nt_mark: \"\\nt p. Dag n low high nt \\ p \\ set_of nt \\ mark p = m\"\n by simp\n from nodes_in_lla n_in_ll lla_st\n have n_in_lla: \"n \\ set (lla ! var n)\"\n proof (cases \"var (low p) < (var n)\")\n case True\n with lla_nc have \"(lla ! var n) = (ll ! var n)\"\n by fastforce\n with n_in_ll show ?thesis\n by fastforce\n next\n assume varnslp: \" \\ var (low p) < var n\"\n with lla_st\n have ll_in_lla: \"\\prx. lla ! (var n) = prx @ ll ! (var n)\"\n apply -\n apply (erule_tac x=\"var n\" in allE)\n apply fastforce\n done\n with n_in_ll show ?thesis\n by fastforce\n qed\n {\n fix nt pt\n assume nt_Dag: \"Dag n low high nt\"\n assume pt_in_nt: \"pt \\ set_of nt\"\n have \" marka pt = m\"\n proof (cases \"pt \\ set_of lt\")\n case True\n with mit_marked show ?thesis\n by fastforce\n next\n assume pt_notin_lt: \" pt \\ set_of lt\"\n with mot_nc have \"mark pt = marka pt\"\n by fastforce\n with nt_mark nt_Dag pt_in_nt show ?thesis\n by fastforce\n qed\n }\n then have nt_marka:\n \"\\nt pt. Dag n low high nt \\ pt \\ set_of nt \\ marka pt = m\"\n by fastforce\n with n_in_lla nt_marka True show ?thesis\n by fastforce\n next\n case False\n note n_not_marka = this\n with wfmarking_lt n_notin_lt\n have \"mark n \\ m\"\n by (simp add: wf_marking_def lt_Node)\n with marked_child_ll\n have n_notin_ll: \"n \\ set (concat ll)\"\n by simp\n show ?thesis\n proof (cases \"n \\ set (concat lla)\")\n case False with n_not_marka show ?thesis by simp\n next\n case True\n with wf_levellist_subset [OF wfll_lt] n_notin_ll\n have \"n \\ set_of lt\"\n by blast\n with n_notin_lt have False by simp\n thus ?thesis ..\n qed\n qed\n qed\n qed\n show ?thesis\n apply (intro conjI ordered_rt mark_rt)\n apply clarify\n subgoal premises prems for markb nextb levellistb llb\n proof -\n have llb: \"Levellist levellistb nextb llb\" by fact\n have wfll_rt: \"wf_levellist rt lla llb var\" by fact\n have wfmarking_rt: \"wf_marking rt marka markb m\" by fact\n show ?thesis\n proof (cases rt)\n case Tip\n from wfll_rt Tip have lla_llb: \"lla = llb\"\n by (simp add: wf_levellist_def)\n moreover\n from wfmarking_rt Tip rt have \"markb = marka\"\n by (simp add: wf_marking_def)\n moreover\n from wfll_lt varsll llb lla_llb\n obtain var_p_bounds: \"var p < length levellistb\" \"var p < length llb\"\n by (simp add: Levellist_length wf_levellist_def lt_Node Tip)\n with p_notin_ll lla_llb wfll_lt\n have p_notin_llb: \"\\i < length llb. p \\ set (llb ! i)\"\n apply -\n apply (intro allI impI)\n apply (clarsimp simp add: wf_levellist_def lt_Node)\n apply (case_tac \"i \\ var l\")\n apply (drule_tac x=i in spec)\n using orderedt Tip lt_Node\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (drule_tac x=i in spec)\n apply clarsimp\n done\n with llb pnN var_p_bounds\n have llc: \"Levellist (levellistb[var p := p])\n (nextb(p := levellistb ! var p))\n (llb[var p := p # llb ! var p])\"\n apply (clarsimp simp add: Levellist_def map_update)\n apply (erule_tac x=i in allE)\n apply (erule_tac x=i in allE)\n apply clarsimp\n apply (case_tac \"i=var p\")\n apply simp\n apply simp\n done\n ultimately show ?thesis\n using Tip lt_Node varsll orderedt lt rt pnN wfll_lt wfmarking_lt\n apply (clarsimp simp add: wf_levellist_def wf_marking_def)\n apply (intro conjI)\n apply (rule allI)\n apply (rule conjI)\n apply (erule_tac x=\"q\" in allE)\n apply (case_tac \"var p = var q\")\n apply fastforce\n apply fastforce\n apply (case_tac \"var p = var q\")\n apply hypsubst_thin\n apply fastforce\n apply fastforce\n apply (rule allI)\n apply (rotate_tac 4)\n apply (erule_tac x=\"i\" in allE)\n apply (case_tac \"i=var p\")\n apply simp\n apply (case_tac \"var (low p) < i\")\n apply simp\n apply simp\n apply (erule exE)\n apply (rule_tac x=\"prx\" in exI)\n apply (intro conjI)\n apply simp\n apply clarify\n apply (rotate_tac 15)\n apply (erule_tac x=\"pt\" in ballE)\n apply fastforce\n apply fastforce\n done\n next\n case (Node lrt r rrt)\n have rt_Node: \"rt = Node lrt r rrt\" by fact\n from wfll_rt rt_Node\n have llb_eq_lla: \"length llb = length lla\"\n by (simp add: wf_levellist_def)\n with llb lla\n have llb_eq_lla': \"length levellistb = length levellista\"\n by (simp add: Levellist_length)\n from wfll_rt rt_Node\n have nodes_in_llb: \"\\q. q \\ set_of rt \\ q \\ set (llb ! (q\\var))\"\n by (simp add: wf_levellist_def)\n from wfll_rt rt_Node rt\n have llb_st: \"(\\ i \\ (high p)\\var.\n (\\ prx. (llb ! i) = prx@(lla ! i) \\\n (\\pt \\ set prx. pt \\ set_of rt \\ pt\\var = i)))\"\n by (simp add: wf_levellist_def)\n from wfll_rt rt_Node rt\n have llb_nc:\n \"\\i. ((high p)\\var) < i \\ (llb ! i) = (lla ! i)\"\n by (simp add: wf_levellist_def)\n from wfmarking_rt rt_Node rt\n have mort_nc: \"\\n. n \\ set_of rt \\ marka n = markb n\"\n by (simp add: wf_marking_def)\n from wfmarking_rt rt_Node rt\n have mirt_marked: \"\\n. n \\ set_of rt \\ markb n = m\"\n by (simp add: wf_marking_def)\n with p_notin_ll wfll_rt wfll_lt\n have p_notin_llb: \"\\i < length llb. p \\ set (llb ! i)\"\n apply -\n apply (intro allI impI)\n apply (clarsimp simp add: wf_levellist_def lt_Node rt_Node)\n apply (case_tac \"i \\ var r\")\n apply (drule_tac x=i in spec)\n using orderedt rt_Node lt_Node\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (case_tac \"i \\ var l\")\n apply (drule_tac x=i in spec)\n apply clarsimp\n apply clarsimp\n apply (subgoal_tac \"llb ! i = lla ! i\")\n prefer 2\n apply clarsimp\n apply (case_tac \"i \\ var l\")\n apply (drule_tac x=i in spec, erule impE, assumption)\n apply clarsimp\n using orderedt rt_Node lt_Node\n apply clarsimp\n apply clarsimp\n done\n from wfll_lt wfll_rt varsll lla llb\n obtain var_p_bounds: \"var p < length levellistb\" \"var p < length llb\"\n by (simp add: Levellist_length wf_levellist_def lt_Node rt_Node)\n with p_notin_llb llb pnN var_p_bounds\n have llc: \"Levellist (levellistb[var p := p])\n (nextb(p := levellistb ! var p))\n (llb[var p := p # llb ! var p])\"\n apply (clarsimp simp add: Levellist_def map_update)\n apply (erule_tac x=i in allE)\n apply (erule_tac x=i in allE)\n apply clarsimp\n apply (case_tac \"i=var p\")\n apply simp\n apply simp\n done\n then show ?thesis\n proof (clarsimp)\n show \"wf_levellist (Node lt p rt) ll (llb[var p := p#llb ! var p]) var \\\n wf_marking (Node lt p rt) mark (markb(p := m)) m\"\n proof -\n have nodes_in_upllb: \"\\ q. q \\ set_of (Node lt p rt)\n \\ q \\ set (llb[var p :=p # llb ! var p] ! (var q))\"\n apply -\n apply (rule allI)\n apply (rule impI)\n proof -\n fix q\n assume q_in_t: \"q \\ set_of (Node lt p rt)\"\n show q_in_upllb:\n \"q \\ set (llb[var p :=p # llb ! var p] ! (var q))\"\n proof (cases \"q \\ set_of rt\")\n case True\n with nodes_in_llb have q_in_llb: \"q \\ set (llb ! (var q))\"\n by fastforce\n from orderedt rt_Node lt_Node lt rt\n have ordered_rt: \"ordered rt var\"\n by fastforce\n from True rt ordered_rt rt_Node lt lt_Node have \"var q \\ var r\"\n apply -\n apply (drule subnodes_ordered)\n apply fastforce\n apply fastforce\n apply fastforce\n done\n with orderedt rt lt rt_Node lt_Node have \"var q < var p\"\n by fastforce\n then have\n \"llb[var p :=p#llb ! var p] ! var q =\n llb ! var q\"\n by fastforce\n with q_in_llb show ?thesis\n by fastforce\n next\n assume q_notin_rt: \"q \\ set_of rt\"\n show \"q \\ set (llb[var p :=p # llb ! var p] ! var q)\"\n proof (cases \"q \\ set_of lt\")\n case True\n assume q_in_lt: \"q \\ set_of lt\"\n with nodes_in_lla have q_in_lla: \"q \\ set (lla ! (var q))\"\n by fastforce\n from orderedt rt_Node lt_Node lt rt\n have ordered_lt: \"ordered lt var\"\n by fastforce\n from q_in_lt lt ordered_lt rt_Node rt lt_Node\n have \"var q \\ var l\"\n apply -\n apply (drule subnodes_ordered)\n apply fastforce\n apply fastforce\n apply fastforce\n done\n with orderedt rt lt rt_Node lt_Node have qsp: \"var q < var p\"\n by fastforce\n then show ?thesis\n proof (cases \"var q \\ var (high p)\")\n case True\n with llb_st\n have \"\\prx. (llb ! (var q)) = prx@(lla ! (var q))\"\n by fastforce\n with nodes_in_lla q_in_lla\n have q_in_llb: \"q \\ set (llb ! (var q))\"\n by fastforce\n from qsp\n have \"llb[var p :=p#llb ! var p]!var q =\n llb ! (var q)\"\n by fastforce\n with q_in_llb show ?thesis\n by fastforce\n next\n assume \"\\ var q \\ var (high p)\"\n with llb_nc have \"llb ! (var q) = lla ! (var q)\"\n by fastforce\n with q_in_lla have q_in_llb: \"q \\ set (llb ! (var q))\"\n by fastforce\n from qsp have\n \"llb[var p :=p # llb ! var p] ! var q = llb ! (var q)\"\n by fastforce\n with q_in_llb show ?thesis\n by fastforce\n qed\n next\n assume q_notin_lt: \"q \\ set_of lt\"\n with q_notin_rt rt lt rt_Node lt_Node q_in_t have qp: \"q = p\"\n by fastforce\n with varsll lla_eq_ll llb_eq_lla have \"var p < length llb\"\n by fastforce\n with qp show ?thesis\n by simp\n qed\n qed\n qed\n have prx_ll_st: \"\\i \\ var p.\n (\\prx. llb[var p :=p#llb!var p]!i = prx@(ll!i) \\\n (\\pt \\ set prx. pt \\ set_of (Node lt p rt) \\ var pt = i))\"\n apply -\n apply (rule allI)\n apply (rule impI)\n proof -\n fix i\n assume isep: \"i \\ var p\"\n show \"\\prx. llb[var p :=p#llb!var p]!i = prx@ll!i \\\n (\\pt\\set prx. pt \\ set_of (Node lt p rt) \\ var pt = i)\"\n proof (cases \"i = var p\")\n case True\n with orderedt lt lt_Node rt rt_Node\n have lpsp: \"var (low p) < var p\"\n by fastforce\n with orderedt lt lt_Node rt rt_Node\n have hpsp: \"var (high p) < var p\"\n by fastforce\n with lpsp lla_nc\n have llall: \"lla ! var p = ll ! var p\"\n by fastforce\n with hpsp llb_nc have \"llb ! var p = ll ! var p\"\n by fastforce\n with llb_eq_lla lla_eq_ll isep True varsll lt rt show ?thesis\n apply -\n apply (rule_tac x=\"[p]\" in exI)\n apply (rule conjI)\n apply simp\n apply (rule ballI)\n apply fastforce\n done\n next\n assume inp: \" i \\ var p\"\n show ?thesis\n proof (cases \"var (low p) < i\")\n case True\n with lla_nc have llall: \"lla ! i = ll ! i\"\n by fastforce\n assume vpsi: \"var (low p) < i\"\n show ?thesis\n proof (cases \"var (high p) < i\")\n case True\n with llall llb_nc have \"llb ! i = ll ! i\"\n by fastforce\n with inp True vpsi varsll lt rt show ?thesis\n apply -\n apply (rule_tac x=\"[]\" in exI)\n apply (rule conjI)\n apply simp\n apply (rule ballI)\n apply fastforce\n done\n next\n assume isehp: \" \\ var (high p) < i\"\n with vpsi lla_nc have lla_ll: \"lla ! i = ll ! i\"\n by fastforce\n with isehp llb_st\n have prx_lla: \"\\prx. llb ! i = prx @ lla ! i \\\n (\\pt\\set prx. pt \\ set_of rt \\ var pt = i)\"\n apply -\n apply (erule_tac x=\"i\" in allE)\n apply simp\n done\n with lla_ll inp rt show ?thesis\n apply -\n apply (erule exE)\n apply (rule_tac x=\"prx\" in exI)\n apply simp\n done\n qed\n next\n assume iselp: \"\\ var (low p) < i\"\n show ?thesis\n proof (cases \"var (high p) < i\")\n case True\n with llb_nc have llb_ll: \"llb ! i = lla ! i\"\n by fastforce\n with iselp lla_st\n have prx_ll: \"\\prx. lla ! i = prx @ ll ! i \\\n (\\pt\\set prx. pt \\ set_of lt \\ var pt = i)\"\n apply -\n apply (erule_tac x=\"i\" in allE)\n apply simp\n done\n with llb_ll inp lt show ?thesis\n apply -\n apply (erule exE)\n apply (rule_tac x=\"prx\" in exI)\n apply simp\n done\n next\n assume isehp: \" \\ var (high p) < i\"\n from iselp lla_st\n have prxl: \"\\prx. lla ! i = prx @ ll ! i \\\n (\\pt\\set prx. pt \\ set_of lt \\ var pt = i)\"\n by fastforce\n from isehp llb_st\n have prxh: \"\\prx. llb ! i = prx @ lla ! i \\\n (\\pt\\set prx. pt \\ set_of rt \\ var pt = i)\"\n by fastforce\n with prxl inp lt pnN rt show ?thesis\n apply -\n apply (elim exE)\n apply (rule_tac x=\"prxa @ prx\" in exI)\n apply simp\n apply (elim conjE)\n apply fastforce\n done\n qed\n qed\n qed\n qed\n have big_Nodes_nc: \"\\i. (p->var) < i\n \\ (llb[var p :=p # llb ! var p]) ! i = ll ! i\"\n apply -\n apply (rule allI)\n apply (rule impI)\n proof -\n fix i\n assume psi: \"var p < i\"\n with orderedt lt rt lt_Node rt_Node have lpsi: \"var (low p) < i\"\n by fastforce\n with lla_nc have lla_ll: \"lla ! i = ll ! i\"\n by fastforce\n from psi orderedt lt rt lt_Node rt_Node have hpsi: \"var (high p) < i\"\n by fastforce\n with llb_nc have llb_lla: \"llb ! i = lla ! i\"\n by fastforce\n from psi\n have upllb_llb: \"llb[var p :=p#llb!var p]!i = llb!i\"\n by fastforce\n from upllb_llb llb_lla lla_ll\n show \"llb[var p :=p # llb ! var p] ! i = ll ! i\"\n by fastforce\n qed\n from lla_eq_ll llb_eq_lla\n have length_eq: \"length (llb[var p :=p # llb ! var p]) = length ll\"\n by fastforce\n from length_eq big_Nodes_nc prx_ll_st nodes_in_upllb\n have wf_ll_upllb:\n \"wf_levellist (Node lt p rt) ll (llb[var p :=p # llb ! var p]) var\"\n by (simp add: wf_levellist_def)\n have mark_nc:\n \"\\ n. n \\ set_of (Node lt p rt) \\ (markb(p:=m)) n = mark n\"\n apply -\n apply (rule allI)\n apply (rule impI)\n proof -\n fix n\n assume nnit: \"n \\ set_of (Node lt p rt)\"\n with lt rt have nnilt: \" n \\ set_of lt\"\n by fastforce\n from nnit lt rt have nnirt: \" n \\ set_of rt\"\n by fastforce\n with nnilt mot_nc mort_nc have mb_eq_m: \"markb n = mark n\"\n by fastforce\n from nnit have \"n\\p\"\n by fastforce\n then have upmarkb_markb: \"(markb(p :=m)) n = markb n\"\n by fastforce\n with mb_eq_m show \"(markb(p :=m)) n = mark n\"\n by fastforce\n qed\n have mark_c: \"\\ n. n \\ set_of (Node lt p rt) \\ (markb(p :=m)) n = m\"\n apply -\n apply (intro allI)\n apply (rule impI)\n proof -\n fix n\n assume nint: \" n \\ set_of (Node lt p rt)\"\n show \"(markb(p :=m)) n = m\"\n proof (cases \"n=p\")\n case True\n then show ?thesis\n by fastforce\n next\n assume nnp: \" n \\ p\"\n show ?thesis\n proof (cases \"n \\ set_of rt\")\n case True\n with mirt_marked have \"markb n = m\"\n by fastforce\n with nnp show ?thesis\n by fastforce\n next\n assume nninrt: \" n \\ set_of rt\"\n with nint nnp have ninlt: \"n \\ set_of lt\"\n by fastforce\n with mit_marked have marka_m: \"marka n = m\"\n by fastforce\n from mort_nc nninrt have \"marka n = markb n\"\n by fastforce\n with marka_m have \"markb n = m\"\n by fastforce\n with nnp show ?thesis\n by fastforce\n qed\n qed\n qed\n from mark_c mark_nc\n have wf_mark: \"wf_marking (Node lt p rt) mark (markb(p :=m)) m\"\n by (simp add: wf_marking_def)\n with wf_ll_upllb show ?thesis\n by fastforce\n qed\n qed\n qed\n qed\n done\n qed\n done\n qed\nnext\n fix var low high p lt rt and levellist and\n ll::\"ref list list\" and mark::\"ref \\ bool\" and \"next\"\n assume pnN: \"p \\ Null\"\n assume ll: \"Levellist levellist next ll\"\n assume vpsll: \"var p < length levellist\"\n assume orderedt: \"ordered (Node lt p rt) var\"\n assume marked_child_ll: \"\\n\\set_of (Node lt p rt).\n if mark n = mark p\n then n \\ set (ll ! var n) \\\n (\\nt pa. Dag n low high nt \\ pa \\ set_of nt \\ mark pa = mark p)\n else n \\ set (concat ll)\"\n assume lt: \"Dag (low p) low high lt\"\n assume rt: \"Dag (high p) low high rt\"\n show \"wf_levellist (Node lt p rt) ll ll var \\\n wf_marking (Node lt p rt) mark mark (mark p)\"\n proof -\n from marked_child_ll pnN lt rt have marked_st:\n \"(\\pa. pa \\ set_of (Node lt p rt) \\ mark pa = mark p)\"\n apply -\n apply (drule_tac x=\"p\" in bspec)\n apply simp\n apply (clarsimp)\n apply (erule_tac x=\"(Node lt p rt)\" in allE)\n apply simp\n done\n have nodest_in_ll:\n \"\\q. q \\ set_of (Node lt p rt) \\ q \\ set (ll ! var q)\"\n proof -\n from marked_child_ll pnN have pinll: \"p \\ set (ll ! var p)\"\n apply -\n apply (drule_tac x=\"p\" in bspec)\n apply simp\n apply fastforce\n done\n from marked_st marked_child_ll lt rt show ?thesis\n apply -\n apply (rule allI)\n apply (erule_tac x=\"q\" in allE)\n apply (rule impI)\n apply (erule impE)\n apply assumption\n apply (drule_tac x=\"q\" in bspec)\n apply simp\n apply fastforce\n done\n qed\n have levellist_nc: \"\\ i \\ var p. (\\ prx. ll ! i = prx@(ll ! i) \\\n (\\ pt \\ set prx. pt \\ set_of (Node lt p rt) \\ var pt = i))\"\n apply -\n apply (rule allI)\n apply (rule impI)\n apply (rule_tac x=\"[]\" in exI)\n apply fastforce\n done\n have ll_nc: \"\\ i. (var p) < i \\ ll ! i = ll ! i\"\n by fastforce\n have length_ll: \"length ll = length ll\"\n by fastforce\n with ll_nc levellist_nc nodest_in_ll\n have wf: \"wf_levellist (Node lt p rt) ll ll var\"\n by (simp add: wf_levellist_def)\n have m_nc: \"\\ n. n \\ set_of (Node lt p rt) \\ mark n = mark n\"\n by fastforce\n from marked_st have \"\\ n. n \\ set_of (Node lt p rt) \\ mark n = mark p\"\n by fastforce\n with m_nc have \" wf_marking (Node lt p rt) mark mark (mark p)\"\n by (simp add: wf_marking_def)\n with wf show ?thesis\n by fastforce\n qed\nqed\n\nlemma allD: \"\\ll. P ll \\ P ll\"\n by blast\n\nlemma replicate_spec: \"\\\\i < n. xs ! i = x; n=length xs\\\n \\ replicate (length xs) x = xs\"\napply hypsubst_thin\napply (induct xs)\napply simp\napply force\ndone\n\nlemma (in Levellist_impl) Levellist_spec_total:\nshows \"\\\\ t. \\,\\\\\\<^sub>t\n \\\\. Dag \\p \\low \\high t \\ (\\i < length \\levellist. \\levellist ! i = Null) \\\n length \\levellist = \\p \\ \\var + 1 \\\n ordered t \\var \\ (\\n \\ set_of t. \\mark n = (\\ \\m) )\\\n \\levellist :== PROC Levellist (\\p, \\m, \\levellist)\n \\\\ll. Levellist \\levellist \\next ll \\ wf_ll t ll \\<^bsup>\\\\<^esup>var \\\n length \\levellist = \\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var + 1 \\\n wf_marking t \\<^bsup>\\\\<^esup>mark \\mark \\<^bsup>\\\\<^esup>m \\\n (\\p. p \\ set_of t \\ \\<^bsup>\\\\<^esup>next p = \\next p)\\\"\napply (hoare_rule HoareTotal.conseq)\napply (rule_tac ll=\"replicate (\\<^bsup>\\\\<^esup>p\\\\<^bsup>\\\\<^esup>var + 1) []\" in allD [OF Levellist_spec_total'])\napply (intro allI impI)\napply (rule_tac x=\\ in exI)\napply (rule_tac x=t in exI)\napply (rule conjI)\napply (clarsimp split:if_split_asm simp del: concat_replicate_trivial)\napply (frule replicate_spec [symmetric])\napply (simp)\napply (clarsimp simp add: Levellist_def )\napply (case_tac i)\napply simp\napply simp\napply (simp add: Collect_conv_if split:if_split_asm)\napply vcg_step\napply (elim exE conjE)\napply (rule_tac x=ll' in exI)\napply simp\napply (thin_tac \"\\p. p \\ set_of t \\ next p = nexta p\")\napply (simp add: wf_levellist_def wf_ll_def)\napply (case_tac \"t = Tip\")\napply simp\napply (rule conjI)\napply clarsimp\napply (case_tac k)\napply simp\napply simp\napply (subgoal_tac \"length ll'=Suc (var Null)\")\napply (simp add: Levellist_length)\napply fastforce\napply (split dag.splits)\napply simp\napply (elim conjE)\napply (intro conjI)\napply (rule allI)\napply (erule_tac x=\"pa\" in allE)\napply clarify\nprefer 2\napply (simp add: Levellist_length)\napply (rule allI)\napply (rule impI)\napply (rule ballI)\napply (rotate_tac 11)\napply (erule_tac x=\"k\" in allE)\napply (rename_tac dag1 ref dag2 k pa)\napply (subgoal_tac \"k <= var ref\")\nprefer 2\napply (subgoal_tac \"ref = p\")\napply simp\napply clarify\napply (erule_tac ?P = \"Dag p low high (Node dag1 ref dag2)\" in rev_mp)\napply (simp (no_asm))\napply (rotate_tac 14)\napply (erule_tac x=k in allE)\napply clarify\napply (erule_tac x=k in allE)\napply clarify\napply (case_tac k)\napply simp\napply simp\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BDD/LevellistProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2861738742885876}} {"text": "(* Title: CTR/CTR.thy\n Author: Mihails Milehins\n Copyright 2021 (C) Mihails Milehins\n\nInfrastructure for the synthesis of the transfer rules and relativized \nconstants.\n*)\n\n\nsection\\\\CTR\\\\\ntheory CTR\n imports \n \"../UD/UD\"\n \"HOL-Library.Conditional_Parametricity\"\n keywords \"ctr_relator\" :: thy_defn\n and \"ctr\" :: thy_defn\n and \"trp\"\n and \"synthesis\"\n and \"relativization\"\n and \"hybrid\"\n and \"parametricity\"\nbegin\n\n\n\nsubsection\\Import\\\n\nML_file \"CTR_Relators.ML\"\nML_file \"CTR_Foundations.ML\"\nML_file \"CTR_Algorithm.ML\"\nML_file \"CTR_Conversions.ML\"\nML_file \"CTR_Relativization.ML\"\nML_file \"CTR_Parametricity.ML\"\nML_file \"CTR_Postprocessing.ML\"\nML_file \"CTR.ML\"\n\n\n\nsubsection\\Rewriting\\\n\nnamed_theorems ctr_blank\nnamed_theorems ctr_simps\n\nlemma ctr_simps_pred_fun_top_eq_range[ctr_simps]: \n \"pred_fun top (\\x. x \\ R) f = (range f \\ R)\"\n by auto\nlemma ctr_simps_pred_prod_eq_cart[ctr_simps]: \n \"pred_prod (\\x. x \\ A) (\\x. x \\ B) = (\\x. x \\ A \\ B)\"\n by auto\nlemma ctr_simps_pred_fun_eq_image[ctr_simps]: \n \"pred_fun (\\x. x \\ D) (\\x. x \\ R) f \\ (f ` D \\ R)\"\n by auto\nlemma ctr_simps_in_iff[ctr_simps]: \"(\\x\\A. x \\ U) \\ A \\ U\" by auto\nlemma ctr_simps_subset_pow_iff[ctr_simps]: \"(\\A\\S. A \\ U) \\ S \\ Pow U\" \n by auto\nlemma ctr_simps_subset_pow_iff'[ctr_simps]: \n \"(\\A. A \\ S \\ A \\ U) \\ S \\ Pow U\" \n by auto\nlemma ctr_simps_subset_pow_iff''[ctr_simps]: \"(S \\ {S. S \\ U}) \\ S \\ Pow U\" \n by (simp add: subset_eq)\nlemma ctr_simps_range_ss_iff[ctr_simps]: \"(\\x. f x \\ U) \\ range f \\ U\" \n by auto\nlemma ctr_simps_range_pow_ss_iff[ctr_simps]: \"(\\x. f x \\ U) \\ range f \\ Pow U\" \n by auto\nlemma ctr_simps_Ball_def'[ctr_simps]: \"(\\x. x \\ A \\ P x) \\ (\\x \\ A. P x)\" \n by auto\nlemma ctr_simps_True_imp[ctr_simps]: \"(True \\ A) \\ A\" by simp\nlemma ctr_simps_True_conj[ctr_simps]: \"(True \\ A) \\ A\" by simp\nlemma ctr_simps_conj_True[ctr_simps]: \"(A \\ True) \\ A\" by simp\nlemma ctr_simps_top_True[ctr_simps]: \"top A \\ True\" by auto\nlemma ctr_simps_Ball_True[ctr_simps]: \"(\\x\\U. True) \\ True\" by auto\nlemma ctr_simps_Ball_UNIV[ctr_simps]: \"(\\n\\UNIV. A n) \\ (\\n. A n)\" by simp\nlemma ctr_simps_Bex_UNIV[ctr_simps]: \"(\\n\\UNIV. A n) \\ (\\n. A n)\" by simp\nlemma ctr_simps_subset_Pow[ctr_simps]: \"{A. A \\ U} = Pow U\" by blast\nlemma ctr_simps_mem_Collect_eq[ctr_simps]: \"(a \\ Collect P) = P a\"\n by (rule mem_Collect_eq)\nlemma ctr_simps_relation_top_empty_eq[ctr_simps]: \"(\\x. x \\ UNIV) = top\" \n by auto\nlemma ctr_simps_pred_fun_eq[ctr_simps]: \n \"pred_fun A B = (\\f. \\x. A x \\ B (f x))\" \n by simp\nlemma ctr_simps_subset_eq_sym[ctr_simps]: \"(\\x\\A. x \\ B) \\ (A \\ B)\" by auto\nlemma ctr_simps_UNIV_I[ctr_simps]: \"x \\ UNIV\" by simp\nlemma ctr_simps_UNIV_def[ctr_simps]: \"{x. True} = UNIV\" by simp\nlemma ctr_simps_conj_commute[ctr_simps]: \"(P \\ Q) \\ (Q \\ P)\" by auto\nlemma ctr_simps_conj_absorb[ctr_simps]: \"(A \\ A) \\ A\" by simp\nlemma ctr_simps_conj_left_absorb[ctr_simps]: \"(A \\ A \\ B) \\ (A \\ B)\" by simp\nlemma ctr_simps_inf_idem[ctr_simps]: \"inf a a = (a::'a::semilattice_inf)\" \n by simp\nlemma ctr_simps_sup_idem[ctr_simps]: \"sup a a = (a::'a::semilattice_sup)\" \n by simp\nlemma ctr_simps_inf_assoc[ctr_simps]: \n \"inf (inf a b) c = inf (a::'a::semilattice_inf) (inf b c)\"\n by (auto simp: semilattice_inf_class.inf.assoc)\nlemma ctr_simps_sup_assoc[ctr_simps]:\n \"sup (sup a b) c = sup (a::'a::semilattice_sup) (sup b c)\"\n by (auto simp: semilattice_sup_class.sup.assoc)\nlemma ctr_simps_Collect_mem_eq[ctr_simps]: \"{x. x \\ U} = U\" by simp\n\n\n\nsubsection\\tts relators\\\n\nctr_relator rel_set\nctr_relator rel_filter\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Conditional_Transfer_Rule/CTR/CTR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.28617387428858754}} {"text": "theory ContractGeneration\nimports Contracts\nbegin\n\nfun map_of_eqs :: \"form \\ (var \\ expr)\" where\n \"map_of_eqs ((f_eq (VarE v) e)\\<^emph>f) = (map_of_eqs f)(v\\e)\"\n| \"map_of_eqs _ = Map.empty\"\n\nfun update_var_eq_after :: \"form \\ (expr\\expr) \\ form\" where\n \"update_var_eq_after (f_eq x y) arg_to_new_expr = \n (case arg_to_new_expr x of Some a \\ f_eq x a | None \\ f_eq x y)\"\n| \"update_var_eq_after ((f_eq x y)\\<^emph>rest) arg_to_new_expr = \n ((case arg_to_new_expr x of Some a \\ f_eq x a | None \\ f_eq x y)\n \\<^emph>(update_var_eq_after rest arg_to_new_expr))\"\n| \"update_var_eq_after f _ = f\"\n\ndefinition (in sound_separation_logic) bap :: \"var set \\ var set \\ form \\ form \\ form \\ form \\ form \\ bool\" where\n \"bap args Uq Qfree Qeq C M F \\ entails (Qfree\\<^emph>M) (add_prenex (sorted_list_of_set ((free_vars C \\ free_vars F)\n -(free_vars Qfree \\ free_vars Qeq \\ free_vars M))) (C\\<^emph>F))\n \\ quantifree_symb_heap M \\ quantifree_symb_heap F\n \\ free_vars M \\ UNIV - args - Uq \\ free_vars F \\ args = {}\"\n\nlocale generation_ctxt = program_logic +\n fixes bap_solver :: \"var set \\ var set \\ form \\ form \\ form \\ (form\\form)\" and pvars :: \"var list\"\n assumes bap_solution: \"\\Uq Qf Qeq C M F. bap_solver (set pvars) Uq Qf Qeq C = (M,F) \n \\ bap (set pvars) Uq Qf Qeq C M F\"\nbegin\n\ntext \\This is what's called biabduct(P,Q,g(a1,...,an),C,D) but with slightly different argument order.\\\ndefinition biabduction_step :: \"(contract\\(var list)) \\ (form\\form) \\ (form\\form) option\" where\n \"biabduction_step func_call PQ = (case PQ of (P,Q) \\\n (case func_call of (contr, call_args) \\\n (case raw_contract contr of ([(C,[D])],f) \\\n (case strip_prenex Q of (Uq, Qf\\<^emph>Qeq) \\ \n \\ \\Rename logical variables\\\n (let (C1,vs) = rename_vars C (free_vars P - (set pvars)) VarE in\n (let (D',_) = rename_vars D (free_vars P - (set (pvars))) vs in\n (case strip_prenex D' of (_, Df\\<^emph>Deq) \\ \n \\ \\Substitute the arguments for the parameters\\\n (let (C2,_) = rename_vars_option C1 {} ((map_of_eqs Qeq) \\\\<^sub>m (map_of (zip (snd f) call_args))) in\n \\ \\Do biabduction and construct the next intermediate contract\\\n (let (M,F) = bap_solver (set pvars) Uq Qf Qeq C2 in\n (let P_after = M \\<^emph> P in\n (let Qf' = F \\<^emph> Df in\n (let Qeq' = update_var_eq_after Qeq ((map_of_eqs Deq) \\\\<^sub>m (map_of (zip (map VarE call_args) (snd f)))) in\n (let Uq_after = (free_vars Qf' \\ free_vars Qeq') - (set pvars) - free_vars P_after in\n (let Q_after = add_prenex (sorted_list_of_set Uq_after) (Qf'\\<^emph>Qeq') in\n Some (P_after,Q_after))))))))\n | _ \\ None))) | _ \\ None) | _ \\ None)))\"\nend\n\ntext \\As in 6.3.1 we assume a function body as a sequence of calls to functions for which we already \n have the (conjunctive) contracts.\\\nlocale sequential = generation_ctxt +\n fixes func_body :: \"(contract\\(var list)) list\"\n assumes non_empty: \"func_body \\ []\" and conj: \"list_all (conjunctive \\ fst) func_body\"\n and simple: \"list_all (\\c. (\\c'. fst (raw_contract (fst c)) = [c'])) func_body\"\n and well_formed: \"list_all (\\c. set (snd c) \\ set (pvars) \\ distinct (snd c)) func_body\"\nbegin\nfun symbolic_execution :: \"(contract\\(var list)) list \\ (form\\form) \\ (form\\form) option\" where\n \"symbolic_execution [] (P,Q) = Some (P,Q)\"\n| \"symbolic_execution (func_call#rest) (P,Q) = (case biabduction_step func_call (P,Q) \n of Some (P_after,Q_after) \\ symbolic_execution rest (P_after,Q_after) | _ \\ None)\"\n\nfun build_initial :: \"var list \\ var set \\ form\" where\n \"build_initial [] _ = Emp\"\n| \"build_initial (x#vs) used = (let X = fresh used in (f_eq x X)\\<^emph>(build_initial vs (insert X used)))\"\n\ndefinition initialP :: form where\n \"initialP \\ simplify_emp_sepconj (build_initial pvars (set pvars))\"\n\ntext \\This is Theorem 3, but I won't prove it yet. This would be way to much work for now.\\\nlemma \"symbolic_execution func_body (initialP, initialP) = Some (P,Q) \\\n sound (Contract ([(P,[Q])], (f,pvars)))\"\n sorry\nend\n\ntype_synonym symb_map = \"CFG_node \\ (form\\form) list\"\naxiomatization P_init Q_init :: form\n\nabbreviation add_prenex_wo_pvars :: \"var set \\ form \\ form\" where\n \"add_prenex_wo_pvars pvars P \\ add_prenex (sorted_list_of_set (free_vars P - pvars)) P\"\n\ndefinition (in sound_separation_logic) covers :: \"var set \\ form \\ form \\ form \\ form \\ bool\" where\n \"covers pvars P Q P' Q' \\ \n entails (add_prenex_wo_pvars pvars P) (add_prenex_wo_pvars pvars P') \\\n entails (add_prenex_wo_pvars pvars Q') (add_prenex_wo_pvars pvars Q)\"\n\nlocale loops_allowed = generation_ctxt +\n fixes func_body :: \"(CFG_node \\ string \\ var list \\ CFG_node) set\" and contracts :: \"string \\ contract\"\n and cut_points :: \"CFG_node set\" and widening :: \"form \\ form\"\n assumes sound_contracts: \"\\f. sound (contracts f)\"\nbegin\n\ndefinition init_symb :: symb_map where \"init_symb \\ (\\_. [])(entry := [(P_init,Q_init)])\"\n\ntext \\Given a worklist of nodes and the symb_maps, relate them to the next worklist and the updated\n symb maps.\\\ninductive symbolic_execution :: \"CFG_node set \\ symb_map \\ CFG_node set \\ symb_map \\ bool\" where\n \"\\v\\worklist; sm v = (P,Q)#sm_v; \\f f_args v'. (v,f,f_args,v') \\ func_body \\ \n insert v' (ws-{v}) \\ worklist_after \\\n (\\(C,Ds) \\ set (fst (raw_contract (contracts f))). \n (\\D\\set Ds.\n (\\P_after Q_after. Some (P_after,Q_after) = \n biabduction_step (Contract ([(C,[D])],snd (raw_contract (contracts f))), f_args) (P,Q) \\\n (v'\\cut_points \\ (sm_after v = sm_v \\ sm_after v' = (sm v')@[(P_after,Q_after)])) \\\n (v\\cut_points \\ (\\P' Q'. ((P',Q')\\ set (sm v') \\ covers (set pvars) P_after Q_after P' Q') \n \\ (sm_after v = sm_v \\ sm_after v' = sm v')) \\ \n (\\P' Q'. ((P',Q')\\ set (sm v') \\ covers (set pvars) P_after Q_after P' Q') \n \\ (sm_after v = sm_v \\ sm_after v' = sm v'@[(widening P_after, widening Q_after)]))))))\\\n \\ symbolic_execution worklist sm worklist_after sm_after\"\nend\nend", "meta": {"author": "firefighterduck", "repo": "isabroom", "sha": "f260dfab2f1f6854986d3c337e3d00ab7728aa26", "save_path": "github-repos/isabelle/firefighterduck-isabroom", "path": "github-repos/isabelle/firefighterduck-isabroom/isabroom-f260dfab2f1f6854986d3c337e3d00ab7728aa26/ContractGeneration.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.2861639518393956}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: LocalRG_HoareDef.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\ntheory LocalRG_HoareDefValidityN \nimports \"SmallStepCon\" \"../EmbSimpl/HoarePartialProps\" \nbegin\nsection \\Validity of Correctness Formulas\\\n\nsubsection \\Aux\\\nlemma tl_pair:\"Suc (Suc j) < length l \\ \n l1 = tl l \\\n P (l!(Suc j)) (l!(Suc (Suc j)))=\n P (l1!j) (l1!(Suc j))\"\nby (simp add: tl_zero_eq)\n\nlemma for_all_k_sublist:\nassumes a0:\"Suc (Suc j)k < j. P ((tl l)!k) ((tl l)!(Suc k)))\" and\n a2:\"P (l!0) (l!(Suc 0))\" \nshows \"(\\k < Suc j. P (l!k) (l!(Suc k)))\"\nproof -\n {fix k\n assume aa0:\"k < Suc j\"\n have \"P (l!k) (l!(Suc k))\"\n proof (cases k)\n case 0 thus ?thesis using a2 by auto\n next\n case (Suc k1) thus ?thesis using aa0 a0 a1 a2\n by (metis SmallStepCon.nth_tl Suc_less_SucD dual_order.strict_trans length_greater_0_conv nth_Cons_Suc zero_less_Suc)\n qed\n } thus ?thesis by auto\nqed\n\n\nsubsection \\Validity for Component Programs.\\\n\ntype_synonym ('s,'f) tran = \"('s,'f) xstate \\ ('s,'f) xstate\"\ntype_synonym ('s,'p,'f) rgformula = \n \"(('s,'p,'f) com \\ (* c *)\n ('s set) \\ (* P *) \n (('s,'f) tran) set \\ (* R *)\n (('s,'f) tran) set \\ (* G *)\n ('s set) \\ (* Q *)\n ('s set))\" (* A *)\n \ntype_synonym ('s,'p,'f) sextuple = \n \"('p \\ (* c *)\n ('s set) \\ (* P *) \n (('s,'f) tran) set \\ (* R *)\n (('s,'f) tran) set \\ (* G *)\n ('s set) \\ (* Q *)\n ('s set))\" (* A *) \n\ndefinition Sta :: \"'s set \\ (('s,'f) tran) set \\ bool\" where\n \"Sta \\ \\f g. (\\x y x'. x' \\ f \\ x=Normal x' \\ (x,y)\\ g \\ (\\y'. y=Normal y' \\ y' \\ f))\"\n\n\ndefinition Norm:: \"(('s,'f) tran) set \\ bool\" where\n \"Norm \\ \\g. (\\x y. (x, y) \\ g \\ (\\x' y'. x=Normal x' \\ y=Normal y'))\"\n\ndefinition env_tran::\n \"('p \\ ('s, 'p, 'f) LanguageCon.com option)\n \\ ('s set)\n \\ (('s, 'p, 'f) LanguageCon.com \\ ('s, 'f) xstate) list\n \\ ('s,'f) tran set \\ bool\"\nwhere\n\"env_tran \\ q l rely \\ snd(l!0) \\ Normal ` q \\ (\\i. Suc i \n \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ rely)\n\"\n\ndefinition env_tran_right::\n \"('p \\ ('s, 'p, 'f) LanguageCon.com option) \n \\ (('s, 'p, 'f) LanguageCon.com \\ ('s, 'f) xstate) list\n \\ ('s,'f) tran set \\ bool\"\nwhere\n\"env_tran_right \\ l rely \\ \n (\\i. Suc i \n \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ rely)\n\"\n\nlemma env_tran_tail:\"env_tran_right \\ (x#l) R \\ env_tran_right \\ l R\"\nunfolding env_tran_right_def\nby fastforce\n\nlemma env_tran_subr:\nassumes a0:\"env_tran_right \\ (l1@l2) R\"\nshows \"env_tran_right \\ l1 R\"\nunfolding env_tran_right_def\nproof -\n {fix i\n assume a1:\"Suc i< length l1\"\n assume a2:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n then have \"Suc i < length (l1@l2)\" using a1 by fastforce\n also then have \"\\\\\\<^sub>c (l1@l2) ! i \\\\<^sub>e (l1@l2) ! Suc i\" \n proof -\n show ?thesis\n by (simp add: Suc_lessD a1 a2 nth_append)\n qed\n ultimately have f1:\"(snd ((l1@l2)! i), snd ((l1@l2) ! Suc i)) \\ R\"\n using a0 unfolding env_tran_right_def by auto\n then have \"(snd (l1! i), snd (l1 ! Suc i)) \\ R\"\n using a1\nproof -\n have \"\\ps psa n. if n < length ps then (ps @ psa) ! n = (ps ! n::('b, 'a, 'c) LanguageCon.com \\ ('b, 'c) xstate) else (ps @ psa) ! n = psa ! (n - length ps)\"\n by (meson nth_append)\n then show ?thesis\n using f1 \\Suc i < length l1\\ by force\nqed \n } then show \n \"\\i. Suc i < length l1 \\\n \\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i \\\n (snd (l1 ! i), snd (l1 ! Suc i)) \\ R\"\n by blast\nqed\n \n\nlemma env_tran_subl:\"env_tran_right \\ (l1@l2) R \\ env_tran_right \\ l2 R\"\nproof (induct \"l1\")\n case Nil thus ?case by auto\nnext\n case (Cons a l1) thus ?case by (fastforce intro:append_Cons env_tran_tail )\nqed\n\nlemma env_tran_R_R':\"env_tran_right \\ l R \\ \n (R \\ R') \\\n env_tran_right \\ l R'\"\nunfolding env_tran_right_def Satis_def sep_conj_def\napply clarify\napply (erule allE)\napply auto\ndone\n\n\n(* lemma skip_fault_tran_false:\nassumes a0:\"(\\,l) \\ cptn\" and\n a1:\"Suc i l!i=(Skip, t) \\ (\\t'. \\(t=Normal t'))\" and\n a2: \"env_tran_right \\ l rely \\ Norm rely\" and \n a3: \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\"\nshows \"P\"\nproof -\n from a3 have \"\\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \\\\\\<^sub>c(l!i) \\ (l!(Suc i))\"\n using step_ce_elim_cases by blast\n thus ?thesis\n proof\n assume \"\\\\\\<^sub>c l ! i \\\\<^sub>e (l ! Suc i)\"\n thus ?thesis using a2 a1 unfolding env_tran_right_def Norm_def by fastforce\n next\n assume \"\\\\\\<^sub>c l ! i \\ (l ! Suc i)\"\n thus ?thesis using a1 by (metis (full_types) stepc_elim_cases(1)) \n qed \nqed *)\n\n(* lemma skip_fault_last:\nassumes a0:\"(\\,l) \\ cptn\" and\n a1:\"(i< (length l)) \\ (l!i)=(Skip, t) \\ (\\t'. \\(t=Normal t'))\" and\n a2: \"env_tran_right \\ l rely \\ Norm rely\" \nshows \"i=((length l)-1)\"\nproof (cases \"i = ((length l)-1)\")\n case True thus ?thesis .\nnext\n case False \n have \"0 < length l\" using a1 by auto\n then obtain x xs where l:\"l=x#xs\"\n by (meson gr0_conv_Suc length_Suc_conv) \n then have suci:\"Suc i < length l\" using False a1 by fastforce\n then have \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" \n using a0 a1 cptn_stepc_rtran l by blast\n thus ?thesis using a0 a1 a2 skip_fault_tran_false suci by blast \nqed *)\n\nlemma env_tran_normal:\nassumes a0:\"env_tran_right \\ l rely \\ Sta q rely \\ snd(l!i) = Normal s1 \\ s1\\q\" and\n a1:\"Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\nshows \"\\s1 s2. snd(l!i) = Normal s1 \\ snd(l!(Suc i)) = Normal s2 \\ s2\\q\"\nusing a0 a1 unfolding env_tran_right_def Sta_def by fastforce\n\nlemma no_env_tran_not_normal:\nassumes a0:\"env_tran_right \\ l rely \\ Sta q rely \\ snd(l!i) = Normal s1 \\ s1\\q\" and\n a1:\"Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a2:\"(\\s1. \\ (snd(l!i) = Normal s1)) \\ (\\s2. \\ (snd (l!Suc i) = Normal s2))\"\nshows \"P\"\nusing a0 a1 a2 unfolding env_tran_right_def Sta_def by fastforce \n \ndefinition assum :: \n \"('s set \\ ('s,'f) tran set) \\\n 'f set \\\n (('s,'p,'f) confs) set\" where\n \"assum \\ \\(pre, rely) F. \n {c. snd((snd c)!0) \\ Normal ` pre \\ \n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ rely)}\"\n\ndefinition assum1 :: \n \"('s set \\ ('s,'f) tran set) \\\n 'f set \\\n (('s,'p,'f) confs) set\" where\n \"assum1 \\ \\(pre, rely) F. \n {(\\,comp). snd(comp!0) \\ Normal ` pre \\ \n (\\i. Suc i \n \\\\\\<^sub>c(comp!i) \\\\<^sub>e (comp!(Suc i)) \\ \n (snd(comp!i), snd(comp!(Suc i))) \\ rely)}\"\n\n\nlemma assum_R_R': \n \"(\\, l) \\ assum(p, R) F \\\n snd(l!0) \\ Normal ` p' \\\n R \\ R' \\ \n (\\, l) \\ assum(p', R') F\"\nproof -\nassume a0:\"(\\, l) \\ assum(p, R) F\" and\n a1:\"snd(l!0) \\ Normal ` p'\" and\n a2: \" R \\ R'\"\n then have \"env_tran_right \\ l R\" \n unfolding assum_def using env_tran_right_def\n by force\n then have \"env_tran_right \\ l R'\" \n using a2 env_tran_R_R' by blast\n thus ?thesis using a1 unfolding assum_def unfolding env_tran_right_def\n by fastforce\nqed\n\n\nlemma same_prog_p:\n \"(\\,(P,s)#(P,t)#l)\\cptn \\\n (\\,(P,s)#(P,t)#l) \\ assum (p,R) F \\\n Sta p R \\\n \\t1. t=Normal t1 \\ t1 \\ p\n \" \nproof -\nassume a0: \"(\\,(P,s)#(P,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(P,t)#l) \\ assum (p,R) F\" and\n a2: \"Sta p R\"\n then have \"Suc 0 < length ((P,s)#(P,t)#l)\" \n by fastforce\n then have \"\\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\\\<^sub>c\\<^sub>e (((P,s)#(P,t)#l)!(Suc 0))\" \n using a0 cptn_stepc_rtran by fastforce \n then have step_ce:\"\\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\\\<^sub>e (((P,s)#(P,t)#l)!(Suc 0)) \\\n \\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\ (((P,s)#(P,t)#l)!(Suc 0))\"\n using step_ce_elim_cases by blast \n then obtain s1 where s:\"s=Normal s1 \\ s1 \\ p\" \n using a1 unfolding assum_def\n by fastforce\n have \"\\t1. t=Normal t1 \\ t1 \\ p \"\n using step_ce\n proof\n {assume step_e:\"\\\\\\<^sub>c ((P, s) # (P, t) # l) ! 0 \\\\<^sub>e\n ((P, s) # (P, t) # l) ! Suc 0\"\n have ?thesis \n using a2 a1 s unfolding Sta_def assum_def \n proof -\n have \"(Suc 0 < length ((P, s) # (P, t) # l))\"\n by fastforce\n then have assm:\"(s, t) \\ R\"\n using s a1 step_e\n unfolding assum_def by fastforce\n then obtain t1 s2 where s_t:\"s= Normal s2 \\ t = Normal t1\" \n using a2 s unfolding Sta_def by fastforce \n then have R:\"(s,t)\\R\" \n using assm unfolding Satis_def by fastforce\n then have \"s2=s1\" using s s_t by fastforce\n then have \"t1\\p\" \n using a2 s s_t R unfolding Sta_def Norm_def by blast\n thus ?thesis using s_t by blast\n qed thus ?thesis by auto\n } \n next\n { \n assume step:\"\\\\\\<^sub>c ((P, s) # (P, t) # l) ! 0 \\\n ((P, s) # (P, t) # l) ! Suc 0\"\n then have \"P\\P \\ s=t\"\n proof -\n have \"\\\\\\<^sub>c (P, s) \\ (P, t)\"\n using local.step by force\n then show ?thesis\n using step_change_p_or_eq_s by blast\n qed\n then show ?thesis using s by fastforce\n }\n qed thus ?thesis by auto\nqed\n\nlemma tl_of_assum_in_assum:\n \"(\\,(P,s)#(P,t)#l)\\cptn \\\n (\\,(P,s)#(P,t)#l) \\ assum (p,R) F \\\n Sta p R \\\n (\\,(P,t)#l) \\ assum (p,R) F\n \" \nproof -\n assume a0: \"(\\,(P,s)#(P,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(P,t)#l) \\ assum (p,R) F\" and\n a2: \"Sta p R \"\n \n then obtain t1 where t1:\"t=Normal t1 \\ t1 \\p\" \n using same_prog_p by blast\n then have \"env_tran_right \\ ((P,s)#(P,t)#l) R\"\n using env_tran_right_def a1 unfolding assum_def\n by force\n then have \"env_tran_right \\ ((P,t)#l) R\"\n using env_tran_tail by auto\n thus ?thesis using t1 unfolding assum_def env_tran_right_def by auto\nqed\n\nlemma tl_of_assum_in_assum1:\n \"(\\,(P,s)#(Q,t)#l)\\cptn \\\n (\\,(P,s)#(Q,t)#l) \\ assum (p,R) F \\\n t \\ Normal ` q \\\n (\\,(Q,t)#l) \\ assum (q,R) F\n \" \nproof -\n assume a0: \"(\\,(P,s)#(Q,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(Q,t)#l) \\ assum (p,R) F\" and\n a2: \"t \\ Normal ` q\" \n then have \"env_tran_right \\ ((P,s)#(Q,t)#l) R\"\n using env_tran_right_def a1 unfolding assum_def\n by force\n then have \"env_tran_right \\ ((Q,t)#l) R\"\n using env_tran_tail by auto\n thus ?thesis using a2 unfolding assum_def env_tran_right_def by auto\nqed\n \nlemma sub_assum:\n assumes a0: \"(\\,(x#l0)@l1) \\ assum (p,R) F\"\n shows \"(\\,x#l0) \\ assum (p,R) F\" \nproof -\n {have p0:\"snd x \\ Normal ` p\" \n using a0 unfolding assum_def by force\n then have \"env_tran_right \\ ((x#l0)@l1) R\"\n using a0 unfolding assum_def \n by (auto simp add: env_tran_right_def)\n then have env:\"env_tran_right \\ (x#l0) R\" \n using env_tran_subr by blast \n also have \"snd ((x#l0)!0) \\ Normal ` p\" \n using p0 by fastforce\n ultimately have \"snd ((x#l0)!0) \\ Normal ` p \\ \n (\\i. Suc i \n \\\\\\<^sub>c((x#l0)!i) \\\\<^sub>e ((x#l0)!(Suc i)) \\ \n (snd((x#l0)!i), snd((x#l0)!(Suc i))) \\ R)\"\n unfolding env_tran_right_def by auto\n } \n then show ?thesis unfolding assum_def by auto\nqed \n\nlemma sub_assum_r:\n assumes a0: \"(\\,l0@x1#l1) \\ assum (p,R) F\" and\n a1: \"(snd x1) \\ Normal ` q\"\n shows \"(\\,x1#l1) \\ assum (q,R) F\"\nproof -\n have \"env_tran_right \\ (l0@x1#l1) R\"\n using a0 unfolding assum_def env_tran_right_def\n by fastforce\n then have \"env_tran_right \\ (x1#l1) R\"\n using env_tran_subl by auto\n thus ?thesis using a1 unfolding assum_def env_tran_right_def by fastforce\nqed\n\ndefinition comm :: \n \"(('s,'f) tran) set \\ \n ('s set \\ 's set) \\\n 'f set \\ \n (('s,'p,'f) confs) set\" where\n \"comm \\ \\(guar, (q,a)) F. \n {c. snd (last (snd c)) \\ Fault ` F \\ \n (\\i. \n Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\ ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ guar) \\ \n (final (last (snd c)) \\ \n ((fst (last (snd c)) = Skip \\ \n snd (last (snd c)) \\ Normal ` q)) \\\n (fst (last (snd c)) = Throw \\ \n snd (last (snd c)) \\ Normal ` a))}\"\n\ndefinition comm1 :: \n \"(('s,'f) tran) set \\ \n ('s set \\ 's set) \\\n 'f set \\ \n (('s,'p,'f) confs) set\" where\n \"comm1 \\ \\(guar, (q,a)) F. \n {(\\,comp). snd (last comp) \\ Fault ` F \\ \n (\\i. \n Suc i \n \\\\\\<^sub>c(comp!i) \\ (comp!(Suc i)) \\ \n (snd(comp!i), snd(comp!(Suc i))) \\ guar) \\ \n (final (last comp) \\ \n ((fst (last comp) = Skip \\ \n snd (last comp) \\ Normal ` q)) \\\n (fst (last comp) = Throw \\ \n snd (last comp) \\ Normal ` a))}\"\n\nlemma comm_dest:\n\"(\\, l)\\ comm (G,(q,a)) F \\\n snd (last l) \\ Fault ` F \\\n (\\i. Suc i\n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\nunfolding comm_def\napply clarify\napply (drule mp)\napply fastforce\napply (erule conjE)\napply (erule allE)\nby auto\n\nlemma comm_dest1:\n\"(\\, l)\\ comm (G,(q,a)) F \\\n snd (last l) \\ Fault ` F \\\n Suc i\n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\\n(snd(l!i), snd(l!(Suc i))) \\ G\"\nunfolding comm_def\napply clarify\napply (drule mp)\napply fastforce\napply (erule conjE)\napply (erule allE)\nby auto\n\nlemma comm_dest2:\n assumes a0: \"(\\, l)\\ comm (G,(q,a)) F\" and\n a1: \"final (last l)\" and\n a2: \"snd (last l) \\ Fault ` F\" \n shows \" ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\nproof -\n show ?thesis using a0 a1 a2 unfolding comm_def by auto\nqed\n\nlemma comm_des3:\n assumes a0: \"(\\, l)\\ comm (G,(q,a)) F\" and\n a1: \"snd (last l) \\ Fault ` F\"\n shows \"final (last l) \\ ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\nusing a0 a1 unfolding comm_def by auto\n\nlemma commI:\n assumes a0:\"snd (last l) \\ Fault ` F \\\n (\\i. \n Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G) \\ \n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\nshows \"(\\,l)\\comm (G, (q,a)) F\"\nusing a0 unfolding comm_def\napply clarify\nby simp\n\nlemma comm_conseq:\n \"(\\,l) \\ comm(G', (q',a')) F \\\n G' \\ G \\\n q' \\ q \\\n a' \\ a \\\n (\\,l) \\ comm (G,(q,a)) F\"\nproof -\n assume a0:\"(\\,l) \\ comm(G', (q',a')) F\" and\n a1:\" G' \\ G \\\n q' \\ q \\\n a' \\ a\"\n {\n assume a:\"snd (last l) \\ Fault ` F \"\n have l:\"(\\i. \n Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a00:\"Suc i\\\\<^sub>c(l!i) \\ (l!(Suc i))\" \n have \"(snd(l!i), snd(l!(Suc i))) \\ G\" \n proof -\n have \"(snd(l!i), snd(l!(Suc i))) \\ G'\"\n using comm_dest1 [OF a0 a a00 a11] by auto\n thus ?thesis using a1 unfolding Satis_def sep_conj_def by fastforce\n qed\n } thus ?thesis by auto\n qed \n have \"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof -\n {assume a33:\"final (last l)\"\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q')) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a')\"\n using comm_dest2[OF a0 a33 a] by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\n using a1 by fastforce\n } thus ?thesis by auto\n qed\n note res1 = conjI[OF l this] \n } thus ?thesis unfolding comm_def by simp\nqed \n\ndefinition com_validity :: \n \"('s,'p,'f) body \\ 'f set \\ ('s,'p,'f) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ bool\" \n (\"_ \\\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,20,1000,1000,1000,1000,1000] 60) where\n \"\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n \\s. cp \\ Pr s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n\ndefinition com_validityn :: \n \"('s,'p,'f) body \\ nat \\ 'f set \\ ('s,'p,'f) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ bool\" \n (\"_ \\_:\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,60,20,1000,1000,1000,1000,1000] 60) where\n \"\\ \\n:\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n \\s. (cpn n \\ Pr s) \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n\ndefinition com_cvalidity::\n \"('s,'p,'f) body \\\n ('s, 'p, 'f) sextuple set \\\n 'f set \\\n ('s,'p,'f) com \\ \n 's set \\ \n (('s,'f) tran) set \\ \n (('s,'f) tran) set \\ \n 's set \\ \n 's set \\\n bool\" \n (\"_,_ \\\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,60,20,1000,1000,1000,1000,1000] 60) where\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \n \\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\n\ndefinition com_cvalidityn::\n \"('s,'p,'f) body \\\n ('s, 'p, 'f) sextuple set \\ nat \\ \n 'f set \\\n ('s,'p,'f) com \\ \n 's set \\ \n (('s,'f) tran) set \\ \n (('s,'f) tran) set \\ \n 's set \\ \n 's set \\\n bool\" \n (\"_,_ \\_:\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,60,60,20,1000,1000,1000,1000,1000] 60) where\n \"\\,\\ \\n:\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\n:\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \n \\ \\n:\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\nlemma cvalid_iff_cnvalid:\n\"\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] = (\\n. \\ \\n:\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])\"\n apply (simp only: com_validity_def com_validityn_def cp_def cpn_def Int_def subset_eq)\n using cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod_set\n by fastforce\n\nlemma cvalid_to_cnvalid:\n\"(\\n. \\,\\ \\n:\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]) \\ \\,\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \"\n apply (simp only: com_cvalidityn_def com_cvalidity_def cvalid_iff_cnvalid)\n by fast\n \n \nlemma etran_in_comm:\n \"(\\,(P, t) # xs) \\ comm(G, (q,a)) F \\ \n \\ (\\\\\\<^sub>c((P,s)) \\ ((P,t))) \\\n (\\,(P, s) # (P, t) # xs) \\ cptn \\ \n (\\,(P, s) # (P, t) # xs) \\ comm(G, (q,a)) F\" \nproof -\n assume a1:\"(\\,(P, t) # xs) \\ comm(G, (q,a)) F\" and\n a2:\"\\ \\\\\\<^sub>c((P,s)) \\ ((P,t))\" and\n a3:\"(\\,(P, s) # (P, t) # xs) \\ cptn\"\n show ?thesis using comm_def a1 a2 a3\n proof -\n {\n let ?l1 = \"(P, t) # xs\"\n let ?l = \"(P, s) # ?l1\"\n assume a00:\"snd (last ?l) \\ Fault ` F\"\n have concl:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have p1:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(?l1!i) \\ (?l1!(Suc i)) \\ \n (snd(?l1!i), snd(?l1!(Suc i))) \\ G)\"\n using a1 a3 a00 unfolding comm_def by auto\n have \"(snd (?l ! i), snd (?l ! Suc i)) \\ G\" \n proof (cases i)\n case 0 \n have \"\\\\\\<^sub>c (P, s) \\ (P, t)\" using a12 0 by auto\n thus ?thesis using a2 by auto \n next\n case (Suc n) thus ?thesis\n proof -\n have f1: \"\\\\\\<^sub>c ((P, t) # xs) ! n \\ ((P, t) # xs) ! Suc n\"\n using Suc a12 by fastforce\n have f2: \"Suc n < length ((P, t) # xs)\"\n using Suc a11 by fastforce \n have \"snd (last ((P, t) # xs)) \\ Fault ` F\"\n by (metis (no_types) a00 last.simps list.distinct(1))\n hence \"(snd (((P, t) # xs) ! n), snd (((P, t) # xs) ! Suc n)) \\ G\"\n using f2 f1 a1 comm_dest1 by blast \n thus ?thesis\n by (simp add: Suc)\n qed \n qed\n } thus ?thesis by auto\n qed\n have concr:\"(final (last ?l) \\ \n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q)) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a))\"\n using a1 a00 unfolding comm_def by auto\n note res1=conjI[OF concl concr] } \n thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma ctran_in_comm: \n \" (Normal s,Normal s) \\ G \\\n (\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F \\ \n (\\,(P, Normal s) # (Q, Normal s) # xs) \\ comm(G, (q,a)) F\"\nproof -\n assume a1:\"(Normal s,Normal s) \\ G\" and\n a2:\"(\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F\" \n show ?thesis using comm_def a1 a2\n proof -\n {\n let ?l1 = \"(Q, Normal s) # xs\"\n let ?l = \"(P, Normal s) # ?l1\"\n assume a00:\"snd (last ?l) \\ Fault ` F\"\n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have p1:\"(\\i. Suc i \n \\\\\\<^sub>c(?l1!i) \\ (?l1!(Suc i)) \\ \n (snd(?l1!i), snd(?l1!(Suc i))) \\ G)\"\n using a2 a00 unfolding comm_def by auto\n have \"(snd (?l ! i), snd (?l ! Suc i)) \\ G\" \n proof (cases i)\n case 0 \n then have \"snd (((P, Normal s) # (Q, Normal s) # xs) ! i) = Normal s \\ \n snd (((P, Normal s) # (Q, Normal s) # xs) ! (Suc i)) = Normal s\" \n by fastforce\n also have \"(Normal s, Normal s) \\ G\"\n using Satis_def a1 by blast\n ultimately show ?thesis using a1 Satis_def by auto \n next\n case (Suc n) thus ?thesis using p1 a2 a11 a12 \n proof -\n have f1: \"\\\\\\<^sub>c ((Q, Normal s) # xs) ! n \\ ((Q, Normal s) # xs) ! Suc n\"\n using Suc a12 by fastforce\n have f2: \"Suc n < length ((Q, Normal s) # xs)\"\n using Suc a11 by fastforce\n thus ?thesis using Suc f1 nth_Cons_Suc p1 by auto \n qed \n qed\n } thus ?thesis by auto\n qed\n have concr:\"(final (last ?l) \\ \n snd (last ?l) \\ Fault ` F \\\n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q)) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a))\"\n using a2 unfolding comm_def by auto\n note res=conjI[OF concl concr]}\n thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma not_final_in_comm:\n \"(\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F \\\n \\ final (last ((Q, Normal s) # xs)) \\\n (\\,(Q, Normal s) # xs) \\ comm(G, (q',a')) F\"\nunfolding comm_def by force\n\nlemma comm_union:\n assumes \n a0: \"(\\,xs) \\ comm(G, (q,a)) F\" and\n a1: \"(\\,ys) \\ comm(G, (q',a')) F\" and\n a2: \"xs\\[] \\ ys\\[]\" and\n a3: \"( snd (last xs),snd (ys!0)) \\ G\" and\n a4: \"(\\,xs@ys) \\ cptn\"\n shows \"(\\,xs@ys) \\ comm(G, (q',a')) F\" \nproof -\n{\n let ?l=\"xs@ys\" \n assume a00:\"snd (last (xs@ys)) \\ Fault ` F\"\n have last_ys:\"last (xs@ys) = last ys\" using a2 by fastforce\n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have all_ys:\"\\i\\length xs. (xs@ys)!i = ys!(i-(length xs))\"\n by (simp add: nth_append) \n have all_xs:\"\\i G\"\n proof (cases \"Suc i>length xs\")\n case True \n have \"Suc (i - (length xs)) < length ys\" using a11 True by fastforce\n moreover have \"\\\\\\<^sub>c (ys ! (i-(length xs))) \\ ( ys ! ((Suc i)-(length xs)))\" \n using a12 all_ys True by fastforce \n moreover have \"snd (last ys) \\ Fault ` F\" using last_ys a00 by fastforce \n ultimately have \"(snd(ys!(i-(length xs))), snd(ys!Suc (i-(length xs)))) \\ G\" \n using a1 comm_dest1[of \\ ys G q' a' F \"i-length xs\"] True Suc_diff_le by fastforce \n thus ?thesis using True all_ys Suc_diff_le by fastforce\n next\n case False note F1=this thus ?thesis \n proof (cases \"Suc i < length xs\")\n case True \n then have \"snd ((xs@ys)!(length xs -1)) \\ Fault ` F\"\n using a00 a2 a4 \n by (simp add: last_not_F ) \n then have \"snd (last xs) \\ Fault ` F\" using all_xs a2 by (simp add: last_conv_nth ) \n moreover have \"\\\\\\<^sub>c (xs ! i) \\ ( xs ! Suc i)\" \n using True all_xs a12 by fastforce \n ultimately have\"(snd(xs!i), snd(xs!(Suc i))) \\ G\"\n using a0 comm_dest1[of \\ xs G q a F i] True by fastforce\n thus ?thesis using True all_xs by fastforce\n next\n case False\n then have suc_i:\"Suc i = length xs\" using F1 by fastforce\n then have i:\"i=length xs -1\" using a2 by fastforce \n then show ?thesis using a3 \n by (simp add: a2 all_xs all_ys last_conv_nth ) \n qed\n qed\n } thus ?thesis by auto \n qed\n have concr:\"(final (last ?l) \\ \n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q')) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a'))\"\n using a1 last_ys a00 a2 comm_des3 by fastforce\n note res=conjI[OF concl concr]}\n thus ?thesis unfolding comm_def by auto \nqed\n\n(* text{* \n@{text rel_safe} specifies that the relation leaves unmodifed any fragment out of the \nstate\n*}\ndefinition rel_safe:: \"(('l::sep_algebra,'g::sep_algebra) transition \\ bool) \\ bool\"\nwhere\n\"rel_safe R \\ \\h h1 h2 t. R (h1,t) \\ ((h1 \\\\<^sub>p h2) h) \\ R (h, t \\ h2)\"\n\ndefinition mem_safe::\n\"(('l::sep_algebra,'g::sep_algebra) state,'p,'f) body \\ \n (('l,'g) state,'p,'f) com \\ \n (('l,'g) transition \\ bool) \\ \n bool\"\nwhere\n \"mem_safe \\ f R \\ \\h h1 h2 t1. \n ((\\c\\ cp \\ f (Normal h1). \n final_valid(last (snd c)) \\ (Normal t1 = snd (last (snd c))) \\\n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ \n (case_prod (\\x y. (Normal x, Normal y))) ` (R))) \\ \n (h1 \\\\<^sub>p h2) h \\\n (\\c\\ cp \\ f (Normal h). \n final_valid(last (snd c)) \\\n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ \n (case_prod (\\x y. (Normal x, Normal y))) ` (R)) \\\n (Normal (t1 \\ h2) = snd (last (snd c))))) \n \" \n *)\n\n \nsubsection \\Validity for Parallel Programs.\\\ndefinition All_End :: \"('s,'p,'f) par_config \\ bool\" where\n \"All_End xs \\ fst xs \\[] \\ (\\i \n (('s,'f) tran) set) \\\n 'f set \\\n (('s,'p,'f) par_confs) set\" where\n \"par_assum \\ \n \\(pre, rely) F. {c. \n snd((snd c)!0) \\ Normal ` pre \\ (\\i. Suc i \n (fst c)\\\\<^sub>p((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ rely)}\"\n \ndefinition par_comm :: \n \"((('s,'f) tran) set \\ \n ('s set \\ 's set)) \\ \n 'f set \\\n (('s,'p,'f) par_confs) set\" where\n \"par_comm \\ \n \\(guar, (q,a)) F. \n {c. snd (last (snd c)) \\ Fault ` F \\ \n (\\i. \n Suc i \n (fst c)\\\\<^sub>p((snd c)!i) \\ ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ guar) \\ \n (All_End (last (snd c)) \\ \n (\\j \n snd (last (snd c)) \\ Normal ` a) \\\n (\\j\n snd (last (snd c)) \\ Normal ` q))}\"\n\ndefinition par_com_validity :: \n \"('s,'p,'f) body \\ \n 'f set \\\n ('s,'p,'f) par_com \\ \n ('s set) \\ \n ((('s,'f) tran) set) \\ \n ((('s,'f) tran) set) \\ \n ('s set) \\\n ('s set) \\ \n bool\" \n(\"_ \\\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\ \\\\<^bsub>/F\\<^esub> Ps SAT [pre, R, G, q,a] \\ \n \\s. par_cp \\ Ps s \\ par_assum(pre, R) F \\ par_comm(G, (q,a)) F\"\n \ndefinition par_com_cvalidity :: \n \"('s,'p,'f) body \\\n ('s,'p,'f) sextuple set \\\n 'f set \\\n ('s,'p,'f) par_com \\ \n ('s set) \\ \n ((('s,'f) tran) set) \\ \n ((('s,'f) tran) set) \\ \n ('s set) \\\n ('s set) \\ \n bool\" \n(\"_,_ \\\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. (\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])) \\\n \\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a]\"\n \ndeclare Un_subset_iff [simp del] sup.bounded_iff [simp del]\n\ninductive\nlrghoare :: \"[('s,'p,'f) body,\n ('s,'p,'f) sextuple set,\n 'f set,\n ('s,'p,'f) com, \n ('s set), \n (('s,'f) tran) set, (('s,'f) tran) set,\n 's set,\n 's set] \\ bool\"\n (\"_,_ \\\\<^bsub>'/_\\<^esub> _ sat [_, _, _, _,_]\" [61,61,60,60,0,0,0,0] 45)\nwhere\n Skip: \"\\ Sta q R; (\\s. (Normal s, Normal s) \\ G) \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [q, R, G, q,a] \"\n\n|Spec: \"\\p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}; \n (\\s t. s\\p \\ (s,t)\\r \\ (Normal s,Normal t) \\ G);\n Sta p R;Sta q R\\ \\ \\,\\ \\\\<^bsub>/F\\<^esub> (Spec r) sat [p, R, G, q,a]\"\n\n| Basic: \"\\ p \\ {s. f s \\ q}; \n (\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G);\n Sta p R;Sta q R \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Basic f) sat [p, R, G, q,a]\"\n\n| If: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]; \n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]; \n Sta p R; (\\s. (Normal s, Normal s) \\ G)\n \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p, R, G, q,a]\"\n\n| While: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]; \n Sta p R; Sta (p \\ (-b)) R; Sta a R; (\\s. (Normal s,Normal s) \\ G)\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (While b c) sat [p, R, G, p \\ (-b),a]\"\n\n| Seq: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]; \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]; \n Sta a R; Sta p R; (\\s. (Normal s,Normal s) \\ G)\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\n\n| Await: \"\\ \\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a); \n Sta p R; Sta q R; Sta a R\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Await b c) sat [p, R, G, q,a]\"\n\n| Guard: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ g, R, G, q,a]; \n Sta (p \\ g) R; (\\s. (Normal s, Normal s) \\ G)\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c) sat [p \\ g, R, G, q,a]\"\n\n| Guarantee: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ g, R, G, q,a];\n Sta p R;f\\F; (\\s. (Normal s, Normal s) \\ G) \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c) sat [p, R, G, q,a]\"\n\n| CallRec: \"\\(c,p,R,G,q,a) \\ Specs; \n \\(c,p,R,G,q,a)\\ Specs. c \\ dom \\ \\ \n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p, R, G, q,a];\n Sta p R; (\\s. (Normal s, Normal s) \\ G)\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n\n| Asm: \"\\(c,p,R,G,q,a) \\ \\\\ \n \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| Call: \"\\c \\ dom \\; \n \\,\\ \\\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p, R, G, q,a]; \n Sta p R; (\\s. (Normal s, Normal s) \\ G)\\ \n \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n\n| DynCom: \"\\(\\s \\ p. (\\,\\\\\\<^bsub>/F\\<^esub> (c s) sat [p, R, G, q,a]));\n (Sta p R) \\ (Sta q R) \\ (Sta a R) \\\n (\\s. (Normal s,Normal s) \\ G)\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> (DynCom c) sat [p, R, G, q,a]\"\n\n| Throw: \"\\Sta a R; (\\s. (Normal s, Normal s) \\ G) \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Throw sat [a, R, G, q,a] \"\n\n| Catch: \"\\ \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]; \n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]; \n Sta q R; (\\s. (Normal s, Normal s) \\ G)\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\n\n| Conseq: \"\\s \\ p. \n (\\p' R' G' q' a'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n (\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) ) \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n\n| Conj_post: \" \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a] \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q \\ q',a \\ a']\" \n\ninductive_cases hoare_elim_cases [cases set]:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\nthm hoare_elim_cases\n(*\nlemma \"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a] \\ \n \\s \\ p. \n (\\p' R' G' q' a'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n (\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\ p'=q' \\ Sta q' R' \\ Norm R' \\ (\\s. (Normal s, Normal s) \\ G'))\"\nproof -\n assume a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\" \n {\n fix s\n assume a01:\"s\\p\"\n have \"(\\p' R' G' q' a'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n (\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\ p'=q' \\ Sta q' R' \\ Norm R' \\ (\\s. (Normal s, Normal s) \\ G'))\"\n proof (cases \"p=q\")\n case True thus ?thesis using hoare_elim_cases sorry\n next\n case False thus ?thesis sorry\n qed\n } thus ?thesis by fastforce\nqed*)\n\n(* lemma \"\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,r] \\\n c\\Throw \\\n Sta p R\"\nsorry *)\n(*\n| Env: \"\\noawaits c; \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> (p ) (sequential c) q,(a)\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p, sep_empty, Emp, Emp, q,a]\"\n \n| Hide: \"\\\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, (I \\* I'), (R \\* R'), (G \\* G'), q,a]; \n (I \\ R); \n (I \\ G)\n \\ \\ \n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p, I, R, G, q,a]\" \n\n|Frame: \"\\\n \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, I, R, G , q,a]; \n I' \\ R'; I' \\ G';\n Sta r (R'\\*tran_Id);\n (\\s t. (r imp (I'\\*sep_true))(s,t));\n (rel_safe R); (rel_safe (G\\*tran_True)) \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p\\*r, I \\* I', R \\* R', G \\* G', q\\*r,a\\*r]\"\n*)\n\n\ndefinition Pre :: \" ('s,'p,'f)rgformula \\ ('s set)\" where\n \"Pre x \\ fst(snd x)\"\n\ndefinition Post :: \"('s,'p,'f) rgformula \\ ('s set)\" where\n \"Post x \\ fst(snd(snd(snd(snd x))))\"\n\ndefinition Abr :: \"('s,'p,'f) rgformula \\ ('s set)\" where\n \"Abr x \\ snd(snd(snd(snd(snd x))))\"\n\ndefinition Rely :: \"('s,'p,'f) rgformula \\ (('s,'f) tran) set\" where\n \"Rely x \\ fst(snd(snd x))\"\n\ndefinition Guar :: \"('s,'p,'f) rgformula \\ (('s,'f) tran) set\" where\n \"Guar x \\ fst(snd(snd(snd x)))\"\n\ndefinition Com :: \"('s,'p,'f) rgformula \\ ('s ,'p,'f) com\" where\n \"Com x \\ fst x\"\n\n\ninductive\n par_rghoare :: \"[('s,'p,'f) body,\n ('s,'p,'f) sextuple set,\n 'f set,\n ( ('s,'p,'f) rgformula) list, \n 's set, \n (('s,'f) tran) set, (('s,'f) tran) set,\n 's set,\n 's set] \\ bool\"\n (\"_,_ \\\\<^bsub>'/_\\<^esub> _ SAT [_, _, _, _,_]\" [61,60,60,0,0,0,0] 45)\nwhere\n Parallel:\n \"\\ \\i (\\j\\{j. j j\\i}. (Guar(xs!j))) \\ (Rely(xs!i));\n (\\j G;\n p \\ (\\ii q;\n (\\i a; \n \\i,\\ \\\\<^bsub>/F\\<^esub> Com(xs!i) sat [Pre(xs!i),Rely(xs!i),Guar(xs!i),Post(xs!i),Abr(xs!i)] \\\n \\ \\,\\ \\\\<^bsub>/F\\<^esub> xs SAT [p, R, G, q,a]\" \n \nsection {* Soundness *}\n\nlemma skip_suc_i:\n assumes a1:\"(\\, l) \\ cptn \\ fst (l!i) = Skip\" \n assumes a2:\"i+1 < length l\"\n shows \"fst (l!(i+1)) = Skip\"\nproof -\n from a2 a1 obtain l1 ls where \"l=l1#ls\" \n by (metis list.exhaust list.size(3) not_less0) \n then have \"\\\\\\<^sub>c (l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n by fastforce \n thus ?thesis using a1 a2 step_ce_elim_cases\n by (metis (no_types) Suc_eq_plus1 not_eq_not_env prod.collapse stepc_elim_cases(1))\nqed \n\nlemma throw_suc_i:\n assumes a1:\"(\\, l) \\ cptn \\ (fst(l!i) = Throw \\ snd(l!i) = Normal s1)\" \n assumes a2:\"Suc i < length l\"\n assumes a3:\"env_tran_right \\ l rely \\ Sta q rely \\ s1 \\ q\"\n shows \"fst (l!(Suc i)) = Throw \\ (\\s2. snd(l!(Suc i)) = Normal s2 \\ s2 \\q)\"\nproof -\n have fin:\"final (l!i)\" using a1 unfolding final_def by auto \n from a2 a1 obtain l1 ls where \"l=l1#ls\" \n by (metis list.exhaust list.size(3) not_less0) \n then have \"\\\\\\<^sub>c (l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n by fastforce then have \"\\\\\\<^sub>c (l!i) \\ (l!(Suc i)) \\ \\\\\\<^sub>c (l!i) \\\\<^sub>e (l!(Suc i))\"\n using step_ce_elim_cases by blast\n thus ?thesis proof \n assume \"\\\\\\<^sub>c (l!i) \\ (l!(Suc i))\" thus ?thesis using fin no_step_final' by blast\n next\n assume \"\\\\\\<^sub>c (l!i) \\\\<^sub>e (l!(Suc i))\" thus ?thesis \n using a1 a3 a2 env_tran_normal by (metis (no_types, lifting) env_c_c' prod.collapse) \n qed \nqed \n\nlemma i_skip_all_skip:assumes a1:\"(\\, l) \\ cptn \\ fst (l!i) = Skip\"\n assumes a2: \"i\\j \\ j < (length l)\"\n assumes a3:\"n=j-i\"\n (* assumes a4:\"env_tran_right \\ l rely\" *)\n shows \"fst (l!j) = Skip\"\nusing a1 a2 a3\nproof (induct n arbitrary: i j)\n case 0\n then have \"Suc i = Suc j\" by simp \n thus ?case using \"0.prems\" skip_suc_i by fastforce\nnext\n case (Suc n) \n then have \"length l > Suc i\" by auto \n then have \"i, l) \\ cptn \\ (fst (l!i) = Throw \\ snd (l!i) = Normal s1)\"\n assumes a2: \"i\\j \\ j < (length l)\"\n assumes a3:\"n=j-i\"\n assumes a4:\"env_tran_right \\ l rely \\ Sta q rely \\ s1\\q\" \n shows \"fst (l!j) = Throw \\ (\\s2. snd(l!j) = Normal s2 \\ s2\\q)\"\nusing a1 a2 a3 a4\nproof (induct n arbitrary: i j s1)\n case 0\n then have \"Suc i = Suc j\" by simp \n thus ?case using \"0.prems\" skip_suc_i by fastforce\nnext\n case (Suc n) \n then have l_suc:\"length l > Suc i\" by linarith \n then have \"ii < j\\ Suc(4))\n ultimately obtain s2 where \"fst (l ! (j-1)) = LanguageCon.com.Throw \\ snd (l ! (j-1)) = Normal s2 \\ s2\\q\"\n using Suc(1)[of i s1 \"j-1\"] Suc(2) Suc(5)\n by (metis (no_types, lifting) Suc_diff_Suc diff_Suc_eq_diff_pred diff_zero less_imp_Suc_add not_le not_less_eq_eq zero_less_Suc) \n also have \"Suc (j - 1) < length l\" using Suc by arith\n ultimately have \"fst (l ! (j)) = LanguageCon.com.Throw \\ (\\s2. snd(l!j) = Normal s2 \\ s2\\q)\" \n using Suc(2-5) throw_suc_i[of \\ l \"j-1\" s2 rely q] a4\n by fastforce\n also have \"j=j\" using Cons using Suc.prems(2) by linarith \n ultimately show ?case using Suc by (metis (no_types))\nqed \n\nlemma only_one_component_tran_j:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Skip \\ fst (l!i) = Throw \" and \n a1': \"snd (l!i) = Normal x \\ x \\ q\" and\n a2: \"i\\j \\ Suc j < length l\" and\n a3: \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and \n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\"\nproof - \n have \"fst (l!j) = Skip \\ (fst (l!i) = Throw \\ snd(l!i) = Normal x)\" \n using a0 a1 a1' a2 a3 a4 i_skip_all_skip by fastforce \n also have \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" using a3 by fastforce \n ultimately show ?thesis\nby (meson SmallStepCon.final_def SmallStepCon.no_step_final' Suc_lessD a0 a2 a4 i_throw_all_throw a1') \nqed \n\nlemma only_one_component_tran_all_j:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Skip \\ (fst (l!i) = Throw \\ snd(l!i) = Normal s1)\" and \n a1': \"snd (l!i) = Normal x \\ x \\ q\" and\n a2: \"Suc ij. i\\j \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\" \nusing a0 a1 a2 a3 a4 a1' only_one_component_tran_j \nby (metis lessI less_Suc_eq_le) \n\n\nlemma zero_skip_all_skip: \n assumes a1:\"(\\, l) \\ cptn \\ fst (l!0) = Skip \\ i < length l\"\n shows \"fst (l!i) = Skip\"\nusing a1 i_skip_all_skip by blast\n\nlemma all_skip:\n assumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = (Skip,s)\"\nshows \"(\\i, l) \\ cptn \\ fst (l!0) = Throw \\ \n snd(l!0) = Normal s1 \\ i < length l \\ s1\\q\"\n assumes a2: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"fst (l!i) = Throw \\ (\\s2. snd (l!i) = Normal s2)\"\nusing a1 a2 i_throw_all_throw by (metis le0) \n\nlemma only_one_component_tran_0:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"(fst (l!0) = Skip) \\ (fst (l!0) = Throw)\" and \n a1': \"snd (l!0) = Normal x \\ x \\ q\" and\n a2: \"Suc j < length l\" and\n a3: \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\" \n proof-\n have a2':\"0\\j \\ Suc j, l) \\ cptn\" and\n a1: \"fst (l!i) = Skip \\ (fst (l!0) = Throw \\ snd(l!0) = Normal s1)\" and \n a2: \"Suc ij. j\\i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"env_tran_right \\ l rely \\ Norm rely\" \n shows \"P\" \nusing a0 a1 a2 a3 a4\nproof (induct i)\n case 0 \n have \"(0::nat) \\ 0\" by fastforce \n thus ?thesis using only_one_component_tran_0 0 by metis\nnext\n case (Suc n) thus ?thesis\n by (metis Suc_leI lessI only_one_component_tran_0 prod.collapse stepc_elim_cases(1))\nqed *)\n\nlemma not_step_comp_step_env:\n assumes a0: \"(\\, l) \\ cptn\" and\n a1: \"(Suc jk < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n shows \"(\\k < j. ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\"\nproof -\n {fix k\n assume asm: \"k\\\\<^sub>c(l!k) \\\\<^sub>c\\<^sub>e (l!(Suc k)))\" using a0 cptn_stepc_rtran\n proof -\n obtain nn :: \"nat \\ nat \\ nat\" where\n f1: \"\\x0 x1. (\\v2>x1. x0 = Suc v2) = (x1 < nn x0 x1 \\ x0 = Suc (nn x0 x1))\"\n by moura\n obtain pp :: \"nat \\ (('b, 'a, 'c) LanguageCon.com \\ ('b, 'c) xstate) list \\ ('b, 'a, 'c) LanguageCon.com \\ ('b, 'c) xstate\" and pps :: \"nat \\ (('b, 'a, 'c) LanguageCon.com \\ ('b, 'c) xstate) list \\ (('b, 'a, 'c) LanguageCon.com \\ ('b, 'c) xstate) list\" where\n \"\\x0 x1. (\\v2 v3. x1 = v2 # v3 \\ length v3 = x0) = (x1 = pp x0 x1 # pps x0 x1 \\ length (pps x0 x1) = x0)\"\n by moura\n then have f2: \"l = pp (nn (length l) k) l # pps (nn (length l) k) l \\ length (pps (nn (length l) k) l) = nn (length l) k\"\n using f1 by (meson Suc_lessE \\Suc k < length l\\ length_Suc_conv)\n then have f3: \"Suc k < length (pp (nn (length l) k) l # pps (nn (length l) k) l)\"\n by (metis \\Suc k < length l\\)\n have \"(\\, pp (nn (length l) k) l # pps (nn (length l) k) l) \\ cptn\"\n using f2 a0 by presburger\n then have \"\\\\\\<^sub>c (pp (nn (length l) k) l # pps (nn (length l) k) l) ! k \\\\<^sub>c\\<^sub>e (pp (nn (length l) k) l # pps (nn (length l) k) l) ! Suc k\"\n using f3 by (meson cptn_stepc_rtran)\n then show ?thesis\n using f2 by auto\n qed \n also have \"\\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k))))\" using a2 asm by auto\n ultimately have \"((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" using step_ce_elim_cases by blast\n } thus ?thesis by auto\nqed\n\nlemma cptn_i_env_same_prog:\nassumes a0: \"(\\, l) \\ cptn\" and\n a1: \"\\k < j. k\\i \\ (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a2: \"i\\j \\ j < length l\"\nshows \"fst (l!j) = fst (l!i)\"\nusing a0 a1 a2\nproof (induct \"j-i\" arbitrary: l j i)\n case 0 thus ?case by auto \nnext\n case (Suc n) \n then have lenl:\"length l>Suc 0\" by fastforce \n have \"j>0\" using Suc by linarith\n then obtain j1 where prev:\"j=Suc j1\" \n using not0_implies_Suc by blast \n then obtain a0 a1 l1 where l:\"l=a0#l1@[a1]\" \n using Suc lenl by (metis add.commute add.left_neutral length_Cons list.exhaust list.size(3) not_add_less1 rev_exhaust) \n then have al1_cptn:\"(\\,a0#l1)\\ cptn\"\n using Suc.prems(1) Suc.prems(3) tl_in_cptn cptn_dest_2\n by blast\n have i_j:\"i\\j1\" using Suc prev by auto\n have \"\\k < j1. k\\i \\ (\\\\\\<^sub>c((a0#l1)!k) \\\\<^sub>e ((a0#l1)!(Suc k)))\"\n proof -\n {fix k\n assume a0:\"k k\\i\"\n then have \"(\\\\\\<^sub>c((a0#l1)!k) \\\\<^sub>e ((a0#l1)!(Suc k)))\" \n using l Suc(4) prev lenl Suc(5)\n proof - \n have suc_k_j:\"Suc k < j\" using a0 prev by blast\n have j1_l_l1:\"j1 < Suc (length l1)\" \n using Suc.prems(3) l prev by auto\n have \"k < Suc j1\"\n using `k < j1 \\ i \\ k` less_Suc_eq by blast\n hence f3: \"k < j\"\n using prev by blast\n hence ksuc:\"k < Suc (Suc j1)\"\n using less_Suc_eq prev by blast\n hence f4: \"k < Suc (length l1)\"\n using prev Suc.prems(3) l a0 j1_l_l1 less_trans \n by blast \n have f6: \"\\\\\\<^sub>c l ! k \\\\<^sub>e (l ! Suc k)\"\n using f3 Suc(4) a0 by blast\n have k_l1:\"k < length l1\"\n using f3 Suc.prems(3) i_j l suc_k_j by auto \n thus ?thesis\n proof (cases k)\n case 0 thus ?thesis using f6 l k_l1\n by (simp add: nth_append)\n next \n case (Suc k1) thus ?thesis \n using f6 f4 l k_l1 \n by (simp add: nth_append)\n qed\n qed\n }thus ?thesis by auto\n qed\n then have fst:\"fst ((a0#l1)!i)=fst ((a0#l1)!j1)\"\n using Suc(1)[of j1 i \"a0#l1\"] \n Suc(2) Suc(3) Suc(4) Suc(5) prev al1_cptn i_j\n by (metis (mono_tags, lifting) Suc_diff_le Suc_less_eq diff_Suc_1 l length_Cons length_append_singleton)\n have len_l:\"length l = Suc (length (a0#l1))\" using l by auto\n then have f1:\"i, l) \\ cptn \\ i + 1 < length l\"\n shows \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\"\nproof -\n from a1\n obtain a1 l1 where \"l=a1#l1\" using cptn.simps by blast\n thus ?thesis using a1 cptn_stepc_rtran by fastforce\nqed\n\nlemma zero_final_always_env_0: \n assumes a1:\"(\\, l) \\ cptn\" and\n a2: \"fst (l!0) = Skip \\ fst (l!0) = Throw\" and\n a2': \"snd(l!0) = Normal s1 \\ s1\\q\" and\n a3: \"Suc i < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\"\n shows \"\\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\nproof -\n have \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using a1 a2 a3 cptn_tran_ce_i by auto \n also have \"\\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" using a1 a2 a3 a4 a2'\n using only_one_component_tran_0 by metis \n ultimately show ?thesis by (simp add: step_ce.simps) \nqed\n\nlemma final_always_env_i: \n assumes a1:\"(\\, l) \\ cptn\" and\n a2: \"fst (l!0) = Skip \\ fst (l!0) = Throw\" and\n a2': \"snd(l!0) = Normal s1 \\ s1\\q\" and\n a3: \"j\\i \\ Suc j l rely \\ Sta q rely\"\n shows \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof -\n have ce_tran:\"\\\\\\<^sub>c(l!j) \\\\<^sub>c\\<^sub>e (l!(Suc j))\" using a1 a2 a3 a4 cptn_tran_ce_i by auto \n then have \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)) \\ \\\\\\<^sub>c(l!j) \\ (l!(Suc j))\" \n using step_ce_elim_cases by blast\n thus ?thesis\n proof\n assume \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\" then show ?thesis by auto\n next\n assume a01:\"\\\\\\<^sub>c(l!j) \\ (l!(Suc j))\"\n then have \"\\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" \n using a1 a2 a3 a4 a2' only_one_component_tran_j [OF a1] \n by blast\n then show ?thesis using a01 ce_tran by (simp add: step_ce.simps) \n qed\nqed\n\n\nsubsection {*Skip Sound*}\n\nlemma stable_q_r_q: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2:\"(snd(l!i), snd(l!(Suc i))) \\ R\"\n shows \"snd(l!(Suc i)) \\ Normal ` q\"\nusing a0 a1 a2 \nunfolding Sta_def by fastforce \n\nlemma stability:\nassumes a0:\"Sta q R\" and \n a1: \"snd(l!j) \\ Normal ` q\" and\n a2: \"j\\k \\ k < (length l)\" and\n a3: \"n=k-j\" and\n a4: \"\\i. j\\i \\ i < k \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a5:\"env_tran_right \\ l R \"\n shows \"snd (l!k) \\ Normal ` q \\ fst (l!j) = fst (l!k)\"\nusing a0 a1 a2 a3 a4 a5 \nproof (induct n arbitrary: j k)\n case 0\n thus ?case by auto\nnext\n case (Suc n) \n then have \"length l > j + 1\" by arith \n moreover then have \"k-1< length l\" using Suc by fastforce \n moreover then have \"(k - 1) - j = n\" using Suc by fastforce\n moreover then have \"j\\k-1\" using Suc by arith \n moreover have \"\\i. j \\ i \\ i < k-1 \\ \\\\\\<^sub>c (l ! i) \\\\<^sub>e (l ! Suc i)\"\n using Suc by fastforce \n ultimately have induct:\"snd (l! (k-1)) \\ Normal ` q \\ fst (l!j) = fst (l!(k-1))\" using Suc\n by blast \n also have j_1:\"k-1+1=k\" using Cons Suc.prems(4) by auto \n have f1:\"\\i. j\\i \\ i < k \\ (snd((snd (\\,l))!i), snd((snd (\\,l))!(Suc i))) \\ R\"\n using Suc unfolding env_tran_right_def by fastforce\n have k1:\"k - 1 < k\"\n by (metis (no_types) Suc_eq_plus1 j_1 lessI) \n then have \"(snd((snd (\\,l))!(k-1)), snd((snd (\\,l))!(Suc (k-1)))) \\ R\" \n using `j \\ k - 1` f1 by blast \n ultimately have \"snd (l!k) \\ Normal ` q\" using stable_q_r_q Suc(2) Suc(5) by fastforce\n also have \"fst (l!j) = fst (l!k)\"\n proof -\n have \"\\\\\\<^sub>c (l ! (k-1)) \\\\<^sub>e (l ! k)\" using Suc(6) k1 `j\\k-1` by fastforce\n thus ?thesis using k1 prod.collapse env_c_c' induct by metis\n qed\n ultimately show ?case by meson\nqed\n\nlemma stable_only_env_i_j: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2: \"i j < (length l)\" and\n a3: \"n=j-i-1\" and\n a4: \"\\k\\i. k < j \\ \\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))\" and\n a5: \"env_tran_right \\ l R\"\n shows \"snd (l!j) \\ Normal ` q\"\nusing a0 a1 a2 a3 a4 a5 by (meson less_imp_le_nat stability)\n\n \nlemma stable_only_env_1: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2: \"i j < (length l)\" and\n a3: \"n=j-i-1\" and\n a4: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a5: \"env_tran_right \\ l R\"\n shows \"snd (l!j) \\ Normal ` q\"\nusing a0 a1 a2 a3 a4 a5 \nby (meson stable_only_env_i_j less_trans_Suc)\n\n\nlemma stable_only_env_q: \n assumes a0:\"Sta q R\" and \n a1: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a2: \"env_tran \\ q l R\"\n shows \"\\i. i < length l \\ snd (l!i) \\ Normal ` q\"\nproof (cases \"0 < length l\")\n case False thus ?thesis using a2 unfolding env_tran_def by fastforce \nnext\n case True \n thus ?thesis \n proof - {\n fix i\n assume aa1:\"i < length l\"\n have post_0:\"snd (l ! 0) \\ Normal ` q \" \n using a2 unfolding env_tran_def by auto\n then have \"snd (l ! i) \\ Normal ` q\" \n proof (cases i) \n case 0 thus ?thesis using post_0 by auto\n next\n case (Suc n) \n \n have \"env_tran_right \\ l R\" \n using a2 env_tran_right_def unfolding env_tran_def by auto\n also have \"0 \n (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\n:\\<^bsub>/F\\<^esub> Skip sat [q,R, G, q,a]\"\nproof - \n assume\n a0:\"Sta q R\" and \n a1:\"(\\s. (Normal s, Normal s) \\ G)\"\n {\n fix s\n have ass:\"cpn n \\ Skip s \\ assum(q, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ Skip s\" and a11:\"c \\ assum(q, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume \"snd (last l) \\ Fault ` F\" \n then have cp:\"l!0=(Skip,s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n\n cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce\n have assum:\"snd(l!0) \\ Normal ` q \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix i\n assume asuc:\"Suc i (\\1\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n by (metis Suc_lessD cp prod.collapse prod.sel(1) stepc_elim_cases(1) zero_skip_all_skip)\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n then have fst_last_skip:\"fst (last l) = Skip\" \n by (metis `0 < length l` cp diff_less fst_conv zero_less_one zero_skip_all_skip) \n have last_q: \"snd (last l) \\ Normal ` q\" \n proof -\n have env: \"env_tran \\ q l R\" using env_tran_def assum cp by blast\n have env_right:\"env_tran_right \\ l R \" using a0 env_tran_right_def assum cp by metis\n also obtain s1 where \"snd(l!0) = Normal s1 \\ s1\\q\" \n using assum by auto\n ultimately have all_tran_env: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\n using final_always_env_i cp zero_final_always_env_0 a0\n by fastforce\n then have \"\\i. i < length l \\ snd (l!i) \\ Normal ` q\"\n using stable_only_env_q a0 env by fastforce\n thus ?thesis using last_l using len_l by fastforce \n qed \n note res = conjI [OF fst_last_skip last_q]\n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma Throw_sound: \n \"Sta a R \\\n (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\n:\\<^bsub>/F\\<^esub> Throw sat [a, R, G, q,a]\"\nproof - \n assume \n a1:\"Sta a R\" and\n a2:\" (\\s. (Normal s, Normal s) \\ G)\" \n {\n fix s\n have \"cpn n \\ Throw s \\ assum(a, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ Throw s\" and a11:\"c \\ assum(a, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume \"snd (last l) \\ Fault ` F\"\n have cp:\"l!0=(Throw,s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\=\\1\" \n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n by fastforce\n then have cp:\"l!0=(Throw,s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce \n have assum:\"snd(l!0) \\ Normal ` (a) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ (R))\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran_right \\ l R\" using cp env_tran_right_def by auto\n obtain a1 where a_normal:\"snd(l!0) = Normal a1 \\ a1 \\ a\"\n using assum by auto\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ (G))\"\n proof -\n { fix i\n assume asuc:\"Suc i (\\s2. snd (l ! i) = Normal s2)\" \n using cp a1 assum a_normal env_tran asuci zero_throw_all_throw\n by fastforce\n then have \"\\ (\\1\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n by (meson SmallStepCon.final_def SmallStepCon.no_step_final') \n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n then have fst_last_skip:\"fst (last l) = Throw\"\n by (metis a1 a_normal cp diff_less env_tran fst_conv len_l zero_less_one zero_throw_all_throw) \n have last_q: \"snd (last l) \\ Normal ` (a)\" \n proof -\n have env: \"env_tran \\ a l R\" using env_tran_def assum cp by blast\n have env_right:\"env_tran_right \\ l R\" using env_tran_right_def assum cp by metis\n then have all_tran_env: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\n using final_always_env_i a1 assum cp zero_final_always_env_0 by fastforce \n then have \"\\i. i < length l \\ snd (l!i) \\ Normal ` (a)\"\n using stable_only_env_q a1 env by fastforce\n thus ?thesis using last_l using len_l by fastforce \n qed \n note res = conjI [OF fst_last_skip last_q]\n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma no_comp_tran_before_i_0_g:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c \" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n (c1=Skip) \\ (c1=Throw \\ (\\s21. s2 = Normal s21))\" and \n a6: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\n proof -\n have \"Suc j < length l\" using a0 a1 a2 a3 a4 by fastforce\n then have \"fst (l!j) = c\" \n using a0 a1 a2 a3 a4 cptn_env_same_prog[of \\ l j] by fastforce\n then obtain s s1 c1 where l_0: \"l!j = (c, s) \\ l!(Suc j) = (c1,s1)\" \n by (metis (no_types) prod.collapse) \n moreover have \"snd (l!j) \\ Normal ` p\" using a4 stability[of p rely l 0 j j] a6 a3 a2\n proof -\n have \"\\B r ps n na nb f. \\ Sta B r \\ snd (ps ! n) \\ Normal ` B \\ \\ n \\ na \\ \\ na < length ps \\ na - n \\ nb \\ (\\nb\\n. nb < na \\ \\ f\\\\<^sub>c ps ! nb \\\\<^sub>e ps ! Suc nb) \\ \\ env_tran_right f ps r \\ snd (ps ! na) \\ Normal ` B \\ (fst (ps ! n)::('b, 'a, 'c) LanguageCon.com) = fst (ps ! na)\"\n using stability by blast\n then show ?thesis\n using Suc_lessD \\Suc j < length l\\ a4 a6 by blast\n qed \n then have suc_0_skip: \"(fst (l!Suc j) = Skip \\ fst (l!Suc j) = Throw) \\ \n (\\s2. snd(l!Suc j) = Normal s2 ) \" \n using a5 a6 a3 SmallStepCon.step_Stuck_prop using fst_conv imageE l_0 snd_conv by auto \n thus ?thesis using only_one_component_tran_j\n proof -\n have \"\\n na. \\ n < na \\ Suc n \\ na\"\n using Suc_leI by satx \n thus ?thesis using only_one_component_tran_j[OF a0] suc_0_skip a6 a0 a2 a3\n using imageE by blast \n qed\nqed\n\nlemma no_comp_tran_before_i:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n (c1=Skip) \\ (c1=Throw \\ (\\s21. s2 = Normal s21))\" and \n a6: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct k arbitrary: l i j)\n case 0 thus ?thesis using no_comp_tran_before_i_0_g by blast\nnext\n case (Suc n) \n then obtain a1 l1 where l: \"l=a1#l1\"\n by (metis less_nat_zero_code list.exhaust list.size(3))\n then have l1notempty:\"l1\\[]\" using Suc by force \n then obtain i' where i': \"i=Suc i'\" using Suc \n using less_imp_Suc_add by blast\n then obtain j' where j': \"j=Suc j'\" using Suc\n using Suc_le_D by blast \n have \"(\\,l1)\\cptn\" using Suc l\n using tl_in_cptn l1notempty by blast\n moreover have \"fst (l1 ! n) = c\"\n using Suc l l1notempty by force \n moreover have \"Suc i' < length l1 \\ n \\ i' \\ \\\\\\<^sub>c l1 ! i' \\ (l1 ! Suc i')\"\n using Suc l l1notempty i' by auto\n moreover have \"n \\ j' \\ j' < i' \\ \\\\\\<^sub>c l1 ! j' \\ (l1 ! Suc j')\"\n using Suc l l1notempty i' j' by auto\n moreover have \"\\k\\\\<^sub>c l1 ! k \\\\<^sub>e (l1 ! Suc k)\"\n using Suc l l1notempty j' by auto \n moreover have \"env_tran_right \\ l1 rely \\ Sta q rely \\ Sta p rely \\ snd (l1!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l1!Suc j') \\ Normal ` q\" \n proof -\n have suc0:\"Suc 0 < length l\" using Suc by auto\n have \"j>0\" using j' by auto\n then have \"\\\\\\<^sub>c(l!0) \\\\<^sub>e (l!(Suc 0))\" using Suc(6) by blast\n then have \"(snd(l!Suc 0) \\ Normal ` p)\" \n using Suc(8) suc0 unfolding Sta_def env_tran_right_def by blast\n also have \"snd (l!Suc j) \\ Normal ` q\" using Suc(8) by auto\n ultimately show ?thesis using Suc(8) l by (metis env_tran_tail j' nth_Cons_Suc) \n qed\n ultimately show ?case using Suc(1)[of l1 i' j' ] Suc(7) Suc(8) j' l by auto\nqed\n\nlemma exists_first_occ: \"P (n::nat) \\ \\m. P m \\ (\\i P i)\"\nproof (induct n)\n case 0 thus ?case by auto\nnext\n case (Suc n) thus ?case\n by (metis ex_least_nat_le not_less0) \nqed\n\nlemma exist_first_comp_tran':\nassumes a1: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" \nshows \"\\j. (Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ (\\k < j. \\\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n let ?P = \"(\\n. Suc n (\\\\\\<^sub>c(l!n) \\ (l!(Suc n))))\"\n show ?thesis using exists_first_occ[of ?P i] a1 by auto \nqed\n\nlemma exist_first_comp_tran:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" \nshows \"\\j. j\\i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\nproof -\n obtain j where pj:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\(Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n using a1 exist_first_comp_tran' by blast\n then have \"j\\i\" using a1 pj by (cases \"j\\i\", auto)\n moreover have \"\\\\\\<^sub>c(l!j) \\ (l!(Suc j))\" using pj by auto\n moreover have \"(\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" \n proof -\n {fix k\n assume kj:\"k length l \\ \\ ( (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))) \" using pj by auto\n then have \"(\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n proof\n {assume \"length l \\ Suc k\" \n thus ?thesis using kj pj by auto\n }\n {assume \"\\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n also have \"k + 1 < length l\" using kj pj by auto\n ultimately show ?thesis\n using a0 cptn_tran_ce_i step_ce_elim_cases by blast\n }\n qed\n } thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\nqed\n\n\nlemma skip_com_all_skip:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1:\"fst (l!i) = Skip\" and\n a2:\"ij. j\\i \\ j fst (l!j) = Skip\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n case 0 thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n case (Suc n)\n then have l:\"Suc i < length l\" by arith\n have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n then have \"\\\\\\<^sub>c l ! i \\\\<^sub>c\\<^sub>e l ! Suc i\" using cptn_tran_ce_i Suc\n by (metis (no_types) Suc.hyps(2) a0 cptn_tran_ce_i zero_less_Suc zero_less_diff)\n then have \"\\\\\\<^sub>c l ! i \\ l ! Suc i \\ \\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n using step_ce_elim_cases by blast \n then have or:\"fst(l!Suc i) = Skip\" \n proof\n {assume \"\\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n thus ?thesis using Suc(4) by (metis env_c_c' prod.collapse)\n }\n next\n {assume step:\"\\\\\\<^sub>c l ! i \\ l ! Suc i\" \n {assume \"fst(l!i) = Skip\" \n then have ?thesis using step\n using SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }note left = this\n {assume \"fst(l!i) = Throw\"\n then have ?thesis using step stepc_elim_cases\n proof -\n have \"\\x. l ! Suc i = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) \\fst (l ! i) = LanguageCon.com.Throw\\ local.step stepc_elim_cases(11) surjective_pairing)\n then show ?thesis\n by fastforce\n qed \n } then show ?thesis using Suc(4) left by auto\n }\n qed\n show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) by (metis le_less_Suc_eq not_le) \nqed\n\nlemma terminal_com_all_term:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1:\"fst (l!i) = Skip \\ fst (l!i) = Throw\" and\n a2:\"ij. j\\i \\ j fst (l!j) = Skip \\ fst (l!j) = Throw\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n case 0 thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n case (Suc n)\n then have l:\"Suc i < length l\" by arith\n have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n then have \"\\\\\\<^sub>c l ! i \\\\<^sub>c\\<^sub>e l ! Suc i\" using cptn_tran_ce_i Suc\n by (metis (no_types) Suc.hyps(2) a0 cptn_tran_ce_i zero_less_Suc zero_less_diff)\n then have \"\\\\\\<^sub>c l ! i \\ l ! Suc i \\ \\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n using step_ce_elim_cases by blast \n then have or:\"fst(l!Suc i) = Skip \\ fst(l!Suc i) = Throw\" \n proof\n {assume \"\\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n thus ?thesis using Suc(4) by (metis env_c_c' prod.collapse)\n }\n next\n {assume step:\"\\\\\\<^sub>c l ! i \\ l ! Suc i\" \n {assume \"fst(l!i) = Skip\" \n then have ?thesis using step\n using SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }note left = this\n {assume \"fst(l!i) = Throw\"\n then have ?thesis using step stepc_elim_cases\n proof -\n have \"\\x. l ! Suc i = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) \\fst (l ! i) = LanguageCon.com.Throw\\ local.step stepc_elim_cases(11) surjective_pairing)\n then show ?thesis\n by fastforce\n qed \n } then show ?thesis using Suc(4) left by auto\n }\n qed\n show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) by (metis le_less_Suc_eq not_le) \nqed\n\nlemma only_one_c_comp_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c\" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"i < j \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"(\\k < i. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n shows \"P\"\nproof - \n have fst:\"fst (l!i) = c\" using a0 a1 a5\n by (simp add: a2 cptn_env_same_prog)\n then have suci:\"fst (l!Suc i) = Skip \\ fst (l!Suc i) = Throw\" \n using a4 by (metis a2 surjective_pairing) \n then have \"fst (l!j) = Skip \\ fst (l!j) = Throw\" \n proof -\n have \"Suc i \\ j\"\n using Suc_leI a3 by presburger\n then show ?thesis\n using Suc_lessD terminal_com_all_term[OF a0 suci] a2 a3 by blast\n qed \n thus ?thesis\n proof \n {assume \"fst (l ! j) = Skip\"\n then show ?thesis using a3 SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }\n next\n {assume asm:\"fst (l ! j) = Throw\"\n then show ?thesis \n proof (cases \"snd (l!i)\")\n case Normal \n thus ?thesis using a3 a2 fst asm\n by (metis SmallStepCon.final_def SmallStepCon.no_step_final') \n next\n case Abrupt thus ?thesis using a3 a2 fst asm skip_com_all_skip\n by (metis Suc_leI Suc_lessD a0 \n prod.collapse step_change_p_or_eq_s_normal \n stepc_Normal_elim_cases(11) suci)\n next \n case Fault thus ?thesis using a3 a2 fst asm skip_com_all_skip \n by (metis Suc_leI Suc_lessD a0 prod.collapse \n step_change_p_or_eq_s_normal stepc_Normal_elim_cases(11) suci)\n next \n case Stuck thus ?thesis using a3 a2 fst asm skip_com_all_skip \n by (metis Suc_leI Suc_lessD a0 \n prod.collapse step_change_p_or_eq_s_normal \n stepc_Normal_elim_cases(11) suci)\n qed\n } \n qed\nqed\n\nlemma only_one_component_tran1:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c\" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q \"\n shows \"P\"\nproof (cases \"j=i\")\n case True thus ?thesis using a3 by auto\nnext\n case False note j_neq_i=this \n thus ?thesis\n proof (cases \"j ('b \\ ('b, 'c) xstate) \\ ('b, 'c) xstate \\ 'b\" where\n \"\\x0 x1 x2. (\\v3. x2 = x1 v3 \\ v3 \\ x0) = (x2 = x1 (bb x0 x1 x2) \\ bb x0 x1 x2 \\ x0)\"\n by moura\n then have f1: \"\\x f B. x \\ f ` B \\ x = f (bb B f x) \\ bb B f x \\ B\"\n by (meson imageE)\n then have \"\\\\\\<^sub>c (c, snd (l ! j)) \\ (fst (l ! Suc j), Normal (bb q Normal (snd (l ! Suc j))))\"\n by (metis (no_types) a3 a5 surjective_pairing)\n then show ?thesis\n using f1 by (meson Suc_leI a0 a2 a4 a5 True only_one_component_tran_j)\n qed \n next\n case False \n obtain j1 \n where all_ev:\"j1\\i \\ \n (\\\\\\<^sub>c(l!j1) \\ (l!(Suc j1))) \\ \n (\\k < j1. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a0 a2 a3 exist_first_comp_tran by blast\n then have fst:\"fst (l!j1) = c\" \n using a0 a1 a2 cptn_env_same_prog le_imp_less_Suc less_trans_Suc by blast\n have suc:\"Suc j1 < length l \\ \\\\\\<^sub>c l ! j1 \\ l ! Suc j1\" using all_ev a2\n using Suc_lessD le_eq_less_or_eq less_trans_Suc by linarith\n have evs:\"(\\k < j1. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" using all_ev by auto\n have j:\"j1 < j \\ Suc j < length l \\ \\\\\\<^sub>c l ! j \\ l ! Suc j \\ fst (l ! j) = c\"\n using a3 all_ev False by auto\n then show ?thesis \n using only_one_c_comp_tran[OF a0 a1 suc j a4 evs] by auto \n qed\nqed \n \nlemma only_one_component_tran_i:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q \"\n shows \"P\"\nusing a0 a1 a2 a3 a4 a5\nproof (induct k arbitrary: l i j p q)\n case 0 show ?thesis using only_one_component_tran1[OF 0(1) 0(2) ] 0 by blast\nnext\n case (Suc n) \n then obtain a1 l1 where l: \"l=a1#l1\"\n by (metis less_nat_zero_code list.exhaust list.size(3))\n then have l1notempty:\"l1\\[]\" using Suc by force \n then obtain i' where i': \"i=Suc i'\" using Suc \n using less_imp_Suc_add using Suc_le_D by meson \n then obtain j' where j': \"j=Suc j'\" using Suc\n using Suc_le_D by meson \n have a0:\"(\\,l1)\\cptn\" using Suc l\n using tl_in_cptn l1notempty by meson\n moreover have a1:\"fst (l1 ! n) = c\"\n using Suc l l1notempty by force \n moreover have a2:\"Suc i' < length l1 \\ n \\ i' \\ \\\\\\<^sub>c l1 ! i' \\ (l1 ! Suc i')\"\n using Suc l l1notempty i' by auto\n moreover have a3:\"n \\ j' \\ j' \\ i' \\ Suc j' < length l1 \\ \\\\\\<^sub>c l1 ! j' \\ (l1 ! Suc j') \\ fst (l1!j') = c\"\n using Suc l l1notempty i' j' by auto\n moreover have a4:\"env_tran_right \\ l1 rely \\\n Sta p rely \\ snd (l1!n) \\ Normal ` p \\ \n Sta q rely \\ snd (l1 ! Suc j') \\ Normal ` q \" \n using Suc(7) l j' unfolding env_tran_right_def by fastforce\n show ?case using Suc(1)[OF a0 a1 a2 a3 Suc(6) a4] by auto\nqed\n\nlemma only_one_component_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c,s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nusing a0 a1 a2 a3 a4 a5 only_one_component_tran_i\nproof -\n {assume \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\ \\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n then have \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n proof\n assume \"\\\\\\<^sub>c l ! j \\ (l ! Suc j)\" \n then have j:\"Suc j k\\j \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" using a3 by auto\n show ?thesis using only_one_component_tran_i[OF a0 a1 j a2 a4 a5] \n by blast \n next\n assume \"\\ \\\\\\<^sub>c l ! j \\ (l ! Suc j)\"\n thus ?thesis\n by (metis Suc_eq_plus1 a0 a3 cptn_tran_ce_i step_ce_elim_cases)\n qed\n } thus ?thesis by auto\nqed\n \nlemma only_one_component_tran_all_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"\\s1 s2 c1. \\\\\\<^sub>c(c,s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n {fix j\n assume ass:\"k\\j \\ j\\i \\ Suc j < (length l)\"\n then have a2:\"k \\ i \\ i \\ j \\ Suc i < length l \\ \\\\\\<^sub>c l ! i \\ l ! Suc i \\ fst (l ! i) = c\"\n using a2 by auto\n then have \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\" \n using only_one_component_tran[OF a0 a1 ] a2 a3 ass a4 by blast\n } thus ?thesis by auto\nqed\n\nlemma only_one_component_tran_all_not_comp:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n {fix j\n assume ass:\"k\\j \\ j\\i \\ Suc j < (length l)\"\n then have \"\\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" \n using a0 a1 a2 a3 a4 only_one_component_tran_i ass by blast \n } thus ?thesis by auto\nqed\n\nlemma final_exist_component_tran1:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = c\" and \n a2: \"env_tran \\ q l R \\ Sta q R\" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" and \n a5: \"c\\Skip \\ c\\Throw\"\n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n {assume \"\\k. k\\i \\ k \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" \n then have \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n by (metis (no_types, lifting) Suc_eq_plus1 a0 a3 cptn_tran_ce_i less_trans_Suc step_ce_elim_cases)\n then have \"fst (l!j) = fst (l!i)\" using cptn_i_env_same_prog a0 a3 by blast \n then have False using a3 a1 a5 unfolding final_def by auto\n } \n thus ?thesis by auto\nqed \n\nlemma final_exist_component_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = c\" and \n a2: \"i\\j \\ j < length l \\ final (l!j)\" and \n a3: \"c\\Skip \\ c\\Throw\"\n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n {assume \"\\k. k\\i \\ k \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" \n then have \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n by (metis (no_types, lifting) Suc_eq_plus1 a0 a2 cptn_tran_ce_i less_trans_Suc step_ce_elim_cases)\n then have \"fst (l!j) = fst (l!i)\" using cptn_i_env_same_prog a0 a2 by blast \n then have False using a2 a1 a3 unfolding final_def by auto\n } \n thus ?thesis by auto\nqed\n\nlemma suc_not_final_final_c_tran:\n assumes a0: \"(\\, l) \\ cptn \" and \n a1: \"Suc j< length l \\ \\final (l!j) \\ final (l!Suc j)\"\n shows \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n obtain x xs where l:\"l = x#xs\" using a0 cptn.simps by blast\n obtain c1 s1 c2 s2 where l1:\"l!j = (c1,s1) \\ l!(Suc j) = (c2,s2)\" using a1 by fastforce\n have \"\\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\" \n proof -\n { assume a:\"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\n then have eq_fst:\"fst (l!j) = fst (l!Suc j)\" by (metis env_c_c' prod.collapse)\n { assume \"fst (l!Suc j) = Skip\"\n then have \"False\" using a1 eq_fst unfolding final_def by fastforce\n }note p1=this\n { assume \"fst (l!Suc j) = Throw \\ (\\s. snd (l!Suc j) = Normal s)\" \n then have \"False\" using a1 eq_fst unfolding final_def\n by (metis a eenv_normal_s'_normal_s local.l1 snd_conv)\n }\n then have False using a1 p1 unfolding final_def by fastforce\n } thus ?thesis by auto\n qed\n also have \"\\\\\\<^sub>c(l!j) \\\\<^sub>c\\<^sub>e (l!(Suc j))\" using l cptn_stepc_rtran a0 a1 by fastforce \n ultimately show ?thesis using step_ce_not_step_e_step_c local.l1 by fastforce \nqed\n \nlemma final_exist_component_tran_final:\n assumes a0:\"(\\, l) \\ cptn\" and \n a2: \"i\\j \\ j < length l \\ final (l!j)\" and \n a3: \"\\final(l!i)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final(l!(Suc k))\"\nproof -\n let ?P = \"\\j. i\\j \\ j < length l \\ final (l!j)\"\n obtain k where k:\"?P k \\ (\\i ?P i)\" using a2 exists_first_occ[of ?P j] by auto\n then have i_k_not_final:\"\\i'i \\ \\final (l!i')\" using a2 by fastforce\n have i_eq_j:\"i\\\\<^sub>c(l!pre_k) \\ (l!k)\"\n proof -\n have \"pre_k \\i\" using pre_k i_eq_j using a3 k le_Suc_eq by blast \n then have \"\\(final (l!pre_k))\" using i_k_not_final pre_k by auto \n thus ?thesis using suc_not_final_final_c_tran a0 a2 pre_k k by fastforce\n qed\n thus ?thesis using pre_k by (metis a2 a3 i_k_not_final k le_Suc_eq not_less_eq)\nqed \n\n\nsubsection {* Basic Sound *}\n\nlemma basic_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f, s1) \\ ((c1,s2)) \\ c1=Skip\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2))\" \n then have \"c1=Skip\" using stepc_elim_cases(3) by blast \n } thus ?thesis by auto \nqed \n\nlemma no_comp_tran_before_i_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and \n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by fastforce \n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Basic f\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed \n\nlemma only_one_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f\" and \n a2: \" k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f\" and \n a2: \"k\\i \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have b: \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n show ?thesis \n by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_basic) \nqed \n\nlemma only_one_component_tran_all_not_comp_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Basic f\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. f s \\ q}\"\n \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Basic f\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n then have \"snd (l!Suc j) \\ Normal ` q\" using a4 first prg_j\n proof -\n obtain s where \"snd (l!j) = Normal s \\ s\\p\" using sta_j by fastforce\n moreover then have \"fst(l!Suc j) = Skip \\ snd(l!Suc j) = Normal (f s)\" using first\n by (metis fst_conv prg_j snd_conv stepc_Normal_elim_cases(3) surjective_pairing)\n ultimately show ?thesis using a4 by fastforce\n qed\n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_basic[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast \n moreover then have \"k=j\" using a2 by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_basic_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Basic f\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. f s \\ q}\" \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof - \n have \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n using one_component_tran_basic[OF a0 a1 a2 a3 a4] by auto\n thus ?thesis using a0 \n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases)\nqed\n\nlemma final_exist_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Basic f\" and \n a2: \"env_tran \\ q l R\" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof - \n show ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \n\nlemma Basic_sound: \n \"p \\ {s. f s \\ q} \\\n (\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G) \\ \n Sta p R \\\n Sta q R \\ \n \\,\\ \\n:\\<^bsub>/F\\<^esub> (Basic f) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"p \\ {s. f s \\ q}\" and\n a1:\"(\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R \" and\n a3:\"Sta q R\" \n{\n fix s\n have \"cpn n \\ (Basic f) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Basic f) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {\n have cp:\"l!0=(Basic f,s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n\n cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n then have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_basic_env[of \\ l f k R] a0 a00 a11 a2 a3 assum cp \n env_tran_right fst_conv\n by metis\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 by fastforce\n then have k_basic:\"fst(l!k) = Basic f \\ snd (l!k) \\ Normal ` (p)\" \n using cp env_tran_right a2 assum a00 a11 stability[of p R l 0 k k \\]\n by force\n have suc_k_skip_q:\"fst(l!Suc k) = Skip \\ snd (l!(Suc k)) \\ Normal ` q\"\n proof \n show suc_skip: \"fst(l!Suc k) = Skip\"\n using a0 a00 a11 k_basic by (metis basic_skip surjective_pairing) \n next\n obtain s' where k_s: \"snd (l!k)=Normal s' \\ s' \\ (p)\" \n using a00 a11 k_basic by auto\n then have \"snd (l!(Suc k)) = Normal (f s')\" \n using a00 a11 k_basic stepc_Normal_elim_cases(3)\n by (metis prod.inject surjective_pairing) \n then show \"snd (l!(Suc k)) \\ Normal ` q\" using a0 k_s by blast\n qed\n obtain s' s'' where \n ss:\"snd (l!k) = Normal s' \\ s' \\ (p) \\ \n snd (l!(Suc k)) = Normal s'' \\ s'' \\ q\"\n using suc_k_skip_q k_basic by fastforce \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using a0 a1 a2\n by (metis Pair_inject a11 k_basic prod.exhaust_sel stepc_Normal_elim_cases(3))\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n snd (last l) \\ Fault ` F \\\n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Basic f\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_basic env_tran a2 by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by auto\n moreover then have \"Suc k < length l\" by auto\n ultimately have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_basic_env[of \\ l f k R] a0 a11 a2 a3 assum cp \n env_tran_right fst_conv by metis \n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then have k_basic:\"fst(l!k) = Basic f \\ snd (l!k) \\ Normal ` (p)\" \n using cp env_tran_right a2 assum k_comp_tran stability[of p R l 0 k k \\]\n by force\n have suc_k_skip_q:\"fst(l!Suc k) = Skip \\ snd (l!(Suc k)) \\ Normal ` q\"\n proof \n show suc_skip: \"fst(l!Suc k) = Skip\"\n using a0 k_comp_tran k_basic by (metis basic_skip surjective_pairing) \n next\n obtain s' where k_s: \"snd (l!k)=Normal s' \\ s' \\ (p)\" \n using k_comp_tran k_basic by auto\n then have \"snd (l!(Suc k)) = Normal (f s')\" \n using k_comp_tran k_basic stepc_Normal_elim_cases(3)\n by (metis prod.inject surjective_pairing) \n then show \"snd (l!(Suc k)) \\ Normal ` q\" using a0 using k_s by blast\n qed\n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n then have fst_last_skip:\"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\"\n using a2 last_l len_l cp env_tran_right a3 suc_k_skip_q assum k_comp_tran stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by fastforce \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def)\nqed\n\nsubsection {* Spec Sound *}\n\nlemma spec_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ c1=Skip\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2))\" \n then have \"c1=Skip\" using stepc_elim_cases(4) by force \n } thus ?thesis by auto \nqed \n\n\nlemma no_comp_tran_before_i_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Spec r\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed \n\nlemma only_one_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r\" and \n a2: \"k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r\" and \n a2: \"k\\i \\ Suc i(\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_spec) \nqed \n\nlemma only_one_component_tran_all_not_comp_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r\" and \n a2: \"k\\i \\ Suc i(\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Spec r\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\"\n \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!Suc j))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Spec r\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n then have \"snd (l!Suc j) \\ Normal ` q\" using a4 first prg_j\n proof -\n obtain s where s:\"snd (l!j) = Normal s \\ s\\p\" using sta_j by fastforce \n then have suc_skip: \"fst (l!Suc j) = Skip\"\n using spec_skip first prg_j a4 by (metis (no_types, lifting) prod.collapse)\n moreover obtain s' where \"snd (l!Suc j) = Normal s' \\ (s,s')\\r\" \n proof -\n { have f1:\"(\\\\\\<^sub>c(fst(l!j),snd(l!j)) \\ (fst(l!Suc j),snd(l!Suc j)))\" using first by auto\n obtain t where \"snd (l!Suc j) = Normal t\"\n using step_spec_skip_normal_normal[of \\ \"fst(l!j)\" \"snd(l!j)\" \"fst(l!Suc j)\" \"snd(l!Suc j)\" r s] \n suc_skip prg_j s a4 f1 by blast\n moreover then have \"(s,t)\\r\" using a4 s prg_j f1 suc_skip stepc_Normal_elim_cases(4)\n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) prod.inject xstate.distinct(5) xstate.inject(1))\n ultimately have \"\\t. snd (l!Suc j)= Normal t \\ (s,t)\\r\" by auto\n }\n then show \"(\\s'. snd (l ! Suc j) = Normal s' \\ (s, s') \\ r \\ thesis) \\ thesis\" ..\n qed \n then show ?thesis using a4 sta_j s by auto\n qed\n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_spec[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast\n moreover then have \"k=j\" using a2 by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_spec_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Spec r\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\" \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof - \n have \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n using one_component_tran_spec[OF a0 a1 a2 a3 a4] by auto\n thus ?thesis using a0 \n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases)\nqed\n\nlemma final_exist_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Spec r\" and \n a2: \"env_tran \\ q l R \" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \n\nlemma Spec_sound: \n \"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)} \\\n (\\s t. s\\p \\ (s,t)\\r \\ (Normal s, Normal t) \\ G) \\ \n Sta p R \\\n Sta q R \\ \n \\,\\ \\n:\\<^bsub>/F\\<^esub> (Spec r) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\" and\n a1:\"(\\s t. s\\p \\ (s,t)\\r \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" \n{\n fix s\n have \"cpn n \\ (Spec r) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Spec r) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {\n have cp:\"l!0=(Spec r,s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n\n cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using a11 by fastforce\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n then have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 one_component_tran_spec_env[of \\ l r k R] \n env_tran_right fst_conv a0 a2 a3 cp len_l assum\n by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 by fastforce\n then have k_basic:\"ck = Spec r \\ sk \\ Normal ` (p)\" \n using cp env_tran_right a2 assum a00 a11 stability[of p R l 0 k k \\] tran_pair\n by force\n have suc_skip: \"csk = Skip\"\n using a0 a00 k_basic tran_pair spec_skip by blast\n obtain s' where ss:\"sk = Normal s' \\ s' \\ (p)\" \n using k_basic by fastforce\n obtain s'' where suc_k_skip_q:\"ssk = Normal s'' \\ (s',s'')\\r \" \n proof - \n {from ss obtain t where \"ssk = Normal t\" \n using step_spec_skip_normal_normal[of \\1 ck sk csk ssk r s'] \n k_basic tran_pair a0 suc_skip\n by blast \n moreover then have \"(s',t)\\r\" using a0 k_basic ss a11 suc_skip \n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) tran_pair prod.inject xstate.distinct(5) xstate.inject(1)) \n ultimately have \"\\t. ssk= Normal t \\ (s',t)\\r\" by auto\n } \n then show \"(\\s''. ssk = Normal s'' \\ (s',s'')\\r\\ thesis) \\ thesis\" ..\n qed \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a1 tran_pair by force\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Spec r\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_spec env_tran by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by auto\n then obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using cp by fastforce\n moreover then have \"Suc k < length l\" using k_comp_tran by auto\n ultimately have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_spec_env[of \\ l r k R] a0 a11 a2 a3 assum cp \n env_tran_right fst_conv \n by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then have k_basic:\"ck = Spec r \\ sk \\ Normal ` (p)\" \n using cp env_tran_right a2 assum tran_pair k_comp_tran stability[of p R l 0 k k \\] tran_pair\n by force\n have suc_skip: \"csk = Skip\"\n using a0 k_basic tran_pair spec_skip by blast\n have suc_k_skip_q:\"ssk \\ Normal ` q\" \n proof - \n obtain s' where k_s: \"sk =Normal s' \\ s' \\ (p)\" \n using k_basic by auto\n then obtain t where \"ssk = Normal t\" \n using step_spec_skip_normal_normal[of \\1 ck sk csk ssk r s'] k_basic tran_pair a0 suc_skip\n by blast \n then obtain t where \"ssk= Normal t\" by fastforce\n then have \"(s',t)\\r\" using k_basic k_s a11 suc_skip \n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) tran_pair prod.inject xstate.distinct(5) xstate.inject(1))\n thus \"ssk \\ Normal ` q\" using a0 k_s `ssk = Normal t` by blast \n qed \n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n then have fst_last_skip:\"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\"\n using l tran_pair suc_skip last_l len_l cp \n env_tran_right a3 suc_k_skip_q \n assum k_comp_tran stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by (metis One_nat_def Suc_eq_plus1 Suc_leI Suc_mono diff_Suc_1 lessI list.size(4)) \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def)\nqed\n\nsubsection {* Await Sound *}\n\nlemma await_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2))\" \n then have \"c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" using stepc_elim_cases(8) by blast \n } thus ?thesis by auto \nqed \n\nlemma no_comp_tran_before_i_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Await b c\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i by blast\nqed \n\nlemma only_one_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c\" and \n a2: \" k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have a:\"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw)\" \n using await_skip by blast\n thus ?thesis by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_await)\nqed\n \n\nlemma only_one_component_tran_all_not_comp_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Await b c\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\\n Sta a rely\" and\n a4:\"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c\n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a5:\"snd (last l) \\ Fault ` F\"\n \n shows \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\\n (\\s s'. fst (l!k) = Await b c \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\nproof -\n have suc_skip:\"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\ (c1=Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Await b c\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n from sta_j obtain s where \n k_basic:\"fst (l!j) = Await b c \\ snd (l!j) = Normal s \\ s \\ p \\ snd(l!j) \\ Normal ` p\" \n using sta_j prg_j by fastforce\n then have conc:\"snd (l!Suc j) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc j) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n proof - \n have \"\\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {s}) c \n ({s'. (Normal s, Normal s') \\ G} \\ q),\n ({s'. (Normal s, Normal s') \\ G} \\ a)\"\n using a4 hoare_sound by fastforce\n then have e_auto:\"\\\\<^sub>\\\\<^sub>a\\\\<^bsub>/F\\<^esub> (p \\ b \\ {s}) c \n ({s'. (Normal s, Normal s') \\ G} \\ q),\n ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n unfolding cvalid_def by auto \n have f': \"\\\\\\<^sub>c(fst (l!j), snd(l!j)) \\ (fst(l!(Suc j)), snd(l!(Suc j)))\" \n using first by auto\n have step_await:\"Suc j \\\\\\<^sub>c (Await b c,snd(l!j)) \\ (fst(l!(Suc j)), snd(l!(Suc j)))\"\n using f' k_basic first by fastforce \n then have s'_in_bp:\"s\\ b \\ s \\ p\" using k_basic stepc_Normal_elim_cases(8) by metis\n then have \"s \\ (p \\ b)\" by fastforce\n moreover have test:\n \"\\t. \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ t \\ \n ((\\t'. t =Abrupt t' \\ snd(l!Suc j) = Normal t') \\\n (\\t'. t \\ Abrupt t' \\ snd(l!Suc j)=t))\"\n proof -\n fix t \n { assume \"fst(l!Suc j) = Skip\"\n then have step:\"\\\\\\<^sub>c (Await b c,Normal s) \\ (Skip, snd(l!Suc j))\"\n using step_await k_basic by fastforce\n have s'_b:\"s\\b\" using s'_in_bp by fastforce\n note step = stepc_elim_cases_Await_skip[OF step]\n have h:\"(s \\ b \\ \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ snd(l!Suc j) \\ \\t'. snd(l!Suc j) \\ Abrupt t' \\\n \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ snd(l!Suc j) \\ (\\t'. snd(l!Suc j) \\ Abrupt t'))\" by auto\n have ?thesis \n using step[OF h] by fastforce\n } note left = this\n { assume \"fst(l!Suc j)= Throw \\ (\\s1. snd(l!Suc j) = Normal s1)\"\n then obtain s1 where step:\"fst(l!Suc j)= Throw \\ snd(l!Suc j) = Normal s1\"\n by fastforce\n then have step: \"\\\\\\<^sub>c (Await b c,Normal s) \\ (Throw, snd(l!Suc j))\"\n using step_await k_basic by fastforce\n have s'_b:\"s\\b\" using s'_in_bp by fastforce\n note step = stepc_elim_cases_Await_throw[OF step]\n have h:\"(\\t'. snd(l!Suc j) = Normal t' \\ s \\ b \\ \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ Abrupt t' \\ \n \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ Abrupt t' \\ snd(l!Suc j) = Normal t')\"\n by auto \n have ?thesis using step[OF h] by blast \n } thus ?thesis using suc_skip left step_await suc_skip by blast \n qed\n then obtain t where e_step:\"\\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ t \\ \n ((\\t'. t =Abrupt t' \\ snd(l!Suc j) = Normal t') \\\n (\\t'. t \\ Abrupt t' \\ snd(l!Suc j)=t)) \" by fastforce\n moreover have \"t \\ Fault ` F\" \n proof - \n {assume a10:\"t \\ Fault ` F\"\n then obtain tf where \"t=Fault tf \\ tf\\F\" by fastforce\n then have \"snd(l!Suc j) = Fault tf \\ tf\\F\" using e_step by fastforce\n also have \"snd(l!Suc j) \\ Fault ` F\" \n using last_not_F[of \\ l F] a5 a1 step_await a0 by blast\n ultimately have False by auto\n } thus ?thesis by auto\n qed\n ultimately have t_q_a:\"t \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\q) \\ \n Abrupt ` ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n using e_auto unfolding valid_def by fastforce\n thus ?thesis using e_step t_q_a by blast \n qed \n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_await[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast \n moreover then have k:\"k=j\" using a2 by fastforce\n ultimately have \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j))))\" by auto \n also from conc k k_basic have \n \"(\\s s'. fst (l!k) = Await b c \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_await_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Await b c\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\\n Sta a rely\" and\n a4:\"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c\n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a5:\"snd (last l) \\ Fault ` F\" \n shows \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))) \\ \n (\\s s'. fst (l!k) = Await b c \\ snd (l!k) \\ Normal ` (p) \\ \n snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\" \nproof - \n have \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\s s'. fst (l!k) = Await b c \\ snd (l!k) \\ Normal ` (p) \\ \n snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using one_component_tran_await[OF a0 a1 a2 a3 a4 a5] by auto\n thus ?thesis using a0\n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases) \nqed\n\nlemma final_exist_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Await b c\" and \n a2: \"env_tran \\ q l R \" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \n\ninductive_cases stepc_elim_cases_Await_Fault:\n\"\\\\\\<^sub>c (Await b c, Normal s) \\ (u,Fault f)\"\n\nlemma Await_sound: \n \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a) \\ \n Sta p R \\ Sta q R \\ Sta a R \\ \n \\,\\\\n:\\<^bsub>/F\\<^esub> (Await b e) sat [p, R, G, q,a]\"\nproof - \n assume\n a0: \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" and\n a4:\"Sta a R\" \n{\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n:\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n have \"cpn n \\ (Await b e) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Await b e) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume last_fault:\"snd (last l) \\ Fault ` F\"\n have cp:\"l!0=(Await b e,s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n\n cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n then have all_event:\n \"(\\s s'. fst (l!k) = Await b e \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = \n Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using a00 a11 one_component_tran_await_env[of \\ l b e k R p q a F G] env_tran_right cp len_l\n using a0 a2 a3 a4 assum fst_conv last_fault by auto \n then obtain s' s'' where ss:\n \"snd (l!k) = Normal s' \\ s' \\ (p) \\ snd (l!Suc k) = Normal s'' \n \\ (s'' \\ (({s. (Normal s', Normal s) \\ G} \\ q)) \\ \n s''\\ (({s. (Normal s', Normal s) \\ G} \\ a)))\"\n by fastforce \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using a2 by force\n } thus ?thesis using c_prod by auto qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Await b e\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_await env_tran by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ Suc k < length l \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by fastforce\n then obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using cp by fastforce \n have all_event:\n \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))) \\\n (\\s s'. fst (l!k) = Await b e \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = \n Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using one_component_tran_await_env[of \\ l b e k R p q a F G] a0 a11 a2 a3 a4 assum cp \n env_tran_right len_l fst_conv last_fault k_comp_tran by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then obtain s' where k_basic:\"ck = Await b e \\ sk \\ Normal ` (p) \\ sk = Normal s'\" \n using cp env_tran_right a2 assum tran_pair k_comp_tran stability[of p R l 0 k k \\] tran_pair\n by force \n have \"\\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {s'}) e \n ({s. (Normal s', Normal s) \\ G} \\ q),\n ({s. (Normal s', Normal s) \\ G} \\ a)\"\n using a0 hoare_sound k_basic\n by fastforce\n then have e_auto:\"\\\\<^sub>\\\\<^sub>a\\\\<^bsub>/F\\<^esub> (p \\ b \\ {s'}) e \n ({s. (Normal s', Normal s) \\ G} \\ q),\n ({s. (Normal s', Normal s) \\ G} \\ a)\" \n unfolding cvalid_def by auto \n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n have suc_skip: \"csk = Skip \\ (csk = Throw \\ (\\s1. ssk = Normal s1))\"\n using a0 k_basic tran_pair await_skip by blast\n moreover {\n assume at:\"csk = Skip\" \n then have atom_tran:\"\\\\<^sub>\\\\<^sub>a\\\\e,sk\\ \\ ssk\"\n using k_basic tran_pair k_basic cp stepc_elim_cases_Await_skip\n by metis\n have sk_in_normal_pb:\"sk \\ Normal ` (p \\ b)\" \n using k_basic tran_pair at cp stepc_elim_cases_Await_skip\n by (metis (no_types, lifting) IntI image_iff) \n then have \"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\" \n proof (cases ssk)\n case (Normal t) \n then have \"ssk \\ Normal ` q\" \n using sk_in_normal_pb k_basic e_auto Normal atom_tran unfolding valid_def\n by blast\n thus ?thesis\n using at l tran_pair last_l len_l cp \n env_tran_right a3 after_k_all_evn \n assum k_comp_tran stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\]\n by (metis (no_types, hide_lams) Suc_leI diff_Suc_eq_diff_pred diff_less less_one zero_less_diff) \n next\n case (Abrupt t)\n thus ?thesis \n using at k_basic tran_pair k_basic cp stepc_elim_cases_Await_skip\n by metis \n next\n case (Fault f1) \n then have \"ssk \\ Normal ` q \\ ssk \\ Fault ` F\" \n using k_basic sk_in_normal_pb e_auto Fault atom_tran unfolding valid_def by auto \n thus ?thesis\n proof\n assume \"ssk \\ Normal ` q\" thus ?thesis using Fault by auto\n next\n assume suck_fault:\"ssk \\ Fault ` F\"\n have \"\\i Fault ` F\" \n using last_not_F[of \\ l F] last_fault cp by auto\n thus ?thesis \n using cp tran_pair a11 k_comp_tran suck_fault\n by (meson diff_less len_l less_imp_Suc_add less_one less_trans_Suc) \n qed\n next \n case (Stuck) \n then have \"ssk \\ Normal ` q\" \n using k_basic sk_in_normal_pb e_auto Stuck atom_tran unfolding valid_def\n by blast\n thus ?thesis using Stuck by auto \n qed \n }\n moreover {\n assume at:\"(csk = Throw \\ (\\t. ssk = Normal t))\"\n then obtain t where ssk_normal:\"ssk=Normal t\" by auto\n then have atom_tran:\"\\\\<^sub>\\\\<^sub>a\\\\e,sk\\ \\ Abrupt t\"\n using at k_basic tran_pair k_basic ssk_normal cp stepc_elim_cases_Await_throw xstate.inject(1)\n by metis \n also have \"sk \\ Normal ` (p \\ b)\" \n using k_basic tran_pair k_basic ssk_normal at cp stepc_elim_cases_Await_throw\n by (metis (no_types, lifting) IntI imageE image_eqI stepc_elim_cases_Await_throw) \n then have \"ssk \\ Normal ` a\" \n using e_auto k_basic ssk_normal atom_tran unfolding valid_def\n by blast\n then have \"(fst (last l) = Throw \\ snd (last l) \\ Normal ` (a))\"\n using at l tran_pair last_l len_l cp \n env_tran_right a4 after_k_all_evn\n assum k_comp_tran stability [of a R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by (metis (no_types, hide_lams) Suc_leI diff_Suc_eq_diff_pred diff_less less_one zero_less_diff) \n }\n ultimately have \"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q \\\n (fst (last l) = Throw \\ snd (last l) \\ Normal ` (a))\"\n by blast \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nsubsection {* If sound *}\n\nlemma cptn_assum_induct:\nassumes\n a0: \"(\\,l) \\ (cp \\ c s) \\ ((\\,l) \\ assum(p, R) F)\" and\n a1: \"k < length l \\ l!k=(c1,Normal s') \\ s' \\ p1\"\nshows \"(\\,drop k l)\\ ((cp \\ c1 (Normal s')) \\ assum(p1, R) F)\"\nproof -\n have drop_k_s:\"(drop k l)!0 = (c1,Normal s')\" using a1 by fastforce\n have p1:\"s' \\ p1\" using a1 by auto\n have k_l:\"k < length l\" using a1 by auto\n show ?thesis\n proof\n show \"(\\, drop k l) \\ cp \\ c1 (Normal s')\" \n unfolding cp_def \n using dropcptn_is_cptn a0 a1 drop_k_s cp_def \n by fastforce\n next\n let ?c= \"(\\,drop k l)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` p1\"\n using p1 drop_k_s by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R \"\n using a0 unfolding assum_def using a00 a11 by auto\n } thus \"(\\, drop k l) \\ assum (p1, R) F\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma cptn_n_assum_induct:\nassumes\n a0: \"(\\,l) \\ (cpn n \\ c s) \\ ((\\,l) \\ assum(p, R) F)\" and\n a1: \"k < length l \\ l!k=(c1,Normal s') \\ s' \\ p1\"\nshows \"(\\,drop k l)\\ ((cpn n \\ c1 (Normal s')) \\ assum(p1, R) F)\"\nproof -\n have drop_k_s:\"(drop k l)!0 = (c1,Normal s')\" using a1 by fastforce\n have p1:\"s' \\ p1\" using a1 by auto\n have k_l:\"k < length l\" using a1 by auto\n show ?thesis\n proof\n show \"(\\, drop k l) \\ cpn n \\ c1 (Normal s')\" \n unfolding cpn_def \n using dropcptn_is_cptn a0 a1 drop_k_s cpn_def \n by fastforce\n next\n let ?c= \"(\\,drop k l)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` p1\"\n using p1 drop_k_s by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R \"\n using a0 unfolding assum_def using a00 a11 by auto\n } thus \"(\\, drop k l) \\ assum (p1, R) F\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\n\n\nlemma cptn_comm_induct:\nassumes\n a0: \"(\\,l) \\ (cp \\ c s)\" and\n a1: \"l1 = drop j l \\ (\\, l1)\\ comm(G, (q,a)) F\" and\n a2: \"k \\ j \\ j < length l\" \nshows \"snd (last (l)) \\ Fault ` F \\ ((Suc k < length l \\\n \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd(l!k), snd(l!(Suc k))) \\ G) \n \\ (final (last (l)) \\ \n ((fst (last (l)) = Skip \\ \n snd (last (l)) \\ Normal ` q)) \\\n (fst (last (l)) = Throw \\ \n snd (last (l)) \\ Normal ` (a))))\"\nproof - \n have pair_\\l:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce \n have a03:\"snd (last (l1)) \\ Fault ` F \\(\\i. \n Suc i, l1)) \\ \n fst (\\, l1)\\\\<^sub>c((snd (\\, l1))!i) \\ ((snd (\\, l1))!(Suc i)) \\ \n (snd((snd (\\, l1))!i), snd((snd (\\, l1))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l1))) \\ \n snd (last (snd (\\, l1))) \\ Fault ` F \\\n ((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n have last_l:\"last l1 = last l\" using a1 a2 by fastforce\n show ?thesis \n proof -\n {\n assume \" snd (last l) \\ Fault ` F\" \n then have l1_f:\"snd (last l1) \\ Fault ` F\" \n using a03 a1 a2 by force \n { assume \"Suc k < length l\"\n then have a2: \"k \\ j \\ Suc k < length l\" using a2 by auto\n have \"k \\ length l\" using a2 by fastforce\n then have l1_l:\"(l!k = l1! (k - j) ) \\ (l!Suc k = l1!Suc (k - j))\"\n using a1 a2 by fastforce \n have a00:\"Suc (k - j) < length l1\" using a1 a2 by fastforce\n have \"\\\\\\<^sub>c(l1!(k-j)) \\ (l1!(Suc (k-j))) \\ \n (snd((snd (\\, l1))!(k-j)), snd((snd (\\, l1))!(Suc (k-j)))) \\ G\"\n using pair_\\l a00 l1_f a03 by presburger\n then have \" \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G \" \n using l1_l last_l by auto\n } then have l_side:\"Suc k < length l \\\n \\\\\\<^sub>c l ! k \\ l ! Suc k \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G\" by auto \n { \n assume a10:\"final (last (l))\" \n then have final_eq: \"final (last (l1))\"\n using a10 a1 a2 by fastforce\n also have \"snd (last (l1)) \\ Fault ` F\"\n using last_l l1_f by fastforce\n ultimately have \"((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a))\"\n using pair_\\l a03 by presburger\n then have \"((fst (last (snd (\\, l))) = Skip \\ \n snd (last (snd (\\, l))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l))) = Throw \\ \n snd (last (snd (\\, l))) \\ Normal ` (a))\"\n using final_eq a1 a2 by auto \n } then have \n r_side: \n \"SmallStepCon.final (last l) \\ \n fst (last l) = LanguageCon.com.Skip \\ snd (last l) \\ Normal ` q \\\n fst (last l) = LanguageCon.com.Throw \\ snd (last l) \\ Normal ` a\"\n by fastforce\n note res=conjI[OF l_side r_side] \n } thus ?thesis by auto\n qed\nqed\n\n\nlemma If_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ b), R, G, q,a] \\\n \\,\\ \\n:\\<^bsub>/F\\<^esub> c1 sat [(p \\ b), R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [(p \\ (-b)), R, G, q,a] \\\n \\,\\ \\n:\\<^bsub>/F\\<^esub> c2 sat [(p \\ (-b)), R, G, q,a] \\ \n Sta p R \\ (\\s. (Normal s, Normal s) \\ G) \\ \n \\,\\ \\n:\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]\" and \n a2: \"\\,\\ \\n:\\<^bsub>/F\\<^esub> c1 sat [(p \\ b), R, G, q,a]\" and\n a3: \"\\,\\ \\n:\\<^bsub>/F\\<^esub> c2 sat [(p \\ (-b)), R, G, q,a]\" and\n a4: \"Sta p R\" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n:\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a3:\"\\ \\n:\\<^bsub>/F\\<^esub> c2 sat [(p \\ (-b)), R, G, q,a]\" \n using a3 com_cvalidityn_def by fastforce \n have a2:\"\\ \\n:\\<^bsub>/F\\<^esub> c1 sat [(p \\ b), R, G, q,a]\"\n using a2 all_call com_cvalidityn_def by fastforce \n have \"cpn n \\ (Cond b c1 c2) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Cond b c1 c2) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n then have cp:\"l!0=((Cond b c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using a10 cpn_def c_prod cptn_eq_cptn_mod_set cptn_mod_same_n\n cptn_mod_eq_cptn_mod_nest cptn_eq_cptn_mod by fastforce \n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (Cond b c1 c2) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" using before_k_all_evnt k_basic pair_j\n by (metis prod.collapse snd_conv stepc_Normal_elim_cases(6)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def \n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" \n using a5 by blast\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n have l_suc:\"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j ssj_normal_s\n by fastforce\n have l_k:\"jb \\ s'\\b\" by auto \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n proof\n assume a000:\"s'\\b\"\n then have cj:\"csj=c1\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ b)\" using a000 ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ b), R) F \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s p R F \"Suc j\" c1 s' \"(p \\ b)\"]\n by blast \n show ?thesis \n using l_k drop_comm a00 a21 a10 \\1 l_f \n cptn_comm_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s _ \"Suc j\" G q a F k]\n by fastforce \n next\n assume a000:\"s'\\b\"\n then have cj:\"csj=c2\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ (-b))\" using a000 ss by fastforce\n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ (-b)), R) F \\ comm(G, (q,a)) F\"\n using a3 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s p R F \"Suc j\" c2 s' \"(p \\ (-b))\"]\n by fastforce \n show ?thesis \n using l_k drop_comm a00 a21 a10 \\1 l_f\n cptn_comm_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s _ \"Suc j\" G q a F k]\n unfolding Satis_def by fastforce\n qed\n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n assume not_fault: \"snd (last l) \\ Fault ` F\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = LanguageCon.com.Cond b c1 c2\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Cond b c1 c2) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\]\n by fastforce\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" using before_k_all_evnt k_basic pair_j\n by (metis prod.collapse snd_conv stepc_Normal_elim_cases(6)) \n have l_suc:\"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j ssj_normal_s\n by fastforce\n have \"s'\\b \\ s'\\b\" by auto \n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof\n assume a000:\"s'\\b\"\n then have cj:\"csj=c1\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ b)\" using a000 ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ b), R) F \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s p R F \"Suc j\" c1 s' \"(p \\ b)\"]\n by blast \n thus ?thesis \n using j_length drop_comm a10 \\1 cptn_comm_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s _ \"Suc j\" G q a F \"Suc j\"] valid not_fault \n by blast\n next\n assume a000:\"s'\\b\"\n then have cj:\"csj=c2\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s'\\(p \\ (-b))\" using a000 ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ (-b)), R) F \\ comm(G, (q,a)) F\"\n using a3 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s p R F \"Suc j\" c2 s' \"(p \\ (-b))\"]\n by blast \n thus ?thesis \n using j_length drop_comm a10 \\1 cptn_comm_induct[of \\ l \"(LanguageCon.com.Cond b c1 c2)\" s _ \"Suc j\" G q a F \"Suc j\"] valid not_fault \n by blast\n qed\n } thus ?thesis using l_f by fastforce qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\nlemma Asm_sound:\n \"(c, p, R, G, q, a) \\ \\ \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\n \"\nproof -\n assume\n a0:\"(c, p, R, G, q, a) \\ \\\" \n { fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have \"\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" using a0 by auto\n } thus ?thesis unfolding com_cvalidity_def by auto\nqed\n\nlemma Call_sound: \n \"f \\ dom \\ \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> (the (\\ f)) sat [p, R, G, q,a] \\ \n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Call f) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"f \\ dom \\\" and\n a2:\"\\,\\ \\\\<^bsub>/F\\<^esub> (the (\\ f)) sat [p, R, G, q,a]\" and \n a3: \"Sta p R\" and\n a4: \"(\\s. (Normal s, Normal s) \\ G)\" \n obtain bdy where a0:\"\\ f = Some bdy\" using a0 by auto\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a2:\"\\ \\\\<^bsub>/F\\<^esub> bdy sat [p, R, G, q,a]\" \n using a0 a2 com_cvalidity_def by fastforce\n have \"cp \\ (Call f) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (Call f) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Call f),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (Call f) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis not_None_eq snd_conv stepc_Normal_elim_cases(9)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 \n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" \n using a4 by fastforce \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=bdy\" using k_basic pair_j ss a0\n by (metis fst_conv option.distinct(1) option.sel stepc_Normal_elim_cases(9)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n using a2 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"Call f\" s p R F \"Suc j\" bdy s' p]\n by blast \n then show ?thesis \n using a00 a21 a10 \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"Call f\" s _ \"Suc j\" G q a F k ]\n unfolding Satis_def by fastforce \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Call f\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Call f) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis not_None_eq snd_conv stepc_Normal_elim_cases(9))\n have cj:\"csj=bdy\" using k_basic pair_j ss a0\n by (metis fst_conv option.distinct(1) option.sel stepc_Normal_elim_cases(9)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n using a2 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"Call f\" s p R F \"Suc j\" bdy s' p]\n by blast \n thus ?thesis \n using j_length l_f drop_comm a10 \\1 cptn_comm_induct[of \\ l \"Call f\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\n(* fun n_calls_cptn:: \"('s,'p,'f) confs \\ nat\"\nwhere\n\"n_calls_cptn (\\,[]) = 0\"\n|\"n_calls_cptn (\\,[a0]) = 0\"\n|\"n_calls_cptn (\\,[a0,a1]) = 0\"\n|\"n_calls_cptn (\\,a0#a1#l) = (if (\\p. redex (fst a0) = Call p \\ \n redex (fst a1) = the (\\ p)) then\n (n_calls_cptn (\\,(a1#l))) + 1\n else n_calls_cptn (\\,(a1#l)))\"\n\ndefinition cptns_sat::\"('s,'p,'f) body \\ 'f set \\ ('s,'p,'f) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ (('s,'p,'f) confs) set\"\nwhere \n\"cptns_sat \\ F Pr p R G q a \\ \n {cf. \\s. cf \\ (cp \\ Pr s \\ assum(p, R) F) \\\n (cp \\ Pr s \\ assum(p, R) F \\ comm(G, (q,a)) F) \n }\"\n\ndefinition max_calls_cptn_sat::\"('s,'p,'f) body \\ 'f set \\ ('s,'p,'f) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ nat\"\nwhere\n\"max_calls_cptn_sat \\ F Pr p R G q a \\ \n if (cptns_sat \\ F Pr p R G q a) = {} then 0\n else\n (SOME n.\n (\\n1 \\ (n_calls_cptn ` (cptns_sat \\ F Pr p R G q a)). \n n1\\n))\n\"\n\ndefinition calls_cptn_spec::\n \"('s,'p,'f) body \\ 'f set \\ ('s, 'p, 'f) sextuple set \\ nat set\"\nwhere\n\"calls_cptn_spec \\ F \\ \\ \n {n. \\(Pr,p,R,G,q,a)\\\\. n \\ (n_calls_cptn ` (cptns_sat \\ F (Call Pr) p R G q a)) }\n\"\n\ndefinition max_calls_cptn_spec::\n \"('s,'p,'f) body \\ 'f set \\ ('s, 'p, 'f) sextuple set \\ nat \"\nwhere\n\"max_calls_cptn_spec \\ F \\ \\ \n if (calls_cptn_spec \\ F \\) = {} then 0\n else\n (SOME n. \n (\\n1 \\ (calls_cptn_spec \\ F \\). \n n1\\n))\n\"\n\ndefinition max_calls_cptn_spec_sat::\n\"('s,'p,'f) body \\ 'f set \\ ('s, 'p, 'f) sextuple set \\\n ('s,'p,'f) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ nat\"\nwhere\n\"max_calls_cptn_spec_sat \\ F \\ Pr p R G q a \\\n if (max_calls_cptn_sat \\ F Pr p R G q a) \\ (max_calls_cptn_spec \\ F \\) then\n (max_calls_cptn_sat \\ F Pr p R G q a)\n else (max_calls_cptn_spec \\ F \\)\n\" *)\n\n\n(* lemma CallRec_sound1:\n \"(c, p, R, G, q, a) \\ Specs \\\n \\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a] \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof -\n assume a0: \"(c, p, R, G, q, a) \\ Specs\" and\n a1: \n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\"\n then have a1': \"c \\ dom \\\" and \n a1'': \"\\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\" using a0 by auto \n from a1 have \n valid_body:\n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\" by fastforce\n assume a5: \"Sta p R\" and\n a6: \"(\\s. (Normal s,Normal s) \\ G)\" and\n a7: \"Norm R\" \n obtain bdy where \\bdy:\"\\ c = Some bdy\" using a1' by auto\n have theta_specs: \n \"\\(c, p, R, G, q, a)\\\\. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\\n \\(c, p, R, G, q, a)\\Specs. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n proof -\n assume a00:\"\\(c, p, R, G, q, a)\\\\. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n { \n fix c1 p1 R1 G1 q1 a1\n assume a001:\"(c1, p1, R1, G1, q1, a1)\\Specs\" \n then have \"c1 \\ dom \\ \\ Sta p1 R1 \\ (\\s. (Normal s,Normal s) \\ G1) \\ Norm R1 \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c1) sat [p1,R1, G1, q1,a1]\" \n using valid_body by fastforce\n then have \"\\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> Call c1 sat [p1,R1, G1, q1,a1]\"\n using Call_sound[of c1 \\ \"\\ \\ Specs\" F p1 R1 G1 q1 a1] a5 a6 a7\n by fastforce\n {\n fix s\n have \"cp \\ (LanguageCon.com.Call c1) s \\ assum (p1, R1) F \\ comm (G1, q1, a1) F\"\n proof -\n { \n fix c\n assume a10:\"c \\ cp \\ (Call c1) s\" and a11:\"c\\ assum(p1,R1) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n obtain n where h:\"n_calls_cptn (\\1,l) = n\" by auto\n then have \"c \\ comm(G1, (q1,a1)) F\" using a10 a11 \n proof (induct n arbitrary: l s p1 c)\n case 0 thus ?case sorry\n next\n case (Suc n) thus ?case sorry\n qed\n } thus ?thesis by auto qed\n } \n then have \"\\ \\\\<^bsub>/F\\<^esub> Call c1 sat [p1,R1, G1, q1,a1]\"\n unfolding com_validity_def by auto\n \n } thus ?thesis by auto\n qed\n then show ?thesis using a0 unfolding com_cvalidity_def by auto \nqed *)\n\n\n(* lemma CallRec_sound:\n \"(c, p, R, G, q, a) \\ Specs \\\n \\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a] \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof -\n assume a0: \"(c, p, R, G, q, a) \\ Specs\" and\n a1: \n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\"\n then have a1': \"c \\ dom \\\" and \n a1'': \"\\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\" using a0 by auto \n from a1 have \n valid_body:\n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ Norm R \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\" by fastforce\n assume a5: \"Sta p R\" and\n a6: \"(\\s. (Normal s,Normal s) \\ G)\" \n obtain bdy where \\bdy:\"\\ c = Some bdy\" using a1' by auto\n have theta_specs: \n \"\\(c, p, R, G, q, a)\\\\. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\\n \\(c, p, R, G, q, a)\\Specs. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n proof -\n assume a00:\"\\(c, p, R, G, q, a)\\\\. \\ \\\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n { \n fix c1 p1 R1 G1 q1 a1\n assume \"(c1, p1, R1, G1, q1, a1)\\Specs\"\n then have \"c1 \\ dom \\ \\ Sta p1 R1 \\ (\\s. (Normal s,Normal s) \\ G1) \\ Norm R1 \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c1) sat [p1,R1, G1, q1,a1]\" \n using valid_body by fastforce\n then have \"\\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> Call c1 sat [p1,R1, G1, q1,a1]\"\n using Call_sound[of c1 \\ \"\\ \\ Specs\" F p1 R1 G1 q1 a1] a5 a6 \n by fastforce \n then have \"\\ \\\\<^bsub>/F\\<^esub> Call c1 sat [p1,R1, G1, q1,a1]\" \n unfolding com_cvalidity_def using a00\n sorry\n } thus ?thesis by auto\n qed\n then show ?thesis using a0 unfolding com_cvalidity_def by auto \nqed*)\n\n\n\n\nlemma Seq_env_P:assumes a0:\"\\\\\\<^sub>c(Seq P Q,s) \\\\<^sub>e (Seq P Q,t)\"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t)\"\nusing a0\nby (metis env_not_normal_s snormal_enviroment)\n\nlemma map_eq_state:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Seq c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\\\<^sub>e l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\\\<^sub>e (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (metis Env_n env_c_c' env_not_normal_s step_e.Env)\n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\\\<^sub>e (l2 ! Suc i)\" \n using a4 l1prod l2prod \n by (metis Env_n LanguageCon.com.inject(3) env_c_c' env_not_normal_s step_e.Env) \n }\n qed\n } \n thus ?thesis by auto\nqed\n\n\n\nlemma same_comp_seq_c:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Seq c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\ l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\ (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (simp add: Seqc) \n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\ l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\ (l2 ! Suc i)\" \n using a4 l1prod l2prod stepc_elim_cases_Seq_Seq\n by auto \n }\n qed\n } \n thus ?thesis by auto\nqed\n\nlemma assum_map:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s) \\ ((\\,l1) \\ assum(p, R) F)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"((\\,l2) \\ assum(p, R) F)\"\nproof -\n have a3: \"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \n using a0 a1 a2 same_env_seq_c by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n obtain s' where normal_s:\"s = Normal s'\" \n using a0 unfolding cp_def assum_def by fastforce\n then have p1:\"s'\\p\" using a0 unfolding cp_def assum_def by fastforce \n show ?thesis \n proof - \n let ?c= \"(\\,l2)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` (p)\"\n using p1 drop_k_s a1 normal_s unfolding cp_def by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R\"\n using a0 a1 a2 a3 map_eq_state unfolding assum_def \n using a00 a11 eq_length by fastforce\n } thus \"(\\, l2) \\ assum (p, R) F\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma comm_map':\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\(Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (fst (last l1) = (Seq c c2) \\ final (c, snd (last l1)) \\ \n (fst (last l1) = (Seq Skip c2) \\ \n (snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Seq Throw c2) \\ \n snd (last l1) \\ Normal ` (a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_seq_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto \n then have len0:\"length l1>0\" using a0 unfolding cp_def \n using Collect_case_prodD drop_k_s eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed\n then have \"snd (last l1) \\ Fault ` F \\\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis Suc_lessD a0 a1 a2 map_eq_state)\n } note l=this\n {\n assume a00: \"fst (last l1) = (Seq c c2) \\ final (c, snd (last l1))\" and\n a01:\"snd (last (l1)) \\ Fault ` F\"\n then have c:\"c=Skip \\ c = Throw\"\n unfolding final_def by auto \n then have fst_last_l2:\"fst (last l2) = c\" \n using last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift \n by fastforce \n also have last_eq:\"snd (last l2) = snd (last l1)\" \n using l2_not_empty a2 last_conv_nth last_lenl1 last_snd \n by fastforce\n ultimately have \"final (fst (last l2),snd (last l2))\" \n using a00 by auto\n then have \"final (last l2)\" by auto\n also have \"snd (last (l2)) \\ Fault ` F\"\n using last_eq a01 by auto\n ultimately have \"(fst (last l2)) = Skip \\ \n snd (last l2) \\ Normal ` q \\\n (fst (last l2) = Throw \\ \n snd (last l2) \\ Normal ` (a))\"\n using a03 by auto\n then have \"(fst (last l1) = (Seq Skip c2) \\ \n snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Seq Throw c2) \\ \n snd (last l1) \\ Normal ` (a))\"\n using last_eq fst_last_l2 a00 by force\n }\n thus ?thesis using l by auto qed\nqed\n\nlemma comm_map'':\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\ ((Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (final (last l1) \\ \n (fst (last l1) = Skip \\ \n (snd (last l1) \\ Normal ` r) \\\n (fst (last l1) = Throw \\ \n snd (last l1) \\ Normal ` (a)))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_seq_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto \n then have len0:\"length l1>0\" using a0 unfolding cp_def \n using Collect_case_prodD drop_k_s eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce \n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed \n then have \"\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift)\n } note l= this\n {\n assume a00: \"final (last l1)\" \n then have c:\"fst (last l1)=Skip \\ fst (last l1) = Throw\"\n unfolding final_def by auto \n moreover have \"fst (last l1) = Seq (fst (last l2)) c2\" \n using a2 last_lenl1 eq_length\n proof -\n have \"last l2 = l2 ! (length l2 - 1)\"\n using l2_not_empty last_conv_nth by blast\n then show ?thesis\n by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift)\n qed\n ultimately have False by simp \n } thus ?thesis using l by auto qed\nqed\n\nlemma comm_map:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"(\\, l1)\\ comm(G, (r,a)) F\"\nproof - \n {fix i \n have \"snd (last l1) \\ Fault ` F \\(Suc i < length (l1) \\\n \\\\\\<^sub>c (l1 ! i) \\ (l1 ! (Suc i)) \\ \n (snd (l1 ! i), snd (l1 ! Suc i)) \\ G) \\\n (SmallStepCon.final (last l1) \\ \n fst (last l1) = LanguageCon.com.Skip \\\n snd (last l1) \\ Normal ` r \\\n fst (last l1) = LanguageCon.com.Throw \\\n snd (last l1) \\ Normal ` a) \"\n using comm_map''[of \\ l1 c1 c2 s l2 G q a F i r] a0 a1 a2 \n by fastforce\n } then show ?thesis using comm_def unfolding comm_def by force \nqed\n\nlemma Seq_sound1: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"\\ final (last x)\" and\n a4:\"env_tran_right \\ x rely\" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely \" and \n a6: \"\\ \\\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\" \nshows\n \"\\xs. (\\,xs) \\ cp \\ P s \\ x = map (lift Q) xs\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: P s p) \n case (CptnModOne \\ C s1)\n then have \"(\\, [(P,s)]) \\ cp \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]\"\n unfolding cp_def lift_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n have \"\\xs. (\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"\\ SmallStepCon.final (last ((C, t1) # xsa))\" using CptnModEnv(6) \n by fastforce\n moreover have \"snd (((C, t1) # xsa) ! 0) \\ Normal ` p\" \n using CptnModEnv(8) CptnModEnv(1) CptnModEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) CptnModEnv(8) CptnModEnv(9) env_tran_tail by blast\n qed \n then obtain xs where hi:\"(\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModEnv unfolding cp_def by auto\n obtain xsa' where xs:\"xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')\" \n using hi unfolding cp_def by fastforce\n \n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModEnv Seq_env_P by (metis fst_conv nth_Cons_0) \n then have \"(\\,(P,s1)#(P,t1)#xsa')\\cptn\" using xs env_tran CptnEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cp \\ P s\" \n using cp_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')\"\n using xs C unfolding lift_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModSeq1 \\ P0 sa xsa zs P1)\n then have a1:\"LanguageCon.com.Seq P Q = LanguageCon.com.Seq P0 P1\"\n by fastforce \n have f1: \"sa = s\"\n using CptnModSeq1.prems(1) by force\n have f2: \"P = P0 \\ Q = P1\" using a1 by auto\n have \"(\\, (P0, sa) # xsa) \\ cptn\"\n by (metis CptnModSeq1.hyps(1) cptn_eq_cptn_mod_set)\n hence \"(\\, (P0, sa) # xsa) \\ cp \\ P s\"\n using f2 f1 by (simp add: cp_def)\n thus ?case\n using Cons_lift CptnModSeq1.hyps(3) a1 by fastforce \nnext\n case (CptnModSeq2 \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModSeq2(8) zs by auto\nnext\n case (CptnModSeq3 \\ P1 sa xsa s' ys zs Q1 ) \n have s'_a:\"s' \\ a\" \n proof -\n have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\" \n using CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set unfolding cp_def by fastforce\n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely) F\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModSeq3.hyps(7) CptnModSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModSeq3(7) CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod.CptnModSeq1 \n unfolding cp_def by fastforce \n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely) F\" \n using assum_map map cpP1 by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpP1 CptnModSeq3(13) CptnModSeq3.prems(1) unfolding com_validity_def by auto\n thus ?thesis \n using CptnModSeq3(3) CptnModSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have \"final (last ((LanguageCon.com.Throw, Normal s')# ys))\"\n proof -\n have cptn:\"(\\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn\" \n using CptnModSeq3(5) by (simp add: cptn_eq_cptn_mod_set)\n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw \\ \n snd (last ((LanguageCon.com.Throw, Normal s') # ys)) = Normal st'\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"(length ((Throw, Normal s') # ys))-1\" a rely]\n s'_a CptnModSeq3(11) CptnModSeq3(12) by fastforce \n thus ?thesis using CptnModSeq3(10) final_def by blast\n qed\n thus ?case using CptnModSeq3(10) CptnModSeq3(7)\n by force\nqed (auto)\n\nlemma Seq_sound2: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst (last x) = Throw \\ snd (last x) = Normal s'\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs s' ys. (\\,xs) \\ cp \\ P s \\ x = ((map (lift Q) xs)@((Throw, Normal s')#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s s')\n case (CptnModOne \\ C s1)\n then have \"(\\, [(P,s)]) \\ cp \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]@[(Throw, Normal s')]\"\n unfolding cp_def lift_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n have \"\\xs s' ys. (\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s')#ys)\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = Throw \\ snd (last ((C, t1) # xsa)) = Normal s'\" using CptnModEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) env_tran_tail by blast \n qed \n then obtain xs s'' ys where hi:\"(\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s'')#ys)\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModEnv unfolding cp_def by auto\n have \"\\xsa' s'' ys. xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\" \n using hi unfolding cp_def\n proof -\n have \"(\\,xs)\\cptn \\ xs!0 = (P,t1)\" using hi unfolding cp_def by fastforce\n moreover then have \"xs\\[]\" using cptn.simps by fastforce \n ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n thus ?thesis\n using hi using \\(\\, xs) \\ cptn \\ xs ! 0 = (P, t1)\\ by auto \n qed\n then obtain xsa' s'' ys where xs:\"xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n by fastforce\n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModEnv Seq_env_P by (metis fst_conv nth_Cons_0) \n then have \"(\\,(P,s1)#(P,t1)#xsa')\\cptn\" using xs env_tran CptnEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cp \\ P s\" \n using cp_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n using xs C unfolding lift_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModSeq1 \\ P0 sa xsa zs P1) \n thus ?case \n proof -\n have \"\\c p. fst (case p of (ca::('s, 'a, 'd) LanguageCon.com, x::('s, 'd) xstate) \\ (LanguageCon.com.Seq ca c, x)) = LanguageCon.com.Seq (fst p) c\"\n by simp\n then have \"[] = xsa\"\n using CptnModSeq1(6) CptnModSeq1(3)\n by (metis (no_types) LanguageCon.com.distinct(71) fst_conv last.simps last_map lift_def)\n then have \"\\c. Throw = c \\ [] = zs\"\n using CptnModSeq1(3) by fastforce\n then show ?thesis\n using CptnModSeq1.prems(3) by force\n qed \nnext\n case (CptnModSeq2 \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModSeq2(8) zs by auto\nnext \n case (CptnModSeq3 \\ P0 sa xsa s'' ys zs P1) \n then have \"P0 = P \\ P1 = Q \\ s=Normal sa\" by auto \n moreover then have \"(\\, (P0, Normal sa) # xsa)\\ cp \\ P s\" \n using CptnModSeq3(1)\n by (simp add: cp_def cptn_eq_cptn_mod_set) \n moreover have \"last zs=(Throw, Normal s')\" using CptnModSeq3(10) CptnModSeq3.hyps(7) \n by (simp add: prod_eqI) \n ultimately show ?case using CptnModSeq3(7)\n using Cons_lift_append by blast \nqed (auto)\n\nlemma Last_Skip_Exist_Final: \nassumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Skip\" \nshows \n \"\\c s' i. i x!i = (Seq c Q,s') \\ final (c,s')\"\nusing a0 a1 a2 a3 \nproof (induct arbitrary: P s)\n case (CptnOne \\ c s1) thus ?case by fastforce \nnext\n case (CptnEnv \\ C st t xsa) \n thus ?case \n proof - \n have \"LanguageCon.com.Seq P Q = C\"\n using CptnEnv.prems(1) by auto\n then show ?thesis\n using CptnEnv.hyps(3) CptnEnv.prems(2) CptnEnv.prems(3) by fastforce\n qed\nnext\n case (CptnComp \\ C st C' st' xsa) \n then have c_seq:\"C = (Seq P Q) \\ st = s\" by force\n from CptnComp show ?case proof(cases)\n case (Seqc P1 P1' P2) \n then have \"\\c s' i. i < length ((C', st') # xsa) \\ \n ((C', st') # xsa) ! i = (LanguageCon.com.Seq c Q, s') \\ \n SmallStepCon.final (c, s')\"\n using CptnComp last.simps by fastforce\n thus ?thesis by fastforce \n next\n case (SeqThrowc C2 s') \n thus ?thesis \n proof -\n have \"LanguageCon.com.Seq LanguageCon.com.Throw Q = C\"\n using \\C = LanguageCon.com.Seq LanguageCon.com.Throw C2\\ c_seq by blast\n then show ?thesis\n using \\st = Normal s'\\ unfolding final_def by force\n qed\n next\n case (FaultPropc) thus ?thesis \n using c_seq redex_not_Seq by blast\n next\n case (StuckPropc) thus ?thesis \n using c_seq redex_not_Seq by blast\n next \n case (AbruptPropc) thus ?thesis\n using c_seq redex_not_Seq by blast \n qed (auto)\nqed\n\nlemma Seq_sound3: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Skip\" and\n a4:\"env_tran_right \\ x rely \" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely\" and\n a6: \"\\ \\\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n \"False\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: P s p) (* p) *)\n case (CptnModOne \\ C s1) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n thus ?case\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = LanguageCon.com.Skip\" using CptnModEnv(6)\n by (simp add: SmallStepCon.final_def) \n moreover have \"snd (((C, t1) # xsa) ! 0) \\ Normal ` p\" \n using CptnModEnv(8) CptnModEnv(1) CptnModEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) CptnModEnv(8) CptnModEnv(9) env_tran_tail\n by blast\n qed \nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModSeq1 \\ P0 sa xsa zs P1)\n obtain cl where \"fst (last ((LanguageCon.com.Seq P0 P1, sa) # zs)) = Seq cl P1\"\n using CptnModSeq1(3) by (metis One_nat_def fst_conv last.simps last_conv_nth last_lift map_is_Nil_conv)\n thus ?case using CptnModSeq1(6) by auto\nnext\n case (CptnModSeq2 \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n thus ?case using CptnModSeq2(8) zs by auto \nnext\n case (CptnModSeq3 \\ P1 sa xsa s' ys zs Q1 ) \n have s'_a:\"s' \\ a\" \n proof -\n have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\" \n using CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set unfolding cp_def by fastforce\n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely) F\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModSeq3.hyps(7) CptnModSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModSeq3(7) CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod.CptnModSeq1 \n unfolding cp_def by fastforce \n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely) F\" \n using assum_map map cpP1 by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpP1 CptnModSeq3(13) CptnModSeq3.prems(1) unfolding com_validity_def by auto\n thus ?thesis \n using CptnModSeq3(3) CptnModSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw\"\n proof -\n have cptn:\"(\\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn\" \n using CptnModSeq3(5) by (simp add: cptn_eq_cptn_mod_set)\n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw \\ \n snd (last ((LanguageCon.com.Throw, Normal s') # ys)) = Normal st'\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"(length ((Throw, Normal s') # ys))-1\" a rely]\n s'_a CptnModSeq3(11) CptnModSeq3(12) by fastforce \n thus ?thesis using CptnModSeq3(10) final_def by blast\n qed\n thus ?case using CptnModSeq3(10) CptnModSeq3(7)\n by force\nqed(auto)\n\nlemma map_xs_ys:\n assumes\n a0:\"(\\, (P0, sa) # xsa) \\ cptn_mod\" and \n a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n a2:\"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod\" and\n a3:\"zs = map (lift P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n a4:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Seq P Q, s)\" and\n a5:\"i < length ((LanguageCon.com.Seq P0 P1, sa) # zs) \\ ((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = (Q, sj)\" and\n a6:\"\\j Q\"\nshows \n \"\\xs ys. (\\, xs) \\ cp \\ P s \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i - 1))) \\ (LanguageCon.com.Seq P0 P1, sa) # zs = map (lift Q) xs @ ys\"\nproof -\n let ?P0 = \"(P0, sa) # xsa\"\n have P_Q:\"P=P0 \\ s=sa \\ Q = P1\" using a4 by force\n have i:\"i=(length ((P0, sa) # xsa))\" \n proof (cases \"i=(length ((P0, sa) # xsa))\")\n case True thus ?thesis by auto\n next\n case False \n then have i:\"i<(length ((P0, sa) # xsa)) \\ i > (length ((P0, sa) # xsa))\" by auto\n {\n assume i:\"i<(length ((P0, sa) # xsa))\"\n then have eq_map:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = map (lift P1) ((P0, sa) # xsa) ! i\" \n using a3 Cons_lift_append by (metis (no_types, lifting) length_map nth_append) \n then have \"\\ci si. map (lift P1) ((P0, sa) # xsa) ! i = (Seq ci P1,si)\" \n using i unfolding lift_def\n proof -\n have \"map (\\(c, y). (LanguageCon.com.Seq c P1, y)) ((P0, sa) # xsa) ! i = (case ((P0, sa) # xsa) ! i of (c, x) \\ (LanguageCon.com.Seq c P1, x))\"\n by (meson \\i < length ((P0, sa) # xsa)\\ nth_map)\n then show \"\\c x. map (\\(c, x). (LanguageCon.com.Seq c P1, x)) ((P0, sa) # xsa) ! i = (LanguageCon.com.Seq c P1, x)\"\n by (simp add: case_prod_beta)\n qed \n then have \"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i \\ (Q, sj)\" \n using P_Q eq_map by fastforce\n then have ?thesis using a5 by auto\n }note l=this\n {\n assume i:\"i>(length ((P0, sa) # xsa))\"\n have \"fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n using a3 P_Q Cons_lift_append by (metis fstI length_map nth_append_length) \n then have ?thesis using a6 i by auto\n }\n thus ?thesis using l i by auto\n qed\n then have \"(\\, (P0, sa) # xsa) \\ cp \\ P s\" \n using a0 cptn_eq_cptn_mod P_Q unfolding cp_def by fastforce\n also have \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cp \\ Q (snd (?P0 ! ((length ?P0) -1)))\" \n using a3 cptn_eq_cptn_mod P_Q unfolding cp_def\n proof -\n have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod\"\n using a2 P_Q by blast\n then have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\ (\\, ps) \\ cptn \\ f = \\}\"\n by (simp add: cptn_eq_cptn_mod last_length)\n then show \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\ (\\, ps) \\ cptn \\ f = \\}\"\n using P_Q by force\n qed \n ultimately show ?thesis using a3 P_Q i using Cons_lift_append by blast\nqed\n\nlemma Seq_sound4: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"i x!i=(Q,sj)\" and\n a3:\"\\jQ\" and \n a4:\"env_tran_right \\ x rely\" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely\" and\n a6: \"\\ \\\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n \"\\xs ys. (\\,xs) \\ (cp \\ P s) \\ (\\,ys) \\ (cp \\ Q (snd (xs!(i-1)))) \\ x = (map (lift Q) xs)@ys\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: i sj P s p) \n case (CptnModOne \\ C s1) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C st t xsa) \n have a1:\"Seq P Q \\ Q\" by simp \n then have C_seq:\"C=(Seq P Q)\" using CptnModEnv by fastforce\n then have \"fst(((C, st) # (C, t) # xsa)!0) \\Q\" using CptnEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!1) \\Q\" using CptnModEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnModEnv by auto\n ultimately have i_suc: \"i> (Suc 0)\" \n by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n then have i_minus:\"i'=i-1\" by auto\n have \"((C, t) # xsa) ! 0 = ((Seq P Q), t)\"\n using CptnModEnv by auto \n moreover have \"i'< length ((C,t)#xsa) \\ ((C,t)#xsa)!i' = (Q,sj)\"\n using i' CptnModEnv(5) by force\n moreover have \"\\j Q\"\n using i' CptnModEnv(6) by force\n moreover have \"snd (((C, t) # xsa) ! 0) \\ Normal ` p\" \n using CptnModEnv(8) CptnModEnv(1) CptnModEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately have hyp:\"\\xs ys.\n (\\, xs) \\ cp \\ P t \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift Q) xs @ ys\"\n using CptnModEnv(3) env_tran_tail CptnModEnv(8) CptnModEnv(9) CptnModEnv.prems(4) by blast \n then obtain xs ys where xs_cp:\"(\\, xs) \\ cp \\ P t \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift Q) xs @ ys\"\n by fast\n have \"(\\, (P,s)#xs) \\ cp \\ P s\"\n proof -\n have \"xs!0 = (P,t)\" \n using xs_cp unfolding cp_def by blast\n moreover have \"xs\\[]\"\n using cp_def cptn.simps xs_cp by blast \n ultimately obtain xs' where xs':\"(\\, (P,t)#xs') \\ cptn \\ xs=(P,t)#xs'\" \n using SmallStepCon.nth_tl xs_cp unfolding cp_def by force\n thus ?thesis using cp_def cptn.CptnEnv\n proof -\n have \"(LanguageCon.com.Seq P Q, s) = (C, st)\"\n using CptnModEnv.prems(1) by auto\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\"\n using Seq_env_P CptnModEnv(1) by blast\n then show ?thesis\n by (simp add:xs' cp_def cptn.CptnEnv)\n qed\n qed\n thus ?case \n using i_suc Cons_lift_append CptnModEnv.prems(1) i' i_minus xs_cp\n by fastforce \nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModSeq1 \\ P0 sa xsa zs P1) \n then have P1_Q:\"P1 = Q\" by auto\n let ?x = \"(LanguageCon.com.Seq P0 P1, sa) # zs\"\n have \"\\jc s. ?x!j = (Seq c P1,s)\" using CptnModSeq1(3)\n proof (induct xsa arbitrary: zs P0 P1 sa)\n case Nil thus ?case by auto\n next\n case (Cons a xsa) \n then obtain ac as where \"a=(ac,as)\" by fastforce\n then have zs:\"zs = (Seq ac P1,as)#(map (lift P1) xsa)\" \n using Cons(2) \n unfolding lift_def by auto\n have zs_eq:\"(map (lift P1) xsa)=(map (lift P1) xsa)\" by auto\n note hyp=Cons(1)[OF zs_eq] \n note hyp[of ac as]\n thus ?case using zs Cons(2) by (metis One_nat_def diff_Suc_Suc diff_zero length_Cons less_Suc_eq_0_disj nth_Cons') \n qed \n thus ?case using P1_Q CptnModSeq1(5) using fstI seq_not_eq2 by auto\nnext\n case (CptnModSeq2 \\ P0 sa xsa P1 ys zs) \n show ?case using map_xs_ys[OF CptnModSeq2(1) CptnModSeq2(3) CptnModSeq2(4) CptnModSeq2(6)\n CptnModSeq2(7) CptnModSeq2(8) CptnModSeq2(9)] by blast\nnext \n case (CptnModSeq3 \\ P1 sa xsa s' ys zs Q1 ) \n then have P_Q:\"P=P1 \\ Q = Q1\" by force\n thus ?case\n proof (cases \"Q1 = Throw\")\n case True thus ?thesis using map_xs_ys[of \\ P1 \"Normal sa\" xsa Throw Throw ys zs] \n CptnModSeq3 by fastforce\n next \n case False note q_not_throw=this\n have \"\\x. x< length ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) \\\n ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\"\n proof -\n {\n fix x\n assume x_less:\"x< length ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs)\"\n have \"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\"\n proof (cases \"x < length ((LanguageCon.com.Seq P1 Q1, Normal sa)#map (lift Q1) xsa)\")\n case True \n then have eq_map:\"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x = map (lift Q1) ((P1, Normal sa) # xsa) ! x\" \n by (metis (no_types) Cons_lift Cons_lift_append CptnModSeq3.hyps(7) True nth_append)\n then have \"\\ci si. map (lift Q1) ((P1, Normal sa) # xsa) ! x = (Seq ci Q1,si)\" \n using True unfolding lift_def\n proof -\n have \"x < length ((P1, Normal sa) # xsa)\"\n using True by auto\n then have \"map (\\(c, y). (LanguageCon.com.Seq c Q1, y)) ((P1, Normal sa) # xsa) ! x = (case ((P1, Normal sa) # xsa) ! x of (c, x) \\ (LanguageCon.com.Seq c Q1, x))\"\n using nth_map by blast\n then show \"\\c x1. map (\\(c, x1). (LanguageCon.com.Seq c Q1, x1)) ((P1, Normal sa) # xsa) ! x = (LanguageCon.com.Seq c Q1, x1)\"\n by (simp add: case_prod_beta')\n qed \n then have \"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\" \n using P_Q eq_map by fastforce \n thus ?thesis using CptnModSeq3(10) by auto \n next\n case False \n have s'_a:\"s' \\ a\" \n proof -\n have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\" \n using CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set unfolding cp_def by fastforce\n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely) F\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModSeq3.hyps(7) CptnModSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModSeq3(7) CptnModSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod.CptnModSeq1 \n unfolding cp_def by fastforce \n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely) F\" \n using assum_map map cpP1 by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpP1 CptnModSeq3(13) CptnModSeq3.prems(1) unfolding com_validity_def by auto\n thus ?thesis \n using CptnModSeq3(3) CptnModSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have all_throw:\"\\i, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn\" \n using CptnModSeq3(5) by (simp add: cptn_eq_cptn_mod_set)\n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModSeq3(11) CptnModSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately have \n \"fst (((LanguageCon.com.Throw, Normal s')# ys)!i) = Throw\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"i\" a rely]\n s'_a CptnModSeq3(12) i by fastforce\n } \n thus ?thesis using CptnModSeq3(10) final_def by blast \n qed \n then have \n \"\\x\\ length ((LanguageCon.com.Seq P1 Q1, Normal sa) # map (lift Q1) xsa). \n x\n fst (((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x) = Throw\" \n proof-\n {\n fix x \n assume a1:\"x\\ length ((LanguageCon.com.Seq P1 Q1, Normal sa) # map (lift Q1) xsa)\" and\n a2:\"x\\\\<^sub>c(Seq c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Seq_skip_c2:\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (c2,s)\"\n\n\nlemma seq_skip_throw:\n \"\\\\\\<^sub>c(Seq c1 c2,s) \\ (c2,s) \\ c1= Skip \\ (c1=Throw \\ (\\s2'. s=Normal s2'))\"\napply (rule stepc_elim_cases_Seq_skip_c2)\napply fastforce\napply (auto)+\napply (fastforce intro:redex_not_Seq)+\ndone\n\n\nlemma Seq_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\ \n Sta a R \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n a2:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and \n a3: \"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and \n a4: \"Sta a R \\ Sta p R\" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a1:\"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" \n using a1 com_cvalidity_def by fastforce \n then have a3: \"\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\"\n using a3 com_cvalidity_def all_call by fastforce \n have \"cp \\ (Seq c1 c2) s \\ assum(p, R) F \\ comm(G, (r,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (Seq c1 c2) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((Seq c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have \"c \\ comm(G, (r,a)) F\" \n proof - \n {\n assume l_f:\"snd (last l) \\ Fault ` F\" \n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\\\n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof (cases \"\\i c2\")\n case True \n then have no_c2:\"\\i c2\" by assumption\n show ?thesis\n proof (cases \"final (last l)\")\n case True\n then obtain s' where \"fst (last l) = Skip \\ (fst (last l) = Throw \\ snd (last l) = Normal s')\" \n using final_def by fast \n thus ?thesis\n proof\n assume \"fst (last l) = LanguageCon.com.Skip\" \n then have \"False\" \n using no_c2 env_tran_right cp cptn_eq_cptn_mod_set Seq_sound3 a4 a1 assum by blast\n thus ?thesis by auto\n next \n assume asm0:\"fst (last l) = LanguageCon.com.Throw \\ snd (last l) = Normal s'\"\n then obtain lc1 s1' ys where cp_lc1:\"(\\,lc1) \\ cp \\ c1 s \\ l = ((map (lift c2) lc1)@((Throw, Normal s1')#ys))\"\n using Seq_sound2[of \\ l c1 c2 s s'] cp cptn_eq_cptn_mod_set env_tran_right no_c2 by blast\n let ?m_lc1 = \"map (lift c2) lc1\"\n let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" \n have lc1_not_empty:\"lc1 \\ []\"\n using \\1 a10 cp_def cp_lc1 by force\n then have map_cp:\"(\\,?m_lc1) \\ cp \\ (Seq c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (\\, lc1) \\ cptn \\ \\ = \\\"\n using cp_lc1 cp_def by blast\n then have f2: \"(\\, ?m_lc1) \\ cptn\" using lc1_not_empty\n by (meson lift_is_cptn) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cp_def lift_def)\n qed\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R) F\"\n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 assum_map cp_lc1 by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,a)) F\" \n using a1 cp_lc1 by (meson IntI com_validity_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,a)) F\"\n using map_cp map_assum comm_map cp_lc1 by fastforce\n then have last_m_lc1:\"last (?m_lc1) = (Seq (fst (last lc1)) c2,snd (last lc1))\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n using Cons_lift by force\n then show ?thesis\n by (simp add: last_map a000 lc1_not_empty)\n qed\n then have last_length:\"last (?m_lc1) = ?last_m_lc1\" \n using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n using cp_lc1\n by (simp add:lc1_not_empty nth_append)\n then have lm_lc1:\"l!(?lm_lc1) = (Throw, Normal s1')\"\n using cp_lc1 by (meson nth_append_length) \n then have step:\"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\ (l!(?lm_lc1))\"\n proof -\n have \"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift c2) lc1)\"\n by (meson length_greater_0_conv)\n then have \"length (map (lift c2) lc1) - 1 + 1 < length (map (lift c2) lc1 @ (LanguageCon.com.Throw, Normal s1') # ys)\"\n by simp\n then show ?thesis\n using f2 f1 by (metis (no_types) One_nat_def cp cp_lc1 cptn_tran_ce_i diff_zero)\n qed\n moreover have \"\\\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>e (l!(?lm_lc1))\"\n using last_m_lc1 last_length l_map\n proof -\n have \"(LanguageCon.com.Seq (fst (last lc1)) c2, snd (last lc1)) = l ! (length (map (lift c2) lc1) - 1)\"\n using l_map last_m_lc1 local.last_length by presburger\n then show ?thesis\n by (metis (no_types) LanguageCon.com.distinct(71) \\l ! length (map (lift c2) lc1) = (LanguageCon.com.Throw, Normal s1')\\ env_c_c')\n qed\n ultimately show ?thesis using step_ce_elim_cases by blast \n qed\n then have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = snd (l!?lm_lc1) \\ fst (l!(?lm_lc1-1)) = Seq Throw c2\"\n using lm_lc1 stepc_elim_cases_Seq_throw\n by (metis One_nat_def asm0 append_is_Nil_conv cp_lc1 diff_Suc_less fst_conv l_map last_conv_nth last_m_lc1 length_greater_0_conv list.simps(3) local.last_length no_c2 snd_conv) \n then have a_normal:\"snd (l!?lm_lc1) \\ Normal ` (a)\" \n proof\n have last_lc1:\"fst (last lc1) = Throw \\ snd (last lc1) = Normal s1'\" \n using last_length l_map lm_lc1 last_m_lc1 last_lc1_suc\n by (metis LanguageCon.com.inject(3) fst_conv snd_conv) \n have \"final (last lc1)\" using last_lc1 final_def \n by blast\n moreover have \"snd (last lc1)\\ Fault ` F\" \n using last_lc1 by fastforce\n ultimately have \"(fst (last lc1) = Throw \\ \n snd (last lc1) \\ Normal ` (a))\" \n using lc1_comm last_lc1 unfolding comm_def by force\n thus ?thesis using l_map last_lc1_suc last_m_lc1 last_length by auto\n qed \n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n then have i_m_l:\"\\i []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (no_types) cp_lc1 nth_append)\n qed\n have last_not_F:\"snd (last ?m_lc1) \\ Fault ` F\" \n using l_map last_lc1_suc lm_lc1 last_length by auto \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< ?lm_lc1\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis\n by (metis (no_types) Suc_lessI True a21 i_m_l l_map zero_less_diff)\n qed \n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' m_lc1_comm True comm_dest1 l_f last_not_F by fastforce\n thus ?thesis using i_m_l using True by fastforce\n next\n case False \n then have \"(Suc k=?lm_lc1) \\ (Suc k>?lm_lc1)\" by auto\n thus ?thesis \n proof\n {assume suck:\"(Suc k=?lm_lc1)\"\n then have k:\"k=?lm_lc1-1\" by auto\n have G_s1':\"(Normal s1', Normal s1')\\G\" \n using a5 by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\" \n proof -\n have \"snd (l!Suc k) = Normal s1'\" \n using lm_lc1 suck by fastforce \n then show ?thesis using suck k G_s1' last_lc1_suc by fastforce\n qed\n }\n next\n { \n assume a001:\"Suc k>?lm_lc1\"\n have \"\\i. i\\(length lc1) \\ (Suc i < length l) \\ \n \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using lm_lc1 lc1_not_empty\n proof -\n have \"env_tran_right \\ l R\"\n by (metis env_tran_right)\n then show ?thesis \n using a_normal cp fst_conv length_map \n lm_lc1 only_one_component_tran_j[of \\ l ?lm_lc1 s1' a k R] snd_conv a21 a001 a00\n a4 by auto\n qed\n then have \"\\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using a00 a001 by auto \n then show ?thesis using a21 by fastforce \n }\n qed \n qed\n } thus ?thesis by auto \n qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\" \n proof -\n have l_t:\"fst (last l) = Throw\" \n using lm_lc1 by (simp add: asm0)\n have \"?lm_lc1 \\ length l -1\" using cp_lc1 by fastforce\n then have \"snd (l ! (length l - 1)) \\ Normal ` a\"\n using cp a_normal a4 fst_conv lm_lc1 snd_conv \n env_tran_right i_throw_all_throw[of \\ l ?lm_lc1 s1' \"(length l -1)\" _ R a ]\n by (metis (no_types, lifting) One_nat_def diff_is_0_eq diff_less diff_less_Suc diff_zero image_iff length_greater_0_conv lessI less_antisym list.size(3) xstate.inject(1)) \n thus ?thesis using l_t \n by (simp add: cp_lc1 last_conv_nth)\n qed\n note res = conjI [OF concl concr]\n then show ?thesis using \\1 c_prod unfolding comm_def by auto\n qed \n next\n case False\n then obtain lc1 where cp_lc1:\"(\\,lc1) \\ cp \\ c1 s \\ l = map (lift c2) lc1\" \n using Seq_sound1 assum False no_c2 env_tran_right cp cptn_eq_cptn_mod_set a4 a1 \n by blast \n then have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 a10 a11 assum_map by blast\n then have \"(\\, lc1)\\ comm(G, (q,a)) F\" using cp_lc1 a1\n by (meson IntI com_validity_def contra_subsetD)\n then have \"(\\, l)\\ comm(G, (r,a)) F\"\n using comm_map a10 \\1 cp_lc1 by fastforce\n then show ?thesis using l_f\n unfolding comm_def by auto\n qed\n next \n case False \n then obtain k where k_len:\"k fst (l ! k) = c2\"\n by blast \n then have \"\\m. (m < length l \\ fst (l ! m) = c2) \\\n (\\i (i < length l \\ fst (l ! i) = c2))\" \n using a0 exists_first_occ[of \"(\\i. i fst (l ! i) = c2)\" k] \n by blast\n then obtain i where a0:\"i fst (l !i) = c2 \\\n (\\j c2))\"\n by fastforce \n then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n then obtain lc1 lc2 where cp_lc1:\"(\\,lc1) \\ (cp \\ c1 s) \\ \n (\\,lc2) \\ (cp \\ c2 (snd (lc1!(i-1)))) \\ \n l = (map (lift c2) lc1)@lc2\"\n using Seq_sound4[of \\ l c1 c2 s] a0 cptn_eq_cptn_mod_set cp env_tran_right a4 a1 assum by blast \n have \"\\i < length l. snd (l!i) \\ Fault ` F\"\n using cp l_f last_not_F[of \\ l F] by blast \n then have i_not_fault:\"snd (l!i) \\ Fault ` F\" using a0 by blast\n have length_c1_map:\"length lc1 = length (map (lift c2) lc1)\" \n by fastforce \n then have i_map:\"i=length lc1\" \n using cp_lc1 li a0 unfolding lift_def\n proof -\n assume a1: \"(\\, lc1) \\ cp \\ c1 s \\ (\\, lc2) \\ cp \\ c2 (snd (lc1 ! (i - 1))) \\ l = map (\\(P, s). (LanguageCon.com.Seq P c2, s)) lc1 @ lc2\"\n have f2: \"i < length l \\ fst (l ! i) = c2 \\ (\\n. \\ n < i \\ fst (l ! n) \\ c2)\"\n using a0 by blast\n have f3: \"(LanguageCon.com.Seq (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift c2 (lc1 ! i)\"\n by (simp add: case_prod_unfold lift_def) \n then have \"fst (l ! length lc1) = c2\"\n using a1 by (simp add: cp_def nth_append)\n thus ?thesis\n using f3 f2 by (metis (no_types) nth_append cp_lc1 fst_conv length_map lift_nth linorder_neqE_nat seq_and_if_not_eq(4))\n qed \n have lc2_l:\"\\j []\"\n using cp cp_lc1 unfolding cp_def by fastforce \n have lc2_not_empty:\"lc2 \\ []\"\n using cp_def cp_lc1 cptn.simps by blast \n have l_is:\"s2= snd (last lc1)\"\n using cp_lc1 li a0 lc1_not_empty unfolding cp_def\n proof -\n assume a1: \"(\\, lc1) \\ {(\\1, l). l ! 0 = (c1, s) \\ (\\, l) \\ cptn \\ \\1 = \\} \\ (\\, lc2) \\ {(\\1, l). l ! 0 = (c2, snd (lc1 ! (i - 1))) \\ (\\, l) \\ cptn \\ \\1 = \\} \\ l = map (lift c2) lc1 @ lc2\"\n then have \"(map (lift c2) lc1 @ lc2) ! length (map (lift c2) lc1) = l ! i\"\n using i_map by force\n have f2: \"(c2, s2) = lc2 ! 0\"\n using li lc2_l lc2_not_empty by fastforce\n have \"op - i = op - (length lc1)\"\n using i_map by blast\n then show ?thesis\n using f2 a1 by (simp add: last_conv_nth lc1_not_empty)\n qed \n let ?m_lc1 = \"map (lift c2) lc1\"\n (* let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *) \n have last_m_lc1:\"l!(i-1) = (Seq (fst (last lc1)) c2,s2)\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n using Cons_lift by force\n then show ?thesis\n proof -\n have \"length (map (lift c2) lc1) = i\"\n using i_map by fastforce\n then show ?thesis\n by (metis (no_types) One_nat_def l_is a000 cp_lc1 diff_less last_conv_nth last_map lc1_not_empty length_c1_map length_greater_0_conv less_Suc0 nth_append)\n qed \n qed \n have last_mcl1_not_F:\"snd (last ?m_lc1) \\ Fault ` F\" \n proof -\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (full_types) One_nat_def i_not_fault l_is last_conv_nth last_snd lc1_not_empty li snd_conv)\n qed \n have map_cp:\"(\\,?m_lc1) \\ cp \\ (Seq c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (\\, lc1) \\ cptn \\ \\ = \\\"\n using cp_lc1 cp_def by blast\n then have f2: \"(\\, ?m_lc1) \\ cptn\" using lc1_not_empty\n by (meson lift_is_cptn) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cp_def lift_def)\n qed\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R) F\" \n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 assum_map using assum_map cp_lc1 by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,a)) F\" \n using a1 cp_lc1 by (meson IntI com_validity_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,a)) F\"\n using map_cp map_assum comm_map cp_lc1 by fastforce \n then have i_step:\"\\\\\\<^sub>c(l!(i-1)) \\ (l!i)\"\n proof -\n have \"\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>c\\<^sub>e (l!(i))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift c2) lc1)\"\n by (meson length_greater_0_conv) \n then have \"length (map (lift c2) lc1) - 1 + 1 < length (map (lift c2) lc1 @ lc2)\"\n using f2 lc2_not_empty by simp\n then show ?thesis\n using f2 f1\n proof -\n have \"0 < i\"\n using f2 i_map by blast\n then show ?thesis\n by (metis (no_types) One_nat_def Suc_diff_1 a0 add.right_neutral add_Suc_right cp cptn_tran_ce_i)\n qed \n qed \n moreover have \"\\\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>e (l!i)\" \n using li last_m_lc1\n by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(4))\n ultimately show ?thesis using step_ce_elim_cases by blast\n qed \n then have step:\"\\\\\\<^sub>c(Seq (fst (last lc1)) c2,s2) \\ (c2, s2)\"\n using last_m_lc1 li by fastforce\n then obtain s2' where \n last_lc1:\"fst (last lc1) = Skip \\ \n fst (last lc1) = Throw \\ (s2 = Normal s2')\" \n using seq_skip_throw by blast \n have final:\"final (last lc1)\" \n using last_lc1 l_is unfolding final_def by auto\n(* look here for the property *******************************************************************************)\n have normal_last:\"fst (last lc1) = Skip \\ snd (last lc1) \\ Normal ` q \\\n fst (last lc1) = Throw \\ snd (last lc1) \\ Normal ` (a)\" \n proof - \n have \"snd (last lc1) \\ Fault ` F\"\n using i_not_fault l_is li by auto\n then show ?thesis\n using final comm_dest2 lc1_comm by blast\n qed\n obtain s2' where lastlc1_normal:\"snd (last lc1) = Normal s2'\" \n using normal_last by blast\n then have Normals2:\"s2 = Normal s2'\" by (simp add: l_is ) \n have Gs2':\"(Normal s2', Normal s2')\\G\" using a5 by auto \n have concl:\n \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k \n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have i_m_l:\"\\j []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis \n using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append) \n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< i\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis using True a21 i_m_l by force \n qed \n have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' last_mcl1_not_F m_lc1_comm True i_map length_c1_map \n comm_dest1[of \\]\n by blast\n thus ?thesis using i_m_l using True by fastforce \n next\n case False \n have \"(Suc k=i) \\ (Suc k>i)\" using False by auto\n thus ?thesis \n proof\n { assume suck:\"(Suc k=i)\" \n then have k:\"k=i-1\" by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\" \n proof -\n have \"snd (l!Suc k) = Normal s2'\" \n using Normals2 suck li by auto \n moreover have \"snd (l ! k) = Normal s2'\" \n using Normals2 k last_m_lc1 by fastforce \n moreover have \"\\p. p \\ G \"\n by (meson case_prod_conv mem_Collect_eq Gs2')\n ultimately show ?thesis using suck k Normals2\n using Gs2' by force \n qed\n }\n next\n { \n assume a001:\"Suc k>i\"\n then have k:\"k\\i\" by fastforce\n then obtain k' where k':\"k=i+k'\" \n using add.commute le_Suc_ex by blast\n {assume throw:\"c2=Throw \\ fst (last lc1) = Throw\"\n then have s2_in:\"s2' \\ a\" \n using Normals2 i_map normal_last li lastlc1_normal \n using image_iff snd_conv xstate.inject(1) by auto\n \n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a21 a001 a00 a4\n a0 throw env_tran_right only_one_component_tran_j snd_conv \n by (metis cp env_tran_right)\n then have ?thesis using a21 a001 k a00 by blast \n } note left=this\n {assume \"\\(c2=Throw \\ fst (last lc1) = Throw)\"\n then have \"fst (last lc1) = Skip\"\n using last_m_lc1 last_lc1\n by (metis step a0 l_is li prod.collapse stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(5)) \n then have s2_normal:\"s2 \\ Normal ` q\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (q,R) F\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` q\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\"\n \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cp \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (r,a)) F\"\n using a3 unfolding com_validity_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce\n have suck':\"Suc k' < length lc2\" \n using k' a00 length_lc2 by arith\n moreover then have \"\\\\\\<^sub>c(lc2!k') \\ (lc2!(Suc k'))\" \n using k' lc2_l a21 by fastforce\n ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\ G\"\n using comm_lc2 lc2_last_f comm_dest1[of \\ lc2 G r a F k'] \n by blast\n then have ?thesis using suck' lc2_l k' by fastforce\n } \n then show ?thesis using left by auto \n }\n qed \n qed\n } thus ?thesis by auto \n qed note left=this\n have right:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof -\n { assume final_l:\"final (last l)\" \n have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n then have final_lc2:\"final (last lc2)\" using final_l by auto\n {\n assume lst_lc1_throw:\"fst (last lc1) = Throw\" \n then have c2_throw:\"c2 = Throw\" \n using lst_lc1_throw step lastlc1_normal stepc_elim_cases_Seq_skip_c2\n by fastforce \n have s2_a:\"s2 \\ Normal ` (a)\"\n using normal_last \n by (simp add: lst_lc1_throw l_is)\n have all_ev:\"\\ki \\ (Suc k < length l) \\ \n \\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))\"\n proof -\n have s2_in:\"s2' \\ a\" \n using Normals2 i_map normal_last li lastlc1_normal \n using image_iff snd_conv xstate.inject(1) lst_lc1_throw by auto\n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a4\n a0 c2_throw env_tran_right only_one_component_tran_j snd_conv \n by (metis cp env_tran_right) \n thus ?thesis by (metis Suc_eq_plus1 cp cptn_tran_ce_i step_ce_elim_cases) \n qed \n then have Throw:\"fst (l!(length l - 1)) = Throw\"\n using cp c2_throw a0 cptn_i_env_same_prog[of \\ l \"((length l)-1)\" i] \n by fastforce \n then have \"snd (l!(length l - 1)) \\ Normal ` (a) \\ fst (l!(length l - 1)) = Throw\"\n using all_ev a0 s2_a li a4 env_tran_right stability[of a R l i \"(length l) -1\" _ \\] Throw \n by (metis One_nat_def Suc_pred length_greater_0_conv \n lessI linorder_not_less list.size(3) \n not_less0 not_less_eq_eq snd_conv) \n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using a0 by (metis last_conv_nth list.size(3) not_less0) \n } note left = this\n { assume \"fst (last lc1) = Skip\" \n then have s2_normal:\"s2 \\ Normal ` q\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (q,R) F\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` q\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\" \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cp \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (r,a)) F\"\n using a3 unfolding com_validity_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce \n then have \"((fst (last lc2) = Skip \\ \n snd (last lc2) \\ Normal ` r)) \\\n (fst (last lc2) = Throw \\ \n snd (last lc2) \\ Normal ` a)\" \n using final_lc2 comm_lc2 unfolding comm_def by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\" \n using eq_last_lc2_l by auto\n }\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\" \n using left using last_lc1 by auto\n } thus ?thesis by auto qed \n thus ?thesis using left l_f \\1 unfolding comm_def by force \n qed \n } thus ?thesis using \\1 unfolding comm_def by auto qed\n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\nlemma Catch_env_P:assumes a0:\"\\\\\\<^sub>c(Catch P Q,s) \\\\<^sub>e (Catch P Q,t)\"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t)\"\nusing a0\nby (metis env_not_normal_s snormal_enviroment)\n\nlemma map_catch_eq_state:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Catch c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\\\<^sub>e l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod \n by (simp add: lift_catch_def) \n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\\\<^sub>e (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (metis Env_n env_c_c' env_not_normal_s step_e.Env)\n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod\n by (simp add: lift_catch_def)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\\\<^sub>e (l2 ! Suc i)\" \n using a4 l1prod l2prod \n by (metis Env_n LanguageCon.com.inject(9) env_c_c' env_not_normal_s step_e.Env) \n }\n qed\n } \n thus ?thesis by auto\nqed\n\n\nlemma same_comp_catch_c:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Catch c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\ l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_catch_c l1prod\n by (simp add: lift_catch_def)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\ (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (simp add: Catchc) \n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\ l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod\n by (simp add: lift_catch_def) \n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\ (l2 ! Suc i)\" \n using a4 l1prod l2prod stepc_elim_cases_Catch_Catch Catch_not_c\n by (metis (no_types))\n }\n qed\n } \n thus ?thesis by auto\nqed\n\nlemma assum_map_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s) \\ ((\\,l1) \\ assum(p, R) F)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"((\\,l2) \\ assum(p, R) F)\"\nproof -\n have a3: \"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \n using a0 a1 a2 same_env_catch_c by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n obtain s' where normal_s:\"s = Normal s'\" \n using a0 unfolding cp_def assum_def by fastforce\n then have p1:\"s'\\p\" using a0 unfolding cp_def assum_def by fastforce \n show ?thesis \n proof - \n let ?c= \"(\\,l2)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` (p)\"\n using p1 drop_k_s a1 normal_s unfolding cp_def by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R\"\n using a0 a1 a2 a3 map_catch_eq_state unfolding assum_def \n using a00 a11 eq_length by fastforce\n } thus \"(\\, l2) \\ assum (p, R) F\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma comm_map'_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\(Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (fst (last l1) = (Catch c c2) \\ final (c, snd (last l1)) \\ \n (fst (last l1) = (Catch Skip c2) \\ \n (snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Catch Throw c2) \\ \n snd (last l1) \\ Normal ` (a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_catch_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n have len0:\"length l2>0\" using a1 unfolding cp_def \n using cptn.simps by fastforce \n then have len0:\"length l1>0\" using eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_catch_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed\n then have \"snd (last l1) \\ Fault ` F \\\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis Suc_lessD a0 a1 a2 map_catch_eq_state)\n } note l=this\n {\n assume a00: \"fst (last l1) = (Catch c c2) \\ final (c, snd (last l1))\" and\n a01:\"snd (last (l1)) \\ Fault ` F\"\n then have c:\"c=Skip \\ c = Throw\"\n unfolding final_def by auto \n then have fst_last_l2:\"fst (last l2) = c\" \n using last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift_catch \n by fastforce \n also have last_eq:\"snd (last l2) = snd (last l1)\" \n using l2_not_empty a2 last_conv_nth last_lenl1 last_snd_catch\n by fastforce\n ultimately have \"final (fst (last l2),snd (last l2))\" \n using a00 by auto\n then have \"final (last l2)\" by auto\n also have \"snd (last (l2)) \\ Fault ` F\"\n using last_eq a01 by auto\n ultimately have \"(fst (last l2)) = Skip \\ \n snd (last l2) \\ Normal ` q \\\n (fst (last l2) = Throw \\ \n snd (last l2) \\ Normal ` (a))\"\n using a03 by auto\n then have \"(fst (last l1) = (Catch Skip c2) \\ \n snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Catch Throw c2) \\ \n snd (last l1) \\ Normal ` (a))\"\n using last_eq fst_last_l2 a00 by force\n }\n thus ?thesis using l by auto qed\nqed\n\nlemma comm_map''_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\ ((Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (final (last l1) \\ \n (fst (last l1) = Skip \\ \n (snd (last l1) \\ Normal ` r) \\\n (fst (last l1) = Throw \\ \n snd (last l1) \\ Normal ` a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_catch_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n have len0:\"length l2>0\" using a1 unfolding cp_def \n using cptn.simps by fastforce \n then have len0:\"length l1>0\" using eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce \n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_catch_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed \n then have \"\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift_catch)\n } note l= this\n {\n assume a00: \"final (last l1)\" \n then have c:\"fst (last l1)=Skip \\ fst (last l1) = Throw\"\n unfolding final_def by auto \n moreover have \"fst (last l1) = Catch (fst (last l2)) c2\" \n using a2 last_lenl1 eq_length\n proof -\n have \"last l2 = l2 ! (length l2 - 1)\"\n using l2_not_empty last_conv_nth by blast\n then show ?thesis\n by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift_catch)\n qed\n ultimately have False by simp \n } thus ?thesis using l by auto qed\nqed\n\nlemma comm_map_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"(\\, l1)\\ comm(G, (r,a)) F\"\nproof - \n {fix i ns ns'\n have \"snd (last l1) \\ Fault ` F \\(Suc i < length (l1) \\\n \\\\\\<^sub>c (l1 ! i) \\ (l1 ! (Suc i)) \\ \n (snd (l1 ! i), snd (l1 ! Suc i)) \\ G) \\\n (SmallStepCon.final (last l1) \\ \n fst (last l1) = LanguageCon.com.Skip \\\n snd (last l1) \\ Normal ` r \\\n fst (last l1) = LanguageCon.com.Throw \\\n snd (last l1) \\ Normal ` a) \"\n using comm_map''_catch[of \\ l1 c1 c2 s l2 G q a F i r] a0 a1 a2 \n by fastforce\n } then show ?thesis using comm_def unfolding comm_def by force \nqed\n\nlemma Catch_sound1: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"\\ final (last x)\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs. (\\,xs) \\ cp \\ P s \\ x = map (lift_catch Q) xs\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnModOne \\ C s1)\n then have \"(\\, [(P,s)]) \\ cp \\ P s \\ [(C, s1)] = map (lift_catch Q) [(P,s)]\"\n unfolding cp_def lift_catch_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n have \"\\xs. (\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (Catch P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"\\ SmallStepCon.final (last ((C, t1) # xsa))\" using CptnModEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) env_tran_tail by blast \n qed \n then obtain xs where hi:\"(\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModEnv unfolding cp_def by auto\n obtain xsa' where xs:\"xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')\" \n using hi unfolding cp_def by fastforce\n \n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModEnv Catch_env_P by (metis fst_conv nth_Cons_0) \n then have \"(\\,(P,s1)#(P,t1)#xsa')\\cptn\" using xs env_tran CptnEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cp \\ P s\" \n using cp_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')\"\n using xs C unfolding lift_catch_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModCatch1 \\ P0 sa xsa zs P1)\n then have a1:\"LanguageCon.com.Catch P Q = LanguageCon.com.Catch P0 P1\"\n by fastforce \n have f1: \"sa = s\"\n using CptnModCatch1.prems(1) by force\n have f2: \"P = P0 \\ Q = P1\" using a1 by auto\n have \"(\\, (P0, sa) # xsa) \\ cptn\"\n by (metis CptnModCatch1.hyps(1) cptn_eq_cptn_mod_set)\n hence \"(\\, (P0, sa) # xsa) \\ cp \\ P s\"\n using f2 f1 by (simp add: cp_def)\n thus ?case\n using Cons_lift_catch CptnModCatch1.hyps(3) a1 by blast \nnext\n case (CptnModCatch2 \\ P1 sa xsa ys zs Q1)\n have \"final (last ((Skip, sa)# ys))\"\n proof -\n have cptn:\"(\\, (Skip,snd (last ((P1, sa) # xsa))) # ys) \\ cptn\" \n using CptnModCatch2(4) by (simp add: cptn_eq_cptn_mod_set)\n moreover have throw_0:\"((Skip,snd (last ((P1, sa) # xsa))) # ys)!0 = (Skip, snd (last ((P1, sa) # xsa))) \\ 0 < length((Skip, snd (last ((P1, sa) # xsa))) # ys)\"\n by force \n moreover have last:\"last ((Skip,snd (last ((P1, sa) # xsa))) # ys) = \n ((Skip,snd (last ((P1, sa) # xsa))) # ys)!((length ((Skip,snd (last ((P1, sa) # xsa))) # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((Skip,snd (last ((P1, sa) # xsa))) # ys) rely\" \n using CptnModCatch2.hyps(6) CptnModCatch2.prems(4) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((Skip,snd (last ((P1, sa) # xsa))) # ys)) = Skip \\ \n snd (last ((Skip,snd (last ((P1, sa) # xsa))) # ys)) = Normal st'\" \n using CptnModCatch2 zero_skip_all_skip[of \\ \"((Skip,snd (last ((P1, sa) # xsa))) # ys)\" \"(length ((Skip,snd (last ((P1, sa) # xsa))) # ys))-1\"]\n proof -\n have False\n by (metis (no_types) One_nat_def SmallStepCon.final_def \\(\\, (LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) \\ cptn \\ fst (((LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) ! 0) = LanguageCon.com.Skip \\ length ((LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) - 1 < length ((LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) \\ fst (((LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) ! (length ((LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys) - 1)) = LanguageCon.com.Skip\\ \\\\ SmallStepCon.final (last ((LanguageCon.com.Catch P1 Q1, sa) # zs))\\ \\zs = map (lift_catch Q1) xsa @ (LanguageCon.com.Skip, snd (last ((P1, sa) # xsa))) # ys\\ append_is_Nil_conv cptn diff_Suc_Suc diff_zero fst_conv last last.simps last_appendR length_Cons lessI list.simps(3) throw_0)\n then show ?thesis\n by metis\n qed\n thus ?thesis using final_def by (metis fst_conv last.simps) \n qed\n thus ?case \n by (metis (no_types, lifting) CptnModCatch2.hyps(3) CptnModCatch2.hyps(6) CptnModCatch2.prems(3) SmallStepCon.final_def append_is_Nil_conv last.simps last_appendR list.simps(3) prod.collapse) \nnext\n case (CptnModCatch3 \\ P0 sa xsa sa' P1 ys zs)\n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" \n using CptnModCatch3\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Catch P0 P1,Normal sa)#zs)\" by fastforce\n then have \"fst (((Catch P0 P1, Normal sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModCatch3(9) zs by auto\nqed (auto)\n\nlemma Catch_sound2: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst (last x) = Skip\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs ys. (\\,xs) \\ cp \\ P s \\ x = ((map (lift_catch Q) xs)@((Skip,snd(last xs))#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnModOne \\ C s1)\n then have \"(\\, [(P,s)]) \\ cp \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]@[(Throw, Normal s')]\"\n unfolding cp_def lift_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n have \"\\xs ys. (\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = \n map (lift_catch Q) xs@((Skip, snd(last xs))#ys)\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Catch P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = Skip\" using CptnModEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) env_tran_tail by blast \n qed \n then obtain xs ys where hi:\"(\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs@((Skip,snd(last ((P, t1)#xs)))#ys)\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModEnv unfolding cp_def by auto\n have \"\\xsa' ys. xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')@((Skip, snd(last xs))#ys)\" \n using hi unfolding cp_def\n proof -\n have \"(\\,xs)\\cptn \\ xs!0 = (P,t1)\" using hi unfolding cp_def by fastforce\n moreover then have \"xs\\[]\" using cptn.simps by fastforce \n ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n thus ?thesis\n using hi using \\(\\, xs) \\ cptn \\ xs ! 0 = (P, t1)\\ by auto \n qed\n then obtain xsa' ys where xs:\"xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = \n map (lift_catch Q) ((P,t1)#xsa')@((Skip,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n by fastforce\n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModEnv Catch_env_P by (metis fst_conv nth_Cons_0) \n then have \"(\\,(P,s1)#(P,t1)#xsa')\\cptn\" using xs env_tran CptnEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cp \\ P s\" \n using cp_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')@((Skip,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n using xs C unfolding lift_catch_def\n by auto\n ultimately show ?case by fastforce \nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModCatch1 \\ P0 sa xsa zs P1) \n thus ?case\n proof -\n have \"\\c x. (LanguageCon.com.Catch c P1, x) # zs = map (lift_catch P1) ((c, x) # xsa)\"\n using Cons_lift_catch CptnModCatch1.hyps(3) by blast\n then have \"(P0, sa) # xsa = []\"\n by (metis (no_types) CptnModCatch1.prems(3) LanguageCon.com.distinct(19) One_nat_def last_conv_nth last_lift_catch map_is_Nil_conv)\n then show ?thesis\n by force\n qed \nnext\n case (CptnModCatch2 \\ P1 sa xsa ys zs Q1) \n then have \"P1 = P \\ Q1 = Q \\ sa = s\" by auto \n moreover then have \"(\\, (P1,sa) # xsa)\\ cp \\ P s\" \n using CptnModCatch2(1)\n by (simp add: cp_def cptn_eq_cptn_mod_set) \n moreover obtain s' where \"last zs=(Skip, s')\" \n proof -\n assume a1: \"\\s'. last zs = (LanguageCon.com.Skip, s') \\ thesis\"\n have \"\\x. last zs = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) CptnModCatch2.hyps(6) CptnModCatch2.prems(3) append_is_Nil_conv last_ConsR list.simps(3) prod.exhaust_sel)\n then show ?thesis\n using a1 by metis\n qed \n ultimately show ?case \n using Cons_lift_catch_append CptnModCatch2.hyps(6) by fastforce \nnext \n case (CptnModCatch3 \\ P0 sa xsa sa' P1 ys zs) \n then have \"P0 = P \\ P1 = Q \\ s=Normal sa\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" \n using CptnModCatch3 \n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have si:\"Suc i< length ((Catch P0 P1,Normal sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, Normal sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModCatch3(9) zs\n by (metis si nth_Cons_Suc)\nqed (auto)\n\nlemma Catch_sound3: \nassumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Throw\" and\n a4:\"env_tran_right \\ x rely \"\nshows\n \"False\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnOne \\ C s1) thus ?case by auto\nnext\n case (CptnEnv \\ C st t xsa) \n thus ?case\n proof -\n have f1: \"env_tran_right \\ ((C, t) # xsa) rely\"\n using CptnEnv.prems(4) env_tran_tail by blast\n have \"LanguageCon.com.Catch P Q = C\"\n using CptnEnv.prems(1) by auto\n then show ?thesis\n using f1 CptnEnv.hyps(3) CptnEnv.prems(2) CptnEnv.prems(3) by moura\n qed\nnext \n case (CptnComp \\ C st C' st' xsa)\n then have c_catch:\"C = (Catch P Q) \\ st = s\" by force\n from CptnComp show ?case proof(cases)\n case (Catchc P1 P1' P2) thus ?thesis\n proof -\n have f1: \"env_tran_right \\ ((C', st') # xsa) rely\"\n using CptnComp.prems(4) env_tran_tail by blast\n have \"Q = P2\"\n using c_catch Catchc(1) by blast\n then show ?thesis\n using f1 CptnComp.hyps(3) CptnComp.prems(2) CptnComp.prems(3) Catchc(2) by moura\n qed\n next\n case (CatchSkipc) thus ?thesis\n proof -\n have \"fst (((C', st') # xsa) ! 0) = LanguageCon.com.Skip\"\n by (simp add: local.CatchSkipc(2))\n then show ?thesis\n by (metis (no_types) CptnComp.hyps(2) CptnComp.prems(3) LanguageCon.com.distinct(17) \n last_ConsR last_length length_Cons lessI list.simps(3) zero_skip_all_skip)\n qed \n next\n case (SeqThrowc C2 s') thus ?thesis\n by (simp add: c_catch) \n next\n case (FaultPropc) thus ?thesis \n using c_catch redex_not_Catch by blast \n next\n case (StuckPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n next\n case (AbruptPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n qed (auto)\nqed\n\n\nlemma Catch_sound4: \nassumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"i x!i=(Q,sj)\" and\n a3:\"\\jQ\" and \n a4:\"env_tran_right \\ x rely \"\nshows\n \"\\xs ys. (\\,xs) \\ (cp \\ P s) \\ (\\,ys) \\ (cp \\ Q (snd (xs!(i-1)))) \\ x = (map (lift_catch Q) xs)@ys\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: i sj P s) \n case (CptnOne \\1 P1 s1) \n thus ?case by auto \nnext\n case (CptnEnv \\ C st t xsa) \n have a1:\"Catch P Q \\ Q\" by simp \n then have C_catch:\"C=(Catch P Q)\" using CptnEnv by fastforce\n then have \"fst(((C, st) # (C, t) # xsa)!0) \\Q\" using CptnEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!1) \\Q\" using CptnEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnEnv by auto\n ultimately have i_suc: \"i> (Suc 0)\" using CptnEnv \n by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n then have i_minus:\"i'=i-1\" by auto \n have \"((C, t) # xsa) ! 0 = ((Catch P Q), t)\"\n using CptnEnv by auto \n moreover have \"i'< length ((C,t)#xsa) \\ ((C,t)#xsa)!i' = (Q,sj)\"\n using i' CptnEnv(5) by force\n moreover have \"\\j Q\"\n using i' CptnEnv(6) by force\n ultimately have hyp:\"\\xs ys.\n (\\, xs) \\ cp \\ P t \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n using CptnEnv(3) env_tran_tail CptnEnv.prems(4) by blast \n then obtain xs ys where xs_cp:\"(\\, xs) \\ cp \\ P t \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n by fast\n have \"(\\, (P, s)#xs) \\ cp \\ P s\"\n proof -\n have \"xs!0 = (P,t)\" \n using xs_cp unfolding cp_def by blast\n moreover have \"xs\\[]\"\n using cp_def cptn.simps xs_cp by blast \n ultimately obtain xs' where xs':\"(\\, (P,t)#xs') \\ cptn \\ xs=(P,t)#xs'\" \n using SmallStepCon.nth_tl xs_cp unfolding cp_def by force\n thus ?thesis using cp_def cptn.CptnEnv\n proof -\n have \"(Catch P Q, s) = (C, st)\"\n using CptnEnv.prems(1) by auto\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\"\n using Catch_env_P CptnEnv(1) by blast\n then show ?thesis\n by (simp add:xs' cp_def cptn.CptnEnv)\n qed\n qed\n thus ?case \n using i_suc Cons_lift_catch_append CptnEnv.prems(1) i' i_minus xs_cp\n by fastforce \nnext\n case (CptnComp \\ C st C' st' xsa i)\n then have c_catch:\"C = (Catch P Q) \\ st = s\" by fastforce \n from CptnComp show ?case proof(cases)\n case (Catchc P1 P1' P2) \n then have C_seq:\"C=(Catch P Q)\" using CptnEnv CptnComp by fastforce \n then have \"fst(((C, st) # (C', st') # xsa)!0) \\Q\" \n using CptnComp by auto\n moreover have \"fst(((C, st) # (C', st') # xsa)!1) \\Q\" \n using CptnComp Catchc by auto\n moreover have \"fst(((C, st) # (C', st') # xsa)!i) =Q\" \n using CptnComp by auto\n ultimately have i_gt0:\"i> (Suc 0)\" \n by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n then have i_minus:\"i'=i-1\" by auto \n have \"((C', st') # xsa) ! 0 = ((Catch P1' Q), st')\"\n using CptnComp Catchc by auto \n moreover have \"i'< length ((C',st')#xsa) \\ ((C',st')#xsa)!i' = (Q,sj)\"\n using i' CptnComp(5) by force\n moreover have \"\\j Q\"\n using i' CptnComp(6) by force \n ultimately have \"\\xs ys.\n (\\, xs) \\ cp \\ P1' st' \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C', st') # xsa = map (lift_catch Q) xs @ ys\"\n using CptnComp Catchc env_tran_tail CptnComp.prems(4) by blast\n then obtain xs ys where xs_cp:\n \"(\\, xs) \\ cp \\ P1' st' \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i'-1))) \\ (C', st') # xsa = map (lift_catch Q) xs @ ys\"\n by fastforce\n have \"(\\, (P,s)#xs) \\ cp \\ P s\" \n proof -\n have \"xs!0 = (P1',st')\" \n using xs_cp unfolding cp_def by blast\n moreover have \"xs\\[]\"\n using cp_def cptn.simps xs_cp by blast \n ultimately obtain xs' where xs':\"(\\, (P1',st')#xs') \\ cptn \\ xs=(P1',st')#xs'\" \n using SmallStepCon.nth_tl xs_cp unfolding cp_def by force\n thus ?thesis using cp_def cptn.CptnEnv Catchc c_catch\n xs' cp_def cptn.CptnComp \n by (simp add: cp_def cptn.CptnComp xs') \n qed \n thus ?thesis using Cons_lift_catch c_catch i' xs_cp i_gt0 by fastforce\n next\n case (CatchSkipc) \n with CptnComp have PC:\"P=Skip \\ C'=Skip \\ st=st' \\ s=st\" by fastforce \n then have all_skip:\"\\j\\0. j< (length ((C',st')#xsa)) \\ fst(((C',st')#xsa)!j) = Skip\" \n by (metis (no_types) CptnComp.hyps(2) PC fst_conv i_skip_all_skip nth_Cons_0)\n then have Q_skip:\"Q=Skip\" \n proof - \n have \"Catch Skip Q\\Q\" by auto\n then show \"Q=Skip\" \n using all_skip CptnComp(4,5,6) PC less_Suc_eq_0_disj \n by auto\n qed\n then have \"(\\, [(Skip,st)]) \\ cp \\ P s\" unfolding cp_def using cptn.simps PC\n by fastforce \n moreover have \"(\\, (Q,st')#xsa) \\ cp \\ Q st'\" \n unfolding cp_def\n using CptnComp PC Q_skip by fastforce\n moreover have \"i=1\"\n proof -\n have f1: \"fst (((C, st) # (C', st') # xsa) ! 0) \\ Q\"\n using CptnComp.prems(1) by force \n have \"fst (((C, st) # (C', st') # xsa) ! Suc 0) = LanguageCon.com.Skip\"\n using PC by force\n then have f3: \"\\ Suc 0 < i\"\n using CptnComp.prems(3) Q_skip by blast\n have \"((C, st) # (C', st') # xsa) ! i \\ (C, st)\"\n using f1 CptnComp.prems(2) by force\n then have \"0 \\ i\"\n by force\n then show ?thesis\n using f3 by auto\n qed \n moreover have \"[(Catch Skip Q, st)] = map (lift_catch Q) [(Skip,st)]\" \n unfolding lift_catch_def by auto\n ultimately show ?thesis using PC CatchSkipc\n using CptnComp.prems(2) PC c_catch by force \n next\n case (CatchThrowc s')\n with CptnComp have PC:\"P=Throw \\ C'=Q \\ st=st' \\ st=s\" by fastforce \n then have \"(\\, [(Throw, Normal s')]) \\ cp \\ P s\"\n using PC cptn.simps unfolding cp_def \n using cptn.CptnOne local.CatchThrowc(3) by force\n moreover have \"(\\, (C', st') # xsa)\\cp \\ Q st' \"\n using PC CptnComp unfolding cp_def by fastforce\n moreover have \"i=1\" using CptnComp (4-6) PC \n proof -\n have \"fst (((C, st) # (C', st') # xsa) ! Suc 0) = Q\"\n using PC by force\n then have \"\\ Suc 0 < i\"\n using local.CptnComp(6) by blast \n have \"(LanguageCon.com.Throw, sj) \\ (LanguageCon.com.Seq P Q, s)\"\n by blast\n then have \"i \\ 0\"\n using c_catch local.CptnComp(5) by force\n then have \"Suc 0 = i\"\n using \\\\ Suc 0 < i\\ by linarith\n then show ?thesis by auto \n qed \n moreover have \"[(Catch Throw Q, st)] = map (lift_catch Q) [(Throw,st)]\" \n unfolding lift_catch_def by auto\n ultimately show ?thesis using PC CatchThrowc by fastforce \n next\n case (FaultPropc) thus ?thesis \n using c_catch redex_not_Catch by blast \n next\n case (StuckPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n next\n case (AbruptPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n qed(auto)\nqed\n\ninductive_cases stepc_elim_cases_Catch_throw:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Catch_skip_c2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s)\"\n\ninductive_cases stepc_elim_cases_Catch_skip_2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Skip, s)\"\n\nlemma catch_skip_throw:\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s) \\ (c2= Skip \\ c1=Skip) \\ (c1=Throw \\ (\\s2'. s=Normal s2'))\"\napply (rule stepc_elim_cases_Catch_skip_c2)\napply fastforce\napply (auto)+\nusing redex_not_Catch apply auto\ndone\n\nlemma catch_skip_throw1:\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Skip,s) \\ (c1=Skip) \\ (c1=Throw \\ (\\s2'. s=Normal s2') \\ c2 = Skip)\"\napply (rule stepc_elim_cases_Catch_skip_2)\nusing redex_not_Catch apply auto\nusing redex_not_Catch by auto\n\nlemma Catch_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a] \\ \n Sta q R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n a2:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and \n a3: \"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and \n a4: \"Sta q R \" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a1:\"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" \n using a1 com_cvalidity_def by fastforce \n then have a3: \"\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\"\n using a3 com_cvalidity_def all_call by fastforce \n have \"cp \\ (Catch c1 c2) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (Catch c1 c2) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((Catch c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {\n assume l_f:\"snd (last l) \\ Fault ` F\" \n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\\\n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof (cases \"\\i c2\")\n case True \n then have no_c2:\"\\i c2\" by assumption\n show ?thesis\n proof (cases \"final (last l)\")\n case True\n then obtain s' where \"fst (last l) = Skip \\ (fst (last l) = Throw \\ snd (last l) = Normal s')\" \n using final_def by fast \n thus ?thesis\n proof\n assume \"fst (last l)= LanguageCon.com.Throw \\ snd (last l) = Normal s'\" \n then have \"False\" using no_c2 env_tran_right cp cptn_eq_cptn_mod_set Catch_sound3\n by blast\n thus ?thesis by auto\n next \n assume asm0:\"fst (last l) = Skip\"\n then obtain lc1 ys where cp_lc1:\"(\\,lc1) \\ cp \\ c1 s \\ l = ((map (lift_catch c2) lc1)@((Skip,snd(last lc1))#ys))\"\n using Catch_sound2 cp cptn_eq_cptn_mod_set env_tran_right no_c2 by blast\n let ?m_lc1 = \"map (lift_catch c2) lc1\"\n let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" \n have lc1_not_empty:\"lc1 \\ []\"\n using \\1 a10 cp_def cp_lc1 by force \n then have map_cp:\"(\\,?m_lc1) \\ cp \\ (Catch c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (\\, lc1) \\ cptn \\ \\ = \\\"\n using cp_lc1 cp_def by blast\n then have f2: \"(\\, ?m_lc1) \\ cptn\" using lc1_not_empty\n by (meson lift_catch_is_cptn) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cp_def lift_catch_def)\n qed\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R) F\"\n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 assum_map_catch cp_lc1 by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,r)) F\" \n using a1 cp_lc1 by (meson IntI com_validity_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,r)) F\"\n using map_cp map_assum comm_map_catch cp_lc1 by fastforce\n then have last_m_lc1:\"last (?m_lc1) = (Catch (fst (last lc1)) c2,snd (last lc1))\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Catch (fst p) c, snd p) = lift_catch c p\"\n using Cons_lift_catch by force\n then show ?thesis\n by (simp add: last_map a000 lc1_not_empty)\n qed\n then have last_length:\"last (?m_lc1) = ?last_m_lc1\" \n using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n using cp_lc1\n by (simp add:lc1_not_empty nth_append)\n then have lm_lc1:\"l!(?lm_lc1) = (Skip, snd (last lc1))\"\n using cp_lc1 by (meson nth_append_length) \n then have step:\"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\ (l!(?lm_lc1))\"\n proof -\n have \"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift_catch c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift_catch c2) lc1)\"\n by (meson length_greater_0_conv)\n then have \"length (map (lift_catch c2) lc1) - 1 + 1 < length (map (lift_catch c2) lc1 @ (Skip,snd (last lc1)) # ys)\"\n by simp\n then show ?thesis\n using f2 f1 by (metis (no_types) One_nat_def cp cp_lc1 cptn_tran_ce_i diff_zero)\n qed\n moreover have \"\\\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>e (l!(?lm_lc1))\"\n using last_m_lc1 last_length l_map\n proof -\n have \"(LanguageCon.com.Catch (fst (last lc1)) c2, snd (last lc1)) = l ! (length (map (lift_catch c2) lc1) - 1)\"\n using l_map last_m_lc1 local.last_length by presburger\n then show ?thesis\n by (metis LanguageCon.com.simps(30) env_c_c' lm_lc1) \n qed\n ultimately show ?thesis using step_ce_elim_cases by blast \n qed\n have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = snd (l!?lm_lc1)\"\n using l_map last_m_lc1 lm_lc1 local.last_length by force\n then have step_catch:\"\\\\\\<^sub>c(Catch (fst (last lc1)) c2,snd (last lc1)) \\ (Skip, snd (last lc1))\" \n using l_map last_m_lc1 lm_lc1 local.last_length local.step \n by presburger \n then obtain s2' where \n last_lc1:\"fst (last lc1) = Skip \\ \n fst (last lc1) = Throw \\ (snd (last lc1) = Normal s2') \\ c2 = Skip\"\n using catch_skip_throw1 by fastforce \n then have last_lc1_skip:\"fst (last lc1) = Skip\" \n proof \n assume \"fst (last lc1) = LanguageCon.com.Throw \\\n snd (last lc1) = Normal s2' \\ c2 = LanguageCon.com.Skip\"\n thus ?thesis using no_c2 asm0 \n by (simp add: cp_lc1 last_conv_nth ) \n qed auto \n have last_not_F:\"snd (last ?m_lc1) \\ Fault ` F\"\n proof -\n have \"snd ?last_m_lc1 = snd (l!(?lm_lc1-1))\"\n using l_map by auto \n have \"(?lm_lc1-1)< length l\"using cp_lc1 by fastforce\n also then have \"snd (l!(?lm_lc1-1))\\ Fault ` F\"\n using cp cp_lc1 l_f last_not_F[of \\ l F]\n by fastforce\n ultimately show ?thesis using l_map last_length by fastforce\n qed\n then have q_normal:\"snd (l!?lm_lc1) \\ Normal ` q \" \n proof -\n have last_lc1:\"fst (last lc1) = Skip\" \n using last_lc1_skip by fastforce \n have \"final (last lc1)\" using last_lc1 final_def \n by blast \n then show ?thesis \n using lc1_comm last_lc1 last_not_F \n unfolding comm_def\n using last_lc1_suc comm_dest2 l_map lm_lc1 local.last_length\n by force\n qed \n then obtain s1' where normal_lm_lc1:\"snd (l!?lm_lc1) = Normal s1' \\ s1' \\q\" \n by auto\n have concl:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n then have i_m_l:\"\\i []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (no_types) cp_lc1 nth_append)\n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< ?lm_lc1\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis\n by (metis (no_types) True a21 i_m_l zero_less_diff)\n qed \n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' m_lc1_comm True comm_dest1 l_f last_not_F by fastforce\n thus ?thesis using i_m_l True by auto \n next\n case False \n then have \"(Suc k=?lm_lc1) \\ (Suc k>?lm_lc1)\" by auto\n thus ?thesis \n proof\n {assume suck:\"(Suc k=?lm_lc1)\"\n then have k:\"k=?lm_lc1-1\" by auto\n then obtain s1' where s1'_normal:\"snd(l!?lm_lc1) = Normal s1'\"\n using q_normal by fastforce\n have G_s1':\"(Normal s1', Normal s1')\\ G\" using a5 by auto\n then show \"(snd (l!k), snd (l!Suc k)) \\ G\"\n proof -\n have \"snd (l ! k) = Normal s1'\"\n using k last_lc1_suc s1'_normal by presburger\n then show ?thesis\n using G_s1' s1'_normal suck by force\n qed \n }\n next\n { \n assume a001:\"Suc k>?lm_lc1\"\n have \"\\i. i\\(length lc1) \\ (Suc i < length l) \\ \n \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using lm_lc1 lc1_not_empty\n proof -\n have \"env_tran_right \\1 l R\"\n by (metis cp env_tran_right)\n then show ?thesis \n using cp fst_conv length_map lm_lc1 a001 a21 a00 a4\n normal_lm_lc1 \n by (metis (no_types) only_one_component_tran_j)\n qed\n then have \"\\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using a00 a001 by auto \n then show ?thesis using a21 by fastforce \n }\n qed \n qed\n } thus ?thesis by auto \n qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\" \n proof -\n have l_t:\"fst (last l) = Skip\" \n using lm_lc1 by (simp add: asm0)\n have \"?lm_lc1 \\ length l -1\" using cp_lc1 by fastforce \n also have \"\\i. ?lm_lc1 \\i \\ i<(length l -1) \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" \n using cp fst_conv length_map lm_lc1 a4\n normal_lm_lc1 only_one_component_tran_j[of \\ l ?lm_lc1 s1' q ]\n by (metis Suc_eq_plus1 cptn_tran_ce_i env_tran_right less_diff_conv step_ce_elim_cases) \n ultimately have \"snd (l ! (length l - 1)) \\ Normal ` q\"\n using cp_lc1 q_normal a4 env_tran_right stability[of q R l ?lm_lc1 \"(length l) -1\" _ \\] \n by fastforce \n thus ?thesis using l_t \n by (simp add: cp_lc1 last_conv_nth)\n qed\n note res = conjI [OF concl concr]\n then show ?thesis using \\1 c_prod unfolding comm_def by auto\n qed \n next\n case False\n then obtain lc1 where cp_lc1:\"(\\,lc1) \\ cp \\ c1 s \\ l = map (lift_catch c2) lc1\" \n using Catch_sound1 False no_c2 env_tran_right cp cptn_eq_cptn_mod_set \n by blast \n then have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 a10 a11 assum_map_catch by blast\n then have \"(\\, lc1)\\ comm(G, (q,r)) F\" using cp_lc1 a1\n by (meson IntI com_validity_def contra_subsetD)\n then have \"(\\, l)\\ comm(G, (q,r)) F\"\n using comm_map_catch a10 \\1 cp_lc1 by fastforce\n then show ?thesis using l_f False\n unfolding comm_def by fastforce\n qed\n next \n case False \n then obtain k where k_len:\"k fst (l ! k) = c2\"\n by blast \n then have \"\\m. (m < length l \\ fst (l ! m) = c2) \\\n (\\i (i < length l \\ fst (l ! i) = c2))\" \n using a0 exists_first_occ[of \"(\\i. i fst (l ! i) = c2)\" k] \n by blast\n then obtain i where a0:\"i fst (l !i) = c2 \\\n (\\j c2))\"\n by fastforce \n then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n then obtain lc1 lc2 where cp_lc1:\"(\\,lc1) \\ (cp \\ c1 s) \\ \n (\\,lc2) \\ (cp \\ c2 (snd (lc1!(i-1)))) \\ \n l = (map (lift_catch c2) lc1)@lc2\"\n using Catch_sound4 a0 cp env_tran_right by blast \n have i_not_fault:\"snd (l!i) \\ Fault ` F\" using a0 cp l_f last_not_F[of \\ l F] by blast\n have length_c1_map:\"length lc1 = length (map (lift_catch c2) lc1)\" \n by fastforce \n then have i_map:\"i=length lc1\" \n using cp_lc1 li a0 unfolding lift_catch_def\n proof -\n assume a1: \"(\\, lc1) \\ cp \\ c1 s \\ (\\, lc2) \\ cp \\ c2 (snd (lc1 ! (i - 1))) \\ l = map (\\(P, s). (Catch P c2, s)) lc1 @ lc2\"\n have f2: \"i < length l \\ fst (l ! i) = c2 \\ (\\n. \\ n < i \\ fst (l ! n) \\ c2)\"\n using a0 by blast\n have f3: \"(Catch (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift_catch c2 (lc1 ! i)\"\n by (simp add: case_prod_unfold lift_catch_def) \n then have \"fst (l ! length lc1) = c2\"\n using a1 by (simp add: cp_def nth_append)\n thus ?thesis\n using f3 f2\n by (metis (no_types, lifting) Pair_inject a0 cp_lc1 f3 length_c1_map li linorder_neqE_nat nth_append nth_map seq_and_if_not_eq(12))\n qed \n have lc2_l:\"\\j []\"\n using cp cp_lc1 unfolding cp_def by fastforce \n have lc2_not_empty:\"lc2 \\ []\"\n using cp_def cp_lc1 cptn.simps by blast \n have l_is:\"s2= snd (last lc1)\"\n using cp_lc1 li a0 lc1_not_empty unfolding cp_def\n proof -\n assume a1: \"(\\, lc1) \\ {(\\1, l). l ! 0 = (c1, s) \\ (\\, l) \\ cptn \\ \\1 = \\} \\ (\\, lc2) \\ {(\\1, l). l ! 0 = (c2, snd (lc1 ! (i - 1))) \\ (\\, l) \\ cptn \\ \\1 = \\} \\ l = map (lift_catch c2) lc1 @ lc2\"\n then have \"(map (lift_catch c2) lc1 @ lc2) ! length (map (lift_catch c2) lc1) = l ! i\"\n using i_map by force\n have f2: \"(c2, s2) = lc2 ! 0\"\n using li lc2_l lc2_not_empty by fastforce\n have \"op - i = op - (length lc1)\"\n using i_map by blast\n then show ?thesis\n using f2 a1 by (simp add: last_conv_nth lc1_not_empty)\n qed \n let ?m_lc1 = \"map (lift_catch c2) lc1\"\n (* let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *) \n have last_m_lc1:\"l!(i-1) = (Catch (fst (last lc1)) c2,s2)\"\n proof -\n have a000:\"\\p c. (Catch (fst p) c, snd p) = lift_catch c p\"\n using Cons_lift_catch by fastforce\n then show ?thesis\n proof -\n have \"length (map (lift_catch c2) lc1) = i\"\n using i_map by fastforce\n then show ?thesis\n by (metis (no_types) One_nat_def l_is a000 cp_lc1 diff_less last_conv_nth last_map lc1_not_empty length_c1_map length_greater_0_conv less_Suc0 nth_append)\n qed \n qed \n have last_mcl1_not_F:\"snd (last ?m_lc1) \\ Fault ` F\" \n proof -\n have \"map (lift_catch c2) lc1 \\ []\"\n by (metis lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis One_nat_def i_not_fault l_is last_conv_nth last_snd_catch lc1_not_empty li snd_conv) \n qed \n have map_cp:\"(\\,?m_lc1) \\ cp \\ (Catch c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (\\, lc1) \\ cptn \\ \\ = \\\"\n using cp_lc1 cp_def by blast\n then have f2: \"(\\, ?m_lc1) \\ cptn\" using lc1_not_empty\n by (meson lift_catch_is_cptn) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cp_def lift_catch_def)\n qed\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R) F\"\n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R) F)\" \n using \\1 assum_map_catch using assum_map cp_lc1 by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,r)) F\" \n using a1 cp_lc1 by (meson IntI com_validity_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,r)) F\"\n using map_cp map_assum comm_map_catch cp_lc1 by fastforce \n then have \"\\\\\\<^sub>c(l!(i-1)) \\ (l!i)\"\n proof -\n have \"\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>c\\<^sub>e (l!(i))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift_catch c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift_catch c2) lc1)\"\n by (meson length_greater_0_conv) \n then have \"length (map (lift_catch c2) lc1) - 1 + 1 < length (map (lift_catch c2) lc1 @ lc2)\"\n using f2 lc2_not_empty by simp\n then show ?thesis\n using f2 f1\n proof -\n have \"0 < i\"\n using f2 i_map by blast\n then show ?thesis\n by (metis (no_types) One_nat_def Suc_diff_1 a0 add.right_neutral add_Suc_right cp cptn_tran_ce_i)\n qed \n qed\n moreover have \"\\\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>e (l!i)\" \n using li last_m_lc1\n by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(12))\n ultimately show ?thesis using step_ce_elim_cases by blast\n qed \n then have step:\"\\\\\\<^sub>c(Catch (fst (last lc1)) c2,s2) \\ (c2, s2)\"\n using last_m_lc1 li by fastforce\n then obtain s2' where \n last_lc1:\"(fst (last lc1) = Skip \\ c2 = Skip) \\ \n fst (last lc1) = Throw \\ (s2 = Normal s2')\" \n using catch_skip_throw by blast \n have final:\"final (last lc1)\" \n using last_lc1 l_is unfolding final_def by auto\n have normal_last:\"fst (last lc1) = Skip \\ snd (last lc1) \\ Normal ` q \\\n fst (last lc1) = Throw \\ snd (last lc1) \\ Normal ` r\"\n proof - \n have \"snd (last lc1) \\ Fault ` F\"\n using i_not_fault l_is li by auto\n then show ?thesis\n using final comm_dest2 lc1_comm by blast\n qed\n obtain s2' where lastlc1_normal:\"snd (last lc1) = Normal s2'\" \n using normal_last by blast\n then have Normals2:\"s2 = Normal s2'\" by (simp add: l_is) \n have Gs2':\" (Normal s2', Normal s2')\\G\" using a5 by auto \n have concl:\n \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have i_m_l:\"\\j []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis \n using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append) \n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< i\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis using True a21 i_m_l by force \n qed \n have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' last_mcl1_not_F m_lc1_comm True i_map length_c1_map comm_dest1[of \\] \n by blast\n thus ?thesis using i_m_l True by auto \n next\n case False \n have \"(Suc k=i) \\ (Suc k>i)\" using False by auto\n thus ?thesis \n proof\n { assume suck:\"(Suc k=i)\" \n then have k:\"k=i-1\" by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\"\n using Gs2' Normals2 last_m_lc1 li suck by auto \n }\n next\n { \n assume a001:\"Suc k>i\"\n then have k:\"k\\i\" by fastforce\n then obtain k' where k':\"k=i+k'\" \n using add.commute le_Suc_ex by blast\n {assume skip:\"c2=Skip\"\n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a21 a001 a00 a4\n a0 skip env_tran_right cp\n by (metis SmallStepCon.final_def SmallStepCon.no_step_final' Suc_lessD skip_com_all_skip) \n then have ?thesis using a21 a001 k a00 by blast\n } note left=this\n {assume \"c2\\Skip\"\n then have \"fst (last lc1) = Throw\"\n using last_m_lc1 last_lc1 by simp \n then have s2_normal:\"s2 \\ Normal ` r\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (r,R) F\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` r\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\" \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cp \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (q,a)) F\"\n using a3 unfolding com_validity_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce\n have suck':\"Suc k' < length lc2\" \n using k' a00 length_lc2 by arith\n moreover then have \"\\\\\\<^sub>c(lc2!k') \\ (lc2!(Suc k'))\" \n using k' lc2_l a21 by fastforce \n ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\ G\"\n using comm_lc2 lc2_last_f comm_dest1[of \\ lc2 G q a F k'] \n by blast\n then have ?thesis using suck' lc2_l k' by fastforce\n } \n then show ?thesis using left by auto \n }\n qed \n qed\n } thus ?thesis by auto \n qed note left=this\n have right:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof -\n { assume final_l:\"final (last l)\" \n have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n then have final_lc2:\"final (last lc2)\" using final_l by auto\n {\n assume lst_lc1_skip:\"fst (last lc1) = Skip\" \n then have c2_skip:\"c2 = Skip\" \n using step lastlc1_normal LanguageCon.com.distinct(17) last_lc1 \n by auto \n have Skip:\"fst (l!(length l - 1)) = Skip\"\n using li Normals2 env_tran_right cp c2_skip a0\n i_skip_all_skip[of \\ l i \"(length l) - 1\" _] \n by fastforce \n have s2_a:\"s2 \\ Normal ` q\"\n using normal_last \n by (simp add: lst_lc1_skip l_is)\n then have \"\\ia. i \\ ia \\ ia < length l - 1 \\ \\\\\\<^sub>c l ! ia \\\\<^sub>e l ! Suc ia\"\n using c2_skip li Normals2 a0 cp env_tran_right final_def\n by (metis (no_types, hide_lams) One_nat_def SmallStepCon.no_step_final' \n Suc_lessD add.right_neutral add_Suc_right \n cptn_tran_ce_i i_skip_all_skip less_diff_conv step_ce_elim_cases) \n then have \"snd (l!(length l - 1)) \\ Normal ` q \\ fst (l!(length l - 1)) = Skip\" \n using a0 s2_a li a4 env_tran_right stability[of q R l i \"(length l) -1\" _ \\] Skip \n by (metis One_nat_def Suc_pred length_greater_0_conv lessI linorder_not_less list.size(3) \n not_less0 not_less_eq_eq snd_conv)\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using a0 by (metis last_conv_nth list.size(3) not_less0) \n } note left = this\n { assume \"fst (last lc1) = Throw\" \n then have s2_normal:\"s2 \\ Normal ` r\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (r,R) F\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` r\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\"\n \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cp \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (q,a)) F\"\n using a3 unfolding com_validity_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce \n then have \"((fst (last lc2) = Skip \\ \n snd (last lc2) \\ Normal ` q)) \\\n (fst (last lc2) = Throw \\ \n snd (last lc2) \\ Normal ` (a))\" \n using final_lc2 comm_lc2 unfolding comm_def by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using eq_last_lc2_l by auto\n }\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using left using last_lc1 by auto\n } thus ?thesis by auto qed \n thus ?thesis using left l_f \\1 unfolding comm_def by force \n qed \n } thus ?thesis using \\1 unfolding comm_def by auto qed\n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\nlemma \"\\s t. (q imp I)(s,t) \\ (q imp (I \\*sep_true))(s,t)\"\nby (simp add: sep_conj_sep_true)\n\n\nlemma DynCom_sound: \n \"(\\s \\ p. ((\\,\\\\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\ \n (\\,\\ \\\\<^bsub>/F\\<^esub> (c1 s) sat [p,R, G, q,a]))) \\\n (\\s. (Normal s, Normal s) \\ G) \\\n (Sta p R) \\ (Sta q R) \\ (Sta a R) \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> (DynCom c1) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"(\\s \\ p. ((\\,\\\\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\ \n (\\,\\ \\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a])))\" and \n a1:\"\\s. (Normal s, Normal s) \\ G\" and \n a2: \"(Sta p R) \\ (Sta q R) \\ (Sta a R)\" \n { \n fix s\n assume all_DynCom:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a0:\"(\\s \\ p. (\\ \\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]))\"\n using a0 unfolding com_cvalidity_def by fastforce \n have \"cp \\(DynCom c1) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (DynCom c1) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=(DynCom c1,s) \\ (\\,l) \\ cptn \\ \\=\\1\" \n using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n obtain ns where s_normal:\"s=Normal ns \\ ns\\ p\" \n using cp assum by fastforce \n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (DynCom c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt a2 cp env_tran_right assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis snd_conv stepc_Normal_elim_cases(10)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s')\\G\" using a1 by fastforce\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have p1:\"s'\\p \\ ssj=Normal s'\" using ss ssj_normal_s by fastforce\n then have c1_valid:\"(\\ \\\\<^bsub>/F\\<^esub> (c1 s') sat [p, R, G, q,a])\"\n using a0 by fastforce\n have cj:\"csj= (c1 s')\" using k_basic pair_j ss a0 s_normal\n proof -\n have \"\\\\\\<^sub>c (LanguageCon.com.DynCom c1, Normal s') \\ (csj, ssj)\"\n using k_basic pair_j ss by force\n then have \"(csj, ssj) = (c1 s', Normal s')\"\n by (meson stepc_Normal_elim_cases(10))\n then show ?thesis\n by blast\n qed \n moreover then have \"cp \\ csj ssj \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n using a2 com_validity_def cj p1 c1_valid by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using p1 j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"DynCom c1\" s p R F \"Suc j\" \"c1 s'\" s' p]\n by blast \n then show ?thesis \n using a00 a21 a10 \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"DynCom c1\" s _ \"Suc j\" G q a F k ]\n unfolding Satis_def by fastforce \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = DynCom c1\" using cp by auto\n ultimately show ?thesis \n using a2 cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (DynCom c1) \\ sj \\ Normal ` (p)\" \n using a2 pair_j before_k_all_evnt cp env_tran_right assum stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis snd_conv stepc_Normal_elim_cases(10))\n have cj:\"csj=c1 s'\" using k_basic pair_j ss a0\n by (metis fst_conv stepc_Normal_elim_cases(10)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n using a0 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"DynCom c1\" s p R F \"Suc j\" \"c1 s'\" s' p]\n by blast \n thus ?thesis \n using j_length l_f drop_comm a10 \\1 cptn_comm_induct[of \\ l \"DynCom c1\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (auto simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\nlemma Guard_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a] \\ \n Sta (p \\ g) R \\ (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p \\ g, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ g) , R, G, q,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" and \n a2: \"Sta (p \\ g) R\" and\n a3: \"\\s. (Normal s, Normal s) \\ G\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" \n using a1 com_cvalidity_def by fastforce\n have \"cp \\ (Guard f g c1) s \\ assum(p \\ g, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (Guard f g c1) s\" and a11:\"c \\ assum(p \\ g, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Guard f g c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p \\ g) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ (p \\ g) l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of \"p \\ g\" R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p \\ g)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 stepc_Normal_elim_cases(2)\n by (metis (no_types, lifting) IntD2 prod.inject) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \" (Normal s', Normal s')\\G\" using a3 by auto \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) IntD2 fst_conv stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum(p \\ g, R) F \\ comm(G, (q,a)) F\"\n using a1 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \" (Guard f g c1)\" s \"(p \\ g)\" R F \"Suc j\" c1 s' \"p \\ g\"]\n by blast \n then show ?thesis \n using a00 a21 a10 \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k ]\n unfolding Satis_def by fastforce \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of \"p \\ g\" R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p \\ g)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a1\n by (metis (no_types, lifting) IntD2 Pair_inject stepc_Normal_elim_cases(2)) \n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum((p \\ g), R) F \\ comm(G, (q,a)) F\"\n using a1 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(Guard f g c1)\" s \"(p \\ g)\" R F \"Suc j\" c1 s' \"(p \\ g)\"]\n by blast \n thus ?thesis \n using j_length l_f drop_comm a10 \\1 cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\n\nlemma Guarantee_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ g), R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ g), R, G, q,a] \\ \n Sta p R \\ \n f\\F \\\n (\\s. (Normal s, Normal s) \\ G) \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" and \n a2: \"Sta p R\" and\n a3: \"(\\s. (Normal s, Normal s) \\ G)\" and\n a4: \"f\\F\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" \n using a1 com_cvalidity_def by fastforce\n have \"cp \\ (Guard f g c1) s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cp \\ (Guard f g c1) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Guard f g c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n have or:\"s'\\ (g \\ (-g))\" by fastforce\n {assume \"s' \\ g\"\n then have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using ss k_basic by fastforce\n then have ss: \"sj = Normal s' \\ s'\\ (p \\ g)\"\n using ss by fastforce\n have ssj_normal_s:\"ssj = Normal s'\" \n using ss before_k_all_evnt k_basic pair_j a0 stepc_Normal_elim_cases(2)\n by (metis (no_types, lifting) IntD2 prod.inject) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" using a3 by auto\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum((p \\ g), R) F \\ comm(G, (q,a)) F\"\n using a1 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \" (Guard f g c1)\" s \"p\" R F \"Suc j\" c1 s' \"(p \\ g)\"]\n by blast \n then show ?thesis \n using a3 a00 a21 a10 \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k]\n unfolding Satis_def by fastforce \n qed \n qed\n } note p1=this\n {assume \"s' \\ (Collect (not (set_fun g)))\"\n then have \"s'\\g\" by fastforce\n then have csj_skip:\"csj= Skip \\ ssj=Fault f\" using k_basic ss pair_j \n by (meson Pair_inject stepc_Normal_elim_cases(2))\n then have \"snd (last l) = Fault f\" using pair_j\n proof -\n have \"j = k\" \n proof -\n have f1: \"k < length l\"\n using a00 by linarith\n have \"\\ SmallStepCon.final (l ! k)\"\n by (metis SmallStepCon.no_step_final' a21)\n then have \"\\ Suc j \\ k\"\n using f1 SmallStepCon.final_def cp csj_skip i_skip_all_skip pair_j by blast\n then show ?thesis\n by (metis Suc_leI before_k_all_evnt le_eq_less_or_eq)\n qed\n then have False\n using pair_j csj_skip by (metis a00 a4 cp image_eqI l_f last_not_F)\n then show ?thesis\n by metis\n qed\n then have False using a4 l_f by auto \n }\n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using p1 or by fastforce\n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n have or:\"s'\\ (g \\ (-g))\" by fastforce\n {assume \"s' \\ g\"\n then have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using ss k_basic by fastforce\n then have ss: \"sj = Normal s' \\ s'\\ (p \\ g)\"\n using ss by fastforce\n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a1\n by (metis (no_types, lifting) Pair_inject IntD2 stepc_Normal_elim_cases(2)) \n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s'\\(p \\ g)\" using ss by blast \n moreover then have \"cp \\ csj ssj \\ assum((p \\ g), R) F \\ comm(G, (q,a)) F\"\n using a1 com_validity_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cptn_assum_induct[of \\ l \"(Guard f g c1)\" s \"p\" R F \"Suc j\" c1 s' \"(p \\ g)\"]\n by blast \n then have ?thesis \n using j_length l_f drop_comm a10 \\1 cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n }note left=this \n {\n assume \"s' \\ (Collect (not (set_fun g)))\"\n then have \"s'\\g\" by fastforce\n then have \"csj= Skip \\ ssj=Fault f\" using k_basic ss pair_j \n by (meson Pair_inject stepc_Normal_elim_cases(2))\n then have \"snd (last l) = Fault f\" using pair_j\n by (metis a4 cp imageI j_length l_f last_not_F) \n then have False using a4 l_f by auto \n }\n thus ?thesis using or left by auto qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\nlemma WhileNone: \n \"\\\\\\<^sub>c (While b c1, s1) \\ (LanguageCon.com.Skip, t1) \\ \n (\\, (Skip, t1) # xsa) \\ cptn \\ \n \\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b,R, G, p,a] \\\n Sta p R \\\n Sta (p \\ (-b)) R \\\n Sta a R \\\n (\\s. (Normal s, Normal s) \\ G) \\ \n (\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ assum (p, R) F \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p , R, G, q,a]) \\ \n (\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ comm (G,(p \\ (-b)),a) F\"\nproof -\n assume a0:\"\\\\\\<^sub>c (While b c1, s1) \\ (LanguageCon.com.Skip, t1)\" and\n a1:\"(\\, (Skip, t1) # xsa) \\ cptn\" and\n a2:\" \\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b,R, G, p,a]\" and\n a3:\"Sta p R\" and\n a4:\"Sta (p \\ (-b)) R\" and\n a5:\"Sta a R\" and\n a6:\"\\s. (Normal s, Normal s) \\ G\" and\n a7:\"(\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ assum (p, R) F\" and\n a8:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p , R, G, q,a])\"\n obtain s1' where s1N:\"s1=Normal s1' \\ s1'\\p\" using a7 unfolding assum_def by fastforce\n then have s1_t1:\"s1'\\ b \\ t1=s1\" using a0\n using LanguageCon.com.distinct(5) prod.inject \n by (fastforce elim:stepc_Normal_elim_cases(7))\n then have t1_Normal_post:\"t1\\ Normal ` (p \\ (-b))\"\n using s1N by fastforce\n also have \"(\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa)\\cptn\"\n using a1 a0 cptn.simps by fastforce\n ultimately have assum_skip:\n \"(\\,(LanguageCon.com.Skip, t1) # xsa) \\ assum (( p \\ (-b)), R) F\"\n using a1 a7 tl_of_assum_in_assum1 t1_Normal_post by fastforce\n have skip_comm:\"(\\,(LanguageCon.com.Skip, t1) # xsa) \\ \n comm (G,(( p \\ (-b)),a)) F\" \n proof- \n have \"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [( p \\ (-b)), R, G, ( p \\ (-b)),a]\"\n using Skip_sound[of \"(p \\ - b)\"] a4 a6 by blast\n thus ?thesis\n using assum_skip cp_def a1 a8 unfolding com_cvalidity_def com_validity_def\n by fastforce\n qed \n have G_ref:\"(Normal s1', Normal s1')\\G\" using a6 by fastforce\n thus ?thesis using skip_comm ctran_in_comm[of s1'] s1N s1_t1 by blast\nqed \n\nlemma while1:\n \"(\\, ((c, Normal s1) # xs1)) \\ cptn_mod \\ \n s1 \\ b \\\n xsa = map (lift (While b c)) xs1 \\\n \\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a] \\ \n (\\, (While b c, Normal s1) #\n (Seq c (LanguageCon.com.While b c), Normal s1) # xsa)\n \\ assum (p, R) F \\ \n \\s. (Normal s, Normal s) \\ G \\ \n (\\, (LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) # xsa)\n \\ comm (G, p\\(-b), a) F\"\nproof -\nassume \n a0:\"(\\, ((c, Normal s1) # xs1)) \\ cptn_mod\" and\n a1:\"s1 \\ b\" and\n a2:\"xsa = map (lift (While b c)) xs1\" and\n a3:\"\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a]\" and\n a4:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R) F\" and \n a5:\"\\s. (Normal s,Normal s) \\ G\" \n have seq_map:\"(Seq c (While b c), Normal s1) # xsa=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a1\n WhileTruec by fastforce\n have s1_normal:\"s1 \\ p \\ s1 \\ b \" using a4 a1 unfolding assum_def by fastforce\n then have G_ref:\"(Normal s1, Normal s1) \\ G\" using a5 by fastforce \n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(\\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn\" \n using a2 cptn_eq_cptn_mod lift_is_cptn a0 by fastforce\n then have cptn_seq:\"(\\,(Seq c (While b c), Normal s1) # xsa) \\cptn\" \n using seq_map by auto\n then have \"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa) \\ cptn\"\n using step by (simp add: cptn.CptnComp) \n then have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # xsa)\\assum (p, R) F\"\n using a4 tl_of_assum_in_assum1 s1_collect_p by fastforce\n have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n using a0[THEN cptn_if_cptn_mod] unfolding cp_def by fastforce\n also have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # xsa) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cp_def by fastforce\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R) F\" \n using assum_map assum_seq seq_map by fastforce \n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R) F\"\n unfolding assum_def using s1_collect_p by fastforce\n then have \"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a3 cp_c unfolding com_validity_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # xsa) \\ comm(G,(p,a)) F\"\n using cp_seq cp_c comm_map seq_map by fastforce\n then have \"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n also have \"\\ final (last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa))\"\n using seq_map unfolding final_def lift_def by (simp add: case_prod_beta' last_map) \n ultimately show ?thesis using not_final_in_comm[of \\] by blast\nqed\n\nlemma while2:\n \" (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa) \\cptn \\\n (\\, (c, Normal s1) # xs1) \\ cptn_mod \\\n fst (last ((c, Normal s1) # xs1)) = LanguageCon.com.Skip \\\n s1 \\ b \\\n xsa = map (lift (While b c)) xs1 @\n (While b c, snd (last ((c, Normal s1) # xs1))) # ys \\\n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ cptn_mod \\\n (\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a] \\ \n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R) F \\\n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ comm (G, p \\ (-b), a) F) \\\n \\ \\\\<^bsub>/F\\<^esub> c sat [ p \\ b, R, G, p,a] \\\n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R) F \\\n \\s. (Normal s,Normal s) \\ G \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ comm (G,( p \\ (-b), a)) F\"\nproof -\nassume a00:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa) \\cptn\" and\n a0:\"(\\, (c, Normal s1) # xs1) \\ cptn_mod\" and\n a1:\" fst (last ((c, Normal s1) # xs1)) = LanguageCon.com.Skip\" and\n a2:\"s1 \\ b\" and\n a3:\"xsa = map (lift (While b c)) xs1 @\n (While b c, snd (last ((c, Normal s1) # xs1))) # ys\" and\n a4:\"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ cptn_mod\" and\n a5:\"\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]\" and \n a6:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R) F\" and\n a7:\"(\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a] \\ \n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R) F \\\n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ comm (G,p \\ (-b), a) F)\" and\n a8:\"\\s. (Normal s, Normal s) \\ G\" \n let ?l= \"(While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa\"\n let ?sub_l=\"((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)\"\n {\n assume final_not_fault:\"snd (last ?l) \\ Fault ` F\"\n have a0:\"(\\, (c, Normal s1) # xs1) \\ cptn\"\n using cptn_if_cptn_mod using a0 by auto\n have a4:\"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys) \\ cptn\" \n using cptn_if_cptn_mod using a4 by auto\n have seq_map:\"(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a2\n WhileTruec by fastforce\n have s1_normal:\"s1\\p \\ s1 \\ b \" using a6 a2 unfolding assum_def by fastforce\n have G_ref:\"(Normal s1, Normal s1)\\G \" \n using a8 by blast\n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(\\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn\" \n using a2 cptn_eq_cptn_mod lift_is_cptn a0 by fastforce\n then have cptn_seq:\"(\\,(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\cptn\" \n using seq_map by auto\n then have \"(\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ cptn\"\n using step by (simp add: cptn.CptnComp) \n also have \"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) #\n map (lift (While b c)) xs1)\n \\ assum (p, R) F\"\n using a6 a3 sub_assum by force \n ultimately have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ assum (p, R) F\"\n using a6 tl_of_assum_in_assum1 s1_collect_p \n tl_of_assum_in_assum by fastforce\n have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n using a0 unfolding cp_def by fastforce\n also have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cp_def by fastforce\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R) F\" \n using assum_map assum_seq seq_map by fastforce \n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R) F\"\n unfolding assum_def using s1_collect_p by fastforce\n then have c_comm:\"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a5 cp_c unfolding com_validity_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using cp_seq cp_c comm_map seq_map by fastforce\n then have comm_while:\"(\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n have final_last_c:\"final (last ((c,Normal s1)#xs1))\"\n using a1 a3 unfolding final_def by fastforce\n have last_while1:\"snd (last (map (lift (While b c)) ((c,Normal s1)#xs1))) = snd (last ((c, Normal s1) # xs1))\"\n unfolding lift_def by (simp add: case_prod_beta' last_map)\n have last_while2:\"(last (map (lift (While b c)) ((c,Normal s1)#xs1))) =\n last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1)\"\n using seq_map by fastforce\n have not_fault_final_last_c:\n \"snd (last ( (c,Normal s1)#xs1)) \\ Fault ` F\"\n proof - \n have \"(length ?sub_l) - 1 < length ?l\" \n using a3 by fastforce\n then have \"snd (?l!((length ?sub_l) - 1))\\ Fault ` F\"\n using final_not_fault a3 a00 last_not_F[of \\ ?l F] by fast\n thus ?thesis using last_while2 last_while1 seq_map\n by (metis (no_types) Cons_lift_append a3 diff_Suc_1 last_length length_Cons lessI nth_Cons_Suc nth_append)\n qed\n then have last_c_normal:\"snd (last ( (c,Normal s1)#xs1)) \\ Normal ` (p)\"\n using c_comm a1 unfolding comm_def final_def by fastforce \n then obtain sl where sl:\"snd (last ( (c,Normal s1)#xs1)) = Normal sl\" by fastforce\n have while_comm:\"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys) \\ comm(G,(p\\(-b),a)) F\"\n proof -\n have assum_while: \"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R) F\"\n using last_c_normal a3 a6 sub_assum_r[of \\ ?sub_l \"(While b c, snd (last ((c, Normal s1) # xs1)))\" ys p R F p] \n by fastforce\n thus ?thesis using a5 a7 by fastforce\n qed \n have \"sl\\p\" using last_c_normal sl by fastforce\n then have G1_ref:\"(Normal sl, Normal sl)\\G\" using a8 by auto\n also have \"snd (last ?sub_l) = Normal sl\"\n using last_while1 last_while2 sl by fastforce\n ultimately have ?thesis \n using a00 a3 sl while_comm comm_union[OF comm_while] \n by fastforce \n } note p1 =this\n {\n assume final_not_fault:\"\\ (snd (last ?l) \\ Fault ` F)\"\n then have ?thesis unfolding comm_def by fastforce\n } thus ?thesis using p1 by fastforce\nqed\n\nlemma while3:\n \"(\\, (c, Normal s1) # xs1) \\ cptn_mod \\ \n fst (last ((c, Normal s1) # xs1)) = Throw \\\n s1 \\ b \\\n snd (last ((c, Normal s1) # xs1)) = Normal sl \\\n (\\, (Throw, Normal sl) # ys) \\ cptn_mod \\\n \\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a] \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n (map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))\n \\ assum (p, R) F \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \n Sta p R \\\n Sta a R \\ \\s. (Normal s, Normal s) \\ G \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n ((map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))) \\ comm (G, p\\ (-b), a) F\n\"\nproof -\nassume a0:\"(\\, (c, Normal s1) # xs1) \\ cptn_mod\" and\n a1:\"fst (last ((c, Normal s1) # xs1)) = Throw\" and\n a2:\"s1 \\ b\" and\n a3:\"snd (last ((c, Normal s1) # xs1)) = Normal sl\" and\n a4:\"(\\, (Throw, Normal sl) # ys) \\ cptn_mod\" and\n a5:\"\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]\" and\n a6:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n (map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))\n \\ assum (p, R) F\" and \n a7: \"Sta p R\" and\n a8: \"Sta a R\" and\n a9: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and\n a10:\"\\s. (Normal s,Normal s) \\ G\" \n have a0:\"(\\, (c, Normal s1) # xs1) \\ cptn\"\n using cptn_if_cptn_mod using a0 by auto\n have a4:\"(\\, (Throw, Normal sl) # ys) \\ cptn\" \n using cptn_if_cptn_mod using a4 by auto\n have seq_map:\"(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a2\n WhileTruec by fastforce\n have s1_normal:\"s1\\p \\ s1 \\ b \" using a6 a2 unfolding assum_def by fastforce\n then have G_ref:\"(Normal s1, Normal s1)\\G\" using a10 by auto\n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(\\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn\" \n using a2 cptn_eq_cptn_mod lift_is_cptn a0 by fastforce\n then have cptn_seq:\"(\\,(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\cptn\" \n using seq_map by auto\n then have cptn:\"(\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ cptn\"\n using step by (simp add: cptn.CptnComp) \n also have \"(\\, (LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1)\n \\ assum (p, R) F\"\n using a6 sub_assum by force \n ultimately have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ assum (p, R) F\"\n using a6 tl_of_assum_in_assum1 s1_collect_p \n tl_of_assum_in_assum by fastforce\n have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n using a0 unfolding cp_def by fastforce\n also have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cp_def by fastforce\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R) F\" \n using assum_map assum_seq seq_map by fastforce \n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R) F\"\n unfolding assum_def using s1_collect_p by fastforce\n then have c_comm:\"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a5 cp_c unfolding com_validity_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using cp_seq cp_c comm_map seq_map by fastforce\n then have comm_while:\"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n have final_last_c:\"final (last ((c,Normal s1)#xs1))\"\n using a1 a3 unfolding final_def by fastforce\n have not_fault_final_last_c:\n \"snd (last ( (c,Normal s1)#xs1)) \\ Fault ` F\"\n using a3 by fastforce\n then have sl_a:\"Normal sl \\ Normal ` (a)\" \n using final_last_c a1 c_comm unfolding comm_def\n using a3 comm_dest2 \n by auto\n have last_while1:\"snd (last (map (lift (While b c)) ((c,Normal s1)#xs1))) = snd (last ((c, Normal s1) # xs1))\"\n unfolding lift_def by (simp add: case_prod_beta' last_map)\n have last_while2:\"(last (map (lift (While b c)) ((c,Normal s1)#xs1))) =\n last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1)\"\n using seq_map by fastforce\n have throw_comm:\"(\\, (Throw, Normal sl) # ys) \\ comm(G,(p\\(-b),a)) F\"\n proof -\n have assum_throw: \"(\\, (Throw, Normal sl) # ys) \\ assum (a,R) F\"\n using sl_a a6 sub_assum_r[of _ \"(LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1\" \"(Throw, Normal sl)\" ] \n by fastforce\n also have \"(\\,(Throw, Normal sl) # ys) \\ cp \\ Throw (Normal sl)\" \n unfolding cp_def using a4 by fastforce\n ultimately show ?thesis using Throw_sound[of a R G \\] a10 a8 a9 \n unfolding com_cvalidity_def com_validity_def by fast\n qed \n have p1:\"(LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1 \\\n [] \\\n (LanguageCon.com.Throw, Normal sl) # ys \\ []\" by auto \n have \"sl \\ a\" using sl_a by fastforce\n then have G1_ref:\"(Normal sl, Normal sl) \\ G\" using a10 by auto\n moreover have \"snd (last ((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)) = Normal sl\"\n using last_while1 last_while2 a3 by fastforce\n moreover have \"snd (((LanguageCon.com.Throw, Normal sl) # ys) ! 0) = Normal sl\"\n by (metis nth_Cons_0 snd_conv)\n ultimately have G:\"(snd (last ((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)),\n snd (((LanguageCon.com.Throw, Normal sl) # ys) ! 0)) \\ G\" by auto\n have cptn:\"(\\, ((LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1) @\n (LanguageCon.com.Throw, Normal sl) # ys)\n \\ cptn\" using cptn a4 a0 a1 a3 a4 cptn_eq_cptn_mod_set cptn_mod.CptnModWhile3 s1_normal by fastforce\n show ?thesis using a0 comm_union[OF comm_while throw_comm p1 G cptn] by auto \nqed\n\n\ninductive_cases stepc_elim_cases_while_throw [cases set]:\n \"\\\\\\<^sub>c(While b c, s) \\ (Throw, t)\"\n\nlemma WhileSound_aux:\n \"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \\\n Sta p R \\\n Sta (p \\ (-b)) R \\ \n Sta a R \\ \n (\\,x)\\ cptn_mod \\ \n \\s. (Normal s, Normal s) \\ G \\\n \\s xs. x = ((While b c1),s)#xs \\ \n (\\,x)\\assum(p,R) F \\ \n (\\,x) \\ comm (G,(( p \\ (-b)),a)) F\"\nproof -\n assume a0: \"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \" and\n a1: \"Sta p R\" and\n a2: \"Sta (p \\ (-b)) R\" and\n a3: \"Sta a R\" and\n a4: \"(\\,x)\\ cptn_mod\" and\n a5: \"\\s. (Normal s, Normal s) \\ G\" \n {fix xs s \n assume while_xs:\"x=((While b c1),s)#xs\" and\n x_assum:\"(\\,x)\\assum(p,R) F\"\n have \"(\\,x) \\ comm (G,(( p \\ (-b)),a)) F\"\n using a4 a0 while_xs x_assum\n proof (induct arbitrary: xs s c1 rule:cptn_mod.induct)\n case (CptnModOne \\ C s1) thus ?case \n using CptnModOne unfolding comm_def final_def\n by auto\n next\n case (CptnModEnv \\ C s1 t1 xsa) \n then have c_while:\"C = While b c1\" by fastforce\n have \"(\\, (C, t1) # xsa) \\ assum (p, R) F \\\n (\\, (C, t1) # xsa) \\ comm (G, p \\ (-b), a) F\" \n using CptnModEnv by fastforce \n moreover have\"(\\,(C, s1)#(C, t1) # xsa) \\ cptn_mod\"\n using CptnModEnv(1,2)\n by (simp add: CptnModEnv.hyps(1) CptnModEnv.hyps(2) cptn_mod.CptnModEnv)\n then have cptn_mod:\"(\\,(C, s1)#(C, t1) # xsa) \\ cptn\"\n using cptn_eq_cptn_mod_set by blast \n then have \"(\\, (C, t1) # xsa) \\ assum (p, R) F\" \n using tl_of_assum_in_assum CptnModEnv(6) a1 a2 a3 a4 a5\n by blast\n ultimately have \"(\\, (C, t1) # xsa) \\ comm (G, p \\ (-b), a) F\"\n by auto\n also have \" \\ (\\\\\\<^sub>c((C,s1)) \\ ((C,t1)))\" \n proof \n assume step:\"\\\\\\<^sub>c (C, s1) \\ (C, t1)\"\n show False \n proof (cases s1)\n case (Normal s1') thus ?thesis \n using step step_change_p_or_eq_Ns redex.simps(6) LanguageCon.com.distinct(91) c_while\n by fastforce\n next\n case Abrupt thus ?thesis \n using step c_while prod.inject stepc_elim_cases(7) xstate.distinct(1) \n by fastforce\n next\n case Fault thus ?thesis\n using step c_while prod.inject stepc_elim_cases(7) xstate.distinct(1) \n by fastforce\n next\n case Stuck thus ?thesis\n using step c_while prod.inject stepc_elim_cases(7) xstate.distinct(1) \n by fastforce\n qed\n qed\n ultimately show ?case \n using cptn_mod etran_in_comm by blast\n next \n case (CptnModSkip \\ C s1 t1 xsa) \n then have \"C=While b c1\" by auto\n also have \"(\\, (LanguageCon.com.Skip, t1) # xsa) \\ cptn\"\n using cptn_eq_cptn_mod_set CptnModSkip(3) by fastforce\n thus ?case using WhileNone CptnModSkip a1 a2 a3 a4 a5 by blast\n next\n case (CptnModThrow \\ C s1 t1 xsa) \n then have \"C = While b c1\" by auto \n thus ?case using stepc_elim_cases_while_throw CptnModThrow(1) \n by blast\n next \n case (CptnModWhile1 \\ c s1 xs1 b1 xsa zs) \n then have \"b=b1 \\ c=c1 \\ s=Normal s1\" by auto \n thus ?case\n using a4 a5 CptnModWhile1 while1[of \\] by blast\n next \n case (CptnModWhile2 \\ c s1 xs1 b1 xsa ys zs)\n then have a00: \"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\\cptn_mod\" \n using cptn_mod.CptnModWhile2 by fast note pp1 = this[THEN cptn_if_cptn_mod] \n then have eqs:\"b=b1 \\ c=c1 \\ s=Normal s1\"using CptnModWhile2 by auto\n thus ?case using pp1 a4 a5 CptnModWhile2 while2[of \\ b c s1 xsa xs1 ys F p R G a] \n by fastforce\n next\n case (CptnModWhile3 \\ c s1 xs1 b1 sl ys zs) \n then have eqs:\"b=b1 \\ c=c1 \\ s=Normal s1\" by auto \n then have \"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n ((map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))) \\ comm (G, p\\(-b), a) F\" \n using a1 a3 a4 a5 CptnModWhile3 while3[of \\ c s1 xs1 b sl ys F p R G a] \n by fastforce \n thus ?case using eqs CptnModWhile3 by auto\n qed (auto)\n }\n then show ?thesis by auto \nqed\n\n\n\nlemma While_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \\ \n Sta p R \\ \n Sta (p \\ (-b)) R \\ Sta a R \\ \\s. (Normal s, Normal s) \\ G \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (While b c1) sat [p, R, G, p \\ (-b),a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]\" and \n a2: \"Sta p R\" and\n a3: \"Sta (p \\ (-b)) R\" and\n a4: \"Sta a R\" and\n a5: \"\\s. (Normal s, Normal s) \\ G\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]\" \n using a1 com_cvalidity_def by fastforce\n have \"cp \\ (While b c1) s \\ assum(p, R) F \\ comm(G, (p \\ (-b),a)) F\"\n proof-\n {fix c \n assume a10:\"c \\ cp \\ (While b c1) s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((While b c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce \n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n obtain xs where \"l=((While b c1),s)#xs\" using cp\n proof -\n assume a1: \"\\xs. l = (LanguageCon.com.While b c1, s) # xs \\ thesis\"\n have \"[] \\ l\"\n using cp cptn.simps by auto\n then show ?thesis\n using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n qed \n moreover have \"(\\,l)\\cptn_mod\" using cp cptn_eq_cptn_mod_set by fastforce\n ultimately have \"c \\ comm(G, (p \\ (-b),a)) F\"\n using a1 a2 a3 a4 WhileSound_aux a11 \\1 a5 \n by blast\n } thus ?thesis by auto qed\n }\n thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed\n\n\nlemma Conseq_sound:\n \"(\\s\\ p.\n \\p' R' G' q' a' I'.\n s \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\\n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a]\" \nproof -\n assume \n a0: \"(\\s\\ p.\n \\p' R' G' q' a' I'.\n s \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\\n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])\"\n {\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n have \"cp \\ P s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n proof -\n {\n fix c\n assume a10:\"c \\ cp \\ P s\" and a11:\"c \\ assum(p, R) F\"\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=(P,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast \n obtain xs where \"l=(P,s)#xs\" using cp\n proof -\n assume a1: \"\\xs. l = (P, s) # xs \\ thesis\"\n have \"[] \\ l\"\n using cp cptn.simps by auto\n then show ?thesis\n using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n qed\n obtain ns where s:\"(s = Normal ns)\" using a10 a11 unfolding assum_def cp_def by fastforce\n then have \"ns \\ p\" using a10 a11 unfolding assum_def cp_def by fastforce\n then have ns:\"ns\\p\" by auto\n then have\n \"\\s. s \\ p \\ (\\p' R' G' q' a' . (s\\p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\\n (\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])\" using a0 by auto\n then have \n \"ns \\ p \\ (\\p' R' G' q' a'. (ns \\ p' ) \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\\n (\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])\" apply (rule allE) by auto \n then obtain p' R' G' q' a' where\n rels:\n \"ns \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']\" using ns by auto\n then have \"s \\ Normal ` p'\" using s by fastforce\n then have \"(\\,l) \\ assum(p', R') F\"\n using a11 rels cp a11 c_prod assum_R_R'[of \\ l p R F p' R'] \n by fastforce\n then have \"(\\,l) \\ comm(G',(q',a')) F\" \n using rels all_call a10 c_prod cp unfolding com_cvalidity_def com_validity_def \n by blast\n then have \"(\\,l) \\ comm(G, (q,a)) F\" \n using c_prod cp comm_conseq[of \\ l G' q' a' F G q a] rels by fastforce\n then have \"c \\ comm(G, (q,a)) F\" using c_prod cp by fastforce\n } \n thus ?thesis unfolding comm_def by force qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed \n\nlemma Conj_post_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q \\ q' ,a \\ a']\" \nproof -\nassume a0: \"\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\" and\n a1: \" \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a']\"\n{\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n with a0 have a0:\"cp \\ P s \\ assum(p, R) F \\ comm(G, (q,a)) F\"\n unfolding com_cvalidity_def com_validity_def by auto\n with a1 all_call have a1:\"cp \\ P s \\ assum(p, R) F \\ comm(G, (q',a')) F\"\n unfolding com_cvalidity_def com_validity_def by auto\n have \"cp \\ P s \\ assum(p, R) F \\ comm(G, (q\\q',a\\a')) F\"\n proof -\n {\n fix c\n assume a10:\"c \\ cp \\ P s\" and a11:\"c \\ assum(p, R) F\"\n then have \"c \\ comm(G,(q,a)) F \\ c \\ comm(G,(q',a')) F\"\n using a0 a1 by auto\n then have \"c\\comm(G, (q\\q',a\\a')) F\"\n unfolding comm_def by fastforce\n } \n thus ?thesis unfolding comm_def by force qed \n } thus ?thesis by (simp add: com_validity_def[of \\] com_cvalidity_def) \nqed \n\nlemma localRG_sound: \"\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a] \\ \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a]\"\nproof (induct rule:lrghoare.induct)\n case Skip \n thus ?case by (simp add: Skip_sound)\nnext\n case Spec\n thus ?case by (simp add: Spec_sound)\nnext\n case Basic\n thus ?case by (simp add: Basic_sound)\nnext\n case Await\n thus ?case by (simp add: Await_sound)\nnext\n case Throw thus ?case by (simp add: Throw_sound)\nnext \n case If thus ?case by (simp add: If_sound)\nnext \n case Call thus ?case by (simp add: Call_sound)\nnext\n case Asm thus ?case by (simp add: Asm_sound)\nnext\n case CallRec thus ?case using CallRec_sound by (simp add: CallRec_sound)\nnext\n case Seq thus ?case by (simp add: Seq_sound)\nnext\n case Catch thus ?case by (simp add: Catch_sound)\nnext\n case DynCom thus ?case by (simp add: DynCom_sound)\nnext\n case Guard thus ?case by (simp add: Guard_sound)\nnext\n case Guarantee thus ?case by (simp add: Guarantee_sound)\nnext\n case While thus ?case by (simp add: While_sound)\nnext\n case (Conseq p R G q a \\ \\ F P) thus ?case \n using Conseq_sound by simp\nnext \n case (Conj_post \\ \\ F P p' R' G' q a q' a') thus ?case\n using Conj_post_sound[of \\ \\] by simp\nqed \n\n\ndefinition ParallelCom :: \"('s,'p,'f) rgformula list \\ ('s,'p,'f) par_com\"\nwhere\n\"ParallelCom Ps \\ map fst Ps\"\n\nlemma ParallelCom_Com:\"i (ParallelCom xs)!i = Com (xs!i)\"\nunfolding ParallelCom_def Com_def by fastforce\n\n\nlemma etran_ctran_eq_p_normal_s: \"\\\\\\<^sub>c s1 \\ s1' \\\n \\\\\\<^sub>c s1 \\\\<^sub>e s1' \\\n fst s1 = fst s1' \\ snd s1 = snd s1' \\ (\\ns1. snd s1 = Normal ns1)\"\nproof -\n assume a0: \"\\\\\\<^sub>c s1 \\ s1'\" and\n a1: \"\\\\\\<^sub>c s1 \\\\<^sub>e s1'\"\n then obtain ps1 ss1 ps1' ss1' where prod:\"s1 = (ps1,ss1) \\ s1' = (ps1', ss1')\"\n by fastforce\n then have \"ps1=ps1'\" using a1 etranE by fastforce\n thus ?thesis using prod step_change_p_or_eq_s_normal a0 by fastforce\nqed\n\nlemma step_e_step_c_eq:\"\\ \n (\\,l) \\ clist;\n Suc m < length l;\n i < length clist; \n (fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m); \n (fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m);\n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\n \\ \\ \n l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\nproof -\n assume a0:\"(\\,l) \\ clist\" and\n a1:\"Suc m < length l\" and\n a2:\"i < length clist\" and\n a3:\"(fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m)\" and\n a4:\"(fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m)\" and\n a5:\"(\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\"\n obtain fp fs sp ss \n where prod_step: \" \n \\\\\\<^sub>c (fp, fs) \\ (sp,ss) \\ \n fp = fst (((snd (clist!i))!m)) \\ fs = snd (((snd (clist!i))!m)) \\ \n sp = fst ((snd (clist!i))!(Suc m)) \\ ss = snd((snd (clist!i))!(Suc m)) \\\n \\ = fst (clist!i)\"\n using a0 a2 a1 a4 unfolding conjoin_def same_functions_def by fastforce \n have snd_lj:\"(snd (l!m)) = snd ((snd (clist!i))!m)\"\n using a0 a1 a2 unfolding conjoin_def same_state_def\n by fastforce \n have fst_clist_\\:\"\\i\" \n using a0 unfolding conjoin_def same_functions_def by fastforce\n have all_env: \"\\l\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m))\"\n using a3 a5 a2 fst_clist_\\ by fastforce\n then have allP:\"\\l< length clist. fst ((snd (clist!l))!m) = fst ((snd (clist!l))!(Suc m))\"\n by (fastforce elim:etranE) \n then have \"fst (l!m) = (fst (l!(Suc m)))\"\n using a0 conjoin_same_program_i_j [of \"(\\,l)\"] a1 by fastforce\n also have snd_l_normal:\"snd (l!m) = snd (l!(Suc m)) \\ (\\ns. snd (l!m) = Normal ns )\"\n proof - \n have \"(snd (l!Suc m)) = snd ((snd (clist!i))!(Suc m))\"\n using a0 a1 a2 unfolding conjoin_def same_state_def\n by fastforce\n also have \"fs = ss \\ \n (\\ns. (snd ((snd (clist!i))!m) = Normal ns ))\"\n using a1 a2 step_change_p_or_eq_s_normal[of \\ fp fs sp ss] all_env prod_step allP \n by metis \n ultimately show ?thesis using snd_lj prod_step a1 by fastforce\n qed \n ultimately show ?thesis using prod_eq_iff by blast \nqed\n\nlemma two': \n \"\\ \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l)\\par_assum (p, R) F;\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\"\nproof -\n assume a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a3: \"length xs=length clist\" and\n a4: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a5: \"(\\,l)\\par_assum (p, R) F\" and\n a6: \"\\icp \\ (Com(xs!i)) s\" and\n a7: \"(\\,l) \\ clist\" and\n a8: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and \n a9: \"snd (last l) \\ Fault ` F\"\n{\n assume a10:\"\\i j ns ns'. \n i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n \\(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\"\n then obtain j where \n a10:\"\\i ns ns'. \n i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\\n \\(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\" by fastforce\n let ?P = \"\\j. \\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n (\\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i))\" \n obtain m where fist_occ:\"(?P m) \\ (\\i ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n then have \"?P m\" by fastforce\n then obtain i where\n fst_occ:\"i Suc m\n \\\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m) \\ \n (\\ (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\ Rely(xs!i))\"\n by fastforce\n have notP:\"(\\i ?P i)\" using fist_occ by blast \n have fst_clist_\\:\"\\i\" \n using a7 unfolding conjoin_def same_functions_def by fastforce\n have compat:\"(\\\\\\<^sub>p(l!m) \\ (l!(Suc m))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!m) \\ ((snd (clist!i))!(Suc m))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))) \\ \n (\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m)) \\ \n (\\i\\<^sub>c (snd (clist!i))!m \\\\<^sub>e ((snd (clist!i))!(Suc m))))\"\n using a7 fst_occ unfolding conjoin_def compat_label_def by simp\n {\n assume a20: \"(\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m)) \\ \n (\\i\\<^sub>c (snd (clist!i))!m \\\\<^sub>e ((snd (clist!i))!(Suc m))))\"\n then have \"(snd (l!m),snd (l!(Suc m))) \\ R\" \n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd(l!m), snd(l!(Suc m))) \\ Rely(xs!i)\"\n using fst_occ a3 a0 by fastforce\n then have \"(snd ((snd (clist!i))!m), snd ((snd (clist!i))!(Suc m)) ) \\ Rely(xs!i)\" \n using a7 fst_occ unfolding conjoin_def same_state_def by fastforce \n then have False using fst_occ by auto\n }note l = this\n {\n assume a20:\"(\\\\\\<^sub>p(l!m) \\ (l!(Suc m))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!m) \\ ((snd (clist!i))!(Suc m))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m))))\"\n then obtain i' \n where i':\"i' \n ((fst (clist!i'))\\\\<^sub>c ((snd (clist!i'))!m) \\ ((snd (clist!i'))!(Suc m))) \\ \n (\\li' \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\"\n by fastforce\n then have eq_\\:\"\\ = fst (clist!i')\" using a7 unfolding conjoin_def same_functions_def by fastforce\n obtain fp fs sp ss \n where prod_step: \" \n \\\\\\<^sub>c (fp, fs) \\ (sp,ss) \\ \n fp = fst (((snd (clist!i'))!m)) \\ fs = snd (((snd (clist!i'))!m)) \\ \n sp = fst ((snd (clist!i'))!(Suc m)) \\ ss = snd((snd (clist!i'))!(Suc m)) \\\n \\ = fst (clist!i') \"\n using a7 i' unfolding conjoin_def same_functions_def by fastforce \n then have False\n proof (cases \"i = i'\")\n case True \n then have \"l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\n using step_e_step_c_eq[OF a7] i' fst_occ eq_\\ by blast\n then have \"\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m))\" \n using step_pe.ParEnv by (metis prod.collapse) \n then have \"(snd (l ! m), snd (l ! Suc m)) \\ R \"\n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd (l ! m), snd (l ! Suc m)) \\ Rely (xs ! i)\"\n using a0 a3 fst_occ by fastforce\n then show ?thesis using fst_occ a7\n unfolding conjoin_def same_state_def \n by fastforce \n next\n case False note not_eq = this \n thus ?thesis \n proof (cases \"fp = sp\")\n case True \n then have \"fs = ss \\ (\\ns. fs=Normal ns)\" \n using prod_step step_change_p_or_eq_s_normal[of \"\\\" fp fs sp ss] \n by fastforce\n then have \"\\\\\\<^sub>c (fp, fs) \\\\<^sub>e (sp, ss)\" using True step_e.Env \n by fastforce\n then have \"l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\n using step_e_step_c_eq[OF a7] prod_step i' fst_occ prod.collapse by auto\n then have \"\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m))\" \n using step_pe.ParEnv by (metis prod.collapse) \n then have \"(snd (l ! m), snd (l ! Suc m)) \\ R \"\n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd (l ! m), snd (l ! Suc m)) \\ Rely (xs ! i)\"\n using a0 a3 fst_occ by fastforce\n then show ?thesis using fst_occ a7\n unfolding conjoin_def same_state_def \n by fastforce \n next\n case False \n let ?l1 = \"take (Suc (Suc m)) (snd(clist!i'))\"\n have clist_cptn:\"(\\,snd(clist!i')) \\ cptn\" using a6 i' unfolding cp_def by fastforce\n have sucm_len:\"Suc m < length (snd (clist!i'))\" \n using i' fst_occ a7 unfolding conjoin_def same_length_def by fastforce \n then have summ_lentake:\"Suc m < length ?l1\" by fastforce\n have len_l: \"0[]\" \n using i' a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have \"snd (last (snd (clist ! i'))) = snd (last l)\"\n using a7 i' conjoin_last_same_state by fastforce\n then have last_i_notF:\"snd (last (snd(clist!i'))) \\ Fault ` F\" \n using a9 by auto \n have \"\\i Fault ` F \" \n using last_not_F[OF clist_cptn last_i_notF] by auto \n also have suc_m_i':\"Suc m < length (snd (clist !i'))\"\n using fst_occ i' a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have last_take_not_f:\"snd (last (take (Suc (Suc m)) (snd(clist!i')))) \\ Fault ` F\"\n by (simp add: take_Suc_conv_app_nth) \n have not_env_step:\"\\ \\\\\\<^sub>c snd (clist ! i') ! m \\\\<^sub>e snd (clist ! i') ! Suc m\"\n using False etran_ctran_eq_p_normal_s i' prod_step by blast \n then have \"snd ((snd(clist!i'))!0)\\ Normal ` p\" \n using len_l a7 i' a5 unfolding conjoin_def same_state_def par_assum_def by fastforce\n then have \"snd ((snd(clist!i'))!0)\\ Normal ` (Pre (xs ! i'))\"\n using a1 i' a3 by fastforce\n then have \"snd ((take (Suc (Suc m)) (snd(clist!i')))!0)\\ Normal `(Pre (xs ! i'))\" \n by fastforce \n moreover have \n \"\\j. Suc j < Suc (Suc m) \\\n \\\\\\<^sub>c snd (clist ! i') ! j \\\\<^sub>e snd (clist ! i') ! Suc j \\\n (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\ Rely (xs ! i')\" \n using not_env_step fst_occ Suc_less_eq fist_occ i' less_SucE less_trans_Suc by auto\n then have \"\\j. Suc j < length (take (Suc (Suc m)) (snd(clist!i'))) \\\n \\\\\\<^sub>c snd (clist ! i') ! j \\\\<^sub>e snd (clist ! i') ! Suc j \\\n (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\ Rely (xs ! i')\"\n by fastforce \n ultimately have \"(\\, (take (Suc (Suc m)) (snd(clist!i')))) \\ \n assum ((Pre (xs ! i')),Rely (xs ! i')) F\"\n unfolding assum_def by fastforce \n moreover have \"(\\,snd(clist!i')) \\ cptn\" using a6 i' unfolding cp_def by fastforce\n then have \"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ cptn\"\n by (simp add: takecptn_is_cptn) \n then have \"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ cp \\ (Com(xs!i')) s\"\n using i' a3 a6 unfolding cp_def by fastforce \n ultimately have t:\"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ \n comm (Guar (xs ! i'), (Post (xs ! i'),Abr (xs ! i'))) F \"\n using a8 a2 a3 i' unfolding com_cvalidity_def com_validity_def by fastforce \n have \"(snd(take (Suc (Suc m)) (snd(clist!i'))!m), \n snd(take (Suc (Suc m)) (snd(clist!i'))!(Suc m))) \\ Guar (xs ! i')\"\n using eq_\\ i' comm_dest1[OF t last_take_not_f summ_lentake] by fastforce\n \n then have \"(snd( (snd(clist!i'))!m), \n snd((snd(clist!i'))!(Suc m))) \\ Guar (xs ! i')\"\n by fastforce\n then have \"(snd( (snd(clist!i))!m), \n snd((snd(clist!i))!(Suc m))) \\ Guar (xs ! i')\"\n using a7 fst_occ unfolding conjoin_def same_state_def by (metis Suc_lessD i' snd_conv) \n then have \"(snd( (snd(clist!i))!m), \n snd((snd(clist!i))!(Suc m))) \\ Rely (xs ! i)\"\n using not_eq a0 i' a3 fst_occ by auto \n then have \"False\" using fst_occ by auto\n then show ?thesis by auto\n qed\n qed\n } \n then have False using compat l by auto\n} thus ?thesis by auto\nqed\n\nlemma two: \n \"\\ \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l)\\par_assum (p, R) F;\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i) \"\nproof -\n assume a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a3: \"length xs=length clist\" and\n a4: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a5: \"(\\,l)\\par_assum (p, R) F\" and\n a6: \"\\icp \\ (Com(xs!i)) s\" and\n a7: \"(\\,l) \\ clist\" and\n a8: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and \n a9: \"snd (last l) \\ Fault ` F\"\n {\n assume a10:\"(\\i j. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)) \"\n then obtain j where a10: \"\\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)\"\n by fastforce\n let ?P = \"\\j. \\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)\" \n obtain m where fist_occ:\"?P m \\ (\\i ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n then have P:\"?P m\" by fastforce\n then have notP:\"(\\i ?P i)\" using fist_occ by blast\n obtain i ns ns' where fst_occ:\"i Suc m \n \\\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m) \\ \n (\\ (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\ Guar(xs!i))\"\n using P by fastforce\n have fst_clist_i: \"fst (clist!i) = \\\" \n using a7 fst_occ unfolding conjoin_def same_functions_def \n by fastforce\n have \"clist!i\\cp \\ (Com(xs!i)) s\" using a6 fst_occ by fastforce\n then have clistcp:\"(\\, snd (clist!i))\\cp \\ (Com(xs!i)) s\" \n using fst_occ a7 unfolding conjoin_def same_functions_def by fastforce\n let ?li=\"take (Suc (Suc m)) (snd (clist!i))\" \n have \"\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\"\n using a8 a2 a3 fst_occ unfolding com_cvalidity_def by fastforce\n moreover have take_in_ass:\"(\\, take (Suc (Suc m)) (snd (clist!i))) \\ assum (Pre(xs!i), Rely(xs!i)) F\" \n proof -\n have length_take_length_l:\"length (take (Suc (Suc m)) (snd (clist!i))) \\ length l\"\n using a7 fst_occ unfolding conjoin_def same_length_def by auto\n have \"snd((?li!0)) \\ Normal ` Pre(xs!i)\" \n proof -\n have \"(take (Suc (Suc m)) (snd (clist!i)))!0 = (snd (clist!i))!0\" by fastforce\n moreover have \"snd (snd(clist!i)!0) = snd (l!0)\" \n using a7 fst_occ unfolding conjoin_def same_state_def by fastforce\n moreover have \"snd (l!0) \\ Normal ` p\" \n using a5 unfolding par_assum_def by fastforce\n ultimately show ?thesis using a1 a3 fst_occ by fastforce \n qed note left=this\n thus ?thesis \n using two'[OF a0 a1 a2 a3 a4 a5 a6 a7 a8 a9] fst_occ unfolding assum_def by fastforce\n qed \n moreover have \"(\\,take (Suc (Suc m)) (snd (clist!i))) \\ cp \\ (Com(xs!i)) s\"\n using takecptn_is_cptn clistcp unfolding cp_def by fastforce \n ultimately have comm:\"(\\, take (Suc (Suc m)) (snd (clist!i)))\\comm(Guar(xs!i),(Post (xs ! i),Abr (xs ! i))) F\" \n unfolding com_validity_def by fastforce \n also have not_fault:\"snd (last (take (Suc (Suc m)) (snd (clist!i)))) \\ Fault ` F\"\n proof - \n have cptn:\"(\\, snd (clist!i)) \\ cptn\" \n using fst_clist_i a6 fst_occ unfolding cp_def by fastforce \n then have \"(snd (clist!i))\\[]\" \n using cptn.simps list.simps(3) \n by fastforce \n then have \"snd (last (snd (clist!i))) = snd (last l)\"\n using conjoin_last_same_state fst_occ a7 by fastforce\n then have \"snd (last (snd (clist!i))) \\ Fault ` F\" using a9\n by simp\n also have sucm:\"Suc m < length (snd (clist!i))\" \n using fst_occ a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have sucm_not_fault:\"snd ((snd (clist!i))!(Suc m)) \\ Fault ` F\"\n using last_not_F cptn by blast \n have \"length (take (Suc (Suc m)) (snd (clist!i))) = Suc (Suc m)\" \n using sucm by fastforce\n then have \"last (take (Suc (Suc m)) (snd (clist!i))) = (take (Suc (Suc m)) (snd (clist!i)))!(Suc m)\"\n by (metis Suc_diff_1 Suc_inject last_conv_nth list.size(3) old.nat.distinct(2) zero_less_Suc)\n moreover have \"(take (Suc (Suc m)) (snd (clist!i)))!(Suc m) = (snd (clist!i))!(Suc m)\" \n by fastforce \n ultimately show ?thesis using sucm_not_fault by fastforce\n qed\n then have \" (Suc m < length (snd (clist ! i)) ) \\\n (\\\\\\<^sub>c (snd (clist ! i)) ! m \\ (snd (clist ! i)) ! Suc m) \\ \n (snd ((snd (clist ! i)) ! m), snd ((snd (clist ! i)) ! Suc m)) \\ Guar(xs!i)\"\n using comm_dest [OF comm not_fault] by auto \n then have \"False\" using fst_occ using a7 unfolding conjoin_def same_length_def by fastforce\n } thus ?thesis by fastforce\nqed\n\nlemma par_cptn_env_comp:\n \"(\\,l) \\ par_cptn \\ Suc i \n \\\\\\<^sub>p l!i \\\\<^sub>e (l!(Suc i)) \\ \\ \\\\<^sub>p l!i \\ (l!(Suc i))\"\nproof -\n assume a0:\"(\\,l) \\ par_cptn \\ Suc i l!(Suc i) = (c2,s2)\" by fastforce\n obtain xs ys where l:\"l= xs@((l!i)#(l!(Suc i))#ys)\" using a0\n by (metis Cons_nth_drop_Suc Suc_less_SucD id_take_nth_drop less_SucI)\n moreover then have \"(drop (length xs) l) = ((l!i)#(l!(Suc i))#ys)\"\n by (metis append_eq_conv_conj) \n moreover then have \"length xs < length l\" using leI by fastforce \n ultimately have \"(\\,((l!i)#(l!(Suc i))#ys))\\par_cptn\" \n using a0 droppar_cptn_is_par_cptn by fastforce\n also then have \"(\\,(l!(Suc i))#ys)\\par_cptn\" using par_cptn_dest li by fastforce\n ultimately show ?thesis using li par_cptn_elim_cases(2)\n by metis\nqed\n\n\nlemma three:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R) F;\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist; (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i. i Suc j \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\\n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n (R \\ (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j))))\"\nproof -\n assume a0:\"xs\\[]\" and\n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2: \"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a4: \"length xs=length clist\" and\n a5: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a6: \"(\\,l) \\ par_assum(p, R) F\" and\n a7: \"\\icp \\ (Com(xs!i)) s\" and\n a8: \"(\\,l) \\ clist\" and\n a9: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and\n 10: \"snd (last l) \\ Fault ` F\" \n {\n fix j i ns ns'\n assume a00:\"i Suc j\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j)\" \n then have two:\"\\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ (Guar(xs!i))\"\n using two[OF a1 a2 a3 a4 a5 a6 a7 a8 a9 10] by auto\n then have j_lenl:\"Suc j i:\"\\i\" using a8 unfolding conjoin_def same_functions_def by fastforce\n have \"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))) \\ \n (\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\"\n using a8 a00 unfolding conjoin_def compat_label_def by simp\n then have compat_label:\"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))) \\ \n (\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\"\n using fst_clist_\\ by blast\n then have \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n (R \\ (\\j\\{j. j < length xs \\ j \\ i}. Guar (xs ! j)))\" \n proof \n assume a10:\"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j))))\" \n then obtain i' where \n a20:\"i' \n (\\\\\\<^sub>c ((snd (clist!i'))!j) \\ ((snd (clist!i'))!(Suc j))) \\ \n (\\li' \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))\" by blast \n thus ?thesis \n proof (cases \"i'=i\")\n case True note eq_i = this \n then obtain P S1 S2 where P:\"(snd (clist!i'))!j=(P,S1) \\ ((snd (clist!i'))!(Suc j)) = (P,S2)\" \n using a11 by (fastforce elim:etranE) \n thus ?thesis \n proof (cases \"S1 = S2\")\n case True \n have snd_lj:\"(snd (l!j)) = snd ((snd (clist!i'))!j)\"\n using a8 a20 a00 unfolding conjoin_def same_state_def\n by fastforce \n have all_e:\"(\\l\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))\"\n using a11 a20 eq_i by fastforce\n then have allP:\"\\l< length clist. fst ((snd (clist!l))!j) = fst ((snd (clist!l))!(Suc j))\"\n by (fastforce elim:etranE)\n then have \"fst (l!j) = (fst (l!(Suc j)))\"\n using a8 conjoin_same_program_i_j [of \"(\\,l)\"] a00 by fastforce\n also have \"snd (l!j) = snd (l!(Suc j))\"\n proof - \n have \"(snd (l!Suc j)) = snd ((snd (clist!i'))!(Suc j))\"\n using a8 a20 a00 unfolding conjoin_def same_state_def\n by fastforce\n then show ?thesis using snd_lj P True by auto\n qed \n ultimately have \"l!j = l!(Suc j)\" by (simp add: prod_eq_iff) \n moreover have ns1:\"\\ns1. S1=Normal ns1\" \n using P a20 step_change_p_or_eq_s_normal by fastforce \n ultimately have \"\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j))\" \n using P step_pe.ParEnv snd_lj by (metis prod.collapse snd_conv) \n then have \"(snd (l ! j), snd (l ! Suc j)) \\ R \"\n using a00 a6 unfolding par_assum_def by fastforce\n then show ?thesis using a8 a00 \n unfolding conjoin_def same_state_def \n by fastforce\n next\n case False thus ?thesis \n using a20 P a11 step_change_p_or_eq_s by fastforce\n qed\n next\n case False \n have i'_clist:\"i' < length clist\" using a20 by fastforce\n then have clist_i'_Guardxs:\"(snd((snd (clist!i'))!j), snd((snd (clist!i'))!Suc j)) \\ Guar(xs!i')\"\n using two a00 False a8 unfolding conjoin_def same_state_def\n by (metis a20)\n have \"snd((snd (clist!i))!j) = snd (l!j) \\ snd((snd (clist!i))!Suc j) = snd (l!Suc j)\" \n using a00 a20 a8 unfolding conjoin_def same_state_def by fastforce\n also have \"snd((snd (clist!i'))!j) = snd (l!j) \\ snd((snd (clist!i'))!Suc j) = snd (l!Suc j)\"\n using j_lenl a20 a8 unfolding conjoin_def same_state_def by fastforce\n ultimately have \"snd((snd (clist!i))!j) = snd((snd (clist!i'))!j) \\ \n snd((snd (clist!i))!Suc j) = snd((snd (clist!i'))!Suc j)\" \n by fastforce\n then have clist_i_Guardxs:\n \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n Guar(xs!i')\" \n using clist_i'_Guardxs by fastforce \n thus ?thesis \n using False a20 a4 by fastforce \n qed\n next\n assume a10:\"(\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\" \n then have \"(snd (l ! j), snd (l ! Suc j)) \\ R\"\n using a00 a10 a6 unfolding par_assum_def by fastforce\n then show ?thesis using a8 a00 \n unfolding conjoin_def same_state_def\n by fastforce\n qed\n } thus ?thesis by blast\nqed\n\n \nlemma four:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n (\\j (G);\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R) F; Suc i < length l;\n \\\\\\<^sub>p (l!i) \\ (l!(Suc i));\n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ (snd (l ! i), snd (l ! Suc i)) \\ G\"\nproof -\n assume a0:\"xs\\[]\" and\n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2:\"(\\j (G)\" and\n a3:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a5:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a6:\"(\\,l) \\ par_assum(p, R) F\" and\n a7: \"Suc i < length l\" and\n a8:\"\\\\\\<^sub>p (l!i) \\ (l!(Suc i))\" and \n a10:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and\n a11:\"snd (last l) \\ Fault ` F\"\n have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def by fastforce \n then have \"(ParallelCom xs)\\[]\" using a0 by fastforce \n then have \"(\\,l) \\{(\\1,c). \\clist. (length clist)=(length (ParallelCom xs)) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,c) \\ clist \\ \\1=\\}\"\n using one a5 by fastforce\n then obtain clist where \"(length clist)=(length xs) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,l) \\ clist\"\n using length_par_xs by auto\n then have conjoin:\"(length clist)=(length xs) \\ \n (\\i cp \\ (Com (xs ! i)) s) \\ (\\,l) \\ clist\"\n using ParallelCom_Com by fastforce\n then have length_xs_clist:\"length xs = length clist\" by auto \n have clist_cp:\"\\i cp \\ (Com (xs ! i)) s\" using conjoin by auto\n have conjoin:\"(\\,l) \\ clist\" using conjoin by auto \n have l_not_empty:\"l\\[]\" using a5 par_cptn.simps unfolding par_cp_def by fastforce\n then have l_g0:\"0i< length l. fst (l!i) = map (\\x. fst ((snd x)!i)) clist\"\n using conjoin unfolding conjoin_def same_program_def by fastforce\n obtain Ps si Ps' ssi where li:\"l!i = (Ps,si) \\ l!(Suc i) = (Ps', ssi)\" by fastforce\n then have \"\\j r. j Ps' = Ps[j:=r] \\ (\\\\\\<^sub>c((Ps!j),si) \\ (r, ssi))\" \n using a8 par_ctranE by fastforce\n then obtain j r where step_c:\"j Ps' = Ps[j:=r] \\ (\\\\\\<^sub>c((Ps!j),si) \\ (r, ssi))\"\n by auto \n have length_Ps_clist:\n \"length Ps = length clist \\ length Ps = length Ps'\" \n using conjoin a7 conjoin_same_length li step_c by fastforce\n have from_step:\"(snd (clist!j))!i = ((Ps!j),si) \\ (snd (clist!j))!(Suc i) = (Ps'!j,ssi)\" \n proof - \n have f2: \"Ps = fst (snd (\\, l) ! i)\" and f2':\"Ps' = fst (snd (\\, l) ! (Suc i))\"\n using li by auto\n have f3:\"si = snd (snd (\\, l) ! i) \\ ssi = snd (snd (\\, l) ! (Suc i))\"\n by (simp add: li)\n then have \"(snd (clist!j))!i = ((Ps!j),si)\"\n using f2 conjoin a7 step_c unfolding conjoin_def same_program_def same_state_def by force \n moreover have \"(snd (clist!j))!(Suc i) = (Ps'!j,ssi)\"\n using f2' f3 conjoin a7 step_c length_Ps_clist \n unfolding conjoin_def same_program_def same_state_def \n by auto\n ultimately show ?thesis by auto\n qed \n then have step_clist:\"\\\\\\<^sub>c(snd (clist!j))!i \\ (snd (clist!j))!(Suc i)\" \n using from_step step_c by fastforce\n have j_xs:\"ji j ns ns'. j < length clist \\ Suc i < length l \\\n \\\\\\<^sub>c snd (clist ! j) ! i \\ snd (clist ! j) ! Suc i \\ \n (snd (snd (clist ! j) ! i), snd (snd (clist ! j) ! Suc i)) \\ Guar (xs ! j)\"\n using two[OF a1 a3 a4 length_xs_clist a5 a6 clist_cp conjoin a10 a11] by auto\n ultimately have \"(snd (snd (clist ! j) ! i), snd (snd (clist ! j) ! Suc i)) \\ Guar (xs ! j)\"\n using a7 step_c length_Ps_clist step_clist by metis \n then have \"(snd (l!i), snd (l!(Suc i)))\\ Guar (xs ! j)\"\n using from_step a2 length_xs_clist step_c li by fastforce\n then show ?thesis using a2 j_xs\n unfolding sep_conj_def tran_True_def after_def Satis_def by fastforce\nqed\n\nlemma same_program_last:\"l\\[] \\ (\\,l) \\ clist \\ ifst (last (snd (clist!i))) = fst (last l) ! i\" \nproof -\n assume l_not_empty:\"l\\[]\" and\n conjoin: \"(\\,l) \\ clist\" and\n i_clist: \"iix. fst (snd x ! ((length l)-1))) clist\"\n using l_not_empty last_l conjoin unfolding conjoin_def same_program_def by auto\n also have \"(map (\\x. fst (snd x ! ((length l)-1))) clist)!i = \n fst ((snd (clist!i))! ((length l)-1))\" using i_clist by fastforce\n also have \"fst ((snd (clist!i))! ((length l)-1)) = \n fst ((snd (clist!i))! ((length (snd (clist!i)))-1))\" \n using conjoin i_clist unfolding conjoin_def same_length_def by fastforce\n also then have \"fst ((snd (clist!i))! ((length (snd (clist!i)))-1)) = fst (last (snd (clist!i)))\"\n using i_clist l_not_empty conjoin last_clist_eq_l last_conv_nth unfolding conjoin_def same_length_def\n by presburger\n finally show ?thesis by auto\nqed\n\n\n\nlemma five:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii q;\n (\\i a ;\n \\i < length xs.\n \\,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R) F;\n All_End (last l); snd (last l) \\ Fault ` F;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \\ \n (\\j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\"\nproof-\n assume a0:\"xs\\[]\" and \n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2:\"p \\ (\\ii q\" and\n a4:\"(\\i a\" and\n a5:\"\\i < length xs.\n \\,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), \n Rely (xs ! i), Guar (xs ! i), \n Post (xs ! i),Abr (xs ! i)]\" and\n a6:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a7:\"(\\,l) \\ par_assum(p, R) F\"and\n a8:\"All_End (last l)\" and\n a9:\"snd (last l) \\ Fault ` F\" and\n a10:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\"\n have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def by fastforce \n then have \"(ParallelCom xs)\\[]\" using a0 by fastforce\n then have \"(\\,l) \\{(\\1,c). \\clist. (length clist)=(length (ParallelCom xs)) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,c) \\ clist \\ \\1=\\}\"\n using one a6 by fastforce\n then obtain clist where \"(length clist)=(length xs) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,l) \\ clist\"\n using length_par_xs by auto\n then have conjoin:\"(length clist)=(length xs) \\ \n (\\i cp \\ (Com (xs ! i)) s) \\ (\\,l) \\ clist\"\n using ParallelCom_Com by fastforce\n then have length_xs_clist:\"length xs = length clist\" by auto\n (*have length_l_clist: \"length l = length clist\" \n using conjoin unfolding conjoin_def same_length_def *)\n have clist_cp:\"\\i cp \\ (Com (xs ! i)) s\" using conjoin by auto\n have conjoin:\"(\\,l) \\ clist\" using conjoin by auto\n have l_not_empty:\"l\\[]\" using a6 par_cptn.simps unfolding par_cp_def by fastforce\n then have l_g0:\"0i assum (Pre (xs!i),Rely (xs!i)) F\" \n proof -\n { fix i\n assume i_length:\"i1 li where clist:\"clist!i=(\\1,li)\" by fastforce \n then have \\eq:\"\\1=\\\" \n using conjoin i_length unfolding conjoin_def same_functions_def by fastforce\n have \"(\\1,li) \\ assum (Pre (xs!i),Rely (xs!i)) F\"\n proof-\n have l:\"snd (li!0) \\ Normal ` ( (Pre (xs!i)))\"\n proof - \n have snd_l:\"snd (\\,l) = l\" by fastforce \n have \"snd (l!0) \\ Normal ` (p)\" \n using a7 unfolding par_assum_def by fastforce \n also have \"snd (l!0) = snd (li!0)\" \n using i_length conjoin l_g0 clist \n unfolding conjoin_def same_state_def by fastforce\n finally show ?thesis using a2 i_length length_xs_clist\n by auto \n qed \n have r:\"(\\j. Suc j < length li \\ \n \\\\\\<^sub>c(li!j) \\\\<^sub>e (li!(Suc j)) \\ \n (snd(li!j), snd(li!(Suc j))) \\ Rely (xs!i))\" \n using three[OF a0 a1 a2 a5 length_xs_clist a6 a7 clist_cp conjoin a10 a9] \n i_length conjoin a1 length_xs_clist clist \n unfolding assum_def conjoin_def same_length_def by fastforce \n show ?thesis using l r \\eq unfolding assum_def by fastforce\n qed \n then have \"clist!i \\ assum (Pre (xs!i),Rely (xs!i)) F\" using clist by auto \n } thus ?thesis by auto\n qed\n then have clist_com:\"\\i comm (Guar (xs!i),(Post(xs!i),Abr (xs!i))) F\"\n using a5 unfolding com_cvalidity_def \n using a10 unfolding com_validity_def using clist_cp length_xs_clist\n by force \n have last_clist_eq_l:\"\\iiiij snd (last l) \\ Normal ` q)\"\n proof -\n {fix j\n assume aj:\"ji Normal ` Post(xs!i)\"\n proof-\n {fix i \n assume a20:\"i Fault ` F\"\n using a9 last_clist_l a20 by fastforce\n have \"fst (last l) ! i = Skip\" \n using a20 ac1 conjoin_same_length[OF conjoin]\n by (simp add: l_not_empty last_l ) \n also have \"fst (last l) ! i=fst (last (snd (clist!i)))\"\n using same_program_last[OF l_not_empty conjoin a20] by auto\n finally have \"fst (last (snd (clist!i))) = Skip\" .\n then have \"snd (last (snd (clist!i))) \\ Normal ` Post(xs!i)\" \n using clist_com last_clist_not_F a20\n unfolding comm_def final_def by fastforce\n } thus ?thesis by auto \n qed \n then have \"\\i Normal ` Post(xs!i)\" \n using last_clist_l length_xs_clist by fastforce\n then have \"\\ix\\( Post(xs!i)). snd (last l) = Normal x\"\n by fastforce\n moreover have \"\\t. (\\i Post (xs ! i))\\ t\\ q\" using a3\n by fastforce \n ultimately have \"(\\x\\ q. snd (last l) = Normal x)\" using a0\n by (metis (mono_tags, lifting) length_greater_0_conv xstate.inject(1)) \n then have \"snd (last l) \\ Normal ` q\" by fastforce \n then have \"fst (last l) ! j = LanguageCon.com.Skip \\ snd (last l) \\ Normal ` q\"\n using aj ac1 by fastforce\n } thus ?thesis by auto\n qed \n thus ?thesis by auto\n next\n assume \"\\ (\\i fst (last l)!i \\ Skip\" \n by fastforce\n then have last_i_throw:\"fst (last l)!i = Throw \\ (\\n. snd (last l) = Normal n)\" \n using a8 unfolding All_End_def final_def by fastforce \n have \"length (fst (last l)) = length clist\" \n using conjoin_same_length[OF conjoin] l_not_empty last_l\n by simp\n then have i_length:\"i Fault ` F\"\n using a9 last_clist_l i_length by fastforce\n then have \"fst (last (snd (clist!i))) = fst (last l) ! i\" \n using i_length same_program_last [OF l_not_empty conjoin] by fastforce\n then have \"fst (last (snd (clist!i))) = Throw\"\n using last_i_throw by fastforce\n then have \"snd (last (snd (clist!i))) \\ Normal ` Abr(xs!i)\" \n using clist_com last_clist_not_F i_length last_i_throw snd_last\n unfolding comm_def final_def by fastforce\n then have \"snd (last l)\\ Normal ` Abr(xs!i)\" using last_clist_l i_length\n by fastforce\n then have \"snd (last l)\\ Normal ` (a)\" using a4 a0 i_length length_xs_clist by fastforce\n then have \"\\j snd (last l) \\ Normal ` a\"\n using last_i_throw a20 by fastforce\n thus ?thesis by auto\n qed \nqed\n\n\nlemma ParallelEmpty [rule_format]:\n \"\\i s. (\\,l) \\ par_cp \\ (ParallelCom []) s \\\n Suc i < length l \\ \\ (\\ \\\\<^sub>p (l!i) \\ (l!Suc i))\"\napply(induct_tac l)\n apply simp\napply clarify\napply(case_tac list,simp,simp)\napply(case_tac i)\n apply(simp add:par_cp_def ParallelCom_def) \n apply(erule par_ctranE,simp)\napply(simp add:par_cp_def ParallelCom_def)\napply clarify\napply(erule par_cptn.cases,simp)\n apply simp\nby (metis list.inject list.size(3) not_less0 step_p_pair_elim_cases)\n\nlemma ParallelEmpty2:\n assumes a0:\"(\\,l) \\ par_cp \\ (ParallelCom []) s\" and\n a1: \"i < length l\" \n shows \"fst (l!i) = []\"\nproof -\n have paremp:\"ParallelCom [] = []\" unfolding ParallelCom_def by auto\n then have l0:\"l!0 =([],s)\" using a0 unfolding par_cp_def by auto\n then have \"(\\,l) \\ par_cptn\" using a0 unfolding par_cp_def by fastforce\n thus ?thesis using l0 a1\n proof (induct arbitrary: i s) \n case ParCptnOne thus ?case by auto\n next\n case (ParCptnEnv \\ P s1 t xs i s)\n thus ?case\n proof -\n have f1: \"i < Suc (Suc (length xs))\"\n using ParCptnEnv.prems(2) by auto\n have \"(P, s1) = ([], s)\"\n using ParCptnEnv.prems(1) by auto\n then show ?thesis\n using f1 by (metis (no_types) ParCptnEnv.hyps(3) diff_Suc_1 fst_conv length_Cons less_Suc_eq_0_disj nth_Cons')\n qed \n next\n case (ParCptnComp \\ P s1 Q t xs) \n have \"(\\, (P,s1)#(Q, t) # xs) \\ par_cp \\ (ParallelCom []) s1\" \n using ParCptnComp(4) ParCptnComp(1) step_p_elim_cases by fastforce\n then have \"\\ \\\\\\<^sub>p (P, s1) \\ (Q, t)\" using ParallelEmpty ParCptnComp by fastforce\n thus ?case using ParCptnComp by auto\n qed\nqed \n\nlemma parallel_sound: \n \"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i)) \\\n (\\j G \\\n p \\ (\\i\n (\\i q \\\n (\\i a \\ \n \\i,\\ \\\\<^bsub>/F\\<^esub> Com (xs !i) sat [Pre (xs !i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> ParallelCom xs SAT [p, R, G, q,a]\n \"\nproof -\n assume \n a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"(\\j G\" and\n a2:\"p \\ (\\ii q\" and\n a4:\"(\\i a\" and\n a5:\"\\i,\\ \\\\<^bsub>/F\\<^esub> Com (xs !i) sat [Pre (xs !i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\"\n { \n assume a00:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\"\n { fix s l\n assume a10: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s \\ (\\,l) \\ par_assum(p, R) F\" \n then have c_par_cp:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" by auto\n have c_par_assum: \"(\\,l) \\ par_assum(p, R) F\" using a10 by auto\n { fix i ns ns'\n assume a20:\"snd (last l) \\ Fault ` F\"\n {\n assume a30:\"Suc i\\\\<^sub>p(l!i) \\ (l!(Suc i))\" \n have xs_not_empty:\"xs\\[]\" \n proof -\n {\n assume \"xs = []\"\n then have \"\\ (\\ \\\\<^sub>p (l!i) \\ (l!Suc i))\" \n using a30 a10 ParallelEmpty by fastforce\n then have False using a31 by auto\n } thus ?thesis by auto\n qed \n then have \"(snd(l!i), snd(l!(Suc i))) \\ G\"\n using four[OF xs_not_empty a0 a1 a2 a5 c_par_cp c_par_assum a30 a31 a00 a20] by blast\n \n } then have \"Suc i \n \\\\\\<^sub>p(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G \" by auto \n note l = this\n { assume a30:\"All_End (last l)\"\n then have xs_not_empty:\"xs\\[]\" \n proof - \n { assume xs_emp:\"xs=[]\"\n have lenl:\"0j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\"\n using five[OF xs_not_empty a0 a2 a3 a4 a5 c_par_cp c_par_assum a30 a20 a00] by blast\n } then have \"All_End (last l) \\ \n (\\j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\" by auto \n note res1 = conjI[OF l this] \n }\n then have \"(\\,l) \\ par_comm(G, (q,a)) F\" unfolding par_comm_def by auto \n } \n then have \"\\ \\\\<^bsub>/F\\<^esub> (ParallelCom xs) SAT [p, R, G, q,a]\" \n unfolding par_com_validity_def par_cp_def by fastforce\n } thus ?thesis using par_com_cvalidity_def by fastforce\nqed\n\n\ntheorem \n par_rgsound:\"\\,\\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (ParallelCom Ps) SAT [p, R, G, q,a]\"\nproof (induction rule:par_rghoare.induct)\n case (Parallel xs R G p q a \\ \\ F)\n thus ?case using localRG_sound parallel_sound[of xs R G p q a \\ \\ F] \n by fast\nqed\nlemma Conseq':\"\\s. s\\p \\\n (\\p' q' a' R' G'. \n (\\Z. \\,\\\\\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)]) \\\n (\\ Z. s\\p' Z \\ (q' Z \\ q) \\ (a' Z \\ a) \\ (G' Z \\ G) \\ (R \\ R' Z)))\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule Conseq) meson\n\nlemma conseq:\"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)];\n \\s. s \\ p \\ (\\ Z. s\\p' Z \\ (q' Z \\ q) \\ (a' Z \\ a) \\ (G' Z \\ G) \\ (R \\ R' Z))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule Conseq) meson\n\nlemma conseqPrePost[trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'] \\\n p\\p' \\ q' \\ q \\ a' \\ a \\ G' \\ G \\ R \\ R' \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule conseq) auto\n\nlemma conseqPre[trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R, G, q,a] \\\n p\\p' \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule conseq) auto\n\nlemma conseqPost[trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \\\n q'\\q \\ a'\\a \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule conseq) auto\n\ninductive_cases hoare_elim_skip_cases [cases set]:\n\"\\,\\\\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\n\n\n(* abbreviation \n \"stepc_rtrancl\" :: \"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ ((CONST stepc \\))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/LocalRG_HoareDefValidityN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512488, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2861149919934692}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_alpha_par\nimports CSP_F_op_alpha_par CSP_F_law_decompo \n CSP_T.CSP_T_law_alpha_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*****************************************************************\n\n 1. associativity of |[X,Y]|\n 2. commutativity of |[X,Y]|\n 3. monotonicity of |[X,Y]|\n 4. \n\n *****************************************************************)\n\n(*********************************************************\n P |[X,Y]| Q\n *********************************************************)\n\n(************************************\n | SKIP and SKIP |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_SKIP_Alpha_parallel:\n \"(SKIP |[{}, {}]| SKIP) =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Alpha_parallel)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n\n apply (simp add: in_failures)\n apply (elim disjE)\n apply (simp_all)\n apply (simp add: Evset_def)\n apply (subgoal_tac \"(s = <> | s = )\")\n apply (erule disjE)\n apply (simp)\n apply (fast)\n apply (simp)\n apply (simp add: sett_subset_Tick)\n\n apply (subgoal_tac \"(s = <> | s = )\")\n apply (erule disjE)\n apply (simp)\n apply (simp)\n apply (simp add: sett_subset_Tick)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (rule_tac x=\"X\" in exI)\n apply (rule_tac x=\"X\" in exI)\n apply (simp)\n\n apply (simp add: in_failures)\n apply (auto)\ndone\n\n(************************************\n | associativity |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Alpha_parallel_ass_lm1:\n \"Ya Int insert Tick (Ev ` X1) Un\n (Za Int insert Tick (Ev ` X2) Un Z Int insert Tick (Ev ` X3)) =\n Ya Int insert Tick (Ev ` X1) Un\n (Za Int insert Tick (Ev ` X2) Un Z Int insert Tick (Ev ` X3)) Int\n insert Tick (Ev ` (X2 Un X3))\"\nby (auto)\n\nlemma cspF_Alpha_parallel_assoc:\n \"(P1 |[X1, X2]| P2) |[X1 Un X2, X3]| P3 =F[M,M]\n P1 |[X1, X2 Un X3]| (P2 |[X2, X3]| P3)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Alpha_parallel_assoc)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (simp add: Un_upper1 Un_upper2 rest_tr_of_rest_tr_subset)\n apply (rule_tac x=\"Ya\" in exI, simp)\n apply (rule_tac x=\"(Za Int insert Tick (Ev ` X2)) Un \n (Z Int insert Tick (Ev ` X3))\" in exI)\n apply (simp add: Un_assoc)\n apply (simp add: cspF_Alpha_parallel_ass_lm1)\n\n apply (rule_tac x=\"Za\" in exI, simp)\n apply (rule_tac x=\"Z\" in exI, simp)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (simp add: Un_upper1 Un_upper2 rest_tr_of_rest_tr_subset)\n apply (rule_tac x=\"Y Int insert Tick (Ev ` X1) Un\n (Ya Int insert Tick (Ev ` X2))\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp add: Un_assoc)\n apply (rule conjI)\n apply (fast)\n\n apply (rule_tac x=\"Y\" in exI, simp)\n apply (rule_tac x=\"Ya\" in exI, simp)\n apply (force)\ndone\n\nlemma cspF_Alpha_parallel_assoc_sym:\n \"P1 |[X1, X2 Un X3]| (P2 |[X2, X3]| P3) =F[M,M]\n (P1 |[X1, X2]| P2) |[X1 Un X2, X3]| P3\"\napply (rule cspF_sym)\nby (simp add: cspF_Alpha_parallel_assoc)\n\n(************************************\n | commutativity |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Alpha_parallel_commut:\n \"(P1 |[X1, X2]| P2) =F[M,M] (P2 |[X2, X1]| P1)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Alpha_parallel_commut)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Z\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (simp add: Un_sym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Z\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (simp add: Un_sym)\ndone\n\n(************************************\n | monotonicity |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Alpha_parallel_mono:\n \"[| X1 = X2 ; Y1 = Y2 ;\n P1 <=F[M1,M2] Q1 ; \n P2 <=F[M1,M2] Q2 |]\n ==> P1 |[X1,Y1]| P2 <=F[M1,M2] Q1 |[X2,Y2]| Q2\"\napply (simp add: Alpha_parallel_def)\napply (simp add: cspF_Parallel_mono)\ndone\n\nlemma cspF_Alpha_parallel_cong:\n \"[| X1 = X2 ; Y1 = Y2 ;\n P1 =F[M1,M2] Q1 ; \n P2 =F[M1,M2] Q2 |]\n ==> P1 |[X1,Y1]| P2 =F[M1,M2] Q1 |[X2,Y2]| Q2\"\nby (simp add: cspF_eq_ref_iff cspF_Alpha_parallel_mono)\n\nlemmas cspF_decompo_Alpha_parallel = cspF_Alpha_parallel_mono\n cspF_Alpha_parallel_cong\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_alpha_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.2861149799807242}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartialDef.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Hoare Logic for Partial Correctness\\\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\ 'p \\ 's assn \\ 's assn)\"\n\nsubsection \\Validity of Hoare Tuples: \\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\ndefinition\n valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n (\"_\\\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\s t. \\\\\\c,s\\ \\ t \\ s \\ Normal ` P \\ t \\ Fault ` F \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n\ndefinition\n cvalid::\n \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n (\"_,_\\\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n nvalid :: \"[('s,'p,'f) body,nat,'f set, \n 's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n (\"_\\_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \\ \\s t. \\\\\\c,s \\ =n\\ t \\ s \\ Normal ` P \\ t \\ Fault ` F \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n\n\ndefinition\n cnvalid::\n \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set, \n 's assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_,_\\_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ASCII)\n valid (\"_|='/_/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60) and\n cvalid (\"_,_|='/_/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60) and\n nvalid (\"_|=_:'/_/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60) and\n cnvalid (\"_,_|=_:'/_/ _ _ _,_\" [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection \\Properties of Validity\\\n\nlemma valid_iff_nvalid: \"\\\\\\<^bsub>/F\\<^esub> P c Q,A = (\\n. \\\\n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n apply (simp only: valid_def nvalid_def exec_iff_execn )\n apply (blast dest: exec_final_notin_to_execn)\n done\n \nlemma cnvalid_to_cvalid: \"(\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A) \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n apply fast\n done\n\nlemma nvalidI: \n \"\\\\s t. \\\\\\\\c,Normal s \\ =n\\ t;s \\ P; t\\ Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: nvalid_def)\n\nlemma validI: \n \"\\\\s t. \\\\\\\\c,Normal s \\ \\ t;s \\ P; t\\Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: valid_def)\n\nlemma cvalidI: \n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P;t\\Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A;\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P;t\\Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI: \n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n \\\\\\c,Normal s \\ =n\\ t;s \\ P;t\\Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD: \n \"\\\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A;\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n \\\\\\c,Normal s \\ =n\\ t;s \\ P;\n t\\Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n assumes validn:\"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n fix s t\n assume exec: \"\\\\\\c,Normal s \\ =n\\ t\" \n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F'\"\n with F' have \"t \\ Fault ` F\"\n by blast\n with exec P validn\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n assumes validn:\"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n fix s t\n assume exec: \"\\\\\\c,Normal s \\ \\ t\" \n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F'\"\n with F' have \"t \\ Fault ` F\"\n by blast\n with exec P validn\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n assumes validn:\"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F' \\ -F\"\n shows \"strip F' \\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n fix s t\n assume exec_strip: \"strip F' \\\\\\c,Normal s \\ =n\\ t\" \n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F\"\n from exec_strip obtain t' where\n exec: \"\\\\\\c,Normal s \\ =n\\ t'\" and\n t': \"t' \\ Fault ` (-F') \\ t'=t\" \"\\ isFault t' \\ t'=t\"\n by (blast dest: execn_strip_to_execn)\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"t' \\ Fault ` F\")\n case True\n with t' F F' have False\n by blast\n thus ?thesis ..\n next\n case False\n with exec P validn\n have *: \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: nvalid_def)\n with t' have \"t'=t\"\n by auto\n with * show ?thesis\n by simp\n qed\nqed\n\n\nlemma valid_to_valid_strip:\n assumes valid:\"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F' \\ -F\"\n shows \"strip F' \\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n fix s t\n assume exec_strip: \"strip F' \\\\\\c,Normal s \\ \\ t\" \n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F\"\n from exec_strip obtain t' where\n exec: \"\\\\\\c,Normal s \\ \\ t'\" and\n t': \"t' \\ Fault ` (-F') \\ t'=t\" \"\\ isFault t' \\ t'=t\"\n by (blast dest: exec_strip_to_exec)\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"t' \\ Fault ` F\")\n case True\n with t' F F' have False\n by blast\n thus ?thesis ..\n next\n case False\n with exec P valid\n have *: \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: valid_def)\n with t' have \"t'=t\"\n by auto\n with * show ?thesis\n by simp\n qed\nqed\n\n\nsubsection \\The Hoare Rules: \\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\nlemma mono_WeakenContext: \"A \\ B \\\n (\\(P, c, Q, A'). (\\, \\, F, P, c, Q, A') \\ A) x \\\n (\\(P, c, Q, A'). (\\, \\, F, P, c, Q, A') \\ B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\,\\\\\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\,\\\\\\<^bsub>/F\\<^esub> {s. f s \\ Q} (Basic f) Q,A\"\n\n| Spec: \"\\,\\\\\\<^bsub>/F\\<^esub> {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} (Spec r) Q,A\"\n\n| Seq: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n \n| Cond: \"\\\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c\\<^sub>1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> (P \\ - b) c\\<^sub>2 Q,A\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n\n| Guard: \"\\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\f \\ F; \\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n \"\\(P,p,Q,A) \\ Specs; \n \\(P,p,Q,A) \\ Specs. p \\ dom \\ \\ \\,\\\\Specs\\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A \\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n \"\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> P (c s) Q,A \n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\,\\\\\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\(P,p,Q,A) \\ \\\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A; \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n \\ \\This is a hack rule that enables us to derive completeness for\n an arbitrary context \\\\\\, from completeness for an empty context.\\ \n\n\n\ntext \\Does not work, because of rule ExFalso, the context \\\\\\ is to blame.\n A weaker version with empty context can be derived from soundness \n and completeness later on.\\\nlemma hoare_strip_\\: \n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"strip (-F) \\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv \nproof induct\n case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n case While thus ?case by (iprover intro: hoarep.While)\nnext\n case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\ \\ init p\n result return )\n from CallRec.hyps\n have \"\\p\\Procs. \\Z. (strip \\),\\ \\\n (\\\\<^bsub>p\\Procs\\<^esub>\n \\\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n Post p Z, Abr p Z)})\\\n (Pre p Z) (the (\\ p)) (R p Z),(Abr' p Z)\" by blast\n hence \"\\p\\Procs. \\Z. (strip \\),\\ \\\n (\\\\<^bsub>p\\Procs\\<^esub>\n \\\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n Post p Z, Abr p Z)})\\\n (Pre p Z) (the ((strip \\) p)) (R p Z),(Abr' p Z)\"\n by (auto intro: hoarep.StripI)\n then show ?case\n apply - \n apply (rule hoarep.CallRec)\n apply (assumption | simp only:dom_strip)+\n done*)\nnext\n case DynCom \n thus ?case\n by - (rule hoarep.DynCom,best elim!: ballE exE)\nnext\n case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next \n case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n case ExFalso\n thus ?case\n oops\n\nlemma hoare_augment_context: \n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\\\'. \\ \\ \\' \\ \\,\\'\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n case CallRec\n case (CallRec P p Q A Specs \\ F \\')\n from CallRec.prems\n have \"\\\\Specs\n \\ \\'\\Specs\"\n by blast\n with CallRec.hyps (2) \n have \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\ \\,\\'\\Specs \\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A\"\n by fastforce\n\n with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n case (Conseq P \\ F c Q A \\')\n from Conseq\n have \"\\s \\ P. \n (\\P' Q' A'. \\,\\' \\\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A)\"\n by blast\n with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n case (ExFalso \\ F P c Q A \\')\n have valid_ctxt: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\ \\'\" by fact+\n hence \"\\n. \\,\\'\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cnvalid_def) blast\n moreover have invalid: \"\\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\" by fact\n ultimately show ?case\n by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection \\Some Derived Rules\\\n\nlemma Conseq': \"\\s. s \\ P \\ \n (\\P' Q' A'. \n (\\ Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\\n (\\Z. s \\ P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)))\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]: \n \"\\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where ?P'=\"\\Z. P'\" and ?Q'=\"\\Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\,\\\\\\<^bsub>/F\\<^esub> P' c Q,A \\ P \\ P' \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q',A' \\ Q' \\ Q \\ A' \\ A \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq) auto\n\n\nlemma CallRec': \n \"\\p\\Procs; Procs \\ dom \\;\n \\p\\Procs. \n \\Z. \\,\\ \\ (\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply blast\napply blast\ndone\n\nend \n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2861104844729612}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | August 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2009-2 |\n | October 2010 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Domain_F_cpo\nimports Domain_F Domain_T_cpo Set_F_cpo CPO_pair CSP_T_continuous\nbegin\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n(*********************************************************\n Bottom in Dom_F\n *********************************************************)\n(*\ninstance domF :: (type) bot0\nby (intro_classes)\n*)\n\n\ninstantiation domF :: (type) bot0\nbegin\ndefinition\n bottom_domF_def : \"Bot == ({<>}t ,, {}f)\"\ninstance ..\nend\n\n(*\ndefs (overloaded)\n bottom_domF_def : \"Bot == ({<>}t ,, {}f)\"\n*)\n\nlemma bottom_domF: \"Bot <= (F::'a domF)\"\napply (simp add: bottom_domF_def pairF_def)\napply (simp add: subdomF_def Abs_domF_inverse)\ndone\n\ninstance domF :: (type) bot\napply (intro_classes)\nby (simp add: bottom_domF)\n\n(*** fstF and sndF ***)\n\nlemma fstF_bottom_domF[simp]: \"(fstF o Bot) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domF_def)\napply (simp add: bottom_domT_def)\napply (simp add: comp_def pairF)\ndone\n\nlemma sndF_bottom_domF[simp]: \"(sndF o Bot) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domF_def)\napply (simp add: bottom_setF_def)\napply (simp add: comp_def pairF)\ndone\n\n(********************************************************** \n lemmas used in a proof that domain_F is a cpo.\n **********************************************************)\n\n(* LUB_TF TFs is an upper bound of TFs *)\n\ndefinition\n LUB_TF :: \"'a domTsetF set => 'a domTsetF\"\n where\n LUB_TF_def : \"LUB_TF TFs == (UnionT (fst ` TFs), UnionF (snd ` TFs))\"\n \ndefinition \n LUB_domF :: \"'a domF set => 'a domF\"\n where\n LUB_domF_def : \"LUB_domF Fs == Abs_domF (LUB_TF (Rep_domF ` Fs))\"\n\n(************* LUB_TF *************)\n\n(*** LUB_TF --> LUB ***)\n\nlemma LUB_TF_isLUB:\n \"TFs ~= {} ==> LUB_TF TFs isLUB TFs\"\napply (simp add: pair_LUB_decompo)\napply (simp add: LUB_TF_def)\napply (simp add: isLUB_UnionT isLUB_UnionF)\ndone\n\n(*** LUB --> LUB_TF ***)\n\nlemma isLUB_LUB_TF_only_if:\n \"[| TFs ~= {} ; TF isLUB TFs |] ==> TF = LUB_TF TFs\"\napply (insert LUB_TF_isLUB[of TFs])\nby (simp add: LUB_unique)\n\n(* iff *)\n\nlemma isLUB_LUB_TF : \"TFs ~= {} ==> TF isLUB TFs = (TF = LUB_TF TFs)\"\napply (rule iffI)\napply (simp add: isLUB_LUB_TF_only_if)\napply (simp add: LUB_TF_isLUB)\ndone\n\n(*** LUB TF = LUB_TF ***)\n\nlemma LUB_LUB_TF:\n \"TFs ~= {} ==> LUB TFs = LUB_TF TFs\"\nby (simp add: isLUB_LUB LUB_TF_isLUB)\n\n(****** LUB_TF TFs in domF ******)\n\n(* T3_F4 *)\n\nlemma LUB_TF_in_T3_F4: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_T3_F4 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_T3_F4_def)\napply (intro allI impI)\napply (elim bexE conjE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_iff HC_T3_F4_def)\nby (auto)\n\n(* F3 *)\n\nlemma LUB_TF_in_F3: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_F3 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_F3_def)\napply (intro allI impI)\n\napply (elim bexE conjE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\nby (auto)\n\n(* T2 *)\n\nlemma LUB_TF_in_T2: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_T2 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_T2_def)\napply (intro allI impI)\n\napply (elim exE bexE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\nby (auto)\n\n(*** LUB_TF TFs in domF ***)\n\nlemma LUB_TF_in: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> (LUB_TF TFs): domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: LUB_TF_in_T2)\napply (simp add: LUB_TF_in_F3)\napply (simp add: LUB_TF_in_T3_F4)\ndone\n\nlemma LUB_TF_in_Rep: \n \"Fs ~= {} ==> (LUB_TF (Rep_domF ` Fs)): domF\"\napply (rule LUB_TF_in)\napply (auto)\ndone\n\n(************* LUB_domF *************)\n\n(* isLUB lemma *)\n\nlemma TF_isLUB_domFs:\n \"[| TF:domF ; TF isLUB Rep_domF ` Fs |] ==> Abs_domF TF isLUB Fs\"\napply (simp add: isUB_def isLUB_def)\napply (rule conjI)\n\n(* ub *)\napply (intro allI impI)\napply (elim bexE conjE)\napply (drule_tac x=\"fst (Rep_domF y)\" in spec)\napply (drule_tac x=\"snd (Rep_domF y)\" in spec)\napply (simp add: subdomF_def Abs_domF_inverse)\n\n(* lub *)\napply (intro allI impI)\napply (elim bexE conjE)\napply (rotate_tac -1)\napply (drule_tac x=\"fst (Rep_domF y)\" in spec)\napply (rotate_tac -1)\napply (drule_tac x=\"snd (Rep_domF y)\" in spec)\napply (simp)\napply (drule mp)\n apply (intro allI impI)\n apply (simp add: image_def)\n apply (elim bexE conjE)\n apply (drule_tac x=\"x\" in spec)\n apply (simp)\n apply (simp add: subdomF_def)\napply (simp add: subdomF_def Abs_domF_inverse)\ndone\n\n(*** LUB_domF --> LUB ***)\n\nlemma LUB_domF_isLUB:\n \"Fs ~= {} ==> LUB_domF Fs isLUB Fs\"\napply (simp add: LUB_domF_def)\napply (rule TF_isLUB_domFs)\napply (simp add: LUB_TF_in)\napply (simp add: LUB_TF_isLUB)\ndone\n\nlemma LUB_domF_isLUB_I:\n \"[| Fs ~= {} ; F = LUB_domF Fs |] ==> F isLUB Fs\"\nby (simp add: LUB_domF_isLUB)\n\n(*** LUB --> LUB_domF ***)\n\nlemma isLUB_LUB_domF_only_if:\n \"[| Fs ~= {} ; F isLUB Fs |] ==> F = LUB_domF Fs\"\napply (insert LUB_domF_isLUB[of Fs])\nby (simp add: LUB_unique)\n\n(* iff *)\n\nlemma isLUB_LUB_domF : \"Fs ~= {} ==> F isLUB Fs = (F = LUB_domF Fs)\"\napply (rule iffI)\napply (simp add: isLUB_LUB_domF_only_if)\napply (simp add: LUB_domF_isLUB)\ndone\n\n(********************************************************** \n ( domF, <= ) is a CPO\n **********************************************************)\n\ninstance domF :: (type) cpo\napply (intro_classes)\napply (simp add: hasLUB_def)\napply (rule_tac x=\"LUB_domF X\" in exI)\nby (simp add: directed_def LUB_domF_isLUB)\n\n(********************************************************** \n ( domF, <= ) is a pointed CPO\n **********************************************************)\n\ninstance domF :: (type) cpo_bot\nby (intro_classes)\n\n(********************************************************** \n continuity of Abs_domF\n **********************************************************)\n\n(*** Abs_domF ***)\n\nlemma continuous_Abs_domF:\n \"[| ALL x. f x: domF ; continuous f |] ==> continuous (Abs_domF o f)\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (rule_tac x=\"x\" in exI, simp)\napply (rule TF_isLUB_domFs)\napply (simp)\n\napply (subgoal_tac \"Rep_domF ` (Abs_domF o f) ` X = f ` X\")\nby (auto simp add: image_def Abs_domF_inverse)\n\n(*** Rep_domF ***)\n\nlemma cont_Rep_domF: \"continuous Rep_domF\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (rule_tac x=\"LUB_domF X\" in exI)\n\napply (simp add: directed_def LUB_domF_isLUB)\napply (simp add: isLUB_LUB_TF)\napply (simp add: LUB_domF_def)\napply (simp add: LUB_TF_in Abs_domF_inverse)\ndone\n\n(*** fstF and sndF ***)\n\nlemma fstF_continuous: \"continuous fstF\"\napply (simp add: fstF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: fst_continuous)\ndone\n\nlemma sndF_continuous: \"continuous sndF\"\napply (simp add: sndF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: snd_continuous)\ndone\n\n(********************************************************** \n continuity decomposition\n **********************************************************)\n\n(*** if ***)\n\nlemma continuous_domF:\n \"[| ALL x. (f x, g x): domF ; continuous f ; continuous g |]\n ==> continuous (%x. (f x ,, g x))\"\napply (simp add: pairF_def)\napply (subgoal_tac \"(%x. Abs_domF (f x, g x)) = Abs_domF o (%x. (f x, g x))\")\napply (simp)\napply (rule continuous_Abs_domF)\napply (simp)\napply (simp add: pair_continuous)\napply (simp add: comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemmas continuous_domF_decompo_if = continuous_domF\n\n(*** only if ***)\n\nlemma continuous_domF_decompo_only_if_lm:\n \"[| ALL x. (f x, g x) : domF; continuous (%x. (f x , g x)) |]\n ==> continuous f & continuous g\"\napply (simp add: pair_continuous)\napply (simp add: comp_def)\ndone\n\nlemma continuous_domF_decompo_only_if:\n \"[| ALL x. (f x, g x) : domF; continuous (%x. (f x ,, g x)) |]\n ==> continuous f & continuous g\"\napply (rule continuous_domF_decompo_only_if_lm)\napply (simp)\napply (simp add: pairF_def)\napply (insert compo_continuous\n [of \"(%x. Abs_domF (f x, g x))\" \"Rep_domF\" ])\napply (simp add: comp_def)\napply (simp add: cont_Rep_domF)\napply (simp add: Abs_domF_inverse)\ndone\n\nlemma continuous_domF_decompo:\n \"ALL x. (f x, g x) : domF\n ==> continuous (%x. (f x ,, g x)) = (continuous f & continuous g)\"\napply (rule)\napply (simp add: continuous_domF_decompo_only_if)\napply (simp add: continuous_domF_decompo_if)\ndone\n\n(********************************************************** \n continuity of (op o fstF)\n **********************************************************)\n\nlemma continuous_op_fstF: \"continuous (op o fstF)\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (insert complete_cpo_lm)\napply (drule_tac x=\"X\" in spec)\napply (simp add: hasLUB_def)\n\napply (elim exE)\napply (rule_tac x=\"x\" in exI)\napply (simp)\napply (simp add: image_def)\napply (simp add: isLUB_def)\napply (simp add: isUB_def)\napply (rule)\n\n (* UB *)\n apply (intro allI impI)\n apply (elim conjE bexE) \n apply (simp)\n apply (drule_tac x=\"xa\" in spec)\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n\n (* LUB *)\n apply (intro allI impI)\n apply (elim conjE)\n\n apply (rotate_tac -1)\n apply (drule_tac x=\"(%pn. (y pn ,, maxFof (y pn)))\" in spec)\n apply (drule mp)\n\n apply (intro allI impI)\n apply (drule_tac x=\"fstF o ya\" in spec)\n apply (drule mp, fast)\n apply (simp add: order_prod_def)\n apply (intro allI impI)\n apply (drule_tac x=\"xa\" in spec)\n apply (simp add: subdomF_decompo)\n apply (simp add: pairF maxFof_domF)\n apply (rule)\n apply (simp add: subdomT_iff)\n apply (drule_tac x=\"s\" in spec)\n apply (simp add: pairF_domF_T2)\n apply (simp add: maxFof_max)\n\n apply (simp add: order_prod_def)\n apply (simp add: subdomF_decompo)\n apply (simp add: pairF maxFof_domF)\ndone\n\n(********************************************************** \n fstF-distribution over LUB\n **********************************************************)\n\nlemma dist_fstF_LUB:\n \"X ~= {} ==> fstF o LUB X = LUB ((op o fstF) ` X)\"\napply (subgoal_tac \"X hasLUB\")\napply (rule sym)\napply (rule isLUB_LUB)\napply (simp add: isLUB_def isUB_def)\napply (rule)\n\n(* UB *)\n apply (intro allI impI)\n apply (simp add: image_iff)\n apply (simp add: comp_def)\n apply (elim bexE)\n apply (simp add: order_prod_def)\n apply (intro allI)\n apply (subgoal_tac \"x <= LUB X\")\n\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n apply (subgoal_tac \"LUB X isLUB X\")\n apply (simp add: isLUB_def isUB_def)\n apply (simp add: LUB_is)\n\n(* LUB *)\n apply (intro allI impI)\n apply (simp add: order_prod_def)\n apply (intro allI impI)\n apply (subgoal_tac \"(LUB X) isLUB X\")\n\n apply (simp add: prod_LUB_decompo)\n apply (simp add: proj_fun_def)\n apply (drule_tac x=\"x\" in spec)\n apply (subgoal_tac \"(%xa. xa x) ` X ~= {}\")\n\n apply (simp add: isLUB_LUB_domF)\n apply (simp add: LUB_domF_def)\n apply (simp add: fstF_def)\n apply (simp add: LUB_TF_in_Rep Abs_domF_inverse)\n apply (simp add: LUB_TF_def)\n apply (rule subdomTI)\n apply (simp)\n apply (elim conjE bexE)\n apply (drule_tac x=\"fstF o xa\" in spec)\n apply (drule mp)\n apply (simp add: image_iff)\n apply (rule_tac x=\"xa\" in bexI)\n apply (simp add: fstF_def)\n apply (simp)\n apply (drule_tac x=\"x\" in spec)\n apply (simp add: subdomT_iff)\n apply (drule_tac x=\"t\" in spec)\n apply (simp add: fstF_def)\n\n apply (force)\n apply (rule LUB_is)\n apply (simp)\n\napply (simp add: hasLUB_def)\napply (simp add: prod_LUB_decompo)\napply (simp add: proj_fun_def)\napply (rule_tac x=\"(%i. LUB_domF ((%x. x i) ` X))\" in exI)\napply (simp add: isLUB_LUB_domF)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/Domain_F_cpo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.28611047733270767}} {"text": "section\\Interface between set models and Constructibility\\\n\ntext\\This theory provides an interface between Paulson's\nrelativization results and set models of ZFC. In particular,\nit is used to prove that the locale \\<^term>\\forcing_data\\ is\na sublocale of all relevant locales in ZF-Constructibility\n(\\<^term>\\M_trivial\\, \\<^term>\\M_basic\\, \\<^term>\\M_eclose\\, etc).\\\n\ntheory Interface\n imports\n Nat_Miscellanea\n Relative_Univ\n Synthetic_Definition\nbegin\n\nsyntax\n \"_sats\" :: \"[i, i, i] \\ o\" (\"(_, _ \\ _)\" [36,36,36] 60)\ntranslations\n \"(M,env \\ \\)\" \\ \"CONST sats(M,\\,env)\"\n\nabbreviation\n dec10 :: i (\"10\") where \"10 \\ succ(9)\"\n\nabbreviation\n dec11 :: i (\"11\") where \"11 \\ succ(10)\"\n\nabbreviation\n dec12 :: i (\"12\") where \"12 \\ succ(11)\"\n\nabbreviation\n dec13 :: i (\"13\") where \"13 \\ succ(12)\"\n\nabbreviation\n dec14 :: i (\"14\") where \"14 \\ succ(13)\"\n\n\ndefinition\n infinity_ax :: \"(i \\ o) \\ o\" where\n \"infinity_ax(M) \\\n (\\I[M]. (\\z[M]. empty(M,z) \\ z\\I) \\ (\\y[M]. y\\I \\ (\\sy[M]. successor(M,y,sy) \\ sy\\I)))\"\n\ndefinition\n choice_ax :: \"(i\\o) \\ o\" where\n \"choice_ax(M) \\ \\x[M]. \\a[M]. \\f[M]. ordinal(M,a) \\ surjection(M,a,x,f)\"\n\ncontext M_basic begin\n\nlemma choice_ax_abs :\n \"choice_ax(M) \\ (\\x[M]. \\a[M]. \\f[M]. Ord(a) \\ f \\ surj(a,x))\"\n unfolding choice_ax_def\n by (simp)\n\nend (* M_basic *)\n\ndefinition\n wellfounded_trancl :: \"[i=>o,i,i,i] => o\" where\n \"wellfounded_trancl(M,Z,r,p) \\\n \\w[M]. \\wx[M]. \\rp[M].\n w \\ Z & pair(M,w,p,wx) & tran_closure(M,r,rp) & wx \\ rp\"\n\nlemma empty_intf :\n \"infinity_ax(M) \\\n (\\z[M]. empty(M,z))\"\n by (auto simp add: empty_def infinity_ax_def)\n\nlemma Transset_intf :\n \"Transset(M) \\ y\\x \\ x \\ M \\ y \\ M\"\n by (simp add: Transset_def,auto)\n\nlocale M_ZF_trans =\n fixes M\n assumes\n upair_ax: \"upair_ax(##M)\"\n and Union_ax: \"Union_ax(##M)\"\n and power_ax: \"power_ax(##M)\"\n and extensionality: \"extensionality(##M)\"\n and foundation_ax: \"foundation_ax(##M)\"\n and infinity_ax: \"infinity_ax(##M)\"\n and separation_ax: \"\\\\formula \\ env\\list(M) \\ arity(\\) \\ 1 #+ length(env) \\\n separation(##M,\\x. sats(M,\\,[x] @ env))\"\n and replacement_ax: \"\\\\formula \\ env\\list(M) \\ arity(\\) \\ 2 #+ length(env) \\\n strong_replacement(##M,\\x y. sats(M,\\,[x,y] @ env))\"\n and trans_M: \"Transset(M)\"\nbegin\n\n\nlemma TranssetI :\n \"(\\y x. y\\x \\ x\\M \\ y\\M) \\ Transset(M)\"\n by (auto simp add: Transset_def)\n\nlemma zero_in_M: \"0 \\ M\"\nproof -\n from infinity_ax have\n \"(\\z[##M]. empty(##M,z))\"\n by (rule empty_intf)\n then obtain z where\n zm: \"empty(##M,z)\" \"z\\M\"\n by auto\n with trans_M have \"z=0\"\n by (simp add: empty_def, blast intro: Transset_intf )\n with zm show ?thesis\n by simp\nqed\n\nsubsection\\Interface with \\<^term>\\M_trivial\\\\\nlemma mtrans :\n \"M_trans(##M)\"\n using Transset_intf[OF trans_M] zero_in_M exI[of \"\\x. x\\M\"]\n by unfold_locales auto\n\n\nlemma mtriv :\n \"M_trivial(##M)\"\n using trans_M M_trivial.intro mtrans M_trivial_axioms.intro upair_ax Union_ax\n by simp\n\nend\n\nsublocale M_ZF_trans \\ M_trivial \"##M\"\n by (rule mtriv)\n\ncontext M_ZF_trans\nbegin\n\nsubsection\\Interface with \\<^term>\\M_basic\\\\\n\n(* Inter_separation: \"M(A) \\ separation(M, \\x. \\ y[M]. y\\A \\ x\\y)\" *)\nschematic_goal inter_fm_auto:\n assumes\n \"nth(i,env) = x\" \"nth(j,env) = B\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\y\\A . y\\B \\ x\\y) \\ sats(A,?ifm(i,j),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\nlemma inter_sep_intf :\n assumes\n \"A\\M\"\n shows\n \"separation(##M,\\x . \\y\\M . y\\A \\ x\\y)\"\nproof -\n obtain ifm where\n fmsats:\"\\env. env\\list(M) \\ (\\ y\\M. y\\(nth(1,env)) \\ nth(0,env)\\y)\n \\ sats(M,ifm(0,1),env)\"\n and\n \"ifm(0,1) \\ formula\"\n and\n \"arity(ifm(0,1)) = 2\"\n using \\A\\M\\ inter_fm_auto\n by (simp del:FOL_sats_iff add: nat_simp_union)\n then\n have \"\\a\\M. separation(##M, \\x. sats(M,ifm(0,1) , [x, a]))\"\n using separation_ax by simp\n moreover\n have \"(\\y\\M . y\\a \\ x\\y) \\ sats(M,ifm(0,1),[x,a])\"\n if \"a\\M\" \"x\\M\" for a x\n using that fmsats[of \"[x,a]\"] by simp\n ultimately\n have \"\\a\\M. separation(##M, \\x . \\y\\M . y\\a \\ x\\y)\"\n unfolding separation_def by simp\n with \\A\\M\\ show ?thesis by simp\nqed\n\n\n(* Diff_separation: \"M(B) \\ separation(M, \\x. x \\ B)\" *)\nschematic_goal diff_fm_auto:\n assumes\n \"nth(i,env) = x\" \"nth(j,env) = B\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"x\\B \\ sats(A,?dfm(i,j),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\nlemma diff_sep_intf :\n assumes\n \"B\\M\"\n shows\n \"separation(##M,\\x . x\\B)\"\nproof -\n obtain dfm where\n fmsats:\"\\env. env\\list(M) \\ nth(0,env)\\nth(1,env)\n \\ sats(M,dfm(0,1),env)\"\n and\n \"dfm(0,1) \\ formula\"\n and\n \"arity(dfm(0,1)) = 2\"\n using \\B\\M\\ diff_fm_auto\n by (simp del:FOL_sats_iff add: nat_simp_union)\n then\n have \"\\b\\M. separation(##M, \\x. sats(M,dfm(0,1) , [x, b]))\"\n using separation_ax by simp\n moreover\n have \"x\\b \\ sats(M,dfm(0,1),[x,b])\"\n if \"b\\M\" \"x\\M\" for b x\n using that fmsats[of \"[x,b]\"] by simp\n ultimately\n have \"\\b\\M. separation(##M, \\x . x\\b)\"\n unfolding separation_def by simp\n with \\B\\M\\ show ?thesis by simp\nqed\n\nschematic_goal cprod_fm_auto:\n assumes\n \"nth(i,env) = z\" \"nth(j,env) = B\" \"nth(h,env) = C\"\n \"i \\ nat\" \"j \\ nat\" \"h \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\x\\A. x\\B \\ (\\y\\A. y\\C \\ pair(##A,x,y,z))) \\ sats(A,?cpfm(i,j,h),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma cartprod_sep_intf :\n assumes\n \"A\\M\"\n and\n \"B\\M\"\n shows\n \"separation(##M,\\z. \\x\\M. x\\A \\ (\\y\\M. y\\B \\ pair(##M,x,y,z)))\"\nproof -\n obtain cpfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\x\\M. x\\nth(1,env) \\ (\\y\\M. y\\nth(2,env) \\ pair(##M,x,y,nth(0,env))))\n \\ sats(M,cpfm(0,1,2),env)\"\n and\n \"cpfm(0,1,2) \\ formula\"\n and\n \"arity(cpfm(0,1,2)) = 3\"\n using cprod_fm_auto by (simp del:FOL_sats_iff add: fm_defs nat_simp_union)\n then\n have \"\\a\\M. \\b\\M. separation(##M, \\z. sats(M,cpfm(0,1,2) , [z, a, b]))\"\n using separation_ax by simp\n moreover\n have \"(\\x\\M. x\\a \\ (\\y\\M. y\\b \\ pair(##M,x,y,z))) \\ sats(M,cpfm(0,1,2),[z,a,b])\"\n if \"a\\M\" \"b\\M\" \"z\\M\" for a b z\n using that fmsats[of \"[z,a,b]\"] by simp\n ultimately\n have \"\\a\\M. \\b\\M. separation(##M, \\z . (\\x\\M. x\\a \\ (\\y\\M. y\\b \\ pair(##M,x,y,z))))\"\n unfolding separation_def by simp\n with \\A\\M\\ \\B\\M\\ show ?thesis by simp\nqed\n\nschematic_goal im_fm_auto:\n assumes\n \"nth(i,env) = y\" \"nth(j,env) = r\" \"nth(h,env) = B\"\n \"i \\ nat\" \"j \\ nat\" \"h \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\p\\A. p\\r & (\\x\\A. x\\B & pair(##A,x,y,p))) \\ sats(A,?imfm(i,j,h),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\nlemma image_sep_intf :\n assumes\n \"A\\M\"\n and\n \"r\\M\"\n shows\n \"separation(##M, \\y. \\p\\M. p\\r & (\\x\\M. x\\A & pair(##M,x,y,p)))\"\nproof -\n obtain imfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\p\\M. p\\nth(1,env) & (\\x\\M. x\\nth(2,env) & pair(##M,x,nth(0,env),p)))\n \\ sats(M,imfm(0,1,2),env)\"\n and\n \"imfm(0,1,2) \\ formula\"\n and\n \"arity(imfm(0,1,2)) = 3\"\n using im_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\r\\M. \\a\\M. separation(##M, \\y. sats(M,imfm(0,1,2) , [y,r,a]))\"\n using separation_ax by simp\n moreover\n have \"(\\p\\M. p\\k & (\\x\\M. x\\a & pair(##M,x,y,p))) \\ sats(M,imfm(0,1,2),[y,k,a])\"\n if \"k\\M\" \"a\\M\" \"y\\M\" for k a y\n using that fmsats[of \"[y,k,a]\"] by simp\n ultimately\n have \"\\k\\M. \\a\\M. separation(##M, \\y . \\p\\M. p\\k & (\\x\\M. x\\a & pair(##M,x,y,p)))\"\n unfolding separation_def by simp\n with \\r\\M\\ \\A\\M\\ show ?thesis by simp\nqed\n\nschematic_goal con_fm_auto:\n assumes\n \"nth(i,env) = z\" \"nth(j,env) = R\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\p\\A. p\\R & (\\x\\A.\\y\\A. pair(##A,x,y,p) & pair(##A,y,x,z)))\n \\ sats(A,?cfm(i,j),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma converse_sep_intf :\n assumes\n \"R\\M\"\n shows\n \"separation(##M,\\z. \\p\\M. p\\R & (\\x\\M.\\y\\M. pair(##M,x,y,p) & pair(##M,y,x,z)))\"\nproof -\n obtain cfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\p\\M. p\\nth(1,env) & (\\x\\M.\\y\\M. pair(##M,x,y,p) & pair(##M,y,x,nth(0,env))))\n \\ sats(M,cfm(0,1),env)\"\n and\n \"cfm(0,1) \\ formula\"\n and\n \"arity(cfm(0,1)) = 2\"\n using con_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\r\\M. separation(##M, \\z. sats(M,cfm(0,1) , [z,r]))\"\n using separation_ax by simp\n moreover\n have \"(\\p\\M. p\\r & (\\x\\M.\\y\\M. pair(##M,x,y,p) & pair(##M,y,x,z))) \\\n sats(M,cfm(0,1),[z,r])\"\n if \"z\\M\" \"r\\M\" for z r\n using that fmsats[of \"[z,r]\"] by simp\n ultimately\n have \"\\r\\M. separation(##M, \\z . \\p\\M. p\\r & (\\x\\M.\\y\\M. pair(##M,x,y,p) & pair(##M,y,x,z)))\"\n unfolding separation_def by simp\n with \\R\\M\\ show ?thesis by simp\nqed\n\n\nschematic_goal rest_fm_auto:\n assumes\n \"nth(i,env) = z\" \"nth(j,env) = C\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\x\\A. x\\C & (\\y\\A. pair(##A,x,y,z)))\n \\ sats(A,?rfm(i,j),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma restrict_sep_intf :\n assumes\n \"A\\M\"\n shows\n \"separation(##M,\\z. \\x\\M. x\\A & (\\y\\M. pair(##M,x,y,z)))\"\nproof -\n obtain rfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\x\\M. x\\nth(1,env) & (\\y\\M. pair(##M,x,y,nth(0,env))))\n \\ sats(M,rfm(0,1),env)\"\n and\n \"rfm(0,1) \\ formula\"\n and\n \"arity(rfm(0,1)) = 2\"\n using rest_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\a\\M. separation(##M, \\z. sats(M,rfm(0,1) , [z,a]))\"\n using separation_ax by simp\n moreover\n have \"(\\x\\M. x\\a & (\\y\\M. pair(##M,x,y,z))) \\\n sats(M,rfm(0,1),[z,a])\"\n if \"z\\M\" \"a\\M\" for z a\n using that fmsats[of \"[z,a]\"] by simp\n ultimately\n have \"\\a\\M. separation(##M, \\z . \\x\\M. x\\a & (\\y\\M. pair(##M,x,y,z)))\"\n unfolding separation_def by simp\n with \\A\\M\\ show ?thesis by simp\nqed\n\nschematic_goal comp_fm_auto:\n assumes\n \"nth(i,env) = xz\" \"nth(j,env) = S\" \"nth(h,env) = R\"\n \"i \\ nat\" \"j \\ nat\" \"h \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\x\\A. \\y\\A. \\z\\A. \\xy\\A. \\yz\\A.\n pair(##A,x,z,xz) & pair(##A,x,y,xy) & pair(##A,y,z,yz) & xy\\S & yz\\R)\n \\ sats(A,?cfm(i,j,h),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma comp_sep_intf :\n assumes\n \"R\\M\"\n and\n \"S\\M\"\n shows\n \"separation(##M,\\xz. \\x\\M. \\y\\M. \\z\\M. \\xy\\M. \\yz\\M.\n pair(##M,x,z,xz) & pair(##M,x,y,xy) & pair(##M,y,z,yz) & xy\\S & yz\\R)\"\nproof -\n obtain cfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\x\\M. \\y\\M. \\z\\M. \\xy\\M. \\yz\\M. pair(##M,x,z,nth(0,env)) &\n pair(##M,x,y,xy) & pair(##M,y,z,yz) & xy\\nth(1,env) & yz\\nth(2,env))\n \\ sats(M,cfm(0,1,2),env)\"\n and\n \"cfm(0,1,2) \\ formula\"\n and\n \"arity(cfm(0,1,2)) = 3\"\n using comp_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\r\\M. \\s\\M. separation(##M, \\y. sats(M,cfm(0,1,2) , [y,s,r]))\"\n using separation_ax by simp\n moreover\n have \"(\\x\\M. \\y\\M. \\z\\M. \\xy\\M. \\yz\\M.\n pair(##M,x,z,xz) & pair(##M,x,y,xy) & pair(##M,y,z,yz) & xy\\s & yz\\r)\n \\ sats(M,cfm(0,1,2) , [xz,s,r])\"\n if \"xz\\M\" \"s\\M\" \"r\\M\" for xz s r\n using that fmsats[of \"[xz,s,r]\"] by simp\n ultimately\n have \"\\s\\M. \\r\\M. separation(##M, \\xz . \\x\\M. \\y\\M. \\z\\M. \\xy\\M. \\yz\\M.\n pair(##M,x,z,xz) & pair(##M,x,y,xy) & pair(##M,y,z,yz) & xy\\s & yz\\r)\"\n unfolding separation_def by simp\n with \\S\\M\\ \\R\\M\\ show ?thesis by simp\nqed\n\n\nschematic_goal pred_fm_auto:\n assumes\n \"nth(i,env) = y\" \"nth(j,env) = R\" \"nth(h,env) = X\"\n \"i \\ nat\" \"j \\ nat\" \"h \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\p\\A. p\\R & pair(##A,y,X,p)) \\ sats(A,?pfm(i,j,h),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma pred_sep_intf:\n assumes\n \"R\\M\"\n and\n \"X\\M\"\n shows\n \"separation(##M, \\y. \\p\\M. p\\R & pair(##M,y,X,p))\"\nproof -\n obtain pfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\p\\M. p\\nth(1,env) & pair(##M,nth(0,env),nth(2,env),p)) \\ sats(M,pfm(0,1,2),env)\"\n and\n \"pfm(0,1,2) \\ formula\"\n and\n \"arity(pfm(0,1,2)) = 3\"\n using pred_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\x\\M. \\r\\M. separation(##M, \\y. sats(M,pfm(0,1,2) , [y,r,x]))\"\n using separation_ax by simp\n moreover\n have \"(\\p\\M. p\\r & pair(##M,y,x,p))\n \\ sats(M,pfm(0,1,2) , [y,r,x])\"\n if \"y\\M\" \"r\\M\" \"x\\M\" for y x r\n using that fmsats[of \"[y,r,x]\"] by simp\n ultimately\n have \"\\x\\M. \\r\\M. separation(##M, \\ y . \\p\\M. p\\r & pair(##M,y,x,p))\"\n unfolding separation_def by simp\n with \\X\\M\\ \\R\\M\\ show ?thesis by simp\nqed\n\n(* Memrel_separation:\n \"separation(M, \\z. \\x[M]. \\y[M]. pair(M,x,y,z) & x \\ y)\"\n*)\nschematic_goal mem_fm_auto:\n assumes\n \"nth(i,env) = z\" \"i \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\x\\A. \\y\\A. pair(##A,x,y,z) & x \\ y) \\ sats(A,?mfm(i),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\nlemma memrel_sep_intf:\n \"separation(##M, \\z. \\x\\M. \\y\\M. pair(##M,x,y,z) & x \\ y)\"\nproof -\n obtain mfm where\n fmsats:\"\\env. env\\list(M) \\\n (\\x\\M. \\y\\M. pair(##M,x,y,nth(0,env)) & x \\ y) \\ sats(M,mfm(0),env)\"\n and\n \"mfm(0) \\ formula\"\n and\n \"arity(mfm(0)) = 1\"\n using mem_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"separation(##M, \\z. sats(M,mfm(0) , [z]))\"\n using separation_ax by simp\n moreover\n have \"(\\x\\M. \\y\\M. pair(##M,x,y,z) & x \\ y) \\ sats(M,mfm(0),[z])\"\n if \"z\\M\" for z\n using that fmsats[of \"[z]\"] by simp\n ultimately\n have \"separation(##M, \\z . \\x\\M. \\y\\M. pair(##M,x,y,z) & x \\ y)\"\n unfolding separation_def by simp\n then show ?thesis by simp\nqed\n\nschematic_goal recfun_fm_auto:\n assumes\n \"nth(i1,env) = x\" \"nth(i2,env) = r\" \"nth(i3,env) = f\" \"nth(i4,env) = g\" \"nth(i5,env) = a\"\n \"nth(i6,env) = b\" \"i1\\nat\" \"i2\\nat\" \"i3\\nat\" \"i4\\nat\" \"i5\\nat\" \"i6\\nat\" \"env \\ list(A)\"\n shows\n \"(\\xa\\A. \\xb\\A. pair(##A,x,a,xa) & xa \\ r & pair(##A,x,b,xb) & xb \\ r &\n (\\fx\\A. \\gx\\A. fun_apply(##A,f,x,fx) & fun_apply(##A,g,x,gx) & fx \\ gx))\n \\ sats(A,?rffm(i1,i2,i3,i4,i5,i6),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma is_recfun_sep_intf :\n assumes\n \"r\\M\" \"f\\M\" \"g\\M\" \"a\\M\" \"b\\M\"\n shows\n \"separation(##M,\\x. \\xa\\M. \\xb\\M.\n pair(##M,x,a,xa) & xa \\ r & pair(##M,x,b,xb) & xb \\ r &\n (\\fx\\M. \\gx\\M. fun_apply(##M,f,x,fx) & fun_apply(##M,g,x,gx) &\n fx \\ gx))\"\nproof -\n obtain rffm where\n fmsats:\"\\env. env\\list(M) \\\n (\\xa\\M. \\xb\\M. pair(##M,nth(0,env),nth(4,env),xa) & xa \\ nth(1,env) &\n pair(##M,nth(0,env),nth(5,env),xb) & xb \\ nth(1,env) & (\\fx\\M. \\gx\\M.\n fun_apply(##M,nth(2,env),nth(0,env),fx) & fun_apply(##M,nth(3,env),nth(0,env),gx) & fx \\ gx))\n \\ sats(M,rffm(0,1,2,3,4,5),env)\"\n and\n \"rffm(0,1,2,3,4,5) \\ formula\"\n and\n \"arity(rffm(0,1,2,3,4,5)) = 6\"\n using recfun_fm_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\a1\\M. \\a2\\M. \\a3\\M. \\a4\\M. \\a5\\M.\n separation(##M, \\x. sats(M,rffm(0,1,2,3,4,5) , [x,a1,a2,a3,a4,a5]))\"\n using separation_ax by simp\n moreover\n have \"(\\xa\\M. \\xb\\M. pair(##M,x,a4,xa) & xa \\ a1 & pair(##M,x,a5,xb) & xb \\ a1 &\n (\\fx\\M. \\gx\\M. fun_apply(##M,a2,x,fx) & fun_apply(##M,a3,x,gx) & fx \\ gx))\n \\ sats(M,rffm(0,1,2,3,4,5) , [x,a1,a2,a3,a4,a5])\"\n if \"x\\M\" \"a1\\M\" \"a2\\M\" \"a3\\M\" \"a4\\M\" \"a5\\M\" for x a1 a2 a3 a4 a5\n using that fmsats[of \"[x,a1,a2,a3,a4,a5]\"] by simp\n ultimately\n have \"\\a1\\M. \\a2\\M. \\a3\\M. \\a4\\M. \\a5\\M. separation(##M, \\ x .\n \\xa\\M. \\xb\\M. pair(##M,x,a4,xa) & xa \\ a1 & pair(##M,x,a5,xb) & xb \\ a1 &\n (\\fx\\M. \\gx\\M. fun_apply(##M,a2,x,fx) & fun_apply(##M,a3,x,gx) & fx \\ gx))\"\n unfolding separation_def by simp\n with \\r\\M\\ \\f\\M\\ \\g\\M\\ \\a\\M\\ \\b\\M\\ show ?thesis by simp\nqed\n\n\n(* Instance of Replacement for M_basic *)\n\nschematic_goal funsp_fm_auto:\n assumes\n \"nth(i,env) = p\" \"nth(j,env) = z\" \"nth(h,env) = n\"\n \"i \\ nat\" \"j \\ nat\" \"h \\ nat\" \"env \\ list(A)\"\n shows\n \"(\\f\\A. \\b\\A. \\nb\\A. \\cnbf\\A. pair(##A,f,b,p) & pair(##A,n,b,nb) & is_cons(##A,nb,f,cnbf) &\n upair(##A,cnbf,cnbf,z)) \\ sats(A,?fsfm(i,j,h),env)\"\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma funspace_succ_rep_intf :\n assumes\n \"n\\M\"\n shows\n \"strong_replacement(##M,\n \\p z. \\f\\M. \\b\\M. \\nb\\M. \\cnbf\\M.\n pair(##M,f,b,p) & pair(##M,n,b,nb) & is_cons(##M,nb,f,cnbf) &\n upair(##M,cnbf,cnbf,z))\"\nproof -\n obtain fsfm where\n fmsats:\"env\\list(M) \\\n (\\f\\M. \\b\\M. \\nb\\M. \\cnbf\\M. pair(##M,f,b,nth(0,env)) & pair(##M,nth(2,env),b,nb)\n & is_cons(##M,nb,f,cnbf) & upair(##M,cnbf,cnbf,nth(1,env)))\n \\ sats(M,fsfm(0,1,2),env)\"\n and \"fsfm(0,1,2) \\ formula\" and \"arity(fsfm(0,1,2)) = 3\" for env\n using funsp_fm_auto[of concl:M] by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\n0\\M. strong_replacement(##M, \\p z. sats(M,fsfm(0,1,2) , [p,z,n0]))\"\n using replacement_ax by simp\n moreover\n have \"(\\f\\M. \\b\\M. \\nb\\M. \\cnbf\\M. pair(##M,f,b,p) & pair(##M,n0,b,nb) &\n is_cons(##M,nb,f,cnbf) & upair(##M,cnbf,cnbf,z))\n \\ sats(M,fsfm(0,1,2) , [p,z,n0])\"\n if \"p\\M\" \"z\\M\" \"n0\\M\" for p z n0\n using that fmsats[of \"[p,z,n0]\"] by simp\n ultimately\n have \"\\n0\\M. strong_replacement(##M, \\ p z.\n \\f\\M. \\b\\M. \\nb\\M. \\cnbf\\M. pair(##M,f,b,p) & pair(##M,n0,b,nb) &\n is_cons(##M,nb,f,cnbf) & upair(##M,cnbf,cnbf,z))\"\n unfolding strong_replacement_def univalent_def by simp\n with \\n\\M\\ show ?thesis by simp\nqed\n\n\n(* Interface with M_basic *)\n\nlemmas M_basic_sep_instances =\n inter_sep_intf diff_sep_intf cartprod_sep_intf\n image_sep_intf converse_sep_intf restrict_sep_intf\n pred_sep_intf memrel_sep_intf comp_sep_intf is_recfun_sep_intf\n\nlemma mbasic : \"M_basic(##M)\"\n using trans_M zero_in_M power_ax M_basic_sep_instances funspace_succ_rep_intf mtriv\n by unfold_locales auto\n\nend\n\nsublocale M_ZF_trans \\ M_basic \"##M\"\n by (rule mbasic)\n\nsubsection\\Interface with \\<^term>\\M_trancl\\\\\n\n(* rtran_closure_mem *)\nschematic_goal rtran_closure_mem_auto:\n assumes\n \"nth(i,env) = p\" \"nth(j,env) = r\" \"nth(k,env) = B\"\n \"i \\ nat\" \"j \\ nat\" \"k \\ nat\" \"env \\ list(A)\"\n shows\n \"rtran_closure_mem(##A,B,r,p) \\ sats(A,?rcfm(i,j,k),env)\"\n unfolding rtran_closure_mem_def\n by (insert assms ; (rule sep_rules | simp)+)\n\n\nlemma (in M_ZF_trans) rtrancl_separation_intf:\n assumes\n \"r\\M\"\n and\n \"A\\M\"\n shows\n \"separation (##M, rtran_closure_mem(##M,A,r))\"\nproof -\n obtain rcfm where\n fmsats:\"\\env. env\\list(M) \\\n (rtran_closure_mem(##M,nth(2,env),nth(1,env),nth(0,env))) \\ sats(M,rcfm(0,1,2),env)\"\n and\n \"rcfm(0,1,2) \\ formula\"\n and\n \"arity(rcfm(0,1,2)) = 3\"\n using rtran_closure_mem_auto by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\x\\M. \\a\\M. separation(##M, \\y. sats(M,rcfm(0,1,2) , [y,x,a]))\"\n using separation_ax by simp\n moreover\n have \"(rtran_closure_mem(##M,a,x,y))\n \\ sats(M,rcfm(0,1,2) , [y,x,a])\"\n if \"y\\M\" \"x\\M\" \"a\\M\" for y x a\n using that fmsats[of \"[y,x,a]\"] by simp\n ultimately\n have \"\\x\\M. \\a\\M. separation(##M, rtran_closure_mem(##M,a,x))\"\n unfolding separation_def by simp\n with \\r\\M\\ \\A\\M\\ show ?thesis by simp\nqed\n\nschematic_goal rtran_closure_fm_auto:\n assumes\n \"nth(i,env) = r\" \"nth(j,env) = rp\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"rtran_closure(##A,r,rp) \\ sats(A,?rtc(i,j),env)\"\n unfolding rtran_closure_def\n by (insert assms ; (rule sep_rules rtran_closure_mem_auto | simp)+)\n\nschematic_goal trans_closure_fm_auto:\n assumes\n \"nth(i,env) = r\" \"nth(j,env) = rp\"\n \"i \\ nat\" \"j \\ nat\" \"env \\ list(A)\"\n shows\n \"tran_closure(##A,r,rp) \\ sats(A,?tc(i,j),env)\"\n unfolding tran_closure_def\n by (insert assms ; (rule sep_rules rtran_closure_fm_auto | simp))+\n\nsynthesize \"trans_closure_fm\" from_schematic trans_closure_fm_auto\n\nschematic_goal wellfounded_trancl_fm_auto:\n assumes\n \"nth(i,env) = p\" \"nth(j,env) = r\" \"nth(k,env) = B\"\n \"i \\ nat\" \"j \\ nat\" \"k \\ nat\" \"env \\ list(A)\"\n shows\n \"wellfounded_trancl(##A,B,r,p) \\ sats(A,?wtf(i,j,k),env)\"\n unfolding wellfounded_trancl_def\n by (insert assms ; (rule sep_rules trans_closure_fm_iff_sats | simp)+)\n\nlemma (in M_ZF_trans) wftrancl_separation_intf:\n assumes\n \"r\\M\"\n and\n \"Z\\M\"\n shows\n \"separation (##M, wellfounded_trancl(##M,Z,r))\"\nproof -\n obtain rcfm where\n fmsats:\"\\env. env\\list(M) \\\n (wellfounded_trancl(##M,nth(2,env),nth(1,env),nth(0,env))) \\ sats(M,rcfm(0,1,2),env)\"\n and\n \"rcfm(0,1,2) \\ formula\"\n and\n \"arity(rcfm(0,1,2)) = 3\"\n using wellfounded_trancl_fm_auto[of concl:M \"nth(2,_)\"] unfolding fm_defs trans_closure_fm_def\n by (simp del:FOL_sats_iff pair_abs add: fm_defs nat_simp_union)\n then\n have \"\\x\\M. \\z\\M. separation(##M, \\y. sats(M,rcfm(0,1,2) , [y,x,z]))\"\n using separation_ax by simp\n moreover\n have \"(wellfounded_trancl(##M,z,x,y))\n \\ sats(M,rcfm(0,1,2) , [y,x,z])\"\n if \"y\\M\" \"x\\M\" \"z\\M\" for y x z\n using that fmsats[of \"[y,x,z]\"] by simp\n ultimately\n have \"\\x\\M. \\z\\M. separation(##M, wellfounded_trancl(##M,z,x))\"\n unfolding separation_def by simp\n with \\r\\M\\ \\Z\\M\\ show ?thesis by simp\nqed\n\n(* nat \\ M *)\n\nlemma (in M_ZF_trans) finite_sep_intf:\n \"separation(##M, \\x. x\\nat)\"\nproof -\n have \"arity(finite_ordinal_fm(0)) = 1 \"\n unfolding finite_ordinal_fm_def limit_ordinal_fm_def empty_fm_def succ_fm_def cons_fm_def\n union_fm_def upair_fm_def\n by (simp add: nat_union_abs1 Un_commute)\n with separation_ax\n have \"(\\v\\M. separation(##M,\\x. sats(M,finite_ordinal_fm(0),[x,v])))\"\n by simp\n then have \"(\\v\\M. separation(##M,finite_ordinal(##M)))\"\n unfolding separation_def by simp\n then have \"separation(##M,finite_ordinal(##M))\"\n using zero_in_M by auto\n then show ?thesis unfolding separation_def by simp\nqed\n\n\nlemma (in M_ZF_trans) nat_subset_I' :\n \"\\ I\\M ; 0\\I ; \\x. x\\I \\ succ(x)\\I \\ \\ nat \\ I\"\n by (rule subsetI,induct_tac x,simp+)\n\n\nlemma (in M_ZF_trans) nat_subset_I :\n \"\\I\\M. nat \\ I\"\nproof -\n have \"\\I\\M. 0\\I \\ (\\x\\M. x\\I \\ succ(x)\\I)\"\n using infinity_ax unfolding infinity_ax_def by auto\n then obtain I where\n \"I\\M\" \"0\\I\" \"(\\x\\M. x\\I \\ succ(x)\\I)\"\n by auto\n then have \"\\x. x\\I \\ succ(x)\\I\"\n using Transset_intf[OF trans_M] by simp\n then have \"nat\\I\"\n using \\I\\M\\ \\0\\I\\ nat_subset_I' by simp\n then show ?thesis using \\I\\M\\ by auto\nqed\n\nlemma (in M_ZF_trans) nat_in_M :\n \"nat \\ M\"\nproof -\n have 1:\"{x\\B . x\\A}=A\" if \"A\\B\" for A B\n using that by auto\n obtain I where\n \"I\\M\" \"nat\\I\"\n using nat_subset_I by auto\n then have \"{x\\I . x\\nat} \\ M\"\n using finite_sep_intf separation_closed[of \"\\x . x\\nat\"] by simp\n then show ?thesis\n using \\nat\\I\\ 1 by simp\nqed\n (* end nat \\ M *)\n\n\nlemma (in M_ZF_trans) mtrancl : \"M_trancl(##M)\"\n using mbasic rtrancl_separation_intf wftrancl_separation_intf nat_in_M\n wellfounded_trancl_def\n by unfold_locales auto\n\nsublocale M_ZF_trans \\ M_trancl \"##M\"\n by (rule mtrancl)\n\nsubsection\\Interface with \\<^term>\\M_eclose\\\\\n\nlemma repl_sats:\n assumes\n sat:\"\\x z. x\\M \\ z\\M \\ sats(M,\\,Cons(x,Cons(z,env))) \\ P(x,z)\"\n shows\n \"strong_replacement(##M,\\x z. sats(M,\\,Cons(x,Cons(z,env)))) \\\n strong_replacement(##M,P)\"\n by (rule strong_replacement_cong,simp add:sat)\n\nlemma (in M_ZF_trans) nat_trans_M :\n \"n\\M\" if \"n\\nat\" for n\n using that nat_in_M Transset_intf[OF trans_M] by simp\n\nlemma (in M_ZF_trans) list_repl1_intf:\n assumes\n \"A\\M\"\n shows\n \"iterates_replacement(##M, is_list_functor(##M,A), 0)\"\nproof -\n {\n fix n\n assume \"n\\nat\"\n have \"succ(n)\\M\"\n using \\n\\nat\\ nat_trans_M by simp\n then have 1:\"Memrel(succ(n))\\M\"\n using \\n\\nat\\ Memrel_closed by simp\n have \"0\\M\"\n using nat_0I nat_trans_M by simp\n then have \"is_list_functor(##M, A, a, b)\n \\ sats(M, list_functor_fm(13,1,0), [b,a,c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),A,0])\"\n if \"a\\M\" \"b\\M\" \"c\\M\" \"d\\M\" \"a0\\M\" \"a1\\M\" \"a2\\M\" \"a3\\M\" \"a4\\M\" \"y\\M\" \"x\\M\" \"z\\M\"\n for a b c d a0 a1 a2 a3 a4 y x z\n using that 1 \\A\\M\\ list_functor_iff_sats by simp\n then have \"sats(M, iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0), [a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),A,0])\n \\ iterates_MH(##M,is_list_functor(##M,A),0,a2, a1, a0)\"\n if \"a0\\M\" \"a1\\M\" \"a2\\M\" \"a3\\M\" \"a4\\M\" \"y\\M\" \"x\\M\" \"z\\M\"\n for a0 a1 a2 a3 a4 y x z\n using that sats_iterates_MH_fm[of M \"is_list_functor(##M,A)\" _] 1 \\0\\M\\ \\A\\M\\ by simp\n then have 2:\"sats(M, is_wfrec_fm(iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0),3,1,0),\n [y,x,z,Memrel(succ(n)),A,0])\n \\\n is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) , Memrel(succ(n)), x, y)\"\n if \"y\\M\" \"x\\M\" \"z\\M\" for y x z\n using that sats_is_wfrec_fm 1 \\0\\M\\ \\A\\M\\ by simp\n let\n ?f=\"Exists(And(pair_fm(1,0,2),\n is_wfrec_fm(iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0),3,1,0)))\"\n have satsf:\"sats(M, ?f, [x,z,Memrel(succ(n)),A,0])\n \\\n (\\y\\M. pair(##M,x,y,z) &\n is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) , Memrel(succ(n)), x, y))\"\n if \"x\\M\" \"z\\M\" for x z\n using that 2 1 \\0\\M\\ \\A\\M\\ by (simp del:pair_abs)\n have \"arity(?f) = 5\"\n unfolding iterates_MH_fm_def is_wfrec_fm_def is_recfun_fm_def is_nat_case_fm_def\n restriction_fm_def list_functor_fm_def number1_fm_def cartprod_fm_def\n sum_fm_def quasinat_fm_def pre_image_fm_def fm_defs\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\x z. sats(M,?f,[x,z,Memrel(succ(n)),A,0]))\"\n using replacement_ax 1 \\A\\M\\ \\0\\M\\ by simp\n then\n have \"strong_replacement(##M,\\x z.\n \\y\\M. pair(##M,x,y,z) & is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) ,\n Memrel(succ(n)), x, y))\"\n using repl_sats[of M ?f \"[Memrel(succ(n)),A,0]\"] satsf by (simp del:pair_abs)\n }\n then\n show ?thesis unfolding iterates_replacement_def wfrec_replacement_def by simp\nqed\n\n\n\n(* Iterates_replacement para predicados sin parámetros *)\nlemma (in M_ZF_trans) iterates_repl_intf :\n assumes\n \"v\\M\" and\n isfm:\"is_F_fm \\ formula\" and\n arty:\"arity(is_F_fm)=2\" and\n satsf: \"\\a b env'. \\ a\\M ; b\\M ; env'\\list(M) \\\n \\ is_F(a,b) \\ sats(M, is_F_fm, [b,a]@env')\"\n shows\n \"iterates_replacement(##M,is_F,v)\"\nproof -\n {\n fix n\n assume \"n\\nat\"\n have \"succ(n)\\M\"\n using \\n\\nat\\ nat_trans_M by simp\n then have 1:\"Memrel(succ(n))\\M\"\n using \\n\\nat\\ Memrel_closed by simp\n {\n fix a0 a1 a2 a3 a4 y x z\n assume as:\"a0\\M\" \"a1\\M\" \"a2\\M\" \"a3\\M\" \"a4\\M\" \"y\\M\" \"x\\M\" \"z\\M\"\n have \"sats(M, is_F_fm, Cons(b,Cons(a,Cons(c,Cons(d,[a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v])))))\n \\ is_F(a,b)\"\n if \"a\\M\" \"b\\M\" \"c\\M\" \"d\\M\" for a b c d\n using as that 1 satsf[of a b \"[c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v]\"] \\v\\M\\ by simp\n then\n have \"sats(M, iterates_MH_fm(is_F_fm,9,2,1,0), [a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v])\n \\ iterates_MH(##M,is_F,v,a2, a1, a0)\"\n using as\n sats_iterates_MH_fm[of M \"is_F\" \"is_F_fm\"] 1 \\v\\M\\ by simp\n }\n then have 2:\"sats(M, is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0),\n [y,x,z,Memrel(succ(n)),v])\n \\\n is_wfrec(##M, iterates_MH(##M,is_F,v),Memrel(succ(n)), x, y)\"\n if \"y\\M\" \"x\\M\" \"z\\M\" for y x z\n using that sats_is_wfrec_fm 1 \\v\\M\\ by simp\n let\n ?f=\"Exists(And(pair_fm(1,0,2),\n is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0)))\"\n have satsf:\"sats(M, ?f, [x,z,Memrel(succ(n)),v])\n \\\n (\\y\\M. pair(##M,x,y,z) &\n is_wfrec(##M, iterates_MH(##M,is_F,v) , Memrel(succ(n)), x, y))\"\n if \"x\\M\" \"z\\M\" for x z\n using that 2 1 \\v\\M\\ by (simp del:pair_abs)\n have \"arity(?f) = 4\"\n unfolding iterates_MH_fm_def is_wfrec_fm_def is_recfun_fm_def is_nat_case_fm_def\n restriction_fm_def pre_image_fm_def quasinat_fm_def fm_defs\n using arty by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\x z. sats(M,?f,[x,z,Memrel(succ(n)),v]))\"\n using replacement_ax 1 \\v\\M\\ \\is_F_fm\\formula\\ by simp\n then\n have \"strong_replacement(##M,\\x z.\n \\y\\M. pair(##M,x,y,z) & is_wfrec(##M, iterates_MH(##M,is_F,v) ,\n Memrel(succ(n)), x, y))\"\n using repl_sats[of M ?f \"[Memrel(succ(n)),v]\"] satsf by (simp del:pair_abs)\n }\n then\n show ?thesis unfolding iterates_replacement_def wfrec_replacement_def by simp\nqed\n\nlemma (in M_ZF_trans) formula_repl1_intf :\n \"iterates_replacement(##M, is_formula_functor(##M), 0)\"\nproof -\n have \"0\\M\"\n using nat_0I nat_trans_M by simp\n have 1:\"arity(formula_functor_fm(1,0)) = 2\"\n unfolding formula_functor_fm_def fm_defs sum_fm_def cartprod_fm_def number1_fm_def\n by (simp add:nat_simp_union)\n have 2:\"formula_functor_fm(1,0)\\formula\" by simp\n have \"is_formula_functor(##M,a,b) \\\n sats(M, formula_functor_fm(1,0), [b,a])\"\n if \"a\\M\" \"b\\M\" for a b\n using that by simp\n then show ?thesis using \\0\\M\\ 1 2 iterates_repl_intf by simp\nqed\n\nlemma (in M_ZF_trans) nth_repl_intf:\n assumes\n \"l \\ M\"\n shows\n \"iterates_replacement(##M,\\l' t. is_tl(##M,l',t),l)\"\nproof -\n have 1:\"arity(tl_fm(1,0)) = 2\"\n unfolding tl_fm_def fm_defs quasilist_fm_def Cons_fm_def Nil_fm_def Inr_fm_def number1_fm_def\n Inl_fm_def by (simp add:nat_simp_union)\n have 2:\"tl_fm(1,0)\\formula\" by simp\n have \"is_tl(##M,a,b) \\ sats(M, tl_fm(1,0), [b,a])\"\n if \"a\\M\" \"b\\M\" for a b\n using that by simp\n then show ?thesis using \\l\\M\\ 1 2 iterates_repl_intf by simp\nqed\n\n\nlemma (in M_ZF_trans) eclose_repl1_intf:\n assumes\n \"A\\M\"\n shows\n \"iterates_replacement(##M, big_union(##M), A)\"\nproof -\n have 1:\"arity(big_union_fm(1,0)) = 2\"\n unfolding big_union_fm_def fm_defs by (simp add:nat_simp_union)\n have 2:\"big_union_fm(1,0)\\formula\" by simp\n have \"big_union(##M,a,b) \\ sats(M, big_union_fm(1,0), [b,a])\"\n if \"a\\M\" \"b\\M\" for a b\n using that by simp\n then show ?thesis using \\A\\M\\ 1 2 iterates_repl_intf by simp\nqed\n\n(*\n and list_replacement2:\n \"M(A) \\ strong_replacement(M,\n \\n y. n\\nat & is_iterates(M, is_list_functor(M,A), 0, n, y))\"\n\n*)\nlemma (in M_ZF_trans) list_repl2_intf:\n assumes\n \"A\\M\"\n shows\n \"strong_replacement(##M,\\n y. n\\nat & is_iterates(##M, is_list_functor(##M,A), 0, n, y))\"\nproof -\n have \"0\\M\"\n using nat_0I nat_trans_M by simp\n have \"is_list_functor(##M,A,a,b) \\\n sats(M,list_functor_fm(13,1,0),[b,a,c,d,e,f,g,h,i,j,k,n,y,A,0,nat])\"\n if \"a\\M\" \"b\\M\" \"c\\M\" \"d\\M\" \"e\\M\" \"f\\M\"\"g\\M\"\"h\\M\"\"i\\M\"\"j\\M\" \"k\\M\" \"n\\M\" \"y\\M\"\n for a b c d e f g h i j k n y\n using that \\0\\M\\ nat_in_M \\A\\M\\ by simp\n then\n have 1:\"sats(M, is_iterates_fm(list_functor_fm(13,1,0),3,0,1),[n,y,A,0,nat] ) \\\n is_iterates(##M, is_list_functor(##M,A), 0, n , y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\0\\M\\ \\A\\M\\ nat_in_M\n sats_is_iterates_fm[of M \"is_list_functor(##M,A)\"] by simp\n let ?f = \"And(Member(0,4),is_iterates_fm(list_functor_fm(13,1,0),3,0,1))\"\n have satsf:\"sats(M, ?f,[n,y,A,0,nat] ) \\\n n\\nat & is_iterates(##M, is_list_functor(##M,A), 0, n, y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\0\\M\\ \\A\\M\\ nat_in_M 1 by simp\n have \"arity(?f) = 5\"\n unfolding is_iterates_fm_def restriction_fm_def list_functor_fm_def number1_fm_def Memrel_fm_def\n cartprod_fm_def sum_fm_def quasinat_fm_def pre_image_fm_def fm_defs is_wfrec_fm_def\n is_recfun_fm_def iterates_MH_fm_def is_nat_case_fm_def\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\n y. sats(M,?f,[n,y,A,0,nat]))\"\n using replacement_ax 1 nat_in_M \\A\\M\\ \\0\\M\\ by simp\n then\n show ?thesis using repl_sats[of M ?f \"[A,0,nat]\"] satsf by simp\nqed\n\nlemma (in M_ZF_trans) formula_repl2_intf:\n \"strong_replacement(##M,\\n y. n\\nat & is_iterates(##M, is_formula_functor(##M), 0, n, y))\"\nproof -\n have \"0\\M\"\n using nat_0I nat_trans_M by simp\n have \"is_formula_functor(##M,a,b) \\\n sats(M,formula_functor_fm(1,0),[b,a,c,d,e,f,g,h,i,j,k,n,y,0,nat])\"\n if \"a\\M\" \"b\\M\" \"c\\M\" \"d\\M\" \"e\\M\" \"f\\M\"\"g\\M\"\"h\\M\"\"i\\M\"\"j\\M\" \"k\\M\" \"n\\M\" \"y\\M\"\n for a b c d e f g h i j k n y\n using that \\0\\M\\ nat_in_M by simp\n then\n have 1:\"sats(M, is_iterates_fm(formula_functor_fm(1,0),2,0,1),[n,y,0,nat] ) \\\n is_iterates(##M, is_formula_functor(##M), 0, n , y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\0\\M\\ nat_in_M\n sats_is_iterates_fm[of M \"is_formula_functor(##M)\"] by simp\n let ?f = \"And(Member(0,3),is_iterates_fm(formula_functor_fm(1,0),2,0,1))\"\n have satsf:\"sats(M, ?f,[n,y,0,nat] ) \\\n n\\nat & is_iterates(##M, is_formula_functor(##M), 0, n, y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\0\\M\\ nat_in_M 1 by simp\n have artyf:\"arity(?f) = 4\"\n unfolding is_iterates_fm_def formula_functor_fm_def fm_defs sum_fm_def quasinat_fm_def\n cartprod_fm_def number1_fm_def Memrel_fm_def ordinal_fm_def transset_fm_def\n is_wfrec_fm_def is_recfun_fm_def iterates_MH_fm_def is_nat_case_fm_def subset_fm_def\n pre_image_fm_def restriction_fm_def\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\n y. sats(M,?f,[n,y,0,nat]))\"\n using replacement_ax 1 artyf \\0\\M\\ nat_in_M by simp\n then\n show ?thesis using repl_sats[of M ?f \"[0,nat]\"] satsf by simp\nqed\n\n\n(*\n \"M(A) \\ strong_replacement(M,\n \\n y. n\\nat & is_iterates(M, big_union(M), A, n, y))\"\n*)\n\nlemma (in M_ZF_trans) eclose_repl2_intf:\n assumes\n \"A\\M\"\n shows\n \"strong_replacement(##M,\\n y. n\\nat & is_iterates(##M, big_union(##M), A, n, y))\"\nproof -\n have \"big_union(##M,a,b) \\\n sats(M,big_union_fm(1,0),[b,a,c,d,e,f,g,h,i,j,k,n,y,A,nat])\"\n if \"a\\M\" \"b\\M\" \"c\\M\" \"d\\M\" \"e\\M\" \"f\\M\"\"g\\M\"\"h\\M\"\"i\\M\"\"j\\M\" \"k\\M\" \"n\\M\" \"y\\M\"\n for a b c d e f g h i j k n y\n using that \\A\\M\\ nat_in_M by simp\n then\n have 1:\"sats(M, is_iterates_fm(big_union_fm(1,0),2,0,1),[n,y,A,nat] ) \\\n is_iterates(##M, big_union(##M), A, n , y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\A\\M\\ nat_in_M\n sats_is_iterates_fm[of M \"big_union(##M)\"] by simp\n let ?f = \"And(Member(0,3),is_iterates_fm(big_union_fm(1,0),2,0,1))\"\n have satsf:\"sats(M, ?f,[n,y,A,nat] ) \\\n n\\nat & is_iterates(##M, big_union(##M), A, n, y)\"\n if \"n\\M\" \"y\\M\" for n y\n using that \\A\\M\\ nat_in_M 1 by simp\n have artyf:\"arity(?f) = 4\"\n unfolding is_iterates_fm_def formula_functor_fm_def fm_defs sum_fm_def quasinat_fm_def\n cartprod_fm_def number1_fm_def Memrel_fm_def ordinal_fm_def transset_fm_def\n is_wfrec_fm_def is_recfun_fm_def iterates_MH_fm_def is_nat_case_fm_def subset_fm_def\n pre_image_fm_def restriction_fm_def\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\n y. sats(M,?f,[n,y,A,nat]))\"\n using replacement_ax 1 artyf \\A\\M\\ nat_in_M by simp\n then\n show ?thesis using repl_sats[of M ?f \"[A,nat]\"] satsf by simp\nqed\n\nlemma (in M_ZF_trans) mdatatypes : \"M_datatypes(##M)\"\n using mtrancl list_repl1_intf list_repl2_intf formula_repl1_intf\n formula_repl2_intf nth_repl_intf\n by unfold_locales auto\n\nsublocale M_ZF_trans \\ M_datatypes \"##M\"\n by (rule mdatatypes)\n\nlemma (in M_ZF_trans) meclose : \"M_eclose(##M)\"\n using mdatatypes eclose_repl1_intf eclose_repl2_intf\n by unfold_locales auto\n\nsublocale M_ZF_trans \\ M_eclose \"##M\"\n by (rule meclose)\n\n(* Interface with locale M_eclose_pow *)\n\n(* \"powerset(M,A,z) \\ \\x[M]. x \\ z \\ subset(M,x,A)\" *)\ndefinition\n powerset_fm :: \"[i,i] \\ i\" where\n \"powerset_fm(A,z) \\ Forall(Iff(Member(0,succ(z)),subset_fm(0,succ(A))))\"\n\nlemma powerset_type [TC]:\n \"\\ x \\ nat; y \\ nat \\ \\ powerset_fm(x,y) \\ formula\"\n by (simp add:powerset_fm_def)\n\ndefinition\n is_powapply_fm :: \"[i,i,i] \\ i\" where\n \"is_powapply_fm(f,y,z) \\\n Exists(And(fun_apply_fm(succ(f), succ(y), 0),\n Forall(Iff(Member(0, succ(succ(z))),\n Forall(Implies(Member(0, 1), Member(0, 2)))))))\"\n\nlemma is_powapply_type [TC] :\n \"\\f\\nat ; y\\nat; z\\nat\\ \\ is_powapply_fm(f,y,z)\\formula\"\n unfolding is_powapply_fm_def by simp\n\nlemma sats_is_powapply_fm :\n assumes\n \"f\\nat\" \"y\\nat\" \"z\\nat\" \"env\\list(A)\" \"0\\A\"\n shows\n \"is_powapply(##A,nth(f, env),nth(y, env),nth(z, env))\n \\ sats(A,is_powapply_fm(f,y,z),env)\"\n unfolding is_powapply_def is_powapply_fm_def is_Collect_def powerset_def subset_def\n using nth_closed assms by simp\n\n\nlemma (in M_ZF_trans) powapply_repl :\n assumes\n \"f\\M\"\n shows\n \"strong_replacement(##M,is_powapply(##M,f))\"\nproof -\n have \"arity(is_powapply_fm(2,0,1)) = 3\"\n unfolding is_powapply_fm_def\n by (simp add: fm_defs nat_simp_union)\n then\n have \"\\f0\\M. strong_replacement(##M, \\p z. sats(M,is_powapply_fm(2,0,1) , [p,z,f0]))\"\n using replacement_ax by simp\n moreover\n have \"is_powapply(##M,f0,p,z) \\ sats(M,is_powapply_fm(2,0,1) , [p,z,f0])\"\n if \"p\\M\" \"z\\M\" \"f0\\M\" for p z f0\n using that zero_in_M sats_is_powapply_fm[of 2 0 1 \"[p,z,f0]\" M] by simp\n ultimately\n have \"\\f0\\M. strong_replacement(##M, is_powapply(##M,f0))\"\n unfolding strong_replacement_def univalent_def by simp\n with \\f\\M\\ show ?thesis by simp\nqed\n\n\n(*\"PHrank(M,f,y,z) \\ M(z) \\ (\\fy[M]. fun_apply(M,f,y,fy) \\ successor(M,fy,z))\"*)\ndefinition\n PHrank_fm :: \"[i,i,i] \\ i\" where\n \"PHrank_fm(f,y,z) \\ Exists(And(fun_apply_fm(succ(f),succ(y),0)\n ,succ_fm(0,succ(z))))\"\n\nlemma PHrank_type [TC]:\n \"\\ x \\ nat; y \\ nat; z \\ nat \\ \\ PHrank_fm(x,y,z) \\ formula\"\n by (simp add:PHrank_fm_def)\n\n\nlemma (in M_ZF_trans) sats_PHrank_fm [simp]:\n \"\\ x \\ nat; y \\ nat; z \\ nat; env \\ list(M) \\ \n \\ sats(M,PHrank_fm(x,y,z),env) \\\n PHrank(##M,nth(x,env),nth(y,env),nth(z,env))\"\n using zero_in_M Internalizations.nth_closed by (simp add: PHrank_def PHrank_fm_def)\n\n\nlemma (in M_ZF_trans) phrank_repl :\n assumes\n \"f\\M\"\n shows\n \"strong_replacement(##M,PHrank(##M,f))\"\nproof -\n have \"arity(PHrank_fm(2,0,1)) = 3\"\n unfolding PHrank_fm_def\n by (simp add: fm_defs nat_simp_union)\n then\n have \"\\f0\\M. strong_replacement(##M, \\p z. sats(M,PHrank_fm(2,0,1) , [p,z,f0]))\"\n using replacement_ax by simp\n then\n have \"\\f0\\M. strong_replacement(##M, PHrank(##M,f0))\"\n unfolding strong_replacement_def univalent_def by simp\n with \\f\\M\\ show ?thesis by simp\nqed\n\n\n(*\"is_Hrank(M,x,f,hc) \\ (\\R[M]. big_union(M,R,hc) \\is_Replace(M,x,PHrank(M,f),R)) \"*)\ndefinition\n is_Hrank_fm :: \"[i,i,i] \\ i\" where\n \"is_Hrank_fm(x,f,hc) \\ Exists(And(big_union_fm(0,succ(hc)),\n Replace_fm(succ(x),PHrank_fm(succ(succ(succ(f))),0,1),0)))\"\n\nlemma is_Hrank_type [TC]:\n \"\\ x \\ nat; y \\ nat; z \\ nat \\ \\ is_Hrank_fm(x,y,z) \\ formula\"\n by (simp add:is_Hrank_fm_def)\n\nlemma (in M_ZF_trans) sats_is_Hrank_fm [simp]:\n \"\\ x \\ nat; y \\ nat; z \\ nat; env \\ list(M)\\\n \\ sats(M,is_Hrank_fm(x,y,z),env) \\\n is_Hrank(##M,nth(x,env),nth(y,env),nth(z,env))\"\n using zero_in_M is_Hrank_def is_Hrank_fm_def sats_Replace_fm\n by simp\n\n(* M(x) \\ wfrec_replacement(M,is_Hrank(M),rrank(x)) *)\nlemma (in M_ZF_trans) wfrec_rank :\n assumes\n \"X\\M\"\n shows\n \"wfrec_replacement(##M,is_Hrank(##M),rrank(X))\"\nproof -\n have\n \"is_Hrank(##M,a2, a1, a0) \\\n sats(M, is_Hrank_fm(2,1,0), [a0,a1,a2,a3,a4,y,x,z,rrank(X)])\"\n if \"a4\\M\" \"a3\\M\" \"a2\\M\" \"a1\\M\" \"a0\\M\" \"y\\M\" \"x\\M\" \"z\\M\" for a4 a3 a2 a1 a0 y x z\n using that rrank_in_M \\X\\M\\ by simp\n then\n have\n 1:\"sats(M, is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0),[y,x,z,rrank(X)])\n \\ is_wfrec(##M, is_Hrank(##M) ,rrank(X), x, y)\"\n if \"y\\M\" \"x\\M\" \"z\\M\" for y x z\n using that \\X\\M\\ rrank_in_M sats_is_wfrec_fm by simp\n let\n ?f=\"Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0)))\"\n have satsf:\"sats(M, ?f, [x,z,rrank(X)])\n \\ (\\y\\M. pair(##M,x,y,z) & is_wfrec(##M, is_Hrank(##M) , rrank(X), x, y))\"\n if \"x\\M\" \"z\\M\" for x z\n using that 1 \\X\\M\\ rrank_in_M by (simp del:pair_abs)\n have \"arity(?f) = 3\"\n unfolding is_wfrec_fm_def is_recfun_fm_def is_nat_case_fm_def is_Hrank_fm_def PHrank_fm_def\n restriction_fm_def list_functor_fm_def number1_fm_def cartprod_fm_def\n sum_fm_def quasinat_fm_def pre_image_fm_def fm_defs\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\x z. sats(M,?f,[x,z,rrank(X)]))\"\n using replacement_ax 1 \\X\\M\\ rrank_in_M by simp\n then\n have \"strong_replacement(##M,\\x z.\n \\y\\M. pair(##M,x,y,z) & is_wfrec(##M, is_Hrank(##M) , rrank(X), x, y))\"\n using repl_sats[of M ?f \"[rrank(X)]\"] satsf by (simp del:pair_abs)\n then\n show ?thesis unfolding wfrec_replacement_def by simp\nqed\n\n(*\"is_HVfrom(M,A,x,f,h) \\ \\U[M]. \\R[M]. union(M,A,U,h)\n \\ big_union(M,R,U) \\ is_Replace(M,x,is_powapply(M,f),R)\"*)\ndefinition\n is_HVfrom_fm :: \"[i,i,i,i] \\ i\" where\n \"is_HVfrom_fm(A,x,f,h) \\ Exists(Exists(And(union_fm(A #+ 2,1,h #+ 2),\n And(big_union_fm(0,1),\n Replace_fm(x #+ 2,is_powapply_fm(f #+ 4,0,1),0)))))\"\n\nlemma is_HVfrom_type [TC]:\n \"\\ A\\nat; x \\ nat; f \\ nat; h \\ nat \\ \\ is_HVfrom_fm(A,x,f,h) \\ formula\"\n by (simp add:is_HVfrom_fm_def)\n\nlemma sats_is_HVfrom_fm :\n \"\\ a\\nat; x \\ nat; f \\ nat; h \\ nat; env \\ list(A); 0\\A\\\n \\ sats(A,is_HVfrom_fm(a,x,f,h),env) \\\n is_HVfrom(##A,nth(a,env),nth(x,env),nth(f,env),nth(h,env))\"\n using is_HVfrom_def is_HVfrom_fm_def sats_Replace_fm[OF sats_is_powapply_fm]\n by simp\n\nlemma is_HVfrom_iff_sats:\n assumes\n \"nth(a,env) = aa\" \"nth(x,env) = xx\" \"nth(f,env) = ff\" \"nth(h,env) = hh\"\n \"a\\nat\" \"x\\nat\" \"f\\nat\" \"h\\nat\" \"env\\list(A)\" \"0\\A\"\n shows\n \"is_HVfrom(##A,aa,xx,ff,hh) \\ sats(A, is_HVfrom_fm(a,x,f,h), env)\"\n using assms sats_is_HVfrom_fm by simp\n\n(* FIX US *)\nschematic_goal sats_is_Vset_fm_auto:\n assumes\n \"i\\nat\" \"v\\nat\" \"env\\list(A)\" \"0\\A\"\n \"i < length(env)\" \"v < length(env)\"\n shows\n \"is_Vset(##A,nth(i, env),nth(v, env))\n \\ sats(A,?ivs_fm(i,v),env)\"\n unfolding is_Vset_def is_Vfrom_def\n by (insert assms; (rule sep_rules is_HVfrom_iff_sats is_transrec_iff_sats | simp)+)\n\nschematic_goal is_Vset_iff_sats:\n assumes\n \"nth(i,env) = ii\" \"nth(v,env) = vv\"\n \"i\\nat\" \"v\\nat\" \"env\\list(A)\" \"0\\A\"\n \"i < length(env)\" \"v < length(env)\"\n shows\n \"is_Vset(##A,ii,vv) \\ sats(A, ?ivs_fm(i,v), env)\"\n unfolding \\nth(i,env) = ii\\[symmetric] \\nth(v,env) = vv\\[symmetric]\n by (rule sats_is_Vset_fm_auto(1); simp add:assms)\n\n\nlemma (in M_ZF_trans) memrel_eclose_sing :\n \"a\\M \\ \\sa\\M. \\esa\\M. \\mesa\\M.\n upair(##M,a,a,sa) & is_eclose(##M,sa,esa) & membership(##M,esa,mesa)\"\n using upair_ax eclose_closed Memrel_closed unfolding upair_ax_def\n by (simp del:upair_abs)\n\n\nlemma (in M_ZF_trans) trans_repl_HVFrom :\n assumes\n \"A\\M\" \"i\\M\"\n shows\n \"transrec_replacement(##M,is_HVfrom(##M,A),i)\"\nproof -\n { fix mesa\n assume \"mesa\\M\"\n have\n 0:\"is_HVfrom(##M,A,a2, a1, a0) \\\n sats(M, is_HVfrom_fm(8,2,1,0), [a0,a1,a2,a3,a4,y,x,z,A,mesa])\"\n if \"a4\\M\" \"a3\\M\" \"a2\\M\" \"a1\\M\" \"a0\\M\" \"y\\M\" \"x\\M\" \"z\\M\" for a4 a3 a2 a1 a0 y x z\n using that zero_in_M sats_is_HVfrom_fm \\mesa\\M\\ \\A\\M\\ by simp\n have\n 1:\"sats(M, is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0),[y,x,z,A,mesa])\n \\ is_wfrec(##M, is_HVfrom(##M,A),mesa, x, y)\"\n if \"y\\M\" \"x\\M\" \"z\\M\" for y x z\n using that \\A\\M\\ \\mesa\\M\\ sats_is_wfrec_fm[OF 0] by simp\n let\n ?f=\"Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0)))\"\n have satsf:\"sats(M, ?f, [x,z,A,mesa])\n \\ (\\y\\M. pair(##M,x,y,z) & is_wfrec(##M, is_HVfrom(##M,A) , mesa, x, y))\"\n if \"x\\M\" \"z\\M\" for x z\n using that 1 \\A\\M\\ \\mesa\\M\\ by (simp del:pair_abs)\n have \"arity(?f) = 4\"\n unfolding is_HVfrom_fm_def is_wfrec_fm_def is_recfun_fm_def is_nat_case_fm_def\n restriction_fm_def list_functor_fm_def number1_fm_def cartprod_fm_def\n is_powapply_fm_def sum_fm_def quasinat_fm_def pre_image_fm_def fm_defs\n by (simp add:nat_simp_union)\n then\n have \"strong_replacement(##M,\\x z. sats(M,?f,[x,z,A,mesa]))\"\n using replacement_ax 1 \\A\\M\\ \\mesa\\M\\ by simp\n then\n have \"strong_replacement(##M,\\x z.\n \\y\\M. pair(##M,x,y,z) & is_wfrec(##M, is_HVfrom(##M,A) , mesa, x, y))\"\n using repl_sats[of M ?f \"[A,mesa]\"] satsf by (simp del:pair_abs)\n then\n have \"wfrec_replacement(##M,is_HVfrom(##M,A),mesa)\"\n unfolding wfrec_replacement_def by simp\n }\n then show ?thesis unfolding transrec_replacement_def\n using \\i\\M\\ memrel_eclose_sing by simp\nqed\n\n\nlemma (in M_ZF_trans) meclose_pow : \"M_eclose_pow(##M)\"\n using meclose power_ax powapply_repl phrank_repl trans_repl_HVFrom wfrec_rank\n by unfold_locales auto\n\nsublocale M_ZF_trans \\ M_eclose_pow \"##M\"\n by (rule meclose_pow)\n\nlemma (in M_ZF_trans) repl_gen :\n assumes\n f_abs: \"\\x y. \\ x\\M; y\\M \\ \\ is_F(##M,x,y) \\ y = f(x)\"\n and\n f_sats: \"\\x y. \\x\\M ; y\\M \\ \\\n sats(M,f_fm,Cons(x,Cons(y,env))) \\ is_F(##M,x,y)\"\n and\n f_form: \"f_fm \\ formula\"\n and\n f_arty: \"arity(f_fm) = 2\"\n and\n \"env\\list(M)\"\n shows\n \"strong_replacement(##M, \\x y. y = f(x))\"\nproof -\n have \"sats(M,f_fm,[x,y]@env) \\ is_F(##M,x,y)\" if \"x\\M\" \"y\\M\" for x y\n using that f_sats[of x y] by simp\n moreover\n from f_form f_arty\n have \"strong_replacement(##M, \\x y. sats(M,f_fm,[x,y]@env))\"\n using \\env\\list(M)\\ replacement_ax by simp\n ultimately\n have \"strong_replacement(##M, is_F(##M))\"\n using strong_replacement_cong[of \"##M\" \"\\x y. sats(M,f_fm,[x,y]@env)\" \"is_F(##M)\"] by simp\n with f_abs show ?thesis\n using strong_replacement_cong[of \"##M\" \"is_F(##M)\" \"\\x y. y = f(x)\"] by simp\nqed\n\n(* Proof Scheme for instances of separation *)\nlemma (in M_ZF_trans) sep_in_M :\n assumes\n \"\\ \\ formula\" \"env\\list(M)\"\n \"arity(\\) \\ 1 #+ length(env)\" \"A\\M\" and\n satsQ: \"\\x. x\\M \\ sats(M,\\,[x]@env) \\ Q(x)\"\n shows\n \"{y\\A . Q(y)}\\M\"\nproof -\n have \"separation(##M,\\x. sats(M,\\,[x] @ env))\"\n using assms separation_ax by simp\n then show ?thesis using\n \\A\\M\\ satsQ trans_M\n separation_cong[of \"##M\" \"\\y. sats(M,\\,[y]@env)\" \"Q\"]\n separation_closed by simp\nqed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Forcing/Interface.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2860522664194274}} {"text": "(* Title: Jinja/Compiler/Correctness2.thy\n Author: Tobias Nipkow\n Copyright TUM 2003\n*)\n\nsection \\Correctness of Stage 2\\\n\ntheory Correctness2\nimports \"HOL-Library.Sublist\" Compiler2\nbegin\n\n(*<*)hide_const (open) Throw(*>*)\n\nsubsection\\Instruction sequences\\\n\ntext\\How to select individual instructions and subsequences of\ninstructions from a program given the class, method and program\ncounter.\\\n\ndefinition before :: \"jvm_prog \\ cname \\ mname \\ nat \\ instr list \\ bool\"\n (\"(_,_,_,_/ \\ _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\ is \\ prefix is (drop pc (instrs_of P C M))\"\n\ndefinition at :: \"jvm_prog \\ cname \\ mname \\ nat \\ instr \\ bool\"\n (\"(_,_,_,_/ \\ _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\ i \\ (\\is. drop pc (instrs_of P C M) = i#is)\"\n\n\n\n\nlemma [simp]: \"P,C,M,pc \\ (i#is) = (P,C,M,pc \\ i \\ P,C,M,pc + 1 \\ is)\"\n(*<*)by(fastforce simp add:before_def at_def prefix_def drop_Suc drop_tl)(*>*)\n\n(*<*)\ndeclare drop_drop[simp del]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\ (is\\<^sub>1 @ is\\<^sub>2) = (P,C,M,pc \\ is\\<^sub>1 \\ P,C,M,pc + size is\\<^sub>1 \\ is\\<^sub>2)\"\n(*<*)\napply(simp add:before_def prefix_def)\napply(subst add.commute)\napply(simp add: drop_drop[symmetric])\napply fastforce\ndone\n(*>*)\n\n(*<*)\ndeclare drop_drop[simp]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\ i \\ instrs_of P C M ! pc = i\"\n(*<*)by(clarsimp simp add:at_def strict_prefix_def nth_via_drop)(*>*)\n\n\nlemma beforeM:\n \"P \\ C sees M: Ts\\T = body in D \\\n compP\\<^sub>2 P,D,M,0 \\ compE\\<^sub>2 body @ [Return]\"\n(*<*)\napply(drule sees_method_idemp)\napply(simp add:before_def compP\\<^sub>2_def compMb\\<^sub>2_def)\ndone\n(*>*)\n\ntext\\This lemma executes a single instruction by rewriting:\\\n\nlemma [simp]:\n \"P,C,M,pc \\ instr \\\n (P \\ (None, h, (vs,ls,C,M,pc) # frs) -jvm\\ \\') =\n ((None, h, (vs,ls,C,M,pc) # frs) = \\' \\\n (\\\\. exec(P,(None, h, (vs,ls,C,M,pc) # frs)) = Some \\ \\ P \\ \\ -jvm\\ \\'))\"\n(*<*)\napply(simp only: exec_all_def)\napply(blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)\ndone\n(*>*)\n\n\nsubsection\\Exception tables\\\n\ndefinition pcs :: \"ex_table \\ nat set\"\nwhere\n \"pcs xt \\ \\(f,t,C,h,d) \\ set xt. {f ..< t}\"\n\nlemma pcs_subset:\nshows \"\\pc d. pcs(compxE\\<^sub>2 e pc d) \\ {pc..2 e)}\"\nand \"\\pc d. pcs(compxEs\\<^sub>2 es pc d) \\ {pc..2 es)}\"\n(*<*)\napply(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\napply (simp_all add:pcs_def)\napply (fastforce split:bop.splits)+\ndone\n(*>*)\n\n\nlemma [simp]: \"pcs [] = {}\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs (x#xt) = {fst x ..< fst(snd x)} \\ pcs xt\"\n(*<*)by(auto simp add: pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs(xt\\<^sub>1 @ xt\\<^sub>2) = pcs xt\\<^sub>1 \\ pcs xt\\<^sub>2\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\ pc\\<^sub>0+size(compE\\<^sub>2 e) \\ pc \\ pc \\ pcs(compxE\\<^sub>2 e pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\ pc\\<^sub>0+size(compEs\\<^sub>2 es) \\ pc \\ pc \\ pcs(compxEs\\<^sub>2 es pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>1) \\ pc\\<^sub>2 \\ pcs(compxE\\<^sub>2 e\\<^sub>1 pc\\<^sub>1 d\\<^sub>1) \\ pcs(compxE\\<^sub>2 e\\<^sub>2 pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e) \\ pc\\<^sub>2 \\ pcs(compxE\\<^sub>2 e pc\\<^sub>1 d\\<^sub>1) \\ pcs(compxEs\\<^sub>2 es pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]:\n \"pc \\ pcs xt\\<^sub>0 \\ match_ex_table P C pc (xt\\<^sub>0 @ xt\\<^sub>1) = match_ex_table P C pc xt\\<^sub>1\"\n(*<*)by (induct xt\\<^sub>0) (auto simp: matches_ex_entry_def)(*>*)\n\n\nlemma [simp]: \"\\ x \\ set xt; pc \\ pcs xt \\ \\ \\ matches_ex_entry P D pc x\"\n(*<*)by(auto simp:matches_ex_entry_def pcs_def)(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\ set(compxE\\<^sub>2 e pc d)\" and outside: \"pc' < pc \\ pc+size(compE\\<^sub>2 e) \\ pc'\"\nshows \"\\ matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n assume \"matches_ex_entry P C pc' xe\"\n with xe have \"pc' \\ pcs(compxE\\<^sub>2 e pc d)\"\n by(force simp add:matches_ex_entry_def pcs_def)\n with outside show False by simp\nqed\n(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\ set(compxEs\\<^sub>2 es pc d)\" and outside: \"pc' < pc \\ pc+size(compEs\\<^sub>2 es) \\ pc'\"\nshows \"\\ matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n assume \"matches_ex_entry P C pc' xe\"\n with xe have \"pc' \\ pcs(compxEs\\<^sub>2 es pc d)\"\n by(force simp add:matches_ex_entry_def pcs_def)\n with outside show False by simp\nqed\n(*>*)\n\n\nlemma match_ex_table_app[simp]:\n \"\\xte \\ set xt\\<^sub>1. \\ matches_ex_entry P D pc xte \\\n match_ex_table P D pc (xt\\<^sub>1 @ xt) = match_ex_table P D pc xt\"\n(*<*)by(induct xt\\<^sub>1) simp_all(*>*)\n\n\nlemma [simp]:\n \"\\x \\ set xtab. \\ matches_ex_entry P C pc x \\\n match_ex_table P C pc xtab = None\"\n(*<*)using match_ex_table_app[where ?xt = \"[]\"] by fastforce(*>*)\n\n\nlemma match_ex_entry:\n \"matches_ex_entry P C pc (start, end, catch_type, handler) =\n (start \\ pc \\ pc < end \\ P \\ C \\\\<^sup>* catch_type)\"\n(*<*)by(simp add:matches_ex_entry_def)(*>*)\n\n\ndefinition caught :: \"jvm_prog \\ pc \\ heap \\ addr \\ ex_table \\ bool\" where\n \"caught P pc h a xt \\\n (\\entry \\ set xt. matches_ex_entry P (cname_of h a) pc entry)\"\n\ndefinition beforex :: \"jvm_prog \\ cname \\ mname \\ ex_table \\ nat set \\ nat \\ bool\"\n (\"(2_,/_,/_ \\/ _ /'/ _,/_)\" [51,0,0,0,0,51] 50) where\n \"P,C,M \\ xt / I,d \\\n (\\xt\\<^sub>0 xt\\<^sub>1. ex_table_of P C M = xt\\<^sub>0 @ xt @ xt\\<^sub>1 \\ pcs xt\\<^sub>0 \\ I = {} \\ pcs xt \\ I \\\n (\\pc \\ I. \\C pc' d'. match_ex_table P C pc xt\\<^sub>1 = \\(pc',d')\\ \\ d' \\ d))\"\n\ndefinition dummyx :: \"jvm_prog \\ cname \\ mname \\ ex_table \\ nat set \\ nat \\ bool\" (\"(2_,_,_ \\/ _ '/_,_)\" [51,0,0,0,0,51] 50) where\n \"P,C,M \\ xt/I,d \\ P,C,M \\ xt/I,d\"\n\nlemma beforexD1: \"P,C,M \\ xt / I,d \\ pcs xt \\ I\"\n(*<*)by(auto simp add:beforex_def)(*>*)\n\n\nlemma beforex_mono: \"\\ P,C,M \\ xt/I,d'; d' \\ d \\ \\ P,C,M \\ xt/I,d\"\n(*<*)by(fastforce simp:beforex_def)(*>*)\n\n\nlemma [simp]: \"P,C,M \\ xt/I,d \\ P,C,M \\ xt/I,Suc d\"\n(*<*)by(fastforce intro:beforex_mono)(*>*)\n\n\nlemma beforex_append[simp]:\n \"pcs xt\\<^sub>1 \\ pcs xt\\<^sub>2 = {} \\\n P,C,M \\ xt\\<^sub>1 @ xt\\<^sub>2/I,d =\n (P,C,M \\ xt\\<^sub>1/I-pcs xt\\<^sub>2,d \\ P,C,M \\ xt\\<^sub>2/I-pcs xt\\<^sub>1,d \\ P,C,M \\ xt\\<^sub>1@xt\\<^sub>2/I,d)\"\n(*<*)\napply(rule iffI)\n prefer 2\n apply(simp add:dummyx_def)\napply(auto simp add: beforex_def dummyx_def)\n apply(rule_tac x = xt\\<^sub>0 in exI)\n apply auto\napply(rule_tac x = \"xt\\<^sub>0@xt\\<^sub>1\" in exI)\napply auto\ndone\n(*>*)\n\n\nlemma beforex_appendD1:\n \"\\ P,C,M \\ xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d;\n pcs xt\\<^sub>1 \\ J; J \\ I; J \\ pcs xt\\<^sub>2 = {} \\\n \\ P,C,M \\ xt\\<^sub>1 / J,d\"\n(*<*)\napply(auto simp:beforex_def)\napply(rule exI,rule exI,rule conjI, rule refl)\napply(rule conjI, blast)\napply(auto)\napply(subgoal_tac \"pc \\ pcs xt\\<^sub>2\")\n prefer 2 apply blast\napply (auto split:if_split_asm)\ndone\n(*>*)\n\n\nlemma beforex_appendD2:\n \"\\ P,C,M \\ xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d;\n pcs xt\\<^sub>2 \\ J; J \\ I; J \\ pcs xt\\<^sub>1 = {} \\\n \\ P,C,M \\ xt\\<^sub>2 / J,d\"\n(*<*)\napply(auto simp:beforex_def)\napply(rule_tac x = \"xt\\<^sub>0 @ xt\\<^sub>1\" in exI)\napply fastforce\ndone\n(*>*)\n\n\nlemma beforexM:\n \"P \\ C sees M: Ts\\T = body in D \\\n compP\\<^sub>2 P,D,M \\ compxE\\<^sub>2 body 0 0/{..2 body)},0\"\n(*<*)\napply(drule sees_method_idemp)\napply(drule sees_method_compP[where f = compMb\\<^sub>2])\napply(simp add:beforex_def compP\\<^sub>2_def compMb\\<^sub>2_def)\napply(rule_tac x = \"[]\" in exI)\nusing pcs_subset apply fastforce\ndone\n(*>*)\n\n\nlemma match_ex_table_SomeD2:\n \"\\ match_ex_table P D pc (ex_table_of P C M) = \\(pc',d')\\;\n P,C,M \\ xt/I,d; \\x \\ set xt. \\ matches_ex_entry P D pc x; pc \\ I \\\n \\ d' \\ d\"\n(*<*)\napply(auto simp:beforex_def)\napply(subgoal_tac \"pc \\ pcs xt\\<^sub>0\")\napply auto\ndone\n(*>*)\n\n\nlemma match_ex_table_SomeD1:\n \"\\ match_ex_table P D pc (ex_table_of P C M) = \\(pc',d')\\;\n P,C,M \\ xt / I,d; pc \\ I; pc \\ pcs xt \\ \\ d' \\ d\"\n(*<*)by(auto elim: match_ex_table_SomeD2)(*>*)\n\n\nsubsection\\The correctness proof\\\n\n(*<*)\ndeclare nat_add_distrib[simp] caught_def[simp]\ndeclare fun_upd_apply[simp del]\n(*>*)\n\n\ndefinition\n handle :: \"jvm_prog \\ cname \\ mname \\ addr \\ heap \\ val list \\ val list \\ nat \\ frame list\n \\ jvm_state\" where\n \"handle P C M a h vs ls pc frs = find_handler P a h ((vs,ls,C,M,pc) # frs)\"\n\nlemma handle_Cons:\n \"\\ P,C,M \\ xt/I,d; d \\ size vs; pc \\ I;\n \\x \\ set xt. \\ matches_ex_entry P (cname_of h xa) pc x \\ \\\n handle P C M xa h (v # vs) ls pc frs = handle P C M xa h vs ls pc frs\"\n(*<*)by(auto simp:handle_def Suc_diff_le dest: match_ex_table_SomeD2)(*>*)\n\nlemma handle_append:\n \"\\ P,C,M \\ xt/I,d; d \\ size vs; pc \\ I; pc \\ pcs xt \\ \\\n handle P C M xa h (ws @ vs) ls pc frs = handle P C M xa h vs ls pc frs\"\n(*<*)\napply(auto simp:handle_def)\napply(rename_tac pc' d')\napply(subgoal_tac \"size ws \\ length ws + length vs - d'\")\napply(simp add:drop_all)\napply(fastforce dest:match_ex_table_SomeD2 split:nat_diff_split)\ndone\n(*>*)\n\n\nlemma aux_isin[simp]: \"\\ B \\ A; a \\ B \\ \\ a \\ A\"\n(*<*)by blast(*>*)\n\n\nlemma fixes P\\<^sub>1 defines [simp]: \"P \\ compP\\<^sub>2 P\\<^sub>1\"\nshows Jcc:\n \"P\\<^sub>1 \\\\<^sub>1 \\e,(h\\<^sub>0,ls\\<^sub>0)\\ \\ \\ef,(h\\<^sub>1,ls\\<^sub>1)\\ \\\n (\\C M pc v xa vs frs I.\n \\ P,C,M,pc \\ compE\\<^sub>2 e; P,C,M \\ compxE\\<^sub>2 e pc (size vs)/I,size vs;\n {pc..2 e)} \\ I \\ \\\n (ef = Val v \\\n P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 e))#frs))\n \\\n (ef = Throw xa \\\n (\\pc\\<^sub>1. pc \\ pc\\<^sub>1 \\ pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\\n \\ caught P pc\\<^sub>1 h\\<^sub>1 xa (compxE\\<^sub>2 e pc (size vs)) \\\n P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\ handle P C M xa h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs)))\"\n(*<*)\n (is \"_ \\ (\\C M pc v xa vs frs I.\n PROP ?P e h\\<^sub>0 ls\\<^sub>0 ef h\\<^sub>1 ls\\<^sub>1 C M pc v xa vs frs I)\")\n(*>*)\n\nand \"P\\<^sub>1 \\\\<^sub>1 \\es,(h\\<^sub>0,ls\\<^sub>0)\\ [\\] \\fs,(h\\<^sub>1,ls\\<^sub>1)\\ \\\n (\\C M pc ws xa es' vs frs I.\n \\ P,C,M,pc \\ compEs\\<^sub>2 es; P,C,M \\ compxEs\\<^sub>2 es pc (size vs)/I,size vs;\n {pc..2 es)} \\ I \\ \\\n (fs = map Val ws \\\n P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(rev ws @ vs,ls\\<^sub>1,C,M,pc+size(compEs\\<^sub>2 es))#frs))\n \\\n (fs = map Val ws @ Throw xa # es' \\\n (\\pc\\<^sub>1. pc \\ pc\\<^sub>1 \\ pc\\<^sub>1 < pc + size(compEs\\<^sub>2 es) \\\n \\ caught P pc\\<^sub>1 h\\<^sub>1 xa (compxEs\\<^sub>2 es pc (size vs)) \\\n P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\ handle P C M xa h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs)))\"\n(*<*)\n (is \"_ \\ (\\C M pc ws xa es' vs frs I.\n PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 fs h\\<^sub>1 ls\\<^sub>1 C M pc ws xa es' vs frs I)\")\nproof (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts)\n case New\\<^sub>1 thus ?case by (clarsimp simp add:blank_def fun_eq_iff)\nnext\n case NewFail\\<^sub>1 thus ?case by(auto simp: handle_def pcs_def)\nnext\n case (Cast\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 D fs C')\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc)#frs)\" using Cast\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc+1)#frs)\"\n using Cast\\<^sub>1 by (auto simp add:cast_ok_def)\n finally show ?case by auto\nnext\n case (CastNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 C')\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc)#frs)\"\n using CastNull\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc+1)#frs)\"\n using CastNull\\<^sub>1 by (auto simp add:cast_ok_def)\n finally show ?case by auto\nnext\n case (CastFail\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 D fs C')\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n let ?xa = \"addr_of_sys_xcpt ClassCast\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc)#frs)\"\n using CastFail\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc frs\"\n using CastFail\\<^sub>1 by (auto simp add:handle_def cast_ok_def)\n also have \"handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc frs =\n handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 ?pc frs\"\n using CastFail\\<^sub>1.prems by(auto simp:handle_Cons)\n finally have exec: \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\ \\\".\n show ?case (is \"?N \\ (?eq \\ (\\pc\\<^sub>1. ?H pc\\<^sub>1))\")\n proof\n show ?N by simp\n next\n have \"?eq \\ ?H ?pc\" using exec by auto\n thus \"?eq \\ (\\pc\\<^sub>1. ?H pc\\<^sub>1)\" by blast\n qed\nnext\n case CastThrow\\<^sub>1 thus ?case by fastforce\nnext\n case Val\\<^sub>1 thus ?case by simp\nnext\n case Var\\<^sub>1 thus ?case by auto\nnext\n case (BinOp\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 v\\<^sub>2 h\\<^sub>2 ls\\<^sub>2 bop w)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 (Val v\\<^sub>2) h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 v\\<^sub>2 xa (v\\<^sub>1#vs) frs\n (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\" using BinOp\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(v\\<^sub>2#v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using BinOp\\<^sub>1.prems IH\\<^sub>2 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(w#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+1)#frs)\"\n using BinOp\\<^sub>1 by(cases bop) auto\n finally show ?case by (auto split: bop.splits simp:add.assoc)\nnext\n case BinOpThrow\\<^sub>1\\<^sub>1 thus ?case by(fastforce)\nnext\n case (BinOpThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 e h\\<^sub>2 ls\\<^sub>2 bop)\n let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc)#frs)\"\n have 1: \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\ ?\\\\<^sub>1\"\n using BinOpThrow\\<^sub>2\\<^sub>1 by fastforce\n show ?case (is \"?N \\ (?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2))\")\n proof\n show ?N by simp\n next\n { assume ?eq\n moreover\n have \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 (throw e) h\\<^sub>2 ls\\<^sub>2 C M ?pc v xa (v\\<^sub>1#vs) frs\n (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc + size(compE\\<^sub>2 e\\<^sub>2) \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc (size vs + 1))\" and\n 2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 (v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>2 frs\"\n using BinOpThrow\\<^sub>2\\<^sub>1.prems by fastforce\n have 3: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using 2 BinOpThrow\\<^sub>2\\<^sub>1.prems pc\\<^sub>2 by(auto simp:handle_Cons)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 3] by auto\n hence \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n }\n thus \"?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n qed\nnext\n case (FAcc\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 C fs F D w)\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc)#frs)\" using FAcc\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc+1)#frs)\"\n using FAcc\\<^sub>1 by auto\n finally show ?case by auto\nnext\n case (FAccNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 F D)\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n let ?xa = \"addr_of_sys_xcpt NullPointer\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc)#frs)\" using FAccNull\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc frs\"\n using FAccNull\\<^sub>1.prems\n by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n also have \"handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc frs =\n handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 ?pc frs\"\n using FAccNull\\<^sub>1.prems by(auto simp add:handle_Cons)\n finally show ?case by (auto intro: exI[where x = ?pc])\nnext\n case FAccThrow\\<^sub>1 thus ?case by fastforce\nnext\n case (LAss\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 i ls\\<^sub>2)\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc)#frs)\" using LAss\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>2,C,M,?pc+2)#frs)\"\n using LAss\\<^sub>1 by auto\n finally show ?case using LAss\\<^sub>1 by auto\nnext\n case LAssThrow\\<^sub>1 thus ?case by fastforce\nnext\n case (FAss\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 C fs fs' F D h\\<^sub>2')\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 w xa (Addr a#vs) frs\n (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\" using FAss\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using FAss\\<^sub>1.prems IH\\<^sub>2 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2',(Unit#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+2)#frs)\"\n using FAss\\<^sub>1 by auto\n finally show ?case using FAss\\<^sub>1 by (auto simp:add.assoc)\nnext\n case (FAssNull\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 F D)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n let ?xa = \"addr_of_sys_xcpt NullPointer\"\n have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 w xa (Null#vs) frs\n (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\" using FAssNull\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(w#Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using FAssNull\\<^sub>1.prems IH\\<^sub>2 by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M ?xa h\\<^sub>2 (w#Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using FAssNull\\<^sub>1.prems\n by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n also have \"handle P C M ?xa h\\<^sub>2 (w#Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 frs =\n handle P C M ?xa h\\<^sub>2 vs ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using FAssNull\\<^sub>1.prems by(auto simp add:handle_Cons)\n finally show ?case by (auto intro: exI[where x = ?pc\\<^sub>2])\nnext\n case (FAssThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 F D)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n have 1: \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\ ?\\\\<^sub>1\"\n using FAssThrow\\<^sub>2\\<^sub>1 by fastforce\n show ?case (is \"?N \\ (?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2))\")\n proof\n show ?N by simp\n next\n { assume ?eq\n moreover\n have \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 v xa (w#vs) frs\n (I - pcs (compxE\\<^sub>2 e\\<^sub>1 pc (length vs)))\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>2) \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1 (size vs + 1))\" and\n 2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 (w#vs) ls\\<^sub>2 pc\\<^sub>2 frs\"\n using FAssThrow\\<^sub>2\\<^sub>1.prems by fastforce\n have 3: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using 2 FAssThrow\\<^sub>2\\<^sub>1.prems pc\\<^sub>2 by(auto simp:handle_Cons)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 3] by auto\n hence \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n }\n thus \"?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n qed\nnext\n case FAssThrow\\<^sub>1\\<^sub>1 thus ?case by fastforce\nnext\n case (Call\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 Ca fs M' Ts T body D ls\\<^sub>2' f h\\<^sub>3 ls\\<^sub>3)\n have \"P\\<^sub>1 \\\\<^sub>1 \\es,(h\\<^sub>1, ls\\<^sub>1)\\ [\\] \\map Val pvs,(h\\<^sub>2, ls\\<^sub>2)\\\" by fact\n hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc)#frs)\"\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a # vs, ls\\<^sub>1, C,M,?pc\\<^sub>1)#frs)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2)#frs\"\n let ?\\\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2)\"\n let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0) # ?frs\\<^sub>2\"\n let ?\\\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2')\"\n have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 pvs xa\n (map Val pvs) (Addr a # vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n have \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\" using Call\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>2\" using IH_es Call\\<^sub>1.prems by fastforce\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>2'\"\n using Call\\<^sub>1 by(auto simp add: nth_append compMb\\<^sub>2_def)\n finally have 1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>2'\".\n have \"P\\<^sub>1 \\ Ca sees M': Ts\\T = body in D\" by fact\n then have M'_in_D: \"P\\<^sub>1 \\ D sees M': Ts\\T = body in D\"\n by(rule sees_method_idemp) \n hence M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\ compE\\<^sub>2 body @ [Return]\"\n and M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\ compxE\\<^sub>2 body 0 0/{..2 body)},0\"\n by(rule beforeM, rule beforexM)\n have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' f h\\<^sub>3 ls\\<^sub>3 D M' 0 v xa [] ?frs\\<^sub>2 ({..2 body)})\" by fact\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note 1\n also have \"P \\ ?\\\\<^sub>2' -jvm\\\n (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body))#?frs\\<^sub>2)\"\n using val IH_body Call\\<^sub>1.prems M'_code M'_xtab\n by (fastforce simp del:split_paired_Ex)\n also have \"P \\ \\ -jvm\\ (None, h\\<^sub>3, (v # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1)#frs)\"\n using Call\\<^sub>1 M'_code M'_in_D by(auto simp: nth_append compMb\\<^sub>2_def)\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n with IH_body obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"0 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < size(compE\\<^sub>2 body) \\\n \\ caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n 2: \"P \\ ?\\\\<^sub>2' -jvm\\ handle P D M' xa h\\<^sub>3 [] ls\\<^sub>3 pc\\<^sub>2 ?frs\\<^sub>2\"\n using Call\\<^sub>1.prems M'_code M'_xtab\n by (fastforce simp del:split_paired_Ex)\n have \"handle P D M' xa h\\<^sub>3 [] ls\\<^sub>3 pc\\<^sub>2 ?frs\\<^sub>2 =\n handle P C M xa h\\<^sub>3 (rev pvs @ Addr a # vs) ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using pc\\<^sub>2 M'_in_D by(auto simp add:handle_def)\n also have \"\\ = handle P C M xa h\\<^sub>3 vs ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using Call\\<^sub>1.prems by(auto simp add:handle_append handle_Cons)\n finally have \"?H ?pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case (CallParamsThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 es es' h\\<^sub>2 ls\\<^sub>2 pvs ex es'' M')\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc)#frs)\"\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(w # vs, ls\\<^sub>1, C,M,?pc\\<^sub>1)#frs)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n have 1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\" using CallParamsThrow\\<^sub>1 by fastforce\n show ?case (is \"?N \\ (?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2))\")\n proof\n show ?N by simp\n next\n { assume ?eq\n moreover\n have \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 pvs xa es'' (w#vs) frs\n (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n ultimately have \"\\pc\\<^sub>2.\n (?pc\\<^sub>1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>1 + size(compEs\\<^sub>2 es) \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))) \\\n P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 (w#vs) ls\\<^sub>2 pc\\<^sub>2 frs\"\n (is \"\\pc\\<^sub>2. ?PC pc\\<^sub>2 \\ ?Exec pc\\<^sub>2\")\n using CallParamsThrow\\<^sub>1 by force\n then obtain pc\\<^sub>2 where pc\\<^sub>2: \"?PC pc\\<^sub>2\" and 2: \"?Exec pc\\<^sub>2\" by iprover\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 2] CallParamsThrow\\<^sub>1\n by(auto simp:handle_Cons)\n hence \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n }\n thus \"?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n qed\nnext\n case (CallNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 M')\n have \"P\\<^sub>1 \\\\<^sub>1 \\es,(h\\<^sub>1, ls\\<^sub>1)\\ [\\] \\map Val pvs,(h\\<^sub>2, ls\\<^sub>2)\\\" by fact\n hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n let ?xa = \"addr_of_sys_xcpt NullPointer\"\n have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 pvs xa\n (map Val pvs) (Null#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\" using CallNull\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(rev pvs@Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using CallNull\\<^sub>1 IH_es by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M ?xa h\\<^sub>2 (rev pvs@Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using CallNull\\<^sub>1.prems\n by(auto simp:split_beta handle_def nth_append simp del: split_paired_Ex)\n also have \"handle P C M ?xa h\\<^sub>2 (rev pvs@Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 frs =\n handle P C M ?xa h\\<^sub>2 vs ls\\<^sub>2 ?pc\\<^sub>2 frs\"\n using CallNull\\<^sub>1.prems by(auto simp:handle_Cons handle_append)\n finally show ?case by (auto intro: exI[where x = ?pc\\<^sub>2])\nnext\n case CallObjThrow\\<^sub>1 thus ?case by fastforce\nnext\n case Block\\<^sub>1 thus ?case by auto\nnext\n case (Seq\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1)#frs)\"\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n using Seq\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>1\" using Seq\\<^sub>1 by auto\n finally have eval\\<^sub>1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\".\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 C M (?pc\\<^sub>1+1) v xa vs frs\n (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note eval\\<^sub>1\n also have \"P \\ ?\\\\<^sub>1 -jvm\\ (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using val Seq\\<^sub>1.prems IH\\<^sub>2 by fastforce\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n then obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1+1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>2 \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1+1) (size vs))\" and\n eval\\<^sub>2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using IH\\<^sub>2 Seq\\<^sub>1.prems by fastforce\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case SeqThrow\\<^sub>1 thus ?case by fastforce\nnext\n case (CondT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 e\\<^sub>2)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1)#frs)\"\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n using CondT\\<^sub>1 by (fastforce simp add: Int_Un_distrib)\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>1\" using CondT\\<^sub>1 by auto\n finally have eval\\<^sub>1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\".\n let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>2' = \"?pc\\<^sub>1' + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note eval\\<^sub>1\n also have \"P \\ ?\\\\<^sub>1 -jvm\\ (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>1')#frs)\"\n using val CondT\\<^sub>1 by(fastforce simp:Int_Un_distrib)\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2')#frs)\"\n using CondT\\<^sub>1 by(auto simp:add.assoc)\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n let ?d = \"size vs\"\n let ?I = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1'+1) ?d)\"\n assume throw: ?throw\n moreover\n have \"PROP ?P e\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 C M (?pc\\<^sub>1+1) v xa vs frs ?I\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1+1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>1' \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) (size vs))\" and\n eval\\<^sub>2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using CondT\\<^sub>1.prems by (fastforce simp:Int_Un_distrib)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case (CondF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 e\\<^sub>1)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)+ 1\"\n let ?pc\\<^sub>2' = \"?pc\\<^sub>2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>2)#frs)\"\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,(Bool(False)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n using CondF\\<^sub>1 by (fastforce simp add: Int_Un_distrib)\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>1\" using CondF\\<^sub>1 by auto\n finally have eval\\<^sub>1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\".\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note eval\\<^sub>1\n also have \"P \\ ?\\\\<^sub>1 -jvm\\ (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2')#frs)\"\n using val CondF\\<^sub>1 by(fastforce simp:Int_Un_distrib)\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n let ?d = \"size vs\"\n let ?I = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) ?d)\"\n assume throw: ?throw\n moreover\n have \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>2 v xa vs frs ?I\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>2 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>2' \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>2 ?d)\" and\n eval\\<^sub>2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using CondF\\<^sub>1.prems by(fastforce simp:Int_Un_distrib)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case (CondThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 f h\\<^sub>1 ls\\<^sub>1 e\\<^sub>1 e\\<^sub>2)\n let ?d = \"size vs\"\n let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n let ?I = \"I - (pcs ?xt\\<^sub>1 \\ pcs ?xt\\<^sub>2)\"\n have \"pcs(compxE\\<^sub>2 e pc ?d) \\ pcs(?xt\\<^sub>1 @ ?xt\\<^sub>2) = {}\"\n using CondThrow\\<^sub>1.prems by (simp add:Int_Un_distrib)\n moreover have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 (throw f) h\\<^sub>1 ls\\<^sub>1 C M pc v xa vs frs ?I\" by fact\n ultimately show ?case using CondThrow\\<^sub>1.prems by fastforce\nnext\n case (WhileF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 c)\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 3\"\n have \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(Bool False#vs,ls\\<^sub>1,C,M,?pc)#frs)\"\n using WhileF\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc')#frs)\"\n using WhileF\\<^sub>1 by (auto simp:add.assoc)\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>1,C,M,?pc'+1)#frs)\"\n using WhileF\\<^sub>1.prems by (auto simp:eval_nat_numeral)\n finally show ?case by (simp add:add.assoc eval_nat_numeral)\nnext\n case (WhileT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 c v\\<^sub>1 h\\<^sub>2 ls\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3)\n let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 1\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>2 = \"(None,h\\<^sub>2,(vs,ls\\<^sub>2,C,M,pc)#frs)\"\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,(Bool True#vs,ls\\<^sub>1,C,M,?pc)#frs)\"\n using WhileT\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc+1)#frs)\"\n using WhileT\\<^sub>1.prems by auto\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>2,(v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc')#frs)\"\n using WhileT\\<^sub>1 by(fastforce)\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>2\" using WhileT\\<^sub>1.prems by auto\n finally have 1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>2\".\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note 1\n also have \"P \\ ?\\\\<^sub>2 -jvm\\ (None,h\\<^sub>3,(v#vs,ls\\<^sub>3,C,M,?pc'+3)#frs)\"\n using val WhileT\\<^sub>1 by (auto simp add:add.assoc eval_nat_numeral)\n finally show ?trans by(simp add:add.assoc eval_nat_numeral)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n moreover\n have \"PROP ?P (while (e) c) h\\<^sub>2 ls\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3 C M pc v xa vs frs I\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"pc \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc'+3 \\\n \\ caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 (while (e) c) pc (size vs))\" and\n 2: \"P \\ ?\\\\<^sub>2 -jvm\\ handle P C M xa h\\<^sub>3 vs ls\\<^sub>3 pc\\<^sub>2 frs\"\n using WhileT\\<^sub>1.prems by (auto simp:add.assoc eval_nat_numeral)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case WhileCondThrow\\<^sub>1 thus ?case by fastforce\nnext\n case (WhileBodyThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 c e' h\\<^sub>2 ls\\<^sub>2)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1)#frs)\"\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n using WhileBodyThrow\\<^sub>1 by (fastforce simp add: Int_Un_distrib)\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>1\" using WhileBodyThrow\\<^sub>1 by auto\n finally have eval\\<^sub>1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\".\n let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 c)\"\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm by simp\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n moreover\n have \"PROP ?P c h\\<^sub>1 ls\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 C M (?pc\\<^sub>1+1) v xa vs frs\n (I - pcs (compxE\\<^sub>2 e pc (size vs)))\" by fact\n ultimately obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1+1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>1' \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 c (?pc\\<^sub>1+1) (size vs))\" and\n eval\\<^sub>2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using WhileBodyThrow\\<^sub>1.prems by (fastforce simp:Int_Un_distrib)\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by auto\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case (Throw\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1)\n let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm by simp\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>1. ?H pc\\<^sub>1)\")\n proof\n assume ?throw\n hence \"P \\ (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc) # frs) -jvm\\\n (None, h\\<^sub>1, (Addr xa#vs, ls\\<^sub>1, C, M, ?pc) # frs)\"\n using Throw\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M xa h\\<^sub>1 (Addr xa#vs) ls\\<^sub>1 ?pc frs\"\n using Throw\\<^sub>1.prems by(auto simp add:handle_def)\n also have \"handle P C M xa h\\<^sub>1 (Addr xa#vs) ls\\<^sub>1 ?pc frs =\n handle P C M xa h\\<^sub>1 vs ls\\<^sub>1 ?pc frs\"\n using Throw\\<^sub>1.prems by(auto simp add:handle_Cons)\n finally have \"?H ?pc\" by simp\n thus \"\\pc\\<^sub>1. ?H pc\\<^sub>1\" by iprover\n qed\n qed\nnext\n case (ThrowNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 h\\<^sub>1 ls\\<^sub>1)\n let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n let ?xa = \"addr_of_sys_xcpt NullPointer\"\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm by simp\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>1. ?H pc\\<^sub>1)\")\n proof\n assume throw: ?throw\n have \"P \\ (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc) # frs) -jvm\\\n (None, h\\<^sub>1, (Null#vs, ls\\<^sub>1, C, M, ?pc) # frs)\"\n using ThrowNull\\<^sub>1 by fastforce\n also have \"P \\ \\ -jvm\\ handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc frs\"\n using ThrowNull\\<^sub>1.prems by(auto simp add:handle_def)\n also have \"handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc frs =\n handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 ?pc frs\"\n using ThrowNull\\<^sub>1.prems by(auto simp add:handle_Cons)\n finally have \"?H ?pc\" using throw by simp\n thus \"\\pc\\<^sub>1. ?H pc\\<^sub>1\" by iprover\n qed\n qed\nnext\n case ThrowThrow\\<^sub>1 thus ?case by fastforce\nnext\n case (Try\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 Ci i e\\<^sub>2)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n have \"P,C,M \\ compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs) / I,size vs\" by fact\n hence \"P,C,M \\ compxE\\<^sub>2 e\\<^sub>1 pc (size vs) /\n {pc..2 e\\<^sub>1)},size vs\"\n using Try\\<^sub>1.prems by (fastforce simp:beforex_def split:if_split_asm)\n hence \"P \\ (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs) -jvm\\\n (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\" using Try\\<^sub>1 by auto\n also have \"P \\ \\ -jvm\\ (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1')#frs)\"\n using Try\\<^sub>1.prems by auto\n finally show ?case by (auto simp:add.assoc)\nnext\n case (TryCatch\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 D fs Ci i e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2)\n let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?ls\\<^sub>1 = \"ls\\<^sub>1[i := Addr a]\"\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(vs,?ls\\<^sub>1,C,M, ?pc\\<^sub>1') # frs)\"\n have I: \"{pc..2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\ I\"\n and beforex: \"P,C,M \\ ?xt/I,size vs\" by fact+\n have \"P \\ ?\\\\<^sub>0 -jvm\\ (None,h\\<^sub>1,((Addr a)#vs,ls\\<^sub>1,C,M, ?pc\\<^sub>1+1) # frs)\"\n proof -\n have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 C M pc w a vs frs {pc..2 e\\<^sub>1)}\"\n by fact\n moreover have \"P,C,M \\ compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..1},size vs\"\n using beforex I pcs_subset by(force elim!: beforex_appendD1)\n ultimately have\n \"\\pc\\<^sub>1. pc \\ pc\\<^sub>1 \\ pc\\<^sub>1 < ?pc\\<^sub>1 \\\n \\ caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\\n P \\ ?\\\\<^sub>0 -jvm\\ handle P C M a h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs\"\n using TryCatch\\<^sub>1.prems by auto\n then obtain pc\\<^sub>1 where\n pc\\<^sub>1_in_e\\<^sub>1: \"pc \\ pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n pc\\<^sub>1_not_caught: \"\\ caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n 0: \"P \\ ?\\\\<^sub>0 -jvm\\ handle P C M a h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs\" by iprover\n from beforex obtain xt\\<^sub>0 xt\\<^sub>1\n where ex_tab: \"ex_table_of P C M = xt\\<^sub>0 @ ?xt @ xt\\<^sub>1\"\n and disj: \"pcs xt\\<^sub>0 \\ I = {}\" by(auto simp:beforex_def)\n have hp: \"h\\<^sub>1 a = Some (D, fs)\" \"P\\<^sub>1 \\ D \\\\<^sup>* Ci\" by fact+\n have \"pc\\<^sub>1 \\ pcs xt\\<^sub>0\" using pc\\<^sub>1_in_e\\<^sub>1 I disj by auto\n with pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught hp\n show ?thesis using ex_tab 0 by(simp add:handle_def matches_ex_entry_def)\n qed\n also have \"P \\ \\ -jvm\\ ?\\\\<^sub>1\" using TryCatch\\<^sub>1 by auto\n finally have 1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\" .\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1' + length(compE\\<^sub>2 e\\<^sub>2)\"\n let ?I\\<^sub>2 = \"{?pc\\<^sub>1' ..< ?pc\\<^sub>2}\"\n have \"P,C,M \\ compxE\\<^sub>2 ?e pc (size vs) / I,size vs\" by fact\n hence beforex\\<^sub>2: \"P,C,M \\ compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs) / ?I\\<^sub>2, size vs\"\n using I pcs_subset[of _ ?pc\\<^sub>1'] by(auto elim!:beforex_appendD2)\n have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ?ls\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1' v xa vs frs ?I\\<^sub>2\" by fact\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note 1 also have \"P \\ ?\\\\<^sub>1 -jvm\\ (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using val beforex\\<^sub>2 IH\\<^sub>2 TryCatch\\<^sub>1.prems by auto\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n then obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1+2 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>2 \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs))\" and\n 2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 vs ls\\<^sub>2 pc\\<^sub>2 frs\"\n using IH\\<^sub>2 beforex\\<^sub>2 TryCatch\\<^sub>1.prems by auto\n have \"?H pc\\<^sub>2\" using pc\\<^sub>2 jvm_trans[OF 1 2]\n by (simp add:match_ex_entry) (fastforce)\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case (TryThrow\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 D fs Ci i e\\<^sub>2)\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n have I: \"{pc..2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\ I\"\n and beforex: \"P,C,M \\ ?xt/I,size vs\" by fact+\n have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 C M pc w a vs frs {pc..2 e\\<^sub>1)}\" by fact\n moreover have \"P,C,M \\ compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..1},size vs\"\n using beforex I pcs_subset by(force elim!: beforex_appendD1)\n ultimately have\n \"\\pc\\<^sub>1. pc \\ pc\\<^sub>1 \\ pc\\<^sub>1 < ?pc\\<^sub>1 \\\n \\ caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\\n P \\ ?\\\\<^sub>0 -jvm\\ handle P C M a h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs\"\n using TryThrow\\<^sub>1.prems by auto\n then obtain pc\\<^sub>1 where\n pc\\<^sub>1_in_e\\<^sub>1: \"pc \\ pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n pc\\<^sub>1_not_caught: \"\\ caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n 0: \"P \\ ?\\\\<^sub>0 -jvm\\ handle P C M a h\\<^sub>1 vs ls\\<^sub>1 pc\\<^sub>1 frs\" by iprover\n show ?case (is \"?N \\ (?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2))\")\n proof\n show ?N by simp\n next\n { assume ?eq\n with TryThrow\\<^sub>1 pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught 0\n have \"?H pc\\<^sub>1\" by (simp add:match_ex_entry) auto\n hence \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n }\n thus \"?eq \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n qed\nnext\n case Nil\\<^sub>1 thus ?case by simp\nnext\n case (Cons\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 v h\\<^sub>1 ls\\<^sub>1 es fs h\\<^sub>2 ls\\<^sub>2)\n let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n let ?\\\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc)#frs)\"\n let ?\\\\<^sub>1 = \"(None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1)#frs)\"\n have 1: \"P \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\" using Cons\\<^sub>1 by fastforce\n let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n have IHs: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 fs h\\<^sub>2 ls\\<^sub>2 C M ?pc\\<^sub>1 (tl ws) xa es' (v#vs) frs\n (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n show ?case (is \"?Norm \\ ?Err\")\n proof\n show ?Norm (is \"?val \\ ?trans\")\n proof\n assume val: ?val\n note 1\n also have \"P \\ ?\\\\<^sub>1 -jvm\\ (None,h\\<^sub>2,(rev(ws) @ vs,ls\\<^sub>2,C,M,?pc\\<^sub>2)#frs)\"\n using val IHs Cons\\<^sub>1.prems by fastforce\n finally show ?trans by(simp add:add.assoc)\n qed\n next\n show ?Err (is \"?throw \\ (\\pc\\<^sub>2. ?H pc\\<^sub>2)\")\n proof\n assume throw: ?throw\n then obtain pc\\<^sub>2 where\n pc\\<^sub>2: \"?pc\\<^sub>1 \\ pc\\<^sub>2 \\ pc\\<^sub>2 < ?pc\\<^sub>2 \\\n \\ caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))\" and\n 2: \"P \\ ?\\\\<^sub>1 -jvm\\ handle P C M xa h\\<^sub>2 (v#vs) ls\\<^sub>2 pc\\<^sub>2 frs\"\n using IHs Cons\\<^sub>1.prems\n by(fastforce simp:Cons_eq_append_conv neq_Nil_conv)\n have \"?H pc\\<^sub>2\" using Cons\\<^sub>1.prems pc\\<^sub>2 jvm_trans[OF 1 2]\n by (auto simp add: handle_Cons)\n thus \"\\pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n qed\n qed\nnext\n case ConsThrow\\<^sub>1 thus ?case by (fastforce simp:Cons_eq_append_conv)\nqed\n(*>*)\n\n\n(*FIXME move! *)\nlemma atLeast0AtMost[simp]: \"{0::nat..n} = {..n}\"\nby auto\n\nlemma atLeast0LessThan[simp]: \"{0::nat.. addr option\" where\n \"exception (Throw a) = Some a\"\n| \"exception e = None\"\n\n\nlemma comp\\<^sub>2_correct:\nassumes \"method\": \"P\\<^sub>1 \\ C sees M:Ts\\T = body in C\"\n and eval: \"P\\<^sub>1 \\\\<^sub>1 \\body,(h,ls)\\ \\ \\e',(h',ls')\\\"\nshows \"compP\\<^sub>2 P\\<^sub>1 \\ (None,h,[([],ls,C,M,0)]) -jvm\\ (exception e',h',[])\"\n(*<*)\n (is \"_ \\ ?\\\\<^sub>0 -jvm\\ ?\\\\<^sub>1\")\nproof -\n let ?P = \"compP\\<^sub>2 P\\<^sub>1\"\n have code: \"?P,C,M,0 \\ compE\\<^sub>2 body\" using beforeM[OF \"method\"] by auto\n have xtab: \"?P,C,M \\ compxE\\<^sub>2 body 0 (size[])/{..2 body)},size[]\"\n using beforexM[OF \"method\"] by auto\n \\ \\Distinguish if e' is a value or an exception\\\n { fix v assume [simp]: \"e' = Val v\"\n have \"?P \\ ?\\\\<^sub>0 -jvm\\ (None,h',[([v],ls',C,M,size(compE\\<^sub>2 body))])\"\n using Jcc[OF eval code xtab] by auto\n also have \"?P \\ \\ -jvm\\ ?\\\\<^sub>1\" using beforeM[OF \"method\"] by auto\n finally have ?thesis .\n }\n moreover\n { fix a assume [simp]: \"e' = Throw a\"\n obtain pc where pc: \"0 \\ pc \\ pc < size(compE\\<^sub>2 body) \\\n \\ caught ?P pc h' a (compxE\\<^sub>2 body 0 0)\"\n and 1: \"?P \\ ?\\\\<^sub>0 -jvm\\ handle ?P C M a h' [] ls' pc []\"\n using Jcc[OF eval code xtab] by fastforce\n from pc have \"handle ?P C M a h' [] ls' pc [] = ?\\\\<^sub>1\" using xtab \"method\"\n by(auto simp:handle_def compMb\\<^sub>2_def)\n with 1 have ?thesis by simp\n } \n ultimately show ?thesis using eval\\<^sub>1_final[OF eval] by(auto simp:final_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Compiler/Correctness2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2860522664194274}} {"text": "theory v1_isar_new_original_K\n imports Main \"../../QML\"\nbegin\n\n(* (T x y) \\ x made from y *)\nconsts makeTable :: \"\\ \\ \\ \\ \\\" (\"T\") \n(* lemma necessity_of_distinctness: \"\\(\\<^bold>\\(\\<^bold>\\x. \\<^bold>\\(\\<^bold>\\y. \\<^bold>\\(\\<^bold>\\(x\\<^bold>=\\<^sup>Ly) \\<^bold>\\ \\<^bold>\\(\\<^bold>\\(x\\<^bold>=\\<^sup>Ly))))))\\\" by auto *)\n\nlemma \n assumes compossibilty1: \"\\(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. ((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ T x2 y2) \\<^bold>\\ \\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2))))\\\"\n assumes origin_uniqueness1: \"\\(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. \\<^bold>\\((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x1 y1) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ (\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))))))\\\" \n shows origin_essentialism1: \"\\(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))))\\\"\n\nproof(rule allI)\n fix a\n show \"(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)))) a\"\n proof(rule allI)\n fix b\n show \"a r b \\ ((\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) b)\"\n proof(rule impI)\n assume \"a r b\"\n show \"((\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) b)\"\n proof(rule allI)\n fix x1\n show \"((\\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) b)\"\n proof(rule allI)\n fix y1\n show \"((T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) b)\"\n proof (rule impI)\n assume table_x1_from_y1: \"T x1 y1 b\" \n show \"((\\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) b)\"\n proof(rule allI)\n fix c \n show \"b r c \\ (((\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) c)\"\n proof (rule impI)\n assume \"b r c\" \n show \"(((\\<^bold>\\x2. \\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) c)\"\n proof (rule allI)\n fix x2 \n show \"(((\\<^bold>\\y2. (\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) c)\"\n proof (rule allI)\n fix y2 \n show \"((((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ \\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2))) c)\"\n proof (rule impI)\n assume antecedent: \"((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ (T x2 y2)) c\"\n show \"(\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)) c\"\n proof (rule notI)\n assume \"(x1\\<^bold>=\\<^sup>Lx2) c\"\n from antecedent have table_x2_from_y2: \"T x2 y2 c\" by (rule conjE)\n from antecedent have non_overlapping: \"(\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) c\" by (rule conjE)\n\n from compossibilty1 have \"(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. ((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ T x2 y2) \\<^bold>\\ \\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2)))) a\"..\n then have \"((T x1 y1 \\<^bold>\\ \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. ((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ T x2 y2) \\<^bold>\\ \\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2))) b)\" \n using `a r b` by auto\n then have \"((\\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. ((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ T x2 y2) \\<^bold>\\ \\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2))) b)\" \n using table_x1_from_y1 by auto\n then have \"((((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\ T x2 y2) \\<^bold>\\ \\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2)) c)\" \n using `b r c` by auto\n then have \"(\\<^bold>\\(T x1 y1 \\<^bold>\\ T x2 y2)) c\" \n using antecedent by auto\n then obtain d where d: \"c r d \\ (((T x1 y1 \\<^bold>\\ T x2 y2)) d)\" by (rule exE)\n then have \"c r d\" by (rule conjE)\n have \"(T x1 y1 \\<^bold>\\ T x2 y2) d\" \n using `c r d \\ (((T x1 y1 \\<^bold>\\ T x2 y2)) d)` by (rule conjE) \n\n from origin_uniqueness1 have \"(\\<^bold>\\(\\<^bold>\\x1. \\<^bold>\\y1. \\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. \\<^bold>\\((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x1 y1) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ (\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)))))) a\"..\n then have \"((\\<^bold>\\(\\<^bold>\\x2. \\<^bold>\\y2. \\<^bold>\\((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x1 y1) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ (\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)))))) b\" \n using `a r b` by auto\n then have \"(((\\<^bold>\\((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x1 y1) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ (\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)))))) c\" \n using `b r c` by metis\n then have \"(((((\\<^bold>\\(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\ (T x1 y1) \\<^bold>\\ (T x2 y2)) \\<^bold>\\ (\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)))))) d\" \n using `c r d` by auto\n then have \"(\\<^bold>\\(x1\\<^bold>=\\<^sup>Lx2)) d\" \n using `(T x1 y1 \\<^bold>\\ T x2 y2) d` and table_x1_from_y1 and `b r c` and `c r d` by (meson antecedent)\n then show False using `(x1\\<^bold>=\\<^sup>Lx2) c` and `c r d` by auto\n qed\n qed\n qed\n qed\n qed\n qed\n qed\n qed\n qed\n qed\n qed\nqed\n\n\nend\n", "meta": {"author": "hotessy", "repo": "origin_essen_public", "sha": "c91f54abfade669c30db34d2bbfcccbe1b97d23a", "save_path": "github-repos/isabelle/hotessy-origin_essen_public", "path": "github-repos/isabelle/hotessy-origin_essen_public/origin_essen_public-c91f54abfade669c30db34d2bbfcccbe1b97d23a/experiments/v1_isar_new_original_K.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2860375588287087}} {"text": "(* Title: Jinja/J/WellType.thy\n\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Well-typedness of Jinja expressions} *}\n\ntheory WellType\nimports \"../Common/Objects\" Expr\nbegin\n\ntype_synonym\n env = \"vname \\ ty\"\n\ninductive\n WT :: \"[J_prog,env, expr , ty ] \\ bool\"\n (\"_,_ \\ _ :: _\" [51,51,51]50)\n and WTs :: \"[J_prog,env, expr list, ty list] \\ bool\"\n (\"_,_ \\ _ [::] _\" [51,51,51]50)\n for P :: J_prog\nwhere\n \n WTNew:\n \"is_class P C \\\n P,E \\ new C :: Class C\"\n\n| WTCast:\n \"\\ P,E \\ e :: Class D; is_class P C; P \\ C \\\\<^sup>* D \\ P \\ D \\\\<^sup>* C \\\n \\ P,E \\ Cast C e :: Class C\"\n\n| WTVal:\n \"typeof v = Some T \\\n P,E \\ Val v :: T\"\n\n| WTVar:\n \"E V = Some T \\\n P,E \\ Var V :: T\"\n(*\nWTBinOp:\n \"\\ P,E \\ e\\<^sub>1 :: T\\<^sub>1; P,E \\ e\\<^sub>2 :: T\\<^sub>2;\n case bop of Eq \\ (P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1) \\ T = Boolean\n | Add \\ T\\<^sub>1 = Integer \\ T\\<^sub>2 = Integer \\ T = Integer \\\n \\ P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\"\n*)\n| WTBinOpEq:\n \"\\ P,E \\ e\\<^sub>1 :: T\\<^sub>1; P,E \\ e\\<^sub>2 :: T\\<^sub>2; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1 \\\n \\ P,E \\ e\\<^sub>1 \\Eq\\ e\\<^sub>2 :: Boolean\"\n\n| WTBinOpAdd:\n \"\\ P,E \\ e\\<^sub>1 :: Integer; P,E \\ e\\<^sub>2 :: Integer \\\n \\ P,E \\ e\\<^sub>1 \\Add\\ e\\<^sub>2 :: Integer\"\n\n| WTLAss:\n \"\\ E V = Some T; P,E \\ e :: T'; P \\ T' \\ T; V \\ this \\\n \\ P,E \\ V:=e :: Void\"\n\n| WTFAcc:\n \"\\ P,E \\ e :: Class C; P \\ C sees F:T in D \\\n \\ P,E \\ e\\F{D} :: T\"\n\n| WTFAss:\n \"\\ P,E \\ e\\<^sub>1 :: Class C; P \\ C sees F:T in D; P,E \\ e\\<^sub>2 :: T'; P \\ T' \\ T \\\n \\ P,E \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 :: Void\"\n\n| WTCall:\n \"\\ P,E \\ e :: Class C; P \\ C sees M:Ts \\ T = (pns,body) in D;\n P,E \\ es [::] Ts'; P \\ Ts' [\\] Ts \\\n \\ P,E \\ e\\M(es) :: T\"\n\n| WTBlock:\n \"\\ is_type P T; P,E(V \\ T) \\ e :: T' \\\n \\ P,E \\ {V:T; e} :: T'\"\n\n| WTSeq:\n \"\\ P,E \\ e\\<^sub>1::T\\<^sub>1; P,E \\ e\\<^sub>2::T\\<^sub>2 \\\n \\ P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n| WTCond:\n \"\\ P,E \\ e :: Boolean; P,E \\ e\\<^sub>1::T\\<^sub>1; P,E \\ e\\<^sub>2::T\\<^sub>2;\n P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ T = T\\<^sub>2; P \\ T\\<^sub>2 \\ T\\<^sub>1 \\ T = T\\<^sub>1 \\\n \\ P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile:\n \"\\ P,E \\ e :: Boolean; P,E \\ c::T \\\n \\ P,E \\ while (e) c :: Void\"\n\n| WTThrow:\n \"P,E \\ e :: Class C \\ \n P,E \\ throw e :: Void\"\n\n| WTTry:\n \"\\ P,E \\ e\\<^sub>1 :: T; P,E(V \\ Class C) \\ e\\<^sub>2 :: T; is_class P C \\\n \\ P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n\n-- \"well-typed expression lists\"\n\n| WTNil:\n \"P,E \\ [] [::] []\"\n\n| WTCons:\n \"\\ P,E \\ e :: T; P,E \\ es [::] Ts \\\n \\ P,E \\ e#es [::] T#Ts\"\n\n(*<*)\n(*\nlemmas [intro!] = WTNew WTCast WTVal WTVar WTBinOp WTLAss WTFAcc WTFAss WTCall WTBlock WTSeq\n WTWhile WTThrow WTTry WTNil WTCons\nlemmas [intro] = WTCond1 WTCond2\n*)\ndeclare WT_WTs.intros[intro!] (* WTNil[iff] *)\n\nlemmas WT_WTs_induct = WT_WTs.induct [split_format (complete)]\n and WT_WTs_inducts = WT_WTs.inducts [split_format (complete)]\n(*>*)\n\n\n\nlemma [iff]: \"(P,E \\ e#es [::] T#Ts) = (P,E \\ e :: T \\ P,E \\ es [::] Ts)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTs.cases)\ndone\n(*>*)\n\nlemma [iff]: \"(P,E \\ (e#es) [::] Ts) =\n (\\U Us. Ts = U#Us \\ P,E \\ e :: U \\ P,E \\ es [::] Us)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTs.cases)\ndone\n(*>*)\n\nlemma [iff]: \"\\Ts. (P,E \\ es\\<^sub>1 @ es\\<^sub>2 [::] Ts) =\n (\\Ts\\<^sub>1 Ts\\<^sub>2. Ts = Ts\\<^sub>1 @ Ts\\<^sub>2 \\ P,E \\ es\\<^sub>1 [::] Ts\\<^sub>1 \\ P,E \\ es\\<^sub>2[::]Ts\\<^sub>2)\"\n(*<*)\napply(induct es\\<^sub>1 type:list)\n apply simp\napply clarsimp\napply(erule thin_rl)\napply (rule iffI)\n apply clarsimp\n apply(rule exI)+\n apply(rule conjI)\n prefer 2 apply blast\n apply simp\napply fastforce\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\ Val v :: T = (typeof v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\ Var V :: T = (E V = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2 = (\\T\\<^sub>1. P,E \\ e\\<^sub>1::T\\<^sub>1 \\ P,E \\ e\\<^sub>2::T\\<^sub>2)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"(P,E \\ {V:T; e} :: T') = (is_type P T \\ P,E(V\\T) \\ e :: T')\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\n(*<*)\ninductive_cases WT_elim_cases[elim!]:\n \"P,E \\ V :=e :: T\"\n \"P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n \"P,E \\ while (e) c :: T\"\n \"P,E \\ throw e :: T\"\n \"P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n \"P,E \\ Cast D e :: T\"\n \"P,E \\ a\\F{D} :: T\"\n \"P,E \\ a\\F{D} := v :: T\"\n \"P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\"\n \"P,E \\ new C :: T\"\n \"P,E \\ e\\M(ps) :: T\"\n(*>*)\n\n\nlemma wt_env_mono:\n \"P,E \\ e :: T \\ (\\E'. E \\\\<^sub>m E' \\ P,E' \\ e :: T)\" and \n \"P,E \\ es [::] Ts \\ (\\E'. E \\\\<^sub>m E' \\ P,E' \\ es [::] Ts)\"\n(*<*)\napply(induct rule: WT_WTs_inducts)\napply(simp add: WTNew)\napply(fastforce simp: WTCast)\napply(fastforce simp: WTVal)\napply(simp add: WTVar map_le_def dom_def)\napply(fastforce simp: WTBinOpEq)\napply(fastforce simp: WTBinOpAdd)\napply(force simp:map_le_def)\napply(fastforce simp: WTFAcc)\napply(fastforce simp: WTFAss del:WT_WTs.intros WT_elim_cases)\napply(fastforce simp: WTCall)\napply(fastforce simp: map_le_def WTBlock)\napply(fastforce simp: WTSeq)\napply(fastforce simp: WTCond)\napply(fastforce simp: WTWhile)\napply(fastforce simp: WTThrow)\napply(fastforce simp: WTTry map_le_def dom_def)\napply(simp add: WTNil)\napply(simp add: WTCons)\ndone\n(*>*)\n\n\nlemma WT_fv: \"P,E \\ e :: T \\ fv e \\ dom E\"\nand \"P,E \\ es [::] Ts \\ fvs es \\ dom E\"\n(*<*)\napply(induct rule:WT_WTs.inducts)\napply(simp_all del: fun_upd_apply)\napply fast+\ndone\n\nend\n(*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/J/WellType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056167854461, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.2859921048055114}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory PackedTypes\nimports \"Word_Lib.WordSetup\" CProof\nbegin\n\nsection \\Underlying definitions for the class axioms\\\n\ntext \\field_access / field_update is the identity for packed types\\\n\ndefinition fa_fu_idem :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext \\field_access is independent of the underlying bytes\\\n\ndefinition fa_heap_indep :: \"'a field_desc \\ nat \\ bool\" where\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection \\Lemmas about td_fafu_idem\\\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n.\n \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: if_split_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover\n have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover\n have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have updeq:\n \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n by (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n using mlt nlex xln lbs lbs' wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply (cases p')\n apply (simp split: if_split_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts \\td_fafu_idem s\\ \\wf_fd s\\\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using \\field_lookup_list (p' # ts') f 0 = Some (s, n)\\ by (simp split: option.splits)\nqed (clarsimp split: if_split_asm)+\n\nsubsection \\td_fa_hi\\\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"(@)\"])\n apply (erule Cons_typ_desc.hyps; simp)\n apply (erule Cons_typ_desc.hyps; simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection \\Simp rules for deriving packed props from the type combinators\\\n\nsubsection \\td_fafu_idem\\\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fafu_idem_list_append)\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\\n field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply (rule iffI)\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self; simp)\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\\n fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\ td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\\n td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def)\n (simp add: td_fafu_idem_ti_typ_combine)\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp: typ_info_array array_tag_def fa_fu_idem_def td_fafu_idem_array_n)\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection \\td_fa_hi\\\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append)\n\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm\n have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def Let_def using tda tds\n by (cases s, rename_tac typ_struct xs)\n (case_tac typ_struct; simp add: td_fa_hi_list_append td_fa_hi_adjust_ti[OF fg wf_fd])\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n by (induct n; simp add: array_tag_n.simps empty_typ_info_def td_fa_hi_ti_typ_combine)\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n by (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def td_fa_hi_array_n)\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection \\The type class and simp sets\\\n\ntext \\Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity\\\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n \\ \\Axioms\\\n td_fafu_idem\n \\ \\Combinators\\\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n \\ \\Constructors\\\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n \\ \\Axioms\\\n td_fa_hi\n \\ \\Combinators\\\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n \\ \\Constructors\\\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection \\Instances\\\n\ntext \\Words (of multiple of 8 size) are packed\\\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n by (intro_classes; rule td_fafu_idem_word td_fa_hi_word)\nend\n\ntext \\Pointers are always packed\\\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n by (intro_classes; simp add: fa_fu_idem_def word_rsplit_rcat_size word_size fa_heap_indep_def)\nend\n\ntext \\Arrays of packed types are in turn packed\\\n\nclass array_outer_packed = packed_type + array_outer_max_size\nclass array_inner_packed = array_outer_packed + array_inner_max_size\n\ninstance word :: (len8)array_outer_packed ..\ninstance word :: (len8)array_inner_packed ..\n\ninstance array :: (array_outer_packed, array_max_count) packed_type\n by (intro_classes; simp add: td_fafu_idem_intro_simps td_fa_hi_intro_simps)\n\ninstance array :: (array_inner_packed, array_max_count) array_outer_packed ..\n\nsection \\Theorems about packed types\\\n\nsubsection \\td_fa_hi\\\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows \"heap_update p v (heap_update p u h) = heap_update p v h\"\n unfolding heap_update_def\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: heap_update_mem_same_point)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence, simp)\n prefer 2\n apply(rule refl)\n apply(simp)\n apply(simp add: heap_update_nmem_same)\n done\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp) =\n hrs_mem_update (heap_update p v) hp\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection \\td_fafu_idem\\\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right; assumption?)\n apply (rule of_nat_mono_maybe_le; simp)\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def\n by (rule heap_independence; simp add: lbs size_of_def)\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n show ?case\n proof (cases n')\n case 0 thus ?thesis using \\Suc m' < n'\\ by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using \\Suc m' < n'\\ by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: addr_bitsize word) = n\" using szn szb\n by (simp add: nat_less_le unat_of_nat_eq)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n by (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n apply -\n apply (drule c_guard_no_wrap)\n apply (simp add: std)\n done\n\n have szt': \"size_td t < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (subst std)\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n from xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n by (rule intvl_le_lower)\n next\n from szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: addr_bitsize word)\"\n apply -\n apply (rule of_nat_mono_maybe_le)\n apply simp_all\n done\n with al show \"ptr_val p \\ ptr_val p + of_nat n\"\n by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n by (simp add: word_le_nat_alt uofn)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (drule (2) intvl_less_upper)\n apply (simp add: add.assoc)\n done\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n apply -\n apply (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n apply (metis (hide_lams, mono_tags) add.commute of_nat_add)\n apply (erule (2) intvl_le_lower)\n done\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: addr_bitsize word) = n + size_td t - 1\"\n using t0 order_le_less_trans [OF szt1 szb]\n apply (subst Abs_fnat_homs(1))\n apply (subst unat_of_nat)\n apply simp\n done\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n by (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n by simp\n\n show \"td_fafu_idem t\"\n by (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n by (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n by (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n by (simp add: unat_sub [OF ofn] uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n by simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n (update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n have \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n proof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n by (subst add.commute, rule intvl_less_upper)\n show \"ptr_val p \\ x\" using xin al szb\n by (rule intvl_le_lower)\n qed\n thus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n by (simp add: word_le_nat_alt size_of_def unat_of_nat)\n\n show \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (erule intvl_cut)\n apply simp\n apply (rule max_size)\n done\n\n show \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n (* clag *)\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n apply (subst heap_list_nth)\n apply (rule unx)\n apply simp\n done\n\n thus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n unfolding h_val_def\n by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2859553171226515}} {"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: XVcgEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader \"Examples for Parallel Assignments\"\n\ntheory XVcgEx \nimports \"../XVcg\"\n\nbegin\n\nrecord \"globals\" =\n \"G_'\"::\"nat\"\n \"H_'\"::\"nat\"\n\nrecord 'g vars = \"'g state\" +\n A_' :: nat\n B_' :: nat\n C_' :: nat\n I_' :: nat\n M_' :: nat\n N_' :: nat\n R_' :: nat\n S_' :: nat\n Arr_' :: \"nat list\"\n Abr_':: string\n\nterm \"BASIC\n \\A :== x,\n \\B :== y \n END\"\n\nterm \"BASIC\n \\G :== \\H,\n \\H :== \\G \n END\"\n\nterm \"BASIC\n LET (x,y) = (\\A,b);\n z = \\B\n IN \\A :== x,\n \\G :== \\A + y + z\n END\"\n\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\B :== b,\n \\C :== c\n END\n \\\\A = x \\ \\B = y \\ \\C = c\\\"\napply vcg\noops\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply vcg\noops\n\ndefinition foo:: \"nat \\ (nat \\ nat \\ nat)\"\n where \"foo n = (n,n+1,n+2)\"\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply (vcg add: foo_def snd_conv fst_conv)\noops\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/ex/XVcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.28595531056210705}} {"text": "subsection \\Link implementation to CISK: the specific separation kernel is an interpretation of the generic model.\\label{sect:link_to_CISK}\\\n\ntheory Link_separation_kernel_model_to_CISK\n imports Separation_kernel_model \nbegin\n\ntext \\We show that the separation kernel instantiation satisfies the \nspecification of CISK.\n\\\n\ntheorem CISK_proof_obligations_satisfied:\n shows\n \"Controllable_Interruptible_Separation_Kernel\n rstep\n routput_f\n (\\s0)\n rcurrent\n rcswitch\n rkinvolved\n rifp\n rvpeq\n rAS_set\n rinvariant\n rprecondition\n raborting\n rwaiting\n rset_error_code\"\nproof (unfold_locales)\n \\ \\show that rvpeq is equivalence relation\\\n show \"\\ a b c u. (rvpeq u a b \\ rvpeq u b c) \\ rvpeq u a c\"\n and \"\\ a b u. rvpeq u a b \\ rvpeq u b a\"\n and \"\\ a u. rvpeq u a a\"\n using inst_vpeq_rel by metis+\n \\ \\show output consistency\\\n show \"\\ a s t. rvpeq (rcurrent s) s t \\ rcurrent s = rcurrent t \\ routput_f s a = routput_f t a\"\n using inst_output_consistency by metis\n \\ \\show reflexivity of ifp\\\n show \"\\ u . rifp u u\"\n using inst_ifp_refl by metis\n \\ \\show step consistency\\\n show \"\\s t u a. rvpeq u s t \\ rvpeq (rcurrent s) s t \\ True \\ rprecondition s (rcurrent s) a \\ True \\ rprecondition t (rcurrent t) a \\ rcurrent s = rcurrent t \\\n rvpeq u (rstep s a) (rstep t a)\"\n using inst_weakly_step_consistent by blast\n \\ \\show step atomicity\\\n show \"\\ s a . rcurrent (rstep s a) = rcurrent s\"\n using inst_step_atomicity by metis\n show \" \\a s u. \\ rifp (rcurrent s) u \\ True \\ rprecondition s (rcurrent s) a \\ rvpeq u s (rstep s a)\"\n using inst_local_respect by blast\n \\ \\show cswitch is independent of state\\\n show \"\\n s t. rcurrent s = rcurrent t \\ rcurrent (rcswitch n s) = rcurrent (rcswitch n t)\"\n using inst_cswitch_independent_of_state by metis\n \\ \\show cswitch consistency\\\n show \"\\u s t n. rvpeq u s t \\ rvpeq u (rcswitch n s) (rcswitch n t)\"\n using inst_cswitch_consistency by metis\n \\ \\Show the empt action sequence is in @{term AS_set}\\\n show \"[] \\ rAS_set\"\n unfolding rAS_set_def\n by auto\n \\ \\The invariant for the initial state, already encoded in @{term rstate_t}\\\n show \"True\"\n by auto\n \\ \\Step function of the invariant, already encoded in @{term rstate_t}\\\n show \"\\s n. True \\ True\"\n by auto\n \\ \\The precondition does not change with a context switch\\\n show \"\\s d n a. rprecondition s d a \\ rprecondition (rcswitch n s) d a\"\n using precondition_after_cswitch by blast\n \\ \\The precondition holds for the first action of each action sequence\\\n show \"\\s d aseq. True \\ aseq \\ rAS_set \\ aseq \\ [] \\ rprecondition s d (hd aseq)\"\n using prec_first_IPC_action prec_first_EV_WAIT_action prec_first_EV_SIGNAL_action\n unfolding rAS_set_def is_sub_seq_def \n by auto\n \\ \\The precondition holds for the next action in an action sequence, assuming the sequence is not aborted or delayed\\\n show \"\\s a a'. (\\aseq\\rAS_set. is_sub_seq a a' aseq) \\ True \\ rprecondition s (rcurrent s) a \\ \\ raborting s (rcurrent s) a \\ \\ rwaiting s (rcurrent s) a \\\n rprecondition (rstep s a) (rcurrent s) a'\"\n using prec_after_IPC_step prec_after_EV_SIGNAL_step prec_after_EV_WAIT_step\n unfolding rAS_set_def is_sub_seq_def\n by auto\n \\ \\Steps of other domains do not influence the precondition\\\n show \"\\s d a a'. rcurrent s \\ d \\ rprecondition s d a \\ rprecondition (rstep s a') d a\"\n using prec_dom_independent by blast\n \\ \\The invariant\\\n show \"\\s a. True \\ True\"\n by auto\n \\ \\Aborting does not depend on a context switch\\\n show \"\\n s. raborting (rcswitch n s) = raborting s\"\n using aborting_switch_independent by auto\n \\ \\Aborting does not depend on actions of other domains\\\n show \"\\s a d. rcurrent s \\ d \\ raborting (rstep s a) d = raborting s d\"\n using aborting_dom_independent by auto\n \\ \\Aborting is consistent\\\n show \"\\s t u. rvpeq u s t \\ raborting s u = raborting t u\"\n using raborting_consistent by auto\n \\ \\Waiting does not depend on a context switch\\\n show \"\\n s. rwaiting (rcswitch n s) = rwaiting s\"\n using waiting_switch_independent by auto\n \\ \\Waiting is consistent\\\n show \"\\s t u a. rvpeq (rcurrent s) s t \\ (\\ d \\ rkinvolved a . rvpeq d s t) \n \\ rvpeq u s t \n \\ rwaiting s u a = rwaiting t u a\"\n unfolding Kernel.involved_def\n using waiting_consistent by auto\n \\ \\Domains that are involved in an action may influence the domain of the action\\\n show \"\\s a. \\ d \\ rkinvolved a. rprecondition s (rcurrent s) a \\ rifp d (rcurrent s)\"\n using involved_ifp by blast\n \\ \\An action that is waiting does not change the state\\\n show \"\\s a. rwaiting s (rcurrent s) a \\ rstep s a = s\"\n using spec_of_waiting by blast\n \\ \\Proof obligations for @{term set_error_code}. Right now, they are all trivial\\\n show \"\\s d a' a. rcurrent s \\ d \\ raborting s d a \\ raborting (rset_error_code s a') d a\"\n unfolding rset_error_code_def\n by auto\n show \"\\s t u a. rvpeq u s t \\ rvpeq u (rset_error_code s a) (rset_error_code t a)\"\n unfolding rset_error_code_def\n by auto\n show \"\\s u a. \\ rifp (rcurrent s) u \\ rvpeq u s (rset_error_code s a)\"\n unfolding rset_error_code_def\n by (metis \\\\a u. rvpeq u a a\\)\n show \"\\s a. rcurrent (rset_error_code s a) = rcurrent s\"\n unfolding rset_error_code_def\n by auto\n show \"\\s d a a'. rprecondition s d a \\ raborting s (rcurrent s) a' \\ rprecondition (rset_error_code s a') d a\"\n unfolding rset_error_code_def\n by auto\n show \"\\s d a' a. rcurrent s \\ d \\ rwaiting s d a \\ rwaiting (rset_error_code s a') d a\"\n unfolding rset_error_code_def\n by auto\nqed\n\ntext \\Now we can instantiate CISK with some initial state, interrupt function, etc.\\\n\ninterpretation Inst:\n Controllable_Interruptible_Separation_Kernel\n rstep \\ \\step function, without program stack\\\n routput_f \\ \\output function\\\n \"\\s0\" \\ \\initial state\\\n rcurrent \\ \\returns the currently active domain\\\n rcswitch \\ \\switches the currently active domain\\\n \"(=) 42\" \\ \\interrupt function (yet unspecified)\\\n rkinvolved \\ \\returns a set of threads involved in the give action\\\n rifp \\ \\information flow policy\\\n rvpeq \\ \\view partitioning\\\n rAS_set \\ \\the set of valid action sequences\\\n rinvariant \\ \\the state invariant\\\n rprecondition \\ \\the precondition for doing an action\\\n raborting \\ \\condition under which an action is aborted\\\n rwaiting \\ \\condition under which an action is delayed\\\n rset_error_code \\ \\updates the state. Has no meaning in the current model.\\\nusing CISK_proof_obligations_satisfied by auto\n\ntext \\The main theorem: the instantiation implements the information flow policy @{term ifp}.\\\ntheorem risecure:\n \"Inst.isecure\"\nusing Inst.unwinding_implies_isecure_CISK\nby blast\n \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CISC-Kernel/trace/Rushby-with-Control/Link_separation_kernel_model_to_CISK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.28595531056210705}} {"text": "theory SubstDropEnv\n imports FlatLemma SubstExp\nbegin\n\n\n\n\n \n (* the issue we're having right now is that if we freely allow for r_s1 / r_s2, then in application, it's\n possible that the reqs include ownerships that they dont need, which then get removed from the final reqs.\n *) \n \n (* the reasoning behind this lemma is that if tau is unlim, then we only require unlim reqs. *)(*\nlemma wt_sexp_drop_req: \"\\ well_typed env r_s1 e tau r_s2 rx'; req_type tau \\ Aff; (*\\ aff_fun_ty tau;*) is_sexp e \\ \\\n well_typed env r_s1 e tau r_s2 (drop_use_env rx')\" \n apply (induction e arbitrary: env tau r_s1 r_s2 rx')\n apply (auto)\n (* const + op case *)\n apply (rule_tac drop_leq_use_env)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: ereq_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (simp add: one_use_env_def)\n apply (case_tac tau)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"rx\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (simp add: aff_use_env_def)\n apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)\n (* lam case *)\n apply (rule_tac x=\"rx\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (auto)\n apply (simp add: aff_use_env_def)\n apply (case_tac a)\n apply (auto)\n apply (simp add: null_use_env_def)\n apply (simp add: weak_use_env_def)\n (* app case. e1 *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n (* app case. e2, lambda unrolling *)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (cut_tac ?e1.0=\"e1\" and ?e2.0=\"e2\" in e2_sexp)\n apply (auto)\n apply (case_tac \"\\ unlim t1\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: unlim_def)\n (* - final manipulation *)\n apply (rule_tac x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (simp add: drop_use_env_def)\n apply (case_tac r)\n apply (auto)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in trans_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (cut_tac r_s=\"comp_use_env rx1 rx2\" and r_ex=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in diff_drop_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n done *) \n\n(*\nlemma wt_sexp_drop_all: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau \\ Aff; is_sexp e \\ \\ well_typed env (drop_use_env r_s1) e tau (drop_use_env r_s1) (drop_use_env rx)\" \n apply (induct e arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n (* const + op cases *)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp_all)\n (* var case p1. *)\n apply (rule_tac ereq_leq_use_envx)\n apply (cut_tac r_x=\"ereq_use_env x1a tau\" and r_s=\"r_s1\" and x=\"x1a\" in spec_leq_perm)\n apply (simp)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (case_tac \"req_type tau\")\n apply (auto)\n (* var case p2. *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (case_tac \"req_type tau\")\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)*)\n\n \n (*\nlemma wt_sexp_drop_all: \"\\ well_typed env rx e tau rx rx'; req_type tau \\ Aff; is_sexp e \\ \\ well_typed env (drop_use_env rx) e tau (drop_use_env rx) (drop_use_env rx')\" \n apply (induct e arbitrary: env tau rx rx')\n apply (auto)\n (* const + op cases *)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n (* var case p1 *)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: drop_use_env_def)\n apply (auto)\n apply (simp add: end_req_perm_def)\n apply (case_tac \"req_type tau\")\n apply (auto)\n apply (erule_tac x=\"x1a\" in allE)\n apply (simp)\n (* var case p2 *)\n apply (cut_tac r_s=\"rx\" and r_x=\"comp_use_env (ereq_use_env x1a tau) r_ex\" in wtsdr_weak_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac r_sa=\"ereq_use_env x1a tau\" in weak_comp_use_env2)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac r_sb=\"r_ex\" in weak_comp_use_env1)\n apply (auto)\n (* pair case *)\n apply (case_tac \"\\ (req_type t1 \\ Aff \\ req_type t2 \\ Aff)\")\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rxa\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"drop_use_env (comp_use_env r_xa (infl_use_env rx1 r_sa))\" in exI)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (cut_tac e=\"e1\" in value_is_sexp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"rx1\" and e=\"e1\" and ?r_s2.0=\"r_sa\" and rx=\"r_xa\" in infl_full_sexp_wp)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"drop_use_env (comp_use_env r_xb (infl_use_env rx2 r_sb))\" in exI)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (cut_tac e=\"e2\" in value_is_sexp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"rx2\" and e=\"e2\" and ?r_s2.0=\"r_sb\" and rx=\"r_xb\" in infl_full_sexp_wp)\n apply (auto)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"drop_use_env (diff_use_env rxa r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n (* lam case *)\n apply (simp add: aff_use_env_def)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (auto)\n apply (case_tac a)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (auto)\n apply (case_tac a)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)\n (* app case. e1 *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (rule_tac x=\"empty_use_env\" in exI)\n (*apply (rule_tac x=\"drop_use_env rx1\" in exI)*)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (rule_tac id_leq_use_env)(*\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)*)\n apply (rule_tac leq_empty_use_env)(*\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)*)\n (* app case. e2, lambda unrolling *)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (rule_tac x=\"drop_use_env rx\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and r_c=\"rx\" and ?r_s1.0=\"r_s2\" and ?r_s2.0=\"rx\" and e=\"e2\" and tau=\"t1\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (rule_tac r_c=\"r_s3\" in well_typed_decr_end_perm)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - prove that e2 is an s-expression *)\n apply (case_tac \"\\ is_sexp e2\")\n apply (cut_tac ?e1.0=\"e1\" and ?e2.0=\"e2\" in e2_sexp)\n apply (simp_all)\n (* - prove that t1 is unlim *)\n apply (case_tac \"\\ req_type t1 \\ Aff\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp add: pure_fun_def)\n (* app case. tau primitive case (only happens for fixed point w/ primitive fun) *)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (auto)\n apply (case_tac t)\n apply (auto)\n apply (case_tac \"\\ weak_use_env empty_use_env\")\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (auto)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: drop_use_env_def)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n (* non prim case. *)\n (* - prove weakness of rx1 + rx2 + r_ex *)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in wtsdr_weak_use_env)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp_all)\n (* - r not ownership *)\n apply (case_tac \"r = OwnPerm\")\n apply (case_tac e1)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (simp add: pure_fun_def)\n (* - final manipulation *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in leq_weak_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (simp add: drop_use_env_def)\n apply (case_tac r)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac r)\n apply (auto)\n apply (rule_tac dist_drop_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 rx2\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac dist_drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac r_sa=\"comp_use_env rx1 (lift_use_env rx2 r)\" in weak_comp_use_env2)\n apply (auto)\n apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in trans_leq_use_env)\n apply (rule_tac dist_drop_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac drop_weak_use_env)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_drop_leq_use_env)\n done*)\n \n (*\nlemma wt_sexp_drop_req: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau \\ Aff; (*\\ aff_fun_ty tau;*) is_sexp e \\ \\\n well_typed env r_s1 e tau r_s2 (drop_use_env rx)\"\n apply (induct e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n (* const + op case *)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_drop_leq_use_env)\n apply (rule_tac weak_diff_use_env)\n apply (simp add: weak_use_env_def)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (case_tac \"req_type tau\")\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"drop_use_env rxa\" in exI)\n (* - e1. the idea is that we should be able to drop the perms. *)\n apply (rule_tac x=\"drop_use_env rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"drop_use_env rx2\" in exI)\n apply (auto)\n *)\n \nlemma wt_sexp_drop_req: \"\\ well_typed env r_s1 e tau r_s2 rx; req_type tau \\ Aff; (*\\ aff_fun_ty tau;*) is_sexp e \\ \\\n well_typed env r_s1 e tau r_s2 (drop_use_env rx)\"\n apply (rule_tac ?r_s2.0=\"diff_use_env r_s1 (infl_use_env r_s1 r_s2)\" and\n rx=\"diff_use_env (drop_use_env (comp_use_env rx (infl_use_env r_s1 r_s2))) (infl_use_env r_s1 r_s2)\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac r_s=\"drop_use_env r_s1\" in well_typed_incr_simul_perm)\n apply (rule_tac self_drop_leq_use_env)\n apply (rule_tac wt_sexp_drop_all)\n apply (rule_tac infl_full_sexp_wp)\n apply (auto)\n apply (rule_tac self_infl_leq_use_env)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac drop_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (cut_tac r_sa=\"rx\" and r_sb=\"infl_use_env r_s1 r_s2\" in dist_drop_comp_use_env)\n apply (auto)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (infl_use_env r_s1 r_s2) (infl_use_env r_s1 r_s2)\" in trans_leq_use_env)\n apply (rule_tac diff_infl_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_drop_leq_use_env)\n done\n \nfun drop_use_env_ex where\n \"drop_use_env_ex r_s OwnPerm = r_s\"\n| \"drop_use_env_ex r_s r = drop_use_env r_s\"\n\ndefinition tau_drop_req where\n \"tau_drop_req r tau = (if r = OwnPerm then True else req_type tau \\ Aff)\"\n \nlemma wt_sexp_drop_all_ex: \"\\ well_typed env rx e tau rx rx; tau_drop_req r tau; is_sexp e \\ \\ well_typed env (drop_use_env_ex rx r) e tau (drop_use_env_ex rx r) (drop_use_env_ex rx r)\" \n apply (simp add: tau_drop_req_def)\n apply (case_tac r)\n apply (auto)\n apply (rule_tac wt_sexp_drop_all)\n apply (auto)\n apply (rule_tac wt_sexp_drop_all)\n apply (auto)\n done\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/SubstDropEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.28595530400156255}} {"text": "theory Legacy_Char\nimports Main\nbegin\n\ndatatype nibble =\n Nibble0 | Nibble1 | Nibble2 | Nibble3 | Nibble4 | Nibble5 | Nibble6 | Nibble7\n | Nibble8 | Nibble9 | NibbleA | NibbleB | NibbleC | NibbleD | NibbleE | NibbleF\n \ndatatype legacy_char = LegacyChar nibble nibble\n\nfunction mk_legacy_nibble :: \"nat \\ nibble\" where\n \"mk_legacy_nibble 0 = Nibble0\"\n| \"mk_legacy_nibble (Suc 0) = Nibble1\"\n| \"mk_legacy_nibble 2 = Nibble2\"\n| \"mk_legacy_nibble 3 = Nibble3\"\n| \"mk_legacy_nibble 4 = Nibble4\"\n| \"mk_legacy_nibble 5 = Nibble5\"\n| \"mk_legacy_nibble 6 = Nibble6\"\n| \"mk_legacy_nibble 7 = Nibble7\"\n| \"mk_legacy_nibble 8 = Nibble8\"\n| \"mk_legacy_nibble 9 = Nibble9\"\n| \"mk_legacy_nibble 10 = NibbleA\"\n| \"mk_legacy_nibble 11 = NibbleB\"\n| \"mk_legacy_nibble 12 = NibbleC\"\n| \"mk_legacy_nibble 13 = NibbleD\"\n| \"mk_legacy_nibble 14 = NibbleE\"\n| \"mk_legacy_nibble 15 = NibbleF\"\n| \"x \\ 16 \\ mk_legacy_nibble x = undefined\"\n apply auto apply atomize_elim by arith\ntermination apply (relation \"{}\") by auto\n \nfun unmk_legacy_nibble where\n \"unmk_legacy_nibble Nibble0 = 0\"\n| \"unmk_legacy_nibble Nibble1 = 1\"\n| \"unmk_legacy_nibble Nibble2 = 2\"\n| \"unmk_legacy_nibble Nibble3 = 3\"\n| \"unmk_legacy_nibble Nibble4 = 4\"\n| \"unmk_legacy_nibble Nibble5 = 5\"\n| \"unmk_legacy_nibble Nibble6 = 6\"\n| \"unmk_legacy_nibble Nibble7 = 7\"\n| \"unmk_legacy_nibble Nibble8 = 8\"\n| \"unmk_legacy_nibble Nibble9 = 9\"\n| \"unmk_legacy_nibble NibbleA = 10\"\n| \"unmk_legacy_nibble NibbleB = 11\"\n| \"unmk_legacy_nibble NibbleC = 12\"\n| \"unmk_legacy_nibble NibbleD = 13\"\n| \"unmk_legacy_nibble NibbleE = 14\"\n| \"unmk_legacy_nibble NibbleF = 15\"\n\n \ndefinition mk_legacy_char :: \"char \\ legacy_char\" where\n \"mk_legacy_char c = LegacyChar (mk_legacy_nibble (nat_of_char c div 16)) (mk_legacy_nibble (nat_of_char c mod 16))\"\n \nlemma legacy_char_000: \"mk_legacy_char CHR 000 = LegacyChar Nibble0 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_001: \"mk_legacy_char CHR 001 = LegacyChar Nibble0 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_002: \"mk_legacy_char CHR 002 = LegacyChar Nibble0 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_003: \"mk_legacy_char CHR 003 = LegacyChar Nibble0 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_004: \"mk_legacy_char CHR 004 = LegacyChar Nibble0 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_005: \"mk_legacy_char CHR 005 = LegacyChar Nibble0 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_006: \"mk_legacy_char CHR 006 = LegacyChar Nibble0 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_007: \"mk_legacy_char CHR 007 = LegacyChar Nibble0 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_008: \"mk_legacy_char CHR 008 = LegacyChar Nibble0 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_009: \"mk_legacy_char CHR 009 = LegacyChar Nibble0 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_010: \"mk_legacy_char CHR 010 = LegacyChar Nibble0 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_011: \"mk_legacy_char CHR 011 = LegacyChar Nibble0 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_012: \"mk_legacy_char CHR 012 = LegacyChar Nibble0 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_013: \"mk_legacy_char CHR 013 = LegacyChar Nibble0 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_014: \"mk_legacy_char CHR 014 = LegacyChar Nibble0 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_015: \"mk_legacy_char CHR 015 = LegacyChar Nibble0 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_016: \"mk_legacy_char CHR 016 = LegacyChar Nibble1 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_017: \"mk_legacy_char CHR 017 = LegacyChar Nibble1 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_018: \"mk_legacy_char CHR 018 = LegacyChar Nibble1 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_019: \"mk_legacy_char CHR 019 = LegacyChar Nibble1 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_020: \"mk_legacy_char CHR 020 = LegacyChar Nibble1 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_021: \"mk_legacy_char CHR 021 = LegacyChar Nibble1 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_022: \"mk_legacy_char CHR 022 = LegacyChar Nibble1 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_023: \"mk_legacy_char CHR 023 = LegacyChar Nibble1 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_024: \"mk_legacy_char CHR 024 = LegacyChar Nibble1 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_025: \"mk_legacy_char CHR 025 = LegacyChar Nibble1 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_026: \"mk_legacy_char CHR 026 = LegacyChar Nibble1 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_027: \"mk_legacy_char CHR 027 = LegacyChar Nibble1 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_028: \"mk_legacy_char CHR 028 = LegacyChar Nibble1 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_029: \"mk_legacy_char CHR 029 = LegacyChar Nibble1 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_030: \"mk_legacy_char CHR 030 = LegacyChar Nibble1 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_031: \"mk_legacy_char CHR 031 = LegacyChar Nibble1 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_032: \"mk_legacy_char CHR 032 = LegacyChar Nibble2 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_033: \"mk_legacy_char CHR 033 = LegacyChar Nibble2 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_034: \"mk_legacy_char CHR 034 = LegacyChar Nibble2 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_035: \"mk_legacy_char CHR 035 = LegacyChar Nibble2 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_036: \"mk_legacy_char CHR 036 = LegacyChar Nibble2 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_037: \"mk_legacy_char CHR 037 = LegacyChar Nibble2 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_038: \"mk_legacy_char CHR 038 = LegacyChar Nibble2 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_039: \"mk_legacy_char CHR 039 = LegacyChar Nibble2 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_040: \"mk_legacy_char CHR 040 = LegacyChar Nibble2 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_041: \"mk_legacy_char CHR 041 = LegacyChar Nibble2 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_042: \"mk_legacy_char CHR 042 = LegacyChar Nibble2 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_043: \"mk_legacy_char CHR 043 = LegacyChar Nibble2 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_044: \"mk_legacy_char CHR 044 = LegacyChar Nibble2 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_045: \"mk_legacy_char CHR 045 = LegacyChar Nibble2 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_046: \"mk_legacy_char CHR 046 = LegacyChar Nibble2 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_047: \"mk_legacy_char CHR 047 = LegacyChar Nibble2 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_048: \"mk_legacy_char CHR 048 = LegacyChar Nibble3 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_049: \"mk_legacy_char CHR 049 = LegacyChar Nibble3 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_050: \"mk_legacy_char CHR 050 = LegacyChar Nibble3 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_051: \"mk_legacy_char CHR 051 = LegacyChar Nibble3 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_052: \"mk_legacy_char CHR 052 = LegacyChar Nibble3 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_053: \"mk_legacy_char CHR 053 = LegacyChar Nibble3 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_054: \"mk_legacy_char CHR 054 = LegacyChar Nibble3 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_055: \"mk_legacy_char CHR 055 = LegacyChar Nibble3 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_056: \"mk_legacy_char CHR 056 = LegacyChar Nibble3 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_057: \"mk_legacy_char CHR 057 = LegacyChar Nibble3 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_058: \"mk_legacy_char CHR 058 = LegacyChar Nibble3 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_059: \"mk_legacy_char CHR 059 = LegacyChar Nibble3 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_060: \"mk_legacy_char CHR 060 = LegacyChar Nibble3 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_061: \"mk_legacy_char CHR 061 = LegacyChar Nibble3 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_062: \"mk_legacy_char CHR 062 = LegacyChar Nibble3 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_063: \"mk_legacy_char CHR 063 = LegacyChar Nibble3 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_064: \"mk_legacy_char CHR 064 = LegacyChar Nibble4 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_065: \"mk_legacy_char CHR 065 = LegacyChar Nibble4 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_066: \"mk_legacy_char CHR 066 = LegacyChar Nibble4 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_067: \"mk_legacy_char CHR 067 = LegacyChar Nibble4 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_068: \"mk_legacy_char CHR 068 = LegacyChar Nibble4 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_069: \"mk_legacy_char CHR 069 = LegacyChar Nibble4 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_070: \"mk_legacy_char CHR 070 = LegacyChar Nibble4 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_071: \"mk_legacy_char CHR 071 = LegacyChar Nibble4 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_072: \"mk_legacy_char CHR 072 = LegacyChar Nibble4 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_073: \"mk_legacy_char CHR 073 = LegacyChar Nibble4 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_074: \"mk_legacy_char CHR 074 = LegacyChar Nibble4 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_075: \"mk_legacy_char CHR 075 = LegacyChar Nibble4 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_076: \"mk_legacy_char CHR 076 = LegacyChar Nibble4 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_077: \"mk_legacy_char CHR 077 = LegacyChar Nibble4 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_078: \"mk_legacy_char CHR 078 = LegacyChar Nibble4 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_079: \"mk_legacy_char CHR 079 = LegacyChar Nibble4 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_080: \"mk_legacy_char CHR 080 = LegacyChar Nibble5 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_081: \"mk_legacy_char CHR 081 = LegacyChar Nibble5 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_082: \"mk_legacy_char CHR 082 = LegacyChar Nibble5 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_083: \"mk_legacy_char CHR 083 = LegacyChar Nibble5 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_084: \"mk_legacy_char CHR 084 = LegacyChar Nibble5 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_085: \"mk_legacy_char CHR 085 = LegacyChar Nibble5 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_086: \"mk_legacy_char CHR 086 = LegacyChar Nibble5 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_087: \"mk_legacy_char CHR 087 = LegacyChar Nibble5 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_088: \"mk_legacy_char CHR 088 = LegacyChar Nibble5 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_089: \"mk_legacy_char CHR 089 = LegacyChar Nibble5 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_090: \"mk_legacy_char CHR 090 = LegacyChar Nibble5 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_091: \"mk_legacy_char CHR 091 = LegacyChar Nibble5 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_092: \"mk_legacy_char CHR 092 = LegacyChar Nibble5 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_093: \"mk_legacy_char CHR 093 = LegacyChar Nibble5 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_094: \"mk_legacy_char CHR 094 = LegacyChar Nibble5 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_095: \"mk_legacy_char CHR 095 = LegacyChar Nibble5 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_096: \"mk_legacy_char CHR 096 = LegacyChar Nibble6 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_097: \"mk_legacy_char CHR 097 = LegacyChar Nibble6 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_098: \"mk_legacy_char CHR 098 = LegacyChar Nibble6 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_099: \"mk_legacy_char CHR 099 = LegacyChar Nibble6 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_100: \"mk_legacy_char CHR 100 = LegacyChar Nibble6 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_101: \"mk_legacy_char CHR 101 = LegacyChar Nibble6 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_102: \"mk_legacy_char CHR 102 = LegacyChar Nibble6 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_103: \"mk_legacy_char CHR 103 = LegacyChar Nibble6 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_104: \"mk_legacy_char CHR 104 = LegacyChar Nibble6 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_105: \"mk_legacy_char CHR 105 = LegacyChar Nibble6 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_106: \"mk_legacy_char CHR 106 = LegacyChar Nibble6 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_107: \"mk_legacy_char CHR 107 = LegacyChar Nibble6 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_108: \"mk_legacy_char CHR 108 = LegacyChar Nibble6 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_109: \"mk_legacy_char CHR 109 = LegacyChar Nibble6 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_110: \"mk_legacy_char CHR 110 = LegacyChar Nibble6 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_111: \"mk_legacy_char CHR 111 = LegacyChar Nibble6 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_112: \"mk_legacy_char CHR 112 = LegacyChar Nibble7 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_113: \"mk_legacy_char CHR 113 = LegacyChar Nibble7 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_114: \"mk_legacy_char CHR 114 = LegacyChar Nibble7 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_115: \"mk_legacy_char CHR 115 = LegacyChar Nibble7 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_116: \"mk_legacy_char CHR 116 = LegacyChar Nibble7 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_117: \"mk_legacy_char CHR 117 = LegacyChar Nibble7 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_118: \"mk_legacy_char CHR 118 = LegacyChar Nibble7 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_119: \"mk_legacy_char CHR 119 = LegacyChar Nibble7 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_120: \"mk_legacy_char CHR 120 = LegacyChar Nibble7 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_121: \"mk_legacy_char CHR 121 = LegacyChar Nibble7 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_122: \"mk_legacy_char CHR 122 = LegacyChar Nibble7 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_123: \"mk_legacy_char CHR 123 = LegacyChar Nibble7 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_124: \"mk_legacy_char CHR 124 = LegacyChar Nibble7 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_125: \"mk_legacy_char CHR 125 = LegacyChar Nibble7 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_126: \"mk_legacy_char CHR 126 = LegacyChar Nibble7 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_127: \"mk_legacy_char CHR 127 = LegacyChar Nibble7 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_128: \"mk_legacy_char CHR 128 = LegacyChar Nibble8 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_129: \"mk_legacy_char CHR 129 = LegacyChar Nibble8 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_130: \"mk_legacy_char CHR 130 = LegacyChar Nibble8 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_131: \"mk_legacy_char CHR 131 = LegacyChar Nibble8 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_132: \"mk_legacy_char CHR 132 = LegacyChar Nibble8 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_133: \"mk_legacy_char CHR 133 = LegacyChar Nibble8 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_134: \"mk_legacy_char CHR 134 = LegacyChar Nibble8 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_135: \"mk_legacy_char CHR 135 = LegacyChar Nibble8 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_136: \"mk_legacy_char CHR 136 = LegacyChar Nibble8 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_137: \"mk_legacy_char CHR 137 = LegacyChar Nibble8 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_138: \"mk_legacy_char CHR 138 = LegacyChar Nibble8 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_139: \"mk_legacy_char CHR 139 = LegacyChar Nibble8 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_140: \"mk_legacy_char CHR 140 = LegacyChar Nibble8 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_141: \"mk_legacy_char CHR 141 = LegacyChar Nibble8 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_142: \"mk_legacy_char CHR 142 = LegacyChar Nibble8 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_143: \"mk_legacy_char CHR 143 = LegacyChar Nibble8 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_144: \"mk_legacy_char CHR 144 = LegacyChar Nibble9 Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_145: \"mk_legacy_char CHR 145 = LegacyChar Nibble9 Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_146: \"mk_legacy_char CHR 146 = LegacyChar Nibble9 Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_147: \"mk_legacy_char CHR 147 = LegacyChar Nibble9 Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_148: \"mk_legacy_char CHR 148 = LegacyChar Nibble9 Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_149: \"mk_legacy_char CHR 149 = LegacyChar Nibble9 Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_150: \"mk_legacy_char CHR 150 = LegacyChar Nibble9 Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_151: \"mk_legacy_char CHR 151 = LegacyChar Nibble9 Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_152: \"mk_legacy_char CHR 152 = LegacyChar Nibble9 Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_153: \"mk_legacy_char CHR 153 = LegacyChar Nibble9 Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_154: \"mk_legacy_char CHR 154 = LegacyChar Nibble9 NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_155: \"mk_legacy_char CHR 155 = LegacyChar Nibble9 NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_156: \"mk_legacy_char CHR 156 = LegacyChar Nibble9 NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_157: \"mk_legacy_char CHR 157 = LegacyChar Nibble9 NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_158: \"mk_legacy_char CHR 158 = LegacyChar Nibble9 NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_159: \"mk_legacy_char CHR 159 = LegacyChar Nibble9 NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_160: \"mk_legacy_char CHR 160 = LegacyChar NibbleA Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_161: \"mk_legacy_char CHR 161 = LegacyChar NibbleA Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_162: \"mk_legacy_char CHR 162 = LegacyChar NibbleA Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_163: \"mk_legacy_char CHR 163 = LegacyChar NibbleA Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_164: \"mk_legacy_char CHR 164 = LegacyChar NibbleA Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_165: \"mk_legacy_char CHR 165 = LegacyChar NibbleA Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_166: \"mk_legacy_char CHR 166 = LegacyChar NibbleA Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_167: \"mk_legacy_char CHR 167 = LegacyChar NibbleA Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_168: \"mk_legacy_char CHR 168 = LegacyChar NibbleA Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_169: \"mk_legacy_char CHR 169 = LegacyChar NibbleA Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_170: \"mk_legacy_char CHR 170 = LegacyChar NibbleA NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_171: \"mk_legacy_char CHR 171 = LegacyChar NibbleA NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_172: \"mk_legacy_char CHR 172 = LegacyChar NibbleA NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_173: \"mk_legacy_char CHR 173 = LegacyChar NibbleA NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_174: \"mk_legacy_char CHR 174 = LegacyChar NibbleA NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_175: \"mk_legacy_char CHR 175 = LegacyChar NibbleA NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_176: \"mk_legacy_char CHR 176 = LegacyChar NibbleB Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_177: \"mk_legacy_char CHR 177 = LegacyChar NibbleB Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_178: \"mk_legacy_char CHR 178 = LegacyChar NibbleB Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_179: \"mk_legacy_char CHR 179 = LegacyChar NibbleB Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_180: \"mk_legacy_char CHR 180 = LegacyChar NibbleB Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_181: \"mk_legacy_char CHR 181 = LegacyChar NibbleB Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_182: \"mk_legacy_char CHR 182 = LegacyChar NibbleB Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_183: \"mk_legacy_char CHR 183 = LegacyChar NibbleB Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_184: \"mk_legacy_char CHR 184 = LegacyChar NibbleB Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_185: \"mk_legacy_char CHR 185 = LegacyChar NibbleB Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_186: \"mk_legacy_char CHR 186 = LegacyChar NibbleB NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_187: \"mk_legacy_char CHR 187 = LegacyChar NibbleB NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_188: \"mk_legacy_char CHR 188 = LegacyChar NibbleB NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_189: \"mk_legacy_char CHR 189 = LegacyChar NibbleB NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_190: \"mk_legacy_char CHR 190 = LegacyChar NibbleB NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_191: \"mk_legacy_char CHR 191 = LegacyChar NibbleB NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_192: \"mk_legacy_char CHR 192 = LegacyChar NibbleC Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_193: \"mk_legacy_char CHR 193 = LegacyChar NibbleC Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_194: \"mk_legacy_char CHR 194 = LegacyChar NibbleC Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_195: \"mk_legacy_char CHR 195 = LegacyChar NibbleC Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_196: \"mk_legacy_char CHR 196 = LegacyChar NibbleC Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_197: \"mk_legacy_char CHR 197 = LegacyChar NibbleC Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_198: \"mk_legacy_char CHR 198 = LegacyChar NibbleC Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_199: \"mk_legacy_char CHR 199 = LegacyChar NibbleC Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_200: \"mk_legacy_char CHR 200 = LegacyChar NibbleC Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_201: \"mk_legacy_char CHR 201 = LegacyChar NibbleC Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_202: \"mk_legacy_char CHR 202 = LegacyChar NibbleC NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_203: \"mk_legacy_char CHR 203 = LegacyChar NibbleC NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_204: \"mk_legacy_char CHR 204 = LegacyChar NibbleC NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_205: \"mk_legacy_char CHR 205 = LegacyChar NibbleC NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_206: \"mk_legacy_char CHR 206 = LegacyChar NibbleC NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_207: \"mk_legacy_char CHR 207 = LegacyChar NibbleC NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_208: \"mk_legacy_char CHR 208 = LegacyChar NibbleD Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_209: \"mk_legacy_char CHR 209 = LegacyChar NibbleD Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_210: \"mk_legacy_char CHR 210 = LegacyChar NibbleD Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_211: \"mk_legacy_char CHR 211 = LegacyChar NibbleD Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_212: \"mk_legacy_char CHR 212 = LegacyChar NibbleD Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_213: \"mk_legacy_char CHR 213 = LegacyChar NibbleD Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_214: \"mk_legacy_char CHR 214 = LegacyChar NibbleD Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_215: \"mk_legacy_char CHR 215 = LegacyChar NibbleD Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_216: \"mk_legacy_char CHR 216 = LegacyChar NibbleD Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_217: \"mk_legacy_char CHR 217 = LegacyChar NibbleD Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_218: \"mk_legacy_char CHR 218 = LegacyChar NibbleD NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_219: \"mk_legacy_char CHR 219 = LegacyChar NibbleD NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_220: \"mk_legacy_char CHR 220 = LegacyChar NibbleD NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_221: \"mk_legacy_char CHR 221 = LegacyChar NibbleD NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_222: \"mk_legacy_char CHR 222 = LegacyChar NibbleD NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_223: \"mk_legacy_char CHR 223 = LegacyChar NibbleD NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_224: \"mk_legacy_char CHR 224 = LegacyChar NibbleE Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_225: \"mk_legacy_char CHR 225 = LegacyChar NibbleE Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_226: \"mk_legacy_char CHR 226 = LegacyChar NibbleE Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_227: \"mk_legacy_char CHR 227 = LegacyChar NibbleE Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_228: \"mk_legacy_char CHR 228 = LegacyChar NibbleE Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_229: \"mk_legacy_char CHR 229 = LegacyChar NibbleE Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_230: \"mk_legacy_char CHR 230 = LegacyChar NibbleE Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_231: \"mk_legacy_char CHR 231 = LegacyChar NibbleE Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_232: \"mk_legacy_char CHR 232 = LegacyChar NibbleE Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_233: \"mk_legacy_char CHR 233 = LegacyChar NibbleE Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_234: \"mk_legacy_char CHR 234 = LegacyChar NibbleE NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_235: \"mk_legacy_char CHR 235 = LegacyChar NibbleE NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_236: \"mk_legacy_char CHR 236 = LegacyChar NibbleE NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_237: \"mk_legacy_char CHR 237 = LegacyChar NibbleE NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_238: \"mk_legacy_char CHR 238 = LegacyChar NibbleE NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_239: \"mk_legacy_char CHR 239 = LegacyChar NibbleE NibbleF\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_240: \"mk_legacy_char CHR 240 = LegacyChar NibbleF Nibble0\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_241: \"mk_legacy_char CHR 241 = LegacyChar NibbleF Nibble1\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_242: \"mk_legacy_char CHR 242 = LegacyChar NibbleF Nibble2\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_243: \"mk_legacy_char CHR 243 = LegacyChar NibbleF Nibble3\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_244: \"mk_legacy_char CHR 244 = LegacyChar NibbleF Nibble4\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_245: \"mk_legacy_char CHR 245 = LegacyChar NibbleF Nibble5\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_246: \"mk_legacy_char CHR 246 = LegacyChar NibbleF Nibble6\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_247: \"mk_legacy_char CHR 247 = LegacyChar NibbleF Nibble7\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_248: \"mk_legacy_char CHR 248 = LegacyChar NibbleF Nibble8\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_249: \"mk_legacy_char CHR 249 = LegacyChar NibbleF Nibble9\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_250: \"mk_legacy_char CHR 250 = LegacyChar NibbleF NibbleA\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_251: \"mk_legacy_char CHR 251 = LegacyChar NibbleF NibbleB\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_252: \"mk_legacy_char CHR 252 = LegacyChar NibbleF NibbleC\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_253: \"mk_legacy_char CHR 253 = LegacyChar NibbleF NibbleD\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_254: \"mk_legacy_char CHR 254 = LegacyChar NibbleF NibbleE\" by (simp add: mk_legacy_char_def)\nlemma legacy_char_255: \"mk_legacy_char CHR 255 = LegacyChar NibbleF NibbleF\" by (simp add: mk_legacy_char_def)\n\nlemmas legacy_char_simps = legacy_char_000 legacy_char_001 legacy_char_002 legacy_char_003 legacy_char_004 legacy_char_005 legacy_char_006 legacy_char_007 legacy_char_008 legacy_char_009 legacy_char_010 legacy_char_011 legacy_char_012 legacy_char_013 legacy_char_014 legacy_char_015 legacy_char_016 legacy_char_017 legacy_char_018 legacy_char_019 legacy_char_020 legacy_char_021 legacy_char_022 legacy_char_023 legacy_char_024 legacy_char_025 legacy_char_026 legacy_char_027 legacy_char_028 legacy_char_029 legacy_char_030 legacy_char_031 legacy_char_032 legacy_char_033 legacy_char_034 legacy_char_035 legacy_char_036 legacy_char_037 legacy_char_038 legacy_char_039 legacy_char_040 legacy_char_041 legacy_char_042 legacy_char_043 legacy_char_044 legacy_char_045 legacy_char_046 legacy_char_047 legacy_char_048 legacy_char_049 legacy_char_050 legacy_char_051 legacy_char_052 legacy_char_053 legacy_char_054 legacy_char_055 legacy_char_056 legacy_char_057 legacy_char_058 legacy_char_059 legacy_char_060 legacy_char_061 legacy_char_062 legacy_char_063 legacy_char_064 legacy_char_065 legacy_char_066 legacy_char_067 legacy_char_068 legacy_char_069 legacy_char_070 legacy_char_071 legacy_char_072 legacy_char_073 legacy_char_074 legacy_char_075 legacy_char_076 legacy_char_077 legacy_char_078 legacy_char_079 legacy_char_080 legacy_char_081 legacy_char_082 legacy_char_083 legacy_char_084 legacy_char_085 legacy_char_086 legacy_char_087 legacy_char_088 legacy_char_089 legacy_char_090 legacy_char_091 legacy_char_092 legacy_char_093 legacy_char_094 legacy_char_095 legacy_char_096 legacy_char_097 legacy_char_098 legacy_char_099 legacy_char_100 legacy_char_101 legacy_char_102 legacy_char_103 legacy_char_104 legacy_char_105 legacy_char_106 legacy_char_107 legacy_char_108 legacy_char_109 legacy_char_110 legacy_char_111 legacy_char_112 legacy_char_113 legacy_char_114 legacy_char_115 legacy_char_116 legacy_char_117 legacy_char_118 legacy_char_119 legacy_char_120 legacy_char_121 legacy_char_122 legacy_char_123 legacy_char_124 legacy_char_125 legacy_char_126 legacy_char_127 legacy_char_128 legacy_char_129 legacy_char_130 legacy_char_131 legacy_char_132 legacy_char_133 legacy_char_134 legacy_char_135 legacy_char_136 legacy_char_137 legacy_char_138 legacy_char_139 legacy_char_140 legacy_char_141 legacy_char_142 legacy_char_143 legacy_char_144 legacy_char_145 legacy_char_146 legacy_char_147 legacy_char_148 legacy_char_149 legacy_char_150 legacy_char_151 legacy_char_152 legacy_char_153 legacy_char_154 legacy_char_155 legacy_char_156 legacy_char_157 legacy_char_158 legacy_char_159 legacy_char_160 legacy_char_161 legacy_char_162 legacy_char_163 legacy_char_164 legacy_char_165 legacy_char_166 legacy_char_167 legacy_char_168 legacy_char_169 legacy_char_170 legacy_char_171 legacy_char_172 legacy_char_173 legacy_char_174 legacy_char_175 legacy_char_176 legacy_char_177 legacy_char_178 legacy_char_179 legacy_char_180 legacy_char_181 legacy_char_182 legacy_char_183 legacy_char_184 legacy_char_185 legacy_char_186 legacy_char_187 legacy_char_188 legacy_char_189 legacy_char_190 legacy_char_191 legacy_char_192 legacy_char_193 legacy_char_194 legacy_char_195 legacy_char_196 legacy_char_197 legacy_char_198 legacy_char_199 legacy_char_200 legacy_char_201 legacy_char_202 legacy_char_203 legacy_char_204 legacy_char_205 legacy_char_206 legacy_char_207 legacy_char_208 legacy_char_209 legacy_char_210 legacy_char_211 legacy_char_212 legacy_char_213 legacy_char_214 legacy_char_215 legacy_char_216 legacy_char_217 legacy_char_218 legacy_char_219 legacy_char_220 legacy_char_221 legacy_char_222 legacy_char_223 legacy_char_224 legacy_char_225 legacy_char_226 legacy_char_227 legacy_char_228 legacy_char_229 legacy_char_230 legacy_char_231 legacy_char_232 legacy_char_233 legacy_char_234 legacy_char_235 legacy_char_236 legacy_char_237 legacy_char_238 legacy_char_239 legacy_char_240 legacy_char_241 legacy_char_242 legacy_char_243 legacy_char_244 legacy_char_245 legacy_char_246 legacy_char_247 legacy_char_248 legacy_char_249 legacy_char_250 legacy_char_251 legacy_char_252 legacy_char_253 legacy_char_254 legacy_char_255\n\nlemma unmk_legacy_nibble: \n assumes \"x < 16\" \n shows \"unmk_legacy_nibble (mk_legacy_nibble x) = x\" \nproof -\n consider \"x=0\" | \"x=1\" | \"x=2\" | \"x=3\" | \"x=4\" | \"x=5\" | \"x=6\" | \"x=7\" | \"x=8\" | \"x=9\" | \"x=10\" | \"x=11\" | \"x=12\" | \"x=13\" | \"x=14\" | \"x=15\"\n apply atomize_elim using `x<16` by arith\n thus ?thesis apply cases by simp_all\nqed\n \nlemma mk_legacy_nibble_inj:\n assumes \"x < 16\" and \"y < 16\" \n shows \"mk_legacy_nibble x = mk_legacy_nibble y \\ x=y\"\n apply rule\n apply (subst unmk_legacy_nibble[OF `x<16`, symmetric])\n apply (subst unmk_legacy_nibble[OF `y<16`, symmetric])\n by auto\n\n \nlemma mk_legacy_char_inj: \"x = y \\ mk_legacy_char x = mk_legacy_char y\" \nproof -\n define a b where \"a = nat_of_char x\" and \"b = nat_of_char y\"\n have a: \"a<256\" by (simp add: a_def)\n hence adiv16: \"a div 16 < 16\" by arith\n have amod16: \"a mod 16 < 16\" by arith\n have b: \"b<256\" by (simp add: b_def)\n hence bdiv16: \"b div 16 < 16\" by arith \n have bmod16: \"b mod 16 < 16\" by arith\n have \"(a = b) =\n (LegacyChar (mk_legacy_nibble (a div 16)) (mk_legacy_nibble (a mod 16)) =\n LegacyChar (mk_legacy_nibble (b div 16)) (mk_legacy_nibble (b mod 16)))\"\n apply simp\n apply (subst mk_legacy_nibble_inj[OF adiv16 bdiv16])\n apply (subst mk_legacy_nibble_inj[OF amod16 bmod16])\n apply rule\n apply simp\n apply (subst mult_div_mod_eq[where a=a and b=16, symmetric])\n apply (subst mult_div_mod_eq[where a=b and b=16, symmetric])\n by arith\n thus ?thesis\n unfolding mk_legacy_char_def nat_of_char_eq_iff[symmetric] a_def[symmetric] b_def[symmetric] \n by assumption\nqed\n \nlemma \"CHR ''y'' \\ CHR ''z''\" \n using[[simp_trace_new]]\n by (simp only: List.list.inject mk_legacy_char_inj legacy_char.inject nibble.distinct legacy_char_simps HOL.simp_thms)\n \n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Legacy_Char.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.28579150759861116}} {"text": "(* Title: Safe OCL\n Author: Denis Nikiforov, March 2019\n Maintainer: Denis Nikiforov \n License: LGPL\n*)\nsection \\Object Model\\\ntheory Object_Model\n imports Finite_Map_Ext \"HOL-Library.Extended_Nat\"\n \"HOL-Library.Phantom_Type\"\nbegin\n\ntext \\\n The section defines a generic object model.\\\n\n(*** Type Synonyms **********************************************************)\n\nsubsection \\Type Synonyms\\\n\ntype_synonym attr = String.literal\ntype_synonym assoc = String.literal\ntype_synonym role = String.literal\ntype_synonym oper = String.literal\ntype_synonym param = String.literal\ntype_synonym elit = String.literal\n\ntype_synonym 'a enum_type = \"('a, String.literal) phantom\"\n\ndatatype param_dir = In | Out | InOut\n\ntype_synonym 'c assoc_end = \"'c \\ nat \\ enat \\ bool \\ bool\"\ntype_synonym 't param_spec = \"param \\ 't \\ param_dir\"\ntype_synonym ('t, 'e) oper_def = \"oper \\ 't param_spec list \\ 't \\ bool \\ 'e option\"\ntype_synonym ('t, 'e) oper_spec = \"'t \\ ('t, 'e) oper_def\"\n\ndefinition \"assoc_end_class :: 'c assoc_end \\ 'c \\ fst\"\ndefinition \"assoc_end_min :: 'c assoc_end \\ nat \\ fst \\ snd\"\ndefinition \"assoc_end_max :: 'c assoc_end \\ enat \\ fst \\ snd \\ snd\"\ndefinition \"assoc_end_ordered :: 'c assoc_end \\ bool \\ fst \\ snd \\ snd \\ snd\"\ndefinition \"assoc_end_unique :: 'c assoc_end \\ bool \\ snd \\ snd \\ snd \\ snd\"\n\ndefinition \"oper_context :: ('t, 'e) oper_spec \\ 't \\ fst\"\ndefinition \"oper_name :: ('t, 'e) oper_spec \\ oper \\ fst \\ snd\"\ndefinition \"oper_params :: ('t, 'e) oper_spec \\ 't param_spec list \\ fst \\ snd \\ snd\"\ndefinition \"oper_result :: ('t, 'e) oper_spec \\ 't \\ fst \\ snd \\ snd \\ snd\"\ndefinition \"oper_static :: ('t, 'e) oper_spec \\ bool \\ fst \\ snd \\ snd \\ snd \\ snd\"\ndefinition \"oper_body :: ('t, 'e) oper_spec \\ 'e option \\ snd \\ snd \\ snd \\ snd \\ snd\"\n\ndefinition \"param_name ::'t param_spec \\ param \\ fst\"\ndefinition \"param_type ::'t param_spec \\ 't \\ fst \\ snd\"\ndefinition \"param_dir ::'t param_spec \\ param_dir \\ snd \\ snd\"\n\ndefinition \"oper_in_params op \\\n filter (\\p. param_dir p = In \\ param_dir p = InOut) (oper_params op)\"\n\ndefinition \"oper_out_params op \\\n filter (\\p. param_dir p = Out \\ param_dir p = InOut) (oper_params op)\"\n\nsubsection \\Attributes\\\n\ninductive owned_attribute' where\n \"\\ |\\| fmdom attributes \\\n fmlookup attributes \\ = Some attrs\\<^sub>\\ \\\n fmlookup attrs\\<^sub>\\ attr = Some \\ \\\n owned_attribute' attributes \\ attr \\\"\n\ninductive attribute_not_closest where\n \"owned_attribute' attributes \\' attr \\' \\\n \\ \\ \\' \\\n \\' < \\ \\\n attribute_not_closest attributes \\ attr \\ \\\"\n\ninductive closest_attribute where\n \"owned_attribute' attributes \\ attr \\ \\\n \\ \\ \\ \\\n \\ attribute_not_closest attributes \\ attr \\ \\ \\\n closest_attribute attributes \\ attr \\ \\\"\n\ninductive closest_attribute_not_unique where\n \"closest_attribute attributes \\ attr \\' \\' \\\n \\ \\ \\' \\ \\ \\ \\' \\\n closest_attribute_not_unique attributes \\ attr \\ \\\"\n\ninductive unique_closest_attribute where\n \"closest_attribute attributes \\ attr \\ \\ \\\n \\ closest_attribute_not_unique attributes \\ attr \\ \\ \\\n unique_closest_attribute attributes \\ attr \\ \\\"\n\nsubsection \\Association Ends\\\n\ninductive role_refer_class where\n \"role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n assoc_end_class end = \\ \\\n role_refer_class ends \\ role\"\n\ninductive association_ends' where\n \"\\ |\\| classes \\\n assoc |\\| fmdom associations \\\n fmlookup associations assoc = Some ends \\\n role_refer_class ends \\ from \\\n role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n role \\ from \\\n association_ends' classes associations \\ from role end\"\n\ninductive association_ends_not_unique' where\n \"association_ends' classes associations \\ from role end\\<^sub>1 \\\n association_ends' classes associations \\ from role end\\<^sub>2 \\\n end\\<^sub>1 \\ end\\<^sub>2 \\\n association_ends_not_unique' classes associations\"\n\ninductive owned_association_end' where\n \"association_ends' classes associations \\ from role end \\\n owned_association_end' classes associations \\ None role end\"\n| \"association_ends' classes associations \\ from role end \\\n owned_association_end' classes associations \\ (Some from) role end\"\n\ninductive association_end_not_closest where\n \"owned_association_end' classes associations \\' from role end' \\\n \\ \\ \\' \\\n \\' < \\ \\\n association_end_not_closest classes associations \\ from role \\ end\"\n\ninductive closest_association_end where\n \"owned_association_end' classes associations \\ from role end \\\n \\ \\ \\ \\\n \\ association_end_not_closest classes associations \\ from role \\ end \\\n closest_association_end classes associations \\ from role \\ end\"\n\ninductive closest_association_end_not_unique where\n \"closest_association_end classes associations \\ from role \\' end' \\\n \\ \\ \\' \\ end \\ end' \\\n closest_association_end_not_unique classes associations \\ from role \\ end\"\n\ninductive unique_closest_association_end where\n \"closest_association_end classes associations \\ from role \\ end \\\n \\ closest_association_end_not_unique classes associations \\ from role \\ end \\\n unique_closest_association_end classes associations \\ from role \\ end\"\n\nsubsection \\Association Classes\\\n\ninductive referred_by_association_class'' where\n \"fmlookup association_classes \\ = Some assoc \\\n fmlookup associations assoc = Some ends \\\n role_refer_class ends \\ from \\\n referred_by_association_class'' association_classes associations \\ from \\\"\n\ninductive referred_by_association_class' where\n \"referred_by_association_class'' association_classes associations \\ from \\ \\\n referred_by_association_class' association_classes associations \\ None \\\"\n| \"referred_by_association_class'' association_classes associations \\ from \\ \\\n referred_by_association_class' association_classes associations \\ (Some from) \\\"\n\ninductive association_class_not_closest where\n \"referred_by_association_class' association_classes associations \\' from \\ \\\n \\ \\ \\' \\\n \\' < \\ \\\n association_class_not_closest association_classes associations \\ from \\ \\\"\n\ninductive closest_association_class where\n \"referred_by_association_class' association_classes associations \\ from \\ \\\n \\ \\ \\ \\\n \\ association_class_not_closest association_classes associations \\ from \\ \\ \\\n closest_association_class association_classes associations \\ from \\ \\\"\n\ninductive closest_association_class_not_unique where\n \"closest_association_class association_classes associations \\ from \\ \\' \\\n \\ \\ \\' \\\n closest_association_class_not_unique\n association_classes associations \\ from \\ \\\"\n\ninductive unique_closest_association_class where\n \"closest_association_class association_classes associations \\ from \\ \\ \\\n \\ closest_association_class_not_unique\n association_classes associations \\ from \\ \\ \\\n unique_closest_association_class association_classes associations \\ from \\ \\\"\n\nsubsection \\Association Class Ends\\\n\ninductive association_class_end' where\n \"fmlookup association_classes \\ = Some assoc \\\n fmlookup associations assoc = Some ends \\\n fmlookup ends role = Some end \\\n association_class_end' association_classes associations \\ role end\"\n\ninductive association_class_end_not_unique where\n \"association_class_end' association_classes associations \\ role end' \\\n end \\ end' \\\n association_class_end_not_unique association_classes associations \\ role end\"\n\ninductive unique_association_class_end where\n \"association_class_end' association_classes associations \\ role end \\\n \\ association_class_end_not_unique\n association_classes associations \\ role end \\\n unique_association_class_end association_classes associations \\ role end\"\n\nsubsection \\Operations\\\n\ninductive any_operation' where\n \"op |\\| fset_of_list operations \\\n oper_name op = name \\\n \\ \\ oper_context op \\\n list_all2 (\\\\ param. \\ \\ param_type param) \\ (oper_in_params op) \\\n any_operation' operations \\ name \\ op\"\n\ninductive operation' where\n \"any_operation' operations \\ name \\ op \\\n \\ oper_static op \\\n operation' operations \\ name \\ op\"\n\ninductive operation_not_unique where\n \"operation' operations \\ name \\ oper' \\\n oper \\ oper' \\\n operation_not_unique operations \\ name \\ oper\"\n\ninductive unique_operation where\n \"operation' operations \\ name \\ oper \\\n \\ operation_not_unique operations \\ name \\ oper \\\n unique_operation operations \\ name \\ oper\"\n\ninductive operation_defined' where\n \"unique_operation operations \\ name \\ oper \\\n operation_defined' operations \\ name \\\"\n\ninductive static_operation' where\n \"any_operation' operations \\ name \\ op \\\n oper_static op \\\n static_operation' operations \\ name \\ op\"\n\ninductive static_operation_not_unique where\n \"static_operation' operations \\ name \\ oper' \\\n oper \\ oper' \\\n static_operation_not_unique operations \\ name \\ oper\"\n\ninductive unique_static_operation where\n \"static_operation' operations \\ name \\ oper \\\n \\ static_operation_not_unique operations \\ name \\ oper \\\n unique_static_operation operations \\ name \\ oper\"\n\ninductive static_operation_defined' where\n \"unique_static_operation operations \\ name \\ oper \\\n static_operation_defined' operations \\ name \\\"\n\nsubsection \\Literals\\\n\ninductive has_literal' where\n \"fmlookup literals e = Some lits \\\n lit |\\| lits \\\n has_literal' literals e lit\"\n\n(*** Definition *************************************************************)\n\nsubsection \\Definition\\\n\nlocale object_model =\n fixes classes :: \"'a :: semilattice_sup fset\"\n and attributes :: \"'a \\\\<^sub>f attr \\\\<^sub>f 't :: order\"\n and associations :: \"assoc \\\\<^sub>f role \\\\<^sub>f 'a assoc_end\"\n and association_classes :: \"'a \\\\<^sub>f assoc\"\n and operations :: \"('t, 'e) oper_spec list\"\n and literals :: \"'a enum_type \\\\<^sub>f elit fset\"\n assumes assoc_end_min_less_eq_max:\n \"assoc |\\| fmdom associations \\\n fmlookup associations assoc = Some ends \\\n role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n assoc_end_min end \\ assoc_end_max end\"\n assumes association_ends_unique:\n \"association_ends' classes associations \\ from role end\\<^sub>1 \\\n association_ends' classes associations \\ from role end\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\nbegin\n\nabbreviation \"owned_attribute \\\n owned_attribute' attributes\"\n\nabbreviation \"attribute \\\n unique_closest_attribute attributes\"\n\nabbreviation \"association_ends \\\n association_ends' classes associations\"\n\nabbreviation \"owned_association_end \\\n owned_association_end' classes associations\"\n\nabbreviation \"association_end \\\n unique_closest_association_end classes associations\"\n\nabbreviation \"referred_by_association_class \\\n unique_closest_association_class association_classes associations\"\n\nabbreviation \"association_class_end \\\n unique_association_class_end association_classes associations\"\n\nabbreviation \"operation \\\n unique_operation operations\"\n\nabbreviation \"operation_defined \\\n operation_defined' operations\"\n\nabbreviation \"static_operation \\\n unique_static_operation operations\"\n\nabbreviation \"static_operation_defined \\\n static_operation_defined' operations\"\n\nabbreviation \"has_literal \\\n has_literal' literals\"\n\nend\n\nlemmas object_model_simps =\n assoc_end_class_def\n assoc_end_min_def\n assoc_end_max_def\n assoc_end_ordered_def\n assoc_end_unique_def\n oper_name_def\n oper_context_def\n oper_params_def\n oper_result_def\n oper_static_def\n oper_body_def\n oper_in_params_def\n oper_out_params_def\n has_literal'.simps\n\n(*** Properties *************************************************************)\n\nsubsection \\Properties\\\n\nlemma (in object_model) attribute_det:\n \"attribute \\ attr \\\\<^sub>1 \\\\<^sub>1 \\\n attribute \\ attr \\\\<^sub>2 \\\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2\"\n by (meson closest_attribute_not_unique.intros unique_closest_attribute.cases)\n\nlemma (in object_model) attribute_self_or_inherited:\n \"attribute \\ attr \\ \\ \\ \\ \\ \\\"\n by (meson closest_attribute.cases unique_closest_attribute.cases)\n\nlemma (in object_model) attribute_closest:\n \"attribute \\ attr \\ \\ \\\n owned_attribute \\' attr \\ \\\n \\ \\ \\' \\ \\ \\' < \\\"\n by (meson attribute_not_closest.intros closest_attribute.cases\n unique_closest_attribute.cases)\n\n\nlemma (in object_model) association_end_det:\n \"association_end \\ from role \\\\<^sub>1 end\\<^sub>1 \\\n association_end \\ from role \\\\<^sub>2 end\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\n by (meson closest_association_end_not_unique.intros\n unique_closest_association_end.cases)\n\nlemma (in object_model) association_end_self_or_inherited:\n \"association_end \\ from role \\ end \\ \\ \\ \\\"\n by (meson closest_association_end.cases unique_closest_association_end.cases)\n\nlemma (in object_model) association_end_closest:\n \"association_end \\ from role \\ end \\\n owned_association_end \\' from role end \\\n \\ \\ \\' \\ \\ \\' < \\\"\n by (meson association_end_not_closest.intros closest_association_end.cases\n unique_closest_association_end.cases)\n\n\nlemma (in object_model) association_class_end_det:\n \"association_class_end \\ role end\\<^sub>1 \\\n association_class_end \\ role end\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\n by (meson association_class_end_not_unique.intros unique_association_class_end.cases)\n\n\nlemma (in object_model) operation_det:\n \"operation \\ name \\ oper\\<^sub>1 \\\n operation \\ name \\ oper\\<^sub>2 \\ oper\\<^sub>1 = oper\\<^sub>2\"\n by (meson operation_not_unique.intros unique_operation.cases)\n\nlemma (in object_model) static_operation_det:\n \"static_operation \\ name \\ oper\\<^sub>1 \\\n static_operation \\ name \\ oper\\<^sub>2 \\ oper\\<^sub>1 = oper\\<^sub>2\"\n by (meson static_operation_not_unique.intros unique_static_operation.cases)\n\n(*** Notation ***************************************************************)\n\nsubsection \\Notation\\\n\ndatatype ('a, 't, 'e) model_element_spec =\n EnumSpec \"'a enum_type\" \"elit list\"\n| ClassSpec 'a \"attr \\\\<^sub>f 't\"\n| AssociationSpec assoc \"role \\\\<^sub>f 'a assoc_end\"\n| ContextSpec 't \"('t, 'e) oper_def list\"\n\ndatatype ('a, 't, 'e) model_spec =\n ModelSpec (model_spec_elements: \"('a, 't, 'e) model_element_spec list\")\n\nprimrec model_spec_classes where\n \"model_spec_classes [] = []\"\n| \"model_spec_classes (x # xs) = (case x\n of ClassSpec cls attrs \\ (cls, attrs) # (model_spec_classes xs)\n | _ \\ (model_spec_classes xs))\"\n\nprimrec model_spec_assocs where\n \"model_spec_assocs [] = []\"\n| \"model_spec_assocs (x # xs) = (case x\n of AssociationSpec assoc ends \\ (assoc, ends) # (model_spec_assocs xs)\n | _ \\ (model_spec_assocs xs))\"\n\nprimrec model_spec_contexts where\n \"model_spec_contexts [] = []\"\n| \"model_spec_contexts (x # xs) = (case x\n of ContextSpec ctx opers \\ (ctx, opers) # (model_spec_contexts xs)\n | _ \\ (model_spec_contexts xs))\"\n\nprimrec model_spec_enums where\n \"model_spec_enums [] = []\"\n| \"model_spec_enums (x # xs) = (case x\n of EnumSpec enm lits \\ (enm, fset_of_list lits) # (model_spec_enums xs)\n | _ \\ (model_spec_enums xs))\"\n\ndefinition \"model_spec_attributes m \\\n fmap_of_list (model_spec_classes (model_spec_elements m))\"\n\ndefinition \"model_spec_assoc_ens m \\\n fmap_of_list (model_spec_assocs (model_spec_elements m))\"\n\ndefinition \"model_spec_operations m \\\n concat (map (\\ctx. map (\\op. (fst ctx, op)) (snd ctx))\n (model_spec_contexts (model_spec_elements m)))\"\n\ndefinition \"model_spec_enum_literals m \\\n fmap_of_list (model_spec_enums (model_spec_elements m))\"\n\nlemmas object_model_notation_simps =\n model_spec_elements_def\n model_spec_assocs_def\n model_spec_assoc_ens_def\n model_spec_enum_literals_def\n\nnonterminal model_elements and model_element\n\nnonterminal enum_def and enum_literal_defs and enum_literal_def\n\nsyntax\n \"_enum_def\" :: \"'a \\ enum_literal_defs \\ model_element\" (\"enum _ {_}\" [1000,0] 0)\n \"_enum_literal_defs_single\" :: \"elit \\ enum_literal_defs\" (\"_\")\n \"_enum_literal_defs_cons\" :: \"elit \\ enum_literal_defs \\ enum_literal_defs\" (\"_, _\")\n\ntranslations\n \"_enum_def name literals\" \\ \"CONST EnumSpec name literals\"\n \"_enum_literal_defs_cons x (y # xs)\" \\ \"x # y # xs\"\n \"_enum_literal_defs_single x\" \\ \"[x]\"\n\nnonterminal class_defs and class_def\nnonterminal attr_defs and attr_def\n\nsyntax\n \"_class_def\" :: \"'a \\ attr_defs \\ model_element\" (\"class _ _\" [1000,0] 0)\n \"_class_def\" :: \"'a \\ model_element\" (\"class _\" [1000] 0)\n \"_attr_def\" :: \"'a \\ 'b \\ attr_def\" (\"_ : _\" [1000,1000] 0)\n \"_attr_defs_single\" :: \"attr_def \\ attr_defs\" (\"_\")\n \"_attr_defs_cons\" :: \"attr_def \\ attr_defs \\ attr_defs\" (\"_ _\")\n\ntranslations\n \"_class_def cls attrs\" \\ \"CONST ClassSpec cls (CONST fmap_of_list attrs)\"\n \"_class_def cls\" \\ \"CONST ClassSpec cls (CONST fmap_of_list [])\"\n \"_attr_def x y\" \\ \"(x, y)\"\n \"_attr_defs_single x\" \\ \"[x]\"\n \"_attr_defs_cons x (y # xs)\" \\ \"x # y # xs\"\n\nnonterminal assoc_defs and assoc_def\nnonterminal assoc_end_defs and assoc_end_def\nnonterminal assoc_end_mult\n\nsyntax\n \"_assoc_def\" :: \"'a \\ assoc_end_defs \\ model_element\"\n (\"association _ _\" [1000,100] 10)\n \"_assoc_end_defs_single\" :: \"assoc_end_def \\ assoc_end_defs\" (\"_\")\n \"_assoc_end_defs_cons\" :: \"assoc_end_def \\ assoc_end_defs \\ assoc_end_defs\"\n (\"_ _\")\n \"_assoc_end_def\" :: \"'a \\ 'b \\ assoc_end_mult \\ assoc_end_def\"\n (\"_ : _ _\" [100,100,100] 100)\n \"_assoc_end_def_o\" :: \"'a \\ 'b \\ assoc_end_mult \\ assoc_end_def\"\n (\"_ : _ _ {ordered}\" [100,100,100] 100)\n \"_assoc_end_def_u\" :: \"'a \\ 'b \\ assoc_end_mult \\ assoc_end_def\"\n (\"_ : _ _ {unique}\" [100,100,100] 100)\n \"_assoc_end_def_ou\" :: \"'a \\ 'b \\ assoc_end_mult \\ assoc_end_def\"\n (\"_ : _ _ {ordered,unique}\" [100,100,100] 100)\n\n \"_assoc_end_mult_both\" :: \"nat \\ assoc_end_mult\" (\"[_]\" [1000] 100)\n \"_assoc_end_mult_lower\" :: \"nat \\ assoc_end_mult\" (\"[_..(*)]\" [1000] 100)\n \"_assoc_end_mult\" :: \"nat \\ nat \\ assoc_end_mult\" (\"[_.._]\" [1000,1000] 100)\n\ntranslations\n \"_assoc_def assoc ends\" \\\n \"CONST AssociationSpec assoc (CONST fmap_of_list ends)\"\n \"_assoc_end_defs_single x\" \\ \"[x]\"\n \"_assoc_end_defs_cons x (y # xs)\" \\ \"x # y # xs\"\n \"_assoc_end_def name cls (CONST Pair lower upper)\" \\\n \"(name, cls, lower, upper, CONST False, CONST False)\"\n \"_assoc_end_def_o name cls (CONST Pair lower upper)\" \\\n \"(name, cls, lower, upper, CONST True, CONST False)\"\n \"_assoc_end_def_u name cls (CONST Pair lower upper)\" \\\n \"(name, cls, lower, upper, CONST False, CONST True)\"\n \"_assoc_end_def_ou name cls (CONST Pair lower upper)\" \\\n \"(name, cls, lower, upper, CONST True, CONST True)\"\n\n \"_assoc_end_mult_both x\" \\ \"CONST Pair (x :: nat) (x :: enat)\"\n \"_assoc_end_mult_lower x\" \\ \"CONST Pair (x :: nat) (\\ :: enat)\"\n \"_assoc_end_mult x y\" \\ \"CONST Pair (x :: nat) (y :: enat)\"\n\nnonterminal context_defs and context_def\nnonterminal oper_defs and oper_def_const and oper_signature\nnonterminal oper_params and oper_param\n\nsyntax\n \"_oper_param\" :: \"'a \\ 'a \\ oper_param\" (\"_ : _\")\n \"_oper_param_in\" :: \"'a \\ 'a \\ oper_param\" (\"in _ : _\")\n \"_oper_param_out\" :: \"'a \\ 'a \\ oper_param\" (\"out _ : _\")\n \"_oper_param_inout\" :: \"'a \\ 'a \\ oper_param\" (\"inout _ : _\")\n \"_oper_params_nil\" :: \"oper_params\" (\"\")\n \"_oper_params_single\" :: \"oper_param \\ oper_params\" (\"_\")\n \"_oper_params_cons\" :: \"oper_param \\ oper_params \\ oper_params\" (\"_, _\")\n\ntranslations\n \"_oper_param param ty\" \\ \"(param, ty, CONST In)\"\n \"_oper_param_in param ty\" \\ \"(param, ty, CONST In)\"\n \"_oper_param_out param ty\" \\ \"(param, ty, CONST Out)\"\n \"_oper_param_inout param ty\" \\ \"(param, ty, CONST InOut)\"\n \"_oper_params_nil\" \\ \"[]\"\n \"_oper_params_single x\" \\ \"[x]\"\n \"_oper_params_cons x xs\" \\ \"x # xs\"\n\nsyntax\n \"_context_def\" :: \"'a \\ oper_defs \\ model_element\"\n (\"context _ _\" [1000,100] 10)\n \"_oper_def\" :: \"oper_signature \\ 'a \\ oper_def_const\"\n (\"def : _ = _\" [100,100] 100)\n \"_oper_def_no_body\" :: \"oper_signature \\ oper_def_const\"\n (\"def : _\" [100] 100)\n \"_oper_def_static\" :: \"oper_signature \\ 'a \\ oper_def_const\"\n (\"static def : _ = _\" [100,100] 100)\n \"_oper_def_static_no_body\" :: \"oper_signature \\ oper_def_const\"\n (\"static def : _\" [100] 100)\n \"_oper_defs_nil\" :: \"oper_defs\" (\"\")\n \"_oper_defs_cons\" :: \"oper_def_const \\ oper_defs \\ oper_defs\" (\"_ _\")\n \"_oper_signature\" :: \"'a \\ oper_params \\ 'b \\ oper_signature\"\n (\"_'(_') : _\" [1000,100,100] 100)\n \"_oper_signature_no_params\" :: \"'a \\ 'b \\ oper_signature\"\n (\"_'(') : _\" [1000,100] 100)\n\n(*definition \"mk_oper_spec op st body \\ (fst op, fst (snd op), snd (snd op), st, body)\"*)\n\ndatatype ('a, 'b, 'c) Triple = Triple 'a 'b 'c\n\ntranslations\n \"_context_def ctx ops\" \\ \"CONST ContextSpec ctx ops\"\n \"_oper_defs_nil\" \\ \"[]\"\n \"_oper_defs_cons x xs\" \\ \"x # xs\"\n\n \"_oper_def (CONST Triple op params ty) body\" \\\n \"(op, params, ty, CONST False, CONST Some body)\"\n \"_oper_def_no_body (CONST Triple op params ty)\" \\\n \"(op, params, ty, CONST False, CONST None)\"\n \"_oper_def_static (CONST Triple op params ty) body\" \\\n \"(op, params, ty, CONST True, CONST Some body)\"\n \"_oper_def_static_no_body (CONST Triple op params ty)\" \\\n \"(op, params, ty, CONST True, CONST None)\"\n\n \"_oper_signature op params ty\" \\ \"CONST Triple op params ty\"\n \"_oper_signature_no_params op ty\" \\ \"CONST Triple op [] ty\"\n(*\n \"_oper_def sign body\" \\\n \"CONST mk_oper_spec sign CONST False (CONST Some body)\"\n \"_oper_def_no_body sign\" \\\n \"CONST mk_oper_spec sign CONST False CONST None\"\n \"_oper_def_static sign body\" \\\n \"CONST mk_oper_spec sign CONST True (CONST Some body)\"\n \"_oper_def_static_no_body sign\" \\\n \"CONST mk_oper_spec sign CONST True (CONST None)\"\n \"_oper_signature op params ty\" \\ \"(op, params, ty)\"\n \"_oper_signature_no_params op ty\" \\ \"(op, [], ty)\"\n*)\n\nsyntax\n \"_model\" :: \"model_elements \\ ('a, 't, 'e) model_spec\" (\"_\" 10)\n \"_model_element_single\" :: \"model_element \\ model_elements\" (\" _\")\n \"_model_element_cons\" ::\n \"model_element \\ model_elements \\ model_elements\" (\"_ _\")\n\ntranslations\n \"_model xs\" \\ \"CONST ModelSpec xs\"\n \"_model_element_single x\" \\ \"[x]\"\n \"_model_element_cons x (y # xs)\" \\ \"x # y # xs\"\n\nterm \"\nassociation qwea\nz : x [1]\"\n\nterm \"\nassociation qwea\nz : x [1..2]\nz : x [1..2]\n\ncontext q\n def: STR ''q''(qq : zz) : ff = ee\n static def : zzz() : qq\"\n\nterm \"\nassociation qwea\nz : x [1 .. 2]\nz : x [1] {ordered}\nz : x [1]\nz : x [1 .. *]\"\n\n\n(*** Code Setup *************************************************************)\n\nsubsection \\Code Setup\\\n\nlemma fmember_code_predI [code_pred_intro]:\n \"x |\\| xs\" if \"Predicate_Compile.contains (fset xs) x\"\n using that by (simp add: Predicate_Compile.contains_def fmember.rep_eq)\n\ncode_pred fmember\n by (simp add: Predicate_Compile.contains_def fmember.rep_eq)\n\ncode_pred unique_closest_attribute .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ o \\ o \\ o \\ o \\ bool) association_ends' .\n\ncode_pred association_ends_not_unique' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ o \\ o \\ o \\ o \\ bool) owned_association_end' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ o \\ bool) closest_association_end .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ i \\ bool ) closest_association_end_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ o \\ bool) unique_closest_association_end .\n\ncode_pred unique_closest_association_class .\n\ncode_pred association_class_end' .\n\ncode_pred association_class_end_not_unique .\n\ncode_pred unique_association_class_end .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) any_operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool) operation_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) unique_operation .\n\ncode_pred operation_defined' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) static_operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool) static_operation_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) unique_static_operation .\n\ncode_pred static_operation_defined' .\n\ncode_pred has_literal' .\n\nend\n", "meta": {"author": "AresEkb", "repo": "Safe_OCL", "sha": "61efbf1207b7a0e892190fe36fb60daf6dcf45a5", "save_path": "github-repos/isabelle/AresEkb-Safe_OCL", "path": "github-repos/isabelle/AresEkb-Safe_OCL/Safe_OCL-61efbf1207b7a0e892190fe36fb60daf6dcf45a5/Object_Model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.28574099716393986}} {"text": "(* Title: HOL/MicroJava/BV/Correct.thy\n Author: Cornelia Pusch, Gerwin Klein\n Copyright 1999 Technische Universitaet Muenchen\n*)\n\nsection {* BV Type Safety Invariant *}\n\ntheory Correct\nimports BVSpec \"../JVM/JVMExec\"\nbegin\n\ndefinition approx_val :: \"[jvm_prog,aheap,val,ty err] \\ bool\" where\n \"approx_val G h v any == case any of Err \\ True | OK T \\ G,h\\v::\\T\"\n\ndefinition approx_loc :: \"[jvm_prog,aheap,val list,locvars_type] \\ bool\" where\n \"approx_loc G hp loc LT == list_all2 (approx_val G hp) loc LT\"\n\ndefinition approx_stk :: \"[jvm_prog,aheap,opstack,opstack_type] \\ bool\" where\n \"approx_stk G hp stk ST == approx_loc G hp stk (map OK ST)\"\n\ndefinition correct_frame :: \"[jvm_prog,aheap,state_type,nat,bytecode] \\ frame \\ bool\" where\n \"correct_frame G hp == \\(ST,LT) maxl ins (stk,loc,C,sig,pc).\n approx_stk G hp stk ST \\ approx_loc G hp loc LT \\ \n pc < length ins \\ length loc=length(snd sig)+maxl+1\"\n\nprimrec correct_frames :: \"[jvm_prog,aheap,prog_type,ty,sig,frame list] \\ bool\" where\n \"correct_frames G hp phi rT0 sig0 [] = True\"\n| \"correct_frames G hp phi rT0 sig0 (f#frs) =\n (let (stk,loc,C,sig,pc) = f in\n (\\ST LT rT maxs maxl ins et.\n phi C sig ! pc = Some (ST,LT) \\ is_class G C \\ \n method (G,C) sig = Some(C,rT,(maxs,maxl,ins,et)) \\\n (\\C' mn pTs. ins!pc = (Invoke C' mn pTs) \\ \n (mn,pTs) = sig0 \\ \n (\\apTs D ST' LT'.\n (phi C sig)!pc = Some ((rev apTs) @ (Class D) # ST', LT') \\\n length apTs = length pTs \\\n (\\D' rT' maxs' maxl' ins' et'.\n method (G,D) sig0 = Some(D',rT',(maxs',maxl',ins',et')) \\\n G \\ rT0 \\ rT') \\\n correct_frame G hp (ST, LT) maxl ins f \\ \n correct_frames G hp phi rT sig frs))))\"\n\ndefinition correct_state :: \"[jvm_prog,prog_type,jvm_state] \\ bool\"\n (\"_,_ |-JVM _ [ok]\" [51,51] 50) where\n\"correct_state G phi == \\(xp,hp,frs).\n case xp of\n None \\ (case frs of\n [] \\ True\n | (f#fs) \\ G\\h hp\\ \\ preallocated hp \\ \n (let (stk,loc,C,sig,pc) = f\n in\n \\rT maxs maxl ins et s.\n is_class G C \\\n method (G,C) sig = Some(C,rT,(maxs,maxl,ins,et)) \\\n phi C sig ! pc = Some s \\\n correct_frame G hp s maxl ins f \\ \n correct_frames G hp phi rT sig fs))\n | Some x \\ frs = []\" \n\n\nnotation (xsymbols)\n correct_state (\"_,_ \\JVM _ \\\" [51,51] 50)\n\n\nlemma sup_ty_opt_OK:\n \"(G \\ X <=o (OK T')) = (\\T. X = OK T \\ G \\ T \\ T')\"\n by (cases X) auto\n\n\nsubsection {* approx-val *}\n\nlemma approx_val_Err [simp,intro!]:\n \"approx_val G hp x Err\"\n by (simp add: approx_val_def)\n\nlemma approx_val_OK [iff]: \n \"approx_val G hp x (OK T) = (G,hp \\ x ::\\ T)\"\n by (simp add: approx_val_def)\n\nlemma approx_val_Null [simp,intro!]:\n \"approx_val G hp Null (OK (RefT x))\"\n by (auto simp add: approx_val_def)\n\nlemma approx_val_sup_heap:\n \"\\ approx_val G hp v T; hp \\| hp' \\ \\ approx_val G hp' v T\"\n by (cases T) (blast intro: conf_hext)+\n\nlemma approx_val_heap_update:\n \"\\ hp a = Some obj'; G,hp\\ v::\\T; obj_ty obj = obj_ty obj'\\ \n \\ G,hp(a\\obj)\\ v::\\T\"\n by (cases v) (auto simp add: obj_ty_def conf_def)\n\nlemma approx_val_widen:\n \"\\ approx_val G hp v T; G \\ T <=o T'; wf_prog wt G \\\n \\ approx_val G hp v T'\"\n by (cases T') (auto simp add: sup_ty_opt_OK intro: conf_widen)\n\nsubsection {* approx-loc *}\n\nlemma approx_loc_Nil [simp,intro!]:\n \"approx_loc G hp [] []\"\n by (simp add: approx_loc_def)\n\nlemma approx_loc_Cons [iff]:\n \"approx_loc G hp (l#ls) (L#LT) = \n (approx_val G hp l L \\ approx_loc G hp ls LT)\"\nby (simp add: approx_loc_def)\n\nlemma approx_loc_nth:\n \"\\ approx_loc G hp loc LT; n < length LT \\\n \\ approx_val G hp (loc!n) (LT!n)\"\n by (simp add: approx_loc_def list_all2_conv_all_nth)\n\nlemma approx_loc_imp_approx_val_sup:\n \"\\approx_loc G hp loc LT; n < length LT; LT ! n = OK T; G \\ T \\ T'; wf_prog wt G\\ \n \\ G,hp \\ (loc!n) ::\\ T'\"\n apply (drule approx_loc_nth, assumption) \n apply simp\n apply (erule conf_widen, assumption+)\n done\n\nlemma approx_loc_conv_all_nth:\n \"approx_loc G hp loc LT = \n (length loc = length LT \\ (\\n < length loc. approx_val G hp (loc!n) (LT!n)))\"\n by (simp add: approx_loc_def list_all2_conv_all_nth)\n\nlemma approx_loc_sup_heap:\n \"\\ approx_loc G hp loc LT; hp \\| hp' \\\n \\ approx_loc G hp' loc LT\"\n apply (clarsimp simp add: approx_loc_conv_all_nth)\n apply (blast intro: approx_val_sup_heap)\n done\n\nlemma approx_loc_widen:\n \"\\ approx_loc G hp loc LT; G \\ LT <=l LT'; wf_prog wt G \\\n \\ approx_loc G hp loc LT'\"\napply (unfold Listn.le_def lesub_def sup_loc_def)\napply (simp (no_asm_use) only: list_all2_conv_all_nth approx_loc_conv_all_nth)\napply (simp (no_asm_simp))\napply clarify\napply (erule allE, erule impE) \n apply simp\napply (erule approx_val_widen)\n apply simp\napply assumption\ndone\n\nlemma loc_widen_Err [dest]:\n \"\\XT. G \\ replicate n Err <=l XT \\ XT = replicate n Err\"\n by (induct n) auto\n \nlemma approx_loc_Err [iff]:\n \"approx_loc G hp (replicate n v) (replicate n Err)\"\n by (induct n) auto\n\nlemma approx_loc_subst:\n \"\\ approx_loc G hp loc LT; approx_val G hp x X \\\n \\ approx_loc G hp (loc[idx:=x]) (LT[idx:=X])\"\napply (unfold approx_loc_def list_all2_iff)\napply (auto dest: subsetD [OF set_update_subset_insert] simp add: zip_update)\ndone\n\nlemma approx_loc_append:\n \"length l1=length L1 \\\n approx_loc G hp (l1@l2) (L1@L2) = \n (approx_loc G hp l1 L1 \\ approx_loc G hp l2 L2)\"\n apply (unfold approx_loc_def list_all2_iff)\n apply (simp cong: conj_cong)\n apply blast\n done\n\nsubsection {* approx-stk *}\n\nlemma approx_stk_rev_lem:\n \"approx_stk G hp (rev s) (rev t) = approx_stk G hp s t\"\n apply (unfold approx_stk_def approx_loc_def)\n apply (simp add: rev_map [THEN sym])\n done\n\nlemma approx_stk_rev:\n \"approx_stk G hp (rev s) t = approx_stk G hp s (rev t)\"\n by (auto intro: subst [OF approx_stk_rev_lem])\n\nlemma approx_stk_sup_heap:\n \"\\ approx_stk G hp stk ST; hp \\| hp' \\ \\ approx_stk G hp' stk ST\"\n by (auto intro: approx_loc_sup_heap simp add: approx_stk_def)\n\nlemma approx_stk_widen:\n \"\\ approx_stk G hp stk ST; G \\ map OK ST <=l map OK ST'; wf_prog wt G \\\n \\ approx_stk G hp stk ST'\" \n by (auto elim: approx_loc_widen simp add: approx_stk_def)\n\nlemma approx_stk_Nil [iff]:\n \"approx_stk G hp [] []\"\n by (simp add: approx_stk_def)\n\nlemma approx_stk_Cons [iff]:\n \"approx_stk G hp (x#stk) (S#ST) = \n (approx_val G hp x (OK S) \\ approx_stk G hp stk ST)\"\n by (simp add: approx_stk_def)\n\nlemma approx_stk_Cons_\n\nlemma approx_stk_append:\n \"approx_stk G hp stk (S@S') \\\n (\\s stk'. stk = s@stk' \\ length s = length S \\ length stk' = length S' \\ \n approx_stk G hp s S \\ approx_stk G hp stk' S')\"\n by (simp add: list_all2_append2 approx_stk_def approx_loc_def)\n\nlemma approx_stk_all_widen:\n \"\\ approx_stk G hp stk ST; \\(x, y) \\ set (zip ST ST'). G \\ x \\ y; length ST = length ST'; wf_prog wt G \\ \n \\ approx_stk G hp stk ST'\"\napply (unfold approx_stk_def)\napply (clarsimp simp add: approx_loc_conv_all_nth all_set_conv_all_nth)\napply (erule allE, erule impE, assumption)\napply (erule allE, erule impE, assumption)\napply (erule conf_widen, assumption+)\ndone\n\nsubsection {* oconf *}\n\nlemma oconf_field_update:\n \"\\map_of (fields (G, oT)) FD = Some T; G,hp\\v::\\T; G,hp\\(oT,fs)\\ \\\n \\ G,hp\\(oT, fs(FD\\v))\\\"\n by (simp add: oconf_def lconf_def)\n\nlemma oconf_newref:\n \"\\hp oref = None; G,hp \\ obj \\; G,hp \\ obj' \\\\ \\ G,hp(oref\\obj') \\ obj \\\"\n apply (unfold oconf_def lconf_def)\n apply simp\n apply (blast intro: conf_hext hext_new)\n done\n\nlemma oconf_heap_update:\n \"\\ hp a = Some obj'; obj_ty obj' = obj_ty obj''; G,hp\\obj\\ \\\n \\ G,hp(a\\obj'')\\obj\\\"\n apply (unfold oconf_def lconf_def)\n apply (fastforce intro: approx_val_heap_update)\n done\n\nsubsection {* hconf *}\n\nlemma hconf_newref:\n \"\\ hp oref = None; G\\h hp\\; G,hp\\obj\\ \\ \\ G\\h hp(oref\\obj)\\\"\n apply (simp add: hconf_def)\n apply (fast intro: oconf_newref)\n done\n\nlemma hconf_field_update:\n \"\\ map_of (fields (G, oT)) X = Some T; hp a = Some(oT,fs); \n G,hp\\v::\\T; G\\h hp\\ \\ \n \\ G\\h hp(a \\ (oT, fs(X\\v)))\\\"\n apply (simp add: hconf_def)\n apply (fastforce intro: oconf_heap_update oconf_field_update \n simp add: obj_ty_def)\n done\n\nsubsection {* preallocated *}\n\nlemma preallocated_field_update:\n \"\\ map_of (fields (G, oT)) X = Some T; hp a = Some(oT,fs); \n G\\h hp\\; preallocated hp \\ \n \\ preallocated (hp(a \\ (oT, fs(X\\v))))\"\n apply (unfold preallocated_def)\n apply (rule allI)\n apply (erule_tac x=x in allE)\n apply simp\n apply (rule ccontr) \n apply (unfold hconf_def)\n apply (erule allE, erule allE, erule impE, assumption)\n apply (unfold oconf_def lconf_def)\n apply (simp del: split_paired_All)\n done \n\n\nlemma \n assumes none: \"hp oref = None\" and alloc: \"preallocated hp\"\n shows preallocated_newref: \"preallocated (hp(oref\\obj))\"\nproof (cases oref)\n case (XcptRef x) \n with none alloc have False by (auto elim: preallocatedE [of _ x])\n thus ?thesis ..\nnext\n case (Loc l)\n with alloc show ?thesis by (simp add: preallocated_def)\nqed\n \nsubsection {* correct-frames *}\n\nlemmas [simp del] = fun_upd_apply\n\nlemma correct_frames_field_update [rule_format]:\n \"\\rT C sig. \n correct_frames G hp phi rT sig frs \\ \n hp a = Some (C,fs) \\ \n map_of (fields (G, C)) fl = Some fd \\ \n G,hp\\v::\\fd \n \\ correct_frames G (hp(a \\ (C, fs(fl\\v)))) phi rT sig frs\"\napply (induct frs)\n apply simp\napply clarify\napply (simp (no_asm_use))\napply clarify\napply (unfold correct_frame_def)\napply (simp (no_asm_use))\napply clarify\napply (intro exI conjI)\n apply assumption+\n apply (erule approx_stk_sup_heap)\n apply (erule hext_upd_obj)\n apply (erule approx_loc_sup_heap)\n apply (erule hext_upd_obj)\n apply assumption+\napply blast\ndone\n\nlemma correct_frames_newref [rule_format]:\n \"\\rT C sig. \n hp x = None \\ \n correct_frames G hp phi rT sig frs \\\n correct_frames G (hp(x \\ obj)) phi rT sig frs\"\napply (induct frs)\n apply simp\napply clarify\napply (simp (no_asm_use))\napply clarify\napply (unfold correct_frame_def)\napply (simp (no_asm_use))\napply clarify\napply (intro exI conjI)\n apply assumption+\n apply (erule approx_stk_sup_heap)\n apply (erule hext_new)\n apply (erule approx_loc_sup_heap)\n apply (erule hext_new)\n apply assumption+\napply blast\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/BV/Correct.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2857409855286218}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Words of Length 8\"\n\ntheory Word_8\nimports\n More_Word\n Enumeration_Word\n Even_More_List\n Signed_Words\n Word_Lemmas\nbegin\n\ncontext\n includes bit_operations_syntax\nbegin\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\n\nlemma word8_and_max_simp:\n \\x AND 0xFF = x\\ for x :: \\8 word\\\n using word_and_full_mask_simp [of x]\n by (simp add: numeral_eq_Suc mask_Suc_exp)\n\nlemma enum_word8_eq:\n \\enum = [0 :: 8 word, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,\n 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,\n 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,\n 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,\n 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,\n 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103,\n 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117,\n 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131,\n 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145,\n 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,\n 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,\n 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187,\n 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201,\n 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215,\n 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,\n 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243,\n 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255]\\ (is \\?lhs = ?rhs\\)\nproof -\n have \\map unat ?lhs = [0..<256]\\\n by (simp add: enum_word_def comp_def take_bit_nat_eq_self map_idem_upt_eq unsigned_of_nat)\n also have \\\\ = map unat ?rhs\\\n by (simp add: upt_zero_numeral_unfold)\n finally show ?thesis\n using unat_inj by (rule map_injective)\nqed\n\nlemma set_enum_word8_def:\n \"(set enum :: 8 word set) = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,\n 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,\n 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,\n 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,\n 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,\n 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103,\n 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117,\n 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131,\n 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145,\n 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,\n 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,\n 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187,\n 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201,\n 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215,\n 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,\n 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243,\n 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}\"\n by (simp add: enum_word8_eq)\n\nlemma set_strip_insert: \"\\ x \\ insert a S; x \\ a \\ \\ x \\ S\"\n by simp\n\nlemma word8_exhaust:\n fixes x :: \\8 word\\\n shows \"\\x \\ 0; x \\ 1; x \\ 2; x \\ 3; x \\ 4; x \\ 5; x \\ 6; x \\ 7; x \\ 8; x \\ 9; x \\ 10; x \\ 11; x \\\n 12; x \\ 13; x \\ 14; x \\ 15; x \\ 16; x \\ 17; x \\ 18; x \\ 19; x \\ 20; x \\ 21; x \\ 22; x \\\n 23; x \\ 24; x \\ 25; x \\ 26; x \\ 27; x \\ 28; x \\ 29; x \\ 30; x \\ 31; x \\ 32; x \\ 33; x \\\n 34; x \\ 35; x \\ 36; x \\ 37; x \\ 38; x \\ 39; x \\ 40; x \\ 41; x \\ 42; x \\ 43; x \\ 44; x \\\n 45; x \\ 46; x \\ 47; x \\ 48; x \\ 49; x \\ 50; x \\ 51; x \\ 52; x \\ 53; x \\ 54; x \\ 55; x \\\n 56; x \\ 57; x \\ 58; x \\ 59; x \\ 60; x \\ 61; x \\ 62; x \\ 63; x \\ 64; x \\ 65; x \\ 66; x \\\n 67; x \\ 68; x \\ 69; x \\ 70; x \\ 71; x \\ 72; x \\ 73; x \\ 74; x \\ 75; x \\ 76; x \\ 77; x \\\n 78; x \\ 79; x \\ 80; x \\ 81; x \\ 82; x \\ 83; x \\ 84; x \\ 85; x \\ 86; x \\ 87; x \\ 88; x \\\n 89; x \\ 90; x \\ 91; x \\ 92; x \\ 93; x \\ 94; x \\ 95; x \\ 96; x \\ 97; x \\ 98; x \\ 99; x \\\n 100; x \\ 101; x \\ 102; x \\ 103; x \\ 104; x \\ 105; x \\ 106; x \\ 107; x \\ 108; x \\ 109; x \\\n 110; x \\ 111; x \\ 112; x \\ 113; x \\ 114; x \\ 115; x \\ 116; x \\ 117; x \\ 118; x \\ 119; x \\\n 120; x \\ 121; x \\ 122; x \\ 123; x \\ 124; x \\ 125; x \\ 126; x \\ 127; x \\ 128; x \\ 129; x \\\n 130; x \\ 131; x \\ 132; x \\ 133; x \\ 134; x \\ 135; x \\ 136; x \\ 137; x \\ 138; x \\ 139; x \\\n 140; x \\ 141; x \\ 142; x \\ 143; x \\ 144; x \\ 145; x \\ 146; x \\ 147; x \\ 148; x \\ 149; x \\\n 150; x \\ 151; x \\ 152; x \\ 153; x \\ 154; x \\ 155; x \\ 156; x \\ 157; x \\ 158; x \\ 159; x \\\n 160; x \\ 161; x \\ 162; x \\ 163; x \\ 164; x \\ 165; x \\ 166; x \\ 167; x \\ 168; x \\ 169; x \\\n 170; x \\ 171; x \\ 172; x \\ 173; x \\ 174; x \\ 175; x \\ 176; x \\ 177; x \\ 178; x \\ 179; x \\\n 180; x \\ 181; x \\ 182; x \\ 183; x \\ 184; x \\ 185; x \\ 186; x \\ 187; x \\ 188; x \\ 189; x \\\n 190; x \\ 191; x \\ 192; x \\ 193; x \\ 194; x \\ 195; x \\ 196; x \\ 197; x \\ 198; x \\ 199; x \\\n 200; x \\ 201; x \\ 202; x \\ 203; x \\ 204; x \\ 205; x \\ 206; x \\ 207; x \\ 208; x \\ 209; x \\\n 210; x \\ 211; x \\ 212; x \\ 213; x \\ 214; x \\ 215; x \\ 216; x \\ 217; x \\ 218; x \\ 219; x \\\n 220; x \\ 221; x \\ 222; x \\ 223; x \\ 224; x \\ 225; x \\ 226; x \\ 227; x \\ 228; x \\ 229; x \\\n 230; x \\ 231; x \\ 232; x \\ 233; x \\ 234; x \\ 235; x \\ 236; x \\ 237; x \\ 238; x \\ 239; x \\\n 240; x \\ 241; x \\ 242; x \\ 243; x \\ 244; x \\ 245; x \\ 246; x \\ 247; x \\ 248; x \\ 249; x \\\n 250; x \\ 251; x \\ 252; x \\ 253; x \\ 254; x \\ 255\\ \\ P\"\n apply (subgoal_tac \"x \\ set enum\", subst (asm) set_enum_word8_def)\n apply (drule set_strip_insert, assumption)+\n apply (erule emptyE)\n apply (subst enum_UNIV, rule UNIV_I)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Word_Lib/Word_8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2857051938559796}} {"text": "theory Sepref_Additional\nimports Sepref_Basic Sepref_Rules\nbegin\n\nlemma hoare_alt: \n \"

c <\\r. Q r > = (\\h as n.\n pHeap h as n \\ P \\ (\\h' t r. execute c h = Some (r, h', t) \\\n (pHeap h' (new_addrs h as h') (n - t) \\ Q r \\\n t \\ n \\ relH {a. a < heap.lim h \\ a \\ as} h h' \\ heap.lim h \\ heap.lim h')))\" (is \"?L = (\\h as n. ?H h as n \\ (\\h' t r. _ \\ ?P h as h' n t r))\")\nproof -\n have \"?L = (\\h as n. pHeap h as n \\ P \\ \n (\\ \\ t r. run c (Some h) \\ r t \\ \\ \\ None \\ (?P h as (the \\) n t r)))\"\n unfolding hoare_triple_def by auto \n also have \"\\ = (\\h as n. pHeap h as n \\ P \\\n (\\h' t r. execute c h = Some (r, h', t) \\\n ?P h as h' n t r))\" apply(subst run_and_execute) by simp\n finally show ?thesis .\nqed\n\nlemma extract_cost_otherway:\n assumes \n \"\\ * timeCredit_assn Cost_lb \\\\<^sub>A G * F\"\n \" c <\\r. Q r >\"\n \"\\r. Q r * F \\\\<^sub>A \\' * (\\\\<^sub>Ara. R ra r * \\(ra \\ dom M)) * true\"\n \"(\\c. c\\ran M \\ Cost_lb \\ c)\"\n shows \"hn_refine \\ c \\' R (REST M)\" \nproof - \n note pre_rule[OF assms(1) frame_rule[OF assms(2)]]\n then have TR: \"\\h as n. pHeap h as n \\ \\ * timeCredit_assn Cost_lb \\\n (\\h' t r. execute c h = Some (r, h', t) \\\n pHeap h' (new_addrs h as h') (n - t) \\ Q r * F \\ t \\ n \\ relH {a. a < heap.lim h \\ a \\ as} h h' \\ heap.lim h \\ heap.lim h')\" \n unfolding hoare_alt by simp\n\n show ?thesis\n unfolding hn_refine_def apply auto\n proof -\n fix h as n\n assume \"pHeap h as n \\ \\\"\n then have \"pHeap h as (n+Cost_lb) \\ \\ * timeCredit_assn Cost_lb\" \n by (simp add: mod_timeCredit_dest)\n from TR[OF this] obtain h' t r where \"execute c h = Some (r, h', t)\"\n and h: \"pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ Q r * F\" \n and 3: \"t \\ n + Cost_lb\" \"relH {a. a < heap.lim h \\ a \\ as} h h'\" \"heap.lim h \\ heap.lim h'\"\n by blast\n\n from h assms(3) have h': \"pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ \\' * (\\\\<^sub>Ara. R ra r * \\ (ra \\ dom M)) * true\"\n by (simp add: entails_def)\n then have \"\\ra. pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ \\' * R ra r * \\ (ra \\ dom M) * true\"\n by simp\n then obtain ra where h'': \"pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ \\' * R ra r * \\ (ra \\ dom M) * true\"\n by blast\n have \"pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ (\\' * R ra r * true) * \\ (ra \\ dom M)\"\n apply(rule entailsD[OF _ h'']) by (simp add: entails_triv move_back_pure') \n then have h'': \"pHeap h' (new_addrs h as h') (n + Cost_lb - t) \\ \\' * R ra r * true\" and radom: \"ra \\ dom M\"\n using mod_pure_star_dist by auto \n\n show \"\\h' t r. execute c h = Some (r, h', t) \\\n (\\ra Ca. Some (enat Ca) \\ M ra \\ t \\ n + Ca \\ pHeap h' (new_addrs h as h') (n + Ca - t) \\ \\' * R ra r * true) \\\n relH {a. a < heap.lim h \\ a \\ as} h h' \\ heap.lim h \\ heap.lim h'\"\n apply(rule exI[where x=h']) apply(rule exI[where x=t]) apply(rule exI[where x=r])\n apply safe apply fact\n apply(rule exI[where x=ra])\n apply(rule exI[where x=Cost_lb])\n apply safe \n subgoal using assms(4) radom using ranI by force\n subgoal by fact\n subgoal using h'' mod_star_trueI by blast \n apply fact apply fact done\n qed\nqed\n\n\nlemma extract_cost_otherway':\n fixes R\n assumes \n \"\\ * timeCredit_assn Cost_lb \\\\<^sub>A G * F\"\n \"\\h. h\\\\ \\ c <\\r. Q r >\"\n \"\\r h. h\\\\ \\ Q r * F \\\\<^sub>A \\' * (\\\\<^sub>Ara. R ra r * \\(ra \\ dom M)) * true\"\n \"(\\c h. h\\\\ \\ c\\ran M \\ Cost_lb \\ c)\"\n shows \"hn_refine \\ c \\' R (REST M)\" \n apply(rule hn_refine_preI)\n apply(rule extract_cost_otherway)\n using assms by auto\n\n\nlemmas extr = extract_cost_otherway[where F=emp, simplified, OF ent_refl _ ent_refl]\n\nlemma extr': \"(\\M. m = SPECT M \\ <\\ * timeCredit_assn Cost_lb> c <\\r. \\\\<^sub>Ara. \\' * (R ra r * \\ (ra \\ dom M)) * true>) \\\n(\\c M. m = SPECT M \\ c \\ ran M \\ enat Cost_lb \\ c) \\ hn_refine \\ c \\' R m\"\n apply(cases m)\n subgoal by simp\n subgoal premises prems for M\n using extr[OF prems(1)[OF prems(3)] prems(2)[OF prems(3)]] prems(3) by simp\n done\n\nlemma hfrefb_to_hoare_triple:\n assumes\n \"(\\M h c a t. P a \\ D a \\ t a \\ h\\fst RS a c \\ g t a = SPECT M\n \\ f c <\\r. \\\\<^sub>Ara. snd RS a c * (T ra r * \\ (ra \\ dom M)) * true>)\"\n \"(\\co M h c a t. P a \\ D a \\ t a \\ h\\fst RS a c \\ g t a = SPECT M \\ co \\ ran M\n \\ enat (D a) \\ co)\"\nshows \"(f,g)\\hfrefb P D RS T\"\n apply(rule hfrefbI)\n apply(rule hn_refine_preI)\n subgoal for c a t h\n apply(rule extr'[where Cost_lb=\"D a\"])\n apply (rule assms(1)) apply simp_all\n apply (rule assms(2)) apply simp_all\n done\n done\n\n\n\nsubsection \"how to extract a hoare triple from hn_refine\"\n\nlemma extract_cost_ub:\n assumes \"hn_refine \\ c \\' R (REST M)\" \"(\\c. c\\ran M \\ c \\ Cost_ub)\"\n shows \"<\\ * timeCredit_assn Cost_ub> c <\\r. \\' * (\\\\<^sub>Ara. R ra r * \\(ra \\ dom M)) >\\<^sub>t\"\n using assms(1) unfolding hn_refine_def\n unfolding hoare_triple_def \n apply clarify\nproof (goal_cases)\n case (1 h as \\ r n t)\n from 1(2) have 2: \"pHeap h as (n-Cost_ub) \\ \\\" and nf: \"n\\Cost_ub\"\n using mod_timeCredit_dest by auto\n\n from 1(1) have 3: \"\\h as n Ma.\n pHeap h as n \\ \\ \\ \n SPECT M = SPECT Ma \\ (\\h' t r. execute c h = Some (r, h', t) \\ \n (\\ra Ca. Ma ra \\ Some (enat Ca) \\ t \\ n + Ca \\ pHeap h' (new_addrs h as h') ((n + Ca) - t) \\ \\' * R ra r * true) \\\n relH {a. a < heap.lim h \\ a \\ as} h h' \\ heap.lim h \\ heap.lim h')\" \n by auto\n\n thm effect_deterministic\n\n from 3[OF 2 ] obtain h' t' r' where E: \"execute c h = Some (r', h', t') \" and\n R: \"(\\ra Ca. M ra \\ Some (enat Ca) \\\n pHeap h' (new_addrs h as h') (n - Cost_ub + Ca - t') \\ \\' * R ra r' * true \\ t' \\ n - Cost_ub + Ca) \\\n relH {a. a < heap.lim h \\ a \\ as} h h' \\ heap.lim h \\ heap.lim h'\" by blast\n\n have F: \"\\ = Some h'\" and prime: \"r' = r\" \"t' = t\" \n using E 1(3) run.cases apply force\n using E 1(3) run.cases apply force\n using E 1(3) run.cases by force \n then have sig: \"the \\ = h'\" by auto\n from R have\n B: \"(\\ra Ca. M ra \\ Some (enat Ca) \\\n pHeap (the \\) (new_addrs h as (the \\)) (n - Cost_ub + Ca - t) \\ \\' * R ra r * true \\\n t \\ n - Cost_ub + Ca )\" and C:\n \"relH {a. a < heap.lim h \\ a \\ as} h (the \\)\" \"heap.lim h \\ heap.lim (the \\) \" \n unfolding prime sig by auto\n\n\n\n from B obtain ra Ca where i: \"pHeap (the \\) (new_addrs h as (the \\)) (n - Cost_ub + Ca - t) \\ \\' * R ra r * true\"\n and ii: \"t \\ n - Cost_ub + Ca\" and ineq: \"M ra \\ Some (enat Ca)\"\n using B by auto\n\n from ineq have radom: \"ra \\ dom M\" using domIff by fastforce \n then obtain Mra where Mra: \"M ra = Some Mra\" by blast\n with assms(2) have \"Mra \\ enat Cost_ub\" by (meson ranI)\n with Mra ineq have \"Some (enat Ca) \\ Some (enat Cost_ub)\" \n using dual_order.trans by fastforce \n then have ie: \"Ca \\ Cost_ub\" by auto\n\n have pr: \"(n - Cost_ub + Ca - t) = (n - t) - (Cost_ub - Ca)\" using ie ii nf by auto\n have pl: \"(n - (t + (Cost_ub - Ca)) + (Cost_ub - Ca)) = n-t\" using ii nf by auto\n\n have \"pHeap (the \\) (new_addrs h as (the \\) \\ {}) ((n - t) - (Cost_ub - Ca) + (Cost_ub - Ca)) \\ \\' * R ra r * true * true\"\n apply(rule mod_star_convI) apply simp\n apply(rule i[unfolded pr]) by (simp add: top_assn_rule)\n\n then have H: \"pHeap (the \\) (new_addrs h as (the \\)) (n - t) \\ \\' * R ra r * true * true\"\n by (simp add: pl) \n\n have \"pHeap (the \\) (new_addrs h as (the \\)) (n - t) \\ \\' * R ra r * \\ (ra \\ dom M) * true\"\n apply(rule entailsD[OF _ H]) using radom by auto2 \n then have \"\\ra. pHeap (the \\) (new_addrs h as (the \\)) (n - t) \\ \\' * R ra r * \\ (ra \\ dom M) * true\"\n by blast\n then have H': \"pHeap (the \\) (new_addrs h as (the \\)) (n - t) \\ (\\\\<^sub>Ara. \\' * R ra r * \\ (ra \\ dom M) * true)\"\n using mod_ex_dist by blast\n have H: \"pHeap (the \\) (new_addrs h as (the \\)) (n - t) \\ \\' * (\\\\<^sub>Ara. R ra r * \\ (ra \\ dom M)) * true\" \n apply(rule entailsD[OF _ H']) by auto2\n\n from ii ie nf have T: \"t \\ n \" by auto\n\n show ?case\n apply safe\n subgoal using F by auto\n subgoal using H by simp \n subgoal by fact\n apply fact apply fact done\nqed \n\n\n\nlemma r: \"ran (\\v. if M v then Some (t v) else None) = {t v |v. M v}\"\n by (auto simp: ran_is_image domIff split: if_splits) \n\nlemma d: \"ra \\ dom (\\v. if M v then Some (t v) else None) \\ M ra\" \n unfolding domIff by (auto) \n \nlemma extract_cost_ub_SPEC: \"hn_refine \\ c \\' R (SPEC M t) \\ (\\c. M c \\ t c \\ enat Cost_ub) \\ <\\ * timeCredit_assn Cost_ub> c <\\r. \\' * (\\\\<^sub>Ara. R ra r * \\ (M ra))>\\<^sub>t\"\n unfolding SPEC_def\n apply(drule extract_cost_ub[where Cost_ub=Cost_ub])\n by (auto simp: r d)\n\n\nlemma hnr_hoare_triple_SPEC_conv: \"hn_refine \\ c \\' R (SPEC P (\\_. t)) = <\\ * timeCredit_assn t> c <\\r. \\' * (\\\\<^sub>Ara. R ra r * \\ (P ra))>\\<^sub>t\"\n apply(rule)\n subgoal apply(rule extract_cost_ub_SPEC) by auto \n subgoal unfolding SPEC_def apply(rule extract_cost_otherway[where Cost_lb=\"t\" and F=\"emp\"])\n defer apply assumption apply (auto split: if_splits simp: domIff)[]\n apply solve_entails\napply (auto split: if_splits simp: domIff)[]\n by(auto split: if_splits simp: ran_def) \n done\n\n\n\n\nlemma post_rulet:\n \"

f \\<^sub>t \\ \\x. Q x \\\\<^sub>A R x * true \\

f \\<^sub>t\"\n apply(rule post_rule[where Q=\"\\x. Q x * true\"])\n apply auto apply(rule ent_true_drop(1)) by simp\n\n lemma ht_cons_rule:\n assumes CPRE: \"P \\\\<^sub>A P'\"\n assumes CPOST: \"\\x. Q x \\\\<^sub>A Q' x\"\n assumes R: \" c \"\n shows \"

c \" apply(rule cons_post_rule[OF _ CPOST])\n by(rule pre_rule[OF CPRE R]) \n\n\nlemma extract_cost_ub':\n assumes \"hn_refine \\ c \\' R (REST M)\" \"(\\c. c\\ran M \\ c \\ Cost_ub)\"\n and pre: \"P \\\\<^sub>A \\ * timeCredit_assn Cost_ub\"\n and post: \"\\r. \\' * (\\\\<^sub>Ara. R ra r * \\(ra \\ dom M)) \\\\<^sub>A Q r * true\"\n shows \"

c \\<^sub>t\"\n apply(rule pre_rule[OF pre])\n apply(rule post_rulet[OF _ post]) \n apply(rule extract_cost_ub) by fact+\n \n\nlemma hn_refineI: \n shows \"tt = enat ttt ==> <\\ * timeCredit_assn ttt> C <\\r. \\' * RR ra r>\\<^sub>t \\ hn_refine \\ C \\' RR (SPECT [ra \\ tt])\"\n apply(rule extract_cost_otherway[where F=emp and Cost_lb=ttt and G=\" \\ * timeCredit_assn ttt\"]) \n apply solve_entails apply simp apply simp apply solve_entails by simp\nlemma RETURNT_SPECT_conv: \"RETURNT r = SPECT [r \\ 0]\" unfolding RETURNT_def by auto\nlemma hn_refineI0: \n shows \"<\\> C <\\r. \\' * RR ra r>\\<^sub>t \\ hn_refine \\ C \\' RR (RETURNT ra)\"\n unfolding RETURNT_SPECT_conv\n apply(rule extract_cost_otherway[where F=emp and Cost_lb=0 and G=\" \\ * timeCredit_assn 0\"]) \n apply solve_entails apply (simp add: zero_time) apply simp apply solve_entails by (simp add: zero_enat_def)\n\n \nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/Sepref_Additional.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2857051938559796}} {"text": "section \\Implementation of Heaps with Arrays\\\ntheory IICF_Impl_Heap\nimports \n IICF_Abs_Heap \n \"../IICF_Array\" \n \"../IICF_Array_List\" \nbegin\n\n (* TODO: Move *)\n \n term al_assn\n\n (* TODO: Move *) \n lemma size_mset_param[param]: \"(size,size)\\\\A\\mset_rel \\ nat_rel\" \n by (auto simp: mset_rel_def p2rel_def rel_mset_size)\n \n\n (* TODO: Move *)\n lemma rdomp_ref_mk_assn_iff[simp]: \"rdomp \\(mk_assn A) = rdomp A\"\n by (auto simp: rdomp_def)\n \n thm vcg_prep_ext_rules \n \n find_theorems pure_part \n \n lemma rdomp_arl_assn_len:\n assumes \"rdomp \\(arl_assn:: ('a::llvm_rep list, 'l::len2 word \\ 'l word \\ 'a ptr) dr_assn) xs\"\n shows \"length xs < max_snat LENGTH('l)\"\n using assms\n by (auto \n simp: rdomp_def arl_assn_def arl_assn'_def sep_algebra_simps pred_lift_extract_simps\n simp: snat.assn_def\n )\n\n find_theorems vassn_tag hn_refine\n\n \n (* TODO: Very specialized workaround lemma, to work around invalid-recombination\n problem for case that B is pure \n *) \n lemma workaround_invalid_recombine_pure2: \"is_pure B \\ hn_ctxt (invalid_assn A \\\\<^sub>a B) ax px \\ hn_invalid (A \\\\<^sub>a B) ax px\"\n unfolding hn_ctxt_def invalid_assn_def prod_assn_def entails_def\n by (auto split: prod.split elim!: is_pureE \n simp: sep_algebra_simps pure_part_pure_conj_eq)\n argo\n \n (* TODO: Move\n TODO: Should be generic algorithm!\n *) \n lemma mop_list_swap_unfold: \"mop_list_swap xs i j = do {\n xi \\ mop_list_get xs i;\n xj \\ mop_list_get xs j;\n xs \\ mop_list_set xs i xj;\n mop_list_set xs j xi\n }\"\n by (auto simp: pw_eq_iff refine_pw_simps swap_def)\n \n \n\n\n text \\We implement the heap data structure by an array.\n The implementation is automatically synthesized by the Sepref-tool.\n \\\n subsection \\Setup of the Sepref-Tool\\\n\n (* TODO: Move *)\n lemma mset_rel_id: \"\\Id\\mset_rel = Id\"\n unfolding mset_rel_def apply (simp add: rel2p multiset.rel_eq)\n by (simp only: p2rel)\n \n \n locale heap_impl = heapstruct prio for prio :: \"'e \\ 'p::linorder\" +\n fixes prio_assn :: \"'p \\ 'pi::llvm_rep \\ assn\"\n and elem_assn :: \"'e \\ 'ei::llvm_rep \\ assn\"\n and prio_impl le_prio_impl lt_prio_impl\n and ltype :: \"'l::len2 itself\"\n assumes prio_is_pure[safe_constraint_rules]: \"is_pure prio_assn\"\n assumes elem_is_pure[safe_constraint_rules]: \"is_pure elem_assn\" \n assumes prio_impl_refine[sepref_fr_rules]: \"(prio_impl, RETURN o prio)\\elem_assn\\<^sup>k \\\\<^sub>a prio_assn\"\n assumes le_prio_impl_refine[sepref_fr_rules]: \n \"(uncurry le_prio_impl, uncurry (RETURN oo (\\))) \\ prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n assumes lt_prio_impl_refine[sepref_fr_rules]: \n \"(uncurry lt_prio_impl, uncurry (RETURN oo (<))) \\ prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n \n fixes N defines \"N\\LENGTH('l)\"\n (*assumes l_len[simp,arith]: \"4 < LENGTH('l)\"*)\n begin\n \n abbreviation \"assn \\ al_assn' TYPE('l) elem_assn\"\n abbreviation \"idx_assn \\ snat_assn' TYPE('l)\"\n definition \"heap_assn \\ hr_comp (al_assn elem_assn) heap_rel1\"\n\n lemma mk_free_heap_assn[sepref_frame_free_rules]: \"MK_FREE heap_assn arl_free\"\n unfolding heap_assn_def\n by (rule sepref_frame_free_rules)+\n \n (*context\n assumes l_len_pre: \"(4 < LENGTH('l))\"\n begin \n private lemma l_len: \"4 < LENGTH('l)\" using l_len_pre unfolding vcg_tag_defs by auto\n *) \n \n sepref_register prio\n \n sepref_register \"(\\) :: 'p \\ 'p \\ bool\"\n sepref_register \"(<) :: 'p \\ 'p \\ bool\"\n \n lemmas [sepref_frame_free_rules] = \n mk_free_is_pure[OF prio_is_pure]\n mk_free_is_pure[OF elem_is_pure]\n \n sepref_register update_op\n sepref_definition update_impl is \"uncurry2 update_op\" \n :: \"assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k \\\\<^sub>a assn\"\n unfolding update_op_def[abs_def]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = update_impl.refine\n \n sepref_register val_of_op\n sepref_definition val_of_impl is \"uncurry val_of_op\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\\\<^sub>a elem_assn\"\n unfolding val_of_op_def[abs_def]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = val_of_impl.refine\n \n sepref_register exch_op\n sepref_definition exch_impl is \"uncurry2 exch_op\" :: \"assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\\\<^sub>a assn\"\n unfolding exch_op_def[abs_def] mop_list_swap_unfold\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n \n lemmas [sepref_fr_rules] = exch_impl.refine\n \n sepref_register valid\n sepref_definition valid_impl is \"uncurry (RETURN oo valid)\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n unfolding valid_def[abs_def]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = valid_impl.refine\n \n sepref_register prio_of_op \n sepref_definition prio_of_impl is \"uncurry (PR_CONST prio_of_op)\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\\\<^sub>a prio_assn\"\n unfolding prio_of_op_def[abs_def] PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = prio_of_impl.refine\n \n sepref_definition append_impl is \"uncurry mop_list_append\" \n :: \"[\\(xs,_). length xs + 1 < max_snat LENGTH('l)]\\<^sub>a assn\\<^sup>d *\\<^sub>a elem_assn\\<^sup>k \\ assn\"\n by sepref\n lemmas [sepref_fr_rules] = append_impl.refine \n \n sepref_register swim_op\n sepref_definition swim_impl is \n \"uncurry (PR_CONST swim_op)\" :: \"[\\_. 4a assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k \\ assn\"\n unfolding swim_op_def[abs_def] parent_def PR_CONST_def\n apply (annot_snat_const \"TYPE('l)\")\n (* TODO: Workaround/Hack *)\n supply [sepref_frame_match_rules] = workaround_invalid_recombine_pure2[where B=snat_assn, simplified]\n by sepref_dbg_keep\n \n lemmas [sepref_fr_rules] = swim_impl.refine\n \n \n lemma overflow_safe_hbound_check: \"2*k\\n \\ k\\n div 2\" for k n :: nat by auto\n \n (*lemma bound_aux1: \"rdomp assn xs \\ j\\length xs div 2 \\ 2*j < max_snat LENGTH('l)\" \n apply sepref_bounds*)\n\n (* \n lemma bound_aux2: \"\\rdomp assn a1'; 2 * a2' < length a1'\\ \n \\ Suc (2 * a2') < max_snat LENGTH('l)\" \n apply sepref_bounds\n apply (drule al_assn_len_bound)\n by auto\n *)\n \n sepref_register sink_op\n sepref_definition sink_impl is \"uncurry (PR_CONST sink_op)\" :: \"[\\_. 4a assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k \\ assn\"\n unfolding sink_op_opt_def[abs_def] sink_op_opt_eq[symmetric,abs_def] PR_CONST_def\n unfolding overflow_safe_hbound_check Suc_eq_plus1\n (* TODO: Workaround/Hack *)\n supply [sepref_frame_match_rules] = workaround_invalid_recombine_pure2[where B=snat_assn, simplified]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n \n lemmas [sepref_fr_rules] = sink_impl.refine\n \n \n lemma prenorm_heaprel1_len: \"(h,m)\\heap_rel1 \\ length h = size m\"\n unfolding heap_rel1_def in_br_conv\n by auto\n lemma max_snat_param: \"(max_snat,max_snat)\\nat_rel \\ nat_rel\" by simp\n\n context\n notes [fcomp_norm_unfold] = heap_assn_def[symmetric] list_rel_id_simp mset_rel_id\n notes [fcomp_prenorm_simps] = prenorm_heaprel1_len\n notes [param] = IdI[of N] max_snat_param\n begin \n \n sepref_definition empty_impl is \"uncurry0 empty_op\" :: \"[\\_. 4a unit_assn\\<^sup>k \\ assn\"\n unfolding empty_op_def N_def\n apply (rewrite al_fold_custom_empty[where 'l='l])\n by sepref\n sepref_decl_impl (no_register) heap_empty: empty_impl.refine[FCOMP empty_op_refine] \n uses op_mset_empty.fref[of Id] .\n \n sepref_definition is_empty_impl is \"is_empty_op\" :: \"assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n unfolding is_empty_op_def[abs_def]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n sepref_decl_impl heap_is_empty: is_empty_impl.refine[FCOMP is_empty_op_refine] \n uses op_mset_is_empty.fref[of Id] . \n \n sepref_definition insert_impl\n is \"uncurry insert_op\" :: \"[\\(_,xs). 4 length xs+1 < max_snat N]\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a assn\\<^sup>d \\ assn\"\n unfolding insert_op_def[abs_def] append_op_def N_def\n by sepref\n sepref_decl_impl heap_insert: insert_impl.refine[FCOMP insert_op_refine] \n uses op_mset_insert.fref[of Id] .\n \n sepref_definition pop_min_impl is \"pop_min_op\" :: \"[\\_. 4a assn\\<^sup>d \\ elem_assn \\\\<^sub>a assn\"\n unfolding pop_min_op_def[abs_def] butlast_op_def N_def\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n sepref_decl_impl (no_mop) heap_pop_min: pop_min_impl.refine[FCOMP pop_min_op_refine] \n uses op_prio_pop_min.fref[of Id] .\n \n \n \n sepref_definition peek_min_impl is \"peek_min_op\" :: \"assn\\<^sup>k \\\\<^sub>a elem_assn\"\n unfolding peek_min_op_def[abs_def]\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n sepref_decl_impl (no_mop) heap_peek_min: peek_min_impl.refine[FCOMP peek_min_op_refine] \n uses op_prio_peek_min.fref[of Id] .\n \n end\n (*end *)\n\n end \n \n\n global_interpretation heap_impl id snat_assn snat_assn return ll_icmp_sle ll_icmp_slt \"TYPE('l::len2)\" \"LENGTH('l)\"\n defines h_update_impl = update_impl\n and h_val_of_impl = val_of_impl\n and h_exch_impl = exch_impl\n and h_valid_impl = valid_impl\n and h_prio_of_impl = prio_of_impl\n and h_append_impl = append_impl\n and h_swim_impl = swim_impl\n and h_sink_impl = sink_impl\n and h_empty_impl = empty_impl\n and h_is_empty_impl = is_empty_impl\n and h_insert_impl = insert_impl\n and h_pop_min_impl = pop_min_impl\n and h_peek_min_impl = peek_min_impl\n \n apply unfold_locales\n apply (rule pure_pure)\n apply sepref\n apply sepref\n apply sepref\n apply simp\n done\n\n \n lemmas heap_impl_inlines = \n heap_impl.valid_impl_def[OF heap_impl_axioms] \n heap_impl.prio_of_impl_def[OF heap_impl_axioms]\n heap_impl.val_of_impl_def[OF heap_impl_axioms]\n heap_impl.append_impl_def[OF heap_impl_axioms]\n heap_impl.exch_impl_def[OF heap_impl_axioms]\n heap_impl.empty_impl_def[OF heap_impl_axioms]\n heap_impl.is_empty_impl_def[OF heap_impl_axioms]\n heap_impl.insert_impl_def[OF heap_impl_axioms]\n heap_impl.pop_min_impl_def[OF heap_impl_axioms]\n heap_impl.peek_min_impl_def[OF heap_impl_axioms]\n \n h_swim_impl_def[symmetric]\n h_sink_impl_def[symmetric]\n \n lemmas [llvm_inline] = update_impl_def \n lemmas [llvm_inline] = val_of_impl_def \n lemmas [llvm_inline] = exch_impl_def \n lemmas [llvm_inline] = h_valid_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_prio_of_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_append_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_code] = h_swim_impl_def[unfolded heap_impl.swim_impl_def[OF heap_impl_axioms], unfolded heap_impl_inlines]\n lemmas [llvm_code] = h_sink_impl_def[unfolded heap_impl.sink_impl_def[OF heap_impl_axioms], unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_empty_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_is_empty_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_insert_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_pop_min_impl_def[unfolded heap_impl_inlines]\n lemmas [llvm_inline] = h_peek_min_impl_def[unfolded heap_impl_inlines]\n \n definition [simp]: \"op_heap_custom_empty (_::'a::len2 itself) (_::'l::len2 itself) \\ op_mset_empty\"\n context fixes Q T :: \"_::len2 itself\" begin sepref_register \"op_heap_custom_empty Q T\" end\n \n lemma op_heap_custom_empty_hnr[sepref_fr_rules]:\n shows \"(\n uncurry0 (empty_impl::('a::len2 word,'l)array_list llM ), \n uncurry0 (RETURN (PR_CONST (op_heap_custom_empty TYPE('a) TYPE('l))))) \\ [\\_. 4a unit_assn\\<^sup>k \\ heap_assn\"\n unfolding op_heap_custom_empty_def PR_CONST_def\n by (rule heap_empty_hnr[unfolded PRECOND_def])\n \n lemma heap_fold_custom_empty: \n \"{#} = op_heap_custom_empty TYPE('a::len2) TYPE('l::len2)\"\n \"op_mset_empty = op_heap_custom_empty TYPE('a::len2) TYPE('l::len2)\"\n \"mop_mset_empty = RETURN (op_heap_custom_empty TYPE('a::len2) TYPE('l::len2))\"\n by auto\n \n \n \n \n \ndefinition \"sort_by_prio l\\<^sub>0 \\ do {\n q \\ nfoldli l\\<^sub>0 (\\_. True) (\\x q. do { ASSERT (size q < length l\\<^sub>0); mop_mset_insert x q }) {#};\n ASSERT (q = mset l\\<^sub>0);\n (l,q) \\ WHILEIT (\\(l,q). sorted l \\ (\\x\\set l. \\y\\#q. x\\y) \\ mset l + q = mset l\\<^sub>0) \n (\\(l,q). \\op_mset_is_empty q) (\\(l,q). \n do {\n (x,q) \\ mop_prio_pop_min id q;\n ASSERT (size l < length l\\<^sub>0);\n RETURN (l@[x],q)\n }) (op_list_empty,q);\n RETURN l\n}\"\n\nlemma sort_by_prio_correct: \"sort_by_prio l \\ SPEC (\\l'. sorted l' \\ mset l' = mset l)\"\n unfolding sort_by_prio_def mop_prio_pop_min_def\n \n apply (refine_vcg \n nfoldli_rule[where I=\"\\ll _ q. q = mset ll\"]\n WHILEIT_rule[where R=\"measure (\\(l,q). size q)\"]\n )\n apply (auto 0 3 dest: in_diffD simp: size_Diff1_less sorted_append_bigger)\n subgoal by (metis add_cancel_right_right le_add1 nat_less_le size_eq_0_iff_empty size_mset size_union) \n subgoal by (metis insert_DiffM union_iff) \n done\n \n\n\n(* TODO: Move *)\nfunction list_intv_induction where\n \"list_intv_induction l u = (if l(l,u). u-l)\")\n by auto\n \n \n(* \nlemma nfoldli_range_to_while: \"nfoldli [l.. = do {\n (_,\\) \\ WHILET \n (\\(i,\\). i c \\) \n (\\(i,\\). do { \\ \\ f i \\; ASSERT (i) })\n (l,\\);\n RETURN \\\n }\"\nproof (induction l u arbitrary: \\ rule: list_intv_induction.induct)\n case (1 l u)\n show ?case proof (cases \"ll. length l < max_snat LENGTH(64)]\\<^sub>a (al_assn' TYPE(64) (snat_assn' TYPE(64)))\\<^sup>k \\ al_assn' TYPE(64) (snat_assn' TYPE(64))\"\n unfolding sort_by_prio_def[abs_def] \n apply (rewrite nfoldli_by_idx)\n apply (rewrite nfoldli_upt_by_while)\n apply (rewrite heap_fold_custom_empty[where 'l=64 and 'a=\"64\"])\n apply (rewrite at op_list_empty al_fold_custom_empty[where 'l=64])\n apply (annot_snat_const \"TYPE(64)\")\n by sepref\n\n \n \nexport_llvm (no_header)\n sort_impl is \"sort\" \n \"arl_new_raw :: (64 word,64) array_list llM\" is \"arl_new\"\n \"arl_push_back :: _ \\ _ \\ (64 word,64) array_list llM\" is \"arl_push_back\"\n file \"sort.ll\"\n (* CAREFUL: The calling conventions generated by this LLVM code are hard/impossible to \n interface from C !? *)\n \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/IICF/Impl/Heaps/IICF_Impl_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.28569518523107806}} {"text": "theory ringBufFifoModi imports paraGste1\nbegin\nabbreviation rst::\"expType\" where\n\"rst \\ IVar (Ident ''rst'')\"\n\nabbreviation push::\"expType\" where\n\"push \\ IVar (Ident ''push'')\"\n\nabbreviation pop::\"expType\" where\n\"pop \\ IVar (Ident ''pop'')\"\n\nabbreviation dataIn::\"expType\" where\n\"dataIn \\ IVar (Ident ''dataIn'' )\"\n\n\n\nabbreviation LOW::\"expType\" where\n\"LOW \\ Const (boolV False)\"\nabbreviation HIGH::\"expType\" where\n\" HIGH \\ Const (boolV True)\"\n\nabbreviation emptyFifo::\"expType\" where\n\" emptyFifo \\ IVar (Ident ''empty'' ) \"\n\nabbreviation tail::\"expType\" where\n\" tail \\ IVar (Ident ''tail'' ) \"\n\nabbreviation head::\"expType\" where\n\" head \\ IVar (Ident ''head'' ) \"\n\n\nabbreviation full::\"expType\" where\n\" full \\ IVar (Ident ''full'' ) \"\n\ndefinition fullForm::\"formula\" where [simp]:\n\" fullForm \\ eqn full HIGH \"\n\nabbreviation mem::\"varType\" where\n\"mem \\ ( (Ident ''mem'') )\"\n\ntype_synonym paraExpType=\"nat \\expType\"\n\n \n\nabbreviation dataOut::\"nat\\expType\" where\n\"dataOut DEPTH \\ read (Ident ''mem'') DEPTH (IVar (Ident ''head'' ))\"\n\n\nabbreviation rstForm::\"formula\" where\n\"rstForm \\ (eqn rst HIGH)\"\n\nabbreviation emptyForm::\"formula\" where\n\"emptyForm \\ (eqn emptyFifo HIGH)\"\n \nabbreviation pushForm::\"formula\" where\n\"pushForm \\ andForm (andForm (eqn rst LOW) (eqn push HIGH)) (eqn pop LOW)\"\n\nabbreviation popForm::\"formula\" where\n\"popForm \\ andForm (andForm (eqn rst LOW) (eqn push LOW)) (eqn pop HIGH)\"\n\nabbreviation nPushPopForm::\"formula\" where\n\"nPushPopForm \\ andForm (andForm (eqn rst LOW) (eqn push LOW)) (eqn pop LOW)\"\n\nabbreviation pushDataForm::\"nat \\formula\" where\n\" pushDataForm D \\andForm pushForm (eqn dataIn (Const (index D)))\"\n\nabbreviation popDataForm::\"nat\\nat \\formula\" where\n\" popDataForm DEPTH D \\ (eqn (dataOut DEPTH) (Const (index D)))\"\n \nabbreviation nFullForm::\"formula\" where\n\"nFullForm \\ neg (fullForm )\"\n\nabbreviation nEmptyForm::\"formula\" where\n\"nEmptyForm \\ neg emptyForm \"\n\n\n\ndefinition vertexI::\"node\" where [simp]:\n\"vertexI \\Vertex 0\"\n\n(*DEPTH=LAST + 1*)\ndefinition vertexL::\"nat \\ node list\" where [simp]:\n\"vertexL LAST \\ vertexI # (map (%i. Vertex i) (down LAST))\"\n\ndefinition edgeL::\"nat \\ edge list\" where [simp]:\n \"edgeL LAST \\ [Edge vertexI ( Vertex 1)]\n @ [Edge ( Vertex 1) ( Vertex 3)]\t\t\n @ [Edge ( Vertex 1) ( Vertex 4)]\t\n \n\t\t@(map (%i. ( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) (upt 0 (LAST+2) )) (* self-loop*) \n\t @(map (%i. ( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) (upt 1 (LAST+2) )) (* self-loop*) \n\t \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) ( upt 1 (LAST+1)))\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) ( upt 1 (LAST+1)))\n\t\t\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) ( upt 0 (LAST+1) )) \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 4)) (Vertex (2 * i +2 ))) ) ( upt 1 (LAST+1) ))\n\t\t@[ Edge (Vertex 4) (Vertex 1)]\n\t \"\n\n\n(*\nedgeL LAST \\ [Edge vertexI ( Vertex 1)]\n @ [Edge ( Vertex 1) ( Vertex 3)]\t\t\n @ [Edge ( Vertex 1) ( Vertex 4)]\t\n \n\t\t@(map (%i. ( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) (upt 0 (LAST+2) )) (* self-loop*) \n\t @(map (%i. ( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) (upt 1 (LAST+2) )) (* self-loop*) \n\t \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) ( upt 1 (LAST+1)))\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) ( upt 1 (LAST+1)))\n\t\t\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) ( upt 0 (LAST+1) )) \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 4)) (Vertex (2 * i + 2))) ) ( upt 1 (LAST+1) ))\n\t\t@[Edge ( Vertex 4) ( Vertex 1)]\n;*)\nprimrec node2Nat::\"node \\ nat\" where\n\"node2Nat (Vertex n) = n\"\n\n\ndefinition antOfRbFifo::\"nat\\edge\\formula\" where [simp]:\n\"antOfRbFifo D edge\\\n (let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n ( if (\tfrom = 0) then rstForm\telse\n if (from=to) then nPushPopForm else\n ( if ((from mod 2) =1) then\n (\n if ((from + 2)=to) then ( pushForm ) else\n if (from=(to + 2)) then popForm else\n pushDataForm D ) else \n popForm)))\"\n\n\n(*definition antOfRbFifo::\"nat\\edge\\formula\" where [simp]:\n\"antOfRbFifo D edge\\\n (let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if (from = 0) then rstForm\telse\n if (from=to) then nPushPopForm else\n (if ((from mod 2) =1) then\n (\n if ((from + 2)=to) then ( pushForm ) else\n if (from=(to + 2)) then popForm else\n pushDataForm D ) \n else popForm))\"\n\n\n\ndefinition consOfRbFifo::\"nat\\nat\\edge \\formula\" where [simp]:\n\"consOfRbFifo D LAST edge \\\n(let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if \t(((from mod 2) = 1) \\ ((to mod 2) = 1)) then\n (if from =1 then (andForm emptyForm (nFullForm LAST))\n else if (from = (2*LAST+3)) then (andForm nEmptyForm (fullForm LAST)) \n else andForm nEmptyForm (nFullForm LAST))\n else if (from=4 \\ to = 1) then popDataForm LAST D\n else if (from = (2*LAST+4)) then (andForm nEmptyForm (fullForm LAST)) \n else if (from =1 ) then (andForm emptyForm (nFullForm LAST))\n else if (from \\0) then (andForm nEmptyForm (nFullForm LAST))\n else chaos)\"\n\nlet cons aEdge = \n\tval (Edge (Vertex from) (Vertex to)) = aEdge\nin\n\t((from%2) = 1) AND ((to%2) = 1) => \t\t\t\t\n\t\t(from = 1) => TAndList [empty,nFull]\t\t//FIFO is empty\n\t|\t(from = (2*DEPTH+1)) => TAndList [nEmpty,full]\t//FIFO is full\n\t|\tTAndList [nEmpty,nFull]\t\t\t\t\t//FIFO of other size\n|\t(to = 2) => popData vOfDataIn\t\t\t\t\t//read the write data\n| \tTAndList []\n;*)\n\ndefinition consOfRbFifo::\"nat\\nat\\edge \\formula\" where [simp]:\n\"consOfRbFifo D LAST edge \\\nlet from=node2Nat (source edge) in\nlet to=node2Nat (sink edge) in\n (if \t(((from mod 2) = 1) \\ ((to mod 2) = 1)) then\n (if from =1 then (andForm emptyForm (nFullForm))\n else if (from = (2*LAST+3)) then (andForm nEmptyForm (fullForm )) \n else andForm nEmptyForm (nFullForm ))\n else if (from=4 \\ to = 1) then popDataForm LAST D\n else if (from = (2*LAST+4)) then (andForm nEmptyForm (fullForm)) \n else if (from =1 ) then (andForm emptyForm (nFullForm ))\n else if (from \\0) then (andForm nEmptyForm (nFullForm))\n else chaos)\"\n\ndefinition rbFifoGsteSpec::\" nat\\nat\\gsteSpec\" where [simp]:\n\"rbFifoGsteSpec LAST data\\Graph vertexI (edgeL LAST ) (antOfRbFifo data ) (consOfRbFifo data LAST)\"\n\nprimrec applyPlusN::\"expType\\nat \\expType\" where\n\"applyPlusN e 0=e\" |\n\"applyPlusN e (Suc N) = uif ''+'' [applyPlusN e N, Const (index 1)]\"\n\ndefinition tagFunOfRingBufFifo:: \" nat\\nat\\nodeTagFuncList\" where [simp]:\n\"tagFunOfRingBufFifo DATA LAST n \\ \n let x=node2Nat n in\n let DataE=(Const (index DATA)) in\n let LASTE=(Const (index LAST)) in\n let TwiceLASTPlus3=(Const (index (2*LAST +3))) in\n let tailPlus=uif ''+'' [tail, (Const (index 1))] in\n let headPlus=uif ''+'' [head, (Const (index 1))] in\n if (x = 0) then [] else\n (if ((x mod 2) = 1) then \n (if (x =1) then \n [eqn tail head, eqn emptyFifo HIGH,\n eqn full LOW,uip ''le'' [head,LASTE]]\n else \n (if (x=2*LAST+3) then \n [eqn tail (applyPlusN head (x div 2 )), \n eqn emptyFifo LOW,\n (*eqn emptyFifo (iteForm (eqn tail headPlus) HIGH emptyFifo),\n eqn full (iteForm (eqn tailPlus head) HIGH full),*)\n eqn full HIGH,\n uip ''le'' [head,LASTE]\n ] \n else \n [eqn tail (applyPlusN head (x div 2 )), \n eqn emptyFifo LOW,\n eqn full LOW,uip ''le'' [head,LASTE]]\n (* eqn emptyFifo (iteForm (eqn tail headPlus) HIGH emptyFifo),\n eqn full (iteForm (eqn tailPlus head) HIGH full),*)\n (* uip ''le'' [head,LASTE]]*) ) )\n else \n ((*if (x = 2) then [] \n else *)\n (if (x=2*LAST+4) then \n [eqn tail (applyPlusN head (x div 2 - 1 ) ), \n eqn emptyFifo LOW, \n eqn full HIGH,uip ''le'' [head,LASTE],\n eqn (read mem LAST (applyPlusN head (x div 2 - 2))) DataE ] \n else \n [eqn tail (applyPlusN head (x div 2 - 1)), eqn emptyFifo LOW,\n eqn full LOW, uip ''le'' [head,LASTE],\n \n eqn (read mem LAST (applyPlusN head (x div 2 - 2))) DataE ]))\n )\n \n \"\n \n abbreviation branch1::\"generalizeStatement\" where \n\"branch1 \\ \n (let S1=assign (Ident ''head'',(Const (index 0))) in\n let S2=assign (Ident ''tail'',(Const (index 0))) in\n let S3=assign (Ident ''empty'',HIGH) in\n let S4=assign (Ident ''full'',LOW) in \n Parallel [S1,S2,S3,S4])\"\n \nabbreviation branch2::\"nat\\generalizeStatement\" where \n\"branch2 LAST \\ \n (let S1=map (\\i. assign ((Para (Ident ''mem'') i), \n iteForm (eqn tail (Const (index i))) dataIn \n (IVar (Para (Ident ''mem'') i)))) (down LAST ) in\n let tailPlus=uif ''+'' [tail, (Const (index 1))] in\n let S2=assign (Ident ''tail'', tailPlus ) in\n let S3=assign (Ident ''empty'',LOW) in\n let S4=assign (Ident ''full'',iteForm (eqn tailPlus head) HIGH full) in\n (* Parallel (S1@[S2,S3]))*)\n Parallel ([S2,S3,S4]@S1))\" \n \nabbreviation branch3::\"generalizeStatement\" where \n\"branch3 \\ \n (let headPlus=uif ''+'' [head, (Const (index 1))] in\n Parallel [\n assign (Ident ''empty'',iteForm (eqn tail headPlus) HIGH emptyFifo),\n assign (Ident ''full'', LOW),\n assign (Ident ''head'', headPlus)] )\n \" \n\n \nabbreviation ringBuffifo::\" nat\\generalizeStatement\" where\n\"ringBuffifo LAST\\ \n caseStatement \n [(eqn rst HIGH, branch1),\n (andForm (eqn push HIGH) (nFullForm), branch2 LAST),\n (andForm (eqn pop HIGH) (eqn emptyFifo LOW), branch3)] \n \"\n \n\nconsts J::\"nat \\ interpretFunType\" \n \naxiomatization where axiomOnIAdd [simp,intro]:\n\" J LAST ''+'' [index m, index (Suc 0)] = index ((m + 1) mod (Suc LAST ))\"\n(* (if m=LAST then (index 0) else (index (m +1 )))\"\nindex ((m + 1) mod (Suc LAST )) \" *)\n\naxiomatization where axiomOnLe [simp,intro]: \n\" J LAST ''le'' [index m, index n] = boolV (m \\ n)\" \n\naxiomatization where headIsIndex[simp,intro]:\"\\i. ((s (Ident ''head'') ) = (index i)) \"\n\n\n\nlemma test0: \"formEval (J LAST) (eqn (Var tail) (applyPlusN head i) ) s \\\nformEval (J LAST) (eqn (uif ''+'' [Var tail, Const (index 1)]) (applyPlusN head (i+1)) ) s\"\napply(auto) done\n\nlemma auxOnReadWrite[simp]:\n\"expEval I e s=expEval I e' s \\expEval I e s=index i\\ i\\ LAST \\(\\j. Para mem j \\set (varOfExp e'))\\ \n\n expEval I (substExp (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i, iteForm (eqn e (Const (index i))) e'' (IVar (Para mem i))))\n (down LAST)))\n s = expEval I e'' s \" (is \"?P LAST\")\nproof(induct_tac LAST) \n show \"?P 0\"\n proof(rule impI)+\n assume a1:\" expEval I e s = expEval I e' s \\ expEval I e s = index i \\ i \\ 0\" and \n a2:\" \\j. Para mem j \\ set (varOfExp e')\"\n have a3:\"(Para mem 0) \\ set (varOfExp e')\"\n by(cut_tac a2,auto)\n show \" expEval I\n (substExp (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down 0)))\n (map (\\i. (Para mem i, iteForm (eqn e (Const (index i))) e'' (IVar (Para mem i)))) (down 0)))\n s =\n expEval I e'' s\"\n using a1 a3 noEffectSubstExp proof(cut_tac a1,auto)qed\n qed\n next\n fix n\n assume a0: \"?P n\"\n show \"?P (Suc n)\"\n proof(rule impI)+\n assume a1:\" expEval I e s = expEval I e' s \\ expEval I e s = index i \\ i \\ Suc n\" and \n a2:\" \\j. Para mem j \\ set (varOfExp e')\"\n have a3:\"(Para mem (Suc n)) \\ set (varOfExp e')\"\n by(cut_tac a2,auto) \n show \"expEval I\n (substExp (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down (Suc n))))\n (map (\\i. (Para mem i, iteForm (eqn e (Const (index i))) e'' (IVar (Para mem i)))) (down (Suc n))))\n s =\n expEval I e'' s\" (is \"?LHS (Suc n) =?RHS\")\n proof(case_tac \"i \\ n\")\n assume b1:\"i \\ n\"\n have b2:\" (Para mem (Suc n)) \\ set (varOfExp\n (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down n))))\" \n apply(auto)\n apply (simp add: SucnIsNotInDownn)\n by (simp add: a3)\n \n have b3:\"?LHS (Suc n) =?LHS n\" \n using a1 a2 a3 b1 b2 by auto\n have b4:\"?LHS n = expEval I e'' s\"\n using a1 b1 a2 a0 apply auto done\n show \"?LHS (Suc n) =?RHS\"\n using b4 b3 by auto\n next\n assume b1:\"\\i \\ n\"\n have b2:\"i=Suc n\" \n using b1 a1 by auto\n show \"?LHS (Suc n) =?RHS\"\n using b1 b2 a1 a2 a3 apply auto done\n qed\nqed \nqed\n\nlemma caseExpCong:\n assumes a:\"tautlogy (eqn e e') I\"\n shows \"expEval I (caseExp (map (\\i. (eqn e (Const (index i)), IVar (Para mem i))) (down LAST))) s\n =expEval I (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down LAST))) s\"\nproof(induct_tac LAST,(cut_tac a,simp)+)qed\n\nlemma caseExpCong1:\n assumes a:\"formEval I (eqn e e') s \"\n shows \"expEval I (caseExp (map (\\i. (eqn e (Const (index i)), IVar (Para mem i))) (down LAST))) s\n =expEval I (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down LAST))) s\"\nproof(induct_tac LAST,(cut_tac a,simp)+)qed\n\nlemma readWrite[simp,intro!]:\nassumes a1:\"expEval I e s=expEval I e' s \" and a2:\"expEval I e s=index i\" and a3:\" i\\ LAST \" and\na2:\"(\\j. Para mem j \\set (varOfExp e'))\" \n\nshows \" expEval I (substExp (caseExp (map (\\i. (eqn e' (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i, iteForm (eqn e (Const (index i))) e'' (IVar (Para mem i))))\n (down LAST)))\n s = expEval I e'' s \"\nusing a2 a3 assms(2) auxOnReadWrite local.a1 by blast\n\n\n\nlemma varOfApplyPlus[simp]:\n \"varOfExp (applyPlusN head i) = [(Ident ''head'' )]\"\n apply(induct_tac i,auto) done\n \nlemma onApplyPlusI[simp]:\"i \\ LAST \\ \n j \\ LAST \\ s (Ident ''head'') = index j \\ \n expEval (J LAST) (applyPlusN head i) s = index ((j + i) mod (Suc LAST)) \"\n proof(induct_tac i,auto,arith) qed\n \nlemma onApplyPlusII[simp]:\"0i\\ LAST \\ \n j \\ LAST \\ s (Ident ''head'') = index j \\ \nexpEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (i - Suc 0)) s = index ((j + i) mod (Suc LAST))\" (is \"?P i\")\n proof(induct_tac i,simp,case_tac \"n=0\",simp) \n fix n\n assume a:\"?P n\" and b:\"~n=0\"\n show \"?P (Suc n)\"\n proof(rule impI)+\n assume c1:\"0< Suc n\" and c2:\"Suc n \\ LAST\" and c3:\"j \\ LAST\" and c4:\"s (Ident ''head'') = index j\"\n show \"\n expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (Suc n - Suc 0)) s = index ((j + Suc n) mod Suc LAST)\"\n (is \"?LHS =?RHS\")\n proof -\n have d1:\"0 LAST \\ (Suc j + (Suc LAST)) mod (Suc LAST) =Suc ((j + (Suc LAST)) mod (Suc LAST))\" (is \"?P j\")\nby (metis Divides.mod_less le_less_trans lessI less_trans mod_add_self2)\n \nlemma test3:\"j \\ LAST \\ (j + (Suc LAST)) mod (Suc LAST) =j\" (is \"?P j\")\nby (metis Divides.mod_less le_imp_less_Suc mod_add_self2)\n\n\nlemma test4[simp]:\"0i < Suc LAST \\ 0 < i \\\n j \\ LAST \\ ((j + i) mod (Suc LAST)) =\n (if (j+i)< (Suc LAST) then j+i else (j+i -(Suc LAST)))\" (is \"?P LAST\")\nusing le_mod_geq by force \n\nlemma test5Aux[simp]:\"0i < Suc LAST \\ 0 < i \\\n j \\ LAST \\ ((j + i) mod (Suc LAST)) \\ j\"\nusing nat_neq_iff not_less by auto \n\nlemma test5:\n assumes a1:\" 0 < LAST \" and a2:\" i < Suc LAST\" and a3:\" 0 < i \" and \n a4:\"j \\ LAST\"\n shows \" ((j + i) mod (Suc LAST)) \\ j\"\n using a1 a2 a3 a4 test5Aux by auto \n \n\n \nlemma iPlus1IsNotI:\n assumes a1:\"0 < LAST\" and \n a2:\"J LAST ''+'' [s (Ident ''head''), index (Suc 0)] = s (Ident ''head'')\" \n (*and *a3:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\"*)\n shows False\n proof -\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n (* have b2:\"i\\ LAST\"\n using a1 a3 b1 axiomOnLe apply auto done*)\n show False\n apply(cut_tac a1 a2 b1 ,case_tac \"i=LAST\",auto)\n by (metis mod_Suc mod_mod_trivial n_not_Suc_n nat.inject)\n \n qed \n\nlemma iPlusSucLatIsi: \n assumes a:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\"\n shows \"J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)]= s (Ident ''head'')\"\n proof -\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n have b2:\"i\\ LAST\"\n using a b1 axiomOnLe apply auto done\n show ?thesis\n apply(cut_tac b1 b2,simp)\n by (metis (full_types) Divides.mod_less add.commute add_Suc le_imp_less_Suc mod_Suc_eq_Suc_mod mod_add_self1)\nqed\n\nlemma iPlusjPLUSIsNotj:\n assumes a1:\"0 < LAST\" and a4:\"i < LAST\" and\n a3:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\"\n \n shows \"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)]\\s (Ident ''head'')\" \nproof -\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\"\n using a1 a3 b1 axiomOnLe apply auto done\n have b3: \"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =index ((j + Suc i) mod (Suc LAST))\"\n by (metis Suc_eq_plus1 a4 b1 b2 discrete le_Suc_eq onApplyPlusI test1)\n \n have b4:\"Suc i< Suc LAST\"\n by (simp add: a4) thm test5\n have b5:\"((j + (Suc i)) mod (Suc LAST)) \\j\" \n apply (cut_tac a1 b2 b4 ,rule test5,auto) \n done\n with b3 show \"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] \\ s (Ident ''head'')\"\n by (simp add: b1)\n \nqed\nlemma substApplyHead[simp]:\n \"substExp (applyPlusN head n) [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])] =\n applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) n\"\nproof(induct_tac n,auto)qed \n\nlemma applyIPlusIsPlusI:\n\"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =\n expEval (J LAST) (substExp (applyPlusN head i) \n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])]) s\"\nproof(induct_tac i,auto)qed\n\nlemma substCaseExp:\n \"substExp\n (caseExp\n (map (\\i. (g i,e i)) (down LAST)))\n subst0 =\n caseExp\n (map (\\i. (substForm (g i) subst0, substExp (e i) subst0))\n (down LAST))\" (is \"?P LAST\")\nproof(induct_tac LAST,simp)\n fix n\n assume b:\"?P n\"\n show \"?P (Suc n)\" (is \"substExp (?caseExp (Suc n)) subst0= caseExp (?list (Suc n))\")\n proof -\n have c1:\"substExp (?caseExp (Suc n)) subst0=\n substExp (caseExp ((g (Suc n), e (Suc n))#(map (\\i. (g i,e i)) (down n)))) subst0\" (is \"?LHS =?RHS1\")\n apply (simp only:downSuc ,auto) done\n have c2:\"?RHS1 =iteForm (substForm (g (Suc n)) subst0) (substExp (e (Suc n)) subst0) (caseExp (?list n))\"\n (is \"?RHS1=?RHS2\")\n by (simp add: b)\n have c3:\"?RHS2=caseExp ((substForm (g (Suc n)) subst0,substExp (e (Suc n)) subst0)#(?list n))\"\n (is \"?RHS2=?RHS3\")\n by(simp )\n have c4:\"?RHS3=caseExp (?list (Suc n))\"\n by simp\n with c1 c2 c3 show \"?P (Suc n)\" \n by presburger\n qed\nqed\n\n\n \nlemma substCaseExp1:\n \"substExp\n (caseExp\n (map (\\i. (eqn (applyPlusN head (j - Suc 0)) (Const (index i)), IVar (Para mem i))) (down LAST)))\n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])] =\n caseExp\n (map (\\i. (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (j - Suc 0)) (Const (index i)), IVar (Para mem i)))\n (down LAST))\" (is \"?P LAST\")\nusing substCaseExp by auto\n \nlemma consistencyOfRbfifo0:\n assumes a:\"LAST=0 \"\n shows \"consistent' (ringBuffifo LAST ) (J LAST) (rbFifoGsteSpec LAST data) \n (tagFunOfRingBufFifo data LAST)\"\n proof(unfold consistent'_def,rule allI,rule impI)\n fix e\n let ?G=\" (rbFifoGsteSpec LAST data)\"\n let ?M=\"(ringBuffifo LAST )\"\n let ?tag=\"(tagFunOfRingBufFifo data LAST)\"\n let ?P =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f ( ?M))) (J LAST))\"\n \n assume a1:\"e \\ edgesOf (rbFifoGsteSpec LAST data)\"\n \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex 1) ( Vertex 3) |\n e=Edge ( Vertex 1) ( Vertex 4)|\n (\\i. 0\\i \\ i\\ LAST + 1 \\ e=( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) |\n (\\i. 1\\i \\ i\\ LAST + 1 \\ e=( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) |\n \n e=Edge ( Vertex 3) ( Vertex 1) |\n e=Edge (Vertex 4) (Vertex 1)\"\n apply(cut_tac a a1,auto) done\n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac b1, simp add:antOfRbFifo_def)\n done\n }\n moreover\n {assume b1:\" (\\i. 0\\i \\ i\\ LAST +1 \\ e=( Edge (Vertex (2* i + 1)) (Vertex ( 2*i + 1))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n }\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 2)) (Vertex ( 2*i + 2))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n } \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 3) \"\n \n let ?P' =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f (branch2 LAST))) (J LAST))\"\n \n let ?P1=\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n let tailPlus=uif ''+'' [tail, (Const (index 1))] in\n let f1=andListForm [eqn tailPlus (applyPlusN head 1), eqn LOW LOW,\n eqn full LOW, uip ''le'' [head,LASTE]] in\n tautlogy (implyForm (andForm f' (antOf ?G e)) f1) (J LAST))\" \n have c1:\"?P e= ?P' e\"\n by (simp add: a b1 del:tautlogy_def,auto)\n \n \n (* have c2:\"?P' e=?P1 e\" \n apply (cut_tac a b1,simp del:tautlogy_def add:Let_def) \n apply(rule onIfExpPos)\n apply*)\n have \"?P e \"\n proof(cut_tac a b1,auto simp add:Let_def ) \n fix s\n assume c1:\"scalar2Bool (J 0 ''le'' [s (Ident ''head''), index 0]) \" and\n c2:\" J 0 ''+'' [s (Ident ''head''), index (Suc 0)] \\ s (Ident ''head'')\" \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n have b2:\"i=0\" \n using a c1 b1 axiomOnLe apply auto done\n show False\n apply(cut_tac b1 b2 c2 , auto) done\n \n qed\n \n }\n \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 4) \"\n let ?f=\"andForm (neg (eqn rst HIGH)) (andForm (eqn push HIGH) nFullForm ) \" \n have \"?P e \"\n proof(cut_tac a b1,auto simp add:Let_def)\n fix s::state\n assume c1:\"s (Ident ''head'') \\ index 0 \" and\n c2:\"scalar2Bool (J 0 ''le'' [s (Ident ''head''), index 0])\"\n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n have b2:\"i=0\" \n using a c2 b1 axiomOnLe apply auto done\n show False\n apply(cut_tac b1 b2 c1 , auto) done\n qed\n }\n moreover\n {assume b1:\"e=Edge ( Vertex 3) ( Vertex 1)\"\n \n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\"\n by simp \n have \"?P e\"\n proof(cut_tac a b1 b3,auto simp add:antOfRbFifo_def Let_def)\n fix s\n assume c1:\" scalar2Bool (J 0 ''le'' [s (Ident ''head''), index 0])\" \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n have b2:\"i=0\" \n using a c1 b1 axiomOnLe apply auto done\n show \"scalar2Bool (J 0 ''le'' [J 0 ''+'' [s (Ident ''head''), index (Suc 0)], index 0])\"\n apply(cut_tac b1 b2,auto)\n done\n qed\n }\n moreover\n {assume b1:\"e=Edge ( Vertex 4) ( Vertex 1)\"\n \n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\"\n by simp \n have \"?P e\"\n proof(cut_tac a b1 b3,auto simp add:antOfRbFifo_def Let_def)\n qed\n }\n ultimately show \"?P e\" by satx\nqed\n\nlemma consistencyOfRbfifo:\n assumes a:\"0 < LAST \"\n shows \"consistent' (ringBuffifo LAST ) (J LAST) (rbFifoGsteSpec LAST data) \n (tagFunOfRingBufFifo data LAST)\"\n proof(unfold consistent'_def,rule allI,rule impI)\n fix e\n let ?G=\" (rbFifoGsteSpec LAST data)\"\n let ?M=\"(ringBuffifo LAST )\"\n let ?tag=\"(tagFunOfRingBufFifo data LAST)\"\n let ?P =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f ( ?M))) (J LAST))\"\n \n assume a1:\"e \\ edgesOf (rbFifoGsteSpec LAST data)\"\n \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex 1) ( Vertex 3) |\n e=Edge ( Vertex 1) ( Vertex 4)|\n (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) |\n (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) |\n \n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) |\n \n (\\i. 0\\i \\ i\\ LAST \\ e= ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex(2 * i + 4)) (Vertex(2 *i+ 2))))|\n e=Edge (Vertex 4) (Vertex 1)\"\n apply(cut_tac a a1,auto) done\n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac b1, simp add:antOfRbFifo_def)\n done\n }\n moreover\n {assume b1:\" (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 1)) (Vertex ( 2*i + 1))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n }\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 2)) (Vertex ( 2*i + 2))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n } \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 3) \"\n \n let ?P' =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f (branch2 LAST))) (J LAST))\"\n \n let ?P1=\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n let tailPlus=uif ''+'' [tail, (Const (index 1))] in\n let f1=andListForm [eqn tailPlus (applyPlusN head 1), eqn LOW LOW,\n eqn full LOW, uip ''le'' [head,LASTE]] in\n tautlogy (implyForm (andForm f' (antOf ?G e)) f1) (J LAST))\" \n have c1:\"?P e= ?P' e\"\n by (simp add: a b1 del:tautlogy_def,auto)\n \n \n \n have \"?P e \"\n proof(cut_tac a b1,auto simp add:Let_def ) \n fix s\n assume c1:\"0 4\" apply(cut_tac a,arith) done\n have \"?P e \"\n proof(cut_tac a b1 b2,auto simp add:Let_def)\n fix s::state\n assume a1:\"0 i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain i where b1:\"((s (Ident ''head'') ) = (index i))\"\n by blast\n have b2:\"i\\ LAST\" \n using a1 a2 b1 axiomOnLe apply auto done\n have b3:\" \n expEval (J LAST)\n (substExp\n (caseExp (map (\\i. (eqn head (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i,\n iteForm (eqn tail (Const (index i))) dataIn (IVar (Para mem i))))\n (down LAST)))\n s =\n expEval (J LAST) dataIn s\" thm auxOnReadWrite \n using a1 a2 b1 b2 by auto \n show \"\n expEval (J LAST)\n (substExp\n (caseExp (map (\\i. (eqn head (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i,\n iteForm (eqn tail (Const (index i))) dataIn (IVar (Para mem i))))\n (down LAST)))\n s =\n index data\"\n using a3 b3 by auto\n qed \n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i \\LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i + 3))\" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have b2:\"i - 1 < LAST\" by(cut_tac a b1,auto)\n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\" by auto\n have \"i=LAST \\ i s (Ident ''head'')\" and\n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" \n \n have b1:\"J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)]= s (Ident ''head'')\" \n by (simp add: a2 iPlusSucLatIsi)\n with a1 b1 show False by auto \n qed\n }\n moreover\n {assume b4:\" i i \" and c2:\" i < LAST \" and c3:\"\n J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] = s (Ident ''head'')\"\n and c4:\"scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST]) \"\n have c1:\"0< i\" by(cut_tac c1,simp)\n have c5:\"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] \\ s (Ident ''head'')\"\n using assms c1 c2 c4 iPlusjPLUSIsNotj by blast \n \n with c3 show False by simp\n \n \n qed\n }\n ultimately have \"?P e \" by satx\n \n \n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i+4)) \"(is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have b2:\"i - 1 < LAST\" by(cut_tac a b1,auto)\n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\"\n by simp \n have \"i=LAST \\ i s (Ident ''head'')\" and\n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" \n \n have b1:\"J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)]= s (Ident ''head'')\"\n by (simp add: a2 iPlusSucLatIsi)\n with a1 b1 show False by auto \n next\n fix s\n assume \n a4:\"s (Ident ''tail'') = expEval (J LAST) (applyPlusN head LAST) s\" and\n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and\n a3:\"s (Ident ''dataIn'') = index data\" \n \n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n (*have a0:\"s (Ident ''tail'') = s (Ident ''head'')\"*)\n have b3:\" \n expEval (J LAST)\n (substExp\n (caseExp (map (\\i. (eqn (applyPlusN head LAST) (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i,\n iteForm (eqn tail (Const (index i))) dataIn (IVar (Para mem i))))\n (down LAST)))\n s =\n expEval (J LAST) dataIn s\" thm auxOnReadWrite \n using a4 a2 b1 b2 by auto \n show \"\n expEval (J LAST)\n (substExp\n (caseExp (map (\\i. (eqn (applyPlusN head LAST) (Const (index i)), IVar (Para mem i))) (down LAST)))\n (map (\\i. (Para mem i,\n iteForm (eqn tail (Const (index i))) dataIn (IVar (Para mem i))))\n (down LAST)))\n s =\n index data\"\n using a3 b3 by auto\n qed \n \n }\n moreover\n {assume b4:\" i i \" and c2:\" i < LAST \" and c3:\"\n J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] = s (Ident ''head'')\"\n and c4:\"scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST]) \"\n \n have c1:\"0< i\" by(cut_tac c1,simp)\n have c5:\"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] \\ s (Ident ''head'')\"\n using assms c1 c2 c4 iPlusjPLUSIsNotj by blast \n \n with c3 show False by simp\n \n next\n fix s\n assume\n a4:\"s (Ident ''tail'') = expEval (J LAST) (applyPlusN head i) s\" and\n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and\n a3:\"s (Ident ''dataIn'') = index data\" \n \n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n have b3:\"expEval (J LAST) tail s = index ((j +i) mod (Suc LAST))\"\n apply(cut_tac a4,simp)\n by (simp add: b1 b2 b4 less_or_eq_imp_le)\n have b4:\"(j +i) mod (Suc LAST) \\ LAST\" by simp \n (*have a0:\"s (Ident ''tail'') = s (Ident ''head'')\"*)\n \n have b5:\"expEval (J LAST)\n (substExp\n (caseExp (map (\\i'. (eqn (applyPlusN head i) (Const (index i')), IVar (Para mem i'))) (down LAST)))\n (map (\\i'. (Para mem i',\n iteForm (eqn tail (Const (index i'))) dataIn (IVar (Para mem i'))))\n (down LAST)))\n s =\n expEval (J LAST) dataIn s\" thm readWrite \n apply(cut_tac b3 b4, rule readWrite,auto)\n by (simp add: a4) \n show \"expEval (J LAST)\n (substExp\n (caseExp (map (\\i'. (eqn (applyPlusN head i) (Const (index i')), IVar (Para mem i'))) (down LAST)))\n (map (\\i'. (Para mem i',\n iteForm (eqn tail (Const (index i'))) dataIn (IVar (Para mem i'))))\n (down LAST)))\n s =\n index data\"\n using a3 b5 by auto\n qed\n }\n ultimately have \"?P e \" by satx\n \n } \n \n moreover\n {assume b1:\"\\i. 0\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 3)) ( Vertex (2*i + 1)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have b2:\"i - 1 < LAST\" by(cut_tac a b1,auto)\n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\"\n by simp \n have \"i=LAST \\ i s (Ident ''head'')\" \n apply(cut_tac a c2,rule iPlusjPLUSIsNotj,auto) done\n with d1 d2 c1 show False\n by simp\n next\n fix s\n show \" J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)] =\n expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) LAST) s\"\n using applyIPlusIsPlusI by auto\n next\n fix s\n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n show \"scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST])\"\n apply(cut_tac b1,auto) done\n qed \n }\n moreover\n {assume b4:\"i i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n show \"scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST])\"\n apply(cut_tac b1,auto) done\n \n next\n fix s\n assume c1:\" J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =\n J LAST ''+'' [s (Ident ''head''), index (Suc 0)]\" and \n c2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and c3:\"0i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where e1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n have e2:\"j\\ LAST\" \n using c2 e1 axiomOnLe apply auto done thm onApplyPlusI\n have e3:\"expEval (J LAST) (applyPlusN head i) s= index ((j +i) mod Suc LAST)\"\n by (simp add: e1 e2 b4 less_imp_le_nat)\n \n show False\n apply(cut_tac a b1 e1 e2 e3 c1 c3, simp)\n by (smt Divides.mod_less le_imp_less_Suc le_mod_geq mod_Suc nat.distinct(1) nat.inject neq0_conv not_less test5)\n next\n fix s\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n show \" scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST])\"\n apply(cut_tac b1,auto) done\n next\n fix s\n show \"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =\n expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) i) s\"\n by (simp add: applyIPlusIsPlusI)\n qed\n }\n ultimately have \"?P e \" by satx\n }\n \n \n moreover\n {assume b1:\"\\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 4)) ( Vertex (2*i+2 )) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n \n have b3:\"varOfExp (applyPlusN head i) =[Ident ''head'']\"\n by simp \n have \"i=LAST \\ i i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where e1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n have e2:\"j\\ LAST\" \n using c2 e1 axiomOnLe apply auto done thm onApplyPlusI\n have e3:\"J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)]= index j\"\n by (metis c2 e1 iPlusSucLatIsi)\n \n have e4:\"J LAST ''+'' [s (Ident ''head''), index (Suc 0)] = index ((j +1) mod Suc LAST) \"\n by (simp add: e1)\n show False\n apply(cut_tac c1 e3 e4 a, simp)\n by (metis e1 iPlus1IsNotI)\n next\n fix s\n show \" J LAST ''+'' [expEval (J LAST) (applyPlusN head LAST) s, index (Suc 0)] =\n expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) LAST) s\"\n using applyIPlusIsPlusI by auto\n next\n fix s\n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n show \"scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST])\"\n apply(cut_tac b1,auto) done\n next\n fix s\n assume \n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and \n a4:\"expEval (J LAST) (caseExp (map (\\i. (eqn (applyPlusN head LAST) (Const (index i)), IVar (Para mem i))) (down LAST))) s =\n index data\"\n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n (*have a0:\"s (Ident ''tail'') = s (Ident ''head'')\"*)\n have b20:\"tautlogy (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0)) \n (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0))) (J LAST)\"\n apply(induct_tac LAST, auto) done\n have b3:\" \n expEval (J LAST)\n (substExp\n (caseExp\n (map (\\i. (eqn (applyPlusN head (LAST - Suc 0)) (Const (index i)), IVar (Para mem i))) (down LAST)))\n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])])\n s =\n expEval (J LAST)\n (caseExp\n (map (\\i. (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0)) (Const (index i)), IVar (Para mem i)))\n (down LAST))) s\" \n using substCaseExp1 by auto\n\n have b4:\" expEval (J LAST)\n ((caseExp (map (\\i. (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0)) (Const (index i)), \n IVar (Para mem i))) (down LAST)))\n )\n s =\n expEval (J LAST) (caseExp (map (\\i. (eqn (applyPlusN head LAST) (Const (index i)), IVar (Para mem i))) (down LAST))) s\"\n proof(rule caseExpCong1,simp)\n \n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n show \"expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0)) s\n = expEval (J LAST) (applyPlusN head LAST) s\"\n apply(cut_tac a b1 b2,auto) done\n qed\n \n show \"expEval (J LAST)\n (substExp (caseExp (map (\\i. (eqn (applyPlusN head (LAST - Suc 0)) (Const (index i)), IVar (Para mem i))) (down LAST)))\n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])])\n s =\n index data\"\n by (simp add: a4 b3 b4)\n \n qed \n }\n moreover\n {assume b4:\"i i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n show \"scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST])\"\n apply(cut_tac b1,auto) done\n \n next\n fix s\n assume c1:\" J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =\n J LAST ''+'' [s (Ident ''head''), index (Suc 0)]\" and \n c2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and c3:\"Suc 0 \\ i\"\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where e1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n have e2:\"j\\ LAST\" \n using c2 e1 axiomOnLe apply auto done thm onApplyPlusI\n have e3:\"expEval (J LAST) (applyPlusN head i) s= index ((j +i) mod Suc LAST)\"\n by (simp add: e1 e2 b4 less_imp_le_nat)\n \n show False\n apply(cut_tac a b1 e1 e2 e3 c1 c3, simp)\n by (smt Divides.mod_less le_imp_less_Suc le_mod_geq mod_Suc nat.distinct(1) nat.inject neq0_conv not_less test5)\n next\n fix s\n assume d1:\"i i\"\n show \"J LAST ''+'' [expEval (J LAST) (applyPlusN head i) s, index (Suc 0)] =\n expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) i) s\"\n by (simp add: applyIPlusIsPlusI)\n next\n fix s\n assume \n a1:\"Suc 0 \\ i\" and\n a2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\" and \n a4:\"expEval (J LAST) (caseExp (map (\\ia. (eqn (applyPlusN head i) (Const (index ia)), IVar (Para mem ia))) (down LAST))) s =\n index data\"\n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n (*have a0:\"s (Ident ''tail'') = s (Ident ''head'')\"*)\n have b20:\"tautlogy (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0)) \n (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (LAST - Suc 0))) (J LAST)\"\n apply(induct_tac LAST, auto) done\n have b3:\" \n expEval (J LAST)\n (substExp\n (caseExp\n (map (\\ia. (eqn (applyPlusN head (i - Suc 0)) (Const (index ia)), IVar (Para mem ia))) (down LAST)))\n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])])\n s =\n expEval (J LAST)\n (caseExp\n (map (\\ia. (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (i - Suc 0)) (Const (index ia)), IVar (Para mem ia)))\n (down LAST))) s\" \n using substCaseExp1 by auto\n\n have c4:\" expEval (J LAST)\n ((caseExp (map (\\ia. (eqn (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (i - Suc 0)) (Const (index ia)), \n IVar (Para mem ia))) (down LAST)))\n )\n s =\n expEval (J LAST) (caseExp (map (\\ia. (eqn (applyPlusN head i) (Const (index ia)), IVar (Para mem ia))) (down LAST))) s\"\n proof(rule caseExpCong1,simp)\n \n \n have \"\\i. ((s (Ident ''head'') ) = (index i))\" \n using headIsIndex by auto\n then obtain j where b1:\"((s (Ident ''head'') ) = (index j))\"\n by blast\n have b2:\"j\\ LAST\" \n using a2 b1 axiomOnLe apply auto done\n show \"expEval (J LAST) (applyPlusN (uif ''+'' [head, Const (index (Suc 0))]) (i - Suc 0)) s\n = expEval (J LAST) (applyPlusN head i) s\"\n apply(cut_tac a b1 b2 b4 a1,auto)\n done\n qed\n \n show \"expEval (J LAST)\n (substExp (caseExp (map (\\ia. (eqn (applyPlusN head (i - Suc 0)) (Const (index ia)), IVar (Para mem ia))) (down LAST)))\n [(Ident ''head'', uif ''+'' [head, Const (index (Suc 0))])])\n s =\n index data\"\n by (simp add: a4 b3 c4)\n \n qed \n }\n ultimately have \"?P e\" by satx\n }\n moreover\n {assume b1:\"e=Edge (Vertex 4) ( Vertex 1)\"\n have \"?P e\"\n proof(cut_tac a b1, simp add:antOfRbFifo_def Let_def,auto)\n fix s\n assume c2:\" scalar2Bool (J LAST ''le'' [s (Ident ''head''), index LAST])\"\n have \"\\i. ((s (Ident ''head'') ) = (index i))\"\n using headIsIndex by auto\n then obtain j where e1:\"((s (Ident ''head'') ) = (index j))\"\n by blast \n have e2:\"j\\ LAST\"\n using c2 e1 axiomOnLe apply auto done \n show \" scalar2Bool (J LAST ''le'' [J LAST ''+'' [s (Ident ''head''), index (Suc 0)], index LAST]) \"\n apply(cut_tac e1 e2,auto) done\n qed\n }\nultimately show \"?P e\" by satx\nqed \nlemma testAux[simp]:\n \nshows \"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), me i)) (down LAST)@S))) s \n=expEval I (me i) s) \\\n(expEval I e s =index i \\\n LAST < i\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)),me i)) (down LAST)@S))) s \n=expEval I (caseExp S) s)\" (is \"?P LAST\")\nproof(induct_tac LAST,auto )qed \n\nlemma test[simp]:\nshows \"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), me i)) (down LAST)))) s \n=expEval I (me i) s)\"\nproof -\nhave a:\"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), me i)) (down LAST)@[]))) s \n=expEval I (me i) s)\"\napply(cut_tac testAux [where I=\"I\" and S=\"[]\" and i=\"i\" and e=\"e\" and s=\"s\" and LAST=\"LAST\" and me=\"me\"]) \napply simp\ndone\nthen show ?thesis by auto\nqed\n\n \n\nlemma instImply:\nassumes a:\"G=(rbFifoGsteSpec LAST data)\" and c:\"tag=tagFunOfRingBufFifo data LAST\"\nshows\n\"\\ e. e \\edgesOf G\\ \ntautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) I\" \nproof(rule allI,rule impI,simp,rule allI,rule impI)\n fix e s\n assume a1:\"e \\ edgesOf G \" and a2:\"\n formEval I (antOf G e) s \\ formEval I (andListForm (tag (source e))) s\" \n let ?P =\"\\e. formEval I (consOf G e) s\" \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex 1) ( Vertex 3) |\n e=Edge ( Vertex 1) ( Vertex 4)|\n (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) |\n (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) |\n \n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) |\n \n (\\i. 0\\i \\ i\\ LAST \\ e= ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex(2 * i + 4)) (Vertex(2 *i+ 2))))|\n e=Edge (Vertex 4) (Vertex 1)\"\n apply(cut_tac a a1,auto) done\n \n \n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1, simp add:antOfRbFifo_def) done\n }\n moreover\n {assume b1:\" (\\i. 0\\i \\ i\\ LAST +1 \\ e=( Edge (Vertex (2* i + 1)) (Vertex ( 2*i + 1))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac a c a2 b2, auto) done\n }\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 2)) (Vertex ( 2*i + 2))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac a c a2 b2,auto) done\n } \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 3) \"\n \n have \"?P e\"\n apply(cut_tac a c a2 b1,auto ) done\n }\n \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 4) \"\n let ?f=\"andForm (neg (eqn rst HIGH)) (andForm (eqn push HIGH) (neg (eqn tail (Const (index LAST )))) ) \"\n \n \n have \"?P e \"\n apply(cut_tac a a1 a2 b1 ,auto simp add: antOfRbFifo_def assms) done\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i + 3))\" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a c a2 b1 ,auto simp add: antOfRbFifo_def assms )\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i+4)) \"(is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a b1 a1 a2,auto simp add: antOfRbFifo_def assms)\n } \n \n moreover\n {assume b1:\"\\i. 0\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 3)) ( Vertex (2*i + 1)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a c a2 b1 ,auto simp add:Let_def antOfRbFifo_def assms )\n }\n \n moreover\n {assume b1:\"\\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 4)) ( Vertex (2*i +2)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a a2 b1 ,auto simp add: Let_def antOfRbFifo_def assms)\n \n }\n moreover\n {assume b1:\"e=Edge (Vertex 4) ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a c a2 b1 ,case_tac \"LAST=0\",auto simp add: Let_def antOfRbFifo_def assms) done\n }\n ultimately show \"?P e\" by satx\n qed \n\nlemma main: \nassumes a:\"G=(rbFifoGsteSpec LAST data)\" \nand c:\"tag=tagFunOfRingBufFifo data LAST\" and\nd:\"M=(ringBuffifo LAST )\"\nshows \" circuitSatGsteSpec M G (J LAST) \" \nproof(rule mainLemma)\nhave a1:\"consistent' (ringBuffifo LAST ) (J LAST) (rbFifoGsteSpec LAST data) (tagFunOfRingBufFifo data LAST)\" \n apply (case_tac \"LAST=0\",rule consistencyOfRbfifo0,simp)\n apply(rule consistencyOfRbfifo,arith) done\nfrom a c d this show \"consistent' M (J LAST) G tag\"\n by simp \nnext\nfrom a c show \"\\e. e \\ edgesOf G \\\n tautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) (J LAST)\"\napply(rule instImply) done\nnext\nfrom a c show \"tag (initOf G) = []\"\napply auto done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/ringBufFifoModi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.2856951781658655}} {"text": "section \\ RoboChart Meta-Model \\\n\ntheory MetaModel\n imports Actions\nbegin\n\nsubsection \\ State Machine Syntax \\\n\ntext \\ All state machine statespace types extend the following type which provides a state control variable \\\n\ntype_synonym ID = String.literal\n\nalphabet robochart_ctrl =\n rc_ctrl :: ID \n\ntype_synonym 's rcst = \"'s robochart_ctrl_scheme\"\ntype_synonym ('s, 'e) RoboAction = \"('s robochart_ctrl_scheme, 'e) Actions.Action\"\ntype_synonym 's RoboPred = \"'s robochart_ctrl_scheme upred\"\n\ntranslations\n (type) \"'s rcst\" <= (type) \"'s robochart_ctrl_scheme\"\n (type) \"('s, 'e) RoboAction\" <= (type) \"('s rcst, 'e) Action\"\n (type) \"'s RoboPred\" <= (type) \"'s rcst upred\"\n\nabbreviation \"rc_state \\ robochart_ctrl.more\\<^sub>L\"\n\nnotation rc_state (\"\\<^bold>r\")\n\nsyntax\n \"_svid_rc_state\" :: \"svid\" (\"\\<^bold>r\")\n\ntranslations\n \"_svid_rc_state\" == \"CONST rc_state\"\n \"_svid_dot \\<^bold>r x\" <= \"x ;\\<^sub>L \\<^bold>r\"\n\nrecord ('s, 'e) Transition = \n tn_source :: ID\n tn_target :: ID\n tn_trigger :: \"('s, 'e) Actions.Action option\"\n tn_condition :: \"'s upred\"\n tn_action :: \"('s, 'e) Actions.Action\"\n\ndeclare Transition.defs [simp]\n\nrecord ('s, 'e) Node =\n n_name :: \"ID\"\n n_entry :: \"('s, 'e) Action\"\n n_during :: \"('s, 'e) Action\"\n n_exit :: \"('s, 'e) Action\"\n\ndeclare Node.defs [simp]\n\nrecord ('s, 'e) StateMachine =\n sm_initial :: \"String.literal\" (\"init\\\")\n sm_finals :: \"String.literal list\" (\"finals\\\")\n sm_nodes :: \"('s, 'e) Node list\" (\"nodes\\\")\n sm_transitions :: \"('s, 'e) Transition list\" (\"\\<^bold>T\\\")\n\ndeclare StateMachine.defs [simp]\n\nthm set_map\n\ndefinition sm_node_names :: \"('s, 'e) StateMachine \\ String.literal set\" (\"nnames\\\") where\n\"sm_node_names sm \\ n_name ` set(sm_nodes sm)\"\n\ndefinition sm_inters :: \"('s, 'e) StateMachine \\ ('s, 'e) Node list\" where\n\"sm_inters sm = filter (\\ n. n_name n \\ set(sm_finals sm)) (sm_nodes sm)\"\n\ndefinition sm_inter_names (\"inames\\\") where\n\"sm_inter_names sm \\ n_name ` set (sm_inters sm)\"\n\nabbreviation sm_final_names (\"fnames\\\") where\n\"sm_final_names M \\ set (finals\\<^bsub>M\\<^esub>)\"\n\ndefinition sm_node_map :: \"('s, 'e) StateMachine \\ (ID \\ ('s, 'e) Node)\" (\"nmap\\\") where\n\"sm_node_map M = map_of (map (\\ n. (n_name n, n)) (sm_nodes M))\"\n\ndefinition sm_trans_map :: \"('s, 'e) StateMachine \\ (ID \\ ('s, 'e) Transition list)\" (\"tmap\\\") where\n\"sm_trans_map M = map_of (map (\\ n. (n_name n, filter (\\ t. tn_source t = n_name n) (sm_transitions M))) (sm_nodes M))\"\n\nlemma dom_sm_node_map: \"dom(nmap\\<^bsub>M\\<^esub>) = nnames\\<^bsub>M\\<^esub>\"\n using image_iff by (force simp add: sm_node_map_def sm_node_names_def dom_map_of_conv_image_fst)\n\nlemma dom_sm_trans_map: \"dom(tmap\\<^bsub>M\\<^esub>) = nnames\\<^bsub>M\\<^esub>\"\n using image_iff by (force simp add: sm_trans_map_def sm_node_names_def dom_map_of_conv_image_fst)\n\nlemma nnames_finite: \"finite(nnames\\<^bsub>M\\<^esub>)\"\n by (force simp add: sm_node_names_def)\n\nabbreviation sm_init_node :: \"('s, 'e) StateMachine \\ ('s, 'e) Node\" (\"ninit\\\") where\n\"sm_init_node M \\ the (sm_node_map M (sm_initial M))\"\n\nsubsection \\ Well-Formedness \\\n\nlocale WfStateMachine =\n fixes M :: \"('s, 'm) StateMachine\" (structure)\n \\ \\ The list of nnames is a set \\\n assumes nnames_distinct: \"distinct (map n_name (nodes\\<^bsub>M\\<^esub>))\"\n and init_is_state: \"init \\ nnames\"\n and init_not_final: \"init \\ fnames\"\n and trans_wf: \" \\ t. t \\ set(\\<^bold>T) \\ tn_source t \\ inames \\ tn_target t \\ nnames\"\nbegin\n lemma init_is_inter: \"init \\ inames\"\n using init_is_state init_not_final by (auto simp add: sm_inters_def sm_inter_names_def sm_node_names_def)\n\n lemma nmap_init: \"nmap init = Some ninit\"\n by (metis domIff dom_sm_node_map init_is_state option.exhaust_sel)\n\n lemma n_name_init: \"n_name ninit = init\"\n proof (simp add: sm_node_map_def)\n have \"map_of (map (\\n. (n_name n, n)) (sm_nodes M)) init = Some (the (map_of (map (\\n. (n_name n, n)) (sm_nodes M)) init))\"\n by (metis (no_types) nmap_init sm_node_map_def)\n then show \"n_name (the (map_of (map (\\n. (n_name n, n)) (sm_nodes M)) init)) = init\"\n using map_of_SomeD by force\n qed\n\n lemma nmap_name:\n assumes \"n \\ set(sm_nodes M)\"\n shows \"nmap (n_name n) = Some n\"\n proof -\n have \"distinct (map fst (map (\\n. (n_name n, n)) (sm_nodes M)))\"\n by (simp add: comp_def nnames_distinct)\n with assms show ?thesis\n by (simp add: sm_node_map_def)\n qed\n\n lemma ninit_is_node: \"ninit \\ set(sm_nodes M)\"\n using init_is_state nmap_name by (auto simp add: sm_node_names_def)\n\n lemma tmap_node_in_trans: \n assumes \"n \\ nnames\" \"ts \\ ran(tmap)\"\n shows \"set(ts) \\ set(\\<^bold>T)\"\n using assms by (auto simp add: sm_trans_map_def ran_distinct nnames_distinct comp_def)\n\n lemma node_tran_exists:\n assumes \"n \\ nnames\" \"t \\ set(the(tmap n))\"\n shows \"t \\ set(\\<^bold>T)\"\n by (metis (mono_tags, hide_lams) assms(1) assms(2) domIff dom_sm_trans_map in_mono init_is_state option.collapse ranI tmap_node_in_trans)\n\nend\n\nmethod check_machine uses defs = \n (unfold_locales, \n simp_all add: defs sm_node_names_def sm_inter_names_def sm_inters_def, safe, simp_all)\n\nsubsection \\ State Machine Semantics \\\n\nabbreviation \"trigger_semantics t null_event \\ \n (case tn_trigger t of Some e \\ if productive e then e else sync null_event | None \\ sync null_event)\"\n\nno_utp_lift tn_condition\n\ndefinition tr_semantics :: \"('s, 'e) Transition \\ (unit, 'e) chan \\ ('s, 'e) RoboAction\" (\"\\_\\\\<^sub>T\") where\n\"tr_semantics t null_event \\ \n tn_condition t \\\\<^sub>p rc_state \\<^bold>& \n rc_state:[trigger_semantics t null_event ; tn_action t]\\<^sub>A\\<^sup>+ ; rc_ctrl := \\tn_target t\\\"\n\ndefinition node_semantics :: \n \"('s, 'e) StateMachine \\ (unit, 'e) chan \\ ('s, 'e) Node \\ ('s, 'e) RoboAction\" (\"_;_ \\ \\_\\\\<^sub>N\" [10,0,0] 10) where\n \"node_semantics M null_event node = \n (rc_state:[n_entry node]\\<^sub>A\\<^sup>+ ;\n (foldr (\\) (map (\\ t. \\t\\\\<^sub>T null_event) (the (tmap\\<^bsub>M\\<^esub> (n_name node)))) stop) ;\n rc_state:[n_exit node]\\<^sub>A\\<^sup>+)\"\n\ndefinition sm_semantics :: \"('s, 'e) StateMachine \\ (unit, 'e) chan \\ ('s, 'e) RoboAction\" (\"\\_\\\\<^sub>M\") where\n\"sm_semantics M null_event = \n (rc_ctrl := \\sm_initial M\\ ;\n iteration (map (\\ n. (&rc_ctrl =\\<^sub>u \\n_name n\\, M;null_event \\ \\n\\\\<^sub>N)) (sm_inters M)))\"\n\nlemmas sm_sem_def = sm_semantics_def node_semantics_def sm_inters_def sm_inter_names_def\n\nlemma tr_semantics_subst_ctrl: \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ (\\a\\\\<^sub>T null_event) = \\a\\\\<^sub>T null_event\"\n by (simp add: tr_semantics_def action_simp usubst unrest frame_asubst)\n\nlemma tr_choice_subst_ctrl:\n \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ foldr (\\) (map (\\t. \\t\\\\<^sub>T null_event) ts) stop = foldr (\\) (map (\\t. \\t\\\\<^sub>T null_event) ts) stop\"\n by (induct ts, simp_all add: action_simp usubst tr_semantics_subst_ctrl)\n\nlemma sm_semantics_subst_ctrl:\n \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ node_semantics M null_event node = node_semantics M null_event node\"\n by (simp add: node_semantics_def action_simp frame_asubst tr_choice_subst_ctrl unrest)\n\nsubsection \\ Theorems \\\n\nlemma productive_tr_semantics [closure]: \"productive (\\t\\\\<^sub>T null_event)\"\n by (cases \"tn_trigger t\", auto simp add: tr_semantics_def action_rep_eq closure unrest)\n\nlemma productive_node_semantics:\n \"productive (M;null_event \\ \\node\\\\<^sub>N)\"\nproof -\n have \"\\ ts. productive (foldr (\\) (map (\\ t. \\t\\\\<^sub>T null_event) ts) stop)\"\n by (rename_tac ts, induct_tac ts, auto simp add: action_rep_eq closure, simp add: closure productive_Productive)\n hence \"productive (foldr (\\) (map (\\ t. \\t\\\\<^sub>T null_event) (the (tmap\\<^bsub>M\\<^esub> (n_name node)))) stop)\"\n by blast\n thus ?thesis\n by (simp add: action_rep_eq closure node_semantics_def)\nqed\n\nlemma Sup_Collect_as_UINF:\n \"\\ {P x | x. x \\ A} = (\\ x \\ A \\ P x)\"\n apply (simp add: UINF_as_Sup[THEN sym], rel_simp)\n apply (rule cong[of Sup Sup])\n apply (auto)\n done\n \n\nlemma Sup_Collect_2_as_UINF:\n \"\\ {P x y | x y. (x, y) \\ A} = (\\ (x, y) \\ A \\ P x y)\"\n apply (simp add: UINF_as_Sup[THEN sym], rel_simp)\n apply (rule cong[of Sup Sup])\n apply (auto)\n done\n\nlemma UINF_Collect: \"(\\ b \\ {F(x)| x . x \\ A} \\ b) = (\\ x \\ A \\ F(x))\"\n by (simp add: Sup_Collect_as_UINF UINF_as_Sup)\n\nlemma ueq_literlise [lit_simps]: \n \"(\\x = y\\) = (\\x\\ =\\<^sub>u \\y\\)\"\n by (rel_auto)\n\nlemma seq_refine_mono:\n fixes P\\<^sub>1 P\\<^sub>2 Q\\<^sub>1 Q\\<^sub>2 :: \"('s, 'e) Action\"\n assumes \"P\\<^sub>1 \\ Q\\<^sub>1\" \"P\\<^sub>2 \\ Q\\<^sub>2\"\n shows \"P\\<^sub>1 ; P\\<^sub>2 \\ Q\\<^sub>1 ; Q\\<^sub>2\"\n using assms\n by (simp add: action_rep_eq seqr_mono)\n\nlemma StateMachine_refine_intro:\n fixes \n S :: \"('s, 'e) RoboAction\" and\n M :: \"('s, 'e) StateMachine\"\n assumes \n \"WfStateMachine M\"\n \"S \\ (M;null_event \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N)\"\n \"\\ n. n \\ inames\\<^bsub>M\\<^esub> \\ S \\ S ; (M;null_event \\ \\the(nmap\\<^bsub>M\\<^esub> n)\\\\<^sub>N)\"\n shows \"S \\ \\M\\\\<^sub>M null_event\"\nproof -\n interpret wf: WfStateMachine M\n by (simp add: assms)\n have 1: \"\\n. n \\ set(sm_inters M) \\ productive (M;null_event \\ \\n\\\\<^sub>N)\"\n by (simp add: productive_node_semantics)\n have 2: \"S \\ rc_ctrl := \\init\\<^bsub>M\\<^esub>\\ ; [\\ (\\ (b, P) \\ (\\n. (&rc_ctrl =\\<^sub>u \\n_name n\\, M;null_event \\ \\n\\\\<^sub>N)) ` set(sm_inters M) \\ b)]\\<^sub>A\"\n proof -\n have a:\"(\\ n. (&rc_ctrl =\\<^sub>u \\n_name n\\ :: 's RoboPred, M;null_event \\ \\n\\\\<^sub>N)) ` set(sm_inters M) =\n {(&rc_ctrl =\\<^sub>u \\n_name n\\, M;null_event \\ \\n\\\\<^sub>N)| n . n \\ set(sm_inters M)}\"\n by (auto)\n have b: \"(\\init\\<^bsub>M\\<^esub>\\ \\\\<^sub>u \\inames\\<^bsub>M\\<^esub>\\) = false\"\n by (literalise, metis (full_types) false_alt_def true_alt_def utp_pred_laws.compl_top_eq wf.init_is_inter)\n have \"(\\ (b, P) \\ (\\n. (&rc_ctrl =\\<^sub>u \\n_name n\\ :: 's RoboPred, M;null_event \\ \\n\\\\<^sub>N)) ` set(sm_inters M) \\ b) =\n (\\ (b, P) \\ {(&rc_ctrl =\\<^sub>u \\n_name n\\, M;null_event \\ \\n\\\\<^sub>N)| n . n \\ set(sm_inters M)} \\ b)\"\n by (simp add: a)\n also have \"... = (\\ b \\ {&rc_ctrl =\\<^sub>u \\n_name n\\| n . n \\ set(sm_inters M)} \\ b)\"\n by (rel_auto) \n also have \"... = (&rc_ctrl \\\\<^sub>u \\inames\\<^bsub>M\\<^esub>\\)\"\n apply (simp add: UINF_Collect, rel_auto)\n apply (simp add: sm_inter_names_def sm_sem_def(3))\n using sm_inter_names_def apply fastforce\n done\n finally show ?thesis\n by (simp add: action_simp usubst b miracle_top)\n qed\n have 3: \"S \\ rc_ctrl := \\init\\<^bsub>M\\<^esub>\\ ; [\\ (&rc_ctrl \\\\<^sub>u \\inames\\<^bsub>M\\<^esub>\\)]\\<^sub>A\" (is \"?lhs \\ ?rhs\")\n proof -\n have \"?rhs = [\\init\\<^bsub>M\\<^esub>\\ \\\\<^sub>u \\inames\\<^bsub>M\\<^esub>\\]\\<^sub>A ; rc_ctrl := \\init\\<^bsub>M\\<^esub>\\\"\n by (simp add: action_simp usubst)\n also have \"... = [false]\\<^sub>A ; rc_ctrl := \\init\\<^bsub>M\\<^esub>\\\"\n by (literalise, simp add: wf.init_is_inter)\n also have \"... = miracle\"\n by (simp add: action_simp)\n finally\n show ?thesis by (simp add: miracle_top)\n qed\n have 4:\"\\n. n \\ set(sm_inters M) \\ S \\ rc_ctrl := \\init\\<^bsub>M\\<^esub>\\ ; [&rc_ctrl =\\<^sub>u \\n_name n\\]\\<^sub>A ; (M;null_event \\ \\n\\\\<^sub>N)\"\n proof -\n fix n\n assume a:\"n \\ set(sm_inters M)\"\n show \"S \\ rc_ctrl := \\init\\<^bsub>M\\<^esub>\\ ; [&rc_ctrl =\\<^sub>u \\n_name n\\]\\<^sub>A ; (M;null_event \\ \\n\\\\<^sub>N)\"\n proof (cases \"n=ninit\\<^bsub>M\\<^esub>\")\n case True\n hence \"[&rc_ctrl \\\\<^sub>s \\init\\<^bsub>M\\<^esub>\\] \\ (M;null_event \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N) = (M;null_event \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N)\"\n by (simp add: sm_semantics_subst_ctrl)\n with True assms(2) show ?thesis\n by (simp add: action_simp usubst wf.n_name_init)\n next\n case False\n with a have \"(init\\<^bsub>M\\<^esub> = n_name n) = False\"\n proof -\n have \"n \\ {n. n \\ set(sm_nodes M) \\ \\ n_name n \\ set(finals\\<^bsub>M\\<^esub>)}\"\n by (metis a set_filter sm_sem_def(3))\n then have \"nmap\\<^bsub>M\\<^esub> (n_name n) = Some n\"\n using WfStateMachine.nmap_name wf.WfStateMachine_axioms by blast\n then show ?thesis\n using False by fastforce\n qed\n hence \"((\\init\\<^bsub>M\\<^esub>\\ =\\<^sub>u \\n_name n\\) :: 's RoboPred) = false\"\n by (rel_auto)\n thus ?thesis\n by (simp add: action_simp usubst miracle_top)\n qed\n qed\n have 5: \"\\n. n \\ set(sm_inters M) \\ S \\ S ; [&rc_ctrl =\\<^sub>u \\n_name n\\]\\<^sub>A ; (M;null_event \\ \\n\\\\<^sub>N)\"\n proof -\n fix n\n assume a:\"n \\ set(sm_inters M)\"\n have \"S \\ S ; (M;null_event \\ \\n\\\\<^sub>N)\"\n proof -\n have f1: \"{n. (n::('s, 'e) Node) \\ set(sm_nodes M) \\ \\ n_name n \\ set(finals\\<^bsub>M\\<^esub>)} = set(sm_inters M)\"\n by (simp add: sm_sem_def(3))\n then have \"n_name n \\ n_name ` {n. (n::('s, 'e) Node) \\ set(sm_nodes M) \\ \\ n_name n \\ set(finals\\<^bsub>M\\<^esub>)}\"\n using a by force\n then have \"n_name n \\ inames\\<^bsub>M\\<^esub>\"\n by (simp add: sm_inter_names_def sm_sem_def(3))\n then show ?thesis\n using f1 a assms(3) wf.nmap_name by fastforce\n qed\n moreover have \"S ; (M;null_event \\ \\n\\\\<^sub>N) \\ S ; [&rc_ctrl =\\<^sub>u \\n_name n\\]\\<^sub>A ; (M;null_event \\ \\n\\\\<^sub>N)\"\n by (rule seq_refine_mono, simp_all add: asm_pre_refine)\n ultimately show \"S \\ S ; [&rc_ctrl =\\<^sub>u \\n_name n\\]\\<^sub>A ; (M;null_event \\ \\n\\\\<^sub>N)\"\n using dual_order.trans by blast\n qed\n\n show ?thesis\n apply (simp add: sm_semantics_def)\n apply (rule iterate_refine_intro)\n apply (simp_all)\n apply (auto simp add: 1 2 3 4 5)\n done\nqed\n(*\nlemma StateMachine_sinv_refine_intro:\n fixes \n S :: \"('s, 'e) RoboAction\" and\n M :: \"('s, 'e) StateMachine\"\n assumes \n \"WfStateMachine M\"\n \"sinv\\<^sub>A(s) \\ (M;null_event \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N)\"\n \"\\ n. n \\ inames\\<^bsub>M\\<^esub> \\ S \\ S ; (M;null_event \\ \\the(nmap\\<^bsub>M\\<^esub> n)\\\\<^sub>N)\"\n shows \"S \\ \\M\\\\<^sub>M null_event\"\n*)\n\n(*\nlemma \"sinv\\<^sub>A (&rc_ctrl \\\\<^sub>u \\nnames\\<^bsub>M\\<^esub>\\) \\ r:[P]\\<^sub>A\\<^sup>+\"\n apply (simp add: action_rep_eq, safe)\n apply (rdes_refine_split)\n apply (rel_simp)\n\nlemma \n assumes \"WfStateMachine M\"\n shows \"sinv\\<^sub>A(&rc_ctrl \\\\<^sub>u \\nnames\\<^bsub>M\\<^esub>\\) \\ \\M\\\\<^sub>M null_event\"\nproof (rule StateMachine_refine_intro[OF assms])\n show \"sinv\\<^sub>A(&rc_ctrl \\\\<^sub>u \\nnames\\<^bsub>M\\<^esub>\\) \\ (M;null_event \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N)\"\n apply (simp add: node_semantics_def)\n*)\n\nsubsection \\ Divergence Freedom \\\n\nlocale DivFreeSM = WfStateMachine +\n assumes \n n_entry_divf: \"\\ n. n \\ set(nodes) \\ divf \\ n_entry n\" and\n n_during_divf: \"\\ n. n \\ set(nodes) \\ divf \\ n_exit n\" and\n n_exit_divf: \"\\ n. n \\ set(nodes) \\ divf \\ n_exit n\" and\n tn_trigger_divf: \"\\ t e. \\ t \\ set(\\<^bold>T); tn_trigger t = Some e \\ \\ divf \\ e\" and\n tn_action_divf: \"\\ t. t \\ set(\\<^bold>T) \\ divf \\ tn_action t\"\n\nlemma DivFreeSM_divf:\n assumes \"DivFreeSM M\"\n shows \"divf \\ \\M\\\\<^sub>M \\\"\nproof (rule StateMachine_refine_intro)\n interpret dvs: DivFreeSM M\n by (simp add: assms)\n show \"WfStateMachine M\"\n by (simp add: dvs.WfStateMachine_axioms)\n have \"\\ n t. \\ n \\ nnames\\<^bsub>M\\<^esub>; t \\ set(the (tmap\\<^bsub>M\\<^esub> n)) \\ \\ divf \\ \\t\\\\<^sub>T \\\" \n proof -\n fix n t\n assume a: \"n \\ nnames\\<^bsub>M\\<^esub>\" \"t \\ set(the (tmap\\<^bsub>M\\<^esub> n))\"\n have \"divf \\ trigger_semantics t \\\"\n proof (cases \"tn_trigger t\")\n case None\n then show ?thesis by (simp add: divf_sync)\n next\n case (Some a)\n then show ?thesis\n using a(1) a(2) divf_sync dvs.node_tran_exists dvs.tn_trigger_divf by fastforce\n qed\n thus \"divf \\ \\t\\\\<^sub>T \\\"\n apply (simp add: tr_semantics_def)\n apply (rule divf_guard)\n apply (rule divf_seq_refine)\n apply (rule divf_seq_refine)\n apply (rule divf_frame_ext)\n apply (simp)\n apply (rule divf_frame_ext)\n using a(1) a(2) dvs.node_tran_exists dvs.tn_action_divf apply blast\n apply (simp add: divf_assigns)\n done\n qed\n hence b:\"\\ n. n \\ inames\\<^bsub>M\\<^esub> \\ divf \\ (M;\\ \\ \\the (nmap\\<^bsub>M\\<^esub> n)\\\\<^sub>N)\"\n apply (simp add: node_semantics_def)\n apply (rule divf_seq_refine)\n apply (rule divf_frame_ext)\n apply (smt dvs.n_entry_divf dvs.nmap_name filter_is_subset imageE option.sel sm_inter_names_def sm_inters_def subset_eq)\n apply (rule divf_seq_refine)\n apply (rule divf_extchoice_fold_refine)\n apply (auto)\n apply (smt dvs.nmap_name filter_is_subset image_iff option.sel sm_inter_names_def sm_inters_def sm_node_names_def subset_code(1))\n apply (rule divf_frame_ext)\n apply (smt dvs.n_exit_divf dvs.nmap_name filter_is_subset imageE option.sel sm_inter_names_def sm_inters_def subset_eq)\n done\n show \"divf \\ (M;\\ \\ \\ninit\\<^bsub>M\\<^esub>\\\\<^sub>N)\"\n by (simp add: b dvs.init_is_inter)\n show \"\\n. n \\ inames\\<^bsub>M\\<^esub> \\ divf \\ divf ; (M;\\ \\ \\the (nmap\\<^bsub>M\\<^esub> n)\\\\<^sub>N)\"\n by (simp add: b divf_seq_refine)\nqed\n\nsubsection \\ Transition and State Parsers \\\n\nsyntax\n \"_transition\" :: \"id \\ id \\ raction \\ logic \\ raction \\ logic\"\n (\"from _ to _ trigger _ condition _ action _\" [0,0,0,0,10] 10)\n\n \"_transition_action\" :: \"id \\ id \\ logic \\ logic\"\n (\"from _ to _ action _\" [0,0,10] 10)\n\n \"_transition_condition\" :: \"id \\ id \\ logic \\ logic\"\n (\"from _ to _ condition _\" [0,0,10] 10)\n\n \"_transition_condition_action\" :: \"id \\ id \\ logic \\ raction \\ logic\"\n (\"from _ to _ condition _ action _\" [0,0,0,10] 10)\n\n \"_transition_trigger\" :: \"id \\ id \\ raction \\ logic\"\n (\"from _ to _ trigger _\" [0,0,10] 10)\n\n \"_transition_trigger_action\" :: \"id \\ id \\ raction \\ raction \\ logic\"\n (\"from _ to _ trigger _ action _\" [0,0,0,10] 10)\n\n \"_transition_trigger_condition\" :: \"id \\ id \\ raction \\ logic \\ logic\"\n (\"from _ to _ trigger _ condition _\" [0,0,0,10] 10)\n\n \"_state\" :: \"raction \\ raction \\ raction \\ logic\"\n (\"entry _ during _ exit _\" [0,0,10] 10)\n\n \"_state_entry\" :: \"raction \\ logic\"\n (\"entry _\" [10] 10)\n\ntranslations\n \"_transition s1 s2 e b a\" =>\n \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST Some e) b a\"\n\n \"_transition_action s1 s2 a\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST None) true a\"\n\n \"_transition_condition s1 s2 b\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST None) b (CONST Actions.skips)\"\n\n \"_transition_condition_action s1 s2 b a\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST None) b a\"\n\n \"_transition_trigger s1 s2 t\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST Some t) true (CONST Actions.skips)\"\n\n \"_transition_trigger_action s1 s2 t a\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST Some t) true a\"\n\n \"_transition_trigger_condition s1 s2 t b\" => \"CONST Transition.make IDLIT(s1) IDLIT(s2) (CONST Some t) b (CONST Actions.skips)\"\n\n\n \"_state e d x\" => \"CONST Node.make (CONST undefined) e d x\"\n\n \"_state_entry e\" => \"CONST Node.make (CONST undefined) e skip skip\"\n\nutp_lift_notation Transition.make (0 1 2 4)\n\nterm \"from s1 to s2 trigger y := 1 ; x?(y) ; z!(1) condition b action a\"\nterm \"from s1 to s2 action x := []\"\nterm \"from s1 to s2 trigger e\"\nterm \"entry e during d exit x\"\nterm \"entry e\"\n\nterm \"entry skip during skip exit skip\"\n\nsubsection \\ Proof Tactics \\\n\nmethod sm_induct uses simps wf = auto intro!: StateMachine_refine_intro[OF wf] dlockf_refine_intro simp add: simps\nmethod sm_calc uses simps = simp_all add: simps sm_sem_def, simp_all add: action_simp usubst alpha\n\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/robochart/untimed/MetaModel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.285479896968777}} {"text": "theory Proofs5\n imports Requirements VCTheoryLemmas\nbegin\n\ndefinition inv5 where \"inv5 s \\ R5 s \\ extraInv s\"\n\nthm extraInv_def\n\nlemma minimalOpened_R5: \"toEnvP s1 \\ toEnvP s2 \\ toEnvP s0 \\ substate s1 s2 \\ substate s2 s0 \\ substate s0 s \\\ntoEnvNum s1 s2 = 1 \\ toEnvNum s2 s0 < 9 \\ getPstate s0 Controller' = Controller'minimalOpened' \\\nltime s0 Controller' = 10 \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 Init'init' = Controller'minimalOpened' \\ ltime s1 Init'init' \\ 10) \\\n(\\s2. toEnvP s2 \\ substate s2 s \\ getPstate s2 Init'init' = Controller'minimalOpened' \\\n (\\s1. toEnvP s1 \\ substate s1 s2 \\ toEnvNum s1 s2 < ltime s2 Init'init' \\\n getPstate s1 Init'init' = Controller'minimalOpened')) \\\n(\\s1. toEnvP s1 \\\n substate s1 s \\ (getPstate s1 Init'init' = Controller'isOpened' \\ getPstate s1 Init'init' = Controller'minimalOpened') \\\n getVarBool s1 Controller'minimalOpened') \n\\ \\ (\\ getVarBool s1 open' \\ getVarBool s2 open')\"\n using substate_trans\n by (smt (verit, ccfv_SIG) BitM_inc_eq eval_nat_numeral(2) inc.simps(2) nat_add_left_cancel_less plus_1_eq_Suc toEnvNum3)\n\nlemma isOpened_timeout_R5: \"toEnvP s1 \\ toEnvP s2 \\ toEnvP s0 \\ substate s1 s2 \\ substate s2 s0 \\ substate s0 s \\\ntoEnvNum s1 s2 = 1 \\ toEnvNum s2 s0 < 9 \\ getPstate s0 Controller' = Controller'isOpened' \\\nltime s0 Controller' = 90 \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 Init'init' = Controller'isOpened' \\ ltime s1 Init'init' \\ 90) \\\n(\\s3. toEnvP s3 \\ substate s3 s \\ getPstate s3 Init'init' = Controller'isOpened' \\\n (\\s1. toEnvP s1 \\ substate s1 s3 \\ toEnvNum s1 s3 < ltime s3 Init'init' \\ getPstate s1 Init'init' = Controller'isOpened') \\\n (\\s2. toEnvP s2 \\ substate s2 s3 \\ toEnvNum s2 s3 + 1 < ltime s3 Init'init' \\ \\ getVarBool s2 Init')) \\\n(\\s1. toEnvP s1 \\\n substate s1 s \\ (getPstate s1 Init'init' = Controller'isOpened' \\ getPstate s1 Init'init' = Controller'minimalOpened') \\\n getVarBool s1 Controller'minimalOpened') \n\\ \\(\\ getVarBool s1 open' \\ getVarBool s2 open')\"\n apply(rule impI)\n apply(rule cut_rl[of \"toEnvNum s1 s0 < ltime s0 Controller'\"])\n using substate_trans\n apply meson\n using toEnvNum3 by auto\n\nlemma isOpened_R5: \"toEnvP s1 \\ toEnvP s2 \\ toEnvP s0 \\ substate s1 s2 \\ substate s2 s0 \\ substate s0 s \\\ntoEnvNum s1 s2 = 1 \\ toEnvNum s2 s0 < 9 \\ getPstate s0 Controller' = Controller'isOpened' \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 Init'init' = Controller'minimalOpened' \\ ltime s1 Init'init' \\ 10) \\\n(\\s2. toEnvP s2 \\ substate s2 s \\ getPstate s2 Init'init' = Controller'minimalOpened' \\\n (\\s1. toEnvP s1 \\ substate s1 s2 \\ toEnvNum s1 s2 < ltime s2 Init'init' \\\n getPstate s1 Init'init' = Controller'minimalOpened')) \\\n(\\s1. toEnvP s1 \\\n substate s1 s \\ (getPstate s1 Init'init' = Controller'isOpened' \\ getPstate s1 Init'init' = Controller'minimalOpened') \\\n getVarBool s1 Controller'minimalOpened') \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 Init'init' = Controller'isOpened' \\ ltime s1 Init'init' \\ 90) \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 Init'init' = Controller'isOpened' \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = 1 \\\n toEnvNum s2 s1 = ltime s1 Init'init' \\\n getPstate s2 Init'init' = Controller'minimalOpened' \\\n ltime s2 Init'init' = 10 \\ \\ getVarBool s3 EntranceController'isOpened')) \\\n(\\s3. toEnvP s3 \\ substate s3 s \\ getPstate s3 Init'init' = Controller'isOpened' \\\n (\\s1. toEnvP s1 \\ substate s1 s3 \\ toEnvNum s1 s3 < ltime s3 Init'init' \\ getPstate s1 Init'init' = Controller'isOpened') \\\n (\\s2. toEnvP s2 \\ substate s2 s3 \\ toEnvNum s2 s3 + 1 < ltime s3 Init'init' \\ \\ getVarBool s2 Init'))\n\\ \\ (\\ getVarBool s1 open' \\ getVarBool s2 open')\"\n apply(rule impI)\n apply(cases \"toEnvNum s1 s0 < ltime s0 Controller'\")\n using substate_trans\n apply meson \n apply(rule exE[of \" (\\ s2. \\ s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvNum s2 s3 = 1 \\\n toEnvNum s2 s0 = ltime s0 Init'init' \\\n getPstate s2 Init'init' = Controller'minimalOpened' \\ ltime s2 Init'init' = 10 \\ \\ getVarBool s3 EntranceController'isOpened')\"])\napply blast\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s3 s4\n apply(rule cut_rl[of \"substate s3 s0\"])\n apply(cases \"substate s2 s3\")\n apply(rule impE[OF minimalOpened_R5[of s1 s2 s3 s]])\n using substate_trans toEnvNum3\n apply (smt (verit) leD le_neq_implies_less le_trans less_or_eq_imp_le toEnvNum_substate1)\n apply assumption\n apply(rule cut_rl[of \"s1=s3\"])\n using substate_trans\n apply meson\n apply(rule cut_rl[of \"toEnvNum s1 s0 = toEnvNum s3 s0\"])\n using toEnvNum_eq_imp_eq2 substate_trans\n apply meson\n apply(rule le_antisym)\n apply(rule cut_rl[of \"substate s3 s2 \\ s2 \\ s3\"])\n using toEnvNum_substate2 toEnvNum_eq_imp_eq2 toEnvNum3[of s1 s2 s0]\n apply (metis Suc_leI order.order_iff_strict plus_1_eq_Suc)\n using substate_linear substate_refl\n apply meson\n apply arith\n using substate_trans by meson\n done\n\ntheorem proof_5_1: \"VC1 inv5 s0\"\n apply(unfold VC1_def inv5_def R5_def extraInv_def)\n by auto\n\ntheorem proof_5_2: \"VC2 R5 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC2_def)\n apply simp\n apply(unfold R5_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n subgoal premises vc_prems\n apply((rule allI)+)\n apply(rule impI)\n apply(simp split: if_splits)\nusing vc_prems\n by (metis One_nat_def) \n done\n\ntheorem proof_5_500: \"VC500 R5 env s0 PdOut_value paid_value opened_value\"\n apply(unfold VC500_def)\n apply simp\n apply(unfold R5_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n subgoal premises vc_prems\n apply((rule allI)+)\n apply(rule impI)\n apply(simp split: if_splits)\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 <10\"])\n using vc_prems substate_refl apply(metis One_nat_def) \n by simp\n using vc_prems by(metis One_nat_def) \n done\n\nend\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proofs5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804196836383, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2852681561840741}} {"text": "section \\Generic Block Allocator\\\ntheory Sep_Block_Allocator\nimports \"../../lib/Monad\"\nbegin\n\n text \\This theory specifies the concepts of memory allocation and deallocation.\n It is parameterized over the actual type of blocks.\n \\\n\n subsection \\Memory and Addresses\\\n\n text \\A memory is a list of allocated or already freed blocks.\n Allocated blocks are modeled by @{term \\Some blk\\}, \n freed blocks are modeled by @{term \\None\\}\n \\ \n datatype 'blk memory = MEMORY (the_memory: \"'blk option list\")\n define_lenses memory\n\n text \\An address indexes a block, and then addresses into the value of this block.\\\n datatype 'baddr addr = ADDR nat 'baddr\n\n text \\A pointer is either \\null\\, or an address\\\n datatype 'addr rptr = RP_NULL | RP_ADDR (the_addr: \"'addr\")\n hide_const (open) the_addr\n\n text \\Type-class to model that there is a base address.\\ \n (* TODO: Remove from semantics, move to reasoning infrastructure? *)\n class this_addr = fixes this_addr :: 'a \n \n text \\We immediately show that the typeclass is not empty. \n This avoids confusion of the code generator with lemmas depending on this typeclass.\\\n typedecl this_addr_witness\n instantiation this_addr_witness :: this_addr begin\n instance ..\n end\n \n \n subsection \\Memory Functions\\\n \n text \\\n We specify the standard functions \\alloc\\, \\free\\, \\load\\, and \\store\\. \n They are parameterized over load and store functions for blocks.\n \n Additionally, we specify a \\check_ptr\\ function, that asserts that a pointer is valid,\n i.e., is either \\null\\, or points to an allocated block, and its block address is valid \n for this block.\n \\\n \n locale block_allocator1 =\n fixes static_err :: 'err\n and mem_err :: 'err\n and bload :: \"'baddr::this_addr \\ ('val,_,'block,'err) M\"\n and bstore :: \"'val \\ 'baddr \\ (unit,_,'block,'err) M\"\n and bcheck_addr :: \"'baddr \\ (unit,_,'block,'err) M\"\n begin\n\n text \\Allocate a new block, and a pointer to its start\\\n definition alloc :: \"'block \\ ('baddr addr rptr,_,'block memory,'err) M\"\n where \"alloc init \\ zoom (lift_lens static_err the_memory\\<^sub>L) (doM {\n blocks \\ Monad.get;\n let bi = length blocks;\n let blocks = blocks @ [Some init];\n Monad.set blocks;\n return (RP_ADDR (ADDR bi this_addr))\n })\"\n\n text \\Free a block, specified by a pointer to its start\\ \n definition free :: \"'baddr addr rptr \\ (unit,_,'block memory,'err) M\"\n where \"free \\ \n \\RP_ADDR (ADDR bi ba) \\ doM {\n fcheck mem_err (ba=this_addr);\n \\\\ TODO: Use load here! \\\n let L = lift_lens static_err the_memory\\<^sub>L \\ (lift_lens mem_err (idx\\<^sub>L bi));\n blk \\ use L;\n fcheck mem_err (blk \\ None);\n L ::= None\n } \n | _ \\ fail mem_err\"\n \n text \\We define a lens that focuses a block index. \\ \n (* TODO: Can we define lenses to focus addresses/pointers instead? *)\n definition \"lens_of_bi bi \\ the_memory\\<^sub>L \\\\<^sub>L idx\\<^sub>L bi \\\\<^sub>L the\\<^sub>L\"\n abbreviation \"elens_of_bi bi \\ lift_lens mem_err (lens_of_bi bi)\"\n lemma lens_of_bi[simp, intro!]: \"hlens (lens_of_bi bi)\"\n unfolding lens_of_bi_def by auto\n \n text \\Load from an address\\ \n definition \"load \\ \\RP_ADDR (ADDR bi ba) \\ zoom (elens_of_bi bi) (bload ba) | _ \\ fail mem_err\"\n text \\Store at an address\\ \n definition \"store \\ \\x. \\RP_ADDR (ADDR bi ba) \\ zoom (elens_of_bi bi) (bstore x ba) | _ \\ fail mem_err\"\n \n text \\Check that pointer is valid\\\n definition \"check_ptr \\ \\RP_NULL \\ return () | RP_ADDR (ADDR bi ba) \\ zoom (elens_of_bi bi) (bcheck_addr ba)\"\n \n text \\The empty memory\\\n definition \"empty_memory \\ MEMORY []\"\n \n end \n\n subsection \\Isabelle Code Generator Setup\\\n text \\Setup to make the semantics executable inside Isabelle/HOL\\\n \n lemmas block_allocator1_code[code] =\n block_allocator1.alloc_def \n block_allocator1.free_def\n block_allocator1.lens_of_bi_def\n block_allocator1.load_def\n block_allocator1.store_def\n block_allocator1.check_ptr_def\n block_allocator1.empty_memory_def\n \n \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/basic/kernel/Sep_Block_Allocator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980404, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.2852461737808281}} {"text": "theory SpreadGetSet\n imports Main\n \"build_spread/Spread_dargentfull_CorresProof\"\n\nbegin\ncontext spread_dargentfull begin\ndefinition find_position :: \"nat \\ nat \\ nat \\ nat\"\n where \"find_position si offset = (offset div si, offset mod si)\"\n\ndefinition get_bit :: \"(('a::len0) word)['n::finite] \\ nat \\ bool\"\n where \"get_bit arr pos = \n (let (byte, off) = find_position LENGTH('a) pos in\n arr.[byte] !! off )\"\n\ndefinition raw_get_bit :: \"(('a::len0) word)['n::finite] \\ nat \\ 'a word\"\n where \"raw_get_bit arr pos = \n (let (byte, off) = find_position LENGTH('a) pos in\n arr.[byte] && 2^off )\"\n\n\n\ndefinition size_of_arr :: \"(('a::len0) word)['n::finite] \\ nat\"\n where \"size_of_arr _ = CARD('n)\"\n\ndefinition size_of_arr_bits :: \"(('a::len0) word)['n::finite] \\ nat\"\n where \"size_of_arr_bits _ = LENGTH('a)*CARD('n)\"\n\nML \\\nfun getter_sanity_tac ctxt = \n let\n val gets = Proof_Context.get_thms ctxt\n val get = Proof_Context.get_thm ctxt\n in\n K (print_tac ctxt \"debut_getter\")\nTHEN' \n (asm_full_simp_tac (ctxt addsimps [(get \"find_position_def\")])\nTHEN'\n (fn i => \nTRY (REPEAT_ALL_NEW (eresolve_tac ctxt @{thms exE conjE}) i))\n(* THEN' K (print_tac ctxt \"coucou\") *)\nTHEN' custom_get_set_different_field_tac ctxt\n) end\n\\\n\nlemma wesh : \"x < LENGTH('a) \\ (((2 ^ x) :: ('a :: len0) word) !! n) = (x = n)\"\n by sorry\nML \\\nfun setter_sanity_tac ctxt = \n let\n val gets = Proof_Context.get_thms ctxt\n val get = Proof_Context.get_thm ctxt\n in\n K (print_tac ctxt \"debut\")\nTHEN' \n (asm_full_simp_tac (ctxt addsimps\n [get \"find_position_def\", get \"size_of_arr_bits_def\"]))\nTHEN'\n(asm_full_simp_tac ((clear_simpset ctxt) addsimps\n (gets \"numeral.simps\")))\nTHEN' asm_full_simp_tac ctxt\n(* THEN' K (print_tac ctxt \"suite\") *)\nTHEN'\n (fn i => \nTRY (REPEAT_ALL_NEW (eresolve_tac ctxt @{thms exE conjE}) i))\n(* THEN' K (print_tac ctxt \"resuite\") *)\n THEN' (fn i => \nTRY (REPEAT_ALL_NEW (eresolve_tac ctxt @{thms less_zeroE less_SucE}) i)) \n\n (* THEN' K (print_tac ctxt \"coucou\") *)\nTHEN_ALL_NEW custom_get_set_different_field_tac (ctxt addsimps @{thms wesh})\n end\n\\\nML \\\nfun prove_thm ctxt assms concl tactic = \nlet\nval clean = HOLogic.mk_Trueprop o strip_atype\nval thm0 = mk_meta_imps (map clean assms) (concl |> clean) ctxt\nval names = Variable.add_free_names ctxt thm0 []\nin\nGoal.prove ctxt names [] thm0\n( fn {context, prems} => tactic context 1)\nend\n\\\n\nML \\\nval uvals = \nSymtab.lookup (UVals.get @{theory}) \"spread_dargentfull.c\"\n|> the\n(* Filter those with custom layouts*)\n |> get_uval_custom_layout_records\n\\\nML \\\n val uval0 = hd uvals\n\\\n\nML \\\nval (info0, lay0) = \ncase get_uval_layout uval0 of\nCustomLayout (info, \nConst (\"Option.option.Some\", _) $ \n( Const (\"Cogent.ptr_layout.LayRecord\", _) $ \nlayout)) => \n(info, \nlayout |> HOLogic.dest_list\n|> map HOLogic.dest_prod\n|> map (apfst HOLogic.dest_string)\n|> Symtab.make\n)\n\nval field0 = hd info0\nval layfield0 = Symtab.lookup lay0 (# name field0) |> the\n\\\n\nML \\\nval get_data =\nget_uval_name uval0 ^ \"_C.data_C\"\n\\\n\nML \\\nfun make_getter_sanity_thm ctxt layfield (field_info : field_layout) = \nlet\nval ass = \n @{term \n \"\\ lay data. \n (\\ x\\ set(layout_taken_bit_list lay). \n get_bit (data s) x = get_bit (data t) x)\n \"\n } $ layfield $ (Syntax.read_term ctxt get_data)\nval concl = @{term \"\\ getter . getter s = getter t\" }\n $ # isa_getter field_info\nin\nprove_thm ctxt [ass] concl getter_sanity_tac\nend\n\n\\\nML \\\nfun make_setter_sanity_thm ctxt layfield (field_info : field_layout) = \nlet\n\n val data = Syntax.read_term ctxt get_data\nval ass1 = \n @{term \n \"\\ data .x < size_of_arr_bits (data s) \n \"\n } $ data\nval ass2 = \n @{term \n \"\\ lay .x \\ set (layout_taken_bit_list lay) \n \"\n } $ layfield\nval concl = @{term \"\\ data setter . \n raw_get_bit (data (setter s b)) x = raw_get_bit (data s) x\" }\n $ data\n $ # isa_setter field_info\nin\nprove_thm ctxt [ass1, ass2] concl (fn ctxt => fn _ => print_tac ctxt \"coucuo\" THEN cheat_tactic ctxt)(* setter_sanity_tac *)\nend\n\\\n\nML \\\nfun make_getset_sanity_thms ctxt (uval : field_layout uval) : (thm * thm) list =\nlet\nval (info, lays) = \ncase get_uval_layout uval of\nCustomLayout (info, \nConst (\"Option.option.Some\", _) $ \n( Const (\"Cogent.ptr_layout.LayRecord\", _) $ \nlayout)) => \n(info, \nlayout |> HOLogic.dest_list\n|> map HOLogic.dest_prod\n|> map (apfst HOLogic.dest_string)\n|> Symtab.make\n)\nin\nmap (\nfn field => \nlet val lay = Symtab.lookup lays (# name field) |> the in\n(make_getter_sanity_thm ctxt lay field,\nmake_setter_sanity_thm ctxt lay field)\nend\n)\n \n info\n\nend\n\\\n\nlemma raw_get_bit_eq : \"raw_get_bit x n = raw_get_bit y n \\ get_bit x n = get_bit y n\"\n by sorry\n\nlemma find_pos_split : \" P (find_position q x)\n = ((\\ p r. find_position q x = (p, r) \\\nr < q \\ p < n div q \\ P (p, r))\n\\ (\\ r. find_position q x = (n div q, r) \\ r < n mod q \\ P ( (n div q), r) )\n\\ (\\ p r. find_position q x = (p, r) \\ (x \\ n \\ q = 0) \\ P ( p, r) )\n)\n\"\n by sorry\n\nlemma \"x < size_of_arr_bits (data_C s) \\\n x \\ set (layout_taken_bit_list (LayBitRange (64, 2))) \\\n get_bit (data_C (deref_d21_set_b s b)) x = get_bit (data_C s) x \"\n apply(rule raw_get_bit_eq )\napply(simp add:raw_get_bit_def)\napply( split find_pos_split[of _ _ _ 32])\n\nend\n\nlemma \"x < size_of_arr_bits (data_C s) \\\n x \\ set (layout_taken_bit_list\n (LayVariant (Suc 0, Suc 0) [(''A'', 0, LayBitRange (Suc 0, 0)), (''B'', Suc 0, LayBitRange (Suc 0, 67))])) \\\n raw_get_bit (data_C (deref_d14_set_a s b)) x = raw_get_bit (data_C s) x \"\n apply(tactic \\setter_sanity_tac @{context} 1\\ )\n(* ca ne marche pas ! *)\n\nlemma \"x < size_of_arr_bits (data_C s) \\\n x \\ set (layout_taken_bit_list (LayBitRange (64, 2))) \\\n raw_get_bit (data_C (deref_d21_set_b s b)) x = raw_get_bit (data_C s) x \"\napply(tactic \\setter_sanity_tac @{context} 1\\ )\n\nML \\\nval thms = make_getset_sanity_thms @{context} uval0\n\\\n\nend\n\n\nend\n", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/bucket/SpreadGetSet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.285246173780828}} {"text": "theory SNS_IAS_Eduroam_Spoofing\nimports \n Iptables_Semantics.Parser\nbegin\n\n\nsection\\Example: Eduroam and sns.ias Firewall Script\\\n\ndefinition \"everything_but_my_ip = all_but_those_ips [(ipv4addr_of_dotdecimal (131,159,207,206), 32)]\"\n\n\ntext\\Incoming: everything but my IP\\\ndefinition \"ipassignment_incoming = [(Iface ''wlan0'', everything_but_my_ip), (Iface ''lo'', [(0,0)])]\"\n\nlemma \"ipassmt_sanity_nowildcards (map_of ipassignment_incoming)\" by eval\n\ntext\\Outgoing: only my IP\\\ndefinition \"ipassignment_outgoing = [(Iface ''wlan0'', [(ipv4addr_of_dotdecimal (131,159,207,206), 32)]), (Iface ''lo'', [(0,0)])]\"\n\nlemma \"ipassmt_sanity_nowildcards (map_of ipassignment_outgoing)\" by eval\n\nparse_iptables_save eduroam_fw=\"eduroam_iptables-save\"\n\nthm eduroam_fw_def\nthm eduroam_fw_INPUT_default_policy_def\n\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_incoming (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\nvalue[code] \"unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)\"\n\nvalue[code] \"collect_ifaces (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\n\nlemma \"ipassmt_sanity_defined (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) (map_of_ipassmt ipassignment_incoming)\" by eval\nlemma \"ipassmt_sanity_defined (unfold_ruleset_OUTPUT eduroam_fw_OUTPUT_default_policy (map_of_string_ipv4 eduroam_fw)) (map_of_ipassmt ipassignment_outgoing)\" by eval\n\n\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_incoming (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_outgoing (unfold_ruleset_OUTPUT eduroam_fw_OUTPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\n\ntext\\The ruleset\\\nlemma \"check_simple_fw_preconditions (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))))\" by eval\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\"\nlemma \"simple_fw_valid (to_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall (lower_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\" by eval\n\n\ntext\\We do not need to call things such as @{const transform_optimize_dnf_strict} because the\n firewall already is in @{const normalized_nnf_match} (required for @{const no_spoofing_iface})\\\nlemma \"transform_optimize_dnf_strict (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) =\n unfold_ruleset_INPUT action.Drop (map_of_string_ipv4 eduroam_fw)\" by eval\n\ntext\\The ruleset prevents spoofed incoming packets\\\nlemma \"no_spoofing_iface (Iface ''wlan0'')\n (map_of_ipassmt ipassignment_incoming) (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\" by eval\n\n\ntext\\Ruleset does not prevent that I'm spoofing (which is not necessary anyways since I need root right to spoof, which \n would also enable me to deactivate the firewall). This is only a one-user laptop!\\\n\nlemma \"transform_optimize_dnf_strict (unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) =\n unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)\" by eval\n\nlemma \"\\ no_spoofing_iface (Iface ''wlan0'')\n (map_of_ipassmt ipassignment_outgoing) (unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\" by eval\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Examples/sns.ias.edu/SNS_IAS_Eduroam_Spoofing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.2852461667911226}} {"text": "(*\n * Copyright 2022, Proofcraft Pty Ltd\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Named_Eta_Test\nimports Lib.Named_Eta\nbegin\n\nexperiment\nbegin\n\ndeclare [[eta_contract=false]] (* for display only, it does not affect terms *)\n\n(* tactical invocation example *)\nschematic_goal\n \"\\y. ?Q y False \\ ?P y (\\x. f x)\"\n apply (tactic \\named_eta_tac \"x\" @{context}\\)\n apply assumption\n done\n\n(* method invocation example *)\nschematic_goal\n \"\\y. ?Q y False \\ ?P y (\\x. f x)\"\n apply (named_eta x)\n apply assumption\n done\n\nlemma\n \"P x (\\z. g (\\x. f x) z)\"\n \"\\P z. Q z \\ P (\\x. f x)\"\n apply -\n (* only affects one subgoal *)\n prefer 2\n apply (named_eta x)\n prefer 2\n (* only contract \"z\" *)\n apply (named_eta z)\n (* now only contract \"x\" *)\n apply (named_eta x)\n oops\n\nlemma (* nested lambdas *)\n \"\\ X; P (\\x. (f (\\x. g y x))) \\ \\ P (\\x. (f (\\x. g y x)))\"\n apply (named_eta x)\n apply assumption\n done\n\nML \\\n (* nameless abstractions: *)\n val t = Abs (\"\", @{typ bool}, @{term \"f (\\x. g x) :: bool \\ bool\"} $ Bound 0)\n val ct = Thm.cterm_of @{context} t\n (* contracts only the nameless \"a\" lambda: *)\n val thm = Named_Eta.named_eta_conv \"\" @{context} ct\n\\\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/test/Named_Eta_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.285220232519147}} {"text": "(* Title: Notions of Topology for C2KA\n Author: Maxime Buyse , 2019\n Maintainers: Maxime Buyse and Jason Jaskolka \n*)\n\nsection \\Notions of Topology for \\CCKAabbrv \\label{sec:topology}\\\n\ntext \\\nOrbits, stabilisers, and fixed points are notions that allow us to perceive a kind of topology of a system \nwith respect to the stimulus-response relationships among system agents. In this context, the term ``topology'' \nis used to capture the relationships (influence) and connectedness via stimuli of the agents in a distributed \nsystem. It intends to capture a kind of reachability in terms of the possible behaviours for a given agent.\n\nA \\CCKAabbrv consists of two semimodules~$\\ActSemimodule$ and~$\\OutSemimodule$ for which we have a \n\\leftAct{\\stim}~$\\lSact$ and a \\rightAct{\\cka}~$\\rKact$. Therefore, there are two complementary notions of orbits, \nstabilisers, and fixed points within the context of agent behaviours and stimuli, respectively. In this way, one \ncan use these notions to think about distributed systems from two different perspectives, namely the behavioural \nperspective provided by the action of stimuli on agent behaviours described by~$\\ActSemimodule$ and the external \nevent (stimulus) perspective provided by the action of agent behaviours on stimuli described by~$\\OutSemimodule$. \nIn this section, only the treatment of these notions with respect to the \\leftSemimodule{\\stim}~$\\ActSemimodule$ \nand agent behaviours is provided. The same notions for the \\rightSemimodule{\\cka}~$\\OutSemimodule$ and stimuli \ncan be provided in a very similar way.\n\nWhen discussing the interplay between \\CCKAabbrv and the notions of orbits, stabilisers, and fixed points, the \npartial order of sub-behaviours~$\\CKAle$ is extended to sets in order to express sets of agent behaviours \nencompassing one another. For two subsets of agent behaviours~$A,B \\STleq \\CKAset$, we say that~$A$ \n\\emph{is encompassed by}~$B$ (or~$B$ \\emph{encompasses}~$A$), written~$\\CKAencompass{A}{B}$, if and only \nif~$\\biglnotation{\\forall}{a}{a \\in A}{\\lnotation{\\exists}{b}{b \\in B}{a \\CKAle b}}$. In essence,~$A \\CKAenc B$ \nindicates that every behaviour contained within the set~$A$ is a sub-behaviour of at least one behaviour in the \nset~$B$. The encompassing relation~$\\STIMenc$ for stimuli can be defined similarly. \n\nThroughout this section, let~$\\ActSemimodule$ be the unitary and zero-preserving \\leftSemimodule{\\stim} of a \n\\CCKAabbrv and let~$a \\in \\CKAset$.\n\\\n\ntheory Topology_C2KA\n imports C2KA\nbegin\n\nno_notation\ncomp (infixl \"\\\" 55)\nand rtrancl (\"(_\\<^sup>*)\" [1000] 999)\n\ntext \\\nThe locale \\emph{topology-c2ka} extends the axiomatisation of \\emph{c2ka} to support the notions of topology. \n\\\n\nlocale topology_c2ka = c2ka +\n fixes orbit :: \"'a::cka \\ 'a::cka set\" (\"Orb\")\n and strong_orbit :: \"'a::cka \\ 'a::cka set\" (\"Orb\\<^sub>S\")\n and stabiliser :: \"'a::cka \\ 'b::stimuli set\" (\"Stab\")\n and fixed :: \"'a::cka \\ bool\"\n and encompassing_relation_behaviours :: \"'a set \\ 'a set \\ bool\" (infix \"\\\\<^sub>\\\" 50)\n and encompassing_relation_stimuli :: \"'b set \\ 'b set \\ bool\" (infix \"\\\\<^sub>\\\" 50)\n and induced :: \"'a::cka \\ 'a::cka \\ bool\" (infix \"\\\" 50)\n and orbit_equivalent :: \"'a::cka \\ 'a::cka \\ bool\" (infix \"\\\\<^sub>\\\" 50)\n assumes orb_def: \"x \\ Orb(a) \\ (\\s. (s \\ a = x))\"\n and orbs_def: \"b \\ Orb\\<^sub>S(a) \\ Orb(b) = Orb(a)\"\n and stab_def: \"s \\ Stab(a) \\ s \\ a = a\"\n and fixed_def: \"fixed(a) \\ (\\s::'b. s\\\\

\\ s \\ a = a)\"\n and erb_def: \"A \\\\<^sub>\\ B \\ (\\a::'a. a \\ A \\ (\\b. b \\ B \\ a \\\\<^sub>\\ b))\"\n and ers_def: \"E \\\\<^sub>\\ F \\ (\\a::'b. a \\ E \\ (\\b. b \\ F \\ a \\\\<^sub>\\ b))\"\n and induced_def: \"a \\ b \\ b \\ Orb(a)\"\n and orbit_equivalent_def: \"a \\\\<^sub>\\ b \\ Orb(a) = Orb(b)\"\nbegin\n\nsubsection \\Orbits \\label{sub:orbits}\\\n\ntext \\\nThe \\emph{orbit} of~$a$ in~$\\stim$ is the set given by~$\\orb{a} = \\sets{\\lAct{a}{s}}{s \\in \\STIMset}$. The orbit of \nan agent~$a \\in \\CKAset$ represents the set of all possible behavioural responses from an agent behaving as~$a$ to \nany stimulus from~$\\stim$. In this way, the orbit of a given agent can be perceived as the set of all possible \nfuture behaviours for that agent. \n\\\n\n\ntext \\\nLemma \\emph{inf-K-enc-orb} provides an isotonicity law with respect to the orbits and the encompassing relation for agent behaviours.\n\\\n\nlemma inf_K_enc_orb: \"a \\\\<^sub>\\ b \\ Orb(a) \\\\<^sub>\\ Orb(b)\"\n unfolding erb_def orb_def\n using inf_K_next_behaviour by blast\n \ntext \\\nThe following lemmas provide a selection of properties regarding orbits and the encompassing relation for agent behaviours.\n\\\n\nlemma enc_orb_add: \"Orb(a) \\\\<^sub>\\ Orb(a + b)\"\n using inf_K_enc_orb inf_add_K_right by auto\n\nlemma enc_orb_exchange: \"Orb((a*b) ; (c*d)) \\\\<^sub>\\ Orb((a;c) * (b;d))\"\n using inf_K_enc_orb exchange_2 by blast\n\nlemma enc_orb_seq_par: \"Orb(a;b) \\\\<^sub>\\ Orb(a*b)\"\n using inf_K_enc_orb seq_inf_par by auto\n\nlemma enc_orb_add_seq_par: \"Orb(a;b + b;a) \\\\<^sub>\\ Orb(a*b)\"\n using inf_K_enc_orb add_seq_inf_par by auto\n\nlemma enc_orb_parseq: \"Orb((a*b);c) \\\\<^sub>\\ Orb(a*(b;c))\"\n using inf_K_enc_orb exchange_3 by blast\n\nlemma enc_orb_seqpar: \"Orb(a;(b*c)) \\\\<^sub>\\ Orb((a;b)*c)\"\n using inf_K_enc_orb exchange_4 by blast\n\nlemma enc_orb_seqstar_parstar: \"Orb(a\\<^sup>;) \\\\<^sub>\\ Orb(a\\<^sup>*)\"\n using inf_K_enc_orb seqstar_inf_parstar by auto\n\nlemma enc_orb_union: \"Orb(a) \\\\<^sub>\\ Orb(c) \\ Orb(b) \\\\<^sub>\\ Orb(c) \n\\ Orb(a) \\ Orb(b) \\\\<^sub>\\ Orb(c)\"\n unfolding erb_def \n by auto\n \nsubsection \\Stabilisers \\label{sub:stabilisers}\\\n\ntext \\\nThe \\emph{stabiliser} of~$a$ in~$\\stim$ is the set given by~$\\stab{a} = \\sets{s \\in \\STIMset}{\\lAct{a}{s} = a}$. \nThe stabiliser of an agent~$a \\in \\CKAset$ represents the set of stimuli which have no observable influence \n(or act as neutral stimuli) on an agent behaving as~$a$.\n\\ \n\ntext \\\nLemma \\emph{enc-stab-inter-add} provides a property regarding stabilisers and the encompassing relation for stimuli.\n\\\n\nlemma enc_stab_inter_add: \"Stab(a) \\ Stab(b) \\\\<^sub>\\ Stab(a + b)\"\n unfolding ers_def\n by (auto simp add: stab_def, rename_tac s, rule_tac x=\"s\" in exI, simp)\n \nsubsection \\Fixed Points \\label{sub:fixed_points}\\\n\ntext \\\nAn element~$a \\in \\CKAset$ is called a \\emph{fixed point} if~$\\lnotation{\\forall}{s}{s \\in \\STIMset \\STdiff \\set{\\Dstim}}{\\lAct{a}{s} = a}$.\\linebreak \nWhen an agent behaviour is a fixed point, it is not influenced by any stimulus other than the deactivation stimulus~$\\Dstim$. \nIt is important to note that since~$\\ActSemimodule$ is zero-preserving, every agent behaviour becomes inactive when subjected to the \ndeactivation stimulus~$\\Dstim$. Because of this, we exclude this special case when discussing fixed point agent behaviours.\n\\ \n\nlemma zerofix [simp]: \"s \\ 0 = 0\"\nproof -\n have \"0 = \\
\\ a\" by simp\n hence \"s \\ 0 = s \\ (\\
\\ a)\" by simp\n hence \"s \\ 0 = (s \\ \\
) \\ a\" by (simp only: lsemimodule3 [symmetric])\n thus \"s \\ 0 = 0\" by simp\nqed\n\ntext \\\nThe following lemmas provide a selection of properties regarding fixed agent behaviours.\n\\ \n\nlemma fixed_zero: \"fixed(0)\"\n unfolding fixed_def\n by simp\n\nlemma fixed_a_b_add: \"fixed(a) \\ fixed(b) \\ fixed(a + b)\"\n unfolding fixed_def\n by simp\n\nlemma fix_not_deactivation: \"s \\ a = a \\ \\(s,a) = \\
\\ a = 0\"\nproof -\n assume E: \"s \\ a = a \\ \\(s,a) = \\
\"\n hence \"s \\ (a;1) = a\" by simp\n hence \"(s\\a) ; (\\(s,a)\\1) = a\" by (simp only: cascadingaxiom)\n hence \"0 = a\" by (simp add: E)\n thus ?thesis by auto\nqed\n\nlemma fixed_a_b_seq: \"fixed(a) \\ fixed(b) \\ fixed(a ; b)\"\n unfolding fixed_def\nproof (rule impI)\n assume hyp: \"(\\s. s \\ \\
\\ s \\ a = a) \\ (\\s. s \\ \\
\\ s \\ b = b)\"\n have C1: \"(\\s. \\(s,a) = \\
\\ s \\ \\
\\ s \\ (a ; b) = a ; b)\"\n proof -\n have E: \"(\\s. s \\ \\
\\ \\(s,a) = \\
\\ s \\ (a ; b) = 0)\" by simp\n hence \"(\\s. s \\ \\
\\ \\(s,a) = \\
\\ s \\ a = a \\ \\(s,a) = \\
)\" \n by (simp add: hyp)\n moreover have \"(\\s. s \\ a = a \\ \\(s,a) = \\
\\ a = 0)\" \n by (simp add: fix_not_deactivation)\n ultimately have \"(\\s. s \\ \\
\\ \\(s,a) = \\
\\ a = 0)\" by auto\n thus ?thesis by (auto simp add: E)\n qed\n moreover have C2: \"(\\s. \\(s,a) \\ \\
\\ s \\ \\
\\ s \\ (a ; b) = a ; b)\" \n by (simp add: hyp)\n ultimately show \"(\\s. s \\ \\
\\ s \\ (a ; b) = a ; b)\" by blast\nqed\n\nsubsection \\Strong Orbits and Induced Behaviours \\label{sub:strong_orbits_and_induced_behaviours}\\\n\ntext \\\nThe \\emph{strong orbit} of~$a$ in~$\\stim$ is the set given by~$\\orbS{a} = \\sets{b \\in \\CKAset}{\\orb{b} = \\orb{a}}$. \nTwo agents are in the same strong orbit, denoted~$a \\CKAsim b$ for~$a,b \\in \\CKAset$, if and only if their orbits are \nidentical. This is to say when~$a \\CKAsim b$, if an agent behaving as~$a$ is influenced by a stimulus to behave as~$b$, \nthen there exists a stimulus which influences the agent, now behaving as~$b$, to revert back to its original behaviour~$a$. \n\nThe influence of stimuli on agent behaviours is called the \\emph{induced behaviours} via stimuli. Let~$a,b \\in \\CKAset$ \nbe agent behaviours with~$a \\neq b$. We say that~$b$ is \\emph{induced by~$a$ via stimuli} (denoted by~$\\induced{b}{a}$) \nif and only if~$\\lnotation{\\exists}{s}{s \\in \\STIMset}{\\lAct{a}{s} = b}$. The notion of induced behaviours allows us to make \nsome predictions about the evolution of agent behaviours in a given system by providing some insight into how different agents \ncan respond to any stimuli.\n\\ \n\ntext \\\nLemma \\emph{fixed-not-induce} states that if an agent has a fixed point behaviour, then it does not induce any agent behaviours via stimuli besides the inactive behaviour~$0$.\n\\ \n\nlemma fixed_not_induce: \"fixed(a) \\ (\\b. b \\ 0 \\ b \\ a \\ \\(a \\ b))\"\nproof -\n have \"\\s. s = \\
\\ s \\ \\
\\ (\\t. t \\ \\
\\ t \\ a = a) \\ s \\ a \\ 0 \n\\ s \\ a \\ a \\ False\"\n by (erule disjE, simp_all)\n hence \"\\s. (\\t. t \\ \\
\\ t \\ a = a) \\ s \\ a \\ 0 \\ s \\ a \\ a \\ False\"\n by simp\n thus ?thesis \n unfolding fixed_def induced_def orb_def\n by auto\nqed\n\ntext \\\nLemma \\emph{strong-orbit-both-induced} states that all agent behaviours which belong to the same strong orbit are mutually induced via some (possibly different) stimuli.\nThis is to say that if two agent behaviours are in the same strong orbit, then there exists inverse stimuli for each agent behaviour in a \nstrong orbit allowing an agent to revert back to its previous behaviour.\n\\ \n\nlemma in_own_orbit: \"a \\ Orb(a)\"\n unfolding orb_def\n by (rule_tac x=\"\\\" in exI, simp)\n\nlemma strong_orbit_both_induced: \"a \\\\<^sub>\\ b \\ a \\ b \\ b \\ a\"\n unfolding orbit_equivalent_def induced_def\n by (blast intro: in_own_orbit)\n\ntext \\\nLemma \\emph{strong-orbit-induce-same} states that if two agent behaviours are in the same strong orbit, then a third behaviour can be induced via stimuli by either of \nthe behaviours within the strong orbit. This is to say that each behaviour in a strong orbit can induce the same set of behaviours\n(perhaps via different stimuli).\n\\ \n\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/C2KA_DistributedSystems/Topology_C2KA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.285220232519147}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepTactic\nimports SepInv\nbegin\n\nsection \"sep_point_tac\"\n\ndefinition sep_conj_extract :: \"heap_assert \\ heap_assert\" where\n \"sep_conj_extract \\ id\"\n\ndefinition sep_points :: \"heap_assert \\ heap_assert\" where\n \"sep_points P \\ P \\\\<^sup>* sep_true\"\n\nlemma sep_conj_extract1D:\n \"(P \\\\<^sup>* Q) s \\ sep_conj_extract (P \\\\<^sup>* Q) s\"\n by (simp add: sep_conj_extract_def)\n\nlemma sep_conj_extract2D:\n \"sep_conj_extract P s \\ P s \\ (sep_conj_extract P \\\\<^sup>* sep_true) s\"\n by (auto simp: sep_conj_extract_def elim: sep_conj_sep_true)\n\nlemma sep_conj_extract_assoc:\n \"sep_conj_extract ((P \\\\<^sup>* Q) \\\\<^sup>* R) = sep_conj_extract (P \\\\<^sup>* (Q \\\\<^sup>* R))\"\n by (simp add: sep_conj_ac)\n\nlemma sep_conj_extract_decomposeD:\n \"(sep_conj_extract (P \\\\<^sup>* Q) \\\\<^sup>* sep_true) s \\ sep_points P s \\\n (sep_conj_extract Q \\\\<^sup>* sep_true) s\"\n apply (rule conjI)\n apply(simp add: sep_conj_extract_def sep_points_def sep_conj_ac)\n apply(erule (1) sep_conj_impl, simp)\n apply(simp add: sep_conj_extract_def sep_conj_ac)\n apply(subst (asm) sep_conj_assoc [symmetric])\n apply(subst (asm) sep_conj_com)\n apply(subst (asm) sep_conj_assoc)\n apply(erule (1) sep_conj_impl)\n apply simp\n done\n\nlemma sep_conj_extract_decomposeD2:\n \"(sep_conj_extract P \\\\<^sup>* sep_true) s \\ sep_points P s\"\n by (simp add: sep_conj_extract_def sep_points_def)\n\nlemma sep_point_mapD:\n \"sep_points (p \\\\<^sup>i\\<^sub>g v) s \\ (p \\\\<^sup>i\\<^sub>g v) s\"\n by (simp add: sep_points_def sep_map_inv_def sep_map'_inv_def sep_map'_def\n sep_conj_ac)\n\nlemma sep_point_map_excD:\n \"sep_points (p \\\\<^sub>g v) s \\ (p \\\\<^sub>g v) s\"\n by (simp add: sep_points_def sep_map'_def)\n\nlemma sep_point_otherD:\n \"sep_points P s \\ True\"\n by (rule TrueI)\n\nML \\\n\nval sep_point_ds = [@{thm sep_point_mapD}, @{thm sep_point_map_excD}]\n\nfun sep_point_tacs ds ctxt = [\n REPEAT1 (dresolve_tac ctxt [@{thm sep_conj_extract1D}] 1),\n REPEAT1 (dresolve_tac ctxt [@{thm sep_conj_extract2D}] 1),\n clarify_tac ctxt 1,\n TRY (full_simp_tac (put_simpset HOL_ss ctxt addsimps\n [@{thm sep_conj_extract_assoc}]) 1),\n REPEAT (dresolve_tac ctxt [@{thm sep_conj_extract_decomposeD},\n @{thm sep_conj_extract_decomposeD2}] 1 THEN\n clarify_tac ctxt 1),\n TRY (full_simp_tac ctxt 1),\n REPEAT (dresolve_tac ctxt (sep_point_ds@ds) 1),\n REPEAT (dresolve_tac ctxt [@{thm sep_point_otherD}] 1),\n TRY (full_simp_tac ctxt 1)\n ]\n\nfun sep_point_tac ds ctxt = EVERY (sep_point_tacs ds ctxt)\n\\\n\nmethod_setup sep_point_tac =\n \"Attrib.thms >> (fn thms => Method.SIMPLE_METHOD o sep_point_tac thms)\"\n \"extract points-to facts from separation assertions in assumptions\"\n\nlemma \"(P \\\\<^sup>* p \\\\<^sub>g v \\\\<^sup>* Q) s \\ (p \\\\<^bsub>g\\<^esub> v) s\"\n by sep_point_tac\n\n\nsection \"sep_exists_tac\"\n\nML\\\nfun sep_exists_tac ctxt = full_simp_tac\n (put_simpset HOL_ss ctxt addsimps [@{thm \"sep_conj_exists1\"}, @{thm \"sep_conj_exists2\"}])\n\\\n\nmethod_setup sep_exists_tac =\n \"Scan.succeed (Method.SIMPLE_METHOD' o sep_exists_tac)\"\n \"push existentials inside separation assertions to the outside\"\n\nlemma \"(P \\\\<^sup>* (\\s. (\\x. Q x s))) s \\ \\x. (P \\\\<^sup>* Q x) s\"\n by sep_exists_tac\n\nsection \"sep_select_tac\"\n\ndefinition sep_mark :: \"heap_assert \\ heap_assert\" where\n \"sep_mark \\ id\"\n\ndefinition sep_mark2 :: \"heap_assert \\ heap_assert\" where\n \"sep_mark2 \\ id\"\n\nlemma sep_mark2_id:\n \"sep_mark2 P = P\"\n by (simp add: sep_mark2_def)\n\nlemma sep_markI:\n \"(\\ \\\\<^sup>* sep_mark (P \\\\<^sup>* Q)) s \\ (P \\\\<^sup>* Q) s\"\n by (simp add: sep_mark_def sep_conj_empty)\n\nlemma sep_mark_match:\n \"(R \\\\<^sup>* sep_mark2 P \\\\<^sup>* Q) s \\ (R \\\\<^sup>* sep_mark (P \\\\<^sup>* Q)) s\"\n by (simp add: sep_mark_def sep_mark2_def)\n\nlemma sep_mark_match2:\n \"(R \\\\<^sup>* sep_mark2 P) s \\ (R \\\\<^sup>* sep_mark P) s\"\n by (simp add: sep_mark_def sep_mark2_def)\n\nlemma sep_mark_mismatch:\n \"((R \\\\<^sup>* P) \\\\<^sup>* sep_mark Q) s \\ (R \\\\<^sup>* sep_mark (P \\\\<^sup>* Q)) s\"\n by (simp add: sep_mark_def sep_conj_ac)\n\nlemma sep_mark_mismatch2:\n \"(R \\\\<^sup>* P) s \\ (R \\\\<^sup>* sep_mark P) s\"\n by (simp add: sep_mark_def)\n\nlemma sep_emp_rem:\n \"P s \\ (\\ \\\\<^sup>* P) s\"\n by (simp add: sep_conj_empty)\n\nlemma sep_mark2_left:\n \"(P \\\\<^sup>* (sep_mark2 Q \\\\<^sup>* R)) = (sep_mark2 Q \\\\<^sup>* (P \\\\<^sup>* R))\"\n by (rule sep_conj_left_com)\n\nlemma sep_mark2_left2:\n \"(P \\\\<^sup>* sep_mark2 Q) = (sep_mark2 Q \\\\<^sup>* P)\"\n by (rule sep_conj_com)\n\nML \\\n\n(* Replace all occurrences of an underscore that does not have an alphanumeric\n on either side of it *)\nlocal\n val dummy_char = #\" \";\n fun get_next (x::_) = x\n | get_next [] = dummy_char;\n fun nth_id n = \"SEPTAC\"^(Int.toString n);\n\n fun ok_char c = not (Char.isAlphaNum c);\n\n fun can_replace (prev,cur,last) =\n (ok_char prev) andalso (cur = #\"_\") andalso (ok_char last);\n\n fun replace_usc n prev_char (x::xs) =\n let val (xs', ys) = replace_usc (n+1) x xs\n in\n if can_replace (prev_char,x,get_next xs)\n then (nth_id n::xs', nth_id n::ys)\n else (String.str x::xs', ys)\n end\n | replace_usc _ _ [] = ([],[])\nin\n val rusc = apfst String.concat o replace_usc 0 dummy_char o String.explode\nend;\n\n(* some tests *)\nrusc \"(_ +\\<^sub>p _) \\ _\";\nrusc \"_ \\\\<^sub>_ _\";\nrusc \"_\";\nrusc \"_ O_o _\"\n\\\n\nML\\\n\nfun sep_select_tacs s ctxt =\n let val (str, vars) = rusc s\n val subst = [((Lexicon.read_indexname \"P\", Position.none), str)]\n val fixes = map (fn v => (Binding.name v, NONE, Mixfix.NoSyn)) vars\n in\n [\n TRY (simp_tac (put_simpset HOL_ss ctxt addsimps [@{thm sep_conj_assoc}]) 1),\n resolve_tac ctxt [@{thm sep_markI}] 1,\n REPEAT (Rule_Insts.res_inst_tac ctxt subst fixes @{thm sep_mark_match} 1 ORELSE\n (Rule_Insts.res_inst_tac ctxt subst fixes @{thm sep_mark_match2} 1 ORELSE\n resolve_tac ctxt [@{thm sep_mark_mismatch}] 1 ORELSE\n resolve_tac ctxt [@{thm sep_mark_mismatch2}] 1)),\n TRY (simp_tac (put_simpset HOL_ss ctxt addsimps [@{thm sep_conj_assoc}]) 1),\n resolve_tac ctxt [@{thm sep_emp_rem}] 1,\n TRY (simp_tac (put_simpset HOL_ss ctxt addsimps [@{thm sep_mark2_left},\n @{thm sep_mark2_left2}]) 1),\n TRY (simp_tac (put_simpset HOL_ss ctxt addsimps [@{thm sep_mark2_id}]) 1)\n ]\n end\n\nfun sep_select_tac s ctxt = SELECT_GOAL (EVERY (sep_select_tacs s ctxt))\n\nfun lift_parser p (ctxt,ts) =\n let val (r, ts') = p ts\n in (r, (ctxt,ts')) end\n\\\n\nmethod_setup sep_select_tac =\n \\lift_parser Args.name >> (fn s => Method.SIMPLE_METHOD' o sep_select_tac s)\\\n \"takes a target conjunct in the goal and reorders it to the front\"\n\nlemma\n \"\\R x f n. ((P::heap_assert) \\\\<^sup>* fac x n \\\\<^sup>* R (f x)) s\"\n apply(sep_select_tac \"fac _ _\")\n apply(sep_select_tac \"R _\")\n apply(sep_select_tac \"fac x _\")\n apply(sep_select_tac \"R _\")\n oops\n\nlemma\n \"((P::heap_assert) \\\\<^sup>* fac x n) s\"\n apply(sep_select_tac \"fac _ _\")\n oops\n\nlemma\n \"((P::heap_assert) \\\\<^sup>* long_name) s\"\n apply(sep_select_tac \"long_name\")\n oops\n\nconsts c_guard :: \"'a::c_type ptr_guard\"\n\nlemma sep_heap_update'_hrs:\n \"(c_guard \\\\<^sub>s\\<^sup>i p \\\\<^sup>* (p \\\\<^sup>i\\<^sub>c_guard v \\\\<^sup>* P)) (lift_state s) \\\n P (lift_state (hrs_mem_update (heap_update p (v::'a::mem_type)) s))\"\n by (case_tac s)\n (simp add: hrs_mem_update_def, erule sep_heap_update')\n\nlemma sep_map_lift_wp_hrs:\n \"\\ \\v. (p \\\\<^sup>i\\<^sub>c_guard v \\\\<^sup>* (p \\\\<^sup>i\\<^sub>c_guard v \\\\<^sup>* P v)) (lift_state s) \\\n \\ P (lift (hrs_mem s) (p::'a::mem_type ptr)) (lift_state s)\"\n by (case_tac s)\n (simp add: hrs_mem_def, erule sep_map_lift_wp)\n\nlemma ptr_retyp_sep_cut'_wp_hrs:\n \"\\ (sep_cut' (ptr_val p) (size_of TYPE('a)) \\\\<^sup>* (c_guard \\\\<^sub>s\\<^sup>i p \\\\<^sup>* P))\n (lift_state s); c_guard (p::'a::mem_type ptr) \\\n \\ P (lift_state (hrs_htd_update (ptr_retyp p) s))\"\n by (case_tac s)\n (simp add: hrs_htd_update_def, erule (1) ptr_retyp_sep_cut'_wp)\n\nML \\\n\nfun destruct bs (Bound n) = Free (List.nth (bs,n))\n | destruct bs (Abs (s,ty,t)) = destruct ((s,ty)::bs) t\n | destruct bs (l$r) = destruct bs l $ destruct bs r\n | destruct _ x = x\n\nfun schems (Abs (_,_,t)) = schems t\n | schems (l$r) = schems l + schems r\n | schems (Var _) = 1\n | schems _ = 0\n\nfun hrs_mem_update (Const (@{const_name \"HeapRawState.hrs_mem_update\"},_)$_$s) = SOME s\n | hrs_mem_update _ = NONE\n\nfun hrs_htd_update (Const (@{const_name \"HeapRawState.hrs_htd_update\"},_)$_$s) = SOME s\n | hrs_htd_update _ = NONE\n\nfun lift_state_arg _ _ (Const (@{const_name \"TypHeap.lift_state\"},_)$s) = SOME s\n | lift_state_arg thy nc (l$r) =\n (case lift_state_arg thy nc r of\n SOME s => if nc orelse hrs_mem_update s <> NONE orelse\n hrs_htd_update s <> NONE then SOME s\n else lift_state_arg thy nc l\n | NONE => lift_state_arg thy nc l)\n | lift_state_arg thy nc (Abs (_,_,t)) =\n lift_state_arg thy nc t\n | lift_state_arg _ _ _ =\n NONE (*error (Sign.string_of_term thy s)*)\n\nfun term_of_thm thm = Thm.term_of (Thm.cprop_of thm)\n\nfun lift_tac ctxt s old_schems =\n Rule_Insts.res_inst_tac ctxt [((Lexicon.read_indexname \"s\",Position.none),s)] [] @{thm sep_map_lift_wp_hrs} 1 THEN\n (fn thm => if schems (term_of_thm thm) = old_schems then all_tac thm\n else no_tac thm)\n\nfun heap_update_tac ctxt s =\n Rule_Insts.res_inst_tac ctxt [((Lexicon.read_indexname \"s\",Position.none),s)] [] @{thm sep_heap_update'_hrs} 1\n\nfun ptr_retyp_tac ctxt s =\n Rule_Insts.res_inst_tac ctxt [((Lexicon.read_indexname \"s\",Position.none),s)] [] @{thm ptr_retyp_sep_cut'_wp_hrs} 1\n\nfun sep_wp_step_tac' ctxt lift_only s old_schems = let\n fun prt s = (\n case s of\n Free (a, _) => a\n | _ => raise TERM (\"Not a free variable\",[s]))\n val state = prt s\n val step = case hrs_mem_update s of\n SOME s => heap_update_tac ctxt (prt s)\n | NONE => case hrs_htd_update s of\n SOME s => ptr_retyp_tac ctxt (prt s)\n | NONE => no_tac\nin\n TRY (lift_tac ctxt state old_schems) THEN (if lift_only then all_tac else step)\nend\n\nfun sep_wp_step_tac ctxt lift_only thm = let\n val t = term_of_thm thm\n val thy = Proof_Context.theory_of ctxt\n val old_schems = schems t\n val s = lift_state_arg thy lift_only (destruct [] t)\nin\n (case s of\n SOME state => sep_wp_step_tac' ctxt lift_only state old_schems\n | NONE => no_tac) thm\nend\n\nfun sep_wp_tac ctxt = (REPEAT (sep_wp_step_tac ctxt false)) THEN sep_wp_step_tac ctxt true\n\n\\\n\nmethod_setup sep_wp_tac =\n \"Scan.succeed (Method.SIMPLE_METHOD o sep_wp_tac)\"\n \"apply WP separation logic rules to goal\"\n\n\n(* see testfiles/sep_example_pre_list.thy for a more detailed example *)\nlemma\n \"((\\z. lift (hrs_mem s) (p::(32 word) ptr) + 1 = 2) \\\\<^sup>* P) (lift_state s)\"\n apply sep_wp_tac\n oops\n\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/SepTactic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.285220232519147}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Refinement/Runs.thy (Isabelle/HOL 2016-1)\n ID: $Id: Runs.thy 132773 2016-12-09 15:30:22Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n \n Protocol runs: local state of executing protocol roles\n\n Copyright (c) 2010-2016 Christoph Sprenger \n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Protocol runs\\\n\ntheory Runs imports Atoms\nbegin\n\n\n(******************************************************************************)\nsubsection \\Runs\\\n(******************************************************************************)\n\ntext \\Define some typical roles.\\\n\ndatatype role_t = Init | Resp | Serv\n\nfun \n roleIdx :: \"role_t \\ nat\"\nwhere\n \"roleIdx Init = 0\"\n| \"roleIdx Resp = 1\"\n| \"roleIdx Serv = 2\"\n\n\ntext \\The type of runs is a partial function from run identifiers to \na triple consisting of a role, a list of agents, and a list of atomic messages \nrecorded during the run's execution. \n\nThe type of roles could be made a parameter for more flexibility.\\\n\ntype_synonym\n rid_t = \"fid_t\"\n\ntype_synonym\n runs_t = \"rid_t \\ role_t \\ agent list \\ atom list\"\n\n\nsubsection \\Run abstraction\\\n(******************************************************************************)\n\ntext \\Define a function that lifts a function on roles and atom lists \nto a function on runs.\\\n\ndefinition \n map_runs :: \"([role_t, atom list] \\ atom list) \\ runs_t \\ runs_t\"\nwhere\n \"map_runs h runz rid \\ case runz rid of\n None \\ None\n | Some (rol, agts, al) \\ Some (rol, agts, h rol al)\"\n\nlemma map_runs_empty [simp]: \"map_runs h Map.empty = Map.empty\"\nby (rule ext) (auto simp add: map_runs_def)\n\nlemma map_runs_dom [simp]: \"dom (map_runs h runz) = dom runz\"\nby (auto simp add: map_runs_def split: option.split_asm)\n\nlemma map_runs_update [simp]:\n \"map_runs h (runz(R \\ (rol, agts, al))) \n = (map_runs h runz)(R \\ (rol, agts, h rol al))\"\nby (auto simp add: map_runs_def)\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Refinement/Runs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2851784719394057}} {"text": "theory ArityAnalysisImpl\nimports ArityAnalysisFix ArityAnalysisPreImpl\nbegin\n\ndefinition Real_Aexp where \"Real_Aexp = ArityAnalysisPreImpl.Aexp ArityAnalysis.Afix\"\n\nlemma heap_exp_are_smaller: \"e \\ snd ` set \\ \\ size e \\ size_list (\\p. size (snd p)) \\\"\n by (metis (mono_tags) imageE order_refl size_list_estimation')\n\ninterpretation ArityAnalysisPreImpl ArityAnalysis.Afix where \"Aexp = ArityAnalysisImpl.Real_Aexp\"\n unfolding Real_Aexp_def atomize_conj\n apply (rule conjI[OF _ refl])\n apply default\n apply (perm_simp, rule)\n apply (rule ArityAnalysisFix.Afix_cong)\n apply (metis heap_exp_are_smaller)\n apply assumption\n done\n\ninterpretation ArityAnalysis Aexp.\n\nlemma Aexp_edom': \"edom (Aexp e\\a) \\ fv e\"\n by (nominal_induct arbitrary: a rule: exp_strong_induct) fastforce+\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/ArityAnalysisImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2851784660131493}} {"text": "section \\Final Instantiation of Algorithms Related to Complementation\\\n\ntheory Complementation_Final\nimports\n \"Complementation_Implement\"\n \"Formula\"\n \"Transition_Systems_and_Automata.NBA_Translate\"\n \"Transition_Systems_and_Automata.NGBA_Algorithms\"\n \"HOL-Library.Multiset\"\nbegin\n\n subsection \\Syntax\\\n\n (* TODO: this syntax has unnecessarily high inner binding strength, requiring extra parentheses\n the regular let syntax correctly uses inner binding strength 0: (\"(2_ =/ _)\" 10) *)\n no_syntax \"_do_let\" :: \"[pttrn, 'a] \\ do_bind\" (\"(2let _ =/ _)\" [1000, 13] 13)\n syntax \"_do_let\" :: \"[pttrn, 'a] \\ do_bind\" (\"(2let _ =/ _)\" 13)\n\n subsection \\Hashcodes on Complement States\\\n\n definition \"hci k \\ uint32_of_nat k * 1103515245 + 12345\"\n definition \"hc \\ \\ (p, q, b). hci p + hci q * 31 + (if b then 1 else 0)\"\n definition \"list_hash xs \\ fold (xor \\ hc) xs 0\"\n\n lemma list_hash_eq:\n assumes \"distinct xs\" \"distinct ys\" \"set xs = set ys\"\n shows \"list_hash xs = list_hash ys\"\n proof -\n have \"mset (remdups xs) = mset (remdups ys)\" using assms(3)\n using set_eq_iff_mset_remdups_eq by blast \n then have \"mset xs = mset ys\" using assms(1, 2) by (simp add: distinct_remdups_id)\n have \"fold (xor \\ hc) xs = fold (xor \\ hc) ys\"\n apply (rule fold_multiset_equiv)\n apply (simp_all add: fun_eq_iff ac_simps)\n using \\mset xs = mset ys\\ .\n then show ?thesis unfolding list_hash_def by simp\n qed\n\n definition state_hash :: \"nat \\ Complementation_Implement.state \\ nat\" where\n \"state_hash n p \\ nat_of_hashcode (list_hash p) mod n\"\n\n lemma state_hash_bounded_hashcode[autoref_ga_rules]: \"is_bounded_hashcode state_rel\n (gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\))) state_hash\"\n proof\n show [param]: \"(gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\)), (=)) \\ state_rel \\ state_rel \\ bool_rel\" by autoref\n show \"state_hash n xs = state_hash n ys\" if \"xs \\ Domain state_rel\" \"ys \\ Domain state_rel\"\n \"gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list))\n (list_map_lookup (=)) (prod_eq (=) (=)) xs ys\" for xs ys n\n proof -\n have 1: \"distinct (map fst xs)\" \"distinct (map fst ys)\"\n using that(1, 2) unfolding list_map_rel_def list_map_invar_def by (auto simp: in_br_conv)\n have 2: \"distinct xs\" \"distinct ys\" using 1 by (auto intro: distinct_mapI)\n have 3: \"(xs, map_of xs) \\ state_rel\" \"(ys, map_of ys) \\ state_rel\"\n using 1 unfolding list_map_rel_def list_map_invar_def by (auto simp: in_br_conv)\n have 4: \"(gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\)) xs ys, map_of xs = map_of ys) \\ bool_rel\" using 3 by parametricity\n have 5: \"map_to_set (map_of xs) = map_to_set (map_of ys)\" using that(3) 4 by simp\n have 6: \"set xs = set ys\" using map_to_set_map_of 1 5 by blast\n show \"state_hash n xs = state_hash n ys\" unfolding state_hash_def using list_hash_eq 2 6 by metis\n qed\n show \"state_hash n x < n\" if \"1 < n\" for n x using that unfolding state_hash_def by simp\n qed\n\n subsection \\Complementation\\\n\n schematic_goal complement_impl:\n assumes [simp]: \"finite (NBA.nodes A)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, op_translate (complement_4 A)) \\ ?R\"\n by (autoref_monadic (plain))\n concrete_definition complement_impl uses complement_impl\n\n theorem complement_impl_correct:\n assumes \"finite (NBA.nodes A)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"NBA.language (nbae_nba (nbaei_nbae (complement_impl Ai))) =\n streams (nba.alphabet A) - NBA.language A\"\n using op_translate_language[OF complement_impl.refine[OF assms]]\n using complement_4_correct[OF assms(1)]\n by simp\n\n subsection \\Language Subset\\\n\n definition [simp]: \"op_language_subset A B \\ NBA.language A \\ NBA.language B\"\n\n lemmas [autoref_op_pat] = op_language_subset_def[symmetric]\n\n schematic_goal language_subset_impl:\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }) \\ ?R\"\n\t\tby (autoref_monadic (plain))\n concrete_definition language_subset_impl uses language_subset_impl\n lemma language_subset_impl_refine[autoref_rules]:\n assumes \"SIDE_PRECOND (finite (NBA.nodes A))\"\n assumes \"SIDE_PRECOND (finite (NBA.nodes B))\"\n assumes \"SIDE_PRECOND (nba.alphabet A \\ nba.alphabet B)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(language_subset_impl Ai Bi, (OP op_language_subset :::\n \\Id, nat_rel\\ nbai_nba_rel \\ \\Id, nat_rel\\ nbai_nba_rel \\ bool_rel) $ A $ B) \\ bool_rel\"\n proof -\n have \"(RETURN (language_subset_impl Ai Bi), do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }) \\ \\bool_rel\\ nres_rel\"\n using language_subset_impl.refine assms(2, 4, 5) unfolding autoref_tag_defs by this\n also have \"(do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }, RETURN (NBA.language A \\ NBA.language B)) \\ \\bool_rel\\ nres_rel\"\n proof refine_vcg\n show \"finite (NGBA.nodes (intersect' A (complement_4 B)))\" using assms(1, 2) by auto\n have 1: \"NBA.language A \\ streams (nba.alphabet B)\"\n using nba.language_alphabet streams_mono2 assms(3) unfolding autoref_tag_defs by blast\n have 2: \"NBA.language (complement_4 B) = streams (nba.alphabet B) - NBA.language B\"\n using complement_4_correct assms(2) by auto\n show \"(NGBA.language (intersect' A (complement_4 B)) = {},\n NBA.language A \\ NBA.language B) \\ bool_rel\" using 1 2 by auto\n qed\n finally show ?thesis using RETURN_nres_relD unfolding nres_rel_comp by force\n qed\n\n subsection \\Language Equality\\\n\n definition [simp]: \"op_language_equal A B \\ NBA.language A = NBA.language B\"\n\n lemmas [autoref_op_pat] = op_language_equal_def[symmetric]\n\n schematic_goal language_equal_impl:\n assumes [simp]: \"finite (NBA.nodes A)\"\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [simp]: \"nba.alphabet A = nba.alphabet B\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, NBA.language A \\ NBA.language B \\ NBA.language B \\ NBA.language A) \\ ?R\"\n by autoref\n concrete_definition language_equal_impl uses language_equal_impl\n lemma language_equal_impl_refine[autoref_rules]:\n assumes \"SIDE_PRECOND (finite (NBA.nodes A))\"\n assumes \"SIDE_PRECOND (finite (NBA.nodes B))\"\n assumes \"SIDE_PRECOND (nba.alphabet A = nba.alphabet B)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(language_equal_impl Ai Bi, (OP op_language_equal :::\n \\Id, nat_rel\\ nbai_nba_rel \\ \\Id, nat_rel\\ nbai_nba_rel \\ bool_rel) $ A $ B) \\ bool_rel\"\n using language_equal_impl.refine[OF assms[unfolded autoref_tag_defs]] by auto\n\n schematic_goal product_impl:\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, do {\n let AB' = intersect A (complement_4 B);\n ASSERT (finite (NBA.nodes AB'));\n op_translate AB'\n }) \\ ?R\"\n\t\tby (autoref_monadic (plain))\n concrete_definition product_impl uses product_impl\n\n (* TODO: possible optimizations:\n - introduce op_map_map operation for maps instead of manually iterating via FOREACH\n - consolidate various binds and maps in expand_map_get_7 *)\n export_code\n Set.empty Set.insert Set.member\n \"Inf :: 'a set set \\ 'a set\" \"Sup :: 'a set set \\ 'a set\" image Pow set\n nat_of_integer integer_of_nat\n Variable Negation Conjunction Disjunction satisfies map_formula\n nbaei alphabetei initialei transitionei acceptingei\n nbae_nba_impl complement_impl language_equal_impl product_impl\n in SML module_name Complementation file_prefix Complementation\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Buchi_Complementation/Complementation_Final.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2849263257070786}} {"text": "(* Title: HOL/HOLCF/IOA/meta_theory/CompoScheds.thy\n Author: Olaf Müller\n*)\n\nsection {* Compositionality on Schedule level *}\n\ntheory CompoScheds\nimports CompoExecs\nbegin\n\ndefinition\n mkex2 :: \"('a,'s)ioa => ('a,'t)ioa => 'a Seq ->\n ('a,'s)pairs -> ('a,'t)pairs ->\n ('s => 't => ('a,'s*'t)pairs)\" where\n \"mkex2 A B = (fix$(LAM h sch exA exB. (%s t. case sch of\n nil => nil\n | x##xs =>\n (case x of\n UU => UU\n | Def y =>\n (if y:act A then\n (if y:act B then\n (case HD$exA of\n UU => UU\n | Def a => (case HD$exB of\n UU => UU\n | Def b =>\n (y,(snd a,snd b))>>\n (h$xs$(TL$exA)$(TL$exB)) (snd a) (snd b)))\n else\n (case HD$exA of\n UU => UU\n | Def a =>\n (y,(snd a,t))>>(h$xs$(TL$exA)$exB) (snd a) t)\n )\n else\n (if y:act B then\n (case HD$exB of\n UU => UU\n | Def b =>\n (y,(s,snd b))>>(h$xs$exA$(TL$exB)) s (snd b))\n else\n UU\n )\n )\n ))))\"\n\ndefinition\n mkex :: \"('a,'s)ioa => ('a,'t)ioa => 'a Seq =>\n ('a,'s)execution => ('a,'t)execution =>('a,'s*'t)execution\" where\n \"mkex A B sch exA exB =\n ((fst exA,fst exB),\n (mkex2 A B$sch$(snd exA)$(snd exB)) (fst exA) (fst exB))\"\n\ndefinition\n par_scheds ::\"['a schedule_module,'a schedule_module] => 'a schedule_module\" where\n \"par_scheds SchedsA SchedsB =\n (let schA = fst SchedsA; sigA = snd SchedsA;\n schB = fst SchedsB; sigB = snd SchedsB\n in\n ( {sch. Filter (%a. a:actions sigA)$sch : schA}\n Int {sch. Filter (%a. a:actions sigB)$sch : schB}\n Int {sch. Forall (%x. x:(actions sigA Un actions sigB)) sch},\n asig_comp sigA sigB))\"\n\n\nsubsection \"mkex rewrite rules\"\n\n\nlemma mkex2_unfold:\n\"mkex2 A B = (LAM sch exA exB. (%s t. case sch of\n nil => nil\n | x##xs =>\n (case x of\n UU => UU\n | Def y =>\n (if y:act A then\n (if y:act B then\n (case HD$exA of\n UU => UU\n | Def a => (case HD$exB of\n UU => UU\n | Def b =>\n (y,(snd a,snd b))>>\n (mkex2 A B$xs$(TL$exA)$(TL$exB)) (snd a) (snd b)))\n else\n (case HD$exA of\n UU => UU\n | Def a =>\n (y,(snd a,t))>>(mkex2 A B$xs$(TL$exA)$exB) (snd a) t)\n )\n else\n (if y:act B then\n (case HD$exB of\n UU => UU\n | Def b =>\n (y,(s,snd b))>>(mkex2 A B$xs$exA$(TL$exB)) s (snd b))\n else\n UU\n )\n )\n )))\"\napply (rule trans)\napply (rule fix_eq2)\napply (simp only: mkex2_def)\napply (rule beta_cfun)\napply simp\ndone\n\nlemma mkex2_UU: \"(mkex2 A B$UU$exA$exB) s t = UU\"\napply (subst mkex2_unfold)\napply simp\ndone\n\nlemma mkex2_nil: \"(mkex2 A B$nil$exA$exB) s t= nil\"\napply (subst mkex2_unfold)\napply simp\ndone\n\nlemma mkex2_cons_1: \"[| x:act A; x~:act B; HD$exA=Def a|]\n ==> (mkex2 A B$(x>>sch)$exA$exB) s t =\n (x,snd a,t) >> (mkex2 A B$sch$(TL$exA)$exB) (snd a) t\"\napply (rule trans)\napply (subst mkex2_unfold)\napply (simp add: Consq_def If_and_if)\napply (simp add: Consq_def)\ndone\n\nlemma mkex2_cons_2: \"[| x~:act A; x:act B; HD$exB=Def b|]\n ==> (mkex2 A B$(x>>sch)$exA$exB) s t =\n (x,s,snd b) >> (mkex2 A B$sch$exA$(TL$exB)) s (snd b)\"\napply (rule trans)\napply (subst mkex2_unfold)\napply (simp add: Consq_def If_and_if)\napply (simp add: Consq_def)\ndone\n\nlemma mkex2_cons_3: \"[| x:act A; x:act B; HD$exA=Def a;HD$exB=Def b|]\n ==> (mkex2 A B$(x>>sch)$exA$exB) s t =\n (x,snd a,snd b) >>\n (mkex2 A B$sch$(TL$exA)$(TL$exB)) (snd a) (snd b)\"\napply (rule trans)\napply (subst mkex2_unfold)\napply (simp add: Consq_def If_and_if)\napply (simp add: Consq_def)\ndone\n\ndeclare mkex2_UU [simp] mkex2_nil [simp] mkex2_cons_1 [simp]\n mkex2_cons_2 [simp] mkex2_cons_3 [simp]\n\n\nsubsection {* mkex *}\n\nlemma mkex_UU: \"mkex A B UU (s,exA) (t,exB) = ((s,t),UU)\"\napply (simp add: mkex_def)\ndone\n\nlemma mkex_nil: \"mkex A B nil (s,exA) (t,exB) = ((s,t),nil)\"\napply (simp add: mkex_def)\ndone\n\nlemma mkex_cons_1: \"[| x:act A; x~:act B |]\n ==> mkex A B (x>>sch) (s,a>>exA) (t,exB) =\n ((s,t), (x,snd a,t) >> snd (mkex A B sch (snd a,exA) (t,exB)))\"\napply (simp (no_asm) add: mkex_def)\napply (cut_tac exA = \"a>>exA\" in mkex2_cons_1)\napply auto\ndone\n\nlemma mkex_cons_2: \"[| x~:act A; x:act B |]\n ==> mkex A B (x>>sch) (s,exA) (t,b>>exB) =\n ((s,t), (x,s,snd b) >> snd (mkex A B sch (s,exA) (snd b,exB)))\"\napply (simp (no_asm) add: mkex_def)\napply (cut_tac exB = \"b>>exB\" in mkex2_cons_2)\napply auto\ndone\n\nlemma mkex_cons_3: \"[| x:act A; x:act B |]\n ==> mkex A B (x>>sch) (s,a>>exA) (t,b>>exB) =\n ((s,t), (x,snd a,snd b) >> snd (mkex A B sch (snd a,exA) (snd b,exB)))\"\napply (simp (no_asm) add: mkex_def)\napply (cut_tac exB = \"b>>exB\" and exA = \"a>>exA\" in mkex2_cons_3)\napply auto\ndone\n\ndeclare mkex2_UU [simp del] mkex2_nil [simp del]\n mkex2_cons_1 [simp del] mkex2_cons_2 [simp del] mkex2_cons_3 [simp del]\n\nlemmas composch_simps = mkex_UU mkex_nil mkex_cons_1 mkex_cons_2 mkex_cons_3\n\ndeclare composch_simps [simp]\n\n\nsubsection {* COMPOSITIONALITY on SCHEDULE Level *}\n\nsubsubsection \"Lemmas for ==>\"\n\n(* --------------------------------------------------------------------- *)\n(* Lemma_2_1 : tfilter(ex) and filter_act are commutative *)\n(* --------------------------------------------------------------------- *)\n\nlemma lemma_2_1a:\n \"filter_act$(Filter_ex2 (asig_of A)$xs)=\n Filter (%a. a:act A)$(filter_act$xs)\"\n\napply (unfold filter_act_def Filter_ex2_def)\napply (simp (no_asm) add: MapFilter o_def)\ndone\n\n\n(* --------------------------------------------------------------------- *)\n(* Lemma_2_2 : State-projections do not affect filter_act *)\n(* --------------------------------------------------------------------- *)\n\nlemma lemma_2_1b:\n \"filter_act$(ProjA2$xs) =filter_act$xs &\n filter_act$(ProjB2$xs) =filter_act$xs\"\napply (tactic {* pair_induct_tac @{context} \"xs\" [] 1 *})\ndone\n\n\n(* --------------------------------------------------------------------- *)\n(* Schedules of A||B have only A- or B-actions *)\n(* --------------------------------------------------------------------- *)\n\n(* very similar to lemma_1_1c, but it is not checking if every action element of\n an ex is in A or B, but after projecting it onto the action schedule. Of course, this\n is the same proposition, but we cannot change this one, when then rather lemma_1_1c *)\n\nlemma sch_actions_in_AorB: \"!s. is_exec_frag (A||B) (s,xs)\n --> Forall (%x. x:act (A||B)) (filter_act$xs)\"\n\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm is_exec_frag_def}, @{thm Forall_def},\n @{thm sforall_def}] 1 *})\n(* main case *)\napply auto\napply (simp add: trans_of_defs2 actions_asig_comp asig_of_par)\ndone\n\n\nsubsubsection \"Lemmas for <==\"\n\n(*---------------------------------------------------------------------------\n Filtering actions out of mkex(sch,exA,exB) yields the oracle sch\n structural induction\n --------------------------------------------------------------------------- *)\n\nlemma Mapfst_mkex_is_sch: \"! exA exB s t.\n Forall (%x. x:act (A||B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> filter_act$(snd (mkex A B sch (s,exA) (t,exB))) = sch\"\n\napply (tactic {* Seq_induct_tac @{context} \"sch\" [@{thm Filter_def}, @{thm Forall_def},\n @{thm sforall_def}, @{thm mkex_def}] 1 *})\n\n(* main case *)\n(* splitting into 4 cases according to a:A, a:B *)\napply auto\n\n(* Case y:A, y:B *)\napply (tactic {* Seq_case_simp_tac @{context} \"exA\" 1 *})\n(* Case exA=UU, Case exA=nil*)\n(* These UU and nil cases are the only places where the assumption filter A sch< to generate a contradiction using ~a>>ss<< UU(nil), using theorems\n Cons_not_less_UU and Cons_not_less_nil *)\napply (tactic {* Seq_case_simp_tac @{context} \"exB\" 1 *})\n(* Case exA=a>>x, exB=b>>y *)\n(* here it is important that Seq_case_simp_tac uses no !full!_simp_tac for the cons case,\n as otherwise mkex_cons_3 would not be rewritten without use of rotate_tac: then tactic\n would not be generally applicable *)\napply simp\n\n(* Case y:A, y~:B *)\napply (tactic {* Seq_case_simp_tac @{context} \"exA\" 1 *})\napply simp\n\n(* Case y~:A, y:B *)\napply (tactic {* Seq_case_simp_tac @{context} \"exB\" 1 *})\napply simp\n\n(* Case y~:A, y~:B *)\napply (simp add: asig_of_par actions_asig_comp)\ndone\n\n\n(* generalizing the proof above to a proof method *)\n\nML {*\n\nlocal\n val defs = [@{thm Filter_def}, @{thm Forall_def}, @{thm sforall_def}, @{thm mkex_def},\n @{thm stutter_def}]\n val asigs = [@{thm asig_of_par}, @{thm actions_asig_comp}]\nin\n\nfun mkex_induct_tac ctxt sch exA exB =\n EVERY'[Seq_induct_tac ctxt sch defs,\n asm_full_simp_tac ctxt,\n SELECT_GOAL\n (safe_tac (Context.raw_transfer (Proof_Context.theory_of ctxt) @{theory_context Fun})),\n Seq_case_simp_tac ctxt exA,\n Seq_case_simp_tac ctxt exB,\n asm_full_simp_tac ctxt,\n Seq_case_simp_tac ctxt exA,\n asm_full_simp_tac ctxt,\n Seq_case_simp_tac ctxt exB,\n asm_full_simp_tac ctxt,\n asm_full_simp_tac (ctxt addsimps asigs)\n ]\n\nend\n*}\n\nmethod_setup mkex_induct = {*\n Scan.lift (Args.name -- Args.name -- Args.name)\n >> (fn ((sch, exA), exB) => fn ctxt => SIMPLE_METHOD' (mkex_induct_tac ctxt sch exA exB))\n*}\n\n\n(*---------------------------------------------------------------------------\n Projection of mkex(sch,exA,exB) onto A stutters on A\n structural induction\n --------------------------------------------------------------------------- *)\n\nlemma stutterA_mkex: \"! exA exB s t.\n Forall (%x. x:act (A||B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> stutter (asig_of A) (s,ProjA2$(snd (mkex A B sch (s,exA) (t,exB))))\"\n by (mkex_induct sch exA exB)\n\nlemma stutter_mkex_on_A: \"[|\n Forall (%x. x:act (A||B)) sch ;\n Filter (%a. a:act A)$sch << filter_act$(snd exA) ;\n Filter (%a. a:act B)$sch << filter_act$(snd exB) |]\n ==> stutter (asig_of A) (ProjA (mkex A B sch exA exB))\"\n\napply (cut_tac stutterA_mkex)\napply (simp add: stutter_def ProjA_def mkex_def)\napply (erule allE)+\napply (drule mp)\nprefer 2 apply (assumption)\napply simp\ndone\n\n\n(*---------------------------------------------------------------------------\n Projection of mkex(sch,exA,exB) onto B stutters on B\n structural induction\n --------------------------------------------------------------------------- *)\n\nlemma stutterB_mkex: \"! exA exB s t.\n Forall (%x. x:act (A||B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> stutter (asig_of B) (t,ProjB2$(snd (mkex A B sch (s,exA) (t,exB))))\"\n by (mkex_induct sch exA exB)\n\n\nlemma stutter_mkex_on_B: \"[|\n Forall (%x. x:act (A||B)) sch ;\n Filter (%a. a:act A)$sch << filter_act$(snd exA) ;\n Filter (%a. a:act B)$sch << filter_act$(snd exB) |]\n ==> stutter (asig_of B) (ProjB (mkex A B sch exA exB))\"\napply (cut_tac stutterB_mkex)\napply (simp add: stutter_def ProjB_def mkex_def)\napply (erule allE)+\napply (drule mp)\nprefer 2 apply (assumption)\napply simp\ndone\n\n\n(*---------------------------------------------------------------------------\n Filter of mkex(sch,exA,exB) to A after projection onto A is exA\n -- using zip$(proj1$exA)$(proj2$exA) instead of exA --\n -- because of admissibility problems --\n structural induction\n --------------------------------------------------------------------------- *)\n\nlemma filter_mkex_is_exA_tmp: \"! exA exB s t.\n Forall (%x. x:act (A||B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> Filter_ex2 (asig_of A)$(ProjA2$(snd (mkex A B sch (s,exA) (t,exB)))) =\n Zip$(Filter (%a. a:act A)$sch)$(Map snd$exA)\"\n by (mkex_induct sch exB exA)\n\n(*---------------------------------------------------------------------------\n zip$(proj1$y)$(proj2$y) = y (using the lift operations)\n lemma for admissibility problems\n --------------------------------------------------------------------------- *)\n\nlemma Zip_Map_fst_snd: \"Zip$(Map fst$y)$(Map snd$y) = y\"\napply (tactic {* Seq_induct_tac @{context} \"y\" [] 1 *})\ndone\n\n\n(*---------------------------------------------------------------------------\n filter A$sch = proj1$ex --> zip$(filter A$sch)$(proj2$ex) = ex\n lemma for eliminating non admissible equations in assumptions\n --------------------------------------------------------------------------- *)\n\nlemma trick_against_eq_in_ass: \"!! sch ex.\n Filter (%a. a:act AB)$sch = filter_act$ex\n ==> ex = Zip$(Filter (%a. a:act AB)$sch)$(Map snd$ex)\"\napply (simp add: filter_act_def)\napply (rule Zip_Map_fst_snd [symmetric])\ndone\n\n(*---------------------------------------------------------------------------\n Filter of mkex(sch,exA,exB) to A after projection onto A is exA\n using the above trick\n --------------------------------------------------------------------------- *)\n\n\nlemma filter_mkex_is_exA: \"!!sch exA exB.\n [| Forall (%a. a:act (A||B)) sch ;\n Filter (%a. a:act A)$sch = filter_act$(snd exA) ;\n Filter (%a. a:act B)$sch = filter_act$(snd exB) |]\n ==> Filter_ex (asig_of A) (ProjA (mkex A B sch exA exB)) = exA\"\napply (simp add: ProjA_def Filter_ex_def)\napply (tactic {* pair_tac @{context} \"exA\" 1 *})\napply (tactic {* pair_tac @{context} \"exB\" 1 *})\napply (rule conjI)\napply (simp (no_asm) add: mkex_def)\napply (simplesubst trick_against_eq_in_ass)\nback\napply assumption\napply (simp add: filter_mkex_is_exA_tmp)\ndone\n\n\n(*---------------------------------------------------------------------------\n Filter of mkex(sch,exA,exB) to B after projection onto B is exB\n -- using zip$(proj1$exB)$(proj2$exB) instead of exB --\n -- because of admissibility problems --\n structural induction\n --------------------------------------------------------------------------- *)\n\nlemma filter_mkex_is_exB_tmp: \"! exA exB s t.\n Forall (%x. x:act (A||B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> Filter_ex2 (asig_of B)$(ProjB2$(snd (mkex A B sch (s,exA) (t,exB)))) =\n Zip$(Filter (%a. a:act B)$sch)$(Map snd$exB)\"\n\n(* notice necessary change of arguments exA and exB *)\n by (mkex_induct sch exA exB)\n\n\n(*---------------------------------------------------------------------------\n Filter of mkex(sch,exA,exB) to A after projection onto B is exB\n using the above trick\n --------------------------------------------------------------------------- *)\n\n\nlemma filter_mkex_is_exB: \"!!sch exA exB.\n [| Forall (%a. a:act (A||B)) sch ;\n Filter (%a. a:act A)$sch = filter_act$(snd exA) ;\n Filter (%a. a:act B)$sch = filter_act$(snd exB) |]\n ==> Filter_ex (asig_of B) (ProjB (mkex A B sch exA exB)) = exB\"\napply (simp add: ProjB_def Filter_ex_def)\napply (tactic {* pair_tac @{context} \"exA\" 1 *})\napply (tactic {* pair_tac @{context} \"exB\" 1 *})\napply (rule conjI)\napply (simp (no_asm) add: mkex_def)\napply (simplesubst trick_against_eq_in_ass)\nback\napply assumption\napply (simp add: filter_mkex_is_exB_tmp)\ndone\n\n(* --------------------------------------------------------------------- *)\n(* mkex has only A- or B-actions *)\n(* --------------------------------------------------------------------- *)\n\n\nlemma mkex_actions_in_AorB: \"!s t exA exB.\n Forall (%x. x : act (A || B)) sch &\n Filter (%a. a:act A)$sch << filter_act$exA &\n Filter (%a. a:act B)$sch << filter_act$exB\n --> Forall (%x. fst x : act (A ||B))\n (snd (mkex A B sch (s,exA) (t,exB)))\"\n by (mkex_induct sch exA exB)\n\n\n(* ------------------------------------------------------------------ *)\n(* COMPOSITIONALITY on SCHEDULE Level *)\n(* Main Theorem *)\n(* ------------------------------------------------------------------ *)\n\nlemma compositionality_sch:\n\"(sch : schedules (A||B)) =\n (Filter (%a. a:act A)$sch : schedules A &\n Filter (%a. a:act B)$sch : schedules B &\n Forall (%x. x:act (A||B)) sch)\"\napply (simp (no_asm) add: schedules_def has_schedule_def)\napply auto\n(* ==> *)\napply (rule_tac x = \"Filter_ex (asig_of A) (ProjA ex) \" in bexI)\nprefer 2\napply (simp add: compositionality_ex)\napply (simp (no_asm) add: Filter_ex_def ProjA_def lemma_2_1a lemma_2_1b)\napply (rule_tac x = \"Filter_ex (asig_of B) (ProjB ex) \" in bexI)\nprefer 2\napply (simp add: compositionality_ex)\napply (simp (no_asm) add: Filter_ex_def ProjB_def lemma_2_1a lemma_2_1b)\napply (simp add: executions_def)\napply (tactic {* pair_tac @{context} \"ex\" 1 *})\napply (erule conjE)\napply (simp add: sch_actions_in_AorB)\n\n(* <== *)\n\n(* mkex is exactly the construction of exA||B out of exA, exB, and the oracle sch,\n we need here *)\napply (rename_tac exA exB)\napply (rule_tac x = \"mkex A B sch exA exB\" in bexI)\n(* mkex actions are just the oracle *)\napply (tactic {* pair_tac @{context} \"exA\" 1 *})\napply (tactic {* pair_tac @{context} \"exB\" 1 *})\napply (simp add: Mapfst_mkex_is_sch)\n\n(* mkex is an execution -- use compositionality on ex-level *)\napply (simp add: compositionality_ex)\napply (simp add: stutter_mkex_on_A stutter_mkex_on_B filter_mkex_is_exB filter_mkex_is_exA)\napply (tactic {* pair_tac @{context} \"exA\" 1 *})\napply (tactic {* pair_tac @{context} \"exB\" 1 *})\napply (simp add: mkex_actions_in_AorB)\ndone\n\n\nsubsection {* COMPOSITIONALITY on SCHEDULE Level -- for Modules *}\n\nlemma compositionality_sch_modules:\n \"Scheds (A||B) = par_scheds (Scheds A) (Scheds B)\"\n\napply (unfold Scheds_def par_scheds_def)\napply (simp add: asig_of_par)\napply (rule set_eqI)\napply (simp add: compositionality_sch actions_of_par)\ndone\n\n\ndeclare compoex_simps [simp del]\ndeclare composch_simps [simp del]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/meta_theory/CompoScheds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2849263184019152}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\n(*\n * Primitive ops\n * \n *)\n\ntheory Prim\nimports\n \"../Deep_Embedding_Auto\"\n \"../SpecialisedLemmaTactic\"\n \"../Cogent_Corres\"\n \"../Corres_Tac\"\n \"../TypeProofGen\"\n \"../Tidy\"\n \"../Heap_Relation_Generation\" \"../Type_Relation_Generation\"\nbegin\n\n\n(* Cogent semantics generated by\n cogent --fml-typing-tree --type-proof=Foo.thy pass_prim-ops.cogent\n*)\n\nlemmas abbreviated_type_defs =\n TrueI\n\ndefinition\n \"ops8_type \\ ([], (TPrim (Num U8), TPrim (Num U8)))\"\n\ndefinition\n \"ops8 \\ Let (Var 0) (Let (Lit (LU8 1)) (Let (Prim (Plus U8) [Var 1, Var 0]) (Let (Prim (Times U8) [Var 0, Var 2]) (Let (Prim (Minus U8) [Var 0, Var 1]) (Let (Prim (BitOr U8) [Var 0, Var 1]) (Let (Prim (BitAnd U8) [Var 0, Var 1]) (Let (Prim (BitXor U8) [Var 1, Var 2]) (Let (Prim (Complement U8) [Var 0]) (Let (Prim (LShift U8) [Var 1, Var 0]) (Let (Prim (RShift U8) [Var 1, Var 0]) (Let (Prim (Divide U8) [Var 0, Var 1]) (Let (Prim (Mod U8) [Var 1, Var 0]) (Let (Prim (Lt U8) [Var 2, Var 1]) (Let (Prim (Le U8) [Var 2, Var 1]) (Let (Prim (Eq (Num U8)) [Var 4, Var 2]) (Let (Prim Cogent.And [Var 1, Var 0]) (Let (Prim Cogent.And [Var 3, Var 0]) (If (Var 0) (Lit (LU8 0)) (Lit (LU8 1))))))))))))))))))))\"\n\ndefinition\n \"ops64_type \\ ([], (TPrim (Num U64), TPrim (Num U64)))\"\n\ndefinition\n \"ops64 \\ Let (Var 0) (Let (Lit (LU8 1)) (Let (Cast U64 (Var 0)) (Let (Prim (Plus U64) [Var 2, Var 0]) (Let (Prim (Times U64) [Var 0, Var 3]) (Let (Prim (Minus U64) [Var 0, Var 1]) (Let (Prim (BitOr U64) [Var 0, Var 1]) (Let (Prim (BitAnd U64) [Var 0, Var 1]) (Let (Prim (BitXor U64) [Var 1, Var 0]) (Let (Prim (Complement U64) [Var 0]) (Let (Prim (LShift U64) [Var 1, Var 0]) (Let (Prim (RShift U64) [Var 1, Var 0]) (Let (Prim (Divide U64) [Var 0, Var 1]) (Let (Prim (Mod U64) [Var 1, Var 0]) (Let (Prim (Lt U64) [Var 2, Var 1]) (Let (Prim (Le U64) [Var 2, Var 1]) (Let (Prim (Eq (Num U64)) [Var 4, Var 2]) (Let (Prim Cogent.And [Var 1, Var 0]) (Let (Prim Cogent.And [Var 3, Var 0]) (If (Var 0) (Let (Lit (LU8 0)) (Cast U64 (Var 0))) (Let (Lit (LU8 1)) (Cast U64 (Var 0))))))))))))))))))))))\"\n\ndefinition\n \"ops32_type \\ ([], (TPrim (Num U32), TPrim (Num U32)))\"\n\ndefinition\n \"ops32 \\ Let (Var 0) (Let (Lit (LU8 1)) (Let (Cast U32 (Var 0)) (Let (Prim (Plus U32) [Var 2, Var 0]) (Let (Prim (Times U32) [Var 0, Var 3]) (Let (Prim (Minus U32) [Var 0, Var 1]) (Let (Prim (BitOr U32) [Var 0, Var 1]) (Let (Prim (BitAnd U32) [Var 0, Var 1]) (Let (Prim (BitXor U32) [Var 1, Var 2]) (Let (Prim (Complement U32) [Var 0]) (Let (Prim (LShift U32) [Var 1, Var 0]) (Let (Prim (RShift U32) [Var 1, Var 0]) (Let (Prim (Divide U32) [Var 0, Var 1]) (Let (Prim (Mod U32) [Var 1, Var 0]) (Let (Prim (Lt U32) [Var 2, Var 1]) (Let (Prim (Le U32) [Var 2, Var 1]) (Let (Prim (Eq (Num U32)) [Var 4, Var 2]) (Let (Prim Cogent.And [Var 1, Var 0]) (Let (Prim Cogent.And [Var 3, Var 0]) (If (Var 0) (Let (Lit (LU8 0)) (Cast U32 (Var 0))) (Let (Lit (LU8 1)) (Cast U32 (Var 0))))))))))))))))))))))\"\n\ndefinition\n \"ops16_type \\ ([], (TPrim (Num U16), TPrim (Num U16)))\"\n\ndefinition\n \"ops16 \\ Let (Var 0) (Let (Lit (LU8 1)) (Let (Cast U16 (Var 0)) (Let (Prim (Plus U16) [Var 2, Var 0]) (Let (Prim (Times U16) [Var 0, Var 3]) (Let (Prim (Minus U16) [Var 0, Var 1]) (Let (Prim (BitOr U16) [Var 0, Var 1]) (Let (Prim (BitAnd U16) [Var 0, Var 1]) (Let (Prim (BitXor U16) [Var 1, Var 2]) (Let (Prim (Complement U16) [Var 0]) (Let (Prim (LShift U16) [Var 1, Var 0]) (Let (Prim (RShift U16) [Var 1, Var 0]) (Let (Prim (Divide U16) [Var 0, Var 1]) (Let (Prim (Mod U16) [Var 1, Var 0]) (Let (Prim (Lt U16) [Var 2, Var 1]) (Let (Prim (Le U16) [Var 2, Var 1]) (Let (Prim (Eq (Num U16)) [Var 4, Var 2]) (Let (Prim Cogent.And [Var 1, Var 0]) (Let (Prim Cogent.And [Var 3, Var 0]) (If (Var 0) (Let (Lit (LU8 0)) (Cast U16 (Var 0))) (Let (Lit (LU8 1)) (Cast U16 (Var 0))))))))))))))))))))))\"\n\ndefinition\n \"bool_ops_type \\ ([], (TPrim (Num U32), TPrim Bool))\"\n\ndefinition\n \"bool_ops \\ Let (Var 0) (Let (Lit (LU8 1)) (Let (Cast U32 (Var 0)) (Let (Prim (Plus U32) [Var 2, Var 0]) (Let (Prim (Times U32) [Var 0, Var 3]) (Let (Prim (Lt U32) [Var 4, Var 1]) (Let (Prim (Le U32) [Var 2, Var 1]) (Let (Prim (Eq (Num U32)) [Var 2, Var 6]) (Let (Prim Cogent.And [Var 1, Var 0]) (Let (Prim Cogent.Or [Var 0, Var 1]) (Let (Prim Not [Var 0]) (Let (Lit (LBool True)) (Let (Prim Cogent.Or [Var 1, Var 0]) (Let (Prim Not [Var 0]) (Let (Lit (LBool False)) (Let (Prim Cogent.And [Var 1, Var 0]) (Var 0))))))))))))))))\"\n\nML {*\nval Cogent_functions = [\"ops8\",\"ops64\",\"ops32\",\"ops16\",\"bool_ops\"]\nval Cogent_abstract_functions = []\n*}\n\ndefinition\n \"\\ func_name' \\ case func_name' of ''ops8'' \\ ops8_type | ''ops64'' \\ ops64_type | ''ops32'' \\ ops32_type | ''ops16'' \\ ops16_type | ''bool_ops'' \\ bool_ops_type\"\n\ndefinition\n \"ops8_typetree \\ TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (append (replicate 2 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_S) (Cons None []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons None (Cons (Some TSK_L) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 3 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 4 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 5 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 5 None) [])))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 8 None) [])) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 8 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 9 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 10 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 11 None) []))) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 11 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 12 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 2 None) (Cons (Some TSK_L) (Cons None (Cons (Some TSK_L) (append (replicate 11 None) []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 15 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) (Cons (Some TSK_L) (append (replicate 14 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 18 None) [])) [] TyTrLeaf [] (TyTrSplit (append (replicate 19 None) []) [] TyTrLeaf [] TyTrLeaf)))))))))))))))))))\"\n\ndefinition\n \"ops64_typetree \\ TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (append (replicate 2 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) [])) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_L) (Cons None (Cons (Some TSK_S) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 2 None) (Cons (Some TSK_L) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 4 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 5 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 6 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 7 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 9 None) [])) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 9 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 10 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 11 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) []))) [] TyTrLeaf [Some (TPrim (Num U64))] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 13 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 2 None) (Cons (Some TSK_L) (Cons None (Cons (Some TSK_L) (append (replicate 12 None) []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 16 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) (Cons (Some TSK_L) (append (replicate 15 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 19 None) [])) [] TyTrLeaf [] (TyTrSplit (append (replicate 20 None) []) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf)))))))))))))))))))))\"\n\ndefinition\n \"ops32_typetree \\ TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (append (replicate 2 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) [])) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_L) (Cons None (Cons (Some TSK_S) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 2 None) (Cons (Some TSK_L) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 4 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 5 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 6 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 6 None) [])))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 9 None) [])) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 9 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 10 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 11 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) []))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 13 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 2 None) (Cons (Some TSK_L) (Cons None (Cons (Some TSK_L) (append (replicate 12 None) []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 16 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) (Cons (Some TSK_L) (append (replicate 15 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 19 None) [])) [] TyTrLeaf [] (TyTrSplit (append (replicate 20 None) []) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf)))))))))))))))))))))\"\n\ndefinition\n \"ops16_typetree \\ TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (append (replicate 2 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) [])) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_L) (Cons None (Cons (Some TSK_S) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 2 None) (Cons (Some TSK_L) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 4 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 5 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 6 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 6 None) [])))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 9 None) [])) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 9 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 10 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 11 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) []))) [] TyTrLeaf [Some (TPrim (Num U16))] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_S) (append (replicate 12 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons None (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 13 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 2 None) (Cons (Some TSK_L) (Cons None (Cons (Some TSK_L) (append (replicate 12 None) []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 16 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) (Cons (Some TSK_L) (append (replicate 15 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 19 None) [])) [] TyTrLeaf [] (TyTrSplit (append (replicate 20 None) []) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf) [] (TyTrSplit (append (replicate 20 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] TyTrLeaf)))))))))))))))))))))\"\n\ndefinition\n \"bool_ops_typetree \\ TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (append (replicate 2 None) []) [] TyTrLeaf [Some (TPrim (Num U8))] (TyTrSplit (Cons (Some TSK_L) (append (replicate 2 None) [])) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_L) (Cons None (Cons (Some TSK_S) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons (Some TSK_S) (append (replicate 2 None) (Cons (Some TSK_S) (Cons None [])))) [] TyTrLeaf [Some (TPrim (Num U32))] (TyTrSplit (Cons None (Cons (Some TSK_S) (append (replicate 2 None) (Cons (Some TSK_S) (Cons None []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 4 None) [])))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 2 None) (Cons (Some TSK_L) (append (replicate 3 None) (Cons (Some TSK_L) (Cons None []))))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_S) (Cons (Some TSK_L) (append (replicate 7 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 8 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 10 None) [])) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 12 None) []) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 11 None) []))) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (append (replicate 13 None) [])) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (append (replicate 15 None) []) [] TyTrLeaf [Some (TPrim Bool)] (TyTrSplit (Cons (Some TSK_L) (Cons (Some TSK_L) (append (replicate 14 None) []))) [] TyTrLeaf [Some (TPrim Bool)] TyTrLeaf)))))))))))))))\"\n\nML {* open TTyping_Tactics *}\n\nML_quiet {*\nval typing_helper_1_script : tac list = [\n(RTac @{thm kind_tprim[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_1[unfolded abbreviated_type_defs] :\n \"kinding [] (TPrim (Num U8)) {E, S, D}\"\n apply (unfold abbreviated_type_defs)?\n apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_1_script |> EVERY *})\n done\n\nML_quiet {*\nval typing_helper_2_script : tac list = [\n(RTac @{thm kind_tprim[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_2[unfolded abbreviated_type_defs] :\n \"kinding [] (TPrim Bool) {E, S, D}\"\n apply (unfold abbreviated_type_defs)?\n apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_2_script |> EVERY *})\n done\n\nML_quiet {*\nval typing_helper_3_script : tac list = [\n(RTac @{thm kind_tprim[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_3[unfolded abbreviated_type_defs] :\n \"kinding [] (TPrim (Num U64)) {E, S, D}\"\n apply (unfold abbreviated_type_defs)?\n apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_3_script |> EVERY *})\n done\n\nML_quiet {*\nval typing_helper_4_script : tac list = [\n(RTac @{thm kind_tprim[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_4[unfolded abbreviated_type_defs] :\n \"kinding [] (TPrim (Num U32)) {E, S, D}\"\n apply (unfold abbreviated_type_defs)?\n apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_4_script |> EVERY *})\n done\n\nML_quiet {*\nval typing_helper_5_script : tac list = [\n(RTac @{thm kind_tprim[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_5[unfolded abbreviated_type_defs] :\n \"kinding [] (TPrim (Num U16)) {E, S, D}\"\n apply (unfold abbreviated_type_defs)?\n apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_5_script |> EVERY *})\n done\n\nML_quiet {*\nval ops8_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_1})],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nTypingTacs [],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval ops8_ttyping_details_future = get_all_typing_details_future @{context} \"ops8\"\n ops8_typecorrect_script*}\n\n\nlemma ops8_typecorrect :\n \"\\, fst ops8_type, (ops8_typetree, [Some (fst (snd ops8_type))]) T\\ ops8 : snd (snd ops8_type)\"\n apply (tactic {* resolve_future_typecorrect @{context} ops8_ttyping_details_future *})\n done\n\nML_quiet {*\nval ops64_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_3})],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval ops64_ttyping_details_future = get_all_typing_details_future @{context} \"ops64\"\n ops64_typecorrect_script*}\n\n\nlemma ops64_typecorrect :\n \"\\, fst ops64_type, (ops64_typetree, [Some (fst (snd ops64_type))]) T\\ ops64 : snd (snd ops64_type)\"\n apply (tactic {* resolve_future_typecorrect @{context} ops64_ttyping_details_future *})\n done\n\nML_quiet {*\nval ops32_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_4})],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval ops32_ttyping_details_future = get_all_typing_details_future @{context} \"ops32\"\n ops32_typecorrect_script*}\n\n\nlemma ops32_typecorrect :\n \"\\, fst ops32_type, (ops32_typetree, [Some (fst (snd ops32_type))]) T\\ ops32 : snd (snd ops32_type)\"\n apply (tactic {* resolve_future_typecorrect @{context} ops32_ttyping_details_future *})\n done\n\nML_quiet {*\nval ops16_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_5})],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_5})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval ops16_ttyping_details_future = get_all_typing_details_future @{context} \"ops16\"\n ops16_typecorrect_script*}\n\n\nlemma ops16_typecorrect :\n \"\\, fst ops16_type, (ops16_typetree, [Some (fst (snd ops16_type))]) T\\ ops16 : snd (snd ops16_type)\"\n apply (tactic {* resolve_future_typecorrect @{context} ops16_ttyping_details_future *})\n done\n\nML_quiet {*\nval bool_ops_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_4})],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [(RTac @{thm typing_cast}),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[])),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_4})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [(RTac @{thm typing_lit'}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(SimpTac ([],[]))],\nKindingTacs [(RTac @{thm typing_helper_2})],\nTypingTacs [],\nTypingTacs []\n] *}\n\n\nML_quiet {*\nval bool_ops_ttyping_details_future = get_all_typing_details_future @{context} \"bool_ops\"\n bool_ops_typecorrect_script*}\n\n\nlemma bool_ops_typecorrect :\n \"\\, fst bool_ops_type, (bool_ops_typetree, [Some (fst (snd bool_ops_type))]) T\\ bool_ops : snd (snd bool_ops_type)\"\n apply (tactic {* resolve_future_typecorrect @{context} bool_ops_ttyping_details_future *})\n done\n\nML_quiet {*\nval (_, ops8_typing_tree, ops8_typing_bucket)\n= Future.join ops8_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, ops64_typing_tree, ops64_typing_bucket)\n= Future.join ops64_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, ops32_typing_tree, ops32_typing_bucket)\n= Future.join ops32_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, ops16_typing_tree, ops16_typing_bucket)\n= Future.join ops16_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, bool_ops_typing_tree, bool_ops_typing_bucket)\n= Future.join bool_ops_ttyping_details_future\n*}\n\n\n\n(* end Cogent semantics *)\n\n(* C semantics, generated by C parser *)\nnew_C_include_dir \"../../cogent/tests\"\ninstall_C_file \"pass_prim-ops.c\"\n\nautocorres [ts_rules=nondet, no_opt, gen_word_heaps, skip_word_abs] \"pass_prim-ops.c\"\n\ninstantiation bool_t_C :: cogent_C_val\nbegin\ndefinition type_rel_bool_t_C_def:\n \"type_rel typ (_ :: bool_t_C itself) \\ (typ = RPrim Bool)\"\n\ndefinition val_rel_bool_t_C_def:\n \"val_rel uv (x :: bool_t_C) \\ uv = UPrim (LBool (bool_t_C.boolean_C x \\ 0))\"\ninstance ..\nend\n\n(* Relation between Cogent and C data *)\nlocal_setup{* local_setup_val_rel_type_rel_put_them_in_buckets \"pass_prim-ops.c\" *}\n\n(* Lemma bucket.*)\nML{* TypeRelSimp.get @{context} *}\nML{* ValRelSimp.get @{context} *}\n\nlemmas val_rel_simps[ValRelSimp] = val_rel_word val_rel_ptr_def val_rel_bool_t_C_def\nlemmas type_rel_simps[TypeRelSimp] = type_rel_word type_rel_ptr_def type_rel_bool_t_C_def\n\nclass cogent_C_heap = cogent_C_val +\n fixes is_valid :: \"lifted_globals \\ 'a ptr \\ bool\"\n fixes heap :: \"lifted_globals \\ 'a ptr \\ 'a\"\n fixes heap_update :: \"(('a ptr \\ 'a) \\ 'a ptr \\ 'a) \\ lifted_globals \\ lifted_globals\"\n\nlocal_setup{* local_setup_instantiate_cogent_C_heaps_store_them_in_buckets \"pass_prim-ops.c\"*}\nML{* HeapSimp.get @{context}; IsValidSimp.get @{context} *}\n\nlocale take_cogent = \"pass_prim-ops\" + update_sem_init\nbegin\n\n(* Relation between program heaps *)\ndefinition\n heap_rel_ptr ::\n \"(funtyp, abstyp, ptrtyp) store \\ lifted_globals \\\n ('a :: cogent_C_heap) ptr \\ bool\"\nwhere\n \"heap_rel_ptr \\ h p \\\n (\\uv.\n \\ (ptr_val p) = Some uv \\\n type_rel (uval_repr uv) TYPE('a) \\\n is_valid h p \\ val_rel uv (heap h p))\"\n\nlemma heap_rel_ptr_meta:\n \"heap_rel_ptr = heap_rel_meta is_valid heap\"\n by (simp add: heap_rel_ptr_def[abs_def] heap_rel_meta_def[abs_def])\n\nlemmas heap_rel_def = TrueI\n\ndefinition state_rel :: \"((funtyp, abstyp, ptrtyp) store \\ lifted_globals) set\"\nwhere\n \"state_rel = {(\\, h). True}\"\n\n\n(* Preprocess AutoCorres output *)\nlocal_setup {* fold tidy_C_fun_def' Cogent_functions *}\n\n(* Defined here because it relies on bool_t_C *)\n\nlemma corres_if_base:\n assumes split\\: \"[] \\ \\' \\ \\1 | \\2\"\n assumes typing_cond: \"\\', [], \\1 \\ Var c : TPrim Bool\"\n assumes val_rel_cond: \"\\!c = UPrim (LBool (bool_val' c' \\ (0::word8)))\"\n assumes corres_true: \"corres srel a a' \\ \\ \\' \\2 \\ s\"\n assumes corres_false: \"corres srel b b' \\ \\ \\' \\2 \\ s\"\n shows \"corres srel (If (Var c) a b)\n (do x \\ condition (\\s. bool_val' c' \\ 0) a' b'; gets (\\_. x) od)\n \\ \\ \\' \\' \\ s\"\n apply (clarsimp simp: corres_def snd_condition in_condition)\n apply (rename_tac r w)\n apply (insert typing_cond)\n apply (erule typing_varE)\n apply (frule matches_ptrs_split'[OF split\\])\n apply clarsimp\n apply (rename_tac r' w' r'' w'')\n apply (frule_tac \\=\\1 in matches_ptrs_proj', simp+)\n apply clarsimp\n apply (rename_tac rr')\n apply (insert val_rel_cond[unfolded val_rel_bool_t_C_def])\n apply clarsimp\n apply (cases \"bool_val' c'=0\")\n apply (insert corres_false[unfolded corres_def])[1]\n apply simp\n apply (erule impE, fast)\n apply clarsimp\n apply (rename_tac v' s')\n apply (erule_tac x=v' in allE)\n apply (erule_tac x=s' in allE )\n apply clarsimp\n apply (rename_tac \\' v)\n apply (rule_tac x=\\' in exI)\n apply (rule_tac x=v in exI)\n apply (fastforce intro!: u_sem_if u_sem_var elim: subst split: uval.splits lit.splits) \n apply (insert corres_true[unfolded corres_def])[1]\n apply simp\n apply (erule impE, fast)\n apply clarsimp\n apply (rename_tac v' s')\n apply (erule_tac x=v' in allE)\n apply (erule_tac x=s' in allE )\n apply clarsimp\n apply (rename_tac \\' v)\n apply (rule_tac x=\\' in exI)\n apply (rule_tac x=v in exI)\n apply (fastforce intro!: u_sem_if u_sem_var elim: subst split: uval.splits lit.splits)\n done\n\nlemmas corres_if = corres_if_base[where bool_val' = boolean_C,\n OF _ _ val_rel_bool_t_C_def[THEN meta_eq_to_obj_eq, THEN iffD1]]\n\n(* dummy *)\nlemmas corres_nested_let = TrueI\n\nlemma ops32_corres:\n \"val_rel a a' \\ corres state_rel ops32 (ops32' a') \\ [a] \\ [Some (fst (snd ops32_type))] \\ s\"\n apply (tactic {* corres_tac @{context}\n (peel_two ops32_typing_tree)\n @{thms ops32_def ops32'_def' ops32_type_def abbreviated_type_defs} [] []\n @{thm corres_if} [] @{thms } @{thms } []\n @{thm LETBANG_TRUE_def} @{thms } true *})\n done\n\nlemma ops64_corres:\n \"val_rel a a' \\ corres state_rel ops64 (ops64' a') \\ [a] \\ [Some (fst (snd ops64_type))] \\ s\"\n apply (tactic {* corres_tac @{context}\n (peel_two ops64_typing_tree)\n @{thms ops64_def ops64'_def' ops64_type_def abbreviated_type_defs} [] []\n @{thm corres_if} [] @{thms } @{thms } []\n @{thm LETBANG_TRUE_def} @{thms } true *})\n done\n\nlemma ops8_corres:\n \"val_rel a a' \\ corres state_rel ops8 (ops8' a') \\ [a] \\ [Some (fst (snd ops8_type))] \\ s\"\n apply (tactic {* corres_tac @{context}\n (peel_two ops8_typing_tree)\n @{thms ops8_def ops8'_def' ops8_type_def abbreviated_type_defs} [] []\n @{thm corres_if} [] @{thms } @{thms } []\n @{thm LETBANG_TRUE_def} @{thms } true *})\n done\n\nlemma ops16_corres:\n \"val_rel a a' \\ corres state_rel ops16 (ops16' a') \\ [a] \\ [Some (fst (snd ops16_type))] \\ s\"\n apply (tactic {* corres_tac @{context}\n (peel_two ops16_typing_tree)\n @{thms ops16_def ops16'_def' ops16_type_def abbreviated_type_defs} [] []\n @{thm corres_if} [] @{thms } @{thms } []\n @{thm LETBANG_TRUE_def} @{thms } true *})\n done\n\nlemma bool_ops_corres:\n \"val_rel a a' \\ corres state_rel bool_ops (bool_ops' a') \\ [a] \\ [Some (fst (snd bool_ops_type))] \\ s\"\n apply (tactic {* corres_tac @{context}\n (peel_two bool_ops_typing_tree)\n @{thms bool_ops_def bool_ops'_def' bool_ops_type_def abbreviated_type_defs} [] []\n @{thm corres_if} [] @{thms } @{thms } []\n @{thm LETBANG_TRUE_def} @{thms } true *})\n done\n\nend\nend\n\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/c-refinement/tests/Prim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2848668048252886}} {"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Proofs\nimports\n TSO\n Phases\n MarkObject\n StrongTricolour\n Valid_Refs\n Worklists\n Global_Noninterference\n Noninterference\n Initial_Conditions\nbegin\n\n(*>*)\nsection\\Top-level safety \\label{sec:top-level-correctness}\\\n\nlemma (in gc) I:\n \"\\ I \\ gc\"\napply (simp add: I_defs)\napply (rule valid_pre)\napply ( rule valid_conj_lift valid_all_lift | fastforce )+\ndone\n\nlemma (in sys) I:\n \"\\ I \\ sys\"\napply (simp add: I_defs)\napply (rule valid_pre)\napply ( rule valid_conj_lift valid_all_lift | fastforce )+\ndone\n\ntext\\\n\nWe need to separately treat the two cases of a single mutator and\nmultiple mutators. In the latter case we have the additional\nobligation of showing mutual non-interference amongst mutators.\n\n\\\n\nlemma mut_invsL[intro]:\n \"\\I\\ mutator m \\mut_m.invsL m'\\\"\nproof(cases \"m = m'\")\n case True\n interpret mut_m m' by unfold_locales\n from True show ?thesis\n apply (simp add: I_defs)\n apply (rule valid_pre)\n apply ( rule valid_conj_lift | fastforce )+\n done\nnext\n case False\n then interpret mut_m' m' m by unfold_locales blast\n from False show ?thesis\n apply (simp add: I_defs)\n apply (rule valid_pre)\n apply ( rule valid_conj_lift | fastforce )+\n done\nqed\n\n(* FIXME split mutators_phase_inv from global invs to local invs. Move to StrongTricolour or similar. note dependence on I *)\nlemma mutators_phase_inv[intro]:\n \"\\ I \\ mutator m \\ LSTP (mut_m.mutator_phase_inv m') \\\"\nproof(cases \"m = m'\")\n case True\n interpret mut_m m' by unfold_locales\n from True show ?thesis\n apply (simp add: I_defs)\n apply (rule valid_pre)\n apply ( rule valid_conj_lift valid_all_lift | fastforce )+\n done\nnext\n case False\n then interpret mut_m' m' m by unfold_locales blast\n from False show ?thesis\n apply (simp add: I_defs)\n apply (rule valid_pre)\n apply ( rule valid_conj_lift valid_all_lift | fastforce )+\n done\nqed\n\nlemma (in mut_m) I:\n \"\\ I \\ mutator m\"\napply (simp add: I_def gc.invsL_def invs_def Local_Invariants.invsL_def)\napply (rule valid_pre)\napply ( rule valid_conj_lift valid_all_lift | fastforce )+\napply (simp add: I_defs)\ndone\n\ncontext gc_system\nbegin\n\ntheorem I: \"gc_system \\\\<^bsub>pre\\<^esub> I\"\napply (rule VCG)\n apply (rule init_inv)\napply (rename_tac p)\napply (case_tac p, simp_all)\n apply (rule mut_m.I[unfolded valid_proc_def, simplified])\n apply (rule gc.I[unfolded valid_proc_def, simplified])\napply (rule sys.I[unfolded valid_proc_def, simplified])\ndone\n\ntext\\\n\n\\label{sec:proofs-headline-safety}\n\nOur headline safety result follows directly.\n\n\\\n\ncorollary safety: \"gc_system \\\\<^bsub>pre\\<^esub> LSTP valid_refs\"\nusing I unfolding I_def invs_def valid_refs_def prerun_valid_def\napply clarsimp\napply (drule_tac x=\\ in spec)\napply (drule (1) mp)\napply (rule alwaysI)\napply (erule_tac i=i in alwaysE)\napply (clarsimp simp: valid_refs_invD(1))\ndone\n\nend\n\ntext\\\n\nThe GC is correct for the remaining fixed-but-arbitrary initial\nconditions.\n\n\\\n\ninterpretation gc_system_interpretation: gc_system undefined .\n\n(* unused_thms Main Sublist CIMP - *)\n\n\nsection\\ A concrete system state \\label{sec:concrete-system-state} \\\n\ntext\\\n\nWe demonstrate that our definitions are not vacuous by exhibiting a\nconcrete initial state that satisfies the initial conditions. The heap\nis shown in Figure~\\ref{fig:concrete-heap}. We use Isabelle's notation\nfor types of a given size.\n\n\\begin{figure}\n \\centering\n \\includegraphics{heap.pdf}\n \\caption{A concrete system state.}\n \\label{fig:concrete-heap}\n\\end{figure}\n\n\\\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/ConcurrentGC/Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2848667981636509}} {"text": "(* Title: HOL/MicroJava/Comp/Index.thy\n Author: Martin Strecker\n*)\n\n(* Index of variable in list of parameter names and local variables *)\n\ntheory Index\nimports AuxLemmas DefsComp\nbegin\n\n(*indexing a variable name among all variable declarations in a method body*)\ndefinition index :: \"java_mb => vname => nat\" where\n \"index == \\ (pn,lv,blk,res) v.\n if v = This\n then 0 \n else Suc (length (takeWhile (\\ z. z~=v) (pn @ map fst lv)))\"\n\n\nlemma index_length_pns: \"\n \\ i = index (pns,lvars,blk,res) vn;\n wf_java_mdecl G C ((mn,pTs),rT, (pns,lvars,blk,res));\n vn \\ set pns\\\n \\ 0 < i \\ i < Suc (length pns)\"\n apply (simp add: wf_java_mdecl_def index_def)\n apply (subgoal_tac \"vn \\ This\")\n apply (auto intro: length_takeWhile)\n done\n\nlemma index_length_lvars: \"\n \\ i = index (pns,lvars,blk,res) vn;\n wf_java_mdecl G C ((mn,pTs),rT, (pns,lvars,blk,res));\n vn \\ set (map fst lvars)\\\n \\ (length pns) < i \\ i < Suc((length pns) + (length lvars))\"\n apply (simp add: wf_java_mdecl_def index_def)\n apply (subgoal_tac \"vn \\ This\")\n apply simp\n apply (subgoal_tac \"\\ x \\ set pns. (\\z. z \\ vn) x\")\n apply simp\n apply (subgoal_tac \"length (takeWhile (\\z. z \\ vn) (map fst lvars)) < length (map fst lvars)\")\n apply simp\n apply (rule length_takeWhile)\n apply simp\n apply (simp add: map_of_in_set)\n apply (intro strip notI) \n apply simp \n apply blast\n done\n\n\n(*** index ***)\n\nlemma select_at_index : \n \"x \\ set (gjmb_plns (gmb G C S)) \\ x = This\n \\ (the (loc This) # glvs (gmb G C S) loc) ! (index (gmb G C S) x) = the (loc x)\"\n apply (simp only: index_def gjmb_plns_def)\n apply (case_tac \"gmb G C S\" rule: prod.exhaust)\n apply (simp add: galldefs del: set_append map_append)\n apply (rename_tac a b)\n apply (case_tac b, simp add: gmb_def gjmb_lvs_def del: set_append map_append)\n apply (intro strip)\n apply (simp del: set_append map_append)\n apply (frule length_takeWhile)\n apply (frule_tac f = \"(the \\ loc)\" in nth_map)\n apply simp\n done\n\nlemma lift_if: \"(f (if b then t else e)) = (if b then (f t) else (f e))\"\n by auto\n\nlemma update_at_index: \"\n \\ distinct (gjmb_plns (gmb G C S));\n x \\ set (gjmb_plns (gmb G C S)); x \\ This \\ \\\n (locvars_xstate G C S (Norm (h, l)))[index (gmb G C S) x := val] =\n locvars_xstate G C S (Norm (h, l(x\\val)))\"\n apply (simp only: locvars_xstate_def locvars_locals_def index_def)\n apply (case_tac \"gmb G C S\" rule: prod.exhaust, simp)\n apply (rename_tac a b)\n apply (case_tac b, simp)\n apply (rule conjI)\n apply (simp add: gl_def)\n apply (simp add: galldefs del: set_append map_append)\n done\n\n\n(* !!!! incomprehensible: why can't List.takeWhile_append2 be applied the same \n way in the second case as in the first case ? *)\nlemma index_of_var: \"\\ xvar \\ set pns; xvar \\ set (map fst zs); xvar \\ This \\\n \\ index (pns, zs @ ((xvar, xval) # xys), blk, res) xvar = Suc (length pns + length zs)\"\n apply (simp add: index_def)\n apply (subgoal_tac \"(\\x. ((x \\ (set pns)) \\ ((\\z. (z \\ xvar))x)))\")\n apply simp\n apply (subgoal_tac \"(takeWhile (\\z. z \\ xvar) (map fst zs @ xvar # map fst xys)) = map fst zs @ (takeWhile (\\z. z \\ xvar) (xvar # map fst xys))\")\n apply simp\n apply (rule List.takeWhile_append2)\n apply auto\n done\n\n\n\n\n(* The following definition should replace the conditions in WellType.thy / wf_java_mdecl\n*)\ndefinition disjoint_varnames :: \"[vname list, (vname \\ ty) list] \\ bool\" where\n \"disjoint_varnames pns lvars \\ \n distinct pns \\ unique lvars \\ This \\ set pns \\ This \\ set (map fst lvars) \\ \n (\\pn\\set pns. pn \\ set (map fst lvars))\"\n\n\nlemma index_of_var2: \"\n disjoint_varnames pns (lvars_pre @ (vn, ty) # lvars_post)\n \\ index (pns, lvars_pre @ (vn, ty) # lvars_post, blk, res) vn =\n Suc (length pns + length lvars_pre)\"\n apply (simp add: disjoint_varnames_def index_def unique_def)\n apply (subgoal_tac \"vn \\ This\", simp)\n apply (subgoal_tac\n \"takeWhile (\\z. z \\ vn) (map fst lvars_pre @ vn # map fst lvars_post) =\n map fst lvars_pre @ takeWhile (\\z. z \\ vn) (vn # map fst lvars_post)\")\n apply simp\n apply (rule List.takeWhile_append2)\n apply auto\n done\n\nlemma wf_java_mdecl_disjoint_varnames: \n \"wf_java_mdecl G C (S,rT,(pns,lvars,blk,res))\n \\ disjoint_varnames pns lvars\"\n apply (cases S)\n apply (simp add: wf_java_mdecl_def disjoint_varnames_def map_of_in_set)\n done\n\nlemma wf_java_mdecl_length_pTs_pns: \n \"wf_java_mdecl G C ((mn, pTs), rT, pns, lvars, blk, res)\n \\ length pTs = length pns\"\n by (simp add: wf_java_mdecl_def)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/Comp/Index.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.40356685373537454, "lm_q1q2_score": 0.28483144309771635}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__5_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__5_on_rules imports n_mutualEx_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__5 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__5) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6992544210587585, "lm_q2_score": 0.4073334000459302, "lm_q1q2_score": 0.2848296808270126}} {"text": "theory Simple_Network_Language_Deadlock_Checking\n imports Simple_Network_Language_Model_Checking Deadlock.Deadlock_Checking\nbegin\n\ncontext Simple_Network_Impl_nat_ceiling_start_state\nbegin\n\ncontext\n fixes \\\n assumes formula_is_false: \"formula = formula.EX (not sexp.true)\"\nbegin\n\nlemma F_is_FalseI:\n shows \"PR_CONST F = (\\_. False)\"\n by (subst formula_is_false) auto\n\nlemma final_fun_is_False:\n \"Fi a = False\"\n by (subst formula_is_false) auto\n\nlemmas deadlock_checker_hoare = impl.deadlock_checker_hoare[\n OF final_fun_is_False F_is_FalseI, folded deadlock_start_iff has_deadlock_def]\n\nend\n\nthm impl.is_start_in_states_impl_def\nschematic_goal deadlock_checker_alt_def:\n \"impl.deadlock_checker \\ ?impl\"\n unfolding impl.deadlock_checker_def\n unfolding impl.succs_impl_def\n unfolding impl.check_deadlock_neg_impl_def impl.check_deadlock_impl_def\n apply (abstract_let impl.is_start_in_states_impl is_start)\n unfolding impl.is_start_in_states_impl_def\n apply (abstract_let impl.E_op''_impl E_op''_impl)\n unfolding impl.E_op''_impl_def fw_impl'_int\n apply (abstract_let trans_impl trans_impl)\n unfolding trans_impl_def\n apply (abstract_let int_trans_impl int_trans_impl)\n apply (abstract_let bin_trans_from_impl bin_trans_impl)\n apply (abstract_let broad_trans_from_impl broad_trans_impl)\n unfolding int_trans_impl_def bin_trans_from_impl_def broad_trans_from_impl_def\n apply (abstract_let trans_in_broad_grouped trans_in_broad_grouped)\n apply (abstract_let trans_out_broad_grouped trans_out_broad_grouped)\n apply (abstract_let trans_in_map trans_in_map)\n apply (abstract_let trans_out_map trans_out_map)\n apply (abstract_let int_trans_from_all_impl int_trans_from_all_impl)\n unfolding int_trans_from_all_impl_def\n apply (abstract_let int_trans_from_vec_impl int_trans_from_vec_impl)\n unfolding int_trans_from_vec_impl_def\n apply (abstract_let int_trans_from_loc_impl int_trans_from_loc_impl)\n unfolding int_trans_from_loc_impl_def\n apply (abstract_let trans_i_map trans_i_map)\n unfolding trans_out_broad_grouped_def trans_out_broad_map_def\n unfolding trans_in_broad_grouped_def trans_in_broad_map_def\n unfolding trans_in_map_def trans_out_map_def\n unfolding trans_i_map_def\n apply (abstract_let trans_map trans_map)\n apply (abstract_let \"inv_fun :: nat list \\ int list \\ _\" inv_fun)\n unfolding inv_fun_alt_def\n apply (abstract_let invs2 invs)\n unfolding invs2_def\n unfolding k_impl_alt_def\n apply (abstract_let k_i k_i) (* Could be killed *)\n apply (abstract_let n_ps n_ps)\n (* These would need to be moved to a defs locale *)\n unfolding k_i_def impl.state_copy_impl_def impl.a\\<^sub>0_impl_def impl.abstr_repair_impl_def\n impl.subsumes_impl_def impl.emptiness_check_impl_def impl.abstra_repair_impl_def\n impl.init_dbm_impl_def\n by (rule Pure.reflexive)\n\nend\n\nconcrete_definition deadlock_checker uses\n Simple_Network_Impl_nat_ceiling_start_state.deadlock_checker_alt_def\n\ndefinition precond_dc where\n \"precond_dc\n show_clock show_state broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula \\\n if Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula\n then\n deadlock_checker\n broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 show_clock show_state\n \\ (\\ x. return (Some x))\n else return None\"\n\ntheorem deadlock_check:\n \" precond_dc\n show_clock show_state broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0\n (formula.EX (not sexp.true))\n <\\ Some r \\ \\(\n Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 (formula.EX (not sexp.true)) \\\n r = has_deadlock (N broadcast automata bounds) (L\\<^sub>0, map_of s\\<^sub>0, \\_ . 0)\n )\n | None \\ \\(\\ Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 (formula.EX (not sexp.true)))\n >\\<^sub>t\"\nproof -\n define A where \"A \\ N broadcast automata bounds\"\n define check where \"check \\ A,(L\\<^sub>0, map_of s\\<^sub>0, \\_ . 0) \\ (formula.EX (not sexp.true))\"\n note [sep_heap_rules] = Simple_Network_Impl_nat_ceiling_start_state.deadlock_checker_hoare[\n OF _ HOL.refl,\n of broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 _,\n unfolded UPPAAL_Reachability_Problem_precompiled_defs.init_def,\n folded A_def\n ]\n show ?thesis\n unfolding A_def[symmetric] precond_dc_def\n by (sep_auto simp: deadlock_checker.refine[symmetric] pure_def has_deadlock_def)\nqed\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/Simple_Network_Language_Deadlock_Checking.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.66192288918838, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.2847243757526624}} {"text": "theory ProcSendCase\n imports ResMapValid ReduceWTS ProcDef ProcCVars\nbegin\n \nlemma cancel_strong_leq_use_env: \"\\ strong_use_env r_x \\ \\ leq_use_env (diff_use_env r_x r_x) r_s\" \n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: strong_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma sfl_diff_use_env: \"\\ strong_use_env r_ex; leq_use_env r_ex r_s; is_own r \\ \\ diff_use_env r_s (diff_use_env (lift_use_env r_s r) r_ex) = r_ex\"\n apply (case_tac \"\\ x. diff_use_env r_s (diff_use_env (lift_use_env r_s r) r_ex) x = r_ex x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: is_own_def)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_ex x\")\n apply (auto) \n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \n (* the question right now is, how do we make these types line up? *)\n \nlemma safe_val_exp: \"\\ well_typed env r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a b))) v)) tau r_s2 rx;\n env (Loc a) = Some (ChanTy t SEnd); is_value c; is_value v \\ \\\n well_typed env (np_dom_use_env env v) v t (np_dom_use_env env v) (np_dom_use_env env v)\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (case_tac \"t \\ t1\")\n apply (simp add: pure_fun_def)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"v\" and tau=\"t\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (simp)\n apply (rule_tac value_is_sexp)\n apply (auto)\n (* r = rb *)\n apply (case_tac \"rb \\ r\")\n apply (simp add: pure_fun_def)\n (* the idea is that the infl_sexp_wp requirements are strictly greater than np_dom. since np_dom is strong, there is an exact way of\n subtracting to get to np_dom. (we do cheat a little by lifting rx2). *)\n apply (rule_tac t=\"np_dom_use_env env v\" and s=\"diff_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3))\n (diff_use_env (lift_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)) rb) (np_dom_use_env env v))\" in subst)\n apply (rule_tac sfl_diff_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n (* to prove that the infl_sexp_wp reqs are greater than np_dom, we use the fact that any npv must have a permission *)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (auto)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (case_tac \"comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3) x \\ OwnPerm\")\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac x=\"x\" and env=\"env\" and e=\"v\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (cut_tac r_sa=\"lift_use_env rx2 r\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_no_own_both)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (simp add: is_own_def)\n apply (auto)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* with that in mind, we manipulate until we match the infl sexp lemma *)\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_req)\n apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n (* next, we must show that the differential is actually subtractible, which is true since it removes all non-prim vars *)\n apply (auto)\n apply (case_tac \"np_dom_use_env env v x \\ OwnPerm\")\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (cut_tac r_s=\"lift_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)) r\" and\n r_ex=\"np_dom_use_env env v\" and x=\"x\" in diff_use_none_ex)\n apply (simp)\n apply (simp add: own_env_vars_def)\n done\n \n \nlemma safe_recv_exp: \"\\ well_typed env r_s1 (app_hole h (AppExp (ConstExp RecvConst) (VarExp (LocType a b)))) tau r_s2 rx;\n env (Loc a) = Some (ChanTy t REnd); well_typed env r_x v t r_x r_x; disj_use_env r_s1 r_x; \n strong_use_env r_x; is_value c; is_value v; is_own r \\ \\\n well_typed env (comp_use_env r_s1 r_x) (app_hole h v) tau r_s2 rx\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_exa)\" and\n r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (Loc b) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"diff_use_env (comp_use_env r_s1 r_x) r_x\"\n and rx=\"diff_use_env r_x r_x\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac well_typed_comp_perms2)\n apply (simp add: pure_fun_def)\n apply (auto)\n apply (rule_tac comm_disj_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in disj_leq_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac cancel_strong_leq_use_env)\n apply (simp)\n (* lhs pair case. *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* rhs pair case. *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (simp_all)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_x\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case. *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case. *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* rhs pair case. *)\n apply (rule_tac x=\"comp_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (simp_all)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_x\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done\n \nlemma safe_own_npv_use: \"\\ well_typed env r_s1 (app_hole h (AppExp f v)) tau r_s2 rx; is_value f; strong_fun f;\n a \\ NoRef; is_value v; x \\ non_prim_vars env v \\ \\ r_s1 x = OwnPerm\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n (* base case *)\n apply (cut_tac f=\"f\" and r=\"r\" in strong_fun_own)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"v\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (simp)\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"v\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (simp add: is_own_def)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* rhs pair *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done \n \n \nlemma safe_send_exp_ih: \"\\ well_typed env r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) c) v)) tau r_s2 rx; is_value c; is_value v \\ \\\n well_typed env r_s1 (app_hole h (ConstExp UnitConst)) tau r_s2 rx\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2b\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lhs app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto) \n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n done\n \n \nlemma safe_send_exp: \"\\ well_typed env r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a b))) v)) tau r_s2 rx;\n valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s1; wf_hole h; is_value v \\ \\\n well_typed env (diff_use_env r_s1 (full_dom_use_env env rs_map v)) (app_hole h (ConstExp UnitConst)) tau\n (diff_use_env r_s2 (full_dom_use_env env rs_map v)) (diff_use_env rx (full_dom_use_env env rs_map v))\" \n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac c=\"VarExp (LocType a b)\" in safe_send_exp_ih)\n apply (auto)\n (* we want to show that if xa is in the dominator, it is not an np-var in h.\n > if xa is an np-var itself, it cannot be in e by lemma *)\n apply (case_tac \"x \\ non_prim_vars env v\")\n apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and v=\"VarExp (LocType a b)\" and e=\"v\" in safe_send_hole_npv_use)\n apply (auto)\n (* otherwise, xa is in the completion. we identify its ancestor z. *)\n apply (simp add: own_env_vars_def)\n apply (simp add: full_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (case_tac \"\\xa. x = Loc xa \\ (\\l z. Loc z \\ non_prim_vars env v \\ path_lookup rs_map z l xa)\")\n apply (auto)\n (* we note that z is a np-var of e therefore r_s1 z = Own *)\n apply (cut_tac x=\"Loc z\" and env=\"env\" and f=\"AppExp (ConstExp SendConst) (VarExp (LocType a b))\" in safe_own_npv_use)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: is_own_def)\n (* xa then is in the lookup map of some parent y. *)\n apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"xa\" in path_lookup_parent)\n apply (auto)\n (* with that in mind, by separation, x is disjoint from r_s1. *)\n apply (case_tac \"r_s1 (Loc xa) \\ NoPerm\")\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc xa\" in allE)\n apply (auto)\n (* by extension, x is not in 'h (send c v)' *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"Loc xa\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: non_prim_vars_def) \n (* the very last part is showing that x not in 'h (send c v)' implies x not in 'h ()'. *)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a b))) v\" in app_hole_res_vars2)\n apply (auto)\n done\n \nlemma disj_lift_use_envr_rev: \"\\ strong_disj_use_env r_s r_x \\ \\ disj_use_env r_s (lift_use_env r_x r)\" \n apply (simp add: strong_disj_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \nlemma lift_strong_disj_use_env1: \"\\ strong_disj_use_env r_x r_s \\ \\ strong_disj_use_env (lift_use_env r_x r) r_s\" \n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \nlemma send_disj_nres_map: \"\\ disj_nres_map p_map; p_map u1 = Some r_sa; p_map u2 = Some r_sb; is_own r;\n leq_use_env r_xa (lift_use_env r_sa r); leq_use_env r_xb (comp_use_env (lift_use_env r_sa r) (lift_use_env r_sb r));\n strong_disj_use_env r_xa r_xb \\ \\ disj_nres_map (add_env (add_env p_map u1 r_xa) u2 r_xb)\" \n apply (rule_tac disj_add_nres_map) \n apply (rule_tac disj_add_nres_map) \n apply (simp)\n (* proving disjointness for the send thread's material *)\n apply (rule_tac r_s=\"lift_use_env r_sa r\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: disj_nres_map_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = u1\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n (* proving disjointness for the recv thread *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"u2 = x\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (case_tac \"u1 = x\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (simp add: add_env_def)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (simp add: add_env_def)\n apply (simp add: disj_nres_map_def)\n apply (rule_tac r_s=\"comp_use_env (lift_use_env r_sa r) (lift_use_env r_sb r)\" in strong_disj_leq_use_env1)\n apply (rule_tac strong_disj_comp_use_env2)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u2\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n done\n \nfun proper_hole where\n \"proper_hole rs_map ExpHole = True\"\n| \"proper_hole rs_map (AppHole1 h e) = (proper_hole rs_map h \\ proper_exp rs_map e)\" \n| \"proper_hole rs_map (AppHole2 v h) = (proper_exp rs_map v \\ proper_hole rs_map h)\"\n| \"proper_hole rs_map (IfHole h e1 e2) = (proper_hole rs_map h \\ proper_exp rs_map e1 \\ proper_exp rs_map e2)\" \n| \"proper_hole rs_map (PairHole1 h e) = (proper_hole rs_map h \\ proper_exp rs_map e)\" \n| \"proper_hole rs_map (PairHole2 v h) = (proper_exp rs_map v \\ proper_hole rs_map h)\"\n \nlemma proper_app_hole_split1: \"\\ proper_exp rs_map (app_hole h e) \\ \\ proper_hole rs_map h\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n\nlemma proper_app_hole_split2: \"\\ proper_exp rs_map (app_hole h e) \\ \\ proper_exp rs_map e\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n \nlemma proper_app_hole_recon: \"\\ proper_hole rs_map h; proper_exp rs_map e \\ \\ proper_exp rs_map (app_hole h e)\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n \nlemma proper_app_hole: \"\\ proper_exp rs_map (app_hole h e1); proper_exp rs_map e2 \\ \\ proper_exp rs_map (app_hole h e2)\" \n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" and e=\"e1\" in proper_app_hole_split1)\n apply (auto)\n apply (rule_tac proper_app_hole_recon)\n apply (auto)\n done\n \nlemma srps_send_case: \"\\well_typed_system env rs_map p_map s2 ps1; valid_reduct app_red_exp; r_ax = SendAct;\n ps1 u1 = Some (app_hole h1 (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s a_s))) v));\n ps1 u2 = Some (app_hole h2 (AppExp (ConstExp RecvConst) (VarExp (LocType x_r a_r)))); u1 \\ u2; wf_hole h1;\n wf_hole h2; is_value v; s2 x_s = Some ChanSValue;\n s2 x_r = Some (ChanRValue x_s); s1 = s2;\n ps2 = add_env (add_env ps1 u1 (app_hole h1 (ConstExp UnitConst))) u2 (app_hole h2 v)\\\n \\ \\r_s g_ax.\n (\\p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2\n (add_env (add_env ps1 u1 (app_hole h1 (ConstExp UnitConst))) u2 (app_hole h2 v))) \\\n safe_act s2 r_s g_ax\"\n (* send case. no resources are generated in this step *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* we have to get the well-typedness statement for h1 [send c v] *)\n apply (case_tac \"\\ (case ps1 u1 of None \\ True | Some e \\ (case p_map u1 of None \\ False | Some r_s \\ \\rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\ proper_exp rs_map e))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (case_tac \"p_map u1\")\n apply (auto)\n (* we also get the well-typedness statement for h2 [recv c v] *)\n apply (case_tac \"\\ (case ps1 u2 of None \\ True | Some e \\ (case p_map u2 of None \\ False | Some r_s \\ \\rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\ proper_exp rs_map e))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u2\" in allE)\n apply (erule_tac x=\"u2\" in allE)\n apply (auto)\n apply (case_tac \"p_map u2\")\n apply (auto)\n (* next we get the send channel's type *)\n apply (case_tac \"\\ (\\ t. env (Loc x_s) = Some (ChanTy t SEnd))\")\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"x_s\" in allE)\n apply (erule_tac x=\"x_s\" in allE)\n apply (auto)\n apply (case_tac \"env (Loc x_s)\")\n apply (auto)\n (* and the recv channel's type *)\n apply (case_tac \"\\ env (Loc x_r) = Some (ChanTy t REnd)\")\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"x_r\" in allE)\n apply (erule_tac x=\"x_r\" in allE)\n apply (auto)\n apply (case_tac \"env (Loc x_r)\")\n apply (auto)\n (* prelim: we prove the dominator of v \\ lift a r (the permission map of u1) *)\n apply (cut_tac eq_own)\n apply (auto)\n apply (cut_tac r_sc=\"np_dom_use_env env v\" and r_sb=\"np_dom_use_env env (app_hole h1 (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s a_s))) v))\"\n and r_sa=\"lift_use_env a r\" in trans_leq_use_env)\n apply (rule_tac wt_np_leq_use_env)\n apply (auto)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac dist_dom_leq_use_env)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (rule_tac app_hole_res_vars)\n apply (auto)\n (* we can generate a type for h1 () *)\n apply (cut_tac env=\"env\" and v=\"v\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h1\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and s=\"s2\" and rs_map=\"rs_map\" in safe_send_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)\n (* - complete proof that a is still valid *)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n (* we can also generate a type for h2 v, first by getting a type for v, and then by putting it in the hole *)\n apply (cut_tac env=\"env\" and v=\"v\" and h=\"h1\" and a=\"x_s\" and a=\"a_s\" and t=\"t\" in safe_val_exp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"aa\" and h=\"h2\" and r_x=\"np_dom_use_env env v\" in safe_recv_exp)\n apply (auto)\n (* - p_map disjointness proves that the permissions being added are disjoint *)\n apply (rule_tac r_s=\"lift_use_env a r\" in disj_leq_use_env2)\n apply (case_tac \"\\x y. x \\ y \\ strong_disj_use_env (nres_lookup p_map x) (nres_lookup p_map y)\")\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u2\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (rule_tac disj_lift_use_envr_rev)\n apply (simp)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: disj_nres_map_def)\n (* - proving the dominator is strong *)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n (* lastly it remains to prove the new process map is well-formed *)\n apply (rule_tac x=\"add_env (add_env p_map u1 (diff_use_env a (full_dom_use_env env rs_map v)))\n u2 (comp_use_env aa (np_dom_use_env env v))\" in exI)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* completeness *)\n apply (rule_tac add_full_nres_map)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* disjointness, assisted by lemma *)\n apply (rule_tac r_sa=\"a\" and r_sb=\"aa\" in send_disj_nres_map)\n apply (simp_all)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac strong_disj_comp_use_env1)\n apply (rule_tac r_s=\"a\" in strong_disj_leq_use_env1)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u2\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"full_dom_use_env env rs_map v\" in strong_disj_leq_use_env2)\n apply (rule_tac diff_strong_disj_use_env)\n apply (simp add: full_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac full_dom_leq_use_env)\n (* proving that the processes are well-typed *)\n apply (case_tac \"u = u1\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac proper_app_hole)\n apply (simp)\n apply (simp add: proper_exp_def)\n apply (case_tac \"u = u2\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac proper_app_hole)\n apply (simp)\n apply (cut_tac rs_map=\"rs_map\" and h=\"h1\" and e=\"AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s a_s))) v\" in proper_app_hole_split2)\n apply (simp)\n apply (simp add: proper_exp_def)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (case_tac \"ps1 u\")\n apply (auto)\n apply (simp add: add_env_def)\n (* proving res_map element containment *)\n apply (rule_tac add_sub_nres_map1)\n apply (rule_tac add_sub_nres_map1)\n apply (simp)\n apply (rule_tac r_s=\"a\" in trans_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u2\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac r_s=\"lift_use_env a r\" in trans_sub_use_env)\n apply (rule_tac lift_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* poriving the separation of the new maps *)\n apply (case_tac \"u = u1\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"a\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (case_tac \"u = u2\")\n apply (simp add: add_env_def)\n apply (rule_tac comp_sep_nres_map)\n apply (erule_tac x=\"u2\" in allE)\n apply (auto)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env a r\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (simp)\n apply (simp add: add_env_def)\n done\n \n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ProcSendCase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.2847243700151911}} {"text": "(* Title: Lightweight Java, the equivalence functions\n Authors: Rok Strnisa , 2006\n Matthew Parkinson , 2006\n Maintainer: \n*)\n\ntheory Lightweight_Java_Equivalence imports Lightweight_Java_Definition begin\n\n(* BEGIN: HELPER FUNCTIONS *)\n\nlemma map_id[simp]: \"map id list = list\" by (induct list) auto\n\nlemma id_map_two[simp]: \"map (\\(x,y). (x,y)) list = list\" by (induct list) auto\n\nlemma id_image_two[simp]: \"(\\(x,y). (x,y)) ` set list = set list\" by (induct list) auto\n\nlemma map_fst[simp]: \"map (\\(x, y). x) list = map fst list\" by (induct list) auto\n\nlemma map_snd[simp]: \"map (\\(x, y). y) list = map snd list\" by (induct list) auto\n\nlemma zip_map_map_two [simp]: \"zip (map fst list) (map snd list) = list\"\nby (induct list) auto\n\nlemma concat_map_singlton [simp]: \"concat (map (\\e. [e]) list) = list\"\nby (induct list) simp_all\n\nlemma list_all_map_P [simp]: \"list_all (\\b. b) (map (\\x. P x) list) = (\\x \\ set list. P x)\"\nby (induct list) simp_all\n\nlemma dom_single[simp]: \"a : dom (Map.empty(k \\ v)) = (a = k)\"\nby (simp add: dom_def)\n\nlemma predicted_lu[rule_format, simp]:\n \"x \\ set list \\ map_of (map (\\key. (key, value)) list) x = Some value\"\nby (induct list) auto\n\nlemma key_in_map1[simp]: \"k \\ dom M' \\ (M ++ M') k = M k\"\napply (subgoal_tac \"M' k = None\")\napply (simp add: map_add_def, force simp add: domI)\ndone\n\nlemma forall_cons [rule_format]: \"(\\x \\ set (s#S). P x) \\ y \\ set S \\ P y\"\nby (induct_tac S) simp_all\n\nlemma mem_cong[rule_format]:\n \"x \\ set list \\ (f x \\ set (map f list))\"\nby (induct list) auto\n\nlemma forall_union: \"\\\\a \\ dom A. P (A a); \\b \\ dom B. P (B b)\\ \\ \\x \\ dom A \\ dom B. P ((B ++ A) x)\"\napply(safe)\n apply(force)\napply(drule_tac x = x in bspec, simp add: domI)\napply(case_tac \"A x = None\")\n apply(force simp add: map_add_def)\nby (force)\n\n(* END: HELPER FUNCTIONS *)\n\ndefinition\nclass_name_f :: \"cld \\ dcl\"\nwhere\n\"class_name_f cld =\n (case cld of cld_def dcl cl fds mds \\ dcl)\"\n\n\ndefinition\nsuperclass_name_f :: \"cld \\ cl\"\nwhere\n\"superclass_name_f cld =\n (case cld of cld_def dcl cl fds mds \\ cl)\"\nlemma [simp]: \"(superclass_name cld cl) = (superclass_name_f cld = cl)\"\nby (force simp add: superclass_name_f_def split: cld.splits\n intro: superclass_nameI elim: superclass_name.cases)\n\ndefinition\nclass_fields_f :: \"cld \\ fds\"\nwhere\n\"class_fields_f cld =\n (case cld of cld_def dcl cl fds mds \\ fds)\"\nlemma [simp]: \"(class_fields cld fds) = (class_fields_f cld = fds)\"\nby (force simp add: class_fields_f_def split: cld.splits\n intro: class_fieldsI elim: class_fields.cases)\n\ndefinition\nclass_methods_f :: \"cld \\ meth_defs\"\nwhere\n\"class_methods_f cld =\n (case cld of cld_def dcl cl fds mds \\ mds)\"\nlemma [simp]: \"(class_methods cld fds) = (class_methods_f cld = fds)\"\nby (force simp add: class_methods_f_def split: cld.splits\n intro: class_methodsI elim: class_methods.cases)\n\ndefinition\nmethod_name_f :: \"meth_def \\ meth\"\nwhere\n\"method_name_f md =\n (case md of meth_def_def meth_sig meth_body \\\n (case meth_sig of meth_sig_def cl meth vds \\ meth))\"\nlemma [simp]: \"(method_name md m) = (method_name_f md = m)\"\nby (force simp add: method_name_f_def split: meth_def.splits meth_sig.splits\n intro: method_nameI elim: method_name.cases)\n\ndefinition\ndistinct_names_f :: \"P \\ bool\"\nwhere\n\"distinct_names_f P =\n (distinct (map class_name_f P))\"\nlemma distinct_names_map[rule_format]:\n \"(\\x\\set cld_dcl_list. case_prod (\\cld. (=) (class_name_f cld)) x) \\ distinct (map snd cld_dcl_list)\n \\ distinct_names_f (map fst cld_dcl_list)\"\napply(induct cld_dcl_list)\n apply(clarsimp simp add: distinct_names_f_def)+ apply(force)\ndone\nlemma [simp]: \"(distinct_names P) = (distinct_names_f P)\"\napply(rule)\n apply(erule distinct_names.cases) apply(clarsimp simp add: distinct_names_map)\napply(simp add: distinct_names_f_def)\napply(rule_tac cld_dcl_list = \"map (\\cld. (cld, class_name_f cld)) P\" in dn_defI)\n apply(simp) apply(induct P) apply(simp) apply(simp)\n apply(clarsimp)\napply(clarsimp) apply(induct P) apply(simp) apply(force)\ndone\n\nprimrec\nfind_cld_f :: \"P \\ ctx \\ fqn \\ ctxcld_opt\"\nwhere\n\"find_cld_f [] ctx fqn = None\" |\n\"find_cld_f (cld#clds) ctx fqn =\n (case cld of cld_def dcl cl fds mds \\\n (case fqn of fqn_def dcl' \\\n (if dcl = dcl' then Some (ctx, cld) else find_cld_f clds ctx fqn)))\"\nlemma [simp]: \"(find_cld P ctx fqn ctxcld_opt) = (find_cld_f P ctx fqn = ctxcld_opt)\"\napply(rule)\n apply(induct rule: find_cld.induct) apply(simp+)\n apply(clarsimp)\napply(induct P)\n apply(simp add: fc_emptyI)\napply(case_tac fqn) apply(rename_tac cld clds dcl) apply(case_tac cld)\napply(clarsimp) apply(rename_tac dcl' cl' vds' mds') apply(rule)\napply(clarsimp) apply(rule fc_cons_trueI) apply(simp) apply(force)\napply(force intro: fc_cons_falseI[simplified])\ndone\n\nlemma find_to_mem[rule_format]:\n \"find_cld_f P ctx fqn = Some (ctx', cld) \\ cld : set P\"\napply(induct P) by (clarsimp split: cld.splits fqn.splits)+\n\nlemma find_cld_name_eq[rule_format]:\n \"\\ctxcld. find_cld_f P ctx (fqn_def dcl) = Some ctxcld \\ (\\cl fds mds. (ctx, cld_def dcl cl fds mds) = ctxcld)\"\napply(induct P) apply(simp) apply(clarsimp split: cld.splits fqn.splits) done\n\nprimrec\nfind_type_f :: \"P \\ ctx \\ cl \\ ty_opt\"\nwhere\n\"find_type_f P ctx cl_object = Some ty_top\" |\n\"find_type_f P ctx (cl_fqn fqn) =\n (case fqn of fqn_def dcl \\\n (case find_cld_f P ctx fqn of None \\ None | Some (ctx', cld) \\\n Some (ty_def ctx' dcl)))\"\nlemma [simp]: \"(find_type P ctx cl ty_opt) = (find_type_f P ctx cl = ty_opt)\"\napply(rule)\n apply(force elim: find_type.cases split: fqn.splits)\napply(case_tac cl) apply(force intro: ft_objI)\napply(rename_tac fqn)\napply(case_tac fqn) apply(clarsimp)\napply(split option.splits) apply(rule)\n apply(force intro: ft_nullI)\nby (force intro: ft_dclI)\n\nlemma mem_remove: \"cld : set P \\ length (remove1 cld P) < length P\"\napply(induct P) by(simp, force split: if_split_asm)\n\nlemma finite_program[rule_format, intro]:\n \"\\P cld. (\\ctx ctx' fqn. find_cld_f P ctx fqn = Some (ctx', cld)) \\\n length (remove1 cld P) < length P\"\napply(clarsimp) apply(drule find_to_mem) by (simp add: mem_remove)\n\nlemma path_length_eq[rule_format]:\n \"path_length P ctx cl nn \\ \\nn'. path_length P ctx cl nn' \\ nn = nn'\"\napply(erule path_length.induct)\n apply(clarsimp) apply(erule path_length.cases) apply(simp) apply(simp)\napply(rule) apply(rule)\napply(erule_tac ?a4.0 = nn' in path_length.cases) apply(clarify)\napply(clarsimp)\ndone\n\nlemma fpr_termination[iff]:\n \"\\P cld ctx ctx' fqn. find_cld_f P ctx fqn = Some (ctx', cld) \\ acyclic_clds P\n \\ The (path_length P ctx' (superclass_name_f cld)) < The (path_length P ctx (cl_fqn fqn))\"\napply(clarsimp)\napply(erule acyclic_clds.cases) apply(clarsimp) apply(rename_tac P)\napply(erule_tac x = ctx in allE)\napply(erule_tac x = fqn in allE)\napply(clarsimp)\napply(rule theI2) apply(simp) apply(simp add: path_length_eq)\napply(erule path_length.cases) apply(simp) apply(clarsimp)\napply(rule theI2) apply(simp) apply(simp add: path_length_eq)\napply(drule_tac path_length_eq, simp)\napply(erule path_length.cases) apply(simp) apply(clarsimp)\napply(drule_tac path_length_eq, simp) apply(simp)\ndone\n\nfunction\nfind_path_rec_f :: \"P \\ ctx \\ cl \\ ctxclds \\ ctxclds_opt\"\nwhere\n\"find_path_rec_f P ctx cl_object path = Some path\" |\n\"find_path_rec_f P ctx (cl_fqn fqn) path =\n (if ~(acyclic_clds P) then None else\n (case find_cld_f P ctx fqn of None \\ None | Some (ctx', cld) \\\n find_path_rec_f P ctx'\n (superclass_name_f cld) (path @ [(ctx',cld)])))\"\nby pat_completeness auto\ntermination\nby (relation \"measure (\\(P, ctx, cl, path). (THE nn. path_length P ctx cl nn))\") auto\n\nlemma [simp]: \"(find_path_rec P ctx cl path path_opt) = (find_path_rec_f P ctx cl path = path_opt)\"\napply(rule)\n apply(erule find_path_rec.induct) apply(simp)+\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp simp add: fpr_objI)\napply(clarsimp) apply(rule)\n apply(simp add: fpr_nullI)\napply(clarsimp split: option.splits)\napply(rule fpr_nullI)\n apply(simp add: fpr_nullI)\napply(rule fpr_fqnI) apply(force)+\ndone\n\ndefinition\nfind_path_f :: \"P \\ ctx \\ cl \\ ctxclds_opt\"\nwhere\n\"find_path_f P ctx cl = find_path_rec_f P ctx cl []\"\nlemma [simp]: \"(find_path P ctx cl path_opt) = (find_path_f P ctx cl = path_opt)\"\napply(rule)\n apply(erule find_path.cases) apply(unfold find_path_f_def) apply(simp)\napply(simp add: fp_defI)\ndone\n\nprimrec\nfind_path_ty_f :: \"P \\ ty \\ ctxclds_opt\"\nwhere\n\"find_path_ty_f P ty_top = Some []\" |\n\"find_path_ty_f P (ty_def ctx dcl) =\n find_path_f P ctx (cl_fqn (fqn_def dcl))\"\nlemma [simp]: \"(find_path_ty P ty ctxclds_opt) = (find_path_ty_f P ty = ctxclds_opt)\"\napply(rule)\n apply(force elim: find_path_ty.cases)\napply(case_tac ty)\n apply(clarsimp simp add: fpty_objI)\napply(clarsimp simp add: fpty_dclI)\ndone\n\nprimrec\nfields_in_path_f :: \"ctxclds \\ fs\"\nwhere\n\"fields_in_path_f [] = []\" |\n\"fields_in_path_f (ctxcld#ctxclds) =\n (map (\\fd. case fd of fd_def cl f \\ f) (class_fields_f (snd ctxcld)))\n @ fields_in_path_f ctxclds\"\nlemma cl_f_list_map: \"map (case_fd (\\cl f. f)) (map (\\(x, y). fd_def x y) cl_f_list) = map (\\(cl_XXX, f_XXX). f_XXX) cl_f_list\"\nby (induct cl_f_list, auto)\n\nlemma fip_ind_to_f: \"\\fs. fields_in_path clds fs \\ fields_in_path_f clds = fs\"\napply(induct clds)\n apply(clarsimp, erule fields_in_path.cases) apply(simp) apply(clarsimp)\napply(clarsimp)\napply(erule fields_in_path.cases) apply(simp) by(clarsimp simp add: cl_f_list_map)\n\nlemma fd_map_split: \"map (case_fd (\\cl f. f)) (map (\\(x, y). fd_def x y) list) = map (\\(cl, f). f) list\"\napply(induct list) apply(simp) apply(clarsimp) done\n\nlemma fd_map_split': \"map (\\(x, y). fd_def x y) (map (case_fd Pair) list) = list\"\napply(induct list) apply(simp split: fd.splits)+ done\n\nlemma fd_map_split'': \"map ((\\(x, y). fd_def x y) \\ case_fd Pair) list = list\"\napply(induct list) apply(simp split: fd.splits)+ done\n\nlemma [simp]: \"\\fs. (fields_in_path ctxclds fs) = (fields_in_path_f ctxclds = fs)\"\napply(induct ctxclds)\n apply(rule) apply(rule)\n apply(force elim: fields_in_path.cases)\n apply(simp add: fip_emptyI)\napply(clarsimp)\napply(rule)\n apply(erule fields_in_path.cases)\n apply(simp)\n apply(simp add: fip_ind_to_f fd_map_split)\napply(clarsimp)\napply(rule_tac cld = b and ctxcld_list = ctxclds\n and cl_f_list = \"map (case_fd (\\cl f. (cl, f))) (class_fields_f b)\" in fip_consI[simplified])\n apply(simp add: fd_map_split'')\n apply(simp add: fd_map_split')\napply(clarsimp split: fd.splits)\ndone\n\ndefinition\nfields_f :: \"P \\ ty \\ fs option\"\nwhere\n\"fields_f P ty =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n Some (fields_in_path_f ctxclds))\"\nlemma [simp]: \"\\fs_opt. (fields P ty fs_opt) = (fields_f P ty = fs_opt)\"\napply(rule) apply(rule)\n apply(case_tac fs_opt)\n apply(clarsimp) apply(erule fields.cases)\n apply(clarsimp) apply(simp add: fields_f_def)\n apply(clarsimp)\n apply(erule fields.cases)\n apply(simp)\n apply(clarsimp) apply(simp add: fields_f_def)\n apply(simp add: fields_f_def) apply(case_tac \"find_path_ty_f P ty\") apply(simp) apply(simp add: fields_noneI[simplified])\napply(clarsimp) apply(case_tac \"find_path_ty_f P ty\") apply(simp) apply(simp) apply(clarsimp)\napply(rule fields_someI) apply(simp) apply(simp)\ndone\n\nprimrec\nmethods_in_path_f :: \"clds \\ meths\"\nwhere\n\"methods_in_path_f [] = []\" |\n\"methods_in_path_f (cld#clds) =\n map (\\md. case md of meth_def_def meth_sig meth_body \\\n case meth_sig of meth_sig_def cl meth vds \\ meth)\n (class_methods_f cld) @ methods_in_path_f clds\"\n\nlemma meth_def_map[THEN mp]:\n \"(\\x \\ set list. (\\(md, cl, m, vds, mb). md = meth_def_def (meth_sig_def cl m vds) mb) x)\n \\ map (case_meth_def (\\ms mb. case ms of meth_sig_def cl m vds \\ m)) (map (\\(md, cl, m, vds, mb). md) list) = map (\\(md, cl, m, vds, mb). m) list\"\nby (induct list, auto)\n\nlemma meth_def_map':\n \"map ((\\(md, cl, m, vds, mb). md) \\ (\\md. case md of meth_def_def (meth_sig_def cl m vds) mb \\ (md, cl, m, vds, mb))) list = list\"\napply(induct list) by (auto split: meth_def.splits meth_sig.splits)\n\nlemma [simp]: \"\\meths. (methods_in_path clds meths) = (methods_in_path_f clds = meths)\"\napply(induct clds)\n apply(clarsimp) apply(rule)\n apply(erule methods_in_path.cases) apply(simp) apply(clarsimp)\n apply(clarsimp) apply(rule mip_emptyI)\napply(clarsimp) apply(rule)\n apply(erule methods_in_path.cases) apply(simp)\n apply(force)\n\napply(rule_tac\n meth_def_cl_meth_vds_meth_body_list =\n \"(case a of cld_def dcl cl fds mds \\\n (map (\\md. (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m vds \\ (md, cl, m, vds, mb)))) mds))\" in\n mip_consI[simplified])\n apply(clarsimp) apply(case_tac a) apply(simp add: class_methods_f_def meth_def_map')\n apply(clarsimp) apply(clarsimp split: meth_def.splits meth_sig.splits)\n apply(simp)\napply(clarsimp) apply(case_tac a) apply(clarsimp simp add: class_methods_f_def split: meth_def.splits meth_sig.splits)\ndone\n\ndefinition\nmethods_f :: \"P \\ ty \\ meths option\"\nwhere\n\"methods_f P ty =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n Some (methods_in_path_f (map (\\(ctx, cld). cld) ctxclds)))\"\nlemma [simp]: \"(methods P ty meths) = (methods_f P ty = Some meths)\"\napply(rule)\n apply(erule methods.cases) apply(clarsimp simp add: methods_f_def)\napply(simp add: methods_f_def) apply(split option.splits) apply(simp)\napply(clarsimp) apply(rule methods_methodsI) apply(simp) apply(clarsimp)\ndone\n\nprimrec\nftype_in_fds_f :: \"P \\ ctx \\ fds \\ f \\ ty_opt_bot\"\nwhere\n\"ftype_in_fds_f P ctx [] f = ty_opt_bot_opt None\" |\n\"ftype_in_fds_f P ctx (fd#fds) f =\n (case fd of fd_def cl f' \\ (if f = f' then\n (case find_type_f P ctx cl of None \\ ty_opt_bot_bot | Some ty \\\n ty_opt_bot_opt (Some ty)) else ftype_in_fds_f P ctx fds f))\"\nlemma [simp]: \"(ftype_in_fds P ctx fds f ty_opt) = (ftype_in_fds_f P ctx fds f = ty_opt)\"\napply(rule)\n apply(induct fds) apply(erule ftype_in_fds.cases) apply(simp) apply(simp) apply(simp) apply(simp)\n apply(erule ftype_in_fds.cases) apply(simp) apply(simp) apply(simp) apply(clarsimp)\napply(induct fds)\n apply(clarsimp) apply(rule ftif_emptyI)\napply(rename_tac fd fds) apply(case_tac fd, rename_tac cl f', clarsimp) apply(rule)\n apply(clarsimp) apply(case_tac \"find_type_f P ctx cl\")\n apply(simp add: ftif_cons_botI[simplified])\n apply(simp add: ftif_cons_trueI[simplified])\napply(force intro: ftif_cons_falseI[simplified])\ndone\n\nprimrec\nftype_in_path_f :: \"P \\ ctxclds \\ f \\ ty_opt\"\nwhere\n\"ftype_in_path_f P [] f = None\" |\n\"ftype_in_path_f P (ctxcld#ctxclds) f =\n (case ctxcld of (ctx, cld) \\\n (case ftype_in_fds_f P ctx (class_fields_f cld) f of\n ty_opt_bot_bot \\ None | ty_opt_bot_opt ty_opt \\\n (case ty_opt of Some ty \\ Some ty | None \\\n ftype_in_path_f P ctxclds f)))\"\nlemma [simp]: \"(ftype_in_path P ctxclds f ty_opt) = (ftype_in_path_f P ctxclds f = ty_opt)\"\napply(rule)\n apply(induct rule: ftype_in_path.induct) apply(simp+)\napply(induct ctxclds) apply(simp) apply(rule ftip_emptyI)\napply(hypsubst_thin)\napply(clarsimp) apply(case_tac \"ftype_in_fds_f P a (class_fields_f b) f\")\n apply(rename_tac ty_opt) apply(case_tac ty_opt)\n apply(simp add: ftip_cons_falseI[simplified])\n apply(simp add: ftip_cons_trueI[simplified])\napply(simp add: ftip_cons_botI[simplified])\ndone\n\ndefinition\nftype_f :: \"P \\ ty \\ f \\ ty_opt\"\nwhere\n\"ftype_f P ty f =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n ftype_in_path_f P ctxclds f)\"\nlemma [simp]: \"(ftype P ty f ty') = (ftype_f P ty f = Some ty')\"\napply(rule)\n apply(induct rule: ftype.induct) apply(clarsimp simp add: ftype_f_def)\napply(clarsimp simp add: ftype_f_def split: option.splits) apply(rule ftypeI) apply(simp+)\ndone\n\nprimrec\nfind_meth_def_in_list_f :: \"meth_defs \\ meth \\ meth_def_opt\"\nwhere\n\"find_meth_def_in_list_f [] m = None\" |\n\"find_meth_def_in_list_f (md#mds) m =\n (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m' vds \\\n (if m = m' then Some md else find_meth_def_in_list_f mds m)))\"\nlemma [simp]: \"(find_meth_def_in_list mds m md_opt) = (find_meth_def_in_list_f mds m = md_opt)\"\napply(rule)\n apply(induct rule: find_meth_def_in_list.induct) apply(simp+)\napply(induct mds) apply(simp) apply(rule fmdil_emptyI)\napply(clarsimp) apply(clarsimp split: meth_def.split meth_sig.split) apply(rule)\n apply(clarsimp) apply(rule fmdil_cons_trueI[simplified]) apply(force)\napply(clarsimp) apply(rule fmdil_cons_falseI[simplified]) apply(force+)\ndone\n\nprimrec\nfind_meth_def_in_path_f :: \"ctxclds \\ meth \\ ctxmeth_def_opt\"\nwhere\nfmdip_empty: \"find_meth_def_in_path_f [] m = None\" |\nfmdip_cons: \"find_meth_def_in_path_f (ctxcld#ctxclds) m =\n (case ctxcld of (ctx, cld) \\\n (case find_meth_def_in_list_f (class_methods_f cld) m of\n Some md \\ Some (ctx, md) |\n None \\ find_meth_def_in_path_f ctxclds m))\"\nlemma [simp]: \"(find_meth_def_in_path ctxclds m ctxmeth_def_opt) = (find_meth_def_in_path_f ctxclds m = ctxmeth_def_opt)\"\napply(rule)\n apply(induct rule: find_meth_def_in_path.induct) apply(simp+)\napply(induct ctxclds) apply(simp) apply(rule fmdip_emptyI)\napply(clarsimp) apply(case_tac \"find_meth_def_in_list_f (class_methods_f b) m\") apply(clarsimp)\napply(simp add: fmdip_cons_falseI[simplified])\napply(simp add: fmdip_cons_trueI[simplified])\ndone\n\ndefinition\nfind_meth_def_f :: \"P \\ ty \\ meth \\ ctxmeth_def_opt\"\nwhere\n\"find_meth_def_f P ty m =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n find_meth_def_in_path_f ctxclds m)\"\nlemma [simp]: \"(find_meth_def P ty m ctxmd_opt) = (find_meth_def_f P ty m = ctxmd_opt)\"\napply(rule)\n apply(induct rule: find_meth_def.induct) apply(simp add: find_meth_def_f_def)+\napply(clarsimp simp add: find_meth_def_f_def split: option.splits)\napply(simp add: fmd_nullI)\napply(simp add: fmd_optI)\ndone\n\nprimrec\nlift_opts :: \"'a option list \\ 'a list option\"\nwhere\n\"lift_opts [] = Some []\" |\n\"lift_opts (opt#opts) =\n (case opt of None \\ None | Some v \\\n (case lift_opts opts of None \\ None | Some vs \\ Some (v#vs)))\"\n\ndefinition\nmtype_f :: \"P \\ ty \\ meth \\ mty option\"\nwhere\n\"mtype_f P ty m =\n (case find_meth_def_f P ty m of None \\ None | Some (ctx, md) \\\n (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m' vds \\\n (case find_type_f P ctx cl of None \\ None | Some ty' \\\n (case lift_opts (map (\\vd. case vd of vd_def clk vark \\\n find_type_f P ctx clk) vds) of None \\ None | Some tys \\\n Some (mty_def tys ty'))))))\"\n\nlemma lift_opts_ind[rule_format]:\n \"(\\x\\set list. (\\(cl, var, ty). find_type_f P ctx cl = Some ty) x)\n \\ lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk) \\ (\\(cl, var, ty). vd_def cl var)) list) = Some (map (\\(cl, var, ty). ty) list)\"\nby (induct list, auto)\n\nlemma find_md_m_match'[rule_format]:\n \"find_meth_def_in_list_f mds m = Some (meth_def_def (meth_sig_def cl m' vds) mb) \\ m' = m\"\napply(induct mds) apply(simp) apply(clarsimp split: meth_def.splits meth_sig.splits) done\n\nlemma find_md_m_match:\n \"find_meth_def_in_path_f path m = Some (ctx, meth_def_def (meth_sig_def cl m' vds) mb) \\ m' = m\"\napply(induct path) apply(simp) apply(clarsimp split: option.splits) by(rule find_md_m_match')\n\nlemma vds_map_length:\n \"length (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = length vds\"\nby (induct vds, auto)\n\nlemma lift_opts_length[rule_format]:\n \"\\tys. lift_opts ty_opts = Some tys \\ length ty_opts = length tys\"\napply(induct ty_opts) apply(simp) by(clarsimp split: option.splits)\n\nlemma vds_tys_length_eq[rule_format]:\n \"lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = Some tys \\ length vds = length tys\"\napply(rule) apply(drule lift_opts_length) apply(simp add: vds_map_length) done\n\nlemma vds_tys_length_eq'[rule_format]:\n \"\\tys. length vds = length tys \\ vds = map (\\(cl, var, ty). vd_def cl var) (map (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty)) (zip vds tys))\"\napply(induct vds) apply(simp) apply(clarsimp) apply(case_tac a) apply(clarsimp)\napply(case_tac tys) apply(simp) apply(clarsimp) done\n\nlemma vds_tys_length_eq''[rule_format]:\n \"\\vds. length vds = length tys \\ tys = map ((\\(cl, var, ty). ty) \\ (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty))) (zip vds tys)\"\napply(induct tys) apply(simp) apply(clarsimp) apply(case_tac vds) apply(clarsimp) apply(clarsimp)\napply(split vd.splits) apply(simp) done\n\nlemma lift_opts_find_type[rule_format]:\n \"\\tys. lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = Some tys\n \\ (\\(vd, ty) \\ set (zip vds tys). case vd of vd_def cl var \\ find_type_f P ctx cl = Some ty)\"\napply(induct vds) apply(simp) apply(clarsimp split: vd.splits option.splits) apply(rename_tac cl' var)\napply(drule_tac x = \"(vd_def cl' var, b)\" in bspec, simp) apply(force) done\n\nlemma [simp]: \"(mtype P ty m mty) = (mtype_f P ty m = Some mty)\"\napply(rule)\n apply(induct rule: mtype.induct) apply(clarsimp simp add: mtype_f_def)\n apply(split option.splits) apply(rule) apply(clarsimp)\n apply(rule_tac x = \"map (\\(cl, var, ty). ty) cl_var_ty_list\" in exI)\n apply(simp add: lift_opts_ind) apply(clarsimp) apply(simp add: lift_opts_ind)\napply(clarsimp simp add: mtype_f_def split: option.splits meth_def.splits meth_sig.splits)\napply(rename_tac ctx mb cl m' vds ty' tys)\napply(rule_tac ctx = ctx and cl = cl and meth_body = mb and ty' = ty'\n and cl_var_ty_list = \"map (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty)) (zip vds tys)\"\n and meth_def = \"meth_def_def (meth_sig_def cl m' vds) mb\" in mtypeI[simplified])\n apply(simp) apply(clarsimp) apply(rule) apply(clarsimp simp add: find_meth_def_f_def split: option.splits)\n apply(simp add: find_md_m_match) apply(drule vds_tys_length_eq) apply(frule vds_tys_length_eq') apply(clarsimp)\n apply(simp) apply(clarsimp) apply(split vd.splits) apply(clarsimp) apply(drule lift_opts_find_type) apply(simp)\n apply(clarsimp)\napply(clarsimp) apply(drule vds_tys_length_eq) apply(simp add: vds_tys_length_eq'')\ndone\n\ndefinition\nis_sty_one :: \"P \\ ty \\ ty \\ bool option\"\nwhere\n\"is_sty_one P ty ty' =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n (case ty' of ty_top \\ Some True | ty_def ctx' dcl' \\\n Some ((ctx', dcl') : set (map (\\(ctx, cld). (ctx, class_name_f cld)) ctxclds)) ))\"\n\nlemma class_name_mem_map[rule_format]:\n\"(ctx, cld, class_name_f cld) \\ set ctx_cld_dcl_list\n \\ (ctx, class_name_f cld)\n \\ ((\\(ctx, cld). (ctx, class_name_f cld)) \\ (\\(ctx, cld, dcl). (ctx, cld))) `\n set ctx_cld_dcl_list\"\nby (induct ctx_cld_dcl_list, auto)\n\nlemma map_map_three:\n \" ctxclds = map ((\\(ctx, cld, dcl). (ctx, cld)) \\ (\\(ctx, cld). (ctx, cld, class_name_f cld))) ctxclds\"\nby (induct ctxclds, auto)\n\nlemma mem_el_map[rule_format]:\n \"(ctx, dcl) \\ set ctxclds\n \\ (ctx, class_name_f dcl)\n \\ (\\(ctx_XXX, cld_XXX, y). (ctx_XXX, y)) `\n set (map (\\(ctx, cld). (ctx, cld, class_name_f cld)) ctxclds)\"\nby (induct ctxclds, auto)\n\nlemma [simp]: \"(sty_one P ty ty') = (is_sty_one P ty ty' = Some True)\"\napply(rule)\n apply(induct rule: sty_one.induct)\n apply(simp add: is_sty_one_def)\n apply(clarsimp simp add: is_sty_one_def) apply(rename_tac ctx cld dcl)\n apply(drule_tac x = \"(ctx, cld, dcl)\" in bspec, simp) apply(clarsimp)\n using case_prod_conv image_iff apply fastforce\napply(clarsimp simp add: is_sty_one_def split: option.splits ty.splits)\n apply(simp add: sty_objI)\napply(rename_tac ctxclds ctx dcl)\napply(rule_tac ctx_cld_dcl_list = \"map (\\(ctx, cld). (ctx, cld, class_name_f cld)) ctxclds\" in sty_dclI[simplified])\n apply(clarsimp) apply(rule map_map_three)\n apply(force)\napply(rule mem_el_map, assumption)\ndone\n\nlemma path_append[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\ \\path''. path = path' @ path''\"\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(force split: if_split_asm option.splits)\ndone\n\nlemma all_in_path_found'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\ctxcld \\ set path. ctxcld \\ set path' \\ (\\ctx' fqn'. find_cld_f P ctx' fqn' = Some ctxcld))\"\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(rule)\napply(force split: if_split_asm option.splits)\ndone\n\nlemma all_in_path_found:\n \"\\find_path_f P ctx cl = Some path; ctxcld \\ set path\\ \\ \\ctx' fqn'. find_cld_f P ctx' fqn' = Some ctxcld\"\nby (unfold find_path_f_def, simp only: all_in_path_found'[of _ _ _ \"[]\", simplified])\n\nlemma fpr_target_is_head':\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld. cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\\n (\\path''. path = path' @ ctxcld # path''))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: if_split_asm option.splits)\napply(case_tac \"superclass_name_f b\") apply(clarsimp)\napply(clarsimp split: if_split_asm option.splits)\napply(force)\ndone\n\nlemma fpr_target_is_head:\n \"find_path_f P ctx (cl_fqn fqn) = Some path \\ \\ctxcld. find_cld_f P ctx fqn = Some ctxcld \\ (\\path''. path = ctxcld # path'')\"\napply(unfold find_path_f_def) apply(frule fpr_target_is_head'[of _ _ _ \"[]\", THEN mp]) apply(clarsimp split: option.splits) done\n\nlemma fpr_sub_path':\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld path'' path_fqn.\n cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\\n find_path_rec_f P (fst ctxcld) (superclass_name_f (snd ctxcld)) path'' = Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ path = path' @ ctxcld # path'''))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: if_split_asm option.splits)\napply(case_tac \"superclass_name_f b\") apply(simp add: find_path_f_def)\napply(clarsimp split: if_split_asm option.splits)\napply(frule_tac path = path in path_append) apply(clarsimp) apply(force)\ndone\n\nlemma fpr_sub_path:\n \"\\find_path_f P ctx (cl_fqn fqn) = Some path; find_cld_f P ctx fqn = Some ctxcld;\n find_path_f P (fst ctxcld) (superclass_name_f (snd ctxcld)) = Some path'\\\n \\ path = ctxcld # path'\"\nby (unfold find_path_f_def, force intro: fpr_sub_path'[rule_format, of _ _ _ \"[]\" _ _ _ \"[]\", simplified])\n\nlemma fpr_sub_path_simp:\n \"\\find_path_rec_f P ctx (superclass_name_f cld) path'' = Some path_fqn; find_cld_f P ctx fqn = Some (ctx, cld); acyclic_clds P;\n find_path_rec_f P ctx (superclass_name_f cld) (path' @ [(ctx, cld)]) = Some path\\\n \\ \\path'''. path_fqn = path'' @ path''' \\ path = path' @ (ctx, cld) # path'''\"\napply(cut_tac P = P and ctx = ctx and cl = \"cl_fqn fqn\" and path' = path' and path = path in fpr_sub_path')\napply(clarsimp split: option.splits if_split_asm)\ndone\n\nlemma fpr_same_suffix'[rule_format]:\n \"find_path_rec_f P ctx cl prefix = Some path \\\n (\\suffix prefix'. path = prefix @ suffix \\\n find_path_rec_f P ctx cl prefix' = Some (prefix' @ suffix))\"\napply(induct_tac P ctx cl prefix rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(clarsimp split: option.splits)\napply(frule path_append) apply(force)\ndone\n\nlemma fpr_same_suffix:\n \"find_path_rec_f P ctx cl prefix = Some path \\\n (\\suffix prefix' suffix'. path = prefix @ suffix \\\n find_path_rec_f P ctx cl prefix' = Some (prefix' @ suffix')\n \\ suffix = suffix')\"\napply(induct_tac P ctx cl prefix rule: find_path_rec_f.induct)\n apply(clarsimp)\nby (metis fpr_same_suffix' option.inject same_append_eq)\n\nlemma fpr_mid_path'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\ctxcld \\ set path.\n ctxcld \\ set path' \\\n (\\path_fqn. find_path_rec_f P (fst ctxcld) (cl_fqn (fqn_def (class_name_f (snd ctxcld)))) path'' = Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ (\\path_rest. path = path_rest @ path'''))))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: option.splits)\napply(frule find_cld_name_eq) apply(clarsimp)\napply(rename_tac path' ctx' cld' cld'' ctx'' path''' cl fds mds)\napply(subgoal_tac \"find_path_rec_f P ctx' (superclass_name_f cld') (path' @ [(ctx', cld')]) = Some path \\\n (\\ctxcld\\set path.\n ctxcld = (ctx', cld') \\\n ctxcld \\ set path' \\\n (\\path_fqn. case_option None (case_prod (\\ctx' cld. find_path_rec_f P ctx' (superclass_name_f cld) (path'' @ [(ctx', cld)])))\n (find_cld_f P (fst ctxcld) (fqn_def (class_name_f (snd ctxcld)))) =\n Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ (\\path_rest. path = path_rest @ path'''))))\")\n apply(erule impE) apply simp\n apply(drule_tac x = \"(ctx'', cld'')\" in bspec, simp) apply(clarsimp)\n apply(simp add: superclass_name_f_def)\n apply(case_tac cld') apply(rename_tac dcl' cl' fds' mds') apply(clarsimp simp add: class_name_f_def)\n apply(case_tac fqn) apply(rename_tac dcl'') apply(clarsimp)\n apply(frule find_cld_name_eq) apply(clarsimp)\n apply(frule path_append) apply(frule_tac path = \"path'' @ path'''\" in path_append) apply(clarsimp)\n apply(rule_tac x = path' in exI) apply(clarsimp)\n apply(frule_tac suffix = path''a and prefix' = \"path'' @ [(ctx', cld_def dcl' cl' fds' mds')]\" and\n suffix' = path''aa in fpr_same_suffix[rule_format]) apply(simp)\n apply(force)\napply(simp)\ndone\n\nlemma fpr_mid_path:\n \"\\find_path_f P ctx cl = Some path; (ctx', cld') \\ set path;\n find_path_f P ctx' (cl_fqn (fqn_def (class_name_f cld'))) = Some path'\\\n \\ \\path''. path = path'' @ path'\"\napply(cut_tac P = P and ctx = ctx and cl = cl and path' = \"[]\" and path = path and ctxcld = \"(ctx', cld')\" and path'' = \"[]\" in fpr_mid_path')\napply(unfold find_path_f_def, assumption) apply(assumption) apply(simp)\ndone\n\nlemma fpr_first_in_path'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld. cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\ ctxcld \\ set path)\"\napply(case_tac cl)\n apply(simp)\napply(clarsimp) apply(drule path_append) apply(force)\ndone\n\nlemma fpr_first_in_path:\n \"\\find_path_f P ctx (cl_fqn fqn) = Some path; find_cld_f P ctx fqn = Some ctxcld\\ \\ ctxcld \\ set path\"\nby (unfold find_path_f_def, force intro: fpr_first_in_path'[of _ _ _ \"[]\", simplified])\n\nlemma cld_for_path:\n \"find_path_f P ctx (cl_fqn fqn) = Some path \\ \\ctxcld. find_cld_f P ctx fqn = Some ctxcld\"\napply(unfold find_path_f_def) apply(clarsimp split: if_split_asm option.splits) done\n\nlemma ctx_cld_ctx_dcl[rule_format]:\n \"(ctx, cld_def dcl cl fds mds) \\ set path \\ (ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path\"\nby (induct path, auto simp add: class_name_f_def)\n\nlemma ctx_dcl_ctx_cld[rule_format]:\n \"(ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path \\ (\\cl fds mds. (ctx, cld_def dcl cl fds mds) \\ set path)\"\napply(induct path) apply(simp)\napply(auto) apply(case_tac b) apply(force simp add: class_name_f_def)\ndone\n\nlemma ctx_dcl_mem_path:\n \"find_path_f P ctx (cl_fqn (fqn_def dcl)) = Some path \\ (ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path\"\napply(frule cld_for_path) apply(erule exE)\napply(frule fpr_first_in_path) apply(assumption)\napply(frule find_cld_name_eq) apply(elim exE)\napply(clarsimp simp add: ctx_cld_ctx_dcl)\ndone\n\nlemma sty_reflexiveI:\n \"is_sty_one P ty ty' = Some True \\ is_sty_one P ty ty = Some True\"\napply(simp add: is_sty_one_def split: option.splits) apply(case_tac ty) apply(simp) apply(clarsimp)\napply(drule ctx_dcl_mem_path) apply(force)\ndone\n\nlemma sty_transitiveI:\n \"\\is_sty_one P ty ty' = Some True; is_sty_one P ty' ty'' = Some True\\\n \\ is_sty_one P ty ty'' = Some True\"\napply(clarsimp simp add: is_sty_one_def split: ty.splits option.splits)\napply(rename_tac path ctx dcl path' ctx' dcl')\napply(case_tac ty) apply(simp) apply(clarsimp) apply(rename_tac ctx dcl ctx' cld' ctx'' cld'')\napply(frule fpr_mid_path) apply(simp) apply(simp) apply(force)\ndone\n\ndefinition\nis_sty_many :: \"P \\ tys \\ tys \\ bool option\"\nwhere\n\"is_sty_many P tys tys' =\n (if length tys \\ length tys' then None else\n (case lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') (zip tys tys'))\n of None \\ None | Some bools \\ Some (list_all id bools)))\"\n\nlemma lift_opts_exists:\n \"\\x\\set ty_ty'_list. (\\(ty, ty'). is_sty_one P ty ty' = Some True) x \\ \\bools. lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') ty_ty'_list) = Some bools\"\nby (induct ty_ty'_list, auto)\n\nlemma lift_opts_all_true[rule_format]:\n \"\\bools. (\\x\\set ty_ty'_list. (\\(ty, ty'). is_sty_one P ty ty' = Some True) x) \\\n lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') ty_ty'_list) = Some bools\n \\ list_all id bools\"\nby (induct ty_ty'_list, auto split: option.splits)\n\nlemma tys_tys'_list: \"\\bools ty ty'. \\lift_opts (map (\\(x, y). is_sty_one P x y) tys_tys'_list) = Some bools; length tys = length tys'; list_all id bools; (ty, ty') \\ set tys_tys'_list\\ \\ is_sty_one P ty ty' = Some True\"\napply(induct tys_tys'_list)\n apply(simp)\napply(clarsimp split: option.splits)\nby force\n\nlemma [simp]: \"(sty_many P tys tys') = (is_sty_many P tys tys' = Some True)\"\napply(rule)\n apply(erule sty_many.cases) apply(clarsimp simp add: is_sty_many_def split: option.splits) apply(rule)\n apply(simp add: lift_opts_exists)\n apply(force intro: lift_opts_all_true)\napply(clarsimp simp add: is_sty_many_def split: option.splits if_split_asm)\napply(rule_tac ty_ty'_list = \"zip tys tys'\" in sty_manyI)\n apply(simp add: map_fst_zip[THEN sym])\n apply(simp add: map_snd_zip[THEN sym])\napply(clarsimp)\napply(simp add: tys_tys'_list)\ndone\n\n(* TODO: here will go all the other definitions for functions equivalent to\n relations concerning well-formedness *)\n\ndefinition\ntr_x :: \"T \\ x \\ x\"\nwhere\n\"tr_x T x = (case T x of None \\ x | Some x' \\ x')\"\n\ndefinition\ntr_var :: \"T \\ var \\ var\"\nwhere\n\"tr_var T var = (case tr_x T (x_var var) of x_this \\ var | x_var var' \\ var')\"\n\nprimrec\ntr_s_f :: \"T \\ s \\ s\" and\ntr_ss_f :: \"T \\ s list \\ s list\"\nwhere\n\"tr_s_f T (s_block ss) = s_block (tr_ss_f T ss)\" |\n\"tr_s_f T (s_ass var x) = s_ass (tr_var T var) (tr_x T x)\" |\n\"tr_s_f T (s_read var x f) = s_read (tr_var T var) (tr_x T x) f\" |\n\"tr_s_f T (s_write x f y) = s_write (tr_x T x) f (tr_x T y)\" |\n\"tr_s_f T (s_if x y s1 s2) = s_if (tr_x T x) (tr_x T y) (tr_s_f T s1) (tr_s_f T s2)\" |\n\"tr_s_f T (s_call var x m ys) = s_call (tr_var T var) (tr_x T x) m (map (tr_x T) ys)\" |\n\"tr_s_f T (s_new var ctx cl) = s_new (tr_var T var) ctx cl\" |\n\n\"tr_ss_f T [] = []\" |\n\"tr_ss_f T (s#ss) = tr_s_f T s # tr_ss_f T ss\"\n\nlemma [simp]: \"(\\x\\set s_s'_list. case x of (s_XXX, s_') \\ tr_s T s_XXX s_' \\ tr_s_f T s_XXX = s_') \\\n tr_ss_f T (map fst s_s'_list) = map snd s_s'_list\"\nby (induct s_s'_list, auto)\n\nlemma [simp]: \"(\\x\\set y_y'_list. case_prod (\\y_XXX. (=) (case T y_XXX of None \\ y_XXX | Some x' \\ x')) x) \\ map (tr_x T) (map fst y_y'_list) = map snd y_y'_list\"\napply(induct y_y'_list) apply(simp) apply(clarsimp) apply(simp only: tr_x_def) done\n\nlemma set_zip_tr[simp]: \"(s, s') \\ set (zip ss (tr_ss_f T ss)) \\ s' = tr_s_f T s\" by (induct ss, auto)\n\n\n\nlemma tr_ss_map:\n \"tr_ss_f T (map fst s_s'_list) = map snd s_s'_list \\ (\\x\\set s_s'_list. case_prod (tr_s T) x) \\\n (a, b) \\ set s_s'_list \\ tr_s T a (tr_s_f T a)\"\napply(induct s_s'_list) by auto\n\nlemma tr_f_to_rel: \"\\s'. tr_s_f T s = s' \\ tr_s T s s'\"\napply(induct s rule: tr_s_f.induct)\napply(simp)\napply(clarsimp) apply(rule tr_s_var_assignI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp add: tr_x_def)\napply(clarsimp) apply(rule tr_s_field_readI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp add: tr_x_def)\napply(clarsimp) apply(rule tr_s_field_writeI)\napply(simp add: tr_x_def) apply(simp add: tr_x_def)\napply(clarsimp simp only: tr_s_f.simps) apply(rule tr_s_ifI)\napply(simp only: tr_x_def) apply(simp only: tr_x_def) apply(simp) apply(simp)\napply(clarsimp) apply(rule tr_s_newI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(clarsimp)\napply(rename_tac var x m ys)\napply(cut_tac T = T and var = var and var' = \"tr_var T var\" and x = x and\n x' = \"tr_x T x\" and y_y'_list = \"zip ys (map (tr_x T) ys)\" and\n meth = m in tr_s_mcallI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp only: tr_x_def) apply(clarsimp simp add: set_zip tr_x_def) apply(simp)\napply(simp)\napply(cut_tac T = T and s_s'_list = \"[]\" in tr_s_blockI[simplified])\n apply(simp)\napply(clarsimp)\napply(clarsimp) apply(rename_tac s ss)\napply(cut_tac T = T and s_s'_list = \"zip (s # ss) (tr_s_f T s # tr_ss_f T ss)\" in tr_s_blockI[simplified])\n apply(clarsimp) apply(rename_tac x x')\n apply(frule set_zip_tr[THEN mp]) apply(clarsimp)\n apply(erule in_set_zipE)\n apply(erule_tac ?a1.0=\"T\" and ?a2.0=\"s_block ss\" and ?a3.0=\"s_block (tr_ss_f T ss)\" in tr_s.cases)\n apply(clarsimp)\n apply(rule tr_ss_map[THEN mp], force)\n apply(clarsimp)+\ndone\n\nlemma tr_rel_f_eq: \"((tr_s T s s') = (tr_s_f T s = s'))\"\napply(rule)\n apply(erule tr_s.induct)\n apply(force simp add: tr_x_def tr_var_def split: option.splits)+\napply(cut_tac T = T and s = s in tr_f_to_rel) apply(simp)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LightweightJava/Lightweight_Java_Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.45713671682749474, "lm_q1q2_score": 0.28454901502425395}} {"text": "section {*I\\_kparser\\_HF*}\ntheory\n I_kparser_HF\n\nimports\n I_kparser_base\n\nbegin\n\nrecord ('stack, 'event) parserHF_conf =\n parserHF_conf_fixed :: \"'event list\"\n parserHF_conf_history :: \"'event list\"\n parserHF_conf_stack :: \"'stack list\"\n\ndefinition parserHF_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf set\"\n where\n \"parserHF_configurations G \\\n {\\parserHF_conf_fixed = f,\n parserHF_conf_history=h,\n parserHF_conf_stack = l\\\n | f h l.\n set l \\ parser_nonterms G\n \\ set f \\ parser_events G\n \\ set h \\ parser_events G\n \\ parser_bottom G \\ set h\n \\ suffix h (butlast_if_match f (parser_bottom G))\n \\ (parser_bottom G \\ set f\n \\ (\\w. f = w @ [parser_bottom G]\n \\ parser_bottom G \\ set w))}\"\n\ndefinition parserHF_configurations_ALT :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf set\"\n where\n \"parserHF_configurations_ALT G \\\n {\\parserHF_conf_fixed = f,\n parserHF_conf_history=h,\n parserHF_conf_stack = l\\\n | f h l.\n set l \\ parser_nonterms G\n \\ set h \\ parser_events G - {parser_bottom G}\n \\ suffix h (butlast_if_match f (parser_bottom G))\n \\ f \\ parser_fixed_schedulers G}\"\n\nlemma parserHF_configurations_ALT_vs_parserHF_configurations: \"\n valid_parser G\n \\ parserHF_configurations_ALT G = parserHF_configurations G\"\n apply(simp add: parserHF_configurations_ALT_def parserHF_configurations_def)\n apply(rule antisym)\n prefer 2\n apply(clarsimp)\n apply(rename_tac f h l)(*strict*)\n apply(case_tac \"parser_bottom G \\ set f\")\n apply(rename_tac f h l)(*strict*)\n apply(simp add: parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac h l w)(*strict*)\n apply(rule conjI)\n apply(rename_tac h l w)(*strict*)\n apply(force)\n apply(rename_tac h l w)(*strict*)\n apply(simp add: parser_fixed_schedulers_def prefix_closure_def)\n apply(rule_tac x=\"w @ [parser_bottom G]\" in exI)\n apply(rule conjI)\n apply(rename_tac h l w)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(rename_tac h l w)(*strict*)\n apply(simp add: parser_schedulers_def)\n apply(rename_tac f h l)(*strict*)\n apply(rule conjI)\n apply(rename_tac f h l)(*strict*)\n apply(force)\n apply(rename_tac f h l)(*strict*)\n apply(simp add: parser_fixed_schedulers_def)\n apply(simp add: prefix_closure_def parser_schedulers_def)\n apply(rule_tac\n x=\"f@ [parser_bottom G]\"\n in exI)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac f h l)(*strict*)\n apply(simp add: parser_fixed_schedulers_def)\n apply(simp add: prefix_closure_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac f h l va)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac f h l va c)(*strict*)\n apply(rule conjI)\n apply(rename_tac f h l va c)(*strict*)\n apply(simp add: valid_parser_def)\n apply(clarsimp)\n apply(rename_tac f h l va c x)(*strict*)\n apply(subgoal_tac \"x\\ set(va @ [parser_bottom G])\")\n apply(rename_tac f h l va c x)(*strict*)\n prefer 2\n apply(rule_tac\n A=\"set f\"\n in set_mp)\n apply(rename_tac f h l va c x)(*strict*)\n apply(rule_tac\n t=\"va @ [parser_bottom G]\"\n and s=\"f @ c\"\n in ssubst)\n apply(rename_tac f h l va c x)(*strict*)\n apply(force)\n apply(rename_tac f h l va c x)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac f h l va c x)(*strict*)\n apply(force)\n apply(rename_tac f h l va c x)(*strict*)\n apply(force)\n apply(rename_tac f h l va c)(*strict*)\n apply(rule conjI)\n apply(rename_tac f h l va c)(*strict*)\n apply(force)\n apply(rename_tac f h l va c)(*strict*)\n apply(rule conjI)\n apply(rename_tac f h l va c)(*strict*)\n apply(force)\n apply(rename_tac f h l va c)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n xs=\"c\"\n in rev_cases)\n apply(rename_tac f h l va c)(*strict*)\n apply(clarsimp)\n apply(rename_tac f h l va c ys y)(*strict*)\n apply(clarsimp)\n done\n\ndefinition parserHF_step_relation :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation G c1 p c2 \\\n p \\ parser_rules G \\ ((\\x. parserHF_conf_stack c1=x@(rule_lpop p) \\ parserHF_conf_stack c2=x@(rule_lpush p)) \\ (parserHF_conf_history c2=parserHF_conf_history c1@(drop (length(parserHF_conf_fixed c1)) (butlast_if_match (rule_rpop p) (parser_bottom G))) \\ parserHF_conf_fixed c2 = (rule_rpush p) @ (drop (length (rule_rpop p)) (parserHF_conf_fixed c1)) \\ (prefix (rule_rpop p) (parserHF_conf_fixed c1) \\ prefix (parserHF_conf_fixed c1) (rule_rpop p))))\"\n\ndefinition parserHF_step_relation_ALT :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT G c1 e c2 \\\n e \\ parser_rules G\n \\ (\\x. parserHF_conf_stack c1 = x @ rule_lpop e\n \\ parserHF_conf_stack c2 = x @ rule_lpush e)\n \\ parserHF_conf_history c2\n = parserHF_conf_history c1\n @ drop\n (length(parserHF_conf_fixed c1))\n (butlast_if_match (rule_rpop e) (parser_bottom G))\n \\ parserHF_conf_fixed c2\n = rule_rpush e\n @ drop\n (length (rule_rpop e))\n (parserHF_conf_fixed c1)\n \\ (prefix (rule_rpop e) (parserHF_conf_fixed c1)\n \\ prefix (parserHF_conf_fixed c1) (rule_rpop e))\"\n\nlemma parserHF_step_relation_ALT_vs_parserHF_step_relation: \"\n parserHF_step_relation_ALT M c1 p c2 = parserHF_step_relation M c1 p c2\"\n apply(simp add: parserHF_step_relation_ALT_def parserHF_step_relation_def)\n done\n\n(*1a 1b 1c not fixed before AND not fixed afterwards*)\ndefinition parserHF_step_relation_ALT2_1a :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_1a G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1, parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2 @ v3, rule_lpush = s2 @ [q2], rule_rpush = v3\\\n \\ c2 = \\parserHF_conf_fixed = v3, parserHF_conf_history = h @ v2 @ v3, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\ndefinition parserHF_step_relation_ALT2_1b :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_1b G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1 @ v2, parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2 @ v3, rule_lpush = s2 @ [q2], rule_rpush = v2 @ v3\\\n \\ c2 = \\parserHF_conf_fixed = v2 @ v3, parserHF_conf_history = h @ v3, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\ndefinition parserHF_step_relation_ALT2_1c :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_1c G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1 @ v2 @ v3, parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2, rule_lpush = s2 @ [q2], rule_rpush = v2\\\n \\ c2 = \\parserHF_conf_fixed = v2 @ v3, parserHF_conf_history = h, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\n(*2a 2b not fixed before but fixed afterwards*)\ndefinition parserHF_step_relation_ALT2_2a :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_2a G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1, parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2 @ v3 @ [parser_bottom G], rule_lpush = s2 @ [q2], rule_rpush = v3 @ [parser_bottom G]\\\n \\ c2 = \\parserHF_conf_fixed = v3 @ [parser_bottom G], parserHF_conf_history = h @ v2 @ v3, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\ndefinition parserHF_step_relation_ALT2_2b :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_2b G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1 @ v2, parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2 @ v3 @ [parser_bottom G], rule_lpush = s2 @ [q2], rule_rpush = v2 @ v3 @ [parser_bottom G]\\\n \\ c2 = \\parserHF_conf_fixed = v2 @ v3 @ [parser_bottom G], parserHF_conf_history = h @ v3, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\n(*3a 3b fixed before*)\ndefinition parserHF_step_relation_ALT2_3a :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_3a G c1 e c2 \\\n (\\v1 v2 v3 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1 @ v2 @ v3 @ [parser_bottom G], parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2, rule_lpush = s2 @ [q2], rule_rpush = v2\\\n \\ c2 = \\parserHF_conf_fixed = v2 @ v3 @ [parser_bottom G], parserHF_conf_history = h, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2 @ v3))\"\n\ndefinition parserHF_step_relation_ALT2_3b :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2_3b G c1 e c2 \\\n (\\v1 v2 h s s1 q1 s2 q2.\n c1 = \\parserHF_conf_fixed = v1 @ v2 @ [parser_bottom G], parserHF_conf_history = h, parserHF_conf_stack = s @ s1 @ [q1]\\\n \\ e = \\rule_lpop = s1 @ [q1], rule_rpop = v1 @ v2 @ [parser_bottom G], rule_lpush = s2 @ [q2], rule_rpush = v2 @ [parser_bottom G]\\\n \\ c2 = \\parserHF_conf_fixed = v2 @ [parser_bottom G], parserHF_conf_history = h, parserHF_conf_stack = s @ s2 @ [q2]\\\n \\ parser_bottom G \\ set (v1 @ v2))\"\n\ndefinition parserHF_step_relation_ALT2 :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserHF_conf\n \\ bool\"\n where\n \"parserHF_step_relation_ALT2 G c1 e c2 \\\n e \\ parser_rules G\n \\ (\n parserHF_step_relation_ALT2_1a G c1 e c2\n \\ parserHF_step_relation_ALT2_1b G c1 e c2\n \\ parserHF_step_relation_ALT2_1c G c1 e c2\n \\ parserHF_step_relation_ALT2_2a G c1 e c2\n \\ parserHF_step_relation_ALT2_2b G c1 e c2\n \\ parserHF_step_relation_ALT2_3a G c1 e c2\n \\ parserHF_step_relation_ALT2_3b G c1 e c2\n )\"\n\nlemma parserHF_step_relation_ALT2_1a_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_1a G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_2b_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_2b G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_1b_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_1b G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_1c_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_1c G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_2a_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_2a G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_3b_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_3b G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2_3a_intro: \"\n e \\ parser_rules G \\ parserHF_step_relation_ALT2_3a G c1 e c2 \\ parserHF_step_relation_ALT2 G c1 e c2\"\n apply(simp add: parserHF_step_relation_ALT2_def)\n done\n\nlemma parserHF_step_relation_ALT2__vs__parserHF_step_relation_ALT: \"\n valid_parser G\n \\ c1 \\ parserHF_configurations G\n \\ parserHF_step_relation_ALT2 G c1 e c2 = parserHF_step_relation_ALT G c1 e c2\"\n apply(rule antisym)\n apply(simp add: parserHF_step_relation_ALT2_def parserHF_step_relation_ALT_def)\n apply(clarsimp)\n apply(erule disjE) \n apply(simp add: parserHF_step_relation_ALT2_1a_def)\n apply(clarsimp)\n apply (metis append_Nil2 butlast_if_match_direct2_prime butlast_if_match_pull_out drop_butlast_if_match_distrib prefix_append)\n apply(erule disjE) \n apply(simp add: parserHF_step_relation_ALT2_1b_def)\n apply(clarsimp)\n apply (metis append_assoc butlast_if_match_direct2_prime drop_butlast_if_match_distrib length_append prefix_append)\n apply(erule disjE) \n apply(simp add: parserHF_step_relation_ALT2_1c_def)\n apply(clarsimp)\n apply (metis append_assoc butlast_if_match_direct2_prime drop_length_append length_append not_set_append prefix_append)\n apply(erule disjE) \n apply(simp add: parserHF_step_relation_ALT2_2a_def)\n apply(clarsimp)\n apply (metis append_assoc butlast_if_match_direct drop_butlast_if_match_distrib length_append prefix_append) \n apply(erule disjE)\n apply(simp add: parserHF_step_relation_ALT2_2b_def)\n apply(clarsimp)\n apply (metis append_assoc butlast_if_match_direct drop_butlast_if_match_distrib length_append prefix_append) \n apply(erule disjE)\n apply(simp add: parserHF_step_relation_ALT2_3a_def)\n apply(clarsimp)\n apply(rule conjI)\n apply (metis append_assoc append_self_conv butlast_if_match_direct2_prime butlast_if_match_pull_out drop_length_append le_SucI length_append)\n apply (metis append_assoc prefix_def)\n apply(simp add: parserHF_step_relation_ALT2_3b_def)\n apply(clarsimp)\n apply(rule conjI)\n apply (metis add_Suc_right butlast_if_match_length_le length_Suc length_append)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(simp add: parserHF_step_relation_ALT_def)\n apply(clarsimp)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n prefer 2\n apply (metis valid_parser_def)\n apply(case_tac c1)\n apply(rename_tac f1 h1 s1)\n apply(case_tac c2)\n apply(rename_tac f2 h2 s2)\n apply(case_tac e)\n apply(rename_tac lpop rpop lpush rpush)\n apply(clarsimp)\n apply(erule disjE)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(subgoal_tac \"drop (length rpop + length c) (butlast_if_match rpop (parser_bottom G)) = []\")\n prefer 2\n apply (metis drop_entire_butlast_if_match drop_length_append length_append) \n apply(clarsimp)\n apply(thin_tac \"length (butlast_if_match rpop (parser_bottom G)) \\ length rpop + length c\")\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rule_tac xs=\"lpop\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(rule_tac xs=\"lpush\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(case_tac \"\\w'. kPrefix k (w @ [parser_bottom G]) @ c = w'@[parser_bottom G]\")\n prefer 2\n apply(clarsimp)\n apply(case_tac \"k \\ length w\")\n prefer 2\n apply(simp add: parserHF_configurations_def)\n apply(simp add: kPrefix_def)\n apply(simp add: kPrefix_def)\n apply(rule parserHF_step_relation_ALT2_1c_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_1c_def)\n apply(rule_tac x=\"xb\" in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply (metis append_same_eq append_take_drop_id drop_prefix_closureise set_take_subset subsetD triv_compl)\n apply(rule conjI)\n apply (metis (no_types, hide_lams) Diff_iff Un_iff all_not_in_conv empty_subsetI insert_subset set_append set_take_subset subsetD)\n apply(simp add: parserHF_configurations_def)\n apply(clarsimp)\n apply(rule_tac xs=\"c\" in rev_cases)\n prefer 2\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_3a_intro)\n apply(force)\n apply(rule_tac t=\"kPrefix k (w @ [parser_bottom G])\" and s=\"xb @ rpush\" in ssubst)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_3a_def)\n apply(rule_tac x=\"xb\" in exI)\n apply(clarsimp)\n apply(case_tac \"k \\ length w\")\n apply(simp add: parserHF_configurations_def)\n apply(simp add: kPrefix_def)\n apply (metis Un_iff set_append)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(simp add: parserHF_configurations_def)\n apply(clarsimp)\n apply(case_tac \"k \\ length w\")\n apply(simp add: kPrefix_def)\n apply (metis Un_iff insertCI set_append set_simps(2) set_take_subset subset_trans triv_compl)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_3b_intro)\n apply(force) \n apply(simp add: parserHF_step_relation_ALT2_3b_def)\n apply (metis triv_compl)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(subgoal_tac \"drop (length f1) (butlast_if_match (f1 @ c) (parser_bottom G)) = butlast_if_match c (parser_bottom G)\")\n prefer 2\n apply (metis drop_butlast_if_match_distrib)\n apply(clarsimp)\n apply(thin_tac \"drop (length f1) (butlast_if_match (f1 @ c) (parser_bottom G)) =\n butlast_if_match c (parser_bottom G)\")\n apply(case_tac \"\\c'. c = c' @[parser_bottom G]\")\n apply(clarsimp)\n apply(subgoal_tac \"butlast_if_match (c' @ [parser_bottom G]) (parser_bottom G) = c'\")\n prefer 2\n apply (metis butlast_if_match_direct)\n apply(clarsimp)\n apply(thin_tac \"butlast_if_match (c' @ [parser_bottom G]) (parser_bottom G) = c'\")\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rule_tac xs=\"lpop\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(rule_tac xs=\"lpush\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"f1@c'=xb@xc\") \n prefer 2\n apply (metis append1_eq_conv append_assoc)\n apply(subgoal_tac \"prefix f1 xb \\ prefix xb f1\")\n prefer 2\n apply (metis mutual_prefix_prefix)\n apply(erule disjE)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(case_tac \"k \\ length w\")\n apply(simp add: kPrefix_def)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(force)\n apply(rule_tac A=\"set (take k w)\" in set_mp)\n apply(rule set_take_subset)\n apply(rule_tac A=\"set (f1 @ c @ xc @ [parser_bottom G])\" in set_mp)\n apply(force)\n apply(simp (no_asm))\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_2a_intro)\n apply(force)\n apply(rename_tac s v1 h k v3 s1 q1 s2 q2 v2)\n apply(simp add: parserHF_step_relation_ALT2_2a_def)\n apply(force)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(case_tac \"k \\ length w\")\n apply(simp add: kPrefix_def) \n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(force)\n apply(rule_tac A=\"set (take k w)\" in set_mp)\n apply(rule set_take_subset)\n apply(rule_tac A=\"set (xb @ c @ c' @ [parser_bottom G])\" in set_mp)\n apply(force)\n apply(simp (no_asm))\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rename_tac s h v3 k v1 s1 q1 s2 q2 v2)\n apply(rule parserHF_step_relation_ALT2_2b_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_2b_def)\n apply (metis triv_compl)\n apply(clarsimp)\n apply(rule_tac xs=\"c\" in rev_cases)\n apply(clarsimp)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rule_tac xs=\"lpop\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(rule_tac xs=\"lpush\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(simp add: butlast_if_match_def) \n apply(case_tac \"k \\ length w\")\n apply(simp add: kPrefix_def)\n apply(subgoal_tac \"\\w'. w =xb@rpush @w' \\ length (xb@rpush) = k\")\n prefer 2\n apply(rule_tac x=\"drop k w\" in exI)\n apply(rule conjI)\n apply (metis append_assoc append_take_drop_id)\n apply (metis take_all_length)\n apply(rule_tac t=\"take k w\" and s=\"xb@rpush\" in ssubst) \n apply(force)\n apply(thin_tac \"xb @ rpush = take k w\")\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_1c_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_1c_def) \n apply (metis triv_compl) \n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rename_tac s h k v1 s1 q1 s2 q2 v2)\n apply(rule parserHF_step_relation_ALT2_3b_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_3b_def)\n apply (metis triv_compl)\n apply(clarsimp)\n apply(subgoal_tac \"butlast_if_match (ys @ [y]) (parser_bottom G) =ys@[y]\")\n prefer 2\n apply (metis butlast_if_match_direct2)\n apply(clarsimp)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(thin_tac \"butlast_if_match (ys @ [y]) (parser_bottom G) = ys @ [y]\")\n apply(case_tac \"k \\ length w\")\n prefer 2\n apply(simp add: kPrefix_def)\n apply(simp add: kPrefix_def)\n apply(subgoal_tac \"\\w'. w =f1 @ ys @ [y] @w' \\ length (f1 @ ys @ [y]) = k\")\n prefer 2\n apply(rule_tac x=\"drop k w\" in exI)\n apply(rule conjI)\n apply (metis append_assoc append_take_drop_id)\n apply (metis take_all_length)\n apply(rule_tac t=\"take k w\" and s=\"f1 @ ys @ [y]\" in ssubst) \n apply(force)\n apply(thin_tac \"f1 @ ys @ [y] = take k w\")\n apply(clarsimp)\n apply(rule_tac xs=\"lpop\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(rule_tac xs=\"lpush\" in rev_cases)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"prefix f1 xb \\ prefix xb f1\")\n prefer 2\n apply (metis mutual_prefix_prefix)\n apply(erule disjE)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rule_tac xs=\"rpush\" in rev_cases)\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_1a_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_1a_def)\n apply(force)\n apply(clarsimp)\n apply(rule parserHF_step_relation_ALT2_1a_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_1a_def)\n apply(force)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac s h v3a v3b v1 w' s1 q1 s2 q2 v2)\n apply(rule parserHF_step_relation_ALT2_1b_intro)\n apply(force)\n apply(simp add: parserHF_step_relation_ALT2_1b_def)\n apply(force)\n done\n\n\ndefinition parserHF_initial_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf set\"\n where\n \"parserHF_initial_configurations G \\\n {c. parserHF_conf_history c = []\n \\ parserHF_conf_fixed c = []\n \\ parserHF_conf_stack c = [parser_initial G]}\n \\ parserHF_configurations G\"\n\ndefinition parserHF_marking_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserHF_conf set\"\n where\n \"parserHF_marking_configurations G \\\n {c. \\f \\ parser_marking G. \\w.\n parserHF_conf_stack c = w @ [f]\n \\ parserHF_conf_fixed c \\ {[], [parser_bottom G]}}\n \\ parserHF_configurations G\"\n\ndefinition parserHF_marking_condition :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserHF_conf)derivation\n \\ bool\"\n where\n \"parserHF_marking_condition G d \\\n \\i e c.\n d i = Some (pair e c)\n \\ c \\ parserHF_marking_configurations G\n \\ (\\j e' c'.\n j > i\n \\ d j = Some(pair e' c')\n \\ parserHF_conf_history c = parserHF_conf_history c')\"\n\ndefinition parserHF_marked_effect :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserHF_conf)derivation\n \\ 'event list set\"\n where\n \"parserHF_marked_effect G d \\\n {w. \\i e c.\n d i = Some (pair e c)\n \\ w = parserHF_conf_history c\n \\ c \\ parserHF_marking_configurations G}\"\n\ndefinition parserHF_unmarked_effect :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserHF_conf)derivation\n \\ 'event list set\"\n where\n \"parserHF_unmarked_effect G d \\\n {w. \\i e c.\n d i = Some (pair e c)\n \\ parserHF_conf_history c = w}\"\n\ndefinition parserHF_get_destinations :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserHF_conf)derivation_configuration\n \\ ('stack, 'event) parser_destinations set\"\n where\n \"parserHF_get_destinations G der_conf \\\n case der_conf of pair e c \\\n state ` set (parserHF_conf_stack c)\n \\ (case e of None \\ {} | Some e' \\ {rule e'})\"\n\nlemma parserHF_inst_AX_initial_configuration_belongs: \"\n (\\G. valid_parser G \\ parserHF_initial_configurations G \\ parserHF_configurations G)\"\n apply(clarsimp)\n apply(rename_tac G x)(*strict*)\n apply(simp add: parserHF_initial_configurations_def)\n done\n\nlemma parserHF_inst_AX_step_relation_preserves_belongs: \"\n (\\G. valid_parser G \\ (\\c1 e c2. parserHF_step_relation G c1 e c2 \\ c1 \\ parserHF_configurations G \\ e \\ parser_step_labels G \\ c2 \\ parserHF_configurations G))\"\n apply(clarsimp)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: parser_step_labels_def parserHF_step_relation_def)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: parserHF_configurations_def)\n apply(clarsimp)\n apply(rename_tac G e c2 f h l)(*strict*)\n apply(simp add: parserHF_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G e c2 f h x)(*strict*)\n apply(case_tac c2)\n apply(rename_tac G e c2 f h x parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x)(*strict*)\n apply(simp add: parser_step_labels_def)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G e f h x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G e f h x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e f h x)(*strict*)\n apply(subgoal_tac \"set (rule_rpush e) \\ parser_events G\")\n apply(rename_tac G e f h x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e f h x)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G e f h x)(*strict*)\n apply(metis set_drop_subset subset_trans)\n apply(rename_tac G e f h x)(*strict*)\n apply(subgoal_tac \"set (rule_rpop e) \\ parser_events G\")\n apply(rename_tac G e f h x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f h x xa k w xc)(*strict*)\n apply(rule_tac\n A=\"set (kPrefix k (w @ [parser_bottom G]))\"\n in set_mp)\n apply(rename_tac G e f h x xa k w xc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G e f h x xa k w xc)(*strict*)\n apply(rule set_kPrefix_subset)\n apply(clarsimp)\n apply(simp add: valid_parser_def)\n apply(rule_tac\n B=\"parser_events G - {parser_bottom G}\"\n in subset_trans)\n apply(rename_tac G e f h x xa k w xc)(*strict*)\n apply(force)\n apply(rename_tac G e f h x xa k w xc)(*strict*)\n apply(force)\n apply(rename_tac G e f h x)(*strict*)\n apply(subgoal_tac \"set (drop (length f) (butlast_if_match (rule_rpop e) (parser_bottom G))) \\ set (rule_rpop e)\")\n apply(rename_tac G e f h x)(*strict*)\n prefer 2\n apply(rule_tac\n B=\"set(butlast_if_match (rule_rpop e) (parser_bottom G))\"\n in subset_trans)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule_tac\n B=\"set(rule_rpop e)\"\n in subset_trans)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule set_butlast_if_match_is_subset)\n apply(rename_tac G e f h x)(*strict*)\n apply(force)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G e f h x)(*strict*)\n apply(force)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G e f h x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(case_tac \"(\\x. x @ rule_rpush e = rule_rpop e)\")\n apply(rename_tac G e f h x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(case_tac \"k-length w\")\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set (drop (length f) (take k w))\")\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(force)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule_tac\n B=\"set(take k w)\"\n in nset_mp)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule_tac\n B=\"set w\"\n in nset_mp)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(rule_tac\n B=\"set w\"\n in nset_mp)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac G e f h x xa k w)(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G e f h x xa k w nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(subgoal_tac \"butlast_if_match (w @ [parser_bottom G]) (parser_bottom G) = w\")\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set (drop (length f) w)\")\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(force)\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(rule_tac\n B=\"set w\"\n in nset_mp)\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G e f h x xa k w nat xb)(*strict*)\n apply(rule butlast_if_match_direct)\n apply(force)\n apply(rename_tac G e f h x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x)(*strict*)\n apply(rule propSym)\n apply(subgoal_tac \"\\w. rule_rpop e = w @ (rule_rpush e)\")\n apply(rename_tac G e f h x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f h x k w xb)(*strict*)\n apply(simp add: kPrefix_def)\n apply(rule_tac\n x=\"xb\"\n in exI)\n apply(force)\n apply(rename_tac G e f h x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x w)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G e f h x w)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G e f h x w)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e h x w c wa)(*strict*)\n apply(subgoal_tac \"prefix w wa \\ prefix wa w\")\n apply(rename_tac G e h x w c wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e h x w c wa)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e h x w c wa)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e h x c wa ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e h x c wa ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e h x c wa ca a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e h x w c wa)(*strict*)\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac G e f h x w)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e f h x w c)(*strict*)\n apply(subgoal_tac \"drop (length w + length (rule_rpush e)) f = []\")\n apply(rename_tac G e f h x w c)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f h x w c k wa)(*strict*)\n apply(case_tac e)\n apply(rename_tac G e f h x w c k wa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length wa\")\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set rule_rpush\")\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(rule_tac\n B=\"set(w @ rule_rpush)\"\n in nset_mp)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(rule_tac\n B=\"set(take k wa)\"\n in nset_mp)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(simp (no_asm_simp))\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(rule_tac\n B=\"set wa\"\n in nset_mp)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G f h x w c k wa rule_lpop rule_lpush rule_rpush nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G f h x w c k rule_lpop rule_lpush nat xa)(*strict*)\n apply(case_tac c)\n apply(rename_tac G f h x w c k rule_lpop rule_lpush nat xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G f h x w c k rule_lpop rule_lpush nat xa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. c = w' @ [x']\")\n apply(rename_tac G f h x w c k rule_lpop rule_lpush nat xa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G f h x w c k rule_lpop rule_lpush nat xa a list)(*strict*)\n apply(thin_tac \"c=a#list\")\n apply(clarsimp)\n apply(rename_tac G f h x w k rule_lpop rule_lpush nat xa w')(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set xa\")\n apply(rename_tac G f h x w k rule_lpop rule_lpush nat xa w')(*strict*)\n apply(force)\n apply(rename_tac G f h x w k rule_lpop rule_lpush nat xa w')(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G e f h x w c)(*strict*)\n apply(rule drop_all)\n apply(rule_tac\n j=\"length(w@rule_rpush e)\"\n in le_trans)\n apply(rename_tac G e f h x w c)(*strict*)\n apply(rule_tac\n t=\"w@rule_rpush e\"\n and s=\"f@c\"\n in ssubst)\n apply(rename_tac G e f h x w c)(*strict*)\n apply(force)\n apply(rename_tac G e f h x w c)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G e f h x w c)(*strict*)\n apply(force)\n apply(rename_tac G e f h x w)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G e f h x w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set f\")\n apply(rename_tac G e f h x w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e h x w wa)(*strict*)\n apply(case_tac \"length w + length (rule_rpush e) - length wa\")\n apply(rename_tac G e h x w wa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set wa\")\n apply(rename_tac G e h x w wa)(*strict*)\n apply(force)\n apply(rename_tac G e h x w wa)(*strict*)\n apply(rule_tac\n A=\"set (drop (length w + length (rule_rpush e)) wa)\"\n in set_mp)\n apply(rename_tac G e h x w wa)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G e h x w wa)(*strict*)\n apply(force)\n apply(rename_tac G e h x w wa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f h x w)(*strict*)\n apply(rule_tac\n A=\"set (drop (length w + length (rule_rpush e)) f)\"\n in set_mp)\n apply(rename_tac G e f h x w)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G e f h x w)(*strict*)\n apply(force)\n apply(rename_tac G e f h x w)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G e f x w c)(*strict*)\n apply(case_tac \"parser_bottom G \\ set f\")\n apply(rename_tac G e f x w c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (wa @ [parser_bottom G]) (parser_bottom G)\"\n and s=\"wa\"\n in ssubst)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(rule butlast_if_match_direct)\n apply(force)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(case_tac \"length w + length (rule_rpush e) - length wa\")\n apply(rename_tac G e x w c wa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"butlast_if_match (rule_rpush e @ drop (length w + length (rule_rpush e)) wa @ [parser_bottom G]) (parser_bottom G)\"\n and s=\"rule_rpush e @ drop (length w + length (rule_rpush e)) wa\"\n in ssubst)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(rule butlast_if_match_direct)\n apply(force)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(rule_tac\n t=\"drop (Suc (length wa)) (butlast_if_match (w @ rule_rpush e) (parser_bottom G))\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(rule drop_all)\n apply(rule_tac\n j=\"length(w@rule_rpush e)\"\n in le_trans)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(rule butlast_if_match_length_le)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(force)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(clarsimp)\n apply(case_tac ca)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(rule_tac\n t=\"drop (length w + length (rule_rpush e)) wa\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(rule drop_all)\n apply(rule_tac\n j=\"length(w@rule_rpush e)\"\n in le_trans)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(force)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G e x w c wa)(*strict*)\n apply(clarsimp)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e x w c wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e x w c wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa a list)(*strict*)\n apply(thin_tac \"rule_rpush e=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c wa ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(subgoal_tac \"prefix (wa@[parser_bottom G]) w \\ prefix w (wa@[parser_bottom G])\")\n apply(rename_tac G e x w c wa ca)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca cb)(*strict*)\n apply(case_tac cb)\n apply(rename_tac G e x w c wa ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa ca cb a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cb = w' @ [x']\")\n apply(rename_tac G e x w c wa ca cb a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa ca cb a list)(*strict*)\n apply(thin_tac \"cb=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c ca w')(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set (rule_rpush e)\")\n apply(rename_tac G e x w c ca w')(*strict*)\n apply(force)\n apply(rename_tac G e x w c ca w')(*strict*)\n apply(rule_tac\n t=\"rule_rpush e\"\n and s=\"w' @ parser_bottom G # ca\"\n in ssubst)\n apply(rename_tac G e x w c ca w')(*strict*)\n apply(force)\n apply(rename_tac G e x w c ca w')(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"parser_bottom G \\ set (rule_rpush e)\")\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (wb @ [parser_bottom G]) (parser_bottom G)\"\n and s=\"wb\"\n in ssubst)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(rule butlast_if_match_direct)\n apply(force)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w @ wb @ [parser_bottom G]) (parser_bottom G)\"\n and s=\"w@wb\"\n in ssubst)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(rule butlast_if_match_direct)\n apply(force)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c wa nat wb ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c wa nat wb ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat wb ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb w')(*strict*)\n apply(subgoal_tac \"prefix (wa@[parser_bottom G]) w \\ prefix w (wa@[parser_bottom G])\")\n apply(rename_tac G e x w c wa nat wb w')(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac G e x w c wa nat wb w')(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa nat wb w')(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb w')(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb w' ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c wa nat wb w' ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat wb w' ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c wa nat wb w' ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat wb w' ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (rule_rpush e) (parser_bottom G)\"\n and s=\"rule_rpush e\"\n in ssubst)\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e x w c wa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e x w c wa nat a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat a list)(*strict*)\n apply(thin_tac \"rule_rpush e=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w @ w' @ [x']) (parser_bottom G)\"\n and s=\"w @ w' @ [x']\"\n in ssubst)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(rule butlast_if_match_direct2)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat+length wa=length w + length w'\")\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(subgoal_tac \"prefix (wa@[parser_bottom G]) w \\ prefix w (wa@[parser_bottom G])\")\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca cb)(*strict*)\n apply(case_tac cb)\n apply(rename_tac G e x w c wa nat w' x' ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca cb a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cb = w' @ [x']\")\n apply(rename_tac G e x w c wa nat w' x' ca cb a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat w' x' ca cb a list)(*strict*)\n apply(thin_tac \"cb=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c nat w' x' ca w'a)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c nat w' x' ca w'a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c nat w' x' ca w'a a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c nat w' x' ca w'a a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c nat w' x' ca w'a a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x')(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c wa nat w' x' ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c wa nat w' x' ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c wa nat w' x' ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c wa nat w' x' ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e f x w c)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match f (parser_bottom G)\"\n and s=\"f\"\n in ssubst)\n apply(rename_tac G e f x w c)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e f x w c)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G e f x w c)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e x w c ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e x w c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c)(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e x w c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x c)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [] (parser_bottom G)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x c)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e x c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e x w c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c a list)(*strict*)\n apply(thin_tac \"rule_rpush e=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w' @ [x']) (parser_bottom G)\"\n and s=\"w'@[x']\"\n in ssubst)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule butlast_if_match_direct2)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w@w' @ [x']) (parser_bottom G)\"\n and s=\"w@w'@[x']\"\n in ssubst)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule butlast_if_match_direct2)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e x w c ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (rule_rpush e @ w' @ [x']) (parser_bottom G)\"\n and s=\"(rule_rpush e @ w' @ [x'])\"\n in ssubst)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule butlast_if_match_direct2)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule_tac\n t=\"drop (Suc (length w + (length (rule_rpush e) + length w'))) (butlast_if_match (w @ rule_rpush e) (parser_bottom G))\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule drop_all)\n apply(rule_tac\n j=\"length ((w @ rule_rpush e))\"\n in le_trans)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule butlast_if_match_length_le)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e f x w c)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(rule_tac\n t=\"drop (length w + length (rule_rpush e)) f\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(rule drop_all)\n apply(rule_tac\n t=\"length w + length (rule_rpush e)\"\n and s=\"length (w @ rule_rpush e)\"\n in ssubst)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(force)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(rule_tac\n t=\"w @ rule_rpush e\"\n and s=\"f@ca\"\n in ssubst)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(force)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"drop (length f) (butlast_if_match (w @ rule_rpush e) (parser_bottom G))\"\n and s=\"butlast_if_match ca (parser_bottom G)\"\n in ssubst)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(rule_tac\n t=\"w @ rule_rpush e\"\n and s=\"f@ca\"\n in ssubst)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(force)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(rule drop_butlast_if_match_distrib)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac G e f x w c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [] (parser_bottom G)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x w c)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e x w c)(*strict*)\n apply(clarsimp)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e x w c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x c)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [] (parser_bottom G)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e x c)(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e x c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x w c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e x w c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x w c a list)(*strict*)\n apply(thin_tac \"rule_rpush e=a#list\")\n apply(clarsimp)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w' @ [x']) (parser_bottom G)\"\n and s=\"w'@[x']\"\n in ssubst)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(rule butlast_if_match_direct2)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e x w c w' x')(*strict*)\n apply(force)\n apply(rename_tac G e f x w c ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ca = w' @ [x']\")\n apply(rename_tac G e f x w c ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e f x w c ca a list)(*strict*)\n apply(thin_tac \"ca=a#list\")\n apply(clarsimp)\n apply(rename_tac G e f x w c w' x')(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e f x w c w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x c w' x')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [] (parser_bottom G)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G e f x c w' x')(*strict*)\n apply(rule butlast_if_match_direct2_prime)\n apply(force)\n apply(rename_tac G e f x c w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x w c w' x' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e f x w c w' x' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e f x w c w' x' a list)(*strict*)\n apply(thin_tac \"rule_rpush e=a#list\")\n apply(clarsimp)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(rule_tac\n x=\"c@w\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"f @ butlast_if_match (w' @ [x'a]) (parser_bottom G)\"\n and s=\"butlast_if_match (f @ w' @ [x'a]) (parser_bottom G)\"\n in ssubst)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply (metis butlast_if_match_pull_out_prime)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(rule_tac\n t=\"w @ butlast_if_match (w'a @ [x'a]) (parser_bottom G)\"\n and s=\"butlast_if_match (w @ w'a @ [x'a]) (parser_bottom G)\"\n in ssubst)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply (metis butlast_if_match_pull_out dropPrecise drop_Nil not_Cons_self)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(rule_tac\n t=\"f @ w' @ [x'a]\"\n and s=\"(f @ w')@ [x'a]\"\n in ssubst)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(force)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(rule_tac\n t=\"f @ w'\"\n and s=\"w @ w'a\"\n in ssubst)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(force)\n apply(rename_tac G e f x w c w' w'a x'a)(*strict*)\n apply(force)\n done\n\ninterpretation \"parserHF\" : loc_autHF_0\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs)\n done\n\nlemma parserHF_inst_AX_effect_inclusion1: \"\n (\\M f. parserHF_marking_condition M f \\ parserHF_marked_effect M f \\ parserHF_unmarked_effect M f)\"\n apply(clarsimp)\n apply(rename_tac M f x)(*strict*)\n apply(simp add: parserHF_unmarked_effect_def parserHF_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac M f i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n done\n\nlemma parserHF_ins_lang_sound: \"\n (\\M. valid_parser M \\ parserHF.unmarked_language M \\ parser_markers M)\"\n apply(clarsimp)\n apply(rename_tac M x)(*strict*)\n apply(simp add: parserHF.unmarked_language_def parserHF_unmarked_effect_def parser_markers_def)\n apply(clarsimp)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(subgoal_tac \"c \\ parserHF_configurations M\")\n apply(rename_tac M xa d i e c)(*strict*)\n apply(simp add: parserHF_configurations_def)\n apply(clarsimp)\n apply(rename_tac M xa d i e f h l)(*strict*)\n apply(force)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(rule parserHF.belongs_configurations)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(force)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(force)\n apply(rename_tac M xa d i e c)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_AX_marking_condition_implies_existence_of_effect: \"\n (\\M. valid_parser M \\ (\\f. parserHF.derivation_initial M f \\ parserHF_marking_condition M f \\ parserHF_marked_effect M f \\ {}))\"\n apply(simp add: parserHF_marking_condition_def parserHF_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac M f i e c)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_AX_unmarked_effect_persists: \"\n (\\G. valid_parser G \\\n (\\d. ATS.derivation_initial parserHF_initial_configurations\n parserHF_step_relation G d \\\n (\\n. parserHF_unmarked_effect G (derivation_take d n)\n \\ parserHF_unmarked_effect G d)))\"\n apply(clarsimp)\n apply(rename_tac G d n xa)(*strict*)\n apply(simp add: parserHF_unmarked_effect_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac G d n i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(case_tac \"i\\n\")\n apply(rename_tac G d n i e c)(*strict*)\n apply(force)\n apply(rename_tac G d n i e c)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_ATS_axioms: \"\n ATS_Language_axioms valid_parser parserHF_initial_configurations\n parserHF_step_relation parser_markers parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect\"\n apply(simp add: ATS_Language_axioms_def)\n apply(simp add: parserHF_inst_AX_effect_inclusion1 parserHF_ins_lang_sound parserHF_inst_AX_marking_condition_implies_existence_of_effect parserHF_inst_AX_unmarked_effect_persists )\n done\n\ninterpretation \"parserHF\" : loc_autHF_1\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms )\n done\n\ndefinition parserHF_set_history :: \"\n ('stack, 'event) parserHF_conf\n \\ 'event list\n \\ ('stack, 'event) parserHF_conf\"\n where\n \"parserHF_set_history c h \\\n c \\parserHF_conf_history := h\\\"\n\nlemma parserHF_inst_AX_initial_history_empty: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserHF_initial_configurations G \\ parserHF_conf_history c = []))\"\n apply(simp add: parserHF_initial_configurations_def)\n done\n\nlemma parserHF_inst_AX_steps_extend_history: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserHF_configurations G \\ (\\e c'. parserHF_step_relation G c e c' \\ (\\hf\\ parser_markers G. parserHF_conf_history c' = parserHF_conf_history c @ hf))))\"\n apply(clarsimp)\n apply(rename_tac G c e c')(*strict*)\n apply(subgoal_tac \"SSe \\ parser_step_labels SSG \\ SSc2 \\ parserHF_configurations SSG\" for SSe SSc2 SSG)\n apply(rename_tac G c e c')(*strict*)\n prefer 2\n apply(rule parserHF.AX_step_relation_preserves_belongs)\n apply(rename_tac G c e c')(*strict*)\n apply(force)\n apply(rename_tac G c e c')(*strict*)\n apply(force)\n apply(rename_tac G c e c')(*strict*)\n apply(force)\n apply(rename_tac G c e c')(*strict*)\n apply(clarsimp)\n apply(simp add: parserHF_step_relation_def parser_markers_def parser_step_labels_def)\n apply(clarsimp)\n apply(rename_tac G c e c' x xa)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G c e c' x xa)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac G c e c' x xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule_tac\n A=\"set (drop (length (parserHF_conf_fixed c)) (butlast_if_match (kPrefix k (w @ [parser_bottom G])) (parser_bottom G)))\"\n in set_mp)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule_tac\n B=\"set ((butlast_if_match (kPrefix k (w @ [parser_bottom G])) (parser_bottom G)))\"\n in subset_trans)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule set_drop_subset)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule_tac\n B=\"set (((kPrefix k (w @ [parser_bottom G]))))\"\n in subset_trans)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule set_butlast_if_match_is_subset)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(rule set_kPrefix_subset)\n apply(clarsimp)\n apply(simp add: valid_parser_def)\n apply(blast)\n apply(rename_tac G c e c' x xa k w xc)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_AX_empty_history_is_history: \"\n (\\G. valid_parser G \\ [] \\ parser_markers G)\"\n apply(simp add: parser_markers_def)\n done\n\nlemma parserHF_inst_AX_set_get_history: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserHF_configurations G \\ parserHF_set_history c (parserHF_conf_history c) = c))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parserHF_set_history_def)\n done\n\nlemma parserHF_inst_AX_get_set_history: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserHF_configurations G \\ (\\h. h \\ parser_markers G \\ parserHF_conf_history (parserHF_set_history c h) = h)))\"\n apply(clarsimp)\n apply(rename_tac G c h)(*strict*)\n apply(simp add: parserHF_set_history_def)\n done\n\nlemma parserHF_inst_AX_join_history_fragments_closed: \"\n (\\G. valid_parser G \\ (\\hf1. hf1 \\ parser_markers G \\ (\\hf2. hf2 \\ parser_markers G \\ hf1 @ hf2 \\ parser_markers G)))\"\n apply(clarsimp)\n apply(rename_tac G hf1 hf2)(*strict*)\n apply(simp add: parser_markers_def)\n done\n\nlemma parserHF_inst_AX_get_history_closed: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserHF_configurations G \\ parserHF_conf_history c \\ parser_markers G))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parser_markers_def parserHF_configurations_def)\n apply(clarsimp)\n apply(rename_tac G x f h l)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_AX_mutual_prefix: \"\n (\\G. valid_parser G \\ (\\hf1. hf1 \\ parser_markers G \\ (\\hf2. hf2 \\ parser_markers G \\ (\\hf3. hf3 \\ parser_markers G \\ (\\hf4. hf4 \\ parser_markers G \\ hf1 @ hf2 = hf3 @ hf4 \\ (\\hf\\ parser_markers G. hf1 @ hf = hf3) \\ (\\hf\\ parser_markers G. hf3 @ hf = hf1))))))\"\n apply(clarsimp)\n apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n apply(simp add: parser_markers_def parserHF_configurations_def)\n apply(subgoal_tac \"prefix hf1 hf3 \\ prefix hf3 hf1\")\n apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n apply(erule disjE)\n apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac G hf2 hf3 c)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_ATS_History_axioms: \"\n ATS_History_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parserHF_step_relation parser_markers\n parser_markers parser_empty_history parser_empty_history_fragment\n parserHF_set_history (@) (@) parserHF_conf_history\"\n apply(simp add: ATS_History_axioms_def)\n apply(simp add: parserHF_inst_AX_initial_history_empty parserHF_inst_AX_steps_extend_history parserHF_inst_AX_empty_history_is_history parserHF_inst_AX_set_get_history parserHF_inst_AX_get_set_history parserHF_inst_AX_join_history_fragments_closed parserHF_inst_AX_get_history_closed parserHF_inst_AX_mutual_prefix )\n done\n\ninterpretation \"parserHF\" : loc_autHF_2\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms )\n done\n\nlemma parserHF_inst_lang_finite: \"\n (\\G. valid_parser G \\ parserHF.finite_marked_language G = parserHF.marked_language G)\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(simp add: parserHF.finite_marked_language_def parserHF.marked_language_def)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d n)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d)(*strict*)\n apply(simp add: parserHF_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"derivation_take d i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d i e c)(*strict*)\n apply(simp add: parserHF_marking_condition_def)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G d i e c ia ea ca)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n done\n\nlemma parserHF_inst_AX_unmarked_language_finite: \"\n (\\G. valid_parser G \\ parserHF.finite_unmarked_language G = parserHF.unmarked_language G)\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(simp add: parserHF.finite_unmarked_language_def parserHF.unmarked_language_def)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d n)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d)(*strict*)\n apply(simp add: parserHF_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"derivation_take d i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d i e c)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n done\n\ndefinition parserHF_get_fixed_scheduler_DB :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserHF_conf) derivation\n \\ nat\n \\ 'event list\"\n where\n \"parserHF_get_fixed_scheduler_DB G d n \\\n parserHF_conf_fixed (the (get_configuration (d n)))\"\n\nlemma parserHF_inst_AX_fixed_scheduler_extendable_translates_backwards: \"\n (\\G. valid_parser G \\ (\\c1. c1 \\ parserHF_configurations G \\ (\\e c2. parserHF_step_relation G c1 e c2 \\ \\ parserHF_conf_fixed c2 \\ [parser_bottom G] \\ \\ parserHF_conf_fixed c1 \\ [parser_bottom G])))\"\n apply(clarsimp)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G c1 e c2)(*strict*)\n prefer 2\n apply(simp add: parserHF_step_relation_def valid_parser_def)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(subgoal_tac \"c2 \\ parserHF_configurations G\")\n apply(rename_tac G c1 e c2)(*strict*)\n prefer 2\n apply(rule parserHF.AX_step_relation_preserves_belongsC)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: valid_parser_step_label_def suffix_def parserHF_configurations_def parserHF_step_relation_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb)(*strict*)\n apply(case_tac \"length (kPrefix k (w @ [parser_bottom G])) - length c\")\n apply(rename_tac G e c k w xa ca cb xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n apply(clarsimp)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n prefer 2\n apply(rename_tac G e c k w xa ca cb xb nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat nata x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"min (length w) k = k\")\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"min (length w) k = k\")\n apply(erule disjE)\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(case_tac cc)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat cc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cc = w' @ [x']\")\n apply(rename_tac G e c k w xa ca cb xb nat cc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat cc a list)(*strict*)\n apply(thin_tac \"cc = a # list\")\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(rule_tac\n A=\"parser_events G\"\n in not_in_diff)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(rule_tac\n A=\"set(take k w)\"\n in set_mp)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(rule set_take_subset)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(rule_tac\n t=\"take k w\"\n and s=\"c @ [parser_bottom G] @ cc\"\n in ssubst)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(force)\n apply(rename_tac G e c k w xa ca cb xb nat cc)(*strict*)\n apply(simp (no_asm))\n done\n\nlemma parserHF_inst_AX_get_fixed_scheduler_DB_in_fixed_schedulers: \"\n (\\G. valid_parser G \\ (\\d. parserHF.derivation G d \\ parserHF.belongs G d \\ (\\n. (\\y. d n = Some y) \\ parserHF_get_fixed_scheduler_DB G d n \\ parser_fixed_schedulers G)))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: parserHF_get_fixed_scheduler_DB_def)\n apply(simp add: parser_fixed_schedulers_def)\n apply(case_tac y)\n apply(rename_tac G d n y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"b \\ parserHF_configurations G\")\n apply(rename_tac G d n option b)(*strict*)\n prefer 2\n apply (metis parserHF.belongs_configurations)\n apply(rename_tac G d n option b)(*strict*)\n apply(simp add: parserHF_configurations_def parser_schedulers_def prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G d n option f h l)(*strict*)\n apply(case_tac \"parser_bottom G \\ set f\")\n apply(rename_tac G d n option f h l)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n option h l w)(*strict*)\n apply(rule_tac\n x=\"w @ [parser_bottom G]\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G d n option f h l)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"f @ [parser_bottom G]\"\n in exI)\n apply(clarsimp)\n done\n\nlemma parserHF_inst_AX_get_fixed_scheduler_DB_restrict: \"\n \\G. valid_parser G \\ (\\x n. x \\ n \\ (\\d1. parserHF.derivation G d1 \\ (\\d2. parserHF_get_fixed_scheduler_DB G (derivation_append d1 d2 n) x = parserHF_get_fixed_scheduler_DB G d1 x)))\"\n apply(clarsimp)\n apply(rename_tac G x n d1 d2)(*strict*)\n apply(simp add: derivation_append_def parserHF_get_fixed_scheduler_DB_def)\n done\n\nlemma parserHF_inst_ATS_SchedF_SB_axioms: \"\n ATS_SchedF_SB_axioms valid_parser parserHF_configurations\n parserHF_step_relation parser_fixed_scheduler_extendable\n parserHF_conf_fixed\"\n apply(simp add: ATS_SchedF_SB_axioms_def)\n apply(simp add: parserHF_inst_AX_fixed_scheduler_extendable_translates_backwards )\n done\n\ninterpretation \"parserHF\" : loc_autHF_3\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms )\n done\n\nlemma parserHF_inst_AX_schedF_db_extendable_translates_backwards: \"\n (\\G. valid_parser G \\ (\\d1. parserHF.derivation G d1 \\ parserHF.belongs G d1 \\ (\\n x. (\\y. d1 (n + x) = Some y) \\ \\ parserHF_get_fixed_scheduler_DB G d1 (n + x) \\ [parser_bottom G] \\ \\ parserHF_get_fixed_scheduler_DB G d1 n \\ [parser_bottom G])))\"\n apply(clarsimp)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(simp add: parserHF_get_fixed_scheduler_DB_def)\n apply(subgoal_tac \"\\e c. d1 n= Some (pair e c)\")\n apply(rename_tac G d1 n x y)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d1 n x y e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac y)\n apply(rename_tac G d1 n x y e c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(subgoal_tac \"\\ parserHF_conf_fixed c \\ [parser_bottom G]\")\n apply(rename_tac G d1 n x e c option b)(*strict*)\n prefer 2\n apply(fold parser_fixed_scheduler_extendable_def)\n apply(rule parserHF.fixed_scheduler_extendable_translates_backwards_lift)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply (metis parserHF.belongs_configurations)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x e c option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(rule_tac\n m=\"n+x\"\n in parserHF.pre_some_position_is_some_position)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(force)\n done\n\nlemma parserHF_inst_AX_state_based_vs_derivation_based_get_fixed_scheduler: \"\n \\G. valid_parser G \\ (\\d. parserHF.derivation_initial G d \\ (\\n e c. d n = Some (pair e c) \\ parserHF_get_fixed_scheduler_DB G d n = parserHF_conf_fixed c))\"\n apply(clarsimp)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parserHF_get_fixed_scheduler_DB_def)\n apply(simp add: get_configuration_def)\n done\n\nlemma parserHF_inst_AX_history_no_mod_after_nonextendable_fixed_sched: \"\n \\G. valid_parser G \\ (\\c. parserHF_conf_fixed c \\ [parser_bottom G] \\ c \\ parserHF_configurations G \\ (\\e c'. parserHF_step_relation G c e c' \\ parserHF_conf_history c = parserHF_conf_history c'))\"\n apply(clarsimp)\n apply(rename_tac G c e c')(*strict*)\n apply(simp add: parserHF_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G c e c' x)(*strict*)\n apply(simp add: prefix_def suffix_def)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac G c e c' x ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca cb)(*strict*)\n apply (metis append_length_inc drop_entire_butlast_if_match drop_eq_Nil length_Suc)\n apply(rename_tac G c e c' x ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca cb)(*strict*)\n apply(subgoal_tac \"cb=[]\")\n apply(rename_tac G c e c' x ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca)(*strict*)\n apply (metis butlast_if_match_length_le length_Suc)\n apply(rename_tac G c e c' x ca cb)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G c e c' x ca cb)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac G c e c' x ca cb)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca cb k w xb)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac G c e c' x ca cb k w xb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G c e c' x ca cb k w xb)(*strict*)\n apply(force)\n apply(rename_tac G c e c' x ca cb k w xb)(*strict*)\n apply (metis Cons_eq_appendI append_Nil append_eq_appendI append_self_conv butlast_if_match_direct butlast_if_match_direct2_prime in_set_takeD kPrefix_def list.simps(2) take_append_prime)\n apply(rename_tac G c e c' x ca cb k w xb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c e c' x ca cb k w xb nat xa)(*strict*)\n apply(case_tac cb)\n apply(rename_tac G c e c' x ca cb k w xb nat xa)(*strict*)\n apply(force)\n apply(rename_tac G c e c' x ca cb k w xb nat xa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cb = w' @ [x']\")\n apply(rename_tac G c e c' x ca cb k w xb nat xa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G c e c' x ca cb k w xb nat xa a list)(*strict*)\n apply(thin_tac \"cb=a#list\")\n apply(clarsimp)\n done\n\nlemma parserHF_inst_ATS_SchedF_DB_axioms: \"\n ATS_SchedF_DB_axioms valid_parser parserHF_configurations\n parser_step_labels parserHF_step_relation parser_fixed_schedulers\n parser_fixed_scheduler_extendable parserHF_get_fixed_scheduler_DB\"\n apply(simp add: ATS_SchedF_DB_axioms_def)\n apply(simp add: parserHF_inst_AX_get_fixed_scheduler_DB_in_fixed_schedulers parserHF_inst_AX_fixed_scheduler_extendable_translates_backwards parserHF_inst_AX_get_fixed_scheduler_DB_restrict parserHF_inst_AX_schedF_db_extendable_translates_backwards )\n done\n\nlemma parserHF_inst_ATS_SchedF_SDB_axioms: \"\n ATS_SchedF_SDB_axioms valid_parser parserHF_initial_configurations parserHF_step_relation parserHF_conf_fixed parserHF_get_fixed_scheduler_DB\"\n apply(simp add: ATS_SchedF_SDB_axioms_def)\n apply(simp add: parserHF_inst_AX_state_based_vs_derivation_based_get_fixed_scheduler )\n done\n\nlemma parserHF_inst_ATS_determHIST_SB_axioms: \"\n ATS_determHIST_SB_axioms valid_parser parserHF_configurations\n parserHF_step_relation parserHF_conf_history\n parser_fixed_scheduler_extendable parserHF_conf_fixed\"\n apply(simp add: ATS_determHIST_SB_axioms_def)\n apply(simp add: parserHF_inst_AX_history_no_mod_after_nonextendable_fixed_sched )\n done\n\ninterpretation \"parserHF\" : loc_autHF_6\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n (* get_fixed_scheduler_DB *)\n \"parserHF_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms parserHF_inst_ATS_SchedF_DB_axioms parserHF_inst_ATS_SchedF_SDB_axioms parserHF_inst_ATS_determHIST_SB_axioms )\n done\n\nlemma parserHF_inst_ATS_Language_by_Finite_Derivations_axioms: \"\n ATS_Language_by_Finite_Derivations_axioms valid_parser\n parserHF_initial_configurations parserHF_step_relation\n parserHF_marking_condition parserHF_marked_effect\n parserHF_unmarked_effect\"\n apply(simp add: ATS_Language_by_Finite_Derivations_axioms_def)\n apply(simp add: parserHF_inst_lang_finite parserHF_inst_AX_unmarked_language_finite )\n done\n\ninterpretation \"parserHF\" : loc_autHF_7\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n (* get_fixed_scheduler_DB *)\n \"parserHF_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms parserHF_inst_ATS_SchedF_DB_axioms parserHF_inst_ATS_SchedF_SDB_axioms parserHF_inst_ATS_determHIST_SB_axioms parserHF_inst_ATS_Language_by_Finite_Derivations_axioms )\n done\n\nlemma parserHF_inst_AX_is_forward_target_deterministic_correspond_SB: \"\n \\G. valid_parser G \\ parserHF.is_forward_target_deterministic_accessible G = ATS_determHIST_SB.is_forward_target_deterministicHist_SB_long parserHF_initial_configurations parserHF_step_relation parser_markers (@) (@) parserHF_conf_history parser_fixed_scheduler_extendable parserHF_conf_fixed G\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rule parserHF.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_SB_long)\n apply(rename_tac G)(*strict*)\n apply(force)\n apply(rename_tac G)(*strict*)\n apply(force)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(simp add: parserHF.is_forward_target_deterministic_accessible_def)\n apply(simp add: parserHF.is_forward_target_deterministicHist_SB_long_def)\n apply(clarsimp)\n apply(rename_tac G c c1 c2 e)(*strict*)\n apply(erule_tac\n x=\"c\"\n in ballE)\n apply(rename_tac G c c1 c2 e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G c c1 c2 e)(*strict*)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(clarsimp)\n apply(simp add: parserHF_step_relation_def)\n apply(clarsimp)\n done\n\nlemma parserHF_inst_ATS_HistoryCT_SB_axioms: \"\n ATS_HistoryCT_SB_axioms valid_parser parserHF_initial_configurations parserHF_step_relation parser_markers (@) (@) parserHF_conf_history parser_fixed_scheduler_extendable parserHF_conf_fixed\"\n apply(simp add: ATS_HistoryCT_SB_axioms_def)\n apply(simp add: parserHF_inst_AX_is_forward_target_deterministic_correspond_SB )\n done\n\ninterpretation \"parserHF\" : loc_autHF_8\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n (* get_fixed_scheduler_DB *)\n \"parserHF_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms parserHF_inst_ATS_SchedF_DB_axioms parserHF_inst_ATS_SchedF_SDB_axioms parserHF_inst_ATS_determHIST_SB_axioms parserHF_inst_ATS_Language_by_Finite_Derivations_axioms parserHF_inst_ATS_HistoryCT_SB_axioms )\n done\n\nlemma parserHF_inst_AX_is_forward_target_deterministic_correspond_DB: \"\n \\G. valid_parser G \\ parserHF.is_forward_target_deterministic_accessible G = ATS_determHIST_DB.is_forward_target_deterministicHist_DB_long parserHF_initial_configurations parserHF_step_relation parser_markers (@) (@) parserHF_conf_history parser_fixed_scheduler_extendable parserHF_get_fixed_scheduler_DB G\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rule parserHF.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_DB_long)\n apply(rename_tac G)(*strict*)\n apply(force)\n apply(rename_tac G)(*strict*)\n apply(force)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(simp add: parserHF.is_forward_target_deterministic_accessible_def)\n apply(simp add: parserHF.is_forward_target_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac G c c1 c2 e)(*strict*)\n apply(simp add: parserHF_step_relation_def)\n apply(clarsimp)\n done\n\nlemma parserHF_inst_ATS_HistoryCT_DB_axioms: \"\n ATS_HistoryCT_DB_axioms valid_parser parserHF_initial_configurations parserHF_step_relation parser_markers (@) (@) parserHF_conf_history parser_fixed_scheduler_extendable parserHF_get_fixed_scheduler_DB\"\n apply(simp add: ATS_HistoryCT_DB_axioms_def)\n apply(simp add: parserHF_inst_AX_is_forward_target_deterministic_correspond_DB )\n done\n\ninterpretation \"parserHF\" : loc_autHF_9\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n (* get_fixed_scheduler_DB *)\n \"parserHF_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms parserHF_inst_ATS_SchedF_DB_axioms parserHF_inst_ATS_SchedF_SDB_axioms parserHF_inst_ATS_determHIST_SB_axioms parserHF_inst_ATS_Language_by_Finite_Derivations_axioms parserHF_inst_ATS_HistoryCT_SB_axioms parserHF_inst_ATS_HistoryCT_DB_axioms )\n done\n\nlemma parserHF_inst_AX_BF_BraSBRest_DetHSB_LaOp: \"\n \\M. valid_parser M \\\n ATS_determHIST_SB.is_forward_deterministicHist_SB\n parserHF_initial_configurations parserHF_step_relation\n parser_markers (@) (@) parserHF_conf_history\n parser_fixed_scheduler_extendable parserHF_conf_fixed M \\\n nonblockingness_language\n (ATS_Language0.unmarked_language parserHF_initial_configurations\n parserHF_step_relation parserHF_unmarked_effect M)\n (ATS_Language0.marked_language parserHF_initial_configurations\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect M) \\\n ATS_SchedF_SB.Nonblockingness_branching_restricted parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parser_fixed_scheduler_extendable parserHF_conf_fixed M\"\n apply(clarsimp)\n apply(rename_tac M)(*strict*)\n apply(simp add: parserHF.Nonblockingness_branching_restricted_def)\n apply(clarsimp)\n apply(rename_tac M dh n)(*strict*)\n apply(subgoal_tac \"\\e c. dh n= Some (pair e c)\")\n apply(rename_tac M dh n)(*strict*)\n prefer 2\n apply(rule_tac\n M=\"M\"\n in parserHF.some_position_has_details_before_max_dom)\n apply(rename_tac M dh n)(*strict*)\n apply (metis parserHF.derivation_initial_is_derivation)\n apply(rename_tac M dh n)(*strict*)\n apply(force)\n apply(rename_tac M dh n)(*strict*)\n apply(force)\n apply(rename_tac M dh n)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"parserHF_conf_history c \\ prefix_closure (parserHF.marked_language M)\")\n apply(rename_tac M dh n e c)(*strict*)\n prefer 2\n apply(simp add: nonblockingness_language_def)\n apply(rename_tac M dh n e c)(*strict*)\n apply(rule_tac\n A=\" parserHF.unmarked_language M\"\n in set_mp)\n apply(rename_tac M dh n e c)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c)(*strict*)\n apply(thin_tac \" parserHF.unmarked_language M \\ (prefix_closure (parserHF.marked_language M))\")\n apply(rename_tac M dh n e c)(*strict*)\n apply(simp add: parserHF.unmarked_language_def)\n apply(rule_tac\n x=\"dh\"\n in exI)\n apply(clarsimp)\n apply(simp add: parserHF.derivation_initial_def)\n apply(simp add: parserHF_unmarked_effect_def)\n apply(clarsimp)\n apply(force)\n apply(rename_tac M dh n e c)(*strict*)\n apply(thin_tac \"nonblockingness_language (parserHF.unmarked_language M) (parserHF.marked_language M)\")\n apply(rename_tac M dh n e c)(*strict*)\n apply(simp add: prefix_closure_def parserHF.marked_language_def prefix_def)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca)(*strict*)\n apply(simp add: parserHF_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n apply(subgoal_tac \"\\i e c. d i = Some (pair e c) \\ c \\ parserHF_marking_configurations M \\ (\\j e' c'. i < j \\ d j = Some (pair e' c') \\ parserHF_conf_history c = parserHF_conf_history c' )\")\n apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n prefer 2\n apply(simp add: parserHF_marking_condition_def)\n apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n apply(thin_tac \"parserHF_marking_condition M d\")\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(subgoal_tac \"dh 0 = d 0\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(simp add: parserHF.derivation_initial_def)\n apply(case_tac \"d 0\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc b)(*strict*)\n apply(case_tac \"dh 0\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc b a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc b a option ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc b ba)(*strict*)\n apply(simp add: parserHF_initial_configurations_def)\n (*\n what should dc be?\n ia \\ i \\ n : d@i ~ d@ia; d@ia ~~ dh@ia \\ dh@n ~ dh@ia; dc = []\n ia \\ n \\ i : d@i ~ d@ia; d@ia ~~ dh@ia \\ dh@n ~ dh@ia; dc = []\n n \\ ia \\ i : d@ia ~ d@ia \\ dc = d (n\\ia)\n i \\ ia \\ n : d@ia ~ dh@ia \\ dh@n ~ dh@ia; dc = []\n i \\ n \\ ia : d@n ~ dh@n; dc = d (n\\ia)\n n \\ i \\ ia : d@n ~ dh@n; dc = d (n\\ia)\n ia \\ n \\ dc = []\n n \\ ia \\ dc = d (n\\ia)\n*)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(case_tac \"ia\\n\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule_tac\n x=\"der1 c\"\n in exI)\n apply(rule_tac\n t=\"derivation_append dh (der1 c) n\"\n and s=\"dh\"\n in ssubst)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule ext)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(simp add: der1_def)\n apply(case_tac \"dh x\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n apply(rule_tac\n m=\"x\"\n and d=\"dh\"\n in parserHF.no_some_beyond_maximum_of_domain)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule parserHF.der1_is_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule parserHF.der1_belongs)\n apply(rule parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply (metis)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: parserHF_marking_condition_def)\n (*\n where does it accept continuously?\n ia \\ i \\ n : d@i ~ d@ia; d@ia ~~ dh@ia \\ d@ia=dh@ia; @ia @i\n ia \\ n \\ i : d@i ~ d@ia; d@ia ~~ dh@ia \\ dh@n ~ dh@ia; @ia\n i \\ ia \\ n : d@ia ~ dh@ia \\ dh@n ~ dh@ia; @ia\n *)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(rule_tac\n x=\"ia\"\n in exI)\n apply(subgoal_tac \"dh ia = d ia\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(subgoal_tac \"\\e c. dh ia = Some (pair e c)\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(rule parserHF.some_position_has_details_before_max_dom)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(erule exE)+\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"\\ca'. parserHF_conf_history c @ ca' = parserHF_conf_history cc\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(case_tac \"i\\ia\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"\\ca'. parserHF_conf_history cb @ ca' = parserHF_conf_history cc\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(rule_tac\n x=\"ca @ ca'\"\n in exI)\n apply(rule_tac\n t=\"parserHF_conf_history cc\"\n and s=\"parserHF_conf_history cb @ ca'\"\n in ssubst)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(rule_tac\n t=\"parserHF_conf_history cb\"\n and s=\"parserHF_conf_history c @ ca\"\n in ssubst)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp (no_asm))\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"\\h\\ parser_markers M. parserHF_conf_history cc = parserHF_conf_history cb @ h\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"i\"\n and m=\"ia-i\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: valid_bounded_parser_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(erule exE)+\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(rule_tac\n ?d1.0=\"dh\"\n and n=\"ia\"\n and m=\"ia\"\n and ?d2.0=\"d\"\n and x=\"0\"\n and y=\"0\"\n in parserHF.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\h\\ parser_markers M. parserHF_conf_history c = parserHF_conf_history cd @ h\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n and n=\"ia\"\n and m=\"n-ia\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rule parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(erule bexE)+\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(subgoal_tac \"cb \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(case_tac \"ia\\i\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(subgoal_tac \"parserHF_conf_history cc = parserHF_conf_history cb\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n prefer 2\n apply(case_tac \"iah\\ parser_markers M. parserHF_conf_history cc = parserHF_conf_history cb @ h\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"i\"\n and m=\"ia-i\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n apply(rule_tac\n x=\"h @ ca @ ha\"\n in bexI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n apply(simp add: parser_markers_def)\n apply(simp add: parserHF_configurations_def)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea ia eb cc ec \"cd\" h ha x f l)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(simp add: get_configuration_def)\n apply(fold parser_fixed_scheduler_extendable_def)\n apply(rule_tac\n ?d=\"dh\"\n in parserHF.fixed_scheduler_extendable_translates_backwards_lift)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply (metis parserHF.derivation_initial_is_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(subgoal_tac \"\\h\\ parser_markers M. parserHF_conf_history c = parserHF_conf_history cc @ h\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n and n=\"ia\"\n and m=\"n-ia\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(erule bexE)+\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(subgoal_tac \"h@ca=[]\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n prefer 2\n apply(case_tac \"ia\\i\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(case_tac \"iah\\ parser_markers M. parserHF_conf_history cc = parserHF_conf_history cb @ h\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"i\"\n and m=\"ia-i\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(erule_tac\n x=\"j\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"j\\n\")\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n in parserHF.allPreMaxDomSome_prime)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(subgoal_tac \"\\h\\ parser_markers M. parserHF_conf_history c = parserHF_conf_history c' @ h\")\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n and n=\"j\"\n and m=\"n-j\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rule parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(subgoal_tac \"\\h\\ parser_markers M. parserHF_conf_history c' = parserHF_conf_history cc @ h\")\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n and n=\"ia\"\n and m=\"j-ia\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: parserHF_marking_configurations_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(case_tac \"d j\")\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n apply(clarify)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' h ha)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a)(*strict*)\n apply(clarify)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha)(*strict*)\n apply(case_tac a)\n apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(subgoal_tac \"ia>n\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(thin_tac \"\\ ia \\ n\")\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"ia\"\n in parserHF.pre_some_position_is_some_position)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"cd \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"c \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dh\"\n in parserHF.belongs_configurations)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"d n = dh n\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(rule sym)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule_tac\n ?d1.0=\"dh\"\n and n=\"n\"\n and m=\"ia\"\n and ?d2.0=\"d\"\n and x=\"0\"\n and y=\"0\"\n in parserHF.is_forward_deterministicHist_derivations_coincide)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(case_tac \"d 0\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" a)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(case_tac \"dh 0\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" a)(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"ia parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"cc \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF_configurations_def parser_markers_def)\n apply(clarsimp)\n apply(rename_tac M dh n e d ca i ea ia eb ec x f fa fb fc h ha l la lb lc)(*strict*)\n apply(rule_tac\n A=\"set ca\"\n in set_mp)\n apply(rename_tac M dh n e d ca i ea ia eb ec x f fa fb fc h ha l la lb lc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e d ca i ea ia eb ec x f fa fb fc h ha l la lb lc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(subgoal_tac \"i\\ia\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\hf\\ parser_markers M. parserHF_conf_history cc = parserHF_conf_history cb @ hf\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"i\"\n and m=\"ia-i\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply(rule_tac\n x=\"ca@hf\"\n in bexI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply(subgoal_tac \"cb \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply(subgoal_tac \"cc \\ parserHF_configurations M\")\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply(simp add: parserHF_configurations_def parser_markers_def)\n apply(clarsimp)\n apply(rename_tac M dh n e d ca i ea ia eb ec hf x f fa fb fc h ha l la lb lc)(*strict*)\n apply(rule_tac\n A=\"set ca\"\n in set_mp)\n apply(rename_tac M dh n e d ca i ea ia eb ec hf x f fa fb fc h ha l la lb lc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e d ca i ea ia eb ec hf x f fa fb fc h ha l la lb lc)(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n apply (metis parserHF.belongs_configurations parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule_tac\n x=\"derivation_drop (derivation_take d ia) n\"\n in exI)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule_tac\n m=\"ia-n\"\n in parserHF.derivation_drop_preserves_derivation_prime)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_drop_preserves_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule parserHF.derivation_take_preserves_belongs)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(force)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule_tac\n x=\"ia-n\"\n in exI)\n apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule conjI)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: parserHF_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(rule_tac\n x=\"ia\"\n in exI)\n apply(rule_tac\n x=\"eb\"\n in exI)\n apply(rule_tac\n x=\"cc\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\" j e' c')(*strict*)\n apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n done\n\nlemma parserHF_inst_BF_BraSBRest_DetHSB_LaOp_axioms: \"\n BF_BraSBRest_DetHSB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_conf_fixed\"\n apply(simp add: BF_BraSBRest_DetHSB_LaOp_axioms_def)\n apply(rule parserHF_inst_AX_BF_BraSBRest_DetHSB_LaOp)\n done\n\nlemma parserHF_inst_BF_BraSBRest_DetHDB_LaOp_axioms: \"\n BF_BraSBRest_DetHDB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_get_fixed_scheduler_DB parserHF_conf_fixed\"\n apply(simp add: BF_BraSBRest_DetHDB_LaOp_axioms_def)\n apply(clarsimp)\n apply(rename_tac M)(*strict*)\n apply(subgoal_tac \"parserHF.is_forward_deterministicHist_SB M\")\n apply(rename_tac M)(*strict*)\n apply (metis parserHF_inst_AX_BF_BraSBRest_DetHSB_LaOp)\n apply(rename_tac M)(*strict*)\n apply(thin_tac \"nonblockingness_language (parserHF.unmarked_language M) (parserHF.marked_language M)\")\n apply(rename_tac M)(*strict*)\n apply (metis parserHF.is_forward_deterministic_correspond_DB_SB)\n done\n\nlemma parserHF_inst_BF_BraDBRest_DetHSB_LaOp_axioms: \"\n BF_BraDBRest_DetHSB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_conf_fixed parserHF_get_fixed_scheduler_DB\"\n apply(simp add: BF_BraDBRest_DetHSB_LaOp_axioms_def)\n apply(clarsimp)\n apply(rename_tac M)(*strict*)\n apply(rule_tac\n t=\"ATS_SchedF_DB.Nonblockingness_branching_restricted_DB\n parserHF_configurations parserHF_initial_configurations\n parser_step_labels parserHF_step_relation\n parserHF_marking_condition parser_fixed_scheduler_extendable\n parserHF_get_fixed_scheduler_DB M\"\n and s=\"parserHF.Nonblockingness_branching_restricted M\"\n in subst)\n apply(rename_tac M)(*strict*)\n apply(rule parserHF.Nonblockingness_branching_SB_DB_restricted)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(subgoal_tac \"BF_BraSBRest_DetHDB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_get_fixed_scheduler_DB parserHF_conf_fixed\")\n apply(rename_tac M)(*strict*)\n apply(simp add: BF_BraSBRest_DetHDB_LaOp_axioms_def)\n apply(erule_tac\n x=\"M\"\n in allE)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply (metis parserHF.is_forward_deterministic_correspond_DB_SB)\n apply(rename_tac M)(*strict*)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(rule parserHF_inst_BF_BraSBRest_DetHDB_LaOp_axioms)\n done\n\nlemma parserHF_inst_BF_BraDBRest_DetHDB_LaOp_axioms: \"\n BF_BraDBRest_DetHDB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_get_fixed_scheduler_DB\"\n apply(simp add: BF_BraDBRest_DetHDB_LaOp_axioms_def)\n apply(clarsimp)\n apply(rename_tac M)(*strict*)\n apply(subgoal_tac \"BF_BraDBRest_DetHSB_LaOp_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect parser_markers (@)\n (@) parserHF_conf_history parser_fixed_scheduler_extendable\n parserHF_conf_fixed parserHF_get_fixed_scheduler_DB\")\n apply(rename_tac M)(*strict*)\n apply(simp add: BF_BraDBRest_DetHSB_LaOp_axioms_def)\n apply(erule_tac\n x=\"M\"\n in allE)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply (metis parserHF.is_forward_deterministic_correspond_DB_SB)\n apply(rename_tac M)(*strict*)\n apply(erule impE)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(force)\n apply(rename_tac M)(*strict*)\n apply(rule parserHF_inst_BF_BraDBRest_DetHSB_LaOp_axioms)\n done\n\nlemma parserHF_inst_BF_Bra_OpLa_axioms: \"\n BF_Bra_OpLa_axioms valid_parser parserHF_configurations\n parserHF_initial_configurations parser_step_labels\n parserHF_step_relation parserHF_marking_condition\n parserHF_marked_effect parserHF_unmarked_effect\"\n apply(simp add: BF_Bra_OpLa_axioms_def)\n apply(clarsimp)\n apply(rename_tac M)(*strict*)\n apply(simp add: nonblockingness_language_def)\n apply(clarsimp)\n apply(rename_tac M xa)(*strict*)\n apply(simp add: prefix_closure_def prefix_def)\n apply(simp add: parserHF.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac M xa d)(*strict*)\n apply(simp add: parserHF.Nonblockingness_branching_def)\n apply(simp add: parserHF_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac M d i e c)(*strict*)\n apply(erule_tac\n x=\"derivation_take d i\"\n in allE)\n apply(erule impE)\n apply(rename_tac M d i e c)(*strict*)\n apply(rename_tac M d i e c)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac M d i e c)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule impE)\n apply(rename_tac M d i e c)(*strict*)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n apply(rename_tac M d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x)(*strict*)\n apply(simp add: parserHF_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule_tac\n x=\"parserHF_conf_history ca\"\n in exI)\n apply(rule conjI)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: parserHF.marked_language_def)\n apply(rule_tac\n x=\"derivation_append (derivation_take d i) dc i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_append_preserves_derivation_initial)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_append_preserves_derivation)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: derivation_take_def)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"dc 0\")\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac M d i e c dc x ia ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n apply(case_tac option)\n apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca option b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: parserHF_marked_effect_def)\n apply(rule_tac\n x=\"ia\"\n in exI)\n apply(rule_tac\n x=\"ea\"\n in exI)\n apply(rule_tac\n x=\"ca\"\n in exI)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(simp add: parserHF_marking_condition_def)\n apply(rule_tac\n x=\"ia\"\n in exI)\n apply(rule_tac\n x=\"ea\"\n in exI)\n apply(rule_tac\n x=\"ca\"\n in exI)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(case_tac \"iah\\ parser_markers M. parserHF_conf_history SSc' = parserHF_conf_history SSc @ h\" for SSc' SSc)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"derivation_append (derivation_take d i) dc i\"\n and n=\"i\"\n and m=\"ia-i\"\n in parserHF.steps_extend_history_derivation)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: parserHF.derivation_initial_def)\n apply(rule parserHF.derivation_append_preserves_derivation)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_take_preserves_derivation)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: derivation_take_def derivation_append_fit_def)\n apply(case_tac \"dc 0\")\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac M d i e c dc x ia ea ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n apply(case_tac option)\n apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca option b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def derivation_append_def derivation_take_def)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.belongs_configurations)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(rule parserHF.derivation_initial_belongs)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def derivation_take_def)\n apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n apply(force)\n done\n\ninterpretation \"parserHF\" : loc_autHF_10\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserHF_configurations\"\n (* initial_configurations *)\n \"parserHF_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserHF_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserHF_marking_condition\"\n (* marked_effect *)\n \"parserHF_marked_effect\"\n (* unmarked_effect *)\n \"parserHF_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserHF_get_destinations\"\n (* histories *)\n \"parser_markers\"\n (* history_fragments *)\n \"parser_markers\"\n (* empty_history *)\n \"parser_empty_history\"\n (* empty_history_fragment *)\n \"parser_empty_history_fragment\"\n (* set_history *)\n \"parserHF_set_history\"\n (* extend_history *)\n \"append\"\n (* join_history_fragments *)\n \"append\"\n (* get_history *)\n \"parserHF_conf_history\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* get_fixed_scheduler *)\n \"parserHF_conf_fixed\"\n (* get_fixed_scheduler_DB *)\n \"parserHF_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserHF_inst_AX_initial_configuration_belongs parserHF_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserHF_inst_ATS_axioms parserHF_inst_ATS_History_axioms parserHF_inst_ATS_SchedF_SB_axioms parserHF_inst_ATS_SchedF_DB_axioms parserHF_inst_ATS_SchedF_SDB_axioms parserHF_inst_ATS_determHIST_SB_axioms parserHF_inst_ATS_Language_by_Finite_Derivations_axioms parserHF_inst_ATS_HistoryCT_SB_axioms parserHF_inst_ATS_HistoryCT_DB_axioms parserHF_inst_BF_BraSBRest_DetHDB_LaOp_axioms parserHF_inst_BF_BraSBRest_DetHSB_LaOp_axioms parserHF_inst_BF_BraDBRest_DetHSB_LaOp_axioms parserHF_inst_BF_BraDBRest_DetHDB_LaOp_axioms parserHF_inst_BF_Bra_OpLa_axioms )\n done\n\nlemma parserHF_history_prefix_makes_prefix: \"\n w1 \\ parser_markers G\n \\ ATS_History.history_fragment_prefixes parser_markers (@) G w1 \\ ATS_History.history_fragment_prefixes parser_markers (@) G w2\n \\ w1 \\ w2\"\n apply(simp add: parserHF.history_fragment_prefixes_def)\n apply(simp add: prefix_def)\n apply(subgoal_tac \"w1 \\ {hf' \\ parser_markers G. \\hf''\\ parser_markers G. hf' @ hf'' = w1}\")\n prefer 2\n apply(clarsimp)\n apply(simp add: parser_markers_def)\n apply(subgoal_tac \"w1 \\ {hf' \\ parser_markers G. \\hf''\\ parser_markers G. hf' @ hf'' = w2}\")\n prefer 2\n apply(force)\n apply(thin_tac \"{hf' \\ parser_markers G. \\hf''\\ parser_markers G. hf' @ hf'' = w1} \\ {hf' \\ parser_markers G. \\hf''\\ parser_markers G. hf' @ hf'' = w2}\")\n apply(thin_tac \"w1 \\ {hf' \\ parser_markers G. \\hf''\\ parser_markers G. hf' @ hf'' = w1}\")\n apply(force)\n done\n\nlemma parserHF_history_prefix_makes_prefix_mutual: \"\n w1 \\ parser_markers G\n \\ w2 \\ parser_markers G\n \\ ATS_History.history_fragment_prefixes parser_markers (@) G w1 \\ ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\ ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\ ATS_History.history_fragment_prefixes parser_markers (@) G w1\n \\ prefix w1 w2 \\ prefix w2 w1\"\n apply(erule disjE)\n apply(rule disjI1)\n apply(rule parserHF_history_prefix_makes_prefix)\n apply(force)\n apply(force)\n apply(rule disjI2)\n apply(rule parserHF_history_prefix_makes_prefix)\n apply(force)\n apply(force)\n done\n\nlemma parserHF_is_forward_target_deterministicHist_DB_long: \"\n valid_parser G\n \\ parserHF.is_forward_target_deterministicHist_DB_long G\"\n apply(simp add: parserHF.is_forward_target_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(simp add: parserHF_step_relation_def)\n apply(clarsimp)\n done\n\nlemmas parserHF_interpretations =\n parser_interpretations\n parserHF_inst_AX_initial_configuration_belongs\n parserHF_inst_AX_step_relation_preserves_belongs\n parserHF_inst_ATS_axioms\n parserHF_inst_ATS_History_axioms\n parserHF_inst_ATS_SchedF_SB_axioms\n parserHF_inst_ATS_SchedF_DB_axioms\n parserHF_inst_ATS_SchedF_SDB_axioms\n parserHF_inst_ATS_determHIST_SB_axioms\n parserHF_inst_ATS_Language_by_Finite_Derivations_axioms\n parserHF_inst_ATS_HistoryCT_SB_axioms\n parserHF_inst_ATS_HistoryCT_DB_axioms\n parserHF_inst_BF_BraSBRest_DetHDB_LaOp_axioms\n parserHF_inst_BF_BraSBRest_DetHSB_LaOp_axioms\n parserHF_inst_BF_BraDBRest_DetHSB_LaOp_axioms\n parserHF_inst_BF_BraDBRest_DetHDB_LaOp_axioms\n parserHF_inst_BF_Bra_OpLa_axioms\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_08/I_kparser_HF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2845368391064484}} {"text": "theory BeispielZahlenweltGesetz\nimports BeispielZahlenwelt Simulation Gesetze AllgemeinesGesetz\nbegin\n\nsection\\Beispiel: BeispielZahlenwelt aber mit Gesetz (Experimental)\\\n\n (*<*)\n fun delta_zahlenwelt :: \\(zahlenwelt, person, int) delta\\ where\n \\delta_zahlenwelt (Handlung (Zahlenwelt vor_besitz) (Zahlenwelt nach_besitz)) =\n Aenderung.delta_num_fun (Handlung vor_besitz nach_besitz)\\\n (*>*)\n\nsubsection\\Setup\\\n text\\Wir nehmen an unsere handelnde Person ist \\<^const>\\Alice\\.\\\n \n definition \\beispiel_case_law_absolut maxime handlungsabsicht \\\n simulateOne\n (SimConsts\n Alice\n maxime\n (printable_case_law_ableiten_absolut show_zahlenwelt))\n 5 handlungsabsicht initialwelt (Gesetz {})\\\n definition \\beispiel_case_law_relativ maxime handlungsabsicht \\\n simulateOne\n (SimConsts\n Alice\n maxime\n (case_law_ableiten_relativ delta_zahlenwelt))\n 10 handlungsabsicht initialwelt (Gesetz {})\\\n\n\nsubsection\\Beispiele\\\n text\\Alice kann beliebig oft 5 Wohlstand für sich selbst erschaffen.\n Das entstehende Gesetz ist nicht sehr gut, da es einfach jedes Mal einen\n Snapshot der Welt aufschreibt und nicht sehr generisch ist.\\\n (*check: ist auch eine moralische Handlung*)\n lemma \\beispiel_case_law_absolut maxime_zahlenfortschritt (Handlungsabsicht (erschaffen 5))\n =\n Gesetz\n {(\\
5,\n Rechtsnorm\n (Tatbestand ([(Alice, 25), (Bob, 10), (Carol, - 3)], [(Alice, 30), (Bob, 10), (Carol, - 3)]))\n (Rechtsfolge Erlaubnis)),\n (\\
4,\n Rechtsnorm\n (Tatbestand ([(Alice, 20), (Bob, 10), (Carol, - 3)], [(Alice, 25), (Bob, 10), (Carol, - 3)]))\n (Rechtsfolge Erlaubnis)),\n (\\
3,\n Rechtsnorm\n (Tatbestand ([(Alice, 15), (Bob, 10), (Carol, - 3)], [(Alice, 20), (Bob, 10), (Carol, - 3)]))\n (Rechtsfolge Erlaubnis)),\n (\\
2,\n Rechtsnorm\n (Tatbestand ([(Alice, 10), (Bob, 10), (Carol, - 3)], [(Alice, 15), (Bob, 10), (Carol, - 3)]))\n (Rechtsfolge Erlaubnis)),\n (\\
1,\n Rechtsnorm\n (Tatbestand ([(Alice, 5), (Bob, 10), (Carol, - 3)], [(Alice, 10), (Bob, 10), (Carol, - 3)]))\n (Rechtsfolge Erlaubnis))}\n \\ by eval\n \n \n text\\Die gleiche Handlung, wir schreiben aber nur die Änderung der Welt ins Gesetz:\\\n lemma \\beispiel_case_law_relativ maxime_zahlenfortschritt (Handlungsabsicht (erschaffen 5)) =\n Gesetz\n {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5]) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n (*TODO: Beispiele mit der guten maxime!*)\n lemma \\beispiel_case_law_relativ\n (Maxime (\\(ich::person) h. (\\pX. individueller_fortschritt pX h))) (Handlungsabsicht (erschaffen 5)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5]) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n\n\n text\\Nun ist es \\<^const>\\Alice\\ verboten Wohlstand für sich selbst zu erzeugen.\\\n (*check: ist auch keine moralische Handlung*)\n lemma \\beispiel_case_law_relativ\n (Maxime (\\ich. individueller_strikter_fortschritt ich))\n (Handlungsabsicht (erschaffen 5)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5]) (Rechtsfolge Verbot))}\\\n by eval\n\n\n\n (*check: ist auch eine moralische Handlung*)\n lemma \\beispiel_case_law_relativ\n (Maxime (\\ich. globaler_strikter_fortschritt))\n (Handlungsabsicht (erschaffen 5)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5]) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n \n\n (*check: ist auch keine moralische Handlung*)\n lemma \\beispiel_case_law_relativ\n (Maxime (\\ich. globaler_strikter_fortschritt))\n (Handlungsabsicht (erschaffen 0)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand []) (Rechtsfolge Verbot))}\\\n by eval\n\n\n (*check: ist auch keine moralische Handlung*)\n lemma \\beispiel_case_law_relativ\n maxime_zahlenfortschritt\n (Handlungsabsicht (erschaffen 0)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand []) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n (*check: ist auch eine moralische Handlung*)\n lemma\\beispiel_case_law_relativ\n (Maxime (\\ich. globaler_fortschritt))\n (Handlungsabsicht (erschaffen 0))\n =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand []) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n \n\n (*check: ist auch eine moralische Handlung*)\n lemma\\beispiel_case_law_relativ\n (Maxime (\\ich. globaler_fortschritt))\n (Handlungsabsicht (stehlen_nichtwf 5 Bob))\n =\n Gesetz\n {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5, Verliert Bob 5]) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n\n\n\n text\\Stehlen ist verboten:\\\n (*check: ist auch keine moralische Handlung*)\n lemma \\beispiel_case_law_relativ maxime_zahlenfortschritt (Handlungsabsicht (stehlen_nichtwf 5 Bob)) =\n Gesetz\n {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5, Verliert Bob 5]) (Rechtsfolge Verbot))}\\\n by eval\n\n\n\n text\\Auch wenn \\<^const>\\Alice\\ von sich selbst stehlen möchte ist dies verboten,\n obwohl hier keiner etwas verliert:\\\n (*check: ist auch keine moralische Handlung*)\n lemma \\beispiel_case_law_relativ maxime_zahlenfortschritt (Handlungsabsicht (stehlen_nichtwf 5 Alice)) =\n Gesetz {(\\
1, Rechtsnorm (Tatbestand []) (Rechtsfolge Verbot))}\\\n by eval\n\n\n text\\Der Grund ist, dass \\<^const>\\Alice\\ die abstrakte Handlung \"Alice wird bestohlen\" gar nicht gut\n fände, wenn sie jemand anderes ausführt:\\\n(*\n lemma \\debug_maxime show_zahlenwelt initialwelt\n maxime_zahlenfortschritt (Handlungsabsicht (stehlen_nichtwf 5 Alice)) =\n {VerletzteMaxime (Opfer Alice) (Taeter Bob)\n (Handlung [(Alice, 5), (Bob, 10), (Carol, - 3)] [(Bob, 15), (Carol, - 3)]),\n VerletzteMaxime (Opfer Alice) (Taeter Carol)\n (Handlung [(Alice, 5), (Bob, 10), (Carol, - 3)] [(Bob, 10), (Carol, 2)]),\n VerletzteMaxime (Opfer Alice) (Taeter Eve)\n (Handlung [(Alice, 5), (Bob, 10), (Carol, - 3)] [(Bob, 10), (Carol, - 3), (Eve, 5)])\n }\\\n by eval\n*) \n text\\Leider ist das hier abgeleitete Gesetz sehr fragwürdig:\n \\<^term>\\Rechtsnorm (Tatbestand []) (Rechtsfolge Verbot)\\\n \n Es besagt, dass Nichtstun verboten ist.\\\n\n text\\Indem wir die beiden Handlungen Nichtstun und Selbstbestehlen betrachten,\n können wir sogar ein widersprüchliches Gesetz ableiten:\\\n lemma \\simulateOne\n (SimConsts\n Alice\n maxime_zahlenfortschritt\n (case_law_ableiten_relativ delta_zahlenwelt))\n 20 (Handlungsabsicht (stehlen_nichtwf 5 Alice)) initialwelt\n (beispiel_case_law_relativ maxime_zahlenfortschritt (Handlungsabsicht (erschaffen 0)))\n =\n Gesetz\n {(\\
2, Rechtsnorm (Tatbestand []) (Rechtsfolge Verbot)),\n (\\
1, Rechtsnorm (Tatbestand []) (Rechtsfolge Erlaubnis))}\\\n by eval\n\n text\\Meine persönliche Conclusion: Wir müssen irgendwie die Absicht mit ins Gesetz schreiben.\\\n\n\n\n text\\Es ist \\<^const>\\Alice\\ verboten, etwas zu verschenken:\\\n (*Check*)\n lemma\\beispiel_case_law_relativ maxime_zahlenfortschritt (Handlungsabsicht (schenken 5 Bob))\n =\n Gesetz\n {(\\
1,\n Rechtsnorm (Tatbestand [Verliert Alice 5, Gewinnt Bob 5]) (Rechtsfolge Verbot))}\\\n by eval\n text\\Der Grund ist, dass \\<^const>\\Alice\\ dabei etwas verliert und\n die \\<^const>\\maxime_zahlenfortschritt\\ dies nicht Erlaubt.\n Es fehlt eine Möglichkeit zu modellieren, dass \\<^const>\\Alice\\ damit einverstanden ist,\n etwas abzugeben.\n Doch wir haben bereits in @{thm stehlen_ist_schenken} gesehen,\n dass \\<^const>\\stehlen\\ und \\<^const>\\schenken\\ nicht unterscheidbar sind.\\\n\n(*TODO: gesetz ableiten aendern, so dass allgemeines gesetz ableiten eine\nhandlungsabsicht anstatt einer handlung nimmt.\nEvtl in neue Datei, damit sich dieses Beipsiel noch gut liesst.*)\n\n\n text\\Folgende ungültige Maxime würde es erlauben, dass \\<^const>\\Alice\\ Leute bestehlen darf:\\\n lemma\\beispiel_case_law_relativ\n (Maxime (\\ich. individueller_fortschritt Alice))\n (Handlungsabsicht (stehlen_nichtwf 5 Bob))\n =\n Gesetz\n {(\\
1, Rechtsnorm (Tatbestand [Gewinnt Alice 5, Verliert Bob 5]) (Rechtsfolge Erlaubnis))}\\\n by eval\nend", "meta": {"author": "diekmann", "repo": "kant", "sha": "fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902", "save_path": "github-repos/isabelle/diekmann-kant", "path": "github-repos/isabelle/diekmann-kant/kant-fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902/Formal/BeispielZahlenweltGesetz.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.284249300964024}} {"text": "theory Traceback_Properties\nimports Safety_Properties\nbegin\n\n\nsection \\Traceback properties\\\n\ntext \\In this section, we prove various traceback properties,\nby essentially giving trace-based justifications of certain\noccurring situations that are relevant for access to information:\n%\n\\begin{description}\n\\item{\\bf Being an author. }\nIf a user is an author of a paper, then either the user has registered the paper in the first\nplace or, inductively, has been appointed as coauthor by another author.\n%\n\\item{\\bf Being a chair. }\nIf a user is a chair of a conference, then either that user has registered the conference\nwhich has been approved by the superuser or, inductively, that user has been appointed\nby an existing chair of that conference.\n%\n%\n\\item{\\bf Being a PC member. }\nIf a user is a PC member in a conference, then the user either must have been the original chair or must\nhave been appointed by a chair.\n%\n\\item{\\bf Being a reviewer. }\nIf a user is a paper's reviewer, then the user must have been appointed by a chair (from\namong the PC members who have not declared a conflict with the paper).\n%\n\\item{\\bf Having conflict. }\nIf a user has conflict with a paper, then the user is either an author of the paper or the\nconflict has been declared by that user or by a paper's author, in such a way that between\nthe moment when the conflict has been last declared and the current moment there is no\ntransition that successfully removes the conflict.\n%\n\\item{\\bf Conference reaching a phase. }\nIf a conference is in a given phase different from ``no phase'', then this has happened as\na consequence of either a conference approval action by the superuser (if the phase is\nSetup) or a phase change action by a chair (otherwise).\n\\end{description}\n\nMore details and explanations can be found in \\<^cite>\\\\Section 3.6\\ in \"cocon-JAR2021\"\\.\n\\\n\n\nsubsection \\Preliminaries\\\n\ninductive trace_between :: \"state \\ (state,act,out) trans trace \\ state \\ bool\" where\n empty[simp]: \"trace_between s [] s\"\n| step: \"\\trace_between s tr sh; step sh a = (ou,s')\\ \\ trace_between s (tr@[Trans sh a ou s']) s'\"\n\ninductive_simps\n trace_ft_empty[simp]: \"trace_between s [] s'\" and\n trace_ft_snoc: \"trace_between s (tr@[trn]) s'\"\nthm trace_ft_empty trace_ft_snoc\n\nlemma trace_ft_append: \"trace_between s (tr1@tr2) s'\n \\ (\\sh. trace_between s tr1 sh \\ trace_between sh tr2 s')\"\n apply (induction tr2 arbitrary: s' rule: rev_induct)\n apply simp\n apply (subst append_assoc[symmetric], subst trace_ft_snoc)\n apply (auto simp: trace_ft_snoc)\n done\n\nlemma trace_ft_Cons: \"trace_between s (trn#tr) s'\n \\ (\\sh ou a. trn = Trans s a ou sh \\ step s a = (ou,sh) \\ trace_between sh tr s')\"\n apply (subst trace_ft_append[where ?tr1.0 = \"[trn]\", simplified])\n apply (subst trace_ft_snoc[where tr = \"[]\", simplified])\n by auto\n\nlemmas trace_ft_simps = trace_ft_empty trace_ft_snoc trace_ft_Cons trace_ft_append\n\ninductive trace_to :: \" (state,act,out) trans trace \\ state \\ bool\" where\n empty: \"trace_to [] istate\"\n| step: \"\\trace_to tr s; step s a = (ou,s')\\ \\ trace_to (tr@[Trans s a ou s']) s'\"\n\nlemma trace_to_ft: \"trace_to tr s \\ trace_between istate tr s\"\nproof (rule,goal_cases)\n case 1 thus ?case\n by induction (auto intro: trace_between.intros)\nnext\n case 2\n moreover\n {fix s' assume \"trace_between s' tr s\" hence \"s' = istate \\ trace_to tr s\"\n by induction (auto intro: trace_to.intros)\n }\n ultimately show ?case by auto\nqed\n\ninductive_simps trace_to_empty[simp]: \"trace_to [] s\"\n\nlemma trace_to_reach: assumes \"trace_to tr s\" shows \"reach s\"\n using assms apply induction\n apply (rule reach.intros)\n by (metis reach_step snd_conv)\n\nlemma reach_to_trace: assumes \"reach s\" obtains tr where \"trace_to tr s\"\n using assms apply (induction rule: reach_step_induct)\n apply (auto intro: trace_to.intros) []\n by (metis surjective_pairing trace_to.step)\n\nlemma reach_trace_to_conv: \"reach s \\ (\\tr. trace_to tr s)\"\n by (blast intro: trace_to_reach elim: reach_to_trace)\n\nthm trace_to.induct[no_vars]\n\nlemma trace_to_induct[case_names empty step, induct set]:\n \"\\trace_to x1 x2; P [] istate;\n \\tr s a ou s'.\n \\trace_to tr s; P tr s; reach s; reach s'; step s a = (ou, s')\\\n \\ P (tr ## Trans s a ou s') s'\\\n \\ P x1 x2\"\n apply (erule trace_to.induct)\n apply simp\n apply (frule trace_to_reach)\n using reach_PairI by blast\n\n\n\nsubsection \\Authorship\\\n\ntext \\\n Only the creator of a paper, and users explicitly added by other authors,\n are authors of a paper.\n\\\n\ninductive isAut' :: \"(state,act,out) trans trace \\ confID \\ userID \\ paperID \\ bool\" where\n creator: \"\\ trn = Trans _ (Cact (cPaper cid uid _ pid _ _)) outOK _ \\\n \\ isAut' (tr@[trn]) cid uid pid\"\n (* \"The creator of a paper is an author\" *)\n| co_author: \"\\\n isAut' tr cid uid' pid;\n trn = Trans _ (Cact (cAuthor cid uid' _ pid uid)) outOK _ \\\n \\ isAut' (tr@[trn]) cid uid pid\"\n (* \"An author can add any other user as a coauthor\" *)\n| irrelevant: \"isAut' tr cid uid' pid \\ isAut' (tr@[_]) cid uid' pid\"\n\nlemma justify_author:\n assumes \"trace_to tr s\"\n assumes \"isAut s cid uid pid\"\n shows \"isAut' tr cid uid pid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def)\nnext\n case (step tr s a ou s')\n show ?case\n proof (cases \"isAut s cid uid pid\")\n case True with step.IH show ?thesis by (blast intro: isAut'.intros)\n next\n case False\n with step.hyps step.prems obtain\n pass s1 s2 uid' where\n \"a=Cact (cPaper cid uid pass pid s1 s2)\n \\ (a=Cact (cAuthor cid uid' pass pid uid) \\ isAut s cid uid' pid)\"\n and [simp]: \"ou=outOK\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp add: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp add: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp add: uu_defs) [] .\n by simp_all\n thus ?thesis using step.IH\n apply (elim disjE)\n apply (rule isAut'.creator, auto) []\n apply (rule isAut'.co_author, auto) []\n done\n qed\nqed\n\n\nlemma author_justify:\n assumes \"trace_to tr s\"\n assumes \"isAut' tr cid uid pid\"\n shows \"isAut s cid uid pid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def elim: isAut'.cases)\nnext\n case (step tr s a ou s')\n from step.prems\n show ?case\n proof (cases)\n case (creator _ _ pass s1 s2)\n hence [simp]: \"a=Cact (cPaper cid uid pass pid s1 s2)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs)\n next\n case (co_author _ uid' _ _ pass)\n hence [simp]: \"a=Cact (cAuthor cid uid' pass pid uid)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs)\n next\n case (irrelevant) with step.IH have AUT: \"isAut s cid uid pid\" by simp\n\n note roles_confIDs[OF \\reach s\\ AUT]\n with AUT \\step s a = (ou, s')\\ show ?thesis\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n qed\nqed\n\ntheorem isAut_eq: \"trace_to tr s \\ isAut s cid uid pid \\ isAut' tr cid uid pid\"\n (* \"Trace-based equivalent of authorship\" *)\n using justify_author author_justify\n by (blast)\n\n\nsubsection \\Becoming a Conference Chair\\\n\ninductive isChair' :: \"(state,act,out) trans trace \\ confID \\ userID \\ bool\" where\n creator: \"\\ trn=Trans _ (Cact (cConf cid uid _ _ _)) outOK _ \\\n \\ isChair' (tr@[trn]) cid uid\"\n| add_chair: \"\\ isChair' tr cid uid'; trn = Trans _ (Cact (cChair cid uid' _ uid)) outOK _ \\\n \\ isChair' (tr@[trn]) cid uid\"\n| irrelevant: \"\\isChair' tr cid uid\\ \\ isChair' (tr@[_]) cid uid\"\n\nlemma justify_chair:\n assumes \"trace_to tr s\"\n assumes \"isChair s cid uid\"\n shows \"isChair' tr cid uid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def)\nnext\n case (step tr s a ou s')\n show ?case\n proof (cases \"isChair s cid uid\")\n case True with step.IH show ?thesis by (blast intro: isChair'.intros)\n next\n case False\n term cConf\n with step.hyps step.prems obtain\n pass s1 s2 uid' where\n \"a=Cact (cConf cid uid pass s1 s2)\n \\ (a=Cact (cChair cid uid' pass uid) \\ isChair s cid uid')\"\n and [simp]: \"ou=outOK\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp add: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp add: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp add: uu_defs) [] .\n by simp_all\n thus ?thesis using step.IH\n apply (elim disjE)\n apply (rule isChair'.creator, auto) []\n apply (rule isChair'.add_chair, auto) []\n done\n qed\nqed\n\nlemma chair_justify:\n assumes \"trace_to tr s\"\n assumes \"isChair' tr cid uid\"\n shows \"isChair s cid uid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def elim: isChair'.cases)\nnext\n case (step tr s a ou s')\n from step.prems\n show ?case\n proof (cases)\n case (creator _ _ pass s1 s2)\n hence [simp]: \"a=Cact (cConf cid uid pass s1 s2)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs)\n next\n case (add_chair _ uid' _ _ pass)\n hence [simp]: \"a=Cact (cChair cid uid' pass uid)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs)\n next\n case (irrelevant) with step.IH have CH: \"isChair s cid uid\" by simp\n\n from CH \\step s a = (ou, s')\\ show ?thesis\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n qed\nqed\n\ntheorem isChair_eq: \"trace_to tr s \\ isChair s cid uid = isChair' tr cid uid\"\n (* \"Trace-based equivalent of being a chair\" *)\n using justify_chair chair_justify\n by (blast)\n\n\nsubsection \\Committee Membership\\\n\ninductive isPC' :: \"(state,act,out) trans trace \\ confID \\ userID \\ bool\" where\n chair: \"isChair' tr cid uid \\ isPC' tr cid uid\"\n| add_com: \"\\ isChair' tr cid uid'; trn = Trans _ (Cact (cPC cid uid' _ uid)) outOK _ \\\n \\ isPC' (tr@[trn]) cid uid\"\n| irrelevant: \"\\isPC' tr cid uid\\ \\ isPC' (tr@[_]) cid uid\"\n\nlemma justify_com:\n assumes \"trace_to tr s\"\n assumes \"isPC s cid uid\"\n shows \"isPC' tr cid uid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def)\nnext\n case (step tr s a ou s')\n\n show ?case\n proof (cases \"isPC s cid uid\")\n case True with step.IH show ?thesis by (blast intro: isPC'.irrelevant)\n next\n case False note noPC = this\n show ?thesis proof (cases \"isChair s' cid uid\")\n case True thus ?thesis\n by (metis chair justify_chair step.hyps(1) step.hyps(4) trace_to.step)\n next\n case False note noChair=this\n from noPC noChair step.hyps step.prems obtain\n pass uid' where \"(a=Cact (cPC cid uid' pass uid))\"\n and \"isChair s cid uid'\"\n and [simp]: \"ou=outOK\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp add: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp add: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp add: uu_defs) [] .\n by simp_all\n thus ?thesis\n apply -\n apply (rule isPC'.add_com, auto simp: isChair_eq[OF \\trace_to tr s\\]) []\n done\n qed\n qed\nqed\n\nlemma com_justify:\n assumes \"trace_to tr s\"\n assumes \"isPC' tr cid uid\"\n shows \"isPC s cid uid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def elim!: isPC'.cases isChair'.cases)\nnext\n case (step tr s a ou s')\n from step.prems\n show ?case\n proof (cases)\n case chair thus ?thesis\n by (metis isChair_eq isChair_isPC step.hyps(1) step.hyps(3) step.hyps(4) trace_to.step)\n next\n case (add_com _ uid' _ _ pass)\n hence [simp]: \"a=Cact (cPC cid uid' pass uid)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs)\n next\n case (irrelevant) with step.IH have COM: \"isPC s cid uid\" by simp\n\n from COM \\step s a = (ou, s')\\ show ?thesis\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n qed\nqed\n\ntheorem isPC_eq: \"trace_to tr s \\ isPC s cid uid = isPC' tr cid uid\"\n (* \"Trace-based equivalent of committee membership\" *)\n using justify_com com_justify\n by (blast)\n\n\nsubsection \\Being a Reviewer\\\n\ninductive isRev' :: \"(state,act,out) trans trace \\ confID \\ userID \\ paperID \\ bool\" where\n add_rev: \"\\ isChair' tr cid uid'; trn = Trans _ (Cact (cReview cid uid' _ pid uid)) outOK _ \\\n \\ isRev' (tr@[trn]) cid uid pid\"\n| irrelevant: \"\\isRev' tr cid uid pid\\ \\ isRev' (tr@[_]) cid uid pid\"\n\nlemma justify_rev:\n assumes \"trace_to tr s\"\n assumes \"isRev s cid uid pid\"\n shows \"isRev' tr cid uid pid\"\n using assms\nproof (induction)\n case empty thus ?case\n by (auto simp add: istate_def isRev_def)\nnext\n case (step tr s a ou s')\n\n show ?case\n proof (cases \"isRev s cid uid pid\")\n case True with step.IH show ?thesis by (blast intro: isRev'.irrelevant)\n next\n case False note noRev = this\n with step.hyps step.prems obtain\n pass uid' where \"(a=Cact (cReview cid uid' pass pid uid))\"\n and \"isChair s cid uid'\"\n and [simp]: \"ou=outOK\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp add: c_defs isRev_def) [] .\n subgoal for x2 apply (cases x2, auto simp add: u_defs isRev_def) [] .\n subgoal for x3 apply (cases x3, auto simp add: uu_defs isRev_def) [] .\n by simp_all\n thus ?thesis\n apply -\n apply (rule isRev'.add_rev, auto simp: isChair_eq[OF \\trace_to tr s\\]) []\n done\n qed\nqed\n\nlemma rev_justify:\n assumes \"trace_to tr s\"\n assumes \"isRev' tr cid uid pid\"\n shows \"isRev s cid uid pid\"\n using assms\nproof (induction arbitrary: uid)\n case (empty s) thus ?case\n by (auto simp add: istate_def elim!: isRev'.cases)\nnext\n case (step tr s a ou s')\n from step.prems\n show ?case\n proof (cases)\n case (add_rev _ uid' _ _ pass)\n hence [simp]: \"a=Cact (cReview cid uid' pass pid uid)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: c_defs isRev_def)\n next\n case (irrelevant) with step.IH have REV: \"isRev s cid uid pid\" by simp\n\n note roles_confIDs[OF step.hyps(2)]\n with REV \\step s a = (ou, s')\\ show ?thesis\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs isRev_def) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs isRev_def) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs isRev_def) [] .\n by simp_all\n qed\nqed\n\ntheorem isRev_eq: \"trace_to tr s \\ isRev s cid uid pid = isRev' tr cid uid pid\"\n (* \"Trace-based equivalent of being a reviewer\" *)\n using justify_rev rev_justify\n by (blast)\n\n\n\nsubsection \"Conflicts\"\n\nfun irrev_conflict :: \"userID \\ paperID \\ (state,act,out) trans \\ bool\"\n (* \"Transitions causing irrevokable conflicts\" *)\nwhere\n \"irrev_conflict uid pid (Trans _ (Cact (cPaper _ uid' _ pid' _ _)) outOK _)\n \\ uid'=uid \\ pid'=pid\"\n| \"irrev_conflict uid pid (Trans _ (Cact (cAuthor _ _ _ pid' uid')) outOK _)\n \\ uid'=uid \\ pid'=pid\"\n| \"irrev_conflict uid pid _ \\ False\"\n\nfun set_conflict :: \"userID \\ paperID \\ (state,act,out) trans \\ bool\"\n (* \"Transitions setting conflict state, can be revoked by later reset-actions\" *)\n where\n \"set_conflict uid pid (Trans _ (Cact (cConflict _ _ _ pid' uid')) outOK _)\n \\ uid'=uid \\ pid'=pid\"\n| \"set_conflict uid pid (Trans _ (Uact (uPref _ uid' _ pid' Conflict)) outOK _)\n \\ uid'=uid \\ pid'=pid\"\n| \"set_conflict _ _ _ \\ False\"\n\nfun reset_conflict :: \"userID \\ paperID \\ (state,act,out)trans \\ bool\"\n (* \"Transitions re-setting conflict state, can be revoked by later set-actions\" *)\n where\n \"reset_conflict uid pid (Trans _ (Uact (uPref _ uid' _ pid' pr)) outOK _)\n \\ uid'=uid \\ pid'=pid \\ pr\\Conflict\"\n| \"reset_conflict _ _ _ \\ False\"\n\ndefinition conflict_trace :: \"userID \\ paperID \\ (state,act,out) trans trace \\ bool\"\n (* \"Trace that causes a conflict: It contains either an irrevokable conflict action,\n or the last action concerning conflicts was set-conflict\" *)\n where\n \"conflict_trace uid pid tr \\\n (\\trn\\set tr. irrev_conflict uid pid trn)\n\\ (\\tr1 trn tr2. tr=tr1@trn#tr2 \\\n set_conflict uid pid trn \\ (\\trn\\set tr2. \\reset_conflict uid pid trn))\"\n\nlemma irrev_conflict_impl_author:\n assumes \"trace_to tr s\"\n assumes \"\\trn\\set tr. irrev_conflict uid pid trn\"\n shows \"\\cid. isAut s cid uid pid\"\n using assms\n apply induction\n apply (auto simp add: istate_def) []\n subgoal for _ _ a apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs, (metis roles_confIDs)+) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n done\n\nlemma irrev_conflict_impl_conflict:\n assumes \"trace_to tr s\"\n assumes \"\\trn\\set tr. irrev_conflict uid pid trn\"\n shows \"pref s uid pid = Conflict\"\n by (metis assms(1) assms(2) irrev_conflict_impl_author\n isAut_pref_Conflict reach_trace_to_conv)\n\nlemma conflict_justify:\n assumes TR: \"trace_to tr s\"\n assumes \"conflict_trace uid pid tr\"\n shows \"pref s uid pid = Conflict\"\n using assms(2)\n unfolding conflict_trace_def\nproof (cases rule: disjE[consumes 1, case_names irrev set])\n case irrev thus ?thesis by (simp add: irrev_conflict_impl_conflict[OF TR])\nnext\n case set\n then obtain tr1 trn tr2 where\n [simp]: \"tr = tr1 @ trn # tr2\" and\n SET: \"set_conflict uid pid trn\"\n and NRESET: \"\\trn\\set tr2. \\ reset_conflict uid pid trn\"\n by blast\n\n from TR obtain s1 s2 a ou where\n [simp]: \"trn = Trans s1 a ou s2\" and\n TR1: \"trace_to tr1 s1\" and\n STEP: \"step s1 a = (ou,s2)\" and\n TR2: \"trace_between s2 tr2 s\"\n by (fastforce simp add: trace_to_ft trace_ft_simps)\n\n from STEP SET have \"pref s2 uid pid = Conflict\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) []\n subgoal for _ x65 apply (cases x65, auto) [] .\n subgoal for _ _ _ x65 apply (cases x65, auto) [] .\n subgoal for _ _ _ x65 apply (cases x65, auto) [] . .\n by simp_all\n\n with TR2 NRESET show ?thesis\n apply induction\n subgoal by simp\n subgoal for _ _ _ a apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n done\nqed\n\nlemma justify_conflict:\n assumes TR: \"trace_to tr s\"\n assumes \"pref s uid pid = Conflict\"\n shows \"conflict_trace uid pid tr\"\n using assms\nproof induction\n case empty thus ?case by (auto simp add: istate_def)\nnext\n case (step tr s a ou s')\n\n let ?trn = \"Trans s a ou s'\"\n\n show ?case proof (cases \"pref s uid pid = Conflict\")\n case False\n with step.prems \\step s a = (ou, s')\\\n have \"irrev_conflict uid pid ?trn \\ set_conflict uid pid ?trn\"\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n thus ?thesis\n unfolding conflict_trace_def by fastforce\n next\n case True with step.IH have CT: \"conflict_trace uid pid tr\" .\n\n from step.prems \\step s a = (ou, s')\\ have \"\\reset_conflict uid pid ?trn\"\n apply (cases a)\n subgoal by simp\n subgoal for x2 by (cases x2, auto simp: u_defs)\n by simp_all\n\n thus ?thesis using CT\n unfolding conflict_trace_def\n apply clarsimp\n by (metis rotate1.simps(2) set_ConsD set_rotate1)\n\n qed\nqed\n\ntheorem conflict_eq:\n assumes \"trace_to tr s\"\n shows \"pref s uid pid = Conflict \\ conflict_trace uid pid tr\"\n using assms conflict_justify justify_conflict by auto\n\n\nsubsection \\Conference Phases\\\n\nfun is_uPhase where\n \"is_uPhase cid (Trans _ (Uact (uConfA cid' _ _)) outOK _) \\ cid'=cid\"\n| \"is_uPhase cid (Trans _ (Uact (uPhase cid' _ _ _)) outOK _) \\ cid'=cid\"\n| \"is_uPhase _ _ \\ False\"\n\ninductive phase' :: \"(state,act,out) trans trace \\ confID \\ nat \\ bool\" where\n initial: \"phase' [] cid noPH\"\n| approve: \"\\phase' tr cid noPH; trn=Trans s (Uact (uConfA cid (voronkov s) _)) outOK _ \\\n \\ phase' (tr@[trn]) cid setPH\"\n| advance: \"\\trn = (Trans _ (Uact (uPhase cid uid _ ph)) outOK _); isChair' tr cid uid\\\n \\ phase' (tr@[trn]) cid ph\"\n| irrelevant: \"\\phase' tr cid ph; \\is_uPhase cid trn \\ \\ phase' (tr@[trn]) cid ph\"\n\nlemma justify_phase:\n assumes \"trace_to tr s\"\n assumes \"phase s cid = ph\"\n shows \"phase' tr cid ph\"\n using assms\nproof (induction arbitrary: ph)\n case (empty s) thus ?case\n by (auto simp add: istate_def phase'.initial)\nnext\n case (step tr s a ou s')\n thus ?case\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs intro: phase'.advance phase'.irrelevant) [] .\n subgoal for x2 apply (cases x2,\n auto\n simp: u_defs isChair_eq\n intro: phase'.advance phase'.irrelevant phase'.approve,\n (fastforce intro: phase'.approve phase'.irrelevant phase'.advance)+\n ) [] .\n\n subgoal for x3 apply (cases x3, auto simp: uu_defs intro: phase'.irrelevant) [] .\n by (auto intro: phase'.advance phase'.irrelevant)\nqed\n\nlemma phase_justify:\n assumes \"trace_to tr s\"\n assumes \"phase' tr cid ph\"\n shows \"phase s cid = ph\"\n using assms\nproof (induction arbitrary: ph)\n case (empty s) thus ?case\n by (auto simp add: istate_def elim: phase'.cases)\nnext\n case (step tr s a ou s')\n from step.prems\n show ?case\n proof (cases)\n case (approve _ _ _ pass _)\n hence [simp]: \"a=Uact (uConfA cid (voronkov s) pass)\" \"ou=outOK\" \"ph=setPH\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: u_defs)\n next\n case (advance _ _ uid pass _ _)\n hence [simp]: \"a=Uact (uPhase cid uid pass ph)\" \"ou=outOK\" by simp_all\n from step.hyps show ?thesis\n by (auto simp add: u_defs)\n next\n case (irrelevant) with step.IH have PH: \"phase s cid = ph\" \"\\ is_uPhase cid (Trans s a ou s')\"\n by simp_all\n\n from PH \\step s a = (ou, s')\\ show ?thesis\n apply (cases a)\n subgoal for x1 apply (cases x1, auto simp: c_defs) [] .\n subgoal for x2 apply (cases x2, auto simp: u_defs) [] .\n subgoal for x3 apply (cases x3, auto simp: uu_defs) [] .\n by simp_all\n qed auto\nqed\n\ntheorem phase_eq:\n assumes \"trace_to tr s\"\n shows \"phase s cid = ph \\ phase' tr cid ph\"\n using assms phase_justify justify_phase by blast\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Traceback_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.28424930096402395}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | July 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_law_dist\nimports CSP_T_law_basic CSP_T_law_alpha_par\nbegin\n\n(*****************************************************************\n\n distribution over internal choice\n\n 1. (P1 |~| P2) [+] Q\n 2. Q [+] (P1 |~| P2)\n 3. (P1 |~| P2) |[X]| Q\n 4. Q |[X]| (P1 |~| P2)\n 5. (P1 |~| P2) -- X\n 6. (P1 |~| P2) [[r]]\n 7. (P1 |~| P2) ;; Q\n 8. (P1 |~| P2) |. n\n 9. !! x:X .. (P1 |~| P2)\n\n *****************************************************************)\n\n(*********************************************************\n dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspT_Ext_choice_dist_l: \n \"(P1 |~| P2) [+] Q =T[M,M]\n (P1 [+] Q) |~| (P2 [+] Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*********************************************************\n dist law for Ext_choice (r)\n *********************************************************)\n\nlemma cspT_Ext_choice_dist_r: \n \"P [+] (Q1 |~| Q2) =T[M,M]\n (P [+] Q1) |~| (P [+] Q2)\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_Ext_choice_dist_l)\napply (rule cspT_decompo)\napply (rule cspT_commut)+\ndone\n\n(*********************************************************\n dist law for Parallel (l)\n *********************************************************)\n\nlemma cspT_Parallel_dist_l: \n \"(P1 |~| P2) |[X]| Q =T[M,M]\n (P1 |[X]| Q) |~| (P2 |[X]| Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*********************************************************\n dist law for Parallel (r)\n *********************************************************)\n\nlemma cspT_Parallel_dist_r: \n \"P |[X]| (Q1 |~| Q2) =T[M,M]\n (P |[X]| Q1) |~| (P |[X]| Q2)\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_Parallel_dist_l)\napply (rule cspT_decompo)\napply (rule cspT_commut)+\ndone\n\n(*********************************************************\n dist law for Hiding\n *********************************************************)\n\nlemma cspT_Hiding_dist: \n \"(P1 |~| P2) -- X =T[M,M]\n (P1 -- X) |~| (P2 -- X)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*********************************************************\n dist law for Renaming\n *********************************************************)\n\nlemma cspT_Renaming_dist: \n \"(P1 |~| P2) [[r]] =T[M,M]\n (P1 [[r]]) |~| (P2 [[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*********************************************************\n dist law for Sequential composition\n *********************************************************)\n\nlemma cspT_Seq_compo_dist: \n \"(P1 |~| P2) ;; Q =T[M,M]\n (P1 ;; Q) |~| (P2 ;; Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*********************************************************\n dist law for Depth_rest\n *********************************************************)\n\nlemma cspT_Depth_rest_dist: \n \"(P1 |~| P2) |. n =T[M,M]\n (P1 |. n) |~| (P2 |. n)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces)\napply (rule, simp add: in_traces)\napply (force)\ndone\n\n(*********************************************************\n dist law for Rep_int_choice\n *********************************************************)\n\nlemma cspT_Rep_int_choice_sum_dist:\n \"!! c:C .. (Pf c |~| Qf c) =T[M,M] (!! c:C .. Pf c) |~| (!! c:C .. Qf c)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\nlemma cspT_Rep_int_choice_nat_dist:\n \"!nat n:N .. (Pf n |~| Qf n) =T[M,M] (!nat n:N .. Pf n) |~| (!nat n:N .. Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspT_Rep_int_choice_sum_dist)\n\nlemma cspT_Rep_int_choice_set_dist:\n \"!set X:Xs .. (Pf X |~| Qf X) =T[M,M] (!set X:Xs .. Pf X) |~| (!set X:Xs .. Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Rep_int_choice_sum_dist)\n\nlemma cspT_Rep_int_choice_com_dist:\n \"! a:X .. (Pf a |~| Qf a) =T[M,M] (! a:X .. Pf a) |~| (! a:X .. Qf a)\"\nby (simp add: Rep_int_choice_com_def cspT_Rep_int_choice_set_dist)\n\nlemma cspT_Rep_int_choice_f_dist:\n \"inj f ==>\n ! a:X .. (Pf a |~| Qf a) =T[M,M] (! a:X .. Pf a) |~| (! a:X .. Qf a)\"\nby (simp add: Rep_int_choice_f_def cspT_Rep_int_choice_com_dist)\n\nlemmas cspT_Rep_int_choice_dist =\n cspT_Rep_int_choice_sum_dist\n cspT_Rep_int_choice_nat_dist\n cspT_Rep_int_choice_set_dist\n cspT_Rep_int_choice_com_dist\n cspT_Rep_int_choice_f_dist\n\n(*********************************************************\n dist laws\n *********************************************************)\n\nlemmas cspT_dist = cspT_Ext_choice_dist_l cspT_Ext_choice_dist_r\n cspT_Parallel_dist_l cspT_Parallel_dist_r\n cspT_Hiding_dist cspT_Renaming_dist\n cspT_Seq_compo_dist cspT_Depth_rest_dist\n cspT_Rep_int_choice_dist\n\n(*****************************************************************\n\n distribution over replicated internal choice\n\n 1. (!! :C .. Pf) [+] Q\n 2. Q [+] (!! :C .. Pf)\n 3. (!! :C .. Pf) |[X]| Q\n 4. Q |[X]| (!! :C .. Pf)\n 5. (!! :C .. Pf) -- X\n 6. (!! :C .. Pf) [[r]]\n 7. (!! :C .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n Rep_dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_sum_l_nonempty: \n \"sumset C ~= {} ==> (!! :C .. Pf) [+] Q =T[M,M]\n !! c:C .. (Pf c [+] Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces, fast)+\ndone\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_sum_l: \n \"(!! :C .. Pf) [+] Q =T[M,M]\n IF (sumset C={}) THEN (DIV [+] Q) ELSE (!! c:C .. (Pf c [+] Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo)\napply (rule cspT_Rep_int_choice_empty)\napply (simp_all)\n\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Ext_choice_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n Dist_sum law for Ext_choice (r)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_sum_r_nonempty: \n \"sumset C ~= {} ==> P [+] (!! :C .. Qf) =T[M,M]\n !! c:C .. (P [+] Qf c)\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_Ext_choice_Dist_sum_l_nonempty, simp)\napply (rule cspT_decompo, simp)\napply (rule cspT_commut)\ndone\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_sum_r: \n \"P [+] (!! :C .. Qf) =T[M,M]\n IF (sumset C={}) THEN (P [+] DIV) ELSE (!! c:C .. (P [+] Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo)\napply (simp)\napply (simp add: cspT_Rep_int_choice_empty)\n\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Ext_choice_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n Dist_sum law for Parallel (l)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_sum_l_nonempty: \n \"sumset C ~= {} ==>\n (!! :C .. Pf) |[X]| Q =T[M,M]\n !! c:C .. (Pf c |[X]| Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (subgoal_tac \"EX c. c: sumset C\")\n apply (elim exE)\n apply (rule disjI2)\n apply (rule_tac x=\"c\" in bexI)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp)\n apply (simp)\n apply (fast)\n (* *)\n apply (rule disjI2)\n apply (rule_tac x=\"c\" in bexI)\n apply (fast)\n apply (simp)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n apply (fast)\ndone\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_sum_l: \n \"(!! :C .. Pf) |[X]| Q =T[M,M]\n IF (sumset C={}) THEN (DIV |[X]| Q) ELSE (!! c:C .. (Pf c |[X]| Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo)\napply (simp)\napply (simp add: cspT_Rep_int_choice_empty)\napply (simp)\n\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Parallel_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n Dist_sum law for Parallel (r)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_sum_r_nonempty: \n \"sumset C ~= {} ==>\n P |[X]| (!! :C .. Qf) =T[M,M]\n !! c:C .. (P |[X]| Qf c)\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_Parallel_Dist_sum_l_nonempty, simp)\napply (rule cspT_decompo, simp)\napply (rule cspT_commut)\ndone\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_sum_r: \n \"P |[X]| (!! :C .. Qf) =T[M,M]\n IF (sumset C={}) THEN (P |[X]| DIV) ELSE (!! c:C .. (P |[X]| Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo)\napply (simp)\napply (simp)\napply (simp add: cspT_Rep_int_choice_empty)\n\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Parallel_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n Dist_sum law for Hiding\n *********************************************************)\n\nlemma cspT_Hiding_Dist_sum: \n \"(!! :C .. Pf) -- X =T[M,M]\n !! c:C .. (Pf c -- X)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE, simp, fast)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (rule_tac x=\"<>\" in exI, simp)\n apply (rule_tac x=\"s\" in exI, fast)\ndone\n\n(*********************************************************\n Dist_sum law for Renaming\n *********************************************************)\n\nlemma cspT_Renaming_Dist_sum: \n \"(!! :C .. Pf) [[r]] =T[M,M]\n !! c:C .. (Pf c [[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE, simp, fast)\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE, simp, fast)\ndone\n\n(*********************************************************\n Dist_sum law for Sequential composition\n *********************************************************)\n\nlemma cspT_Seq_compo_Dist_sum: \n \"(!! :C .. Pf) ;; Q =T[M,M]\n !! c:C .. (Pf c ;; Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp)\n apply (fast)\n apply (force)\n apply (rule disjI2)\n apply (rule_tac x=\"c\" in bexI)\n apply (force)\n apply (simp)\n\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (rule disjI1)\n apply (rule_tac x=\"<>\" in exI, simp)\n apply (fast)\n apply (fast)\ndone\n\n(*********************************************************\n Dist_sum law for Depth_rest\n *********************************************************)\n\nlemma cspT_Depth_rest_Dist_sum: \n \"(!! :C .. Pf) |. m =T[M,M]\n !! c:C .. (Pf c |. m)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n apply (rule, simp add: in_traces)\n apply (rule, simp add: in_traces)\n apply (force)\ndone\n\n(*********************************************************\n Dist_sum laws\n *********************************************************)\n\nlemmas cspT_Dist_sum = cspT_Ext_choice_Dist_sum_l cspT_Ext_choice_Dist_sum_r\n cspT_Parallel_Dist_sum_l cspT_Parallel_Dist_sum_r\n cspT_Hiding_Dist_sum cspT_Renaming_Dist_sum\n cspT_Seq_compo_Dist_sum cspT_Depth_rest_Dist_sum\n\nlemmas cspT_Dist_sum_nonempty = \n cspT_Ext_choice_Dist_sum_l_nonempty cspT_Ext_choice_Dist_sum_r_nonempty\n cspT_Parallel_Dist_sum_l_nonempty cspT_Parallel_Dist_sum_r_nonempty\n cspT_Hiding_Dist_sum cspT_Renaming_Dist_sum\n cspT_Seq_compo_Dist_sum cspT_Depth_rest_Dist_sum\n\n(*****************************************************************\n\n distribution over replicated internal choice\n\n 1. (!nat :C .. Pf) [+] Q\n 2. Q [+] (!nat :C .. Pf)\n 3. (!nat :C .. Pf) |[X]| Q\n 4. Q |[X]| (!nat :C .. Pf)\n 5. (!nat :C .. Pf) -- X\n 6. (!nat :C .. Pf) [[r]]\n 7. (!nat :C .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n Rep_dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_nat_l_nonempty: \n \"N ~= {} ==> (!nat :N .. Pf) [+] Q =T[M,M]\n !nat n:N .. (Pf n [+] Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_nat_l: \n \"(!nat :N .. Pf) [+] Q =T[M,M]\n IF (N={}) THEN (DIV [+] Q) ELSE (!nat n:N .. (Pf n [+] Q))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_rw_left)\napply (rule cspT_Dist_sum)\napply (simp)\ndone\n\n(*********************************************************\n Dist_nat law for Ext_choice (r)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_nat_r_nonempty: \n \"N ~= {} ==> P [+] (!nat :N .. Qf) =T[M,M]\n !nat n:N .. (P [+] Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_nat_r: \n \"P [+] (!nat :N .. Qf) =T[M,M]\n IF (N={}) THEN (P [+] DIV) ELSE (!nat n:N .. (P [+] Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_nat law for Parallel (l)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_nat_l_nonempty: \n \"N ~= {} ==>\n (!nat :N .. Pf) |[X]| Q =T[M,M]\n !nat n:N .. (Pf n |[X]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_nat_l: \n \"(!nat :N .. Pf) |[X]| Q =T[M,M]\n IF (N={}) THEN (DIV |[X]| Q) ELSE (!nat n:N .. (Pf n |[X]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_nat law for Parallel (r)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_nat_r_nonempty: \n \"N ~= {} ==>\n P |[X]| (!nat :N .. Qf) =T[M,M]\n !nat n:N .. (P |[X]| Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_nat_r: \n \"P |[X]| (!nat :N .. Qf) =T[M,M]\n IF (N={}) THEN (P |[X]| DIV) ELSE (!nat n:N .. (P |[X]| Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_nat law for Hiding\n *********************************************************)\n\nlemma cspT_Hiding_Dist_nat: \n \"(!nat :N .. Pf) -- X =T[M,M]\n !nat n:N .. (Pf n -- X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_nat law for Renaming\n *********************************************************)\n\nlemma cspT_Renaming_Dist_nat: \n \"(!nat :N .. Pf) [[r]] =T[M,M]\n !nat n:N .. (Pf n [[r]])\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_nat law for Sequential composition\n *********************************************************)\n\nlemma cspT_Seq_compo_Dist_nat: \n \"(!nat :N .. Pf) ;; Q =T[M,M]\n !nat n:N .. (Pf n ;; Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_nat law for Depth_rest\n *********************************************************)\n\nlemma cspT_Depth_rest_Dist_nat: \n \"(!nat :N .. Pf) |. m =T[M,M]\n !nat n:N .. (Pf n |. m)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_nat laws\n *********************************************************)\n\nlemmas cspT_Dist_nat = cspT_Ext_choice_Dist_nat_l cspT_Ext_choice_Dist_nat_r\n cspT_Parallel_Dist_nat_l cspT_Parallel_Dist_nat_r\n cspT_Hiding_Dist_nat cspT_Renaming_Dist_nat\n cspT_Seq_compo_Dist_nat cspT_Depth_rest_Dist_nat\n\nlemmas cspT_Dist_nat_nonempty = \n cspT_Ext_choice_Dist_nat_l_nonempty cspT_Ext_choice_Dist_nat_r_nonempty\n cspT_Parallel_Dist_nat_l_nonempty cspT_Parallel_Dist_nat_r_nonempty\n cspT_Hiding_Dist_nat cspT_Renaming_Dist_nat\n cspT_Seq_compo_Dist_nat cspT_Depth_rest_Dist_nat\n\n(*****************************************************************\n\n distribution over replicated internal choice\n\n 1. (!set :C .. Pf) [+] Q\n 2. Q [+] (!set :C .. Pf)\n 3. (!set :C .. Pf) |[X]| Q\n 4. Q |[X]| (!set :C .. Pf)\n 5. (!set :C .. Pf) -- X\n 6. (!set :C .. Pf) [[r]]\n 7. (!set :C .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n Rep_dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_set_l_nonempty: \n \"Xs ~= {} ==> (!set :Xs .. Pf) [+] Q =T[M,M]\n !set X:Xs .. (Pf X [+] Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_set_l: \n \"(!set :Xs .. Pf) [+] Q =T[M,M]\n IF (Xs={}) THEN (DIV [+] Q) ELSE (!set X:Xs .. (Pf X [+] Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_set law for Ext_choice (r)\n *********************************************************)\n\nlemma cspT_Ext_choice_Dist_set_r_nonempty: \n \"Xs ~= {} ==> P [+] (!set :Xs .. Qf) =T[M,M]\n !set X:Xs .. (P [+] Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Ext_choice_Dist_set_r: \n \"P [+] (!set :Xs .. Qf) =T[M,M]\n IF (Xs={}) THEN (P [+] DIV) ELSE (!set X:Xs .. (P [+] Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_set law for Parallel (l)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_set_l_nonempty: \n \"Xs ~= {} ==>\n (!set :Xs .. Pf) |[Y]| Q =T[M,M]\n !set X:Xs .. (Pf X |[Y]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_set_l: \n \"(!set :Xs .. Pf) |[Y]| Q =T[M,M]\n IF (Xs={}) THEN (DIV |[Y]| Q) ELSE (!set X:Xs .. (Pf X |[Y]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_set law for Parallel (r)\n *********************************************************)\n\nlemma cspT_Parallel_Dist_set_r_nonempty: \n \"Xs ~= {} ==>\n P |[Y]| (!set :Xs .. Qf) =T[M,M]\n !set X:Xs .. (P |[Y]| Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Parallel_Dist_set_r: \n \"P |[Y]| (!set :Xs .. Qf) =T[M,M]\n IF (Xs={}) THEN (P |[Y]| DIV) ELSE (!set X:Xs .. (P |[Y]| Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Dist_sum, simp)\n\n(*********************************************************\n Dist_set law for Hiding\n *********************************************************)\n\nlemma cspT_Hiding_Dist_set: \n \"(!set :Xs .. Pf) -- Y =T[M,M]\n !set X:Xs .. (Pf X -- Y)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_set law for Renaming\n *********************************************************)\n\nlemma cspT_Renaming_Dist_set: \n \"(!set :Xs .. Pf) [[r]] =T[M,M]\n !set X:Xs .. (Pf X [[r]])\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_set law for Sequential composition\n *********************************************************)\n\nlemma cspT_Seq_compo_Dist_set: \n \"(!set :Xs .. Pf) ;; Q =T[M,M]\n !set X:Xs .. (Pf X ;; Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_set law for Depth_rest\n *********************************************************)\n\nlemma cspT_Depth_rest_Dist_set: \n \"(!set :Xs .. Pf) |. m =T[M,M]\n !set X:Xs .. (Pf X |. m)\"\nby (simp add: Rep_int_choice_ss_def cspT_Dist_sum)\n\n(*********************************************************\n Dist_set laws\n *********************************************************)\n\nlemmas cspT_Dist_set = cspT_Ext_choice_Dist_set_l cspT_Ext_choice_Dist_set_r\n cspT_Parallel_Dist_set_l cspT_Parallel_Dist_set_r\n cspT_Hiding_Dist_set cspT_Renaming_Dist_set\n cspT_Seq_compo_Dist_set cspT_Depth_rest_Dist_set\n\nlemmas cspT_Dist_set_nonempty = \n cspT_Ext_choice_Dist_set_l_nonempty cspT_Ext_choice_Dist_set_r_nonempty\n cspT_Parallel_Dist_set_l_nonempty cspT_Parallel_Dist_set_r_nonempty\n cspT_Hiding_Dist_set cspT_Renaming_Dist_set\n cspT_Seq_compo_Dist_set cspT_Depth_rest_Dist_set\n\n(*****************************************************************\n\n for convenience\n\n 1. (! :X .. Pf) [+] Q\n 2. Q [+] (! :X .. Pf)\n 3. (! :X .. Pf) |[X]| Q\n 4. Q |[X]| (! :X .. Pf)\n 5. (! :X .. Pf) -- X\n 6. (! :X .. Pf) [[r]]\n 7. (! :X .. Pf) |. n\n\n *****************************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Ext_choice_Dist_com_l_nonempty: \n \"X ~= {}\n ==> (! :X .. Pf) [+] Q =T[M,M] ! x:X .. (Pf x [+] Q)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Ext_choice_Dist_com_r_nonempty: \n \"X ~= {}\n ==> P [+] (! :X .. Qf) =T[M,M] ! x:X .. (P [+] Qf x)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Parallel_Dist_com_l_nonempty: \n \"Y ~= {}\n ==> (! :Y .. Pf) |[X]| Q =T[M,M] ! x:Y .. (Pf x |[X]| Q)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Parallel_Dist_com_r_nonempty: \n \"Y ~= {}\n ==> P |[X]| (! :Y .. Qf) =T[M,M] ! x:Y .. (P |[X]| Qf x)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Ext_choice_Dist_com_l: \n \"(! :X .. Pf) [+] Q =T[M,M] \n IF (X ={}) THEN (DIV [+] Q) ELSE (! x:X .. (Pf x [+] Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Dist_set, simp)\n\nlemma cspT_Ext_choice_Dist_com_r: \n \"P [+] (! :X .. Qf) =T[M,M]\n IF (X ={}) THEN (P [+] DIV) ELSE (! x:X .. (P [+] Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Dist_set, simp)\n\nlemma cspT_Parallel_Dist_com_l: \n \"(! :Y .. Pf) |[X]| Q =T[M,M]\n IF (Y ={}) THEN (DIV |[X]| Q) ELSE (! x:Y .. (Pf x |[X]| Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Dist_set, simp)\n\nlemma cspT_Parallel_Dist_com_r: \n \"P |[X]| (! :Y .. Qf) =T[M,M] \n IF (Y ={}) THEN (P |[X]| DIV) ELSE (! x:Y .. (P |[X]| Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Dist_set, simp)\n\nlemma cspT_Hiding_Dist_com: \n \"(! :Y .. Pf) -- X =T[M,M] ! x:Y .. (Pf x -- X)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Renaming_Dist_com: \n \"(! :X .. Pf) [[r]] =T[M,M] ! x:X .. (Pf x [[r]])\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Seq_compo_Dist_com:\n \"(! :X .. Pf) ;; Q =T[M,M] ! x:X .. (Pf x ;; Q)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\nlemma cspT_Depth_rest_Dist_com: \n \"(! :X .. Pf) |. n =T[M,M] ! x:X .. (Pf x |. n)\"\nby (simp add: Rep_int_choice_com_def cspT_Dist_set_nonempty)\n\n(*********************************************************\n Dist laws\n *********************************************************)\n\nlemmas cspT_Dist_com = cspT_Ext_choice_Dist_com_l cspT_Ext_choice_Dist_com_r\n cspT_Parallel_Dist_com_l cspT_Parallel_Dist_com_r\n cspT_Hiding_Dist_com cspT_Renaming_Dist_com\n cspT_Seq_compo_Dist_com cspT_Depth_rest_Dist_com\n\nlemmas cspT_Dist_com_nonempty = \n cspT_Ext_choice_Dist_com_l_nonempty cspT_Ext_choice_Dist_com_r_nonempty\n cspT_Parallel_Dist_com_l_nonempty cspT_Parallel_Dist_com_r_nonempty\n cspT_Hiding_Dist_com cspT_Renaming_Dist_com\n cspT_Seq_compo_Dist_com cspT_Depth_rest_Dist_com\n\n(*****************************************************************\n\n for convenience\n\n 1. (! :X .. Pf) [+] Q\n 2. Q [+] (! :X .. Pf)\n 3. (! :X .. Pf) |[X]| Q\n 4. Q |[X]| (! :X .. Pf)\n 5. (! :X .. Pf) -- X\n 6. (! :X .. Pf) [[r]]\n 7. (! :X .. Pf) |. n\n\n *****************************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Ext_choice_Dist_f_l_nonempty: \n \"[| inj f ; X ~= {} |]\n ==> (! :X .. Pf) [+] Q =T[M,M] ! x:X .. (Pf x [+] Q)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com_nonempty)\n\nlemma cspT_Ext_choice_Dist_f_r_nonempty: \n \"[| inj f ; X ~= {} |]\n ==> P [+] (! :X .. Qf) =T[M,M] ! x:X .. (P [+] Qf x)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com_nonempty)\n\nlemma cspT_Parallel_Dist_f_l_nonempty: \n \"[| inj f ; Y ~= {} |]\n ==> (! :Y .. Pf) |[X]| Q =T[M,M] ! x:Y .. (Pf x |[X]| Q)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com_nonempty)\n\nlemma cspT_Parallel_Dist_f_r_nonempty: \n \"[| inj f ; Y ~= {} |]\n ==> P |[X]| (! :Y .. Qf) =T[M,M] ! x:Y .. (P |[X]| Qf x)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com_nonempty)\n\nlemma cspT_Ext_choice_Dist_f_l: \n \"(! :X .. Pf) [+] Q =T[M,M] \n IF (X ={}) THEN (DIV [+] Q) ELSE (! x:X .. (Pf x [+] Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Dist_com, simp)\n\nlemma cspT_Ext_choice_Dist_f_r: \n \"P [+] (! :X .. Qf) =T[M,M]\n IF (X ={}) THEN (P [+] DIV) ELSE (! x:X .. (P [+] Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Dist_com, simp)\n\nlemma cspT_Parallel_Dist_f_l: \n \"(! :Y .. Pf) |[X]| Q =T[M,M]\n IF (Y ={}) THEN (DIV |[X]| Q) ELSE (! x:Y .. (Pf x |[X]| Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Dist_com, simp)\n\nlemma cspT_Parallel_Dist_f_r: \n \"P |[X]| (! :Y .. Qf) =T[M,M] \n IF (Y ={}) THEN (P |[X]| DIV) ELSE (! x:Y .. (P |[X]| Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Dist_com, simp)\n\nlemma cspT_Hiding_Dist_f: \n \"(! :Y .. Pf) -- X =T[M,M] ! x:Y .. (Pf x -- X)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com)\n\nlemma cspT_Renaming_Dist_f: \n \"(! :X .. Pf) [[r]] =T[M,M] ! x:X .. (Pf x [[r]])\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com)\n\nlemma cspT_Seq_compo_Dist_f:\n \"(! :X .. Pf) ;; Q =T[M,M] ! x:X .. (Pf x ;; Q)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com)\n\nlemma cspT_Depth_rest_Dist_f: \n \"(! :X .. Pf) |. n =T[M,M] ! x:X .. (Pf x |. n)\"\nby (simp add: Rep_int_choice_f_def cspT_Dist_com)\n\n(*********************************************************\n Dist laws\n *********************************************************)\n\nlemmas cspT_Dist_f = cspT_Ext_choice_Dist_f_l cspT_Ext_choice_Dist_f_r\n cspT_Parallel_Dist_f_l cspT_Parallel_Dist_f_r\n cspT_Hiding_Dist_f cspT_Renaming_Dist_f\n cspT_Seq_compo_Dist_f cspT_Depth_rest_Dist_f\n\nlemmas cspT_Dist_f_nonempty = \n cspT_Ext_choice_Dist_f_l_nonempty cspT_Ext_choice_Dist_f_r_nonempty\n cspT_Parallel_Dist_f_l_nonempty cspT_Parallel_Dist_f_r_nonempty\n cspT_Hiding_Dist_f cspT_Renaming_Dist_f\n cspT_Seq_compo_Dist_f cspT_Depth_rest_Dist_f\n\n(*** all rules ***)\n\nlemmas cspT_Dist = cspT_Dist_sum\n cspT_Dist_nat cspT_Dist_set cspT_Dist_com cspT_Dist_f\n\nlemmas cspT_Dist_nonempty = cspT_Dist_sum_nonempty\n cspT_Dist_nat_nonempty\n cspT_Dist_set_nonempty\n cspT_Dist_com_nonempty\n cspT_Dist_f_nonempty\n\n(*****************************************************************\n\n additional distribution over replicated internal choice\n\n 1. (!! :X .. (a -> P))\n 2. (!! :Y .. (? :X -> P))\n\n *****************************************************************)\n\n(*********************************************************\n Dist law for Act_prefix\n *********************************************************)\n\nlemma cspT_Act_prefix_Dist_sum:\n \"sumset C ~= {} ==> \n a -> (!! :C .. Pf) =T[M,M] !! c:C .. (a -> Pf c)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\n apply (force)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\ndone\n\n(*********************************************************\n Dist_nat law for Ext_pre_choice\n *********************************************************)\n\nlemma cspT_Ext_pre_choice_Dist_sum:\n \"sumset C ~= {} ==> \n ? x:X -> (!! c:C .. (Pf c) x) =T[M,M] !! c:C .. (? :X -> (Pf c))\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\n apply (force)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\ndone\n\n(*****************************************************************\n for convenienve\n *****************************************************************)\n\n(* nat *)\n\nlemma cspT_Act_prefix_Dist_nat:\n \"N ~= {} ==> \n a -> (!nat :N .. Pf) =T[M,M] !nat n:N .. (a -> Pf n)\"\nby (simp add: Rep_int_choice_ss_def cspT_Act_prefix_Dist_sum)\n\nlemma cspT_Ext_pre_choice_Dist_nat:\n \"N ~= {} ==> \n ? x:X -> (!nat n:N .. (Pf n) x) =T[M,M] !nat n:N .. (? :X -> (Pf n))\"\nby (simp add: Rep_int_choice_ss_def cspT_Ext_pre_choice_Dist_sum)\n\n(* set *)\n\nlemma cspT_Act_prefix_Dist_set:\n \"Xs ~= {} ==> \n a -> (!set :Xs .. Pf) =T[M,M] !set X:Xs .. (a -> Pf X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Act_prefix_Dist_sum)\n\nlemma cspT_Ext_pre_choice_Dist_set:\n \"Ys ~= {} ==> \n ? x:X -> (!set Y:Ys .. (Pf Y) x) =T[M,M] !set Y:Ys .. (? :X -> (Pf Y))\"\nby (simp add: Rep_int_choice_ss_def cspT_Ext_pre_choice_Dist_sum)\n\n(* com *)\n\nlemma cspT_Act_prefix_Dist_com:\n \"X ~= {} ==> \n a -> (! :X .. Pf) =T[M,M] ! x:X .. (a -> Pf x)\"\nby (simp add: Rep_int_choice_com_def cspT_Act_prefix_Dist_set)\n\nlemma cspT_Ext_pre_choice_Dist_com:\n \"Y ~= {} ==> \n ? x:X -> (! y:Y .. (Pf y) x) =T[M,M] ! y:Y .. (? :X -> (Pf y))\"\nby (simp add: Rep_int_choice_com_def cspT_Ext_pre_choice_Dist_set)\n\n(* f *)\n\nlemma cspT_Act_prefix_Dist_f:\n \"X ~= {} ==> \n a -> (! :X .. Pf) =T[M,M] ! x:X .. (a -> Pf x)\"\nby (simp add: Rep_int_choice_f_def cspT_Act_prefix_Dist_com)\n\nlemma cspT_Ext_pre_choice_Dist_f:\n \"Y ~= {} ==> \n ? x:X -> (! y:Y .. (Pf y) x) =T[M,M] ! y:Y .. (? :X -> (Pf y))\"\nby (simp add: Rep_int_choice_f_def cspT_Ext_pre_choice_Dist_com)\n\n(*** arias ***)\n\nlemmas cspT_Act_prefix_Dist \n = cspT_Act_prefix_Dist_sum\n cspT_Act_prefix_Dist_nat\n cspT_Act_prefix_Dist_set\n cspT_Act_prefix_Dist_com\n cspT_Act_prefix_Dist_f\n\nlemmas cspT_Ext_pre_choice_Dist\n = cspT_Ext_pre_choice_Dist_sum\n cspT_Ext_pre_choice_Dist_nat\n cspT_Ext_pre_choice_Dist_set\n cspT_Ext_pre_choice_Dist_com\n cspT_Ext_pre_choice_Dist_f\n\n(*****************************************************************\n distribution over external choice\n 1. (P1 [+] P2) [[r]]\n 2. (P1 [+] P2) |. n\n *****************************************************************)\n\n(*********************\n [[r]]-[+]-dist\n *********************)\n\nlemma cspT_Renaming_Ext_dist:\n \"(P1 [+] P2) [[r]] =T[M,M]\n (P1 [[r]]) [+] (P2 [[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\ndone\n\n(*********************\n |.-[+]-dist\n *********************)\n\nlemma cspT_Depth_rest_Ext_dist: \n \"(P1 [+] P2) |. n =T[M,M]\n (P1 |. n) [+] (P2 |. n)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\ndone\n\nlemmas cspT_Ext_dist = cspT_Renaming_Ext_dist cspT_Depth_rest_Ext_dist\n\n(*---------------------------------------------------------*\n | complex distribution |\n *---------------------------------------------------------*)\n\n(*********************\n !!-input-!set\n *********************)\n\nlemma cspT_Rep_int_choice_sum_input_set:\n \"(!! c:C .. (? :(Yf c) -> Rff c))\n =T[M,M]\n (!set Y : {(Yf c)|c. c: sumset C} .. \n (? a : Y -> (!! c:{c:C. a : Yf c}s .. Rff c a)))\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (fast)\n apply (force)\ndone\n\nlemma cspT_Rep_int_choice_nat_input_set:\n \"(!nat n:N .. (? :(Yf n) -> Rff n))\n =T[M,M]\n (!set Y : {(Yf n)|n. n:N} .. (? a : Y -> (!nat n:{n:N. a : Yf n} .. Rff n a)))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_rw_left)\napply (rule cspT_Rep_int_choice_sum_input_set)\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_decompo)\napply (auto)\napply (rule_tac x=\"type2 n\" in exI)\nby (auto)\n\nlemma cspT_Rep_int_choice_set_input_set:\n \"(!set X:Xs .. (? :(Yf X) -> Rff X))\n =T[M,M]\n (!set Y : {(Yf X)|X. X:Xs} .. (? a : Y -> (!set X:{X:Xs. a : Yf X} .. Rff X a)))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_rw_left)\napply (rule cspT_Rep_int_choice_sum_input_set)\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_decompo)\napply (auto)\napply (rule_tac x=\"type1 X\" in exI)\nby (auto)\n\nlemmas cspT_Rep_int_choice_input_set =\n cspT_Rep_int_choice_sum_input_set\n cspT_Rep_int_choice_nat_input_set\n cspT_Rep_int_choice_set_input_set\n\n(*-------------------------------*\n !!-[+]-Dist\n *-------------------------------*)\n\nlemma cspT_Rep_int_choice_Ext_Dist_sum:\n \"ALL c:sumset C. (Qf c = SKIP | Qf c = DIV) ==>\n (!! c:C .. (Pf c [+] Qf c)) =T[M,M]\n ((!! :C .. Pf) [+] (!! :C .. Qf))\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE bexE disjE)\n apply (simp_all)\n apply (force)\n apply (drule_tac x=\"c\" in bspec)\n apply (simp)\n apply (erule disjE)\n apply (simp_all add: in_traces)\n apply (erule disjE)\n apply (simp_all)\n apply (rule disjI2)\n apply (rule_tac x=\"c\" in bexI)\n apply (simp_all add: in_traces)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE bexE disjE)\n apply (simp_all)\n apply (fast)\n apply (fast)\ndone\n\nlemma cspT_Rep_int_choice_Ext_Dist_nat:\n \"ALL n:N. (Qf n = SKIP | Qf n = DIV) ==>\n (!nat n:N .. (Pf n [+] Qf n)) =T[M,M]\n ((!nat :N .. Pf) [+] (!nat :N .. Qf))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_Rep_int_choice_Ext_Dist_sum)\nby (auto)\n\nlemma cspT_Rep_int_choice_Ext_Dist_set:\n \"ALL X:Xs. (Qf X = SKIP | Qf X = DIV) ==>\n (!set X:Xs .. (Pf X [+] Qf X)) =T[M,M]\n ((!set :Xs .. Pf) [+] (!set :Xs .. Qf))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspT_Rep_int_choice_Ext_Dist_sum)\nby (auto)\n\nlemma cspT_Rep_int_choice_Ext_Dist_com:\n \"ALL a:X. (Qf a = SKIP | Qf a = DIV) ==>\n (! a:X .. (Pf a [+] Qf a)) =T[M,M]\n ((! :X .. Pf) [+] (! :X .. Qf))\"\napply (simp add: Rep_int_choice_com_def)\napply (rule cspT_Rep_int_choice_Ext_Dist_set)\nby (auto)\n\nlemma cspT_Rep_int_choice_Ext_Dist_f:\n \"[| inj f ; ALL a:X. (Qf a = SKIP | Qf a = DIV) |] ==>\n (! a:X .. (Pf a [+] Qf a)) =T[M,M]\n ((! :X .. Pf) [+] (! :X .. Qf))\"\napply (simp add: Rep_int_choice_f_def)\napply (rule cspT_Rep_int_choice_Ext_Dist_com)\nby (auto)\n\nlemmas cspT_Rep_int_choice_Ext_Dist =\n cspT_Rep_int_choice_Ext_Dist_sum\n cspT_Rep_int_choice_Ext_Dist_nat\n cspT_Rep_int_choice_Ext_Dist_set\n cspT_Rep_int_choice_Ext_Dist_com\n cspT_Rep_int_choice_Ext_Dist_f\n\n(*-------------------------------*\n !!-input-Dist\n *-------------------------------*)\n\nlemma cspT_Rep_int_choice_input:\n \"!set X:Xs .. (? :X -> Pf) =T[M,M] (? :(Union Xs) -> Pf)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (force)\ndone\n\nlemma cspT_Rep_int_choice_input_Dist:\n \"(!set X:Xs .. (? :X -> Pf)) [+] Q =T[M,M] (? :(Union Xs) -> Pf) [+] Q\"\napply (rule cspT_decompo)\napply (rule cspT_Rep_int_choice_input)\napply (rule cspT_reflex)\ndone\n\n(* =================================================== *\n | addition for CSP-Prover 5 |\n * =================================================== *)\n\n(* --------------------------------------------------- *\n distribution hiding over sequential composition\n * --------------------------------------------------- *)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Seq_compo_hide_dist: \n \"(P ;; Q) -- X =T[M,M] (P -- X) ;; (Q -- X)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n (* 1 *)\n apply (rule disjI1)\n apply (rule_tac x=\"sa --tr X\" in exI)\n apply (simp add: rmTick_hide)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n\n (* 2 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sa --tr X\" in exI)\n apply (rule_tac x=\"ta --tr X\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (rule_tac x=\"sa ^^^ \" in exI)\n apply (simp)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n (* 1 *)\n apply (insert trace_last_noTick_or_Tick)\n apply (drule_tac x=\"sa\" in spec)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sb ^^^ \" in exI)\n apply (simp)\n\n (* 2 *)\n apply (drule_tac x=\"sa\" in spec)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (subgoal_tac \"noTick(sa --tr X)\")\n apply (rotate_tac 2)\n apply (drule sym)\n apply (simp del: hide_tr_noTick)\n apply (simp)\n\n apply (simp)\n apply (rule_tac x=\"sc ^^^ sb\" in exI)\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"sc\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\ndone\n\n\n(* --------------------------------------------------- *\n distribution hiding over interleaving\n * --------------------------------------------------- *)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Interleave_hide_dist: \n \"(P ||| Q) -- X =T[M,M] (P -- X) ||| (Q -- X)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (rule_tac x=\"sa --tr X\" in exI)\n apply (rule_tac x=\"ta --tr X\" in exI)\n apply (simp add: interleave_of_hide_tr_ex)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n\n apply (simp add: interleave_of_hide_tr_ex)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"v\" in exI)\n apply (simp)\n apply (force)\ndone\n\n(* --------------------------------------------------- *\n distribution renaming over sequential composition\n * --------------------------------------------------- *)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Seq_compo_renaming_dist: \n \"(P ;; Q) [[r]] =T[M,M] (P [[r]]) ;; (Q [[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n (* 1 *)\n apply (rule disjI1)\n apply (rule_tac x=\"t\" in exI)\n apply (subgoal_tac \"noTick t\")\n apply (simp)\n apply (rule_tac x=\"rmTick sa\" in exI)\n apply (simp)\n apply (rule memT_prefix_closed)\n apply (simp)\n apply (simp)\n apply (rule ren_tr_noTick_left)\n apply (simp)\n apply (simp)\n\n (* 2 *)\n apply (rule disjI2)\n apply (simp add: ren_tr_appt_decompo_left)\n apply (elim conjE exE)\n\n apply (simp)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"t2\" in exI)\n apply (simp)\n apply (rule conjI)\n\n apply (rule_tac x=\"sa ^^^ \" in exI)\n apply (simp add: ren_tr_noTick_left)\n\n apply (simp add: ren_tr_noTick_left)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n (* 1 *)\n apply (insert trace_last_noTick_or_Tick)\n apply (drule_tac x=\"s\" in spec)\n apply (elim disjE conjE exE)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (simp add: ren_tr_noTick_right)\n\n apply (simp)\n apply (simp add: ren_tr_appt_decompo_right)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"s1\" in exI)\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"s1 ^^^ \" in exI)\n apply (simp)\n\n (* 2 *)\n apply (simp)\n apply (simp add: ren_tr_appt_decompo_right)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"s1 ^^^ sb\" in exI)\n apply (rule conjI)\n\n apply (force)\n apply (force)\ndone\n\n\n(* --------------------------------------------------- *\n distribution renaming over interleaving\n * --------------------------------------------------- *)\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Interleave_renaming_dist: \n \"(P ||| Q) [[r]] =T[M,M] (P [[r]]) ||| (Q [[r]])\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (insert interleave_of_ren_tr_only_if_all)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"r\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"ta\" in spec)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (erule rem_asmE)\n apply (insert interleave_of_ren_tr_if_all)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"r\" in spec)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"sb\" in spec)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"ta\" in spec)\n apply (force)\ndone\n\n(* --------------------------------------------------- *\n distribution internal choice over prefix\n * --------------------------------------------------- *)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Act_prefix_dist:\n \"a -> (P |~| Q) =T[M,M] (a -> P) |~| (a -> Q)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\ndone\n\n\nlemma cspT_Int_choice_Act_prefix_delay:\n \"(a -> P) |~| (a -> Q) =T[M,M] a -> (P |~| Q)\"\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_dist)\ndone\n\nlemma cspT_Int_choice_Act_prefix_delay_eq:\n \"a = b ==> (a -> P) |~| (b -> Q) =T[M,M] a -> (P |~| Q)\"\napply (simp add: cspT_Int_choice_Act_prefix_delay)\ndone\n\n\n(* --------------------------------------------------- *\n distribution internal choice over prefix choice\n * --------------------------------------------------- *)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Ext_pre_choice_dist:\n \"? x:X -> (Pf x |~| Qf x) =T[M,M] (? x:X -> Pf x) |~| (? x:X -> Qf x)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\ndone\n\n\nlemma cspT_Int_choice_Ext_pre_choice_delay:\n \"(? x:X -> Pf x) |~| (? x:X -> Qf x) =T[M,M] ? x:X -> (Pf x |~| Qf x)\"\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_dist)\ndone\n\nlemma cspT_Int_choice_Ext_pre_choice_delay_eq:\n \"X = Y ==>\n (? x:X -> Pf x) |~| (? x:Y -> Qf x)\n =T[M,M] ? x:X -> (Pf x |~| Qf x)\"\napply (simp add: cspT_Int_choice_Ext_pre_choice_delay)\ndone\n\n\n(* replicated internal choice *)\n\nlemma cspT_Act_prefix_delay_sum:\n \"!! c:C .. (a -> Pf c) =T[M,M] \n IF (sumset C = {}) THEN DIV ELSE (a -> (!! c:C .. (Pf c)))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"sumset C = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_Dist)\ndone\n\nlemma cspT_Ext_pre_choice_delay_sum:\n \"!! c:C .. (? :X -> (Pf c)) =T[M,M] \n IF (sumset C = {}) THEN DIV ELSE (? x:X -> (!! c:C .. (Pf c) x))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"sumset C = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_Dist)\ndone\n\nlemma cspT_Act_prefix_delay_nat:\n \"!nat n:N .. (a -> Pf n) =T[M,M] \n IF (N = {}) THEN DIV ELSE (a -> (!nat n:N .. (Pf n)))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"N = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_Dist)\ndone\n\nlemma cspT_Ext_pre_choice_delay_nat:\n \"!nat n:N .. (? :X -> (Pf n)) =T[M,M] \n IF (N = {}) THEN DIV ELSE (? x:X -> (!nat n:N .. (Pf n) x))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"N = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_Dist)\ndone\n\nlemma cspT_Act_prefix_delay_set:\n \"!set X:Xs .. (a -> Pf X) =T[M,M] \n IF (Xs = {}) THEN DIV ELSE (a -> (!set X:Xs .. (Pf X)))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"Xs = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_Dist)\ndone\n\nlemma cspT_Ext_pre_choice_delay_set:\n \"!set Y:Xs .. (? :X -> (Pf Y)) =T[M,M] \n IF (Xs = {}) THEN DIV ELSE (? x:X -> (!set Y:Xs .. (Pf Y) x))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"Xs = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_Dist)\ndone\n\nlemma cspT_Act_prefix_delay_com:\n \"! x:X .. (a -> Pf x) =T[M,M] \n IF (X = {}) THEN DIV ELSE (a -> (! :X .. Pf))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"X = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_Dist)\ndone\n\nlemma cspT_Ext_pre_choice_delay_com:\n \"! y:Y .. (? :X -> (Pf y)) =T[M,M] \n IF (Y = {}) THEN DIV ELSE (? x:X -> (! y:Y .. (Pf y) x))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"Y = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_Dist)\ndone\n\nlemma cspT_Act_prefix_delay_f:\n \"inj f ==> \n ! x:X .. (a -> Pf x) =T[M,M] \n IF (X = {}) THEN DIV ELSE (a -> (! :X .. Pf))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"X = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Act_prefix_Dist)\ndone\n\nlemma cspT_Ext_pre_choice_delay_f:\n \"inj f ==> \n ! y:Y .. (? :X -> (Pf y)) =T[M,M] \n IF (Y = {}) THEN DIV ELSE (? x:X -> (! y:Y .. (Pf y) x))\"\napply (rule cspT_rw_right)\napply (rule cspT_IF_split)\napply (case_tac \"Y = {}\")\napply (simp add: cspT_Rep_int_choice_DIV)\napply (simp)\napply (rule cspT_sym)\napply (simp add: cspT_Ext_pre_choice_Dist)\ndone\n\nlemmas cspT_choice_delay =\n cspT_Int_choice_Act_prefix_delay\n cspT_Int_choice_Ext_pre_choice_delay\n cspT_Act_prefix_delay_sum\n cspT_Ext_pre_choice_delay_sum\n cspT_Act_prefix_delay_nat\n cspT_Ext_pre_choice_delay_nat\n cspT_Act_prefix_delay_set\n cspT_Ext_pre_choice_delay_set\n cspT_Act_prefix_delay_com\n cspT_Ext_pre_choice_delay_com\n cspT_Act_prefix_delay_f\n cspT_Ext_pre_choice_delay_f\n\nlemmas cspT_choice_delay_eq =\n cspT_Int_choice_Act_prefix_delay_eq\n cspT_Int_choice_Ext_pre_choice_delay_eq\n\n\n(*********************************************************\n P |[X,Y]| Q\n *********************************************************)\n\n(* ---------- *\n |~| left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_dist_l: \n \"(P1 |~| P2) |[X,Y]| Q =T[M,M]\n (P1 |[X,Y]| Q) |~| (P2 |[X,Y]| Q)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspT_rw_left)\napply (rule cspT_decompo)\napply (simp)\napply (rule cspT_dist)\napply (rule cspT_reflex)\napply (rule cspT_rw_left)\napply (rule cspT_dist)\napply (simp)\ndone\n\n(* ---------- *\n |~| right\n * ---------- *)\nlemma cspT_Alpha_Parallel_dist_r: \n \"P |[X,Y]| (Q1 |~| Q2) =T[M,M]\n (P |[X,Y]| Q1) |~| (P |[X,Y]| Q2)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspT_rw_left)\napply (rule cspT_decompo)\napply (simp)\napply (rule cspT_reflex)\napply (rule cspT_dist)\napply (rule cspT_rw_left)\napply (rule cspT_dist)\napply (simp)\ndone\n\n(* ---------- *\n !! left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_sum_l_nonempty: \n \"sumset C ~= {} ==>\n (!! :C .. Pf) |[X,Y]| Q =T[M,M]\n !! c:C .. (Pf c |[X,Y]| Q)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspT_rw_left)\napply (rule cspT_decompo)\napply (simp)\napply (rule cspT_Parallel_Dist_sum_l_nonempty)\napply (simp)\napply (rule cspT_reflex)\napply (rule cspT_rw_left)\napply (rule cspT_Parallel_Dist_sum_l_nonempty)\napply (simp)\napply (simp)\ndone\n\nlemma cspT_Alpha_Parallel_Dist_sum_l: \n \"(!! :C .. Pf) |[X,Y]| Q =T[M,M]\n IF (sumset C={}) THEN (DIV |[X,Y]| Q) ELSE (!! c:C .. (Pf c |[X,Y]| Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo_Alpha_parallel)\napply (simp)+\napply (simp add: cspT_Rep_int_choice_empty)\napply (simp)\n\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Alpha_Parallel_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(* ---------- *\n !! right\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_sum_r_nonempty: \n \"sumset C ~= {} ==>\n P |[X,Y]| (!! :C .. Qf) =T[M,M]\n !! c:C .. (P |[X,Y]| Qf c)\"\napply (rule cspT_rw_left)\napply (rule cspT_Alpha_parallel_commut)\napply (rule cspT_rw_left)\napply (rule cspT_Alpha_Parallel_Dist_sum_l_nonempty, simp)\napply (rule cspT_decompo, simp)\napply (rule cspT_Alpha_parallel_commut)\ndone\n\nlemma cspT_Alpha_Parallel_Dist_sum_r: \n \"P |[X,Y]| (!! :C .. Qf) =T[M,M]\n IF (sumset C={}) THEN (P |[X,Y]| DIV) ELSE (!! c:C .. (P |[X,Y]| Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_decompo_Alpha_parallel)\napply (simp)+\napply (simp add: cspT_Rep_int_choice_empty)\napply (simp)\n\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_Alpha_Parallel_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(* ---------- *\n !nat left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_nat_l_nonempty: \n \"N ~= {} ==>\n (!nat :N .. Pf) |[X,Y]| Q =T[M,M]\n !nat n:N .. (Pf n |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Alpha_Parallel_Dist_sum_l_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Alpha_Parallel_Dist_nat_l: \n \"(!nat :N .. Pf) |[X,Y]| Q =T[M,M]\n IF (N={}) THEN (DIV |[X,Y]| Q) ELSE (!nat n:N .. (Pf n |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_sum_l, simp)\n\n(* ---------- *\n !nat right\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_nat_r_nonempty: \n \"N ~= {} ==>\n P |[X,Y]| (!nat :N .. Qf) =T[M,M]\n !nat n:N .. (P |[X,Y]| Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspT_Alpha_Parallel_Dist_sum_r_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Alpha_Parallel_Dist_nat_r: \n \"P |[X,Y]| (!nat :N .. Qf) =T[M,M]\n IF (N={}) THEN (P |[X,Y]| DIV) ELSE (!nat n:N .. (P |[X,Y]| Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_sum_r, simp)\n\n(* ---------- *\n !set left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_set_l_nonempty: \n \"Xs ~= {} ==>\n (!set :Xs .. Pf) |[Y,Z]| Q =T[M,M]\n !set X:Xs .. (Pf X |[Y,Z]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspT_Alpha_Parallel_Dist_sum_l_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Alpha_Parallel_Dist_set_l: \n \"(!set :Xs .. Pf) |[Y,Z]| Q =T[M,M]\n IF (Xs={}) THEN (DIV |[Y,Z]| Q) ELSE (!set X:Xs .. (Pf X |[Y,Z]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_sum_l, simp)\n\n(* ---------- *\n !set right\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_set_r_nonempty: \n \"Xs ~= {} ==>\n P |[Y,Z]| (!set :Xs .. Qf) =T[M,M]\n !set X:Xs .. (P |[Y,Z]| Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspT_Alpha_Parallel_Dist_sum_r_nonempty)\n\n(*** Dist ***)\n\nlemma cspT_Alpha_Parallel_Dist_set_r: \n \"P |[Y,Z]| (!set :Xs .. Qf) =T[M,M]\n IF (Xs={}) THEN (P |[Y,Z]| DIV) ELSE (!set X:Xs .. (P |[Y,Z]| Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_sum_r, simp)\n\n(* ---------- *\n ! left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_com_l_nonempty: \n \"A ~= {}\n ==> (! :A .. Pf) |[X,Y]| Q =T[M,M] ! x:A .. (Pf x |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_com_def cspT_Alpha_Parallel_Dist_set_l_nonempty)\n\nlemma cspT_Alpha_Parallel_Dist_com_l: \n \"(! :A .. Pf) |[X,Y]| Q =T[M,M]\n IF (A ={}) THEN (DIV |[X,Y]| Q) ELSE (! x:A .. (Pf x |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_set_l, simp)\n\n(* ---------- *\n ! right\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_com_r_nonempty: \n \"A ~= {}\n ==> P |[X,Y]| (! :A .. Qf) =T[M,M] ! x:A .. (P |[X,Y]| Qf x)\"\nby (simp add: Rep_int_choice_com_def cspT_Alpha_Parallel_Dist_set_r_nonempty)\n\nlemma cspT_Alpha_Parallel_Dist_com_r: \n \"P |[X,Y]| (! :A .. Qf) =T[M,M] \n IF (A ={}) THEN (P |[X,Y]| DIV) ELSE (! x:A .. (P |[X,Y]| Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_set_r, simp)\n\n(* ---------- *\n ! left\n * ---------- *)\n\nlemma cspT_Alpha_Parallel_Dist_f_l_nonempty: \n \"[| inj f ; A ~= {} |]\n ==> (! :A .. Pf) |[X,Y]| Q =T[M,M] ! x:A .. (Pf x |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_f_def cspT_Alpha_Parallel_Dist_com_l_nonempty)\n\nlemma cspT_Alpha_Parallel_Dist_f_l: \n \"(! :A .. Pf) |[X,Y]| Q =T[M,M]\n IF (A ={}) THEN (DIV |[X,Y]| Q) ELSE (! x:A .. (Pf x |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_com_l, simp)\n\nlemma cspT_Alpha_Parallel_Dist_f_r_nonempty: \n \"[| inj f ; A ~= {} |]\n ==> P |[X,Y]| (! :A .. Qf) =T[M,M] ! x:A .. (P |[X,Y]| Qf x)\"\nby (simp add: Rep_int_choice_f_def cspT_Alpha_Parallel_Dist_com_r_nonempty)\n\nlemma cspT_Alpha_Parallel_Dist_f_r: \n \"P |[X,Y]| (! :A .. Qf) =T[M,M] \n IF (A ={}) THEN (P |[X,Y]| DIV) ELSE (! x:A .. (P |[X,Y]| Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspT_rw_left, rule cspT_Alpha_Parallel_Dist_com_r, simp)\n\nlemmas cspT_dist_Alpha_Parallel =\n cspT_Alpha_Parallel_dist_l\n cspT_Alpha_Parallel_dist_r \n\nlemmas cspT_Dist_Alpha_Parallel =\n cspT_Alpha_Parallel_Dist_sum_l \n cspT_Alpha_Parallel_Dist_sum_r \n cspT_Alpha_Parallel_Dist_nat_l \n cspT_Alpha_Parallel_Dist_nat_r \n cspT_Alpha_Parallel_Dist_set_l \n cspT_Alpha_Parallel_Dist_set_r \n cspT_Alpha_Parallel_Dist_com_l \n cspT_Alpha_Parallel_Dist_com_r \n cspT_Alpha_Parallel_Dist_f_l \n cspT_Alpha_Parallel_Dist_f_r \n\nlemmas cspT_Dist_Alpha_Parallel_nonempty =\n cspT_Alpha_Parallel_Dist_sum_l_nonempty \n cspT_Alpha_Parallel_Dist_sum_r_nonempty \n cspT_Alpha_Parallel_Dist_nat_l_nonempty \n cspT_Alpha_Parallel_Dist_nat_r_nonempty \n cspT_Alpha_Parallel_Dist_set_l_nonempty \n cspT_Alpha_Parallel_Dist_set_r_nonempty \n cspT_Alpha_Parallel_Dist_com_l_nonempty\n cspT_Alpha_Parallel_Dist_com_r_nonempty \n cspT_Alpha_Parallel_Dist_f_l_nonempty \n cspT_Alpha_Parallel_Dist_f_r_nonempty \n\n(****************** to add them again ******************)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_dist.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.28423636717820466}} {"text": "(*\n Author: Gerwin Klein\n Copyright 1999 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Correctness of the LBV} *}\n\ntheory LBVCorrect\nimports LBVSpec Typing_Framework\nbegin\n\nlocale lbvs = lbv +\n fixes s\\<^sub>0 :: 'a\n fixes c :: \"'a list\"\n fixes ins :: \"'b list\"\n fixes \\s :: \"'a list\"\n defines phi_def:\n \"\\s \\ map (\\pc. if c!pc = \\ then wtl (take pc ins) c 0 s\\<^sub>0 else c!pc) \n [0.. \\ A\"\n assumes pres: \"pres_type step (size ins) A\"\n\nlemma (in lbvs) phi_None [intro?]:\n \"\\ pc < size ins; c!pc = \\ \\ \\ \\s!pc = wtl (take pc ins) c 0 s\\<^sub>0\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_Some [intro?]:\n \"\\ pc < size ins; c!pc \\ \\ \\ \\ \\s!pc = c!pc\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_len [simp]: \"size \\s = size ins\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) wtl_suc_pc:\n assumes all: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes pc: \"pc+1 < size ins\"\n shows \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\\\<^sub>r \\s!(pc+1)\"\n(*<*)\nproof -\n from all pc\n have \"wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s\\<^sub>0) \\ T\" by (rule wtl_all)\n with pc show ?thesis by (simp add: phi_def wtc split: split_if_asm)\nqed\n(*>*)\n\nlemma (in lbvs) wtl_stable:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes s\\<^sub>0: \"s\\<^sub>0 \\ A\" and pc: \"pc < size ins\" \n shows \"stable r step \\s pc\"\n(*<*)\nproof (unfold stable_def, clarify)\n fix pc' s' assume step: \"(pc',s') \\ set (step pc (\\s ! pc))\" \n (is \"(pc',s') \\ set (?step pc)\")\n \n from bounded pc step have pc': \"pc' < size ins\" by (rule boundedD)\n\n have tkpc: \"wtl (take pc ins) c 0 s\\<^sub>0 \\ \\\" (is \"?s\\<^sub>1 \\ _\") using wtl by (rule wtl_take)\n have s\\<^sub>2: \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\ \\\" (is \"?s\\<^sub>2 \\ _\") using wtl by (rule wtl_take)\n \n from wtl pc have wt_s\\<^sub>1: \"wtc c pc ?s\\<^sub>1 \\ \\\" by (rule wtl_all)\n\n have c_Some: \"\\pc t. pc < size ins \\ c!pc \\ \\ \\ \\s!pc = c!pc\" \n by (simp add: phi_def)\n have c_None: \"c!pc = \\ \\ \\s!pc = ?s\\<^sub>1\" using pc ..\n\n from wt_s\\<^sub>1 pc c_None c_Some\n have inst: \"wtc c pc ?s\\<^sub>1 = wti c pc (\\s!pc)\"\n by (simp add: wtc split: split_if_asm)\n\n have \"?s\\<^sub>1 \\ A\" using pres cert s\\<^sub>0 wtl pc by (rule wtl_pres)\n with pc c_Some cert c_None\n have \"\\s!pc \\ A\" by (cases \"c!pc = \\\") (auto dest: cert_okD1)\n with pc pres\n have step_in_A: \"snd`set (?step pc) \\ A\" by (auto dest: pres_typeD2)\n\n show \"s' \\\\<^sub>r \\s!pc'\" \n proof (cases \"pc' = pc+1\")\n case True\n with pc' cert\n have cert_in_A: \"c!(pc+1) \\ A\" by (auto dest: cert_okD1)\n from True pc' have pc1: \"pc+1 < size ins\" by simp\n with tkpc have \"?s\\<^sub>2 = wtc c pc ?s\\<^sub>1\" by - (rule wtl_Suc)\n with inst \n have merge: \"?s\\<^sub>2 = merge c pc (?step pc) (c!(pc+1))\" by (simp add: wti)\n also from s\\<^sub>2 merge have \"\\ \\ \\\" (is \"?merge \\ _\") by simp\n with cert_in_A step_in_A\n have \"?merge = (map snd [(p',t') \\ ?step pc. p'=pc+1] \\\\<^bsub>f\\<^esub> c!(pc+1))\"\n by (rule merge_not_top_s) \n finally have \"s' \\\\<^sub>r ?s\\<^sub>2\" using step_in_A cert_in_A True step \n by (auto intro: pp_ub1')\n also from wtl pc1 have \"?s\\<^sub>2 \\\\<^sub>r \\s!(pc+1)\" by (rule wtl_suc_pc)\n also note True [symmetric]\n finally show ?thesis by simp \n next\n case False\n from wt_s\\<^sub>1 inst \n have \"merge c pc (?step pc) (c!(pc+1)) \\ \\\" by (simp add: wti)\n with step_in_A have \"\\(pc', s')\\set (?step pc). pc'\\pc+1 \\ s' \\\\<^sub>r c!pc'\"\n by - (rule merge_not_top)\n with step False have ok: \"s' \\\\<^sub>r c!pc'\" by blast\n moreover from ok have \"c!pc' = \\ \\ s' = \\\" by simp\n moreover from c_Some pc' have \"c!pc' \\ \\ \\ \\s!pc' = c!pc'\" by auto\n ultimately show ?thesis by (cases \"c!pc' = \\\") auto \n qed\nqed\n(*>*)\n \nlemma (in lbvs) phi_not_top:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and pc: \"pc < size ins\"\n shows \"\\s!pc \\ \\\"\n(*<*)\nproof (cases \"c!pc = \\\")\n case False with pc\n have \"\\s!pc = c!pc\" ..\n also from cert pc have \"\\ \\ \\\" by (rule cert_okD4)\n finally show ?thesis .\nnext\n case True with pc\n have \"\\s!pc = wtl (take pc ins) c 0 s\\<^sub>0\" ..\n also from wtl have \"\\ \\ \\\" by (rule wtl_take)\n finally show ?thesis .\nqed\n(*>*)\n\nlemma (in lbvs) phi_in_A:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and s\\<^sub>0: \"s\\<^sub>0 \\ A\"\n shows \"\\s \\ list (size ins) A\"\n(*<*)\nproof -\n { fix x assume \"x \\ set \\s\"\n then obtain xs ys where \"\\s = xs @ x # ys\" \n by (auto simp add: in_set_conv_decomp)\n then obtain pc where pc: \"pc < size \\s\" and x: \"\\s!pc = x\"\n by (simp add: that [of \"size xs\"] nth_append)\n \n from pres cert wtl s\\<^sub>0 pc \n have \"wtl (take pc ins) c 0 s\\<^sub>0 \\ A\" by (auto intro!: wtl_pres)\n moreover\n from pc have \"pc < size ins\" by simp\n with cert have \"c!pc \\ A\" ..\n ultimately\n have \"\\s!pc \\ A\" using pc by (simp add: phi_def)\n hence \"x \\ A\" using x by simp\n } \n hence \"set \\s \\ A\" ..\n thus ?thesis by (unfold list_def) simp\nqed\n(*>*)\n\nlemma (in lbvs) phi0:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" and 0: \"0 < size ins\"\n shows \"s\\<^sub>0 \\\\<^sub>r \\s!0\"\n(*<*)\nproof (cases \"c!0 = \\\")\n case True\n with 0 have \"\\s!0 = wtl (take 0 ins) c 0 s\\<^sub>0\" ..\n moreover have \"wtl (take 0 ins) c 0 s\\<^sub>0 = s\\<^sub>0\" by simp\n ultimately have \"\\s!0 = s\\<^sub>0\" by simp\n thus ?thesis by simp\nnext\n case False\n with 0 have \"\\s!0 = c!0\" ..\n moreover \n have \"wtl (take 1 ins) c 0 s\\<^sub>0 \\ \\\" using wtl by (rule wtl_take)\n with 0 False \n have \"s\\<^sub>0 \\\\<^sub>r c!0\" by (auto simp add: neq_Nil_conv wtc split: split_if_asm)\n ultimately\n show ?thesis by simp\nqed\n(*>*)\n\n\n\n\n\ntheorem (in lbvs) wtl_sound_strong:\n assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\ \\\" \n assumes s\\<^sub>0: \"s\\<^sub>0 \\ A\" and ins: \"0 < size ins\"\n shows \"\\\\s \\ list (size ins) A. wt_step r \\ step \\s \\ s\\<^sub>0 \\\\<^sub>r \\s!0\"\n(*<*)\nproof -\n have \"\\s \\ list (size ins) A\" using wtl s\\<^sub>0 by (rule phi_in_A)\n moreover\n have \"wt_step r \\ step \\s\"\n proof (unfold wt_step_def, intro strip conjI)\n fix pc assume \"pc < size \\s\"\n then obtain pc: \"pc < size ins\" by simp\n with wtl show \"\\s!pc \\ \\\" by (rule phi_not_top)\n from wtl s\\<^sub>0 and pc show \"stable r step \\s pc\" by (rule wtl_stable)\n qed\n moreover from wtl ins have \"s\\<^sub>0 \\\\<^sub>r \\s!0\" by (rule phi0)\n ultimately show ?thesis by fast\nqed\n(*>*)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/DFA/LBVCorrect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2842363600202124}} {"text": "section \\List Comprehension\\\n\ntheory List_Comprehension\n imports Data_List\nbegin\n\nno_notation\n disj (infixr \"|\" 30)\n\nnonterminal llc_qual and llc_quals\n\nsyntax\n \"_llc\" :: \"'a \\ llc_qual \\ llc_quals \\ ['a]\" (\"[_ | __\")\n \"_llc_gen\" :: \"'a \\ ['a] \\ llc_qual\" (\"_ <- _\")\n \"_llc_guard\" :: \"tr \\ llc_qual\" (\"_\")\n \"_llc_let\" :: \"letbinds \\ llc_qual\" (\"let _\")\n \"_llc_quals\" :: \"llc_qual \\ llc_quals \\ llc_quals\" (\", __\")\n \"_llc_end\" :: \"llc_quals\" (\"]\")\n \"_llc_abs\" :: \"'a \\ ['a] \\ ['a]\"\n\ntranslations\n \"[e | p <- xs]\" => \"CONST concatMap\\(_llc_abs p [e])\\xs\"\n \"_llc e (_llc_gen p xs) (_llc_quals q qs)\"\n => \"CONST concatMap\\(_llc_abs p (_llc e q qs))\\xs\"\n \"[e | b]\" => \"If b then [e] else []\"\n \"_llc e (_llc_guard b) (_llc_quals q qs)\"\n => \"If b then (_llc e q qs) else []\"\n \"_llc e (_llc_let b) (_llc_quals q qs)\"\n => \"_Let b (_llc e q qs)\"\n\nparse_translation \\\nlet open HOLCF_Library in\n let\n val NilC = Syntax.const @{const_syntax \"Nil\"};\n\n fun Lam x = Syntax.const @{const_syntax \"Abs_cfun\"} $ x;\n\n fun fresh_var ts ctxt =\n let\n val ctxt' = fold Variable.declare_term ts ctxt\n in\n singleton (Variable.variant_frees ctxt' []) (\"x\", dummyT)\n end\n\n fun pat_tr ctxt p e = (* %x. case x of p => e | _ => [] *)\n let\n val x = Free (fresh_var [p, e] ctxt);\n val case1 = Syntax.const @{syntax_const \"_case1\"} $ p $ e;\n val case2 =\n Syntax.const @{syntax_const \"_case1\"} $\n Syntax.const @{const_syntax Pure.dummy_pattern} $ NilC;\n val cs = Syntax.const @{syntax_const \"_case2\"} $ case1 $ case2;\n in\n (* FIXME: handle HOLCF patterns correctly *)\n Syntax_Trans.abs_tr [x, Case_Translation.case_tr false ctxt [x, cs]]\n |> Lam\n end\n\n fun abs_tr ctxt [p, e] =\n (case Term_Position.strip_positions p of\n Free (s, T) => Lam (Syntax_Trans.abs_tr [p, e])\n | _ => pat_tr ctxt p e)\n\n in [(@{syntax_const \"_llc_abs\"}, abs_tr)] end\nend\n\\\n\nlemma concatMap_singleton [simp]:\n \"concatMap\\(\\ x. [f\\x])\\xs = map\\f\\xs\"\n by (induct xs) simp_all\n\nlemma listcompr_filter [simp]:\n \"[x | x <- xs, P\\x] = filter\\P\\xs\"\nproof (induct xs)\n case (Cons a xs)\n then show ?case by (cases \"P\\a\"; simp)\nqed simp_all\n\nlemma \"[y | let y = x*2; z = y, x <- xs] = A\"\n apply simp\n oops\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/HOLCF-Prelude/List_Comprehension.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.28423636002021235}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory PackedTypes\nimports \"../lib/$L4V_ARCH/WordSetup\" CProof\nbegin\n\nsection {* Underlying definitions for the class axioms *}\n\ntext {* field_access / field_update is the identity for packed types *}\n\ndefinition\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext {* field_access is independent of the underlying bytes *}\n\ndefinition\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection {* Lemmas about td_fafu_idem *}\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: if_split_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have\n updeq: \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n by (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n using mlt nlex xln lbs lbs' wf wfts `td_fafu_idem s` `wf_fd s`\n by (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply -\n apply (cases p')\n apply (simp split: if_split_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts `td_fafu_idem s` `wf_fd s`\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using `field_lookup_list (p' # ts') f 0 = Some (s, n)` by (simp split: option.splits)\nqed (clarsimp split: if_split_asm)+\n\nsubsection {* td_fa_hi *}\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"op @\"])\n apply (erule Cons_typ_desc.hyps, simp, simp)\n apply (erule Cons_typ_desc.hyps, simp, simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection {* Simp rules for deriving packed props from the type combinators *}\n\nsubsection {* td_fafu_idem *}\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fafu_idem_list_append)\n done\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\ field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\n(* Beer crime? *)\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply rule\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self)\n apply simp\n apply simp\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\ fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fafu_idem_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fafu_idem_array_n)\n apply simp\n done\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection {* td_fa_hi *}\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fa_hi_list_append)\n done\n\n(* Beer crime? *)\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fa_hi_list_append)\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fa_hi_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fa_hi_array_n)\n apply simp\n done\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection {* The type class and simp sets *}\n\ntext {* Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity *}\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n -- \"Axioms\"\n td_fafu_idem\n -- \"Combinators\"\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n -- \"Constructors\"\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n -- \"Axioms\"\n td_fa_hi\n -- \"Combinators\"\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n -- \"Constructors\"\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection {* Instances *}\n\ntext {* Words (of multiple of 8 size) are packed *}\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n apply(intro_classes)\n apply (rule td_fafu_idem_word)\n apply (rule td_fa_hi_word)\n done\nend\n\ntext {* Pointers are always packed *}\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n apply intro_classes\n apply (simp add: fa_fu_idem_def word_rsplit_rcat_size word_size)\n apply (simp add: fa_heap_indep_def)\n done\nend\n\ntext {* Arrays of packed types are in turn packed *}\n\nclass array_outer_packed = packed_type + array_outer_max_size\nclass array_inner_packed = array_outer_packed + array_inner_max_size\n\ninstance word :: (len8)array_outer_packed ..\ninstance word :: (len8)array_inner_packed ..\n\ninstance array :: (array_outer_packed, array_max_count) packed_type\n apply(intro_classes)\n apply (simp add: td_fafu_idem_intro_simps)\n apply (simp add: td_fa_hi_intro_simps)\n done\n\ninstance array :: (array_inner_packed, array_max_count) array_outer_packed ..\n\nsection {* Theorems about packed types *}\n\nsubsection {* td_fa_hi *}\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows\n \"heap_update p v (heap_update p u h) = heap_update p v h\"\n apply(simp add:heap_update_def)\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply((subst heap_update_mem_same_point, simp, simp)+)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence)\n apply(simp)\n prefer 2\n apply(force)\n apply(simp)\n apply((subst heap_update_nmem_same, simp)+)\n apply(rule refl)\ndone\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"(hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp)) =\n (hrs_mem_update (heap_update p v) hp)\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection {* td_fafu_idem *}\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n apply assumption\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def using lbs\n apply -\n apply (rule heap_independence)\n apply simp\n apply (simp add: size_of_def)\n done\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n\n show ?case\n proof (cases n')\n case 0 thus ?thesis using `Suc m' < n'` by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using `Suc m' < n'` by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n(* Similar in TypHeap, but for w32 *)\nlemma unat_minus':\n fixes x :: \"'a :: len word\"\n shows \"x \\ 0 \\ unat (-x) = 2 ^ len_of TYPE('a) - unat x\"\n apply (simp add: unat_def word_minus_def)\n apply (simp add: int_word_uint zmod_zminus1_eq_if uint_0_iff)\n apply (subst nat_diff_distrib)\n apply simp\n apply (rule order_less_imp_le [OF uint_lt2p])\n apply (clarsimp simp: nat_power_eq)\n done\n\nlemma word_wrap_of_natD:\n fixes x :: \"'a :: len word\"\n assumes wraps: \"\\ x \\ x + of_nat n\"\n shows \"\\k. x + of_nat k = 0 \\ k \\ n\"\nproof -\n show ?thesis\n proof (rule exI [where x = \"unat (- x)\"], intro conjI)\n show \"x + of_nat (unat (-x)) = 0\"\n by simp\n next\n show \"unat (-x) \\ n\"\n proof (subst unat_minus')\n from wraps show \"x \\ 0\"\n by (rule contrapos_pn, simp add: not_le)\n next\n show \"2 ^ len_of TYPE('a) - unat x \\ n\" using wraps\n apply (simp add: no_olen_add_nat le_diff_conv not_less)\n apply (erule order_trans)\n apply (simp add: unat_of_nat)\n done\n qed\n qed\nqed\n\nlemma nat_le_Suc_less:\n \"0 < y \\ (x \\ y - Suc 0) = (x < y)\"\n by arith\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: addr_bitsize word) = n\" using szn szb\n by (simp add: unat_simps)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n by (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n apply -\n apply (drule c_guard_no_wrap)\n apply (simp add: std)\n done\n\n have szt': \"size_td t < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (subst std)\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n from xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n by (rule intvl_le_lower)\n next\n from szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: addr_bitsize word)\"\n apply -\n apply (rule of_nat_mono_maybe_le)\n apply simp_all\n done\n with al show \"ptr_val p \\ ptr_val p + of_nat n\"\n by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n by (simp add: word_le_nat_alt uofn)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (drule (2) intvl_less_upper)\n apply (simp add: add.assoc)\n done\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n apply -\n apply (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n apply (metis (hide_lams, mono_tags) add.commute of_nat_add)\n apply (erule (2) intvl_le_lower)\n done\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: addr_bitsize word) = n + size_td t - 1\"\n using t0 order_le_less_trans [OF szt1 szb]\n apply (subst Abs_fnat_homs(1))\n apply (subst unat_of_nat)\n apply simp\n done\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n by (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n by simp\n\n show \"td_fafu_idem t\"\n by (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n by (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n by (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n by (simp add: unat_sub [OF ofn] uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n by simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n by (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n (update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n have \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n proof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n by (subst add.commute, rule intvl_less_upper)\n show \"ptr_val p \\ x\" using xin al szb\n by (rule intvl_le_lower)\n qed\n thus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n by (simp add: word_le_nat_alt size_of_def unat_of_nat)\n\n show \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n apply -\n apply (erule intvl_cut)\n apply simp\n apply (rule max_size)\n done\n\n show \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n (* clag *)\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n using wf_fd [where 'a = 'a]\n by (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n by (simp add: size_of_def)\n\n have \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n apply (subst heap_list_nth)\n apply (rule unx)\n apply simp\n done\n\n thus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n unfolding h_val_def\n by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.28423243351001287}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchVSpaceLookup_AI\nimports \"../SubMonad_AI\"\n \"Lib.Crunch_Instances_NonDet\"\nbegin\n\ndefinition\n \"lookup_walk cs m ref p \\ {(r, q). \\h. ref = h @ r \\ (r, q) \\ cs\\<^sup>* `` m \\ (([], q),h, p) \\ cs\\<^sup>*}\"\n\ndefinition\n \"trans_depends kh cs f \\ \\q h p. (([],q),h,p) \\ cs = (\\obj. obj = kh q \\ f obj p h)\"\n\ndefinition\n \"lookup_leaf ptr cs = {(ref,p). (([],ptr),ref, p) \\ cs^*}\"\n\ndefinition\nlookup_refs ::\"'c \\ ('c \\ 'b \\ 'a list \\ bool) \\ ('a list \\ 'b) set\"\nwhere \"lookup_refs obj f \\ {(h,p). f obj p h}\"\n\ndefinition\nlookupable_refs :: \"(('a list \\ 'b) \\ 'a list \\ 'b) set \\ 'a list set \\ ('a list \\ 'b) set \\ ('a list \\ 'b) set\"\nwhere \"lookupable_refs cs refs m \\ {(ref, p). \\tref href. href\\refs \\ ref=tref@href \\ (tref,p)\\cs^* `` m}\"\n\ndefinition\n \"reachable vset \\ (\\(ref, p). p) ` vset\"\n\nlocale wellformed_lookup =\n fixes cs :: \"(('c list \\ 'a) \\ 'c list \\ 'a) set\" and kh and f\n assumes trans_depends: \"trans_depends kh cs f\"\n assumes lookup1_is_append:\n \"((r , q), rs, p) \\ cs \\ \\ref. rs = ref # r\"\n assumes lookup1_append:\n \"((ra @ b, q), r @ b, p) \\ cs \\ ((ra, q), r, p) \\ cs\"\n assumes lookup1_cut:\n \"((ra, q), r, p) \\ cs \\ ((ra @ b, q), r @ b, p) \\ cs\"\n assumes graph_inject:\n \"\\p q obj ref. \\f obj p ref; f obj q ref\\ \\ p = q\"\n assumes graph_single_step:\n \"\\p obj ref. \\f obj p ref\\ \\ \\r. ref = [r]\"\n\ncontext wellformed_lookup\nbegin\n\nlemma lookup_refs_lookup1:\n \"lookup_refs (kh ptr) f = {(h,p). (([],ptr),h,p) \\ cs}\"\n apply (insert trans_depends)\n apply (clarsimp simp: trans_depends_def lookup_refs_def)\n done\n\nlemma lookupable_refs_reach_self:\n \"(rs, ptr) \\ lookupable_refs cs {ref. (ref, ptr) \\ cs\\<^sup>* `` rset} refs\n \\ \\rs'. (rs', ptr) \\ cs^* `` rset\"\n apply (clarsimp simp: lookupable_refs_def Image_def)\n apply fastforce\n done\n\nlemma lookup1_append_singleton:\n \"((a, b), ref # a, q) \\ cs \\ (([], b), [ref], q) \\ cs\"\n apply (rule lookup1_append)\n apply fastforce\n done\n\nlemma lookup1_cut_singleton:\n \"(([], b), [ref], q) \\ cs \\ ((a, b), ref # a, q) \\ cs \"\n apply (drule lookup1_cut)\n apply fastforce\n done\n\nlemma trans_dependsD:\n \"(([],p), ref, q ) \\ cs \\ f (kh p) q ref\"\n apply (insert trans_depends)\n apply (simp add: trans_depends_def)\n done\n\nlemma trans_depends_eq:\n \"(([],q),h,p) \\ cs = f (kh q) p h\"\n apply (insert trans_depends)\n apply (clarsimp simp: trans_depends_def)\n done\n\nlemma lookup_empty_refl:\n \"((a, p), [], q) \\ cs\\<^sup>* \\ a = [] \\ p = q\"\n apply (erule rtranclE)\n apply simp\n apply (case_tac y)\n apply (clarsimp dest!: lookup1_is_append)\n done\n\nlemma lookup_empty_refl_eq[simp]:\n \"((a, p), [], q) \\ cs\\<^sup>* \\ a = [] \\ p = q\"\n using lookup_empty_refl by auto\n\nlemma lookup1_same_leaf:\n \"\\(a, refs, p) \\ cs; (a, refs, q) \\ cs\\ \\ p = q\"\n apply (case_tac a)\n apply clarsimp\n apply (frule lookup1_is_append)\n apply clarsimp\n apply (drule lookup1_append_singleton)\n apply (drule lookup1_append_singleton)\n apply (clarsimp dest!: trans_dependsD)\n apply (drule graph_inject)\n apply simp+\n done\n\nlemma lookup_ref_step:\n \"((ref, ptr), ref', p) \\ cs\\<^sup>* \\ \\r. ref' = r @ ref\"\n proof (induct \"length ref'\" arbitrary: ref' ref ptr p)\n case 0\n assume xs: \"0 = length ref'\"\n and \"((ref, ptr), ref', p) \\ cs\\<^sup>*\"\n thus ?case\n apply simp\n done\n next\n case Suc\n show ?case\n apply (cut_tac Suc.prems Suc.hyps(2))\n apply (erule rtranclE)\n apply fastforce\n apply (case_tac y)\n apply (case_tac ref')\n apply clarsimp\n apply simp\n apply (drule Suc.hyps(1)[rotated])\n apply (clarsimp dest!: lookup1_is_append )+\n done\n qed\n\nlemma lookup_trancl_append_1: (* This is true because the lengh of the lookup is always increased by 1 *)\n \"((ra @ [b], q), r @ [b], p) \\ cs\\<^sup>*\n \\ ((ra, q), r, p) \\ cs\\<^sup>*\"\n proof (induct \"length r - length ra\" arbitrary: ra r q p)\n case 0\n assume \"0 = length r - length ra\"\n and \"((ra @ [b], q), r @ [b], p) \\ cs\\<^sup>*\"\n thus ?case\n apply simp\n apply (erule rtranclE)\n apply simp\n apply (case_tac y)\n apply simp\n apply (frule lookup_ref_step)\n apply (clarsimp dest!: lookup1_is_append)\n done\n next\n case Suc\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (erule rtranclE)\n apply simp\n apply (case_tac y)\n apply clarsimp\n apply (frule lookup_ref_step)\n apply clarsimp\n apply (drule Suc.hyps(1)[where r = \"a @ b\" for a b, rotated,simplified])\n apply (clarsimp dest!: lookup1_is_append)\n apply (drule lookup1_append[where ra = \"a @ b\" for a b, simplified])\n apply (erule rtrancl.intros)\n apply simp\n done\n qed\n\n\nlemma lookup_trancl_append:\n \"((ra @ ref, b), r @ ref, p) \\ cs^* \\ ((ra, b), r, p) \\ cs^*\"\n proof (induct \"length ref\" arbitrary: ref ra r b p)\n case 0\n assume \"((ra @ ref, b), r @ ref, p) \\ cs ^*\"\n and \" 0 = length ref\"\n thus ?case\n by simp\n next\n case Suc\n have t: \"\\a b c. a @ b # c = (a @ [b]) @ c\"\n by auto\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (case_tac ref)\n apply clarsimp+\n apply (subst(asm) t)\n apply (subst(asm) t[where a = r])\n apply (frule(1) Suc.hyps(1)[rotated])\n apply (drule lookup_trancl_append_1)\n apply fastforce\n done\n qed\n\nlemma lookup_leaf_from_lookup:\n assumes neq: \"ref' \\ ref\"\n shows \"\\((ref, p), ref', q) \\ cs\\<^sup>* \\\n \\ \\r ptr. ref' = r @ ref \\ (([],p),[last r],ptr) \\ cs \\ (r,q) \\ lookup_leaf p cs\"\n apply (frule lookup_ref_step)\n apply clarsimp\n apply (erule converse_rtranclE)\n apply (insert neq)\n apply clarsimp\n apply (case_tac y)\n apply (rule conjI)\n apply clarsimp\n apply (rename_tac r mref ptr)\n apply (rule_tac x = ptr in exI)\n subgoal ex\n apply (clarsimp dest!: lookup_ref_step)\n apply (rule_tac ra = \"[]\" and b = ref in lookup1_append)\n apply (frule lookup1_is_append)\n apply clarsimp\n done\n apply (clarsimp simp: lookup_leaf_def)\n apply (rule converse_rtrancl_into_rtrancl)\n apply (rule ex)\n apply simp+\n apply (rule_tac ref = ref in lookup_trancl_append)\n apply (frule lookup_ref_step)\n apply (clarsimp dest!: lookup1_is_append)\n done\n\nlemma lookupE:\n assumes rcl: \"((ref, p), ref', q) \\ cs\\<^sup>*\"\n assumes eq: \"\\ref' = ref; p = q\\ \\ P ref' ref p q cs\"\n and neq: \"\\r ptr. \\ref' \\ ref; ref' = r @ ref; (([],p),[last r],ptr) \\ cs; (r,q) \\ lookup_leaf p cs\\ \\ P ref' ref p q cs\"\n shows \"P ref' ref p q cs\"\n apply (insert rcl)\n apply (case_tac \"ref' = ref\")\n apply (rule eq)\n apply simp\n apply (erule rtranclE)\n apply simp\n apply (clarsimp dest!: lookup1_is_append lookup_ref_step)\n apply (frule(1) lookup_leaf_from_lookup)\n apply (elim disjE conjE exE)\n apply (rule neq)\n apply simp+\n done\n\nlemma lookup_forwardE:\n assumes rcl: \"(([], p), ref, q) \\ cs\\<^sup>*\"\n assumes eq: \"\\ref = []; p = q\\ \\ P ref p q cs\"\n and neq1: \"\\r. \\ref = [r]; (([], p), [r], q) \\ cs\\ \\ P ref p q cs\"\n and neq: \"\\r ptr ref'. \\ref \\ []; ref = r @ [ref']; (([],p),[ref'],ptr) \\ cs; (([], ptr), r, q) \\ cs\\<^sup>*\\ \\ P ref p q cs\"\n shows \"P ref p q cs\"\n apply (insert rcl)\n apply (erule converse_rtranclE)\n apply (rule eq)\n apply (simp add: eq)\n apply simp\n apply clarsimp\n apply (frule lookup_ref_step)\n apply (frule lookup1_is_append)\n apply (elim exE)+\n apply (case_tac r)\n apply (rule neq1)\n apply simp\n apply clarsimp\n apply (erule rtranclE, simp)\n apply (clarsimp dest!: lookup1_is_append)\n apply clarsimp\n apply (drule lookup_trancl_append[where ra = \"[]\" and r = \"h # g\" for h g,simplified])\n apply (drule neq[rotated 2])\n apply simp+\n done\n\nlemma lookup_rtrancl_stepD:\n \"(([],p), [r], q) \\ cs^* \\ (([],p),[r],q) \\ cs\"\n apply (erule rtranclE)\n apply simp\n apply clarsimp\n apply (frule lookup_ref_step)\n apply clarsimp\n apply (erule rtranclE)\n apply simp\n apply (clarsimp dest!: lookup_ref_step lookup1_is_append)\n done\n\nlemma lookup_rtrancl_stepsD:\n \"(([], p), r @ [ref'], q) \\ cs\\<^sup>* \\ \\ptr. (([],p),[ref'],ptr) \\ cs \\ (([], ptr), r, q) \\ cs\\<^sup>*\"\n apply (erule lookup_forwardE)\n apply clarsimp+\n apply force+\n done\n\nlemma lookup_trancl_cut_1:\n (* This is true because the lengh of the lookup is always increased by 1 *)\n \"((ra, q), r, p) \\ cs\\<^sup>* \\ ((ra @ [b], q), r @ [b], p) \\ cs\\<^sup>*\"\n proof (induct \"length r - length ra\" arbitrary: ra r q p)\n case 0\n assume \" 0 = length r - length ra\"\n and \"((ra , q), r , p) \\ cs\\<^sup>*\"\n thus ?case\n apply simp\n apply (frule lookup_ref_step)\n apply clarsimp\n apply (erule rtranclE)\n apply simp\n apply (case_tac y)\n apply simp\n apply (frule lookup_ref_step)\n apply (clarsimp dest!: lookup1_is_append)\n done\n next\n case Suc\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (erule rtranclE)\n apply simp\n apply (case_tac y)\n apply clarsimp\n apply (frule lookup_ref_step)\n apply clarsimp\n apply (drule Suc.hyps(1)[where r = \"a @ b\" for a b, rotated,simplified])\n apply (clarsimp dest!: lookup1_is_append)\n apply (erule rtrancl.intros)\n apply (frule lookup1_cut)\n apply simp\n done\n qed\n\nlemma lookup_trancl_cut:\n \"((ra, b), r, p) \\ cs\\<^sup>* \\ ((ra @ ref, b), r @ ref, p) \\ cs\\<^sup>*\"\n proof (induct \"length ref\" arbitrary: ref ra r b p)\n case 0\n assume \"((ra, b), r, p) \\ cs\\<^sup>*\"\n and \" 0 = length ref\"\n thus ?case\n by simp\n next\n case Suc\n have t: \"\\a b c. a @ b # c = (a @ [b]) @ c\"\n by auto\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (case_tac ref rule: rev_cases)\n apply clarsimp+\n apply (frule(1) Suc.hyps(1)[rotated])\n apply (drule lookup_trancl_cut_1)\n apply (drule lookup_trancl_cut_1)\n apply fastforce\n done\n qed\n\nlemma empty_lookup_walk:\n \"lookup_walk cs m [] p = {ptr. ptr \\ m \\ fst ptr = [] \\ snd ptr = p }\"\n by (fastforce simp: lookup_walk_def)\n\nlemma lookup_walk_stepI1:\n \"\\p \\ lookup_walk cs m ref ptr; (([], ptr), [q], ptr') \\ cs\\ \\ p \\ lookup_walk cs m (q # ref) ptr'\"\n apply (clarsimp simp: lookup_walk_def)\n apply (rule conjI, fastforce)\n apply (erule rtrancl_into_rtrancl)\n apply (erule lookup1_cut[where ra = \"[]\" and r = \"[q]\", simplified])\n done\n\nlemma lookup_walk_stepsI1:\n \"\\p \\ lookup_walk cs m ref ptr; (([], ptr), refs, ptr') \\ cs^*\\ \\ p \\ lookup_walk cs m (refs @ ref) ptr'\"\n apply (clarsimp simp: lookup_walk_def)\n apply (rule conjI, fastforce)\n apply (erule rtrancl_trans)\n apply (erule lookup_trancl_cut[where ra = \"[]\" and r = \"refs\", simplified])\n done\n\nlemma lookup_walk_stepI2:\n \"\\(ref, ptr) \\ lookup_walk cs m ref ptr; (([], ptr), [q], ptr') \\ cs\\\n \\ (q#ref,ptr') \\ lookup_walk cs m (q # ref) ptr'\"\n apply (clarsimp simp: lookup_walk_def Image_def)\n apply (erule bexI[rotated])\n apply (erule rtrancl_into_rtrancl)\n apply (drule lookup1_cut)\n apply fastforce\n done\n\nlemma lookup_walk_step_hdD:\n \"(refs, p) \\ lookup_walk cs m refs p \\ (refs, p)\\ m \\ (\\y. (tl refs,y) \\ lookup_walk cs m (tl refs) y \\ (([],y), [hd refs], p) \\ cs)\"\n apply (clarsimp simp: lookup_walk_def del: disjCI)\n apply (erule rtranclE)\n apply simp\n apply (rule disjI2)\n apply (case_tac y, clarsimp)\n apply (frule lookup1_is_append)\n apply clarsimp\n apply (intro conjI exI)\n apply fastforce\n apply (erule lookup1_append_singleton)\n done\n\nlemma lookup_walk_stepD:\n \"p \\ lookup_walk cs m (ref # refs) q\n \\ p = (ref # refs, q)\n \\ (\\ptr r. r @ (fst p) = refs \\ p \\ lookup_walk cs m refs ptr \\ (([],ptr),[ref], q) \\ cs)\"\n apply (clarsimp simp: lookup_walk_def del: disjCI)\n apply (erule rtranclE)\n apply clarsimp\n apply (case_tac ya, clarsimp del: disjCI)\n apply (frule lookup1_is_append)\n apply (clarsimp del: disjCI)\n apply (rule conjI)\n apply force\n apply (intro exI conjI)\n apply force\n apply (erule lookup1_append_singleton)\n done\n\nlemma reachable_walk:\n \"(ref, p) \\ (cs^* `` m) \\ (ref, p) \\ lookup_walk cs m ref p\"\n by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_trans_eq:\n \"((refs, b), refs, p) \\ cs\\<^sup>* \\ b = p\"\n by (erule lookup_trancl_append[where ra = \"[]\" and r = \"[]\" , simplified])\n\nlemma lookup1_same_parent:\n \"\\(a, refs, p) \\ cs; (b, refs, q) \\ cs\\ \\ fst a = fst b\"\n apply (insert trans_depends)\n apply (case_tac a,case_tac b)\n apply (clarsimp dest!: lookup1_is_append)\n done\n\nlemma lookupable_is_unique:\n \"\\(sref, refs, p) \\ cs^*; (sref, refs, q) \\ cs^* \\\n \\ p = q\"\n proof (induct \"length refs - length (fst sref)\" arbitrary: p q sref refs)\n case 0\n thus ?case\n apply (insert \"local.0.prems\" \"local.0.hyps\")\n apply (cases sref, simp)\n apply (case_tac \"fst sref = refs\")\n apply (clarsimp dest!: lookup_trans_eq)\n apply clarsimp\n apply (drule lookup_leaf_from_lookup[rotated])\n apply simp\n apply clarsimp\n done\n next\n case Suc\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (erule rtranclE, simp)\n apply (erule rtranclE, simp)\n apply (frule_tac a = y and b = ya in lookup1_same_parent)\n apply simp\n apply (case_tac y, clarsimp)\n apply (drule(1) Suc.hyps(1)[rotated])\n apply (fastforce dest!: lookup1_is_append)\n apply clarsimp\n apply (erule(1) lookup1_same_leaf)\n done\n qed\n\nlemma lookup_walk_reduce:\n \"(ref, ptr) \\ lookup_walk cs m refs q\n \\ (ref, ptr) \\ lookup_walk cs m ref ptr\"\n by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_walk_trivial:\n \"a \\ lookup_walk cs m ref ptr\n \\ (ref, ptr) \\ lookup_walk cs m ref ptr\"\n apply (clarsimp simp: lookup_walk_def Image_def)\n apply (erule bexI[rotated])\n apply (erule rtrancl_trans)\n apply clarsimp\n apply (drule_tac ref = x in lookup_trancl_cut)\n apply clarsimp\n done\n\nlemma lookup_walk_imp_reachable:\n \"p \\ lookup_walk cs m r ptr \\ (r, ptr) \\ cs^* `` m\"\n apply (clarsimp simp: lookup_walk_def Image_def)\n apply (erule bexI[rotated])\n apply (erule rtrancl_trans)\n apply (erule lookup_trancl_cut[where ra = \"[]\", simplified])\n done\n\nlemma lookup_trancl_walk:\n \"(([], pa), ref, rptr) \\ cs\\<^sup>* \\ (ref, rptr) \\ lookup_walk cs {([],pa)} ref rptr\"\n by (clarsimp simp: lookup_walk_def)\n\nlemma lookup1_eq_ref:\n \"(ref, ptr) \\ lookup_walk cs m ref p \\ p = ptr\"\n by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_walk_decomp:\n \"(a, ptr) \\ lookup_walk cs rset r rptr \\\n \\h. r = h @ a \\ (h,rptr) \\ lookup_walk cs ({([], ptr)}) h rptr\"\n apply (clarsimp simp: lookup_walk_def)\n done\n\nlemma lookup_walk_decomp_more:\n \"(h @ [b],rptr) \\ lookup_walk cs ({([], ptr)}) (h @ [b]) rptr \\\n \\p. (([], ptr), [b], p) \\ cs \\ (([], p), h, rptr) \\ cs\\<^sup>*\"\n apply (clarsimp simp: lookup_walk_def)\n apply (erule converse_rtranclE)\n apply clarsimp\n apply clarsimp\n apply (frule lookup1_is_append)\n apply clarsimp\n apply (frule lookup_ref_step)\n apply (intro exI conjI)\n apply force\n apply (rule lookup_trancl_append)\n apply force\n done\n\nlemma lookupable_refs_set:\n shows \"lookupable_refs cs refs (lookup_refs a f)\n \\ lookupable_refs cs refs (lookup_refs a f - lookup_refs b f) \\ lookupable_refs cs refs (lookup_refs b f)\"\n apply (fastforce simp: lookupable_refs_def Image_def)\n done\n\nlemma in_lookupable_refsI:\n \"\\(ref, ptr) \\ cs\\<^sup>* `` rset; f obj b a ; ((a, b), refs, rptr) \\ cs\\<^sup>*\\ \\\n (refs @ ref, rptr) \\ lookupable_refs cs {ref. (ref, ptr) \\ cs\\<^sup>* `` rset} (lookup_refs obj f)\"\n apply (clarsimp simp: lookupable_refs_def Image_def)\n apply (intro exI conjI)\n apply fastforce\n apply fastforce\n apply (clarsimp simp: lookup_refs_def)\n apply fastforce\n done\n\n(* The main result for this locale *)\ntheorem khupd_graph_subset:\n assumes wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n shows \"(refs, p) \\ cs'^* `` rset \\ \\sref. (sref, p) \\ cs^* `` rset \\ lookupable_refs cs\n {ref. (ref, ptr) \\ cs^* `` rset} (lookup_refs obj f)\"\n proof (induct \"length refs\" arbitrary: refs p)\n case 0\n note \"0.prems\" \"0.hyps\"\n thus ?case\n apply clarsimp\n apply (erule rtranclE, fastforce)\n apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs])\n done\n next\n case Suc\n thus ?case\n apply (insert Suc.hyps(2) Suc.prems)\n apply (clarsimp del: disjCI)\n apply (erule rtranclE)\n apply fastforce\n apply (case_tac y, clarsimp del: disjCI)\n apply (rename_tac ref mptr)\n apply (frule wellformed_lookup.lookup1_is_append[OF wlcs])\n apply (clarsimp del: disjCI)\n apply (drule Suc.hyps(1))\n apply (fastforce simp: Image_def)\n apply clarsimp\n apply (case_tac \"mptr = ptr\")\n apply (elim disjE)\n apply (rule_tac x = \"refa # sref\" in exI)\n apply (rule disjI2)\n apply (clarsimp simp: lookupable_refs_def lookup_refs_def)\n apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n apply ((rule exI | rule conjI | force)+)[1]\n apply clarsimp\n apply (clarsimp simp: lookupable_refs_def)\n apply (intro disjI2 exI conjI | force)+\n apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n apply (fastforce simp: Image_def lookup_refs_def)\n apply (clarsimp simp: Image_def)\n apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n apply (rule exI)\n apply (elim disjE)\n apply (rule disjI1)\n apply (clarsimp simp: Image_def trans_depends_eq[symmetric])\n apply ((intro conjI bexI\n | simp add: obj_at_def\n | erule lookup1_cut_singleton\n | erule rtrancl_into_rtrancl)+)[1]\n apply (rule disjI2)\n apply (clarsimp simp: lookupable_refs_def Image_def trans_depends_eq[symmetric])\n apply (intro conjI exI)\n apply (rule_tac x = \"(aa,ba)\" in bexI)\n apply simp+\n apply (clarsimp simp: lookup_refs_def)\n apply ((intro conjI exI bexI\n | simp add: obj_at_def\n | erule lookup1_cut_singleton\n | erule rtrancl_into_rtrancl)+)[1]\n done\n qed\nend\n\nlemma lookup_bound_estimate:\n assumes wlcs: \"wellformed_lookup cs kh f\"\n and wlcs': \"wellformed_lookup cs' kh' f\"\n and bound: \"\\p. lookup_refs (kh' p) f \\ lookup_refs (kh p) f\"\n shows \"(refs, p) \\ cs'^* `` rset \\ (refs, p) \\ cs^* `` rset\"\n apply (clarsimp simp: Image_def)\n apply (erule_tac x = \"(a,b)\" in bexI[rotated])\n apply (induct refs arbitrary: p)\n apply (erule rtranclE)\n apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs'])+\n apply (erule rtranclE)\n apply simp\n apply (rule_tac b = y in rtrancl_into_rtrancl)\n apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs'])\n apply (case_tac y,clarsimp)\n apply (frule wellformed_lookup.lookup_ref_step[OF wlcs'])\n apply clarsimp\n apply (frule wellformed_lookup.lookup1_is_append[OF wlcs'])\n apply clarsimp\n apply (rule wellformed_lookup.lookup1_cut[OF wlcs,where ra = \"[]\" and r = \"[a]\" for a,simplified])\n apply (drule wellformed_lookup.lookup1_append[OF wlcs', where ra = \"[]\" and r = \"[a]\" for a, simplified])\n apply (simp add: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n apply (insert bound)\n apply (clarsimp simp: lookup_refs_def)\n apply fastforce\n done\n\nlemma trans_depends_vs_walk:\n assumes wlcs: \"wellformed_lookup cs kh f\"\n and wlcs': \"wellformed_lookup cs' kh' f\"\n and stick: \"\\r q. (r, q) \\ lookup_walk cs m ref p \\ kh' q = kh q\"\n shows \"lookup_walk cs m ref p \\ lookup_walk cs' m ref p\"\n apply (subgoal_tac \"\\r q. (r, q) \\ lookup_walk cs m ref p \\ kh' q = kh q\")\n prefer 2\n apply (clarsimp simp: stick)\n proof (induct ref arbitrary: p)\n case Nil\n show ?case\n by (simp add: wellformed_lookup.empty_lookup_walk[OF wlcs]\n wellformed_lookup.empty_lookup_walk[OF wlcs'])\n next\n case Cons\n show ?case\n apply clarsimp\n apply (frule wellformed_lookup.lookup_walk_stepD[OF wlcs])\n apply (elim disjE)\n apply clarsimp\n apply (drule wellformed_lookup.lookup_walk_step_hdD[OF wlcs])\n apply (erule disjE)\n apply (fastforce simp: lookup_walk_def Image_def)\n apply clarsimp\n apply (rule wellformed_lookup.lookup_walk_stepI2[OF wlcs'])\n apply (erule subsetD[OF Cons.hyps, rotated])\n apply clarsimp\n apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n apply (insert Cons.prems, fastforce)\n apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n apply (elim exE conjE)\n apply (rule wellformed_lookup.lookup_walk_stepI1[OF wlcs'])\n apply (erule subsetD[OF Cons.hyps,rotated])\n apply clarsimp\n apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n apply (insert Cons.prems, fastforce)\n apply clarsimp\n apply (drule_tac ptr = ptr in wellformed_lookup.lookup_walk_trivial[OF wlcs])\n apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n done\n qed\n\n\nlocale wellformed_order_lookup = wellformed_lookup +\n fixes ev :: \"'b\\nat\" and rset\n assumes lookup1_increase: \"\\p q r ref. \\(ref,p) \\ cs^* `` rset; (([],p),[r],q) \\ cs \\ \\ ev (kh p) < ev (kh q)\"\n\ncontext wellformed_order_lookup\nbegin\nlemma lookup1_increaseD:\n \"\\(ref,p) \\ cs^* `` rset; (([],p),[r],q) \\ cs\\ \\ ev (kh p) < ev (kh q)\"\n apply (insert lookup1_increase)\n apply (fastforce)\n done\n\nlemma lookup_walk_distinct_strong:\n \"(ref, ptr) \\ lookup_walk cs rset (r @ ref) q \\ (ev (kh ptr)) < (ev (kh q)) \\ r = []\"\n proof (induct \"length r\" arbitrary: ref ptr q r)\n case 0\n show ?case\n apply (insert \"local.0\")\n by clarsimp\n next\n case Suc\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (case_tac r, simp)\n apply clarsimp\n apply (drule lookup_walk_stepD)\n apply (elim disjE, clarsimp)\n apply clarsimp\n apply (frule Suc.hyps(1)[rotated])\n apply fastforce\n apply (elim disjE)\n apply (frule lookup_walk_imp_reachable)\n apply (drule(1) lookup1_increaseD)\n apply clarsimp\n apply (frule lookup_walk_imp_reachable)\n apply (drule(1) lookup1_increaseD)\n apply (clarsimp dest!:lookup1_eq_ref)\n done\n qed\n\nlemma lookup1_trans_increase:\n \"\\(ref,p) \\ cs^* `` rset; ((a,p),b,q) \\ cs^+ \\ \\ ev (kh p) < ev (kh q)\"\n apply (drule reachable_walk)\n apply (frule lookup_ref_step[OF trancl_into_rtrancl])\n apply clarsimp\n apply (drule lookup_walk_stepsI1)\n apply (rule lookup_trancl_append)\n apply force\n apply (drule lookup_walk_distinct_strong)\n apply clarsimp\n apply (erule tranclE)\n apply (clarsimp dest!: lookup1_is_append lookup_ref_step trancl_into_rtrancl)+\n done\n\nlemma lookup_walk_unique:\n \"(ref', ptr) \\ lookup_walk cs rset ref ptr \\ ref = ref'\"\n proof (induct \"length ref\" arbitrary: ref ptr ref')\n case 0\n show ?case\n apply (insert \"local.0\")\n by (clarsimp simp:empty_lookup_walk)\n next\n case Suc\n show ?case\n apply (insert Suc.prems Suc.hyps(2))\n apply (case_tac ref)\n apply simp\n apply clarsimp\n apply (drule lookup_walk_stepD)\n apply (elim disjE, clarsimp)\n apply clarsimp\n apply (frule lookup_walk_distinct_strong)\n apply (frule lookup_walk_imp_reachable)\n apply (drule(1) lookup1_increaseD)\n apply (clarsimp dest!: lookup1_eq_ref)\n done\n qed\n\nlemma lookup_walk_unique_from_root:\n \"\\(([], ptr), b, ptr) \\ cs^*; (ref,ptr) \\ cs^* `` rset\\ \\ b = []\"\n apply (subgoal_tac \"b @ ref = ref\")\n apply simp\n apply (rule lookup_walk_unique)\n apply (simp add: lookup_walk_def)\n done\n\nlemma lookup_walk_kh_upd:\n \"\\wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset; (q, ptr) \\ lookup_walk cs rset q ptr \\\n \\ (q, ptr) \\ lookup_walk cs' rset q ptr\"\n apply (case_tac q)\n apply (clarsimp simp: empty_lookup_walk)\n apply (fastforce simp: lookup_walk_def Image_def)\n apply clarsimp\n apply (frule lookup_walk_step_hdD)\n apply (elim disjE)\n apply (fastforce simp: lookup_walk_def Image_def)\n apply (clarsimp simp: Image_def)\n apply (cut_tac m = rset and ref = list and p = y\n in trans_depends_vs_walk[OF local.wellformed_lookup_axioms])\n apply (erule wellformed_order_lookup.axioms)\n apply clarsimp\n apply (drule_tac p = \"(r, ptr)\" in lookup_walk_stepI1[rotated])\n apply simp\n apply (clarsimp dest!: lookup_walk_unique)\n apply (drule lookup_walk_decomp)\n apply simp\n apply (rule wellformed_lookup.lookup_walk_stepI2)\n apply (erule wellformed_order_lookup.axioms)\n apply fastforce\n apply (subst wellformed_lookup.trans_depends_eq)\n apply (erule wellformed_order_lookup.axioms)\n apply (subgoal_tac \"y \\ ptr\")\n apply (simp add: trans_depends_eq)\n apply clarsimp\n apply (drule_tac p = \"(list, ptr)\" in lookup_walk_stepI1[rotated])\n apply simp\n apply (clarsimp dest!: lookup_walk_unique)\n done\n\nlemma lookup_walk_path_distinct:\n \"h \\ [] \\ (q, ptr) \\ lookup_walk cs rset (h @ q) rptr \\ ptr \\ rptr\"\n apply (rule ccontr)\n apply clarsimp\n apply (drule lookup_walk_unique)\n apply simp\n done\n\n(*\n This lemma should not be used out side of this locale.\n Please use kpupd_wellformed_order_lookup instead.\n*)\nlemma khupd_wellform_order_lookup_pref:\n assumes wlos: \"wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n shows \"cs'^* `` rset \\ cs^* `` rset \\ lookupable_refs cs\n {ref. (ref, ptr) \\ cs^* `` rset} (lookup_refs obj f)\"\n proof -\n have wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n by (intro wellformed_order_lookup.axioms[OF wlos])\n have kh_upd_dummy[simp]:\n \"(kh(ptr := obj, ptr := kh ptr)) = kh\"\n by auto\n have l: \"\\ys y q. ys @ y # q = (ys @ [y]) @ q\"\n by auto\n show ?thesis\n apply (rule subsetI)\n apply (clarsimp del: disjCI)\n apply (rename_tac r rptr ref p)\n apply (erule rtranclE)\n apply (fastforce simp: wellformed_lookup.empty_lookup_walk[OF wlcs] Image_def)\n apply (insert wlcs)\n apply (drule wellformed_lookup.reachable_walk)\n apply (simp add: Image_def)\n apply fastforce\n apply (case_tac \"\\q. (q, ptr) \\ lookup_walk cs' rset r rptr\")\n apply (clarsimp del: disjCI)\n apply (frule_tac ptr = ptr in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n apply (drule_tac obj = \"kh ptr\" and ptr = ptr and cs' = cs in wellformed_order_lookup.lookup_walk_kh_upd[rotated -1,OF _ wlos])\n apply simp\n apply (rule wellformed_order_lookup_axioms)\n apply (frule_tac rptr = rptr in wellformed_lookup.lookup_walk_decomp[OF wlcs])\n apply (clarsimp del: disjCI)\n apply (rule_tac xs = h in rev_cases)\n apply (clarsimp simp: wellformed_lookup.empty_lookup_walk[OF wlcs])\n apply (simp add: lookup_walk_def)\n apply (rule disjI2)\n apply clarsimp\n apply (drule wellformed_lookup.lookup_walk_decomp_more[OF wlcs])\n apply clarsimp\n apply (drule wellformed_lookup.lookup_trancl_walk[OF wlcs])\n apply (drule_tac ref = q in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n apply (drule_tac c=\"(ys, rptr)\" in subsetD[OF trans_depends_vs_walk,rotated -1])\n apply (rule wlcs)\n apply (rule local.wellformed_lookup_axioms)\n apply clarsimp\n apply (drule_tac ref = r in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n apply (frule_tac ptr = ptr in wellformed_order_lookup.lookup_walk_unique_from_root\n [OF wlos _ wellformed_lookup.lookup_walk_imp_reachable[OF wlcs],rotated])\n apply (erule converse_rtrancl_into_rtrancl)\n apply (drule wellformed_lookup.lookup_walk_imp_reachable[OF wlcs])+\n apply (clarsimp simp: Image_def)\n apply (rule wellformed_lookup.lookup_trancl_cut[OF wlcs, where ra = \"[]\",simplified])\n apply simp\n apply simp\n apply (subst l)\n apply (rule in_lookupable_refsI)\n apply (clarsimp dest!: lookup_walk_imp_reachable)\n apply (drule wellformed_lookup.trans_dependsD[OF wlcs])\n apply simp\n apply (rule lookup_trancl_cut[where ra =\"[]\",simplified])\n apply (clarsimp dest!: lookup_walk_imp_reachable)\n apply simp\n apply (cut_tac m = rset and ref=r and p = rptr\n in trans_depends_vs_walk[OF wlcs local.wellformed_lookup_axioms])\n apply clarsimp\n apply (drule subsetD)\n apply (rule wellformed_lookup.reachable_walk[OF wlcs])\n apply (clarsimp simp: Image_def)\n apply (erule bexI[rotated])\n apply (erule(1) rtrancl_into_rtrancl)\n apply (simp add: lookup_walk_imp_reachable)\n done\n qed\n\nlemma lookupable_refs_reachable:\n \"lookupable_refs cs {ref. (ref, ptr) \\ cs\\<^sup>* `` rset} (lookup_refs (kh ptr) f)\n \\ cs\\<^sup>* `` rset\"\n apply (clarsimp simp: lookupable_refs_def Image_def lookup_refs_lookup1)\n apply (erule bexI[rotated])\n apply (erule rtrancl_trans)\n apply (frule lookup1_is_append)\n apply clarsimp\n apply (erule converse_rtrancl_into_rtrancl[OF lookup1_cut_singleton])\n apply (drule lookup_trancl_cut)\n apply force\n done\n\nlemma khupd_wellformed_order_lookup_private:\n assumes well_order:\n \"\\nref np stepref nq sref. \\(nref,np) \\ cs^* `` (lookup_refs obj f); (([],np),[stepref],nq) \\ cs; (sref, ptr)\\ cs^* `` rset\\\n \\ ev (kh np) < ev (kh nq)\"\n and well_order_as_parent:\n \"\\nref np sref. \\(nref,np) \\ lookup_refs obj f; (sref, ptr)\\ cs^* `` rset\\ \\ ev (obj) < ev (kh np)\"\n and well_order_as_leaf:\n \"\\p r sref. \\((r, p), sref, ptr) \\ cs^+ ;(r, p) \\ cs^* `` rset\\ \\ ev (kh p) < ev (obj)\"\n and wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n shows \"ev (kh ptr) \\ ev obj \\ wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n apply (intro wellformed_order_lookup.intro[OF wlcs])\n apply (intro wellformed_order_lookup_axioms.intro)\n apply (drule khupd_graph_subset[OF wlcs])\n apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs])\n apply (elim disjE)\n apply (clarsimp split: if_splits)\n apply (cut_tac nref = \"[r]\" and np = q in well_order_as_parent)\n apply (clarsimp simp: Image_def lookup_refs_def)\n apply (fastforce simp: Image_def)\n apply clarsimp\n apply (clarsimp simp: trans_depends_eq[symmetric])\n apply (intro conjI impI)\n apply (rule well_order_as_leaf[rotated])\n apply (fastforce simp: Image_def)\n apply (rule r_into_trancl')\n apply (rule lookup1_cut_singleton)\n apply force\n apply (rule lookup1_increase)\n apply (clarsimp simp: Image_def)\n apply (erule bexI[rotated])\n apply simp\n apply simp\n apply (clarsimp simp: lookupable_refs_def split: if_splits)\n apply (cut_tac nref = \"[r]\" and np = q in well_order_as_parent)\n apply (clarsimp simp: Image_def lookup_refs_def)\n apply (fastforce simp: Image_def)\n apply clarsimp\n apply (clarsimp simp: trans_depends_eq[symmetric])\n apply (intro conjI impI)\n apply clarsimp\n apply (frule well_order_as_parent)\n apply fastforce\n apply (drule well_order[rotated])\n apply fastforce+\n apply (frule well_order[rotated])\n apply (fastforce)+\n done\n\nlemma khupd_wellformed_order_lookup:\n assumes well_order:\n \"\\nref np stepref nq sref. \\(nref,np) \\ cs^* `` (lookup_refs obj f - lookup_refs (kh ptr) f); (([],np),[stepref],nq) \\ cs; (sref, ptr)\\ cs^* `` rset\\\n \\ ev (kh np) < ev (kh nq)\"\n and well_order_as_parent:\n \"\\nref np sref. \\(nref,np) \\ (lookup_refs obj f - lookup_refs (kh ptr) f); (sref, ptr)\\ cs^* `` rset\\ \\ ev (obj) < ev (kh np)\"\n and well_order_as_leaf:\n \"\\p r sref. \\((r, p), sref, ptr) \\ cs^+ ;(r, p) \\ cs^* `` rset\\ \\ ev (kh p) < ev (obj)\"\n and wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n shows \"ev (kh ptr) = ev obj \\ wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n apply (rule khupd_wellformed_order_lookup_private[OF _ _ well_order_as_leaf wlcs])\n apply clarsimp\n apply (case_tac \"(a,b) \\ lookup_refs (kh ptr) f\")\n apply (rule lookup1_increaseD)\n apply (clarsimp simp: Image_def)\n apply (erule bexI[rotated])\n apply (erule rtrancl_trans)\n apply (rule converse_rtrancl_into_rtrancl)\n apply (simp add: lookup_refs_lookup1)\n apply (drule_tac b = sref in lookup1_cut[where q = ptr])\n apply fastforce\n apply (erule lookup_trancl_cut)\n apply simp\n apply (rule well_order, fastforce+)\n apply clarsimp\n apply (case_tac \"(nref,np) \\ lookup_refs (kh ptr) f\")\n apply (clarsimp simp: Image_def lookup_refs_lookup1)\n apply (frule lookup1_is_append)\n apply clarsimp\n apply (erule subst)\n apply (rule lookup1_trans_increase)\n apply (clarsimp simp: Image_def)\n apply (erule bexI[rotated])\n apply (simp add: lookup_refs_lookup1)+\n apply fastforce\n apply (rule well_order_as_parent,fastforce+)\n done\n\n(* The main result for this locale *)\ntheorem khupd_graph_subset:\n assumes wlos: \"wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n shows \"cs'^* `` rset \\ cs^* `` rset \\ lookupable_refs cs\n {ref. (ref, ptr) \\ cs^* `` rset} (lookup_refs obj f - lookup_refs (kh ptr) f)\"\n proof -\n have set_plus_mono: \"\\a b c d. \\a \\ b \\ c; c \\ d\\ \\ a \\ b \\ d\"\n by auto\n show ?thesis\n apply (insert khupd_wellform_order_lookup_pref[OF wlos])\n apply (drule set_plus_mono)\n apply (rule_tac b = \"kh ptr\" in lookupable_refs_set)\n apply (cut_tac ptr = ptr in lookupable_refs_reachable)\n apply fastforce\n done\n qed\nend\n\ncontext Arch begin global_naming X64\n\nlocale_abbrev \"vs_lookup_leaf ptr s \\ lookup_leaf ptr (vs_lookup1 s)\"\n\nprimrec vsref_of :: \"vs_ref \\ word64\"\nwhere\n \"vsref_of (VSRef x _ ) = x\"\n\ndefinition\n vs_ref_lvl_arch :: \"arch_kernel_obj \\ nat\"\nwhere\n \"vs_ref_lvl_arch atype \\ case aa_type atype of\n AASIDPool \\ 1\n | APageMapL4 \\ 2\n | APDPointerTable \\ 3\n | APageDirectory \\ 4\n | APageTable \\ 5\n | _ \\ 6\"\n\ndefinition\n \"vs_ref_lvl obj_opt \\ case_option 7 (arch_obj_fun_lift vs_ref_lvl_arch 7) obj_opt\"\n\nlemma vs_ref_lvl_arch_obj [simp]:\n \"vs_ref_lvl (Some (ArchObj aobj)) = vs_ref_lvl_arch aobj\"\n by (simp add: vs_ref_lvl_def)\n\nlemma vs_ref_lvl_arch_simps [simp]:\n \"vs_ref_lvl_arch (ASIDPool ap) = 1\"\n \"vs_ref_lvl_arch (PageMapL4 pm) = 2\"\n \"vs_ref_lvl_arch (PDPointerTable pdpt) = 3\"\n \"vs_ref_lvl_arch (PageDirectory pd) = 4\"\n \"vs_ref_lvl_arch (PageTable pt) = 5\"\n \"vs_ref_lvl_arch (DataPage dev sz) = 6\"\n by (auto simp: vs_ref_lvl_arch_def aa_type_def)\n\ndefinition\n \"vs_lookup1_on_heap_obj \\ \\obj q h. (\\ko. obj = Some ko \\ (\\r. h = [r] \\ (r, q) \\ vs_refs ko))\"\n\ndefinition\n \"vs_lookup_pages1_on_heap_obj \\ \\obj q h. (\\ko. obj = Some ko \\ (\\r. h = [r] \\ (r, q) \\ vs_refs_pages ko))\"\n\nsublocale vs_lookup1_wellformed:\n wellformed_lookup \"vs_lookup1 s\" \"kheap s\" vs_lookup1_on_heap_obj\n apply unfold_locales\n apply (clarsimp simp: trans_depends_def vs_lookup1_def obj_at_def vs_lookup1_on_heap_obj_def)+\n apply (clarsimp simp: vs_refs_def up_ucast_inj_eq graph_of_def\n split: kernel_object.splits arch_kernel_obj.splits)\n apply (clarsimp simp: vs_lookup1_on_heap_obj_def)\n done\n\nlemmas vs_lookup1_is_wellformed_lookup\n = vs_lookup1_wellformed.wellformed_lookup_axioms\n\nsublocale vs_lookup_pages1_wellformed:\n wellformed_lookup \"vs_lookup_pages1 s\" \"kheap s\" vs_lookup_pages1_on_heap_obj\n apply unfold_locales\n apply (clarsimp simp: trans_depends_def vs_lookup_pages1_def obj_at_def vs_lookup_pages1_on_heap_obj_def)+\n apply (clarsimp simp: vs_refs_pages_def up_ucast_inj_eq graph_of_def\n split: kernel_object.splits arch_kernel_obj.splits)\n apply (clarsimp simp: vs_lookup_pages1_on_heap_obj_def)\n done\n\nlemmas vs_lookup_pages1_is_wellformed_lookup\n = vs_lookup_pages1_wellformed.wellformed_lookup_axioms\n\nlemma vs_refs_pages_vs_ref_lvl:\n \"\\ ko_at (ArchObj aobj) p s; (r, q) \\ vs_refs_pages (ArchObj aobj); valid_vspace_obj aobj s \\\n \\ vs_ref_lvl (kheap s p) < vs_ref_lvl (kheap s q)\"\n apply (cases aobj;\n clarsimp simp: vs_refs_pages_def graph_of_def ball_ran_eq obj_at_def\n pte_ref_pages_def pde_ref_pages_def pdpte_ref_pages_def pml4e_ref_pages_def\n split: if_splits pte.splits pde.splits pdpte.splits pml4e.splits;\n match premises in H [thin]: \"\\i. P (t i)\" and J: \"t i = v\" for P t i v \\\n \\insert spec[where x=i, OF H]\\\n \\ H [thin]: \"\\i \\ S. P (t i)\" and J: \"t i = v\" for P S t i v \\\n \\insert bspec[where x=i, OF H]\\)\n by (auto simp: obj_at_def data_at_def)\n\nlemmas vs_refs_vs_ref_lvl = vs_refs_pages_vs_ref_lvl[OF _ vs_refs_vs_refs_pages]\n\nlemma vs_lookup1_wellformed_order:\n \"valid_vspace_objs s\n \\ wellformed_order_lookup (vs_lookup1 s) (kheap s) vs_lookup1_on_heap_obj\n vs_ref_lvl (vs_asid_refs (x64_asid_table (arch_state s)))\"\n apply (intro wellformed_order_lookup.intro vs_lookup1_wellformed.wellformed_lookup_axioms\n wellformed_order_lookup_axioms.intro)\n apply (simp only: vs_lookup_def2[symmetric])\n apply (clarsimp simp add: vs_lookup1_def)\n apply (case_tac ko; (clarsimp simp: vs_refs_def; fail)?; rename_tac ako; clarsimp)\n apply (frule (2) valid_vspace_objsD)\n apply (case_tac ako; clarsimp simp: vs_refs_def)\n apply (drule (1) graph_of_in_ranD; clarsimp simp: obj_at_def)\n apply (match premises in \"(i,_) \\ graph_of _\" for i \\\n \\match premises in H[thin]: \"\\i. P i\" for P \\ \\insert spec[where x=i, OF H]\\\n \\ H[thin]: \"\\i\\_. P i\" for P \\ \\insert bspec[where x=i, OF H]\\\\;\n fastforce simp: graph_of_def obj_at_def\n pde_ref_def pdpte_ref_def pml4e_ref_def\n split: pde.splits pdpte.splits pml4e.splits if_splits)+\n done\n\nlemma vs_lookup_pages1_wellformed_order:\n \"\\ valid_vspace_objs s; valid_asid_table (x64_asid_table (arch_state s)) s \\\n \\ wellformed_order_lookup (vs_lookup_pages1 s) (kheap s) vs_lookup_pages1_on_heap_obj\n vs_ref_lvl (vs_asid_refs (x64_asid_table (arch_state s)))\"\n apply (intro wellformed_order_lookup.intro vs_lookup_pages1_wellformed.wellformed_lookup_axioms\n wellformed_order_lookup_axioms.intro)\n apply (simp only: vs_lookup_pages_def2[symmetric])\n apply (clarsimp simp add: vs_lookup_pages1_def)\n apply (case_tac ko; (clarsimp simp: vs_refs_pages_def; fail)?; rename_tac ako; clarsimp)\n apply (frule (3) valid_vspace_objsD')\n apply (case_tac ako; clarsimp simp: vs_refs_pages_def)\n apply (drule (1) graph_of_in_ranD; clarsimp simp: obj_at_def)\n apply (match premises in \"(x,y) \\ graph_of f\" for f x y \\\n \\match premises in H[thin]: \"\\i. P i\" for P \\ \\insert spec[where x=x, OF H]\\\n \\ H[thin]: \"\\i\\_. P i\" for P \\ \\insert bspec[where x=x, OF H]\\\\;\n fastforce simp: graph_of_def obj_at_def data_at_def\n pte_ref_pages_def pde_ref_pages_def pdpte_ref_pages_def pml4e_ref_pages_def\n split: pte.splits pde.splits pdpte.splits pml4e.splits if_splits)+\n done\n\ndefinition\n refs_diff :: \"(kernel_object option \\ 'b \\ 'a list \\ bool)\n \\ arch_kernel_obj \\ 64 word \\ 'c abstract_state_scheme \\ ('a list \\ 'b) set\"\nwhere\n \"refs_diff lf obj ptr s = (lookup_refs (Some (ArchObj obj)) lf - lookup_refs (kheap s ptr) lf)\"\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/X64/ArchVSpaceLookup_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725053, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.28414568910287125}} {"text": "(* Title: HOL/Proofs/ex/XML_Data.thy\n Author: Makarius\n Author: Stefan Berghofer\n\nXML data representation of proof terms.\n*)\n\ntheory XML_Data\nimports \"~~/src/HOL/Isar_Examples/Drinker\"\nbegin\n\nsubsection \\Export and re-import of global proof terms\\\n\nML \\\n fun export_proof ctxt thm =\n let\n val thy = Proof_Context.theory_of ctxt;\n val (_, prop) =\n Logic.unconstrainT (Thm.shyps_of thm)\n (Logic.list_implies (Thm.hyps_of thm, Thm.prop_of thm));\n val prf =\n Proofterm.proof_of (Proofterm.strip_thm (Thm.proof_body_of thm)) |>\n Reconstruct.reconstruct_proof ctxt prop |>\n Reconstruct.expand_proof ctxt [(\"\", NONE)] |>\n Proofterm.rew_proof thy |>\n Proofterm.no_thm_proofs;\n in Proofterm.encode prf end;\n\n fun import_proof thy xml =\n let\n val prf = Proofterm.decode xml;\n val (prf', _) = Proofterm.freeze_thaw_prf prf;\n in Drule.export_without_context (Proof_Checker.thm_of_proof thy prf') end;\n\\\n\n\nsubsection \\Examples\\\n\nML \\val thy1 = @{theory}\\\n\nlemma ex: \"A \\ A\" ..\n\nML_val \\\n val xml = export_proof @{context} @{thm ex};\n val thm = import_proof thy1 xml;\n\\\n\nML_val \\\n val xml = export_proof @{context} @{thm de_Morgan};\n val thm = import_proof thy1 xml;\n\\\n\nML_val \\\n val xml = export_proof @{context} @{thm Drinker's_Principle};\n val thm = import_proof thy1 xml;\n\\\n\ntext \\Some fairly large proof:\\\n\nML_val \\\n val xml = export_proof @{context} @{thm abs_less_iff};\n val thm = import_proof thy1 xml;\n @{assert} (size (YXML.string_of_body xml) > 1000000);\n\\\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Proofs/ex/XML_Data.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2841456891028712}} {"text": "(* Title: Jive Data and Store Model\n Author: Norbert Schirmer and \n Nicole Rauch , 2003\n Maintainer: Nicole Rauch \n License: LGPL\n*)\n \nsection \\Value\\\n\ntheory Value imports Subtype begin\n\ntext \\This theory contains our model of the values in the store. The store is untyped, therefore all\n types that exist in Java are wrapped into one type \\Value\\.\n\n In a first approach, the primitive Java types supported in this formalization are \n mapped to similar Isabelle\n types. Later, we will have\n proper formalizations of the Java types in Isabelle, which will then be used here.\n\\\n \ntype_synonym JavaInt = int\ntype_synonym JavaShort = int\ntype_synonym JavaByte = int\ntype_synonym JavaBoolean = bool\n\ntext \\The objects of each class are identified by a unique ID.\nWe use elements of type @{typ nat} here, but in general it is sufficient to use\nan infinite type with a successor function and a comparison predicate.\n\\\n\ntype_synonym ObjectId = nat\n\ntext \\The definition of the datatype \\Value\\. Values can be of the Java types \nboolean, int, short and byte. Additionally, they can be an object reference,\nan array reference or the value null.\\\n\ndatatype Value = boolV JavaBoolean\n | intgV JavaInt \n | shortV JavaShort\n | byteV JavaByte\n | objV CTypeId ObjectId \\ \\typed object reference\\\n | arrV Arraytype ObjectId \\ \\typed array reference\\\n | nullV\n \n\ntext \\Arrays are modeled as references just like objects. So they\ncan be viewed as special kinds of objects, like in Java.\\\n\nsubsection \\Discriminator Functions\\\n\ntext \\To test values, we define the following discriminator functions.\\\n\ndefinition isBoolV :: \"Value \\ bool\" where\n\"isBoolV v = (case v of\n boolV b \\ True \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ False\n | arrV T a \\ False\n | nullV \\ False)\"\n\nlemma isBoolV_simps [simp]:\n\"isBoolV (boolV b) = True\" \n\"isBoolV (intgV i) = False\"\n\"isBoolV (shortV s) = False\"\n\"isBoolV (byteV by) = False\"\n\"isBoolV (objV C a) = False\"\n\"isBoolV (arrV T a) = False\"\n\"isBoolV (nullV) = False\"\n by (simp_all add: isBoolV_def)\n\n\ndefinition isIntgV :: \"Value \\ bool\" where\n\"isIntgV v = (case v of\n boolV b \\ False \n | intgV i \\ True\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ False\n | arrV T a \\ False\n | nullV \\ False)\" \n\nlemma isIntgV_simps [simp]:\n\"isIntgV (boolV b) = False\" \n\"isIntgV (intgV i) = True\"\n\"isIntgV (shortV s) = False\"\n\"isIntgV (byteV by) = False\"\n\"isIntgV (objV C a) = False\"\n\"isIntgV (arrV T a) = False\"\n\"isIntgV (nullV) = False\"\n by (simp_all add: isIntgV_def)\n\n\ndefinition isShortV :: \"Value \\ bool\" where\n\"isShortV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ True\n | byteV by \\ False\n | objV C a \\ False\n | arrV T a \\ False\n | nullV \\ False)\" \n\nlemma isShortV_simps [simp]:\n\"isShortV (boolV b) = False\" \n\"isShortV (intgV i) = False\"\n\"isShortV (shortV s) = True\"\n\"isShortV (byteV by) = False\"\n\"isShortV (objV C a) = False\"\n\"isShortV (arrV T a) = False\"\n\"isShortV (nullV) = False\"\n by (simp_all add: isShortV_def)\n\n\ndefinition isByteV :: \"Value \\ bool\" where\n\"isByteV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ True\n | objV C a \\ False\n | arrV T a \\ False\n | nullV \\ False)\" \n\n\n\n\ndefinition isRefV :: \"Value \\ bool\" where\n\"isRefV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ True\n | arrV T a \\ True\n | nullV \\ True)\"\n\nlemma isRefV_simps [simp]:\n\"isRefV (boolV b) = False\" \n\"isRefV (intgV i) = False\"\n\"isRefV (shortV s) = False\"\n\"isRefV (byteV by) = False\"\n\"isRefV (objV C a) = True\"\n\"isRefV (arrV T a) = True\"\n\"isRefV (nullV) = True\"\n by (simp_all add: isRefV_def)\n\n\ndefinition isObjV :: \"Value \\ bool\" where\n\"isObjV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ True\n | arrV T a \\ False\n | nullV \\ False)\"\n\nlemma isObjV_simps [simp]:\n\"isObjV (boolV b) = False\" \n\"isObjV (intgV i) = False\"\n\"isObjV (shortV s) = False\"\n\"isObjV (byteV by) = False\"\n\"isObjV (objV c a) = True\" \n\"isObjV (arrV T a) = False\"\n\"isObjV nullV = False\"\n by (simp_all add: isObjV_def)\n\n\ndefinition isArrV :: \"Value \\ bool\" where\n\"isArrV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ False\n | arrV T a \\ True\n | nullV \\ False)\"\n\nlemma isArrV_simps [simp]:\n\"isArrV (boolV b) = False\" \n\"isArrV (intgV i) = False\"\n\"isArrV (shortV s) = False\"\n\"isArrV (byteV by) = False\"\n\"isArrV (objV c a) = False\" \n\"isArrV (arrV T a) = True\"\n\"isArrV nullV = False\"\n by (simp_all add: isArrV_def)\n\n\ndefinition isNullV :: \"Value \\ bool\" where\n\"isNullV v = (case v of\n boolV b \\ False \n | intgV i \\ False\n | shortV s \\ False\n | byteV by \\ False\n | objV C a \\ False\n | arrV T a \\ False\n | nullV \\ True)\"\n\nlemma isNullV_simps [simp]:\n\"isNullV (boolV b) = False\" \n\"isNullV (intgV i) = False\"\n\"isNullV (shortV s) = False\"\n\"isNullV (byteV by) = False\"\n\"isNullV (objV c a) = False\" \n\"isNullV (arrV T a) = False\"\n\"isNullV nullV = True\"\n by (simp_all add: isNullV_def)\n\nsubsection \\Selector Functions\\\n\ndefinition aI :: \"Value \\ JavaInt\" where\n\"aI v = (case v of \n boolV b \\ undefined\n | intgV i \\ i\n | shortV sh \\ undefined\n | byteV by \\ undefined\n | objV C a \\ undefined\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\nlemma aI_simps [simp]:\n\"aI (intgV i) = i\"\nby (simp add: aI_def)\n\n\ndefinition aB :: \"Value \\ JavaBoolean\" where\n\"aB v = (case v of \n boolV b \\ b\n | intgV i \\ undefined\n | shortV sh \\ undefined\n | byteV by \\ undefined\n | objV C a \\ undefined\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\nlemma aB_simps [simp]:\n\"aB (boolV b) = b\"\nby (simp add: aB_def)\n\n\ndefinition aSh :: \"Value \\ JavaShort\" where\n\"aSh v = (case v of \n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV sh \\ sh\n | byteV by \\ undefined\n | objV C a \\ undefined\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\nlemma aSh_simps [simp]:\n\"aSh (shortV sh) = sh\"\nby (simp add: aSh_def)\n\n\ndefinition aBy :: \"Value \\ JavaByte\" where\n\"aBy v = (case v of \n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV s \\ undefined\n | byteV by \\ by\n | objV C a \\ undefined\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\nlemma aBy_simps [simp]:\n\"aBy (byteV by) = by\"\nby (simp add: aBy_def)\n\n\ndefinition tid :: \"Value \\ CTypeId\" where\n\"tid v = (case v of\n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV s \\ undefined\n | byteV by \\ undefined\n | objV C a \\ C\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\n\nlemma tid_simps [simp]:\n\"tid (objV C a) = C\"\nby (simp add: tid_def)\n\n\ndefinition oid :: \"Value \\ ObjectId\" where\n\"oid v = (case v of\n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV s \\ undefined\n | byteV by \\ undefined\n | objV C a \\ a\n | arrV T a \\ undefined\n | nullV \\ undefined)\"\n\nlemma oid_simps [simp]:\n\"oid (objV C a) = a\"\nby (simp add: oid_def)\n\n\ndefinition jt :: \"Value \\ Javatype\" where\n\"jt v = (case v of\n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV s \\ undefined\n | byteV by \\ undefined\n | objV C a \\ undefined\n | arrV T a \\ at2jt T\n | nullV \\ undefined)\"\n\nlemma jt_simps [simp]:\n\"jt (arrV T a) = at2jt T\"\nby (simp add: jt_def)\n\n\ndefinition aid :: \"Value \\ ObjectId\" where\n\"aid v = (case v of\n boolV b \\ undefined\n | intgV i \\ undefined\n | shortV s \\ undefined\n | byteV by \\ undefined\n | objV C a \\ undefined\n | arrV T a \\ a\n | nullV \\ undefined)\"\n\nlemma aid_simps [simp]:\n\"aid (arrV T a) = a\"\nby (simp add: aid_def)\n\nsubsection\\Determining the Type of a Value\\\n\ntext \\To determine the type of a value, we define the function\n\\typeof\\. This function is\noften written as $\\tau$ in theoretical texts, therefore we add\nthe appropriate syntax support.\\\n\ndefinition typeof :: \"Value \\ Javatype\" where\n\"typeof v = (case v of\n boolV b \\ BoolT \n | intgV i \\ IntgT\n | shortV sh \\ ShortT\n | byteV by \\ ByteT\n | objV C a \\ CClassT C\n | arrV T a \\ ArrT T\n | nullV \\ NullT)\"\n\nabbreviation tau_syntax :: \"Value \\ Javatype\" (\"\\ _\")\n where \"\\ v == typeof v\"\n\nlemma typeof_simps [simp]:\n\"(\\ (boolV b)) = BoolT\"\n\"(\\ (intgV i)) = IntgT\"\n\"(\\ (shortV sh)) = ShortT\"\n\"(\\ (byteV by)) = ByteT\"\n\"(\\ (objV c a)) = CClassT c\"\n\"(\\ (arrV t a)) = ArrT t\"\n\"(\\ (nullV)) = NullT\"\n by (simp_all add: typeof_def)\n\n\nsubsection \\Default Initialization Values for Types\\\n\ntext \\The function \\init\\ yields the default initialization values for each \ntype. For boolean, the\ndefault value is False, for the integral types, it is 0, and for the reference\ntypes, it is nullV.\n\\\n\ndefinition init :: \"Javatype \\ Value\" where\n\"init T = (case T of\n BoolT \\ boolV False\n | IntgT \\ intgV 0\n | ShortT \\ shortV 0\n | ByteT \\ byteV 0\n | NullT \\ nullV\n | ArrT T \\ nullV\n | CClassT C \\ nullV\n | AClassT C \\ nullV\n | InterfaceT I \\ nullV)\" \n\nlemma init_simps [simp]:\n\"init BoolT = boolV False\"\n\"init IntgT = intgV 0\"\n\"init ShortT = shortV 0\"\n\"init ByteT = byteV 0\"\n\"init NullT = nullV\"\n\"init (ArrT T) = nullV\"\n\"init (CClassT c) = nullV\"\n\"init (AClassT a) = nullV\"\n\"init (InterfaceT i) = nullV\"\n by (simp_all add: init_def)\n\nlemma typeof_init_widen [simp,intro]: \"typeof (init T) \\ T\"\nproof (cases T)\n assume c: \"T = BoolT\"\n show \"(\\ (init T)) \\ T\"\n using c by simp\nnext\n assume c: \"T = IntgT\"\n show \"(\\ (init T)) \\ T\"\n using c by simp\nnext\n assume c: \"T = ShortT\"\n show \"(\\ (init T)) \\ T\"\n using c by simp\nnext\n assume c: \"T = ByteT\"\n show \"(\\ (init T)) \\ T\"\n using c by simp\nnext\n assume c: \"T = NullT\"\n show \"(\\ (init T)) \\ T\"\n using c by simp\nnext\n fix x\n assume c: \"T = CClassT x\"\n show \"(\\ (init T)) \\ T\"\n using c by (cases x, simp_all)\nnext\n fix x\n assume c: \"T = AClassT x\"\n show \"(\\ (init T)) \\ T\"\n using c by (cases x, simp_all)\nnext\n fix x\n assume c: \"T = InterfaceT x\"\n show \"(\\ (init T)) \\ T\"\n using c by (cases x, simp_all)\nnext\n fix x\n assume c: \"T = ArrT x\"\n show \"(\\ (init T)) \\ T\"\n using c \n proof (cases x)\n fix y\n assume c2: \"x = CClassAT y\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by (cases y, simp_all)\n next\n fix y\n assume c2: \"x = AClassAT y\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by (cases y, simp_all)\n next\n fix y\n assume c2: \"x = InterfaceAT y\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by (cases y, simp_all)\n next\n assume c2: \"x = BoolAT\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by simp\n next\n assume c2: \"x = IntgAT\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by simp\n next\n assume c2: \"x = ShortAT\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by simp\n next\n assume c2: \"x = ByteAT\"\n show \"(\\ (init T)) \\ T\"\n using c c2 by simp\n qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JiveDataStoreModel/Isabelle/Value.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2841456891028712}} {"text": "chapter \\Calculus of Programming\\\n\ntheory Calculus_of_Programming\n imports Spec_Framework IDE_CP_Reasoning1\n abbrevs \"\" = \"\\\\\\\\\\\"\n and \"\" = \"\\\\\\\\\\\\\\\"\n and \"\" = \"\\\\\"\n and \"\" = \"\\\\\"\nbegin\n\nsection \\Implementing CoP Sequent\\\n\ntext \\CoP sequent \\P | S |- Q\\ for \\S = (C\\<^sub>1,v\\<^sub>1); \\ ; (C\\<^sub>n,v\\<^sub>n)\\ is implemented as\n\\begin{align*}\n& \\\\\\\\\\\\\\\\ s\\<^sub>0 [R] \\\\\\\\\\\\\\ \\\\ P\\, \\\\\n& \\CodeBlock s\\<^sub>0 s\\<^sub>1 C\\<^sub>1 v\\<^sub>1,\\ \\\\\n& \\qquad \\\\\\ \\\\\n& \\CodeBlock s\\<^sub>i\\<^sub>-\\<^sub>1 s\\<^sub>i C\\<^sub>i v\\<^sub>i,\\ \\\\\n& \\qquad \\\\\\ \\\\\n& \\CodeBlock s\\<^sub>n\\<^sub>-\\<^sub>1 s\\<^sub>n C\\<^sub>n v\\<^sub>n\\ \\\\\n\\\\\\ \\;&\\; \\\\\\\\\\\\\\\\ s\\<^sub>n [R] \\\\\\\\\\\\\\ \\\\ Q\\\n\\end{align*}\nwhere \\s\\<^sub>0\\ denotes the initial state before execution and \\s\\<^sub>i, v\\<^sub>i\\ denote\nrespectively the intermediate state after executing procedure \\C\\<^sub>i\\ and\nthe return value of \\C\\<^sub>i\\.\nSequence \\{s\\<^sub>i}\\<^sub>n\\ therefore links execution of each procedure.\n\\R\\ is the frame variable.\n\n[C]-modality \\[C]{Q}{E}\\ is implemented by \\\\

\\\\\\\\\\\\ C \\\\ s\\<^sub>n [R] \\\\\\\\\\\\\\ \\\\ Q \\\\\\\\\\\\ E\\.\n\n\\\n\ntext \\\nIn addition, besides programming of procedures,\nthe system is extended to deduce view shift and transformation of abstraction by programming.\n\nThe programming deduction of view shift is also realized using similar structures\n(\\CurrentConstruction\\). Thus we reuse the infrastructures and\ngive two modes \\programming_mode\\ and \\view_shift_mode\\ to differentiate the two modes.\n\\\n\nconsts programming_mode :: mode\n view_shift_mode :: mode\n\ndefinition CurrentConstruction :: \" mode \\ resource \\ assn \\ assn \\ bool \"\n where \"CurrentConstruction mode s R S \\ s \\ (INTERP_SPEC (R * S))\"\n\nabbreviation Programming_CurrentConstruction (\"\\\\\\\\\\\\\\ _ [_]/ \\\\\\\\\\\\\\ \\\\ _\" [1000,1000,11] 10)\n where \\Programming_CurrentConstruction \\ CurrentConstruction programming_mode\\\n\nabbreviation View_Shift_CurrentConstruction (\"\\\\\\\\ _ [_]/ \\\\ _\" [1000,1000,11] 10)\n where \\View_Shift_CurrentConstruction \\ CurrentConstruction view_shift_mode\\\n\nconsts Programming_CurrentConstruction_syntax :: \\assn \\ bool\\ (\"\\\\\\\\\\\\\\ \\\\\\\\\\: _\" [11] 10)\nconsts View_Shift_CurrentConstruction_syntax :: \\assn \\ bool\\ (\"\\\\\\\\\\\\\\ \\\\\\\\: _\" [11] 10)\n\ndefinition PendingConstruction :: \" 'ret::VALs proc\n \\ resource\n \\ assn\n \\ ('ret \\arg \\ assn)\n \\ (ABNM \\ assn)\n \\ bool \"\n (\"\\

\\\\\\\\\\\\ _ \\\\ _ [_]/ \\\\\\\\\\\\\\ \\\\ _/ \\\\\\\\\\\\ _\" [1000,1000,1000,11,11] 10)\n where \"PendingConstruction f s R S E \\ f s \\ \\ (\\ret. INTERP_SPEC (R * S ret)) (\\ex. INTERP_SPEC (R * E ex))\"\n\nconsts PendingConstruction_syntax :: \\'ret::VALs proc \\ ('ret \\arg \\ assn) \\ (ABNM \\ assn) \\ bool\\\n (\"\\

\\\\\\\\\\\\ \\

\\\\\\ _/ \\\\\\\\\\\\\\ \\\\ _/ \\\\\\\\\\\\ _\" [1000,11,11] 10)\n\ntranslations\n \"\\\\\\\\\\\\\\ \\\\\\\\\\: S\" <= \"CONST Programming_CurrentConstruction s R S\"\n \"\\\\\\\\\\\\\\ \\\\\\\\: S\" <= \"CONST View_Shift_CurrentConstruction s R S\"\n \"\\

\\\\\\\\\\\\ \\

\\\\\\ f \\\\\\\\\\\\\\ \\\\ S \\\\\\\\\\\\ E\" <= \"CONST PendingConstruction f s R S E\"\n\ndefinition \\CodeBlock s s' f ret \\ Success ret s' \\ f s\\\n\nlemma CurrentConstruction_D: \"CurrentConstruction mode s H T \\ Inhabited T\"\n unfolding CurrentConstruction_def Inhabited_def by (clarsimp simp add: \\expns; blast)\n\ndefinition ToA_Construction :: \\'a \\ 'a set \\ bool\\ (\"\\\\\\\\\\\\\\\\\\\\\\'(_') \\\\ _\" [11,11] 10)\n where \\ToA_Construction = (\\)\\\n\n\nsection \\Rules for Constructing Programs\\\n\nsubsection \\Construct Procedure\\\n\nlemma \\apply_proc:\n \"(\\\\\\\\\\\\\\ blk [R] \\\\\\\\\\\\\\ \\\\ S)\n\\ \\

\\\\\\ f \\ S \\ T \\ \\\\\\\\\\\\ E\n\\(\\

\\\\\\\\\\\\ f \\\\ blk [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E)\"\n unfolding \\Procedure_def CurrentConstruction_def PendingConstruction_def bind_def by (auto 0 5)\n\nlemma\n \\ (\\s' x. CodeBlock s s' f x \\ CodeBlock s' s'' (g x) y)\n\\ CodeBlock s s'' (f \\ g) y\\\n unfolding CodeBlock_def bind_def\n apply (rule; clarsimp)\n apply blast\n by (case_tac x; clarsimp; blast)\n\n\n(*Hint: because\n\\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ U \\\\\\\\\\\\ E1 \\\n Invalid \\ f s \\ (\\v s'. Abnormality v s' \\ f s \\ s' \\ INTERP_SPEC (R \\ E v))*)\n\nlemma \\assemble_proc:\n \\ \\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E1\n\\ (\\s' ret. CodeBlock s s' f ret \\ \\

\\\\\\\\\\\\ (g ret) \\\\ s' [R] \\\\\\\\\\\\\\ \\\\ U \\\\\\\\\\\\ E2)\n\\ \\

\\\\\\\\\\\\ (f \\ g) \\\\ s [R] \\\\\\\\\\\\\\ \\\\ U \\\\\\\\\\\\ E1 + E2\\\n unfolding CurrentConstruction_def PendingConstruction_def bind_def subset_iff CodeBlock_def\n apply clarsimp subgoal for s s'\n by (cases s; simp; cases s'; simp add: split_comp_All ring_distribs plus_fun) .\n\n\n\n\nlemma \\accept_proc:\n \\ \\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ CodeBlock s s' f ret\n\\ \\\\\\\\\\\\\\ s' [R] \\\\\\\\\\\\\\ \\\\ T ret\\\n unfolding PendingConstruction_def bind_def subset_iff CurrentConstruction_def CodeBlock_def\n by blast\n\nlemma \\accept_proc_optimize_return_v:\n \\ \\

\\\\\\\\\\\\ (Return v) \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ \\\\\\\\\\\\\\ s [R] \\\\\\\\\\\\\\ \\\\ T v\\\n unfolding PendingConstruction_def bind_def subset_iff CurrentConstruction_def Return_def\n det_lift_def\n by simp\n\n\n(* lemma \\accept_proc: \\ \\Depreciated!\\\n \" \\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E1\n\\ (\\s' ret. \\\\\\\\\\\\\\ s' [R] \\\\\\\\\\\\\\ \\\\ T ret \\ \\

\\\\\\\\\\\\ (g ret) \\\\ s' [R] \\\\\\\\\\\\\\ \\\\ U \\\\\\\\\\\\ E2)\n\\ \\

\\\\\\\\\\\\ (f \\ g) \\\\ s [R] \\\\\\\\\\\\\\ \\\\ U \\\\\\\\\\\\ E1 + E2\"\n unfolding CurrentConstruction_def PendingConstruction_def bind_def subset_iff plus_fun_def\n apply clarsimp subgoal for s' s'' by (cases s'; simp; cases s''; simp add: ring_distribs; blast) .*)\n\n(*\nlemma \\return_when_unreachable:\n \\ \\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ (\\_. T) \\\\\\\\\\\\ E\n\\ \\

\\\\\\\\\\\\ (f \\ Return (\\arg undefined)) \\\\ s [R] \\\\\\\\\\\\\\ \\\\ (\\_. T) \\\\\\\\\\\\ E\\\n for f :: \\unreachable proc\\\n unfolding CurrentConstruction_def PendingConstruction_def bind_def Return_def det_lift_def subset_iff\n apply clarsimp subgoal for s' s'' by (cases s'; simp; cases s''; simp add: ring_distribs; blast) .\n*)\nlemma \\return_additional_unit:\n \\ \\

\\\\\\\\\\\\ f \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ \\

\\\\\\\\\\\\ (f \\ (\\v. Return (\\V_pair v \\V_none))) \\\\ s [R]\n \\\\\\\\\\\\\\ \\\\ (\\ret. T (\\V_fst ret)) \\\\\\\\\\\\ E\\\n unfolding CurrentConstruction_def PendingConstruction_def bind_def Return_def \\V_pair_def\n \\V_fst_def \\V_snd_def det_lift_def subset_iff\n apply clarsimp subgoal for s' s'' by (cases s'; simp; cases s''; simp add: ring_distribs; blast) .\n\nlemma \\return:\n \" \\\\\\\\\\\\\\ s [R] \\\\\\\\\\\\\\ \\\\ T'\n\\ T' = T ret\n\\ \\

\\\\\\\\\\\\ (Return ret) \\\\ s [R] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ 0\"\n unfolding CurrentConstruction_def PendingConstruction_def bind_def Return_def det_lift_def subset_iff\n by simp+\n\nlemma \\reassemble_proc_final:\n \"(\\s H. \\\\\\\\\\\\\\ s [H] \\\\\\\\\\\\\\ \\\\ S \\ \\

\\\\\\\\\\\\ g \\\\ s [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E)\n\\ \\

\\\\\\ g \\ S \\ T \\ \\\\\\\\\\\\ E\"\n unfolding CurrentConstruction_def PendingConstruction_def \\Procedure_def bind_def split_paired_all\n by blast\n\nlemma \"\\__Return_rule__\":\n \\ X \\\\\\\\\\\\ Y \\\\\\ Any\n\\ \\

\\\\\\ Return \\V_none \\ X \\ \\_::unit \\arg. Y \\\\\n unfolding \\Procedure_def Return_def View_Shift_def subset_iff det_lift_def\n by clarsimp\n\nsubsection \\Construct View Shift\\\n\nlemma \\make_view_shift:\n \\ (\\s R. \\\\\\\\ s [R] \\\\ S \\ (\\\\\\\\ s [R] \\\\ S' \\\\\\\\ P))\n\\ S \\\\\\\\\\\\ S' \\\\\\ P\\\n unfolding CurrentConstruction_def View_Shift_def\n by (simp add: INTERP_SPEC_subj Subjection_expn)\n\n\nsubsection \\Construct Implication\\\n\nlemma \"\\make_implication\":\n \\(\\x. \\\\\\\\\\\\\\\\\\\\\\(x) \\\\ S \\ \\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T \\\\\\\\ P) \\ S \\\\\\

\\\\\\\\ T \\\\\\ P\\\n unfolding Imply_def ToA_Construction_def\n by (simp add: Subjection_expn)\n\nsubsection \\Cast\\\n\nlemma \\apply_view_shift:\n \" CurrentConstruction mode blk R S\n\\ S \\\\\\\\\\\\ S' \\\\\\ P\n\\ (CurrentConstruction mode blk R S') \\ P\"\n unfolding CurrentConstruction_def View_Shift_def\n by (simp_all add: split_paired_all \\expns)\n\nlemmas \\apply_implication = \\apply_view_shift[OF _ view_shift_by_implication]\n\nlemma \\apply_view_shift_pending:\n \" PendingConstruction f blk H T E\n\\ (\\x. T x \\\\\\\\\\\\ T' x \\\\\\ P)\n\\ PendingConstruction f blk H T' E\"\n unfolding PendingConstruction_def View_Shift_def\n by (clarsimp simp add: \\expns LooseStateSpec_expn' subset_iff split_comp_All)\n\nlemma \\apply_view_shift_pending_E:\n \" PendingConstruction f blk H T E\n\\ (\\x. E x \\\\\\\\\\\\ E' x \\\\\\ P)\n\\ PendingConstruction f blk H T E'\"\n unfolding PendingConstruction_def View_Shift_def\n by (clarsimp simp add: \\expns LooseStateSpec_expn' subset_iff split_comp_All)\n\nlemmas \\apply_implication_pending =\n \\apply_view_shift_pending[OF _ view_shift_by_implication]\n\nlemmas \\apply_implication_pending_E =\n \\apply_view_shift_pending_E[OF _ view_shift_by_implication]\n\nlemma \\ex_quantify_E:\n \\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ (E ret)\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ (\\e. ExSet (\\x. E x e))\\\n using \\apply_implication_pending_E[OF _ ExSet_imp_I[OF implies_refl]] .\n\nlemma \\apply_implication_impl:\n \\ \\\\\\\\\\\\\\\\\\\\\\(s) \\\\ S\n\\ S \\\\\\

\\\\\\\\ S' \\\\\\ P\n\\(\\\\\\\\\\\\\\\\\\\\\\(s) \\\\ S') \\ P\\\n unfolding ToA_Construction_def Imply_def by blast\n\nlemma \"_\\cast_internal_rule_\":\n \" CurrentConstruction mode blk H T\n\\ T \\\\\\

\\\\\\\\ T' \\\\\\ Any @action ToSA\n\\ \\Success\n\\ \\\\\\\\\\\\\\\\\\\\ True\n\\ CurrentConstruction mode blk H T'\"\n unfolding Action_Tag_def\n using \\apply_implication by blast\n\n\nlemma \"_\\cast_internal_rule_'\":\n \" \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ (\\v. T v \\\\\\

\\\\\\\\ T' v \\\\\\ Any @action ToSA)\n\\ \\Success\n\\ \\\\\\\\\\\\\\\\\\\\ True\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T' \\\\\\\\\\\\ E\"\n unfolding Action_Tag_def\n using \\apply_implication_pending by blast\n\nlemma \"_\\cast_exception_\":\n \" \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ (\\v. E v \\\\\\

\\\\\\\\ E' v @action ToSA)\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E'\"\n unfolding Action_Tag_def\n using \\apply_implication_pending_E by blast\n\nlemma \"_\\cast_exception_rule_\":\n \" \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E\n\\ (\\v. E v \\\\\\

\\\\\\\\ E' v @action ToSA)\n\\ \\Success\n\\ \\\\\\\\\\\\\\\\\\\\ True\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ T \\\\\\\\\\\\ E'\"\n using \"_\\cast_exception_\" .\n\nlemma \"_\\cast_implication_\":\n \\ \\\\\\\\\\\\\\\\\\\\\\(x) \\\\ S\n\\ S \\\\\\

\\\\\\\\ T \\\\\\ Any @action ToSA\n\\ \\Success\n\\ \\\\\\\\\\\\\\\\\\\\ True\n\\ \\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T\\\n unfolding ToA_Construction_def Action_Tag_def Imply_def by blast\n\n\nsubsection \\Finalization Rewrites\\\n\ntext \\Rules showing the obtained procedure is identical to the desired goal\n in the end of the construction.\\\n\nML \\structure Proc_Monad_SS = Simpset(\n val initial_ss = Simpset_Configure.Minimal_SS\n val binding = \\<^binding>\\procedure_simps\\\n val comment = \"declare the rules for simplifying procedure monad.\"\n)\\\n\nconsts procedure_simplification :: mode\n\nlemmas [procedure_simps] =\n proc_bind_SKIP proc_bind_SKIP'\n proc_bind_assoc proc_bind_return_none \\V_simps\n\n\\reasoner_ML procedure_equivalence 1200 (\\Premise procedure_simplification ?P\\)\n = \\PLPR_Simplifier.simplifier_by_ss' NONE Proc_Monad_SS.get'\\\n\n\\reasoner_ML procedure_simplification 1000 (\\Simplify procedure_simplification ?x ?y\\)\n = \\PLPR_Simplifier.simplifier_by_ss' NONE Proc_Monad_SS.get'\\\n\nsubsection \\Misc\\\n\nparagraph \\Inhabitance\\\n\nlemma ToA_Construction_Inhabited_rule:\n \\\\\\\\\\\\\\\\\\\\\\\\(x) \\\\ S \\ (Inhabited S \\ C) \\ C\\\n unfolding ToA_Construction_def Inhabited_def by blast\n\nlemma CurrentConstruction_Inhabited_rule:\n \"CurrentConstruction mode s H T \\ (Inhabited T \\ C) \\ C\"\n using CurrentConstruction_D by blast\n\n\nparagraph \\Fact Store\\\n\nlemma [\\programming_simps]:\n \"CurrentConstruction mode s H (T \\\\\\\\ P) \\ (CurrentConstruction mode s H T) \\ P\"\n unfolding CurrentConstruction_def by (simp_all add: \\expns split_paired_all)\n\nlemma [\\programming_simps]:\n \"(CurrentConstruction mode s H T \\ B) \\ C \\ (CurrentConstruction mode s H T) \\ (B \\ C)\"\n by simp\n\nlemma [\\programming_simps]:\n \\(\\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T \\\\\\\\ P) \\ (\\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T) \\ P\\\n unfolding ToA_Construction_def by (simp add: Subjection_expn)\n\nlemma [\\programming_simps]:\n \\((\\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T) \\ B) \\ C \\ (\\\\\\\\\\\\\\\\\\\\\\(x) \\\\ T) \\ (B \\ C)\\\n by simp\n\nparagraph \\Fixing Existentially Quantified Variable\\\n\nlemma \\ExTyp_strip:\n \"(CurrentConstruction mode p H (ExSet T)) \\ (\\c. CurrentConstruction mode p H (T c))\"\n unfolding CurrentConstruction_def atomize_eq by (simp_all add: \\expns split_paired_all)\n\nlemma \\ExTyp_strip_imp:\n \\ToA_Construction s (ExSet T) \\ (\\c. ToA_Construction s (T c))\\\n unfolding ToA_Construction_def by (simp add: \\expns)\n\nparagraph \\Introducing Existential Quantification\\\n\nlemma introduce_Ex:\n \\CurrentConstruction mode blk H (S x) \\ CurrentConstruction mode blk H (ExSet S)\\\n using \\apply_implication[OF _ ExSet_imp_I[OF implies_refl], THEN conjunct1] .\n\nlemma introduce_Ex_subj:\n \\CurrentConstruction mode blk H (S x \\\\\\\\ Q) \\ CurrentConstruction mode blk H (ExSet S \\\\\\\\ Q)\\\n by (metis Subjection_True Subjection_cong introduce_Ex)\n\nlemma introduce_Ex_pending:\n \\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ (\\v. Q x v) \\\\\\\\\\\\ E\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ (\\v. \\*x. Q x v) \\\\\\\\\\\\ E\\\n using \\apply_implication_pending[OF _ ExSet_imp_I[OF implies_refl]] .\n\nlemma introduce_Ex_pending_E:\n \\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ Q \\\\\\\\\\\\ (\\v. E x v)\n\\ \\

\\\\\\\\\\\\ f \\\\ blk [H] \\\\\\\\\\\\\\ \\\\ Q \\\\\\\\\\\\ (\\v. \\*x. E x v)\\\n using \\apply_implication_pending_E[OF _ ExSet_imp_I[OF implies_refl]] .\n\nlemma introduce_Ex_ToA:\n \\ ToA_Construction s (S x)\n\\ ToA_Construction s (ExSet S) \\\n using \\ExTyp_strip_imp by fastforce\n\nlemma introduce_Ex_ToA_subj:\n \\ ToA_Construction s (S x \\\\\\\\ Q)\n\\ ToA_Construction s (ExSet S \\\\\\\\ Q) \\\n by (metis Subjection_Flase Subjection_True introduce_Ex_ToA)\n\n\nparagraph \\Return\\\n\n\nlemma \\M_Success[intro!]:\n \\ v \\ (y \\ T)\n\\ \\

\\\\\\ Return (\\arg v) \\ X \\ \\u. X\\ y \\ Val u T \\ \\\\\\\\\\\\ Any \\\n unfolding \\Procedure_def det_lift_def Return_def\n by (clarsimp simp add: \\expns)\n\ndeclare \\M_Success[where X=1, simplified, intro!]\n\nlemma \\M_Success'[intro!]:\n \\ \\

\\\\\\ Return vs \\ X vs \\ X \\ \\\\\\\\\\\\ Any \\\n unfolding Return_def \\Procedure_def det_lift_def by (clarsimp simp add: \\expns)\n\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/Calculus_of_Programming.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5428632831725051, "lm_q1q2_score": 0.28414568910287114}} {"text": "theory LiarsStreet (*Christoph Benzmüller, 2020*)\n imports Main \n\nabbrevs \n Nilda=\"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a\" and Nilda=\"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a\" and And=\"( \\<^bold>a\\<^bold>n\\<^bold>d )\" and Or=\"( \\<^bold>o\\<^bold>r )\" and Not=\"(\\<^bold>n\\<^bold>o\\<^bold>t )\" and If_then=\"(\\<^bold>I\\<^bold>f \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n )\"\n and LiarsStreet=\"\\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t\" and TruthtellersRoad=\"\\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d\" and Lies=\"\\<^bold>(l\\<^bold>i\\<^bold>e\\<^bold>s )\"\n and Says_the_truth=\"(\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h )\" and Lives_not_in=\"( \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n )\" \n and Neither_nor_live_in=\"\\<^bold>(n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r \\<^bold>n\\<^bold>o\\<^bold>r \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n )\" and Both_live_in=\"\\<^bold>(b\\<^bold>o\\<^bold>t\\<^bold>h \\<^bold>a\\<^bold>n\\<^bold>d \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n )\" \n\nbegin \n(*unimportant*) nitpick_params [user_axioms,format=2,show_all]\n(*unimportant*) declare [[show_abbrevs=false]]\n\n(***********************************************************************************\n ****************** Some Basic Types of our Ontology ******************************\n ***********************************************************************************)\n\n(* There are some kids, could be many more *)\ndatatype Entity = Nilda (\"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a\") | Carla (\"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a\")\n\nlemma \"\\(\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a = \\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a)\" sledgehammer by simp\n\n(* There are some roads, could be many more *)\ndatatype Street = LiarsStreet (\"\\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t\") | TruthtellersRoad (\"\\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d\") \n\n(***********************************************************************************\n ****************** Controlled Natural Language Library ***************************\n ****************** Logic and Modalities ******************************************\n ***********************************************************************************)\n\ndefinition And (\"_ \\<^bold>a\\<^bold>n\\<^bold>d _\") where \"X \\<^bold>a\\<^bold>n\\<^bold>d Y \\ X \\ Y\"\nabbreviation Or (\"_ \\<^bold>o\\<^bold>r _\") where \"X \\<^bold>o\\<^bold>r Y \\ X \\ Y\"\ndefinition Not (\"\\<^bold>n\\<^bold>o\\<^bold>t _\") where \"\\<^bold>n\\<^bold>o\\<^bold>t X \\ \\X\"\ndefinition If_then (\"\\<^bold>I\\<^bold>f _ \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n _\") where \"\\<^bold>I\\<^bold>f X \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n Y \\ X \\ Y\"\n\n\n(* \"Says\" \"Knows\" \"Belief\" \"Obligation\", etc. as uninterpreted truth-functions\n --- which, of course, will lead to known paradoxes *)\nconsts Says::\"Entity\\bool\\bool\" (\"_ \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s _\") \nconsts Knows::\"Entity\\bool\\bool\" (\"_ \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s _\") \nconsts Believes::\"Entity\\bool\\bool\" (\"_ \\<^bold>b\\<^bold>e\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>v\\<^bold>e\\<^bold>s _\") \nconsts Obligation::\"Entity\\bool\\bool\" (\"_ \\<^bold>m\\<^bold>u\\<^bold>s\\<^bold>t\\<^bold>-\\<^bold>d\\<^bold>o _\") \n\n(* We can introduce some further derived modal NL phrases *)\ndefinition Lies (\"\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s _\") where \"\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s X \\ \\Y. \\<^bold>I\\<^bold>f (X \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s Y) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n \\<^bold>n\\<^bold>o\\<^bold>t Y\"\ndefinition Says_the_truth (\"\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h _\") \n where \"\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h X \\ \\Y. \\<^bold>I\\<^bold>f (X \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s Y) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n Y\" \n\n(* We add the above defintions to our \"bag\" called \"Defs\" — Unimportant *)\nnamed_theorems Defs\ndeclare Lies_def [Defs] Says_the_truth_def [Defs] \n\n\n(***********************************************************************************\n ****************** Controlled Natural Language Library ****************************\n ****************** Domain specific concepts ***************************************\n ***********************************************************************************)\n\n(* Uninterpreted predicate: Lives_in *)\nconsts Lives_in::\"Entity\\Street\\bool\" (\"_ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n _\") \n\n(* Further derived NL phrases that concern \"Lives_in\" *)\ndefinition Lives_not_in (\"_ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n _\")\n where \"X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>n\\<^bold>o\\<^bold>t\\<^bold>-\\<^bold>i\\<^bold>n G \\ \\<^bold>n\\<^bold>o\\<^bold>t (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)\"\ndefinition Neither_nor_live_in (\"\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r _ \\<^bold>n\\<^bold>o\\<^bold>r _ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n _\") \n where \"\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r X \\<^bold>n\\<^bold>o\\<^bold>r Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n G \\ (\\<^bold>n\\<^bold>o\\<^bold>t (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>n\\<^bold>o\\<^bold>t (Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G))\"\ndefinition Both_live_in (\"\\<^bold>b\\<^bold>o\\<^bold>t\\<^bold>h _ \\<^bold>a\\<^bold>n\\<^bold>d _ \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n _\") \n where \"\\<^bold>b\\<^bold>o\\<^bold>t\\<^bold>h X \\<^bold>a\\<^bold>n\\<^bold>d Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n G \\ (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G) \\<^bold>a\\<^bold>n\\<^bold>d (Y \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n G)\"\n\n(* We add the above defintions to our \"bag\" called \"Defs\" — Unimportant *)\ndeclare Lives_not_in_def [Defs] Neither_nor_live_in_def [Defs] Both_live_in_def [Defs] \n\n\n(***********************************************************************************\n ****************** Example Queries ************************************************\n ***********************************************************************************)\n\naxiomatization where\nA1: \"\\X. \\<^bold>I\\<^bold>f (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n (\\<^bold>l\\<^bold>i\\<^bold>e\\<^bold>s X)\" and\nA2: \"\\X. \\<^bold>I\\<^bold>f (X \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d) \\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>n (\\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s\\<^bold>-\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>-\\<^bold>t\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h X)\" \n\n\nlemma Question1:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops \n\n\n\nlemma Question1b:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>T\\<^bold>r\\<^bold>u\\<^bold>t\\<^bold>h\\<^bold>t\\<^bold>e\\<^bold>l\\<^bold>l\\<^bold>e\\<^bold>r\\<^bold>s\\<^bold>R\\<^bold>o\\<^bold>a\\<^bold>d)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops \n\nlemma Question2:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>n\\<^bold>e\\<^bold>i\\<^bold>t\\<^bold>h\\<^bold>e\\<^bold>r \\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>n\\<^bold>o\\<^bold>r \\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\"\n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops\n\nlemma Question3:\n assumes\n \"\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n \\<^bold>L\\<^bold>i\\<^bold>a\\<^bold>r\\<^bold>s\\<^bold>S\\<^bold>t\\<^bold>r\\<^bold>e\\<^bold>e\\<^bold>t)\" \n shows\n \"((\\<^bold>N\\<^bold>i\\<^bold>l\\<^bold>d\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S1) \\<^bold>a\\<^bold>n\\<^bold>d (\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>l\\<^bold>i\\<^bold>v\\<^bold>e\\<^bold>s\\<^bold>-\\<^bold>i\\<^bold>n S2))\" \n nitpick[satisfy] oops\n\n(*** Do we run into Paradoxes with the modelling of modalities? ***)\n\nconsts It_holds_that_One_plus_One_Equals_Two::bool\n It_holds_that_Fermats_last_Theorem_is_True::bool\n\n\n\nlemma Question8:\n assumes\n \"It_holds_that_One_plus_One_Equals_Two\" \n \"It_holds_that_Fermats_last_Theorem_is_True\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s It_holds_that_One_plus_One_Equals_Two\"\n shows\n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>s\\<^bold>a\\<^bold>y\\<^bold>s It_holds_that_Fermats_last_Theorem_is_True\" \n using assms(1) assms(2) assms(3) by auto\n\n\nlemma Question9:\n assumes\n \"It_holds_that_One_plus_One_Equals_Two\" \n \"It_holds_that_Fermats_last_Theorem_is_True\" \n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s It_holds_that_One_plus_One_Equals_Two\"\n shows\n \"\\<^bold>C\\<^bold>a\\<^bold>r\\<^bold>l\\<^bold>a \\<^bold>k\\<^bold>n\\<^bold>o\\<^bold>w\\<^bold>s It_holds_that_Fermats_last_Theorem_is_True\" \n sledgehammer [verbose](assms)\n nitpick oops\n\nend", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/CoursesAndTutorials/2020-ZhejiangUniversity/examples/LiarsStreet/LiarsStreet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2841456813606196}} {"text": "theory Semantics\nimports Model\nbegin\ntypedecl binop\naxiomatization apply_binop :: \"binop \\ val \\ val \\ val\"\n and plus minus :: binop\ntypedecl unop\naxiomatization apply_unop :: \"unop \\ val \\ val\"\ndatatype condition = Eq | Neq | Leq | Le | Geq | Gr\n\nfun eval_cond_aux :: \"val \\ val \\ (byte \\ byte \\ bool) \\ bool \\ bool\" where\n \"eval_cond_aux [] [] _ b = b\"\n| \"eval_cond_aux [] _ _ _ = undefined\"\n| \"eval_cond_aux _ [] _ _ = undefined\"\n| \"eval_cond_aux (v1#xs) (v2#ys) c b = (if v1=v2 then eval_cond_aux xs ys c b\n else c v1 v2)\"\n\nfun eval_cond :: \"condition \\ val \\ val \\ bool\" where\n \"eval_cond Eq v1 v2 = (v1=v2)\"\n| \"eval_cond Neq v1 v2 = (v1\\v2)\"\n| \"eval_cond Leq v1 v2 = eval_cond_aux v1 v2 (\\) True\"\n| \"eval_cond Le v1 v2 = eval_cond_aux v1 v2 (<) False\"\n| \"eval_cond Geq v1 v2 = eval_cond_aux v1 v2 (\\) True\"\n| \"eval_cond Gr v1 v2 = eval_cond_aux v1 v2 (>) False\"\n\ntype_synonym func = \"string \\ var list\"\n\ndatatype command =\n AssignConst var val \n| AssignVar var var\n| Load var var\n| Store var var\n| Malloc var var\n| Free var\n| BinOp binop var var var\n| UnOp unop var var\n| PtrPlus var var var\n| PtrSub var var var\n| Memcpy (dest: var) (source: var) (number: var)\n| Assume condition var var\n| Assert condition var var\n| Call \"func\" \"var list\"\n\nsubsection \\CFG\\\n\ntypedecl CFG_node\naxiomatization entry :: CFG_node and exit :: CFG_node\n\ntype_synonym edge = \"CFG_node \\ command \\ CFG_node\"\ntype_synonym cfg = \"func \\ edge set\"\ntype_synonym prog = \"string \\ cfg\"\n\nabbreviation can_allocate_from :: \"blocks \\ loc \\ blockname \\ val \\ bool\" where\n \"can_allocate_from B l n z \\\n 0 \\ \\The location is not at null.\\\n l < l + (loc64_ops.from_val z) \\ \\ \\The allocated block does not wrap around.\\\n \\ \\It doesn't overlap with any other block.\\\n (\\b\\set (raw_blocks B). \\(overlaps_with (n,l,l + (loc64_ops.from_val z)) b)) \\\n (\\b\\set (raw_blocks B). (case b of (n',_,_) \\ n'\\n)) \\ \\The name is new and unique\\\"\n\ntext \\Given a control flow graph as a map from function names to their body graphs, \n relate the semantics of the program. The program implicitly starts at ''main''.\\\ncontext fixes funs :: \"string \\ cfg option\" begin\ninductive semantics :: \"pre_config \\ command \\ pre_config option \\ bool\"\n and fun_semantics :: \"string \\ pre_config \\ pre_config \\ bool\"\n and cfg_reachable :: \"edge set \\ CFG_node \\ CFG_node \\ pre_config \\ pre_config \\ bool\" where SingleStep: \"\\\\cmd. (from,cmd,to) \\ es; semantics pre cmd (Some post)\\ \\ cfg_reachable es from to pre post\"\n| MultiStep: \"\\\\cmd. (from,cmd,to') \\ es; semantics pre cmd (Some interm); \n cfg_reachable es to' to interm post\\ \\ cfg_reachable es from to pre post\"\n| \"\\(funs f) = Some cfg; cfg_reachable (snd cfg) entry exit pre post\\ \\ fun_semantics f pre post\"\n| \"fits k x \\ semantics (S,B,M) (AssignConst x k) (Some (update_stack S x k,B,M))\"\n| \"size x = size y \\ semantics (S,B,M) (AssignVar x y) (Some (update_stack S x (lookup S y),B,M))\"\n| LoadFail: \n \"\\ \\y does not point into any block, i.e. is an invalid location\\\n base B (loc64_ops.from_val (lookup S y)) = 0 \\\n \\ \\This load would read past the end of the block.\\\n ((loc64_ops.from_val (lookup S y)) + (sizev x) > ende B (loc64_ops.from_val (lookup S y)) \\ \n \\ \\This would read past the maximum location and wrap around.\\\n (loc64_ops.from_val (lookup S y)) + (sizev x) \\ (loc64_ops.from_val (lookup S y))) \\\n semantics (S,B,M) (Load x y) None\"\n| LoadSuccess: \"\\\\(base B (loc64_ops.from_val (lookup S y)) = 0 \\ \n ((loc64_ops.from_val (lookup S y)) + (sizev x) > ende B (loc64_ops.from_val (lookup S y)) \\\n (loc64_ops.from_val (lookup S y)) + (sizev x) \\ (loc64_ops.from_val (lookup S y))));\n \\ \\The addressed memory cells are actually allocated.\\\n access M (loc64_ops.from_val (lookup S y)) (size x) = Some v\\ \\ \n semantics (S,B,M) (Load x y) (Some (update_stack S x v, B, M))\"\n| StoreFail:\n \"\\ \\x does not point into any block, i.e. is an invalid location\\\n base B (loc64_ops.from_val (lookup S x)) = 0 \\\n \\ \\This store woudl write past the end of the block.\\\n ((loc64_ops.from_val (lookup S x)) + (sizev y) > ende B (loc64_ops.from_val (lookup S x)) \\ \n \\ \\This would write past the maximum location and wrap around.\\\n (loc64_ops.from_val (lookup S x)) + (sizev y) \\ (loc64_ops.from_val (lookup S x))) \\\n semantics (S,B,M) (Store x y) None\"\n| StoreSuccess: \"\\(base B (loc64_ops.from_val (lookup S x)) = 0 \\ \n ((loc64_ops.from_val (lookup S x)) + (sizev y) > ende B (loc64_ops.from_val (lookup S x)) \\\n (loc64_ops.from_val (lookup S x)) + (sizev y) \\ (loc64_ops.from_val (lookup S x)))) \\ \n semantics (S,B,M) (Store x y) (Some (S, B, update_memory M (loc64_ops.from_val (lookup S x)) (lookup S y)))\"\n| MallocError: \"\n \\ \\If we would allocate 0 bytes or x can't hold a pointer.\\\n (\\v\\set (lookup S z). v = 0) \\ (size x \\ loc_N_B) \\ \n semantics (S,_,_) (Malloc x z) None\"\n| MallocSuccessNull: \"\\\\v\\set (lookup S z). v \\ 0; size x = loc_N_B\\ \\\n semantics (S,B,M) (Malloc x z) (Some (update_stack S x (null x),B,M))\"\n| MallocSuccess: \"\\\\v\\set (lookup S z). v \\ 0; size x = loc_N_B;\n \\ \\l and n are new, k is arbitrary\\\n can_allocate_from B l n (lookup S z); length k = length (lookup S z)\\ \\\n semantics (S,B,M) (Malloc x z) \n (Some (update_stack S x (loc64_ops.to_val l), \n Blocks ((n,l,l+(loc64_ops.from_val (lookup S z)))#raw_blocks B),\n update_memory M l k))\"\n| FreeError: \"loc64_ops.from_val (lookup S x) \\ base B (loc64_ops.from_val (lookup S x))\n \\ semantics (S,B,_) (Free x) None\"\n| FreeSuccess: \"\\loc64_ops.from_val (lookup S x) = y; y = base B y\\\n \\ semantics (S,B,M) (Free x) (Some (S,free_block B y, free_memory M y (ende B y)))\"\n| \"semantics (S,B,M) (BinOp b x y z) \n (Some (update_stack S x (apply_binop b (lookup S y) (lookup S z)),B,M))\"\n| \"semantics (S,B,M) (UnOp u x y) \n (Some (update_stack S x (apply_unop u (lookup S y)),B,M))\"\n| PtrPlusError: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n (\\v\\set (lookup S y). v = 0) \\ (y' + z' < base B y') \\ (y' + z' > ende B y')\\\n \\ semantics (S,B,M) (PtrPlus _ y z) None\"\n| PtrPlusSuccess: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n \\v\\set (lookup S y). v \\ 0; y' + z' \\ base B y'; y' + z' \\ ende B y'\\\n \\ semantics (S,B,M) (PtrPlus x y z) (Some (update_stack S x (loc64_ops.to_val (y'+z')),B,M))\"\n| PtrSubError: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n (\\v\\set (lookup S y). v = 0) \\ (from_block y' B \\ from_block z' B)\\\n \\ semantics (S,B,M) (PtrSub _ y z) None\"\n| PtrSubSuccess: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n \\v\\set (lookup S y). v \\ 0; from_block y' B = from_block z' B\\\n \\ semantics (S,B,M) (PtrSub x y z) (Some (update_stack S x (loc64_ops.to_val (y'-z')),B,M))\"\n| MemcpyError: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n x'=loc64_ops.from_val (lookup S x);\n \\ \\x or y do not point into any block, i.e. is an invalid location\\\n from_block x' B = None \\ from_block y' B = None \\\n \\ \\The size is too big, i.e. we would read/write out of bounds\\\n x'+z' > ende B x' \\ y'+z' > ende B y' \\\n \\ \\The two memory portions (pointer+size) overlap\\\n intv (x'+z') (bounds (raw_blocks B) y') \\ intv (y'+z') (bounds (raw_blocks B) x')\\ \n \\ semantics (S,B,M) (Memcpy x y z) None\"\n| MemcpySuccess: \"\\y'=loc64_ops.from_val (lookup S y); z'=loc64_ops.from_val (lookup S z);\n from_block x' B \\ None; from_block y' B \\ None; x'+z' \\ ende B x'; y'+z' \\ ende B y';\n \\(intv (x'+z') (bounds (raw_blocks B) y')); \\(intv (y'+z') (bounds (raw_blocks B) x'));\n access M y' (unat z') = Some v\\\n \\ semantics (S,B,M) (Memcpy x y z) (Some (S,B,update_memory M x' v))\"\n| \"eval_cond c (lookup S x) (lookup S y) \\ semantics (S,B,M) (Assume c x y) (Some (S,B,M))\"\n| AssertError: \"\\ eval_cond c (lookup S x) (lookup S y) \\ semantics (S,B,M) (Assert c x y) None\"\n| AssertSuccess: \"eval_cond c (lookup S x) (lookup S y) \\ semantics (S,B,M) (Assert c x y) (Some (S,B,M))\"\n| \"\\distinct args; length args = length params; list_all2 (\\a p. size a = size p) args params;\n fun_semantics f (Stack (bind_args_to_params (lookup S) params args),B,M) (S',B',M')\\\n \\ semantics (S,B,M) (Call (f,params) args) \n (Some (Stack (bind_args_to_params (lookup S') args params),B',M'))\"\nend\n\nabbreviation program_semantics :: \"prog \\ pre_config \\ bool\" where\n \"program_semantics program post \\ fun_semantics program ''main'' initial post\"\n\nlift_definition program_semantics_config :: \"prog \\ config \\ bool\" is\n \"program_semantics\" .\n\nabbreviation all_blocks_alloc :: \"block list \\ memory \\ bool\" where\n \"all_blocks_alloc B M \\ list_all (\\(n,l,u). \\x. intv x (l,u) \\ M x \\ None) B\"\n\nlift_definition blocks_alloc :: \"blocks \\ memory \\ bool\" is all_blocks_alloc .\n\nabbreviation config_blocks_alloc :: \"pre_config \\ bool\" where\n \"config_blocks_alloc \\ \\(_,B,M). blocks_alloc B M\"\n\nlemma assumes \"config_blocks_alloc pre\"\n shows \"(semantics pr pre cmd (Some post) \\ config_blocks_alloc post) \\\n (fun_semantics pr f pre post \\ config_blocks_alloc post) \\\n (cfg_reachable pr es from to pre post \\ config_blocks_alloc post)\"\nproof (induction rule: semantics_fun_semantics_cfg_reachable.induct)\n case (SingleStep \"from\" to es pre cmd post)\n then show ?case sorry\nnext\n case (MultiStep \"from\" to' es pre cmd interm to post)\n then show ?case sorry\nnext\n case (LoadFail B S y x M)\n then show ?case sorry\nnext\n case (LoadSuccess B S y x M v)\n then show ?case sorry\nnext\n case (StoreFail B S x y M)\n then show ?case sorry\nnext\n case (StoreSuccess B S x y M)\n then show ?case sorry\nnext\n case (MallocError S z x uu uv)\n then show ?case sorry\nnext\n case (MallocSuccessNull S z x B M)\n then show ?case sorry\nnext\n case (MallocSuccess S z x B l n k M)\n then show ?case sorry\nnext\n case (FreeError S x B uw)\n then show ?case sorry\nnext\n case (FreeSuccess S x y B M)\n then show ?case sorry\nnext\n case (PtrPlusError y' S y z' z B M ux)\n then show ?case sorry\nnext\n case (PtrPlusSuccess y' S y z' z B M x)\n then show ?case sorry\nnext\n case (PtrSubError y' S y z' z B M uy)\n then show ?case sorry\nnext\n case (PtrSubSuccess y' S y z' z B M x)\n then show ?case sorry\nnext\n case (MemcpyError y' S y z' z x' x B M)\n then show ?case sorry\nnext\n case (MemcpySuccess y' S y z' z x' B M v x)\n then show ?case sorry\nnext\n case (AssertError c S x y B M)\n then show ?case sorry\nnext\n case (AssertSuccess c S x y B M)\n then show ?case sorry\nqed oops\n\nlemma assumes \"config_def pre\"\n shows \"(semantics pr pre cmd (Some post) \\ config_def post) \\\n (fun_semantics pr f pre post \\ config_def post) \\\n (cfg_reachable pr es from to pre post \\ config_def post)\"\nproof (induction rule: semantics_fun_semantics_cfg_reachable.induct)\n case (SingleStep \"from\" to es pre cmd post')\n then show ?case sorry\nnext\n case (MultiStep \"from\" to' es pre cmd interm to post)\n then show ?case sorry\nnext\n case (LoadFail B S y x M)\n then show ?case sorry\nnext\n case (LoadSuccess B S y x M v)\n then show ?case sorry\nnext\n case (StoreFail B S x y M)\n then show ?case sorry\nnext\n case (StoreSuccess B S x y M)\n then show ?case sorry\nnext\n case (MallocError S z x uu uv)\n then show ?case sorry\nnext\n case (MallocSuccessNull S z x B M)\n then show ?case sorry\nnext\n case (MallocSuccess S z x B l n k M)\n then show ?case sorry\nnext\n case (FreeError S x B uw)\n then show ?case sorry\nnext\n case (FreeSuccess S x y B M)\n then show ?case sorry\nnext\n case (PtrPlusError y' S y z' z B M ux)\n then show ?case sorry\nnext\n case (PtrPlusSuccess y' S y z' z B M x)\n then show ?case sorry\nnext\n case (PtrSubError y' S y z' z B M uy)\n then show ?case sorry\nnext\n case (PtrSubSuccess y' S y z' z B M x)\n then show ?case sorry\nnext\n case (MemcpyError y' S y z' z x' x B M)\n then show ?case sorry\nnext\n case (MemcpySuccess y' S y z' z x' B M v x)\n then show ?case sorry\nnext\n case (AssertError c S x y B M)\n then show ?case sorry\nnext\n case (AssertSuccess c S x y B M)\n then show ?case sorry\nqed oops\n\nend", "meta": {"author": "firefighterduck", "repo": "isabroom", "sha": "f260dfab2f1f6854986d3c337e3d00ab7728aa26", "save_path": "github-repos/isabelle/firefighterduck-isabroom", "path": "github-repos/isabelle/firefighterduck-isabroom/isabroom-f260dfab2f1f6854986d3c337e3d00ab7728aa26/Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316991792861, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.2840632590357469}} {"text": "theory Leadsto_Map\n imports Leadsto Unified_PW_Hashing Liveness_Subsumption_Map Heap_Hash_Map Next_Key\nbegin\n\ndefinition map_to_set :: \"('b \\ 'a set) \\ 'a set\" where\n \"map_to_set m = (\\ (ran m))\"\n\nhide_const wait\n\ndefinition\n \"map_list_set_rel =\n {(ml, ms). dom ml = dom ms\n \\ (\\ k \\ dom ms. set (the (ml k)) = the (ms k) \\ distinct (the (ml k)))\n \\ finite (dom ml)\n }\"\n\ncontext Worklist_Map2_Defs\nbegin\n\ndefinition\n \"add_pw'_map3 passed wait a \\\n nfoldli (succs a) (\\(_, _, brk). \\brk)\n (\\a (passed, wait, _).\n do {\n RETURN (\n if empty a then\n (passed, wait, False)\n else if F' a then (passed, wait, True)\n else\n let k = key a; passed' = (case passed k of Some passed' \\ passed' | None \\ [])\n in\n if \\ x \\ set passed'. a \\ x then\n (passed, wait, False)\n else\n (passed(k \\ (a # passed')), a # wait, False)\n )\n }\n )\n (passed,wait,False)\"\n\ndefinition\n \"pw_map_inv3 \\ \\ (passed, wait, brk).\n \\ passed'. (passed, passed') \\ map_list_set_rel \\ pw_map_inv (passed', wait, brk)\n \"\n\ndefinition pw_algo_map3 where\n \"pw_algo_map3 = do\n {\n if F a\\<^sub>0 then RETURN (True, Map.empty)\n else if empty a\\<^sub>0 then RETURN (False, Map.empty)\n else do {\n (passed, wait) \\ RETURN ([key a\\<^sub>0 \\ [a\\<^sub>0]], [a\\<^sub>0]);\n (passed, wait, brk) \\ WHILEIT pw_map_inv3 (\\ (passed, wait, brk). \\ brk \\ wait \\ [])\n (\\ (passed, wait, brk). do\n {\n (a, wait) \\ take_from_list wait;\n ASSERT (reachable a);\n if empty a then RETURN (passed, wait, brk) else add_pw'_map3 passed wait a\n }\n )\n (passed, wait, False);\n RETURN (brk, passed)\n }\n }\n \"\n\nend \\ \\Worklist Map 2 Defs\\\n\nlemma map_list_set_rel_empty[refine, simp, intro]:\n \"(Map.empty, Map.empty) \\ map_list_set_rel\"\n unfolding map_list_set_rel_def by auto\n\nlemma map_list_set_rel_single:\n \"(ml(key a\\<^sub>0 \\ [a\\<^sub>0]), ms(key a\\<^sub>0 \\ {a\\<^sub>0})) \\ map_list_set_rel\" if \"(ml, ms) \\ map_list_set_rel\"\n using that unfolding map_list_set_rel_def by auto\n\ncontext Worklist_Map2\nbegin\n\nlemma refine_start[refine]:\n \"(([key a\\<^sub>0 \\ [a\\<^sub>0]], [a\\<^sub>0]), [key a\\<^sub>0 \\ {a\\<^sub>0}], [a\\<^sub>0]) \\ map_list_set_rel \\\\<^sub>r Id\"\n by (simp add: map_list_set_rel_single)\n\nlemma pw_map_inv_ref:\n \"pw_map_inv (x1, x2, x3) \\ (x1a, x1) \\ map_list_set_rel \\ pw_map_inv3 (x1a, x2, x3)\"\n unfolding pw_map_inv3_def by auto\n\nlemma refine_aux[refine]:\n \"(x1, x) \\ map_list_set_rel \\ ((x1, x2, False), x, x2, False) \\ map_list_set_rel \\\\<^sub>r Id \\\\<^sub>r Id\"\n by simp\n\nlemma map_list_set_relD:\n \"ms k = Some (set xs)\" if \"(ml, ms) \\ map_list_set_rel\" \"ml k = Some xs\"\n using that unfolding map_list_set_rel_def\n by clarsimp (metis (mono_tags, lifting) domD domI option.sel)\n\nlemma map_list_set_rel_distinct:\n \"distinct xs\" if \"(ml, ms) \\ map_list_set_rel\" \"ml k = Some xs\"\n using that unfolding map_list_set_rel_def by clarsimp (metis domI option.sel)\n\nlemma map_list_set_rel_NoneD1[dest, intro]:\n \"ms k = None\" if \"(ml, ms) \\ map_list_set_rel\" \"ml k = None\"\n using that unfolding map_list_set_rel_def by auto\n\nlemma map_list_set_rel_NoneD2[dest, intro]:\n \"ml k = None\" if \"(ml, ms) \\ map_list_set_rel\" \"ms k = None\"\n using that unfolding map_list_set_rel_def by auto\n\nlemma map_list_set_rel_insert:\n \"(ml, ms) \\ map_list_set_rel \\\n ml (key a) = Some xs \\\n ms (key a) = Some (set xs) \\\n a \\ set xs \\\n (ml(key a \\ a # xs), ms(key a \\ insert a (set xs))) \\ map_list_set_rel\"\n apply (frule map_list_set_rel_distinct) unfolding map_list_set_rel_def by auto\n\nlemma add_pw'_map3_ref:\n \"add_pw'_map3 ml xs a \\ \\ (map_list_set_rel \\\\<^sub>r Id) (add_pw'_map2 ms xs a)\"\n if \"(ml, ms) \\ map_list_set_rel\" \"\\ empty a\"\n using that unfolding add_pw'_map3_def add_pw'_map2_def\n apply refine_rcg\n apply refine_dref_type\n apply (simp; fail)\n apply (simp; fail)\n apply (simp; fail)\n apply (clarsimp simp: Let_def)\n apply safe\n subgoal\n by (auto dest: map_list_set_relD[OF _ sym])\n subgoal\n apply (auto split: option.split_asm)\n by (metis (mono_tags, lifting)\n map_list_set_relD map_list_set_rel_NoneD1 option.collapse option.sel option.simps(3)\n )\n subgoal premises prems for a ms x2a ml x2c\n proof (cases \"ml (key a)\")\n case None\n with \\(ml, ms) \\ map_list_set_rel\\ have \"ms (key a) = None\"\n by auto\n with None \\(ml, ms) \\ map_list_set_rel\\ show ?thesis\n by (auto intro: map_list_set_rel_single)\n next\n case (Some xs)\n from map_list_set_relD[OF \\(ml, ms) \\ map_list_set_rel\\ \\ml _ = _\\] have\n \"ms (key a) = Some (set xs)\"\n by auto\n moreover from prems have \"a \\ set xs\"\n by (metis Some empty_subsumes' local.eq_refl)\n ultimately show ?thesis\n using Some \\(ml, ms) \\ map_list_set_rel\\ by (auto intro: map_list_set_rel_insert)\n qed\n done\n\nlemma pw_algo_map3_ref[refine]:\n \"pw_algo_map3 \\ \\ (Id \\\\<^sub>r map_list_set_rel) pw_algo_map2\"\n unfolding pw_algo_map3_def pw_algo_map2_def\n apply refine_rcg\n apply refine_dref_type\n apply (simp; fail)+\n apply (clarsimp, rule refine_aux; assumption)\n by (auto intro: add_pw'_map3_ref pw_map_inv_ref)\n\nlemma pw_algo_map2_ref':\n \"pw_algo_map2 \\ \\ (bool_rel \\\\<^sub>r map_set_rel) pw_algo\"\nproof -\n note pw_algo_map2_ref\n also note pw_algo_map_ref\n also note pw_algo_unified_ref\n finally show ?thesis .\nqed\n\nlemma pw_algo_map3_ref'[refine]:\n \"pw_algo_map3 \\ \\ (bool_rel \\\\<^sub>r (map_list_set_rel O map_set_rel)) pw_algo\"\nproof -\n have [simp]:\n \"((bool_rel \\\\<^sub>r map_list_set_rel) O (bool_rel \\\\<^sub>r map_set_rel))\n = (bool_rel \\\\<^sub>r (map_list_set_rel O map_set_rel))\"\n unfolding relcomp_def prod_rel_def by auto\n note pw_algo_map3_ref\n also note pw_algo_map2_ref'\n finally show ?thesis\n by (simp add: conc_fun_chain)\nqed\n\nend \\ \\Worklist Map 2 Defs\\\n\nlemma (in Worklist_Map2_finite) map_set_rel_finite_domI[intro]:\n \"finite (dom m)\" if \"(m, S) \\ map_set_rel\"\n using that unfolding map_set_rel_def by auto\n\nlemma (in Worklist_Map2_finite) map_set_rel_finiteI:\n \"finite S\" if \"(m, S) \\ map_set_rel\"\n using that unfolding map_set_rel_def\n apply clarsimp\n apply (rule finite_Union)\n apply (auto intro: map_dom_ran_finite; fail)\n apply (auto simp: ran_def; fail)\n done\n\nlemma (in Worklist_Map2_finite) map_set_rel_finite_ranI[intro]:\n \"finite S'\" if \"(m, S) \\ map_set_rel\" \"S' \\ ran m\"\n using that unfolding map_set_rel_def ran_def by auto\n\nlocale Leadsto_Search_Space_Key =\n A: Worklist_Map2 _ _ _ _ _ _ _ succs1 +\n Leadsto_Search_Space for succs1\nbegin\n\nsublocale A': Worklist_Map2_finite a\\<^sub>0 \"\\ _. False\" \"(\\)\" empty \"(\\)\" E key succs1 \"\\ _. False\"\n by (standard; blast intro!: A.succs_correct)\n\ninterpretation B:\n Liveness_Search_Space_Key\n \"\\ x y. E x y \\ Q y \\ \\ empty y\" a\\<^sub>0 \"\\ _. False\" \"(\\)\" \"\\ x. A.reachable x \\ \\ empty x\"\n succs_Q key\n by standard (auto intro!: A.empty_subsumes')\n\ncontext\n fixes a\\<^sub>1 :: 'a\nbegin\n\ninterpretation B':\n Liveness_Search_Space_Key_Defs\n a\\<^sub>1 \"\\ _. False\" \"(\\)\" \"\\ x. A.reachable x \\ \\ empty x\"\n succs_Q \"\\ x y. E x y \\ Q y \\ \\ empty y\" key .\n\ndefinition has_cycle_map where\n \"has_cycle_map = B'.dfs_map\"\n\ncontext\n assumes \"A.reachable a\\<^sub>1\"\nbegin\n\ninterpretation B':\n Liveness_Search_Space_Key\n \"\\ x y. E x y \\ Q y \\ \\ empty y\" a\\<^sub>1 \"\\ _. False\" \"(\\)\" \"\\ x. A.reachable x \\ \\ empty x\"\n succs_Q key\n by standard\n\nlemmas has_cycle_map_ref[refine] = B'.dfs_map_dfs_refine[folded has_cycle_map_def has_cycle_def]\n\nend (* Reachability assumption *)\n\nend (* Second start state *)\n\ndefinition outer_inv where\n \"outer_inv passed done todo \\ \\ (r, passed').\n (r \\ (\\ a. A.reachable a \\ \\ empty a \\ P a \\ Q a \\ reaches_cycle a))\n \\ (\\ r \\\n (\\ a \\ \\ done. P a \\ Q a \\ \\ reaches_cycle a)\n \\ B.liveness_compatible passed'\n \\ passed' \\ {x. A.reachable x \\ \\ empty x}\n )\n \"\n\ndefinition inner_inv where\n \"inner_inv passed done todo \\ \\ (r, passed').\n (r \\ (\\ a. A.reachable a \\ \\ empty a \\ P a \\ Q a \\ reaches_cycle a))\n \\ (\\ r \\\n (\\ a \\ done. P a \\ Q a \\ \\ reaches_cycle a)\n \\ B.liveness_compatible passed'\n \\ passed' \\ {x. A.reachable x \\ \\ empty x}\n )\n \"\n\ndefinition leadsto' :: \"bool nres\" where\n \"leadsto' = do {\n (r, passed) \\ A'.pw_algo_map2;\n let passed = ran passed;\n (r, _) \\ FOREACHcdi (outer_inv passed) passed (\\(b,_). \\b)\n (\\ passed' (_,acc).\n FOREACHcdi (inner_inv acc) passed' (\\(b,_). \\b)\n (\\v' (_,passed).\n do {\n ASSERT(A.reachable v' \\ \\ empty v');\n if P v' \\ Q v' then has_cycle v' passed else RETURN (False, passed)\n }\n )\n (False, acc)\n )\n (False, {});\n RETURN r\n }\"\n\nlemma leadsto'_correct:\n \"leadsto' \\ leadsto_spec\"\nproof -\n define inv where\n \"inv \\ \\ passed it (r, passed').\n (r \\ (\\ a. A.reachable a \\ \\ empty a \\ P a \\ Q a \\ reaches_cycle a))\n \\ (\\ r \\\n (\\ a \\ passed - it. \\ reaches_cycle a)\n \\ B.liveness_compatible passed'\n \\ passed' \\ {x. A.reachable x \\ \\ empty x}\n )\n \"\n\n have [simp, intro]:\n \"\\ A'.F_reachable\"\n unfolding A'.F_reachable_def by simp\n\n have B_reaches_empty:\n \"\\ empty b\" if \"\\ empty a\" \"B.reaches a b\" for a b\n using that(2,1)by induction auto\n\n interpret Subgraph_Start E a\\<^sub>0 \"\\ a x. E a x \\ Q x \\ \\ empty x\"\n by standard auto\n\n have B_A_reaches:\n \"A.reaches a b\" if \"B.reaches a b\" for a b\n using that by (rule reaches)\n\n have reaches_iff: \"B.reaches a x \\ B.G.G'.reaches a x\"\n if \"A.reachable a\" \"\\ empty a\" for a x\n unfolding reaches_cycle_def\n apply standard\n using that\n apply (rotate_tac 3)\n apply (induction rule: rtranclp.induct)\n apply blast\n apply rule\n apply assumption\n apply (subst B.G.E'_def)\n subgoal for a b c\n by (auto dest: B_reaches_empty)\n subgoal\n by (rule B.G.reaches)\n done\n\n have reaches1_iff: \"B.reaches1 a x \\ B.G.G'.reaches1 a x\"\n if \"A.reachable a\" \"\\ empty a\" for a x\n unfolding reaches_cycle_def\n apply standard\n subgoal\n using that\n apply (rotate_tac 3)\n apply (induction rule: tranclp.induct)\n apply (rule tranclp.intros(1), auto simp: B.G.E'_def; fail)\n apply (\n rule tranclp.intros(2);\n auto 4 3 simp: B.G.E'_def dest:B_reaches_empty tranclp_into_rtranclp\n )\n done\n subgoal\n by (rule B.G.reaches1)\n done\n\n have reaches_cycle_iff: \"reaches_cycle a \\ (\\x. B.G.G'.reaches a x \\ B.G.G'.reaches1 x x)\"\n if \"A.reachable a\" \"\\ empty a\" for a\n unfolding reaches_cycle_def\n apply (subst reaches_iff[OF that])\n using reaches1_iff B.G.G'_reaches_V that by blast\n\n have aux1:\n \"\\ reaches_cycle x\"\n if\n \"\\a. A.reachable a \\ \\ empty a \\ (\\x\\passed. a \\ x)\"\n \"passed \\ {a. A.reachable a \\ \\ empty a}\"\n \"\\ y \\ ran passed'. \\ x \\ y. P x \\ Q x \\ \\ reaches_cycle x\"\n \"A.reachable x\" \"\\ empty x\" \"P x\" \"Q x\"\n \"(passed', passed) \\ A'.map_set_rel\"\n for x passed passed'\n proof (rule ccontr, simp)\n assume \"reaches_cycle x\"\n from that obtain x' where x':\"x' \\ passed\" \"x \\ x'\"\n by auto\n with \\(_, _) \\ _\\ obtain y where y: \"y \\ ran passed'\" \"x' \\ y\"\n unfolding A'.map_set_rel_def by auto\n from x' that have \"P x'\" \"Q x'\"\n by (auto intro: P_mono Q_mono)\n with \\x' \\ passed\\ that(3) y have \"\\ reaches_cycle x'\"\n by auto\n have \"A.reachable x'\" \"\\ empty x'\"\n using \\x' \\ passed\\ that(2) A.empty_mono \\x \\ x'\\ that(5) by auto\n note reaches_cycle_iff' = reaches_cycle_iff[OF this] reaches_iff[OF this] reaches1_iff[OF this]\n from \\reaches_cycle x\\ guess y unfolding reaches_cycle_def\n by safe\n interpret\n Subsumption_Graph_Pre_Nodes\n \"(\\)\" A.subsumes_strictly \"\\ x y. E x y \\ Q y \\ \\ empty y\"\n \"\\ x. A.reachable x \\ \\ empty x\"\n by standard (rule B.mono[simplified]; assumption)\n from \\B.reaches x y\\ \\x \\ x'\\ \\B.reaches1 y y\\ reaches_cycle_mono[OF B.finite_V] obtain y' where\n \"y \\ y'\" \"B.G.G'.reaches x' y'\" \"B.G.G'.reaches1 y' y'\"\n apply atomize_elim\n apply (subst (asm) reaches_iff[rotated 2])\n defer\n defer\n apply (subst (asm) reaches1_iff)\n defer\n defer\n using \\A.reachable x\\ \\\\ empty x\\ \\A.reachable x'\\ \\\\ empty x'\\ \\B.reaches1 y y\\\n by (auto simp: B.reaches1_reaches_iff2 dest!: B.G.G'_reaches_V)\n with \\A.reachable x'\\ \\\\ empty x'\\ have \"reaches_cycle x'\"\n unfolding reaches_cycle_iff'\n by auto\n with \\\\ reaches_cycle x'\\ show False ..\n qed\n\n note [refine_vcg] = A'.pw_algo_map2_correct[THEN order.trans]\n\n show ?thesis\n unfolding leadsto'_def leadsto_spec_def\n apply (refine_rcg refine_vcg)\n\n (* Input is finite 1 *)\n subgoal\n by (auto intro: map_dom_ran_finite)\n\n (* Outer invariant holds initially *)\n subgoal\n unfolding outer_inv_def B.liveness_compatible_def by simp\n\n (* Input is finite 2 *)\n subgoal\n by auto\n\n (* Inner invariant holds initially *)\n subgoal for x a b S1 S2 todo \\ aa passed\n unfolding inner_inv_def outer_inv_def by simp\n\n (* Assertion *)\n subgoal\n unfolding inner_inv_def outer_inv_def A'.map_set_rel_def by auto\n\n (* Assertion *)\n subgoal\n unfolding inner_inv_def outer_inv_def A'.map_set_rel_def by auto\n\n (* Inner invariant is preserved *)\n subgoal for _ _ b S1 S2 xa \\ aa passed S1' S2' a\\<^sub>1 \\' ab passed'\n unfolding outer_inv_def\n apply clarsimp\n subgoal premises prems for p\n proof -\n from prems have \"a\\<^sub>1 \\ p\"\n unfolding A'.map_set_rel_def by auto\n with \\passed \\ _\\ \\p \\ _\\ have \"A.reachable a\\<^sub>1\"\n by auto\n interpret B':\n Liveness_Search_Space\n \"\\ x y. E x y \\ Q y \\ \\ empty y\" a\\<^sub>1 \"\\ _. False\" \"(\\)\"\n \"\\ x. A.reachable x \\ \\ empty x\" succs_Q\n by standard\n from \\inner_inv _ _ _ _\\ have\n \"B'.liveness_compatible passed'\" \"passed' \\ {x. A.reachable x \\ \\ empty x}\"\n unfolding inner_inv_def by auto\n from B'.dfs_correct[OF _ this] \\passed \\ _\\ \\a\\<^sub>1 \\ _\\ \\p \\ _\\ have\n \"B'.dfs passed' \\ B'.dfs_spec\"\n by auto\n then show ?thesis\n unfolding has_cycle_def\n apply (rule order.trans)\n unfolding B'.dfs_spec_def\n apply clarsimp\n subgoal for r passed1\n apply (cases r)\n apply simp\n subgoal\n unfolding inner_inv_def\n using \\passed \\ _\\ \\a\\<^sub>1 \\ _\\ \\p \\ _\\\n apply simp\n apply (inst_existentials a\\<^sub>1)\n by (auto 4 3 simp: reaches_cycle_iff intro: prems)\n subgoal\n using \\inner_inv _ _ _ _\\ \\passed \\ _\\ \\a\\<^sub>1 \\ _\\ \\p \\ _\\ reaches_cycle_iff\n unfolding inner_inv_def by auto\n done\n done\n qed\n done\n\n (* Current state filtered out *)\n subgoal for x a b S1 S2 xa \\ aa ba S1a S2a xb \\' ab bb\n unfolding inner_inv_def by auto\n\n (* Break \\ inner inv \\ outer inv *)\n subgoal for x a b S1 S2 xa \\ aa ba S1a S2a \\'\n unfolding inner_inv_def outer_inv_def by auto\n\n (* \\ Break \\ inner inv \\ outer inv *)\n subgoal for x a b S1 S2 xa \\ aa ba \\'\n unfolding inner_inv_def outer_inv_def by auto\n\n (* Break \\ outer inv \\ cycle *)\n subgoal for x a b S1 S2 \\ aa ba\n unfolding outer_inv_def by auto\n\n (* \\ Break \\ outer inv \\ cycle *)\n (* I \\ \\ b \\ post *)\n subgoal for x a b \\ aa ba\n unfolding outer_inv_def by (auto dest!: aux1)\n\n done\n qed\n\nlemma init_ref[refine]:\n \"((False, Map.empty), False, {}) \\ bool_rel \\\\<^sub>r A'.map_set_rel\"\n unfolding A'.map_set_rel_def by auto\n\nlemma map_set_rel_id:\n \"Liveness_Search_Space_Key.map_set_rel key = A'.map_set_rel\"\n unfolding A'.map_set_rel_def B.map_set_rel_def ..\n\nlemma has_cycle_map_ref'[refine]:\n assumes \"(P1, P1') \\ A'.map_set_rel\" \"(a, a') \\ Id\" \"A.reachable a\" \"\\ empty a\"\n shows \"has_cycle_map a P1 \\ \\ (bool_rel \\\\<^sub>r A'.map_set_rel) (has_cycle a' P1')\"\n using has_cycle_map_ref assms by (auto simp: map_set_rel_id)\n\ndefinition leadsto_map3' :: \"bool nres\" where\n \"leadsto_map3' = do {\n (r, passed) \\ A'.pw_algo_map2;\n let passed = ran passed;\n (r, _) \\ FOREACHcd passed (\\(b,_). \\b)\n (\\ passed' (_,acc).\n do {\n passed' \\ SPEC (\\l. set l = passed');\n nfoldli passed' (\\(b,_). \\b)\n (\\v' (_,passed).\n if P v' \\ Q v' then has_cycle_map v' passed else RETURN (False, passed)\n )\n (False, acc)\n }\n )\n (False, Map.empty);\n RETURN r\n }\"\n\ndefinition \"pw_algo_map2_copy = A'.pw_algo_map2\"\n\nlemma [refine]:\n \"A'.pw_algo_map2 \\\n \\ (br id (\\ (_, m). finite (dom m) \\ (\\ k S. m k = Some S \\ finite S))) pw_algo_map2_copy\"\nproof -\n have [refine]:\n \"(x, x') \\ Id \\\n x' = (x1, x2) \\\n x = (x1a, x2a) \\\n A'.pw_map_inv (x1, x2, False)\n \\ ((x1a, x2a, False), x1, x2, False) \\\n (br id (\\ m. finite (dom m) \\ (\\ k S. m k = Some S \\ finite S))) \\\\<^sub>r Id \\\\<^sub>r Id\"\n for x x' x1 x2 x1a x2a\n by (auto simp: br_def A'.pw_map_inv_def A'.map_set_rel_def)\n show ?thesis\n unfolding pw_algo_map2_copy_def\n unfolding A'.pw_algo_map2_def\n apply refine_rcg\n apply refine_dref_type\n prefer 5\n apply assumption\n apply (assumption | (simp add: br_def; fail) | (auto simp: br_def; fail))+\n subgoal\n apply (clarsimp simp: br_def)\n subgoal premises prems\n using \\finite _\\ \\\\k S. _ \\ finite _\\\n unfolding A'.add_pw'_map2_def\n apply refine_rcg\n apply refine_dref_type\n apply (auto simp: Let_def split!: option.split)\n done\n done\n by (simp add: br_def)\nqed\n\nlemma leadsto_map3'_ref[refine]:\n \"leadsto_map3' \\ \\ Id leadsto'\"\n unfolding leadsto_map3'_def leadsto'_def\n apply (subst (2) pw_algo_map2_copy_def[symmetric])\n apply (subst (2) FOREACHcdi_def)\n apply (subst (2) FOREACHcd_def)\n apply refine_rcg\n apply refine_dref_type\n by (auto simp: br_def intro: map_dom_ran_finite)\n\ndefinition leadsto_map3 :: \"bool nres\" where\n \"leadsto_map3 = do {\n (r, passed) \\ A'.pw_algo_map3;\n let passed = ran passed;\n (r, _) \\ FOREACHcd passed (\\(b,_). \\b)\n (\\ passed' (_,acc).\n nfoldli passed' (\\(b,_). \\b)\n (\\v' (_,passed).\n if P v' \\ Q v' then has_cycle_map v' passed else RETURN (False, passed)\n )\n (False, acc)\n )\n (False, Map.empty);\n RETURN r\n }\"\n\nlemma start_ref:\n \"((False, Map.empty), False, Map.empty) \\ Id \\\\<^sub>r map_list_set_rel\"\n by simp\n\nlemma map_list_set_rel_ran_set_rel:\n \"(ran ml, ran ms) \\ \\br set (\\_. True)\\set_rel\" if \"(ml, ms) \\ map_list_set_rel\"\n using that unfolding map_list_set_rel_def set_rel_def\n apply safe\n subgoal for x\n by (auto simp: ran_def dom_def in_br_conv dest: A.map_list_set_relD[OF that])\n subgoal premises prems for x'\n proof -\n from prems(4) obtain a where \"ms a = Some x'\"\n unfolding ran_def by clarsimp\n with prems(1) obtain m' where\n \"ml a = Some (m' a)\"\n by (fastforce simp: dom_def ran_def)\n with prems(2) \\ms a = _\\ show ?thesis\n by (fastforce simp: in_br_conv dom_def ran_def)\n qed\n done\n\nlemma Id_list_rel_ref:\n \"(x'a, x'a) \\ \\Id\\list_rel\"\n by simp\n\nlemma map_list_set_rel_finite_ran:\n \"finite (ran ml)\" if \"(ml, ms) \\ map_list_set_rel\"\n using that unfolding map_list_set_rel_def by (auto intro: map_dom_ran_finite)\n\nlemma leadsto_map3_ref[refine]:\n \"leadsto_map3 \\ \\ Id leadsto'\"\n unfolding leadsto_map3_def leadsto'_def\n apply (subst (2) FOREACHcdi_def)\n apply (subst (2) FOREACHcd_def)\n apply (refine_rcg map_list_set_rel_ran_set_rel map_list_set_rel_finite_ran)\n prefer 4\n apply (rule rhs_step_bind_SPEC)\n apply (clarsimp simp: br_def; rule HOL.refl; fail)\n apply (refine_rcg Id_list_rel_ref; simp; fail)\n by auto\n\ndefinition leadsto_map4 :: \"bool nres\" where\n \"leadsto_map4 = do {\n (r, passed) \\ A'.pw_algo_map3;\n ASSERT (finite (dom passed));\n passed \\ ran_of_map passed;\n (r, _) \\ nfoldli passed (\\(b,_). \\b)\n (\\ passed' (_,acc).\n nfoldli passed' (\\(b,_). \\b)\n (\\v' (_,passed).\n if P v' \\ Q v' then has_cycle_map v' passed else RETURN (False, passed)\n )\n (False, acc)\n )\n (False, Map.empty);\n RETURN r\n }\"\n\nlemma ran_of_map_ref:\n \"ran_of_map m \\ SPEC (\\c. (c, ran m') \\ br set (\\ _. True))\" if \"finite (dom m)\" \"(m, m') \\ Id\"\n using ran_of_map_correct[OF that(1)] that(2) unfolding br_def by (simp add: pw_le_iff)\n\nlemma aux_ref:\n \"(xa, x'a) \\ Id \\\n x'a = (x1b, x2b) \\ xa = (x1c, x2c) \\ (x1c, x1b) \\ bool_rel\"\n by simp\n\ndefinition \"foo = A'.pw_algo_map3\"\n\nlemma [refine]:\n \"A'.pw_algo_map3 \\ \\ (br id (\\ (_, m). finite (dom m))) foo\"\nproof -\n have [refine]:\n \"(x, x') \\ Id \\\n x' = (x1, x2) \\\n x = (x1a, x2a) \\\n A'.pw_map_inv3 (x1, x2, False)\n \\ ((x1a, x2a, False), x1, x2, False) \\ (br id (\\ m. finite (dom m))) \\\\<^sub>r Id \\\\<^sub>r Id\"\n for x x' x1 x2 x1a x2a\n by (auto simp: br_def A'.pw_map_inv3_def map_list_set_rel_def)\n show ?thesis\n unfolding foo_def\n unfolding A'.pw_algo_map3_def\n apply refine_rcg\n apply refine_dref_type\n prefer 5\n apply assumption\n apply (assumption | (simp add: br_def; fail) | (auto simp: br_def; fail))+\n subgoal\n apply (clarsimp simp: br_def)\n subgoal premises prems\n using \\finite _\\\n unfolding A'.add_pw'_map3_def\n apply refine_rcg\n apply refine_dref_type\n apply (auto simp: Let_def)\n done\n done\n by (simp add: br_def)\nqed\n\nlemma leadsto_map4_ref[refine]:\n \"leadsto_map4 \\ \\ Id leadsto_map3\"\n unfolding leadsto_map4_def leadsto_map3_def FOREACHcd_def\n apply (subst (2) foo_def[symmetric])\n apply (refine_rcg ran_of_map_ref)\n apply refine_dref_type\n apply (simp add: br_def; fail)\n apply (simp add: br_def; fail)\n apply (rule rhs_step_bind_SPEC)\n by (auto simp: br_def)\n\ndefinition leadsto_map4' :: \"bool nres\" where\n \"leadsto_map4' = do {\n (r, passed) \\ A'.pw_algo_map2;\n ASSERT (finite (dom passed));\n passed \\ ran_of_map passed;\n (r, _) \\ nfoldli passed (\\(b,_). \\b)\n (\\ passed' (_,acc).\n do {\n passed' \\ SPEC (\\l. set l = passed');\n nfoldli passed' (\\(b,_). \\b)\n (\\v' (_,passed).\n if P v' \\ Q v' then has_cycle_map v' passed else RETURN (False, passed)\n )\n (False, acc)\n }\n )\n (False, Map.empty);\n RETURN r\n }\"\n\nlemma leadsto_map4'_ref:\n \"leadsto_map4' \\ \\ Id leadsto_map3'\"\n unfolding leadsto_map4'_def leadsto_map3'_def FOREACHcd_def\n apply (subst (2) pw_algo_map2_copy_def[symmetric])\n apply (refine_rcg ran_of_map_ref)\n apply refine_dref_type\n apply (simp add: br_def; fail)\n apply (simp add: br_def; fail)\n apply (rule rhs_step_bind_SPEC)\n by (auto simp: br_def)\n\nlemma leadsto_map4'_correct:\n \"leadsto_map4' \\ leadsto_spec_alt\"\nproof -\n note leadsto_map4'_ref\n also note leadsto_map3'_ref\n also note leadsto'_correct\n also note leadsto_spec_leadsto_spec_alt\n finally show ?thesis .\nqed\n\nend (* Leadsto Search Space Key *)\n\nend (* Theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Worklist_Algorithms/Leadsto_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2840421274806909}} {"text": "section\\The Axiom of Replacement in $M[G]$\\\ntheory Replacement_Axiom\n imports\n Separation_Axiom\nbegin\n\ncontext forcing_data1\nbegin\n\nbundle sharp_simps1 = snd_abs[simp] fst_abs[simp] fst_closed[simp del, simplified, simp]\n snd_closed[simp del, simplified, simp] M_inhabited[simplified, simp]\n pair_in_M_iff[simp del, simplified, simp]\n\nlemma sats_body_ground_repl_fm:\n includes sharp_simps1\n assumes\n \"\\t p. x=\\t,p\\\" \"[x,\\,m,\\,leq,\\] @ nenv \\list(M)\"\n \"\\\\formula\"\n shows\n \"(\\\\\\M. \\V\\M. is_Vset(\\a. (##M)(a),\\,V) \\ \\ \\ V \\ (snd(x) \\ \\ ([fst(x),\\]@nenv)))\n \\ M, [\\, x, m, \\, leq, \\] @ nenv \\ body_ground_repl_fm(\\)\"\n unfolding body_ground_repl_fm_def rename_split_fm_def\n by ((insert assms,rule iff_sats | simp add:nonempty[simplified])+,\n insert sats_incr_bv_iff[where bvs=\"[_,_,_,_,_,_]\", simplified],auto del: iffI)\n\nend \\ \\\\<^locale>\\forcing_data1\\\\\n\ncontext G_generic1\nbegin\n\nlemma Replace_sats_in_MG:\n assumes\n \"c\\M[G]\" \"env \\ list(M[G])\"\n \"\\ \\ formula\" \"arity(\\) \\ 2 +\\<^sub>\\ length(env)\"\n \"univalent(##M[G], c, \\x v. (M[G] , [x,v]@env \\ \\) )\"\n and\n ground_replacement:\n \"\\nenv. ground_replacement_assm(M,[\\,leq,\\] @ nenv, \\)\"\n shows\n \"{v. x\\c, v\\M[G] \\ (M[G] , [x,v]@env \\ \\)} \\ M[G]\"\nproof -\n let ?R = \"\\ x v . v\\M[G] \\ (M[G] , [x,v]@env \\ \\)\"\n from \\c\\M[G]\\\n obtain \\' where \"val(G, \\') = c\" \"\\' \\ M\"\n using GenExt_def by auto\n then\n have \"domain(\\')\\\\\\M\" (is \"?\\\\M\")\n using cartprod_closed domain_closed by simp\n from \\val(G, \\') = c\\\n have \"c \\ val(G,?\\)\"\n using def_val[of G ?\\] elem_of_val[of _ G \\'] one_in_G\n domain_of_prod[OF one_in_P, of \"domain(\\')\"]\n by (force del:M_genericD)\n from \\env \\ _\\\n obtain nenv where \"nenv\\list(M)\" \"env = map(val(G),nenv)\"\n using map_val by auto\n then\n have \"length(nenv) = length(env)\" by simp\n with \\arity(\\) \\ _\\\n have \"arity(\\) \\ 2 +\\<^sub>\\ length(nenv)\" by simp\n define f where \"f(\\p) \\ \\ \\. \\\\M \\ (\\\\\\M. \\ \\ Vset(\\) \\\n (snd(\\p) \\ \\ ([fst(\\p),\\] @ nenv)))\" (is \"_ \\ \\ \\. ?P(\\p,\\)\") for \\p\n have \"f(\\p) = (\\ \\. \\\\M \\ (\\\\\\M. \\V\\M. is_Vset(##M,\\,V) \\ \\\\V \\\n (snd(\\p) \\ \\ ([fst(\\p),\\] @ nenv))))\" (is \"_ = (\\ \\. \\\\M \\ ?Q(\\p,\\))\") for \\p\n unfolding f_def using Vset_abs Vset_closed Ord_Least_cong[of \"?P(\\p)\" \"\\ \\. \\\\M \\ ?Q(\\p,\\)\"]\n by (simp, simp del:setclass_iff)\n moreover\n note inM = \\nenv\\list(M)\\ \\?\\\\M\\\n moreover\n have \"f(\\p) \\ M\" \"Ord(f(\\p))\" for \\p\n unfolding f_def using Least_closed'[of \"?P(\\p)\"] by simp_all\n ultimately\n have 1:\"least(##M,\\\\. ?Q(\\p,\\),f(\\p))\" for \\p\n using least_abs'[of \"\\\\. \\\\M \\ ?Q(\\p,\\)\" \"f(\\p)\"] least_conj\n by (simp flip: setclass_iff)\n define QQ where \"QQ\\?Q\"\n from 1\n have \"least(##M,\\\\. QQ(\\p,\\),f(\\p))\" for \\p\n unfolding QQ_def .\n have body:\"(M, [\\p,m,\\,leq,\\] @ nenv \\ ground_repl_fm(\\)) \\ least(##M, QQ(\\p), m)\"\n if \"\\p\\M\" \"\\p\\?\\\" \"m\\M\" for \\p m\n proof -\n note inM that\n moreover from this assms 1\n have \"(M , [\\,\\p,m,\\,leq,\\] @ nenv \\ body_ground_repl_fm(\\)) \\ ?Q(\\p,\\)\" if \"\\\\M\" for \\\n using that sats_body_ground_repl_fm[of \\p \\ m nenv \\]\n by auto\n moreover from calculation\n have body:\"\\\\. \\ \\ M \\ (\\\\\\M. \\V\\M. is_Vset(\\a. a\\M, \\, V) \\ \\ \\ V \\\n (snd(\\p) \\ \\ ([fst(\\p),\\] @ nenv))) \\\n M, Cons(\\, [\\p, m, \\, leq, \\] @ nenv) \\ body_ground_repl_fm(\\)\"\n by simp\n ultimately\n show \"(M , [\\p,m,\\,leq,\\] @ nenv \\ ground_repl_fm(\\)) \\ least(##M, QQ(\\p), m)\"\n using sats_least_fm[OF body,of 1] unfolding QQ_def ground_repl_fm_def\n by (simp, simp flip: setclass_iff)\n qed\n then\n have \"univalent(##M, ?\\, \\\\p m. M , [\\p,m] @ ([\\,leq,\\] @ nenv) \\ ground_repl_fm(\\))\"\n unfolding univalent_def by (auto intro:unique_least)\n moreover from \\length(_) = _\\ \\env \\ _\\\n have \"length([\\,leq,\\] @ nenv) = 3 +\\<^sub>\\ length(env)\" by simp\n moreover from \\arity(\\) \\ 2 +\\<^sub>\\ length(nenv)\\\n \\length(_) = length(_)\\[symmetric] \\nenv\\_\\ \\\\\\_\\\n have \"arity(ground_repl_fm(\\)) \\ 5 +\\<^sub>\\ length(env)\"\n using arity_ground_repl_fm[of \\] le_trans Un_le by auto\n moreover from \\\\\\formula\\\n have \"ground_repl_fm(\\)\\formula\" by simp\n moreover\n note \\length(nenv) = length(env)\\ inM\n ultimately\n obtain Y where \"Y\\M\"\n \"\\m\\M. m \\ Y \\ (\\\\p\\M. \\p \\ ?\\ \\ (M, [\\p,m] @ ([\\,leq,\\] @ nenv) \\ ground_repl_fm(\\)))\"\n using ground_replacement[of nenv]\n unfolding strong_replacement_def ground_replacement_assm_def replacement_assm_def by auto\n with \\least(_,QQ(_),f(_))\\ \\f(_) \\ M\\ \\?\\\\M\\ body\n have \"f(\\p)\\Y\" if \"\\p\\?\\\" for \\p\n using that transitivity[OF _ \\?\\\\M\\]\n by (clarsimp,rename_tac \\ p \\p, rule_tac x=\"\\\\,p\\\" in bexI, auto)\n from \\Y\\M\\\n have \"\\ {y\\Y. Ord(y)} \\ M\" (is \"?sup \\ M\")\n using separation_Ord separation_closed Union_closed by simp\n then\n have \"{x\\Vset(?sup). x \\ M} \\ {\\} \\ M\" (is \"?big_name \\ M\")\n using Vset_closed cartprod_closed singleton_closed by simp\n then\n have \"val(G,?big_name) \\ M[G]\"\n by (blast intro:GenExtI)\n have \"{v. x\\c, ?R(x,v)} \\ val(G,?big_name)\" (is \"?repl\\?big\")\n proof(intro subsetI)\n fix v\n assume \"v\\?repl\"\n moreover from this\n obtain x where \"x\\c\" \"M[G], [x, v] @ env \\ \\\" \"v\\M[G]\"\n by auto\n moreover\n note \\val(G,\\')=c\\ \\\\'\\M\\\n moreover\n from calculation\n obtain \\ p where \"\\\\,p\\\\\\'\" \"val(G,\\) = x\" \"p\\G\" \"\\\\M\"\n using elem_of_val_pair' by blast\n moreover from this \\v\\M[G]\\\n obtain \\ where \"val(G,\\) = v\" \"\\\\M\"\n using GenExtD by (force del:M_genericD)\n moreover\n note \\\\\\_\\ \\nenv\\_\\ \\env = _\\ \\arity(\\)\\ 2 +\\<^sub>\\ length(env)\\\n ultimately\n obtain q where \"q\\G\" \"q \\ \\ ([\\,\\]@nenv)\" \"q\\\\\"\n using truth_lemma[OF \\\\\\_\\,of \"[\\,\\] @ nenv\"]\n by auto\n with \\\\\\,p\\\\\\'\\ \\\\\\,q\\\\?\\ \\ f(\\\\,q\\)\\Y\\\n have \"f(\\\\,q\\)\\Y\"\n using generic by blast\n let ?\\=\"succ(rank(\\))\"\n note \\\\\\M\\\n moreover from this\n have \"?\\ \\ M\" \"\\ \\ Vset(?\\)\"\n using rank_closed cons_closed Vset_Ord_rank_iff\n by (simp_all flip: setclass_iff)\n moreover\n note \\q \\ \\ ([\\,\\] @ nenv)\\\n ultimately\n have \"?P(\\\\,q\\,?\\)\" by (auto simp del: Vset_rank_iff)\n moreover\n have \"(\\ \\. ?P(\\\\,q\\,\\)) = f(\\\\,q\\)\"\n unfolding f_def by simp\n ultimately\n obtain \\ where \"\\\\M\" \"\\ \\ Vset(f(\\\\,q\\))\" \"q \\ \\ ([\\,\\] @ nenv)\"\n using LeastI[of \"\\ \\. ?P(\\\\,q\\,\\)\" ?\\] by auto\n with \\q\\G\\ \\\\\\M\\ \\nenv\\_\\ \\arity(\\)\\ 2 +\\<^sub>\\ length(nenv)\\\n have \"M[G], map(val(G),[\\,\\] @ nenv) \\ \\\"\n using truth_lemma[OF \\\\\\_\\, of \"[\\,\\] @ nenv\"] by auto\n moreover from \\x\\c\\ \\c\\M[G]\\\n have \"x\\M[G]\" using transitivity_MG by simp\n moreover\n note \\M[G],[x,v] @ env\\ \\\\ \\env = map(val(G),nenv)\\ \\\\\\M\\ \\val(G,\\)=x\\\n \\univalent(##M[G],_,_)\\ \\x\\c\\ \\v\\M[G]\\\n ultimately\n have \"v=val(G,\\)\"\n using GenExtI[of \\ G] unfolding univalent_def by (auto)\n from \\\\ \\ Vset(f(\\\\,q\\))\\ \\Ord(f(_))\\ \\f(\\\\,q\\)\\Y\\\n have \"\\ \\ Vset(?sup)\"\n using Vset_Ord_rank_iff lt_Union_iff[of _ \"rank(\\)\"] by auto\n with \\\\\\M\\\n have \"val(G,\\) \\ val(G,?big_name)\"\n using domain_of_prod[of \\ \"{\\}\" \"{x\\Vset(?sup). x \\ M}\" ] def_val[of G ?big_name]\n one_in_G one_in_P by (auto simp del: Vset_rank_iff)\n with \\v=val(G,\\)\\\n show \"v \\ val(G,?big_name)\"\n by simp\n qed\n from \\?big_name\\M\\\n have \"?repl = {v\\?big. \\x\\c. M[G], [x,v] @ env \\ \\}\" (is \"_ = ?rhs\")\n proof(intro equalityI subsetI)\n fix v\n assume \"v\\?repl\"\n with \\?repl\\?big\\\n obtain x where \"x\\c\" \"M[G], [x, v] @ env \\ \\\" \"v\\?big\"\n using subsetD by auto\n with \\univalent(##M[G],_,_)\\ \\c\\M[G]\\\n show \"v \\ ?rhs\"\n unfolding univalent_def\n using transitivity_MG ReplaceI[of \"\\ x v. \\x\\c. M[G], [x, v] @ env \\ \\\"] by blast\n next\n fix v\n assume \"v\\?rhs\"\n then\n obtain x where\n \"v\\val(G, ?big_name)\" \"M[G], [x, v] @ env \\ \\\" \"x\\c\"\n by blast\n moreover from this \\c\\M[G]\\\n have \"v\\M[G]\" \"x\\M[G]\"\n using transitivity_MG GenExtI[OF \\?big_name\\_\\,of G] by auto\n moreover from calculation \\univalent(##M[G],_,_)\\\n have \"?R(x,y) \\ y = v\" for y\n unfolding univalent_def by auto\n ultimately\n show \"v\\?repl\"\n using ReplaceI[of ?R x v c]\n by blast\n qed\n moreover\n let ?\\ = \"(\\\\\\\\0 \\ 2 +\\<^sub>\\ length(env) \\ \\ \\\\\\)\"\n from \\\\\\_\\\n have \"?\\\\formula\" \"arity(?\\) \\ 2 +\\<^sub>\\ length(env)\"\n using pred_mono[OF _ \\arity(\\)\\2+\\<^sub>\\length(env)\\] lt_trans[OF _ le_refl]\n by (auto simp add:ord_simp_union arity)\n moreover\n from \\\\\\_\\ \\arity(\\)\\2+\\<^sub>\\length(env)\\ \\c\\M[G]\\ \\env\\_\\\n have \"(\\x\\c. M[G], [x,v] @ env \\ \\) \\ M[G], [v] @ env @ [c] \\ ?\\\" if \"v\\M[G]\" for v\n using that nth_concat transitivity_MG[OF _ \\c\\M[G]\\] arity_sats_iff[of \\ \"[c]\" _ \"[_,v]@env\"]\n by auto\n moreover from this\n have \"{v\\?big. \\x\\c. M[G], [x,v] @ env \\ \\} = {v\\?big. M[G], [v] @ env @ [c] \\ ?\\}\"\n using transitivity_MG[OF _ GenExtI, OF _ \\?big_name\\M\\]\n by simp\n moreover from calculation and \\env\\_\\ \\c\\_\\ \\?big\\M[G]\\\n have \"{v\\?big. M[G] , [v] @ env @ [c] \\ ?\\} \\ M[G]\"\n using Collect_sats_in_MG by auto\n ultimately\n show ?thesis by simp\nqed\n\ntheorem strong_replacement_in_MG:\n assumes\n \"\\\\formula\" and \"arity(\\) \\ 2 +\\<^sub>\\ length(env)\" \"env \\ list(M[G])\"\n and\n ground_replacement:\n \"\\nenv. ground_replacement_assm(M,[\\,leq,\\] @ nenv, \\)\"\n shows\n \"strong_replacement(##M[G],\\x v. M[G],[x,v] @ env \\ \\)\"\nproof -\n let ?R=\"\\x y . M[G], [x, y] @ env \\ \\\"\n {\n fix A\n let ?Y=\"{v . x \\ A, v\\M[G] \\ ?R(x,v)}\"\n assume 1: \"(##M[G])(A)\" \"univalent(##M[G], A, ?R)\"\n with assms\n have \"(##M[G])(?Y)\"\n using Replace_sats_in_MG ground_replacement 1\n unfolding ground_replacement_assm_def by auto\n have \"b \\ ?Y \\ (\\x[##M[G]]. x \\ A \\ ?R(x,b))\" if \"(##M[G])(b)\" for b\n proof(rule)\n from \\(##M[G])(A)\\\n show \"\\x[##M[G]]. x \\ A \\ ?R(x,b)\" if \"b \\ ?Y\"\n using that transitivity_MG by auto\n next\n show \"b \\ ?Y\" if \"\\x[##M[G]]. x \\ A \\ ?R(x,b)\"\n proof -\n from \\(##M[G])(b)\\\n have \"b\\M[G]\" by simp\n with that\n obtain x where \"(##M[G])(x)\" \"x\\A\" \"b\\M[G] \\ ?R(x,b)\"\n by blast\n moreover from this 1 \\(##M[G])(b)\\\n have \"x\\M[G]\" \"z\\M[G] \\ ?R(x,z) \\ b = z\" for z\n unfolding univalent_def\n by auto\n ultimately\n show ?thesis\n using ReplaceI[of \"\\ x y. y\\M[G] \\ ?R(x,y)\"] by blast\n qed\n qed\n then\n have \"\\b[##M[G]]. b \\ ?Y \\ (\\x[##M[G]]. x \\ A \\ ?R(x,b))\"\n by simp\n with \\(##M[G])(?Y)\\\n have \" (\\Y[##M[G]]. \\b[##M[G]]. b \\ Y \\ (\\x[##M[G]]. x \\ A \\ ?R(x,b)))\"\n by auto\n }\n then show ?thesis unfolding strong_replacement_def\n by simp\nqed\n\nlemma replacement_assm_MG:\n assumes\n ground_replacement:\n \"\\nenv. ground_replacement_assm(M,[\\,leq,\\] @ nenv, \\)\"\n shows\n \"replacement_assm(M[G],env,\\)\"\n using assms strong_replacement_in_MG\n unfolding replacement_assm_def by simp\n\nend \\ \\\\<^locale>\\G_generic1\\\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Independence_CH/Replacement_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2840421198068635}} {"text": "subsection \\State Monad\\\n\ntheory State_Monad_Ext\n imports \"HOL-Library.State_Monad\"\nbegin\n\ndefinition fun_app_lifted :: \"('M,'a \\ ('M, 'b) state) state \\ ('M,'a) state \\ ('M,'b) state\" where\n \"fun_app_lifted f\\<^sub>T x\\<^sub>T \\ do { f \\ f\\<^sub>T; x \\ x\\<^sub>T; f x }\"\n\nbundle state_monad_syntax begin\n\nnotation fun_app_lifted (infixl \".\" 999)\ntype_synonym ('a,'M,'b) fun_lifted = \"'a \\ ('M,'b) state\" (\"_ ==_\\ _\" [3,1000,2] 2)\ntype_synonym ('a,'b) dpfun = \"'a ==('a\\'b)\\ 'b\" (infixr \"\\\\<^sub>T\" 2)\ntype_notation state (\"[_| _]\")\n\nnotation State_Monad.return (\"\\_\\\")\nnotation (ASCII) State_Monad.return (\"(#_#)\")\nnotation Transfer.Rel (\"Rel\")\n\nend\n\ncontext includes state_monad_syntax begin\n\nqualified lemma return_app_return:\n \"\\f\\ . \\x\\ = f x\"\n unfolding fun_app_lifted_def bind_left_identity ..\n\nqualified lemma return_app_return_meta:\n \"\\f\\ . \\x\\ \\ f x\"\n unfolding return_app_return .\n\nqualified definition if\\<^sub>T :: \"('M, bool) state \\ ('M, 'a) state \\ ('M, 'a) state \\ ('M, 'a) state\" where\n \"if\\<^sub>T b\\<^sub>T x\\<^sub>T y\\<^sub>T \\ do {b \\ b\\<^sub>T; if b then x\\<^sub>T else y\\<^sub>T}\"\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/state_monad/State_Monad_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2839041234137523}} {"text": "theory Linearization\nimports \"../LinearAssembly/LinearAssemblyLanguage\" \"../Utilities/Iterate\"\nbegin\n\nfun state_convert :: \"assembly_state \\ l_assembly_state\" where\n \"state_convert (\\, a, d, \\, s, \\) = (\\, a, d, \\ @ [JAssm {EQ, GT, LT} s], \\)\"\n\nfun linearize_step :: \"code_label\\<^sub>2 \\ assembly list \\ code_label\\<^sub>2 \\ l_assembly_program \\ \n l_assembly_program\" where\n \"linearize_step (s, \\, s') \\ = (s, \\ @ [JAssm {EQ, GT, LT} s']) # \\\"\n\ndefinition linearize :: \"assembly_program \\ l_assembly_program\" where\n \"linearize \\ = finite_map_fold linearize_step [] \\\"\n\n(* linearization correct *)\n\n\n\nlemma [simp]: \"finite (dom \\) \\ \\ x = None \\ \n lookup (finite_map_fold linearize_step [] \\) x = None\"\n proof (induction linearize_step \"[]::code_label\\<^sub>2 \\ assembly list\" \\ rule: finite_map_fold.induct)\n case 1\n thus ?case by metis\n next case 2\n thus ?case by simp\n next case (3 \\)\n let ?x = \"SOME x. x \\ dom \\\"\n let ?ih = \"finite_map_fold linearize_step [] (\\(?x := None))\"\n from 3 have \"?x \\ dom \\\" by (smt Collect_empty_eq card_0_eq dom_def mem_Collect_eq someI_ex)\n with 3 have \"x \\ ?x\" by blast\n with 3 show ?case by (cases \"the (\\ ?x)\") (simp add: Let_def)\n qed\n\nlemma [simp]: \"finite (dom \\) \\ \\ x = Some (\\, s) \\ \n lookup (finite_map_fold linearize_step [] \\) x = Some (\\ @ [JAssm {EQ, GT, LT} s])\"\n proof (induction linearize_step \"[]::code_label\\<^sub>2 \\ assembly list\" \\ rule: finite_map_fold.induct)\n case 1\n thus ?case by metis\n next case 2\n thus ?case by (metis card_0_eq dom_eq_empty_conv option.distinct(1))\n next case (3 \\)\n let ?x = \"SOME x. x \\ dom \\\"\n let ?ih = \"finite_map_fold linearize_step [] (\\(?x := None))\"\n show ?case\n proof (cases \"x = ?x\")\n case True\n with 3 have \"\\ ?x = Some (\\, s)\" by blast\n with True have \"lookup (linearize_step (?x, the (\\ ?x)) ?ih) x = \n Some (\\ @ [JAssm {EQ, GT, LT} s])\" by (cases \"the (\\ ?x)\") simp\n with 3 show ?thesis by (simp add: Let_def)\n next case False\n with 3 show ?thesis by (cases \"the (\\ ?x)\") (simp add: Let_def)\n qed\n qed\n\nlemma [simp]: \"finite (dom \\) \\ \\ x = Some (\\, s) \\ \n lookup (linearize \\) x = Some (\\ @ [JAssm {EQ, GT, LT} s])\"\n by (simp add: linearize_def)\n\nlemma [simp]: \"finite (dom \\) \\ domain_distinct (finite_map_fold linearize_step [] \\)\"\n proof (induction linearize_step \"[]::code_label\\<^sub>2 \\ assembly list\" \\ rule: finite_map_fold.induct)\n case 1\n thus ?case by metis\n next case 2\n thus ?case by simp\n next case (3 \\)\n let ?x = \"SOME x. x \\ dom \\\"\n let ?ih = \"finite_map_fold linearize_step [] (\\(?x := None))\"\n show ?case\n proof (cases \"the (\\ ?x)\")\n case (Pair \\ s)\n from 3 have \"lookup ?ih ?x = None\" by simp\n hence \"?x \\ dom (lookup ?ih)\" by auto\n with 3 Pair show ?thesis by (simp add: Let_def)\n qed\n qed\n\nlemma [simp]: \"finite (dom \\) \\ domain_distinct (linearize \\)\"\n by (simp add: linearize_def)\n\nlemma [simp]: \"finite (dom \\) \\ eval_assembly \\ \\ = Some \\' \\ \n eval_l_assembly (linearize \\) (state_convert \\) = Some (state_convert \\')\"\n proof (induction \\ \\ rule: eval_assembly.induct)\n case (1 \\ \\ a d s \\)\n thus ?case by (cases \"\\ s\") (auto split: prod.splits)\n next case 2\n thus ?case by auto\n next case 3\n thus ?case by (auto simp add: Let_def)\n next case 4\n thus ?case by simp\n next case (5 \\ \\ a d jmp s \\ s' \\)\n thus ?case by (cases \"\\ s\") auto\n next case 6\n thus ?case by auto\n qed\n\ntheorem linearization_correct [simp]: \"iterate (eval_assembly \\) \\ \\' \\ finite (dom \\) \\ \n iterate (eval_l_assembly (linearize \\)) (state_convert \\) (state_convert \\')\"\n by (induction \"eval_assembly \\\" \\ \\' rule: iterate.induct) simp_all\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Elements", "sha": "695d842d865d1524a9e638f778b0bad97485b969", "save_path": "github-repos/isabelle/xtreme-james-cooper-Elements", "path": "github-repos/isabelle/xtreme-james-cooper-Elements/Elements-695d842d865d1524a9e638f778b0bad97485b969/Assembly/Linearization.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.28390412341375226}} {"text": " (*-------------------------------------------*\n | |\n | Test on LW-CSP-Prover |\n | |\n *-------------------------------------------*)\n\ntheory Test\nimports CSP_semantics\nbegin\n\n(*************************************************************\n\n 1. Test\n 2. \n 3. \n 4. \n\n *************************************************************)\n\n(* test of transition *)\n\ndatatype K_Events = lock | unlock | finish\ndatatype K_PName = Key\n\nprimrec\n Def :: \"K_PName => (K_PName, K_Events) proc\"\n where\n \"Def Key = (lock -> unlock -> $Key) [+] (finish -> STOP)\"\n\noverloading K_PNfun == \n \"PNfun :: K_PName => (K_PName, K_Events) proc\"\n begin definition \"PNfun = Def\" end\n declare K_PNfun_def [simp]\n\nlemma trn_exists:\n \"$Key ---(Ev lock)---> (unlock -> $Key)\"\n apply (rule PName, simp)\n apply (rule ExtCh1)\n apply (rule Prefix)\n done\n\nlemma if_trn_exists:\n \"$Key ---e---> P' \n \\ (e = (Ev lock) \\ P' = unlock -> $Key)\n \\ (e = (Ev finish) \\ P' = STOP)\"\n apply (erule trn.cases, auto)+\n done\n\n\n\n(* test of transition *)\n\ndatatype FW_Events = in1 | in2 | out1 | out2\ndatatype FW_PName = FW\n\nprimrec\n FW_Def :: \"FW_PName => (FW_PName, FW_Events) proc\"\n where\n \"FW_Def FW = (in1 -> out1 -> $FW) [+] (in2 -> out2 -> $FW)\"\n\noverloading FW_PNfun == \n \"PNfun :: FW_PName => (FW_PName, FW_Events) proc\"\n begin definition \"PNfun = FW_Def\" end\n declare FW_PNfun_def [simp]\n\nlemma fw_trn_exists:\n \"$FW ---(Ev in1)---> (out1 -> $FW)\"\n apply (rule PName, simp)\n apply (rule ExtCh1)\n apply (rule Prefix)\n done\n\nlemma fw_if_trn_exists:\n \"$FW ---e---> P' \n ==> (e = Ev in1 & P' = out1 -> $FW)\n | (e = Ev in2 & P' = out2 -> $FW)\"\n apply (erule trn.cases, auto)+\n done\n\nlemma trn_exists_STOP:\n \"(in1 -> out1 -> STOP) [+] (in2 -> out2 -> STOP)\n ---(Ev in1)---> (out1 -> STOP)\"\n apply (rule ExtCh1)\n apply (rule Prefix)\n done\n\nlemma if_trn_exists_STOP:\n \"(in1 -> out1 -> STOP) [+] (in2 -> out2 -> STOP)\n ---e---> P' \n ==> (e = Ev in1 & P' = out1 -> STOP)\n | (e = Ev in2 & P' = out2 -> STOP)\"\n apply (erule trn.cases, auto)+\n done\n\ndatatype Events2 = put | pass | get\n\nlemma ex1_transition:\n \"((get -> pass -> STOP) |[{pass}]| (pass -> put -> STOP)) ~~ {pass}\n ---(Ev get)---> \n ((pass -> STOP) |[{pass}]| (pass -> put -> STOP)) ~~ {pass}\"\n apply (rule Hide1, auto)\n apply (rule Para1, auto)\n apply (rule Prefix)\n done\n\nlemma ex2_transition:\n \"((pass -> STOP) |[{pass}]| (pass -> put -> STOP)) ~~ {pass}\n ---Tau---> \n (STOP |[{pass}]| (put -> STOP)) ~~ {pass}\"\n apply (intro Hide2 Para3 Prefix, auto?)+\n done\n\nlemma ex3_transition:\n \"(STOP |[{pass}]| (put -> STOP)) ~~ {pass}\n ---(Ev put)---> \n (STOP |[{pass}]| STOP) ~~ {pass}\"\n apply (intro Hide1 Para2 Prefix, auto?)+\n done\n\nlemma ex4_transition:\n \"((get -> pass -> STOP) |[{pass}]| (pass -> put -> STOP)) ~~ {pass}\n ---e---> P'\n ==> e = Ev get & \n P' = ((pass -> STOP) |[{pass}]| (pass -> put -> STOP)) ~~ {pass}\"\n apply (erule trn.cases, auto?)+\n done\n\n\n\n\n\nlemma ex1_transition_manual_proof:\n \"((a -> STOP) [+] P) ||| Q ---(Ev a)---> STOP ||| Q\"\n apply (rule Para1)\n apply (rule conjI)\n apply (rule ExtCh1)\n apply (rule Prefix)\n apply (simp)\n done\n\nlemma ex2_transition_auto_proof:\n \"((a -> STOP) [+] P) ||| Q ---(Ev a)---> STOP ||| Q\"\n apply (auto intro: trn.intros)\n done\n\nlemma ex3_decomposition_of_transition:\n \"((a -> STOP) [+] (b -> STOP)) ||| Q ---(Ev c)---> STOP ||| Q\n ==> a = c | b = c\"\n apply (erule trn.cases) (* all cases are checked for ||| *)\n apply (auto)\n apply (erule trn.cases) (* all cases are checked for [+] *)\n apply (auto)\n apply (erule trn.cases) (* all cases are checked for a -> *)\n apply (auto)\n apply (erule trn.cases) (* all cases are checked for b -> *)\n apply (auto)\n done\n\n\n\n(* ----- loop test (process name) ------ *)\n\ndatatype Event = act1 | act2\ndatatype Name = Ptest\n\nprimrec\n Def2 :: \"Name => (Name, Event) proc\"\n where\n \"Def2 Ptest = act1 -> $Ptest [+] act2 -> STOP\"\n\noverloading Test_PNfun == \n \"PNfun :: Name => (Name, Event) proc\"\n begin\n definition \"PNfun == Def2\"\n end\n\ndeclare Test_PNfun_def [simp]\n\nlemma ex4_loop_transition_manual_proof:\n \"$Ptest ---(Ev act1)---> $Ptest\"\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (rule Prefix)\n done\n\nlemma ex4_loop_transition_auto_proof:\n \"$Ptest ---(Ev act1)---> $Ptest\"\n apply (intro trn.intros)\n apply (simp)\n apply (intro trn.intros)\n done\n\n\n(* test of sequential transition *)\n\nlemma ex5_seq_transition_manual_proof:\n \"a ~= b ==> c ~= b\n ==> (a -> b -> c -> STOP) ~~ {b} ---[Ev a, Tau, Ev c]--->> STOP ~~ {b}\"\n apply (rule Step)\n apply (rule_tac x=\"(b -> c -> STOP) ~~ {b}\" in exI)\n apply (rule_tac x=\"Ev a\" in exI)\n apply (rule_tac x=\"[Tau,Ev c]\" in exI)\n apply (rule conjI)\n apply (rule Hide1)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (rule conjI)\n apply (rule Step)\n apply (rule_tac x=\"(c -> STOP) ~~ {b}\" in exI)\n apply (rule_tac x=\"Tau\" in exI)\n apply (rule_tac x=\"[Ev c]\" in exI)\n apply (rule conjI)\n apply (rule Hide2)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (rule conjI)\n apply (rule Base)\n apply (rule Hide1)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (simp)\n apply (simp)\n done\n\n(* test of traces *)\n\nlemma ex6_traces_manual_proof:\n \"[| a ~= b; c ~= b |]\n ==> [a,c] : traces((a -> b -> c -> STOP) ~~ {b})\"\n apply (simp add: traces_def)\n apply (rule_tac x=\"[Ev a, Tau, Ev c]\" in exI)\n apply (rule conjI)\n apply (simp)\n apply (rule_tac x=\"STOP ~~ {b}\" in exI)\n apply (simp add: ex5_seq_transition_manual_proof)\n done\n\n\n\nend\n", "meta": {"author": "nu-manycore", "repo": "public", "sha": "94b6a68b8183e6b756f6ece0fa483b93ad8cc833", "save_path": "github-repos/isabelle/nu-manycore-public", "path": "github-repos/isabelle/nu-manycore-public/public-94b6a68b8183e6b756f6ece0fa483b93ad8cc833/MBP-Prover/Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.28390412341375226}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory IndirectCalls\n\nimports\n \"PrettyProgs\"\n\nbegin\n\ndefinition\n lookup_proc :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ 'proc_id\"\nwhere\n \"lookup_proc symtab naming x\n = (THE pid. naming pid \\ None \\ symtab (the (naming pid)) = x)\"\n\ndefinition\n lookup_proc_safe :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ bool\"\nwhere\n \"lookup_proc_safe symtab naming x\n = (card {pid. naming pid \\ None \\ symtab (the (naming pid)) = x} = 1)\"\n\ndefinition\n procs_consistent :: \"(string \\ 'proc_addr) \\ ('proc_nm \\ string)\n \\ bool\"\nwhere\n \"procs_consistent symtab naming\n = (finite (dom naming)\n \\ (\\x y nm nm'. naming x = Some nm \\ naming y = Some nm'\n \\ symtab nm = symtab nm'\n \\ x = y))\"\n\nlemma procs_consistent_eq:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc symtab naming addr = proc\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_def)\n apply (rule the_equality)\n apply clarsimp\n apply clarsimp\n done\n\nlemma procs_consistent_safe:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc_safe symtab naming addr\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_safe_def)\n apply (rule trans, rule arg_cong[where f=card and y=\"{proc}\"])\n apply auto\n done\n\nlemma hoare_indirect_call_procs_consistent:\n \"\\ naming proc = Some nm;\n \\ \\ P (call initf proc ret c) Q, A \\\n \\ \\ \\ ({s. procs_consistent symtab naming \\ x_fn s = symtab nm} \\ P)\n (dynCall initf (\\s. lookup_proc symtab naming (x_fn s))\n ret c) Q, A\"\n apply (rule hoare_complete, drule hoare_sound)\n apply (clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n apply (erule exec_dynCall_Normal_elim)\n apply (simp add: procs_consistent_eq)\n apply blast\n done\n\nend\n\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/c-parser/IndirectCalls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.28384064679576765}} {"text": "theory ReduceRestr\n imports GenSubEnv WTLemma ResMapDisj ReduceWTS\nbegin\n \n (* setup for an important lemma, which states that s + env restricted to part of an rs_map should remain well-typed. *)\n \ndefinition restr_env where\n \"restr_env s rs_map = (\\ x. if lookup_mem rs_map x = None then None else s x)\" \n \ndefinition np_restr_env where\n \"np_restr_env env rs_map = (\\ x. if lookup_mem rs_map x = None \\ non_prim_entry env x then None else env x)\" \n \nlemma restr_sub_env: \"\\ sub_env s env; non_prim_env env \\ \\ sub_env (restr_env s rs_map) (np_restr_env env rs_map)\" \n apply (simp add: sub_env_def)\n apply (auto)\n apply (simp add: restr_env_def)\n apply (simp add: np_restr_env_def)\n apply (auto)\n apply (case_tac \"lookup_mem rs_map x\")\n apply (auto)\n apply (simp add: non_prim_env_def)\n apply (simp add: non_prim_entry_def)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"env x\")\n apply (auto)\n done\n \nlemma restr_disj_res_map: \"\\ valid_res_map s rs_map; lookup_mem rs_map x = Some (r_s, rs_map');\n lookup_res rs_map' x = empty_use_env \\ \\ disj_res_map rs_map'\"\n apply (induct rs_map arbitrary: s)\n apply (auto)\n apply (case_tac \"x1 = x\")\n apply (auto)\n apply (rule_tac x=\"x\" and r_s=\"r_s\" in disj_add_res_map_rev)\n apply (simp add: add_mem_def)\n apply (simp add: valid_res_map_def)\n apply (simp)\n apply (simp add: valid_res_map_def)\n (* - disjointness for induction *)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and r_s=\"x2\" in disj_add_res_map_rev)\n apply (simp add: add_mem_def)\n apply (simp add: scope_res_map_def)\n apply (simp add: fresh_map_var_def)\n apply (simp add: lookup_res_def)\n (* - containment for induction *)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and r_s=\"x2\" and s=\"s\" in add_sub_res_map_rev)\n apply (simp add: add_mem_def)\n apply (simp add: scope_res_map_def)\n apply (simp add: fresh_map_var_def)\n (* - scope containment for induction *)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and r_s=\"x2\" in add_scope_res_map_rev)\n apply (simp add: add_mem_def)\n apply (auto)\n done\n \nlemma restr_sub_res_map: \"\\ sub_res_map s rs_map; scope_res_map rs_map;\n lookup_mem rs_map x = Some (r_s, rs_map') \\ \\ sub_res_map (restr_env s rs_map') rs_map'\"\n apply (cut_tac rs_map=\"rs_map\" and rs_map'=\"rs_map'\" and x=\"x\" and r_s=\"r_s\" in self_scope_use_env_ih2)\n apply (auto)\n apply (simp add: sub_res_map_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: sub_scope_use_env_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' xa\")\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: restr_env_def)\n done\n \nlemma restr_valid_res_map: \"\\ valid_res_map s rs_map; lookup_mem rs_map x = Some (r_s, rs_map') \\ \\ valid_res_map (restr_env s rs_map') rs_map'\"\n apply (simp add: valid_res_map_def)\n apply (auto)\n apply (rule_tac restr_disj_res_map)\n apply (simp add: valid_res_map_def)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x\" in scope_res_map_fresh_lookup)\n apply (auto)\n apply (simp add: fresh_map_var_def)\n apply (simp add: lookup_res_def)\n apply (rule_tac restr_sub_res_map)\n apply (auto)\n apply (rule_tac self_scope_res_map)\n apply (auto)\n done\n \nlemma dist_restr_contain_env: \"\\ sub_scope_use_env rs_map rs_map' \\ \\ contain_env (restr_env r_s rs_map) (restr_env r_s rs_map')\" \n apply (simp add: sub_scope_use_env_def)\n apply (simp add: contain_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"restr_env r_s rs_map' x\")\n apply (auto)\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' x\")\n apply (auto)\n apply (simp add: restr_env_def)\n done\n \nlemma np_restr_add_contain_env: \"\\ contain_env r_s r_x \\ \\ contain_env (add_env (np_restr_env r_s rs_map) x t) (np_restr_env (add_env r_x x t) rs_map)\" \n apply (simp add: contain_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"np_restr_env (add_env r_x x t) rs_map xa\")\n apply (auto)\n (* if x = xa, we know that rs_map has an entry, it's just a matter of showing that it's the same entry. *)\n apply (case_tac \"x = xa\")\n apply (case_tac \"np_restr_env (add_env r_x x t) rs_map xa \\ Some t\")\n apply (simp add: add_env_def)\n apply (simp add: np_restr_env_def)\n apply (case_tac \"lookup_mem rs_map xa = None \\ non_prim_entry (\\x'. if xa = x' then Some t else r_x x') xa\")\n apply (auto)\n apply (simp add: add_env_def)\n (* otherwise, we know rs_map xa = None or r_x has a prim entry. *)\n apply (simp add: np_restr_env_def)\n apply (case_tac \"lookup_mem rs_map xa = None \\ non_prim_entry (add_env r_x x t) xa\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (simp add: non_prim_entry_def)\n done\n \nlemma np_restr_add_contain_env2: \"\\ contain_env r_s r_x \\ \\ contain_env (add_env (np_restr_env r_s rs_map) x t) (np_restr_env (add_env r_x x t) (add_mem rs_map x r_c))\" \n apply (simp add: contain_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"np_restr_env (add_env r_x x t) (add_mem rs_map x r_c) xa\")\n apply (auto)\n (* if x = xa, then since x wasn't restricted in the original, it wont be restricted here either *)\n apply (case_tac \"x = xa\")\n apply (simp add: add_env_def)\n apply (simp add: np_restr_env_def)\n apply (auto)\n apply (case_tac \"lookup_mem (add_mem rs_map x r_c) x\")\n apply (simp add: add_mem_def)\n apply (auto)\n (* for x \\ xa, since xa wasn't restricted in the original, either it has a lookup in rs_map or it is a prim entry *)\n apply (simp add: np_restr_env_def)\n apply (case_tac \"lookup_mem (add_mem rs_map x r_c) xa = None \\ non_prim_entry (add_env r_x x t) xa\")\n apply (auto)\n (* if you can find it in rs_map, you can find it here too *)\n apply (simp add: add_env_def)\n apply (simp add: add_mem_def)\n (* if it is prim, it will be prim in the new result as well *)\n apply (simp add: add_env_def)\n apply (simp add: non_prim_entry_def)\n done \n \nlemma restr_env_eq: \"\\ sub_res_map s rs_map; sub_env s env \\ \\ restr_env env rs_map = env\" \n apply (case_tac \"\\ x. restr_env env rs_map x = env x\") \n apply (auto)\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map x = None\")\n apply (auto)\n apply (simp add: sub_env_def)\n apply (simp add: sub_res_map_def)\n done\n \n (* attempt to show restricting the env to rs_map is acceptable. *)(*\nlemma well_typed_restr_ih: \"\\ sub_res_map s rs_map; sub_env s env (*scope_res_map rs_map; scope_use_env rs_map r_s1;*)\n well_typed env r_s1 v tau r_s2 rx; contain_env env' (np_restr_env env rs_map) \\ \\ well_typed env' r_s1 v tau r_s2 rx\" \n apply (induct v arbitrary: env env' tau r_s1 r_s2 rx rs_map)\n apply (auto)\n (* var case p1. we must show the de-referenced name will still exist. *)\n apply (case_tac \"\\ non_prim_entry env (deref_name x1a x2a)\")\n apply (simp add: np_restr_env_def)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"deref_name x1a x2a\" in allE)\n apply (auto)\n apply (case_tac \"r_s1 x1a = NoPerm\")\n apply (cut_tac r_x=\"ereq_use_env x1a tau\" and r_s=\"r_s1\" and x=\"x1a\" in leq_use_none)\n apply (auto)\n apply (cut_tac x=\"x1a\" and tau=\"tau\" in ereq_use_none)\n apply (simp add: non_prim_entry_def)\n apply (auto)\n apply (simp add: scope_use_env_def)\n apply (erule_tac x=\"x1a\" in allE)\n apply (auto)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"x1a\" in allE)\n apply (case_tac \"env' x1a\")\n apply (auto)\n apply (simp add: np_restr_env_def)\n apply (simp add: np_restr_env_def)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and rs_map=\"rs_map\" in trans_scope_use_env2)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and rs_map=\"rs_map\" in trans_scope_use_env2)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n (* - split over x1a in rs_map *)\n apply (case_tac \"fresh_map_var rs_map x1a\")\n (* - containment for induction *)\n apply (cut_tac env_c=\"np_restr_env (add_env env x1a t1) (add_mem rs_map x1a empty_use_env)\" and\n env_b=\"add_env (np_restr_env env rs_map) x1a t1\" and env_a=\"add_env env' x1a t1\" in trans_contain_env)\n apply (rule_tac dist_add_contain_env)\n apply (simp)\n apply (rule_tac np_restr_add_contain_env2)\n apply (rule_tac id_contain_env)\n (* - scoping for induction *)\n apply (cut_tac rs_map=\"rs_map\" and r_s=\"rxa\" and x=\"x1a\" and r=\"r\" and r_c=\"empty_use_env\" in dist_add_scope_use_env)\n apply (rule_tac r_s=\"r_s1\" in trans_scope_use_env2)\n apply (simp_all)\n (* - scoping for induction p2 *)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1a\" and r_s=\"empty_use_env\" in add_scope_res_map)\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac empty_scope_use_env)\n (* if x1a is in rs_map, we have a simpler containment induction *)\n apply (cut_tac env_c=\"np_restr_env (add_env env x1a t1) rs_map\" and\n env_b=\"add_env (np_restr_env env rs_map) x1a t1\" and env_a=\"add_env env' x1a t1\" in trans_contain_env)\n apply (rule_tac dist_add_contain_env)\n apply (simp)\n apply (rule_tac np_restr_add_contain_env)\n apply (rule_tac id_contain_env)\n (* - scoping for induction *)\n apply (cut_tac rs_map=\"rs_map\" and r_s=\"rxa\" and x=\"x1a\" and r=\"r\" in add_scope_use_env)\n apply (rule_tac r_s=\"r_s1\" in trans_scope_use_env2)\n apply (simp_all)\n apply (simp add: fresh_map_var_def)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and rs_map=\"rs_map\" in trans_scope_use_env2)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done*)\n \nlemma well_typed_restr: \"\\ (*scope_res_map rs_map; scope_use_env rs_map r_s1; non_prim_env env; *)\n sub_res_map s rs_map; sub_env s env; well_typed env r_s1 v tau r_s2 rx \\ \\\n well_typed (restr_env env rs_map) r_s1 v tau r_s2 rx\" \n apply (simp add: restr_env_eq)\n (*apply (rule_tac well_typed_restr_ih)\n apply (auto)\n apply (simp add: contain_env_def)\n apply (auto)\n apply (case_tac \"np_restr_env env rs_map x\")\n apply (auto)\n apply (simp add: np_restr_env_def)\n apply (simp add: restr_env_def)\n apply (auto)\n apply (case_tac \"lookup_mem rs_map x = None \\ non_prim_entry env x\")\n apply (auto)\n apply (simp add: non_prim_env_def)\n apply (simp add: non_prim_entry_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto) *)\n done\n \nlemma well_typed_list_restr: \"\\ (*scope_res_map rs_map; non_prim_env env;*) sub_res_map s rs_map;\n sub_env s env; well_typed_list env rs_list el n tau \\ \\\n well_typed_list (restr_env env rs_map) rs_list el n tau\"\n apply (induct el arbitrary: n)\n apply (auto)\n apply (rule_tac well_typed_restr)\n apply (auto)(*\n apply (rule_tac self_scope_use_env)\n apply (simp)*)\n done\n \ndefinition rs_free_vars where\n \"rs_free_vars rs_map e = (\\ x. lookup_mem rs_map x = None \\ x \\ free_vars e)\"\n\nlemma rem_add_restr_env: \"rem_env (restr_env s rs_map) x = restr_env (rem_env s x) (add_mem rs_map x r_c)\" \n apply (case_tac \"\\ y. rem_env (restr_env s rs_map) x y = restr_env (rem_env s x) (add_mem rs_map x r_c) y\")\n apply (auto)\n apply (simp add: rem_env_def)\n apply (simp add: add_mem_def)\n apply (simp add: restr_env_def)\n apply (case_tac \"x = y\")\n apply (auto)\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map y\")\n apply (auto)\n done\n \n (* a lemma that states that every free variable of e appears in rs_map *)\nlemma well_typed_rs_free_vars: \"\\ scope_use_env rs_map r_s1; well_typed env r_s1 e tau r_s2 rx; non_prim_env env \\ \\ rs_free_vars rs_map e\"\n apply (simp add: rs_free_vars_def)\n apply (auto)\n apply (case_tac \"r_s1 x = NoPerm\")\n apply (cut_tac ?r_s1.0=\"r_s1\" and x=\"x\" and e=\"e\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" in well_typed_fv_env_use)\n apply (auto)\n apply (simp add: non_prim_entry_def)\n apply (simp add: scope_use_env_def)\n done\n\n\n (*\nlemma aff_value_restr: \"\\ aff_value s e; rs_free_vars (rs_map :: perm_use_env p_stack) e \\ \\ aff_value (restr_env s rs_map) e\" \n apply (induct e arbitrary: s rs_map)\n apply (auto)\n (* var case. *)\n apply (simp add: restr_env_def)\n apply (simp add: rs_free_vars_def)\n apply (erule_tac x=\"x1a\" in allE)\n apply (auto)\n (* if cases 1 - 3. *)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n (* lam case. *)\n apply (case_tac \"\\ rs_free_vars (add_mem rs_map x1a empty_use_env) e\")\n apply (simp add: rs_free_vars_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: add_mem_def)\n apply (case_tac \"x = x1a\")\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and x=\"x1a\" and r_c=\"empty_use_env\" in rem_add_restr_env)\n apply (auto)\n (* app cases 1 + 2. *)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n done\n \nlemma neg_aff_value_restr: \"\\ \\ aff_value s e; rs_free_vars (rs_map :: perm_use_env p_stack) e \\ \\ \\ aff_value (restr_env s rs_map) e\" \n apply (induct e arbitrary: s rs_map)\n apply (auto)\n (* var case. *)\n apply (simp add: restr_env_def)\n apply (simp add: rs_free_vars_def)\n apply (erule_tac x=\"x1a\" in allE)\n apply (auto)\n (* if cases 1 - 3. *)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n (* lam case. *)\n apply (case_tac \"\\ rs_free_vars (add_mem rs_map x1a empty_use_env) e\")\n apply (simp add: rs_free_vars_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: add_mem_def)\n apply (case_tac \"x = x1a\")\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and x=\"x1a\" and r_c=\"empty_use_env\" in rem_add_restr_env)\n apply (auto)\n (* app cases 1 + 2. *)\n apply (simp add: rs_free_vars_def)\n apply (simp add: rs_free_vars_def)\n done\n \nlemma aff_pair_restr: \"\\ aff_pair s v1 v2 a; rs_free_vars (rs_map :: perm_use_env p_stack) v1; rs_free_vars rs_map v2 \\ \\ aff_pair (restr_env s rs_map) v1 v2 a\"\n apply (simp add: aff_pair_def)\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and e=\"v1\" in neg_aff_value_restr)\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and e=\"v2\" in neg_aff_value_restr)\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and e=\"v1\" in aff_value_restr)\n apply (auto)\n apply (cut_tac s=\"s\" and rs_map=\"rs_map\" and e=\"v2\" in aff_value_restr)\n apply (auto)\n done\n *)\nlemma well_typed_mv_restr: \"\\ (*scope_res_map rs_map; non_prim_env env;*)\n sub_res_map s rs_map; sub_env s env; well_typed_mem_value s env (lookup_res rs_map x) tau v \\ \\\n well_typed_mem_value (restr_env s rs_map) (restr_env env rs_map) (lookup_res rs_map x) tau v\" \n apply (case_tac v)\n apply (auto)\n apply (rule_tac x=\"rs_list\" in exI)\n apply (auto)\n apply (rule_tac well_typed_list_restr)\n apply (auto)(*\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n(*\n apply (rule_tac aff_pair_restr)\n apply (auto)\n apply (rule_tac well_typed_rs_free_vars)\n apply (auto)\n apply (rule_tac well_typed_rs_free_vars)\n apply (auto)*)\n apply (rule_tac well_typed_restr)\n apply (auto)\n apply (rule_tac self_scope_use_env)\n apply (simp)\n apply (rule_tac well_typed_restr)\n apply (auto)\n apply (rule_tac self_scope_use_env)\n apply (simp)*)\n done\n\ndefinition spec_scope_use_env where\n \"spec_scope_use_env rs_map rs_map' = (\\ y. case lookup_mem rs_map' y of None \\ True | Some (r_s, rs_map') \\ lookup_mem rs_map y = Some (r_s, rs_map'))\"\n\nlemma add_spec_scope_use_env: \"\\ spec_scope_use_env rs_map rs_map'; fresh_map_var rs_map x \\ \\ spec_scope_use_env (add_mem rs_map x r_s) rs_map'\"\n apply (simp add: spec_scope_use_env_def)\n apply (auto)\n apply (case_tac \"lookup_mem rs_map' y\")\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (auto)\n apply (simp add: fresh_map_var_def)\n apply (simp add: add_mem_def)\n apply (auto)\n done\n \nlemma self_spec_scope_use_env: \"\\ scope_res_map rs_map; lookup_mem rs_map x = Some (r_s, rs_map') \\ \\ spec_scope_use_env rs_map rs_map'\"\n apply (induct rs_map)\n apply (auto)\n (* if x1 = x, rs_map' is only one level down from rs_map. any y that can be sucessfully looked-up from rs_map' is distinct from x1 by freshness,\n meaning we look it up from rs_map' *)\n apply (case_tac \"x1 = x\")\n apply (auto)\n apply (simp add: spec_scope_use_env_def)\n apply (auto)\n apply (simp add: scope_res_map_def)\n apply (simp add: fresh_map_var_def)\n apply (case_tac \"lookup_mem rs_map' y\")\n apply (auto)\n (* otherwise we have to induct *)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and r_s=\"x2\" in add_scope_res_map_rev)\n apply (simp add: add_mem_def)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and rs_map'=\"rs_map'\" in add_spec_scope_use_env)\n apply (simp)\n apply (simp add: scope_res_map_def)\n apply (simp add: add_mem_def)\n done \n (*\nlemma well_typed_restr_state: \"\\ well_typed_state s env rs_map; lookup_mem rs_map x = Some (r_s, rs_map') \\ \\\n well_typed_state (restr_env s rs_map') (restr_env env rs_map') rs_map'\"\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (rule_tac restr_sub_env)\n apply (simp)\n apply (rule_tac restr_valid_res_map)\n apply (auto)\n apply (case_tac \"restr_env s rs_map' xa\")\n apply (auto)\n apply (case_tac \"s xa = None\")\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' xa\")\n apply (auto)\n apply (case_tac \"restr_env env rs_map' xa\")\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"env xa \\ None\")\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' xa\")\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"env xa\")\n apply (auto)\n apply (case_tac \"aa \\ ab\")\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' xa\")\n apply (auto)\n apply (rule_tac well_typed_mv_restr)\n apply (simp add: valid_res_map_def)\n apply (auto)\n apply (rule_tac rs_map=\"rs_map\" and x=\"x\" in self_scope_res_map)\n apply (auto)\n apply (simp add: restr_env_def)\n apply (case_tac \"lookup_mem rs_map' xa\")\n apply (auto)\n apply (simp add: lookup_res_def)\n apply (cut_tac rs_map=\"rs_map\" and rs_map'=\"rs_map'\" in self_spec_scope_use_env)\n apply (auto)\n apply (simp add: valid_res_map_def)\n apply (simp add: spec_scope_use_env_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n done *)\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ReduceRestr.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.28384063971216084}} {"text": "(* Title: BDD\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* \nNormalizeTotalProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Proof of Procedure Normalize\\\ntheory NormalizeTotalProof imports LevellistProof ShareReduceRepListProof \n RepointProof begin\n\nhide_const (open) DistinctTreeProver.set_of tree.Node tree.Tip\n\nlemma (in Normalize_impl) Normalize_modifies:\n shows\n \"\\\\. \\\\{\\} \\p :== PROC Normalize (\\p) \n {t. t may_only_modify_globals \\ in [rep,mark,low,high,next]}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in Normalize_impl) Normalize_spec: \n shows \"\\\\ pret prebdt. \\\\\\<^sub>t\n \\\\. Dag \\p \\low \\high pret \\ ordered pret \\var \\ \n \\p \\ Null \\ (\\n. n \\ set_of pret \\ \\mark n = \\mark \\p) \\ \n bdt pret \\var = Some prebdt\\ \n \\p :== PROC Normalize(\\p)\n \\(\\pt. pt \\ set_of pret \n \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt \\ \n \\<^bsup>\\\\<^esup>mark pt = \\mark pt \\ \\<^bsup>\\\\<^esup>next pt = \\next pt) \\ \n (\\postt. Dag \\p \\low \\high postt \\ reduced postt \\ \n shared postt \\<^bsup>\\\\<^esup>var \\ ordered postt \\<^bsup>\\\\<^esup>var \\\n set_of postt \\ set_of pret \\ \n (\\postbdt. bdt postt \\<^bsup>\\\\<^esup>var = Some postbdt \\ prebdt \\ postbdt)) \\ \n (\\ no. no \\ set_of pret \\ \\mark no = (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p)) \\\"\n apply (hoare_rule HoareTotal.ProcNoRec1)\n apply (hoare_rule anno=\"\n \\levellist :==replicate (\\p\\\\var + 1) Null;;\n \\levellist :== CALL Levellist (\\p, (\\ \\p\\\\mark) , \\levellist);;\n (ANNO (\\,ll). \\\\. Levellist \\levellist \\next ll \\\n Dag \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high pret \\ ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (bdt pret \\<^bsup>\\\\<^esup>var = Some prebdt) \\ \n wf_ll pret ll \\<^bsup>\\\\<^esup>var \\ \n length \\levellist = ((\\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var) + 1) \\ \n wf_marking pret \\<^bsup>\\\\<^esup>mark \\mark (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p) \\ \n (\\pt. pt \\ set_of pret \\ \\<^bsup>\\\\<^esup>next pt = \\next pt) \\\n \\low = \\<^bsup>\\\\<^esup>low \\ \\high = \\<^bsup>\\\\<^esup>high \\ \\p = \\<^bsup>\\\\<^esup>p \\ \\rep = \\<^bsup>\\\\<^esup>rep \\ \n \\var = \\<^bsup>\\\\<^esup>var\\ \n \\n :==0;;\n WHILE (\\n < length \\levellist) \n INV \\Levellist \\levellist \\next ll \\\n Dag \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high pret \\ ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (bdt pret \\<^bsup>\\\\<^esup>var = Some prebdt) \\ wf_ll pret ll \\<^bsup>\\\\<^esup>var \\ \n length \\<^bsup>\\\\<^esup>levellist = ((\\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var) + 1) \\ \n wf_marking pret \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>mark (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p) \\\n \\<^bsup>\\\\<^esup>low = \\<^bsup>\\\\<^esup>low \\ \\<^bsup>\\\\<^esup>high = \\<^bsup>\\\\<^esup>high \\ \\<^bsup>\\\\<^esup>p = \\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>rep = \\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>var = \\<^bsup>\\\\<^esup>var \\\n \\n \\ length \\<^bsup>\\\\<^esup>levellist \\\n (\\pt i. (pt \\ set_of pret \\ (\\n <= i \\ pt \\ set (ll ! i) \\\n i \\\\<^esup>levellist ) \n \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt)) \\ \n \\rep ` Nodes \\n ll \\ Nodes \\n ll \\ \n (\\no \\ Nodes \\n ll.\n no\\\\rep\\\\<^bsup>\\\\<^esup>var <= no\\\\<^bsup>\\\\<^esup>var \\ \n (\\not nort. Dag (\\rep no) (\\rep \\ \\<^bsup>\\\\<^esup>low ) (\\rep \\ \\<^bsup>\\\\<^esup>high ) nort \\\n Dag no \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high not \\ reduced nort \\ \n ordered nort \\<^bsup>\\\\<^esup>var \\ set_of nort \\ \\rep ` Nodes \\n ll \\ \n (\\ no \\ set_of nort. \\rep no = no) \\ \n (\\nobdt norbdt. bdt not \\<^bsup>\\\\<^esup>var = Some nobdt \\ \n bdt nort \\<^bsup>\\\\<^esup>var = Some norbdt \\ nobdt \\ norbdt))) \\\n (\\t1 t2. \n t1\\Dags (\\rep `(Nodes \\n ll))(\\rep \\ \\<^bsup>\\\\<^esup>low )(\\rep \\ \\<^bsup>\\\\<^esup>high)\\\n t2\\Dags (\\rep `(Nodes \\n ll))(\\rep \\ \\<^bsup>\\\\<^esup>low )(\\rep \\ \\<^bsup>\\\\<^esup>high)\n \\ \n isomorphic_dags_eq t1 t2 \\<^bsup>\\\\<^esup>var) \\\n \\levellist = \\<^bsup>\\\\<^esup>levellist \\ \\next = \\<^bsup>\\\\<^esup>next \\ \\mark = \\<^bsup>\\\\<^esup>mark \\ \\low = \\<^bsup>\\\\<^esup>low \\ \n \\high = \\<^bsup>\\\\<^esup>high \\ \\p = \\<^bsup>\\\\<^esup>p \\ \\var = \\<^bsup>\\\\<^esup>var \\\n VAR MEASURE (length \\levellist - \\n)\n DO\n CALL ShareReduceRepList(\\levellist ! \\n);;\n \\n :==\\n + 1\n OD\n \\(\\postnormt. Dag (\\rep \\<^bsup>\\\\<^esup>p) (\\rep \\ \\<^bsup>\\\\<^esup>low ) (\\rep \\ \\<^bsup>\\\\<^esup>high ) postnormt \\ \n reduced postnormt \\ shared postnormt \\<^bsup>\\\\<^esup>var \\ \n ordered postnormt \\<^bsup>\\\\<^esup>var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. bdt postnormt \\<^bsup>\\\\<^esup>var = Some postnormbdt \\ prebdt \\ postnormbdt) \\\n (\\ no \\ set_of postnormt. (\\rep no = no))) \\ \n ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (\\ pt. pt \\ set_of pret \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt) \\ \n \\levellist = \\<^bsup>\\\\<^esup>levellist \\ \\next = \\<^bsup>\\\\<^esup>next \\ \\mark = \\<^bsup>\\\\<^esup>mark \\ \\low = \\<^bsup>\\\\<^esup>low \\ \\high = \\<^bsup>\\\\<^esup>high \\\n \\p = \\<^bsup>\\\\<^esup>p \\ (\\ no. no \\ set_of pret \\ \\mark no = (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p)) \\)\n ;;\n \\p :== CALL Repoint (\\p)\"\n in HoareTotal.annotateI)\n apply (vcg spec=spec_total)\n prefer 2\n (*from precondition of inner spec to invariant *)\n apply (simp add: Nodes_def null_comp_def)\n (*from inner spec to postcondition *) \n apply (rule_tac x=pret in exI)\n apply clarify\n apply (rule conjI)\n apply clarsimp\n apply (case_tac i)\n apply simp\n apply simp\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply clarify\n apply (simp (no_asm_use) only: simp_thms) \n apply (rule_tac x=\"ll\" in exI)\n apply (rule conjI)\n apply assumption\n apply clarify\n apply (simp only: simp_thms triv_forall_equality True_implies_equals) \n apply (rule_tac x=postnormt in exI)\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply clarify\n apply (simp (no_asm_simp))\n prefer 2\n (*while-while-Fall: while nb und Schleifenbdg gelten \\ while (nb+1)*)\n apply clarify\n apply (simp only: simp_thms triv_forall_equality True_implies_equals)\n apply (rule_tac x=\"ll!n\" in exI)\n apply (rule conjI)\n apply (simp add: Levellist_def)\n prefer 3\n (*while-end-Fall: INV nb gilt und Schleifenbdg falsch \\ Nachbdg while*)\n apply (clarify)\n apply (simp (no_asm_use) only: simp_thms triv_forall_equality True_implies_equals) \nproof -\n \\ \\End of while (invariant + false condition) to end of inner SPEC\\\n fix var p rep mark vara lowa higha pa levellista repa marka nexta varb ll \n nb pret prebdt and low :: \"ref \\ ref\" and \n high :: \"ref \\ ref\" and repb :: \"ref \\ ref\"\n assume ll: \"Levellist levellista nexta ll\"\n assume wf_lla: \"wf_ll pret ll var\"\n assume length_lla: \"length levellista = var p + 1\"\n assume ord_pret: \"ordered pret var\"\n assume pnN: \" p \\ Null\"\n assume rep_repb_nc: \n \"\\pt i. pt \\ set_of pret \\ nb \\ i \\ pt \\ set (ll ! i) \\ \n i < length levellista \n \\ rep pt = repb pt\"\n\n assume wf_marking_prop: \" wf_marking pret mark marka (\\ mark p)\"\n assume pret_dag: \"Dag p low high pret\"\n assume prebdt: \"bdt pret var = Some prebdt\"\n assume not_nbslla: \"\\ nb < length levellista\"\n assume nb_le_lla: \" nb \\ length levellista\"\n \n assume normalize_prop: \"\\no\\Nodes nb ll.\n var (repb no) \\ var no \\\n (\\not nort. Dag (repb no) (repb \\ low) (repb \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\ \n set_of nort \\ repb ` Nodes nb ll \\ \n (\\no\\set_of nort. repb no = no) \\ \n (\\nobdt norbdt. bdt not var = Some nobdt \\ \n bdt nort var = Some norbdt \\ nobdt \\ norbdt))\"\n assume repbNodes_in_Nodes: \" repb ` Nodes nb ll \\ Nodes nb ll\"\n assume shared_mult_dags: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \\ \n t2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n show \"(\\postnormt. Dag (repb p) (repb \\ low) (repb \\ high) postnormt \\\n reduced postnormt \\ shared postnormt var \\\n ordered postnormt var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. \n bdt postnormt var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\ no \\ set_of postnormt. repb no = no)) \\\n ordered pret var \\ p \\ Null \\ \n (\\pt. pt \\ set_of pret \\ rep pt = repb pt) \\ \n (\\no. no \\ set_of pret \\ marka no = (\\ mark p))\"\n\n proof -\n from ll have length_ll_eq: \"length levellista = length ll\"\n by (simp add: Levellist_length)\n from rep_repb_nc have rep_nc_post: \"\\pt. pt \\ set_of pret \\ rep pt = repb pt\"\n by auto\n from pnN pret_dag obtain lt rt where pret_def: \"pret = Node lt p rt\"\n by auto\n from wf_marking_prop pret_def \n have marking_inverted: \"(\\no. no \\ set_of pret \\ marka no = (\\ mark p))\"\n by (simp add: wf_marking_def)\n from not_nbslla nb_le_lla have nb_length_lla: \"nb = length levellista\"\n by simp\n with length_lla have varp_s_nb: \"var p < nb\"\n by simp\n from pret_def have p_in_pret: \"p \\ set_of pret\"\n by simp\n with wf_lla have \"p \\ set (ll ! (var p))\" \n by (simp add: wf_ll_def)\n with varp_s_nb have p_in_Nodes: \"p \\ Nodes nb ll\"\n by (auto simp add: Nodes_def)\n with normalize_prop obtain not nort where\n varrepno_varno: \" var (repb p) \\ var p\" and\n nort_dag: \"Dag (repb p) (repb \\ low) (repb \\ high) nort\" and\n not_dag: \" Dag p low high not\" and\n red_nort: \"reduced nort\" and\n ord_nort: \"ordered nort var\" and\n nort_in_repNodes: \" set_of nort \\ repb ` Nodes nb ll\" and\n nort_repb: \"(\\no\\set_of nort. repb no = no)\" and\n bdt_prop: \"\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = Some norbdt \\\n nobdt \\ norbdt\"\n by auto\n \n from wf_lla nb_length_lla have Nodes_in_pret: \"Nodes nb ll \\ set_of pret\"\n apply -\n apply (rule Nodes_in_pret)\n apply (auto simp add: length_ll_eq)\n done\n from pret_dag wf_lla nb_length_lla have \"Null \\ Nodes nb ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n with p_in_Nodes repbNodes_in_Nodes have rp_nNull: \"repb p \\ Null\"\n by auto\n with nort_dag have nort_nTip: \"nort\\ Tip\"\n by auto\n have \"\\postnormt. Dag (repb p) (repb \\ low) (repb \\ high) postnormt \\\n reduced postnormt \\ shared postnormt var \\\n ordered postnormt var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. \n bdt postnormt var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\no \\ set_of postnormt. repb no = no)\"\n proof (rule_tac x=nort in exI)\n from nort_in_repNodes repbNodes_in_Nodes Nodes_in_pret \n have nort_in_pret: \"set_of nort \\ set_of pret\"\n by blast\n from not_dag pret_dag have not_pret: \"not = pret\"\n by (simp add: Dag_unique)\n with bdt_prop prebdt have pret_bdt_prop: \n \"\\postnormbdt.\n bdt nort var = Some postnormbdt \\ prebdt \\ postnormbdt\"\n by auto\n from shared_mult_dags have \"shared nort var\"\n proof (auto simp add: shared_def isomorphic_dags_eq_def)\n fix st1 st2 bdt1\n assume shared_imp: \n \"\\t1 t2. t1\\Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \\ \n t2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\n \\\n (\\bdt1. bdt t1 var = Some bdt1 \\ bdt t2 var = Some bdt1) \\ t1 = t2\"\n assume st1_nort: \" st1 \\ nort\"\n assume st2_nort: \"st2 \\ nort\"\n assume bdt_st1: \"bdt st1 var = Some bdt1\"\n assume bdt_st2: \" bdt st2 var = Some bdt1\"\n from nort_in_repNodes nort_dag nort_nTip \n have nort_in_DagsrNodes: \n \"nort \\ Dags (repb `(Nodes nb ll)) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done\n show \"st1 = st2\"\n proof (cases st1)\n case Tip\n note st1_Tip=this\n with bdt_st1 bdt_st2 show ?thesis\n by auto\n next\n case (Node lst1 st1p rst1)\n note st1_Node=this\n then have st1_nTip: \"st1 \\ Tip\"\n by simp\n show ?thesis\n proof (cases st2)\n case Tip\n with bdt_st1 bdt_st2 show ?thesis\n by auto\n next\n case (Node lst2 st2p rst2)\n note st2_Node=this\n then have st2_nTip: \"st2 \\ Tip\"\n by simp \n from nort_in_DagsrNodes st1_nort ord_nort wf_lla st1_nTip \n have st1_in_Dags: \n \"st1 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule Dags_subdags)\n apply auto\n done\n from nort_in_DagsrNodes st2_nort ord_nort wf_lla st2_nTip \n have st2_in_Dags: \n \"st2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule Dags_subdags) \n apply auto\n done\n from st1_in_Dags st2_in_Dags bdt_st1 bdt_st2 shared_imp show \"st1=st2\"\n by simp\n qed\n qed\n qed\n with nort_dag red_nort ord_nort nort_in_pret pret_bdt_prop nort_repb \n show \"Dag (repb p) (repb \\ low) (repb \\ high) nort \\\n reduced nort \\ shared nort var \\ ordered nort var \\ \n set_of nort \\ set_of pret \\ \n (\\postnormbdt. \n bdt nort var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\no \\ set_of nort. repb no = no)\"\n apply -\n apply (intro conjI)\n apply assumption+\n done\n qed\n with wf_lla length_lla ord_pret pnN rep_nc_post marking_inverted\n show ?thesis\n by simp\n qed\nnext\n \\ \\From postcondition inner SPEC to final postcondition\\\n fix var low high p rep levellist marka \"next\" \n nexta lowb highb pb levellista ll repa pret prebdt \n and mark::\"ref\\bool\" and postnormt postnormbdt\n assume ll: \"Levellist levellista nexta ll\"\n assume repoint_spec: \n \"Dag pb lowb highb postnormt\"\n \"\\pt. pt \\ set_of postnormt \\ low pt = lowb pt \\ high pt = highb pt\"\n assume pret_dag: \"Dag p low high pret\"\n assume ord_pret: \"ordered pret var\"\n assume pnN: \" p \\ Null\"\n assume onemark_pret: \n \"\\n. n \\ set_of pret \\ mark n = mark p\" (is \"\\n. ?in_pret n \\ ?eq_mark_p n\")\n assume pret_bdt: \" bdt pret var = Some prebdt\"\n \n assume wf_ll: \"wf_ll pret ll var\" and\n length_ll:\"length levellist =var p + 1\" and\n wf_marking_ll: \"wf_marking pret mark marka (\\ mark p)\"\n assume \n postnormt_dag: \"Dag (repa p) (repa \\ low) (repa \\ high) postnormt\" and\n reduced_postnormt: \"reduced postnormt\" and\n shared_postnormt: \"shared postnormt var\" and\n ordered_postnormt: \"ordered postnormt var\" and\n subset_pret: \"set_of postnormt \\ set_of pret\"and\n sim_bdt: \"bdt postnormt var = Some postnormbdt\" \"prebdt \\ postnormbdt\" and\n postdag_repa: \"\\no \\ set_of postnormt. repa no = no\" and\n rep_eq: \"\\pt. pt \\ set_of pret \\ rep pt = repa pt\" and\n pret_marked: \"\\no. no \\ set_of pret \\ marka no = (\\ mark p)\"\n assume unmodif_next: \"\\p. p \\ set_of pret \\ next p = nexta p\"\n show \"(\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt \\ \n mark pt = marka pt ) \"\n\n proof -\n from ll have length_ll_eq: \"length levellista = length ll\"\n by (simp add: Levellist_length)\n from repoint_spec pnN subset_pret\n have repoint_nc: \"(\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt) \\ Dag pb lowb highb postnormt\"\n by auto\n then have lowhigh_b_eq: \"\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt\"\n by fastforce\n from wf_marking_ll pret_dag pnN \n have mark_b_eq: \"\\pt. pt \\ set_of pret \\ mark pt = marka pt\"\n apply -\n apply (simp add: wf_marking_def)\n apply (split dag.splits)\n apply simp\n apply (rule allI)\n apply (rule impI)\n apply (elim conjE)\n apply (erule_tac x=pt in allE)\n apply fastforce\n done\n with lowhigh_b_eq rep_eq unmodif_next\n have pret_nc: \"\\pt. pt \\ set_of pret \n \\ rep pt = repa pt \\ low pt = lowb pt \\ high pt = highb pt \\ \n mark pt = marka pt \\ next pt = nexta pt\"\n by blast\n(* from repoint_nc have rept_dag: \"Dag pb lowb highb postnormt\"\n by simp\n with reduced_postnormt shared_postnormt ordered_postnormt subset_pret sim_bdt \n pret_bdt \n have post_same_prop: \n \"\\postt. Dag pb lowb highb postt \\ reduced postt \\\n shared postt var \\ ordered postt var \\ set_of postt \\ set_of pret \\\n (\\postbdt. bdt postt var = Some postbdt \\ prebdt \\ postbdt)\" \n apply -\n apply (rule_tac x=postnormt in exI)\n apply fastforce\n done*)\n from pret_nc \n show ?thesis\n by fastforce\n qed\nnext\n \\ \\invariant to invariant\\\n fix var low high p rep mark pret prebdt levellist ll \"next\" marka n repc \n and repb :: \"ref \\ ref\" \n assume ll: \"Levellist levellist next ll\"\n assume pret_dag: \"Dag p low high pret\"\n assume ord_pret: \" ordered pret var\"\n assume pnN: \"p \\ Null\"\n assume prebdt_pret: \"bdt pret var = Some prebdt\"\n assume wf_ll: \"wf_ll pret ll var\"\n assume lll: \"length levellist = var p + 1\"\n assume n_Suc_var_p: \"n < var p + 1\"\n assume wf_marking_m_ma: \"wf_marking pret mark marka (\\ mark p)\"\n\n(* assume rep_nc: \" \\pt. pt \\ set_of pret \\ \n (\\i. n \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repb pt\" *)\n assume rep_nc: \"\\pt i.\n pt \\ set_of pret \\ n \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1 \\\n rep pt = repb pt\"\n assume repbNodes_in_Nodes: \"repb ` Nodes n ll \\ Nodes n ll\"\n assume\n normalize_prop: \"\\no\\Nodes n ll.\n var (repb no) \\ var no \\\n (\\not nort. Dag (repb no) (repb \\ low) (repb \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repb ` Nodes n ll \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ \n nobdt \\ norbdt)))\" \n assume \n isomorphic_dags_eq: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n show \"(\\no\\set (ll ! n).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\\n high no \\ set (ll ! n) \\\n isLeaf_pt no low high = (var no \\ 1) \\\n (low no \\ Null \\ repb (low no) \\ Null) \\ (repb \\ low) no \\ set (ll ! n)) \\\n (\\no1\\set (ll ! n). \\no2\\set (ll ! n). var no1 = var no2) \\\n (\\repa. (\\no. no \\ set (ll ! n) \\ repb no = repa no) \\\n (\\no\\set (ll ! n).\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no \\ set (ll ! n) \\\n repa (repa no) = repa no \\\n (\\no1\\set (ll ! n).\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))) \\\n var p + 1 - (n + 1) < var p + 1 - n \\\n n + 1 \\ var p + 1 \\\n (\\pt i. pt \\ set_of pret \\ (n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \\\n rep pt = repa pt) \\\n repa ` Nodes (n + 1) ll \\ Nodes (n + 1) ll \\\n (\\no\\Nodes (n + 1) ll.\n var (repa no) \\ var no \\\n (\\not nort.\n Dag (repa no) (repa \\ low) (repa \\ high) nort \\\n Dag no low high not \\\n reduced nort \\\n ordered nort var \\\n set_of nort \\ repa ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repa no = no) \\\n (\\nobdt.\n bdt not var = Some nobdt \\\n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))) \\\n (\\t1 t2.\n t1 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n t2 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n isomorphic_dags_eq t1 t2 var))\"\n proof -\n from ll have length_ll_eq: \"length levellist = length ll\"\n by (simp add: Levellist_length)\n from n_Suc_var_p lll have nsll: \"n < length levellist\" by simp\n hence nseqll: \"n \\ length levellist\" by simp\n have srrl_precond: \"(\\no \\ set (ll ! n).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\\n high no \\ set (ll ! n) \\ \n isLeaf_pt no low high = (var no \\ 1) \\ \n (low no \\ Null \\ repb (low no) \\ Null) \\ \n (repb \\ low) no \\ set (ll ! n))\"\n proof (intro ballI)\n fix no\n assume no_in_lln: \"no \\ set (ll ! n)\"\n with wf_ll nsll have no_in_pret_var: \"no \\ set_of pret \\ var no = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with pret_dag have no_nNull: \"no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n from pret_dag prebdt_pret no_in_pret_var \n have balanced_no: \"(low no = Null) = (high no = Null)\"\n apply -\n apply (erule conjE)\n apply (rule_tac p=p and low=low in balanced_bdt)\n apply auto\n done\n have low_no_notin_lln: \"low no \\ set (ll ! n)\"\n proof (cases \"low no = Null\")\n case True\n note lno_Null=this\n with balanced_no have hno_Null: \"high no = Null\"\n by simp\n show ?thesis\n proof (cases \"low no \\ set (ll ! n)\") \n case True\n with wf_ll nsll have \"low no \\ set_of pret \\ var (low no) = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"low no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n with lno_Null show ?thesis\n by simp\n next\n assume lno_notin_lln: \"low no \\ set (ll ! n)\"\n then show ?thesis\n by simp\n qed\n next\n assume lno_nNull: \"low no \\ Null\"\n with balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n show ?thesis\n proof (cases \"low no \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"low no \\ set_of pret \\ var (low no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_children_smaller no_in_pret_var show ?thesis\n by simp\n next\n assume \"low no \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n qed\n have high_no_notin_lln: \"high no \\ set (ll ! n)\"\n proof (cases \"high no = Null\")\n case True\n note hno_Null=this\n with balanced_no have lno_Null: \"low no = Null\"\n by simp\n show ?thesis\n proof (cases \"high no \\ set (ll ! n)\") \n case True\n with wf_ll nsll have \"high no \\ set_of pret \\ var (high no) = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"high no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n with hno_Null show ?thesis\n by simp\n next\n assume hno_notin_lln: \"high no \\ set (ll ! n)\"\n then show ?thesis\n by simp\n qed\n next\n assume hno_nNull: \"high no \\ Null\"\n with balanced_no have lno_nNull: \"low no \\ Null\"\n by simp\n with hno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n show ?thesis\n proof (cases \"high no \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"high no \\ set_of pret \\ var (high no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_children_smaller no_in_pret_var show ?thesis\n by simp\n next\n assume \"high no \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n qed \n from no_in_pret_var pret_dag no_nNull obtain not where \n no_dag_ex: \"Dag no low high not\"\n apply -\n apply (rotate_tac 2)\n apply (drule subnode_dag_cons)\n apply (auto simp del: Dag_Ref)\n done\n with pret_dag prebdt_pret no_in_pret_var obtain nobdt \n where nobdt_ex: \n \"bdt not var = Some nobdt\"\n apply -\n apply (drule subbdt_ex_dag_def)\n apply auto\n done\n have isLeaf_var: \"isLeaf_pt no low high = (var no \\ 1)\"\n proof\n assume no_isLeaf: \"isLeaf_pt no low high\"\n from nobdt_ex no_dag_ex no_isLeaf show \"var no \\ 1\"\n apply -\n apply (rule bdt_Some_Leaf_var_le_1)\n apply auto\n done\n next\n assume varno_le_1: \"var no \\ 1\"\n show \"isLeaf_pt no low high\"\n proof (cases \"var no = 0\")\n case True\n with nobdt_ex no_nNull no_dag_ex have \"not = Node Tip no Tip\" \n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n with no_dag_ex show \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n next\n assume \"var no \\ 0\"\n with varno_le_1 have \"var no = 1\"\n by simp\n with nobdt_ex no_nNull no_dag_ex have \"not = Node Tip no Tip\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with no_dag_ex show \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n qed\n qed\n have repb_low_nNull: \"(low no \\ Null \\ repb (low no) \\ Null)\"\n proof\n assume lno_nNull: \"low no \\ Null\"\n with no_nNull no_in_pret_var pret_dag have lno_in_pret: \"low no \\ set_of pret\"\n apply -\n apply (rule_tac low=low in subelem_set_of_low)\n apply auto\n done\n from lno_nNull balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done \n with no_in_pret_var have var_lno_l_n: \"var (low no) set (ll ! (var (low no)))\"\n by (simp add: wf_ll_def length_ll_eq)\n with lno_in_pret var_lno_l_n have \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n hence \"repb (low no) \\ repb ` Nodes n ll\"\n by simp\n with repbNodes_in_Nodes have repb_lno_in_Nodes: \n \"repb (low no) \\ Nodes n ll\"\n by blast\n from pret_dag wf_ll nsll have \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done \n with repb_lno_in_Nodes show \"repb (low no) \\ Null\"\n by auto\n qed\n have Null_notin_lln: \"Null \\ set (ll ! n)\"\n proof (cases \"Null \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"Null \\ set_of pret \\ var (Null) = n\" \n by (simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"Null \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n thus ?thesis\n by auto\n next\n assume \"Null \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n have \"(repb \\ low) no \\ set (ll ! n)\"\n proof (cases \"low no = Null\") \n case True\n with Null_notin_lln show ?thesis\n by (simp add: null_comp_def)\n next\n assume lno_nNull: \"low no \\ Null\"\n with no_nNull no_in_pret_var pret_dag have lno_in_pret: \"low no \\ set_of pret\"\n apply -\n apply (rule_tac low=low in subelem_set_of_low)\n apply auto\n done\n from lno_nNull have propto_eq_comp: \"(repb \\ low) no = repb (low no)\"\n by (simp add: null_comp_def)\n from lno_nNull balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done \n with no_in_pret_var have var_lno_l_n: \"var (low no) set (ll ! (var (low no)))\"\n by (simp add: wf_ll_def length_ll_eq)\n with lno_in_pret var_lno_l_n have lno_in_Nodes_n: \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n hence \"repb (low no) \\ repb ` Nodes n ll\"\n by simp\n with repbNodes_in_Nodes have repb_lno_in_Nodes: \n \"repb (low no) \\ Nodes n ll\"\n by blast\n with lno_in_Nodes_n normalize_prop have \"var (repb (low no)) \\ var (low no)\" \n by auto\n with var_lno_l_n have var_rep_lno_l_n: \" var (repb (low no)) < n\"\n by simp\n with repb_lno_in_Nodes have \"\\ k < n. repb (low no) \\ set (ll ! k)\"\n by (auto simp add: Nodes_def)\n with wf_ll propto_eq_comp nsll show \" (repb \\ low) no \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n qed\n with no_nNull balanced_no low_no_notin_lln high_no_notin_lln isLeaf_var repb_low_nNull\n show \" no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\ high no \\ set (ll ! n) \\ \n isLeaf_pt no low high = (var no \\ 1) \\ \n (low no \\ Null \\ repb (low no) \\ Null) \\ \n (repb \\ low) no \\ set (ll ! n)\"\n by auto\n qed\n have all_nodes_same_var: \"\\no1 \\ set (ll ! n). \\no2 \\ set (ll ! n). var no1 = var no2\"\n proof (intro ballI impI)\n fix no1 no2\n assume \"no1 \\ set (ll ! n)\"\n with wf_ll nsll have var_lln_i: \"var no1 = n\"\n by (simp add: wf_ll_def length_ll_eq)\n assume \"no2 \\ set (ll ! n)\"\n with wf_ll nsll have \"var no2 = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_lln_i show \" var no1 = var no2\"\n by simp\n qed\n have \"(\\repa. (\\no. no \\ set (ll ! n) \\ repb no = repa no) \\\n (\\no\\set (ll ! n).\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no \\ set (ll ! n) \\\n repa (repa no) = repa no \\\n (\\no1\\set (ll ! n).\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))) \\\n var p + 1 - (n + 1) < var p + 1 - n \\\n n + 1 \\ var p + 1 \\\n (\\pt i. pt \\ set_of pret \\ (n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \\\n rep pt = repa pt) \\\n repa ` Nodes (n + 1) ll \\ Nodes (n + 1) ll \\\n (\\no\\Nodes (n + 1) ll.\n var (repa no) \\ var no \\\n (\\not nort.\n Dag (repa no) (repa \\ low) (repa \\ high) nort \\\n Dag no low high not \\\n reduced nort \\\n ordered nort var \\\n set_of nort \\ repa ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repa no = no) \\\n (\\nobdt.\n bdt not var = Some nobdt \\\n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))) \\\n (\\t1 t2.\n t1 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n t2 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n isomorphic_dags_eq t1 t2 var))\"\n (is \"(\\repc. ?srrl_post repc \\ ?norm_inv repc) \") \n proof (intro allI impI, elim conjE)\n fix repc\n assume repbc_nc: \"\\no. no \\ set (ll ! n) \\ repb no = repc no\"\n assume rep_prop: \" \\no\\set (ll ! n).\n repc no \\ Null \\\n (if (repc \\ low) no = (repc \\ high) no \\ low no \\ Null\n then repc no = (repc \\ low) no\n else repc no \\ set (ll ! n) \\\n repc (repc no) = repc no \\\n (\\no1\\set (ll ! n).\n ((repc \\ high) no1 = (repc \\ high) no \\\n (repc \\ low) no1 = (repc \\ low) no) =\n (repc no = repc no1)))\"\n show \"?norm_inv repc\"\n proof -\n from n_Suc_var_p have termi: \"var p + 1 - (n + 1) < var p + 1 - n\"\n by arith\n from wf_ll repbc_nc nsll \n have Nodes_n_rep_nc: \"\\p. p \\ Nodes n ll \\ repb p = repc p\"\n apply -\n apply (rule allI)\n apply (rule impI)\n apply (simp add: Nodes_def)\n apply (erule exE)\n apply (erule_tac x=p in allE)\n apply (drule_tac i=x and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n from repbNodes_in_Nodes \n have Nodes_n_rep_in_Nodesn: \n \"\\ p. p \\ Nodes n ll \\ repb p \\ Nodes n ll\"\n by auto\n from wf_ll nsll have \"Nodes n ll \\ set_of pret\"\n apply -\n apply (rule Nodes_in_pret)\n apply (auto simp add: length_ll_eq)\n done\n with Nodes_n_rep_in_Nodesn \n have Nodes_n_rep_in_pret: \"\\p. p \\ Nodes n ll \\ repb p \\ set_of pret\"\n apply -\n apply (intro allI impI)\n apply blast\n done\n have Nodes_repbc_Dags_eq: \"\\p t. p \\ Nodes n ll \n \\ Dag (repb p) (repb \\ low) (repb \\ high) t = \n Dag (repc p) (repc \\ low) (repc \\ high) t\"\n proof (intro allI impI)\n fix p t\n assume p_in_Nodes: \" p \\ Nodes n ll\"\n then have repp_nc: \"repb p = repc p\"\n by (rule Nodes_n_rep_nc [rule_format])\n from p_in_Nodes normalize_prop obtain nort where\n nort_repb_dag: \"Dag (repb p) (repb \\ low) (repb \\ high) nort\" and\n nort_in_repbNodes: \"set_of nort \\ repb ` Nodes n ll\"\n apply -\n apply (erule_tac x=p in ballE)\n prefer 2\n apply auto\n done\n from nort_in_repbNodes repbNodes_in_Nodes \n have nort_in_Nodesn: \"set_of nort \\ Nodes n ll\"\n by blast\n from pret_dag wf_ll nsll have \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n with p_in_Nodes repbNodes_in_Nodes have repp_nNull: \"repb p \\ Null\"\n by auto\n from nort_repb_dag repp_nc \n have nort_repbc_dag: \"Dag (repc p) (repb \\ low) (repb \\ high) nort\"\n by simp\n from nort_in_Nodesn have \"\\x \\ set_of nort. x \\ Nodes n ll\"\n apply -\n apply (rule ballI)\n apply blast\n done\n with wf_ll nsll have \"\\x \\ set_of nort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret nort_repbc_dag ord_pret wf_ll nsll repbc_nc \n have \n \"\\ x \\ set_of nort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with nort_repbc_dag repp_nc \n have \"Dag (repc p) (repb \\ low) (repb \\ high) nort = \n Dag (repc p) (repc \\ low) (repc \\ high) nort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply (rule ballI)\n apply (erule_tac x=x in ballE)\n apply (elim conjE)\n apply (rule conjI)\n apply auto\n done\n with nort_repbc_dag repp_nc show \n \"Dag (repb p) (repb \\ low) (repb \\ high) t = \n Dag (repc p) (repc \\ low) (repc \\ high) t\"\n apply auto\n apply (rotate_tac 2)\n apply (frule_tac Dag_unique)\n apply (rotate_tac 1)\n apply simp\n apply simp\n apply (frule Dag_unique)\n apply (rotate_tac 3)\n apply simp\n apply simp\n done\n qed\n from rep_prop have repbc_changes: \"\\no\\set (ll ! n).\n repc no \\ Null \\\n (if (repc \\ low) no = (repc \\ high) no \\ low no \\ Null \n then repc no = (repc \\ low) no\n else repc no \\ set (ll ! n) \\ repc (repc no) = repc no \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) no \\ \n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1)))\"\n by blast\n from nsll lll have n_var_prop: \"n + 1 <= var p + 1\"\n by simp\n from rep_nc have Sucn_repb_nc: \"(\\pt. pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repb pt)\" \n apply -\n apply (intro allI impI)\n apply (erule_tac x=pt in allE)\n apply auto\n apply (rule_tac x=\"i\" in exI)\n apply auto\n done\n have repc_nc: \n \"(\\pt. pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repc pt)\" \n proof (intro allI impI)\n fix pt \n assume pt_notin_lower_ll: \"pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1)\"\n show \"rep pt = repc pt\"\n proof (cases \"pt \\ set_of pret\")\n case True\n with wf_ll nsll have \"pt \\ set (ll ! n)\"\n apply (simp add: wf_ll_def length_ll_eq)\n apply (case_tac \"pt \\ set (ll ! n)\")\n apply (subgoal_tac \"pt \\ set_of pret\")\n apply (auto)\n done\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with Sucn_repb_nc True show ?thesis\n by auto\n next\n assume pt_in_pret: \"\\ pt \\ set_of pret\"\n with pt_notin_lower_ll have pt_in_higher_ll: \n \"\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1\"\n by simp\n with nsll wf_ll lll have pt_notin_lln: \"pt \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=i and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with Sucn_repb_nc pt_in_higher_ll show ?thesis\n by auto \n qed\n qed\n from wf_ll nsll \n have Nodesn_notin_lln: \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def)\n apply clarify\n apply (drule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc \n have Nodesn_repnc: \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n have repcNodes_in_Nodes: \n \"repc ` Nodes (n + 1) ll \\ Nodes (n + 1) ll\"\n proof\n fix x\n assume x_in_repcNodesSucn: \" x \\ repc ` Nodes (n + 1) ll\"\n show \"x \\ Nodes (n + 1) ll\"\n proof (cases \"x \\ repc `Nodes n ll\")\n case True\n with repbNodes_repcNodes repbNodes_in_Nodes have \"x \\ Nodes n ll\" \n by auto\n with Nodes_subset show ?thesis \n by auto\n next\n assume \" x \\ repc `Nodes n ll\"\n with x_in_repcNodesSucn have x_in_repclln: \"x \\ repc `set (ll ! n)\"\n apply (auto simp add: Nodes_def)\n apply (case_tac \"k set (ll ! n)\"\n from rep_prop y_in_repclln obtain\n repcy_nNull: \"repc y \\ Null\" and\n red_prop: \"(repc \\ low) y = (repc \\ high) y \\ \n low y \\ Null \\ repc y = (repc \\ high) y\" and\n share_prop: \"((repc \\ low) y = (repc \\ high) y \\ low y = Null) \n \\ repc y \\ set (ll ! n) \\ repc (repc y) = repc y \\ \n (\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1))\"\n using [[simp_depth_limit = 4]]\n by auto\n from wf_ll nsll y_in_repclln obtain\n y_in_pret: \"y \\ set_of pret\" and\n vary_n: \"var y = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n from y_in_pret pret_dag have y_nNull: \"y \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n show \"x \\ Nodes (n + 1) ll\"\n proof (cases \"low y = Null\")\n case True\n from pret_dag prebdt_pret True y_in_pret \n have highy_Null: \"high y = Null\"\n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n with share_prop True obtain \n repcy_in_llb: \"repc y \\ set (ll ! n)\" and\n rry_ry: \" repc (repc y) = repc y\" and\n y_other_node_prop: \"\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1)\"\n by simp\n from repcy_in_llb x_repcy show ?thesis\n by (auto simp add: Nodes_def)\n next\n assume lowy_nNull: \"low y \\ Null\"\n with pret_dag prebdt_pret y_in_pret \n have highy_nNull: \"high y \\ Null\"\n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n show ?thesis\n proof (cases \"(repc \\ low) y = (repc \\ high) y\")\n case True\n with red_prop lowy_nNull have \"repc y = (repc \\ high) y\"\n by auto\n with highy_nNull have red_repc_y: \"repc y = repc (high y)\"\n by (simp add: null_comp_def)\n from pret_dag ord_pret y_in_pret lowy_nNull highy_nNull \n \n have \"var (low y) < var y \\ var (high y) < var y\"\n apply -\n apply (rule var_ordered_children) \n apply auto\n done\n with vary_n have varhighy: \"var (high y) < n\"\n by auto\n from y_in_pret y_nNull highy_nNull pret_dag \n have \"high y \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll varhighy have \"high y \\ Nodes n ll\"\n by (auto simp add: wf_ll_def Nodes_def)\n with red_repc_y have \"repc y \\ repc `Nodes n ll\"\n by simp\n with x_repcy have \"x \\ repc `Nodes n ll\"\n by simp\n with repbNodes_repcNodes repbNodes_in_Nodes \n have \"x \\ Nodes n ll\" \n by auto\n with Nodes_subset show ?thesis \n by auto\n next\n assume \"(repc \\ low) y \\ (repc \\ high) y\"\n with share_prop obtain \n repcy_in_llbn: \"repc y \\ set (ll ! n)\" and\n rry_ry: \"repc (repc y) = repc y\" and \n y_other_node_share: \"\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1)\"\n by auto\n with repcy_in_llbn x_repcy have \"x \\ set (ll ! n)\"\n by auto\n then show ?thesis\n by (auto simp add: Nodes_def)\n qed\n qed\n qed\n qed\n qed\n have \"(\\no\\Nodes (n + 1) ll.\n var (repc no) \\ var no \\ \n (\\not nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\\n Dag no low high not \\\n reduced nort \\ ordered nort var \\ \n set_of nort \\ repc ` Nodes (n + 1) ll \\ \n (\\no\\set_of nort. repc no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt))))\"\n (is \"\\no\\Nodes (n + 1) ll. ?Q i no\")\n proof (intro ballI)\n fix no\n assume no_in_Nodes: \"no \\ Nodes (n + 1) ll\"\n from wf_ll no_in_Nodes nsll have no_in_pret: \"no \\ set_of pret\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (erule conjE)\n apply (thin_tac \"\\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule exE)\n apply (erule_tac x=x in allE)\n apply (erule impE)\n apply arith\n apply (erule_tac x=no in ballE)\n apply auto\n done\n from pret_dag no_in_pret have nonNull: \"no\\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done \n show \"?Q i no\"\n proof (cases \"no \\ Nodes n ll\")\n case True\n note no_in_Nodesn=this\n with wf_ll nsll no_in_Nodes \n have no_notin_llbn: \"no \\ set (ll ! n)\"\n apply -\n apply (simp add: Nodes_def length_ll_eq)\n apply (elim exE)\n apply (drule_tac ?i=xa and ?j=n in no_in_one_ll)\n apply arith\n apply simp\n apply auto\n done\n with repbc_nc have repb_no_eq_repc_no: \"repb no = repc no\" \n by simp\n from repbc_nc no_in_Nodes no_notin_llbn normalize_prop True \n have varrep_eq_var: \"var (repc no) \\ var no\" \n apply -\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in allE)\n apply simp\n done\n moreover\n from True normalize_prop no_in_Nodes obtain not nort where\n nort_dag: \"Dag (repb no) (repb \\ low) (repb \\ high) nort\" and\n ord_nort: \"ordered nort var\" and\n subset_nort_not: \"set_of nort \\ repb `(Nodes n ll)\" and\n not_dag: \" Dag no low high not\" and\n red_nort: \"reduced nort\" and \n nort_repb: \"(\\no\\set_of nort. repb no = no)\" and\n bdt_prop: \"\\nobdt norbdt. bdt not var = Some nobdt \\ \n bdt nort var = Some norbdt \\ nobdt \\ norbdt\" \n by blast\n moreover\n from Nodesn_notin_lln repbc_nc nort_repb subset_nort_not repbNodes_in_Nodes \n have nort_repc: \n \"(\\no\\set_of nort. repc no = no)\"\n apply auto\n apply (subgoal_tac \"no \\ Nodes n ll\")\n apply fastforce\n apply blast\n done\n moreover\n from nort_dag have nortnodesnN: \"(\\no. no \\ set_of nort \\ no \\ Null)\"\n apply -\n apply (rule allI)\n apply (rule impI)\n apply (rule set_of_nn)\n apply auto\n done\n moreover \n have \"Dag (repc no) (repc \\ low) (repc \\ high) nort\"\n proof -\n from no_notin_llbn repbc_nc have repbc_no: \"repc no = repb no\"\n by fastforce\n with nort_dag \n have nortrepbc_dag: \"Dag (repc no) (repb \\ low) (repb \\ high) nort\"\n by simp\n from wf_ll nseqll have \"Nodes n ll \\ set_of pret\"\n apply -\n apply (rule Nodes_levellist_subset_t)\n apply assumption+\n apply (simp add: length_ll_eq)\n done\n with repbNodes_in_Nodes subset_nort_not \n have subset_nort_pret: \"set_of nort \\ set_of pret\"\n by simp\n have vxsn_in_pret: \"\\ x \\ set_of nort. var x < n \\ x \\ set_of pret\"\n proof (rule ballI)\n fix x\n assume x_in_nort: \"x \\ set_of nort\"\n from x_in_nort subset_nort_not repbNodes_in_Nodes \n have \"x \\ Nodes n ll\"\n by blast\n with wf_ll nsll have xsn: \"var x < n\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (erule conjE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule exE)\n apply (erule_tac x=xa in allE)\n apply (erule impE)\n apply arith\n apply (erule_tac x=x in ballE)\n apply auto\n done\n from x_in_nort subset_nort_pret have x_in_pret: \"x \\ set_of pret\"\n by blast\n with xsn show \"var x < n \\ x \\ set_of pret\" by simp\n qed\n with pret_dag prebdt_pret nortrepbc_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\ x \\ set_of nort. ((repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x)\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with nort_dag \n have \"Dag (repc no) (repc \\ low) (repc \\ high) nort = \n Dag (repc no) (repb \\ low) (repb \\ high) nort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply simp\n done\n with nortrepbc_dag show ?thesis\n by simp\n qed\n moreover \n have \"set_of nort \\ repc `(Nodes (n + 1) ll)\"\n proof -\n have Nodesn_in_NodesSucn: \"Nodes n ll \\ Nodes (n + 1) ll\"\n by (simp add: Nodes_def set_split)\n then have repbNodesn_in_repbNodesSucn: \n \"repb `(Nodes n ll) \\ repb `(Nodes (n + 1) ll)\"\n by blast\n from wf_ll nsll \n have Nodes_n_notin_lln: \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n from Nodesn_in_NodesSucn \n have \"repc `(Nodes n ll) \\ repc `(Nodes (n + 1) ll)\"\n by blast\n with repbNodes_repcNodes subset_nort_not repbNodesn_in_repbNodesSucn \n show ?thesis by simp\n qed\n ultimately show ?thesis \n by blast\n next\n assume \" no \\ Nodes n ll\"\n with no_in_Nodes have no_in_llbn: \"no \\ set (ll ! n)\"\n apply (simp add: Nodes_def)\n apply (erule exE)\n apply (erule_tac x=x in allE)\n apply (case_tac \"x Null \\\n ((repc \\ low) no = (repc \\ high) no \\ low no \\ Null \n \\ repc no = (repc \\ high) no) \\\n (((repc \\ low) no = (repc \\ high) no \\ low no = Null) \n \\ repc no \\ set (ll ! n) \\ repc (repc no) = repc no \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) no \\\n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1)))\"\n (is \"?rnonN \\ ?repreduce \\ ?repshare\")\n using [[simp_depth_limit=4]]\n by (simp split: if_split)\n then obtain \n rnonN: \"?rnonN\" and\n repreduce: \"?repreduce\" and\n repshare: \"?repshare\"\n by blast\n have repcn_normalize: \"var (repc no) \\ var no \\\n (\\not nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repc ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repc no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))\"\n (is \"?varrep \\ ?repcn_prop\" \n is \"?varrep \\ \n (\\not nort. ?nort_dag nort \\ ?not_dag not \\ ?red nort \\ \n ?ord nort \\ ?nort_in_Nodes nort \\ ?repcno_no_n nort \\ ?bdt_equ not nort)\")\n proof (cases \"high no = Null\")\n case True\n note highnoNull=this\n with pret_dag prebdt_pret no_in_pret \n have lownoNull: \"low no = Null\"\n apply -\n apply (drule balanced_bdt)\n apply assumption+\n apply simp\n done\n with repshare have repcnoinlln:\"repc no \\ set (ll ! n)\"\n by simp\n with wf_ll nsll have varrno_n: \"var (repc no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with varno have varrep: \"?varrep\"\n by simp\n from wf_ll nsll no_in_llbn varrno_n \n have varrno_varno: \"var (repc no) = var no\"\n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll repcnoinlln \n have rno_in_pret: \"repc no \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from repcnoinlln repshare lownoNull \n have reprep_eq_rep: \"repc (repc no) = repc no\" \n by simp\n with repcnoinlln repshare lownoNull \n have repchildreneq: \n \"((repc \\ high) (repc no) = (repc \\ high) no \\ \n (repc \\ low) (repc no) = (repc \\ low) no)\"\n by simp\n have repcn_prop: \"?repcn_prop\"\n apply - \n apply (rule_tac x=\"(Node Tip no Tip)\" in exI)\n apply (rule_tac x=\"(Node Tip (repc no) Tip)\" in exI)\n apply (intro conjI)\n apply simp\n prefer 3\n apply simp\n prefer 3\n apply simp\n proof -\n from pret_dag pnN rno_in_pret have rnonN: \"repc no \\ Null\"\n apply (case_tac \"repc no = Null\")\n apply auto\n done\n from highnoNull repchildreneq \n have rhighNull: \"(repc \\ high) (repc no) = Null\" \n by (simp add: null_comp_def)\n from lownoNull repchildreneq \n have rlowNull: \"(repc \\ low) (repc no) = Null\" \n by (simp add: null_comp_def)\n with rhighNull rnonN \n show \"repc no \\ Null \\ (repc \\ low) (repc no) = Null \\ \n (repc \\ high) (repc no) = Null\"\n by simp\n next\n from nonNull lownoNull highnoNull \n show \"?not_dag (Node Tip no Tip)\"\n by simp\n next\n from no_in_Nodes \n show \"set_of (Node Tip (repc no) Tip) \\ repc ` Nodes (n + 1) ll\"\n by simp\n next\n show \"\\no\\set_of (Node Tip (repc no) Tip). repc no = no\"\n proof \n fix pt\n assume pt_in_repcLeaf: \"pt \\ set_of (Node Tip (repc no) Tip)\"\n with reprep_eq_rep show \"repc pt = pt\"\n by simp\n qed\n next\n show \"?bdt_equ (Node Tip no Tip) (Node Tip (repc no) Tip)\"\n proof (cases \"var no = 0\")\n case True \n note vno_Null=this\n then have nobdt: \"bdt (Node Tip no Tip) var = Some Zero\" by simp\n from varrep vno_Null have varrno: \"var (repc no) = 0\" by simp\n then have norbdt: \"bdt (Node Tip (repc no) Tip) var = Some Zero\" by simp\n from nobdt norbdt vno_Null varrno show ?thesis\n by (simp add: cong_eval_def)\n next\n assume vno_not_Null: \"var no \\ 0\"\n show ?thesis\n proof (cases \"var no = 1\")\n case True\n note vno_One=this\n then have nobdt: \"bdt (Node Tip no Tip) var = Some One\" by simp\n from varrno_varno vno_One \n have \"bdt (Node Tip (repc no) Tip) var = Some One\" by simp \n with nobdt show ?thesis by (auto simp add: cong_eval_def)\n next\n assume vno_nOne: \"var no \\ 1\"\n with vno_not_Null have onesvno: \"1 < var no\" by simp\n from nonNull lownoNull highnoNull \n have no_dag: \"Dag no low high (Node Tip no Tip)\"\n by simp \n with pret_dag no_in_pret have not_in_pret: \"(Node Tip no Tip) \\ pret\"\n by (metis set_of_subdag)\n with prebdt_pret have \"\\bdt2. bdt (Node Tip no Tip) var = Some bdt2\"\n by (metis subbdt_ex)\n with onesvno show ?thesis \n by simp\n qed\n qed\n qed\n with varrep reprep_eq_rep show ?thesis by simp\n next\n assume hno_nNull: \"high no \\ Null\"\n with pret_dag prebdt_pret no_in_pret have lno_nNull: \"low no \\ Null\"\n by (metis balanced_bdt)\n (*-------------------normalize_prop fuer (high no)------------------------*)\n \n from no_in_pret nonNull hno_nNull pret_dag \n have hno_in_pret: \"high no \\ set_of pret\"\n by (metis subelem_set_of_high)\n with wf_ll \n have hno_in_ll: \"high no \\ set (ll ! (var (high no)))\" \n by (simp add: wf_ll_def)\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n \n have varhnos_varno: \"var (high no) < var no\"\n by (metis var_ordered_children)\n with varno have varhnos_n: \"var (high no) < n\" by simp\n with hno_in_ll have hno_in_Nodesn: \"high no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (high no)\" in exI)\n apply simp\n done\n from wf_ll nsll hno_in_ll varhnos_n \n have \"high no \\ set (ll ! n)\"\n apply -\n apply (rule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repb_repc_high: \"repb (high no) = repc (high no)\" by simp\n with normalize_prop hno_in_Nodesn varhnos_varno varno \n have high_normalize: \"var (repc (high no)) \\ var (high no) \\\n (\\not nort. Dag (repc (high no)) (repb \\ low) (repb \\ high) nort \\\n Dag (high no) low high not \\ reduced nort \\\n ordered nort var \\ set_of nort \\ repb `(Nodes n ll) \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = \n Some norbdt \\ nobdt \\ norbdt))\"\n (is \"?varrep_high \\ \n (\\not nort. ?repbchigh_dag nort \\ ?high_dag not \\ \n ?redhigh nort \\ ?ordhigh nort \\ ?rephigh_in_Nodes nort \\ \n ?repbno_no nort \\ ?highdd_prop not nort)\"\n is \"?varrep_high \\ ?not_nort_prop\")\n apply simp\n apply (erule_tac x=\"high no\" in ballE)\n apply (simp del: Dag_Ref)\n apply simp\n done\n then have varrep_high: \"?varrep_high\" by simp\n from varhnos_n varrep_high have varrephno_s_n: \n \"var (repc (high no)) < n\"\n by simp\n from Nodes_subset \n have \"Nodes n ll \\ Nodes (Suc n) ll\"\n by auto\n with hno_in_Nodesn repcNodes_in_Nodes \n have \"repc (high no) \\ Nodes (Suc n) ll\"\n apply simp\n apply blast\n done\n with wf_ll nsll have \"repc (high no) \\ set_of pret\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (elim conjE exE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule_tac x=x in allE)\n apply (erule impE)\n apply simp\n apply (erule_tac x=\"repc (high no)\" in ballE)\n apply auto\n done\n with wf_ll varrephno_s_n \n have \"\\ k set (ll ! k)\"\n by (auto simp add: wf_ll_def)\n with wf_ll nsll have \"repc (high no) \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc \n have repbchigh_idem: \"repb (repc (high no)) = repc (repc (high no))\"\n by auto\n from high_normalize \n have not_nort_prop_high: \"?not_nort_prop\" by (simp del: Dag_Ref)\n from not_nort_prop_high obtain hnot where high_dag: \"?high_dag hnot\"\n by auto\n from wf_ll nsll \n have \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then \n have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n then have repcNodes_repbNodes: \n \"repc `(Nodes n ll) = repb `(Nodes n ll)\"\n by simp\n from pret_dag nsll wf_ll \n have null_notin_Nodesn: \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n from hno_in_Nodesn have \"repc (high no) \\ repc `(Nodes n ll)\"\n by blast\n with repbNodes_in_Nodes repcNodes_repbNodes \n have \"repc (high no) \\ Nodes n ll\"\n apply simp\n apply blast\n done\n with null_notin_Nodesn have rhn_nNull: \"repc (high no) \\ Null\"\n by auto\n\n (*-------------------normalize_prop fuer (low no)--------------------------*)\n\n from no_in_pret nonNull lno_nNull pret_dag \n have lno_in_pret: \"low no \\ set_of pret\"\n by (rule subelem_set_of_low)\n with wf_ll \n have lno_in_ll: \"low no \\ set (ll ! (var (low no)))\" \n by (simp add: wf_ll_def)\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n have varlnos_varno: \"var (low no) < var no\"\n apply -\n apply (drule var_ordered_children)\n apply assumption+\n apply auto\n done\n with varno have varlnos_n: \"var (low no) < n\" by simp\n with lno_in_ll have lno_in_Nodesn: \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n from varlnos_n wf_ll nsll lno_in_ll \n have \"low no \\ set (ll ! n)\"\n apply -\n apply (rule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repb_repc_low: \"repb (low no) = repc (low no)\" by simp\n with normalize_prop lno_in_Nodesn varlnos_varno varno \n have low_normalize: \"var (repc (low no)) \\ var (low no) \\\n (\\not nort. Dag (repc (low no)) (repb \\ low) (repb \\ high) nort \\\n Dag (low no) low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repb `(Nodes n ll) \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = Some norbdt \\ \n nobdt \\ norbdt))\"\n (is \"?varrep_low \\ \n (\\not nort. ?repbclow_dag nort \\ ?low_dag not \\ ?redhigh nort \\ \n ?ordhigh nort \\ ?replow_in_Nodes nort \\ ?low_repno_no nort \n \\ ?lowdd_prop not nort)\"\n is \"?varrep_low \\ ?not_nort_prop_low\")\n apply simp\n apply (erule_tac x=\"low no\" in ballE)\n apply (simp del: Dag_Ref)\n apply simp\n done\n then have varrep_low: \"?varrep_low\" by simp\n from low_normalize have not_nort_prop_low: \"?not_nort_prop_low\" \n by (simp del: Dag_Ref)\n from lno_in_Nodesn have \"repc (low no) \\ repc `(Nodes n ll)\"\n by blast\n with repbNodes_in_Nodes repcNodes_repbNodes \n have \"repc (low no) \\ Nodes n ll\"\n apply simp\n apply blast\n done\n with null_notin_Nodesn have rln_nNull: \"repc (low no) \\ Null\"\n by auto\n\n \n show ?thesis\n proof (cases \"repc (low no) = repc (high no)\")\n case True\n note red_case=this\n with repreduce lno_nNull hno_nNull \n have rno_eq_hrno: \"repc no = repc (high no)\" \n by (simp add: null_comp_def)\n from varhnos_varno rno_eq_hrno varrep_high have varrep: \"?varrep\" by simp\n from not_nort_prop_high not_nort_prop_low have repcn_prop: \"?repcn_prop\"\n apply -\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort )\n apply (rule_tac x=\"(Node lnot no rnot)\" in exI)\n apply (rule_tac x=rnort in exI)\n apply (elim conjE)\n apply (intro conjI)\n prefer 7\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt)\n apply (elim conjE)\n apply (case_tac \"Suc 0 < var no\")\n apply (rule_tac x=\"(Bdt_Node lnobdt (var no) rnobdt)\" in exI)\n apply (rule conjI)\n prefer 2\n apply (rule_tac x=rnorbdt in exI)\n apply (rule conjI)\n proof -\n fix rnot lnot rnort lnort\n assume highnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume ord_nort: \" ordered rnort var\"\n assume rnort_in_repNodes: \" set_of rnort \\ repb ` Nodes n ll\"\n from rnort_in_repNodes repbNodes_in_Nodes \n have nort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by blast\n from varhnos_n varrep_high \n have vrhnos_n: \"var (repc (high no)) < n\" by simp\n from rhn_nNull highnort_dag \n have \"\\lno rno. rnort = Node lno (repc (high no)) rno\" by fastforce\n with highnort_dag rhn_nNull have \"root rnort = repc (high no)\" by auto\n with ord_nort have \"\\x \\ set_of rnort. var x <= var (repc (high no))\"\n apply -\n apply (rule ballI)\n apply (drule ordered_set_of)\n apply auto\n done\n with vrhnos_n have vxsn: \"\\x \\ set_of rnort. var x < n\" \n by fastforce\n from nort_in_Nodes have \"\\x \\ set_of rnort. x \\ Nodes n ll\" \n by auto\n with wf_ll nsll \n have x_in_pret: \"\\x \\ set_of rnort. x \\ set_of pret\"\n apply -\n apply (rule ballI)\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n from vxsn x_in_pret \n have vxsn_in_nort: \"\\x \\ set_of rnort. var x x \\ set_of pret\"\n by auto\n with pret_dag prebdt_pret highnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\x \\ set_of rnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with rno_eq_hrno \n have \"Dag (repc no) (repc \\ low) (repc \\ high) rnort = \n Dag (repc no) (repb \\ low) (repb \\ high) rnort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply simp\n done\n with highnort_dag rno_eq_hrno \n show \"Dag (repc no) (repc \\ low) (repc \\ high) rnort\" by simp\n next\n fix rnot lnot rnort lnort\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n with lnot_dag nonNull \n show \"Dag no low high (Node lnot no rnot)\" by simp\n next\n fix rnot lnot rnort lnort\n assume \" reduced rnort\"\n then show \"reduced rnort\" by simp\n next\n fix rnort\n assume \"ordered rnort var\"\n then show \"ordered rnort var\" by simp\n next\n fix rnort\n assume rnort_in_Nodes: \" set_of rnort \\ repb ` Nodes n ll\"\n have \"Nodes n ll \\ Nodes (n + 1) ll\" \n by (simp add: Nodes_def set_split) \n then have \"repc ` Nodes n ll \\ repc ` Nodes (n + 1) ll\"\n by blast\n with rnort_in_Nodes repbNodes_repcNodes \n show \" set_of rnort \\ repc ` Nodes (n + 1) ll\" \n by (simp add: Nodes_def)\n next\n fix rnort rnorbdt\n assume \" bdt rnort var = Some rnorbdt\"\n then show \" bdt rnort var = Some rnorbdt\" by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume rcongeval: \"rnobdt \\ rnorbdt\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnorbdt_def: \" bdt lnort var = Some lnorbdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume lcongeval:\"lnobdt \\ lnorbdt\"\n from red_case lnort_dag rnort_dag \n have lnort_rnort: \"lnort = rnort\" \n by (simp add: Dag_unique del: Dag_Ref)\n with lnorbdt_def lcongeval rnorbdt_def \n have lnobdt_rnorbdt: \"lnobdt \\ rnorbdt\" by simp\n with rcongeval have \"lnobdt \\ rnobdt\" \n apply -\n apply (rule cong_eval_trans)\n apply (auto simp add: cong_eval_sym)\n done\n then have \" Bdt_Node lnobdt (var no) rnobdt \\ rnobdt\"\n apply -\n apply (simp add: cong_eval_sym [rule_format])\n apply (rule cong_eval_child_high)\n apply assumption\n done\n with rcongeval show \"Bdt_Node lnobdt (var no) rnobdt \\ rnorbdt\"\n apply -\n apply (rotate_tac 1)\n apply (rule cong_eval_trans)\n apply auto\n done\n next\n fix lnot rnot lnobdt rnobdt\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \" Dag (high no) low high rnot\"\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume onesvarno: \" Suc 0 < var no\"\n with rnobdt_def lnot_dag rnot_dag lnobdt_def \n show \"bdt (Node lnot no rnot) var = \n Some (Bdt_Node lnobdt (var no) rnobdt)\" \n by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume cong_rno_rnor: \" rnobdt \\ rnorbdt\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume \"\\ Suc 0 < var no\"\n then have varnoseq1: \"var no = 0 \\ var no = 1\" by auto\n show \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt \\ \n (\\norbdt. bdt rnort var = Some norbdt \\ nobdt \\ norbdt)\"\n proof (cases \"var no = 0\")\n case True\n note vnoNull=this\n with pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n show ?thesis\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n next\n assume \"var no \\ 0\"\n with varnoseq1 have vnoOne: \"var no = 1\" by simp\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n vnoOne \n have vlvrNull: \"var (low no) = 0 \\ var (high no) = 0\"\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n then have vlNull: \"var (low no) = 0\" by simp\n from vlvrNull have vrNull: \"var (high no) = 0\" by simp\n from lnobdt_def lnot_dag vlNull lno_nNull \n have lnobdt_Zero: \"lnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from rnobdt_def rnot_dag vrNull hno_nNull \n have rnobdt_Zero: \"rnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from lnobdt_Zero lnobdt_def have \"bdt lnot var = Some Zero\" by simp\n with lnot_dag vlNull \n have lnot_Node: \"lnot = (Node Tip (low no) Tip)\"\n by auto\n from rnobdt_Zero rnobdt_def rnot_dag vrNull \n have rnot_Node: \"rnot = (Node Tip (high no) Tip)\" \n by auto\n from pret_dag no_in_pret obtain not where \n not_ex: \"Dag no low high not\"\n apply -\n apply (drule dag_setof_exD)\n apply auto\n done\n with pret_dag no_in_pret have not_ex_in_pret: \"not <= pret\" \n apply -\n apply (rule set_of_subdag)\n apply auto\n done\n from not_ex lnot_dag rnot_dag nonNull \n have not_def: \"not = (Node lnot no rnot)\" \n by (simp add: Dag_unique del: Dag_Ref)\n with not_ex_in_pret prebdt_pret \n have nobdt_ex: \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt\"\n apply -\n apply (rule subbdt_ex)\n apply auto\n done\n then obtain nobdt where \n nobdt_def: \"bdt (Node lnot no rnot) var = Some nobdt\" by auto\n from not_def have \"root not = no\" by simp\n with nobdt_def vnoOne not_def have \"not = (Node Tip no Tip)\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with not_def have \"rnot = Tip\" by simp\n with rnot_Node show ?thesis by simp\n qed\n next\n fix rnot lnot rnort lnort\n assume rnort_in_repb_Nodesn: \"set_of rnort \\ repb ` Nodes n ll\"\n assume rnort_repb_no: \"\\no\\set_of rnort. repb no = no\"\n from repbNodes_in_Nodes rnort_in_repb_Nodesn \n have rnort_in_Nodesn: \"set_of rnort \\ Nodes n ll\"\n by blast\n show \"\\no\\set_of rnort. repc no = no\"\n proof\n fix pt\n assume pt_in_rnort: \" pt \\ set_of rnort\"\n with rnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with rnort_repb_no pt_in_rnort show \"repc pt = pt\"\n by auto\n qed\n qed\n with varrep show ?thesis by simp\n next\n assume share_case_cond: \"repc (low no) \\ repc (high no)\"\n with lno_nNull hno_nNull \n have share_case_cond_propto: \"(repc \\ low) no \\ (repc \\ high) no\"\n by (simp add: null_comp_def)\n with repshare obtain \n rno_in_llbn: \"repc no \\ set (ll ! n)\" and\n rrno_eq_rno: \"repc (repc no) = repc no\" and\n twonodes_in_llbn_prop: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) no \\ \n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1))\"\n by auto\n from wf_ll rno_in_llbn nsll \n have varrepno_n: \"var (repc no) = n\" \n by (simp add: wf_ll_def length_ll_eq)\n with varno have varrep: \"?varrep\" \n by simp\n from not_nort_prop_high not_nort_prop_low have repcn_prop: \"?repcn_prop\"\n apply-\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort)\n apply (rule_tac x=\"Node lnot no rnot\" in exI)\n apply (rule_tac x=\"Node lnort (repc no) rnort\" in exI)\n apply (elim conjE)\n apply (intro conjI)\n prefer 7\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt)\n apply (elim conjE)\n apply (case_tac \"Suc 0 < var no\")\n apply (rule_tac x=\"(Bdt_Node lnobdt (var no) rnobdt)\" in exI)\n apply (rule conjI)\n prefer 2\n apply (rule_tac x=\"(Bdt_Node lnorbdt (var (repc no)) rnorbdt)\" in exI)\n apply (rule conjI)\n proof -\n fix rnot lnot rnort lnort\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnort_in_repNodes: \"set_of rnort \\ repb ` Nodes n ll\"\n assume lnort_in_repNodes: \"set_of lnort \\ repb ` Nodes n ll\"\n from rnort_in_repNodes repbNodes_in_Nodes \n have rnort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by simp\n from lnort_in_repNodes repbNodes_in_Nodes \n have lnort_in_Nodes: \"set_of lnort \\ Nodes n ll\"\n by simp\n from rnort_in_Nodes \n have rnortx_in_Nodes: \"\\ x \\ set_of rnort. x \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have \"\\ x \\ set_of rnort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret rnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\x \\ set_of rnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n then have \"Dag (repc (high no)) (repc \\ low) (repc \\ high) rnort = \n Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply assumption\n done\n with rnort_dag \n have rnort_dag_repc: \n \"Dag (repc (high no)) (repc \\ low) (repc \\ high) rnort\" \n by simp\n from lnort_in_Nodes \n have lnortx_in_Nodes: \"\\x \\ set_of lnort. x \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have \"\\ x \\ set_of lnort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret lnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\ x \\ set_of lnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n then have \n \"Dag (repc (low no)) (repc \\ low) (repc \\ high) lnort = \n Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply assumption\n done\n with lnort_dag \n have lnort_dag_repc: \n \"Dag (repc (low no)) (repc \\ low) (repc \\ high) lnort\" \n by simp\n from lno_nNull hno_nNull \n have propto_comp: \"(repc \\ low) no = repc (low no) \\ \n (repc \\ high) no = repc (high no)\" \n by (simp add: null_comp_def)\n from rno_in_llbn twonodes_in_llbn_prop rrno_eq_rno \n have \"(repc \\ high) (repc no) = (repc \\ high) no \\ \n (repc \\ low) (repc no) = (repc \\ low) no\"\n by simp\n with propto_comp lnort_dag_repc rnort_dag_repc lno_nNull hno_nNull \n rnonN \n show \"Dag(repc no)(repc \\ low)(repc \\ high)(Node lnort (repc no) rnort)\"\n by auto\n next\n fix rnot lnot rnort lnort\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n with rnot_dag nonNull \n show \"Dag no low high (Node lnot no rnot)\" \n by simp\n next\n fix rnort lnort\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume red_rnort: \"reduced rnort\"\n assume red_lnort: \" reduced lnort\"\n from rhn_nNull rnort_dag obtain lrnort rrnort where \n rnort_Node: \"rnort = (Node lrnort (repc (high no)) rrnort)\"\n by auto\n from rln_nNull lnort_dag obtain llnort rlnort where \n lnort_Node: \"lnort = (Node llnort (repc (low no)) rlnort)\"\n by auto\n from twonodes_in_llbn_prop rrno_eq_rno rno_in_llbn hno_nNull lno_nNull \n have \"((repc \\ high) (repc no)) = repc (high no) \\ \n ((repc \\ low) (repc no)) = repc (low no)\"\n apply -\n apply (erule_tac x=\"repc no\" in ballE)\n apply (auto simp add: null_comp_def)\n done\n with share_case_cond \n have \"((repc \\ high) (repc no)) \\ ((repc \\ low) (repc no))\"\n by auto\n with red_lnort red_rnort rnort_Node lnort_Node share_case_cond \n show \"reduced (Node lnort (repc no) rnort)\"\n apply -\n apply (rule_tac lp=\"repc (low no)\" and rp=\"repc (high no)\" and \n llt=llnort and rlt = rlnort and lrt=lrnort and rrt=rrnort \n in reduced_children_parent)\n apply auto\n done\n next\n fix lnort rnort\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume ord_lnort: \"ordered lnort var\"\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume ord_rnort: \" ordered rnort var\"\n assume lnort_in_repNodes: \"set_of lnort \\ repb `Nodes n ll\"\n assume rnort_in_repNodes: \"set_of rnort \\ repb `Nodes n ll\"\n from lnort_in_repNodes repbNodes_in_Nodes \n have lnort_in_Nodes: \"set_of lnort \\ Nodes n ll\"\n by simp\n from rnort_in_repNodes repbNodes_in_Nodes \n have rnort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by simp\n\n from rhn_nNull rnort_dag obtain lrnort rrnort where \n rnort_Node: \"rnort = (Node lrnort (repc (high no)) rrnort)\"\n by auto\n from rln_nNull lnort_dag obtain llnort rlnort where \n lnort_Node: \"lnort = (Node llnort (repc (low no)) rlnort)\"\n by auto\n from lnort_dag rln_nNull lnort_in_Nodes \n have \"repc (low no) \\ set_of lnort\" \n by auto\n with lnort_in_Nodes \n have \"repc (low no) \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have vrlno_sn: \"var (repc (low no)) < n\"\n apply -\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n from rnort_dag rhn_nNull rnort_in_Nodes \n have \"repc (high no) \\ set_of rnort\" \n by auto\n with rnort_in_Nodes \n have \"repc (high no) \\ Nodes n ll\"\n by blast\n with wf_ll nsll have vrhno_sn: \"var (repc (high no)) < n\"\n apply -\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with varrepno_n vrlno_sn lnort_dag ord_lnort rnort_dag rnort_Node \n lnort_Node ord_rnort \n show \"ordered (Node lnort (repc no) rnort) var\"\n by auto\n next\n fix lnort rnort\n assume lnort_in_Nodes: \"set_of lnort \\ repb `Nodes n ll\"\n assume rnort_in_Nodes: \"set_of rnort \\ repb `Nodes n ll\"\n from lnort_in_Nodes repbNodes_repcNodes \n have lnort_in_repcNodes: \"set_of lnort \\ repc `Nodes n ll\"\n by simp\n from rnort_in_Nodes repbNodes_repcNodes \n have rnort_in_repcNodes: \"set_of rnort \\ repc `Nodes n ll\"\n by simp\n have nNodessubset: \"Nodes n ll \\ Nodes (n+1) ll\"\n by (simp add: Nodes_subset)\n then have repc_Nodes_subset:\n \"repc `Nodes n ll \\ repc `Nodes (n+1) ll\"\n by blast\n from no_in_Nodes have \"repc no \\ repc `Nodes (n+1) ll\"\n by blast\n with repc_Nodes_subset lnort_in_repcNodes rnort_in_repcNodes \n show \"set_of (Node lnort (repc no) rnort) \\ \n repc `Nodes (n + 1) ll\"\n apply simp\n apply blast\n done\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume cong_rno_rnor: \" rnobdt \\ rnorbdt\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume \"\\ Suc 0 < var no\"\n then have varnoseq1: \"var no = 0 \\ var no = 1\" by auto\n show \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt \\ \n (\\norbdt. bdt (Node lnort (repc no) rnort) var = Some norbdt \\ \n nobdt \\ norbdt)\"\n proof (cases \"var no = 0\")\n case True\n note vnoNull=this\n with pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n show ?thesis\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n next\n assume \"var no \\ 0\"\n with varnoseq1 have vnoOne: \"var no = 1\" by simp\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n vnoOne \n have vlvrNull: \"var (low no) = 0 \\ var (high no) = 0\"\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n then have vlNull: \"var (low no) = 0\" by simp\n from vlvrNull have vrNull: \"var (high no) = 0\" by simp\n from lnobdt_def lnot_dag vlNull lno_nNull \n have lnobdt_Zero: \"lnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from rnobdt_def rnot_dag vrNull hno_nNull \n have rnobdt_Zero: \"rnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from lnobdt_Zero lnobdt_def \n have \"bdt lnot var = Some Zero\" by simp\n with lnot_dag vlNull \n have lnot_Node: \"lnot = (Node Tip (low no) Tip)\"\n by auto\n from rnobdt_Zero rnobdt_def rnot_dag vrNull \n have rnot_Node: \"rnot = (Node Tip (high no) Tip)\" \n by auto\n from pret_dag no_in_pret obtain not \n where not_ex: \"Dag no low high not\"\n apply -\n apply (drule dag_setof_exD)\n apply auto\n done\n with pret_dag no_in_pret have not_ex_in_pret: \"not <= pret\" \n apply -\n apply (rule set_of_subdag)\n apply auto\n done\n from not_ex lnot_dag rnot_dag nonNull \n have not_def: \"not = (Node lnot no rnot)\" \n by (simp add: Dag_unique del: Dag_Ref)\n with not_ex_in_pret prebdt_pret \n have nobdt_ex: \"\\ nobdt. bdt (Node lnot no rnot) var = Some nobdt\"\n apply -\n apply (rule subbdt_ex)\n apply auto\n done\n then obtain nobdt where \n nobdt_def: \"bdt (Node lnot no rnot) var = Some nobdt\" by auto\n from not_def have \"root not = no\" by simp\n with nobdt_def vnoOne not_def \n have \"not = (Node Tip no Tip)\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with not_def have \"rnot = Tip\" by simp\n with rnot_Node show ?thesis by simp\n qed\n next\n fix lnot rnot lnobdt rnobdt\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \" Dag (high no) low high rnot\"\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume onesvarno: \" Suc 0 < var no\"\n with rnobdt_def lnot_dag rnot_dag lnobdt_def \n show \"bdt (Node lnot no rnot) var = \n Some (Bdt_Node lnobdt (var no) rnobdt)\" by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume lnorbdt_def: \"bdt lnort var = Some lnorbdt\"\n assume varno_bOne: \"Suc 0 < var no\"\n with varno have \"Suc 0 < n\" by simp\n with varrepno_n have \"Suc 0 < var (repc no)\" by simp\n with rnorbdt_def lnorbdt_def \n show \"bdt (Node lnort (repc no) rnort) var = \n Some (Bdt_Node lnorbdt (var (repc no)) rnorbdt)\"\n by simp\n next\n fix rnobdt lnobdt rnorbdt lnorbdt \n assume lcong_eval: \"lnobdt \\ lnorbdt\"\n assume rcong_eval: \" rnobdt \\ rnorbdt\"\n from varno varrepno_n have \"var (repc no) = var no\" by simp\n with lcong_eval rcong_eval \n show \"Bdt_Node lnobdt (var no) rnobdt \\ \n Bdt_Node lnorbdt (var (repc no)) rnorbdt\"\n apply (unfold cong_eval_def)\n apply (rule ext)\n by simp\n next\n fix rnot lnot rnort lnort\n assume lnort_repb: \"\\no\\set_of lnort. repb no = no\"\n assume rnort_repb: \"\\no\\set_of rnort. repb no = no\"\n assume rnort_in_repb_Nodesn: \"set_of rnort \\ repb ` Nodes n ll\"\n assume lnort_in_repb_Nodesn: \"set_of lnort \\ repb ` Nodes n ll\"\n from repbNodes_in_Nodes rnort_in_repb_Nodesn \n have rnort_in_Nodesn: \"set_of rnort \\ Nodes n ll\"\n by blast\n from repbNodes_in_Nodes lnort_in_repb_Nodesn \n have lnort_in_Nodesn: \"set_of lnort \\ Nodes n ll\"\n by blast\n have rnort_repc: \"\\no\\set_of rnort. repc no = no\"\n proof\n fix pt\n assume pt_in_rnort: \" pt \\ set_of rnort\"\n with rnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with rnort_repb pt_in_rnort show \"repc pt = pt\"\n by auto\n qed\n have lnort_repc: \"\\no\\set_of lnort. repc no = no\"\n proof\n fix pt\n assume pt_in_lnort: \" pt \\ set_of lnort\"\n with lnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with lnort_repb pt_in_lnort show \"repc pt = pt\"\n by auto\n qed\n show \"\\no\\set_of (Node lnort (repc no) rnort). repc no = no\"\n proof\n fix pt\n assume pt_in_rept: \"pt \\ set_of (Node lnort (repc no) rnort)\"\n show \"repc pt = pt\"\n proof (cases \"pt \\ set_of lnort\")\n case True\n with lnort_repc show ?thesis\n by auto\n next\n assume pt_notin_lnort: \"pt \\ set_of lnort\"\n show ?thesis\n proof (cases \"pt \\ set_of rnort\")\n case True\n with rnort_repc show ?thesis\n by auto\n next \n assume pt_notin_rnort: \"pt \\ set_of rnort\"\n with pt_notin_lnort pt_in_rept have \"pt = repc no\"\n by simp\n with rrno_eq_rno show \"repc pt = pt\"\n by simp\n qed\n qed\n qed\n qed\n \n with varrep rrno_eq_rno show ?thesis by simp\n qed\n qed\n with rnonN show ?thesis by simp\n qed\n qed\n note while_while_prop=this\n from wf_ll nsll \n have \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n then have repcNodes_repbNodes: \n \"repc `(Nodes n ll) = repb `(Nodes n ll)\"\n by simp\n have repbc_dags_eq: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply rule\n apply rule\n apply (erule Dags.cases)\n apply (rule DagsI)\n prefer 4\n apply rule\n apply (erule Dags.cases)\n apply (rule DagsI)\n proof -\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes n ll\"\n assume x_t: \"x=t\"\n with t_in_repcNodes repcNodes_repbNodes \n show \"set_of x \\ repb ` Nodes n ll\" \n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes n ll\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume x_t: \"x=t\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodes t_dag t_nTip t_Node obtain q where \n rq_p: \"repc q = p\" and q_in_Nodes: \"q \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n from q_in_Nodes have \"repb q = repc q\"\n by (rule Nodes_n_rep_nc [rule_format])\n with rq_p have repbq_p: \"repb q = p\" by simp\n from q_in_Nodes \n have \"Dag (repb q) (repb \\ low) (repb \\ high) t = \n Dag (repc q) (repc \\ low) (repc \\ high) t\"\n by (rule Nodes_repbc_Dags_eq [rule_format])\n with t_dag rq_p have \"Dag (repb q) (repb \\ low) (repb \\ high) t\" by simp\n with repbq_p x_t show \"Dag p (repb \\ low) (repb \\ high) x\"\n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repb ` Nodes n ll\"\n assume x_t: \"x=t\"\n with t_in_repcNodes repbNodes_repcNodes \n show \"set_of x \\ repc ` Nodes n ll\" \n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repb ` Nodes n ll\"\n assume t_dag: \"Dag p (repb \\ low) (repb \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume x_t: \"x=t\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodes t_dag t_nTip t_Node obtain q where \n rq_p: \"repb q = p\" and q_in_Nodes: \"q \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n from q_in_Nodes have \"repb q = repc q\"\n by (rule Nodes_n_rep_nc [rule_format])\n with rq_p have repbq_p: \"repc q = p\" by simp\n from q_in_Nodes \n have \"Dag (repb q) (repb \\ low) (repb \\ high) t = \n Dag (repc q) (repc \\ low) (repc \\ high) t\"\n by (rule Nodes_repbc_Dags_eq [rule_format])\n with t_dag rq_p have \"Dag (repc q) (repc \\ low) (repc \\ high) t\" by simp\n with repbq_p x_t show \"Dag p (repc \\ low) (repc \\ high) x\"\n by simp\n next\n fix x p and t :: \"dag\"\n assume x_t: \"x = t\"\n assume t_nTip: \" t \\ Tip\"\n with x_t show \"x\\ Tip\" by simp\n next\n fix x p and t :: \"dag\"\n assume x_t: \"x = t\"\n assume t_nTip: \" t \\ Tip\"\n with x_t show \"x\\ Tip\" by simp\n qed\n from pret_dag wf_ll nsll \n have null_notin_Nodes_Suc_n: \"Null \\ Nodes (Suc n) ll\"\n by - (rule Null_notin_Nodes,auto simp add: length_ll_eq)\n { fix t1 t2\n assume t1_in_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repbc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n from t1_in_DagsNodesn repbc_Dags \n have t1_repb_subnode: \n \"t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\" \n by simp\n from t2_in_DagsNodesSucn \n have t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\" \n by simp\n from repbNodes_in_Nodes repbNodes_repcNodes \n have repcNodesn_in_Nodesn: \"repc `Nodes n ll \\ Nodes n ll\"\n by simp\n from t1_in_DagsNodesn obtain q where \n Dag_q_Nodes_n: \n \"Dag (repc q) (repc \\ low) (repc \\ high) t1 \\ q \\ Nodes n ll\"\n proof (elim Dags.cases)\n fix p t\n assume t1_t: \"t1 = t\"\n assume t_in_repcNodesn: \"set_of t \\ repc ` Nodes n ll\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume obtain_prop: \"\\q. Dag (repc q) (repc \\ low) (repc \\ high) t1 \\ \n q \\ Nodes n ll \\ ?thesis\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodesn t_dag t_nTip t_Node obtain k where \n rk_p: \"repc k = p\" and k_in_Nodes: \"k \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n with t1_t t_dag obtain_prop rk_p k_in_Nodes show ?thesis\n by auto\n qed\n with wf_ll nsll have varq_sn: \"(var q < n)\" \n apply (simp add: Nodes_def)\n apply (elim conjE)\n apply (erule exE)\n apply (simp add: wf_ll_def length_ll_eq)\n apply (elim conjE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule_tac x=x in allE)\n apply auto\n done\n from Dag_q_Nodes_n have q_in_Nodesn: \"q \\ Nodes n ll\"\n by simp\n then have \"\\ k set (ll ! k)\"\n by (simp add: Nodes_def)\n with wf_ll nsll have \"q \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repbc_q: \"repc q = repb q\"\n apply -\n apply (erule_tac x=q in allE)\n apply auto\n done\n from normalize_prop q_in_Nodesn have \"var (repb q) <= var q\"\n apply -\n apply (erule_tac x=q in ballE)\n apply auto\n done\n with repbc_q have var_repc_q: \"var (repc q) <= var q\"\n by simp\n with varq_sn have var_repc_q_n: \"var (repc q) < n\"\n by simp\n \n from Nodes_subset Dag_q_Nodes_n while_while_prop \n have ord_t1_var_rep: \"ordered t1 var \\ var (repc q) <= var q\" \n apply (elim conjE)\n apply (erule_tac x=q in ballE)\n apply auto\n done\n then have ord_t1: \"ordered t1 var\" by simp\n from ord_t1_var_rep have varrep_q: \"var (repc q) <= var q\" by simp\n from t2_in_DagsNodesSucn have ord_t2: \"ordered t2 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t2 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes have x_in_repcNodesSucn: \n \"\\x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where repca_p: \"p=repc a\" and \n a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from while_while_prop have while_prop_part: \n \"\\no \\ Nodes (Suc n) ll. \n var (repc no) <= var no\"\n by auto\n from while_while_prop have rep_rep_nort: \n \"\\no\\Nodes (n + 1) ll. (\\nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\ \n (\\no\\set_of nort. repc no = no))\"\n by auto\n from repcNodes_in_Nodes null_notin_Nodes_Suc_n \n have \"\\no \\ Nodes (n+1) ll. repc no \\ Null\"\n by auto\n with rep_rep_nort have \"\\ no \\ Nodes (n+1) ll. repc (repc no) = (repc no)\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in ballE)\n apply (erule exE)\n apply (subgoal_tac \"repc no \\ set_of nort\")\n apply (elim conjE)\n apply (erule_tac x=\"repc no\" in ballE)\n apply simp\n apply simp\n apply (simp)\n apply (elim conjE)\n apply (thin_tac \"\\no\\set_of nort. repc no = no\")\n apply auto\n done\n with t2_in_DagsNodesSucn t2_notin_DagsNodesn ord_t2 while_prop_part \n wf_ll nsll repcNodes_in_Nodes obtain a where\n t2_repc_dag: \"Dag (repc a) (repc \\ low) (repc \\ high) t2\" and\n a_in_lln: \"a \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a_in_pret: \"a \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a_in_lln have vara_n: \"var a = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a_in_lln rep_prop obtain\n repp_nNull: \" repc a \\ Null\" and\n repp_reduce: \"(repc \\ low) a = (repc \\ high) a \\ low a \\ Null \n \\ repc a = (repc \\ high) a\" and\n repp_share: \"((repc \\ low) a = (repc \\ high) a \\ low a = Null) \n \\ repc a \\ set (ll ! n) \\\n repc (repc a) = repc a \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a \\ \n (repc \\ low) no1 = (repc \\ low) a) = (repc a = repc no1))\"\n using [[simp_depth_limit=4]]\n by auto\n from t2_repc_dag a_in_lln repp_nNull obtain lt2 rt2 where \n t2_Node: \"t2 = (Node lt2 (repc a) rt2)\"\n by auto\n have \"isomorphic_dags_eq t1 t2 var\"\n proof (cases \"(repc \\ low) a = (repc \\ high) a \\ low a \\ Null\")\n case True\n note red=this\n then have red_case: \"(repc \\ low) a = (repc \\ high) a\"\n by simp\n from red have low_nNull: \"low a \\ Null\"\n by simp\n with pret_dag prebdt_pret a_in_pret have highp_nNull: \"high a \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a_in_pret low_nNull highp_nNull \n have var_children_smaller: \"var (low a) < var a \\ var (high a) < var a\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a_in_pret have a_nNull: \"a \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a_in_pret highp_nNull pret_dag have \"high a \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a \\ set (ll ! (var (high a)))\" \n by (simp add: wf_ll_def)\n with a_in_lln t2_repc_dag var_children_smaller vara_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha_in_Nodesn: \"(high a) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha_in_rNodesn: \"repc (high a) \\ repc ` Nodes n ll\"\n by simp\n from higha_in_Nodesn normalize_prop obtain rt where \n rt_dag: \"Dag (repb (high a)) (repb \\ low) (repb \\ high) rt\" and\n rt_in_repbNort: \"set_of rt \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a\" in ballE)\n apply auto\n done\n from rt_in_repbNort repbNodes_repcNodes \n have rt_in_repcNodesn: \"set_of rt \\ repc `Nodes n ll\"\n by blast\n from rt_dag higha_in_Nodesn \n have repcrt_dag: \"Dag (repc (high a)) (repc \\ low) (repc \\ high) rt\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt_nTip: \"rt \\ Tip\"\n proof -\n have \"repc (high a) \\ Null\"\n proof -\n note rhigha_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt_dag show ?thesis by auto\n qed\n from a_nNull a_in_pret low_nNull pret_dag have \"low a \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \"low a \\ set (ll ! (var (low a)))\" \n by (simp add: wf_ll_def)\n with a_in_lln t2_repc_dag var_children_smaller vara_n \n have \"\\k set (ll ! k)\"\n by auto\n then have \"(low a) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlow_in_rNodesn: \"repc (low a) \\ repc ` Nodes n ll\"\n by simp\n show ?thesis\n proof -\n from repp_reduce low_nNull highp_nNull red_case \n have repc_p_def: \"repc a = repc (high a)\" \n by (simp add: null_comp_def)\n with rt_in_repcNodesn repcrt_dag rhigha_in_rNodesn a_in_lln t2_repc_dag\n repc_p_def rt_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt\")\n apply (auto simp add: Dag_unique)\n done\n from t1_in_DagsNodesn t2_in_Dags_Nodesn repbc_dags_eq isomorphic_dags_eq_asm \n show shared_t1_t2: \"isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (erule_tac x=t1 in allE)\n apply (erule_tac x=t2 in allE)\n apply simp\n done\n qed\n next\n assume share: \" \\ ((repc \\ low) a = (repc \\ high) a \\ low a \\ Null)\"\n then\n have share: \"(repc \\ low) a \\ (repc \\ high) a \\ low a = Null\"\n using [[simp_depth_limit=1]]\n by simp\n with repp_share obtain \n ra_in_llbn: \"repc a \\ set (ll ! n)\" and \n rra_ra: \"repc (repc a) = repc a\" and\n two_nodes_share: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) a \\ \n (repc \\ low) no1 = (repc \\ low) a) = (repc a = repc no1))\"\n using [[simp_depth_limit=3]]\n by simp\n from wf_ll ra_in_llbn nsll have var_repc_a_n: \"var (repc a) = n\" \n by (auto simp add: wf_ll_def length_ll_eq)\n show ?thesis\n proof (auto simp add: isomorphic_dags_eq_def)\n fix bdt1\n assume bdt_t1: \"bdt t1 var = Some bdt1\"\n assume bdt_t2: \"bdt t2 var = Some bdt1\"\n show \"t1 = t2\"\n proof (cases t1)\n case Tip\n with bdt_t1 show ?thesis\n by simp\n next\n case (Node lt1 p1 rt1)\n note t1_Node=this\n with Dag_q_Nodes_n have \"p1=(repc q)\"\n by simp\n with t2_Node bdt_t1 bdt_t2 t1_Node have \"var (repc q) = var (repc a)\"\n apply -\n apply (rule same_bdt_var)\n apply auto\n done\n with var_repc_q_n var_repc_a_n show ?thesis\n by simp\n qed\n qed\n qed }\n note mixed_Dags_case = this\n from repbc_dags_eq isomorphic_dags_eq \n have dags_shared: \n \"\\t1 t2. t1 \\ Dags (repc ` Nodes (Suc n) ll)(repc \\ low)(repc \\ high)\\\n t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (rule Dags_Nodes_cases)\n apply (rule isomorphic_dags_eq_sym)\n proof -\n fix t1 t2\n assume t1_in_Dagsn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_Dagsn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repb_repc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n with t1_in_Dagsn t2_in_Dagsn isomorphic_dags_eq_asm \n show \"isomorphic_dags_eq t1 t2 var\" by simp\n next\n fix t1 t2\n assume t1_in_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repbc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n from t1_in_DagsNodesn t2_notin_DagsNodesn t2_in_DagsNodesSucn \n isomorphic_dags_eq_asm repbc_Dags\n show \"isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n next\n fix t1 t2\n assume t1_in_DagsNodesSucn: \n \"t1 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume t1_notin_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n \n \n (* ab hier gehts um t1 *)\n from t1_in_DagsNodesSucn have ord_t1: \"ordered t1 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t1 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes \n have x_in_repcNodesSucn: \n \"\\ x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where \n repca_p: \"p=repc a\" and a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from while_while_prop \n have while_prop_part: \"\\no \\ Nodes (Suc n) ll. \n var (repc no) <= var no\"\n by auto\n from while_while_prop have rep_rep_nort: \n \"\\no\\Nodes (n + 1) ll. \n (\\nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\ \n (\\no\\set_of nort. repc no = no))\"\n by auto\n from repcNodes_in_Nodes null_notin_Nodes_Suc_n \n have \"\\ no \\ Nodes (n+1) ll. repc no \\ Null\"\n by auto\n with rep_rep_nort \n have rep_rep_no: \"\\no \\ Nodes (n+1) ll. repc (repc no) = (repc no)\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in ballE)\n apply (erule exE)\n apply (subgoal_tac \"repc no \\ set_of nort\")\n apply (elim conjE)\n apply (erule_tac x=\"repc no\" in ballE)\n apply simp\n apply simp\n apply (simp)\n apply (elim conjE)\n apply (thin_tac \"\\no\\set_of nort. repc no = no\")\n apply auto\n done\n with t1_in_DagsNodesSucn t1_notin_DagsNodesn ord_t1 while_prop_part wf_ll \n nsll repcNodes_in_Nodes obtain a1 where\n t1_repc_dag: \"Dag (repc a1) (repc \\ low) (repc \\ high) t1\" and\n a1_in_lln: \"a1 \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a1_in_pret: \"a1 \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a1_in_lln have vara1_n: \"var a1 = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a1_in_lln rep_prop obtain\n repa1_nNull: \" repc a1 \\ Null\" and\n repa1_reduce: \"(repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null \n \\ repc a1 = (repc \\ high) a1\" and\n repa1_share: \"((repc \\ low) a1 = (repc \\ high) a1 \\ low a1 = Null) \n \\ repc a1 \\ set (ll ! n) \\ repc (repc a1) = repc a1 \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a1 \\ \n (repc \\ low) no1 = (repc \\ low) a1) = (repc a1 = repc no1))\"\n using [[simp_depth_limit=4]]\n by auto\n from t1_repc_dag a1_in_lln repa1_nNull obtain lt1 rt1 where \n t1_Node: \"t1 = (Node lt1 (repc a1) rt1)\"\n by auto\n\n\n\n (* ab hier gehts um t2 *)\n from t2_in_DagsNodesSucn have ord_t2: \"ordered t2 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t2 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes \n have x_in_repcNodesSucn: \n \"\\ x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where \n repca_p: \"p=repc a\" and a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from rep_rep_no t2_in_DagsNodesSucn t2_notin_DagsNodesn ord_t2 while_prop_part wf_ll \n nsll repcNodes_in_Nodes obtain a2 where\n t2_repc_dag: \"Dag (repc a2) (repc \\ low) (repc \\ high) t2\" and\n a2_in_lln: \"a2 \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a2_in_pret: \"a2 \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a2_in_lln have vara2_n: \"var a2 = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a2_in_lln rep_prop obtain\n repa2_nNull: \" repc a2 \\ Null\" and\n repa2_reduce: \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null \n \\ repc a2 = (repc \\ high) a2\" and\n repa2_share: \"((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 = Null) \n \\ repc a2 \\ set (ll ! n) \\ repc (repc a2) = repc a2 \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a2 \\ \n (repc \\ low) no1 = (repc \\ low) a2) = (repc a2 = repc no1))\"\n using [[simp_depth_limit = 4]]\n by auto\n from t2_repc_dag a2_in_lln repa2_nNull obtain lt2 rt2 where \n t2_Node: \"t2 = (Node lt2 (repc a2) rt2)\"\n by auto\n show \"isomorphic_dags_eq t1 t2 var\"\n proof (cases \"(repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null\")\n case True\n note t1_red_cond=this \n with t1_red_cond have t1_red_case: \"(repc \\ low) a1 = (repc \\ high) a1\"\n by simp\n from t1_red_cond have lowa1_nNull: \"low a1 \\ Null\"\n by simp\n with pret_dag prebdt_pret a1_in_pret have higha1_nNull: \"high a1 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a1_in_pret lowa1_nNull higha1_nNull \n have var_children_smaller_a1: \"var (low a1) < var a1 \\ var (high a1) < var a1\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a1_in_pret have a1_nNull: \"a1 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a1_in_pret higha1_nNull pret_dag have \"high a1 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a1 \\ set (ll ! (var (high a1)))\" \n by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\k set (ll ! k)\"\n by auto\n then have higha1_in_Nodesn: \"(high a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha1_in_rNodesn: \"repc (high a1) \\ repc ` Nodes n ll\"\n by simp\n from higha1_in_Nodesn normalize_prop obtain rt1 where \n rt1_dag: \"Dag (repb (high a1)) (repb \\ low) (repb \\ high) rt1\" and\n rt1_in_repbNort: \"set_of rt1 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a1\" in ballE)\n apply auto\n done\n from rt1_in_repbNort repbNodes_repcNodes \n have rt1_in_repcNodesn: \"set_of rt1 \\ repc `Nodes n ll\"\n by blast\n from rt1_dag higha1_in_Nodesn \n have repcrt1_dag: \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt1_nTip: \"rt1 \\ Tip\"\n proof -\n have \"repc (high a1) \\ Null\"\n proof -\n note rhigha1_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt1_dag show ?thesis by auto\n qed\n from repa1_reduce lowa1_nNull higha1_nNull t1_red_case \n have repc_a1_def: \"repc a1 = repc (high a1)\" \n by (simp add: null_comp_def)\n with rt1_in_repcNodesn repcrt1_dag rhigha1_in_rNodesn a1_in_lln \n t1_repc_dag repc_a1_def rt1_nTip \n have t1_in_Dags_Nodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t1=rt1\")\n apply (auto simp add: Dag_unique)\n done\n show ?thesis\n proof (cases \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null\")\n case True\n note t2_red_cond=this \n with t2_red_cond have t2_red_case: \"(repc \\ low) a2 = (repc \\ high) a2\"\n by simp\n from t2_red_cond have lowa2_nNull: \"low a2 \\ Null\"\n by simp\n with pret_dag prebdt_pret a2_in_pret have higha2_nNull: \"high a2 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a2_in_pret lowa2_nNull higha2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a2_in_pret higha2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2 where \n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2\" and\n rt2_in_repbNort: \"set_of rt2 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2 \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag show ?thesis by auto\n qed\n from repa2_reduce lowa2_nNull higha2_nNull t2_red_case \n have repc_a2_def: \"repc a2 = repc (high a2)\" \n by (simp add: null_comp_def)\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag repc_a2_def rt2_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt2\")\n apply (auto simp add: Dag_unique)\n done\n from isomorphic_dags_eq t1_in_Dags_Nodesn t2_in_Dags_Nodesn repbc_dags_eq \n show ?thesis\n by auto\n next\n assume t2_share_cond: \n \"\\ ((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null)\"\n from t1_in_Dags_Nodesn t2_notin_DagsNodesn t2_in_DagsNodesSucn \n isomorphic_dags_eq repbc_dags_eq\n show ?thesis\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n qed\n next\n assume t1_share_cond: \n \"\\((repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null)\"\n with repa1_share obtain\n repca1_in_llbn: \"repc a1 \\ set (ll ! n)\" and \n reprepa1: \"repc (repc a1) = repc a1\" and\n twonodes_llbn_a1: \n \"(\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a1 \\ \n (repc \\ low) no1 = (repc \\ low) a1) = (repc a1 = repc no1))\"\n using [[simp_depth_limit=2]]\n by auto\n show ?thesis\n proof (cases \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null\")\n case True\n note t2_red_cond=this \n with t2_red_cond have t2_red_case: \"(repc \\ low) a2 = (repc \\ high) a2\"\n by simp\n from t2_red_cond have lowa2_nNull: \"low a2 \\ Null\"\n by simp\n with pret_dag prebdt_pret a2_in_pret have higha2_nNull: \"high a2 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a2_in_pret lowa2_nNull higha2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a2_in_pret higha2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll \n have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2 where \n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2\" and\n rt2_in_repbNort: \"set_of rt2 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2 \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag show ?thesis by auto\n qed\n from repa2_reduce lowa2_nNull higha2_nNull t2_red_case \n have repc_a2_def: \"repc a2 = repc (high a2)\" \n by (simp add: null_comp_def)\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag repc_a2_def rt2_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt2\")\n apply (auto simp add: Dag_unique)\n done\n from t2_in_Dags_Nodesn t1_notin_DagsNodesn t1_in_DagsNodesSucn \n isomorphic_dags_eq repbc_dags_eq \n have \"isomorphic_dags_eq t2 t1 var\"\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n then show ?thesis\n by (simp add: isomorphic_dags_eq_sym)\n next\n assume t2_shared_cond: \n \"\\ ((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null)\"\n with repa2_share obtain\n repca2_in_llbn: \"repc a2 \\ set (ll ! n)\" and \n reprepa2: \"repc (repc a2) = repc a2\" and\n twonodes_llbn_a2: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) a2 \\ \n (repc \\ low) no1 = (repc \\ low) a2) = (repc a2 = repc no1))\"\n using [[simp_depth_limit=2]]\n by auto \n from twonodes_llbn_a2 a1_in_lln \n have share_a1_a2: \n \"((repc \\ high) a1 = (repc \\ high) a2 \\ \n (repc \\ low) a1 = (repc \\ low) a2) = (repc a2 = repc a1)\"\n by auto\n from twonodes_llbn_a1 repca1_in_llbn reprepa1 \n have children_repc_eq_a1: \"(repc \\ high) (repc a1) = (repc \\ high) a1 \\ \n (repc \\ low) (repc a1) = (repc \\ low) a1\"\n by auto\n from twonodes_llbn_a2 repca2_in_llbn reprepa2 \n have children_repc_eq_a2: \"(repc \\ high) (repc a2) = (repc \\ high) a2 \\ \n (repc \\ low) (repc a2) = (repc \\ low) a2\"\n by auto\n from t1_Node t2_Node show ?thesis\n proof (clarsimp simp add: isomorphic_dags_eq_def)\n fix bdt1\n assume t1_bdt: \"bdt (Node lt1 (repc a1) rt1) var = Some bdt1\"\n assume t2_bdt: \"bdt (Node lt2 (repc a2) rt2) var = Some bdt1\"\n show \"lt1 = lt2 \\ repc a1 = repc a2 \\ rt1 = rt2\"\n proof (cases bdt1)\n case Zero\n with t1_bdt t1_Node obtain\n lt1_Tip: \"lt1 = Tip\" and\n rt1_Tip: \"rt1 = Tip\"\n by simp\n from Zero t2_bdt t2_Node obtain \n lt2_Tip: \"lt2 = Tip\" and\n rt2_Tip: \"rt2 = Tip\"\n by simp\n from t1_repc_dag t1_Node lt1_Tip have \"(repc \\ low) (repc a1) = Null\" \n by simp\n with children_repc_eq_a1 \n have repc_low_a1_Null: \"(repc \\ low) a1 = Null\"\n by simp\n from t1_repc_dag t1_Node rt1_Tip \n have \"(repc \\ high) (repc a1) = Null\"\n by simp\n with children_repc_eq_a1 \n have repc_high_a1_Null: \"(repc \\ high) a1 = Null\"\n by simp\n from t2_repc_dag t2_Node lt2_Tip have \"(repc \\ low) (repc a2) = Null\" \n by simp\n with children_repc_eq_a2 \n have repc_low_a2_Null: \"(repc \\ low) a2 = Null\"\n by simp\n from t2_repc_dag t2_Node rt2_Tip \n have \"(repc \\ high) (repc a2) = Null\"\n by simp\n with children_repc_eq_a2 \n have repc_high_a2_Null: \"(repc \\ high) a2 = Null\"\n by simp\n with share_a1_a2 repc_low_a1_Null repc_high_a1_Null \n repc_low_a2_Null repc_high_a2_Null\n have \"repc a2 = repc a1\"\n by auto\n with lt1_Tip rt1_Tip lt2_Tip rt2_Tip show ?thesis\n by auto\n next\n case One\n with t1_bdt t1_Node obtain\n lt1_Tip: \"lt1 = Tip\" and\n rt1_Tip: \"rt1 = Tip\"\n by simp\n from One t2_bdt t2_Node obtain \n lt2_Tip: \"lt2 = Tip\" and\n rt2_Tip: \"rt2 = Tip\"\n by simp\n from t1_repc_dag t1_Node lt1_Tip have \"(repc \\ low) (repc a1) = Null\" \n by simp\n with children_repc_eq_a1 \n have repc_low_a1_Null: \"(repc \\ low) a1 = Null\"\n by simp\n from t1_repc_dag t1_Node rt1_Tip have \"(repc \\ high) (repc a1) = Null\"\n by simp\n with children_repc_eq_a1 \n have repc_high_a1_Null: \"(repc \\ high) a1 = Null\"\n by simp\n from t2_repc_dag t2_Node lt2_Tip have \"(repc \\ low) (repc a2) = Null\" \n by simp\n with children_repc_eq_a2 \n have repc_low_a2_Null: \"(repc \\ low) a2 = Null\"\n by simp\n from t2_repc_dag t2_Node rt2_Tip have \"(repc \\ high) (repc a2) = Null\"\n by simp\n with children_repc_eq_a2 \n have repc_high_a2_Null: \"(repc \\ high) a2 = Null\"\n by simp\n with share_a1_a2 repc_low_a1_Null repc_high_a1_Null \n repc_low_a2_Null repc_high_a2_Null\n have \"repc a2 = repc a1\"\n by auto\n with lt1_Tip rt1_Tip lt2_Tip rt2_Tip show ?thesis\n by auto\n next\n case (Bdt_Node lbdt v rbdt)\n note bdt_Node_case=this\n with t1_bdt t1_Node obtain\n lbdt_def_lt1: \"bdt lt1 var = Some lbdt\" and\n rbdt_def_rt1: \"bdt rt1 var = Some rbdt\"\n by auto\n from t2_bdt bdt_Node_case t2_Node obtain\n lbdt_def_lt2: \"bdt lt2 var = Some lbdt\" and\n rbdt_def_rt2: \"bdt rt2 var = Some rbdt\"\n by auto\n from lbdt_def_lt1 t1_Node t1_repc_dag children_repc_eq_a1 \n have \"(repc \\ low) a1 \\ Null\"\n by auto\n then have low_a1_nNull: \"(low a1) \\ Null\" \n by (auto simp: null_comp_def)\n from rbdt_def_rt1 t1_Node t1_repc_dag children_repc_eq_a1 \n have \"(repc \\ high) a1 \\ Null\"\n by auto\n then have high_a1_nNull: \"(high a1) \\ Null\" \n by (auto simp: null_comp_def)\n from lbdt_def_lt2 t2_Node t2_repc_dag children_repc_eq_a2 \n have \"(repc \\ low) a2 \\ Null\"\n by auto\n then have low_a2_nNull: \"(low a2) \\ Null\" \n by (auto simp: null_comp_def)\n from rbdt_def_rt2 t2_Node t2_repc_dag children_repc_eq_a2 \n have \"(repc \\ high) a2 \\ Null\"\n by auto\n then have high_a2_nNull: \"(high a2) \\ Null\" \n by (auto simp: null_comp_def)\n\n (*hier gehts um t1*)\n from pret_dag ord_pret a1_in_pret low_a1_nNull high_a1_nNull \n have var_children_smaller_a1: \n \"var (low a1) < var a1 \\ var (high a1) < var a1\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a1_in_pret have a1_nNull: \"a1 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n \n (*hier gehts um rt1 *)\n with a1_in_pret high_a1_nNull pret_dag have \"high a1 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll \n have \"high a1 \\ set (ll ! (var (high a1)))\" \n by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha1_in_Nodesn: \"(high a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha1_in_rNodesn: \n \"repc (high a1) \\ repc ` Nodes n ll\"\n by simp\n from higha1_in_Nodesn normalize_prop obtain rt1h where\n rt1_dag: \"Dag (repb (high a1)) (repb \\ low) (repb \\ high) rt1h\" and\n rt1_in_repbNort: \"set_of rt1h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a1\" in ballE)\n apply auto\n done\n from rt1_in_repbNort repbNodes_repcNodes \n have rt1_in_repcNodesn: \"set_of rt1h \\ repc `Nodes n ll\"\n by blast\n from rt1_dag higha1_in_Nodesn \n have repcrt1_dag: \n \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t1_Node t1_repc_dag high_a1_nNull children_repc_eq_a1 \n have \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1\"\n by (auto simp add: null_comp_def)\n with repcrt1_dag have rt1h_rt1: \"rt1h = rt1\" by (simp add: Dag_unique)\n have rt1_nTip: \"rt1 \\ Tip\"\n proof -\n have \"repc (high a1) \\ Null\"\n proof -\n note rhigha1_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt1_dag rt1h_rt1 show ?thesis by auto\n qed\n with rt1_in_repcNodesn repcrt1_dag rhigha1_in_rNodesn a1_in_lln \n t1_repc_dag rt1h_rt1 \n have rt1_in_Dags_Nodesn: \n \"rt1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n\n \n (*hier gehts um lt1 *)\n from a1_nNull a1_in_pret low_a1_nNull pret_dag \n have \"low a1 \\ set_of pret\"\n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \n \"low a1 \\ set (ll ! (var (low a1)))\" by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have lowa1_in_Nodesn: \"(low a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlowa1_in_rNodesn: \"repc (low a1) \\ repc ` Nodes n ll\"\n by simp\n from lowa1_in_Nodesn normalize_prop obtain lt1h where\n lt1_dag: \"Dag (repb (low a1)) (repb \\ low) (repb \\ high) lt1h\" and\n lt1_in_repbNort: \"set_of lt1h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"low a1\" in ballE)\n apply auto\n done\n from lt1_in_repbNort repbNodes_repcNodes \n have lt1_in_repcNodesn: \"set_of lt1h \\ repc `Nodes n ll\"\n by blast\n from lt1_dag lowa1_in_Nodesn \n have repclt1_dag: \"Dag (repc (low a1)) (repc \\ low) (repc \\ high) lt1h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t1_Node t1_repc_dag low_a1_nNull children_repc_eq_a1 \n have \"Dag (repc (low a1)) (repc \\ low) (repc \\ high) lt1\"\n by (auto simp add: null_comp_def)\n with repclt1_dag have lt1h_lt1: \"lt1h = lt1\" by (simp add: Dag_unique)\n have lt1_nTip: \"lt1 \\ Tip\"\n proof -\n have \"repc (low a1) \\ Null\"\n proof -\n note rlowa1_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repclt1_dag lt1h_lt1 show ?thesis by auto\n qed\n with lt1_in_repcNodesn repclt1_dag rlowa1_in_rNodesn a1_in_lln \n t1_repc_dag lt1h_lt1 \n have lt1_in_Dags_Nodesn: \n \"lt1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n \n \n (*hier gehts um t2*)\n from pret_dag ord_pret a2_in_pret low_a2_nNull high_a2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n \n (*hier gehts um rt1 *)\n with a2_in_pret high_a2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \n \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2h where\n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2h\" and\n rt2_in_repbNort: \"set_of rt2h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2h \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \n \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t2_Node t2_repc_dag high_a2_nNull children_repc_eq_a2 \n have \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n by (auto simp add: null_comp_def)\n with repcrt2_dag have rt2h_rt2: \"rt2h = rt2\" by (simp add: Dag_unique)\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag rt2h_rt2 show ?thesis by auto\n qed\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag rt2h_rt2 \n have rt2_in_Dags_Nodesn: \n \"rt2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n\n \n (*hier gehts um lt2 *)\n from a2_nNull a2_in_pret low_a2_nNull pret_dag \n have \"low a2 \\ set_of pret\"\n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \"low a2 \\ set (ll ! (var (low a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have lowa2_in_Nodesn: \"(low a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlowa2_in_rNodesn: \"repc (low a2) \\ repc ` Nodes n ll\"\n by simp\n from lowa2_in_Nodesn normalize_prop obtain lt2h where\n lt2_dag: \"Dag (repb (low a2)) (repb \\ low) (repb \\ high) lt2h\" and\n lt2_in_repbNort: \"set_of lt2h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"low a2\" in ballE)\n apply auto\n done\n from lt2_in_repbNort repbNodes_repcNodes \n have lt2_in_repcNodesn: \"set_of lt2h \\ repc `Nodes n ll\"\n by blast\n from lt2_dag lowa2_in_Nodesn \n have repclt2_dag: \"Dag (repc (low a2)) (repc \\ low) (repc \\ high) lt2h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t2_Node t2_repc_dag low_a2_nNull children_repc_eq_a2 \n have \"Dag (repc (low a2)) (repc \\ low) (repc \\ high) lt2\"\n by (auto simp add: null_comp_def)\n with repclt2_dag have lt2h_lt2: \"lt2h = lt2\" by (simp add: Dag_unique)\n have lt2_nTip: \"lt2 \\ Tip\"\n proof -\n have \"repc (low a2) \\ Null\"\n proof -\n note rlowa2_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repclt2_dag lt2h_lt2 show ?thesis by auto\n qed\n with lt2_in_repcNodesn repclt2_dag rlowa2_in_rNodesn a2_in_lln \n t2_repc_dag lt2h_lt2 \n have lt2_in_Dags_Nodesn: \n \"lt2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n \n \n from isomorphic_dags_eq lt1_in_Dags_Nodesn lt2_in_Dags_Nodesn repbc_dags_eq \n have shared_lt1_lt2: \"isomorphic_dags_eq lt1 lt2 var\"\n by auto\n from isomorphic_dags_eq rt1_in_Dags_Nodesn rt2_in_Dags_Nodesn repbc_dags_eq \n have shared_rt1_rt2: \"isomorphic_dags_eq rt1 rt2 var\"\n by auto\n \n from shared_lt1_lt2 lbdt_def_lt1 lbdt_def_lt2 have lt1_lt2: \"lt1 = lt2\"\n by (auto simp add: isomorphic_dags_eq_def)\n then have root_lt1_lt2: \"root lt1 = root lt2\"\n by auto\n from lt1_nTip t1_repc_dag t1_Node have \"(repc \\ low) (repc a1) \\ Null\"\n by auto\n with lt1_nTip t1_repc_dag t1_Node obtain llt1 lt1p rlt1 where \n lt1_Node: \"lt1 = Node llt1 lt1p rlt1\"\n by auto\n with t1_repc_dag t1_Node children_repc_eq_a1 lt1_nTip \n have root_lt1: \"root lt1 = (repc \\ low) a1\"\n by auto\n from lt2_nTip t2_repc_dag t2_Node have \"(repc \\ low) (repc a2) \\ Null\"\n by auto\n with lt2_nTip t2_repc_dag t2_Node obtain llt2 lt2p rlt2 where \n lt2_Node: \"lt2 = Node llt2 lt2p rlt2\"\n by auto\n with t2_repc_dag t2_Node children_repc_eq_a2 lt2_nTip \n have root_lt2: \"root lt2 = (repc \\ low) a2\"\n by auto\n from root_lt1_lt2 root_lt2 root_lt1 \n have low_a1_a2: \"(repc \\ low) a1 = (repc \\ low) a2\"\n by auto\n from shared_rt1_rt2 rbdt_def_rt1 rbdt_def_rt2 have rt1_rt2: \"rt1 = rt2\"\n by (auto simp add: isomorphic_dags_eq_def)\n then have root_rt1_rt2: \"root rt1 = root rt2\"\n by auto\n from rt1_nTip t1_repc_dag t1_Node have \"(repc \\ high) (repc a1) \\ Null\"\n by auto\n with rt1_nTip t1_repc_dag t1_Node obtain lrt1 rt1p rrt1 where \n rt1_Node: \"rt1 = Node lrt1 rt1p rrt1\"\n by auto\n with t1_repc_dag t1_Node children_repc_eq_a1 rt1_nTip \n have root_rt1: \"root rt1 = (repc \\ high) a1\"\n by auto\n from rt2_nTip t2_repc_dag t2_Node \n have \"(repc \\ high) (repc a2) \\ Null\"\n by auto\n with rt2_nTip t2_repc_dag t2_Node obtain lrt2 rt2p rrt2 where \n rt2_Node: \"rt2 = Node lrt2 rt2p rrt2\"\n by auto\n with t2_repc_dag t2_Node children_repc_eq_a2 rt2_nTip \n have root_rt2: \"root rt2 = (repc \\ high) a2\"\n by auto\n from root_rt1_rt2 root_rt2 root_rt1 \n have high_a1_a2: \"(repc \\ high) a1 = (repc \\ high) a2\"\n by auto\n from low_a1_a2 high_a1_a2 share_a1_a2 \n have \"repc a1 = repc a2\"\n by auto\n with lt1_lt2 rt1_rt2 show ?thesis\n by auto\n qed\n qed\n qed\n qed\n qed\n from termi dags_shared while_while_prop repcNodes_in_Nodes repc_nc n_var_prop \n wf_marking_m_ma \n show ?thesis\n by auto\n qed\n qed\n with srrl_precond all_nodes_same_var \n show ?thesis\n apply -\n apply (intro conjI)\n apply assumption+\n done\n qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BDD/NormalizeTotalProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2837317512729648}} {"text": "section \\Error monad\\\n\ntheory Error_Monad\nimports Monad_Plus\nbegin\n\nsubsection \\Type definition\\\n\ntycondef 'a\\'e error = Err (lazy \"'e\") | Ok (lazy \"'a\")\n\nlemma coerce_error_abs [simp]: \"coerce\\(error_abs\\x) = error_abs\\(coerce\\x)\"\napply (simp add: error_abs_def coerce_def)\napply (simp add: emb_prj_emb prj_emb_prj DEFL_eq_error)\ndone\n\nlemma coerce_Err [simp]: \"coerce\\(Err\\x) = Err\\(coerce\\x)\"\nunfolding Err_def by simp\n\nlemma coerce_Ok [simp]: \"coerce\\(Ok\\m) = Ok\\(coerce\\m)\"\nunfolding Ok_def by simp\n\nlemma fmapU_error_simps [simp]:\n \"fmapU\\f\\(\\::udom\\'a error) = \\\"\n \"fmapU\\f\\(Err\\e) = Err\\e\"\n \"fmapU\\f\\(Ok\\x) = Ok\\(f\\x)\"\nunfolding fmapU_error_def error_map_def fix_const\napply simp\napply (simp add: Err_def)\napply (simp add: Ok_def)\ndone\n\nsubsection \\Monad class instance\\\n\ninstantiation error :: (\"domain\") \"{monad, functor_plus}\"\nbegin\n\ndefinition\n \"returnU = Ok\"\n\nfixrec bindU_error :: \"udom\\'a error \\ (udom \\ udom\\'a error) \\ udom\\'a error\"\n where \"bindU_error\\(Err\\e)\\f = Err\\e\"\n | \"bindU_error\\(Ok\\x)\\f = f\\x\"\n\nlemma bindU_error_strict [simp]: \"bindU\\\\\\k = (\\::udom\\'a error)\"\nby fixrec_simp\n\nfixrec plusU_error :: \"udom\\'a error \\ udom\\'a error \\ udom\\'a error\"\n where \"plusU_error\\(Err\\e)\\f = f\"\n | \"plusU_error\\(Ok\\x)\\f = Ok\\x\"\n\nlemma plusU_error_strict [simp]: \"plusU\\(\\ :: udom\\'a error) = \\\"\nby fixrec_simp\n\ninstance proof\n fix f g :: \"udom \\ udom\" and r :: \"udom\\'a error\"\n show \"fmapU\\f\\(fmapU\\g\\r) = fmapU\\(\\ x. f\\(g\\x))\\r\"\n by (induct r rule: error.induct) simp_all\nnext\n fix f :: \"udom \\ udom\" and r :: \"udom\\'a error\"\n show \"fmapU\\f\\r = bindU\\r\\(\\ x. returnU\\(f\\x))\"\n by (induct r rule: error.induct)\n (simp_all add: returnU_error_def)\nnext\n fix f :: \"udom \\ udom\\'a error\" and x :: \"udom\"\n show \"bindU\\(returnU\\x)\\f = f\\x\"\n by (simp add: returnU_error_def)\nnext\n fix r :: \"udom\\'a error\" and f g :: \"udom \\ udom\\'a error\"\n show \"bindU\\(bindU\\r\\f)\\g = bindU\\r\\(\\ x. bindU\\(f\\x)\\g)\"\n by (induct r rule: error.induct)\n simp_all\nnext\n fix f :: \"udom \\ udom\" and a b :: \"udom\\'a error\"\n show \"fmapU\\f\\(plusU\\a\\b) = plusU\\(fmapU\\f\\a)\\(fmapU\\f\\b)\"\n by (induct a rule: error.induct) simp_all\nnext\n fix a b c :: \"udom\\'a error\"\n show \"plusU\\(plusU\\a\\b)\\c = plusU\\a\\(plusU\\b\\c)\"\n by (induct a rule: error.induct) simp_all\nqed\n\nend\n\nsubsection \\Transfer properties to polymorphic versions\\\n\nlemma fmap_error_simps [simp]:\n \"fmap\\f\\(\\::'a\\'e error) = \\\"\n \"fmap\\f\\(Err\\e :: 'a\\'e error) = Err\\e\"\n \"fmap\\f\\(Ok\\x :: 'a\\'e error) = Ok\\(f\\x)\"\nunfolding fmap_def [where 'f=\"'e error\"]\nby (simp_all add: coerce_simp)\n\nlemma return_error_def: \"return = Ok\"\nunfolding return_def returnU_error_def\nby (simp add: coerce_simp eta_cfun)\n\nlemma bind_error_simps [simp]:\n \"bind\\(\\ :: 'a\\'e error)\\f = \\\"\n \"bind\\(Err\\e :: 'a\\'e error)\\f = Err\\e\"\n \"bind\\(Ok\\x :: 'a\\'e error)\\f = f\\x\"\nunfolding bind_def\nby (simp_all add: coerce_simp)\n\nlemma join_error_simps [simp]:\n \"join\\\\ = (\\ :: 'a\\'e error)\"\n \"join\\(Err\\e) = Err\\e\"\n \"join\\(Ok\\x) = x\"\nunfolding join_def by simp_all\n\nlemma fplus_error_simps [simp]:\n \"fplus\\\\\\r = (\\ :: 'a\\'e error)\"\n \"fplus\\(Err\\e)\\r = r\"\n \"fplus\\(Ok\\x)\\r = Ok\\x\"\nunfolding fplus_def\nby (simp_all add: coerce_simp)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Tycon/Error_Monad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5544704649604274, "lm_q1q2_score": 0.2837317437382898}} {"text": "(*\n File: PAC_Checker_Relation.thy\n Author: Mathias Fleury, Daniela Kaufmann, JKU\n Maintainer: Mathias Fleury, JKU\n*)\ntheory PAC_Checker_Relation\n imports PAC_Checker WB_Sort \"Native_Word.Uint64\"\nbegin\n\nsection \\Various Refinement Relations\\\n\ntext \\When writing this, it was not possible to share the definition with the IsaSAT version.\\\ndefinition uint64_nat_rel :: \"(uint64 \\ nat) set\" where\n \\uint64_nat_rel = br nat_of_uint64 (\\_. True)\\\n\nabbreviation uint64_nat_assn where\n \\uint64_nat_assn \\ pure uint64_nat_rel\\\n\ninstantiation uint32 :: hashable\nbegin\ndefinition hashcode_uint32 :: \\uint32 \\ uint32\\ where\n \\hashcode_uint32 n = n\\\n\ndefinition def_hashmap_size_uint32 :: \\uint32 itself \\ nat\\ where\n \\def_hashmap_size_uint32 = (\\_. 16)\\\n \\ \\same as @{typ nat}\\\ninstance\n by standard (simp add: def_hashmap_size_uint32_def)\nend\n\ninstantiation uint64 :: hashable\nbegin\ndefinition hashcode_uint64 :: \\uint64 \\ uint32\\ where\n \\hashcode_uint64 n = (uint32_of_nat (nat_of_uint64 ((n) AND ((2 :: uint64)^32 -1))))\\\n\ndefinition def_hashmap_size_uint64 :: \\uint64 itself \\ nat\\ where\n \\def_hashmap_size_uint64 = (\\_. 16)\\\n \\ \\same as @{typ nat}\\\ninstance\n by standard (simp add: def_hashmap_size_uint64_def)\nend\n\nlemma word_nat_of_uint64_Rep_inject[simp]: \\nat_of_uint64 ai = nat_of_uint64 bi \\ ai = bi\\\n by transfer (simp add: word_unat_eq_iff)\n\ninstance uint64 :: heap\n by standard (auto simp: inj_def exI[of _ nat_of_uint64])\n\ninstance uint64 :: semiring_numeral\n by standard\n\nlemma nat_of_uint64_012[simp]: \\nat_of_uint64 0 = 0\\ \\nat_of_uint64 2 = 2\\ \\nat_of_uint64 1 = 1\\\n by (transfer, auto)+\n\ndefinition uint64_of_nat_conv where\n [simp]: \\uint64_of_nat_conv (x :: nat) = x\\\n\nlemma less_upper_bintrunc_id: \\n < 2 ^b \\ n \\ 0 \\ take_bit b n = n\\ for n :: int\n by (rule take_bit_int_eq_self)\n\nlemma nat_of_uint64_uint64_of_nat_id: \\n < 2^64 \\ nat_of_uint64 (uint64_of_nat n) = n\\\n unfolding uint64_of_nat_def\n apply simp\n apply transfer\n apply (subst unat_eq_nat_uint)\n apply transfer\n by (auto simp: less_upper_bintrunc_id)\n\nlemma [sepref_fr_rules]:\n \\(return o uint64_of_nat, RETURN o uint64_of_nat_conv) \\ [\\a. a < 2 ^64]\\<^sub>a nat_assn\\<^sup>k \\ uint64_nat_assn\\\n by sepref_to_hoare\n (sep_auto simp: uint64_nat_rel_def br_def nat_of_uint64_uint64_of_nat_id)\n\ndefinition string_rel :: \\(String.literal \\ string) set\\ where\n \\string_rel = {(x, y). y = String.explode x}\\\n\nabbreviation string_assn :: \\string \\ String.literal \\ assn\\ where\n \\string_assn \\ pure string_rel\\\n\nlemma eq_string_eq:\n \\((=), (=)) \\ string_rel \\ string_rel \\ bool_rel\\\n by (auto intro!: frefI simp: string_rel_def String.less_literal_def\n less_than_char_def rel2p_def literal.explode_inject)\n\nlemmas eq_string_eq_hnr =\n eq_string_eq[sepref_import_param]\n\ndefinition string2_rel :: \\(string \\ string) set\\ where\n \\string2_rel \\ \\Id\\list_rel\\\n\nabbreviation string2_assn :: \\string \\ string \\ assn\\ where\n \\string2_assn \\ pure string2_rel\\\n\nabbreviation monom_rel where\n \\monom_rel \\ \\string_rel\\list_rel\\\n\nabbreviation monom_assn where\n \\monom_assn \\ list_assn string_assn\\\n\nabbreviation monomial_rel where\n \\monomial_rel \\ monom_rel \\\\<^sub>r int_rel\\\n\nabbreviation monomial_assn where\n \\monomial_assn \\ monom_assn \\\\<^sub>a int_assn\\\n\nabbreviation poly_rel where\n \\poly_rel \\ \\monomial_rel\\list_rel\\\n\n\nabbreviation poly_assn where\n \\poly_assn \\ list_assn monomial_assn\\\n\nlemma poly_assn_alt_def:\n \\poly_assn = pure poly_rel\\\n by (simp add: list_assn_pure_conv)\n\nabbreviation polys_assn where\n \\polys_assn \\ hm_fmap_assn uint64_nat_assn poly_assn\\\n\nlemma string_rel_string_assn:\n \\(\\ ((c, a) \\ string_rel)) = string_assn a c\\\n by (auto simp: pure_app_eq)\n\nlemma single_valued_string_rel:\n \\single_valued string_rel\\\n by (auto simp: single_valued_def string_rel_def)\n\nlemma IS_LEFT_UNIQUE_string_rel:\n \\IS_LEFT_UNIQUE string_rel\\\n by (auto simp: IS_LEFT_UNIQUE_def single_valued_def string_rel_def\n literal.explode_inject)\n\nlemma IS_RIGHT_UNIQUE_string_rel:\n \\IS_RIGHT_UNIQUE string_rel\\\n by (auto simp: single_valued_def string_rel_def\n literal.explode_inject)\n\nlemma single_valued_monom_rel: \\single_valued monom_rel\\\n by (rule list_rel_sv)\n (auto intro!: frefI simp: string_rel_def\n rel2p_def single_valued_def p2rel_def)\n\nlemma single_valued_monomial_rel:\n \\single_valued monomial_rel\\\n using single_valued_monom_rel\n by (auto intro!: frefI simp:\n rel2p_def single_valued_def p2rel_def)\n\nlemma single_valued_monom_rel': \\IS_LEFT_UNIQUE monom_rel\\\n unfolding IS_LEFT_UNIQUE_def inv_list_rel_eq string2_rel_def\n by (rule list_rel_sv)+\n (auto intro!: frefI simp: string_rel_def\n rel2p_def single_valued_def p2rel_def literal.explode_inject)\n\n\nlemma single_valued_monomial_rel':\n \\IS_LEFT_UNIQUE monomial_rel\\\n using single_valued_monom_rel'\n unfolding IS_LEFT_UNIQUE_def inv_list_rel_eq\n by (auto intro!: frefI simp:\n rel2p_def single_valued_def p2rel_def)\n\nlemma [safe_constraint_rules]:\n \\Sepref_Constraints.CONSTRAINT single_valued string_rel\\\n \\Sepref_Constraints.CONSTRAINT IS_LEFT_UNIQUE string_rel\\\n by (auto simp: CONSTRAINT_def single_valued_def\n string_rel_def IS_LEFT_UNIQUE_def literal.explode_inject)\n\nlemma eq_string_monom_hnr[sepref_fr_rules]:\n \\(uncurry (return oo (=)), uncurry (RETURN oo (=))) \\ monom_assn\\<^sup>k *\\<^sub>a monom_assn\\<^sup>k \\\\<^sub>a bool_assn\\\n using single_valued_monom_rel' single_valued_monom_rel\n unfolding list_assn_pure_conv\n by sepref_to_hoare\n (sep_auto simp: list_assn_pure_conv string_rel_string_assn\n single_valued_def IS_LEFT_UNIQUE_def\n dest!: mod_starD\n simp flip: inv_list_rel_eq)\n\n\ndefinition term_order_rel' where\n [simp]: \\term_order_rel' x y = ((x, y) \\ term_order_rel)\\\n\nlemma term_order_rel[def_pat_rules]:\n \\(\\)$(x,y)$term_order_rel \\ term_order_rel'$x$y\\\n by auto\n\nlemma term_order_rel_alt_def:\n \\term_order_rel = lexord (p2rel char.lexordp)\\\n by (auto simp: p2rel_def char.lexordp_conv_lexord var_order_rel_def intro!: arg_cong[of _ _ lexord])\n\n\ninstantiation char :: linorder\nbegin\n definition less_char where [symmetric, simp]: \"less_char = PAC_Polynomials_Term.less_char\"\n definition less_eq_char where [symmetric, simp]: \"less_eq_char = PAC_Polynomials_Term.less_eq_char\"\ninstance\n apply standard\n using char.linorder_axioms\n by (auto simp: class.linorder_def class.order_def class.preorder_def\n less_eq_char_def less_than_char_def class.order_axioms_def\n class.linorder_axioms_def p2rel_def less_char_def)\nend\n\n\ninstantiation list :: (linorder) linorder\nbegin\n definition less_list where \"less_list = lexordp (<)\"\n definition less_eq_list where \"less_eq_list = lexordp_eq\"\n\ninstance\nproof standard\n have [dest]: \\\\x y :: 'a :: linorder list. (x, y) \\ lexord {(x, y). x < y} \\\n lexordp_eq y x \\ False\\\n by (metis lexordp_antisym lexordp_conv_lexord lexordp_eq_conv_lexord)\n have [simp]: \\\\x y :: 'a :: linorder list. lexordp_eq x y \\\n \\ lexordp_eq y x \\\n (x, y) \\ lexord {(x, y). x < y}\\\n using lexordp_conv_lexord lexordp_conv_lexordp_eq by blast\n show\n \\(x < y) = Restricted_Predicates.strict (\\) x y\\\n \\x \\ x\\\n \\x \\ y \\ y \\ z \\ x \\ z\\\n \\x \\ y \\ y \\ x \\ x = y\\\n \\x \\ y \\ y \\ x\\\n for x y z :: \\'a :: linorder list\\\n by (auto simp: less_list_def less_eq_list_def List.lexordp_def\n lexordp_conv_lexord lexordp_into_lexordp_eq lexordp_antisym\n antisym_def lexordp_eq_refl lexordp_eq_linear intro: lexordp_eq_trans\n dest: lexordp_eq_antisym)\nqed\n\nend\n\n\nlemma term_order_rel'_alt_def_lexord:\n \\term_order_rel' x y = ord_class.lexordp x y\\ and\n term_order_rel'_alt_def:\n \\term_order_rel' x y \\ x < y\\\nproof -\n show\n \\term_order_rel' x y = ord_class.lexordp x y\\\n \\term_order_rel' x y \\ x < y\\\n unfolding less_than_char_of_char[symmetric, abs_def]\n by (auto simp: lexordp_conv_lexord less_eq_list_def\n less_list_def lexordp_def var_order_rel_def\n rel2p_def term_order_rel_alt_def p2rel_def)\nqed\n\nlemma list_rel_list_rel_order_iff:\n assumes \\(a, b) \\ \\string_rel\\list_rel\\ \\(a', b') \\ \\string_rel\\list_rel\\\n shows \\a < a' \\ b < b'\\\nproof\n have H: \\(a, b) \\ \\string_rel\\list_rel \\\n (a, cs) \\ \\string_rel\\list_rel \\ b = cs\\ for cs\n using single_valued_monom_rel' IS_RIGHT_UNIQUE_string_rel\n unfolding string2_rel_def\n by (subst (asm)list_rel_sv_iff[symmetric])\n (auto simp: single_valued_def)\n assume \\a < a'\\\n then consider\n u u' where \\a' = a @ u # u'\\ |\n u aa v w aaa where \\a = u @ aa # v\\ \\a' = u @ aaa # w\\ \\aa < aaa\\\n by (subst (asm) less_list_def)\n (auto simp: lexord_def List.lexordp_def\n list_rel_append1 list_rel_split_right_iff)\n then show \\b < b'\\\n proof cases\n case 1\n then show \\b < b'\\\n using assms\n by (subst less_list_def)\n (auto simp: lexord_def List.lexordp_def\n list_rel_append1 list_rel_split_right_iff dest: H)\n next\n case 2\n then obtain u' aa' v' w' aaa' where\n \\b = u' @ aa' # v'\\ \\b' = u' @ aaa' # w'\\\n \\(aa, aa') \\ string_rel\\\n \\(aaa, aaa') \\ string_rel\\\n using assms\n by (smt list_rel_append1 list_rel_split_right_iff single_valued_def single_valued_monom_rel)\n with \\aa < aaa\\ have \\aa' < aaa'\\\n by (auto simp: string_rel_def less_literal.rep_eq less_list_def\n lexordp_conv_lexord lexordp_def char.lexordp_conv_lexord\n simp flip: less_char_def PAC_Polynomials_Term.less_char_def)\n then show \\b < b'\\\n using \\b = u' @ aa' # v'\\ \\b' = u' @ aaa' # w'\\\n by (subst less_list_def)\n (fastforce simp: lexord_def List.lexordp_def\n list_rel_append1 list_rel_split_right_iff)\n qed\nnext\n have H: \\(a, b) \\ \\string_rel\\list_rel \\\n (a', b) \\ \\string_rel\\list_rel \\ a = a'\\ for a a' b\n using single_valued_monom_rel'\n by (auto simp: single_valued_def IS_LEFT_UNIQUE_def\n simp flip: inv_list_rel_eq)\n assume \\b < b'\\\n then consider\n u u' where \\b' = b @ u # u'\\ |\n u aa v w aaa where \\b = u @ aa # v\\ \\b' = u @ aaa # w\\ \\aa < aaa\\\n by (subst (asm) less_list_def)\n (auto simp: lexord_def List.lexordp_def\n list_rel_append1 list_rel_split_right_iff)\n then show \\a < a'\\\n proof cases\n case 1\n then show \\a < a'\\\n using assms\n by (subst less_list_def)\n (auto simp: lexord_def List.lexordp_def\n list_rel_append2 list_rel_split_left_iff dest: H)\n next\n case 2\n then obtain u' aa' v' w' aaa' where\n \\a = u' @ aa' # v'\\ \\a' = u' @ aaa' # w'\\\n \\(aa', aa) \\ string_rel\\\n \\(aaa', aaa) \\ string_rel\\\n using assms\n by (auto simp: lexord_def List.lexordp_def\n list_rel_append2 list_rel_split_left_iff dest: H)\n with \\aa < aaa\\ have \\aa' < aaa'\\\n by (auto simp: string_rel_def less_literal.rep_eq less_list_def\n lexordp_conv_lexord lexordp_def char.lexordp_conv_lexord\n simp flip: less_char_def PAC_Polynomials_Term.less_char_def)\n then show \\a < a'\\\n using \\a = u' @ aa' # v'\\ \\a' = u' @ aaa' # w'\\\n by (subst less_list_def)\n (fastforce simp: lexord_def List.lexordp_def\n list_rel_append1 list_rel_split_right_iff)\n qed\nqed\n\n\nlemma string_rel_le[sepref_import_param]:\n shows \\((<), (<)) \\ \\string_rel\\list_rel \\ \\string_rel\\list_rel \\ bool_rel\\\n by (auto intro!: fun_relI simp: list_rel_list_rel_order_iff)\n\n(* TODO Move *)\nlemma [sepref_import_param]:\n assumes \\CONSTRAINT IS_LEFT_UNIQUE R\\ \\CONSTRAINT IS_RIGHT_UNIQUE R\\\n shows \\(remove1, remove1) \\ R \\ \\R\\list_rel \\ \\R\\list_rel\\\n apply (intro fun_relI)\n subgoal premises p for x y xs ys\n using p(2) p(1) assms\n by (induction xs ys rule: list_rel_induct)\n (auto simp: IS_LEFT_UNIQUE_def single_valued_def)\n done\n\ninstantiation pac_step :: (heap, heap, heap) heap\nbegin\n\ninstance\nproof standard\n obtain f :: \\'a \\ nat\\ where\n f: \\inj f\\\n by blast\n obtain g :: \\nat \\ nat \\ nat \\ nat \\ nat \\ nat\\ where\n g: \\inj g\\\n by blast\n obtain h :: \\'b \\ nat\\ where\n h: \\inj h\\\n by blast\n obtain i :: \\'c \\ nat\\ where\n i: \\inj i\\\n by blast\n have [iff]: \\g a = g b \\ a = b\\\\h a'' = h b'' \\ a'' = b''\\ \\f a' = f b' \\ a' = b'\\\n \\i a''' = i b''' \\ a''' = b'''\\ for a b a' b' a'' b'' a''' b'''\n using f g h i unfolding inj_def by blast+\n let ?f = \\\\x :: ('a, 'b, 'c) pac_step.\n g (case x of\n Add a b c d \\ (0, i a, i b, i c, f d)\n | Del a \\ (1, i a, 0, 0, 0)\n | Mult a b c d \\ (2, i a, f b, i c, f d)\n | Extension a b c \\ (3, i a, f c, 0, h b))\\\n have \\inj ?f\\\n apply (auto simp: inj_def)\n apply (case_tac x; case_tac y)\n apply auto\n done\n then show \\\\f :: ('a, 'b, 'c) pac_step \\ nat. inj f\\\n by blast\nqed\n\nend\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/PAC_Checker/PAC_Checker_Relation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5544704649604274, "lm_q1q2_score": 0.2837317437382898}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weakening\n imports Weak_Bisimulation\nbegin\n\nlocale weak = env + \n assumes weaken: \"\\ \\ \\ \\ \\'\"\nbegin\n\nlemma entWeaken:\n fixes \\ :: 'b\n and \\ :: 'c\n\n assumes \"\\ \\ \\\"\n\n shows \"\\ \\ \\' \\ \\\"\nusing assms weaken\nby(auto simp add: AssertionStatImp_def)\n\nlemma assertWeaken:\n fixes \\ :: 'b\n and \\' :: 'b\n\n shows \"\\ \\ \\ \\ \\'\"\nby(auto simp add: AssertionStatImp_def entWeaken)\n\nlemma frameWeaken:\n fixes F :: \"'b frame\"\n and G :: \"'b frame\"\n\n shows \"F \\\\<^sub>F F \\\\<^sub>F G\"\nproof -\n obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\" and \"A\\<^sub>F \\* F\" and \"A\\<^sub>F \\* G\"\n by(rule_tac F=F and C=\"(F, G)\" in freshFrame) auto\n obtain A\\<^sub>G \\\\<^sub>G where FrG: \"G = \\A\\<^sub>G, \\\\<^sub>G\\\" and \"A\\<^sub>G \\* F\" and \"A\\<^sub>G \\* G\" and \"A\\<^sub>G \\* A\\<^sub>F\" and \"A\\<^sub>G \\* \\\\<^sub>F\"\n by(rule_tac F=G and C=\"(F, G, A\\<^sub>F, \\\\<^sub>F)\" in freshFrame) auto\n from FrG `A\\<^sub>F \\* G` `A\\<^sub>G \\* A\\<^sub>F` have \"A\\<^sub>F \\* \\\\<^sub>G\" by auto\n have \"\\\\<^sub>F \\ \\\\<^sub>F \\ \\\\<^sub>G\" by(rule weaken)\n hence \"\\A\\<^sub>G, \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\\\<^sub>F \\ \\\\<^sub>G\\\" by(rule_tac frameImpResChainPres) auto\n with `A\\<^sub>G \\* \\\\<^sub>F` have \"\\\\, \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\\\<^sub>F \\ \\\\<^sub>G\\\" using frameResFreshChain\n by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def)\n with FrF FrG `A\\<^sub>G \\* A\\<^sub>F` `A\\<^sub>G \\* \\\\<^sub>F` `A\\<^sub>F \\* \\\\<^sub>G` show ?thesis\n by(force simp add: frameChainAppend intro: frameImpResChainPres)\nqed\n\nlemma unitAssertWeaken:\n fixes \\ :: 'b\n\n shows \"\\ \\ \\\"\nproof -\n have \"\\ \\ \\ \\ \\\" by(rule assertWeaken)\n moreover have \"\\ \\ \\ \\ \\\" by(metis Identity AssertionStatEq_def Commutativity AssertionStatEqTrans)\n ultimately show ?thesis by(rule AssertionStatImpTrans)\nqed\n\nlemma unitFrameWeaken:\n fixes F :: \"'b frame\"\n\n shows \"\\\\, \\\\ \\\\<^sub>F F\"\nproof -\n have \"\\\\, \\\\ \\\\<^sub>F ((\\\\, \\\\) \\\\<^sub>F F)\" by(rule frameWeaken)\n moreover obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\"\n by(rule_tac F=F and C=\"()\" in freshFrame) auto\n hence \"(\\\\, \\\\) \\\\<^sub>F F \\\\<^sub>F F\" \n by simp (metis frameIntIdentity frameIntCommutativity FrameStatEqTrans FrameStatEqSym)\n ultimately show ?thesis by(metis FrameStatImpTrans FrameStatEq_def)\nqed\n\nlemma insertAssertionWeaken:\n fixes F :: \"'b frame\"\n and \\ :: 'b\n\n shows \"\\\\, \\\\ \\\\<^sub>F insertAssertion F \\\"\nproof -\n have \"\\\\, \\\\ \\\\<^sub>F (\\\\, \\\\) \\\\<^sub>F F\" by(rule frameWeaken)\n thus ?thesis by simp\nqed\n\nlemma frameImpStatEq:\n fixes A\\<^sub>F :: \"name list\"\n and \\ :: 'b\n and \\' :: 'b\n and \\ :: 'c\n\n assumes \"(\\A\\<^sub>F, \\\\) \\\\<^sub>F \\\"\n and \"\\ \\ \\'\"\n\n shows \"(\\A\\<^sub>F, \\'\\) \\\\<^sub>F \\\"\nproof -\n obtain p::\"name prm\" where \"(p \\ A\\<^sub>F) \\* \\\" and \"(p \\ A\\<^sub>F) \\* \\\" and \"(p \\ A\\<^sub>F) \\* \\'\"\n and \"distinctPerm p\" and S: \"set p \\ set A\\<^sub>F \\ set(p \\ A\\<^sub>F)\"\n by(rule_tac c=\"(\\, \\, \\')\" in name_list_avoiding) auto\n from `(\\A\\<^sub>F, \\\\) \\\\<^sub>F \\` `(p \\ A\\<^sub>F) \\* \\` S have \"(\\(p \\ A\\<^sub>F), p \\ \\\\) \\\\<^sub>F \\\" by(simp add: frameChainAlpha)\n hence \"(p \\ \\) \\ \\\" using `(p \\ A\\<^sub>F) \\* \\` by(rule frameImpE)\n moreover from `\\ \\ \\'` have \"(p \\ \\) \\ (p \\ \\')\" by(rule AssertionStatEqClosed)\n ultimately have \"(p \\ \\') \\ \\\" by(simp add: AssertionStatEq_def AssertionStatImp_def)\n hence \"(\\(p \\ A\\<^sub>F), p \\ \\'\\) \\\\<^sub>F \\\" using `(p \\ A\\<^sub>F) \\* \\` \n by(rule_tac frameImpI) auto\n with `(p \\ A\\<^sub>F) \\* \\'` S show ?thesis by(simp add: frameChainAlpha)\nqed\n\n\n\n assumes \"\\ \\ P \\\\ \\ P'\"\n\n shows \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame P') \\\"\nproof(auto simp add: FrameStatImp_def)\n fix \\ :: 'c\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* P\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* \\\" and \"distinct A\\<^sub>P\" \n by(rule_tac C=\"(P, \\, \\)\" in freshFrame) auto\n with `\\ \\ P \\\\ \\ P'` obtain \\' A\\<^sub>P' \\\\<^sub>P' where FrP': \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\" \n and \"A\\<^sub>P' \\* P'\" and \"A\\<^sub>P' \\* \\\" and \"A\\<^sub>P' \\* \\\" \n by(rule_tac C=\"(\\, \\)\" in expandTauFrame) auto\n assume \"insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\"\n with FrP `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\` have \"\\ \\ \\\\<^sub>P \\ \\\" by(auto dest: frameImpE)\n hence \"(\\ \\ \\\\<^sub>P) \\ \\' \\ \\\" by(rule entWeaken)\n hence \"\\ \\ \\\\<^sub>P' \\ \\\" using `\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'`\n by(rule_tac statEqEnt, auto) (metis Associativity compositionSym AssertionStatEqTrans AssertionStatEqSym Commutativity)\n with `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* \\` FrP' show \"insertAssertion (extractFrame P') \\ \\\\<^sub>F \\\"\n by(force intro: frameImpI)\nqed\n\nlemma weakenTransition:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rs :: \"('a, 'b, 'c) residual\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\ Rs\"\n\n shows \"\\ \\ \\' \\ P \\ Rs\"\nusing assms\nproof(nominal_induct avoiding: \\' rule: semantics.strong_induct)\n case(cInput \\ M K xvec N Tvec P \\')\n from `\\ \\ M \\ K` have \"\\ \\ \\' \\ M \\ K\" by(rule entWeaken)\n thus ?case using `distinct xvec` `set xvec \\ (supp N)` `length xvec = length Tvec` \n by(rule Input)\nnext\n case(Output \\ M K N P \\')\n from `\\ \\ M \\ K` have \"\\ \\ \\' \\ M \\ K\" by(rule entWeaken)\n thus ?case by(rule semantics.Output)\nnext\n case(Case \\ P Rs \\ Cs \\')\n have \"\\ \\ \\' \\ P \\ Rs\" by(rule Case)\n moreover note `(\\, P) mem Cs`\n moreover from `\\ \\ \\` have \"\\ \\ \\' \\ \\\" by(rule entWeaken)\n ultimately show ?case using `guarded P`\n by(rule semantics.Case)\nnext\n case(cPar1 \\ \\\\<^sub>Q P \\ P' Q A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\\\ \\ P'\" by(rule cPar1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n thus ?case using `extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `bn \\ \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\'` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* \\`\n by(rule_tac Par1) auto\nnext\n case(cPar2 \\ \\\\<^sub>P Q \\ Q' P A\\<^sub>P \\')\n have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\\\ \\ Q'\" by(rule cPar2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n thus ?case using `extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\` `bn \\ \\* P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\'` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* \\`\n by(rule_tac Par2) auto\nnext\n case(cComm1 \\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\M\\N\\ \\ P'\" by(rule cComm1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\M\\N\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note `extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\`\n moreover have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\" by(rule cComm1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note `extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\`\n moreover from `\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K` have \"(\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q) \\ \\' \\ M \\ K\" by(rule entWeaken)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\" by(metis statEqEnt Composition Associativity Commutativity AssertionStatEqTrans)\n ultimately show ?case using `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\'` `A\\<^sub>P \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* A\\<^sub>Q`\n `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\'` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* K` `xvec \\* P`\n by(rule_tac Comm1) (assumption | auto)+\nnext\n case(cComm2 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\M\\\\*xvec\\\\N\\ \\ P'\" by(rule cComm2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note `extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\`\n moreover have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\K\\N\\ \\ Q'\" by(rule cComm2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\K\\N\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note `extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\`\n moreover from `\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K` have \"(\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q) \\ \\' \\ M \\ K\" by(rule entWeaken)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\" by(metis statEqEnt Composition Associativity Commutativity AssertionStatEqTrans)\n ultimately show ?case using `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\'` `A\\<^sub>P \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* A\\<^sub>Q`\n `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\'` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* K` `xvec \\* Q`\n by(rule_tac Comm2) (assumption | auto)+\nnext\n case(cOpen \\ P M xvec yvec N P' x \\')\n have \"\\ \\ \\' \\ P \\M\\\\*(xvec@yvec)\\\\N\\ \\ P'\" by(rule cOpen)\n thus ?case using `x \\ supp N` `x \\ \\` `x \\ \\'` `x \\ M` `x \\ xvec` `x \\ yvec`\n by(rule_tac Open) auto\nnext \n case(cScope \\ P \\ P' x \\')\n have \"\\ \\ \\' \\ P \\\\ \\ P'\" by(rule cScope)\n thus ?case using `x \\ \\` `x \\ \\'` `x \\ \\` by(rule_tac Scope) auto\nnext\n case(Bang \\ P Rs \\')\n have \"\\ \\ \\' \\ P \\ !P\\ Rs\" by(rule Bang)\n thus ?case using `guarded P` by(rule semantics.Bang)\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Weakening.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.2837317362036145}} {"text": "theory TwoColouringEx\n imports Rule FOLoG\nbegin\n\nabbreviation cast_ruleschema_rule :: \"ruleschema \\ rule\" where\n\"cast_ruleschema_rule rs \\ (rs, cond.T)\"\n\ndeclare [[coercion_enabled]]\ndeclare [[coercion cast_ruleschema_rule]]\n\n\n\ndefinition init :: ruleschema where\n\"init = \\rule_ty = Mapping [(0,Lty)],\n rule_lhs = \\nodes = Mapping [(1, \\node_mark = RuleMarkNode_None, node_label= Var 0 # [], node_rooted=False\\)]\n ,edges = Mapping.empty\\,\n rule_rhs = \\nodes = Mapping [(1, \\node_mark = RuleMarkNode_Red, node_label= Var 0 # [] , node_rooted=False\\)]\n ,edges = Mapping.empty\\,\n rule_interf = {1}\\\"\n\ndefinition unmark :: rule where\n\"unmark = (\\rule_ty = Mapping [(0, Lty)],\n rule_lhs = \\nodes = Mapping [(1, \\node_mark = RuleMarkNode_Any, node_label= Var 0 # [] , node_rooted=False\\)]\n ,edges = Mapping.empty\\,\n rule_rhs = \\nodes = Mapping[(1, \\node_mark = RuleMarkNode_None, node_label= Var 0 # [], node_rooted=False\\)]\n ,edges = Mapping.empty\\,\n rule_interf = {1}\\, cond.T)\"\n\ndefinition col_blue_1 :: ruleschema where\n\"col_blue_1 = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_None, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Blue, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n\ndefinition col_blue_2 :: ruleschema where\n\"col_blue_2 = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_None, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 2, edge_trg = 1, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Blue, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 2, edge_trg = 1, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n \ndefinition col_red_1 :: ruleschema where\n\"col_red_1 = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Blue , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_None, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping \n [(1, \\node_mark = RuleMarkNode_Blue , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Red, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n\n \ndefinition col_red_2 :: ruleschema where\n\"col_red_2 = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Blue , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_None, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 2, edge_trg = 1, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping \n [(1, \\node_mark = RuleMarkNode_Blue , node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Red, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 2, edge_trg = 1, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n\ndefinition ill_blue :: ruleschema where\n\"ill_blue = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Blue, node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Blue, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Blue, node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Blue, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n\ndefinition ill_red :: ruleschema where\n\"ill_red = \\rule_ty = Mapping [(0, Lty), (1, Lty), (2, Lty)]\n ,rule_lhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red, node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Red, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_rhs = \\nodes = Mapping\n [(1, \\node_mark = RuleMarkNode_Red, node_label = [Var 0], node_rooted = False\\)\n ,(2, \\node_mark = RuleMarkNode_Red, node_label = [Var 1], node_rooted = False\\)]\n ,edges = Mapping [(1, \\edge_src = 1, edge_trg = 2, edge_mark = RuleMarkEdge_None, edge_label = [Var 2]\\)]\\\n ,rule_interf = {1,2}\\\"\n\nlemma \"wf_ruleschema ill_red\"\n by (simp add: ill_red_def)\n\nlemma \"wf_ruleschema ill_blue\"\n by (simp add: ill_blue_def)\n\nlemma \"wf_ruleschema col_red\"\n by (simp add: col_red_def)\n\nlemma \"wf_ruleschema col_blue\"\n by (simp add: col_blue_def)\n\ndefinition twocolouring :: com where\n\"twocolouring \\ (RuleApp init ;; RuleSet {col_blue :: rule, col_red:: rule}!)! ;; \n IF RuleSet {ill_blue :: rule, ill_red :: rule} THEN RuleApp unmark! ELSE Skip\"\n\n\nabbreviation c :: \"form\" where\n\"c == (\\\\ 0 : Node\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None \\\\\\ \\unrooted \\0\\\\) \\\\\\\n (\\\\ 0 : Edge\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)\"\n\n\nabbreviation d :: form where\n\"d == (\\\\ 0 : Node\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\\\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue) \\\\\\\n \\\\\\(\\\\ 0 : Edge\\ (\\src \\0\\\\ \\\\\\ \\trg \\0\\\\) \\\\\\\n \\mark \\src \\0\\\\\\ \\=\\ \\mark \\trg \\0\\\\\\)\"\n\nabbreviation e :: form where\n\"e == (\\\\ 0 : Node\\ (\\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue) \\\\\\ \\unrooted \\0\\\\) \\\\\\\n (\\\\ 0 : Edge\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)\"\n\nabbreviation f :: form where\n\"f == (\\\\ 0 : Node\\ (\\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \n \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\0\\\\) \\\\\\\n (\\\\ 0 : Edge\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)\"\n\n\nsection \\SLP proofs\\\n\nlemma \"eval g undefined (Slp f (init:: rule) \\\\\\ \n ((\\\\0: Node\\ (\\\\1: Node\\ (\\1\\ \\=\\ \\0\\ \n \\\\\\ ((\\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None)\\\\\\ \\unrooted \\1\\\\)) \n \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\unrooted \\0\\\\)) \\\\\\ (\\\\1: Edge\\ (\\mark \\1\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None))))\"\n apply code_simp\n by auto\n\n\nvalue \"Slp f (col_blue_1::rule)\"\nvalue \"Slp f (col_blue_2::rule)\"\nvalue \"Slp f (col_red_1::rule)\" \n(* \nlemma \"eval g undefined ((Slp f (col_blue_1:: rule) \\\\\\ Slp f (col_blue_2:: rule)) \\\\\\ \n (Slp f (col_red_1:: rule) \\\\\\ Slp f (col_red_2:: rule)))\"\n apply code_simp\n apply auto\n apply (smt (z3))\n apply (smt (z3))\n apply (smt (z3))\n by (smt (z3)) *)\n\n\n\n(* \n\nlemma \"eval g undefined (Slp f (col_blue:: rule) \\\\\\ Slp f (col_red:: rule))\"\n apply code_simp\n apply auto\n oops\n \n\n\n oops\n\nlemma \"eval g undefined (((\\\\0: Node\\ (\\\\1: Node\\ ((\\\\2: Node\\ (\\2\\ \\=\\ \\0\\ \\\\\\ \\2\\ \\=\\ \\1\\ \\\\\\\n ((\\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\2\\\\)))\n \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\unrooted \\0\\\\ \\\\\\ \\unrooted \\1\\\\\n \\\\\\ (\\\\3: Edge\\ ((\\src \\3\\\\ \\=\\ \\0\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\1\\) \\\\\\ (\\src \\3\\\\ \\=\\ \\1\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\0\\)) )))) \\\\\\ (\\\\4:Edge\\ (\\mark \\4\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None))) \\\\\\ Slp f (col_blue:: rule))\"\n apply code_simp\n apply auto\n apply (erule notE)\n apply (smt (z3) conv_mark_node.elims mark_eq_node.simps(12) mark_eq_node.simps(15) mark_eq_node.simps(23) mark_eq_node.simps(24) mark_eq_node.simps(26) rulemark_node.distinct(13))\n apply (erule notE)\n apply (rule spec)\n oops \n\n\n text \\\n Slp f col_blue implies rule\n \\\n*)\nlemma x[simp]:\"mark_eq_node (conv_mark_node HostMarkNode_Red) RuleMarkNode_Red\"\n by simp\n\n\nlemma xxx: \"\\e. \\e\\Mapping.keys (edges g).\n (\\y. Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e))) = Some y) \\\n (\\y. Mapping.lookup (nodes g) (edge_src (the (Mapping.lookup (edges g) e))) = Some y) \\\n edge_src (the (Mapping.lookup (edges g) e)) \\ Mapping.keys (nodes g) \\\n edge_trg (the (Mapping.lookup (edges g) e)) \\ Mapping.keys (nodes g) \\\n \\e\\Mapping.keys (edges g). mark_eq_edge (conv_mark_edge (edge_mark (the (Mapping.lookup (edges g) e)))) RuleMarkEdge_None \\\n \\n\\Mapping.keys (nodes g).\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Blue \\\n (\\na\\Mapping.keys (nodes g).\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) na)))) RuleMarkNode_Red \\\n n = na \\\n na = n \\\n (\\nb\\Mapping.keys (nodes g).\n nb \\ na \\\n nb \\ n \\\n (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Red \\\n \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Blue \\\n \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_None \\\n node_rooted (the (Mapping.lookup (nodes g) nb)))) \\\n node_rooted (the (Mapping.lookup (nodes g) na)) \\\n node_rooted (the (Mapping.lookup (nodes g) n)) \\\n (\\e\\Mapping.keys (edges g). edge_src (the (Mapping.lookup (edges g) e)) = n \\ edge_trg (the (Mapping.lookup (edges g) e)) \\ na)) \\\n \\n\\Mapping.keys (nodes g).\n \\na\\Mapping.keys (nodes g).\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) na)))) RuleMarkNode_Blue \\\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Red \\\n n = na \\\n na = n \\\n (\\nb\\Mapping.keys (nodes g).\n nb \\ n \\\n nb \\ na \\\n (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Red \\\n \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Blue \\\n \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_None \\\n node_rooted (the (Mapping.lookup (nodes g) nb)))) \\\n node_rooted (the (Mapping.lookup (nodes g) n)) \\\n node_rooted (the (Mapping.lookup (nodes g) na)) \\\n (\\e\\Mapping.keys (edges g). edge_src (the (Mapping.lookup (edges g) e)) = n \\ edge_trg (the (Mapping.lookup (edges g) e)) \\ na) \\\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e))))))) RuleMarkNode_Blue \\\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (edge_src (the (Mapping.lookup (edges g) e))))))) RuleMarkNode_Red \\\n \\n\\Mapping.keys (nodes g).\n n = edge_src (the (Mapping.lookup (edges g) e)) \\\n n = edge_trg (the (Mapping.lookup (edges g) e)) \\\n (mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Red \\\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Blue \\\n mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_None) \\\n \\ node_rooted (the (Mapping.lookup (nodes g) n)) \\\n \\ node_rooted (the (Mapping.lookup (nodes g) (edge_src (the (Mapping.lookup (edges g) e))))) \\\n \\ node_rooted (the (Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e))))) \\ e \\ Mapping.keys (edges g) \\ False\"\nproof -\n fix e :: nat\n assume a1: \"mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e))))))) RuleMarkNode_Blue\"\n assume a2: \"mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (edge_src (the (Mapping.lookup (edges g) e))))))) RuleMarkNode_Red\"\n assume a3: \"edge_trg (the (Mapping.lookup (edges g) e)) \\ Mapping.keys (nodes g)\"\n assume a4: \"\\ node_rooted (the (Mapping.lookup (nodes g) (edge_src (the (Mapping.lookup (edges g) e)))))\"\n assume a5: \"\\ node_rooted (the (Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e)))))\"\n assume a6: \"edge_src (the (Mapping.lookup (edges g) e)) \\ Mapping.keys (nodes g)\"\n assume a7: \"\\n\\Mapping.keys (nodes g). \\na\\Mapping.keys (nodes g). mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) na)))) RuleMarkNode_Blue \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Red \\ n = na \\ na = n \\ (\\nb\\Mapping.keys (nodes g). nb \\ n \\ nb \\ na \\ (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Red \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_Blue \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) nb)))) RuleMarkNode_None \\ node_rooted (the (Mapping.lookup (nodes g) nb)))) \\ node_rooted (the (Mapping.lookup (nodes g) n)) \\ node_rooted (the (Mapping.lookup (nodes g) na)) \\ (\\e\\Mapping.keys (edges g). edge_src (the (Mapping.lookup (edges g) e)) = n \\ edge_trg (the (Mapping.lookup (edges g) e)) \\ na)\"\n assume a8: \"\\n\\Mapping.keys (nodes g). n = edge_src (the (Mapping.lookup (edges g) e)) \\ n = edge_trg (the (Mapping.lookup (edges g) e)) \\ (mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Red \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Blue \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_None) \\ \\ node_rooted (the (Mapping.lookup (nodes g) n))\"\n assume a9: \"e \\ Mapping.keys (edges g)\"\n obtain nn :: \"nat \\ nat \\ nat\" where\n\"\\x0 x1. (\\v2. v2 \\ Mapping.keys (nodes g) \\ v2 \\ x1 \\ v2 \\ x0 \\ (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) v2)))) RuleMarkNode_Red \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) v2)))) RuleMarkNode_Blue \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) v2)))) RuleMarkNode_None \\ node_rooted (the (Mapping.lookup (nodes g) v2)))) = (nn x0 x1 \\ Mapping.keys (nodes g) \\ nn x0 x1 \\ x1 \\ nn x0 x1 \\ x0 \\ (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn x0 x1))))) RuleMarkNode_Red \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn x0 x1))))) RuleMarkNode_Blue \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn x0 x1))))) RuleMarkNode_None \\ node_rooted (the (Mapping.lookup (nodes g) (nn x0 x1)))))\"\n by moura\n then have f10: \"\\n. n \\ Mapping.keys (nodes g) \\ (\\na. (na \\ Mapping.keys (nodes g) \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) na)))) RuleMarkNode_Blue \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) n)))) RuleMarkNode_Red) \\ n = na \\ na = n \\ nn na n \\ Mapping.keys (nodes g) \\ nn na n \\ n \\ nn na n \\ na \\ (\\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn na n))))) RuleMarkNode_Red \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn na n))))) RuleMarkNode_Blue \\ \\ mark_eq_node (conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (nn na n))))) RuleMarkNode_None \\ node_rooted (the (Mapping.lookup (nodes g) (nn na n)))) \\ node_rooted (the (Mapping.lookup (nodes g) n)) \\ node_rooted (the (Mapping.lookup (nodes g) na)) \\ (\\nb. (nb \\ Mapping.keys (edges g) \\ edge_src (the (Mapping.lookup (edges g) nb)) \\ n) \\ edge_trg (the (Mapping.lookup (edges g) nb)) \\ na))\"\n using a7 by (simp add: Ball_def_raw Bex_def_raw)\n have \"conv_mark_node (node_mark (the (Mapping.lookup (nodes g) (edge_trg (the (Mapping.lookup (edges g) e)))))) \\ RuleMarkNode_Green\"\n using a1 by force\n then show False\n using f10 a9 a8 a6 a5 a4 a3 a2 a1 by (smt (z3) conv_mark_node.elims mark_eq_node.simps(12) mark_eq_node.simps(15) mark_eq_node.simps(16) mark_eq_node.simps(23) rulemark_node.distinct(13))\nqed\n\nlemma \"\\wf_ruleschema col_blue_1; wf_ruleschema col_blue_2; wf_graph g\\ \n \\ eval g undefined ((Slp f (col_blue_1:: rule) \\\\\\ Slp f (col_blue_2:: rule)) \\\\\\ \n (\\\\0: Node\\ (\\\\1: Node\\ ((\\\\2: Node\\ (\\2\\ \\=\\ \\0\\ \\\\\\ \\2\\ \\=\\ \\1\\ \\\\\\\n ((\\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\2\\\\)))\n \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\unrooted \\0\\\\ \\\\\\ \\unrooted \\1\\\\\n \\\\\\ (\\\\3: Edge\\ ((\\src \\3\\\\ \\=\\ \\0\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\1\\) \\\\\\ (\\src \\3\\\\ \\=\\ \\1\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\0\\)) )))) \\\\\\ (\\\\4:Edge\\ (\\mark \\4\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)))\"\n apply code_simp\n apply safe\n apply auto\n apply (metis (no_types, lifting))\n apply (metis (no_types, hide_lams))\n apply (rule xxx)\n apply blast+\n apply (rule xxx)\n apply blast+\n by (metis (no_types, hide_lams))+\n\n\n\n \n \n \n(*\nlemma \"eval g undefined (Slp f (col_red:: rule) \\\\\\ \n (\\\\0: Node\\ (\\\\1: Node\\ ((\\\\2: Node\\ (\\2\\ \\=\\ \\0\\ \\\\\\ \\2\\ \\=\\ \\1\\ \\\\\\\n ((\\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\2\\\\)))\n \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\unrooted \\0\\\\ \\\\\\ \\unrooted \\1\\\\\n \\\\\\ (\\\\3: Edge\\ ((\\src \\3\\\\ \\=\\ \\0\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\1\\) \\\\\\ (\\src \\3\\\\ \\=\\ \\1\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\0\\)) )))) \\\\\\ (\\\\4:Edge\\ (\\mark \\4\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)))\"\n apply code_simp\n by auto \n\nlemma \"eval g undefined (Slp f (col_red:: rule) \\\\\\\n ((\\\\0: Node\\ \n (\\\\1: Node\\ \n ((\\\\2: Node\\ (\\2\\ \\=\\ \\0\\ \\\\\\ \\2\\ \\=\\ \\1\\ \\\\\\\n ((\\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\2\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\2\\\\) ))\n \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\1\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\unrooted \\0\\\\ \\\\\\ \\unrooted \\1\\\\\n \\\\\\ (\\\\3: Edge\\ ((\\src \\3\\\\ \\=\\ \\0\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\1\\) \\\\\\ (\\src \\3\\\\ \\=\\ \\1\\ \\\\\\ \\trg \\3\\\\ \\=\\ \\0\\)) )))) \\\\\\ (\\\\4:Edge\\ (\\mark \\4\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None))))\"\n apply code_simp\n apply auto\n oops\n *)\n \n \nlemma \"eval g undefined (Slp f (unmark :: rule) \\\\\\ \n (\\\\1: Node\\ ((\\\\0: Node\\ (\\0\\ \\=\\ \\1\\ \\\\\\ \n ((\\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue \\\\\\ \\mark \\0\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\ \\unrooted \\0\\\\)))\n \\\\\\ \\mark \\1\\\\ \\=\\\\\\<^sub>V RuleMarkNode_None \\\\\\ \\unrooted \\1\\\\)) \\\\\\ (\\\\4:Edge\\ (\\mark \\4\\\\ \\=\\ \\\\<^sub>E RuleMarkEdge_None)))\"\n apply code_simp\n by auto\n\n\n\n\n\nlemma c_impl_f : \"eval g undefined (c \\\\\\ f)\" \n by clarsimp\n\n(* section \\Proof of Fail output\\ *)\n(* \nlemma \"eval g undefined (Fail (RuleSet {col_blue::rule, col_red::rule}) \\\\\\ \n (\\\\\\(\\\\ x: Edge\\ ((((\\mark \\src \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\src \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue) \\\\\\ \\mark \\src \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) \\\\\\\n ((\\mark \\trg \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Red \\\\\\ \\mark \\trg \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_Blue) \\\\\\ \\mark \\src \\x\\\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None) ) \\\\\\\n \\unrooted \\src \\x\\\\\\ \\\\\\ \\unrooted \\trg \\x\\\\\\) )))\"\n apply auto\n oops\n\nlemma \"eval g undefined (Fail (RuleApp init ;; RuleSet {col_blue::rule, col_red::rule}!) \\\\\\ \n (\\\\\\(\\\\ x : Node\\ (\\mark \\x\\\\ \\=\\ \\\\<^sub>V RuleMarkNode_None \\\\\\ \\unrooted \\x\\\\))))\"\n apply auto\n sorry\n\n\nlemma \"eval g undefined (Fail (RuleApp unmark) \\\\\\ (\\\\\\(\\\\x:Node\\ (\\mark \\x\\\\ \\\\\\ \\\\<^sub>V RuleMarkNode_None \\\\\\ \\unrooted \\x\\\\))))\"\n apply (simp add: unmark_def)\n apply (rule conjI)\n apply (rule disjI1)\n apply (simp add: set_to_list_def)\n apply (rule someI2_ex)\n apply (metis empty_set list.simps(15))\n apply (induct g rule: eval.induct)\n\n\nlemma \"\\ {c} twocolouring {c \\\\\\ d}\"\n apply (simp add: twocolouring_def)\n apply (rule Cons [where ?c' = f and ?d' = \"c \\\\\\ d\"])\n apply auto\n apply (rule Comp [where ?e = e])\n\\ \\subtree I\\\n apply (rule Cons [where ?c' = f and d'=\"f \\\\\\ Fail (RuleApp init ;; RuleSet {col_blue::rule, col_red::rule}!)\"])\n apply auto\n prefer 2\n oops\n *)\n\n(* prefer 2\n using c_impl_f apply blast\n prefer 2\n apply auto\n apply (rule Comp [where ?e = e])\n apply (rule Cons [where ?c' = f and ?d' = \"f \\\\\\ Fail (RuleApp init ;; RuleSet {col_blue::rule, col_red::rule}!)\"])\n prefer 2\n apply auto\n prefer 2\n apply (simp add: dom_def)\n oops\n\n *)end", "meta": {"author": "rsoeldner", "repo": "gp2-isabelle", "sha": "bd6283c5ee5307231d9bfdfce409610f46ec0357", "save_path": "github-repos/isabelle/rsoeldner-gp2-isabelle", "path": "github-repos/isabelle/rsoeldner-gp2-isabelle/gp2-isabelle-bd6283c5ee5307231d9bfdfce409610f46ec0357/TwoColouringEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.283699113521498}} {"text": "theory ResourcedDenotational\nimports \"Abstract-Denotational-Props\" \"CValue-Nominal\" \"C-restr\"\nbegin\n\ntype_synonym CEnv = \"var \\ (C \\ CValue)\"\n\ninterpretation semantic_domain\n \"\\ f . \\ r. CFn\\(\\ v. (f\\(v))|\\<^bsub>r\\<^esub>)\"\n \"\\ x y. (\\ r. (x\\r \\CFn y|\\<^bsub>r\\<^esub>)\\r)\"\n \"\\ b r. CB\\b\"\n \"\\ scrut v1 v2 r. CB_project\\(scrut\\r)\\(v1\\r)\\(v2\\r)\"\n \"C_case\".\n\nnotation ESem_syn (\"\\\\ _ \\\\<^bsub>_\\<^esub>\" [60,60] 60)\nnotation EvalHeapSem_syn (\"\\<^bold>\\\\ _ \\<^bold>\\\\<^bsub>_\\<^esub>\" [0,0] 110)\nnotation HSem_syn (\"\\\\_\\_\" [60,60] 60)\nnotation AHSem_bot (\"\\\\_\\\" [60] 60)\n\ntext \\\nHere we re-state the simplification rules, cleaned up by beta-reducing the locale parameters.\n\\\n\nlemma CESem_simps:\n \"\\\\ Lam [x]. e \\\\<^bsub>\\\\<^esub> = (\\ (C\\r). CFn\\(\\ v. (\\\\ e \\\\<^bsub>\\(x := v)\\<^esub>)|\\<^bsub>r\\<^esub>))\"\n \"\\\\ App e x \\\\<^bsub>\\\\<^esub> = (\\ (C\\r). ((\\\\ e \\\\<^bsub>\\\\<^esub>)\\r \\CFn \\ x|\\<^bsub>r\\<^esub>)\\r)\"\n \"\\\\ Var x \\\\<^bsub>\\\\<^esub> = (\\ (C\\r). (\\ x) \\ r)\"\n \"\\\\ Bool b \\\\<^bsub>\\\\<^esub> = (\\ (C\\r). CB\\(Discr b))\"\n \"\\\\ (scrut ? e\\<^sub>1 : e\\<^sub>2) \\\\<^bsub>\\\\<^esub> = (\\ (C\\r). CB_project\\((\\\\ scrut \\\\<^bsub>\\\\<^esub>)\\r)\\((\\\\ e\\<^sub>1 \\\\<^bsub>\\\\<^esub>)\\r)\\((\\\\ e\\<^sub>2 \\\\<^bsub>\\\\<^esub>)\\r))\"\n \"\\\\ Let as body \\\\<^bsub>\\\\<^esub> = (\\ (C \\ r). (\\\\body\\\\<^bsub>\\\\as\\\\\\<^esub>) \\ r)\"\n by (auto simp add: eta_cfun)\n\nlemma CESem_bot[simp]:\"(\\\\ e \\\\<^bsub>\\\\<^esub>)\\\\ = \\\"\n by (nominal_induct e arbitrary: \\ rule: exp_strong_induct) auto\n\nlemma CHSem_bot[simp]:\"((\\\\ \\ \\) x)\\\\ = \\\"\n by (cases \"x \\ domA \\\") (auto simp add: lookup_HSem_heap lookup_HSem_other)\n\ntext \\\nSometimes we do not care much about the resource usage and just want a simpler formula.\n\\\n\nlemma CESem_simps_no_tick:\n \"(\\\\ Lam [x]. e \\\\<^bsub>\\\\<^esub>)\\r \\ CFn\\(\\ v. (\\\\ e \\\\<^bsub>\\(x := v)\\<^esub>)|\\<^bsub>r\\<^esub>)\"\n \"(\\\\ App e x \\\\<^bsub>\\\\<^esub>)\\r \\ ((\\\\ e \\\\<^bsub>\\\\<^esub>)\\r \\CFn \\ x|\\<^bsub>r\\<^esub>)\\r\"\n \"\\\\ Var x \\\\<^bsub>\\\\<^esub> \\ \\ x\"\n \"(\\\\ (scrut ? e\\<^sub>1 : e\\<^sub>2) \\\\<^bsub>\\\\<^esub>)\\r \\ CB_project\\((\\\\ scrut \\\\<^bsub>\\\\<^esub>)\\r)\\((\\\\ e\\<^sub>1 \\\\<^bsub>\\\\<^esub>)\\r)\\((\\\\ e\\<^sub>2 \\\\<^bsub>\\\\<^esub>)\\r)\"\n \"\\\\ Let as body \\\\<^bsub>\\\\<^esub> \\ \\\\body\\\\<^bsub>\\\\as\\\\\\<^esub>\"\n apply -\n apply (rule below_trans[OF monofun_cfun_arg[OF below_C]], simp)\n apply (rule below_trans[OF monofun_cfun_arg[OF below_C]], simp)\n apply (rule cfun_belowI, rule below_trans[OF monofun_cfun_arg[OF below_C]], simp)\n apply (rule below_trans[OF monofun_cfun_arg[OF below_C]], simp)\n apply (rule cfun_belowI, rule below_trans[OF monofun_cfun_arg[OF below_C]], simp)\n done\n\nlemma CELam_no_restr: \"(\\\\ Lam [x]. e \\\\<^bsub>\\\\<^esub>)\\r \\ CFn\\(\\ v. (\\\\ e \\\\<^bsub>\\(x := v)\\<^esub>))\"\nproof-\n have \"(\\\\ Lam [x]. e \\\\<^bsub>\\\\<^esub>)\\r \\ CFn\\(\\ v. (\\\\ e \\\\<^bsub>\\(x := v)\\<^esub>)|\\<^bsub>r\\<^esub>)\" by (rule CESem_simps_no_tick)\n also have \"\\ \\ CFn\\(\\ v. (\\\\ e \\\\<^bsub>\\(x := v)\\<^esub>))\"\n by (intro cont2cont monofun_LAM below_trans[OF C_restr_below] monofun_cfun_arg below_refl fun_upd_mono)\n finally show ?thesis by this (intro cont2cont)\nqed\n\nlemma CEApp_no_restr: \"(\\\\ App e x \\\\<^bsub>\\\\<^esub>)\\r \\ ((\\\\ e \\\\<^bsub>\\\\<^esub>)\\r \\CFn \\ x)\\r\"\nproof-\n have \"(\\\\ App e x \\\\<^bsub>\\\\<^esub>)\\r \\ ((\\\\ e \\\\<^bsub>\\\\<^esub>)\\r \\CFn \\ x|\\<^bsub>r\\<^esub>)\\r\" by (rule CESem_simps_no_tick)\n also have \"\\ x|\\<^bsub>r\\<^esub> \\ \\ x\" by (rule C_restr_below)\n finally show ?thesis by this (intro cont2cont)\nqed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Launchbury/ResourcedDenotational.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2836212884577598}} {"text": "(* File: Parallel_Composition.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nsection \\Parallel Composition\\\n\ntheory Parallel_Composition\n imports \"Basic_Modules/Component_Types/Aggregator\"\n \"Basic_Modules/Component_Types/Electoral_Module\"\nbegin\n\ntext\n\\The parallel composition composes a new electoral module from\ntwo electoral modules combined with an aggregator.\nTherein, the two modules each make a decision and the aggregator combines\nthem to a single (aggregated) result.\\\n\nsubsection \\Definition\\\n\nfun parallel_composition :: \"'a Electoral_Module \\ 'a Electoral_Module \\\n 'a Aggregator \\ 'a Electoral_Module\" where\n \"parallel_composition m n agg A p = agg A (m A p) (n A p)\"\n\nabbreviation parallel :: \"'a Electoral_Module \\ 'a Aggregator \\\n 'a Electoral_Module \\ 'a Electoral_Module\"\n (\"_ \\\\<^sub>_ _\" [50, 1000, 51] 50) where\n \"m \\\\<^sub>a n == parallel_composition m n a\"\n\nsubsection \\Soundness\\\n\ntheorem par_comp_sound[simp]:\n assumes\n mod_m: \"electoral_module m\" and\n mod_n: \"electoral_module n\" and\n agg_a: \"aggregator a\"\n shows \"electoral_module (m \\\\<^sub>a n)\"\n unfolding electoral_module_def\nproof (safe)\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\"\n have wf_quant:\n \"\\f. aggregator f =\n (\\a_set elec1 rej1 def1 elec2 rej2 def2.\n (\\ well_formed (a_set::'a set) (elec1, rej2, def1) \\\n \\ well_formed a_set (rej1, def2, elec2)) \\\n well_formed a_set\n (f a_set (elec1, rej2, def1) (rej1, def2, elec2)))\"\n unfolding aggregator_def\n by blast\n have wf_imp:\n \"\\e_mod a_set prof.\n (electoral_module e_mod \\ finite (a_set::'a set) \\\n profile a_set prof) \\\n well_formed a_set (e_mod a_set prof)\"\n using par_comp_result_sound\n by (metis (no_types))\n from mod_m mod_n fin_A prof_A agg_a\n have \"well_formed A (a A (m A p) (n A p))\"\n using agg_a combine_ele_rej_def fin_A\n mod_m mod_n prof_A wf_imp wf_quant\n by metis\n thus \"well_formed A ((m \\\\<^sub>a n) A p)\"\n by simp\nqed\n\nsubsection \\Composition Rule\\\n\n(*\n Using a conservative aggregator, the parallel composition\n preserves the property non-electing.\n*)\ntheorem conserv_agg_presv_non_electing[simp]:\n assumes\n non_electing_m: \"non_electing m\" and\n non_electing_n: \"non_electing n\" and\n conservative: \"agg_conservative a\"\n shows \"non_electing (m \\\\<^sub>a n)\"\n unfolding non_electing_def\nproof (safe)\n have emod_m: \"electoral_module m\"\n using non_electing_m\n by (simp add: non_electing_def)\n have emod_n: \"electoral_module n\"\n using non_electing_n\n by (simp add: non_electing_def)\n have agg_a: \"aggregator a\"\n using conservative\n by (simp add: agg_conservative_def)\n thus \"electoral_module (m \\\\<^sub>a n)\"\n using emod_m emod_n agg_a par_comp_sound\n by simp\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n x :: \"'a\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\" and\n x_wins: \"x \\ elect (m \\\\<^sub>a n) A p\"\n have emod_m: \"electoral_module m\"\n using non_electing_m\n by (simp add: non_electing_def)\n have emod_n: \"electoral_module n\"\n using non_electing_n\n by (simp add: non_electing_def)\n have\n \"\\x0 x1 x2 x3 x4 x5 x6 x7.\n (well_formed (x6::'a set) (x5, x1, x3) \\ well_formed x6 (x4, x0, x2) \\\n elect_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x5 \\ x4 \\\n reject_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x1 \\ x0 \\\n defer_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x3 \\ x2) =\n ((\\ well_formed x6 (x5, x1, x3) \\ \\ well_formed x6 (x4, x0, x2)) \\\n elect_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x5 \\ x4 \\\n reject_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x1 \\ x0 \\\n defer_r (x7 x6 (x5, x1, x3) (x4, x0, x2)) \\ x3 \\ x2)\"\n by linarith\n hence\n \"\\f. agg_conservative f =\n (aggregator f \\\n (\\A Aa Ab Ac Ad Ae Af. (\\ well_formed (A::'a set) (Aa, Ae, Ac) \\\n \\ well_formed A (Ab, Af, Ad)) \\\n elect_r (f A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Aa \\ Ab \\\n reject_r (f A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Ae \\ Af \\\n defer_r (f A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Ac \\ Ad))\"\n by (simp add: agg_conservative_def)\n hence\n \"aggregator a \\\n (\\A Aa Ab Ac Ad Ae Af. \\ well_formed A (Aa, Ae, Ac) \\\n \\ well_formed A (Ab, Af, Ad) \\\n elect_r (a A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Aa \\ Ab \\\n reject_r (a A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Ae \\ Af \\\n defer_r (a A (Aa, Ae, Ac) (Ab, Af, Ad)) \\ Ac \\ Ad)\"\n using conservative\n by presburger\n hence\n \"let c = (a A (m A p) (n A p)) in\n (elect_r c \\ ((elect m A p) \\ (elect n A p)))\"\n using emod_m emod_n fin_A par_comp_result_sound\n prod.collapse prof_A\n by metis\n hence \"x \\ ((elect m A p) \\ (elect n A p))\"\n using x_wins\n by auto\n thus \"x \\ {}\"\n using sup_bot_right non_electing_def fin_A\n non_electing_m non_electing_n prof_A\n by (metis (no_types, lifting))\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master - Bevor Range/theories/Compositional_Structures/Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583270090337582, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.283525079334865}} {"text": "theory ETCS_Comparison\n imports ETCS_Quantifier ETCS_Add \nbegin\n\ndefinition leq :: \"cfunc\" where\n \"leq = EXISTS \\\\<^sub>c \\\\<^sub>c (eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c)\\<^sup>\\\"\n\ndefinition leq_infix :: \"cfunc \\ cfunc \\ bool\" (infix \"\\\\<^sub>\\\" 50) where\n \"a \\\\<^sub>\\ b = (leq \\\\<^sub>c \\a, b\\ = \\)\"\n\nlemma leq_type[type_rule]:\n \"leq : \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\ \\\"\n unfolding leq_def by typecheck_cfuncs\n\nlemma leq_true_implies_exists:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\"\n assumes leq_true: \"leq \\\\<^sub>c \\m, n\\ = \\\"\n shows \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\nproof -\n have \"EXISTS \\\\<^sub>c \\\\<^sub>c (eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c)\\<^sup>\\ \\\\<^sub>c \\m, n\\ = \\\"\n using m_type n_type leq_true comp_associative2 unfolding leq_def by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c (id \\\\<^sub>c \\\\<^sub>f \\m, n\\))\\<^sup>\\ = \\\"\n using m_type n_type sharp_comp by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c id (\\\\<^sub>c \\\\<^sub>c one))\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, simp add: id_right_unit2)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c \\left_cart_proj \\\\<^sub>c one, \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c one\\<^esub>\\)\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, metis cfunc_cross_prod_def id_cross_prod\n id_domain id_left_unit2 right_cart_proj_type terminal_func_unique)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c \\id \\\\<^sub>c, \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, simp add: cfunc_prod_comp id_left_unit2 terminal_func_comp)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n ((id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c \\id \\\\<^sub>c, \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type cfunc_cross_prod_comp_cfunc_prod id_right_unit2 by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c\n left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, smt cfunc_type_def comp_associative domain_comp)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n (eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type EXISTS_true_implies_exists_true by (typecheck_cfuncs, blast)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c ((add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c (associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\k, \\m, n\\\\ = \\\"\n using m_type n_type cart_prod_extract_left by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c \\\\k, m\\, n\\ = \\\"\n using associate_left_ap m_type n_type by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c \\(add2 \\\\<^sub>c \\k, m\\), (id \\\\<^sub>c \\\\<^sub>c n)\\ = \\\"\n proof (rule ex_forward, auto)\n fix k\n assume k_type: \"k \\\\<^sub>c \\\\<^sub>c\"\n assume \"eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id\\<^sub>c \\\\<^sub>c) \\\\<^sub>c \\\\k,m\\,n\\ = \\\"\n then show \"eq_pred \\\\<^sub>c \\\\<^sub>c \\add2 \\\\<^sub>c \\k,m\\,id\\<^sub>c \\\\<^sub>c \\\\<^sub>c n\\ = \\\"\n using k_type assms by (typecheck_cfuncs, simp add: cfunc_cross_prod_comp_cfunc_prod)\n qed\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c \\add2 \\\\<^sub>c \\k, m\\, n\\ = \\\"\n using id_left_unit2 n_type by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ add2 \\\\<^sub>c \\k, m\\ = n\"\n by (metis add_def add_type eq_pred_iff_eq m_type n_type)\n then show \"\\k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\n by (simp add: add_def)\nqed\n\nlemma exists_implies_leq_true:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\"\n assumes leq_eqn: \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\n shows \"leq \\\\<^sub>c \\m, n\\ = \\\"\nproof - \n have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ add2 \\\\<^sub>c \\k, m\\ = n\"\n using add_def leq_eqn by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c \\add2 \\\\<^sub>c \\k, m\\, n\\ = \\\"\n using eq_pred_iff_eq n_type by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c \\(add2 \\\\<^sub>c \\k, m\\), (id \\\\<^sub>c \\\\<^sub>c n)\\ = \\\"\n using id_left_unit2 n_type by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c \\\\k, m\\, n\\ = \\\"\n proof (rule ex_forward, auto)\n fix k ka\n assume k_type: \"k \\\\<^sub>c \\\\<^sub>c\"\n assume \"eq_pred \\\\<^sub>c \\\\<^sub>c \\add2 \\\\<^sub>c \\k,m\\,id\\<^sub>c \\\\<^sub>c \\\\<^sub>c n\\ = \\\"\n then show \"eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id\\<^sub>c \\\\<^sub>c) \\\\<^sub>c \\\\k,m\\,n\\ = \\\"\n using k_type assms by (typecheck_cfuncs, simp add: cfunc_cross_prod_comp_cfunc_prod)\n qed\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\k, \\m, n\\\\ = \\\"\n using associate_left_ap m_type n_type by auto\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c k = \\\"\n using m_type n_type cart_prod_extract_left by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c (associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n eq_pred \\\\<^sub>c \\\\<^sub>c ((add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ \n (eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c k = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\) \\\\<^sub>c\n left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type exists_true_implies_EXISTS_true by (typecheck_cfuncs, blast)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n \\id \\\\<^sub>c, \\m, n\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type comp_associative2 by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c \\id \\\\<^sub>c, \\\\<^bsub>\\\\<^sub>c\\<^esub>\\ \\\\<^sub>c left_cart_proj \\\\<^sub>c one)\\<^sup>\\ = \\\"\n using m_type n_type cfunc_cross_prod_comp_cfunc_prod comp_associative2 id_right_unit2 by (typecheck_cfuncs, auto)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c \\left_cart_proj \\\\<^sub>c one, \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c one\\<^esub>\\)\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, smt cfunc_prod_comp id_left_unit2 terminal_func_comp terminal_func_type)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c\n (id \\\\<^sub>c \\\\<^sub>f \\m, n\\) \\\\<^sub>c id (\\\\<^sub>c \\\\<^sub>c one))\\<^sup>\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, metis cfunc_cross_prod_def id_cross_prod id_domain id_left_unit2 left_cart_proj_type right_cart_proj_type terminal_func_unique)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c \n ((eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c) \\\\<^sub>c (id \\\\<^sub>c \\\\<^sub>f \\m, n\\))\\<^sup>\\ = \\\"\n using m_type n_type id_right_unit2 by (typecheck_cfuncs, force)\n then have \"EXISTS \\\\<^sub>c \\\\<^sub>c (eq_pred \\\\<^sub>c \\\\<^sub>c (add2 \\\\<^sub>f id \\\\<^sub>c) \\\\<^sub>c associate_left \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c)\\<^sup>\\ \\\\<^sub>c \\m, n\\ = \\\"\n using m_type n_type by (typecheck_cfuncs, simp add: sharp_comp)\n then show \"leq \\\\<^sub>c \\m, n\\ = \\\"\n using m_type n_type comp_associative2 unfolding leq_def by (typecheck_cfuncs, auto)\nqed\n\nlemma add_monotonic:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\" and u_type: \"u \\\\<^sub>c \\\\<^sub>c\" and v_type: \"v \\\\<^sub>c \\\\<^sub>c\"\n assumes m_leq_n: \"leq \\\\<^sub>c \\m, n\\ = \\\" \n assumes u_leq_v: \"leq \\\\<^sub>c \\u, v\\ = \\\" \n shows \"leq \\\\<^sub>c \\m +\\<^sub>\\ u, n +\\<^sub>\\ v\\ = \\\" \nproof - \n have m_leq_n_Eqn: \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\n by (simp add: leq_true_implies_exists m_leq_n m_type n_type)\n have u_leq_v_Eqn: \"\\ j. j \\\\<^sub>c \\\\<^sub>c \\ j +\\<^sub>\\ u = v\"\n by (simp add: leq_true_implies_exists u_leq_v u_type v_type)\n have combined_Eqns: \"\\ l. l \\\\<^sub>c \\\\<^sub>c \\ l +\\<^sub>\\ (m +\\<^sub>\\ u) = n +\\<^sub>\\ v\"\n by (smt add_associates add_commutes add_type m_leq_n_Eqn m_type u_leq_v_Eqn u_type)\n show \"leq \\\\<^sub>c \\m +\\<^sub>\\ u, n +\\<^sub>\\ v\\ = \\\"\n by (metis add_type combined_Eqns exists_implies_leq_true m_type u_type)\nqed\n\nlemma leq_transitivity:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\" and p_type: \"p \\\\<^sub>c \\\\<^sub>c\"\n assumes m_leq_n: \"leq \\\\<^sub>c \\m, n\\ = \\\" \n assumes n_leq_p: \"leq \\\\<^sub>c \\n, p\\ = \\\" \n shows \"leq \\\\<^sub>c \\m, p\\ = \\\" \nproof - \n have m_leq_n_Eqn: \"\\ k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\n by (simp add: leq_true_implies_exists m_leq_n m_type n_type)\n obtain k where k_num: \"k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ m = n\"\n using m_leq_n_Eqn by blast\n have n_leq_p_Eqn: \"\\ j. j \\\\<^sub>c \\\\<^sub>c \\ j +\\<^sub>\\ n = p\"\n by (simp add: leq_true_implies_exists n_leq_p n_type p_type)\n obtain j where j_num: \"j \\\\<^sub>c \\\\<^sub>c \\ j +\\<^sub>\\ n = p\"\n using n_leq_p_Eqn by blast\n have combined_Eqn: \"(k +\\<^sub>\\ j) +\\<^sub>\\ m = p\"\n using add_associates add_commutes j_num k_num m_type by auto\n have combined_Exists: \"\\ l. l \\\\<^sub>c \\\\<^sub>c \\ l +\\<^sub>\\ m = p\"\n using add_type combined_Eqn j_num k_num by blast\n then show \"leq \\\\<^sub>c \\m, p\\ = \\\"\n by (simp add: exists_implies_leq_true m_type p_type)\n qed\n\n \n\n\n\nlemma lqe_antisymmetry:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\"\n assumes m_leq_n: \"leq \\\\<^sub>c \\m, n\\ = \\\" \n assumes n_leq_m: \"leq \\\\<^sub>c \\n, m\\ = \\\" \n shows \"m = n\"\nproof - \n have k_exists: \"\\k. k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ n = m\"\n by (simp add: leq_true_implies_exists m_type n_leq_m n_type)\n obtain k where k_def: \"k \\\\<^sub>c \\\\<^sub>c \\ k +\\<^sub>\\ n = m\"\n using k_exists by blast\n have j_exists: \"\\j. j \\\\<^sub>c \\\\<^sub>c \\ j +\\<^sub>\\ m = n\"\n by (simp add: leq_true_implies_exists m_leq_n m_type n_type)\n obtain j where j_def: \"j \\\\<^sub>c \\\\<^sub>c \\ j +\\<^sub>\\ m = n\"\n using j_exists by blast\n have \"zero +\\<^sub>\\ m = k +\\<^sub>\\ n\"\n by (simp add: add_respects_zero_on_left k_def m_type)\n also have \"... = (k +\\<^sub>\\ j) +\\<^sub>\\ m\"\n using add_associates j_def k_def m_type by blast\n then have zero_is_kplsj: \"zero = k +\\<^sub>\\ j\"\n by (metis add_cancellative add_type calculation j_def k_def n_type zero_type)\n have \"k = zero\"\n proof(rule ccontr)\n assume bwoc: \"k \\ zero\"\n have k_is_succ: \"\\a. (a \\\\<^sub>c \\\\<^sub>c \\ k = successor \\\\<^sub>c a)\"\n by (simp add: bwoc k_def nonzero_is_succ)\n obtain a where a_def: \"a \\\\<^sub>c \\\\<^sub>c \\ k = successor \\\\<^sub>c a\"\n using k_is_succ by blast\n have \"zero = successor \\\\<^sub>c (a +\\<^sub>\\ j)\"\n by (simp add: a_def add_respects_succ3 j_def zero_is_kplsj)\n then show False\n using a_def add_type j_def zero_is_not_successor by auto\n qed\n then show ?thesis\n using add_respects_zero_on_left k_def n_type by blast\nqed\n\nlemma zero_is_smallest:\n assumes \"n \\\\<^sub>c \\\\<^sub>c\"\n shows \"leq \\\\<^sub>c\\zero ,n\\ = \\\"\n using add_respects_zero_on_right assms exists_implies_leq_true zero_type by blast\n\nlemma lqe_connexity:\n assumes m_type: \"m \\\\<^sub>c \\\\<^sub>c\" and n_type: \"n \\\\<^sub>c \\\\<^sub>c\"\n shows \"(leq \\\\<^sub>c \\n, m\\ = \\) \\ (leq \\\\<^sub>c \\m, n\\ = \\)\"\nproof-\n\n have main_result: \"(OR \\\\<^sub>c \\\nleq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c, right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\nleq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c, left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\n\\)\\<^sup>\\ = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\\\<^sub>c\\\\<^sub>c\\<^esub>)\\<^sup>\\\"\n proof(rule natural_number_object_func_unique[where X=\"\\\\<^bsup>\\\\<^sub>c\\<^esup>\", where f = \"id (\\\\<^bsup>\\\\<^sub>c\\<^esup>)\" ])\n show type_fact1: \"(OR \\\\<^sub>c \\leq \\\\<^sub>c\\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (meson OR_type cfunc_prod_type comp_type left_cart_proj_type leq_type right_cart_proj_type transpose_func_type)\n show type_fact2: \"(\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n using comp_type terminal_func_type transpose_func_type true_func_type by blast\n have type_fact3: \"id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero : \\\\<^sub>c\\\\<^sub>c one \\ \\\\<^sub>c\\\\<^sub>c\\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n using cfunc_cross_prod_type comp_type id_type type_fact2 zero_type by auto\n show type_fact3: \"id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) : \\\\<^bsup>\\\\<^sub>c\\<^esup> \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (simp add: id_type)\n show eqn_1: \"(OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero =\n (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero\"\n proof(rule same_evals_equal[where Z = \"one\", where X=\\, where A=\"\\\\<^sub>c\"])\n show type_fact5: \"(OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero \\\\<^sub>c \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (meson comp_type type_fact1 zero_type)\n show type_fact6: \"(\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero \\\\<^sub>c \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (meson comp_type type_fact2 zero_type)\n show eqn_2: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero =\n eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero\"\n proof(rule one_separator[where X=\"\\\\<^sub>c\\\\<^sub>c one\", where Y = \\])\n show type_fact7: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f \n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n zero : \\\\<^sub>c \\\\<^sub>c one \\ \\\"\n using flat_type inv_transpose_func_def2 type_fact5 by force\n show type_fact8: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero : \\\\<^sub>c \\\\<^sub>c one \\ \\\"\n using flat_type inv_transpose_func_def2 type_fact6 by force\n show \"\\x. x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c one \\\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (OR \\\\<^sub>c\n \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x\"\n proof - \n fix x \n assume x_type: \"x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c one\"\n have x_form: \"\\j. (j\\\\<^sub>c \\\\<^sub>c \\ x = \\j,id one\\)\"\n by (metis (no_types) x_type cart_prod_decomp id_type one_unique_element)\n obtain j where j_def: \"j\\\\<^sub>c \\\\<^sub>c \\ x = \\j,id one\\\"\n using x_form by blast\n have eqn_RHS: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x = \\\"\n proof - \n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x = \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>c (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f zero) \\\\<^sub>c x\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition x_type)\n also have \"... = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>) \\\\<^sub>c (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f zero) \\\\<^sub>c \\j,id one\\\"\n by (typecheck_cfuncs, simp add: j_def transpose_func_def)\n also have \"... = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>) \\\\<^sub>c \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c j,zero \\\\<^sub>c id one\\\"\n using cfunc_cross_prod_comp_cfunc_prod j_def by (typecheck_cfuncs, force)\n also have \"... = \\ \\\\<^sub>c (\\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub> \\\\<^sub>c \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c j,zero \\\\<^sub>c id one\\)\"\n by (typecheck_cfuncs, metis comp_associative2 j_def)\n also have \"... = \\\"\n by (typecheck_cfuncs, metis id_right_unit2 j_def terminal_func_unique)\n then show ?thesis\n by (simp add: calculation)\n qed\n \n have eqn_LHS: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x = \\\"\n proof - \n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x = \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f zero) \\\\<^sub>c x\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition x_type)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f zero) \\\\<^sub>c x\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative transpose_func_def x_type)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c\n \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c j,zero \\\\<^sub>c id one\\\"\n using cfunc_cross_prod_comp_cfunc_prod j_def by (typecheck_cfuncs, auto)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c\n \\j,zero\\\"\n using id_left_unit2 id_right_unit2 j_def zero_type by force\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\j,zero\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\j,zero\\ \\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\j,zero\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\j,zero\\ \\\\\"\n by (typecheck_cfuncs, smt cfunc_prod_comp comp_associative2 j_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\j ,zero \\, leq \\\\<^sub>c\\zero ,j \\\\\"\n by (typecheck_cfuncs, metis j_def left_cart_proj_cfunc_prod right_cart_proj_cfunc_prod)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\j ,zero \\, \\\\\"\n by (simp add: j_def zero_is_smallest)\n also have \"... = \\\"\n by (typecheck_cfuncs, simp add: OR_true_right_is_true j_def)\n then show ?thesis\n by (simp add: calculation)\n qed\n show \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x =(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c zero) \\\\<^sub>c x\"\n by (simp add: eqn_LHS eqn_RHS)\n qed\n qed\n qed\n show \"(\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor =\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\\"\n proof(rule same_evals_equal[where Z = \"\\\\<^sub>c\", where X = \\,where A = \"\\\\<^sub>c\"])\n show type_fact9: \"(\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (meson comp_type successor_type type_fact2)\n show type_fact10: \"id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n by (meson comp_type type_fact2 type_fact3)\n show \"eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor =\n eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\\"\n proof(rule one_separator[where X=\"\\\\<^sub>c\\\\<^sub>c\\\\<^sub>c\", where Y = \\])\n show type_fact11: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor : \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\ \\\"\n using type_fact9 flat_type inv_transpose_func_def2 by auto\n show type_fact12: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ : \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\ \\\"\n using flat_type inv_transpose_func_def2 type_fact10 by auto\n show \"\\x. x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>cx\"\n proof -\n fix x\n assume x_def: \"x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\"\n\n \n \n \n show \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>cx\"\n \n\n proof - \n have calc1: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\)\\\\<^sub>c (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c x\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition x_def) \n also have \"... = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>) \\\\<^sub>c (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c x\"\n using transpose_func_def by (typecheck_cfuncs, auto)\n also have \"... = \\ \\\\<^sub>c (\\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub> \\\\<^sub>c (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c x)\"\n by (typecheck_cfuncs, metis cfunc_type_def comp_associative x_def)\n also have \"... = \\\"\n by (typecheck_cfuncs, metis id_right_unit2 id_type terminal_func_unique x_def)\n then have eqsT1: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\ \\\\<^sub>c successor) \\\\<^sub>c x = \\\"\n by (simp add: calculation)\n have calc2: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>cx = \\\"\n proof -\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>cx = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>) \\\\<^sub>cx\"\n by (typecheck_cfuncs, simp add: id_left_unit2 transpose_func_def)\n also have \"... = \\ \\\\<^sub>c (\\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub> \\\\<^sub>c x)\"\n using comp_associative2 x_def by (typecheck_cfuncs, auto)\n also have \"... = \\\"\n by (metis id_right_unit2 id_type one_unique_element terminal_func_comp terminal_func_type true_func_type x_def)\n then show ?thesis\n using calculation by auto\n qed\n then have eqsT2: \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\\<^esub>)\\<^sup>\\) \\\\<^sub>cx = \\\"\n by (simp add: calc2)\n then show ?thesis\n using eqsT1 by auto\n qed\n qed\n qed\n qed\n\n \n\n show \"(OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor =\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\\"\n proof(rule same_evals_equal[where Z=\"\\\\<^sub>c\", where X=\\, where A =\"\\\\<^sub>c\" ])\n show type_fact13: \"(OR \\\\<^sub>c \\leq \\\\<^sub>c\\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n using comp_type successor_type type_fact1 by blast\n\n show type_fact14: \"id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ : \\\\<^sub>c \\ \\\\<^bsup>\\\\<^sub>c\\<^esup>\"\n using comp_type type_fact1 type_fact3 by auto\n\n show \"eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c\\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor =\n eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\\"\n proof(rule one_separator[where X = \"\\\\<^sub>c\\\\<^sub>c\\\\<^sub>c\", where Y = \\])\n show type_fact15: \"eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor : \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\ \\\"\n using flat_type inv_transpose_func_def2 type_fact13 by force\n show \"eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ : \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\ \\\"\n using flat_type inv_transpose_func_def2 type_fact14 by force\n show \"\\x. x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c x\"\n proof -\n fix x \n assume x_is: \"x \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\"\n have x_cart: \"\\n m. n \\\\<^sub>c \\\\<^sub>c \\ m \\\\<^sub>c \\\\<^sub>c \\ x = \\n,m\\\"\n using cart_prod_decomp x_is by blast\n obtain n where n_def: \"\\m. n \\\\<^sub>c \\\\<^sub>c \\ m \\\\<^sub>c \\\\<^sub>c \\ x = \\n,m\\\"\n using x_cart by blast\n obtain m where m_def: \"n \\\\<^sub>c \\\\<^sub>c \\ m \\\\<^sub>c \\\\<^sub>c \\ x = \\n,m\\\"\n using n_def by blast\n\n \n \n\n\n\n have nsm_type: \"\\n,successor \\\\<^sub>c m\\ \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\"\n by (simp add: cfunc_prod_type m_def succ_n_type)\n have smn_type: \"\\successor \\\\<^sub>c m,n\\ \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c\"\n by (simp add: cfunc_prod_type m_def succ_n_type)\n\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c \\n,m\\ =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\\"\n proof(cases \"leq \\\\<^sub>c \\n,m\\ = \\ \\ leq \\\\<^sub>c \\m,n\\ = \\\", auto) \n assume \"leq \\\\<^sub>c \\n,m\\ = \\\"\n assume \"leq \\\\<^sub>c \\m,n\\ = \\\"\n\n have \"(leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ = \\) \\ (leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\ = \\)\"\n proof(rule ccontr,auto)\n assume \"leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ \\ \\\"\n then have \"leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ = \\\"\n using comp_type leq_type nsm_type true_false_only_truth_values by blast\n then have j_exists: \"\\ j. j \\\\<^sub>c \\\\<^sub>c \\ n +\\<^sub>\\ j = successor \\\\<^sub>c m\"\n by (metis add_commutes leq_true_implies_exists m_def succ_n_type)\n obtain j where j_def: \"j \\\\<^sub>c \\\\<^sub>c \\ n +\\<^sub>\\ j = successor \\\\<^sub>c m\"\n using j_exists by blast\n have \"n +\\<^sub>\\ j = m +\\<^sub>\\ (successor \\\\<^sub>c zero)\"\n by (simp add: add_respects_succ1 add_respects_zero_on_right j_def m_def zero_type)\n have \"leq \\\\<^sub>c \\m,n\\ = \\\"\n proof (cases \"j = zero\")\n assume \"j = zero\" \n have \"n = m +\\<^sub>\\ (successor \\\\<^sub>c zero)\"\n using \\j = zero\\ \\n +\\<^sub>\\ j = m +\\<^sub>\\ (successor \\\\<^sub>c zero)\\ add_respects_zero_on_right m_def by auto\n then have \"n = (successor \\\\<^sub>c zero) +\\<^sub>\\ m\"\n using add_commutes m_def succ_n_type zero_type by blast\n then have \"\\p. p \\\\<^sub>c \\\\<^sub>c \\ n = p +\\<^sub>\\ m\"\n using succ_n_type zero_type by blast\n then show ?thesis\n using exists_implies_leq_true m_def by blast\n next\n assume \"j \\ zero\"\n then have \"\\ p. (p \\\\<^sub>c \\\\<^sub>c \\ j = successor \\\\<^sub>c p) \"\n using j_def nonzero_is_succ by auto\n then obtain p where p_def: \"p \\\\<^sub>c \\\\<^sub>c \\ j = successor \\\\<^sub>c p\"\n by blast\n have \"successor \\\\<^sub>c m = n +\\<^sub>\\ j\"\n by (simp add: j_def)\n also have \"... = n +\\<^sub>\\ (successor \\\\<^sub>c p)\"\n by (simp add: p_def)\n also have \"... = successor \\\\<^sub>c (n +\\<^sub>\\ p)\"\n by (simp add: add_respects_succ1 m_def p_def)\n then have \"successor \\\\<^sub>c m = successor \\\\<^sub>c (n +\\<^sub>\\ p)\"\n using calculation by auto\n then have \"m = n +\\<^sub>\\ p\"\n by (simp add: add_type m_def p_def succ_inject)\n then have \"... = p +\\<^sub>\\ n\"\n using add_commutes m_def p_def by blast\n then have \"\\p. (p \\\\<^sub>c \\\\<^sub>c \\ m = p +\\<^sub>\\ n)\"\n using \\m = n +\\<^sub>\\ p\\ p_def by blast\n then show ?thesis\n using \\leq \\\\<^sub>c \\m,n\\ = \\\\ \\leq \\\\<^sub>c \\n,m\\ = \\\\ exists_implies_leq_true m_def by force\n qed\n then show False\n using \\leq \\\\<^sub>c \\m,n\\ = \\\\ true_false_distinct by auto\n \n next\n assume \"leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\ \\ \\\"\n then have \"leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\ = \\\"\n using comp_type leq_type smn_type true_false_only_truth_values by blast\n then show False\n by (metis \\leq \\\\<^sub>c \\m,n\\ = \\\\ add_respects_succ2 exists_implies_leq_true leq_true_implies_exists m_def succ_n_type true_false_distinct)\n qed\n \n\n\n\n\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c \\n,m\\= \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition m_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\" \n by (typecheck_cfuncs, smt cfunc_type_def comp_associative m_def transpose_func_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c n,successor \\\\<^sub>c m\\\" \n using cfunc_cross_prod_comp_cfunc_prod m_def by (typecheck_cfuncs, auto)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\n,successor \\\\<^sub>c m\\\"\n using id_left_unit2 m_def by auto \n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\\ ,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ \\ \\\"\n using nsm_type by (typecheck_cfuncs, smt cfunc_prod_comp comp_associative2)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,successor \\\\<^sub>c m\\ , leq \\\\<^sub>c \\successor \\\\<^sub>c m ,n \\\\\"\n using left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod succ_n_type by auto \n also have \"... = \\\"\n by (simp add: OR_false_false_is_false \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ = \\ \\ leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\ = \\\\)\n\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \\\"\n proof -\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \n OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt comp_associative2 id_left_unit2 m_def transpose_func_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\\\ \"\n by (typecheck_cfuncs , smt cfunc_prod_comp comp_associative2 m_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,m \\, leq \\\\<^sub>c \\m ,n \\\\ \"\n by (typecheck_cfuncs, metis left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod) \n also have \"... = \\\"\n by (simp add: OR_false_false_is_false \\leq \\\\<^sub>c \\m,n\\ = \\\\ \\leq \\\\<^sub>c \\n,m\\ = \\\\)\n then show ?thesis\n using calculation by auto\n qed\n\n then show ?thesis\n using \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\,leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\\\ = \\\\ calculation by presburger\n \n next\n assume \"leq \\\\<^sub>c \\n,m\\ \\ \\\"\n then have \"leq \\\\<^sub>c \\n,m\\ = \\\"\n using m_def true_false_only_truth_values by (typecheck_cfuncs, blast)\n\n then have \"leq \\\\<^sub>c \\n ,successor \\\\<^sub>c m\\ = \\\"\n by (metis add_respects_succ3 exists_implies_leq_true leq_true_implies_exists m_def succ_n_type)\n \n \n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c \\n,m\\= \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition m_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\" \n by (typecheck_cfuncs, smt cfunc_type_def comp_associative m_def transpose_func_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c n,successor \\\\<^sub>c m\\\" \n using cfunc_cross_prod_comp_cfunc_prod m_def by (typecheck_cfuncs, auto)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\n,successor \\\\<^sub>c m\\\"\n using id_left_unit2 m_def by auto \n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\\ ,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ \\ \\\"\n using nsm_type by (typecheck_cfuncs, smt cfunc_prod_comp comp_associative2)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,successor \\\\<^sub>c m\\ , leq \\\\<^sub>c \\successor \\\\<^sub>c m ,n \\\\\"\n using left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod succ_n_type by auto \n also have \"... = \\\"\n using OR_true_left_is_true \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ = \\\\ comp_type leq_type smn_type by auto\n\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \\\"\n proof -\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \n OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt comp_associative2 id_left_unit2 m_def transpose_func_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\\\ \"\n by (typecheck_cfuncs , smt cfunc_prod_comp comp_associative2 m_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,m \\, leq \\\\<^sub>c \\m ,n \\\\ \"\n by (typecheck_cfuncs, metis left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod) \n also have \"... = \\\"\n by (typecheck_cfuncs, simp add: OR_true_left_is_true \\leq \\\\<^sub>c \\n,m\\ = \\\\ m_def)\n\n then show ?thesis\n by (simp add: \\(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\\\ \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\\\ = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n,m\\,leq \\\\<^sub>c \\m,n\\\\\\ \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\ = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\\\\\ \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\,leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\\\ = \\\\ calculation)\n\n next\n assume \"leq \\\\<^sub>c \\m,n\\ \\ \\\"\n then have \"leq \\\\<^sub>c \\m,n\\ = \\\"\n using m_def true_false_only_truth_values by (typecheck_cfuncs, blast)\n\n then have \"leq \\\\<^sub>c \\m ,successor \\\\<^sub>c n\\ = \\\"\n by (metis add_respects_succ3 exists_implies_leq_true leq_true_implies_exists m_def succ_n_type)\n \n \n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c \\n,m\\= \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt cfunc_type_def comp_associative inv_transpose_func_def2 inv_transpose_of_composition m_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n (id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c \\n,m\\\" \n by (typecheck_cfuncs, smt cfunc_type_def comp_associative m_def transpose_func_def)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\id\\<^sub>c \\\\<^sub>c \\\\<^sub>c n,successor \\\\<^sub>c m\\\" \n using cfunc_cross_prod_comp_cfunc_prod m_def by (typecheck_cfuncs, auto)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\\\\\<^sub>c\n \\n,successor \\\\<^sub>c m\\\"\n using id_left_unit2 m_def by auto \n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\\ ,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ \\ \\\"\n using nsm_type by (typecheck_cfuncs, smt cfunc_prod_comp comp_associative2)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,successor \\\\<^sub>c m\\ , leq \\\\<^sub>c \\successor \\\\<^sub>c m ,n \\\\\"\n using left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod succ_n_type by auto \n also have \"... = \\\"\n using OR_true_left_is_true \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ = \\\\ comp_type leq_type smn_type by auto\n\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \\\"\n proof -\n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\ = \n OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt comp_associative2 id_left_unit2 m_def transpose_func_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ ,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\ \\\\ \"\n by (typecheck_cfuncs , smt cfunc_prod_comp comp_associative2 m_def x_is)\n also have \"... = OR \\\\<^sub>c \\leq \\\\<^sub>c \\n ,m \\, leq \\\\<^sub>c \\m ,n \\\\ \"\n by (typecheck_cfuncs, metis left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod) \n also have \"... = \\\"\n using OR_true_right_is_true \\leq \\\\<^sub>c \\m,n\\ = \\\\ comp_type leq_type m_def x_is by auto\n then show ?thesis\n using calculation by auto\n qed\n qed\n then show \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c\n \\n,m\\ =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n \\n,m\\\"\n by (simp add: \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\n,successor \\\\<^sub>c m\\,leq \\\\<^sub>c \\successor \\\\<^sub>c m,n\\\\ = \\\\ calculation)\n next\n assume \"leq \\\\<^sub>c \\m,n\\ \\ \\\"\n then have m_leq_n: \"leq \\\\<^sub>c \\m,n\\ = \\\"\n by (meson cfunc_prod_type comp_type leq_type m_def true_false_only_truth_values)\n then have main_inequality: \"OR \\\\<^sub>c \\ leq \\\\<^sub>c \\n, successor \\\\<^sub>c m\\, leq \\\\<^sub>c \\ successor \\\\<^sub>c m, n\\\\= \\\"\n proof(cases \"m = n\")\n assume \"m = n\"\n then have \"leq \\\\<^sub>c \\n, successor \\\\<^sub>c m\\ = \\\"\n by (typecheck_cfuncs, metis add_respects_succ3 add_respects_zero_on_left exists_implies_leq_true m_def succ_n_type zero_type)\n then show ?thesis\n using OR_true_left_is_true comp_type leq_type smn_type by presburger\n next \n assume \"m \\ n\"\n then obtain k where k_def: \"k \\\\<^sub>c \\\\<^sub>c \\ n = m +\\<^sub>\\ k \\ k \\ zero\"\n by (metis m_leq_n add_commutes add_respects_zero_on_right leq_true_implies_exists m_def)\n then have \"leq \\\\<^sub>c \\ successor \\\\<^sub>c m, n\\ = \\\"\n proof - \n have \"leq \\\\<^sub>c \\m +\\<^sub>\\ (successor \\\\<^sub>c zero), n \\ = \\\"\n by (smt (verit, ccfv_SIG) add_commutes add_respects_succ3 add_respects_zero_on_left exists_implies_leq_true k_def m_def nonzero_is_succ succ_n_type zero_type)\n then show ?thesis\n by (simp add: add_respects_succ1 add_respects_zero_on_right m_def zero_type)\n qed\n then show ?thesis\n using OR_true_right_is_true comp_type leq_type nsm_type by presburger\n qed\n \n\n\n\n\n show \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c\n \\n,m\\ = \n (eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n \\n,m\\\"\n \n proof - \n have \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c\n \\n,m\\ = ((eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c\n \\n,m\\\"\n using sharp_comp transpose_func_def by (typecheck_cfuncs,force)\n also have \"... = (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\\\<^sub>c\n ((id\\<^sub>c \\\\<^sub>c \\\\<^sub>f successor) \\\\<^sub>c\n \\n,m\\)\"\n by (typecheck_cfuncs, smt (verit, best) comp_associative2 m_def transpose_func_def)\n also have \"... = (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\\\<^sub>c\n \\n,successor \\\\<^sub>c m\\\"\n using cfunc_cross_prod_comp_cfunc_prod id_left_unit2 m_def by (typecheck_cfuncs, force)\n also have \"... = OR \\\\<^sub>c \\\n leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\ \\\\<^sub>c \\n,successor \\\\<^sub>c m\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\ \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\n \\\"\n by (typecheck_cfuncs, smt (verit, best) cfunc_prod_comp comp_associative2 nsm_type)\n also have \"... = OR \\\\<^sub>c \\\n leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\ ,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\\ ,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,successor \\\\<^sub>c m\\\\ \n \\\"\n using cfunc_prod_comp nsm_type by (typecheck_cfuncs, force)\n also have \"... = OR \\\\<^sub>c \\ leq \\\\<^sub>c \\n, successor \\\\<^sub>c m\\, leq \\\\<^sub>c \\ successor \\\\<^sub>c m, n\\\\\"\n using left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod by (typecheck_cfuncs, force)\n also have \"... = OR \\\\<^sub>c \\ leq \\\\<^sub>c \\n, m\\, leq \\\\<^sub>c \\ m, n\\\\\"\n using OR_true_right_is_true main_inequality comp_type leq_type m_def m_leq_n x_is by presburger\n also have \"... = OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c \\\\<^sub>c \\n,m\\,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\n,m\\\\\\\"\n by (typecheck_cfuncs, metis left_cart_proj_cfunc_prod m_def right_cart_proj_cfunc_prod)\n also have \"... = OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\ \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2 m_def x_is)\n also have \"... = (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\) \\\\<^sub>c \\n,m\\\"\n by (typecheck_cfuncs, meson comp_associative2 m_def)\n \n \n also have \"... = (eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n \\n,m\\\"\n using transpose_func_def by (typecheck_cfuncs, presburger)\n \n also have \"... = (eval_func \\ \\\\<^sub>c \\\\<^sub>c\n id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c\n \\leq \\\\<^sub>c\n \\left_cart_proj \\\\<^sub>c\n \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c\n \\n,m\\\"\n using id_left_unit2 by (typecheck_cfuncs, presburger)\n then show ?thesis\n by (simp add: calculation)\n qed\n qed\n\n\n\n \n\n\n show \"(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c\n successor) \\\\<^sub>c x =\n (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c\n (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\n leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c x\"\n using \\(eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\ \\\\<^sub>c successor) \\\\<^sub>c \\n,m\\ = (eval_func \\ \\\\<^sub>c \\\\<^sub>c id\\<^sub>c \\\\<^sub>c \\\\<^sub>f id\\<^sub>c (\\\\<^bsup>\\\\<^sub>c\\<^esup>) \\\\<^sub>c (OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\)\\<^sup>\\) \\\\<^sub>c \\n,m\\\\ m_def by force\n \n qed\n\n qed\n\n qed\n qed\n\nhave flat_main_result: \"(OR \\\\<^sub>c \\\nleq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c, right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\nleq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c, left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\n\\) = (\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\\\<^sub>c\\\\<^sub>c\\<^esub>)\"\n by (typecheck_cfuncs, metis main_result transpose_func_def)\n\n\n have \"(\\ \\\\<^sub>c \\\\<^bsub>\\\\<^sub>c\\\\<^sub>c\\\\<^sub>c\\<^esub>) \\\\<^sub>c \\m,n\\ = \\\" \n using assms by (typecheck_cfuncs, smt comp_associative2 id_right_unit2 id_type one_unique_element terminal_func_comp terminal_func_type)\n then have \"(OR \\\\<^sub>c \\\nleq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c, right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\nleq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c, left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\n\\) \\\\<^sub>c \\m,n\\ = \\\"\n by (simp add: flat_main_result) \n have \"(OR \\\\<^sub>c \\\nleq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c, right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,\nleq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c, left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\n\\) \\\\<^sub>c \\m,n\\ = \nOR \\\\<^sub>c \\\nleq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\ , right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\\\,\nleq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\, left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\\\\n\\\"\n using assms by (typecheck_cfuncs , smt cfunc_prod_comp comp_associative2)\n also have \"... = OR \\\\<^sub>c \\ leq \\\\<^sub>c \\m , n\\, leq \\\\<^sub>c \\n, m\\\\\"\n using left_cart_proj_cfunc_prod m_type n_type right_cart_proj_cfunc_prod by auto\n\n then have \"OR \\\\<^sub>c \\ leq \\\\<^sub>c \\m , n\\, leq \\\\<^sub>c \\n, m\\\\ = \\\"\n using \\(OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c,right_cart_proj \\\\<^sub>c \\\\<^sub>c\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c,left_cart_proj \\\\<^sub>c \\\\<^sub>c\\\\) \\\\<^sub>c \\m,n\\ = \\\\ \\OR \\\\<^sub>c \\leq \\\\<^sub>c \\left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\,right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\\\,leq \\\\<^sub>c \\right_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\,left_cart_proj \\\\<^sub>c \\\\<^sub>c \\\\<^sub>c \\m,n\\\\\\ = OR \\\\<^sub>c \\leq \\\\<^sub>c \\m,n\\,leq \\\\<^sub>c \\n,m\\\\\\ calculation by presburger\n\n then show ?thesis\n using OR_true_implies_one_is_true cfunc_prod_type comp_type leq_type m_type n_type by blast\nqed\n\n\n\n\n\nend", "meta": {"author": "jameseb7", "repo": "Isabelle-ETCS", "sha": "ae81dc674faf7cca62b30ac53888b3d319160849", "save_path": "github-repos/isabelle/jameseb7-Isabelle-ETCS", "path": "github-repos/isabelle/jameseb7-Isabelle-ETCS/Isabelle-ETCS-ae81dc674faf7cca62b30ac53888b3d319160849/ETCS_Comparison.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.2834870708261469}} {"text": "theory Balance\n imports \n \"../Utilities\"\n Balance_Adapted\nbegin\n\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\n\nsubsection \\Checks\\\n\n\ndefinition \"check_1 lhs_p rhs_p \\ is_red lhs_p &&! is_red rhs_p\"\ndefinition \"check_2 lhs_p rhs_p \\ is_red lhs_p &&! (do {l \\ left lhs_p; is_red l})\"\ndefinition \"check_3 lhs_p rhs_p \\ is_red lhs_p &&! (do {r \\ right lhs_p; is_red r})\"\ndefinition \"check_4 lhs_p rhs_p \\ is_red rhs_p &&! (do {r \\ right rhs_p; is_red r})\"\ndefinition \"check_5 lhs_p rhs_p \\ is_red rhs_p &&! (do {l \\ left rhs_p; is_red l})\"\n\n\nlemma check_1_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi)\n (check_1 lhsi rhsi)\n (\\r. rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\bool.assn(rbt_check_1 lhs rhs) r)\n \"\n unfolding rbt_check_1_def check_1_def sc_and_def\n apply vcg \n unfolding rbt_is_red_def\n apply vcg\n done\n\n\nlemma check_2_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi)\n (check_2 lhsi rhsi)\n (\\r. rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\bool.assn (rbt_check_2 lhs rhs) r)\n \"\n unfolding rbt_check_2_def check_2_def sc_and_def\n apply vcg\n subgoal\n unfolding rbt_is_red_def rbt_left_def\n apply vcg_try_solve\n done \n subgoal by vcg\n done\n\n\nlemma check_3_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi)\n (check_3 lhsi rhsi)\n (\\r. rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\bool.assn(rbt_check_3 lhs rhs) r)\n \"\n unfolding rbt_check_3_def check_3_def sc_and_def\n apply vcg\n subgoal\n unfolding rbt_is_red_def rbt_right_def\n apply vcg_try_solve\n done \n subgoal by vcg\n done\n\n\nlemma check_4_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi)\n (check_4 lhsi rhsi)\n (\\r. rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\bool.assn(rbt_check_4 lhs rhs) r)\n \"\n unfolding rbt_check_4_def check_4_def sc_and_def\n apply vcg\n subgoal\n unfolding rbt_is_red_def rbt_right_def\n apply vcg_try_solve\n done \n subgoal by vcg\n done\n\n\nlemma check_5_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi)\n (check_5 lhsi rhsi)\n (\\r. rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\bool.assn(rbt_check_5 lhs rhs) r)\n \"\n unfolding rbt_check_5_def check_5_def sc_and_def\n apply vcg\n subgoal\n unfolding rbt_is_red_def rbt_left_def\n apply vcg_try_solve\n done \n subgoal by vcg\n done\n\n\nlemmas [llvm_inline] = \n check_1_def \n check_2_def\n check_3_def\n check_4_def\n check_5_def\n\n\nsubsection \\Balance Cases\\\n\n\ndefinition \"balance_ad_case_1 lhs_p k v rhs_p \\ do {\n set_color_p 1 lhs_p;\n set_color_p 1 rhs_p;\n new (RBT_NODE 0 lhs_p k v rhs_p)\n}\"\n\nthm set_color_p_def[simplified mod_ptr_def]\nschematic_goal \"set_color_p color node_ptr = X ?X\"\n unfolding set_color_p_def mod_ptr_def\n apply simp\n oops\n\nlemma balance_ad_case_1_correct [vcg_rules]:\n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi ** \\(rbt_check_1 lhs rhs))\n (balance_ad_case_1 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_1 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_1_def rbt_balance_ad_case_1_def new_def\n apply vcg\n apply (erule rbt_check_1_unfold)\n apply vcg\n done\n\n\ndefinition \"balance_ad_case_2 lhs_p k v rhs_p \\ do {\n lhs \\ ll_load lhs_p;\n case lhs of (RBT_NODE _ llhs_p s t c) \\\n do {\n llhs \\ ll_load llhs_p;\n case llhs of (RBT_NODE _ a w x b) \\\n let y = k; z = v; d = rhs_p in\n do {\n ll_free lhs_p;\n ll_free llhs_p;\n lhs_n \\ new (RBT_NODE 1 a w x b);\n rhs_n \\ new (RBT_NODE 1 c y z d);\n new (RBT_NODE 0 lhs_n s t rhs_n)\n }\n }\n}\"\n\n\nlemma balance_ad_case_2_correct [vcg_rules]: \n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi ** \\(rbt_check_2 lhs rhs))\n (balance_ad_case_2 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_2 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_2_def rbt_balance_ad_case_2_def new_def\n apply vcg\n apply (erule rbt_check_2_unfold)\n apply vcg\n done\n\nfind_theorems rbt_assn is_rbt\n\n\ndefinition \"balance_ad_case_3 lhs_p k v rhs_p \\ do {\n lhs \\ ll_load lhs_p;\n case lhs of (RBT_NODE _ a w x rlhs_p) \\\n do {\n rlhs \\ ll_load rlhs_p;\n case rlhs of (RBT_NODE _ b s t c) \\\n let y = k; z = v; d = rhs_p in\n do {\n ll_free lhs_p;\n ll_free rlhs_p;\n lhs_n \\ new (RBT_NODE 1 a w x b);\n rhs_n \\ new (RBT_NODE 1 c y z d);\n new (RBT_NODE 0 lhs_n s t rhs_n)\n }\n }\n}\"\n\n\nlemma balance_ad_case_3_correct [vcg_rules]: \n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi ** \\(rbt_check_3 lhs rhs))\n (balance_ad_case_3 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_3 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_3_def rbt_balance_ad_case_3_def new_def\n apply vcg\n apply (erule rbt_check_3_unfold)\n apply vcg\n done\n\n\ndefinition \"balance_ad_case_4 l_p k v r_p \\ do {\n let a=l_p; w=k; x=v in\n do { \n r \\ ll_load r_p;\n case r of (RBT_NODE _ b s t rr_p) \\ \n do {\n rr \\ ll_load rr_p;\n case rr of (RBT_NODE _ c y z d) \\ \n do {\n ll_free r_p;\n ll_free rr_p;\n lhs_n \\ new (RBT_NODE 1 a w x b);\n rhs_n \\ new (RBT_NODE 1 c y z d);\n new (RBT_NODE 0 lhs_n s t rhs_n)\n }\n }\n }\n}\"\n\n\nlemma balance_ad_case_4_correct [vcg_rules]: \n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi ** \\(rbt_check_4 lhs rhs))\n (balance_ad_case_4 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_4 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_4_def rbt_balance_ad_case_4_def new_def\n apply vcg\n apply (erule rbt_check_4_unfold)\n apply vcg\n done\n\n\ndefinition \"balance_ad_case_5 l_p k v r_p \\ do {\n let a=l_p; w=k; x=v in\n do { \n r \\ ll_load r_p;\n case r of (RBT_NODE _ rl_p y z d) \\ \n do {\n rl \\ ll_load rl_p;\n case rl of (RBT_NODE _ b s t c) \\ \n do {\n ll_free r_p;\n ll_free rl_p;\n lhs_n \\ new (RBT_NODE 1 a w x b);\n rhs_n \\ new (RBT_NODE 1 c y z d);\n new (RBT_NODE 0 lhs_n s t rhs_n)\n }\n }\n }\n}\"\n\n\nlemma balance_ad_case_5_correct [vcg_rules]: \n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi ** \\(rbt_check_5 lhs rhs))\n (balance_ad_case_5 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_5 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_5_def rbt_balance_ad_case_5_def new_def\n apply vcg\n apply (erule rbt_check_5_unfold)\n apply vcg\n done\n\n \ndefinition \"balance_ad_case_6 l_p k v r_p \\ new (RBT_NODE 1 l_p k v r_p)\"\n\n\nlemma balance_ad_case_6_correct [vcg_rules]: \n \"\n llvm_htriple\n (rbt_assn lhs lhsi ** rbt_assn rhs rhsi ** \\key_assn k ki ** \\value_assn v vi)\n (balance_ad_case_6 lhsi ki vi rhsi)\n (\\r. rbt_assn (rbt_balance_ad_case_6 lhs k v rhs) r)\n \"\n unfolding balance_ad_case_6_def rbt_balance_ad_case_6_def\n by vcg\n\n\nlemmas [llvm_code] = \n balance_ad_case_1_def\n balance_ad_case_2_def\n balance_ad_case_3_def\n balance_ad_case_4_def\n balance_ad_case_5_def\n balance_ad_case_6_def\n\n\nsubsection \\Balance Function\\\n\n\ndefinition balance ::\n \"('ki, 'vi) rbti \\ 'ki \\ 'vi \\ ('ki, 'vi) rbti \\ ('ki, 'vi) rbti llM\" where\n \"balance lhs_p k v rhs_p = do {\n if! check_1 lhs_p rhs_p\n then! balance_ad_case_1 lhs_p k v rhs_p\n else! if! check_2 lhs_p rhs_p\n then! balance_ad_case_2 lhs_p k v rhs_p\n else! if! check_3 lhs_p rhs_p\n then! balance_ad_case_3 lhs_p k v rhs_p\n else! if! check_4 lhs_p rhs_p\n then! balance_ad_case_4 lhs_p k v rhs_p\n else! if! check_5 lhs_p rhs_p\n then! balance_ad_case_5 lhs_p k v rhs_p\n else! balance_ad_case_6 lhs_p k v rhs_p\n }\"\n\n\nlemmas [llvm_code] = balance_def\n\n\nlemma balance_correct':\n \"llvm_htriple\n (\n rbt_assn tree_l tree_li **\n rbt_assn tree_r tree_ri ** \n \\key_assn k ki **\n \\value_assn v vi\n )\n (balance tree_li ki vi tree_ri)\n (\\ri. rbt_assn (rbt_balance_ad tree_l k v tree_r) ri) \n \"\n unfolding balance_def\n by vcg\n\n\nlemma balance_correct [vcg_rules]:\n \"llvm_htriple\n (\n rbt_assn l li **\n rbt_assn r ri ** \n \\key_assn k ki **\n \\value_assn v vi\n )\n (balance li ki vi ri)\n (\\res. rbt_assn (rbt_balance l k v r) res) \n \"\n by (metis balance_correct' rbt_balance_ad_correct)\n\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Insert/Balance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.28328421511547436}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Crunch_Test_NonDet\nimports\n Lib.Crunch_Instances_NonDet\n Crunch_Test_Qualified_NonDet\n Lib.GenericLib\n Lib.Defs\nbegin\n\ntext \\Test cases for crunch\\\n\ndefinition\n \"crunch_foo1 (x :: nat) \\ do\n modify ((+) x);\n modify ((+) x)\n od\"\n\ndefinition\n \"crunch_foo2 \\ do\n crunch_foo1 12;\n crunch_foo1 13\n od\"\n\ncrunch (empty_fail) empty_fail: crunch_foo2\n (ignore: modify bind)\n\ncrunch_ignore (add: crunch_foo1)\n\ncrunch gt: crunch_foo2 \"\\x. x > y\"\n (ignore: modify bind ignore_del: crunch_foo1)\n\ncrunch_ignore (del: crunch_foo1)\n\ndefinition\n \"crunch_always_true (x :: nat) \\ \\y :: nat. True\"\n\nlemma crunch_foo1_at_2:\n \"True \\ \\crunch_always_true 3 and crunch_always_true 2\\\n crunch_foo1 x \\\\rv. crunch_always_true 2 and K True\\\"\n by (simp add: crunch_always_true_def, wp)\n\nlemma crunch_foo1_at_2':\n \"True \\ \\crunch_always_true 3 and crunch_always_true 2\\\n crunch_foo1 x \\\\rv. crunch_always_true 3\\\"\n by (simp add: crunch_always_true_def, wp)\n\nlemma crunch_foo1_at_3[wp]:\n \"\\crunch_always_true 3\\ crunch_foo1 x \\\\rv. crunch_always_true 3\\\"\n by (simp add: crunch_always_true_def, wp)\n\nlemma crunch_foo1_no_fail:\n \"True \\ no_fail (crunch_always_true 2 and crunch_always_true 3) (crunch_foo1 x)\"\n apply (simp add:crunch_always_true_def crunch_foo1_def)\n apply (rule no_fail_pre)\n apply (wp, simp)\n done\n\ncrunch (no_fail) no_fail: crunch_foo2\n (ignore: modify bind wp: crunch_foo1_at_2[simplified])\n\ncrunch (valid) at_2': crunch_foo2 \"crunch_always_true 2\"\n (ignore: modify bind wp: crunch_foo1_at_2[simplified])\n\nfun crunch_foo3 :: \"nat => nat => 'a => (nat,unit) nondet_monad\" where\n \"crunch_foo3 0 x _ = crunch_foo1 x\"\n| \"crunch_foo3 (Suc n) x y = crunch_foo3 n x y\"\n\ncrunch gt2: crunch_foo3 \"\\x. x > y\"\n (ignore: modify bind)\n\ncrunch (empty_fail) empty_fail2: crunch_foo3\n (ignore: modify bind)\n\nclass foo_class =\n fixes stuff :: 'a\nbegin\n\nfun crunch_foo4 :: \"nat => nat => 'a => (nat,unit) nondet_monad\" where\n \"crunch_foo4 0 x _ s = crunch_foo1 x s\"\n| \"crunch_foo4 (Suc n) x y s = crunch_foo4 n x y s\"\n\ndefinition\n \"crunch_foo5 x (y::'a) \\ crunch_foo1 x\"\n\nend\n\nlemma crunch_foo4_alt:\n \"crunch_foo4 n x y \\ crunch_foo1 x\"\n apply (induct n)\n apply (simp add: fun_eq_iff)+\n done\n\n(* prove rules about crunch_foo4 with and without the alternative definition *)\ncrunch gt3: crunch_foo4 \"\\x. x > y\"\n (ignore: modify bind)\n\ncrunch (no_fail) no_fail2: crunch_foo4\n (rule: crunch_foo4_alt ignore: modify bind)\n\ncrunch gt3: crunch_foo4 \"\\x. x > y\"\n (rule: crunch_foo4_alt ignore: modify bind)\n\ncrunch gt4: crunch_foo5 \"\\x. x > y\"\n (ignore: modify bind)\n\n(* Test cases for crunch in locales *)\n\ndefinition\n \"crunch_foo6 \\ return () >>= (\\_. return ())\"\n\nlocale test_locale =\nfixes fixed_return_unit :: \"(unit, unit) nondet_monad\"\n\nbegin\n\ndefinition\n \"crunch_foo7 \\ return () >>= (\\_. return ())\"\n\n(* crunch works on a global constant within a locale *)\ncrunch test[wp]: crunch_foo6 P\n(ignore: bind)\n\n(* crunch works on a locale constant *)\ncrunch test[wp]: crunch_foo7 P\n(ignore: bind)\n\ndefinition\n \"crunch_foo8 \\ fixed_return_unit >>= (\\_. fixed_return_unit)\"\n\ndefinition\n \"crunch_foo9 (x :: nat) \\ do\n modify ((+) x);\n modify ((+) x)\n od\"\n\ncrunch test: crunch_foo9 \"\\x. x > y\" (ignore: bind)\n\ndefinition\n \"crunch_foo10 (x :: nat) \\ do\n modify ((+) x);\n modify ((+) x)\n od\"\n\n(*crunch_def attribute overrides definition lookup *)\n\nlemma crunch_foo10_def2[crunch_def]:\n \"crunch_foo10 = crunch_foo9\"\n unfolding crunch_foo10_def[abs_def] crunch_foo9_def[abs_def]\n by simp\n\ncrunch test[wp]: crunch_foo10 \"\\x. x > y\"\n\n(* crunch_ignore works within a locale *)\ncrunch_ignore (add: bind)\n\ncrunch test': crunch_foo9 \"\\x. x > y\"\n\nend\n\ninterpretation test_locale \"return ()\" .\n\n(* interpretation promotes the wp attribute from the locale *)\nlemma \"\\Q\\ crunch_foo7 \\\\_. Q\\\" by wp\n\n(* crunch still works on an interpreted locale constant *)\ncrunch test2: crunch_foo7 P\n (wp_del: crunch_foo7_test)\n\nlocale test_sublocale\n\nsublocale test_sublocale < test_locale \"return ()\" .\n\ncontext test_sublocale begin\n\n(* crunch works on a locale constant with a fixed locale parameter *)\ncrunch test[wp]: crunch_foo8 P\n\nend\n\n(* check that qualified names are handled properly. *)\n\nconsts foo_const :: \"(unit, unit) nondet_monad\"\ndefs foo_const_def: \"foo_const \\ Crunch_Test_Qualified_NonDet.foo_const\"\n\ncrunch test: foo_const P\n\n(* check that the grid-style crunch is working *)\n\ncrunches crunch_foo3, crunch_foo4, crunch_foo5\n for silly: \"\\s. True \\ False\" and (no_fail)nf and (empty_fail)ef\n (ignore: modify bind rule: crunch_foo4_alt wp_del: hoare_vcg_prop)\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/lib/Crunch_Test_NonDet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.28328420772280083}} {"text": "(* Title: JinjaDCI/Compiler/Compiler1.thy\n Author: Tobias Nipkow, Susannah Mansky\n Copyright TUM 2003, UIUC 2019-20\n\n Based on the Jinja theory Compiler/Compiler1.thy by Tobias Nipkow\n*)\n\nsection \\ Compilation Stage 1 \\\n\ntheory Compiler1 imports PCompiler J1 Hidden begin\n\ntext\\ Replacing variable names by indices. \\\n\nprimrec compE\\<^sub>1 :: \"vname list \\ expr \\ expr\\<^sub>1\"\n and compEs\\<^sub>1 :: \"vname list \\ expr list \\ expr\\<^sub>1 list\" where\n \"compE\\<^sub>1 Vs (new C) = new C\"\n| \"compE\\<^sub>1 Vs (Cast C e) = Cast C (compE\\<^sub>1 Vs e)\"\n| \"compE\\<^sub>1 Vs (Val v) = Val v\"\n| \"compE\\<^sub>1 Vs (e\\<^sub>1 \\bop\\ e\\<^sub>2) = (compE\\<^sub>1 Vs e\\<^sub>1) \\bop\\ (compE\\<^sub>1 Vs e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (Var V) = Var(last_index Vs V)\"\n| \"compE\\<^sub>1 Vs (V:=e) = (last_index Vs V):= (compE\\<^sub>1 Vs e)\"\n| \"compE\\<^sub>1 Vs (e\\F{D}) = (compE\\<^sub>1 Vs e)\\F{D}\"\n| \"compE\\<^sub>1 Vs (C\\\\<^sub>sF{D}) = C\\\\<^sub>sF{D}\"\n| \"compE\\<^sub>1 Vs (e\\<^sub>1\\F{D}:=e\\<^sub>2) = (compE\\<^sub>1 Vs e\\<^sub>1)\\F{D} := (compE\\<^sub>1 Vs e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (C\\\\<^sub>sF{D}:=e\\<^sub>2) = C\\\\<^sub>sF{D} := (compE\\<^sub>1 Vs e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (e\\M(es)) = (compE\\<^sub>1 Vs e)\\M(compEs\\<^sub>1 Vs es)\"\n| \"compE\\<^sub>1 Vs (C\\\\<^sub>sM(es)) = C\\\\<^sub>sM(compEs\\<^sub>1 Vs es)\"\n| \"compE\\<^sub>1 Vs {V:T; e} = {(size Vs):T; compE\\<^sub>1 (Vs@[V]) e}\"\n| \"compE\\<^sub>1 Vs (e\\<^sub>1;;e\\<^sub>2) = (compE\\<^sub>1 Vs e\\<^sub>1);;(compE\\<^sub>1 Vs e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (if (e) e\\<^sub>1 else e\\<^sub>2) = if (compE\\<^sub>1 Vs e) (compE\\<^sub>1 Vs e\\<^sub>1) else (compE\\<^sub>1 Vs e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (while (e) c) = while (compE\\<^sub>1 Vs e) (compE\\<^sub>1 Vs c)\"\n| \"compE\\<^sub>1 Vs (throw e) = throw (compE\\<^sub>1 Vs e)\"\n| \"compE\\<^sub>1 Vs (try e\\<^sub>1 catch(C V) e\\<^sub>2) =\n try(compE\\<^sub>1 Vs e\\<^sub>1) catch(C (size Vs)) (compE\\<^sub>1 (Vs@[V]) e\\<^sub>2)\"\n| \"compE\\<^sub>1 Vs (INIT C (Cs,b) \\ e) = INIT C (Cs,b) \\ (compE\\<^sub>1 Vs e)\"\n| \"compE\\<^sub>1 Vs (RI(C,e);Cs \\ e') = RI(C,(compE\\<^sub>1 Vs e));Cs \\ (compE\\<^sub>1 Vs e')\"\n\n| \"compEs\\<^sub>1 Vs [] = []\"\n| \"compEs\\<^sub>1 Vs (e#es) = compE\\<^sub>1 Vs e # compEs\\<^sub>1 Vs es\"\n\n\n\nlemma [simp]: \"\\Vs. sub_RI (compE\\<^sub>1 Vs e) = sub_RI e\"\n and [simp]: \"\\Vs. sub_RIs (compEs\\<^sub>1 Vs es) = sub_RIs es\"\nproof(induct rule: sub_RI_sub_RIs_induct) qed(auto)\n\nprimrec fin\\<^sub>1:: \"expr \\ expr\\<^sub>1\" where\n \"fin\\<^sub>1(Val v) = Val v\"\n| \"fin\\<^sub>1(throw e) = throw(fin\\<^sub>1 e)\"\n\nlemma comp_final: \"final e \\ compE\\<^sub>1 Vs e = fin\\<^sub>1 e\"\n(*<*)by(erule finalE, simp_all)(*>*)\n\n\nlemma [simp]:\n \"\\Vs. max_vars (compE\\<^sub>1 Vs e) = max_vars e\"\nand \"\\Vs. max_varss (compEs\\<^sub>1 Vs es) = max_varss es\"\n(*<*)by (induct e and es rule: max_vars.induct max_varss.induct) simp_all(*>*)\n\n\ntext\\ Compiling programs: \\\n\ndefinition compP\\<^sub>1 :: \"J_prog \\ J\\<^sub>1_prog\"\nwhere\n \"compP\\<^sub>1 \\ compP (\\b (pns,body). compE\\<^sub>1 (case b of NonStatic \\ this#pns | Static \\ pns) body)\"\n\n(*<*)\ndeclare compP\\<^sub>1_def[simp]\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Compiler/Compiler1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621764862150636, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2832842003301271}} {"text": "section \\Examples for infixl seq (;;)\\\n\ntheory examples_infixl_seq\n imports \"../../../hoare/HoareLogic/TotalCorrectness/Abrupt/utp_hoare_total\"\nbegin\n\ntext \\Burkhart Wolff suggests infixl rather than infixr (like how seL4 does it)\\\nno_notation useq (infixr \";;\" 51)\nnotation useq (infixl \";;\" 51)\n\ntext \\Variable swapping\\\n\nlemma swap_test1:\n assumes \"weak_lens x\" and \"weak_lens y\" and \"weak_lens z\"\n and \"x \\ y\" and \"x \\ z\" and \"y \\ z\"\n shows \"\\&x =\\<^sub>u \\a\\ \\ &y =\\<^sub>u \\b\\\\\n z \\ &x;;\n x \\ &y;;\n y \\ &z\n \\&x =\\<^sub>u \\b\\ \\ &y =\\<^sub>u \\a\\\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (insert assms)\n apply (rule seq_hoare_r_t)\n apply (rule seq_hoare_r_t)\n defer\n apply (rule assigns_abr_hoare_r'_t)\n apply (rule assigns_abr_hoare_r'_t)\n apply (rule assigns_abr_hoare_r_t)\n apply pred_simp\n apply (simp add: lens_indep_sym)\n done\n\nlemma swap_test2:\n assumes \"weak_lens x\" and \"weak_lens y\" and \"weak_lens z\"\n and \"x \\ y\" and \"x \\ z\" and \"y \\ z\"\n shows \"\\&x =\\<^sub>u \\a\\ \\ &y =\\<^sub>u \\b\\\\\n z \\ &x;;\n x \\ &y;;\n y \\ &z\n \\&x =\\<^sub>u \\b\\ \\ &y =\\<^sub>u \\a\\\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (insert assms)\n apply (rule seq_hoare_r_t)\n defer\n apply (rule assigns_abr_hoare_r'_t)\n apply (rule seq_hoare_r_t)\n defer\n apply (rule assigns_abr_hoare_r'_t)\n apply (rule assigns_abr_hoare_r_t)\n apply pred_simp\n apply (simp add: lens_indep_sym)\n done\n\nsubsection \\Adding in loops\\\n\nlemma increment:\n assumes \"vwb_lens x\" and \"x \\ y\"\n shows\n \"\\&y =\\<^sub>u \\5::int\\\\\n x \\ 0;;\n (&x =\\<^sub>u 0 \\ &y =\\<^sub>u 5)\\<^sup>\\\\<^sup>C;;\n while &x <\\<^sub>u &y\n invr &x \\\\<^sub>u &y \\ &y =\\<^sub>u 5\n do x \\ &x + 1 od\n \\&x =\\<^sub>u 5\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (insert assms)\n apply (rule seq_hoare_r_t)\n apply (rule seq_hoare_r_t[of _ _ true])\n apply (rule assigns_abr_hoare_r_t)\n apply pred_auto\n apply (rule assume_hoare_r_t)\n apply (rule skip_abr_hoare_r_t)\n apply rel_auto\n apply (rule while_invr_hoare_r_t)\n apply (rule assigns_abr_hoare_r_t)\n unfolding lens_indep_def\n apply pred_auto\n apply pred_auto\n apply pred_auto\n done\n\nlemma increment2:\n assumes \"vwb_lens x\" and \"x \\ y\"\n shows\n \"\\&y =\\<^sub>u \\5::int\\\\\n x \\ 0;;\n (&x =\\<^sub>u 0 \\ &y =\\<^sub>u 5)\\<^sup>\\\\<^sup>C;;\n while &x <\\<^sub>u &y\n invr &x \\\\<^sub>u &y \\ &y =\\<^sub>u 5\n do x \\ &x + 1 od\n \\&x =\\<^sub>u 5\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (insert assms)\n apply (rule seq_hoare_r_t)\n defer\n apply (rule while_invr_hoare_r_t)\n apply (rule assigns_abr_hoare_r_t)\n unfolding lens_indep_def\n apply pred_auto\n defer\n apply pred_auto\n apply (rule seq_hoare_r_t)\n defer\n apply (rule assume_hoare_r_t)\n apply (rule skip_abr_hoare_r_t)\n apply rel_auto\n apply pred_auto\n apply (rule assigns_abr_hoare_r_t)\n apply pred_auto\n oops (* (rule seq_hoare_r_t[of _ _ true]) is necessary to instantiate ?s27 *)\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/examples/TotalCorrectness/Abrupt/examples_infixl_seq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621764862150634, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.283284200330127}} {"text": "section \\ Events for Reactive Processes \\\n\ntheory utp_rea_event\nimports \"UTP1.utp\"\nbegin\n\nsubsection \\ Events \\\n\ntext \\ Events of some type @{typ \"'\\\"} are just the elements of that type. \\\n\ntype_synonym '\\ event = \"'\\\"\n\nsubsection \\ Channels \\\n\ntext \\\n Typed channels are modelled as prisms. Below, @{typ \"'a\"} determines the\n channel type and @{typ \"'\\\"} the underlying event alphabet type. As with values, it\n is difficult to introduce channels as monomorphic types due to the fact that\n they can have arbitrary parametrisations in term of @{typ \"'a\"}. Applying a\n channel to an element of its type yields an event, as we may expect. Though\n this is not formalised here, we may also sensibly assume that all channel-\n representing functions are injective.\n\\\n\ntype_synonym ('a, '\\) chan = \"'a \\\\<^sub>\\ '\\ event\"\n\ntext \\\n A downside of the approach is that the event type @{typ \"'\\\"} must be able\n to encode \\emph{all} events of a process model, and hence cannot be fixed\n upfront for a single channel or channel set. To do so, we actually require\n a notion of `extensible' datatypes, in analogy to extensible record types.\n Another solution is to encode a notion of channel scoping that namely uses\n @{type sum} types to lift channel types into extensible ones, that is using\n channel-set specific scoping operators. This is a current work in progress.\n\\\n\nsubsubsection \\ Operators \\\n\ntext \\\n The next lifted function creates an expression that yields a channel event,\n from an expression on the channel type @{typ \"'a\"}.\n\\\n\ndefinition chan_apply ::\n \"('a, '\\) chan \\ ('a, '\\) uexpr \\ ('\\ event, '\\) uexpr\" (\"'(_\\/_')\\<^sub>u\") where\n[upred_defs]: \"(c\\e)\\<^sub>u = uop (build\\<^bsub>c\\<^esub>) e\"\n\nno_utp_lift chan_apply (0)\n\nlemma unrest_chan_apply [unrest]: \"x \\ e \\ x \\ (c\\e)\\<^sub>u\"\n by (rel_auto)\n\nlemma usubst_chan_apply [usubst]: \"\\ \\ (c\\v)\\<^sub>u = (c\\\\ \\ v)\\<^sub>u\"\n by (rel_auto)\n\nlemma msubst_event [usubst]:\n \"(c\\v x)\\<^sub>u\\x\\u\\ = (c\\(v x)\\x\\u\\)\\<^sub>u\"\n by (pred_simp)\n\nlemma msubst_event_2 [usubst]:\n \"(c\\v x y)\\<^sub>u\\(x,y)\\u\\ = (c\\(v x y)\\(x,y)\\u\\)\\<^sub>u\"\n by (pred_simp)+\n\nlemma aext_event [alpha]: \"(c\\v)\\<^sub>u \\\\<^sub>p a = (c\\v \\\\<^sub>p a)\\<^sub>u\"\n by (pred_auto)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/reactive/utp_rea_event.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2831175827719284}} {"text": "theory dADemo\n\nimports dAutomaton_causal\n\nbegin\n\nsection \\ flasher port chans \\\n\ntypedef botChan =\"{SOME c. c\\cEmpty}\"\n by simp\n\ntypedef flasherPortIn = \"{SOME c. c\\cEmpty}\"\n apply auto\n done\n\n\ntypedef flasherPortOut = \"{SOME c. c\\cEmpty \\ c\\range(Rep_flasherPortIn)}\"\n apply auto\n done\n\ninstantiation flasherPortIn::chan\nbegin\ndefinition \"Rep = Rep_flasherPortIn\"\ninstance\n apply(standard)\n apply (smt Int_lower1 Rep_flasherPortIn_def inf.orderI subset_singletonD type_definition.Rep_range type_definition_flasherPortIn)\n by (simp add: Rep_flasherPortIn_def Rep_flasherPortIn_inject inj_on_def)\nend\n\ninstance flasherPortIn::finite\n apply(intro_classes)\n apply (subst UNIV_def)\n by (metis (full_types) Abs_flasherPortIn_cases Collect_const ex_new_if_finite finite.emptyI finite_insert insert_iff singletonD)\n\ninstantiation flasherPortOut::chan\nbegin\ndefinition \"Rep = Rep_flasherPortOut\"\ninstance\n apply(standard) \n apply (smt Int_lower1 Rep_flasherPortOut_def inf_commute subset_singletonD type_definition.Rep_range type_definition_flasherPortOut)\n by (smt Rep_flasherPortOut_def Rep_flasherPortOut_inject injI)\nend\n\ninstantiation botChan::chan\nbegin\ndefinition \"Rep = Rep_botChan\"\ninstance\n apply(standard)\n apply (smt Int_lower1 Rep_botChan_def inf_commute subset_singletonD type_definition.Rep_range type_definition_botChan)\n by (simp add: Rep_botChan_def Rep_botChan_inject inj_on_def)\nend\n\nlift_definition Nonesbe::\"botChan sbElem\" is (*Does not work for undefined ctype*)\n\"None\"\n apply(simp)\n using Rep_botChan Rep_botChan_def sorry\n\nsection \\flasher states\\\n\ndatatype flasherState = S\n\nsection \\flasher automaton definition\\\n\ndefinition flasherAutomatonw::\"(flasherState,flasherPortIn,flasherPortOut,botChan) dAutomaton_weak\" where\n\"flasherAutomatonw =(| dawTransition =(\\s sbe. (s,Abs_sbElem(Some (\\c. sbegetch c sbe)))), \n dawInitState = S, dawInitOut = Nonesbe |)\"\n\ndefinition flasherAutomatons::\"(flasherState,flasherPortIn,flasherPortOut) dAutomaton_strong\" where\n\"flasherAutomatons =(| dawTransition =(\\s sbe. (s,Abs_sbElem(Some (\\c. sbegetch c sbe)))), \n dawInitState = S, dawInitOut = Abs_sbElem(Some (\\c. SOME m. True)) |)\"\n\nsection \\ flasher automat to spf\\\n\ndefinition flasherspfw::\"(flasherPortIn,flasherPortOut)spfw\"where\n\"flasherspfw = semantik_weak(flasherAutomatonw)\"\n\ndefinition flasherspfs::\"(flasherPortIn,flasherPortOut)spfs\"where\n\"flasherspfs = semantik_strong(flasherAutomatons)\"\n\nlemma dawinitout_genaut:\"daInitOut (daw2da auts) = sbe2sb\\(dawInitOut auts)\"\n by(simp add: daw2da_def)\n\nlemma semantik_strong_head:\"\\sb. (Rep_spfw (Rep_spfs (semantik_strong auts)))\\insb = sbe2sb\\(dawInitOut auts) \\\\<^sup>\\ sb\"\n apply(simp add: semantik_strong_def daSem_def dawinitout_genaut)\n sorry\n\ntheorem flasherhead:assumes \"B True \\ ctype c2\" shows\"shd (((Rep_spfw (Rep_spfs flasherspfs))\\sb) \\<^enum> (Abs c2)) = B True\"\n apply(simp add: flasherspfs_def)\n apply(insert semantik_strong_head[of flasherAutomatons sb])\n apply(simp add: flasherAutomatons_def)\n apply auto\n oops\n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/automatons/dADemo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.28301606994047906}} {"text": "theory ProcSendCase\n imports ResMapValid ReduceWTS ProcDef ProcCVars\nbegin\n \nlemma cancel_strong_leq_use_env: \"\\ strong_use_env r_x \\ \\ leq_use_env (diff_use_env r_x r_x) r_s\" \n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: strong_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma sfl_diff_use_env: \"\\ strong_use_env r_ex; leq_use_env r_ex r_s; is_own r \\ \\ diff_use_env r_s (diff_use_env (lift_use_env r_s r) r_ex) = r_ex\"\n apply (case_tac \"\\ x. diff_use_env r_s (diff_use_env (lift_use_env r_s r) r_ex) x = r_ex x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: is_own_def)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_ex x\")\n apply (auto) \n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \n (* the question right now is, how do we make these types line up? *)\n \nlemma safe_val_exp: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a))) v)) tau r_s2 rx;\n well_formed_delta env delta; env (Loc a) = Some (ChanTy t SEnd); is_value c; is_value v \\ \\\n well_typed env delta (np_dom_use_env env delta v) v t (np_dom_use_env env delta v) (np_dom_use_env env delta v)\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (case_tac \"t \\ t1\")\n apply (simp add: pure_fun_def)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"v\" and tau=\"t\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (simp_all)\n apply (rule_tac value_is_sexp)\n apply (auto)\n (* r = rb *)\n apply (case_tac \"rb \\ r\")\n apply (simp add: pure_fun_def)\n (* the idea is that the infl_sexp_wp requirements are strictly greater than np_dom. since np_dom is strong, there is an exact way of\n subtracting to get to np_dom. (we do cheat a little by lifting rx2). *)\n apply (rule_tac t=\"np_dom_use_env env delta v\" and s=\"diff_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3))\n (diff_use_env (lift_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)) rb) (np_dom_use_env env delta v))\" in subst)\n apply (rule_tac sfl_diff_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n (* to prove that the infl_sexp_wp reqs are greater than np_dom, we use the fact that any npv must have a permission *)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (auto)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (case_tac \"comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3) x \\ OwnPerm\")\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac x=\"x\" and env=\"env\" and e=\"v\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (cut_tac r_sa=\"lift_use_env rx2 r\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_no_own_both)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (simp add: is_own_def)\n apply (auto)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* with that in mind, we manipulate until we match the infl sexp lemma *)\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_req)\n apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n (* next, we must show that the differential is actually subtractible, which is true since it removes all non-prim vars *)\n apply (auto)\n apply (case_tac \"np_dom_use_env env delta v x \\ OwnPerm\")\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (cut_tac r_s=\"lift_use_env (comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)) r\" and\n r_ex=\"np_dom_use_env env delta v\" and x=\"x\" in diff_use_none_ex)\n apply (simp)\n apply (simp add: own_env_vars_def)\n done\n \n \nlemma safe_recv_exp: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (ConstExp RecvConst) (VarExp (LocType a)))) tau r_s2 rx;\n well_formed_delta env delta; env (Loc a) = Some (ChanTy t REnd); well_typed env delta r_x v t r_x r_x; disj_use_env r_s1 r_x; \n strong_use_env r_x; is_value c; is_value v; is_own r \\ \\\n well_typed env delta (comp_use_env r_s1 r_x) (app_hole h v) tau r_s2 rx\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_exa)\" and\n r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (Loc (delta a)) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"diff_use_env (comp_use_env r_s1 r_x) r_x\"\n and rx=\"diff_use_env r_x r_x\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac well_typed_comp_perms2)\n apply (simp add: pure_fun_def)\n apply (auto)\n apply (rule_tac comm_disj_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in disj_leq_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac cancel_strong_leq_use_env)\n apply (simp)\n (* lhs pair case. *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* rhs pair case. *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (simp_all)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_x\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case. *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case. *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* rhs pair case. *)\n apply (rule_tac x=\"comp_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (simp_all)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_x\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done\n \nlemma safe_own_npv_use: \"\\ well_typed env delta r_s1 (app_hole h (AppExp f v)) tau r_s2 rx; well_formed_delta env delta;\n is_value f; strong_fun f; a \\ NoRef; is_value v; x \\ non_prim_vars env delta v \\ \\ r_s1 x = OwnPerm\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n (* base case *)\n apply (cut_tac f=\"f\" and r=\"r\" in strong_fun_own)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"v\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (simp)\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"v\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (simp add: is_own_def)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* rhs pair *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done \n \n \nlemma safe_send_exp_ih: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) c) v)) tau r_s2 rx;\n well_formed_delta env delta; is_value c; is_value v \\ \\\n well_typed env delta r_s1 (app_hole h (ConstExp UnitConst)) tau r_s2 rx\" \n apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2b\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lhs app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto) \n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n done\n \n \nlemma safe_send_exp: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a))) v)) tau r_s2 rx;\n well_formed_delta env delta; sub_use_env s r_s1; wf_hole h; is_value v \\ \\\n well_typed env delta (diff_use_env r_s1 (np_dom_use_env env delta v)) (app_hole h (ConstExp UnitConst)) tau\n (diff_use_env r_s2 (np_dom_use_env env delta v)) (diff_use_env rx (np_dom_use_env env delta v))\" \n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac c=\"VarExp (LocType a)\" in safe_send_exp_ih)\n apply (auto)\n (* we want to show that if xa is in the dominator, it is not an np-var in h.\n > if xa is an np-var itself, it cannot be in e by lemma *)\n apply (case_tac \"x \\ non_prim_vars env delta v\")\n apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" and delta=\"delta\" in app_hole_res_vars_rev)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and v=\"VarExp (LocType a)\" and e=\"v\" in safe_send_hole_npv_use)\n apply (auto)\n apply (simp add: own_env_vars_def)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)(*\n (* otherwise, xa is in the completion. we identify its ancestor z. *)\n apply (simp add: own_env_vars_def)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (case_tac \"\\xa. x = Loc xa \\ (\\l z. Loc z \\ non_prim_vars env v \\ path_lookup rs_map z l xa)\")\n apply (auto)\n (* we note that z is a np-var of e therefore r_s1 z = Own *)\n apply (cut_tac x=\"Loc z\" and env=\"env\" and f=\"AppExp (ConstExp SendConst) (VarExp (LocType a b))\" in safe_own_npv_use)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: is_own_def)\n (* xa then is in the lookup map of some parent y. *)\n apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"xa\" in path_lookup_parent)\n apply (auto)\n (* with that in mind, by separation, x is disjoint from r_s1. *)\n apply (case_tac \"r_s1 (Loc xa) \\ NoPerm\")\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc xa\" in allE)\n apply (auto)\n (* by extension, x is not in 'h (send c v)' *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"Loc xa\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: non_prim_vars_def) \n (* the very last part is showing that x not in 'h (send c v)' implies x not in 'h ()'. *)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"AppExp (AppExp (ConstExp SendConst) (VarExp (LocType a b))) v\" in app_hole_res_vars2)\n apply (auto)*)\n done\n \nlemma disj_lift_use_envr_rev: \"\\ strong_disj_use_env r_s r_x \\ \\ disj_use_env r_s (lift_use_env r_x r)\" \n apply (simp add: strong_disj_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \nlemma lift_strong_disj_use_env1: \"\\ strong_disj_use_env r_x r_s \\ \\ strong_disj_use_env (lift_use_env r_x r) r_s\" \n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \nlemma send_disj_nres_map: \"\\ disj_nres_map p_map; p_map u1 = Some r_sa; p_map u2 = Some r_sb; is_own r;\n leq_use_env r_xa (lift_use_env r_sa r); leq_use_env r_xb (comp_use_env (lift_use_env r_sa r) (lift_use_env r_sb r));\n strong_disj_use_env r_xa r_xb \\ \\ disj_nres_map (add_env (add_env p_map u1 r_xa) u2 r_xb)\" \n apply (rule_tac disj_add_nres_map) \n apply (rule_tac disj_add_nres_map) \n apply (simp)\n (* proving disjointness for the send thread's material *)\n apply (rule_tac r_s=\"lift_use_env r_sa r\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: disj_nres_map_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = u1\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n (* proving disjointness for the recv thread *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"u2 = x\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (case_tac \"u1 = x\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (simp add: add_env_def)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (simp add: add_env_def)\n apply (simp add: disj_nres_map_def)\n apply (rule_tac r_s=\"comp_use_env (lift_use_env r_sa r) (lift_use_env r_sb r)\" in strong_disj_leq_use_env1)\n apply (rule_tac strong_disj_comp_use_env2)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (erule_tac x=\"u2\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n done\n (*\nfun proper_hole where\n \"proper_hole rs_map ExpHole = True\"\n| \"proper_hole rs_map (AppHole1 h e) = (proper_hole rs_map h \\ proper_exp rs_map e)\" \n| \"proper_hole rs_map (AppHole2 v h) = (proper_exp rs_map v \\ proper_hole rs_map h)\"\n| \"proper_hole rs_map (IfHole h e1 e2) = (proper_hole rs_map h \\ proper_exp rs_map e1 \\ proper_exp rs_map e2)\" \n| \"proper_hole rs_map (PairHole1 h e) = (proper_hole rs_map h \\ proper_exp rs_map e)\" \n| \"proper_hole rs_map (PairHole2 v h) = (proper_exp rs_map v \\ proper_hole rs_map h)\"\n \nlemma proper_app_hole_split1: \"\\ proper_exp rs_map (app_hole h e) \\ \\ proper_hole rs_map h\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n\nlemma proper_app_hole_split2: \"\\ proper_exp rs_map (app_hole h e) \\ \\ proper_exp rs_map e\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n \nlemma proper_app_hole_recon: \"\\ proper_hole rs_map h; proper_exp rs_map e \\ \\ proper_exp rs_map (app_hole h e)\" \n apply (induct h)\n apply (auto)\n apply (simp_all add: proper_exp_def)\n done\n \nlemma proper_app_hole: \"\\ proper_exp rs_map (app_hole h e1); proper_exp rs_map e2 \\ \\ proper_exp rs_map (app_hole h e2)\" \n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" and e=\"e1\" in proper_app_hole_split1)\n apply (auto)\n apply (rule_tac proper_app_hole_recon)\n apply (auto)\n done*)\n \nlemma srps_send_case: \"\\well_typed_system env delta p_map s2 ps1; valid_reduct app_red_exp; r_ax = SendAct;\n ps1 u1 = Some (app_hole h1 (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s))) v));\n ps1 u2 = Some (app_hole h2 (AppExp (ConstExp RecvConst) (VarExp (LocType x_r)))); u1 \\ u2; wf_hole h1;\n wf_hole h2; is_value v; s2 x_s = Some ChanSValue;\n s2 x_r = Some (ChanRValue x_s); s1 = s2;\n ps2 = add_env (add_env ps1 u1 (app_hole h1 (ConstExp UnitConst))) u2 (app_hole h2 v)\\\n \\ \\r_s g_ax.\n (\\p_map'. well_typed_system (red_env env g_ax) (red_delta delta g_ax) p_map' s2\n (add_env (add_env ps1 u1 (app_hole h1 (ConstExp UnitConst))) u2 (app_hole h2 v))) \\\n safe_act s2 r_s g_ax\"\n (* prelim: well-formed-delta *)\n apply (cut_tac delta=\"delta\" in wts_well_formed_delta)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* send case. no resources are generated in this step *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* we have to get the well-typedness statement for h1 [send c v] *)\n apply (case_tac \"\\ (case ps1 u1 of None \\ True | Some e \\ (case p_map u1 of None \\ False | Some r_s \\ \\rx r_s2. well_typed env delta r_s e UnitTy r_s2 rx))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (case_tac \"p_map u1\")\n apply (auto)\n (* we also get the well-typedness statement for h2 [recv c v] *)\n apply (case_tac \"\\ (case ps1 u2 of None \\ True | Some e \\ (case p_map u2 of None \\ False | Some r_s \\ \\rx r_s2. well_typed env delta r_s e UnitTy r_s2 rx))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u2\" in allE)\n apply (auto)\n apply (case_tac \"p_map u2\")\n apply (auto)\n (* next we get the send channel's type *)\n apply (case_tac \"\\ (\\ t. env (Loc x_s) = Some (ChanTy t SEnd))\")\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"x_s\" in allE)\n apply (auto)\n apply (case_tac \"env (Loc x_s)\")\n apply (auto)\n (* and the recv channel's type *)\n apply (case_tac \"\\ env (Loc x_r) = Some (ChanTy t REnd)\")\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"x_r\" in allE)\n apply (auto)\n apply (case_tac \"env (Loc x_r)\")\n apply (auto)\n (* prelim: we prove the dominator of v \\ lift a r (the permission map of u1) *)\n apply (cut_tac eq_own)\n apply (auto)\n apply (cut_tac r_sc=\"np_dom_use_env env delta v\" and r_sb=\"np_dom_use_env env delta (app_hole h1 (AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s))) v))\"\n and r_sa=\"lift_use_env a r\" in trans_leq_use_env)\n apply (rule_tac wt_np_leq_use_env)\n apply (auto)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac dist_dom_leq_use_env)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (rule_tac app_hole_res_vars)\n apply (auto)\n (* we can generate a type for h1 () *)\n apply (cut_tac env=\"env\" and v=\"v\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h1\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and s=\"s2\" and delta=\"delta\" in safe_send_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)\n (* - complete proof that a is still valid *)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n (* we can also generate a type for h2 v, first by getting a type for v, and then by putting it in the hole *)\n apply (cut_tac env=\"env\" and v=\"v\" and h=\"h1\" and a=\"x_s\" and t=\"t\" in safe_val_exp)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"aa\" and h=\"h2\" and r_x=\"np_dom_use_env env delta v\" in safe_recv_exp)\n apply (auto)\n (* - p_map disjointness proves that the permissions being added are disjoint *)\n apply (rule_tac r_s=\"lift_use_env a r\" in disj_leq_use_env2)\n apply (case_tac \"\\x y. x \\ y \\ strong_disj_use_env (nres_lookup p_map x) (nres_lookup p_map y)\")\n apply (erule_tac x=\"u2\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (rule_tac disj_lift_use_envr_rev)\n apply (simp)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: disj_nres_map_def)\n (* - proving the dominator is strong *)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n (* lastly it remains to prove the new process map is well-formed *)\n apply (rule_tac x=\"add_env (add_env p_map u1 (diff_use_env a (np_dom_use_env env delta v)))\n u2 (comp_use_env aa (np_dom_use_env env delta v))\" in exI)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* completeness *)(*\n apply (rule_tac add_full_nres_map)\n apply (rule_tac add_full_nres_map)\n apply (simp)*)\n (* disjointness, assisted by lemma *)\n apply (rule_tac r_sa=\"a\" and r_sb=\"aa\" in send_disj_nres_map)\n apply (simp_all)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac strong_disj_comp_use_env1)\n apply (rule_tac r_s=\"a\" in strong_disj_leq_use_env1)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u1\" in allE)\n apply (erule_tac x=\"u2\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"np_dom_use_env env delta v\" in strong_disj_leq_use_env2)\n apply (rule_tac diff_strong_disj_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac id_leq_use_env)\n (* proving that the processes are well-typed *)\n apply (case_tac \"u = u1\")\n apply (simp add: add_env_def)\n apply (auto)(*\n apply (rule_tac proper_app_hole)\n apply (simp)\n apply (simp add: proper_exp_def)*)\n apply (case_tac \"u = u2\")\n apply (simp add: add_env_def)\n apply (auto)(*\n apply (rule_tac proper_app_hole)\n apply (simp)\n apply (cut_tac rs_map=\"rs_map\" and h=\"h1\" and e=\"AppExp (AppExp (ConstExp SendConst) (VarExp (LocType x_s a_s))) v\" in proper_app_hole_split2)\n apply (simp)\n apply (simp add: proper_exp_def)*)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"u\" in allE)\n apply (case_tac \"ps1 u\")\n apply (auto)\n apply (simp add: add_env_def)\n (* proving res_map element containment *)\n apply (rule_tac add_sub_nres_map1)\n apply (rule_tac add_sub_nres_map1)\n apply (simp)\n apply (rule_tac r_s=\"a\" in trans_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u2\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac r_s=\"lift_use_env a r\" in trans_sub_use_env)\n apply (rule_tac lift_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u1\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* proving the separation of the new maps *)(*\n apply (case_tac \"u = u1\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"a\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (case_tac \"u = u2\")\n apply (simp add: add_env_def)\n apply (rule_tac comp_sep_nres_map)\n apply (erule_tac x=\"u2\" in allE)\n apply (auto)\n apply (erule_tac x=\"u1\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env a r\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (rule_tac lift_strong_disj_use_env1)\n apply (simp)\n apply (simp add: add_env_def)*)\n done\n \n \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/ProcSendCase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.28301606994047906}} {"text": "section\\The Needham-Schroeder Public-Key Protocol against Dolev-Yao --- with Gets event, hence with Reception rule\\\n\ntheory NS_Public_Bad imports Public begin\n\ninductive_set ns_public :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ ns_public\"\n\n (*The spy MAY say anything he CAN say. We do not expect him to\n invent new nonces here, but he can also use NS1. Common to\n all similar protocols.*)\n | Fake: \"\\evsf \\ ns_public; X \\ synth (analz (knows Spy evsf))\\\n \\ Says Spy B X # evsf \\ ns_public\"\n\n (*A message that is sent may be received*)\n | Reception: \"\\evsr \\ ns_public; Says A B X \\ set evsr\\\n \\ Gets B X # evsr \\ ns_public\"\n\n (*Alice initiates a protocol run, sending a nonce to Bob*)\n | NS1: \"\\evs1 \\ ns_public; Nonce NA \\ used evs1\\\n \\ Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\)\n # evs1 \\ ns_public\"\n\n (*Bob responds to Alice's message with a further nonce*)\n | NS2: \"\\evs2 \\ ns_public; Nonce NB \\ used evs2;\n Gets B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs2\\\n \\ Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\)\n # evs2 \\ ns_public\"\n\n (*Alice proves her existence by sending NB back to Bob.*)\n | NS3: \"\\evs3 \\ ns_public;\n Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs3;\n Gets A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs3\\\n \\ Says A B (Crypt (pubEK B) (Nonce NB)) # evs3 \\ ns_public\"\n\ndeclare knows_Spy_partsEs [elim] thm knows_Spy_partsEs\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"\\NB. \\evs \\ ns_public. Says A B (Crypt (pubEK B) (Nonce NB)) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] ns_public.Nil [THEN ns_public.NS1, THEN ns_public.Reception, \n THEN ns_public.NS2, THEN ns_public.Reception, \n THEN ns_public.NS3])\nby possibility\n\n\ntext\\Lemmas about reception invariant: if a message is received it certainly\nwas sent\\\nlemma Gets_imp_Says :\n \"\\ Gets B X \\ set evs; evs \\ ns_public \\ \\ \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule ns_public.induct)\napply auto\ndone\n\nlemma Gets_imp_knows_Spy: \n \"\\ Gets B X \\ set evs; evs \\ ns_public \\ \\ X \\ knows Spy evs\"\napply (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\ndone\n\nlemma Gets_imp_knows_Spy_parts[dest]:\n \"\\ Gets B X \\ set evs; evs \\ ns_public \\ \\ X \\ parts (knows Spy evs)\"\napply (blast dest: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\n(**** Inductive proofs about ns_public ****)\n\n(** Theorems of the form X \\ parts (knows Spy evs) imply that NOBODY\n sends messages containing X! **)\n\n(*Spy never sees another agent's private key! (unless it's bad at start)*)\nlemma Spy_see_priEK [simp]: \n \"evs \\ ns_public \\ (Key (priEK A) \\ parts (knows Spy evs)) = (A \\ bad)\"\nby (erule ns_public.induct, auto)\n\nlemma Spy_analz_priEK [simp]: \n \"evs \\ ns_public \\ (Key (priEK A) \\ analz (knows Spy evs)) = (A \\ bad)\"\nby auto\n\n\n(*** Authenticity properties obtained from NS2 ***)\n\n(*It is impossible to re-use a nonce in both NS1 and NS2, provided the nonce\n is secret. (Honest users generate fresh nonces.)*)\n\n\n\n(*Unicity for NS1: nonce NA identifies agents A and B*)\nlemma unique_NA: \n \"\\Crypt(pubEK B) \\Nonce NA, Agent A \\ \\ parts(knows Spy evs); \n Crypt(pubEK B') \\Nonce NA, Agent A'\\ \\ parts(knows Spy evs); \n Nonce NA \\ analz (knows Spy evs); evs \\ ns_public\\\n \\ A=A' \\ B=B'\"\napply (erule rev_mp, erule rev_mp, erule rev_mp) \napply (erule ns_public.induct, simp_all)\n(*Fake, NS1*)\napply (blast intro!: analz_insertI)+\ndone\n\n\n(*Secrecy: Spy does not see the nonce sent in msg NS1 if A and B are secure\n The major premise \"Says A B ...\" makes it a dest-rule, so we use\n (erule rev_mp) rather than rule_format. *)\ntheorem Spy_not_see_NA: \n \"\\Says A B (Crypt(pubEK B) \\Nonce NA, Agent A\\) \\ set evs;\n A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Nonce NA \\ analz (knows Spy evs)\"\napply (erule rev_mp) \napply (erule ns_public.induct, simp_all, spy_analz)\napply (blast dest: unique_NA intro: no_nonce_NS1_NS2)+\ndone\n\n\n(*Authentication for A: if she receives message 2 and has used NA\n to start a run, then B has sent message 2.*)\nlemma A_trusts_NS2_lemma [rule_format]: \n \"\\A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Crypt (pubEK A) \\Nonce NA, Nonce NB\\ \\ parts (knows Spy evs) \\\n Says A B (Crypt(pubEK B) \\Nonce NA, Agent A\\) \\ set evs \\\n Says B A (Crypt(pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs\"\napply (erule ns_public.induct)\napply (auto dest: Spy_not_see_NA unique_NA)\ndone\n\ntheorem A_trusts_NS2: \n \"\\Says A B (Crypt(pubEK B) \\Nonce NA, Agent A\\) \\ set evs; \n Gets A (Crypt(pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs;\n A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Says B A (Crypt(pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs\"\nby (blast intro: A_trusts_NS2_lemma)\n\n\n(*If the encrypted message appears then it originated with Alice in NS1*)\nlemma B_trusts_NS1 [rule_format]:\n \"evs \\ ns_public \n \\ Crypt (pubEK B) \\Nonce NA, Agent A\\ \\ parts (knows Spy evs) \\\n Nonce NA \\ analz (knows Spy evs) \\\n Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs\"\napply (erule ns_public.induct, simp_all)\n(*Fake*)\napply (blast intro!: analz_insertI)\ndone\n\n\n\n(*** Authenticity properties obtained from NS2 ***)\n\n(*Unicity for NS2: nonce NB identifies nonce NA and agent A\n [proof closely follows that for unique_NA] *)\nlemma unique_NB [dest]: \n \"\\Crypt(pubEK A) \\Nonce NA, Nonce NB\\ \\ parts(knows Spy evs);\n Crypt(pubEK A') \\Nonce NA', Nonce NB\\ \\ parts(knows Spy evs);\n Nonce NB \\ analz (knows Spy evs); evs \\ ns_public\\\n \\ A=A' \\ NA=NA'\"\napply (erule rev_mp, erule rev_mp, erule rev_mp) \napply (erule ns_public.induct, simp_all)\n(*Fake, NS2*)\napply (blast intro!: analz_insertI)+\ndone\n\n\n(*NB remains secret PROVIDED Alice never responds with round 3*)\ntheorem Spy_not_see_NB [dest]:\n \"\\Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs; \n \\C. Says A C (Crypt (pubEK C) (Nonce NB)) \\ set evs; \n A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Nonce NB \\ analz (knows Spy evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule ns_public.induct, simp_all, spy_analz)\napply (simp_all add: all_conj_distrib) (*speeds up the next step*)\napply (blast intro: no_nonce_NS1_NS2)+\ndone\n\n\n(*Authentication for B: if he receives message 3 and has used NB\n in message 2, then A has sent message 3--to somebody....*)\n\nlemma B_trusts_NS3_lemma [rule_format]:\n \"\\A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Crypt (pubEK B) (Nonce NB) \\ parts (knows Spy evs) \\\n Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs \\\n (\\C. Says A C (Crypt (pubEK C) (Nonce NB)) \\ set evs)\"\napply (erule ns_public.induct, auto)\nby (blast intro: no_nonce_NS1_NS2)+\n\ntheorem B_trusts_NS3:\n \"\\Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs;\n Gets B (Crypt (pubEK B) (Nonce NB)) \\ set evs; \n A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ \\C. Says A C (Crypt (pubEK C) (Nonce NB)) \\ set evs\"\nby (blast intro: B_trusts_NS3_lemma)\n\n\n(*Can we strengthen the secrecy theorem Spy_not_see_NB? NO*)\nlemma \"\\A \\ bad; B \\ bad; evs \\ ns_public\\ \n \\ Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs \n \\ Nonce NB \\ analz (knows Spy evs)\"\napply (erule ns_public.induct, simp_all, spy_analz)\n(*NS1: by freshness*)\napply blast\n(*NS2: by freshness and unicity of NB*)\napply (blast intro: no_nonce_NS1_NS2)\n(*NS3: unicity of NB identifies A and NA, but not B*)\napply clarify\napply (frule_tac A' = A in \n Says_imp_knows_Spy [THEN parts.Inj, THEN unique_NB], auto)\napply (rename_tac evs3 B' C)\ntxt\\This is the attack!\n@{subgoals[display,indent=0,margin=65]}\n\\\noops\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Inductive_Confidentiality/DolevYao/NS_Public_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070808, "lm_q2_score": 0.4493926344647596, "lm_q1q2_score": 0.2830160636951201}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory GraphLang\n\nimports\n \"CParser.TypHeapLib\"\n \"Lib.SplitRule\"\n \"CommonOps\"\n\nbegin\n\ntext \\Note that machine states here are assumed to be countable and\nare thus represented by naturals.\\\n\ndatatype variable =\n VarNone\n | VarWord8 word8\n | VarWord16 word16\n | VarWord32 word32\n | VarWord64 word64\n | VarMem \"machine_word \\ word8\"\n | VarDom \"machine_word set\"\n | VarGhostState \"ghost_assertions\"\n | VarHTD \"heap_typ_desc\"\n | VarMS \"unit \\ nat\"\n | VarBool bool\n\ntext \\States are a mapping from names to the variable type, which is\na union of the available names.\\\n\ndatatype state = State \"string \\ variable\"\n\ntext \\Accessors for grabbing variables by name and expected type.\\\n\ndefinition\n \"var_acc nm st = (case st of State f \\ f nm)\"\n\ndefinition\n \"var_word8 nm st = (case var_acc nm st of\n VarWord8 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word16 nm st = (case var_acc nm st of\n VarWord16 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word32 nm st = (case var_acc nm st of\n VarWord32 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word64 nm st = (case var_acc nm st of\n VarWord64 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_ghoststate nm st = (case var_acc nm st of\n VarGhostState arr \\ arr | _ \\ (\\_. 0))\"\n\ndefinition\n \"var_mem nm st = (case var_acc nm st of\n VarMem m \\ m | _ \\ \\_. 0)\"\n\ndefinition\n \"var_dom nm st = (case var_acc nm st of\n VarDom d \\ d | _ \\ {})\"\n\ndefinition\n \"var_htd nm st = (case var_acc nm st of\n VarHTD htd \\ htd | _ \\ empty_htd)\"\n\ndefinition\n \"var_ms nm st = (case var_acc nm st of\n VarMS ms \\ ms | _ \\ ((), 0))\"\n\ndefinition\n \"var_bool nm st = (case var_acc nm st of\n VarBool bool \\ bool | _ \\ False)\"\n\ntext \\The variable updator.\\\n\ndefinition\n \"var_upd nm v st = (case st of State f \\ State (f (nm := v)))\"\n\ndefinition\n \"default_state = State (\\_. VarNone)\"\n\ntext \\The type of nodes.\\\n\ndatatype next_node =\n NextNode nat | Ret | Err\n\ndatatype node =\n Basic next_node \"(string \\ (state \\ variable)) list\"\n | Cond next_node next_node \"state \\ bool\"\n | Call next_node string \"(state \\ variable) list\" \"string list\"\n\ndefinition Skip where\n \"Skip nn = Cond nn nn (\\x. True)\"\n\ntext \\The type for a total graph function, including list of inputs,\n list of outputs, graph, and entry point.\\\n\ndatatype graph_function\n = GraphFunction \"string list\" \"string list\" \"nat \\ node option\" nat\n\nprimrec entry_point where\n \"entry_point (GraphFunction inputs outputs graph ep) = ep\"\n\nprimrec function_graph where\n \"function_graph (GraphFunction inputs outputs graph ep) = graph\"\n\nprimrec function_inputs where\n \"function_inputs (GraphFunction inputs outputs graph ep) = inputs\"\n\nprimrec function_outputs where\n \"function_outputs (GraphFunction inputs outputs graph ep) = outputs\"\n\ntext \\The definition of execution, including a stack to allow function calls.\\\n\ndefinition\n save_vals :: \"string list \\ variable list \\ state \\ state\"\nwhere\n \"save_vals vars vals st = fold (\\(var, val). var_upd var val) (zip vars vals) st\"\n\ndefinition\n init_vars :: \"string list \\ (state \\ variable) list \\ state \\ state\"\nwhere\n \"init_vars vars accs st = save_vals vars (map (\\i. i st) accs) default_state\"\n\ndefinition\n acc_vars :: \"string list \\ state \\ variable list\"\nwhere\n \"acc_vars vars st = map (\\v. var_acc v st) vars\"\n\ndefinition\n return_vars :: \"string list \\ string list \\ state \\ state \\ state\"\nwhere\n \"return_vars inner outer inner_st = save_vals outer (acc_vars inner inner_st)\"\n\ndefinition\n upd_vars :: \"(string \\ (state \\ variable)) list \\ state \\ state\"\nwhere\n \"upd_vars upds st = save_vals (map fst upds) (map (\\(nm, vf). vf st) upds) st\"\n\ntype_synonym stack = \"(next_node \\ state \\ string) list\"\n\nprimrec\n upd_stack :: \"next_node \\ (state \\ state) \\ stack \\ stack\"\nwhere\n \"upd_stack nn stf (x # xs) = (nn, stf (fst (snd x)), snd (snd x)) # xs\"\n | \"upd_stack nn stf [] = []\"\n\nprimrec\n exec_node :: \"(string \\ graph_function option)\n \\ state \\ node \\ stack \\ stack set\"\nwhere\n \"exec_node Gamma st (Basic cont upds) stack\n = {upd_stack cont (K (upd_vars upds st)) stack}\"\n | \"exec_node Gamma st (Cond left right cond) stack\n = {upd_stack (if cond st then left else right) id stack}\"\n | \"exec_node Gamma st (Call cont fname inputs outputs) stack\n = (case Gamma fname of None \\ {upd_stack Err id stack}\n | Some (GraphFunction inps outps graph ep)\n \\ {(NextNode ep, init_vars inps inputs st, fname)\n # stack})\"\n\nprimrec\n exec_node_return :: \"(string \\ graph_function option)\n \\ state \\ node \\ stack \\ stack set\"\nwhere\n \"exec_node_return _ _ (Basic _ _) stack = {}\"\n | \"exec_node_return _ _ (Cond _ _ _) stack = {}\"\n | \"exec_node_return Gamma st (Call cont fname inputs outputs) stack\n = (case Gamma fname of None \\ {}\n | Some (GraphFunction inps outps graph ep)\n \\ {upd_stack cont (return_vars outps outputs st) stack})\"\n\ntext \\The single-step relation on graph states.\\\n\ndefinition\n exec_graph_step :: \"(string \\ graph_function option)\n \\ (stack \\ stack) set\"\nwhere\n \"exec_graph_step Gamma = {(stack, stack'). case stack of\n (NextNode nn, st, fname) # _ \\\n (case Gamma fname of None \\ False\n | Some (GraphFunction _ _ graph _) \\\n (case graph nn of None \\ stack' = upd_stack Err id stack\n | Some node \\ stack' \\ exec_node Gamma st node stack))\n | (Ret, st, _) # (NextNode nn, _, fname) # _ \\\n (case Gamma fname of None \\ False\n | Some (GraphFunction _ _ graph _) \\\n (case graph nn of None \\ stack' = upd_stack Err id (tl stack)\n | Some node \\ stack' \\ exec_node_return Gamma st node (tl stack)))\n | [] \\ False\n | [_] \\ False \\ \\note NextNode case is handled\\\n | _ \\ stack' = upd_stack Err id (tl stack)\n }\"\n\ntext \\Multi-step relations.\\\n\ndefinition exec_graph\nwhere \"exec_graph Gamma = rtrancl (exec_graph_step Gamma)\"\n\ndefinition exec_graph_n\nwhere \"exec_graph_n Gamma n = exec_graph_step Gamma ^^ n\"\n\nlemma relpow_Suc_simp2:\n \"R ^^ Suc n = R O R ^^ n\"\n apply safe\n apply (erule relpow_Suc_E2, blast)\n apply (blast intro: relpow_Suc_I2)\n done\n\nlemma exec_graph_n_take_step:\n \"\\ (stack, stack') \\ exec_graph_n GGamma n;\n \\ n = 0; stack' = stack \\ \\ P;\n \\stack''. \\ n > 0; (stack, stack'') \\ exec_graph_step GGamma;\n (stack'', stack') \\ exec_graph_n GGamma (n - 1) \\\n \\ P \\ \\ P\"\n apply (cases n, simp_all only: exec_graph_n_def relpow_Suc_simp2)\n apply simp\n apply clarsimp\n done\n\nlemma exec_graph_take_step:\n \"\\ ((NextNode m, gst, fname) # stack, stack') \\ exec_graph_n GGamma n;\n GGamma fname = Some gf; function_graph gf m = Some node \\\n \\ (n = 0 \\ stack' = (NextNode m, gst, fname) # stack)\n \\ (\\stack''. n \\ 1\n \\ stack'' \\ exec_node GGamma gst node\n ((NextNode m, gst, fname) # stack)\n \\ (stack'', stack') \\ exec_graph_n GGamma (n - 1))\"\n apply (erule exec_graph_n_take_step)\n apply simp\n apply (clarsimp simp: exec_graph_step_def split: graph_function.split_asm)\n apply blast\n done\n\ndefinition\n continuing :: \"stack \\ bool\"\nwhere\n \"continuing st = (case st of [] \\ False\n | [(NextNode _, _, _)] \\ True | [_] \\ False | _ \\ True)\"\n\nlemma continuing_simps[simp]:\n \"\\ continuing []\"\n \"continuing [(unn, st, g)] = (unn \\ Ret \\ unn \\ Err)\"\n \"continuing ((Ret, st, g) # stk) = (stk \\ [])\"\n \"continuing (stf # stf' # stk)\"\n \"continuing ((NextNode nn, st, g) # stk)\"\n \"continuing ((Err, st, g) # stk) = (stk \\ [])\"\n by (simp_all add: continuing_def split: next_node.split list.split)\n\nlemma consume_Not_eq:\n \"(\\ P) = Q \\ P = (\\ Q)\"\n by clarsimp\n\nlemma exec_node_case_helper:\n \"(stk' \\ exec_node Gamma st node stk)\n = (case node of Basic _ _ \\ stk' \\ id (exec_node Gamma) st node stk\n | _ \\ stk' \\ id (exec_node Gamma) st node stk)\"\n \"(stk' \\ exec_node_return Gamma st node stk)\n = (case node of Basic _ _ \\ stk' \\ id (exec_node_return Gamma) st node stk\n | _ \\ stk' \\ id (exec_node_return Gamma) st node stk)\"\n by (simp_all split: node.split)\n\nlemmas splits_raw = prod.split list.split option.split\n next_node.split graph_function.split node.split\nlemmas splits_cooked = splits_raw[where P=Not, THEN consume_Not_eq]\n option.split[where P=\"\\S. x \\ S\", THEN consume_Not_eq]\n graph_function.split[where P=\"\\S. x \\ S\", THEN consume_Not_eq] for x\n\nlemmas all_exec_graph_step_cases = exec_graph_step_def[THEN eqset_imp_iff,\n simplified, unfolded exec_node_case_helper splits_cooked, simplified,\n unfolded splits_cooked, simplified]\n\nlemma exec_node_stack_extend:\n \"continuing stack \\\n (stack' \\ exec_node Gamma st node (stack @ xs))\n = (\\stack''. stack' = stack'' @ xs\n \\ stack'' \\ exec_node Gamma st node stack)\"\n apply (cases node, simp_all)\n apply (simp_all add: continuing_def\n split: list.split_asm prod.split_asm next_node.split_asm)\n apply (auto split: option.split graph_function.split)\n done\n\nlemma exec_node_return_stack_extend:\n \"continuing stack \\\n (stack' \\ exec_node_return Gamma st node (stack @ xs))\n = (\\stack''. stack' = stack'' @ xs\n \\ stack'' \\ exec_node_return Gamma st node stack)\"\n apply (cases node, simp_all)\n apply (simp_all add: continuing_def\n split: list.split_asm prod.split_asm next_node.split_asm)\n apply (auto split: option.split graph_function.split)\n done\n\nlemma exec_graph_step_stack_extend:\n \"continuing stack \\\n ((stack @ xs, stack') \\ exec_graph_step Gamma)\n = (\\stack''. stack' = stack'' @ xs\n \\ (stack, stack'') \\ exec_graph_step Gamma)\"\n using exec_node_stack_extend[where stack'=stack' and stack=stack\n and Gamma=Gamma and xs=xs]\n exec_node_return_stack_extend[where stack'=stack' and stack=\"tl stack\"\n and Gamma=Gamma and xs=xs]\n apply (simp add: exec_graph_step_def)\n apply (cases stack, simp_all)\n apply clarsimp\n apply (case_tac a, simp_all)\n apply (clarsimp split: option.split graph_function.split)\n apply (clarsimp simp: neq_Nil_conv split: list.split)\n apply (clarsimp split: next_node.split option.split graph_function.split)\n apply (clarsimp simp: neq_Nil_conv split: list.split)\n done\n\nlemma exec_graph_n_stack_extend:\n \"continuing stack \\\n ((stack @ xs, stack') \\ exec_graph_n Gamma n)\n = (\\stack'' n'. (stack, stack'') \\ (exec_graph_step Gamma\n \\ {(st, _). continuing st}) ^^ n'\n \\ ((n' < n \\ \\ continuing stack''\n \\ (stack'' @ xs, stack') \\ exec_graph_n Gamma (n - n'))\n \\ (stack' = stack'' @ xs \\ n' = n)))\"\n unfolding exec_graph_n_def\nproof (induct n arbitrary: stack)\n case 0\n show ?case\n by auto[1]\nnext\n case (Suc n stack)\n show ?case\n apply (simp only: relpow_Suc_simp2)\n apply (rule iffI)\n apply (clarsimp simp: exec_graph_step_stack_extend Suc.prems)\n apply (case_tac \"continuing stack''\")\n apply (frule Suc.hyps, clarsimp)\n apply (rule_tac x=\"stack''a\" in exI, rule_tac x=\"Suc n'\" in exI)\n apply (simp only: relpow_Suc_simp2, clarsimp)\n apply (blast intro: Suc.prems)\n apply (rule_tac x=\"stack''\" in exI, rule_tac x=1 in exI)\n apply (auto simp: Suc.prems)[1]\n apply (clarsimp)\n apply (case_tac n', simp_all only: minus_nat.diff_0 relpow_Suc_simp2)\n apply auto[1]\n apply clarsimp\n apply (rule_tac b=\"y @ xs\" in relcompI)\n apply (simp add: exec_graph_step_stack_extend Suc.prems)\n apply (case_tac \"nat = 0\")\n apply auto[1]\n apply (subst Suc.hyps)\n apply (case_tac nat, simp_all only: relpow_Suc_simp2, auto)[1]\n apply auto[1]\n done\nqed\n\ndefinition\n \"init_state fname gfun xs =\n (NextNode (entry_point gfun), save_vals (function_inputs gfun) xs default_state, fname)\"\n\nlemma exec_graph_step_nonempty:\n \"\\ (stack, stack') \\ exec_graph_step Gamma ^^ n; stack \\ [] \\\n \\ stack' \\ []\"\n by (cases n, auto simp: all_exec_graph_step_cases\n split: graph_function.split_asm)\n\nlemma relpow_mono:\n \"\\ R \\ (S :: ('a \\ 'a) set) \\ \\ R ^^ n \\ S ^^ n\"\n by (induct n, auto)\n\nlemma drop_eq_Cons:\n \"(drop n xs = x # ys) = (\\zs. length zs = n \\ xs = zs @ x # ys)\"\n apply (induct n arbitrary: xs)\n apply simp\n apply (case_tac xs, auto simp add: length_Suc_conv)\n done\n\nlemma exec_graph_step_n_Err:\n \"(((Err, st, graph) # stack, stack') \\ exec_graph_n Gamma n)\n \\ stack' = upd_stack Err id (drop n ((Err, st, graph) # stack))\n \\ drop n ((Err, st, graph) # stack) \\ []\"\nproof (induct n arbitrary: stack')\n case 0\n show ?case using 0\n by (auto simp add: exec_graph_n_def)\nnext\n case (Suc n)\n show ?case using Suc.prems\n apply (clarsimp simp: exec_graph_n_def relcomp_unfold linorder_not_le)\n apply (drule exec_graph_step_def[THEN eqset_imp_iff, THEN iffD1])\n apply (case_tac y, simp_all)\n apply (drule Suc.hyps[rotated, unfolded exec_graph_n_def])\n apply (simp only: neq_Nil_conv)\n apply (clarsimp simp: linorder_not_le drop_eq_Cons)\n apply (clarsimp split: list.split_asm)\n apply (case_tac zs, simp_all)\n done\nqed\n\ntext \\Possibly infinite traces.\\\n\ndefinition nat_trace_rel\n where \"nat_trace_rel cont r = {tr. (\\n. (tr n = None \\ tr (Suc n) = None)\n \\ (tr (Suc n) \\ None \\ (the (tr n), the (tr (Suc n))) \\ r)\n \\ (tr n \\ None \\ cont (the (tr n)) \\ tr (Suc n) \\ None))}\"\n\ntype_synonym trace = \"(nat \\ stack option)\"\n\ndefinition\n trace_end :: \"(nat \\ 'a option) \\ 'a option\"\nwhere\n \"trace_end tr = (if \\n. tr n = None then tr (Max (dom tr)) else None)\"\n\nlemma nat_trace_rel_Some_range:\n \"tr \\ nat_trace_rel cont r \\ tr n = Some v\n \\ \\i \\ n. \\v'. tr i = Some v'\"\n apply (induct n arbitrary: v, simp_all)\n apply (simp add: nat_trace_rel_def le_Suc_eq)\n apply (drule_tac x=n in spec, clarsimp)\n done\n\nlemma trace_None_dom_subset:\n \"tr n = None \\ tr \\ nat_trace_rel cont R\n \\ dom tr \\ {..< n}\"\n apply clarsimp\n apply (drule_tac n=x in nat_trace_rel_Some_range, simp+)\n apply (drule_tac x=\"n\" in spec)\n apply simp\n done\n\nlemma nat_trace_Max_dom_None:\n \"tr \\ nat_trace_rel cont R \\ tr n \\ None \\ (tr (Max (dom tr)) \\ None)\"\n apply (rule notI)\n apply (frule(1) trace_None_dom_subset)\n apply (cases \"dom tr = {}\")\n apply clarsimp\n apply (drule Max_in[rotated])\n apply (simp add: finite_subset)\n apply clarsimp\n done\n\nlemma trace_end_NoneD:\n \"trace_end tr = None \\ tr \\ nat_trace_rel cont r\n \\ tr = (\\_. None) \\ (\\f. tr = Some o f)\"\n apply (subst disj_commute, rule disjCI)\n apply (clarsimp simp: fun_eq_iff)\n apply (simp add: trace_end_def split: if_split_asm)\n apply (metis nat_trace_Max_dom_None not_None_eq)\n apply (rule_tac x=\"the o tr\" in exI, simp)\n done\n\nlemma trace_end_SomeD:\n \"trace_end tr = Some v \\ tr \\ nat_trace_rel cont r\n \\ \\n. tr n = Some v \\ tr (Suc n) = None \\ \\ cont v\"\n apply (clarsimp simp: trace_end_def split: if_split_asm)\n apply (rule exI, rule conjI, assumption)\n apply (case_tac \"tr (Suc (Max (dom tr)))\")\n apply (simp add: nat_trace_rel_def)\n apply (metis option.sel option.simps(3))\n apply (cut_tac x=\"Suc y\" for y in Max_ge[OF finite_subset domI])\n apply (erule(1) trace_None_dom_subset[rotated])\n apply simp+\n done\n\ndefinition\n exec_trace :: \"(string \\ graph_function option) \\ string \\ trace set\"\nwhere\n \"exec_trace Gamma fname\n = {trace. \\gf. Gamma fname = Some gf\n \\ (\\st. trace 0 = Some [(NextNode (entry_point gf), st, fname)])\n \\ trace \\ nat_trace_rel continuing (exec_graph_step Gamma)}\"\n\nlemma relpow_nat_trace:\n \"((s, s') \\ r ^^ n) = (\\tr \\ nat_trace_rel (\\x. False) r. tr 0 = Some s\n \\ tr n = Some s' \\ tr (Suc n) = None)\"\n apply (simp add: relpow_fun_conv, safe)\n apply (rule_tac x=\"\\x. if x < Suc n then Some (f x) else None\" in bexI)\n apply simp\n apply (simp add: nat_trace_rel_def)\n apply (rule_tac x=\"the o tr\" in exI)\n apply (frule(1) nat_trace_rel_Some_range[where n=n])\n apply (clarsimp simp: nat_trace_rel_def)\n done\n\ntext \\Parsing code for the graph language.\\\n\nML \\\n\nstructure ParseGraph = struct\n\nexception PARSEGRAPH of string list\n\nval debug = ref false\n\nfun trace s = if (! debug) then writeln s else ()\n\nfun parse_int str = if String.isPrefix \"-\" str\n then ~ (parse_int (unprefix \"-\" str))\n else case read_int (raw_explode str)\n of (n, []) => n\n | _ => raise PARSEGRAPH [\"read_int:\", str]\n\nval s = @{term \"s :: state\"}\n\nfun parse_n p (n :: ss) = let\n val n = parse_int n\n in funpow_yield n p ss end\n | parse_n _ [] = raise PARSEGRAPH [\"parse_n: empty\"]\n\nfun mk_binT sz = Word_Lib.mk_wordT sz |> dest_Type |> snd |> hd\n\nval ptr_size_str =\n case @{typ machine_word} of\n @{typ word32} => \"32\"\n | @{typ word64} => \"64\"\n\nfun parse_typ (\"Word\" :: n :: ss) = let\n val n = parse_int n\n in (Word_Lib.mk_wordT n, ss) end\n | parse_typ (\"Bool\" :: ss) = (@{typ bool}, ss)\n | parse_typ (\"Mem\" :: ss) = (@{typ \"machine_word \\ word8\"}, ss)\n | parse_typ (\"Dom\" :: ss) = (@{typ \"machine_word set\"}, ss)\n | parse_typ (\"HTD\" :: ss) = (@{typ heap_typ_desc}, ss)\n | parse_typ (\"PMS\" :: ss) = (@{typ nat}, ss)\n | parse_typ (\"UNIT\" :: ss) = (@{typ unit}, ss)\n | parse_typ (\"Array\" :: ss) = let\n val (el_typ, ss) = parse_typ ss\n val (n, ss) = case ss of (n :: ss) => (parse_int n, ss)\n | [] => raise PARSEGRAPH [\"parse_typ: array index\"]\n in (Type (@{type_name array}, [el_typ, mk_binT n]), ss) end\n | parse_typ (bad as (\"WordArray\" :: \"50\" :: element_size :: ss)) =\n (if element_size = ptr_size_str\n then (@{typ \"ghost_assertions\"}, ss)\n else raise PARSEGRAPH (\"parse_typ: bad ghost assertion codomain\" :: bad))\n | parse_typ (\"Struct\" :: nm :: ss) = (Type (nm, []), ss)\n | parse_typ (\"Ptr\" :: ss) = let\n val (obj_typ, ss) = parse_typ ss\n in (Type (@{type_name ptr}, [obj_typ]), ss) end\n | parse_typ ss = raise PARSEGRAPH (\"parse_typ: malformed\" :: ss)\n\nfun parse_lval (\"VarUpdate\" :: nm :: ss) = let\n val (_, ss) = parse_typ ss (* FIXME: check typ? *)\n in (nm, ss) end\n | parse_lval ss = raise PARSEGRAPH (\"parse_lval\" :: ss)\n\nfun parse_var ss = parse_lval (\"VarUpdate\" :: ss)\n\nval opers = Symtab.make [\n (\"Plus\", @{const_name \"plus\"}),\n (\"Minus\", @{const_name \"minus\"}),\n (\"Times\", @{const_name \"times\"}),\n (\"Modulus\", @{const_name \"modulo_class.modulo\"}),\n (\"DividedBy\", @{const_name \"divide_class.divide\"}),\n (\"BWAnd\", @{const_name \"and\"}),\n (\"BWOr\", @{const_name \"or\"}),\n (\"BWXOR\", @{const_name \"xor\"}),\n (\"And\", @{const_name \"conj\"}),\n (\"Or\", @{const_name \"disj\"}),\n (\"Implies\", @{const_name \"implies\"}),\n (\"Equals\", @{const_name \"HOL.eq\"}),\n (\"Less\", @{const_name \"less\"}),\n (\"LessEquals\", @{const_name \"less_eq\"}),\n (\"SignedLess\", @{const_name \"word_sless\"}),\n (\"SignedLessEquals\", @{const_name \"word_sle\"}),\n (\"Not\", @{const_name \"Not\"}),\n (\"BWNot\", @{const_name \"not\"}),\n (\"WordCast\", @{const_name \"unsigned\"}),\n (\"WordCastSigned\", @{const_name \"signed\"}),\n (\"WordArrayAccess\", @{const_name \"fun_app\"}),\n (\"WordArrayUpdate\", @{const_name \"fun_upd\"}),\n (\"CountLeadingZeroes\", @{const_name \"bv_clz\"}),\n (\"CountTrailingZeroes\", @{const_name \"bv_ctz\"}),\n (\"True\", @{const_name \"True\"}),\n (\"False\", @{const_name \"False\"}),\n (\"IfThenElse\", @{const_name \"If\"}),\n (\"MemAcc\", @{const_name \"mem_acc\"}),\n (\"MemUpdate\", @{const_name \"mem_upd\"}),\n (\"MemDom\", @{const_name \"Set.member\"}),\n (\"ShiftLeft\", @{const_name \"bvshl\"}),\n (\"ShiftRight\", @{const_name \"bvlshr\"}),\n (\"SignedShiftRight\", @{const_name \"bvashr\"}),\n (\"PValid\", @{const_name pvalid}),\n (\"PArrayValid\", @{const_name parray_valid}),\n (\"PAlignValid\", @{const_name palign_valid}),\n (\"PGlobalValid\", @{const_name pglobal_valid}),\n (\"PWeakValid\", @{const_name pweak_valid}),\n (\"HTDUpdate\", @{const_name all_htd_updates})\n ]\n\nfun mk_acc nm typ st = (case typ of\n @{typ word8} => @{term var_word8}\n | @{typ word16} => @{term var_word16}\n | @{typ word32} => @{term var_word32}\n | @{typ word64} => @{term var_word64}\n | @{typ \"machine_word \\ word8\"} => @{term var_mem}\n | @{typ \"machine_word set\"} => @{term var_dom}\n | @{typ \"ghost_assertions\"} => @{term var_ghoststate}\n | @{typ \"heap_typ_desc\"} => @{term var_htd}\n | @{typ \"nat\"} => @{term var_ms}\n | @{typ bool} => @{term var_bool}\n | Type (@{type_name ptr}, [_]) =>\n (case @{typ \"machine_word\"} of\n @{typ word32} => @{term var_word32}\n | @{typ word64} => @{term var_word64})\n | _ => raise PARSEGRAPH [\"mk_acc\", nm, fst (dest_Type typ)])\n $ HOLogic.mk_string nm $ st\n\nfun parse_val (\"Num\" :: ss) = let\n val (n, ss) = case ss of n :: ss => (n, ss)\n | [] => raise PARSEGRAPH [\"parse_val: parsing num, no numeral\"]\n val (typ, ss) = parse_typ ss\n val n = parse_int n\n in (HOLogic.mk_number typ n, ss) end\n | parse_val (\"Op\" :: nm :: ss) = let\n val const = case Symtab.lookup opers nm\n of SOME c => c\n | NONE => raise PARSEGRAPH [\"parse_val: unexpected op\", nm]\n val (typ, ss) = parse_typ ss\n val (args, ss) = parse_n parse_val ss\n val oper = Const (const, map fastype_of args ---> typ)\n in trace (\"parsed oper \" ^ nm ^ \" and args\");\n (list_comb (oper, args), ss) end\n | parse_val (\"Var\" :: nm :: ss) = let\n val (typ, ss) = parse_typ ss\n in (mk_acc nm typ s, ss) end\n | parse_val (\"Type\" :: ss) = let\n val (typ, ss) = parse_typ ss\n in (Logic.mk_type typ, ss) end\n | parse_val (\"Symbol\" :: nm :: ss) = let\n val (_, ss) = parse_typ ss\n in (TermsTypes.symbol_table $ HOLogic.mk_string nm, ss) end\n | parse_val ss = raise PARSEGRAPH (\"parse_val: malformed\" :: ss)\n\nval parse_lvals = parse_n parse_lval\n\nval parse_vars = parse_n parse_var\n\nfun mk_var_typ T = (case T of\n @{typ word8} => @{term VarWord8}\n | @{typ word16} => @{term VarWord16}\n | @{typ word32} => @{term VarWord32}\n | @{typ word64} => @{term VarWord64}\n | Type (@{type_name word}, [Type (@{type_name signed}, [T2])])\n => let val uT = Type (@{type_name word}, [T2])\n in Abs (\"t\", T, mk_var_typ uT $ (Const (@{const_name unsigned}, T --> uT) $ Bound 0)) end\n | @{typ \"machine_word \\ word8\"} => @{term VarMem}\n | @{typ \"ghost_assertions\"} => @{term VarGhostState}\n | @{typ \"machine_word set\"} => @{term VarDom}\n | @{typ \"heap_typ_desc\"} => @{term VarHTD}\n | @{typ \"unit \\ nat\"} => @{term VarMS}\n | @{typ bool} => @{term VarBool}\n | _ => raise TYPE (\"mk_var_typ: unexpected var typ\", [T], []))\n\nfun mk_var_term t = betapply (mk_var_typ (fastype_of t), t)\n\nfun parse_val_acc ss = let\n val (t, ss) = parse_val ss\n in (Term.lambda_name (\"s\", s) (mk_var_term t), ss) end\n\nfun parse_cond ss = let\n val (t, ss) = parse_val ss\n in (Term.lambda_name (\"s\", s) t, ss) end\n\nval parse_vals = parse_n parse_val_acc\n\nfun mk_NextNode n = @{term NextNode} $ HOLogic.mk_number @{typ nat} n\n\nfun parse_nn \"Err\" = @{term Err}\n | parse_nn \"Ret\" = @{term Ret}\n | parse_nn n = mk_NextNode (parse_int n)\n\nfun parse_fun_decl (\"Function\" :: nm :: ss) = let\n val (xs, ss) = parse_vars ss\n val (ys, ss) = parse_vars ss\n in\n ss = [] orelse raise PARSEGRAPH (\"parse_fun_decl: trailing\" :: ss);\n (nm, xs, ys)\n end\n | parse_fun_decl ss = raise PARSEGRAPH (\"parse_fun_decl: malformed\" :: ss)\n\nfun parse_var_and_val_acc ss = let\n val (var, ss) = parse_var ss\n val (v, ss) = parse_val_acc ss\n in (HOLogic.mk_prod (HOLogic.mk_string var, v), ss) end\n\nval mk_stringlist = map HOLogic.mk_string #> HOLogic.mk_list @{typ string}\n\nfun parse_node (n :: ss) = let\n val n = parse_int n\n val (t, ss) = case ss of\n \"Cond\" :: l :: r :: ss => let\n val l = parse_nn l\n val r = parse_nn r\n val (c, ss) = parse_cond ss\n in (@{term Cond} $ l $ r $ c, ss) end\n | \"Basic\" :: c :: ss => let\n val c = parse_nn c\n val (upds, ss) = parse_n parse_var_and_val_acc ss\n in (@{term Basic} $ c $ HOLogic.mk_list\n @{typ \"string \\ (state \\ variable)\"} upds, ss) end\n | \"Call\" :: c :: fname :: ss => let\n val c = parse_nn c\n val (args, ss) = parse_vals ss\n val (rets, ss) = parse_vars ss\n in (@{term Call} $ c $ HOLogic.mk_string fname\n $ HOLogic.mk_list @{typ \"state \\ variable\"} args\n $ mk_stringlist rets, ss) end\n | _ => raise PARSEGRAPH (\"parse_node: malformed\" :: ss)\n in\n ss = [] orelse raise PARSEGRAPH (\"parse_node: trailing\" :: ss);\n (n, t)\n end\n | parse_node [] = raise PARSEGRAPH ([\"parse_node: empty\"])\n\nfun parse_fun ([\"Function\" :: ss]) = let\n val (nm, xs, ys) = parse_fun_decl (\"Function\" :: ss)\n in SOME (nm, (xs, ys, NONE)) end\n | parse_fun ((\"Function\" :: ss) :: sss) = let\n val (nm, xs, ys) = parse_fun_decl (\"Function\" :: ss)\n val _ = tracing (\"Parsing \" ^ nm)\n val (node_sss, sss) = chop_prefix\n (fn ss => not (is_prefix (op =) [\"EntryPoint\"] ss)) sss\n val (ep, _) = case sss of (ep :: sss) => (ep, sss)\n | [] => raise PARSEGRAPH [\n \"parse_fun: EntryPoint not found\"]\n val ep = case ep of [_, n] => parse_int n\n | _ => raise PARSEGRAPH (\n \"parse_fun: EntryPoint line malformed\" :: ep)\n in\n SOME (nm, (xs, ys, SOME (ep, map parse_node node_sss,\n Abs (\"g\", @{typ \"nat \\ node option\"}, @{term GraphFunction}\n $ mk_stringlist xs $ mk_stringlist ys\n $ Bound 0 $ HOLogic.mk_number @{typ nat} ep))))\n end\n | parse_fun [] = raise PARSEGRAPH [\"parse_fun: empty\"]\n | parse_fun (ss :: _) = (warning (\"parse_fun: ignoring: \"\n ^ space_implode \" \" ss); NONE)\n\nfun fun_groups gp ((fs as (\"Function\" :: _)) :: sss) =\n (if null gp then [] else [rev gp]) @ fun_groups [fs] sss\n | fun_groups gp ([] :: sss) = fun_groups gp sss\n | fun_groups gp (ss :: sss) = fun_groups (ss :: gp) sss\n | fun_groups gp [] = [rev gp]\n\nfun filename_relative thy name =\n Path.append (Resources.master_directory thy) (Path.explode name)\n |> File.standard_path\n\nfun mkdir_relative thy name =\n Path.append (Resources.master_directory thy) (Path.explode name)\n |> Isabelle_System.make_directory\n\nfun openIn_relative thy = filename_relative thy #> TextIO.openIn\n\nfun get_funs thy file = let\n val f = openIn_relative thy file\n fun get () = case TextIO.inputLine f\n of NONE => []\n | SOME s => unsuffix \"\\n\" s :: get ()\n val lines = get ()\n |> map (Library.space_explode \" \" #> filter (fn s => s <> \"\"))\n |> filter_out null\n |> filter_out (fn (s :: _) => String.isPrefix \"#\" s | _ => false)\n in fun_groups [] lines end\n\ntype funs = (string list * string list * (int * (int * term) list * term) option) Symtab.table\n\nfun funs thy file : funs = get_funs thy file\n |> map_filter parse_fun\n |> Symtab.make\n\nfun define_graph s nodes = let\n val nodes = sort (int_ord o apply2 fst) nodes\n in StaticFun.define_tree_and_save_thms (Binding.name s)\n (map (fst #> Int.toString #> prefix (s ^ \"_\")) nodes)\n (map (apfst (HOLogic.mk_number @{typ nat})) nodes)\n @{term \"id :: nat => nat\"} []\n end\n\nfun define_graph_fun (funs : funs) b1 b2 nm ctxt =\n case (Symtab.lookup funs nm) of\n SOME (_, _, SOME (_, g, gf))\n => let\n val (graph_term, ctxt) = define_graph b1 g ctxt\n val (_, ctxt) = Local_Theory.define ((b2, NoSyn), ((Thm.def_binding b2, []),\n betapply (gf, graph_term))) ctxt\n in ctxt end\n | _ => error (\"define_graph_fun: \" ^ nm ^ \" not in funs\")\n\nend\n\n\\\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/GraphLang.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.28301606369512006}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Stat_Imp\n imports Tau_Sim Weaken_Stat_Imp\nbegin\n\nlocale weakTauLaws = weak + tau\nbegin\n\nlemma tauLaw1StatImpLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>w Q\"\n and \"(\\, \\.(P), Q) \\ Rel\"\n \n shows \"\\ \\ \\.(P) \\\\<^sub>w Q\"\nproof -\n have \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q\" by simp\n moreover have \"insertAssertion (extractFrame(\\.(P))) \\ \\\\<^sub>F \\\\, \\\\\" by(rule insertTauAssertion)\n hence \"insertAssertion (extractFrame(\\.(P))) \\ \\\\<^sub>F insertAssertion (extractFrame Q) \\\"\n by(metis FrameStatImpTrans FrameStatEq_def insertAssertionWeaken)\n ultimately show ?thesis using \\(\\, \\.(P), Q) \\ Rel\\\n by(rule weakenStatImpI)\nqed\n\nlemma tauLaw1StatImpRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n and C1: \"\\\\ P Q R. \\(\\, P, Q) \\ Rel; \\ \\ Q \\ R\\ \\ (\\, P, R) \\ Rel'\"\n\n shows \"\\ \\ P \\ \\.(Q)\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n from \\\\ \\ P \\ Q\\ obtain Q' Q'' \n where QChain: \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\" and PImpQ': \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q') \\\" \n and Q'Chain: \"\\ \\ \\' \\ Q' \\\\<^sup>^\\<^sub>\\ Q''\" and PRelQ'': \"(\\ \\ \\', P, Q'') \\ Rel\"\n by(rule weakStatImpE)\n \n obtain Q''' where QTrans: \"\\ \\ \\.(Q) \\\\ \\ Q'''\" and \"\\ \\ Q \\ Q'''\" using tauActionI by auto\n \n from \\\\ \\ Q \\ Q'''\\ QChain bisimE(2) obtain Q'''' where Q'''Chain: \"\\ \\ Q''' \\\\<^sup>^\\<^sub>\\ Q''''\" and \"\\ \\ Q' \\ Q''''\"\n by(metis bisimE(4) simTauChain)\n \n from QTrans Q'''Chain have \"\\ \\ \\.(Q) \\\\<^sup>^\\<^sub>\\ Q''''\" by(drule_tac tauActTauChain) auto\n moreover from \\\\ \\ Q' \\ Q''''\\ have \"insertAssertion (extractFrame Q') \\ \\\\<^sub>F insertAssertion (extractFrame Q'''') \\\"\n by(metis bisimE FrameStatEq_def)\n with PImpQ' have \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q'''') \\\"\n by(rule FrameStatImpTrans)\n moreover from \\\\ \\ Q' \\ Q''''\\ have \"\\ \\ \\' \\ Q' \\ Q''''\" by(rule bisimE) \n then obtain Q''''' where Q''''Chain: \"\\ \\ \\' \\ Q'''' \\\\<^sup>^\\<^sub>\\ Q'''''\" and \"\\ \\ \\' \\ Q'' \\ Q'''''\" using Q'Chain bisimE(2) \n by(metis bisimE(4) simTauChain)\n note Q''''Chain\n moreover from \\(\\ \\ \\', P, Q'') \\ Rel\\ \\\\ \\ \\' \\ Q'' \\ Q'''''\\ have \"(\\ \\ \\', P, Q''''') \\ Rel'\"\n by(rule C1)\n ultimately show ?case by blast\nqed\n\nend\n\ncontext tau begin\n\nlemma tauLaw3StatImpLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a prefix\"\n\n assumes C1: \"\\\\'. (\\ \\ \\', \\\\(\\.(P)), \\\\Q) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P)) \\ \\\\Q\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ \\\\Q \\\\<^sup>^\\<^sub>\\ \\\\Q\" by auto\n moreover have \"insertAssertion (extractFrame(\\\\(\\.(P)))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\Q)) \\\" using insertTauAssertion\n by(nominal_induct \\ rule: prefix.strong_inducts) (auto simp add: FrameStatEq_def intro: FrameStatImpTrans)\n moreover have \"\\ \\ \\' \\ \\\\Q \\\\<^sup>^\\<^sub>\\ \\\\Q\" by auto\n moreover have \"(\\ \\ \\', \\\\(\\.(P)), \\\\Q) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nlemma tauLaw3StatImpRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes C1: \"\\\\'. (\\ \\ \\', \\\\P, \\\\(\\.(Q))) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\ \\\\(\\.(Q))\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ \\\\(\\.(Q)) \\\\<^sup>^\\<^sub>\\ \\\\(\\.(Q))\" by auto\n moreover have \"insertAssertion (extractFrame(\\\\P)) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\(\\.(Q)))) \\\" using insertTauAssertion\n by(nominal_induct \\ rule: prefix.strong_inducts) (auto simp add: FrameStatEq_def intro: FrameStatImpTrans)\n moreover have \"\\ \\ \\' \\ \\\\(\\.(Q)) \\\\<^sup>^\\<^sub>\\ \\\\(\\.(Q))\" by auto\n moreover have \"(\\ \\ \\', \\\\P, \\\\(\\.(Q))) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nend\n\ncontext tauSum begin\n\nlemma tauLaw2StatImpLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes C1: \"\\\\'. (\\ \\ \\', P \\ \\.(P), \\.(P)) \\ Rel\" \n\n shows \"\\ \\ P \\ \\.(P) \\ \\.(P)\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ \\.(P)\" by auto\n moreover have \"insertAssertion (extractFrame(\\.(P))) \\ \\\\<^sub>F \\\\, \\\\\" by(rule insertTauAssertion)\n hence \"insertAssertion (extractFrame(P \\ \\.(P))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\.(P))) \\\" using Identity\n by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def AssertionStatEq_def)\n moreover have \"\\ \\ \\' \\ \\.(P) \\\\<^sup>^\\<^sub>\\ \\.(P)\" by auto\n moreover have \"(\\ \\ \\', P \\ \\.(P), \\.(P)) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed \n\nlemma tauLaw2StatImpRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes C1: \"\\\\'. (\\ \\ \\', \\.(P), P \\ \\.(P)) \\ Rel\"\n\n shows \"\\ \\ \\.(P) \\ P \\ \\.(P)\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ P \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P \\ \\.(P)\" by auto\n moreover have \"insertAssertion (extractFrame(\\.(P))) \\ \\\\<^sub>F \\\\, \\\\\" by(rule insertTauAssertion)\n hence \"insertAssertion (extractFrame(\\.(P))) \\ \\\\<^sub>F insertAssertion (extractFrame(P \\ \\.(P))) \\\" using Identity\n by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def AssertionStatEq_def)\n moreover have \"\\ \\ \\' \\ P \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P \\ \\.(P)\" by auto\n moreover have \"(\\ \\ \\', \\.(P), P \\ \\.(P)) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nlemma tauLaw4StatImpLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes C1: \"\\\\'. (\\ \\ \\', \\\\P \\ \\\\(\\.(P) \\ Q), \\\\(\\.(P) \\ Q)) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\(\\.(P) \\ Q)\" by auto\n hence \"insertAssertion (extractFrame(\\\\P \\ \\\\(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\(\\.(P) \\ Q))) \\\" \n using insertTauAssertion Identity\n by(nominal_induct \\ rule: prefix.strong_inducts, auto) \n (rule FrameStatImpTrans[where G=\"\\\\, \\\\\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n moreover have \"\\ \\ \\' \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\(\\.(P) \\ Q)\" by auto\n moreover have \"(\\ \\ \\', \\\\P \\ \\\\(\\.(P) \\ Q), \\\\(\\.(P) \\ Q)) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nlemma tauLaw4StatImpRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a prefix\"\n\n assumes C1: \"\\\\'. (\\ \\ \\', \\\\(\\.(P) \\ Q), \\\\P \\ \\\\(\\.(P) \\ Q)) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P) \\ Q) \\ \\\\P \\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakStatImpI)\n case(cStatImp \\')\n have \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\P \\ \\\\(\\.(P) \\ Q)\" by auto\n hence \"insertAssertion (extractFrame(\\\\(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\P \\ \\\\(\\.(P) \\ Q))) \\\"\n using insertTauAssertion Identity\n by(nominal_induct \\ rule: prefix.strong_inducts, auto) \n (rule FrameStatImpTrans[where G=\"\\\\, \\\\\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n moreover have \"\\ \\ \\' \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\P \\ \\\\(\\.(P) \\ Q)\" by auto\n moreover have \"(\\ \\ \\', \\\\(\\.(P) \\ Q), \\\\P \\ \\\\(\\.(P) \\ Q)) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Tau_Stat_Imp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.5, "lm_q1q2_score": 0.28300927491873945}} {"text": " (*-------------------------------------------*\n | DFP package |\n | May 2005 |\n | December 2005 (modified) |\n | |\n | DFP on CSP-Prover ver.3.0 |\n | September 2006 (modified) |\n | April 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory DFP_Block\nimports DFP_Deadlock\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = []t) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n definitions\n *********************************************************)\n\ndefinition\n triple_disjoint :: \"('i,'a) NetworkF => bool\"\n where\n triple_disjoint_def :\n \"triple_disjoint VF == \n (ALL i: fst VF. ALL j: fst VF. ALL k: fst VF. i ~= j & j ~= k & k ~= i\n --> (snd ((snd VF) i) Int snd ((snd VF) j) Int snd ((snd VF) k) = {}))\"\n\ndefinition\n VocabularyOf :: \"('i,'a) NetworkF => 'a set\"\n where\n VocabularyOf_def : \n \"VocabularyOf VF == \n Union {X. EX i: fst VF. EX j: fst VF. i ~= j &\n X = snd((snd VF) i) Int snd((snd VF) j)}\"\n (* internal communication *)\n\ndefinition \n BusyNetworkP :: \"('i,'p,'a) Network => bool\"\n where\n BusyNetworkP_def : \n \"BusyNetworkP V == \n ALL i: fst V. DeadlockFreeNetwork ({i}, snd V)\"\n \ndefinition \n BusyNetwork :: \"('i,'a) NetworkF => bool\"\n where\n BusyNetwork_def : \n \"BusyNetwork VF == \n ALL i: fst VF. (ALL sigma. ~(sigma isDeadlockStateOf ({i}, snd VF)))\"\n\ndefinition\n isRequestOf :: \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n (\"(1_ >> /(0_ (1/--[_]-->) /_))\" [800, 800,100,800] 900)\n where\n isRequestOf_def :\n \"VF >> i --[sigma]--> j == \n sigma isStateOf VF & \n i ~= j & i : fst VF & j : fst VF &\n (Ev ` (snd (snd VF i)) - (snd sigma) i) Int \n Ev ` (snd (snd VF j)) ~= {}\"\n\ndefinition\n isStrongRequestOf :: \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n (\"(1_ >> /(0_ (1/==[_]==>) /_))\" [800, 800,100,800] 900)\n where\n isStrongRequestOf_def :\n \"VF >> i ==[sigma]==> j == \n sigma isStateOf VF & \n i ~= j & i : fst VF & j : fst VF &\n Ev ` (snd (snd VF i)) - (snd sigma) i ~= {} &\n Ev ` (snd (snd VF i)) - (snd sigma) i <= Ev ` (snd (snd VF j))\"\n\ndefinition\n isUngrantedRequestOf ::\n \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n (\"(1_ >> /(0_ (1/--[_]-->o) /_))\" [800, 800,0,800] 900)\n where\n isUngrantedRequestOf_def :\n \"VF >> i --[sigma]-->o j == VF >> i --[sigma]--> j &\n Ev ` (snd (snd VF i)) Int Ev ` (snd (snd VF j))\n <= (snd sigma) i Un (snd sigma) j\"\n \ndefinition\n isUngrantedStrongRequestOf ::\n \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n (\"(1_ >> /(0_ (1/==[_]==>o) /_))\" [800, 800,0,800] 900)\n where\n isUngrantedStrongRequestOf_def :\n \"VF >> i ==[sigma]==>o j == VF >> i ==[sigma]==> j &\n Ev ` (snd (snd VF i)) Int Ev ` (snd (snd VF j))\n <= (snd sigma) i Un (snd sigma) j\"\n\ndefinition\n isUngrantedRequestOfwrt ::\n \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'a set => 'i => bool\"\n (\"(1_ >> /(0_ (1/--[(0_,/_)]-->o) /_))\" [800, 800,0,0,800] 900)\n where\n isUngrantedRequestOfwrt_def :\n \"VF >> i --[sigma,Lambda]-->o j == VF >> i --[sigma]-->o j &\n ((Ev ` (snd (snd VF i))) - (snd sigma) i) Un\n ((Ev ` (snd (snd VF j))) - (snd sigma) j) <= Ev ` Lambda\"\n\n(*** Block ***)\n\ndefinition\n isBlockedIn ::\n \"('i,'a) NetworkF => 'i => ('i,'a) net_state => bool\"\n (\"(_ >> _ isBlockedIn _)\" [800, 800, 800] 900)\n where\n isBlockedIn_def :\n \"VF >> i isBlockedIn sigma == \n triple_disjoint VF &\n (EX j. VF >> i --[sigma]--> j) &\n (ALL j. VF >> i --[sigma]--> j\n --> (VF >> i --[sigma, (VocabularyOf VF)]-->o j))\"\n\n(*********************************************************\n BusyNetwork lemmas\n *********************************************************)\n\nlemma BusyNetwork_BusyNetworkP :\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n ==> BusyNetwork (I,FXf) = BusyNetworkP (I,PXf)\"\napply (simp add: BusyNetwork_def)\napply (simp add: BusyNetworkP_def)\napply (rule)\n\n apply (rule ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"({i}, FXf) isFailureOf ({i}, PXf)\")\n apply (simp add: DeadlockFree_notDeadlockState)\n apply (rule isFailureOf_subset_index)\n apply (simp)\n apply (simp)\n\n apply (rule ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"({i}, FXf) isFailureOf ({i}, PXf)\")\n apply (simp add: DeadlockFree_notDeadlockState)\n apply (rule isFailureOf_subset_index)\n apply (simp)\n apply (simp)\ndone\n\n(*-----------------------------------*\n | How to check BusyNetworkF |\n *-----------------------------------*)\n\nlemma check_BusyNetwork:\n \"[| ALL i:I. ALL s Y. (s, Y) : fst (FXf i) --> Y ~= Ev ` (snd (FXf i)) |]\n ==> BusyNetwork (I,FXf)\"\napply (simp add: BusyNetwork_def)\napply (intro allI ballI)\napply (rename_tac s Yf)\napply (drule_tac x=\"i\" in bspec, simp)\n\napply (simp add: isDeadlockStateOf_def)\napply (simp add: disj_not1)\napply (intro impI)\napply (simp add: isStateOf_def)\napply (drule_tac x=\"s rest-tr (snd (FXf i))\" in spec)\napply (drule_tac x=\"Yf i\" in spec)\napply (simp)\napply (simp add: ALP_def)\ndone\n\n(*********************************************************\n in index I\n *********************************************************)\n\nlemma in_index_I1:\n \"(I, FXf) >> i --[sigma]--> j ==> i : I & j : I & i ~= j\"\nby (simp add: isRequestOf_def)\n\nlemma in_index_I2:\n \"(I, FXf) >> i ==[sigma]==> j ==> i : I & j : I & i ~= j\"\nby (simp add: isStrongRequestOf_def)\n\nlemma in_index_I3:\n \"(I, FXf) >> i --[sigma]-->o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedRequestOf_def)\napply (elim conjE)\nby (simp add: in_index_I1)\n\nlemma in_index_I4:\n \"(I, FXf) >> i ==[sigma]==>o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedStrongRequestOf_def)\napply (elim conjE)\nby (simp add: in_index_I2)\n\nlemma in_index_I5:\n \"(I, FXf) >> i --[sigma,Lambda]-->o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedRequestOfwrt_def)\napply (elim conjE)\nby (simp add: in_index_I3)\n\nlemmas in_index_I = in_index_I1 in_index_I2 in_index_I3 in_index_I4 in_index_I5\n\n(*********************************************************\n note (P.7)\n *********************************************************)\n\nlemma isUngrantedRequestOfwrt_note1:\n \"[| Lambda1 <= Lambda2 ; VF >> i --[sigma,Lambda1]-->o j |]\n ==> VF >> i --[sigma,Lambda2]-->o j\"\napply (simp add: isUngrantedRequestOfwrt_def)\nby (blast)\n\nlemma isUngrantedRequestOfwrt_note2:\n \"(snd (snd VF i)) Un (snd (snd VF j)) <= Lambda\n ==> (VF >> i --[sigma,Lambda]-->o j) = (VF >> i --[sigma]-->o j)\"\nby (auto simp add: isUngrantedRequestOfwrt_def)\n\n(*********************************************************\n sub request\n *********************************************************)\n\nlemma isRequestOf_subsetI:\n \"[| (I, FXf) >> i --[(t,Yf)]--> j; J <= I; i:J ; j:J ; \n X = Union {snd (FXf i)|i. i:J} |]\n ==> (J, FXf) >> i --[(t rest-tr X,Yf)]--> j\"\napply (simp add: isRequestOf_def)\napply (rule isStateOf_subsetI)\napply (simp_all)\ndone\n\nlemma isStrongRequestOf_subsetI:\n \"[| (I, FXf) >> i ==[(t,Yf)]==> j; J <= I; i:J ; j:J ; \n X = Union {snd (FXf i)|i. i:J} |]\n ==> (J, FXf) >> i ==[(t rest-tr X,Yf)]==> j\"\napply (simp add: isStrongRequestOf_def)\napply (rule isStateOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedRequestOf_subsetI:\n \"[| (I, FXf) >> i --[(t,Yf)]-->o j; J <= I; i:J ; j:J ; \n X = Union {snd (FXf i)|i. i:J} |]\n ==> (J, FXf) >> i --[(t rest-tr X,Yf)]-->o j\"\napply (simp add: isUngrantedRequestOf_def)\napply (rule isRequestOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedStrongRequestOf_subsetI:\n \"[| (I, FXf) >> i ==[(t,Yf)]==>o j; J <= I; i:J ; j:J ; \n X = Union {snd (FXf i)|i. i:J} |]\n ==> (J, FXf) >> i ==[(t rest-tr X,Yf)]==>o j\"\napply (simp add: isUngrantedStrongRequestOf_def)\napply (rule isStrongRequestOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedRequestOfwrt_subsetI:\n \"[| (I, FXf) >> i --[(t,Yf), Lambda1]-->o j; J <= I; i:J ; j:J ; \n Lambda1 <= Lambda2 ; X = Union {snd (FXf i)|i. i:J} |]\n ==> (J, FXf) >> i --[(t rest-tr X,Yf), Lambda2]-->o j\"\napply (simp add: isUngrantedRequestOfwrt_def)\napply (rule conjI)\napply (rule isUngrantedRequestOf_subsetI)\napply (simp_all)\napply (blast)\ndone\n\n(*********************************************************\n blocked\n *********************************************************)\n\n(*---------------------------------*\n | lemma 1 [Roscoe_Dathi_1987 P.7] |\n *---------------------------------*)\n\n(*** only if ***)\n\nlemma Lemma1_Roscoe_Dathi_1987_only_if:\n \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n (t,Yf) isDeadlockStateOf (I,FXf) |]\n ==> ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf)\"\napply (intro ballI)\napply (subgoal_tac \"ALL i:I. Yf i <= (Ev ` (snd (FXf i)))\")\n apply (simp only: isBlockedIn_def)\n apply (rule conjI)\n apply (simp)\n apply (rule conjI)\n\n (* 1 *)\n\n (* busy --> i is deadlock-free *)\n apply (simp add: isRequestOf_def)\n apply (simp add: BusyNetwork_def)\n apply (drule_tac x=\"i\" in bspec, simp)\n\n (* i is deadlock-free --> EX j *)\n apply (rule conjI)\n apply (simp add: isDeadlockStateOf_def)\n\n apply (simp add: isDeadlockStateOf_def)\n apply (simp add: disj_not1)\n apply (elim conjE)\n apply (drule_tac x=\"t rest-tr (snd (FXf i))\" in spec)\n apply (drule_tac x=\"Yf\" in spec)\n apply (simp add: isStateOf_each_element)\n apply (simp add: ALP_def)\n\n apply (subgoal_tac \"EX a: Ev ` snd (FXf i). a ~: Yf i\")\n (* ... sub 1 *)\n apply (elim bexE)\n apply (subgoal_tac \"a : Ev ` {a. EX i:I. a : snd (FXf i)}\")\n (* ... sub 2 *)\n apply (rotate_tac 4)\n apply (drule sym)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"ia\" in exI)\n apply (case_tac \"i = ia\", simp)\n apply (simp)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (blast)\n (* sub 2 *)\n apply (blast)\n (* sub 1 *)\n apply (blast)\n\n(* 2 *) \n apply (intro allI impI)\n apply (unfold isUngrantedRequestOfwrt_def)\n apply (rule conjI)\n\n (* 2-1 *)\n apply (simp add: isUngrantedRequestOf_def)\n apply (rule)\n\n apply (subgoal_tac \"x : Union {Yf i |i. i : I}\")\n apply (simp)\n apply (elim conjE bexE exE)\n apply (case_tac \"ia = i\", simp)\n apply (case_tac \"ia = j\", simp)\n (* ia ~= i & ia ~= j ==> contradict with triple_dijoint *)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (simp add: isDeadlockStateOf_def isStateOf_def)\n apply (simp add: triple_disjoint_def)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (drule_tac x=\"j\" in bspec, simp add: isRequestOf_def)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (drule mp)\n apply (simp add: isRequestOf_def)\n apply (rotate_tac -1)\n apply (erule contrapos_pp)\n apply (blast)\n\n apply (simp add: isDeadlockStateOf_def)\n apply (simp add: ALP_def)\n apply (simp add: image_iff)\n apply (elim conjE bexE, simp)\n apply (rule_tac x=\"i\" in bexI)\n apply (simp)\n apply (simp)\n\n (* 2-2 *)\n apply (rule)\n apply (simp add: VocabularyOf_def)\n apply (subgoal_tac \"x : Union {Yf i |i. i : I}\")\n\n apply (simp)\n apply (elim conjE bexE exE)\n apply (simp add: image_iff)\n apply (elim disjE conjE bexE)\n\n apply (case_tac \"i = ia\", simp)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (simp add: isDeadlockStateOf_def isStateOf_def)\n apply (rule_tac x=\"snd (FXf i) Int snd (FXf ia)\" in exI)\n apply (rule conjI)\n apply (rule_tac x=\"i\" in bexI)\n apply (rule_tac x=\"ia\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp)\n apply (blast)\n\n apply (case_tac \"j = ia\", simp)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (simp add: isDeadlockStateOf_def isStateOf_def)\n apply (rule_tac x=\"snd (FXf j) Int snd (FXf ia)\" in exI)\n apply (rule conjI)\n apply (rule_tac x=\"j\" in bexI)\n apply (rule_tac x=\"ia\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp add: isRequestOf_def)\n apply (blast)\n\n apply (simp add: isDeadlockStateOf_def)\n apply (simp add: ALP_def)\n apply (simp add: image_iff)\n apply (elim disjE conjE bexE)\n\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (fast)\n\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"j\" in bexI)\n apply (simp)\n apply (simp add: isRequestOf_def)\n\napply (simp add: isDeadlockStateOf_def)\napply (simp add: isStateOf_def)\ndone\n\n(*** if ***)\n\nlemma Lemma1_Roscoe_Dathi_1987_if:\n \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n (t,Yf) isStateOf (I,FXf) ;\n ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf) |]\n ==> (t,Yf) isDeadlockStateOf (I,FXf)\"\napply (simp add: isDeadlockStateOf_def)\napply (simp add: ALP_def)\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim exE conjE)\n apply (simp)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp add: isStateOf_def)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp add: ALP_def)\n apply (force)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (simp only: isBlockedIn_def)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n\n apply (case_tac \"Ev xa : Yf i\")\n apply (rule_tac x=\"Yf i\" in exI)\n apply (fast)\n\n (* Ev xa ~: Yf i *)\n apply (subgoal_tac \"xa : VocabularyOf (I,FXf)\")\n apply (simp add: VocabularyOf_def)\n apply (elim conjE exE bexE)\n apply (simp)\n\n apply (case_tac \"ia = i\")\n apply (simp)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE)\n\n apply (drule_tac x=\"j\" in spec)\n apply (drule mp)\n apply (simp add: isRequestOf_def)\n apply (blast)\n\n apply (simp add: isUngrantedRequestOfwrt_def)\n apply (simp add: isUngrantedRequestOf_def)\n apply (rule_tac x=\"Yf j\" in exI)\n apply (fast)\n\n apply (case_tac \"j = i\")\n apply (simp)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE)\n apply (drule_tac x=\"ia\" in spec)\n apply (drule mp)\n apply (simp add: isRequestOf_def)\n apply (blast)\n\n apply (simp add: isUngrantedRequestOfwrt_def)\n apply (simp add: isUngrantedRequestOf_def)\n apply (rule_tac x=\"Yf ia\" in exI)\n apply (fast)\n\n (* ia ~= i; j ~= i; ia ~= j, but xa : snd (PXf i), ... *)\n apply (simp add: triple_disjoint_def)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (rotate_tac -1)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (rotate_tac -1)\n apply (drule_tac x=\"j\" in bspec, simp)\n apply (fast)\n\n (* xa : VocabularyOf VF *)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim exE conjE)\n apply (drule_tac x=\"xb\" in spec)\n apply (simp add: isUngrantedRequestOfwrt_def)\n apply (fast)\ndone\n\nlemma Lemma1_Roscoe_Dathi_1987:\n \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n (t,Yf) isStateOf (I,FXf) |]\n ==> (t,Yf) isDeadlockStateOf (I,FXf)\n = (ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf))\"\napply (rule)\napply (simp add: Lemma1_Roscoe_Dathi_1987_only_if)\napply (simp add: Lemma1_Roscoe_Dathi_1987_if)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/DFP/DFP_Block.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.282948671068109}} {"text": "section \\ Modelica Core \\\n\ntheory Modelica_Core\nimports \"UTP1-Hybrid.utp_hrd\"\nbegin\n \nnamed_theorems mo_defs\n \nalphabet 'l mst =\n mtime :: real\n mintern :: \"'l\" \\ \\ Internal continuous variables \\\n \nsetup_lifting type_definition_mst_ext\n\ntext \\ Syntax for internal variables \\\n \nnotation mintern (\"\\<^bold>i\")\n \nsyntax\n \"_svid_mintern\" :: \"svid\" (\"\\<^bold>i\")\n \ntranslations\n \"_svid_mintern\" => \"CONST mintern\"\n \ninstantiation mst_ext :: (t2_space,t2_space) t2_space\nbegin\n lift_definition open_mst_ext :: \"('a, 'b) mst_scheme set \\ bool\" is \"open\" .\n instance by (intro_classes, (transfer, auto simp add: separation_t2)+)\nend\n \ndefinition map_mst ::\n \"('\\ \\ '\\) \\\n ('\\, 'c) mst_scheme \\ ('\\, 'c) mst_scheme\" where\n[lens_defs]: \"map_mst f = (\\r. \\mtime\\<^sub>v = mtime\\<^sub>v r, mintern\\<^sub>v = f (mintern\\<^sub>v r), \\ = more r\\)\"\n\ndefinition map_mst_lens ::\n \"('\\ \\ '\\) \\ \n (('\\, 'b) mst_scheme, 't::trace, 'c) rsp \\ (('\\, 'b) mst_scheme, 't, 'c) rsp\" (\"map'_mst\\<^sub>L\") where\n[lens_defs]:\n\"map_mst_lens l = map_st\\<^sub>L \\\n lens_get = map_mst (get\\<^bsub>l\\<^esub>),\n lens_put = map_mst o (put\\<^bsub>l\\<^esub>) o mintern\\<^sub>v\\\"\n\n\nlemma map_mst_vwb [simp]: \"vwb_lens X \\ vwb_lens (map_mst\\<^sub>L X)\"\n by (unfold_locales, simp_all add: lens_defs des_vars.defs rp_vars.defs rsp_vars.defs)\n\nabbreviation \"abs_mst\\<^sub>L \\ (map_mst\\<^sub>L 0\\<^sub>L) \\\\<^sub>L (map_mst\\<^sub>L 0\\<^sub>L)\"\n\ntype_synonym ('l, 'c) mrel = \"(('l, 'c) mst_ext, ('l, 'c) mst_ext) hyrel\"\ntype_synonym ('d, 'l, 'c) mpred = \"('d, ('l, 'c) mst_ext) hybs upred\"\ntype_synonym ('a, 'l, 'c) mexpr = \"('a, ('l, 'c) mst_ext) uexpr\" \n \ntranslations\n (type) \"('l,'c) mrel\" <= (type) \"(('l, 'c) mst_scheme, ('l', 'c') mst_scheme) hyrel\"\n (type) \"('d,'l,'c) mpred\" <= (type) \"('d, ('l, 'c) mst_scheme) hybs upred\"\n (type) \"('a,'l,'c) mexpr\" <= (type) \"('a, ('l, 'c) mst_scheme) uexpr\"\n \ntext \\ Preconditions are captured by negating the continuous divergences, that is the set of\n trajectories that eventually violate the precondition. Every divergence can be extended\n aribtrarily. The precondition effectively states that no trace must violate the precondition\n at the limit. \\\n \ndefinition ModelicaPre (\"\\_\\\\<^sub>M\") where\n[upred_defs]: \"\\P\\\\<^sub>M = (\\\\<^sub>r (\\\\ P\\\\<^sup>\\ ;; true\\<^sub>r))\"\n \nlemma true_ModelicaPre [rpred]: \"\\true\\\\<^sub>M = true\\<^sub>r\"\n by (rel_auto)\n\nlemma ModelicaPre_RC [closure]: \"\\P\\\\<^sub>M is RC\"\n apply (rel_auto)\n apply (meson less_iff minus_gr_zero_iff order_refl)\n apply (metis (no_types, lifting) diff_add_cancel_left' minus_gr_zero_iff order.trans trace_class.add_diff_cancel_left trace_class.add_left_mono)\ndone\n\ndefinition ModelicaBlock (\"[_ | _]\\<^sub>M\") where\n\"[P | Q]\\<^sub>M = \\<^bold>R\\<^sub>s(\\P\\\\<^sub>M \\ Q \\ false)\"\n\nlemma preR_simple_block [rdes]: \"pre\\<^sub>R([P\\<^sub>1 | \\Q\\<^sub>1\\\\<^sub>h]\\<^sub>M) = \\P\\<^sub>1\\\\<^sub>M\"\n by (simp add: ModelicaBlock_def preR_srdes closure)\n\nlemma periR_simple_block [rdes]: \"peri\\<^sub>R([P\\<^sub>1 | \\Q\\<^sub>1\\\\<^sub>h]\\<^sub>M) = (\\P\\<^sub>1\\\\<^sub>M \\\\<^sub>r \\Q\\<^sub>1\\\\<^sub>h)\"\n by (simp add: ModelicaBlock_def rdes closure)\n \nlemma postR_simple_block [rdes]: \"post\\<^sub>R([P | \\Q\\\\<^sub>h]\\<^sub>M) = (\\\\<^sub>r \\P\\\\<^sub>M)\"\n by (simp add: ModelicaBlock_def rdes closure)\n \nlemma NSRD_simple_block [closure]: \"[P\\<^sub>1 | \\Q\\<^sub>1\\\\<^sub>h]\\<^sub>M is NSRD\"\n apply (rule NSRD_intro)\n apply (simp add: ModelicaBlock_def)\n apply (rule RHS_tri_design_is_SRD)\n apply (simp_all add: unrest rdes closure RC1_prop RC_implies_RC1)\ndone\n \nend\n", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/modelica/Modelica_Core.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2827003840742062}} {"text": " (*-------------------------------------------------*\n | (a part of) ep2 |\n | September 2004 |\n | December 2004 (modified) |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Markus Roggenbach (Univ of Wales Swansea, UK) |\n | Yoshinao Isobe (AIST, Japan) |\n *-------------------------------------------------*)\n\ntheory ep2_nucleus\nimports CSP_F\nbegin\n\n(*** To automatically unfold syntactic sugar ***)\n\ndeclare csp_prefix_ss_def [simp]\ndeclare inj_on_def [simp]\n\n(*********************************************************\n data type passed on channels\n *********************************************************)\n\ntypedecl init_d typedecl request_d typedecl response_d typedecl exit_d\n\ndatatype Data = Init init_d | Exit exit_d\n | Request request_d | Response response_d\n\n(*********************************************************\n event (channel)\n *********************************************************)\n\ndatatype Event = c Data\n\n(*********************************************************\n abstract component description level\n *********************************************************)\n\ndatatype ACName = Acquirer | AcConfigManagement \n | Terminal | TerminalConfigManagement\n\nprimrec\n ACfun :: \"ACName => (ACName, Event) proc\"\nwhere\n \"ACfun Acquirer\n = c ? x:(range Init) -> $AcConfigManagement\"\n\n |\"ACfun AcConfigManagement\n = c !? exit:(range Exit) -> SKIP\n |~| \n c !? request:(range Request)\n -> c ? response:(range Response)\n -> $AcConfigManagement\"\n\n |\"ACfun Terminal\n = c !? init:(range Init) -> $TerminalConfigManagement\"\n\n |\"ACfun TerminalConfigManagement\n = c ? x -> IF (x:range Request) \n THEN (c !? response:(range Response)\n -> $TerminalConfigManagement)\n ELSE IF (x:range Exit)\n THEN SKIP\n ELSE STOP\"\n(*\ndefs (overloaded)\nSet_ACfun_def [simp]: \"PNfun == ACfun\"\n*)\n\noverloading Set_ACfun == \n \"PNfun :: (ACName, Event) pnfun\"\nbegin\n definition \"PNfun == ACfun\"\nend\n\ndeclare Set_ACfun_def [simp]\n\ndefinition\n AC :: \"(ACName, Event) proc\"\n where\n AC_def: \"AC == ($Acquirer |[range c]| $Terminal)\"\n\n(*---------------------------------------------------------------*\n | NOTE |\n | |\n | c ! v -> P : sends a value v to c, then behaves like P. |\n | |\n | c ? x:X -> P(x) : receives a value v from c if c in X, |\n | then behaves like P(v). |\n | |\n | c !? x:X -> P(x) : sends a value v selected from X to c, |\n | then behaves like P(v). |\n | |\n *---------------------------------------------------------------*)\n\n(*********************************************************\n equivalent sequential behavior\n *********************************************************)\n\ndatatype SeqName = SeqInit | Loop\n\nprimrec\n Seqfun :: \"SeqName => (SeqName, Event) proc\"\nwhere\n \"Seqfun SeqInit\n = c !? init:(range Init) -> $Loop\"\n\n |\"Seqfun Loop\n = c !? exit:(range Exit) -> SKIP\n |~| \n c !? request:(range Request)\n -> c !? response:(range Response)\n -> $Loop\"\n(*\ndefs (overloaded)\nSet_Seqfun_def [simp]: \"PNfun == Seqfun\"\n*)\n\noverloading Set_Seqfun == \n \"PNfun :: (SeqName, Event) pnfun\"\nbegin\n definition \"PNfun == Seqfun\"\nend\n \ndeclare Set_Seqfun_def [simp]\n\ndefinition\n Seq :: \"(SeqName, Event) proc\"\n where\n Seq_def: \"Seq == $SeqInit\"\n\n(*********************************************************\n relating function between ACName and SeqName\n *********************************************************)\n\nprimrec\n Seq_to_AC :: \"SeqName => (ACName, Event) proc\"\nwhere\n \"Seq_to_AC (SeqInit)\n = ($Acquirer |[range c]| $Terminal)\"\n\n |\"Seq_to_AC (Loop)\n = ($AcConfigManagement |[range c]| $TerminalConfigManagement)\"\n\n(*********************************************************\n gProc lemmas (routine work)\n *********************************************************)\n\nlemma guardedfun_AC_Seq[simp]:\n \"guardedfun ACfun\"\n \"guardedfun Seqfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)+\n\n(*********************************************************\n a theorem for verifying Seq <=F AC\n *********************************************************)\n(*\ndefs FPmode_def [simp]: \"FPmode == CMSmode\"\n*)\n\noverloading FPmode == \n \"FPmode :: fpmode\"\nbegin\n definition \"FPmode == CMSmode\"\nend\n\ndeclare FPmode_def [simp]\n\n\ntheorem ep2: \"Seq =F AC\"\napply (unfold Seq_def AC_def)\napply (rule cspF_fp_induct_left[of _ \"Seq_to_AC\"])\napply (simp_all)\napply (simp)\napply (induct_tac p)\napply (simp_all)\n\n(* 1st subgoal *)\napply (cspF_unwind)\napply (cspF_hsf)+\napply (rule cspF_decompo, auto)\napply (cspF_hsf)+\napply (rule cspF_decompo, auto)\napply (cspF_hsf)+\n\n(* 2nd subgoal *)\napply (cspF_auto | rule cspF_decompo | rule cspF_decompo_ref | \n auto simp add: image_iff)+\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/ep2/ep2_nucleus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6513548511303338, "lm_q2_score": 0.4339814648038986, "lm_q1q2_score": 0.2826759324006676}} {"text": "(* Title: JinjaDCI/BV/TF_JVM.thy\n\n Author: Tobias Nipkow, Gerwin Klein, Susannah Mansky\n Copyright 2000 TUM, 2019-20 UIUC\n\n Based on the Jinja theory BV/TF_JVM.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\ The Typing Framework for the JVM \\label{sec:JVM} \\\n\ntheory TF_JVM\nimports Jinja.Typing_Framework_err EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ ex_table \\ instr list \\ ty\\<^sub>i' err step_type\"\nwhere \n \"exec G maxs rT et bs \\\n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc (size bs) et) \n (\\pc. eff (bs!pc) G pc et)\"\n\nlocale JVM_sl =\n fixes P :: jvm_prog and mxs and mxl\\<^sub>0 and n\n fixes b and Ts :: \"ty list\" and \"is\" and xt and T\\<^sub>r\n\n fixes mxl and A and r and f and app and eff and step\n defines [simp]: \"mxl \\ (case b of Static \\ 0 | NonStatic \\ 1)+size Ts+mxl\\<^sub>0\"\n defines [simp]: \"A \\ states P mxs mxl\"\n defines [simp]: \"r \\ JVM_SemiType.le P mxs mxl\"\n defines [simp]: \"f \\ JVM_SemiType.sup P mxs mxl\"\n\n defines [simp]: \"app \\ \\pc. Effect.app (is!pc) P mxs T\\<^sub>r pc (size is) xt\"\n defines [simp]: \"eff \\ \\pc. Effect.eff (is!pc) P pc xt\"\n defines [simp]: \"step \\ err_step (size is) app eff\"\n\n defines [simp]: \"n \\ size is\"\n assumes staticb: \"b = Static \\ b = NonStatic\" \n\nlocale start_context = JVM_sl +\n fixes p and C\n\n assumes wf: \"wf_prog p P\"\n assumes C: \"is_class P C\"\n assumes Ts: \"set Ts \\ types P\"\n\n \n fixes first :: ty\\<^sub>i' and start\n defines [simp]: \n \"first \\ Some ([],(case b of Static \\ [] | NonStatic \\ [OK (Class C)]) @ map OK Ts @ replicate mxl\\<^sub>0 Err)\"\n defines [simp]:\n \"start \\ (OK first) # replicate (size is - 1) (OK None)\"\nthm start_context.intro\n\nlemma start_context_intro_auxi: \n fixes P b Ts p C\n assumes \"b = Static \\ b = NonStatic \" \n and \"wf_prog p P\"\n and \"is_class P C\"\n and \"set Ts \\ types P\"\n shows \" start_context P b Ts p C\"\n using start_context.intro[OF JVM_sl.intro] start_context_axioms_def assms by auto\n\nsubsection \\ Connecting JVM and Framework \\\n\nlemma (in start_context) semi: \"semilat (A, r, f)\"\n apply (insert semilat_JVM[OF wf])\n apply (unfold A_def r_def f_def JVM_SemiType.le_def JVM_SemiType.sup_def states_def)\n apply auto\n done\n\n\nlemma (in JVM_sl) step_def_exec: \"step \\ exec P mxs T\\<^sub>r xt is\" \n by (simp add: exec_def) \n\nlemma special_ex_swap_\n\nlemma ex_in_list [iff]:\n \"(\\n. ST \\ nlists n A \\ n \\ mxs) = (set ST \\ A \\ size ST \\ mxs)\"\n by (unfold nlists_def) auto\n\nlemma singleton_nlists: \n \"(\\n. [Class C] \\ nlists n (types P) \\ n \\ mxs) = (is_class P C \\ 0 < mxs)\"\n by auto\n\nlemma set_drop_subset:\n \"set xs \\ A \\ set (drop n xs) \\ A\"\n by (auto dest: in_set_dropD)\n\nlemma Suc_minus_minus_le:\n \"n < mxs \\ Suc (n - (n - b)) \\ mxs\"\n by arith\n\nlemma in_nlistsE:\n \"\\ xs \\ nlists n A; \\size xs = n; set xs \\ A\\ \\ P \\ \\ P\"\n by (unfold nlists_def) blast\n\ndeclare is_relevant_entry_def [simp]\ndeclare set_drop_subset [simp]\n\ntheorem (in start_context) exec_pres_type:\n \"pres_type step (size is) A\"\n(*<*)\nproof -\n let ?n = \"size is\" and ?app = app and ?step = eff\n let ?mxl = \"(case b of Static \\ 0 | NonStatic \\ 1) + length Ts + mxl\\<^sub>0\"\n let ?A = \"opt((Union {nlists n (types P) |n. n <= mxs}) \\\n nlists ?mxl (err(types P)))\"\n have \"pres_type (err_step ?n ?app ?step) ?n (err ?A)\"\n proof(rule pres_type_lift)\n have \"\\s pc pc' s'. s\\?A \\ pc < ?n \\ ?app pc s\n \\ (pc', s')\\set (?step pc s) \\ s' \\ ?A\"\n proof -\n fix s pc pc' s'\n assume asms: \"s\\?A\" \"pc < ?n\" \"?app pc s\" \"(pc', s')\\set (?step pc s)\"\n show \"s' \\ ?A\"\n proof(cases s)\n case None\n then show ?thesis using asms by (fastforce dest: effNone)\n next\n case (Some ab)\n then show ?thesis using asms proof(cases \"is!pc\")\n case Load\n then show ?thesis using asms\n by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def\n dest: nlistsE_nth_in)\n next\n case Push\n then show ?thesis using asms Some\n by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def\n xcpt_eff_def norm_eff_def typeof_lit_is_type)\n next\n case Getfield\n then show ?thesis using asms wf\n by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def\n xcpt_eff_def norm_eff_def\n dest: sees_field_is_type)\n next\n case Getstatic\n then show ?thesis using asms wf\n by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def\n xcpt_eff_def norm_eff_def\n dest: sees_field_is_type)\n next\n case (Invoke M n)\n obtain a b where [simp]: \"s = \\(a,b)\\\" using Some asms(1) by blast\n show ?thesis\n proof(cases \"a!n = NT\")\n case True\n then show ?thesis using Invoke asms wf\n by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def)\n next\n case False\n have \"(pc', s') \\ set (norm_eff (Invoke M n) P pc (a, b)) \\\n (pc', s') \\ set (xcpt_eff (Invoke M n) P pc (a, b) xt)\"\n using Invoke asms(4) by (simp add: Effect.eff_def)\n then show ?thesis proof(rule disjE)\n assume \"(pc', s') \\ set (xcpt_eff (Invoke M n) P pc (a, b) xt)\"\n then show ?thesis using Invoke asms(1-3)\n by (fastforce simp: Effect.app_def xcpt_app_def xcpt_eff_def)\n next\n assume norm: \"(pc', s') \\ set (norm_eff (Invoke M n) P pc (a, b))\"\n also have \"Suc (length a - Suc n) \\ mxs\" using Invoke asms(1,3)\n by (simp add: Effect.app_def xcpt_app_def) arith\n ultimately show ?thesis using False Invoke asms(1-3) wf\n by (auto simp: Effect.app_def xcpt_app_def norm_eff_def wf_mdecl_def\n dest!: sees_wf_mdecl)\n qed\n qed\n next\n case (Invokestatic C M n)\n obtain a b where [simp]: \"s = \\(a,b)\\\" using Some asms(1) by blast\n have \"(pc', s') \\ set (norm_eff (Invokestatic C M n) P pc (a, b)) \\\n (pc', s') \\ set (xcpt_eff (Invokestatic C M n) P pc (a, b) xt)\"\n using Invokestatic asms(4) by (simp add: Effect.eff_def)\n then show ?thesis proof(rule disjE)\n assume \"(pc', s') \\ set (xcpt_eff (Invokestatic C M n) P pc (a, b) xt)\"\n then show ?thesis using Invokestatic asms(1-3)\n by (fastforce simp: Effect.app_def xcpt_app_def xcpt_eff_def)\n next\n assume norm: \"(pc', s') \\ set (norm_eff (Invokestatic C M n) P pc (a, b))\"\n also have \"Suc (length a - Suc n) \\ mxs\" using Invokestatic asms(1,3)\n by (simp add: Effect.app_def xcpt_app_def) arith\n ultimately show ?thesis using Invokestatic asms(1-3) wf\n by (auto simp: Effect.app_def xcpt_app_def norm_eff_def wf_mdecl_def\n dest!: sees_wf_mdecl)\n qed\n qed (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def)+\n qed\n qed\n then show \"\\s\\?A. \\p. p < ?n \\ ?app p s \\ (\\(q, s')\\set (?step p s). s' \\ ?A)\"\n by clarsimp\n qed\n then show ?thesis by (simp add: JVM_states_unfold)\nqed\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\ndeclare set_drop_subset [simp del]\n\nlemma lesubstep_type_simple:\n \"xs [\\\\<^bsub>Product.le (=) r\\<^esub>] ys \\ set xs {\\\\<^bsub>r\\<^esub>} set ys\"\n(*<*)\nproof -\n assume assm: \"xs [\\\\<^bsub>Product.le (=) r\\<^esub>] ys\"\n have \"\\a b i y. (a, b) = xs ! i \\ i < length xs\n \\ \\\\'. (\\i. (a, \\') = ys ! i \\ i < length xs) \\ b \\\\<^bsub>r\\<^esub> \\'\"\n proof -\n fix a b i assume ith: \"(a, b) = xs ! i\" and len: \"i < length xs\"\n obtain \\ where \"ys ! i = (a, \\) \\ r b \\\"\n using le_listD[OF assm len] ith\n by (clarsimp simp: lesub_def Product.le_def)\n then have \"(a, \\) = ys ! i \\ b \\\\<^bsub>r\\<^esub> \\\"\n by (clarsimp simp: lesub_def)\n with len show \"\\\\'. (\\i. (a, \\') = ys ! i \\ i < length xs) \\ b \\\\<^bsub>r\\<^esub> \\'\"\n by fastforce\n qed\n then show \"set xs {\\\\<^bsub>r\\<^esub>} set ys\" using assm\n by (clarsimp simp: lesubstep_type_def set_conv_nth)\nqed\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\n\n\nlemma conjI2: \"\\ A; A \\ B \\ \\ A \\ B\" by blast\n \nlemma (in JVM_sl) eff_mono:\nassumes wf: \"wf_prog p P\" and \"pc < length is\" and\n lesub: \"s \\\\<^bsub>sup_state_opt P\\<^esub> t\" and app: \"app pc t\"\nshows \"set (eff pc s) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (eff pc t)\"\n(*<*)\nproof(cases t)\n case None then show ?thesis using lesub\n by (simp add: Effect.eff_def lesub_def)\nnext\n case tSome: (Some a)\n show ?thesis proof(cases s)\n case None then show ?thesis using lesub\n by (simp add: Effect.eff_def lesub_def)\n next\n case (Some b)\n let ?norm = \"\\x. norm_eff (is ! pc) P pc x\"\n let ?xcpt = \"\\x. xcpt_eff (is ! pc) P pc x xt\"\n let ?r = \"Product.le (=) (sup_state_opt P)\"\n let ?\\' = \"\\eff\\<^sub>i (is ! pc, P, a)\\\"\n {\n fix x assume xb: \"x \\ set (succs (is ! pc) b pc)\"\n then have appi: \"app\\<^sub>i (is ! pc, P, pc, mxs, T\\<^sub>r, a)\" and\n bia: \"P \\ b \\\\<^sub>i a\" and appa: \"app pc \\a\\\"\n using lesub app tSome Some by (auto simp add: lesub_def Effect.app_def)\n have xa: \"x \\ set (succs (is ! pc) a pc)\"\n using xb succs_mono[OF wf appi bia] by auto\n then have \"(x, ?\\') \\ (\\pc'. (pc', ?\\')) ` set (succs (is ! pc) a pc)\"\n by (rule imageI)\n moreover have \"P \\ \\eff\\<^sub>i (is ! pc, P, b)\\ \\' ?\\'\"\n using xb xa eff\\<^sub>i_mono[OF wf bia] appa by fastforce\n ultimately have \"\\\\'. (x, \\') \\ (\\pc'. (pc', \\eff\\<^sub>i (is ! pc, P, a)\\)) ` set (succs (is ! pc) a pc) \\\n P \\ \\eff\\<^sub>i (is ! pc, P, b)\\ \\' \\'\" by blast\n }\n then have norm: \"set (?norm b) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (?norm a)\"\n using tSome Some by (clarsimp simp: norm_eff_def lesubstep_type_def lesub_def)\n obtain a1 b1 a2 b2 where a: \"a = (a1, b1)\" and b: \"b = (a2, b2)\"\n using tSome Some by fastforce\n then have a12: \"size a2 = size a1\" using lesub tSome Some\n by (clarsimp simp: lesub_def list_all2_lengthD)\n have \"length (?xcpt b) = length (?xcpt a)\"\n by (simp add: xcpt_eff_def split_beta)\n moreover have \"\\n. n < length (?xcpt b) \\ (?xcpt b) ! n \\\\<^bsub>?r\\<^esub> (?xcpt a) ! n\"\n using lesub tSome Some a b a12\n by (simp add: xcpt_eff_def split_beta fun_of_def) (simp add: lesub_def)\n ultimately have \"?xcpt b [\\\\<^bsub>?r\\<^esub>] ?xcpt a\"\n by(rule le_listI)\n then have \"set (?xcpt b) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (?xcpt a)\"\n by (rule lesubstep_type_simple)\n moreover note norm\n ultimately have\n \"set (?norm b) \\ set (?xcpt b) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (?norm a) \\ set (?xcpt a)\"\n by(intro lesubstep_union)\n then show ?thesis using tSome Some by(simp add: Effect.eff_def)\n qed\nqed\n(*>*)\n\nlemma (in JVM_sl) bounded_step: \"bounded step (size is)\"\n(*<*)\n by (auto simp: bounded_def err_step_def Effect.app_def Effect.eff_def\n error_def map_snd_def\n split: err.splits option.splits)\n(*>*)\n\ntheorem (in JVM_sl) step_mono:\n \"wf_prog wf_mb P \\ mono r step (size is) A\"\n(*<*)\n apply (simp add: JVM_le_Err_conv) \n apply (insert bounded_step)\n apply (unfold JVM_states_unfold)\n apply (rule mono_lift) \n apply (subgoal_tac \"b = Static \\ b = NonStatic\") \n apply (fastforce split:if_splits)\\\\ order_sup_state_opt' order_sup_state_opt'' \\\n apply (simp only:staticb)\n apply (unfold app_mono_def lesub_def)\n apply clarsimp\n apply (erule (2) app_mono)\n apply simp\n apply clarify\n apply (drule eff_mono)\n apply (auto simp add: lesub_def)\n done\n(*\nproof -\n assume wf: \"wf_prog wf_mb P\"\n let ?r = \"sup_state_opt P\" and ?n = \"length is\" and ?app = app and ?step = eff\n let ?A = \"opt (\\ {list n (types P) |n. n \\ mxs} \\\n list ((case b of Static \\ 0 | NonStatic \\ 1) + length Ts + mxl\\<^sub>0)\n (err (types P)))\"\n have \"order ?r ?A\" using wf by simp\n moreover have \"app_mono ?r ?app ?n ?A\" using app_mono[OF wf]\n by (clarsimp simp: app_mono_def lesub_def)\n moreover have \"bounded (err_step ?n ?app ?step) ?n\" using bounded_step\n by simp\n moreover have \"\\s p t. s \\ ?A \\ p < ?n \\ s \\\\<^bsub>?r\\<^esub> t \\\n ?app p t \\ set (?step p s) {\\\\<^bsub>?r\\<^esub>} set (?step p t)\"\n using eff_mono[OF wf] by simp\n ultimately have \"mono (Err.le ?r) (err_step ?n ?app ?step) ?n (err ?A)\"\n by(rule mono_lift)\n then show \"mono r step (size is) A\" using bounded_step\n by (simp add: JVM_le_Err_conv JVM_states_unfold)\nqed\n*)\n(*>*)\n\n\nlemma (in start_context) first_in_A [iff]: \"OK first \\ A\"\n using Ts C by (cases b; force intro!: nlists_appendI simp add: JVM_states_unfold)\n\n\nlemma (in JVM_sl) wt_method_def2:\n \"wt_method P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s =\n (is \\ [] \\ \n (b = Static \\ b = NonStatic) \\\n size \\s = size is \\\n OK ` set \\s \\ states P mxs mxl \\\n wt_start P C' b Ts mxl\\<^sub>0 \\s \\ \n wt_app_eff (sup_state_opt P) app eff \\s)\"\n(*<*)using staticb\n by (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def\n check_types_def) auto\n(*>*)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/TF_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2825035625210456}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_ref\nimports CSP_F_law_basic CSP_T_law_ref\nbegin\n\n(*****************************************************************\n\n 1. rules for refinement\n\n *****************************************************************)\n\n(*-------------------------------------------------------*\n | refinement and equality |\n *-------------------------------------------------------*)\n\nlemma cspF_ref_eq_iff: \"(P <=F[M,M] Q) = (P =F[M,M] Q |~| P)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_ref_eq_iff)\napply (rule)\n\n(* <= *)\n apply (simp)\n apply (rule order_antisym)\n apply (simp add: subsetF_iff)\n apply (simp add: in_failures)\n apply (simp add: subsetF_iff)\n apply (simp add: in_failures)\n\n(* => *)\n apply (simp)\n apply (erule conjE)\n apply (erule order_antisymE)\n apply (rule)\n apply (rotate_tac 2)\n apply (erule subsetFE_ALL)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: in_failures)\ndone\n\n(*-------------------------------------------------------*\n | decompose Internal choice |\n *-------------------------------------------------------*)\n\n(*** or <= ***) (* unsafe *)\n\nlemma cspF_Int_choice_left1:\n \"P1 <=F[M1,M2] Q ==> P1 |~| P2 <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_choice_left1)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Int_choice_left2:\n \"P2 <=F[M1,M2] Q ==> P1 |~| P2 <=F[M1,M2] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\nby (simp add: cspF_Int_choice_left1)\n\n(*** <= and ***) (* safe *)\n\nlemma cspF_Int_choice_right:\n \"[| P <=F[M1,M2] Q1 ; P <=F[M1,M2] Q2 |]\n ==> P <=F[M1,M2] Q1 |~| Q2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\n(*-------------------------------------------------------*\n | decompose Replicated internal choice |\n *-------------------------------------------------------*)\n\n(*** EX <= ***) (* unsafe *)\n\nlemma cspF_Rep_int_choice_nat_left:\n \"(EX n. n:N & Pf n <=F[M1,M2] Q)\n ==> !nat :N .. Pf <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (rule conjI)\n\napply (rule cspT_Rep_int_choice_left)\napply (fast)\n\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_nat_left_x:\n \"[| n:N ; Pf n <=F[M1,M2] Q |]\n ==> !nat :N .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_nat_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_set_left:\n \"(EX X. X:Xs & Pf X <=F[M1,M2] Q)\n ==> !set :Xs .. Pf <=F[M1,M2] Q\"\napply (simp add: cspF_cspT_semantics)\napply (rule conjI)\n\napply (rule cspT_Rep_int_choice_left)\napply (fast)\n\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_left_x:\n \"[| X:Xs ; Pf X <=F[M1,M2] Q |]\n ==> !set :Xs .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_set_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_com_left:\n \"(EX a. a:X & Pf a <=F[M1,M2] Q)\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (simp add: Rep_int_choice_com_def)\napply (rule cspF_Rep_int_choice_set_left)\napply (erule exE)\napply (rule_tac x=\"{a}\" in exI)\napply (auto)\ndone\n\nlemma cspF_Rep_int_choice_com_left_x:\n \"[| a:X ; Pf a <=F[M1,M2] Q |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_com_left)\nby (fast)\n\nlemma cspF_Rep_int_choice_f_left:\n \"[| inj f ; (EX a. a:X & Pf a <=F[M1,M2] Q) |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (simp add: Rep_int_choice_f_def)\napply (rule cspF_Rep_int_choice_com_left)\napply (erule exE)\napply (rule_tac x=\"f a\" in exI)\napply (auto)\ndone\n\nlemma cspF_Rep_int_choice_f_left_x:\n \"[| inj f ; a:X ; Pf a <=F[M1,M2] Q |]\n ==> ! :X .. Pf <=F[M1,M2] Q\"\napply (rule cspF_Rep_int_choice_f_left)\napply (simp)\nby (fast)\n\nlemmas cspF_Rep_int_choice_left = cspF_Rep_int_choice_nat_left\n cspF_Rep_int_choice_set_left\n cspF_Rep_int_choice_com_left\n cspF_Rep_int_choice_f_left\n\nlemmas cspF_Rep_int_choice_left_x = cspF_Rep_int_choice_nat_left_x\n cspF_Rep_int_choice_set_left_x\n cspF_Rep_int_choice_com_left_x\n cspF_Rep_int_choice_f_left_x\n\n(*** <= ALL ***) (* safe *)\n\nlemma cspF_Rep_int_choice_nat_right:\n \"[| !!n. n:N ==> P <=F[M1,M2] Qf n |]\n ==> P <=F[M1,M2] !nat :N .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_right:\n \"[| !!X. X:Xs ==> P <=F[M1,M2] Qf X |]\n ==> P <=F[M1,M2] !set :Xs .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_right:\n \"[| !!a. a:X ==> P <=F[M1,M2] Qf a |]\n ==> P <=F[M1,M2] ! :X .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_right:\n \"[| inj f ; !!a. a:X ==> P <=F[M1,M2] Qf a |]\n ==> P <=F[M1,M2] ! :X .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_right)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_right \n = cspF_Rep_int_choice_nat_right\n cspF_Rep_int_choice_set_right\n cspF_Rep_int_choice_com_right\n cspF_Rep_int_choice_f_right\n\n(* 1,2,3,f E *)\n\nlemma cspF_Rep_int_choice_nat_rightE:\n \"[| P <=F[M1,M2] !nat :N .. Qf ;\n ALL n:N. P <=F[M1,M2] Qf n ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_rightE:\n \"[| P <=F[M1,M2] !set :Xs .. Qf ;\n ALL X:Xs. P <=F[M1,M2] Qf X ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_rightE:\n \"[| P <=F[M1,M2] ! :X .. Qf ;\n ALL a:X. P <=F[M1,M2] Qf a ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_rightE:\n \"[| P <=F[M1,M2] ! :X .. Qf ; inj f ;\n [| ALL a:X. P <=F[M1,M2] Qf a |] ==> R\n |] ==> R\"\napply (simp add: cspF_cspT_semantics)\napply (elim conjE exE)\napply (erule cspT_Rep_int_choice_rightE)\napply (simp)\n\napply (simp add: subsetF_iff)\napply (simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_rightE =\n cspF_Rep_int_choice_nat_rightE\n cspF_Rep_int_choice_set_rightE\n cspF_Rep_int_choice_com_rightE\n cspF_Rep_int_choice_f_rightE\n\n(*-------------------------------------------------------*\n | decomposition with subset |\n *-------------------------------------------------------*)\n\nlemma cspF_Rep_int_choice_nat_subset:\n \"[| N2 <= N1 ; !!n. n:N2 ==> Pf n <=F[M1,M2] Qf n |]\n ==> !nat :N1 .. Pf <=F[M1,M2] !nat :N2 .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_set_subset:\n \"[| Ys <= Xs ; !!X. X:Ys ==> Pf X <=F[M1,M2] Qf X |]\n ==> !set :Xs .. Pf <=F[M1,M2] !set :Ys .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_com_subset:\n \"[| Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! :X .. Pf <=F[M1,M2] ! :Y .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemma cspF_Rep_int_choice_f_subset:\n \"[| inj f ; Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! :X .. Pf <=F[M1,M2] ! :Y .. Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_Rep_int_choice_subset \n = cspF_Rep_int_choice_nat_subset\n cspF_Rep_int_choice_set_subset\n cspF_Rep_int_choice_com_subset\n cspF_Rep_int_choice_f_subset\n\n(*** ! x:X .. and ? -> ***)\n\nlemma cspF_Int_Ext_pre_choice_subset:\n \"[| Y ~={} ; Y <= X ; !!a. a:Y ==> Pf a <=F[M1,M2] Qf a |]\n ==> ! x:X .. (x -> Pf x) <=F[M1,M2]\n ? :Y -> Qf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Int_Ext_pre_choice_subset)\napply (rule, simp add: in_failures)\napply (force)\ndone\n\nlemmas cspF_decompo_subset = cspF_Rep_int_choice_subset\n cspF_Int_Ext_pre_choice_subset\n\n(*-------------------------------------------------------*\n | decompose external choice |\n *-------------------------------------------------------*)\n\nlemma cspF_Ext_choice_right:\n \"[| P <=F[M1,M2] Q1 ;\n P <=F[M1,M2] Q2 |]\n ==> P <=F[M1,M2] Q1 [+] Q2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_right)\napply (rule)\n\n apply (simp add: in_failures)\n apply (elim disjE conjE exE, simp)\n apply (force, force, force)\n apply (simp_all)\n\n apply (subgoal_tac \"(<>, X) :f failures(Q1) M2\")\n apply (force)\n apply (rule proc_F2_F4)\n apply (simp_all)\n apply (rule proc_F2_F4)\n apply (simp_all)\n apply (simp add: cspT_semantics)\n apply (auto)\ndone\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2825035625210456}} {"text": "theory InstanceFsetalt\nimports NonFreeAnimation\nbegin \n\n(*\ndatatype 'a fset2 = Emp | Ins 'a ('a fset2) \nwhere \n Ins a (Ins a s) = Ins a s\n Ins a1 (Ins a2 s) = Ins a2 (Ins a1 s)\n*)\n\nlocale results =\n fixes alpha :: tyvar\n and finset_name :: tyco\n and ins_name :: oper\n and emp_name :: oper\n and dummy :: 'a\nbegin\n\nlemma [ffact]: \"decl_tyvars () [alpha]\" ..\nlemma [ffact]: \"alpha tyinterpr TYPE('a)\" ..\n\nlemma [ffact]: \"finset_name tycohaskind (ExtType =K=> IntType)\" ..\n\nlemma [ffact]: \"ins_name operhasty (alpha =T=> finset_name ** alpha =T=> finset_name ** alpha)\" ..\nlemma [ffact]: \"emp_name operhasty (finset_name ** alpha)\" ..\n\ndefinition \"ins_clause1_name = (0::nat)\"\ndefinition \"ins_clause2_name = (0::nat)\"\n\nlemma [ffact]: \"decl_hcl ins_clause1_name (QUANT a:alpha. QUANT S: finset_name**alpha.\n ins_name $ a $ (ins_name $ a $ S) === ins_name $ a $ S)\" ..\nlemma [ffact]: \"decl_hcl ins_clause2_name (QUANT a:alpha. QUANT a2:alpha. QUANT S: finset_name**alpha.\n ins_name $ a $ (ins_name $ a2 $ S) === ins_name $ a2 $ (ins_name $ a $ S))\" ..\n\nlocal_setup {* MetaRec.run_expl_frules *}\n\nend\n\n\nthm results.ins_clause1\nthm results.ins_clause2\n\n\n\n\nlocale algebra_results = results alpha finset_name ins_name emp_name dummy\n for alpha :: tyvar\n and finset_name :: tyco\n and emp_name :: oper\n and ins_name :: oper\n and dummy :: 'a\nbegin\n\n\nlemma [ffact]: \"(finset_name ** alpha) alginterpr TYPE('a set)\" ..\nlemma [ffact]: \"ins_name operalginterpr (% (x::'a) (xs :: 'a set). {x} Un xs)\" ..\nlemma [ffact]: \"emp_name operalginterpr ({} :: 'a set)\" ..\n\nlemma [ffact]: \"proven_hcl (ALL (x::'a) (S::'a set). {x} Un ({x} Un S) = {x} Un S)\"\n unfolding proven_hcl_def by blast\nlemma [ffact]: \"proven_hcl (ALL (x::'a) (x2::'a) (S::'a set). {x} Un ({x2} Un S) = {x2} Un ({x} Un S))\"\n unfolding proven_hcl_def by blast\n\nlocal_setup {* MetaRec.run_expl_frules *}\n\nend\n\nthm algebra_results.iter_op_clauses0\n\n\n\nend\n", "meta": {"author": "metaforcy", "repo": "nonfree-data", "sha": "f3ce28278a88fdd240faa2e51f893fee5c15f2f2", "save_path": "github-repos/isabelle/metaforcy-nonfree-data", "path": "github-repos/isabelle/metaforcy-nonfree-data/nonfree-data-f3ce28278a88fdd240faa2e51f893fee5c15f2f2/manual-instantiations/InstanceFsetalt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2825035625210455}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Title: Confinement_S\n * Description: Rephrasing of the confinement proof using the concept of islands.\n *)\n\ntheory Islands_S\nimports Confine_S\nbegin\n\ndefinition\n island :: \"state \\ entity_id \\ entity_id set\" where\n \"island s x \\ {e\\<^sub>i. s \\ x \\* e\\<^sub>i}\"\n\ndefinition\n island_caps :: \"state \\ entity_id \\ cap set\" where\n \"island_caps s x \\ \\(caps_of s ` island s x)\"\n\nlemma island_caps_def2:\n \"island_caps s x \\ \\ e \\ island s x. caps_of s e\"\n by(simp add: island_caps_def)\n\nlemma island_caps_def3:\n \"island_caps s x = \\(direct_caps_of s ` island s x)\"\n apply (clarsimp simp: island_caps_def)\n apply rule\n apply (clarsimp simp: island_def caps_of_def)\n apply (drule store_connected_directly_tgs_connected)\n apply (metis directly_tgs_connected_rtrancl_into_rtrancl)\n apply (fastforce simp: caps_of_def store_connected_def)\n done\n\nlemma island_caps_dom:\n \"island_caps s e\\<^sub>x \\cap c =\n (\\e\\<^sub>i. (e\\<^sub>x, e\\<^sub>i) \\ tgs_connected s \\ caps_of s e\\<^sub>i \\cap c)\"\n by (auto simp add: island_caps_def caps_dominated_by_def island_def)\n\nlemma authority_confinement_islands:\n \"\\s' \\ execute cmds s;\n island_caps s x \\cap c\\\n \\ island_caps s' x \\cap c\"\n apply (simp add: island_caps_dom)\n apply clarsimp\n apply (frule (1) tgs_connected_preserved)\n apply (subst (asm) tgs_connected_comm_eq)\n apply (erule authority_confinement)\n apply clarsimp\n apply (erule_tac x=e\\<^sub>i' in allE)\n apply (erule impE)\n apply (metis (opaque_lifting, no_types) tgs_connected_comm_eq tgs_connected_def rtrancl_trans)\n apply clarsimp\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/take-grant/Islands_S.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926666143433998, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2824528482608677}} {"text": "(* Title: HOL/HOLCF/Powerdomains.thy\n Author: Brian Huffman\n*)\n\nsection {* Powerdomains *}\n\ntheory Powerdomains\nimports ConvexPD Domain\nbegin\n\nsubsection {* Universal domain embeddings *}\n\ndefinition \"upper_emb = udom_emb (\\i. upper_map\\(udom_approx i))\"\ndefinition \"upper_prj = udom_prj (\\i. upper_map\\(udom_approx i))\"\n\ndefinition \"lower_emb = udom_emb (\\i. lower_map\\(udom_approx i))\"\ndefinition \"lower_prj = udom_prj (\\i. lower_map\\(udom_approx i))\"\n\ndefinition \"convex_emb = udom_emb (\\i. convex_map\\(udom_approx i))\"\ndefinition \"convex_prj = udom_prj (\\i. convex_map\\(udom_approx i))\"\n\nlemma ep_pair_upper: \"ep_pair upper_emb upper_prj\"\n unfolding upper_emb_def upper_prj_def\n by (simp add: ep_pair_udom approx_chain_upper_map)\n\nlemma ep_pair_lower: \"ep_pair lower_emb lower_prj\"\n unfolding lower_emb_def lower_prj_def\n by (simp add: ep_pair_udom approx_chain_lower_map)\n\nlemma ep_pair_convex: \"ep_pair convex_emb convex_prj\"\n unfolding convex_emb_def convex_prj_def\n by (simp add: ep_pair_udom approx_chain_convex_map)\n\nsubsection {* Deflation combinators *}\n\ndefinition upper_defl :: \"udom defl \\ udom defl\"\n where \"upper_defl = defl_fun1 upper_emb upper_prj upper_map\"\n\ndefinition lower_defl :: \"udom defl \\ udom defl\"\n where \"lower_defl = defl_fun1 lower_emb lower_prj lower_map\"\n\ndefinition convex_defl :: \"udom defl \\ udom defl\"\n where \"convex_defl = defl_fun1 convex_emb convex_prj convex_map\"\n\nlemma cast_upper_defl:\n \"cast\\(upper_defl\\A) = upper_emb oo upper_map\\(cast\\A) oo upper_prj\"\nusing ep_pair_upper finite_deflation_upper_map\nunfolding upper_defl_def by (rule cast_defl_fun1)\n\nlemma cast_lower_defl:\n \"cast\\(lower_defl\\A) = lower_emb oo lower_map\\(cast\\A) oo lower_prj\"\nusing ep_pair_lower finite_deflation_lower_map\nunfolding lower_defl_def by (rule cast_defl_fun1)\n\nlemma cast_convex_defl:\n \"cast\\(convex_defl\\A) = convex_emb oo convex_map\\(cast\\A) oo convex_prj\"\nusing ep_pair_convex finite_deflation_convex_map\nunfolding convex_defl_def by (rule cast_defl_fun1)\n\nsubsection {* Domain class instances *}\n\ninstantiation upper_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n \"emb = upper_emb oo upper_map\\emb\"\n\ndefinition\n \"prj = upper_map\\prj oo upper_prj\"\n\ndefinition\n \"defl (t::'a upper_pd itself) = upper_defl\\DEFL('a)\"\n\ndefinition\n \"(liftemb :: 'a upper_pd u \\ udom u) = u_map\\emb\"\n\ndefinition\n \"(liftprj :: udom u \\ 'a upper_pd u) = u_map\\prj\"\n\ndefinition\n \"liftdefl (t::'a upper_pd itself) = liftdefl_of\\DEFL('a upper_pd)\"\n\ninstance proof\n show \"ep_pair emb (prj :: udom \\ 'a upper_pd)\"\n unfolding emb_upper_pd_def prj_upper_pd_def\n by (intro ep_pair_comp ep_pair_upper ep_pair_upper_map ep_pair_emb_prj)\nnext\n show \"cast\\DEFL('a upper_pd) = emb oo (prj :: udom \\ 'a upper_pd)\"\n unfolding emb_upper_pd_def prj_upper_pd_def defl_upper_pd_def cast_upper_defl\n by (simp add: cast_DEFL oo_def cfun_eq_iff upper_map_map)\nqed (fact liftemb_upper_pd_def liftprj_upper_pd_def liftdefl_upper_pd_def)+\n\nend\n\ninstantiation lower_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n \"emb = lower_emb oo lower_map\\emb\"\n\ndefinition\n \"prj = lower_map\\prj oo lower_prj\"\n\ndefinition\n \"defl (t::'a lower_pd itself) = lower_defl\\DEFL('a)\"\n\ndefinition\n \"(liftemb :: 'a lower_pd u \\ udom u) = u_map\\emb\"\n\ndefinition\n \"(liftprj :: udom u \\ 'a lower_pd u) = u_map\\prj\"\n\ndefinition\n \"liftdefl (t::'a lower_pd itself) = liftdefl_of\\DEFL('a lower_pd)\"\n\ninstance proof\n show \"ep_pair emb (prj :: udom \\ 'a lower_pd)\"\n unfolding emb_lower_pd_def prj_lower_pd_def\n by (intro ep_pair_comp ep_pair_lower ep_pair_lower_map ep_pair_emb_prj)\nnext\n show \"cast\\DEFL('a lower_pd) = emb oo (prj :: udom \\ 'a lower_pd)\"\n unfolding emb_lower_pd_def prj_lower_pd_def defl_lower_pd_def cast_lower_defl\n by (simp add: cast_DEFL oo_def cfun_eq_iff lower_map_map)\nqed (fact liftemb_lower_pd_def liftprj_lower_pd_def liftdefl_lower_pd_def)+\n\nend\n\ninstantiation convex_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n \"emb = convex_emb oo convex_map\\emb\"\n\ndefinition\n \"prj = convex_map\\prj oo convex_prj\"\n\ndefinition\n \"defl (t::'a convex_pd itself) = convex_defl\\DEFL('a)\"\n\ndefinition\n \"(liftemb :: 'a convex_pd u \\ udom u) = u_map\\emb\"\n\ndefinition\n \"(liftprj :: udom u \\ 'a convex_pd u) = u_map\\prj\"\n\ndefinition\n \"liftdefl (t::'a convex_pd itself) = liftdefl_of\\DEFL('a convex_pd)\"\n\ninstance proof\n show \"ep_pair emb (prj :: udom \\ 'a convex_pd)\"\n unfolding emb_convex_pd_def prj_convex_pd_def\n by (intro ep_pair_comp ep_pair_convex ep_pair_convex_map ep_pair_emb_prj)\nnext\n show \"cast\\DEFL('a convex_pd) = emb oo (prj :: udom \\ 'a convex_pd)\"\n unfolding emb_convex_pd_def prj_convex_pd_def defl_convex_pd_def cast_convex_defl\n by (simp add: cast_DEFL oo_def cfun_eq_iff convex_map_map)\nqed (fact liftemb_convex_pd_def liftprj_convex_pd_def liftdefl_convex_pd_def)+\n\nend\n\nlemma DEFL_upper: \"DEFL('a::domain upper_pd) = upper_defl\\DEFL('a)\"\nby (rule defl_upper_pd_def)\n\nlemma DEFL_lower: \"DEFL('a::domain lower_pd) = lower_defl\\DEFL('a)\"\nby (rule defl_lower_pd_def)\n\nlemma DEFL_convex: \"DEFL('a::domain convex_pd) = convex_defl\\DEFL('a)\"\nby (rule defl_convex_pd_def)\n\nsubsection {* Isomorphic deflations *}\n\nlemma isodefl_upper:\n \"isodefl d t \\ isodefl (upper_map\\d) (upper_defl\\t)\"\napply (rule isodeflI)\napply (simp add: cast_upper_defl cast_isodefl)\napply (simp add: emb_upper_pd_def prj_upper_pd_def)\napply (simp add: upper_map_map)\ndone\n\nlemma isodefl_lower:\n \"isodefl d t \\ isodefl (lower_map\\d) (lower_defl\\t)\"\napply (rule isodeflI)\napply (simp add: cast_lower_defl cast_isodefl)\napply (simp add: emb_lower_pd_def prj_lower_pd_def)\napply (simp add: lower_map_map)\ndone\n\nlemma isodefl_convex:\n \"isodefl d t \\ isodefl (convex_map\\d) (convex_defl\\t)\"\napply (rule isodeflI)\napply (simp add: cast_convex_defl cast_isodefl)\napply (simp add: emb_convex_pd_def prj_convex_pd_def)\napply (simp add: convex_map_map)\ndone\n\nsubsection {* Domain package setup for powerdomains *}\n\nlemmas [domain_defl_simps] = DEFL_upper DEFL_lower DEFL_convex\nlemmas [domain_map_ID] = upper_map_ID lower_map_ID convex_map_ID\nlemmas [domain_isodefl] = isodefl_upper isodefl_lower isodefl_convex\n\nlemmas [domain_deflation] =\n deflation_upper_map deflation_lower_map deflation_convex_map\n\nsetup {*\n fold Domain_Take_Proofs.add_rec_type\n [(@{type_name \"upper_pd\"}, [true]),\n (@{type_name \"lower_pd\"}, [true]),\n (@{type_name \"convex_pd\"}, [true])]\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/Powerdomains.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2824528414032058}} {"text": "(* Title: HOL/Bali/Decl.thy\n Author: David von Oheimb and Norbert Schirmer\n*)\nsubsection {* Field, method, interface, and class declarations, whole Java programs\n*}\n\ntheory Decl\nimports Term Table\n (** order is significant, because of clash for \"var\" **)\nbegin\n\ntext {*\nimprovements:\n\\begin{itemize}\n\\item clarification and correction of some aspects of the package/access concept\n (Also submitted as bug report to the Java Bug Database:\n Bug Id: 4485402 and Bug Id: 4493343 \n @{url \"http://developer.java.sun.com/developer/bugParade/index.jshtml\"}\n )\n\\end{itemize}\nsimplifications:\n\\begin{itemize}\n\\item the only field and method modifiers are static and the access modifiers\n\\item no constructors, which may be simulated by new + suitable methods\n\\item there is just one global initializer per class, which can simulate all \n others\n\n\\item no throws clause\n\\item a void method is replaced by one that returns Unit (of dummy type Void)\n\n\\item no interface fields\n\n\\item every class has an explicit superclass (unused for Object)\n\\item the (standard) methods of Object and of standard exceptions are not \n specified\n\n\\item no main method\n\\end{itemize}\n*}\n\nsubsection {* Modifier*}\n\nsubsubsection {* Access modifier *}\n\ndatatype acc_modi (* access modifier *)\n = Private | Package | Protected | Public \n\ntext {* \nWe can define a linear order for the access modifiers. With Private yielding the\nmost restrictive access and public the most liberal access policy:\n Private < Package < Protected < Public\n*}\n \ninstantiation acc_modi :: linorder\nbegin\n\ndefinition\n less_acc_def: \"a < b\n \\ (case a of\n Private \\ (b=Package \\ b=Protected \\ b=Public)\n | Package \\ (b=Protected \\ b=Public)\n | Protected \\ (b=Public)\n | Public \\ False)\"\n\ndefinition\n le_acc_def: \"(a :: acc_modi) \\ b \\ a < b \\ a = b\"\n\ninstance\nproof\n fix x y z::acc_modi\n show \"(x < y) = (x \\ y \\ \\ y \\ x)\"\n by (auto simp add: le_acc_def less_acc_def split add: acc_modi.split) \n show \"x \\ x\" -- reflexivity\n by (auto simp add: le_acc_def)\n {\n assume \"x \\ y\" \"y \\ z\" -- transitivity \n then show \"x \\ z\"\n by (auto simp add: le_acc_def less_acc_def split add: acc_modi.split)\n next\n assume \"x \\ y\" \"y \\ x\" -- antisymmetry\n moreover have \"\\ x y. x < (y::acc_modi) \\ y < x \\ False\"\n by (auto simp add: less_acc_def split add: acc_modi.split)\n ultimately show \"x = y\" by (unfold le_acc_def) iprover\n next\n fix x y:: acc_modi\n show \"x \\ y \\ y \\ x\" \n by (auto simp add: less_acc_def le_acc_def split add: acc_modi.split)\n }\nqed\n \nend\n\nlemma acc_modi_top [simp]: \"Public \\ a \\ a = Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_top1 [simp, intro!]: \"a \\ Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_le_Public: \n\"a \\ Public \\ a=Private \\ a = Package \\ a=Protected \\ a=Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_bottom: \"a \\ Private \\ a = Private\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_Private_le: \n\"Private \\ a \\ a=Private \\ a = Package \\ a=Protected \\ a=Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_Package_le: \n \"Package \\ a \\ a = Package \\ a=Protected \\ a=Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.split)\n\nlemma acc_modi_le_Package: \n \"a \\ Package \\ a=Private \\ a = Package\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_Protected_le: \n \"Protected \\ a \\ a=Protected \\ a=Public\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\nlemma acc_modi_le_Protected: \n \"a \\ Protected \\ a=Private \\ a = Package \\ a = Protected\"\nby (auto simp add: le_acc_def less_acc_def split: acc_modi.splits)\n\n\nlemmas acc_modi_le_Dests = acc_modi_top acc_modi_le_Public\n acc_modi_Private_le acc_modi_bottom\n acc_modi_Package_le acc_modi_le_Package\n acc_modi_Protected_le acc_modi_le_Protected\n\nlemma acc_modi_Package_le_cases:\n assumes \"Package \\ m\"\n obtains (Package) \"m = Package\"\n | (Protected) \"m = Protected\"\n | (Public) \"m = Public\"\nusing assms by (auto dest: acc_modi_Package_le)\n\n\nsubsubsection {* Static Modifier *}\ntype_synonym stat_modi = bool (* modifier: static *)\n\nsubsection {* Declaration (base \"class\" for member,interface and class\n declarations *}\n\nrecord decl =\n access :: acc_modi\n\ntranslations\n (type) \"decl\" <= (type) \"\\access::acc_modi\\\"\n (type) \"decl\" <= (type) \"\\access::acc_modi,\\::'a\\\"\n\nsubsection {* Member (field or method)*}\nrecord member = decl +\n static :: stat_modi\n\ntranslations\n (type) \"member\" <= (type) \"\\access::acc_modi,static::bool\\\"\n (type) \"member\" <= (type) \"\\access::acc_modi,static::bool,\\::'a\\\"\n\nsubsection {* Field *}\n\nrecord field = member +\n type :: ty\ntranslations\n (type) \"field\" <= (type) \"\\access::acc_modi, static::bool, type::ty\\\"\n (type) \"field\" <= (type) \"\\access::acc_modi, static::bool, type::ty,\\::'a\\\"\n\ntype_synonym fdecl (* field declaration, cf. 8.3 *)\n = \"vname \\ field\"\n\n\ntranslations\n (type) \"fdecl\" <= (type) \"vname \\ field\"\n\nsubsection {* Method *}\n\nrecord mhead = member + (* method head (excluding signature) *)\n pars ::\"vname list\" (* parameter names *)\n resT ::ty (* result type *)\n\nrecord mbody = (* method body *)\n lcls:: \"(vname \\ ty) list\" (* local variables *)\n stmt:: stmt (* the body statement *)\n\nrecord methd = mhead + (* method in a class *)\n mbody::mbody\n\ntype_synonym mdecl = \"sig \\ methd\" (* method declaration in a class *)\n\n\ntranslations\n (type) \"mhead\" <= (type) \"\\access::acc_modi, static::bool, \n pars::vname list, resT::ty\\\"\n (type) \"mhead\" <= (type) \"\\access::acc_modi, static::bool, \n pars::vname list, resT::ty,\\::'a\\\"\n (type) \"mbody\" <= (type) \"\\lcls::(vname \\ ty) list,stmt::stmt\\\"\n (type) \"mbody\" <= (type) \"\\lcls::(vname \\ ty) list,stmt::stmt,\\::'a\\\" \n (type) \"methd\" <= (type) \"\\access::acc_modi, static::bool, \n pars::vname list, resT::ty,mbody::mbody\\\"\n (type) \"methd\" <= (type) \"\\access::acc_modi, static::bool, \n pars::vname list, resT::ty,mbody::mbody,\\::'a\\\"\n (type) \"mdecl\" <= (type) \"sig \\ methd\"\n\n\ndefinition\n mhead :: \"methd \\ mhead\"\n where \"mhead m = \\access=access m, static=static m, pars=pars m, resT=resT m\\\"\n\nlemma access_mhead [simp]:\"access (mhead m) = access m\"\nby (simp add: mhead_def)\n\nlemma static_mhead [simp]:\"static (mhead m) = static m\"\nby (simp add: mhead_def)\n\nlemma pars_mhead [simp]:\"pars (mhead m) = pars m\"\nby (simp add: mhead_def)\n\nlemma resT_mhead [simp]:\"resT (mhead m) = resT m\"\nby (simp add: mhead_def)\n\ntext {* To be able to talk uniformaly about field and method declarations we\nintroduce the notion of a member declaration (e.g. useful to define \naccessiblity ) *}\n\ndatatype memberdecl = fdecl fdecl | mdecl mdecl\n\ndatatype memberid = fid vname | mid sig\n\nclass has_memberid =\n fixes memberid :: \"'a \\ memberid\"\n\ninstantiation memberdecl :: has_memberid\nbegin\n\ndefinition\nmemberdecl_memberid_def:\n \"memberid m = (case m of\n fdecl (vn,f) \\ fid vn\n | mdecl (sig,m) \\ mid sig)\"\n\ninstance ..\n\nend\n\nlemma memberid_fdecl_simp[simp]: \"memberid (fdecl (vn,f)) = fid vn\"\nby (simp add: memberdecl_memberid_def)\n\nlemma memberid_fdecl_simp1: \"memberid (fdecl f) = fid (fst f)\"\nby (cases f) (simp add: memberdecl_memberid_def)\n\nlemma memberid_mdecl_simp[simp]: \"memberid (mdecl (sig,m)) = mid sig\"\nby (simp add: memberdecl_memberid_def)\n\nlemma memberid_mdecl_simp1: \"memberid (mdecl m) = mid (fst m)\"\nby (cases m) (simp add: memberdecl_memberid_def)\n\ninstantiation prod :: (type, has_memberid) has_memberid\nbegin\n\ndefinition\npair_memberid_def:\n \"memberid p = memberid (snd p)\"\n\ninstance ..\n\nend\n\nlemma memberid_pair_simp[simp]: \"memberid (c,m) = memberid m\"\nby (simp add: pair_memberid_def)\n\nlemma memberid_pair_simp1: \"memberid p = memberid (snd p)\"\nby (simp add: pair_memberid_def)\n\ndefinition\n is_field :: \"qtname \\ memberdecl \\ bool\"\n where \"is_field m = (\\ declC f. m=(declC,fdecl f))\"\n \nlemma is_fieldD: \"is_field m \\ \\ declC f. m=(declC,fdecl f)\"\nby (simp add: is_field_def)\n\nlemma is_fieldI: \"is_field (C,fdecl f)\"\nby (simp add: is_field_def)\n\ndefinition\n is_method :: \"qtname \\ memberdecl \\ bool\"\n where \"is_method membr = (\\declC m. membr=(declC,mdecl m))\"\n \nlemma is_methodD: \"is_method membr \\ \\ declC m. membr=(declC,mdecl m)\"\nby (simp add: is_method_def)\n\nlemma is_methodI: \"is_method (C,mdecl m)\"\nby (simp add: is_method_def)\n\n\nsubsection {* Interface *}\n\n\nrecord ibody = decl + --{* interface body *}\n imethods :: \"(sig \\ mhead) list\" --{* method heads *}\n\nrecord iface = ibody + --{* interface *}\n isuperIfs:: \"qtname list\" --{* superinterface list *}\ntype_synonym\n idecl --{* interface declaration, cf. 9.1 *}\n = \"qtname \\ iface\"\n\ntranslations\n (type) \"ibody\" <= (type) \"\\access::acc_modi,imethods::(sig \\ mhead) list\\\"\n (type) \"ibody\" <= (type) \"\\access::acc_modi,imethods::(sig \\ mhead) list,\\::'a\\\"\n (type) \"iface\" <= (type) \"\\access::acc_modi,imethods::(sig \\ mhead) list,\n isuperIfs::qtname list\\\"\n (type) \"iface\" <= (type) \"\\access::acc_modi,imethods::(sig \\ mhead) list,\n isuperIfs::qtname list,\\::'a\\\"\n (type) \"idecl\" <= (type) \"qtname \\ iface\"\n\ndefinition\n ibody :: \"iface \\ ibody\"\n where \"ibody i = \\access=access i,imethods=imethods i\\\"\n\nlemma access_ibody [simp]: \"(access (ibody i)) = access i\"\nby (simp add: ibody_def)\n\nlemma imethods_ibody [simp]: \"(imethods (ibody i)) = imethods i\"\nby (simp add: ibody_def)\n\nsubsection {* Class *}\nrecord cbody = decl + --{* class body *}\n cfields:: \"fdecl list\" \n methods:: \"mdecl list\"\n init :: \"stmt\" --{* initializer *}\n\nrecord \"class\" = cbody + --{* class *}\n super :: \"qtname\" --{* superclass *}\n superIfs:: \"qtname list\" --{* implemented interfaces *}\ntype_synonym\n cdecl --{* class declaration, cf. 8.1 *}\n = \"qtname \\ class\"\n\ntranslations\n (type) \"cbody\" <= (type) \"\\access::acc_modi,cfields::fdecl list,\n methods::mdecl list,init::stmt\\\"\n (type) \"cbody\" <= (type) \"\\access::acc_modi,cfields::fdecl list,\n methods::mdecl list,init::stmt,\\::'a\\\"\n (type) \"class\" <= (type) \"\\access::acc_modi,cfields::fdecl list,\n methods::mdecl list,init::stmt,\n super::qtname,superIfs::qtname list\\\"\n (type) \"class\" <= (type) \"\\access::acc_modi,cfields::fdecl list,\n methods::mdecl list,init::stmt,\n super::qtname,superIfs::qtname list,\\::'a\\\"\n (type) \"cdecl\" <= (type) \"qtname \\ class\"\n\ndefinition\n cbody :: \"class \\ cbody\"\n where \"cbody c = \\access=access c, cfields=cfields c,methods=methods c,init=init c\\\"\n\nlemma access_cbody [simp]:\"access (cbody c) = access c\"\nby (simp add: cbody_def)\n\nlemma cfields_cbody [simp]:\"cfields (cbody c) = cfields c\"\nby (simp add: cbody_def)\n\nlemma methods_cbody [simp]:\"methods (cbody c) = methods c\"\nby (simp add: cbody_def)\n\nlemma init_cbody [simp]:\"init (cbody c) = init c\"\nby (simp add: cbody_def)\n\n\nsubsubsection \"standard classes\"\n\nconsts\n Object_mdecls :: \"mdecl list\" --{* methods of Object *}\n SXcpt_mdecls :: \"mdecl list\" --{* methods of SXcpts *}\n\ndefinition\n ObjectC :: \"cdecl\" --{* declaration of root class *} where\n \"ObjectC = (Object,\\access=Public,cfields=[],methods=Object_mdecls,\n init=Skip,super=undefined,superIfs=[]\\)\"\n\ndefinition\n SXcptC ::\"xname \\ cdecl\" --{* declarations of throwable classes *} where\n \"SXcptC xn = (SXcpt xn,\\access=Public,cfields=[],methods=SXcpt_mdecls,\n init=Skip,\n super=if xn = Throwable then Object \n else SXcpt Throwable,\n superIfs=[]\\)\"\n\nlemma ObjectC_neq_SXcptC [simp]: \"ObjectC \\ SXcptC xn\"\nby (simp add: ObjectC_def SXcptC_def Object_def SXcpt_def)\n\nlemma SXcptC_inject [simp]: \"(SXcptC xn = SXcptC xm) = (xn = xm)\"\nby (simp add: SXcptC_def)\n\ndefinition\n standard_classes :: \"cdecl list\" where\n \"standard_classes = [ObjectC, SXcptC Throwable,\n SXcptC NullPointer, SXcptC OutOfMemory, SXcptC ClassCast,\n SXcptC NegArrSize , SXcptC IndOutBound, SXcptC ArrStore]\"\n\n\nsubsubsection \"programs\"\n\nrecord prog =\n ifaces ::\"idecl list\"\n \"classes\"::\"cdecl list\"\n\ntranslations\n (type) \"prog\" <= (type) \"\\ifaces::idecl list,classes::cdecl list\\\"\n (type) \"prog\" <= (type) \"\\ifaces::idecl list,classes::cdecl list,\\::'a\\\"\n\nabbreviation\n iface :: \"prog \\ (qtname, iface) table\"\n where \"iface G I == table_of (ifaces G) I\"\n\nabbreviation\n \"class\" :: \"prog \\ (qtname, class) table\"\n where \"class G C == table_of (classes G) C\"\n\nabbreviation\n is_iface :: \"prog \\ qtname \\ bool\"\n where \"is_iface G I == iface G I \\ None\"\n\nabbreviation\n is_class :: \"prog \\ qtname \\ bool\"\n where \"is_class G C == class G C \\ None\"\n\n\nsubsubsection \"is type\"\n\nprimrec is_type :: \"prog \\ ty \\ bool\"\n and isrtype :: \"prog \\ ref_ty \\ bool\"\nwhere\n \"is_type G (PrimT pt) = True\"\n| \"is_type G (RefT rt) = isrtype G rt\"\n| \"isrtype G (NullT) = True\"\n| \"isrtype G (IfaceT tn) = is_iface G tn\"\n| \"isrtype G (ClassT tn) = is_class G tn\"\n| \"isrtype G (ArrayT T ) = is_type G T\"\n\nlemma type_is_iface: \"is_type G (Iface I) \\ is_iface G I\"\nby auto\n\nlemma type_is_class: \"is_type G (Class C) \\ is_class G C\"\nby auto\n\n\nsubsubsection \"subinterface and subclass relation, in anticipation of TypeRel.thy\"\n\ndefinition\n subint1 :: \"prog \\ (qtname \\ qtname) set\" --{* direct subinterface *}\n where \"subint1 G = {(I,J). \\i\\iface G I: J\\set (isuperIfs i)}\"\n\ndefinition\n subcls1 :: \"prog \\ (qtname \\ qtname) set\" --{* direct subclass *}\n where \"subcls1 G = {(C,D). C\\Object \\ (\\c\\class G C: super c = D)}\"\n\nabbreviation\n subcls1_syntax :: \"prog => [qtname, qtname] => bool\" (\"_|-_<:C1_\" [71,71,71] 70)\n where \"G|-C <:C1 D == (C,D) \\ subcls1 G\"\n\nabbreviation\n subclseq_syntax :: \"prog => [qtname, qtname] => bool\" (\"_|-_<=:C _\"[71,71,71] 70)\n where \"G|-C <=:C D == (C,D) \\(subcls1 G)^*\" (* cf. 8.1.3 *)\n\nabbreviation\n subcls_syntax :: \"prog => [qtname, qtname] => bool\" (\"_|-_<:C _\"[71,71,71] 70)\n where \"G|-C <:C D == (C,D) \\(subcls1 G)^+\"\n\nnotation (xsymbols)\n subcls1_syntax (\"_\\_\\\\<^sub>C1_\" [71,71,71] 70) and\n subclseq_syntax (\"_\\_\\\\<^sub>C _\" [71,71,71] 70) and\n subcls_syntax (\"_\\_\\\\<^sub>C _\" [71,71,71] 70)\n\nlemma subint1I: \"\\iface G I = Some i; J \\ set (isuperIfs i)\\ \n \\ (I,J) \\ subint1 G\" \napply (simp add: subint1_def)\ndone\n\nlemma subcls1I:\"\\class G C = Some c; C \\ Object\\ \\ (C,(super c)) \\ subcls1 G\"\napply (simp add: subcls1_def)\ndone\n\n\nlemma subint1D: \"(I,J)\\subint1 G\\ \\i\\iface G I: J\\set (isuperIfs i)\"\nby (simp add: subint1_def)\n\nlemma subcls1D: \n \"(C,D)\\subcls1 G \\ C\\Object \\ (\\c. class G C = Some c \\ (super c = D))\"\napply (simp add: subcls1_def)\napply auto\ndone\n\nlemma subint1_def2: \n \"subint1 G = (SIGMA I: {I. is_iface G I}. set (isuperIfs (the (iface G I))))\"\napply (unfold subint1_def)\napply auto\ndone\n\nlemma subcls1_def2: \n \"subcls1 G = \n (SIGMA C: {C. is_class G C}. {D. C\\Object \\ super (the(class G C))=D})\"\napply (unfold subcls1_def)\napply auto\ndone\n\nlemma subcls_is_class:\n\"\\G\\C \\\\<^sub>C D\\ \\ \\ c. class G C = Some c\"\nby (auto simp add: subcls1_def dest: tranclD)\n\nlemma no_subcls1_Object:\"G\\Object\\\\<^sub>C1 D \\ P\"\nby (auto simp add: subcls1_def)\n\nlemma no_subcls_Object: \"G\\Object\\\\<^sub>C D \\ P\"\napply (erule trancl_induct)\napply (auto intro: no_subcls1_Object)\ndone\n\nsubsubsection \"well-structured programs\"\n\ndefinition\n ws_idecl :: \"prog \\ qtname \\ qtname list \\ bool\"\n where \"ws_idecl G I si = (\\J\\set si. is_iface G J \\ (J,I)\\(subint1 G)^+)\"\n \ndefinition\n ws_cdecl :: \"prog \\ qtname \\ qtname \\ bool\"\n where \"ws_cdecl G C sc = (C\\Object \\ is_class G sc \\ (sc,C)\\(subcls1 G)^+)\"\n \ndefinition\n ws_prog :: \"prog \\ bool\" where\n \"ws_prog G = ((\\(I,i)\\set (ifaces G). ws_idecl G I (isuperIfs i)) \\ \n (\\(C,c)\\set (classes G). ws_cdecl G C (super c)))\"\n\n\nlemma ws_progI: \n\"\\\\(I,i)\\set (ifaces G). \\J\\set (isuperIfs i). is_iface G J \\ \n (J,I) \\ (subint1 G)^+; \n \\(C,c)\\set (classes G). C\\Object \\ is_class G (super c) \\ \n ((super c),C) \\ (subcls1 G)^+ \n \\ \\ ws_prog G\"\napply (unfold ws_prog_def ws_idecl_def ws_cdecl_def)\napply (erule_tac conjI)\napply blast\ndone\n\nlemma ws_prog_ideclD: \n\"\\iface G I = Some i; J\\set (isuperIfs i); ws_prog G\\ \\ \n is_iface G J \\ (J,I)\\(subint1 G)^+\"\napply (unfold ws_prog_def ws_idecl_def)\napply clarify\napply (drule_tac map_of_SomeD)\napply auto\ndone\n\nlemma ws_prog_cdeclD: \n\"\\class G C = Some c; C\\Object; ws_prog G\\ \\ \n is_class G (super c) \\ (super c,C)\\(subcls1 G)^+\"\napply (unfold ws_prog_def ws_cdecl_def)\napply clarify\napply (drule_tac map_of_SomeD)\napply auto\ndone\n\n\nsubsubsection \"well-foundedness\"\n\nlemma finite_is_iface: \"finite {I. is_iface G I}\"\napply (fold dom_def)\napply (rule_tac finite_dom_map_of)\ndone\n\nlemma finite_is_class: \"finite {C. is_class G C}\"\napply (fold dom_def)\napply (rule_tac finite_dom_map_of)\ndone\n\nlemma finite_subint1: \"finite (subint1 G)\"\napply (subst subint1_def2)\napply (rule finite_SigmaI)\napply (rule finite_is_iface)\napply (simp (no_asm))\ndone\n\nlemma finite_subcls1: \"finite (subcls1 G)\"\napply (subst subcls1_def2)\napply (rule finite_SigmaI)\napply (rule finite_is_class)\napply (rule_tac B = \"{super (the (class G C))}\" in finite_subset)\napply auto\ndone\n\nlemma subint1_irrefl_lemma1: \n \"ws_prog G \\ (subint1 G)^-1 \\ (subint1 G)^+ = {}\"\napply (force dest: subint1D ws_prog_ideclD conjunct2)\ndone\n\nlemma subcls1_irrefl_lemma1: \n \"ws_prog G \\ (subcls1 G)^-1 \\ (subcls1 G)^+ = {}\"\napply (force dest: subcls1D ws_prog_cdeclD conjunct2)\ndone\n\nlemmas subint1_irrefl_lemma2 = subint1_irrefl_lemma1 [THEN irrefl_tranclI']\nlemmas subcls1_irrefl_lemma2 = subcls1_irrefl_lemma1 [THEN irrefl_tranclI']\n\nlemma subint1_irrefl: \"\\(x, y) \\ subint1 G; ws_prog G\\ \\ x \\ y\"\napply (rule irrefl_trancl_rD)\napply (rule subint1_irrefl_lemma2)\napply auto\ndone\n\nlemma subcls1_irrefl: \"\\(x, y) \\ subcls1 G; ws_prog G\\ \\ x \\ y\"\napply (rule irrefl_trancl_rD)\napply (rule subcls1_irrefl_lemma2)\napply auto\ndone\n\nlemmas subint1_acyclic = subint1_irrefl_lemma2 [THEN acyclicI]\nlemmas subcls1_acyclic = subcls1_irrefl_lemma2 [THEN acyclicI]\n\n\nlemma wf_subint1: \"ws_prog G \\ wf ((subint1 G)\\)\"\nby (auto intro: finite_acyclic_wf_converse finite_subint1 subint1_acyclic)\n\nlemma wf_subcls1: \"ws_prog G \\ wf ((subcls1 G)\\)\"\nby (auto intro: finite_acyclic_wf_converse finite_subcls1 subcls1_acyclic)\n\n\nlemma subint1_induct: \n \"\\ws_prog G; \\x. \\y. (x, y) \\ subint1 G \\ P y \\ P x\\ \\ P a\"\napply (frule wf_subint1)\napply (erule wf_induct)\napply (simp (no_asm_use) only: converse_iff)\napply blast\ndone\n\nlemma subcls1_induct [consumes 1]:\n \"\\ws_prog G; \\x. \\y. (x, y) \\ subcls1 G \\ P y \\ P x\\ \\ P a\"\napply (frule wf_subcls1)\napply (erule wf_induct)\napply (simp (no_asm_use) only: converse_iff)\napply blast\ndone\n\nlemma ws_subint1_induct: \n \"\\is_iface G I; ws_prog G; \\I i. \\iface G I = Some i \\ \n (\\J \\ set (isuperIfs i). (I,J)\\subint1 G \\ P J \\ is_iface G J)\\ \\ P I\n \\ \\ P I\"\napply (erule rev_mp)\napply (rule subint1_induct)\napply assumption\napply (simp (no_asm)) \napply safe\napply (blast dest: subint1I ws_prog_ideclD)\ndone\n\n\nlemma ws_subcls1_induct: \"\\is_class G C; ws_prog G; \n \\C c. \\class G C = Some c; \n (C \\ Object \\ (C,(super c))\\subcls1 G \\ \n P (super c) \\ is_class G (super c))\\ \\ P C\n \\ \\ P C\"\napply (erule rev_mp)\napply (rule subcls1_induct)\napply assumption\napply (simp (no_asm)) \napply safe\napply (fast dest: subcls1I ws_prog_cdeclD)\ndone\n\nlemma ws_class_induct [consumes 2, case_names Object Subcls]:\n\"\\class G C = Some c; ws_prog G; \n \\ co. class G Object = Some co \\ P Object; \n \\ C c. \\class G C = Some c; C \\ Object; P (super c)\\ \\ P C\n \\ \\ P C\"\nproof -\n assume clsC: \"class G C = Some c\"\n and init: \"\\ co. class G Object = Some co \\ P Object\"\n and step: \"\\ C c. \\class G C = Some c; C \\ Object; P (super c)\\ \\ P C\"\n assume ws: \"ws_prog G\"\n then have \"is_class G C \\ P C\" \n proof (induct rule: subcls1_induct)\n fix C\n assume hyp:\"\\ S. G\\C \\\\<^sub>C1 S \\ is_class G S \\ P S\"\n and iscls:\"is_class G C\"\n show \"P C\"\n proof (cases \"C=Object\")\n case True with iscls init show \"P C\" by auto\n next\n case False with ws step hyp iscls \n show \"P C\" by (auto dest: subcls1I ws_prog_cdeclD)\n qed\n qed\n with clsC show ?thesis by simp\nqed\n\nlemma ws_class_induct' [consumes 2, case_names Object Subcls]:\n\"\\is_class G C; ws_prog G; \n \\ co. class G Object = Some co \\ P Object; \n \\ C c. \\class G C = Some c; C \\ Object; P (super c)\\ \\ P C\n \\ \\ P C\"\nby (auto intro: ws_class_induct)\n\nlemma ws_class_induct'' [consumes 2, case_names Object Subcls]:\n\"\\class G C = Some c; ws_prog G; \n \\ co. class G Object = Some co \\ P Object co; \n \\ C c sc. \\class G C = Some c; class G (super c) = Some sc;\n C \\ Object; P (super c) sc\\ \\ P C c\n \\ \\ P C c\"\nproof -\n assume clsC: \"class G C = Some c\"\n and init: \"\\ co. class G Object = Some co \\ P Object co\"\n and step: \"\\ C c sc . \\class G C = Some c; class G (super c) = Some sc;\n C \\ Object; P (super c) sc\\ \\ P C c\"\n assume ws: \"ws_prog G\"\n then have \"\\ c. class G C = Some c\\ P C c\" \n proof (induct rule: subcls1_induct)\n fix C c\n assume hyp:\"\\ S. G\\C \\\\<^sub>C1 S \\ (\\ s. class G S = Some s \\ P S s)\"\n and iscls:\"class G C = Some c\"\n show \"P C c\"\n proof (cases \"C=Object\")\n case True with iscls init show \"P C c\" by auto\n next\n case False\n with ws iscls obtain sc where\n sc: \"class G (super c) = Some sc\"\n by (auto dest: ws_prog_cdeclD)\n from iscls False have \"G\\C \\\\<^sub>C1 (super c)\" by (rule subcls1I)\n with False ws step hyp iscls sc\n show \"P C c\" \n by (auto) \n qed\n qed\n with clsC show \"P C c\" by auto\nqed\n\nlemma ws_interface_induct [consumes 2, case_names Step]:\n assumes is_if_I: \"is_iface G I\" and \n ws: \"ws_prog G\" and\n hyp_sub: \"\\I i. \\iface G I = Some i; \n \\ J \\ set (isuperIfs i).\n (I,J)\\subint1 G \\ P J \\ is_iface G J\\ \\ P I\"\n shows \"P I\"\nproof -\n from is_if_I ws \n show \"P I\"\n proof (rule ws_subint1_induct)\n fix I i\n assume hyp: \"iface G I = Some i \\\n (\\J\\set (isuperIfs i). (I,J) \\subint1 G \\ P J \\ is_iface G J)\"\n then have if_I: \"iface G I = Some i\"\n by blast\n show \"P I\"\n proof (cases \"isuperIfs i\")\n case Nil\n with if_I hyp_sub \n show \"P I\" \n by auto\n next\n case (Cons hd tl)\n with hyp if_I hyp_sub \n show \"P I\" \n by auto\n qed\n qed\nqed\n\nsubsubsection \"general recursion operators for the interface and class hiearchies\"\n\nfunction iface_rec :: \"prog \\ qtname \\ (qtname \\ iface \\ 'a set \\ 'a) \\ 'a\"\nwhere\n[simp del]: \"iface_rec G I f = \n (case iface G I of \n None \\ undefined \n | Some i \\ if ws_prog G \n then f I i \n ((\\J. iface_rec G J f)`set (isuperIfs i))\n else undefined)\"\nby auto\ntermination\nby (relation \"inv_image (same_fst ws_prog (\\G. (subint1 G)^-1)) (%(x,y,z). (x,y))\")\n (auto simp: wf_subint1 subint1I wf_same_fst)\n\nlemma iface_rec: \n\"\\iface G I = Some i; ws_prog G\\ \\ \n iface_rec G I f = f I i ((\\J. iface_rec G J f)`set (isuperIfs i))\"\napply (subst iface_rec.simps)\napply simp\ndone\n\n\nfunction\n class_rec :: \"prog \\ qtname \\ 'a \\ (qtname \\ class \\ 'a \\ 'a) \\ 'a\"\nwhere\n[simp del]: \"class_rec G C t f = \n (case class G C of \n None \\ undefined \n | Some c \\ if ws_prog G \n then f C c \n (if C = Object then t \n else class_rec G (super c) t f)\n else undefined)\"\n\nby auto\ntermination\nby (relation \"inv_image (same_fst ws_prog (\\G. (subcls1 G)^-1)) (%(x,y,z,w). (x,y))\")\n (auto simp: wf_subcls1 subcls1I wf_same_fst)\n\nlemma class_rec: \"\\class G C = Some c; ws_prog G\\ \\ \n class_rec G C t f = \n f C c (if C = Object then t else class_rec G (super c) t f)\"\napply (subst class_rec.simps)\napply simp\ndone\n\ndefinition\n imethds :: \"prog \\ qtname \\ (sig,qtname \\ mhead) tables\" where\n --{* methods of an interface, with overriding and inheritance, cf. 9.2 *}\n \"imethds G I = iface_rec G I\n (\\I i ts. (Un_tables ts) \\\\ \n (set_option \\ table_of (map (\\(s,m). (s,I,m)) (imethods i))))\"\n \n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/Decl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2824528414032058}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Corres_Tac\nimports \n \"Cogent_Corres\"\n \"../cogent/isa/ProofTrace\"\n \"../cogent/isa/CogentHelper\"\n Value_Relation_Generation\n\nbegin \n\n(*\n * Fix Cogent/C mismatch caused by unused return values of C blocks.\n * Cogent code can bind a value without using it. This commonly appears in code like\n *\n * -- first, a message from our sponsors\n * let debug_output = stuff\n * and _ = _debug_print debug_output\n * -- now back to our regularly scheduled programming\n * ...\n *\n * where debug_output becomes unused because the call to _debug_print is stripped for verification.\n *\n * When AutoCorres comes across this code, it figures that debug_output is unused,\n * so its generated code for \"stuff\" appends \"gets (\\_. ())\".\n * This breaks Corres_Tac's expectation that the C code for \"stuff\" returns a value that\n * corresponds to the Cogent code.\n *\n * We fix that up by walking the AutoCorres output and removing the extra \"gets (\\_. ())\",\n * allowing the original return value of \"stuff\" to be propagated.\n * The most annoying bit is that the last statement of a monad block is the most deeply nested.\n * So our rules need to iterate through pairs of consecutive statements in the same manner\n * as @{term simp_last_bind}. The other annoying bit is that we need to change the return type\n * from unit to the corresponding type (e.g. of debug_output).\n * We use a stack of schematic variables to remember where to apply the type changes.\n *\n * This could also be fixed directly in AutoCorres, assuming someone remembers how l2 works...\n *)\n\ndefinition \"cogent_C_unused_return__internal X Y \\ X = (do Y; return () od)\"\n\nlemma cogent_C_unused_return_step:\n \"\\A A' B B'. A = A' \\ B = B' \\ A >>= K_bind B = A' >>= K_bind B'\"\n \"\\A A' B B'. A = A' \\ (\\v. B v = B' v) \\ A >>= B = A' >>= B'\"\n by meson+\n\n(* This should be the only interesting statement block.\n * For Let and LetBang codegen, C always returns true and R is unused,\n * so we don't care what the rules do to it. *)\nlemma cogent_C_unused_return_L:\n \"\\ L = L';\n cogent_C_unused_return__internal (L' :: ('s, unit) nondet_monad) (L'' :: ('s, 'a) nondet_monad);\n X = X' \\ \\\n (do (_ :: unit) \\ condition C L R; X od)\n =\n (do (_ :: 'a) \\ condition C L'' (do R; return undefined od); X' od)\"\n apply (simp add: cogent_C_unused_return__internal_def)\n (* goal assumptions cause normal monad_eq to loop *)\n apply (tactic {* simp_tac (@{context} addsimps (MonadEqThms.get @{context})) 1 *})\n apply blast\n done\n\nlemma cogent_C_unused_return__internal:\n \"\\A. cogent_C_unused_return__internal (do v \\ A; gets (\\_. ()) od) A\"\n \"\\A A' B B'. \\ A = A'; (\\v. cogent_C_unused_return__internal (B v) (B' v)) \\ \\\n cogent_C_unused_return__internal (A >>= B) (A' >>= B')\"\n \"\\A A'. A = A' \\ cogent_C_unused_return__internal A A'\"\n by (monad_eq simp: cogent_C_unused_return__internal_def | blast)+\n\n(* Test: *)\nschematic_lemma\n (* input *)\n \"(do stuff1;\n stuff2;\n _ \\\n condition C1\n (do _ \\\n condition C2\n (do _ \\ gets (\\_. r1);\n gets (\\_. ()) od) (* <-- *)\n bla1;\n gets (\\_. ()) od) (* <-- *)\n bla2;\n _ \\\n condition C3 stuff3 stuff4; (* no change *)\n stuff5 od)\n = ?A\"\n (* expected output *)\n \"?A =\n (do stuff1;\n stuff2;\n _ \\\n condition C1\n (condition C2\n (gets (\\_. r1))\n (do bla1; return undefined od))\n (do bla2; return undefined od);\n _ \\\n condition C3 stuff3 stuff4;\n stuff5 od)\"\n (* do it *)\n apply ((rule cogent_C_unused_return_L cogent_C_unused_return_step cogent_C_unused_return__internal refl)+)[1]\n (* check *)\n by (rule refl)\n\n(* Apply the rewrite to a corres proof state.\n * In corres_tac, we apply this tactic blindly and it rewrites all unit-returning blocks\n * in the C code. This should be safe because no genuine Cogent code ever returns unit\n * (the unit type in Cogent is currently compiled to unit_t in C, instead of void). *)\n(* FIXME: maybe make this part of Tidy *)\n\ncontext update_sem_init begin\nlemma cogent_corres_unused_return:\n \"m = m' \\\n corres srel c m' \\ \\ \\ \\ \\ s \\\n corres srel c m \\ \\ \\ \\ \\ s\"\n by simp\n\nML {*\nfun cogent_C_unused_return_tac ctxt = let\n (* import into ctxt's locale *)\n val corres_rule = Proof_Context.get_thm ctxt \"cogent_corres_unused_return\"\n in fn n =>\n rtac corres_rule n\n THEN SOLVES (REPEAT_DETERM\n (resolve_tac ctxt @{thms cogent_C_unused_return_L cogent_C_unused_return_step\n cogent_C_unused_return__internal refl} n)) end\n*}\nend\n\n\nML {*\n(* Create derivative equations that only apply in a given context.\n *\n * make_contextual_eq_thms \"f\" [\"a = b\", \"c = d\"] ctxt\n * = [\"f a = f b\", \"f c = f d\"]\n *)\nfun make_contextual_eq_thms (context : term) (eq_thms : thm list) ctxt : thm list =\n let fun dest_eq (Const (@{const_name \"Trueprop\"}, _) $ eq) = dest_eq eq\n | dest_eq (Const (@{const_name \"Pure.eq\"}, _) $ l $ r) = (l, r)\n | dest_eq (Const (@{const_name \"HOL.eq\"}, _) $ l $ r) = (l, r)\n | dest_eq t = raise (TERM (\"ContextThms.dest_eq\", [t]))\n fun make_eq_thm thm0 =\n let val ((_, [thm]), _) = Variable.import true [thm0] (Variable.set_body false ctxt);\n val (lhs, rhs) = dest_eq (Thm.prop_of thm)\n handle TERM _ => raise THM (\"make_contextual_eq_thms: not an equation\", 0, [thm0])\n val prop = @{term Trueprop} $ (@{term \"op =\"} $ (context $ lhs) $ (context $ rhs))\n val prop' = map_types (K dummyT) prop |> Syntax.check_term ctxt\n handle ERROR _ => raise TERM (\"make_contextual_eq_thms: equality term is invalid\", [prop])\n fun free_var v = case Syntax.check_term ctxt (Free (v, dummyT)) of\n Free (_, TFree _) => true\n | _ => false\n in Goal.prove ctxt (filter free_var (Term.add_free_names prop' [])) [] prop'\n (K (simp_tac (ctxt addsimps [thm]) 1))\n handle ERROR msg => raise TERM (\"make_contextual_eq_thms proof failed:\\n\" ^ msg, [prop']) end\n in map make_eq_thm eq_thms end\n*}\n\nlemma simp_trivial_gets:\n \"do x \\ gets (\\_. v); B x od = B v\"\n by simp\n(* Limit simp_trivial_gets to the top level *)\nlocal_setup {*\nfn ctxt =>\nLocal_Theory.note\n ((Binding.name \"corres_simp_gets\", []),\n (make_contextual_eq_thms @{term \"\\m. update_sem_init.corres abs_typing abs_repr srel c m \\' \\ \\' \\' \\ s\"} @{thms simp_trivial_gets} ctxt))\n ctxt |> snd\n*}\n\nlemma simp_condition_bind:\n \"do retval \\ condition b x y; gets (\\s. retval) od = condition b x y\" by simp\n\nlocal_setup {*\nfn ctxt =>\nLocal_Theory.note\n ((Binding.name \"corres_simp_cond_gets\", []),\n (make_contextual_eq_thms @{term \"\\m. update_sem_init.corres abs_typing abs_repr srel c m \\' \\ \\' \\' \\ s\"} @{thms simp_condition_bind} ctxt))\n ctxt |> snd\n*}\n\nlemma ucast_up_lesseq[OF refl]:\n \"upcast = ucast\n \\ is_up (upcast :: ('a :: len) word \\ ('b :: len) word)\n \\ (upcast x \\ upcast y) = (x \\ y)\"\n by (simp add: word_le_nat_alt unat_ucast_upcast)\n\nlemma ucast_up_less[OF refl]:\n \"upcast = ucast\n \\ is_up (upcast :: ('a :: len) word \\ ('b :: len) word)\n \\ (upcast x < upcast y) = (x < y)\"\n by (simp add: word_less_nat_alt unat_ucast_upcast)\n\nlemma ucast_up_mod[OF refl]:\n \"upcast = ucast\n \\ is_up (upcast :: ('c :: len) word \\ ('d :: len) word)\n \\ (upcast x mod upcast y) = upcast (x mod y)\"\n apply (rule word_unat.Rep_eqD)\n apply (simp only: unat_mod unat_ucast_upcast)\n done\n\nlemma ucast_up_div[OF refl]:\n \"upcast = ucast\n \\ is_up (upcast :: ('c :: len) word \\ ('d :: len) word)\n \\ (upcast x div upcast y) = upcast (x div y)\"\n apply (rule word_unat.Rep_eqD)\n apply (simp only: unat_div unat_ucast_upcast)\n done\n\nlemma ucast_up_eq_0[OF refl]:\n \"upcast = ucast\n \\ is_up (upcast :: ('c :: len) word \\ ('d :: len) word)\n \\ (upcast x = 0) = (x = 0)\"\n by (metis word_unat.Rep_inject unat_ucast_upcast ucast_0)\n\nlemma ucast_down_bitwise[OF refl]:\n \"dcast = ucast\n \\ (bitOR (dcast x) (dcast y)) = dcast (bitOR x y)\"\n \"dcast = ucast\n \\ (bitAND (dcast x) (dcast y)) = dcast (bitAND x y)\"\n \"dcast = ucast\n \\ (bitXOR (dcast x) (dcast y)) = dcast (bitXOR x y)\"\n \"dcast = ucast\n \\ is_down (dcast :: ('a :: len) word \\ ('b :: len) word)\n \\ (bitNOT (dcast x)) = dcast (bitNOT x)\"\n by (auto intro!: word_eqI simp add: word_size nth_ucast word_ops_nth_size\n is_down_def target_size_def source_size_def)\n\nlemma ucast_down_shiftl[OF refl]:\n \"dcast = ucast\n \\ is_down (dcast :: ('a :: len) word \\ ('b :: len) word)\n \\ dcast (x << n) = dcast x << n\"\n apply clarsimp\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftl nth_ucast)\n apply (simp add: is_down_def source_size_def target_size_def word_size)\n apply auto\n done\n\nlemma ucast_up_down_shiftr[OF refl]:\n \"dcast = ucast\n \\ is_down (dcast :: ('a :: len) word \\ ('b :: len) word)\n \\ dcast (ucast x >> n) = x >> n\"\n apply clarsimp\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftr nth_ucast)\n apply (simp add: is_down_def source_size_def target_size_def word_size)\n apply (auto dest: test_bit_size simp: word_size)\n done\n\nlemma ucast_up_sless_disgusting[OF refl]:\n \"(upcast :: ('c :: len) word \\ ('d :: len) word) = ucast\n \\ len_of TYPE('c) < len_of TYPE('d)\n \\ (upcast x ('d :: len) word) = ucast\n \\ len_of TYPE('c) < len_of TYPE('d)\n \\ (upcast x <=s upcast y) = (x \\ y)\"\n apply (clarsimp simp: word_sle_msb_le msb_nth nth_ucast\n word_le_nat_alt unat_ucast_upcast\n is_up_def source_size_def target_size_def word_size)\n apply (auto dest: test_bit_size simp: word_size)\n done\n\n(* Corres tactic *)\n\nML {*\n(* Used to decode Cogent Var indices *)\nfun decode_isa_nat @{term \"0 :: nat\"} = 0\n | decode_isa_nat (@{term Suc} $ n) = decode_isa_nat n + 1\n | decode_isa_nat n = HOLogic.dest_number n |> snd\n\nfun TRY_FST tac1 tac2 st = (tac2 ORELSE ((DETERM tac1) THEN tac2)) st\nfun TRY_FST_N tac1 tac2 st = (tac2 ORELSE (tac1 THEN tac2)) st\nfun TRY_MORE_FST tac1 tac2 st = (tac2 ORELSE ((DETERM tac1) THEN (TRY_MORE_FST tac1 tac2))) st\n\n(* Determine whether a Cogent type contains a TFun anywhere.\n * This is used as a crude heuristic for applying corres_let_gets_propagate. *)\nfun Cogent_type_contains_TFun (Const (@{const_name TFun}, _)) = true\n | Cogent_type_contains_TFun (Abs (_, _, t)) = Cogent_type_contains_TFun t\n | Cogent_type_contains_TFun (f $ x) = Cogent_type_contains_TFun f orelse Cogent_type_contains_TFun x\n | Cogent_type_contains_TFun _ = false\n\n(* Matches within a typing judgement. *)\nfun Cogent_typing_returns_TFun (@{term Trueprop} $\n (Const (@{const_name typing}, _) $ tenv $ kind $ env $ expr $ typ)) =\n Cogent_type_contains_TFun typ\n | Cogent_typing_returns_TFun t = raise TERM (\"Cogent_typing_returns_TFun: not a typing rule\", [t])\n\n(* Number of expected nondet_monad statements for each Cogent atom in a Let. *)\nfun atom_stmts @{const_name Var} = SOME 1\n | atom_stmts @{const_name Prim} = NONE\n | atom_stmts @{const_name App} = SOME 2\n | atom_stmts @{const_name Con} = SOME 1\n | atom_stmts @{const_name Promote} = SOME 1\n | atom_stmts @{const_name Struct} = SOME 1\n | atom_stmts @{const_name Unit} = SOME 1\n | atom_stmts @{const_name Lit} = SOME 1\n | atom_stmts @{const_name Cast} = SOME 1\n | atom_stmts @{const_name Tuple} = SOME 1\n | atom_stmts @{const_name Esac} = SOME 1\n | atom_stmts @{const_name Fun} = SOME 1\n | atom_stmts @{const_name AFun} = SOME 1\n (* Let (Put...) is handled outside of corres_let_tac. *)\n | atom_stmts _ = NONE\nfun sigil_atom_stmts @{const_name Member} Unboxed = SOME 1\n | sigil_atom_stmts @{const_name Member} _ = SOME 2\n | sigil_atom_stmts _ _ = NONE\nfun rec_sigil (Const (@{const_name TRecord}, _) $ _ $ @{term Unboxed}) = SOME Unboxed\n | rec_sigil (Const (@{const_name TRecord}, _) $ _ $ @{term ReadOnly}) = SOME ReadOnly\n | rec_sigil (Const (@{const_name TRecord}, _) $ _ $ @{term Writable}) = SOME Writable\n | rec_sigil _ = NONE\n\n(* Guess the number of statements for this atom.\n * \"Member (Var 0) 0\" is passed as {head = Member, args = [Var 0, 0]}.\n * The type env is used to distinguish unboxed and boxed member accesses. *)\nfun atom_stmts' (head : string) (args : term list) (env : term) =\n case atom_stmts head of SOME n => SOME n | NONE => (case (head, args)\n of (@{const_name Member}, Const (@{const_name Var}, _) $ n :: _) => let\n val ty = case nth (HOLogic.dest_list env) (decode_isa_nat n) of\n (Const (@{const_name Some}, _) $ ty) => ty | t => raise TERM (\"atom_stmts': Gamma none\", [t])\n val sg = case rec_sigil ty of SOME s => s | _ => raise TERM (\"atom_stmts': no sig\", [ty])\n in sigil_atom_stmts head sg end\n | (@{const_name Prim}, primop :: _) => let\n val is_guarded = case head_of primop of @{const \"LShift\"} => true\n | @{const \"RShift\"} => true | @{const \"Divide\"} => true\n | @{const \"Mod\"} => true | _ => false\n in if is_guarded then SOME 2 else SOME 1 end\n | _ => NONE)\n\n(* Inspect a \"corres ...\" subgoal. *)\nfun dest_corres_prop prop =\n case prop of\n @{term Trueprop} $ (Const (@{const_name \"update_sem_init.corres\"}, _) $\n _ $ _ $ (* locale parameters *)\n srel $ cogent $ m $ xi $ gam $ Xi $ Gam $ si $ s) =>\n SOME (srel, cogent, m, xi, gam, Xi, Gam, si, s)\n | _ => NONE\nfun dest_corres_goal goal_num st =\n if Thm.nprems_of st < goal_num then NONE else\n Logic.concl_of_goal (Thm.prop_of st) goal_num |> dest_corres_prop\n\n(* Guess the C types mentioned in a rule. This can reduce the amount of\n * val_rel and type_rels that we need to unfold.\n * Ideally, this should be tracked in the lemma buckets. *)\n\nfun scrape_C_types thm = let\n fun filter_Const P (Const (c_name, _)) = if P c_name then [c_name] else []\n | filter_Const P (f $ x) = filter_Const P f @ filter_Const P x\n | filter_Const P (Abs (_, _, t)) = filter_Const P t\n | filter_Const _ _ = []\n fun c_type_name str = String.tokens (fn x => x = #\".\") str\n |> filter (String.isSuffix \"_C\") |> take 1\n in Thm.prop_of thm\n |> filter_Const (c_type_name #> null #> not)\n |> map c_type_name |> List.concat\n |> distinct (op =)\n end\n\n(* Apply a conversion to the n'th arg in the concl of the chosen subgoal. *)\nfun nth_arg_conv_tac n ngoal ctxt conv st = if Thm.nprems_of st < ngoal then no_tac st else\n let val subgoal = Logic.get_goal (Thm.prop_of st) ngoal\n val all_vars = length (strip_all_vars subgoal)\n val imps = length (Logic.strip_imp_prems (strip_all_body subgoal))\n val goal_concl = Logic.concl_of_goal (Thm.prop_of st) ngoal\n in\n Conv.gconv_rule\n (Utils.nth_arg_conv n conv\n |> (if fst (strip_comb goal_concl) = @{term Trueprop} then Conv.arg_conv else I)\n |> Conv.concl_conv imps\n |> (fn conv => Conv.params_conv all_vars (K conv) ctxt)) ngoal st\n |> Seq.succeed\n end\n handle CTERM _ => no_tac st\n\n(* Remove \"val_rel a a'\" assumptions if a' does not appear anywhere else in the subgoal.\n Special case for appearance within corres propositions - ignore elements of \\\n that are not given types in \\. *)\nval val_rel_thin_tac = SUBGOAL (fn (goal, n) => let\n val hyps = Logic.strip_assums_hyp goal\n val concl = Logic.strip_assums_concl goal\n fun match_xi_bvars (Const (@{const_name Cons}, _) $ _ $ xs)\n (Const (@{const_name Cons}, _) $ Const (@{const_name None}, _) $ ys) = match_xi_bvars xs ys\n | match_xi_bvars (Const (@{const_name Cons}, _) $ x $ xs)\n (Const (@{const_name Cons}, _) $ y $ ys) = maps spot_bvars [x, y] @ match_xi_bvars xs ys\n | match_xi_bvars xs ys = maps spot_bvars [xs, ys]\n and spot_bvars t = case (dest_corres_prop t, t) of\n (SOME (srel, cogent, m, xi, gam, Xi, Gam, si, s), _)\n => maps spot_bvars [srel, cogent, m, xi, Xi, si, s] @ match_xi_bvars gam Gam\n | (NONE, f $ x) => spot_bvars f @ spot_bvars x\n | (NONE, Abs (_, _, bd)) => map (fn x => x - 1) (filter (fn x => x > 0) (spot_bvars bd))\n | (NONE, Bound n) => [n]\n | _ => []\n val used_bvars = (maps spot_bvars (concl :: hyps))\n |> map (fn x => (x, ())) |> Inttab.make_list\n fun keep (@{term Trueprop} $ (Const (@{const_name val_rel}, _) $ _ $ Bound n))\n = (Inttab.lookup used_bvars n <> SOME [()])\n | keep _ = true\n val drops = filter_out (keep o fst) (hyps ~~ (0 upto length hyps - 1))\n |> map snd |> rev\n fun thin i = (rotate_tac i n THEN etac thin_rl n THEN rotate_tac (~ i) n)\n in EVERY (map thin drops) end)\n\nfun corres_tac ctxt\n (typing_tree : thm Tree)\n (fun_defs : thm list)\n (absfun_corres : thm list)\n (fun_corres : thm list)\n (corres_if: thm)\n (corres_esac: thm list)\n (val_rel_simps : thm list)\n (type_rel_simps : thm list)\n (tag_enum_defs : thm list)\n (LETBANG_TRUE_def: thm)\n (list_to_map_simps: thm list)\n (verbose : bool)\n : tactic =\nlet\n\n fun corres_Cogent_head goal_num st =\n Option.map (#2 #> strip_comb #> fst #> dest_Const #> fst) (dest_corres_goal goal_num st)\n\n fun get_thm nm = Proof_Context.get_thm ctxt nm;\n fun get_thms nm = Proof_Context.get_thms ctxt nm;\n\n (* Basic rules. *)\n val corres_let = get_thm \"corres_let\";\n val corres_nested_let = get_thm \"corres_nested_let\";\n val corres_let_propagate = get_thm \"corres_let_gets_propagate\";\n val corres_letbang = get_thm \"corres_letbang\";\n val corres_app_concrete = get_thm \"corres_app_concrete\";\n val corres_var = get_thm \"corres_var\";\n val corres_con = get_thm \"corres_con\";\n val corres_lit = get_thm \"corres_lit\";\n val corres_prim1 = get_thm \"corres_prim1\";\n val corres_prim2 = get_thm \"corres_prim2\";\n val corres_prim2_partial_right = get_thm \"corres_prim2_partial_right\";\n val corres_prim2_partial_left = get_thm \"corres_prim2_partial_left\";\n val eval_prim_simps = @{thms eval_prim_u_def\n ucast_down_add ucast_down_mult up_ucast_inj_eq\n ucast_down_minus ucast_up_less ucast_up_lesseq\n ucast_down_bitwise[symmetric] ucast_down_shiftl unat_ucast_upcast\n ucast_up_down_shiftr ucast_id\n ucast_up_div ucast_up_mod ucast_up_eq_0 checked_div_def\n ucast_up_sle_disgusting ucast_up_sless_disgusting\n is_up_def is_down_def source_size_def \n target_size_def word_size ucast_down_ucast_id\n };\n val eval_prim_ineq_guard_simps = @{thms word_less_nat_alt word_le_nat_alt}\n val corres_unit = get_thm \"corres_unit\";\n val corres_fun = get_thm \"corres_fun\";\n val corres_afun = get_thm \"corres_afun\";\n val corres_cast = get_thms \"corres_cast\";\n val corres_struct = get_thm \"corres_struct\";\n val corres_promote = get_thm \"corres_promote\";\n val corres_let_put_unboxed = get_thm \"corres_let_put_unboxed'\";\n val corres_no_let_put_unboxed = get_thm \"corres_no_let_put_unboxed'\";\n\n (* Type-specialised rule buckets. *)\n val net_resolve_tac = Tactic.build_net #> resolve_from_net_tac ctxt\n val corres_case_rule = Case.get ctxt |> net_resolve_tac;\n val corres_member_boxed_rule = MemberReadOnly.get ctxt |> net_resolve_tac;\n val corres_take_boxed_rule = TakeBoxed.get ctxt |> net_resolve_tac;\n val corres_take_unboxed_rule = TakeUnboxed.get ctxt |> net_resolve_tac;\n val corres_put_boxed_rule = PutBoxed.get ctxt |> net_resolve_tac;\n val corres_let_put_boxed_rule = LetPutBoxed.get ctxt |> net_resolve_tac;\n\n (* Miscellaneous rules. *)\n val bind_assoc_sym = @{thm bind_assoc[symmetric]};\n val recguard_true_rule = get_thm \"condition_true_pure\";\n\n val type_rel_simps = type_rel_simps @ TypeRelSimp.get ctxt;\n val val_rel_simps_prim = @{thms val_rel_word}\n @ [get_thm \"val_rel_bool_t_C_def\"]\n val val_rel_simps = val_rel_simps @ ValRelSimp.get ctxt;\n fun make_thm_index guess thms = let\n val nmths = map swap (maps (fn t => map (pair t) (guess t)) thms)\n in Symtab.make_list nmths end\n fun lookup_thm_index table = List.mapPartial (Symtab.lookup table) #> List.concat #> distinct Thm.eq_thm\n val type_rel_index = make_thm_index scrape_C_types type_rel_simps\n val val_rel_index = make_thm_index guess_val_rel_type val_rel_simps\n\n (* Basic tactics. *)\n fun SOLVES' tac = fn n => SOLVES (tac n);\n fun TRY' tac = fn n => TRY (tac n);\n val simp = asm_full_simp_tac ctxt;\n val subgoal_simp = TRY' (SOLVES' simp);\n fun simp_add thms = asm_full_simp_tac (add_simps thms ctxt);\n fun subgoal_simp_add thms = TRY' (SOLVES' (simp_add thms));\n fun fastforce_add thms = Clasimp.fast_force_tac (add_simps thms ctxt);\n fun clarsimp_add thms = Clasimp.clarsimp_tac (add_simps thms ctxt);\n fun subst thms = EqSubst.eqsubst_tac ctxt [0] thms;\n val rule = rtac;\n val rules = resolve_tac ctxt;\n\n (* Common simpsets. *)\n val val_rel_simp_ctxt = ctxt addsimps val_rel_simps\n val type_rel_simp_ctxt = ctxt addsimps type_rel_simps\n fun subgoal_val_rel_simp_add thms = TRY' (val_rel_thin_tac\n THEN' SOLVES' (asm_full_simp_tac (val_rel_simp_ctxt addsimps thms))) \n fun subgoal_type_rel_simp_add thms = TRY' (SOLVES' (asm_full_simp_tac (type_rel_simp_ctxt addsimps thms)))\n fun subgoal_val_rel_clarsimp_add thms = TRY' (val_rel_thin_tac\n THEN' SOLVES' (Clasimp.clarsimp_tac (val_rel_simp_ctxt addsimps thms)))\n\n fun real_goal_of (@{term Pure.imp} $ _ $ t) = real_goal_of t\n | real_goal_of (@{term Trueprop} $ t) = real_goal_of t\n | real_goal_of (Const (@{const_name Pure.all}, _) $ Abs (x, ty, t)) = betapply (real_goal_of t, Free (x, ty))\n | real_goal_of t = t\n\n (* Apply an abstract function corres rule.\n * These rules may come in all shapes and sizes; try to solve their assumptions by simp. *)\n fun apply_absfun absfun_thm st =\n if exists_subterm (fn t => is_const @{const_name measure_call} t) (Thm.prop_of st)\n then (* resolve AutoCorres' \"measure_call\" construct *)\n st |>\n (rule (get_thm \"corres_measure_call_subst\") 1\n THEN\n (fn st => (case Logic.concl_of_goal (Thm.prop_of st) 1 |> real_goal_of of\n Const (@{const_name \"monad_mono\"}, _) $ Abs (_ (* measure var *), _, call) =>\n case fst (strip_comb call) of\n Const (f, _) => rule (get_thm (Long_Name.base_name f ^ \"_mono\")) 1 st)\n handle Match => raise TERM (\"Corres_Tac: failed to resolve measure_call\",\n [Logic.concl_of_goal (Thm.prop_of st) 1]))\n THEN\n (rule absfun_thm\n THEN_ALL_NEW\n (SOLVES' (val_rel_thin_tac THEN'\n (rule @{thm order_refl} ORELSE'\n simp_add (type_rel_simps @ val_rel_simps @ @{thms recguard_dec_def}))))) 1\n )\n else\n st |>\n (rule absfun_thm\n THEN_ALL_NEW\n (SOLVES' (val_rel_thin_tac THEN' simp_add (type_rel_simps @ val_rel_simps @ @{thms recguard_dec_def})))) 1\n\n (* Strip the recursion guard from recursive function bodies.\n * We try to simp away the guard condition. *)\n fun simp_recguard_tac n st =\n case dest_corres_goal n st of\n NONE => raise THM (\"corres_tac/simp_recguard_tac: expected a corres subgoal here\", 0, [st])\n | SOME (_, _, c_def, _, _, _, _, _, _) =>\n (case strip_comb c_def of\n (Const (@{const_name condition}, _), _) =>\n (case (if verbose then tracing \"Proving: recursion guard\\n\" else ();\n subst [recguard_true_rule] n THEN SOLVES (simp n)) st |> Seq.pull of\n SOME (st', _) => Seq.succeed st'\n | NONE => raise THM (\"corres_tac/simp_recguard_tac: failed to discharge recursion guard\\n\", 0, [st]))\n | _ => all_tac st);\n\n (* Prove corres recursively. *)\n fun corres_tac_rec typing_tree depth = let\n fun print msg st = ((if verbose then tracing (String.implode (replicate (depth*2) #\" \") ^ msg ^ \"\\n\") else ()); Seq.single st);\n fun tree_nth nth = List.nth (tree_rest typing_tree, nth);\n fun rule_tree nth n st = TRY (TRY_FST (simp n) (rule (tree_hd (tree_nth nth)) n) |> SOLVES) st\n handle Subscript => (print \"Warning: rule_tree failed\" THEN no_tac) st;\n fun corres_tac_nth nth st = corres_tac_rec (tree_nth nth) (depth+1) st;\n\n fun tree_nth' tree nth = List.nth (tree_rest tree, nth);\n fun rule_tree' tree nth n st = rule (tree_hd (tree_nth' tree nth)) n st\n handle Subscript => (print \"Warning: rule_tree' failed\" THEN no_tac) st;\n\n (* For Let (Fun...) and similar constructs, we need to remember the value of the Fun\n * so that we can apply the corres lemma for that function. *)\n fun apply_corres_let n st =\n (if Cogent_typing_returns_TFun (Thm.prop_of (tree_hd (tree_nth 1))) (* check the type of the bound-expr *)\n then (print \"Debug: using corres_let_propagate\" THEN rule corres_let_propagate n) st\n else rule corres_let n st\n ) handle Subscript => (print \"Warning: tree_nth failed in apply_corres_let\" THEN no_tac) st\n\n (* Process a program of the form (Let x y...).\n * While x is guaranteed to be an atomic expression, atoms may translate\n * to more than one statement in the C monad.\n * For two-statement atoms, we use bind_assoc to pull out the statement pair\n * before continuing.\n *)\n fun corres_let_tac n st =\n (case dest_corres_goal n st of\n SOME (_, Const (@{const_name Cogent.Let}, _) $ lhs $ rhs, _, _, _, _, env, _, _) =>\n (case strip_comb lhs of\n (Const (lhs_head, _), args) =>\n (case atom_stmts' lhs_head args env of\n SOME 1 => apply_corres_let n\n THEN print (\"corres_let: \" ^ lhs_head)\n THEN rule_tree 0 n\n THEN rule_tree 1 n\n THEN TRY (corres_tac_nth 1)\n THEN TRY (corres_tac_nth 2)\n | SOME 2 => subst [bind_assoc_sym] n\n THEN apply_corres_let n\n THEN print (\"corres_let: \" ^ lhs_head)\n THEN rule_tree 0 n\n THEN rule_tree 1 n\n THEN TRY (corres_tac_nth 1)\n THEN TRY (corres_tac_nth 2)\n | _ => no_tac)\n | _ => no_tac)\n | _ => no_tac) st;\n\n (* Check the head of the Cogent program before applying a tactic.\n * This is useful when the tactic doesn't fail quickly (eg. for type-specialised rule buckets). *)\n fun check_Cogent_head head tac st =\n case corres_Cogent_head 1 st of\n NONE => tac st (* not sure if we'd expect this to work *)\n | SOME head' => if head = head' then tac st else no_tac st;\n in\n (fn t => case corres_Cogent_head 1 t of SOME h => print (\"Proving: \" ^ h) t | _ => all_tac t)\n THEN\n (* Evaluate Cogent environment lookups (ie. list lookups) eagerly *)\n ((nth_arg_conv_tac 7 (* \\ *) 1 ctxt (Simplifier.rewrite ctxt)\n THEN nth_arg_conv_tac 9 (* \\ *) 1 ctxt (Simplifier.rewrite ctxt))\n THEN\n (* Prune val_rel assumptions and variables. *)\n val_rel_thin_tac 1 THEN prune_params_tac ctxt\n THEN\n ((rule corres_var 1\n THEN print \"corres_var\"\n THEN subgoal_simp 1)\n\n ORELSE\n (rule corres_unit 1\n THEN print \"corres_unit\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n (rule corres_con 1\n THEN print \"corres_con\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n (rule corres_lit 1\n THEN print \"corres_lit\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n (rule corres_prim1 1\n THEN print \"corres_prim (unary)\"\n THEN val_rel_thin_tac 1 THEN fastforce_add (val_rel_simps_prim @ eval_prim_simps) 1)\n\n ORELSE\n (rule corres_prim2 1\n THEN print \"corres_prim (binary)\"\n THEN val_rel_thin_tac 1 THEN fastforce_add (val_rel_simps_prim @ eval_prim_simps) 1)\n\n ORELSE\n (rule corres_prim2_partial_right 1\n THEN print \"corres_prim (binary, partial, right)\"\n THEN (val_rel_thin_tac THEN' simp_add (eval_prim_simps @ val_rel_simps)\n THEN_ALL_NEW simp_add (eval_prim_simps @ eval_prim_ineq_guard_simps)) 1\n THEN subgoal_val_rel_simp_add (eval_prim_simps @ eval_prim_ineq_guard_simps) 1\n )\n\n ORELSE\n (rule corres_prim2_partial_left 1\n THEN print \"corres_prim (binary, partial, left)\"\n THEN (val_rel_thin_tac THEN' simp_add (eval_prim_simps @ val_rel_simps)\n THEN_ALL_NEW simp_add (eval_prim_simps @ eval_prim_ineq_guard_simps)) 1\n THEN subgoal_val_rel_simp_add (eval_prim_simps @ eval_prim_ineq_guard_simps) 1\n )\n\n ORELSE\n (rule corres_fun 1\n THEN print \"corres_fun\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n (rule corres_afun 1\n THEN print \"corres_afun\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n ((simp_tac (put_simpset HOL_basic_ss ctxt addsimps list_to_map_simps) 1)\n THEN rule corres_struct 1\n THEN print \"corres_struct\"\n THEN subgoal_val_rel_simp_add [] 1)\n\n ORELSE\n (rules corres_cast 1\n THEN print \"corres_cast\"\n THEN rule_tree 0 1\n THEN subgoal_simp 1)\n\n ORELSE check_Cogent_head @{const_name App}\n (((fn n => rule corres_app_concrete n\n THEN print \"corres_app_concrete\"\n THEN simp n THEN simp n\n THEN rules fun_corres n)\n THEN_ALL_NEW subgoal_simp_add (@{thm recguard_dec_def} :: fun_corres)) 1)\n\n ORELSE check_Cogent_head @{const_name App}\n (APPEND_LIST (map apply_absfun absfun_corres)\n THEN print \"corres_app_abstract\")\n\n ORELSE\n (rule corres_promote 1\n THEN print \"corres_promote\"\n THEN TRY (TRY_FST (simp 1) (rule_tree' (tree_nth 0) 0 1) |> SOLVES)\n THEN subgoal_val_rel_clarsimp_add [] 1)\n\n ORELSE\n (rules corres_esac 1\n THEN print \"corres_esac\"\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN subgoal_val_rel_simp_add [] 1\n\n ORELSE check_Cogent_head @{const_name Member}\n (corres_member_boxed_rule 1\n THEN print \"corres_member_boxed\"\n THEN rule_tree 0 1\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN rule_tree 0 1\n THEN TRY (TRY_FST (simp 1) (rule_tree' (tree_nth 0) 0 1) |> SOLVES))\n\n ORELSE\n (rule (Proof_Context.get_thm ctxt \"corres_member_unboxed\") 1\n THEN subgoal_val_rel_clarsimp_add [] 1)\n\n ORELSE check_Cogent_head @{const_name Take}\n (corres_take_unboxed_rule 1\n THEN print \"corres_take_unboxed\"\n THEN subgoal_simp 1\n THEN rule_tree 0 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN TRY (TRY (simp 1) THEN SOLVES (rule (tree_hd typing_tree) 1))\n THEN rule_tree 1 1\n THEN rule_tree 3 1\n THEN rule_tree 2 1\n THEN subgoal_simp 1\n THEN TRY (corres_tac_nth 3))\n\n ORELSE check_Cogent_head @{const_name Take}\n (corres_take_boxed_rule 1\n THEN print \"corres_take_boxed\"\n THEN subgoal_simp 1\n THEN rule_tree 0 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN TRY (TRY_FST (simp 1) (SOLVES (rule (tree_hd typing_tree) 1)))\n THEN rule_tree 1 1\n THEN rule_tree 3 1\n THEN rule_tree 2 1\n THEN subgoal_simp 1\n THEN TRY (corres_tac_nth 3))\n\n ORELSE\n (rule corres_if 1\n THEN print \"corres_if\"\n THEN rule_tree 0 1\n THEN rule_tree 1 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN TRY (corres_tac_nth 2)\n THEN TRY (corres_tac_nth 3))\n\n ORELSE check_Cogent_head @{const_name Let}\n (rule corres_let_put_unboxed 1\n THEN print \"corres_put_unboxed\"\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN rule_tree 0 1\n THEN rule_tree 1 1\n THEN subgoal_val_rel_clarsimp_add [] 1\n THEN TRY (corres_tac_nth 2))\n\n ORELSE check_Cogent_head @{const_name Put}\n (rule corres_no_let_put_unboxed 1\n THEN print \"corres_put_unboxed (no let)\"\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN TRY (TRY (simp 1) THEN SOLVES (rule (tree_hd typing_tree) 1))\n THEN subgoal_val_rel_clarsimp_add [] 1)\n\n ORELSE check_Cogent_head @{const_name Let}\n (corres_let_put_boxed_rule 1\n THEN print \"corres_let_put_boxed\"\n THEN rule_tree 0 1\n THEN subgoal_simp 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN TRY (TRY_FST (simp 1) (SOLVES (rule (tree_hd typing_tree) 1)))\n THEN rule_tree 1 1\n THEN subgoal_simp 1\n THEN TRY (corres_tac_nth 2))\n\n ORELSE check_Cogent_head @{const_name Put}\n (corres_put_boxed_rule 1\n THEN print \"corres_put_boxed\"\n THEN rule_tree' (tree_nth 0 handle Subscript => error \"tree_nth failed\") 0 1\n THEN subgoal_simp 1\n THEN subgoal_type_rel_simp_add [] 1\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN TRY (TRY_FST (simp 1) (SOLVES (rule (tree_hd typing_tree) 1)))\n THEN subgoal_simp 1)\n\n ORELSE check_Cogent_head @{const_name Case}\n (rtac (get_thm \"corres_simp_cond_gets\" RS @{thm iffD2}) 1 THEN\n (corres_case_rule 1\n THEN print \"corres_case\"\n THEN subgoal_simp 1\n THEN subgoal_simp 1\n THEN rule_tree 0 1\n THEN subgoal_simp 1\n THEN rule_tree 1 1\n THEN rule_tree 2 1\n THEN rule_tree 3 1\n THEN TRY (corres_tac_nth 2)\n THEN TRY (corres_tac_nth 3)))\n\n ORELSE check_Cogent_head @{const_name Let}\n (rtac corres_nested_let 1\n THEN print \"corres_let (nested)\"\n THEN rule_tree 0 1\n THEN rule_tree 1 1\n THEN TRY (corres_tac_nth 1)\n THEN TRY (corres_tac_nth 2))\n\n ORELSE corres_let_tac 1\n\n ORELSE check_Cogent_head @{const_name LetBang}\n ((simp_tac (put_simpset HOL_basic_ss ctxt addsimps [LETBANG_TRUE_def]) 1)\n THEN\n rule corres_letbang 1\n THEN print \"corres_letbang\"\n THEN rule_tree 0 1\n THEN rule_tree 1 1\n THEN rule_tree 3 1\n THEN subgoal_simp 1\n THEN TRY (corres_tac_nth 1)\n THEN TRY (corres_tac_nth 2))\n\n ORELSE check_Cogent_head @{const_name Split}\n (rtac (get_thm \"corres_split\") 1\n THEN print \"corres_split\"\n THEN rule_tree 0 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN subgoal_simp 1\n THEN rule_tree 1 1\n THEN rule_tree 2 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN subgoal_val_rel_simp_add [] 1\n THEN TRY (corres_tac_nth 1))\n )))\n end\nin\n (simp_tac (put_simpset HOL_basic_ss ctxt addsimps fun_defs) 1)\n THEN simp_recguard_tac 1\n THEN (fn st => (if verbose then tracing \"Fixing unused variables\\n\" else ();\n cogent_C_unused_return_tac ctxt 1 st))\n THEN corres_tac_rec typing_tree 0\nend\n*}\n\nML{*\nfun peel_two tree = hd (tree_rest (hd (tree_rest (hd tree))));\n*}\n\n\n\n(* Analyse the program and generate proofs based on its call tree. *)\nML {*\nfun partition _ [] = ([], [])\n | partition P (x::xs) = let val (ps, ns) = partition P xs in\n if P x then (x::ps, ns) else (ps, x::ns) end\n\nfun max a b = if a < b then b else a\nfun maximum [] = error \"maximum: empty list\"\n | maximum [x] = x\n | maximum (x::xs) = max x (maximum xs)\n\nfun get_Cogent_funtype ctxt fname = let\n val simps = Proof_Context.get_thms ctxt \"abbreviated_type_defs\"\n in\n Proof_Context.get_thm ctxt (fname ^ \"_type_def\")\n |> simplify (ctxt addsimps simps)\n end\n\n(* check whether the function argument type contains a TFun *)\nfun funtype_is_first_order (funtype:term) =\n case funtype of (Const (@{const_name Pair}, _) $ _ $\n (Const (@{const_name Pair}, _) $ arg $ _)) =>\n not (Cogent_type_contains_TFun arg)\n | _ => raise TERM (\"Expected a Cogent type signature\", [funtype])\n\n(* scrape all direct function calls *)\nval get_simple_function_calls = let\n fun search (Const (@{const_name App}, _) $\n (Const (@{const_name Fun}, _) $ Const (callee, _) $ _) $ _) = [Long_Name.base_name callee]\n | search (Const (@{const_name App}, _) $\n (Const (@{const_name AFun}, _) $ callee $ _) $ _) = [Utils.decode_isa_string callee]\n | search (f $ x) = search f @ search x\n | search _ = []\n in search end\n\n(*\n * Infer a call graph. We assume that the program only has:\n * - first-order Cogent functions,\n * - first-order abstract functions, and\n * - second-order abstract functions with first-order Cogent function arguments.\n *)\ndatatype FunType = AbsFun | CogentFun;\n\n(* Warning: CogentCallTree inlines a full subtree at each call site.\n * If this doesn't scale, we will need more indirection. *)\ndatatype 'a CogentCallOrder = FirstOrderCall of 'a CogentCallTree\n | SecondOrderCall of ('a CogentCallTree * (term * 'a CogentCallTree) list)\n and 'a CogentCallTree = CogentCallTree of ('a * FunType * string * 'a CogentCallOrder list);\n\nfun CogentCallTree_name (CogentCallTree (_, _, name, _)) = name\nfun CogentCallTree_funtype (CogentCallTree (_, typ, _, _)) = typ\nfun CogentCallTree_data (CogentCallTree (a, _, _, _)) = a\nfun CogentCallTree_calls (CogentCallTree (_, _, _, calls)) = calls\n\n(* We need a stack of environments \\ to verify with higher-order absfuns later on.\n * Each such function call increments \\.\n * Get the stack height and the position of each function in the call tree.\n * Note that a function may appear in multiple environments. *)\nfun calc_call_depth tr = maximum (0 :: map calc_call_order_depth (CogentCallTree_calls tr))\nand calc_call_order_depth (FirstOrderCall f) = calc_call_depth f\n | calc_call_order_depth (SecondOrderCall (f, args)) =\n maximum (map calc_call_depth (f::map snd args)) + (if CogentCallTree_funtype f = AbsFun then 1 else 0)\n\n(*\n * FIXME: this only deals with one function (call tree) at a time.\n * If there are multiple entry points, we'd want to handle them simultaneously\n * to avoid redundant \\'s and subproofs.\n *)\nfun annotate_depth tr = let\n fun annotate' d (CogentCallTree ((), ty, name, calls)) = let\n in CogentCallTree (d, ty, name, map (annotate_call' d) calls) end\n and annotate_call' d (FirstOrderCall f) = FirstOrderCall (annotate' d f)\n | annotate_call' d (SecondOrderCall (f, args)) = let\n val d' = if CogentCallTree_funtype f = AbsFun then d-1 else 0\n in SecondOrderCall (annotate' d f, map (apsnd (annotate' d')) args) end\n in annotate' (calc_call_depth tr) tr end\n\nfun make_call_tree (Cogent_functions, Cogent_abstract_functions) HO_hints ctxt = let\n val Cogent_abstract_functions_HO =\n filter_out (get_Cogent_funtype ctxt #> Thm.prop_of #> Utils.rhs_of_eq #> funtype_is_first_order)\n Cogent_abstract_functions\n val FO_call_graph =\n Cogent_functions\n |> map (fn n => (n, Proof_Context.get_thm ctxt (n ^ \"_def\") |> Thm.prop_of |> Utils.rhs_of_eq\n |> get_simple_function_calls |> distinct (op =)))\n |> map (apsnd (filter (fn f => not (exists (fn af => f = af) Cogent_abstract_functions_HO))))\n val absfun_decls = map (fn name => (name, CogentCallTree ((), AbsFun, name, []))) Cogent_abstract_functions\n fun func_name (Left f) = f\n | func_name (Right f) = f\n fun add_fun (name, FO_callees) table = let\n fun subtree f = case Symtab.lookup table f of\n SOME tr => tr\n | (* assume that we get Cogent_functions in topological order *)\n NONE => error (\"make_call_tree: \" ^ quote name ^ \" calls \" ^ quote f ^\n \" but we don't know anything about it (yet)\")\n val FO_callees' = FO_callees\n |> map (fn f => FirstOrderCall (subtree f))\n val HO_callees = Symtab.lookup_list HO_hints name\n |> map (fn (f, args) => SecondOrderCall (subtree (func_name f), map (apsnd (subtree o func_name)) args))\n in Symtab.update_new (name, CogentCallTree ((), CogentFun, name, FO_callees' @ HO_callees)) table end\n in\n fold add_fun FO_call_graph (Symtab.make absfun_decls)\n end\n\n(* Obtain the absfuns included in each \\_n, up to the call tree depth. *)\nfun make_uabsfuns_defs (tr as CogentCallTree (depth, _, _, _)) = let\n fun collect_absfuns d (CogentCallTree (d', ty, name, calls)) callees =\n (if d = d' andalso ty = AbsFun then [(AbsFun, name, map CogentCallTree_name callees)] else []) @\n maps (fn c => case c of\n FirstOrderCall t => collect_absfuns d t []\n | SecondOrderCall (f, args) => collect_absfuns d f (map snd args) @\n maps (fn arg => collect_absfuns d (snd arg) []) args) calls\n in map (fn d => collect_absfuns d tr []) (0 upto depth) end\n\n(* Define each of the \\_n. *)\nfun define_uabsfuns (defs : string list list) ctxt : ((term * (string * thm)) list * Proof.context) = let\n fun define _ [] ctxt = ([], ctxt)\n | define n (absfuns::defs') ctxt = let\n val name = \"\\_\" ^ string_of_int n\n val typ = @{typ \"(funtyp, abstyp, ptrtyp) uabsfuns\"}\n val rhs = Const (@{const_name undefined}, typ) (* FIXME *)\n val (thm, ctxt) = Specification.definition\n (NONE, ((Binding.name (name ^ \"_def\"), []),\n @{mk_term \"?name \\ ?def\" (name, def)} (Free (name, typ), rhs))) ctxt\n val (thms, ctxt) = define (n+1) defs' ctxt\n in (thm::thms, ctxt) end\n in define 0 defs ctxt end\n\n(* Convenience wrapper. *)\nfun define_uabsfuns' tr ctxt =\n make_uabsfuns_defs tr\n |> map (map #2 o filter (fn (funtyp, _, _) => funtyp = AbsFun))\n |> (fn defs => define_uabsfuns defs ctxt)\n |> snd\n\nfun isAutoCorresFunRec ctxt f =\n (Proof_Context.get_thms ctxt (f ^ \"'.simps\"); true)\n handle ERROR _ => false\n\n(* Manufacture fake corres rules for first-order absfuns. *)\nfun generate_FO_absfun_corres (xi:term) ctxt (fname:string) = let\n val abs_rel = Syntax.read_term ctxt \"abs_rel\"\n val state_rel = Syntax.read_term ctxt \"state_rel\"\n val Xi = Syntax.read_term ctxt \"\\ :: string \\ poly_type\"\n val _ = if isAutoCorresFunRec ctxt fname then\n error (\"Corres_Tac: expected first-order function call for \" ^ quote fname ^ \" but it is recursive\")\n else ()\n val cfun = Syntax.read_term ctxt (fname ^ \"'\")\n val prop = @{mk_term \"Trueprop (?abs_rel ?Xi ?state_rel ?fname ?xi ?cfun)\"\n (abs_rel, Xi, state_rel, fname, xi, cfun)}\n (abs_rel, Xi, state_rel, Utils.encode_isa_string fname, xi, cfun)\n |> strip_type |> Syntax.check_term ctxt\n in\n Goal.prove ctxt [] [] prop (K (Skip_Proof.cheat_tac ctxt 1)) RS Proof_Context.get_thm ctxt \"afun_corres\"\n end\n\n(* The same, but for (higher-order absfun, callees) pairs. *)\nfun generate_HO_absfun_corres (xi:term) ctxt (fname:string) (callees:(term * string) list) min_measure = let\n val corres = Syntax.read_term ctxt \"corres\"\n val state_rel = Syntax.read_term ctxt \"state_rel\"\n val Xi = Syntax.read_term ctxt \"\\ :: string \\ poly_type\"\n val cfun = Syntax.read_term ctxt (fname ^ \"'\")\n val prop = if isAutoCorresFunRec ctxt fname\n then @{mk_term \"\\ i < length \\; val_rel (\\ ! i) v'; \\ ! i = Some (fst (snd (?Xi ?fname))); m \\ ?min_m \\ \\\n ?corres ?state_rel (App (AFun ?fname []) (Var i))\n (do x \\ ?cfun m v'; gets (\\s. x) od) ?xi \\ ?Xi \\ \\ s\"\n (corres, Xi, state_rel, fname, xi, cfun, min_m)}\n (corres, Xi, state_rel, Utils.encode_isa_string fname, xi, cfun,\n Int.toString min_measure |> Syntax.read_term ctxt)\n else @{mk_term \"\\ i < length \\; val_rel (\\ ! i) v'; \\ ! i = Some (fst (snd (?Xi ?fname))) \\ \\\n ?corres ?state_rel (App (AFun ?fname []) (Var i))\n (do x \\ ?cfun v'; gets (\\s. x) od) ?xi \\ ?Xi \\ \\ s\"\n (corres, Xi, state_rel, fname, xi, cfun)}\n (corres, Xi, state_rel, Utils.encode_isa_string fname, xi, cfun)\n fun callee_assm (getter, callee) = @{mk_term \"Trueprop (?getter v' = ?callee_tag)\" (getter, callee_tag)}\n (getter, Syntax.read_term ctxt (\"FUN_ENUM_\" ^ callee))\n fun give_xi_type (t as Const (nm, T)) = (if nm = fst (dest_Const Xi) then Xi else t)\n | give_xi_type t = t\n val prop' = map callee_assm callees |> foldr Logic.mk_implies prop\n |> strip_type |> map_aterms give_xi_type |> Syntax.check_term ctxt\n in\n Goal.prove ctxt [\"i\", \"\\\", \"\\\", \"v\", \"v'\", \"\\\", \"s\", \"m\"] [] prop' (K (Skip_Proof.cheat_tac ctxt 1))\n end\n\nfun unfold_abbreviatedType_term ctxt (Const (nm, @{typ \"Cogent.type\"}))\n = if String.isPrefix \"abbreviatedType\" (Long_Name.base_name nm)\n then Proof_Context.get_thm ctxt (nm ^ \"_def\")\n |> safe_mk_meta_eq |> Thm.concl_of |> Logic.dest_equals |> snd |> SOME\n else NONE\n | unfold_abbreviatedType_term _ _ = NONE\n\n(* Generate and prove corres rules for Cogent functions. *)\nfun make_FO_fun_corres_prop xi_index ctxt fname min_measure = let\n val read = Syntax.read_term ctxt\n val Xi = read \"\\ :: string \\ poly_type\"\n fun give_xi_type (t as Const (nm, T)) = (if nm = fst (dest_Const Xi) then Xi else t)\n | give_xi_type t = t\n val cfun = read (fname ^ \"'\")\n val prop = if isAutoCorresFunRec ctxt fname\n then @{mk_term \"\\a a' \\ s m. val_rel a a' \\ m \\ ?min_m \\\n ?corres ?state_rel ?cogent (?cfun m a') ?\\ [a] ?\\ [Some (fst (snd ?cogent_type))] \\ s\"\n (corres, state_rel, cogent, cfun, \\, \\, cogent_type, min_m)}\n (read \"corres\", read \"state_rel\", read fname, cfun,\n read (\"\\_\" ^ Int.toString xi_index), Xi, read (fname ^ \"_type\"),\n Int.toString min_measure |> Syntax.read_term ctxt)\n else @{mk_term \"\\a a' \\ s. val_rel a a' \\\n ?corres ?state_rel ?cogent (?cfun a') ?\\ [a] ?\\ [Some (fst (snd ?cogent_type))] \\ s\"\n (corres, state_rel, cogent, cfun, \\, \\, cogent_type)}\n (read \"corres\", read \"state_rel\", read fname, cfun,\n read (\"\\_\" ^ Int.toString xi_index), Xi, read (fname ^ \"_type\"))\n in prop |> strip_type |> map_aterms give_xi_type |> Syntax.check_term ctxt end\n\n(* Unfold types in corres rules. *)\nfun unfold_Cogent_simps ctxt =\n Proof_Context.get_thms ctxt \"fst_conv\" @\n Proof_Context.get_thms ctxt \"snd_conv\" @\n Proof_Context.get_thms ctxt \"abbreviated_type_defs\"\nfun unfold_Cogent_types ctxt simps fname thm =\n Local_Defs.unfold ctxt (Proof_Context.get_thms ctxt (fname ^ \"_type_def\") @ simps) thm\n\nfun mapAccumL _ [] acc = ([], acc)\n | mapAccumL f (x::xs) acc = let val (x', acc') = f x acc\n val (xs', acc'') = mapAccumL f xs acc'\n in (x'::xs', acc'') end\n\ntype obligations = (string * FunType * string list * cterm) Symtab.table\n\nfun corres_tree_obligations trs ctxt : obligations = let\n fun descend (CogentCallTree ((xi_index, _), AbsFun, name, [])) tab = let\n val thm_name = name ^ \"_corres_\" ^ string_of_int xi_index in\n if Symtab.defined tab thm_name then (thm_name, tab) else let\n (* generate a fake corres rule and for interesting reasons throw it away *)\n val x = generate_FO_absfun_corres (Syntax.read_term ctxt (\"\\_\" ^ string_of_int xi_index)) ctxt name\n |> forall_intr_vars\n in tracing (\" adding thm \" ^ thm_name);\n (thm_name, Symtab.update (thm_name, (name, AbsFun, [], Thm.cprop_of x)) tab) end end\n | descend (CogentCallTree ((xi_index, min_measure), CogentFun, name, callees)) tab = let\n (* Calls to CogentFuns, which we should prove. *)\n val thm_name = name ^ \"_corres_\" ^ string_of_int xi_index\n in if Symtab.defined tab thm_name then (thm_name, tab) else let\n val (callee_nms, tab) = mapAccumL (fn c => fn tab => case c of\n FirstOrderCall f => descend f tab\n | SecondOrderCall (f as CogentCallTree ((fxi_index, fmin_measure), AbsFun, fname, []), args) => let\n (* Second-order AbsFun calls are specialised to their callees. *)\n val nm = (space_implode \"_\" (fname::map (CogentCallTree_name o snd) args)\n ^ \"_corres_\" ^ string_of_int fxi_index)\n in if Symtab.defined tab nm then (nm, tab) else let\n val tab = fold (snd oo descend) (map snd args) tab\n val f_thm = generate_HO_absfun_corres (Syntax.read_term ctxt (\"\\_\" ^ string_of_int fxi_index))\n ctxt fname (map (apsnd CogentCallTree_name) args) fmin_measure\n |> forall_intr_vars\n in tracing (\" adding thm \" ^ nm);\n (nm, Symtab.update (nm, (fname, AbsFun, [], Thm.cprop_of f_thm)) tab) end end\n | tr' => raise TERM (\"descend: callees: tr': \" ^ @{make_string} tr', [])\n ) callees tab\n val prop = make_FO_fun_corres_prop xi_index ctxt name min_measure\n val _ = tracing (\" adding thm \" ^ thm_name)\n in (thm_name, Symtab.update (thm_name, (name, CogentFun, callee_nms, Thm.cterm_of ctxt prop)) tab) end end\n | descend tr' _ = raise TERM (\"descend: tr': \" ^ @{make_string} tr', [])\n\n val tab = fold (snd oo descend o snd) (Symtab.dest trs) Symtab.empty\n in tab end\n\nfun corres_tac_driver corres_tac typing_tree_of ctxt (tab : obligations) thm_name\n = case Symtab.lookup tab thm_name of SOME (fname, CogentFun, assums, prop) => let\n val lookup_assums = map (Symtab.lookup tab #> the) assums\n val (callee_info, callee_abs_info) = lookup_assums\n |> partition (fn v => #2 v = CogentFun)\n val (callee_names, callee_abs_names) = (callee_info, callee_abs_info) |> apply2 (map #1)\n val (callee_thm_props, callee_abs_thm_props) = (callee_info, callee_abs_info) |> apply2 (map #4)\n\n val type_unfold_simps = unfold_Cogent_simps ctxt\n\n val fun_defs = Proof_Context.get_thms ctxt (fname ^ \"_def\") @\n Proof_Context.get_thms ctxt (fname ^ \"'_def'\") @\n Proof_Context.get_thms ctxt (fname ^ \"_type_def\") @\n type_unfold_simps\n val _ = @{trace} (\"corres_tac_driver: Proving \" ^ thm_name,\n { prop = prop, callee_props = callee_thm_props,\n callee_abs_props = callee_abs_thm_props })\n\n in Goal.prove ctxt []\n (map Thm.term_of (callee_thm_props @ callee_abs_thm_props))\n (Thm.term_of prop)\n (fn args => let\n val callee_thms = take (length callee_thm_props) (#prems args) ~~ callee_names\n |> map (fn (assum, name) => unfold_Cogent_types ctxt type_unfold_simps name assum)\n val callee_abs_thms = drop (length callee_thm_props) (#prems args) ~~ callee_abs_names\n |> map (fn (assum, name) => simp_xi ctxt assum |> unfold_Cogent_types ctxt type_unfold_simps name)\n val _ = @{trace} (\"Assumptions for \" ^ thm_name, callee_thms, callee_abs_thms)\n in corres_tac (#context args) (peel_two (typing_tree_of fname))\n fun_defs callee_abs_thms callee_thms end)\n end\n | SOME (_, AbsFun, [], _) => @{thm TrueI}\n | v => error (\"corres_tac_driver: tab contents: \" ^ thm_name ^ \": \" ^ @{make_string} v)\n\nfun finalise (tab : obligations) ctxt thm_tab = let\n fun to_rsn NONE = Thm.trivial @{cpat \"?P :: prop\"}\n | to_rsn (SOME thm) = thm\n\n fun cleanup thm = thm\n |> (ALLGOALS val_rel_thin_tac\n THEN prune_params_tac ctxt\n THEN distinct_subgoals_tac)\n |> Seq.hd\n\n fun inner nm ftab =\n case Symtab.lookup ftab nm of SOME thm => (thm, ftab)\n | NONE => let\n val _ = tracing (\"finalise: \" ^ nm)\n val assum_nms = Symtab.lookup tab nm |> the |> #3\n val (concr_assums, abs_assums) = partition (fn n => CogentFun = (Symtab.lookup tab n |> the |> #2)) assum_nms\n val assum_nms = concr_assums @ abs_assums\n val thm = Symtab.lookup thm_tab nm |> the\n val (assums, ftab) = mapAccumL inner assum_nms ftab\n val rthm = case thm of NONE => NONE\n | SOME t => if Thm.eq_thm (t, @{thm TrueI}) then NONE\n else SOME ((map to_rsn assums MRS gen_all (Variable.maxidx_of ctxt) t) |> cleanup)\n in (rthm, Symtab.update (nm, rthm) ftab) end\n\n in fold (snd oo inner) (Symtab.keys tab) Symtab.empty end\n\nfun all_corres_goals corres_tac typing_tree_of time_limit ctxt (tab : obligations) =\n let\n val tl = Time.fromSeconds time_limit\n fun driver nm = Timing.timing (try (TimeLimit.timeLimit tl\n (corres_tac_driver corres_tac typing_tree_of ctxt tab))) nm\n |> (fn (dur, res) => (tracing (\"Time for \" ^ nm ^ \": \" ^ Timing.message dur); res))\n |> (fn NONE => (tracing (\"Failed: \" ^ nm); (nm, NONE))\n | SOME thm => (tracing (\"Succeeded: \" ^ nm); (nm, SOME thm)))\n val res = Par_List.map driver (Symtab.keys tab)\n val thm_tab = Symtab.make res\n in thm_tab end\n\n(* Top-level driver that attempts to prove a CogentCallTree.\n * For each function in the tree, it proves a corres theorem and assigns a standard name.\n * If a theorem by that name already exists, that is used instead.\n *\n * The naming scheme is: _[__...]_corres_\n * Eg. for f called with function arguments g and h: f_g_h_corres_1\n * These names can be obtained using callee_corres_thms.\n *\n * Known issues:\n * - Does not handle C recursion guards.\n * - Does not handle higher-order CogentFuns.\n * - Should be parallelised.\n *)\nfun corres_tree tr typing_tree_of corres_tac run_proofs skip_initial time_limit ctxt = let\n fun cache_proof ctxt thm_name (make_thms : unit -> thm list) =\n (Proof_Context.get_thms ctxt thm_name, ctxt)\n handle ERROR _ =>\n Utils.define_lemmas thm_name (make_thms ()) ctxt\n\n fun mapAccumL _ [] acc = ([], acc)\n | mapAccumL f (x::xs) acc = let val (x', acc') = f x acc\n val (xs', acc'') = mapAccumL f xs acc'\n in (x'::xs', acc'') end\n\n val type_unfold_simps = unfold_Cogent_simps ctxt\n\n val skip_ctr = Unsynchronized.ref skip_initial\n val failed_proofs = Unsynchronized.ref []\n\n fun descend (CogentCallTree (xi_index, AbsFun, name, [])) ctxt = let\n (* Simple AbsFun calls. Higher-order calls are handled elsewhere. *)\n val (thm, ctxt) =\n cache_proof ctxt (name ^ \"_corres_\" ^ string_of_int xi_index) (fn () =>\n [generate_FO_absfun_corres (Syntax.read_term ctxt (\"\\_\" ^ string_of_int xi_index)) ctxt name\n |> unfold_Cogent_types ctxt type_unfold_simps name])\n in (CogentCallTree ((xi_index, thm), AbsFun, name, []), ctxt) end\n | descend (CogentCallTree (xi_index, CogentFun, name, callees)) ctxt = let\n (* Calls to CogentFuns, which we should prove. *)\n val (callees', ctxt) = mapAccumL (fn c => fn ctxt => case c of\n FirstOrderCall f => descend f ctxt |> apfst FirstOrderCall\n | SecondOrderCall (f as CogentCallTree (fxi_index, AbsFun, fname, []), args) => let\n (* Second-order AbsFun calls are specialised to their callees. *)\n val (args', ctxt) = mapAccumL descend (map snd args) ctxt\n val (f_thm, ctxt) = cache_proof ctxt\n (space_implode \"_\" (fname::map (CogentCallTree_name o snd) args) ^ \"_corres_\" ^ string_of_int fxi_index)\n (fn () => [generate_HO_absfun_corres (Syntax.read_term ctxt (\"\\_\" ^ string_of_int fxi_index))\n ctxt fname (map (apsnd CogentCallTree_name) args) 42\n |> unfold_Cogent_types ctxt type_unfold_simps fname])\n in (SecondOrderCall (CogentCallTree ((fxi_index, f_thm), AbsFun, fname, []), map fst args ~~ args'), ctxt) end)\n callees ctxt\n val thm_name = name ^ \"_corres_\" ^ string_of_int xi_index\n val _ = if !skip_ctr > 0 then @{trace} (\"skipping \" ^ string_of_int (!skip_ctr) ^ \" more\") else ()\n val run_proofs = run_proofs andalso !skip_ctr <= 0\n val _ = (skip_ctr := !skip_ctr-1)\n val (thm, ctxt) =\n cache_proof ctxt thm_name (fn () => let\n (* Warning: actual proofs ahead. *)\n val corres = Syntax.read_term ctxt \"corres\"\n val fun_term = Syntax.read_term ctxt name\n val fun_type = Syntax.read_term ctxt (name ^ \"_type\")\n val fun_c = Syntax.read_term ctxt (name ^ \"'\")\n val state_rel = Syntax.read_term ctxt \"state_rel\"\n val xi = Syntax.read_term ctxt (\"\\_\" ^ string_of_int xi_index)\n val Xi = Syntax.read_term ctxt \"\\ :: string \\ poly_type\"\n val prop = @{mk_term \"\\a a' \\ s. val_rel a a' \\ ?corres ?state_rel ?fun_term (?fun_c a') ?xi [a] ?Xi\n [Some (fst (snd ?fun_type))] \\ s\"\n (corres, state_rel, fun_term, fun_c, xi, Xi, fun_type)}\n (corres, state_rel, fun_term, fun_c, xi, Xi, fun_type)\n |> strip_type |> Syntax.check_term ctxt\n val (callee_thms, callee_abs_thms) = callees'\n |> map (fn call => case call of FirstOrderCall f => f\n | SecondOrderCall (f, _) => f)\n |> partition (fn tr => CogentCallTree_funtype tr = CogentFun)\n |> apply2 (map (CogentCallTree_data #> snd))\n val (callee_thms, callee_abs_thms) = (List.concat callee_thms, List.concat callee_abs_thms)\n\n val fun_defs = Proof_Context.get_thms ctxt (name ^ \"_def\") @\n Proof_Context.get_thms ctxt (name ^ \"'_def'\") @\n Proof_Context.get_thms ctxt (name ^ \"_type_def\") @\n type_unfold_simps\n val _ = @{trace} (\"cogent_corres_tree: \" ^ (if run_proofs then \"Proving \" else \"Skipping \") ^ thm_name,\n { prop = Thm.cterm_of ctxt prop,\n callees = callees\n |> map (fn call => case call of FirstOrderCall f => f\n | SecondOrderCall (f, _) => f)\n |> map CogentCallTree_name |> commas })\n fun fallback_thm msg = (warning (\"Failed to prove \" ^ thm_name ^ \"; error: \" ^ msg);\n failed_proofs := thm_name :: !failed_proofs;\n Goal.prove ctxt [] [] prop (K (Skip_Proof.cheat_tac ctxt 1)))\n val (time, thms) = (fn f => Timing.timing f ()) (fn () =>\n [(TimeLimit.timeLimit (Time.fromSeconds time_limit) (fn () =>\n (((((Goal.prove ctxt [] [] prop (fn {context, prems} =>\n if not run_proofs then Skip_Proof.cheat_tac ctxt 1 else\n (corres_tac context (peel_two (typing_tree_of name)) fun_defs\n callee_abs_thms callee_thms))\n handle Bind => fallback_thm (@{make_string} Bind))\n handle Match => fallback_thm (@{make_string} Match))\n handle Option => fallback_thm (@{make_string} Option))\n handle THM t => fallback_thm (@{make_string} (THM t)))\n handle TERM t => fallback_thm (@{make_string} (TERM t)))\n handle ERROR e => fallback_thm (@{make_string} (ERROR e))) ()\n handle TimeLimit.TimeOut => fallback_thm (@{make_string} TimeLimit.TimeOut))\n |> unfold_Cogent_types ctxt type_unfold_simps name])\n val _ = tracing (\"Time for \" ^ thm_name ^ \": \" ^ Timing.message time)\n in thms end)\n in (CogentCallTree ((xi_index, thm), CogentFun, name, callees'), ctxt) end\n\n val (tr', ctxt) = descend tr ctxt\n val _ = if null (!failed_proofs) then () else warning (\"Failed proofs: \" ^ commas_quote (!failed_proofs))\n in (tr', ctxt) end\n\n(* Convenience function for getting the expected corres thm names. *)\nfun callee_corres_thms (CogentCallTree (_, _, _, callees)) = callees\n |> map (fn call => case call of\n FirstOrderCall f => (f, CogentCallTree_name f ^ \"_corres_\" ^ string_of_int (CogentCallTree_data f))\n | SecondOrderCall (f, args) => (f, space_implode \"_\" (map CogentCallTree_name (f :: map snd args)) ^\n \"_corres_\" ^ string_of_int (CogentCallTree_data f)))\n |> partition (fn (tr, _) => CogentCallTree_funtype tr = CogentFun)\n |> apply2 (map snd)\n\n(* Assign AutoCorres recursion measures.\n * Each second-order function call involves a trip to the dispatcher,\n * meaning that the measure decreases by 2 instead of 1. *)\nfun calc_call_measure tr = maximum (1 :: map calc_call_order_measure (CogentCallTree_calls tr))\nand calc_call_order_measure (FirstOrderCall f) = 1 + calc_call_measure f\n | calc_call_order_measure (SecondOrderCall (f, args)) =\n 1 + max (maximum (map (calc_call_measure o snd) args) + 2) (calc_call_measure f)\n\nfun annotate_measure tr = let\n fun annotate' d (CogentCallTree (x, ty, name, calls)) = let\n in CogentCallTree ((x, d), ty, name, map (annotate_call' d) calls) end\n and annotate_call' d (FirstOrderCall f) = FirstOrderCall (annotate' (d-1) f)\n | annotate_call' d (SecondOrderCall (f, args)) =\n SecondOrderCall (annotate' (d-1) f, map (apsnd (annotate' (d-3))) args)\n in annotate' (calc_call_measure tr) tr end\n\nfun map_annotations f (CogentCallTree (a, ty, name, calls)) =\n CogentCallTree (f a, ty, name, calls |>\n map (fn c => case c of FirstOrderCall a => FirstOrderCall (map_annotations f a)\n | SecondOrderCall (a, bs) =>\n SecondOrderCall (map_annotations f a, map (apsnd (map_annotations f)) bs)))\n*}\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/c-refinement/Corres_Tac.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.28220298026568125}} {"text": "chapter \\A Control Flow Graph for Jinja Byte Code\\\n\nsection \\Formalizing the CFG\\\n\ntheory JVMCFG imports \"../StaticInter/BasicDefs\" Jinja.BVExample begin\n\ndeclare lesub_list_impl_same_size [simp del]\ndeclare listE_length [simp del]\n\nsubsection \\Type definitions\\\n\nsubsubsection \\Wellformed Programs\\\n\ndefinition \"wf_jvmprog = {(P, Phi). wf_jvm_prog\\<^bsub>Phi\\<^esub> P}\"\n\ntypedef wf_jvmprog = \"wf_jvmprog\"\nproof\n show \"(E, Phi) \\ wf_jvmprog\"\n unfolding wf_jvmprog_def by (auto intro: wf_prog)\nqed\n\nhide_const Phi E\n\nabbreviation PROG :: \"wf_jvmprog \\ jvm_prog\"\n where \"PROG P \\ fst(Rep_wf_jvmprog(P))\"\n\nabbreviation TYPING :: \"wf_jvmprog \\ ty\\<^sub>P\"\n where \"TYPING P \\ snd(Rep_wf_jvmprog(P))\"\n\nlemma wf_jvmprog_is_wf_typ: \"wf_jvm_prog\\<^bsub>TYPING P\\<^esub> (PROG P)\"\nusing Rep_wf_jvmprog [of P]\n by (auto simp: wf_jvmprog_def split_beta)\n\nlemma wf_jvmprog_is_wf: \"wf_jvm_prog (PROG P)\"\n using wf_jvmprog_is_wf_typ unfolding wf_jvm_prog_def\n by blast\n\nsubsubsection \\Interprocedural CFG\\\n\ntype_synonym jvm_method = \"wf_jvmprog \\ cname \\ mname\"\ndatatype var = Heap | Local \"nat\" | Stack \"nat\" | Exception\ndatatype val = Hp \"heap\" | Value \"Value.val\"\n\ntype_synonym state = \"var \\ val\"\n\ndefinition valid_state :: \"state \\ bool\"\n where \"valid_state s \\ (\\val. s Heap \\ Some (Value val))\n \\ (s Exception = None \\ (\\addr. s Exception = Some (Value (Addr addr))))\n \\ (\\var. var \\ Heap \\ var \\ Exception \\ (\\h. s var \\ Some (Hp h)))\"\n\nfun the_Heap :: \"val \\ heap\"\n where \"the_Heap (Hp h) = h\"\n\nfun the_Value :: \"val \\ Value.val\"\n where \"the_Value (Value v) = v\"\n\nabbreviation heap_of :: \"state \\ heap\"\n where \"heap_of s \\ the_Heap (the (s Heap))\"\n\nabbreviation exc_flag :: \"state \\ addr option\"\n where \"exc_flag s \\ case (s Exception) of None \\ None\n | Some v \\ Some (THE a. v = Value (Addr a))\"\n\nabbreviation stkAt :: \"state \\ nat \\ Value.val\"\n where \"stkAt s n \\ the_Value (the (s (Stack n)))\"\n\nabbreviation locAt :: \"state \\ nat \\ Value.val\"\n where \"locAt s n \\ the_Value (the (s (Local n)))\"\n\ndatatype nodeType = Enter | Normal | Return | Exceptional \"pc option\" \"nodeType\"\ntype_synonym cfg_node = \"cname \\ mname \\ pc option \\ nodeType\"\n\ntype_synonym\n cfg_edge = \"cfg_node \\ (var, val, cname \\ mname \\ pc, cname \\ mname) edge_kind \\ cfg_node\"\n\ndefinition ClassMain :: \"wf_jvmprog \\ cname\"\n where \"ClassMain P \\ SOME Name. \\ is_class (PROG P) Name\"\n\ndefinition MethodMain :: \"wf_jvmprog \\ mname\"\n where \"MethodMain P \\ SOME Name.\n \\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m \\ set ms. Name \\ fst m)\"\n\ndefinition stkLength :: \"jvm_method \\ pc \\ nat\"\n where\n \"stkLength m pc \\ let (P, C, M) = m in (\n if (C = ClassMain P) then 1 else (\n length (fst(the(((TYPING P) C M) ! pc)))\n ))\"\n\ndefinition locLength :: \"jvm_method \\ pc \\ nat\"\n where\n \"locLength m pc \\ let (P, C, M) = m in (\n if (C = ClassMain P) then 1 else (\n length (snd(the(((TYPING P) C M) ! pc)))\n ))\"\n\nlemma ex_new_class_name: \"\\C. \\ is_class P C\"\nproof -\n have \"\\ finite (UNIV :: cname set)\"\n by (rule infinite_UNIV_listI)\n hence \"\\C. C \\ set (map fst P)\"\n by -(rule ex_new_if_finite, auto)\n then obtain C where \"C \\ set (map fst P)\"\n by blast\n have \"\\ is_class P C\"\n proof\n assume \"is_class P C\"\n then obtain D fs ms where \"class P C = \\(D, fs, ms)\\\"\n by auto\n with \\C \\ set (map fst P)\\ show False\n by (auto dest: map_of_SomeD intro!: image_eqI simp: class_def)\n qed\n thus ?thesis\n by blast\nqed\n\nlemma ClassMain_unique_in_P:\n assumes \"is_class (PROG P) C\"\n shows \"ClassMain P \\ C\"\nproof -\n from ex_new_class_name [of \"PROG P\"] obtain D where \"\\ is_class (PROG P) D\"\n by blast\n with \\is_class (PROG P) C\\ show ?thesis\n unfolding ClassMain_def\n by -(rule someI2, fastforce+)\nqed\n\nlemma map_of_fstD: \"\\ map_of xs a = \\b\\; \\x \\ set xs. fst x \\ a \\ \\ False\"\n by (induct xs, auto)\n\nlemma map_of_fstE: \"\\ map_of xs a = \\b\\; \\x \\ set xs. fst x = a \\ thesis \\ \\ thesis\"\n by (induct xs) (auto split: if_split_asm)\n\nlemma ex_unique_method_name:\n \"\\Name. \\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m\\set ms. Name \\ fst m)\"\nproof -\n from wf_jvmprog_is_wf [of P]\n have \"distinct_fst (PROG P)\"\n by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def wf_prog_def)\n hence \"{C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\} = fst ` set (PROG P)\"\n by (fastforce elim: map_of_fstE simp: class_def intro: map_of_SomeI)\n hence \"finite {C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\}\"\n by auto\n moreover have \"{ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}\n = snd ` snd ` the ` (\\C. class (PROG P) C) ` {C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\}\"\n by (fastforce intro: rev_image_eqI map_of_SomeI simp: class_def)\n ultimately have \"finite {ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}\"\n by auto\n moreover have \"\\ finite (UNIV :: mname set)\"\n by (rule infinite_UNIV_listI)\n ultimately\n have \"\\Name. Name \\ fst ` (\\ms \\ {ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}. set ms)\"\n by -(rule ex_new_if_finite, auto)\n thus ?thesis\n by fastforce\nqed\n\nlemma MethodMain_unique_in_P:\n assumes \"PROG P \\ D sees M:Ts\\T = mb in C\"\n shows \"MethodMain P \\ M\"\nproof -\n from ex_unique_method_name [of P] obtain M'\n where \"\\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m \\ set ms. M' \\ fst m)\"\n by blast\n with \\PROG P \\ D sees M:Ts\\T = mb in C\\\n show ?thesis\n unfolding MethodMain_def\n by -(rule someI2_ex, fastforce, fastforce dest!: visible_method_exists elim: map_of_fstE)\nqed\n\nlemma ClassMain_is_no_class [dest!]: \"is_class (PROG P) (ClassMain P) \\ False\"\nproof (erule rev_notE)\n from ex_new_class_name [of \"PROG P\"] obtain C where \"\\ is_class (PROG P) C\"\n by blast\n thus \"\\ is_class (PROG P) (ClassMain P)\" unfolding ClassMain_def\n by (rule someI)\nqed\n\nlemma MethodMain_not_seen [dest!]: \"PROG P \\ C sees (MethodMain P):Ts\\T = mb in D \\ False\"\n by (fastforce dest: MethodMain_unique_in_P)\n\nlemma no_Call_from_ClassMain [dest!]: \"PROG P \\ ClassMain P sees M:Ts\\T = mb in C \\ False\"\n by (fastforce dest: sees_method_is_class)\n\nlemma no_Call_in_ClassMain [dest!]: \"PROG P \\ C sees M:Ts\\T = mb in ClassMain P \\ False\"\n by (fastforce dest: sees_method_idemp)\n\ninductive JVMCFG :: \"jvm_method \\ cfg_node \\ (var, val, cname \\ mname \\ pc, cname \\ mname) edge_kind \\ cfg_node \\ bool\" (\" _ \\ _ -_\\ _\")\n and reachable :: \"jvm_method \\ cfg_node \\ bool\" (\" _ \\ \\_\")\n where\n Entry_reachable: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, None, Enter)\"\n | reachable_step: \"\\ P \\ \\n; P \\ n -(e)\\ n' \\ \\ P \\ \\n'\"\n | Main_to_Call: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Enter)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Enter) -\\id\\ (ClassMain P, MethodMain P, \\0\\, Normal)\"\n | Main_Call_LFalse: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Normal)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Normal) -(\\s. False)\\<^sub>\\\\ (ClassMain P, MethodMain P, \\0\\, Return)\"\n | Main_Call: \"\\ (P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Normal);\n PROG P \\ C0 sees Main:[]\\T = (mxs, mxl\\<^sub>0, is, xt) in D;\n initParams = [(\\s. s Heap),(\\s. \\Value Null\\)];\n ek = (\\(s, ret). True):(ClassMain P, MethodMain P, 0)\\\\<^bsub>(D, Main)\\<^esub>initParams \\\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Normal) -(ek)\\ (D, Main, None, Enter)\"\n | Main_Return_to_Exit: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Return)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Return) -(\\id)\\ (ClassMain P, MethodMain P, None, Return)\"\n | Method_LFalse: \"(P, C0, Main) \\ \\(C, M, None, Enter)\n \\ (P, C0, Main) \\ (C, M, None, Enter) -(\\s. False)\\<^sub>\\\\ (C, M, None, Return)\"\n | Method_LTrue: \"(P, C0, Main) \\ \\(C, M, None, Enter)\n \\ (P, C0, Main) \\ (C, M, None, Enter) -(\\s. True)\\<^sub>\\\\ (C, M, \\0\\, Enter)\"\n | CFG_Load: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Load n;\n ek = \\(\\s. s(Stack (stkLength (P, C, M) pc) := s (Local n))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Store: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Store n;\n ek = \\(\\s. s(Local n := s (Stack (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Push: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Push v;\n ek = \\(\\s. s(Stack (stkLength (P, C, M) pc) \\ Value v)) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Pop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Pop;\n ek = \\id \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_IAdd: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = IAdd;\n ek = \\(\\s. let i1 = the_Intg (stkAt s (stkLength (P, C, M) pc - 1));\n i2 = the_Intg (stkAt s (stkLength (P, C, M) pc - 2))\n in s(Stack (stkLength (P, C, M) pc - 2) \\ Value (Intg (i1 + i2)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Goto: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Goto i \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -((\\s. True)\\<^sub>\\)\\ (C, M, \\nat (int pc + i)\\, Enter)\"\n | CFG_CmpEq: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = CmpEq;\n ek = \\(\\s. let e1 = stkAt s (stkLength (P, C, M) pc - 1);\n e2 = stkAt s (stkLength (P, C, M) pc - 2)\n in s(Stack (stkLength (P, C, M) pc - 2) \\ Value (Bool (e1 = e2)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_IfFalse_False: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = IfFalse i;\n i \\ 1;\n ek = (\\s. stkAt s (stkLength(P, C, M) pc - 1) = Bool False)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\nat (int pc + i)\\, Enter)\"\n | CFG_IfFalse_True: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = IfFalse i;\n ek = (\\s. stkAt s (stkLength(P, C, M) pc - 1) \\ Bool False \\ i = 1)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_New_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = (\\s. new_Addr (heap_of s) \\ None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_New_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n pc' = (case (match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. new_Addr (heap_of s) = None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_New_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. let a = the (new_Addr (heap_of s))\n in s(Heap \\ Hp ((heap_of s)(a \\ blank (PROG P) Cl)))\n (Stack (stkLength(P, C, M) pc) \\ Value (Addr a))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_New_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_New_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Getfield_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 1) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Getfield_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 1) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Getfield_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. let (D, fs) = the (heap_of s (the_Addr (stkAt s (stkLength (P, C, M) pc - 1))))\n in s(Stack (stkLength(P, C, M) pc - 1) \\ Value (the (fs (F, Cl))))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Getfield_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Getfield_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Putfield_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 2) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Putfield_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 2) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Putfield_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n r = stkAt s (stkLength (P, C, M) pc - 2);\n a = the_Addr r;\n (D, fs) = the (heap_of s a);\n h' = (heap_of s)(a \\ (D, fs((F, Cl) \\ v)))\n in s(Heap \\ Hp h')) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Putfield_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Putfield_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Checkcast_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = (\\s. cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Checkcast_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n pc' = (case (match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. \\ cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Checkcast_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt ClassCast)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Checkcast_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt ClassCast)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Throw_Check: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Throw;\n pc' = None \\ match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(the pc', d)\\;\n ek = (\\s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n Cl = if (v = Null) then NullPointer else (cname_of (heap_of s) (the_Addr v))\n in case pc' of\n None \\ match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M) = None\n | Some pc'' \\ \\d. match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M)\n = \\(pc'', d)\\\n )\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n\n | CFG_Throw_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Throw;\n ek = \\(\\s. s(Exception \\ Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Throw_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n pc' \\ length (instrs_of (PROG P) C M);\n instrs_of (PROG P) C M ! pc = Throw;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Check_NP_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - Suc n) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Invoke_Check_NP_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - Suc n) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Invoke_NP_prop: \"\\ C \\ ClassMain P;\n (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Invoke_NP_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. s(Exception := None)\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Call: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n TYPING P C M ! pc = \\(ST, LT)\\;\n ST ! n = Class D';\n PROG P \\ D' sees M':Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in D;\n Q = (\\(s, ret). let r = stkAt s (stkLength (P, C, M) pc - Suc n);\n C' = fst (the (heap_of s (the_Addr r)))\n in D = fst (method (PROG P) C' M'));\n paramDefs = (\\s. s Heap)\n # (\\s. s (Stack (stkLength (P, C, M) pc - Suc n)))\n # (rev (map (\\i. (\\s. s (Stack (stkLength (P, C, M) pc - Suc i)))) [0..\\<^bsub>(D,M')\\<^esub>paramDefs\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (D, M', None, Enter)\"\n | CFG_Invoke_False: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. False)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\pc\\, Return)\"\n | CFG_Invoke_Return_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n (TYPING P) C M ! pc = \\(ST, LT)\\;\n ST ! n \\ NT;\n ek = (\\s. s Exception = None)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Invoke_Return_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', diff)\\;\n pc' \\ length (instrs_of (PROG P) C M);\n ek = (\\s. \\v d. s Exception = \\v\\ \\\n match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = \\(pc', d)\\)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, \\pc\\, Exceptional \\pc'\\ Return)\"\n | CFG_Invoke_Return_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. s(Exception := None,\n Stack (stkLength (P, C, M) pc' - 1) := s Exception)) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Return) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Return_Exceptional_prop: \"\\ C \\ ClassMain P;\n (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. \\v. s Exception = \\v\\ \\\n match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, None, Return)\"\n | CFG_Return: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = instr.Return;\n ek = \\(\\s. s(Stack 0 := s (Stack (stkLength (P, C, M) pc - 1))))\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Return_from_Method: \"\\ (P, C0, Main) \\ \\(C, M, None, Return);\n (P, C0, Main) \\ (C', M', \\pc'\\, Normal) -(Q':(C', M', pc')\\\\<^bsub>(C,M)\\<^esub>ps)\\ (C, M, None, Enter);\n Q = (\\(s, ret). ret = (C', M', pc'));\n stateUpdate = (\\s s'. s'(Heap := s Heap,\n Exception := s Exception,\n Stack (stkLength (P, C', M') (Suc pc') - 1) := s (Stack 0))\n );\n ek = Q\\\\<^bsub>(C, M)\\<^esub>stateUpdate\n \\\n \\ (P, C0, Main) \\ (C, M, None, Return) -(ek)\\ (C', M', \\pc'\\, Return)\"\n\n\n(* This takes veeeery long *)\nlemma JVMCFG_edge_det: \"\\ P \\ n -(et)\\ n'; P \\ n -(et')\\ n' \\ \\ et = et'\"\n by (erule JVMCFG.cases) (erule JVMCFG.cases, (fastforce dest: sees_method_fun)+)+\n\nlemma sourcenode_reachable: \"P \\ n -(ek)\\ n' \\ P \\ \\n\"\n by (erule JVMCFG.cases, auto)\n\nlemma targetnode_reachable:\n assumes edge: \"P \\ n -(ek)\\ n'\"\n shows \"P \\ \\n'\"\nproof -\n from edge have \"P \\ \\n\"\n by -(drule sourcenode_reachable)\n with edge show ?thesis\n by -(rule JVMCFG_reachable.intros)\nqed\n\nlemmas JVMCFG_reachable_inducts = JVMCFG_reachable.inducts[split_format (complete)]\n\nlemma ClassMain_imp_MethodMain:\n \"(P, C0, Main) \\ (C', M', pc', nt') -ek\\ (ClassMain P, M, pc, nt) \\ M = MethodMain P\"\n \"(P, C0, Main) \\ \\(ClassMain P, M, pc, nt) \\ M = MethodMain P\"\nproof (induct P==\"P\" C0\\\"C0\" Main\\Main C' M' pc' nt' ek C''==\"ClassMain P\" M pc nt and\n P==\"P\" C0\\\"C0\" Main\\Main C'==\"ClassMain P\" M pc nt\n rule: JVMCFG_reachable_inducts)\n case CFG_Return_from_Method\n thus ?case\n by (fastforce elim: JVMCFG.cases)\nqed auto\n\nlemma ClassMain_no_Call_target [dest!]:\n \"(P, C0, Main) \\ (C, M, pc, nt) -Q:(C', M', pc')\\\\<^bsub>(D,M'')\\<^esub>paramDefs\\ (ClassMain P, M''', pc'', nt')\n \\ False\"\n and\n \"(P, C0, Main) \\ \\(C, M, pc, nt) \\ True\"\n by (induct P C0 Main C M pc nt ek==\"Q:(C', M', pc')\\\\<^bsub>(D,M'')\\<^esub>paramDefs\"\n C''==\"ClassMain P\" M''' pc'' nt' and\n P C0 Main C M pc nt\n rule: JVMCFG_reachable_inducts) auto\n\nlemma method_of_src_and_trg_exists:\n \"\\ (P, C0, Main) \\ (C', M', pc', nt') -ek\\ (C, M, pc, nt); C \\ ClassMain P; C' \\ ClassMain P \\\n \\ (\\Ts T mb. (PROG P) \\ C sees M:Ts\\T = mb in C) \\\n (\\Ts T mb. (PROG P) \\ C' sees M':Ts\\T = mb in C')\"\n and method_of_reachable_node_exists:\n \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P \\\n \\ \\Ts T mb. (PROG P) \\ C sees M:Ts\\T = mb in C\"\nproof (induct rule: JVMCFG_reachable_inducts)\n case CFG_Invoke_Call\n thus ?case\n by (blast dest: sees_method_idemp)\nnext\n case (reachable_step P C0 Main C M pc nt ek C' M' pc' nt')\n show ?case\n proof (cases \"C = ClassMain P\")\n case True\n with \\(P, C0, Main) \\ (C, M, pc, nt) -ek\\ (C', M', pc', nt')\\ \\C' \\ ClassMain P\\\n show ?thesis\n proof cases\n case Main_Call\n thus ?thesis\n by (blast dest: sees_method_idemp)\n qed auto\n next\n case False\n with reachable_step show ?thesis\n by simp\n qed\nqed simp_all\n\nlemma \"\\ (P, C0, Main) \\ (C', M', pc', nt') -ek\\ (C, M, pc, nt); C \\ ClassMain P; C' \\ ClassMain P \\\n \\ (case pc of None \\ True |\n \\pc''\\ \\ (TYPING P) C M ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C M)) \\\n (case pc' of None \\ True |\n \\pc''\\ \\ (TYPING P) C' M' ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C' M'))\"\n and instr_of_reachable_node_typable: \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P \\\n \\ case pc of None \\ True |\n \\pc''\\ \\ (TYPING P) C M ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C M)\"\nproof (induct rule: JVMCFG_reachable_inducts)\n case (CFG_Load C P C0 Main M pc n ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Load show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Store C P C0 Main M pc n ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Store show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Push C P C0 Main M pc v ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Push show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Pop C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Pop show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IAdd C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IAdd show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Goto C P C0 Main M pc i)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Goto show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_CmpEq C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_CmpEq show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IfFalse_False C P C0 Main M pc i ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IfFalse_False show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IfFalse_True C P C0 Main M pc i ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IfFalse_True show ?case\n using [[simproc del: list_to_set_comprehension]] by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_New_Update C P C0 Main M pc Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_New_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_New_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = New Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ New Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = New Cl\\ obtain d'\n where \"match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) OutOfMemory pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = New Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Getfield_Update C P C0 Main M pc F Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Getfield_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Getfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Getfield F Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Putfield_Update C P C0 Main M pc F Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Putfield_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Putfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Putfield F Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Checkcast_Check_Normal C P C0 Main M pc Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Checkcast_Check_Normal show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Checkcast_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Checkcast Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\ obtain d'\n where \"match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) ClassCast pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Throw_handle C P C0 Main M pc pc' ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Throw\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Throw,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Throw\\ obtain d' Exc\n where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Throw\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_NP_handle C P C0 Main M pc pc' M' n ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Invoke M' n,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Invoke M' n\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_Return_Exceptional_handle C P C0 Main M pc pc' M' n ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Invoke M' n,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Invoke M' n\\ obtain d' Exc\n where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_Return_Check_Normal C P C0 Main M pc M' n ST LT ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Return)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Invoke_Return_Check_Normal show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext \n case (Method_LTrue P C0 Main C M)\n from \\(P, C0, Main) \\ \\(C, M, None, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with Method_LTrue show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_start [OF wf_jvmprog_is_wf_typ] simp: wt_start_def)\nnext\n case (reachable_step P C0 Main C M opc nt ek C' M' opc' nt')\n thus ?case\n by (cases \"C = ClassMain P\") (fastforce elim: JVMCFG.cases, simp)\nqed simp_all\n\nlemma reachable_node_impl_wt_instr:\n assumes \"(P, C0, Main) \\ \\(C, M, \\pc\\, nt)\"\n and \"C \\ ClassMain P\"\n shows \"\\T mxs mpc xt. PROG P,T,mxs,mpc,xt \\ (instrs_of (PROG P) C M ! pc),pc :: TYPING P C M\"\nproof -\n from \\C \\ ClassMain P\\ \\(P, C0, Main) \\ \\(C, M, \\pc\\, nt)\\\n method_of_reachable_node_exists [of P C0 Main C M \"\\pc\\\" nt]\n instr_of_reachable_node_typable [of P C0 Main C M \"\\pc\\\" nt]\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt\n where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"TYPING P C M ! pc \\ None\"\n and \"pc < length (instrs_of (PROG P) C M)\"\n by fastforce+\n with wf_jvmprog_is_wf_typ [of P]\n have \"PROG P,T,mxs,length is,xt \\ instrs_of (PROG P) C M ! pc,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr)\n thus ?thesis\n by blast\nqed\n\nlemma\n \"\\ (P, C0, Main) \\ (C, M, pc, nt) -ek\\ (C', M', pc', nt'); C \\ ClassMain P \\ C' \\ ClassMain P \\\n \\ \\T mb D. PROG P \\ C0 sees Main:[]\\T = mb in D\"\n and reachable_node_impl_Main_ex:\n \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P\\\n \\ \\T mb D. PROG P \\ C0 sees Main:[]\\T = mb in D\"\n by (induct rule: JVMCFG_reachable_inducts) fastforce+\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/JinjaVM_Inter/JVMCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.2822029740994188}} {"text": "(* Title: ZF/UNITY/AllocImpl.thy\n Author: Sidi O Ehmety, Cambridge University Computer Laboratory\n Copyright 2002 University of Cambridge\n\nSingle-client allocator implementation.\nCharpentier and Chandy, section 7 (page 17).\n*)\n\ntheory AllocImpl imports ClientImpl begin\n\nabbreviation\n NbR :: i (*number of consumed messages*) where\n \"NbR \\ Var([succ(2)])\"\n\nabbreviation\n available_tok :: i (*number of free tokens (T in paper)*) where\n \"available_tok \\ Var([succ(succ(2))])\"\n\naxiomatization where\n alloc_type_assumes [simp]:\n \"type_of(NbR) = nat \\ type_of(available_tok)=nat\" and\n\n alloc_default_val_assumes [simp]:\n \"default_val(NbR) = 0 \\ default_val(available_tok)=0\"\n\ndefinition\n \"alloc_giv_act \\\n {\\s, t\\ \\ state*state.\n \\k. k = length(s`giv) \\\n t = s(giv := s`giv @ [nth(k, s`ask)],\n available_tok := s`available_tok #- nth(k, s`ask)) \\\n k < length(s`ask) \\ nth(k, s`ask) \\ s`available_tok}\"\n\ndefinition\n \"alloc_rel_act \\\n {\\s, t\\ \\ state*state.\n t = s(available_tok := s`available_tok #+ nth(s`NbR, s`rel),\n NbR := succ(s`NbR)) \\\n s`NbR < length(s`rel)}\"\n\ndefinition\n (*The initial condition s`giv=[] is missing from the\n original definition: S. O. Ehmety *)\n \"alloc_prog \\\n mk_program({s:state. s`available_tok=NbT \\ s`NbR=0 \\ s`giv=Nil},\n {alloc_giv_act, alloc_rel_act},\n \\G \\ preserves(lift(available_tok)) \\\n preserves(lift(NbR)) \\\n preserves(lift(giv)). Acts(G))\"\n\n\nlemma available_tok_value_type [simp,TC]: \"s\\state \\ s`available_tok \\ nat\"\n unfolding state_def\napply (drule_tac a = available_tok in apply_type, auto)\ndone\n\nlemma NbR_value_type [simp,TC]: \"s\\state \\ s`NbR \\ nat\"\n unfolding state_def\napply (drule_tac a = NbR in apply_type, auto)\ndone\n\n(** The Alloc Program **)\n\nlemma alloc_prog_type [simp,TC]: \"alloc_prog \\ program\"\nby (simp add: alloc_prog_def)\n\ndeclare alloc_prog_def [THEN def_prg_Init, simp]\ndeclare alloc_prog_def [THEN def_prg_AllowedActs, simp]\ndeclare alloc_prog_def [program]\n\ndeclare alloc_giv_act_def [THEN def_act_simp, simp]\ndeclare alloc_rel_act_def [THEN def_act_simp, simp]\n\n\nlemma alloc_prog_ok_iff:\n\"\\G \\ program. (alloc_prog ok G) \\\n (G \\ preserves(lift(giv)) \\ G \\ preserves(lift(available_tok)) \\\n G \\ preserves(lift(NbR)) \\ alloc_prog \\ Allowed(G))\"\nby (auto simp add: ok_iff_Allowed alloc_prog_def [THEN def_prg_Allowed])\n\n\nlemma alloc_prog_preserves:\n \"alloc_prog \\ (\\x \\ var-{giv, available_tok, NbR}. preserves(lift(x)))\"\napply (rule Inter_var_DiffI, force)\napply (rule ballI)\napply (rule preservesI, safety)\ndone\n\n(* As a special case of the rule above *)\n\nlemma alloc_prog_preserves_rel_ask_tok:\n \"alloc_prog \\\n preserves(lift(rel)) \\ preserves(lift(ask)) \\ preserves(lift(tok))\"\napply auto\napply (insert alloc_prog_preserves)\napply (drule_tac [3] x = tok in Inter_var_DiffD)\napply (drule_tac [2] x = ask in Inter_var_DiffD)\napply (drule_tac x = rel in Inter_var_DiffD, auto)\ndone\n\nlemma alloc_prog_Allowed:\n\"Allowed(alloc_prog) =\n preserves(lift(giv)) \\ preserves(lift(available_tok)) \\ preserves(lift(NbR))\"\napply (cut_tac v=\"lift(giv)\" in preserves_type)\napply (auto simp add: Allowed_def client_prog_def [THEN def_prg_Allowed]\n cons_Int_distrib safety_prop_Acts_iff)\ndone\n\n(* In particular we have *)\nlemma alloc_prog_ok_client_prog: \"alloc_prog ok client_prog\"\napply (auto simp add: ok_iff_Allowed)\napply (cut_tac alloc_prog_preserves)\napply (cut_tac [2] client_prog_preserves)\napply (auto simp add: alloc_prog_Allowed client_prog_Allowed)\napply (drule_tac [6] B = \"preserves (lift (NbR))\" in InterD)\napply (drule_tac [5] B = \"preserves (lift (available_tok))\" in InterD)\napply (drule_tac [4] B = \"preserves (lift (giv))\" in InterD)\napply (drule_tac [3] B = \"preserves (lift (tok))\" in InterD)\napply (drule_tac [2] B = \"preserves (lift (ask))\" in InterD)\napply (drule_tac B = \"preserves (lift (rel))\" in InterD)\napply auto\ndone\n\n(** Safety property: (28) **)\nlemma alloc_prog_Increasing_giv: \"alloc_prog \\ program guarantees Incr(lift(giv))\"\napply (auto intro!: increasing_imp_Increasing simp add: guar_def\n Increasing.increasing_def alloc_prog_ok_iff alloc_prog_Allowed, safety+)\napply (auto dest: ActsD)\napply (drule_tac f = \"lift (giv) \" in preserves_imp_eq)\napply auto\ndone\n\nlemma giv_Bounded_lamma1:\n\"alloc_prog \\ stable({s\\state. s`NbR \\ length(s`rel)} \\\n {s\\state. s`available_tok #+ tokens(s`giv) =\n NbT #+ tokens(take(s`NbR, s`rel))})\"\napply safety\napply auto\napply (simp add: diff_add_0 add_commute diff_add_inverse add_assoc add_diff_inverse)\napply (simp (no_asm_simp) add: take_succ)\ndone\n\nlemma giv_Bounded_lemma2:\n\"\\G \\ program; alloc_prog ok G; alloc_prog \\ G \\ Incr(lift(rel))\\\n \\ alloc_prog \\ G \\ Stable({s\\state. s`NbR \\ length(s`rel)} \\\n {s\\state. s`available_tok #+ tokens(s`giv) =\n NbT #+ tokens(take(s`NbR, s`rel))})\"\napply (cut_tac giv_Bounded_lamma1)\napply (cut_tac alloc_prog_preserves_rel_ask_tok)\napply (auto simp add: Collect_conj_eq [symmetric] alloc_prog_ok_iff)\napply (subgoal_tac \"G \\ preserves (fun_pair (lift (available_tok), fun_pair (lift (NbR), lift (giv))))\")\napply (rotate_tac -1)\napply (cut_tac A = \"nat * nat * list(nat)\"\n and P = \"% y. n \\ length(y) \\\n m #+ tokens(l) = NbT #+ tokens(take(n,y))\"\n and g = \"lift(rel)\" and F = alloc_prog\n in stable_Join_Stable)\nprefer 3 apply assumption\napply (auto simp add: Collect_conj_eq)\napply (frule_tac g = length in imp_Increasing_comp)\napply (blast intro: mono_length)\napply (auto simp add: refl_prefix)\napply (drule_tac a=xa and f = \"length comp lift(rel)\" in Increasing_imp_Stable)\napply assumption\napply (auto simp add: Le_def length_type)\napply (auto dest: ActsD simp add: Stable_def Constrains_def constrains_def)\napply (drule_tac f = \"lift (rel) \" in preserves_imp_eq)\napply assumption+\napply (force dest: ActsD)\napply (erule_tac V = \"\\x \\ Acts (alloc_prog) \\ Acts (G). P(x)\" for P in thin_rl)\napply (erule_tac V = \"alloc_prog \\ stable (u)\" for u in thin_rl)\napply (drule_tac a = \"xc`rel\" and f = \"lift (rel)\" in Increasing_imp_Stable)\napply (auto simp add: Stable_def Constrains_def constrains_def)\napply (drule bspec, force)\napply (drule subsetD)\napply (rule imageI, assumption)\napply (auto simp add: prefix_take_iff)\napply (rotate_tac -1)\napply (erule ssubst)\napply (auto simp add: take_take min_def)\ndone\n\n(*Property (29), page 18:\n the number of tokens in circulation never exceeds NbT*)\nlemma alloc_prog_giv_Bounded: \"alloc_prog \\ Incr(lift(rel))\n guarantees Always({s\\state. tokens(s`giv) \\ NbT #+ tokens(s`rel)})\"\napply (cut_tac NbT_pos)\napply (auto simp add: guar_def)\napply (rule Always_weaken)\napply (rule AlwaysI)\napply (rule_tac [2] giv_Bounded_lemma2, auto)\napply (rule_tac j = \"NbT #+ tokens(take (x` NbR, x`rel))\" in le_trans)\napply (erule subst)\napply (auto intro!: tokens_mono simp add: prefix_take_iff min_def length_take)\ndone\n\n(*Property (30), page 18: the number of tokens given never exceeds the number\n asked for*)\nlemma alloc_prog_ask_prefix_giv:\n \"alloc_prog \\ Incr(lift(ask)) guarantees\n Always({s\\state. \\ prefix(tokbag)})\"\napply (auto intro!: AlwaysI simp add: guar_def)\napply (subgoal_tac \"G \\ preserves (lift (giv))\")\n prefer 2 apply (simp add: alloc_prog_ok_iff)\napply (rule_tac P = \"\\x y. \\x,y\\ \\ prefix(tokbag)\" and A = \"list(nat)\"\n in stable_Join_Stable)\napply safety\n prefer 2 apply (simp add: lift_def, clarify)\napply (drule_tac a = k in Increasing_imp_Stable, auto)\ndone\n\nsubsection\\Towards proving the liveness property, (31)\\\n\nsubsubsection\\First, we lead up to a proof of Lemma 49, page 28.\\\n\nlemma alloc_prog_transient_lemma:\n \"\\G \\ program; k\\nat\\\n \\ alloc_prog \\ G \\\n transient({s\\state. k \\ length(s`rel)} \\\n {s\\state. succ(s`NbR) = k})\"\napply auto\napply (erule_tac V = \"G\\u\" for u in thin_rl)\napply (rule_tac act = alloc_rel_act in transientI)\napply (simp (no_asm) add: alloc_prog_def [THEN def_prg_Acts])\napply (simp (no_asm) add: alloc_rel_act_def [THEN def_act_eq, THEN act_subset])\napply (auto simp add: alloc_prog_def [THEN def_prg_Acts] domain_def)\napply (rule ReplaceI)\napply (rule_tac x = \"x (available_tok:= x`available_tok #+ nth (x`NbR, x`rel),\n NbR:=succ (x`NbR))\"\n in exI)\napply (auto intro!: state_update_type)\ndone\n\nlemma alloc_prog_rel_Stable_NbR_lemma:\n \"\\G \\ program; alloc_prog ok G; k\\nat\\\n \\ alloc_prog \\ G \\ Stable({s\\state . k \\ succ(s ` NbR)})\"\napply (auto intro!: stable_imp_Stable simp add: alloc_prog_ok_iff, safety, auto)\napply (blast intro: le_trans leI)\napply (drule_tac f = \"lift (NbR)\" and A = nat in preserves_imp_increasing)\napply (drule_tac [2] g = succ in imp_increasing_comp)\napply (rule_tac [2] mono_succ)\napply (drule_tac [4] x = k in increasing_imp_stable)\n prefer 5 apply (simp add: Le_def comp_def, auto)\ndone\n\nlemma alloc_prog_NbR_LeadsTo_lemma:\n \"\\G \\ program; alloc_prog ok G;\n alloc_prog \\ G \\ Incr(lift(rel)); k\\nat\\\n \\ alloc_prog \\ G \\\n {s\\state. k \\ length(s`rel)} \\ {s\\state. succ(s`NbR) = k}\n \\w {s\\state. k \\ s`NbR}\"\napply (subgoal_tac \"alloc_prog \\ G \\ Stable ({s\\state. k \\ length (s`rel)})\")\napply (drule_tac [2] a = k and g1 = length in imp_Increasing_comp [THEN Increasing_imp_Stable])\napply (rule_tac [2] mono_length)\n prefer 3 apply simp\napply (simp_all add: refl_prefix Le_def comp_def length_type)\napply (rule LeadsTo_weaken)\napply (rule PSP_Stable)\nprefer 2 apply assumption\napply (rule PSP_Stable)\napply (rule_tac [2] alloc_prog_rel_Stable_NbR_lemma)\napply (rule alloc_prog_transient_lemma [THEN transient_imp_leadsTo, THEN leadsTo_imp_LeadsTo], assumption+)\napply (auto dest: not_lt_imp_le elim: lt_asym simp add: le_iff)\ndone\n\nlemma alloc_prog_NbR_LeadsTo_lemma2 [rule_format]:\n \"\\G \\ program; alloc_prog ok G; alloc_prog \\ G \\ Incr(lift(rel));\n k\\nat; n \\ nat; n < k\\\n \\ alloc_prog \\ G \\\n {s\\state . k \\ length(s ` rel)} \\ {s\\state . s ` NbR = n}\n \\w {x \\ state. k \\ length(x`rel)} \\\n (\\m \\ greater_than(n). {x \\ state. x ` NbR=m})\"\n unfolding greater_than_def\napply (rule_tac A' = \"{x \\ state. k \\ length(x`rel)} \\ {x \\ state. n < x`NbR}\"\n in LeadsTo_weaken_R)\napply safe\napply (subgoal_tac \"alloc_prog \\ G \\ Stable ({s\\state. k \\ length (s`rel) }) \")\napply (drule_tac [2] a = k and g1 = length in imp_Increasing_comp [THEN Increasing_imp_Stable])\napply (rule_tac [2] mono_length)\n prefer 3 apply simp\napply (simp_all add: refl_prefix Le_def comp_def length_type)\napply (subst Int_commute [of _ \"{x \\ state . n < x ` NbR}\"])\napply (rule_tac A = \"({s \\ state . k \\ length (s ` rel) } \\\n {s\\state . s ` NbR = n}) \\ {s\\state. k \\ length(s`rel)}\"\n in LeadsTo_weaken_L)\napply (rule PSP_Stable, safe)\napply (rule_tac B = \"{x \\ state . n < length (x ` rel) } \\ {s\\state . s ` NbR = n}\" in LeadsTo_Trans)\napply (rule_tac [2] LeadsTo_weaken)\napply (rule_tac [2] k = \"succ (n)\" in alloc_prog_NbR_LeadsTo_lemma)\napply simp_all\napply (rule subset_imp_LeadsTo, auto)\napply (blast intro: lt_trans2)\ndone\n\nlemma Collect_vimage_eq: \"u\\nat \\ {. s \\ A} -`` u = {s\\A. f(s) < u}\"\nby (force simp add: lt_def)\n\n(* Lemma 49, page 28 *)\n\nlemma alloc_prog_NbR_LeadsTo_lemma3:\n \"\\G \\ program; alloc_prog ok G; alloc_prog \\ G \\ Incr(lift(rel));\n k\\nat\\\n \\ alloc_prog \\ G \\\n {s\\state. k \\ length(s`rel)} \\w {s\\state. k \\ s`NbR}\"\n(* Proof by induction over the difference between k and n *)\napply (rule_tac f = \"\\s\\state. k #- s`NbR\" in LessThan_induct)\napply (simp_all add: lam_def, auto)\napply (rule single_LeadsTo_I, auto)\napply (simp (no_asm_simp) add: Collect_vimage_eq)\napply (rename_tac \"s0\")\napply (case_tac \"s0`NbR < k\")\napply (rule_tac [2] subset_imp_LeadsTo, safe)\napply (auto dest!: not_lt_imp_le)\napply (rule LeadsTo_weaken)\napply (rule_tac n = \"s0`NbR\" in alloc_prog_NbR_LeadsTo_lemma2, safe)\nprefer 3 apply assumption\napply (auto split: nat_diff_split simp add: greater_than_def not_lt_imp_le not_le_iff_lt)\napply (blast dest: lt_asym)\napply (force dest: add_lt_elim2)\ndone\n\nsubsubsection\\Towards proving lemma 50, page 29\\\n\nlemma alloc_prog_giv_Ensures_lemma:\n\"\\G \\ program; k\\nat; alloc_prog ok G;\n alloc_prog \\ G \\ Incr(lift(ask))\\ \\\n alloc_prog \\ G \\\n {s\\state. nth(length(s`giv), s`ask) \\ s`available_tok} \\\n {s\\state. k < length(s`ask)} \\ {s\\state. length(s`giv)=k}\n Ensures {s\\state. \\ k {s\\state. length(s`giv) \\ k}\"\napply (rule EnsuresI, auto)\napply (erule_tac [2] V = \"G\\u\" for u in thin_rl)\napply (rule_tac [2] act = alloc_giv_act in transientI)\n prefer 2\n apply (simp add: alloc_prog_def [THEN def_prg_Acts])\n apply (simp add: alloc_giv_act_def [THEN def_act_eq, THEN act_subset])\napply (auto simp add: alloc_prog_def [THEN def_prg_Acts] domain_def)\napply (erule_tac [2] swap)\napply (rule_tac [2] ReplaceI)\napply (rule_tac [2] x = \"x (giv := x ` giv @ [nth (length(x`giv), x ` ask) ], available_tok := x ` available_tok #- nth (length(x`giv), x ` ask))\" in exI)\napply (auto intro!: state_update_type simp add: app_type)\napply (rule_tac A = \"{s\\state . nth (length(s ` giv), s ` ask) \\ s ` available_tok} \\ {s\\state . k < length(s ` ask) } \\ {s\\state. length(s`giv) =k}\" and A' = \"{s\\state . nth (length(s ` giv), s ` ask) \\ s ` available_tok} \\ {s\\state. \\ k < length(s`ask) } \\ {s\\state . length(s ` giv) \\ k}\" in Constrains_weaken)\napply (auto dest: ActsD simp add: Constrains_def constrains_def alloc_prog_def [THEN def_prg_Acts] alloc_prog_ok_iff)\napply (subgoal_tac \"length(xa ` giv @ [nth (length(xa ` giv), xa ` ask) ]) = length(xa ` giv) #+ 1\")\napply (rule_tac [2] trans)\napply (rule_tac [2] length_app, auto)\napply (rule_tac j = \"xa ` available_tok\" in le_trans, auto)\napply (drule_tac f = \"lift (available_tok)\" in preserves_imp_eq)\napply assumption+\napply auto\napply (drule_tac a = \"xa ` ask\" and r = \"prefix(tokbag)\" and A = \"list(tokbag)\"\n in Increasing_imp_Stable)\napply (auto simp add: prefix_iff)\napply (drule StableD)\napply (auto simp add: Constrains_def constrains_def, force)\ndone\n\nlemma alloc_prog_giv_Stable_lemma:\n\"\\G \\ program; alloc_prog ok G; k\\nat\\\n \\ alloc_prog \\ G \\ Stable({s\\state . k \\ length(s`giv)})\"\napply (auto intro!: stable_imp_Stable simp add: alloc_prog_ok_iff, safety)\napply (auto intro: leI)\napply (drule_tac f = \"lift (giv)\" and g = length in imp_preserves_comp)\napply (drule_tac f = \"length comp lift (giv)\" and A = nat and r = Le in preserves_imp_increasing)\napply (drule_tac [2] x = k in increasing_imp_stable)\n prefer 3 apply (simp add: Le_def comp_def)\napply (auto simp add: length_type)\ndone\n\n(* Lemma 50, page 29 *)\n\nlemma alloc_prog_giv_LeadsTo_lemma:\n\"\\G \\ program; alloc_prog ok G;\n alloc_prog \\ G \\ Incr(lift(ask)); k\\nat\\\n \\ alloc_prog \\ G \\\n {s\\state. nth(length(s`giv), s`ask) \\ s`available_tok} \\\n {s\\state. k < length(s`ask)} \\\n {s\\state. length(s`giv) = k}\n \\w {s\\state. k < length(s`giv)}\"\napply (subgoal_tac \"alloc_prog \\ G \\ {s\\state. nth (length(s`giv), s`ask) \\ s`available_tok} \\ {s\\state. k < length(s`ask) } \\ {s\\state. length(s`giv) = k} \\w {s\\state. \\ k {s\\state. length(s`giv) \\ k}\")\nprefer 2 apply (blast intro: alloc_prog_giv_Ensures_lemma [THEN LeadsTo_Basis])\napply (subgoal_tac \"alloc_prog \\ G \\ Stable ({s\\state. k < length(s`ask) }) \")\napply (drule PSP_Stable, assumption)\napply (rule LeadsTo_weaken)\napply (rule PSP_Stable)\napply (rule_tac [2] k = k in alloc_prog_giv_Stable_lemma)\napply (auto simp add: le_iff)\napply (drule_tac a = \"succ (k)\" and g1 = length in imp_Increasing_comp [THEN Increasing_imp_Stable])\napply (rule mono_length)\n prefer 2 apply simp\napply (simp_all add: refl_prefix Le_def comp_def length_type)\ndone\n\n\ntext\\Lemma 51, page 29.\n This theorem states as invariant that if the number of\n tokens given does not exceed the number returned, then the upper limit\n (\\<^term>\\NbT\\) does not exceed the number currently available.\\\nlemma alloc_prog_Always_lemma:\n\"\\G \\ program; alloc_prog ok G;\n alloc_prog \\ G \\ Incr(lift(ask));\n alloc_prog \\ G \\ Incr(lift(rel))\\\n \\ alloc_prog \\ G \\\n Always({s\\state. tokens(s`giv) \\ tokens(take(s`NbR, s`rel)) \\\n NbT \\ s`available_tok})\"\napply (subgoal_tac\n \"alloc_prog \\ G\n \\ Always ({s\\state. s`NbR \\ length(s`rel) } \\\n {s\\state. s`available_tok #+ tokens(s`giv) = \n NbT #+ tokens(take (s`NbR, s`rel))})\")\napply (rule_tac [2] AlwaysI)\napply (rule_tac [3] giv_Bounded_lemma2, auto)\napply (rule Always_weaken, assumption, auto)\napply (subgoal_tac \"0 \\ tokens(take (x ` NbR, x ` rel)) #- tokens(x`giv) \")\n prefer 2 apply (force)\napply (subgoal_tac \"x`available_tok =\n NbT #+ (tokens(take(x`NbR,x`rel)) #- tokens(x`giv))\")\napply (simp add: )\napply (auto split: nat_diff_split dest: lt_trans2)\ndone\n\n\n\nsubsubsection\\Main lemmas towards proving property (31)\\\n\nlemma LeadsTo_strength_R:\n \"\\F \\ C \\w B'; F \\ A-C \\w B; B'<=B\\ \\ F \\ A \\w B\"\nby (blast intro: LeadsTo_weaken LeadsTo_Un_Un)\n\nlemma PSP_StableI:\n\"\\F \\ Stable(C); F \\ A - C \\w B;\n F \\ A \\ C \\w B \\ (state - C)\\ \\ F \\ A \\w B\"\napply (rule_tac A = \" (A-C) \\ (A \\ C)\" in LeadsTo_weaken_L)\n prefer 2 apply blast\napply (rule LeadsTo_Un, assumption)\napply (blast intro: LeadsTo_weaken dest: PSP_Stable)\ndone\n\nlemma state_compl_eq [simp]: \"state - {s\\state. P(s)} = {s\\state. \\P(s)}\"\nby auto\n\n(*needed?*)\nlemma single_state_Diff_eq [simp]: \"{s}-{x \\ state. P(x)} = (if s\\state \\ P(s) then 0 else {s})\"\nby auto\n\n\nlocale alloc_progress =\n fixes G\n assumes Gprog [intro,simp]: \"G \\ program\"\n and okG [iff]: \"alloc_prog ok G\"\n and Incr_rel [intro]: \"alloc_prog \\ G \\ Incr(lift(rel))\"\n and Incr_ask [intro]: \"alloc_prog \\ G \\ Incr(lift(ask))\"\n and safety: \"alloc_prog \\ G\n \\ Always(\\k \\ nat. {s\\state. nth(k, s`ask) \\ NbT})\"\n and progress: \"alloc_prog \\ G\n \\ (\\k\\nat. {s\\state. k \\ tokens(s`giv)} \\w\n {s\\state. k \\ tokens(s`rel)})\"\n\n(*First step in proof of (31) -- the corrected version from Charpentier.\n This lemma implies that if a client releases some tokens then the Allocator\n will eventually recognize that they've been released.*)\nlemma (in alloc_progress) tokens_take_NbR_lemma:\n \"k \\ tokbag\n \\ alloc_prog \\ G \\\n {s\\state. k \\ tokens(s`rel)}\n \\w {s\\state. k \\ tokens(take(s`NbR, s`rel))}\"\napply (rule single_LeadsTo_I, safe)\napply (rule_tac a1 = \"s`rel\" in Increasing_imp_Stable [THEN PSP_StableI])\napply (rule_tac [4] k1 = \"length(s`rel)\" in alloc_prog_NbR_LeadsTo_lemma3 [THEN LeadsTo_strength_R])\napply (rule_tac [8] subset_imp_LeadsTo)\napply (auto intro!: Incr_rel)\napply (rule_tac j = \"tokens(take (length(s`rel), x`rel))\" in le_trans)\napply (rule_tac j = \"tokens(take (length(s`rel), s`rel))\" in le_trans)\napply (auto intro!: tokens_mono take_mono simp add: prefix_iff)\ndone\n\n(*** Rest of proofs done by lcp ***)\n\n(*Second step in proof of (31): by LHS of the guarantee and transivity of\n \\w *)\nlemma (in alloc_progress) tokens_take_NbR_lemma2:\n \"k \\ tokbag\n \\ alloc_prog \\ G \\\n {s\\state. tokens(s`giv) = k}\n \\w {s\\state. k \\ tokens(take(s`NbR, s`rel))}\"\napply (rule LeadsTo_Trans)\n apply (rule_tac [2] tokens_take_NbR_lemma)\n prefer 2 apply assumption\napply (insert progress) \napply (blast intro: LeadsTo_weaken_L progress nat_into_Ord)\ndone\n\n(*Third step in proof of (31): by PSP with the fact that giv increases *)\nlemma (in alloc_progress) length_giv_disj:\n \"\\k \\ tokbag; n \\ nat\\\n \\ alloc_prog \\ G \\\n {s\\state. length(s`giv) = n \\ tokens(s`giv) = k}\n \\w\n {s\\state. (length(s`giv) = n \\ tokens(s`giv) = k \\\n k \\ tokens(take(s`NbR, s`rel))) | n < length(s`giv)}\"\napply (rule single_LeadsTo_I, safe)\napply (rule_tac a1 = \"s`giv\" in Increasing_imp_Stable [THEN PSP_StableI])\napply (rule alloc_prog_Increasing_giv [THEN guaranteesD])\napply (simp_all add: Int_cons_left)\napply (rule LeadsTo_weaken)\napply (rule_tac k = \"tokens(s`giv)\" in tokens_take_NbR_lemma2)\napply auto\napply (force dest: prefix_length_le [THEN le_iff [THEN iffD1]]) \napply (simp add: not_lt_iff_le)\napply (force dest: prefix_length_le_equal) \ndone\n\n(*Fourth step in proof of (31): we apply lemma (51) *)\nlemma (in alloc_progress) length_giv_disj2:\n \"\\k \\ tokbag; n \\ nat\\\n \\ alloc_prog \\ G \\\n {s\\state. length(s`giv) = n \\ tokens(s`giv) = k}\n \\w\n {s\\state. (length(s`giv) = n \\ NbT \\ s`available_tok) |\n n < length(s`giv)}\"\napply (rule LeadsTo_weaken_R)\napply (rule Always_LeadsToD [OF alloc_prog_Always_lemma length_giv_disj], auto)\ndone\n\n(*Fifth step in proof of (31): from the fourth step, taking the union over all\n k\\nat *)\nlemma (in alloc_progress) length_giv_disj3:\n \"n \\ nat\n \\ alloc_prog \\ G \\\n {s\\state. length(s`giv) = n}\n \\w\n {s\\state. (length(s`giv) = n \\ NbT \\ s`available_tok) |\n n < length(s`giv)}\"\napply (rule LeadsTo_weaken_L)\napply (rule_tac I = nat in LeadsTo_UN)\napply (rule_tac k = i in length_giv_disj2)\napply (simp_all add: UN_conj_eq)\ndone\n\n(*Sixth step in proof of (31): from the fifth step, by PSP with the\n assumption that ask increases *)\nlemma (in alloc_progress) length_ask_giv:\n \"\\k \\ nat; n < k\\\n \\ alloc_prog \\ G \\\n {s\\state. length(s`ask) = k \\ length(s`giv) = n}\n \\w\n {s\\state. (NbT \\ s`available_tok \\ length(s`giv) < length(s`ask) \\\n length(s`giv) = n) |\n n < length(s`giv)}\"\napply (rule single_LeadsTo_I, safe)\napply (rule_tac a1 = \"s`ask\" and f1 = \"lift(ask)\" \n in Increasing_imp_Stable [THEN PSP_StableI])\napply (rule Incr_ask, simp_all)\napply (rule LeadsTo_weaken)\napply (rule_tac n = \"length(s ` giv)\" in length_giv_disj3)\napply simp_all\napply blast\napply clarify\napply simp\napply (blast dest!: prefix_length_le intro: lt_trans2)\ndone\n\n\n(*Seventh step in proof of (31): no request (ask[k]) exceeds NbT *)\nlemma (in alloc_progress) length_ask_giv2:\n \"\\k \\ nat; n < k\\\n \\ alloc_prog \\ G \\\n {s\\state. length(s`ask) = k \\ length(s`giv) = n}\n \\w\n {s\\state. (nth(length(s`giv), s`ask) \\ s`available_tok \\\n length(s`giv) < length(s`ask) \\ length(s`giv) = n) |\n n < length(s`giv)}\"\napply (rule LeadsTo_weaken_R)\napply (rule Always_LeadsToD [OF safety length_ask_giv], assumption+, clarify)\napply (simp add: INT_iff)\napply (drule_tac x = \"length(x ` giv)\" and P = \"\\x. f (x) \\ NbT\" for f in bspec)\napply simp\napply (blast intro: le_trans)\ndone\n\n(*Eighth step in proof of (31): by 50, we get |giv| > n. *)\nlemma (in alloc_progress) extend_giv:\n \"\\k \\ nat; n < k\\\n \\ alloc_prog \\ G \\\n {s\\state. length(s`ask) = k \\ length(s`giv) = n}\n \\w {s\\state. n < length(s`giv)}\"\napply (rule LeadsTo_Un_duplicate)\napply (rule LeadsTo_cancel1)\napply (rule_tac [2] alloc_prog_giv_LeadsTo_lemma)\napply (simp_all add: Incr_ask lt_nat_in_nat)\napply (rule LeadsTo_weaken_R)\napply (rule length_ask_giv2, auto)\ndone\n\n(*Ninth and tenth steps in proof of (31): by 50, we get |giv| > n.\n The report has an error: putting |ask|=k for the precondition fails because\n we can't expect |ask| to remain fixed until |giv| increases.*)\nlemma (in alloc_progress) alloc_prog_ask_LeadsTo_giv:\n \"k \\ nat\n \\ alloc_prog \\ G \\\n {s\\state. k \\ length(s`ask)} \\w {s\\state. k \\ length(s`giv)}\"\n(* Proof by induction over the difference between k and n *)\napply (rule_tac f = \"\\s\\state. k #- length(s`giv)\" in LessThan_induct)\napply (auto simp add: lam_def Collect_vimage_eq)\napply (rule single_LeadsTo_I, auto)\napply (rename_tac \"s0\")\napply (case_tac \"length(s0 ` giv) < length(s0 ` ask) \")\n apply (rule_tac [2] subset_imp_LeadsTo)\n apply (auto simp add: not_lt_iff_le)\n prefer 2 apply (blast dest: le_imp_not_lt intro: lt_trans2)\napply (rule_tac a1 = \"s0`ask\" and f1 = \"lift (ask)\"\n in Increasing_imp_Stable [THEN PSP_StableI])\napply (rule Incr_ask, simp)\napply (force)\napply (rule LeadsTo_weaken)\napply (rule_tac n = \"length(s0 ` giv)\" and k = \"length(s0 ` ask)\"\n in extend_giv) \napply (auto dest: not_lt_imp_le simp add: leI diff_lt_iff_lt) \napply (blast dest!: prefix_length_le intro: lt_trans2)\ndone\n\n(*Final lemma: combine previous result with lemma (30)*)\nlemma (in alloc_progress) final:\n \"h \\ list(tokbag)\n \\ alloc_prog \\ G\n \\ {s\\state. \\ prefix(tokbag)} \\w\n {s\\state. \\ prefix(tokbag)}\"\napply (rule single_LeadsTo_I)\n prefer 2 apply simp\napply (rename_tac s0)\napply (rule_tac a1 = \"s0`ask\" and f1 = \"lift (ask)\"\n in Increasing_imp_Stable [THEN PSP_StableI])\n apply (rule Incr_ask)\n apply (simp_all add: Int_cons_left)\napply (rule LeadsTo_weaken)\napply (rule_tac k1 = \"length(s0 ` ask)\"\n in Always_LeadsToD [OF alloc_prog_ask_prefix_giv [THEN guaranteesD]\n alloc_prog_ask_LeadsTo_giv])\napply (auto simp add: Incr_ask)\napply (blast intro: length_le_prefix_imp_prefix prefix_trans prefix_length_le \n lt_trans2)\ndone\n\n(** alloc_prog liveness property (31), page 18 **)\n\ntheorem alloc_prog_progress:\n\"alloc_prog \\\n Incr(lift(ask)) \\ Incr(lift(rel)) \\\n Always(\\k \\ nat. {s\\state. nth(k, s`ask) \\ NbT}) \\\n (\\k\\nat. {s\\state. k \\ tokens(s`giv)} \\w\n {s\\state. k \\ tokens(s`rel)})\n guarantees (\\h \\ list(tokbag).\n {s\\state. \\ prefix(tokbag)} \\w\n {s\\state. \\ prefix(tokbag)})\"\napply (rule guaranteesI)\napply (rule INT_I)\napply (rule alloc_progress.final)\napply (auto simp add: alloc_progress_def)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/UNITY/AllocImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.66192288918838, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2821920202624261}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Memcpy\nimports\n \"CParser.CTranslation\"\n \"AutoCorres.AutoCorres\"\nbegin\n\nabbreviation \"ADDR_MAX \\ UWORD_MAX TYPE(addr_bitsize)\"\n\n(* Helper for noticing when you accidentally haven't constrained an of_nat *)\nabbreviation \"of_nat_addr \\ of_nat::(nat \\ addr)\"\n\nlemma byte_ptr_guarded:\n \"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc)\n\n(* FIXME: MOVE *)\nlemma ptr_add_coerce: \"ptr_val (((ptr_coerce x)::('a::{c_type}) ptr) +\\<^sub>p a) = (ptr_val x) + (of_int a * of_nat (size_of TYPE('a)))\"\n apply (case_tac x)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n done\n\n(* FIXME: MOVE *)\n(* Casting a valid pointer to char* and incrementing it by a value less than\n * the size of the underlying type does not give us NULL.\n *)\nlemma ptr_contained:\"\\ c_guard (x::('a::c_type) ptr); size_of TYPE('a) = sz;\n 0 \\ i; i < int sz; (y::8 word ptr) = ptr_coerce x\\ \\ c_guard (y +\\<^sub>p i)\"\n apply (rule byte_ptr_guarded)\n unfolding c_guard_def c_null_guard_def ptr_add_def\n apply simp\n apply (clarsimp simp: CTypesDefs.ptr_add_def intvl_def)\n apply (erule allE [where x=\"nat i\"])\n apply (clarsimp simp: nat_less_iff)\n done\n\nexternal_file \"memcpy.c\"\ninstall_C_file \"memcpy.c\"\n\n(* FIXME: MOVE *)\nlemma squash_auxupd_id[polish]:\n \"modify (t_hrs_'_update (hrs_htd_update id)) = skip\"\n by (monad_eq simp: skip_def id_def hrs_htd_update_def)\n\nautocorres [no_heap_abs=memcpy memcpy_int] \"memcpy.c\"\n\n(* Dereference a pointer *)\nabbreviation \"deref s x \\ h_val (hrs_mem (t_hrs_' s)) x\"\n\n(* char* cast *)\nabbreviation \"byte_cast x \\ ((ptr_coerce x)::8 word ptr)\"\n\ncontext memcpy begin\n\nlemma memcpy_char:\n \"\\ \\s. c_guard (x::8 word ptr) \\\n c_guard (y::8 word ptr) \\\n unat sz = size_of TYPE(8 word) \\\n P (deref s x) \\\n x \\ y\\\n memcpy' (ptr_coerce y) (ptr_coerce x) sz\n \\\\ _ s. P (deref s y) \\!\"\n (* Evaluate sz *)\n apply clarsimp\n\n unfolding memcpy'_def\n apply (clarsimp simp:skip_def)\n apply wp\n\n (* Unroll the loop twice *)\n apply (subst whileLoop_unroll, wp)\n apply (subst whileLoop_unroll, wp)\n\n (* The remaining loop is never encountered *)\n apply (rule validNF_false_pre)\n apply wp+\n\n (* Finally we're left with the single assignment *)\n apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n apply unat_arith\n done\n\nlemma of_nat_prop_exp: \"n < 32 \\ of_nat (2 ^ n) = 2 ^ (of_nat n)\"\n by clarsimp\n\nlemma memcpy_word:\n \"\\ \\s. c_guard (x::32 word ptr) \\\n c_guard (y::32 word ptr) \\\n unat sz = size_of TYPE(32 word) \\\n P (deref s x) \\\n x \\ y \\\n memcpy' (ptr_coerce y) (ptr_coerce x) sz\n \\ \\_ s. P (deref s y) \\!\"\n apply clarsimp\n unfolding memcpy'_def apply (clarsimp simp:skip_def)\n apply (rule validNF_assume_pre)\n apply (subgoal_tac \"{ptr_val x ..+ unat sz} \\ {ptr_val y ..+ unat sz} = {}\")\n apply (subst whileLoop_add_inv [where\n I=\"\\i s. unat i \\ unat sz \\\n (\\a < i. deref s (byte_cast x +\\<^sub>p uint a) = deref s (byte_cast y +\\<^sub>p uint a)) \\\n P (deref s x)\" and\n M=\"\\(i, s). unat sz - unat i\"])\n apply (wp validNF_whileLoop_inv_measure_twosteps)\n apply clarsimp\n apply (rule conjI, unat_arith)\n apply (rule conjI, clarsimp)\n apply (case_tac \"a = i\")\n apply (clarsimp)\n apply (erule_tac x=i in allE)\n apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n apply (subst h_val_heap_same)\n apply (rule ptr_retyp_h_t_valid)\n apply simp\n apply (rule ptr_retyp_disjoint)\n apply (rule ptr_retyp_h_t_valid)\n apply simp\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply simp\n apply (clarsimp simp: CTypesDefs.ptr_add_def field_of_t_simple)\n apply (drule field_of_t_simple)\n apply clarsimp\n apply simp\n apply (subgoal_tac \"a < i\")\n apply (clarsimp simp:hrs_mem_update)\n apply (subst h_val_heap_update_disjoint)\n\n (* The current goal should be obvious to unat_arith, but for some reason isn't *)\n apply (clarsimp simp:ptr_add_def intvl_def disjoint_iff_not_equal)\n apply (erule_tac x=\"ptr_val x + a\" in allE, clarsimp)\n apply (erule impE)\n apply (rule_tac x=\"unat a\" in exI, clarsimp)\n apply unat_arith\n\n apply (erule_tac x=\"ptr_val y + i\" and\n P=\"\\ya. (\\k. ya = ptr_val y + of_nat k \\ k < 4) \\ ptr_val y + i \\ ya\" in allE, clarsimp)\n apply (erule_tac x=\"unat i\" in allE, clarsimp)\n apply unat_arith\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply (subst h_val_heap_update_disjoint)\n (* Similar goal to the previous irritation, but this time Isabelle decides to play ball *)\n apply (clarsimp simp:ptr_add_def intvl_def disjoint_iff_not_equal)\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply (clarsimp simp:CTypesDefs.ptr_add_def)\n apply unat_arith\n\n apply (rule conjI)\n apply (subst hrs_mem_update)+\n apply (subst h_val_heap_update_disjoint)\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply (clarsimp simp:CTypesDefs.ptr_add_def intvl_def)\n apply (erule_tac x=\"ptr_val x + of_nat k\" in allE)\n apply (erule impE)\n apply (rule_tac x=\"k\" in exI)\n apply simp\n apply (erule_tac x=\"ptr_val y + i\" and\n P=\"\\ya. (\\k. ya = ptr_val y + of_nat k \\ k < 4) \\ ptr_val x + of_nat k \\ ya\" in allE)\n apply (erule impE)\n apply (rule_tac x=\"unat i\" in exI)\n apply simp\n apply unat_arith\n apply simp\n apply simp\n\n (* Yet more tedium that unat_arith doesn't like *)\n apply (rule conjI)\n apply (rule byte_ptr_guarded,\n clarsimp simp:CTypesDefs.ptr_add_def c_guard_def c_null_guard_def intvl_def,\n (erule_tac x=\"unat i\" in allE)+,\n clarsimp,\n unat_arith)+\n\n apply wp\n apply unat_arith\n apply clarsimp\n apply (subgoal_tac \"deref sa x = deref sa y\")\n apply clarsimp\n apply (clarsimp simp: h_val_def)[1]\n apply (rule arg_cong[where f=from_bytes])\n apply (simp add: numeral_nat)\n apply (rule_tac x=0 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=1 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=2 in allE, assumption, erule impE, unat_arith)\n apply (rule_tac x=3 in allE, assumption, erule impE, unat_arith)\n apply (simp add:CTypesDefs.ptr_add_def)\n apply (simp add: add.commute from_bytes_eq)\n apply clarsimp\n apply (clarsimp simp:intvl_def disjoint_iff_not_equal)\n apply (drule_tac x=x and y=y and j=\"of_nat k\" and i=\"of_nat ka\" and n=2 in neq_imp_bytes_disjoint)\n apply assumption\n apply (case_tac \"k = 0\", clarsimp) (* insert \"k > 0\" *)\n apply (clarsimp simp:unat_of_nat_len)\n apply (case_tac \"ka = 0\", clarsimp)\n apply (clarsimp simp:unat_of_nat_len)\n apply assumption\n apply clarsimp+\n done\n\ntext \\The bytes at the pointer @{term p} are @{term bs}.\\\ndefinition\n bytes_at :: \"'a globals_scheme \\ 'b::c_type ptr \\ word8 list \\ bool\"\nwhere\n \"bytes_at s p bs \\ length bs = 0 \\\n (length bs \\ ADDR_MAX \\ (\\i \\ {0..(length bs - 1)}. deref s (byte_cast p +\\<^sub>p (of_nat i)) = bs ! i))\"\n\nlemma bytes_at_none[simp]: \"bytes_at s p []\"\n by (clarsimp simp:bytes_at_def)\n\ntext \\The bytes of typed pointer @{term p} are @{term bs}.\\\ndefinition\n bytes_of :: \"'a globals_scheme \\ 'b::c_type ptr \\ word8 list \\ bool\"\nwhere\n \"bytes_of s p bs \\ length bs = size_of TYPE('b) \\ bytes_at s p bs\"\n\ntext \\The bytes at a char pointer are just it dereferenced.\\\nlemma bytes_of_char[simp]: \"bytes_of s (p::8word ptr) bs = (length bs = 1 \\ deref s p = hd bs)\"\n apply (clarsimp simp:bytes_of_def bytes_at_def)\n apply (rule iffI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp+\n apply (rule hd_conv_nth[symmetric])\n apply clarsimp+\n apply (subgoal_tac \"hd bs = bs ! 0\")\n apply simp\n apply (rule hd_conv_nth)\n apply clarsimp\n done\n\ntext \\A pointer does not wrap around memory.\\\ndefinition\n no_wrap :: \"'a::c_type ptr \\ nat \\ bool\"\nwhere\n \"no_wrap p sz \\ 0 \\ {ptr_val p ..+ sz}\"\n\ntext \\Two pointers do not overlap.\\\ndefinition\n no_overlap :: \"'a::c_type ptr \\ 'b::c_type ptr \\ nat \\ bool\"\nwhere\n \"no_overlap p q sz \\ {ptr_val p ..+ sz} \\ {ptr_val q ..+ sz} = {}\"\n\nlemma no_overlap_sym: \"no_overlap x y = no_overlap y x\"\n apply (rule ext)\n apply (clarsimp simp:no_overlap_def)\n by blast\n\n(* FIXME: MOVE *)\nlemma h_val_not_id:\n fixes x :: \"'a::mem_type ptr\"\n and y :: \"'b::mem_type ptr\"\n shows \"{ptr_val x..+size_of TYPE('a)} \\ {ptr_val y..+size_of TYPE('b)} = {}\n \\ h_val (hrs_mem (hrs_mem_update (heap_update x v) s)) y = h_val (hrs_mem s) y\"\n apply (subst hrs_mem_heap_update[symmetric])\n apply (subst h_val_heap_update_disjoint)\n apply blast\n apply clarsimp\n done\n\ndefinition\n update_bytes :: \"'a globals_scheme \\ 'b::mem_type ptr \\ word8 list \\ 'a globals_scheme\"\nwhere\n \"update_bytes s p bs \\ s\\t_hrs_' := hrs_mem_update (heap_update_list (ptr_val p) bs) (t_hrs_' s)\\\"\n\nlemma the_horse_says_neigh: \"(s\\t_hrs_' := x\\ = s\\t_hrs_' := y\\) = (x = y)\"\n by (metis (erased, lifting) globals.cases_scheme globals.select_convs(1) globals.update_convs(1))\n\nlemma upto_singleton[simp]:\"[x..x] = [x]\"\n by (simp add: upto_rec1)\n\nlemma update_bytes_ignore_ptr_coerce[simp]: \"update_bytes s (ptr_coerce p) = update_bytes s p\"\n by (auto simp:update_bytes_def)\n\nlemma hrs_mem_update_commute:\n \"f \\ g = g \\ f \\ hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update g (hrs_mem_update f s)\"\n by (metis (no_types, lifting) comp_eq_elim hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma hrs_mem_update_collapse:\n \"hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update (f \\ g) s\"\n by (metis comp_eq_dest_lhs hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma update_bytes_reorder:\n \"{ptr_val p..+length cs} \\ {ptr_val q..+length bs} = {} \\\n update_bytes (update_bytes s q bs) p cs = update_bytes (update_bytes s p cs) q bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (subst hrs_mem_update_commute)\n apply (rule ext)\n apply clarsimp\n apply (subst heap_update_list_commute)\n apply clarsimp+\n done\n\nlemma lt_step_down: \"\\(x::nat) < y; x = y - 1 \\ P; x < y - 1 \\ P\\ \\ P\"\n by force\n\n(* XXX: This proof makes me sad. *)\nlemma under_uint_imp_no_overflow: \"x < ADDR_MAX \\ ((of_nat x)::addr) + 1 \\ 0\"\n apply (induct x)\n apply (clarsimp simp:UWORD_MAX_def)+\n apply unat_arith\n apply (clarsimp simp:UWORD_MAX_def)\n apply (cut_tac y=x and z=\"(of_nat (ADDR_MAX - 1))::addr\" in le_unat_uoi)\n apply (clarsimp simp:UWORD_MAX_def)+\n done\n\nlemma heap_update_list_append3:\n \"1 + length ys < 2 ^ word_bits \\\n heap_update_list s (y # ys) hp = heap_update_list s [y] (heap_update_list (s + 1) ys hp)\"\n apply clarsimp\n apply (subst heap_update_list_append2[where xs=\"[y]\", simplified])\n apply clarsimp+\n done\n\nlemma hrs_mem_update_cong': \"f = g \\ hrs_mem_update f s = hrs_mem_update g s\"\n by presburger\n\nlemma update_bytes_append: \"length bs \\ ADDR_MAX \\\n update_bytes s p (b # bs) = update_bytes (update_bytes s p [b]) (byte_cast p +\\<^sub>p 1) bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (subst hrs_mem_update_commute)\n apply (rule ext)+\n apply simp\n apply (case_tac \"xa = ptr_val p\")\n apply (clarsimp simp:fun_upd_def)\n apply (subst heap_update_nmem_same)\n apply (clarsimp simp:intvl_def ptr_add_def)\n apply (subgoal_tac \"k < ADDR_MAX\")\n prefer 2\n apply unat_arith\n apply (drule under_uint_imp_no_overflow)\n apply unat_arith\n apply clarsimp\n apply (subst heap_update_list_update)\n apply simp\n apply (clarsimp simp:fun_upd_def)\n apply (subst hrs_mem_update_collapse)\n apply (rule hrs_mem_update_cong')\n apply (clarsimp simp:ptr_add_def)\n apply (rule ext)\n apply (cut_tac xs=\"[b]\" and ys=bs and s=\"ptr_val p\" and hp=x in heap_update_list_append)\n apply (rule ext)\n apply (clarsimp simp:fun_upd_def)\n apply (rule conjI)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (subgoal_tac \"k < ADDR_MAX\")\n prefer 2\n apply unat_arith\n apply (drule under_uint_imp_no_overflow)\n apply unat_arith\n apply clarsimp\n apply clarsimp\n apply (case_tac \"xa \\ {ptr_val p + 1..+length bs}\")\n apply (subst heap_update_mem_same_point)\n apply simp\n apply (subgoal_tac \"addr_card = ADDR_MAX + 1\")\n apply clarsimp\n apply (clarsimp simp:addr_card UWORD_MAX_def)\n apply (subst heap_update_mem_same_point)\n apply simp\n apply (subgoal_tac \"addr_card = ADDR_MAX + 1\")\n apply clarsimp\n apply (clarsimp simp:addr_card UWORD_MAX_def)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply clarsimp\n apply (subst heap_update_nmem_same)\n apply clarsimp+\n done\n\nlemma update_bytes_postpend: \"length bs = x + 1 \\\n update_bytes s p bs = update_bytes (update_bytes s p (take x bs)) (byte_cast p +\\<^sub>p (of_nat x)) [bs ! x]\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst the_horse_says_neigh)\n apply (clarsimp simp:ptr_add_def)\n apply (subst heap_update_list_concat_fold_hrs_mem)\n apply clarsimp+\n apply (metis append.right_neutral append_eq_conv_conj lessI take_Suc_conv_app_nth)\n done\n\nlemma h_val_not_id_general:\n fixes y :: \"'a::mem_type ptr\"\n shows \"\\i \\ {0..+size_of TYPE('a)}. \\g. f g (ptr_val y + i) = g (ptr_val y + i)\n \\ h_val (hrs_mem (hrs_mem_update f s)) y = h_val (hrs_mem s) y\"\n apply (subst hrs_mem_update)\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (f (hrs_mem s)) (size_of TYPE('a)) (ptr_val y) =\n heap_list (hrs_mem s) (size_of TYPE('a)) (ptr_val y)\")\n apply clarsimp\n apply (cut_tac h=\"f (hrs_mem s)\" and p=\"ptr_val y\" and n=\"size_of TYPE('a)\"\n and h'=\"hrs_mem s\" in heap_list_h_eq2)\n apply (erule_tac x=\"x - ptr_val y\" in ballE)\n apply clarsimp\n apply (clarsimp simp:intvl_def)+\n done\n\nlemma h_val_not_id_list:\n fixes y :: \"'a::mem_type ptr\"\n shows \"{x..+length vs} \\ {ptr_val y..+size_of TYPE('a)} = {}\n \\ h_val (hrs_mem (hrs_mem_update (heap_update_list x vs) s)) y = h_val (hrs_mem s) y\"\n apply (subst h_val_not_id_general)\n apply clarsimp\n apply (metis (erased, opaque_lifting) disjoint_iff_not_equal heap_update_nmem_same intvlD intvlI\n monoid_add_class.add.left_neutral)\n apply clarsimp\n done\n\nlemma h_val_id_update_bytes:\n fixes q :: \"'a::mem_type ptr\"\n shows \"{ptr_val q..+size_of TYPE('a)} \\ {ptr_val p..+length bs} = {}\n \\ deref (update_bytes s p bs) q = deref s q\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst h_val_not_id_list)\n apply blast\n by simp\n\nlemma bytes_at_len: \"bytes_at s p bs \\ length bs \\ ADDR_MAX\"\n by (clarsimp simp:bytes_at_def, fastforce)\n\n(* Another sad proof. *)\nlemma le_uint_max_imp_id: \"x \\ ADDR_MAX \\ unat ((of_nat x)::addr) = x\"\n apply (induct x)\n apply (clarsimp simp: UWORD_MAX_def)+\n apply unat_arith\n apply clarsimp\n done\n\nlemma update_bytes_id: \"update_bytes s p [] = s\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst heap_update_list_base')\n by (simp add: hrs_mem_update_id3)\n\nlemma a_horse_by_any_other_name: \"t_hrs_'_update f s = s\\t_hrs_' := f (t_hrs_' s)\\\"\n by auto\n\nlemma heap_update_list_singleton: \"heap_update_list p [x] = heap_update (Ptr p) x\"\n apply (rule ext)\n by (metis heap_update_def ptr_val.simps to_bytes_word8)\n\nlemma update_bytes_eq: \"\\s = s'; p = p'; bs = bs'\\ \\ update_bytes s p bs = update_bytes s' p' bs'\"\n by clarsimp\n\ntext \\\n Memcpy does what it says on the box.\n\\\nlemma memcpy_wp':\n fixes src :: \"'a::mem_type ptr\"\n and dst :: \"'b::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ c_guard src \\ c_guard dst \\ sz = of_nat (length bs) \\ bytes_at s src bs \\\n no_wrap src (unat sz) \\ no_wrap dst (unat sz) \\ no_overlap src dst (unat sz)\\\n memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n \\\\r s. r = ptr_coerce dst \\ bytes_at s dst bs \\ s = update_bytes s0 dst bs\\!\"\n apply (rule allI)+\n apply (rule validNF_assume_pre)\n unfolding memcpy'_def\n apply clarsimp\n apply (subst whileLoop_add_inv[where\n I=\"\\i s. unat i \\ unat sz \\\n bytes_at s dst (take (unat i) bs) \\\n bytes_at s src bs \\\n s = update_bytes s0 dst (take (unat i) bs)\" and\n M=\"\\(i, s). unat sz - unat i\"])\n apply wp\n apply clarsimp\n apply (rule conjI)\n apply unat_arith\n apply (rule conjI)\n apply (simp add:bytes_at_def)\n apply (case_tac \"bs = []\")\n apply (rule disjI1)\n apply clarsimp\n apply (rule disjI2)\n apply clarsimp\n apply (rule conjI)\n apply unat_arith\n apply clarsimp\n apply (case_tac \"unat i = ia\")\n apply clarsimp\n apply (subgoal_tac \"int (unat i) = uint i\")\n prefer 2\n apply (subst uint_nat)\n apply simp\n apply simp\n apply (subst h_val_id)\n apply (subst h_val_id_update_bytes)\n apply (clarsimp simp:no_overlap_def ptr_add_def)\n apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\ {ptr_val src..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply unat_arith\n apply (subgoal_tac \"{ptr_val dst..+unat i} \\ {ptr_val dst..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule exI, rule conjI, rule refl)\n apply (simp add: unat_of_nat)\n apply blast\n apply (erule_tac x=\"unat i\" and P=\"\\x. deref s0 (byte_cast src +\\<^sub>p int x) = bs ! x\" in ballE)\n apply clarsimp\n apply (subst nth_take)\n apply unat_arith\n apply simp\n apply (erule disjE)\n apply clarsimp+\n apply (erule disjE)\n apply (subgoal_tac \"length bs \\ 0\")\n prefer 2\n apply clarsimp\n apply (case_tac \"unat i = 0\")\n apply unat_arith\n apply linarith\n apply (subst h_val_not_id)\n apply (clarsimp simp:ptr_add_def intvl_def)\n (* Isabelle, why do you have to make it so hard? *)\n apply (erule_tac P=\"unat (of_nat ia) = ia\" in notE)\n apply (cut_tac y=ia and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (subgoal_tac \"unat ((of_nat ADDR_MAX)::addr) = ADDR_MAX\")\n prefer 2\n apply (simp add: unat_of_nat)\n apply (simp add: unat_of_nat)\n apply clarsimp\n apply clarsimp\n apply (erule_tac x=ia and A=\"{0..min (length bs) (unat i) - Suc 0}\" in ballE)\n apply clarsimp\n apply (subst nth_take, unat_arith)+\n apply simp\n apply clarsimp\n apply unat_arith\n apply (rule conjI)\n apply (clarsimp simp:bytes_at_def)\n apply (subst h_val_not_id)\n apply (clarsimp simp:no_overlap_def)\n apply (subgoal_tac \"ptr_val (byte_cast dst +\\<^sub>p uint i) \\ {ptr_val dst..+unat (of_nat (length bs))}\")\n prefer 2\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply clarsimp\n apply unat_arith\n (* More or less symmetric subgoal *)\n apply (subgoal_tac \"ptr_val (byte_cast src +\\<^sub>p int ia) \\ {ptr_val src..+unat ((of_nat (length bs))::addr)}\")\n prefer 2\n apply (clarsimp simp:ptr_add_def intvl_def)\n apply (rule_tac x=ia in exI)\n apply clarsimp\n apply (subgoal_tac \"unat ((of_nat (length bs))::addr) = length bs\")\n apply clarsimp\n apply arith\n apply (cut_tac y=\"length bs\" and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (simp add: unat_of_nat)\n apply arith\n apply (clarsimp simp:intvl_def ptr_add_def)\n apply blast\n apply clarsimp\n apply (rule conjI)\n apply (subst h_val_id_update_bytes)\n apply (clarsimp simp:no_overlap_def ptr_add_def)\n apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\ {ptr_val src..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=\"unat i\" in exI)\n apply unat_arith\n apply (subgoal_tac \"{ptr_val dst..+min (length bs) (unat i)} \\ {ptr_val dst..+unat (of_nat_addr (length bs))}\")\n prefer 2\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x=ka in exI)\n apply unat_arith\n apply blast\n apply (subgoal_tac \"deref s0 (byte_cast src +\\<^sub>p uint i) = bs ! (unat i)\")\n apply clarsimp\n apply (subgoal_tac \"update_bytes s0 dst (take (unat (i + 1)) bs) =\n update_bytes (update_bytes s0 dst (take (unat i) bs)) (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n apply clarsimp\n apply (subgoal_tac\n \"\\s'. t_hrs_'_update (hrs_mem_update (heap_update (byte_cast dst +\\<^sub>p uint i) (bs ! unat i))) s' =\n update_bytes s' (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n apply fast\n apply (clarsimp simp:update_bytes_def)\n apply (subst a_horse_by_any_other_name)\n apply (subst the_horse_says_neigh)\n apply (clarsimp simp:ptr_add_def)\n apply (subst heap_update_list_singleton)\n apply simp\n apply (cut_tac s=s0 and p=dst and bs=\"take (unat (i + 1)) bs\" and x=\"unat i\"\n in update_bytes_postpend)\n apply (subgoal_tac \"unat (i + 1) \\ length bs\")\n apply clarsimp\n apply unat_arith\n apply (subgoal_tac \"unat i < length bs\")\n apply unat_arith\n apply (rule unat_less_helper)\n apply simp\n apply clarsimp\n apply (rule update_bytes_eq)\n apply (subgoal_tac \"min (unat i) (unat (i + 1)) = unat i\")\n apply presburger\n apply unat_arith\n apply (clarsimp simp:ptr_add_def)\n apply clarsimp\n apply (rule nth_take)\n apply unat_arith\n apply (clarsimp simp:bytes_at_def)\n apply (erule disjE)\n apply clarsimp\n apply clarsimp\n apply (erule_tac x=\"unat i\" in ballE)\n apply (subst (asm) uint_nat[symmetric])\n apply simp\n apply clarsimp\n apply (subgoal_tac \"unat i < length bs\")\n prefer 2\n apply (rule unat_less_helper)\n apply simp\n apply unat_arith\n apply (rule conjI)\n apply unat_arith\n apply (rule conjI)\n apply (rule byte_ptr_guarded)\n apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n apply (erule_tac x=\"unat i\" in allE)\n apply clarsimp\n apply (rule byte_ptr_guarded)\n apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n apply (erule_tac x=\"unat i\" and\n P=\"\\x. ptr_val dst + ((of_nat x)::addr) = 0 \\ \\ x < unat ((of_nat_addr (length bs))::addr)\"\n in allE)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (subgoal_tac \"unat i = length bs\")\n apply clarsimp\n apply (case_tac \"length bs = 0\")\n apply clarsimp\n apply (subgoal_tac \"length bs \\ ADDR_MAX\")\n prefer 2\n apply (clarsimp simp:bytes_at_def)\n (* XXX: We keep introducing this subgoal; we should do it once and for all up top. *)\n apply (subgoal_tac \"unat ((of_nat (length bs))::addr) = length bs\")\n prefer 2\n apply (cut_tac y=\"length bs\" and z=\"(of_nat ADDR_MAX)::addr\" in le_unat_uoi)\n apply (clarsimp simp:UWORD_MAX_def)\n apply clarsimp+\n apply unat_arith\n (* insert a bunch a tedium... *)\n apply (subgoal_tac \"unat i = length bs\")\n prefer 2\n apply (drule bytes_at_len)\n apply (subgoal_tac \"unat (of_nat_addr (length bs)) = length bs\")\n prefer 2\n apply (rule le_uint_max_imp_id)\n apply simp\n apply unat_arith\n apply clarsimp\n apply (simp add:update_bytes_id)\n done\n\nlemma validNF_make_schematic_post':\n \"(\\s0 x. \\ \\s. P s0 x s \\ f \\ \\rv s. Q s0 x rv s \\!) \\\n \\ \\s. \\s0 x. P s0 x s \\ (\\rv s'. Q s0 x rv s' \\ Q' rv s') \\ f \\ Q'\\!\"\n by (auto simp add: valid_def validNF_def no_fail_def split: prod.splits)\n\nlemmas memcpy_wp = memcpy_wp'[THEN validNF_make_schematic_post', simplified]\n\nlemma h_val_not_id_update_bytes:\n fixes q :: \"'a::mem_type ptr\"\n shows \"\\ptr_val p = ptr_val q; length bs = size_of TYPE('a)\\ \\\n deref (update_bytes s p bs) q = from_bytes bs\"\n apply (clarsimp simp:update_bytes_def h_val_def)\n apply (subst hrs_mem_update)\n apply (cut_tac p=\"ptr_val q\" and v=bs and h=\"hrs_mem (t_hrs_' s)\" in heap_list_update)\n apply clarsimp\n apply (metis less_imp_le max_size)\n by clarsimp\n\ntext \\\n Test that we can use memcpy in a compositional proof. The following proof can be done much more\n pleasantly, but we're just trying to check that the memcpy WP lemma is usable.\n TODO: This relies on disabling heap abstraction for the calling function as well. We should be\n able to phrase an exec_concrete WP lemma over memcpy that lets us prove properties about\n heap-abstracted callers. This will need AutoCorres support to connect is_valid_* with\n c_guard/no_overlap/no_wrap.\n\\\n\ndefinition\n memcpy_int_spec :: \"sword32 ptr \\ sword32 ptr \\ bool\"\nwhere\n \"memcpy_int_spec dst src \\\n \\x. \\\\s. deref s src = x \\\n {ptr_val src..+4} \\ {ptr_val dst..+4} = {} \\\n c_guard src \\ c_guard dst \\\n no_wrap src 4 \\ no_wrap dst 4\\\n memcpy_int' dst src\n \\\\_ s. deref s dst = x\\!\"\n\nlemma memcpy_int_wp'[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def\n apply (rule allI)\n unfolding memcpy_int'_def\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=\"[deref s (byte_cast src),\n deref s (byte_cast src +\\<^sub>p 1),\n deref s (byte_cast src +\\<^sub>p 2),\n deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n apply (clarsimp simp:bytes_at_def no_overlap_def UINT_MAX_def)\n apply (rule conjI)\n apply clarsimp\n apply (case_tac \"i = 0\", clarsimp)\n apply (case_tac \"i = 1\", clarsimp)\n apply (case_tac \"i = 2\", clarsimp)\n apply (case_tac \"i = 3\", clarsimp)\n apply clarsimp\n apply clarsimp\n apply (subst h_val_not_id_update_bytes)\n apply clarsimp+\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) =\n deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n prefer 2\n apply (clarsimp simp:h_val_def)\n apply (metis Suc_numeral from_bytes_eq heap_list_rec semiring_norm(2) semiring_norm(8))\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) =\n deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n prefer 2\n apply (clarsimp simp:h_val_def ptr_add_def)\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n apply clarsimp\n apply (simp add: add.commute from_bytes_eq)\n apply clarsimp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) =\n deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n prefer 2\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n apply (metis (no_types) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n done\n\ntext \\memcpying a typed variable is equivalent to assignment.\\\nlemma memcpy_type_wp':\n fixes dst :: \"'a::mem_type ptr\"\n and src :: \"'a::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ c_guard dst \\ c_guard src \\ sz = of_nat (size_of TYPE('a)) \\\n no_overlap dst src (unat sz) \\ no_wrap dst (unat sz) \\ no_wrap src (unat sz) \\\n bytes_of s src bs\\\n memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n \\\\r s. r = ptr_coerce dst \\ bytes_of s dst bs \\ s = update_bytes s0 dst bs\\!\"\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply clarsimp\n apply (subst no_overlap_sym)\n apply (clarsimp simp:bytes_of_def)\n done\n\nlemmas memcpy_type_wp = memcpy_type_wp'[THEN validNF_make_schematic_post', simplified]\n\ntext \\Confirm that we can also prove memcpy_int using the previous generic lemma.\\\nlemma memcpy_int_wp''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def memcpy_int'_def\n apply (rule allI)\n apply (wp memcpy_type_wp)\n (* Remainder mostly clagged from the original proof above. *)\n apply clarsimp\n apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n apply (rule_tac x=\"[deref s (byte_cast src),\n deref s (byte_cast src +\\<^sub>p 1),\n deref s (byte_cast src +\\<^sub>p 2),\n deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n apply (rule conjI)\n apply (clarsimp simp:bytes_of_def bytes_at_def UINT_MAX_def)\n apply (case_tac \"i = 0\", clarsimp)\n apply (case_tac \"i = 1\", clarsimp)\n apply (case_tac \"i = 2\", clarsimp)\n apply (case_tac \"i = 3\", clarsimp)\n apply clarsimp\n apply clarsimp\n apply (subst h_val_not_id_update_bytes, clarsimp+)\n apply (clarsimp simp:h_val_def)\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) =\n deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n prefer 2\n apply (clarsimp simp:h_val_def from_bytes_eq)\n apply (subst heap_list_rec[symmetric])\n apply simp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) =\n deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n prefer 2\n apply (clarsimp simp:h_val_def ptr_add_def)\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n apply (clarsimp simp: from_bytes_eq)\n apply (metis add.commute)\n apply clarsimp\n apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) =\n deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n prefer 2\n apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n apply (metis (no_types) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n done\n\nlemma bytes_of_imp_at[simp]: \"bytes_of s x bs \\ bytes_at s x bs\"\n by (clarsimp simp:bytes_of_def bytes_at_def)\n\nlemma bytes_at_imp_of:\n fixes x :: \"'a::mem_type ptr\"\n shows \"\\bytes_at s x bs; length bs = size_of TYPE('a)\\ \\ bytes_of s x bs\"\n by (clarsimp simp:bytes_of_def bytes_at_def)\n\ntext \\\n Memcpying from a source to a destination via an intermediary does what it should. This is close to\n the desirable property we want for CAmkES systems; i.e. that copying into your IPC buffer on one\n side and then out on the other gives you back what you put in. Note that the type of the\n intermediate pointer is irrelevant and we don't need to assume that the source and final\n destination do not overlap.\n\\\nlemma memcpy_seq:\n fixes x :: \"'a::mem_type ptr\"\n and y :: \"'b::mem_type ptr\"\n and z :: \"'a::mem_type ptr\"\n shows \"\\s0 bs.\n \\\\s. s = s0 \\ sz = of_nat (size_of TYPE('a)) \\\n c_guard x \\ c_guard y \\ c_guard z \\\n no_wrap x (unat sz) \\ no_wrap y (unat sz) \\ no_wrap z (unat sz) \\\n no_overlap x y (unat sz) \\ no_overlap y z (unat sz) \\\n bytes_of s x bs\\\n do memcpy' (ptr_coerce y) (ptr_coerce x) sz;\n memcpy' (ptr_coerce z) (ptr_coerce y) sz\n od\n \\\\r s. r = ptr_coerce z \\ bytes_of s z bs\\!\"\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply clarsimp\n apply (rule conjI, clarsimp simp:bytes_of_def)\n apply clarsimp\n apply (rule_tac x=bs in exI)\n apply (rule conjI, clarsimp simp:bytes_of_def)\n apply clarsimp\n apply (rule bytes_at_imp_of)\n apply (clarsimp simp:bytes_of_def)+\n done\n\nlemma update_ti_eq:\n fixes x :: \"'a::mem_type\"\n and y :: 'a\n shows \"\\length bs = size_of TYPE('a); bs = bs'\\\n \\ update_ti_t (typ_info_t TYPE('a)) bs x = update_ti_t (typ_info_t TYPE('a)) bs' y\"\n by (clarsimp simp:upd)\n\nlemma from_bytes_cong: \"x = y \\ from_bytes x = from_bytes y\"\n by simp\n\ndeclare from_bytes_eq [simp]\n\ntext \\\n If you dereference a pointer, the value you get is the same as the underlying bytes backing that\n memory.\n\\\nlemma val_eq_bytes:\n fixes x :: \"'a::mem_type ptr\"\n shows \"deref s x = from_bytes (map (\\off. deref s (byte_cast x +\\<^sub>p of_nat off)) [0.. f i = (map f [0.. deref (update_bytes s x bs) x = from_bytes bs\"\n apply (clarsimp simp:update_bytes_def)\n apply (subst hrs_mem_update)\n apply (clarsimp simp:h_val_def)\n apply (subst heap_list_update)\n apply (metis less_imp_le max_size)\n apply clarsimp\n done\n\ntext \\\n The memcpy_int proof can now be completed more elegantly. Note that the body of this proof is more\n generic than the previous attempts and doesn't involve manually reasoning about each byte.\n\\\nlemma memcpy_int_wp'''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n unfolding memcpy_int_spec_def memcpy_int'_def\n apply (rule allI)\n apply (wp memcpy_type_wp)\n apply clarsimp\n apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..n \\ ADDR_MAX; no_wrap x n\\\n \\ bytes_at s x (heap_list (hrs_mem (t_hrs_' s)) n (ptr_val x))\"\n apply (clarsimp simp:bytes_at_def ptr_add_def h_val_def)\n apply (subst heap_list_nth)\n apply unat_arith\n apply clarsimp\n done\n\ntext \\\n A collection of useful type-generic implications for moving from the abstract heap to the concrete\n heap.\n\\\ndefinition\n is_valid_imp_c_guard :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_c_guard is_valid \\ \\s p. is_valid (lift_global_heap s) p \\ c_guard p\"\ndefinition\n is_valid_imp_no_null :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_null is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ 0 \\ {ptr_val p..of_nat (size_of TYPE('b))}\"\ndefinition\n is_valid_imp_no_wrap :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_wrap is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ no_wrap p (size_of TYPE('b))\"\ndefinition\n is_valid_imp_no_overlap :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_no_overlap is_valid \\\n \\s p q. is_valid (lift_global_heap s) p \\ is_valid (lift_global_heap s) q \\ p \\ q\n \\ no_overlap p q (size_of TYPE('b))\"\ndefinition\n is_valid_imp_heap_ptr_valid :: \"(lifted_globals \\ 'b::mem_type ptr \\ bool) \\ bool\"\nwhere\n \"is_valid_imp_heap_ptr_valid is_valid \\\n \\s p. is_valid (lift_global_heap s) p \\ heap_ptr_valid (hrs_htd (t_hrs_' s)) p\"\n\ntext \\We can easily discharge these for a given type.\\\nlemma is_valid_w32_imp_c_guard[unfolded is_valid_imp_c_guard_def, simplified]:\n \"is_valid_imp_c_guard is_valid_w32\"\n unfolding is_valid_imp_c_guard_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (rule simple_lift_c_guard, force)\n done\n\nlemma is_valid_w32_imp_no_null[unfolded is_valid_imp_no_null_def, simplified]:\n \"is_valid_imp_no_null is_valid_w32\"\n unfolding is_valid_imp_no_null_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n by force\n\nlemma is_valid_w32_imp_no_wrap[unfolded is_valid_imp_no_wrap_def, simplified]:\n \"is_valid_imp_no_wrap is_valid_w32\"\n unfolding is_valid_imp_no_wrap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n done\n\nlemma is_valid_w32_imp_no_overlap[unfolded is_valid_imp_no_overlap_def, simplified]:\n \"is_valid_imp_no_overlap is_valid_w32\"\n unfolding is_valid_imp_no_overlap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)+\n apply clarsimp\n apply (drule simple_lift_heap_ptr_valid)+\n apply (clarsimp simp:no_overlap_def)\n apply (cut_tac p=p and q=q and d=\"hrs_htd (t_hrs_' s)\" in heap_ptr_valid_neq_disjoint)\n apply clarsimp+\n done\n\nlemma is_valid_w32_imp_heap_ptr_valid[unfolded is_valid_imp_heap_ptr_valid_def, simplified]:\n \"is_valid_imp_heap_ptr_valid is_valid_w32\"\n unfolding is_valid_imp_heap_ptr_valid_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n by (rule simple_lift_heap_ptr_valid, force)\n\ntext \\\n With that support in place, we can now prove a heap-abstracted call to memcpy of a type in a\n reasonably generic way. Note that we leverage the relationship between\n is_valid_*/lift_global_heap/simple_lift to transfer assumptions across the boundary between the\n abstract and concrete heaps.\n\\\nlemma\n fixes dst :: \"32word ptr\"\n and src :: \"32word ptr\"\n shows \"\\s0 x.\n \\\\s. s = s0 \\ is_valid_w32 s dst \\ is_valid_w32 s src \\ sz = of_nat (size_of TYPE(32word)) \\\n heap_w32 s src = x \\ dst \\ src\\\n exec_concrete lift_global_heap (memcpy' (ptr_coerce dst) (ptr_coerce src) sz)\n \\\\r s. r = ptr_coerce dst \\ heap_w32 s dst = x\\!\"\n including nf_no_pre\n apply (rule allI)+\n apply (wp memcpy_wp)\n apply (clarsimp simp:is_valid_w32_imp_c_guard\n is_valid_w32_imp_no_wrap\n is_valid_w32_imp_no_overlap)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..\n Let's do the same instantiation for a structure. Note that the proof text for the following lemmas\n is identical to the word 32 instantiation above. These could be straightforwardly abstracted into\n a locale which could be automatically interpreted with the use of generated proofs.\n\\\nlemma is_valid_my_structure_imp_c_guard[unfolded is_valid_imp_c_guard_def, simplified]:\n \"is_valid_imp_c_guard is_valid_my_structure_C\"\n unfolding is_valid_imp_c_guard_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (rule simple_lift_c_guard, force)\n done\n\nlemma is_valid_my_structure_imp_no_null[unfolded is_valid_imp_no_null_def, simplified]:\n \"is_valid_imp_no_null is_valid_my_structure_C\"\n unfolding is_valid_imp_no_null_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n by force\n\nlemma is_valid_my_structure_imp_no_wrap[unfolded is_valid_imp_no_wrap_def, simplified]:\n \"is_valid_imp_no_wrap is_valid_my_structure_C\"\n unfolding is_valid_imp_no_wrap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n apply (drule simple_lift_c_guard)\n apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n done\n\nlemma is_valid_my_structure_imp_no_overlap[unfolded is_valid_imp_no_overlap_def, simplified]:\n \"is_valid_imp_no_overlap is_valid_my_structure_C\"\n unfolding is_valid_imp_no_overlap_def no_wrap_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)+\n apply clarsimp\n apply (drule simple_lift_heap_ptr_valid)+\n apply (clarsimp simp:no_overlap_def)\n apply (cut_tac p=p and q=q and d=\"hrs_htd (t_hrs_' s)\" in heap_ptr_valid_neq_disjoint)\n apply clarsimp+\n done\n\nlemma is_valid_my_structure_imp_heap_ptr_valid[unfolded is_valid_imp_heap_ptr_valid_def, simplified]:\n \"is_valid_imp_heap_ptr_valid is_valid_my_structure_C\"\n unfolding is_valid_imp_heap_ptr_valid_def\n apply clarsimp\n apply (subst (asm) lifted_globals_ext_simps)\n apply clarsimp\n by (rule simple_lift_heap_ptr_valid, force)\n\ntext \\\n Again, we can now trivially transfer Hoare triple properties.\n\\\nlemma\n fixes dst :: \"my_structure_C ptr\"\n and src :: \"my_structure_C ptr\"\n shows \"\\s0 x.\n \\\\s. s = s0 \\ is_valid_my_structure_C s dst \\ is_valid_my_structure_C s src \\\n heap_my_structure_C s src = x \\ dst \\ src\\\n memcpy_struct' dst src\n \\\\r s. r = dst \\ heap_my_structure_C s dst = x\\!\"\n including nf_no_pre\n apply (rule allI)+\n unfolding memcpy_struct'_def\n apply (wp memcpy_wp)\n apply (clarsimp simp:is_valid_my_structure_imp_c_guard)\n apply (rule_tac x=\"map (\\i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..Heap Monad\\\n\ntheory Heap_Monad_Ext\n imports \"HOL-Imperative_HOL.Imperative_HOL\"\nbegin\n\ndefinition fun_app_lifted :: \"('a \\ 'b Heap) Heap \\ 'a Heap \\ 'b Heap\" where\n \"fun_app_lifted f\\<^sub>T x\\<^sub>T \\ do { f \\ f\\<^sub>T; x \\ x\\<^sub>T; f x }\"\n\nbundle heap_monad_syntax begin\n\nnotation fun_app_lifted (infixl \".\" 999)\ntype_synonym ('a, 'b) fun_lifted = \"'a \\ 'b Heap\" (\"_ ==H\\ _\" [3,2] 2)\ntype_notation Heap (\"[_]\")\n\nnotation Heap_Monad.return (\"\\_\\\")\nnotation (ASCII) Heap_Monad.return (\"(#_#)\")\nnotation Transfer.Rel (\"Rel\")\n\nend\n\ncontext includes heap_monad_syntax begin\n\nqualified lemma return_app_return:\n \"\\f\\ . \\x\\ = f x\"\n unfolding fun_app_lifted_def return_bind ..\n\nqualified lemma return_app_return_meta:\n \"\\f\\ . \\x\\ \\ f x\"\n unfolding return_app_return .\n\nqualified definition if\\<^sub>T :: \"bool Heap \\ 'a Heap \\ 'a Heap \\ 'a Heap\" where\n \"if\\<^sub>T b\\<^sub>T x\\<^sub>T y\\<^sub>T \\ do {b \\ b\\<^sub>T; if b then x\\<^sub>T else y\\<^sub>T}\"\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/heap_monad/Heap_Monad_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.28218339836013884}} {"text": "theory Presimplified_Semantics\n imports \"Presimplified_Semantics_Manual\"\nbegin\n\nnamed_theorems get_semantics_rewriting\n\ncontext presimplified_semantics\nbegin\n\nabbreviation \"write_mem \\ \\ a v s \\ bv_put \\ (Memory s a) (ucast v,0) \\\"\n\nabbreviation \"read_mem64 \\ \\ s a \\ fst (read_memory \\ \\ s a)\"\n\nabbreviation \"write_mem32 \\ \\ a (v::32 word) \\\n \\\\mem := write_block ((resolve_address \\ \\ a) \\ rev (\\3,0\\ v)) (mem \\)\\\"\n\nabbreviation \"write_mem64 \\ \\ a (v::64 word) \\\n \\\\mem := write_block ((resolve_address \\ \\ a) \\ rev (\\7,0\\ v)) (mem \\)\\\"\n\nlemma state_eqI:\n fixes \\ \\' :: state\n assumes \"regs \\ = regs \\'\"\n and \"mem \\ = mem \\'\"\n and \"flags \\ = flags \\'\"\n shows \"\\ = \\'\"\n using assms\n by (cases \\,cases \\',auto)\n\nlemma flags_eqI:\n assumes \"f flag_zf = f' flag_zf\"\n and \"f flag_cf = f' flag_cf\"\n and \"f flag_pf = f' flag_pf\"\n and \"f flag_af = f' flag_af\"\n and \"f flag_sf = f' flag_sf\"\n and \"f flag_of = f' flag_of\"\n shows \"f = f'\"\n apply (rule ext)\n subgoal for flg\n using assms\n by (cases flg,auto)\n done\n\n\nlemma parity_ucast[get_semantics_rewriting]:\n fixes a :: \"'b::len0 word\"\n assumes \"LENGTH('a) > LENGTH('b)\"\n and \"LENGTH('b) \\ 8\"\n shows \"parity (ucast a :: 'a::len0 word) = parity a\"\n using assms\n unfolding parity_def\n by (auto simp add: to_bl_ucast) \n\nlemma test_bit_of_argument_of_take_bits[get_semantics_rewriting]:\n fixes a :: \"'a::len0 word\"\n and x :: \"'b::len0 word\"\n assumes \"\\h,0\\a = x\"\n and \"n \\ h\"\n and \"h < LENGTH('a)\"\n and \"n < LENGTH('b)\"\n shows \"a !! n = x !! n\"\nproof-\n have \"a !! n = (\\h,0\\a :: 'b::len0 word) !! n\"\n apply (subst test_bit_of_take_bits)\n using assms\n by (auto)\n also have \"... = x !! n\"\n apply (subst assms(1))\n by simp\n finally\n show ?thesis\n by simp\nqed\n\n\n\n\n\n\n(*---------------------------------------------------proofs on nop ---------------------------------------*)\n\nlemma is_manual_nop[is_manual]:\n shows \"is_manual assembly semantics (Nullary (IS_8088 Nop)) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_nop[presimplify]:\n shows \"get_semantics \\ semantics (Nullary (IS_8088 Nop)) si = id\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (subst unfold_semantics)\n apply (rewrite_one_let')+\n apply simp\n done\n\nlemma unat_take_bits_remove_32bits[get_semantics_rewriting]:\n fixes a :: \"32 word\"\n assumes \"LENGTH('a) \\ 32\"\n shows \"unat (\\31,0\\a :: 'a::len0 word) = unat a\"\nproof-\n have 1: \"(\\31,0\\a :: 'a::len0 word) = (ucast a :: 'a::len0 word)\"\n by (auto simp add:take_bits_remove)\n show ?thesis\n using assms\n by (auto simp add:1 is_up unat_ucast)\nqed\n\n\nlemma test_bit_of_take_bits_for_diff_size[get_semantics_rewriting]:\n fixes a b:: \"64 word\"\n assumes \"LENGTH('a) > 64\"\n shows \"((\\63,0\\a + \\63,0\\b) ::'a::len0 word ) !! 63 = (a + b) !! 63\"\nproof-\n {\n let ?x = \"((\\63,0\\a + \\63,0\\b) ::'a::len0 word )\"\n have 1:\"(\\63,0\\?x :: 64 word) = a + b\"\n using assms\n apply (subst take_bits_plus_64bit(1))\n by auto\n show ?thesis\n apply (subst test_bit_of_argument_of_take_bits[where ?h=63 and ?x=\"a+b\"])\n using assms\n by auto\n }\nqed\n\nlemma stupid[get_semantics_rewriting]:\n fixes a :: \"'a::len0 word\"\n assumes \"LENGTH('a) = x\"\n shows \"a = a\"\n by auto\n\n\nlemma unat_take_bits_32word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"unat (\\31,0\\a :: 33 word) = unat (\\31,0\\a :: 32 word)\"\nproof -\n have 1:\"(\\31,0\\a :: 33 word) = (ucast (\\31,0\\a :: 32 word))\"\n by (auto simp add:simp_rules)\n show ?thesis\n apply (subst 1)\n apply (subst unat_ucast)\n by (auto simp add: is_up)\n qed\n\nlemma test_bit_of_different_word_size_32[get_semantics_rewriting]:\n fixes a b:: \"64 word\"\n assumes \"LENGTH('a) = 33\"\n shows \"((\\31,0\\a + \\31,0\\b) ::'a::len0 word ) !! 31 = ((\\31,0\\a + \\31,0\\b) :: 32 word ) !! 31\"\nproof-\n {\n let ?x = \"((\\31,0\\a + \\31,0\\b) ::'a::len0 word )\"\n have 1:\"(\\31,0\\?x :: 32 word) = ((\\31,0\\a + \\31,0\\b) :: 32 word)\"\n using assms\n apply (subst take_bits_plus)\n by auto\n show ?thesis\n using assms\n apply (subst test_bit_of_argument_of_take_bits[where ?h=31 and ?x=\"(\\31,0\\a + \\31,0\\b) :: 32 word\"])\n by (auto simp add:ucast_id)\n }\nqed\n\nlemma test_bit_2p_minus_1[get_semantics_rewriting]:\n shows \"((2 ^ LENGTH('a) - 1) :: 'a::len word) !! n = (n < LENGTH('a))\"\nproof-\n show ?thesis\n apply (subst max_word_eq[symmetric])\n by (auto simp add:word_size)\nqed\n\nlemma or_mask_all_0[get_semantics_rewriting]:\n fixes a :: \"'a :: len word\"\n shows \"a OR NOT mask LENGTH('a) = a\"\nproof-\n have 1:\"NOT (2 ^ LENGTH('a) - 1) = (0 :: 'a::len word)\"\n proof-\n {\n fix i\n assume \"i < LENGTH('a)\" \n have \"(NOT ((2 ^ LENGTH('a) - 1) :: 'a::len word)) !! i = (0 :: 'a::len word) !! i\"\n apply (subst max_word_eq[symmetric])\n by (auto simp add:test_bit_of_take_bits test_bit_2p_minus_1)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n show ?thesis\n by (auto simp add:mask_def 1)\nqed\n\nlemma useless_and[get_semantics_rewriting]:\n fixes a::\"'a::len word\"\n shows \"a AND ((2^LENGTH('a) - 1) :: 'a:: len word) = (a)\"\nproof-\n show ?thesis\n using max_word_eq\n apply (subst max_word_eq[symmetric])\n by auto\nqed\n\nlemma p2_ge_one:\n shows \" Suc 0 \\ nat (2 ^ x)\"\n by(induct x,auto)\n\nlemma nat_remove_2pxminusOne[get_semantics_rewriting]:\n shows \"nat (2 ^ x - 1) = 2 ^ x - Suc 0\"\nproof(induct x)\n case 0\n thus ?case \n by auto\nnext\n case (Suc x)\n have 1: \"2 * nat (2 ^ x) - Suc 0 = nat (2 ^ x) - Suc 0 + nat (2^x)\"\n by (auto simp add: field_simps)\n show ?case\n using Suc \n apply (auto simp add: nat_diff_distrib' nat_mult_distrib)\n apply (subst 1)\n apply auto\n apply (subst diff_add_assoc)\n by (auto simp add: p2_ge_one)\nqed\n\nlemma unat_max_word[get_semantics_rewriting]:\n shows \"unat (max_word :: 'a::len word) = 2^LENGTH('a) - 1\"\n apply (subst max_word_def)\n apply auto\n apply (subst unat_def)\n apply (subst int_word_uint)\n apply (auto simp add: m1mod2k)\n apply (subst nat_remove_2pxminusOne)\n by simp\n\nlemma unat_2px[get_semantics_rewriting]:\n assumes \"x < LENGTH('a)\"\n shows \"unat (2 ^ x :: 'a::len word) = 2 ^ x\"\n using assms\nproof (induct x)\n case 0\n thus ?case\n by auto\nnext\n case (Suc x)\n have 1: \"2 * 2 ^ x = (2 ^ x + 2 ^ x :: 'a word)\"\n by (auto simp add: field_simps)\n show ?case\n using Suc\n apply (auto simp add: )\n apply (subst 1)\n apply (subst unat_word_ariths)\n apply (auto simp add: field_simps)\n apply (subst mod_less)\n using power_strict_increasing_iff[of 2 \"x+1\" \"LENGTH('a)\"]\n by (auto simp add: field_simps mult_2)\nqed\n\n\nlemma test_bit_2p_of_diff_length[get_semantics_rewriting]:\n assumes \"h < LENGTH('a)\"\n and \"LENGTH('h::len) = h\"\n shows \"((2 ^ h - 1) :: 'a::len word) = ucast (max_word :: 'h word)\"\n using assms\n apply (auto)\n apply unat_arith\n by (auto simp add: unat_ucast is_up unat_max_word unat_2px)\n\n\nlemma useless_sextend_hardocded_65_word:\n fixes a :: \"64 word\"\n shows \"\\63,0\\((sextend (\\63,0\\a :: 1000 word) 64 64) :: 1000 word) = (\\63,0\\a ::65 word)\"\nproof-\n show ?thesis\n unfolding sextend.simps\n apply (auto simp add: simp_rules mask_def)\n apply (subst take_bits_bitOR)\n apply (auto simp add:take_bits_remove ucast_id)\n apply (subst useless_and[where ?a=\"a :: 64 word\", simplified])\n by auto\n qed\n\nlemma useless_sextend_hardocded[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\63,0\\((sextend (\\63,0\\a :: 1000 word) 64 64) :: 1000 word) = (a ::64 word)\"\nproof-\n show ?thesis\n unfolding sextend.simps\n apply (auto simp add: simp_rules mask_def)\n apply (subst Word.word_bool_alg.conj_disj_distrib2)\n apply (auto)\n apply (subst take_bits_remove[where ?w=\"a\" and ?h=\"63\", simplified])\n apply (subst take_bits_bitAND)\n apply auto\n apply (auto simp add:ucast_id)\n apply (subst useless_and[where ?a=\"a :: 64 word\", simplified])\n by auto\n qed\n\n\nlemma and_2p_minus_1_extend[get_semantics_rewriting]:\n fixes a:: \"64 word\"\n shows \"(\\63,0\\a :: 1000 word) AND 2^(LENGTH(64)) - 1 = (\\63,0\\a :: 1000 word)\"\nproof-\n {\n fix i n :: nat\n assume a:\"n < 1000\"\n have 1: \"(( 2^(LENGTH(64)) - 1) :: 1000 word) = \\63,0\\(( 2^(LENGTH(64)) - 1) :: 64 word)\"\n by auto\n hence \"((\\63,0\\a :: 1000 word) AND (2^(LENGTH(64)) - 1 :: 1000 word)) !! n = (\\63,0\\a :: 1000 word) !! n\"\n apply (subst 1)\n apply (subst max_word_eq[symmetric])\n apply (subst take_bits_bitAND[symmetric]) \n by (auto simp add:take_bits_remove)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\nqed\n\n\nlemma useless_sextend_hardocded_ucast[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"((sextend (\\63,0\\a :: 1000 word) 64 64) :: 1000 word) = (ucast a ::1000 word)\"\nproof-\n show ?thesis\n unfolding sextend.simps\n apply (auto simp add: simp_rules mask_def)\n apply (subst Word.word_bool_alg.conj_disj_distrib2)\n apply (auto)\n subgoal\n apply (subst and_2p_minus_1_extend[simplified])\n apply (subst take_bits_remove[where ?w=\"a\" and ?h=\"63\", simplified])\n by auto\n subgoal\n apply (subst take_bits_remove[where ?w=\"a\" and ?h=\"63\", simplified])\n by auto\n done\n qed\n\nlemma take_bits_lt_bit64[get_semantics_rewriting]:\n fixes a b :: \"'b::len0 word\"\n assumes \"64 \\ LENGTH('a)\"\n and \"64 \\ LENGTH('b)\"\n shows \"(((\\63,0\\a)::'a::len0 word) < ((\\63,0\\b)::'a::len0 word)) = (((\\63,0\\a)::64 word) < ((\\63,0\\b)::64 word))\"\nproof-\n have 1: \"\\i\\64. i < length (rev (to_bl ((\\63,0\\a)::'a::len0 word))) \\ \\rev (to_bl ((\\63,0\\a)::'a::len0 word)) ! i\"\n using assms\n by (auto simp add: rev_nth test_bit_of_take_bits to_bl_nth word_size)\n have 2: \"\\i\\64. i < length (rev (to_bl ((\\63,0\\b)::'a::len0 word))) \\ \\rev (to_bl ((\\63,0\\b)::'a::len0 word)) ! i\"\n using assms\n by (auto simp add: rev_nth test_bit_of_take_bits to_bl_nth word_size)\n have 3: \"\\ a ::'b::len0 word . take 64 (rev (to_bl ((\\63,0\\a)::'a::len0 word))) = rev (to_bl ((\\63,0\\a)::64 word))\"\n proof-\n fix a :: \"'b::len0 word\"\n {\n fix i :: nat\n assume \"i < 64\"\n hence \"take 64 (rev (to_bl ((\\63,0\\a)::'a::len0 word))) ! i = rev (to_bl ((\\63,0\\a)::64 word)) ! i\"\n using assms\n by (auto simp add: rev_nth to_bl_nth word_size test_bit_of_take_bits)\n }\n thus \"?thesis a\"\n using assms\n apply (intro nth_equalityI)\n by (auto)\n qed\n\n show ?thesis\n apply (auto simp add: word_less_rbl)\n apply (subst (asm) rev_bl_order_take[of 64])\n using 1 2 3\n apply auto\n apply (subst rev_bl_order_take[of 64])\n using 1 2 3\n by auto\nqed\n\nlemma take_bits_le_bit64[get_semantics_rewriting]:\n fixes a b :: \"'b::len0 word\"\n assumes \"64 \\ LENGTH('a)\"\n and \"64 \\ LENGTH('b)\"\n shows \"(((\\63,0\\a)::'a::len0 word) \\ ((\\63,0\\b)::'a::len0 word)) = (((\\63,0\\a)::64 word) \\ ((\\63,0\\b)::64 word))\"\nproof-\n have \"(((\\63,0\\a)::'a::len0 word) = ((\\63,0\\b)::'a::len0 word)) = (((\\63,0\\a)::64 word) = ((\\63,0\\b)::64 word))\"\n proof-\n { fix i :: nat\n assume \"(((\\63,0\\a)::'a::len0 word) = ((\\63,0\\b)::'a::len0 word))\"\n hence \"\\ i < 64 . (((\\63,0\\a)::'a::len0 word) !! i = (((\\63,0\\b)::'a::len0 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n \n hence \"\\ i < 64 . (((\\63,0\\a)::64 word) !! i = (((\\63,0\\b)::64 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n hence \"(((\\63,0\\a)::64 word) = ((\\63,0\\b)::64 word))\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n }\n moreover\n {\n assume \"(((\\63,0\\a)::64 word) = ((\\63,0\\b)::64 word))\"\n hence \"\\ i < 64 . (((\\63,0\\a)::64 word) !! i = (((\\63,0\\b)::64 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n hence \"\\ i < LENGTH('a) . (((\\63,0\\a)::'a::len0 word) !! i = (((\\63,0\\b)::'a::len0 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n hence \"(((\\63,0\\a)::'a::len0 word) = ((\\63,0\\b)::'a::len0 word))\"\n using assms\n apply (intro word_eqI)\n by (auto simp add: word_size)\n }\n ultimately\n show ?thesis\n by auto\n qed\n thus ?thesis\n using assms\n apply (cases \"(((\\63,0\\a)::'a::len0 word) = ((\\63,0\\b)::'a::len0 word))\"; cases \"(((\\63,0\\a)::64 word) = ((\\63,0\\b)::64 word))\";auto)\n by (meson less_imp_le_nat linorder_not_le take_bits_lt_bit64)+\nqed\n\n\n\nlemma overflow_sub_bit64[get_semantics_rewriting]:\n fixes a b:: \"'a :: len0 word\"\n assumes \"64 \\ LENGTH('a)\"\n shows \"((1::65 word) + (((\\63,0\\a)::65 word) + ucast (NOT ((\\63,0\\b):: 64 word)))) !! 64 = (((\\63,0\\a)::64 word) \\ \\63,0\\b)\"\nproof-\n have 3: \"(((\\63,0\\a)::65 word) \\ \\63,0\\b) = (((\\63,0\\a)::64 word) \\ \\63,0\\b)\"\n using assms\n by (subst take_bits_le_bit64,simp,simp,simp)\n have 1: \"\\ ((\\63,0\\a)::65 word) !! 64\"\n and 2: \"\\ ((\\63,0\\b)::65 word) !! 64\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n have \"uint ((\\63,0\\a)::65 word) < 18446744073709551616\"\n and \"uint ((\\63,0\\b)::65 word) < 18446744073709551616\"\n using msb_is_gt_2p[unfolded msb_nth,where 'a=65,simplified] 1\n apply (uint_arith)\n using msb_is_gt_2p[unfolded msb_nth,where 'a=65,simplified] 2\n by (uint_arith)\n hence \"((1::65 word) + (((\\63,0\\a)::65 word) + ucast (NOT ((\\63,0\\b):: 64 word)))) !! 64 = (((\\63,0\\a)::65 word) \\ \\63,0\\b)\"\n apply (subst ucast_bitNOT)\n apply simp\n apply (subst twos_complement_subtraction)\n apply simp\n apply (subst msb_is_gt_2p[unfolded msb_nth,where 'a=65,simplified])\n apply auto\n apply uint_arith\n using assms\n apply (auto simp add: is_up)\n apply uint_arith\n using assms\n by (auto simp add: is_up)\n thus ?thesis\n using 3\n by auto\nqed\n\n\n\nlemma sign_sub_bit64[get_semantics_rewriting]:\n fixes a b:: \"'a :: len0 word\"\n assumes \"63 < LENGTH('a)\"\n shows \"((1::65 word) + (((\\63,0\\a)::65 word) + ucast (NOT ((\\63,0\\b):: 64 word)))) !! 63 \\ sint (((\\63,0\\a):: 64 word) - \\63,0\\b) < 0\"\nproof-\n have 1: \"\\ a :: 65 word . a !! 63 = ((\\63,0\\a):: 64 word) !! 63\"\n using assms\n by (auto simp add: test_bit_of_take_bits nth_ucast)\n have 2: \"\\63,0\\((1::65 word) + (((\\63,0\\a)::65 word) + ucast (NOT ((\\63,0\\b):: 64 word)))) = (((\\63,0\\a)::64 word) - \\63,0\\b)\"\n using assms\n apply (subst ucast_bitNOT)\n apply simp\n apply (subst twos_complement_subtraction)\n apply (subst take_bits_minus)\n apply (simp)\n apply (simp)\n by (simp)\n have 3: \"... !! 63 \\ sint (((\\63,0\\a):: 64 word) - \\63,0\\b) < 0\"\n using msb_nth[symmetric, where 'a=64]\n by (simp add: word_msb_sint)\n show ?thesis\n apply (subst 1)\n apply (subst 2)\n apply (subst 3)\n by simp\nqed\n\nlemma sub_overflow_flag64_bit[get_semantics_rewriting]:\n fixes a b :: \"'a::len0 word\"\n assumes \"LENGTH('a) \\ 64\"\n shows \"((\\ b !! 63) = a !! 63 \\ b !! 63 = (sint (\\63,0\\a - \\63,0\\b::64 word) < 0)) \\\n ((9223372036854775808::64 word) > \\63,0\\b \\ sint (\\63,0\\a - \\63,0\\b::64 word) \\ 0 \\ (9223372036854775808::64 word) \\ \\63,0\\a)\n \\\n ((9223372036854775808::64 word) \\ \\63,0\\b \\ sint (\\63,0\\a - \\63,0\\b::64 word) < 0 \\ (9223372036854775808::64 word) > \\63,0\\a)\"\nproof-\n have 1: \"a !! 63 = msb (\\63,0\\ a :: 64 word)\"\n and 2: \"b !! 63 = msb (\\63,0\\ b :: 64 word)\"\n using assms\n by (auto simp add: msb_nth test_bit_of_take_bits)\n show ?thesis\n using assms\n apply (subst 1)\n apply (subst 2)+\n apply (subst msb_is_gt_2p)+\n apply simp\n by (auto)\nqed\n\nfind_theorems \"(ucast ?x) !! ?v = ?m\"\n\n\nlemma test_32b_of_32AND64_word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a :: 1000 word) !! 31 = (\\31,0\\a :: 32 word) !! 31\"\n by (simp add: test_bit_of_take_bits)\n\n\n(*---------------------------------------------------proofs on add ---------------------------------------*)\n\nlemma unat_take_bits_64word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"unat (\\63,0\\a :: 65 word) = unat (a)\"\nproof -\n have 1:\"(\\63,0\\a :: 65 word) = (ucast (a))\"\n by (auto simp add:simp_rules take_bits_remove)\n show ?thesis\n apply (subst 1)\n apply (subst unat_ucast)\n by (auto simp add: is_up)\n qed\n\n\n\nlemma is_manual_add_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_r64_r64[presimplify]:\n shows \"get_semantics assembly semantics (Binary (IS_8088 Add) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := (op1 + op2)),\n flags := (flags \\)\n (flag_zf := ucast(op1 + op2) = (0 :: 64 word),\n flag_cf := (unat(op1 :: 64 word) + unat(op2 :: 64 word) \\ 2^64),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (simp add: simp_rules )\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (intro flags_eqI,simp_all)\n subgoal\n unfolding bv_slice.simps[simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal \n apply (subst msb_is_gt_2p[where ?a =\"(\\63,0\\regs \\ r64_1 + \\63,0\\regs \\ r64_2) :: 65 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply (auto simp add:simp_rules)\n using unat_take_bits_64word[where ?a=\"regs \\ r64_1\"]\n using unat_take_bits_64word[where ?a=\"regs \\ r64_2\"]\n apply auto\n done\n subgoal \n unfolding bv_slice.simps[simplified]\n apply (auto simp add:parity_ucast)\n done\n subgoal \n apply (subst word_msb_sint[where ?w=\"regs \\ r64_1 + regs \\ r64_2 :: 64 word\", unfolded msb_nth, symmetric])\n apply (auto simp add:test_bit_of_take_bits simp_rules get_semantics_rewriting)\n done\n subgoal \n apply (subst test_bit_of_take_bits_for_diff_size)\n using word_msb_sint[where ?w=\"regs \\ r64_1\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"regs \\ r64_2\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"regs \\ r64_1 + regs \\ r64_2\", unfolded msb_nth, simplified]\n by (auto simp add: simp_rules msb_nth test_bit_of_take_bits )\n done\n done\n qed\n\n\n\nlemma test_64b_of_AND1000_word[get_semantics_rewriting]:\n fixes w :: \"64 word\"\n shows \"w !! 63 = (\\63,0\\w :: 1000 word) !! 63\"\n by (simp add: test_bit_of_take_bits)\n\nlemma is_manual_add_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_r32_r32[presimplify]:\n shows \"get_semantics assembly semantics (Binary (IS_8088 Add) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\regs := (regs \\)(r32_1 := ucast(op1 + op2)),\n flags := (flags \\)\n (flag_zf := ucast(op1 + op2) = (0 :: 32 word),\n flag_cf := (unat(op1 :: 32 word) + unat(op2 :: 32 word) \\ 2^32),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (simp add: simp_rules)\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (intro flags_eqI,simp_all)\n subgoal \n apply (subst msb_is_gt_2p[where ?a =\"(\\31,0\\regs \\ r32_1 + \\31,0\\regs \\ r32_2) :: 33 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply auto\n using unat_take_bits_32word[where ?a=\"regs \\ r32_1\"]\n using unat_take_bits_32word[where ?a=\"regs \\ r32_2\"]\n apply auto\n done\n subgoal \n apply (auto simp add:parity_ucast)\n done\n subgoal \n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1 + \\31,0\\regs \\ r32_2 :: 32 word\", unfolded msb_nth]\n apply (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_different_word_size_32)\n done\n subgoal \n apply (subst test_bit_of_different_word_size_32)\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1 :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_2 :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1 + \\31,0\\regs \\ r32_2 :: 32 word\", unfolded msb_nth, simplified]\n by (auto simp add: simp_rules msb_nth test_bit_of_take_bits )\n done\n done\n qed\n\n\nlemma is_manual_add_r64_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Reg (General SixtyFour r64)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_r64_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Add) (Reg (General SixtyFour r64)) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let op1 = regs \\ r64 :: 64 word;\n op2 = (word_of_int Imm32) :: 64 word\n in\n \\\\regs := (regs \\)(r64 := (op1 + op2)),\n flags := (flags \\)\n (flag_zf := (op1 + op2) = (0 :: 64 word),\n flag_cf := (unat(op1) + unat(op2) \\ 2^64),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules useless_sextend_hardocded)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n unfolding bv_slice.simps[simplified]\n apply (auto simp add:take_bits_remove ucast_id)\n done\n subgoal for \\\n apply (subst msb_is_gt_2p[where ?a=\"( \\63,0\\word_of_int Imm32 + \\63,0\\regs \\ r64 ) :: 65 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply (auto simp add:take_bits_remove)\n apply (auto simp add:unat_ucast is_up)\n done\n subgoal for \\\n unfolding bv_slice.simps[simplified]\n apply (auto simp add:parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"word_of_int Imm32 + regs \\ r64 :: 64 word\", unfolded msb_nth]\n apply (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_take_bits_for_diff_size)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"word_of_int Imm32 + regs \\ r64 :: 64 word\", unfolded msb_nth]\n using word_msb_sint[where ?w=\"regs \\ r64 :: 64 word\", unfolded msb_nth]\n using word_msb_sint[where ?w=\"word_of_int Imm32 :: 64 word\", unfolded msb_nth]\n by (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_take_bits_for_diff_size)\n done\nqed\n\nlemma is_manual_add_r32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Reg (General ThirtyTwo r32)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_r32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Add) (Reg (General ThirtyTwo r32)) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32 :: 32 word;\n op2 = \\31,0\\(word_of_int Imm32 :: 64 word) :: 32 word\n in\n \\\\regs := (regs \\)(r32 := ucast(op1 + op2)),\n flags := (flags \\)\n (flag_zf := (op1 + op2) = (0 :: 32 word),\n flag_cf := (unat(op1) + unat(op2) \\ 2^32),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (subst msb_is_gt_2p[where ?a =\"(\\31,0\\word_of_int Imm32 + \\31,0\\regs \\ r32) :: 33 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply auto\n using unat_take_bits_32word[where ?a=\"word_of_int Imm32\"]\n using unat_take_bits_32word[where ?a=\"regs \\ r32\"]\n apply auto\n done\n subgoal for \\\n apply (auto simp add:parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 + \\31,0\\regs \\ r32 :: 32 word\", unfolded msb_nth]\n apply (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_different_word_size_32)\n done\n subgoal for \\\n apply (subst test_bit_of_different_word_size_32)\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32 :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 + \\31,0\\regs \\ r32 :: 32 word\", unfolded msb_nth, simplified]\n by (auto simp add: simp_rules msb_nth test_bit_of_take_bits )\n done\nqed\n\nlemma read_reg_after_update_flag[get_semantics_rewriting]: \"read_reg (\\\\flags := x\\) r = read_reg \\ r\"\n by (induct \\ r rule: read_reg.induct,auto)\n\nlemma resolve_address_after_update_flag[get_semantics_rewriting]: \"resolve_address \\ (\\\\flags := x\\) Mem = resolve_address \\ \\ Mem\"\n by (induct \\ \\ Mem rule: resolve_address.induct, auto simp add:read_reg_after_update_flag)\n\nlemma sextend_useless_64_64:\n fixes a :: \"64 word\"\n shows \"sextend a 64 64 = a\"\n unfolding sextend.simps\n apply (auto simp add: simp_rules mask_def)\n apply (subst useless_and[where ?a=\"a OR - 18446744073709551616 :: 64 word\", simplified])\n using or_mask_all_0[of a]\n by auto\n\nlemma is_manual_add_m64_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Memory 64 Mem) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_m64_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Add) (Memory 64 Mem) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = read_mem64 \\ \\ 64 Mem;\n op2 = (word_of_int Imm32) :: 64 word in\n \\\\mem := write_blocks [a \\ rev (\\7,0\\ (op1 + op2))] (mem \\),\n flags := (flags \\)\n (flag_zf := (op1 + op2) = (0 :: 64 word),\n flag_cf := (unat(op1) + unat(op2) \\ 2^64),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ sint(op1 + op2) < 0)\n \\\n (sint(op1) < 0 \\ sint(op2) < 0 \\ sint(op1 + op2) \\ 0),\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules sextend_useless_64_64 useless_sextend_hardocded_ucast useless_sextend_hardocded useless_sextend_hardocded_65_word resolve_address_after_update_flag)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:take_bits_remove ucast_id )\n unfolding bv_slice.simps\n apply (auto simp add: sextend_useless_64_64 ucast_id)\n done\n subgoal for \\\n apply (subst useless_sextend_hardocded_65_word[simplified])\n apply (subst msb_is_gt_2p[where ?a=\"( \\63,0\\word_of_int Imm32 + \\63,0\\read_mem64 \\ \\ 64 Mem) :: 65 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply (auto simp add:take_bits_remove)\n apply (auto simp add:unat_ucast is_up)\n done\n subgoal for \\\n unfolding bv_slice.simps\n apply (subst useless_sextend_hardocded_65_word[simplified])\n apply (auto simp add:parity_ucast)\n done\n subgoal for \\\n apply (subst useless_sextend_hardocded_65_word[simplified])\n using word_msb_sint[where ?w=\"word_of_int Imm32 + read_mem64 \\ \\ 64 Mem :: 64 word\", unfolded msb_nth]\n apply (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_take_bits_for_diff_size)\n done\n subgoal for \\\n apply (subst useless_sextend_hardocded_ucast[where ?a=\"word_of_int Imm32\"])\n apply (subst useless_sextend_hardocded_65_word[simplified])\n apply (subst useless_sextend_hardocded_ucast[where ?a=\"word_of_int Imm32\"])\n using word_msb_sint[where ?w=\"word_of_int Imm32 +read_mem64 \\ \\ 64 Mem :: 64 word\", unfolded msb_nth]\n using word_msb_sint[where ?w=\"read_mem64 \\ \\ 64 Mem :: 64 word\", unfolded msb_nth]\n using word_msb_sint[where ?w=\"word_of_int Imm32 :: 64 word\", unfolded msb_nth]\n by (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_take_bits_for_diff_size)\n done\nqed\n\nlemma is_manual_add_m32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_m32_imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Add) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = \\31,0\\read_mem64 \\ \\ 32 Mem;\n op2 = \\31,0\\(word_of_int Imm32 :: 64 word) :: 32 word\n in\n \\\\mem := write_blocks [a \\ rev (\\3,0\\ (op1 + op2))] (mem \\),\n flags := (flags \\)\n (flag_zf := ucast(op1 + op2) = (0 :: 32 word),\n flag_cf := (unat(op1 :: 32 word) + unat(op2 :: 32 word) \\ 2^32),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (simp add: simp_rules resolve_address_after_update_flag)\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (intro flags_eqI,simp_all)\n subgoal \n apply (subst msb_is_gt_2p[where ?a =\"(\\31,0\\word_of_int Imm32 + \\31,0\\fst (read_memory \\ \\ 32 Mem)) :: 33 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply auto\n using unat_take_bits_32word[where ?a=\"word_of_int Imm32\"]\n using unat_take_bits_32word[where ?a=\"fst (read_memory \\ \\ 32 Mem)\"]\n apply auto\n done\n subgoal \n apply (auto simp add:parity_ucast)\n done\n subgoal \n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 + \\31,0\\fst (read_memory \\ \\ 32 Mem) :: 32 word\", unfolded msb_nth]\n apply (auto simp add:simp_rules msb_nth test_bit_of_take_bits test_bit_of_different_word_size_32)\n done\n subgoal \n apply (subst test_bit_of_different_word_size_32)\n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\fst (read_memory \\ \\ 32 Mem) :: 32 word\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"\\31,0\\word_of_int Imm32 + \\31,0\\fst (read_memory \\ \\ 32 Mem) :: 32 word\", unfolded msb_nth, simplified]\n by (auto simp add: simp_rules msb_nth test_bit_of_take_bits )\n done\n done\n qed\n\nlemma is_manual_add_m64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Add) (Memory 64 Mem) (Storage (Reg (General SixtyFour reg)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_add_m64_imm64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Add) (Memory 64 Mem) (Storage (Reg (General SixtyFour reg)))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = read_mem64 \\ \\ 64 Mem;\n op2 = regs \\ reg\n in\n \\\\mem := write_blocks [a \\ rev (\\7,0\\ (op1 + op2))] (mem \\),\n flags := (flags \\)\n (flag_zf := ucast(op1 + op2) = (0 :: 64 word),\n flag_cf := (unat(op1 :: 64 word) + unat(op2 :: 64 word) \\ 2^64),\n flag_of := (sint(op1) \\ 0 \\ sint(op2) \\ 0 \\ (sint(op1 + op2) <0))\n \\\n (sint(op1) < 0 \\ sint(op2)<0 \\ (sint(op1 + op2) \\0)),\n\n flag_sf := sint(op1 + op2) < 0,\n flag_pf := parity(op1 + op2)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (simp add: simp_rules resolve_address_after_update_flag)\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (intro flags_eqI,simp_all)\n subgoal\n unfolding bv_slice.simps[simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal \n apply (subst msb_is_gt_2p[where ?a =\"(\\63,0\\regs \\ reg + \\63,0\\fst (read_memory \\ \\ 64 Mem)) :: 65 word\", unfolded msb_nth, simplified])\n apply unat_arith\n apply (auto simp add:simp_rules)\n using unat_take_bits_64word[where ?a=\"regs \\ reg\"]\n using unat_take_bits_64word[where ?a=\"fst (read_memory \\ \\ 64 Mem)\"]\n apply auto\n done\n subgoal \n unfolding bv_slice.simps[simplified]\n apply (auto simp add:parity_ucast)\n done\n subgoal \n apply (subst word_msb_sint[where ?w=\"regs \\ reg + fst (read_memory \\ \\ 64 Mem) :: 64 word\", unfolded msb_nth, symmetric])\n apply (auto simp add:test_bit_of_take_bits simp_rules test_bit_of_take_bits_for_diff_size)\n done\n subgoal \n apply (subst test_bit_of_take_bits_for_diff_size)\n using word_msb_sint[where ?w=\"regs \\ reg\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"fst (read_memory \\ \\ 64 Mem)\", unfolded msb_nth, simplified]\n using word_msb_sint[where ?w=\"regs \\ reg + fst (read_memory \\ \\ 64 Mem)\", unfolded msb_nth, simplified]\n by (auto simp add: simp_rules msb_nth test_bit_of_take_bits )\n done\n done\n qed\n\n\n\n\nlemma sub_overflow_flag[get_semantics_rewriting]:\n fixes a b :: \"'a::len0 word\"\n assumes \"LENGTH('a) \\ 32\"\n shows \"((\\ b !! 31) = a !! 31 \\ b !! 31 = (sint (\\31,0\\a - \\31,0\\b::32 word) < 0)) \\\n ((2147483648::32 word) > \\31,0\\b \\ sint (\\31,0\\a - \\31,0\\b::32 word) \\ 0 \\ (2147483648::32 word) \\ \\31,0\\a)\n \\\n ((2147483648::32 word) \\ \\31,0\\b \\ sint (\\31,0\\a - \\31,0\\b::32 word) < 0 \\ (2147483648::32 word) > \\31,0\\a)\"\nproof-\n have 1: \"a !! 31 = msb (\\31,0\\ a :: 32 word)\"\n and 2: \"b !! 31 = msb (\\31,0\\ b :: 32 word)\"\n using assms\n by (auto simp add: msb_nth test_bit_of_take_bits)\n show ?thesis\n using assms\n apply (subst 1)\n apply (subst 2)+\n apply (subst msb_is_gt_2p)+\n apply simp\n by (auto)\nqed\n\n\n\n(*---------------------------------------------------proofs on seta ---------------------------------------*)\n\nlemma is_manual_seta_r8[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_80386 Seta) (Storage (Reg (General EightLow r1)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_seta_r8[presimplify]:\n shows \"get_semantics assembly semantics (Unary (IS_80386 Seta) (Storage (Reg (General EightLow r1)))) si =\n (\\ \\ . let op1 = regs \\ r1 :: 64 word\n in\n \\\\regs := (regs \\)(r1 := \\63,0\\((\\63,8\\regs \\ r1 << 8 :: 64 word) OR (if flags \\ flag_zf \\ flags \\ flag_cf then 0 else 1))) \\)\"\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules Let'_def)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n by (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl bv_to_bool_def word_lsb_alt)\n\nlemma is_manual_seta_m8[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_80386 Seta) (Storage (Memory 8 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_seta_m8[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_80386 Seta) (Storage (Memory 8 Mem))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = (read_mem64 \\ \\ 8 Mem) :: 64 word\n in\n \\\\mem := write_blocks [a \\ (if flags \\ flag_zf \\ flags \\ flag_cf then [0] else [1])] (mem \\)\\)\"\nproof-\n {\n fix x :: \"64 word\"\n have \"rev (\\0,0\\(\\63,0\\(\\63,8\\x << 8 :: 1000 word) :: 64 word)) = [0]\"\n apply auto\n apply (intro nth_equalityI)\n apply (auto simp add: nth_bytes_of)\n apply (intro word_eqI)\n by (auto simp add: word_size nth_shiftl test_bit_of_take_bits)\n }\n note 1 = this\n {\n fix x :: \"64 word\"\n have \"rev (\\0,0\\(\\63,0\\((\\63,8\\x << 8 :: 1000 word) OR 1)::64 word)) = [1]\"\n apply auto\n apply (intro nth_equalityI)\n apply (auto simp add: nth_bytes_of)\n apply (intro word_eqI)\n by (auto simp add: word_size nth_shiftl test_bit_of_take_bits word_ao_nth)\n }\n note 2 = this\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules Let'_def)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 1)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 1 2)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 1 2)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 1 2)\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply(auto simp add:semantics_def simp_rules Let'_def)[1]\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl bv_to_bool_def word_lsb_alt)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps 2)\n done\nqed\n\n\n(*---------------------------------------------------proofs on setb ---------------------------------------*)\n\nlemma is_manual_setb_r8[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_80386 Setb) (Storage (Reg (General EightLow r)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_setb_r8[presimplify]:\n shows \"get_semantics assembly semantics (Unary (IS_80386 Setb) (Storage (Reg (General EightLow r)))) si =\n (\\\\. let op = regs \\ r\n in\n \\\\regs := (regs \\)(r := \\63,0\\((\\63,8\\op << 8 :: 64 word) OR (if flags \\ flag_cf then 1 else 0)))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply (rewrite_one_let' add: semantics_def)\n apply rewrite_one_let'+\n apply (auto simp add:simp_rules)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply auto\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply (rewrite_one_let' add: semantics_def)\n apply rewrite_one_let'+\n apply (auto simp add: simp_rules)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply auto\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n done\n\n\n(*---------------------------------------------------proofs on setne ---------------------------------------*)\n\nlemma is_manual_setne_r8[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_80386 Setne) (Storage (Reg (General EightLow r1)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_setne_r8[presimplify]:\n shows \"get_semantics assembly semantics (Unary (IS_80386 Setne) (Storage (Reg (General EightLow r1)))) si =\n (\\ \\ . let op1 = regs \\ r1 :: 64 word\n in\n \\\\regs := (regs \\)(r1 := \\63,0\\((\\63,8\\regs \\ r1 << 8 :: 64 word) OR (if flags \\ flag_zf then 0 else 1))) \\)\"\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto)\n apply (rule word_eqI)\n by (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl bv_to_bool_def word_lsb_alt)\n\nlemma is_manual_setne_m8[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_80386 Setne) (Storage (Memory 8 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_setne_m8[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_80386 Setne) (Storage (Memory 8 Mem))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = (read_mem64 \\ \\ 8 Mem) :: 64 word\n in\n \\\\mem := write_blocks [a \\ (if flags \\ flag_zf then [0] else [1])] (mem \\)\\)\"\nproof-\n {\n fix x :: \"64 word\"\n have \"rev (\\0,0\\(\\63,0\\(\\63,8\\x << 8 :: 1000 word) :: 64 word)) = [0]\"\n apply auto\n apply (intro nth_equalityI)\n apply (auto simp add: nth_bytes_of)\n apply (intro word_eqI)\n by (auto simp add: word_size nth_shiftl test_bit_of_take_bits)\n }\n note 1 = this\n {\n fix x :: \"64 word\"\n have \"rev (\\0,0\\(\\63,0\\((\\63,8\\x << 8 :: 1000 word) OR 1)::64 word)) = [1]\"\n apply auto\n apply (intro nth_equalityI)\n apply (auto simp add: nth_bytes_of)\n apply (intro word_eqI)\n by (auto simp add: word_size nth_shiftl test_bit_of_take_bits word_ao_nth)\n }\n note 2 = this\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 1)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: 2)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules )\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply (auto simp add: )\n by (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl bv_to_bool_def word_lsb_alt)\nqed\n\n(*---------------------------------------------------proofs on sete ---------------------------------------*)\nlemma is_manual_sete_r8[is_manual]:\n shows \\is_manual assembly semantics (Unary (IS_80386 Sete) (Storage (Reg (General EightLow r)))) = False\\\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sete_r8[presimplify]:\n \\get_semantics assembly semantics (Unary (IS_80386 Sete) (Storage (Reg (General EightLow r)))) si =\n (\\\\. let op1 = regs \\ r in\n \\\\regs := (regs \\)(r := \\63,0\\((\\63,8\\regs \\ r << 8::64 word) OR (if flags \\ flag_zf then 1 else 0)))\\)\\\n apply (rule ext)\n apply (subst get_semantics_def)\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply (rewrite_one_let' add: semantics_def)\n apply rewrite_one_let'+\n apply (auto simp add: simp_rules)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply auto\n apply (rule word_eqI)\n apply (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply rewrite_one_let'\n apply (rewrite_one_let' add: semantics_def)\n apply rewrite_one_let'+\n apply (auto simp add: simp_rules)\n apply (subst bv_cat'_def)\n apply (auto simp add: bv_cat.simps)\n apply (intro state_eqI)\n apply (rule ext)\n apply auto\n apply (rule word_eqI)\n by (auto simp add: word_size word_ao_nth test_bit_of_take_bits nth_shiftl)\n\n(*---------------------------------------------------proofs on cmp ---------------------------------------*)\nlemma is_manual_cmp_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_r32_r32[presimplify]:\n shows \"get_semantics assembly semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32_2 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32_1 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\regs \\ r32_1 - \\31,0\\regs \\ r32_2) :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\nqed\n\nlemma is_manual_cmp_r32_m32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 a))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_r32_m32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 a))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32 :: 32 word;\n op2 = \\31,0\\(read_mem64 \\ \\ 32 a) :: 32 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of :=(sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 a)) :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\regs \\ r32 - \\31,0\\fst (read_memory \\ \\ 32 a)) :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\nqed\n\n\nlemma is_manual_cmp_r32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_r32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Reg (General ThirtyTwo r1)) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ . let op1 = (\\31,0\\regs \\ r1 :: 32 word);\n op2 = \\31,0\\(word_of_int Imm32 :: 64 word)\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r1 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\(word_of_int Imm32 :: 64 word) :: 32 word)\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\n\n\n\n\nlemma is_manual_cmp_m32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Memory 32 a) (Storage (Reg (General ThirtyTwo r32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_m32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Memory 32 a) (Storage (Reg (General ThirtyTwo r32)))) si = \n (\\ \\ . let op2 = \\31,0\\regs \\ r32 :: 32 word;\n op1 = \\31,0\\(read_mem64 \\ \\ 32 a) :: 32 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of :=(sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (subst add.commute[of \"ucast (NOT \\31,0\\regs \\ r32)\"])\n by auto\n subgoal for \\\n apply (subst add.commute[of \"ucast (NOT \\31,0\\regs \\ r32)\"])\n apply (subst sign_sub_bit32)\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 a)) :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 a)) - \\31,0\\regs \\ r32 :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits)\n done\nqed\n\n\nlemma is_manual_cmp_r64_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Reg (General SixtyFour r64_1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_r64_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Reg (General SixtyFour r64_1)) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = (word_of_int Imm32 :: 64 word)\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (subst sextend_useless_64_64)\n unfolding bv_slice.simps\n apply (auto simp add:ucast_bitNOT ucast_id)\n done\n subgoal for \\\n apply (subst sextend_useless_64_64)\n using overflow_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n apply (subst sextend_useless_64_64)\n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal for \\\n apply (subst useless_sextend_hardocded_ucast)\n apply (subst useless_sextend_hardocded_ucast)\n apply (subst sextend_useless_64_64)\n apply(subst test_64b_of_AND1000_word[symmetric, where ?w=\"regs \\ r64_1\"])\n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules)\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"word_of_int Imm32 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"regs \\ r64_1 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(regs \\ r64_1 - word_of_int Imm32) :: 64 word\"]\n using sub_overflow_flag64_bit[where ?b=\"word_of_int Imm32 :: 64 word\" and ?a=\"regs \\ r64_1\"]\n apply (auto simp add: word_msb_sint msb_nth test_bit_of_take_bits)\n done\n done\n\n\n\nlemma is_manual_cmp_m64_Imm64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Memory 64 Mem) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_m64_Imm64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Memory 64 Mem) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ .let op1 = read_mem64 \\ \\ 64 Mem;\n op2 = (word_of_int Imm32 :: 64 word)\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (subst sextend_useless_64_64)\n unfolding bv_slice.simps\n apply (auto simp add:ucast_bitNOT ucast_id)\n done\n subgoal for \\\n apply (subst sextend_useless_64_64)\n\n using overflow_sub_bit64[where ?a=\"fst (read_memory \\ \\ 64 Mem)\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n apply (subst sextend_useless_64_64)\n using sign_sub_bit64[where ?a=\"fst (read_memory \\ \\ 64 Mem)\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal for \\\n apply (subst useless_sextend_hardocded_ucast)\n apply (subst useless_sextend_hardocded_ucast)\n apply (subst sextend_useless_64_64)\n apply(subst test_64b_of_AND1000_word[symmetric, where ?w=\"fst (read_memory \\ \\ 64 Mem)\"])\n using sign_sub_bit64[where ?a=\"fst (read_memory \\ \\ 64 Mem)\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules)\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"word_of_int Imm32 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"fst (read_memory \\ \\ 64 Mem) :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(fst (read_memory \\ \\ 64 Mem) - word_of_int Imm32) :: 64 word\"]\n using sub_overflow_flag64_bit[where ?b=\"word_of_int Imm32 :: 64 word\" and ?a=\"fst (read_memory \\ \\ 64 Mem)\"]\n apply (auto simp add: word_msb_sint msb_nth test_bit_of_take_bits)\n done\n done\n\n\n\nlemma is_manual_cmp_m8_Imm8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Memory 8 Mem) (Immediate (ImmSixtyFour Imm8))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma take_bits_remove_NOT:\n fixes a :: \"64 word\"\n shows \"\\7,0\\(NOT (\\7,0\\a :: 1000 word)) = ((NOT \\7,0\\a) :: 8 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\nlemma take_bits_lt_bit8[get_semantics_rewriting]:\n fixes a b :: \"'b::len0 word\"\n assumes \"8 \\ LENGTH('a)\"\n and \"8 \\ LENGTH('b)\"\n shows \"(((\\7,0\\a)::'a::len0 word) < ((\\7,0\\b)::'a::len0 word)) = (((\\7,0\\a)::8 word) < ((\\7,0\\b)::8 word))\"\nproof-\n have 1: \"\\i\\8. i < length (rev (to_bl ((\\7,0\\a)::'a::len0 word))) \\ \\rev (to_bl ((\\7,0\\a)::'a::len0 word)) ! i\"\n using assms\n by (auto simp add: rev_nth test_bit_of_take_bits to_bl_nth word_size)\n have 2: \"\\i\\8. i < length (rev (to_bl ((\\7,0\\b)::'a::len0 word))) \\ \\rev (to_bl ((\\7,0\\b)::'a::len0 word)) ! i\"\n using assms\n by (auto simp add: rev_nth test_bit_of_take_bits to_bl_nth word_size)\n have 3: \"\\ a ::'b::len0 word . take 8 (rev (to_bl ((\\7,0\\a)::'a::len0 word))) = rev (to_bl ((\\7,0\\a)::8 word))\"\n proof-\n fix a :: \"'b::len0 word\"\n {\n fix i :: nat\n assume \"i < 8\"\n hence \"take 8 (rev (to_bl ((\\7,0\\a)::'a::len0 word))) ! i = rev (to_bl ((\\7,0\\a)::8 word)) ! i\"\n using assms\n by (auto simp add: rev_nth to_bl_nth word_size test_bit_of_take_bits)\n }\n thus \"?thesis a\"\n using assms\n apply (intro nth_equalityI)\n by (auto)\n qed\n\n show ?thesis\n apply (auto simp add: word_less_rbl)\n apply (subst (asm) rev_bl_order_take[of 8])\n using 1 2 3\n apply auto\n apply (subst rev_bl_order_take[of 8])\n using 1 2 3\n by auto\nqed\n\nlemma take_bits_le_bit8[get_semantics_rewriting]:\n fixes a b :: \"'b::len0 word\"\n assumes \"8 \\ LENGTH('a)\"\n and \"8 \\ LENGTH('b)\"\n shows \"(((\\7,0\\a)::'a::len0 word) \\ ((\\7,0\\b)::'a::len0 word)) = (((\\7,0\\a)::8 word) \\ ((\\7,0\\b)::8 word))\"\nproof-\n have \"(((\\7,0\\a)::'a::len0 word) = ((\\7,0\\b)::'a::len0 word)) = (((\\7,0\\a)::8 word) = ((\\7,0\\b)::8 word))\"\n proof-\n { fix i :: nat\n assume \"(((\\7,0\\a)::'a::len0 word) = ((\\7,0\\b)::'a::len0 word))\"\n hence \"\\ i <8 . (((\\7,0\\a)::'a::len0 word) !! i = (((\\7,0\\b)::'a::len0 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n \n hence \"\\ i < 8 . (((\\7,0\\a)::8 word) !! i = (((\\7,0\\b):: 8 word)) !! i)\"\n using assms\n by (simp add: simp_rules test_bit_of_take_bits)\n hence \"(((\\7,0\\a)::8 word) = ((\\7,0\\b)::8 word))\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n }\n moreover\n {\n assume \"(((\\7,0\\a)::8 word) = ((\\7,0\\b)::8 word))\"\n hence \"\\ i < 8 . (((\\7,0\\a)::8 word) !! i = (((\\7,0\\b)::8 word)) !! i)\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n hence \"\\ i < LENGTH('a) . (((\\7,0\\a)::'a::len0 word) !! i = (((\\7,0\\b)::'a::len0 word)) !! i)\"\n using assms\n by (auto simp add: simp_rules test_bit_of_take_bits)\n hence \"(((\\7,0\\a)::'a::len0 word) = ((\\7,0\\b)::'a::len0 word))\"\n using assms\n apply (intro word_eqI)\n by (auto simp add: word_size)\n }\n ultimately\n show ?thesis\n by auto\n qed\n thus ?thesis\n using assms\n apply (cases \"(((\\7,0\\a)::'a::len0 word) = ((\\7,0\\b)::'a::len0 word))\"; cases \"(((\\7,0\\a)::8 word) = ((\\7,0\\b)::8 word))\";auto)\n by (meson less_imp_le_nat linorder_not_le take_bits_lt_bit8)+\nqed\n\nvalue \"2 ^ 8 :: 65 word\"\n\n\nlemma overflow_sub_bit8[get_semantics_rewriting]:\n fixes a b:: \"'a :: len0 word\"\n assumes \"64\\ LENGTH('a)\"\n shows \"((1::9 word) + (((\\7,0\\a)::9 word) + ucast (NOT ((\\7,0\\b):: 8 word)))) !! 8 = (((\\7,0\\a)::8 word) \\ \\7,0\\b)\"\nproof-\n have 3: \"(((\\7,0\\a)::9 word) \\ \\7,0\\b) = (((\\7,0\\a)::8 word) \\ \\7,0\\b)\"\n using assms\n by (subst take_bits_le_bit8,simp,simp,simp)\n have 1: \"\\ ((\\7,0\\a)::9 word) !! 8\"\n and 2: \"\\ ((\\7,0\\b)::9 word) !! 8\"\n using assms\n by (auto simp add: test_bit_of_take_bits)\n have \"uint ((\\7,0\\a)::9 word) < 256\"\n and \"uint ((\\7,0\\b)::9 word) < 256\"\n using msb_is_gt_2p[unfolded msb_nth,where 'a=9,simplified] 1\n apply (uint_arith)\n using msb_is_gt_2p[unfolded msb_nth,where 'a=9,simplified] 2\n by (uint_arith)\n hence \"((1::9 word) + (((\\7,0\\a)::9 word) + ucast (NOT ((\\7,0\\b):: 8 word)))) !! 8 = (((\\7,0\\a)::9 word) \\ \\7,0\\b)\"\n apply (subst ucast_bitNOT)\n apply simp\n apply (subst twos_complement_subtraction)\n apply simp\n apply (subst msb_is_gt_2p[unfolded msb_nth,where 'a=9,simplified])\n apply auto\n apply uint_arith\n using assms\n apply (auto simp add: is_up)\n apply uint_arith\n using assms\n by (auto simp add: is_up)\n thus ?thesis\n using 3\n by auto\nqed\n\n\nlemma sign_sub_bit8[get_semantics_rewriting]:\n fixes a b:: \"'a :: len0 word\"\n assumes \"63 < LENGTH('a)\"\n shows \"((1::9 word) + (((\\7,0\\a)::9 word) + ucast (NOT ((\\7,0\\b):: 8 word)))) !! 7 \\ sint (((\\7,0\\a):: 8 word) - \\7,0\\b) < 0\"\nproof-\n have 1: \"\\ a :: 9 word . a !! 7 = ((\\7,0\\a):: 8 word) !! 7\"\n using assms\n by (auto simp add: test_bit_of_take_bits nth_ucast)\n have 2: \"\\7,0\\((1::9 word) + (((\\7,0\\a)::9 word) + ucast (NOT ((\\7,0\\b):: 8 word)))) = (((\\7,0\\a)::8 word) - \\7,0\\b)\"\n using assms\n apply (subst ucast_bitNOT)\n apply simp\n apply (subst twos_complement_subtraction)\n apply (subst take_bits_minus)\n apply (simp)\n apply (simp)\n by (simp)\n have 3: \"... !! 7 \\ sint (((\\7,0\\a):: 8 word) - \\7,0\\b) < 0\"\n using msb_nth[symmetric, where 'a=8]\n by (simp add: word_msb_sint)\n show ?thesis\n apply (subst 1)\n apply (subst 2)\n apply (subst 3)\n by simp\nqed\n\n\nlemma test_8b_of_8AND1000_word[get_semantics_rewriting]:\n fixes a :: \"1000 word\"\n shows \"a !! 8 = (\\8,0\\a :: 9 word) !! 8\"\n by (auto simp add:simp_rules test_bit_of_take_bits)\n\nlemma take_bits_remove_NOT_1000word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\7,0\\(NOT (\\7,0\\a :: 1000 word)) = (\\7,0\\(NOT a) :: 1000 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\nlemma take_bits_remove_NOT_9word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\7,0\\(NOT (\\7,0\\a :: 9 word)) = (\\7,0\\(NOT a) :: 9 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\n\nlemma take_bits_remove_UCAST_NOT_9word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\7,0\\(NOT a) :: 9 word) = (ucast (NOT (\\7,0\\a :: 8 word)) :: 9 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\nlemma take_bits_remove_UCAST_NOT_1000word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\7,0\\(NOT (\\7,0\\a :: 1000 word)) = (ucast (NOT (\\7,0\\a :: 8 word)) :: 9 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\nlemma take_bits_remove_UCAST_NOT_9word_2[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\7,0\\(NOT (\\7,0\\a :: 9 word)) = (ucast (NOT (\\7,0\\a :: 8 word)) :: 9 word)\"\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size bitNOT_nth)\n\nlemma test_bit7_of_64_and_1000word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a :: 1000 word) !! 7 = (\\7,0\\a :: 8 word) !! 7\"\n by (auto simp add:test_bit_of_take_bits)\n\n\nlemma sub_overflow_flag8_bit[get_semantics_rewriting]:\n fixes a b :: \"'a::len0 word\"\n assumes \"LENGTH('a) \\ 64\"\n shows \"((\\ b !! 7) = a !! 7 \\ b !! 7 = (sint (\\7,0\\a - \\7,0\\b::8 word) < 0)) \\\n ((128::8 word) > \\7,0\\b \\ sint (\\7,0\\a - \\7,0\\b::8 word) \\ 0 \\ (128::8 word) \\ \\7,0\\a)\n \\\n ((128::8 word) \\ \\7,0\\b \\ sint (\\7,0\\a - \\7,0\\b::8 word) < 0 \\ (128::8 word) > \\7,0\\a)\"\nproof-\n have 1: \"a !! 7 = msb (\\7,0\\ a :: 8 word)\"\n and 2: \"b !! 7 = msb (\\7,0\\ b :: 8 word)\"\n using assms\n by (auto simp add: msb_nth test_bit_of_take_bits)\n show ?thesis\n using assms\n apply (subst 1)\n apply (subst 2)+\n apply (subst msb_is_gt_2p)+\n apply simp\n by (auto)\nqed\n\n\n\nlemma BV_Add_bit9:\n fixes a b :: longword\n shows \"(a,9) +\\<^sup>b\\<^sup>v (b,9) = (ucast (((\\8,0\\a)::9 word) + \\8,0\\b), 9)\"\nproof-\n have \"(a,9) +\\<^sup>b\\<^sup>v (b,9) = (\\8,0\\(a + b), 9)\"\n by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n also have \"... = (ucast ((\\8,0\\(a + b))::9 word), 9)\"\n by (subst ucast_take_bits,simp,simp,simp)\n also have \"... = (ucast (((\\8,0\\a)::9 word) + \\8,0\\b), 9)\"\n by (subst take_bits_plus,simp,simp,simp)\n finally\n show ?thesis\n by auto\nqed\n\nlemma get_semantics_cmp_m8_Imm8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Memory 8 Mem) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ .let op1 = \\7,0\\read_mem64 \\ \\ 8 Mem :: 8 word;\n op2 = \\7,0\\(word_of_int Imm32 :: 64 word) :: 8 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add:BV_Add_bit9)+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add:simp_rules exec_BV_Plus_def take_bits_remove_NOT)\n done\n subgoal for \\\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using overflow_sub_bit8[where ?a=\"fst (read_memory \\ \\ 8 Mem)\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules take_bits_remove_UCAST_NOT_9word)\n done\n subgoal for \\\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using sign_sub_bit8[where ?a=\"fst (read_memory \\ \\ 8 Mem)\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"fst (read_memory \\ \\ 8 Mem)\"])\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"word_of_int Imm32\"])\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"word_of_int Imm32\"])\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using sign_sub_bit8[where ?a=\"fst (read_memory \\ \\ 8 Mem)\" and ?b=\"word_of_int Imm32\", simplified]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\7,0\\word_of_int Imm32 :: 8 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\7,0\\fst (read_memory \\ \\ 8 Mem) :: 8 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\7,0\\fst (read_memory \\ \\ 8 Mem) - \\7,0\\word_of_int Imm32) :: 8 word\"]\n apply (auto simp add:simp_rules test_bit_of_take_bits)\n done\n done\n\n\n\nlemma is_manual_cmp_r8_m8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Reg (General EightLow r1)) (Storage (Memory 8 a))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_r8_m8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Reg (General EightLow r1)) (Storage (Memory 8 a))) si = \n (\\ \\ . let op1 = \\7,0\\regs \\ r1 :: 8 word;\n op2 = \\7,0\\(read_mem64 \\ \\ 8 a) :: 8 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add:BV_Add_bit9)+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add:simp_rules exec_BV_Plus_def take_bits_remove_NOT)\n done\n subgoal for \\\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using overflow_sub_bit8[where ?a=\"regs \\ r1\" and ?b=\"fst (read_memory \\ \\ 8 a)\", simplified]\n apply (auto simp add:simp_rules take_bits_remove_UCAST_NOT_9word)\n done\n subgoal for \\\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using sign_sub_bit8[where ?a=\"regs \\ r1\" and ?b=\"fst (read_memory \\ \\ 8 a)\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"regs \\ r1\"])\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"fst (read_memory \\ \\ 8 a)\"])\n apply(subst test_bit7_of_64_and_1000word[where ?a=\"fst (read_memory \\ \\ 8 a)\"])\n apply (subst take_bits_remove_UCAST_NOT_1000word)\n using sign_sub_bit8[where ?a=\"regs \\ r1\" and ?b=\"fst (read_memory \\ \\ 8 a)\", simplified]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\7,0\\regs \\ r1 :: 8 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\7,0\\fst (read_memory \\ \\ 8 a) :: 8 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\7,0\\regs \\ r1 - \\7,0\\fst (read_memory \\ \\ 8 a)) :: 8 word\"]\n apply (auto simp add:simp_rules)\n done\n done\n\n\n\nlemma is_manual_cmp_m32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Cmp) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmp_m32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Cmp) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = \\31,0\\(read_mem64 \\ \\ 32 Mem :: 64 word) :: 32 word;\n op2 = \\31,0\\(word_of_int Imm32 :: 64 word) :: 32 word\n in\n \\\\flags := (flags \\)\n (flag_pf := undefined,\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n using sign_sub_bit32[where ?a=\"fst (read_memory \\ \\ 32 Mem)\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add: simp_rules)\n done\n subgoal for \\\n apply (subst test_32b_of_32AND64_word[where ?a=\"fst (read_memory \\ \\ 32 Mem)\"])\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\word_of_int Imm32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\fst (read_memory \\ \\ 32 Mem) :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 Mem) - \\31,0\\word_of_int Imm32) :: 32 word\"]\n \n using sign_sub_bit32[where ?a=\"fst (read_memory \\ \\ 32 Mem)\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add: simp_rules test_bit_of_take_bits)\n done\n done\n\n\n(*---------------------------------------------------proofs on test ---------------------------------------*)\n\nlemma take_bits_AND_zero_64_word[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a AND \\63,0\\b = (0::1000 word)) \\ (a AND b = (0 :: 64 word))\"\nproof-\n {\n assume 1: \"(\\63,0\\a AND \\63,0\\b = (0::1000 word))\"\n hence 2: \"\\ i < 1000 . (\\63,0\\a AND \\63,0\\b :: 1000 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(a AND b = (0 :: 64 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 64\"\n hence \"(a AND b :: 64 word) !! i = (0 :: 64 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n moreover\n {\n assume 1: \"(a AND b = (0::64 word))\"\n hence 2: \"\\ i < 64 . (a AND b :: 64 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(\\63,0\\a AND \\63,0\\b = (0 :: 1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \"(\\63,0\\a AND \\63,0\\b :: 1000 word) !! i = (0 :: 1000 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\n\n\nlemma take_bits_AND_zero_32_word[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"(\\31,0\\a AND \\31,0\\b = (0::1000 word)) \\ (\\31,0\\a AND \\31,0\\b = (0 :: 32 word))\"\nproof-\n {\n assume 1: \"(\\31,0\\a AND \\31,0\\b = (0::1000 word))\"\n hence 2: \"\\ i < 1000 . (\\31,0\\a AND \\31,0\\b :: 1000 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(\\31,0\\a AND \\31,0\\b = (0 :: 32 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 32\"\n hence \"(\\31,0\\a AND \\31,0\\b :: 32 word) !! i = (0 :: 32 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n moreover\n {\n assume 1: \"(\\31,0\\a AND \\31,0\\b = (0::32 word))\"\n hence 2: \"\\ i < 32 . (\\31,0\\a AND \\31,0\\b :: 32 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(\\31,0\\a AND \\31,0\\b = (0 :: 1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \"(\\31,0\\a AND \\31,0\\b :: 1000 word) !! i = (0 :: 1000 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\n\nlemma take_bits_AND_zero_16_word[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"(\\15,0\\a AND \\15,0\\b = (0::1000 word)) \\ (\\15,0\\a AND \\15,0\\b = (0 :: 16 word))\"\nproof-\n {\n assume 1: \"(\\15,0\\a AND \\15,0\\b = (0::1000 word))\"\n hence 2: \"\\ i < 1000 . (\\15,0\\a AND \\15,0\\b :: 1000 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(\\15,0\\a AND \\15,0\\b = (0 :: 16 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 16\"\n hence \"(\\15,0\\a AND \\15,0\\b :: 16 word) !! i = (0 :: 16 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n moreover\n {\n assume 1: \"(\\15,0\\a AND \\15,0\\b = (0::16 word))\"\n hence 2: \"\\ i < 16 . (\\15,0\\a AND \\15,0\\b :: 16 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"(\\15,0\\a AND \\15,0\\b = (0 :: 1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \"(\\15,0\\a AND \\15,0\\b :: 1000 word) !! i = (0 :: 1000 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\n\n\nlemma bool_to_bv_eq_fst[get_semantics_rewriting]:\n shows \"fst (bool_to_bv b) = x \\ (x \\ {0,1} \\ ((x = 1) \\ b))\"\n by (cases b,auto)\n\nlemma fst_bool_to_bv_AND_def[get_semantics_rewriting]:\n shows \"(fst (bool_to_bv a) AND fst (bool_to_bv b)) = (if a \\ b then 1 else 0)\"\n by (auto simp add:bool_to_bv_eq_fst )\n\nlemma is_manual_test_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Test) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_test_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Test) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\flags := (flags \\)\n (flag_zf := (op1 AND op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint op1 < 0) \\ (sint op2 < 0),\n flag_pf := undefined) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n subgoal for \\ \n apply(subst word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1 :: 32 word\", symmetric, unfolded msb_nth])\n apply(subst word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_2 :: 32 word\", symmetric, unfolded msb_nth])\n by (auto simp add:simp_rules take_bits_AND_zero_32_word msb_nth flags_eqI test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\n qed\n\n\nlemma is_manual_test_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Test) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_test_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Test) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\flags := (flags \\)\n (flag_zf := (op1 AND op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint op1 < 0) \\ (sint op2 < 0),\n flag_pf := undefined) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n subgoal for \\ \n apply(subst word_msb_sint[where ?w=\"regs \\ r64_1\", symmetric, unfolded msb_nth])\n apply(subst word_msb_sint[where ?w=\"regs \\ r64_2\", symmetric, unfolded msb_nth])\n find_theorems \"\\?h,?l\\?a AND \\?h,?l\\?b = 0\"\n by (auto simp add:simp_rules take_bits_AND_zero_64_word msb_nth flags_eqI test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\n qed\n\n\nlemma is_manual_test_r16_r16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Test) (Reg (General Sixteen r16_1)) (Storage (Reg (General Sixteen r16_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_test_r16_r16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Test) (Reg (General Sixteen r16_1)) (Storage (Reg (General Sixteen r16_2)))) si =\n (\\ \\ . let op1 = \\15,0\\regs \\ r16_1 :: 16 word;\n op2 = \\15,0\\regs \\ r16_2 :: 16 word\n in\n \\\\flags := (flags \\)\n (flag_zf := (op1 AND op2) = (0 :: 16 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint op1 < 0) \\ (sint op2 < 0),\n flag_pf := undefined) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n subgoal for \\ \n apply(subst word_msb_sint[where ?w=\"\\15,0\\regs \\ r16_1 :: 16 word\", symmetric, unfolded msb_nth])\n apply(subst word_msb_sint[where ?w=\"\\15,0\\regs \\ r16_2 :: 16 word\", symmetric, unfolded msb_nth])\n by (auto simp add:simp_rules take_bits_AND_zero_16_word msb_nth flags_eqI test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\nqed \n\n\n(*---------------------------------------------------proofs on xor ---------------------------------------*)\n\nlemma take_bits_bitXOR[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"((\\63,0\\(a XOR b)) :: 1000 word) = ((\\63,0\\a) :: 1000 word) XOR ((\\63,0\\b))\"\nproof-\n {\nfix n :: nat\n assume 1: \"n < 64\"\n hence \"((\\63,0\\(a XOR b)) :: 1000 word) !! n = (((\\63,0\\a) :: 1000 word) XOR \\63,0\\b) !! n \"\n using 1\n apply (subst test_bit_of_take_bits)\n by (auto simp add: simp_rules test_bit_of_take_bits word_ao_nth bitXOR_nth)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size word_ao_nth bitXOR_nth)\nqed\n\nlemma take_bits_bitXOR2:\n fixes a b :: \"64 word\"\n shows \" ((\\63,0\\a) :: 1000 word) XOR ((\\63,0\\b)) = ((\\63,0\\(a XOR b)) :: 1000 word)\"\nproof-\n {\nfix n :: nat\n assume 1: \"n < 64\"\n hence \"(((\\63,0\\a) :: 1000 word) XOR \\63,0\\b) !! n = ((\\63,0\\(a XOR b)) :: 1000 word) !! n \"\n using 1\n apply (subst test_bit_of_take_bits)\n by (auto simp add: simp_rules test_bit_of_take_bits word_ao_nth bitXOR_nth)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add:simp_rules test_bit_of_take_bits word_size word_ao_nth bitXOR_nth)\nqed\n\n\n\nlemma take_bits_XOR_eq_zero_64word[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"((\\63,0\\a XOR \\63,0\\b) = (0::1000 word)) \\ ((a XOR b) = (0::64 word))\"\nproof-\n {\n assume 1: \"((\\63,0\\a XOR \\63,0\\b) = (0::1000 word))\"\n hence 2: \"\\ i<1000. (((\\63,0\\a XOR \\63,0\\b) :: 1000 word) !! i = False)\"\n apply (subst 1)+\n by auto\n have \"((a XOR b) = (0::64 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 64\"\n hence \"((a XOR b) !! i = (0 :: 64 word) !! i)\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI )\n qed\n }\n moreover\n {\n assume 1: \"((a XOR b) = (0::64 word))\"\n hence 2: \"\\ i < 64 . ((a XOR b) !! i = False)\"\n apply (subst 1)\n by auto\n have \"((\\63,0\\a XOR \\63,0\\b) = (0::1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \" (((\\63,0\\a XOR \\63,0\\b):: 1000 word) !! i = (0 :: 1000 word) !! i)\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\nlemma take_bits_XOR_eq_zero_32word[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"((\\31,0\\a XOR \\31,0\\b) = (0::1000 word)) \\ ((\\31,0\\a XOR \\31,0\\b) = (0::32 word))\"\nproof-\n {\n assume 1: \"((\\31,0\\a XOR \\31,0\\b) = (0::1000 word))\"\n hence 2: \"\\ i<1000. (((\\31,0\\a XOR \\31,0\\b) :: 1000 word) !! i = False)\"\n apply (subst 1)+\n by auto\n have \"(((\\31,0\\a XOR \\31,0\\b) :: 32 word) = (0::32 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 32\"\n hence \"(((\\31,0\\a XOR \\31,0\\b) :: 32 word) !! i = (0 :: 32 word) !! i)\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI )\n qed\n }\n moreover\n {\n assume 1: \"(((\\31,0\\a XOR \\31,0\\b) :: 32 word) = (0::32 word))\"\n hence 2: \"\\ i < 32 . (((\\31,0\\a XOR \\31,0\\b) :: 32 word) !! i = False)\"\n apply (subst 1)\n by auto\n have \"(((\\31,0\\a XOR \\31,0\\b) :: 1000 word) = (0::1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \" (((\\31,0\\a XOR \\31,0\\b):: 1000 word) !! i = (0 :: 1000 word) !! i)\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\nlemma parity_bit64[simp]:\n fixes a :: \"'b::len0 word\"\n assumes \"LENGTH('a) > 64\"\n and \"LENGTH('b) \\ 64\"\n shows \"parity (\\63,0\\ a :: 'a::len0 word) = parity (\\63,0\\ a :: 64 word)\"\nproof-\n {\n fix i\n assume \"i < LENGTH('a)\"\n hence \"(\\63,0\\ a :: 'a::len0 word) !! i = (ucast (\\63,0\\ a :: 64 word) :: 'a::len0 word) !! i\"\n using assms\n by (auto simp add: test_bit_of_take_bits nth_ucast)\n }\n hence 1: \"(\\63,0\\ a :: 'a::len0 word) = (ucast (\\63,0\\ a :: 64 word) :: 'a::len0 word)\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n show ?thesis\n apply (subst 1)\n apply (subst parity_ucast)\n using assms 1\n by auto\nqed\n\n\nlemma fst_bool_to_bv_XOR_def[get_semantics_rewriting]:\n shows \"(fst (bool_to_bv a) XOR fst (bool_to_bv b)) = (if (a\\b) then 1 else 0)\"\n by (auto simp add:bool_to_bv_eq_fst )\n\n(* Proofs on Xor *)\nlemma is_manual_test_xor_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Xor) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_xor_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Xor) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op1 XOR op2),\n flags := (flags \\)\n (flag_zf := (op1 XOR op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := (sint(op1 XOR op2) < 0 ),\n flag_pf := parity(op1 XOR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_XOR_eq_zero_64word)\n done\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2 )\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"regs \\ r64_1 XOR regs \\ r64_2\"]\n by (auto simp add:msb_nth fst_bool_to_bv_XOR_def bitXOR_nth test_bit_of_take_bits)\n done\nqed\n\nlemma is_manual_test_xor_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Xor) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_xor_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Xor) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\regs := (regs \\)(r32_1 := ucast(op1 XOR op2)),\n flags := (flags \\)\n (flag_zf := (op1 XOR op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint (op1 XOR op2) < 0),\n flag_pf := parity(op1 XOR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_XOR_eq_zero_32word)\n done\n subgoal for \\\n apply (auto simp add:simp_rules parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1 XOR \\31,0\\regs \\ r32_2\"]\n by (auto simp add:msb_nth fst_bool_to_bv_XOR_def bitXOR_nth test_bit_of_take_bits)\n done\nqed\n\nlemma is_manual_test_xor_r64_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Xor) (Reg (General SixtyFour r64_1)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\n\n\nlemma get_semantics_xor_r64_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Xor) (Reg (General SixtyFour r64_1)) (Storage (Memory 64 Mem))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op1 XOR op2),\n flags := (flags \\)\n (flag_zf := (op1 XOR op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := (sint(op1 XOR op2) < 0 ),\n flag_pf := parity(op1 XOR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_XOR_eq_zero_64word)\n done\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2 )\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"regs \\ r64_1 XOR read_mem64 \\ \\ 64 Mem\"]\n by (auto simp add:msb_nth fst_bool_to_bv_XOR_def bitXOR_nth test_bit_of_take_bits)\n done\nqed\n\nlemma is_manual_test_xor_m32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Xor) (Memory 32 Mem) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_xor_m32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Xor) (Memory 32 Mem) (Storage (Reg (General ThirtyTwo r32_2)))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = \\31,0\\read_mem64 \\ \\ 32 Mem;\n\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\mem := write_blocks [a \\ rev (\\3,0\\ (op1 XOR op2))] (mem \\),\n flags := (flags \\)\n (flag_zf := (op1 XOR op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint (op1 XOR op2) < 0),\n flag_pf := parity(op1 XOR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_bitXOR2 resolve_address_after_update_flag)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules take_bits_XOR_eq_zero_32word)\n done\n subgoal for \\\n apply (auto simp add:simp_rules parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\read_mem64 \\ \\ 32 Mem XOR \\31,0\\regs \\ r32_2\"]\n by (auto simp add:msb_nth fst_bool_to_bv_XOR_def bitXOR_nth test_bit_of_take_bits)\n done\nqed\n\n\n(*---------------------------------------------------proofs on or ---------------------------------------*)\n\n\nlemma test_bit_of_extended_word_64[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\63,0\\a :: 1000 word) !! 63 = a !! 63\"\n using test_bit_of_take_bits[of 63 63 0 \"\\63,0\\a::1000 word\",where ?'a=64]\n by auto\n\n\n\n(* Proofs on or *)\n\n\nlemma extended_AND_iff_orig_AND[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"(\\63,0\\a = (0::1000 word) \\ \\63,0\\b = (0::1000 word)) \\ (a = (0::64 word) \\ b = (0::64 word))\"\nproof-\n {\n assume 1: \"(\\63,0\\a = (0::1000 word) \\ \\63,0\\b = (0::1000 word))\"\n hence 2: \"\\ i<1000. ((\\63,0\\a :: 1000 word) !! i = False) \\ ((\\63,0\\b :: 1000 word) !! i = False)\"\n apply (subst 1)+\n by auto\n have \"(a = (0::64 word) \\ b = (0::64 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 64\"\n hence \"((a !! i = (0 :: 64 word) !! i) \\ (b !! i = (0 :: 64 word) !! i))\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n moreover\n {\n assume 1: \"(a = (0::64 word) \\ b = (0::64 word))\"\n hence 2: \"\\ i < 64 . ((a !! i = False) \\ (b !! i = False))\"\n apply (subst 1)\n by auto\n have \"(\\63,0\\a = (0::1000 word) \\ \\63,0\\b = (0::1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \"( ((\\63,0\\a :: 1000 word) !! i = (0 :: 1000 word) !! i) \\ ((\\63,0\\b :: 1000 word) !! i = (0 :: 1000 word) !! i))\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\nlemma extended_AND_iff_orig_AND_32[get_semantics_rewriting]:\n fixes a b :: \"64 word\"\n shows \"(\\31,0\\a = (0::1000 word) \\ \\31,0\\b = (0::1000 word)) \\ (\\31,0\\a = (0::32 word) \\ \\31,0\\b = (0::32 word))\"\nproof-\n {\n assume 1: \"(\\31,0\\a = (0::1000 word) \\ \\31,0\\b = (0::1000 word))\"\n hence 2: \"\\ i<1000. ((\\31,0\\a :: 1000 word) !! i = False) \\ ((\\31,0\\b :: 1000 word) !! i = False)\"\n apply (subst 1)+\n by auto\n have \"(\\31,0\\a = (0::32 word) \\ \\31,0\\b = (0::32 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 32\"\n hence \"(((\\31,0\\a::32 word) !! i = (0 :: 32 word) !! i) \\ ((\\31,0\\b::32 word) !! i = (0 :: 32 word) !! i))\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n moreover\n {\n assume 1: \"((\\31,0\\a :: 32 word) = (0::32 word) \\ (\\31,0\\b :: 32 word) = (0::32 word))\"\n hence 2: \"\\ i < 32 . (((\\31,0\\a ::32 word) !! i = False) \\ ((\\31,0\\b :: 32 word) !! i = False))\"\n apply (subst 1)\n by auto\n have \"((\\31,0\\a :: 1000 word) = (0::1000 word) \\ (\\31,0\\b :: 1000 word) = (0::1000 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \"( ((\\31,0\\a :: 1000 word) !! i = (0 :: 1000 word) !! i) \\ ((\\31,0\\b :: 1000 word) !! i = (0 :: 1000 word) !! i))\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by blast\nqed\n\nlemma take_bits_bitOR_64[get_semantics_rewriting]:\n fixes a b::\"64 word\"\n shows \"((\\63,0\\a OR \\63,0\\b) :: 1000 word) = (\\63,0\\(a OR b) :: 1000 word) \"\n apply (subst take_bits_bitOR[symmetric, where ?h=63 and ?l=0 and ?a=a and ?b=b])\n apply simp\n by simp\n\n\nlemma fst_bool_to_bv_OR_def[get_semantics_rewriting]:\n shows \"(fst (bool_to_bv a) OR fst (bool_to_bv b)) = (if a then 1 else if b then 1 else 0)\"\n by (auto simp add:bool_to_bv_eq_fst )\n\nlemma is_manual_or_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Or) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_or_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Or) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op1 OR op2),\n flags := (flags \\)\n (flag_zf := (op1 OR op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := ((sint(op1)<0) \\ (sint(op2)<0)),\n flag_pf := parity(op1 OR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules take_bits_bitOR)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:extended_AND_iff_orig_AND)\n done\n subgoal for \\\n apply (auto simp add:take_bits_bitOR_64)\n done\n subgoal for \\\n using fst_bool_to_bv_OR_def\n using word_msb_sint[where ?w=\"regs \\ r64_1\"]\n using word_msb_sint[where ?w=\"regs \\ r64_2\"]\n by (auto simp add: msb_nth test_bit_of_take_bits simp_rules)\n done\n qed\n\n\nlemma is_manual_or_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r64_1)) (Storage (Reg (General ThirtyTwo r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_or_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r64_1)) (Storage (Reg (General ThirtyTwo r64_2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r64_1 :: 32 word;\n op2 = \\31,0\\ regs \\ r64_2 :: 32 word\n in\n \\\\regs := (regs \\)(r64_1 := \\31,0\\(op1 OR op2)),\n flags := (flags \\)\n (flag_zf := (op1 OR op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := (((op1 !! 31) \\ (op2 !! 31)) = True),\n flag_pf := parity(op1 OR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules take_bits_bitOR)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:extended_AND_iff_orig_AND_32)\n done\n subgoal for \\\n apply (simp add: simp_rules parity_ucast take_bits_bitOR)\n done\n subgoal for \\\n using fst_bool_to_bv_OR_def\n by (auto simp add:test_bit_of_take_bits simp_rules)\n done\n qed\n\n\nlemma is_manual_or_r32_m32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r64_1)) (Storage (Memory 32 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_or_r32_m32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r64_1)) (Storage (Memory 32 Mem))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r64_1 :: 32 word;\n op2 = \\31,0\\(read_mem64 \\ \\ 32 Mem) :: 32 word\n in\n \\\\regs := (regs \\)(r64_1 := ucast(op1 OR op2)),\n flags := (flags \\)\n (flag_zf := (op1 OR op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := (((op1 !! 31) \\ (op2 !! 31)) = True),\n flag_pf := parity(op1 OR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (simp add: simp_rules)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:extended_AND_iff_orig_AND_32)\n done\n subgoal for \\\n apply (simp add: simp_rules parity_ucast take_bits_bitOR)\n done\n subgoal for \\\n using fst_bool_to_bv_OR_def\n by (auto simp add:test_bit_of_take_bits simp_rules)\n done\n qed\n\n\nlemma useless_take_bits_ucast[get_semantics_rewriting]:\n shows \"(\\31,0\\(a :: 1000 word) :: 1000 word) = ucast (\\31,0\\a :: 32 word) \"\n by auto\n\n\nlemma useless_and_generic[get_semantics_rewriting]:\n fixes a::\"'a::len word\"\n assumes \"LENGTH('b :: len) < LENGTH('a)\" \n and \"h = LENGTH('b) - 1\"\n shows \"\\h,0\\a AND ((2^LENGTH('b) - 1) :: 'b:: len word) = (\\h,0\\a :: 'b:: len word)\"\nproof-\n show ?thesis\n using max_word_eq\n apply (subst max_word_eq[symmetric])\n by auto\nqed\n\nlemma useless_sextend_hardocded_32_word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\31,0\\((sextend (\\63,0\\a :: 1000 word) 64 32) :: 1000 word) = (\\31,0\\a ::32 word)\"\nproof-\n show ?thesis\n unfolding sextend.simps\n apply (auto simp add: simp_rules mask_def)\n apply (subst Word.word_bool_alg.conj_disj_distrib2)\n apply (auto)\n apply (subst take_bits_remove[where ?w=\"a\" and ?h=\"63\", simplified])\n apply (subst take_bits_bitAND)\n apply auto\n apply (subst useless_and_generic[where ?a=a and ?h=31 and ?'b=32, simplified])\n by auto\n qed\n\nlemma is_manual_or_r32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_or_r32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Or) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = (word_of_int Imm32) :: 64 word\n in\n \\\\regs := (regs \\)(r32_1 := ucast(op1 OR \\31,0\\op2)),\n flags := (flags \\)\n (flag_zf := (op1 OR \\31,0\\op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := sint(op1 OR \\31,0\\op2) < 0,\n flag_pf := parity(op1 OR \\31,0\\op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (simp add: simp_rules useless_sextend_hardocded_32_word)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:useless_sextend_hardocded_32_word extended_AND_iff_orig_AND_32)\n done\n subgoal for \\\n apply (simp add: simp_rules parity_ucast take_bits_bitOR)\n done\n subgoal for \\\n apply (subst word_msb_sint[where ?w=\"(\\31,0\\regs \\ r32_1 OR \\31,0\\word_of_int Imm32) :: 32 word\", unfolded msb_nth, symmetric])\n apply (subst word_ao_nth[where ?x=\"(\\31,0\\regs \\ r32_1) :: 32 word\" and ?y=\"(\\31,0\\word_of_int Imm32) :: 32 word\" and ?n=\"(LENGTH(32) - 1)\"])\n using fst_bool_to_bv_OR_def\n by (auto simp add:test_bit_of_take_bits simp_rules)\n done\n qed\n\n\nlemma is_manual_or_r64_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Or) (Reg (General SixtyFour r64_1)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_or_r64_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Or) (Reg (General SixtyFour r64_1)) (Storage (Memory 64 Mem))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op1 OR op2),\n flags := (flags \\)\n (flag_zf := (op1 OR op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := ((sint(op1)<0) \\ (sint(op2)<0)),\n flag_pf := parity(op1 OR op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules take_bits_bitOR)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:extended_AND_iff_orig_AND)\n done\n subgoal for \\\n apply (auto simp add:take_bits_bitOR_64)\n done\n subgoal for \\\n apply (subst test_bit_of_extended_word_64[where ?a=\"regs \\ r64_1\"])\n apply (subst test_bit_of_extended_word_64[where ?a=\"read_mem64 \\ \\ 64 Mem\"])\n apply (subst word_msb_sint[where ?w=\"regs \\ r64_1\", symmetric, unfolded msb_nth, simplified])\n apply (subst word_msb_sint[where ?w=\"read_mem64 \\ \\ 64 Mem\", symmetric, unfolded msb_nth, simplified])\n using fst_bool_to_bv_OR_def\n by (auto simp add: msb_nth test_bit_of_take_bits simp_rules)\n done\n qed\n\n\n(*---------------------------------------------------proofs on and ---------------------------------------*)\nlemma is_manual_and_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 And) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_and_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 And) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op1 AND op2),\n flags := (flags \\)\n (flag_zf := (op1 AND op2) = (0 :: 64 word),\n flag_cf := False,\n flag_of := False,\n\n flag_sf := (((op1 !! 63) \\ (op2 !! 63)) = True),\n flag_pf := parity(op1 AND op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (simp add:simp_rules take_bits_bitAND)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n using take_bits_bitAND[where ?h=63 and ?l=0 and ?a=\"regs \\ r64_1\" and ?b=\"regs \\ r64_2\" ]\n apply auto\n done\n subgoal for \\\n apply (subst take_bits_bitAND[symmetric, where ?h=63 and ?l=0 and ?a=\"regs \\ r64_1\" and ?b=\"regs \\ r64_2\", simplified])\n apply (simp add:parity_ucast)\n done\n subgoal for \\\n by (auto simp add:test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\nqed\n\nlemma is_manual_and_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 And) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_and_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 And) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\regs := (regs \\)(r32_1 := ucast(op1 AND op2)),\n flags := (flags \\)\n (flag_zf := (op1 AND op2) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := (sint op1 < 0) \\ (sint op2 < 0),\n flag_pf := parity(op1 AND op2)) \n\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (simp add:simp_rules take_bits_bitAND)\n apply (intro flags_eqI,simp_all)\n apply (simp add:take_bits_AND_zero_32_word)\n apply (simp add: parity_ucast)\n apply (auto simp add: fst_bool_to_bv_AND_def test_bit_of_take_bits)\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1\"]\n apply (auto)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_2\"]\n apply (auto)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_1\"]\n apply (auto)\n done\n subgoal for \\\n using word_msb_sint[where ?w=\"\\31,0\\regs \\ r32_2\"]\n by (auto)\n done\n qed\n\nlemma and_2p_minus_1_32_extended[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\63,0\\a AND (2^(LENGTH(32)) - 1 :: 1000 word) = (\\31,0\\a :: 1000 word)\"\nproof-\n {\n fix n :: nat\n assume 1:\"n < 1000\"\n have a: \"(2^(LENGTH(32)) - 1 :: 1000 word) = ucast (2^(LENGTH(32)) - 1 :: 32 word)\"\n apply (subst max_word_eq[symmetric])\n by (auto simp add:simp_rules max_word_eq)\n have b: \"(mask 32 :: 1000 word) = ucast (mask 32 :: 32 word)\"\n by simp\n have c: \" (mask 32 :: 32 word) = (2^(LENGTH(32)) - 1 :: 32 word)\"\n apply (subst max_word_eq[symmetric])\n by (simp add: max_word_def)\n have d: \"ucast (2^(LENGTH(32)) - 1 :: 32 word) = (mask 32 :: 1000 word)\"\n apply (subst c[symmetric])\n apply (subst b[symmetric])\n by simp\n have e :\"(mask 32 :: 1000 word) !! n = (n < 32)\"\n apply (subst b)\n apply (subst c)\n apply(subst max_word_eq[symmetric])\n by (auto simp add:simp_rules)\n hence \"(\\63,0\\a AND (2^(LENGTH(32)) - 1 :: 1000 word)) !! n = (\\31,0\\a :: 1000 word) !! n\"\n using 1\n apply (subst a)\n apply (subst d)\n by (auto simp add: mask_def word_ao_nth test_bit_of_take_bits e)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\nqed\n\nlemma test_nth_32_bit[get_semantics_rewriting]:\n fixes a:: \"64 word\"\n assumes \"i<32\"\n shows \"(\\63,0\\a :: 1000 word) !! i = (\\31,0\\a :: 32 word) !! i\"\nproof-\n show ?thesis\n using assms\n by(auto simp add:simp_rules test_bit_of_take_bits)\nqed\n\nlemma test_bit_msb_sextend[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(sextend (\\63,0\\a :: 1000 word) 64 32 :: 1000 word) !! 31 = (\\31,0\\sextend (\\63,0\\a :: 1000 word) 64 32 :: 32 word) !! 31\"\nproof-\n show ?thesis\n by (auto simp add:test_bit_of_take_bits)\nqed\n\nlemma is_manual_and_m32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 And) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_and_m32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 And) (Memory 32 Mem) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = read_mem64 \\ \\ 32 Mem;\n op2 = (word_of_int Imm32) :: 64 word in\n \\\\mem := write_blocks [a \\ rev (\\3,0\\ (\\31,0\\(op1 AND op2) :: 32 word))] (mem \\),\n flags := (flags \\)\n (flag_zf := (\\31,0\\(op1 AND op2)) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := sint((\\31,0\\op1 :: 32 word) AND (\\31,0\\op2)) < 0,\n flag_pf := parity(\\31,0\\(op1 AND op2) :: 32 word)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:resolve_address_after_update_flag useless_sextend_hardocded_32_word)\n apply (subst take_bits_bitAND[symmetric, where ?h=31 and ?l=0 and ?a=\"fst (read_memory \\ \\ 32 Mem)\" and ?b=\"word_of_int Imm32\"])\n apply auto\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:take_bits_remove take_bits_bitAND take_bits_AND_zero_32_word)\n done\n subgoal for \\\n apply (auto simp add: parity_ucast take_bits_bitAND)\n done\n subgoal for \\\n apply (subst word_msb_sint[where ?w=\"(\\31,0\\read_mem64 \\ \\ 32 Mem AND \\31,0\\word_of_int Imm32) :: 32 word\", unfolded msb_nth, symmetric])\n apply (subst word_ao_nth[where ?x=\"(\\31,0\\read_mem64 \\ \\ 32 Mem) :: 32 word\" and ?y=\"(\\31,0\\word_of_int Imm32) :: 32 word\" and ?n=\"(LENGTH(32) - 1)\"])\n apply (subst test_nth_32_bit[where ?a=\"read_mem64 \\ \\ 32 Mem\" and i=31])\n by (auto simp add:simp_rules test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\nqed\n\nlemma is_manual_and_r32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 And) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_and_r32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 And) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = (word_of_int Imm32) :: 64 word\n in\n \\\\regs := (regs \\)(r32_1 := (ucast(op1 AND \\31,0\\op2) :: 64 word)),\n flags := (flags \\)\n (flag_zf := ((op1 AND \\31,0\\op2)) = (0 :: 32 word),\n flag_cf := False,\n flag_of := False,\n flag_sf := sint(op1 AND (\\31,0\\op2)) < 0,\n flag_pf := parity(op1 AND \\31,0\\op2)) \\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:take_bits_remove take_bits_bitAND take_bits_AND_zero_32_word)\n done\n subgoal for \\\n apply (auto simp add: parity_ucast take_bits_bitAND)\n done\n subgoal for \\\n apply (subst word_msb_sint[where ?w=\"(\\31,0\\regs \\ r32_1 AND \\31,0\\word_of_int Imm32) :: 32 word\", unfolded msb_nth, symmetric])\n apply (subst word_ao_nth[where ?x=\"(\\31,0\\regs \\ r32_1) :: 32 word\" and ?y=\"(\\31,0\\word_of_int Imm32) :: 32 word\" and ?n=\"(LENGTH(32) - 1)\"])\n by (auto simp add:simp_rules test_bit_of_take_bits fst_bool_to_bv_AND_def)\n done\nqed\n\n(*---------------------------------------------------proofs on not ---------------------------------------*)\nlemma is_manual_not_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_8088 Not) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_not_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_8088 Not) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_2 := NOT op1)\\)\"\nproof -\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n by (simp add:simp_rules)\n qed\n\nlemma is_manual_not_r32[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_8088 Not) (Storage (Reg (General ThirtyTwo r32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_not_r32[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_8088 Not) (Storage (Reg (General ThirtyTwo r32)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r32 :: 32 word\n in\n \\\\regs := (regs \\)(r32 := \\31,0\\(NOT op1))\\)\"\nproof -\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n by (simp add:simp_rules)\n qed\n\n\n(*---------------------------------------------------proofs on neg ---------------------------------------*)\n\nlemma zero_le_2p[get_semantics_rewriting]:\n assumes \"n < LENGTH('a)\"\n shows \"(0::'a::len word) < 2 ^ n\"\n using assms\nproof (induct n)\n case 0\n thus ?case\n by auto\nnext\n case (Suc n)\n thus ?case\n using shiftl_1[symmetric,of \"n+1\",where 'a='a]\n using is_zero_shiftl[of \"1::'a word\" \"n+1\"]\n apply (auto simp del: shiftl_1)\n by fastforce\nqed\n\n\nlemma take_bits_neg[get_semantics_rewriting]:\n fixes w :: \"1000 word\"\n shows \"\\63,0\\ (- w) = (ucast (NOT w) + 1 :: 64 word)\"\n apply (subst twos_complement)\n apply (subst word_succ_p1)\n apply (subst take_bits_plus[of 63 \"NOT w\" 1])\n apply simp\n apply simp\n apply simp\n apply (intro word_eqI)\n by (auto simp add: word_size nth_ucast word_ao_nth bitNOT_nth test_bit_of_take_bits)\n\nlemma take_bits_drop_minus_64bit[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"\\63,0\\ (- (\\63,0\\a :: 1000 word)) = -a\"\n using take_bits_minus_64bit(1)[where ?'a=1000,of 0 \"\\63,0\\a\"]\n by auto\n\nlemma test_bit_of_take_bits_extended_64_neg_word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(- (\\63,0\\a :: 1000 word)) !! 63 = (-a) !! 63\"\n using take_bits_drop_minus_64bit[of a]\n using test_bit_of_take_bits[of 63 63 0 \"- (\\63,0\\a::1000 word)\",where ?'a=64]\n by auto\n\nlemma test_bit_of_take_bits_extended_64_word[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"((\\63,0\\a :: 1000 word)) !! 63 = (a) !! 63\"\n using take_bits_drop_minus_64bit[of a]\n using test_bit_of_take_bits[of 63 63 0 \"(\\63,0\\a::1000 word)\",where ?'a=64]\n by auto\n\n\nlemma diff_len_word_eq_0_64[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"((\\63,0\\a :: 1000 word) = 0) = (a = 0)\"\nproof-\n {\n assume 1: \"\\63,0\\a = (0::1000 word)\"\n hence 2: \"\\ i<1000. (\\63,0\\a :: 1000 word) !! i = False\"\n apply (subst 1)+\n by auto\n have \"(a = (0::64 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 64\"\n hence \"a !! i = (0 :: 64 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI )\n qed\n }\n moreover\n {\n assume 1: \"a = (0::64 word)\"\n hence 2: \"\\ i < 64 . a !! i = False\"\n apply (subst 1)\n by auto\n have \"\\63,0\\a = (0::1000 word)\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \" (\\63,0\\a:: 1000 word) !! i = (0 :: 1000 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\n\nlemma parity_equality[get_semantics_rewriting]:\n fixes a :: \"1000 word\"\n and b :: \"64 word\"\n assumes \"\\63,0\\a = b\"\n shows \"parity a = parity b\"\nproof-\n have a:\"parity(a) = parity(\\63,0\\a :: 64 word)\"\n unfolding parity_def\n unfolding take_bits_def\n by (auto simp add:simp_rules word_rep_drop)\n thus ?thesis\n apply (subst assms(1)[symmetric]) \n by (auto simp add:simp_rules)\nqed\n\n\nlemma is_manual_neg_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_8088 Neg) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_neg_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_8088 Neg) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_2 := (0:: 64 word) - op1),\n flags := (flags \\)\n (flag_zf := op1 = (0 :: 64 word),\n flag_cf := op1 \\ (0 :: 64 word),\n flag_sf := (2^63 \\ - op1),\n flag_of := (op1 \\ 2^63 \\ 2^63 \\ - op1),\n flag_pf := parity((0:: 64 word) - op1) )\n \n \\)\"\nproof-\n\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply rewrite_one_let'\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules take_bits_drop_minus_64bit)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:diff_len_word_eq_0_64)\n done\n subgoal for \\\n apply (auto simp add:diff_len_word_eq_0_64)\n done\n subgoal for \\\n using parity_equality[where ?a=\"- (\\63,0\\regs \\ r64_2)\" and ?b=\"- regs \\ r64_2\"]\n apply (auto simp add:take_bits_drop_minus_64bit)\n done\n subgoal for \\\n using msb_is_gt_2p[of \"- regs \\ r64_2\", unfolded msb_nth]\n using msb_is_gt_2p[of \"regs \\ r64_2\", unfolded msb_nth]\n apply (simp add: test_bit_of_take_bits_extended_64_neg_word test_bit_of_take_bits)\n done\n subgoal for \\\n apply (subst test_bit_of_take_bits_extended_64_neg_word[where ?a=\"regs \\ r64_2\"])\n apply (subst test_bit_of_take_bits_extended_64_word[where ?a=\"regs \\ r64_2\"])\n apply( subst msb_is_gt_2p[of \"- regs \\ r64_2\", unfolded msb_nth, simplified])\n apply( subst msb_is_gt_2p[of \"regs \\ r64_2\", unfolded msb_nth, simplified])\n by simp\n done\nqed\n\nlemma diff_len_word_eq_0_32[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"((\\31,0\\a :: 1000 word) = 0) \\ ((\\31,0\\a :: 32 word) = (0 :: 32 word))\"\nproof-\n {\n assume 1: \"\\31,0\\a = (0::1000 word)\"\n hence 2: \"\\ i<1000. (\\31,0\\a :: 1000 word) !! i = False\"\n apply (subst 1)+\n by auto\n have \"((\\31,0\\a :: 32 word) = (0::32 word))\"\n proof-\n {\n fix i :: nat\n assume \"i < 32\"\n hence \"(\\31,0\\a :: 32 word) !! i = (0 :: 32 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits)\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI )\n qed\n }\n moreover\n {\n assume 1: \"\\31,0\\a = (0::32 word)\"\n hence 2: \"\\ i < 32 . (\\31,0\\a :: 32 word) !! i = False\"\n apply (subst 1)\n by auto\n have \"\\31,0\\a = (0::1000 word)\"\n proof-\n {\n fix i :: nat\n assume \"i < 1000\"\n hence \" (\\31,0\\a:: 1000 word) !! i = (0 :: 1000 word) !! i\"\n using 2[THEN spec, of i]\n by (auto simp add: word_ao_nth test_bit_of_take_bits )\n }\n thus ?thesis\n by (auto simp add: word_size word_eqI)\n qed\n }\n ultimately\n show ?thesis\n by auto\nqed\n\n\nlemma take_bits_minus_extend_32_to_64bits[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\31,0\\(- (\\31,0\\a :: 1000 word)) :: 64 word) = (ucast (-(\\31,0\\a :: 32 word)) :: 64 word)\"\n apply (subst take_bits_minus_bit32_generic[where ?a=\"0 :: 1000 word\" and ?b=\"(\\31,0\\a :: 1000 word)\" and ?'b=64, simplified])\n by (auto simp add:simp_rules)\n\nlemma take_bits_minus_extend_32_to_32bits[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(\\31,0\\(- (\\31,0\\a :: 1000 word)) :: 32 word) = ((-(\\31,0\\a :: 32 word)))\"\n apply (subst take_bits_minus_bit32_generic[where ?a=\"0 :: 1000 word\" and ?b=\"(\\31,0\\a :: 1000 word)\" and ?'b=32, simplified])\n by (auto simp add:simp_rules)\n\nlemma parity_equality_32[get_semantics_rewriting]:\n fixes a :: \"1000 word\"\n and b :: \"32 word\"\n assumes \"\\31,0\\a = b\"\n shows \"parity a = parity b\"\nproof-\n have a:\"parity(a) = parity(\\31,0\\a :: 32 word)\"\n unfolding parity_def\n unfolding take_bits_def\n by (auto simp add:simp_rules word_rep_drop)\n thus ?thesis\n apply (subst assms(1)[symmetric]) \n by (auto simp add:simp_rules)\nqed\n\nlemma test_32b_neg_wordextended[get_semantics_rewriting]:\n fixes a :: \"64 word\"\n shows \"(- (\\31,0\\a :: 1000 word)) !! 31 = (-(\\31,0\\a :: 32 word)) !! 31\"\n using take_bits_minus_extend_32_to_32bits[of a]\n using test_bit_of_take_bits[of 31 31 0 \"- (\\31,0\\a::1000 word)\",where ?'a=32]\n by auto\n\nlemma is_manual_neg_r32[is_manual]:\n shows \"is_manual assembly semantics (Unary (IS_8088 Neg) (Storage (Reg (General ThirtyTwo r32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_neg_r32[presimplify]:\n shows \"get_semantics \\ semantics (Unary (IS_8088 Neg) (Storage (Reg (General ThirtyTwo r32)))) si =\n (\\ \\ . let opx = \\31,0\\regs \\ r32 :: 32 word\n in\n \\\\regs := (regs \\)(r32 := ucast ((0:: 32 word) - opx) ),\n flags := (flags \\)\n (flag_zf := opx = (0 :: 32 word),\n flag_cf := opx \\ (0 :: 32 word),\n flag_sf := sint(0 - opx) < 0,\n flag_of := (opx \\ 2^31 \\ 2^31 \\ - opx),\n flag_pf := parity((0:: 32 word) - opx) )\n \n \\)\"\nproof-\n\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply rewrite_one_let'\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules take_bits_minus_extend_32_to_64bits)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:diff_len_word_eq_0_32)\n done\n subgoal for \\\n apply (auto simp add:diff_len_word_eq_0_32)\n done\n subgoal for \\\n apply (subst stupid[where a=\"(\\31,0\\- (\\31,0\\regs \\ r32))\"])\n using parity_equality_32[where ?a=\"- (\\31,0\\regs \\ r32)\" and ?b=\"- (\\31,0\\regs \\ r32)\"]\n apply (auto simp add:take_bits_minus_extend_32_to_32bits parity_equality_32 ucast_id)\n done\n subgoal for \\\n apply (subst word_msb_sint[where ?w=\"(- (\\31,0\\regs \\ r32)) :: 32 word\", symmetric, unfolded msb_nth, simplified])\n apply (simp add: test_32b_neg_wordextended test_bit_of_take_bits)\n done\n subgoal for \\\n apply (subst test_32b_of_32AND64_word[where ?a=\"regs \\ r32\"])\n apply (subst test_32b_neg_wordextended[where a=\"regs \\ r32\"]) \n apply( subst msb_is_gt_2p[of \"(- (\\31,0\\regs \\ r32)) :: 32 word\", unfolded msb_nth, simplified])\n apply( subst msb_is_gt_2p[of \"\\31,0\\regs \\ r32 :: 32 word\", unfolded msb_nth, simplified])\n by simp\n done\nqed\n\n\n(*---------------------------------------------------proofs on mov ---------------------------------------*)\nabbreviation \"write_mem16 \\ \\ a (v::64 word) \\\n \\\\mem := write_block ((resolve_address \\ \\ a) \\ rev (\\1,0\\ v)) (mem \\)\\\"\n\nabbreviation \"write_mem8 \\ \\ a (v::64 word) \\\n \\\\mem := write_block ((resolve_address \\ \\ a) \\ rev (\\0,0\\ v)) (mem \\)\\\"\n\n\nlemma is_manual_mov_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si =\n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := op2)\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n by (simp add: simp_rules)\nqed\n\nlemma is_manual_mov_m64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 64 Mem) (Storage (Reg (General SixtyFour r64)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 64 Mem) (Storage (Reg (General SixtyFour r64)))) si =\n (\\ \\. let op2 = regs \\ r64 :: 64 word\n in \n write_mem64 \\ \\ Mem op2)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n by(rewrite_one_let')+\n\nlemma is_manual_mov_m32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 32 Mem) (Storage (Reg (General ThirtyTwo r32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 32 Mem) (Storage (Reg (General ThirtyTwo r32))) ) si =\n (\\ \\. let op2 = \\31,0\\regs \\ r32 :: 32 word\n in \n write_mem32 \\ \\ Mem op2)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n by(rewrite_one_let')+\n\n\n\nlemma is_manual_mov_m16_r16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 16 Mem) (Storage (Reg (General Sixteen r16)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m16_r16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 16 Mem) (Storage (Reg (General Sixteen r16))) ) si =\n (\\ \\. let op2 = \\15,0\\regs \\ r16 :: 64 word;\n op1 = \\63,16\\read_mem64 \\ \\ 16 Mem :: 64 word;\n op3 = fst (bv_cat (op1, 48) (op2, 16)) :: 64 word\n\n in \n write_mem16 \\ \\ Mem op3)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,16\\fst (read_memory \\ \\ 16 Mem) << 16) :: 1000 word\" and ?b=\"\\15,0\\regs \\ r16\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_m8_r8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 8 Mem) (Storage (Reg (General EightLow r8_1)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m8_r8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 8 Mem) (Storage (Reg (General EightLow r8_1))) ) si =\n (\\ \\. let op2 = \\7,0\\regs \\ r8_1 :: 64 word;\n op1 = \\63,8\\read_mem64 \\ \\ 8 Mem :: 64 word;\n op3 = fst (bv_cat (op1, 56) (op2, 8)) :: 64 word\n\n in \n write_mem8 \\ \\ Mem op3)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,8\\fst (read_memory \\ \\ 8 Mem) << 8) :: 1000 word\" and ?b=\"\\7,0\\regs \\ r8_1\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_m16_imm16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 16 Mem) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m16_imm16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 16 Mem) (Immediate (ImmSixtyFour imm)) ) si =\n (\\ \\. let op2 = word_of_int imm :: 64 word;\n op1 = \\63,16\\read_mem64 \\ \\ 16 Mem :: 64 word;\n op3 = fst (bv_cat (op1, 48) (op2, 16)) :: 64 word\n\n in \n write_mem16 \\ \\ Mem op3)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,16\\fst (read_memory \\ \\ 16 Mem) << 16) :: 1000 word\" and ?b=\"\\15,0\\word_of_int imm \"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_m8_imm8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 8 Mem) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m8_imm8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 8 Mem) (Immediate (ImmSixtyFour imm)) ) si =\n (\\ \\. let op2 = word_of_int imm :: 64 word;\n op1 = \\63,8\\read_mem64 \\ \\ 8 Mem :: 64 word;\n op3 = fst (bv_cat (op1, 56) (op2, 8)) :: 64 word\n\n in \n write_mem8 \\ \\ Mem op3)\"\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,8\\fst (read_memory \\ \\ 8 Mem) << 8) :: 1000 word\" and ?b=\"\\7,0\\word_of_int imm \"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\n\n\nlemma is_manual_mov_r16_imm16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16)) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r16_imm16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16)) (Immediate (ImmSixtyFour imm)) ) si =\n (\\ \\. let op2 = word_of_int imm :: 64 word;\n op1 = \\63,16\\regs \\ r16 :: 64 word;\n op3 = fst (bv_cat (op1, 48) (op2, 16)) :: 64 word\n in \n \\\\regs := (regs \\)(r16 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,16\\regs \\ r16 << 16) :: 1000 word\" and ?b=\"\\15,0\\word_of_int imm\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_r8_imm8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General EightLow r16)) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r8_imm8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General EightLow r8_1)) (Immediate (ImmSixtyFour imm)) ) si =\n (\\ \\. let op2 = word_of_int imm :: 64 word;\n op1 = \\63,8\\regs \\ r8_1 :: 64 word;\n op3 = fst (bv_cat (op1, 56) (op2, 8)) :: 64 word\n in \n \\\\regs := (regs \\)(r8_1 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,8\\regs \\ r8_1 << 8) :: 1000 word\" and ?b=\"\\7,0\\word_of_int imm\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\n\n\nlemma is_manual_mov_r16_r16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16_1)) (Storage (Reg (General Sixteen r16_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r16_r16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16_1)) (Storage (Reg (General Sixteen r16_2))) ) si =\n (\\ \\. let op2 =regs \\ r16_2 :: 64 word;\n op1 = \\63,16\\regs \\ r16_1 :: 64 word;\n op3 = fst (bv_cat (op1, 48) (op2, 16)) :: 64 word\n in \n \\\\regs := (regs \\)(r16_1 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,16\\regs \\ r16_1 << 16) :: 1000 word\" and ?b=\"\\15,0\\regs \\ r16_2\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_r8_r8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General EightLow r8_1)) (Storage (Reg (General EightLow r8_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r8_r8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General EightLow r8_1)) (Storage (Reg (General EightLow r8_2))) ) si =\n (\\ \\. let op2 =regs \\ r8_2 :: 64 word;\n op1 = \\63,8\\regs \\ r8_1 :: 64 word;\n op3 = fst (bv_cat (op1, 56) (op2, 8)) :: 64 word\n in \n \\\\regs := (regs \\)(r8_1 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,8\\regs \\ r8_1 << 8) :: 1000 word\" and ?b=\"\\7,0\\regs \\ r8_2\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_r16_m16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16_1)) (Storage (Memory 16 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r16_m16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General Sixteen r16_1)) (Storage (Memory 16 Mem)) ) si =\n (\\ \\. let op2 =read_mem64 \\ \\ 16 Mem :: 64 word;\n op1 = \\63,16\\regs \\ r16_1 :: 64 word;\n op3 = fst (bv_cat (op1, 48) (op2, 16)) :: 64 word\n in \n \\\\regs := (regs \\)(r16_1 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,16\\regs \\ r16_1 << 16) :: 1000 word\" and ?b=\"\\15,0\\fst (read_memory \\ \\ 16 Mem)\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\nlemma is_manual_mov_r8_m8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General EightLow r8_1)) (Storage (Memory 8 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r8_m8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General EightLow r8_1)) (Storage (Memory 8 Mem))) si =\n (\\ \\. let op2 =read_mem64 \\ \\ 8 Mem :: 64 word;\n op1 = \\63,8\\regs \\ r8_1 :: 64 word;\n op3 = fst (bv_cat (op1, 56) (op2, 8)) :: 64 word\n in \n \\\\regs := (regs \\)(r8_1 := op3)\\)\" \n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')+\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR[where ?h=63 and ?l=0 and ?a=\"(\\63,8\\regs \\ r8_1 << 8) :: 1000 word\" and ?b=\"\\7,0\\fst (read_memory \\ \\ 8 Mem)\"])\n by (auto simp add:simp_rules take_bits_def word_rep_drop shiftl_of_bl)\n\n\nlemma is_manual_mov_r64_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r64_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64)) (Storage (Memory 64 Mem))) si =\n (\\ \\. let op1 = regs \\ r64 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n in \n \\\\regs := (regs \\)(r64 := op2)\\)\"\n\nproof-\n show ?thesis\n apply (rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add: semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n by (simp add: simp_rules)\nqed \n\nlemma is_manual_mov_r32_m32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r32_m32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 Mem))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32 :: 32 word;\n op2 = \\31,0\\(read_mem64 \\ \\ 32 Mem) :: 32 word\n in\n \\\\regs := (regs \\)(r32 := \\31,0\\op2)\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n by(simp add:simp_rules)\nqed\n\nlemma is_manual_mov_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General ThirtyTwo r2_32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General ThirtyTwo r2_32)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = \\31,0\\regs \\ r2_32 :: 32 word\n in\n \\\\regs := (regs \\)(r1_32 := \\31,0\\op2)\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n by(simp add:simp_rules)\nqed\n\n\nlemma truncating_word_of_int_32_bits[get_semantics_rewriting]:\n shows \"(\\3,0\\ (word_of_int imm :: 64 word)) = (\\3,0\\ (word_of_int imm :: 32 word))\"\nproof-\n let ?xs = \"\\3,0\\ (word_of_int imm :: 64 word)\"\n let ?ys = \"\\3,0\\ (word_of_int imm :: 32 word)\"\n {\n fix i :: nat\n assume i: \"i < length ?xs\"\n {\n fix j :: nat\n have i: \"i \\ {0,1,2,3}\"\n using i\n by auto\n assume \"j < 8\"\n hence \"?xs ! i !! j = ?ys ! i !! j\"\n using i\n by (auto simp add: nth_bytes_of test_bit_of_take_bits test_bit_of_byte_of)\n }\n hence \"?xs ! i = ?ys ! i\"\n apply (intro word_eqI)\n by (auto simp add: word_size)\n }\n thus ?thesis\n apply (intro nth_equalityI)\n by auto\nqed\n\nlemma is_manual_mov_m32_imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 32 Mem) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m32_imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 32 Mem) (Immediate (ImmSixtyFour imm))) si = \n (\\ \\ . let op2 = imm \n in\n write_mem32 \\ \\ Mem (word_of_int imm))\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (simp add: truncating_word_of_int_32_bits )\n\nqed\n\nlemma is_manual_mov_r32_imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r1_32)) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r32_imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General ThirtyTwo r1_32)) (Immediate (ImmSixtyFour Imm))) si = \n (\\ \\ . let op2 = word_of_int Imm :: 64 word\n in\n \\\\regs := (regs \\)(r1_32 := (\\31,0\\op2) :: 64 word)\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\nlemma is_manual_mov_r64_imm64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64)) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_r64_imm64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Reg (General SixtyFour r64)) (Immediate (ImmSixtyFour Imm))) si = \n (\\ \\ . let op2 = word_of_int Imm :: 64 word\n in\n \\\\regs := (regs \\)(r64 := op2)\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\nlemma is_manual_mov_m64_imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Mov) (Memory 64 Mem) (Immediate (ImmSixtyFour imm))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mov_m64_imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Mov) (Memory 64 Mem) (Immediate (ImmSixtyFour Imm))) si = \n (\\ \\ . let op2 = imm \n in\n write_mem64 \\ \\ Mem (word_of_int Imm::64 word))\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules sextend_useless_64_64)\nqed\n\n(*---------------------------------------------------proofs on cmovae ---------------------------------------*)\n\nlemma is_manual_cmovae_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_PentiumPro Cmovae) (Reg (General ThirtyTwo r1)) (Storage (Reg (General ThirtyTwo r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmovae_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_PentiumPro Cmovae) (Reg (General ThirtyTwo r1)) (Storage (Reg (General ThirtyTwo r2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r1 :: 32 word;\n op2 = \\31,0\\regs \\ r2 :: 32 word\n in\n \\\\regs := (regs \\)(r1 := if flags \\ flag_cf then ucast op1 else ucast op2)\\)\"\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules bv_to_bool_def word_lsb_alt test_bit_of_take_bits)\n\n(*---------------------------------------------------proofs on cmova ---------------------------------------*)\n\nlemma is_manual_cmova_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_PentiumPro Cmova) (Reg (General ThirtyTwo r1)) (Storage (Reg (General ThirtyTwo r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cmova_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_PentiumPro Cmova) (Reg (General ThirtyTwo r1)) (Storage (Reg (General ThirtyTwo r2)))) si =\n (\\ \\ . let op1 = \\31,0\\regs \\ r1 :: 32 word;\n op2 = \\31,0\\regs \\ r2 :: 32 word\n in\n \\\\regs := (regs \\)(r1 := if flags \\ flag_cf \\ flags \\ flag_zf then ucast op1 else ucast op2)\\)\"\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules bv_to_bool_def word_lsb_alt test_bit_of_take_bits)\n\n(*---------------------------------------------------proofs on movsx ---------------------------------------*)\nlemma is_manual_movsx_r32_r8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_80386 Movsx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General EightLow r2_8)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movsx_r32_r8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_80386 Movsx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General EightLow r2_8)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = sextend (\\7,0\\regs \\ r2_8 :: 32 word) 8 32\n in\n \\\\regs := (regs \\)(r1_32 := ucast op2 )\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n(*---------------------------------------------------proofs on movsxd ---------------------------------------*)\n\nlemma is_manual_movsxd_r64_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_X86_64 Movsxd) (Reg (General SixtyFour r1)) (Storage (Reg (General ThirtyTwo r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movsxd_r64_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_X86_64 Movsxd) (Reg (General SixtyFour r1)) (Storage (Reg (General ThirtyTwo r2)))) si =\n (\\ \\ . let op2 = \\31,0\\regs \\ r2 :: 32 word\n in\n \\\\regs := (regs \\)(r1 := sextend (ucast op2) 32 64)\\)\"\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n\n\nlemma is_manual_movsxd_r64_m32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_X86_64 Movsxd) (Reg (General SixtyFour r1)) (Storage (Memory 32 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movsxd_r64_m32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_X86_64 Movsxd) (Reg (General SixtyFour r1)) (Storage (Memory 32 Mem))) si =\n (\\ \\ . let op2 = \\31,0\\(read_mem64 \\ \\ 32 Mem) :: 32 word\n in\n \\\\regs := (regs \\)(r1 := sextend (ucast op2) 32 64)\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (subst unfold_semantics)\n apply (auto simp add: Let'_def simp_rules )\n done\n\n\n\n\n(*---------------------------------------------------proofs on movzx ---------------------------------------*)\n\nlemma is_manual_movzx_r32_m8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Memory 8 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movzx_r32_m8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Memory 8 Mem))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = \\7,0\\(read_mem64 \\ \\ 8 Mem) :: 8 word\n in\n \\\\regs := (regs \\)(r1_32 := ucast op2 )\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n\nlemma is_manual_movzx_r32_r8[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General EightLow r2_8)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movzx_r32_r8[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General EightLow r2_8)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = \\7,0\\(regs \\ r2_8) :: 8 word\n in\n \\\\regs := (regs \\)(r1_32 := ucast op2 )\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n\nlemma is_manual_movzx_r32_m16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Memory 16 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movzx_r32_m16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Memory 16 Mem))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = \\15,0\\(read_mem64 \\ \\ 16 Mem) :: 16 word\n in\n \\\\regs := (regs \\)(r1_32 := ucast op2 )\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n\nlemma is_manual_movzx_r32_r16[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General Sixteen r16)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movzx_r32_r16[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_80386 Movzx) (Reg (General ThirtyTwo r1_32)) (Storage (Reg (General Sixteen r16)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r1_32 :: 32 word;\n op2 = \\15,0\\(regs \\ r16) :: 16 word\n in\n \\\\regs := (regs \\)(r1_32 := ucast op2 )\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n\n\n(*---------------------------------------------------proofs on movapd ---------------------------------------*)\nlemma is_manual_movapd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Movapd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movapd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Movapd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r1 :: 64 word;\n op2 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)(r3 := op1, r4 := op2)\\\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Movapd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Movapd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Movapd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec)\n \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (simp_all add: Let'_def simp_rules )\n done\nqed\n\n(*---------------------------------------------------proofs on movq ---------------------------------------*)\nlemma is_manual_movq_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_PentiumMMX_MMX Movq) (Reg (General SixtyFour r64)) (Storage (Reg (SSE r3 r4 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movq_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_PentiumMMX_MMX Movq) (Reg (General SixtyFour r64)) (Storage (Reg (SSE r3 r4 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r2 :: 64 word\n in\n \\\\regs := (regs \\)(r64 := op1)\\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (simp_all add: Let'_def simp_rules )\nqed\n\n(*---------------------------------------------------proofs on movsd ---------------------------------------*)\nlemma is_manual_movsd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Movsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_movsd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Movsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)(r4 := op1)\\\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Movsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Movsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Movsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\n(*---------------------------------------------------proofs on pxor ---------------------------------------*)\n\nlemma take_bits_bitXOR_generic[get_semantics_rewriting]:\n fixes a b :: \"'a::len0 word\"\n assumes \"h < LENGTH('a)\"\n and \"k < h\" \n shows \"((\\h,k\\(a XOR b)) :: 'b::len0 word) = ((\\h,k\\a) :: 'b::len0 word) XOR \\h,k\\b\"\nproof-\n {\n fix n :: nat\n assume \"n < LENGTH('b)\"\n hence \"((\\h,k\\(a XOR b)) :: 'b::len0 word) !! n = (((\\h,k\\a) :: 'b::len0 word) XOR \\h,k\\b) !! n\"\n using assms\n apply (subst test_bit_of_take_bits)\n by (auto simp add: test_bit_of_take_bits bitXOR_nth)\n }\n thus ?thesis\n apply (intro word_eqI)\n by (auto simp add: word_size)\nqed\n\n\n\nlemma xor_shift_and_take_upper[get_semantics_rewriting]:\n fixes a b c d :: \"64 word\"\n shows \"\\127,64\\(((\\63,0\\a << 64) OR (\\63,0\\b :: 1000 word)) XOR (\\63,0\\c << 64) OR (\\63,0\\d :: 1000 word)) = (a XOR c)\"\nproof-\n show ?thesis\n apply (subst take_bits_bitXOR_generic)\n apply (auto)\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_def)+\n apply (auto)\n by (auto simp add: word_rep_drop shiftl_of_bl)\nqed\n\nlemma xor_shift_and_take_lower[get_semantics_rewriting]:\n fixes a b c d :: \"64 word\"\n shows \"\\63,0\\(((\\63,0\\a << 64) OR (\\63,0\\b :: 1000 word)) XOR (\\63,0\\c << 64) OR (\\63,0\\d :: 1000 word)) = (b XOR d)\"\nproof-\n show ?thesis\n apply (subst take_bits_bitXOR_generic)\n apply (auto)\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_def)+\n apply (auto)\n by (auto simp add: word_rep_drop shiftl_of_bl)\nqed\n\nlemma is_manual_pxor_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n \nlemma get_semantics_pxor_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = regs \\ r1 :: 64 word;\n op4 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)(r3 := op1 XOR op3, r4 := op2 XOR op4 )\\\n else (let' p = (IMF_PentiumMMX_MMX, IS_PentiumMMX_MMX Pxor,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4))\n (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4))\n (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \n \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules)\n unfolding bv_cat.simps\n by (auto simp add:simp_rules xor_shift_and_take_upper xor_shift_and_take_lower)\n qed\n\nabbreviation \"read_mem_128 \\ \\ s a \\ fst (bv_slice s 0 (bv_read_memory \\ \\ s a))\"\n\nlemma is_manual_pxor_xmm_m128[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 128 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_pxor_xmm_m128[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 128 Mem))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = \\127,64\\read_mem_128 \\ \\ 128 Mem :: 64 word;\n op4 = \\63,0\\read_mem_128 \\ \\ 128 Mem :: 64 word\n\n in\n if r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)(r3 := (op1 XOR op3), r4 := (op2 XOR op4))\\\n else (let' p = (IMF_PentiumMMX_MMX, IS_PentiumMMX_MMX Pxor,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Memory_sig 128)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 128 Mem))) si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_PentiumMMX_MMX Pxor) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 128 Mem)))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules)\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitXOR_generic)\n apply (auto)\n apply (subst take_bits_bitXOR_generic)\n apply (auto)\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_def)+\n apply (auto)\n by (auto simp add: word_rep_drop shiftl_of_bl)\n qed\n\n(*---------------------------------------------------proofs on andpd ---------------------------------------*)\nlemma is_manual_andpd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Andpd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_andpd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Andpd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = regs \\ r1 :: 64 word;\n op4 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)(r3 := op1 AND op3, r4 := op2 AND op4 )\\\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Andpd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Andpd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Andpd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitAND)\n apply simp\n apply (subst take_bits_bitAND)\n apply simp\n unfolding bv_cat.simps\n apply (auto simp add:simp_rules)\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_bitOR)\n apply simp\n apply (subst take_bits_def)+\n apply (auto)\n by (auto simp add: word_rep_drop shiftl_of_bl)\n qed\n\n(*---------------------------------------------------proofs on subsd ---------------------------------------*)\nlemma is_manual_subsd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_subsd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = regs \\ r1 :: 64 word;\n op4 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op2 -\\<^sup>f op4 )\\\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Subsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n qed\n\nlemma is_manual_subsd_xmm_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_subsd_xmm_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si = \n (\\ \\ . let op1 = regs \\ r4 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n\n in\n if r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op1 -\\<^sup>f op2 )\\\n\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Subsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Memory_sig 64)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Subsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem)))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n qed\n\n(*---------------------------------------------------proofs on addsd ---------------------------------------*)\nlemma is_manual_addsd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_addsd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = regs \\ r1 :: 64 word;\n op4 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op2 +\\<^sup>f op4 )\\\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Addsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\nqed\n\nlemma is_manual_addsd_xmm_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_addsd_xmm_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si = \n (\\ \\ . let op1 = regs \\ r4 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n\n in\n if r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op1 +\\<^sup>f op2 )\\\n\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Addsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Memory_sig 64)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Addsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem)))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n qed\n\n\n(*---------------------------------------------------proofs on mulsd ---------------------------------------*)\nlemma is_manual_mulsd_xmm_xmm[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mulsd_xmm_xmm[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2)))) si = \n (\\ \\ . let op1 = regs \\ r3 :: 64 word;\n op2= regs \\ r4 :: 64 word;\n op3 = regs \\ r1 :: 64 word;\n op4 = regs \\ r2 :: 64 word\n in\n if r1 \\ r4 \\ r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op2 *\\<^sup>f op4 )\\\n else \n (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Mulsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Reg_sig SSE_sig)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Reg (SSE r7 r17 r1 r2))))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def) \n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add: set_def)\n qed\n\nlemma is_manual_mulsd_xmm_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_mulsd_xmm_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si = \n (\\ \\ . let op1 = regs \\ r4 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n\n in\n if r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op1 *\\<^sup>f op2 )\\\n\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Mulsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Memory_sig 64)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Mulsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem)))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n qed\n\n(*---------------------------------------------------proofs on divsd ---------------------------------------*)\nlemma is_manual_divsd_xmm_m64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_SSE2_SIMD Divsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_divsd_xmm_m64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_SSE2_SIMD Divsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si = \n (\\ \\ . let op1 = regs \\ r4 :: 64 word;\n op2 = read_mem64 \\ \\ 64 Mem :: 64 word\n\n in\n if r3 \\ r4 \\ r5 \\ r3 \\ r5 \\ r4 \\ r6 \\ r4 \\ r6 \\ r3 then\n \\\\regs := (regs \\)( r4 := op1 div\\<^sup>f op2 )\\\n\n else (let' p = (IMF_SSE2_SIMD, IS_SSE2_SIMD Divsd,\n Binary_sig (Reg_sig SSE_sig) (Storage_sig (Memory_sig 64)));\n family_list = instr_semantics semantics (fst p); family_list_not_found = family_list = None;\n variant_list = if family_list_not_found then None else the family_list (fst (snd p));\n variant_list_not_found = variant_list = None;\n bv_formula = if variant_list_not_found then None else the variant_list (snd (snd p));\n manual = bv_formula = None; op1_bvf = get_op1_bvf (the bv_formula);\n exec =\n if manual\n then manual_exec_instr \\\n (Binary (IS_SSE2_SIMD Divsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem))) si\n else exec_learned_instr \\ (the bv_formula) op1_bvf\n (Binary (IS_SSE2_SIMD Divsd) (Reg (SSE r5 r6 r3 r4)) (Storage (Memory 64 Mem)))\n in exec) \\)\"\nproof-\n show ?thesis\n apply(rule ext)\n apply(subst get_semantics_def)\n apply(rewrite_one_let')\n defer\n apply simp\n apply(rewrite_one_let')\n apply(rewrite_one_let')\n apply(rewrite_one_let' add:semantics_def)\n apply(rewrite_one_let')+\n by (auto simp add:simp_rules)\n qed\n\n(*---------------------------------------------------proofs on sub ---------------------------------------*)\nabbreviation \"read_mem \\ \\ s a \\ fst (read_memory \\ \\ s a)\"\n\nlemma is_manual_sub_r32_m32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 a))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_r32_m32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32)) (Storage (Memory 32 a))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32 :: 32 word;\n op2 = \\31,0\\(read_mem \\ \\ 32 a) :: 32 word\n in\n \\\\regs := (regs \\)(r32 := ucast (op1 - op2)),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (auto simp add:simp_rules)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 a)) :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\regs \\ r32 - \\31,0\\fst (read_memory \\ \\ 32 a)) :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\nqed\n\nlemma is_manual_sub_m32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Memory 32 a) (Storage (Reg (General ThirtyTwo r32)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_m32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Memory 32 Mem) (Storage (Reg (General ThirtyTwo r32)))) si = \n (\\ \\ . let a = resolve_address \\ \\ Mem;\n op1 = \\31,0\\(read_mem \\ \\ 32 Mem) :: 32 word;\n op2 = \\31,0\\regs \\ r32 :: 32 word\n in\n \\\\mem := write_blocks [a \\ rev (\\3,0\\ (op1 - op2))] (mem \\),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\nproof-\n show ?thesis\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (auto simp add:simp_rules resolve_address_after_update_flag)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules parity_ucast)\n done\n subgoal for \\\n apply (subst add.commute[of \"ucast (NOT \\31,0\\regs \\ r32)\"])\n apply (subst sign_sub_bit32)\n by auto\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\fst (read_memory \\ \\ 32 Mem)) :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\fst (read_memory \\ \\ 32 Mem) - (\\31,0\\regs \\ r32) :: 32 word\"]\n using sign_sub_bit32[where b=\"regs \\ r32\" and a=\"fst (read_memory \\ \\ 32 Mem)\"]\n by (auto simp add: simp_rules test_bit_of_take_bits)\n done\nqed\n\nlemma is_manual_sub_r32_r32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_r32_r32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32_1)) (Storage (Reg (General ThirtyTwo r32_2)))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\regs \\ r32_2 :: 32 word\n in\n \\\\regs := (regs \\)(r32_1 := ucast (op1 - op2) :: 64 word),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n apply (auto simp add:simp_rules)\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules parity_ucast)\n done\n subgoal for \\\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32_2 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32_1 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\regs \\ r32_1 - \\31,0\\regs \\ r32_2) :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\n\nlemma test_32b_of_32AND1000_word[get_semantics_rewriting]:\n fixes a :: \"1000 word\"\n shows \"(a :: 1000 word) !! 31 = (\\31,0\\(a :: 1000 word) :: 32 word) !! 31\"\n by (simp add: test_bit_of_take_bits)\n\nlemma is_manual_sub_r32_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_r32_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Reg (General ThirtyTwo r32_1)) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ . let op1 = \\31,0\\regs \\ r32_1 :: 32 word;\n op2 = \\31,0\\(word_of_int Imm32 :: 64 word) :: 32 word\n in\n \\\\regs := (regs \\)(r32_1 := (ucast (op1 - op2 :: 32 word)) :: 64 word),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n apply (auto simp add: simp_rules parity_ucast)\n done\n subgoal for \\\n apply (subst test_32b_of_32AND64_word[where ?a=\"regs \\ r32_1\"])\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\word_of_int Imm32 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"\\31,0\\regs \\ r32_1 :: 32 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(\\31,0\\regs \\ r32_1 - \\31,0\\word_of_int Imm32) :: 32 word\"]\n by (auto simp add: simp_rules test_bit_of_take_bits )\n done\n\nlemma test_64b_of_1000AND_take_64_word[get_semantics_rewriting]:\n fixes a :: \"1000 word\"\n shows \"(a :: 1000 word) !! 63 = (\\63,0\\(a :: 1000 word) :: 64 word) !! 63\"\n by (simp add: test_bit_of_take_bits)\n\nlemma is_manual_sub_r64_Imm32[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Reg (General SixtyFour r64_1)) (Immediate (ImmSixtyFour Imm32))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_r64_Imm32[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Reg (General SixtyFour r64_1)) (Immediate (ImmSixtyFour Imm32))) si = \n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = (word_of_int Imm32 :: 64 word)\n in\n \\\\regs := (regs \\)(r64_1 := (op1 - op2 ) :: 64 word),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n\n subgoal for \\\n apply (auto simp add:simp_rules useless_sextend_hardocded)\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add:ucast_bitNOT ucast_id)\n done\n subgoal for \\\n using overflow_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add: simp_rules parity_ucast)\n done\n subgoal for \\ \n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\", simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal for \\\n apply(subst test_64b_of_AND1000_word[symmetric, where ?w=\"regs \\ r64_1\"])\n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"word_of_int Imm32\", simplified]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"word_of_int Imm32 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"regs \\ r64_1 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(regs \\ r64_1 - word_of_int Imm32) :: 64 word\"]\n apply (auto simp add:simp_rules)\n using sub_overflow_flag64_bit[where ?b=\"word_of_int Imm32 :: 64 word\" and ?a=\"regs \\ r64_1\"]\n by (auto simp add: word_msb_sint msb_nth test_bit_of_take_bits)\n done\n\n\nlemma is_manual_sub_r64_r64[is_manual]:\n shows \"is_manual assembly semantics (Binary (IS_8088 Sub) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_sub_r64_r64[presimplify]:\n shows \"get_semantics \\ semantics (Binary (IS_8088 Sub) (Reg (General SixtyFour r64_1)) (Storage (Reg (General SixtyFour r64_2)))) si = \n (\\ \\ . let op1 = regs \\ r64_1 :: 64 word;\n op2 = regs \\ r64_2 :: 64 word\n in\n \\\\regs := (regs \\)(r64_1 := (op1 - op2 ) :: 64 word),\n flags := (flags \\)\n (flag_pf := parity (op1 - op2),\n flag_cf := op2 > op1,\n flag_zf := op1 = op2,\n flag_sf := sint (op1 - op2) < 0,\n flag_of := (sint(op2) \\ 0 \\ 0 \\ sint (op1 - op2) \\ sint(op1) < 0)\n \\\n (sint(op2) < 0 \\ sint (op1 - op2) < 0 \\ sint(op1) \\ 0))\\)\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal for \\\n apply (auto simp add:simp_rules )\n done\n apply (intro flags_eqI,simp_all)\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add:ucast_bitNOT ucast_id)\n done\n subgoal for \\\n using overflow_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"regs \\ r64_2\"]\n apply (auto simp add:simp_rules )\n done\n subgoal for \\\n unfolding bv_slice.simps\n apply (auto simp add: simp_rules parity_ucast)\n done\n subgoal for \\ \n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"regs \\ r64_2\", simplified]\n apply (auto simp add:simp_rules)\n done\n subgoal for \\\n apply(subst test_64b_of_AND1000_word[symmetric, where ?w=\"regs \\ r64_1\"])\n using sign_sub_bit64[where ?a=\"regs \\ r64_1\" and ?b=\"regs \\ r64_2\", simplified]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"regs \\ r64_2 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"regs \\ r64_1 :: 64 word\"]\n using word_msb_sint[symmetric, unfolded msb_nth, where ?w=\"(regs \\ r64_1 - regs \\ r64_2) :: 64 word\"]\n apply (auto simp add:simp_rules)\n using sub_overflow_flag64_bit[where ?b=\"regs \\ r64_2 :: 64 word\" and ?a=\"regs \\ r64_1\"]\n by (auto simp add: word_msb_sint msb_nth test_bit_of_take_bits)\n done\n\n\n\n\n(*---------------------------------------------------proofs on cdq ---------------------------------------*)\nlemma is_manual_cdq[is_manual]:\n shows \"is_manual assembly semantics (Nullary (IS_80386 Cdq)) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cdq[presimplify]:\n shows \"get_semantics \\ semantics (Nullary (IS_80386 Cdq)) si = \n (\\ \\ . let op1 = EAX \\\n in\n \\\\regs := (regs \\)(rdx := ucast (if sint op1 \\ 0 then 0 else -1 :: 32 word)) \\ )\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal premises prems for \\\n proof(cases \"(\\31,0\\regs \\ rax :: 1000 word) !! 31\")\n case True\n hence \"EAX \\ !! 31\"\n by (auto simp add: test_bit_of_take_bits) \n hence False\n using word_msb_sint[of \"EAX \\\"] prems\n by (auto simp add: msb_nth)\n thus ?thesis\n by simp\n next\n case False\n have \"\\31,32\\regs \\ rax = (0::64 word)\"\n apply (intro word_eqI)\n by (auto simp add: word_size test_bit_of_take_bits)\n thus ?thesis\n using False\n by (auto simp add: simp_rules bv_slice.simps sextend.simps bv_cat'_def)[1]\n qed\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all)\n subgoal premises prems for \\\n proof(cases \"(\\31,0\\regs \\ rax :: 1000 word) !! 31\")\n case True\n have 1: \"\\ a b . a = b \\ (regs \\)(rdx := a) = (regs \\)(rdx := b)\"\n by auto\n thus ?thesis\n using True\n apply (auto simp add: simp_rules bv_slice.simps sextend.simps bv_cat'_def)[1]\n apply (rule 1)\n apply (intro word_eqI)\n subgoal for n\n apply (cases\"n=0\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast)\n apply (cases\"n=1\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=2\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=3\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=4\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=5\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=6\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=7\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=8\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=9\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=10\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=11\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=12\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=13\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=14\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=15\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=16\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=17\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=18\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=19\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=20\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=22\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=23\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=24\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=25\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=26\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=27\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=28\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=29\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=30\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=31\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply unat_arith\n apply (cases\"n=0\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast)\n apply (cases\"n=1\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=2\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=3\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=4\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=5\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=6\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=7\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=8\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=9\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=10\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=11\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=12\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=13\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=14\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=15\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=16\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=17\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=18\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=19\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=20\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=21\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=22\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=23\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=24\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=25\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=26\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=27\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=28\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=29\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=30\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply (cases\"n=31\", auto simp add: word_size test_bit_of_take_bits word_ao_nth nth_ucast) \n apply unat_arith\n done\n done\n next\n case False\n hence \"\\EAX \\ !! 31\"\n by (auto simp add: test_bit_of_take_bits) \n hence False\n using word_msb_sint[of \"EAX \\\"] prems\n by (auto simp add: msb_nth)\n thus ?thesis\n by simp\n qed\n done\n\n(*---------------------------------------------------proofs on cdqe ---------------------------------------*)\nlemma is_manual_cdqe[is_manual]:\n shows \"is_manual assembly semantics (Nullary (IS_X86_64 Cdqe)) = False\"\n by (auto simp add: is_manual_def Let'_def simp_rules unfold_semantics)\n\nlemma get_semantics_cdqe[presimplify]:\n shows \"get_semantics \\ semantics (Nullary (IS_X86_64 Cdqe)) si = \n (\\ \\ . let op1 = EAX \\\n in\n \\\\regs := (regs \\)(rax := sextend (ucast op1) 32 64) \\ )\"\n apply (rule ext)\n apply (subst get_semantics_def)\n apply (rewrite_one_let') \n apply (rewrite_one_let' add: semantics_def)\n apply (rewrite_one_let')+\n apply (intro state_eqI,simp_all add: set_def)\n apply (auto simp add: simp_rules sextend.simps)[1]\n done\n\n\n\nthm is_manual\nthm presimplify\n\nend\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/current_work/isabelle/Presimplified_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165382362517, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2821662509990428}} {"text": "theory doc\n imports \"repliss_sem\"\n \"repliss_sem_single_invocation\"\n \"HOL-Library.OptionalSugar\"\n unique_ids\nbegin\n\nsection \"Document Snippets\"\n\n\nnotation (tab output)\n \"HOL.eq\" (\"(_) = (1_)\" [50,49] 50) and\n \"Pure.eq\" (\"(_) \\ (1_)\" [1,1] 2)\n\n\ntext \\\n\\DefineSnippet{local}{\n @{thm [display] repliss_sem.local}\n}%EndSnippet\n\n\\DefineSnippet{newId}{\n @{thm [display] repliss_sem.newId}\n}%EndSnippet\n\n\\DefineSnippet{beginAtomic}{\n @{thm [display] repliss_sem.beginAtomic}\n}%EndSnippet\n\n\\DefineSnippet{endAtomic}{\n @{thm [display] repliss_sem.endAtomic}\n}%EndSnippet\n\n\\DefineSnippet{dbop}{\n @{thm [display] repliss_sem.dbop}\n}%EndSnippet\n\n\\DefineSnippet{invocation}{\n @{thm [display] repliss_sem.invocation}\n}%EndSnippet\n\n\\DefineSnippet{return}{\n @{thm [display] repliss_sem.return}\n}%EndSnippet\n\n\\DefineSnippet{crash}{\n @{thm [display] repliss_sem.crash}\n}%EndSnippet\n\n\\DefineSnippet{invCheck}{\n @{thm [display] repliss_sem.invCheck}\n}%EndSnippet\n\n\n\\\n\n\n\ntext \\\n\\DefineSnippet{s_local}{\n @{thm [display] repliss_sem_single_invocation.local}\n}%EndSnippet\n\n\\DefineSnippet{s_newId}{\n @{thm [display] repliss_sem_single_invocation.newId}\n}%EndSnippet\n\n\\DefineSnippet{s_beginAtomic}{\n @{thm [display] repliss_sem_single_invocation.beginAtomic[unfolded atomize_all]}\n}%EndSnippet\n\n\\DefineSnippet{s_endAtomic}{\n @{thm [display] repliss_sem_single_invocation.endAtomic}\n}%EndSnippet\n\n\\DefineSnippet{s_dbop}{\n @{thm [display] repliss_sem_single_invocation.dbop}\n}%EndSnippet\n\n\\DefineSnippet{s_invocation}{\n @{thm [display] repliss_sem_single_invocation.invocation[unfolded atomize_all]}\n}%EndSnippet\n\n\\DefineSnippet{s_return}{\n @{thm [display] repliss_sem_single_invocation.return}\n}%EndSnippet\n\n\\\n\ntext \\\n\\DefineSnippet{traces}{\n @{thm [display] traces_def}\n}%EndSnippet\n\n\\DefineSnippet{actionCorrect_def}{\n @{thm [display] actionCorrect_def}\n}%EndSnippet\n\n\\DefineSnippet{traceCorrect}{\n @{thm [display] traceCorrect_def}\n}%EndSnippet\n\n\n\\DefineSnippet{programCorrect}{\n @{thm [display] programCorrect_def}\n}%EndSnippet\n\n\n\\\n\nschematic_goal getContext_def: \"visibleCalls S i \\ vis \\ getContext S i = ?x\"\n unfolding getContextH_def\n by auto\n\n\ntext \\\\DefineSnippet{getContext_def}{\n @{thm [display] getContext_def}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{getContext_def_prem}{\n @{thm [display] (prem 1) getContext_def}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{getContext_def_concl}{\n @{thm [display] (concl) getContext_def}\n}%EndSnippet\\\n\n\nschematic_goal invariant_all_def: \"invariant_all S = ?x\"\n unfolding invContextH_def\n by simp\n\ntext \\\\DefineSnippet{invariant_all_def}{\n @{thm [display] invariant_all_def}\n}%EndSnippet\\\n\nlemma committedCalls_def: \"committedCalls S = {c. \\tx. callOrigin S c \\ tx \\ txStatus S tx \\ Committed}\"\n unfolding committedCallsH_def isCommittedH_def\n by simp\n\n\ntext \\\\DefineSnippet{committedCalls_def}{\n @{thm [display] committedCalls_def}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{traceCorrect_s_def}{\n @{thm [display] traceCorrect_s_def}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{programCorrect_s_def}{\n @{thm [display] programCorrect_s_def}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{steps_s_refl}{\n @{thm [display] steps_s_refl}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{steps_s_step}{\n @{thm [display] steps_s_step}\n}%EndSnippet\\\n\n\ntext \\\\DefineSnippet{state_monotonicGrowth_def}{\n @{thm [display] state_monotonicGrowth_def}\n}%EndSnippet\\\n\n\n\ntext \\\\DefineSnippet{program_wellFormed_def}{\n @{thm [display] program_wellFormed_def}\n}%EndSnippet\\\n\n\n\ntext \\\\DefineSnippet{invocations_cannot_guess_ids_def}{\n @{thm [display] invocations_cannot_guess_ids_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{invocations_cannot_guess_ids_def2}{\n @{thm [display] invocations_cannot_guess_ids_def2}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{invocation_cannot_guess_ids_def}{\n @{thm [display] invocation_cannot_guess_ids_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{trace_outputs_def}{\n @{thm [display] trace_outputs_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{action_outputs_simps}{\n @{thm [display] action_outputs.simps}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{trace_inputs_def}{\n @{thm [display] trace_inputs_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{action_inputs_simps}{\n @{thm [display] action_inputs.simps}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{queries_cannot_guess_ids_def}{\n @{thm [display] queries_cannot_guess_ids_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{query_cannot_guess_ids_def}{\n @{thm [display] query_cannot_guess_ids_def}\n}%EndSnippet\\\n\ntext \\\\DefineSnippet{queries_cannot_guess_ids_def2}{\n @{thm [display] queries_cannot_guess_ids_def2}\n}%EndSnippet\\\n\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/doc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.2821662430492543}} {"text": "section {* Host Properties *}\n\ntheory Wasm_Axioms imports Wasm begin\n\nlemma old_mem_size_def:\n shows \"mem_size m = length (fst (Rep_mem m)) div Ki64\"\n unfolding mem_size_def mem_length_def\n by (simp split: prod.splits)\n\n(* these were originally axioms, but memory now has a concrete representation in the model *)\nlemma mem_grow_size:\n assumes \"mem_grow m n = Some m'\"\n shows \"(mem_size m + n) = mem_size m'\"\n using assms Abs_mem_inverse\n unfolding mem_grow_def old_mem_size_def mem_append_def bytes_replicate_def\n by (auto simp add: Ki64_def Let_def split: prod.splits if_splits)\n\nlemma mem_grow_max1:\n assumes \"mem_grow m n = Some m'\"\n shows \"mem_max m = mem_max m'\"\n using assms Abs_mem_inverse\n unfolding mem_grow_def mem_max_def mem_append_def \n by (auto simp add: Ki64_def Let_def split: prod.splits if_splits)\n\nlemma mem_grow_max2:\n assumes \"mem_grow m n = Some m'\"\n shows \"pred_option ((\\) (mem_size m')) (mem_max m')\"\n using assms Abs_mem_inverse\n unfolding mem_grow_def mem_max_def mem_append_def\n by (auto simp add: assms mem_grow_size Let_def split: prod.splits if_splits)\n\nlemma mem_grow_length:\n assumes \"mem_grow m n = Some m'\"\n shows \"(mem_length m + (n * Ki64)) = mem_length m'\"\n using assms Abs_mem_inverse\n bytes_replicate_def mem_append.rep_eq mem_length.rep_eq\n unfolding mem_grow_def old_mem_size_def mem_append_def bytes_replicate_def\n by (auto simp add: Let_def split: prod.splits if_splits)\n\nlemma mem_grow_byte_at_m:\n assumes \"k < mem_length m\"\n \"(mem_grow m n) = Some m'\"\n shows \"byte_at m' k = byte_at m k\"\n using assms\n unfolding byte_at.rep_eq mem_length.rep_eq mem_grow_def mem_append.rep_eq mem_append_def\n by (auto simp add: Abs_mem_inverse nth_append Let_def split: prod.splits if_splits)\n\nlemma mem_grow_byte_at_m_n:\n assumes \"k \\ mem_length m\"\n \"(mem_grow m n) = Some m'\"\n \"k < mem_length m'\"\n shows \"byte_at m' k = (0::byte)\"\n using assms\n unfolding byte_at.rep_eq mem_length.rep_eq mem_grow_def mem_append.rep_eq bytes_replicate_def mem_append_def\n by (auto simp add: Abs_mem_inverse nth_append Let_def split: prod.splits if_splits)\n\nlemma load_size:\n \"(load m n off l = None) = (mem_length m < (off + n + l))\"\n unfolding load_def\n by (cases \"n + off + l \\ mem_length m\") auto\n\nlemma load_packed_size:\n \"(load_packed sx m n off lp l = None) = (mem_length m < (off + n + lp))\"\n using load_size\n unfolding load_packed_def\n by (cases \"n + off + l \\ mem_length m\") auto \n\nlemma store_size1:\n \"(store m n off v l = None) = (mem_length m < (off + n + l))\"\n unfolding store_def\n by (cases \"n + off + l \\ mem_length m\") auto\n\nlemma store_size:\n assumes \"(store m n off v l = Some m')\"\n shows \"mem_size m = mem_size m'\"\n using assms Abs_mem_inverse mem_length.rep_eq\n unfolding store_def write_bytes_def bytes_takefill_def\n by (cases \"n + off + l \\ mem_length m\") (auto simp add: old_mem_size_def split: prod.splits)\n\nlemma store_max:\n assumes \"(store m n off v l = Some m')\"\n shows \"mem_max m = mem_max m'\"\n using assms Abs_mem_inverse\n unfolding store_def mem_max.rep_eq write_bytes_def\n by (auto split: if_splits prod.splits)\n\nlemma store_length:\n assumes \"(store m n off v l = Some m')\"\n shows \"mem_length m = mem_length m'\"\n using assms Abs_mem_inverse mem_length.rep_eq\n unfolding store_def write_bytes_def bytes_takefill_def\n by (cases \"n + off + l \\ mem_length m\") (auto split: prod.splits)\n\nlemma store_packed_size1:\n \"(store_packed m n off v l = None) = (mem_length m < (off + n + l))\"\n using store_size1\n unfolding store_packed_def\n by simp\n\nlemma store_packed_size:\n assumes \"(store_packed m n off v l = Some m')\"\n shows \"mem_size m = mem_size m'\"\n using assms store_size\n unfolding store_packed_def\n by simp\n\nlemma store_packed_max:\n assumes \"(store_packed m n off v l = Some m')\"\n shows \"mem_max m = mem_max m'\"\n using assms store_max\n unfolding store_packed_def\n by simp\n\naxiomatization where\n wasm_deserialise_type:\"typeof (wasm_deserialise bs t) = t\"\n\naxiomatization where\n host_apply_preserve_store1:\"host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\ store_extension s s'\"\nand host_apply_preserve_store2:\"host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\ store_typing s \\ store_typing s'\"\nand host_apply_respect_type:\"list_all2 types_agree t1s vs \\ host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\ list_all2 types_agree t2s vs'\"\n\nlemma host_apply_preserve_store:\n assumes \"host_apply s (t1s _> t2s) f vs hs = Some (s', vs')\"\n \"store_typing s\"\n shows \"store_extension s s' \\ store_typing s'\"\n using assms host_apply_preserve_store1 host_apply_preserve_store2\n by blast\n\nend", "meta": {"author": "conrad-watt", "repo": "wasm-pl-isabelle", "sha": "265f292250c01770d50d4ecda998ed5961c6719e", "save_path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle", "path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle/wasm-pl-isabelle-265f292250c01770d50d4ecda998ed5961c6719e/WebAssembly/Wasm_Axioms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593171945417, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2821370604259934}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory longlong\nimports \"CParser.CTranslation\"\nbegin\n\nexternal_file \"longlong.c\"\ninstall_C_file \"longlong.c\"\n\nML \\NameGeneration.return_var_name (Absyn.Signed Absyn.LongLong)\\\n\n\ncontext longlong\nbegin\n\nthm f_body_def\nthm shifts1_body_def\nthm shifts2_body_def\n\nlemma \"(ucast :: 16 word \\ 8 word) 32768 = 0\"\napply simp\ndone\n\nlemma \"(scast :: 16 word \\ 8 word) 32768 = 0\"\nby simp\n\nlemma \"(scast :: 16 word \\ 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\ 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\ 8 word) 32767 = 255\" by simp\nlemma \"(scast :: 16 word \\ 8 word) 32767 = 255\" by simp\n\nlemma \"(scast :: 8 word \\ 16 word) 255 = 65535\" by simp\nlemma \"(ucast :: 8 word \\ 16 word) 255 = 255\" by simp\n\nlemma g_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL callg() \\ \\ret__int = 0 \\\"\napply vcg\napply (simp add: max_word_def)\ndone\n\nthm literals_body_def\n\nlemma literals_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL literals() \\ \\ret__int = 31 \\\"\napply vcg\napply simp\ndone\n\nend (* context *)\n\nend (* theory *)\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/c-parser/testfiles/longlong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.28211478544317137}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2018-2020\n(C) Copyright Sebastian A. Mödersheim, DTU, 2018-2020\n(C) Copyright Achim D. Brucker, University of Sheffield, 2018-2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Labeled_Strands.thy\n Author: Andreas Viktor Hess, DTU\n Author: Sebastian A. Mödersheim, DTU\n Author: Achim D. Brucker, The University of Sheffield\n*)\n\nsection \\Labeled Strands\\\ntheory Labeled_Strands\nimports Strands_and_Constraints\nbegin\n\nsubsection \\Definitions: Labeled Strands and Constraints\\\ndatatype 'l strand_label =\n LabelN (the_LabelN: \"'l\") (\"ln _\")\n| LabelS (\"\\\")\n\ntext \\Labeled strands are strands whose steps are equipped with labels\\\ntype_synonym ('a,'b,'c) labeled_strand_step = \"'c strand_label \\ ('a,'b) strand_step\"\ntype_synonym ('a,'b,'c) labeled_strand = \"('a,'b,'c) labeled_strand_step list\"\n\nabbreviation is_LabelN where \"is_LabelN n x \\ fst x = ln n\"\nabbreviation is_LabelS where \"is_LabelS x \\ fst x = \\\"\n\ndefinition unlabel where \"unlabel S \\ map snd S\"\ndefinition proj where \"proj n S \\ filter (\\s. is_LabelN n s \\ is_LabelS s) S\"\nabbreviation proj_unl where \"proj_unl n S \\ unlabel (proj n S)\"\n\nabbreviation wfrestrictedvars\\<^sub>l\\<^sub>s\\<^sub>t where \"wfrestrictedvars\\<^sub>l\\<^sub>s\\<^sub>t S \\ wfrestrictedvars\\<^sub>s\\<^sub>t (unlabel S)\"\n\nabbreviation subst_apply_labeled_strand_step (infix \"\\\\<^sub>l\\<^sub>s\\<^sub>t\\<^sub>p\" 51) where\n \"x \\\\<^sub>l\\<^sub>s\\<^sub>t\\<^sub>p \\ \\ (case x of (l, s) \\ (l, s \\\\<^sub>s\\<^sub>t\\<^sub>p \\))\"\n\nabbreviation subst_apply_labeled_strand (infix \"\\\\<^sub>l\\<^sub>s\\<^sub>t\" 51) where\n \"S \\\\<^sub>l\\<^sub>s\\<^sub>t \\ \\ map (\\x. x \\\\<^sub>l\\<^sub>s\\<^sub>t\\<^sub>p \\) S\"\n\nabbreviation trms\\<^sub>l\\<^sub>s\\<^sub>t where \"trms\\<^sub>l\\<^sub>s\\<^sub>t S \\ trms\\<^sub>s\\<^sub>t (unlabel S)\"\nabbreviation trms_proj\\<^sub>l\\<^sub>s\\<^sub>t where \"trms_proj\\<^sub>l\\<^sub>s\\<^sub>t n S \\ trms\\<^sub>s\\<^sub>t (proj_unl n S)\"\n\nabbreviation vars\\<^sub>l\\<^sub>s\\<^sub>t where \"vars\\<^sub>l\\<^sub>s\\<^sub>t S \\ vars\\<^sub>s\\<^sub>t (unlabel S)\"\nabbreviation vars_proj\\<^sub>l\\<^sub>s\\<^sub>t where \"vars_proj\\<^sub>l\\<^sub>s\\<^sub>t n S \\ vars\\<^sub>s\\<^sub>t (proj_unl n S)\"\n\nabbreviation bvars\\<^sub>l\\<^sub>s\\<^sub>t where \"bvars\\<^sub>l\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>t (unlabel S)\"\nabbreviation fv\\<^sub>l\\<^sub>s\\<^sub>t where \"fv\\<^sub>l\\<^sub>s\\<^sub>t S \\ fv\\<^sub>s\\<^sub>t (unlabel S)\"\n\nabbreviation wf\\<^sub>l\\<^sub>s\\<^sub>t where \"wf\\<^sub>l\\<^sub>s\\<^sub>t V S \\ wf\\<^sub>s\\<^sub>t V (unlabel S)\"\n\n\nsubsection \\Lemmata: Projections\\\nlemma is_LabelS_proj_iff_not_is_LabelN:\n \"list_all is_LabelS (proj l A) \\ \\list_ex (is_LabelN l) A\"\nby (induct A) (auto simp add: proj_def)\n\nlemma proj_subset_if_no_label:\n assumes \"\\list_ex (is_LabelN l) A\"\n shows \"set (proj l A) \\ set (proj l' A)\"\n and \"set (proj_unl l A) \\ set (proj_unl l' A)\"\nusing assms by (induct A) (auto simp add: unlabel_def proj_def)\n\nlemma proj_in_setD:\n assumes a: \"a \\ set (proj l A)\"\n obtains k b where \"a = (k, b)\" \"k = (ln l) \\ k = \\\"\nusing that a unfolding proj_def by (cases a) auto\n\nlemma proj_set_mono:\n assumes \"set A \\ set B\"\n shows \"set (proj n A) \\ set (proj n B)\"\n and \"set (proj_unl n A) \\ set (proj_unl n B)\"\nusing assms unfolding proj_def unlabel_def by auto\n\nlemma unlabel_nil[simp]: \"unlabel [] = []\"\nby (simp add: unlabel_def)\n\nlemma unlabel_mono: \"set A \\ set B \\ set (unlabel A) \\ set (unlabel B)\"\nby (auto simp add: unlabel_def)\n\nlemma unlabel_in: \"(l,x) \\ set A \\ x \\ set (unlabel A)\"\nunfolding unlabel_def by force\n\nlemma unlabel_mem_has_label: \"x \\ set (unlabel A) \\ \\l. (l,x) \\ set A\"\nunfolding unlabel_def by auto\n\nlemma proj_nil[simp]: \"proj n [] = []\" \"proj_unl n [] = []\"\nunfolding unlabel_def proj_def by auto\n\nlemma singleton_lst_proj[simp]:\n \"proj_unl l [(ln l, a)] = [a]\"\n \"l \\ l' \\ proj_unl l' [(ln l, a)] = []\"\n \"proj_unl l [(\\, a)] = [a]\"\n \"unlabel [(l'', a)] = [a]\"\nunfolding proj_def unlabel_def by simp_all\n\nlemma unlabel_nil_only_if_nil[simp]: \"unlabel A = [] \\ A = []\"\nunfolding unlabel_def by auto\n\nlemma unlabel_Cons[simp]:\n \"unlabel ((l,a)#A) = a#unlabel A\"\n \"unlabel (b#A) = snd b#unlabel A\"\nunfolding unlabel_def by simp_all\n\nlemma unlabel_append[simp]: \"unlabel (A@B) = unlabel A@unlabel B\"\nunfolding unlabel_def by auto\n\nlemma proj_Cons[simp]:\n \"proj n ((ln n,a)#A) = (ln n,a)#proj n A\"\n \"proj n ((\\,a)#A) = (\\,a)#proj n A\"\n \"m \\ n \\ proj n ((ln m,a)#A) = proj n A\"\n \"l = (ln n) \\ proj n ((l,a)#A) = (l,a)#proj n A\"\n \"l = \\ \\ proj n ((l,a)#A) = (l,a)#proj n A\"\n \"fst b \\ \\ \\ fst b \\ (ln n) \\ proj n (b#A) = proj n A\"\nunfolding proj_def by auto\n\nlemma proj_append[simp]:\n \"proj l (A'@B') = proj l A'@proj l B'\"\n \"proj_unl l (A@B) = proj_unl l A@proj_unl l B\"\nunfolding proj_def unlabel_def by auto\n\nlemma proj_unl_cons[simp]:\n \"proj_unl l ((ln l, a)#A) = a#proj_unl l A\"\n \"l \\ l' \\ proj_unl l' ((ln l, a)#A) = proj_unl l' A\"\n \"proj_unl l ((\\, a)#A) = a#proj_unl l A\"\nunfolding proj_def unlabel_def by simp_all\n\nlemma trms_unlabel_proj[simp]:\n \"trms\\<^sub>s\\<^sub>t\\<^sub>p (snd (ln l, x)) \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [(ln l, x)]\"\nby auto\n\nlemma trms_unlabel_star[simp]:\n \"trms\\<^sub>s\\<^sub>t\\<^sub>p (snd (\\, x)) \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [(\\, x)]\"\nby auto\n\nlemma trms\\<^sub>l\\<^sub>s\\<^sub>t_union[simp]: \"trms\\<^sub>l\\<^sub>s\\<^sub>t A = (\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l A)\"\nproof (induction A)\n case (Cons a A)\n obtain l s where ls: \"a = (l,s)\" by moura\n have \"trms\\<^sub>l\\<^sub>s\\<^sub>t [a] = (\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a])\"\n proof -\n have *: \"trms\\<^sub>l\\<^sub>s\\<^sub>t [a] = trms\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by simp\n show ?thesis\n proof (cases l)\n case (LabelN n)\n hence \"trms_proj\\<^sub>l\\<^sub>s\\<^sub>t n [a] = trms\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by simp\n moreover have \"\\m. n \\ m \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t m [a] = {}\" using ls LabelN by auto\n ultimately show ?thesis using * ls by fastforce\n next\n case LabelS\n hence \"\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a] = trms\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by auto\n thus ?thesis using * ls by fastforce\n qed\n qed\n moreover have \"\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l (a#A) = trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a] \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l A\"\n unfolding unlabel_def proj_def by auto\n hence \"(\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l (a#A)) = (\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a]) \\ (\\l. trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l A)\" by auto\n ultimately show ?case using Cons.IH ls by auto\nqed simp\n\nlemma trms\\<^sub>l\\<^sub>s\\<^sub>t_append[simp]: \"trms\\<^sub>l\\<^sub>s\\<^sub>t (A@B) = trms\\<^sub>l\\<^sub>s\\<^sub>t A \\ trms\\<^sub>l\\<^sub>s\\<^sub>t B\"\nby (metis trms\\<^sub>s\\<^sub>t_append unlabel_append)\n\nlemma trms_proj\\<^sub>l\\<^sub>s\\<^sub>t_append[simp]: \"trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l (A@B) = trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l A \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l B\"\nby (metis (no_types, lifting) filter_append proj_def trms\\<^sub>l\\<^sub>s\\<^sub>t_append)\n\nlemma trms_proj\\<^sub>l\\<^sub>s\\<^sub>t_subset[simp]:\n \"trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l A \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l (A@B)\"\n \"trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l B \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t l (A@B)\"\nusing trms_proj\\<^sub>l\\<^sub>s\\<^sub>t_append[of l] by blast+\n\nlemma trms\\<^sub>l\\<^sub>s\\<^sub>t_subset[simp]:\n \"trms\\<^sub>l\\<^sub>s\\<^sub>t A \\ trms\\<^sub>l\\<^sub>s\\<^sub>t (A@B)\"\n \"trms\\<^sub>l\\<^sub>s\\<^sub>t B \\ trms\\<^sub>l\\<^sub>s\\<^sub>t (A@B)\"\nproof (induction A)\n case (Cons a A)\n obtain l s where *: \"a = (l,s)\" by moura\n { case 1 thus ?case using Cons * by auto }\n { case 2 thus ?case using Cons * by auto }\nqed simp_all\n\nlemma vars\\<^sub>l\\<^sub>s\\<^sub>t_union: \"vars\\<^sub>l\\<^sub>s\\<^sub>t A = (\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l A)\"\nproof (induction A)\n case (Cons a A)\n obtain l s where ls: \"a = (l,s)\" by moura\n have \"vars\\<^sub>l\\<^sub>s\\<^sub>t [a] = (\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a])\"\n proof -\n have *: \"vars\\<^sub>l\\<^sub>s\\<^sub>t [a] = vars\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by auto\n show ?thesis\n proof (cases l)\n case (LabelN n)\n hence \"vars_proj\\<^sub>l\\<^sub>s\\<^sub>t n [a] = vars\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by simp\n moreover have \"\\m. n \\ m \\ vars_proj\\<^sub>l\\<^sub>s\\<^sub>t m [a] = {}\" using ls LabelN by auto\n ultimately show ?thesis using * ls by fast\n next\n case LabelS\n hence \"\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a] = vars\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by auto\n thus ?thesis using * ls by fast\n qed\n qed\n moreover have \"\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l (a#A) = vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a] \\ vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l A\"\n unfolding unlabel_def proj_def by auto\n hence \"(\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l (a#A)) = (\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l [a]) \\ (\\l. vars_proj\\<^sub>l\\<^sub>s\\<^sub>t l A)\"\n using strand_vars_split(1) by auto\n ultimately show ?case using Cons.IH ls strand_vars_split(1) by auto\nqed simp\n\nlemma unlabel_Cons_inv:\n \"unlabel A = b#B \\ \\A'. (\\n. A = (ln n, b)#A') \\ A = (\\, b)#A'\"\nproof -\n assume *: \"unlabel A = b#B\"\n then obtain l A' where \"A = (l,b)#A'\" unfolding unlabel_def by moura\n thus \"\\A'. (\\l. A = (ln l, b)#A') \\ A = (\\, b)#A'\" by (metis strand_label.exhaust)\nqed\n\nlemma unlabel_snoc_inv:\n \"unlabel A = B@[b] \\ \\A'. (\\n. A = A'@[(ln n, b)]) \\ A = A'@[(\\, b)]\"\nproof -\n assume *: \"unlabel A = B@[b]\"\n then obtain A' l where \"A = A'@[(l,b)]\"\n unfolding unlabel_def by (induct A rule: List.rev_induct) auto\n thus \"\\A'. (\\n. A = A'@[(ln n, b)]) \\ A = A'@[(\\, b)]\" by (cases l) auto\nqed\n\nlemma proj_idem[simp]: \"proj l (proj l A) = proj l A\"\nunfolding proj_def by auto\n\nlemma proj_ik\\<^sub>s\\<^sub>t_is_proj_rcv_set:\n \"ik\\<^sub>s\\<^sub>t (proj_unl n A) = {t. (ln n, Receive t) \\ set A \\ (\\, Receive t) \\ set A} \"\nusing ik\\<^sub>s\\<^sub>t_is_rcv_set unfolding unlabel_def proj_def by force\n\nlemma unlabel_ik\\<^sub>s\\<^sub>t_is_rcv_set:\n \"ik\\<^sub>s\\<^sub>t (unlabel A) = {t | l t. (l, Receive t) \\ set A}\"\nusing ik\\<^sub>s\\<^sub>t_is_rcv_set unfolding unlabel_def by force\n\nlemma proj_ik_union_is_unlabel_ik:\n \"ik\\<^sub>s\\<^sub>t (unlabel A) = (\\l. ik\\<^sub>s\\<^sub>t (proj_unl l A))\"\nproof\n show \"(\\l. ik\\<^sub>s\\<^sub>t (proj_unl l A)) \\ ik\\<^sub>s\\<^sub>t (unlabel A)\"\n using unlabel_ik\\<^sub>s\\<^sub>t_is_rcv_set[of A] proj_ik\\<^sub>s\\<^sub>t_is_proj_rcv_set[of _ A] by auto\n\n show \"ik\\<^sub>s\\<^sub>t (unlabel A) \\ (\\l. ik\\<^sub>s\\<^sub>t (proj_unl l A))\"\n proof\n fix t assume \"t \\ ik\\<^sub>s\\<^sub>t (unlabel A)\"\n then obtain l where \"(l, Receive t) \\ set A\"\n using ik\\<^sub>s\\<^sub>t_is_rcv_set unlabel_mem_has_label[of _ A]\n by moura\n thus \"t \\ (\\l. ik\\<^sub>s\\<^sub>t (proj_unl l A))\" using proj_ik\\<^sub>s\\<^sub>t_is_proj_rcv_set[of _ A] by (cases l) auto\n qed\nqed\n\nlemma proj_ik_append[simp]:\n \"ik\\<^sub>s\\<^sub>t (proj_unl l (A@B)) = ik\\<^sub>s\\<^sub>t (proj_unl l A) \\ ik\\<^sub>s\\<^sub>t (proj_unl l B)\"\nusing proj_append(2)[of l A B] ik_append by auto\n\nlemma proj_ik_append_subst_all:\n \"ik\\<^sub>s\\<^sub>t (proj_unl l (A@B)) \\\\<^sub>s\\<^sub>e\\<^sub>t I = (ik\\<^sub>s\\<^sub>t (proj_unl l A) \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\ (ik\\<^sub>s\\<^sub>t (proj_unl l B) \\\\<^sub>s\\<^sub>e\\<^sub>t I)\"\nusing proj_ik_append[of l] by auto\n\nlemma ik_proj_subset[simp]: \"ik\\<^sub>s\\<^sub>t (proj_unl n A) \\ trms_proj\\<^sub>l\\<^sub>s\\<^sub>t n A\"\nby auto\n\nlemma prefix_proj:\n \"prefix A B \\ prefix (unlabel A) (unlabel B)\"\n \"prefix A B \\ prefix (proj n A) (proj n B)\"\n \"prefix A B \\ prefix (proj_unl n A) (proj_unl n B)\"\nunfolding prefix_def unlabel_def proj_def by auto\n\n\nsubsection \\Lemmata: Well-formedness\\\nlemma wfvarsoccs\\<^sub>s\\<^sub>t_proj_union:\n \"wfvarsoccs\\<^sub>s\\<^sub>t (unlabel A) = (\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l A))\"\nproof (induction A)\n case (Cons a A)\n obtain l s where ls: \"a = (l,s)\" by moura\n have \"wfvarsoccs\\<^sub>s\\<^sub>t (unlabel [a]) = (\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l [a]))\"\n proof -\n have *: \"wfvarsoccs\\<^sub>s\\<^sub>t (unlabel [a]) = wfvarsoccs\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by auto\n show ?thesis\n proof (cases l)\n case (LabelN n)\n hence \"wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl n [a]) = wfvarsoccs\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by simp\n moreover have \"\\m. n \\ m \\ wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl m [a]) = {}\" using ls LabelN by auto\n ultimately show ?thesis using * ls by fast\n next\n case LabelS\n hence \"\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l [a]) = wfvarsoccs\\<^sub>s\\<^sub>t\\<^sub>p s\" using ls by auto\n thus ?thesis using * ls by fast\n qed\n qed\n moreover have\n \"wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l (a#A)) =\n wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l [a]) \\ wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l A)\"\n for l\n unfolding unlabel_def proj_def by auto\n hence \"(\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l (a#A))) =\n (\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l [a])) \\ (\\l. wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l A))\"\n using strand_vars_split(1) by auto\n ultimately show ?case using Cons.IH ls strand_vars_split(1) by auto\nqed simp\n\nlemma wf_if_wf_proj:\n assumes \"\\l. wf\\<^sub>s\\<^sub>t V (proj_unl l A)\"\n shows \"wf\\<^sub>s\\<^sub>t V (unlabel A)\"\nusing assms\nproof (induction A arbitrary: V rule: List.rev_induct)\n case (snoc a A)\n hence IH: \"wf\\<^sub>s\\<^sub>t V (unlabel A)\" using proj_append(2)[of _ A] by auto\n obtain b l where b: \"a = (ln l, b) \\ a = (\\, b)\" by (cases a, metis strand_label.exhaust)\n hence *: \"wf\\<^sub>s\\<^sub>t V (proj_unl l A@[b])\"\n by (metis snoc.prems proj_append(2) singleton_lst_proj(1) proj_unl_cons(1,3))\n thus ?case using IH b snoc.prems proj_append(2)[of l A \"[a]\"] unlabel_append[of A \"[a]\"]\n proof (cases b)\n case (Receive t)\n have \"fv t \\ wfvarsoccs\\<^sub>s\\<^sub>t (unlabel A) \\ V\"\n proof\n fix x assume \"x \\ fv t\"\n hence \"x \\ V \\ wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l A)\" using wf_append_exec[OF *] b Receive by auto\n thus \"x \\ wfvarsoccs\\<^sub>s\\<^sub>t (unlabel A) \\ V\" using wfvarsoccs\\<^sub>s\\<^sub>t_proj_union[of A] by auto\n qed\n hence \"fv t \\ wfrestrictedvars\\<^sub>s\\<^sub>t (unlabel A) \\ V\"\n using vars_snd_rcv_strand_subset2(4)[of \"unlabel A\"] by blast\n hence \"wf\\<^sub>s\\<^sub>t V (unlabel A@[Receive t])\" by (rule wf_rcv_append'''[OF IH])\n thus ?thesis using b Receive unlabel_append[of A \"[a]\"] by auto\n next\n case (Equality ac s t)\n have \"fv t \\ wfvarsoccs\\<^sub>s\\<^sub>t (unlabel A) \\ V\" when \"ac = Assign\"\n proof\n fix x assume \"x \\ fv t\"\n hence \"x \\ V \\ wfvarsoccs\\<^sub>s\\<^sub>t (proj_unl l A)\" using wf_append_exec[OF *] b Equality that by auto\n thus \"x \\ wfvarsoccs\\<^sub>s\\<^sub>t (unlabel A) \\ V\" using wfvarsoccs\\<^sub>s\\<^sub>t_proj_union[of A] by auto\n qed\n hence \"fv t \\ wfrestrictedvars\\<^sub>l\\<^sub>s\\<^sub>t A \\ V\" when \"ac = Assign\"\n using vars_snd_rcv_strand_subset2(4)[of \"unlabel A\"] that by blast\n hence \"wf\\<^sub>s\\<^sub>t V (unlabel A@[Equality ac s t])\"\n by (cases ac) (metis wf_eq_append'''[OF IH], metis wf_eq_check_append''[OF IH])\n thus ?thesis using b Equality unlabel_append[of A \"[a]\"] by auto\n qed auto\nqed simp\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Stateful_Protocol_Composition_and_Typing", "sha": "34755583e50bc8a2e3eb0f91350c0b8510422a16", "save_path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing", "path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing/Stateful_Protocol_Composition_and_Typing-34755583e50bc8a2e3eb0f91350c0b8510422a16/Stateful_Protocol_Composition_and_Typing/Labeled_Strands.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.2821147854431713}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_op_rep_par\nimports CSP_T_op_alpha_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*============================================================*\n | |\n | replicated alphabetized parallel |\n | |\n *============================================================*)\n\n(*** traces Inductive_parallel ***)\n\nlemma in_traces_Inductive_parallel_lm1: \n \"(P, X) : set PXs ==> X <= Union (snd ` (set PXs))\"\nby (auto)\n\n(* main *)\n\nlemma in_traces_Inductive_parallel_lm:\n \"PXs ~= [] --> (ALL u.\n (u :t traces ([||] PXs) M) =\n (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M)))\"\napply (induct_tac PXs)\n\n(* case 0 *)\n apply (simp)\n\n(* case 1 *)\n apply (case_tac \"list = []\")\n apply (simp)\n apply (intro allI)\n apply (simp add: in_traces_Alpha_parallel in_traces)\n apply (simp add: pair_eq_decompo)\n apply (simp add: rest_tr_empty)\n apply (rule iffI)\n (* => *)\n apply (simp)\n (* <= *)\n apply (simp)\n\n(* step case *)\napply (simp add: in_traces_Alpha_parallel)\napply (intro allI impI)\napply (rule iffI)\n\n(* => *)\n apply (simp)\n apply (intro allI)\n apply (rule conjI)\n\n apply (intro impI)\n apply (simp add: pair_eq_decompo)\n\n apply (intro impI)\n apply (elim conjE)\n apply (drule_tac x=\"P\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (simp add: in_traces_Inductive_parallel_lm1)\n\n(* <= *)\n apply (simp add: rest_tr_sett_subseteq_sett)\n apply (intro allI impI)\n apply (elim conjE)\n apply (drule_tac x=\"P\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (simp add: in_traces_Inductive_parallel_lm1)\ndone\n\n(*** remove ALL ***)\n\nlemma in_traces_Inductive_parallel:\n \"PXs ~= [] \n ==> (u :t traces ([||] PXs) M) =\n (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M))\"\nby (simp add: in_traces_Inductive_parallel_lm)\n\n(*** Semantics for replicated alphabetized parallel on T ***)\n\nlemma traces_Inductive_parallel:\n \"PXs ~= []\n ==> traces ([||] PXs) M =\n {u. sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M)}t\"\napply (simp add: in_traces_Inductive_parallel[THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_traces_Inductive_parallel:\n \"[| PXs ~= [] ; t :t traces ([||] PXs) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` set PXs))\"\nby (simp add: in_traces_Inductive_parallel)\n\n(*---------------------------------------------------------*\n | another expression of Inductive_parallel_eval |\n *---------------------------------------------------------*)\n\nlemma in_traces_Inductive_parallel_nth:\n \"PXs ~= [] \n ==> (u :t traces ([||] PXs) M) =\n (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n (ALL i. i < length PXs --> (u rest-tr (snd (PXs!i))) :t traces (fst (PXs!i)) M))\"\napply (simp add: in_traces_Inductive_parallel)\napply (simp add: set_nth)\napply (simp add: pair_eq_decompo)\nby (auto)\n\n(*============================================================*\n | |\n | indexed alphabetized parallel |\n | |\n *============================================================*)\n\n(*** index_style ***)\n\nlemma to_index_style_T:\n \"(ALL P X. (P,X):(PXf ` I) --> (u rest-tr X) :t traces P M)\n = (ALL i:I. u rest-tr (snd (PXf i)) :t traces (fst (PXf i)) M)\"\napply (auto)\napply (simp add: pair_eq_decompo)\ndone\n\n(*** in_traces_Rep_parallel (pre) ***)\n\nlemma in_traces_Rep_parallel_pre:\n \"[| I ~= {} ; finite I |]\n ==> (u :t traces ([||]:I PXf) M) =\n (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n (ALL P X. (P,X):PXf ` I --> (u rest-tr X) :t traces P M))\"\napply (simp add: Rep_parallel_def)\napply (subgoal_tac \"EX Is. Is isListOf I\")\napply (elim conjE exE)\napply (subgoal_tac \"(map PXf (SOME Is. Is isListOf I)) ~= []\")\napply (simp add: in_traces in_traces_Inductive_parallel)\napply (rule someI2)\n apply (simp)\n apply (simp add: isListOf_set_eq)\n\napply (rule someI2)\n apply (simp)\n apply (simp add: isListOf_nonemptyset)\n\napply (simp add: isListOf_EX)\ndone\n\n(*** in_traces_Rep_parallel ***)\n\nlemma in_traces_Rep_parallel:\n \"[| I ~= {} ; finite I |]\n ==> (u :t traces ([||]:I PXf) M) =\n (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n (ALL i:I. (u rest-tr (snd (PXf i))) :t traces (fst (PXf i)) M))\"\napply (simp add: in_traces_Rep_parallel_pre)\napply (simp add: to_index_style_T)\ndone\n\nlemmas in_traces_par = in_traces_Alpha_parallel\n in_traces_Inductive_parallel\n in_traces_Rep_parallel\n\n(*** Semantics for indexed alphabetized parallel on T ***)\n\nlemma traces_Rep_parallel:\n \"[| I ~= {} ; finite I |]\n ==> traces ([||]:I PXf) M =\n {u. (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n (ALL i:I. (u rest-tr (snd (PXf i))) :t traces (fst (PXf i)) M))}t\"\napply (simp add: in_traces_Rep_parallel[THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_traces_Rep_parallel:\n \"[| I ~= {} ; finite I ; t :t traces ([||]:I PXf) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` PXf ` I))\"\nby (simp add: in_traces_Rep_parallel)\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_T/CSP_T_op_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.5234203489363239, "lm_q1q2_score": 0.28211477769101206}} {"text": "section \\Stack by Array\\\ntheory Impl_Array_Stack\nimports\n \"../../../Automatic_Refinement/Automatic_Refinement\"\n \"../../Lib/Diff_Array\"\nbegin\n\ntype_synonym 'a array_stack = \"'a array \\ nat\"\n\nterm Diff_Array.array_length\n\ndefinition \"as_raw_\\ s \\ take (snd s) (list_of_array (fst s))\"\ndefinition \"as_raw_invar s \\ snd s \\ array_length (fst s)\"\n\ndefinition as_rel_def_internal: \"as_rel R \\ br as_raw_\\ as_raw_invar O \\R\\list_rel\"\nlemma as_rel_def: \"\\R\\as_rel \\ br as_raw_\\ as_raw_invar O \\R\\list_rel\"\n unfolding as_rel_def_internal[abs_def] by (simp add: relAPP_def)\n\nlemma [relator_props]: \"single_valued R \\ single_valued (\\R\\as_rel)\"\n unfolding as_rel_def\n by tagged_solver\n\nlemmas [autoref_rel_intf] = REL_INTFI[of as_rel i_list]\n\n\ndefinition \"as_empty (_::unit) \\ (array_of_list [],0)\"\n\nlemma as_empty_refine[autoref_rules]: \"(as_empty (),[]) \\ \\R\\as_rel\"\n unfolding as_rel_def as_empty_def br_def\n unfolding as_raw_\\_def as_raw_invar_def\n by auto\n\n\ndefinition \"as_push s x \\ let\n (a,n)=s;\n a = if n = array_length a then\n array_grow a (max 4 (2*n)) x\n else a;\n a = array_set a n x\n in\n (a,n+1)\"\n\nlemma as_push_refine[autoref_rules]: \n \"(as_push,op_list_append_elem) \\ \\R\\as_rel \\ R \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (simp add: as_push_def op_list_append_elem_def as_rel_def br_def\n as_raw_\\_def as_raw_invar_def)\n apply clarsimp\n apply safe\n apply (rule)\n apply auto []\n apply (clarsimp simp: array_length_list) []\n apply parametricity\n\n apply rule\n apply auto []\n apply (auto simp: take_Suc_conv_app_nth array_length_list list_update_append) []\n apply parametricity\n done\n\nterm array_shrink\n\ndefinition \"as_shrink s \\ let \n (a,n) = s;\n a = if 128*n \\ array_length a \\ n>4 then\n array_shrink a n\n else a\n in\n (a,n)\"\n\nlemma as_shrink_id_refine: \"(as_shrink,id) \\ \\R\\as_rel \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (simp add: as_shrink_def as_rel_def br_def\n as_raw_\\_def as_raw_invar_def Let_def)\n apply clarsimp\n apply safe\n\n apply (rule)\n apply (auto simp: array_length_list)\n done\n\nlemma as_shrinkI:\n assumes [param]: \"(s,a)\\\\R\\as_rel\"\n shows \"(as_shrink s,a)\\\\R\\as_rel\"\n apply (subst id_apply[of a,symmetric])\n apply (parametricity add: as_shrink_id_refine)\n done\n\ndefinition \"as_pop s \\ let (a,n)=s in as_shrink (a,n - 1)\"\n\nlemma as_pop_refine[autoref_rules]: \"(as_pop,butlast) \\ \\R\\as_rel \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (clarsimp simp add: as_pop_def split: prod.split)\n apply (rule as_shrinkI)\n\n apply (simp add: as_pop_def as_rel_def br_def\n as_raw_\\_def as_raw_invar_def Let_def)\n apply clarsimp\n\n apply rule\n apply (auto simp: array_length_list) []\n apply (clarsimp simp: array_length_list take_minus_one_conv_butlast) []\n apply parametricity\n done\n \ndefinition \"as_get s i \\ let (a,_::nat)=s in array_get a i\"\n\nlemma as_get_refine: \n assumes 1: \"i'\\R\\as_rel\" \n assumes 3[param]: \"(i,i')\\nat_rel\"\n shows \"(as_get a i,l!i')\\R\"\n using 2\n apply (clarsimp \n simp add: as_get_def as_rel_def br_def as_raw_\\_def as_raw_invar_def\n split: prod.split)\n apply (rename_tac aa bb)\n apply (case_tac aa, simp)\nproof -\n fix n cl\n assume TKR[param]: \"(take n cl, l) \\ \\R\\list_rel\"\n\n have \"(take n cl!i, l!i')\\R\"\n by parametricity (rule 1)\n also have \"take n cl!i = cl!i\"\n using 1 3 list_rel_imp_same_length[OF TKR]\n by simp\n finally show \"(cl!i,l!i')\\R\" .\nqed\n \ncontext begin interpretation autoref_syn .\nlemma as_get_autoref[autoref_rules]: \n assumes \"(l,l')\\\\R\\as_rel\"\n assumes \"(i,i')\\Id\"\n assumes \"SIDE_PRECOND (i' < length l')\"\n shows \"(as_get l i,(OP nth ::: \\R\\as_rel \\ nat_rel \\ R)$l'$i')\\R\"\n using assms by (simp add: as_get_refine)\n\ndefinition \"as_set s i x \\ let (a,n::nat)=s in (array_set a i x,n)\"\n\nlemma as_set_refine[autoref_rules]: \n \"(as_set,list_update)\\\\R\\as_rel \\ nat_rel \\ R \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (clarsimp \n simp: as_set_def as_rel_def br_def as_raw_\\_def as_raw_invar_def\n split: prod.split)\n apply rule\n apply auto []\n apply parametricity\n by simp\n\ndefinition as_length :: \"'a array_stack \\ nat\" where \n \"as_length = snd\"\n\nlemma as_length_refine[autoref_rules]: \n \"(as_length,length) \\ \\R\\as_rel \\ nat_rel\"\n by (auto \n simp: as_length_def as_rel_def br_def as_raw_\\_def as_raw_invar_def\n array_length_list\n dest!: list_rel_imp_same_length\n )\n\ndefinition \"as_top s \\ as_get s (as_length s - 1)\"\n\nlemma as_top_code[code]: \"as_top s = (let (a,n)=s in array_get a (n - 1))\"\n unfolding as_top_def as_get_def as_length_def \n by (auto split: prod.split)\n\nlemma as_top_refine: \"\\l\\[]; (s,l)\\\\R\\as_rel\\ \\ (as_top s,last l)\\R\"\n unfolding as_top_def\n apply (simp add: last_conv_nth)\n apply (rule as_get_refine)\n apply (auto simp: as_length_def as_rel_def br_def as_raw_\\_def \n as_raw_invar_def array_length_list\n dest!: list_rel_imp_same_length)\n done\n\nlemma as_top_autoref[autoref_rules]:\n assumes \"(l,l')\\\\R\\as_rel\"\n assumes \"SIDE_PRECOND (l' \\ [])\"\n shows \"(as_top l,(OP last ::: \\R\\as_rel \\ R)$l')\\R\"\n using assms by (simp add: as_top_refine)\n\n\ndefinition \"as_is_empty s \\ as_length s = 0\"\nlemma as_is_empty_code[code]: \"as_is_empty s = (snd s = 0)\"\n unfolding as_is_empty_def as_length_def by simp\n\nlemma as_is_empty_refine[autoref_rules]: \n \"(as_is_empty,is_Nil) \\ \\R\\as_rel \\ bool_rel\"\nproof\n fix s l\n assume [param]: \"(s,l)\\\\R\\as_rel\"\n have \"(as_is_empty s,length l = 0) \\ bool_rel\"\n unfolding as_is_empty_def\n by (parametricity add: as_length_refine)\n also have \"length l = 0 \\ is_Nil l\"\n by (cases l) auto\n finally show \"(as_is_empty s, is_Nil l) \\ bool_rel\" .\nqed\n\ndefinition \"as_take m s \\ let (a,n) = s in \n if mnat_rel \\ \\R\\as_rel \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (clarsimp simp add: as_take_def, safe)\n\n apply (rule as_shrinkI)\n apply (simp add: as_rel_def br_def as_raw_\\_def as_raw_invar_def)\n apply rule\n apply auto []\n apply clarsimp\n apply (subgoal_tac \"take a' (list_of_array a) = take a' (take ba (list_of_array a))\")\n apply (simp only: )\n apply (parametricity, rule IdI)\n apply simp\n\n apply (simp add: as_rel_def br_def as_raw_\\_def as_raw_invar_def)\n apply rule\n apply auto []\n apply clarsimp\n apply (frule list_rel_imp_same_length)\n apply simp\n done\n\ndefinition \"as_singleton x \\ (array_of_list [x],1)\"\nlemma as_singleton_refine[autoref_rules]: \n \"(as_singleton,op_list_singleton)\\R \\ \\R\\as_rel\"\n apply (intro fun_relI)\n apply (simp add: as_singleton_def as_rel_def br_def as_raw_\\_def \n as_raw_invar_def)\n apply rule\n apply (auto simp: array_length_list) []\n apply simp\n done\n\nend\n\nend\n", "meta": {"author": "VTrelat", "repo": "Hopcroft_verif", "sha": "ede77c3a2105fd6722cf96896a297db294edf269", "save_path": "github-repos/isabelle/VTrelat-Hopcroft_verif", "path": "github-repos/isabelle/VTrelat-Hopcroft_verif/Hopcroft_verif-ede77c3a2105fd6722cf96896a297db294edf269/Isabelle/Collections/GenCF/Impl/Impl_Array_Stack.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2820290505130333}} {"text": "theory VCTheoryLemmas\n imports trafficLights\nbegin\n\nlemma substate_refl: \"substate s s\"\n apply(cases s)\n apply(auto)\n done\n\nlemma substate_trans:\n\"substate s1 s2 \\ substate s2 s3 \\ substate s1 s3\"\nproof(induction s3)\n case emptyState\n assume 1: \"substate s1 s2 \\ substate s2 emptyState\"\n hence \"s2=emptyState\"\n proof(cases)\n assume \"s2=emptyState\"\n thus ?thesis by assumption\n next\n assume \"s2 \\ emptyState\"\n with 1 show ?thesis by simp\n qed\n with 1 show ?case by auto\n next\n case (toEnv s3)\n assume 1: \"substate s1 s2 \\ substate s2 (toEnv s3)\"\n show ?case\n proof(cases)\n assume \"s2=toEnv s3\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ toEnv s3\"\n with 1 toEnv.IH show ?case by auto\n qed\n next\n case (toCon s3)\nassume 1: \"substate s1 s2 \\ substate s2 (toCon s3)\"\n show ?case\n proof(cases)\n assume \"s2=toCon s3\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ toCon s3\"\n with 1 toCon.IH show ?case by auto\n qed\n next\n case (setVarBool s3 v u)\n assume 1: \"substate s1 s2 \\ substate s2 (setVarBool s3 v u)\"\n show ?case\n proof(cases)\n assume \"s2 = setVarBool s3 v u\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ setVarBool s3 v u\"\n with 1 setVarBool.IH show ?case by auto\n qed\n next\n case (setVarInt s3 v u)\n assume 1: \"substate s1 s2 \\ substate s2 (setVarInt s3 v u)\"\n show ?case\n proof(cases)\n assume \"s2 = setVarInt s3 v u\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ setVarInt s3 v u\"\n with 1 setVarInt.IH show ?case by auto\n qed\n next\n case (setVarAny s3 u)\n assume 1: \"substate s1 s2 \\substate s2 (setVarAny s3 u)\"\n show ?case\n proof(cases)\n assume \"s2 = setVarAny s3 u\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ setVarAny s3 u\"\n with 1 setVarAny.IH show ?case by auto\n qed\n next\n case (setPstate s3 p q)\n assume 1: \"substate s1 s2 \\ substate s2 (setPstate s3 p q)\"\n show ?case\n proof(cases)\n assume \"s2 = setPstate s3 p q\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ setPstate s3 p q\"\n with 1 setPstate.IH show ?case by auto\n qed\n next\n case (reset s3 p)\n assume 1: \"substate s1 s2 \\ substate s2 (reset s3 p)\"\n show ?case\n proof(cases)\n assume \"s2 = reset s3 p\"\n with 1 show ?case by auto\n next\n assume \"s2 \\ reset s3 p\"\n with 1 reset.IH show ?case by auto\n qed\n qed\n\n\nlemma substate_asym:\n \"substate s1 s2 \\ substate s2 s1 \\ s1=s2\"\nproof(induction s2 arbitrary: s1)\n case emptyState\n assume 1: \"substate s1 emptyState \\ substate emptyState s1\"\n show ?case\n proof(cases)\n assume \"s1=emptyState\"\n thus ?case by assumption\n next\n assume \"s1 \\ emptyState\"\n with 1 show ?case by auto\n qed\nnext\n case (toEnv s2)\n assume 1: \"substate s1 (toEnv s2) \\ substate (toEnv s2) s1\"\n show ?case\n proof(cases)\n assume \"s1 = toEnv s2\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ toEnv s2\"\n from 1 obtain 3: \"substate s1 (toEnv s2)\" \nand 4: \"substate (toEnv s2) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (toEnv s2) s2\" by blast\n have \"substate s2 (toEnv s2)\" \n using substate_refl by auto\n with 5 toEnv.IH have \"toEnv s2 = s2\" by auto\n with 3 4 toEnv.IH show ?case by auto\n qed\nnext\n case (toCon s2)\n assume 1: \"substate s1 (toCon s2) \\ substate (toCon s2) s1\"\n show ?case\n proof(cases)\n assume \"s1 = toCon s2\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ toCon s2\"\n from 1 obtain 3: \"substate s1 (toCon s2)\" \nand 4: \"substate (toCon s2) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (toCon s2) s2\" by blast\n have \"substate s2 (toCon s2)\"\n using substate_refl by auto\n with 5 toCon.IH have \"toCon s2 = s2\" by auto\n with 3 4 toCon.IH show ?case by auto\n qed\nnext\n case (setVarBool s2 v u)\n assume 1: \"substate s1 (setVarBool s2 v u) \\ substate (setVarBool s2 v u) s1\"\n show ?case\n proof(cases)\n assume \"s1 = setVarBool s2 v u\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ setVarBool s2 v u\"\n from 1 obtain 3: \"substate s1 (setVarBool s2 v u)\" \nand 4: \"substate (setVarBool s2 v u) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (setVarBool s2 v u) s2\" by blast\n have \"substate s2 (setVarBool s2 v u)\" \n using substate_refl by auto\n with 5 setVarBool.IH have \"setVarBool s2 v u = s2\" by auto\n with 3 4 setVarBool.IH show ?case by auto\n qed\nnext\n case (setVarInt s2 v u)\n assume 1: \"substate s1 (setVarInt s2 v u) \\ substate (setVarInt s2 v u) s1\"\n show ?case\n proof(cases)\n assume \"s1 = setVarInt s2 v u\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ setVarInt s2 v u\"\n from 1 obtain 3: \"substate s1 (setVarInt s2 v u)\" \nand 4: \"substate (setVarInt s2 v u) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (setVarInt s2 v u) s2\" by blast\n have \"substate s2 (setVarInt s2 v u)\" \n using substate_refl by auto\n with 5 setVarInt.IH have \"setVarInt s2 v u = s2\" by auto\n with 3 4 setVarInt.IH show ?case by auto\n qed\nnext\n case (setVarAny s2 u)\n assume 1: \"substate s1 (setVarAny s2 u) \\ substate (setVarAny s2 u) s1\"\n show ?case\n proof(cases)\n assume \"s1 = setVarAny s2 u\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ setVarAny s2 u\"\n from 1 obtain 3: \"substate s1 (setVarAny s2 u)\" \nand 4: \"substate (setVarAny s2 u) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (setVarAny s2 u) s2\" by blast\n have \"substate s2 (setVarAny s2 u)\" \n using substate_refl by auto\n with 5 setVarAny.IH have \"setVarAny s2 u = s2\" by auto\n with 3 4 setVarAny.IH show ?case by auto\n qed\nnext\n case (setPstate s2 p q)\n assume 1: \"substate s1 (setPstate s2 p q) \\ substate (setPstate s2 p q) s1\"\n show ?case\n proof(cases)\n assume \"s1 = setPstate s2 p q\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ setPstate s2 p q\"\n from 1 obtain 3: \"substate s1 (setPstate s2 p q)\" \nand 4: \"substate (setPstate s2 p q) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (setPstate s2 p q) s2\" by blast\n have \"substate s2 (setPstate s2 p q)\" \n using substate_refl by auto\n with 5 setPstate.IH have \"setPstate s2 p q = s2\" by auto\n with 3 4 setPstate.IH show ?case by auto\n qed\nnext\n case (reset s2 p)\n assume 1: \"substate s1 (reset s2 p) \\ substate (reset s2 p) s1\"\n show ?case\n proof(cases)\n assume \"s1 = reset s2 p\"\n thus ?case by assumption\n next\n assume 2: \"s1 \\ reset s2 p\"\n from 1 obtain 3: \"substate s1 (reset s2 p)\" \nand 4: \"substate (reset s2 p) s1\" ..\n from 2 3 have \"substate s1 s2\" by simp\n with 4 substate_trans \n have 5: \"substate (reset s2 p) s2\" by blast\n have \"substate s2 (reset s2 p)\" \n using substate_refl by auto\n with 5 reset.IH have \"reset s2 p = s2\" by auto\n with 3 4 reset.IH show ?case by auto\n qed\nqed\n\nlemma predEnv_substate: \"substate (predEnv s) s\"\n apply(induction s)\n using substate_refl by auto\n\n\nlemma substate_eq_or_predEnv: \n\"substate s1 s2 \\ toEnvP s1 \\ s1=s2 \\ substate s1 (predEnv s2)\"\n apply(induction s2)\n apply(auto)\n done\n(*\n case emptyState\n then show ?case by force\nnext\n case (toEnv s2)\n assume 1: \"substate s1 (toEnv s2) \\ toEnvP s1\"\n show ?case\n proof cases\n assume \"s1= toEnv s2\"\n then show ?case by auto\n next\n assume \"s1 \\ toEnv s2\"\n with 1 have \"substate s1 s2\" by simp\n with 1 toEnv.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (toEnv s2) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed \nnext\n case (toCon s2)\n assume 1: \"substate s1 (toCon s2) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= toCon s2\"\n thus ?case by auto\n next\n assume \"s1 \\ toCon s2\"\n with 1 have \"substate s1 s2\" by simp\n with 1 toCon.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (toCon s2) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nnext\n case (setVarBool s2 v u)\n assume 1: \"substate s1 (setVarBool s2 v u) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= setVarBool s2 v u\"\n thus ?case by auto\n next\n assume \"s1 \\ setVarBool s2 v u\"\n with 1 have \"substate s1 s2\" by simp\n with 1 setVarBool.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (setVarBool s2 v u) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nnext\n case (setVarInt s2 v u)\n assume 1: \"substate s1 (setVarInt s2 v u) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= setVarInt s2 v u\"\n thus ?case by auto\n next\n assume \"s1 \\ setVarInt s2 v u\"\n with 1 have \"substate s1 s2\" by simp\n with 1 setVarInt.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (setVarInt s2 v u) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nnext\n case (setVarAny s2 u)\n assume 1: \"substate s1 (setVarAny s2 u) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= setVarAny s2 u\"\n thus ?case by auto\n next\n assume \"s1 \\ setVarAny s2 u\"\n with 1 have \"substate s1 s2\" by simp\n with 1 setVarAny.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (setVarAny s2 u) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nnext\n case (setPstate s2 p q)\n assume 1: \"substate s1 (setPstate s2 p q) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= setPstate s2 p q\"\n thus ?case by auto\n next\n assume \"s1 \\ setPstate s2 p q\"\n with 1 have \"substate s1 s2\" by simp\n with 1 setPstate.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (setPstate s2 p q) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nnext\n case (reset s2 p)\n assume 1: \"substate s1 (reset s2 p) \\ toEnvP s1\"\n show ?case \n proof cases\n assume \"s1= reset s2 p\"\n thus ?case by auto\n next\n assume \"s1 \\ reset s2 p\"\n with 1 have \"substate s1 s2\" by simp\n with 1 reset.IH\n have \"s1=s2 \\ substate s1 (predEnv s2)\" by auto\n thus ?case\n proof\n assume \"s1=s2\"\n with 1 \n have \"predEnv (reset s2 p) = s1\" by auto\n thus ?case by auto\n next\n assume 2: \"substate s1 (predEnv s2)\"\n show ?case\n proof(cases)\n assume 3: \"toEnvP s2\" \n from 2 predEnv_substate[of s2]\n substate_trans have \"substate s1 s2\" by auto\n with 3 show ?case by auto\n next\n assume \"\\ toEnvP s2\" \n with 2 show ?case by auto\n qed\n qed\n qed\nqed\n*)\n\nlemma substate_total: \n\"substate s1 s \\ substate s2 s \\\n substate s1 s2 \\ substate s2 s1\"\n apply(induction s)\n apply(auto)\n done\n\nlemma toEnvNum_id: \"toEnvNum s s = 0\"\n apply(cases s)\n apply(auto)\n done\n\nlemma substate_toEnvNum_id:\n\"substate s1 s2 \\ toEnvNum s1 s2 = 0 \\ toEnvP s1 \\\ntoEnvP s2 \\ s1=s2\"\n apply(cases s2)\n apply(auto)\n done\n\nlemma gtime_predI:\n \"\\ toEnvP s \\ toEnvNum emptyState s =\n toEnvNum emptyState (predEnv s)\"\n apply(induction s)\n apply(auto)\n done\n (*\nproof(induction s)\n case emptyState\n then show ?case by auto\nnext\n case (toEnv s)\n then show ?case by auto\nnext\n case (toCon s)\n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (toCon s) =\n toEnvNum emptyState s\" by auto\n from 1 2 toCon.IH show ?case by auto\n qed\nnext\n case (setVarBool s v u)\n then show ?case\n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (setVarBool s v u) =\n toEnvNum emptyState s\" by auto\n from 1 2 setVarBool.IH show ?case by auto\n qed\nnext\n case (setVarInt s v u)\n then show ?case \n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (setVarInt s v u) =\n toEnvNum emptyState s\" by auto\n from 1 2 setVarInt.IH show ?case by auto\n qed\nnext\n case (setVarAny s u)\n then show ?case \n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (setVarAny s u) =\n toEnvNum emptyState s\" by auto\n from 1 2 setVarAny.IH show ?case by auto\n qed\nnext\n case (setPstate s p q)\n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (setPstate s p q) =\n toEnvNum emptyState s\" by auto\n from 1 2 setPstate.IH show ?case by auto\n qed\nnext\n case (reset s p)\n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have 2: \"toEnvNum emptyState (reset s p) =\n toEnvNum emptyState s\" by auto\n from 1 2 reset.IH show ?case by auto\n qed\nqed\n*)\nlemma gtime_predE:\n\"toEnvP s \\ toEnvNum emptyState s =\ntoEnvNum emptyState (predEnv s) + 1\"\nproof(induction s)\n case emptyState\n then show ?case by auto\nnext\n case (toEnv s)\n then show ?case \n proof cases\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n have \"toEnvNum emptyState (toEnv s) =\ntoEnvNum emptyState s + 1\" by auto\n with 1 gtime_predI show ?thesis by auto\n qed\nnext\n case (toCon s)\n then show ?case by auto\nnext\n case (setVarBool s x2a x3a)\n then show ?case by auto\nnext\n case (setVarInt s x2a x3a)\n then show ?case by auto\nnext\n case (setVarAny s x2a)\n then show ?case by auto\nnext\n case (setPstate s x2a x3a)\n then show ?case by auto\nnext\n case (reset s x2a)\n then show ?case by auto\nqed\n\nlemma predEnvPI: \"\\ toEnvP s \\\ntoEnvNum emptyState s > 0 \\\ntoEnvP (predEnv s)\"\n apply(induction s)\n apply(auto)\n done\n\nlemma predEnvP: \"toEnvNum emptyState s > 1 \\\ntoEnvP (predEnv s)\"\nproof(induction s)\n case emptyState\n then show ?case by auto\nnext\n case (toEnv s)\n then show ?case \n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\n assume \"toEnvNum emptyState (toEnv s) > 1\"\n hence \"toEnvNum emptyState s > 0\" by auto\n with 1 predEnvPI show ?case by auto\n qed\nnext\n case (toCon s)\n then show ?case\n proof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (toCon s) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 toCon.IH show ?case by auto\nqed\nnext\n case (setVarBool s v u)\n then show ?case \nproof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (setVarBool s v u) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 setVarBool.IH show ?case by auto\nqed\nnext\n case (setVarInt s v u)\n then show ?case \nproof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (setVarInt s v u) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 setVarInt.IH show ?case by auto\nqed\nnext\n case (setVarAny s u)\n then show ?case \nproof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (setVarAny s u) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 setVarAny.IH show ?case by auto\nqed\nnext\n case (setPstate s p q)\n then show ?case \nproof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (setPstate s p q) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 setPstate.IH show ?case by auto\nqed\nnext\n case (reset s p)\n then show ?case \nproof(cases)\n assume \"toEnvP s\"\n thus ?case by auto\n next\n assume 1: \"\\ toEnvP s\"\nassume \"toEnvNum emptyState (reset s p) > 1\"\n hence \"toEnvNum emptyState s > 1\" by auto\n with 1 reset.IH show ?case by auto\nqed\nqed\n\n\nlemma shift_spec:\n \"toEnvP s \\ toEnvNum emptyState s > n \\\ntoEnvP (shiftEnv s n) \\\n toEnvNum emptyState (shiftEnv s n) =\n toEnvNum emptyState s - n\"\nproof(induction n)\n case 0\n then show ?case by auto\nnext\n case (Suc n)\n assume 1: \"toEnvP s \\\n Suc n < toEnvNum emptyState s\"\n with Suc.IH\n have \"toEnvNum emptyState (shiftEnv s n) > 1\"\n by auto\n with predEnvP have 2:\n \"toEnvP (shiftEnv s (Suc n))\"\n by auto\n from 1 Suc.IH have 3: \"toEnvP (shiftEnv s n)\"\n by auto\n from 1 Suc.IH have\n \"toEnvNum emptyState (shiftEnv s n) =\ntoEnvNum emptyState s - n\" by auto\n with 1 3 gtime_predE have\n\"toEnvNum emptyState (shiftEnv s (Suc n)) =\ntoEnvNum emptyState s - (Suc n)\" by auto\n with 2 show ?case .. \nqed\n\nlemma toEnvNum3: \"substate s1 s2 \\ substate s2 s3\n \\ toEnvNum s1 s3 = toEnvNum s1 s2 + toEnvNum s2 s3\"\n proof(induction s3)\n case emptyState\n then show ?case by (cases s2; auto)\n next\n case (toEnv s3)\n then show ?case \n proof(cases)\n assume \"s2= toEnv s3\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ toEnv s3\"\n assume 2: \"substate s1 s2 \\ substate s2 (toEnv s3)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = toEnv s3\"\n with 2 substate_asym[of \"(toEnv s3)\" s2]\n have \"toEnv s3 = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (toEnv s3)\"\n with 1 2 toEnv.IH show?case by auto\n qed\n qed\n next\n case (toCon s3)\n then show ?case\n proof(cases)\n assume \"s2= toCon s3\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ toCon s3\"\n assume 2: \"substate s1 s2 \\ substate s2 (toCon s3)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = toCon s3\"\n with 2 substate_asym[of \"(toCon s3)\" s2]\n have \"toCon s3 = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (toCon s3)\"\n with 1 2 toCon.IH show?case by auto\n qed\n qed\n next\n case (setVarBool s3 v u)\n then show ?case \n proof(cases)\n assume \"s2= setVarBool s3 v u\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ setVarBool s3 v u\"\n assume 2: \"substate s1 s2 \\ substate s2\n (setVarBool s3 v u)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = setVarBool s3 v u\"\n with 2 substate_asym[of \"(setVarBool s3 v u)\" s2]\n have \"setVarBool s3 v u = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (setVarBool s3 v u)\"\n with 1 2 setVarBool.IH show?case by auto\n qed\n qed\n next\n case (setVarInt s3 v u)\n then show ?case \n proof(cases)\n assume \"s2= setVarInt s3 v u\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ setVarInt s3 v u\"\n assume 2: \"substate s1 s2 \\ substate s2 (setVarInt s3 v u)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = setVarInt s3 v u\"\n with 2 substate_asym[of \"(setVarInt s3 v u)\" s2]\n have \"setVarInt s3 v u = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (setVarInt s3 v u)\"\n with 1 2 setVarInt.IH show?case by auto\n qed\n qed\n next\n case (setVarAny s3 u)\n then show ?case \n proof(cases)\n assume \"s2= setVarAny s3 u\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ setVarAny s3 u\"\n assume 2: \"substate s1 s2 \\ substate s2 (setVarAny s3 u)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = setVarAny s3 u\"\n with 2 substate_asym[of \"(setVarAny s3 u)\" s2]\n have \"setVarAny s3 u = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (setVarAny s3 u)\"\n with 1 2 setVarAny.IH show?case by auto\n qed\n qed\n next\n case (setPstate s3 p q)\n then show ?case \n proof(cases)\n assume \"s2= setPstate s3 p q\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ setPstate s3 p q\"\n assume 2: \"substate s1 s2 \\ substate s2 (setPstate s3 p q)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = setPstate s3 p q\"\n with 2 substate_asym[of \"(setPstate s3 p q)\" s2]\n have \"setPstate s3 p q = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (setPstate s3 p q)\"\n with 1 2 setPstate.IH show?case by auto\n qed\n qed\n next\n case (reset s3 p)\n then show ?case \n proof(cases)\n assume \"s2= reset s3 p\"\n thus ?case by auto\n next\n assume 1: \"s2 \\ reset s3 p\"\n assume 2: \"substate s1 s2 \\ substate s2 (reset s3 p)\"\n with 1 have \"substate s2 s3\" by simp\n show ?case\n proof(cases)\n assume \"s1 = reset s3 p\"\n with 2 substate_asym[of \"(reset s3 p)\" s2]\n have \"reset s3 p = s2\" by auto\n with 1 show ?case by auto\n next\n assume \"s1 \\ (reset s3 p)\"\n with 1 2 reset.IH show?case by auto\n qed\n qed\n qed\n\nlemma emptyState_substate: \"substate emptyState s\"\n apply(induction s)\n apply(auto)\n done\n\n\nlemma gtimeE_inj:\n\"substate s1 s \\ toEnvP s1 \\ toEnvP s \\\ntoEnvNum emptyState s1 = toEnvNum emptyState s \\\ns1=s\"\nproof(cases s)\n case emptyState\n then show ?thesis by auto\nnext\n case (toEnv s2)\n then show ?thesis \n proof cases\n assume \"s1 =s\"\n then show ?thesis by auto\n next\n assume 1: \"s1 \\ s\"\n show ?thesis \n proof\n assume 2: \"substate s1 s \\\n toEnvP s1 \\\n toEnvP s \\\n toEnvNum emptyState s1 =\n toEnvNum emptyState s\"\n with 1 toEnv have 3: \"substate s1 s2\" by auto\n from toEnv have 4: \"substate s2 s\" \n using substate_refl by auto\n from 3 emptyState_substate toEnvNum3 \n have 5: \"toEnvNum emptyState s2 =\ntoEnvNum emptyState s1 + toEnvNum s1 s2\" by auto\n from emptyState_substate 4 toEnvNum3 have 6:\n\"toEnvNum emptyState s = toEnvNum emptyState s2 + toEnvNum s2 s\"\n by auto\n with toEnv have 7: \"toEnvNum s2 s > 0\" by auto\n from 5 have\n \"toEnvNum emptyState s1 \\ toEnvNum emptyState s2\"\n by auto\n also from 6 7 have\n\"toEnvNum emptyState s2 < toEnvNum emptyState s\"\n by auto\n finally have \n \"toEnvNum emptyState s1 < toEnvNum emptyState s\" .\n with 2 show\n\"substate s1 s \\\n toEnvP s1 \\\n toEnvP s \\\n toEnvNum emptyState s1 =\n toEnvNum emptyState s \\ s1=s\" by auto\n qed\n qed\nnext\n case (toCon x3)\n then show ?thesis by auto\nnext\n case (setVarBool x41 x42 x43)\n then show ?thesis by auto\nnext\n case (setVarInt x51 x52 x53)\n then show ?thesis by auto\nnext\n case (setVarAny x61 x62)\n then show ?thesis by auto\nnext\n case (setPstate x71 x72 x73)\n then show ?thesis by auto\nnext\n case (reset x81 x82)\n then show ?thesis by auto\nqed\n\nlemma shiftEnv_substate: \"substate (shiftEnv s n) s\"\nproof(induction n)\n case 0\n then show ?case using substate_refl by auto\nnext\n case (Suc n)\n then have \"substate (predEnv (shiftEnv s n)) s\"\n using predEnv_substate[of \"shiftEnv s n\"]\nsubstate_trans by blast\n thus ?case by simp\nqed\n\nlemma toEnvNum_shift: \"toEnvP s \\\ntoEnvNum emptyState s > n\n \\ toEnvNum (shiftEnv s n) s = n\"\nproof -\n assume 1: \"toEnvP s \\ toEnvNum emptyState s > n\"\n have 2: \"toEnvNum emptyState s =\ntoEnvNum emptyState (shiftEnv s n) +\ntoEnvNum (shiftEnv s n) s\" \n using emptyState_substate toEnvNum3 \nshiftEnv_substate by auto\n with 1 shift_spec show ?thesis by force\nqed\n\nlemma substate_shift:\n\"toEnvP s1 \\ toEnvP s \\ substate s1 s \\ \ntoEnvNum s1 s \\ n \\ \nsubstate s1 (shiftEnv s n)\"\nproof(induction n)\n case 0\n then show ?case by auto\nnext\n case (Suc n)\n then show ?case\n proof -\n assume 1: \"toEnvP s1 \\\n toEnvP s \\\n substate s1 s \\ Suc n \\ toEnvNum s1 s\"\n with Suc.IH have \"substate s1 (shiftEnv s n)\"\n by auto\n with 1 substate_eq_or_predEnv have\n\"s1 = shiftEnv s n \\ \nsubstate s1 (predEnv (shiftEnv s n))\" by auto\n then show ?case\n proof\n assume 2: \"s1 = shiftEnv s n\"\n with 1 emptyState_substate[of s1] toEnvNum3\n have \"toEnvNum emptyState s > n\" by force\n with 1 toEnvNum_shift have\n\"toEnvNum (shiftEnv s n) s = n\" by auto\n with 1 2 show ?case by auto\n next\n assume \"substate s1 (predEnv (shiftEnv s n))\"\n thus ?case by simp \n qed\n qed\nqed\n\nlemma predEnvP_or_emptyState:\n\"toEnvP (predEnv s) \\ predEnv s = emptyState\"\n apply(induction s)\n apply(auto)\n done\n\nlemma shiftEnvP_or_emptyState: \"n \\ 0 \\\n toEnvP (shiftEnv s n) \\ shiftEnv s n = emptyState\"\n apply(cases n)\n using predEnvP_or_emptyState by auto\n\nlemma shift_toEnvNum: \n\"toEnvP s \\ toEnvP s1 \\ substate s1 s \\\nshiftEnv s (toEnvNum s1 s) = s1\"\nproof -\n define s2:: state where\n \"s2 = shiftEnv s (toEnvNum s1 s)\"\n assume 1: \"toEnvP s \\ toEnvP s1 \\ substate s1 s\"\n with s2_def substate_shift have 2: \n\"substate s1 s2\" by auto\n from 1 have \"toEnvNum emptyState s1 > 0\"\n by (cases s1; auto)\n with 1 emptyState_substate[of s1] toEnvNum3 have\n\"toEnvNum s1 s < toEnvNum emptyState s\" by force\n with 1 shift_spec s2_def have \n\"toEnvNum emptyState s2 = \ntoEnvNum emptyState s - toEnvNum s1 s\" by auto\n also from 1 emptyState_substate[of s1] toEnvNum3\n have \"toEnvNum emptyState s - toEnvNum s1 s = \ntoEnvNum emptyState s1\" by force\n finally have 3:\n \"toEnvNum emptyState s2 = toEnvNum emptyState s1\"\n .\n show ?thesis\n proof(cases)\n assume 4: \"toEnvNum s1 s = 0\"\n with 1 substate_toEnvNum_id have \"s1=s\"\n by blast\n with 1 show ?thesis using toEnvNum_id by auto\n next\n assume \"toEnvNum s1 s \\ 0\"\n with s2_def shiftEnvP_or_emptyState have\n\"toEnvP s2 \\ s2 = emptyState\" by auto\n hence \"toEnvP s2\" \n proof\n assume \"toEnvP s2\"\n thus ?thesis by assumption\n next\n assume \"s2 = emptyState\"\n with 2 have \"s1=emptyState\"\n by (cases s1; auto)\n with 1 show ?thesis by auto\n qed\n with 1 2 3[symmetric] gtimeE_inj\n have \"s1=s2\" by blast\n with s2_def show ?thesis by simp\n qed\nqed\n\nlemma ltime_le_toEnvNum: \n\"ltimeEnv s p \\ toEnvNum emptyState s\"\n apply(induction s)\n apply(auto)\n done\n\n(*\nlemma partitioning:\n\"substate s1 s2 \\ substate s2 s3 \\ substate s1 s \\\nsubstate s s3 \\ substate s1 s \\ substate s s2 \\\nsubstate s2 s \\ substate s s3\"\n using substate_total by blast\n*)\n\nlemma predEnv_substate_imp_eq_or_substate:\n\"toEnvP s1 \\ toEnvP s2 \\ substate s1 s \\\n substate s2 s \\ substate (predEnv s1) s2 \\ \ns2 = predEnv s1 \\ substate s1 s2\"\nproof cases\n assume \"s1 = s2\"\n with substate_refl show ?thesis by auto\nnext \n assume 1: \"s1 \\ s2\"\n show ?thesis\n proof\n assume 2: \"toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s \\\n substate s2 s \\ substate (predEnv s1) s2 \"\n with substate_total \n have \"substate s1 s2 \\ substate s2 s1\" by auto\n thus \" s2 = predEnv s1 \\ substate s1 s2\"\n proof\n assume \"substate s1 s2\" \n thus ?thesis by auto\n next\n assume \"substate s2 s1\"\n with 1 substate_eq_or_predEnv 2 substate_asym\n show ?thesis by auto\n qed\n qed\nqed\n\nlemma state_down_ind: \n\"toEnvP s \\ toEnvP s1 \\ P s \\\n (\\ s2. toEnvP s2 \\\n (substate s1 s2 \\ substate s2 s \\ s1 \\ s2)\n \\ P s2 \\ P (predEnv s2)) \\\ntoEnvP s2 \\ substate s1 s2 \\ substate s2 s \\\n P s2\"\nproof -\n assume 1: \"toEnvP s \\ toEnvP s1\"\n define Q:: \"nat \\ bool\" where \n\"Q = (\\ n. P (shiftEnv s n))\"\n from Q_def 1 shift_toEnvNum have P_def:\n\"\\ s'. toEnvP s' \\ substate s' s \\ \nP s' = Q (toEnvNum s' s)\" by auto\n define n where \"n = toEnvNum s2 s\"\n assume base: \"P s\" and ind_step:\n\"\\ s2. toEnvP s2 \\\n (substate s1 s2 \\ substate s2 s \\ s1 \\ s2)\n \\ P s2 \\ P (predEnv s2)\"\n show ?thesis\n proof\n assume 2: \"toEnvP s2 \\ substate s1 s2 \\\n substate s2 s\"\n with 1 n_def shift_toEnvNum have s2_def: \"s2 = shiftEnv s n\"\n by auto\n from 2 show \"P s2\"\n apply(simp only: P_def n_def[symmetric])\n apply(simp only: s2_def)\n proof(induction n)\n case 0\n then show ?case using Q_def base by auto\n next\n case (Suc n)\n then show ?case \n apply(simp only: Q_def)\n print_state\n proof cases\n assume 3: \"s1 = shiftEnv s n\"\n assume 4: \"toEnvP (shiftEnv s (Suc n)) \\\n substate s1 (shiftEnv s (Suc n)) \\\n substate (shiftEnv s (Suc n)) s\"\n from 3 have 5: \"substate (shiftEnv s n) s1\"\n using substate_refl by auto\n from predEnv_substate have\n\"substate (shiftEnv s (Suc n)) (shiftEnv s n)\"\n by simp\n with 4 5 substate_asym substate_trans\n have \"s1 = shiftEnv s (Suc n)\"\n by blast\n with 3 have\n \"shiftEnv s n = shiftEnv s (Suc n)\" by simp\n with 4 gtime_predE show\n \"P (shiftEnv s (Suc n))\" by fastforce\n next\n assume 3: \"s1 \\ shiftEnv s n\"\n assume 4: \"toEnvP (shiftEnv s (Suc n)) \\\n substate s1 (shiftEnv s (Suc n)) \\\n substate (shiftEnv s (Suc n)) s\"\nfrom predEnv_substate have\n\"substate (shiftEnv s (Suc n)) (shiftEnv s n)\"\n by simp\n with 4 substate_trans have 5:\n \"substate s1 (shiftEnv s n)\" by blast\n have 6: \"toEnvP (shiftEnv s n)\"\n proof cases\n assume \"n = 0\"\n with 1 show ?thesis by auto\n next \n assume \"n \\ 0\"\n with shiftEnvP_or_emptyState have\n\"toEnvP (shiftEnv s n) \\\n (shiftEnv s n) = emptyState\" by auto\n thus ?thesis\n proof\n assume \"toEnvP (shiftEnv s n)\"\n thus ?thesis by assumption\n next\n assume \"shiftEnv s n = emptyState\"\n with 5 have \"s1 = emptyState\"\n by (cases s1; auto)\n with 1 show ?thesis by auto\n qed\n qed\n assume \"(toEnvP (shiftEnv s n) \\\n substate s1 (shiftEnv s n) \\\n substate (shiftEnv s n) s \\\n P (shiftEnv s n))\"\n with 3 5 6 shiftEnv_substate ind_step\n show \"P (shiftEnv s (Suc n))\"\n by auto\nqed\nqed\nqed\nqed\n\nend\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/VCTheoryLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2820290505130333}} {"text": "subsection \\ UTP theory of Designs \\\n\ntheory utp_des_theory\n imports utp_des_healths\nbegin\n \nsubsection \\ UTP theories \\\n\ninterpretation des_theory: utp_theory_continuous \"\\<^bold>H\"\n rewrites \"P \\ carrier des_theory.thy_order \\ P is \\<^bold>H\"\n and \"carrier des_theory.thy_order \\ carrier des_theory.thy_order \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\"\n and \"le des_theory.thy_order = (\\)\"\n and \"eq des_theory.thy_order = (=)\" \n and des_top: \"des_theory.utp_top = \\\\<^sub>D\"\n and des_bottom: \"des_theory.utp_bottom = \\\\<^sub>D\"\nproof -\n show \"utp_theory_continuous \\<^bold>H\"\n by (unfold_locales, simp_all add: H1_H2_idempotent H1_H2_Continuous)\n then interpret utp_theory_continuous \"\\<^bold>H\"\n by simp\n show \"utp_top = \\\\<^sub>D\" \"utp_bottom = \\\\<^sub>D\"\n by (simp_all add: H1_H2_false healthy_top H1_H2_true healthy_bottom)\nqed (simp_all)\n\ninterpretation ndes_theory: utp_theory_continuous \"\\<^bold>N\"\n rewrites \"P \\ carrier ndes_theory.thy_order \\ P is \\<^bold>N\"\n and \"carrier ndes_theory.thy_order \\ carrier ndes_theory.thy_order \\ \\\\<^bold>N\\\\<^sub>H \\ \\\\<^bold>N\\\\<^sub>H\"\n and \"le ndes_theory.thy_order = (\\)\"\n and \"eq ndes_theory.thy_order = (=)\" \n and ndes_top: \"ndes_theory.utp_top = \\\\<^sub>D\"\n and ndes_bottom: \"ndes_theory.utp_bottom = \\\\<^sub>D\"\nproof -\n show \"utp_theory_continuous \\<^bold>N\"\n by (unfold_locales, simp_all add: H1_H3_idempotent H1_H3_Continuous)\n then interpret utp_theory_continuous \"\\<^bold>N\"\n by simp\n show \"utp_top = \\\\<^sub>D\" \"utp_bottom = \\\\<^sub>D\"\n by (simp_all add: H1_H3_false healthy_top H1_H3_true healthy_bottom)\nqed (simp_all)\n\ninterpretation des_left_unital: utp_theory_left_unital \"\\<^bold>H\" \"II\\<^sub>D\"\n by (unfold_locales, simp_all add: H1_H2_left_unit closure)\n\ninterpretation ndes_unital: utp_theory_unital \"\\<^bold>N\" \"II\\<^sub>D\"\n by (unfold_locales, simp_all add: H1_H3_left_unit H1_H3_right_unit closure)\n\ninterpretation ndes_kleene: utp_theory_kleene \"\\<^bold>N\" \"II\\<^sub>D\"\n by (unfold_locales, simp add: ndes_top H1_H3_top_left)\n\nabbreviation ndes_star :: \"_ \\ _\" (\"_\\<^sup>\\\\<^sup>D\" [999] 999) where\n\"P\\<^sup>\\\\<^sup>D \\ ndes_unital.utp_star\"\n\nsubsection \\ Galois Connection \\\n\ntext \\ Example Galois connection between designs and relations. Based on Jim's example in COMPASS\n deliverable D23.5. \\\n\ndefinition [upred_defs]: \"Des(R) = \\<^bold>H(\\R\\\\<^sub>D \\ $ok\\)\"\ndefinition [upred_defs]: \"Rel(D) = \\D\\true,true/$ok,$ok\\\\\\\\<^sub>D\"\n\nlemma Des_design: \"Des(R) = true \\\\<^sub>r R\"\n by (rel_auto)\n\nlemma Rel_design: \"Rel(P \\\\<^sub>r Q) = (P \\ Q)\"\n by (rel_auto)\n\ninterpretation Des_Rel_coretract:\n coretract \"\\<^bold>H \\\\Des,Rel\\\\ id\"\n rewrites\n \"\\ x. x \\ carrier \\\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = (x is \\<^bold>H)\" and\n \"\\ x. x \\ carrier \\\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = True\" and\n \"\\\\<^sub>*\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = Des\" and\n \"\\\\<^sup>*\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = Rel\" and\n \"le \\\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = (\\)\" and\n \"le \\\\<^bsub>\\<^bold>H \\\\Des,Rel\\\\ id\\<^esub> = (\\)\"\nproof (unfold_locales, simp_all)\n show \"\\x. x is id\"\n by (simp add: Healthy_def)\nnext\n show \"Rel \\ \\\\<^bold>H\\\\<^sub>H \\ \\id\\\\<^sub>H\"\n by (auto simp add: Rel_def Healthy_def)\nnext\n show \"Des \\ \\id\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\"\n by (auto simp add: Des_def Healthy_def H1_H2_commute H1_idem H2_idem)\nnext\n fix R :: \"('a, 'b) urel\"\n show \"R \\ Rel (Des R)\"\n by (simp add: Des_design Rel_design)\nnext\n fix R :: \"('a, 'b) urel\" and D :: \"('a, 'b) rel_des\"\n assume a: \"D is \\<^bold>H\"\n then obtain D\\<^sub>1 D\\<^sub>2 where D: \"D = D\\<^sub>1 \\\\<^sub>r D\\<^sub>2\"\n by (metis H1_H2_commute H1_H2_is_rdesign H1_idem Healthy_def')\n show \"(Rel D \\ R) = (D \\ Des R)\"\n proof -\n have \"(D \\ Des R) = (D\\<^sub>1 \\\\<^sub>r D\\<^sub>2 \\ true \\\\<^sub>r R)\"\n by (simp add: D Des_design)\n also have \"... = `D\\<^sub>1 \\ R \\ D\\<^sub>2`\"\n by (simp add: rdesign_refinement)\n also have \"... = ((D\\<^sub>1 \\ D\\<^sub>2) \\ R)\"\n by (rel_auto)\n also have \"... = (Rel D \\ R)\"\n by (simp add: D Rel_design)\n finally show ?thesis ..\n qed\nqed\n\n\ntext \\ From this interpretation we gain many Galois theorems. Some require simplification to\n remove superfluous assumptions. \\\n\nthm Des_Rel_coretract.deflation[simplified]\nthm Des_Rel_coretract.inflation\nthm Des_Rel_coretract.upper_comp[simplified]\nthm Des_Rel_coretract.lower_comp\n\nsubsection \\ Fixed Points \\\n\nnotation des_theory.utp_lfp (\"\\\\<^sub>D\")\nnotation des_theory.utp_gfp (\"\\\\<^sub>D\")\n\nnotation ndes_theory.utp_lfp (\"\\\\<^sub>N\")\nnotation ndes_theory.utp_gfp (\"\\\\<^sub>N\")\n\nutp_const des_theory.utp_lfp des_theory.utp_gfp\n ndes_theory.utp_lfp ndes_theory.utp_gfp\n\nsyntax\n \"_dmu\" :: \"pttrn \\ logic \\ logic\" (\"\\\\<^sub>D _ \\ _\" [0, 10] 10)\n \"_dnu\" :: \"pttrn \\ logic \\ logic\" (\"\\\\<^sub>D _ \\ _\" [0, 10] 10)\n \"_ndmu\" :: \"pttrn \\ logic \\ logic\" (\"\\\\<^sub>N _ \\ _\" [0, 10] 10)\n \"_ndnu\" :: \"pttrn \\ logic \\ logic\" (\"\\\\<^sub>N _ \\ _\" [0, 10] 10)\n\ntranslations\n \"\\\\<^sub>D X \\ P\" == \"\\\\<^sub>D (\\ X. P)\"\n \"\\\\<^sub>D X \\ P\" == \"\\\\<^sub>D (\\ X. P)\"\n \"\\\\<^sub>N X \\ P\" == \"\\\\<^sub>N (\\ X. P)\"\n \"\\\\<^sub>N X \\ P\" == \"\\\\<^sub>N (\\ X. P)\"\n\nthm des_theory.LFP_unfold\nthm des_theory.GFP_unfold\n\ntext \\ Specialise @{thm [source] mu_refine_intro} to designs. \\\n\nlemma design_mu_refine_intro:\n assumes \"$ok\\ \\ C\" \"$ok\\ \\ S\" \"(C \\ S) \\ F(C \\ S)\" \"`C \\ (\\\\<^sub>D F \\ \\\\<^sub>D F)`\"\n shows \"(C \\ S) \\ \\\\<^sub>D F\"\nproof -\n from assms have \"(C \\ S) \\ \\\\<^sub>D F\"\n by (simp add: design_is_H1_H2 des_theory.GFP_upperbound)\n with assms show ?thesis\n by (rel_auto, metis (no_types, lifting))\nqed\n\nlemma rdesign_mu_refine_intro:\n assumes \"(C \\\\<^sub>r S) \\ F(C \\\\<^sub>r S)\" \"`\\C\\\\<^sub>D \\ (\\\\<^sub>D F \\ \\\\<^sub>D F)`\"\n shows \"(C \\\\<^sub>r S) \\ \\\\<^sub>D F\"\n using assms by (simp add: rdesign_def design_mu_refine_intro unrest)\n\nlemma H1_H2_mu_refine_intro:\n assumes \"P is \\<^bold>H\" \"P \\ F(P)\" \"`\\pre\\<^sub>D(P)\\\\<^sub>D \\ (\\\\<^sub>D F \\ \\\\<^sub>D F)`\"\n shows \"P \\ \\\\<^sub>D F\"\n by (metis H1_H2_eq_rdesign Healthy_if assms rdesign_mu_refine_intro)\n\ntext \\ Foundational theorem for recursion introduction using a well-founded relation. Contributed\n by Dr. Yakoub Nemouchi. \\\n\ntheorem rdesign_mu_wf_refine_intro: \n assumes WF: \"wf R\"\n and M: \"Monotonic F\"\n and H: \"F \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\"\n and induct_step:\n \"\\st. (P \\ \\e\\\\<^sub>< =\\<^sub>u \\st\\) \\\\<^sub>r Q \\ F ((P \\ (\\e\\\\<^sub><, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>r Q)\"\n shows \"(P \\\\<^sub>r Q) \\ \\\\<^sub>D F\" \nproof - \n {\n fix st\n have \"(P \\ \\e\\\\<^sub>< =\\<^sub>u \\st\\) \\\\<^sub>r Q \\ \\\\<^sub>D F\" \n using WF proof (induction rule: wf_induct_rule)\n case (less st)\n hence 0: \"(P \\ (\\e\\\\<^sub><, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>r Q \\ \\\\<^sub>D F\"\n by rel_blast\n from M H\n have 1: \"\\\\<^sub>D F \\ F (\\\\<^sub>D F)\"\n by (simp add: des_theory.LFP_lemma3 mono_Monotone_utp_order)\n from 0 1 have 2:\"(P \\ (\\e\\\\<^sub><,\\st\\)\\<^sub>u\\\\<^sub>u\\R\\) \\\\<^sub>r Q \\ F (\\\\<^sub>D F)\"\n by simp\n have 3: \"F ((P \\ (\\e\\\\<^sub><, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>r Q) \\ F (\\\\<^sub>D F)\"\n by (simp add: 0 M monoD)\n have 4:\"(P \\ \\e\\\\<^sub>< =\\<^sub>u \\st\\) \\\\<^sub>r Q \\ \\\" \n by (rule induct_step)\n show ?case\n using order_trans[OF 3 4] H M des_theory.LFP_lemma2 dual_order.trans mono_Monotone_utp_order\n by (metis (no_types) partial_object.simps(1) utp_order_def)\n qed\n }\n thus ?thesis\n by (pred_simp)\nqed \n\ntheorem ndesign_mu_wf_refine_intro': \n assumes WF: \"wf R\"\n and M: \"Monotonic F\"\n and H: \"F \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\"\n and induct_step:\n \"\\st. ((p \\ e =\\<^sub>u \\st\\) \\\\<^sub>n Q) \\ F ((p \\ (e, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>n Q)\"\n shows \"(p \\\\<^sub>n Q) \\ \\\\<^sub>D F\"\n using assms unfolding ndesign_def\n by (rule_tac rdesign_mu_wf_refine_intro[of R F \"\\p\\\\<^sub><\" e], simp_all add: alpha)\n\ntheorem ndesign_mu_wf_refine_intro: \n assumes WF: \"wf R\"\n and M: \"Monotonic F\"\n and H: \"F \\ \\\\<^bold>N\\\\<^sub>H \\ \\\\<^bold>N\\\\<^sub>H\"\n and induct_step:\n \"\\st. ((p \\ e =\\<^sub>u \\st\\) \\\\<^sub>n Q) \\ F ((p \\ (e, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>n Q)\"\n shows \"(p \\\\<^sub>n Q) \\ \\\\<^sub>N F\"\nproof - \n {\n fix st\n have \"(p \\ e =\\<^sub>u \\st\\) \\\\<^sub>n Q \\ \\\\<^sub>N F\" \n using WF proof (induction rule: wf_induct_rule)\n case (less st)\n hence 0: \"(p \\ (e, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>n Q \\ \\\\<^sub>N F\"\n by rel_blast\n from M H des_theory.LFP_lemma3 mono_Monotone_utp_order\n have 1: \"\\\\<^sub>N F \\ F (\\\\<^sub>N F)\"\n by (simp add: mono_Monotone_utp_order ndes_theory.LFP_lemma3)\n from 0 1 have 2:\"(p \\ (e, \\st\\)\\<^sub>u\\\\<^sub>u\\R\\) \\\\<^sub>n Q \\ F (\\\\<^sub>N F)\"\n by simp\n have 3: \"F ((p \\ (e, \\st\\)\\<^sub>u \\\\<^sub>u \\R\\) \\\\<^sub>n Q) \\ F (\\\\<^sub>N F)\"\n by (simp add: 0 M monoD)\n have 4:\"(p \\ e =\\<^sub>u \\st\\) \\\\<^sub>n Q \\ \\\" \n by (rule induct_step)\n show ?case\n using order_trans[OF 3 4] H M ndes_theory.LFP_lemma2 dual_order.trans mono_Monotone_utp_order \n by (metis (no_types) partial_object.simps(1) utp_order_def)\n qed\n }\n thus ?thesis\n by (pred_simp)\nqed \n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/designs/utp_des_theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.2820290505130333}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory fncall\nimports \"CParser.CTranslation\"\nbegin\n\ndeclare sep_conj_ac [simp add]\n\nprimrec\n fac :: \"nat \\ nat\"\nwhere\n \"fac 0 = 1\"\n| \"fac (Suc n) = (Suc n) * fac n\"\n\nML \\\n\nval ast = IsarInstall.get_Csyntax @{theory} \"fncall.c\"\n\n\\\n\nexternal_file \"fncall.c\"\ninstall_C_file \"fncall.c\"\n\ncontext fncall\nbegin\n\n\nthm \"\\_def\"\nthm has_bogus_spec_'proc_def\nthm has_bogus_spec_impl\nthm f_impl\nthm g_impl\nthm h_impl\nthm i_impl\nthm calls_bogus_impl\nthm f_body_def\nthm g_body_def\nthm fact_body_def\n\nthm fact_'proc_def\n\nthm has_bogus_spec_modifies\nthm g_modifies\nthm f_modifies\nthm fact_modifies\n\nterm \"f_body\"\nterm \"\\\"\nterm \"fact_body\"\nterm \"f_'proc\"\n\nend\n\nprint_locale fncall_global_addresses\n\nprint_locale g_modifies\nthm g_modifies_def\n\nprint_locale f_spec\nthm f_spec_def\n\nlemma (in g_modifies)\n shows \"\\ \\ \\ \\t_hrs = t \\ \\ret__int :== PROC g() \\ \\t_hrs = t \\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in fncall_global_addresses) f_impl_result:\n \"\\ f_'proc = Some f_body\"\n apply (rule f_impl)\n done\n\nlemma (in fncall_global_addresses) g_spec:\n shows\n \"\\ \\ \\ True \\ \\ret__int :== PROC g() \\ \\ret__int = 257 \\\"\n apply vcg\n done\n\nlemma (in fncall_global_addresses) foo:\n shows\n \"\\ \\ \\ True \\ \\ret__int :== PROC f(n) \\ \\ret__int = 1 \\\"\napply vcg\napply (simp )\ndone\n\nlemma (in f_spec) foo :\nshows\n \"\\ \\ \\ True \\ \\ret__int :== CALL f(\\n) \\ \\ret__int = 1 \\\"\n\napply vcg\ndone\n\nlemma (in fncall_global_addresses) bar:\nshows \"\\ \\ \\ 1\\ \\n & \\n \\ 12 \\ \\ret__int :== CALL fact(\\n) \\ \\ret__int = of_nat (fac (unat \\n)) \\\"\napply vcg\napply unat_arith\noops\n\nlemma (in fncall_global_addresses) baz:\nshows \"\\ \\\\<^bsub>/UNIV\\<^esub> \\ \\t_hrs = t \\ \\ret__int :== PROC i() \\ \\t_hrs = t \\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\nlocale ih = i_modifies + h_modifies\nlemma (in ih) qux:\nshows \"\\t. \\ \\ \\\\t_hrs = t\\ \\ret__int :== CALL i() \\ t = \\t_hrs \\\"\napply vcg\noops\n\nlocale ff = f_spec + f_modifies\n(* this lemma is bogus, because f does actually modify the globals *)\nlemma (in ff) bogus1:\nshows \"\\t. \\ \\ \\ \\t_hrs = t \\ \\ret__int :== CALL f(\\n) \\ t = \\t_hrs \\\"\napply vcg\napply simp\ndone\n\nlemma (in has_bogus_spec_spec) bogus2:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL has_bogus_spec() \\ \\ret__int = 4 \\\"\napply vcg\ndone\n\nlemma (in fncall_global_addresses) toldyou:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL has_bogus_spec() \\ \\ret__int = 3 \\\"\napply vcg\ndone\n\nlemma (in has_bogus_spec_spec) bogus3:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL calls_bogus() \\ \\ret__int = 4 \\\"\napply vcg\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/testfiles/fncall.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.28198139768053615}} {"text": "section \\Modelling distributed systems\\\n\ntext \\We assume familiarity with Chandy and Lamport's\npaper \\emph{Distributed Snapshots: Determining Global States of\nDistributed Systems}~\\<^cite>\\\"chandy\"\\.\\\n\ntheory Distributed_System\n\nimports Main\n\nbegin\n\ntype_synonym 'a fifo = \"'a list\"\ntype_synonym channel_id = nat\n\ndatatype 'm message =\n Marker\n | Msg 'm\n\ndatatype recording_state =\n NotStarted\n | Recording\n | Done\n\ntext \\We characterize distributed systems by three underlying type variables:\nType variable 'p captures the processes of the underlying system.\nType variable 's describes the possible states of the processes.\nFinally, type variable 'm describes all possible messages in said system.\n\nEach process is in exactly one state at any point in time of the system.\nProcesses are interconnected by directed channels, which hold messages in-flight\nbetween connected processes. There can be an arbitrary number of channels between\ndifferent processes. The entire state of the system including the (potentially unfinished)\nsnapshot state is called \\emph{configuration}.\\\n\nrecord ('p, 's, 'm) configuration =\n states :: \"'p \\ 's\"\n msgs :: \"channel_id \\ 'm message fifo\"\n\n process_snapshot :: \"'p \\ 's option\"\n channel_snapshot :: \"channel_id \\ 'm fifo * recording_state\"\n\ntext \\An event in Chandy and Lamport's formalization describes a\nprocess' state transition, optionally producing or consuming\n(but not both) a message on a channel. Additionally, a process may either initiate\na snapshot spontaneously, or is forced to do so by receiving a snapshot \\emph{marker}\non one of it's incoming channels.\\\n\ndatatype ('p, 's, 'm) event =\n isTrans: Trans (occurs_on: 'p) 's 's\n | isSend: Send (getId: channel_id)\n (occurs_on: 'p)\n (partner: 'p)\n 's 's (getMsg: 'm)\n | isRecv: Recv (getId: channel_id)\n (occurs_on: 'p)\n (partner: 'p)\n 's 's (getMsg: 'm)\n\n | isSnapshot: Snapshot (occurs_on: 'p)\n | isRecvMarker: RecvMarker (getId: channel_id)\n (occurs_on: 'p)\n (partner: 'p)\n\ntext \\We introduce abbreviations and type synoyms for commonly used terms.\\\n\ntype_synonym ('p, 's, 'm) trace = \"('p, 's, 'm) event list\"\n\nabbreviation ps where \"ps \\ process_snapshot\"\nabbreviation cs where \"cs \\ channel_snapshot\"\n\nabbreviation no_snapshot_change where\n \"no_snapshot_change c c' \\ ((\\p'. ps c p' = ps c' p') \\ (\\i'. cs c i' = cs c' i'))\"\n\nabbreviation has_snapshotted where\n \"has_snapshotted c p \\ process_snapshot c p \\ None\"\n\ntext \\A regular event is an event as described in Chandy and Lamport's\noriginal paper: A state transition accompanied by the emission\nor receiving of a message. Nonregular events are related to\nsnapshotting and receiving markers along communication channels.\\\n\ndefinition regular_event[simp]:\n \"regular_event ev \\ (isTrans ev \\ isSend ev \\ isRecv ev)\"\n\nlemma nonregular_event:\n \"~ regular_event ev = (isSnapshot ev \\ isRecvMarker ev)\" \n by (meson event.distinct_disc event.exhaust_disc regular_event)\n\nlemma event_occurs_on_unique:\n assumes\n \"p \\ q\"\n \"occurs_on ev = p\"\n shows\n \"occurs_on ev \\ q\"\n using assms by (cases ev, auto)\n\nsubsection \\The distributed system locale\\\n\ntext \\In order to capture Chandy and Lamport's computation system\nwe introduce two locales. The distributed system locale describes\nglobal truths, such as the mapping from channel IDs to sender and\nreceiver processes, the transition relations for the underlying\ncomputation system and the core assumption that no process has\na channel to itself. While not explicitly mentioned in Chandy's\nand Lamport's work, it makes sense to assume that a channel need\nnot communicate to itself via messages, since it shares memory with\nitself.\\\n\nlocale distributed_system =\n fixes\n channel :: \"channel_id \\ ('p * 'p) option\" and\n trans :: \"'p \\ 's \\ 's \\ bool\" and\n send :: \"channel_id \\ 'p \\ 'p \\ 's \\ 's \\ 'm \\ bool\" and\n recv :: \"channel_id \\ 'p \\ 'p \\ 's \\ 's \\ 'm \\ bool\"\n assumes\n no_self_channel:\n \"\\i. \\p. channel i = Some (p, p)\"\nbegin\n\nsubsubsection \\State transitions\\\n\ndefinition can_occur :: \"('p, 's, 'm) event \\ ('p, 's, 'm) configuration \\ bool\" where\n\"can_occur ev c \\ (case ev of\n Trans p s s' \\ states c p = s\n \\ trans p s s'\n | Send i p q s s' msg \\ states c p = s\n \\ channel i = Some (p, q)\n \\ send i p q s s' msg\n | Recv i p q s s' msg \\ states c p = s\n \\ channel i = Some (q, p)\n \\ length (msgs c i) > 0\n \\ hd (msgs c i) = Msg msg\n \\ recv i p q s s' msg\n | Snapshot p \\ \\ has_snapshotted c p\n | RecvMarker i p q \\ channel i = Some (q, p)\n \\ length (msgs c i) > 0\n \\ hd (msgs c i) = Marker)\"\n\ndefinition src where\n \"src i p \\ (\\q. channel i = Some (p, q))\"\n\ndefinition dest where\n \"dest i q \\ (\\p. channel i = Some (p, q))\"\n\nlemma can_occur_Recv:\n assumes\n \"can_occur (Recv i p q s s' m) c\"\n shows\n \"states c p = s \\ channel i = Some (q, p) \\ (\\xs. msgs c i = Msg m # xs) \\ recv i p q s s' m\"\nproof -\n have \"\\xs. msgs c i = Msg m # xs\" \n using assms can_occur_def \n by (metis (mono_tags, lifting) event.case(3) hd_Cons_tl length_greater_0_conv)\n then show ?thesis using assms can_occur_def by auto\nqed\n\nabbreviation check_snapshot_occur where\n \"check_snapshot_occur c c' p \\\n (can_occur (Snapshot p) c \\\n (ps c' p = Some (states c p))\n \\ (\\p'. states c p' = states c' p')\n \\ (\\p'. (p' \\ p) \\ ps c' p' = ps c p')\n \\ (\\i. (\\q. channel i = Some (p, q)) \\ msgs c' i = msgs c i @ [Marker])\n \\ (\\i. (\\q. channel i = Some (q, p)) \\ channel_snapshot c' i = (fst (channel_snapshot c i), Recording))\n \\ (\\i. (\\q. channel i = Some (p, q)) \\ msgs c' i = msgs c i)\n \\ (\\i. (\\q. channel i = Some (q, p)) \\ channel_snapshot c' i = channel_snapshot c i))\"\n\nabbreviation check_recv_marker_occur where\n \"check_recv_marker_occur c c' i p q \\\n (can_occur (RecvMarker i p q) c\n \\ (\\r. states c r = states c' r)\n \\ (\\r. (r \\ p) \\ process_snapshot c r = process_snapshot c' r)\n \\ (Marker # msgs c' i = msgs c i)\n \\ (channel_snapshot c' i = (fst (channel_snapshot c i), Done))\n \\ (if has_snapshotted c p\n then (process_snapshot c p = process_snapshot c' p)\n \\ (\\i'. (i' \\ i) \\ msgs c' i' = msgs c i')\n \\ (\\i'. (i' \\ i) \\ channel_snapshot c i' = channel_snapshot c' i')\n else (process_snapshot c' p = Some (states c p))\n \\ (\\i'. i' \\ i \\ (\\r. channel i' = Some (p, r))\n \\ msgs c' i' = msgs c i' @ [Marker])\n \\ (\\i'. i' \\ i \\ (\\r. channel i' = Some (r, p))\n \\ channel_snapshot c' i' = (fst (channel_snapshot c i'), Recording))\n \\ (\\i'. i' \\ i \\ (\\r. channel i' = Some (p, r))\n \\ msgs c' i' = msgs c i')\n \\ (\\i'. i' \\ i \\ (\\r. channel i' = Some (r, p))\n \\ channel_snapshot c' i' = channel_snapshot c i')))\"\n\nabbreviation check_trans_occur where\n \"check_trans_occur c c' p s s'\\\n (can_occur (Trans p s s') c\n \\ (states c' p = s')\n \\ (\\r. (r \\ p) \\ states c' r = states c r)\n \\ (\\i. msgs c' i = msgs c i)\n \\ (no_snapshot_change c c'))\"\n\nabbreviation check_send_occur where \n \"check_send_occur c c' i p q s s' msg \\\n (can_occur (Send i p q s s' msg) c\n \\ (states c' p = s')\n \\ (\\r. (r \\ p) \\ states c' r = states c r)\n \\ (msgs c' i = msgs c i @ [Msg msg])\n \\ (\\i'. i \\ i' \\ msgs c' i' = msgs c i')\n \\ (no_snapshot_change c c'))\"\n\nabbreviation check_recv_occur where\n \"check_recv_occur c c' i p q s s' msg \\\n (can_occur (Recv i p q s s' msg) c\n \\ (states c p = s \\ states c' p = s')\n \\ (\\r. (r \\ p) \\ states c' r = states c r)\n \\ (msgs c i = Msg msg # msgs c' i)\n \\ (\\i'. i \\ i' \\ msgs c' i' = msgs c i')\n \\ (\\r. process_snapshot c r = process_snapshot c' r)\n \\ (\\i'. i' \\ i \\ channel_snapshot c i' = channel_snapshot c' i')\n \\ (if snd (channel_snapshot c i) = Recording\n then channel_snapshot c' i = (fst (channel_snapshot c i) @ [msg], Recording)\n else channel_snapshot c i = channel_snapshot c' i))\"\n\ntext \\The \\emph{next} predicate lets us express configuration transitions\nusing events. The predicate $next(s_1, e, s_2)$ denotes the transition\nof the configuration $s_1$ to $s_2$ via the event $e$. It ensures that\n$e$ can occur in state $s_1$ and the state $s_2$ is correctly constructed\nfrom $s_1$.\\\n\nprimrec \"next\" ::\n \"('p, 's, 'm) configuration\n \\ ('p, 's, 'm) event\n \\ ('p, 's, 'm) configuration\n \\ bool\"\n (\"_ \\ _ \\ _\" [70, 70, 70]) where\n next_snapshot: \"c \\ Snapshot p \\ c' =\n check_snapshot_occur c c' p\"\n | next_recv_marker: \"c \\ RecvMarker i p q \\ c' =\n check_recv_marker_occur c c' i p q\"\n | next_trans: \"c \\ Trans p s s' \\ c' =\n check_trans_occur c c' p s s'\"\n | next_send: \"c \\ Send i p q s s' msg \\ c' =\n check_send_occur c c' i p q s s' msg\"\n | next_recv: \"c \\ Recv i p q s s' msg \\ c' =\n check_recv_occur c c' i p q s s' msg\"\n\ntext \\Useful lemmas about state transitions\\\n\nlemma state_and_event_determine_next:\n assumes\n \"c \\ ev \\ c'\" and\n \"c \\ ev \\ c''\"\n shows\n \"c' = c''\"\nproof (cases ev)\n case (Snapshot p)\n then have \"states c' = states c''\" using assms by auto\n moreover have \"msgs c' = msgs c''\"\n proof (rule ext)\n fix i\n show \"msgs c' i = msgs c'' i\"\n proof (cases \"channel i = None\")\n case True\n then show ?thesis using Snapshot assms by auto\n next\n case False\n then obtain r s where \"channel i = Some (r, s)\" by auto\n with assms Snapshot show ?thesis by (cases \"r = p\", simp_all)\n qed\n qed\n moreover have \"process_snapshot c' = process_snapshot c''\" by (metis Snapshot assms next_snapshot ext)\n moreover have \"channel_snapshot c' = channel_snapshot c''\"\n proof (rule ext)\n fix i\n show \"channel_snapshot c' i = channel_snapshot c'' i\"\n proof (cases \"channel i = None\")\n case True\n then show ?thesis using assms Snapshot by simp\n next\n case False\n then obtain r s where \"channel i = Some (r, s)\" by auto\n with assms Snapshot show ?thesis by (cases \"s = p\", simp_all)\n qed\n qed\n ultimately show \"c' = c''\" by simp\nnext\n case (RecvMarker i p)\n then have \"states c' = states c''\" using assms by auto\n moreover have \"msgs c' = msgs c''\"\n proof (rule ext)\n fix i'\n show \"msgs c' i' = msgs c'' i'\"\n proof (cases \"i' = i\")\n case True\n then have \"Marker # msgs c' i' = msgs c i'\" using assms RecvMarker by simp\n also have \"... = Marker # msgs c'' i'\" using assms RecvMarker \\i' = i\\ by simp\n finally show ?thesis by simp\n next\n case False\n then show ?thesis\n proof (cases \"has_snapshotted c p\")\n case True\n then show ?thesis using assms RecvMarker \\i' \\ i\\ by simp\n next\n case no_snap: False\n then show ?thesis\n proof (cases \"channel i' = None\")\n case True\n then show ?thesis using assms RecvMarker \\i' \\ i\\ no_snap by simp\n next\n case False\n then obtain r s where \"channel i' = Some (r, s)\" by auto\n with assms RecvMarker no_snap \\i' \\ i\\ show ?thesis by (cases \"r = p\"; simp_all)\n qed\n qed\n qed\n qed\n moreover have \"process_snapshot c' = process_snapshot c''\"\n proof (rule ext)\n fix r\n show \"ps c' r = ps c'' r\"\n proof (cases \"r \\ p\")\n case True\n then show ?thesis using assms RecvMarker by simp\n next\n case False\n with assms RecvMarker \\~ r \\ p\\ show ?thesis by (cases \"has_snapshotted c r\", auto)\n qed\n qed\n moreover have \"channel_snapshot c' = channel_snapshot c''\"\n proof (rule ext)\n fix i'\n show \"cs c' i' = cs c'' i'\"\n proof (cases \"i' = i\")\n case True\n then show ?thesis using assms RecvMarker by simp\n next\n case False\n then show ?thesis\n proof (cases \"has_snapshotted c p\")\n case True\n then show ?thesis using assms RecvMarker \\i' \\ i\\ by simp\n next\n case no_snap: False\n then show ?thesis\n proof (cases \"channel i' = None\")\n case True\n then show ?thesis using assms RecvMarker \\i' \\ i\\ no_snap by simp\n next\n case False\n then obtain r s where \"channel i' = Some (r, s)\" by auto\n with assms RecvMarker no_snap \\i' \\ i\\ show ?thesis by (cases \"s = p\"; simp_all)\n qed\n qed\n qed\n qed\n ultimately show \"c' = c''\" by simp\nnext\n case (Trans p s s')\n then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_trans ext)\n moreover have \"msgs c' = msgs c''\" using assms Trans by auto\n moreover have \"process_snapshot c' = process_snapshot c''\" using assms Trans by auto\n moreover have \"channel_snapshot c' = channel_snapshot c''\" using assms Trans by auto\n ultimately show \"c' = c''\" by simp\nnext\n case (Send i p s s' m)\n then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_send ext)\n moreover have \"msgs c' = msgs c''\"\n proof (rule ext)\n fix i'\n from assms Send show \"msgs c' i' = msgs c'' i'\" by (cases \"i' = i\", simp_all)\n qed\n moreover have \"process_snapshot c' = process_snapshot c''\" using assms Send by auto\n moreover have \"channel_snapshot c' = channel_snapshot c''\" using assms Send by auto\n ultimately show \"c' = c''\" by simp\nnext\n case (Recv i p s s' m)\n then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_recv ext)\n moreover have \"msgs c' = msgs c''\"\n proof (rule ext)\n fix i'\n from assms Recv show \"msgs c' i' = msgs c'' i'\" by (cases \"i' = i\", simp_all)\n qed\n moreover have \"process_snapshot c' = process_snapshot c''\" using assms Recv by auto\n moreover have \"channel_snapshot c' = channel_snapshot c''\"\n proof (rule ext)\n fix i'\n show \"cs c' i' = cs c'' i'\"\n proof (cases \"i' \\ i\")\n case True\n then show ?thesis using assms Recv by simp\n next\n case False\n with assms Recv show ?thesis by (cases \"snd (cs c i') = Recording\", auto)\n qed\n qed\n ultimately show \"c' = c''\" by simp\nqed\n\nlemma exists_next_if_can_occur:\n assumes\n \"can_occur ev c\"\n shows\n \"\\c'. c \\ ev \\ c'\"\nproof (cases ev)\n case (Snapshot p)\n let ?c = \"\\ states = states c,\n msgs = %i. if (\\q. channel i = Some (p, q)) then msgs c i @ [Marker] else msgs c i,\n process_snapshot = %r. if r = p then Some (states c p) else ps c r,\n channel_snapshot = %i. if (\\q. channel i = Some (q, p)) then (fst (cs c i), Recording) else cs c i \\\"\n have \"c \\ ev \\ ?c\" using Snapshot assms by auto\n then show ?thesis by blast\nnext\n case (RecvMarker i p q)\n show ?thesis\n proof (cases \"has_snapshotted c p\")\n case True\n let ?c = \"\\ states = states c,\n msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n process_snapshot = ps c,\n channel_snapshot = %i'. if i = i' then (fst (cs c i'), Done) else cs c i' \\\"\n have \"msgs c i = Marker # msgs ?c i\"\n using assms can_occur_def RecvMarker hd_Cons_tl by fastforce\n then have \"c \\ ev \\ ?c\" using True RecvMarker assms by auto\n then show ?thesis by blast\n next\n case False\n let ?c = \"\\ states = states c,\n msgs = %i'. if i' = i\n then tl (msgs c i')\n else if (\\r. channel i' = Some (p, r))\n then msgs c i' @ [Marker]\n else msgs c i',\n process_snapshot = %r. if r = p then Some (states c r) else ps c r,\n channel_snapshot = %i'. if i = i' then (fst (cs c i'), Done)\n else if (\\r. channel i' = Some (r, p))\n then (fst (cs c i'), Recording)\n else cs c i' \\\"\n have \"msgs c i = Marker # msgs ?c i\"\n using assms can_occur_def RecvMarker hd_Cons_tl by fastforce\n moreover have \"ps ?c p = Some (states c p)\" by simp\n ultimately have \"c \\ ev \\ ?c\" using RecvMarker assms False by auto\n then show ?thesis by blast\n qed\nnext\n case (Trans p s s')\n let ?c = \"\\ states = %r. if r = p then s' else states c r,\n msgs = msgs c,\n process_snapshot = ps c,\n channel_snapshot = cs c \\\"\n have \"c \\ ev \\ ?c\" \n using Trans assms by auto\n then show ?thesis by blast\nnext\n case (Send i p q s s' msg)\n let ?c = \"\\ states = %r. if r = p then s' else states c r,\n msgs = %i'. if i = i' then msgs c i' @ [Msg msg] else msgs c i',\n process_snapshot = ps c,\n channel_snapshot = cs c \\\"\n have \"c \\ ev \\ ?c\" \n using Send assms by auto\n then show ?thesis by blast\nnext\n case (Recv i p q s s' msg)\n then show ?thesis\n proof (cases \"snd (cs c i)\")\n case Recording\n let ?c = \"\\ states = %r. if r = p then s' else states c r,\n msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n process_snapshot = ps c,\n channel_snapshot = %i'. if i = i'\n then (fst (cs c i') @ [msg], Recording)\n else cs c i'\\\"\n have \"c \\ ev \\ ?c\" \n using Recv Recording assms can_occur_Recv by fastforce\n then show ?thesis by blast\n next\n case Done\n let ?c = \"\\ states = %r. if r = p then s' else states c r,\n msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n process_snapshot = ps c,\n channel_snapshot = cs c \\\"\n have \"c \\ ev \\ ?c\"\n using Done Recv assms can_occur_Recv by fastforce\n then show ?thesis by blast\n next\n case NotStarted\n let ?c = \"\\ states = %r. if r = p then s' else states c r,\n msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n process_snapshot = ps c,\n channel_snapshot = cs c \\\"\n have \"c \\ ev \\ ?c\"\n using NotStarted Recv assms can_occur_Recv by fastforce\n then show ?thesis by blast\n qed\nqed\n\nlemma exists_exactly_one_following_state:\n \"can_occur ev c \\ \\!c'. c \\ ev \\ c'\"\n using exists_next_if_can_occur state_and_event_determine_next by blast\n\nlemma no_state_change_if_no_event:\n assumes\n \"c \\ ev \\ c'\" and\n \"occurs_on ev \\ p\"\n shows\n \"states c p = states c' p \\ process_snapshot c p = process_snapshot c' p\"\n using assms by (cases ev, auto)\n\n\n\nlemma no_cs_change_if_no_channel:\n assumes\n \"c \\ ev \\ c'\" and\n \"channel i = None\"\n shows\n \"cs c i = cs c' i\"\nusing assms proof (cases ev)\n case (RecvMarker cid p)\n then have \"cid \\ i\" using assms RecvMarker can_occur_def by fastforce\n with assms RecvMarker show ?thesis by (cases \"has_snapshotted c p\", auto)\nnext\n case (Send cid p s s' m)\n then have \"cid \\ i\" using assms Send can_occur_def by fastforce\n then show ?thesis using assms Send by auto\nnext\n case (Recv cid p s s' m)\n then have \"cid \\ i\" using assms Recv can_occur_def by fastforce\n then show ?thesis using assms Recv by simp\nqed simp_all\n\nlemma no_msg_change_if_no_event:\n assumes\n \"c \\ ev \\ c'\" and\n \"isSend ev \\ getId ev \\ i\" and\n \"isRecv ev \\ getId ev \\ i\" and\n \"regular_event ev\"\n shows\n \"msgs c i = msgs c' i\"\nproof (cases \"channel i = None\")\n case True\n then show ?thesis using assms no_msgs_change_if_no_channel by simp\nnext\n have \"isTrans ev \\ isSend ev \\ isRecv ev\" using assms by simp\n then show ?thesis\n proof (elim disjE)\n assume \"isTrans ev\"\n then show ?thesis \n by (metis assms(1) event.collapse(1) next_trans)\n next\n assume \"isSend ev\"\n then obtain i' r s u u' m where Send: \"ev = Send i' r s u u' m\" by (meson isSend_def)\n then show ?thesis using Send assms by auto\n next\n assume \"isRecv ev\"\n then obtain i' r s u u' m where \"ev = Recv i' r s u u' m\" by (meson isRecv_def)\n then show ?thesis using assms by auto\n qed\nqed\n\nlemma no_cs_change_if_no_event:\n assumes\n \"c \\ ev \\ c'\" and\n \"isRecv ev \\ getId ev \\ i\" and\n \"regular_event ev\"\n shows\n \"cs c i = cs c' i\"\nproof -\n have \"isTrans ev \\ isSend ev \\ isRecv ev\" using assms by simp\n then show ?thesis\n proof (elim disjE)\n assume \"isTrans ev\"\n then show ?thesis \n by (metis assms(1) event.collapse(1) next_trans)\n next\n assume \"isSend ev\"\n then obtain i' r s u u' m where \"ev = Send i' r s u u' m\" by (meson isSend_def)\n then show ?thesis using assms by auto\n next\n assume \"isRecv ev\"\n then obtain i r s u u' m where \"ev = Recv i r s u u' m\" by (meson isRecv_def)\n then show ?thesis using assms by auto\n qed\nqed\n\nlemma happen_implies_can_occur:\n assumes\n \"c \\ ev \\ c'\"\n shows\n \"can_occur ev c\"\nproof -\n show ?thesis using assms by (cases ev, auto)\nqed\n\nlemma snapshot_increases_message_length:\n assumes\n \"ev = Snapshot p\" and\n \"c \\ ev \\ c'\" and\n \"channel i = Some (q, r)\"\n shows\n \"length (msgs c i) \\ length (msgs c' i)\"\n using assms by (cases \"p = q\", auto)\n\nlemma recv_marker_changes_head_only_at_i:\n assumes\n \"ev = RecvMarker i p q\" and\n \"c \\ ev \\ c'\" and\n \"i' \\ i\"\n shows\n \"msgs c i' = [] \\ hd (msgs c i') = hd (msgs c' i')\"\nproof (cases \"channel i' = None\")\n case True\n then show ?thesis using assms no_msgs_change_if_no_channel by presburger\nnext\n case False\n then show ?thesis\n proof (cases \"msgs c i'\")\n case Nil\n then show ?thesis by simp\n next\n case (Cons m xs)\n then obtain r s where \"channel i' = Some (r, s)\" using False by auto\n then show ?thesis\n proof (cases \"has_snapshotted c p\")\n case True\n then show ?thesis using assms by auto\n next\n case False\n with assms show ?thesis by (cases \"r = p\", auto)\n qed\n qed\nqed\n\nlemma recv_marker_other_channels_not_shrinking:\n assumes\n \"ev = RecvMarker i p q\" and\n \"c \\ ev \\ c'\"\n shows\n \"length (msgs c i') \\ length (msgs c' i') \\ i \\ i'\"\nproof (rule iffI)\n show \"length (msgs c i') \\ length (msgs c' i') \\ i \\ i'\"\n proof (rule ccontr)\n assume asm: \"~ i \\ i'\" \"length (msgs c i') \\ length (msgs c' i')\"\n then have \"msgs c i = Marker # msgs c' i\" using assms by auto\n then have \"length (msgs c i) > length (msgs c' i)\" by simp\n then have \"length (msgs c i') > length (msgs c' i')\" using asm by simp\n then show False using asm by simp\n qed\nnext\n show \"i \\ i' \\ length (msgs c i') \\ length (msgs c' i')\"\n proof -\n assume \"i \\ i'\"\n then show ?thesis\n proof (cases \"channel i' = None\")\n case True\n then show ?thesis using assms no_msgs_change_if_no_channel by presburger\n next\n case False\n then obtain r s where chan: \"channel i' = Some (r, s)\" by auto\n then show ?thesis\n proof (cases \"has_snapshotted c p\")\n case True\n with assms \\i \\ i'\\ show ?thesis by auto\n next\n case no_snap: False\n then show ?thesis\n proof (cases \"p = r\")\n case True\n then have \"msgs c' i' = msgs c i' @ [Marker]\" using \\i \\ i'\\ assms no_snap chan by auto\n then show ?thesis by auto\n next\n case False\n then show ?thesis using assms \\i \\ i'\\ chan no_snap by auto\n qed\n qed\n qed\n qed\nqed\n\nlemma regular_event_cannot_induce_snapshot:\n assumes\n \"~ has_snapshotted c p\" and\n \"c \\ ev \\ c'\"\n shows\n \"regular_event ev \\ ~ has_snapshotted c' p\"\nproof (cases ev)\n case (Trans q s s')\n then show ?thesis using assms(1) assms(2) by auto\nnext\n case (Send q r s s' m)\n then show ?thesis using assms by auto\nnext\n case (Recv q r s s' m) \n then show ?thesis using assms by auto\nqed simp_all\n\nlemma regular_event_preserves_process_snapshots:\n assumes\n \"c \\ ev \\ c'\"\n shows\n \"regular_event ev \\ ps c r = ps c' r\"\nproof (cases ev)\n case (Trans p s s')\n then show ?thesis \n using assms by auto\nnext\n case (Send p q s s' m)\n then show ?thesis \n using assms by auto\nnext\n case (Recv p q s s' m)\n then show ?thesis \n using assms by auto\nqed simp_all\n\nlemma no_state_change_if_nonregular_event:\n assumes\n \"~ regular_event ev\" and\n \"c \\ ev \\ c'\"\n shows\n \"states c p = states c' p\"\nproof -\n have \"isSnapshot ev \\ isRecvMarker ev\" using nonregular_event assms by auto\n then show ?thesis\n proof (elim disjE, goal_cases)\n case 1\n then obtain q where \"ev = Snapshot q\" \n by (meson isSnapshot_def)\n then show ?thesis \n using assms(2) by auto\n next\n case 2\n then obtain i q r where \"ev = RecvMarker i q r\"\n by (meson isRecvMarker_def)\n then show ?thesis using assms(2) by auto\n qed\nqed\n\nlemma nonregular_event_induces_snapshot:\n assumes\n \"~ has_snapshotted c p\" and\n \"c \\ ev \\ c'\" and\n \"occurs_on ev = p\" and\n \"~ regular_event ev\"\n shows\n \"~ regular_event ev \\ has_snapshotted c' p\"\nproof (cases ev)\n case (Snapshot q)\n then have \"q = p\" using assms by auto\n then show ?thesis using Snapshot assms(2) by auto\nnext\n case (RecvMarker i q r)\n then have \"q = p\" using assms by auto\n then show ?thesis using RecvMarker assms by auto\nqed (simp_all add: assms)\n\nlemma snapshot_state_unchanged:\n assumes\n step: \"c \\ ev \\ c'\" and\n \"has_snapshotted c p\"\n shows\n \"ps c p = ps c' p\"\nproof (cases \"occurs_on ev = p\")\n case False\n then show ?thesis \n using local.step no_state_change_if_no_event by auto\nnext\n case True\n then show ?thesis\n proof (cases \"regular_event ev\")\n case True\n then show ?thesis \n using local.step regular_event_preserves_process_snapshots by auto\n next\n case False\n have \"isRecvMarker ev\"\n proof (rule ccontr)\n have \"isSnapshot ev \\ isRecvMarker ev\" \n using False nonregular_event by blast\n moreover assume \"~ isRecvMarker ev\"\n ultimately have \"isSnapshot ev\" by simp\n then have \"ev = Snapshot p\" by (metis True event.collapse(4))\n then have \"can_occur ev c\" \n using happen_implies_can_occur local.step by blast\n then have \"~ has_snapshotted c p\" unfolding can_occur_def \n by (simp add: \\ev = Snapshot p\\)\n then show False using assms by auto\n qed\n then show ?thesis (* z3 sledgehammer fails for Isabelle2019 *)\n proof -\n have \"\\n pa. c \\ RecvMarker n p pa \\ c'\"\n by (metis True \\isRecvMarker ev\\ event.collapse(5) local.step)\n then show ?thesis\n using assms(2) by force\n qed\n qed\nqed\n\nlemma message_must_be_delivered:\n assumes\n valid: \"c \\ ev \\ c'\" and\n delivered: \"(msgs c i \\ [] \\ hd (msgs c i) = m) \\ (msgs c' i = [] \\ hd (msgs c' i) \\ m)\"\n shows\n \"(\\p q. ev = RecvMarker i p q \\ m = Marker)\n \\ (\\p q s s' m'. ev = Recv i p q s s' m' \\ m = Msg m')\"\nproof (cases ev)\n case (Snapshot p)\n then show ?thesis\n proof (cases \"msgs c i\")\n case Nil\n then show ?thesis using delivered by simp\n next\n case (Cons m xs)\n with assms Snapshot show ?thesis\n proof (cases \"channel i = None\")\n case True\n then show ?thesis using assms Snapshot by auto\n next\n case False\n then obtain r s where chan: \"channel i = Some (r, s)\" by auto\n then show ?thesis\n proof (cases \"r = p\")\n case True\n then have \"msgs c' i = msgs c i @ [Marker]\" using assms(1) Snapshot chan by auto\n then show ?thesis using delivered by auto\n next\n case False\n then have \"msgs c' i = msgs c i\" using assms Snapshot chan by simp\n then show ?thesis using delivered Cons by simp\n qed\n qed\n qed\nnext\n case (RecvMarker i' p q)\n then have \"i' = i\" \n by (metis assms(1) delivered le_0_eq length_greater_0_conv list.size(3) recv_marker_changes_head_only_at_i recv_marker_other_channels_not_shrinking)\n moreover have \"Marker = m\"\n using \\i' = i\\ RecvMarker assms(1) can_occur_def delivered by auto\n moreover have \"channel i = Some (q, p)\" \n using RecvMarker assms(1) calculation(1) can_occur_def by auto\n ultimately show ?thesis using RecvMarker by simp\nnext\n case (Trans p' s s')\n then show ?thesis\n using valid delivered by auto\nnext\n case (Send p' q' s s' m')\n then show ?thesis\n by (metis (no_types, lifting) delivered distributed_system.next.simps(4) distributed_system_axioms hd_append2 snoc_eq_iff_butlast valid)\nnext\n case (Recv i' p q s s' m')\n then have \"i = i'\" \n using assms(1) delivered by auto\n also have \"m = Msg m'\" \n by (metis (no_types, lifting) Recv delivered list.sel(1) next_recv valid)\n ultimately show ?thesis using Recv by auto\nqed\n\nlemma message_must_be_delivered_2:\n assumes\n \"c \\ ev \\ c'\"\n \"m : set (msgs c i)\"\n \"m \\ set (msgs c' i)\"\n shows\n \"(\\p q. ev = RecvMarker i p q \\ m = Marker) \\ (\\p q s s' m'. ev = Recv i p q s s' m' \\ m = Msg m')\"\nproof -\n have uneq_sets: \"set (msgs c i) \\ set (msgs c' i)\" \n using assms(2) assms(3) by blast\n then obtain p q where chan: \"channel i = Some (p, q)\"\n using assms no_msgs_change_if_no_channel by fastforce\n then show ?thesis\n proof (cases ev)\n case (Snapshot p')\n with Snapshot assms chan have \"set (msgs c' i) = set (msgs c i)\" by (cases \"p' = p\", auto)\n then show ?thesis using uneq_sets by simp\n next\n case (Trans p' s s')\n then show ?thesis using uneq_sets assms by simp\n next\n case (Send i' p' q' s s' m)\n then show ?thesis\n by (metis (no_types, lifting) UnCI assms(1) assms(2) assms(3) local.next.simps(4) set_append)\n next\n case (RecvMarker i' p' q')\n have \"i' = i\"\n proof (rule ccontr)\n assume \"~ i' = i\"\n show False using assms chan RecvMarker\n proof (cases \"has_snapshotted c p'\")\n case True\n then show False using assms chan RecvMarker \\~ i' = i\\ by simp\n next\n case False\n then show False using assms chan RecvMarker \\~ i' = i\\ by (cases \"p' = p\", simp_all)\n qed\n qed\n moreover have \"m = Marker\"\n proof -\n have \"msgs c i' = Marker # msgs c' i'\" using assms chan RecvMarker by auto\n then show ?thesis using assms \\i' = i\\ by simp\n qed\n ultimately show ?thesis using RecvMarker by simp\n next\n case (Recv i' p' q' s s' m')\n have \"i' = i\"\n proof (rule ccontr)\n assume \"~ i' = i\"\n then show False \n using Recv assms(1) uneq_sets by auto\n qed\n then have \"i' = i \\ m = Msg m'\" \n using Recv assms by auto\n then show ?thesis using Recv by simp\n qed\nqed\n\nlemma recv_marker_means_snapshotted_1:\n assumes\n \"ev = RecvMarker i p q\" and\n \"c \\ ev \\ c'\"\n shows\n \"has_snapshotted c' p\"\n using assms snapshot_state_unchanged by (cases \"has_snapshotted c p\", auto)\n\nlemma recv_marker_means_snapshotted_2:\n fixes\n c c' :: \"('p, 's, 'm) configuration\" and\n ev :: \"('p, 's, 'm) event\" and\n i :: channel_id\n assumes\n \"c \\ ev \\ c'\" and\n \"Marker : set (msgs c i)\" and\n \"Marker \\ set (msgs c' i)\" and\n \"channel i = Some (q, p)\"\n shows\n \"has_snapshotted c' p\"\nproof -\n have \"\\p q. ev = RecvMarker i p q\"\n using assms message_must_be_delivered_2 by blast\n then obtain r s where RecvMarker: \"ev = RecvMarker i r s\"\n by blast\n then have \"r = p\"\n using assms(1) assms(4) can_occur_def by auto\n then show ?thesis\n using recv_marker_means_snapshotted_1 assms RecvMarker by blast\nqed\n\nlemma event_stays_valid_if_no_occurrence:\n assumes\n \"c \\ ev \\ c'\" and\n \"occurs_on ev \\ occurs_on ev'\" and\n \"can_occur ev' c\"\n shows\n \"can_occur ev' c'\"\nproof (cases ev')\n case (Trans p s s')\n have \"states c p = states c' p\"\n using Trans assms(1) assms(2) no_state_change_if_no_event by auto\n moreover have \"states c p = s\" using can_occur_def assms Trans by simp\n ultimately have \"states c' p = s\" by simp\n moreover have \"trans p s s'\" \n using Trans assms(3) can_occur_def by auto\n ultimately show ?thesis \n by (simp add: Trans can_occur_def)\nnext\n case (Recv i p q s s' m)\n then have \"hd (msgs c i) = Msg m\"\n proof -\n from Recv have \"length (msgs c i) > 0\" using assms(3) can_occur_def by auto\n then obtain m' xs where mcqp: \"msgs c i = m' # xs\"\n by (metis list.size(3) nat_less_le neq_Nil_conv)\n then have \"Msg m = m'\"\n proof (cases m', auto)\n case Marker\n then have \"msgs c i = Marker # xs\" by (simp add:mcqp)\n then have \"~ can_occur ev' c\" using Recv can_occur_def by simp\n then show False using assms(3) by simp\n next\n case (Msg msg)\n then have \"msgs c i = Msg msg # xs\" by (simp add: mcqp)\n then show \"m = msg\" using Recv can_occur_def assms(3) by simp\n qed\n then show ?thesis by (simp add: mcqp)\n qed\n show ?thesis\n proof (rule ccontr)\n assume asm: \"~ can_occur ev' c'\"\n then have \"msgs c' i = [] \\ hd (msgs c' i) \\ Msg m\"\n using Recv assms can_occur_def no_state_change_if_no_event distributed_system_axioms list.case_eq_if by fastforce\n then obtain i' p' q' s'' s''' m' where RMoR: \"ev = RecvMarker i' p' q' \\ ev = Recv i p' q' s'' s''' m'\"\n by (metis Recv \\hd (msgs c i) = Msg m\\ assms(1) assms(3) can_occur_Recv list.discI message_must_be_delivered)\n then have \"occurs_on ev = p\" \n proof -\n have f1: \"states c p = s \\ channel i = Some (q, p) \\ recv i p q s s' m \\ 0 < length (msgs c i) \\ hd (msgs c i) = Msg m\"\n using Recv assms(3) can_occur_def by force\n have f2: \"RecvMarker i' p' q' = ev \\ states c p' = s'' \\ channel i = Some (q', p') \\ recv i p' q' s'' s''' m' \\ 0 < length (msgs c i) \\ hd (msgs c i) = Msg m'\"\n using RMoR assms(1) can_occur_def by force\n have \"\\e n c. \\p pa s sa m. \\ca cb. (\\ c \\ e \\ ca \\ msgs ca n \\ [] \\ hd (msgs c n) = Marker \\ msgs c n = [] \\ Recv n p pa s sa m = e) \\ (\\ c \\ e \\ cb \\ hd (msgs c n) = Marker \\ hd (msgs cb n) = hd (msgs c n) \\ msgs c n = [] \\ Recv n p pa s sa m = e)\"\n by (metis (no_types) message_must_be_delivered)\n then show ?thesis\n using f2 f1 by (metis RMoR \\msgs c' i = [] \\ hd (msgs c' i) \\ Msg m\\ assms(1) event.disc(13,15) event.sel(3,5) length_greater_0_conv message.distinct(1) option.inject prod.inject)\n qed\n then show False using assms Recv by simp\n qed\nnext\n case (Send i p q s s' m)\n then have \"states c p = states c' p\" using assms no_state_change_if_no_event by auto\n then show \"can_occur ev' c'\" using assms assms(3) can_occur_def Send by auto\nnext\n case (RecvMarker i p q)\n then have msgs_ci: \"hd (msgs c i) = Marker \\ length (msgs c i) > 0\"\n proof -\n from RecvMarker have \"length (msgs c i) > 0\" using assms(3) can_occur_def by auto\n then obtain m' xs where mci: \"msgs c i = m' # xs\"\n by (metis list.size(3) nat_less_le neq_Nil_conv)\n then have m_mark: \"Marker = m'\"\n proof (cases m', auto)\n case (Msg msg)\n then have \"msgs c i = Msg msg # xs\" by (simp add:mci)\n then have \"~ can_occur ev' c\" using RecvMarker can_occur_def by simp\n then show False using assms(3) by simp\n qed\n then show ?thesis by (simp add: mci)\n qed\n show ?thesis\n proof (rule ccontr)\n assume asm: \"~ can_occur ev' c'\"\n then have \"msgs c' i = [] \\ hd (msgs c' i) \\ Marker\"\n using RecvMarker assms(3) can_occur_def list.case_eq_if by fastforce\n then have \"\\p q. ev = RecvMarker i p q \\ Marker = Marker\" using message_must_be_delivered msgs_ci assms by blast\n then obtain r s where RecvMarker_ev: \"ev = RecvMarker i r s\" by blast\n then have \"p = r \\ q = s\" \n using RecvMarker assms(1) assms(3) can_occur_def by auto\n then have \"occurs_on ev = p\" using assms RecvMarker_ev by auto\n then show False using assms using RecvMarker by auto\n qed\nnext\n case (Snapshot p)\n then have \"~ has_snapshotted c p\" using assms assms(3) can_occur_def by simp\n show ?thesis\n proof (rule ccontr)\n assume asm: \"~ can_occur ev' c'\"\n then have \"has_snapshotted c' p\" using can_occur_def Snapshot by simp\n then have \"occurs_on ev = p\"\n using \\\\ has_snapshotted c p\\ assms(1) no_state_change_if_no_event by fastforce\n then show False using assms(2) Snapshot by auto\n qed\nqed\n\nlemma msgs_unchanged_for_other_is:\n assumes\n \"c \\ ev \\ c'\" and\n \"regular_event ev\" and\n \"getId ev = i\" and\n \"i' \\ i\"\n shows\n \"msgs c i' = msgs c' i'\"\nproof -\n have \"isTrans ev \\ isSend ev \\ isRecv ev\" using assms by simp\n then show ?thesis\n proof (elim disjE, goal_cases)\n case 1\n then obtain p s s' where \"ev = Trans p s s'\" by (meson isTrans_def)\n then show ?thesis using assms by simp\n next\n case 2\n then obtain i' p q s s' m where \"ev = Send i' p q s s' m\" by (meson isSend_def)\n then show ?thesis using assms by simp\n next\n case 3\n then obtain i' p q s s' m where \"ev = Recv i' p q s s' m\" by (meson isRecv_def)\n with assms show ?thesis by auto\n qed\nqed\n\nlemma msgs_unchanged_if_snapshotted_RecvMarker_for_other_is:\n assumes\n \"c \\ ev \\ c'\" and\n \"ev = RecvMarker i p q\" and\n \"has_snapshotted c p\" and\n \"i' \\ i\"\n shows\n \"msgs c i' = msgs c' i'\"\n using assms by auto\n\nlemma event_can_go_back_if_no_sender:\n assumes\n \"c \\ ev \\ c'\" and\n \"occurs_on ev \\ occurs_on ev'\" and\n \"can_occur ev' c'\" and\n \"~ isRecvMarker ev'\" and\n \"~ isSend ev\"\n shows\n \"can_occur ev' c\"\nproof (cases ev')\n case (Snapshot p)\n then have \"~ has_snapshotted c' p\" using assms(3) can_occur_def by simp\n then have \"~ has_snapshotted c p\" using assms(1) snapshot_state_unchanged by force\n then show ?thesis using can_occur_def Snapshot by simp\nnext\n case (RecvMarker i p q)\n then show ?thesis using assms(4) by auto\nnext\n case (Trans p s s')\n then show ?thesis\n using assms(1) assms(2) can_occur_def no_state_change_if_no_event assms(3) by auto\nnext\n case (Send p q s s' m)\n then show ?thesis\n using assms(1) assms(2) can_occur_def no_state_change_if_no_event assms(3) by auto\nnext\n case (Recv i p q s s' m)\n have \"msgs c' i \\ Nil\" using Recv can_occur_def assms by auto\n moreover have \"hd (msgs c' i) = Msg m \\ length (msgs c' i) > 0\"\n proof -\n from Recv have \"length (msgs c' i) > 0\" using assms(3) can_occur_def by auto\n then obtain m' xs where mcqp: \"msgs c' i = m' # xs\"\n by (metis list.size(3) nat_less_le neq_Nil_conv)\n then have \"Msg m = m'\"\n proof (cases m', auto)\n case Marker\n then have \"msgs c' i = Marker # xs\" by (simp add:mcqp)\n then have \"~ can_occur ev' c'\" using Recv can_occur_def by simp\n then show False using assms(3) by simp\n next\n case (Msg msg)\n then have \"msgs c' i = Msg msg # xs\" by (simp add: mcqp)\n then show \"m = msg\" using Recv can_occur_def assms(3) by simp\n qed\n then show ?thesis by (simp add: mcqp)\n qed\n moreover have \"msgs c i \\ Nil \\ hd (msgs c' i) = hd (msgs c i)\"\n proof (cases ev)\n case (Snapshot p')\n then have \"p' \\ p\" using assms Recv by simp\n have chan: \"channel i = Some (q, p)\" \n by (metis Recv assms(3) distributed_system.can_occur_Recv distributed_system_axioms)\n with Snapshot assms have \"length (msgs c i) > 0 \\ hd (msgs c i) = hd (msgs c' i)\"\n proof (cases \"q = p'\")\n case True\n then have \"msgs c' i = msgs c i @ [Marker]\" using Snapshot chan assms by simp\n then show ?thesis \n by (metis append_self_conv2 calculation(2) hd_append2 length_greater_0_conv list.sel(1) message.simps(3))\n next\n case False\n then have \"msgs c' i = msgs c i\" using Snapshot chan assms by simp\n then show ?thesis using calculation by simp\n qed\n then show ?thesis by simp\n next\n case (RecvMarker i' p' q')\n then have \"i' \\ i\" \n using Recv assms(1) assms(2) assms(3) can_occur_def by force\n then show ?thesis\n proof (cases \"has_snapshotted c p'\")\n case True\n then have \"msgs c i = msgs c' i\" using \\i' \\ i\\ RecvMarker assms by simp\n then show ?thesis using calculation by simp\n next\n case no_snap: False\n then have chan: \"channel i = Some (q, p)\" \n by (metis Recv assms(3) distributed_system.can_occur_Recv distributed_system_axioms)\n then show ?thesis\n proof (cases \"q = p'\")\n case True\n then have \"msgs c' i = msgs c i @ [Marker]\" \n using no_snap RecvMarker \\i' \\ i\\ assms(1) chan by auto\n then show ?thesis \n by (metis append_self_conv2 calculation(2) hd_append2 list.sel(1) message.simps(3))\n next\n case False\n then have \"msgs c' i = msgs c i\" using RecvMarker no_snap False chan assms \\i' \\ i\\ by simp\n then show ?thesis using calculation by simp\n qed\n qed\n next\n case (Trans p' s'' s''')\n then show ?thesis using assms(1) \\msgs c' i \\ Nil\\ by auto\n next\n case (Send i' p' q' s'' s''' m'')\n have \"p' \\ p\"\n using Recv Send assms(2) by auto\n then show ?thesis \n using Recv Send assms(1) assms(5) calculation(1) by auto\n next\n case (Recv i' p' q' s'' s''' m'')\n then have \"i' \\ i\" using assms \\ev' = Recv i p q s s' m\\ \n by (metis distributed_system.can_occur_Recv distributed_system_axioms event.sel(3) next_recv option.inject prod.inject)\n have \"msgs c i = msgs c' i\" using msgs_unchanged_for_other_is Recv \\i' \\ i\\ assms(1) by auto\n then show ?thesis using \\msgs c' i \\ Nil\\ by simp\n qed\n moreover have \"states c p = states c' p\" using no_state_change_if_no_event assms Recv by simp\n ultimately show ?thesis\n using Recv assms(3) can_occur_def list.case_eq_if by fastforce\nqed\n\nlemma nonregular_event_can_go_back_if_in_distinct_processes:\n assumes\n \"c \\ ev \\ c'\" and\n \"regular_event ev\" and\n \"~ regular_event ev'\" and\n \"can_occur ev' c'\" and\n \"occurs_on ev \\ occurs_on ev'\"\n shows\n \"can_occur ev' c\"\nproof -\n let ?p = \"occurs_on ev\"\n let ?q = \"occurs_on ev'\"\n have \"isTrans ev \\ isSend ev \\ isRecv ev\" using assms by simp\n moreover have \"isSnapshot ev' \\ isRecvMarker ev'\" using assms nonregular_event by auto\n ultimately show ?thesis\n proof (elim disjE, goal_cases)\n case 1\n then show ?case \n using assms(1) assms(4) assms(5) event_can_go_back_if_no_sender by blast\n next\n case 2\n then obtain s s' where Trans: \"ev = Trans ?p s s'\"\n by (metis event.collapse(1))\n obtain i r where RecvMarker: \"ev' = RecvMarker i ?q r\"\n using 2 by (metis event.collapse(5))\n have \"msgs c i = msgs c' i\" \n using \"2\"(1) assms(1) assms(2) no_msg_change_if_no_event by blast\n moreover have \"can_occur ev' c'\" using assms by simp\n ultimately show ?thesis using can_occur_def RecvMarker \n by (metis (mono_tags, lifting) \"2\"(2) event.case_eq_if event.distinct_disc(13) event.distinct_disc(17) event.distinct_disc(19) event.distinct_disc(7) event.sel(10))\n next\n case 3\n then have \"ev' = Snapshot ?q\"\n by (metis event.collapse(4))\n have \"~ has_snapshotted c' ?q\" \n by (metis (mono_tags, lifting) \"3\"(1) assms(4) can_occur_def event.case_eq_if event.distinct_disc(11) event.distinct_disc(16) event.distinct_disc(6))\n then have \"~ has_snapshotted c ?q\" \n using assms(1) assms(2) regular_event_preserves_process_snapshots by auto\n then show ?case unfolding can_occur_def using \\ev' = Snapshot ?q\\ \n by (metis (mono_tags, lifting) event.simps(29))\n next\n case 4\n then have \"ev' = Snapshot ?q\"\n by (metis event.collapse(4))\n have \"~ has_snapshotted c' ?q\"\n by (metis (mono_tags, lifting) \\ev' = Snapshot (occurs_on ev')\\ assms(4) can_occur_def event.simps(29))\n then have \"~ has_snapshotted c ?q\"\n using assms(1) assms(2) regular_event_preserves_process_snapshots by auto\n then show ?case unfolding can_occur_def \n by (metis (mono_tags, lifting) \\ev' = Snapshot (occurs_on ev')\\ event.simps(29))\n next\n case 5\n then obtain i s u u' m where \"ev = Send i ?p s u u' m\"\n by (metis event.collapse(2))\n from 5 obtain i' r where \"ev' = RecvMarker i' ?q r\"\n by (metis event.collapse(5))\n then have pre: \"hd (msgs c' i') = Marker \\ length (msgs c' i') > 0\" \n by (metis (mono_tags, lifting) assms(4) can_occur_def event.simps(30))\n have \"hd (msgs c i') = Marker \\ length (msgs c i') > 0\"\n proof (cases \"i' = i\")\n case False\n then have \"msgs c i' = msgs c' i'\" \n by (metis \\ev = Send i (occurs_on ev) s u u' m\\ assms(1) assms(2) event.sel(8) msgs_unchanged_for_other_is)\n then show ?thesis using pre by auto\n next\n case True\n then have \"msgs c' i' = msgs c i' @ [Msg m]\" \n by (metis \\ev = Send i (occurs_on ev) s u u' m\\ assms(1) next_send)\n then have \"length (msgs c' i') > 1\" \n using pre by fastforce\n then have \"length (msgs c i') > 0\" \n by (simp add: \\msgs c' i' = msgs c i' @ [Msg m]\\)\n then show ?thesis \n using \\msgs c' i' = msgs c i' @ [Msg m]\\ pre by auto\n qed\n then show ?case unfolding can_occur_def using \\ev' = RecvMarker i' ?q r\\ \n by (metis (mono_tags, lifting) assms(4) can_occur_def event.simps(30))\n next\n case 6\n then obtain i s u u' m where \"ev = Recv i ?p s u u' m\"\n by (metis event.collapse(3))\n from 6 obtain i' r where \"ev' = RecvMarker i' ?q r\"\n by (metis event.collapse(5))\n then have \"i' \\ i\"\n proof -\n have \"?p \\ ?q\" using assms by simp\n moreover have \"channel i = Some (s, ?p)\" \n by (metis \\ev = Recv i (occurs_on ev) s u u' m\\ assms(1) distributed_system.can_occur_Recv distributed_system_axioms happen_implies_can_occur)\n moreover have \"channel i' = Some (r, ?q)\"\n by (metis (mono_tags, lifting) \\ev' = RecvMarker i' (occurs_on ev') r\\ assms(4) can_occur_def event.case_eq_if event.disc(5,10,15,20) event.sel(5,10,13))\n ultimately show ?thesis by auto\n qed\n then show ?case\n by (metis (mono_tags, lifting) \"6\"(1) \\ev = Recv i (occurs_on ev) s u u' m\\ \\ev' = RecvMarker i' (occurs_on ev') r\\ assms(1) assms(4) can_occur_def event.case_eq_if event.distinct_disc(13) event.distinct_disc(17) event.distinct_disc(7) event.sel(10) next_recv)\n qed\nqed\n\nlemma same_state_implies_same_result_state:\n assumes\n \"states c p = states d p\"\n \"c \\ ev \\ c'\" and\n \"d \\ ev \\ d'\"\n shows\n \"states d' p = states c' p\"\nproof (cases \"occurs_on ev = p\")\n case False\n then show ?thesis \n by (metis assms(1-3) distributed_system.no_state_change_if_no_event distributed_system_axioms)\nnext\n case True\n then show ?thesis\n using assms by (cases ev, auto)\nqed\n\nlemma same_snapshot_state_implies_same_result_snapshot_state:\n assumes\n \"ps c p = ps d p\" and\n \"states c p = states d p\" and\n \"c \\ ev \\ c'\" and\n \"d \\ ev \\ d'\"\n shows\n \"ps d' p = ps c' p\"\nproof (cases \"occurs_on ev = p\")\n case False\n then show ?thesis\n using assms no_state_change_if_no_event by auto\nnext\n case True\n then show ?thesis\n proof (cases ev)\n case (Snapshot q)\n then have \"p = q\" using True by auto\n then show ?thesis \n using Snapshot assms(2) assms(3) assms(4) by auto\n next\n case (RecvMarker i q r)\n then have \"p = q\" using True by auto\n then show ?thesis \n proof -\n have f1: \"\\c ca. \\ c \\ ev \\ ca \\ ps c p = None \\ ps c p = ps ca p\"\n using RecvMarker \\p = q\\ by force\n have \"\\c ca. ps c p \\ None \\ \\ c \\ ev \\ ca \\ ps ca p = Some (states c p)\"\n using RecvMarker \\p = q\\ by force\n then show ?thesis\n using f1 by (metis (no_types) assms(1) assms(2) assms(3) assms(4))\n qed\n next\n case (Trans q s s')\n then have \"p = q\" \n using True by auto\n then show ?thesis \n using Trans assms(1) assms(3) assms(4) by auto\n next\n case (Send i q r u u' m)\n then have \"p = q\" using True by auto\n then show ?thesis \n using Send assms(1) assms(3) assms(4) by auto\n next\n case (Recv i q r u u' m)\n then have \"p = q\" using True by auto\n then show ?thesis \n using Recv assms(1) assms(3) assms(4) by auto\n qed\nqed\n\nlemma same_messages_imply_same_resulting_messages:\n assumes\n \"msgs c i = msgs d i\"\n \"c \\ ev \\ c'\" and\n \"d \\ ev \\ d'\" and\n \"regular_event ev\"\n shows\n \"msgs c' i = msgs d' i\"\nproof -\n have \"isTrans ev \\ isSend ev \\ isRecv ev\" using assms \n by simp\n then show ?thesis\n proof (elim disjE)\n assume \"isTrans ev\"\n then show ?thesis \n by (metis assms(1) assms(2) assms(3) isTrans_def next_trans)\n next\n assume \"isSend ev\"\n then obtain i' r s u u' m where \"ev = Send i' r s u u' m\"\n by (metis event.collapse(2))\n with assms show ?thesis by (cases \"i = i'\", auto)\n next\n assume \"isRecv ev\"\n then obtain i' r s u u' m where Recv: \"ev = Recv i' r s u u' m\"\n by (metis event.collapse(3))\n with assms show ?thesis by (cases \"i = i'\", auto)\n qed\nqed\n\nlemma Trans_msg:\n assumes\n \"c \\ ev \\ c'\" and\n \"isTrans ev\"\n shows\n \"msgs c i = msgs c' i\"\n using assms(1) assms(2) no_msg_change_if_no_event regular_event by blast\n\nlemma new_msg_in_set_implies_occurrence:\n assumes\n \"c \\ ev \\ c'\" and\n \"m \\ set (msgs c i)\" and\n \"m \\ set (msgs c' i)\" and\n \"channel i = Some (p, q)\"\n shows\n \"occurs_on ev = p\" (is ?P)\nproof (rule ccontr)\n assume \"~ ?P\"\n have \"set (msgs c' i) \\ set (msgs c i)\" \n proof (cases ev)\n case (Snapshot r)\n then have \"msgs c' i = msgs c i\" using \\~ ?P\\ assms by simp\n then show ?thesis by auto\n next\n case (RecvMarker i' r s)\n then show ?thesis\n proof (cases \"has_snapshotted c r\")\n case True\n then show ?thesis\n proof (cases \"i' = i\")\n case True\n then have \"Marker # msgs c' i = msgs c i\" using RecvMarker True assms by simp\n then show ?thesis \n by (metis set_subset_Cons)\n next\n case False\n then show ?thesis using RecvMarker True assms by simp\n qed\n next\n case no_snap: False\n have chan: \"channel i' = Some (s, r)\" \n using RecvMarker assms(1) can_occur_def by auto\n then show ?thesis\n proof (cases \"i' = i\")\n case True\n then have \"Marker # msgs c' i = msgs c i\" using RecvMarker assms by simp\n then show ?thesis by (metis set_subset_Cons)\n next\n case False\n then have \"msgs c' i = msgs c i\" using \\~ ?P\\ RecvMarker assms no_snap by simp\n then show ?thesis by simp\n qed\n qed\n next\n case (Trans r u u')\n then show ?thesis using assms \\~ ?P\\ by simp\n next\n case (Send i' r s u u' m')\n then have \"i' \\ i\" using \\~ ?P\\ can_occur_def assms by auto\n then have \"msgs c i = msgs c' i\" using \\~ ?P\\ assms Send by simp\n then show ?thesis by simp\n next\n case (Recv i' r s u u' m')\n then show ?thesis \n by (metis (no_types, lifting) assms(1) eq_iff local.next.simps(5) set_subset_Cons)\n qed\n moreover have \"~ set (msgs c' i) \\ set (msgs c i)\" using assms by blast\n ultimately show False by simp\nqed\n\nlemma new_Marker_in_set_implies_nonregular_occurence:\n assumes\n \"c \\ ev \\ c'\" and\n \"Marker \\ set (msgs c i)\" and\n \"Marker \\ set (msgs c' i)\" and\n \"channel i = Some (p, q)\"\n shows\n \"~ regular_event ev\" (is ?P)\nproof (rule ccontr)\n have \"occurs_on ev = p\" \n using assms new_msg_in_set_implies_occurrence by blast\n assume \"~ ?P\"\n then have \"isTrans ev \\ isSend ev \\ isRecv ev\" by simp\n then have \"Marker \\ set (msgs c' i)\"\n proof (elim disjE, goal_cases)\n case 1\n then obtain r u u' where \"ev = Trans r u u'\"\n by (metis event.collapse(1))\n then show ?thesis \n using assms(1) assms(2) by auto\n next\n case 2\n then obtain i' r q u u' m where \"ev = Send i' r q u u' m\"\n by (metis event.collapse(2))\n then show ?thesis \n by (metis (no_types, lifting) Un_iff assms(1) assms(2) empty_iff empty_set insert_iff list.set(2) message.distinct(1) next_send set_append)\n next\n case 3\n then obtain i' r q u u' m where \"ev = Recv i' r q u u' m\"\n by (metis event.collapse(3))\n then show ?thesis \n by (metis assms(1) assms(2) list.set_intros(2) next_recv)\n qed\n then show False using assms by simp\nqed\n\nlemma RecvMarker_implies_Marker_in_set:\n assumes\n \"c \\ ev \\ c'\" and\n \"ev = RecvMarker cid p q\"\n shows\n \"Marker \\ set (msgs c cid)\"\n by (metis (mono_tags, lifting) assms(1) assms(2) can_occur_def distributed_system.happen_implies_can_occur distributed_system_axioms event.simps(30) list.set_sel(1) list.size(3) nat_less_le)\n\nlemma RecvMarker_given_channel:\n assumes\n \"isRecvMarker ev\" and\n \"getId ev = cid\" and\n \"channel cid = Some (p, q)\" and\n \"can_occur ev c\"\n shows\n \"ev = RecvMarker cid q p\"\n by (metis (mono_tags, lifting) assms(1) assms(2) assms(3) assms(4) can_occur_def event.case_eq_if event.collapse(5) event.distinct_disc(8,14,18,20) option.inject prod.inject)\n\nlemma Recv_given_channel:\n assumes\n \"isRecv ev\" and\n \"getId ev = cid\" and\n \"channel cid = Some (p, q)\" and\n \"can_occur ev c\"\n shows\n \"\\s s' m. ev = Recv cid q p s s' m\"\n by (metis assms(1) assms(2) assms(3) assms(4) distributed_system.can_occur_Recv distributed_system_axioms event.collapse(3) option.inject prod.inject)\n\nlemma same_cs_if_not_recv:\n assumes\n \"c \\ ev \\ c'\" and\n \"~ isRecv ev\"\n shows\n \"fst (cs c cid) = fst (cs c' cid)\"\nproof (cases \"channel cid = None\")\n case True\n then show ?thesis \n using assms(1) no_cs_change_if_no_channel by auto\nnext\n case False\n then obtain p q where chan: \"channel cid = Some (p, q)\" by auto\n then show ?thesis\n proof (cases ev)\n case (Snapshot r)\n with Snapshot assms chan show ?thesis by (cases \"r = q\", auto)\n next\n case (RecvMarker cid' r s)\n then show ?thesis\n proof (cases \"has_snapshotted c r\")\n case True\n with assms RecvMarker chan show ?thesis by (cases \"cid' = cid\", auto)\n next\n case no_snap: False\n then show ?thesis\n proof (cases \"cid' = cid\")\n case True\n then show ?thesis using RecvMarker assms chan by auto\n next\n case False\n with assms RecvMarker chan no_snap show ?thesis by (cases \"r = q\", auto)\n qed\n qed\n next\n case (Trans r u u')\n then show ?thesis using assms by auto\n next\n case (Send r s u u')\n then show ?thesis using assms by auto\n qed (metis assms(2) isRecv_def)\nqed\n\nlemma done_only_from_recv_marker:\n assumes\n \"c \\ ev \\ c'\" and\n \"channel cid = Some (p, q)\" and\n \"snd (cs c cid) \\ Done\" and\n \"snd (cs c' cid) = Done\"\n shows\n \"ev = RecvMarker cid q p\"\nproof (rule ccontr)\n assume \"~ ev = RecvMarker cid q p\"\n then show False\n proof (cases \"isRecvMarker ev\")\n case True\n then obtain cid' s r where RecvMarker: \"ev = RecvMarker cid' s r\" by (meson isRecvMarker_def)\n have \"cid \\ cid'\"\n proof (rule ccontr)\n assume \"~ cid \\ cid'\"\n then show False\n using \\ev = RecvMarker cid' s r\\ \\ev \\ RecvMarker cid q p\\ assms(1) assms(2) can_occur_def by auto\n qed\n then have \"snd (cs c' cid) \\ Done\"\n proof (cases \"has_snapshotted c s\")\n case True\n then show ?thesis using RecvMarker assms \\cid \\ cid'\\ by simp\n next\n case False\n with RecvMarker assms \\cid \\ cid'\\ show ?thesis by (cases \"s = q\", auto)\n qed\n then show False using assms by auto\n next\n case False\n then have \"isSnapshot ev \\ isTrans ev \\ isSend ev \\ isRecv ev\"\n using event.exhaust_disc by blast\n then have \"snd (cs c' cid) \\ Done\"\n proof (elim disjE, goal_cases)\n case 1\n then obtain r where Snapshot: \"ev = Snapshot r\"\n by (meson isSnapshot_def)\n with assms show ?thesis by (cases \"q = r\", auto)\n next\n case 2\n then obtain r u u' where \"ev = Trans r u u'\"\n by (meson isTrans_def)\n then show ?case using assms by auto\n next\n case 3\n then obtain cid' r s u u' m where \"ev = Send cid' r s u u' m\"\n by (meson isSend_def)\n then show ?thesis using assms by auto\n next\n case 4\n then obtain cid' r s u u' m where Recv: \"ev = Recv cid' r s u u' m\"\n by (meson isRecv_def)\n show ?thesis\n using Recv assms proof (cases \"cid = cid'\")\n case True\n then have \"snd (cs c cid) = NotStarted \\ snd (cs c cid) = Recording\"\n using assms(3) recording_state.exhaust by blast\n then show ?thesis\n proof (elim disjE, goal_cases)\n case 1\n then have \"snd (cs c' cid') = NotStarted\" \n using True Recv assms(1) by auto\n then show ?case using True by auto\n next\n case 2\n then have \"snd (cs c' cid') = Recording\"\n using True Recv assms(1) by auto\n then show ?case using True by auto\n qed\n qed auto\n qed\n then show False using assms by auto\n qed\nqed\n\nlemma cs_not_not_started_stable:\n assumes\n \"c \\ ev \\ c'\" and\n \"snd (cs c cid) \\ NotStarted\" and\n \"channel cid = Some (p, q)\"\n shows\n \"snd (cs c' cid) \\ NotStarted\"\nusing assms proof (cases ev)\n case (Snapshot r)\n then show ?thesis \n by (metis assms(1) assms(2) next_snapshot recording_state.simps(2) sndI)\nnext\n case (RecvMarker cid' r s)\n then show ?thesis\n proof (cases \"has_snapshotted c r\")\n case True\n with RecvMarker assms show ?thesis by (cases \"cid = cid'\", auto)\n next\n case no_snap: False\n then show ?thesis\n proof (cases \"cid = cid'\")\n case True\n then show ?thesis using RecvMarker assms by auto\n next\n case False\n with RecvMarker assms no_snap show ?thesis by (cases \"s = p\", auto)\n qed\n qed\nnext\n case (Recv cid' r s u u' m)\n then have \"snd (cs c cid) = Recording \\ snd (cs c cid) = Done\" \n using assms(2) recording_state.exhaust by blast\n then show ?thesis\n proof (elim disjE, goal_cases)\n case 1\n then show ?thesis \n by (metis (no_types, lifting) Recv assms(1) eq_snd_iff next_recv recording_state.distinct(1))\n next\n case 2\n with Recv assms show ?thesis by (cases \"cid = cid'\", auto)\n qed\nqed auto\n\nlemma fst_cs_changed_by_recv_recording:\n assumes\n step: \"c \\ ev \\ c'\" and\n \"fst (cs c cid) \\ fst (cs c' cid)\" and\n \"channel cid = Some (p, q)\"\n shows\n \"snd (cs c cid) = Recording \\ (\\p q u u' m. ev = Recv cid q p u u' m)\"\nproof -\n have oc_on: \"occurs_on ev = q\" \n proof -\n obtain nn :: \"('p, 's, 'm) event \\ nat\" and aa :: \"('p, 's, 'm) event \\ 'p\" and aaa :: \"('p, 's, 'm) event \\ 'p\" and bb :: \"('p, 's, 'm) event \\ 's\" and bba :: \"('p, 's, 'm) event \\ 's\" and cc :: \"('p, 's, 'm) event \\ 'm\" where\n f1: \"\\e. (\\ isRecv e \\ e = Recv (nn e) (aa e) (aaa e) (bb e) (bba e) (cc e)) \\ (isRecv e \\ (\\n a aa b ba c. e \\ Recv n a aa b ba c))\"\n using isRecv_def by moura\n then have f2: \"c \\ Recv (nn ev) (aa ev) (aaa ev) (bb ev) (bba ev) (cc ev) \\ c'\"\n by (metis (no_types) assms(2) local.step same_cs_if_not_recv)\n have f3: \"\\x0 x1 x7 x8. (x0 \\ x7 \\ cs (x8::('p, 's, 'm) configuration) x0 = cs (x1::('p, 's, _) configuration) x0) = (x0 = x7 \\ cs x8 x0 = cs x1 x0)\"\n by auto\n have f4: \"\\x0 x1 x7 x8. (x7 \\ x0 \\ msgs (x1::('p, 's, 'm) configuration) x0 = msgs (x8::('p, 's, _) configuration) x0) = (x7 = x0 \\ msgs x1 x0 = msgs x8 x0)\"\n by auto\n have \"\\x0 x1 x6 x8. (x0 \\ x6 \\ states (x1::('p, 's, 'm) configuration) x0 = states (x8::(_, _, 'm) configuration) x0) = (x0 = x6 \\ states x1 x0 = states x8 x0)\"\n by fastforce\n then have \"can_occur (Recv (nn ev) (aa ev) (aaa ev) (bb ev) (bba ev) (cc ev)) c \\ states c (aa ev) = bb ev \\ states c' (aa ev) = bba ev \\ (\\a. a = aa ev \\ states c' a = states c a) \\ msgs c (nn ev) = Msg (cc ev) # msgs c' (nn ev) \\ (\\n. nn ev = n \\ msgs c' n = msgs c n) \\ (\\a. ps c a = ps c' a) \\ (\\n. n = nn ev \\ cs c n = cs c' n) \\ (if snd (cs c (nn ev)) = Recording then cs c' (nn ev) = (fst (cs c (nn ev)) @ [cc ev], Recording) else cs c (nn ev) = cs c' (nn ev))\"\n using f4 f3 f2 by force\n then show ?thesis\n using f1 by (metis (no_types) Pair_inject assms(2) assms(3) can_occur_Recv event.sel(3) local.step option.sel same_cs_if_not_recv)\nqed\n have \"isRecv ev\" (is ?P)\n proof (rule ccontr)\n assume \"~ ?P\"\n then have \"fst (cs c cid) = fst (cs c' cid)\" by (metis local.step same_cs_if_not_recv)\n then show False using assms by simp\n qed\n then obtain cid' r s u u' m where Recv: \"ev = Recv cid' r s u u' m\" by (meson isRecv_def)\n have \"cid = cid'\"\n proof (rule ccontr)\n assume \"~ cid = cid'\"\n then have \"fst (cs c cid) = fst (cs c' cid)\" using Recv step by auto\n then show False using assms by simp\n qed\n moreover have \"snd (cs c cid) = Recording\"\n proof (rule ccontr)\n assume \"~ snd (cs c cid) = Recording\"\n then have \"fst (cs c cid) = fst (cs c' cid)\" using Recv step \\cid = cid'\\ by auto\n then show False using assms by simp\n qed\n ultimately show ?thesis using Recv by simp\nqed\n\nlemma no_marker_and_snapshotted_implies_no_more_markers:\n assumes\n \"c \\ ev \\ c'\" and\n \"has_snapshotted c p\" and\n \"Marker \\ set (msgs c cid)\" and\n \"channel cid = Some (p, q)\"\n shows\n \"Marker \\ set (msgs c' cid)\"\nproof (cases ev)\n case (Snapshot r)\n then have \"r \\ p\" \n using assms(1) assms(2) can_occur_def by auto\n then have \"msgs c cid = msgs c' cid\" using assms Snapshot by simp\n then show ?thesis using assms by simp\nnext\n case (RecvMarker cid' r s)\n have \"cid \\ cid'\"\n proof (rule ccontr)\n assume \"~ cid \\ cid'\"\n moreover have \"can_occur ev c\" using happen_implies_can_occur assms by blast\n ultimately have \"Marker : set (msgs c cid)\" using can_occur_def RecvMarker \n by (metis (mono_tags, lifting) assms(1) event.simps(30) hd_in_set list.size(3) recv_marker_other_channels_not_shrinking zero_order(1))\n then show False using assms by simp\n qed\n then have \"msgs c cid = msgs c' cid\"\n proof (cases \"r = p\")\n case True\n then show ?thesis \n using RecvMarker \\cid \\ cid'\\ assms(1) assms(2) msgs_unchanged_if_snapshotted_RecvMarker_for_other_is by blast\n next\n case False\n with RecvMarker \\cid \\ cid'\\ step assms show ?thesis by (cases \"has_snapshotted c r\", auto)\n qed\n then show ?thesis using assms by simp\nnext\n case (Trans r u u')\n then show ?thesis using assms by auto\nnext\n case (Send cid' r s u u' m)\n with assms Send show ?thesis by (cases \"cid = cid'\", auto)\nnext\n case (Recv cid' r s u u' m)\n with assms Recv show ?thesis by (cases \"cid = cid'\", auto)\nqed\n\nlemma same_messages_if_no_occurrence:\n assumes\n \"c \\ ev \\ c'\" and\n \"~ occurs_on ev = p\" and\n \"~ occurs_on ev = q\" and\n \"channel cid = Some (p, q)\"\n shows\n \"msgs c cid = msgs c' cid \\ cs c cid = cs c' cid\"\nproof (cases ev)\n case (Snapshot r)\n then show ?thesis using assms by auto\nnext\n case (RecvMarker cid' r s)\n have \"cid \\ cid'\"\n by (metis RecvMarker_given_channel assms(1) assms(3) assms(4) RecvMarker event.sel(5,10) happen_implies_can_occur isRecvMarker_def)\n have \"\\a. channel cid = Some (r, q)\" \n using assms(2) assms(4) RecvMarker by auto\n with RecvMarker assms \\cid \\ cid'\\ show ?thesis by (cases \"has_snapshotted c r\", auto)\nnext\n case (Trans r u u')\n then show ?thesis using assms by auto\nnext\n case (Send cid' r s u u' m)\n then have \"cid \\ cid'\" \n by (metis (mono_tags, lifting) Pair_inject assms(1) assms(2) assms(4) can_occur_def event.sel(2) event.simps(27) happen_implies_can_occur option.inject)\n then show ?thesis using assms Send by simp\nnext\n case (Recv cid' r s u u' m)\n then have \"cid \\ cid'\" \n by (metis assms(1) assms(3) assms(4) distributed_system.can_occur_Recv distributed_system.happen_implies_can_occur distributed_system_axioms event.sel(3) option.inject prod.inject)\n then show ?thesis using assms Recv by simp\nqed\n\nend (* locale distributed_system *)\n\nend (* theory Distributed_System *)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Chandy_Lamport/Distributed_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2819813976805361}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | August 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2009-2 |\n | October 2010 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | CSP-Prover on Isabelle2018 |\n | February 2019 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Domain_F_cms\nimports Domain_F CSP_T.Domain_T_cms Set_F_cms \n CSP.RS_pair CSP.RS_prod\nbegin\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*********************************************************\n Restriction in Dom_F\n *********************************************************)\n\n(*\ninstance domF :: (type) ms0\nby (intro_classes)\n*)\n\ndefinition\n restTF :: \"'a domF => nat => 'a domTsetF\" (\"_ restTF _\" [84,900] 84)\n where\n restTF_def : \n \"F restTF n == (Rep_domF F) .|. n\"\n \ndefinition\n LimitTF :: \"'a domF infinite_seq => 'a domTsetF\"\n where\n LimitTF_def : \n \"LimitTF Fs == pair_Limit (Rep_domF o Fs)\"\n \ndefinition \n Limit_domF :: \"'a domF infinite_seq => 'a domF\"\n where\n Limit_domF_def :\n \"Limit_domF Fs == Abs_domF (LimitTF Fs)\"\n\n(* isabelle 2009-2 *)\n\ninstantiation domF :: (type) rs0\nbegin\n\ndefinition\n rest_domF_def : \"F .|. n == Abs_domF (F restTF n)\"\n instance ..\nend\n\n(*\ndefs (overloaded)\n rest_domF_def : \"F .|. n == Abs_domF (F restTF n)\"\n*)\n\n(*********************************************************\n Lemmas (Restriction in Dom_F)\n *********************************************************)\n\n(*** restTF (T2) ***)\n\nlemma restTF_T2: \"HC_T2 (F restTF n)\"\napply (simp add: HC_T2_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\nby (auto simp add: domTsetF_T2)\n\n(*** restTF (F3) ***)\n\nlemma restTF_F3: \"HC_F3 (F restTF n)\"\napply (simp add: HC_F3_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\nby (auto simp add: domTsetF_F3)\n\n(*** restTF (T3_F4) ***)\n\nlemma restTF_T3_F4: \"HC_T3_F4 (F restTF n)\"\napply (simp add: HC_T3_F4_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\napply (elim conjE)\nby (auto simp add: domTsetF_T3 domTsetF_F4)\n\n(*** restTF in domF ***)\n\nlemma restTF_in[simp]: \"F restTF n : domF\"\napply (simp add: domF_iff)\napply (simp add: restTF_T2)\napply (simp add: restTF_F3)\napply (simp add: restTF_T3_F4)\ndone\n\n(*********************************************************\n Dom_F --> RS\n *********************************************************)\n\n(*** rest_domF --> restTF ***)\n\nlemma Rep_rest_domF: \n \"((F::'a domF) .|. n = E .|. m) =\n ((Rep_domF F) .|. n = (Rep_domF E) .|. m)\"\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inject)\napply (simp add: restTF_def)\ndone\n\n(*** zero_eq_rs_domF ***)\n\nlemma zero_eq_rs_domF: \"(F::'a domF) .|. 0 = E .|. 0\"\nby (simp add: Rep_rest_domF)\n\n(*** min_rs_domF ***)\n\nlemma min_rs_domF:\n \"((F::'a domF) .|. m) .|. n = F .|. (min m n)\"\napply (simp add: Rep_rest_domF)\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: min_rs)\ndone\n\n(*** diff_rs_domF ***)\n\nlemma diff_rs_domF: \n \"(F::'a domF) ~= E ==> (EX (n::nat). F .|. n ~= E .|. n)\"\napply (simp add: Rep_rest_domF)\napply (simp add: Rep_domF_inject[THEN sym])\napply (simp add: diff_rs)\ndone\n\n(***************************************************************\n domF ==> RS\n ***************************************************************)\n\ninstance domF :: (type) rs\napply (intro_classes)\napply (simp add: zero_eq_rs_domF)\napply (simp add: min_rs_domF)\napply (simp add: diff_rs_domF)\ndone\n\n(************************************************************\n domF ==> MS\n ************************************************************)\n\ninstantiation domF :: (type) ms0\nbegin\n\ndefinition\n domF_distance_def:\n \"distance (FF::('a domF * 'a domF)) = distance_rs FF\"\n instance ..\nend\n\ninstance domF :: (type) ms\napply (intro_classes)\napply (simp_all add: domF_distance_def)\napply (simp add: diagonal_rs)\napply (simp add: symmetry_rs)\napply (simp add: triangle_inequality_rs)\ndone\n\n(************************************************************\n i.e. domF ==> MS & RS \n ************************************************************)\n\ninstance domF :: (type) ms_rs\napply (intro_classes)\napply (simp add: domF_distance_def)\ndone\n\n\n(********************************************************** \n .|. decompo \n **********************************************************)\n\nlemma rest_decompo_domF:\n \"(SF1 .|. n = SF2 .|. m)\n = ((fstF SF1 .|. n = fstF SF2 .|. m &\n sndF SF1 .|. n = sndF SF2 .|. m))\"\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inject)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: fold_fstF)\napply (simp add: fold_sndF)\ndone\n\n(***********************************************************\n lemmas (distance)\n ***********************************************************)\n\n(*** distance ***)\n\nlemma distance_Rep_domF:\n \"distance((F::'a domF), E) = distance(Rep_domF F, Rep_domF E)\"\napply (simp add: to_distance_rs)\napply (simp add: Rep_rest_domF rest_distance_eq)\ndone\n\nlemma distance_Abs_domF:\n \"[| (T1, F1) : domF ; (T2, F2) : domF |]\n ==> distance (Abs_domF (T1, F1), Abs_domF (T2, F2))\n = distance ((T1, F1), T2, F2)\"\nby (simp add: distance_Rep_domF Abs_domF_inverse)\n\n(*** normal ***)\n\nlemma normal_domF:\n \"normal (Fs::'a domF infinite_seq) = normal (Rep_domF o Fs)\"\nby (simp add: normal_def distance_Rep_domF)\n\nlemma normal_domF_only_if:\n \"normal (Fs::'a domF infinite_seq) ==> normal (Rep_domF o Fs)\"\nby (simp add: normal_domF)\n\n(* T and F *)\n\nlemma normal_of_domF:\n \"normal (Fs::'a domF infinite_seq)\n ==> (normal (fstF o Fs) & normal (sndF o Fs))\"\napply (simp add: normal_domF)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_normal_seq)\ndone\n\n(*** cauchy ***)\n\nlemma cauchy_domF:\n \"cauchy (Fs::'a domF infinite_seq) = cauchy (Rep_domF o Fs)\"\nby (simp add: cauchy_def distance_Rep_domF)\n\nlemma cauchy_domF_only_if:\n \"cauchy (Fs::'a domF infinite_seq) ==> cauchy (Rep_domF o Fs)\"\nby (simp add: cauchy_domF)\n\n(* T and F *)\n\nlemma cauchy_of_domF:\n \"cauchy (Fs::'a domF infinite_seq)\n ==> (cauchy (fstF o Fs) & cauchy (sndF o Fs))\"\napply (simp add: cauchy_domF)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_cauchy_seq)\ndone\n\n(***********************************************************\n lemmas (Limit)\n ***********************************************************)\n\n(*** convergeTo domF ***)\n\nlemma convergeTo_domF:\n \"[| (Rep_domF o Fs) convergeTo TF ; TF : domF |]\n ==> Fs convergeTo Abs_domF TF\"\napply (simp add: convergeTo_def)\napply (intro allI impI)\napply (drule_tac x=\"eps\" in spec)\napply (simp)\napply (erule exE)\napply (rule_tac x=\"n\" in exI)\napply (intro allI impI)\napply (drule_tac x=\"m\" in spec)\n\napply (simp add: distance_Rep_domF)\napply (simp add: Abs_domF_inverse)\ndone\n\n(*** LimitTF ***)\n\nlemma LimitTF_iff:\n \"normal (Rep_domF o Fs) \n ==> pair_Limit (Rep_domF o Fs)\n = (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: pair_Limit_def)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_normal_seq Limit_domT_Limit_eq Limit_setF_Limit_eq)\ndone\n\n(*******************************\n LimitTF in domF\n *******************************)\n\n(*** F4 ***)\n\nlemma LimitTF_F4:\n \"normal Fs ==> HC_F4 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_F4_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\n\napply (subgoal_tac \"(Rep_domF (Fs (lengtht (s ^^^ )))) : domF\")\napply (simp add: domF_def HC_F4_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\nby (simp)\n\n(*** T3 ***)\n\nlemma LimitTF_T3:\n \"normal Fs ==> HC_T3 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_T3_def)\napply (intro allI impI)\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\n\napply (subgoal_tac \"(Rep_domF (Fs (lengtht (s ^^^ )))) : domF\")\napply (simp add: domF_def HC_T3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (rule disjI2)\napply (rule_tac x=\"s\" in exI)\napply (simp)\nby (simp)\n\n(*** F3 ***)\n\nlemma LimitTF_F3:\n \"normal Fs ==> HC_F3 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\napply (elim conjE disjE)\n\napply (subgoal_tac \"(Rep_domF (Fs (Suc (lengtht s)))) : domF\")\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp add: fstF_def sndF_def)\napply (simp)\n\napply (erule exE)\napply (simp)\ndone\n\n(*** T2 ***)\n\nlemma LimitTF_T2:\n \"normal Fs ==> HC_T2 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\napply (elim exE disjE)\n\napply (subgoal_tac \"(Rep_domF (Fs (Suc (lengtht s)))) : domF\")\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (drule mp)\napply (rule_tac x=\"X\" in exI, simp)\napply (rule normal_seq_domT_if)\n apply (subgoal_tac \"(%u. fst (Rep_domF (Fs u))) = (fstF o Fs )\")\n apply (simp add: normal_of_domF)\n apply (simp add: fun_eq_iff fstF_def)\n apply (simp_all)\n\n(* *)\n\napply (elim conjE exE)\napply (subgoal_tac \"(Rep_domF (Fs (lengtht s))) : domF\")\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (drule mp)\napply (rule_tac x=\"X\" in exI, simp)\napply (simp_all)\ndone\n\n(*** Limit_domFpari_in ***)\n\nlemma LimitTF_in:\n \"normal Fs ==> LimitTF Fs : domF\"\napply (simp add: LimitTF_def)\napply (simp add: LimitTF_iff normal_domF_only_if)\napply (simp add: domF_def)\napply (simp add: LimitTF_F4)\napply (simp add: LimitTF_T3)\napply (simp add: LimitTF_F3)\napply (simp add: LimitTF_T2)\ndone\n\n(*** (normal) Fs converges to (Limit_domF Fs) ***)\n\nlemma Limit_domF_Limit: \"normal Fs ==> Fs convergeTo (Limit_domF Fs)\"\napply (simp add: Limit_domF_def)\napply (rule convergeTo_domF)\napply (simp add: LimitTF_def)\napply (simp add: pair_cms_cauchy_Limit normal_cauchy normal_domF)\n\nby (simp add: LimitTF_in)\n\n(*** (cauchy) Fs converges to (Limit_domF NF Fs) ***)\n\nlemma cauchy_Limit_domF_Limit:\n \"cauchy Fs ==> Fs convergeTo (Limit_domF (NF Fs))\"\nby (simp add: Limit_domF_Limit normal_form_seq_same_Limit normal_form_seq_normal)\n\n(**************************************\n Dom_F --> Complete Metric Space\n **************************************)\n\nlemma domF_cms:\n \"cauchy (Fs::'a domF infinite_seq) ==> (EX F. Fs convergeTo F)\"\napply (rule_tac x=\"Limit_domF (NF Fs)\" in exI)\nby (simp add: cauchy_Limit_domF_Limit)\n\n(************************************************************\n domF ==> CMS and RS\n ************************************************************)\n\ninstance domF :: (type) cms\napply (intro_classes)\nby (simp add: domF_cms)\n\ninstance domF :: (type) cms_rs\nby (intro_classes)\n\n(*** (normal) Limit Fs = Limit_domF Fs ***)\n\nlemma Limit_domF_Limit_eq:\n \"normal (Fs::'a domF infinite_seq) ==> Limit Fs = Limit_domF Fs\"\napply (rule unique_convergence[of Fs])\nby (simp_all add: Limit_domF_Limit Limit_is normal_cauchy)\n\n(************************************************************\n .|. domF decompostion\n ************************************************************)\n\nlemma rest_domF_decompo_sub:\n \"ALL x. (f x, g x): domF ==>\n ((f x1 ,, g x1) .|. n <= ((f x2 ,, g x2) .|. n))\n = (f x1 .|. n <= f x2 .|. n &\n g x1 .|. n <= g x2 .|. n)\"\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\n\napply (simp add: pairF_def)\napply (simp add: restTF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\ndone\n\nlemma rest_domF_decompo:\n \"ALL x. (f x, g x): domF ==>\n ((f x1 ,, g x1) .|. n = ((f x2 ,, g x2) .|. n))\n = (f x1 .|. n = f x2 .|. n &\n g x1 .|. n = g x2 .|. n)\"\napply (rule)\napply (simp add: order_eq_iff)\napply (simp add: rest_domF_decompo_sub)\napply (simp add: order_eq_iff)\napply (simp add: rest_domF_decompo_sub)\ndone\n\n(************************************************************\n map domF decompostion\n ************************************************************)\n\n(* Abs_domF *)\n\nlemma map_alpha_Abs_domF:\n \"ALL x. (f x, g x): domF ==>\n map_alpha (%x. (f x,, g x)) alpha = map_alpha (f ** g) alpha\"\napply (simp add: pairF_def)\napply (simp add: contraction_alpha_def map_alpha_def)\napply (simp add: pair_fun_def)\napply (simp add: distance_Abs_domF)\ndone\n\n(* decompo *)\n\nlemma map_alpha_domF_decompo:\n \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n map_alpha (%x. (f x,, g x)) alpha = \n (map_alpha f alpha & map_alpha g alpha)\"\napply (simp add: map_alpha_Abs_domF)\napply (simp add: pair_map_alpha_compo)\ndone\n\nlemma non_expanding_domF_decompo:\n \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n non_expanding (%x. (f x,, g x)) =\n (non_expanding f & non_expanding g)\"\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_domF_decompo)\ndone\n\nlemma contraction_alpha_domF_decompo:\n \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n contraction_alpha (%x. (f x,, g x)) alpha =\n (contraction_alpha f alpha & contraction_alpha g alpha)\"\napply (simp add: contraction_alpha_def)\napply (simp add: map_alpha_domF_decompo)\napply (auto)\ndone\n\n(********************************************************** \n non expanding (op o fstF)\n **********************************************************)\n\nlemma non_expanding_Rep_domF: \"non_expanding Rep_domF\"\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: distance_Rep_domF)\ndone\n\nlemma non_expanding_fstF: \"non_expanding fstF\"\napply (simp add: fstF_def)\napply (rule compo_non_expand)\napply (simp add: fst_non_expand)\napply (simp add: non_expanding_Rep_domF)\ndone\n\nlemma non_expanding_sndF: \"non_expanding sndF\"\napply (simp add: sndF_def)\napply (rule compo_non_expand)\napply (simp add: snd_non_expand)\napply (simp add: non_expanding_Rep_domF)\ndone\n\nlemma non_expanding_op_fstF: \"non_expanding ((o) fstF)\"\napply (simp add: prod_non_expand)\napply (insert non_expanding_fstF)\napply (simp add: proj_fun_def)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x i\" in spec)\napply (drule_tac x=\"y i\" in spec)\napply (rule order_trans)\napply (simp)\n\napply (subgoal_tac \"non_expanding (proj_fun i)\")\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: proj_fun_def)\napply (fast)\n\napply (simp add: proj_non_expand)\ndone\n\nlemma non_expanding_op_sndF: \"non_expanding ((o) sndF)\"\napply (simp add: prod_non_expand)\napply (insert non_expanding_sndF)\napply (simp add: proj_fun_def)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x i\" in spec)\napply (drule_tac x=\"y i\" in spec)\napply (rule order_trans)\napply (simp)\n\napply (subgoal_tac \"non_expanding (proj_fun i)\")\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: proj_fun_def)\napply (fast)\n\napply (simp add: proj_non_expand)\ndone\n\n(*** distance ***)\n\ndeclare [[show_sorts]]\n\n\nlemma distance_fstF_compo_le: \n \"distance (fstF o x, fstF o y) <= distance (x, y)\"\napply (insert non_expanding_op_fstF)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (auto)\ndone\n\nlemma alpha_distance_fstF_compo_le: \n \"0 <= alpha ==> alpha * distance (fstF o x, fstF o y) <= alpha * distance (x, y)\"\napply (insert mult_left_mono\n [of \"distance (fstF o x, fstF o y)\" \"distance (x, y)\" \"alpha\" ])\napply (simp add: distance_fstF_compo_le)\ndone\n\n(*----------------------------------------------------------*\n | |\n | cms rs order |\n | |\n *----------------------------------------------------------*)\n\ninstance domF :: (type) ms_rs_order0\napply (intro_classes)\ndone\n\ninstance domF :: (type) ms_rs_order\napply (intro_classes)\napply (intro allI)\napply (rule iffI)\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\napply (erule dist_ALL_conjE)\napply (simp add: rs_order_iff)\n\napply (intro allI)\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\napply (simp add: rs_order_if)\ndone\n\ninstance domF :: (type) cms_rs_order\nby (intro_classes)\n\n(*----------------------------------------------------------*\n | |\n | i.e. lemma \"continuous_rs (Ref_fun (S::'a domF))\" |\n | by (simp add: continuous_rs_Ref_fun) |\n | |\n | see RS.thy |\n | |\n *----------------------------------------------------------*)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/Domain_F_cms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2819813976805361}} {"text": "(* Title: HOL/Auth/n_deadlock_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_on_inis imports n_deadlock_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2819240999295578}} {"text": "theory LR3_Compressed\n imports Compressed_Oracles.CO_Invariants General_Luby_Rackoff\nbegin\n\n(* U_UP,i, using compressed queries *)\ndefinition UPc :: \\(whole \\ whole \\ db) ell2 \\\\<^sub>C\\<^sub>L (whole \\ whole \\ db) ell2\\ where \\UPc = \n (reg_1_3 o Fst; reg_2_3 o Snd) cnot o\\<^sub>C\\<^sub>L\n (reg_1_3 o Snd; reg_2_3 o Fst) cnot o\\<^sub>C\\<^sub>L\n (reg_1_3 o Fst; (reg_2_3 o Fst; reg_3_3)) query\\\n(* U_UP,i, using compressed queries, query' variant *)\n(* We probably will only use this one because we want to use preserve_query1'_fixY_output which is only available for query *)\ndefinition UPc' :: \\(whole \\ whole \\ db) ell2 \\\\<^sub>C\\<^sub>L (whole \\ whole \\ db) ell2\\ where \\UPc' = \n (reg_1_3 o Fst; reg_2_3 o Snd) cnot o\\<^sub>C\\<^sub>L\n (reg_1_3 o Snd; reg_2_3 o Fst) cnot o\\<^sub>C\\<^sub>L\n (reg_1_3 o Fst; (reg_2_3 o Fst; reg_3_3)) query'\\\n\n(* LR3 using compressed oracles *)\ndefinition LR3c where \\LR3c =\n (X;(X1;D1)) UPc o\\<^sub>C\\<^sub>L (X1;(X2;D2)) UPc o\\<^sub>C\\<^sub>L (X2;(Y;D3)) UPc o\\<^sub>C\\<^sub>L (X1;(X2;D2)) UPc o\\<^sub>C\\<^sub>L (X;(X1;D1)) UPc\\\ndefinition LR3c' where \\LR3c' =\n (X;(X1;D1)) UPc' o\\<^sub>C\\<^sub>L (X1;(X2;D2)) UPc' o\\<^sub>C\\<^sub>L (X2;(Y;D3)) UPc' o\\<^sub>C\\<^sub>L (X1;(X2;D2)) UPc' o\\<^sub>C\\<^sub>L (X;(X1;D1)) UPc'\\\n\n(* Notion of good from the current eprint of the LR4-paper. Note: uniqueness condition missing. *)\ndefinition old_good where \\old_good D1 D2 D3 \\ (\\x2L \\ dom D3. \\xL\\dom D1. \\\\\\ran D2. x2L = xL + \\)\\\n for D1 D2 D3 :: db\n\n(* Notion of good from the current eprint of the LR4-paper, more intuitive formulation *)\nlemma old_good_alt_def: \\old_good D1 D2 D3 \\ (\\x2L \\ dom D3. \\xL xR. do { (x2L',x2R) \\ LR2 D1 D2 (xL,xR); Some (x2L=x2L') } = Some True)\\\n for D1 D2 D3\nproof (unfold old_good_def; intro iffI ballI)\n fix x2L assume x2L_D3: \\x2L \\ dom D3\\\n assume \\\\x2L\\dom D3. \\xL\\dom D1. \\\\\\ran D2. x2L = xL + \\\\\n from this[rule_format, OF x2L_D3]\n obtain xL \\ where \\xL \\ dom D1\\ \\\\ \\ ran D2\\ \\x2L = xL + \\\\\n by auto\n from \\xL \\ dom D1\\ obtain \\ where [simp]: \\D1 xL = Some \\\\\n by force\n from \\\\ \\ ran D2\\ obtain D2_in where [simp]: \\D2 D2_in = Some \\\\\n by (smt (verit, del_insts) mem_Collect_eq ran_def)\n have \\LR2 D1 D2 (xL, D2_in + \\) \\ (\\(x2L', x2R). Some (x2L = x2L')) = Some True\\\n using \\x2L = xL + \\\\ by (auto simp: LR2_def)\n then show \\\\xL xR. LR2 D1 D2 (xL, xR) \\ (\\(x2L', x2R). Some (x2L = x2L')) = Some True\\\n by auto\nnext\n fix x2L assume x2L_D3: \\x2L \\ dom D3\\\n assume \\\\x2L\\dom D3. \\xL xR. LR2 D1 D2 (xL, xR) \\ (\\(x2L', x2R). Some (x2L = x2L')) = Some True\\\n from this[rule_format, OF x2L_D3]\n show \\\\xL\\dom D1. \\\\\\ran D2. x2L = xL + \\\\\n by (smt (z3) LR2_def bind_eq_Some_conv domI old.prod.case option.inject ranI)\nqed\n\ndefinition x1_x2_00 :: \\state set\\ where \\x1_x2_00 = {(x,0,0,y,D1,D2,D3)| x y D1 D2 D3. True}\\\ndefinition x2_0 :: \\state set\\ where \\x2_0 = {(x,x1,0,y,D1,D2,D3)| x x1 y D1 D2 D3. True}\\\n\n(* definition old_good_state_00 :: \\state set\\ where \\old_good_state_00 = {(x,0,0,y,D1,D2,D3)| x y D1 D2 D3. old_good D1 D2 D3}\\ *)\n(* definition old_good_state_0 :: \\state set\\ where \\old_good_state_0 = {(x,x1,0,y,D1,D2,D3)| x x1 y D1 D2 D3. old_good D1 D2 D3}\\ *)\ndefinition old_good_state :: \\state set\\ where \\old_good_state = {(x,x1,x2,y,D1,D2,D3). old_good D1 D2 D3}\\\n\nabbreviation \\old_good_state_00 \\ old_good_state \\ x1_x2_00\\ (* TODO remove *)\nabbreviation \\old_good_state_0 \\ old_good_state \\ x2_0\\ (* TODO remove *)\n\ndefinition \\co1_old_good = 2 / sqrt N\\\nlemma preserves_co1_old_good:\n \\preserves_ket ((X o Fst; (X1 o Fst; D1)) query) old_good_state_00 old_good_state_0 co1_old_good\\\nproof -\n define K :: \\(half\\half\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(xL,xR,y,D1',D2,D3).\n ket_invariant {((xL,xR),(x1L,0),0,y,D1'(xL:=d),D2,D3) | x1L d. True})\\\n define M :: \\(half\\half\\whole\\db\\db\\db) set\\ where\n \\M = {(xL,xR,y,D1',D2,D3). D1' xL = None \\ (\\d. old_good (D1'(xL:=d)) D2 D3)}\\\n\n define I1 J1 :: \\(half\\half\\whole\\db\\db\\db) \\ (half \\ half option) set\\ \n where \\I1 = (\\(xL,xR,y,D1',D2,D3).\n {0} \\ {d. old_good (D1'(xL:=d)) D2 D3})\\\n and \\J1 = (\\(xL,xR,y,D1',D2,D3). \n UNIV \\ {d. old_good (D1'(xL:=d)) D2 D3})\\\n\n show ?thesis\n proof (rule inv_split_reg_query[where X=\\X o Fst\\ and Y=\\X1 o Fst\\ and H=\\D1\\ and K=K\n and ?I1.0=\\\\z. ket_invariant (I1 z)\\ and ?J1.0=\\\\z. ket_invariant (J1 z)\\])\n show \\(X \\ Fst;(X1 \\ Fst;D1)) query = (X \\ Fst;(X1 \\ Fst;D1)) query\\\n by simp\n show [simp]: \\compatible (X \\ Fst) (X1 \\ Fst)\\ \\compatible (X \\ Fst) D1\\ \\compatible (X1 \\ Fst) D1\\\n by simp_all\n show \\compatible_register_invariant (X1 \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def X1_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D1 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D1_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant old_good_state_00 \\ (SUP z\\M. K z \\ lift_invariant (X1 \\ Fst;D1 \\ function_at (fst z)) (ket_invariant (I1 z)))\\\n apply (auto simp add: K_def D1_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] I1_def\n old_good_state_def x1_x2_00_def case_prod_beta comp_assoc X1_def M_def zero_prod_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X1 \\ Fst;D1 \\ function_at (fst z)) (ket_invariant (J1 z)) \\ ket_invariant old_good_state_0\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] J1_def\n case_prod_beta D1_def comp_assoc X1_def old_good_state_def x2_0_def M_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X_def lift_Fst_ket_inv lift_invariant_comp case_prod_beta)\n show [simp]: \\0 \\ co1_old_good\\\n by (simp add: co1_old_good_def)\n show \\preserves_ket query1 (I1 z) (J1 z) co1_old_good\\ if \\z\\M\\ for z\n proof (cases z)\n case (fields xL xR y D1' D2 D3)\n from that have D1'xL: \\D1' xL = None\\\n by (auto simp: M_def fields)\n show ?thesis\n proof (cases \\old_good D1' D2 D3\\)\n case True\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1_fixY[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good (D1'(xL := d)) D2 D3} \\ {d. old_good (D1'(xL := d)) D2 D3}\\ by simp\n show \\card (Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ N\\ by (simp add: card_mono)\n show \\card (- Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ 0\\ \n using True D1'xL apply auto\n by (simp add: old_good_def)\n have *: \\old_good (D1'(xL := None)) D2 D3\\\n by (simp add: D1'xL True domIff)\n show \\preserve_query1_fixY_bound\n (None \\ {d. old_good (D1'(xL := d)) D2 D3}) (None \\ {d. old_good (D1'(xL := d)) D2 D3})\n (real N) (real 0) \\ co1_old_good\\\n by (simp add: * preserve_query1_fixY_bound_def)\n qed\n next\n case False\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1_fixY[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good (D1'(xL := d)) D2 D3} \\ {d. old_good (D1'(xL := d)) D2 D3}\\ by simp\n show \\card (Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ N\\\n by (simp add: card_mono)\n show \\card (- Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ 0\\\n using False \\z\\M\\\n apply (auto simp: M_def fields old_good_def)\n by (metis DiffE domI insert_iff)\n have *: \\\\ old_good (D1'(xL := None)) D2 D3\\\n by (simp add: D1'xL False domIff)\n show \\preserve_query1_fixY_bound (None \\ {d. old_good (D1'(xL := d)) D2 D3}) (None \\ {d. old_good (D1'(xL := d)) D2 D3})\n (real N) (real 0) \\ co1_old_good\\\n apply (auto simp add: * preserve_query1_fixY_bound_def co1_old_good_def)\n by (simp add: inverse_eq_divide sqrt_divide_self_eq)\n qed\n qed\n qed\n qed\nqed\n\ndefinition \\co1'_old_good = 2 / sqrt N\\\nlemma preserves_co1'_old_good:\n \\preserves_ket ((X o Fst; (X1 o Fst; D1)) query') old_good_state_00 old_good_state_0 co1'_old_good\\\nproof -\n define K :: \\(half\\half\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(xL,xR,y,D1',D2,D3).\n ket_invariant {((xL,xR),(x1L,0),0,y,D1'(xL:=d),D2,D3) | x1L d. True})\\\n define M :: \\(half\\half\\whole\\db\\db\\db) set\\ where\n \\M = {(xL,xR,y,D1',D2,D3). D1' xL = None \\ (\\d. old_good (D1'(xL:=d)) D2 D3)}\\\n\n define I1 J1 :: \\(half\\half\\whole\\db\\db\\db) \\ (half \\ half option) set\\ \n where \\I1 = (\\(xL,xR,y,D1',D2,D3).\n {0} \\ {d. old_good (D1'(xL:=d)) D2 D3})\\\n and \\J1 = (\\(xL,xR,y,D1',D2,D3). \n UNIV \\ {d. old_good (D1'(xL:=d)) D2 D3})\\\n\n show ?thesis\n proof (rule inv_split_reg_query'[where X=\\X o Fst\\ and Y=\\X1 o Fst\\ and H=\\D1\\ and K=K\n and ?I1.0=\\\\z. ket_invariant (I1 z)\\ and ?J1.0=\\\\z. ket_invariant (J1 z)\\])\n show \\(X \\ Fst;(X1 \\ Fst;D1)) query' = (X \\ Fst;(X1 \\ Fst;D1)) query'\\\n by simp\n show [simp]: \\compatible (X \\ Fst) (X1 \\ Fst)\\ \\compatible (X \\ Fst) D1\\ \\compatible (X1 \\ Fst) D1\\\n by simp_all\n show \\compatible_register_invariant (X1 \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def X1_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D1 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D1_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant old_good_state_00 \\ (SUP z\\M. K z \\ lift_invariant (X1 \\ Fst;D1 \\ function_at (fst z)) (ket_invariant (I1 z)))\\\n apply (auto simp add: K_def D1_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] I1_def\n old_good_state_def x1_x2_00_def case_prod_beta comp_assoc X1_def M_def zero_prod_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X1 \\ Fst;D1 \\ function_at (fst z)) (ket_invariant (J1 z)) \\ ket_invariant old_good_state_0\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] J1_def\n case_prod_beta D1_def comp_assoc X1_def old_good_state_def x2_0_def M_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X_def lift_Fst_ket_inv lift_invariant_comp case_prod_beta)\n show [simp]: \\0 \\ co1'_old_good\\\n by (simp add: co1'_old_good_def)\n show \\preserves_ket query1' (I1 z) (J1 z) co1'_old_good\\ if \\z\\M\\ for z\n proof (cases z)\n case (fields xL xR y D1' D2 D3)\n from that have D1'xL: \\D1' xL = None\\\n by (auto simp: M_def fields)\n show ?thesis\n proof (cases \\old_good D1' D2 D3\\)\n case True\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1'_fixY[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good (D1'(xL := d)) D2 D3} \\ {d. old_good (D1'(xL := d)) D2 D3}\\ by simp\n show \\card (Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ N\\ by (simp add: card_mono)\n show \\card (- Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ 0\\ \n using True D1'xL apply auto\n by (simp add: old_good_def)\n have *: \\old_good (D1'(xL := None)) D2 D3\\\n by (simp add: D1'xL True domIff)\n show \\preserve_query1'_fixY_bound\n (None \\ {d. old_good (D1'(xL := d)) D2 D3}) (None \\ {d. old_good (D1'(xL := d)) D2 D3})\n (real N) (real 0) \\ co1'_old_good\\\n by (simp add: * preserve_query1'_fixY_bound_def)\n qed\n next\n case False\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1'_fixY[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good (D1'(xL := d)) D2 D3} \\ {d. old_good (D1'(xL := d)) D2 D3}\\ by simp\n show \\card (Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ N\\\n by (simp add: card_mono)\n show \\card (- Some -` {d. old_good (D1'(xL := d)) D2 D3}) \\ 0\\\n using False \\z\\M\\\n apply (auto simp: M_def fields old_good_def)\n by (metis DiffE domI insert_iff)\n have *: \\\\ old_good (D1'(xL := None)) D2 D3\\\n by (simp add: D1'xL False domIff)\n show \\preserve_query1'_fixY_bound (None \\ {d. old_good (D1'(xL := d)) D2 D3}) (None \\ {d. old_good (D1'(xL := d)) D2 D3})\n (real N) (real 0) \\ co1'_old_good\\\n apply (auto simp add: * preserve_query1'_fixY_bound_def co1'_old_good_def)\n by (simp add: inverse_eq_divide sqrt_divide_self_eq)\n qed\n qed\n qed\n qed\nqed\n\n\ndefinition \\UPc1_old_good = co1_old_good\\\nlemma preserves_UPc1_old_good:\n \\preserves_ket ((X;(X1;D1)) UPc) old_good_state_00 old_good_state_0 UPc1_old_good\\\nproof -\n note comp_apply[simp del]\n\n have UPc: \\((X;(X1;D1)) UPc) = \n (X o Fst; X1 o Snd) cnot o\\<^sub>C\\<^sub>L (X \\ Snd; X1 \\ Fst) cnot o\\<^sub>C\\<^sub>L (X \\ Fst; (X1 \\ Fst; D1)) query\\\n by (simp add: UPc_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X;(X1;D1))\\] o_apply[where x=query and f=\\(X;(X1;D1))\\])\n\n have \\preserves_ket ((X \\ Fst; (X1 \\ Fst; D1)) query) old_good_state_00 old_good_state_0 co1_old_good\\\n by (rule preserves_co1_old_good)\n also have \\preserves_ket ((X \\ Snd; X1 \\ Fst) cnot) old_good_state_0 old_good_state_0 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def x2_0_def X_def X1_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n also have \\preserves_ket ((X \\ Fst; X1 \\ Snd) cnot) old_good_state_0 old_good_state_0 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def x2_0_def X_def X1_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n finally show ?thesis\n by (auto simp add: UPc1_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\ndefinition \\UPc1'_old_good = co1'_old_good\\\nlemma preserves_UPc1'_old_good:\n \\preserves_ket ((X;(X1;D1)) UPc') old_good_state_00 old_good_state_0 UPc1'_old_good\\\nproof -\n note comp_apply[simp del]\n\n have UPc: \\((X;(X1;D1)) UPc') = \n (X o Fst; X1 o Snd) cnot o\\<^sub>C\\<^sub>L (X \\ Snd; X1 \\ Fst) cnot o\\<^sub>C\\<^sub>L (X \\ Fst; (X1 \\ Fst; D1)) query'\\\n by (simp add: UPc'_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X;(X1;D1))\\] o_apply[where x=query' and f=\\(X;(X1;D1))\\])\n\n have \\preserves_ket ((X \\ Fst; (X1 \\ Fst; D1)) query') old_good_state_00 old_good_state_0 co1'_old_good\\\n by (rule preserves_co1'_old_good)\n also have \\preserves_ket ((X \\ Snd; X1 \\ Fst) cnot) old_good_state_0 old_good_state_0 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def x2_0_def X_def X1_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n also have \\preserves_ket ((X \\ Fst; X1 \\ Snd) cnot) old_good_state_0 old_good_state_0 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def x2_0_def X_def X1_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n finally show ?thesis\n by (auto simp add: UPc1'_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\ndefinition num_queries_D1 :: \\nat \\ state set\\ where \\num_queries_D1 q = {(x,x1,x2,y,D1,D2,D3). card (dom D1) \\ q}\\\n\n(* TODO: preservation lemma for num_queries_1 *)\n\ndefinition \\co2'_old_good q = 2 * sqrt q / N + 2 * sqrt q / sqrt N + 1 / sqrt N\\\nlemma preserves_co2'_old_good:\n \\preserves_ket ((X1 o Fst; (X2 o Fst; D2)) query') (old_good_state_0 \\ num_queries_D1 q) old_good_state (co2'_old_good q)\\\nproof -\n define K :: \\(half\\half\\whole\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(x1L,x1R,x,y,D1,D2',D3).\n ket_invariant {(x,(x1L,x1R),(x2L,0),y,D1,D2'(x1L:=d),D3) | x2L d. True})\\\n define M :: \\(half\\half\\whole\\whole\\db\\db\\db) set\\ where\n \\M = {(x1L,x1R,x,y,D1,D2',D3). D2' x1L = None \\ (\\d. old_good D1 (D2'(x1L:=d)) D3) \\ card (dom D1) \\ q}\\\n\n define I1 J1 :: \\(half\\half\\whole\\whole\\db\\db\\db) \\ (half \\ half option) set\\ \n where \\I1 = (\\(x1L,x1R,x,y,D1,D2',D3).\n {0} \\ {d. old_good D1 (D2'(x1L:=d)) D3})\\\n and \\J1 = (\\(x1L,x1R,x,y,D1,D2',D3).\n UNIV \\ {d. old_good D1 (D2'(x1L:=d)) D3})\\\n\n show ?thesis\n proof (rule inv_split_reg_query'[where X=\\X1 o Fst\\ and Y=\\X2 o Fst\\ and H=\\D2\\ and K=K\n and ?I1.0=\\\\z. ket_invariant (I1 z)\\ and ?J1.0=\\\\z. ket_invariant (J1 z)\\])\n show \\(X1 \\ Fst;(X2 \\ Fst;D2)) query' = (X1 \\ Fst;(X2 \\ Fst;D2)) query'\\\n by simp\n show [simp]: \\compatible (X1 \\ Fst) (X2 \\ Fst)\\ \\compatible (X1 \\ Fst) D2\\ \\compatible (X2 \\ Fst) D2\\\n by simp_all\n show \\compatible_register_invariant (X2 \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def X2_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D2 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D2_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant (old_good_state_0 \\ num_queries_D1 q) \\ (SUP z\\M. K z \\ lift_invariant (X2 \\ Fst;D2 \\ function_at (fst z)) (ket_invariant (I1 z)))\\\n apply (auto simp add: K_def D2_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] I1_def\n old_good_state_def x2_0_def case_prod_beta comp_assoc X2_def M_def zero_prod_def num_queries_D1_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X2 \\ Fst;D2 \\ function_at (fst z)) (ket_invariant (J1 z)) \\ ket_invariant old_good_state\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] J1_def\n case_prod_beta D2_def comp_assoc X2_def old_good_state_def M_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X1 \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X1_def lift_Fst_ket_inv lift_Snd_ket_inv lift_invariant_comp case_prod_beta)\n show [simp]: \\0 \\ co2'_old_good q\\\n by (simp add: co2'_old_good_def)\n show \\preserves_ket query1' (I1 z) (J1 z) (co2'_old_good q)\\ if \\z\\M\\ for z\n proof (cases z)\n case (fields x1L x1R x y D1 D2' D3)\n from that have D2'xL: \\D2' x1L = None\\\n by (auto simp: M_def fields)\n show ?thesis\n proof (cases \\old_good D1 D2' D3\\)\n case True\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1'_fixY[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good D1 (D2'(x1L := d)) D3} \\ {d. old_good D1 (D2'(x1L := d)) D3}\\ by simp\n show \\card (Some -` {d. old_good D1 (D2'(x1L := d)) D3}) \\ N\\ by (simp add: card_mono)\n show \\card (- Some -` {d. old_good D1 (D2'(x1L := d)) D3}) \\ 0\\\n using True D2'xL apply auto\n apply (simp add: old_good_def)\n by meson\n have *: \\old_good D1 (D2'(x1L := None)) D3\\\n by (simp add: D2'xL True domIff)\n show \\preserve_query1'_fixY_bound\n (None \\ {d. old_good D1 (D2'(x1L := d)) D3}) (None \\ {d. old_good D1 (D2'(x1L := d)) D3})\n (real N) (real 0) \\ (co2'_old_good q)\\\n by (simp add: * preserve_query1'_fixY_bound_def)\n qed\n next\n case False\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields)\n proof (rule preserve_query1'_fixY[where b\\<^sub>i=q and b\\<^sub>j\\<^sub>0=N])\n show \\{d. old_good D1 (D2'(x1L := d)) D3} \\ {d. old_good D1 (D2'(x1L := d)) D3}\\ by simp\n have card_D1: \\card (dom D1) \\ q\\\n using \\z\\M\\ by (simp add: fields M_def)\n from False obtain x2L where \\x2L \\ dom D3\\ and x2L_not_good: \\\\xL\\dom D1. \\\\\\ran D2'. x2L \\ xL + \\\\\n by (auto simp: old_good_def)\n have d_poss: \\Some -` {d. old_good D1 (D2'(x1L := d)) D3} \\ (+) x2L ` dom D1\\\n proof (rule subsetI, rename_tac d)\n fix d assume \\d \\ Some -` {d. old_good D1 (D2'(x1L := d)) D3}\\\n then have \\old_good D1 (D2'(x1L \\ d)) D3\\\n by simp\n with \\x2L \\ dom D3\\ have \\\\xL\\dom D1. \\\\\\ran (D2'(x1L \\ d)). x2L = xL + \\\\\n by (simp add: old_good_def)\n with x2L_not_good have \\\\xL\\dom D1. x2L = xL + d\\\n using D2'xL by auto\n then show \\d \\ (+) x2L ` dom D1\\\n by force\n qed\n show \\card (Some -` {d. old_good D1 (D2'(x1L := d)) D3}) \\ q\\\n using _ card_D1 apply (rule order.trans)\n using d_poss by (simp add: surj_card_le)\n show \\card (- Some -` {d. old_good D1 (D2'(x1L := d)) D3}) \\ N\\\n by (simp add: card_mono)\n have *: \\\\ old_good D1 (D2'(x1L := None)) D3\\\n by (simp add: D2'xL False domIff)\n show \\preserve_query1'_fixY_bound (None \\ {d. old_good D1 (D2'(x1L := d)) D3}) (None \\ {d. old_good D1 (D2'(x1L := d)) D3})\n (real q) (real N) \\ co2'_old_good q\\\n apply (auto simp add: * preserve_query1'_fixY_bound_def co2'_old_good_def)\n by (metis ab_semigroup_mult_class.mult_ac(1) dual_order.refl of_nat_0_le_iff real_divide_square_eq sqrt_sqrt times_divide_eq_right)\n qed\n qed\n qed\n qed\nqed\n\n\ndefinition \\UPc2'_old_good q = co2'_old_good q\\\nlemma preserves_UPc2'_old_good:\n \\preserves_ket ((X1;(X2;D2)) UPc') (old_good_state_0 \\ num_queries_D1 q) old_good_state (UPc2'_old_good q)\\\nproof -\n note comp_apply[simp del]\n\n have UPc: \\((X1;(X2;D2)) UPc') = \n (X1 o Fst; X2 o Snd) cnot o\\<^sub>C\\<^sub>L (X1 \\ Snd; X2 \\ Fst) cnot o\\<^sub>C\\<^sub>L (X1 \\ Fst; (X2 \\ Fst; D2)) query'\\\n by (simp add: UPc'_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X1;(X2;D2))\\] o_apply[where x=query' and f=\\(X1;(X2;D2))\\])\n\n have \\preserves_ket ((X1 \\ Fst; (X2 \\ Fst; D2)) query') (old_good_state_0 \\ num_queries_D1 q) old_good_state (co2'_old_good q)\\\n by (rule preserves_co2'_old_good)\n also have \\preserves_ket ((X1 \\ Snd; X2 \\ Fst) cnot) old_good_state old_good_state 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def X1_def X2_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n also have \\preserves_ket ((X1 \\ Fst; X2 \\ Snd) cnot) old_good_state old_good_state 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def X1_def X2_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n finally show ?thesis\n by (auto simp add: UPc2'_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\n\ndefinition xx2_LR2 :: \\state set\\ where \\xx2_LR2 = {(x,x1,x2,y,D1,D2,D3). LR2 D1 D2 x = Some x2}\\\n\ndefinition \\co3'_old_good = 3 / sqrt N\\\nlemma preserves_co3'_old_good:\n \\preserves_ket ((X2 o Fst; (Y o Fst; D3)) query') (old_good_state \\ xx2_LR2) old_good_state co3'_old_good\\\nproof -\n define K :: \\(half\\half\\half\\whole\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(x2L,x2R,yR,x1,x,D1,D2,D3').\n ket_invariant {(x,x1,(x2L,x2R),(yL,yR),D1,D2,D3'(x2L:=d)) | yL d. True})\\\n define M :: \\(half\\half\\half\\whole\\whole\\db\\db\\db) set\\ where\n \\M = {(x2L,x2R,yR,x1,x,D1,D2,D3'). D3' x2L = None \\ (\\d. old_good D1 D2 (D3'(x2L:=d))) \\ LR2 D1 D2 x = Some (x2L,x2R)}\\\n\n define I1 J1 :: \\(half\\half\\half\\whole\\whole\\db\\db\\db) \\ (half \\ half option) set\\ \n where \\I1 = (\\(x2L,x2R,yR,x1,x,D1,D2,D3').\n UNIV \\ {d. old_good D1 D2 (D3'(x2L:=d))})\\\n and \\J1 = (\\(x2L,x2R,yR,x1,x,D1,D2,D3').\n UNIV \\ {d. old_good D1 D2 (D3'(x2L:=d))})\\\n\n show ?thesis\n proof (rule inv_split_reg_query'[where X=\\X2 o Fst\\ and Y=\\Y o Fst\\ and H=\\D3\\ and K=K\n and ?I1.0=\\\\z. ket_invariant (I1 z)\\ and ?J1.0=\\\\z. ket_invariant (J1 z)\\])\n show \\(X2 \\ Fst;(Y \\ Fst;D3)) query' = (X2 \\ Fst;(Y \\ Fst;D3)) query'\\\n by simp\n show [simp]: \\compatible (X2 \\ Fst) (Y \\ Fst)\\ \\compatible (X2 \\ Fst) D3\\ \\compatible (Y \\ Fst) D3\\\n by simp_all\n show \\compatible_register_invariant (Y \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def Y_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D3 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D3_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant (old_good_state \\ xx2_LR2) \\ (SUP z\\M. K z \\ lift_invariant (Y \\ Fst; D3 \\ function_at (fst z)) (ket_invariant (I1 z)))\\\n apply (auto simp add: K_def D3_def lift_Fst_ket_inv ket_invariant_inter\n ket_invariant_SUP[symmetric] I1_def xx2_LR2_def\n old_good_state_def case_prod_beta comp_assoc Y_def M_def zero_prod_def num_queries_D1_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (Y \\ Fst; D3 \\ function_at (fst z)) (ket_invariant (J1 z)) \\ ket_invariant old_good_state\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric] J1_def\n case_prod_beta D3_def comp_assoc Y_def old_good_state_def M_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X2 \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X2_def lift_Fst_ket_inv lift_Snd_ket_inv lift_invariant_comp case_prod_beta)\n show [simp]: \\0 \\ co3'_old_good\\\n by (simp add: co3'_old_good_def)\n show \\preserves_ket query1' (I1 z) (J1 z) co3'_old_good\\ if \\z\\M\\ for z\n proof (cases z)\n case (fields x2L x2R yR x1 x D1 D2D3')\n obtain D2 D3' where D2D3'[simp]: \\D2D3' = (D2,D3')\\\n apply atomize_elim by auto\n from that have D3'xL: \\D3' x2L = None\\\n by (auto simp: M_def fields)\n from that have \\\\d. old_good D1 D2 (D3'(x2L:=d))\\\n by (auto simp: M_def fields)\n then have D3'_good: \\old_good D1 D2 D3'\\\n by (smt (verit) D3'xL domIff fun_upd_apply old_good_def)\n then have None_I1: \\None \\ snd ` I1 z\\ (* TODO used? *)\n apply (auto simp: M_def fields I1_def D3'xL)\n by (simp add: D3'xL fun_upd_idem)\n from that have \\LR2 D1 D2 x = Some (x2L,x2R)\\\n by (auto simp: M_def fields)\n then have good_x2L: \\\\xL xR. LR2 D1 D2 (xL, xR) \\ (\\(x2L', x2R). Some (x2L = x2L')) = Some True\\\n apply (rule_tac x=\\fst x\\ in exI, rule_tac x=\\snd x\\ in exI) by simp\n with D3'_good have D3'x2L_good: \\old_good D1 D2 (D3'(x2L:=d))\\ for d\n unfolding old_good_alt_def by auto\n\n show ?thesis\n apply (simp only: case_prod_beta I1_def J1_def fst_conv snd_conv fields D2D3')\n proof (rule preserve_query1'[where b\\<^sub>i=N and b\\<^sub>j\\<^sub>0=0])\n show \\{d. old_good D1 D2 (D3'(x2L := d))} \\ {d. old_good D1 D2 (D3'(x2L := d))}\\ by simp\n show \\card (Some -` {d. old_good D1 D2 (D3'(x2L := d))}) \\ N\\ by (simp add: card_mono)\n show \\card (- Some -` {d. old_good D1 D2 (D3'(x2L := d))}) \\ 0\\\n using D3'x2L_good by auto\n show \\preserve_query1'_bound\n (None \\ {d. old_good D1 D2 (D3'(x2L := d))})\n (real N) (real 0) \\ co3'_old_good\\\n by (simp add: preserve_query1'_bound_def)\n show \\None \\ {d. old_good D1 D2 (D3'(x2L := d))}\\\n using D3'_good by (auto simp: M_def fields I1_def D3'xL fun_upd_idem)\n qed\n qed\n qed\nqed\n\n\ndefinition \\UPc3'_old_good = co3'_old_good\\\nlemma preserves_UPc3'_old_good:\n \\preserves_ket ((X2;(Y;D3)) UPc') (old_good_state \\ xx2_LR2) old_good_state UPc3'_old_good\\\nproof -\n note comp_apply[simp del]\n\n have UPc: \\((X2;(Y;D3)) UPc') = \n (X2 o Fst; Y o Snd) cnot o\\<^sub>C\\<^sub>L (X2 \\ Snd; Y \\ Fst) cnot o\\<^sub>C\\<^sub>L (X2 \\ Fst; (Y \\ Fst; D3)) query'\\\n by (simp add: UPc'_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X2;(Y;D3))\\] o_apply[where x=query' and f=\\(X2;(Y;D3))\\])\n\n have \\preserves_ket ((X2 \\ Fst; (Y \\ Fst; D3)) query') (old_good_state \\ xx2_LR2) old_good_state co3'_old_good\\\n by (rule preserves_co3'_old_good)\n also have \\preserves_ket ((X2 \\ Snd; Y \\ Fst) cnot) old_good_state old_good_state 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def X2_def Y_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n also have \\preserves_ket ((X2 \\ Fst; Y \\ Snd) cnot) old_good_state old_good_state 0\\\n apply (rule preserves_compatible[where U=cnot])\n by (auto simp add: old_good_state_def X2_def Y_def comp_assoc\n intro!: compatible_register_invariant_pair compatible_register_invariant_Fst_comp\n compatible_register_invariant_Snd_comp)\n finally show ?thesis\n by (auto simp add: UPc3'_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\ndefinition x1_out_x2_0 :: \\state set\\ where \\x1_out_x2_0 = {((xL,xR), (the (D1 xL) + xR, xL), 0,y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None}\\\n\nlemma cnotXSnd_apply: \\((X \\ Snd; X1 \\ Fst) cnot) *\\<^sub>V ket ((xL,xR), (x1L,x1R), x,y,D1,D2,D3) = ket ((xL,xR), (x1L + xR,x1R), x,y,D1,D2,D3)\\\n for D1 D2 D3\n apply (auto intro!: cblinfun_image_ket_invariant_leqI\n simp: preserves0I explicit_pair cnot_apply)\n apply (simp add: register_pair_apply Fst_def Snd_def X_def X1_def\n tensor_op_ell2 ket_cinner' tensor_ell2_scaleC2 tensor_ell2_scaleC1\n flip: tensor_butterfly of_bool_conj tensor_ell2_ket)\n apply (subst sum_single[where i=\\(xR,x1L)\\])\n by auto\n\nlemma cnotXFst_apply: \\((X \\ Fst; X1 \\ Snd) cnot) *\\<^sub>V ket ((xL,xR), (x1L,x1R), x,y,D1,D2,D3)\n = ket ((xL,xR), (x1L,x1R+xL), x,y,D1,D2,D3)\\\n for D1 D2 D3\n apply (auto intro!: cblinfun_image_ket_invariant_leqI\n simp: preserves0I explicit_pair cnot_apply)\n apply (simp add: register_pair_apply Fst_def Snd_def X_def X1_def\n tensor_op_ell2 ket_cinner' tensor_ell2_scaleC2 tensor_ell2_scaleC1\n flip: tensor_butterfly of_bool_conj tensor_ell2_ket)\n apply (subst sum_single[where i=\\(xL,x1R)\\])\n by auto\n\nlemma cnotX1Snd_apply: \\((X1 \\ Snd; X2 \\ Fst) cnot) *\\<^sub>V ket (x, (x1L,x1R), (x2L,x2R), y,D1,D2,D3)\n = ket (x, (x1L,x1R), (x2L+x1R,x2R) ,y,D1,D2,D3)\\\n for D1 D2 D3\n apply (auto intro!: cblinfun_image_ket_invariant_leqI\n simp: preserves0I explicit_pair cnot_apply)\n apply (simp add: register_pair_apply Fst_def Snd_def X_def X1_def X2_def\n tensor_op_ell2 ket_cinner' tensor_ell2_scaleC2 tensor_ell2_scaleC1\n flip: tensor_butterfly of_bool_conj tensor_ell2_ket)\n apply (subst sum_single[where i=\\(x1R,x2L)\\])\n by auto\n\nlemma cnotX1Fst_apply: \\((X1 \\ Fst; X2 \\ Snd) cnot) *\\<^sub>V ket (x, (x1L,x1R), (x2L,x2R), y,D1,D2,D3)\n = ket (x, (x1L,x1R), (x2L,x2R+x1L) ,y,D1,D2,D3)\\\n for D1 D2 D3\n apply (auto intro!: cblinfun_image_ket_invariant_leqI\n simp: preserves0I explicit_pair cnot_apply)\n apply (simp add: register_pair_apply Fst_def Snd_def X_def X1_def X2_def\n tensor_op_ell2 ket_cinner' tensor_ell2_scaleC2 tensor_ell2_scaleC1\n flip: tensor_butterfly of_bool_conj tensor_ell2_ket)\n apply (subst sum_single[where i=\\(x1L,x2R)\\])\n by auto\n\ndefinition UPc1'_output where \\UPc1'_output = 6 / sqrt N\\\nlemma preserves_UPc1'_output: \\preserves_ket ((X;(X1;D1)) UPc') x1_x2_00 x1_out_x2_0 UPc1'_output\\\nproof -\n have UPc: \\((X;(X1;D1)) UPc') = \n (X o Fst; X1 o Snd) cnot o\\<^sub>C\\<^sub>L (X \\ Snd; X1 \\ Fst) cnot o\\<^sub>C\\<^sub>L (X \\ Fst; (X1 \\ Fst; D1)) query'\\\n by (simp add: UPc'_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X;(X1;D1))\\] o_apply[where x=query' and f=\\(X;(X1;D1))\\])\n\n have \\preserves_ket ((X o Fst; (X1 o Fst; D1)) query') x1_x2_00 {((xL,xR), (the (D1 xL), 0), 0,y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None} UPc1'_output\\\n proof -\n define K :: \\(half\\half\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(xL,xR,y,D1',D2,D3).\n ket_invariant {((xL,xR),(x1L,0),0,y,D1'(xL:=d),D2,D3) | x1L d. True})\\\n define M :: \\(half\\half\\whole\\db\\db\\db) set\\ where\n \\M = {(xL,xR,y,D1',D2,D3). D1' xL = None}\\\n\n show ?thesis\n proof (rule inv_split_reg_query'[where X=\\X o Fst\\ and Y=\\X1 o Fst\\ and H=\\D1\\ and K=K\n and ?I1.0=\\\\z. ket_invariant ({0} \\ UNIV)\\ and ?J1.0=\\\\z. ket_invariant {(d, Some d)| d. True}\\])\n show \\(X \\ Fst;(X1 \\ Fst;D1)) query' = (X \\ Fst;(X1 \\ Fst;D1)) query'\\\n by simp\n show [simp]: \\compatible (X \\ Fst) (X1 \\ Fst)\\ \\compatible (X \\ Fst) D1\\ \\compatible (X1 \\ Fst) D1\\\n by simp_all\n show \\compatible_register_invariant (X1 \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def X1_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D1 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D1_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant x1_x2_00 \\ (SUP z\\M. K z \\ lift_invariant (X1 \\ Fst; D1 \\ function_at (fst z)) (ket_invariant ({0} \\ UNIV)))\\\n apply (auto simp add: K_def D1_def lift_Fst_ket_inv ket_invariant_inter\n ket_invariant_SUP[symmetric] x1_x2_00_def X1_def\n old_good_state_def case_prod_beta comp_assoc Y_def M_def zero_prod_def num_queries_D1_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X1 \\ Fst; D1 \\ function_at (fst z)) (ket_invariant {(d, Some d) |d. True})\n \\ ket_invariant {((xL, xR), (the (D1 xL), 0), 0, y, D1, D2, D3) |xL xR y D1 D2 D3. D1 xL \\ None}\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric]\n case_prod_beta D3_def comp_assoc Y_def old_good_state_def M_def X1_def D1_def\n lift_inv_prod' lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X_def lift_Fst_ket_inv lift_Snd_ket_inv lift_invariant_comp case_prod_beta)\n show \\0 \\ UPc1'_output\\\n by (simp add: UPc1'_output_def)\n show \\preserves_ket query1'({0} \\ UNIV) {(d, Some d) |d. True} UPc1'_output\\ if \\z\\M\\ for z\n apply (subst asm_rl[of \\{(d, Some d) |d. True} = {(0+d, Some d) |d. True}\\], simp)\n apply (rule preserve_query1'_fixY_output[where b\\<^sub>i=N])\n apply (auto simp: preserve_query1'_fixY_bound_output_def UPc1'_output_def)\n by (metis (no_types, opaque_lifting) add_One_commute add_divide_distrib divide_inverse dual_order.refl numeral_plus_numeral of_nat_0_le_iff semiring_norm(3) semiring_norm(6) sqrt_divide_self_eq times_divide_eq_right)\n qed\n qed\n also have \\preserves_ket ((X \\ Snd; X1 \\ Fst) cnot)\n {((xL,xR), (the (D1 xL), 0), 0,y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None}\n {((xL,xR), (the (D1 xL) + xR, 0), 0,y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None}\n 0\\\n by (auto intro!: cblinfun_image_ket_invariant_leqI ket_in_ket_invariantI\n simp: preserves0I cnotXSnd_apply ket_in_ket_invariantI)\n also have \\preserves_ket ((X \\ Fst; X1 \\ Snd) cnot)\n {((xL,xR), (the (D1 xL) + xR, 0), 0,y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None}\n x1_out_x2_0\n 0\\\n by (auto intro!: cblinfun_image_ket_invariant_leqI ket_in_ket_invariantI\n simp: preserves0I cnotXFst_apply ket_in_ket_invariantI x1_out_x2_0_def)\n finally show ?thesis\n by (auto simp add: UPc1_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\ndefinition UPc2'_output where \\UPc2'_output = 6 / sqrt N\\\nlemma preserves_UPc2'_output: \\preserves_ket ((X1;(X2;D2)) UPc') x1_out_x2_0 xx2_LR2 UPc2'_output\\\nproof -\n have UPc: \\((X1;(X2;D2)) UPc') = \n (X1 o Fst; X2 o Snd) cnot o\\<^sub>C\\<^sub>L (X1 \\ Snd; X2 \\ Fst) cnot o\\<^sub>C\\<^sub>L (X1 \\ Fst; (X2 \\ Fst; D2)) query'\\\n by (simp add: UPc'_def reg_1_3_def reg_2_3_def reg_3_3_def register_pair_Fst register_pair_Snd\n flip: register_mult comp_assoc register_comp_pair \n o_apply[where x=cnot and f=\\(X1;(X2;D2))\\] o_apply[where x=query' and f=\\(X1;(X2;D2))\\])\n\n have \\preserves_ket ((X1 o Fst; (X2 o Fst; D2)) query') x1_out_x2_0\n {((xL,xR), (the (D1 xL) + xR, xL), (the (D2 (the (D1 xL) + xR)), 0), y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None \\ D2 (the (D1 xL) + xR) \\ None}\n UPc2'_output\\\n proof -\n define K :: \\(half\\half\\half\\whole\\db\\db\\db) \\ state ell2 ccsubspace\\ \n where \\K = (\\(x1L,xL,xR,y,D1,D2',D3).\n ket_invariant {((xL,xR), (x1L, xL), (x2L,0), y,D1,D2'(x1L:=d),D3) | x2L d. D1 xL \\ None})\\\n define M :: \\(half\\half\\half\\whole\\db\\db\\db) set\\ where\n \\M = {(x1L,xL,xR,y,D1,D2',D3). D1 xL \\ None \\ D2' x1L = None \\ x1L = the (D1 xL) + xR}\\\n\n show ?thesis\n proof (rule inv_split_reg_query'[where X=\\X1 o Fst\\ and Y=\\X2 o Fst\\ and H=\\D2\\ and K=K\n and ?I1.0=\\\\z. ket_invariant ({0} \\ UNIV)\\ and ?J1.0=\\\\z. ket_invariant {(d, Some d)| d. True}\\])\n show \\(X1 \\ Fst;(X2 \\ Fst;D2)) query' = (X1 \\ Fst;(X2 \\ Fst;D2)) query'\\\n by simp\n show [simp]: \\compatible (X1 \\ Fst) (X2 \\ Fst)\\ \\compatible (X1 \\ Fst) D2\\ \\compatible (X2 \\ Fst) D2\\\n by simp_all\n show \\compatible_register_invariant (X2 \\ Fst) (K z)\\ for z\n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def X2_def comp_assoc\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp)\n show \\compatible_register_invariant (D2 \\ function_at (fst z)) (K z)\\ for z\n by (auto simp add: K_def D2_def comp_assoc case_prod_beta\n intro!: compatible_register_invariant_Snd_comp compatible_register_invariant_Fst compatible_register_invariant_Fst_comp\n compatible_register_invariant_function_at)\n show \\ket_invariant x1_out_x2_0 \\ (SUP z\\M. K z \\ lift_invariant (X2 \\ Fst; D2 \\ function_at (fst z)) (ket_invariant ({0} \\ UNIV)))\\\n apply (auto simp add: K_def D1_def lift_Fst_ket_inv ket_invariant_inter\n ket_invariant_SUP[symmetric] x1_out_x2_0_def X1_def X2_def D2_def\n old_good_state_def case_prod_beta comp_assoc Y_def M_def zero_prod_def num_queries_D1_def\n lift_inv_prod lift_invariant_comp lift_invariant_function_at_ket_inv lift_Snd_ket_inv)\n by (metis fun_upd_same fun_upd_triv fun_upd_upd option.sel)\n show \\K z \\ lift_invariant (X2 \\ Fst; D2 \\ function_at (fst z)) (ket_invariant {(d, Some d) |d. True})\n \\ ket_invariant {((xL,xR), (the (D1 xL) + xR, xL), (the (D2 (the (D1 xL) + xR)), 0), y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None \\ D2 (the (D1 xL) + xR) \\ None}\\\n if \\z\\M\\ for z\n using that \n apply (cases z, hypsubst_thin)\n by (auto simp add: K_def lift_Fst_ket_inv ket_invariant_inter ket_invariant_SUP[symmetric]\n case_prod_beta D3_def comp_assoc Y_def old_good_state_def M_def X1_def D1_def X2_def D2_def\n lift_inv_prod' lift_invariant_comp lift_invariant_function_at_ket_inv reg_3_3_def lift_Snd_ket_inv)\n show \\orthogonal_spaces (K z) (K z')\\ if \\z\\M\\ \\z'\\M\\ \\z \\ z'\\ for z z'\n apply (cases z; cases z')\n using that apply (auto simp: K_def M_def)\n by (metis fun_upd_triv fun_upd_upd)\n show \\K z \\ lift_invariant (X1 \\ Fst) (ket_invariant {fst z})\\ for z\n by (auto simp: K_def X_def X1_def lift_Fst_ket_inv lift_Snd_ket_inv lift_invariant_comp case_prod_beta)\n show \\0 \\ UPc2'_output\\\n by (simp add: UPc2'_output_def)\n show \\preserves_ket query1' ({0} \\ UNIV) {(d, Some d) |d. True} UPc2'_output\\ if \\z\\M\\ for z\n apply (subst asm_rl[of \\{(d, Some d) |d. True} = {(0+d, Some d) |d. True}\\], simp)\n apply (rule preserve_query1'_fixY_output[where b\\<^sub>i=N])\n apply (auto simp: preserve_query1'_fixY_bound_output_def UPc2'_output_def)\n by (metis (no_types, opaque_lifting) add_One_commute add_divide_distrib divide_inverse dual_order.refl numeral_plus_numeral of_nat_0_le_iff semiring_norm(3) semiring_norm(6) sqrt_divide_self_eq times_divide_eq_right)\n qed\n qed\n also have \\preserves_ket ((X1 \\ Snd; X2 \\ Fst) cnot)\n {((xL,xR), (the (D1 xL) + xR, xL), (the (D2 (the (D1 xL) + xR)), 0), y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None \\ D2 (the (D1 xL) + xR) \\ None}\n {((xL,xR), (the (D1 xL) + xR, xL), (the (D2 (the (D1 xL) + xR)) + xL, 0), y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None \\ D2 (the (D1 xL) + xR) \\ None}\n 0\\\n by (auto intro!: cblinfun_image_ket_invariant_leqI ket_in_ket_invariantI\n simp: preserves0I cnotX1Snd_apply ket_in_ket_invariantI)\n also have \\preserves_ket ((X1 \\ Fst; X2 \\ Snd) cnot)\n {((xL,xR), (the (D1 xL) + xR, xL), (the (D2 (the (D1 xL) + xR)) + xL, 0), y,D1,D2,D3)| xL xR y D1 D2 D3. D1 xL \\ None \\ D2 (the (D1 xL) + xR) \\ None}\n xx2_LR2\n 0\\\n by (auto intro!: cblinfun_image_ket_invariant_leqI ket_in_ket_invariantI\n simp: preserves0I cnotX1Fst_apply ket_in_ket_invariantI xx2_LR2_def LR2_def add.commute)\n finally show ?thesis\n by (auto simp add: UPc1_old_good_def UPc cblinfun_compose_assoc register_norm)\nqed\n\nlemma x1_out_x2_0_subset_x2_0: \\x1_out_x2_0 \\ x2_0\\\n by (smt (z3) Collect_mono_iff x1_out_x2_0_def x2_0_def)\n\nend\n\n(* What we have so far:\n\nUPc1': old_good_state \\ x1_x2_00 \\ old_good_state \\ x2_0 (* Do we need the x2_0 part here? *)\n x1_x2_00 \\ x1_out_x2_0\n x1_out_x2_0 \\ x2_0\nUPc2': old_good_state \\ x2_0 \\ num_queries_1 q \\ old_good_state\n x1_out_x2_0 \\ xx2_LR2\nUPc3': old_good_state \\ xx1_LR3 \\ old_good_state\n\nPlugging this together with other stuff:\nUPc1';UPc2': old_good_state_00 \\ num_queries_1 q \\ num_queries_2 q \n \\ old_good_state_00 \\ num_queries_1 (q+1) \\ num_queries_2 (q+1)\n \\ x1,x2 have the right stuff given x,D1,D2\n\n*)\n", "meta": {"author": "dominique-unruh", "repo": "luby-rackoff-formalization", "sha": "9b4e48a1fe50baac4c93fc4ae4e9dbbaf68b0b2c", "save_path": "github-repos/isabelle/dominique-unruh-luby-rackoff-formalization", "path": "github-repos/isabelle/dominique-unruh-luby-rackoff-formalization/luby-rackoff-formalization-9b4e48a1fe50baac4c93fc4ae4e9dbbaf68b0b2c/LR3_Compressed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.4726834766204329, "lm_q1q2_score": 0.28192409314802636}} {"text": "(*<*)\ntheory Uv_Proofs\nimports Heard_Of.Reduction\n Two_Step_Observing \"../HO_Transition_System\" Uv_Defs\nbegin\n(*>*)\n\nsubsection \\Proofs\\\ntype_synonym uv_TS_state = \"(nat \\ (process \\ (val pstate)))\"\n\naxiomatization where val_linorder: \n \"OFCLASS(val, linorder_class)\"\n\ninstance val :: linorder by (rule val_linorder)\n\nlemma two_step_step:\n \"step = two_step\"\n \"phase = two_phase\"\n by(auto simp add: step_def two_step_def phase_def two_phase_def)\n\ncontext mono_quorum\nbegin\n\ndefinition UV_Alg :: \"(process, val pstate, val msg)CHOAlgorithm\" where\n \"UV_Alg = CHOAlgorithm.truncate UV_M\"\n\ndefinition UV_TS ::\n \"(round \\ process HO) \\ (round \\ process HO) \\ (round \\ process) \\ uv_TS_state TS\"\nwhere\n \"UV_TS HOs SHOs crds = CHO_to_TS UV_Alg HOs SHOs (K o crds)\"\n\nlemmas UV_TS_defs = UV_TS_def CHO_to_TS_def UV_Alg_def CHOinitConfig_def\n UV_initState_def\n\ntype_synonym rHO = \"nat \\ process HO\"\n\ndefinition UV_trans_step \n where\n \"UV_trans_step HOs SHOs nxt_f snd_f stp \\ \\r \\.\n {((r, cfg), (Suc r, cfg'))|cfg cfg'. step r = stp \\ (\\p.\n \\ p \\ get_msgs (snd_f r) cfg (HOs r) (SHOs r) p\n \\ nxt_f r p (cfg p) (\\ p) (cfg' p)\n )}\"\n\nlemma step_less_D:\n \"0 < step r \\ step r = Suc 0\"\n by(auto simp add: step_def)\n\nlemma UV_trans:\n \"CSHO_trans_alt UV_sendMsg (\\r p st msgs crd st'. UV_nextState r p st msgs st') HOs SHOs crds = \n UV_trans_step HOs SHOs next0 send0 0\n \\ UV_trans_step HOs SHOs next1 send1 1\n \"\nproof\n show \"CSHO_trans_alt UV_sendMsg (\\r p st msgs crd. UV_nextState r p st msgs) HOs SHOs crds\n \\ UV_trans_step HOs SHOs next0 send0 0 \\ UV_trans_step HOs SHOs next1 send1 1\"\n by(force simp add: CSHO_trans_alt_def UV_sendMsg_def UV_nextState_def UV_trans_step_def \n K_def dest!: step_less_D)\nnext\n show \" UV_trans_step HOs SHOs next0 send0 0 \\\n UV_trans_step HOs SHOs next1 send1 1\n \\ CSHO_trans_alt UV_sendMsg\n (\\r p st msgs crd. UV_nextState r p st msgs) HOs SHOs crds\"\n by(force simp add: CSHO_trans_alt_def UV_sendMsg_def UV_nextState_def UV_trans_step_def)\nqed\n\nsubsubsection \\Invariants\\\n(******************************************************************************)\n\ndefinition UV_inv1\n :: \"uv_TS_state set\" \nwhere \n \"UV_inv1 = {(r, s). \n two_step r = 0 \\ (\\p. agreed_vote (s p) = None)\n }\"\n\nlemmas UV_inv1I = UV_inv1_def [THEN setc_def_to_intro, rule_format]\nlemmas UV_inv1E [elim] = UV_inv1_def [THEN setc_def_to_elim, rule_format]\nlemmas UV_inv1D = UV_inv1_def [THEN setc_def_to_dest, rule_format]\n\nlemma UV_inv1_inductive:\n \"init (UV_TS HOs SHOs crds) \\ UV_inv1\"\n \"{UV_inv1} TS.trans (UV_TS HOs SHOs crds) {> UV_inv1}\"\n by(auto simp add: UV_inv1_def UV_TS_defs CHO_trans_alt UV_trans PO_hoare_def \n UV_HOMachine_def CHOAlgorithm.truncate_def UV_trans_step_def \n all_conj_distrib two_step_phase_Suc two_step_step next1_def)\n \nlemma UV_inv1_invariant:\n \"reach (UV_TS HOs SHOs crds) \\ UV_inv1\"\n by(intro inv_rule_basic UV_inv1_inductive)\n\nsubsubsection \\Refinement\\\n(******************************************************************************)\n\ndefinition ref_rel :: \"(tso_state \\ uv_TS_state)set\" where\n \"ref_rel \\ {(sa, (r, sc)).\n r = next_round sa\n \\ (step r = 1 \\ r_votes sa = agreed_vote o sc)\n \\ (\\p v. last_obs (sc p) = v \\ (\\q. opt_obsv_state.last_obs sa q \\ {None, Some v}))\n \\ decisions sa = decide o sc\n }\"\n\n(******************************************************************************)\ntext \\Agreement for UV only holds if the communication predicates hold\\\ncontext\n fixes\n HOs :: \"nat \\ process \\ process set\"\n and rho :: \"nat \\ process \\ 'val pstate\"\n assumes global: \"UV_commGlobal HOs\"\n and per_rd: \"\\r. UV_commPerRd (HOs r)\"\n and run: \"HORun fA rho HOs\"\nbegin\n(******************************************************************************)\n\nlemma HOs_intersect:\n \"HOs r p \\ HOs r' q \\ {}\" using per_rd\n apply(simp add: UV_commPerRd_def)\n apply(blast dest: qintersect)\n done\n\nlemma HOs_nonempty:\n \"HOs r p \\ {}\" \n using HOs_intersect\n by blast\n\nlemma vote_origin:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and inv: \"(r, cfg) \\ UV_inv1\"\n and step_r: \"two_step r = 0\"\n shows \n \"agreed_vote (cfg' p) = Some v \\ (\\q \\ HOs r p. last_obs (cfg q) = v)\" \n using send[THEN spec, where x=p] step[THEN spec, where x=p] inv step_r HOs_nonempty\n by(auto simp add: next0_def get_msgs_benign send0_def msgRcvd_def o_def restrict_map_def)\n \nlemma same_new_vote:\n assumes \n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and inv: \"(r, cfg) \\ UV_inv1\"\n and step_r: \"two_step r = 0\"\n obtains v where \"\\p w. agreed_vote (cfg' p) = Some w \\ w = v\" \nproof(cases \"\\p v. agreed_vote (cfg' p) = Some v\")\n case True\n assume asm: \"\\v. \\p w. agreed_vote (cfg' p) = Some w \\ w = v \\ thesis\"\n from True obtain p v where \"agreed_vote (cfg' p) = Some v\" by auto\n\n hence \"\\p w. agreed_vote (cfg' p) = Some w \\ w = v\" (is \"?LV(v)\")\n using vote_origin[OF send step inv step_r] HOs_intersect\n by(force)\n\n from asm[OF this] show ?thesis .\nqed(auto)\n\nlemma x_origin1:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = 0\"\n and last_obs: \"last_obs (cfg' p) = v\"\n shows \n \"\\q. last_obs (cfg q) = v\" \nproof-\n have \"smallestValRcvd (\\ p) \\ {v. \\q. \\ p q = Some (Val v)}\" (is \"smallestValRcvd ?msgs \\ ?vals\")\n unfolding smallestValRcvd_def\n proof(rule Min_in)\n have \"?vals \\ getval ` ((the \\ ?msgs) ` (HOs r p))\"\n using send[THEN spec, where x=p]\n by (auto simp: image_def get_msgs_benign restrict_map_def send0_def)\n thus \"finite ?vals\" by (auto simp: finite_subset)\n next\n from send[THEN spec, where x=p]\n show \"?vals \\ {}\" using HOs_nonempty[of r p]\n by (auto simp: image_def get_msgs_benign restrict_map_def send0_def)\n qed\n hence \"v \\ ?vals\" using last_obs step[THEN spec, of p] \n by(auto simp add: next0_def all_conj_distrib)\n thus ?thesis using send[THEN spec, of p]\n by(auto simp add: get_msgs_benign send0_def restrict_map_def)\nqed\n \nlemma step0_ref:\n \"{ref_rel \\ UNIV \\ UV_inv1} \\r S v. tso_round0 r S v, \n UV_trans_step HOs HOs next0 send0 0 {> ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs UV_trans_step_def two_step_step all_conj_distrib)\n fix sa r cfg \\ cfg'\n assume\n R: \"(sa, (r, cfg)) \\ ref_rel\"\n and step_r: \"two_step r = 0\" \n and send: \"\\p. \\ p \\ get_msgs (send0 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next0 r p (cfg p) (\\ p) (cfg' p)\"\n and inv: \"(r, cfg) \\ UV_inv1\"\n\n from R have next_r: \"next_round sa = r\"\n by(simp add: ref_rel_def)\n\n from HOs_nonempty send have \"\\p. \\q. q \\ msgRcvd (\\ p)\"\n by(fastforce simp add: get_msgs_benign send0_def msgRcvd_def restrict_map_def)\n with step have same_dec: \"decide o cfg' = decide o cfg\"\n apply(simp add: next0_def o_def)\n by (metis pstate.select_convs(3) pstate.surjective pstate.update_convs(1) pstate.update_convs(2))\n\n define S where \"S = {p. \\v. agreed_vote (cfg' p) = Some v}\"\n from same_new_vote[OF send step inv step_r] \n obtain v where v: \"\\p \\ S. agreed_vote (cfg' p) = Some v\"\n by(simp add: S_def) (metis)\n hence vote_const_map: \"agreed_vote o cfg' = const_map v S\"\n by(auto simp add: S_def const_map_def restrict_map_def intro!: ext)\n\n note x_origin = x_origin1[OF send step step_r]\n\n define sa' where \"sa' = sa\\ next_round := Suc r, r_votes := const_map v S \\\"\n\n have \"\\p. p \\ S \\ opt_obs_safe (opt_obsv_state.last_obs sa) v\"\n using vote_origin[OF send step inv step_r] R per_rd[THEN spec, of r] v\n apply(clarsimp simp add: UV_commPerRd_def opt_obs_safe_def ref_rel_def)\n by metis\n \n hence \"(sa, sa') \\ tso_round0 r S v\" using next_r step_r v R \n vote_origin[OF send step inv step_r]\n by(auto simp add: tso_round0_def sa'_def all_conj_distrib)\n\n moreover have \"(sa', Suc r, cfg') \\ ref_rel\" using step send v R same_dec step_r next_r\n apply(clarsimp simp add: ref_rel_def sa'_def two_step_step two_step_phase_Suc vote_const_map)\n by (metis x_origin)\n ultimately show\n \"\\sa'. (\\r S v. (sa, sa') \\ tso_round0 r S v) \\ (sa', Suc r, cfg') \\ ref_rel\"\n by blast\nqed\n\n\nlemma x_origin2:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send1 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next1 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = Suc 0\"\n and last_obs: \"last_obs (cfg' p) = v\"\n shows \n \"(\\q. last_obs (cfg q) = v) \\ (\\q. agreed_vote (cfg q) = Some v)\" \nproof(cases \"\\q \\ HOs r p. \\w. \\ p q = Some (ValVote w None)\")\n case True\n hence empty: \"someVoteRcvd (\\ p) = {}\" using send[THEN spec, of p] HOs_nonempty[of r p]\n by(auto simp add: someVoteRcvd_def msgRcvd_def isValVote_def \n get_msgs_benign send1_def restrict_map_def)\n have \"smallestValNoVoteRcvd (\\ p) \\ {v. \\q. \\ p q = Some (ValVote v None)}\" \n (is \"smallestValNoVoteRcvd ?msgs \\ ?vals\")\n unfolding smallestValNoVoteRcvd_def\n proof(rule Min_in)\n have \"?vals \\ getval ` ((the \\ ?msgs) ` (HOs r p))\"\n using send[THEN spec, where x=p]\n by (auto simp: image_def get_msgs_benign restrict_map_def send0_def)\n thus \"finite ?vals\" by (auto simp: finite_subset)\n next\n from send[THEN spec, where x=p] True HOs_nonempty[of r p]\n show \"?vals \\ {}\" \n by (auto simp: image_def get_msgs_benign restrict_map_def send1_def)\n qed\n hence \"v \\ ?vals\" using empty step[THEN spec, of p] last_obs\n by(auto simp add: next1_def x_update_def)\n thus ?thesis using send[THEN spec, of p]\n by(auto simp add: get_msgs_benign restrict_map_def send1_def)\nnext\n case False\n hence \"someVoteRcvd (\\ p) \\ {}\" using send[THEN spec, of p] HOs_nonempty[of r p]\n by(auto simp add: someVoteRcvd_def msgRcvd_def isValVote_def \n get_msgs_benign send1_def restrict_map_def)\n hence \"\\q \\ someVoteRcvd (\\ p). v = the (getvote (the (\\ p q)))\" using step[THEN spec, of p] last_obs\n by(auto simp add: next1_def x_update_def)\n thus ?thesis using send[THEN spec, of p]\n by(auto simp add: next1_def x_update_def someVoteRcvd_def isValVote_def \n send1_def get_msgs_benign msgRcvd_def restrict_map_def)\nqed\n\ndefinition D where\n \"D cfg cfg' \\ {p. decide (cfg' p) \\ decide (cfg p) }\"\n\nlemma decide_origin:\n assumes\n send: \"\\p. \\ p \\ get_msgs (send1 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next1 r p (cfg p) (\\ p) (cfg' p)\"\n and step_r: \"two_step r = Suc 0\"\n shows \n \"D cfg cfg' \\ {p. \\v. decide (cfg' p) = Some v \\ (\\q \\ HOs r p. agreed_vote (cfg q) = Some v)}\" \n using assms\n by(fastforce simp add: D_def next1_def get_msgs_benign send1_def msgRcvd_def o_def restrict_map_def\n x_update_def dec_update_def identicalVoteRcvd_def all_conj_distrib someVoteRcvd_def isValVote_def\n smallestValNoVoteRcvd_def)\n \nlemma step1_ref:\n \"{ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UNIV} \\r d_f o_f. tso_round1 r d_f o_f, \n UV_trans_step HOs HOs next1 send1 (Suc 0) {> ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs UV_trans_step_def two_step_step all_conj_distrib)\n fix sa r cfg \\ and cfg' :: \"process \\ val pstate\"\n assume\n R: \"(sa, (r, cfg)) \\ ref_rel\"\n and step_r: \"two_step r = Suc 0\" \n and send: \"\\p. \\ p \\ get_msgs (send1 r) cfg (HOs r) (HOs r) p\"\n and step: \"\\p. next1 r p (cfg p) (\\ p) (cfg' p)\"\n and ainv: \"sa \\ TSO_inv1\"\n and ainv2: \"sa \\ TSO_inv2\"\n\n from R have next_r: \"next_round sa = r\"\n by(simp add: ref_rel_def)\n\n define S where \"S = {p. \\v. agreed_vote (cfg p) = Some v}\"\n from R obtain v where v: \"\\p \\ S. agreed_vote (cfg p) = Some v\" using ainv step_r\n by(auto simp add: ref_rel_def TSO_inv1_def S_def two_step_step)\n\n define Ob where \"Ob = {p. last_obs (cfg' p) = v}\"\n define o_f where \"o_f p = (if S \\ Quorum then Some v else None)\" for p :: process\n\n define dec_f where \"dec_f p = (if p \\ D cfg cfg' then decide (cfg' p) else None)\" for p\n\n {\n fix p w\n assume \"agreed_vote (cfg p) = Some w\"\n hence \"w = v\" using v\n by(unfold S_def, auto)\n } note v'=this\n \n have d_guard: \"d_guard dec_f (agreed_vote \\ cfg)\" using per_rd[THEN spec, of r]\n by(fastforce simp add: d_guard_def locked_in_vf_def quorum_for_def dec_f_def\n UV_commPerRd_def dest!: decide_origin[OF send step step_r, THEN subsetD])\n\n have \"dom (agreed_vote \\ cfg) \\ Quorum \\ Ob = UNIV\"\n proof(auto simp add: Ob_def)\n fix p\n assume Q: \"dom (agreed_vote \\ cfg) \\ Quorum\" (is \"?Q \\ Quorum\")\n hence \"?Q \\ HOs r p \\ {}\" using per_rd[THEN spec, of r]\n by(auto simp add: UV_commPerRd_def dest: qintersect)\n hence \"someVoteRcvd (\\ p) \\ {}\" using send[THEN spec, of p]\n by(force simp add: someVoteRcvd_def get_msgs_benign msgRcvd_def restrict_map_def \n isValVote_def send1_def)\n moreover have \"\\q \\ someVoteRcvd (\\ p). \\x'. \\ p q = Some (ValVote x' (Some v))\"\n using send[THEN spec, of p]\n by(auto simp add: someVoteRcvd_def get_msgs_benign msgRcvd_def restrict_map_def\n isValVote_def send1_def dest: v')\n ultimately show \"last_obs (cfg' p) = v\" using step[THEN spec, of p]\n by(auto simp add: next1_def x_update_def)\n qed\n note Ob_UNIV=this[rule_format]\n\n have obs_guard: \"obs_guard o_f (agreed_vote \\ cfg)\"\n apply(auto simp add: obs_guard_def o_f_def S_def dom_def\n dest: v' Ob_UNIV quorum_non_empty) \n apply (metis S_def all_not_in_conv empty_not_quorum v)\n done\n\n define sa' where \"sa' = sa\\ \n next_round := Suc (next_round sa)\n , decisions := decisions sa ++ dec_f\n , opt_obsv_state.last_obs := opt_obsv_state.last_obs sa ++ o_f\n \\\"\n\n\n \\ \\Abstract step\\\n have abs_step: \"(sa, sa') \\ tso_round1 r dec_f o_f\" using next_r step_r R d_guard obs_guard\n by(auto simp add: tso_round1_def sa'_def ref_rel_def two_step_step)\n\n \\ \\Relation preserved\\\n have \"\\p. ((decide \\ cfg) ++ dec_f) p = decide (cfg' p)\"\n proof\n fix p\n show \"((decide \\ cfg) ++ dec_f) p = decide (cfg' p)\" using step[THEN spec, of p]\n by(auto simp add: dec_f_def D_def next1_def dec_update_def map_add_def)\n qed\n note dec_rel=this[rule_format]\n\n have \"\\p. (\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (last_obs (cfg' p)))\"\n proof(intro allI impI, cases \"S \\ Quorum\")\n fix p \n case True \n hence \"last_obs (cfg' p) = v\" using Ob_UNIV\n by(auto simp add: S_def Ob_def dom_def)\n thus \"(\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (last_obs (cfg' p)))\"\n using True\n by(auto simp add: o_f_def)\n next\n fix p\n case False\n hence empty: \"o_f = Map.empty\"\n by(auto simp add: o_f_def)\n note last_obs = x_origin2[OF send step step_r refl, of p]\n thus \"(\\q. o_f q = None \\ opt_obsv_state.last_obs sa q = None \n \\ (opt_obsv_state.last_obs sa ++ o_f) q = Some (last_obs (cfg' p)))\"\n proof(elim disjE exE)\n fix q\n assume \"last_obs (cfg q) = last_obs (cfg' p)\"\n from this[symmetric] show ?thesis using R step_r empty\n by(simp add: ref_rel_def two_step_step)\n next\n fix q\n assume \"agreed_vote (cfg q) = Some (last_obs (cfg' p))\" \n from this[symmetric] show ?thesis using R ainv2 step_r empty\n apply(auto simp add: ref_rel_def two_step_step TSO_inv2_def)\n by metis\n qed\n qed\n note obs_rel=this[rule_format]\n\n have post_rel: \n \"(sa', Suc r, cfg') \\ ref_rel\" using step send next_r R step_r\n by(auto simp add: sa'_def ref_rel_def two_step_step\n two_step_phase_Suc dec_rel obs_rel)\n \n from abs_step post_rel show\n \"\\sa'. (\\r d_f o_f. (sa, sa') \\ tso_round1 r d_f o_f) \\ (sa', Suc r, cfg') \\ ref_rel\"\n by blast\nqed\n\nlemma UV_Refines_votes:\n \"PO_refines (ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UV_inv1)\n tso_TS (UV_TS HOs HOs crds)\"\nproof(rule refine_using_invariants)\n show \"init (UV_TS HOs HOs crds) \\ ref_rel `` init tso_TS\"\n by(auto simp add: UV_TS_defs UV_HOMachine_def CHOAlgorithm.truncate_def \n tso_TS_defs ref_rel_def tso_init_def Let_def o_def)\nnext\n show \n \"{ref_rel \\ (TSO_inv1 \\ TSO_inv2) \\ UV_inv1} TS.trans tso_TS, \n TS.trans (UV_TS HOs HOs crds) {> ref_rel}\"\n apply(simp add: tso_TS_defs UV_TS_defs UV_HOMachine_def CHOAlgorithm.truncate_def)\n apply(auto simp add: CHO_trans_alt UV_trans intro!: step0_ref step1_ref)\n done\nqed(auto intro!: TSO_inv1_inductive TSO_inv2_inductive UV_inv1_inductive)\n\nend (* HO predicate context *)\n\nend (* mono_quorum context *)\n\nsubsubsection \\Termination\\\n(******************************************************************************)\n\ntext \\As the model of the algorithm is taken verbatim from the HO Model AFP, we\n do not repeat the termination proof here and refer to that AFP entry.\\\n\nend (* theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Consensus_Refined/Observing/Uv_Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.28192409314802624}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Properties of Total Correctness Hoare Logic *}\n\ntheory HoareTotalProps imports SmallStep HoareTotalDef HoarePartialProps begin\n\nsubsection {* Soundness *}\n\nlemma hoaret_sound: \n assumes hoare: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ \\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Skip \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ \\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Basic f \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Spec r ,Normal s\\ \\ t\" \n \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n thus \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Spec r \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ r\" and exec_c2: \"\\\\\\c2,r\\ \\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: Fault_end)\n from valid_c1 ctxt exec_c1 P this\n have r: \"r \\ Normal ` R \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: exec_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s\\P\"\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c1,Normal s\\ \\ r\"\n have \"\\\\c2 \\ r\"\n proof (cases r)\n case (Normal r')\n with cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"r\\Normal ` R\"\n by auto\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n show \"\\\\c2 \\ r\"\n by auto\n qed auto \n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ \\ t\"\n by cases auto\n with P True \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ \\ t\"\n by cases auto\n with P False \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n thus \"\\\\Cond b c1 c2 \\ Normal s\"\n using cvalidt_termD [OF valid_c1 ctxt] cvalidt_termD [OF valid_c2 ctxt]\n by (cases \"s \\ b\") (auto intro: terminates.intros)\n qed\nnext\n case (While r \\ F P b c A)\n assume wf: \"wf r\"\n have valid_c: \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n using While.hyps by iprover\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume wprems: \"\\\\\\While b c,Normal s\\ \\ t\" \"s \\ P\" \"t \\ Fault ` F\"\n from wf\n have \"\\t. \\\\\\\\While b c,Normal s\\ \\ t; s \\ P; t \\ Fault ` F\\ \n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (induct)\n fix s t\n assume hyp: \n \"\\s' t. \\(s',s)\\r; \\\\\\While b c,Normal s'\\ \\ t; s' \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n assume exec: \"\\\\\\While b c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume b: \"s\\b\"\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\" \n assume exec_w: \"\\\\\\While b c,s'\\ \\ t\"\n from exec_w t_notin_F have \"s' \\ Fault ` F\"\n by (auto dest: Fault_end)\n from exec_c P b valid_c ctxt this\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P) \\ Abrupt ` A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n show ?thesis\n proof (cases s')\n case Normal \n with exec_w s' t_notin_F\n show ?thesis\n by - (rule hyp,auto)\n next\n case Abrupt\n with exec_w have \"t=s'\"\n by (auto dest: Abrupt_end)\n with Abrupt s' show ?thesis\n by blast\n next\n case Fault\n with exec_w have \"t=s'\"\n by (auto dest: Fault_end)\n with Fault s' show ?thesis\n by blast\n next\n case Stuck\n with exec_w have \"t=s'\"\n by (auto dest: Stuck_end)\n with Stuck s' show ?thesis\n by blast\n qed\n next\n assume \"s\\b\" \"t=Normal s\" with P show ?thesis by simp\n qed\n qed\n with wprems show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\" by blast\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"s \\ P\"\n with wf \n show \"\\\\While b c \\ Normal s\"\n proof (induct)\n fix s\n assume hyp: \"\\s'. \\(s',s)\\r; s' \\ P\\ \n \\ \\\\While b c \\ Normal s'\"\n assume P: \"s \\ P\"\n show \"\\\\While b c \\ Normal s\"\n proof (cases \"s \\ b\")\n case False with P show ?thesis\n by (blast intro: terminates.intros)\n next\n case True\n with valid_c P ctxt\n have \"\\\\c \\ Normal s\"\n by (simp add: cvalidt_def validt_def)\n moreover\n {\n fix s'\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases s')\n case (Normal s'')\n with exec_c P True valid_c ctxt\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P)\"\n by (fastforce simp add: cvalidt_def validt_def valid_def)\n then show ?thesis\n by (blast intro: hyp)\n qed auto\n }\n ultimately\n show ?thesis\n by (blast intro: terminates.intros)\n qed\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ (g \\ P)\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec g have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ P\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (CallRec P p Q A Specs r Specs_wf \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have wf: \"wf r\" by fact\n have Specs_wf: \n \"Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s, q),\\,p) \\ r},q,Q,A)) ` Specs)\" by fact\n from CallRec.hyps\n have valid_body: \n \"\\(P, p, Q, A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) the (\\ p) Q,A)\" by auto\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof -\n {\n fix \\p \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n from wf\n have \"\\\\ p P Q A. \\\\p = (\\,p); (P,p,Q,A) \\ Specs\\ \\ \n \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ (p))) Q,A\" \n proof (induct \\p rule: wf_induct [rule_format, consumes 1, case_names WF])\n case (WF \\p \\ p P Q A)\n have \\p: \"\\p = (\\, p)\" by fact\n have p: \"(P, p, Q, A) \\ Specs\" by fact\n {\n fix q P' Q' A'\n assume q: \"(P',q,Q',A') \\ Specs\"\n have \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' \\ {s. ((s,q), \\,p) \\ r}) (Call q) Q',A'\"\n proof (rule validtI)\n fix s t\n assume exec_q: \n \"\\\\\\Call q,Normal s\\ \\ t\"\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from Pre q \\p\n have valid_bdy: \n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') the (\\ q) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from exec_q show \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ q = Some bdy\"\n assume exec_bdy: \"\\\\\\bdy,Normal s\\ \\ t\"\n from valid_bdy [simplified bdy option.sel] t_notin_F exec_bdy Pre'\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (auto simp add: validt_def valid_def)\n with Pre q \n show ?thesis\n by auto\n next\n assume \"\\ q = None\"\n with q valid_body have False by auto\n thus ?thesis ..\n qed\n next\n fix s\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n from Pre q \\p\n have valid_bdy: \n \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') (the (\\ q)) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from valid_bdy ctxt Pre'\n have \"\\\\the (\\ q) \\ Normal s\"\n by (auto simp add: validt_def)\n with valid_body q \n show \"\\\\Call q\\ Normal s\"\n by (fastforce intro: terminates.Call)\n qed\n }\n hence \"\\(P, p, Q, A)\\Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by (auto simp add: cvalidt_def Specs_wf)\n with ctxt have \"\\(P, p, Q, A)\\\\ \\ Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by auto\n with p valid_body \n show \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (simp add: cvalidt_def) blast\n qed\n }\n note lem = this\n have valid_body': \n \"\\\\. \\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A \\ \n \\(P,p,Q,A)\\Specs. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (auto intro: lem)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_call: \"\\\\\\Call p,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n from exec_body bdy p P t_notin_F \n valid_body' [of \"s\", OF ctxt] \n ctxt\n have \"t \\ Normal ` Q \\ Abrupt ` A\"\n apply (simp only: cvalidt_def validt_def valid_def) \n apply (drule (1) bspec)\n apply auto\n done\n with p P \n show ?thesis\n by simp\n next\n assume \"\\ p = None\"\n with p valid_body have False by auto\n thus ?thesis by simp\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\"\n show \"\\\\Call p \\ Normal s\"\n proof -\n from ctxt P p valid_body' [of \"s\",OF ctxt]\n have \"\\\\(the (\\ p)) \\ Normal s\"\n by (auto simp add: cvalidt_def validt_def)\n with valid_body p show ?thesis\n by (fastforce intro: terminates.Call)\n qed\n qed\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A\" by simp\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ \\ t\" \n from cvalidt_postD [OF valid_c [rule_format, OF P] ctxt this P t_notin_F]\n show ?thesis .\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\DynCom c \\ Normal s\"\n proof -\n from cvalidt_termD [OF valid_c [rule_format, OF P] ctxt P]\n have \"\\\\c s \\ Normal s\" .\n thus ?thesis\n by (rule terminates.intros)\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ \\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n next\n fix s\n show \"\\\\Throw \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt s'\" \n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ \\ t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cvalidt_postD [OF valid_c2 ctxt] exec_c2 t_notin_F\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" \n assume notAbr: \"\\ isAbr t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P] t_notin_F\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s\" \n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt r\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"Abrupt r\\Normal ` Q \\ Abrupt ` R\"\n by auto\n hence \"Abrupt r\\Abrupt ` R\" by fast\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n have \"\\\\c\\<^sub>2 \\ Normal r\"\n by fast\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt: \n \"\\s \\ P. (\\P' Q' A'. (\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\" by blast\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from adapt [rule_format, OF P]\n obtain P' and Q' and A' where \n valid_P'_Q': \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n and weaken: \"s \\ P'\" \"Q' \\ Q\" \"A'\\ A\"\n by blast\n from exec valid_P'_Q' ctxt t_notin_F\n have P'_Q': \"Normal s \\ Normal ` P' \\ \n t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (unfold cvalidt_def validt_def valid_def) blast\n hence \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by blast\n with weaken \n show ?thesis\n by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from P adapt\n obtain P' and Q' and A' where \n \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n \"s \\ P'\"\n by blast\n with ctxt\n show ?thesis\n by (simp add: cvalidt_def validt_def)\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n assume \"(P, p, Q, A) \\ \\\"\n then show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: cvalidt_def )\nnext\n case ExFalso thus ?case by iprover\nqed\n\nlemma hoaret_sound':\n\"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (drule hoaret_sound)\n apply (simp add: cvalidt_def)\n done\n\ntheorem total_to_partial: \n assumes total: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" shows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from total have \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_sound)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cvalidt_def validt_def cvalid_def)\n thus ?thesis\n by (rule hoare_complete)\nqed\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s} c \n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validtI) \n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\" \n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\ \n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n apply (cases t) \n apply (auto simp add: final_notin_def)\n done\nnext\n fix s\n assume \"s \\ {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n thus \"\\\\c\\Normal s\"\n by blast\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s}\n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n shows \"\\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT) \n apply (insert valid)\n apply (auto simp add: validt_def valid_def intro!: final_notinI)\n done\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\nlemma MGT_lemma:\n assumes MGT_Calls: \n \"\\p \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Skip \\ Normal s} \n Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Basic f \\ Normal s} \n Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Basic [THEN conseqPre]) \n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Spec r \\ Normal s} \n Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2) \n have hyp_c1: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s}\n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n have hyp_c2: \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s}\n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n from hyp_c1 \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Seq c1 c2\\Normal s} c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\ \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n elim: terminates_Normal_elim_cases \n intro: exec.intros)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s} \n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoaret.Seq )\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c2 \\ Normal t}\n c2 \n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (rule exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (rule exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2) \n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s} \n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\b) \n c1 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondTrue \n elim: terminates_Normal_elim_cases)\n moreover\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s} \n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\-b) \n c2 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondFalse \n elim: terminates_Normal_elim_cases)\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s} \n (Cond b c1 c2)\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Cond) \nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\"\n let ?A = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n let ?r = \"{(t,s). \\\\(While b c)\\Normal s \\ s\\b \\ \n \\\\\\c,Normal s\\ \\ Normal t}\"\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(While b c)\\Normal s} \n (While b c)\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"\\ Z. ?P' Z\" \n and ?Q'=\"\\ Z. ?P' Z \\ - b\"])\n have wf_r: \"wf ?r\" by (rule wf_terminates_while)\n show \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A Z)\"\n proof (rule allI, rule hoaret.While [OF wf_r])\n fix Z\n from While \n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n show \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ ?P' Z \\ b) c \n ({t. (t, \\) \\ ?r} \\ ?P' Z),(?A Z)\"\n proof (rule allI, rule ConseqMGT [OF hyp_c])\n fix \\ s\n assume \"s\\ {\\} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\n \\ b\"\n then obtain \n s_eq_\\: \"s=\\\" and\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n while_term: \"\\\\(While b c)\\Normal s\" and\n s_in_b: \"s\\b\" \n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal t} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (t,\\) \\ ?r} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b \n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\ \n \\\\(While b c)\\Normal t}) \\ \n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b while_term show ?C1 \n by (blast elim: terminates_Normal_elim_cases)\n next\n {\n fix t \n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n with s_eq_\\ while_term s_in_b have \"(t,\\) \\ ?r\"\n by blast\n moreover\n from Z_s_unroll s_t s_in_b \n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover from while_term s_t s_in_b \n have \"\\\\(While b c)\\Normal t\"\n by (blast elim: terminates_Normal_elim_cases)\n moreover note noabort\n ultimately \n have \"(t,\\) \\ ?r \\ (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\" \n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\While b c \\ Normal s}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\ \n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A s \\ t\\?A Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\" \n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\ \n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n \n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\" \n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body: \n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call p)\n from noStuck_Call\n have \"\\s \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal s}.\n p \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume p_defined: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \n \\\\\\Call p ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\\\Call p\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp: \n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c s'\\Normal s} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s} \n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp]) \n (fastforce simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Guard f g c\\ Normal s} \n Guard f g c \n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s \\ g \\ s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s} )\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Throw \\ Normal s}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>1 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \\\\c\\<^sub>2 \\ Normal t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n elim: terminates_Normal_elim_cases\n simp add: final_notin_def)\n moreover\n have \n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>2 \\ Normal s} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\ \\\\c\\<^sub>2 \\ Normal s \\ \n \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n simp add: noFault_def')\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Catch )\nqed\n\n\n\n\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step \n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n qed\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p, Normal \\) \\\\<^sup>+ (c',Normal s) \\ Throw \\ redexes c')}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp_c1:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ \n c\\<^sub>1 \\ redexes c')}\n c\\<^sub>1 \n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have hyp_c2:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\)\\\\<^sup>+(c',Normal s) \\\n Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault`(-F)) \\ \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\"\n proof (rule ConseqMGT [OF hyp_c1],clarify,safe) \n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c\\<^sub>1,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume c': \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n from steps redexes_subset [OF this]\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c\\<^sub>1 \\ redexes c'\"\n by (auto iff: root_in_redexes)\n next\n fix t\n assume \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c' t\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume red: \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal t) \\ c\\<^sub>2 \\ redexes c'\"\n proof -\n note steps_c'\n also\n from exec_impl_steps_Normal_Abrupt [OF exec_c\\<^sub>1]\n have \"\\\\ (c\\<^sub>1, Normal Z) \\\\<^sup>* (Throw, Normal t)\".\n from steps_redexes_Catch [OF this red] \n obtain c'' where\n steps_c'': \"\\\\ (c', Normal Z) \\\\<^sup>* (c'', Normal t)\" and\n Catch: \"Catch Throw c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps_c''\n also \n have step_Catch: \"\\\\ (Catch Throw c\\<^sub>2,Normal t) \\ (c\\<^sub>2,Normal t)\"\n by (rule step.CatchThrow)\n from step_redexes [OF step_Catch Catch]\n obtain c''' where\n step_c''': \"\\\\ (c'', Normal t) \\ (c''', Normal t)\" and\n c2: \"c\\<^sub>2 \\ redexes c'''\"\n by blast\n note step_c'''\n finally show ?thesis\n using c2\n by blast\n qed\n qed\n moreover\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp_c2]) (fastforce intro: exec.intros)\n ultimately show ?case\n by (rule hoaret.Catch)\nqed\n\n\ntext {* To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n *}\n\nlemma Call_lemma:\n assumes A: \n \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes pdef: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\\\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma' [OF A])\nusing pdef\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] root_in_redexes)\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\nusing p_defined\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] \nroot_in_redexes)\ndone\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext {* Another proof of @{text MGT_Call}, maybe a little more readable *}\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n def Specs == \"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n def Specs_wf == \"(\\p \\. (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs)\"\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format, OF _ defined])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\n\ntheorem hoaret_complete: \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Call])\n\nlemma hoaret_complete': \n assumes cvalid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_complete)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\nsubsection {* And Now: Some Useful Rules *}\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\(Call p),Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr, \n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p) ,Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also \n from exec_body bdy\n have \"\\\\\\Call p ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturnSameFaults_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\n\nsubsubsection {* DynCall *}\n\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.Call)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \n \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturn_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturnSameFaults_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\n assumes valid_Q: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_R: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n moreover\n from valid_R ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cvalidt_postD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nnext \n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from valid_Q ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n assumes deriv_R: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoaret_complete')\napply (rule PostConjI_sound)\napply (rule hoaret_sound [OF deriv_Q])\napply (rule hoaret_sound [OF deriv_R])\ndone\n\n\nlemma Merge_PostConj_sound: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n by (auto intro: validt_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cvalidt_postD [OF validF [rule_format] ctxt exec P t_noFault]\n have \"t \\ Normal ` Q \\ Abrupt ` A\".\n moreover from this have \"t \\ Fault ` G\"\n by auto\n from cvalidt_postD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n ultimately show ?thesis by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from validF ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\n\n\nlemma Merge_PostConj: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoaret_complete')\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoaret_sound)\nusing validG apply (blast intro:hoaret_sound)\ndone\n\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\n assumes valid_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes valid_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def) \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case Abrupt\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case (Fault f)\n assume t: \"t=Fault f\"\n with exec inter_guards_exec_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f\"\n from cvalidt_postD [OF valid_c1 ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n from cvalidD [OF valid_c2 ctxt' this P] t t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1 \\ Normal s\"\n by (rule cvalidt_termD)\n with c show ?thesis\n by (rule inter_guards_terminates)\n qed\nqed\n\nlemma SplitGuards: \n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SplitGuards_sound [OF _ _ c])\napply (rule hoaret_sound [OF deriv_c1])\napply (rule hoare_sound [OF deriv_c2])\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n from ctxt have ctxt'': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt'' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt'' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ \\ Fault f\" \n by (auto intro: exec_to_exec_strip_guards_Fault)\n from cvalidD [OF valid_strip ctxt' this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt'' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt'' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule CombineStrip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n from ctxt have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cvalidD [OF validFlip ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\n\nlemma GuardsFlip: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule GuardsFlip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\mark_guards f c,Normal s\\ \\ t\" \n from exec_mark_guards_to_exec [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\mark_guards f c \\ Normal s\"\n by (rule terminates_to_terminates_mark_guards)\nqed\n\nlemma MarkGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\n\nlemma MarkGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with exec_to_exec_mark_guards_Fault exec\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from exec_to_exec_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n by auto\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\mark_guards f c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_mark_guards_to_terminates)\nqed\n\nlemma MarkGuardsD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\"\n from exec_merge_guards_to_exec [OF exec_merge] \n have exec: \"\\\\\\c,Normal s\\ \\ t\" .\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\merge_guards c \\ Normal s\"\n by (rule terminates_to_terminates_merge_guards)\nqed\n\nlemma MergeGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoaret_complete')\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_merge_guards [OF exec] \n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\".\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\merge_guards c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_merge_guards_to_terminates)\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have termi_c': \"\\\\c' \\ Normal s\".\n from cvalidt_postD [OF valid ctxt _ P]\n have noFault_c': \"\\\\\\c',Normal s\\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def)\n from termi_c' c_c' noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule terminates_fewer_guards)\nqed\n\nlemma SubsetGuards: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n hence exec_norm: \"\\\\\\normalize c,Normal s\\ \\ t\" \n by (rule exec_to_exec_normalize)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\normalize c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_normalize_to_terminates)\nqed\n\nlemma NormalizeD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume \"\\\\\\normalize c,Normal s\\ \\ t\" \n hence exec: \"\\\\\\c,Normal s\\ \\ t\" \n by (rule exec_normalize_to_exec)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\ c \\ Normal s\".\n thus \"\\\\normalize c \\ Normal s\"\n by (rule terminates_to_terminates_normalize)\nqed\n\nlemma NormalizeI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma validt_restrict_to_validt:\nassumes validt_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from validt_c\n have valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\" by (simp add: validt_def)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule valid_restrict_to_valid)\n moreover\n {\n fix s\n assume P: \"s \\ P\"\n have \"\\\\c\\Normal s\"\n proof -\n from P validt_c have \"\\|\\<^bsub>M\\<^esub>\\c\\Normal s\"\n by (auto simp add: validt_def)\n moreover\n from P valid_c\n have \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\\\{Stuck}\"\n by (auto simp add: valid_def final_notin_def)\n ultimately show ?thesis\n by (rule terminates_restrict_to_terminates)\n qed\n }\n ultimately show ?thesis\n by (auto simp add: validt_def)\nqed\n\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_restrict_to_validt)\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nsubsubsection {* Miscellaneous *}\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_augment_Faults [OF _ F])\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nlemma TerminationPartial_sound:\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n assumes partial_corr: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing \"termination\" partial_corr \nby (auto simp add: cvalidt_def validt_def cvalid_def)\n\nlemma TerminationPartial:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete')\n apply (rule TerminationPartial_sound [OF \"termination\"])\n apply (rule hoare_sound [OF partial_deriv])\n done\n\nlemma TerminationPartialStrip:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. strip F' \\\\strip_guards F' c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from \"termination\" have \"\\s \\ P. \\\\c\\Normal s\"\n by (auto intro: terminates_strip_guards_to_terminates \n terminates_strip_to_terminates)\n with partial_deriv\n show ?thesis\n by (rule TerminationPartial)\nqed\n\nlemma SplitTotalPartial:\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nlemma SplitTotalPartial':\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/HoareTotalProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.28190908746506377}} {"text": "theory Simple_Network_Language_Impl\n imports\n Simple_Network_Language\n TA_Impl.Normalized_Zone_Semantics_Impl_Refine\n \"HOL-Library.IArray\" \"HOL-Library.AList\"\n TA_Library.More_Methods\n TA_Library.Bijective_Embedding\n TA_Impl_Misc2\n TA_More2\n TA_Equivalences\n \"HOL-Eisbach.Eisbach_Tools\"\n TA_Library.Syntax_Bundles\nbegin\n\nunbundle no_library_syntax\n\nparagraph \\Default maps\\\n\ndefinition default_map_of :: \"'b \\ ('a \\ 'b) list \\ 'a \\ 'b\" where\n \"default_map_of a xs \\ FinFun.map_default a (map_of xs)\"\n\nlemma default_map_of_alt_def:\n \"default_map_of a xs x = (if x \\ dom (map_of xs) then the (map_of xs x) else a)\"\n unfolding default_map_of_def map_default_def by (auto split: option.split_asm)\n\nlemma range_default_map_of:\n \"range (default_map_of x xs) \\ snd ` set xs \\ {x}\"\n unfolding default_map_of_def map_default_def\n by (auto split: option.split_asm) (meson img_snd map_of_SomeD)\n\nlemma finite_range_default_map_of:\n \"finite (range (default_map_of x m))\"\nproof -\n have \"range (default_map_of x m) \\ the ` range (map_of m) \\ {x}\"\n unfolding default_map_of_def FinFun.map_default_def\n by (auto split: option.splits) (metis image_eqI option.sel rangeI)\n also have \"finite \\\"\n by (blast intro: finite_range_map_of)\n finally show ?thesis .\nqed\n\nlemma map_index'_inj:\n \"L = L'\"\n if \"length L = length L'\" \"map_index' n f L = map_index' n g L'\" \"set L \\ S\" \"set L' \\ T\"\n \"\\ i < length L + n. \\ x \\ S. \\y \\ T. f i x = g i y \\ x = y\"\n using that\nproof (induction \"length L\" arbitrary: L L' n)\n case 0\n then show ?case\n by simp\nnext\n case (Suc x)\n from Suc.prems obtain a b L1 L1' where *:\n \"length L1 = x\" \"length L1' = x\" \"L = a # L1\" \"L' = b # L1'\"\n by (smt Suc.hyps(2) length_Suc_conv)\n show ?case\n unfolding \\L = _\\ \\L' = _\\\n apply (clarsimp, rule conjI)\n subgoal\n by (smt *(3,4) Suc.hyps(2) Suc.prems Suc_less_eq add_Suc_shift less_add_Suc2 list.set_intros(1) list_tail_coinc map_index'.simps(2) set_mp)\n subgoal\n apply (rule Suc.hyps)\n using Suc.prems * by auto\n done\nqed\n\nlemma map_index_inj:\n \"L = L'\"\n if \"map_index f L = map_index g L'\" \"set L \\ S\" \"set L' \\ T\"\n \"\\ i < length L. \\ x \\ S. \\y \\ T. f i x = g i y \\ x = y\"\n using that by - (rule map_index'_inj, auto dest: map_index_eq_imp_length_eq)\n\nlemma map_index_inj1:\n \"L = L'\"\n if \"map_index f L = map_index g L'\"\n \"\\ i < length L. f i (L ! i) = g i (L' ! i) \\ L ! i = L' ! i\"\nproof (intros add: nth_equalityI)\n from that(1) show \\length L = length L'\\\n by (rule map_index_eq_imp_length_eq)\n fix i :: \\nat\\\n assume \\i < length L\\\n with that have \"map_index f L ! i = map_index g L' ! i\"\n by auto\n with \\i < length L\\ \\length L = length L'\\ have \"f i (L ! i) = g i (L' ! i)\"\n by simp\n with \\i < length L\\ that(2) show \\L ! i = L' ! i\\\n by simp\nqed\n\nlemma map_index_update:\n \"map_index f (xs[i := a]) = (map_index f xs)[i := f i a]\"\n by (rule nth_equalityI) (auto simp: nth_list_update')\n\nlemma map_trans_broad_aux1:\n \"map_index map_loc (fold (\\p L. L[p := ls' p]) ps L) =\n fold (\\p L. L[p := map_loc p (ls' p)]) ps (map_index map_loc L)\"\n by (induction ps arbitrary: L) (auto simp: map_index_update)\n\nlemma InD2:\n fixes map_action\n assumes \"inj map_action\" \"In (map_action a) = map_act map_action a'\"\n shows \"a' = In a\"\n using assms(2) by (cases a') (auto simp: injD[OF assms(1)])\n\nlemma OutD2:\n fixes map_action\n assumes \"inj map_action\" \"Out (map_action a) = map_act map_action a'\"\n shows \"a' = Out a\"\n using assms(2) by (cases a') (auto simp: injD[OF assms(1)])\n\nlemma (in Prod_TA_Defs) trans_broad_alt_def:\n \"trans_broad =\n {((L, s), g @ concat (map gs ps), Broad a, r @ concat (map rs ps), (L', s'')) |\n L s L' s' s'' a p l b g f r l' bs gs fs rs ls' ps.\n a \\ broadcast \\\n (l, b, g, Out a, f, r, l') \\ trans (N p) \\\n (\\p \\ set ps. (L ! p, bs p, gs p, In a, fs p, rs p, ls' p) \\ trans (N p)) \\\n (l \\ committed (N p) \\ (\\p \\ set ps. L ! p \\ committed (N p))\n \\ (\\p < n_ps. L ! p \\ committed (N p))) \\\n (\\q < n_ps. q \\ set ps \\ p \\ q \\\n \\ (\\b g f r l'. (L!q, b, g, In a, f, r, l') \\ trans (N q) \\ check_bexp s b True)) \\\n L!p = l \\\n p < length L \\ set ps \\ {0.. p \\ set ps \\ distinct ps \\ sorted ps \\\n check_bexp s b True \\ (\\p \\ set ps. check_bexp s (bs p) True) \\\n L' = (fold (\\p L . L[p := ls' p]) ps L)[p := l'] \\\n is_upd s f s' \\ is_upds s' (map fs ps) s'' \\\n L \\ states \\ bounded bounds s \\ bounded bounds s'' \\\n (\\p. p\\set ps \\ bs p = bexp.true) \\ (\\p. p\\set ps \\ gs p = []) \\\n (\\p. p\\set ps \\ fs p = []) \\ (\\p. p\\set ps \\ rs p = [])\n }\"\n unfolding trans_broad_def\nproof ((intro Collect_eqI iffI; elims add: more_elims), goal_cases)\n case prems: (1 x L s L' s' s'' a p l b g f r l' bs gs fs rs ls' ps)\n let ?f = \"\\gs p. if p \\ set ps then gs p else []\"\n let ?bs = \"\\p. if p \\ set ps then bs p else bexp.true\"\n let ?gs = \"?f gs\" let ?fs = \"?f fs\" let ?rs = \"?f rs\"\n have [simp]: \"map gs ps = map ?gs ps\" \"map rs ps = map ?rs ps\" \"map fs ps = map ?fs ps\"\n by (simp cong: map_cong)+\n with prems show ?case\n by (inst_existentials L s L' s' s'' a p l b g f r l' ?bs ?gs ?fs ?rs ls' ps; (assumption | simp))\nnext\n case (2 x L s L' s' s'' a p l b g f r l' bs gs fs rs ls' ps)\n then show ?case\n by blast\nqed\n\n(* XXX Move to distribution *)\ntext \\Stronger version of @{thm Map.map_of_mapk_SomeI}\\\ntheorem map_of_mapk_SomeI':\n assumes \"inj_on f (fst ` set t)\"\n and \"map_of t k = Some x\"\n shows \"map_of (map (\\(k, y). (f k, g y)) t) (f k) = Some (g x)\"\n using assms\n apply (induction t)\n apply (auto split: if_split_asm)\n apply (metis DiffI imageI img_fst map_of_SomeD singletonD)\n done\n\ntheorem map_of_mapk_SomeI:\n assumes \"inj f\"\n and \"map_of t k = Some x\"\n shows \"map_of (map (\\(k, y). (f k, g y)) t) (f k) = Some (g x)\"\n using assms by - (rule map_of_mapk_SomeI', erule inj_on_subset, auto)\n\n\ndefinition\n \"conv_automaton \\ \\(committed, urgent, trans, inv).\n (committed,\n urgent,\n map (\\(l, b, g, a, f, r, l'). (l, b, conv_cc g, a, f, r, l')) trans,\n map (\\(s, cc). (s, conv_cc cc)) inv)\"\n\ndefinition\n \"automaton_of \\\n \\(committed, urgent, trans, inv). (set committed, set urgent, set trans, default_map_of [] inv)\"\n\nlocale Simple_Network_Impl_Defs =\n fixes automata ::\n \"('s list \\ 's list \\ ('a act, 's, 'c, 't, 'x, int) transition list\n \\ ('s \\ ('c, 't) cconstraint) list) list\"\n and broadcast :: \"'a list\"\n and bounds' :: \"('x \\ (int \\ int)) list\"\nbegin\n\ndefinition \\\\Number of state variables\\\n \"n_vs = length bounds'\"\n\ndefinition\n \"B x \\ if x \\ dom (map_of bounds') then the (map_of bounds' x) else (0, 0)\"\n\nsublocale Prod_TA_Defs\n \"(set broadcast, map automaton_of automata, map_of bounds')\" .\n\nlemma L_len[intro, dest]:\n \"length L = n_ps\" if \"L \\ states\"\n using that unfolding states_def by simp\n\nend\n\n(*\nlocale Simple_Network_Impl =\n Simple_Network_Impl_Defs automata broadcast bounds\n for\n automata ::\n \"('s list \\ ('a act, 's, 'c, int, 'x, int) transition list\n \\ ('s \\ ('c, int) cconstraint) list) list\"\n and broadcast bounds\n*)\n\nlocale Simple_Network_Impl =\n fixes automata ::\n \"('s list \\ 's list \\ ('a act, 's, 'c, int, 'x, int) transition list\n \\ ('s \\ ('c, int) cconstraint) list) list\"\n and broadcast :: \"'a list\"\n and bounds' :: \"('x \\ (int \\ int)) list\"\nbegin\n\nsublocale Simple_Network_Impl_Defs automata broadcast bounds' .\n\nend\n\n\nparagraph \\Mapping through the product construction\\\n\nlemma f_the_inv_f:\n \"f (the_inv f x) = x\" if \"inj f\" \"x \\ range f\"\n using that by (auto simp: the_inv_f_f)\n\ncontext Simple_Network_Impl\nbegin\n\nlemma N_eq:\n \\N i = automaton_of (automata ! i)\\ if \\i < n_ps\\\n using that unfolding N_def n_ps_def fst_conv snd_conv by (intro nth_map; simp)\n\n(* XXX Remove? *)\nlemma covn_N_eq:\n \\N i = automaton_of (automata ! i)\\ if \\i < n_ps\\\n using that unfolding N_def n_ps_def fst_conv snd_conv by (intro nth_map; simp)\n\nend\n\ninductive_cases check_bexp_elims:\n \"check_bexp s bexp.true bv\"\n \"check_bexp s (bexp.not b) bv\"\n \"check_bexp s (bexp.and b1 b2) bv\"\n \"check_bexp s (bexp.or b1 b2) bv\"\n \"check_bexp s (bexp.imply b1 b2) bv\"\n \"check_bexp s (le i x) bv\"\n \"check_bexp s (lt i x) bv\"\n \"check_bexp s (ge i x) bv\"\n \"check_bexp s (eq i x) bv\"\n \"check_bexp s (gt i x) bv\"\n\ninductive_cases is_val_elims:\n \"is_val s (const c) d\"\n \"is_val s (var x) v\"\n \"is_val s (if_then_else b e1 e2) v\"\n \"is_val s (binop f e1 e2) v\"\n \"is_val s (unop f e) v\"\n\nmethod fprem =\n (match premises in R: _ \\ \\rule R[elim_format]\\, assumption)\n\ncontext Simple_Network_Impl\nbegin\n\nparagraph \\Conversion from integers to reals commutes with product construction.\\\n\nsublocale conv: Prod_TA_Defs\n \"(set broadcast, map (Simple_Network_Language.conv_A o automaton_of) automata, map_of bounds')\" .\n\nlemma (in -) conv_ac_inj:\n \"ac = ac'\" if \"conv_ac ac = conv_ac ac'\"\n using that by (cases ac; cases ac'; auto)\n\nlemma (in -) conv_cc_inj:\n \"cc = cc'\" if \"conv_cc cc = conv_cc cc'\"\n using that by (subst (asm) inj_map_eq_map) (auto simp add: conv_ac_inj intro: injI)\n\ncontext\nbegin\n\nlemma conv_alt_def:\n \"conv (set broadcast, map automaton_of automata, map_of bounds') =\n (set broadcast, map (Simple_Network_Language.conv_A o automaton_of) automata, map_of bounds')\"\n unfolding conv_def by simp\n\nprivate lemma 2:\n \"Simple_Network_Language.conv_A o automaton_of = (\\(committed, urgent, trans, inv).\n (set committed,\n set urgent,\n set (map Simple_Network_Language.conv_t trans),\n default_map_of [] (map (\\ (l, g). (l, conv_cc g)) inv)))\"\n apply (rule ext)\n apply clarsimp\n unfolding Simple_Network_Language.conv_A_def automaton_of_def\n apply (clarsimp split: prod.split)\n unfolding default_map_of_def\n unfolding FinFun.map_default_def\n apply (rule ext)\n subgoal for xs a\n by (induction xs) auto\n done\n\nlemma conv_n_ps_eq:\n \"conv.n_ps = n_ps\"\n by (simp add: Prod_TA_Defs.n_ps_def)\n\nlemma conv_N_eq:\n \"conv.N i = Simple_Network_Language.conv_A (N i)\" if \"i < n_ps\"\n using that unfolding n_ps_def Prod_TA_Defs.N_def fst_conv snd_conv by (subst nth_map | simp)+\n\nprivate lemma 5:\n \"inv (conv.N i) = conv_cc o (inv (N i))\" if \"i < n_ps\"\n unfolding conv_N_eq[OF that] unfolding Simple_Network_Language.conv_A_def\n by (simp split: prod.split add: inv_def)\n\nlemma trans_conv_N_eq:\n \"trans (conv.N i) = Simple_Network_Language.conv_t ` (trans (N i))\" if \"i < n_ps\"\n unfolding conv_N_eq[OF that] unfolding Simple_Network_Language.conv_A_def\n by (simp split: prod.split add: trans_def)\n\nprivate lemma 71:\n \"(l, b, conv_cc g, a, r, u, l')\\Simple_Network_Language.trans (conv.N i)\"\n if \"(l, b, g, a, r, u, l')\\Simple_Network_Language.trans (N i)\" \"i < n_ps\"\n using that by (force simp add: trans_conv_N_eq Simple_Network_Language.conv_t_def)\n\nprivate lemma 72:\n \"(l, b, conv_cc g, a, r, u, l')\\Simple_Network_Language.trans (conv.N i)\n\\ (l, b, g, a, r, u, l')\\Simple_Network_Language.trans (N i)\" if \"i < n_ps\"\n by (auto simp: trans_conv_N_eq[OF that] Simple_Network_Language.conv_t_def\n dest: conv_cc_inj intro: image_eqI[rotated])\n\nprivate lemma 73:\n \"\\g'. g = conv_cc g' \\ (l, b, g', a, r, u, l')\\Simple_Network_Language.trans (N i)\"\n if \"(l, b, g, a, r, u, l')\\Simple_Network_Language.trans (conv.N i)\" \"i < n_ps\"\n using that by (force simp: trans_conv_N_eq Simple_Network_Language.conv_t_def)\n\nlemma conv_bounds[simp]:\n \"conv.bounds = bounds\"\n unfolding conv.bounds_def bounds_def by simp\n\nlemma conv_states[simp]:\n \"conv.states = states\"\n unfolding conv.states_def states_def conv_n_ps_eq\n by (auto simp add: trans_conv_N_eq Simple_Network_Language.conv_t_def) (fastforce, force)\n\nprivate lemma 9:\n \"committed (conv.N p) = committed (N p)\" if \\p < n_ps\\\n unfolding conv_N_eq[OF that] unfolding Simple_Network_Language.conv_A_def\n by (simp split: prod.split add: committed_def)\n\nprivate lemma 10:\n \"conv.broadcast = set broadcast\"\n unfolding conv.broadcast_def by simp\n\nlemma conv_trans_int:\n \"conv.trans_int = (\\(l, g, a, r, l'). (l, map conv_ac g, a, r, l')) ` trans_int\"\n unfolding conv.trans_int_def trans_int_def\n supply [simp] = L_len\n apply standard\n subgoal\n by (clarsimp simp: Simple_Network_Language.conv_t_def conv_n_ps_eq trans_conv_N_eq 9)\n (intros add: more_intros, solve_triv+)\n subgoal\n by (rule subsetI,\n clarsimp simp: Simple_Network_Language.conv_t_def conv_n_ps_eq trans_conv_N_eq 9[symmetric])\n ((drule (1) 71)+, intros add: more_intros, solve_triv+)\n done\n\nlemma conv_trans_bin:\n \"conv.trans_bin = (\\(l, g, a, r, l'). (l, map conv_ac g, a, r, l')) ` trans_bin\"\n unfolding conv.trans_bin_def trans_bin_def 10 broadcast_def\n supply [simp] = L_len\n apply standard\n subgoal\n by (clarsimp simp add: Simple_Network_Language.conv_t_def conv_n_ps_eq trans_conv_N_eq 9)\n (intros add: more_intros, solve_triv+)\n subgoal\n by (rule subsetI,\n clarsimp simp: Simple_Network_Language.conv_t_def conv_n_ps_eq trans_conv_N_eq 9[symmetric])\n ((drule (1) 71)+, intros add: more_intros, solve_triv+)\n done\n\nlemma n_ps_rangeD:\n \"p < n_ps\" if \"p \\ set ps\" \"set ps \\ {0..g f r l'.\n (L ! q, b, g, In a', f, r, l')\n \\ (\\(l, b, g, a, f, r, l').\n (l, b, map conv_ac g, a, f, r, l')) ` trans (N q)) \\ \\ check_bexp s b True\" if\n \"\\q set ps \\ p \\ q \\ (\\b. (\\g f r l'.\n (L ! q, b, g, In a', f, r, l') \\ trans (N q)) \\ \\ check_bexp s b True)\"\n \"q set ps\" \"p \\ q\"\n for b ps p q L a' s using that by fastforce\n\nlemma conv_trans_broad:\n \"conv.trans_broad = (\\(l, g, a, r, l'). (l, map conv_ac g, a, r, l')) ` trans_broad\"\n unfolding conv.trans_broad_alt_def trans_broad_alt_def\n apply standard\n supply [simp] = L_len\n subgoal\n proof -\n have **: \"\\ gs'. gs = conv_cc o gs' \\\n (\\p\\set ps.(L ! p, bs p, gs' p, In a, fs p, rs p, ls' p) \\ trans (N p))\"\n if assms:\n \"\\p\\set ps. (L ! p, bs p, gs p, In a, fs p, rs p, ls' p) \\ trans (conv.N p)\"\n \"set ps \\ {0..p. p \\ set ps \\ gs p = []\"\n for L ps bs gs a fs rs ls'\n proof -\n have *: \"gs p = conv_cc (Hilbert_Choice.inv conv_cc (gs p))\" if \"p \\ set ps\" for p\n using that assms by (auto 4 3 simp: f_inv_into_f dest!: 73)\n show ?thesis\n apply (inst_existentials \"Hilbert_Choice.inv conv_cc o gs\")\n subgoal\n apply (rule ext)\n subgoal for p\n apply (cases \"p \\ set ps\")\n subgoal\n by (simp, erule *)\n subgoal\n using that(3) by (auto intro: injI inv_f_eq conv_ac_inj)\n done\n done\n subgoal\n using that * by (force dest!: conv_cc_inj 73)\n done\n qed\n have *: \"set ps \\ {0.. (\\p \\ set ps. p < n_ps)\" for ps\n by auto\n have maximalI:\n \"\\q set ps \\ p \\ q \\ (\\b. (\\g f r l'.\n (L ! q, b, g, In a', f, r, l') \\ trans (N q)) \\ \\ check_bexp s b True)\" if\n \"\\q set ps \\ p \\ q \\ (\\b. (\\g f r l'.\n (L ! q, b, g, In a', f, r, l') \\ trans (conv.N q)) \\ \\ check_bexp s b True)\"\n for ps p L a' s\n using that by (blast dest!: 71)\n show ?thesis\n apply (rule subsetI)\n apply (clarsimp simp add: conv_n_ps_eq 9 10 broadcast_def split: prod.split_asm)\n apply (drule (2) **)\n apply (drule (1) 73)+\n apply elims\n apply (intro image_eqI[rotated] CollectI exI conjI)\n apply solve_triv+\n subgoal premises prems \\\\Commited\\\n using prems(2) \\set _ \\ {0.. by (auto dest: n_ps_rangeD simp: 9)\n apply (erule maximalI; fail) \\\\Maximal set\\\n by solve_triv+ (simp split: prod.split add: map_concat)\n qed\n subgoal\n apply (rule subsetI)\n apply (clarsimp simp:\n Simple_Network_Language.conv_t_def\n conv_n_ps_eq trans_conv_N_eq 9[symmetric] 10 broadcast_def map_concat)\n apply (drule (1) 71)\n apply (intros add: more_intros)\n apply solve_triv+\n apply (subst comp_def; rule 71; fast elim: n_ps_rangeD; fail)\n subgoal premises prems for L s s' s'' aj p g f r l' gs fs rs ls' ps\n using prems(3,6) 9 by fastforce\n apply (erule maximalD)\n apply (solve_triv | blast)+\n done\n done\n\nlemma conv_prod_ta:\n \"conv.prod_ta = Normalized_Zone_Semantics_Impl.conv_A prod_ta\"\n unfolding conv.prod_ta_def prod_ta_def\n unfolding conv.trans_prod_def trans_prod_def\n unfolding conv.prod_inv_def prod_inv_def\n unfolding conv.N_def N_def conv_n_ps_eq\n unfolding conv_A_def\n apply simp\n apply (rule conjI)\n subgoal\n unfolding image_Un\n by ((fo_rule arg_cong2)+; rule conv_trans_int conv_trans_bin conv_trans_broad)\n subgoal \\\\Invariant\\\n unfolding conv.N_def N_def\n by (rule ext) (auto simp: 5 map_concat intro!: map_cong arg_cong[where f = concat])\n done\n\nend (* Anonymous context for private lemmas *)\n\nparagraph \\Fundamentals\\\n\ndefinition \"clkp_set' \\\n (\\ A \\ set automata. \\ g \\ set (snd (snd (snd A))). collect_clock_pairs (snd g))\n \\ (\\ A \\ set automata. \\ (l, b, g, _) \\ set (fst (snd (snd A))). collect_clock_pairs g)\"\n\ndefinition clk_set' where\n \\clk_set' =\n fst ` clkp_set' \\\n (\\ A \\ set automata. \\ (_, _, _, _, _, r, _) \\ set (fst (snd (snd A))). set r)\\\n\nlemma (in -) default_map_of_in_listD:\n \"x \\ \\ (set ` snd ` set invs)\" if \"x \\ set (default_map_of [] invs l)\"\nproof -\n have \"[] \\ default_map_of [] invs l\"\n using that by force\n then have \"default_map_of [] invs l \\ snd ` set invs\"\n by (metis (no_types) UNIV_I Un_insert_right range_default_map_of[of \"[]\" \"invs\"]\n image_eqI insertE subsetCE sup_bot.right_neutral)\n with that show ?thesis\n by blast\nqed\n\nlemma collect_clock_pairs_invsI:\n \"(a, b) \\ \\ ((collect_clock_pairs o snd) ` set invs)\"\n if \"(a, b) \\ collect_clock_pairs (default_map_of [] invs l)\"\n using that unfolding collect_clock_pairs_def by (auto dest!: default_map_of_in_listD)\n\nlemma mem_trans_N_iff:\n \"t \\ Simple_Network_Language.trans (N i) \\ t \\ set (fst (snd (snd (automata ! i))))\"\n if \"i < n_ps\"\n unfolding N_eq[OF that] by (auto split: prod.splits simp: automaton_of_def trans_def)\n\nlemma length_automata_eq_n_ps:\n \"length automata = n_ps\"\n unfolding n_ps_def by simp\n\nlemma clkp_set'_subs:\n \"Timed_Automata.clkp_set prod_ta \\ clkp_set'\"\n unfolding Timed_Automata.clkp_set_def clkp_set'_def\n apply (rule union_subsetI)\n subgoal\n unfolding Timed_Automata.collect_clki_def inv_of_prod prod_inv_def\n apply (auto simp: collect_clock_pairs_concat)\n apply (subst (asm) N_eq)\n apply assumption\n subgoal for a b L i\n apply (inst_existentials \"automata ! i\")\n subgoal\n unfolding automaton_of_def\n by (force dest!: nth_mem collect_clock_pairs_invsI\n split: prod.split_asm simp: inv_def Prod_TA_Defs.n_ps_def)\n done\n done\n subgoal\n apply simp\n unfolding trans_prod_def Timed_Automata.collect_clkt_def\n apply safe\n subgoal\n unfolding trans_int_def by (fastforce simp: length_automata_eq_n_ps mem_trans_N_iff)\n subgoal\n unfolding trans_bin_def\n by (fastforce\n simp: length_automata_eq_n_ps mem_trans_N_iff\n dest!: collect_clock_pairs_append_cases)\n subgoal\n unfolding trans_broad_def\n apply (clarsimp simp: length_automata_eq_n_ps mem_trans_N_iff)\n apply (drule collect_clock_pairs_append_cases)\n unfolding collect_clock_pairs_concat\n apply auto\n apply (fastforce simp: length_automata_eq_n_ps mem_trans_N_iff)+\n done\n done\n done\n\nlemma collect_clkvt_subs:\n \"collect_clkvt (trans_of prod_ta) \\\n (\\ A \\ set automata. \\ (_, _, _, _, _, r, _) \\ set (fst (snd (snd A))). set r)\"\n apply simp\n unfolding collect_clkvt_def\n apply auto\n unfolding trans_prod_def\n subgoal\n apply simp\n unfolding trans_prod_def Timed_Automata.collect_clkt_def\n apply safe\n subgoal\n unfolding trans_int_def\n by (fastforce\n simp: length_automata_eq_n_ps mem_trans_N_iff\n dest!: collect_clock_pairs_append_cases)\n subgoal\n unfolding trans_bin_def\n by (fastforce\n simp: length_automata_eq_n_ps mem_trans_N_iff\n dest!: collect_clock_pairs_append_cases)\n subgoal\n unfolding trans_broad_def\n apply (clarsimp simp: length_automata_eq_n_ps mem_trans_N_iff)\n unfolding collect_clock_pairs_concat\n apply safe\n apply (fastforce simp: length_automata_eq_n_ps mem_trans_N_iff)+\n done\n done\n done\n\nlemma clk_set'_subs: \"clk_set prod_ta \\ clk_set'\"\n using collect_clkvt_subs clkp_set'_subs unfolding clk_set'_def by auto\n\nend (* Simple Network Impl *)\n\n\nlemma (in Prod_TA_Defs) finite_range_invI:\n \"finite (range prod_inv)\" if assms: \"\\ i < n_ps. finite (range (inv (N i)))\"\nproof -\n let ?N = \"\\ (range ` inv ` N ` {0.. ?N \\ length I \\ n_ps}\"\n have \"finite ?N\"\n using assms by auto\n then have \"finite ?X\"\n by (rule finite_lists_length_le)\n moreover have \"range prod_inv \\ concat ` ?X \\ {[]}\"\n proof\n fix x assume \"x \\ range prod_inv\"\n then consider L where \"x = concat (map (\\p. (inv (N p)) (L ! p)) [0.. concat ` ?X \\ {[]}\"\n by (cases; force)\n qed\n ultimately show ?thesis by - (drule finite_subset; auto)\nqed\n\ndefinition (in Prod_TA_Defs)\n \"loc_set =\n (\\ {fst ` trans (N p) | p. p < n_ps} \\\n \\ {(snd o snd o snd \\ snd \\ snd \\ snd) ` trans (N p) | p. p < n_ps})\"\n\nlemma (in Prod_TA_Defs) states_loc_set:\n \"states \\ {L. set L \\ loc_set \\ length L = n_ps}\"\n unfolding states_def loc_set_def\n apply (intros add: more_intros)\n apply (elims add: more_elims)\n apply (drule mem_nth)\n apply simp\n apply (elims add: allE, assumption)\n apply (simp split: prod.split_asm)\n apply (erule disjE; (intros add: disjI1 disjI2 more_intros, solve_triv+); fail)\n by (elims add: more_elims)\n\nlemma (in Prod_TA_Defs) finite_states:\n assumes finite_trans: \"\\p < n_ps. finite (Simple_Network_Language.trans (N p))\"\n shows \"finite states\"\nproof -\n have \"states \\ {L. set L \\ loc_set \\ length L = n_ps}\"\n by (rule states_loc_set)\n also from finite_trans have \"finite \\\"\n unfolding loc_set_def by (intro finite_intros) auto\n finally show ?thesis .\nqed\n\ncontext Simple_Network_Impl\nbegin\n\nlemma trans_N_finite:\n assumes \"p < n_ps\"\n shows \"finite (Simple_Network_Language.trans (N p))\"\n using assms by (subst N_eq) (auto simp: automaton_of_def trans_def split: prod.split)\n\nlemma states_finite:\n \"finite states\"\n by (intros add: finite_states trans_N_finite)\n\nlemma bounded_finite:\n \"finite {s. bounded bounds s}\"\nproof -\n let ?l = \"Min {fst (the (bounds x)) | x. x \\ dom bounds}\"\n let ?u = \"Max {snd (the (bounds x)) | x. x \\ dom bounds}\"\n have \"finite (dom bounds)\"\n unfolding bounds_def by simp\n then have \"{s. bounded bounds s} \\ {s. dom s = dom bounds \\ ran s \\ {?l..?u}}\"\n unfolding bounded_def\n apply clarsimp\n apply (rule conjI)\n subgoal for s v\n unfolding ran_is_image\n apply clarsimp\n subgoal for x l u\n by (rule order.trans[where b = \"fst (the (bounds x))\"]; (rule Min_le)?; force)\n done\n subgoal for s v\n unfolding ran_is_image\n apply clarsimp\n subgoal for x l u\n by (rule order.trans[where b = \"snd (the (bounds x))\"]; (rule Max_ge)?; force)\n done\n done\n also from \\finite (dom bounds)\\ have \"finite \\\"\n by (rule finite_set_of_finite_maps) rule\n finally show ?thesis .\nqed\n\nlemma trans_prod_finite:\n \"finite trans_prod\"\nproof -\n have \"finite trans_int\"\n proof -\n have \"trans_int \\\n {((L, s), g, Internal a, r, (L', s')) | L s p l b g a f r l' s' L'.\n L \\ states \\ bounded bounds s \\ p < n_ps \\\n (l, b, g, Sil a, f, r, l') \\ trans (N p) \\\n bounded bounds s'\n \\ L' = L[p := l']\n }\"\n unfolding trans_int_def by (force simp: L_len)\n also have \"finite \\\"\n proof -\n have \"finite {(a, b, c, d, e, f, g). (a, b, c, Sil d, e, f, g) \\ trans (N p)}\"\n if \"p < n_ps\" for p\n using [[simproc add: finite_Collect]] that\n by (auto intro: trans_N_finite finite_vimageI injI)\n with states_finite bounded_finite show ?thesis\n by defer_ex\n qed\n finally show ?thesis .\n qed\n moreover have \"finite trans_bin\"\n proof -\n have \"trans_bin \\\n {((L, s), g1 @ g2, Bin a, r1 @ r2, (L', s'')) |\n L s p q l1 b1 g1 a f1 r1 l1' l2 b2 g2 f2 r2 l2' s'' L'.\n L \\ states \\ bounded bounds s \\\n p < n_ps \\ q < n_ps \\\n (l1, b1, g1, In a, f1, r1, l1') \\ trans (N p) \\\n (l2, b2, g2, Out a, f2, r2, l2') \\ trans (N q) \\\n bounded bounds s'' \\\n L' = L[p := l1', q := l2']\n }\"\n unfolding trans_bin_def by (fastforce simp: L_len) (* slow *)\n also have \"finite \\\"\n proof -\n have \"finite {(a, b, c, d, e, f, g). (a, b, c, In d, e, f, g) \\ trans (N p)}\"\n if \"p < n_ps\" for p\n using [[simproc add: finite_Collect]] that\n by (auto intro: trans_N_finite finite_vimageI injI)\n moreover have \"finite {(a, b, c, e, f, g). (a, b, c, Out d, e, f, g) \\ trans (N p)}\"\n if \"p < n_ps\" for p d\n using [[simproc add: finite_Collect]] that\n by (auto intro: trans_N_finite finite_vimageI injI)\n ultimately show ?thesis\n using states_finite bounded_finite by defer_ex\n qed\n finally show ?thesis .\n qed\n moreover have \"finite trans_broad\"\n proof -\n define P where \"P ps \\ set ps \\ {0.. distinct ps\" for ps\n define Q where \"Q a n bs gs fs rs \\\n (\\p < n. \\ q < n_ps. \\ l l'. (l, bs ! p, gs ! p, In a, fs ! p, rs ! p, l') \\ trans (N q)) \\\n length bs = n \\ length gs = n \\ length fs = n \\ length rs = n\" for a n bs gs fs rs\n define tag where \"tag x = True\" for x :: 's\n have Q_I: \"Q a (length ps) (map bs ps) (map gs ps) (map fs ps) (map rs ps)\"\n if \"set ps \\ {0..p\\set ps. (L ! p, bs p, gs p, In a, fs p, rs p, ls' p) \\ trans (N p)\"\n for ps :: \"nat list\" and L a bs gs fs rs ls'\n using that unfolding Q_def by (auto 4 4 dest!: nth_mem)\n have \"trans_broad \\\n {((L, s), g @ concat gs, Broad a, r @ concat rs, (L', s'')) |\n L s a p l b g f r l' ps bs gs fs rs L' s''.\n L \\ states \\ bounded bounds s \\ a \\ set broadcast \\\n p < n_ps \\\n (l, b, g, Out a, f, r, l') \\ trans (N p) \\\n P ps \\\n Q a (length ps) bs gs fs rs \\\n L' \\ states \\\n bounded bounds s'' \\\n tag l'\n }\"\n unfolding trans_broad_def broadcast_def\n apply (rule subsetI)\n apply (elims add: more_elims)\n apply (intros add: more_intros)\n apply solve_triv+\n apply (simp add: L_len; fail)\n apply assumption\n apply (unfold P_def; intros; assumption)\n apply (rule Q_I; assumption)\n subgoal\n by (blast intro: state_preservation_updI state_preservation_fold_updI)\n apply assumption\n unfolding tag_def ..\n also have \"finite \\\"\n proof -\n have \"finite {(a, b, c, e, f, g). (a, b, c, Out d, e, f, g) \\ trans (N p)}\"\n if \"p < n_ps\" for p d\n using [[simproc add: finite_Collect]] that\n by (auto intro: trans_N_finite finite_vimageI injI)\n moreover have \"finite {ps. P ps}\"\n unfolding P_def by (simp add: finite_intros)\n moreover have \"finite {(bs, gs, fs, rs). Q a n bs gs fs rs}\" (is \"finite ?S\") for a n\n proof -\n let ?T = \"\\ (trans ` N ` {0.. {(bs, gs, fs, rs).\n (set bs \\ (\\(_,b,_). b) ` ?T \\ length bs = n) \\\n (set gs \\ (\\(_,_,g,_). g) ` ?T \\ length gs = n) \\\n (set fs \\ (\\(_,_,_,_,f,_). f) ` ?T \\ length fs = n) \\\n (set rs \\ (\\(_,_,_,_,_,r,_). r) ` ?T \\ length rs = n)\n }\"\n unfolding Q_def\n by safe (drule mem_nth; elims; drule spec; elims; force)+\n also have \"finite \\\"\n using trans_N_finite by (intro finite_intros more_finite_intros) auto\n finally show ?thesis .\n qed\n ultimately show ?thesis\n using states_finite bounded_finite by defer_ex\n qed\n finally show ?thesis .\n qed\n ultimately show ?thesis\n by (simp add: trans_prod_def)\nqed\n\nlemma prod_inv_finite:\n \"finite (range prod_inv)\"\n apply (intros add: finite_range_invI)\n unfolding length_automata_eq_n_ps[symmetric]\n unfolding N_def\n unfolding automaton_of_def\n by (auto intro: finite_range_default_map_of split: prod.split simp: inv_def)\n\nend (* Simple Network Impl *)\n\nparagraph \\Collecting variables from expressions.\\\n\nfun vars_of_bexp and vars_of_exp where\n \"vars_of_bexp (not e) = vars_of_bexp e\"\n| \"vars_of_bexp (and e1 e2) = (vars_of_bexp e1 \\ vars_of_bexp e2)\"\n| \"vars_of_bexp (bexp.or e1 e2) = (vars_of_bexp e1 \\ vars_of_bexp e2)\"\n| \"vars_of_bexp (imply e1 e2) = (vars_of_bexp e1 \\ vars_of_bexp e2)\"\n| \"vars_of_bexp (eq i x) = vars_of_exp i \\ vars_of_exp x\"\n| \"vars_of_bexp (le i x) = vars_of_exp i \\ vars_of_exp x\"\n| \"vars_of_bexp (lt i x) = vars_of_exp i \\ vars_of_exp x\"\n| \"vars_of_bexp (ge i x) = vars_of_exp i \\ vars_of_exp x\"\n| \"vars_of_bexp (gt i x) = vars_of_exp i \\ vars_of_exp x\"\n| \"vars_of_bexp bexp.true = {}\"\n| \"vars_of_exp (const c) = {}\"\n| \"vars_of_exp (var x) = {x}\"\n| \"vars_of_exp (if_then_else b e1 e2) = vars_of_bexp b \\ vars_of_exp e1 \\ vars_of_exp e2\"\n| \"vars_of_exp (binop _ e1 e2) = vars_of_exp e1 \\ vars_of_exp e2\"\n| \"vars_of_exp (unop _ e) = vars_of_exp e\"\n\ndefinition (in Prod_TA_Defs)\n \"var_set =\n (\\S \\ {(fst \\ snd) ` trans (N p) | p. p < n_ps}. \\b \\ S. vars_of_bexp b) \\\n (\\S \\ {(fst \\ snd \\ snd \\ snd \\ snd) ` trans (N p) | p. p < n_ps}.\n \\f \\ S. \\ (x, e) \\ set f. {x} \\ vars_of_exp e)\"\n\nlocale Simple_Network_Impl_nat_defs =\n Simple_Network_Impl automata\n for automata ::\n \"(nat list \\ nat list \\ (nat act, nat, nat, int, nat, int) transition list\n \\ (nat \\ (nat, int) cconstraint) list) list\" +\n fixes m :: nat and num_states :: \"nat \\ nat\" and num_actions :: nat\n\nlocale Simple_Network_Impl_nat =\n Simple_Network_Impl_nat_defs +\n assumes has_clock: \"m > 0\"\n assumes non_empty: \"0 < length automata\"\n (* assumes \"length automata = length state_nums\" *)\n assumes trans_num_states:\n \"\\i < n_ps. let (_, _, trans, _) = (automata ! i) in \\ (l, _, _, _, _, _, l') \\ set trans.\n l < num_states i \\ l' < num_states i\"\n and inv_num_states:\n \"\\i < n_ps. let (_, _, _, inv) = (automata ! i) in \\ (x, _) \\ set inv. x < num_states i\"\n assumes var_set:\n \"\\(_, _, trans, _) \\ set automata. \\(_, _, _, _, f, _, _) \\ set trans.\n \\(x, upd) \\ set f. x < n_vs \\ (\\i \\ vars_of_exp upd. i < n_vs)\"\n \"\\(_, _, trans, _) \\ set automata. \\(_, b, _, _, _, _, _) \\ set trans.\n \\i \\ vars_of_bexp b. i < n_vs\"\n assumes bounds:\n \"\\ i < n_vs. fst (bounds' ! i) = i\"\n assumes action_set:\n \"\\a \\ set broadcast. a < num_actions\"\n \"\\(_, _, trans, _) \\ set automata. \\(_, _, _, a, _, _, _) \\ set trans.\n pred_act (\\a. a < num_actions) a\"\n assumes clock_set:\n \"\\(_, _, trans, _) \\ set automata. \\(_, _, g, _, _, r, _) \\ set trans.\n (\\c \\ set r. 0 < c \\ c \\ m) \\\n (\\ (c, x) \\ collect_clock_pairs g. 0 < c \\ c \\ m \\ x \\ \\)\n \"\n \"\\(_, _, _, inv) \\ set automata. \\(l, g) \\ set inv.\n (\\ (c, x) \\ collect_clock_pairs g. 0 < c \\ c \\ m \\ x \\ \\)\n \"\n assumes broadcast_receivers:\n \"\\(_, _, trans, _) \\ set automata. \\(_, _, g, a, _, _, _) \\ set trans.\n case a of In a \\ a \\ set broadcast \\ g = [] | _ \\ True\"\nbegin\n\nlemma broadcast_receivers_unguarded:\n \"\\pl b g a f r l'.\n (l, b, g, In a, f, r, l') \\ Simple_Network_Language.trans (N p) \\ a \\ set broadcast \\ g = []\"\n using broadcast_receivers by (fastforce dest: nth_mem simp: n_ps_def mem_trans_N_iff)\n\nsublocale conv: Prod_TA\n \"(set broadcast, map (Simple_Network_Language.conv_A o automaton_of) automata, map_of bounds')\"\n using broadcast_receivers_unguarded\n by - (standard,\n fastforce simp: conv.broadcast_def Simple_Network_Language.conv_t_def conv_n_ps_eq trans_conv_N_eq)\n\nsublocale TA_Start_No_Ceiling prod_ta init m\nproof standard\n show \"finite (trans_of prod_ta)\"\n using trans_prod_finite by simp\nnext\n show \"finite (range (inv_of prod_ta))\"\n using prod_inv_finite by simp\nnext\n from clk_set'_subs have \"clk_set prod_ta \\ clk_set'\" .\n also have \"\\ \\ {1..m}\"\n using clock_set unfolding clk_set'_def clkp_set'_def by force\n finally show \"clk_set prod_ta \\ {1..m}\" .\nnext\n from clock_set have \"\\(_, d)\\clkp_set'. d \\ \\\"\n unfolding clkp_set'_def by force\n then show \"\\(_, d)\\Timed_Automata.clkp_set prod_ta. d \\ \\\"\n by (auto dest!: subsetD[OF clkp_set'_subs])\nnext\n show \"0 < m\"\n by (rule has_clock)\nqed\n\nend (* Simple Network Impl nat *)\n\n\ncontext Simple_Network_Impl\nbegin\n\ndefinition \"sem \\ (set broadcast, map (automaton_of o conv_automaton) automata, map_of bounds')\"\n\nsublocale sem: Prod_TA_sem sem .\n\nlemma sem_N_eq:\n \"sem.N p = automaton_of (conv_automaton (automata ! p))\" if \\p < n_ps\\\n using that unfolding sem.N_def n_ps_def unfolding sem_def fst_conv snd_conv\n by (subst nth_map) auto\n\nend (* Simple Network Impl *)\n\ninductive_cases step_u_elims:\n \"A \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L', s', u'\\\"\n \"A \\ \\L, s, u\\ \\\\<^bsub>Internal a\\<^esub> \\L', s', u'\\\"\n \"A \\ \\L, s, u\\ \\\\<^bsub>Bin a\\<^esub> \\L', s'', u'\\\"\n \"A \\ \\L, s, u\\ \\\\<^bsub>Broad a\\<^esub> \\L', s'', u'\\\"\n\ninductive_cases step_u_elims':\n \"(broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L', s', u'\\\"\n \"(broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Internal a\\<^esub> \\L', s', u'\\\"\n \"(broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Bin a\\<^esub> \\L', s'', u'\\\"\n \"(broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Broad a\\<^esub> \\L', s'', u'\\\"\n\nlemma (in Prod_TA_Defs) states_lengthD:\n \"length L = n_ps\" if \"L \\ states\"\n using that unfolding states_def by simp\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/Simple_Network_Language_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.28190907984886393}} {"text": "section \\Reference Guide\\\ntheory Sepref_Guide_Reference\nimports \"../IICF/IICF\" (*\"~~/src/Doc/Isar_Ref/Base\"*)\nbegin\ntext \\This guide contains a short reference of the most \n important Sepref commands, methods, and attributes, as well as\n a short description of the internal working, and troubleshooting information\n with examples.\n\n Note: To get an impression how to actually use the Sepref-tool, read the\n quickstart guide first!\n\\\n\nsubsection \\The Sepref Method\\\ntext \\The @{method sepref} method is the central method of the tool.\n Given a schematic goal of the form \\hn_refine \\ ?c ?\\' ?R f\\, it tries \n to synthesize terms for the schematics and prove the theorem. Note that the\n \\?\\'\\ and \\?R\\ may also be fixed terms, in which case frame inference is used \n to match the generated assertions with the given ones.\n \\\\\\ must contain a description of the available refinements on the heap, the \n assertion for each variable must be marked with a \\hn_ctxt\\ tag. \n\n Alternatively, a term of the form \\(?c,f)\\[P]\\<^sub>a A\\R\\ is accepted, where \\A\\ \n describes the refinement and preservation of the arguments, and \\R\\ the refinement \n of the result. \\f\\ must be in uncurried form (i.e. have exactly one argument).\n\n We give some very basic examples here. In practice, you would almost always use\n the higher-level commands @{command sepref_definition} and @{command sepref_register}.\n\\\n\ntext \\In its most primitive form, the Sepref-tool is applied like this:\\\nschematic_goal \n notes [id_rules] = itypeI[of x \"TYPE(nat)\"] itypeI[of a \"TYPE(bool list)\"]\n shows \"hn_refine \n (hn_ctxt nat_assn x xi * hn_ctxt (array_assn bool_assn) a ai) \n (?c::?'c Heap) ?\\' ?R \n (do { ASSERT (xThe above command asks Sepref to synthesize a program, in a heap context where there \n is a natural number, refined by \\nat_assn\\, and a list of booleans, refined \n by \\array_assn bool_assn\\. The \\id_rules\\ declarations declare the abstract variables to the \n operation identification heuristics, such that they are recognized as operands.\\\n\ntext \\Using the alternative hfref-form, we can write:\\\nschematic_goal \"(uncurry (?c), uncurry (\\x a. do {ASSERT (x nat_assn\\<^sup>k *\\<^sub>a (array_assn bool_assn)\\<^sup>k \\\\<^sub>a bool_assn\"\n by sepref\ntext \\This uses the specified assertions to derive the rules for \n operation identification automatically. For this, it uses the\n assertion-interface bindings declared in @{attribute intf_of_assn}.\n If there is no such binding, it uses the HOL type as interface type.\n\\\nthm intf_of_assn\n\ntext \\\n The sepref-method is split into various phases, which we will explain now\n\\\n\nsubsubsection \\Preprocessing Phase\\\ntext \\\n This tactic converts a goal in \\hfref\\ form to the more basic \\hn_refine\\ form.\n It uses the theorems from @{attribute intf_of_assn} to add interface type declarations\n for the generated operands. The final result is massaged by rewriting with\n @{attribute to_hnr_post}, and then with @{attribute sepref_preproc}.\n\n Moreover, this phase ensures that there is a constraint slot goal (see section on constraints).\n\\\n\ntext \\The method @{method sepref_dbg_preproc} gives direct access to the preprocessing phase.\\\nthm sepref_preproc\nthm intf_of_assn\nthm to_hnr_post \\ \\Note: These rules are only instantiated for up to 5 arguments. \n If you have functions with more arguments, you need to add corresponding theorems here!\\\n\nsubsubsection \\Consequence Rule Phase\\\ntext \\This phase rewrites \\hn_invalid _ x y\\ assertions in the postcondition to \n \\hn_ctxt (\\_ _. true) x y\\ assertions, which are trivial to discharge. \n Then, it applies @{thm [source] CONS_init}, to make postcondition and \n result relation schematic, and introduce (separation logic) implications to\n the originals, which are discharged after synthesis.\n\\\ntext \\Use @{method sepref_dbg_cons_init} for direct access to this phase.\n The method @{method weaken_hnr_post} performs the rewriting of \\hn_invalid\\\n to \\\\_ _. true\\ postconditions, and may be useful on its own for proving \n combinator rules. \n\\\n\nsubsubsection \\Operation Identification Phase\\\ntext \\The purpose of this phase is to identify the conceptual operations in the given program.\n Consider, for example, a map @{term_type \"m::'k\\'v\"}. \n If one writes @{term \"m(k\\v)\"}, this is a map update. However, in Isabelle/HOL maps\n are encoded as functions @{typ \"'k \\ 'v option\"}, and the map update is just syntactic\n sugar for @{term [source] \"fun_upd m k (Some v)\"}. And, likewise, map lookup is just \n function application.\n\n However, the Sepref tool must be able to distinguish between maps and functions into the\n option type, because maps shall be refined, to e.g., hash-tables, while functions into the\n option type shall be not. Consider, e.g., the term @{term \"Some x\"}. Shall \\Some\\ be \n interpreted as the constructor of the option datatype, or as a map, mapping each element to\n itself, and perhaps be implemented with a hashtable.\n \n Moreover, for technical reasons, the translation phase of Sepref expects each operation \n to be a single constant applied to its operands. This criterion is neither matched by map \n lookup (no constant, just application of the first to the second operand), nor map update \n (complex expression, involving several constants).\n\n The operation identification phase uses a heuristics to find the conceptual types in a term\n (e.g., discriminate between map and function to option), and rewrite the operations to single \n constants (e.g. @{const op_map_lookup} for map lookup). The heuristics is a type-inference \n algorithm combined with rewriting. Note that the inferred conceptual type does not necessarily\n match the HOL type, nor does it have a semantic meaning, other than guiding the heuristics.\n\n The heuristics store a set of typing rules for constants, in @{attribute id_rules}.\n Moreover, it stores two sets of rewrite rules, in @{attribute pat_rules} \n and @{attribute def_pat_rules}. A term is typed by first trying to apply a rewrite rule, and\n then applying standard Hindley-Milner type inference rules for application and abstraction. \n Constants (and free variables) are typed\n using the \\id_rules\\. If no rule for a constant exists, one is inferred from the constant's \n signature. This does not work for free variables, such that rules must be available\n for all free variables. Rewrite rules from \\pat_rules\\ are backtracked over, while rewrite rules\n from \\def_pat_rules\\ are always tried first and never backtracked over.\n \n If typing succeeds, the result is the rewritten term.\n\n For example, consider the type of maps. Their interface (or conceptual) type is \n @{typ \"('k,'v) i_map\"}. The \\id_rule\\ for map lookup is @{thm \"op_map_lookup.itype\"}.\n Moreover, there is a rule to rewrite function application to map lookup (@{thm pat_map_lookup}). \n It can be backtracked over, such that also functions into the option type are possible.\n\\\nthm op_map_lookup.itype\nthm pat_map_lookup\nthm id_rules\ntext \\\n The operation identification phase, and all further phases, work on a tagged \n version of the input term, where all function applications are replaced by the\n tagging constant @{term \"($)\"}, and all abstractions are replaced by \n @{term \"\\x. PROTECT2 (t x) DUMMY\"} (syntax: @{term \"\\x. (#t x#)\"}, \n input syntax: @{term \"\\\\<^sub>2x. t x\"}). This is required to tame Isabelle's \n higher-order unification. However, it makes tagged terms quite unreadable, and it\n may be helpful to \\unfold APP_def PROTECT2_def\\ to get back the untagged form when inspecting\n internal states for debugging purposes.\n\n To prevent looping, rewrite-rules can use @{term \"($')\"} on the RHS. This is\n a synonym for @{term \"($)\"}, and gets rewritten to @{term \"($)\"} after the operation\n identification phase. During the operation identification phase, it prevents infinite\n loops of pattern rewrite rules.\n\n\n Interface type annotations can be added to the term using @{const CTYPE_ANNOT} \n (syntax @{term \"t:::\\<^sub>iTYPE('a)\"}).\n\n In many cases, it is desirable to treat complex terms as a single constant, \n a standard example are constants defined inside locales, which may have locale \n parameters attached. Those terms can be wrapped into an @{const PR_CONST} tag,\n which causes them to be treated like a single constant. Such constants must always \n have \\id_rules\\, as the interface type inference from the signature does not apply here.\n\\\n\nsubsubsection \\Troubleshooting Operation Identification\\\ntext \\\n If the operation identification fails, in most cases one has forgotten to register \n an \\id_rule\\ for a free variable or complex \\PR_CONST\\ constant, or the identification \n rule is malformed. Note that, in practice, identification rules are registered by \n the @{command sepref_register} (see below), which catches many malformed rules, and\n handles \\PR_CONST\\ tagging automatically. Another frequent source of errors here is \n forgetting to register a constant with a conceptual type other than its signature. \n In this case, operation identification gets stuck trying to unify the signature's type with\n the interface type, e.g., @{typ \"'k \\ 'v option\"} with @{typ \"('k,'v)i_map\"}.\n\n The method @{method sepref_dbg_id} invokes the id-phase in isolation.\n The method @{method sepref_dbg_id_keep} returns the internal state where type \n inference got stuck. It returns a sequence of all stuck states, which can be inspected\n using @{command back}. \n\n The methods @{method sepref_dbg_id_init},@{method sepref_dbg_id_step}, \n and @{method sepref_dbg_id_solve} can be used to single-step the operation \n identification phase. Here, solve applies single steps until the current subgoal is discharged.\n Be aware that application of single steps allows no automatic backtracking, such that backtracking\n has to be done manually.\n\\\n\ntext \\Examples for identification errors\\\ncontext \n fixes N::nat \n notes [sepref_import_param] = IdI[of N]\nbegin\n sepref_thm N_plus_2_example is \"uncurry0 (RETURN (N+2))\" :: \"unit_assn\\<^sup>k \\\\<^sub>a nat_assn\"\n apply sepref_dbg_keep\n apply sepref_dbg_id_keep\n \\ \\Forgot to register \\n\\\\\n oops\n\n text \\Solution: Register \\n\\, be careful not to export meaningless registrations from context!\\\n context\n notes [[sepref_register_adhoc N]]\n begin\n sepref_thm N_plus_2_example is \"uncurry0 (RETURN (N+2))\" :: \"unit_assn\\<^sup>k \\\\<^sub>a nat_assn\" by sepref\n end \nend\n\ndefinition \"my_map \\ op_map_empty\"\nlemmas [sepref_fr_rules] = hm.empty_hnr[folded my_map_def]\n\nsepref_thm my_map_example is \"uncurry0 (RETURN (my_map(False\\1)))\" :: \"unit_assn\\<^sup>k \\\\<^sub>a hm.assn bool_assn nat_assn\"\n apply sepref_dbg_keep\n apply sepref_dbg_trans_keep\n \\ \\Stuck at refinement for function update on map\\\n oops\n\ntext \\Solution: Register with correct interface type\\\nsepref_register my_map :: \"('k,'v) i_map\"\nsepref_thm my_map_example is \"uncurry0 (RETURN (my_map(False\\1)))\" :: \"unit_assn\\<^sup>k \\\\<^sub>a hm.assn bool_assn nat_assn\"\n by sepref\n\n\nsubsubsection \\Monadify Phase\\\ntext \\\n The monadify phase rewrites the program such that every operation becomes \n visible on the monad level, that is, nested HOL-expressions are flattened.\n Also combinators (e.g. if, fold, case) may get flattened, if special rules \n are registered for that.\n\n Moreover, the monadify phase fixes the number of operands applied to an operation,\n using eta-expansion to add missing operands. \n\n Finally, the monadify phase handles duplicate parameters to an operation, by\n inserting a @{const COPY} tag. This is necessary as our tool expects the \n parameters of a function to be separate, even for read-only \n parameters@{footnote \\Using fractional permissions or some other more fine grained\n ownership model might lift this restriction in the future.\\}. \n\\\n\ntext \\The monadify phase consists of a number of sub-phases.\n The method @{method sepref_dbg_monadify} executes the monadify phase,\n the method @{method sepref_dbg_monadify_keep} stops at a failing sub-phase\n and presents the internal goal state before the failing sub-phase.\n\\\n\nsubsubsection \\Monadify: Arity\\\ntext \\In the first sub-phase, the rules from @{attribute sepref_monadify_arity} \n are used to standardize the number of operands applied to a constant.\n The rules work by rewriting each constant to a lambda-expression with the \n desired number of arguments, and the using beta-reduction to account for\n already existing arguments. Also higher-order arguments can be enforced,\n for example, the rule for fold enforces three arguments, the function itself\n having two arguments (@{thm fold_arity}).\n\n In order to prevent arity rules being applied infinitely often, \n the @{const SP} tag can be used on the RHS. It prevents anything inside \n from being changed, and gets removed after the arity step.\n\n The method @{method sepref_dbg_monadify_arity} gives you direct access to this phase.\n\n In the Sepref-tool, we use the terminology @{emph \\operator/operation\\} for a function that\n only has first-order arguments, which are evaluated before the function is applied (e.g. @{term \"(+)\"}),\n and @{emph \\combinator\\} for operations with higher-order arguments or custom \n evaluation orders (e.g. @{term \"fold\"}, @{term \"If\"}).\n\n Note: In practice, most arity (and combinator) rules are declared automatically\n by @{command sepref_register} or @{command sepref_decl_op}. Manual declaration\n is only required for higher-order functions.\n\\\nthm sepref_monadify_arity\n\nsubsubsection \\Monadify: Combinators\\\ntext \\The second sub-phase flattens the term. \n It has a rule for every function into @{typ \"_ nres\"} type, that determines\n the evaluation order of the arguments. First-order arguments are evaluated before\n an operation is applied. Higher-order arguments are treated specially, as they\n are evaluated during executing the (combinator) operation. The rules are in\n @{attribute sepref_monadify_comb}.\n\n Evaluation of plain (non-monadic) terms is triggered by wrapping them into\n the @{const EVAL} tag. The @{attribute sepref_monadify_comb} rules may also contain\n rewrite-rules for the @{const EVAL} tag, for example to unfold plain combinators\n into the monad (e.g. @{thm dflt_plain_comb}). If no such rule applies, the \n default method is to interpret the head of the term as a function, and recursively\n evaluate the arguments, using left-to-right evaluation order. The head of \n a term inside @{const EVAL} must not be an abstraction. Otherwise, the \n @{const EVAL} tag remains in the term, and the next sub-phase detects this \n and fails.\n\n The method @{method sepref_dbg_monadify_comb} executes the combinator-phase \n in isolation.\n\\\n\nsubsubsection \\Monadify: Check-Eval\\\ntext \\This phase just checks for remaining @{const EVAL} tags in the term,\n and fails if there are such tags. The method @{method sepref_dbg_monadify_check_EVAL}\n gives direct access to this phase.\n\n Remaining @{const EVAL} tags indicate\n higher-order functions without an appropriate setup of the combinator-rules\n being used. For example:\n\\\ndefinition \"my_fold \\ fold\"\nsepref_thm my_fold_test is \"\\l. do { RETURN (my_fold (\\x y. x+y*2) l 0)}\" :: \"(list_assn nat_assn)\\<^sup>k\\\\<^sub>anat_assn\"\n apply sepref_dbg_keep\n apply sepref_dbg_monadify_keep\n \\ \\An \\EVAL\\-tag with an abstraction remains. This is b/c the default heuristics\n tries to interpret the function inside the fold as a plain value argument.\\\n oops\n\ntext \\Solution: Register appropriate arity and combinator-rules\\\nlemma my_fold_arity[sepref_monadify_arity]: \"my_fold \\ \\\\<^sub>2f l s. SP my_fold$(\\\\<^sub>2x s. f$x$s)$l$s\" by auto\n\ntext \\The combinator-rule rewrites to the already existing and set up combinator @{term nfoldli}:\\\nlemma monadify_plain_my_fold[sepref_monadify_comb]: \n \"EVAL$(my_fold$(\\\\<^sub>2x s. f x s)$l$s) \\ (\\)$(EVAL$l)$(\\\\<^sub>2l. (\\)$(EVAL$s)$(\\\\<^sub>2s. nfoldli$l$(\\\\<^sub>2_. True)$(\\\\<^sub>2x s. EVAL$(f x s))$s))\"\n by (simp add: fold_eq_nfoldli my_fold_def)\n\nsepref_thm my_fold_test is \"\\l. do { RETURN (my_fold (\\x y. x+y*2) l 0)}\" :: \"(list_assn nat_assn)\\<^sup>k\\\\<^sub>anat_assn\"\n by sepref\n\nsubsubsection \\Monadify: Dup\\\ntext \\The last three phases, \\mark_params\\, \\dup\\, \\remove_pass\\ are to detect \n duplicate parameters, and insert \\COPY\\ tags. \n The first phase, \\mark_params\\, adds @{const PASS} tags around all parameters.\n Parameters are bound variables and terms that have a refinement in the \n precondition.\n\n The second phase detects duplicate parameters and inserts @{const COPY} tags\n to remove them. Finally, the last phase removes the @{const PASS} tags again.\n\n The methods @{method sepref_dbg_monadify_mark_params}, \n @{method sepref_dbg_monadify_dup}, and @{method sepref_dbg_monadify_remove_pass}\n gives you access to these phases.\n\\\n\nsubsubsection \\Monadify: Step-Through Example\\\ntext \\\n We give an annotated example of the monadify phase.\n Note that the program utilizes a few features of monadify:\n \\<^item> The fold function is higher-order, and gets flattened\n \\<^item> The first argument to fold is eta-contracted. The missing argument is added.\n \\<^item> The multiplication uses the same argument twice. A copy-tag is inserted.\n\\\nsepref_thm monadify_step_thru_test is \"\\l. do {\n let i = length l;\n RETURN (fold (\\x. (+) (x*x)) l i)\n }\" :: \"(list_assn nat_assn)\\<^sup>k \\\\<^sub>a nat_assn\"\n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id\n\n apply sepref_dbg_monadify_arity \\ \\Second operand of fold-function is added\\\n apply sepref_dbg_monadify_comb \\ \\Flattened. \\fold\\ rewritten to \\monadic_nfoldli\\.\\\n (*apply (unfold APP_def PROTECT2_def) (* Make term readable for inspection*) *)\n apply sepref_dbg_monadify_check_EVAL \\ \\No \\EVAL\\ tags left\\\n apply sepref_dbg_monadify_mark_params \\ \\Parameters marked by \\PASS\\. Note the multiplication \\x*x\\.\\\n (*apply (unfold APP_def PROTECT2_def) (* Make term readable for inspection*) *)\n apply sepref_dbg_monadify_dup \\ \\\\COPY\\ tag inserted.\\\n (*apply (unfold APP_def PROTECT2_def) (* Make term readable for inspection*) *)\n apply sepref_dbg_monadify_remove_pass \\ \\\\PASS\\ tag removed again\\\n (*apply (unfold APP_def PROTECT2_def) (* Make term readable for inspection*) *)\n \n apply sepref_dbg_opt_init\n apply sepref_dbg_trans\n apply sepref_dbg_opt\n apply sepref_dbg_cons_solve\n apply sepref_dbg_cons_solve\n apply sepref_dbg_constraints\n done\n\nsubsubsection \\Optimization Init Phase\\\ntext \\This phase, accessed by @{method sepref_dbg_opt_init}, just applies the \n rule @{thm TRANS_init} to set up a subgoal for a-posteriori optimization\\\n\nsubsubsection \\Translation Phase\\\ntext \\\n The translation phase is the main phase of the Sepref tool. \n It performs the actual synthesis of the imperative program from\n the abstract one. For this, it integrates various components, among others,\n a frame inference tool, a semantic side-condition solver and a monotonicity prover.\n\n The translation phase consists of two major sub-phases: \n Application of translation rules and solving of deferred constraints.\n\n The method @{method sepref_dbg_trans} executes the translation phase,\n @{method sepref_dbg_trans_keep} executes the translation phase, \n presenting the internal goal state of a failed sub-phase.\n\n The translation rule phase repeatedly applies translation steps, until the \n subgoal is completely solved. \n\n The main idea of the translation phase is, that for every abstract variable \\x\\ in scope,\n the precondition contains an assertion of the form @{term \"hn_ctxt A x xi\"}, indicating how\n this variable is implemented. Common abbreviations are \n @{term \"hn_val R x xi \\ hn_ctxt (pure R) x xi\"} \n and @{term \"hn_invalid A x xi \\ hn_ctxt (invalid_assn A) x xi\"}.\n\\\n\nsubsubsection \\Translation: Step\\\ntext \\\n A translation step applies a single synthesis step for an operator,\n or solves a deferred side-condition. \n\n There are two types of translation steps: Combinator steps and operator steps.\n A combinator step consists of applying a rule from @{attribute sepref_comb_rules}\n to the goal-state. If no such rule applies, the rules are tried again after rewriting\n the precondition with @{attribute sepref_frame_normrel_eqs} (see frame-inference).\n The premises of the combinator rule become new subgoals, which are solved by \n subsequent steps. No backtracking is applied over combinator rules. \n This restriction has been introduced to make the tool more deterministic, and hence\n more manageable. \n\n An operator step applies an operator rule (from @{attribute sepref_fr_rules}) \n with frame-inference, and then tries to solve the resulting side conditions \n immediately. If not all side-conditions can be solved, it backtracks over the \n application of the operator rule. \n\n Note that, currently, side conditions to operator rules cannot contain \n synthesis goals themselves. Again, this restriction reduces the tool's \n complexity by avoiding deep nesting of synthesis. However, it hinders\n the important feature of generic algorithms, where an operation can issue \n synthesis subgoals for required operations it is built from (E.g., set union\n can be implemented by insert and iteration). Our predecessor tool, Autoref,\n makes heavy use of this feature, and we consider dropping the restriction in \n the near future.\n\n An operator-step itself consists of several sub-phases:\n \\<^descr>[Align goal] Splits the precondition into the arguments actually occurring in\n the operation, and the rest (called frame).\n \\<^descr>[Frame rule] Applies a frame rule to focus on the actual arguments. Moreover,\n it inserts a subgoal of the form @{term \"RECOVER_PURE \\ \\'\"}, which is used \n to restore invalidated arguments if possible. Finally, it generates an assumption\n of the form @{term \"vassn_tag \\'\"}, which means that the precondition holds\n on some heap. This assumption is used to extract semantic information from the \n precondition during side-condition solving.\n\n \\<^descr>[Recover pure] This phase tries to recover invalidated arguments. \n An invalidated argument is one that has been destroyed by a previous operation.\n It occurs in the precondition as @{term \"hn_invalid A x xi\"}, which indicates\n that there exists a heap where the refinement holds. However, if the refinement \n assertion \\A\\ does not depend on the heap (is \\<^emph>\\pure\\), the invalidated argument\n can be recovered. The purity assumption is inserted as a constraint (see constraints),\n such that it can be deferred.\n \\<^descr>[Apply rule] This phase applies a rule from @{attribute sepref_fr_rules} to\n the subgoal. If there is no matching rule, matching is retried after rewriting\n the precondition with @{attribute sepref_frame_normrel_eqs}. If this does not succeed\n either, a consequence rule is used on the precondition. The implication becomes an \n additional side condition, which will be solved by the frame inference tool.\n\n To avoid too much backtracking, the new precondition\n is massaged to have the same structure as the old one, i.e., it contains a (now schematic)\n refinement assertion for each operand. This excludes rules for which the frame inference\n would fail anyway.\n\n If a matching rule is found, it is applied and all new subgoals are solved by the \n side-condition solver. If this fails, the tool backtracks over the application of \n the @{attribute sepref_fr_rules}-rules. Note that direct matches prevent precondition \n simplification, and matches after precondition simplification prevent the consequence \n rule to be applied.\n\n \n The method @{method sepref_dbg_trans_step} performs a single translation step.\n The method @{method sepref_dbg_trans_step_keep} presents the internal goal state \n on failure. If it fails in the \\apply-rule\\ phase, it presents the sequence of \n states with partially unsolved side conditions for all matching rules. \n\\\n\nsubsubsection \\Translation: Side Conditions\\\ntext \\The side condition solver is used to discharge goals that arise as \n side-conditions to the translation rules. It does a syntactic discrimination \n of the side condition type, and then invokes the appropriate solver. Currently,\n it supports the following side conditions:\n \\<^descr>[Merge] (\\_\\\\<^sub>A_ \\\\<^sub>t _\\). These are used to merge postconditions from different \n branches of the program (e.g. after an if-then-else). They are solved by the \n frame inference tool (see section on frame inference).\n \\<^descr>[Frame] (\\_ \\\\<^sub>t _\\). Used to match up the current precondition against the \n precondition of the applied rule. Solved by the frame inference tool (see section on frame inference).\n \\<^descr>[Independence] (\\INDEP (?R x\\<^sub>1 \\ x\\<^sub>n)\\). Deprecated. Used to instantiate a \n schematic variable such that it does not depend on any bound variables any more. \n Originally used to make goals more readable, we are considering of dropping this.\n \\<^descr>[Constraints] (\\CONSTRAINT _ _\\) Apply solver for deferrable constraints (see section on constraints).\n \\<^descr>[Monotonicity] (\\mono_Heap _\\) Apply monotonicity solver. Monotonicity subgoals occur when\n translating recursion combinators. Monadic expressions are monotonic by construction, and \n this side-condition solver just forwards to the monotonicity prover of the partial \n function package, after stripping any preconditions from the subgoal, which are \n not supported by the case split mechanism of the monotonicity prover (as of Isabelle2016).\n \\<^descr>[Prefer/Defer] (\\PREFER_tag _\\/\\DEFER_tag\\). Deprecated. Invoke the tagged solver of \n the Autoref tool. Used historically for importing refinements from the Autoref tool,\n but as Sepref becomes more complete imports from Autoref are not required any more.\n \\<^descr>[Resolve with Premise] \\RPREM _\\ Resolve subgoal with one of its premises. \n Used for translation of recursion combinators. \n \\<^descr>[Generic Algorithm] \\GEN_ALGO _ _\\ Triggers resolution with a rule from\n @{attribute sepref_gen_algo_rules}. This is a poor-man's version of generic \n algorithm, which is currently only used to synthesize to-list conversions for foreach-loops.\n \\<^descr>[Fallback] (Any pattern not matching the above, nor being a \\hn_refine\\ goal).\n Unfolds the application and abstraction tagging, as well as @{term bind_ref_tag} tags \n which are inserted by several translation rules to indicate the value a variable has \n been bound to, and then tries to solve the goal by @{method auto}, after freezing \n schematic variables. This tactic is used to discharge semantic side conditions, e.g.,\n in-range conditions for array indexing. \n\n\n Methods: @{method sepref_dbg_side} to apply a side-condition solving step,\n @{method sepref_dbg_side_unfold} to apply the unfolding of application and binding tags and \n @{method sepref_dbg_side_keep} to return the internal state after failed side-condition solving.\n\\\n\nsubsubsection \\Translation: Constraints\\\ntext \\During the translation phase, the refinement of operands is not \n always known immediately, such that schematic variables may occur as refinement \n assertions. Side conditions on those refinement assertions cannot be discharged \n until the schematic variable gets instantiated. \n\n Thus, side conditions may be tagged with @{const CONSTRAINT}. \n If the side condition solver encounters a constraint side condition, it first removes\n the constraint tag (@{thm CONSTRAINT_I}) and freezes all schematic variables to prevent them from \n accidentally getting instantiated. Then it simplifies with @{attribute constraint_simps} and\n tries to solve the goal using rules from \n @{attribute safe_constraint_rules} (no backtracking) \n and @{attribute constraint_rules} (with backtracking).\n\n If solving the constraint is not successful, only the safe rules are applied, and the \n remaining subgoals are moved to a special \\CONSTRAINT_SLOT\\ subgoal, that always is the \n last subgoal, and is initialized by the preprocessing phase of Sepref.\n Moving the subgoal to the constraint slot looks for Isabelle's tacticals like the subgoal \n has been solved. In reality, it is only deferred and must be solved later.\n \n Constraints are used in several phases of Sepref, and all constraints are solved\n at the end of the translation phase, and at the end of the Sepref invocation.\n \n Methods: \n \\<^item> @{method solve_constraint} to apply constraint solving, the @{const CONSTRAINT}-tag is optional.\n \\<^item> @{method safe_constraint} to apply safe rules, the @{const CONSTRAINT}-tag is optional.\n \\<^item> @{method print_slot} to print the contents of the constraint slot.\n\n\\\n\nsubsubsection \\Translation: Merging and Frame Inference\\\ntext \\Frame inference solves goals of the form \\\\ \\\\<^sub>t \\'\\.\n For this, it matches \\hn_ctxt\\ components in \\\\'\\ with those in \\\\\\.\n Matching is done according to the refined variables. \n The matching pairs and the rest is then treated differently: \n The rest is resolved by repeatedly applying the rules from @{thm frame_rem_thms}.\n The matching pairs are resolved by repeatedly applying rules from \n @{thm frame_thms} and @{attribute sepref_frame_match_rules}. \n Any non-frame premise of these rules must be solved immediately by the \n side-condition's constraint or fallback tactic (see above). The tool backtracks over rules.\n If no rule matches (or side-conditions cannot be solved), it simplifies the goal \n with @{attribute sepref_frame_normrel_eqs} and tries again.\n\n For merge rules, the theorems @{thm merge_thms} \n and @{attribute sepref_frame_merge_rules} are used.\n\n Note that a smart setup of frame and match rules together with side conditions makes \n the frame matcher a powerful tool for encoding structural and semantic information \n into relations. An example for structural information are the match rules for lists,\n which forward matching of list assertions to matching of the element assertions,\n maintaining the congruence assumption that the refined elements are actually elements \n of the list: @{thm list_match_cong}.\n An example for semantic information is the bounded assertion, which intersects\n any given assertion with a predicate on the abstract domain. The frame matcher is \n set up such that it can convert between bounded assertions, generating semantic \n side conditions to discharge implications between bounds (@{thm b_assn_subtyping_match}). \n\n This is essentially a subtyping mechanism on the level of refinement assertions,\n which is quite useful for maintaining natural side conditions on operands. \n A standard example is to maintain a list of array indices: The refinement assertion \n for array indices is @{term nat_assn} restricted to indices that are in range:\n @{term \"nbn_assn N\"}. When inserting natural numbers into this list, one has to \n prove that they are actually in range (conversion from @{term nat_assn} to @{term nbn_assn}).\n Elements of the list can be used as natural numbers (conversion from @{term nbn_assn} \n to @{term nat_assn}). Additionally, the side condition solver can derive that the predicate\n holds on the abstract variable (via the @{const vassn_tag} inserted by the operator steps). \n\\\n\nsubsubsection \\Translation: Annotated Example\\\n\ncontext \n fixes N::nat \n notes [[sepref_register_adhoc N]]\n notes [sepref_import_param] = IdI[of N]\nbegin\n\ntext \\This worked example utilizes the following features of the translation phase:\n \\<^item> We have a fold combinator, which gets translated by its combinator rule\n \\<^item> We add a type annotation which enforces converting the natural numbers\n inserted into the list being refined by \\nbn_assn N\\, i.e., smaller than \\N\\.\n \\<^item> We can only prove the numbers inserted into the list to be smaller than \\N\\ \n because the combinator rule for \\If\\ inserts congruence assumptions.\n \\<^item> By moving the elements from the list to the set, they get invalidated.\n However, as \\nat_assn\\ is pure, they can be recovered later, allowing us to \n mark the list argument as read-only.\n\\\n\nsepref_thm filter_N_test is \"\\l. RETURN (fold (\\x s.\n if xk \\\\<^sub>a hs.assn (nbn_assn N)\"\n\n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id\n apply sepref_dbg_monadify\n \n apply sepref_dbg_opt_init\n\n apply sepref_dbg_trans_step \\ \\Combinator rule for bind, \n generating two \\hn_refine\\ goals, and a frame rule to\n separate the bound variable from the rest.\\\n apply sepref_dbg_trans_step \\ \\Rule for empty hashset, solves goal\\\n apply sepref_dbg_trans_step \\ \\Combinator rule for nfoldli (@{thm hn_monadic_nfoldli_rl'})\\\n apply sepref_dbg_trans_step \\ \\INDEP\\\n apply sepref_dbg_trans_step \\ \\INDEP\\\n apply sepref_dbg_trans_step \\ \\Frame to get list and initial state\\\n apply sepref_dbg_trans_step \\ \\Refinement of continuation condition\\\n apply sepref_dbg_trans_step \\ \\Frame to recover state after continuation condition\\\n\n \\ \\Loop body\\\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n \\ \\At this point, we arrived at the \\nbn_rel\\ annotation. \n There is enough information to show \\x'a < N\\\\\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step\n \\ \\At this point, we have to merge the postconditions from the two if \n branches. \\nat_rel\\ gets merged with \\invalid_assn (nbn_assn n)\\, \n yielding \\invalid_assn nat_assn\\\\\n apply sepref_dbg_trans_step\n apply sepref_dbg_trans_step \\ \\Frame rule separating bound variable from rest\\\n\n apply sepref_dbg_trans_step \\ \\Frame rule separating fold-state from rest\\\n apply sepref_dbg_trans_step \\ \\Merging elements of list before body \n with elements of list after body, to get refinement for resulting list\\\n \n apply sepref_dbg_trans_step \\ \\Frame rule from initial bind, separating \n bound variable from the rest\\\n\n apply sepref_dbg_opt\n apply sepref_dbg_cons_solve \\ \\Frame rule, recovering the invalidated list \n or pure elements, propagating recovery over the list structure\\\n apply sepref_dbg_cons_solve \\ \\Trivial frame rule\\\n apply sepref_dbg_constraints\n done\n\n\n\nend\n\nsubsubsection \\Optimization Phase\\\ntext \\The optimization phase simplifies the generated\n program, first with @{attribute sepref_opt_simps}, and\n then with @{attribute sepref_opt_simps2}. \n For simplification, the tag @{const CNV} is used, which is discharged\n with @{thm CNV_I} after simplification. \n\n Method @{method sepref_dbg_opt} gives direct access to this phase.\n The simplification is used to beautify the generated code.\n The most important simplifications collapse code that does not \n depend on the heap to plain expressions (using the monad laws), and\n apply certain deforestation optimizations.\n \n Consider the following example:\n\\\n\nsepref_thm opt_example is \"\\n. do { let r = fold (+) [1..k \\\\<^sub>a nat_assn\"\n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id\n apply sepref_dbg_monadify\n apply sepref_dbg_opt_init\n apply sepref_dbg_trans\n \\ \\The generated program contains many superfluous binds, moreover, it actually \n generates a list and then folds over it\\\n supply [[show_main_goal]]\n apply sepref_dbg_opt\n \\ \\The superfluous binds have been collapsed, and the fold over the list\n has been replaced by @{const imp_for'}, which uses a counter.\\\n apply sepref_dbg_cons_solve\n apply sepref_dbg_cons_solve\n apply sepref_dbg_constraints\n done\n\nsubsubsection \\Cons-Solve Phases\\\ntext \\These two phases, accessible via @{method sepref_dbg_cons_solve},\n applies the frame inference tool to solve the two implications generated\n by the consequence rule phase.\n\\\n\nsubsubsection \\Constraints Phase\\\ntext \\\n This phase, accessible via @{method sepref_dbg_constraints}, solve the\n deferred constraints that are left, and then removes the \\CONSTRAINT_SLOT\\ \n subgoal.\n\\\n\nsubsection \\Refinement Rules\\\ntext \\\n There are two forms of specifying refinement between an Imperative/HOL program\n and an abstract program in the \\nres\\-monad.\n The \\hn_refine\\ form (also hnr-form) is the more low-level form.\n The term @{term \"P \\ hn_refine \\ c \\' R a\"} states that, under precondition \\P\\, for \n a heap described by \\\\\\, the Imperative/HOL program \\c\\ produces a heap described by \n \\\\'\\ and the result is refined by \\R\\. Moreover, the abstract result is among the possible \n results of the abstract program \\a\\.\n \n This low-level form formally enforces no restrictions on its arguments, however, there are\n some assumed by our tool:\n \\<^item> \\\\\\ must have the form \\hn_ctxt A\\<^sub>1 x\\<^sub>1 xi\\<^sub>1 * \\ * hn_ctxt A\\<^sub>n x\\<^sub>n xi\\<^sub>n\\\n \\<^item> \\\\'\\ must have the form \\hn_ctxt B\\<^sub>1 x\\<^sub>1 xi\\<^sub>1 * \\ * hn_ctxt B\\<^sub>n x\\<^sub>n xi\\<^sub>n\\\n where either \\B\\<^sub>i = A\\<^sub>i\\ or \\B\\<^sub>i = invalid_assn A\\<^sub>i\\. This means that each argument to\n the program is either preserved or destroyed.\n \\<^item> \\R\\ must not contain a \\hn_ctxt\\ tag.\n \\<^item> \\a\\ must be in protected form (@{term \"($)\"} and @{term \"PROTECT2\"} tags)\n\n The high-level \\hfref\\ form formally enforces these restrictions. Moreover,\n it assumes \\c\\ and \\a\\ to be presented as functions from exactly one argument.\n For constants or functions with more arguments, you may use @{term uncurry0} \n and @{term uncurry}. (Also available @{term uncurry2} to @{term uncurry5}).\n\n The general form is \\PC \\ (uncurry\\<^sub>x f, uncurry\\<^sub>x g) \\ [P]\\<^sub>a A\\<^sub>1\\<^sup>k\\<^sup>1 *\\<^sub>a \\ *\\<^sub>a A\\<^sub>n\\<^sup>k\\<^sup>n \\ R\\,\n where \\ki\\ is \\k\\ if the argument is preserved (kept) or \\d\\ is it is destroyed.\n \\PC\\ are preconditions of the rule that do not depend on the arguments, usually\n restrictions on the relations. \\P\\ is a predicate on the single argument of \\g\\,\n representing the precondition that depends on the arguments.\n\n Optionally, \\g\\ may be of the form \\RETURN o\\o g'\\, in which case the rule \n applies to a plain function.\n\n If there is no precondition, there is a shorter \n syntax: @{term \"Args\\\\<^sub>aR \\ [\\_. True]\\<^sub>a Args\\R\"}.\n\n For example, consider @{thm [source] arl_swap_hnr[unfolded pre_list_swap_def]}.\n It reads @{term \"CONSTRAINT is_pure A \\\n (uncurry2 arl_swap, uncurry2 (RETURN \\\\\\ op_list_swap))\n \\ [\\((l, i), j). i < length l \\ j < length l]\\<^sub>a \n (arl_assn A)\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\ arl_assn A\"}\n\n We have three arguments, the list and two indexes. The refinement assertion \\A\\\n for the list elements must be pure, and the indexes must be in range.\n The original list is destroyed, the indexes are kept.\n\\\nthm arl_swap_hnr[unfolded pre_list_swap_def, no_vars]\n\nsubsubsection \\Converting between hfref and hnr form\\\ntext \\A subgoal in hfref form is converted to hnr form by\n the preprocessing phase of Sepref (see there for a description).\n\n Theorems with hnr/hfref conclusions can be converted\n using @{attribute to_hfref}/@{attribute to_hnr}.\n This conversion is automatically done for rules registered with \n @{attribute sepref_fr_rules}, such that this attribute accepts both forms.\n\n Conversion to hnr-form can be controlled by specifying \n @{attribute to_hnr_post} unfold-rules, which are applied after the conversion.\n\n Note: These currently contain hard-coded rules to handle \\RETURN o\\o _\\ for up \n to six arguments. If you have more arguments, you need to add corresponding rules here,\n until this issue is fixed and the tool can produce such rules automatically.\n \n Similarly, @{attribute to_hfref_post} is applied after conversion to hfref form.\n\\\n\nthm to_hnr_post\nthm to_hfref_post\n\nsubsubsection \\Importing Parametricity Theorems\\\ntext \\For pure refinements, it is sometimes simpler to specify a parametricity \n theorem than a hnr/hfref theorem, in particular as there is a large number of \n parametricity theorems readily available, in the parametricity component or Autoref,\n and in the Lifting/Transfer tool.\n \n Autoref uses a set-based notation for parametricity theorems \n (e.g. @{term \"((@),(@)) \\ \\A\\list_rel \\ \\A\\list_rel \\ \\A\\list_rel\"}), \n while lifting/transfer uses a predicate based notation (e.g. \n @{term \"rel_fun (list_all2 A) (rel_fun (list_all2 A) (list_all2 A)) (@) (@)\"}).\n\n Currently, we only support the Autoref style, but provide a few lemmas that \n ease manual conversion from the Lifting/Transfer style.\n\n Given a parametricity theorem, the attribute @{attribute sepref_param}\n converts it to a hfref theorem, the attribute \n @{attribute sepref_import_param} does the conversion and registers the result\n as operator rule.\n Relation variables are converted to assertion variables with an \\is_pure\\ constraint.\n\n The behaviour can be customized by @{attribute sepref_import_rewrite}, which\n contains rewrite rules applied in the last but one step of the conversion, before\n converting relation variables to assertion variables. \n These theorems can be used to convert relations to there corresponding assertions,\n e.g., @{thm list_assn_pure_conv[symmetric]} converts a list relation to a list \n assertion.\n\n\n For debugging purposes, the attribute @{attribute sepref_dbg_import_rl_only}\n converts a parametricity theorem to a hnr-theorem. This is the first step of \n the standard conversion, followed by a conversion to hfref form.\n\\\n\nthm sepref_import_rewrite\nthm param_append \\ \\Parametricity theorem for append\\\nthm param_append[sepref_param] \\ \\Converted to hfref-form. \n \\list_rel\\ is rewritten to \\list_assn\\, and the relation variable is replaced by an \n assertion variable and a \\is_pure\\ constraint.\\\nthm param_append[sepref_dbg_import_rl_only]\n\n\ntext \\For re-using Lifting/Transfer style theorems, the constants \n @{const p2rel} and @{const rel2p} may be helpful, however, there is no\n automation available yet.\n\n Usage examples can be found in, e.g., @{theory Refine_Imperative_HOL.IICF_Multiset}, where we \n import parametricity lemmas for multisets from the Lifting/Transfer package.\n\\\n\nthm p2rel \\ \\Simp rules to convert predicate to relational style\\\nthm rel2p \\ \\Simp rules to convert relational to predicate style\\\n\n\nsubsection \\Composition\\\n\nsubsubsection \\Fref-Rules\\\ntext \\\n In standard parametricity theorems as described above, one cannot specify\n preconditions for the parameters, e.g., @{term hd} is only parametric for \n non-empty lists. \n\n As of Isabelle2016, the Lifting/Transfer package cannot specify\n such preconditions at all.\n\n Autoref's parametricity tool can specify such preconditions by using first-order rules,\n (cf. @{thm param_hd}). However, currently, @{attribute sepref_import_param} cannot handle \n these first-order rules. \n\n Instead, Sepref supports the fref-format for parametricity rules, which resembles the \n hfref-format: Abstract and concrete objects are functions with exactly one parameter, \n uncurried if necessary. Moreover, there is an explicit precondition.\n The syntax is \\(uncurry\\<^sub>x f, uncurry\\<^sub>x g) \\ [P]\\<^sub>f (...(R\\<^sub>1\\\\<^sub>rR\\<^sub>2)\\\\<^sub>r...)\\\\<^sub>rR\\<^sub>n) \\ R\\,\n and without precondition, we have \\(...(R\\<^sub>1\\\\<^sub>rR\\<^sub>2)\\\\<^sub>r...)\\\\<^sub>rR\\<^sub>n) \\\\<^sub>f R\\. \n Note the left-bracketing of the tuples, which is non-standard in Isabelle.\n As we currently have no syntax for a left-associative product relation, we\n use the right-associative syntax @{term \"(\\\\<^sub>r)\"} and explicit brackets.\n\n The attribute @{attribute to_fref} can convert (higher-order form) parametricity \n theorems to the fref-form.\n\\\n\nsubsubsection \\Composition of hfref and fref theorems\\\ntext \\\n fref and hfref theorems can be composed, if the \n abstract function or the first theorem equals the concrete function of the \n second theorem. Currently, we can compose an hfref with an fref theorem, \n yielding a hfref theorem, and two fref-theorems, yielding an fref theorem.\n As we do not support refinement of heap-programs, but only refinement \\<^emph>\\into\\ heap \n programs, we cannot compose two hfref theorems.\n\n The attribute @{attribute FCOMP} does these compositions and normalizes the result.\n Normalization consists of precondition simplification, and distributing composition\n over products, such that composition can be done argument-wise. \n For this, we unfold with @{attribute fcomp_norm_unfold}, and then simplify with\n @{attribute fcomp_norm_simps}.\n\n The \\FCOMP\\ attribute tries to convert its arguments to hfref/fref form, such that\n it also accepts hnr-rules and parametricity rules.\n\n The standard use-case for \\FCOMP\\ is to compose multiple refinement steps to\n get the final correctness theorem. Examples for this are in the quickstart guide.\n\n Another use-case for \\FCOMP\\ is to compose a refinement theorem of a \n container operation, that refines the elements by identity, with a parametricity theorem\n for the container operation, that adds a (pure) refinement of the elements.\n In practice, the high-level utilities @{command sepref_decl_op} and \n @{command sepref_decl_impl} are used for this purpose. Internally, they use \\FCOMP\\.\n\\\n\nthm fcomp_norm_unfold\nthm fcomp_norm_simps\n\nthm array_get_hnr_aux \\ \\Array indexing, array elements are refined by identity\\\nthm \"op_list_get.fref\" \\ \\Parametricity theorem for list indexing\\\n\nthm array_get_hnr_aux[FCOMP op_list_get.fref] \\ \\Composed theorem\\\n\n\\ \\Note the definition @{thm array_assn_def}\\\ncontext\n notes [fcomp_norm_unfold] = array_assn_def[symmetric]\nbegin\n thm array_get_hnr_aux[FCOMP op_list_get.fref] \\ \\Composed theorem, \\array_assn\\ folded.\\\nend\n\nsubsection \\Registration of Interface Types\\\ntext \\\n An interface type represents some conceptual type, which is encoded to a \n more complex type in HOL. For example, the interface type @{typ \"('k,'v)i_map\"}\n represents maps, which are encoded as @{typ \"'k \\ 'v option\"} in HOL.\n\n New interface types must be registered by the command @{command sepref_decl_intf}.\n\\\n\nsepref_decl_intf ('a,'b) i_my_intf is \"'a*'a \\ 'b option\"\n\\ \\Declares @{typ \"('a,'b) i_my_intf\"} as new interface type, and registers it\n to correspond to @{typ \"'a*'a \\ 'b option\"}. \n Note: For HOL, the interface type is just an arbitrary new type, which is \n not related to he corresponding HOL type.\\\n\nsepref_decl_intf ('a,'b) i_my_intf2 (infix \"*\\\\<^sub>i\" 0) is \"'a*'a \\ 'b option\"\n\\ \\There is also a version that declares infix-syntax for the interface type.\n In this case we have @{typ \"'a *\\\\<^sub>i 'b\"}. @{typ \"'a\\'b\"}\n Be aware of syntax space pollution, as the syntax for interface types and \n HOL types is the same.\\\n\n\n\nsubsection \\Registration of Abstract Operations\\\ntext \\\n Registering a new abstract operation requires some amount of setup,\n which is automated by the \\sepref_register\\ tool. Currently, it only \n works for operations, not for combinators. \n\n The @{command sepref_register} command takes a list of terms and registers \n them as operators. Optionally, each term can have an interface type annotation. \n\n If there is no interface type annotation, the interface type is derived from the \n terms HOL type, which is rewritten by the theorems from @{attribute map_type_eqs}.\n This rewriting is useful for bulk-setup of many constants with conceptual types \n different from there HOL-types. \n Note that the interface type must correspond to the HOL type of the registered term,\n otherwise, you'll get an error message.\n\n If the term is not a single constant or variable, and does not already start \n with a @{const PR_CONST} tag, such a tag will be added, and also a pattern rule \n will be registered to add the tag on operator identification.\n \n If the term has a monadic result type (@{typ \"_ nres\"}), also an \n arity and combinator rule for the monadify phase are generated.\n\n There is also an attribute version @{attribute \"sepref_register_adhoc\"}.\n It has the same syntax, and generates the same theorems, but does not give\n names to the theorems. It's main application is to conveniently register fixed\n variables of a context. Warning: Make sure not to export such an attribute from \n the context, as it may become meaningless outside the context, or worse, confuse \n the tool.\n\\\n\ntext \\Example for bulk-registration, utilizing type-rewriting\\\n\ndefinition \"map_op1 m n \\ m(n\\n+1)\"\ndefinition \"map_op2 m n \\ m(n\\n+2)\"\ndefinition \"map_op3 m n \\ m(n\\n+3)\"\ndefinition \"map_op_to_map (m::'a\\'b) \\ m\"\n\ncontext\n notes [map_type_eqs] = map_type_eqI[of \"TYPE('a\\'b)\" \"TYPE(('a,'b)i_map)\"]\nbegin\n sepref_register map_op1 map_op2 map_op3 \n \\ \\Registered interface types use \\i_map\\\\\n sepref_register map_op_to_map :: \"('a\\'b) \\ ('a,'b) i_map\"\n \\ \\Explicit type annotation is not rewritten\\\nend\n\ntext \\Example for insertion of \\PR_CONST\\ tag and attribute-version\\\n\ncontext\n fixes N :: nat and D :: int\n notes [[sepref_register_adhoc N D]]\n \\ \\In order to use \\N\\ and \\D\\ as operators (constant) inside this context,\n they have to be registered. However, issuing a \\sepref_register\\ command \n inside the context would export meaningless registrations to the global \n theory.\\\n\n notes [sepref_import_param] = IdI[of N] IdI[of D]\n \\ \\For declaring refinement rules, the \\sepref_import_param\\ attribute comes \n in handy here. If this is not possible, you have to work with nested contexts,\n proving the refinement lemmas in the first level, and declaring them as\n \\sepref_fr_rules\\ on the second level.\\\n\nbegin\n definition \"newlist \\ replicate N D\"\n\n sepref_register newlist\n print_theorems\n \\ \\\\PR_CONST\\ tag is added, pattern rule is generated\\\n\n sepref_register other_basename_newlist: newlist\n print_theorems\n \\ \\The base name for the generated theorems can be overridden\\\n\n sepref_register yet_another_basename_newlist: \"PR_CONST newlist\"\n print_theorems\n \\ \\If \\PR_CONST\\ tag is specified, no pattern rule is generated automatically\\\n\nend\n\ntext \\Example for mcomb/arity theorems\\\ndefinition \"select_a_one l \\ SPEC (\\i. i l!i = (1::nat))\"\n\nsepref_register \"select_a_one\"\n print_theorems\n \\ \\Arity and mcomb theorem is generated\\\n\n\ntext \\\n The following command fails, as the specified interface type does not\n correspond to the HOL type of the term:\n @{theory_text \\sepref_register hd :: \"(nat,nat) i_map\"\\}\n\\\n\nsubsection \\High-Level tools for Interface/Implementation Declaration\\\ntext \\\n The Imperative Isabelle Collections Framework (IICF), which comes with Sepref,\n has a concept of interfaces, which specify a set of abstract operations for\n a conceptual type, and implementations, which implement these operations.\n \n Each operation may have a natural precondition, which is established already \n for the abstract operation. Many operations come in a plain version, and a \n monadic version which asserts the precondition. Implementations may \n strengthen the precondition with implementation specific preconditions.\n\n Moreover, each operation comes with a parametricity lemma. \n When registering an implementation, the refinement of the implementation is\n combined with the parametricity lemma to allow for (pure) refinements of the \n element types.\n\n @{rail \\@@{command sepref_decl_op} ('(' @{text flags} ')')? \\\n (@{text name} @':')? @{text term} @'::' @{text term} \\\n (@'where' @{text props})? \\} \n \n The command @{command sepref_decl_op} declares an abstract operation.\n It takes a term defining the operation, and a parametricity relation.\n It generates the monadic version from the plain version, defines constants\n for the operations, registers them, and tries to prove parametricity lemmas\n automatically. Parametricity must be proved for the operation, and for the \n precondition. If the automatic parametricity proofs fail, the user gets \n presented goals that can be proven manually.\n\n Optionally, a basename for the operation can be specified. If none is specified, \n a heuristics tries to derive one from the specified term.\n\n A list of properties (separated by space and/or \\and\\) can be specified, \n which get constraint-preconditions of the relation. \n\n Finally, the following flags can be specified. Each flag can be prefixed by \\no_\\ \n to invert its meaning:\n \\<^descr>[mop] (default: true) Generate monadic version of operation\n \\<^descr>[ismop] (default: false) Indicate that given term is the monadic version\n \\<^descr>[rawgoals] (default: false) Present raw goals to user, without attempting to prove them\n \\<^descr>[def] (default: true) Define a constant for the specified term. Otherwise, use the specified term literally.\n\n\\\n\ntext \\\n \n @{rail \\@@{command sepref_decl_impl} ('(' @{text flags} ')')? \\\n (@{text name} @':')? (@'[' @{text term} @']')? \\\n @{text thm} (@'uses' @{text thm})?\n \\} \n\n The @{command sepref_decl_impl} command declares an implementation of an interface operation.\n It takes a refinement theorem for the implementation, and combines it with the corresponding\n parametricity theorem. After \\uses\\, one can override the parametricity theorem to be used.\n A heuristics is used to merge the preconditions of the refinement and parametricity theorem.\n This heuristics can be overridden by specifiying the desired precondition inside \\[\\]\\.\n Finally, the user gets presented remaining subgoals that cannot be solved by the heuristics.\n The command accepts the following flags:\n \\<^descr>[mop] (default: true) Generate implementation for monadic version\n \\<^descr>[ismop] (default: false) Declare that the given theorems refer to the monadic version\n \\<^descr>[transfer] (default: true) Try to automatically transfer the implementation's precondition\n over the argument relation from the parametricity theorem.\n \\<^descr>[rawgoals] (default: false) Do not attempt to solve or simplify the goals\n \\<^descr>[register] (default: true) Register the generated theorems as operation rules. \n\\\n\nsubsection \\Defining synthesized Constants\\\ntext \\\n The @{command sepref_definition} allows one to specify a name, an abstract term and\n a desired refinement relation in hfref-form. It then sets up a goal that can be\n massaged (usually, constants are unfolded and annotations/implementation specific \n operations are added) and then solved by @{method sepref}.\n After the goal is solved, the command extracts the synthesized term and defines it as\n a constant with the specified name. Moreover, it sets up code equations for the constant,\n correctly handling recursion combinators. Extraction of code equations is controlled by the\n \\prep_code\\ flag. Examples for this command can be found in the quickstart guide.\n\\\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Userguides/Sepref_Guide_Reference.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.28190907984886393}} {"text": "section \\ COMPASS Modelling Language \\\n\ntheory utp_cml\nimports \"UTP1-Reactive-Designs.utp_rea_designs\" \"UTP1.utp_full\"\nbegin\n\nsubsection \\ Preliminaries \\\n\ndatatype '\\ tevent = Tock \"'\\ set\" | Event '\\\n\ntype_synonym ('\\,'\\) st_cml = \"('\\, '\\ tevent list, unit) rsp\"\ntype_synonym ('\\,'\\) cmlact = \"('\\,'\\) st_cml hrel\"\ntype_synonym ('a,'\\,'\\) expr_cml = \"('a, ('\\,'\\) st_cml \\ ('\\,'\\) st_cml) uexpr\"\n\nfun events :: \"'\\ tevent list \\ '\\ tevent list\" where\n\"events [] = []\" |\n\"events (Tock A # t) = events t\" |\n\"events (Event x # t) = (Event x # events t)\"\n\nlemma events_append [simp]: \"events (xs @ ys) = events(xs) @ events(ys)\"\n apply (induct xs, simp_all)\n apply (rename_tac x xs)\n apply (case_tac x)\n apply (simp_all)\ndone\n\nfun tocks :: \"'\\ tevent list \\ '\\ tevent list\" where\n\"tocks [] = []\" |\n\"tocks (Tock A # xs) = Tock A # tocks xs\" |\n\"tocks (Event x # xs) = tocks xs\"\n\nfun refusals :: \"'\\ tevent list \\ '\\ set\" where\n\"refusals [] = {}\" |\n\"refusals (Tock A # t) = A \\ refusals t\" |\n\"refusals (Event x # t) = refusals t\"\n\nfun idleprefix :: \"'\\ tevent list \\ '\\ tevent list\" where\n\"idleprefix [] = []\" |\n\"idleprefix (Tock A # t) = (Tock A # idleprefix t)\" |\n\"idleprefix (Event x # t) = []\"\n\ndefinition \"idlesuffix = idleprefix \\ rev\"\n\nsyntax\n \"_events\" :: \"logic \\ logic\" (\"events\\<^sub>u'(_')\")\n \"_tocks\" :: \"logic \\ logic\" (\"tocks\\<^sub>u'(_')\")\n \"_refusals\" :: \"logic \\ logic\" (\"refusals\\<^sub>u'(_')\")\n \"_idleprefix\" :: \"logic \\ logic\" (\"idleprefix\\<^sub>u'(_')\")\n \"_idlesuffix\" :: \"logic \\ logic\" (\"idlesuffix\\<^sub>u'(_')\")\n \"_ev\" :: \"logic \\ logic\" (\"ev\\<^sub>u'(_')\")\n \"_tock\" :: \"logic \\ logic \\ logic\" (\"tock\\<^sub>u'(_,_')\")\n\ntranslations\n \"events\\<^sub>u(t)\" == \"CONST uop CONST events t\"\n \"tocks\\<^sub>u(t)\" == \"CONST uop CONST tocks t\"\n \"refusals\\<^sub>u(t)\" == \"CONST uop CONST refusals t\"\n \"idleprefix\\<^sub>u(t)\" == \"CONST uop CONST idleprefix t\"\n \"idlesuffix\\<^sub>u(t)\" == \"CONST uop CONST idlesuffix t\"\n \"ev\\<^sub>u(e)\" == \"CONST uop CONST Event e\"\n \"tock\\<^sub>u(t,A)\" == \"CONST bop CONST Tock t A\"\n\nsubsection \\ Signature \\\n\nabbreviation time_length :: \"(nat,'\\,'\\) expr_cml\" (\"\\<^bold>l\")\n where \"\\<^bold>l \\ U(length(tocks(&tt)))\"\n\nabbreviation CML :: \"(('\\, '\\) st_cml \\ ('\\, '\\) st_cml) health\"\n where \"CML \\ SRD\"\n\nabbreviation Skip :: \"('\\,'\\) cmlact\" where\n\"Skip \\ II\\<^sub>R\"\n\nabbreviation Assigns :: \"'\\ usubst \\ ('\\,'\\) cmlact\" (\"\\_\\\\<^sub>C\") where\n\"Assigns \\ \\ \\\\\\\\<^sub>R\"\n\ndefinition Stop :: \"('\\,'\\) cmlact\" where\n[upred_defs]: \"Stop = \\<^bold>R\\<^sub>s(true \\ U(events(&tt) = []) \\ false)\"\n\ndefinition DoCML :: \"('\\, '\\) uexpr \\ ('\\,'\\) cmlact\" where\n [upred_defs]:\n \"DoCML a = \\<^bold>R\\<^sub>s(true \\ U(events(&tt) = [] \\ \\a\\\\<^sub>S\\<^sub>< \\ refusals(&tt))\n \\ U(&tt = idleprefix(&tt) @ [Event(\\a\\\\<^sub>S\\<^sub><)]\n \\ $st\\ = $st \\ \\a\\\\<^sub>S\\<^sub>< \\ refusals(&tt)))\"\n\ndefinition Wait :: \"(nat, '\\) uexpr \\ ('\\,'\\) cmlact\" where\n [upred_defs, rdes_def]:\n \"Wait n = \\<^bold>R\\<^sub>s(true \\ U(events(&tt) = [] \\ length(&tt) < \\n\\\\<^sub>S\\<^sub><)\n \\ U(events(&tt) = [] \\ length(&tt) = \\n\\\\<^sub>S\\<^sub><\n \\ $st\\ = $st))\"\n\nlemma Skip_def: \"Skip = \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ $st\\ =\\<^sub>u $st))\"\n by (simp add: srdes_skip_def, rel_auto)\n\nsubsection \\ Healthiness conditions \\\n\nabbreviation RT1 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT1 \\ R1\"\nabbreviation RT2 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT2 \\ R2c\"\nabbreviation RT3 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT3 \\ R3h\"\nabbreviation RT4 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT4 \\ RD1\"\nabbreviation RT5 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT5 \\ RD2\"\nabbreviation RT6 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT6(P) \\ Skip ;; P\"\nabbreviation RT7 :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\" where \"RT7 \\ RD3\"\n\nabbreviation RT :: \"('\\,'\\) cmlact \\ ('\\,'\\) cmlact\"\nwhere \"RT \\ RT1 \\ RT2 \\ RT3 \\ RT4 \\ RT7\"\n\ntext \\ For the time being we omit RT8. We also omit RT5 and RT6 as, as they are both tautologies \n of the reduced theory, as we shall show. \\\n\ntext \\ The following definition is taken from (Canham and Woodcock, 2014) \\\n\nlemma Skip_CML_def: \"Skip = (RT3 \\ RT4) (\\ $wait\\ \\ $tr\\ =\\<^sub>u $tr \\ $st\\ =\\<^sub>u $st \\ $ok\\)\"\n by (rel_auto)\n\nsubsection \\ Laws \\\n\nlemma Wait_0: \"Wait 0 = Skip\"\nproof -\n have \"Wait 0 = \\<^bold>R\\<^sub>s(true \\ U(events(&tt) = [] \\ 0 > length(&tt)) \\ U(events(&tt) = [] \\ length(&tt) = 0 \\ $st\\ = $st))\"\n (is \"?lhs = \\<^bold>R\\<^sub>s(?P \\ ?Q \\ ?R)\")\n by (simp add: Wait_def alpha)\n also have \"... = \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ $st\\ =\\<^sub>u $st))\"\n proof -\n have 1:\"?Q = false\"\n by (pred_auto)\n have 2:\"R1(?R) = ($tr\\ =\\<^sub>u $tr \\ $st\\ =\\<^sub>u $st)\"\n by (rel_auto)\n show ?thesis\n by (metis (no_types, lifting) \"1\" \"2\" RHS_design_post_R1)\n qed\n also have \"... = Skip\"\n by (simp add: Skip_def)\n finally show ?thesis .\nqed\n\nlemma skip_lift_state [alpha]: \"\\II\\\\<^sub>S = ($st\\ =\\<^sub>u $st)\"\n by (rel_auto)\n\nlemma Stop_left_zero:\n assumes \"P is CML\"\n shows \"Stop ;; P = Stop\"\nproof -\n have \"Stop ;; P = \\<^bold>R\\<^sub>s(true \\ U(events(&tt) = []) \\ false) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P))\"\n by (simp add: SRD_reactive_tri_design Stop_def assms)\n also have \"... = \\<^bold>R\\<^sub>s (true \\ U(\\ $st\\ \\ events(&tt) = []) \\ false)\"\n by (subst RHS_tri_design_composition, simp_all add: unrest R2s_true R1_false R2s_false)\n also have \"... = \\<^bold>R\\<^sub>s (true \\ U(events(&tt) = []) \\ false)\"\n by (simp add: ex_unrest unrest)\n finally show ?thesis\n by (simp add: Stop_def)\nqed\n\n(*\nlemma Wait_m_plus_n: \"(Wait m ;; Wait n) = (Wait (m + n))\"\nproof -\n have 1: \"(R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;; R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt))) =\n R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< \\\\<^sub>u #\\<^sub>u(&tt) \\ #\\<^sub>u(&tt) <\\<^sub>u \\m + n\\\\<^sub>S\\<^sub><)\" (is \"?lhs = ?rhs\")\n proof -\n have \"?lhs = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (((events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ #\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h\n (events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ \\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\))) \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\))\"\n by (simp add: R2_seqr_form usubst unrest, rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ ((events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ (#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h\n (\\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\) \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\))) \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: seqr_pre_out unrest conj_assoc, simp add: conj_comm)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ ((#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h\n (\\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\))) \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: seqr_post_out unrest conj_assoc)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ ((#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h (\\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\))) \\\n events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (meson shEx_cong utp_pred_laws.inf.left_commute)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (\\(\\#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u m\\\\<^sub>< \\ II) ;;\\<^sub>h (\\n\\\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\))\\\\<^sub>S) \\\n events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: alpha)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (\\(II \\ \\#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u m\\\\<^sub>>) ;;\\<^sub>h (\\n\\\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\))\\\\<^sub>S) \\\n events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: pre_skip_post)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (\\\\#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u m\\\\<^sub>< \\ \\n\\\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\)\\\\<^sub>S) \\\n events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: seqr_pre_transfer unrest)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>2\\)) \\\n events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: alpha)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ \\<^bold>\\ tt\\<^sub>0 \\ #\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(drop\\<^sub>u(#\\<^sub>u(\\tt\\<^sub>1\\), \\tt\\<^sub>0\\)) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ \\tt\\<^sub>0\\ =\\<^sub>u \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\ \\\n \\tt\\<^sub>1\\ =\\<^sub>u take\\<^sub>u(#\\<^sub>u(\\tt\\<^sub>1\\), \\tt\\<^sub>0\\) \\ \\tt\\<^sub>2\\ =\\<^sub>u drop\\<^sub>u(#\\<^sub>u(\\tt\\<^sub>1\\), \\tt\\<^sub>0\\))\"\n by ((rule shEx_cong)+, rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ \\<^bold>\\ tt\\<^sub>0 \\ \\n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(drop\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\)) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\\n \\tt\\<^sub>1\\ =\\<^sub>u take\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\) \\ \\tt\\<^sub>2\\ =\\<^sub>u drop\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\) \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub><)\"\n by ((rule shEx_cong)+, rel_auto, simp_all add: min_absorb2)\n also have \"... = (\\<^bold>\\ tt\\<^sub>0 \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(\\tt\\<^sub>0\\) \\ events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub><)\"\n by (rel_auto)\n also have \"... = R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< \\\\<^sub>u #\\<^sub>u(&tt) \\ #\\<^sub>u(&tt) <\\<^sub>u \\m + n\\\\<^sub>S\\<^sub><)\"\n by (simp add: R2_form usubst unrest, rel_auto)\n finally show ?thesis .\n qed\n have 2:\"(R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;; R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)) =\n R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)\" (is \"?lhs = ?rhs\")\n proof -\n have \"?lhs = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ ((events\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\\\ \\ #\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h\n (events\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ #\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st))\n \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: R2_seqr_form usubst unrest, rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ ((#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) ;;\\<^sub>h (#\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)) \\\n events\\<^sub>u(\\tt\\<^sub>1\\ + \\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (\\(\\#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u m\\\\<^sub>< \\ II) ;;\\<^sub>h (#\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>< \\ II)\\\\<^sub>S) \\\n events\\<^sub>u(\\tt\\<^sub>1\\ + \\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: alpha)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (\\\\#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u m\\\\<^sub>< \\ #\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>< \\ II\\\\<^sub>S) \\\n events\\<^sub>u(\\tt\\<^sub>1\\ + \\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: pre_skip_post, simp add: seqr_pre_transfer unrest)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ (#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ #\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>1\\ + \\tt\\<^sub>2\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (simp add: alpha)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ \\<^bold>\\ tt\\<^sub>0 \\ (#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ #\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ \\tt\\<^sub>0\\ =\\<^sub>u \\tt\\<^sub>1\\ + \\tt\\<^sub>2\\)\"\n by (rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>1 \\ \\<^bold>\\ tt\\<^sub>2 \\ \\<^bold>\\ tt\\<^sub>0 \\ (#\\<^sub>u(\\tt\\<^sub>1\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ #\\<^sub>u(\\tt\\<^sub>2\\) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\\n \\tt\\<^sub>1\\ =\\<^sub>u take\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\) \\ \\tt\\<^sub>2\\ =\\<^sub>u drop\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\))\"\n by ((rule shEx_cong)+, rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>0 \\ (#\\<^sub>u(drop\\<^sub>u(\\m\\\\<^sub>S\\<^sub><, \\tt\\<^sub>0\\)) =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub><)\"\n by (rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>0 \\ (#\\<^sub>u(\\tt\\<^sub>0\\) - \\m\\\\<^sub>S\\<^sub>< =\\<^sub>u \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub><)\"\n by (rel_auto)\n also have \"... = (\\<^bold>\\ tt\\<^sub>0 \\ (#\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\m\\\\<^sub>S\\<^sub>< + \\n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st) \\\n events\\<^sub>u(\\tt\\<^sub>0\\) =\\<^sub>u \\\\ \\ $tr\\ =\\<^sub>u $tr + \\tt\\<^sub>0\\ \\ #\\<^sub>u(\\tt\\<^sub>0\\) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub><)\"\n by (rel_auto)\n also have \"... = ?rhs\"\n by (simp add: R2_form usubst unrest, rel_auto)\n finally show ?thesis .\n qed\n show ?thesis\n proof -\n have \"(Wait m ;; Wait n) =\n \\<^bold>R\\<^sub>s (true \\ ((\\ $st\\ \\ events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)) \\ R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)))\n \\ R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st))\"\n by (simp add: Wait_def RHS_tri_design_composition unrest R2s_true R1_false R2_def[THEN sym] 1[simplified] 2[simplified])\n also have \"... =\n \\<^bold>R\\<^sub>s (true \\ R2(((\\ $st\\ \\ events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)) \\ R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)))\n \\ R2(events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)))\"\n using RHS_design_export_R2 by blast\n also have \"... =\n \\<^bold>R\\<^sub>s (true \\ R2((events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt) \\ R2 (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)))\n \\ R2(events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)))\"\n by (simp add: ex_unrest unrest)\n also have \"... =\n \\<^bold>R\\<^sub>s (true \\ R2((events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt) \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)))\n \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st)))\"\n by (simp add: R2_wait'_cond R2_idem R2_disj)\n also have \"... =\n \\<^bold>R\\<^sub>s (true \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt) \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) \\\\<^sub>u \\m\\\\<^sub>S\\<^sub>< \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)))\n \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st))\" (is \"?lhs = \\<^bold>R\\<^sub>s(?P \\ ?Q \\ ?R)\")\n by (metis (mono_tags, hide_lams) R2_def RHS_design_export_R1 RHS_design_export_R2s)\n also have \"... = \\<^bold>R\\<^sub>s (true \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt)) \\ (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ #\\<^sub>u(&tt) =\\<^sub>u \\m + n\\\\<^sub>S\\<^sub>< \\ $st\\ =\\<^sub>u $st))\"\n proof -\n have 1:\"?Q = (events\\<^sub>u(&tt) =\\<^sub>u \\\\ \\ \\m + n\\\\<^sub>S\\<^sub>< >\\<^sub>u #\\<^sub>u(&tt))\"\n by (pred_auto)\n show ?thesis\n by (simp add: 1)\n qed\n also have \"... = Wait (m + n)\"\n by (simp add: Wait_def)\n finally show ?thesis .\n qed\nqed\n*)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/utp_cml.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2819090798488639}} {"text": "(* Title: Imperative_HOL_Time/Ref_Time.thy\n Author: Maximilian P. L. Haslbeck & Bohua Zhan, TU Muenchen\n*)\n\nsection \\Monadic references\\\n\ntext \\This theory is an adaptation of \\HOL/Imperative_HOL/Ref.thy\\,\n adding time bookkeeping.\\\n\ntheory Ref_Time\nimports Array_Time\nbegin\n\ntext \\\n Imperative reference operations; modeled after their ML counterparts.\n See \\<^url>\\https://caml.inria.fr/pub/docs/manual-caml-light/node14.15.html\\\n and \\<^url>\\https://www.smlnj.org/doc/Conversion/top-level-comparison.html\\.\n\\\n\nsubsection \\Primitives\\\n\ndefinition present :: \"heap \\ 'a::heap ref \\ bool\" where\n \"present h r \\ addr_of_ref r < lim h\"\n\ndefinition get :: \"heap \\ 'a::heap ref \\ 'a\" where\n \"get h = from_nat \\ refs h TYPEREP('a) \\ addr_of_ref\"\n\ndefinition set :: \"'a::heap ref \\ 'a \\ heap \\ heap\" where\n \"set r x = refs_update\n (\\h. h(TYPEREP('a) := ((h (TYPEREP('a))) (addr_of_ref r := to_nat x))))\"\n\ndefinition alloc :: \"'a \\ heap \\ 'a::heap ref \\ heap\" where\n \"alloc x h = (let\n l = lim h;\n r = Ref l\n in (r, set r x (h\\lim := l + 1\\)))\"\n\ndefinition noteq :: \"'a::heap ref \\ 'b::heap ref \\ bool\" (infix \"=!=\" 70) where\n \"r =!= s \\ TYPEREP('a) \\ TYPEREP('b) \\ addr_of_ref r \\ addr_of_ref s\"\n\n\nsubsection \\Monad operations\\\n\ndefinition ref :: \"'a::heap \\ 'a ref Heap\" where\n [code del]: \"ref v = Heap_Time_Monad.heap (%h. let (r,h') = alloc v h in (r,h',1))\"\n\ndefinition lookup :: \"'a::heap ref \\ 'a Heap\" (\"!_\" 61) where\n [code del]: \"lookup r = Heap_Time_Monad.tap (\\h. get h r)\"\n\ndefinition update :: \"'a ref \\ 'a::heap \\ unit Heap\" (\"_ := _\" 62) where\n [code del]: \"update r v = Heap_Time_Monad.heap (\\h. ((), set r v h, 1))\"\n\ndefinition change :: \"('a::heap \\ 'a) \\ 'a ref \\ 'a Heap\" where\n \"change f r = do {\n x \\ ! r;\n let y = f x;\n r := y;\n return y\n }\"\n\n\nsubsection \\Properties\\\n\ntext \\Primitives\\\n\nlemma noteq_sym: \"r =!= s \\ s =!= r\"\n and unequal [simp]: \"r \\ r' \\ r =!= r'\" \\ \\same types!\\\n by (auto simp add: noteq_def)\n\nlemma noteq_irrefl: \"r =!= r \\ False\"\n by (auto simp add: noteq_def)\n\nlemma present_alloc_neq: \"present h r \\ r =!= fst (alloc v h)\"\n by (simp add: present_def alloc_def noteq_def Let_def)\n\nlemma next_fresh [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"\\ present h r\"\n using assms by (cases h) (auto simp add: alloc_def present_def Let_def)\n\nlemma next_present [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"present h' r\"\n using assms by (cases h) (auto simp add: alloc_def set_def present_def Let_def)\n\nlemma get_set_eq [simp]:\n \"get (set r x h) r = x\"\n by (simp add: get_def set_def)\n\nlemma get_set_neq [simp]:\n \"r =!= s \\ get (set s x h) r = get h r\"\n by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n \"set r x (set r y h) = set r x h\"\n by (simp add: set_def)\n\nlemma not_present_alloc [simp]:\n \"\\ present h (fst (alloc v h))\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma set_set_swap:\n \"r =!= r' \\ set r x (set r' x' h) = set r' x' (set r x h)\"\n by (simp add: noteq_def set_def fun_eq_iff)\n\nlemma alloc_set:\n \"fst (alloc x (set r x' h)) = fst (alloc x h)\"\n by (simp add: alloc_def set_def Let_def)\n\nlemma get_alloc [simp]:\n \"get (snd (alloc x h)) (fst (alloc x' h)) = x\"\n by (simp add: alloc_def Let_def)\n\nlemma set_alloc [simp]:\n \"set (fst (alloc v h)) v' (snd (alloc v h)) = snd (alloc v' h)\"\n by (simp add: alloc_def Let_def)\n\nlemma get_alloc_neq: \"r =!= fst (alloc v h) \\ \n get (snd (alloc v h)) r = get h r\"\n by (simp add: get_def set_def alloc_def Let_def noteq_def)\n\nlemma lim_set [simp]:\n \"lim (set r v h) = lim h\"\n by (simp add: set_def)\n\nlemma present_alloc [simp]: \n \"present h r \\ present (snd (alloc v h)) r\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma present_set [simp]:\n \"present (set r v h) = present h\"\n by (simp add: present_def fun_eq_iff)\n\nlemma noteq_I:\n \"present h r \\ \\ present h r' \\ r =!= r'\"\n by (auto simp add: noteq_def present_def)\n\n\ntext \\Monad operations\\\n\nlemma execute_ref [execute_simps]:\n \"execute (ref v) h = Some (let (r,h') = alloc v h in (r,h',1))\"\n by (simp add: ref_def execute_simps)\n\nlemma success_refI [success_intros]:\n \"success (ref v) h\"\n by (auto intro: success_intros simp add: ref_def)\n\nlemma effect_refI [effect_intros]:\n assumes \"(r, h') = alloc v h\" \"n=1\"\n shows \"effect (ref v) h h' r n\"\n apply (rule effectI) apply (insert assms, simp add: execute_simps)\n by (metis case_prod_conv) \n\nlemma effect_refE [effect_elims]:\n assumes \"effect (ref v) h h' r n\" \n obtains \"get h' r = v\" and \"present h' r\" and \"\\ present h r\" and \"n=1\"\n using assms apply (rule effectE) apply (simp add: execute_simps)\n by (metis (no_types, lifting) Ref_Time.alloc_def Ref_Time.get_set_eq fst_conv next_fresh next_present prod.case_eq_if snd_conv)\n\nlemma execute_lookup [execute_simps]:\n \"Heap_Time_Monad.execute (lookup r) h = Some (get h r, h, 1)\"\n by (simp add: lookup_def execute_simps)\n\nlemma success_lookupI [success_intros]:\n \"success (lookup r) h\"\n by (auto intro: success_intros simp add: lookup_def)\n\nlemma effect_lookupI [effect_intros]:\n assumes \"h' = h\" \"x = get h r\" \"n=1\"\n shows \"effect (!r) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_lookupE [effect_elims]:\n assumes \"effect (!r) h h' x n\"\n obtains \"h' = h\" \"x = get h r\" \"n=1\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_update [execute_simps]:\n \"Heap_Time_Monad.execute (update r v) h = Some ((), set r v h, 1)\"\n by (simp add: update_def execute_simps)\n\nlemma success_updateI [success_intros]:\n \"success (update r v) h\"\n by (auto intro: success_intros simp add: update_def)\n\nlemma effect_updateI [effect_intros]:\n assumes \"h' = set r v h\" \"n=1\"\n shows \"effect (r := v) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updateE [effect_elims]:\n assumes \"effect (r' := v) h h' r n\"\n obtains \"h' = set r' v h\" \"n=1\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_change [execute_simps]:\n \"Heap_Time_Monad.execute (change f r) h = Some (f (get h r), set r (f (get h r)) h, 3)\"\n by (simp add: change_def bind_def Let_def execute_simps)\n\nlemma success_changeI [success_intros]:\n \"success (change f r) h\"\n by (auto intro!: success_intros effect_intros simp add: change_def)\n\nlemma effect_changeI [effect_intros]: \n assumes \"h' = set r (f (get h r)) h\" \"x = f (get h r)\" \"n=3\"\n shows \"effect (change f r) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps) \n\nlemma effect_changeE [effect_elims]:\n assumes \"effect (change f r') h h' r n\"\n obtains \"h' = set r' (f (get h r')) h\" \"r = f (get h r')\" \"n=3\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma lookup_chain:\n \"(!r \\ f) = wait 1 \\ f\"\n by (rule Heap_eqI) (auto simp add: lookup_def execute_simps intro: execute_bind)\n\n(* this one is wrong! \nlemma update_change [code]:\n \"r := e = change (\\_. e) r \\ return ()\"\n by (rule Heap_eqI) (simp add: change_def lookup_chain)\n*)\n\ntext \\Non-interaction between imperative arrays and imperative references\\\n\nlemma array_get_set [simp]:\n \"Array_Time.get (set r v h) = Array_Time.get h\"\n by (simp add: Array_Time.get_def set_def fun_eq_iff)\n\nlemma get_update [simp]:\n \"get (Array_Time.update a i v h) r = get h r\"\n by (simp add: get_def Array_Time.update_def Array_Time.set_def)\n\nlemma alloc_update:\n \"fst (alloc v (Array_Time.update a i v' h)) = fst (alloc v h)\"\n by (simp add: Array_Time.update_def Array_Time.get_def Array_Time.set_def alloc_def Let_def)\n\nlemma update_set_swap:\n \"Array_Time.update a i v (set r v' h) = set r v' (Array_Time.update a i v h)\"\n by (simp add: Array_Time.update_def Array_Time.get_def Array_Time.set_def set_def)\n\nlemma length_alloc [simp]: \n \"Array_Time.length (snd (alloc v h)) a = Array_Time.length h a\"\n by (simp add: Array_Time.length_def Array_Time.get_def alloc_def set_def Let_def)\n\nlemma array_get_alloc [simp]: \n \"Array_Time.get (snd (alloc v h)) = Array_Time.get h\"\n by (simp add: Array_Time.get_def alloc_def set_def Let_def fun_eq_iff)\n\nlemma present_update [simp]: \n \"present (Array_Time.update a i v h) = present h\"\n by (simp add: Array_Time.update_def Array_Time.set_def fun_eq_iff present_def)\n\nlemma array_present_set [simp]:\n \"Array_Time.present (set r v h) = Array_Time.present h\"\n by (simp add: Array_Time.present_def set_def fun_eq_iff)\n\nlemma array_present_alloc [simp]:\n \"Array_Time.present h a \\ Array_Time.present (snd (alloc v h)) a\"\n by (simp add: Array_Time.present_def alloc_def Let_def)\n\nlemma set_array_set_swap:\n \"Array_Time.set a xs (set r x' h) = set r x' (Array_Time.set a xs h)\"\n by (simp add: Array_Time.set_def set_def)\n\nhide_const (open) present get set alloc noteq lookup update change\n\n\nsubsection \\Code generator setup\\\n\ntext \\Intermediate operation avoids invariance problem in \\Scala\\ (similar to value restriction)\\\n\ndefinition ref' where\n [code del]: \"ref' = ref\"\n\n\n\n\ntext \\SML / Eval\\\n\ncode_printing type_constructor ref \\ (SML) \"_/ ref\"\ncode_printing type_constructor ref \\ (Eval) \"_/ Unsynchronized.ref\"\ncode_printing constant Ref \\ (SML) \"raise/ (Fail/ \\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (SML) \"(fn/ ()/ =>/ ref/ _)\"\ncode_printing constant ref' \\ (Eval) \"(fn/ ()/ =>/ Unsynchronized.ref/ _)\"\ncode_printing constant Ref_Time.lookup \\ (SML) \"(fn/ ()/ =>/ !/ _)\"\ncode_printing constant Ref_Time.update \\ (SML) \"(fn/ ()/ =>/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (SML) infixl 6 \"=\"\n\ncode_reserved Eval Unsynchronized\n\n\ntext \\OCaml\\\n\ncode_printing type_constructor ref \\ (OCaml) \"_/ ref\"\ncode_printing constant Ref \\ (OCaml) \"failwith/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (OCaml) \"(fun/ ()/ ->/ ref/ _)\"\ncode_printing constant Ref_Time.lookup \\ (OCaml) \"(fun/ ()/ ->/ !/ _)\"\ncode_printing constant Ref_Time.update \\ (OCaml) \"(fun/ ()/ ->/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml ref\n\n\ntext \\Haskell\\\n\ncode_printing type_constructor ref \\ (Haskell) \"Heap.STRef/ Heap.RealWorld/ _\"\ncode_printing constant Ref \\ (Haskell) \"error/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (Haskell) \"Heap.newSTRef\"\ncode_printing constant Ref_Time.lookup \\ (Haskell) \"Heap.readSTRef\"\ncode_printing constant Ref_Time.update \\ (Haskell) \"Heap.writeSTRef\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Haskell) infix 4 \"==\"\ncode_printing class_instance ref :: HOL.equal \\ (Haskell) -\n\n\ntext \\Scala\\\n\ncode_printing type_constructor ref \\ (Scala) \"!Ref[_]\"\ncode_printing constant Ref \\ (Scala) \"!sys.error(\\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (Scala) \"('_: Unit)/ =>/ Ref((_))\"\ncode_printing constant Ref_Time.lookup \\ (Scala) \"('_: Unit)/ =>/ Ref.lookup((_))\"\ncode_printing constant Ref_Time.update \\ (Scala) \"('_: Unit)/ =>/ Ref.update((_), (_))\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Van_Emde_Boas_Trees/Imperative_HOL_Time/Ref_Time.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.2819090798488639}} {"text": "theory Refinement_MMU_No_ASIDs\n\nimports Update_Root_Ref\n\nbegin \n\n\ndefinition \n tlb_rel :: \"(unit tlb_entry set) state_scheme \\ (vaddr set) state_scheme \\ bool\"\nwhere \n \"tlb_rel r t \\ \\(s:: unit det_tlb_state_scheme) (s':: unit sat_tlb_state_scheme). \n tlb_rel_det r (typ_det_tlb s) \\ tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb s') \\ \n tlb_rel_abs (typ_sat_tlb s') t\"\n\n\nlemmas abc = mmu_translate_det_sat_refine [simplified split_def Let_def, rotated 2] \nlemmas abc' = mmu_translate_non_det_det_refine [simplified split_def Let_def, rotated 2]\n\n\nlemma address_refinement:\n \"\\ mmu_translate va r = (pa, r'); mmu_translate va t = (pa', t') ;\n va \\ set_tlb t ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n pa = pa' \\ tlb_rel (typ_non_det_tlb r') (typ_set_tlb t') \" \n apply (clarsimp simp: tlb_rel_def)\n apply (frule_tac s = s' and pa = \"fst(mmu_translate va s')\" and s' = \"snd(mmu_translate va s')\" in \n mmu_translate_sat_incon_refine [rotated]; clarsimp?)\n apply (frule_tac va = va and pa = \"fst(mmu_translate va s)\" and s' = \"snd(mmu_translate va s)\"in abc; clarsimp?)\n using tlb_rel_abs_consistent apply force\n apply (frule_tac va = va and pa = \"fst(mmu_translate va r)\" and s' = \"snd(mmu_translate va r)\"in abc'; clarsimp?)\n apply (smt det_tlb_more mmu_incon_eq_asid_root_mem mmu_translate_sat_const_tlb sat_tlb_more tlb_rel_absD tlb_rel_sat_consistent typ_det_prim_parameter typ_sat_prim_parameter typ_set_prim_parameter)\n by force\n\n\nlemma read_refinement:\n \"\\ mmu_read_size (va, sz) r = (val, r'); mmu_read_size (va, sz) t = (val', t');\n va \\ set_tlb t ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n val = val' \\ tlb_rel (typ_non_det_tlb r') (typ_set_tlb t') \" \n apply (clarsimp simp: tlb_rel_def)\n apply (frule_tac s = s' and val = \"fst(mmu_read_size (va, sz) s')\" and s' = \"snd(mmu_read_size (va, sz) s')\" in \n mmu_read_sat_incon_refine [rotated]; clarsimp?)\n apply (frule_tac va = va and sz= sz and val = \"fst(mmu_read_size (va, sz)s)\" and s' = \"snd(mmu_read_size (va, sz) s)\" and \n val' = \"fst(mmu_read_size (va, sz)s')\" and t' = \"snd(mmu_read_size (va, sz) s')\" in mmu_read_non_det_sat_refine [rotated 2]; clarsimp?)\n using tlb_rel_abs_consistent apply force\n\n apply (frule_tac va = va and sz= sz and val = \"fst(mmu_read_size (va, sz)r)\" and s' = \"snd(mmu_read_size (va, sz) r)\" and \n val' = \"fst(mmu_read_size (va, sz)s)\" and t' = \"snd(mmu_read_size (va, sz) s)\" in mmu_read_non_det_det_refine [rotated 2]; clarsimp?)\n using tlb_rel_abs_consistent tlb_rel_sat_consistent apply fastforce\n apply (metis (no_types) prod.collapse)\n by force\n\nlemma write_refinement:\n \"\\ mmu_write_size (val,va, sz) r = ((), r'); mmu_write_size (val,va, sz) t = ((), t');\n va \\ set_tlb t ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n tlb_rel (typ_non_det_tlb r') (typ_set_tlb t') \" \n apply (clarsimp simp: tlb_rel_def)\n apply (frule_tac s = s' and s' = \"snd(mmu_write_size (val,va, sz) s')\" in \n mmu_write_sat_incon_refine [rotated]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust)\n apply (frule_tac va = va and sz= sz and s' = \"snd(mmu_write_size (val,va, sz) s)\" and t' = \"snd(mmu_write_size (val,va, sz) s')\" and val = val in \n mmu_write_det_sat_refine [rotated]; clarsimp?)\n using tlb_rel_abs_consistent apply force \n apply (metis eq_snd_iff old.unit.exhaust)\n apply (metis eq_snd_iff old.unit.exhaust)\n apply (frule_tac va = va and sz= sz and val = val and s' = \"snd(mmu_write_size (val,va, sz) r)\" and \n t' = \"snd(mmu_write_size (val,va, sz) s)\" in mmu_write_non_det_det_refine [rotated]; clarsimp?)\n using tlb_rel_abs_consistent tlb_rel_sat_consistent apply fastforce\n apply (metis eq_snd_iff old.unit.exhaust)\n by force\n\n\n\ndatatype op_typ = translate vaddr \n | memread \"vaddr \\ nat\" \n | memwrite \"bool list \\ vaddr \\ nat\"\n\n\ndatatype res_typ = PA paddr\n | BL \"bool list\"\n | UT unit\n\nfun \n mem_op :: \"op_typ \\ 'a::mmu state_scheme \\ _\"\n where \n \"mem_op (translate va) s = (PA (fst (mmu_translate va s)), snd (mmu_translate va s))\"\n| \"mem_op (memread (va, sz)) s = (BL (fst (mmu_read_size (va, sz) s)), snd (mmu_read_size (va, sz) s))\"\n| \"mem_op (memwrite (bl, va, sz)) s = (UT (fst (mmu_write_size (bl, va, sz) s)), snd (mmu_write_size (bl, va, sz) s))\"\n\n\nfun\n consistent_f :: \"op_typ \\ 'a::mmu set_tlb_state_scheme \\ bool\"\nwhere\n \"consistent_f (translate va) s = (va \\ set_tlb s)\"\n| \"consistent_f (memread (va, sz)) s = (va \\ set_tlb s)\"\n| \"consistent_f (memwrite (bl, va, sz)) s = (va \\ set_tlb s)\"\n\n\nlemma mem_refine:\n \"\\ mem_op f r = (res, r') ; mem_op f t = (res', t'); \n consistent_f f t ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n res = res' \\ tlb_rel (typ_non_det_tlb r') (typ_set_tlb t')\"\n apply (cases f; clarsimp)\n apply (rename_tac va)\n apply (rule_tac va = va and r = r and t = t in address_refinement; force?) \n apply (rename_tac va sz)\n apply (rule_tac read_refinement; force?) \n apply (rename_tac bl va sz)\n apply (rule_tac val = bl and va = va and sz = sz and r = r and t = t in write_refinement; force?) \n apply (metis eq_snd_iff old.unit.exhaust) \n by (metis eq_snd_iff old.unit.exhaust)\n\n\n\ndatatype op_typ' = root_update paddr \n | flush_op flush_type\n\n\nlemma root_refinement:\n \"\\ update_TTBR0 rt r = ((), r'); update_TTBR0 rt t = ((), t') ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n tlb_rel (typ_non_det_tlb r') (typ_set_tlb t') \" \n apply (clarsimp simp: tlb_rel_def)\n apply (frule_tac s = s' and s' = \"snd (update_TTBR0 rt s')\" in update_root_sat_incon_refine [rotated]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n apply (frule_tac r = rt and s' =\"snd ( update_TTBR0 rt s) \" and t' = \"snd (update_TTBR0 rt s')\" in update_root_det_sat_refine [rotated 2]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n apply (metis eq_snd_iff old.unit.exhaust) \n apply (frule_tac r = rt and s' =\"snd ( update_TTBR0 rt r) \" and t' = \"snd (update_TTBR0 rt s)\" in update_root_non_det_det_refine [rotated 2]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n by force\n \nlemma flush_refinement:\n \"\\ flush f r = ((), r'); flush f t = ((), t') ; tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n tlb_rel (typ_non_det_tlb r') (typ_set_tlb t') \" \n apply (clarsimp simp: tlb_rel_def)\n apply (frule_tac s = s' and s' = \"snd (flush f s')\" in flush_sat_incon_refine [rotated]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n apply (frule_tac f= f and s' =\"snd ( flush f s) \" and t' = \"snd (flush f s')\" in flush_det_sat_refine [rotated 2]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n apply (metis eq_snd_iff old.unit.exhaust) \n apply (frule_tac f = f and s' =\"snd ( flush f r) \" and t' = \"snd (flush f s)\" in flush_non_det_det_refine [rotated 2]; clarsimp?)\n apply (metis eq_snd_iff old.unit.exhaust) \n by force\n \nfun \n main_op :: \"op_typ' \\ 'a::mmu state_scheme \\ _\"\n where \n \"main_op (root_update rt) s = ((), snd (update_TTBR0 rt s))\"\n| \"main_op (flush_op f) s = ((), snd (flush f s))\"\n\nlemma main_refine:\n \"\\ main_op f r = ((), r') ; main_op f t = ((), t'); \n tlb_rel (typ_non_det_tlb r) (typ_set_tlb t) \\ \\ \n tlb_rel (typ_non_det_tlb r') (typ_set_tlb t')\"\n apply (cases f; clarsimp)\n apply (rename_tac rt)\n apply (rule_tac rt = rt and r = r and t = t in root_refinement; force?) \n apply (metis eq_snd_iff old.unit.exhaust) \n apply (metis eq_snd_iff old.unit.exhaust) \n apply (rule_tac f = x2 in flush_refinement; force?) \n apply (metis eq_snd_iff old.unit.exhaust) \n by (metis eq_snd_iff old.unit.exhaust) \n \n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_No_ASID/Refinement_MMU_No_ASIDs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.2817904583776214}} {"text": "section {*FUNCTION\\_\\_PARSER\\_TO\\_EDPDA*}\ntheory\n FUNCTION__PARSER_TO_EDPDA\n\nimports\n PRJ_12_07_01__ENTRY\n\nbegin\n\ndefinition F_PARSER_TO_EDPDA__rules_rev :: \"\n ('stack, 'event, 'stack) epda_step_label\n \\ ('stack, 'event) parser_step_label\"\n where\n \"F_PARSER_TO_EDPDA__rules_rev e \\\n \\rule_lpop = rev (edge_pop e) @ [edge_src e],\n rule_rpop = option_to_list (edge_event e),\n rule_lpush = rev (edge_push e) @ [edge_trg e],\n rule_rpush = []\\\"\n\ndefinition F_PARSER_TO_EDPDA__configuration :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserS_conf\n \\ 'stack\n \\ ('stack, 'event, 'stack) epdaS_conf\"\n where\n \"F_PARSER_TO_EDPDA__configuration G c BOX \\\n \\epdaS_conf_state = last (parserS_conf_stack c),\n epdaS_conf_scheduler = butlast_if_match (parserS_conf_scheduler c) (parser_bottom G),\n epdaS_conf_stack = rev (butlast (parserS_conf_stack c)) @ [BOX]\\\"\n\ndefinition F_PARSER_TO_EDPDA__configuration_rev :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\"\n where\n \"F_PARSER_TO_EDPDA__configuration_rev G c \\\n \\parserS_conf_stack =\n (if epdaS_conf_stack c = []\n then []\n else rev (butlast (epdaS_conf_stack c)))\n @ [epdaS_conf_state c],\n parserS_conf_scheduler = epdaS_conf_scheduler c @ [parser_bottom G]\\\"\n\nlemma F_PARSER_TO_EDPDA__configuration_rev_F_PARSER_TO_EDPDA__configuration: \"\n parserS_conf_stack c \\ []\n \\ \\w. parserS_conf_scheduler c = w @ [parser_bottom G]\n \\ F_PARSER_TO_EDPDA__configuration_rev G (F_PARSER_TO_EDPDA__configuration G c BOX) = c\"\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def F_PARSER_TO_EDPDA__configuration_def)\n apply(case_tac c)\n apply(rename_tac parserS_conf_stacka parserS_conf_schedulera)(*strict*)\n apply(clarsimp)\n apply(rename_tac parserS_conf_stack w)(*strict*)\n apply (metis butlast_if_match_direct)\n done\n\nlemma F_PARSER_TO_EDPDA__configuration_F_PARSER_TO_EDPDA__configuration_rev: \"\n epdaS_conf_stack c \\ []\n \\ last (epdaS_conf_stack c) = BOX\n \\ F_PARSER_TO_EDPDA__configuration G (F_PARSER_TO_EDPDA__configuration_rev G c) BOX = c\"\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n apply (metis butlast_if_match_direct)\n done\n\ndefinition F_PARSER_TO_EDPDA__SpecInput1 :: \"\n ('stack, 'event, 'marker) parser\n \\ 'stack\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__SpecInput1 G BOX \\\n valid_parser G\n \\ (\\r \\ parser_rules G.\n rule_rpush r = []\n \\ length (rule_rpop r) \\ Suc 0\n \\ rule_lpop r \\ []\n \\ rule_lpush r \\ [])\n \\ BOX \\ parser_nonterms G\"\n\nlemma F_PARSER_TO_EDPDA__rules_rev_F_PARSER_TO_EDPDA__rules: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ e \\ parser_rules G\n \\ F_PARSER_TO_EDPDA__rules_rev (F_PARSER_TO_EDPDA__rules e) = e\"\n apply(simp add: F_PARSER_TO_EDPDA__rules_rev_def F_PARSER_TO_EDPDA__rules_def)\n apply(case_tac e)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpusha rule_rpush)(*strict*)\n apply(clarsimp)\n apply(rename_tac rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\rule_lpop = rule_lpopa, rule_rpop = rule_rpopa, rule_lpush = rule_lpusha, rule_rpush = rule_rpusha\\\"\n in ballE)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n prefer 2\n apply(rename_tac rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(rename_tac rule_lpop rule_rpop rule_lpush)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(case_tac \"rule_rpop\")\n apply(rename_tac rule_lpop rule_rpop rule_lpush)(*strict*)\n apply(clarsimp)\n apply(rename_tac rule_lpop rule_rpop rule_lpush a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma F_PARSER_TO_EDPDA__rules_F_PARSER_TO_EDPDA__rules_rev: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ e \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\n \\ F_PARSER_TO_EDPDA__rules (F_PARSER_TO_EDPDA__rules_rev e) = e\"\n apply(simp add: F_PARSER_TO_EDPDA__rules_rev_def F_PARSER_TO_EDPDA__rules_def)\n apply(case_tac e)\n apply(rename_tac edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(case_tac \"edge_event\")\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac edge_src edge_event edge_pop edge_push edge_trg a)(*strict*)\n apply(clarsimp)\n done\n\nlemma F_PARSER_TO_EDPDA__SpecInput1_implies_never_fixed: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.derivation_initial G d\n \\ parser_fixed_input_length_recN d n = 0\"\n apply(induct n)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d (Suc n)\")\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ parserS_step_relation G c1 e2 c2\")\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n\"\n in parserS.step_detail_before_some_position)\n apply(rename_tac n a)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e2\"\n in ballE)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(simp add: parserS_step_relation_def)\n apply(rename_tac n e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n done\n\nlemma F_PARSER_TO_EDPDA__SpecInput1_implies_parser_not_observes_input_terminator: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parser_not_observes_input_terminator G\"\n apply(simp add: parser_not_observes_input_terminator_def F_PARSER_TO_EDPDA__SpecInput1_def)\n done\n\nlemma F_PARSER_TO_EDPDA_generates_epda: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ valid_epda (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"parser_not_observes_input_terminator G\")\n prefer 2\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_parser_not_observes_input_terminator)\n apply(force)\n apply(simp add: valid_epda_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: valid_parser_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G x\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def F_PARSER_TO_EDPDA_def)\n apply(simp add: valid_epda_step_label_def)\n apply(rule conjI)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x k w)(*strict*)\n apply (metis last_in_set_X)\n apply(rename_tac x)(*strict*)\n apply(rule conjI)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x k w)(*strict*)\n apply(simp add: option_to_set_def list_to_option_def kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w)(*strict*)\n apply(clarsimp)\n apply(case_tac \"take k w\")\n apply(rename_tac x k w)(*strict*)\n apply(force)\n apply(rename_tac x k w a list)(*strict*)\n apply(clarsimp)\n apply (metis last_in_set_X)\n apply(rename_tac x k w nat)(*strict*)\n apply(clarsimp)\n apply(simp add: parser_not_observes_input_terminator_def)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(rule conjI)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def option_to_set_def list_to_option_def)\n apply(clarsimp)\n apply(rename_tac x xa k w)(*strict*)\n apply(case_tac \"kPrefix k (w @ [parser_bottom G])\")\n apply(rename_tac x xa k w)(*strict*)\n apply(force)\n apply(rename_tac x xa k w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac x k w a)(*strict*)\n apply(simp add: kPrefix_def)\n apply(simp add: valid_parser_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w a)(*strict*)\n apply(clarsimp)\n apply (metis DiffE List.set_simps(2) kPrefix_def set_kPrefix_subset set_subset_in)\n apply(rename_tac x k w a nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(rule conjI)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac x k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w)(*strict*)\n prefer 2\n apply(rename_tac x k w nat)(*strict*)\n apply(force)\n apply(rename_tac x k w)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"rev (butlast (rule_lpop x))\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x k w xa)(*strict*)\n apply (metis in_set_butlastD subsetE)\n apply(rename_tac x)(*strict*)\n apply(rule conjI)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac x k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w)(*strict*)\n prefer 2\n apply(rename_tac x k w nat)(*strict*)\n apply(force)\n apply(rename_tac x k w)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"rev (butlast (rule_lpush x))\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x k w xa)(*strict*)\n apply (metis in_set_butlastD subsetE)\n apply(rename_tac x)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rule order_antisym)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x a)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x a k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x a k w)(*strict*)\n prefer 2\n apply(rename_tac x a k w nat)(*strict*)\n apply(force)\n apply(rename_tac x a k w)(*strict*)\n apply(clarsimp)\n apply (metis in_set_butlastD set_append2 set_rev set_subset_in subsetE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x a)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x a k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac x a k w)(*strict*)\n prefer 2\n apply(rename_tac x a k w nat)(*strict*)\n apply(force)\n apply(rename_tac x a k w)(*strict*)\n apply(clarsimp)\n apply (metis in_set_butlastD set_append2 set_rev set_subset_in subsetE)\n done\n\nlemma F_PARSER_TO_EDPDA__configuration_reflects_steps: \"\n e1 \\ parser_rules G1\n \\ parserS_step_relation G1 c1 e1 c1'\n \\ c1 \\ parserS.get_accessible_configurations G1\n \\ F_PARSER_TO_EDPDA__SpecInput1 G1 BOX\n \\ epdaS_step_relation (F_PARSER_TO_EDPDA G1 BOX) (F_PARSER_TO_EDPDA__configuration G1 c1 BOX) (F_PARSER_TO_EDPDA__rules e1) (F_PARSER_TO_EDPDA__configuration G1 c1' BOX)\"\n apply(subgoal_tac \"c1 \\ parserS_configurations G1\")\n prefer 2\n apply(simp add: parserS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rule parserS.belongs_configurations)\n apply(rename_tac d i option)(*strict*)\n apply(rule parserS.derivation_initial_belongs)\n apply(rename_tac d i option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac d i option)(*strict*)\n apply(force)\n apply(rename_tac d i option)(*strict*)\n apply(force)\n apply(subgoal_tac \"valid_parser_step_label G1 e1\")\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def valid_parser_def)\n apply(simp add: epdaS_step_relation_def)\n apply(rule conjI)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule conjI)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: parserS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rule conjI)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: parserS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rule conjI)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: parserS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(simp add: parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac x xa k w wa xc)(*strict*)\n apply(case_tac xa)\n apply(rename_tac x xa k w wa xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac x k w wa xc)(*strict*)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w wa xc)(*strict*)\n apply(clarsimp)\n apply (metis F_PARSER_TO_EDPDA__SpecInput1_def Suc_length Zero_not_Suc append_Nil2 list.size(3))\n apply(rename_tac x k w wa xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x k w xc nat xa)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w @ [parser_bottom G1]) (parser_bottom G1)\"\n and s=\"w\"\n in ssubst)\n apply(rename_tac x k w xc nat xa)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac x k w xc nat xa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac x xa k w wa xc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. xa = w' @ [x']\")\n apply(rename_tac x xa k w wa xc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac x xa k w wa xc a list)(*strict*)\n apply(thin_tac \"xa=a#list\")\n apply(clarsimp)\n apply(rename_tac x k w xc w')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(rename_tac x k w w')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (kPrefix k (w @ [parser_bottom G1]) @ w' @ [parser_bottom G1]) (parser_bottom G1)\"\n and s=\"kPrefix k (w @ [parser_bottom G1]) @ w'\"\n in ssubst)\n apply(rename_tac x k w w')(*strict*)\n apply (metis butlast_if_match_direct butlast_if_match_pull_out_prime)\n apply(rename_tac x k w w')(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w' @ [parser_bottom G1]) (parser_bottom G1)\"\n and s=\"w'\"\n in ssubst)\n apply(rename_tac x k w w')(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac x k w w')(*strict*)\n apply(clarsimp)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(case_tac \"k-length w\")\n apply(rename_tac x k w w')(*strict*)\n prefer 2\n apply(rename_tac x k w w' nat)(*strict*)\n apply(force)\n apply(rename_tac x k w w')(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac x k w w')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x k w w')(*strict*)\n apply(clarsimp)\n apply(case_tac \"w\")\n apply(rename_tac x k w w')(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(rename_tac x k w w' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac x k w' a list)(*strict*)\n apply(case_tac k)\n apply(rename_tac x k w' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac x w' a list)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(rename_tac x k w' a list nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x w' a list nat)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(clarsimp)\n apply (metis List.length_take length_0_conv list.size(3) take_all_length)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: parserS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x xa k w xc)(*strict*)\n apply(case_tac \"rule_lpush e1\")\n apply(rename_tac x xa k w xc)(*strict*)\n apply(force)\n apply(rename_tac x xa k w xc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_lpush e1 = w' @ [x']\")\n apply(rename_tac x xa k w xc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac x xa k w xc a list)(*strict*)\n apply(thin_tac \"rule_lpush e1=a#list\")\n apply(clarsimp)\n apply(rename_tac x xa k w xc w' x')(*strict*)\n apply(case_tac \"rule_lpop e1\")\n apply(rename_tac x xa k w xc w' x')(*strict*)\n apply(force)\n apply(rename_tac x xa k w xc w' x' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_lpop e1 = w' @ [x']\")\n apply(rename_tac x xa k w xc w' x' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac x xa k w xc w' x' a list)(*strict*)\n apply(thin_tac \"rule_lpop e1=a#list\")\n apply(clarsimp)\n apply(rename_tac x xa k w xc w' x' w'a x'a)(*strict*)\n apply(rule_tac\n t=\"butlast (x @ w'a @ [x'a])\"\n and s=\"x @ w'a\"\n in ssubst)\n apply(rename_tac x xa k w xc w' x' w'a x'a)(*strict*)\n apply (metis butlast_snoc_2)\n apply(rename_tac x xa k w xc w' x' w'a x'a)(*strict*)\n apply(rule_tac\n t=\"butlast (x @ w' @ [x'])\"\n and s=\"x @ w'\"\n in ssubst)\n apply(rename_tac x xa k w xc w' x' w'a x'a)(*strict*)\n apply (metis butlast_snoc_2)\n apply(rename_tac x xa k w xc w' x' w'a x'a)(*strict*)\n apply(rule_tac\n x=\"rev x@[BOX]\"\n in exI)\n apply (metis NoteAboutRev append_Cons rev_append)\n done\n\nlemma F_PARSER_TO_EDPDA__SpecInput1_never_empty_lhs: \"\n e1 \\ parser_rules G1\n \\ F_PARSER_TO_EDPDA__SpecInput1 G1 BOX\n \\ parserS.derivation_initial G1 d\n \\ d i = Some (pair option c1)\n \\ parserS_conf_stack c1 \\ []\"\n apply(induct i arbitrary: option c1)\n apply(rename_tac option c1)(*strict*)\n apply(simp add: parserS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c1)(*strict*)\n apply(simp add: parserS_initial_configurations_def)\n apply(rename_tac i option c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac i option c1)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ parserS_step_relation G1 c1 e2 c2\")\n apply(rename_tac i option c1)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc i\"\n in parserS.step_detail_before_some_position)\n apply(rename_tac i option c1)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac i option c1)(*strict*)\n apply(force)\n apply(rename_tac i option c1)(*strict*)\n apply(force)\n apply(rename_tac i option c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1a e2 c1a)(*strict*)\n apply(erule_tac\n x=\"e1a\"\n in meta_allE)\n apply(erule_tac\n x=\"c1a\"\n in meta_allE)\n apply(clarsimp)\n apply(simp add: parserS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1a e2 c1a x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_steps: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ c \\ epdaS.get_accessible_configurations (F_PARSER_TO_EDPDA G BOX)\n \\ epdaS_step_relation (F_PARSER_TO_EDPDA G BOX) c (F_PARSER_TO_EDPDA__rules x) c1\n \\ x \\ parser_rules G\n \\ parserS_step_relation G (F_PARSER_TO_EDPDA__configuration_rev G c) x (F_PARSER_TO_EDPDA__configuration_rev G c1)\"\n apply(subgoal_tac \"\\w. BOX \\ set w \\ epdaS_conf_stack c = w @ [BOX]\")\n prefer 2\n apply(rule_tac\n t=\"BOX\"\n and s=\"epda_box (F_PARSER_TO_EDPDA G BOX)\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(force)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option)(*strict*)\n apply(rule epda_no_use_epda_box_implies_stack_content)\n apply(rename_tac d i option)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n apply(rename_tac d i option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i option)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option r)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac d i option xa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(subgoal_tac \"valid_parser_step_label G xa\")\n apply(rename_tac d i option xa)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac d i option xa)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac d i option xa k w)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i option xa k w)(*strict*)\n apply (metis in_set_butlastD insert_absorb insert_subset)\n apply(rename_tac d i option xa k w)(*strict*)\n apply (metis in_set_butlastD insert_absorb insert_subset)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def parserS_step_relation_def epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w wa)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G x\")\n apply(rename_tac w wa)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac w wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def F_PARSER_TO_EDPDA__rules_def)\n apply(case_tac wa)\n apply(rename_tac w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac w)(*strict*)\n apply(force)\n apply(rename_tac w)(*strict*)\n apply(subgoal_tac \"BOX \\ set (rule_lpop x)\")\n apply(rename_tac w)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac w k wa)(*strict*)\n apply (metis set_mp_prime)\n apply(rename_tac w)(*strict*)\n apply (metis last_in_set_X set_rev snoc_eq_iff_butlast trivButLast)\n apply(rename_tac w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w wa a list)(*strict*)\n apply(thin_tac \"wa=a#list\")\n apply(clarsimp)\n apply(rename_tac w')(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac w' k w)(*strict*)\n apply(case_tac \"rule_lpush x\")\n apply(rename_tac w' k w)(*strict*)\n apply(force)\n apply(rename_tac w' k w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_lpush x = w' @ [x']\")\n apply(rename_tac w' k w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w' k w a list)(*strict*)\n apply(thin_tac \"rule_lpush x=a#list\")\n apply(clarsimp)\n apply(rename_tac w' k w w'a)(*strict*)\n apply(rule_tac\n t=\"butlast (rev w'a @ w' @ [BOX])\"\n and s=\"rev w'a @ w'\"\n in ssubst)\n apply(rename_tac w' k w w'a)(*strict*)\n apply (metis append_eq_appendI snoc_eq_iff_butlast)\n apply(rename_tac w' k w w'a)(*strict*)\n apply (metis rev_append rev_rev_ident)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac w wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(case_tac \"rule_rpop x\")\n apply(rename_tac w wa)(*strict*)\n apply(force)\n apply(rename_tac w wa a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_steps_prime: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ \\w. BOX \\ set w \\ epdaS_conf_stack c = w @ [BOX]\n \\ epdaS_step_relation (F_PARSER_TO_EDPDA G BOX) c (F_PARSER_TO_EDPDA__rules x) c1\n \\ x \\ parser_rules G\n \\ parserS_step_relation G (F_PARSER_TO_EDPDA__configuration_rev G c) x (F_PARSER_TO_EDPDA__configuration_rev G c1)\"\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def parserS_step_relation_def epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w wa)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G x\")\n apply(rename_tac w wa)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac w wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def F_PARSER_TO_EDPDA__rules_def)\n apply(case_tac wa)\n apply(rename_tac w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac w)(*strict*)\n apply(force)\n apply(rename_tac w)(*strict*)\n apply(subgoal_tac \"BOX \\ set (rule_lpop x)\")\n apply(rename_tac w)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac w k wa)(*strict*)\n apply (metis set_mp_prime)\n apply(rename_tac w)(*strict*)\n apply (metis last_in_set_X set_rev snoc_eq_iff_butlast trivButLast)\n apply(rename_tac w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w wa a list)(*strict*)\n apply(thin_tac \"wa=a#list\")\n apply(clarsimp)\n apply(rename_tac w')(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac w' k w)(*strict*)\n apply(case_tac \"rule_lpush x\")\n apply(rename_tac w' k w)(*strict*)\n apply(force)\n apply(rename_tac w' k w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_lpush x = w' @ [x']\")\n apply(rename_tac w' k w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w' k w a list)(*strict*)\n apply(thin_tac \"rule_lpush x=a#list\")\n apply(clarsimp)\n apply(rename_tac w' k w w'a)(*strict*)\n apply(rule_tac\n t=\"butlast (rev w'a @ w' @ [BOX])\"\n and s=\"rev w'a @ w'\"\n in ssubst)\n apply(rename_tac w' k w w'a)(*strict*)\n apply (metis append_eq_appendI snoc_eq_iff_butlast)\n apply(rename_tac w' k w w'a)(*strict*)\n apply (metis rev_append rev_rev_ident)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac w wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w wa)(*strict*)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(case_tac \"rule_rpop x\")\n apply(rename_tac w wa)(*strict*)\n apply(force)\n apply(rename_tac w wa a list)(*strict*)\n apply(clarsimp)\n done\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_TSstructure :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\\n \\BOX.\n F_PARSER_TO_EDPDA__SpecInput1 G1 BOX\n \\ G2 = F_PARSER_TO_EDPDA G1 BOX\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_configuration :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ ('stack, 'event) parserS_conf\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 c2 \\\n F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2\n \\ c1 \\ parserS.get_accessible_configurations G1\n \\ F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2) = c2\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_initial_configuration :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ ('stack, 'event) parserS_conf\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 c1 c2 \\\n F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2\n \\ c1 \\ parserS_initial_configurations G1\n \\ F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2) = c2\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_effect :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_effect G1 G2 w1 w2 \\\n F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2\n \\ w1 = w2\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_step_labels :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_step_labels G1 G2 e1 e2 \\\n F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2\n \\ e1 \\ parser_rules G1\n \\ F_PARSER_TO_EDPDA__rules e1 = e2\"\n\nlemma parserS_epdaS_P2A_StateSimLR_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_PARSER_TO_EDPDA__LR__relation_TSstructure G1) \\ valid_parser G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ valid_epda G2)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 BOX)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n done\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_initial_simulation :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ ('stack, 'event) parserS_conf\n \\ (('stack, 'event, 'stack) epda_step_label, ('stack, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulation G1 G2 c1 d \\\n d = der1 (F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2))\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_step_simulation :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda\n \\ ('stack, 'event) parserS_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserS_conf\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ (('stack, 'event, 'stack) epda_step_label, ('stack, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 c1 e1 c1' c2 d \\\n d = der2 (F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2)) (F_PARSER_TO_EDPDA__rules e1) (F_PARSER_TO_EDPDA__configuration G1 c1' (epda_box G2))\"\n\nlemma F_PARSER_TO_EDPDA__configuration_preserves_configurations: \"\n F_PARSER_TO_EDPDA__SpecInput1 G1 BOX\n \\ G2 = F_PARSER_TO_EDPDA G1 BOX\n \\ c1 \\ parserS_configurations G1\n \\ parserS_conf_stack c1 \\ []\n \\ F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2) \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def F_PARSER_TO_EDPDA__configuration_def parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac l w)(*strict*)\n apply(rule conjI)\n apply(rename_tac l w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply (metis last_in_set_X)\n apply(rename_tac l w)(*strict*)\n apply(rule conjI)\n apply(rename_tac l w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply (metis butlast_if_match_direct insert_Diff_single subset_insertI2 subset_insert_iff)\n apply(rename_tac l w)(*strict*)\n apply(rule conjI)\n apply(rename_tac l w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac l w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply (metis subset_insertI2 subset_trans trivButLast)\n done\n\nlemma F_PARSER_TO_EDPDA__configuration_preserves_initial_configurations: \"\n F_PARSER_TO_EDPDA__SpecInput1 G1 BOX\n \\ G2 = F_PARSER_TO_EDPDA G1 BOX\n \\ c1 \\ parserS_initial_configurations G1\n \\ F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2) \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(rule conjI)\n apply(simp only: F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(simp only: parserS_initial_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp only: F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(simp only: parserS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule F_PARSER_TO_EDPDA__configuration_preserves_configurations)\n apply(force)\n apply(force)\n apply (metis parserS_inst_AX_initial_configuration_belongs subsetE)\n apply(simp add: parserS_initial_configurations_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ parserS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 c1 (the (get_configuration (d2 0))) \\ F_PARSER_TO_EDPDA__LR__relation_initial_simulation G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_simulation_def)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: der1_def)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__configuration_preserves_initial_configurations)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(simp add: parserS.get_accessible_configurations_def)\n apply(rule_tac\n x=\"der1 c1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(simp add: parserS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(rule parserS.der1_is_derivation)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(simp add: der1_def)\n apply(rename_tac G1 c1 BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def get_configuration_def der1_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ parser_step_labels G1 \\ (\\c1'. parserS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule_tac\n x=\"der2 (F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2)) (F_PARSER_TO_EDPDA__rules e1) (F_PARSER_TO_EDPDA__configuration G1 c1' (epda_box G2))\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(rule_tac\n t=\"epda_box (F_PARSER_TO_EDPDA G1 BOX)\"\n and s=\"BOX\"\n in ssubst)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def parser_step_labels_def)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(simp add: parser_step_labels_def)\n apply(rule F_PARSER_TO_EDPDA__configuration_reflects_steps)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(subgoal_tac \"c1 \\ parserS_configurations G1\")\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n prefer 2\n apply(simp add: parserS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d i a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 G2 c1 e1 c1' d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d i option)(*strict*)\n apply(rule parserS.belongs_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' d i option)(*strict*)\n apply(rule parserS.derivation_initial_belongs)\n apply(rename_tac G1 G2 c1 e1 c1' d i option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G1 G2 c1 e1 c1' d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__configuration_preserves_configurations)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(simp add: parserS.get_accessible_configurations_def parser_step_labels_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' BOX d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac G1 c1 e1 c1' BOX d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' BOX d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 c1 e1 c1' BOX d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(subgoal_tac \"parserS_conf_stack c1 \\ []\")\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_never_empty_lhs)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: der2_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_step_simulation_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: parserS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(rule_tac\n x=\"derivation_append d (der2 c1 e1 c1') i\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(simp add: parserS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(rule parserS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d i\")\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 G2 c1 e1 c1' d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d i option b)(*strict*)\n apply(simp add: der2_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 e1 c1' d i)(*strict*)\n apply(rule_tac\n x=\"Suc i\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(simp add: derivation_append_def)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: der2_def)\n apply(simp add: get_configuration_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_parser parserS_initial_configurations parser_step_labels parserS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_configuration F_PARSER_TO_EDPDA__LR__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n apply(simp add: parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation parserS_epdaS_P2A_StateSimLR_AX_TSstructure_relation_TSstructure1_belongs parserS_epdaS_P2A_StateSimLR_AX_TSstructure_relation_TSstructure2_belongs )\n done\n\ninterpretation \"parserS_epdaS_P2A_StateSimLR\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_parser\"\n (* configurations1 *)\n \"parserS_configurations\"\n (* initial_configurations1 *)\n \"parserS_initial_configurations\"\n (* step_labels1 *)\n \"parser_step_labels\"\n (* step_relation1 *)\n \"parserS_step_relation\"\n (* effects1 *)\n \"parser_markers\"\n (* marking_condition1 *)\n \"parserS_marking_condition\"\n (* marked_effect1 *)\n \"parserS_marked_effect\"\n (* unmarked_effect1 *)\n \"parserS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_PARSER_TO_EDPDA__LR__relation_configuration\"\n (* relation_initial_configuration *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_configuration\"\n (* relation_effect *)\n \"F_PARSER_TO_EDPDA__LR__relation_effect\"\n (* relation_TSstructure *)\n \"F_PARSER_TO_EDPDA__LR__relation_TSstructure\"\n (* relation_initial_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulation\"\n (* relation_step_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: LOCALE_DEFS epda_interpretations parser_interpretations)\n apply(simp add: parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ parser_step_labels G1 \\ (\\c1'. parserS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect G1 G2) (parserS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_unmarked_effect_def parserS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(subgoal_tac \"parser_fixed_input_length_recN (derivation_append deri1 (der2 c1 e1 c1') deri1n) i=0\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"parser_fixed_input_length_recN (derivation_append deri1 (der2 c1 e1 c1') deri1n) i=0\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n apply(subgoal_tac \"c=ca\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' i e v ca)(*strict*)\n apply(case_tac i)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' i e v ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c')(*strict*)\n apply(rule_tac\n x=\"F_PARSER_TO_EDPDA__configuration G1 c' (epda_box G2)\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule_tac\n x=\"None\"\n in exI)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' i e v ca nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' e v ca nat)(*strict*)\n apply(rename_tac i)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' e v ca i)(*strict*)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_def)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(subgoal_tac \"i < Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' e v ca i)(*strict*)\n prefer 2\n apply(case_tac \"i parserS_configurations G1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' e v ca i option)(*strict*)\n apply(simp add: parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f e v ca i option l w)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f c' e v ca i option)(*strict*)\n apply (metis parserS_epdaS_P2A_StateSimLR.AX_TSstructure_relation_TSstructure1_belongs parserS.belongs_configurations parserS.der2_is_derivation parserS.derivation_append_preserves_derivation_initial_prime parserS.derivation_initial_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca)(*strict*)\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_never_fixed)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(rule parserS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c c' i e v ca cb BOX option b)(*strict*)\n apply(simp add: der2_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ parserS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulation G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect G1 G2) (parserS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(rule_tac\n t=\"derivation_append deri1 (der1 c1) deri1n\"\n and s=\"deri1\"\n in ssubst)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(rule ext)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f x)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(simp add: der1_def)\n apply(rule sym)\n apply(rule parserS.none_position_after_max_dom)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f x)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_simulation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"derivation_append deri2 (der1 (F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2))) deri2n\"\n and s=\"deri2\"\n in ssubst)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule ext)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a x)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(simp add: der1_def)\n apply(rule sym)\n apply(rule epdaS.none_position_after_max_dom)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a x)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f a c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: parserS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule_tac\n t=\"parser_fixed_input_length_recN deri1 i\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 n deri1 deri1n deri2 deri2n f c c' i e v BOX)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_never_fixed)\n apply(rename_tac G1 c1 n deri1 deri1n deri2 deri2n f c c' i e v BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 n deri1 deri1n deri2 deri2n f c c' i e v BOX)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_unmarked_effect_def)\n apply(rule_tac\n x=\"F_PARSER_TO_EDPDA__configuration G1 c' (epda_box G2)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(subgoal_tac \"c' \\ parserS_configurations G1\")\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(subgoal_tac \"c \\ parserS_configurations G1\")\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f i e v l la w)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match (w @ [parser_bottom G1]) (parser_bottom G1)\"\n and s=\"w\"\n in ssubst)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f i e v l la w)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f i e v l la w)(*strict*)\n apply(rule_tac\n t=\"v @ w @ [parser_bottom G1]\"\n and s=\"(v @ w) @ [parser_bottom G1]\"\n in ssubst)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f i e v l la w)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f i e v l la w)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: parserS_initial_configurations_def)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.belongs_configurations)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.derivation_initial_belongs)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(subgoal_tac \"f i \\ f deri1n\")\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n prefer 2\n apply(rule_tac\n f=\"f\"\n in parserS_epdaS_P2A_StateSimLR.mono_all)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v option b)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule_tac\n d=\"deri1\"\n in parserS.allPreMaxDomSome_prime)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_def)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v)(*strict*)\n apply (metis not_None_eq parserS.allPreMaxDomSome_prime parserS.derivation_initial_is_derivation)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v y)(*strict*)\n apply(subgoal_tac \"f i \\ f deri1n\")\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v y)(*strict*)\n apply(simp add: derivation_append_def)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(subgoal_tac \"i\\ deri1n\")\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(rule parserS.allPreMaxDomSome_prime)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v option b)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f c c' i e v y)(*strict*)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_S_def)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule_tac\n d=\"der1 (F_PARSER_TO_EDPDA__configuration G1 c1 (epda_box G2))\"\n in epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 n deri1 deri1n deri2 deri2n f c c' i e v)(*strict*)\n apply(simp add: maximum_of_domain_def der1_def)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect: \"\n ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms parserS_initial_configurations parser_step_labels parserS_step_relation parserS_unmarked_effect epdaS_initial_configurations epdaS_step_relation epdaS_unmarked_effect F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_configuration F_PARSER_TO_EDPDA__LR__relation_effect F_PARSER_TO_EDPDA__LR__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_marking_condition: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ parser_step_labels G1 \\ (\\c1'. parserS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ parserS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__LR__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulation_def F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX)(*strict*)\n apply(simp add: parserS_marking_condition_def epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_def)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(case_tac \"i\\Suc deri1n\")\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i-deri1n\")\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i ca)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: parserS_marking_configurations_def epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply (metis append_Nil butlast_if_match_direct)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(simp add: epdaS_configurations_def parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [parser_bottom G1] (parser_bottom G1)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply (metis append_Nil butlast_if_match_direct)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa x)(*strict*)\n apply (metis set_mp_prime)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_marking_condition: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ parserS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulation G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\derivation_append_fit deri1 (der1 c1) deri1n \\derivation_append_fit deri2 d2 deri2n \\parserS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__LR__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulation_def F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX)(*strict*)\n apply(simp add: parserS_marking_condition_def epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_def)\n apply(simp add: parserS_epdaS_P2A_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(subgoal_tac \"derivation_append deri1 (der1 c1) deri1n = deri1\")\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n prefer 2\n apply(rule ext)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca x)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(simp add: der1_def)\n apply(rule sym)\n apply(rule parserS.none_position_after_max_dom)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca x)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca x)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca x)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(clarsimp)\n apply (metis not_None_eq parserS.allPreMaxDomSome_prime parserS.derivation_initial_is_derivation)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def)\n apply(simp add: parserS_marking_configurations_def epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply (metis append_Nil butlast_if_match_direct)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c i e ca option fa w)(*strict*)\n apply(simp add: epdaS_configurations_def parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule_tac\n t=\"butlast_if_match [parser_bottom G1] (parser_bottom G1)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply (metis append_Nil butlast_if_match_direct)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX i e option fa w l wa x)(*strict*)\n apply (metis set_mp_prime)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms parserS_initial_configurations parser_step_labels parserS_step_relation parserS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_configuration F_PARSER_TO_EDPDA__LR__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_marking_condition)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_marked_effect: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__LR__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ parser_step_labels G1 \\ (\\c1'. parserS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect G1 G2) (parserS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__LR__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulation_def F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(simp add: parserS_marked_effect_def epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c ca)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(simp add: parserS_initial_configurations_def parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX w)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_marked_effect: \"\n \\G1 G2. F_PARSER_TO_EDPDA__LR__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ parserS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulation G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. parserS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__LR__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect G1 G2) (parserS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def F_PARSER_TO_EDPDA__LR__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulation_def F_PARSER_TO_EDPDA__LR__relation_initial_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX a)(*strict*)\n apply(simp add: parserS_marked_effect_def epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c ca)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(simp add: parserS_initial_configurations_def parserS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 n deri1 deri1n deri2 deri2n f BOX w wa)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 c1 d2 n deri1 deri1n deri2 deri2n f BOX c)(*strict*)\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n done\n\nlemma parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms parserS_initial_configurations parser_step_labels parserS_step_relation parserS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_PARSER_TO_EDPDA__LR__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_configuration F_PARSER_TO_EDPDA__LR__relation_effect F_PARSER_TO_EDPDA__LR__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulation F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_step_simulation_preserves_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"parserS_epdaS_P2A_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis parserS_epdaS_P2A_StateSimLR_inst_relation_initial_simulation_preserves_marked_effect)\n done\n\ninterpretation \"parserS_epdaS_P2A_StateSimLR\" : ATS_Simulation_Configuration_WeakLR_FULL\n (* TSstructure1 *)\n \"valid_parser\"\n (* configurations1 *)\n \"parserS_configurations\"\n (* initial_configurations1 *)\n \"parserS_initial_configurations\"\n (* step_labels1 *)\n \"parser_step_labels\"\n (* step_relation1 *)\n \"parserS_step_relation\"\n (* effects1 *)\n \"parser_markers\"\n (* marking_condition1 *)\n \"parserS_marking_condition\"\n (* marked_effect1 *)\n \"parserS_marked_effect\"\n (* unmarked_effect1 *)\n \"parserS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_PARSER_TO_EDPDA__LR__relation_configuration\"\n (* relation_initial_configuration *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_configuration\"\n (* relation_effect *)\n \"F_PARSER_TO_EDPDA__LR__relation_effect\"\n (* relation_TSstructure *)\n \"F_PARSER_TO_EDPDA__LR__relation_TSstructure\"\n (* relation_initial_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulation\"\n (* relation_step_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulation\"\n apply(simp add: LOCALE_DEFS epda_interpretations parser_interpretations)\n apply(simp add:\n parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition parserS_epdaS_P2A_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect )\n done\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_TSstructure :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\\n \\BOX.\n F_PARSER_TO_EDPDA__SpecInput1 G2 BOX\n \\ G1 = F_PARSER_TO_EDPDA G2 BOX\"\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_configuration :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 c2 \\\n F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ F_PARSER_TO_EDPDA__configuration_rev G2 c1 = c2\"\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_initial_configuration :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 c1 c2 \\\n F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_PARSER_TO_EDPDA__configuration_rev G2 c1 = c2\"\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_effect :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_effect G1 G2 w1 w2 \\\n F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2\n \\ w1 = w2\"\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_step_labels :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epda_step_label\n \\ ('stack, 'event) parser_step_label\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_step_labels G1 G2 e1 e2 \\\n F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2\n \\ e1 \\ epda_delta G1\n \\ F_PARSER_TO_EDPDA__rules_rev e1 = e2\"\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_PARSER_TO_EDPDA__RL__relation_TSstructure G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 BOX)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ valid_parser G2)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n done\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL G1 G2 c1 d \\\n d = der1 (F_PARSER_TO_EDPDA__configuration_rev G2 c1)\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_step_simulationRL :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event, 'stack) epda_step_label\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d \\\n d = der2 (F_PARSER_TO_EDPDA__configuration_rev G2 c1) (F_PARSER_TO_EDPDA__rules_rev e1) (F_PARSER_TO_EDPDA__configuration_rev G2 c1')\"\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. parserS.derivation_initial G2 d2 \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 c1 (the (get_configuration (d2 0))) \\ F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(subgoal_tac \"the (get_configuration (der1 (F_PARSER_TO_EDPDA__configuration_rev G2 c1) 0)) \\ parserS_initial_configurations G2\")\n apply(rename_tac G2 c1 BOX)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: epdaS_initial_configurations_def parserS_initial_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: parserS_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 BOX i)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def valid_parser_def)\n apply(clarsimp)\n apply(force)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule parserS.derivation_initialI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule parserS.der1_is_derivation)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(fold der1_def)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(rule_tac\n x=\"der1 c1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule epdaS.derivation_initialI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX c)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(simp add: der1_def get_configuration_def)\n done\n\nlemma F_PARSER_TO_EDPDA__rules_rev_preserves_rules: \"\n F_PARSER_TO_EDPDA__SpecInput1 G2 BOX\n \\ e1 \\ epda_step_labels (F_PARSER_TO_EDPDA G2 BOX)\n \\ F_PARSER_TO_EDPDA__rules_rev e1 \\ parser_rules G2\"\n apply(simp add: epda_step_labels_def)\n apply(simp add: F_PARSER_TO_EDPDA__rules_rev_def F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__rules_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(rule_tac\n t=\"\\rule_lpop = rev (edge_pop (F_PARSER_TO_EDPDA__rules x)) @ [edge_src (F_PARSER_TO_EDPDA__rules x)], rule_rpop = option_to_list (edge_event (F_PARSER_TO_EDPDA__rules x)), rule_lpush = rev (edge_push (F_PARSER_TO_EDPDA__rules x)) @ [edge_trg (F_PARSER_TO_EDPDA__rules x)], rule_rpush = []\\\"\n and s=\"x\"\n in ssubst)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(case_tac x)\n apply(rename_tac x rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(rename_tac rule_lpop rule_rpop rule_lpush)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_rev_def F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: option_to_list_def list_to_option_def)\n apply(case_tac \"rule_rpop\")\n apply(rename_tac rule_lpop rule_rpop rule_lpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpop rule_rpop rule_lpush a list)(*strict*)\n apply(force)\n done\n\nlemma F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations: \"\n c1 \\ epdaS_configurations (F_PARSER_TO_EDPDA G2 BOX)\n \\ \\w. epda_box (F_PARSER_TO_EDPDA G2 BOX) \\ set w \\ epdaS_conf_stack c1 = w @ [epda_box G]\n \\ F_PARSER_TO_EDPDA__SpecInput1 G2 BOX\n \\ F_PARSER_TO_EDPDA__configuration_rev G2 c1 \\ parserS_configurations G2\"\n apply(simp add: parserS_configurations_def epdaS_configurations_def F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(clarsimp)\n apply(rename_tac q w i)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(simp add: valid_parser_def)\n apply(rule conjI)\n apply(rename_tac q w i)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w i x)(*strict*)\n apply(force)\n apply(rename_tac q w i)(*strict*)\n apply(force)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. parserS.derivation G2 d2 \\ parserS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule parserS.der2_is_derivation)\n apply(rule F_PARSER_TO_EDPDA_preserves_steps)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule_tac\n t=\"F_PARSER_TO_EDPDA__rules (F_PARSER_TO_EDPDA__rules_rev e1)\"\n and s=\"e1\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply (metis F_PARSER_TO_EDPDA__rules_F_PARSER_TO_EDPDA__rules_rev epda_step_labels_def)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__rules_rev_preserves_rules)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule parserS.derivation_belongs)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule_tac\n BOX=\"BOX\"\n in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply (metis (full_types) F_PARSER_TO_EDPDA_generates_epda epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac G2 c1 e1 c1' BOX d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' BOX d i a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac G2 c1 e1 c1' BOX d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule epda_no_use_epda_box_implies_stack_content)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(erule_tac\n x=\"r\"\n in ballE)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"valid_parser_step_label G2 r\")\n apply(rename_tac G2 c1 e1 c1' BOX d i option r)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r k w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r k w)(*strict*)\n apply (metis in_set_butlastD insert_absorb insert_subset)\n apply(rename_tac G2 c1 e1 c1' BOX d i option r k w)(*strict*)\n apply (metis in_set_butlastD insert_absorb insert_subset)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac G2 c1 e1 c1' BOX d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' BOX d i a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac G2 c1 e1 c1' BOX d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule_tac\n x=\"derivation_append d (der2 c1 e1 c1') i\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply (metis epdaS.derivation_initial_is_derivation)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac G2 c1 e1 c1' BOX d i option)(*strict*)\n apply(rule_tac\n x=\"Suc i\"\n in exI)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac G2 c1 e1 c1' BOX)(*strict*)\n apply(simp add: der2_def)\n apply(simp add: get_configuration_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_parser parserS_configurations parserS_initial_configurations parser_step_labels parserS_step_relation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__RL__relation_initial_configuration F_PARSER_TO_EDPDA__RL__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n apply(simp add: epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation epdaS_parserS_P2A_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_parserS_P2A_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs )\n done\n\ninterpretation \"epdaS_parserS_P2A_StateSimRL\" : ATS_Simulation_Configuration_Weak\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure1 *)\n \"valid_parser\"\n (* configurations1 *)\n \"parserS_configurations\"\n (* initial_configurations1 *)\n \"parserS_initial_configurations\"\n (* step_labels1 *)\n \"parser_step_labels\"\n (* step_relation1 *)\n \"parserS_step_relation\"\n (* effects1 *)\n \"parser_markers\"\n (* marking_condition1 *)\n \"parserS_marking_condition\"\n (* marked_effect1 *)\n \"parserS_marked_effect\"\n (* unmarked_effect1 *)\n \"parserS_unmarked_effect\"\n (* relation_configuration *)\n \"F_PARSER_TO_EDPDA__RL__relation_configuration\"\n (* relation_initial_configuration *)\n \"F_PARSER_TO_EDPDA__RL__relation_initial_configuration\"\n (* relation_effect *)\n \"F_PARSER_TO_EDPDA__RL__relation_effect\"\n (* relation_TSstructure *)\n \"F_PARSER_TO_EDPDA__RL__relation_TSstructure\"\n (* relation_initial_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL\"\n (* relation_step_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations parser_interpretations)\n apply(simp add: epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaS_unmarked_effect_def parserS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(rule_tac\n x=\"F_PARSER_TO_EDPDA__configuration_rev G2 c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule_tac\n d=\"derivation_append deri1 (der2 c1 e1 c1') deri1n\"\n in epdaS.allPreMaxDomSome_prime)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: epdaS.der2_is_derivation)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule_tac\n t=\"Suc deri1n\"\n and s=\"deri1n + Suc 0\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply (metis concat_has_max_dom der2_maximum_of_domain)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in exI)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n t=\"parser_fixed_input_length_recN (derivation_append deri2 (der2 (F_PARSER_TO_EDPDA__configuration_rev G2 c1) (F_PARSER_TO_EDPDA__rules_rev e1) (F_PARSER_TO_EDPDA__configuration_rev G2 c1')) deri2n) (f i)\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_never_fixed)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.der2_is_derivation)\n apply(rule F_PARSER_TO_EDPDA_preserves_steps)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n t=\"F_PARSER_TO_EDPDA__rules (F_PARSER_TO_EDPDA__rules_rev e1)\"\n and s=\"e1\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__rules_F_PARSER_TO_EDPDA__rules_rev)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rule F_PARSER_TO_EDPDA__rules_rev_preserves_rules)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri2 deri2n\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b aa optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b optiona ba)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"parserS_conf_scheduler b\"\n and s=\"epdaS_conf_scheduler c'@[parser_bottom G2]\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n t=\"parserS_conf_scheduler (F_PARSER_TO_EDPDA__configuration_rev G2 c)\"\n and s=\"epdaS_conf_scheduler cb@[parser_bottom G2]\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n \\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserS_unmarked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaS_unmarked_effect_def parserS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(rule_tac\n x=\"F_PARSER_TO_EDPDA__configuration_rev G2 c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule_tac\n d=\"derivation_append deri1 (der1 c1) deri1n\"\n in epdaS.allPreMaxDomSome_prime)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: epdaS.der1_is_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(rule maximum_of_domain_derivation_append_der1)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in exI)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n t=\"parser_fixed_input_length_recN (derivation_append deri2 (der1 (F_PARSER_TO_EDPDA__configuration_rev G2 c1)) deri2n) (f i)\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_never_fixed)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule parserS.der1_is_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri2 deri2n\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b aa optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b optiona ba)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"parserS_conf_scheduler b\"\n and s=\"epdaS_conf_scheduler c'@[parser_bottom G2]\"\n in ssubst)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(rule_tac\n t=\"parserS_conf_scheduler (F_PARSER_TO_EDPDA__configuration_rev G2 c)\"\n and s=\"epdaS_conf_scheduler cb@[parser_bottom G2]\"\n in ssubst)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f a BOX c cb c' i e option b)(*strict*)\n apply(simp add: derivation_append_def)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms: \"\n ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_unmarked_effect parserS_initial_configurations parserS_step_relation parserS_unmarked_effect F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__RL__relation_initial_configuration F_PARSER_TO_EDPDA__RL__relation_effect F_PARSER_TO_EDPDA__RL__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect)\n done\n\nlemma F_PARSER_TO_EDPDA__SpecInput1_no_pop_of_box: \"\n F_PARSER_TO_EDPDA__SpecInput1 G2 BOX\n \\ \\r \\ epda_delta (F_PARSER_TO_EDPDA G2 BOX) . epda_box (F_PARSER_TO_EDPDA G2 BOX) \\ set (edge_pop r) \\ epda_box (F_PARSER_TO_EDPDA G2 BOX) \\ set (edge_push r)\"\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(clarsimp)\n apply(rename_tac r)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(subgoal_tac \"valid_parser_step_label G2 x\")\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac x k w)(*strict*)\n apply (metis in_set_butlastD subsetD)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_marking_condition: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ parserS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(simp add: parserS_marking_condition_def epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(simp add: derivation_append_def)\n apply(simp add: parserS.derivation_initial_def)\n apply(simp add: parserS_initial_configurations_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(subgoal_tac \"i\\Suc deri1n\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"derivation_append deri1 (der2 c1 e1 c1') deri1n\"\n in epdaS.allPreMaxDomSome_prime)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: epdaS.der2_is_derivation)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb option b)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule maximum_of_domain_derivation_append_der2)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(erule impE)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca cb option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: epdaS_marking_configurations_def parserS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule_tac\n x=\"epdaS_conf_state c\"\n in bexI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule_tac\n G=\"F_PARSER_TO_EDPDA G2 BOX\"\n in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib)(*strict*)\n apply(case_tac \"da ib\")\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib a optiona b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona)(*strict*)\n apply(rule_tac\n d=\"da\"\n in epda_no_use_epda_box_implies_stack_content)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona)(*strict*)\n apply (metis epdaS_parserS_P2A_StateSimRL.AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' n deri1 deri1n deri2 deri2n f BOX i e c ca option d da ia ib optiona)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_no_pop_of_box)\n apply(force)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_marking_condition: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\derivation_append_fit deri1 (der1 c1) deri1n \\derivation_append_fit deri2 d2 deri2n \\epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\parserS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_configuration_def F_PARSER_TO_EDPDA__LR__relation_step_simulationRL_def F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(simp add: parserS_marking_condition_def epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(simp add: derivation_append_def)\n apply(simp add: parserS.derivation_initial_def)\n apply(simp add: parserS_initial_configurations_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_parserS_P2A_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(subgoal_tac \"i\\deri1n\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"derivation_append deri1 (der1 c1) deri1n\"\n in epdaS.allPreMaxDomSome_prime)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: epdaS.der1_is_derivation)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb option b)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(rule maximum_of_domain_derivation_append_der1)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(erule impE)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca cb option b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_PARSER_TO_EDPDA__configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: epdaS_marking_configurations_def parserS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule_tac\n x=\"epdaS_conf_state c\"\n in bexI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(rule_tac\n G=\"F_PARSER_TO_EDPDA G2 BOX\"\n in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia)(*strict*)\n apply(case_tac \"d ia\")\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia a optiona b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona)(*strict*)\n apply(rule_tac\n d=\"d\"\n in epda_no_use_epda_box_implies_stack_content)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona)(*strict*)\n apply (metis epdaS_parserS_P2A_StateSimRL.AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 n deri1 deri1n deri2 deri2n f BOX i e c ca option d ia optiona)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_no_pop_of_box)\n apply(force)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition parserS_initial_configurations parserS_step_relation parserS_marking_condition F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__RL__relation_initial_configuration F_PARSER_TO_EDPDA__RL__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_marking_condition)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_marked_effect: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_configuration G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: parserS_marked_effect_def epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c cb)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_marked_effect: \"\n \\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. parserS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: parserS_marked_effect_def epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri1 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n prefer 2\n apply(rule parserS.some_position_has_details_at_0)\n apply(rule parserS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca cb)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c cb)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect parserS_initial_configurations parserS_step_relation parserS_marked_effect F_PARSER_TO_EDPDA__RL__relation_configuration F_PARSER_TO_EDPDA__RL__relation_initial_configuration F_PARSER_TO_EDPDA__RL__relation_effect F_PARSER_TO_EDPDA__RL__relation_TSstructure F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_step_simulation_preserves_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_parserS_P2A_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_parserS_P2A_StateSimRL_inst_relation_initial_simulation_preserves_marked_effect)\n done\n\ninterpretation \"epdaS_parserS_P2A_StateSimRL\" : ATS_Simulation_Configuration_WeakLR_FULL\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure1 *)\n \"valid_parser\"\n (* configurations1 *)\n \"parserS_configurations\"\n (* initial_configurations1 *)\n \"parserS_initial_configurations\"\n (* step_labels1 *)\n \"parser_step_labels\"\n (* step_relation1 *)\n \"parserS_step_relation\"\n (* effects1 *)\n \"parser_markers\"\n (* marking_condition1 *)\n \"parserS_marking_condition\"\n (* marked_effect1 *)\n \"parserS_marked_effect\"\n (* unmarked_effect1 *)\n \"parserS_unmarked_effect\"\n (* relation_configuration *)\n \"F_PARSER_TO_EDPDA__RL__relation_configuration\"\n (* relation_initial_configuration *)\n \"F_PARSER_TO_EDPDA__RL__relation_initial_configuration\"\n (* relation_effect *)\n \"F_PARSER_TO_EDPDA__RL__relation_effect\"\n (* relation_TSstructure *)\n \"F_PARSER_TO_EDPDA__RL__relation_TSstructure\"\n (* relation_initial_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulationRL\"\n (* relation_step_simulation *)\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulationRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations parser_interpretations)\n apply(simp add: epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_parserS_P2A_StateSimRL_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms )\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_lang1: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.marked_language G \\ epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect SSG1 SSG2) (parserS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule parserS_epdaS_P2A_StateSimLR.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(force)\n apply(rule_tac\n t=\"parserS.marked_language G\"\n and s=\"parserS.finite_marked_language G\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply (metis parserS.AX_marked_language_finite)\n apply(rule_tac\n t=\"epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"epdaS.finite_marked_language (F_PARSER_TO_EDPDA G BOX)\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rule sym)\n apply (rule epdaS.AX_marked_language_finite)\n apply (metis F_PARSER_TO_EDPDA_generates_epda F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def)\n apply(rename_tac x)(*strict*)\n apply(force)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_lang2: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.marked_language G \\ epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect SSG1 SSG2) (epdaS.finite_marked_language SSG1) (parserS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule epdaS_parserS_P2A_StateSimRL.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(force)\n apply(rule_tac\n t=\"parserS.marked_language G\"\n and s=\"parserS.finite_marked_language G\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply (metis parserS.AX_marked_language_finite)\n apply(rule_tac\n t=\"epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"epdaS.finite_marked_language (F_PARSER_TO_EDPDA G BOX)\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rule sym)\n apply (rule epdaS.AX_marked_language_finite)\n apply (metis F_PARSER_TO_EDPDA_generates_epda F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(rename_tac x)(*strict*)\n apply(force)\n done\n\ntheorem F_PARSER_TO_EDPDA_preserves_lang: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.marked_language G = epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(rule order_antisym)\n apply(metis F_PARSER_TO_EDPDA_preserves_lang1)\n apply(metis F_PARSER_TO_EDPDA_preserves_lang2)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_unmarked_language1: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.unmarked_language G \\ epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"left_total_on (F_PARSER_TO_EDPDA__LR__relation_effect SSG1 SSG2) (parserS.finite_unmarked_language SSG1) (epdaS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule parserS_epdaS_P2A_StateSimLR.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_TSstructure_def)\n apply(force)\n apply(rule_tac\n t=\"parserS.unmarked_language G\"\n and s=\"parserS.finite_unmarked_language G\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply (metis parserS.AX_unmarked_language_finite)\n apply(rule_tac\n t=\"epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"epdaS.finite_unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rule sym)\n apply (rule epdaS.AX_unmarked_language_finite)\n apply (metis F_PARSER_TO_EDPDA_generates_epda F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_effect_def)\n apply(rename_tac x)(*strict*)\n apply(force)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_unmarked_language2: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.unmarked_language G \\ epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"left_total_on (F_PARSER_TO_EDPDA__RL__relation_effect SSG1 SSG2) (epdaS.finite_unmarked_language SSG1) (parserS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule epdaS_parserS_P2A_StateSimRL.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(force)\n apply(rule_tac\n t=\"parserS.unmarked_language G\"\n and s=\"parserS.finite_unmarked_language G\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply (metis parserS.AX_unmarked_language_finite)\n apply(rule_tac\n t=\"epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"epdaS.finite_unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n in ssubst)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rule sym)\n apply (rule epdaS.AX_unmarked_language_finite)\n apply (metis F_PARSER_TO_EDPDA_generates_epda F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_effect_def)\n apply(rename_tac x)(*strict*)\n apply(force)\n done\n\ntheorem F_PARSER_TO_EDPDA_preserves_unmarked_language: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.unmarked_language G = epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n apply(rule order_antisym)\n apply(metis F_PARSER_TO_EDPDA_preserves_unmarked_language1)\n apply(metis F_PARSER_TO_EDPDA_preserves_unmarked_language2)\n done\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_initial_simulationRLB :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_initial_simulationRLB G1 G2 c1 c2 d \\\n d = der1 (F_PARSER_TO_EDPDA__configuration_rev G2 c1)\"\n\ndefinition F_PARSER_TO_EDPDA__LR__relation_step_simulationRLB :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event, 'stack) epda_step_label\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserS_conf) derivation\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__LR__relation_step_simulationRLB G1 G2 c1 e1 c1' c2 d \\\n d = der2 (F_PARSER_TO_EDPDA__configuration_rev G2 c1) (F_PARSER_TO_EDPDA__rules_rev e1) (F_PARSER_TO_EDPDA__configuration_rev G2 c1')\"\n\ndefinition F_PARSER_TO_EDPDA__RL__relation_configurationB :: \"\n ('stack, 'event, 'stack) epda\n \\ ('stack, 'event, 'marker) parser\n \\ ('stack, 'event, 'stack) epdaS_conf\n \\ ('stack, 'event) parserS_conf\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__RL__relation_configurationB G1 G2 c1 c2 \\\n \\BOX.\n F_PARSER_TO_EDPDA__SpecInput1 G2 BOX\n \\ G1 = F_PARSER_TO_EDPDA G2 BOX\n \\ (\\w.\n BOX \\ set w\n \\ epdaS_conf_stack c1 = w @ [BOX])\n \\ (F_PARSER_TO_EDPDA__configuration_rev G2 c1 = c2)\"\n\nlemma epdaS_parserS_P2A_StateSimRLB_inst_AX_relation_initial_simulationB: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\c2. F_PARSER_TO_EDPDA__RL__relation_configurationB G1 G2 c1 c2 \\ (\\d2. parserS.derivation_initial G2 d2 \\ F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 c1 (the (get_configuration (d2 0))) \\ F_PARSER_TO_EDPDA__LR__relation_initial_simulationRLB G1 G2 c1 c2 d2 \\ (\\n. maximum_of_domain d2 n \\ get_configuration (d2 n) = Some c2)))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configurationB_def F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_initial_simulationRLB_def)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(rule parserS.derivation_initialI)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(rule parserS.der1_is_derivation)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: parserS_initial_configurations_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n prefer 2\n apply(rule F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 BOX BOXa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__configuration_rev_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(force)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G2 c1 BOX BOXa w)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRLB_inst_AX_relation_step_simulationB: \"\n (\\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_configurationB G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. c1' \\ epdaS_configurations G1 \\ epdaS_step_relation G1 c1' e1 c1 \\ (\\d2. parserS.derivation G2 d2 \\ parserS.belongs G2 d2 \\ (\\n. the (get_configuration (d2 n)) = c2 \\ F_PARSER_TO_EDPDA__LR__relation_step_simulationRLB G1 G2 c1' e1 c1 c2 d2 \\ maximum_of_domain d2 n \\ F_PARSER_TO_EDPDA__RL__relation_configurationB G1 G2 c1' (the (get_configuration (d2 0)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configurationB_def F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX BOXa w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__LR__relation_step_simulationRLB_def)\n apply(rule_tac\n x=\"der2 (F_PARSER_TO_EDPDA__configuration_rev G2 c1') (F_PARSER_TO_EDPDA__rules_rev e1) (F_PARSER_TO_EDPDA__configuration_rev G2 c1)\"\n in exI)\n apply(rename_tac G2 c1 e1 c1' BOX BOXa w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"BOX=BOXa\")\n apply(rename_tac G2 c1 e1 c1' BOX BOXa w)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 e1 c1' BOX BOXa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOXa w)(*strict*)\n apply(rename_tac BOX w)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(subgoal_tac \"\\w. BOX \\ set w \\ epdaS_conf_stack c1' = w @ [BOX]\")\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(subgoal_tac \"\\r \\ epda_delta (F_PARSER_TO_EDPDA G2 BOX). epda_box (F_PARSER_TO_EDPDA G2 BOX) \\ set (edge_pop r) \\ epda_box (F_PARSER_TO_EDPDA G2 BOX) \\ set (edge_push r)\")\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n prefer 2\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_no_pop_of_box)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(case_tac wa)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(subgoal_tac \"BOX \\ set (edge_push e1)\")\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply (metis elem_set_app head_in_set)\n apply(rename_tac G2 c1 e1 c1' BOX w wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. wa = w' @ [x']\")\n apply(rename_tac G2 c1 e1 c1' BOX w wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w wa a list)(*strict*)\n apply(thin_tac \"wa=a#list\")\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' w' x')(*strict*)\n apply(rename_tac BOX)\n apply(rename_tac G2 c1 e1 c1' w' BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule parserS.der2_is_derivation)\n apply(rule F_PARSER_TO_EDPDA_preserves_steps_prime)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rule_tac\n t=\"F_PARSER_TO_EDPDA__rules (F_PARSER_TO_EDPDA__rules_rev e1)\"\n and s=\"e1\"\n in ssubst)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__rules_F_PARSER_TO_EDPDA__rules_rev)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(blast)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule F_PARSER_TO_EDPDA__rules_rev_preserves_rules)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule parserS.der2_belongs)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule_tac\n G=\"F_PARSER_TO_EDPDA G2 BOX\"\n in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(simp add: parser_step_labels_def)\n apply(rule F_PARSER_TO_EDPDA__rules_rev_preserves_rules)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule_tac\n G=\"F_PARSER_TO_EDPDA G2 BOX\"\n and BOX=\"BOX\"\n in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply (metis F_PARSER_TO_EDPDA_generates_epda epdaS.AX_step_relation_preserves_belongsC)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' BOX w)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G2 c1 e1 c1' BOX w wa)(*strict*)\n apply(simp add: der2_def get_configuration_def)\n done\n\nlemma epdaS_parserS_P2A_StateSimRLB_inst_AX_initial_contained: \"\n \\G1 G2. F_PARSER_TO_EDPDA__RL__relation_TSstructure G1 G2 \\ (\\c1 c2. F_PARSER_TO_EDPDA__RL__relation_initial_configuration G1 G2 c1 c2 \\ F_PARSER_TO_EDPDA__RL__relation_configurationB G1 G2 c1 c2)\"\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_initial_configuration_def F_PARSER_TO_EDPDA__RL__relation_configurationB_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule_tac\n x=\"BOX\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 BOX)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n done\n\nlemma F_PARSER_TO_EDPDA_preserves_is_forward_edge_deterministic: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ valid_epda (F_PARSER_TO_EDPDA G BOX)\n \\ parserS.is_forward_edge_deterministic_accessible G\n \\ epdaS.is_forward_edge_deterministic_accessible (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"parser_not_observes_input_terminator G\")\n prefer 2\n apply(rule F_PARSER_TO_EDPDA__SpecInput1_implies_parser_not_observes_input_terminator)\n apply(force)\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e1 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e2 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e1)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 w wa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e2)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e1) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e2) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e1 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e2 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: parserS.is_forward_edge_deterministic_accessible_def)\n apply(erule_tac\n x=\"F_PARSER_TO_EDPDA__configuration_rev G c\"\n in ballE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x=\"F_PARSER_TO_EDPDA__configuration_rev G c1\"\n in allE)\n apply(erule_tac\n x=\"F_PARSER_TO_EDPDA__configuration_rev G c2\"\n in allE)\n apply(subgoal_tac \"e1 \\ F_PARSER_TO_EDPDA__rules ` parser_rules G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(thin_tac \"e1 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(subgoal_tac \"e2 \\ F_PARSER_TO_EDPDA__rules ` parser_rules G\")\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(thin_tac \"e2 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G x\")\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def valid_parser_def)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G xa\")\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def valid_parser_def)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_PARSER_TO_EDPDA_preserves_steps)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_PARSER_TO_EDPDA_preserves_steps)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"F_PARSER_TO_EDPDA__configuration_rev G c \\ parserS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(thin_tac \"F_PARSER_TO_EDPDA__configuration_rev G c \\ parserS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(rule_tac\n ?c1.0=\"c\"\n and ?G1.0=\"F_PARSER_TO_EDPDA G BOX\"\n in epdaS_parserS_P2A_StateSimRL.get_accessible_configurations_transfer)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(rule_tac ?G.0=\"F_PARSER_TO_EDPDA G BOX\" and BOX=\"BOX\" in F_PARSER_TO_EDPDA__configuration_rev_preserves_configurations)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply (metis epdaS.get_accessible_configurations_are_configurations2)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_TSstructure_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(rename_tac c c1 c2 e1 e2 cA cB)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__RL__relation_configuration_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c c1 c2 e1 e2 d i a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n apply(rule epda_no_use_epda_box_implies_stack_content)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i option)(*strict*)\n apply(simp (no_asm) add: F_PARSER_TO_EDPDA__SpecInput1_def parser_not_observes_input_terminator_def F_PARSER_TO_EDPDA_def)\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 d i option r)(*strict*)\n apply(erule_tac x=\"F_PARSER_TO_EDPDA__rules r\" in ballE)\n apply(rename_tac c c1 c2 e1 e2 d i option r)(*strict*)\n prefer 2\n apply(subgoal_tac \"F_PARSER_TO_EDPDA__rules r \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(rename_tac c c1 c2 e1 e2 d i option r)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 d i option r)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(rename_tac c c1 c2 e1 e2 d i option r)(*strict*)\n apply(thin_tac \"epdaS_step_relation (F_PARSER_TO_EDPDA G BOX) c e1 c1\")\n apply(thin_tac \"epdaS_step_relation (F_PARSER_TO_EDPDA G BOX) c e2 c2\")\n apply(thin_tac \"edge_src e1 = epdaS_conf_state c\")\n apply(thin_tac \"edge_src e2 = epdaS_conf_state c\")\n apply(thin_tac \"option_to_list (edge_event e1) \\ epdaS_conf_scheduler c\")\n apply(thin_tac \"option_to_list (edge_event e2) \\ epdaS_conf_scheduler c\")\n apply(thin_tac \"edge_pop e1 \\ epdaS_conf_stack c\")\n apply(thin_tac \"edge_pop e2 \\ epdaS_conf_stack c\")\n apply(thin_tac \"e1 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(thin_tac \"e2 \\ epda_delta (F_PARSER_TO_EDPDA G BOX)\")\n apply(thin_tac \"epdaS.derivation_initial (F_PARSER_TO_EDPDA G BOX) d\")\n apply(thin_tac \"d i = Some (pair option c) \")\n apply(thin_tac \"epda_initial (F_PARSER_TO_EDPDA G BOX) \\ epda_states (F_PARSER_TO_EDPDA G BOX)\")\n apply(thin_tac \"epda_box (F_PARSER_TO_EDPDA G BOX) \\ epda_gamma (F_PARSER_TO_EDPDA G BOX)\")\n apply(thin_tac \"epda_marking (F_PARSER_TO_EDPDA G BOX) \\ epda_states (F_PARSER_TO_EDPDA G BOX)\")\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac r)(*strict*)\n apply(simp (no_asm_use) add: F_PARSER_TO_EDPDA__SpecInput1_def parser_not_observes_input_terminator_def F_PARSER_TO_EDPDA_def F_PARSER_TO_EDPDA__rules_def valid_parser_def)\n apply(erule_tac x=\"r\" in ballE)\n apply(rename_tac r)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac r)(*strict*)\n apply(clarsimp)\n apply(erule_tac x=\"r\" in ballE)\n apply(rename_tac r)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac r)(*strict*)\n apply(erule_tac x=\"r\" in ballE)\n apply(rename_tac r)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac r)(*strict*)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(case_tac r)\n apply(rename_tac r rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(rename_tac a b c d)\n apply(rename_tac r a b c d)(*strict*)\n apply(clarsimp)\n apply(rename_tac a b c)(*strict*)\n apply(rule_tac xs=\"a\" in rev_cases)\n apply(rename_tac a b c)(*strict*)\n apply(force)\n apply(rename_tac a b c ys y)(*strict*)\n apply(rule_tac xs=\"c\" in rev_cases)\n apply(rename_tac a b c ys y)(*strict*)\n apply(force)\n apply(rename_tac a b c ys y ysa ya)(*strict*)\n apply(clarsimp)\n apply(rename_tac b ys y ysa ya)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(rule conjI)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(rule_tac B=\"parser_nonterms G\" in nset_mp)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(force)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(force)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(rule_tac B=\"parser_nonterms G\" in nset_mp)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(force)\n apply(rename_tac ys y ysa ya k w)(*strict*)\n apply(force)\n done\n\nlemma F_PARSER_TO_EDPDA_determ_sound: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parserS.Nonblockingness_linear_DB G\n \\ parserS.is_forward_edge_deterministic_accessible G\n \\ epdaS.Nonblockingness_linear_DB (F_PARSER_TO_EDPDA G BOX)\"\n apply(subgoal_tac \"valid_epda (F_PARSER_TO_EDPDA G BOX)\")\n prefer 2\n apply (metis F_PARSER_TO_EDPDA_generates_epda)\n apply(subgoal_tac \"epdaS.Nonblockingness_linear_restricted_DB SSM\" for SSM)\n prefer 2\n apply(rule epdaS.AX_BF_LinDBRest_DetR_LaOp)\n apply(force)\n apply(simp add: epdaS.is_forward_deterministic_accessible_def)\n apply(rule conjI)\n apply (metis epda_is_is_forward_target_deterministic_accessible)\n apply(rule F_PARSER_TO_EDPDA_preserves_is_forward_edge_deterministic)\n apply(force)\n apply(force)\n apply(simp add: parserS.is_forward_deterministic_accessible_def)\n apply(rule_tac\n t=\"epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"parserS.unmarked_language G\"\n in ssubst)\n apply (metis F_PARSER_TO_EDPDA_preserves_unmarked_language)\n apply(rule_tac\n t=\"epdaS.marked_language (F_PARSER_TO_EDPDA G BOX)\"\n and s=\"parserS.marked_language G\"\n in ssubst)\n apply (metis F_PARSER_TO_EDPDA_preserves_lang)\n apply(rule parserS.AX_BF_LinDB_OpLa)\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(force)\n apply(simp add: epdaS.Nonblockingness_linear_restricted_DB_def epdaS.Nonblockingness_linear_DB_def)\n done\n\nlemma P2A_epda_no_empty_steps_from_marking_states: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ (\\e. e \\ parser_rules G \\ last (rule_lpop e) \\ parser_marking G \\ rule_rpop e \\ [])\n \\ R = F_PARSER_TO_EDPDA G BOX\n \\ q \\ epda_marking R\n \\ e \\ epda_delta R\n \\ edge_src e \\ epda_marking R\n \\ edge_event e \\ None\"\n apply(simp add: F_PARSER_TO_EDPDA_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_PARSER_TO_EDPDA__rules_def)\n apply(simp add: list_to_option_def)\n apply(case_tac \"rule_rpop x\")\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x a list)(*strict*)\n apply(force)\n done\n\nlemma F_PARSER_TO_EDPDA_enforces_epda_no_empty_steps_from_marking_states: \"\n F_PARSER_TO_EDPDA__SpecInput1 G BOX\n \\ parser_no_empty_steps_from_marking_states G\n \\ epda_no_empty_steps_from_marking_states (F_PARSER_TO_EDPDA G BOX)\"\n apply(simp add: epda_no_empty_steps_from_marking_states_def parser_no_empty_steps_from_marking_states_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(rule P2A_epda_no_empty_steps_from_marking_states)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(force)\n done\n\ndefinition F_PARSER_TO_EDPDA__SpecInput :: \"\n ('stack, 'event, 'marker) parser\n \\ 'stack\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__SpecInput G BOX \\\n valid_bounded_parser G (Suc 0)\n \\ BOX \\ parser_nonterms G\n \\ parserFS.is_forward_edge_deterministic_accessible G\n \\ nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n \\ parser_not_observes_input_terminator G\n \\ parser_no_top_rules G\n \\ parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_PARSER_TO_EDPDA__SpecOutput :: \"\n ('stack, 'event, 'marker) parser\n \\ ('state, 'event, 'stackx) epda\n \\ bool\"\n where\n \"F_PARSER_TO_EDPDA__SpecOutput Gi Go \\\n valid_epda Go\n \\ epdaS.is_forward_edge_deterministic_accessible Go\n \\ parserS.marked_language Gi = epdaS.marked_language Go\n \\ nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n \\ epda_no_empty_steps_from_marking_states Go\"\n\ntheorem F_PARSER_TO_EDPDA__SOUND: \"\n F_PARSER_TO_EDPDA__SpecInput G BOX\n \\ F_PARSER_TO_EDPDA__SpecOutput G (F_PARSER_TO_EDPDA G BOX)\"\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput_def F_PARSER_TO_EDPDA__SpecOutput_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_PARSER_TO_EDPDA__SpecInput1 G BOX\")\n prefer 2\n apply(simp add: F_PARSER_TO_EDPDA__SpecInput1_def)\n apply(simp add: valid_bounded_parser_def)\n apply(clarsimp)\n apply(rename_tac r)(*strict*)\n apply(simp add: parser_no_top_rules_def)\n apply(subgoal_tac \"valid_parser_step_label G r\")\n apply(rename_tac r)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac r)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rule context_conjI)\n apply(rule F_PARSER_TO_EDPDA_generates_epda)\n apply(force)\n apply(rule conjI)\n apply(rule F_PARSER_TO_EDPDA_preserves_is_forward_edge_deterministic)\n apply(force)\n apply(force)\n apply(rule_tac parserS_vs_parserFS.preserve_FEdetermR2)\n prefer 2\n apply(force)\n apply(simp add: valid_bounded_parser_def)\n apply(rule context_conjI)\n apply(rule F_PARSER_TO_EDPDA_preserves_lang)\n apply(force)\n apply(rule conjI)\n apply(subgoal_tac \"parserS.unmarked_language G = epdaS.unmarked_language (F_PARSER_TO_EDPDA G BOX)\")\n apply(force)\n apply(rule F_PARSER_TO_EDPDA_preserves_unmarked_language)\n apply(force)\n apply(rule F_PARSER_TO_EDPDA_enforces_epda_no_empty_steps_from_marking_states)\n apply(force)\n apply(force)\n done\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_07_01/FUNCTION__PARSER_TO_EDPDA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.2817904583776214}} {"text": "(* Title: HOL/NanoJava/TypeRel.thy\n Author: David von Oheimb, Technische Universitaet Muenchen\n*)\n\nsection \"Type relations\"\n\ntheory TypeRel\nimports Decl\nbegin\n\ntext\\Direct subclass relation\\\n\ndefinition subcls1 :: \"(cname \\ cname) set\"\nwhere\n \"subcls1 \\ {(C,D). C\\Object \\ (\\c. class C = Some c \\ super c=D)}\"\n\nabbreviation\n subcls1_syntax :: \"[cname, cname] => bool\" (\"_ \\C1 _\" [71,71] 70)\n where \"C \\C1 D == (C,D) \\ subcls1\"\nabbreviation\n subcls_syntax :: \"[cname, cname] => bool\" (\"_ \\C _\" [71,71] 70)\n where \"C \\C D \\ (C,D) \\ subcls1\\<^sup>*\"\n\n\nsubsection \"Declarations and properties not used in the meta theory\"\n\ntext\\Widening, viz. method invocation conversion\\\ninductive\n widen :: \"ty => ty => bool\" (\"_ \\ _\" [71,71] 70)\nwhere\n refl [intro!, simp]: \"T \\ T\"\n| subcls: \"C\\C D \\ Class C \\ Class D\"\n| null [intro!]: \"NT \\ R\"\n\nlemma subcls1D: \n \"C\\C1D \\ C \\ Object \\ (\\c. class C = Some c \\ super c=D)\"\napply (unfold subcls1_def)\napply auto\ndone\n\nlemma subcls1I: \"\\class C = Some m; super m = D; C \\ Object\\ \\ C\\C1D\"\napply (unfold subcls1_def)\napply auto\ndone\n\nlemma subcls1_def2: \n \"subcls1 = \n (SIGMA C: {C. is_class C} . {D. C\\Object \\ super (the (class C)) = D})\"\napply (unfold subcls1_def is_class_def)\napply (auto split:if_split_asm)\ndone\n\nlemma finite_subcls1: \"finite subcls1\"\napply(subst subcls1_def2)\napply(rule finite_SigmaI [OF finite_is_class])\napply(rule_tac B = \"{super (the (class C))}\" in finite_subset)\napply auto\ndone\n\ndefinition ws_prog :: \"bool\" where\n \"ws_prog \\ \\(C,c)\\set Prog. C\\Object \\ \n is_class (super c) \\ (super c,C)\\subcls1\\<^sup>+\"\n\nlemma ws_progD: \"\\class C = Some c; C\\Object; ws_prog\\ \\ \n is_class (super c) \\ (super c,C)\\subcls1\\<^sup>+\"\napply (unfold ws_prog_def class_def)\napply (drule_tac map_of_SomeD)\napply auto\ndone\n\nlemma subcls1_irrefl_lemma1: \"ws_prog \\ subcls1\\ \\ subcls1\\<^sup>+ = {}\"\nby (fast dest: subcls1D ws_progD)\n\n(* irrefl_tranclI in Transitive_Closure.thy is more general *)\nlemma irrefl_tranclI': \"r\\ \\ r\\<^sup>+ = {} \\ \\x. (x, x) \\ r\\<^sup>+\"\nby(blast elim: tranclE dest: trancl_into_rtrancl)\n\n\nlemmas subcls1_irrefl_lemma2 = subcls1_irrefl_lemma1 [THEN irrefl_tranclI']\n\nlemma subcls1_irrefl: \"\\(x, y) \\ subcls1; ws_prog\\ \\ x \\ y\"\napply (rule irrefl_trancl_rD)\napply (rule subcls1_irrefl_lemma2)\napply auto\ndone\n\nlemmas subcls1_acyclic = subcls1_irrefl_lemma2 [THEN acyclicI]\n\nlemma wf_subcls1: \"ws_prog \\ wf (subcls1\\)\"\nby (auto intro: finite_acyclic_wf_converse finite_subcls1 subcls1_acyclic)\n\ndefinition class_rec ::\"cname \\ (class \\ ('a \\ 'b) list) \\ ('a \\ 'b)\"\nwhere\n \"class_rec \\ wfrec (subcls1\\) (\\rec C f.\n case class C of None \\ undefined\n | Some m \\ (if C = Object then Map.empty else rec (super m) f) ++ map_of (f m))\"\n\nlemma class_rec: \"\\class C = Some m; ws_prog\\ \\\n class_rec C f = (if C = Object then Map.empty else class_rec (super m) f) ++ \n map_of (f m)\"\napply (drule wf_subcls1)\napply (subst def_wfrec[OF class_rec_def], auto)\napply (subst cut_apply, auto intro: subcls1I)\ndone\n\n\\ \\Methods of a class, with inheritance and hiding\\\ndefinition \"method\" :: \"cname => (mname \\ methd)\" where\n \"method C \\ class_rec C methods\"\n\nlemma method_rec: \"\\class C = Some m; ws_prog\\ \\\nmethod C = (if C=Object then Map.empty else method (super m)) ++ map_of (methods m)\"\napply (unfold method_def)\napply (erule (1) class_rec [THEN trans])\napply simp\ndone\n\n\n\\ \\Fields of a class, with inheritance and hiding\\\ndefinition field :: \"cname => (fname \\ ty)\" where\n \"field C \\ class_rec C flds\"\n\nlemma flds_rec: \"\\class C = Some m; ws_prog\\ \\\nfield C = (if C=Object then Map.empty else field (super m)) ++ map_of (flds m)\"\napply (unfold field_def)\napply (erule (1) class_rec [THEN trans])\napply simp\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/NanoJava/TypeRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.28170123130031516}} {"text": "section \\Correctness of Type Checker\\\n\ntheory Wasm_Checker_Properties imports Wasm_Checker Wasm_Properties begin\n\nsubsection \\Soundness\\\n\nlemma b_e_check_single_type_sound:\n assumes \"type_update (Type x1) (to_ct_list t_in) (Type t_out) = Type x2\"\n \"c_types_agree (Type x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (Type x1) tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms(2) b_e_typing.intros(39)[OF assms(3)] type_update_type[OF assms(1)]\n by auto\n\nlemma b_e_check_single_top_sound:\n assumes \"type_update (TopType x1) (to_ct_list t_in) (Type t_out) = TopType x2\"\n \"c_types_agree (TopType x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (TopType x1) tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n obtain t_ag where t_ag_def:\"ct_suffix (to_ct_list t_out) x2\"\n \"tm = t_ag @ t_out\"\n \"c_types_agree (TopType x1) (t_ag @ t_in)\"\n using type_update_top_top[OF assms(1,2)]\n by fastforce\n hence \"\\ \\ [e] : (t_ag@t_in _> t_ag@t_out)\"\n using b_e_typing.intros(39)[OF assms(3)]\n by fastforce\n thus ?thesis\n using t_ag_def\n by fastforce\nqed\n\nlemma b_e_check_single_top_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (TopType []) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n shows \"\\tn. c_types_agree ts tn \\ suffix t_in tn\"\nproof (cases ts)\n case (TopType x1)\n then obtain t_int where \"consume (TopType x1) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using TopType ct_suffix_ct_list_eq_exists ct_suffix_ts_conv_suffix\n unfolding consume.simps\n by (metis append_Nil c_types_agree.simps(2) ct_suffix_def)\nnext\n case (Type x2)\n then obtain t_int where \"consume (Type x2) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using c_types_agree_id Type consume_type suffixI ct_suffix_ts_conv_suffix\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_type_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (Type t_out) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n \"c_types_agree ts' tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree ts tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms b_e_check_single_type_sound\nproof (cases ts)\n case (TopType x1)\n then obtain x1' where x_def:\"TopType x1' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(1) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_top_sound TopType\n by fastforce\nnext\n case (Type x2)\n then obtain x2' where x_def:\"Type x2' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(2) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_type_sound Type\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_sound_unop_testop_cvtop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = (Unop_i t uu) \\ e = (ExtendS t uv) \\ e = (Testop t uw)) \\ is_int_t t)\n \\ (e = (Unop_f t ux) \\ is_float_t t)\n \\ (e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\n \\ (e = (Cvtop t1 ConvertSat t sx) \\ convert_cond t1 t sx)\n \\ (e = (Cvtop t1 Reinterpret t sx) \\ ((t1 \\ t) \\ t_length t1 = t_length t \\ sx = None))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"(e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\"\n using assms(2)\n by simp\n hence temp0:\"(e = (Cvtop t1 Convert t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,5) arity_1_result_def\n by (simp del: convert_cond.simps)\n have \"(e = (Cvtop t1 ConvertSat t sx) \\ convert_cond t1 t sx)\"\n using assms(2)\n by simp\n hence temp1:\"(e = (Cvtop t1 ConvertSat t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,5) arity_1_result_def\n by (simp del: convert_cond.simps)\n have temp2:\"(e = (Cvtop t1 Reinterpret t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,2,5) arity_1_result_def\n by simp\n have 1:\"type_update tn' (to_ct_list [t]) (Type [arity_1_result e]) = tm'\"\n using assms arity_1_result_def\n unfolding to_ct_list_def\n apply (simp del: convert_cond.simps)\n apply (metis (no_types, lifting) b_e.simps(1175) b_e.simps(1176) b_e.simps(1177) b_e.simps(1180) check_single.simps(2) check_single.simps(3) check_single.simps(4) check_single.simps(7) temp0 temp1 temp2 type_update.simps)\n done\n have \"\\ \\ [e] : ([t] _> [arity_1_result e])\"\n using assms(2) b_e_typing.intros(2,3,4,7,10,11,12)\n unfolding arity_1_result_def\n by fastforce\n thus ?thesis\n using b_e_check_single_type_not_bot_sound[OF 1 assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_check_single_sound_binop_relop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = Binop_i t iop \\ is_int_t t)\n \\ (e = Binop_f t fop \\ is_float_t t)\n \\ (e = Relop_i t irop \\ is_int_t t)\n \\ (e = Relop_f t frop \\ is_float_t t))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"type_update tn' (to_ct_list [t,t]) (Type [arity_2_result e]) = tm'\"\n using assms arity_2_result_def\n unfolding to_ct_list_def\n by auto\n moreover\n have \"\\ \\ [e] : ([t,t] _> [arity_2_result e])\"\n using assms(2) b_e_typing.intros(5,6,8,9)\n unfolding arity_2_result_def\n by fastforce\n ultimately\n show ?thesis\n using b_e_check_single_type_not_bot_sound[OF _ assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_type_checker_sound:\n assumes \"b_e_type_checker \\ es (tn _> tm)\"\n shows \"\\ \\ es : (tn _> tm)\"\nproof -\n fix e tn'\n have \"b_e_type_checker \\ es (tn _> tm) \\\n \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check \\ es tn' = tm' \\\n c_types_agree tm' tm \\\n \\tn. c_types_agree tn' tn \\ \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check_single \\ e tn' = tm' \\\n c_types_agree tm' tm \\\n tn' \\ Bot \\\n tm' \\ Bot \\\n \\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn' tm)\n thus ?case\n by simp\n next\n case (2 \\ es' ts)\n show ?case\n proof (cases es')\n case Nil\n thus ?thesis\n using 2(5,6)\n by (simp add: b_e_type_empty)\n next\n case (Cons e es)\n thus ?thesis\n proof (cases ts)\n case (TopType x1)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) TopType Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(2)[OF Cons TopType check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(1)[OF Cons _ ts'_def] TopType c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case (Type x2)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) Type Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(4)[OF Cons Type check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(3)[OF Cons _ ts'_def] Type c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case Bot\n then show ?thesis\n using 2(5,6) Cons\n by auto\n qed\n qed\n next\n case (3 \\ v ts)\n hence \"type_update ts [] (Type [typeof v]) = tm'\"\n by simp\n moreover\n have \"\\ \\ [C v] : ([] _> [typeof v])\"\n using b_e_typing.intros(1)\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 3(3,4,2)]\n by (metis list.simps(8) to_ct_list_def)\n next\n case (4 \\ t uu ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 4\n by fastforce\n next\n case (5 \\ t uv ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 5\n by fastforce\n next\n case (6 \\ t uw ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 6\n by fastforce\n next\n case (7 \\ t ux ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 7\n by fastforce\n next\n case (8 \\ t uy ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 8\n by fastforce\n next\n case (9 \\ t uz ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 9\n by fastforce\n next\n case (10 \\ t va ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 10\n by fastforce\n next\n case (11 \\ t vb ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 11\n by fastforce\n next\n case (12 \\ t1 t2 sx ts)\n hence \"convert_cond t1 t2 sx\"\n by (simp del: convert_cond.simps, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 12\n by fastforce\n next\n case (13 \\ t1 t2 sx ts)\n hence \"convert_cond t1 t2 sx\"\n by (simp del: convert_cond.simps, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 13\n by fastforce\n next\n case (14 \\ t1 t2 sx ts)\n hence \"t1 \\ t2 \\ t_length t1 = t_length t2 \\ sx = None\"\n by (simp, presburger)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 14\n by fastforce\n next\n case (15 \\ ts)\n thus ?case\n using b_e_typing.intros(13) c_types_agree_not_bot_exists\n by blast\n next\n case (16 \\ ts)\n thus ?case\n using b_e_typing.intros(14,39)\n by fastforce\n next\n case (17 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n thus ?thesis\n proof (cases x1 rule: List.rev_cases)\n case Nil\n have \"\\ \\ [Drop] : (tm@[T_i32] _> tm)\"\n using b_e_typing.intros(15,39)\n by fastforce\n thus ?thesis\n using c_types_agree_top1 Nil TopType\n by fastforce\n next\n case (snoc ys y)\n hence temp1:\"(consume (TopType (ys@[y])) [TAny]) = tm'\"\n using 17 TopType type_update_empty\n by (metis check_single.simps(15))\n hence temp2:\"c_types_agree (TopType ys) tm\"\n using consume_top_geq[OF temp1] 17(2,3,4)\n by (metis Suc_leI add_diff_cancel_right' append_eq_conv_conj consume.simps(2)\n ct_suffix_def length_Cons length_append list.size(3) trans_le_add2\n zero_less_Suc)\n obtain t where \"ct_list_eq [y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc TopType\n by (simp add: to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(15,39)\n by fastforce\n qed\n next\n case (Type x2)\n thus ?thesis\n proof (cases x2 rule: List.rev_cases)\n case Nil\n hence \"(consume (Type []) [TAny]) = tm'\"\n using 17 Type type_update_empty\n by fastforce\n thus ?thesis\n using 17(4) ct_list_eq_def ct_suffix_def to_ct_list_def\n by simp\n next\n case (snoc ys y)\n hence temp1:\"(consume (Type (ys@[y])) [TAny]) = tm'\"\n using 17 Type type_update_empty\n by (metis check_single.simps(15))\n hence temp2:\"c_types_agree (Type ys) tm\"\n using 17(2,3,4) ct_suffix_def\n by (simp, metis One_nat_def butlast_conv_take butlast_snoc c_types_agree.simps(1)\n length_Cons list.size(3))\n obtain t where \"ct_list_eq [TSome y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc Type\n by (simp add: ct_list_eq_def to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(15,39)\n by fastforce\n qed\n qed simp\n next\n case (18 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"tm' = TopType [TAny]\"\n using TopType 18\n by simp\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 18(2) ct_suffix_def\n by (simp, metis Nil_is_append_conv append_butlast_last_id checker_type.inject(1)\n ct_prefixI ct_prefix_nil(2) produce.simps(1) produce_nil)\n have \"\\ \\ [Select] : ([t'',t'',T_i32] _> [t''])\"\n using b_e_typing.intros(16)\n by blast\n thus ?thesis\n using TopType 18 1 tm_def b_e_typing.intros(39) c_types_agree.simps(2) c_types_agree_top1\n by fastforce\n next\n case 2\n have \"type_update_select (TopType x1) = tm'\"\n using 18 TopType\n unfolding check_single.simps\n by simp\n hence x1_def:\"ct_list_eq x1 [TSome T_i32]\" \"tm' = TopType [TAny]\"\n using type_update_select_length1[OF _ 2 18(4)]\n by simp_all\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 18(2) ct_suffix_def\n by (metis Nil_is_append_conv append_butlast_last_id c_types_agree.simps(2) ct_prefixI\n ct_prefix_nil(2) list.simps(8) to_ct_list_def)\n have \"c_types_agree (TopType x1) ((tm''@[t'',t''])@[T_i32])\"\n using x1_def(1)\n by (metis c_types_agree_top2 list.simps(8,9) to_ct_list_def)\n thus ?thesis\n using TopType b_e_typing.intros(16,39) tm_def\n by auto\n next\n case 3\n have \"type_update_select (TopType x1) = tm'\"\n using 18 TopType\n unfolding check_single.simps\n by simp\n then obtain ct1 ct2 where x1_def:\"x1 = [ct1, ct2]\"\n \"ct_eq ct2 (TSome T_i32)\"\n \"tm' = TopType [ct1]\"\n using type_update_select_length2[OF _ 3 18(4)]\n by blast\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n \"ct_list_eq [ct1] [(TSome t'')]\"\n using 18(2) c_types_agree_imp_ct_list_eq[of \"[ct1]\" tm]\n by (metis append_Nil2 append_butlast_last_id append_eq_append_conv_if append_eq_conv_conj\n ct_list_eq_length diff_Suc_1 length_Cons length_butlast length_map\n list.simps(8,9) list.size(3) nat.distinct(2) to_ct_list_def)\n hence \"ct_list_eq x1 (to_ct_list [ t'', T_i32])\"\n using x1_def(1,2)\n unfolding ct_list_eq_def to_ct_list_def\n by fastforce\n hence \"c_types_agree (TopType x1) ((tm''@[t''])@[t'',T_i32])\"\n using c_types_agree_top2\n by blast\n thus ?thesis\n using TopType b_e_typing.intros(16,39) tm_def\n by auto\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n hence tm'_def:\"type_update_select (TopType x1) = tm'\"\n using 18 TopType\n by simp\n then obtain tm_int where \"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = tm_int\"\n \"tm_int \\ Bot\"\n using nat_def 18(4)\n unfolding type_update_select.simps\n by fastforce\n then obtain x2 where x2_def:\"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = TopType x2\"\n using select_return_top_exists\n by fastforce\n have \"ct_suffix x1 [TAny, TAny, TSome T_i32] \\ ct_suffix [TAny, TAny, TSome T_i32] x1\"\n using tm'_def nat_def 18(4)\n by (simp, metis (full_types) produce.simps(6))\n hence tm'_eq:\"tm' = TopType x2\"\n using tm'_def nat_def 18(4) x2_def\n by force\n then obtain cts' ct1 ct2 ct3 where cts'_def:\"x1 = cts'@[ct1, ct2, ct3]\"\n \"ct_eq ct3 (TSome T_i32)\"\n using type_update_select_length3 tm'_def 4\n by blast\n then obtain c' cm' where tm_def:\"tm = cm'@[c']\"\n \"ct_suffix cts' (to_ct_list cm')\"\n \"ct_eq (x1 ! (length x1 - 2)) (TSome c')\"\n \"ct_eq (x1 ! (length x1 - 3)) (TSome c')\"\n using select_return_top_ct_eq[OF x2_def 4] tm'_eq 4 18(2)\n by fastforce\n then obtain as bs where cm'_def:\"cm' = as@bs\"\n \"ct_list_eq (to_ct_list bs) cts'\"\n using ct_list_eq_cons_ct_list1 ct_list_eq_ts_conv_eq\n by (metis ct_suffix_def to_ct_list_append(2))\n hence \"ct_eq ct1 (TSome c')\"\n \"ct_eq ct2 (TSome c')\"\n using cts'_def tm_def\n apply simp_all\n apply (metis append.assoc append_Cons append_Nil length_append_singleton nth_append_length)\n done\n hence \"c_types_agree ts (cm'@[c',c',T_i32])\"\n using c_types_agree_top2[of _ _ as] cm'_def(1) TopType\n ct_list_eq_concat[OF ct_list_eq_commute[OF cm'_def(2)]] cts'_def\n unfolding to_ct_list_def ct_list_eq_def\n by fastforce\n thus ?thesis\n using b_e_typing.intros(16,39) tm_def\n by auto\n qed\n next\n (* TODO: refactor *)\n case (Type x2)\n hence x2_cond:\"(length x2 \\ 3 \\ (x2!(length x2-2)) = (x2!(length x2-3)))\"\n using 18\n by (simp, meson)\n hence tm'_def:\"consume (Type x2) [TAny, TSome T_i32] = tm'\"\n using 18 Type\n by simp\n obtain ts' ts'' where cts_def:\"x2 = ts'@ ts''\" \"length ts'' = 3\"\n using x2_cond\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain t1 ts''2 where \"ts'' = t1#ts''2\" \"length ts''2 = Suc (Suc 0)\"\n using List.length_Suc_conv[of ts' \"Suc (Suc 0)\"]\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain t2 t3 where \"ts'' = [t1,t2,t3]\"\n using List.length_Suc_conv[of ts''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n hence cts_def2:\"x2 = ts'@ [t1,t2,t3]\"\n using cts_def\n by simp\n have ts'_suffix:\"ct_suffix [TAny, TSome T_i32] (to_ct_list (ts' @ [t1, t2, t3]))\"\n using tm'_def 18(4)\n by (simp, metis cts_def2)\n hence tm'_def:\"tm' = Type (ts'@[t1])\"\n using tm'_def 18(4) cts_def2\n by simp\n obtain as bs where \"(to_ct_list (ts' @ [t1])) @ (to_ct_list ([t2, t3])) = as@bs\"\n \"ct_list_eq bs [TAny, TSome T_i32]\"\n using ts'_suffix\n unfolding ct_suffix_def to_ct_list_def\n by fastforce\n hence \"t3 = T_i32\"\n unfolding to_ct_list_def ct_list_eq_def\n by (metis (no_types, lifting) Nil_is_map_conv append_eq_append_conv ct_eq.simps(1)\n length_Cons list.sel(1,3) list.simps(9) list_all2_Cons2 list_all2_lengthD)\n moreover\n have \"t1 = t2\"\n using x2_cond cts_def2\n by (simp, metis append.left_neutral append_Cons append_assoc length_append_singleton\n nth_append_length)\n ultimately\n have \"c_types_agree (Type x2) ((ts'@[t1,t1])@[T_i32])\"\n using cts_def2\n by simp\n thus ?thesis\n using b_e_typing.intros(16,39) Type tm'_def 18(2)\n by fastforce\n qed simp\n next\n case (19 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 19\n by (simp, meson)\n hence \"\\ \\ [Block (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(17)[OF _ 19(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 19(4,5,3)]\n by blast\n next\n case (20 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tn''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 20\n by (simp, meson)\n hence \"\\ \\ [Loop (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(18)[OF _ 20(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 20(4,5,3)]\n by blast\n next\n case (21 \\ tn'' tm'' es1 es2 ts)\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es1 (tn'' _> tm''))\"\n \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es2 (tn'' _> tm''))\"\n using 21\n by (simp, meson)+\n hence \"\\ \\ [If (tn'' _> tm'') es1 es2] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(19)[OF _ 21(1,2)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 21(5,6,4)]\n by blast\n next\n case (22 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i)) (TopType []) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 22\n by (simp, meson)\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 22(3,4)]\n b_e_typing.intros(20,37)\n by (metis suffix_def)\n next\n case (23 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i @ [T_i32])) (Type ((label \\)!i)) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 23\n by (simp, meson)\n hence \"\\ \\ [Br_if i] : ((label \\)!i @ [T_i32] _> (label \\)!i)\"\n using b_e_typing.intros(21)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 23(3,4,2)]\n by fastforce\n next\n case (24 \\ \"is\" i ts)\n then obtain tls where tls_def:\"(same_lab (is@[i]) (label \\)) = Some tls\"\n by fastforce\n hence \"type_update ts (to_ct_list (tls @ [T_i32])) (TopType []) = tm'\"\n using 24\n by simp\n thus ?case\n using b_e_check_single_top_not_bot_sound[OF _ 24(3,4)]\n b_e_typing.intros(22)[OF same_lab_conv_list_all[OF tls_def]]\n b_e_typing.intros(37)\n by (metis suffix_def)\n next\n case (25 \\ ts)\n then obtain ts_r where \"(return \\) = Some ts_r\"\n by fastforce\n moreover\n hence \"type_update ts (to_ct_list ts_r) (TopType []) = tm'\"\n using 25\n by simp\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 25(3,4)]\n b_e_typing.intros(23,37)\n by (metis suffix_def)\n next\n case (26 \\ i ts)\n obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n using 26\n by auto\n moreover\n have \"i < length (func_t \\)\"\n using 26\n by (simp, meson)\n hence \"\\ \\ [Call i] : (tn'' _> tm'')\"\n using b_e_typing.intros(24) func_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 26(3,4,2)]\n by fastforce\n next\n case (27 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n using 27\n by auto\n moreover\n have \"(table \\) \\ None \\ i < length (types_t \\)\"\n using 27\n by (simp, meson)\n hence \"\\ \\ [Call_indirect i] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(25) type_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 27(3,4,2)]\n by fastforce\n next\n case (28 \\ i ts)\n then have length_def:\"i < length (func_t \\)\"\n using 28\n by (simp, meson)\n then obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust 28 length_def\n by (simp, meson)\n hence return_def:\"(return \\) = Some tm''\"\n using 28 length_def\n by (simp, meson)\n moreover\n hence \"type_update ts (to_ct_list tn'') (TopType []) = tm'\"\n using 28 return_def func_def length_def\n by simp\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 28(3,4)]\n b_e_typing.intros(26,37) return_def func_def length_def\n by (metis suffix_def)\n next\n case (29 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n moreover\n have length_def:\"(table \\) \\ None \\ i < length (types_t \\)\"\n using 29\n by (simp, meson)\n hence return_def:\"(return \\) = Some tm''\"\n using 29 type_def\n by (simp, meson)\n moreover\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (TopType []) = tm'\"\n using 29 length_def type_def return_def\n by auto\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 29(3,4)]\n b_e_typing.intros(27,37) return_def length_def type_def\n by (metis suffix_def)\n next\n case (30 \\ i ts)\n hence \"type_update ts [] (Type [(local \\)!i]) = tm'\"\n by auto\n moreover\n have \"i < length (local \\)\"\n using 30\n by (simp, meson)\n hence \"\\ \\ [Get_local i] : ([] _> [(local \\)!i])\"\n using b_e_typing.intros(28)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 30(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (31 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 31\n by (simp, meson)\n hence \"\\ \\ [Set_local i] : ([(local \\)!i] _> [])\"\n using b_e_typing.intros(29)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 31(3,4,2)]\n by fastforce\n next\n case (32 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type [(local \\)!i]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 32\n by (simp, meson)\n hence \"\\ \\ [Tee_local i] : ([(local \\)!i] _> [(local \\)!i])\"\n using b_e_typing.intros(30)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 32(3,4,2)]\n by fastforce\n next\n case (33 \\ i ts)\n hence \"type_update ts [] (Type [tg_t ((global \\)!i)]) = tm'\"\n by auto\n moreover\n have \"i < length (global \\)\"\n using 33\n by (simp, meson)\n hence \"\\ \\ [Get_global i] : ([] _> [tg_t ((global \\)!i)])\"\n using b_e_typing.intros(31)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 33(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (34 \\ i ts)\n hence \"type_update ts (to_ct_list [tg_t ((global \\)!i)]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (global \\) \\ is_mut (global \\ ! i)\"\n using 34\n by (simp, meson)\n then obtain t where \"(global \\ ! i) = \\tg_mut = T_mut, tg_t = t\\\" \"i < length (global \\)\"\n unfolding is_mut_def\n by (cases \"global \\ ! i\", auto)\n hence \"\\ \\ [Set_global i] : ([tg_t (global \\ ! i)] _> [])\"\n using b_e_typing.intros(32)[of i \\ \"tg_t (global \\ ! i)\"]\n unfolding is_mut_def tg_t_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 34(3,4,2)]\n by fastforce\n next\n case (35 \\ t tp_sx a off ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [t]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"(memory \\) \\ None \\ load_store_t_bounds a (option_projl tp_sx) t\"\n using 35\n by (simp, meson)\n hence \"\\ \\ [Load t tp_sx a off] : ([T_i32] _> [t])\"\n using b_e_typing.intros(33)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 35(3,4,2)]\n by fastforce\n next\n case (36 \\ t tp a off ts)\n hence \"type_update ts (to_ct_list [T_i32,t]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"(memory \\) \\ None \\ load_store_t_bounds a tp t\"\n using 36\n by (simp, meson)\n hence \"\\ \\ [Store t tp a off] : ([T_i32,t] _> [])\"\n using b_e_typing.intros(34)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 36(3,4,2)]\n by fastforce\n next\n case (37 \\ ts)\n hence \"type_update ts [] (Type [T_i32]) = tm'\"\n by auto\n moreover\n have \"memory \\ \\ None\"\n using 37\n by (simp, meson)\n hence \"\\ \\ [Current_memory] : ([] _> [T_i32])\"\n using b_e_typing.intros(35)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 37(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (38 \\ ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [T_i32]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"memory \\ \\ None\"\n using 38\n by (simp, meson)\n hence \"\\ \\ [Grow_memory] : ([T_i32] _> [T_i32])\"\n using b_e_typing.intros(36)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 38(3,4,2)]\n by fastforce\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nsubsection \\Completeness\\\n\nlemma check_single_imp:\n assumes \"check_single \\ e ctn = ctm\"\n \"ctm \\ Bot\"\n shows \"check_single \\ e = id\n \\ check_single \\ e = (\\ctn. type_update_select ctn)\n \\ (\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\nproof -\n have True\n and True\n and \"check_single \\ e ctn = ctm \\\n ctm \\ Bot \\\n ?thesis\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn tm)\n thus ?case\n by simp\n next\n case (2 \\ es ts)\n thus ?case\n by simp\n next\n case (3 \\ v ts)\n thus ?case\n by fastforce\n next\n case (4 \\ t uu ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (5 \\ t uv ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (6 \\ t uw ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (7 \\ t ux ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (8 \\ t uy ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (9 \\ t uz ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (10 \\ t va ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (11 \\ t va ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (12 \\ t1 t2 sx ts)\n thus ?case\n by (simp del: convert_cond.simps, meson assms(2) type_update.simps)\n next\n next\n case (13 \\ t1 t2 sx ts)\n thus ?case\n by (simp del: convert_cond.simps, meson assms(2) type_update.simps)\n next\n case (14 \\ t1 t2 sx ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (15 \\ ts)\n thus ?case\n by fastforce\n next\n case (16 \\ ts)\n thus ?case\n by fastforce\n next\n case (17 \\ ts)\n thus ?case\n by fastforce\n next\n case (18 \\ ts)\n thus ?case\n by fastforce\n next\n case (19 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (20 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (21 \\ tn tm es1 es2 ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (22 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (23 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (24 \\ \"is\" ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (25 \\ ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (26 \\ i ts)\n thus ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (27 \\ i ts)\n thus ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (28 \\ i ts)\n then have length_def:\"i < length (func_t \\)\"\n using assms(2)\n by (simp, meson)\n then obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust 28 length_def\n by (simp, meson)\n hence return_def:\"(return \\) = Some tm''\"\n using assms(2) length_def 28\n by (simp, meson)\n moreover\n hence \"check_single \\ (ReturnCall i) ctn = (type_update ctn (to_ct_list tn'') (TopType []))\"\n using 28(1) return_def func_def length_def assms(2)\n by simp\n thus ?case\n using 28(1) return_def func_def length_def assms(2)\n by (simp, metis)\n next\n case (29 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n moreover\n have length_def:\"(table \\) \\ None \\ i < length (types_t \\)\"\n using assms(2) 29\n by (simp, meson)\n hence return_def:\"(return \\) = Some tm''\"\n using 29 type_def assms(2)\n by (simp, meson)\n moreover\n hence \"check_single \\ (ReturnCall_indirect i) ctn = type_update ctn (to_ct_list (tn''@[T_i32])) (TopType [])\"\n using 29 length_def type_def return_def assms(2)\n by auto\n thus ?case\n using 29(1) return_def length_def assms(2) type_def\n by (simp, metis)\n next\n case (30 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (31 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (32 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (33 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (34 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (35 \\ t tp_sx a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (36 \\ t tp a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (37 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (38 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nlemma check_equiv_fold:\n \"check \\ es ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts es\"\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n obtain ts' where ts'_def:\"check \\ (e # es) ts = ts'\"\n by blast\n show ?case\n proof (cases \"ts = Bot\")\n case True\n thus ?thesis\n using ts'_def\n by (induction es, simp_all)\n next\n case False\n thus ?thesis\n using ts'_def Cons\n by (cases ts, simp_all)\n qed\nqed\n\nlemma check_neq_bot_snoc:\n assumes \"check \\ (es@[e]) ts \\ Bot\"\n shows \"check \\ es ts \\ Bot\"\n using assms\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by (cases ts, simp_all)\nnext\n case (Cons a es)\n thus ?case\n by (cases ts, simp_all)\nqed\n\nlemma check_unfold_snoc:\n assumes \"check \\ es ts \\ Bot\"\n shows \"check \\ (es@[e]) ts = check_single \\ e (check \\ es ts)\"\nproof -\n obtain f where f_def:\"f = (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts))\"\n by blast\n have f_simp:\"\\ts. ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n proof -\n fix ts\n show \"ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n using f_def\n by (cases ts, simp_all)\n qed\n have \"check \\ (es@[e]) ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts (es@[e])\"\n using check_equiv_fold\n by simp\n also\n have \"... = foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev (es@[e])) ts\"\n using foldl_conv_foldr\n by fastforce\n also\n have \"... = f e (foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev es) ts)\"\n using f_def\n by simp\n also\n have \"... = f e (check \\ es ts)\"\n using foldr_conv_foldl[of _ \"(rev es)\" ts] rev_rev_ident[of es] check_equiv_fold\n by simp\n also\n have \"... = check_single \\ e (check \\ es ts)\"\n using assms f_simp\n by simp\n finally\n show ?thesis .\nqed\n\nlemma check_single_imp_weakening:\n assumes \"check_single \\ e (Type t1s) = ctm\"\n \"ctm \\ Bot\"\n \"c_types_agree ctn t1s\"\n \"c_types_agree ctm t2s\"\n shows \"\\ctm'. check_single \\ e ctn = ctm' \\ c_types_agree ctm' t2s\"\nproof -\n consider (1) \"check_single \\ e = id\"\n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1,3,4)\n by fastforce\n next\n (* TODO: better proof *)\n case 2\n note outer_2 = 2\n hence t1s_cond:\"(length t1s \\ 3 \\ (t1s!(length t1s-2)) = (t1s!(length t1s-3)))\"\n using assms(1,2)\n by (simp, meson)\n hence ctm_def:\"ctm = consume (Type t1s) [TAny, TSome T_i32]\"\n using assms(1,2) 2\n by simp\n then obtain c_t where c_t_def:\"ctm = Type c_t\"\n using assms(2)\n by (meson consume.simps(1))\n hence t2s_eq:\"t2s = c_t\"\n using assms(4)\n by simp\n hence t2s_len:\"length t2s > 0\"\n using t1s_cond ctm_def c_t_def assms(2)\n by (metis Suc_leI Suc_n_not_le_n checker_type.inject(2) consume.simps(1)\n diff_is_0_eq dual_order.trans length_0_conv length_Cons length_greater_0_conv\n nat.simps(3) numeral_3_eq_3 take_eq_Nil)\n have t1s_suffix_full:\"ct_suffix [TAny, TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis consume.simps(1))\n hence t1s_suffix:\"ct_suffix [TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis append_butlast_last_id last.simps list.distinct(1))\n obtain t t1s' where t1s_suffix2:\"t1s = t1s'@[t,t,T_i32]\"\n using type_update_select_type_length3 assms(1) c_t_def outer_2\n by fastforce\n hence t2s_def:\"t2s = t1s'@[t]\"\n using ctm_def c_t_def t2s_eq t1s_suffix assms(2) t1s_suffix_full\n by simp\n show ?thesis\n using assms(1,3,4)\n proof (cases ctn)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using 2 TopType\n by simp\n thus ?thesis\n using ct_suffix_singleton to_ct_list_def t2s_len\n by auto\n next\n case 2\n hence \"ct_suffix [TSome T_i32] x1\"\n using assms(3) TopType ct_suffix_imp_ct_list_eq ct_suffix_shared t1s_suffix\n by (metis One_nat_def append_Nil c_types_agree.simps(2) ct_list_eq_commute ct_suffix_def\n diff_self_eq_0 drop_0 length_Cons list.size(3))\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using outer_2 TopType 2\n by simp\n thus ?thesis\n using t2s_len ct_suffix_singleton\n by (simp add: to_ct_list_def)\n next\n case 3\n have \"ct_list_eq (to_ct_list t1s) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2\n by (simp add: ct_list_eq_ts_conv_eq)\n hence temp1:\"to_ct_list t1s = (to_ct_list (t1s' @ [t])) @ (to_ct_list [t, T_i32])\"\n using t1s_suffix2 to_ct_list_def\n by simp\n hence \"ct_suffix (to_ct_list [t, T_i32]) (to_ct_list t1s)\"\n using ct_suffix_def[of \"(to_ct_list [t, T_i32])\" \"(to_ct_list t1s)\"]\n by (simp add: ct_suffix_cons_it)\n hence \"ct_suffix (to_ct_list [t, T_i32]) x1\"\n using assms(3) TopType 3\n by (simp, metis temp1 append_Nil ct_suffix_cons2 ct_suffix_def length_Cons length_map\n list.size(3) numeral_2_eq_2 to_ct_list_def)\n hence temp3:\"ct_list_eq (to_ct_list [t, T_i32]) x1\"\n using 3 ct_suffix_imp_ct_list_eq\n unfolding to_ct_list_def\n by (metis Suc_leI ct_list_eq_commute diff_is_0_eq drop_0 length_Cons length_map lessI\n list.size(3) numeral_2_eq_2)\n hence temp4:\"ct_suffix [TSome T_i32] x1\"\n using ct_suffix_less[of \"[TSome t]\" \"[TSome T_i32]\" x1]\n ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\"] ct_suffix_nil\n unfolding to_ct_list_def\n by fastforce\n hence \"ct_suffix (take 1 x1) (to_ct_list [t])\"\n using temp3 ct_suffix_nil ct_list_eq_commute ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\" \"(take 1 x1)\" \"(to_ct_list [t])\"]\n unfolding to_ct_list_def\n by (simp, metis butlast.simps(2) butlast_conv_take ct_list_eq_take diff_Suc_1 length_Cons\n list.distinct(1) list.size(3))\n thus ?thesis\n using TopType 2 3 ct_suffix_nil temp3 temp4 t2s_def to_ct_list_def\n apply (simp, safe)\n apply (metis append.assoc ct_suffix_def)\n done\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n obtain x1' x x' x'' where x1_split:\"x1 = x1'@[x,x',x'']\"\n proof -\n assume local_assms:\"(\\x1' x x' x''. x1 = x1' @ [x, x', x''] \\ thesis)\"\n obtain x1' x1'' where tn_split:\"x1 = x1'@x1''\"\n \"length x1'' = 3\"\n using 4\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain x x1''2 where \"x1'' = x#x1''2\" \"length x1''2 = Suc (Suc 0)\"\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain x' x'' where tn''_def:\"x1''= [x,x',x'']\"\n using List.length_Suc_conv[of x1''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n thus ?thesis\n using tn_split local_assms\n by simp\n qed\n hence a:\"ct_suffix (x1'@[x,x',x'']) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2 assms(3) TopType\n by simp\n hence b:\"ct_suffix (x1'@[x,x']) (to_ct_list (t1s' @ [t, t])) \\ (ct_eq x'' (TSome T_i32))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x,x'])\" \"x''\" \"to_ct_list (t1s' @ [t, t])\"]\n by fastforce\n hence c:\"ct_suffix (x1'@[x]) (to_ct_list (t1s' @ [t])) \\ (ct_eq x' (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x])\" \"x'\" \"to_ct_list (t1s' @ [t])\"]\n by fastforce\n hence d:\"ct_suffix x1' (to_ct_list t1s') \\ (ct_eq x (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1')\" \"x\" \"to_ct_list (t1s')\"]\n by fastforce\n have \"(take (length x1 - 3) x1) = x1'\"\n using x1_split\n by simp\n have x'_ind:\"(x1!(length x1-2)) = x'\"\n using x1_split List.nth_append_length[of \"x1' @ [x]\"]\n by simp\n have x_ind:\"(x1!(length x1-3)) = x\"\n using x1_split\n by simp\n have \"ct_suffix [TSome T_i32] x1\"\n using b x1_split ct_suffix_def ct_list_eq_def ct_suffixI[of x1 \"x1' @ [x, x']\"]\n by simp\n hence \"check_single \\ e (TopType x1) = (select_return_top x1 (x1!(length x1-2)) (x1!(length x1-3)))\"\n using type_update_select_conv_select_return_top[OF _ 4]\n unfolding 2\n by blast\n moreover\n have \"... = (TopType (x1'@[x])) \\ ... = (TopType (x1'@[x']))\"\n apply (cases x; cases x')\n using x1_split 4 nat_def 2 x_ind x'_ind c d\n by simp_all\n moreover\n have \"ct_suffix (x1'@[x]) (to_ct_list t2s)\"\n by (simp add: c t2s_def)\n moreover\n have \"ct_suffix (x1'@[x']) (to_ct_list t2s)\"\n using ct_suffix_unfold_one[symmetric, of x' \"(TSome t)\" x1' \"(to_ct_list t1s')\"] c d\n t2s_def\n unfolding to_ct_list_def\n by fastforce\n ultimately\n show ?thesis\n using TopType\n by auto\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where c_s_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence ctm_def:\"ctm = type_update (Type t1s) cons prods\"\n using assms(1)\n by fastforce\n hence cons_suffix:\"ct_suffix cons (to_ct_list t1s)\"\n using assms\n by (simp, metis (full_types) produce.simps(6))\n hence t_int_def:\"consume (Type t1s) cons = (Type (take (length t1s - length cons) t1s))\"\n using ctm_def\n by simp\n hence ctm_def2:\"ctm = produce (Type (take (length t1s - length cons) t1s)) prods\"\n using ctm_def\n by simp\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n hence \"ct_suffix x1 (to_ct_list t1s)\"\n using assms(3)\n by simp\n thus ?thesis\n using assms(2) ctm_def2\n proof (cases prods)\n case (TopType x1)\n thus ?thesis\n using consume_c_types_agree[OF t_int_def assms(3)] ctm_def2 assms(4) c_s_def\n by (metis c_types_agree.elims(2) produce.simps(3,4) type_update.simps)\n next\n case (Type x2)\n hence ctm_def3:\"ctm = Type ((take (length t1s - length cons) t1s)@ x2)\"\n using ctm_def2\n by simp\n have \"ct_suffix x1 cons \\ ct_suffix cons x1\"\n using ct_suffix_shared assms(3) TopType cons_suffix\n by auto\n thus ?thesis\n proof (rule disjE)\n assume \"ct_suffix x1 cons\"\n hence \"consume (TopType x1) cons = TopType []\"\n by (simp add: ct_suffix_length)\n hence \"check_single \\ e ctn = TopType (to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n thus ?thesis\n using TopType ctm_def3 assms(4) c_types_agree_top2 ct_list_eq_refl\n by auto\n next\n assume \"ct_suffix cons x1\"\n hence 4:\"consume (TopType x1) cons = TopType (take (length x1 - length cons ) x1)\"\n by (simp add: ct_suffix_length)\n hence 3:\"check_single \\ e ctn = TopType ((take (length x1 - length cons ) x1) @ to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n have \"((take (length t1s - length cons ) t1s) @ x2) = t2s\"\n using assms(4) ctm_def3\n by simp\n have \"c_types_agree (TopType (take (length x1 - length cons ) x1)) (take (length t1s - length cons) t1s)\"\n using consume_c_types_agree[OF t_int_def assms(3)] 4 TopType\n by simp\n hence \"c_types_agree (TopType (take (length x1 - length cons ) x1 @ to_ct_list x2)) (take (length t1s - length cons) t1s @ x2)\"\n unfolding c_types_agree.simps to_ct_list_def\n by (simp add: ct_suffix_cons2 ct_suffix_cons_it ct_suffix_extend_ct_list_eq)\n thus ?thesis\n using ctm_def3 assms 3\n by simp\n qed\n qed simp\n next\n case (Type x2)\n thus ?thesis\n using assms\n by simp\n next\n case Bot\n thus ?thesis\n using assms\n by simp\n qed\n qed\nqed\n\nlemma b_e_type_checker_compose:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n \"b_e_type_checker \\ [e] (t2s _> t3s)\"\n shows \"b_e_type_checker \\ (es @ [e]) (t1s _> t3s)\"\nproof -\n have \"c_types_agree (check_single \\ e (Type t2s)) t3s\"\n using assms(2)\n by simp\n then obtain ctm where ctm_def:\"check_single \\ e (Type t2s) = ctm\"\n \"c_types_agree ctm t3s\"\n \"ctm \\ Bot\"\n by fastforce\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n thus ?thesis\n using check_single_imp_weakening[OF ctm_def(1,3) ctn_def(2) ctm_def(2)]\n check_unfold_snoc[of \\ es \"(Type t1s)\" e]\n by simp\nqed\n\nlemma b_e_check_single_type_type:\n assumes \"check_single \\ e xs = (Type tm)\"\n shows \"\\tn. xs = (Type tn)\"\nproof -\n consider (1) \"check_single \\ e = id\"\n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n note outer_2 = 2\n thus ?thesis\n using assms\n proof (cases xs)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = Suc 0\"\n | (3) \"length x1 = Suc (Suc 0)\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof cases\n case 1\n thus ?thesis\n using assms 2 TopType\n by simp\n next\n case 2\n thus ?thesis\n using assms outer_2 TopType produce_type_type\n by fastforce\n next\n case 3\n thus ?thesis\n using assms 2 TopType\n by (simp, metis checker_type.distinct(1) checker_type.distinct(5))\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n thus ?thesis\n using assms 2 TopType\n proof -\n {\n assume a1: \"produce (if ct_suffix [TAny, TAny, TSome T_i32] x1 then TopType (take (length x1 - length [TAny, TAny, TSome T_i32]) x1) else if ct_suffix x1 [TAny, TAny, TSome T_i32] then TopType [] else Bot) (select_return_top x1 (x1 ! Suc nat) (x1 ! nat)) = Type tm\"\n obtain tts :: \"checker_type \\ t list\" where\n f2: \"\\c. (\\ca ts. produce c ca \\ Type ts) \\ c = Type (tts c)\"\n using produce_type_type by moura\n then have f3: \"\\ts. \\ ct_suffix [TAny, TAny, TSome T_i32] x1 \\ Type tm \\ Type ts\"\n using a1 by fastforce\n then have \"\\ts. \\ ct_suffix x1 [TAny, TAny, TSome T_i32] \\ Type tm \\ Type ts\"\n using f2 a1 by fastforce\n then have False\n using f3 a1 by fastforce\n }\n thus ?thesis\n using assms 2 TopType nat_def\n by simp\n qed\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume xs cons) prods = (Type tm)\"\n using assms(1)\n by simp\n thus ?thesis\n using assms check_def consume_type_type produce_type_type\n by blast\n qed\nqed\n\nlemma b_e_check_single_weaken_type:\n assumes \"check_single \\ e (Type tn) = (Type tm)\"\n shows \"check_single \\ e (Type (ts@tn)) = Type (ts@tm)\"\nproof -\n consider (1) \"check_single \\ e = id\"\n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1)\n by simp\n next\n case 2\n hence cond:\"(length tn \\ 3 \\ (tn!(length tn-2)) = (tn!(length tn-3)))\"\n using assms\n by (simp, metis checker_type.distinct(5))\n hence \"consume (Type tn) [TAny, TSome T_i32] = (Type tm)\"\n using assms 2\n by simp\n hence \"consume (Type (ts@tn)) [TAny, TSome T_i32] = (Type (ts@tm))\"\n using consume_weaken_type\n by blast\n moreover\n have \"(length (ts@tn) \\ 3 \\ ((ts@tn)!(length (ts@tn)-2)) = ((ts@tn)!(length (ts@tn)-3)))\"\n using cond\n by (simp, metis add.commute add_leE nth_append_length_plus numeral_Bit1 numeral_One\n one_add_one ordered_cancel_comm_monoid_diff_class.diff_add_assoc2)\n ultimately\n show ?thesis\n using 2\n by simp\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (Type tm)\"\n using assms(1)\n by simp\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis consume.simps(1) produce.simps(6))\n thus ?thesis\n using assms(1) check_def\n consume_weaken_type[OF t_int_def, of ts]\n produce_weaken_type[of t_int prods tm ts]\n by simp\n qed\nqed\n\nlemma b_e_check_single_weaken_top:\n assumes \"check_single \\ e (Type tn) = TopType tm\"\n shows \"check_single \\ e (Type (ts@tn)) = TopType tm\"\nproof -\n consider (1) \"check_single \\ e = id\"\n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n thus ?thesis\n using assms\n by (simp, metis checker_type.distinct(1) checker_type.distinct(3) consume.simps(1))\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (TopType tm)\"\n using assms(1)\n by simp\n moreover\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis checker_type.distinct(3) consume.simps(1) produce.simps(6))\n ultimately\n show ?thesis\n using check_def consume_weaken_type\n by (cases prods, auto)\n qed\nqed\n\nlemma b_e_check_weaken_type:\n assumes \"check \\ es (Type tn) = (Type tm)\"\n shows \"check \\ es (Type (ts@tn)) = (Type (ts@tm))\"\n using assms\nproof (induction es arbitrary: tn tm rule: List.rev_induct)\n case Nil\n thus ?case\n by simp\nnext\n case (snoc e es)\n hence \"check_single \\ e (check \\ es (Type tn)) = Type tm\"\n using check_unfold_snoc[OF check_neq_bot_snoc]\n by (metis checker_type.distinct(5))\n thus ?case\n using b_e_check_single_weaken_type b_e_check_single_type_type snoc\n by (metis check_unfold_snoc checker_type.distinct(5))\nqed\n\nlemma check_bot: \"check \\ es Bot = Bot\"\n by (simp add: list.case_eq_if)\n\nlemma b_e_check_weaken_top:\n assumes \"check \\ es (Type tn) = (TopType tm)\"\n shows \"check \\ es (Type (ts@tn)) = (TopType tm)\"\n using assms\nproof (induction es arbitrary: tn tm)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n show ?case\n proof (cases \"(check_single \\ e (Type tn))\")\n case (TopType x1)\n hence \"check_single \\ e (Type (ts@tn)) = TopType x1\"\n using b_e_check_single_weaken_top\n by blast\n thus ?thesis\n using TopType Cons\n by simp\n next\n case (Type x2)\n hence \"check_single \\ e (Type (ts@tn)) = Type (ts@x2)\"\n using b_e_check_single_weaken_type\n by blast\n thus ?thesis\n using Cons Type\n by fastforce\n next\n case Bot\n thus ?thesis\n using check_bot Cons\n by simp\n qed\n\nqed\n\nlemma b_e_type_checker_weaken:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n shows \"b_e_type_checker \\ es (ts@t1s _> ts@t2s)\"\nproof -\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_top[of \\ es t1s x1 ts]\n by (metis append_assoc b_e_type_checker.simps c_types_agree_imp_ct_list_eq c_types_agree_top2)\n next\n case (Type x2)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_type[of \\ es t1s x2 ts]\n by simp\n next\n case Bot\n thus ?thesis\n using ctn_def(3)\n by simp\n qed\nqed\n\nlemma b_e_type_checker_complete:\n assumes \"\\ \\ es : (tn _> tm)\"\n shows \"b_e_type_checker \\ es (tn _> tm)\"\n using assms\nproof (induction es \"(tn _> tm)\" arbitrary: tn tm rule: b_e_typing.induct)\n case (select \\ t)\n have \"ct_list_eq [TAny, TSome T_i32] [TSome t, TSome T_i32]\"\n by (simp add: to_ct_list_def ct_list_eq_def)\n thus ?case\n using ct_suffix_extend_ct_list_eq[OF ct_suffix_nil[of \"[TSome t]\"]] to_ct_list_def\n by auto\nnext\n case (br_table \\ ts \"is\" i t1s t2s)\n show ?case\n using list_all_conv_same_lab[OF br_table]\n by (auto simp add: to_ct_list_def ct_suffix_nil ct_suffix_cons_it)\nnext\n case (set_global i \\ t)\n thus ?case\n using to_ct_list_def ct_suffix_refl is_mut_def tg_t_def\n by auto\nnext\n case (composition \\ es t1s t2s e t3s)\n thus ?case\n using b_e_type_checker_compose\n by simp\nnext\n case (weakening \\ es t1s t2s ts)\n thus ?case\n using b_e_type_checker_weaken\n by simp\nqed (auto simp add: to_ct_list_def ct_suffix_refl ct_suffix_nil ct_suffix_cons_it\n ct_suffix_singleton_any)\n\ntheorem b_e_typing_equiv_b_e_type_checker:\n shows \"(\\ \\ es : (tn _> tm)) = (b_e_type_checker \\ es (tn _> tm))\"\n using b_e_type_checker_sound b_e_type_checker_complete\n by blast\n\nend\n", "meta": {"author": "jacobmischka", "repo": "wasm-isabelle", "sha": "a7c0395023d06d701848ddaf850e6997206489a5", "save_path": "github-repos/isabelle/jacobmischka-wasm-isabelle", "path": "github-repos/isabelle/jacobmischka-wasm-isabelle/wasm-isabelle-a7c0395023d06d701848ddaf850e6997206489a5/WebAssembly/Wasm_Checker_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.28157164003676394}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weakening\n imports Weak_Bisimulation\nbegin\n\nlocale weak = env + \n assumes weaken: \"\\ \\ \\ \\ \\'\"\nbegin\n\nlemma entWeaken:\n fixes \\ :: 'b\n and \\ :: 'c\n\n assumes \"\\ \\ \\\"\n\n shows \"\\ \\ \\' \\ \\\"\nusing assms weaken\nby(auto simp add: AssertionStatImp_def)\n\nlemma assertWeaken:\n fixes \\ :: 'b\n and \\' :: 'b\n\n shows \"\\ \\ \\ \\ \\'\"\nby(auto simp add: AssertionStatImp_def entWeaken)\n\nlemma frameWeaken:\n fixes F :: \"'b frame\"\n and G :: \"'b frame\"\n\n shows \"F \\\\<^sub>F F \\\\<^sub>F G\"\nproof -\n obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\" and \"A\\<^sub>F \\* F\" and \"A\\<^sub>F \\* G\"\n by(rule_tac F=F and C=\"(F, G)\" in freshFrame) auto\n obtain A\\<^sub>G \\\\<^sub>G where FrG: \"G = \\A\\<^sub>G, \\\\<^sub>G\\\" and \"A\\<^sub>G \\* F\" and \"A\\<^sub>G \\* G\" and \"A\\<^sub>G \\* A\\<^sub>F\" and \"A\\<^sub>G \\* \\\\<^sub>F\"\n by(rule_tac F=G and C=\"(F, G, A\\<^sub>F, \\\\<^sub>F)\" in freshFrame) auto\n from FrG \\A\\<^sub>F \\* G\\ \\A\\<^sub>G \\* A\\<^sub>F\\ have \"A\\<^sub>F \\* \\\\<^sub>G\" by auto\n have \"\\\\<^sub>F \\ \\\\<^sub>F \\ \\\\<^sub>G\" by(rule weaken)\n hence \"\\A\\<^sub>G, \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\\\<^sub>F \\ \\\\<^sub>G\\\" by(rule_tac frameImpResChainPres) auto\n with \\A\\<^sub>G \\* \\\\<^sub>F\\ have \"\\\\, \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\\\<^sub>F \\ \\\\<^sub>G\\\" using frameResFreshChain\n by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def)\n with FrF FrG \\A\\<^sub>G \\* A\\<^sub>F\\ \\A\\<^sub>G \\* \\\\<^sub>F\\ \\A\\<^sub>F \\* \\\\<^sub>G\\ show ?thesis\n by(force simp add: frameChainAppend intro: frameImpResChainPres)\nqed\n\nlemma unitAssertWeaken:\n fixes \\ :: 'b\n\n shows \"\\ \\ \\\"\nproof -\n have \"\\ \\ \\ \\ \\\" by(rule assertWeaken)\n moreover have \"\\ \\ \\ \\ \\\" by(metis Identity AssertionStatEq_def Commutativity AssertionStatEqTrans)\n ultimately show ?thesis by(rule AssertionStatImpTrans)\nqed\n\nlemma unitFrameWeaken:\n fixes F :: \"'b frame\"\n\n shows \"\\\\, \\\\ \\\\<^sub>F F\"\nproof -\n have \"\\\\, \\\\ \\\\<^sub>F ((\\\\, \\\\) \\\\<^sub>F F)\" by(rule frameWeaken)\n moreover obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\"\n by(rule_tac F=F and C=\"()\" in freshFrame) auto\n hence \"(\\\\, \\\\) \\\\<^sub>F F \\\\<^sub>F F\" \n by simp (metis frameIntIdentity frameIntCommutativity FrameStatEqTrans FrameStatEqSym)\n ultimately show ?thesis by(metis FrameStatImpTrans FrameStatEq_def)\nqed\n\nlemma insertAssertionWeaken:\n fixes F :: \"'b frame\"\n and \\ :: 'b\n\n shows \"\\\\, \\\\ \\\\<^sub>F insertAssertion F \\\"\nproof -\n have \"\\\\, \\\\ \\\\<^sub>F (\\\\, \\\\) \\\\<^sub>F F\" by(rule frameWeaken)\n thus ?thesis by simp\nqed\n\nlemma frameImpStatEq:\n fixes A\\<^sub>F :: \"name list\"\n and \\ :: 'b\n and \\' :: 'b\n and \\ :: 'c\n\n assumes \"(\\A\\<^sub>F, \\\\) \\\\<^sub>F \\\"\n and \"\\ \\ \\'\"\n\n shows \"(\\A\\<^sub>F, \\'\\) \\\\<^sub>F \\\"\nproof -\n obtain p::\"name prm\" where \"(p \\ A\\<^sub>F) \\* \\\" and \"(p \\ A\\<^sub>F) \\* \\\" and \"(p \\ A\\<^sub>F) \\* \\'\"\n and \"distinctPerm p\" and S: \"set p \\ set A\\<^sub>F \\ set(p \\ A\\<^sub>F)\"\n by(rule_tac c=\"(\\, \\, \\')\" in name_list_avoiding) auto\n from \\(\\A\\<^sub>F, \\\\) \\\\<^sub>F \\\\ \\(p \\ A\\<^sub>F) \\* \\\\ S have \"(\\(p \\ A\\<^sub>F), p \\ \\\\) \\\\<^sub>F \\\" by(simp add: frameChainAlpha)\n hence \"(p \\ \\) \\ \\\" using \\(p \\ A\\<^sub>F) \\* \\\\ by(rule frameImpE)\n moreover from \\\\ \\ \\'\\ have \"(p \\ \\) \\ (p \\ \\')\" by(rule AssertionStatEqClosed)\n ultimately have \"(p \\ \\') \\ \\\" by(simp add: AssertionStatEq_def AssertionStatImp_def)\n hence \"(\\(p \\ A\\<^sub>F), p \\ \\'\\) \\\\<^sub>F \\\" using \\(p \\ A\\<^sub>F) \\* \\\\ \n by(rule_tac frameImpI) auto\n with \\(p \\ A\\<^sub>F) \\* \\'\\ S show ?thesis by(simp add: frameChainAlpha)\nqed\n\n\n\n assumes \"\\ \\ P \\\\ \\ P'\"\n\n shows \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame P') \\\"\nproof(auto simp add: FrameStatImp_def)\n fix \\ :: 'c\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* P\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* \\\" and \"distinct A\\<^sub>P\" \n by(rule_tac C=\"(P, \\, \\)\" in freshFrame) auto\n with \\\\ \\ P \\\\ \\ P'\\ obtain \\' A\\<^sub>P' \\\\<^sub>P' where FrP': \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\" \n and \"A\\<^sub>P' \\* P'\" and \"A\\<^sub>P' \\* \\\" and \"A\\<^sub>P' \\* \\\" \n by(rule_tac C=\"(\\, \\)\" in expandTauFrame) auto\n assume \"insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\"\n with FrP \\A\\<^sub>P \\* \\\\ \\A\\<^sub>P \\* \\\\ have \"\\ \\ \\\\<^sub>P \\ \\\" by(auto dest: frameImpE)\n hence \"(\\ \\ \\\\<^sub>P) \\ \\' \\ \\\" by(rule entWeaken)\n hence \"\\ \\ \\\\<^sub>P' \\ \\\" using \\\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\\\n by(rule_tac statEqEnt, auto) (metis Associativity compositionSym AssertionStatEqTrans AssertionStatEqSym Commutativity)\n with \\A\\<^sub>P' \\* \\\\ \\A\\<^sub>P' \\* \\\\ FrP' show \"insertAssertion (extractFrame P') \\ \\\\<^sub>F \\\"\n by(force intro: frameImpI)\nqed\n\nlemma weakenTransition:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rs :: \"('a, 'b, 'c) residual\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\ Rs\"\n\n shows \"\\ \\ \\' \\ P \\ Rs\"\nusing assms\nproof(nominal_induct avoiding: \\' rule: semantics.strong_induct)\n case(cInput \\ M K xvec N Tvec P \\')\n from \\\\ \\ M \\ K\\ have \"\\ \\ \\' \\ M \\ K\" by(rule entWeaken)\n thus ?case using \\distinct xvec\\ \\set xvec \\ (supp N)\\ \\length xvec = length Tvec\\ \n by(rule Input)\nnext\n case(Output \\ M K N P \\')\n from \\\\ \\ M \\ K\\ have \"\\ \\ \\' \\ M \\ K\" by(rule entWeaken)\n thus ?case by(rule semantics.Output)\nnext\n case(Case \\ P Rs \\ Cs \\')\n have \"\\ \\ \\' \\ P \\ Rs\" by(rule Case)\n moreover note \\(\\, P) mem Cs\\\n moreover from \\\\ \\ \\\\ have \"\\ \\ \\' \\ \\\" by(rule entWeaken)\n ultimately show ?case using \\guarded P\\\n by(rule semantics.Case)\nnext\n case(cPar1 \\ \\\\<^sub>Q P \\ P' Q A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\\\ \\ P'\" by(rule cPar1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n thus ?case using \\extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\\ \\bn \\ \\* Q\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>Q \\* \\'\\ \\A\\<^sub>Q \\* P\\ \\A\\<^sub>Q \\* \\\\\n by(rule_tac Par1) auto\nnext\n case(cPar2 \\ \\\\<^sub>P Q \\ Q' P A\\<^sub>P \\')\n have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\\\ \\ Q'\" by(rule cPar2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n thus ?case using \\extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\\ \\bn \\ \\* P\\ \\A\\<^sub>P \\* \\\\ \\A\\<^sub>P \\* \\'\\ \\A\\<^sub>P \\* Q\\ \\A\\<^sub>P \\* \\\\\n by(rule_tac Par2) auto\nnext\n case(cComm1 \\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\M\\N\\ \\ P'\" by(rule cComm1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\M\\N\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note \\extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\\\n moreover have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\" by(rule cComm1)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note \\extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\\\n moreover from \\\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\\ have \"(\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q) \\ \\' \\ M \\ K\" by(rule entWeaken)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\" by(metis statEqEnt Composition Associativity Commutativity AssertionStatEqTrans)\n ultimately show ?case using \\A\\<^sub>P \\* \\\\ \\A\\<^sub>P \\* \\'\\ \\A\\<^sub>P \\* P\\ \\A\\<^sub>P \\* Q\\ \\A\\<^sub>P \\* M\\ \\A\\<^sub>P \\* A\\<^sub>Q\\\n \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>Q \\* \\'\\ \\A\\<^sub>Q \\* P\\ \\A\\<^sub>Q \\* Q\\ \\A\\<^sub>Q \\* K\\ \\xvec \\* P\\\n by(rule_tac Comm1) (assumption | auto)+\nnext\n case(cComm2 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q \\')\n have \"(\\ \\ \\\\<^sub>Q) \\ \\' \\ P \\M\\\\*xvec\\\\N\\ \\ P'\" by(rule cComm2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note \\extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\\\n moreover have \"(\\ \\ \\\\<^sub>P) \\ \\' \\ Q \\K\\N\\ \\ Q'\" by(rule cComm2)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ Q \\K\\N\\ \\ Q'\"\n by(metis statEqTransition Composition Associativity Commutativity AssertionStatEqTrans)\n moreover note \\extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\\\n moreover from \\\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\\ have \"(\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q) \\ \\' \\ M \\ K\" by(rule entWeaken)\n hence \"(\\ \\ \\') \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\" by(metis statEqEnt Composition Associativity Commutativity AssertionStatEqTrans)\n ultimately show ?case using \\A\\<^sub>P \\* \\\\ \\A\\<^sub>P \\* \\'\\ \\A\\<^sub>P \\* P\\ \\A\\<^sub>P \\* Q\\ \\A\\<^sub>P \\* M\\ \\A\\<^sub>P \\* A\\<^sub>Q\\\n \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>Q \\* \\'\\ \\A\\<^sub>Q \\* P\\ \\A\\<^sub>Q \\* Q\\ \\A\\<^sub>Q \\* K\\ \\xvec \\* Q\\\n by(rule_tac Comm2) (assumption | auto)+\nnext\n case(cOpen \\ P M xvec yvec N P' x \\')\n have \"\\ \\ \\' \\ P \\M\\\\*(xvec@yvec)\\\\N\\ \\ P'\" by(rule cOpen)\n thus ?case using \\x \\ supp N\\ \\x \\ \\\\ \\x \\ \\'\\ \\x \\ M\\ \\x \\ xvec\\ \\x \\ yvec\\\n by(rule_tac Open) auto\nnext \n case(cScope \\ P \\ P' x \\')\n have \"\\ \\ \\' \\ P \\\\ \\ P'\" by(rule cScope)\n thus ?case using \\x \\ \\\\ \\x \\ \\'\\ \\x \\ \\\\ by(rule_tac Scope) auto\nnext\n case(Bang \\ P Rs \\')\n have \"\\ \\ \\' \\ P \\ !P\\ Rs\" by(rule Bang)\n thus ?case using \\guarded P\\ by(rule semantics.Bang)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weakening.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2815666804993119}} {"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Signed_Add_Inert_Typed\n imports VHDL_Hoare_Typed Bits_Int_Aux\nbegin\n\ndatatype sig = A | B | C\n\ndefinition add :: \"sig conc_stmt\" where\n \"add \\ process {A, B} : Bassign_inert C (Badd (Bsig A) (Bsig B)) 1\"\n\nlocale signed_addition =\n fixes \\ :: \"sig tyenv\"\n fixes len len1 len2 :: nat\n assumes len_def: \"len = max len1 len2\"\n assumes atype: \"\\ A = Lty Sig len1\" and btype: \"\\ B = Lty Sig len2\" and ctype: \"\\ C = Lty Sig len\"\n assumes len1: \"0 < len1\" and len2: \"0 < len2\"\nbegin\n\nlemma well_typed:\n \"seq_wt \\ (Bassign_inert C (Badd (Bsig A) (Bsig B)) 1)\"\n by (metis atype bexp_wt.intros(16) bexp_wt.intros(3) btype ctype len1 len2 len_def\n seq_wt.intros(5))\n\nabbreviation \"lof_wline tw sig n \\ lval_of (wline_of tw sig n)\"\n\ntext \\Here we factor out common expression in both inv1 and inv2. It is parametrised by the index\nwe are interested with for C (first argument) and A (the second argument). Note that the index\nwe are interested with for A should be the same as the index for B.\\\n\ndefinition inv :: \"sig assn2\" where\n \"inv tw \\ (lof_wline tw C (fst tw) = bin_to_bl len (sbl_to_bin (lof_wline tw A (fst tw - 1)) + sbl_to_bin (lof_wline tw B (fst tw - 1))))\"\n\ndefinition inv2 :: \"sig assn2\" where\n \"inv2 tw \\ (disjnt {A, B} (event_of tw) \\ (\\i > fst tw. lof_wline tw C i = lof_wline tw C (fst tw)))\"\n\nlemma inv_next_time:\n fixes tw\n defines \"v \\ eval_world_raw2 tw (Badd (Bsig A) (Bsig B))\"\n defines \"tw' \\ tw\\C, 1 :=\\<^sub>2 v\\\"\n assumes \"wityping \\ (snd tw)\"\n shows \"inv (fst tw' + 1, snd tw')\"\nproof - \n have bexpA: \"bexp_wt \\ (Bsig A) (Lty Sig len1)\" and bexpB: \"bexp_wt \\ (Bsig B) (Lty Sig len2)\"\n using signed_addition_axioms unfolding signed_addition_def by (metis bexp_wt.intros(3))+\n obtain bsA bsB where evalA: \"eval_world_raw (fst tw) (snd tw) (Bsig A) = Lv Sig bsA\" and\" length bsA = len1 \" and\n evalB: \"eval_world_raw (fst tw) (snd tw) (Bsig B) = Lv Sig bsB\" and\" length bsB = len2 \"\n using eval_world_raw_lv[OF bexpA `wityping \\ (snd tw)`] eval_world_raw_lv[OF bexpB `wityping \\ (snd tw)`] by blast\n have \"type_of v = Lty Sig len\"\n using assms(3) bexpA bexpB bexp_wt.intros(9) type_of_eval_world_raw2 v_def \n by (metis ctype seq_wt_cases(5) well_typed)\n hence \"lof_wline tw' C (fst tw + 1) = lval_of v\"\n unfolding tw'_def\n proof (induction v)\n case (Bv x) \n then show ?case by auto\n next\n case (Lv sign bs)\n hence \"sign = Sig\" and \"length bs = len\"\n by auto\n let ?w' = \"\\b. snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)]\"\n let ?time = \"LEAST n. get_time tw < n \\ n \\ get_time tw + 1 \\ (\\b\\set [0.. ?w' b C n)\"\n have *: \" bs = (map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0.. snd (snd tw) C)) C (get_time tw) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (get_time tw + 1) = Bv (bs ! b) \\ \n ( GREATEST n.\n n \\ get_time tw + 1 \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (n - 1) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C n = Bv (bs ! b)) = fst tw + 1\"\n by (metis (mono_tags, lifting) Greatest_equality add_diff_cancel_right' le_eq_less_or_eq)\n hence \"bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1)) = (bs ! b)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n thus \" bs ! b =\n map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0.. \n by blast\n qed\n then show ?case \n proof (cases \"\\n>get_time tw. n \\ get_time tw + 1 \\ (\\b\\set [0.. ?w' b C n)\")\n case True\n hence \"?time = fst tw + 1\"\n by (metis (mono_tags, lifting) LeastI_ex antisym_conv1 discrete leD)\n then show ?thesis \n using True *\n unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n by auto\n next\n case False\n then show ?thesis \n using *\n unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n by auto\n qed\n qed\n also have \"... = bin_to_bl len (sbl_to_bin (lof_wline tw A (fst tw)) + sbl_to_bin (lof_wline tw B (fst tw)))\"\n using evalA evalB `length bsA = len1` `length bsB = len2`\n unfolding v_def eval_world_raw.simps eval_arith.simps len_def Let_def by auto\n finally show ?thesis\n unfolding inv_def tw'_def worldline_inert_upd2_def worldline_inert_upd_def \n by (metis (no_types, hide_lams) add.right_neutral add_diff_cancel_right' comp_apply fst_conv less_not_refl not_less_less_Suc_eq order_refl plus_1_eq_Suc snd_conv snd_worldline_inert_upd2 worldline_inert_upd2_def)\nqed\n\nlemma inv2_next_time:\n fixes tw v\n defines \"tw' \\ tw\\C, 1 :=\\<^sub>2 v\\\"\n shows \"inv2 (fst tw' + 1, snd tw')\"\nproof -\n { assume \"disjnt {A, B} (event_of (fst tw' + 1, snd tw'))\"\n have \"\\j. fst tw + 1 < j \\ lof_wline tw' C j = lof_wline tw' C (fst tw + 1)\"\n unfolding tw'_def \n proof (induction v)\n case (Bv x)\n then show ?case \n proof (cases \"snd (snd tw) C (get_time tw) = Bv x \\ snd (snd tw) C (get_time tw + 1) \\ Bv x \")\n case True\n then show ?thesis \n using Bv\n unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def\n comp_def snd_conv by auto\n next\n case False\n hence \"snd (snd tw) C (get_time tw) \\ Bv x \\ snd (snd tw) C (get_time tw + 1) = Bv x\"\n by auto\n hence \"(GREATEST n. n \\ get_time tw + 1 \\ snd (snd tw) C (n - 1) \\ Bv x \\ snd (snd tw) C n = Bv x) = fst tw + 1\"\n using GreatestI_nat[where k=\"fst tw + 1\"] \n by (metis (mono_tags, lifting) Greatest_equality Suc_eq_plus1 diff_Suc_1 le_eq_less_or_eq)\n then show ?thesis\n using Bv False\n unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def\n comp_def snd_conv by auto\n qed\n next\n case (Lv sign bs)\n let ?w' = \"\\b. snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)]\"\n let ?time = \"LEAST n. get_time tw < n \\ n \\ get_time tw + 1 \\ (\\b\\set [0.. ?w' b C n)\"\n have *: \" bs = (map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0.. snd (snd tw) C)) C (get_time tw) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (get_time tw + 1) = Bv (bs ! b) \\ \n ( GREATEST n.\n n \\ get_time tw + 1 \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (n - 1) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C n = Bv (bs ! b)) = fst tw + 1\"\n by (metis (mono_tags, lifting) Greatest_equality add_diff_cancel_right' le_eq_less_or_eq)\n hence \"bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1)) = (bs ! b)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n thus \" bs ! b =\n map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0.. \n by blast\n qed\n have **: \" bs = (map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0.. snd (snd tw) C)) C (get_time tw) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (get_time tw + 1) = Bv (bs ! b) \\ \n ( GREATEST n.\n n \\ get_time tw + 1 \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C (n - 1) \\ Bv (bs ! b) \\\n ((snd (snd tw))(C := to_bit b \\ snd (snd tw) C)) C n = Bv (bs ! b)) = fst tw + 1\"\n by (metis (mono_tags, lifting) Greatest_equality add_diff_cancel_right' le_eq_less_or_eq)\n hence \"bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j)) = (bs ! b)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using Lv by auto\n thus \" bs ! b =\n map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..map (\\b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0.. \n by blast\n qed\n show ?case \n proof (cases \"\\n>get_time tw. n \\ get_time tw + 1 \\ (\\b\\set [0.. ?w' b C n)\")\n case True\n hence \"?time = fst tw + 1\"\n by (metis (mono_tags, lifting) LeastI_ex antisym_conv1 discrete leD)\n hence \"wline_of tw\\ C, 1 :=\\<^sub>2 Lv sign bs\\ C (get_time tw + 1) = Lv sign bs\"\n using *[THEN sym] True unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps comp_def snd_conv fun_upd_def\n by auto\n moreover have \" wline_of tw\\ C, 1 :=\\<^sub>2 Lv sign bs\\ C j = Lv sign bs\"\n using Lv True \\?time = fst tw + 1\\ **\n unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n fun_upd_def by auto\n ultimately show ?thesis\n by auto\n next\n case False\n then show ?thesis\n using Lv * **\n unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n fun_upd_def by auto \n qed\n qed }\n thus \"inv2 (fst tw' + 1, snd tw')\"\n unfolding inv2_def by (simp add: tw'_def worldline_inert_upd2_def)\nqed\n\nlemma add_conc_hoare:\n \"\\tw. inv tw \\ inv2 tw \\ disjnt {A, B} (event_of tw) \\ inv (fst tw + 1, snd tw)\"\nproof -\n fix tw\n assume \"inv tw \\ inv2 tw \\ disjnt {A, B} (event_of tw)\"\n hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n by auto\n have \"lof_wline tw C (fst tw + 1) = lof_wline tw C (fst tw)\"\n using `inv2 tw` `disjnt {A, B} (event_of tw)` unfolding inv2_def by auto \n also have \"... = bin_to_bl len (sbl_to_bin (lval_of (wline_of tw A (get_time tw - 1))) + sbl_to_bin (lval_of (wline_of tw B (get_time tw - 1))))\"\n using `inv tw` unfolding inv_def by auto\n also have \"... = bin_to_bl len (sbl_to_bin (lval_of (wline_of tw A (fst tw))) + sbl_to_bin (lval_of (wline_of tw B (fst tw))))\"\n using `disjnt {A, B} (event_of tw)` unfolding event_of_alt_def \n by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n finally show \"inv (fst tw + 1, snd tw)\"\n unfolding inv_def by auto\nqed\n\nlemma add_conc_hoare2:\n \"\\tw. inv2 tw \\ disjnt {A, B} (event_of tw) \\ inv2 (fst tw + 1, snd tw)\"\n unfolding inv2_def by auto\n\nlemma conc_stmt_wf_add:\n \"conc_stmt_wf add\"\n unfolding add_def conc_stmt_wf_def by auto \n\nlemma nonneg_delay_conc_add:\n \"nonneg_delay_conc add\"\n unfolding add_def by auto\n\nlemma nonneg_delay_conc_add':\n \"nonneg_delay_conc ( process {A, B} : Bassign_inert C (Badd (Bsig A) (Bsig B)) 1)\"\n using nonneg_delay_conc_add unfolding add_def by auto\n\nlemma conc_wt_add:\n \"conc_wt \\ add\"\n unfolding add_def by (meson conc_wt.intros(1) seq_wt.intros(5) seq_wt_cases(4) well_typed)\n\nlemma conc_wt_add':\n \"conc_wt \\ ( process {A, B} : Bassign_inert C (Badd (Bsig A) (Bsig B)) 1)\"\n using conc_wt_add unfolding add_def by auto\n\nlemma add_conc_sim2':\n \"\\ \\\\<^sub>s \\\\tw. inv tw \\ inv2 tw\\ add \\\\tw. inv tw \\ inv2 tw\\\"\n apply (rule While_Suc)\n apply (rule Conseq'[where P=\"wp3_conc \\ add (\\tw. inv (fst tw + 1, snd tw) \\ \n inv2 (fst tw + 1, snd tw))\", rotated])\n apply (rule wp3_conc_is_pre, rule conc_stmt_wf_add, rule nonneg_delay_conc_add, rule conc_wt_add, simp)\n unfolding add_def wp3_conc_single'[OF conc_wt_add' nonneg_delay_conc_add'] wp3_fun.simps\n using inv_next_time inv2_next_time add_conc_hoare add_conc_hoare2 by presburger\n\ntext \\Initialisation preserves the invariant\\\n\nlemma nonneg_delay_add:\n \" nonneg_delay (Bassign_inert C (Badd (Bsig A) (Bsig B)) 1)\"\n using nonneg_delay_conc_add' by auto\n\nlemma init_sat_nand_inv_comb:\n \"init_sim2_hoare_wt \\ (\\tw. fst tw = 0) add (\\tw. inv tw \\ inv2 tw)\"\n unfolding add_def\n apply (rule AssignI_suc, rule SingleI)\n apply (rule Conseq3[where Q=\"\\tw. inv (fst tw + 1, snd tw) \\ inv2 (fst tw + 1, snd tw)\", rotated])\n apply (rule wp3_fun_is_pre[OF well_typed nonneg_delay_add], simp)\n unfolding wp3_fun.simps using inv_next_time inv2_next_time by blast\n\nlemma correctness:\n assumes \"sim_fin2 w (i + 1) add tw'\" and \"wityping \\ w\"\n shows \"lof_wline tw' C (i + 1) = bin_to_bl len (sbl_to_bin (lof_wline tw' A i) + sbl_to_bin (lof_wline tw' B i))\"\n using grand_correctness[OF assms conc_stmt_wf_add conc_wt_add nonneg_delay_conc_add add_conc_sim2' init_sat_nand_inv_comb]\n unfolding add_def inv_def by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n sim_fin2.cases world_maxtime_lt_fst_tres)\nend\n\nend\n", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Signed_Add_Inert_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.2815666804993119}} {"text": "(* File: Loop_Composition.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nsection \\Loop Composition\\\n\ntheory Loop_Composition\n imports \"Basic_Modules/Component_Types/Termination_Condition\"\n \"Basic_Modules/Defer_Module\"\n Sequential_Composition\nbegin\n\ntext\n\\The loop composition uses the same module in sequence,\ncombined with a termination condition, until either\n (1) the termination condition is met or\n (2) no new decisions are made (i.e., a fixed point is reached).\\\n\nsubsection \\Definition\\\n\nlemma loop_termination_helper:\n assumes \n not_term: \"\\t (acc A p vs)\" and\n subset: \"defer (acc \\ m) A p vs \\ defer acc A p vs\" and\n not_inf: \"\\infinite (defer acc A p vs)\"\n shows\n \"((acc \\ m, m, t, A, p, vs), (acc, m, t, A, p, vs)) \\\n measure (\\(acc, m, t, A, p, vs). card (defer acc A p vs))\"\n using assms psubset_card_mono\n by auto\n\n(*\n This function handles the accumulator for the following loop composition\n function.\n*)\nfunction loop_comp_helper ::\n \"'a Electoral_Module \\ 'a Electoral_Module \\\n 'a Termination_Condition \\ 'a Electoral_Module\" where\n \"t (acc A p vs) \\ \\((defer (acc \\ m) A p vs) \\ (defer acc A p vs)) \\\n infinite (defer acc A p vs) \\\n loop_comp_helper acc m t A p vs = acc A p vs\" |\n \"\\(t (acc A p vs) \\ \\((defer (acc \\ m) A p vs) \\ (defer acc A p vs)) \\\n infinite (defer acc A p vs)) \\\n loop_comp_helper acc m t A p vs = loop_comp_helper (acc \\ m) m t A p vs\"\nproof -\n fix\n P :: bool and\n x :: \"('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors\"\n assume\n a1: \"\\t acc A p vs m.\n \\t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs);\n x = (acc, m, t, A, p, vs)\\ \\ P\" and\n a2: \"\\t acc A p vs m.\n \\\\ (t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs));\n x = (acc, m, t, A, p, vs)\\ \\ P\"\n have \"\\f A p p2 g vs. (g, f, p, A, p2, vs) = x\"\n using prod_cases5\n by metis\n then show P\n using a2 a1\n by (metis (no_types))\nnext\n show\n \"\\t acc A p vs m ta acca Aa pa vsa ma.\n t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs) \\\n ta (acca Aa pa vsa) \\ \\ defer (acca \\ ma) Aa pa vsa \\ defer acca Aa pa vsa \\\n infinite (defer acca Aa pa vsa) \\\n (acc, m, t, A, p, vs) = (acca, ma, ta, Aa, pa, vsa) \\\n acc A p vs= acca Aa pa vsa\"\n by fastforce\nnext\n show\n \"\\t acc A p vs m ta acca Aa pa vsa ma.\n t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs) \\\n \\ (ta (acca Aa pa vsa) \\ \\ defer (acca \\ ma) Aa pa vsa \\ defer acca Aa pa vsa \\\n infinite (defer acca Aa pa vsa)) \\\n (acc, m, t, A, p, vs) = (acca, ma, ta, Aa, pa, vsa) \\\n acc A p vs = loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa, vsa)\"\n proof -\n fix\n t :: \"'a Termination_Condition\" and\n acc :: \"'a Electoral_Module\" and\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n vs :: \"'a Pair_Vectors\" and\n m :: \"'a Electoral_Module\" and\n ta :: \"'a Termination_Condition\" and\n acca :: \"'a Electoral_Module\" and\n Aa :: \"'a set\" and\n pa :: \"'a Profile\" and\n vsa :: \"'a Pair_Vectors\" and\n ma :: \"'a Electoral_Module\"\n assume\n a1: \"t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs)\" and\n a2: \"\\ (ta (acca Aa pa vsa) \\ \\ defer (acca \\ ma) Aa pa vsa \\ defer acca Aa pa vsa \\\n infinite (defer acca Aa pa vsa))\" and\n \"(acc, m, t, A, p, vs) = (acca, ma, ta, Aa, pa, vsa)\"\n hence False\n using a2 a1\n by force\n thus \"acc A p vs = loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa, vsa)\"\n by auto\nqed\nnext\n show\n \"\\t acc A p vs m ta acca Aa pa vsa ma.\n \\ (t (acc A p vs) \\ \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n infinite (defer acc A p vs)) \\\n \\ (ta (acca Aa pa vsa) \\ \\ defer (acca \\ ma) Aa pa vsa \\ defer acca Aa pa vsa \\\n infinite (defer acca Aa pa vsa)) \\\n (acc, m, t, A, p, vs) = (acca, ma, ta, Aa, pa, vsa) \\\n loop_comp_helper_sumC (acc \\ m, m, t, A, p, vs) =\n loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa, vsa)\"\n by force\nqed\ntermination\nproof - \n have f0:\n \"\\r. wf r \\\n (\\p f (A::'a set) prof g vs.\n p (f A prof vs) \\\n \\ defer (f \\ g) A prof vs \\ defer f A prof vs \\\n infinite (defer f A prof vs) \\\n ((f \\ g, g, p, A, prof, vs), (f, g, p, A, prof, vs)) \\ r)\"\n using loop_termination_helper wf_measure \"termination\" \n by (metis (no_types))\n hence\n \"\\r p.\n Ex ((\\ra. \\f (A::'a set) prof pa g vs.\n \\prof2 pb p_rel pc pd h (B::'a set) prof3 i pe vs1.\n \\ wf r \\\n loop_comp_helper_dom\n (p::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile \\ _ Pair_Vectors) \\\n infinite (defer f A prof vs) \\\n pa (f A prof vs) \\\n wf\n (prof2::((\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors) \\ _) set) \\\n \\ loop_comp_helper_dom (pb::\n ('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile \\ _ Pair_Vectors) \\\n wf p_rel \\ \\ defer (f \\ g) A prof vs \\ defer f A prof vs \\\n \\ loop_comp_helper_dom\n (pc::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile \\ _ Pair_Vectors) \\\n ((f \\ g, g, pa, A, prof, vs), f, g, pa, A, prof, vs) \\ p_rel \\ wf p_rel \\\n \\ loop_comp_helper_dom\n (pd::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile \\ _ Pair_Vectors) \\\n finite (defer h B prof3 vs1) \\\n defer (h \\ i) B prof3 vs1 \\ defer h B prof3 vs1\\\n \\ pe (h B prof3 vs1) \\\n ((h \\ i, i, pe, B, prof3, vs1), h, i, pe, B, prof3, vs1) \\ r)::\n ((('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors) \\\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors) set \\ bool)\"\n by metis\n obtain\n p_rel :: \"((('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors) \\\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile \\ 'a Pair_Vectors) set\" where\n \"wf p_rel \\\n (\\p f A prof g vs. p (f A prof vs) \\\n \\ defer (f \\ g) A prof vs \\ defer f A prof vs \\\n infinite (defer f A prof vs) \\\n ((f \\ g, g, p, A, prof, vs), f, g, p, A, prof, vs) \\ p_rel)\"\n using f0\n by presburger\n thus ?thesis\n using \"termination\" \n by metis\nqed\n\nlemma loop_comp_code_helper[code]:\n \"loop_comp_helper acc m t A p vs =\n (if (t (acc A p vs) \\ \\((defer (acc \\ m) A p vs) \\ (defer acc A p vs)) \\\n infinite (defer acc A p vs))\n then (acc A p vs) else (loop_comp_helper (acc \\ m) m t A p vs))\" \n by simp \n \n\nfunction loop_composition ::\n \"'a Electoral_Module \\ 'a Termination_Condition \\\n 'a Electoral_Module\" where\n \"t ({}, {}, A) \\\n loop_composition m t A p vs = defer_module A p vs\" |\n \"\\(t ({}, {}, A)) \\\n loop_composition m t A p vs = (loop_comp_helper m m t) A p vs\"\n by (fastforce, simp_all)\ntermination\n using \"termination\" wf_empty\n by blast\n\nabbreviation loop ::\n \"'a Electoral_Module \\ 'a Termination_Condition \\ 'a Electoral_Module\"\n (\"_ \\\\<^sub>_\" 50) where\n \"m \\\\<^sub>t \\ loop_composition m t\"\n\nlemma loop_comp_code[code]:\n \"loop_composition m t A p vs =\n (if (t ({},{},A))\n then (defer_module A p vs) else (loop_comp_helper m m t) A p vs)\"\n by simp\n\nlemma loop_comp_helper_imp_partit:\n assumes\n module_m: \"electoral_module m\" and\n profile: \"finite_profile A p\" and\n vectors: \"finite_pair_vectors A vs\"\n shows\n \"electoral_module acc \\ (n = card (defer acc A p vs)) \\\n well_formed A (loop_comp_helper acc m t A p vs)\"\nproof (induct arbitrary: acc rule: less_induct)\n case (less)\n have\n \"\\(f::'a set \\ 'a Profile \\ 'a Pair_Vectors \\ 'a Result) g.\n (electoral_module f \\ electoral_module g) \\\n electoral_module (f \\ g)\"\n by auto\n hence \"electoral_module (acc \\ m)\"\n using less.prems module_m\n by metis\n hence wf_acc:\n \"\\ t (acc A p vs) \\ \\ t (acc A p vs) \\\n defer (acc \\ m) A p vs \\ defer acc A p vs \\\n finite (defer acc A p vs) \\\n well_formed A (loop_comp_helper acc m t A p vs)\"\n using less.hyps less.prems loop_comp_helper.simps(2)\n psubset_card_mono\n by metis\n have \"well_formed A (acc A p vs)\"\n using electoral_module_def less.prems profile vectors\n by blast\n thus ?case\n using wf_acc loop_comp_helper.simps(1)\n by (metis (no_types))\nqed\n\nsubsection \\Soundness\\\n\ntheorem loop_comp_sound:\n assumes m_module: \"electoral_module m\"\n shows \"electoral_module (m \\\\<^sub>t)\"\n using def_mod_sound electoral_module_def loop_composition.simps(1)\n loop_composition.simps(2) loop_comp_helper_imp_partit m_module\n by metis\n\nlemma loop_comp_helper_imp_no_def_incr:\n assumes\n module_m: \"electoral_module m\"\n shows\n \"(electoral_module acc \\ n = card (defer acc A p vs)) \\\n defer (loop_comp_helper acc m t) A p vs \\ defer acc A p vs\"\nproof (induct arbitrary: acc rule: less_induct)\n case (less)\n have emod_acc_m: \"electoral_module (acc \\ m)\"\n using less.prems module_m\n by simp\n have \"\\A Aa. infinite (A::'a set) \\ \\ Aa \\ A \\ card Aa < card A\"\n using psubset_card_mono\n by metis\n hence\n \"\\ t (acc A p vs) \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n finite (defer acc A p vs) \\\n defer (loop_comp_helper (acc \\ m) m t) A p vs \\ defer acc A p vs\"\n using emod_acc_m less.hyps less.prems\n by blast\n hence\n \"\\ t (acc A p vs) \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n finite (defer acc A p vs) \\\n defer (loop_comp_helper acc m t) A p vs \\ defer acc A p vs\"\n using loop_comp_helper.simps(2)\n by (metis (no_types))\n thus ?case\n using eq_iff loop_comp_helper.simps(1)\n by (metis (no_types))\nqed\n\nsubsection \\Lemmata\\\n\nlemma loop_comp_helper_def_lift_inv_helper:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n f_prof: \"finite_profile A p\" and\n f_vec: \"finite_pair_vectors A vs\"\n shows\n \"(defer_lift_invariance acc \\ n = card (defer acc A p vs)) \\\n (\\q a.\n (a \\ (defer (loop_comp_helper acc m t) A p vs) \\ finite_pair_vectors A vs \\\n lifted A p q a) \\\n (loop_comp_helper acc m t) A p vs =\n (loop_comp_helper acc m t) A q vs)\"\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n have defer_card_comp:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n card (defer (acc \\ m) A p vs) = card (defer (acc \\ m) A q vs))\"\n using monotone_m def_lift_inv_seq_comp_help \n by metis\n have defer_card_acc:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n card (defer (acc) A p vs) = card (defer (acc) A q vs))\"\n by (smt (verit, del_insts) defer_lift_invariance_def)\n hence defer_card_acc_2:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n card (defer (acc) A p vs) = card (defer (acc) A q vs))\"\n using monotone_m f_prof defer_lift_invariance_def seq_comp_def_set_trans \n by metis\n thus ?case\n proof cases\n assume card_unchanged: \"card (defer (acc \\ m) A p vs) = card (defer acc A p vs)\"\n with defer_card_comp defer_card_acc monotone_m\n have\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n (loop_comp_helper acc m t) A q vs= acc A q vs)\"\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n def_card_eq:\n \"card (defer (acc \\ m) A p vs) = card (defer acc A p vs)\" and\n dli_acc: \"defer_lift_invariance acc\" and\n def_seq_lift_card:\n \"\\q a. a \\ defer (acc \\ m) A p vs \\ finite_pair_vectors A vs \\ Profile.lifted A p q a \\\n card (defer (acc \\ m) A p vs) = card (defer (acc \\ m) A q vs)\" and\n a_in_def_acc: \"a \\ defer acc A p vs\" and\n lifted_A: \"Profile.lifted A p q a\" \n have emod_m: \"electoral_module m\"\n using defer_lift_invariance_def monotone_m\n by auto\n have emod_acc: \"electoral_module acc\"\n using defer_lift_invariance_def dli_acc\n by blast\n have acc_eq_pq: \"acc A q vs = acc A p vs\"\n using a_in_def_acc defer_lift_invariance_def dli_acc lifted_A f_vec\n by (metis (full_types))\n with emod_acc emod_m\n have\n \"finite (defer acc A p vs) \\\n loop_comp_helper acc m t A q vs = acc A q vs\"\n using a_in_def_acc def_card_eq def_seq_lift_card\n dual_order.strict_iff_order f_prof lifted_A\n loop_comp_code_helper psubset_card_mono\n seq_comp_def_set_bounded f_vec\n by (metis (no_types))\n thus \"loop_comp_helper acc m t A q vs = acc A q vs\"\n using acc_eq_pq loop_comp_code_helper\n by (metis (full_types))\n qed\n moreover from card_unchanged have\n \"(loop_comp_helper acc m t) A p vs = acc A p vs\"\n using loop_comp_helper.simps(1) order.strict_iff_order\n psubset_card_mono\n by metis\n ultimately have\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance acc) \\\n (\\q a. (a \\ (defer (loop_comp_helper acc m t) A p vs) \\\n finite_pair_vectors A vs \\ lifted A p q a) \\\n (loop_comp_helper acc m t) A p vs =\n (loop_comp_helper acc m t) A q vs)\"\n using defer_lift_invariance_def \n by metis\n thus ?thesis\n using monotone_m seq_comp_presv_def_lift_inv \n by blast\n next\n assume card_changed:\n \"\\ (card (defer (acc \\ m) A p vs) = card (defer acc A p vs))\"\n with f_prof seq_comp_def_card_bounded have card_smaller_for_p:\n \"electoral_module (acc) \\\n (card (defer (acc \\ m) A p vs) < card (defer acc A p vs))\"\n using monotone_m order.not_eq_order_implies_strict\n defer_lift_invariance_def f_vec\n by (metis (full_types))\n with defer_card_acc_2 defer_card_comp\n have card_changed_for_q:\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n (card (defer (acc \\ m) A q vs) < card (defer acc A q vs)))\"\n using defer_lift_invariance_def\n by (metis (no_types, lifting))\n thus ?thesis\n proof cases\n assume t_not_satisfied_for_p: \"\\ t (acc A p vs)\"\n hence t_not_satisfied_for_q:\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n \\ t (acc A q vs))\"\n using monotone_m f_prof defer_lift_invariance_def seq_comp_def_set_trans \n by metis\n from card_changed defer_card_comp defer_card_acc\n have dli_card_def:\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc)) \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\\n Profile.lifted A p q a) \\\n card (defer (acc \\ m) A q vs) \\ (card (defer acc A q vs)))\"\n proof -\n have\n \"\\f.\n (defer_lift_invariance f \\\n (\\A prof prof2 (a::'a) vs.\n f A prof vs \\ f A prof2 vs \\\n Profile.lifted A prof prof2 a \\\n finite_pair_vectors A vs \\\n a \\ defer f A prof vs) \\ \\ electoral_module f) \\\n ((\\A p1 p2 b vs. f A p1 vs = f A p2 vs \\ \\ Profile.lifted A p1 p2 b \\\n \\ finite_pair_vectors A vs \\ b \\ defer f A p1 vs) \\\n electoral_module f \\ \\ defer_lift_invariance f)\"\n using defer_lift_invariance_def by blast\n thus ?thesis\n using card_changed monotone_m f_prof seq_comp_def_set_trans \n by (metis (no_types, hide_lams))\n qed\n hence dli_def_subset:\n \"defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n defer (acc \\ m) A q vs \\ defer acc A q vs)\"\n proof -\n {\n fix\n alt :: 'a and\n prof :: \"'a Profile\"\n have\n \"(\\ defer_lift_invariance (acc \\ m) \\ \\ defer_lift_invariance acc) \\\n (alt \\ defer (acc \\ m) A p vs \\ \\ finite_pair_vectors A vs \\ \\ lifted A p prof alt) \\\n defer (acc \\ m) A prof vs \\ defer acc A prof vs\"\n using Profile.lifted_def dli_card_def defer_lift_invariance_def\n monotone_m psubsetI seq_comp_def_set_bounded \n by (metis (no_types))\n }\n thus ?thesis\n by metis\n qed\n with t_not_satisfied_for_p\n have rec_step_q:\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc)) \\\n (\\q a. (a \\ (defer (acc \\ m) A p vs) \\ finite_pair_vectors A vs \\ lifted A p q a) \\\n loop_comp_helper acc m t A q vs=\n loop_comp_helper (acc \\ m) m t A q vs)\"\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n a_in_def_impl_def_subset:\n \"\\q a. a \\ defer (acc \\ m) A p vs \\ finite_pair_vectors A vs \\ lifted A p q a \\\n defer (acc \\ m) A q vs \\ defer acc A q vs\" and\n dli_acc: \"defer_lift_invariance acc\" and\n a_in_def_seq_acc_m: \"a \\ defer (acc \\ m) A p vs\" and\n lifted_pq_a: \"lifted A p q a\" and\n vec_A: \"vector_pair A vs\"\n have defer_subset_acc:\n \"defer (acc \\ m) A q vs \\ defer acc A q vs\"\n using a_in_def_impl_def_subset lifted_pq_a\n a_in_def_seq_acc_m vec_A f_prof\n by metis\n have \"electoral_module acc\"\n using dli_acc defer_lift_invariance_def\n by auto\n hence \"finite (defer acc A q vs) \\ \\ t (acc A q vs)\"\n using lifted_def dli_acc a_in_def_seq_acc_m\n lifted_pq_a def_presv_fin_prof\n t_not_satisfied_for_q vec_A f_prof \n by metis\n with defer_subset_acc\n show\n \"loop_comp_helper acc m t A q vs=\n loop_comp_helper (acc \\ m) m t A q vs\"\n using loop_comp_code_helper \n by metis\n qed\n have rec_step_p:\n \"electoral_module acc \\\n loop_comp_helper acc m t A p vs = loop_comp_helper (acc \\ m) m t A p vs\"\n proof (safe)\n assume emod_acc: \"electoral_module acc\"\n have emod_implies_defer_subset:\n \"electoral_module m \\ defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using emod_acc f_prof seq_comp_def_set_bounded f_vec\n by blast\n have card_ineq: \"card (defer (acc \\ m) A p vs) < card (defer acc A p vs)\"\n using card_smaller_for_p emod_acc\n by force\n have fin_def_limited_acc:\n \"finite_profile (defer acc A p vs) (limit_profile (defer acc A p vs) p)\"\n using def_presv_fin_prof emod_acc f_prof f_vec\n by metis\n have \"defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using emod_implies_defer_subset defer_lift_invariance_def monotone_m\n by blast\n hence \"defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using fin_def_limited_acc card_ineq card_psubset\n by metis\n with fin_def_limited_acc\n show \"loop_comp_helper acc m t A p vs = loop_comp_helper (acc \\ m) m t A p vs\"\n using loop_comp_code_helper t_not_satisfied_for_p\n by (metis (no_types))\n qed\n show ?thesis\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n dli_acc: \"defer_lift_invariance acc\" and\n n_card_acc: \"n = card (defer acc A p vs)\" and\n a_in_defer_lch: \"a \\ defer (loop_comp_helper acc m t) A p vs\" and\n a_lifted: \"Profile.lifted A p q a\"\n hence emod_acc: \"electoral_module acc\"\n using defer_lift_invariance_def\n by metis\n have \"defer_lift_invariance (acc \\ m) \\ a \\ defer (acc \\ m) A p vs\"\n using a_in_defer_lch defer_lift_invariance_def dli_acc\n f_prof loop_comp_helper_imp_no_def_incr monotone_m\n rec_step_p seq_comp_presv_def_lift_inv subsetD f_vec\n by (metis (no_types))\n with emod_acc\n show \"loop_comp_helper acc m t A p vs = loop_comp_helper acc m t A q vs\"\n using a_in_defer_lch a_lifted card_smaller_for_p dli_acc\n less.hyps n_card_acc rec_step_p rec_step_q f_vec\n by (metis (full_types))\n qed\n next\n assume \"\\ \\t (acc A p vs)\"\n with defer_lift_invariance_def\n show ?thesis\n using loop_comp_helper.simps(1) f_vec\n by metis\n qed\n qed\nqed\n\nlemma loop_comp_helper_def_lift_inv:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\" and\n profile: \"finite_profile A p\" and\n vector: \"finite_pair_vectors A vs\"\n \n shows\n \"\\q a. (lifted A p q a \\ a \\ (defer (loop_comp_helper acc m t) A p vs)) \\\n (loop_comp_helper acc m t) A p vs= (loop_comp_helper acc m t) A q vs\"\n using loop_comp_helper_def_lift_inv_helper\n monotone_m monotone_acc profile vector \n by blast\n\nlemma loop_comp_helper_def_lift_inv2:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\" and\n finite_A_p: \"finite_profile A p\" and\n lifted_A_pq: \"lifted A p q a\" and\n finite_vec: \"finite_pair_vectors A vs\" and\n a_in_defer_acc: \"a \\ defer (loop_comp_helper acc m t) A p vs\"\n shows\n \"(loop_comp_helper acc m t) A p vs = (loop_comp_helper acc m t) A q vs\"\n using finite_A_p lifted_A_pq a_in_defer_acc\n loop_comp_helper_def_lift_inv\n monotone_acc monotone_m finite_vec\n by blast\n\nlemma lifted_imp_fin_prof:\n assumes \"lifted A p q a\"\n shows \"finite_profile A p\"\n using assms Profile.lifted_def\n by fastforce\n\nlemma loop_comp_helper_presv_def_lift_inv:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\" and\n f_vec: \"finite_pair_vectors A vs\"\n shows \"defer_lift_invariance (loop_comp_helper acc m t)\"\nproof -\n have\n \"\\f. (defer_lift_invariance f \\\n (\\A prof prof2 (a::'a) vs.\n f A prof vs \\ f A prof2 vs \\\n Profile.lifted A prof prof2 a \\\n finite_pair_vectors A vs \\\n a \\ defer f A prof vs) \\\n \\ electoral_module f) \\\n ((\\A prof prof2 a vs. f A prof vs = f A prof2 vs \\\n \\ Profile.lifted A prof prof2 a \\\n \\ finite_pair_vectors A vs \\\n a \\ defer f A prof vs) \\\n electoral_module f \\ \\ defer_lift_invariance f)\"\n using defer_lift_invariance_def f_vec \n by blast\n thus ?thesis\n using electoral_module_def lifted_imp_fin_prof\n loop_comp_helper_def_lift_inv loop_comp_helper_imp_partit\n monotone_acc monotone_m f_vec defer_lift_invariance_def\n by (metis (full_types))\nqed\n\nlemma loop_comp_presv_non_electing_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n non_electing_acc: \"non_electing acc\" and\n f_prof: \"finite_profile A p\" and\n f_vec: \"finite_pair_vectors A vs\" and\n acc_defer_card: \"n = card (defer acc A p vs)\"\n shows \"elect (loop_comp_helper acc m t) A p vs = {}\"\n using acc_defer_card non_electing_acc\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n thus ?case\n proof (safe)\n fix x :: \"'a\"\n assume\n y_acc_no_elect:\n \"(\\y acc'. y < card (defer acc A p vs) \\\n y = card (defer acc' A p vs) \\ non_electing acc' \\\n elect (loop_comp_helper acc' m t) A p vs = {})\" and\n acc_non_elect:\n \"non_electing acc\" and\n x_in_acc_elect:\n \"x \\ elect (loop_comp_helper acc m t) A p vs\"\n have\n \"\\(f::'a set \\ 'a Profile \\ 'a Pair_Vectors \\ 'a Result) g.\n (non_electing f \\ non_electing g) \\\n non_electing (f \\ g)\"\n by simp\n hence seq_acc_m_non_elect: \"non_electing (acc \\ m)\"\n using acc_non_elect non_electing_m\n by blast\n have \"\\A B. (finite (A::'a set) \\ B \\ A) \\ card B < card A\"\n using psubset_card_mono\n by metis\n hence card_ineq:\n \"\\A B. (finite (A::'a set) \\ B \\ A) \\ card B < card A\"\n by presburger\n have no_elect_acc: \"elect acc A p vs = {}\"\n using acc_non_elect f_prof non_electing_def f_vec\n by blast\n have card_n_no_elect:\n \"\\n f.\n (n < card (defer acc A p vs) \\ n = card (defer f A p vs) \\ non_electing f) \\\n elect (loop_comp_helper f m t) A p vs = {}\"\n using y_acc_no_elect\n by blast\n have\n \"\\f.\n (finite (defer acc A p vs) \\ defer f A p vs \\ defer acc A p vs \\ non_electing f) \\\n elect (loop_comp_helper f m t) A p vs = {}\"\n using card_n_no_elect psubset_card_mono\n by metis\n hence f0:\n \"(\\ t (acc A p vs) \\ defer (acc \\ m) A p vs \\ defer acc A p vs \\\n finite (defer acc A p vs)) \\\n \\ t (acc A p vs) \\\n elect (loop_comp_helper acc m t) A p vs = {}\"\n using loop_comp_code_helper seq_acc_m_non_elect\n by (metis (no_types))\n obtain set_func :: \"'a set \\ 'a\" where\n \"\\A. (A = {} \\ (\\a. a \\ A)) \\ (A \\ {} \\ set_func A \\ A)\"\n using all_not_in_conv\n by (metis (no_types))\n thus \"x \\ {}\"\n using loop_comp_code_helper no_elect_acc x_in_acc_elect f0\n by (metis (no_types))\n qed\nqed\n\nlemma loop_comp_helper_iter_elim_def_n_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n f_vec: \"vector_pair A vs\" and\n n_acc_defer_card: \"n = card (defer acc A p vs)\" and\n n_ge_x: \"n \\ x\" and\n def_card_gt_one: \"card (defer acc A p vs) > 1\" and\n acc_nonelect: \"non_electing acc\"\n shows \"card (defer (loop_comp_helper acc m t) A p vs) = x\"\n using n_ge_x def_card_gt_one acc_nonelect n_acc_defer_card\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n have subset:\n \"(card (defer acc A p vs) > 1 \\ finite_profile A p \\ finite_pair_vectors A vs \n \\ electoral_module acc) \\ defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using seq_comp_elim_one_red_def_set single_elimination\n by blast\n hence step_reduces_defer_set:\n \"(card (defer acc A p vs) > 1 \\ finite_profile A p \\ finite_pair_vectors A vs \n \\ non_electing acc) \\ defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using non_electing_def\n by auto\n thus ?case\n proof cases\n assume term_satisfied: \"t (acc A p vs)\"\n have \"card (defer_r (loop_comp_helper acc m t A p vs)) = x\"\n using loop_comp_helper.simps(1) term_satisfied terminate_if_n_left\n by metis\n thus ?case\n by blast\n next\n assume term_not_satisfied: \"\\(t (acc A p vs))\"\n hence card_not_eq_x: \"card (defer acc A p vs) \\ x\"\n by (simp add: terminate_if_n_left)\n have rec_step:\n \"(card (defer acc A p vs) > 1 \\ finite_profile A p \\ finite_pair_vectors A vs \n \\ non_electing acc) \\ loop_comp_helper acc m t A p vs =\n loop_comp_helper (acc \\ m) m t A p vs\" (*needed for step*)\n using loop_comp_helper.simps(2) non_electing_def def_presv_fin_prof\n step_reduces_defer_set term_not_satisfied\n by metis\n thus ?case\n proof cases\n assume card_too_small:\n \"card (defer acc A p vs) < x\"\n thus ?thesis\n using not_le card_too_small less.prems(1) less.prems(4) not_le\n by (metis (no_types))\n next\n assume old_card_at_least_x: \"\\(card (defer acc A p vs) < x)\"\n obtain i where i_is_new_card: \"i = card (defer (acc \\ m) A p vs)\"\n by blast\n with card_not_eq_x\n have card_too_big:\n \"card (defer acc A p vs) > x\"\n using nat_neq_iff old_card_at_least_x\n by blast\n hence enough_leftover:\n \"card (defer acc A p vs) > 1\"\n using x_greater_zero\n by auto\n have \"electoral_module acc \\ (defer acc A p vs) \\ A\"\n by (simp add: defer_in_alts f_prof f_vec)\n hence step_profile:\n \"electoral_module acc \\\n finite_profile (defer acc A p vs)\n (limit_profile (defer acc A p vs) p)\"\n using f_prof limit_profile_sound\n by auto\n hence\n \"electoral_module acc \\\n card (defer m (defer acc A p vs)\n (limit_profile (defer acc A p vs) p) \n (limit_pair_vectors (defer acc A p vs) vs)) =\n card (defer acc A p vs) - 1\"\n using non_electing_m single_elimination\n single_elim_decr_def_card2 enough_leftover\n by (metis def_presv_fin_vector_pair f_prof f_vec)\n hence \"electoral_module acc \\ i = card (defer acc A p vs) - 1\"\n using sequential_composition.simps snd_conv i_is_new_card\n by metis\n hence \"electoral_module acc \\ i \\ x\"\n using card_too_big\n by linarith\n hence new_card_still_big_enough: \"electoral_module acc \\ x \\ i\"\n by blast\n have\n \"electoral_module acc \\ electoral_module m \\\n defer (acc \\ m) A p vs \\ defer acc A p vs\"\n using enough_leftover f_prof subset f_vec\n by blast\n hence\n \"electoral_module acc \\ electoral_module m \\\n i \\ card (defer acc A p vs)\"\n using card_mono i_is_new_card step_profile\n by blast\n hence i_geq_x:\n \"electoral_module acc \\ electoral_module m \\ (i = x \\ i > x)\"\n using nat_less_le new_card_still_big_enough\n by blast\n thus ?thesis\n proof cases\n assume new_card_greater_x: \"electoral_module acc \\ i > x\"\n hence \"electoral_module acc \\ 1 < card (defer (acc \\ m) A p vs)\"\n using x_greater_zero i_is_new_card\n by linarith\n moreover have new_card_still_big_enough2:\n \"electoral_module acc \\ x \\ i\" (* Needed for step *)\n using i_is_new_card new_card_still_big_enough\n by blast\n moreover have\n \"n = card (defer acc A p vs) \\\n (electoral_module acc \\ i < n)\" (* Needed for step *)\n using subset step_profile enough_leftover f_prof psubset_card_mono\n i_is_new_card f_vec\n by blast\n moreover have\n \"electoral_module acc \\\n electoral_module (acc \\ m)\" (* Needed for step *)\n using non_electing_def non_electing_m seq_comp_sound\n by blast\n moreover have non_electing_new:\n \"non_electing acc \\ non_electing (acc \\ m)\"\n by (simp add: non_electing_m)\n ultimately have card_x:\n \"(n = card (defer acc A p vs) \\ non_electing acc \\\n electoral_module acc) \\\n card (defer (loop_comp_helper (acc \\ m) m t) A p vs) = x\"\n using less.hyps i_is_new_card new_card_greater_x\n by blast\n have f1: \"loop_comp_helper acc m t A p vs = loop_comp_helper (acc \\ m) m t A p vs\"\n using enough_leftover f_prof less.prems(3) rec_step f_vec\n by blast\n have \"electoral_module acc\"\n using less.prems(3) non_electing_def\n by blast\n thus ?thesis\n using f1 card_x less.prems(3) less.prems(4)\n by presburger\n next\n assume i_not_gt_x: \"\\(electoral_module acc \\ i > x)\"\n hence \"electoral_module acc \\ electoral_module m \\ i = x\"\n using i_geq_x\n by blast\n hence \"electoral_module acc \\ electoral_module m \\ t ((acc \\ m) A p vs)\"\n using i_is_new_card terminate_if_n_left\n by blast\n hence\n \"electoral_module acc \\ electoral_module m \\\n card (defer_r (loop_comp_helper (acc \\ m) m t A p vs)) = x\"\n using loop_comp_helper.simps(1) terminate_if_n_left\n by metis\n thus ?thesis\n using i_not_gt_x dual_order.strict_iff_order i_is_new_card\n loop_comp_helper.simps(1) new_card_still_big_enough\n f_prof rec_step terminate_if_n_left\n enough_leftover less.prems(3) f_vec\n by metis\n qed\n qed\n qed\nqed\n\nlemma loop_comp_helper_iter_elim_def_n:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n f_vec: \"vector_pair A vs\" and\n acc_defers_enough: \"card (defer acc A p vs) \\ x\" and\n non_electing_acc: \"non_electing acc\"\n shows \"card (defer (loop_comp_helper acc m t) A p vs) = x\"\n using acc_defers_enough gr_implies_not0 le_neq_implies_less\n less_one linorder_neqE_nat loop_comp_helper.simps(1)\n loop_comp_helper_iter_elim_def_n_helper non_electing_acc\n non_electing_m f_prof single_elimination nat_neq_iff\n terminate_if_n_left x_greater_zero less_le f_vec\n by (metis (no_types, lifting))\n\nlemma iter_elim_def_n_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n f_vec: \"vector_pair A vs\" and\n enough_alternatives: \"card A \\ x\"\n shows \"card (defer (m \\\\<^sub>t) A p vs) = x\"\nproof cases\n assume \"card A = x\"\n thus ?thesis\n by (simp add: terminate_if_n_left)\nnext\n assume card_not_x: \"\\ card A = x\"\n thus ?thesis\n proof cases\n assume \"card A < x\"\n thus ?thesis\n using enough_alternatives not_le\n by blast\n next\n assume \"\\card A < x\"\n hence card_big_enough_A: \"card A > x\"\n using card_not_x\n by linarith\n hence card_m: \"card (defer m A p vs) = card A - 1\"\n using non_electing_m f_prof single_elimination\n single_elim_decr_def_card2 x_greater_zero f_vec\n by fastforce\n hence card_big_enough_m: \"card (defer m A p vs) \\ x\"\n using card_big_enough_A\n by linarith\n hence \"(m \\\\<^sub>t) A p vs = (loop_comp_helper m m t) A p vs\"\n by (simp add: card_not_x terminate_if_n_left)\n thus ?thesis\n using card_big_enough_m non_electing_m f_prof single_elimination\n terminate_if_n_left x_greater_zero f_vec\n loop_comp_helper_iter_elim_def_n\n by metis\n qed\nqed\n\nsubsection \\Composition Rules\\\n\n(*The loop composition preserves defer-lift-invariance.*)\ntheorem loop_comp_presv_def_lift_inv[simp]:\n assumes monotone_m: \"defer_lift_invariance m\" and\n f_vec: \"vector_pair A vs\"\n shows \"defer_lift_invariance (m \\\\<^sub>t)\"\n unfolding defer_lift_invariance_def\nproof (safe)\n from monotone_m\n have \"electoral_module m\"\n unfolding defer_lift_invariance_def\n by simp\n thus \"electoral_module (m \\\\<^sub>t)\"\n by (simp add: loop_comp_sound)\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n q :: \"'a Profile\" and\n vs :: \"'a Pair_Vectors\" and\n a :: \"'a\"\n assume\n a_in_loop_defer: \"a \\ defer (m \\\\<^sub>t) A p vs\" and\n lifted_a: \"Profile.lifted A p q a\" and\n fin_vec: \"vector_pair A vs\"\n have defer_lift_loop:\n \"\\ p q a vs. (a \\ (defer (m \\\\<^sub>t) A p vs)\\ vector_pair A vs \\ lifted A p q a) \\\n (m \\\\<^sub>t) A p vs = (m \\\\<^sub>t) A q vs\"\n using monotone_m lifted_imp_fin_prof loop_comp_helper_def_lift_inv2\n loop_composition.simps defer_module.simps\n by (metis (full_types))\n show \"(m \\\\<^sub>t) A p vs = (m \\\\<^sub>t) A q vs\"\n using a_in_loop_defer lifted_a defer_lift_loop fin_vec\n by metis\nqed\n\n(*The loop composition preserves the property non-electing.*)\ntheorem loop_comp_presv_non_electing[simp]:\n assumes non_electing_m: \"non_electing m\"\n shows \"non_electing (m \\\\<^sub>t)\"\n unfolding non_electing_def\nproof (safe, simp_all)\n show \"electoral_module (m \\\\<^sub>t)\"\n using loop_comp_sound non_electing_def non_electing_m\n by metis\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n vs :: \"'a Pair_Vectors\" and\n x :: \"'a\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\" and\n vec_A: \"vector_pair A vs\" and\n x_elect: \"x \\ elect (m \\\\<^sub>t) A p vs\"\n show \"False\"\n using def_mod_non_electing loop_comp_presv_non_electing_helper\n non_electing_m empty_iff fin_A loop_comp_code\n non_electing_def prof_A x_elect vec_A\n by metis\nqed\n\ntheorem iter_elim_def_n[simp]:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = n))\" and\n x_greater_zero: \"n > 0\"\n shows \"defers n (m \\\\<^sub>t)\"\nproof -\n have\n \"\\ A p vs. finite_profile A p \\ vector_pair A vs \\ card A \\ n \\\n card (defer (m \\\\<^sub>t) A p vs) = n\"\n using iter_elim_def_n_helper non_electing_m single_elimination\n terminate_if_n_left x_greater_zero\n by blast\n moreover have \"electoral_module (m \\\\<^sub>t)\"\n using loop_comp_sound eliminates_def single_elimination\n by blast\n thus ?thesis\n by (simp add: calculation defers_def)\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master/theories/Compositional_Structures/Loop_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.28136268373641865}} {"text": "theory Key\n imports\n \"../Fused_Resource\"\nbegin\n\n\nsection \\Key specification\\\n\nlocale ideal_key =\n fixes valid_keys :: \"'key set\"\nbegin\n\nsubsection \\Data-types for Parties, State, Events, Input, and Output\\\n\ndatatype party = Alice | Bob\n\ntype_synonym s_shell = \"party set\"\ndatatype 'key' s_kernel = PState_Store | State_Store 'key'\ntype_synonym 'key' state = \"'key' s_kernel \\ s_shell\"\n\ndatatype event = Event_Shell party | Event_Kernel\n\ndatatype iadv = Inp_Adversary\n\ndatatype iusr_alice = Inp_Alice\ndatatype iusr_bob = Inp_Bob\ntype_synonym iusr = \"iusr_alice + iusr_bob\"\n\ndatatype oadv = Out_Adversary\n\ndatatype 'key' ousr_alice = Out_Alice 'key'\ndatatype 'key' ousr_bob = Out_Bob 'key'\ntype_synonym 'key' ousr = \"'key' ousr_alice + 'key' ousr_bob\"\n\n\nsubsubsection \\Basic lemmas for automated handling of party sets (i.e. @{text s_shell})\\\n\nlemma Alice_neq_iff [simp]: \"Alice \\ x \\ x = Bob\"\n by(cases x) simp_all\n\nlemma neq_Alice_iff [simp]: \"x \\ Alice \\ x = Bob\"\n by(cases x) simp_all\n\nlemma Bob_neq_iff [simp]: \"Bob \\ x \\ x = Alice\"\n by(cases x) simp_all\n\nlemma neq_Bob_iff [simp]: \"x \\ Bob \\ x = Alice\"\n by(cases x) simp_all\n\nlemma Alice_in_iff_nonempty: \"Alice \\ A \\ A \\ {}\" if \"Bob \\ A\"\n using that by(auto)(metis (full_types) party.exhaust)\n\nlemma Bob_in_iff_nonempty: \"Bob \\ A \\ A \\ {}\" if \"Alice \\ A\"\n using that by(auto)(metis (full_types) party.exhaust)\n\n\nsubsection \\Defining the event handler\\\n\nfun poke :: \"('key state, event) handler\"\n where\n \"poke (s_kernel, parties) (Event_Shell party) = \n (if party \\ parties then \n return_pmf None\n else \n return_spmf (s_kernel, insert party parties))\"\n | \"poke (PState_Store, s_shell) (Event_Kernel) = do {\n key \\ spmf_of_set valid_keys;\n return_spmf (State_Store key, s_shell) } \"\n | \"poke _ _ = return_pmf None\"\n\nlemma in_set_spmf_poke:\n \"s' \\ set_spmf (poke s x) \\\n (\\s_kernel parties party. s = (s_kernel, parties) \\ x = Event_Shell party \\ party \\ parties \\ s' = (s_kernel, insert party parties)) \\\n (\\s_shell key. s = (PState_Store, s_shell) \\ x = Event_Kernel \\ key \\ valid_keys \\ finite valid_keys \\ s' = (State_Store key, s_shell))\"\n by(cases \"(s, x)\" rule: poke.cases)(auto simp add: set_spmf_of_set)\n\nlemma foldl_poke_invar:\n \"\\ (s_kernel', parties') \\ set_spmf (foldl_spmf poke p events); \\(s_kernel, parties)\\set_spmf p. set_s_kernel s_kernel \\ valid_keys \\\n \\ set_s_kernel s_kernel' \\ valid_keys\"\n by(induction events arbitrary: parties' rule: rev_induct)\n (auto 4 3 simp add: split_def foldl_spmf_append in_set_spmf_poke dest: bspec)\n\nsubsection \\Defining the adversary interface\\\n\nfun iface_adv :: \"('key state, iadv, oadv) oracle'\"\n where\n \"iface_adv state _ = return_spmf (Out_Adversary, state)\"\n\n\nsubsection \\Defining the user interfaces\\\n\ncontext\nbegin\n\nprivate fun iface_usr_func :: \"party \\ _ \\ _ \\ 'inp \\ ('wrap_key \\ 'key state) spmf\"\n where\n \"iface_usr_func party wrap (State_Store key, parties) inp = \n (if party \\ parties then\n return_spmf (wrap key, State_Store key, parties)\n else\n return_pmf None)\"\n | \"iface_usr_func _ _ _ _ = return_pmf None\"\n\nabbreviation iface_alice :: \"('key state, iusr_alice, 'key ousr_alice) oracle'\"\n where\n \"iface_alice \\ iface_usr_func Alice Out_Alice\"\n\nabbreviation iface_bob :: \"('key state, iusr_bob, 'key ousr_bob) oracle'\"\n where\n \"iface_bob \\ iface_usr_func Bob Out_Bob\"\n\nabbreviation iface_usr :: \"('key state, iusr, 'key ousr) oracle'\"\n where\n \"iface_usr \\ plus_oracle iface_alice iface_bob\"\n\nlemma in_set_iface_usr_func [simp]:\n \"x \\ set_spmf (iface_usr_func party wrap state inp) \\\n (\\key parties. state = (State_Store key, parties) \\ party \\ parties \\ x = (wrap key, State_Store key, parties))\"\n by(cases \"(party, wrap, state, inp)\" rule: iface_usr_func.cases) auto\n\nend\n\n\nsubsection \\Defining the Fuse Resource\\\n\nprimcorec core :: \"('key state, event, iadv, iusr, oadv,'key ousr) core\" \n where\n \"cpoke core = poke\"\n | \"cfunc_adv core = iface_adv\"\n | \"cfunc_usr core = iface_usr\"\n\nsublocale fused_resource core \"(PState_Store, {})\" .\n\n\nsubsubsection \\Lemma showing that the resulting resource is well-typed\\\n\nlemma WT_core [WT_intro]: \n \"WT_core \\_full (\\_uniform UNIV (Out_Alice ` valid_keys) \\\\<^sub>\\ \\_uniform UNIV (Out_Bob ` valid_keys))\n (pred_prod (pred_s_kernel (\\key. key \\ valid_keys)) (\\_. True)) core\"\n apply (rule WT_core.intros)\n subgoal for s e s' by(cases \"(s, e)\" rule: poke.cases)(auto split: if_split_asm simp add: set_spmf_of_set)\n by auto\n\nlemma WT_fuse [WT_intro]: \n assumes [WT_intro]: \"WT_rest \\_adv_rest \\_usr_rest I_rest rest\"\n shows \"(\\_full \\\\<^sub>\\ \\_adv_rest) \\\\<^sub>\\ ((\\_uniform UNIV (Out_Alice ` valid_keys) \\\\<^sub>\\ \\_uniform UNIV (Out_Bob ` valid_keys)) \\\\<^sub>\\ \\_usr_rest) \\res resource rest \\\"\n by(rule WT_intro)+ simp\n \nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Specifications/Key.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2813626770313686}} {"text": "header {*\\isaheader{Dependent Live Variables} *}\n\ntheory DependentLiveVariables imports DynPDG begin\n\ntext {* @{text dependent_live_vars} calculates variables which\n can change\\\\ the value of the @{term Use} variables of the target node *}\n\ncontext DynPDG begin\n\ninductive_set\n dependent_live_vars :: \"'node \\ ('var \\ 'edge list \\ 'edge list) set\"\n for n' :: \"'node\"\n where dep_vars_Use: \n \"V \\ Use n' \\ (V,[],[]) \\ dependent_live_vars n'\"\n\n | dep_vars_Cons_cdep:\n \"\\V \\ Use (sourcenode a); sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> n''; n'' -as''\\\\<^sub>d* n'\\\n \\ (V,[],a#as'@as'') \\ dependent_live_vars n'\"\n\n | dep_vars_Cons_ddep:\n \"\\(V,as',as) \\ dependent_live_vars n'; V' \\ Use (sourcenode a);\n n' = last(targetnodes (a#as));\n sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> last(targetnodes (a#as'))\\\n \\ (V',[],a#as) \\ dependent_live_vars n'\"\n\n | dep_vars_Cons_keep:\n \"\\(V,as',as) \\ dependent_live_vars n'; n' = last(targetnodes (a#as));\n \\ sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> last(targetnodes (a#as'))\\\n \\ (V,a#as',a#as) \\ dependent_live_vars n'\"\n\n\n\nlemma dependent_live_vars_fst_prefix_snd:\n \"(V,as',as) \\ dependent_live_vars n' \\ \\as''. as'@as'' = as\"\nby(induct rule:dependent_live_vars.induct,simp_all)\n\n\nlemma dependent_live_vars_Exit_empty [dest]:\n \"(V,as',as) \\ dependent_live_vars (_Exit_) \\ False\"\nproof(induct rule:dependent_live_vars.induct)\n case (dep_vars_Cons_cdep V a as' n'' as'')\n from `n'' -as''\\\\<^sub>d* (_Exit_)` have \"n'' = (_Exit_)\"\n by(fastforce intro:DynPDG_path_Exit)\n with `sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> n''` have \"sourcenode a -a#as'\\\\<^sub>d* (_Exit_)\"\n by(fastforce intro:DynPDG_path_cdep)\n hence \"sourcenode a = (_Exit_)\" by(fastforce intro:DynPDG_path_Exit)\n with `V \\ Use (sourcenode a)` show False by simp(erule Exit_Use_empty)\nqed auto\n\n\nlemma dependent_live_vars_lastnode:\n \"\\(V,as',as) \\ dependent_live_vars n'; as \\ []\\ \n \\ n' = last(targetnodes as)\"\nproof(induct rule:dependent_live_vars.induct)\n case (dep_vars_Cons_cdep V a as' n'' as'')\n from `sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> n''` have \"sourcenode a -a#as'\\* n''\"\n by(rule DynPDG_cdep_edge_CFG_path(1))\n from `n'' -as''\\\\<^sub>d* n'` have \"n'' -as''\\* n'\" by(rule DynPDG_path_CFG_path)\n show ?case\n proof(cases \"as'' = []\")\n case True\n with `n'' -as''\\* n'` have \"n'' = n'\" by (auto elim: DynPDG.dependent_live_vars.cases)\n with `sourcenode a -a#as'\\* n''` True\n show ?thesis by(fastforce intro:path_targetnode[THEN sym])\n next\n case False\n with `n'' -as''\\* n'` have \"n' = last(targetnodes as'')\"\n by(fastforce intro:path_targetnode[THEN sym])\n with False show ?thesis by(fastforce simp:targetnodes_def)\n qed\nqed simp_all\n\n\nlemma dependent_live_vars_Use_cases:\n \"\\(V,as',as) \\ dependent_live_vars n'; n -as\\* n'\\\n \\ \\nx as''. as = as'@as'' \\ n -as'\\* nx \\ nx -as''\\\\<^sub>d* n' \\ V \\ Use nx \\ \n (\\n'' \\ set (sourcenodes as'). V \\ Def n'')\"\nproof(induct arbitrary:n rule:dependent_live_vars.induct)\n case (dep_vars_Use V)\n from `n -[]\\* n'` have \"valid_node n'\" by(rule path_valid_node(2))\n hence \"n' -[]\\\\<^sub>d* n'\" by(rule DynPDG_path_Nil)\n with `V \\ Use n'` `n -[]\\* n'` show ?case \n by(auto simp:sourcenodes_def)\nnext\n case (dep_vars_Cons_cdep V a as' n'' as'' n)\n from `n -a#as'@as''\\* n'` have \"sourcenode a = n\"\n by(auto elim:path.cases)\n from `sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> n''` have \"sourcenode a -a#as'\\* n''\"\n by(rule DynPDG_cdep_edge_CFG_path(1))\n hence \"valid_edge a\" by(auto elim:path.cases) \n hence \"sourcenode a -[]\\* sourcenode a\" by(fastforce intro:empty_path)\n from `sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> n''` have \"sourcenode a -a#as'\\\\<^sub>d* n''\"\n by(rule DynPDG_path_cdep)\n with `n'' -as''\\\\<^sub>d* n'` have \"sourcenode a -(a#as')@as''\\\\<^sub>d* n'\"\n by(rule DynPDG_path_Append)\n with `sourcenode a -[]\\* sourcenode a` `V \\ Use (sourcenode a)` `sourcenode a = n`\n show ?case by(auto simp:sourcenodes_def)\nnext\n case(dep_vars_Cons_ddep V as' as V' a n)\n note ddep = `sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> last (targetnodes (a#as'))`\n note IH = `\\n. n -as\\* n'\n \\ \\nx as''. as = as'@as'' \\ n -as'\\* nx \\ nx -as''\\\\<^sub>d* n' \\ \n V \\ Use nx \\ (\\n''\\set (sourcenodes as'). V \\ Def n'')`\n from `n -a#as\\* n'` have \"n -[]@a#as\\* n'\" by simp\n hence \"n = sourcenode a\" and \"targetnode a -as\\* n'\" and \"valid_edge a\"\n by(fastforce dest:path_split)+\n hence \"n -[]\\* n\" \n by(fastforce intro:empty_path simp:valid_node_def)\n from IH[OF `targetnode a -as\\* n'`]\n have \"\\nx as''. as = as'@as'' \\ targetnode a -as'\\* nx \\ nx -as''\\\\<^sub>d* n' \\ \n V \\ Use nx \\ (\\n''\\set (sourcenodes as'). V \\ Def n'')\" .\n then obtain nx'' as'' where \"targetnode a -as'\\* nx''\"\n and \"nx'' -as''\\\\<^sub>d* n'\" and \"as = as'@as''\" by blast\n have \"last (targetnodes (a#as')) -as''\\\\<^sub>d* n'\"\n proof(cases as')\n case Nil\n with `targetnode a -as'\\* nx''` have \"nx'' = targetnode a\"\n by(auto elim:path.cases)\n with `nx'' -as''\\\\<^sub>d* n'` Nil show ?thesis by(simp add:targetnodes_def)\n next\n case (Cons ax asx)\n hence \"last (targetnodes (a#as')) = last (targetnodes as')\"\n by(simp add:targetnodes_def)\n from Cons `targetnode a -as'\\* nx''` have \"last (targetnodes as') = nx''\"\n by(fastforce intro:path_targetnode)\n with `last (targetnodes (a#as')) = last (targetnodes as')` `nx'' -as''\\\\<^sub>d* n'`\n show ?thesis by simp\n qed\n with ddep `as = as'@as''` have \"sourcenode a -a#as\\\\<^sub>d* n'\"\n by(fastforce dest:DynPDG_path_ddep DynPDG_path_Append)\n with `V' \\ Use (sourcenode a)` `n = sourcenode a` `n -[]\\* n`\n show ?case by(auto simp:sourcenodes_def)\nnext\n case (dep_vars_Cons_keep V as' as a n)\n note no_dep = `\\ sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> last (targetnodes (a#as'))`\n note IH = `\\n. n -as\\* n'\n \\ \\nx as''. (as = as'@as'') \\ (n -as'\\* nx) \\ (nx -as''\\\\<^sub>d* n') \\ \n V \\ Use nx \\ (\\n''\\set (sourcenodes as'). V \\ Def n'')`\n from `n -a#as\\* n'` have \"n = sourcenode a\" and \"valid_edge a\"\n and \"targetnode a -as\\* n'\" by(auto elim:path_split_Cons)\n from IH[OF `targetnode a -as\\* n'`]\n have \"\\nx as''. as = as'@as'' \\ targetnode a -as'\\* nx \\ nx -as''\\\\<^sub>d* n' \\ \n V \\ Use nx \\ (\\n''\\set (sourcenodes as'). V \\ Def n'')\" .\n then obtain nx'' as'' where \"V \\ Use nx''\"\n and \"\\n''\\set (sourcenodes as'). V \\ Def n''\" and \"targetnode a -as'\\* nx''\"\n and \"nx'' -as''\\\\<^sub>d* n'\" and \"as = as'@as''\" by blast\n from `valid_edge a` `targetnode a -as'\\* nx''` have \"sourcenode a -a#as'\\* nx''\"\n by(fastforce intro:Cons_path)\n hence \"last(targetnodes (a#as')) = nx''\" by(fastforce dest:path_targetnode)\n { assume \"V \\ Def (sourcenode a)\"\n with `V \\ Use nx''` `sourcenode a -a#as'\\* nx''`\n `\\n''\\set (sourcenodes as'). V \\ Def n''` \n have \"(sourcenode a) influences V in nx'' via a#as'\"\n by(simp add:dyn_data_dependence_def sourcenodes_def)\n with no_dep `last(targetnodes (a#as')) = nx''`\n `\\n''\\set (sourcenodes as'). V \\ Def n''` `V \\ Def (sourcenode a)`\n have False by(fastforce dest:DynPDG_ddep_edge) }\n with `\\n''\\set (sourcenodes as'). V \\ Def n''` \n have \"\\n''\\set (sourcenodes (a#as')). V \\ Def n''\"\n by(fastforce simp:sourcenodes_def)\n with `V \\ Use nx''` `sourcenode a -a#as'\\* nx''` `nx'' -as''\\\\<^sub>d* n'`\n `as = as'@as''` `n = sourcenode a` show ?case by fastforce\nqed\n\n\nlemma dependent_live_vars_dependent_edge:\n assumes \"(V,as',as) \\ dependent_live_vars n'\" \n and \"targetnode a -as\\* n'\"\n and \"V \\ Def (sourcenode a)\" and \"valid_edge a\"\n obtains nx as'' where \"as = as'@as''\" and \"sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> nx\"\n and \"nx -as''\\\\<^sub>d* n'\"\nproof(atomize_elim)\n from `(V,as',as) \\ dependent_live_vars n'` `targetnode a -as\\* n'`\n have \"\\nx as''. as = as'@as'' \\ targetnode a -as'\\* nx \\ nx -as''\\\\<^sub>d* n' \\ \n V \\ Use nx \\ (\\n'' \\ set (sourcenodes as'). V \\ Def n'')\"\n by(rule dependent_live_vars_Use_cases)\n then obtain nx as'' where \"V \\ Use nx\"\n and \"\\n''\\ set(sourcenodes as'). V \\ Def n''\"\n and \"targetnode a -as'\\* nx\" and \"nx -as''\\\\<^sub>d* n'\"\n and \"as = as'@as''\" by blast\n from `targetnode a -as'\\* nx` `valid_edge a` have \"sourcenode a -a#as'\\* nx\"\n by(fastforce intro:Cons_path)\n with `V \\ Def (sourcenode a)` `V \\ Use nx` \n `\\n''\\ set(sourcenodes as'). V \\ Def n''` \n have \"sourcenode a influences V in nx via a#as'\"\n by(auto simp:dyn_data_dependence_def sourcenodes_def)\n hence \"sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> nx\" by(rule DynPDG_ddep_edge)\n with `nx -as''\\\\<^sub>d* n'` `as = as'@as''` \n show \"\\as'' nx. (as = as'@as'') \\ (sourcenode a -{V}a#as'\\\\<^bsub>dd\\<^esub> nx) \\ \n (nx -as''\\\\<^sub>d* n')\" by fastforce\nqed\n\n\n\nlemma dependent_live_vars_same_pathsI:\n assumes \"V \\ Use n'\"\n shows \"\\\\as' a as''. as = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'; \n as \\ [] \\ n' = last(targetnodes as)\\\n \\ (V,as,as) \\ dependent_live_vars n'\"\nproof(induct as)\n case Nil\n from `V \\ Use n'` show ?case by(rule dep_vars_Use)\nnext\n case (Cons ax asx)\n note lastnode = `ax#asx \\ [] \\ n' = last (targetnodes (ax#asx))`\n note IH = `\\\\as' a as''. asx = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n';\n asx \\ [] \\ n' = last (targetnodes asx)\\\n \\ (V, asx, asx) \\ dependent_live_vars n'`\n from `\\as' a as''. ax#asx = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'`\n have all':\"\\as' a as''. asx = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n and \"\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> n'\"\n by simp_all\n show ?case\n proof(cases \"asx = []\")\n case True\n from `V \\ Use n'` have \"(V,[],[]) \\ dependent_live_vars n'\" by(rule dep_vars_Use)\n with `\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> n'` True lastnode\n have \"(V,[ax],[ax]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with True show ?thesis by simp\n next\n case False\n with lastnode have \"asx \\ [] \\ n' = last (targetnodes asx)\"\n by(simp add:targetnodes_def)\n from IH[OF all' this] have \"(V, asx, asx) \\ dependent_live_vars n'\" .\n with `\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> n'` lastnode \n show ?thesis by(fastforce intro:dep_vars_Cons_keep)\n qed\nqed\n\n\nlemma dependent_live_vars_same_pathsD:\n \"\\(V,as,as) \\ dependent_live_vars n'; as \\ [] \\ n' = last(targetnodes as)\\\n \\ V \\ Use n' \\ (\\as' a as''. as = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n')\"\nproof(induct as)\n case Nil\n have \"(V,[],[]) \\ dependent_live_vars n'\" by fact\n thus ?case\n by(fastforce elim:dependent_live_vars.cases simp:targetnodes_def sourcenodes_def)\nnext\n case (Cons ax asx)\n note IH = `\\(V,asx,asx) \\ dependent_live_vars n'; \n asx \\ [] \\ n' = last (targetnodes asx)\\\n \\ V \\ Use n' \\ (\\as' a as''. asx = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n')`\n from `(V,ax#asx,ax#asx) \\ dependent_live_vars n'`\n have \"(V,asx,asx) \\ dependent_live_vars n'\"\n and \"\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx))\"\n by(auto elim:dependent_live_vars.cases)\n from `ax#asx \\ [] \\ n' = last (targetnodes (ax#asx))`\n have \"n' = last (targetnodes (ax#asx))\" by simp\n show ?case\n proof(cases \"asx = []\")\n case True\n with `(V,asx,asx) \\ dependent_live_vars n'` have \"V \\ Use n'\"\n by(fastforce elim:dependent_live_vars.cases)\n from `\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx))` \n True `n' = last (targetnodes (ax#asx))`\n have \"\\as' a as''. ax#asx = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n by auto(case_tac as',auto)\n with `V \\ Use n'` show ?thesis by simp\n next\n case False\n with `n' = last (targetnodes (ax#asx))`\n have \"asx \\ [] \\ n' = last (targetnodes asx)\"\n by(simp add:targetnodes_def)\n from IH[OF `(V,asx,asx) \\ dependent_live_vars n'` this] \n have \"V \\ Use n' \\ (\\as' a as''. asx = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n')\" .\n with `\\ sourcenode ax -{V}ax#asx\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx))`\n `n' = last (targetnodes (ax#asx))` have \"V \\ Use n'\"\n and \"\\as' a as''. ax#asx = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n by auto(case_tac as',auto)\n thus ?thesis by simp\n qed\nqed\n\n\nlemma dependent_live_vars_same_paths:\n \"as \\ [] \\ n' = last(targetnodes as) \\\n (V,as,as) \\ dependent_live_vars n' = \n (V \\ Use n' \\ (\\as' a as''. as = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'))\"\nby(fastforce intro!:dependent_live_vars_same_pathsD dependent_live_vars_same_pathsI)\n\n\nlemma dependent_live_vars_cdep_empty_fst:\nassumes \"n'' -as\\\\<^bsub>cd\\<^esub> n'\" and \"V' \\ Use n''\"\n shows \"(V',[],as) \\ dependent_live_vars n'\"\nproof(cases as)\n case Nil\n with `n'' -as\\\\<^bsub>cd\\<^esub> n'` show ?thesis\n by(fastforce elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\nnext\n case (Cons ax asx)\n with `n'' -as\\\\<^bsub>cd\\<^esub> n'` have \"sourcenode ax = n''\"\n by(auto dest:DynPDG_cdep_edge_CFG_path elim:path.cases)\n from `n'' -as\\\\<^bsub>cd\\<^esub> n'` have \"valid_node n'\"\n by(fastforce intro:path_valid_node(2) DynPDG_cdep_edge_CFG_path(1))\n from Cons `n'' -as\\\\<^bsub>cd\\<^esub> n'` have \"last(targetnodes as) = n'\"\n by(fastforce intro:path_targetnode dest:DynPDG_cdep_edge_CFG_path)\n with Cons `n'' -as\\\\<^bsub>cd\\<^esub> n'` `V' \\ Use n''` `sourcenode ax = n''` `valid_node n'`\n have \"(V', [], ax#asx@[]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_cdep DynPDG_path_Nil)\n with Cons show ?thesis by simp\nqed\n \n\nlemma dependent_live_vars_ddep_empty_fst:\n assumes \"n'' -{V}as\\\\<^bsub>dd\\<^esub> n'\" and \"V' \\ Use n''\"\n shows \"(V',[],as) \\ dependent_live_vars n'\"\nproof(cases as)\n case Nil\n with `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` show ?thesis\n by(fastforce elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\nnext\n case (Cons ax asx)\n with `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` have \"sourcenode ax = n''\"\n by(auto dest:DynPDG_ddep_edge_CFG_path elim:path.cases)\n from Cons `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` have \"last(targetnodes as) = n'\"\n by(fastforce intro:path_targetnode elim:DynPDG_ddep_edge_CFG_path(1))\n from Cons `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` have all:\"\\as' a as''. asx = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n by(fastforce dest:DynPDG_ddep_edge_no_shorter_ddep_edge)\n from `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` have \"V \\ Use n'\" \n by(auto elim!:DynPDG_edge.cases simp:dyn_data_dependence_def)\n from Cons `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` have \"as \\ [] \\ n' = last(targetnodes as)\"\n by(fastforce dest:DynPDG_ddep_edge_CFG_path path_targetnode)\n with Cons have \"asx \\ [] \\ n' = last(targetnodes asx)\"\n by(fastforce simp:targetnodes_def)\n with all `V \\ Use n'` have \"(V,asx,asx) \\ dependent_live_vars n'\"\n by -(rule dependent_live_vars_same_pathsI)\n with `V' \\ Use n''` `n'' -{V}as\\\\<^bsub>dd\\<^esub> n'` `last(targetnodes as) = n'`\n Cons `sourcenode ax = n''` show ?thesis\n by(fastforce intro:dep_vars_Cons_ddep)\nqed\n\n\n\n\nlemma ddep_dependent_live_vars_keep_notempty:\n assumes \"n -{V}a#as\\\\<^bsub>dd\\<^esub> n''\" and \"as' \\ []\"\n and \"(V,as'',as') \\ dependent_live_vars n'\"\n shows \"(V,as@as'',as@as') \\ dependent_live_vars n'\"\nproof -\n from `n -{V}a#as\\\\<^bsub>dd\\<^esub> n''` have \"\\n'' \\ set (sourcenodes as). V \\ Def n''\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with `(V,as'',as') \\ dependent_live_vars n'` show ?thesis\n proof(induct as)\n case Nil thus ?case by simp\n next\n case (Cons ax asx)\n note IH = `\\(V,as'',as') \\ dependent_live_vars n';\n \\n''\\set (sourcenodes asx). V \\ Def n''\\\n \\ (V, asx@as'',asx@as') \\ dependent_live_vars n'`\n from `\\n''\\set (sourcenodes (ax#asx)). V \\ Def n''`\n have \"\\n''\\set (sourcenodes asx). V \\ Def n''\"\n by(auto simp:sourcenodes_def)\n from IH[OF `(V,as'',as') \\ dependent_live_vars n'` this]\n have \"(V,asx@as'',asx@as') \\ dependent_live_vars n'\" .\n from `as' \\ []` `(V,as'',as') \\ dependent_live_vars n'`\n have \"n' = last(targetnodes as')\" \n by(fastforce intro:dependent_live_vars_lastnode)\n with `as' \\ []` have \"n' = last(targetnodes (ax#asx@as'))\"\n by(fastforce simp:targetnodes_def)\n have \"\\ sourcenode ax -{V}ax#asx@as''\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx@as''))\"\n proof\n assume \"sourcenode ax -{V}ax#asx@as''\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx@as''))\"\n hence \"sourcenode ax -{V}ax#asx@as''\\\\<^bsub>dd\\<^esub> last(targetnodes (ax#asx@as''))\"\n by simp\n with `\\n''\\set (sourcenodes (ax#asx)). V \\ Def n''`\n show False\n by(fastforce elim:DynPDG_edge.cases \n simp:dyn_data_dependence_def sourcenodes_def)\n qed\n with `(V,asx@as'',asx@as') \\ dependent_live_vars n'` \n `n' = last(targetnodes (ax#asx@as'))`\n show ?case by(fastforce intro:dep_vars_Cons_keep)\n qed\nqed\n\n\n\nlemma dependent_live_vars_cdep_dependent_live_vars:\n assumes \"n'' -as''\\\\<^bsub>cd\\<^esub> n'\" and \"(V',as',as) \\ dependent_live_vars n''\"\n shows \"(V',as',as@as'') \\ dependent_live_vars n'\"\nproof -\n from `n'' -as''\\\\<^bsub>cd\\<^esub> n'` have \"as'' \\ []\"\n by(fastforce elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n with `n'' -as''\\\\<^bsub>cd\\<^esub> n'` have \"last(targetnodes as'') = n'\"\n by(fastforce intro:path_targetnode elim:DynPDG_cdep_edge_CFG_path(1))\n from `(V',as',as) \\ dependent_live_vars n''` show ?thesis\n proof(induct rule:dependent_live_vars.induct)\n case (dep_vars_Use V')\n from `V' \\ Use n''` `n'' -as''\\\\<^bsub>cd\\<^esub> n'` `last(targetnodes as'') = n'` show ?case\n by(fastforce intro:dependent_live_vars_cdep_empty_fst simp:targetnodes_def)\n next\n case (dep_vars_Cons_cdep V a as' nx asx)\n from `n'' -as''\\\\<^bsub>cd\\<^esub> n'` have \"n'' -as''\\\\<^sub>d* n'\" by(rule DynPDG_path_cdep)\n with `nx -asx\\\\<^sub>d* n''` have \"nx -asx@as''\\\\<^sub>d* n'\"\n by -(rule DynPDG_path_Append)\n with `V \\ Use (sourcenode a)` `(sourcenode a) -a#as'\\\\<^bsub>cd\\<^esub> nx`\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_cdep)\n next\n case (dep_vars_Cons_ddep V as' as V' a)\n from `as'' \\ []` `last(targetnodes as'') = n'`\n have \"n' = last(targetnodes ((a#as)@as''))\"\n by(simp add:targetnodes_def)\n with dep_vars_Cons_ddep\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_ddep)\n next\n case (dep_vars_Cons_keep V as' as a)\n from `as'' \\ []` `last(targetnodes as'') = n'`\n have \"n' = last(targetnodes ((a#as)@as''))\"\n by(simp add:targetnodes_def)\n with dep_vars_Cons_keep\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_keep)\n qed\nqed\n\n\nlemma dependent_live_vars_ddep_dependent_live_vars:\n assumes \"n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'\" and \"(V',as',as) \\ dependent_live_vars n''\"\n shows \"(V',as',as@as'') \\ dependent_live_vars n'\"\nproof -\n from `n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'` have \"as'' \\ []\"\n by(rule DynPDG_ddep_edge_CFG_path(2))\n with `n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'` have \"last(targetnodes as'') = n'\"\n by(fastforce intro:path_targetnode elim:DynPDG_ddep_edge_CFG_path(1))\n from `n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'` have notExit:\"n' \\ (_Exit_)\" \n by(fastforce elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n from `(V',as',as) \\ dependent_live_vars n''` show ?thesis\n proof(induct rule:dependent_live_vars.induct)\n case (dep_vars_Use V')\n from `V' \\ Use n''` `n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'` `last(targetnodes as'') = n'` show ?case\n by(fastforce intro:dependent_live_vars_ddep_empty_fst simp:targetnodes_def)\n next\n case (dep_vars_Cons_cdep V' a as' nx asx)\n from `n'' -{V}as''\\\\<^bsub>dd\\<^esub> n'` have \"n'' -as''\\\\<^sub>d* n'\" by(rule DynPDG_path_ddep)\n with `nx -asx\\\\<^sub>d* n''` have \"nx -asx@as''\\\\<^sub>d* n'\"\n by -(rule DynPDG_path_Append)\n with `V' \\ Use (sourcenode a)` `sourcenode a -a#as'\\\\<^bsub>cd\\<^esub> nx` notExit\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_cdep)\n next\n case (dep_vars_Cons_ddep V as' as V' a)\n from `as'' \\ []` `last(targetnodes as'') = n'`\n have \"n' = last(targetnodes ((a#as)@as''))\"\n by(simp add:targetnodes_def)\n with dep_vars_Cons_ddep\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_ddep)\n next\n case (dep_vars_Cons_keep V as' as a)\n from `as'' \\ []` `last(targetnodes as'') = n'`\n have \"n' = last(targetnodes ((a#as)@as''))\"\n by(simp add:targetnodes_def)\n with dep_vars_Cons_keep\n show ?case by(fastforce intro:dependent_live_vars.dep_vars_Cons_keep)\n qed\nqed\n\n\nlemma dependent_live_vars_dep_dependent_live_vars:\n \"\\n'' -as''\\\\<^sub>d* n'; (V',as',as) \\ dependent_live_vars n''\\\n \\ (V',as',as@as'') \\ dependent_live_vars n'\"\nproof(induct rule:DynPDG_path.induct)\n case (DynPDG_path_Nil n) thus ?case by simp\nnext\n case (DynPDG_path_Append_cdep n asx n'' asx' n')\n note IH = `(V', as', as) \\ dependent_live_vars n \\\n (V', as', as @ asx) \\ dependent_live_vars n''`\n from IH[OF `(V',as',as) \\ dependent_live_vars n`]\n have \"(V',as',as@asx) \\ dependent_live_vars n''\" .\n with `n'' -asx'\\\\<^bsub>cd\\<^esub> n'` have \"(V',as',(as@asx)@asx') \\ dependent_live_vars n'\"\n by(rule dependent_live_vars_cdep_dependent_live_vars)\n thus ?case by simp\nnext\n case (DynPDG_path_Append_ddep n asx n'' V asx' n')\n note IH = `(V', as', as) \\ dependent_live_vars n \\\n (V', as', as @ asx) \\ dependent_live_vars n''`\n from IH[OF `(V',as',as) \\ dependent_live_vars n`]\n have \"(V',as',as@asx) \\ dependent_live_vars n''\" .\n with `n'' -{V}asx'\\\\<^bsub>dd\\<^esub> n'` have \"(V',as',(as@asx)@asx') \\ dependent_live_vars n'\"\n by(rule dependent_live_vars_ddep_dependent_live_vars)\n thus ?case by simp\nqed\n\nend\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/Dynamic/DependentLiveVariables.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2813626770313686}} {"text": "header {* ICF-setup for Automatic Refinement *}\ntheory ICF_Autoref\nimports \n ICF_Refine_Monadic \n \"../GenCF/Intf/Intf_Set\"\n \"../GenCF/Intf/Intf_Map\"\nbegin\n\nsubsection {* Unique Priority Queue *}\nconsts i_prio :: \"interface \\ interface \\ interface\"\ndefinition [simp]: \"op_uprio_empty \\ Map.empty\"\ndefinition [simp]: \"op_uprio_is_empty x \\ x = Map.empty\"\ndefinition [simp]: \"op_uprio_insert s e a \\ s(e \\ a)\"\ndefinition op_uprio_prio :: \"('e\\'a)\\'e\\'a\"\n where [simp]: \"op_uprio_prio s e \\ s e\"\n\n(* FIXME: Tune id-op phase such that it can distinguish those patterns!\n For now: Only include this patterns on demand!\n*)\ncontext begin interpretation autoref_syn .\n\nlemma uprio_pats:\n fixes s :: \"'e\\'a\"\n shows\n \"Map.empty::'e\\'a \\ op_uprio_empty\"\n \"s e \\ op_uprio_prio$s$e\"\n \"s(e\\a) \\ op_uprio_insert$s$e$a\"\n\n \"dom s = {} \\ op_uprio_is_empty$s\"\n \"{} = dom s \\ op_uprio_is_empty$s\"\n \"s=Map.empty \\ op_uprio_is_empty$s\"\n \"Map.empty=s \\ op_uprio_is_empty$s\"\n by (auto intro!: eq_reflection)\n\nend\n\nterm prio_pop_min\n\nlemma [autoref_itype]:\n \"op_uprio_empty ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio\"\n \"op_uprio_prio ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i Ie \\\\<^sub>i \\Ia\\\\<^sub>ii_option\"\n \"op_uprio_is_empty ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i i_bool\"\n \"op_uprio_insert ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i Ie \\\\<^sub>i Ia \\\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio\"\n \"prio_pop_min ::\\<^sub>i \\Ie,Ia\\\\<^sub>ii_prio \\\\<^sub>i \\\\Ie,\\Ia,\\Ie,Ia\\\\<^sub>ii_prio\\\\<^sub>ii_prod\\\\<^sub>ii_prod\\\\<^sub>ii_nres\"\n by simp_all\n\ncontext uprio begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\"\n lemma rel_def:\n \"\\Re,Ra\\rel \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n \n\n lemma rel_sv[relator_props]: \n \"\\Range Re = UNIV; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by tagged_solver\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_prio]\nend\n\n\nlemma (in uprio) rel_alt: \"\\Id,Rv\\rel = \n { (c,a). \\x. (\\ c x,a x)\\\\Rv\\option_rel \\ invar c }\"\n by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in uprio_empty) autoref_empty[autoref_rules]:\n \"PREFER_id Re \\ (empty (),op_uprio_empty)\\\\Re,Ra\\rel\"\n by (auto simp: empty_correct rel_alt)\n\nlemma (in uprio_isEmpty) autoref_is_empty[autoref_rules]:\n \"PREFER_id Re \\ (isEmpty,op_uprio_is_empty)\\\\Re,Ra\\rel\\bool_rel\"\n by (auto simp: isEmpty_correct rel_alt intro!: ext)\n\nlemma (in uprio_prio) autoref_prio[autoref_rules]:\n \"PREFER_id Re \\ (prio,op_uprio_prio)\\\\Re,Ra\\rel\\Re\\\\Ra\\option_rel\"\n by (auto simp: prio_correct rel_alt intro!: ext)\n\nlemma (in uprio_insert) autoref_insert[autoref_rules]:\n \"PREFER_id Re \\ (insert,op_uprio_insert)\\\\Re,Ra\\rel\\Re\\Ra\\\\Re,Ra\\rel\"\n by (auto simp: insert_correct rel_alt intro!: ext)\n\nlemma (in uprio_pop) autoref_prio_pop_min[autoref_rules]:\n \"\\PREFER_id Re; PREFER_id Ra \\ \n \\ (\\s. RETURN (pop s),prio_pop_min)\\\\Re,Ra\\rel\\\\\\Re,\\Ra,\\Re,Ra\\rel\\prod_rel\\prod_rel\\nres_rel\"\n apply simp\n apply (intro fun_relI nres_relI)\n by (rule prio_pop_min_refine)\n\n\n\n\ncontext set begin\n definition rel_def_internal: \"rel R \\ br \\ invar O \\R\\set_rel\"\n lemma rel_def: \"\\R\\rel \\ br \\ invar O \\R\\set_rel\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id\\rel = br \\ invar\" by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \"single_valued R \\ single_valued (\\R\\rel)\"\n unfolding rel_def by tagged_solver\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_set]\n\nend\n\ncontext map begin\n definition rel_def_internal: \n \"rel Rk Rv \\ br \\ invar O (Rk \\ \\Rv\\ option_rel)\"\n lemma rel_def: \n \"\\Rk,Rv\\rel \\ br \\ invar O (Rk \\ \\Rv\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\Range Rk = UNIV; single_valued Rv\\ \\ single_valued (\\Rk,Rv\\rel)\"\n unfolding rel_def \n by (tagged_solver (trace))\n\n lemmas [autoref_rel_intf] = REL_INTFI[of rel i_map]\n\nend\n\n\n(*\ncontext list begin\n definition rel_def_internal: \n \"rel R \\ br \\ invar O R\"\n lemma rel_def: \"\\R\\rel \\ br \\ invar O R\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \"single_valued R \\ single_valued (\\R\\rel)\"\n unfolding rel_def by refine_post\nend\n\ncontext al begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O \\\\Re,Ra\\ prod_rel\\list_rel\"\n lemma rel_def: \n \"\\Re,Ra\\rel \\ br \\ invar O \\\\Re,Ra\\ prod_rel\\list_rel\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\single_valued Re; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by refine_post\n\nend\n\ncontext prio begin\n (* TODO: Fix that to use multiset_rel! *)\n definition rel_def[simp]: \"rel \\ br \\ invar\"\n lemma rel_sv: \"single_valued rel\" unfolding rel_def by refine_post\nend\n\ncontext uprio begin\n definition rel_def_internal: \n \"rel Re Ra \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\"\n lemma rel_def:\n \"\\Re,Ra\\rel \\ br \\ invar O (Re \\ \\Ra\\ option_rel)\" \n by (simp add: rel_def_internal relAPP_def)\n \n lemma rel_id[simp]: \"\\Id,Id\\rel = br \\ invar\" \n by (simp add: rel_def)\n\n lemma rel_sv[relator_props]: \n \"\\Range Re = UNIV; single_valued Ra\\ \\ single_valued (\\Re,Ra\\rel)\"\n unfolding rel_def by refine_post\n\nend\n*)\n\n\nsetup {* Revert_Abbrev.revert_abbrev \"Autoref_Binding_ICF.*.rel\" *}\n\n\n\n\n(* TODO: Move *)\nlemma Collect_x_x_pairs_rel_image[simp]: \"{p. \\x. p = (x, x)}``x = x\" \n by auto\n\n\nsubsection \"Set\"\n\nlemma (in set_empty) empty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (empty (), {}) \\ \\Rk\\rel\"\n by (simp add: br_def empty_correct)\n\nlemma (in set_memb) memb_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (memb,op \\)\\Rk\\\\Rk\\rel\\Id\"\n apply simp\n by (auto simp add: memb_correct br_def)\n\nlemma (in set_ins) ins_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (ins,Set.insert)\\Rk\\\\Rk\\rel\\\\Rk\\rel\"\n by simp (auto simp add: ins_correct br_def)\n\ncontext set_ins_dj begin\ncontext begin interpretation autoref_syn .\nlemma ins_dj_autoref[autoref_rules]: \n assumes \"SIDE_PRECOND_OPT (x'\\s')\"\n assumes \"PREFER_id Rk\"\n assumes \"(x,x')\\Rk\"\n assumes \"(s,s')\\\\Rk\\rel\"\n shows \"(ins_dj x s,(OP Set.insert ::: Rk \\ \\Rk\\rel \\ \\Rk\\rel)$x'$s')\\\\Rk\\rel\"\n using assms \n apply simp\n apply (auto simp add: ins_dj_correct br_def)\n done\nend\nend\n\nlemma (in set_delete) delete_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (delete,op_set_delete)\\Rk\\\\Rk\\rel\\\\Rk\\rel\"\n by simp (auto simp add: delete_correct op_set_delete_def br_def)\n \nlemma (in set_isEmpty) isEmpty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isEmpty,op_set_isEmpty) \\ \\Rk\\rel\\Id\"\n apply (simp add: br_def)\n apply (fastforce simp: isEmpty_correct)\n done\n\nlemma (in set_isSng) isSng_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isSng,op_set_isSng) \\ \\Rk\\rel\\Id\"\n by simp\n (auto simp add: isSng_correct op_set_isSng_def br_def card_Suc_eq)\n\nlemma (in set_ball) ball_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (ball,Set.Ball) \\ \\Rk\\rel\\(Rk\\Id)\\Id\"\n by simp (auto simp add: ball_correct fun_rel_def br_def)\n\nlemma (in set_bex) bex_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (bex,Set.Bex) \\ \\Rk\\rel\\(Rk\\Id)\\Id\"\n apply simp\n apply (auto simp: bex_correct fun_rel_def br_def intro!: ext)\n done\n\nlemma (in set_size) size_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (size,card) \\ \\Rk\\rel \\ Id\"\n by simp (auto simp add: size_correct br_def)\n\nlemma (in set_size_abort) size_abort_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (size_abort,op_set_size_abort) \\ Id \\ \\Rk\\rel \\ Id\"\n by simp\n (auto simp add: size_abort_correct op_set_size_abort_def br_def)\n\nlemma (in set_union) union_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (union,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s3.rel\"\n by simp (auto simp add: union_correct br_def)\n\ncontext set_union_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma union_dj_autoref[autoref_rules]:\n assumes \"PREFER_id Rk\"\n assumes \"SIDE_PRECOND_OPT (a'\\b'={})\"\n assumes \"(a,a')\\\\Rk\\s1.rel\"\n assumes \"(b,b')\\\\Rk\\s2.rel\"\n shows \"(union_dj a b,(OP op \\ ::: \\Rk\\s1.rel \\ \\Rk\\s2.rel \\ \\Rk\\s3.rel)$a'$b')\n \\\\Rk\\s3.rel\"\n using assms \n by simp (auto simp: union_dj_correct br_def)\nend \nend\n\nlemma (in set_diff) diff_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (diff,op -)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s1.rel\"\n by simp (auto simp add: diff_correct br_def)\n\nlemma (in set_filter) filter_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (filter,op_set_filter)\\(Rk \\ Id) \\ \\Rk\\s1.rel\\\\Rk\\s2.rel\"\n by simp (auto simp add: filter_correct op_set_filter_def fun_rel_def \n br_def)\n\nlemma (in set_inter) inter_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (inter,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\\\Rk\\s3.rel\"\n by simp (auto simp add: inter_correct br_def)\n\nlemma (in set_subset) subset_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (subset,op \\)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: subset_correct br_def)\n\nlemma (in set_equal) equal_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (equal,op =)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: equal_correct br_def)\n\nlemma (in set_disjoint) disjoint_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (disjoint,op_set_disjoint)\\\\Rk\\s1.rel\\\\Rk\\s2.rel\\Id\"\n by simp (auto simp add: disjoint_correct op_set_disjoint_def br_def)\n\nlemma (in list_to_set) to_set_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (to_set,set)\\\\Rk\\list_rel \\ \\Rk\\rel\"\n apply simp\n apply (auto simp add: to_set_correct br_def)\n done\n\ncontext set_sel' begin\ncontext begin interpretation autoref_syn .\n\nlemma autoref_op_set_pick[autoref_rules]: \n assumes \"SIDE_PRECOND (s'\\{})\"\n assumes \"PREFER_id Rk\"\n assumes \"(s,s')\\\\Rk\\rel\"\n shows \"(RETURN (the (sel' s (\\_. True))), \n (OP op_set_pick ::: \\Rk\\rel \\ \\Rk\\nres_rel) $ s')\n \\ \\Rk\\nres_rel\"\n using assms\n apply (clarsimp simp add: br_def nres_rel_def ex_in_conv[symmetric])\n apply (erule (1) sel'E[OF _ _ TrueI])\n apply (auto intro: RES_refine)\n done\nend\nend\n\nlemma (in poly_set_iteratei) proper[proper_it]:\n \"proper_it' iteratei iteratei\"\n apply (rule proper_it'I)\n by (rule pi_iteratei)\n\nlemma (in poly_set_iteratei) autoref_iteratei[autoref_ga_rules]: \n \"REL_IS_ID Rk \\ is_set_to_list Rk rel (it_to_list iteratei)\"\n unfolding is_set_to_list_def is_set_to_sorted_list_def it_to_list_def \n it_to_sorted_list_def\n apply (simp add: br_def, intro allI impI)\n apply (drule iteratei_correct)\n unfolding set_iterator_def set_iterator_genord_foldli_conv\n apply (elim exE)\n apply clarsimp\n apply (drule fun_cong[where x=\"\\_::'x list. True\"])\n apply simp\n done\n\nlemma (in poly_set_iterateoi) proper_o[proper_it]:\n \"proper_it' iterateoi iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_iterateoi)\n\n\n\nlemma (in poly_set_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n \"REL_IS_ID Rk \\ \n is_set_to_sorted_list op \\ Rk rel (it_to_list rev_iterateoi)\"\n unfolding is_set_to_sorted_list_def it_to_list_def it_to_sorted_list_def\n apply (simp add: br_def, intro allI impI)\n apply (drule rev_iterateoi_correct)\n unfolding set_iterator_rev_linord_def set_iterator_genord_foldli_conv\n apply (elim exE)\n apply clarsimp\n apply (drule fun_cong[where x=\"\\_::'x list. True\"])\n apply simp\n done\n\nlemma (in poly_set_rev_iterateoi) proper_ro[proper_it]:\n \"proper_it' rev_iterateoi rev_iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_rev_iterateoi)\n\nsubsection \"Map\"\n\nlemma (in map) rel_alt: \"\\Id,Rv\\rel = \n { (c,a). \\x. (\\ c x,a x)\\\\Rv\\option_rel \\ invar c }\"\n by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in map_empty) empty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (empty (),op_map_empty)\\\\Rk,Rv\\rel\"\n by (auto simp: empty_correct rel_alt)\n \nlemma (in map_lookup) lookup_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (lookup,op_map_lookup)\\Rk\\\\Rk,Rv\\rel\\\\Rv\\option_rel\"\n apply (intro fun_relI option_relI)\n apply (auto simp: lookup_correct rel_alt\n dest: fun_relD2)\n done\n\nlemma (in map_update) update_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (update,op_map_update)\\Rk\\Rv\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (intro fun_relI)\n apply (simp add: update_correct rel_alt)\n done\n\ncontext map_update_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma update_dj_autoref[autoref_rules]: \n assumes \"SIDE_PRECOND_OPT (k'\\dom m')\"\n assumes \"PREFER_id Rk\"\n assumes \"(k,k')\\Rk\"\n assumes \"(v,v')\\Rv\"\n assumes \"(m,m')\\\\Rk,Rv\\rel\"\n shows \"(update_dj k v m,\n (OP op_map_update ::: Rk \\ Rv \\ \\Rk,Rv\\rel \\ \\Rk,Rv\\rel)$k'$v'$m'\n )\\\\Rk,Rv\\rel\"\n using assms\n apply (subgoal_tac \"k\\dom (\\ m)\")\n apply (simp add: update_dj_correct rel_alt)\n apply (auto simp add: rel_alt option_rel_def)\n apply (metis option.simps(3))\n done\nend\nend\n\nlemma (in map_delete) delete_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (delete,op_map_delete)\\Rk\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (intro fun_relI)\n apply (simp add: delete_correct restrict_map_def rel_alt)\n done\n\nlemma (in map_restrict) restrict_autoref[autoref_rules]: \n \"PREFER_id Rk \\ \n (restrict,op_map_restrict) \n \\ (\\Rk,Rv\\prod_rel \\ Id) \\ \\Rk,Rv\\m1.rel \\ \\Rk,Rv\\m2.rel\"\n apply (intro fun_relI)\n apply (simp add: restrict_correct br_comp_alt m1.rel_def m2.rel_def )\n apply (intro fun_relI)\n apply (auto simp: restrict_map_def split: split_if_asm)\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def) []\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def) []\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n apply (drule (1) fun_relD2)\n apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n done\n\nlemma (in map_add) add_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (add,op ++)\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\\\\Rk,Rv\\rel\"\n apply (auto simp add: add_correct rel_alt Map.map_add_def\n split: option.split)\n apply (drule_tac x=x in spec)+\n apply simp\n apply (metis option.simps(3) option_rel_simp(2))\n by (metis (lifting) option_rel_simp(3))\n\n\ncontext map_add_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma add_dj_autoref[autoref_rules]: \n assumes \"PREFER_id Rk\"\n assumes \"SIDE_PRECOND_OPT (dom a' \\ dom b' = {})\"\n assumes \"(a,a')\\\\Rk,Rv\\rel\"\n assumes \"(b,b')\\\\Rk,Rv\\rel\"\n shows \"(add_dj a b, (OP op ++ ::: \\Rk,Rv\\rel \\ \\Rk,Rv\\rel \\ \\Rk,Rv\\rel) $ a' $ b')\\\\Rk,Rv\\rel\"\n using assms\n apply simp\n apply (subgoal_tac \"dom (\\ a) \\ dom (\\ b) = {}\")\n apply (clarsimp simp add: add_dj_correct rel_def br_comp_alt)\n apply (auto \n simp add: rel_def br_comp_alt Map.map_add_def\n split: option.split\n elim: fun_relE1 dest: fun_relD1 intro: option_relI\n ) []\n\n apply (clarsimp simp add: rel_def br_comp_alt)\n\n apply (auto simp: dom_def)\n apply (drule (1) fun_relD1)\n apply (drule (1) fun_relD1)\n apply (auto simp: option_rel_def)\n done\nend\nend\n\nlemma (in map_isEmpty) isEmpty_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isEmpty,op_map_isEmpty)\\\\Rk,Rv\\rel\\Id\"\n by (auto simp: isEmpty_correct rel_alt\n intro!: ext)\n\nlemma sngI: \n assumes \"m k = Some v\"\n assumes \"\\k'. k'\\k \\ m k' = None\"\n shows \"m = [k\\v]\"\n using assms\n by (auto intro!: ext)\n\nlemma (in map_isSng) isSng_autoref[autoref_rules]: \n \"PREFER_id Rk \\ (isSng,op_map_isSng)\\\\Rk,Rv\\rel\\Id\"\n (* TODO: Clean up this mess *)\n apply (auto simp add: isSng_correct rel_alt)\n apply (rule_tac x=k in exI)\n apply (rule_tac x=\"the (a' k)\" in exI)\n apply (rule sngI)\n apply (drule_tac x=k in spec)\n apply (auto elim: option_relE) []\n apply (force elim: option_relE) []\n\n apply (rule_tac x=k in exI)\n apply (rule_tac x=\"the (\\ a k)\" in exI)\n apply (rule sngI)\n apply (drule_tac x=k in spec)\n apply (auto elim: option_relE) []\n apply (force elim: option_relE) []\n done\n\nlemma (in map_ball) ball_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (ball,op_map_ball)\\\\Rk,Rv\\rel\\(\\Rk,Rv\\prod_rel\\Id)\\Id\"\n apply (auto simp: ball_correct rel_alt map_to_set_def\n option_rel_def prod_rel_def fun_rel_def)\n apply (metis option.inject option.simps(3))+\n done\n\nlemma (in map_bex) bex_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (bex,op_map_bex)\\\\Rk,Rv\\rel\\(\\Rk,Rv\\prod_rel\\Id)\\Id\"\n apply (auto simp: bex_correct map_to_set_def rel_alt \n option_rel_def prod_rel_def fun_rel_def)\n apply (metis option.inject option.simps(3))+\n done\n\nlemma (in map_size) size_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (size,op_map_size)\\\\Rk,Rv\\rel\\Id\"\n apply (auto simp: size_correct rel_alt option_rel_def dom_def \n intro!: arg_cong[where f=card])\n apply (metis option.simps(3))+\n done\n\nlemma (in map_size_abort) size_abort_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (size_abort,op_map_size_abort)\\Id\\\\Rk,Rv\\rel\\Id\"\n apply (auto simp: size_abort_correct \n rel_alt option_rel_def\n dom_def intro!: arg_cong[where f=card] cong[OF arg_cong[where f=min]])\n apply (metis option.simps(3))+\n done\n\nlemma (in list_to_map) to_map_autoref[autoref_rules]:\n \"PREFER_id Rk \\ (to_map,map_of)\\ \\\\Rk,Rv\\prod_rel\\list_rel \\ \\Rk,Rv\\rel\"\nproof (intro fun_relI)\n fix l :: \"('u\\'v) list\" and l' :: \"('u\\'a) list\"\n assume \"PREFER_id Rk\" hence [simp]: \"Rk=Id\" by simp\n assume \"(l,l')\\\\\\Rk,Rv\\prod_rel\\list_rel\"\n thus \"(to_map l, map_of l') \\ \\Rk,Rv\\rel\"\n apply (simp add: list_rel_def)\n proof (induct rule: list_all2_induct)\n case Nil thus ?case \n by (auto simp add: to_map_correct rel_alt)\n next\n case (Cons x x' l l') thus ?case\n by (auto simp add: to_map_correct \n rel_alt prod_rel_def)\n qed\nqed\n\n(* TODO: Move *)\nlemma key_rel_true[simp]: \"key_rel (\\_ _. True) = (\\_ _. True)\"\n by (auto intro!: ext simp: key_rel_def)\n\n\nlemma (in poly_map_iteratei) proper[proper_it]:\n \"proper_it' iteratei iteratei\"\n apply (rule proper_it'I)\n by (rule pi_iteratei)\n\nlemma (in poly_map_iteratei) autoref_iteratei[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_list Rk Rv rel (it_to_list iteratei)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def is_map_to_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_genord_correct[where it = iteratei, \n where R=\"\\_ _. True\", simplified, OF \n iteratei_correct[OF I, unfolded set_iterator_def]\n ] have \n M: \"Map.map_of (it_to_list iteratei m) = \\ m\"\n and D: \"distinct (List.map fst (it_to_list iteratei m))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list iteratei m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list iteratei m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n qed\nqed\n\nlemma (in poly_map_iterateoi) proper_o[proper_it]:\n \"proper_it' iterateoi iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_iterateoi)\n\nlemma (in poly_map_iterateoi) autoref_iterateoi[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_sorted_list op \\ Rk Rv rel (it_to_list iterateoi)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_linord_correct[where it = iterateoi, \n OF iterateoi_correct[OF I]\n ] have \n M: \"map_of (it_to_list iterateoi m) = \\ m\"\n and D: \"distinct (map fst (it_to_list iterateoi m))\"\n and S: \"sorted (map fst (it_to_list iterateoi m))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list iterateoi m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list iterateoi m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n\n from S show \"sorted_by_rel (key_rel op \\) (it_to_list iterateoi m)\"\n by (simp add: key_rel_def[abs_def])\n\n qed\nqed\n\nlemma (in poly_map_rev_iterateoi) proper_ro[proper_it]:\n \"proper_it' rev_iterateoi rev_iterateoi\"\n apply (rule proper_it'I)\n by (rule pi_rev_iterateoi)\n\nlemma (in poly_map_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n assumes ID: \"REL_IS_ID Rk\"\n \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n shows \"is_map_to_sorted_list op \\ Rk Rv rel (it_to_list rev_iterateoi)\"\nproof -\n from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n show ?thesis\n unfolding is_map_to_sorted_list_def\n it_to_sorted_list_def\n apply simp\n apply (intro allI impI conjI)\n proof -\n fix m m'\n assume \"(m, m') \\ br \\ invar\"\n hence I: \"invar m\" and M': \"m' = \\ m\" by (simp_all add: br_def)\n\n have [simp]: \"\\c. (\\(_,_). c) = (\\_. c)\" by auto\n\n from map_it_to_list_rev_linord_correct[where it = rev_iterateoi, \n OF rev_iterateoi_correct[OF I]\n ] have \n M: \"map_of (it_to_list rev_iterateoi m) = \\ m\"\n and D: \"distinct (map fst (it_to_list rev_iterateoi m))\"\n and S: \"sorted (rev (map fst (it_to_list rev_iterateoi m)))\"\n by (simp_all)\n\n from D show \"distinct (it_to_list rev_iterateoi m)\"\n by (rule distinct_mapI)\n\n from M show \"map_to_set m' = set (it_to_list rev_iterateoi m)\"\n by (simp add: M' map_of_map_to_set[OF D])\n\n from S show \"sorted_by_rel (key_rel op \\) (it_to_list rev_iterateoi m)\"\n by (simp add: key_rel_def[abs_def])\n\n qed\nqed\n\n\n\n\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/ICF_Autoref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2813444102119438}} {"text": "(******************************************************************************\n * HOL-TestGen --- theorem-prover based test case generation\n * http://www.brucker.ch/projects/hol-testgen/\n *\n * Monads.thy --- a base testing theory for sequential computations.\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2005-2007 ETH Zurich, Switzerland\n * 2009 B. Wolff, Univ. Paris-Saclay, Univ. Paris-Sud, France\n * 2009,2012 Achim D. Brucker, Germany\n * 2013-2016 Université Paris-Saclay, Univ. Paris-Sud, France\n * 2013-2016 IRT SystemX, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\nchapter {* Basic Monad Theory for Sequential Computations *}\n\ntheory Monads imports Main\nbegin\n\n\nsection{*General Framework for Monad-based Sequence-Test *}\ntext{* As such, Higher-order Logic as a purely functional specification\n formalism has no built-in mechanism for state and state-transitions.\n Forms of testing involving state require therefore explicit mechanisms\n for their treatment inside the logic; a well-known technique to model\n states inside purely functional languages are \\emph{monads} made popular\n by Wadler and Moggi and extensively used in Haskell. \\HOL is powerful\n enough to represent the most important standard monads;\n however, it is not possible to represent monads as such due to well-known\n limitations of the Hindley-Milner type-system. *}\n\ntext{* Here is a variant for state-exception monads, that models precisely\n transition functions with preconditions. Next, we declare the\n state-backtrack-monad. In all of them, our concept of i/o stepping\n functions can be formulated; these are functions mapping input\n to a given monad. Later on, we will build the usual concepts of:\n \\begin{enumerate}\n \\item deterministic i/o automata,\n \\item non-deterministic i/o automata, and\n \\item labelled transition systems (LTS)\n \\end{enumerate}\n*}\n\nsubsection{* Standard State Exception Monads *}\ntype_synonym ('o, '\\) MON\\<^sub>S\\<^sub>E = \"'\\ \\ ('o \\ '\\)\" (* = '\\ \\ ('o \\ '\\)option *)\n\n\ndefinition bind_SE :: \"('o,'\\)MON\\<^sub>S\\<^sub>E \\ ('o \\ ('o','\\)MON\\<^sub>S\\<^sub>E) \\ ('o','\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"bind_SE f g = (\\\\. case f \\ of None \\ None\n | Some (out, \\') \\ g out \\')\"\n\nnotation bind_SE (\"bind\\<^sub>S\\<^sub>E\")\n\nsyntax (xsymbols)\n \"_bind_SE\" :: \"[pttrn,('o,'\\)MON\\<^sub>S\\<^sub>E,('o','\\)MON\\<^sub>S\\<^sub>E] \\ ('o','\\)MON\\<^sub>S\\<^sub>E\"\n (\"(2 _ \\ _; _)\" [5,8,8]8)\ntranslations\n \"x \\ f; g\" == \"CONST bind_SE f (% x . g)\"\n\n\ndefinition unit_SE :: \"'o \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\" (\"(return _)\" 8)\nwhere \"unit_SE e = (\\\\. Some(e,\\))\"\nnotation unit_SE (\"unit\\<^sub>S\\<^sub>E\")\n\ndefinition fail_SE :: \"('o, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"fail_SE = (\\\\. None)\"\nnotation fail_SE (\"fail\\<^sub>S\\<^sub>E\")\n\ndefinition assert_SE :: \"('\\ \\ bool) \\ (bool, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"assert_SE P = (\\\\. if P \\ then Some(True,\\) else None)\"\nnotation assert_SE (\"assert\\<^sub>S\\<^sub>E\")\n\ndefinition assume_SE :: \"('\\ \\ bool) \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"assume_SE P = (\\\\. if \\\\ . P \\ then Some((), SOME \\ . P \\) else None)\"\nnotation assume_SE (\"assume\\<^sub>S\\<^sub>E\")\n\ntext{* The standard monad theorems about unit and associativity: *}\n\nlemma bind_left_unit [simp]: \"(x \\ return c; P x) = P c\"\n by (simp add: unit_SE_def bind_SE_def)\n\n\nlemma bind_left_fail_SE[simp] : \"(x \\ fail\\<^sub>S\\<^sub>E; P x) = fail\\<^sub>S\\<^sub>E\"\n by (simp add: fail_SE_def bind_SE_def)\n\n\nlemma bind_right_unit[simp]: \"(x \\ m; return x) = m\"\n apply (simp add: unit_SE_def bind_SE_def)\n apply (rule ext)\n apply (case_tac \"m \\\", simp_all)\n done\n\nlemma bind_assoc[simp]: \"(y \\ (x \\ m; k x); h y) = (x \\ m; (y \\ k x; h y))\"\n apply (simp add: unit_SE_def bind_SE_def, rule ext)\n apply (case_tac \"m \\\", simp_all)\n apply (case_tac \"a\", simp_all)\n done\n\n\ntext{* The bind-operator in the state-exception monad yields already\n a semantics for the concept of an input sequence on the meta-level: *}\nlemma syntax_test: \"(o1 \\ f1 ; o2 \\ f2; return (post o1 o2)) = X\"\noops\n\n\n\nsubsection {* \"Pipe-free\" - variant of the bind. *}\n\ndefinition seq_SE :: \"[('\\, '\\)MON\\<^sub>S\\<^sub>E, ('\\, '\\)MON\\<^sub>S\\<^sub>E] \\ ('\\, '\\)MON\\<^sub>S\\<^sub>E\" (infixl \";-\" 65)\nwhere \"f ;- g = (_ \\ f ; g)\"\n\n\n\nsubsection {* Monadic If *}\n\ndefinition if_SE :: \"['\\ \\ bool, ('\\, '\\)MON\\<^sub>S\\<^sub>E, ('\\, '\\)MON\\<^sub>S\\<^sub>E] \\ ('\\, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"if_SE c E F = (\\\\. if c \\ then E \\ else F \\)\"\n\nsyntax (xsymbols)\n \"_if_SE\" :: \"['\\ \\ bool,('o,'\\)MON\\<^sub>S\\<^sub>E,('o','\\)MON\\<^sub>S\\<^sub>E] \\ ('o','\\)MON\\<^sub>S\\<^sub>E\"\n (\"(if\\<^sub>S\\<^sub>E _ then _ else _fi)\" [5,8,8]8)\ntranslations\n \"(if\\<^sub>S\\<^sub>E cond then T1 else T2 fi)\" == \"CONST if_SE cond T1 T2\"\n\n\n\nsubsubsection{* Theory of a Monadic While *}\n\ntext{* First Step : Establishing an embedding between partial functions and relations *}\n(* plongement *)\ndefinition Mon2Rel :: \"(unit, '\\)MON\\<^sub>S\\<^sub>E \\ ('\\ \\ '\\) set\"\nwhere \"Mon2Rel f = {(x, y). (f x = Some((), y))}\"\n(* ressortir *)\ndefinition Rel2Mon :: \" ('\\ \\ '\\) set \\ (unit, '\\)MON\\<^sub>S\\<^sub>E \"\nwhere \"Rel2Mon S = (\\ \\. if \\\\'. (\\, \\') \\ S then Some((), SOME \\'. (\\, \\') \\ S) else None)\"\n\nlemma Mon2Rel_Rel2Mon_id: assumes det:\"single_valued R\" shows \"(Mon2Rel \\ Rel2Mon) R = R\"\napply (simp add: comp_def Mon2Rel_def Rel2Mon_def,auto)\napply (case_tac \"\\\\'. (a, \\') \\ R\", auto)\napply (subst some_eq_ex) back\napply (insert det[simplified single_valued_def])\napply (auto)\ndone\n\nlemma Rel2Mon_Id: \"(Rel2Mon \\ Mon2Rel) x = x\"\napply (rule ext)\napply (auto simp: comp_def Mon2Rel_def Rel2Mon_def)\napply (erule contrapos_pp, drule HOL.not_sym, simp)\ndone\n\nlemma single_valued_Mon2Rel: \"single_valued (Mon2Rel B)\"\nby (auto simp: single_valued_def Mon2Rel_def)\n\ntext{* Second Step : Proving an induction principle allowing to establish that lfp remains\n deterministic *}\n\n\n(* Due to Tobias Nipkow *)\ndefinition chain :: \"(nat => 'a set) => bool\"\nwhere \"chain S = (\\i. S i \\ S(Suc i))\"\n\nlemma chain_total: \"chain S ==> S i \\ S j \\ S j \\ S i\"\nby (metis chain_def le_cases lift_Suc_mono_le)\n\ndefinition cont :: \"('a set => 'b set) => bool\"\nwhere \"cont f = (\\S. chain S \\ f(UN n. S n) = (UN n. f(S n)))\"\n\nlemma mono_if_cont: fixes f :: \"'a set => 'b set\"\n assumes \"cont f\" shows \"mono f\"\nproof\n fix a b :: \"'a set\" assume \"a \\ b\"\n let ?S = \"\\n::nat. if n=0 then a else b\"\n have \"chain ?S\" using `a \\ b` by(auto simp: chain_def)\n hence \"f(UN n. ?S n) = (UN n. f(?S n))\"\n using assms by(simp add: cont_def)\n moreover have \"(UN n. ?S n) = b\" using `a \\ b` by (auto split: if_splits)\n moreover have \"(UN n. f(?S n)) = f a \\ f b\" by (auto split: if_splits)\n ultimately show \"f a \\ f b\" by (metis Un_upper1)\nqed\n\nlemma chain_iterates: fixes f :: \"'a set => 'a set\"\n assumes \"mono f\" shows \"chain(\\n. (f^^n) {})\"\nproof-\n { fix n have \"(f ^^ n) {} \\ (f ^^ Suc n) {}\" using assms\n by(induction n) (auto simp: mono_def) }\n thus ?thesis by(auto simp: chain_def)\nqed\n\ntheorem lfp_if_cont:\n assumes \"cont f\" shows \"lfp f = (UN n. (f^^n) {})\" (is \"_ = ?U\")\nproof\n show \"lfp f \\ ?U\"\n proof (rule lfp_lowerbound)\n have \"f ?U = (UN n. (f^^Suc n){})\"\n using chain_iterates[OF mono_if_cont[OF assms]] assms\n by(simp add: cont_def)\n also have \"\\ = (f^^0){} \\ \\\" by simp\n also have \"\\ = ?U\"\n by(auto simp del: funpow.simps) (metis empty_iff funpow_0 old.nat.exhaust)\n finally show \"f ?U \\ ?U\" by simp\n qed\nnext\n { fix n p assume \"f p \\ p\"\n have \"(f^^n){} \\ p\"\n proof(induction n)\n case 0 show ?case by simp\n next\n case Suc\n from monoD[OF mono_if_cont[OF assms] Suc] `f p \\ p`\n show ?case by simp\n qed\n }\n thus \"?U \\ lfp f\" by(auto simp: lfp_def)\nqed\n\n\nlemma single_valued_UN_chain:\n assumes \"chain S\" \"(!!n. single_valued (S n))\"\n shows \"single_valued(UN n. S n)\"\nproof(auto simp: single_valued_def)\n fix m n x y z assume \"(x, y) \\ S m\" \"(x, z) \\ S n\"\n with chain_total[OF assms(1), of m n] assms(2)\n show \"y = z\" by (auto simp: single_valued_def)\nqed\n\nlemma single_valued_lfp:\nfixes f :: \"('a \\ 'a) set => ('a \\ 'a) set\"\nassumes \"cont f\" \"\\r. single_valued r \\ single_valued (f r)\"\nshows \"single_valued(lfp f)\"\nunfolding lfp_if_cont[OF assms(1)]\nproof(rule single_valued_UN_chain[OF chain_iterates[OF mono_if_cont[OF assms(1)]]])\n fix n show \"single_valued ((f ^^ n) {})\"\n by(induction n)(auto simp: assms(2))\nqed\n\n\ntext{* Third Step: Definition of the Monadic While *}\ndefinition \\ :: \"['\\ \\ bool,('\\ \\ '\\) set] \\ (('\\ \\ '\\) set \\ ('\\ \\ '\\) set)\"\nwhere \"\\ b cd = (\\cw. {(s,t). if b s then (s, t) \\ cd O cw else s = t})\"\n\n\ndefinition while_SE :: \"['\\ \\ bool, (unit, '\\)MON\\<^sub>S\\<^sub>E] \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"while_SE c B \\ (Rel2Mon(lfp(\\ c (Mon2Rel B))))\"\n\nsyntax (xsymbols)\n \"_while_SE\" :: \"['\\ \\ bool, (unit, '\\)MON\\<^sub>S\\<^sub>E] \\ (unit, '\\)MON\\<^sub>S\\<^sub>E\"\n (\"(while\\<^sub>S\\<^sub>E _ do _ od)\" [8,8]8)\ntranslations\n \"while\\<^sub>S\\<^sub>E c do b od\" == \"CONST while_SE c b\"\n\nlemma cont_\\: \"cont (\\ c b)\"\nby (auto simp: cont_def \\_def)\n\ntext{* The fixpoint theory now allows us to establish that the lfp constructed over\n @{term Mon2Rel} remains deterministic *}\n\ntheorem single_valued_lfp_Mon2Rel: \"single_valued (lfp(\\ c (Mon2Rel B)))\"\napply(rule single_valued_lfp, simp_all add: cont_\\)\napply(auto simp: \\_def single_valued_def)\napply(metis single_valued_Mon2Rel[of \"B\"] single_valued_def)\ndone\n\n\nlemma Rel2Mon_if:\n \"Rel2Mon {(s, t). if b s then (s, t) \\ Mon2Rel c O lfp (\\ b (Mon2Rel c)) else s = t} \\ =\n (if b \\ then Rel2Mon (Mon2Rel c O lfp (\\ b (Mon2Rel c))) \\ else Some ((), \\))\"\nby (simp add: Rel2Mon_def)\n\nlemma Rel2Mon_homomorphism:\n assumes determ_X: \"single_valued X\" and determ_Y: \"single_valued Y\"\n shows \"Rel2Mon (X O Y) = (Rel2Mon X) ;- (Rel2Mon Y)\"\nproof -\n have relational_partial_next_in_O: \"!!x E F. (\\y. (x, y) \\ (E O F)) \\ (\\y. (x, y) \\ E)\"\n by (auto)\n have some_eq_intro: \"\\X x y . single_valued X \\ (x, y) \\ X \\ (SOME y. (x, y) \\ X) = y\"\n by (auto simp: single_valued_def)\n\nshow ?thesis\napply (simp add: Rel2Mon_def seq_SE_def bind_SE_def)\napply (rule ext, rename_tac \"\\\")\napply (case_tac \" \\\\'. (\\, \\') \\ X O Y\")\napply (simp only: HOL.if_True)\napply (frule relational_partial_next_in_O)\napply (auto)\napply (insert determ_X determ_Y)\n\napply (subgoal_tac \"(SOME \\'. (x, \\') \\ X) = y\")\napply (simp)\n apply (subgoal_tac \"(SOME \\'. (y, \\') \\ Y) = z\")\n apply (simp)\n apply (subgoal_tac \"(SOME \\'. (x, \\') \\ X O Y) = z\")\n apply (simp)\n apply (auto simp: single_valued_def)\napply (subgoal_tac \"(SOME \\'. (x, \\') \\ X) = ya\")\n apply (simp_all)\napply (subgoal_tac \"(SOME \\'. (ya, \\') \\ Y) = \\''\")\n apply (simp_all)\napply (subgoal_tac \"(SOME \\'. (x, \\') \\ X O Y) = \\''\")\n apply (assumption)\napply (subgoal_tac \"single_valued (X O Y)\")\n apply (fold single_valued_def)\n apply (subgoal_tac \"(x, \\'') \\ X O Y\")\n apply (auto, rule some_eq_intro)\n apply (auto, rule Relation.relcomp.relcompI Relation.single_valued_relcomp, auto)\n\napply (rule_tac x=z in exI)\napply (rule someI2)\napply (assumption)+\napply (simp add: single_valued_def)\napply (metis)\n\napply (erule contrapos_pp)\napply (simp)\napply (rule_tac x=\\' in exI)\n apply (subgoal_tac \"(SOME \\'. (\\, \\') \\ X) = \\''\")\n apply (auto)\n apply (auto simp: single_valued_def)\ndone\nqed\n\ntext{* Putting everything together, the theory of embedding and the invariance of\n determinism of the while-body, gives us the usual unfold-theorem: *}\ntheorem \"(while\\<^sub>S\\<^sub>E b do c od) = (if\\<^sub>S\\<^sub>E b then (c ;- (while\\<^sub>S\\<^sub>E b do c od)) else return () fi)\"\napply (simp add: if_SE_def seq_SE_def while_SE_def unit_SE_def)\napply (subst lfp_unfold [OF mono_if_cont, OF cont_\\])\napply (rule ext)\napply (subst \\_def)\napply (auto simp: Rel2Mon_if Rel2Mon_homomorphism seq_SE_def Rel2Mon_Id [simplified comp_def]\n single_valued_Mon2Rel single_valued_lfp_Mon2Rel )\ndone\n\n\n\nsubsection{* Multi-binds *}\n\ntext{* In order to express test-sequences also on the object-level and\nto make our theory amenable to formal reasoning over test-sequences,\nwe represent them as lists of input and generalize the bind-operator\nof the state-exception monad accordingly. The approach is straightforward,\nbut comes with a price: we have to encapsulate all input and output data\ninto one type. Assume that we have a typed interface to a module with\nthe operations $op_1$, $op_2$, \\ldots, $op_n$ with the inputs\n$\\iota_1$, $\\iota_2$, \\ldots, $\\iota_n$ (outputs are treated analogously).\nThen we can encode for this interface the general input - type:\n\\begin{displaymath}\n\\texttt{datatype}\\ \\texttt{in}\\ =\\ op_1\\ ::\\ \\iota_1\\ |\\ ...\\ |\\ \\iota_n\n\\end{displaymath}\nObviously, we loose some type-safety in this approach; we have to express\nthat in traces only \\emph{corresponding} input and output belonging to the\nsame operation will occur; this form of side-conditions have to be expressed\ninside \\HOL. From the user perspective, this will not make much difference,\nsince junk-data resulting from too weak typing can be ruled out by adopted\nfront-ends.\n*}\n\ntext{* Note that the subsequent notion of a test-sequence allows the io stepping\nfunction (and the special case of a program under test) to stop execution\n\\emph{within} the sequence; such premature terminations are characterized by an\noutput list which is shorter than the input list. *}\n\nfun mbind :: \"'\\ list \\ ('\\ \\ ('o,'\\) MON\\<^sub>S\\<^sub>E) \\ ('o list,'\\) MON\\<^sub>S\\<^sub>E\"\nwhere \"mbind [] iostep \\ = Some([], \\)\" |\n \"mbind (a#H) iostep \\ =\n (case iostep a \\ of\n None \\ Some([], \\)\n | Some (out, \\') \\ (case mbind H iostep \\' of\n None \\ Some([out],\\')\n | Some(outs,\\'') \\ Some(out#outs,\\'')))\"\n\nnotation mbind (\"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e\") (* future name: mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e *)\n\ntext{* This definition is fail-safe; in case of an exception, the current state is maintained,\n the computation as a whole is marked as success.\n Compare to the fail-strict variant @{text \"mbind'\"}: *}\n\nlemma mbind_unit [simp]:\n \"mbind [] f = (return [])\"\n by(rule ext, simp add: unit_SE_def)\n\ntext{* The characteristic property of @{term mbind} --- which distinguishes it from\n @{text mbind'} defined in the sequel --- is that it never fails; it ``swallows'' internal\n errors occurring during the computation. *}\nlemma mbind_nofailure [simp]:\n \"mbind S f \\ \\ None\"\n apply(rule_tac x=\\ in spec)\n apply(induct S, auto simp:unit_SE_def)\n apply(case_tac \"f a x\", auto)\n apply(erule_tac x=\"b\" in allE)\n apply(erule exE, erule exE, simp)\n done\n\n\nfun mbind' :: \"'\\ list \\ ('\\ \\ ('o,'\\) MON\\<^sub>S\\<^sub>E) \\ ('o list,'\\) MON\\<^sub>S\\<^sub>E\"\nwhere \"mbind' [] iostep \\ = Some([], \\)\" |\n \"mbind' (a#S) iostep \\ =\n (case iostep a \\ of\n None \\ None\n | Some (out, \\') \\ (case mbind' S iostep \\' of\n None \\ None (* fail-strict *)\n | Some(outs,\\'') \\ Some(out#outs,\\'')))\"\nnotation mbind' (\"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p\") (* future name: mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p *)\n\n\n\nlemma mbind'_bind [simp]:\n \"(x \\ mbind' (a#S) F; M x) = (a \\ (F a); (x \\ mbind' S F; M (a # x)))\"\n by(rule ext, rename_tac \"z\",simp add: bind_SE_def split: option.split)\n\ndeclare mbind'.simps[simp del] (* use only more abstract definitions *)\n\n\nfun mbind'' :: \"'\\ list \\ ('\\ \\ ('o,'\\) MON\\<^sub>S\\<^sub>E) \\ ('o list,'\\) MON\\<^sub>S\\<^sub>E\"\nwhere \"mbind'' [] iostep \\ = Some([], \\)\" |\n \"mbind'' (a#S) iostep \\ =\n (case iostep a \\ of\n None \\ mbind'' S iostep \\\n | Some (out, \\') \\ (case mbind'' S iostep \\' of\n None \\ None (* does not occur *)\n | Some(outs,\\'') \\ Some(out#outs,\\'')))\"\n\nnotation mbind'' (\"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e\") (* future name: mbind\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l *)\ndeclare mbind''.simps[simp del] (* use only more abstract definitions *)\n\n\ntext{* mbind' as failure strict operator can be seen as a foldr on bind -\n if the types would match \\ldots *}\n\ndefinition try_SE :: \"('o,'\\) MON\\<^sub>S\\<^sub>E \\ ('o option,'\\) MON\\<^sub>S\\<^sub>E\" (\"try\\<^sub>S\\<^sub>E\")\nwhere \"try\\<^sub>S\\<^sub>E ioprog = (\\\\. case ioprog \\ of\n None \\ Some(None, \\)\n | Some(outs, \\') \\ Some(Some outs, \\'))\"\ntext{* In contrast, mbind as a failure safe operator can roughly be seen\n as a foldr on bind - try:\n m1 ; try m2 ; try m3; ... Note, that the rough equivalence only holds for\n certain predicates in the sequence - length equivalence modulo None,\n for example. However, if a conditional is added, the equivalence\n can be made precise: *}\n\nlemma mbind_try:\n \"(x \\ mbind (a#S) F; M x) =\n (a' \\ try\\<^sub>S\\<^sub>E(F a);\n if a' = None\n then (M [])\n else (x \\ mbind S F; M (the a' # x)))\"\napply(rule ext)\napply(simp add: bind_SE_def try_SE_def)\napply(case_tac \"F a x\", auto)\napply(simp add: bind_SE_def try_SE_def)\napply(case_tac \"mbind S F b\", auto)\ndone\n\ntext{* On this basis, a symbolic evaluation scheme can be established\n that reduces mbind-code to try\\_SE\\_code and ite-cascades. *}\n\ndefinition alt_SE :: \"[('o, '\\)MON\\<^sub>S\\<^sub>E, ('o, '\\)MON\\<^sub>S\\<^sub>E] \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\" (infixl \"\\\\<^sub>S\\<^sub>E\" 10)\nwhere \"(f \\\\<^sub>S\\<^sub>E g) = (\\ \\. case f \\ of None \\ g \\\n | Some H \\ Some H)\"\n\ndefinition malt_SE :: \"('o, '\\)MON\\<^sub>S\\<^sub>E list \\ ('o, '\\)MON\\<^sub>S\\<^sub>E\"\nwhere \"malt_SE S = foldr alt_SE S fail\\<^sub>S\\<^sub>E\"\nnotation malt_SE (\"\\\\<^sub>S\\<^sub>E\")\n\nlemma malt_SE_mt [simp]: \"\\\\<^sub>S\\<^sub>E [] = fail\\<^sub>S\\<^sub>E\"\nby(simp add: malt_SE_def)\n\nlemma malt_SE_cons [simp]: \"\\\\<^sub>S\\<^sub>E (a # S) = (a \\\\<^sub>S\\<^sub>E (\\\\<^sub>S\\<^sub>E S))\"\nby(simp add: malt_SE_def)\n\n\nsubsection{* State Backtrack Monads *}\ntext{*This subsection is still rudimentary and as such an interesting\nformal analogue to the previous monad definitions. It is doubtful that it is\ninteresting for testing and as a cmputational stucture at all.\nClearly more relevant is ``sequence'' instead of ``set,'' which would\nrephrase Isabelle's internal tactic concept. *}\n\ntype_synonym ('o, '\\) MON\\<^sub>S\\<^sub>B = \"'\\ \\ ('o \\ '\\) set\"\n\ndefinition bind_SB :: \"('o, '\\)MON\\<^sub>S\\<^sub>B \\ ('o \\ ('o', '\\)MON\\<^sub>S\\<^sub>B) \\ ('o', '\\)MON\\<^sub>S\\<^sub>B\"\nwhere \"bind_SB f g \\ = \\ ((\\(out, \\). (g out \\)) ` (f \\))\"\nnotation bind_SB (\"bind\\<^sub>S\\<^sub>B\")\n\ndefinition unit_SB :: \"'o \\ ('o, '\\)MON\\<^sub>S\\<^sub>B\" (\"(returns _)\" 8)\nwhere \"unit_SB e = (\\\\. {(e,\\)})\"\nnotation unit_SB (\"unit\\<^sub>S\\<^sub>B\")\n\nsyntax (xsymbols)\n \"_bind_SB\" :: \"[pttrn,('o,'\\)MON\\<^sub>S\\<^sub>B,('o','\\)MON\\<^sub>S\\<^sub>B] \\ ('o','\\)MON\\<^sub>S\\<^sub>B\"\n (\"(2 _ := _; _)\" [5,8,8]8)\ntranslations\n \"x := f; g\" == \"CONST bind_SB f (% x . g)\"\n\n\n\nlemma bind_left_unit_SB : \"(x := returns a; m x) = m a\"\n by (rule ext,simp add: unit_SB_def bind_SB_def)\n\nlemma bind_right_unit_SB: \"(x := m; returns x) = m\"\n by (rule ext, simp add: unit_SB_def bind_SB_def)\n\n\nlemma bind_assoc_SB: \"(y := (x := m; k x); h y) = (x := m; (y := k x; h y))\"\n by (rule ext, simp add: unit_SB_def bind_SB_def split_def)\n\n\nsubsection{* State Backtrack Exception Monad (vulgo: Boogie-PL) *}\ntext{* The following combination of the previous two Monad-Constructions\nallows for the semantic foundation of a simple generic assertion language\nin the style of Schirmers Simpl-Language or Rustan Leino's Boogie-PL language.\nThe key is to use the exceptional element None for violations of\nthe assert-statement. *}\ntype_synonym ('o, '\\) MON\\<^sub>S\\<^sub>B\\<^sub>E = \"'\\ \\ (('o \\ '\\) set) option\"\n\n\ndefinition bind_SBE :: \"('o,'\\)MON\\<^sub>S\\<^sub>B\\<^sub>E \\ ('o \\ ('o','\\)MON\\<^sub>S\\<^sub>B\\<^sub>E) \\ ('o','\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\"\nwhere \"bind_SBE f g = (\\\\. case f \\ of None \\ None\n | Some S \\ (let S' = (\\(out, \\'). g out \\') ` S\n in if None \\ S' then None\n else Some(\\ (the ` S'))))\"\n\nsyntax (xsymbols)\n \"_bind_SBE\" :: \"[pttrn,('o,'\\)MON\\<^sub>S\\<^sub>B\\<^sub>E,('o','\\)MON\\<^sub>S\\<^sub>B\\<^sub>E] \\ ('o','\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\"\n (\"(2 _ :\\ _; _)\" [5,8,8]8)\ntranslations\n \"x :\\ f; g\" == \"CONST bind_SBE f (% x . g)\"\n\ndefinition unit_SBE :: \"'o \\ ('o, '\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\" (\"(returning _)\" 8)\nwhere \"unit_SBE e = (\\\\. Some({(e,\\)}))\"\n\ndefinition assert_SBE :: \"('\\ \\ bool) \\ (unit, '\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\"\nwhere \"assert_SBE e = (\\\\. if e \\ then Some({((),\\)})\n else None)\"\nnotation assert_SBE (\"assert\\<^sub>S\\<^sub>B\\<^sub>E\")\n\ndefinition assume_SBE :: \"('\\ \\ bool) \\ (unit, '\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\"\nwhere \"assume_SBE e = (\\\\. if e \\ then Some({((),\\)})\n else Some {})\"\nnotation assume_SBE (\"assume\\<^sub>S\\<^sub>B\\<^sub>E\")\n\n\ndefinition havoc_SBE :: \" (unit, '\\)MON\\<^sub>S\\<^sub>B\\<^sub>E\"\nwhere \"havoc_SBE = (\\\\. Some({x. True}))\"\nnotation havoc_SBE (\"havoc\\<^sub>S\\<^sub>B\\<^sub>E\")\n\n\nlemma bind_left_unit_SBE : \"(x :\\ returning a; m x) = m a\"\nby (rule ext,simp add: unit_SBE_def bind_SBE_def)\n\nlemma bind_right_unit_SBE: \"(x :\\ m; returning x) = m\"\n apply (rule ext, simp add: unit_SBE_def bind_SBE_def)\n apply (case_tac \"m x\", simp_all add:Let_def)\n apply (rule HOL.ccontr, simp add: Set.image_iff)\n done\n\n\nlemmas aux = trans[OF HOL.neq_commute,OF Option.not_None_eq]\n\nlemma bind_assoc_SBE: \"(y :\\ (x :\\ m; k); h y) = (x :\\ m; (y :\\ k; h y))\"\nproof (rule ext, rename_tac z, simp add: unit_SBE_def bind_SBE_def,\n case_tac \"m z\", simp_all add: Let_def Set.image_iff, safe)\n case goal1 then show ?case\n by(rule_tac x=\"(a, b)\" in bexI, simp_all)\nnext\n case goal2 then show ?case\n apply(rule_tac x=\"(aa,b)\" in bexI, simp_all add:split_def)\n apply(erule_tac x=\"(aa,b)\" in ballE)\n apply(auto simp: aux image_def split_def intro!: rev_bexI)\n done\nnext\n case goal3 then show ?case\n by(rule_tac x=\"(a, b)\" in bexI, simp_all)\nnext\n case goal4 then show ?case\n apply(erule_tac Q=\"None = (* FIXME to be shorten *) (case k b of None \\ None | Some S \\ let S' = (\\(x, y). h x y) ` S in if None \\ S' then None else Some (\\(the ` S')))\" in contrapos_pp)\n apply(erule_tac x=\"(aa,b)\" in ballE)\n apply(auto simp: aux Option.not_None_eq image_def split_def intro!: rev_bexI)\n done\nnext\n case goal5 then show ?case\n apply simp apply((erule_tac x=\"(ab,ba)\" in ballE)+)\n apply(simp_all add: aux Option.not_None_eq, (erule exE)+, simp add:split_def)\n apply(erule rev_bexI,case_tac \"None\\(\\p. h (fst p) (snd p))`y\",auto simp:split_def)\n done\n\nnext\n case goal6 then show ?case\n apply simp apply((erule_tac x=\"(a,b)\" in ballE)+)\n apply(simp_all add: aux Option.not_None_eq, (erule exE)+, simp add:split_def)\n apply(erule rev_bexI, case_tac \"None\\(\\p. h(fst p)(snd p))`y\",auto simp:split_def)\n done\nqed\n\n\n\n(* TODO: IF THEN ELSE and WHILE + Monadic Laws + Operational Rules. *)\n\n\n\nsection{* Valid Execution Sequences in the State Exception Monad *}\ntext{* This is still an unstructured merge of executable monad concepts\nand specification oriented high-level properties initiating test procedures. *}\n\ndefinition valid_SE :: \"'\\ \\ (bool,'\\) MON\\<^sub>S\\<^sub>E \\ bool\" (infix \"\\\" 15)\nwhere \"(\\ \\ m) = (m \\ \\ None \\ fst(the (m \\)))\"\ntext{* This notation consideres failures as valid -- a definition\ninspired by I/O conformance. BUG: It is not possible to define\nthis concept once and for all in a Hindley-Milner type-system.\nFor the moment, we present it only for the state-exception\nmonad, although for the same definition, this notion is applicable\nto other monads as well. *}\n\n\nlemma exec_unit_SE [simp]: \"(\\ \\ (return P)) = (P)\"\nby(auto simp: valid_SE_def unit_SE_def)\n\nlemma exec_unit_SE' [simp]: \"(\\\\<^sub>0 \\ (\\\\. Some (f \\, \\))) = (f \\\\<^sub>0)\"\nby(simp add: valid_SE_def )\n\nlemma exec_fail_SE [simp]: \"(\\ \\ fail\\<^sub>S\\<^sub>E) = False\"\nby(auto simp: valid_SE_def fail_SE_def)\n\n\nlemma exec_fail_SE'[simp]: \"\\(\\\\<^sub>0 \\ (\\\\. None))\"\nby(simp add: valid_SE_def )\n\nlemma exec_bind_SE_failure:\n\"A \\ = None \\ \\(\\ \\ ((s \\ A ; M s)))\"\nby(simp add: valid_SE_def unit_SE_def bind_SE_def)\n\nlemma exec_bind_SE_success:\n\"A \\ = Some(b,\\') \\ (\\ \\ ((s \\ A ; M s))) = (\\' \\ (M b))\"\nby(simp add: valid_SE_def unit_SE_def bind_SE_def )\n\nlemma exec_bind_SE_success': (* atomic boolean Monad \"Query Functions\" *)\n\"M \\ = Some(f \\,\\) \\ (\\ \\ M) = f \\\"\nby(simp add: valid_SE_def unit_SE_def bind_SE_def )\n\n\n\nlemma exec_bind_SE_success'':\n\"\\ \\ ((s \\ A ; M s)) \\ \\ v \\'. the(A \\) = (v,\\') \\ \\' \\ (M v)\"\napply(auto simp: valid_SE_def unit_SE_def bind_SE_def)\napply(cases \"A \\\", simp_all)\napply(simp add: case_prod_unfold)\napply(drule_tac x=\"A \\\" and f=the in arg_cong, simp)\napply(rule_tac x=\"fst aa\" in exI)\napply(rule_tac x=\"snd aa\" in exI, auto)\ndone\n\n\nlemma exec_bind_SE_success''':\n\"\\ \\ ((s \\ A ; M s)) \\ \\ a. (A \\) = Some a \\ (snd a) \\ (M (fst a))\"\napply(auto simp: valid_SE_def unit_SE_def bind_SE_def)\napply(cases \"A \\\", simp_all)\napply(simp_all add: case_prod_unfold\n split: prod.splits)\napply(drule_tac x=\"A \\\" and f=the in arg_cong, simp)\napply(rule_tac x=\"fst aa\" in exI)\napply(rule_tac x=\"snd aa\" in exI, auto)\ndone\n\n\nlemma exec_bind_SE_success'''' :\n\"\\ \\ ((s \\ A ; M s)) \\ \\ v \\'. A \\ = Some(v,\\') \\ \\' \\ (M v)\"\napply(auto simp: valid_SE_def unit_SE_def bind_SE_def)\napply(cases \"A \\\", simp_all)\napply(simp add: case_prod_unfold)\napply(drule_tac x=\"A \\\" and f=the in arg_cong, simp)\napply(rule_tac x=\"fst aa\" in exI)\napply(rule_tac x=\"snd aa\" in exI, auto)\ndone\n\n\ntext{* Recall \\verb+mbind_unit+ for the base case. *}\n\nlemma exec_mbindFSave_failure:\n\"ioprog a \\ = None \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e (a#S) ioprog ; M s)) = (\\ \\ (M []))\"\nby(simp add: valid_SE_def unit_SE_def bind_SE_def)\n\nlemma exec_mbindFStop_failure:\n\"ioprog a \\ = None \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p (a#S) ioprog ; M s)) = (False)\"\nby(simp add: exec_bind_SE_failure)\n\nlemma exec_mbindFPurge_failure:\n\"ioprog a \\ = None \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e (a#S) ioprog ; M s)) = (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e (S) ioprog ; M s))\"\nby(simp add: valid_SE_def unit_SE_def bind_SE_def mbind''.simps)\n\n\nlemma exec_mbindFSave_success :\n\"ioprog a \\ = Some(b,\\') \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e (a#S) ioprog ; M s)) =\n (\\' \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e S ioprog ; M (b#s)))\"\nunfolding valid_SE_def unit_SE_def bind_SE_def\nby(cases \"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e S ioprog \\'\", auto)\n\nlemma exec_mbindFStop_success :\n\"ioprog a \\ = Some(b,\\') \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p (a#S) ioprog ; M s)) =\n (\\' \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p S ioprog ; M (b#s)))\"\nunfolding valid_SE_def unit_SE_def bind_SE_def\nby(cases \"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p S ioprog \\'\", auto simp: mbind'.simps)\n\nlemma exec_mbindFPurge_success :\n\"ioprog a \\ = Some(b,\\') \\\n (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e (a#S) ioprog ; M s)) =\n (\\' \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e S ioprog ; M (b#s)))\"\nunfolding valid_SE_def unit_SE_def bind_SE_def\nby(cases \"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e S ioprog \\'\", auto simp: mbind''.simps)\n\nlemma exec_mbindFSave:\n\"(\\ \\ (s \\ mbind (a#S) ioprog ; return (P s))) =\n (case ioprog a \\ of\n None \\ (\\ \\ (return (P [])))\n | Some(b,\\') \\ (\\' \\ (s \\ mbind S ioprog ; return (P (b#s)))))\"\napply(case_tac \"ioprog a \\\")\nby(auto simp: exec_mbindFSave_failure exec_mbindFSave_success split: prod.splits)\n\n\ntext{* Universal splitting and symbolic execution rule *}\nlemma exec_mbindFSave_E:\nassumes seq : \"(\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e (a#S) ioprog ; (P s)))\"\n and none: \"ioprog a \\ = None \\ (\\ \\ (P [])) \\ Q\"\n and some: \"\\ b \\'. ioprog a \\ = Some(b,\\') \\ (\\' \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e S ioprog;(P (b#s)))) \\ Q \"\nshows \"Q\"\nusing seq\nproof(cases \"ioprog a \\\")\n case None assume ass:\"ioprog a \\ = None\" show \"Q\"\n apply(rule none[OF ass])\n apply(insert ass, erule_tac ioprog1=ioprog in exec_mbindFSave_failure[THEN iffD1],rule seq)\n done\nnext\n case (Some aa) assume ass:\"ioprog a \\ = Some aa\" show \"Q\"\n apply(insert ass,cases \"aa\",simp, rename_tac \"out\" \"\\'\")\n apply(erule some)\n apply(insert ass,simp)\n apply(erule_tac ioprog1=ioprog in exec_mbindFSave_success[THEN iffD1],rule seq)\n done\nqed\n\ntext{* The next rule reveals the particular interest in deduction;\n as an elimination rule, it allows for a linear conversion of a validity judgement\n @{term \"mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p\"} over an input list @{term \"S\"} into a constraint system; without any\n branching ... Symbolic execution can even be stopped tactically whenever\n @{term \"ioprog a \\ = Some(b,\\')\"} comes to a contradiction. *}\nlemma exec_mbindFStop_E:\nassumes seq : \"(\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p (a#S) ioprog ; (P s)))\"\n and some: \"\\b \\'. ioprog a \\ = Some(b,\\') \\ (\\'\\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p S ioprog;(P(b#s)))) \\ Q\"\nshows \"Q\"\nusing seq\nproof(cases \"ioprog a \\\")\n case None assume ass:\"ioprog a \\ = None\" show \"Q\"\n apply(insert ass seq)\n apply(drule_tac \\=\\ and S=S and M=P in exec_mbindFStop_failure, simp)\n done\nnext\n case (Some aa) assume ass:\"ioprog a \\ = Some aa\" show \"Q\"\n apply(insert ass,cases \"aa\",simp, rename_tac \"out\" \"\\'\")\n apply(erule some)\n apply(insert ass,simp)\n apply(erule_tac ioprog1=ioprog in exec_mbindFStop_success[THEN iffD1],rule seq)\n done\nqed\n\n\nlemma exec_mbindFPurge_E:\nassumes seq : \"(\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e (a#S) ioprog ; (P s)))\"\n and none: \"ioprog a \\ = None \\ (\\ \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e S ioprog;(P (s)))) \\ Q\"\n and some: \"\\ b \\'. ioprog a \\ = Some(b,\\') \\ (\\' \\ (s \\ mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>P\\<^sub>u\\<^sub>r\\<^sub>g\\<^sub>e S ioprog;(P (b#s)))) \\ Q \"\nshows \"Q\"\nusing seq\nproof(cases \"ioprog a \\\")\n case None assume ass:\"ioprog a \\ = None\" show \"Q\"\n apply(rule none[OF ass])\n apply(insert ass, erule_tac ioprog1=ioprog in exec_mbindFPurge_failure[THEN iffD1],rule seq)\n done\nnext\n case (Some aa) assume ass:\"ioprog a \\ = Some aa\" show \"Q\"\n apply(insert ass,cases \"aa\",simp, rename_tac \"out\" \"\\'\")\n apply(erule some)\n apply(insert ass,simp)\n apply(erule_tac ioprog1=ioprog in exec_mbindFPurge_success[THEN iffD1],rule seq)\n done\nqed\n\n\nlemma assert_disch1 :\" P \\ \\ (\\ \\ (x \\ assert\\<^sub>S\\<^sub>E P; M x)) = (\\ \\ (M True))\"\nby(auto simp: bind_SE_def assert_SE_def valid_SE_def)\n\nlemma assert_disch2 :\" \\ P \\ \\ \\ (\\ \\ (x \\ assert\\<^sub>S\\<^sub>E P ; M s))\"\nby(auto simp: bind_SE_def assert_SE_def valid_SE_def)\n\nlemma assert_disch3 :\" \\ P \\ \\ \\ (\\ \\ (assert\\<^sub>S\\<^sub>E P))\"\nby(auto simp: bind_SE_def assert_SE_def valid_SE_def)\n\nlemma assert_D : \"(\\ \\ (x \\ assert\\<^sub>S\\<^sub>E P; M x)) \\ P \\ \\ (\\ \\ (M True))\"\nby(auto simp: bind_SE_def assert_SE_def valid_SE_def split: HOL.if_split_asm)\n\nlemma assume_D : \"(\\ \\ (x \\ assume\\<^sub>S\\<^sub>E P; M x)) \\ \\ \\. (P \\ \\ \\ \\ (M ()))\"\napply(auto simp: bind_SE_def assume_SE_def valid_SE_def split: HOL.if_split_asm)\napply(rule_tac x=\"Eps P\" in exI, auto)\napply(rule_tac x=\"True\" in exI, rule_tac x=\"b\" in exI)\napply(subst Hilbert_Choice.someI,assumption,simp)\napply(subst Hilbert_Choice.someI,assumption,simp)\ndone\ntext{* These two rule prove that the SE Monad in connection with the notion of valid sequence\nis actually sufficient for a representation of a Boogie-like language. The SBE monad with explicit\nsets of states --- to be shown below --- is strictly speaking not necessary (and will therefore\nbe discontinued in the development). *}\n\nterm \"if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi\"\n\nlemma if_SE_D1 : \"P \\ \\ (\\ \\ (if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi)) = (\\ \\ B\\<^sub>1)\"\nby(auto simp: if_SE_def valid_SE_def)\n\nlemma if_SE_D2 : \"\\ P \\ \\ (\\ \\ (if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi)) = (\\ \\ B\\<^sub>2)\"\nby(auto simp: if_SE_def valid_SE_def)\n\nlemma if_SE_split_asm : \" (\\ \\ (if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi)) = ((P \\ \\ (\\ \\ B\\<^sub>1)) \\ (\\ P \\ \\ (\\ \\ B\\<^sub>2)))\"\nby(cases \"P \\\",auto simp: if_SE_D1 if_SE_D2)\n\nlemma if_SE_split : \" (\\ \\ (if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi)) = ((P \\ \\ (\\ \\ B\\<^sub>1)) \\ (\\ P \\ \\ (\\ \\ B\\<^sub>2)))\"\nby(cases \"P \\\", auto simp: if_SE_D1 if_SE_D2)\n\n\nlemma if_SE_execE:\n assumes A: \"\\ \\ (if\\<^sub>S\\<^sub>E P then B\\<^sub>1 else B\\<^sub>2 fi)\"\n and B: \"P \\ \\ \\ \\ B\\<^sub>1 \\ Q\"\n and C: \"\\ P \\\\ \\ \\ B\\<^sub>2 \\ Q\"\n shows \"Q\"\nby(insert A [simplified if_SE_split],cases \"P \\\", simp_all, auto elim: B C)\n\n\n\n\n\ntext{* Test-Refinements will be stated in terms of the failsave @{term mbind}, opting\n more generality. The following lemma allows for an optimization both in\n test execution as well as in symbolic execution for an important special case of\n the post-codition: Whenever the latter has the constraint that the length of input and\n output sequence equal each other (that is to say: no failure occured), failsave mbind\n can be reduced to failstop mbind ... *}\nlemma mbindFSave_vs_mbindFStop :\n \"(\\ \\ (os \\ (mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e \\s ioprog); return(length \\s = length os \\ P \\s os))) =\n (\\ \\ (os \\ (mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p \\s ioprog); return(P \\s os)))\"\n apply(rule_tac x=P in spec)\n apply(rule_tac x=\\ in spec)\n proof(induct \"\\s\")\n case Nil show ?case by(simp_all add: mbind_try try_SE_def del: Monads.mbind.simps)\n case (Cons a \\s) show ?case\n apply(rule allI, rename_tac \"\\\",rule allI, rename_tac \"P\")\n apply(insert Cons.hyps)\n apply(case_tac \"ioprog a \\\")\n apply(simp only: exec_mbindFSave_failure exec_mbindFStop_failure, simp)\n apply(simp add: split_paired_all del: Monads.mbind.simps )\n apply(rename_tac \"\\'\")\n apply(subst exec_mbindFSave_success, assumption)\n apply(subst (2) exec_bind_SE_success, assumption)\n apply(erule_tac x=\"\\'\" in allE)\n apply(erule_tac x=\"\\\\s s. P (a # \\s) (aa # s)\" in allE) (* heureka ! *)\n apply(simp)\n done\n qed\n\n\nlemma mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e_vs_mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p:\nassumes A: \"\\ \\ \\. ioprog \\ \\ \\ None\"\nshows \"(\\ \\ (os \\ (mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e \\s ioprog); P os)) =\n (\\ \\ (os \\ (mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p \\s ioprog); P os))\"\nproof(induct \"\\s\") print_cases\n case Nil show ?case by simp\nnext\n case (Cons a \\s)\n from Cons.hyps\n have B:\"\\ S f \\. mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e S f \\ \\ None \" by simp\n have C:\"\\\\. mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>t\\<^sub>o\\<^sub>p \\s ioprog \\ = mbind\\<^sub>F\\<^sub>a\\<^sub>i\\<^sub>l\\<^sub>S\\<^sub>a\\<^sub>v\\<^sub>e \\s ioprog \\\"\n apply(induct \\s, simp)\n apply(rule allI,rename_tac \"\\\")\n apply(simp add: Monads.mbind'.simps(2))\n apply(insert A, erule_tac x=\"a\" in allE)\n apply(erule_tac x=\"\\\" and P=\"\\\\ . ioprog a \\ \\ None\" in allE)\n apply(auto split:option.split)\n done\n show ?case\n apply(insert A,erule_tac x=\"a\" in allE,erule_tac x=\"\\\" in allE)\n apply(simp, elim exE)\n apply(rename_tac \"out\" \"\\'\")\n apply(insert B, erule_tac x=\\s in allE, erule_tac x=ioprog in allE, erule_tac x=\\' in allE)\n apply(subst(asm) not_None_eq, elim exE)\n apply(subst Monads.exec_bind_SE_success)\n apply(simp split: option.split, auto)\n apply(rule_tac s=\"(\\ a b c. a # (fst c)) out \\' (aa, b)\" in trans, simp,rule refl)\n apply(rule_tac s=\"(\\ a b c. (snd c)) out \\' (aa, b)\" in trans, simp,rule refl)\n apply(simp_all)\n apply(subst Monads.exec_bind_SE_success, assumption)\n apply(subst Monads.exec_bind_SE_success)\n apply(rule_tac s=\"Some (aa, b)\" in trans,simp_all add:C)\n apply(subst(asm) Monads.exec_bind_SE_success, assumption)\n apply(subst(asm) Monads.exec_bind_SE_success)\n apply(rule_tac s=\"Some (aa, b)\" in trans,simp_all add:C)\n done\nqed\n\n\nsection{* Valid Test Sequences in the State Exception Backtrack Monad *}\ntext{* This is still an unstructured merge of executable monad concepts\nand specification oriented high-level properties initiating test procedures. *}\n\ndefinition valid_SBE :: \"'\\ \\ ('a,'\\) MON\\<^sub>S\\<^sub>B\\<^sub>E \\ bool\" (infix \"\\\\<^sub>S\\<^sub>B\\<^sub>E\" 15)\nwhere \"\\ \\\\<^sub>S\\<^sub>B\\<^sub>E m \\ (m \\ \\ None)\"\ntext{* This notation consideres all non-failures as valid. *}\n\n\nlemma assume_assert: \"(\\ \\\\<^sub>S\\<^sub>B\\<^sub>E ( _ :\\ assume\\<^sub>S\\<^sub>B\\<^sub>E P ; assert\\<^sub>S\\<^sub>B\\<^sub>E Q)) = (P \\ \\ Q \\)\"\n by(simp add: valid_SBE_def assume_SBE_def assert_SBE_def bind_SBE_def)\n\n\n\nlemma assume_dest:\n \"\\ \\ \\\\<^sub>S\\<^sub>B\\<^sub>E (x :\\ assume\\<^sub>S\\<^sub>B\\<^sub>E Q; M x); Q \\' \\ \\ \\ \\\\<^sub>S\\<^sub>B\\<^sub>E M ()\"\n apply(auto simp: valid_SBE_def assume_SBE_def assert_SBE_def bind_SBE_def)\n apply(cases \"Q \\\",simp_all)\n oops\n\ntext{* This still needs work. What would be needed is a kind\n of wp - calculus that comes out of that. So far: nope. *}\n\nsubsection{* Legacy Bindings *}\n\n\nlemma valid_true[simp]: (* legacy: special case *)\n \"(\\ \\ (s \\ return x ; return (P s))) = P x\" by simp\n\n\n(*\nlemmas valid_both = exec_mbindFSave (* legacy *)\nlemmas valid_success = exec_mbindFSave_success (* legacy *)\nlemmas valid_success'' = exec_mbindFSave_success(* legacy *)\nlemmas valid_success' = exec_bind_SE_success (* legacy *)\nlemmas valid_failure = exec_mbindFSave_failure (* legacy : *)\nlemmas valid_failure' = exec_bind_SE_failure (* legacy *)\nlemmas valid_failure''=valid_failure (* legacy : *)\nlemmas valid_failure''' = exec_mbindFStop_failure (* legacy : *)\nlemmas valid_propagate_fail = exec_fail_SE (* legacy *)\nlemmas valid_propagate_fail' = exec_fail_SE' (* legacy *)\nlemmas valid_propoagate_3' = valid_propagate_fail' (* legacy *)\nlemmas valid_propagate_2 = exec_bind_SE_success''(* legacy *)\nlemmas valid_propagate_1 = exec_unit_SE (* legacy *)\nlemmas valid_successElem = exec_bind_SE_success' (* legacy *)\nlemmas valid_propagate_2' = exec_bind_SE_success'''(* legacy *)\nlemmas valid_propagate_2'' = exec_bind_SE_success'''' (* legacy *)\nlemmas valid_propoagate_3 = exec_unit_SE' (* legacy *)\n *)\n(* legacy ?:\nlemma valid_success'':\n\"ioprog a \\ = Some(b,\\') \\\n (\\ \\ (s \\ mbind (a#S) ioprog ; return (P s))) =\n (\\' \\ (s \\ mbind S ioprog ; return (P (b#s))))\"\nunfolding valid_SE_def unit_SE_def bind_SE_def\nby(cases \"mbind S ioprog \\'\", auto)\n*)\n\nend\n", "meta": {"author": "object-logics", "repo": "citadelle-devel", "sha": "fd4d57977d1a8a7330ae7d8651d003789980c802", "save_path": "github-repos/isabelle/object-logics-citadelle-devel", "path": "github-repos/isabelle/object-logics-citadelle-devel/citadelle-devel-fd4d57977d1a8a7330ae7d8651d003789980c802/examples/archive/Monads.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2811792492820484}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m3_ds_par.thy (Isabelle/HOL 2016-1)\n ID: $Id: m3_ds_par.thy 132890 2016-12-24 10:25:57Z csprenge $\n Authors: Christoph Sprenger, ETH Zurich \n Ivano Somaini, ETH Zurich \n\n Key distribution protocols\n Level 3: parallel version of Denning-Sacco protocol\n\n Copyright (c) 2009-2016 Christoph Sprenger, Ivano Somaini\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Denning-Sacco, direct variant (L3)\\\n\ntheory m3_ds_par imports m2_ds \"../Refinement/Message\"\nbegin\n\ntext \\\nWe model a direct implementation of the channel-based Denning-Sacco protocol\nat Level 2. In this version, there is no ticket forwarding.\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B \\\\ \n \\mathrm{M2a.} & S \\rightarrow A: & \\{Kab, B, Ts\\}_{Kas} \\\\\n \\mathrm{M2b.} & S \\rightarrow B: & \\{Kab, A, Ts\\}_{Kbs}\n\\end{array}\n\\]\n\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\.\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\Setup\\\n(******************************************************************************)\n\ntext \\Now we can define the initial key knowledge.\\\n\noverloading ltkeySetup' \\ ltkeySetup begin\ndefinition ltkeySetup_def: \"ltkeySetup' \\ {(sharK C, A) | C A. A = C \\ A = Sv}\"\nend\n\nlemma corrKey_shrK_bad [simp]: \"corrKey = shrK`bad\"\nby (auto simp add: keySetup_def ltkeySetup_def corrKey_def)\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\The secure channels are star-shaped to/from the server. Therefore,\nwe have only one agent in the relation.\\\n\nrecord m3_state = \"m1_state\" +\n IK :: \"msg set\" \\ \\intruder knowledge\\\n\n\ntext \\Observable state:\n@{term \"runs\"}, @{term \"leak\"}, @{term \"clk\"}, and @{term \"cache\"}.\\\n\ntype_synonym\n m3_obs = \"m2_obs\"\n\ndefinition\n m3_obs :: \"m3_state \\ m3_obs\" where\n \"m3_obs s \\ \\ runs = runs s, leak = leak s, clk = clk s \\\"\n\ntype_synonym\n m3_pred = \"m3_state set\"\n\ntype_synonym\n m3_trans = \"(m3_state \\ m3_state) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext \\Protocol events.\\\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m2_step1\"}\\\n m3_step1 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step1 Ra A B \\ {(s, s1).\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n\n \\ \\actions:\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n IK := insert \\Agent A, Agent B\\ (IK s) \\ \\send \\M1\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m2_step2\"}\\\n m3_step2 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step2 \\ m1_step2\"\n\ndefinition \\ \\by @{text \"Server\"}, refines @{term m2_step3}\\\n m3_step3 :: \"[rid_t, agent, agent, key, time] \\ m3_trans\"\nwhere\n \"m3_step3 Rs A B Kab Ts \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh server run\\\n Kab = sesK (Rs$sk) \\ \\ \\fresh session key\\\n\n \\Agent A, Agent B\\ \\ IK s \\ \\ \\recv \\M1\\\\\n Ts = clk s \\ \\ \\fresh timestamp\\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M2\\\\\n s1 = s\\\n runs := (runs s)(Rs \\ (Serv, [A, B], [aNum Ts])), \\ \\send \\M2a\\, \\M2b\\\\\n IK := insert (Crypt (shrK A) \\Agent B, Key Kab, Number Ts\\)\n (insert (Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\) (IK s))\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step4}\\\n m3_step4 :: \"[rid_t, agent, agent, key, time] \\ m3_trans\"\nwhere\n \"m3_step4 Ra A B Kab Ts \\ {(s, s1).\n\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n Crypt (shrK A) \\ \\recv \\M2\\\\\n \\Agent B, Key Kab, Number Ts\\ \\ IK s \\\n\n \\ \\check freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts]))\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m2_step5}\\\n m3_step5 :: \"[rid_t, agent, agent, key, time] \\ m3_trans\"\nwhere\n \"m3_step5 Rb A B Kab Ts \\ {(s, s1).\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\ \\ IK s \\ \\ \\recv \\M3\\\\\n\n \\ \\ensure freshness of session key; replays with fresh authenticator ok!\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, aNum Ts]))\n \\\n }\"\n\n\ntext \\Clock tick event\\\n\ndefinition \\ \\refines @{term \"m2_tick\"}\\\n m3_tick :: \"time \\ m3_trans\"\nwhere\n \"m3_tick \\ m1_tick\"\n\n\ntext \\Session key compromise.\\\n\ndefinition \\ \\refines @{term m2_leak}\\\n m3_leak :: \"rid_t \\ m3_trans\"\nwhere\n \"m3_leak Rs \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\\n fst (the (runs s Rs)) = Serv \\ \\ \\compromise server run \\Rs\\\\\n\n \\ \\actions:\\\n \\ \\record session key as leaked and add it to intruder knowledge\\\n s1 = s\\ leak := insert (sesK (Rs$sk)) (leak s),\n IK := insert (Key (sesK (Rs$sk))) (IK s) \\\n }\"\n\ntext \\Intruder fake event. The following \"Dolev-Yao\" event generates all\nintruder-derivable messages.\\\n\ndefinition \\ \\refines @{term \"m2_fake\"}\\\n m3_DY_fake :: \"m3_trans\"\nwhere\n \"m3_DY_fake \\ {(s, s1).\n\n \\ \\actions:\\\n s1 = s\\ IK := synth (analz (IK s)) \\ \\ \\take DY closure\\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\ndefinition\n m3_init :: \"m3_pred\"\nwhere\n \"m3_init \\ { \\\n runs = Map.empty,\n leak = shrK`bad,\n clk = 0,\n IK = Key`shrK`bad\n \\ }\"\n\ndefinition\n m3_trans :: \"m3_trans\" where\n \"m3_trans \\ (\\A B Ra Rb Rs Kab Ts T.\n m3_step1 Ra A B \\\n m3_step2 Rb A B \\\n m3_step3 Rs A B Kab Ts \\\n m3_step4 Ra A B Kab Ts \\\n m3_step5 Rb A B Kab Ts \\\n m3_tick T \\\n m3_leak Rs \\\n m3_DY_fake \\\n Id\n )\"\n\ndefinition\n m3 :: \"(m3_state, m3_obs) spec\" where\n \"m3 \\ \\\n init = m3_init,\n trans = m3_trans,\n obs = m3_obs\n \\\"\n\nlemmas m3_loc_defs =\n m3_def m3_init_def m3_trans_def m3_obs_def\n m3_step1_def m3_step2_def m3_step3_def m3_step4_def m3_step5_def\n m3_tick_def m3_leak_def m3_DY_fake_def\n\nlemmas m3_defs = m3_loc_defs m2_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\ntext \\Specialized injection that we can apply more aggressively.\\\n\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\n\ndeclare parts_Inj_IK [dest!]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\inv1: Secrecy of pre-distributed shared keys\\\n(******************************************************************************)\n\ndefinition\n m3_inv1_lkeysec :: \"m3_pred\"\nwhere\n \"m3_inv1_lkeysec \\ {s. \\C.\n (Key (shrK C) \\ parts (IK s) \\ C \\ bad) \\\n (C \\ bad \\ Key (shrK C) \\ IK s)\n }\"\n\nlemmas m3_inv1_lkeysecI = m3_inv1_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_lkeysecE [elim] = m3_inv1_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_lkeysecD = m3_inv1_lkeysec_def [THEN setc_def_to_dest, rule_format]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv1_lkeysec_init [iff]:\n \"init m3 \\ m3_inv1_lkeysec\"\nby (auto simp add: m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec_trans [iff]:\n \"{m3_inv1_lkeysec} trans m3 {> m3_inv1_lkeysec}\"\nby (fastforce simp add: PO_hoare_defs m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec [iff]: \"reach m3 \\ m3_inv1_lkeysec\"\nby (rule inv_rule_incr) (fast+)\n\n\ntext \\Useful simplifier lemmas\\\n\nlemma m3_inv1_lkeysec_for_parts [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ parts (IK s) \\ C \\ bad\"\nby auto\n\nlemma m3_inv1_lkeysec_for_analz [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ analz (IK s) \\ C \\ bad\"\nby auto\n\n\nsubsubsection \\inv3: Session keys not used to encrypt other session keys\\\n(******************************************************************************)\n\ntext \\Session keys are not used to encrypt other keys. Proof requires\ngeneralization to sets of session keys.\n\nNOTE: This invariant will be derived from the corresponding L2 invariant\nusing the simulation relation.\n\\\n\ndefinition\n m3_inv3_sesK_compr :: \"m3_pred\"\nwhere\n \"m3_inv3_sesK_compr \\ {s. \\K KK.\n KK \\ range sesK \\\n (Key K \\ analz (Key`KK \\ (IK s))) = (K \\ KK \\ Key K \\ analz (IK s))\n }\"\n\nlemmas m3_inv3_sesK_comprI = m3_inv3_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_sesK_comprE = m3_inv3_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_sesK_comprD = m3_inv3_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Additional lemma\\\nlemmas insert_commute_Key = insert_commute [where x=\"Key K\" for K]\n\nlemmas m3_inv3_sesK_compr_simps =\n m3_inv3_sesK_comprD\n m3_inv3_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n m3_inv3_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n insert_commute_Key\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\nsubsubsection \\Message abstraction and simulation relation\\\n(******************************************************************************)\n\ntext \\Abstraction function on sets of messages.\\\n\ninductive_set\n abs_msg :: \"msg set \\ chmsg set\"\n for H :: \"msg set\"\nwhere\n am_M1:\n \"\\Agent A, Agent B\\ \\ H\n \\ Insec A B (Msg []) \\ abs_msg H\"\n| am_M2a:\n \"Crypt (shrK C) \\Agent B, Key K, Number T\\ \\ H\n \\ Secure Sv C (Msg [aAgt B, aKey K, aNum T]) \\ abs_msg H\"\n| am_M2b:\n \"Crypt (shrK C) \\Key K, Agent A, Number T\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt A, aNum T]) \\ abs_msg H\"\n\n\ntext \\R23: The simulation relation. This is a data refinement of\nthe insecure and secure channels of refinement 2.\\\n\ndefinition\n R23_msgs :: \"(m2_state \\ m3_state) set\" where\n \"R23_msgs \\ {(s, t). abs_msg (parts (IK t)) \\ chan s }\"\n\ndefinition\n R23_keys :: \"(m2_state \\ m3_state) set\" where\n \"R23_keys \\ {(s, t). \\KK K. KK \\ range sesK \\\n Key K \\ analz (Key`KK \\ (IK t)) \\ aKey K \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_pres :: \"(m2_state \\ m3_state) set\" where\n \"R23_pres \\ {(s, t). runs s = runs t \\ leak s = leak t \\ clk s = clk t}\"\n\ndefinition\n R23 :: \"(m2_state \\ m3_state) set\" where\n \"R23 \\ R23_msgs \\ R23_keys \\ R23_pres\"\n\nlemmas R23_defs =\n R23_def R23_msgs_def R23_keys_def R23_pres_def\n\n\ntext \\The mediator function is the identity here.\\\n\ndefinition\n med32 :: \"m3_obs \\ m2_obs\" where\n \"med32 \\ id\"\n\n\nlemmas R23_msgsI = R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_keysI = R23_keys_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_keysE [elim] = R23_keys_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_presI = R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_keysI R23_presI\n\n\ntext \\Simplifier lemmas for various instantiations (for keys).\\\n\nlemmas R23_keys_simp = R23_keys_def [THEN rel_def_to_dest, simplified, rule_format]\nlemmas R23_keys_simps =\n R23_keys_simp\n R23_keys_simp [where KK=\"{}\", simplified]\n R23_keys_simp [where KK=\"{K'}\" for K', simplified]\n R23_keys_simp [where KK=\"insert K' KK\" for K' KK, simplified, OF _ conjI]\n\n\nsubsubsection \\General lemmas\\\n(******************************************************************************)\n\ntext \\General facts about @{term \"abs_msg\"}\\\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n \"abs_msg (G \\ H) = abs_msg G \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n \"\\ m \\ abs_msg G; G \\ H \\ \\ m \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n \"\\ m \\ abs_msg H \\ \\ m \\ abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\Facts about @{term \"abs_msg\"} concerning abstraction of fakeable\nmessages. This is crucial for proving the refinement of the intruder event.\\\n\nlemma abs_msg_DY_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs; (s, t) \\ R23_keys; t \\ m3_inv1_lkeysec \\\n \\ abs_msg (synth (analz (IK t))) \\ fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n\\ \\4 subgoals, deal with replays first\\\napply (blast)\ndefer 1 apply (blast)\n\\ \\remaining 2 subgoals are real fakes\\\napply (rule fake_StatCh, auto simp add: R23_keys_simps)+\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\ntext \\Pair decomposition. These were set to \\texttt{elim!}, which is too\nagressive here.\\\n\ndeclare MPair_analz [rule del, elim]\ndeclare MPair_parts [rule del, elim]\n\n\ntext \\Protocol events.\\\n\nlemma PO_m3_step1_refines_m2_step1:\n \"{R23}\n (m2_step1 Ra A B), (m3_step1 Ra A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n \"{R23}\n (m2_step2 Rb A B), (m3_step2 Rb A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step3_refines_m2_step3:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv3_sesK_compr \\ m3_inv1_lkeysec)}\n (m2_step3 Rs A B Kab Ts), (m3_step3 Rs A B Kab Ts)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_pres\"\n \"s \\ m2_inv3a_sesK_compr\" \"t \\ m3_inv3_sesK_compr\" \"t \\ m3_inv1_lkeysec\"\n \"Kab = sesK (Rs$sk)\" \"Rs \\ dom (runs t)\"\n \"\\ Agent A, Agent B \\ \\ parts (IK t)\"\n let ?s'=\n \"s\\ runs := runs s(Rs \\ (Serv, [A, B], [aNum (clk t)])),\n chan := insert (Secure Sv A (Msg [aAgt B, aKey Kab, aNum (clk t)]))\n (insert (Secure Sv B (Msg [aKey Kab, aAgt A, aNum (clk t)])) (chan s)) \\\"\n let ?t'=\n \"t\\ runs := runs t(Rs \\ (Serv, [A, B], [aNum (clk t)])),\n IK := insert\n (Crypt (shrK A) \\ Agent B, Key Kab, Number (clk t) \\)\n (insert\n (Crypt (shrK B) \\ Key Kab, Agent A, Number (clk t) \\)\n (IK t)) \\\"\n have \"(?s', ?t') \\ R23_msgs\" using H\n by (-) (rule R23_intros, auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\" using H\n by (-) (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv3_sesK_compr_simps,\n auto simp add: R23_keys_simps)\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (-) (rule R23_intros, auto)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs)\nqed\n\nlemma PO_m3_step4_refines_m2_step4:\n \"{R23 \\ UNIV \\ (m3_inv1_lkeysec)}\n (m2_step4 Ra A B Kab Ts), (m3_step4 Ra A B Kab Ts)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step5_refines_m2_step5:\n \"{R23}\n (m2_step5 Rb A B Kab Ts), (m3_step5 Rb A B Kab Ts)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_tick_refines_m2_tick:\n \"{R23}\n (m2_tick T), (m3_tick T)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\n\ntext \\Intruder events.\\\n\nlemma PO_m3_leak_refines_m2_leak:\n \"{R23}\n (m2_leak Rs), (m3_leak Rs)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto simp add: R23_keys_simps)\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n \"{R23 \\ UNIV \\ (m3_inv1_lkeysec)}\n m2_fake, m3_DY_fake\n {> R23}\"\napply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros\n del: abs_msg.cases)\napply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]\n del: abs_msg.cases)\napply (auto simp add: R23_keys_simps)\ndone\n\n\ntext \\All together now...\\\n\nlemmas PO_m3_trans_refines_m2_trans =\n PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n PO_m3_step3_refines_m2_step3 PO_m3_step4_refines_m2_step4\n PO_m3_step5_refines_m2_step5 PO_m3_tick_refines_m2_tick\n PO_m3_leak_refines_m2_leak PO_m3_DY_fake_refines_m2_fake\n\n\nlemma PO_m3_refines_init_m2 [iff]:\n \"init m3 \\ R23``(init m2)\"\nby (auto simp add: R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv3_sesK_compr \\ m3_inv1_lkeysec)}\n (trans m2), (trans m3)\n {> R23}\"\nby (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\n (blast intro!: PO_m3_trans_refines_m2_trans)+\n\nlemma PO_m3_observation_consistent [iff]:\n \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m3_defs)\n\n\ntext \\Refinement result.\\\n\nlemma m3_refines_m2 [iff]:\n \"refines\n (R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv1_lkeysec))\n med32 m2 m3\"\nproof -\n have \"R23 \\ m2_inv3a_sesK_compr \\ UNIV \\ UNIV \\ m3_inv3_sesK_compr\"\n by (auto simp add: R23_def R23_keys_simps intro!: m3_inv3_sesK_comprI)\n thus ?thesis\n by (-) (rule Refinement_using_invariants, auto)\nqed\n\nlemma m3_implements_m2 [iff]:\n \"implements med32 m2 m3\"\nby (rule refinement_soundness) (auto)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m3_ds_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.28117924283107915}} {"text": "(* Title: HOL/Auth/n_mutualExDeadFree_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExDeadFree Protocol Case Study*} \n\ntheory n_mutualExDeadFree_lemma_invs_on_rules imports n_mutualExDeadFree_lemma_inv__2_on_rules n_mutualExDeadFree_lemma_inv__3_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_mutualExDeadFree/n_mutualExDeadFree_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.28113903951804775}} {"text": "(*****************************************************************************\n * ESPL --- an embedded security protocol logic\n * http://people.inf.ethz.ch/meiersi/espl/\n *\n * Copyright (c) 2009-2011, Simon Meier, ETH Zurich, Switzerland\n *\n * Extension to compromising adversaries:\n *\n * Copyright (c) 2010-2011, Martin Schaub, ETH Zurich, Switzerland\n *\n * All rights reserved. See file LICENCE for more information.\n ******************************************************************************)\ntheory WeakTyping\nimports\n InferenceRules\n Syntax\nbegin\n\nsection{* A Shallow Embedding of a Message Type System *}\n\nsubsection{* Introduction *}\n\ntext{*\n The goal of this theory is to develop a simple way for specifying\n type invariants for the message variables of a protocol. A message\n type is a set of messages that depends on the thread and the \n system state that this message type is interpreted relative to.\n \n A typing is then a function assigning to each combination of a\n role and an identifier of a message variable in this role a \n message type. \n\n Each typing approximates the set of states where all instantiated\n message variables are instantiated with a message corresponding \n to their type.\n*}\n\ntype_synonym msgtype = \"tid \\ state \\ execmsg set\"\n\ntype_synonym typing = \"(role \\ id) \\ msgtype\"\n\ndefinition approx :: \"typing \\ state set\"\nwhere \"approx typing \\ {q. case q of (t,r,s) \\\n \\ (i,step) \\ steps t. \n \\ R. roleMap r i = Some R \\\n (\\ n. MVar n \\ FV_rolestep step \\\n s (MVar n, i) \\ typing (R, n) i (t,r,s)\n )}\"\n\nlocale typed_state = reachable_state+\n fixes typing :: \"typing\"\n assumes approximates: \"(t,r,s) \\ approx typing\"\n\nlocale typed_thread = reachable_thread+\n fixes typing :: \"typing\"\n assumes approximates: \"(t,r,s) \\ approx typing\"\n\nsublocale typed_thread \\ typed_state\n using approximates by unfold_locales\n\n\nlemma approx_unfold:\n \"((t,r,s) \\ approx typing) = \n (\\ (i,step) \\ steps t. \n \\ R. roleMap r i = Some R \\\n (\\ n. MVar n \\ FV_rolestep step \\\n s (MVar n, i) \\ typing (R, n) i (t,r,s)))\"\nby (auto simp: approx_def)\n\nlemma in_approxI:\n assumes all_vars:\n \"\\ i step R n.\n \\ (i,step) \\ steps t;\n roleMap r i = Some R;\n MVar n \\ FV_rolestep step\n \\\n \\ s (MV n i) \\ typing (R, n) i (t,r,s)\"\n shows \"(t,r,s) \\ approx typing\"\nby (auto simp: approx_unfold dest!: all_vars)\n\nlemma in_approxD:\n assumes approx: \"(t,r,s) \\ approx typing\"\n and asms: \"(i,step) \\ steps t\"\n \"roleMap r i = Some R\"\n \"MVar n \\ FV_rolestep step\"\n shows \"s (MV n i) \\ typing (R, n) i (t,r,s)\"\nusing approx asms\nby (auto simp: approx_unfold)\n\n\nsubsection{* A Combinator Language for Message Types *}\n\nsubsubsection{* Structural Types *}\n\ntext{*\n Structural message types specify the structure of a message.\n Their interpretation is independent of the thread that they\n are interpreted in. All of them except the type for nonces of\n a specific role are also independent of the state that they\n are interpreted in.\n*}\n\ndefinition ConstT :: \"id \\ msgtype\"\nwhere \"ConstT c i q \\ { LC c }\"\n\ndefinition AgentT :: msgtype\nwhere \"AgentT i q \\ Agent\"\n\ndeclare AgentT_def [simp]\n\ndefinition NonceT :: \"role \\ id \\ msgtype\"\nwhere \"NonceT R n i q \\ case q of \n (t,r,s) \\ { LN n i' | i'. roleMap r i' = Some R }\"\n\ndefinition HashT :: \"msgtype \\ msgtype\"\nwhere \"HashT ty i q \\ { Hash m | m. m \\ ty i q }\"\n\ndefinition TupT :: \"msgtype \\ msgtype \\ msgtype\"\nwhere \"TupT ty1 ty2 i q \\ \n { \\x, y\\ | x y. x \\ ty1 i q \\ y \\ ty2 i q }\"\n\ndefinition EncT :: \"msgtype \\ msgtype \\ msgtype\"\nwhere \"EncT tym tyk i q \\ \n { Enc m k | m k. m \\ tym i q \\ k \\ tyk i q }\"\n\ndefinition PKT :: \"msgtype \\ msgtype\"\nwhere \"PKT ty i q \\ { PK m | m. m \\ ty i q }\"\n\ndefinition SKT :: \"msgtype \\ msgtype\"\nwhere \"SKT ty i q \\ { SK m | m. m \\ ty i q }\"\n\ndefinition KT :: \"msgtype \\ msgtype \\ msgtype\"\nwhere \"KT ty1 ty2 i q \\ \n { K m1 m2 | m1 m2. m1 \\ ty1 i q \\ m2 \\ ty2 i q }\"\n\ndefinition KShrT :: \"msgtype\"\nwhere \"KShrT i q \\ { KShr A | A. True }\" \n\n\ntext{* TODO: Make this syntax abbreviation work. *}\nsyntax\n \"@TTuple\" :: \"['a, args] => 'a * 'b\" (\"(2{$_,/ _$})\")\n\nsyntax (xsymbols)\n \"@TTuple\" :: \"['a, args] => 'a * 'b\" (\"(2\\$_,/ _$\\)\")\n\ntranslations\n \"{$x, y, z$}\" == \"{$x, {$y, z$}$}\" \n \"{$x, y$}\" == \"WeakTyping.TupT x y\"\n\n\nsubsubsection{* Special Types *}\n\ntext{* \n The empty type denotes that a variable is never instantiated.\n The sum type denotes the union of two message types, while\n the intersection type denotes the intersection of the two \n message types.\n*}\n\ndefinition EmptyT :: \"msgtype\"\nwhere \"EmptyT i q \\ {}\"\n\ndeclare EmptyT_def [simp]\n\ndefinition SumT :: \"msgtype \\ msgtype \\ msgtype\"\nwhere \"SumT ty1 ty2 i q \\ ty1 i q \\ ty2 i q\"\n\ndefinition InterT :: \"msgtype \\ msgtype \\ msgtype\"\nwhere \"InterT ty1 ty2 i q \\ ty1 i q \\ ty2 i q\"\n\n\ntext{*\n The known before a specific role step type captures the\n interaction of the intruder with the execution of a protocol.\n If the intruder fakes a message being received, then the\n variables are instantiated with messages known to the intruder\n \\emph{before} the receive step was executed.\n*}\n\ndefinition KnownT :: \"rolestep \\ msgtype\"\nwhere \"KnownT step i q \\ case q of (t,r,s) \\ \n { m | m. predOrd t (Ln m) (St (i,step)) }\"\n\n\nsubsubsection{* Constructing Type Invariants *}\n\ntext{*\n The following function converts a list of type assignments to a\n typing. It will be used to specify the type invariants of specific\n protocols.\n*}\n\ndefinition mk_typing :: \"((role \\ id) \\ msgtype) list \\ typing\"\nwhere \"mk_typing tyeqs \\ \n foldr (\\(x, ty) typing. typing(x:=ty)) tyeqs (\\x. EmptyT)\"\n\n\nsubsection{* Proving Well-Typedness *}\n\ntext{*\n A protocol is well-typed with respect to a typing iff\n all its reachable state are approximated by the typing.\n\n We specialize the induction scheme that we get from the definition\n of the set of reachable states to a ``type checking'' induction\n scheme. It works for message typings that are monotoneous with\n respect to state updates.\n*}\n\ndefinition monoTyp :: \"typing \\ bool\" \nwhere \"monoTyp typ \\ \n (\\ x i t r s t' r'.\n roleMap r \\\\<^sub>m roleMap r' \\\n typ x i (t,r,s) \\ typ x i (t@t',r',s)\n )\"\n\nlemma monoTypI:\n \"\\ \\ x i t r s t' r' s' m. \n \\ roleMap r \\\\<^sub>m roleMap r'; m \\ typ x i (t,r,s) \\\n \\ m \\ typ x i (t@t',r',s)\n \\ \\ monoTyp typ\"\n by(auto simp: monoTyp_def)\n\nlemma monoTypD:\n \"\\ monoTyp typ;\n m \\ typ x i (t,r,s);\n roleMap r \\\\<^sub>m roleMap r'\n \\ \\\n m \\ typ x i (t@t',r',s)\"\n unfolding monoTyp_def by blast\n\nlemma monoTyp_freeD:\n \"\\ monoTyp typ;\n m \\ typ x i (t,r,s);\n roleMap r \\\\<^sub>m roleMap r';\n t' = t@t''\n \\ \\\n m \\ typ x i (t',r',s)\"\n unfolding monoTyp_def by blast\n\nlemma monoTyp_appendD:\n \"\\ monoTyp typ;\n m \\ typ x i (t,r,s)\n \\ \\\n m \\ typ x i (t@t',r,s)\"\n by (rule monoTyp_freeD) auto\n\n\nlemma (in reachable_thread) step_done_typing:\n assumes typ_rule:\n \"\\ step.\n \\ (i, step) \\ steps t;\n MVar v \\ FV_rolestep step\n \\ \\ s (MV v i) \\ typing (done @ todo, v) i (t, r, s)\"\n and step_done: \"step \\ set done\"\n and step_var: \"MVar v \\ FV_rolestep step\"\n shows \"s (MV v i) \\ typing (done @ todo, v) i (t, r, s)\"\nproof (cases \"step \\ skipped\")\n case False\n thus ?thesis using assms by auto\nnext\n case True\n note inSkipped = this\n then obtain l ty pt\n where noteEq: \"(Note l ty pt) = step\"\n by(auto dest!: note_in_skipped)\n hence \"\\ step'. listOrd (done@todo) step' (Note l ty pt) \\ v \\ sourced_vars step'\"\n using inSkipped step_done step_var\n apply -\n apply(subgoal_tac \"v \\ used_vars step\")\n apply(subgoal_tac \"Note l ty pt \\ set (done@todo)\")\n apply(drule source_use_ord)\n by auto\n then obtain step'\n where roleBefore: \"listOrd (done@todo) step' (Note l ty pt)\"\n and varSourced: \"v \\ sourced_vars step'\"\n by auto\n have notNote: \"\\ noteStep step'\" using varSourced by auto\n have \"step' \\ set done\" \n using roleBefore step_done noteEq\n apply -\n apply(drule listOrd_append[THEN iffD1])\n apply(case_tac \"listOrd done step' (Note l ty pt)\")\n apply(fastforce dest: in_set_listOrd1)\n apply(case_tac \"listOrd todo step' (Note l ty pt)\")\n apply(fastforce dest: in_set_listOrd2 done_notin_todoD)\n apply(case_tac \"step' \\ set done \\ Note l ty pt \\ set todo\")\n by(auto dest: done_notin_todoD)\n hence \"(i, step') \\ steps t\" using notNote by (cases step', auto)\n thus ?thesis\n using varSourced by (auto intro!: typ_rule thread_exists)\nqed\n\n\nlemma (in reachable_state) reachable_in_approxI:\n assumes monoTyp: \"monoTyp typing\"\n and source_case:\n \"\\ t r s i done todo skipped m R step n.\n \\ R \\ P; \n roleMap r i = Some R;\n (done, step # todo) \\ set (splits R);\n \\ sendStep step; \\ noteStep step;\n n \\ sourced_vars step;\n \\ step' \\ set done. MVar n \\ FV_rolestep step';\n hint ''completenessCase'' (step, n);\n \n (t,r,s) \\ reachable P;\n (t,r,s) \\ approx typing;\n r i = Some (done, step # todo, skipped);\n \n recvStep step \\ Some m = inst s i (stepPat step) \\ m \\ knows t;\n matchEqStep step \\ exec_match s i (matchVar step) (stepPat step)\n \\ \\ \n s (MV n i) \\ typing (R, n) i (t @ [Step (i, step)], r(i \\ (done @ [step], todo, skipped)), s)\"\n shows \"(t,r,s) \\ approx typing\"\nproof -\n { fix i step \"done\" todo skipped n\n have\n \"\\ r i = Some (done, todo, skipped);\n (i,step) \\ steps t;\n MVar n \\ FV_rolestep step\n \\ \\ s (MV n i) \\ typing (done@todo, n) i (t,r,s)\"\n proof(induct arbitrary: i \"done\" todo step n skipped rule: reachable_induct)\n case (send t r s i \"done\" l pt todo skipped m i' done' todo' step n skipped')\n then interpret th1: \n reachable_thread P t r s i \"done\" \"Send l pt # todo\" skipped\n by unfold_locales auto\n from send \n have \"(i', step) \\ steps t \\ (i' = i) \\ step = Send l pt\"\n (is \"?old \\ ?new\") by auto\n moreover\n { assume ?old\n hence \"s(MV n i') \\ typing (done'@todo', n) i' (t,r,s)\"\n using send by (auto split: if_splits)\n hence ?case\n proof(rule monoTyp_freeD[OF monoTyp])\n qed (auto simp: th1.thread_exists)\n }\n moreover\n { let ?role = \"done @ Send l pt # todo\"\n note IH = send(2)\n assume \"?new\"\n moreover hence \"n \\ used_vars step\" using send by auto\n ultimately obtain step' \n where \"(i, step') \\ steps t\" \n \"n \\ sourced_vars step'\" \n by (fastforce dest!: th1.source_step[OF th1.thread_exists])\n hence typed: \"s (MV n i) \\ typing (?role, n) i (t, r, s)\"\n by (auto dest: IH[OF th1.thread_exists])\n have \"done'@todo' = ?role\"\n using send `?new` by auto\n hence ?case using `?new`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n by (auto intro!: typed simp: th1.thread_exists)\n }\n ultimately show ?case by fast\n next\n case (recv t r s i \"done\" l pt todo skipped m i' done' todo' step n skipped') then\n interpret th1: \n reachable_thread P t r s i \"done\" \"Recv l pt # todo\" skipped\n by unfold_locales auto\n from recv\n have \"(i', step) \\ steps t \\ (i' = i) \\ step = Recv l pt\"\n (is \"?old \\ ?new\") by auto\n moreover\n { assume ?old\n hence \"s(MV n i') \\ typing (done'@todo', n) i' (t,r,s)\"\n using recv by (auto split: if_splits)\n hence ?case using `?old`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n apply(auto simp: th1.thread_exists)\n done\n }\n moreover\n { let ?role = \"done @ Recv l pt # todo\"\n note IH = recv(2)\n assume \"?new\"\n hence cur_thread: \"?role = done' @ todo'\" \"i = i'\" \n using recv by auto\n have ?case\n proof(cases \"\\ step' \\ set done. MVar n \\ FV_rolestep step'\")\n case True\n with recv\n obtain step'\n where FV: \"MVar n \\ FV_rolestep step'\" \n and step': \"step' \\ set done\"\n by auto\n hence \"s (MV n i) \\ typing (done'@todo', n) i (t, r, s)\"\n using th1.thread_exists cur_thread IH\n by (metis th1.step_done_typing)\n thus ?thesis using `?new`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n apply(auto simp: th1.thread_exists)\n done\n next\n case False\n moreover have \"(t, r, s) \\ approx typing\"\n by (auto simp: approx_unfold dest!: IH roleMap_SomeD)\n moreover note `?new`\n moreover note `MVar n \\ FV_rolestep step`\n moreover note `Some m = inst s i pt`\n moreover note `m \\ knows t`\n moreover note cur_thread[symmetric]\n \n ultimately show ?thesis\n apply -\n apply(clarsimp simp del: fun_upd_apply)\n apply(rule source_case)\n apply(simp_all add: th1.role_in_P th1.roleMap th1.thread_exists \n in_set_splits_conv remove_hints)\n done\n qed\n }\n ultimately show ?case by fastforce\n next\n case (compr t r s i \"done\" l ty pt todo skipped m i' done' todo' step n skipped')\n then interpret th1: \n reachable_thread P t r s i \"done\" \"Note l ty pt # todo\" skipped\n by unfold_locales auto\n from compr\n have \"(i', step) \\ steps t \\ (i' = i) \\ step = Note l ty pt\"\n (is \"?old \\ ?new\") by auto\n moreover\n { assume ?old\n hence \"s(MV n i') \\ typing (done'@todo', n) i' (t,r,s)\"\n using compr by (auto split: if_splits)\n hence ?case\n proof(rule monoTyp_freeD[OF monoTyp])\n qed (auto simp: th1.thread_exists)\n }\n moreover\n { let ?role = \"done @ Note l ty pt # todo\"\n note IH = compr(2)\n assume \"?new\"\n hence \"n \\ used_vars (Note l ty pt)\"\n using compr by auto\n then obtain step' \n where \"(i, step') \\ steps t\" \n \"n \\ sourced_vars step'\"\n by (fastforce dest!: th1.source_step[OF th1.thread_exists])\n moreover hence \"MVar n \\ FV_rolestep step'\" by auto\n ultimately have typed: \"s (MV n i) \\ typing (?role, n) i (t, r, s)\"\n by (auto dest: IH[OF th1.thread_exists])\n have \"done'@todo' = ?role\"\n using compr `?new` by auto\n hence ?case using `?new`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n by (auto intro!: typed simp: th1.thread_exists)\n }\n ultimately show ?case by fast\n next\n case (skip t r s i \"done\" l ty pt todo skipped i' done' todo' step n skipped')\n then interpret th1: \n reachable_thread P t r s i \"done\" \"Note l ty pt # todo\" skipped\n by unfold_locales auto\n from skip\n have \"(i', step) \\ steps t\" (is \"?old\") by auto\n hence \"s(MV n i') \\ typing (done'@todo', n) i' (t,r,s)\"\n using skip by (auto split: if_splits)\n thus ?case\n proof(rule monoTyp_freeD[OF monoTyp])\n qed (auto simp: th1.thread_exists)\n next\n case (match t r s i \"done\" l eq mv pt todo skipped i' done' todo' step n skipped') then\n interpret th1:\n reachable_thread P t r s i \"done\" \"Match l eq mv pt # todo\" skipped\n by unfold_locales auto\n from match\n have \"(i', step) \\ steps t \\ (i' = i) \\ step = Match l eq mv pt\"\n (is \"?old \\ ?new\") by auto\n moreover\n { assume ?old\n hence \"s (MV n i') \\ typing (done'@todo', n) i' (t,r,s)\"\n using match by (auto split: if_splits)\n hence ?case\n proof (rule monoTyp_freeD[OF monoTyp])\n qed (auto simp: th1.thread_exists)\n }\n moreover\n { let ?role = \"done @ Match l eq mv pt # todo\"\n note IH = match(2)\n assume \"?new\"\n have ?case proof (cases eq)\n case True\n note eq_case = this\n hence cur_thread: \"?role = done' @ todo'\" \"i = i'\" and\n match_FV: \"n \\ used_vars step \\ n \\ sourced_vars step\"\n using `?new` match by auto\n from match_FV show ?thesis proof\n assume \"n \\ used_vars step\"\n with `?new` obtain step'\n where \"(i, step') \\ steps t\"\n \"n \\ sourced_vars step'\"\n by (fastforce dest!: th1.source_step[OF th1.thread_exists])\n hence typed: \"s (MV n i) \\ typing (?role, n) i (t, r, s)\"\n by (auto dest: IH[OF th1.thread_exists])\n thus ?thesis using `?new` cur_thread(1)\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n by (auto intro!: typed simp: th1.thread_exists)\n next\n assume \"n \\ sourced_vars step\"\n thus ?thesis\n proof (cases \"\\ step' \\ set done. MVar n \\ FV_rolestep step'\")\n case True\n with match\n obtain step'\n where FV: \"MVar n \\ FV_rolestep step'\"\n and step': \"step' \\ set done\"\n by auto\n hence \"s (MV n i) \\ typing (done'@todo', n) i (t, r, s)\"\n using th1.thread_exists cur_thread IH\n by (metis th1.step_done_typing)\n thus ?thesis using `?new`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n apply(auto simp: th1.thread_exists)\n done\n next\n case False\n moreover have \"(t, r, s) \\ approx typing\"\n by (auto simp: approx_unfold dest!: IH roleMap_SomeD)\n moreover note `?new`\n moreover note `n \\ sourced_vars step`\n moreover have \"exec_match s i mv pt\"\n using match eq_case by simp\n moreover note cur_thread[symmetric]\n\n ultimately show ?thesis\n apply -\n apply(clarsimp simp del: fun_upd_apply)\n apply(rule source_case)\n apply(simp_all add: th1.role_in_P th1.roleMap th1.thread_exists\n in_set_splits_conv remove_hints)\n done\n qed\n qed\n\n next\n case False note notMatch = this\n moreover note `?new`\n moreover hence \"n \\ used_vars step\" using match notMatch by auto\n ultimately obtain step'\n where \"(i, step') \\ steps t\" \n \"n \\ sourced_vars step'\" \n by (fastforce dest!: th1.source_step[OF th1.thread_exists])\n hence typed: \"s (MV n i) \\ typing (?role, n) i (t, r, s)\"\n by (auto dest: IH[OF th1.thread_exists])\n have \"done'@todo' = ?role\" using match `?new` by auto\n thus ?thesis using `?new`\n apply -\n apply(rule monoTyp_freeD[OF monoTyp])\n by (auto intro!: typed simp: th1.thread_exists)\n qed\n }\n ultimately show ?case by fastforce\n\n qed (auto intro: monoTyp_appendD[OF monoTyp])\n }\n thus ?thesis unfolding approx_unfold by(auto elim!: roleMap_SomeE)\nqed\n\ntext{*\n We prove a variant of the above lemma, which is suitable for\n automation. The difference is the description of the variables\n that need to be checked. Here, it is done such that Isabelle's\n simplifier gets a finite set that it can rewrite into normal\n form.\n*}\nlemma (in reachable_state) reachable_in_approxI_ext:\n assumes monoTyp: \"monoTyp typing\"\n and source_case:\n \"\\ t r s i done todo skipped m R step n.\n \\ R \\ P; \n roleMap r i = Some R;\n (done, step # todo) \\ set (splits R);\n \\ sendStep step; \\ noteStep step;\n n \\ foldl (\\ fv step'. fv - sourced_vars step') (sourced_vars step) done;\n hint ''completenessCase'' (step, n);\n \n (t,r,s) \\ reachable P;\n (t,r,s) \\ approx typing;\n r i = Some (done, step # todo, skipped);\n \\ st'. st' \\ set done \\ \\ noteStep st' \\ (i, st') \\ steps t;\n\n recvStep step \\ Some m = inst s i (stepPat step) \\ m \\ knows t;\n matchEqStep step \\ exec_match s i (matchVar step) (stepPat step)\n \\ \\\n s (MV n i) \\ typing (R, n) i ( t @ [Step (i, step)], r(i \\ (done @ [step], todo, skipped)), s)\"\n shows \"(t,r,s) \\ approx typing\"\nproof(induct rule: reachable_in_approxI[OF monoTyp])\n case (1 t r s i \"done\" todo skipped m R step n)\n { fix v V\n assume \"v \\ V\"\n and \"\\step'\\set done. MVar v \\ FV_rolestep step'\"\n hence \"v \\ foldl (\\ fv step'. fv - sourced_vars step') V done\"\n by (induct \"done\" arbitrary: V) (auto intro!: sourced_imp_FV)\n }\n hence \"n \\ foldl (\\ fv step'. fv - sourced_vars step') (sourced_vars step) done\"\n using 1 by auto\n moreover {\n interpret thread: reachable_thread P t r s i \"done\" \"(step # todo)\" skipped\n using 1 by unfold_locales auto\n fix st'\n assume \"st' \\ set done\" and \"\\ noteStep st'\"\n hence \"(i, st') \\ steps t\" by (auto intro: thread.not_note_done_in_steps)\n }\n ultimately show ?case using 1\n apply(subgoal_tac \"True\")\n apply(clarsimp)\n apply(rule source_case)\n by(assumption | simp add: remove_hints)+\nqed\n\ntext{* Proving typing monotonicity *}\n\nsubsubsection{* Monotonicity Proofs *}\n\ndefinition monoMsgTyp :: \"msgtype \\ bool\"\nwhere \"monoMsgTyp ty \\\n (\\i t r s t' r'.\n roleMap r \\\\<^sub>m roleMap r' \\\n ty i (t, r, s) \\ ty i (t @ t', r', s))\"\n\nlemma monoMsgTypD:\n \"\\ monoMsgTyp ty;\n m \\ ty i (t,r,s);\n roleMap r \\\\<^sub>m roleMap r'\n \\ \\\n m \\ ty i (t@t',r',s)\"\n unfolding monoMsgTyp_def by blast\n\n\nlemma monoMsgTyp_SumTI[intro!]:\n assumes ty1: \"monoMsgTyp ty1\"\n and ty2: \"monoMsgTyp ty2\"\n shows \"monoMsgTyp (SumT ty1 ty2)\"\n by(auto simp: monoMsgTyp_def SumT_def \n dest: monoMsgTypD[OF ty1] monoMsgTypD[OF ty2])\n\nlemma monoMsgTyp_InterTI[intro!]:\n assumes ty1: \"monoMsgTyp ty1\"\n and ty2: \"monoMsgTyp ty2\"\n shows \"monoMsgTyp (InterT ty1 ty2)\"\n by(auto simp: monoMsgTyp_def InterT_def \n dest: monoMsgTypD[OF ty1] monoMsgTypD[OF ty2])\n\nlemma monoMsgTyp_KnownTI[iff]:\n shows \"monoMsgTyp (KnownT step)\"\n by(auto simp: monoMsgTyp_def KnownT_def )\n \nlemma monoMsgTyp_NonceTI[iff]:\n shows \"monoMsgTyp (NonceT R n)\"\n by(auto simp: monoMsgTyp_def NonceT_def dest: map_leD)\n\nlemma monoMsgTyp_ConstTI[iff]:\n shows \"monoMsgTyp (ConstT c)\"\n by(auto simp: monoMsgTyp_def ConstT_def dest: map_leD)\n\nlemma monoMsgTyp_AgentTI[iff]:\n shows \"monoMsgTyp AgentT\"\n by(auto simp: monoMsgTyp_def AgentT_def dest: map_leD)\n\nlemma monoMsgTyp_EncTI[intro!]:\n assumes ty1: \"monoMsgTyp ty1\"\n and ty2: \"monoMsgTyp ty2\"\n shows \"monoMsgTyp (EncT ty1 ty2)\"\n by(auto simp: monoMsgTyp_def EncT_def \n dest: monoMsgTypD[OF ty1] monoMsgTypD[OF ty2])\n\nlemma monoMsgTyp_KTI[intro!]:\n assumes ty1: \"monoMsgTyp ty1\"\n and ty2: \"monoMsgTyp ty2\"\n shows \"monoMsgTyp (KT ty1 ty2)\"\n by(auto simp: monoMsgTyp_def KT_def \n dest: monoMsgTypD[OF ty1] monoMsgTypD[OF ty2])\n\nlemma monoMsgTyp_KShrTI[intro!]:\n shows \"monoMsgTyp KShrT\"\n by(auto simp: monoMsgTyp_def KShrT_def)\n\nlemma monoMsgTyp_TupTI[intro!]:\n assumes ty1: \"monoMsgTyp ty1\"\n and ty2: \"monoMsgTyp ty2\"\n shows \"monoMsgTyp (TupT ty1 ty2)\"\n by(auto simp: monoMsgTyp_def TupT_def \n dest: monoMsgTypD[OF ty1] monoMsgTypD[OF ty2])\n\nlemma monoMsgTyp_HashTI[intro!]:\n assumes ty: \"monoMsgTyp ty\"\n shows \"monoMsgTyp (HashT ty)\"\n by(auto simp: monoMsgTyp_def HashT_def \n dest: monoMsgTypD[OF ty])\n\nlemma monoMsgTyp_PKTI[intro!]:\n assumes ty: \"monoMsgTyp ty\"\n shows \"monoMsgTyp (PKT ty)\"\n by(auto simp: monoMsgTyp_def PKT_def \n dest: monoMsgTypD[OF ty])\n\nlemma monoMsgTyp_SKTI[intro!]:\n assumes ty: \"monoMsgTyp ty\"\n shows \"monoMsgTyp (SKT ty)\"\n by(auto simp: monoMsgTyp_def SKT_def \n dest: monoMsgTypD[OF ty])\n\nlemma monoTyp_mk_typing[intro!]:\n assumes monoMsgTyp: \n \"\\ pos ty. (pos, ty) \\ set tyeqs \\ monoMsgTyp ty\"\n shows \"monoTyp (mk_typing tyeqs)\"\nusing monoMsgTyp\nproof(induct tyeqs)\n case Nil thus ?case\n by(auto intro!: monoTypI simp: mk_typing_def EmptyT_def)\nnext\n case (Cons tyeq tyeqs) \n thus ?case\n proof(cases tyeq)\n case (Pair pos' ty') \n have mk_typing_Cons [simp]:\n \"mk_typing ((pos',ty')#tyeqs) = (mk_typing tyeqs)(pos' := ty')\"\n by (simp add: mk_typing_def)\n with Pair show ?thesis\n apply(auto intro!: monoTypI)\n apply(auto intro: monoTypD[OF Cons(1), OF Cons(2)]\n monoMsgTypD[OF Cons(2)]\n simp: Pair)\n done\n qed\nqed\n\nsubsection{* Automation *}\n\ntext{*\nThe automation of the welltypedness proofs is rather fragile.\nAs a general rule of operation we try to unfold type information\nas late as possible. This allows to guide the automation tools\nby matching on the structure of the types. However, it also\nimplies that more rules are necessary. Moreover the current set\nof rules is not guaranteed to be complete.\n*}\n\nsubsubsection{* ACI of Sum and Intersection Types *}\n\nlemma SumT_absorb [simp]: \"SumT ty ty = ty\"\n by (rule ext, rule ext) (auto simp: SumT_def)\n\nlemma SumT_left_absorb: \"SumT ty1 (SumT ty1 ty2) = SumT ty1 ty2\"\n by (rule ext, rule ext) (auto simp: SumT_def)\n\nlemma SumT_commute: \"SumT ty1 ty2 = SumT ty1 ty2\"\n by (rule ext, rule ext) (auto simp: SumT_def)\n\nlemma SumT_left_commute: \"SumT ty1 (SumT ty2 ty3) = SumT ty2 (SumT ty1 ty3)\"\n by (rule ext, rule ext) (auto simp: SumT_def)\n\nlemma SumT_assoc: \"SumT (SumT ty1 ty2) ty3 = SumT ty1 (SumT ty2 ty3)\"\n by (rule ext, rule ext) (auto simp: SumT_def)\n\nlemmas SumT_ac = SumT_assoc SumT_left_absorb SumT_commute SumT_left_commute\n -- {* Type sum is an AC-operator *}\n\nlemma InterT_absorb [simp]: \"InterT ty ty = ty\"\n by (rule ext, rule ext) (auto simp: InterT_def)\n\nlemma InterT_left_absorb: \"InterT ty1 (InterT ty1 ty2) = InterT ty1 ty2\"\n by (rule ext, rule ext) (auto simp: InterT_def)\n\nlemma InterT_commute: \"InterT ty1 ty2 = InterT ty1 ty2\"\n by (rule ext, rule ext) (auto simp: InterT_def)\n\nlemma InterT_left_commute: \"InterT ty1 (InterT ty2 ty3) = InterT ty2 (InterT ty1 ty3)\"\n by (rule ext, rule ext) (auto simp: InterT_def)\n\nlemma InterT_assoc: \"InterT (InterT ty1 ty2) ty3 = InterT ty1 (InterT ty2 ty3)\"\n by (rule ext, rule ext) (auto simp: InterT_def)\n\n\nlemmas InterT_ac = InterT_assoc InterT_left_absorb InterT_commute InterT_left_commute\n -- {* Type intersection is an AC-operator *}\n\n\nsubsubsection{* Type Membership *}\n\n\ntext{* Special types *}\n\ntext{* The rules for SumT are special, as their usage currently\ndepends on the combination of SumT and KnownT.\n*}\nlemma in_SumTE:\n \"\\ m \\ SumT ty1 ty2 i q; m \\ ty1 i q \\ R; m \\ ty2 i q \\ R \n \\ \\ R\"\n by(auto simp: SumT_def)\n\nlemma notin_SumTE [elim!]: \n \"\\ m \\ SumT ty1 ty2 i q; \n \\ m \\ ty1 i q; m \\ ty2 i q \\ \\ R\n \\ \\ R\"\n by(auto simp: SumT_def)\n\nlemma notin_KnownT_append_StepE [dest!]:\n \"m \\ KnownT step i (t@ [Step (i, step)], r, s) \\\n m \\ knows t\"\n by(auto simp: KnownT_def)\n\nlemma in_SumT_NonceT_NonceTE [elim!]:\n \"\\ m \\ SumT (NonceT Ro n) (NonceT Ro' n') i q; \n m \\ NonceT Ro n i q \\ R; \n m \\ NonceT Ro' n' i q \\ R \n \\ \\ R\"\n by(auto simp: SumT_def)\n\n(* TODO: Add more of the restricted SumT unfoldings analogous to the ones above.\n We don't unfold SumT eagerly, as this would result in too many branches being created.\n The above lemma is a hack to get triple types of the form SumT KnownT (SumT NonceT NonceT)\n to work. The proper way would be to only expand types of variables that are being analyzed\n by the decrChain function.\n*)\n\ntext{* Direct unfoldings *}\n\nlemma in_ConstT_simp [iff]:\n \"(m \\ ConstT c i q) = (m = LC c)\"\n by(auto simp: ConstT_def)\n\nlemma in_KnownTD [dest!]:\n \"(x \\ KnownT step i (t,r,s)) \\ (predOrd t (Ln x) (St (i, step)))\"\n by(simp add: KnownT_def)\n\n\ntext{* To be used together with if\\_splits in a well-typedness\nproof *}\nlemma in_NonceT [simp]: \n \"(LN n i \\ NonceT R n i' (t,r,s)) = (roleMap r i = Some R)\"\n by(simp add: NonceT_def)\n\nlemma in_NonceTE [elim!]:\n \"\\ m \\ NonceT R n i (t,r,s); \n \\ nTid. \\ m = LN n nTid; roleMap r nTid = Some R \\ \\ Q \n \\ \\ Q\"\n by(auto simp: NonceT_def)\n\nlemma notin_NonceT_thenonceE [elim!]:\n \"\\ LN n nTid \\ NonceT nR n i (t, r(i \\ (done,todo,skipped)), s);\n nTid = i \\ Q;\n \\ nTid \\ i; roleMap r nTid \\ Some nR \\ \\ Q\n \\ \\ Q\"\n by(auto simp: NonceT_def split: if_splits)\n\n\ntext{* These rules ensure that type information is exploited\nwhen a match impossible without intruder activity happening.\n*}\nlemma Tup_in_SumT_KnownT_NonceTD [dest!]:\n \"Tup x y \\ SumT (KnownT step) (NonceT R n) i (t, r, s)\n \\ predOrd t (Ln (Tup x y)) (St (i, step))\"\n by(auto simp: KnownT_def SumT_def)\n\nlemma Hash_in_SumT_KnownT_NonceTD [dest!]:\n \"Hash x \\ SumT (KnownT step) (NonceT R n) i (t, r, s)\n \\ predOrd t (Ln (Hash x)) (St (i, step))\"\n by(auto simp: KnownT_def SumT_def)\n\nlemma Enc_in_SumT_KnownT_NonceTD [dest!]:\n \"Enc x y \\ SumT (KnownT step) (NonceT R n) i (t, r, s)\n \\ predOrd t (Ln (Enc x y)) (St (i, step))\"\n by(auto simp: KnownT_def SumT_def)\n\ntext{* TODO: Extend these lemmas for further combinations. This requires\nsome more thinking. However, for a well-designed protocols the message\nstructure is not required for disambiguation because the encryptions\ncontain tags that identify them.\n*}\n\ntext{* Structural types *}\n\ntext{* The following rules are used in well-typedness proofs *}\nlemma Hash_in_HashT [simp]: \n \"(Hash x \\ HashT ty i q) = (x \\ ty i q)\"\n by (simp add: HashT_def)\n\nlemma Tup_in_TupT [simp]: \n \"(Tup x y \\ TupT ty1 ty2 i q) = (x \\ ty1 i q \\ y \\ ty2 i q)\"\n by (simp add: TupT_def)\n\nlemma Enc_in_EncT [simp]: \n \"(Enc x y \\ EncT ty1 ty2 i q) = (x \\ ty1 i q \\ y \\ ty2 i q)\"\n by (simp add: EncT_def)\n\nlemma PK_in_PKT [simp]: \"(PK x \\ PKT ty i q) = (x \\ ty i q)\"\n by (simp add: PKT_def)\n\nlemma SK_in_SKT [simp]: \"(SK x \\ SKT ty i q) = (x \\ ty i q)\"\n by (simp add: SKT_def)\n\nlemma K_in_KT [simp]: \n \"(K x y \\ KT ty1 ty2 i q) = (x \\ ty1 i q \\ y \\ ty2 i q)\"\n by (simp add: KT_def)\n\n\n\ntext{* The following rules ensure that messages are expanded\nautomatically in when applying the sources rule.\n*}\n\nlemma in_HashTE [elim!]:\n \"\\ m \\ HashT ty i q;\n \\ x. \\ m = Hash x; x \\ ty i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: HashT_def)\n\nlemma in_EncTE [elim!]:\n \"\\ m \\ EncT ty1 ty2 i q;\n \\ x k. \\ m = Enc x k; x \\ ty1 i q; k \\ ty2 i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: EncT_def)\n\nlemma in_TupTE [elim!]:\n \"\\ m \\ TupT ty1 ty2 i q;\n \\ x y. \\ m = \\ x, y \\; x \\ ty1 i q; y \\ ty2 i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: TupT_def)\n\nlemma in_KTE [elim!]:\n \"\\ m \\ KT ty1 ty2 i q;\n \\ x y. \\ m = K x y; x \\ ty1 i q; y \\ ty2 i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: KT_def)\n\nlemma in_PKTE [elim!]:\n \"\\ m \\ PKT ty i q;\n \\ x. \\ m = PK x; x \\ ty i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: PKT_def)\n\nlemma in_SKTE [elim!]:\n \"\\ m \\ SKT ty i q;\n \\ x. \\ m = SK x; x \\ ty i q \\ \\ Q\n \\ \\ Q\"\n by(auto simp: SKT_def)\n\n\nsubsection{* Specialization of the Chain Rule *}\n\ntext{* We prove the case distinction on messages known to the\n intruder with respect to an typed state, because we need\n a sufficiently precise invariant when reasoning about the\n contents of a variable.\n*}\nlemma (in typed_state) knows_cases:\n assumes known: \"m' \\ knows t\"\n shows \"\n (m' \\ IK0 \\ \n hint ''case_name'' ''ik0''\n ) \\\n (\\ m. m' = Hash m \\ Ln m \\ Ln (Hash m) \\\n hint ''case_name'' ''fake''\n ) \\\n (\\ m k. m' = Enc m k \\ \n Ln m \\ Ln (Enc m k) \\ Ln k \\ Ln (Enc m k) \\\n hint ''case_name'' ''fake''\n ) \\\n (\\ x y. m' = Tup x y \\ \n Ln x \\ Ln (Tup x y) \\ Ln y \\ Ln (Tup x y) \\\n hint ''case_name'' ''fake''\n ) \\\n (\\ R \\ P. \\ i. roleMap r i = Some R \\ \n (\\ step \\ set R.\n (sendStep step \\ noteStep step) \\\n (\\ m. Some m = inst s i (stepPat step) \\ decrChain [] t {St (i, step)} m m') \\\n prefixClose s t R step i \\\n (\\ v \\ FV (stepPat step). \\ n. v = MVar n \\ \n s (MVar n, i) \\ typing (R, n) i (t,r,s) \\\n hint ''case_name_subst'' n) \\\n hint ''decrChainFrom'' (i, R, step) \\\n hint ''case_name'' ''decrypt''\n )\n\n ) \\\n (\\ a. m' = SK a \\ LKR a \\ Ln m' \\ hint ''case_name'' ''asym_lkr'') \\\n (\\ a b. m' = K a b \\ LKR a \\ Ln m' \\ hint ''case_name'' ''sym_lkr1'') \\\n (\\ a b. m' = K a b \\ LKR b \\ Ln m' \\ hint ''case_name'' ''sym_lkr2'') \\\n (\\ A. \\ a \\ A. m' = KShr A \\ LKR (LAg a) \\ Ln m' \\ hint ''case_name'' ''shr_lkr'')\n \"\n (is \"?ik0 \\ ?hash \\ ?encr \\ ?tup \\ ?decr \\ ?keys\")\nproof -\n from known have\n \"(m' \\ IK0) \\\n (\\ m. m' = Hash m \\ Ln m \\ Ln (Hash m)) \\\n (\\ m k. m' = Enc m k \\ Ln m \\ Ln (Enc m k) \\ Ln k \\ Ln (Enc m k)) \\\n (\\ x y. m' = Tup x y \\ Ln x \\ Ln (Tup x y) \\ Ln y \\ Ln (Tup x y)) \\\n (\\ i done todo skipped. r i = Some (done, todo, skipped) \\ \n (\\ l pt m. \n Send l pt \\ set done \\ Some m = inst s i pt \\ \n decrChain [] t {St (i, Send l pt)} m m'\n )\n ) \\\n (\\ i done todo skipped. r i = Some (done, todo, skipped) \\ \n (\\ l ty pt m. \n Note l ty pt \\ set done \\ Note l ty pt \\ skipped \\ \n Some m = inst s i pt \\ \n decrChain [] t {St (i, Note l ty pt)} m m'\n )\n ) \\\n (\\ a. m' = SK a \\ LKR a \\ Ln m') \\\n (\\ a b. m' = K a b \\ LKR a \\ Ln m') \\\n (\\ a b. m' = K a b \\ LKR b \\ Ln m') \\ \n (\\ A. \\ a \\ A. m' = KShr A \\ LKR (LAg a) \\ Ln m')\n \"\n (is \"?ik0_raw \\ ?hash_raw \\ ?encr_raw \\ ?tup_raw \\ ?decr_raw \\ ?note_raw \\ ?keys_raw\")\n by (rule knows_cases_raw)\n moreover \n {\n assume \"?ik0_raw\" \n hence ?thesis by( simp add: remove_hints)\n }\n moreover \n {\n assume \"?hash_raw\" \n hence ?thesis by( simp add: remove_hints)\n }\n moreover \n {\n assume \"?encr_raw\" \n hence ?thesis by( simp add: remove_hints)\n }\n moreover \n {\n assume \"?tup_raw\" \n hence ?thesis by( simp add: remove_hints)\n }\n moreover \n {\n assume \"?keys_raw\" \n hence ?thesis by( simp add: remove_hints)\n }\n moreover\n { assume ?decr_raw then\n obtain i \"done\" todo l msg skipped m\n where thread_exists: \"r i = Some (done, todo,skipped)\"\n and send_done: \"Send l msg \\ set done\"\n and msg: \"Some m = inst s i msg\"\n and decrChain: \"decrChain [] t {St (i, Send l msg)} m m'\"\n by fast\n then interpret th1: typed_thread P t r s i \"done\" todo skipped \"typing\"\n using approximates by unfold_locales\n from send_done have send_step: \"(i, Send l msg) \\ steps t\" \n by (rule th1.in_steps_send[THEN iffD1])\n moreover\n have \"prefixClose s t (done@todo) (Send l msg) i\" using send_step\n by(auto intro!: prefixCloseI th1.roleMap)\n moreover\n have send_in_role: \"Send l msg \\ set (done @ todo)\"\n using send_done by simp\n moreover\n note in_approxD[OF th1.approximates send_step th1.roleMap, simplified]\n ultimately\n have ?decr using decrChain msg\n apply -\n apply(rule bexI[OF _ th1.role_in_P])\n apply(rule exI)\n apply(rule conjI[OF th1.roleMap])\n apply(rule bexI[OF _ send_in_role])\n by(auto simp: remove_hints)\n hence ?thesis by blast \n }\n moreover\n {\n assume ?note_raw\n then obtain i \"done\" todo skipped l ty pt m\n where thread_exists: \"r i = Some (done, todo,skipped)\"\n and inDone: \"Note l ty pt \\ set done\"\n and notinSkipped: \"Note l ty pt \\ skipped\"\n and msg: \"Some m = inst s i pt\"\n and decrChain: \"decrChain [] t {St (i, Note l ty pt)} m m'\"\n by fast\n then interpret th1: typed_thread P t r s i \"done\" todo skipped \"typing\"\n using approximates by unfold_locales\n from inDone and notinSkipped have note_step: \"(i, Note l ty pt) \\ steps t\" \n by (fastforce dest!: th1.in_steps_eq_in_done)\n moreover\n have \"prefixClose s t (done@todo) (Note l ty pt) i\" using note_step\n by(auto intro!: prefixCloseI th1.roleMap)\n moreover\n have note_in_role: \"Note l ty pt \\ set (done @ todo)\"\n using inDone by simp\n moreover\n note in_approxD[OF th1.approximates note_step th1.roleMap, simplified]\n ultimately\n have ?decr using decrChain msg\n apply -\n apply(rule bexI[OF _ th1.role_in_P])\n apply(rule exI)+\n apply(rule conjI[OF th1.roleMap])\n apply(rule bexI[OF _ note_in_role])\n by(auto simp: remove_hints)\n hence ?thesis by blast \n }\n ultimately\n show ?thesis by fastforce\nqed\n\n\nlemma (in reachable_state) decrChain_AgentE:\n assumes decrChain: \"decrChain path t from m m'\"\n and Agent: \"m \\ Agent\"\n and nonempty: \"from = {} \\ Q\"\n shows \"Q\"\n using decrChain Agent nonempty\n by (auto simp: Agent_def)\n\n(*\nlemma (in reachable_state) decrChain_AgentTE:\n assumes decrChain: \"decrChain path t from m m'\"\n and AgentT: \"m \\ AgentT i (t,r,s)\" \n and elim: \"m = m' \\ Q\"\n shows \"Q\"\n using decrChain AgentT elim\n by (auto simp: AgentT_def)\n*)\n\nlemma (in reachable_state) decrChain_imp_predOrd:\n \"\\ decrChain path t from m m' \\ \\\n \\ im \\ pairParts m. (\\ f \\ from. f \\ Ln im) \\ Ln im \\ Ln m'\"\nproof(induct m arbitrary: path \"from\")\n case (Tup x y) thus ?case\n apply(simp)\n apply(erule disjE)\n apply(clarsimp)\n apply(rule disjI2)\n apply(fastforce intro: less_le_trans)\n done\nqed fastforce+\n\nlemma (in reachable_state) decrChain_KnownT:\n assumes decrChain: \"decrChain path t from m m'\"\n and KnownT: \"predOrd t (Ln m) (St (i, step))\"\n shows \"\\ im \\ pairParts m. \n (\\ f \\ from. f \\ Ln im) \\ Ln im \\ St (i, step)\"\nproof -\n obtain im\n where \"im \\ pairParts m\" and \"\\f \\ from. f \\ Ln im\"\n using decrChain by (fast dest!: decrChain_imp_predOrd)\n with KnownT show ?thesis\n by (fastforce intro: pairParts_before)\nqed\n\nlemma (in reachable_state) decrChain_KnownTE:\n assumes decrChain: \"decrChain path t from m m'\"\n and KnownT: \"predOrd t (Ln m) (St (i, step))\"\n and elim: \"\\ im. \\ im \\ pairParts m; \n \\ f \\ from. f \\ Ln im;\n Ln im \\ St (i, step)\n \\ \\ Q\"\n shows \"Q\"\n using decrChain KnownT\n by(auto dest!: decrChain_KnownT elim)\n\nlemma (in reachable_state) decrChain_SumT_KnownTE:\n assumes KnownT: \"m \\ SumT (KnownT step) ty i (t,r,s)\" \n and decrChain: \"decrChain path t from m m'\"\n and elimK: \"\\ im. \\ im \\ pairParts m; \n \\ f \\ from. f \\ Ln im;\n Ln im \\ St (i, step)\n \\ \\ Q\"\n and elimTy: \"m \\ ty i (t,r,s) \\ Q\"\n shows \"Q\"\n using decrChain KnownT elimK elimTy\n by(auto elim!: in_SumTE decrChain_KnownTE)\n\n\nlemma (in reachable_state) AV_in_Agent [iff]: \n \"s (AV a aTid) \\ Agent\"\nusing inst_AVar_cases \nby (auto simp: Agent_def)\n\n\nend\n\n(* TODO: \n - Remove agent variables from protocol model by \n replacing them with type annotations. \n\n [General version will require us to reintroduce create event.\n But composition becomes nicer, as we can now model protocols, which\n use parameters that are secret values and so on.\n ]\n\n\n - Put decryption chain case into recursion of chain\n predicate to make more information available locally.\n*)\n\n\n", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/ESPLogic/WeakTyping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.281132419524212}} {"text": "section \\Security\\\n\ntheory Constructive_Cryptography imports\n Wiring\nbegin\n\ndefinition \"advantage \\ res1 res2 = \\spmf (connect \\ res1) True - spmf (connect \\ res2) True\\\"\n\nlocale constructive_security_aux =\n fixes real_resource :: \"security \\ ('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"security \\ ('c + 'e, 'd + 'f) resource\"\n and sim :: \"security \\ ('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"security \\ ('a, 'b) \\\"\n and \\_ideal :: \"security \\ ('c, 'd) \\\"\n and \\_common :: \"security \\ ('e, 'f) \\\"\n and bound :: \"security \\ enat\"\n and lossless :: \"bool\"\n assumes WT_real [WT_intro]: \"\\\\. \\_real \\ \\\\<^sub>\\ \\_common \\ \\res real_resource \\ \\\"\n and WT_ideal [WT_intro]: \"\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\res ideal_resource \\ \\\"\n and WT_sim [WT_intro]: \"\\\\. \\_real \\, \\_ideal \\ \\\\<^sub>C sim \\ \\\"\n and adv: \"\\\\ :: security \\ ('a + 'e, 'b + 'f) distinguisher. \n \\ \\\\. \\_real \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\; \n \\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound \\);\n \\\\. lossless \\ plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common \\) (\\ \\) \\\n \\ negligible (\\\\. advantage (\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\) (real_resource \\))\"\n\n\nlocale constructive_security =\n constructive_security_aux real_resource ideal_resource sim \\_real \\_ideal \\_common bound lossless\n for real_resource :: \"security \\ ('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"security \\ ('c + 'e, 'd + 'f) resource\"\n and sim :: \"security \\ ('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"security \\ ('a, 'b) \\\"\n and \\_ideal :: \"security \\ ('c, 'd) \\\"\n and \\_common :: \"security \\ ('e, 'f) \\\"\n and bound :: \"security \\ enat\"\n and lossless :: \"bool\"\n and w :: \"security \\ ('c, 'd, 'a, 'b) wiring\"\n +\n assumes correct: \"\\cnv. \\\\ :: security \\ ('c + 'e, 'd + 'f) distinguisher.\n (\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\) \n \\ (\\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound \\))\n \\ (\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (\\ \\))\n \\ (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n\nlocale constructive_security2 =\n constructive_security_aux real_resource ideal_resource sim \\_real \\_ideal \\_common bound lossless\n for real_resource :: \"security \\ ('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"security \\ ('c + 'e, 'd + 'f) resource\"\n and sim :: \"security \\ ('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"security \\ ('a, 'b) \\\"\n and \\_ideal :: \"security \\ ('c, 'd) \\\"\n and \\_common :: \"security \\ ('e, 'f) \\\"\n and bound :: \"security \\ enat\"\n and lossless :: \"bool\"\n and w :: \"security \\ ('c, 'd, 'a, 'b) wiring\"\n +\n assumes sim: \"\\cnv. \\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\) \\ wiring (\\_ideal \\) (\\_ideal \\) (cnv \\ \\ sim \\) (id, id)\"\nbegin\n\nlemma constructive_security:\n \"constructive_security real_resource ideal_resource sim \\_real \\_ideal \\_common bound lossless w\"\nproof\n from sim obtain cnv\n where w: \"\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\"\n and inverse: \"\\\\. wiring (\\_ideal \\) (\\_ideal \\) (cnv \\ \\ sim \\) (id, id)\"\n by blast\n show \"\\cnv. \\\\. (\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\)\n \\ (\\\\. interaction_any_bounded_by (\\ \\) (bound \\))\n \\ (\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (\\ \\))\n \\ (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n proof(intro strip exI conjI)\n fix \\ :: \"security \\ ('c + 'e, 'd + 'f) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound \\)\"\n and lossless [rule_format]: \"\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (\\ \\)\"\n \n show \"wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\" for \\ by fact\n\n let ?A = \"\\\\. outs_\\ (\\_ideal \\)\"\n let ?cnv = \"\\\\. restrict_converter (?A \\) (\\_real \\) (cnv \\)\"\n let ?\\ = \"\\\\. absorb (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C)\"\n\n have eq: \"advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\) =\n advantage (?\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\) (real_resource \\)\" for \\\n proof -\n from w[of \\] have [WT_intro]: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\\" by cases\n have \"\\_ideal \\, \\_ideal \\ \\\\<^sub>C ?cnv \\ \\ sim \\ \\ cnv \\ \\ sim \\\"\n by(rule eq_\\_comp_cong eq_\\_restrict_converter WT_intro order_refl eq_\\_converter_reflI)+\n also from inverse[of \\] have \"\\_ideal \\, \\_ideal \\ \\\\<^sub>C cnv \\ \\ sim \\ \\ 1\\<^sub>C\" by cases simp\n finally have inverse': \"\\_ideal \\, \\_ideal \\ \\\\<^sub>C ?cnv \\ \\ sim \\ \\ 1\\<^sub>C\" .\n hence \"\\_ideal \\ \\\\<^sub>\\ \\_common \\, \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\\\<^sub>C ?cnv \\ \\ sim \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= 1\\<^sub>C\"\n by(rule parallel_converter2_eq_\\_cong)(intro eq_\\_converter_reflI WT_intro)\n also have \"\\_ideal \\ \\\\<^sub>\\ \\_common \\, \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\\\<^sub>C 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C\"\n by(rule parallel_converter2_id_id)\n also\n have eq1: \"connect (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\) = \n connect (\\ \\) (1\\<^sub>C \\ ideal_resource \\)\"\n unfolding attach_compose[symmetric] comp_converter_parallel2 comp_converter_id_right\n by(rule connect_eq_resource_cong WT_intro eq_\\_attach_on' calculation)+(fastforce intro: WT_intro)+\n\n have *: \"\\_ideal \\ \\\\<^sub>\\ \\_common \\, \\_real \\ \\\\<^sub>\\ \\_common \\ \\\\<^sub>C ?cnv \\ |\\<^sub>= 1\\<^sub>C \\ cnv \\ |\\<^sub>= 1\\<^sub>C\"\n by(rule parallel_converter2_eq_\\_cong eq_\\_restrict_converter)+(auto intro: WT_intro eq_\\_converter_reflI)\n have eq2: \"connect (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\) = connect (\\ \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\)\"\n by(rule connect_eq_resource_cong WT_intro eq_\\_attach_on' *)+(auto intro: WT_intro)\n show ?thesis unfolding advantage_def by(simp add: distinguish_attach[symmetric] eq1 eq2)\n qed\n have \"\\_real \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\\n proof -\n from w have [WT_intro]: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\\" by cases\n show ?thesis by(rule WT_intro)+\n qed\n moreover\n have \"interaction_any_bounded_by (absorb (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C)) (bound \\)\" for \\\n proof -\n from w[of \\] obtain f g where [simp]: \"w \\ = (f, g)\"\n and [WT_intro]: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\\"\n and eq: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\ map_converter id id f g 1\\<^sub>C\" by cases\n from eq_\\_restrict_converter_cong[OF eq order_refl]\n have *: \"restrict_converter (?A \\) (\\_real \\) (cnv \\) =\n restrict_converter (?A \\) (\\_real \\) (map_converter f g id id 1\\<^sub>C)\"\n by(subst map_converter_id_move_right) simp\n show ?thesis unfolding * by interaction_bound_converter simp\n qed\n moreover have \"plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\"\n if \"lossless\" for \\ \n proof -\n from w[of \\] obtain f g where [simp]: \"w \\ = (f, g)\"\n and cnv [WT_intro]: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\\"\n and eq: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\ map_converter id id f g 1\\<^sub>C\" by cases\n from eq_\\_converterD_WT1[OF eq cnv] have \\: \"\\_ideal \\ \\ map_\\ f g (\\_real \\)\"\n by(rule WT_map_converter_idD)\n with WT_converter_id have [WT_intro]: \"\\_ideal \\, map_\\ f g (\\_real \\) \\\\<^sub>C 1\\<^sub>C \\\" \n by(rule WT_converter_mono) simp\n have id: \"plossless_converter (\\_ideal \\) (map_\\ f g (\\_real \\)) 1\\<^sub>C\"\n by(rule plossless_converter_mono)(rule plossless_id_converter order_refl \\ WT_intro)+\n show ?thesis unfolding eq_\\_restrict_converter_cong[OF eq order_refl]\n by(rule plossless_gpv_absorb lossless[OF that] plossless_parallel_converter2 plossless_restrict_converter plossless_map_converter)+\n (fastforce intro: WT_intro id WT_converter_map_converter)+\n qed\n ultimately show \"negligible (\\\\. advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n unfolding eq by(rule adv)\n qed\nqed\n\nsublocale constructive_security real_resource ideal_resource sim \\_real \\_ideal \\_common bound lossless w\n by(rule constructive_security)\n\nend\n\nsubsection \\Composition theorems\\\n\ntheorem composability:\n fixes real\n assumes \"constructive_security middle ideal sim_inner \\_middle \\_inner \\_common bound_inner lossless_inner w1\"\n assumes \"constructive_security real middle sim_outer \\_real \\_middle \\_common bound_outer lossless_outer w2\"\n and bound [interaction_bound]: \"\\\\. interaction_any_bounded_converter (sim_outer \\) (bound_sim \\)\"\n and bound_le: \"\\\\. bound_outer \\ * max (bound_sim \\) 1 \\ bound_inner \\\"\n and lossless_sim [plossless_intro]: \"\\\\. lossless_inner \\ plossless_converter (\\_real \\) (\\_middle \\) (sim_outer \\)\"\n shows \"constructive_security real ideal (\\\\. sim_outer \\ \\ sim_inner \\) \\_real \\_inner \\_common bound_outer (lossless_outer \\ lossless_inner) (\\\\. w1 \\ \\\\<^sub>w w2 \\)\"\nproof\n interpret inner: constructive_security middle ideal sim_inner \\_middle \\_inner \\_common bound_inner lossless_inner w1 by fact\n interpret outer: constructive_security real middle sim_outer \\_real \\_middle \\_common bound_outer lossless_outer w2 by fact\n\n show \"\\_real \\ \\\\<^sub>\\ \\_common \\ \\res real \\ \\\"\n and \"\\_inner \\ \\\\<^sub>\\ \\_common \\ \\res ideal \\ \\\"\n and \"\\_real \\, \\_inner \\ \\\\<^sub>C sim_outer \\ \\ sim_inner \\ \\\" for \\ by(rule WT_intro)+\n\n { fix \\ :: \"security \\ ('g + 'b, 'h + 'd) distinguisher\"\n assume WT [WT_intro]: \"\\_real \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\\" for \\\n assume bound_outer [interaction_bound]: \"interaction_bounded_by (\\_. True) (\\ \\) (bound_outer \\)\" for \\\n assume lossless [plossless_intro]:\n \"lossless_outer \\ lossless_inner \\ plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common \\) (\\ \\)\" for \\\n\n let ?\\ = \"\\\\. absorb (\\ \\) (sim_outer \\ |\\<^sub>= 1\\<^sub>C)\"\n have \"\\_middle \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n moreover have \"interaction_any_bounded_by (?\\ \\) (bound_inner \\)\" for \\\n by interaction_bound_converter(rule bound_le)\n moreover have \"plossless_gpv (\\_middle \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\" if lossless_inner for \\\n by(rule plossless_intro WT_intro | simp add: that)+\n ultimately have \"negligible (\\\\. advantage (?\\ \\) (sim_inner \\ |\\<^sub>= 1\\<^sub>C \\ ideal \\) (middle \\))\"\n by(rule inner.adv)\n also have \"negligible (\\\\. advantage (\\ \\) (sim_outer \\ |\\<^sub>= 1\\<^sub>C \\ middle \\) (real \\))\"\n by(rule outer.adv[OF WT bound_outer lossless]) simp\n finally (negligible_plus)\n show \"negligible (\\\\. advantage (\\ \\) (sim_outer \\ \\ sim_inner \\ |\\<^sub>= 1\\<^sub>C \\ ideal \\) (real \\))\"\n apply(rule negligible_mono)\n apply(simp add: bigo_def)\n apply(rule exI[where x=1])\n apply simp\n apply(rule always_eventually)\n apply(clarsimp simp add: advantage_def)\n apply(rule order_trans)\n apply(rule abs_diff_triangle_ineq2)\n apply(rule add_right_mono)\n apply(clarsimp simp add: advantage_def distinguish_attach[symmetric] attach_compose[symmetric] comp_converter_parallel2 comp_converter_id_left)\n done\n next\n from inner.correct obtain cnv_inner\n where correct_inner: \"\\\\. \\ \\\\. \\_inner \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound_inner \\);\n \\\\. lossless_inner \\ plossless_gpv (\\_inner \\ \\\\<^sub>\\ \\_common \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_inner \\) (\\_middle \\) (cnv_inner \\) (w1 \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal \\) (cnv_inner \\ |\\<^sub>= 1\\<^sub>C \\ middle \\))\"\n by blast\n from outer.correct obtain cnv_outer\n where correct_outer: \"\\\\. \\ \\\\. \\_middle \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound_outer \\);\n \\\\. lossless_outer \\ plossless_gpv (\\_middle \\ \\\\<^sub>\\ \\_common \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_middle \\) (\\_real \\) (cnv_outer \\) (w2 \\)) \\\n negligible (\\\\. advantage (\\ \\) (middle \\) (cnv_outer \\ |\\<^sub>= 1\\<^sub>C \\ real \\))\"\n by blast\n show \"\\cnv. \\\\. (\\\\. \\_inner \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\) \\\n (\\\\. interaction_any_bounded_by (\\ \\) (bound_outer \\)) \\\n (\\\\. lossless_outer \\ lossless_inner \\ plossless_gpv (\\_inner \\ \\\\<^sub>\\ \\_common \\) (\\ \\)) \\\n (\\\\. wiring (\\_inner \\) (\\_real \\) (cnv \\) (w1 \\ \\\\<^sub>w w2 \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real \\))\"\n proof(intro exI strip conjI)\n fix \\ :: \"security \\ ('e + 'b, 'f + 'd) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. \\_inner \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound_outer \\)\"\n and lossless [rule_format]: \"\\\\. lossless_outer \\ lossless_inner \\ plossless_gpv (\\_inner \\ \\\\<^sub>\\ \\_common \\) (\\ \\)\"\n\n let ?cnv = \"\\\\. cnv_inner \\ \\ cnv_outer \\\"\n\n have bound': \"interaction_any_bounded_by (\\ \\) (bound_inner \\)\" for \\ using bound[of \\] bound_le[of \\]\n by(clarsimp elim!: interaction_bounded_by_mono order_trans[rotated] simp add: max_def)\n (metis (full_types) linorder_linear more_arith_simps(6) mult_left_mono zero_le)\n from correct_inner[OF WT_D bound' lossless]\n have w1: \"\\\\. wiring (\\_inner \\) (\\_middle \\) (cnv_inner \\) (w1 \\)\"\n and adv1: \"negligible (\\\\. advantage (\\ \\) (ideal \\) (cnv_inner \\ |\\<^sub>= 1\\<^sub>C \\ middle \\))\"\n by auto\n\n obtain f g where WT_inner [WT_intro]: \"\\\\. \\_inner \\, \\_middle \\ \\\\<^sub>C cnv_inner \\ \\\"\n and fg [simp]: \"\\\\. w1 \\ = (f \\, g \\)\"\n and eq1: \"\\\\. \\_inner \\, \\_middle \\ \\\\<^sub>C cnv_inner \\ \\ map_converter id id (f \\) (g \\) 1\\<^sub>C\"\n using w1\n apply(atomize_elim)\n apply(fold all_conj_distrib)\n apply(subst choice_iff[symmetric])+\n apply(fastforce elim!: wiring.cases)\n done\n\n from w1 have [WT_intro]: \"\\_inner \\, \\_middle \\ \\\\<^sub>C cnv_inner \\ \\\" for \\ by cases\n\n let ?\\ = \"\\\\. absorb (\\ \\) (map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= 1\\<^sub>C)\"\n have \\: \"\\_inner \\ \\ map_\\ (f \\) (g \\) (\\_middle \\)\" for \\\n using eq_\\_converterD_WT1[OF eq1 WT_inner, of \\] by(rule WT_map_converter_idD)\n with WT_converter_id have [WT_intro]: \"\\_inner \\, map_\\ (f \\) (g \\) (\\_middle \\) \\\\<^sub>C 1\\<^sub>C \\\" \n for \\ by(rule WT_converter_mono) simp\n\n have WT_D': \"\\_middle \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro | simp)+\n have bound': \"interaction_any_bounded_by (?\\ \\) (bound_outer \\)\" for \\\n by(subst map_converter_id_move_left)(interaction_bound; simp)\n have [simp]: \"plossless_converter (\\_inner \\) (map_\\ (f \\) (g \\) (\\_middle \\)) 1\\<^sub>C \" for \\\n using plossless_id_converter _ \\[of \\] by(rule plossless_converter_mono) auto\n from lossless\n have \"plossless_gpv (\\_middle \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\" if lossless_outer for \\\n by(rule plossless_gpv_absorb)(auto simp add: that intro!: WT_intro plossless_parallel_converter2 plossless_map_converter)\n from correct_outer[OF WT_D' bound' this]\n have w2: \"\\\\. wiring (\\_middle \\) (\\_real \\) (cnv_outer \\) (w2 \\)\"\n and adv2: \"negligible (\\\\. advantage (?\\ \\) (middle \\) (cnv_outer \\ |\\<^sub>= 1\\<^sub>C \\ real \\))\"\n by auto\n from w2 have [WT_intro]: \"\\_middle \\, \\_real \\ \\\\<^sub>C cnv_outer \\ \\\" for \\ by cases\n\n show \"wiring (\\_inner \\) (\\_real \\) (?cnv \\) (w1 \\ \\\\<^sub>w w2 \\)\" for \\\n using w1 w2 by(rule wiring_comp_converterI)\n\n have eq1': \"connect (\\ \\) (cnv_inner \\ |\\<^sub>= 1\\<^sub>C \\ middle \\) = connect (?\\ \\) (middle \\)\" for \\\n unfolding distinguish_attach[symmetric]\n by(rule connect_eq_resource_cong WT_intro eq_\\_attach_on' parallel_converter2_eq_\\_cong eq1 eq_\\_converter_reflI order_refl)+\n have eq2': \"connect (?\\ \\) (cnv_outer \\ |\\<^sub>= 1\\<^sub>C \\ real \\) = connect (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C \\ real \\)\" for \\\n unfolding distinguish_attach[symmetric] attach_compose comp_converter_parallel2[symmetric]\n by(rule connect_eq_resource_cong WT_intro eq_\\_attach_on' parallel_converter2_eq_\\_cong eq1[symmetric] eq_\\_converter_reflI order_refl|simp)+\n\n show \"negligible (\\\\. advantage (\\ \\) (ideal \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ real \\))\"\n using negligible_plus[OF adv1 adv2] unfolding advantage_def eq1' eq2' comp_converter_id_right\n by(rule negligible_le) simp\n qed\n }\nqed\n\ntheorem (in constructive_security) lifting:\n assumes WT_conv [WT_intro]: \"\\\\. \\_common' \\, \\_common \\ \\\\<^sub>C conv \\ \\\"\n and bound [interaction_bound]: \"\\\\. interaction_any_bounded_converter (conv \\) (bound_conv \\)\"\n and bound_le: \"\\\\. bound' \\ * max (bound_conv \\) 1 \\ bound \\\"\n and lossless [plossless_intro]: \"\\\\. lossless \\ plossless_converter (\\_common' \\) (\\_common \\) (conv \\)\"\n shows \"constructive_security\n (\\\\. 1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\) (\\\\. 1\\<^sub>C |\\<^sub>= conv \\ \\ ideal_resource \\) sim\n \\_real \\_ideal \\_common' bound' lossless w\"\nproof\n fix \\ :: \"security \\ ('a + 'g, 'b + 'h) distinguisher\"\n assume WT_\\ [WT_intro]: \"\\_real \\ \\\\<^sub>\\ \\_common' \\ \\g \\ \\ \\\" for \\\n assume bound_\\ [interaction_bound]: \"interaction_any_bounded_by (\\ \\) (bound' \\)\" for \\\n assume lossless_\\ [plossless_intro]: \"lossless \\ plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common' \\) (\\ \\)\" for \\\n\n let ?\\ = \"\\\\. absorb (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\)\"\n\n have ideal: \"connect (\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= conv \\ \\ ideal_resource \\) = connect (?\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\)\" for \\\n by(simp add: distinguish_attach[symmetric] attach_compose[symmetric] comp_converter_parallel2 comp_converter_id_left comp_converter_id_right)\n have real: \"connect (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\) = connect (?\\ \\) (real_resource \\)\" for \\\n by(simp add: distinguish_attach[symmetric])\n have \"\\_real \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n moreover have \"interaction_any_bounded_by (?\\ \\) (bound \\)\" for \\\n by interaction_bound_converter(use bound_le[of \\] in \\simp add: max.commute\\)\n moreover have \" plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common \\) (absorb (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\))\" if lossless for \\\n by(rule plossless_intro WT_intro | simp add: that)+\n ultimately show \"negligible (\\\\. advantage (\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= conv \\ \\ ideal_resource \\) (1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\))\"\n unfolding advantage_def ideal real by(rule adv[unfolded advantage_def])\nnext\n from correct obtain cnv \n where correct': \"\\\\. \\ \\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound \\);\n \\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n by blast\n show \"\\cnv. \\\\. (\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common' \\ \\g \\ \\ \\) \\\n (\\\\. interaction_any_bounded_by (\\ \\) (bound' \\)) \\\n (\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common' \\) (\\ \\)) \\\n (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\ \\ ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\))\"\n proof(intro exI conjI strip)\n fix \\ :: \"security \\ ('c + 'g, 'd + 'h) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. \\_ideal \\ \\\\<^sub>\\ \\_common' \\ \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound' \\)\"\n and lossless [rule_format]: \"\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common' \\) (\\ \\)\"\n\n let ?\\ = \"\\\\. absorb (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\)\"\n have WT_D' [WT_intro]: \"\\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n have bound': \"interaction_any_bounded_by (?\\ \\) (bound \\)\" for \\\n by interaction_bound(use bound_le[of \\] in \\auto simp add: max_def split: if_split_asm\\)\n have \"plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\" if lossless for \\\n by(rule lossless that WT_intro plossless_intro)+\n from correct'[OF WT_D' bound' this]\n have w1: \"wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\" \n and adv': \"negligible (\\\\. advantage (?\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\" for \\\n by auto\n show \"wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\" for \\ by(rule w1)\n have \"cnv \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\ = 1\\<^sub>C |\\<^sub>= conv \\ \\ cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\\" for \\\n by(simp add: attach_compose[symmetric] comp_converter_parallel2 comp_converter_id_left comp_converter_id_right)\n with adv'\n show \"negligible (\\\\. advantage (\\ \\) (1\\<^sub>C |\\<^sub>= conv \\ \\ ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ 1\\<^sub>C |\\<^sub>= conv \\ \\ real_resource \\))\"\n by(simp add: advantage_def distinguish_attach[symmetric])\n qed\nqed(rule WT_intro)+\n\ntheorem constructive_security_trivial:\n fixes res\n assumes [WT_intro]: \"\\\\. \\ \\ \\\\<^sub>\\ \\_common \\ \\res res \\ \\\"\n shows \"constructive_security res res (\\_. 1\\<^sub>C) \\ \\ \\_common bound lossless (\\_. (id, id))\"\nproof\n show \"\\ \\ \\\\<^sub>\\ \\_common \\ \\res res \\ \\\" and \"\\ \\, \\ \\ \\\\<^sub>C 1\\<^sub>C \\\" for \\ by(rule WT_intro)+\n\n fix \\ :: \"security \\ ('a + 'b, 'c + 'd) distinguisher\"\n assume WT [WT_intro]: \"\\ \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\\" for \\\n have \"connect (\\ \\) (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res \\) = connect (\\ \\) (1\\<^sub>C \\ res \\)\" for \\\n by(rule connect_eq_resource_cong[OF WT])(fastforce intro: WT_intro eq_\\_attach_on' parallel_converter2_id_id)+\n then show \"negligible (\\\\. advantage (\\ \\) (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res \\) (res \\))\"\n unfolding advantage_def by simp\nnext\n show \"\\cnv. \\\\. (\\\\. \\ \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\) \\\n (\\\\. interaction_any_bounded_by (\\ \\) (bound \\)) \\\n (\\\\. lossless \\ plossless_gpv (\\ \\ \\\\<^sub>\\ \\_common \\) (\\ \\)) \\\n (\\\\. wiring (\\ \\) (\\ \\) (cnv \\) (id, id)) \\\n negligible (\\\\. advantage (\\ \\) (res \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ res \\))\"\n proof(intro exI strip conjI)\n fix \\ :: \"security \\ ('a + 'b, 'c + 'd) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. \\ \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_bounded_by (\\_. True) (\\ \\) (bound \\)\"\n and lossless [rule_format]: \"\\\\. lossless \\ plossless_gpv (\\ \\ \\\\<^sub>\\ \\_common \\) (\\ \\)\"\n show \"wiring (\\ \\) (\\ \\) 1\\<^sub>C (id, id)\" for \\ by simp\n have \"connect (\\ \\) (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res \\) = connect (\\ \\) (1\\<^sub>C \\ res \\)\" for \\\n by(rule connect_eq_resource_cong)(rule WT_intro eq_\\_attach_on' parallel_converter2_id_id order_refl)+\n then show \"negligible (\\\\. advantage (\\ \\) (res \\) (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res \\))\"\n by(auto simp add: advantage_def)\n qed\nqed\n\ntheorem parallel_constructive_security:\n assumes \"constructive_security real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 bound1 lossless1 w1\"\n assumes \"constructive_security real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 bound2 lossless2 w2\"\n (* TODO: add symmetric case for lossless1/2 *)\n and lossless_real1 [plossless_intro]: \"\\\\. lossless2 \\ lossless_resource (\\_real1 \\ \\\\<^sub>\\ \\_common1 \\) (real1 \\)\"\n and lossless_sim2 [plossless_intro]: \"\\\\. lossless1 \\ plossless_converter (\\_real2 \\) (\\_inner2 \\) (sim2 \\)\"\n and lossless_ideal2 [plossless_intro]: \"\\\\. lossless1 \\ lossless_resource (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) (ideal2 \\)\"\n shows \"constructive_security (\\\\. parallel_wiring \\ real1 \\ \\ real2 \\) (\\\\. parallel_wiring \\ ideal1 \\ \\ ideal2 \\) (\\\\. sim1 \\ |\\<^sub>= sim2 \\) \n (\\\\. \\_real1 \\ \\\\<^sub>\\ \\_real2 \\) (\\\\. \\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) (\\\\. \\_common1 \\ \\\\<^sub>\\ \\_common2 \\)\n (\\\\. min (bound1 \\) (bound2 \\)) (lossless1 \\ lossless2) (\\\\. w1 \\ |\\<^sub>w w2 \\)\"\nproof\n interpret sec1: constructive_security real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 bound1 lossless1 w1 by fact\n interpret sec2: constructive_security real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 bound2 lossless2 w2 by fact\n\n show \"(\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\) \\res parallel_wiring \\ real1 \\ \\ real2 \\ \\\"\n and \"(\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\) \\res parallel_wiring \\ ideal1 \\ \\ ideal2 \\ \\\"\n and \"\\_real1 \\ \\\\<^sub>\\ \\_real2 \\, \\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\ \\\\<^sub>C sim1 \\ |\\<^sub>= sim2 \\ \\\" for \\ by(rule WT_intro)+\n\n fix \\ :: \"security \\ (('a + 'g) + 'b + 'h, ('c + 'i) + 'd + 'j) distinguisher\"\n assume WT [WT_intro]: \"(\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\) \\g \\ \\ \\\" for \\\n assume bound [interaction_bound]: \"interaction_any_bounded_by (\\ \\) (min (bound1 \\) (bound2 \\))\" for \\\n assume lossless [plossless_intro]: \"lossless1 \\ lossless2 \\ plossless_gpv ((\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) (\\ \\)\" for \\\n\n let ?\\ = \"\\\\. absorb (\\ \\) (parallel_wiring \\ parallel_converter (converter_of_resource (real1 \\)) 1\\<^sub>C)\"\n\n have *:\"\\_uniform (outs_\\ ((\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)))\n UNIV,(\\_real1 \\ \\\\<^sub>\\ \\_common1 \\) \\\\<^sub>\\ (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) \\\\<^sub>C\n ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring\" for \\\n by(rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def intro: parallel_converter2_eq_\\_cong eq_\\_converter_reflI WT_converter_parallel_converter2\n WT_converter_id sec2.WT_sim parallel_converter2_id_id[symmetric] eq_\\_converter_reflI WT_parallel_wiring)\n\n have **: \"outs_\\ ((\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) \\\\<^sub>R\n ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ \\ ideal2 \\ \\\n parallel_wiring \\ (converter_of_resource (real1 \\) |\\<^sub>\\ 1\\<^sub>C) \\ sim2 \\ |\\<^sub>= 1\\<^sub>C \\ ideal2 \\\" for \\\n unfolding comp_parallel_wiring\n by(rule eq_resource_on_trans, rule eq_\\_attach_on[where conv'=\"parallel_wiring \\ (1\\<^sub>C |\\<^sub>= sim2 \\ |\\<^sub>= 1\\<^sub>C)\"]\n , (rule WT_intro)+, rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def attach_compose attach_parallel2 attach_converter_of_resource_conv_parallel_resource\n intro: WT_intro parallel_converter2_eq_\\_cong parallel_converter2_id_id eq_\\_converter_reflI)\n\n have ideal2:\n \"connect (\\ \\) ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ ideal2 \\) =\n connect (?\\ \\) (sim2 \\ |\\<^sub>= 1\\<^sub>C \\ ideal2 \\)\" for \\\n unfolding distinguish_attach[symmetric]\n proof (rule connect_eq_resource_cong[OF WT, rotated], goal_cases)\n case 2\n then show ?case \n by(subst attach_compose[symmetric], rule eq_resource_on_trans\n , rule eq_\\_attach_on[where conv'=\"((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring\"])\n ((rule WT_intro)+ | intro * | intro ** )+\n qed (rule WT_intro)+\n have real2: \"connect (\\ \\) (parallel_wiring \\ real1 \\ \\ real2 \\) = connect (?\\ \\) (real2 \\)\" for \\\n unfolding distinguish_attach[symmetric]\n by(simp add: attach_compose attach_converter_of_resource_conv_parallel_resource)\n have \"\\_real2 \\ \\\\<^sub>\\ \\_common2 \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n moreover have \"interaction_any_bounded_by (?\\ \\) (bound2 \\)\" for \\\n by interaction_bound_converter simp\n moreover have \"plossless_gpv (\\_real2 \\ \\\\<^sub>\\ \\_common2 \\) (?\\ \\)\" if \"lossless2\" for \\ \n by(rule plossless_intro WT_intro | simp add: that)+\n ultimately\n have negl2: \"negligible (\\\\. advantage (\\ \\)\n ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ ideal2 \\)\n (parallel_wiring \\ real1 \\ \\ real2 \\))\"\n unfolding advantage_def ideal2 real2 by(rule sec2.adv[unfolded advantage_def])\n\n let ?\\ = \"\\\\. absorb (\\ \\) (parallel_wiring \\ parallel_converter 1\\<^sub>C (converter_of_resource (sim2 \\ |\\<^sub>= 1\\<^sub>C \\ ideal2 \\)))\"\n have ideal1: \n \"connect (\\ \\) ((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ ideal1 \\ \\ ideal2 \\) =\n connect (?\\ \\) (sim1 \\ |\\<^sub>= 1\\<^sub>C \\ ideal1 \\)\" for \\\n proof -\n have *: \"\\_uniform ((outs_\\ (\\_real1 \\) <+> outs_\\ (\\_real2 \\)) <+> outs_\\ (\\_common1 \\) <+> \n outs_\\ (\\_common2 \\)) UNIV,(\\_inner1 \\ \\\\<^sub>\\ \\_common1 \\) \\\\<^sub>\\ (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) \\\\<^sub>C\n ((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring\"\n by(rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def comp_parallel_wiring' attach_compose attach_parallel2 attach_converter_of_resource_conv_parallel_resource2\n intro: WT_intro parallel_converter2_id_id[symmetric] eq_\\_converter_reflI parallel_converter2_eq_\\_cong eq_\\_converter_mono)\n\n have **:\"((outs_\\ (\\_real1 \\) <+> outs_\\ (\\_real2 \\)) <+> outs_\\ (\\_common1 \\) <+> outs_\\ (\\_common2 \\)) \\\\<^sub>R\n (sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ ideal1 \\ \\ ideal2 \\ \\\n parallel_wiring \\ (1\\<^sub>C |\\<^sub>\\ converter_of_resource (sim2 \\ |\\<^sub>= 1\\<^sub>C \\ ideal2 \\)) \\ sim1 \\ |\\<^sub>= 1\\<^sub>C \\ ideal1 \\\"\n unfolding attach_compose[symmetric]\n by(rule eq_resource_on_trans, rule eq_\\_attach_on[where conv'=\"((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring\"])\n ((rule WT_intro)+ | intro * | auto simp add: le_\\_def comp_parallel_wiring' attach_compose \n attach_parallel2 attach_converter_of_resource_conv_parallel_resource2 intro: WT_intro *)+\n\n show ?thesis\n unfolding distinguish_attach[symmetric] using WT\n by(rule connect_eq_resource_cong) (simp add: **, (rule WT_intro)+)\n qed\n\n have real1:\n \"connect (\\ \\) ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ ideal2 \\) =\n connect (?\\ \\) (real1 \\)\" for \\\n proof -\n have **: \"\\_uniform (outs_\\ ((\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)))\n UNIV,(\\_real1 \\ \\\\<^sub>\\ \\_common1 \\) \\\\<^sub>\\ (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) \\\\<^sub>C\n ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring\" \n by(rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def intro: WT_intro parallel_converter2_eq_\\_cong WT_converter_parallel_converter2\n parallel_converter2_id_id[symmetric] eq_\\_converter_reflI WT_parallel_wiring)\n\n have *: \"outs_\\ ((\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) \\\\<^sub>R\n parallel_wiring \\ ((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= sim2 \\ |\\<^sub>= 1\\<^sub>C) \\ real1 \\ \\ ideal2 \\ \\\n parallel_wiring \\ (1\\<^sub>C |\\<^sub>\\ converter_of_resource (sim2 \\ |\\<^sub>= 1\\<^sub>C \\ ideal2 \\)) \\ real1 \\\"\n by(rule eq_resource_on_trans, rule eq_\\_attach_on[where conv'=\"parallel_wiring \\ (1\\<^sub>C |\\<^sub>= sim2 \\ |\\<^sub>= 1\\<^sub>C)\"]\n , (rule WT_intro)+, rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def attach_compose attach_converter_of_resource_conv_parallel_resource2 attach_parallel2 \n intro: WT_intro parallel_converter2_eq_\\_cong parallel_converter2_id_id eq_\\_converter_reflI)\n\n show ?thesis\n unfolding distinguish_attach[symmetric] using WT\n by(rule connect_eq_resource_cong, fold attach_compose)\n (rule eq_resource_on_trans[where res'=\"((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ \\ ideal2 \\\"]\n , (rule eq_\\_attach_on, (intro * ** | subst comp_parallel_wiring | rule eq_\\_attach_on | (rule WT_intro eq_\\_attach_on)+ )+))\n qed\n\n have \"\\_real1 \\ \\\\<^sub>\\ \\_common1 \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n moreover have \"interaction_any_bounded_by (?\\ \\) (bound1 \\)\" for \\\n by interaction_bound_converter simp\n moreover have \"plossless_gpv (\\_real1 \\ \\\\<^sub>\\ \\_common1 \\) (?\\ \\)\" if \"lossless1\" for \\ \n by(rule plossless_intro WT_intro | simp add: that)+\n ultimately\n have negl1: \"negligible (\\\\. advantage (\\ \\) \n ((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ ideal1 \\ \\ ideal2 \\)\n ((1\\<^sub>C |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ ideal2 \\))\"\n unfolding advantage_def ideal1 real1 by(rule sec1.adv[unfolded advantage_def])\n\n from negligible_plus[OF negl1 negl2]\n show \"negligible (\\\\. advantage (\\ \\) ((sim1 \\ |\\<^sub>= sim2 \\) |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ ideal1 \\ \\ ideal2 \\)\n (parallel_wiring \\ real1 \\ \\ real2 \\))\"\n by(rule negligible_mono) (auto simp add: advantage_def intro!: eventuallyI landau_o.big_mono )\nnext\n interpret sec1: constructive_security real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 bound1 lossless1 w1 by fact\n interpret sec2: constructive_security real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 bound2 lossless2 w2 by fact\n from sec1.correct obtain cnv1\n where correct1: \"\\\\. \\ \\\\. \\_inner1 \\ \\\\<^sub>\\ \\_common1 \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound1 \\);\n \\\\. lossless1 \\ plossless_gpv (\\_inner1 \\ \\\\<^sub>\\ \\_common1 \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_inner1 \\) (\\_real1 \\) (cnv1 \\) (w1 \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal1 \\) (cnv1 \\ |\\<^sub>= 1\\<^sub>C \\ real1 \\))\"\n by blast\n from sec2.correct obtain cnv2\n where correct2: \"\\\\. \\ \\\\. \\_inner2 \\ \\\\<^sub>\\ \\_common2 \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound2 \\);\n \\\\. lossless2 \\ plossless_gpv (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_inner2 \\) (\\_real2 \\) (cnv2 \\) (w2 \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal2 \\) (cnv2 \\ |\\<^sub>= 1\\<^sub>C \\ real2 \\))\"\n by blast\n show \"\\cnv. \\\\. (\\\\. (\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\) \\g \\ \\ \\) \\\n (\\\\. interaction_any_bounded_by (\\ \\) (min (bound1 \\) (bound2 \\))) \\\n (\\\\. lossless1 \\ lossless2 \\ plossless_gpv ((\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) (\\ \\)) \\\n (\\\\. wiring (\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) (\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) (cnv \\) (w1 \\ |\\<^sub>w w2 \\)) \\\n negligible (\\\\. advantage (\\ \\) (parallel_wiring \\ ideal1 \\ \\ ideal2 \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ real2 \\))\"\n proof(intro exI strip conjI)\n fix \\ :: \"security \\ (('e + 'k) + 'b + 'h, ('f + 'l) + 'd + 'j) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. (\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\) \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_any_bounded_by (\\ \\) (min (bound1 \\) (bound2 \\))\"\n and lossless [rule_format, plossless_intro]: \"\\\\. lossless1 \\ lossless2 \\ plossless_gpv ((\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) (\\ \\)\"\n\n let ?cnv = \"\\\\. cnv1 \\ |\\<^sub>= cnv2 \\\"\n\n let ?\\1 = \"\\\\. absorb (\\ \\) (parallel_wiring \\ parallel_converter 1\\<^sub>C (converter_of_resource (ideal2 \\)))\"\n have WT1: \"\\_inner1 \\ \\\\<^sub>\\ \\_common1 \\ \\g ?\\1 \\ \\\" for \\ by(rule WT_intro)+\n have bound1: \"interaction_any_bounded_by (?\\1 \\) (bound1 \\)\" for \\ by interaction_bound simp\n have \"plossless_gpv (\\_inner1 \\ \\\\<^sub>\\ \\_common1 \\) (?\\1 \\)\" if lossless1 for \\\n by(rule plossless_intro WT_intro | simp add: that)+\n from correct1[OF WT1 bound1 this]\n have w1: \"wiring (\\_inner1 \\) (\\_real1 \\) (cnv1 \\) (w1 \\)\" \n and adv1: \"negligible (\\\\. advantage (?\\1 \\) (ideal1 \\) (cnv1 \\ |\\<^sub>= 1\\<^sub>C \\ real1 \\))\" for \\\n by auto\n\n from w1 obtain f g where fg: \"\\\\. w1 \\ = (f \\, g \\)\"\n and [WT_intro]: \"\\\\. \\_inner1 \\, \\_real1 \\ \\\\<^sub>C cnv1 \\ \\\" \n and eq1: \"\\\\. \\_inner1 \\, \\_real1 \\ \\\\<^sub>C cnv1 \\ \\ map_converter id id (f \\) (g \\) 1\\<^sub>C\"\n apply atomize_elim\n apply(fold all_conj_distrib)\n apply(subst choice_iff[symmetric])+\n apply(fastforce elim!: wiring.cases)\n done\n have \\1: \"\\_inner1 \\ \\ map_\\ (f \\) (g \\) (\\_real1 \\)\" for \\\n using eq_\\_converterD_WT1[OF eq1] by(rule WT_map_converter_idD)(rule WT_intro)\n with WT_converter_id order_refl have [WT_intro]: \"\\_inner1 \\, map_\\ (f \\) (g \\) (\\_real1 \\) \\\\<^sub>C 1\\<^sub>C \\\" for \\\n by(rule WT_converter_mono)\n have lossless1 [plossless_intro]: \"plossless_converter (\\_inner1 \\) (\\_real1 \\) (map_converter id id (f \\) (g \\) 1\\<^sub>C)\" for \\\n by(rule plossless_map_converter)(rule plossless_intro order_refl \\1 WT_intro plossless_converter_mono | simp)+\n\n let ?\\2 = \"\\\\. absorb (\\ \\) (parallel_wiring \\ parallel_converter (converter_of_resource (map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ real1 \\)) 1\\<^sub>C)\"\n have WT2: \"\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\ \\g ?\\2 \\ \\\" for \\ by(rule WT_intro | simp)+\n have bound2: \"interaction_any_bounded_by (?\\2 \\) (bound2 \\)\" for \\ by interaction_bound simp\n have \"plossless_gpv (\\_inner2 \\ \\\\<^sub>\\ \\_common2 \\) (?\\2 \\)\" if lossless2 for \\\n by(rule plossless_intro WT_intro | simp add: that)+\n from correct2[OF WT2 bound2 this]\n have w2: \"wiring (\\_inner2 \\) (\\_real2 \\) (cnv2 \\) (w2 \\)\" \n and adv2: \"negligible (\\\\. advantage (?\\2 \\) (ideal2 \\) (cnv2 \\ |\\<^sub>= 1\\<^sub>C \\ real2 \\))\" for \\\n by auto\n\n from w2 have [WT_intro]: \"\\_inner2 \\, \\_real2 \\ \\\\<^sub>C cnv2 \\ \\\" for \\ by cases\n\n have *: \"connect (\\ \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ real2 \\) =\n connect (?\\2 \\) (cnv2 \\ |\\<^sub>= 1\\<^sub>C \\ real2 \\)\" for \\\n proof -\n have \"outs_\\ ((\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) \\\\<^sub>\\ (\\_common1 \\ \\\\<^sub>\\ \\_common2 \\)) \\\\<^sub>R\n ?cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ real2 \\ \\ \n (map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= cnv2 \\) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ \\ real2 \\\"\n by(rule eq_\\_attach_on' WT_intro parallel_converter2_eq_\\_cong eq1 eq_\\_converter_reflI parallel_converter2_id_id[symmetric])+ simp\n also have \"(map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= cnv2 \\) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ \\ real2 \\ =\n parallel_wiring \\ (map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ real1 \\) \\ (cnv2 \\ |\\<^sub>= 1\\<^sub>C \\ real2 \\)\"\n by(simp add: comp_parallel_wiring' attach_compose attach_parallel2)\n finally show ?thesis\n by(auto intro!: connect_eq_resource_cong[OF WT_D] intro: WT_intro simp add: distinguish_attach[symmetric] attach_compose attach_converter_of_resource_conv_parallel_resource)\n qed\n\n have **: \"connect (?\\2 \\) (ideal2 \\) = connect (?\\1 \\) (cnv1 \\ |\\<^sub>= 1\\<^sub>C \\ real1 \\)\" for \\\n proof -\n have \"connect (?\\2 \\) (ideal2 \\) = \n connect (\\ \\) (parallel_wiring \\ ((map_converter id id (f \\) (g \\) 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= 1\\<^sub>C) \\ (real1 \\ \\ ideal2 \\))\"\n by(simp add: distinguish_attach[symmetric] attach_converter_of_resource_conv_parallel_resource attach_compose attach_parallel2)\n also have \"\\ = connect (\\ \\) (parallel_wiring \\ ((cnv1 \\ |\\<^sub>= 1\\<^sub>C) |\\<^sub>= 1\\<^sub>C) \\ (real1 \\ \\ ideal2 \\))\"\n unfolding attach_compose[symmetric] using WT_D\n by(rule connect_eq_resource_cong[symmetric])\n (rule eq_\\_attach_on' WT_intro eq_\\_comp_cong eq_\\_converter_reflI parallel_converter2_eq_\\_cong eq1 | simp)+\n also have \"\\ = connect (?\\1 \\) (cnv1 \\ |\\<^sub>= 1\\<^sub>C \\ real1 \\)\"\n by(simp add: distinguish_attach[symmetric] attach_converter_of_resource_conv_parallel_resource2 attach_compose attach_parallel2)\n finally show ?thesis .\n qed\n\n have ***: \"connect (?\\1 \\) (ideal1 \\) = connect (\\ \\) (parallel_wiring \\ ideal1 \\ \\ ideal2 \\)\" for \\\n by(auto intro!: connect_eq_resource_cong[OF WT_D] simp add: attach_converter_of_resource_conv_parallel_resource2 distinguish_attach[symmetric] attach_compose intro: WT_intro)\n\n show \"wiring (\\_inner1 \\ \\\\<^sub>\\ \\_inner2 \\) (\\_real1 \\ \\\\<^sub>\\ \\_real2 \\) (?cnv \\) (w1 \\ |\\<^sub>w w2 \\)\" for \\\n using w1 w2 by(rule wiring_parallel_converter2)\n from negligible_plus[OF adv1 adv2]\n show \"negligible (\\\\. advantage (\\ \\) (parallel_wiring \\ ideal1 \\ \\ ideal2 \\) (?cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_wiring \\ real1 \\ \\ real2 \\))\"\n by(rule negligible_le)(simp add: advantage_def * ** ***)\n qed\nqed\n\ntheorem (in constructive_security) parallel_realisation1:\n assumes WT_res: \"\\\\. \\_res \\ \\\\<^sub>\\ \\_common' \\ \\res res \\ \\\"\n and lossless_res: \"\\\\. lossless \\ lossless_resource (\\_res \\ \\\\<^sub>\\ \\_common' \\) (res \\)\"\n shows \"constructive_security (\\\\. parallel_wiring \\ res \\ \\ real_resource \\)\n (\\\\. parallel_wiring \\ (res \\ \\ ideal_resource \\)) (\\\\. parallel_converter2 id_converter (sim \\)) \n (\\\\. \\_res \\ \\\\<^sub>\\ \\_real \\) (\\\\. \\_res \\ \\\\<^sub>\\ \\_ideal \\) (\\\\. \\_common' \\ \\\\<^sub>\\ \\_common \\) bound lossless (\\\\. (id, id) |\\<^sub>w w \\)\"\n by(rule parallel_constructive_security[OF constructive_security_trivial[where lossless=False and bound=\"\\_. \\\", OF WT_res], simplified, OF _ lossless_res])\n unfold_locales\n\ntheorem (in constructive_security) parallel_realisation2:\n assumes WT_res: \"\\\\. \\_res \\ \\\\<^sub>\\ \\_common' \\ \\res res \\ \\\"\n and lossless_res: \"\\\\. lossless \\ lossless_resource (\\_res \\ \\\\<^sub>\\ \\_common' \\) (res \\)\"\n shows \"constructive_security (\\\\. parallel_wiring \\ real_resource \\ \\ res \\)\n (\\\\. parallel_wiring \\ (ideal_resource \\ \\ res \\)) (\\\\. parallel_converter2 (sim \\) id_converter) \n (\\\\. \\_real \\ \\\\<^sub>\\ \\_res \\) (\\\\. \\_ideal \\ \\\\<^sub>\\ \\_res \\) (\\\\. \\_common \\ \\\\<^sub>\\ \\_common' \\) bound lossless (\\\\. w \\ |\\<^sub>w (id, id))\"\n by(rule parallel_constructive_security[OF _ constructive_security_trivial[where lossless=False and bound=\"\\_. \\\", OF WT_res], simplified, OF _ lossless_res])\n unfold_locales\n\ntheorem (in constructive_security) parallel_resource1:\n assumes WT_res [WT_intro]: \"\\\\. \\_res \\ \\res res \\ \\\"\n and lossless_res [plossless_intro]: \"\\\\. lossless \\ lossless_resource (\\_res \\) (res \\)\"\n shows \"constructive_security (\\\\. parallel_resource1_wiring \\ res \\ \\ real_resource \\)\n (\\\\. parallel_resource1_wiring \\ res \\ \\ ideal_resource \\) sim \n \\_real \\_ideal (\\\\. \\_res \\ \\\\<^sub>\\ \\_common \\) bound lossless w\"\nproof\n fix \\ :: \"security \\ ('a + 'g + 'e, 'b + 'h + 'f) distinguisher\"\n assume WT [WT_intro]: \"\\_real \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\) \\g \\ \\ \\\" for \\\n assume bound [interaction_bound]: \"interaction_any_bounded_by (\\ \\) (bound \\)\" for \\\n assume lossless [plossless_intro]: \"lossless \\ plossless_gpv (\\_real \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\)) (\\ \\)\" for \\\n\n let ?\\ = \"\\\\. absorb (\\ \\) (swap_lassocr \\ parallel_converter (converter_of_resource (res \\)) 1\\<^sub>C)\"\n have ideal:\n \"connect (\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ parallel_resource1_wiring \\ res \\ \\ ideal_resource \\) =\n connect (?\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\)\" for \\\n proof -\n have[intro]: \"\\_uniform (outs_\\ (\\_real \\) <+> outs_\\ (\\_res \\) <+> outs_\\ (\\_common \\))\n UNIV,\\_ideal \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\) \\\\<^sub>C sim \\ |\\<^sub>= 1\\<^sub>C \\ sim \\ |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \" \n by(rule eq_\\_converter_mono) (auto simp add: le_\\_def intro!: \n WT_intro parallel_converter2_id_id[symmetric] parallel_converter2_eq_\\_cong eq_\\_converter_reflI)\n\n have *: \"outs_\\ (\\_real \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\)) \\\\<^sub>R (sim \\ |\\<^sub>= 1\\<^sub>C) \\ parallel_resource1_wiring \\ res \\ \\ ideal_resource \\ \\\n swap_lassocr \\ (converter_of_resource (res \\) |\\<^sub>\\ 1\\<^sub>C) \\ sim \\ |\\<^sub>= 1\\<^sub>C \\ ideal_resource \\\" \n by (rule eq_resource_on_trans[where res'=\"(sim \\ |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_resource1_wiring \\ res \\ \\ ideal_resource \\\"], \n rule eq_\\_attach_on, (rule WT_intro)+, rule eq_\\_comp_cong)\n (auto simp add: parallel_resource1_wiring_def comp_swap_lassocr attach_compose attach_parallel2 \n attach_converter_of_resource_conv_parallel_resource intro!: WT_intro eq_\\_converter_reflI) \n\n show ?thesis\n unfolding distinguish_attach[symmetric] using WT\n by(rule connect_eq_resource_cong, subst attach_compose[symmetric])\n (intro *, (rule WT_intro)+)\n qed\n have real:\n \"connect (\\ \\) (parallel_resource1_wiring \\ res \\ \\ real_resource \\) =\n connect (?\\ \\) (real_resource \\)\" for \\\n unfolding distinguish_attach[symmetric]\n by(simp add: attach_compose attach_converter_of_resource_conv_parallel_resource parallel_resource1_wiring_def)\n have \"\\_real \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n moreover have \"interaction_any_bounded_by (?\\ \\) (bound \\)\" for \\\n by interaction_bound_converter simp\n moreover have \"plossless_gpv (\\_real \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\" if lossless for \\ \n by(rule plossless_intro WT_intro | simp add: that)+\n ultimately show \"negligible (\\\\. advantage (\\ \\) (sim \\ |\\<^sub>= 1\\<^sub>C \\\n parallel_resource1_wiring \\ res \\ \\ ideal_resource \\)\n (parallel_resource1_wiring \\ res \\ \\ real_resource \\))\"\n unfolding advantage_def ideal real by(rule adv[unfolded advantage_def])\nnext\n from correct obtain cnv \n where correct': \"\\\\. \\ \\\\. \\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g \\ \\ \\;\n \\\\. interaction_any_bounded_by (\\ \\) (bound \\);\n \\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (\\ \\) \\\n \\ (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n by blast\n show \"\\cnv. \\\\. (\\\\. \\_ideal \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\) \\g \\ \\ \\) \\\n (\\\\. interaction_any_bounded_by (\\ \\) (bound \\)) \\\n (\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\)) (\\ \\)) \\\n (\\\\. wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)) \\\n negligible (\\\\. advantage (\\ \\) (parallel_resource1_wiring \\ res \\ \\ ideal_resource \\)\n (cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_resource1_wiring \\ res \\ \\ real_resource \\))\"\n proof(intro exI conjI strip)\n fix \\ :: \"security \\ ('c + 'g + 'e, 'd + 'h + 'f) distinguisher\"\n assume WT_D [rule_format, WT_intro]: \"\\\\. \\_ideal \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\) \\g \\ \\ \\\"\n and bound [rule_format, interaction_bound]: \"\\\\. interaction_any_bounded_by (\\ \\) (bound \\)\"\n and lossless [rule_format, plossless_intro]: \"\\\\. lossless \\ plossless_gpv (\\_ideal \\ \\\\<^sub>\\ (\\_res \\ \\\\<^sub>\\ \\_common \\)) (\\ \\)\"\n\n let ?\\ = \"\\\\. absorb (\\ \\) (swap_lassocr \\ parallel_converter (converter_of_resource (res \\)) 1\\<^sub>C)\"\n have WT': \"\\_ideal \\ \\\\<^sub>\\ \\_common \\ \\g ?\\ \\ \\\" for \\ by(rule WT_intro)+\n have bound': \"interaction_any_bounded_by (?\\ \\) (bound \\)\" for \\ by interaction_bound simp\n have lossless': \"plossless_gpv (\\_ideal \\ \\\\<^sub>\\ \\_common \\) (?\\ \\)\" if lossless for \\\n by(rule plossless_intro WT_intro that)+\n from correct'[OF WT' bound' lossless']\n have w: \"wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\" \n and adv: \"negligible (\\\\. advantage (?\\ \\) (ideal_resource \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n for \\ by auto\n show \"wiring (\\_ideal \\) (\\_real \\) (cnv \\) (w \\)\" for \\ by(rule w)\n from w have [WT_intro]: \"\\_ideal \\, \\_real \\ \\\\<^sub>C cnv \\ \\\" for \\ by cases\n have \"connect (\\ \\) (swap_lassocr \\ res \\ \\ (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\)) =\n connect (\\ \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ swap_lassocr \\ res \\ \\ real_resource \\)\" for \\\n proof -\n have \"connect (\\ \\) (cnv \\ |\\<^sub>= 1\\<^sub>C \\ swap_lassocr \\ res \\ \\ real_resource \\) =\n connect (\\ \\) (cnv \\ |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ swap_lassocr \\ res \\ \\ real_resource \\)\"\n by(rule connect_eq_resource_cong[OF WT_D]) \n (rule eq_\\_attach_on' WT_intro parallel_converter2_eq_\\_cong eq_\\_converter_reflI parallel_converter2_id_id[symmetric] | simp)+\n also have \"\\ = connect (\\ \\) (swap_lassocr \\ res \\ \\ (cnv \\ |\\<^sub>= 1\\<^sub>C \\ real_resource \\))\"\n by(simp add: comp_swap_lassocr' attach_compose attach_parallel2)\n finally show ?thesis by simp\n qed\n with adv show \"negligible (\\\\. advantage (\\ \\) (parallel_resource1_wiring \\ res \\ \\ ideal_resource \\)\n (cnv \\ |\\<^sub>= 1\\<^sub>C \\ parallel_resource1_wiring \\ res \\ \\ real_resource \\))\"\n by(simp add: advantage_def distinguish_attach[symmetric] attach_compose attach_converter_of_resource_conv_parallel_resource parallel_resource1_wiring_def)\n qed\nqed(rule WT_intro)+\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Constructive_Cryptography/Constructive_Cryptography.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4339814648038985, "lm_q1q2_score": 0.2811324195242119}} {"text": "section {*L\\_ATS\\_Simulation\\_Configuration\\_WeakLR\\_Unmarked\\_Effect*}\ntheory\n L_ATS_Simulation_Configuration_WeakLR_Unmarked_Effect\n\nimports\n L_ATS_Simulation_Configuration_Weak\n\nbegin\n\nlocale ATS_Simulation_Configuration_Weak_Unmarked_Effect =\n ATS_Simulation_Configuration_Weak\n \"TSstructure1 :: 'TSstructure1 \\ bool\"\n \"configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"initial_configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"step_labels1 :: 'TSstructure1 \\ 'label1 set\"\n \"step_relation1 :: 'TSstructure1 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ bool\"\n \"effects1 :: 'TSstructure1 \\ 'event1 set\"\n \"marking_condition1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ bool\"\n \"marked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"unmarked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"TSstructure2 :: 'TSstructure2 \\ bool\"\n \"configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"initial_configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"step_labels2 :: 'TSstructure2 \\ 'label2 set\"\n \"step_relation2 :: 'TSstructure2 \\ 'conf2 \\ 'label2 \\ 'conf2 \\ bool\"\n \"effects2 :: 'TSstructure2 \\ 'event2 set\"\n \"marking_condition2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ bool\"\n \"marked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"unmarked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"relation_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_initial_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_effect :: 'TSstructure1 \\ 'TSstructure2 \\ 'event1 \\ 'event2 \\ bool\"\n \"relation_TSstructure :: 'TSstructure1 \\ 'TSstructure2 \\ bool\"\n \"relation_initial_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n \"relation_step_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ 'conf2 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n for\n TSstructure1 configurations1 initial_configurations1 step_labels1 step_relation1 effects1 marking_condition1 marked_effect1 unmarked_effect1 TSstructure2 configurations2 initial_configurations2 step_labels2 step_relation2 effects2 marking_condition2 marked_effect2 unmarked_effect2 relation_configuration relation_initial_configuration relation_effect relation_TSstructure relation_initial_simulation relation_step_simulation\n +\n\nassumes AX_relation_step_simulation_preserves_unmarked_effect: \"\n relation_step_simulation_preservation G1 G2 d1' d2'\n \\ left_total_on\n (relation_effect G1 G2)\n (unmarked_effect1 G1 d1')\n (unmarked_effect2 G2 d2')\"\n\nassumes AX_relation_initial_simulation_preserves_unmarked_effect: \"\n relation_initial_simulation_preservation G1 G2 d1' d2'\n \\ left_total_on\n (relation_effect G1 G2)\n (unmarked_effect1 G1 d1')\n (unmarked_effect2 G2 d2')\"\n\ncontext ATS_Simulation_Configuration_Weak_Unmarked_Effect begin\n\ntheorem ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound: \"\n relation_TSstructure G1 G2\n \\ left_total_on (relation_effect G1 G2) (GL.finite_unmarked_language G1) (GR.finite_unmarked_language G2)\"\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(simp add: GL.finite_unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac a d x)(*strict*)\n apply(case_tac x)\n apply(rename_tac a d x)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac a d)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c)(*strict*)\n apply(rename_tac c1)\n apply(rename_tac a d c1)(*strict*)\n apply(subgoal_tac \"c1 \\ initial_configurations1 G1\")\n apply(rename_tac a d c1)(*strict*)\n prefer 2\n apply(simp add: GL.derivation_initial_def)\n apply(rename_tac a d c1)(*strict*)\n apply(subgoal_tac \"\\ds n. GR.derivation_initial G2 ds \\ relation_initial_configuration G1 G2 c1 (the(get_configuration(ds 0))) \\ relation_initial_simulation G1 G2 c1 ds \\ maximum_of_domain ds n \\ relation_configuration G1 G2 c1 (the(get_configuration(ds n)))\")\n apply(rename_tac a d c1)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation)\n apply(rename_tac a d c1)(*strict*)\n apply(force)\n apply(rename_tac a d c1)(*strict*)\n apply(force)\n apply(rename_tac a d c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 ds n)(*strict*)\n apply(subgoal_tac \"\\c2. ds 0 = Some (pair None c2)\")\n apply(rename_tac a d c1 ds n)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 (derivation_append (der1 c1) (der1 c1) 0)) (unmarked_effect2 G2 (derivation_append (der1 (the(get_configuration(ds 0)))) ds 0))\")\n apply(rename_tac a d c1 ds n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation_preserves_unmarked_effect)\n apply(rule relation_initial_simulation_preservation_PROVE)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n prefer 13\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n prefer 12\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: GL.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule GL.der1_is_derivation)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: GR.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule GR.der1_is_derivation)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def get_configuration_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule_tac\n t=\"Some (pair None c2)\"\n and s=\"ds 0\"\n in ssubst)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def get_configuration_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule simulating_derivation_exist_initial)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 d) (unmarked_effect2 G2 ds)\")\n apply(rename_tac a d c1 ds n c2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"d\"\n and s=\"derivation_append (der1 c1) (der1 c1) 0\"\n in ssubst)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 ds n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def)\n apply(clarsimp)\n apply (metis GL.derivation_initial_is_derivation GL.noSomeAfterMaxDom)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule_tac\n t=\"ds\"\n and s=\"derivation_append (der1 (the (get_configuration (Some (pair None c2))))) ds 0\"\n in ssubst)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 ds n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def get_configuration_def)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(thin_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 (derivation_append (der1 c1) (der1 c1) 0)) (unmarked_effect2 G2 (derivation_append (der1 (the (get_configuration (ds 0)))) ds 0))\")\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(simp add: left_total_on_def)\n apply(erule_tac\n x=\"a\"\n in ballE)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 ds n c2 b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in bexI)\n apply(rename_tac a d c1 ds n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n c2 b)(*strict*)\n apply(simp add: GR.finite_unmarked_language_def)\n apply(rule_tac\n x=\"ds\"\n in exI)\n apply(clarsimp)\n apply (metis)\n apply(rename_tac a d c1 ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 ds n)(*strict*)\n apply (metis GR.derivation_initial_is_derivation GR.some_position_has_details_at_0)\n apply(rename_tac a d)(*strict*)\n apply (metis GL.derivation_initial_is_derivation GL.some_position_has_details_at_0)\n apply(rename_tac a d x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d nat)(*strict*)\n apply(rename_tac x)\n apply(rename_tac a d x)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d x = Some (pair e1 c1) \\ d (Suc x) = Some (pair (Some e2) c2) \\ step_relation1 G1 c1 e2 c2\")\n apply(rename_tac a d x)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc x\"\n in GL.step_detail_before_some_position)\n apply(rename_tac a d x)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac a d x)(*strict*)\n apply(force)\n apply(rename_tac a d x)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e1 e2 c1 c2)(*strict*)\n apply(rename_tac e0 e1 c1 c1')\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(subgoal_tac \"\\d2 n2 f. GR.derivation_initial G2 d2 \\ maximum_of_domain d2 n2 \\ relation_initial_configuration G1 G2 (the(get_configuration(d 0))) (the(get_configuration(d2 0))) \\ relation_configuration G1 G2 c1 (the(get_configuration(d2 n2))) \\ simulating_derivation G1 G2 d x d2 n2 f\")\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n prefer 2\n apply(rule ATS_Simulation_Configuration_Weak_simulation_derivation_exists_witness)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 xa)(*strict*)\n apply(rename_tac f)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(subgoal_tac \"\\e c. d2 n2 = Some (pair e c)\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c)(*strict*)\n apply(rename_tac c2)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply(subgoal_tac \"\\ds n. GR.derivation G2 ds \\ GR.belongs G2 ds \\ the(get_configuration(ds 0)) = c2 \\ relation_step_simulation G1 G2 c1 e1 c1' c2 ds \\ maximum_of_domain ds n \\ relation_configuration G1 G2 c1' (the(get_configuration(ds n)))\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n)(*strict*)\n apply(subgoal_tac \"\\c2. ds 0 = Some (pair None c2)\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 (derivation_append SSd1 (der2 c1 e1 c1') SSn1)) (unmarked_effect2 G2 (derivation_append SSd2 ds SSn2))\" for SSd1 SSn1 SSd2 SSn2)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation_preserves_unmarked_effect)\n apply(rule_tac\n ?d1.0=\"derivation_take d x\"\n and ?d2.0=\"d2\"\n and ?n1.0=\"x\"\n and ?n2.0=\"n2\"\n and f=\"\\a. if a \\ x then f a else f x + n\"\n in relation_step_simulation_preservation_PROVE)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply (metis GL.derivation_take_preserves_derivation_initial)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply (metis GL.derivationNoFromNone GL.derivation_initial_is_derivation maximum_of_domain_derivation_take)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(simp add: get_configuration_def derivation_take_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(simp add: derivation_append_fit_def derivation_take_def der2_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(simp add: derivation_append_fit_def get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(rule simulating_derivation_exist_step)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)+\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 d) (unmarked_effect2 G2 (derivation_append d2 ds n2))\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"d\"\n and s=\"(derivation_append (derivation_take d x) (der2 c1 e1 c1') x)\"\n in ssubst)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa)(*strict*)\n apply(simp add: derivation_append_def derivation_take_def der2_def)\n apply(case_tac \"xa-x\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa)(*strict*)\n apply(subgoal_tac \"Suc x=xa\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nata)(*strict*)\n apply(subgoal_tac \"xa=x+Suc(Suc nata)\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 xa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 nata)(*strict*)\n apply(rule GL.none_position_after_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 nata)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(thin_tac \"left_total_on (relation_effect G1 G2) (unmarked_effect1 G1 (derivation_append (derivation_take d x) (der2 c1 e1 c1') x)) (unmarked_effect2 G2 (derivation_append d2 ds n2))\")\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(simp add: left_total_on_def)\n apply(erule_tac\n x=\"a\"\n in ballE)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in bexI)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(simp add: GR.finite_unmarked_language_def)\n apply(rule_tac\n x=\"derivation_append d2 ds n2\"\n in exI)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation_initial)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply (metis AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2 b)(*strict*)\n apply(rule_tac\n x=\"n2+n\"\n in exI)\n apply (metis concat_has_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f e ds n)(*strict*)\n apply (metis GR.some_position_has_details_at_0)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(rule GR.some_position_has_details_before_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' d2 n2 f)(*strict*)\n apply(force)\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Simulation_Configuration_WeakLR_Unmarked_Effect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2811324136224378}} {"text": "(* LLVM.thy *)\n(* William Mansky *)\n(* MiniLLVM for VeriF-OPT. *)\n\ntheory LLVM\nimports trans_flowgraph AxiomaticModel step_rel\nbegin\n\n(* Maybe I shouldn't have this\ntype_synonym 'a pat = \"('a, string)literal\"\n*)\n\n(* Syntax *)\ndatatype element_flag = ReadFlag | WriteFlag | RMWFlag | FenceFlag | ControlFlag | CallFlag\n\ndatatype ('thread, 'loc, 'val) access = Read 'thread 'loc 'val | Write 'thread 'loc 'val \n | ARW 'thread 'loc 'val 'val | Alloc 'thread 'loc | Free 'thread 'loc\n\ndatatype LLVM_type = Int_ty | (* Float_ty | Void_ty | Label_ty | Array_ty nat LLVM_type (\"[_ \\ _]\") |*)\n(* Structure? | *) Pointer_ty LLVM_type (\"_*\") (* Ignoring size for now. *)\n| Array_ty nat LLVM_type (\"[_ \\ _]\")\n\ndatatype 'mvar LLVM_type_pat = PInt_ty | Tymvar 'mvar | PPointer_ty \"'mvar LLVM_type_pat\"\n | PArray_ty nat \"'mvar LLVM_type_pat\"\n\nprimrec LLVM_type_lit_fv where\n \"LLVM_type_lit_fv PInt_ty = {}\"\n | \"LLVM_type_lit_fv (Tymvar x) = {x}\"\n | \"LLVM_type_lit_fv (PPointer_ty ty) = LLVM_type_lit_fv ty\"\n | \"LLVM_type_lit_fv (PArray_ty x ty) = LLVM_type_lit_fv ty\"\n\nlemma finite_LLVM_type_lit_fv [simp]: \"finite (LLVM_type_lit_fv ty)\"\nby (induct_tac ty, auto)\n\ndatatype ('loc,'int) LLVM_const = CInt 'int | (* Float? | *) CNull (* | CArray \"(LLVM_type \\ LLVM_const) list\" *) | \n CPointer 'loc | CUndef | CArray \"('loc,'int) LLVM_const list\"\n(* Poison values? *)\n\n(* defining the size of a non-atomic reads/writes *)\ndefinition fixedIntSize :: \"nat\" where\n\"fixedIntSize = 4\"\n\nfun LLVM_sizeof where\n\"LLVM_sizeof Int_ty = fixedIntSize\"\n| \"LLVM_sizeof (b*) = fixedIntSize\"\n| \"LLVM_sizeof ([a\\b]) = a * (LLVM_sizeof b)\"\n\ntype_synonym concrete_LLVM_const = \"(int, int)LLVM_const\"\ntype_synonym 'mvar gen_LLVM_const = \"((int,'mvar)literal,(int,'mvar)literal) LLVM_const\"\n\nfun LLVM_const_lit_fv where\n \"LLVM_const_lit_fv (CInt ip) = base_lit_fv ip\"\n | \"LLVM_const_lit_fv CNull = {}\"\n | \"LLVM_const_lit_fv (CPointer lp) = base_lit_fv lp\"\n | \"LLVM_const_lit_fv CUndef = {}\"\n | \"LLVM_const_lit_fv (CArray il) = (\\e\\set il. LLVM_const_lit_fv e)\"\n\nlemma finite_LLVM_const_lit_fv [simp]: \n \"finite (LLVM_const_lit_fv c)\"\n by (induct_tac c, auto)\n\n(* from PL prospective, LLVM global and local variables have no difference after parsing.\n They are just identifier for names, since MiniLLVM will not have levels outisde of a function,\n it is useless to have the two difference. *)\ndatatype ('var, 'cvar) LLVM_expr =\n Var 'var (\"%_\")\n | Const \"'cvar\"\n (* | Global 'gvar string*) (*(\"@_\")*) (* | Constant expressions? *)\n\ntype_synonym concrete_LLVM_expr = \"(string, concrete_LLVM_const) LLVM_expr\"\ntype_synonym 'mvar gen_LLVM_expr = \"('mvar, ('mvar gen_LLVM_const, 'mvar)literal) LLVM_expr\"\ntype_synonym 'mvar LLVM_expr_pat = \"('mvar gen_LLVM_expr,'mvar) expr_pattern\"\n\n(* datatype of have var and pointer togeter *)\ndatatype ('loc, 'var) twoVar = TheVar 'var | TheLoc 'loc\n\n\n(* If we are calculating free variables, then we are dealing with patterns,\n ie things with \"literals\" --ELG *)\n\nprimrec expr_fv :: \"'mvar gen_LLVM_expr \\ 'mvar set\" where\n\"expr_fv (Var x) = {x}\" |\n\"expr_fv (Const c) = lit_fv LLVM_const_lit_fv c\"\n\nlemma finite_expr_fv [simp]:\nfixes e shows \"finite (expr_fv e)\"\nby (case_tac e, auto)\n\ncorollary finite_expr_pattern_fv:\nfixes ep shows \"finite (expr_pattern_fv expr_fv ep)\"\nby simp\n\nprimrec expr_lfv :: \"concrete_LLVM_expr \\ string set\" where\n\"expr_lfv (Var x) = {x}\" |\n\"expr_lfv (Const c) = {}\" \n\ndatatype LLVM_op = add | sub | mul\ndatatype LLVM_cmp = eq | ne | sgt | sge | slt | sle\ndatatype LLVM_order = monotonic | acquire | release | acqrel | seqcst\n\nfun tranOrder where\n\"tranOrder monotonic = Relaxed\"\n| \"tranOrder acquire = Acquire\"\n| \"tranOrder release = Release\"\n| \"tranOrder acqrel = AcqRel\"\n| \"tranOrder seqcst = SeqCst\"\n\nabbreviation eplist_fv :: \"'mvar LLVM_expr_pat list \\ 'mvar set\" where\n\"eplist_fv \\ \\ epl. foldr\n (\\ ep vs. (expr_pattern_fv expr_fv ep) \\ vs) epl {}\"\n\nabbreviation eplist_lfv :: \"concrete_LLVM_expr list \\ string set\" where\n\"eplist_lfv \\ \\ epl. foldr (\\ ep vs. (expr_lfv ep) \\ vs) epl {}\"\n\nlemma finite_eplist_fv [simp]:\nfixes epl shows \"finite (eplist_fv epl)\"\nby (induct \"epl\", auto)\n\n(*\ntype_synonym 'thread gen_node = \"(('thread, string) literal) node_const\"\n\nterm \"(x::('thread gen_node, string) literal)\"\n*)\n\ntype_synonym 'node concrete_philist = \"('node \\ concrete_LLVM_expr) list\"\ntype_synonym 'mvar gen_philist = \"(('mvar node_const,'mvar)literal \\ ('mvar LLVM_expr_pat))list\"\n\nabbreviation philist_fv :: \"'mvar gen_philist \\ 'mvar set\" where\n\"philist_fv \\ \\ es. foldr (\\(n, e) r. lit_fv node_fv n \\ expr_pattern_fv expr_fv e \\ r) es {}\"\n\nlemma finite_philist_fv [simp]:\nfixes phi_list shows \"finite (philist_fv phi_list)\"\nby (induct \"phi_list\", auto)\n\nterm \"expr_lfv\"\nabbreviation philist_lfv :: \"'node concrete_philist \\ string set\" where\n\"philist_lfv \\ \\ es. foldr (\\(n, e) r. expr_lfv e \\ r) es {}\"\n\ndefinition mapSetCon where\n\"mapSetCon S f = (\\ s \\ S . f s)\"\n\n(* TODO: better concrete syntax *)\ndatatype ('var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_instr =\n Assign 'var 'opr 'type 'expr 'expr (\"_ = _ _ _, _\" 160)\n | Ret 'type 'expr\n | Br_i1 'expr(* conditional branch *)\n | Br_label (* unconditional *)\n (* two ops dealing with inserting a value to an array and extracting value from an array *)\n | Extract_value 'var 'type 'expr \"nat list\" (* array type, value, index list natural number list *)\n | Insert_value 'var 'type 'expr 'type 'expr \"nat list\" (* array type , value, element type value, index list*)\n(* Note that, since control flow is implicit in the function body, label targets are unnecessary. \n Well, sort of. If we were linking to outside things, using label names would let us refer outside\n the context. *)\n(* Switch | Indirectbr | Invoke | Resume | *) \n | Malloc 'var 'type\n | Load bool 'var 'type 'expr\n | Atomic_load bool 'var 'type 'expr LLVM_order\n | Store bool 'type 'expr 'type 'expr\n | Atomic_store bool 'type 'expr 'type 'expr LLVM_order\n | LLVM_Fence LLVM_order\n | Cmpxchg bool 'var 'type 'expr 'type 'expr 'type 'expr LLVM_order(* ordering constraint *)\n | ICmp 'var 'cmp 'type 'expr 'expr (\"_ = icmp _ _ _, _\" 160) (* | Atomicrmw *)\n | Phi 'var 'type 'phi_list (*\"('node \\ 'expr) list\"*) (\"_ = phi _ _\" 160) (* Select | *) \n | Call 'var 'type 'var \"'args\" (\"_ = call _ _ _\" 160) (* list patterns? *)\n(* This might be controversial: eliminate function names entirely, indicate call target by call edge.\n This is inadequate for 1) calls to outside functions and 2) function pointers. *) \n (*| IsPointer 'expr why need this? *)\n | Mutex_lock 'expr (*lock on a input lock key *)\n | Mutex_unlock 'expr (* unlock on a input lock key *)\n\ndatatype returnExpr = MemWrite \"LLVM_type \\ (int,int) LLVM_const \\ int \\ LLVM_order option\"\n | NoReturn\n\ndatatype 'a returnAction = NoAction\n | MemAction \"'a list\"\n\n\ntype_synonym 'node concrete_LLVM_instr =\n\"(string, LLVM_type, concrete_LLVM_expr, LLVM_op, LLVM_cmp, 'node concrete_philist,\n concrete_LLVM_expr list) LLVM_instr\"\n\ntype_synonym 'mvar gen_LLVM_instr =\n\"('mvar, 'mvar LLVM_type_pat,'mvar LLVM_expr_pat, (LLVM_op, 'mvar)literal, (LLVM_cmp,'mvar)literal,\n ('mvar gen_philist,'mvar)literal, ('mvar LLVM_expr_pat list, 'mvar)literal) LLVM_instr\"\n\ntype_synonym 'mvar pattern = \"('mvar gen_LLVM_instr, 'mvar) literal\"\n\nprimrec instr_pattern_fv ::\"'mvar gen_LLVM_instr \\ 'mvar set\" where\n\"instr_pattern_fv (Assign x bop ty e1 e2) =\n {x} \\ LLVM_type_lit_fv ty \\ (base_lit_fv bop) \\ (expr_pattern_fv expr_fv) e1 \\ (expr_pattern_fv expr_fv) e2\" |\n\"instr_pattern_fv (Ret ty e) = LLVM_type_lit_fv ty \\ (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Br_i1 e) = (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Br_label) = {}\" |\n\"instr_pattern_fv (Extract_value x ty e nl) = {x} \\ LLVM_type_lit_fv ty \\ (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Insert_value x ty1 e1 ty2 e2 nl) = {x} \\ LLVM_type_lit_fv ty1 \\ (expr_pattern_fv expr_fv) e1\n \\ LLVM_type_lit_fv ty2 \\ (expr_pattern_fv expr_fv) e2\" |\n\"instr_pattern_fv (Load vol x ty e) = {x} \\ LLVM_type_lit_fv ty \\ (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Malloc x ty) = {x} \\ LLVM_type_lit_fv ty\" |\n\"instr_pattern_fv (Atomic_load vol x ty e or1) = {x} \\ LLVM_type_lit_fv ty \\ (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Store vol ty1 e1 ty2 e2) =\n LLVM_type_lit_fv ty1 \\ (expr_pattern_fv expr_fv) e1 \\ LLVM_type_lit_fv ty2 \\ (expr_pattern_fv expr_fv) e2\" |\n\"instr_pattern_fv (Atomic_store vol ty1 e1 ty2 e2 or1) =\n LLVM_type_lit_fv ty1 \\ (expr_pattern_fv expr_fv) e1 \\ LLVM_type_lit_fv ty2 \\ (expr_pattern_fv expr_fv) e2\" |\n\"instr_pattern_fv (Cmpxchg vol x ty1 e1 ty2 e2 ty3 e3 or1) =\n {x} \\ LLVM_type_lit_fv ty1 \\ (expr_pattern_fv expr_fv) e1 \\ LLVM_type_lit_fv ty2 \\ (expr_pattern_fv expr_fv) e2\n \\ LLVM_type_lit_fv ty3 \\ (expr_pattern_fv expr_fv) e3\" |\n\"instr_pattern_fv (ICmp x cop ty e1 e2) =\n {x} \\ lit_fv (\\ x. {}) cop \\ LLVM_type_lit_fv ty \\ (expr_pattern_fv expr_fv) e1 \\ (expr_pattern_fv expr_fv) e2\" |\n\"instr_pattern_fv (Phi x ty phl) =\n {x} \\ LLVM_type_lit_fv ty \\ lit_fv philist_fv phl\" |\n\"instr_pattern_fv (Call x ty fn el) = {x} \\ LLVM_type_lit_fv ty \\ {fn} \\ lit_fv eplist_fv el\" |\n\"instr_pattern_fv (LLVM_Fence or1) = {}\" |\n\"instr_pattern_fv (Mutex_lock e) = (expr_pattern_fv expr_fv) e\" |\n\"instr_pattern_fv (Mutex_unlock e) = (expr_pattern_fv expr_fv) e\"\n\nlemma finite_instr_pattern_fv [simp]:\n fixes instr shows \"finite (instr_pattern_fv instr)\"\nby (case_tac instr, auto)\n\nprimrec instr_fv where\n\"instr_fv (Assign x _ _ e1 e2) = {x} \\ expr_lfv e1 \\ expr_lfv e2\" |\n\"instr_fv (Ret _ e) = expr_lfv e\" |\n\"instr_fv (Br_i1 e) = expr_lfv e\" |\n\"instr_fv (Br_label) = {}\" |\n\"instr_fv (Extract_value x ty e nl) = {x} \\ expr_lfv e\" |\n\"instr_fv (Insert_value x ty1 e1 ty2 e2 nl) = {x} \\ expr_lfv e1 \\ expr_lfv e2\" |\n\"instr_fv (Malloc x _) = {x}\" |\n\"instr_fv (Load vol x _ e) = {x} \\ expr_lfv e\" |\n\"instr_fv (Atomic_load vol x _ e or1) = {x} \\ expr_lfv e\" |\n\"instr_fv (Store vol _ e1 _ e2) = expr_lfv e1 \\ expr_lfv e2\" |\n\"instr_fv (Atomic_store vol _ e1 _ e2 or1) = expr_lfv e1 \\ expr_lfv e2\" |\n\"instr_fv (Cmpxchg vol x _ e1 _ e2 _ e3 or1) = {x} \\ expr_lfv e1 \\ expr_lfv e2 \\ expr_lfv e3\" |\n\"instr_fv (ICmp x _ _ e1 e2) = {x} \\ expr_lfv e1 \\ expr_lfv e2\" |\n\"instr_fv (Phi x _ es) = {x} \\ (\\(_, e)\\set es. expr_lfv e)\" |\n\"instr_fv (Call x _ v es) = {x, v} \\ (\\e\\set es. expr_lfv e)\" |\n\"instr_fv (LLVM_Fence or1) = {}\" |\n\"instr_fv (Mutex_lock e) = expr_lfv e\" |\n\"instr_fv (Mutex_unlock e) = expr_lfv e\"\n\ndatatype 'var LLVM_decl = Global_Decl 'var concrete_LLVM_const\n\n(* We aren't bothering with linking in this pass, surely. *)\n(*datatype LLVM_function = Define LLVM_type string \"LLVM_instr list\"*)\n(* Alternatively:*)\ndatatype LLVM_edge_type = seq | true | false | proc_call | ret\n\nlemma finite_edge_types [simp]: \"finite (UNIV::LLVM_edge_type set)\"\napply (simp add: finite_conv_nat_seg_image)\napply (rule_tac x=5 in exI, rule_tac x=\"\\n. if n = 0 then seq else if n = 1 then true else\n if n = 2 then false else if n = 3 then proc_call else ret\" in exI, auto)\napply (case_tac x, auto)\napply force\ndone\ndeclare finite_edge_types [simp del] (* Why? ---ELG *)\n\ndatatype ('node, 'var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_function =\n Define 'type 'var \"('type \\ 'var) list\" \n \"('node, LLVM_edge_type, ('var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_instr) flowgraph\"\n (\"define _ __ { _ }\")\n(* Basic block structure? *)\n\ndatatype ('node, 'var, 'type, 'expr, 'opr, 'cmp,'phi_list, 'args) LLVM_module = \n Module \"('node, 'var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_function list\"\n(* If we do this, we still have to parse a module into a tICFG. We might instead skip everything\n after LLVM_instr and just work on t(I)CFGs of LLVM_instrs. Doing this for now. *)\n\n(* TODO: Improve program model - functions *)\n\n(* Free variables *)\n\n(* tICFG for LLVM module *)\nfun LLVM_instr_edges where\n\"LLVM_instr_edges (Ret _ _) = {no_edges(ret := n) | n. True}\" |\n\"LLVM_instr_edges (Br_i1 _) = {no_edges(true := 1, false := 1)}\" |\n\"LLVM_instr_edges (Call _ _ _ _) = {no_edges(proc_call := 1, seq := 1)}\" |\n\"LLVM_instr_edges _ = {no_edges(seq := (1::nat))}\"\n\ncorollary one_seq [simp]: \"finite (Edges G) \\ (edge_types {(u, t). (n, u, t) \\ Edges G} = no_edges(seq := Suc 0)) = \n (\\m. (n, m, seq) \\ Edges G \\ (\\u t. (n, u, t) \\ Edges G \\ u = m \\ t = seq))\"\nby (drule_tac n=n and ty=seq in out_one, auto simp add: out_edges_def)\n\nlemma out_br [simp]: \"finite (Edges G) \\ (edge_types (out_edges (Edges G) n) = \n no_edges(true := Suc 0, false := Suc 0)) = \n (\\m1 m2. out_edges (Edges G) n = {(m1, true), (m2, false)})\"\napply (rule iffI, frule_tac x=true in cong, simp, simp (no_asm_use) add: edge_types_def)\napply (frule_tac x=false in cong, simp, simp (no_asm_use) add: edge_types_def)\napply (auto simp add: card_Suc_eq)\ndone\n\n(* Hypothesis: the additional bookkeeping involved in an ICFG is redundant for our purposes. \n Calls and returns can be stored in edge labels. *)\n(* Note that the tICFG assumes that threads execute mutually distinct code, i.e., don't execute \n each other's procedures. We'll run with that assumption for now. *)\n\n(* Semantics *)\n(* basic expressions *)\nabbreviation \"start_env \\ \\x. CUndef\"\n\n\nprimrec eval_expr (*:: \"('a \\ 'b LLVM_const) \\ (char list \\ 'b LLVM_const) \\ 'a LLVM_expr \\ 'b LLVM_const\" *)\nwhere\n\"eval_expr env (Var i) = env i\" | (* i::type of LLVM_expr *)\n\"eval_expr env (Const c) = c\" (* c::LLVM_const *)\n\nterm eval_expr\n\nprimrec cmp_helper where\n\"cmp_helper eq v1 v2 = (v1 = v2)\" |\n\"cmp_helper ne v1 v2 = (v1 \\ v2)\" |\n\"cmp_helper sgt v1 v2 = (v1 > v2)\" |\n\"cmp_helper sge v1 v2 = (v1 \\ v2)\" |\n\"cmp_helper slt v1 v2 = (v1 < v2)\" |\n\"cmp_helper sle v1 v2 = (v1 \\ v2)\"\n\nfun eval_cmp where\n\"eval_cmp env cmp e1 e2 = (case (eval_expr env e1, eval_expr env e2) of\n (CInt v1, CInt v2) \\ if cmp_helper cmp v1 v2 then CInt 1 else CInt 0\n | (CPointer v1, CPointer v2) \\ if cmp_helper cmp v1 v2 then CInt 1 else CInt 0\n | _ \\ CUndef)\"\n\nfun eval where\n\"eval env opr e1 e2 = (case (eval_expr env e1, eval_expr env e2) of\n (CInt v1, CInt v2) \\ (case opr of add \\ CInt (v1 + v2) | sub \\ CInt (v1 - v2) | mul \\ CInt (v1 * v2)) \n | _ \\ CUndef)\"\n\n(* counting on the right element of an array *)\nfun getElement where\n\"getElement (x#xl) 0 = Some x\"\n| \"getElement (x#xl) (Suc n) = getElement xl n\"\n| \"getElement [] n = None\"\n\nfun eval_extract where\n\"eval_extract a [] = a\"\n| \"eval_extract (CArray al) (x#xl) = (case getElement al x of None \\ CUndef\n | Some a \\ eval_extract a xl)\"\n| \"eval_extract x y = CUndef\"\n\nfun setElement where\n\"setElement a (x#xl) 0 = Some (a#xl)\"\n| \"setElement a (x#xl) (Suc n) = (case setElement a xl n of None \\ None | Some al \\ Some (x#al))\"\n| \"setElement a [] n = None\"\n\nfun eval_insert where\n\"eval_insert a b [] = CUndef\"\n| \"eval_insert CUndef b x = CUndef\"\n| \"eval_insert a (CArray b) [x] = (case setElement a b x of None \\ CUndef | Some b' \\ CArray b')\"\n| \"eval_insert a (CArray b) (x#xl) = (case getElement b x of None \\ CUndef | Some b' \\ eval_insert a b' xl)\"\n| \"eval_insert a b x = CUndef\"\n\n(* Copied and adapted the good bits from JinjaThreads' ToString.thy. Why isn't this in Main? *)\nfunction digit_toString :: \"int \\ string\"\nwhere\n \"digit_toString 0 = ''0''\"\n| \"digit_toString 1 = ''1''\"\n| \"digit_toString 2 = ''2''\"\n| \"digit_toString 3 = ''3''\"\n| \"digit_toString 4 = ''4''\"\n| \"digit_toString 5 = ''5''\"\n| \"digit_toString 6 = ''6''\"\n| \"digit_toString 7 = ''7''\"\n| \"digit_toString 8 = ''8''\"\n| \"digit_toString 9 = ''9''\"\n| \"n \\ {0, 1, 2, 3, 4, 5, 6, 7, 8, 9} ==> digit_toString n = undefined\"\napply(case_tac x)\napply simp_all\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply(rename_tac n', case_tac n', simp)\napply simp\ndone\ntermination by lexicographic_order\n\nfunction int_toString :: \"int \\ string\"\nwhere\n \"int_toString n = \n (if n < 0 then ''-'' @ int_toString (- n)\n else if n < 10 then digit_toString n\n else int_toString (n div 10) @ digit_toString (n mod 10))\"\nby pat_completeness simp\ntermination by size_change\n\nlemma neg_int_toString [simp]: \"n < 0 \\ int_toString n = ''-'' @ int_toString (- n)\"\nby simp\n\nlemma digit_int_toString [simp]: \"\\n \\ 0; n < 10\\ \\ int_toString n = digit_toString n\"\nby simp\n\nlemma ten_int_toString [simp]: \"n \\ 10 \\ int_toString n = int_toString (n div 10) @ \n digit_toString (n mod 10)\"\nby simp\n\nlemmas int_toString.simps [simp del]\n\nlemma int_digit: \"\\(i::int) \\ 0; i < 10\\ \\ i \\ {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}\"\nby (case_tac i, auto)\n\nlemma one_digit: \"i \\ {0, 1, 2, 3, 4, 5, 6, 7, 8, 9} \\ length (digit_toString i) = 1\"\nby auto\n\nlemma inj_digit: \"\\i \\ 0; i < 10; j \\ 0; j < 10; digit_toString i = digit_toString j\\ \\ \n i = j\"\nby (drule int_digit, simp, drule int_digit, auto)\n\n(*\nlemma toString_nonempty [simp]: \"int_toString i \\ []\"\napply (induct rule: int_toString.induct)\napply (case_tac \"n < 0\", simp)\napply (case_tac \"n < 10\", simp)\napply (cut_tac i=n in one_digit [OF int_digit], simp+)\napply (case_tac \"digit_toString n\", simp, simp)\napply (simp only: ten_int_toString)\nby (metis Nil_is_append_conv)\n*)\n\nabbreviation \"nat_toString n \\ int_toString (int n)\"\n\nlemma inj_toString: \"\\int_toString x = int_toString y; x \\ 0; y \\ 0\\ \\ x = y\"\noops\n\n(* For now, a bogus calling convention: arguments are named arg0, etc. instead of\n using function definitions and formal parameter names. *)\nprimrec init_env_aux where\n\"init_env_aux _ [] _ = start_env\" |\n\"init_env_aux env (e # rest) n = (init_env_aux env rest (Suc n))((''arg'' @ nat_toString n) := eval_expr env e)\"\nabbreviation \"init_env env args \\ init_env_aux env args 0\"\n\n(* gen new varMap and loactionMap *)\nabbreviation \"initLocMap \\ \\ x . {}\"\nprimrec initVarMapAux where\n\"initVarMapAux [] _ n = (\\ x . {})\" |\n\"initVarMapAux (e#rest) memVarMap n =\n (initVarMapAux rest memVarMap (Suc n))((''arg'' @ nat_toString n) := mapSetCon (expr_lfv e) memVarMap)\"\nabbreviation \"initVarMap args memVarMap \\ initVarMapAux args memVarMap 0\"\nabbreviation \"allVars args \\ foldl (\\ a b . a \\ expr_lfv b) {} args\"\n\nterm \"seq\"\nlocale LLVM_flowgraph = flowgraph\n where Nodes = \"Nodes :: 'node set\"\n and Start = \"Start :: 'node\" \n and Exit =\"Exit ::'node\" \n and Edges = \"Edges :: ('node \\ 'node \\ LLVM_edge_type) set\" \n and L = \"L::'node \\ ('var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_instr\"\n and instr_edges=LLVM_instr_edges\n and Seq=\"seq::LLVM_edge_type\"\n for Nodes and Start and Exit and Edges and L\n\nlocale LLVM_tCFG = tCFG\n where CFGs = \"CFGs::'thread \\ ('node, LLVM_edge_type,\n ('var, 'type, 'expr, 'opr, 'cmp, 'phi_list, 'args) LLVM_instr) flowgraph option\" \n and instr_edges=LLVM_instr_edges\n and Seq=seq\n for CFGs\nbegin\n\nlemma LLVM_graph [simp, intro]: \"CFGs t = Some G \\ \n LLVM_flowgraph (Nodes G) (Start G) (Exit G) (Edges G) (Label G)\"\napply (frule CFGs, simp add: is_flowgraph_def flowgraph_def pointed_graph_def flowgraph_axioms_def)\napply (unfold_locales, auto)\napply force\napply force\n done\n\n(*\nlemma abc : \"finite a \\ finite b \\ finite (a \\ b)\"\n by simp\n*)\n\nend\n\n(* in-order LLVM execution model *)\nlocale LLVM_MM = memory_model\n where actions = \"actions :: (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action set\"\n and locations = \"locations :: loc_type set\"\n and actionIDs = \"actionIDs :: aid_type set\"\n and times = \"times :: time_type set\"\n and threads = \"threads :: 'tid set\"\n and locks = \"locks :: 'lock set\"\n and names = \"names :: 'name set\"\n and callIDs = \"callIDs :: 'callID set\" \n and free_set = \"free_set:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ loc_type set\"\n and can_read = \"can_read:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ 'tid \\ time_type \\ loc_type \\ 'val set\"\n and update_mem = \"update_mem:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ ('tid \\ aid_type \\\n (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set\n \\ (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\ bool\"\n and start_mem = \"start_mem:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\"\n for actions locations actionIDs times threads locks names callIDs \n free_set can_read update_mem start_mem\n\nlocale LLVM = LLVM_flowgraph (* ASSUMED INT *)\n where Nodes = \"Nodes :: 'node set\"\n and Start = \"Start :: 'node\" \n and Exit =\"Exit ::'node\" \n and Edges = \"Edges :: ('node \\ 'node \\ LLVM_edge_type) set\" \n and L=\"L::'node \\ 'node concrete_LLVM_instr\" + \n LLVM_MM\n where actions = \"actions :: (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action set\"\n and locations = \"locations :: loc_type set\"\n and actionIDs = \"actionIDs :: aid_type set\"\n and times = \"times :: time_type set\"\n and threads = \"threads :: 'tid set\"\n and locks = \"locks :: 'lock set\"\n and names = \"names :: 'name set\"\n and callIDs = \"callIDs :: 'callID set\" \n and free_set = \"free_set:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ loc_type set\"\n and can_read = \"can_read:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ 'tid \\ time_type \\ loc_type \\ 'val set\"\n and update_mem = \"update_mem:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ ('tid \\ aid_type \\\n (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set\n \\ (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\ bool\"\n and start_mem = \"start_mem:: (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\"\n for Nodes Start Exit Edges L actions locations actionIDs times threads locks names callIDs \n free_set can_read update_mem start_mem\nbegin\n\n(* first define semantics for each line of MiniLLVM instruction. step semantics *)\n\ninductive LLVM_step :: \"'tid \\ (int \\ (int, int) LLVM_const)\n \\ 'note \\\n 'node \\\n (char list \\ (int, int) LLVM_const) \\\n ('node \\ char list \\ (char list \\ (int, int) LLVM_const)) list \\ int set \\ (int \\ 'tid option)\n \\ (aid_type, (int, int) LLVM_const, int, int, char list, int) AxiomaticModel.action set\n \\ 'node \\\n 'node \\\n (char list \\ (int, int) LLVM_const) \\\n ('node \\ char list \\ (char list \\ (int, int) LLVM_const)) list \\ int set \\ (int \\ 'tid option)\n \\ bool\" where\nassign [intro]: \"\\L p = Assign x opr ty e1 e2;p \\ Exit\\ \\\n LLVM_step (tid::'tid) mem ((p0::'note), p, env, stack,alloced, lockMap) {}\n (p,next_node Edges seq p,env(x := eval env opr e1 e2), stack, alloced,lockMap)\" |\nret_pop [intro]: \"\\L p = Ret ty e;p \\ Exit; (p, ret_addr, ret) \\ Edges\\ \\ \n LLVM_step tid mem (_,p, env, (ret_addr, ret_var, ret_env) # rest,alloced,lockMap) {CallFence name 0}\n (p,ret_addr, ret_env(ret_var := eval_expr env e), rest, alloced,lockMap)\" |\nret_main [intro]: \"\\L p = Ret ty e; p \\ Exit; (p, Exit, ret) \\ Edges\\ \\ \n LLVM_step tid mem (_,p, env, [], alloced,lockMap) {}\n (p,Exit, env, [], alloced,lockMap)\" (* what to do when main function returns? *) |\nbranch_i [intro]: \"\\ L p = Br_i1 e; p \\ Exit\\ \\\n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {ControlFence}\n (p,next_node Edges (if eval_expr env e = CInt 0 then false else true) p,\n env, stack, alloced,lockMap)\" |\nbranch_u [intro]: \"\\ L p = Br_label; p \\ Exit\\ \\\n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {}\n ( p,next_node Edges seq p, env, stack, alloced,lockMap)\"|\nextract_v [intro]: \"\\ L p = Extract_value x ty e1 nl;p \\ Exit \\ \n\\ LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {}\n ( p,next_node Edges seq p, env(x := eval_extract (eval_expr env e1) nl), stack, alloced,lockMap)\" |\ninsert_v [intro]: \"\\ L p = Insert_value x ty1 e1 ty2 e2 nl;p \\ Exit\\ \\\n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {}\n (p,next_node Edges seq p,\n env(x := eval_insert (eval_expr env e2) (eval_expr env e1) nl), stack, alloced,lockMap)\" |\nload [intro!]: \"\\L p = Load vol x ty e; eval_expr env e = CPointer l; v = mem l; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {NRead vol v l 0 0 0 []}\n (p,next_node Edges seq p, env(x := v), stack, alloced,lockMap)\" \n| atomic_load [intro!]: \"\\L p = Atomic_load vol x ty e or1;eval_expr env e = CPointer l; v = mem l; p \\ Exit\\\n \\ \n LLVM_step tid mem (_,p, env, stack,alloced, lockMap) {ARead vol v l (tranOrder or1) []}\n (p,next_node Edges seq p, env(x := v), stack, alloced,lockMap)\"\n| store [intro]: \"\\L p = Store vol ty1 e1 ty2 e2;eval_expr env e2 = CPointer l; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced, lockMap) {NWrite vol (eval_expr env e1) l 0 0 0 []}\n (p,next_node Edges seq p, env, stack, alloced,lockMap)\"\n| atomic_store [intro]: \"\\L p = Atomic_store vol ty1 e1 ty2 e2 or1;eval_expr env e2 = CPointer l; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced, lockMap) {AWrite vol (eval_expr env e1) l (tranOrder or1) []}\n (p,next_node Edges seq p, env, stack, alloced,lockMap)\"\n| malloc [intro] : \"\\L P = Malloc x ty; p \\ Exit\\ \\\n LLVM_step tid mem (_,p, env, stack, alloced,lockMap) {Create v}\n (p,next_node Edges seq p, env(x := CPointer v), stack,alloced \\ nexts, lockMap)\"\n| fence [intro]: \"\\L P = LLVM_Fence or1;p \\ Exit \\\n \\ LLVM_step tid mem (_,p,env, stack,alloced,lockMap) {Fence (tranOrder or1)}\n (p,next_node Edges seq p, env, stack, alloced,lockMap)\"\n| cmpxchg_false [intro]: \"\\L p = Cmpxchg vol x ty1 e1 ty2 e2 ty3 e3 or1;\n eval_expr env e1 = CPointer l; eval_expr env e2 = v;v \\ mem l; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {ARead vol (mem l) l (tranOrder or1) []}\n (p,next_node Edges seq p, env(x := mem l), stack, alloced,lockMap)\"\n| cmpxchg_true [intro]: \"\\L p = Cmpxchg vol x ty1 e1 ty2 e2 ty3 e3 or1;\n eval_expr env e1 = CPointer l; eval_expr env e2 = v;v = mem l; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {RMW vol (eval_expr env e3) l (tranOrder or1) []}\n (p,next_node Edges seq p, env(x := mem l), stack, alloced, lockMap)\"\n| icmp [intro]: \"\\L p = ICmp x cop ty e1 e2;eval_cmp env cop e1 e2 = v; p \\ Exit\\ \\ \n LLVM_step tid mem (_,p, env, stack,alloced, lockMap) {}\n (p,next_node Edges seq p, env(x := v), stack, alloced,lockMap)\"\n| phi [intro]: \"\\L p = (x = phi ty vals); p \\ Exit; (p0,p,l1) \\ Edges; (p0, e) \\ set vals\\\n \\ LLVM_step tid mem\n (_,p, env, stack,alloced, lockMap) {}\n (p,next_node Edges seq p, env(x := eval_expr env e), stack, alloced,lockMap)\"\n| call [intro]: \"\\L p = (x = call ty name args);p \\ Exit\\\n \\ LLVM_step tid mem (_,p, env, stack,alloced, lockMap) {CallFence name 0}\n (p,next_node Edges proc_call p, init_env env args, (next_node Edges seq p, x, env) # stack,\n alloced,lockMap)\"\n| mutex_lock [intro]: \"\\ L p = Mutex_lock e;\n p \\ Exit; lockMap lock = None; eval_expr env e = CInt lock\\ \\\n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {Lock lock}\n (p,next_node Edges seq p, env,stack, alloced,lockMap(lock := Some tid))\"\n| mutex_unlock [intro]: \"\\ L p = Mutex_unlock e;\n p \\ Exit; lockMap lock = Some tid; eval_expr env e = CInt lock\\ \\\n LLVM_step tid mem (_,p, env, stack,alloced,lockMap) {UnLock lock}\n (p,next_node Edges seq p, env,stack, alloced,lockMap(lock := None))\"\n\nterm LLVM_step\n\nfun genReadList :: \"'tid \\ bool \\ 'val \\ 'loc \\ 'aid \\ nat \\ nat\n \\ 'aid list \\ ('tid \\ 'aid \\ ('aid, 'val, 'loc, 'lock,'name,'key) action) list\" where\n\"genReadList tid vol v l aid n 0 al = [(tid, aid, NRead vol v l aid n n al)]\"\n| \"genReadList tid vol v l aid n (Suc x) al = ((tid,aid,NRead vol v l aid (n - (Suc x)) n al)#(genReadList tid vol v l aid n x al))\"\n\nfun genWriteList where\n\"genWriteList tid vol v l aid n 0 al = [(tid, aid, NWrite vol v l aid n n al)]\"\n| \"genWriteList tid vol v l aid n (Suc x) al = ((tid,aid,NWrite vol v l aid (n - (Suc x)) n al)#(genWriteList tid vol v l aid n x al))\"\n\ninductive LLVM_step_sb where\nsb_assign [intro]: \"\\ L p = Assign x opr ty e1 e2;\n LLVM_step tid mem (p0, p, env, stack, alloced,lockMap) {}\n (p,p', env', stack,alloced',lockMap) \\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap,memLocMap, p0,p, env, stack,alloced)\n (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap(x := mapSetCon (expr_lfv e1 \\ expr_lfv e2) memVarMap),memLocMap,\n p, p', env', stack, alloced',NoAction)\"|\nsb_branch_i [intro]: \"\\ L p = Br_i1 e;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) {ControlFence}\n (p,p1, env', stack',alloced', lockMap) \\\n \\ LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p,p1, env', stack',alloced',\n MemAction [(tid,aidCount,ControlFence)])\" |\nsb_branch_u [intro]: \"\\L p = Br_label; LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) {ControlFence}\n ( p, p1, env', stack',alloced', lockMap')\\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount,lockMap',funStack, fCount,funName,funCount,varMap,locMap,p,p1, env', stack',alloced', NoAction)\" |\nsb_extract_v [intro]: \"\\ L p = Extract_value x ty e1 nl; LLVM_step tid mem\n (p0,p, env, stack,alloced,lockMap) {}\n (p, p', env', stack',alloced', lockMap)\\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n ( mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n varMap(x := mapSetCon (expr_lfv e1) varMap),locMap,p,\n p', env', stack',alloced', NoAction)\" |\nsb_insert_v [intro]: \"\\ L p = Insert_value x ty1 e1 ty2 e2 nl; LLVM_step tid mem\n (p0,p, env, stack,alloced,lockMap) {}\n (p, p', env', stack',alloced', lockMap)\\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n varMap(x := mapSetCon (expr_lfv e1 \\ expr_lfv e2) varMap),locMap,p,\n p', env', stack',alloced', NoAction)\" \n| sb_load[intro]: \"\\eval_expr env e = CPointer l; L p = Load vol x ty e;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n ( p,p', env', stack',alloced', lockMap); env x = v\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap(x := mapSetCon (expr_lfv e) varMap \\ {aidCount}),locMap,\n p,p', env', stack',alloced', MemAction (genReadList tid vol v l\n aidCount (LLVM_sizeof ty) (LLVM_sizeof ty)\n (sorted_list_of_set ((mapSetCon (expr_lfv e) varMap) \\ locMap l))))\"\n| sb_atomic_load[intro]: \"\\eval_expr env e = CPointer l; L p = Atomic_load vol x ty e or1;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n ( mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap(x := mapSetCon (expr_lfv e) varMap \\ {aidCount}),locMap,\n p,p', env', stack',alloced', MemAction [(tid,aidCount,ARead vol (env x) l\n (tranOrder or1) (sorted_list_of_set ((mapSetCon (expr_lfv e) varMap) \\ locMap l)))])\"\n| sb_store [intro]: \"\\eval_expr env e2 = CPointer l; L p = Store vol ty1 e1 ty2 e2; eval_expr env e1 = v;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env', stack',alloced', lockMap) \\\n \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap,locMap(l := {aidCount}),\n p,p', env', stack',alloced', MemAction (genWriteList tid vol v l\n aidCount (LLVM_sizeof ty1) (LLVM_sizeof ty1)\n (sorted_list_of_set (mapSetCon (expr_lfv e1 \\ expr_lfv e2) varMap))))\"\n| sb_atomic_store[intro]: \"\\eval_expr env e1 = v;\n eval_expr env e2 = CPointer l; L p = Atomic_store vol ty1 e1 ty2 e2 or1;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap,locMap(l := {aidCount}), p,p', env', stack',alloced',\n MemAction [(tid,aidCount,AWrite vol v l (tranOrder or1)\n (sorted_list_of_set (mapSetCon (expr_lfv e1 \\ expr_lfv e2) varMap)))])\"\n| sb_malloc [intro]: \"\\ L p = Malloc x ty; env' x = CPointer l;\n LLVM_step tid mem (p0,p, env, stack, alloced,lockMap) R\n (p,p', env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap(x := {aidCount}),locMap(l := {aidCount}),\n p,p', env', stack',alloced', MemAction [(tid,aidCount,Create l)])\"\n| sb_fence [intro]: \"\\ L p = LLVM_Fence or1;\n LLVM_step tid mem (p0,p,env, stack, alloced,lockMap) R\n (p,p', env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount, varMap,locMap,\n p, p', env', stack',alloced', MemAction [(tid,aidCount,Fence (tranOrder or1))])\"\n| sb_cmpxchg [intro]: \"\\eval_expr env' e1 = CPointer l;\n L p = Cmpxchg vol x ty1 e1 ty2 e2 ty3 e3 or1;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env', stack', alloced',lockMap)\\\n \\ LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap, funStack,fCount,funName,funCount,\n varMap(x := mapSetCon ((expr_lfv e1) \\ (expr_lfv e2)) varMap \\ {aidCount}),locMap(l := {aidCount}),\n p,p', env', stack',alloced',\n MemAction [(tid, aidCount, RMW vol (eval_expr env e3) l (tranOrder or1)\n (sorted_list_of_set ((mapSetCon ((expr_lfv e1) \\ (expr_lfv e2) \\ (expr_lfv e3)) varMap) \\ locMap l)))])\"\n| sb_icmp [intro]: \"\\ L p = ICmp x cop ty e1 e2;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) {}\n (p,p', env', stack', alloced',lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap,memLocMap, p0,p, env, stack,alloced)\n (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap(x := mapSetCon (expr_lfv e1 \\ expr_lfv e2) memVarMap),memLocMap,\n p,p', env', stack', alloced',NoAction)\"\n| sb_phi [intro]: \"\\ L p = (x = phi ty vals);(p0,p,l1) \\ Edges; (p0, e) \\ set vals;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) {}\n ( p,p', env', stack', alloced',lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap,memLocMap,p0, p, env, stack,alloced)\n (mem, aidCount,lockMap, funStack,fCount,funName,funCount,\n memVarMap(x := mapSetCon (expr_lfv e) memVarMap),memLocMap,\n p,p', env', stack', alloced',NoAction)\"\n| sb_ret_move [intro]: \"\\L p = Ret ty e; ret_addr \\ Exit;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,ret_addr, env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,(funName',funCount', memVarMap',memLocMap')#funStack,\n fCount,funName,funCount,memVarMap,memLocMap, p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap,funStack,fCount,funName',funCount',memVarMap',memLocMap',p,ret_addr,\n env', stack',alloced', MemAction [(tid,aidCount,CallFence funName funCount)])\" |\nsb_ret_main [intro]: \"\\L p = Ret ty e;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) {}\n (p,Exit, env', stack',alloced', lockMap)\\ \\ \n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,funName,funCount,varMap,locMap,p0,p, env, stack,alloced)\n (mem, aidCount,lockMap,funStack,fCount,funName,funCount,\n varMap,locMap,p,Exit, env', stack',alloced', NoAction)\"\n| sb_call [intro]: \"\\L p = (x = call ty name args);\nLLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env', stack', alloced',lockMap)\\\n \\ LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,\n funName,funCount,memVarMap,memLocMap,p0, p, env, stack,alloced)\n (mem, aidCount+1,lockMap,(funName,funCount, memVarMap,memLocMap)#funStack,\n fCount+1,name,fCount,initVarMap args memVarMap,initLocMap,p,p',\n env', stack',alloced', MemAction [(tid,aidCount,CallFence funName funCount)])\"\n| sb_mutex_lock [intro]: \"\\ eval_expr env e = CInt lock; L p = Mutex_lock e;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env',stack', alloced',lockMap')\\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,\n funName,funCount,memVarMap,memLocMap, p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap',funStack,\n fCount,funName,funCount,memVarMap,memLocMap,p,p',\n env', stack',alloced', MemAction [(tid,aidCount,Lock lock)])\"\n| sb_mutex_unlock [intro]: \"\\ eval_expr env e = CInt lock; L p = Mutex_unlock e;\n LLVM_step tid mem (p0,p, env, stack,alloced,lockMap) R\n (p,p', env',stack', alloced',lockMap')\\ \\\n LLVM_step_sb tid (mem, aidCount,lockMap,funStack,fCount,\n funName,funCount,memVarMap,memLocMap, p0,p, env, stack,alloced)\n (mem, aidCount+1,lockMap',funStack,\n fCount,funName,funCount,memVarMap,memLocMap,p,p',\n env', stack',alloced', MemAction [(tid,aidCount,UnLock lock)])\"\n\nlemma step_next [simp]: \"LLVM_step t mem (p0, p, rest) a (p', rest') \\ p' = p\"\nby (erule LLVM_step.cases, simp_all)\n\nlemma not_exit: \"LLVM_step t mem (p0, p, rest) a C' \\ p \\ Exit\"\nby (erule LLVM_step.cases, simp_all)\n\nlemma branch_true [intro]: \"\\L p = Br_i1 e; p \\ Exit; eval_expr env e \\ CInt 0\\\n\\\n LLVM_step t mem (p0, p, env, stack, allocad,lockMap) {ControlFence}\n (p, next_node Edges true p, env, stack, allocad,lockMap)\"\nproof -\n assume a1: \"L p = Br_i1 e\"\n assume a2: \"p \\ Exit\"\n assume a3: \"eval_expr env e \\ CInt 0\"\n have \"\\x3 x7 x8. next_node Edges (if eval_expr (x3::char list \\ (int, int) LLVM_const) x7 = CInt 0 then false else true) x8 = (if eval_expr x3 x7 = CInt 0 then next_node Edges false x8 else next_node Edges true x8)\"\n by presburger\n then show ?thesis\n using a3 a2 a1 by (metis (no_types) branch_i)\nqed \n\nlemma branch_false [intro]: \"\\L p = Br_i1 e; p \\ Exit; eval_expr env e = CInt 0\\ \\ \n LLVM_step t mem (p0, p, env, stack, allocad,lockMap) {ControlFence}\n (p, next_node Edges false p, env, stack, allocad,lockMap)\"\nproof -\n assume a1: \"L p = Br_i1 e\"\n assume a2: \"p \\ Exit\"\n assume a3: \"eval_expr env e = CInt 0\"\n have \"\\x3 x7 x8. next_node Edges (if eval_expr (x3::char list \\ (int, int) LLVM_const) x7 = CInt 0 then false else true) x8 = (if eval_expr x3 x7 = CInt 0 then next_node Edges false x8 else next_node Edges true x8)\"\n by presburger\n then show ?thesis\n using a3 a2 a1 by (metis (no_types) branch_i)\nqed\n\nend\n\ndefinition \"alloc_mem r \\ case r of (stack, allocad) \\ allocad \\ (\\(a, b, c, d)\\set stack. d)\"\n\ncontext LLVM begin\n\n(*\nlemma finite_ops: \"\\LLVM_step t mem gt (p0, p, env, stack, allocad) ops (p, p', env', stack', allocad'); \n finite (alloc_mem (stack, allocad))\\ \\ finite ops \\ finite (alloc_mem (stack', allocad'))\"\nby (erule LLVM_step.cases, auto simp add: alloc_mem_def)\n\nlemma step_mem: \"\\LLVM_step t mem gt (p0, p, env, stack, allocad) ops (p, p', env', stack', allocad'); \n l \\ free_set mem; l \\ alloc_mem (stack, allocad)\\ \\ l \\ alloc_mem (stack', allocad')\"\nby (erule LLVM_step.cases, auto simp add: alloc_mem_def)\n*)\n\nend\n\ntype_synonym ('thread, 'node) LLVM_tCFG =\n \"('thread, ('node, LLVM_edge_type, 'node concrete_LLVM_instr) flowgraph) map\"\n\n\nlocale LLVM_decls = fixes decls::\"'var LLVM_decl list\"\n\nlocale LLVM_base =\n LLVM_MM\n where actions = \"actions :: (time_type, concrete_LLVM_const, loc_type, int, string, int) action set\"\n and locations = \"locations :: loc_type set\"\n and actionIDs = \"actionIDs :: aid_type set\"\n and times = \"times :: time_type set\"\n and threads = \"threads :: int set\"\n and locks = \"locks :: int set\"\n and names = \"names :: string set\"\n and callIDs = \"callIDs :: int set\" +\n LLVM_decls where decls = \"decls:: 'var LLVM_decl list\"\n for actions locations actionIDs times threads locks names callIDs decls +\n fixes gt::\"string \\ concrete_LLVM_const\"\nbegin\n\n(*\nabbreviation \"step t G mem \\ LLVM.LLVM_step (Exit G) (Edges G) free_set can_read (Label G) t mem gt\"\n\nlemma LLVM_graph': \"is_flowgraph G seq LLVM_instr_edges \\ \n LLVM (Nodes G) (Start G) (Exit G) (Edges G) free_set (Label G) update_mem\"\nby (simp add: LLVM_def is_flowgraph_def LLVM_flowgraph_def, unfold_locales)\n\nlemmas step_cases' = LLVM.LLVM_step.cases [OF LLVM_graph']\nlemmas step_next' [simp] = LLVM.step_next [OF LLVM_graph']\n\nlemma out_edges_shape: \"\\{(u, t). (p, u, t) \\ Edges G} = S; (p', t) \\ S\\ \\\n (p, p', t) \\ Edges G\"\nby force\n\nlemma step_along_edge': \"\\is_flowgraph G seq LLVM_instr_edges; step t G m (pp, p, r) a (p, p', r'); p \\ Nodes G\\ \\ \n \\e. (p, p', e) \\ Edges G\"\napply (subgoal_tac \"LLVM (Nodes G) (Start G) (Exit G) (Edges G) free_set (Label G) update_mem\") \napply (clarsimp simp add: is_flowgraph_def flowgraph_def flowgraph_axioms_def)\napply ((erule_tac x=p in allE)+)\napply (frule pointed_graph.finite_edges)\napply (erule LLVM.LLVM_step.cases, simp_all, simp_all, clarsimp)\napply (clarsimp simp add: out_edges_def, force)\napply (clarsimp simp add: out_edges_def, force)\napply force\napply clarsimp\napply (rule conjI, clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (clarsimp simp add: out_edges_def, frule_tac p'=p' in out_edges_shape, force, force)\napply (simp add: LLVM_def LLVM_flowgraph_def is_flowgraph_def, unfold_locales)\ndone\n*)\nend\n\nlemmas option.splits [split]\n\n(* Concurrent semantics *)\nfun get_point where \"get_point (_, p, _) = p\"\n\nsublocale LLVM_base \\ step_rel where free_set=free_set and update_mem=update_mem \n and start_mem=start_mem and can_read=can_read and step_rel=step\n and get_point=get_point \n and instr_edges=\"LLVM_instr_edges::'node concrete_LLVM_instr \\ (LLVM_edge_type \\ nat) set\" \n and Seq=seq \n and start_state=\"\\CFGs C0 mem0. declare_globals (start_env, start_mem) decls (gt, mem0) \\ \n C0 = (\\t. case CFGs t of Some G \\ Some (Start G, Start G, start_env, [], {}) | None \\ None)\"\napply unfold_locales\napply (rule ext, simp add: start_points_def map_comp_def)\napply clarsimp\napply (frule step_next', simp, clarsimp)\napply (metis step_along_edge')\ndone\n\nlemma (in LLVM_base) one_step_next: \"\\one_step t G ((p0, p, rest), m) ((p', rest'), m');\n is_flowgraph G seq LLVM_instr_edges\\ \\ p' = p\"\nby (erule one_step.cases, auto)\n\nprint_locale LLVM_base\nlocale LLVM_threads = LLVM_tCFG\n where CFGs=\"CFGs::('thread, 'node) LLVM_tCFG\" + \n LLVM_base\n where update_mem=\"update_mem::'memory \\ ('thread, int, concrete_LLVM_const) access set \\ 'memory \\ bool\"\n and free_set = \"free_set :: 'memory \\ int set\" \n and can_read = \"can_read :: 'memory \\ 'thread \\ int \\ (int, int) LLVM_const set\" \n and start_mem = \"start_mem:: 'memory\"\n and decls = \"decls::LLVM_decl list\"\n and gt = \"gt::char list \\ (int, int) LLVM_const\" \n for free_set CFGs update_mem can_read start_mem decls gt\n\nbegin\n\nlemma LLVM_graph [simp, intro]: \"CFGs t = Some G \\ \n LLVM (Nodes G) (Start G) (Exit G) (Edges G) free_set (Label G) update_mem\"\nby (frule CFGs, erule LLVM_graph')\n\nlemmas step_cases = LLVM.LLVM_step.cases [OF LLVM_graph]\nlemmas step_next [simp] = LLVM.step_next [OF LLVM_graph]\n\nlemma step_along_edge: \"\\CFGs t = Some G; step t G m (pp, p, r) a (p, p', r'); p \\ Nodes G\\ \\ \n \\e. (p, p', e) \\ Edges G\"\nby (rule step_along_edge', drule CFGs, auto)\n\nabbreviation \"conc_step_star \\ (conc_step CFGs)^**\"\n\nlemma ops_thread: \"\\step t G mem state ops state'; CFGs t = Some G; a \\ ops\\ \\ get_thread a = t\"\nby (rule step_cases, auto)\n\ndefinition \"all_alloc_mem states \\ \\(a0, a, b, c, d)\\ran states. alloc_mem (c, d)\"\n\nlemma run_global: \"\\run_prog CFGs C; Global_Decl s c \\ set decls\\ \\\n \\l. gt s = CPointer l \\ l \\ free_set (snd C) \\ l \\ all_alloc_mem (fst C)\"\napply (rule run_prog_induct, simp, clarsimp simp add: run_prog_def)\napply (drule global_alloc, simp+, clarsimp simp add: all_alloc_mem_def ran_def alloc_mem_def \n split: option.splits)\napply clarsimp\napply (erule conc_step.cases, clarsimp simp add: all_alloc_mem_def ran_def)\napply (rule conjI, clarsimp)\napply (drule stays_not_free, simp, clarsimp simp add: alloc_mem_def)\napply (drule step_cases, simp, simp_all, force, force)\napply clarsimp\napply (case_tac \"al \\ t\", force, clarsimp)\napply (frule step_next, simp+)\napply (drule_tac can_read=can_read and t=t in LLVM.step_mem [OF LLVM_graph], simp+, force, simp)\ndone\n\nlemma call_edges [simp]: \"finite (Edges G) \\\n (edge_types (out_edges (Edges G) p) = no_edges(proc_call := Suc 0, seq := Suc 0))\n = (\\m n. out_edges (Edges G) p = {(m, proc_call), (n, seq)})\"\nby simp\n\nend\n\n(* Memory models *)\nlocale LLVM_TSO = tCFG where instr_edges=LLVM_instr_edges and Seq=seq and \n CFGs=\"CFGs::('thread, 'node) LLVM_tCFG\" + TSO where undef=\"CUndef::concrete_LLVM_const\" for CFGs\n\nsublocale LLVM_TSO \\ TSO: LLVM_threads where update_mem=update_mem and free_set=free_set \n and can_read=can_read and start_mem=start_mem\nby (unfold_locales)\n\nlocale LLVM_SC = tCFG where instr_edges=LLVM_instr_edges and Seq=seq and \n CFGs=\"CFGs::('thread, 'node) LLVM_tCFG\" + SC where undef=\"CUndef::concrete_LLVM_const\" for CFGs\n\nsublocale LLVM_SC \\ SC: LLVM_threads where update_mem=update_mem and free_set=free_set \n and can_read=can_read and start_mem=start_mem\nby (unfold_locales)\n\nlocale LLVM_PSO = tCFG where instr_edges=LLVM_instr_edges and Seq=seq and \n CFGs=\"CFGs::('thread, 'node) LLVM_tCFG\" + PSO where undef=\"CUndef::concrete_LLVM_const\" for CFGs\n\nsublocale LLVM_PSO \\ PSO: LLVM_threads where update_mem=update_mem and free_set=free_set \n and can_read=can_read and start_mem=start_mem\nby (unfold_locales)\n\nlemma (in LLVM_SC) safe_mem: \"\\l \\ free_set mem; l \\ alloc_mem (stack, allocad); CFGs t = Some G;\n LLVM.LLVM_step (Exit G) (Edges G) free_set can_read (Label G) t mem gt (p0, p, env, stack, allocad) \n ops (p, p', env', stack', allocad'); update_mem mem ops mem'; finite (alloc_mem (stack, allocad))\\ \\\n l \\ free_set mem' \\ l \\ alloc_mem (stack', allocad') \\ finite (alloc_mem (stack', allocad'))\"\nby (rule LLVM.LLVM_step.cases, erule LLVM_graph, simp, auto simp add: alloc_mem_def)\n\n(* Memory models in LLVM. *)\ncontext LLVM_threads begin\n\ndeclare step_cases [elim]\n\nabbreviation \"step_SC \\ LLVM_base.step SC.free_set SC.can_read gt\"\nabbreviation \"step_TSO \\ LLVM_base.step TSO.free_set TSO.can_read gt\"\n\ndeclare eval.simps [simp del] eval_cmp.simps [simp del]\n\nend\n\n(*context LLVM_SC begin\n\nlemma LLVM_TSO_graph: \"CFGs t = Some G \\ LLVM (Nodes G) (Start G) (Exit G) (Edges G) TSO.free_set \n (Label G) TSO.update_mem\"\napply (drule LLVM_graph, clarsimp simp add: LLVM_def)\napply unfold_locales\napply (metis TSO_alloc_not_free)\napply (metis TSO_stays_not_free)\ndone\n\n(* automate? *)\nlemma SC_lt_TSO_step: \"\\step_SC t mem gt state ops state'; t \\ dom CFGs\\ \\ \n step_TSO t (mem, \\t. []) gt state ops state'\"\napply (drule domD, clarsimp)\napply (rule step_cases, simp_all, simp_all)\napply (rule LLVM.assign, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.ret_pop, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.ret_main, rule LLVM_TSO_graph, simp_all, force)\napply (rule conjI)\napply (clarsimp, rule LLVM.branch_false, rule LLVM_TSO_graph, simp+)\napply (clarsimp, rule LLVM.branch_true, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.branch_u, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.alloca, rule LLVM_TSO_graph, simp_all)\napply (rule LLVM.load, rule LLVM_TSO_graph, simp, force, simp+)\napply (rule LLVM.store, rule LLVM_TSO_graph, simp_all, force)\napply (rule LLVM.cmpxchg_eq, rule LLVM_TSO_graph, simp, force, simp+)\napply (rule LLVM.cmpxchg_no, rule LLVM_TSO_graph, simp, force, simp+)\napply (rule LLVM.icmp, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.phi, rule LLVM_TSO_graph, simp+, force, simp+)\napply (rule LLVM.call, rule LLVM_TSO_graph, simp+)\napply (rule LLVM.ispointer, rule LLVM_TSO_graph, auto)\ndone\n\nthm LLVM_threads.step_thread\nabbreviation \"conc_step_SC \\ LLVM_threads.conc_step free_set_SC CFGs can_read_SC update_mem_SC\"\nabbreviation \"conc_step_TSO \\ LLVM_threads.conc_step free_set_TSO CFGs can_read_TSO update_mem_TSO\"\n\nlemma SC_lt_TSO_step_threads: \"conc_step_SC gt (states, mem) (states', mem') \\ \n conc_step_TSO gt (states, mem, \\t. []) (states', mem', \\t. [])\"\napply (rule LLVM_threads.conc_step.cases, unfold_locales, simp, clarsimp)\napply (rule_tac ops=ops in LLVM_threads.step_thread, unfold_locales)\napply (metis TSO_alloc_not_free)\napply (metis TSO_stays_not_free)\napply (simp add: dom_def, force)\napply (cut_tac t=t in SC_lt_TSO_step, auto)\ndone\n\nterm LLVM_threads.conc_step_star\nabbreviation \"conc_step_star_SC \\ LLVM_threads.conc_step_star free_set_SC CFGs can_read_SC update_mem_SC\"\nabbreviation \"conc_step_star_TSO \\ LLVM_threads.conc_step_star free_set_TSO CFGs can_read_TSO update_mem_TSO\"\n\n(* SC is stricter than TSO. *)\ntheorem SC_lt_TSO_star: \"conc_step_star_SC gt (states, mem) (states', mem') \\ \n conc_step_star_TSO gt (states, mem, \\t. []) (states', mem', \\t. [])\"\napply (induct rule: rtranclp_induct2, auto)\napply (drule SC_lt_TSO_step_threads, auto)\ndone\n\nend*)\n\n(* Patterns and substitution *)\n(*\ntype_synonym 'mvar pattern =\n \"(('mvar node_lit, 'mvar, (LLVM_type, 'mvar) literal, \n ('mvar, ('mvar,int) LLVM_expr) expr_pattern, (LLVM_op, 'mvar) literal, (LLVM_cmp, 'mvar) literal) LLVM_instr, 'mvar) literal\"\n*)\nterm \"expr_pattern_fv\"\n(* Replaced by earlier instr_pattern_fv\nprimrec instr_pattern_fv :: \"(string, LLVM_type_pat, LLVM_expr_pat, LLVM_op pat, (LLVM_cmp,'mvar)literal,\n (string node_const pat \\ LLVM_expr_pat)list pat, LLVM_expr_pat list pat) LLVM_instr \\ string set\" where\n\"instr_pattern_fv (Assign x opr ty e1 e2) = {x} \\ base_lit_fv opr \\ LLVM_type_lit_fv ty \\ expr_pattern_fv expr_fv e1 \\ expr_pattern_fv expr_fv e2\" |\n\"instr_pattern_fv (Ret ty e) = LLVM_type_lit_fv ty \\ expr_pattern_fv expr_fv e\" |\n\"instr_pattern_fv (Br_i1 e) = expr_pattern_fv expr_fv e\" |\n\"instr_pattern_fv (Br_label) = {}\" |\n\"instr_pattern_fv (Alloca x ty) = {x} \\ LLVM_type_lit_fv ty\" |\n\"instr_pattern_fv (Load x ty e) = {x} \\ LLVM_type_lit_fv ty \\ expr_pattern_fv expr_fv e\" |\n\"instr_pattern_fv (Store ty1 e1 ty2 e2) = LLVM_type_lit_fv ty1 \\ expr_pattern_fv expr_fv e1 \\ LLVM_type_lit_fv ty2 \\ expr_pattern_fv expr_fv e2\" |\n\"instr_pattern_fv (Cmpxchg x ty1 e1 ty2 e2 ty3 e3) = {x} \\ LLVM_type_lit_fv ty1 \\ expr_pattern_fv expr_fv e1 \\ \n LLVM_type_lit_fv ty2 \\ expr_pattern_fv expr_fv e2 \\ LLVM_type_lit_fv ty3 \\ expr_pattern_fv expr_fv e3\" |\n\"instr_pattern_fv (ICmp x cmp ty e1 e2) = {x} \\ base_lit_fv cmp \\ LLVM_type_lit_fv ty \\ expr_pattern_fv expr_fv e1 \\ expr_pattern_fv expr_fv e2\" |\n\"instr_pattern_fv (Phi x ty es) = {x} \\ LLVM_type_lit_fv ty \\ lit_fv philist_fv es\n(*(\\(n, e)\\set es. node_fv n \\ expr_pattern_fv expr_fv e)*)\" |\n\"instr_pattern_fv (Call x ty es) = {x} \\ LLVM_type_lit_fv ty \\ lit_fv eplist_fv es\n (*(\\e\\set es. expr_pattern_fv expr_fv e)*)\" |\n\"instr_pattern_fv (IsPointer e) = expr_pattern_fv expr_fv e\"\n\nlemma finite_instr_pattern_fv [simp]: \"finite (instr_pattern_fv i)\"\nby (induct i, auto)\n*)\n\nabbreviation pattern_fv::\" ('mvar gen_LLVM_instr, 'mvar)literal \\ 'mvar set\" where\n\"pattern_fv \\ \\ p. lit_fv instr_pattern_fv p\"\n\nlemma finite_pattern_fv [simp]:\nfixes p shows \"finite (pattern_fv p)\"\nby (case_tac p, auto)\n\n(* Applying a valuation of metavariables to an expression pattern yields a concrete expression. *)\n\n(* Objects are the values metavariables can take. *)\ndatatype ('thread, 'node, 'mvar) object =\n ONode 'node \n | OThread 'thread\n | OInt int\n | OLoc int\n | OType LLVM_type\n | OConst concrete_LLVM_const\n | OExpr concrete_LLVM_expr\n | OVarName \"string\"\n | OInstr \"'node concrete_LLVM_instr\"\n | OSynFunc \"'mvar\" \"'mvar gen_LLVM_expr\"\n | OEdgeType LLVM_edge_type\n | OOp LLVM_op\n | OCmp LLVM_cmp\n | OPhiList \"'node concrete_philist\"\n | OEPList \"concrete_LLVM_expr list\"\n\nfun get_node where \"get_node (ONode n) = Some n\" | \"get_node _ = None\"\nfun get_thread where \"get_thread (OThread t) = Some t\" | \"get_thread _ = None\"\nfun get_int where \"get_int (OInt n) = Some n\" | \"get_int _ = None\"\nfun get_memloc where \"get_memloc (OLoc n) = Some n\" | \"get_memloc _ = None\"\nfun get_type where \"get_type (OType ty) = Some ty\" | \"get_type _ = None\"\nfun get_const where \"get_const (OConst n) = Some n\" | \"get_const _ = None\"\nfun get_expr where \"get_expr (OExpr n) = Some n\" | \"get_expr _ = None\"\nfun get_var_name where \"get_var_name (OVarName v) = Some v\" | \"get_var_name _ = None\"\n(*\nfun get_local_var where \"get_local_var (OExpr (Local v)) = Some v\" | \"get_local_var _ = None\"\nfun get_global_var where \"get_global_var (OExpr (Global v)) = Some v\" | \"get_global_var _ = None\"\n*)\nfun get_instr where \"get_instr (OInstr i) = Some i\" | \"get_instr _ = None\"\nfun get_synfunc where \"get_synfunc (OSynFunc x f) = Some (x, f)\" | \"get_synfunc _ = None\"\nfun get_edgetype where \"get_edgetype (OEdgeType e) = Some e\" | \"get_edgetype _ = None\"\nfun get_op where \"get_op (OOp n) = Some n\" | \"get_op _ = None\"\nfun get_cmp where \"get_cmp (OCmp n) = Some n\" | \"get_cmp _ = None\"\nfun get_philist where \"get_philist (OPhiList phl) = Some phl\" | \"get_philist _ = None\"\nfun get_eplist where \"get_eplist (OEPList epl) = Some epl\" | \"get_eplist _ = None\"\n\nprimrec LLVM_type_lit_subst where\n \"LLVM_type_lit_subst \\ PInt_ty = Some Int_ty\"\n| \"LLVM_type_lit_subst \\ (Tymvar x) = get_type (\\ x)\"\n| \"LLVM_type_lit_subst \\ (PPointer_ty pty) =\n (case LLVM_type_lit_subst \\ pty of Some ty \\ Some (Pointer_ty ty) | _ \\ None)\"\n\nlemma LLVM_type_lit_same_subst [simp]:\n \"\\x\\LLVM_type_lit_fv ty. \\ x = \\' x \\\n LLVM_type_lit_subst \\ ty = LLVM_type_lit_subst \\' ty\"\nby (induct ty, auto)\n\n\nprimrec const_subst :: \"('mvar \\ ('thread, 'node, 'mvar) object) \\\n 'mvar gen_LLVM_const \\ concrete_LLVM_const option\" where\n \"const_subst \\ (CInt ip) = map_option CInt (base_lit_subst get_int \\ ip)\"\n| \"const_subst \\ CNull = Some CNull\"\n| \"const_subst \\ (CPointer ip) = map_option CPointer (base_lit_subst get_int \\ ip)\"\n| \"const_subst \\ CUndef = Some CUndef\"\n\nlemma const_same_subst [simp]: \"\\x\\LLVM_const_lit_fv c. \\ x = \\' x \\ const_subst \\ c = const_subst \\' c\"\nproof (cases c, auto)\n fix var\n assume A: \"\\x\\base_lit_fv var. \\ x = \\' x \" and B: \"c = CInt var\"\n from A\n have B: \"base_lit_subst get_int \\ var = base_lit_subst get_int \\' var\"\n by simp\n from B\n show \"map_option CInt (base_lit_subst get_int \\ var) = map_option CInt (base_lit_subst get_int \\' var)\"\n by simp\n next fix loc\n assume A: \"\\x\\base_lit_fv loc. \\ x = \\' x\" and B: \"c = CPointer loc\"\n from A\n have B: \"base_lit_subst get_int \\ loc = base_lit_subst get_int \\' loc\"\n by simp\n from B\n show \" map_option CPointer (base_lit_subst get_int \\ loc) = map_option CPointer (base_lit_subst get_int \\' loc)\"\n by simp\nqed\n\nprimrec expr_subst ::\n \"('mvar \\ ('thread, 'node, 'mvar) object) \\ 'mvar gen_LLVM_expr \\\n concrete_LLVM_expr option\" where\n \"expr_subst \\ (Local i) = map_option Local (get_var_name (\\ i))\" \n| \"expr_subst \\ (Const p) = map_option Const (lit_subst const_subst get_const \\ p)\"\n| \"expr_subst \\ (Global s) = map_option Global (get_var_name (\\ s))\"\n\nterm \"expr_subst\"\n\nlemma expr_same_subst [simp]:\n fixes \\ :: \"'mvar \\ ('thread, 'node, 'mvar) object\"\n and \\' :: \"'mvar \\ ('thread, 'node, 'mvar) object\"\n and e :: \"'mvar gen_LLVM_expr\"\n shows \"\\v\\expr_fv e. \\ v = \\' v \\ expr_subst \\ e = expr_subst \\' e\"\nproof (case_tac e, auto, case_tac cvar, simp_all)\n fix c :: \"'mvar gen_LLVM_const\"\n assume A: \"\\(v::'mvar)\\LLVM_const_lit_fv c. \\ v = \\' v\"\n from A have A1: \"const_subst \\ c = const_subst \\' c\" by simp\n from A1\n show \"map_option Const (const_subst \\ c) = map_option Const (const_subst \\' c)\" by simp\nqed\n\nterm \"expr_subst\"\n\n(* Why would you expect this to be true? You could very well have two different\n metavariables referring to the same programming variable \nlemma self_subst: \"expr_subst (\\y. OExpr (Local y)) e = Some e\"\nby (induct e, auto)\n\ncorollary subst_out: \"\\v\\expr_fv e. \\ v = OExpr (Local v) \\ expr_subst \\ e = Some e\"\nby (rule trans, rule expr_same_subst, auto simp add: self_subst)\n\nlemma sub_out: \"\\v \\ expr_fv e; v' \\ expr_fv e\\ \\ \\e'. \n expr_subst ((\\y. OExpr (Local y))(v := OExpr (Local v'))) e = Some e' \\\n expr_subst ((\\y. OExpr (Local y))(v' := OExpr (Local v))) e' = Some e\"\nby (induct e, auto)\n*)\n\nprimrec expr_pattern_subst :: \"('mvar \\ ('thread, 'node, 'mvar) object) \\\n 'mvar LLVM_expr_pat \\ concrete_LLVM_expr option\"\n where\n\"expr_pattern_subst \\ (EPInj e) = expr_subst \\ e\"\n(*| \"expr_pattern_subst \\ (x) = (case (\\ x, expr_subst \\ e) of \n (OSynFunc x e, Some e') \\ expr_subst ((\\y. OExpr (Local y))(x := OExpr e')) e\n | _ \\ None)\"*)\n| \"expr_pattern_subst \\ (x) =\n (case (\\ x, expr_subst \\ e) of (OSynFunc y e', Some e'') \\\n expr_subst (\\ y. ((OExpr e''):: ('thread, 'node, 'mvar) object)) e'\n | _ \\ None)\"\n| \"expr_pattern_subst \\ (EPMVar x) = get_expr (\\ x)\"\n\n\n(* Isabelle note: this type annotation is necessary because OExpr e', in itself,\n is of type (?, ?) object. We need to identify the missing types with existing\n type variables, or they'll be introduced as separate variables. *)\n\nlemma expr_pattern_same_subst [simp]: \"\\v\\expr_pattern_fv expr_fv e. \\ v = \\' v \\\n expr_pattern_subst \\ e = expr_pattern_subst \\' e\"\napply (induct e, auto split: object.split LLVM_expr.split)\napply (drule expr_same_subst, simp)+\ndone\n\nterm \"(\\ epl'. map_option (\\ ep'. ep' # epl) (expr_pattern_subst \\ ep))\"\n\nabbreviation eplist_subst :: \"('mvar \\ ('thread, 'node, 'mvar) object) \\\n 'mvar LLVM_expr_pat list \\ concrete_LLVM_expr list option\" where\n\"eplist_subst \\ \n\\ \\ epl. foldr \n (\\ ep r. flatten_option\n (map_option\n (\\ epl'. map_option (\\ ep'. ep' # epl') (expr_pattern_subst \\ ep))\n r)) epl (Some [])\"\n\n(* Reformulate this in terms of map_option and flatten_option ---ELG *)\nlemma eplist_same_subst :\n\"\\ es. (\\v\\eplist_fv es. \\ v = \\' v) \\ (eplist_subst \\ es = eplist_subst \\' es)\"\nproof (rule allI)\n fix es \n show \"(\\v\\eplist_fv es. \\ v = \\' v) \\ (eplist_subst \\ es = eplist_subst \\' es)\"\n proof (induct es, auto)\n fix a es\n assume A1: \"eplist_subst \\ es = eplist_subst \\' es\"\n and A2: \"\\v\\expr_pattern_fv expr_fv a \\ eplist_fv es. \\ v = \\' v\"\n show \"flatten_option (map_option (\\epl'. map_option (\\ep'. ep' # epl') (expr_pattern_subst \\ a)) (eplist_subst \\' es)) =\n flatten_option (map_option (\\epl'. map_option (\\ep'. ep' # epl') (expr_pattern_subst \\' a)) (eplist_subst \\' es))\"\n proof -\n from A2\n have A3: \"expr_pattern_subst \\ a = expr_pattern_subst \\' a\"\n by auto\n from A3 show ?thesis\n by simp\n qed\n qed\nqed\n\n(* We make no assumptions about our type of concrete nodes here *)\nfun node_subst where\n \"node_subst CFGs \\ (MVar m) = get_node (\\ m)\"\n| \"node_subst CFGs \\ (Inj (NExit t)) = map_option Exit (flatten_option (map_option CFGs (get_thread (\\ t))))\"\n(* (case \\ t of OThread t' \\ map_option Exit t' | _ \\ None) *)\n| \"node_subst CFGs \\ (Inj (NStart t)) = map_option Start (flatten_option (map_option CFGs (get_thread (\\ t))))\"\n(* (case \\ t of OThread t' \\ map_option Start t' | _ \\ None)*)\n\nterm \"node_subst\"\n\nlemma node_same_subst:\n \"\\x\\ lit_fv node_fv n. \\ x = \\' x \\ node_subst CFGs \\ n = node_subst CFGs \\' n\"\napply (cases n, auto)\napply (case_tac data, auto split: object.splits)\ndone\nabbreviation edge_type_subst where \"edge_type_subst \\ base_lit_subst get_edgetype\"\nterm \"edge_type_subst = base_lit_subst get_edgetype\"\n\nlemma edge_type_same_subst: \"\\x\\base_lit_fv ety. \\ x = \\' x \\ edge_type_subst \\ ety = edge_type_subst \\' ety\"\nby simp\n\nabbreviation op_subst where \"op_subst \\ base_lit_subst get_op\"\n\n(*\nlemma op_same_subst: \"\\x\\base_lit_fv p. \\ x = \\' x \\ op_subst \\ p = op_subst \\' p\"\nby (simp)\n*)\n\nabbreviation cmp_subst where \"cmp_subst \\ base_lit_subst get_cmp\"\n\nlemma cmp_same_subst: \"\\x\\base_lit_fv p. \\ x = \\' x \\ cmp_subst \\ p = cmp_subst \\' p\"\nby auto\n\nlemma case_node [simp]: \"(get_node v = Some n) = (v = ONode n)\"\nby (case_tac \"v\", auto)\n\nlemma case_int [simp]: \"(get_int v = Some i) = (v = OInt i)\"\nby (case_tac \"v\", auto)\n\nlemma case_loc [simp]: \"(get_memloc v = Some i) = (v = OLoc i)\"\nby (case_tac \"v\", auto)\n\nlemma case_instr [simp]: \"(get_instr v = Some i) = (v = OInstr i)\"\nby (case_tac \"v\", auto)\n\nlemma case_expr [simp]: \"(get_expr v = Some a) = (v = OExpr a)\"\nby (case_tac \"v\", auto)\n\n(* When do we actually use OSynFunc? Is x used in any examples we have? ---ELG *)\nlemma case_syn_func [simp]: \"(get_synfunc v = Some (x,f)) = (v = OSynFunc x f)\"\nby (case_tac \"v\", auto)\n\nlemma case_edge_type [simp]: \"(get_edgetype v = Some e) = (v = OEdgeType e)\"\nby (case_tac \"v\", auto)\n\nlemma case_thread [simp]: \"((case v of OThread x \\ P x | _ \\ False)) = (\\t. v = OThread t \\ P t)\"\nby (case_tac \"v\", auto)\n\nlemma get_thread_simp [simp]: \"(get_thread v = Some t) = (v = OThread t)\"\nby (case_tac \"v\", auto)\n\nlemma case_const [simp]: \"(get_const v = Some c) = (v = OConst c)\"\nby (case_tac \"v\", auto)\n\nlemma case_type [simp]: \"(get_type v = Some a) = (v = OType a)\"\nby (case_tac \"v\", auto)\n\nlemma case_op [simp]: \"(get_op v = Some a) = (v = OOp a)\"\nby (case_tac \"v\", auto)\n\nterm \"node_subst (G::('thread \\ ('node, LLVM_edge_type, 'node concrete_LLVM_instr)flowgraph option))\"\nabbreviation philist_subst\n(*\n:: \"('thread \\ ('thread, 'node, 'mvar)flowgraph option) \\ \n ('mvar \\ ('thread, 'node, 'mvar) object) \\\n (('mvar node_const,'mvar)literal, 'mvar) gen_philist \\\n ('node \\ concrete_LLVM_expr) list option\" \n*)\n where\n\"philist_subst \\ \\ (G::('thread \\ ('node, LLVM_edge_type, 'node concrete_LLVM_instr)flowgraph option))\n (\\::('mvar \\ ('thread, 'node, 'mvar) object))\n (es::'mvar gen_philist).\n foldr (\\(n, e) r.\n flatten_option (map_option\n (\\ es'. flatten_option (map_option\n (\\ e'. map_option\n (\\ n'. (n',e') # es')\n (node_subst G \\ n ))\n (expr_pattern_subst \\ e)))\n r))\n (es:: 'mvar gen_philist)\n (Some [])\"\n\nterm \"philist_subst\"\nterm \"philist_fv\"\nlemma philist_same_subst [simp]:\n\"(\\x\\ philist_fv es. \\ x = \\' x) \\ philist_subst CFGs \\ es = philist_subst CFGs \\' es\"\napply (erule rev_mp)\napply (induct es, auto (*split del: option.splits*))\napply (cut_tac \\=\\ and \\'=\\' and e=b in expr_pattern_same_subst, simp, simp (no_asm_simp))\nby (cut_tac \\=\\ and \\'=\\' and n=a and CFGs = CFGs in node_same_subst, simp, simp (no_asm_simp))\n\nterm \"philist_subst\"\n(* Similarly, applying a valuation of metavariables to an instruction pattern yields a concrete instruction. *)\nprimrec instr_subst ::\n\"('thread \\ ('node, LLVM_edge_type, 'node concrete_LLVM_instr)flowgraph option) \\\n ('mvar \\ ('thread, 'node, 'mvar) object) \\\n 'mvar gen_LLVM_instr \\\n 'node concrete_LLVM_instr option\" where\n\"instr_subst CFGs \\ (Assign x opr ty e1 e2) =\n flatten_option (map_option (\\ x'. flatten_option (map_option\n (\\ opr'. flatten_option (map_option (\\ ty'. flatten_option (map_option\n (\\ e1'. map_option (\\ e2'. Assign x' opr' ty' e1' e2') (expr_pattern_subst \\ e2))\n (expr_pattern_subst \\ e1)))\n (LLVM_type_lit_subst \\ ty)))\n (op_subst \\ opr)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (Ret ty e) =\n (case (LLVM_type_lit_subst \\ ty, expr_pattern_subst \\ e) of (Some ty', Some e') \\ \n Some (Ret ty' e') | _ \\ None)\" |\n\"instr_subst CFGs \\ (Br_i1 e) = map_option Br_i1 (expr_pattern_subst \\ e)\" |\n\"instr_subst CFGs \\ Br_label = Some Br_label\" |\n\"instr_subst CFGs \\ (Alloca x ty) =\n flatten_option (map_option (\\ x'. map_option (\\ ty'. Alloca x' ty')\n (LLVM_type_lit_subst \\ ty))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (Load x ty e) = \n flatten_option (map_option\n (\\ x'. flatten_option (map_option\n (\\ ty'. map_option (\\ e'. Load x' ty' e') (expr_pattern_subst \\ e))\n (LLVM_type_lit_subst \\ ty)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (Store ty1 e1 ty2 e2) =\n flatten_option (map_option\n (\\ ty1'. flatten_option (map_option\n (\\ e1'. flatten_option (map_option\n (\\ ty2'. map_option (\\ e2'. Store ty1' e1' ty2' e2') (expr_pattern_subst \\ e2))\n (LLVM_type_lit_subst \\ ty2)))\n (expr_pattern_subst \\ e1)))\n (LLVM_type_lit_subst \\ ty1))\" |\n\"instr_subst CFGs \\ (Cmpxchg x ty1 e1 ty2 e2 ty3 e3) =\n flatten_option (map_option\n (\\ x'. flatten_option (map_option\n (\\ ty1'. flatten_option (map_option\n (\\ e1'. flatten_option (map_option\n (\\ ty2'. flatten_option (map_option\n (\\ e2'. flatten_option (map_option\n (\\ ty3'. (map_option \n (\\ e3'. Cmpxchg x' ty1' e1' ty2' e2' ty3' e3')\n (expr_pattern_subst \\ e3)))\n (LLVM_type_lit_subst \\ ty3)))\n (expr_pattern_subst \\ e2)))\n (LLVM_type_lit_subst \\ ty2)))\n (expr_pattern_subst \\ e1)))\n (LLVM_type_lit_subst \\ ty1)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (ICmp x opr ty e1 e2) =\n flatten_option (map_option\n (\\ x'. flatten_option (map_option\n (\\ opr'. flatten_option (map_option\n (\\ ty'. flatten_option (map_option\n (\\ e1'. (map_option\n (\\ e2'. ICmp x' opr' ty' e1' e2')\n (expr_pattern_subst \\ e2)))\n (expr_pattern_subst \\ e1)))\n (LLVM_type_lit_subst \\ ty)))\n (cmp_subst \\ opr)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (Phi x ty es) =\n flatten_option (map_option\n (\\ x'. flatten_option (map_option\n (\\ ty'. (map_option\n (\\ es'. Phi x' ty' es')\n (lit_subst (philist_subst CFGs) get_philist \\ es)))\n (LLVM_type_lit_subst \\ ty)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (Call x ty es) = \n flatten_option (map_option\n (\\ x'. flatten_option (map_option\n (\\ ty'. (map_option\n (\\ es'. Call x' ty' es')\n (lit_subst eplist_subst get_eplist \\ es)))\n (LLVM_type_lit_subst \\ ty)))\n (get_var_name (\\ x)))\" |\n\"instr_subst CFGs \\ (IsPointer e) = map_option IsPointer (expr_pattern_subst \\ e)\"\n\n(*\ndeclare [[show_types = true]]\n*)\n\nlemma instr_same_subst [simp]:\n fixes CFGs :: \"'thread \\ ('node, LLVM_edge_type, 'node concrete_LLVM_instr)flowgraph option\"\n and \\ :: \"'mvar \\ ('thread, 'node, 'mvar) object\"\n and \\':: \"'mvar \\ ('thread, 'node, 'mvar) object\"\n and i :: \"'mvar gen_LLVM_instr\"\n assumes FV_assum:\"\\x\\instr_pattern_fv i. \\ x = \\' x\"\n shows \"instr_subst CFGs \\ i = instr_subst CFGs \\' i\"\nusing FV_assum\nproof (cases i, auto)\n fix var and opr::\"(LLVM_op,'mvar)literal\" and type and expr1 and expr2\n assume A1: \"\\ var = \\' var\"\n and B1: \"\\x\\LLVM_type_lit_fv type \\ base_lit_fv opr \\ expr_pattern_fv expr_fv expr1 \\ expr_pattern_fv expr_fv expr2. \\ x = \\' x\"\n from B1 have E1: \"(op_subst \\ opr = op_subst \\' opr) \\\n (LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type) \\\n (expr_pattern_subst \\ expr1) = (expr_pattern_subst \\' expr1) \\\n (expr_pattern_subst \\ expr2) = (expr_pattern_subst \\' expr2)\"\n by simp\n from E1 show \"flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\opr'. flatten_option\n (map_option\n (\\ty'. flatten_option\n (map_option (\\e1'. map_option (Assign x' opr' ty' e1')\n (expr_pattern_subst \\ expr2)) (expr_pattern_subst \\ expr1)))\n (LLVM_type_lit_subst \\ type)))\n (op_subst \\ opr)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\opr'. flatten_option\n (map_option\n (\\ty'. flatten_option\n (map_option (\\e1'. map_option (Assign x' opr' ty' e1') (expr_pattern_subst \\' expr2)) (expr_pattern_subst \\' expr1)))\n (LLVM_type_lit_subst \\' type)))\n (op_subst \\' opr)))\n (get_var_name (\\' var)))\" by simp\n next (* 15 *)\n fix type and expr and x2\n assume A2: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x \"\n from A2 have E2: \"(LLVM_type_lit_subst \\' type = LLVM_type_lit_subst \\ type)\" by simp\n assume B2: \"LLVM_type_lit_subst \\ type = None\"\n from B2 and E2 show \"LLVM_type_lit_subst \\' type = None\" by simp\n next (* 14 *)\n fix type expr x2 x2a\n assume A3: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A3 have E3: \"(expr_pattern_subst \\ expr) = (expr_pattern_subst \\' expr)\" by simp\n assume B3: \"expr_pattern_subst \\ expr = None\" and C3: \"expr_pattern_subst \\' expr = \\x2a\\\"\n from B3 and C3 and E3 show \"LLVM_type_lit_subst \\' type = None\" by simp\n next (* 13 *)\n fix type and expr x2\n assume A4: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A4 have E4: \"(LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type)\"\n by simp\n assume B4: \"LLVM_type_lit_subst \\ type = \\x2\\\"\n from E4 and B4\n show \"\\y. LLVM_type_lit_subst \\' type = Some y\"\n by (rule_tac x = \"x2\" in exI, clarsimp)\n next (* 12 *)\n fix type expr x2 x2a x2b\n assume A5: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x \"\n from A5 have E5: \"(expr_pattern_subst \\ expr) = (expr_pattern_subst \\' expr)\" by simp\n assume B5: \"expr_pattern_subst \\ expr = \\x2a\\\" and C5: \"expr_pattern_subst \\' expr = None\"\n from E5 and B5 and C5\n show \"False\" by simp\n next (* 11 *)\n fix type expr x2 x2a x2b x2c\n assume A6: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A6 have E6: \"(LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type)\" by simp\n assume B6: \"LLVM_type_lit_subst \\ type = \\x2\\\" and C6: \"LLVM_type_lit_subst \\' type = \\x2b\\\"\n from E6 and B6 and C6\n show \"x2 = x2b\" by simp\n next (* 10 *)\n fix type expr x2 x2a x2b x2c\n assume A7: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A7 have E7: \"(expr_pattern_subst \\ expr) = (expr_pattern_subst \\' expr)\" by simp\n assume B7: \"expr_pattern_subst \\ expr = \\x2a\\\" and C7: \"expr_pattern_subst \\' expr = \\x2c\\\"\n from E7 and B7 and C7 \n show \"x2a = x2c\" by simp\n next (* 9 *)\n fix expr\n assume A8: \"\\x\\expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A8 have E8: \"(expr_pattern_subst \\ expr) = (expr_pattern_subst \\' expr)\" by simp\n from E8\n show \"map_option Br_i1 (expr_pattern_subst \\ expr) = map_option Br_i1 (expr_pattern_subst \\' expr)\"\n by simp\n next (* 8 *)\n fix var type\n assume A9: \"\\ var = \\' var\" and B9: \"\\x\\LLVM_type_lit_fv type. \\ x = \\' x\"\n from A9 and B9 have E9: \"(LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type)\" by simp\n from E9\n show \"flatten_option (map_option (\\x'. map_option (Alloca x') (LLVM_type_lit_subst \\ type)) (get_var_name (\\' var))) =\n flatten_option (map_option (\\x'. map_option (Alloca x') (LLVM_type_lit_subst \\' type)) (get_var_name (\\' var)))\"\n by simp\n next (* 7 *)\n fix var type expr\n assume A10: \"\\ var = \\' var\"\n and B10: \"\\x\\LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A10 and B10\n have E10: \"(LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type) \\\n (expr_pattern_subst \\ expr) = (expr_pattern_subst \\' expr)\" by simp\n from E10\n show \"flatten_option\n (map_option (\\x'. flatten_option (map_option (\\ty'. map_option (Load x' ty') (expr_pattern_subst \\ expr)) (LLVM_type_lit_subst \\ type)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option (\\x'. flatten_option (map_option (\\ty'. map_option (Load x' ty') (expr_pattern_subst \\' expr)) (LLVM_type_lit_subst \\' type)))\n (get_var_name (\\' var)))\" by simp\n next (* 6 *)\n fix type1 expr1 type2 expr2\n assume A11: \"\\x\\LLVM_type_lit_fv type1 \\ expr_pattern_fv expr_fv expr1 \\ LLVM_type_lit_fv type2 \\ expr_pattern_fv expr_fv expr2. \\ x = \\' x \"\n from A11 have E11: \"(LLVM_type_lit_subst \\ type1 = LLVM_type_lit_subst \\' type1) \\\n (expr_pattern_subst \\ expr1) = (expr_pattern_subst \\' expr1) \\\n (LLVM_type_lit_subst \\ type2 = LLVM_type_lit_subst \\' type2) \\\n (expr_pattern_subst \\ expr2) = (expr_pattern_subst \\' expr2)\" by simp\n from E11\n show \"flatten_option\n (map_option\n (\\ty1'. flatten_option\n (map_option (\\e1'. flatten_option (map_option (\\ty2'. map_option (Store ty1' e1' ty2') (expr_pattern_subst \\ expr2)) (LLVM_type_lit_subst \\ type2)))\n (expr_pattern_subst \\ expr1)))\n (LLVM_type_lit_subst \\ type1)) =\n flatten_option\n (map_option\n (\\ty1'. flatten_option\n (map_option\n (\\e1'. flatten_option (map_option (\\ty2'. map_option (Store ty1' e1' ty2') (expr_pattern_subst \\' expr2)) (LLVM_type_lit_subst \\' type2)))\n (expr_pattern_subst \\' expr1)))\n (LLVM_type_lit_subst \\' type1))\" by simp\n next (* 5 *)\n fix var type1 expr1 type2 expr2 type3 expr3\n assume A12: \"\\ var = \\' var\"\n and B12: \"\\x\\LLVM_type_lit_fv type1 \\ expr_pattern_fv expr_fv expr1 \\ LLVM_type_lit_fv type2 \\ expr_pattern_fv expr_fv expr2 \\ LLVM_type_lit_fv type3 \\\n expr_pattern_fv expr_fv expr3. \\ x = \\' x\"\n from A12 and B12 have E12: \"(LLVM_type_lit_subst \\ type1 = LLVM_type_lit_subst \\' type1) \\\n (expr_pattern_subst \\ expr1) = (expr_pattern_subst \\' expr1) \\\n (LLVM_type_lit_subst \\ type2 = LLVM_type_lit_subst \\' type2) \\\n (expr_pattern_subst \\ expr2) = (expr_pattern_subst \\' expr2) \\\n (LLVM_type_lit_subst \\ type3 = LLVM_type_lit_subst \\' type3) \\\n (expr_pattern_subst \\ expr3) = (expr_pattern_subst \\' expr3)\" by simp\n from E12 show \"flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\ty1'. flatten_option\n (map_option\n (\\e1'. flatten_option\n (map_option\n (\\ty2'. flatten_option\n (map_option\n (\\e2'. flatten_option\n (map_option (\\ty3'. map_option (Cmpxchg x' ty1' e1' ty2' e2' ty3') (expr_pattern_subst \\ expr3))\n (LLVM_type_lit_subst \\ type3)))\n (expr_pattern_subst \\ expr2)))\n (LLVM_type_lit_subst \\ type2)))\n (expr_pattern_subst \\ expr1)))\n (LLVM_type_lit_subst \\ type1)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\ty1'. flatten_option\n (map_option\n (\\e1'. flatten_option\n (map_option\n (\\ty2'. flatten_option\n (map_option\n (\\e2'. flatten_option\n (map_option (\\ty3'. map_option (Cmpxchg x' ty1' e1' ty2' e2' ty3') (expr_pattern_subst \\' expr3))\n (LLVM_type_lit_subst \\' type3)))\n (expr_pattern_subst \\' expr2)))\n (LLVM_type_lit_subst \\' type2)))\n (expr_pattern_subst \\' expr1)))\n (LLVM_type_lit_subst \\' type1)))\n (get_var_name (\\' var)))\" by simp\n next (* 4 *)\n fix var and cmp :: \"(LLVM_cmp,'mvar)literal\" and type and expr1 and expr2\n assume A13: \"\\ var = \\' var\"\n and B13: \"\\x\\base_lit_fv cmp \\ LLVM_type_lit_fv type \\ expr_pattern_fv expr_fv expr1 \\ expr_pattern_fv expr_fv expr2. \\ x = \\' x\"\n from A13 and B13 \n have E13: \"(cmp_subst \\ cmp = cmp_subst \\' cmp) \\\n (LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type) \\\n (expr_pattern_subst \\ expr1) = (expr_pattern_subst \\' expr1) \\\n (expr_pattern_subst \\ expr2) = (expr_pattern_subst \\' expr2)\"\n by simp\n from E13\n show \"flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\opr'. flatten_option\n (map_option\n (\\ty'. flatten_option (map_option (\\e1'. map_option (ICmp x' opr' ty' e1') (expr_pattern_subst \\ expr2)) (expr_pattern_subst \\ expr1)))\n (LLVM_type_lit_subst \\ type)))\n (cmp_subst \\ cmp)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\opr'. flatten_option\n (map_option\n (\\ty'. flatten_option\n (map_option (\\e1'. map_option (ICmp x' opr' ty' e1') (expr_pattern_subst \\' expr2)) (expr_pattern_subst \\' expr1)))\n (LLVM_type_lit_subst \\' type)))\n (cmp_subst \\' cmp)))\n (get_var_name (\\' var)))\" by simp\n next (* 3 *)\n fix var type phi_list\n assume A14: \"\\ var = \\' var\"\n and B14: \"\\x\\LLVM_type_lit_fv type \\ lit_fv philist_fv phi_list. \\ x = \\' x\"\n from A14 and B14\n have E14: \"(lit_subst (philist_subst CFGs) get_philist \\ phi_list = lit_subst(philist_subst CFGs) get_philist \\' phi_list) \\\n (LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type)\"\n proof auto\n show \"lit_subst (philist_subst CFGs) get_philist \\ phi_list = lit_subst (philist_subst CFGs) get_philist \\' phi_list\"\nthm lit_same_subst\n proof (rule_tac data_fv = \"philist_fv\" and data_subst = \"philist_subst CFGs\" and get_data = get_philist in lit_same_subst)\n show \"\\x. (\\v\\philist_fv x. \\ v = \\' v) \\ philist_subst CFGs \\ x = philist_subst CFGs \\' x\"\n by auto\n next\n from B14\n show \"\\v\\lit_fv philist_fv phi_list. \\ v = \\' v\" by auto\n qed\n qed\n from E14\n show \"flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\ty'. map_option (Phi x' ty')\n (lit_subst (philist_subst CFGs) get_philist \\\n phi_list))\n (LLVM_type_lit_subst \\ type)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option\n (\\ty'. map_option (Phi x' ty')\n (lit_subst (philist_subst CFGs) get_philist \\'\n phi_list))\n (LLVM_type_lit_subst \\' type)))\n (get_var_name (\\' var)))\"\n by simp\n next (* 2 *)\n fix var type args\n assume A15: \"\\ var = \\' var\"\n and B15: \"\\x\\LLVM_type_lit_fv type \\ lit_fv eplist_fv args. \\ x = \\' x \"\n from A15 and B15\n have E15: \"((lit_subst eplist_subst get_eplist \\ args) = (lit_subst eplist_subst get_eplist \\' args)) \\\n (LLVM_type_lit_subst \\ type = LLVM_type_lit_subst \\' type)\"\n proof auto\n show \"lit_subst eplist_subst get_eplist \\ args = lit_subst eplist_subst get_eplist \\' args\"\n proof (rule_tac data_fv = \"eplist_fv\" and data_subst = \"eplist_subst\" and get_data = get_eplist in lit_same_subst)\n show \"\\x. (\\v\\eplist_fv x. \\ v = \\' v) \\ eplist_subst \\ x = eplist_subst \\' x\" \n by (rule eplist_same_subst)\n next\n from B15\n show \" \\v\\lit_fv eplist_fv args. \\ v = \\' v\" by auto\n qed\n qed\n from E15\n show \"flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option (\\ty'. map_option (Call x' ty') (lit_subst eplist_subst get_eplist \\ args)) (LLVM_type_lit_subst \\ type)))\n (get_var_name (\\' var))) =\n flatten_option\n (map_option\n (\\x'. flatten_option\n (map_option (\\ty'. map_option (Call x' ty') (lit_subst eplist_subst get_eplist \\' args)) (LLVM_type_lit_subst \\' type)))\n (get_var_name (\\' var)))\"\n by simp\n next (* 1 *)\n fix expr\n assume A16: \"\\x\\expr_pattern_fv expr_fv expr. \\ x = \\' x\"\n from A16\n have E16: \"(expr_pattern_subst \\ expr = expr_pattern_subst \\' expr)\" by simp\n from E16\n show \"map_option IsPointer (expr_pattern_subst \\ expr) = map_option IsPointer (expr_pattern_subst \\' expr)\"\n by simp\nqed\n\n\nprimrec subst where\n\"subst CFGs \\ (Inj i) = instr_subst CFGs \\ i\" |\n\"subst CFGs \\ (MVar x) = get_instr (\\ x)\"\n\nterm \"subst\"\n\nterm \"pattern_fv\"\nterm \"instr_subst G \\\"\nlemma pattern_same_subst:\nfixes CFGs and \\ and \\'\nshows \"\\x\\pattern_fv p. \\ x = \\' x \\ subst CFGs \\ p = subst CFGs \\' p\"\nby (cases p, auto)\n\nend\n", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/LLVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.28112863604815547}} {"text": "theory RepeatUpdate\n imports UpdateSemHelper\nbegin\n\nsection \"Repeat loop definitions\" \n\ntext \"Main body:\n Summary:\n Does at most @{term \\n::nat\\} iterations and apply @{term \\g ::'f expr\\} to update the input\n accumulator and heap. If @{term \\f ::'f expr\\} returns @{term True} then terminate early.\n Arguments:\n @{term \\\\'::('f, 'a, 'l) uabsfuns\\} is a partial mapping from abstract function names to their specifications,\n @{term \\n::nat\\} is a natural number that is recursed on, i.e. terminate if 0 else subtract 1, apply body and repeat ,\n @{term \\f ::'f expr\\} is a Cogent expression that is used to check if the loop should terminate early,\n @{term \\g ::'f expr\\} is a Cogent expression that is used to update the heap and the accumulator,\n @{term \\\\::('f, 'a, 'l) store\\} is the input heap that is updated each loop iteration,\n @{term \\\\'::('f, 'a, 'l) store\\} is the output heap,\n @{term \\\\a::type\\} is the Cogent type of the accumulator,\n @{term \\acc::('f, 'a, 'l) uval\\} is the accumulator that is updated each loop iteration,\n @{term \\\\o::type\\} is the Cogent type of the observer,\n @{term \\obsv::('f, 'a, 'l) uval\\} is the observer that does not change throughout the loop,\n @{term \\ret::('f, 'a, 'l) uval\\} is the is the output accumulator value.\n Output:\n @{term True} if the loop evaluates to the output heap and accumulator,\n @{term False} otherwise.\"\n\nfun urepeat_bod\n where\n\"urepeat_bod _ 0 _ _ \\ \\' _ acc _ _ ret = (\\ = \\' \\ acc = ret)\" |\n\"urepeat_bod \\' (Suc n) f g \\ \\' \\a acc \\o obsv ret =\n (\\b. (\\' , [URecord [(acc, type_repr (bang \\a)), (obsv, type_repr \\o)] None] \n \\ (\\, App f (Var 0)) \\! (\\, UPrim (LBool b))) \\\n (if b then \\ = \\' \\ acc = ret\n else (\\\\'' acc'. (\\' , [URecord [(acc, type_repr \\a), (obsv, type_repr \\o)] None] \n \\ (\\, App g (Var 0)) \\! (\\'', acc')) \\\n urepeat_bod \\' n f g \\'' \\' \\a acc' \\o obsv ret)))\"\n\ntext \"Wrapper with extra checks:\n Summary:\n Checks the arguments are of the correct form and type and then passes these to\n @{term urepeat_bod} with minor processing.\n Checks:\n * The observer type has been banged, i.e. is read-only or is drop-able.\n * The functions f and g are of the correct type and form.\"\n\ndefinition urepeat\n where\n\"urepeat \\' \\' \\a \\o x y =\n (\\\\ \\' n f g acc obsv ret.\n x = (\\, URecord [(UPrim (LU64 n), RPrim (Num U64)), (f, RFun), (g, RFun),\n (acc, type_repr \\a), (obsv, type_repr \\o)] None) \\\n y = (\\', ret) \\\n is_uvalfun f \\\n is_uvalfun g \\\n bang \\o = \\o \\\n (\\', 0, [], {}, \n [option.Some (TRecord [(''acc'', bang \\a, Present), (''obsv'', \\o, Present)] Unboxed)]\n \\ (App (uvalfun_to_expr f) (Var 0)) : TPrim Bool) \\\n (\\', 0, [], {}, \n [option.Some (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed)]\n \\ (App (uvalfun_to_expr g) (Var 0)) : \\a) \\\n urepeat_bod \\' (unat n) (uvalfun_to_expr f) (uvalfun_to_expr g) \\ \\' \\a acc \\o obsv ret)\"\n\nsection \"Repeat loop lemmas\"\n\ncontext update_sem begin\n\nsubsection \"Preservation and frame constraint satisfaction\"\n\nlemma urepeat_bod_preservation:\n \"\\proc_ctx_wellformed \\';\n \\' matches-u \\';\n \\', \\ \\ acc :u \\a \\ra, wa\\;\n \\', \\ \\ obsv :u \\o \\ro, {}\\;\n ro \\ wa = {};\n urepeat_bod \\' n f g \\ \\' \\a acc \\o obsv ret;\n \\', 0, [], {}, \n [option.Some (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed)] \\ (App g (Var 0)) : \\a\\\n \\ \\r' w'. \\', \\' \\ ret :u \\a \\r', w'\\ \\ r' \\ (ra \\ ro) \\ frame \\ wa \\' w'\"\n apply (induct arbitrary: ra wa rule: urepeat_bod.induct[of _ \\' n f g \\ \\' \\a acc \\o obsv ret])\n apply (rename_tac \\' f g \\ \\' \\a acc \\o obsv ret ra wa)\n apply clarsimp\n apply (intro exI conjI, assumption, blast, rule frame_id)\n apply (rename_tac \\' n f g \\ \\' \\a acc \\o obsv ret ra wa)\n apply clarsimp\n apply (rename_tac b)\n apply (case_tac b; clarsimp)\n apply (intro exI conjI, assumption, blast, rule frame_id)\n apply (drule_tac x = False in meta_spec; clarsimp)\n apply (drule_tac x = \\'' and y = acc' in meta_spec2)\n apply clarsimp\n apply (drule_tac \\ = \"[URecord [(acc, type_repr \\a), (obsv, type_repr \\o)] None]\" and\n \\' = \\'' and v = acc' and r = \"ra \\ ro\" and w = wa in preservation_mono(1)[rotated -1]; simp?)\n apply (intro matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified]\n matches_ptrs_empty[where \\s = \"[]\", simplified])\n apply (rule u_t_struct; simp?) \n apply (intro u_t_r_cons1[where r' = ro and w' = \"{}\", simplified]\n u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified] u_t_r_empty; simp?)\n apply blast \n apply (simp add: matches_ptrs.matches_ptrs_empty)\n apply clarsimp\n apply (rename_tac r' w')\n apply (drule_tac x = r' and y = w' in meta_spec2; simp)\n apply (erule meta_impE)\n apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n apply (drule meta_mp)\n apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n apply clarsimp\n apply (rename_tac r'' w'')\n apply (intro exI conjI, assumption)\n apply blast\n apply (rule frame_trans; simp?)\n done\n\nlemma urepeat_preservation:\n \"\\\\ \\' v v' r w.\n \\proc_ctx_wellformed \\';\n \\' matches-u \\';\n \\', \\ \\ v :u TRecord\n [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (TRecord [(''acc'', bang \\a, Present), (''obsv'', \\o, Present)] Unboxed) (TPrim Bool), Present),\n (''step'', TFun (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed) \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)]\n Unboxed \\r, w\\;\n urepeat \\' \\' \\a \\o (\\, v) (\\', v')\\\n \\ \\r' w'. \\', \\' \\ v' :u \\a \\r', w'\\ \\ r' \\ r \\ frame \\ w \\' w'\"\n unfolding urepeat_def\n apply clarsimp\n apply (erule u_t_recE; clarsimp)\n apply (erule u_t_r_consE; clarsimp)+\n apply (erule u_t_r_emptyE; clarsimp)\n apply (frule tfun_no_pointers)\n apply (drule tfun_no_pointers(2))\n apply clarsimp\n apply (frule tfun_no_pointers)\n apply (drule tfun_no_pointers(2))\n apply clarsimp\n apply (frule tprim_no_pointers)\n apply (drule tprim_no_pointers(2))\n apply clarsimp\n apply (rename_tac \\ \\' v' n f g acc ra wa obsv ro wo)\n apply (cut_tac \\' = \\' and \\ = \\ and \\ = \\o and v = obsv and r = ro and w = wo in bang_not_writable(1); simp?)\n apply (rule urepeat_bod_preservation; simp?)\n apply blast\n done\n\nend (* of context *)\n\nsubsection \"Early termination and step lemmas\"\n\nlemma urepeat_bod_early_termination:\n \"\\urepeat_bod \\' i f g \\ \\' \\a acc \\o obsv ret; i < n;\n \\', [URecord [(ret, type_repr (bang \\a)), (obsv, type_repr \\o)] None] \\ (\\', App f (Var 0)) \\! (\\', UPrim (LBool True))\\\n \\ urepeat_bod \\' n f g \\ \\' \\a acc \\o obsv ret\"\n apply (induct arbitrary: i rule: urepeat_bod.induct[of _ \\' n f g \\ \\' \\a acc \\o obsv ret])\n apply clarsimp\n apply clarsimp\n apply (rename_tac i)\n apply (case_tac i; clarsimp)\n apply blast\n apply (rename_tac b)\n apply (case_tac b; clarsimp)\n apply blast\n apply (rename_tac ret nat b \\'' acc')\n apply (rule_tac x = b in exI)\n apply (rule conjI; clarsimp)\n apply (intro exI conjI; assumption)\n done\n\ndeclare urepeat_bod.simps[simp del]\nlemma urepeat_bod_step:\n \"\\\\', [URecord [(ret, type_repr (bang \\a)), (obsv, type_repr \\o)] None] \\ (\\', App f (Var 0)) \\! (\\', UPrim (LBool False));\n \\(\\', [URecord [(ret, type_repr (bang \\a)), (obsv, type_repr \\o)] None] \\ (\\', App f (Var 0)) \\! (\\', UPrim (LBool True)));\n \\', [URecord [(ret, type_repr \\a), (obsv, type_repr \\o)] None] \\ (\\', App g (Var 0)) \\! (\\'', ret');\n urepeat_bod \\' n f g \\ \\' \\a acc \\o obsv ret\\ \n \\ urepeat_bod \\' (Suc n) f g \\ \\'' \\a acc \\o obsv ret'\"\n apply (induct arbitrary: \\'' ret' rule: urepeat_bod.induct[of _ \\' n f g \\ \\' \\a acc \\o obsv ret])\n apply (clarsimp simp: urepeat_bod.simps)\n apply clarsimp\n apply (erule urepeat_bod.elims; clarsimp)\n apply (rename_tac \\'' ret' \\ n f g \\ \\' \\a acc \\o obsv ret b)\n apply (case_tac b; clarsimp)\n apply (drule_tac x = b in meta_spec; clarsimp)\n apply (elim meta_allE meta_impE, assumption, assumption)\n apply (subst urepeat_bod.simps; clarsimp)\n apply (rule_tac x = b in exI; clarsimp)\n apply (intro exI conjI; assumption)\n done\ndeclare urepeat_bod.simps[simp]\n\nsubsection \"Deterministic\"\n\nlemma urepeat_bod_deterministic:\n \"\\determ \\;\n urepeat_bod \\ n f g \\ \\' \\a acc \\o obsv ret;\n urepeat_bod \\ n f g \\ \\'' \\a acc \\o obsv ret'\\\n \\ \\' = \\'' \\ ret = ret'\"\n apply (induct n arbitrary: \\ acc)\n apply simp\n apply clarsimp\n apply (drule (2) u_sem_u_sem_all_determ(1)[rotated 1]; simp)\n apply clarsimp\n apply (rename_tac n \\ acc b)\n apply (case_tac b; clarsimp)\n apply (drule (2) u_sem_u_sem_all_determ(1)[rotated 1]; simp)\n done\n\nlemma urepeat_deterministic:\n \"\\determ \\;\n urepeat \\ \\ \\a \\o x y;\n urepeat \\ \\ \\a \\o x z\\\n \\ y = z\"\n unfolding urepeat_def\n apply clarsimp\n apply (drule (3) urepeat_bod_deterministic)\n done\n\nlemma urepeat_bod_step_determ:\n \"\\\\', [URecord [(ret, type_repr (bang \\a)), (obsv, type_repr \\o)] None] \\ (\\', App f (Var 0)) \\! (\\', UPrim (LBool False));\n \\', [URecord [(ret, type_repr \\a), (obsv, type_repr \\o)] None] \\ (\\', App g (Var 0)) \\! (\\'', ret');\n urepeat_bod \\' n f g \\ \\' \\a acc \\o obsv ret;\n determ \\'\\ \n \\ urepeat_bod \\' (Suc n) f g \\ \\'' \\a acc \\o obsv ret'\"\n apply (rule urepeat_bod_step; simp?)\n apply clarsimp\n apply (drule (2) u_sem_u_sem_all_determ(1)[rotated 1]; simp)\n done\n\nsubsection \"Ordering\"\n\nlemma urepeat_bod_rel_leqD:\n \"\\rel_leq \\a \\b;\n urepeat_bod \\a n f g \\ \\' \\a acc \\o obsv ret\\\n \\ urepeat_bod \\b n f g \\ \\' \\a acc \\o obsv ret\"\n apply (induct n arbitrary: \\ acc)\n apply simp\n apply clarsimp\n apply (rename_tac n \\ acc b)\n apply (case_tac b; clarsimp)\n apply (drule (1) u_sem_u_sem_all_rel_leqD)\n apply (rule_tac x = b in exI; clarsimp)\n apply (drule (1) u_sem_u_sem_all_rel_leqD[rotated 1])\n apply (drule (1) u_sem_u_sem_all_rel_leqD[rotated 1])\n apply (rule_tac x = b in exI; clarsimp)\n apply (elim meta_allE meta_impE, assumption)\n apply (intro exI conjI; assumption)\n done\n\nlemma urepeat_rel_leqD:\n \"\\rel_leq \\a \\b;\n urepeat \\ \\a \\a \\o x y\\\n \\ urepeat \\ \\b \\a \\o x y\"\n unfolding urepeat_def\n apply clarsimp\n apply (drule (2) urepeat_bod_rel_leqD)\n done\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/RepeatUpdate.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.28112862909587316}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoareTotal.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Derived Hoare Rules for Total Correctness\\\n\ntheory HoareTotal imports HoareTotalProps begin\n\nlemma conseq_no_aux:\n \"\\\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A';\n \\s. s \\ P \\ (s\\P' \\ (Q' \\ Q)\\ (A' \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where P'=\"\\Z. P'\" and Q'=\"\\Z. Q'\" and A'=\"\\Z. A'\"]) auto\n\ntext \\If for example a specification for a \"procedure pointer\" parameter\nis in the precondition we can extract it with this rule\\\nlemma conseq_exploit_pre:\n \"\\\\s \\ P. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P) c Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply clarify\n apply (rule_tac x=\"{s} \\ P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n by simp\n\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q)\\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq') blast\n\n\nlemma Lem:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n P \\ {s. \\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)}\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (unfold lem_def)\n apply (erule conseq)\n apply blast\n done\n\n\nlemma LemAnno:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)}\"\nassumes lem: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ (\\t. t \\ Q' Z \\ t \\ Q)}\"\nassumes lem: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma TrivPost: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n \\\n \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n \\\n \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma DynComConseq:\n assumes \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n using assms\n apply -\n apply (rule hoaret.DynCom)\n apply clarsimp\n apply (rule hoaret.Conseq)\n apply clarsimp\n apply blast\n done\n\nlemma SpecAnno:\n assumes consequence: \"P \\ {s. (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))}\"\n assumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant: \"\\Z. c Z = c undefined\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n from spec bdy_constant\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c undefined) (Q' Z),(A' Z)\"\n apply -\n apply (rule allI)\n apply (erule_tac x=Z in allE)\n apply (erule_tac x=Z in allE)\n apply simp\n done\n with consequence show ?thesis\n apply (simp add: specAnno_def)\n apply (erule conseq)\n apply blast\n done\nqed\n\n\n\nlemma SpecAnno':\n \"\\P \\ {s. \\ Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)};\n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\nlemma SpecAnnoNoAbrupt:\n \"\\P \\ {s. \\ Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q)};\n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\ Q \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip Q,A\"\n by (rule hoaret.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\ {s. (f s) \\ Q} \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n by (rule hoaret.Basic [THEN conseqPre])\n\nlemma BasicCond:\n \"\\P \\ {s. (b s \\ f s\\Q) \\ (\\ b s \\ g s\\Q)}\\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Basic (\\s. if b s then f s else g s) Q,A\"\n apply (rule Basic)\n apply auto\n done\n\nlemma Spec: \"P \\ {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)}\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoaret.Spec [THEN conseqPre])\n\nlemma SpecIf:\n \"\\P \\ {s. (b s \\ f s \\ Q) \\ (\\ b s \\ g s \\ Q \\ h s \\ Q)}\\ \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n apply (rule Spec)\n apply (auto simp add: if_rel_def)\n done\n\nlemma Seq [trans, intro?]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoaret.Seq)\n\nlemma SeqSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n by (rule Seq)\n\nlemma BSeq:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (unfold bseq_def) (rule Seq)\n\nlemma Cond:\n assumes wp: \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoaret.Cond [THEN conseqPre])\n from deriv_c1\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ b) c\\<^sub>1 Q,A\"\n by (rule conseqPre) blast\nnext\n from deriv_c2\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ - b) c\\<^sub>2 Q,A\"\n by (rule conseqPre) blast\nqed (insert wp)\n\n\nlemma CondSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P2 c2 Q,A;\n P \\ {s. (s\\b \\ s\\P1) \\ (s\\b \\ s\\P2)}\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond)\n\nlemma Cond':\n \"\\P \\ {s. (b \\ P1) \\ (- b \\ P2)};\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P2 c2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule CondSwap) blast+\n\nlemma CondInv:\n assumes wp: \"P \\ Q\"\n assumes inv: \"Q \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from wp inv\n have \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n by blast\n from Cond [OF this deriv_c1 deriv_c2]\n show ?thesis .\nqed\n\nlemma CondInv':\n assumes wp: \"P \\ I\"\n assumes inv: \"I \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes wp': \"I \\ Q\"\n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\"\n assumes deriv_c2: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from CondInv [OF wp inv deriv_c1 deriv_c2]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\" .\n from conseqPost [OF this wp' subset_refl]\n show ?thesis .\nqed\n\n\nlemma switchNil:\n \"P \\ Q \\ \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n by (simp add: Skip)\n\nlemma switchCons:\n \"\\P \\ {s. (v s \\ V \\ s \\ P\\<^sub>1) \\ (v s \\ V \\ s \\ P\\<^sub>2)};\n \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\\n\\ \\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n by (simp add: Cond)\n\n\nlemma Guard:\n \"\\P \\ g \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\napply (rule HoareTotalDef.Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n by (rule Guard)\n\nlemma Guarantee:\n \"\\P \\ {s. s \\ g \\ s \\ R}; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\ g \\ s \\ R}\"])\napply assumption\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ {s. s \\ g \\ s \\ R}; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guarantee)\n\n\nlemma GuardStrip:\n \"\\P \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\P \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\P \\ g \\ R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g c Q,A\"\n by (unfold guaranteeStrip_def) (rule Guard)\n\nlemma GuaranteeAsGuardSwap:\n \"\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g c Q,A\"\n by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While:\n assumes P_I: \"P \\ I\"\n assumes deriv_body:\n \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n assumes I_Q: \"I \\ -b \\ Q\"\n assumes wf: \"wf V\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n from wf deriv_body P_I I_Q\n show ?thesis\n apply (unfold whileAnno_def)\n apply (erule conseqPrePost [OF HoareTotalDef.While])\n apply auto\n done\nqed\n\n\n\nlemma WhileInvPost:\n assumes P_I: \"P \\ I\"\n assumes termi_body:\n \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ P),A\"\n assumes deriv_body:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (I \\ b) c I,A\"\n assumes I_Q: \"I \\ -b \\ Q\"\n assumes wf: \"wf V\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n have \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n proof\n fix \\\n from hoare_sound [OF deriv_body] hoaret_sound [OF termi_body [rule_format, of \\]]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n then\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I \\ b) c ({t. (t, \\) \\ V} \\ I),A\"\n by (rule hoaret_complete')\n qed\n\n from While [OF P_I this I_Q wf]\n show ?thesis .\nqed\n\n(* *)\nlemma \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) (Seq c (Guard f Q Skip)) Q,A\"\noops\n\ntext \\@{term \"J\"} will be instantiated by tactic with @{term \"gs' \\ I\"} for\n those guards that are not stripped.\\\nlemma WhileAnnoG:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards gs\n (whileAnno b J V (Seq c (guards gs Skip)))) Q,A\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n by (simp add: whileAnnoG_def whileAnno_def while_def)\n\ntext \\This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"}\\\n\n\n\n\nlemma WhileAnnoFix':\nassumes consequence: \"P \\ {s. (\\ Z. s\\I Z \\\n (\\t. t \\ I Z \\ -b \\ t \\ Q)) }\"\nassumes bdy: \"\\Z \\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ I Z \\ b) (c Z) ({t. (t, \\) \\ V Z} \\ I Z),A\"\nassumes bdy_constant: \"\\Z. c Z = c undefined\"\nassumes wf: \"\\Z. wf (V Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoFix b I V c) Q,A\"\n apply (rule WhileAnnoFix [OF _ bdy bdy_constant wf])\n using consequence by blast\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (guards gs\n (whileAnnoFix b J V (\\Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n using whileAnnoFix\n by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n assumes adapt: \"P \\ {s. s \\ P' s}\"\n assumes c: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (bind e c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P' Z}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\napply (rule allI)\napply (unfold bind_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule conseqPre)\napply (rule c [rule_format])\napply blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ init s \\ P' Z}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ R Z t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return Z t \\ R Z t}\" and\n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ A}\" in HoareTotalDef.Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule bdy [rule_format])\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma BlockSwap:\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\n using adapt bdy c\n by (rule Block)\n\nlemma BlockSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes bdy: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule HoareTotalDef.DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ R s t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return s t \\ R s t}\" and\n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ A}\" in HoareTotalDef.Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule conseq [OF bdy])\napply clarsimp\napply blast\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma Throw: \"P \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Throw Q,A\"\n by (rule hoaret.Throw [THEN conseqPre])\n\nlemmas Catch = hoaret.Catch\nlemma CatchSwap: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoaret.Catch)\n\nlemma raise: \"P \\ {s. f s \\ A} \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P raise f Q,A\"\n apply (simp add: raise_def)\n apply (rule Seq)\n apply (rule Basic)\n apply (assumption)\n apply (rule Throw)\n apply (rule subset_refl)\n done\n\nlemma condCatch: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A));\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n apply (simp add: condCatch_def)\n apply (rule Catch)\n apply assumption\n apply (rule CondSwap)\n apply (assumption)\n apply (rule hoaret.Throw)\n apply blast\n done\n\nlemma condCatchSwap: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A))\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n by (rule condCatch)\n\n\nlemma ProcSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def)\nby (rule BlockSpec)\n\nlemma ProcSpec':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\n\nlemma ProcSpecNoAbrupt:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall:\n\"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return (\\s t. c (result t))) Q,A\n\\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n by (simp add: fcall_def)\n\nlemma ProcRec:\n assumes deriv_bodies:\n \"\\p\\Procs.\n \\\\ Z. \\,\\\\(\\q\\Procs. \\Z.\n {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z.\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n by (intro strip)\n (rule HoareTotalDef.CallRec'\n [OF _ Procs_defined wf deriv_bodies],\n simp_all)\n\nlemma ProcRec':\n assumes ctxt:\n \"\\'=(\\\\ p. \\\\(\\q\\Procs.\n \\Z. {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)}))\"\n assumes deriv_bodies:\n \"\\p\\Procs.\n \\\\ Z. \\,\\' \\ p\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using ctxt deriv_bodies\n apply simp\n apply (erule ProcRec [OF _ wf Procs_defined])\n done\n\n\nlemma ProcRecList:\n assumes deriv_bodies:\n \"\\p\\set Procs.\n \\\\ Z. \\,\\\\(\\q\\set Procs. \\Z.\n {(P q Z \\ {s. ((s,q), \\,p) \\ r},q,Q q Z,A q Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes wf: \"wf r\"\n assumes dist: \"distinct Procs\"\n assumes Procs_defined: \"set Procs \\ dom \\\"\n shows \"\\p\\set Procs. \\Z.\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using deriv_bodies wf Procs_defined\n by (rule ProcRec)\n\nlemma ProcRecSpecs:\n \"\\\\\\. \\(P,p,Q,A) \\ Specs.\n \\,\\\\ ((\\(P,q,Q,A). (P \\ {s. ((s,q),(\\,p)) \\ r},q,Q,A)) ` Specs)\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A;\n wf r;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\\\\n \\ \\(P,p,Q,A) \\ Specs. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (rule ballI)\napply (case_tac x)\napply (rename_tac x P p Q A)\napply simp\napply (rule hoaret.CallRec)\napply auto\ndone\n\nlemma ProcRec1:\n assumes deriv_body:\n \"\\\\ Z. \\,\\\\(\\Z. {(P Z \\ {s. ((s,p), \\,p) \\ r},p,Q Z,A Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes wf: \"wf r\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n from deriv_body wf p_defined\n have \"\\p\\{p}. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n apply -\n apply (rule ProcRec [where A=\"\\p. A\" and P=\"\\p. P\" and Q=\"\\p. Q\"])\n apply simp_all\n done\n thus ?thesis\n by simp\nqed\n\nlemma ProcNoRec1:\n assumes deriv_body:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n have \"\\\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: conseqPre deriv_body [rule_format])\n with p_defined have \"\\\\ Z. \\,\\\\(\\Z. {(P Z \\ {s. ((s,p), \\,p) \\ {}},\n p,Q Z,A Z)})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: hoaret_augment_context)\n from this\n show ?thesis\n by (rule ProcRec1) (auto simp add: p_defined)\nqed\n\nlemma ProcBody:\n assumes WP: \"P \\ P'\"\n assumes deriv_body: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' body Q,A\"\n assumes body: \"\\ p = Some body\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\Z. P'\" and Q=\"\\Z. Q\" and A=\"\\Z. A\"])\napply (insert body)\napply simp\napply (rule hoaret_augment_context [OF deriv_body])\napply blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\ p = Some body\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\=\\, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoareTotalProps.ProcModifyReturn\nlemmas ProcModifyReturnSameFaults = HoareTotalProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma ProcModifyReturnNoAbrSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P}\"\n and Q'=\"\\Z. Q\" and A'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply (rule CatchSwap)\napply (rule SeqSwap)\napply (rule Throw)\napply (rule subset_refl)\napply (rule Basic)\napply (rule subset_refl)\napply (rule_tac R=\"{i. i \\ P' Z Z'}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply clarsimp\napply simp\napply clarsimp\napply (rule_tac P'=\"\\Z''. {t. t=Z'' \\ return Z t \\ R Z t}\" and\n Q'=\"\\Z''. Q\" and A'=\"\\Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule HoareTotalDef.DynCom)\napply clarsimp\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t \\ Q' s Z. return s t \\ R s t) \\\n (\\t \\ A' s Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n from adapt have \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n by blast\n from this c p show ?thesis\n by (rule DynProc)\nqed\n\nlemma DynProcStaticSpec:\nassumes adapt: \"P \\ {s. s \\ S \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\s\\S. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from adapt have P_S: \"P \\ S\"\n by blast\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ S) (dynCall init p return c) Q,A\"\n apply (rule DynProc [where P'=\"\\s Z. P' Z\" and Q'=\"\\s Z. Q' Z\"\n and A'=\"\\s Z. A' Z\", OF _ c])\n apply clarsimp\n apply (frule in_mono [rule_format, OF adapt])\n apply clarsimp\n using spec\n apply clarsimp\n done\n thus ?thesis\n by (rule conseqPre) (insert P_S,blast)\nqed\n\n\n\nlemma DynProcProcPar:\nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n using spec\n apply simp\n done\n\n\nlemma DynProcProcParNoAbrupt:\nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\))}\"\nassumes c: \"\\s t. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n have \"P \\ {s. p s = q \\ (\\ Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ {} \\ return s t \\ A))}\"\n (is \"P \\ ?P'\")\n proof\n fix s\n assume P: \"s\\P\"\n with adapt obtain Z where\n Pre: \"p s = q \\ init s \\ P' Z\" and\n adapt_Norm: \"\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\\"\n by blast\n from adapt_Norm\n have \"\\t. t \\ Q' Z \\ return s t \\ R s t\"\n by auto\n then\n show \"s\\?P'\"\n using Pre by blast\n qed\n note P = this\n show ?thesis\n apply -\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n apply (insert spec)\n apply auto\n done\nqed\n\nlemma DynProcModifyReturnNoAbr:\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {}\n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturn)\nqed\n\nlemma ProcDynModifyReturnNoAbrSameFaults:\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {}\n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturnSameFaults)\nqed\n\nlemma ProcProcParModifyReturn:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in\n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n ret_abr_modif\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturn) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\n\n\nlemma ProcProcParModifyReturnSameFaults:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in\n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call q (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n ret_abr_modif\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\nlemma ProcProcParModifyReturnNoAbr:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as\n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\n\nlemma ProcProcParModifyReturnNoAbrSameFaults:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as\n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\nlemma MergeGuards_iff: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip':\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n from deriv_strip_triv have deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n by (auto intro: hoare_augment_context)\n from deriv_strip [simplified c'']\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n by (rule HoarePartialProps.MarkGuardsD)\n with deriv\n have \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n by (rule CombineStrip)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n by (rule MarkGuardsI)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n by (rule MergeGuardsI)\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n by (simp add: c)\n thus ?thesis\n by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'':\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c])\n apply (insert c'')\n apply (subgoal_tac \"- {True} = {False}\")\n apply auto\n done\n\nlemma AsmUN:\n \"(\\Z. {(P Z, p, Q Z,A Z)}) \\ \\\n \\\n \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n by (blast intro: hoaret.Asm)\n\n\nlemma hoaret_to_hoarep':\n \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z) \\ \\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: total_to_partial)\n\nlemma augment_context':\n \"\\\\ \\ \\'; \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\\n \\ \\Z. \\,\\'\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoaret_augment_context)\n\n\nlemma augment_emptyFaults:\n \"\\\\Z. \\,{}\\\\<^sub>t\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\ \\\n \\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \\\n \\Z. \\,{}\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI)\n\nlemma PostConjI' :\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]:\n assumes conj: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n assumes E: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\\ \\ S\"\n shows \"S\"\nproof -\n from conj have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n moreover\n from conj have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n ultimately show \"S\"\n by (rule E)\nqed\n\nsubsubsection \\Rules for Single-Step Proof \\label{sec:hoare-isar}\\\n\ntext \\\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar.\n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates. Reversed order is supported as well.\n\\\n\n\nlemma annotateI [trans]:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P anno Q,A; c = anno\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp)\n\nlemma annotate_normI:\n assumes deriv_anno: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>P anno Q,A\"\n assumes norm_eq: \"normalize c = normalize anno\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n from HoareTotalProps.NormalizeI [OF deriv_anno] norm_eq\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n by simp\n from NormalizeD [OF this]\n show ?thesis .\nqed\n\n\nlemma annotateWhile:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\ P \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A\"\n by (rule conseqPre)\n\nlemma [trans]: \"Q \\ Q' \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A\"\n by (rule conseqPost) blast+\n\nlemma [trans]:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ (\\s. P' s \\ P s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"(\\s. P' s \\ P s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q s},A \\ (\\s. Q s \\ Q' s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [trans]:\n \"(\\s. Q s \\ Q' s) \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q s},A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [intro?]: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond) auto\n\nlemma CondConj [trans, intro?]:\n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s \\ b s} c1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s \\ \\ b s} c2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n by (rule Cond) auto\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/HoareTotal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2811286290958731}} {"text": "section \\ CSP Operators \\\n\ntheory ITree_CSP\n imports \"Interaction_Trees.ITrees\" \"Optics.Optics\"\nbegin\n\nsubsection \\ Event Trace and Set Syntax\\\n\ndefinition evinsert :: \"'e \\ 'e set \\ 'e set\" where\n[code_unfold]: \"evinsert e E = insert e E\"\n\ndefinition evsimple :: \"(unit \\\\<^sub>\\ 'e) \\ 'e\" where\n[code_unfold]: \"evsimple c = build\\<^bsub>c\\<^esub> ()\"\n\ndefinition evparam :: \"('a \\\\<^sub>\\ 'e) \\ 'a \\ 'e\" where\n[code_unfold]: \"evparam c v = build\\<^bsub>c\\<^esub> v\"\n\ndefinition evcollect :: \"('a \\\\<^sub>\\ 'e) \\ 'a set \\ ('a \\ bool) \\ 'e set\" where\n[code_unfold]: \"evcollect c A P = {build\\<^bsub>c\\<^esub> v | v. v \\ A \\ P v}\"\n\ndefinition empty_evset (\"\\\\\") where [code_unfold]: \"\\\\ = {}\"\n\nnonterminal evt and evts\n\nsyntax \n \"_evt\" :: \"evt \\ evts\" (\"_\")\n \"_evts\" :: \"evt \\ evts \\ evts\" (\"_,/ _\")\n \"_evt_id\" :: \"id \\ evt\" (\"_\")\n \"_evt_param\" :: \"id \\ logic \\ evt\" (\"_/ _\")\n \"_evt_set\" :: \"evts \\ logic\" (\"\\_\\\")\n \"_evt_collect\" :: \"id \\ pttrn \\ logic \\ logic \\ logic\" (\"\\_/ _ \\ _./ _\\\")\n \"_evt_collect_ns\" :: \"id \\ pttrn \\ logic \\ logic\" (\"\\_/ _./ _\\\")\n \"_evt_trace\" :: \"evts \\ logic\" (\"\\_\\\")\n\ntranslations \n \"_evt e\" => \"CONST evinsert e \\\\\"\n \"_evts e es\" => \"CONST evinsert e es\"\n \"_evt_id x\" == \"CONST evsimple x\"\n \"_evt_param x v\" == \"CONST evparam x v\"\n \"_evt_set A\" => \"A\"\n \"_evt_collect e x A P\" == \"CONST evcollect e A (\\ x. P)\"\n \"_evt_collect_ns e x P\" == \"_evt_collect e x (CONST UNIV) P\"\n \"\\e\\\" <= \"CONST evinsert e \\\\\"\n \"\\e, es\\\" <= \"CONST evinsert e (_evt_set es)\"\n \"_evt_trace (_evt e)\" => \"[e]\"\n \"_evt_trace (_evts e tr)\" => \"e # _evt_trace tr\"\n\nsubsection \\ Basic Constructs \\\n\ndefinition skip :: \"('e, unit) itree\" where\n\"skip = Ret ()\"\n\nabbreviation inp_in_where_choice :: \"('a \\\\<^sub>\\ 'e) \\ 'a set \\ ('a \\ bool) \\ _\" where\n \"inp_in_where_choice c A P \\ (\\ e \\ build\\<^bsub>c\\<^esub> ` A | P (the (match\\<^bsub>c\\<^esub> e)) \\ \\ (the (match\\<^bsub>c\\<^esub> e)))\"\n\ndefinition inp_in_where :: \"('a \\\\<^sub>\\ 'e) \\ 'a set \\ ('a \\ bool) \\ ('e, 'a) itree\" where\n\"inp_in_where c A P = Vis (inp_in_where_choice c A P)\"\n\nabbreviation \"inp_in c A \\ inp_in_where c A (\\ s. True)\"\n\nabbreviation \"inp_where c P \\ inp_in_where c UNIV P\"\n\nlemma retvals_inp_in_where: \"wb_prism c \\ \\<^bold>R(inp_in_where c A P) = {x \\ A. P x}\"\n by (auto simp add: inp_in_where_def)\n (metis image_insert insertCI insert_Diff option.sel retvals_Ret wb_prism.match_build)\n\nlemma retvals_inp_in: \"wb_prism c \\ \\<^bold>R(inp_in c A) = A\"\n by (simp add: retvals_inp_in_where)\n\nlemma div_free_inp_in: \"div_free (inp_in c A)\"\n by (auto simp add: inp_in_where_def div_free_Vis)\n\nabbreviation inp :: \"('a \\\\<^sub>\\ 'e)\\ ('e, 'a) itree\" where\n\"inp c \\ inp_in c UNIV\"\n\ndefinition inp_list :: \"('a \\\\<^sub>\\ 'e) \\ 'a list \\ ('e, 'a) itree\" where\n\"inp_list c B = Vis (pfun_of_alist (map (\\x. (build\\<^bsub>c\\<^esub> x, \\ (the (match\\<^bsub>c\\<^esub> (build\\<^bsub>c\\<^esub> x))))) (filter (\\x. build\\<^bsub>c\\<^esub> x \\ dom match\\<^bsub>c\\<^esub> ) B)))\"\n\ndefinition inp_list_where :: \"('a \\\\<^sub>\\ 'e) \\ 'a list \\ ('a \\ bool) \\ ('e, 'a) itree\" where\n\"inp_list_where c B P = Vis (pfun_of_alist (map (\\x. (build\\<^bsub>c\\<^esub> x, \\ x)) (filter P B)))\"\n\ndefinition inp_map_in_where :: \"('a \\\\<^sub>\\ 'e) \\ 'a set \\ ('a \\ bool) \\ ('e, 'a) itree\" where\n\"inp_map_in_where c B P = Vis (pfun_of_map (\\ e. case match\\<^bsub>c\\<^esub> e of \n Some v \\ if (v \\ B \\ P v) then Some (Ret v) else None | \n None \\ None))\"\n\ndefinition inp_map :: \"('a \\\\<^sub>\\ 'e)\\ ('e, 'a) itree\" where\n\"inp_map c = Vis (pfun_of_map (\\ e. case match\\<^bsub>c\\<^esub> e of Some v \\ Some (Ret v) | None \\ None))\"\n\nlemma inp_in_where_map_code [code_unfold]:\n \"wb_prism c \\ inp_in_where c A P = inp_map_in_where c A P\"\n apply (auto simp add: inp_in_where_def inp_map_in_where_def fun_eq_iff pfun_eq_iff domI pdom.abs_eq option.case_eq_if)\n apply (metis (no_types, opaque_lifting) imageI option.distinct(1) option.exhaust_sel wb_prism_def)\n done\n\nlemma inp_in_where_list_code [code_unfold]:\n \"wb_prism c \\ inp_in_where c (set xs) P = inp_list_where c xs P\"\n unfolding inp_in_where_def inp_list_where_def\n by (simp only: set_map [THEN sym] inter_set_filter pabs_set filter_map comp_def, simp add: comp_def)\n\nlemma inp_map_in_where_list_code [code_unfold]:\n \"wb_prism c \\ inp_map_in_where c (set xs) P = inp_list_where c xs P\"\n by (metis inp_in_where_list_code inp_in_where_map_code)\n\n(*\nlemma inp_where_code [code_unfold]:\n \"wb_prism c \\inp_where c P = Vis (pfun_of_map (\\ e. case match\\<^bsub>c\\<^esub> e of Some v \\ if (P v) then Some (Ret v) else None | None \\ None))\"\n apply (auto simp add: inp_in_where_def fun_eq_iff pfun_eq_iff domI pdom.abs_eq option.case_eq_if)\n apply (metis domIff option.simps(3) wb_prism.range_build)\n apply (meson option.distinct(1) option.exhaust_sel)\n*)\n\nlemma build_in_dom_match [simp]: \"wb_prism c \\ build\\<^bsub>c\\<^esub> x \\ dom match\\<^bsub>c\\<^esub>\"\n by (simp add: dom_def)\n\ntext \\ Is there a way to use this optimise the above definition when applied to a well-behaved prism? \\\n\nlemma inp_list_wb_prism: \"wb_prism c \\ inp_list c B = Vis (pfun_of_alist (map (\\x. (build\\<^bsub>c\\<^esub> x, \\ x)) B))\"\n by (simp add: inp_list_def)\n\nlemma inp_where_enum [code_unfold]:\n assumes \"wb_prism c\"\n shows \"inp_where c P = inp_list_where c enum_class.enum P\"\nproof -\n have \"inp_where c P = inp_in_where c (set enum_class.enum) P\"\n by (simp add: enum_class.UNIV_enum)\n also have \"... = inp_list_where c enum_class.enum P\"\n by (simp add: assms inp_in_where_list_code)\n finally show ?thesis .\nqed\n\nlemma inp_map_where_enum [code_unfold]:\n assumes \"wb_prism c\"\n shows \"inp_map_in_where c UNIV P = inp_list_where c enum_class.enum P\"\n using inp_where_enum[of c P] by (simp add: inp_in_where_map_code assms)\n\n(*\nlemma inp_alist [code]:\n \"inp_in c (set B) = inp_list c B\"\n unfolding inp_in_where_def inp_list_def\n by (simp only: set_map[THEN sym] inter_set_filter pabs_set filter_map comp_def, simp add: comp_def)\n\nlemma inp_enum [code_unfold]:\n \"wb_prism c \\ inp c = inp_list c enum_class.enum\"\n apply (simp add: inp_list_def inp_in_where_def wb_prism.range_build[THEN sym] enum_class.UNIV_enum)\n apply (simp only: image_set pabs_set)\n apply (simp add: comp_def)\n done\n\nlemma inp_in_coset [code_unfold]: \n \"wb_prism c \\ inp_in c (List.coset []) = Vis (pfun_of_map (\\ e. case match\\<^bsub>c\\<^esub> e of Some v \\ Some (Ret v) | None \\ None))\"\n by (auto simp add: inp_in_def pabs_def pfun_entries_def pdom_res_def pfun_of_map_inject restrict_map_def fun_eq_iff domIff wb_prism.range_build)\n*)\n\ndefinition outp :: \"('a \\\\<^sub>\\ 'e) \\ 'a \\ ('e, unit) itree\" where\n\"outp c v = Vis (pfun_of_alist [(build\\<^bsub>c\\<^esub> v, Ret())])\"\n\ndefinition sync :: \"(unit \\\\<^sub>\\ 'e) \\ ('e, unit) itree\" where\n\"sync c = Vis (pfun_of_alist [(build\\<^bsub>c\\<^esub> (), Ret())])\"\n\ndefinition guard :: \"bool \\ ('e, unit) itree\" where\n\"guard b = (if b then Ret () else deadlock)\"\n\nsubsection \\ Generalised Choice \\\n\ntext \\ Generalised choice is parametric over a function to merge the choice functions. \\\n\nprimcorec \n genchoice :: \"(('e \\ ('e, 'a) itree) \\ ('e \\ ('e, 'a) itree) \\ 'e \\ ('e, 'a) itree) \n \\ ('e, 'a) itree \\ ('e, 'a) itree \\ ('e, 'a) itree\" where\n\"genchoice \\ P Q =\n (case (P, Q) of \n (Vis F, Vis G) \\ Vis (\\ F G) |\n (Sil P', _) \\ Sil (genchoice \\ P' Q) | \\ \\ Maximal progress \\\n (_, Sil Q') \\ Sil (genchoice \\ P Q') |\n \\ \\ cf. Butterfield's external choice miraculous issue and a quantum-like computation with reconciliation \\\n (Ret x, Ret y) \\ if (x = y) then Ret x else Vis {}\\<^sub>p |\n (Ret v, Vis _) \\ Ret v | \\ \\ Is this like sliding choice? \\\n (Vis _, Ret v) \\ Ret v\n )\"\n\nlemma genchoice_Vis_Vis [simp]: \"genchoice \\ (Vis F) (Vis G) = Vis (\\ F G)\"\n by (simp add: genchoice.code)\n\nlemma genchoice_diverge: \"genchoice \\ diverge P = diverge\"\n by (coinduction arbitrary: P, auto elim!: stableE is_RetE is_VisE unstableE, metis diverge.code itree.simps(11))\n\nlemma is_Sil_genchoice: \"is_Sil (genchoice \\ P Q) = (is_Sil P \\ is_Sil Q)\"\n using itree.exhaust_disc by (auto)\n\nlemma genchoice_Vis_iff: \n \"genchoice \\ P Q = Vis H \\ ((\\ F G. P = Vis F \\ Q = Vis G \\ H = (\\ F G)) \\ (\\ x y. P = Ret x \\ Q = Ret y \\ x \\ y \\ H = {}\\<^sub>p))\"\n (is \"?lhs = ?rhs\")\nproof\n assume a: ?lhs\n hence is_Vis: \"is_Vis (genchoice \\ P Q)\"\n by simp\n thus ?rhs\n apply (auto elim!: is_RetE is_VisE)\n using a\n apply (simp_all add: a genchoice.code)\n done\nnext\n assume ?rhs\n thus ?lhs\n by (auto simp add: genchoice.code)\nqed\n\nlemma genchoice_VisE [elim]:\n assumes \"Vis H = genchoice \\ P Q\"\n \"\\ F G. \\ P = Vis F; Q = Vis G; H = (\\ F G) \\ \\ R\"\n \"\\ x y. \\ P = Ret x; Q = Ret y; x \\ y; H = {}\\<^sub>p \\ \\ R\"\n shows R\n by (metis assms(1) assms(2) assms(3) genchoice_Vis_iff)\n\nlemma genchoice_Sils: \"genchoice \\ (Sils m P) Q = Sils m (genchoice \\ P Q)\"\n by (induct m, simp_all add: genchoice.code)\n\nlemma genchoice_Sil_stable: \"stable P \\ genchoice \\ P (Sil Q) = Sil (genchoice \\ P Q)\"\n by (cases P, simp_all add: genchoice.code)\n\nlemma genchoice_Sils_stable: \"stable P \\ genchoice \\ P (Sils m Q) = Sils m (genchoice \\ P Q)\"\n by (induct m, simp_all add: genchoice_Sil_stable)\n\nlemma genchoice_Sils': \"genchoice \\ P (Sils m Q) = Sils m (genchoice \\ P Q)\"\nproof (cases \"divergent P\")\n case True\n then show ?thesis\n by (metis Sils_diverge genchoice_diverge diverges_then_diverge) \nnext\n case False\n then obtain n P' where \"Sils n P' = P\" \"stable P'\"\n using stabilises_def by blast\n then show ?thesis\n by (metis Sils_Sils add.commute genchoice_Sils genchoice_Sils_stable)\nqed\n\nlemma genchoice_deadlock_left [simp]: \n assumes \"\\ F. \\ {}\\<^sub>p F = F\"\n shows \"genchoice \\ deadlock P = P\"\nproof (coinduction arbitrary: P rule: itree_strong_coind)\n case wform\nthen show ?case\n by (simp add: deadlock_def) \nnext\n case (Ret x y)\n then show ?case\n by (metis (no_types, lifting) deadlock_def genchoice.ctr(1) itree.collapse(1) itree.disc(9) itree.discI(1) itree.inject(1) itree.simps(12) prod.sel(1) prod.sel(2)) \nnext\n case (Sil P' Q' P)\n then show ?case\n by (metis genchoice_Sil_stable itree.inject(2) stable_deadlock)\nnext\n case Vis\n then show ?case\n by (metis assms deadlock_def genchoice_Vis_Vis itree.inject(3)) \nqed\n\nlemma genchoice_deadlock_right [simp]: \n assumes \"\\ F. \\ F {}\\<^sub>p = F\"\n shows \"genchoice \\ P deadlock = P\"\nproof (coinduction arbitrary: P rule: itree_strong_coind)\n case wform\n then show ?case\n by (simp add: deadlock_def) \nnext\n case Ret\n then show ?case\n by (metis (no_types, lifting) deadlock_def genchoice.ctr(1) itree.case_eq_if itree.collapse(1) itree.disc(9) itree.discI(1) itree.inject(1) itree.simps(12) prod.sel(1) prod.sel(2)) \nnext\n case Sil\n then show ?case\n by (metis genchoice.sel(2) itree.case(2) itree.disc(5) itree.sel(2) prod.sel(1))\nnext\n case Vis\n then show ?case\n by (metis assms deadlock_def genchoice_Vis_Vis itree.inject(3))\nqed\n\nlemma genchoice_Sil': \"genchoice \\ P (Sil Q) = genchoice \\ (Sil P) Q\"\nproof (coinduction arbitrary: P Q rule: itree_strong_coind)\ncase wform\n then show ?case\n by (meson is_Sil_genchoice itree.disc(2) itree.disc(8) itree.distinct_disc(1) itree.distinct_disc(6) itree.exhaust_disc)\nnext\n case Ret\n then show ?case\n by (metis is_Sil_genchoice itree.disc(4) itree.disc(5)) \nnext\n case (Sil P Q P' Q')\n then show ?case\n by (metis Sils.simps(1) Sils.simps(2) genchoice_Sils genchoice_Sils' itree.sel(2)) \nnext\n case Vis\n then show ?case\n by (metis is_Sil_genchoice itree.disc(5) itree.disc(6)) \nqed\n\nlemma genchoice_unstable: \"unstable P \\ genchoice \\ P Q = Sil (genchoice \\ (un_Sil P) Q)\"\n by (metis (no_types, lifting) genchoice.ctr(2) itree.case(2) itree.collapse(2) prod.sel(1))\n\nlemma genchoice_unstable': \"unstable Q \\ genchoice \\ P Q = Sil (genchoice \\ P (un_Sil Q))\"\n by (metis genchoice_Sil' genchoice_Sil_stable genchoice_unstable itree.collapse(2))\n\nlemma genchoice_commute:\n fixes P Q :: \"('e, 's) itree\"\n assumes \"\\ F. \\ F {}\\<^sub>p = F\" \"\\ F. \\ {}\\<^sub>p F = F\"\n shows \"genchoice \\ P Q = genchoice (\\ F G. \\ G F) Q P\"\nproof (coinduction arbitrary: P Q rule: itree_coind)\n case wform\n then show ?case\n by (metis genchoice.disc_iff(1) genchoice.disc_iff(3) itree.distinct_disc(1) itree.distinct_disc(6) itree.exhaust_disc prod.sel(1) prod.sel(2))\nnext\n case Ret\n then show ?case\n by (smt genchoice.disc_iff(1) genchoice.simps(3) genchoice.simps(4) itree.case_eq_if itree.disc(7) itree.sel(1) prod.sel(1) snd_conv un_Ret_def)\nnext\n case (Sil P Q P' Q')\n then show ?case\n proof (cases \"unstable P'\")\n case True\n with Sil have \"P = genchoice \\ (un_Sil P') Q'\" \"Q = genchoice (\\ F G. \\ G F) Q' (un_Sil P')\"\n by (simp_all add: genchoice_unstable genchoice_unstable')\n thus ?thesis\n by blast\n next\n case False\n then show ?thesis\n by (metis Sil(1) Sil(2) genchoice_Sil' genchoice_unstable' is_Sil_genchoice itree.disc(5) itree.sel(2) unstableE)\n qed\nnext\n case Vis\n then show ?case\n using assms by (auto elim!: genchoice_VisE, metis genchoice_deadlock_left genchoice_deadlock_right)\nqed\n\nlemma genchoice_commutative:\n fixes P Q :: \"('e, 's) itree\"\n assumes \"\\ F. \\ F {}\\<^sub>p = F\" \"\\ F. \\ {}\\<^sub>p F = F\" \"\\ F G. \\ F G = \\ G F\"\n shows \"genchoice \\ P Q = genchoice \\ Q P\"\n by (subst genchoice_commute, simp_all add: assms)\n\nlemma skip_stable_genchoice_left: \n assumes \"stable P\"\n shows \"genchoice \\ skip P = skip\"\n by (metis (mono_tags, opaque_lifting) assms genchoice.disc_iff(1) is_Ret_def itree.exhaust_disc old.unit.exhaust prod.sel(1) prod.sel(2) skip_def)\n\nlemma skip_stable_genchoice_right:\n assumes \"stable P\"\n shows \"genchoice \\ P skip = skip\"\n by (metis (mono_tags, opaque_lifting) assms genchoice.disc_iff(1) is_Ret_def itree.exhaust_disc old.unit.exhaust prod.sel(1) prod.sel(2) skip_def)\n\nlemma genchoice_RetE [elim]:\n assumes \"genchoice \\ P Q = \\ x\" \n \"\\ P = Ret x; Q = Ret x\\ \\ R\"\n \"\\ P = Ret x; is_Vis Q \\ \\ R\"\n \"\\ Q = Ret x; is_Vis P \\ \\ R\"\n shows R\n using assms apply (cases P)\n apply (auto simp add: genchoice.code)\n apply (smt (z3) assms(1) genchoice.disc_iff(1) is_Sil_genchoice itree.case_eq_if itree.disc(4) itree.discI(1) itree.distinct(3) itree.expand itree.sel(1) snd_conv)\n apply (metis (no_types, lifting) assms(1) is_Sil_genchoice itree.case_eq_if itree.collapse(1) itree.disc(4) itree.disc(7) itree.disc(9))\n done\n\n\nsubsection \\ External Choice \\\n\ndefinition map_prod :: \"('a \\ 'b) \\ ('a \\ 'b) \\ ('a \\ 'b)\" (infixl \"\\\" 100) where\n\"map_prod f g = (pdom(g) \\ f) \\ (pdom(f) \\ g)\"\n\nlemma map_prod_commute: \"x \\ y = y \\ x\"\n apply (auto simp add: fun_eq_iff map_prod_def option.case_eq_if)\n apply (metis Compl_iff IntD1 IntD2 pdom_pdom_res pfun_override_commute_weak)\n done\n\nlemma map_prod_empty [simp]: \"x \\ {}\\<^sub>p = x\" \"{}\\<^sub>p \\ x = x\"\n by (simp_all add: map_prod_def)\n\nlemma map_prod_merge: \n \"f(x \\ v)\\<^sub>p \\ g = \n (if (x \\ pdom(g)) then (f \\ g)(x \\ v)\\<^sub>p else {x} \\ (f \\ g))\"\n by (auto simp add: map_prod_def)\n (metis (no_types, opaque_lifting) Compl_Un insert_absorb insert_is_Un)\n\nlemma map_prod_as_ovrd:\n assumes \"pdom(f) \\ pdom(g) = {}\"\n shows \"f \\ g = f \\ g\"\n by (simp add: map_prod_def assms inf.commute pdom_nres_disjoint)\n\nlemma map_prod_pfun_of_map [code]:\n \"map_prod (pfun_of_map f) (pfun_of_map g) = \n pfun_of_map (\\ x. case (f x, g x) of\n (Some _, Some _) \\ None |\n (Some y, None) \\ Some y |\n (None, Some y) \\ Some y |\n (None, None) \\ None)\"\n by (auto simp add: map_prod_def pdom_def pdom_res_def restrict_map_def oplus_pfun_def map_add_def \n pfun_of_map_inject fun_eq_iff option.case_eq_if)\n\nlemma map_prod_pfun_of_alist [code]:\n \"map_prod (pfun_of_alist xs) (pfun_of_alist ys) =\n pfun_of_alist (AList.restrict (- fst ` set xs) ys @ AList.restrict (- fst ` set ys) xs)\"\n by (simp add: map_prod_def pdom_res_alist plus_pfun_alist)\n\nlemma map_prod_pfun_of_map_alist [code]: \"(pfun_of_map f) \\ (pfun_of_alist xs) \n = pfun_of_map\n (\\x. case f x of None \\ (case map_of xs x of None \\ None | Some x \\ Some x) \n | Some xa \\ (case map_of xs x of None \\ Some xa | Some x \\ Map.empty x))\"\n by (simp add: pfun_of_alist.abs_eq map_prod_pfun_of_map)\n\nlemma map_prod_pfun_of_alist_map [code]: \"(pfun_of_alist xs) \\ (pfun_of_map p)\n = pfun_of_map\n (\\x. case map_of xs x of None \\ (case p x of None \\ None | Some x \\ Some x)\n | Some xa \\ (case p x of None \\ Some xa | Some x \\ Map.empty x))\"\n by (simp add: pfun_of_alist.abs_eq map_prod_pfun_of_map)\n\nlemma map_prod_Nil_alist [code]: \n \"(pfun_of_alist []) \\ P = P\"\n \"P \\ (pfun_of_alist []) = P\"\n by simp_all\n\ntext \\ This is like race-free behaviour \\\n\nclass extchoice = \n fixes extchoice :: \"'a \\ 'a \\ 'a\" (infixl \"\\\" 59)\n\ntext \\ This is an completion of Hoare's bar operator. \\\n\ninstantiation itree :: (type, type) extchoice \nbegin\n\ntext \\ cf. RAISE language \"interlock\" operator -- basic operators of CCS vs. CSP operators. Can\n this be expressed in terms of operators? \\\n\ndefinition extchoice_itree :: \"('e, 'a) itree \\ ('e, 'a) itree \\ ('e, 'a) itree\" where\n\"extchoice_itree = genchoice (\\)\"\n\ninstance ..\n\nend\n\nlemma choice_Vis_Vis [simp]: \"(Vis F) \\ (Vis G) = Vis (F \\ G)\"\n by (simp add: extchoice_itree_def)\n\nlemma choice_diverge: \"diverge \\ P = diverge\"\n by (simp add: extchoice_itree_def genchoice_diverge)\n\nlemma is_Sil_choice: \"is_Sil (P \\ Q) = (is_Sil P \\ is_Sil Q)\"\n by (metis extchoice_itree_def is_Sil_genchoice)\n \nlemma choice_Vis_iff: \n \"P \\ Q = Vis H \\ ((\\ F G. P = Vis F \\ Q = Vis G \\ H = (F \\ G)) \\ (\\ x y. P = Ret x \\ Q = Ret y \\ x \\ y \\ H = {}\\<^sub>p))\"\n by (simp add: extchoice_itree_def genchoice_Vis_iff)\n \nlemma choice_VisE [elim]:\n assumes \"Vis H = P \\ Q\"\n \"\\ F G. \\ P = Vis F; Q = Vis G; H = (F \\ G) \\ \\ R\"\n \"\\ x y. \\ P = Ret x; Q = Ret y; x \\ y; H = {}\\<^sub>p \\ \\ R\"\n shows R\n by (metis assms(1) assms(2) assms(3) choice_Vis_iff)\n\nlemma choice_Sils: \"(Sils m P) \\ Q = Sils m (P \\ Q)\"\n by (simp add: extchoice_itree_def genchoice_Sils)\n\nlemma choice_Sil_stable: \"stable P \\ P \\ (Sil Q) = Sil (P \\ Q)\"\n by (simp add: extchoice_itree_def genchoice_Sil_stable)\n\nlemma choice_Sils_stable: \"stable P \\ P \\ (Sils m Q) = Sils m (P \\ Q)\"\n by (simp add: extchoice_itree_def genchoice_Sils_stable)\n\nlemma choice_Sils': \"P \\ (Sils m Q) = Sils m (P \\ Q)\"\n by (simp add: extchoice_itree_def genchoice_Sils')\n\ntext \\ External Choice test cases \\\n\nlemma \"X \\ Y \\ (Vis {X \\ Ret a}\\<^sub>p) \\ (Vis {Y \\ Ret b}\\<^sub>p) = \n Vis {X \\ Ret a, Y \\ Ret b}\\<^sub>p\"\n by (auto simp add: genchoice.code map_prod_merge pfun_upd_comm)\n\nlemma \"(Vis {X \\ Ret a}\\<^sub>p) \\ (Vis {X \\ Ret b}\\<^sub>p) = \n deadlock\"\n by (simp add: deadlock_def map_prod_merge)\n\nlemma \"X \\ Y \\ (Sil (Vis {X \\ Ret a}\\<^sub>p)) \\ (Sil (Vis {Y \\ Ret b}\\<^sub>p)) = \n Sil (Sil (Vis {X \\ Ret a, Y \\ Ret b}\\<^sub>p))\"\n by (simp add: genchoice.code extchoice_itree_def map_prod_merge pfun_upd_comm)\n\ntext \\ This requires weak bisimulation \\\n\nlemma \"\\ P. (X = (P :: ('e, 's) itree) \\ P \\ Y = P) \\ (X = Y) \\ X = Y\"\n apply (coinduction arbitrary: X Y)\n apply (auto simp add: itree.case_eq_if itree.distinct_disc(1))\n oops\n\nlemma choice_deadlock [simp]: \"deadlock \\ P = P\"\n by (simp add: extchoice_itree_def)\n\nlemma choice_deadlock' [simp]: \"P \\ deadlock = P\"\n by (simp add: extchoice_itree_def)\n\nlemma choice_unstable: \"unstable P \\ P \\ Q = Sil ((un_Sil P) \\ Q)\"\n by (simp add: extchoice_itree_def genchoice_unstable)\n\nlemma choice_unstable': \"unstable Q \\ P \\ Q = Sil (P \\ (un_Sil Q))\"\n by (simp add: extchoice_itree_def genchoice_unstable')\n\nlemma choice_commutative:\n fixes P Q :: \"('e, 's) itree\"\n shows \"P \\ Q = Q \\ P\"\n by (simp add: extchoice_itree_def genchoice_commutative map_prod_commute)\n\ntext \\ External choice is commutative, but currently not associative. This is because when we\n have two competing return values, external choice deadlocks. However, since a return takes \n priority over a visible event, that means the order in which deadlocks are produced and \n returns occur is significant. Perhaps competing returns should lead to a divergence, which\n would then take priority over a return. \\\n\nlemma skip_stable_choice: \n assumes \"stable P\"\n shows \"skip \\ P = skip\"\n by (simp add: assms extchoice_itree_def skip_stable_genchoice_left)\n\nlemma choice_RetE [elim]:\n assumes \"P \\ Q = \\ x\" \n \"\\ P = Ret x; Q = Ret x\\ \\ R\"\n \"\\ P = Ret x; is_Vis Q \\ \\ R\"\n \"\\ Q = Ret x; is_Vis P \\ \\ R\"\n shows R\n by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) extchoice_itree_def genchoice_RetE)\n\nlemma extchoice_Vis_bind:\n \"(Vis F \\ Vis G) \\ R = (Vis F \\ R) \\ (Vis G \\ R)\"\n by (simp add: map_prod_def)\n\nlemma \n assumes \"is_Vis P\" \"is_Vis Q\" \"\\<^bold>I(P) \\ \\<^bold>I(Q) = {}\"\n shows \"\\<^bold>R(P \\ Q) = \\<^bold>R(P) \\ \\<^bold>R(Q)\"\nproof -\n obtain F G where P: \"P = Vis F\" and Q: \"Q = Vis G\"\n by (meson assms(1) assms(2) is_VisE)\n hence \"pdom(F) \\ pdom(G) = {}\"\n using assms(3) by force\n thus ?thesis\n by (simp add: P Q map_prod_as_ovrd Un_commute pdom_nres_disjoint)\nqed\n\nlemma trace_to_Nil_extchoice: \"P \\[]\\ P' \\ P \\ Q \\[]\\ P' \\ Q\"\n using choice_Sils trace_to_Nil_iff by blast\n\nlemma choice_Ret_Ret: \"\\ x \\ \\ y = (if x = y then \\ x else deadlock)\"\n by (auto simp add: extchoice_itree_def genchoice.ctr(1) deadlock_def genchoice_Vis_iff)\n\nlemma choice_Ret_Vis: \"\\ x \\ Vis G = \\ x\"\n by (simp add: extchoice_itree_def genchoice.ctr(1))\n\nlemma pran_map_prod: \"pran (F \\ G) \\ pran F \\ pran G\"\n by (auto simp add: map_prod_def)\n (metis Un_iff pfun_split_domain pran_override)+\n\nlemma stabilises_retvals_extchoice:\n assumes \"stabilises P\" \"stabilises Q\"\n shows \"\\<^bold>R(P \\ Q) \\ \\<^bold>R(P) \\ \\<^bold>R(Q)\"\nproof -\n obtain m n P' Q' where PQ: \"P = Sils m P'\" \"stable P'\" \"Q = Sils n Q'\" \"stable Q'\"\n by (metis assms(1) assms(2) stabilises_def)\n show ?thesis\n proof (cases \"P'\")\n case (Ret x)\n note Ret_P' = this\n then show ?thesis\n proof (cases Q')\n case (Ret y)\n with Ret_P' PQ show ?thesis\n by (simp add: choice_Sils choice_Sils' choice_Ret_Ret)\n next\n case (Sil _)\n then show ?thesis\n using PQ(4) by auto\n next\n case (Vis G)\n with Ret_P' PQ show ?thesis\n by (simp add: choice_Sils choice_Sils')\n (metis choice_Ret_Vis insertCI retvals_Ret singletonD subsetI)\n qed\n next\n case (Sil _)\n then show ?thesis\n using PQ(2) by auto\n next\n case (Vis F)\n note Vis_P' = this\n then show ?thesis\n proof (cases Q')\n case (Ret y)\n then show ?thesis\n by (metis PQ(1) PQ(3) Vis_P' choice_Ret_Vis choice_commutative extchoice_itree_def genchoice_Sils' le_supI2 retvals_Sils set_eq_subset)\n next\n case (Sil _)\n then show ?thesis\n using PQ(4) by auto\n next\n case (Vis G)\n with Vis_P' PQ show ?thesis\n by (auto simp add: choice_Sils choice_Sils')\n (meson Un_iff in_mono pran_map_prod)\n qed\n qed\nqed\n\nlemma retvals_extchoice: \"\\<^bold>R(P \\ Q) \\ \\<^bold>R(P) \\ \\<^bold>R(Q)\"\n by (metis Un_upper1 choice_commutative choice_diverge diverges_then_diverge le_supE retvals_diverge stabilises_retvals_extchoice sup_bot.right_neutral)\n\nsubsection \\ Generalised Parallel Composition \\\n\ntext \\ This parallel composition operator follows a similar approach to the UTP \"parallel-by-merge\" scheme. \\\n\ndatatype (discs_sels) ('a, 'b) andor = Left 'a | Right 'b | Both \"'a \\ 'b\"\n\ntype_synonym ('e, 'a, 'b) pmerge = \n \"(('e \\ ('e, 'a) itree) \\ 'e set \\ ('e \\ ('e, 'b) itree) \\ 'e \\ (('e, 'a) itree, ('e, 'b) itree) andor)\"\n\nprimcorec genpar :: \"('e, 'a, 'b) pmerge \\ ('e, 'a) itree \\ 'e set \\ ('e, 'b) itree \\ ('e, 'a \\ 'b) itree\" where\n\"genpar \\ P A Q =\n (case (P, Q) of \n \\ \\ Silent events happen independently and have priority \\\n (Sil P', _) \\ Sil (genpar \\ P' A Q) |\n (_, Sil Q') \\ Sil (genpar \\ P A Q') |\n \\ \\ Visible events are subject to synchronisation constraints \\\n (Vis F, Vis G) \\\n Vis (map_pfun \n (\\x. case x of \n Left P' \\ genpar \\ P' A Q \\ \\ Left side acts independently \\\n | Right Q' \\ genpar \\ P A Q' \\ \\ Right side acts independently \\ \n | Both (P', Q') \\ genpar \\ P' A Q') \\ \\ Both sides synchronise \\\n (\\ F A G)) |\n \\ \\ If both sides terminate, then they must agree on the returned value. This could be\n generalised using a merge function. \\\n (Ret x, Ret y) \\ Ret (x, y) |\n \\ \\ A termination occurring on one side is pushed forward. Only events not requiring\n synchronisation can occur on the other side. \\\n (Ret v, Vis G) \\ Vis (map_pfun (\\ P. (genpar \\ (Ret v) A P)) (A \\ G)) |\n (Vis F, Ret v) \\ Vis (map_pfun (\\ P. (genpar \\ P A (Ret v))) (A \\ F))\n )\" \n\nlemma genpar_Sil_left [simp]:\n \"genpar \\ (Sil P') E Q = Sil (genpar \\ P' E Q)\"\n by (simp add: genpar.code)\n\nlemma genpar_Sil_stable_right:\n \"stable P \\ genpar \\ P E (Sil Q') = Sil (genpar \\ P E Q')\"\n by (auto elim!: stableE simp add: genpar.code)\n\nlemma unstable_genpar [simp]: \"unstable (genpar \\ P E Q) = (unstable P \\ unstable Q)\"\n by (auto elim!: stableE)\n\nlemma genpar_Ret_iff: \"Ret x = genpar \\ P E Q \\ (\\ a b. P = Ret a \\ Q = Ret b \\ x = (a, b))\"\n (is \"?lhs \\ ?rhs\")\nproof\n assume a:?lhs\n hence \"is_Ret (genpar \\ P E Q)\"\n by (metis itree.disc(1))\n then obtain a b where \"P = Ret a\" \"Q = Ret b\"\n by force\n with a show ?rhs\n by (simp add: genpar.code)\nnext\n show \"?rhs \\ ?lhs\"\n by (auto simp add: genpar.code)\nqed\n\nlemma genpar_Sil_iff: \"Sil R = genpar \\ P E Q \\ ((\\ P'. P = Sil P' \\ R = genpar \\ P' E Q) \\ (\\ Q'. stable P \\ Q = Sil Q' \\ R = genpar \\ P E Q'))\"\n (is \"?lhs \\ ?rhs\")\nproof\n assume a:?lhs\n hence sil: \"is_Sil (genpar \\ P E Q)\"\n by (metis (no_types, opaque_lifting) itree.disc(5))\n show ?rhs\n proof (cases \"unstable P\")\n case True\n with a show ?thesis\n by (auto elim!: unstableE simp add: genpar.code)\n next\n case False\n hence \"unstable Q\"\n by (metis sil unstable_genpar)\n with a False show ?thesis by (auto simp add: genpar_Sil_stable_right elim!: unstableE)\n qed\nnext\n show \"?rhs \\ ?lhs\"\n by (auto simp add: genpar_Sil_stable_right)\nqed\n \nlemma genpar_SilE [elim!]:\n assumes \"Sil R = genpar \\ P E Q\"\n \"\\ P'. \\ P = Sil P'; R = genpar \\ P' E Q \\ \\ S\"\n \"\\ Q'. \\ stable P; Q = Sil Q'; R = genpar \\ P E Q' \\ \\ S\"\n shows S\n by (metis (full_types) assms(1) assms(2) assms(3) genpar_Sil_iff)\n\nlemma genpar_Sil_shift [simp]: \"genpar \\ P E (Sil Q) = genpar \\ (Sil P) E Q\"\n by (coinduction arbitrary: P Q rule: itree_strong_coind, auto elim!: stableE, metis)\n\nlemma genpar_Sils_left [simp]: \"genpar \\ (Sils n P) E Q = Sils n (genpar \\ P E Q)\"\n by (induct n, simp_all)\n\nlemma genpar_Sils_right [simp]: \"genpar \\ P E (Sils n Q) = Sils n (genpar \\ P E Q)\"\n by (induct n, simp_all)\n\nlemma genpar_Ret_Ret [simp]:\n \"genpar \\ (Ret x) E (Ret y) = Ret (x, y)\"\n by (simp add: genpar.code)\n\ndefinition \"pmerge_Vis \\ F A G \\ \n map_pfun \n (\\x. case x of \n Left P' \\ genpar \\ P' A (Vis G) \\ \\ Left side acts independently \\\n | Right Q' \\ genpar \\ (Vis F) A Q' \\ \\ Right side acts independently \\ \n | Both (P', Q') \\ genpar \\ P' A Q') \\ \\ Both sides synchronise \\\n (\\ F A G)\"\n\nlemma pdom_pmerge_Vis [simp]: \"pdom (pmerge_Vis \\ F A G) = pdom (\\ F A G)\"\n by (simp add: pmerge_Vis_def)\n\nlemma genpar_Vis_Vis [simp]:\n \"genpar \\ (Vis F) E (Vis G) = Vis (pmerge_Vis \\ F E G)\"\n by (auto simp add: genpar.code pmerge_Vis_def)\n\nlemma genpar_Ret_Vis [simp]:\n \"genpar \\ (Ret v) A (Vis G) = Vis (map_pfun (\\ P. (genpar \\ (Ret v) A P)) (A \\ G))\"\n by (subst genpar.code, simp)\n\nlemma genpar_Vis_Ret [simp]:\n \"genpar \\ (Vis F) A (Ret v) = Vis (map_pfun (\\ P. (genpar \\ P A (Ret v))) (A \\ F))\"\n by (subst genpar.code, simp)\n\nlemma genpar_Vis_iff: \n \"Vis H = genpar \\ P E Q \\ ((\\ F G. P = Vis F \\ Q = Vis G \\ H = pmerge_Vis \\ F E G) \n \\ (\\ x G. P = Ret x \\ Q = Vis G \\ H = map_pfun (\\ P. (genpar \\ (Ret x) E P)) (E \\ G))\n \\ (\\ x F. P = Vis F \\ Q = Ret x \\ H = map_pfun (\\ P. (genpar \\ P E (Ret x))) (E \\ F)))\"\n (is \"?lhs \\ ?rhs\")\nproof\n assume a: \"?lhs\"\n hence \"is_Vis (genpar \\ P E Q)\"\n by (metis itree.disc(9))\n thus ?rhs\n apply (auto elim!: is_RetE is_VisE)\n using a apply (simp_all)\n done\nnext\n show \"?rhs \\ ?lhs\" by (auto)\nqed\n\nlemma genpar_VisE [elim!]:\n assumes \"Vis H = genpar \\ P E Q\"\n \"\\ F G. \\ P = Vis F; Q = Vis G; H = pmerge_Vis \\ F E G \\ \\ R\"\n \"\\ x G. \\ P = Ret x; Q = Vis G; H = map_pfun (\\ P. (genpar \\ (Ret x) E P)) (E \\ G) \\ \\ R\"\n \"\\ x F. \\ P = Vis F; Q = Ret x; H = map_pfun (\\ P. (genpar \\ P E (Ret x))) (E \\ F) \\ \\ R\"\n shows R\n using assms by (auto simp add: genpar_Vis_iff)\n\nlemma genpar_diverge: \"genpar \\ diverge E P = diverge\"\nproof (coinduction arbitrary: P rule: itree_coind)\ncase wform\nthen show ?case by (auto)\nnext\n case Ret\n then show ?case\n by (metis diverge_not_Ret) \nnext\n case Sil\n then show ?case \n by (auto, metis diverge.sel itree.sel(2))+\nnext\n case Vis\n then show ?case\n by (metis diverge_not_Vis) \nqed\n\nsubsection \\ Parallel Composition \\\n\ntext \\ The following function combines two choice functions for parallel composition. \\\n\ndefinition emerge :: \"('a \\ 'b) \\ 'a set \\ ('a \\ 'c) \\ ('a \\ ('b, 'c) andor)\" where\n\"emerge f A g = \n map_pfun Both (A \\ pfuse f g) \\ map_pfun Left ((A \\ pdom(g)) \\ f) \\ map_pfun Right ((A \\ pdom(f)) \\ g)\"\n\nlemma emerge_alt_def:\n \"emerge F E G =\n (\\ e \\ pdom(F) \\ pdom(G) \\ E \\ Both(F(e), G(e)))\n \\ (\\ x \\ pdom(F) - (E \\ pdom(G)) \\ Left(F x))\n \\ (\\ x \\ pdom(G) - (E \\ pdom(F)) \\ Right(G x))\"\nproof -\n have 1: \"map_pfun Both (E \\ pfuse F G) = (\\ e \\ pdom(F) \\ pdom(G) \\ E \\ Both(F(e), G(e)))\"\n by (auto intro!: pabs_cong simp add: map_pfun_as_pabs pfuse_def)\n have 2: \"map_pfun Left ((E \\ pdom(G)) \\ F) = (\\ x \\ pdom(F) - (E \\ pdom(G)) \\ Left(F x))\"\n by (auto intro: pabs_cong simp add: map_pfun_as_pabs)\n have 3: \"map_pfun Right ((E \\ pdom(F)) \\ G) = (\\ x \\ pdom(G) - (E \\ pdom(F)) \\ Right(G x))\"\n by (auto intro: pabs_cong simp add: map_pfun_as_pabs)\n show ?thesis\n by (simp only: emerge_def 1 2 3)\nqed\n\nlemma pdom_emerge_commute: \"pdom (emerge f A g) = pdom (emerge g A f)\"\n by (auto simp add: emerge_def)\n\ntext \\ Remove merge function; it can be done otherwise. \\\n\nabbreviation \"par \\ genpar emerge\"\n\nabbreviation \"merge_Vis \\ pmerge_Vis emerge\"\n\nlemma merge_Vis_both [simp]: \"\\ e \\ E; e \\ pdom F; e \\ pdom G \\ \\ merge_Vis F E G(e)\\<^sub>p = par (F(e)\\<^sub>p) E (G(e)\\<^sub>p)\"\n by (simp add: pmerge_Vis_def emerge_def)\n\nlemma merge_Vis_left [simp]: \"\\ e \\ E; e \\ pdom F; e \\ pdom G \\ \\ merge_Vis F E G(e)\\<^sub>p = par (F(e)\\<^sub>p) E (Vis G)\"\n by (simp add: pmerge_Vis_def emerge_def)\n\nlemma merge_Vis_right [simp]: \"\\ e \\ E; e \\ pdom F; e \\ pdom G \\ \\ merge_Vis F E G(e)\\<^sub>p = par (Vis F) E (G(e)\\<^sub>p)\"\n by (simp add: pmerge_Vis_def emerge_def)\n\nlemma par_commute: \"par P E Q = (par Q E P) \\ (\\ (a, b). Ret (b, a))\"\n apply (coinduction arbitrary: P Q rule: itree_strong_coind)\n apply (auto elim!: is_RetE unstableE bind_RetE' bind_SilE' stableE simp add: genpar_Ret_iff)\n apply metis\n apply metis\n apply metis\n apply (metis pdom_emerge_commute)\n apply (metis pdom_emerge_commute)\n apply (simp add: emerge_def)\n apply (auto)\n apply (rename_tac e F G)\n apply (rule_tac x=\"F e\" in exI)\n apply (rule_tac x=\"G e\" in exI)\n apply (simp)\n apply (smt (verit, ccfv_threshold) map_pfun_apply merge_Vis_both pdom.rep_eq pdom_emerge_commute pdom_map_pfun pdom_pmerge_Vis pfun_app.rep_eq)\n apply (metis (no_types, lifting) map_pfun_apply merge_Vis_left merge_Vis_right pdom.rep_eq pdom_emerge_commute pdom_map_pfun pdom_pmerge_Vis pfun_app.rep_eq)\n apply (metis (no_types, lifting) map_pfun_apply merge_Vis_left merge_Vis_right pdom.rep_eq pdom_emerge_commute pdom_map_pfun pdom_pmerge_Vis pfun_app.rep_eq)\n done \n\nconsts \n interleave :: \"'a \\ 'a \\ 'a\" (infixl \"\\\" 55)\n gparallel :: \"'a \\ 'e set \\ 'a \\ 'a\" (\"_ \\\\<^bsub>_\\<^esub> _\" [55, 0, 56] 56)\n\ndefinition \"gpar_csp P cs Q \\ par P cs Q \\ (\\ (x, y). Ret ())\"\n\nabbreviation inter_csp :: \"('e, unit) itree \\ ('e, unit) itree \\ ('e, unit) itree\" where\n\"inter_csp P Q \\ gpar_csp P {} Q\"\n\nadhoc_overloading gparallel gpar_csp and interleave inter_csp\n\nlemma gpar_csp_commute: \"P \\\\<^bsub>E\\<^esub> Q = Q \\\\<^bsub>E\\<^esub> P\"\nproof -\n have \"P \\\\<^bsub>E\\<^esub> Q = (par P E Q \\ (\\(x, y). Ret ()))\"\n by (simp add: gpar_csp_def)\n also have \"... = (par Q E P \\ (\\(x, y). Ret (y, x))) \\ (\\(x, y). Ret ())\"\n by (metis par_commute)\n also have \"... = par Q E P \\ (\\(x, y). Ret ())\"\n by (simp add: bind_itree_assoc[THEN sym])\n (metis (full_types) case_prod_beta' old.unit.exhaust)\n also have \"... = Q \\\\<^bsub>E\\<^esub> P\"\n by (simp add: gpar_csp_def)\n finally show ?thesis .\nqed\n\nlemma gpar_csp_diverge: \"diverge \\\\<^bsub>E\\<^esub> P = diverge\"\n by (metis bind_diverge gpar_csp_def genpar_diverge)\n\nlemma interleave_commute:\n fixes P :: \"('e, unit) itree\"\n shows \"P \\ Q = Q \\ P\"\n by (simp add: gpar_csp_commute)\n\nlemma skip_interleave: \"skip \\ P = P\"\nproof (coinduction arbitrary: P rule: itree_coind)\n case wform\n then show ?case by (auto simp add: gpar_csp_def skip_def)\nnext\n case Ret\n then show ?case\n by (auto simp add: gpar_csp_def skip_def)\nnext\n case Sil\n then show ?case \n by (auto simp add: gpar_csp_def skip_def)\nnext\n case Vis\n then show ?case\n by (auto simp add: gpar_csp_def skip_def)\nqed\n\ndefinition Interleave :: \"'i set \\ ('i \\ ('e, unit) itree) \\ ('e, unit) itree\" where\n\"Interleave I P = Finite_Set.fold (\\) skip (P ` I)\"\n\nsubsection \\ Hiding \\\n\ntext \\ Could we prioritise events to keep determinism? \\\n\ncorec hide :: \"('e, 'a) itree \\ 'e set \\ ('e, 'a) itree\" (infixl \"\\\" 90) where\n\"hide P A = \n (case P of\n Vis F \\ \n \\ \\ If precisely one event in the hidden set is enabled, this becomes a silent event \\\n if (card (A \\ pdom(F)) = 1) then Sil (hide (F (the_elem (A \\ pdom(F)))) A)\n \\ \\ If no event is in the hidden set, then the process continues as normal \\\n else if (A \\ pdom(F)) = {} then Vis (map_pfun (\\ X. hide X A) F)\n \\ \\ Otherwise, there are multiple hidden events present and we deadlock \\\n else deadlock |\n Sil P \\ Sil (hide P A) |\n Ret x \\ Ret x)\"\n\nlemma is_Ret_loop [simp]: \"is_Ret (loop F s) = False\"\n by (metis bind_itree.disc_iff(1) comp_apply itree.disc(2) iterate.code)\n\nlemma is_Ret_hide [simp]: \"is_Ret (P \\ A) = is_Ret P\"\n by (auto simp add: hide.code deadlock_def itree.case_eq_if)\n\nlemma is_Sil_hide [simp]: \"is_Sil (hide P E) = (is_Sil P \\ (is_Vis P \\ card (E \\ pdom(un_Vis P)) = 1))\"\n by (auto elim!: stableE simp add: hide.code deadlock_def itree.case_eq_if)\n\nlemma is_Vis_hide [simp]: \"is_Vis (hide P E) = (is_Vis P \\ (card (E \\ pdom(un_Vis P)) \\ 1 \\ E \\ pdom(un_Vis P) = {}))\"\n by (auto elim!: stableE simp add: hide.code itree.case_eq_if deadlock_def)\n\nlemma hide_Sil [simp]: \"(\\ P) \\ A = \\ (P \\ A)\"\n by (metis (no_types, lifting) hide.code itree.simps(11))\n\nlemma hide_sync: \"(sync a \\ P) \\ {build\\<^bsub>a\\<^esub> ()} = \\ (P ()) \\ {build\\<^bsub>a\\<^esub> ()}\"\n by (simp add: sync_def hide.code)\n\nlemma hide_sync_loop_diverge: \"hide (iter (sync a)) {build\\<^bsub>a\\<^esub> ()} = diverge\"\n apply (coinduction rule:itree_coind, auto)\n apply (simp add: iterate.code, simp add: sync_def)\n apply (metis One_nat_def hide_sync is_Sil_hide itree.disc(5) iterate.code)\n apply (metis One_nat_def hide_sync is_Sil_hide itree.disc(5) itree.distinct_disc(6) iterate.code)\n apply (smt (z3) disjoint_iff empty_iff hide_sync insert_iff is_Vis_hide itree.disc(8) iterate.code)\n apply (smt (z3) Sil_Sil_drop comp_apply hide_Sil hide_sync itree.inject(2) iterate.code)\n apply (metis diverge.code itree.inject(2))\n done\n\nlemma hide_empty: \"hide P {} = P\"\n apply (coinduction arbitrary: P rule: itree_coind)\n apply (auto)\n apply (simp add: hide.code)\n apply (simp add: hide.code)\n apply (simp add: hide.code)\n apply (simp add: hide.code)\n apply (auto simp add: itree.case_eq_if)\n apply (metis (no_types, lifting) hide.code itree.case_eq_if)\n oops\n\nsubsection \\ Interruption \\\n\nprimcorec interrupt :: \"('e, 'a) itree \\ ('e, 'a) itree \\ ('e, 'a) itree\" (infixl \"\\\" 59) where\n\"interrupt P Q =\n (case (P, Q) of\n (Sil P, _) \\ Sil (interrupt P Q) |\n (_, Sil Q) \\ Sil (interrupt P Q) |\n (Ret x, _) \\ Ret x |\n (_, Ret y) \\ Ret y |\n (Vis F, Vis G) \\ \n Vis (map_pfun \n (\\x. case x of \n Left P' \\ interrupt P' Q \\ \\ Left side acts independently \\\n | Right Q' \\ Q' \\ \\ Right side acts independently \\)\n (emerge (pdom(G) \\ F) {} G)))\"\n\nlemma diverge_interrupt_left [simp]: \"diverge \\ P = diverge\"\n by (coinduction arbitrary: P, auto, metis diverge.ctr itree.case(2))\n\nlemma diverge_interrupt_right [simp]: \"P \\ diverge = diverge\"\n by (coinduction arbitrary: P, auto simp add: itree.case_eq_if, meson itree.exhaust_disc)\n\nlemma Sils_interrupt_left [simp]: \"Sils n P \\ Q = Sils n (P \\ Q)\"\n by (induct n, simp_all add: interrupt.code)\n\nlemma Sil_interrupt_right_stable [simp]: \"stable P \\ P \\ Sil Q = Sil (P \\ Q)\"\n by (cases P, simp_all, auto simp add: interrupt.code)\n\nlemma Sils_interrupt_right_stable [simp]: \"stable P \\ P \\ Sils n Q = Sils n (P \\ Q)\"\n by (induct n, auto)\n\nlemma Sils_interrupt_right [simp]: \"P \\ Sils n Q = Sils n (P \\ Q)\"\nproof (cases \"stabilises P\")\n case True\n then obtain m P' where P: \"P = Sils m P'\" \"stable P'\"\n by (metis stabilises_def)\n then have \"Sils m P' \\ Sils n Q = Sils (m + n) (P' \\ Q)\"\n by (simp)\n then show ?thesis\n by (simp add: P(1) add.commute)\nnext\n case False\n then show ?thesis\n by (metis Sils_diverge diverge_interrupt_left diverges_then_diverge)\nqed\n\nlemma deadlock_interrupt_stable: \"stable P \\ deadlock \\ P = P\"\n by (cases P, simp_all add: deadlock_def interrupt.code emerge_def pfun_eq_iff)\n\nlemma deadlock_interrupt: \"deadlock \\ P = P\"\nproof (cases \"stabilises P\")\n case True\n then show ?thesis\n by (metis Sils_interrupt_right deadlock_interrupt_stable stabilises_def)\nnext\n case False\n then show ?thesis\n by (metis diverge_interrupt_right diverges_then_diverge)\nqed\n\nsubsection \\ Exception \\\n\nprimcorec exception :: \"('e, 'a) itree \\ 'e set \\ ('e, 'a) itree \\ ('e, 'a) itree\" (infixl \"\\_\\\" 65) where\n\"exception P A Q =\n (case P of\n Ret x \\ Ret x |\n Sil P' \\ Sil (exception P' A Q) |\n Vis F \\ \n Vis (map_pfun \n (\\x. case x of \n Left P' \\ exception P' A Q \\ \\ Left side acts independently \\\n | Right Q' \\ Q' \\ \\ Right side acts independently \\)\n (emerge \n \\ \\ Non-exceptional behaviours from @{term P}\\\n (A \\ F)\n \\ \\ No synchronisation\\ \n {} \n \\ \\ Exceptional behaviours: events in @{term A} enables by @{term P}, leading to @{term Q}\\\n (pfun_entries (A \\ pdom(F)) ((\\ _. Q))))))\"\n\nsubsection \\ Renaming \\\n\ntext \\ We define notation for writing renaming relations \\\n\ndefinition rncollect :: \"('a \\\\<^sub>\\ 'e\\<^sub>1) \\ ('b \\\\<^sub>\\ 'e\\<^sub>2) \\ 'c set \\ ('c \\ ('a \\ 'b) \\ bool) \\ 'e\\<^sub>1 \\ 'e\\<^sub>2\" where\n\"rncollect c\\<^sub>1 c\\<^sub>2 A f = {(build\\<^bsub>c\\<^sub>1\\<^esub> (fst (fst (f x))), build\\<^bsub>c\\<^sub>2\\<^esub> (snd (fst (f x)))) | x. x \\ A \\ snd (f x)}\"\n \nsyntax \n \"_rncollect\" :: \"evt \\ evt \\ pttrn \\ logic \\ logic \\ logic\" (\"\\_ \\ _ | _ \\ _./ _\\\")\n \"_rncollect_ns\" :: \"evt \\ evt \\ pttrn \\ logic \\ logic\" (\"\\_ \\ _ | _./ _\\\")\n\ntranslations \n \"_rncollect (_evt_param c\\<^sub>1 v\\<^sub>1) (_evt_param c\\<^sub>2 v\\<^sub>2) x A P\" == \"CONST rncollect c\\<^sub>1 c\\<^sub>2 A (\\ x. ((v\\<^sub>1, v\\<^sub>2), P))\"\n \"_rncollect (_evt_id c\\<^sub>1) (_evt_param c\\<^sub>2 v\\<^sub>2) x A P\" == \"CONST rncollect c\\<^sub>1 c\\<^sub>2 A (\\ x. (((), v\\<^sub>2), P))\"\n \"_rncollect (_evt_param c\\<^sub>1 v\\<^sub>1) (_evt_id c\\<^sub>2) x A P\" == \"CONST rncollect c\\<^sub>1 c\\<^sub>2 A (\\ x. ((v\\<^sub>1, ()), P))\"\n \"_rncollect (_evt_id c\\<^sub>1) (_evt_id c\\<^sub>2) x A P\" == \"CONST rncollect c\\<^sub>1 c\\<^sub>2 A (\\ x. (((), ()), P))\"\n \"_rncollect_ns e\\<^sub>1 e\\<^sub>2 x P\" == \"_rncollect e\\<^sub>1 e\\<^sub>2 x (CONST UNIV) P\"\n\nprimcorec rename :: \"('e\\<^sub>1 \\ 'e\\<^sub>2) \\ ('e\\<^sub>1, 'a) itree \\ ('e\\<^sub>2, 'a) itree\" where\n\"rename \\ P = \n (case P of\n Ret x \\ Ret x |\n Sil P \\ Sil (rename \\ P) |\n Vis F \\ Vis (map_pfun (rename \\) (F \\\\<^sub>p graph_pfun ((pdom F \\\\<^sub>r \\)\\))))\"\n\nabbreviation rename':: \"('e\\<^sub>1, 'a) itree \\ ('e\\<^sub>1 \\ 'e\\<^sub>2) \\ ('e\\<^sub>2, 'a) itree\" (\"_\\_\\\" 59) where\n\"rename' P \\ \\ rename \\ P\"\n\nlemma rename_deadlock [simp]: \"rename \\ deadlock = deadlock\"\n by (simp add: deadlock_def rename.code)\n\nsubsection \\ Restriction \\\n\ntext \\ Restrict the events that an ITree can perform to a subset \\\n\nprimcorec evres :: \"'e set \\ ('e, 's) itree \\ ('e, 's) itree\" where\n\"evres E P = \n (case P of\n Ret x \\ Ret x | Sil P' \\ Sil (evres E P') | Vis F \\ Vis (map_pfun (evres E) (E \\ F)))\"\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/UTP/ITree_CSP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2811286290958731}} {"text": "subsection \\Strong Convergence\\\n\ntheory StrongConvergence\n imports IntegrateInsertCommute CreateConsistent HOL.Finite_Set DistributedExecution\nbegin\n\nlemma (in dist_execution) happened_before_same:\n assumes \"i < j\"\n assumes \"j < length (events k)\"\n shows \"(happened_immediately_before)\\<^sup>+\\<^sup>+ (k,i) (k,j)\" \nproof -\n obtain v where v_def: \"j = Suc i + v\" using assms(1) less_iff_Suc_add by auto\n have \"is_valid_event_id (k, Suc i + v) \\ (happened_immediately_before)\\<^sup>+\\<^sup>+ (k,i) (k, Suc i + v)\"\n apply (induction v, simp add: tranclp.r_into_trancl)\n by (metis Suc_lessD add_Suc_right fst_conv happened_immediately_before.elims(3) \n is_valid_event_id.simps snd_conv tranclp.simps)\n then show ?thesis\n using is_valid_event_id.simps v_def assms by blast\nqed\n\ndefinition make_set where \"make_set (k :: nat) p = {x. \\j. p j x \\ j < k}\"\n\nlemma make_set_nil [simp]: \"make_set 0 p = {}\" by (simp add:make_set_def)\n\nlemma make_set_suc [simp]: \"make_set (Suc k) p = make_set k p \\ {x. p k x}\"\n using less_Suc_eq by (simp add:make_set_def, blast)\n\nlemma (in dist_execution) received_messages_eff:\n assumes \"is_valid_state_id (i,j)\"\n shows \"set (received_messages (i,j)) = make_set j (\\k x. (\\s. event_at (i, k) (Receive s x)))\" \n using assms by (induction j, simp add:make_set_def, simp add: take_Suc_conv_app_nth)\n\nlemma (in dist_execution) finite_valid_event_ids:\n \"finite {i. is_valid_event_id i}\"\nproof -\n define X where \"X = {p. events p = events p}\"\n have \"finite X \\ \\m. (\\p \\ X. (length (events p)) < m)\" \n apply (induction rule:finite_induct, simp)\n by (metis gt_ex insert_iff le_less_trans less_imp_not_less not_le_imp_less)\n then obtain m where m_def: \"\\p. length (events p) < m\" using X_def fin_peers by auto\n have \"{(i,j). is_valid_event_id (i,j)} \\ {(i,j). j < m}\" \n using m_def by (simp add: Collect_mono_iff less_trans)\n also have \"... \\ X \\ {j. j < m}\" using X_def by blast\n finally have \"{i. is_valid_event_id i} \\ X \\ {j. j < m}\" \n by (simp add: subset_iff)\n thus ?thesis\n using fin_peers finite_Collect_less_nat finite_cartesian_product\n infinite_super subset_eq\n by (metis UNIV_I)\nqed\n\nlemma (in dist_execution) send_insert_id_1:\n \"state i \\ (\\s. create_insert s n \\ i) = Inr (Insert m) \\ I m = i\"\n by fastforce\n\nlemma (in dist_execution) send_insert_id_2:\n \"state i \\ (\\s. create_delete s n) = Inr (Insert m) \\ False\"\n by fastforce\n\nlemma (in dist_execution) send_insert_id:\n \"event_at i (Send (Insert m)) \\ I m = i\" \n using send_correct send_insert_id_1 send_insert_id_2 by metis\n\nlemma (in dist_execution) recv_insert_once:\n \"event_at (i,j) (Receive s (Insert m)) \\ event_at (i,k) (Receive t (Insert m)) \\ j = k\"\n using no_data_corruption send_insert_id at_most_once\n by (simp, metis (mono_tags) Pair_inject event_pred.simps fst_conv is_valid_event_id.simps)\n\nproposition integrate_insert_commute':\n fixes M m s\n assumes \"consistent M\"\n assumes \"is_delete m \\ m \\ T\"\n assumes \"m \\ M\"\n assumes \"T \\ M\"\n assumes \"deps m \\ I ` insert_messages T\" \n assumes \"is_certified_associated_string T s\"\n shows \"is_certified_associated_string (T \\ {m}) (s \\ (\\t. integrate t m))\" \nproof (cases s)\n case (Inl a)\n then show ?thesis using assms by simp\nnext\n case (Inr b)\n have \"T \\ {m} \\ M\" using assms(3) assms(4) by simp \n moreover have \"\\ (deps ` (T \\ {m})) \\ I ` insert_messages (T \\ {m})\" \n using assms(5) assms(6) Inr apply (simp add:is_associated_string_def consistent_def)\n by (meson dual_order.trans subset_insertI subset_mono)\n ultimately have \"consistent (T \\ {m})\"\n using assms consistent_subset by force \n then show ?thesis using integrate_insert_commute assms(2) assms(6) Inr by auto\nqed\n\nlemma foldM_rev: \"foldM f s (li@[ll]) = foldM f s li \\ (\\t. f t ll)\"\n by (induction li arbitrary:s, simp+)\n\nlemma (in dist_execution) state_is_associated_string':\n fixes i M\n assumes \"j \\ length (events i)\"\n assumes \"consistent M\"\n assumes \"make_set j (\\k m. \\s. event_at (i,k) (Receive s m)) \\ M\"\n shows \"is_certified_associated_string (make_set j (\\k m. \\s. event_at (i,k) (Receive s m))) (state (i,j))\"\n using assms\nproof (induction j)\n case 0\n then show ?case by (simp add: empty_associated)\nnext\n case (Suc j)\n have b:\"j < length (events i)\" using Suc by auto\n show ?case\n proof (cases \"events i ! j\")\n case (Send m)\n then show ?thesis using Suc by (simp add: take_Suc_conv_app_nth) \n next\n case (Receive s m)\n moreover have \"is_delete m \\ m \\ (make_set j (\\k m. \\s. event_at (i,k) (Receive s m)))\"\n apply (cases m) using recv_insert_once Receive b apply (simp add: make_set_def) \n apply (metis nat_neq_iff)\n by (simp)\n moreover have \"deps m \\ I ` insert_messages (make_set j (\\k m. \\s. event_at (i,k) (Receive s m)))\"\n apply (rule subsetI)\n using semantic_causal_delivery Receive b apply (simp add:insert_messages_def image_iff make_set_def) by metis\n ultimately show ?thesis \n using Suc apply (cases s, simp add:take_Suc_conv_app_nth foldM_rev)\n using integrate_insert_commute' by fastforce\n qed \nqed\n\nlemma (in dist_execution) sent_before_recv:\n assumes \"event_at (i,k) (Receive s m)\"\n assumes \"j < length (events i)\"\n assumes \"k < j\" \n shows \"event_at s (Send m) \\ happened_immediately_before\\<^sup>+\\<^sup>+ s (i,j)\"\nproof -\n have a:\"event_at s (Send m)\"\n using assms no_data_corruption by blast\n hence \"happened_immediately_before s (i,k)\" \n using assms by (cases s, simp, metis (mono_tags, lifting) event.simps(6))\n hence \"(happened_immediately_before)\\<^sup>+\\<^sup>+ s (i,j)\" using happened_before_same \n by (meson assms(2) assms(3) tranclp_into_tranclp2)\n thus ?thesis using a by blast\nqed\n\nlemma (in dist_execution) irrefl_p: \"irreflp (happened_immediately_before\\<^sup>+\\<^sup>+)\" \n by (meson acyclic_def dist_execution.acyclic_happened_before\n dist_execution_axioms irreflpI tranclp_unfold)\n\n\n\nlemma (in dist_execution) sent_messages_consistent:\n \"consistent {m. (\\i. event_at i (Send m))}\"\nproof -\n obtain ids where ids_def: \"set ids = {i. is_valid_event_id i} \\ \n sorted_wrt (to_ord (happened_immediately_before)) ids \\ distinct ids\"\n using top_sort finite_valid_event_ids by (metis acyclic_happened_before)\n have \"\\x y. happened_immediately_before\\<^sup>+\\<^sup>+ x y \\ x \\ set ids \\ y \\ set ids\"\n using converse_tranclpE ids_def tranclp.cases by fastforce\n hence a:\"\\x y. happened_immediately_before\\<^sup>+\\<^sup>+ x y \\\n (\\i j. i < j \\ j < length ids \\ ids ! i = x \\ ids ! j = y)\"\n by (metis top_sort_eff ids_def distinct_Ex1 irrefl_p)\n define n where \"n = length ids\"\n have \"n \\ length ids \\ consistent (make_set n (\\k x. event_at (ids ! k) (Send x)))\"\n proof (induction n)\n case 0\n then show ?case using empty_consistent by simp\n next\n case (Suc n)\n moreover obtain i j where ij_def: \n \"ids ! n = (i,j)\" \"n < length ids\"\n \"is_valid_event_id (i,j)\" \"is_valid_state_id (i,j)\"\n by (metis Suc.prems Suc_le_lessD ids_def is_valid_event_id.elims(2) is_valid_state_id.simps\n le_eq_less_or_eq mem_Collect_eq nth_mem)\n moreover have \"set (received_messages (i,j)) \\ make_set n (\\k x. event_at (ids ! k) (Send x))\"\n using ij_def apply (simp add:received_messages_eff del:received_messages.simps, rule_tac subsetI)\n using sent_before_recv a apply (simp add:make_set_def) \n by (metis (no_types, hide_lams) distinct_Ex1 ids_def in_set_conv_nth)\n moreover have \"(i,j) \\ I ` insert_messages (make_set n (\\k x. event_at (ids ! k) (Send x)))\"\n apply (simp add:insert_messages_def image_iff make_set_def del:event_at.simps) \n using ids_def le_eq_less_or_eq nth_eq_iff_index_eq send_insert_id \n by (metis dual_order.strict_trans1 ij_def(1) ij_def(2) less_not_refl)\n ultimately show ?case using Suc\n apply (cases \"events i ! j\")\n using new_messages_keep_consistency [where i = \"(i,j)\"] by simp+\n qed\n moreover have \"make_set n (\\k x. event_at (ids ! k) (Send x)) = {x. (\\i. event_at i (Send x))}\" \n apply (simp add:make_set_def n_def, rule set_eqI, subst surjective_pairing, simp only:event_pred.simps)\n using ids_def apply simp \n by (metis fst_conv in_set_conv_nth is_valid_event_id.simps mem_Collect_eq prod.exhaust_sel snd_conv) \n ultimately show ?thesis using ids_def n_def by simp\nqed\n\nlemma (in dist_execution) received_messages_were_sent:\n assumes \"is_valid_state_id (i,j)\"\n shows \"make_set j (\\k m. (\\s. event_at (i, k) (Receive s m))) \\ {m. \\i. event_at i (Send m)}\"\n using no_data_corruption by (simp add:make_set_def, rule_tac subsetI, fastforce)\n\nlemma (in dist_execution) state_is_associated_string:\n assumes \"is_valid_state_id i\"\n shows \"is_certified_associated_string (set (received_messages i)) (state i)\"\n using state_is_associated_string' received_messages_eff\n sent_messages_consistent received_messages_were_sent assms by (cases i, simp)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WOOT_Strong_Eventual_Consistency/StrongConvergence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2810882504428991}} {"text": "theory Trace_Subset\n\nimports\n \"Sail.Sail2_state_lemmas\"\n \"HOL-Eisbach.Eisbach_Tools\"\n \"Bound_UntilM\"\n\nbegin\n\ntext \\\nShow that an action in the monad can only create trace events\nwithin some set. This tends to be a coarse overapproximation,\nwith no contextual dependency information, but it is useful for\nquickly showing that an action depends on some registers and not\nothers, for instance.\n\nComes with a gadget for proving lots of such theorems with little\nsupervision.\n\\\ndefinition\n monad_trace_subset :: \"'regv event set \\ ('regv, 'a, 'e) monad \\ bool\"\n where\n \"monad_trace_subset S m = (\\t res. (m, t, res) \\ Traces \\ set t \\ S)\"\n\nlemmas monad_trace_subsetD = monad_trace_subset_def[THEN iffD1, rule_format]\n\nlemma monad_trace_subset_weaken:\n \"monad_trace_subset S f \\ S \\ S' \\\n monad_trace_subset S' f\"\n by (auto simp: monad_trace_subset_def)\n\nlemma monad_trace_subset_bind:\n \"monad_trace_subset S f \\\n (\\x t. Run f t x \\ monad_trace_subset S' (g x)) \\\n monad_trace_subset (S \\ S') (bind f (\\x. g x))\"\n apply (subst monad_trace_subset_def, clarsimp)\n apply (erule bind_Traces_cases)\n apply (drule(1) monad_trace_subsetD)\n apply blast\n apply (drule spec, drule mp, erule exI)\n apply (drule(1) monad_trace_subsetD)+\n apply auto\n done\n\nlemma monad_trace_subset_bind_simple:\n \"monad_trace_subset S f \\\n (\\x. monad_trace_subset S (g x)) \\\n monad_trace_subset S (bind f (\\x. g x))\"\n by (drule monad_trace_subset_bind, auto)\n\nlemmas monad_trace_subset_bind_backward =\n monad_trace_subset_bind[where S=S and S'=S for S, simplified]\n\nlemma try_catch_monad_trace_subset:\n \"monad_trace_subset S f \\\n (\\x t. (f, t, Exception x) \\ Traces \\ monad_trace_subset S (g x)) \\\n monad_trace_subset S (try_catch f (\\x. g x))\"\n apply (subst monad_trace_subset_def, clarsimp)\n apply (erule try_catch_Traces_cases)\n apply (drule(1) monad_trace_subsetD)\n apply blast\n apply (drule spec, drule mp, erule exI)\n apply (drule(1) monad_trace_subsetD)+\n apply auto\n done\n\nnamed_theorems monad_trace_subset\n\nlemma monad_trace_subset_return[monad_trace_subset]:\n \"monad_trace_subset {} (return x)\"\n by (simp add: monad_trace_subset_def return_def)\n\nlemma monad_trace_subset_throw[monad_trace_subset]:\n \"monad_trace_subset {} (throw x)\"\n by (simp add: monad_trace_subset_def throw_def)\n\nlemma monad_trace_subset_Fail[monad_trace_subset]:\n \"monad_trace_subset {} (Fail s)\"\n by (simp add: monad_trace_subset_def)\n\nlemma monad_trace_subset_Done[monad_trace_subset]:\n \"monad_trace_subset {} (Done x)\"\n by (simp add: monad_trace_subset_def)\n\nlemma monad_trace_subset_maybe_fail[monad_trace_subset]:\n \"monad_trace_subset {} (maybe_fail s x)\"\n by (simp add: maybe_fail_def monad_trace_subset split: option.split)\n\nlemma read_reg_traces[monad_trace_subset]:\n \"monad_trace_subset (range (E_read_reg (name r))) (read_reg r)\"\n apply (clarsimp simp add: monad_trace_subset_def read_reg_def)\n apply (erule Traces.cases)\n apply simp\n apply clarsimp\n apply (erule T.cases; clarsimp split: option.split_asm)\n done\n\nlemma write_reg_traces[monad_trace_subset]:\n \"monad_trace_subset (range (E_write_reg (name r))) (write_reg r x)\"\n apply (clarsimp simp add: monad_trace_subset_def write_reg_def)\n apply (erule Traces.cases)\n apply simp\n apply clarsimp\n apply (erule T.cases; clarsimp split: option.split_asm)\n done\n\nmethod monad_trace_subsetI uses rules = (determ \\\n intro allI conjI impI monad_trace_subset_bind_simple\n monad_trace_subset empty_subsetI\n | rule rules monad_trace_subset\n | (rule monad_trace_subset_weaken, rule rules monad_trace_subset)\\)+\n\nlemma Read_mem_monad_trace_subset:\n \"(\\x. monad_trace_subset {} (f x)) \\\n monad_trace_subset (range (\\(rk, addr, val, sz). E_read_mem rk addr sz val))\n (Read_mem rk x sz f)\"\n apply (clarsimp simp: monad_trace_subset_def)\n apply (erule Traces.cases; clarsimp)\n apply (erule T.cases; clarsimp)\n apply fastforce\n done\n\nlemma read_mem_monad_trace_subset[monad_trace_subset]:\n \"monad_trace_subset (range (\\(rk, addr, val, sz). E_read_mem rk addr sz val))\n (read_mem dict_Sail2_values_Bitvector_a dict_Sail2_values_Bitvector_b rk addr_sz addr sz)\"\n apply (simp add: read_mem_def read_mem_bytes_def maybe_fail_def[symmetric])\n apply (monad_trace_subsetI rules: Read_mem_monad_trace_subset)\n done\n\nlemma Write_mem_monad_trace_subset:\n \"(\\x. monad_trace_subset {} (f x)) \\\n monad_trace_subset (range (\\(wk, addr, val, sz, k). E_write_mem wk addr sz val k))\n (Write_mem wk x sz v f)\"\n apply (clarsimp simp: monad_trace_subset_def)\n apply (erule Traces.cases; clarsimp)\n apply (erule T.cases; clarsimp)\n apply fastforce\n done\nlemma write_mem_monad_trace_subset[monad_trace_subset]:\n \"monad_trace_subset (range (\\(wk, addr, val, sz, k). E_write_mem wk addr sz val k))\n (write_mem class_a class_b wk addr_sz addr sz v)\"\n apply (simp add: write_mem_def read_mem_bytes_def maybe_fail_def split: option.split)\n apply (monad_trace_subsetI rules: Write_mem_monad_trace_subset)\n done\n\nlemma catch_early_return_trace_subset:\n \"monad_trace_subset S m \\\n monad_trace_subset S (catch_early_return m)\"\n apply (simp add: catch_early_return_def)\n apply (rule try_catch_monad_trace_subset; clarsimp split: sum.split)\n apply monad_trace_subsetI\n done\n\nlemma or_boolM_trace_subset:\n \"monad_trace_subset S m \\ monad_trace_subset S m' \\\n monad_trace_subset S (or_boolM m m')\"\n apply (simp add: or_boolM_def)\n apply (monad_trace_subsetI | simp)+\n done\n\nlemma and_boolM_trace_subset:\n \"monad_trace_subset S m \\ monad_trace_subset S m' \\\n monad_trace_subset S (and_boolM m m')\"\n apply (simp add: and_boolM_def)\n apply (monad_trace_subsetI | simp)+\n done\n\nlemma let_trace_subset:\n \"monad_trace_subset S (f s) \\\n monad_trace_subset S (Let s f)\"\n by simp\n\nlemma bound_untilM_trace_subset:\n \"(\\vars. monad_trace_subset S (cond vars)) \\\n (\\vars. monad_trace_subset S (body vars)) \\\n monad_trace_subset S (bound_untilM bound vars cond body)\"\n apply (induct bound vars cond body rule: bound_untilM.induct)\n apply (subst bound_untilM.simps)\n apply (intro monad_trace_subset_bind_backward allI impI)\n apply (monad_trace_subsetI | clarsimp)+\n done\n\nlemma liftR_trace_subset:\n \"monad_trace_subset S f \\\n monad_trace_subset S (liftR f)\"\n apply (simp add: liftR_def)\n apply (intro try_catch_monad_trace_subset,\n (monad_trace_subsetI | simp)+)\n done\n\nlemma foreachM_monad_trace_subset:\n \"(\\x vs tr e. x \\ set xs \\ monad_trace_subset S (body x vs)) \\\n monad_trace_subset S (foreachM xs vs body)\"\n by (induct xs arbitrary: vs, (monad_trace_subsetI | simp)+)\n\nlemma genlistM_monad_trace_subset:\n \"(\\i. i < n \\ monad_trace_subset S (f i)) \\ monad_trace_subset S (genlistM f n)\"\n apply (clarsimp simp add: genlistM_def genlist_def)\n apply (monad_trace_subsetI rules: foreachM_monad_trace_subset | simp)+\n done\n\nlemma monad_trace_subset_Choose:\n \"(\\b. monad_trace_subset S (cont b)) \\\n monad_trace_subset (range (E_choose nm) \\ S) (Choose nm cont)\"\n apply (clarsimp simp: monad_trace_subset_def)\n apply (erule Traces.cases; clarsimp)\n apply (auto elim!: T.cases)\n done\n\nnamed_theorems monad_trace_subset_intro\n\nlemmas monad_trace_subset_intro_init[monad_trace_subset_intro] =\n conjI impI allI Un_least monad_trace_subset_bind_simple\n or_boolM_trace_subset and_boolM_trace_subset\n catch_early_return_trace_subset let_trace_subset\n liftR_trace_subset monad_trace_subset_Choose\n foreachM_monad_trace_subset genlistM_monad_trace_subset\n bound_untilM_trace_subset\n if_split[where P=\"monad_trace_subset _\", THEN iffD2]\n prod.split[where P=\"monad_trace_subset _\", THEN iffD2]\n option.split[where P=\"monad_trace_subset _\", THEN iffD2]\n bitU.split[where P=\"monad_trace_subset _\", THEN iffD2]\n\nlemmas monad_trace_subset_Choose_return =\n monad_trace_subset_Choose[rule_format, OF monad_trace_subset_return, simplified]\n\nML \\\nstructure Monad_Trace_Subset_Exploration = struct\n\nval triv = Thm.trivial @{cprop \"monad_trace_subset S m\"}\n |> Drule.generalize ([\"'a\", \"'b\", \"'c\"], [\"S\", \"m\"])\n\nfun dest_eq2 t = Logic.dest_equals t\n handle TERM _ => HOLogic.dest_eq (HOLogic.dest_Trueprop t)\n\nfun is_monadT (Type (@{type_name monad}, _)) = true\n | is_monadT _ = false\n\nval is_meta_monadT = is_monadT o snd o strip_type\n\nfun is_monad_const t = let\n val (f, xs) = strip_comb t\n in is_Const f andalso is_monadT (fastype_of t)\n andalso not (exists (is_meta_monadT o fastype_of) xs) end\n\nfun add_monad_consts [] xs = xs\n | add_monad_consts ((f $ x) :: ts) xs = add_monad_consts (f :: x :: ts)\n ((if is_monad_const (f $ x) then [f $ x] else []) @ xs)\n | add_monad_consts (Abs (nm, ty, t) :: ts) xs = let\n val t' = betapply (Abs (nm, ty, t), Var ((suffix \"_bv\" nm, 0), ty))\n in add_monad_consts (t' :: ts) xs end\n | add_monad_consts (_ :: ts) xs = add_monad_consts ts xs\n\nfun fetch_by_term ctxt extras term = let\n val inst = Drule.infer_instantiate ctxt\n [((\"m\", 0), Thm.cterm_of ctxt term)] triv\n val thms = Named_Theorems.get ctxt @{named_theorems \"monad_trace_subset\"}\n val resn = (extras @ thms) RL [inst]\n in case resn of [] => raise TERM (\"fetch_by_term\", [term])\n | (t :: _) => t\n end\n\nfun dest (Const (@{const_name monad_trace_subset}, _) $ S $ m) = (S, m)\n | dest t = raise TERM (\"monad_trace_subset dest\", [t])\n\nfun strip_un (Const (@{const_name \"Lattices.sup\"}, _) $ x $ y) = maps strip_un [x, y]\n | strip_un t = [t]\n\nfun mk_un [] = raise TERM (\"monad_trace_subset mk_un: empty\", [])\n | mk_un (x :: xs) = let\n val ty = fastype_of x\n val c = Const (@{const_name \"Lattices.sup\"}, ty --> ty --> ty)\n in foldr1 (fn (x, y) => c $ x $ y) (x :: xs) end\n\nfun prove ctxt extras defn = let\n val freeze_defn = Variable.import_vars ctxt defn\n val prop = Thm.concl_of freeze_defn\n val (term, expanded) = dest_eq2 prop\n val sub_fs = add_monad_consts [expanded] []\n |> sort_distinct Term_Ord.fast_term_ord\n val sub_thms = map (fetch_by_term ctxt extras) sub_fs\n val ss = map (Thm.concl_of #> HOLogic.dest_Trueprop #> dest #> fst) sub_thms\n |> maps strip_un\n |> sort_distinct Term_Ord.fast_term_ord\n val ss_frees = fold Term.add_vars ss []\n val _ = null ss_frees orelse raise TERM (\"monad_trace_subset prove\", ss)\n val _ = not (null ss) orelse raise THM (\"monad_trace_subset prove: subthms\", 1, sub_thms)\n val st = mk_un ss\n val sub_thm_insts = sub_thms RL @{thms monad_trace_subset_weaken}\n val inst = Drule.infer_instantiate ctxt\n [((\"m\", 0), Thm.cterm_of ctxt term), ((\"S\", 0), Thm.cterm_of ctxt st)] triv\n val subset_ss = put_simpset HOL_ss ctxt addsimps @{thms subset_iff mem_simps}\n val intros = Named_Theorems.get ctxt @{named_theorems monad_trace_subset_intro}\n val tac = simp_tac (put_simpset HOL_basic_ss ctxt addsimps [defn])\n THEN_ALL_NEW REPEAT_ALL_NEW (match_tac ctxt\n (intros @ sub_thm_insts))\n THEN_ALL_NEW simp_tac subset_ss\n THEN_ALL_NEW simp_tac ctxt\n val nms = Term.add_frees (Thm.concl_of inst) [] |> map fst\n fun tr ctxt = Syntax.pretty_term ctxt term\n |> (fn p => Pretty.block [Pretty.str \"proving monad_trace_subset for: \", p])\n |> Pretty.writeln\n in Goal.prove ctxt nms [] (Thm.concl_of inst) (fn r => (tr (#context r); tac 1))\n end\n\nfun defn_name defn = Term.term_name (head_of (fst (dest_eq2 (Thm.concl_of defn))))\n\nfun prove_rec thys ctxt extras nm defn = let\n val thm = prove ctxt extras defn\n in thm :: extras end\n handle TERM (\"fetch_by_term\", [tm]) => let\n val f = head_of tm\n val _ = is_Const f orelse raise TERM (\"prove_rec: stuck\", [tm])\n val f_nm = fst (dest_Const f)\n val q = Long_Name.qualifier f_nm\n val _ = member (op =) thys q orelse raise TERM (\"prove_rec: not in thys\", [tm])\n val def2 = Proof_Context.get_thm ctxt (suffix \"_def\" f_nm)\n val _ = tracing (\"recursing \" ^ nm ^ \" --> \" ^ f_nm)\n val extras2 = prove_rec thys ctxt extras f_nm def2\n in prove_rec thys ctxt extras2 nm defn end\n\nfun install_rec thys defn thy = let\n val ctxt = Proof_Context.init_global thy\n val thms = prove_rec thys ctxt [] \"toplevel\" defn\n in Context.theory_map\n (fold (Named_Theorems.add_thm @{named_theorems \"monad_trace_subset\"}) thms)\n thy\n end\n\nfun install_recs thys = fold (install_rec thys)\n\nend\n\\\n\nlemma choose_bool_monad_trace_subset[monad_trace_subset]:\n \"monad_trace_subset (range (E_choose s)) (choose_bool s)\"\n apply (simp add: choose_bool_def)\n apply (rule monad_trace_subset_Choose_return)\n done\n\nlemma bool_of_bitU_nondet_monad_trace_subset[monad_trace_subset]:\n \"monad_trace_subset (range (E_choose ''bool_of_bitU'')) (bool_of_bitU_nondet bitU)\"\n by (cases bitU, simp_all add: bool_of_bitU_nondet_def, monad_trace_subsetI)\n\nsetup \\Monad_Trace_Subset_Exploration.install_recs\n [\"Sail2_prompt_monad\", \"Sail2_prompt\"]\n @{thms early_return_def exit0_def assert_exp_def\n undefined_bool_def internal_pick_def\n of_bits_nondet_def}\n\\\n\nend\n", "meta": {"author": "CTSRD-CHERI", "repo": "t-cheri", "sha": "f1874cef52245e1de1654c2a3e2da9b8d10e066c", "save_path": "github-repos/isabelle/CTSRD-CHERI-t-cheri", "path": "github-repos/isabelle/CTSRD-CHERI-t-cheri/t-cheri-f1874cef52245e1de1654c2a3e2da9b8d10e066c/model/isabelle/Trace_Subset.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2807983026769544}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: Runs.thy (Isabelle/HOL 2016-1)\n ID: $Id: Runs.thy 132861 2016-12-21 10:34:41Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Defines types protocol runs: a run is described by a protocol role, the owner \n and partner agents, and frame, which maps variables to messages. \n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Runs\\\n\ntheory Runs imports Messages\nbegin\n\nsubsection \\Type definitions\\\n\n\ndatatype role_t = Init | Resp \n\ndatatype var = Var nat\n\ntype_synonym \n rid_t = \"fid_t\"\n\ntype_synonym \n frame = \"var \\ msg\" \n\nrecord run_t = \n role :: role_t\n owner :: agent\n partner :: agent\n\ntype_synonym\n progress_t = \"rid_t \\ var set\" \n\n\nfun\n in_progress :: \"var set option \\ var \\ bool\"\nwhere\n \"in_progress (Some S) x = (x \\ S)\"\n |\"in_progress None x = False\"\n\nfun\n in_progressS :: \"var set option \\ var set \\ bool\"\nwhere\n \"in_progressS (Some S) S' = (S' \\ S)\"\n |\"in_progressS None S' = False\"\n\nlemma in_progress_dom [elim]: \"in_progress (r R) x \\ R \\ dom r\"\nby (cases \"r R\", auto)\n\nlemma in_progress_Some [elim]: \"in_progress r x \\ \\ x. r = Some x\"\nby (cases \"r\", auto)\n\nlemma in_progressS_elt [elim]: \"in_progressS r S \\ x \\ S \\ in_progress r x\"\nby (cases r, auto)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Runs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.42632159254749025, "lm_q1q2_score": 0.2806976031155707}} {"text": "theory RB_Relaxed_mike imports RCU_Lems \nbegin\n\ndatatype F = B | W | Q | R \ndatatype Pointer = Head | Tail\n\nconsts n :: nat (*size of buffer, input*)\nconsts N :: nat (*number of Arr\\<^sub>W entries*)\n\n(*(Wr T u t b \\)*)\n(*\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"ts = getTS \\ w\"\nshows \"\\ [x \\\\<^sub>t u] (write_trans t b w v \\ ts) \"\n sorry\n*)\n\n\nlemma pval_val_same:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n using assms\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var apply blast\n defer \n apply (simp add: getVWNC_var)\n apply (simp add: getVWNC_var)\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\nfix a :: nat and ba :: rat\n assume a1: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ t (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := True)\\) (var w)\"\n assume a2: \"x = var w\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"ba \\ getTS \\ (getVWNC \\ t (var w))\"\n have f5: \"\\s n p. var p = n \\ p \\ surrey_state.writes (s::surrey_state) \\ p \\ writes_on s n\"\n using writes_on_def by force\n have \"\\s n p. writes_on (write_available_update p (s::surrey_state)) n = writes_on s n\"\n by (metis (no_types) surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(5) writes_on_def)\n then have f6: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), modView := (modView \\) ((x, getTS \\ (getVWNC \\ t x)) := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), mods := (mods \\) ((x, getTS \\ (getVWNC \\ t x)) := \\val = v, is_releasing = b\\), writes := insert (x, getTS \\ (getVWNC \\ t x)) (surrey_state.writes \\)\\) x\"\n using a2 a1 by blast\n have f7: \"\\s f. surrey_state.writes (writes_update f (s::surrey_state)) = f (surrey_state.writes s)\"\n by auto\n have f8: \"var (a, ba) = x\"\n using f6 f5 by meson\n have \"(a, ba) \\ surrey_state.writes \\\"\n using f7 f6 f5 a4 a2 by (metis insert_iff snd_conv)\n then show False\n using f8 a3 writes_on_def by force\nqed\n\n\n\nlemma pval_val_other:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"t\\s\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v s b \\)\"\n using assms apply simp\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var\n apply (simp add: w_in_writes_on_var getVWNC_var) \n apply (simp add: getVWNC_var)\n\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\n fix a :: nat and ba :: rat\n assume a1: \"ba \\ getTS \\ (getVWNC \\ s (var w))\"\n assume a2: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\) (var w)\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"x = var w\"\n have \"(a, ba) \\ \\\\var = var w \\ \\(\\) (surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\))\\\"\n using a2 writes_on_def by blast\n then have f5: \"var (a, ba) = var w \\ (a, ba) \\ surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\)\"\n by blast\n then have \"(a, ba) \\ surrey_state.writes \\\"\n using a4 a3 writes_on_def by fastforce\n then show False\n using f5 a1 by simp\nqed\n\n\n\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t' b \\)\"\n using assms apply (cases \"t=t'\")\n using pval_val_same apply blast\n using pval_val_other by blast\n\n\n\n\nlemma pval_val_outside:\n assumes \"wfs \\\"\n and \"N\\ \\\"\n and \"\\j.[x \\\\<^sub>t j] \\ \\ jk. k [x \\\\<^sub>t k] \\\"\n and \"u\\\\ \\ uz.(z>N\\\\[x \\\\<^sub>t z] (Wr x u t' b \\))\"\n using assms apply (cases \"t=t'\")\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n by (metis fst_conv not_less_iff_gr_or_eq pval_val)\n\n\nlemma pval_val_outside_2:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"[x =\\<^sub>t 0] \\\"\n and \"u \\ 0\"\nshows \"\\i.(([x =\\<^sub>t i] (Wr x u t b \\))\\([x =\\<^sub>t i] (Wr x 0 t' b \\)))\" \n using assms apply (cases \"t=t'\")\n using OpSem_ProofRules.ext_d_obs_d_obs apply blast\n using OpSem_ProofRules.ext_d_obs_d_obs by blast\n\n\n\n\n\n\n(*\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n\n\nlemma pval_val_all: \n assumes \"wfs \\\"\n and \"\\i. i > k \\ \\ [x \\\\<^sub>t i] \\\"\n and \"k < j\" \n and \"u \\ k\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t j] (Wr x v t b \\) \"\n using assms\n \n using pval_val sledgehammer\n*)\n\nconsts \n H :: L\n T :: L\n\n\nrecord LB =\n hW :: V (*local copy of W*)\n tW :: V (*local copy of W*)\n q :: \"(nat \\ nat) list\" (*for now assume well synchronised, need to think about weak memory *)\n tempR :: \"(nat \\ nat)\" (*local copy of word by R*)\n\n tloc :: V\n Data:: \"nat \\ nat\" (*returns a word Data_i*)\n countW :: nat (* the index of the next element of Data to be written *)\n countR :: nat (* how many words from Data the read has read or reading (i.e., retrieved) *)\n\n ownD :: \"nat \\ F\" (* ownership of data indices *)\n ownB :: \"nat \\ F\" (* ownership of bytes in buffer *)\n (* tries :: nat *)\n oom :: bool (*signals W that it was OOM*)\n \\ :: surrey_state\n\ndefinition \"global s \\ wfs s \\ H \\ T\"\n\n\n\n\nlemmas opsemsyntax [simp] = global_def\nlemmas defs_del [simp del] = Rd_def Let_def Wr_def Upd_def st_rd_def val_rd_def\n\n(* thread 2 is the writer *)\n(* thread 3 is the reader *)\n\n(* Omit tries *)\n(* Finish queueu + reader *)\n\n(* We need this one to hold at minimum *)\ndefinition \"arrayInv s \\ \\i. (i ownD s i = R)\\ (countR s \\ i \\ i < countW s \\ ownD s i = B) \\ (countW s \\ i \\ i < n \\ ownD s i = W) \"\n\n\ndefinition \"q_entries_bounded s \\ (\\i. i < length(q s) \\ (fst(q s!i)+snd(q s!i)\\N)\\snd(q s!i)>0)\"\ndefinition \"tempR_bounded s \\ fst (tempR s) + snd (tempR s) \\ N\"\ndefinition \"counter_q_rel s \\ (countW s-countR s=length(q s))\"\ndefinition \"con_assms s \\ 0 < N \\ 0 (countR s\\countW s) \\ (countW s\\n)\n \\ (\\i.(iData s i\\N \\ Data s i>0)\"\n(*new\n(typically)\n\\forall x . P(x) \\ Q(x)\n\\exists x . P(x) \\ Q(x)\n\n[H =\\<^sub>2 i] means thread 2 sees the last write to H and this has value i.\n[H \\\\<^sub>2 i] means that thread 2 can see the value i.\n*)\ndefinition \"bounded_pointers s \\ ((\\i. i > N \\ \\[H \\\\<^sub>2 i] (\\ s)))\\\n ((\\j. j > N \\ \\[T \\\\<^sub>2 j] (\\ s)))\"\n\ndefinition \"basic_pointer_movement s \\ 0\\hW s\\ hW s\\N \\ 0\\tW s\\ tW s\\N\"\n\n\n \n\n\ndefinition \"collection s \\ arrayInv s \\ q_entries_bounded s\n \\tempR_bounded s \\counter_q_rel s \\ con_assms s\n \\ bounded_pointers s \\ basic_pointer_movement s\"\n\n\ndefinition \"init s \\\n [T =\\<^sub>2 0] (\\ s) \\ [H =\\<^sub>2 0] (\\ s) \\ [T =\\<^sub>3 0] (\\ s) \\ (q s = []) \\ (hW s = 0) \\ (tW s = 0)\n \\ (\\l. (l ((Data s l > 0)\\(Data s l \\ N)))\n \\ (\\i. (i ownD s i = W)\n \\ (\\i. (i\\N) \\ ownB s i = B)\n \\ (countW s = 0) \\ (countR s = 0)\n \\ (tempR s = (0,0)) \\ \\ oom s \"\n\ndefinition \"grd1 s \\ (tW s = hW s) \\ (Data s (countW s) \\ N) \"\ndefinition \"grd2 s \\ (tW s > hW s) \\ (Data s (countW s) < (tW s - hW s)) \"\ndefinition \"grd3 s \\ tW s < hW s \"\ndefinition \"grd4 s \\ Data s (countW s) \\ N - hW s \"\ndefinition \"grd5 s \\ Data s (countW s) < tW s \"\ndefinition \"no_space_for_word s \\ (grd1 s \\ \\(Data s (countW s) \\ N))\\\n (grd2 s \\ \\(Data s (countW s) < (tW s - hW s)))\\\n (grd3 s \\ \\(Data s (countW s) \\ N - hW s \\ Data s (countW s) < tW s))\"\n\n\n\nlemmas main_invariant_lemmas = collection_def arrayInv_def q_entries_bounded_def \n counter_q_rel_def tempR_bounded_def con_assms_def\n init_def bounded_pointers_def basic_pointer_movement_def\n pval_val_same pval_val_other pval_val\nlemmas guards = grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def\n\n\nlemma LoadBuffering:\n \"\\- \\ global \\\\ \\ \\collection \\ \\init \\\nCOBEGIN\n\\ global \\\\ \\ \\collection \\ \\ \\oom \\ \\init\\\n WHILE \\countW < n \n INV \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\)\\\n DO\n \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\) \\ \\countW < n\\ \\ \\A1\\\n <\\hW \\\\<^sub>2 H\\\\> ;; \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n <\\tW \\\\<^sub>2 T\\\\> ;;\n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n IF \\grd1 \\ \\A2\\\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\ \\ \\A3\\\n 2 0 \\\\> ;; \\ \\This might not need to be releasing\\ \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if 0\\ x \\ x < (\\Data \\countW) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \n IF \\grd2\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd2\\ \\ \\A4\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \\\\grd2\\\n IF \\grd3\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\ \\A5\\\n IF \\grd4\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd4 \\ \\ \\A6\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\\\grd4 \\\n IF \\grd5\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd5 \\ \\ \\A7\\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if ((0 \\ x \\ x < (\\Data \\countW))\\ x\\T)\\x\\N then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\ \\ \\A8\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n FI;;\n \\ global \\\\ \\ \\collection \n \\ ((\\oom=False \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\ ) \\ \\\\ \\hW + \\Data (\\countW) \\ N\\ \n \\ (\\oom=True \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word)) \\ \\countW < n\\\n IF \\oom=True\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word \\ \\countW < n\\ \\ \\OK\\\n SKIP\n ELSE \\ global \\\\ \\ \\collection \\ \\countW < n \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\\\\n \\\\q := \\q @ [(\\hW, (\\Data \\countW))],, \n \\ownD := (\\ x. if x = \\countW then B else \\ownD x),, \n \\ownB := (\\ x. if (\\ownB x = W) then Q else \\ownB x),, \n \\countW := (\\countW+1)\\ \n FI\n OD \n \\ global \\\\ \\ \\collection \\ \\countW = n\\\n\n\\\n \\ global \\\\ \\ \\collection \\ \\tempR = (0, 0) \\\n WHILE \\countR < n\n INV \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\\n DO \\ global \\\\ \\ \\collection \\ \\countR < n \\ \\tempR=(0,0) \\\n IF \\countR < \\countW THEN\n \\ global \\\\ \\ \\collection \\ \\countR < \\countW \\ \\tempR=(0,0) \\ \\ \\retrieve from Q, dequeue\\\n \\ \\tempR := (fst(hd \\q),(snd(hd \\q))) ,, \n \\ownD := (\\ x. if x = \\countR then R else \\ownD x),, \n \\countR := \\countR+1,, \n ( IF \\i.(i<(fst(hd \\q)+snd(hd \\q)) \\ [T =\\<^sub>3 i] \\\\) THEN (\\ownB := ( \\ x. if i \\ x \\ x < (fst(hd \\q)+(snd(hd \\q))) then R else \\ownB x ))\n ELSE (\\ownB := ( \\ x. if i > x \\ x \\ (fst(hd \\q)+(snd(hd \\q)))\\(x=N) then \\ownB x else R ))FI),, \n \\q := (tl \\q) \\;;\n \\ global \\\\ \\\\collection \\ \\countR \\ \\countW \\ \\tempR\\(0,0)\\ \\ \\Push T\\\n \\3 (fst \\tempR + snd \\tempR) \\\\ > \n ,, \\ tempR := (0,0),, \n \\ownB := (\\ x. if \\ownB x = R then B else \\ownD x) \\\n ELSE\n \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\ \\countR < n\\\n SKIP\n FI\n OD\n\\ global \\\\ \\ \\collection \\ \\countR = n\\\n\n\n\nCOEND\n \\ global \\\\ \\ \\collection \\ \\countW = n \\ \\countR = n\\\n \n\n\"\n apply (oghoare)\n apply ((simp add: main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff; force)+)[4]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply (metis OpSem_ProofRules.d_obs_read_value OpSem_ProofRules.ext_d_obs_rd_pres d_obs_implies_p_obs le_less_linear)\n apply auto[1]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply clarsimp\n apply (meson not_less not_pobs_contradiction)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n using pval_val apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis (no_types, lifting) Suc_diff_le d_obs_implies_p_obs fst_eqD le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply clarsimp\n apply (simp_all add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)\n (*129*)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred hd_conv_nth length_0_conv length_tl less_numeral_extra(3) nat.inject nth_tl snd_conv zero_less_diff)\n apply clarify\n using pval_val apply auto[1]\n using OpSem_ProofRules.p_obs_contradiction apply blast\n apply clarify\n apply linarith\n apply (metis (no_types, lifting) less_numeral_extra(3) )\n using pval_val apply auto[1]\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply blast\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply blast\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (meson not_less not_pobs_contradiction)\n apply (meson not_less not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n by simp\n\n\n\n\n\n\n\n\n(*(simp add: Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff )?)*)", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RB_Relaxed_mike.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2806975974005948}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Lookups_D\nimports\n \"DSpec.Syscall_D\"\n \"Lib.OptionMonadND\"\nbegin\n\ntype_synonym 'a lookup = \"cdl_state \\ 'a option\"\n\ndefinition\n opt_cnode :: \"cdl_object_id \\ cdl_cnode lookup\"\nwhere\n \"opt_cnode p \\ DO\n t \\ \\s. cdl_objects s p;\n case t of\n CNode cnode \\ oreturn cnode\n | _ \\ ofail\n OD\"\n\nfunction resolve_cap ::\n \"cdl_cap \\ cdl_cptr \\ nat \\ (cdl_fault_error + cdl_cap_ref \\ nat) lookup\"\nwhere\n \"resolve_cap cnode_cap cap_ptr remaining_size =\n (if is_cnode_cap cnode_cap\n then DO\n \\ \\Fetch the next level CNode.\\\n cnode \\ opt_cnode $ cap_object cnode_cap;\n radix_size \\ oreturn $ cdl_cnode_size_bits cnode;\n guard_size \\ oreturn $ cap_guard_size cnode_cap;\n cap_guard \\ oreturn $ cap_guard cnode_cap;\n level_size \\ oreturn (radix_size + guard_size);\n oassert (level_size \\ 0);\n\n \\ \\Ensure the guard matches up.\\\n guard \\ oreturn $ (cap_ptr >> (remaining_size-guard_size)) && (mask guard_size);\n if \\(guard_size \\ remaining_size \\ guard = cap_guard) \\\n level_size > remaining_size\n then othrow FaultError\n else DO\n \\ \\Find the next slot.\\\n offset \\ oreturn $ (cap_ptr >> (remaining_size-level_size)) && (mask radix_size);\n slot \\ oreturn (cap_object cnode_cap, unat offset);\n size_left \\ oreturn (remaining_size - level_size);\n if size_left = 0 then\n oreturnOk (slot, 0)\n else DO\n next_cap \\ opt_cap slot;\n if is_cnode_cap next_cap then\n resolve_cap next_cap cap_ptr size_left\n else\n oreturnOk (slot, size_left)\n OD\n OD\n OD\n else othrow FaultError)\"\n by auto\n\ntermination\n by (relation \"measure (\\(a,b,c). c)\") auto\n\ndeclare resolve_cap.simps [simp del]\n\ndeclare resolve_address_bits.simps [simp del]\n\nlemma throwError_FaultError [simp]:\n \"throwError FaultError = throw\"\n apply (cases \"undefined::cdl_fault_error\")\n apply simp\n done\n\nlemma gets_the_get_cnode:\n \"gets_the (opt_cnode r) = get_cnode r\"\n apply (simp add: get_cnode_def opt_cnode_def)\n apply (rule bind_cong, rule refl)\n apply (clarsimp split: cdl_object.splits)\n done\n\nlemma gets_the_resolve_cap:\n \"gets_the (resolve_cap cnode_cap cap_ptr remaining_size) =\n resolve_address_bits cnode_cap cap_ptr remaining_size\"\n apply (induct cnode_cap cap_ptr remaining_size rule: resolve_cap.induct [simplified])\n apply (subst resolve_cap.simps)\n apply (subst resolve_address_bits.simps)\n apply (clarsimp simp: unlessE_def liftE_bindE assertE_liftE gets_the_get_cnode)\n apply (rule bind_cong, rule refl)\n apply (rule bind_apply_cong, rule refl)\n apply (clarsimp simp: liftE_bindE)\n apply (rule bind_apply_cong, rule refl)\n apply (clarsimp simp: in_monad gets_the_get_cnode [symmetric])\n done\n\ndefinition resolve_address_bits' ::\n \"cdl_cap \\ cdl_cptr \\ nat \\ (cdl_cap_ref \\ nat) lookup\"\nwhere\n \"resolve_address_bits' cap cptr n \\ odrop $ resolve_cap cap cptr n\"\n\n\n\ndefinition\n lookup_slot' :: \"cdl_object_id \\ cdl_cptr \\ cdl_cap_ref lookup\"\nwhere\n \"lookup_slot' thread cptr \\\n DO\n cspace_root \\ opt_cap (thread, tcb_cspace_slot);\n (slot, _) \\ resolve_address_bits' cspace_root cptr word_bits;\n oreturn slot\n OD\"\n\ndefinition\n lookup_cap' :: \"cdl_object_id \\ cdl_cptr \\ cdl_cap lookup\"\nwhere\n \"lookup_cap' thread cptr \\\n DO\n slot \\ lookup_slot' thread cptr;\n opt_cap slot\n OD\"\n\ndefinition\n lookup_cap_and_slot' :: \"cdl_object_id \\ cdl_cptr \\ (cdl_cap \\ cdl_cap_ref) lookup\"\nwhere\n \"lookup_cap_and_slot' thread cptr \\\n DO\n slot \\ lookup_slot' thread cptr;\n cap \\ opt_cap slot;\n oreturn (cap, slot)\n OD\"\n\ndefinition\n lookup_object :: \"cdl_object_id \\ cdl_cptr \\ cdl_object_id lookup\"\nwhere\n \"lookup_object thread cptr \\\n DO\n cap \\ lookup_cap' thread cptr;\n oreturn $ cap_object cap\n OD\"\n\ndefinition\n lookup_extra_caps' :: \"cdl_object_id \\ cdl_cptr list \\ (cdl_cap \\ cdl_cap_ref) list lookup\"\nwhere\n \"lookup_extra_caps' thread cptrs \\\n omap (\\cptr. lookup_cap_and_slot' thread cptr) cptrs\"\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/sep-capDL/Lookups_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.28065257645652486}} {"text": "theory \"FMap-Utils\"\nimports \"FMap-Nominal-HOLCF\" \"HOLCF-Fix-Join-Nominal\" \"DistinctVars\"\nbegin\n\ndefault_sort type\n\ntext {* Lemmas relating @{theory FMap} to the other auxiliary theories. *}\n\nlemma fdom_fix_join_compat:\n assumes \"fix_on_cond S (bottom_of S) (\\\\'. \\ \\ F \\')\"\n assumes \"\\' \\ fix_join_compat \\ F\"\n shows \"fdom \\' = fdom \\\"\n by (metis assms(2) bottom_of_fjc fmap_below_dom subpcpo.bottom_of_minimal subpcpo_fjc to_bot_minimal)\n\nlemma sharp_star_Env': \"atom ` heapVars \\ \\* (\\ :: 'var::{cont_pt,at_base} f\\ 'value::{pure_cpo,Nonempty_Meet_cpo,pcpo}) \\ heapVars \\ \\ fdom \\ = {}\"\n by(induct \\, auto simp add: fresh_star_def sharp_Env)\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/FMap-Utils.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.2804854316240221}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"64-Bit Machine Word Setup\"\n\ntheory Machine_Word_64\nimports Machine_Word_64_Basics More_Word Bit_Shifts_Infix_Syntax Rsplit\nbegin\n\ncontext\n includes bit_operations_syntax\nbegin\n\ntype_synonym machine_word = \\machine_word_len word\\\n\nlemma word_bits_len_of:\n \\LENGTH(machine_word_len) = word_bits\\\n by (simp add: word_bits_conv)\n\nlemma word_bits_size:\n \"size (w :: machine_word) = word_bits\"\n by (simp add: word_bits_def word_size)\n\nlemma word_bits_word_size_conv:\n \\word_bits = word_size * 8\\\n by (simp add: word_bits_def word_size_def)\n\nlemma word_size_word_size_bits:\n \\word_size = (2 :: 'a :: semiring_1) ^ word_size_bits\\\n by (simp add: word_size_def word_size_bits_def)\n\nlemma lt_word_bits_lt_pow:\n \"sz < word_bits \\ sz < 2 ^ word_bits\"\n by (simp add: word_bits_conv)\n\nlemma if_then_1_else_0:\n \"((if P then 1 else 0) = (0 :: machine_word)) = (\\ P)\"\n by simp\n\nlemma if_then_0_else_1:\n \"((if P then 0 else 1) = (0 :: machine_word)) = (P)\"\n by simp\n\nlemmas if_then_simps = if_then_0_else_1 if_then_1_else_0\n\nlemma bool_mask [simp]:\n \\0 < x AND 1 \\ x AND 1 = 1\\ for x :: machine_word\n by (rule bool_mask') auto\n\nlemma in_16_range:\n \"0 \\ S \\ r \\ (\\x. r + x * (16 :: machine_word)) ` S\"\n \"n - 1 \\ S \\ (r + (16 * n - 16)) \\ (\\x :: machine_word. r + x * 16) ` S\"\n by (clarsimp simp: image_def elim!: bexI[rotated])+\n\nlemma le_step_down_word_3:\n fixes x :: machine_word\n shows \"\\x \\ y; x \\ y\\ \\ x \\ y - 1\"\n by (fact le_step_down_word_2)\n\nlemma shiftr_1:\n \"(x::machine_word) >> 1 = 0 \\ x < 2\"\n apply transfer\n apply (simp add: take_bit_drop_bit)\n apply (simp add: drop_bit_Suc)\n done\n\nlemma Suc_unat_mask_div:\n \"Suc (unat (mask sz div word_size :: machine_word)) = 2 ^ (min sz word_bits - word_size_bits)\"\n by (simp add: word_size_word_size_bits unat_drop_bit_eq unat_mask_eq drop_bit_mask_eq Suc_mask_eq_exp\n flip: drop_bit_eq_div word_bits_conv)\n\nlemma ucast_not_helper:\n fixes a::\"8 word\"\n assumes a: \"a \\ 0xFF\"\n shows \"ucast a \\ (0xFF::machine_word)\"\nproof\n assume \"ucast a = (0xFF::machine_word)\"\n also\n have \"(0xFF::machine_word) = ucast (0xFF::8 word)\" by simp\n finally\n show False using a\n apply -\n apply (drule up_ucast_inj, simp)\n apply simp\n done\nqed\n\nlemma unat_less_2p_word_bits:\n \"unat (x :: machine_word) < 2 ^ word_bits\"\n apply (simp only: word_bits_def)\n apply (rule unat_lt2p)\n done\n\nlemma unat_less_word_bits:\n fixes y :: machine_word\n shows \"x < unat y \\ x < 2 ^ word_bits\"\n unfolding word_bits_def\n by (rule order_less_trans [OF _ unat_lt2p])\n\nlemma unat_mask_2_less_4:\n \"unat (p AND mask 2 :: machine_word) < 4\"\n by (rule unat_less_helper) (simp only: take_bit_eq_mod word_mod_less_divisor flip: take_bit_eq_mask, simp add: word_mod_less_divisor)\n\nlemma unat_mult_simple:\n \\unat (x * y) = unat x * unat y\\\n if \\unat x * unat y < 2 ^ LENGTH(machine_word_len)\\\n for x y :: machine_word\n using that by (simp flip: unat_mult_lem)\n\nlemma upto_2_helper:\n \"{0..<2 :: machine_word} = {0, 1}\"\n by (safe; simp) unat_arith\n\nlemma word_ge_min:\n \\- (2 ^ (word_bits - 1)) \\ sint x\\ for x :: machine_word\n using sint_ge [of x] by (simp add: word_bits_def)\n\nlemma word_rsplit_0:\n \"word_rsplit (0 :: machine_word) = replicate (word_bits div 8) (0 :: 8 word)\"\n by (simp add: word_rsplit_def bin_rsplit_def word_bits_def word_size_def Cons_replicate_eq)\n\nlemma x_less_2_0_1:\n fixes x :: machine_word\n shows \"x < 2 \\ x = 0 \\ x = 1\"\n by (rule x_less_2_0_1') auto\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Word_Lib/Machine_Word_64.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.28048542561608797}} {"text": "(* Title: HOL/Auth/Guard/Guard_Yahalom.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\Yahalom Protocol\\\n\ntheory Guard_Yahalom imports \"../Shared\" Guard_Shared begin\n\nsubsection\\messages used in the protocol\\\n\nabbreviation (input)\n ya1 :: \"agent => agent => nat => event\" where\n \"ya1 A B NA == Says A B \\Agent A, Nonce NA\\\"\n\nabbreviation (input)\n ya1' :: \"agent => agent => agent => nat => event\" where\n \"ya1' A' A B NA == Says A' B \\Agent A, Nonce NA\\\"\n\nabbreviation (input)\n ya2 :: \"agent => agent => nat => nat => event\" where\n \"ya2 A B NA NB == Says B Server \\Agent B, Ciph B \\Agent A, Nonce NA, Nonce NB\\\\\"\n\nabbreviation (input)\n ya2' :: \"agent => agent => agent => nat => nat => event\" where\n \"ya2' B' A B NA NB == Says B' Server \\Agent B, Ciph B \\Agent A, Nonce NA, Nonce NB\\\\\"\n\nabbreviation (input)\n ya3 :: \"agent => agent => nat => nat => key => event\" where\n \"ya3 A B NA NB K ==\n Says Server A \\Ciph A \\Agent B, Key K, Nonce NA, Nonce NB\\,\n Ciph B \\Agent A, Key K\\\\\"\n\nabbreviation (input)\n ya3':: \"agent => msg => agent => agent => nat => nat => key => event\" where\n \"ya3' S Y A B NA NB K ==\n Says S A \\Ciph A \\Agent B, Key K, Nonce NA, Nonce NB\\, Y\\\"\n\nabbreviation (input)\n ya4 :: \"agent => agent => nat => nat => msg => event\" where\n \"ya4 A B K NB Y == Says A B \\Y, Crypt K (Nonce NB)\\\"\n\nabbreviation (input)\n ya4' :: \"agent => agent => nat => nat => msg => event\" where\n \"ya4' A' B K NB Y == Says A' B \\Y, Crypt K (Nonce NB)\\\"\n\n\nsubsection\\definition of the protocol\\\n\ninductive_set ya :: \"event list set\"\nwhere\n\n Nil: \"[]:ya\"\n\n| Fake: \"[| evs:ya; X:synth (analz (spies evs)) |] ==> Says Spy B X # evs:ya\"\n\n| YA1: \"[| evs1:ya; Nonce NA ~:used evs1 |] ==> ya1 A B NA # evs1:ya\"\n\n| YA2: \"[| evs2:ya; ya1' A' A B NA:set evs2; Nonce NB ~:used evs2 |]\n ==> ya2 A B NA NB # evs2:ya\"\n\n| YA3: \"[| evs3:ya; ya2' B' A B NA NB:set evs3; Key K ~:used evs3 |]\n ==> ya3 A B NA NB K # evs3:ya\"\n\n| YA4: \"[| evs4:ya; ya1 A B NA:set evs4; ya3' S Y A B NA NB K:set evs4 |]\n ==> ya4 A B K NB Y # evs4:ya\"\n\nsubsection\\declarations for tactics\\\n\ndeclare knows_Spy_partsEs [elim]\ndeclare Fake_parts_insert [THEN subsetD, dest]\ndeclare initState.simps [simp del]\n\nsubsection\\general properties of ya\\\n\nlemma ya_has_no_Gets: \"evs:ya ==> ALL A X. Gets A X ~:set evs\"\nby (erule ya.induct, auto)\n\nlemma ya_is_Gets_correct [iff]: \"Gets_correct ya\"\nby (auto simp: Gets_correct_def dest: ya_has_no_Gets)\n\nlemma ya_is_one_step [iff]: \"one_step ya\"\nby (unfold one_step_def, clarify, ind_cases \"ev#evs:ya\" for ev evs, auto)\n\nlemma ya_has_only_Says' [rule_format]: \"evs:ya ==>\nev:set evs --> (EX A B X. ev=Says A B X)\"\nby (erule ya.induct, auto)\n\nlemma ya_has_only_Says [iff]: \"has_only_Says ya\"\nby (auto simp: has_only_Says_def dest: ya_has_only_Says')\n\nlemma ya_is_regular [iff]: \"regular ya\"\napply (simp only: regular_def, clarify)\napply (erule ya.induct, simp_all add: initState.simps knows.simps)\nby (auto dest: parts_sub)\n\nsubsection\\guardedness of KAB\\\n\nlemma Guard_KAB [rule_format]: \"[| evs:ya; A ~:bad; B ~:bad |] ==>\nya3 A B NA NB K:set evs --> GuardK K {shrK A,shrK B} (spies evs)\" \napply (erule ya.induct)\n(* Nil *)\napply simp_all\n(* Fake *)\napply (clarify, erule in_synth_GuardK, erule GuardK_analz, simp)\n(* YA1 *)\n(* YA2 *)\napply safe\napply (blast dest: Says_imp_spies)\n(* YA3 *)\napply blast\napply (drule_tac A=Server in Key_neq, simp+, rule No_Key, simp)\napply (drule_tac A=Server in Key_neq, simp+, rule No_Key, simp)\n(* YA4 *)\napply (blast dest: Says_imp_spies in_GuardK_kparts)\nby blast\n\nsubsection\\session keys are not symmetric keys\\\n\nlemma KAB_isnt_shrK [rule_format]: \"evs:ya ==>\nya3 A B NA NB K:set evs --> K ~:range shrK\"\nby (erule ya.induct, auto)\n\nlemma ya3_shrK: \"evs:ya ==> ya3 A B NA NB (shrK C) ~:set evs\"\nby (blast dest: KAB_isnt_shrK)\n\nsubsection\\ya2' implies ya1'\\\n\nlemma ya2'_parts_imp_ya1'_parts [rule_format]:\n \"[| evs:ya; B ~:bad |] ==>\n Ciph B \\Agent A, Nonce NA, Nonce NB\\:parts (spies evs) -->\n \\Agent A, Nonce NA\\:spies evs\"\nby (erule ya.induct, auto dest: Says_imp_spies intro: parts_parts)\n\nlemma ya2'_imp_ya1'_parts: \"[| ya2' B' A B NA NB:set evs; evs:ya; B ~:bad |]\n==> \\Agent A, Nonce NA\\:spies evs\"\nby (blast dest: Says_imp_spies ya2'_parts_imp_ya1'_parts)\n\nsubsection\\uniqueness of NB\\\n\nlemma NB_is_uniq_in_ya2'_parts [rule_format]: \"[| evs:ya; B ~:bad; B' ~:bad |] ==>\nCiph B \\Agent A, Nonce NA, Nonce NB\\:parts (spies evs) -->\nCiph B' \\Agent A', Nonce NA', Nonce NB\\:parts (spies evs) -->\nA=A' & B=B' & NA=NA'\"\napply (erule ya.induct, simp_all, clarify)\napply (drule Crypt_synth_insert, simp+)\napply (drule Crypt_synth_insert, simp+, safe)\napply (drule not_used_parts_false, simp+)+\nby (drule Says_not_parts, simp+)+\n\nlemma NB_is_uniq_in_ya2': \"[| ya2' C A B NA NB:set evs;\nya2' C' A' B' NA' NB:set evs; evs:ya; B ~:bad; B' ~:bad |]\n==> A=A' & B=B' & NA=NA'\"\nby (drule NB_is_uniq_in_ya2'_parts, auto dest: Says_imp_spies)\n\nsubsection\\ya3' implies ya2'\\\n\nlemma ya3'_parts_imp_ya2'_parts [rule_format]: \"[| evs:ya; A ~:bad |] ==>\nCiph A \\Agent B, Key K, Nonce NA, Nonce NB\\:parts (spies evs)\n--> Ciph B \\Agent A, Nonce NA, Nonce NB\\:parts (spies evs)\"\napply (erule ya.induct, simp_all)\napply (clarify, drule Crypt_synth_insert, simp+)\napply (blast intro: parts_sub, blast)\nby (auto dest: Says_imp_spies parts_parts)\n\nlemma ya3'_parts_imp_ya2' [rule_format]: \"[| evs:ya; A ~:bad |] ==>\nCiph A \\Agent B, Key K, Nonce NA, Nonce NB\\:parts (spies evs)\n--> (EX B'. ya2' B' A B NA NB:set evs)\"\napply (erule ya.induct, simp_all, safe)\napply (drule Crypt_synth_insert, simp+)\napply (drule Crypt_synth_insert, simp+, blast)\napply blast\napply blast\nby (auto dest: Says_imp_spies2 parts_parts)\n\nlemma ya3'_imp_ya2': \"[| ya3' S Y A B NA NB K:set evs; evs:ya; A ~:bad |]\n==> (EX B'. ya2' B' A B NA NB:set evs)\"\nby (drule ya3'_parts_imp_ya2', auto dest: Says_imp_spies)\n\nsubsection\\ya3' implies ya3\\\n\nlemma ya3'_parts_imp_ya3 [rule_format]: \"[| evs:ya; A ~:bad |] ==>\nCiph A \\Agent B, Key K, Nonce NA, Nonce NB\\:parts(spies evs)\n--> ya3 A B NA NB K:set evs\"\napply (erule ya.induct, simp_all, safe)\napply (drule Crypt_synth_insert, simp+)\nby (blast dest: Says_imp_spies2 parts_parts)\n\nlemma ya3'_imp_ya3: \"[| ya3' S Y A B NA NB K:set evs; evs:ya; A ~:bad |]\n==> ya3 A B NA NB K:set evs\"\nby (blast dest: Says_imp_spies ya3'_parts_imp_ya3)\n\nsubsection\\guardedness of NB\\\n\ndefinition ya_keys :: \"agent => agent => nat => nat => event list => key set\" where\n\"ya_keys A B NA NB evs == {shrK A,shrK B} Un {K. ya3 A B NA NB K:set evs}\"\n\nlemma Guard_NB [rule_format]: \"[| evs:ya; A ~:bad; B ~:bad |] ==>\nya2 A B NA NB:set evs --> Guard NB (ya_keys A B NA NB evs) (spies evs)\"\napply (erule ya.induct)\n(* Nil *)\napply (simp_all add: ya_keys_def)\n(* Fake *)\napply safe\napply (erule in_synth_Guard, erule Guard_analz, simp, clarify)\napply (frule_tac B=B in Guard_KAB, simp+)\napply (drule_tac p=ya in GuardK_Key_analz, simp+)\napply (blast dest: KAB_isnt_shrK, simp)\n(* YA1 *)\napply (drule_tac n=NB in Nonce_neq, simp+, rule No_Nonce, simp)\n(* YA2 *)\napply blast\napply (drule Says_imp_spies)\napply (drule_tac n=NB in Nonce_neq, simp+)\napply (drule_tac n'=NAa in in_Guard_kparts_neq, simp+)\napply (rule No_Nonce, simp)\n(* YA3 *)\napply (rule Guard_extand, simp, blast)\napply (case_tac \"NAa=NB\", clarify)\napply (frule Says_imp_spies)\napply (frule in_Guard_kparts_Crypt, simp+)\napply (frule_tac A=A and B=B and NA=NA and NB=NB and C=Ba in ya3_shrK, simp)\napply (drule ya2'_imp_ya1'_parts, simp, blast, blast)\napply (case_tac \"NBa=NB\", clarify)\napply (frule Says_imp_spies)\napply (frule in_Guard_kparts_Crypt, simp+)\napply (frule_tac A=A and B=B and NA=NA and NB=NB and C=Ba in ya3_shrK, simp)\napply (drule NB_is_uniq_in_ya2', simp+, blast, simp+)\napply (simp add: No_Nonce, blast)\n(* YA4 *)\napply (blast dest: Says_imp_spies)\napply (case_tac \"NBa=NB\", clarify)\napply (frule_tac A=S in Says_imp_spies)\napply (frule in_Guard_kparts_Crypt, simp+)\napply (blast dest: Says_imp_spies)\napply (case_tac \"NBa=NB\", clarify)\napply (frule_tac A=S in Says_imp_spies)\napply (frule in_Guard_kparts_Crypt, simp+, blast, simp+)\napply (frule_tac A=A and B=B and NA=NA and NB=NB and C=Aa in ya3_shrK, simp)\napply (frule ya3'_imp_ya2', simp+, blast, clarify)\napply (frule_tac A=B' in Says_imp_spies)\napply (rotate_tac -1, frule in_Guard_kparts_Crypt, simp+)\napply (frule_tac A=A and B=B and NA=NA and NB=NB and C=Ba in ya3_shrK, simp)\napply (drule NB_is_uniq_in_ya2', simp+, blast, clarify)\napply (drule ya3'_imp_ya3, simp+)\napply (simp add: Guard_Nonce)\napply (simp add: No_Nonce)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/Guard_Yahalom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.2804747069440569}} {"text": "theory Memory_Allocation_Security\nimports Memory_Allocation_Model Memory_Allocation_Invariant SK_SecurityModel\nbegin\n\nsubsection \\Memory Execution Model\\\n\ntype_synonym partition_id = nat\ntype_synonym partition_name = string\ndatatype Partition_Conf = PartConf partition_id partition_name\ntype_synonym Partitions = \"partition_id \\ Partition_Conf\"\n\ntype_synonym domain_id = nat\ntype_synonym Mem_Add = \"ID set\"\ntype_synonym Partition_Mem = \"partition_id \\ Mem_Add\"\n\nrecord Sys_Config = partconf :: Partitions\n scheduler :: domain_id\n\nrecord State = current :: domain_id \n partitionmem :: Partition_Mem\n mempools :: \"Pool set\"\n memids :: \"ID set\"\n\ndatatype Hypercall = Buddy_Memory_Alloc Pool nat |\n Buddy_Memory_Free Pool Block\ndatatype System_Event = Schedule\ndatatype Event = hyperc Hypercall | sys System_Event\n\nprimrec get_partname_by_type :: \"Partition_Conf \\ partition_name\"\n where \"get_partname_by_type (PartConf _ pn) = pn\"\n \nprimrec get_partid_by_type :: \"Partition_Conf \\ partition_id\"\n where \"get_partid_by_type (PartConf pid _) = pid\"\n\ndefinition is_a_partition :: \"Sys_Config \\ domain_id \\ bool\"\n where \"is_a_partition sc nid \\ (partconf sc) nid \\ None\"\n\ndefinition is_a_scheduler :: \"Sys_Config \\ domain_id \\ bool\"\n where \"is_a_scheduler sc nid \\ (scheduler sc) = nid\"\n\ndefinition get_partconf_byid :: \"Sys_Config \\ partition_id \\ Partition_Conf option\"\n where \"get_partconf_byid sc pid \\ (partconf sc) pid\"\n\ndefinition get_partmem_byid :: \"State \\ partition_id \\ Mem_Add option\"\n where \"get_partmem_byid s pid \\ (partitionmem s) pid\"\n\ndefinition alloc_memory :: \"Sys_Config \\ State \\ Pool \\ nat \\ State\"\n where \"alloc_memory sc s po lv \\\n (if get_partconf_byid sc (current s) \\ None then\n (let partmem = get_partmem_byid s (current s);\n re = alloc (zerolevelblocks po) lv (memids s) in\n (if fst (snd (snd re)) = True then\n s\\partitionmem := (partitionmem s)(current s := Some (the partmem \\ (snd (snd (snd re))))),\n mempools := (mempools s - {po}) \\ {po\\zerolevelblocks := fst re\\},\n memids := fst (snd re)\\\n else s))\n else s)\"\n\ndefinition free_memory :: \"Sys_Config \\ State \\ Pool \\ Block \\ State\"\n where \"free_memory sc s po b \\\n let partmem = get_partmem_byid s (current s) in\n (if get_partconf_byid sc (current s) \\ None \\ partmem \\ None then\n (let re = free (zerolevelblocks po) b (memids s) in\n (if snd (snd re) = True then\n s\\partitionmem := (partitionmem s)(current s := Some (the partmem - {snd (L b)} )),\n mempools := (mempools s - {po}) \\ {po\\zerolevelblocks := fst re\\},\n memids := fst (snd re)\\\n else s))\n else s)\"\n\ndefinition schedule :: \"Sys_Config \\ State \\ State set\" where\n \"schedule sc s \\ {s\\current:= SOME p. p\\{x. (partconf sc) x \\ None}\\}\"\n\ndefinition sys_config_witness :: Sys_Config \n where \"sys_config_witness \\ \\partconf = Map.empty,\n scheduler = 0\\\"\n\nconsts sysconf :: \"Sys_Config\"\nspecification(sysconf)\n part_id_conf: \"\\p. (partconf sysconf) p \\ None \\ get_partid_by_type (the ((partconf sysconf) p)) = p\"\n part_not_sch: \"(partconf sysconf) x \\ None \\ x \\ scheduler sysconf\"\n sch_not_part: \"scheduler sysconf = x \\ (partconf sysconf) x = None\"\n by (metis Sys_Config.select_convs(1) sys_config_witness_def)\n\ndefinition state_witness :: State\n where \"state_witness \\ \\current = (SOME x. (partconf sysconf) x \\ None),\n partitionmem = (\\ p. (case ((partconf sysconf) p) of None \\ None\n | Some (PartConf _ _) \\ Some {})),\n mempools = {},\n memids = {}\\\"\n\nconsts s0t :: State\nspecification(s0t)\n s0t_init: \"s0t = state_witness\"\n by simp\n\nprimrec event_enabled :: \"State \\ Event \\ bool\"\n where \"event_enabled s (hyperc h) = (is_a_partition sysconf (current s))\" |\n \"event_enabled s (sys h) = (case h of Schedule \\ True)\" \n\ndefinition exec_event :: \"Event \\ (State \\ State) set\"\n where \"exec_event e = {(s, s'). s' \\ (if event_enabled s e then\n (case e of hyperc (Buddy_Memory_Alloc po lv) \\ {(alloc_memory sysconf s po lv)} |\n hyperc (Buddy_Memory_Free po b) \\ {(free_memory sysconf s po b)} |\n sys Schedule \\ schedule sysconf s)\n else {s})}\"\n\nprimrec domain_of_event :: \"State \\ Event \\ domain_id option\"\nwhere \"domain_of_event s (hyperc h) = Some (current s)\" |\n \"domain_of_event s (sys h) = Some (scheduler sysconf)\"\n\ndefinition interference1 :: \"domain_id \\ domain_id \\ bool\" (\"(_ \\ _)\")\n where \"interference1 d1 d2 \\\n if d1 = d2 then True\n else if is_a_scheduler sysconf d1 then True\n else False\"\n\ndefinition non_interference1 :: \"domain_id \\ domain_id \\ bool\" (\"(_ \\\\ _)\")\n where \"(u \\\\ v) \\ \\ (u \\ v)\"\n\ndeclare non_interference1_def [cong] and interference1_def [cong] and domain_of_event_def[cong] and\n event_enabled_def[cong] and is_a_partition_def[cong] and is_a_scheduler_def[cong]\n\nlemma nintf_neq: \"u \\\\ v \\ u \\ v\" by auto\n\nlemma nintf_reflx: \"interference1 u u\" by auto\n\ndefinition vpeq_part :: \"State \\ partition_id \\ State \\ bool\"\n where \"vpeq_part s d t \\ (partitionmem s) d = (partitionmem t) d\"\n\ndefinition vpeq_sched :: \"State \\ domain_id \\ State \\ bool\"\n where \"vpeq_sched s d t \\ current s = current t\"\n\ndefinition vpeq1 :: \"State \\ domain_id \\ State \\ bool\" (\"(_ \\ _ \\ _)\") \n where \"vpeq1 s d t \\ \n (if d = scheduler sysconf then \n (vpeq_sched s d t)\n else if is_a_partition sysconf d then \n (vpeq_part s d t)\n else True)\"\n\ndeclare vpeq_part_def [cong] and vpeq_sched_def[cong] and vpeq1_def[cong] \n\nlemma vpeq_part_transitive_lemma : \"\\ s t r d. vpeq_part s d t \\ vpeq_part t d r \\ vpeq_part s d r\"\n by auto\n\nlemma vpeq_part_symmetric_lemma:\"\\ s t d. vpeq_part s d t \\ vpeq_part t d s\"\n by auto\n\nlemma vpeq_part_reflexive_lemma:\"\\ s d. vpeq_part s d s\"\n by auto\n\nlemma vpeq_scheduler_transitive_lemma : \"\\ s t r d. vpeq_sched s d t \\ vpeq_sched t d r \\ vpeq_sched s d r\"\n by simp\n\nlemma vpeq_scheduler_symmetric_lemma:\"\\ s t d. vpeq_sched s d t \\ vpeq_sched t d s\"\n by simp\n\nlemma vpeq_scheduler_reflexive_lemma:\"\\ s d. vpeq_sched s d s\"\n by simp\n\nlemma vpeq1_transitive_lemma : \"\\ s t r d. (vpeq1 s d t) \\ (vpeq1 t d r) \\ (vpeq1 s d r)\"\n by auto\n\nlemma vpeq1_symmetric_lemma : \"\\ s t d. (vpeq1 s d t) \\ (vpeq1 t d s)\"\n by auto\n\nlemma vpeq1_reflexive_lemma : \"\\ s d. (vpeq1 s d s)\"\n by auto\n\nlemma sched_current_lemma : \"\\s t a. vpeq1 s (scheduler sysconf) t \\ (domain_of_event s a) = (domain_of_event t a)\"\n by (metis (no_types) Event.exhaust domain_of_event.simps(1) domain_of_event.simps(2) vpeq1_def vpeq_sched_def)\n \nlemma schedeler_intf_all_help : \"\\d. interference1 (scheduler sysconf) d\"\n by (meson interference1_def is_a_scheduler_def)\n\nlemma no_intf_sched_help : \"\\d. interference1 d (scheduler sysconf) \\ d = (scheduler sysconf)\"\n by (simp add: interference1_def is_a_scheduler_def)\n\nlemma reachable_top: \"\\s a. (SM.reachable0 s0t exec_event) s \\ (\\s'. (s, s') \\ exec_event a)\"\n proof -\n {\n fix s a\n assume p0: \"(SM.reachable0 s0t exec_event) s\"\n have \"\\s'. (s, s') \\ exec_event a\"\n proof(induct a)\n case (hyperc x) show ?case \n apply (induct x)\n by (simp add:exec_event_def)+\n next\n case (sys x) then show ?case\n apply (induct x)\n by (simp add:exec_event_def schedule_def)+\n qed \n }\n then show ?thesis by auto\n qed\n\ninterpretation SM_enabled\n s0t exec_event domain_of_event \"scheduler sysconf\" vpeq1 interference1 \n using vpeq1_transitive_lemma vpeq1_symmetric_lemma vpeq1_reflexive_lemma sched_current_lemma\n schedeler_intf_all_help no_intf_sched_help reachable_top nintf_reflx\n SM.intro[of vpeq1 \"scheduler sysconf\" domain_of_event interference1]\n SM_enabled_axioms.intro [of s0t exec_event] \n SM_enabled.intro[of domain_of_event \"scheduler sysconf\" vpeq1 interference1 s0t exec_event] by blast\n\nsubsection \\Some lemmas of security proofs\\\n\nlemma sche_imp_not_part:\n \"is_a_scheduler sysconf d \\ \\ (is_a_partition sysconf d)\" \n using sch_not_part by auto\n\nlemma part_imp_not_sch:\n \"is_a_partition sysconf d \\ \\ (is_a_scheduler sysconf d)\"\n by (auto simp add: sch_not_part)\n\nsubsection \\proving \"allocate memory\" satisfying the \"local respect\" property\\\nlemma alloc_memory_notchg_current:\n \"\\is_a_partition sysconf (current s);\n s' = alloc_memory sysconf s po lv\\\n \\ current s = current s'\"\n by(clarsimp simp: alloc_memory_def get_partconf_byid_def get_partmem_byid_def Let_def)\n\nlemma alloc_memory_sm_sche:\n \"\\is_a_partition sysconf (current s);\n s' = alloc_memory sysconf s po lv\\\n \\ (s\\(scheduler sysconf)\\s')\"\n using alloc_memory_notchg_current part_imp_not_sch\n by(meson vpeq1_def vpeq_sched_def)\n\nlemma alloc_memory_notchg_partstate:\n \"\\is_a_partition sysconf (current s);\n is_a_partition sysconf d;\n d \\ current s;\n s' = alloc_memory sysconf s po lv\\\n \\ (partitionmem s) d = (partitionmem s') d\"\n by(clarsimp simp: alloc_memory_def get_partconf_byid_def get_partmem_byid_def Let_def)\n\nlemma alloc_memory_sm_nitfpart:\n \"\\reachable0 s;\n is_a_partition sysconf (current s);\n is_a_partition sysconf d;\n ((current s) \\\\ d);\n s' = alloc_memory sysconf s po lv\\\n \\ (s \\ d \\ s')\"\n using sche_imp_not_part \n apply(clarsimp cong del: is_a_partition_def interference1_def non_interference1_def)\n using nintf_neq alloc_memory_notchg_partstate by blast\n\nlemma alloc_memory_presrv_lcrsp:\n assumes p0:\"reachable0 s\"\n and p1:\"is_a_partition sysconf (current s)\"\n and p2:\"(current s) \\\\ d\"\n and p3:\"s' = alloc_memory sysconf s po lv\"\n shows \"s \\ d \\ s'\"\nproof(cases \"is_a_scheduler sysconf d\")\n assume a0:\"is_a_scheduler sysconf d\"\n then show ?thesis using is_a_scheduler_def alloc_memory_sm_sche[OF p1 p3] by auto\nnext\n assume a1:\"\\ is_a_scheduler sysconf d\"\n show ?thesis\n proof(cases \"is_a_partition sysconf d\")\n assume b0:\"is_a_partition sysconf d\"\n show ?thesis using b0 alloc_memory_sm_nitfpart p0 p1 p2 p3 by blast\n next\n assume b1:\"\\ is_a_partition sysconf d\"\n show ?thesis using a1 b1 by auto\n qed\nqed\n\nlemma alloc_memory_presrv_lcrsp_e:\n \"local_respect_e (hyperc (Buddy_Memory_Alloc po lv))\"\n using alloc_memory_presrv_lcrsp exec_event_def\n prod.simps(2) vpeq_reflexive_lemma\n by(auto cong del: vpeq1_def)\n\nsubsection \\proving \"free memory\" satisfying the \"local respect\" property\\\nlemma free_memory_notchg_current:\n \"\\is_a_partition sysconf (current s);\n s' = free_memory sysconf s po b\\\n \\ current s = current s'\"\n by(clarsimp simp: free_memory_def get_partconf_byid_def get_partmem_byid_def Let_def)\n\nlemma free_memory_sm_sche:\n \"\\is_a_partition sysconf (current s);\n s' = free_memory sysconf s po b\\\n \\ (s\\(scheduler sysconf)\\s')\"\n using free_memory_notchg_current part_imp_not_sch\n by(meson vpeq1_def vpeq_sched_def)\n\nlemma free_memory_notchg_partstate:\n \"\\is_a_partition sysconf (current s);\n is_a_partition sysconf d;\n d \\ current s;\n s' = free_memory sysconf s po b\\\n \\ (partitionmem s) d = (partitionmem s') d\"\n by(clarsimp simp: free_memory_def get_partconf_byid_def get_partmem_byid_def Let_def)\n\nlemma free_memory_sm_nitfpart:\n \"\\reachable0 s;\n is_a_partition sysconf (current s);\n is_a_partition sysconf d;\n ((current s) \\\\ d);\n s' = free_memory sysconf s po b\\\n \\ (s \\ d \\ s')\"\n using sche_imp_not_part \n apply(clarsimp cong del: is_a_partition_def interference1_def non_interference1_def)\n using nintf_neq free_memory_notchg_partstate by blast\n\nlemma free_memory_presrv_lcrsp:\n assumes p0:\"reachable0 s\"\n and p1:\"is_a_partition sysconf (current s)\"\n and p2:\"(current s) \\\\ d\"\n and p3:\"s' = free_memory sysconf s po b\"\n shows \"s \\ d \\ s'\"\nproof(cases \"is_a_scheduler sysconf d\")\n assume a0:\"is_a_scheduler sysconf d\"\n then show ?thesis using is_a_scheduler_def free_memory_sm_sche[OF p1 p3] by auto\nnext\n assume a1:\"\\ is_a_scheduler sysconf d\"\n show ?thesis\n proof(cases \"is_a_partition sysconf d\")\n assume b0:\"is_a_partition sysconf d\"\n show ?thesis using b0 free_memory_sm_nitfpart p0 p1 p2 p3 by blast\n next\n assume b1:\"\\ is_a_partition sysconf d\"\n show ?thesis using a1 b1 by auto\n qed\nqed\n\nlemma free_memory_presrv_lcrsp_e:\n \"local_respect_e (hyperc (Buddy_Memory_Free po b))\"\n using free_memory_presrv_lcrsp exec_event_def\n prod.simps(2) vpeq_reflexive_lemma\n by(auto cong del: vpeq1_def)\n\nsubsection \\proving \"schedule\" satisfying the \"local respect\" property\\\nlemma schedule_presrv_lcrsp:\n assumes p0:\"(scheduler sysconf) \\\\ d\" \n shows \"s \\ d \\ s'\"\n using p0 by auto\n\nlemma schedule_presrv_lcrsp_e: \"local_respect_e (sys Schedule)\"\n using schedule_presrv_lcrsp exec_event_def prod.simps(2) vpeq_reflexive_lemma by auto\n\nsubsection \\proving the \"local respect\" property\\\ntheorem local_respect:local_respect\n proof -\n {\n fix e\n have \"local_respect_e e\"\n apply(induct e)\n using alloc_memory_presrv_lcrsp_e free_memory_presrv_lcrsp_e\n apply (rule Hypercall.induct)\n using schedule_presrv_lcrsp_e\n by (rule System_Event.induct)\n }\n then show ?thesis using local_respect_all_evt by blast\n qed\n\nend", "meta": {"author": "johnakeke", "repo": "Buddy-Memory-Verification", "sha": "bc6ea9213f93938d51dc7a9e225ce9ce14cdfb27", "save_path": "github-repos/isabelle/johnakeke-Buddy-Memory-Verification", "path": "github-repos/isabelle/johnakeke-Buddy-Memory-Verification/Buddy-Memory-Verification-bc6ea9213f93938d51dc7a9e225ce9ce14cdfb27/Memory_Allocation_Security.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.28037395299311685}} {"text": "theory SimpleNetwork\nimports NetworkAnalysis\nbegin\n\ndefinition \"router = ipv4addr_of_dotteddecimal (1,0,1,1)\"\ndefinition \"normal = ipv4addr_of_dotteddecimal (1,0,1,2)\"\ndefinition \"weird = ipv4addr_of_dotteddecimal (1,0,2,3)\"\ndefinition \"daisy = ipv4addr_of_dotteddecimal (1,0,3,4)\"\ndefinition \"wlan1 = ipv4addr_of_dotteddecimal (1,0,4,5)\"\ndefinition \"wlan2 = ipv4addr_of_dotteddecimal (1,0,4,6)\"\ndefinition \"internet = ipv4addr_of_dotteddecimal (2,0,0,7)\"\nlemmas entity_defs = router_def normal_def daisy_def weird_def wlan1_def wlan2_def internet_def\n\ndefinition \"simple_links = add_backlinks {\n (\\ entity = NetworkBox router, port = Port 11 \\, \\ entity = Host normal, port = Port 12 \\),\n (\\ entity = NetworkBox router, port = Port 21 \\, \\ entity = NetworkBox weird, port = Port 23 \\),\n (\\ entity = NetworkBox weird, port = Port 33 \\, \\ entity = Host daisy, port = Port 34 \\),\n (\\ entity = NetworkBox router, port = Port 41 \\, \\ entity = Host wlan1, port = Port 45 \\),\n (\\ entity = NetworkBox router, port = Port 41 \\, \\ entity = Host wlan2, port = Port 46 \\),\n (\\ entity = Host wlan1, port = Port 45 \\, \\ entity = Host wlan2, port = Port 46 \\),\n (\\ entity = NetworkBox router, port = Port 1 \\, \\ entity = Host internet, port = Port 7 \\)\n}\"\n\ndefinition \"router_fwd_table = [\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,1,1),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,2,1),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,4,1),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (2,0,0,1),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,1,0), pfxm_length = 24 \\, routing_action = Port ` {11} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,4,0), pfxm_length = 24 \\, routing_action = Port ` {41} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,2,0), pfxm_length = 23 \\, routing_action = Port ` {21} \\,\n\t\\ routing_match = \\ pfxm_prefix = 0, pfxm_length = 0 \\, routing_action = Port ` {1} \\\n]\"\nlemma \"correct_routing router_fwd_table\" by eval\n\ndefinition \"weirdbox_fwd_table = [\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,2,3),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,3,3),pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = ipv4addr_of_dotteddecimal (1,0,3,0),pfxm_length = 24 \\, routing_action = Port ` {33} \\,\n\t\\ routing_match = \\ pfxm_prefix = 0,pfxm_length = 0 \\, routing_action = Port ` {23} \\\n]\"\nlemma \"correct_routing weirdbox_fwd_table\" by eval\n\ndefinition \"default_only own_addr default_port = [\n\t\\ routing_match = \\ pfxm_prefix = own_addr,pfxm_length = 32 \\, routing_action = {} \\,\n\t\\ routing_match = \\ pfxm_prefix = 0,pfxm_length = 0 \\, routing_action = Port ` {default_port} \\\n]\"\nlemma \"correct_routing (default_only addr defport)\"\n unfolding default_only_def correct_routing_def valid_prefix_def valid_prefixes_def by simp\n\ndefinition \"forwarding_table_map = [\n (NetworkBox router, router_fwd_table),\n (NetworkBox weird, weirdbox_fwd_table),\n (Host daisy, default_only daisy 34),\n (Host wlan1, default_only wlan1 45),\n (Host wlan2, default_only wlan2 46),\n (Host normal, default_only normal 12),\n (Host internet, default_only normal 7)\n]\"\n\ndefinition \"to_fun m = (the \\ map_of m)\"\n\ndefinition \"simple_interfaces \\ fst ` simple_links \\ snd ` simple_links\"\n\nlemma simple_valid_formed: \"valid_network_formers simple_interfaces simple_links forwarding_table_map\"\nproof -\n have \"(\\tbl\\snd ` set forwarding_table_map. correct_routing tbl)\" by eval\n moreover\n have \"wellformed_network (network_of simple_interfaces simple_links forwarding_table_map)\"\n proof(unfold_locales)\n case goal1 thus ?case by eval\n next\n case goal2 thus ?case by eval\n next\n case goal3 thus ?case by(simp add: simple_links_def simple_interfaces_def network_of_def)\n next\n case goal4 thus ?case\n unfolding network_of_def simple_links_def entity_defs simple_interfaces_def fst_add_backlinks snd_add_backlinks\n by(auto, (fastforce dest: ipv4addr_of_dotteddecimal_eqE)+)\n qed\n moreover\n have \"entity ` simple_interfaces \\ fst ` set forwarding_table_map\" by eval\n moreover\n have \"single_valued (set forwarding_table_map)\" \n unfolding forwarding_table_map_def single_valued_def entity_defs \n by(auto, (fastforce dest: ipv4addr_of_dotteddecimal_eqE)+)\n ultimately\n show ?thesis unfolding valid_network_formers_def by simp\nqed\n\ndefinition \"simple_network \\ network_of simple_interfaces simple_links forwarding_table_map\"\n\ninterpretation simple_wellformed: wellformed_network simple_network\n unfolding simple_network_def using conjunct1[OF simple_valid_formed[unfolded valid_network_formers_def]] .\n\nvalue \"reduced_range_destination ((to_fun forwarding_table_map) (NetworkBox router)) ipv4rq_UNIV\"\nvalue \"range_destination ((to_fun forwarding_table_map) (NetworkBox weird)) ipv4rq_UNIV\"\nvalue[code] \"reachable_code simple_network (Host wlan1, Host wlan2) \\ entity = Host wlan1, port = Port 45 \\\"\nvalue[code] \"reachable_code simple_network (Host normal, Host daisy) \\ entity = Host normal, port = Port 12 \\\"\nvalue[code] \"reachable_code simple_network (Host internet, Host (daisy + 1)) \\ entity = Host normal, port = Port 12 \\\"\nvalue[code] \"reachable_code simple_network (Host daisy, Host internet) \\ entity = Host daisy, port = Port 34 \\\"\n\nlemma [code_unfold]:\n \"all_views simple_interfaces simple_links forwarding_table_map = \n all_views_code simple_interfaces simple_links forwarding_table_map\"\n using all_views_code_correct[OF conjunct1[OF simple_valid_formed[unfolded valid_network_formers_def]]] .\n\nvalue \"covering_iplist (map snd forwarding_table_map)\"\nvalue \"(map (\\cdst. (cdst, view_code (network_of simple_interfaces simple_links forwarding_table_map) (Host 0, Host cdst)))\n (covering_iplist (map snd forwarding_table_map)))\"\nvalue \"(\\l. (length (remdups l), length l)) ((map (\\cdst. view_code (network_of simple_interfaces simple_links forwarding_table_map) (Host 0, Host cdst))\n (covering_iplist (map snd forwarding_table_map))))\"\n\n(* \nWhat you get if you don't block the reoutput:\n\"\"[{(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = Host 0x1000304, port = Port 34\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = Host 0x1000304, port = Port 34\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = Host 0x1000304, port = Port 34\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = Host 0x1000304, port = Port 34\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = Host 0x1000102, port = Port 12\\, \\entity = NetworkBox 0x1000101, port = Port 11\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = Host 0x1000304, port = Port 34\\, \\entity = NetworkBox 0x1000203, port = Port 33\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = Host 0x1000405, port = Port 45\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = Host 0x1000406, port = Port 46\\, \\entity = NetworkBox 0x1000101, port = Port 41\\),\n (\\entity = Host 0x2000007, port = Port 7\\, \\entity = NetworkBox 0x1000101, port = Port 1\\)}]\"\n :: \"(32 word interface \\ 32 word interface) set list\"\n\nOtherwise:\n\"[{(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000203, port = Port 23\\, \\entity = Host 0x1000304, port = Port 34\\)},\n {(\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x1000102, port = Port 12\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000102, port = Port 12\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x1000405, port = Port 45\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000406, port = Port 46\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x1000405, port = Port 45\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 1\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = NetworkBox 0x1000203, port = Port 23\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = NetworkBox 0x1000203, port = Port 23\\)},\n {(\\entity = NetworkBox 0x1000101, port = Port 41\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = NetworkBox 0x1000203, port = Port 33\\, \\entity = NetworkBox 0x1000101, port = Port 21\\),\n (\\entity = NetworkBox 0x1000101, port = Port 21\\, \\entity = Host 0x2000007, port = Port 7\\),\n (\\entity = NetworkBox 0x1000101, port = Port 11\\, \\entity = Host 0x2000007, port = Port 7\\)}]\"\n*)\n\nend\n", "meta": {"author": "jcaesar", "repo": "fixed-topos-header-space-analysis", "sha": "2da808ab41e5924d616ad1af15e8f50cb986c803", "save_path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis", "path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis/fixed-topos-header-space-analysis-2da808ab41e5924d616ad1af15e8f50cb986c803/thy/SimpleNetwork.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.28017856802459373}} {"text": "theory RB_Relaxed_mike_bd imports RCU_Lems \nbegin\n\ndatatype F = B | W | Q | R\ndatatype Pointer = Head | Tail\n\nconsts n :: nat (*size of buffer, input*)\nconsts N :: nat (*number of Arr\\<^sub>W entries*)\n\n(*(Wr T u t b \\)*)\n(*\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"ts = getTS \\ w\"\nshows \"\\ [x \\\\<^sub>t u] (write_trans t b w v \\ ts) \"\n sorry\n*)\n\n\nlemma pval_val_same:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n using assms\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var apply blast\n defer \n apply (simp add: getVWNC_var)\n apply (simp add: getVWNC_var)\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\nfix a :: nat and ba :: rat\n assume a1: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ t (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := True)\\) (var w)\"\n assume a2: \"x = var w\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"ba \\ getTS \\ (getVWNC \\ t (var w))\"\n have f5: \"\\s n p. var p = n \\ p \\ surrey_state.writes (s::surrey_state) \\ p \\ writes_on s n\"\n using writes_on_def by force\n have \"\\s n p. writes_on (write_available_update p (s::surrey_state)) n = writes_on s n\"\n by (metis (no_types) surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(5) writes_on_def)\n then have f6: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), modView := (modView \\) ((x, getTS \\ (getVWNC \\ t x)) := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), mods := (mods \\) ((x, getTS \\ (getVWNC \\ t x)) := \\val = v, is_releasing = b\\), writes := insert (x, getTS \\ (getVWNC \\ t x)) (surrey_state.writes \\)\\) x\"\n using a2 a1 by blast\n have f7: \"\\s f. surrey_state.writes (writes_update f (s::surrey_state)) = f (surrey_state.writes s)\"\n by auto\n have f8: \"var (a, ba) = x\"\n using f6 f5 by meson\n have \"(a, ba) \\ surrey_state.writes \\\"\n using f7 f6 f5 a4 a2 by (metis insert_iff snd_conv)\n then show False\n using f8 a3 writes_on_def by force\nqed\n\n\n\nlemma pval_val_other:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"t\\s\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v s b \\)\"\n using assms apply simp\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var\n apply (simp add: w_in_writes_on_var getVWNC_var) \n apply (simp add: getVWNC_var)\n\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\n fix a :: nat and ba :: rat\n assume a1: \"ba \\ getTS \\ (getVWNC \\ s (var w))\"\n assume a2: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\) (var w)\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"x = var w\"\n have \"(a, ba) \\ \\\\var = var w \\ \\(\\) (surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\))\\\"\n using a2 writes_on_def by blast\n then have f5: \"var (a, ba) = var w \\ (a, ba) \\ surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\)\"\n by blast\n then have \"(a, ba) \\ surrey_state.writes \\\"\n using a4 a3 writes_on_def by fastforce\n then show False\n using f5 a1 by simp\nqed\n\n\n\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t' b \\)\"\n using assms apply (cases \"t=t'\")\n using pval_val_same apply blast\n using pval_val_other by blast\n\n\n\n\nlemma pval_val_outside:\n assumes \"wfs \\\"\n and \"N\\ \\\"\n and \"\\j.[x \\\\<^sub>t j] \\ \\ jk. k [x \\\\<^sub>t k] \\\"\n and \"u\\\\ \\ uz.(z>N\\\\[x \\\\<^sub>t z] (Wr x u t' b \\))\"\n using assms apply (cases \"t=t'\")\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n by (metis fst_conv not_less_iff_gr_or_eq pval_val)\n\n\nlemma pval_val_outside_2:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"[x =\\<^sub>t 0] \\\"\n and \"u \\ 0\"\nshows \"\\i.(([x =\\<^sub>t i] (Wr x u t b \\))\\([x =\\<^sub>t i] (Wr x 0 t' b \\)))\" \n using assms apply (cases \"t=t'\")\n using OpSem_ProofRules.ext_d_obs_d_obs apply blast\n using OpSem_ProofRules.ext_d_obs_d_obs by blast\n\n\n\nlemma pval_val_outside_3:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"u \\ \\ \\ ut u]\\\"\n and \"t\\y\"\n and \"if \\'=(Wr x u y False \\) then [x =\\<^sub>t u]\\' else [x =\\<^sub>t u]\\'\"\nshows \"[x =\\<^sub>t u]\\'\" \n by (meson assms(6))\n\n\n\n\n\n(*Ex (d_obs_t (Wr T 0 2 False (\\ x)) 3 T)*)\n\n\n(*\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n\n\nlemma pval_val_all: \n assumes \"wfs \\\"\n and \"\\i. i > k \\ \\ [x \\\\<^sub>t i] \\\"\n and \"k < j\" \n and \"u \\ k\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t j] (Wr x v t b \\) \"\n using assms\n \n using pval_val sledgehammer\n*)\n\nconsts \n H :: L\n T :: L\n\n\nrecord LB =\n hW :: V (*local copy of W*)\n tW :: V (*local copy of W*)\n q :: \"(nat \\ nat) list\" (*for now assume well synchronised, need to think about weak memory *)\n tempR :: \"(nat \\ nat)\" (*local copy of word by R*)\n\n tloc :: V\n Data:: \"nat \\ nat\" (*returns a word Data_i*)\n countW :: nat (* the index of the next element of Data to be written *)\n countR :: nat (* how many words from Data the read has read or reading (i.e., retrieved) *)\n\n ownD :: \"nat \\ F\" (* ownership of data indices *)\n ownB :: \"nat \\ F\" (* ownership of bytes in buffer *)\n (* tries :: nat *)\n oom :: bool (*signals W that it was OOM*)\n \\ :: surrey_state\n\ndefinition \"global s \\ wfs s \\ H \\ T\"\n\n\n\n\nlemmas opsemsyntax [simp] = global_def\nlemmas defs_del [simp del] = Rd_def Let_def Wr_def Upd_def st_rd_def val_rd_def\n\n(* thread 2 is the writer *)\n(* thread 3 is the reader *)\n\n(* Omit tries *)\n(* Finish queueu + reader *)\n\n(* We need this one to hold at minimum *)\ndefinition \"arrayInv s \\ \\i. (i ownD s i = R)\\ (countR s \\ i \\ i < countW s \\ ownD s i = B) \\ (countW s \\ i \\ i < n \\ ownD s i = W) \"\n\n\ndefinition \"q_entries_bounded s \\ (\\i. i < length(q s) \\ (fst(q s!i)+snd(q s!i)\\N)\\snd(q s!i)>0)\"\ndefinition \"tempR_bounded s \\ fst (tempR s) + snd (tempR s) \\ N\"\ndefinition \"counter_q_rel s \\ (countW s-countR s=length(q s))\"\ndefinition \"con_assms s \\ 0 < N \\ 0 (countR s\\countW s) \\ (countW s\\n)\n \\ (\\i.(iData s i\\N \\ Data s i>0)\"\n(*new\n(typically)\n\\forall x . P(x) \\ Q(x)\n\\exists x . P(x) \\ Q(x)\n\n[H =\\<^sub>2 i] means thread 2 sees the last write to H and this has value i.\n[H \\\\<^sub>2 i] means that thread 2 can see the value i.\n*)\ndefinition \"bounded_pointers s \\ ((\\i. i > N \\ \\[H \\\\<^sub>2 i] (\\ s)))\\\n ((\\j. j > N \\ \\[T \\\\<^sub>2 j] (\\ s)))\"\n\ndefinition \"basic_pointer_movement s \\ 0\\hW s\\ hW s\\N \\ 0\\tW s\\ tW s\\N\"\n\n\n\ndefinition \"collection s \\ arrayInv s \\ q_entries_bounded s\n \\tempR_bounded s \\counter_q_rel s \\ con_assms s\n \\ bounded_pointers s \\ basic_pointer_movement s\n \"\n\n\ndefinition \"init s \\\n [T =\\<^sub>2 0] (\\ s) \\ [H =\\<^sub>2 0] (\\ s) \\ (q s = []) \\ (hW s = 0) \\ (tW s = 0)\n \\ (\\l. (l ((Data s l > 0)\\(Data s l \\ N)))\n \\ (\\i. (i ownD s i = W)\n \\ (\\i. (i\\N) \\ ownB s i = B)\n \\ (countW s = 0) \\ (countR s = 0)\n \\ (tempR s = (0,0)) \\ \\ oom s \"\n\ndefinition \"grd1 s \\ (tW s = hW s) \\ (Data s (countW s) \\ N) \"\ndefinition \"grd2 s \\ (tW s > hW s) \\ (Data s (countW s) < (tW s - hW s)) \"\ndefinition \"grd3 s \\ tW s < hW s \"\ndefinition \"grd4 s \\ Data s (countW s) \\ N - hW s \"\ndefinition \"grd5 s \\ Data s (countW s) < tW s \"\ndefinition \"no_space_for_word s \\ (grd1 s \\ \\(Data s (countW s) \\ N))\\\n (grd2 s \\ \\(Data s (countW s) < (tW s - hW s)))\\\n (grd3 s \\ \\(Data s (countW s) \\ N - hW s \\ Data s (countW s) < tW s))\"\n\n\n\nlemmas main_invariant_lemmas = collection_def arrayInv_def q_entries_bounded_def \n counter_q_rel_def tempR_bounded_def con_assms_def\n init_def bounded_pointers_def basic_pointer_movement_def\n pval_val_same pval_val_other pval_val \nlemmas guards = grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def\n\n\nlemma LoadBuffering:\n \"\\- \\ global \\\\ \\ \\collection \\ \\init \\\nCOBEGIN\n\\ global \\\\ \\ \\collection \\ \\ \\oom \\ \\init\\\n WHILE \\countW < n \n INV \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\)\\\n DO\n \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\) \\ \\countW < n\\ \\ \\A1\\\n <\\hW \\\\<^sub>2 H\\\\> ;; \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n <\\tW \\\\<^sub>2 T\\\\> ;;\n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n IF \\grd1 \\ \\A2\\\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\ \\ \\A3\\\n R\\<^sub>2 0 \\\\> ;; \\ \\This might not need to be releasing\\ \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if 0\\ x \\ x < (\\Data \\countW) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \n IF \\grd2\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd2\\ \\ \\A4\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \\\\grd2\\\n IF \\grd3\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\ \\A5\\\n IF \\grd4\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd4 \\ \\ \\A6\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\\\grd4 \\\n IF \\grd5\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd5 \\ \\ \\A7\\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if ((0 \\ x \\ x < (\\Data \\countW))\\ x\\T)\\x\\N then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\ \\ \\A8\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n FI;;\n \\ global \\\\ \\ \\collection \n \\ ((\\oom=False \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\ ) \\ \\\\ \\hW + \\Data (\\countW) \\ N\\ \n \\ (\\oom=True \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word)) \\ \\countW < n\\\n IF \\oom=True\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word \\ \\countW < n\\ \\ \\OK\\\n SKIP\n ELSE \\ global \\\\ \\ \\collection \\ \\countW < n \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\\\\n \\\\q := \\q @ [(\\hW, (\\Data \\countW))],, \n \\ownD := (\\ x. if x = \\countW then B else \\ownD x),, \n \\ownB := (\\ x. if (\\ownB x = W) then Q else \\ownB x),, \n \\countW := (\\countW+1)\\ \n FI\n OD \n \\ global \\\\ \\ \\collection \\ \\countW = n\\\n\n\\\n \\ global \\\\ \\ \\collection \\ \\tempR = (0, 0) \\\n WHILE \\countR < n\n INV \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\\n DO \\ global \\\\ \\ \\collection \\ \\countR < n \\ \\tempR=(0,0) \\\n IF \\countR < \\countW THEN\n \\ global \\\\ \\ \\collection \\ \\countR < \\countW \\ \\tempR=(0,0) \\ \\ \\retrieve from Q, dequeue\\\n \\ \\tempR := (fst(hd \\q),(snd(hd \\q))) ,, \n \\ownD := (\\ x. if x = \\countR then R else \\ownD x),, \n \\countR := \\countR+1,, \n ( IF fst(hd \\q)\\0 THEN (\\ownB := ( \\ x. if fst(hd \\q) \\ x \\ x < (fst(hd \\q)+(snd(hd \\q))) then R else \\ownB x ))\n ELSE (\\ownB := ( \\ x. if (0 \\ x \\ x < (fst(hd \\q)+(snd(hd \\q))))\\(\\i.(x+i\\ownB x=Q)) then R else \\ownB x )) FI),, \n \\q := (tl \\q) \\;;\n \\ global \\\\ \\\\collection \\ \\countR \\ \\countW \\ \\tempR\\(0,0)\\ \\ \\Push T\\\n \\3 (fst \\tempR + snd \\tempR) \\\\ > \n ,, \\ tempR := (0,0),, \n \\ownB := (\\ x. if \\ownB x = R then B else \\ownD x) \\\n ELSE\n \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\ \\countR < n \\\n SKIP\n FI\n OD\n\\ global \\\\ \\ \\collection \\ \\countR = n\\\n\n\n\nCOEND\n \\ global \\\\ \\ \\collection \\ \\countW = n \\ \\countR = n\\\n \n\n\"\n apply (oghoare)\n apply ((simp add: main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff; force)+)[4]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply (clarify)\n apply (intro conjI impI)\n apply (metis OpSem_ProofRules.d_obs_read_value d_obs_implies_p_obs le_less_linear)\n apply (metis OpSem_ProofRules.d_obs_read_value OpSem_ProofRules.ext_d_obs_rd_pres)\n apply auto[1]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply clarsimp\n apply (meson not_less not_pobs_contradiction)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n using pval_val apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis (no_types, lifting) Suc_diff_le d_obs_implies_p_obs fst_eqD le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply clarsimp\n apply (simp_all add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)\n (*129*)\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis (full_types) diff_is_0_eq hd_conv_nth length_0_conv length_greater_0_conv not_less)\n apply linarith\n apply auto[1]\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_0_conv not_less0 zero_less_diff)\n apply linarith\n apply (metis (full_types) hd_conv_nth length_0_conv not_less0 snd_conv zero_less_diff)\n using main_invariant_lemmas(12) apply auto[1]\n using OpSem_ProofRules.ext_d_obs_d_obs apply blast\n apply clarify\n apply linarith\n using OpSem_ProofRules.p_obs_contradiction apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis One_nat_def Suc_eq_plus1 length_tl less_diff_conv nth_tl)\n apply (metis One_nat_def Suc_eq_plus1 length_tl less_diff_conv nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify \n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis getVWNC_var le_less_trans main_invariant_lemmas(12) nat_neq_iff)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis getVWNC_var leD pval_val) \n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_greater_0_conv zero_less_diff)\n apply linarith\n apply blast\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth length_greater_0_conv zero_less_diff)\n apply linarith\n apply blast\n apply (metis getVWNC_var leD pval_val)\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val)\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val) \n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (intro conjI impI)\n apply blast\n apply blast\n apply blast\n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (simp add: nth_tl) \n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith\n apply blast\n apply clarify\n apply (metis getVWNC_var leD pval_val) \n apply blast\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply (intro conjI impI)\n apply (simp add: nth_tl)\n apply (metis hd_conv_nth length_greater_0_conv zero_less_diff) \n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis (full_types) Nat.add_0_right add.commute hd_conv_nth my_simp_list(1) not_less0 zero_less_diff) \n apply linarith \n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis (full_types) fst_conv not_less0 pval_val)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n by simp\n \n\n\n\n\n\n(*(simp add: Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff )?)*)", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RB_Relaxed_mike_bd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.28017856220223947}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory IndirectCalls\n\nimports\n \"PrettyProgs\"\n\nbegin\n\ndefinition\n lookup_proc :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ 'proc_id\"\nwhere\n \"lookup_proc symtab naming x\n = (THE pid. naming pid \\ None \\ symtab (the (naming pid)) = x)\"\n\ndefinition\n lookup_proc_safe :: \"(string \\ 'proc_addr) \\ ('proc_id \\ string)\n \\ 'proc_addr \\ bool\"\nwhere\n \"lookup_proc_safe symtab naming x\n = (card {pid. naming pid \\ None \\ symtab (the (naming pid)) = x} = 1)\"\n\ndefinition\n procs_consistent :: \"(string \\ 'proc_addr) \\ ('proc_nm \\ string)\n \\ bool\"\nwhere\n \"procs_consistent symtab naming\n = (finite (dom naming)\n \\ (\\x y nm nm'. naming x = Some nm \\ naming y = Some nm'\n \\ symtab nm = symtab nm'\n \\ x = y))\"\n\nlemma procs_consistent_eq:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc symtab naming addr = proc\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_def)\n apply (rule the_equality)\n apply clarsimp\n apply clarsimp\n done\n\nlemma procs_consistent_safe:\n \"\\ naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\\n \\ lookup_proc_safe symtab naming addr\"\n apply (clarsimp simp: procs_consistent_def lookup_proc_safe_def)\n apply (rule trans, rule arg_cong[where f=card and y=\"{proc}\"])\n apply auto\n done\n\nlemma hoare_indirect_call_procs_consistent:\n \"\\ naming proc = Some nm;\n \\ \\ P (call initf proc ret c) Q, A \\\n \\ \\ \\ ({s. procs_consistent symtab naming \\ x_fn s = symtab nm} \\ P)\n (dynCall initf (\\s. lookup_proc symtab naming (x_fn s))\n ret c) Q, A\"\n apply (rule hoare_complete, drule hoare_sound)\n apply (clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n apply (erule exec_dynCall_Normal_elim)\n apply (simp add: procs_consistent_eq)\n apply blast\n done\n\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/IndirectCalls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2801437089431009}} {"text": "theory PartialEvaluation\nimports BananasBigStepDynamics\nbegin\n\nfun partial_evaluation :: \"dynamic_environment \\ nat \\ expr \\ val \\ val option\" where\n \"partial_evaluation \\ n \\ v = Some v\"\n| \"partial_evaluation \\ n (\\ v\\<^sub>1) v\\<^sub>2 = Some v\\<^sub>1\"\n| \"partial_evaluation \\ n (f \\ g) v = (case partial_evaluation \\ n g v of \n Some v' \\ partial_evaluation \\ n f v'\n | None \\ None)\"\n| \"partial_evaluation \\ n \\\\<^sub>1 (PairV v\\<^sub>1 v\\<^sub>2) = Some v\\<^sub>1\"\n| \"partial_evaluation \\ n \\\\<^sub>1 _ = None\"\n| \"partial_evaluation \\ n \\\\<^sub>2 (PairV v\\<^sub>1 v\\<^sub>2) = Some v\\<^sub>2\"\n| \"partial_evaluation \\ n \\\\<^sub>2 _ = None\"\n| \"partial_evaluation \\ n (f\\<^sub>1 \\ f\\<^sub>2) (PairV v\\<^sub>1 v\\<^sub>2) = (case partial_evaluation \\ n f\\<^sub>1 v\\<^sub>1 of \n Some v\\<^sub>1' \\ (case partial_evaluation \\ n f\\<^sub>2 v\\<^sub>2 of \n Some v\\<^sub>2' \\ Some (PairV v\\<^sub>1' v\\<^sub>2')\n | None \\ None)\n | None \\ None)\"\n| \"partial_evaluation \\ n (f\\<^sub>1 \\ f\\<^sub>2) _ = None\"\n| \"partial_evaluation \\ n \\ v = Some (PairV v v)\"\n| \"partial_evaluation \\ n \\\\<^sub>l v = Some (InlV v)\"\n| \"partial_evaluation \\ n \\\\<^sub>r v = Some (InrV v)\"\n| \"partial_evaluation \\ n \\ (InlV v) = Some v\"\n| \"partial_evaluation \\ n \\ (InrV v) = Some v\"\n| \"partial_evaluation \\ n \\ _ = None\"\n| \"partial_evaluation \\ n (f\\<^sub>l \\ f\\<^sub>r) (InlV v) = partial_evaluation \\ n (\\\\<^sub>l \\ f\\<^sub>l) v\"\n| \"partial_evaluation \\ n (f\\<^sub>l \\ f\\<^sub>r) (InrV v) = partial_evaluation \\ n (\\\\<^sub>r \\ f\\<^sub>r) v\"\n| \"partial_evaluation \\ n (f\\<^sub>l \\ f\\<^sub>r) _ = None\"\n| \"partial_evaluation \\ n \\ (PairV (InlV v\\<^sub>1) v\\<^sub>2) = Some (InlV (PairV v\\<^sub>1 v\\<^sub>2))\"\n| \"partial_evaluation \\ n \\ (PairV (InrV v\\<^sub>1) v\\<^sub>2) = Some (InrV (PairV v\\<^sub>1 v\\<^sub>2))\"\n| \"partial_evaluation \\ n \\ _ = None\"\n| \"partial_evaluation \\ (Suc n) $ (PairV (FunV e) v) = partial_evaluation \\ n e v\"\n| \"partial_evaluation \\ n $ _ = None\"\n| \"partial_evaluation \\ n (g \\ f) (FunV e) = Some (FunV (g \\ e \\ f))\"\n| \"partial_evaluation \\ n (g \\ f) _ = None\"\n| \"partial_evaluation \\ n \\\\<^bsub>x\\<^esub> v = Some (InjV x v)\"\n| \"partial_evaluation \\ n \\\\<^bsub>x\\<^esub> (InjV y v) = Some v\"\n| \"partial_evaluation \\ n \\\\<^bsub>x\\<^esub> _ = None\"\n| \"partial_evaluation \\ (Suc n) \\ f \\\\<^bsub>x\\<^esub> v = (case var\\<^sub>t_bind \\ x of \n Some F \\ partial_evaluation \\ n (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) v\n | None \\ None)\"\n| \"partial_evaluation \\ 0 \\ f \\\\<^bsub>x\\<^esub> _ = None\"\n| \"partial_evaluation \\ (Suc n) \\ f \\\\<^bsub>x\\<^esub> v = (case var\\<^sub>t_bind \\ x of \n Some F \\ partial_evaluation \\ n (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) v\n | None \\ None)\"\n| \"partial_evaluation \\ 0 \\ f \\\\<^bsub>x\\<^esub> _ = None\"\n| \"partial_evaluation \\ 0 (Var x) _ = None\"\n| \"partial_evaluation \\ (Suc n) (Var x) v = (case var\\<^sub>e_bind \\ x of \n Some e \\ partial_evaluation \\ n e v \n | None \\ None )\"\n\nprimrec algorithmic_assemble_context :: \"decl list \\ dynamic_environment\" where\n \"algorithmic_assemble_context [] = empty_dynamic\"\n| \"algorithmic_assemble_context (\\ # \\) = \n combine\\<^sub>d (assemble_context' something \\) (assemble_context \\)\"\n\nprimrec partial_eval_prog :: \"nat \\ prog \\ val option\" where\n \"partial_eval_prog n (Prog \\ e v) = partial_evaluation (algorithmic_assemble_context \\) n e v\"\n\n(* correctness *)\n\nlemma soundness': \"partial_evaluation \\ n e v = Some v' \\ \\ \\ e \\ v \\ v'\"\n proof (induction \\ n e v arbitrary: v' rule: partial_evaluation.induct)\n case 3\n thus ?case by (simp split: option.splits) fastforce\n next case 8\n thus ?case by (auto split: option.splits)\n next case (16 \\ n f\\<^sub>l f\\<^sub>r v)\n hence \"\\ \\ (\\\\<^sub>l \\ f\\<^sub>l) \\ v \\ v'\" by simp\n moreover have \"\\ \\ f\\<^sub>l \\ f\\<^sub>r \\ InlV v \\ (\\\\<^sub>l \\ f\\<^sub>l) \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n next case (17 \\ n f\\<^sub>l f\\<^sub>r v)\n hence \"\\ \\ (\\\\<^sub>r \\ f\\<^sub>r) \\ v \\ v'\" by simp\n moreover have \"\\ \\ f\\<^sub>l \\ f\\<^sub>r \\ InrV v \\ (\\\\<^sub>r \\ f\\<^sub>r) \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n next case (22 \\ n e v)\n hence \"\\ \\ e \\ v \\ v'\" by simp\n moreover have \"\\ \\ $ \\ PairV (FunV e) v \\ e \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n next case 27\n thus ?case by (simp split: if_splits)\n next case (29 \\ n f x v)\n moreover then obtain F where \"var\\<^sub>t_bind \\ x = Some F \\ \n partial_evaluation \\ n (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) v = Some v'\" by (auto split: option.splits)\n moreover hence \"\\ \\ \\ f \\\\<^bsub>x\\<^esub> \\ v \\ (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n next case (31 \\ n f x v)\n moreover then obtain F where \"var\\<^sub>t_bind \\ x = Some F \\ \n partial_evaluation \\ n (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) v = Some v'\" by (auto split: option.splits)\n moreover hence \"\\ \\ \\ f \\\\<^bsub>x\\<^esub> \\ v \\ (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n next case (34 \\ n x v)\n moreover then obtain e where E: \"var\\<^sub>e_bind \\ x = Some e \\ partial_evaluation \\ n e v = Some v'\" \n by (auto split: option.splits)\n ultimately have \"\\ \\ e \\ v \\ v'\" by simp\n moreover from E have \"\\ \\ Var x \\ v \\ e \\ v\" by simp\n ultimately show ?case by (metis tev_step)\n qed auto\n\nlemma pev_larger [elim]: \"partial_evaluation \\ n e v = Some v' \\ n \\ m \\ \n partial_evaluation \\ m e v = Some v'\"\n proof (induction \\ n e v arbitrary: v' m rule: partial_evaluation.induct)\n case (3 \\ n f g v)\n from 3(3) obtain v\\<^sub>1 where V: \"partial_evaluation \\ n g v = Some v\\<^sub>1 \\ \n partial_evaluation \\ n f v\\<^sub>1 = Some v'\" by (auto split: option.splits)\n with 3 have \"partial_evaluation \\ m g v = Some v\\<^sub>1\" by blast\n moreover from 3 V have \"partial_evaluation \\ m f v\\<^sub>1 = Some v'\" by blast\n ultimately show ?case by simp\n next case (8 \\ n f\\<^sub>1 f\\<^sub>2 v\\<^sub>1 v\\<^sub>2)\n moreover from 8(3) obtain v\\<^sub>1' v\\<^sub>2' where V: \"partial_evaluation \\ n f\\<^sub>1 v\\<^sub>1 = Some v\\<^sub>1' \\ \n partial_evaluation \\ n f\\<^sub>2 v\\<^sub>2 = Some v\\<^sub>2' \\ v' = PairV v\\<^sub>1' v\\<^sub>2'\" by (auto split: option.splits)\n ultimately show ?case by simp\n next case (16 \\ n f\\<^sub>l f\\<^sub>r v)\n moreover from 16(2) obtain v\\<^sub>1 where \"partial_evaluation \\ n f\\<^sub>l v = Some v\\<^sub>1 \\ \n partial_evaluation \\ n \\\\<^sub>l v\\<^sub>1 = Some v'\" by (auto split: option.splits)\n ultimately show ?case by simp\n next case (17 \\ n f\\<^sub>l f\\<^sub>r v)\n moreover from 17(2) obtain v\\<^sub>1 where \"partial_evaluation \\ n f\\<^sub>r v = Some v\\<^sub>1 \\ \n partial_evaluation \\ n \\\\<^sub>r v\\<^sub>1 = Some v'\" by (auto split: option.splits)\n ultimately show ?case by simp\n next case (22 \\ n e v)\n thus ?case\n proof (induction m)\n case (Suc m)\n moreover from Suc(3) have \"partial_evaluation \\ n e v = Some v'\" by simp\n ultimately have \"partial_evaluation \\ m e v = Some v'\" by blast\n thus ?case by simp\n qed simp_all\n next case (29 \\ n f x v)\n thus ?case\n proof (induction m)\n case (Suc m)\n moreover from Suc(3) obtain v\\<^sub>1 v\\<^sub>2 F where F: \"var\\<^sub>t_bind \\ x = Some F \\ \n partial_evaluation \\ n \\\\<^bsub>x\\<^esub> v = Some v\\<^sub>1 \\ \n partial_evaluation \\ n (\\ f \\\\<^bsub>x\\<^esub> \\ F) v\\<^sub>1 = Some v\\<^sub>2 \\ \n partial_evaluation \\ n f v\\<^sub>2 = Some v'\" by (auto split: option.splits)\n moreover hence \"partial_evaluation \\ n (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) v = Some v'\" by simp\n ultimately have \"partial_evaluation \\ m (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) v = Some v'\" by blast\n with F show ?case by simp\n qed simp_all\n next case (31 \\ n f x v)\n thus ?case\n proof (induction m)\n case (Suc m)\n moreover from Suc(3) obtain v\\<^sub>1 v\\<^sub>2 F where F: \"var\\<^sub>t_bind \\ x = Some F \\ \n partial_evaluation \\ n f v = Some v\\<^sub>1 \\\n partial_evaluation \\ n (\\ f \\\\<^bsub>x\\<^esub> \\ F) v\\<^sub>1 = Some v\\<^sub>2 \\ \n partial_evaluation \\ n \\\\<^bsub>x\\<^esub> v\\<^sub>2 = Some v'\" by (auto split: option.splits)\n moreover hence \"partial_evaluation \\ n (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) v = Some v'\" by simp\n ultimately have \"partial_evaluation \\ m (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) v = Some v'\" by blast\n with F show ?case by simp\n qed simp_all\n next case (34 \\ n x v)\n thus ?case\n proof (induction m)\n case (Suc m)\n from Suc(3) obtain e where \"var\\<^sub>e_bind \\ x = Some e \\ partial_evaluation \\ n e v = Some v'\" \n by (auto split: option.splits)\n moreover with Suc have \"partial_evaluation \\ m e v = Some v'\" by blast\n ultimately show ?case by simp\n qed simp_all\n qed simp_all\n\nlemma completeness': \"\\ \\ e \\ v \\ v' \\ \\n. partial_evaluation \\ n e v = Some v'\"\n proof (induction \\ e v v' rule: total_eval.induct)\n case (tev_step \\ e v e' v' v'')\n thus ?case\n proof (induction \\ e v e' v' arbitrary: v'' rule: evaluate.induct)\n case (ev_comp1 \\ g v g' v' f)\n moreover then obtain n v\\<^sub>1 where N: \"partial_evaluation \\ n g' v' = Some v\\<^sub>1 \\ \n partial_evaluation \\ n f v\\<^sub>1 = Some v''\" by (auto split: option.splits)\n moreover hence \"\\ \\ g' \\ v' \\ v\\<^sub>1\" by (metis soundness')\n ultimately obtain m where M: \"partial_evaluation \\ m g v = Some v\\<^sub>1\" by auto\n have \"max n m \\ m \\ max n m \\ n\" by simp\n with M N have \"partial_evaluation \\ (max n m) f v\\<^sub>1 = Some v'' \\ \n partial_evaluation \\ (max n m) g v = Some v\\<^sub>1\" by (metis pev_larger)\n hence \"partial_evaluation \\ (max n m) (f \\ g) v = Some v''\" by simp\n thus ?case by fastforce\n next case (ev_pair1 \\ f\\<^sub>1 v\\<^sub>1 f\\<^sub>1' v\\<^sub>1' f\\<^sub>2 v\\<^sub>2)\n then obtain n v\\<^sub>1'' v\\<^sub>2' where N: \"partial_evaluation \\ n f\\<^sub>1' v\\<^sub>1' = Some v\\<^sub>1'' \\ \n partial_evaluation \\ n f\\<^sub>2 v\\<^sub>2 = Some v\\<^sub>2' \\ v'' = PairV v\\<^sub>1'' v\\<^sub>2'\" \n by (auto split: option.splits) fastforce\n with ev_pair1 have \"\\ \\ f\\<^sub>1' \\ f\\<^sub>2 \\ PairV v\\<^sub>1' v\\<^sub>2 \\ PairV v\\<^sub>1'' v\\<^sub>2'\" by simp\n hence \"(\\ \\ f\\<^sub>1' \\ v\\<^sub>1' \\ v\\<^sub>1'') \\ \\ \\ f\\<^sub>2 \\ v\\<^sub>2 \\ v\\<^sub>2'\" by (metis pair_big_eval)\n with ev_pair1 N obtain m where M: \"partial_evaluation \\ m f\\<^sub>1 v\\<^sub>1 = Some v\\<^sub>1''\" by auto\n have \"max n m \\ m \\ max n m \\ n\" by simp\n with M N have \"partial_evaluation \\ (max n m) f\\<^sub>1 v\\<^sub>1 = Some v\\<^sub>1'' \\ \n partial_evaluation \\ (max n m) f\\<^sub>2 v\\<^sub>2 = Some v\\<^sub>2'\" by (metis pev_larger)\n with N have \"partial_evaluation \\ (max n m) (f\\<^sub>1 \\ f\\<^sub>2) (PairV v\\<^sub>1 v\\<^sub>2) = Some v''\" by simp\n thus ?case by fastforce\n next case (ev_pair2 \\ f\\<^sub>2 v\\<^sub>2 f\\<^sub>2' v\\<^sub>2' v\\<^sub>1)\n then obtain n v\\<^sub>2'' where V: \"partial_evaluation \\ n f\\<^sub>2' v\\<^sub>2' = Some v\\<^sub>2'' \\ v'' = PairV v\\<^sub>1 v\\<^sub>2''\" \n by (auto split: option.splits)\n with ev_pair2 have \"\\ \\ \\ \\ f\\<^sub>2' \\ PairV v\\<^sub>1 v\\<^sub>2' \\ PairV v\\<^sub>1 v\\<^sub>2''\" by simp\n hence \"\\ \\ f\\<^sub>2' \\ v\\<^sub>2' \\ v\\<^sub>2''\" by (metis pair_big_eval)\n with ev_pair2 V obtain m where \"partial_evaluation \\ m f\\<^sub>2 v\\<^sub>2 = Some v\\<^sub>2''\" by auto\n with V have \"partial_evaluation \\ m (\\ \\ f\\<^sub>2) (PairV v\\<^sub>1 v\\<^sub>2) = Some v''\" by simp\n thus ?case by fastforce\n next case (ev_app \\ e v)\n then obtain n where \"partial_evaluation \\ n e v = Some v''\" by blast\n hence \"partial_evaluation \\ (Suc n) $ (PairV (FunV e) v) = Some v''\" by simp\n thus ?case by fastforce\n next case ev_outj\n thus ?case by simp\n next case (ev_cata \\ x F f v)\n moreover then obtain n where \"partial_evaluation \\ n (f \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ \\\\<^bsub>x\\<^esub>) v = Some v''\" \n by blast\n ultimately have \"partial_evaluation \\ (Suc n) \\ f \\\\<^bsub>x\\<^esub> v = Some v''\" by simp\n thus ?case by fastforce\n next case (ev_ana \\ x F f v)\n moreover then obtain n where \"partial_evaluation \\ n (\\\\<^bsub>x\\<^esub> \\ \\ f \\\\<^bsub>x\\<^esub> \\ F \\ f) v = Some v''\" \n by blast\n ultimately have \"partial_evaluation \\ (Suc n) \\ f \\\\<^bsub>x\\<^esub> v = Some v''\" by simp\n thus ?case by fastforce\n next case (ev_var \\ x e v)\n moreover then obtain n where \"partial_evaluation \\ n e v = Some v''\" by blast\n ultimately have \"partial_evaluation \\ (Suc n) (Var x) v = Some v''\" by simp\n thus ?case by fastforce\n qed auto \n qed simp_all\n\ntheorem soundness: \"partial_eval_prog n \\ = Some v \\ \\ \\ v\"\n by (induction \\) (simp add: soundness')\n\ntheorem completeness: \"\\ \\ v \\ \\n. partial_eval_prog n \\ = Some v\"\n by (simp, induction \\ v rule: total_evaluate_prog'.induct) (simp add: completeness')\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Bananas", "sha": "aeecb3ef1e7994d6c080c8f4800f7aabcde30e15", "save_path": "github-repos/isabelle/xtreme-james-cooper-Bananas", "path": "github-repos/isabelle/xtreme-james-cooper-Bananas/Bananas-aeecb3ef1e7994d6c080c8f4800f7aabcde30e15/PartialEvaluation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2801429174630725}} {"text": "(* Title: JinjaThreads/Execute/TypeRelRefine.thy\n Author: Andreas Lochbihler\n\n Tabulation for lookup functions\n*)\n\nheader {* \\isaheader{Tabulation for lookup functions} *}\n\ntheory TypeRelRefine\nimports\n \"../Common/TypeRel\"\n \"~~/src/HOL/Library/AList_Mapping\"\nbegin\n\nsubsection {* Auxiliary lemmata *}\n\n\n\nlemma map_of_map2: \"map_of (map (\\(k, v). (k, f k v)) xs) k = map_option (f k) (map_of xs k)\"\nby(induct xs) auto\n\nlemma map_of_map_K: \"map_of (map (\\k. (k, c)) xs) k = (if k \\ set xs then Some c else None)\"\nby(induct xs) auto\n\nlift_definition map_values :: \"('a \\ 'b \\ 'c) \\ ('a, 'b) mapping \\ ('a, 'c) mapping\"\nis \"\\f m k. map_option (f k) (m k)\" .\n\n\n\nlemma map_Mapping: \"Mapping.map f g (Mapping.Mapping m) = Mapping.Mapping (map_option g \\ m \\ f)\"\nby(rule map.abs_eq)\n\nabbreviation subclst :: \"'m prog \\ cname \\ cname \\ bool\"\nwhere \"subclst P \\ (subcls1 P)^++\"\n\nsubsection {* Representation type for tabulated lookup functions *}\n\ntype_synonym\n 'm prog_impl' = \n \"'m cdecl list \\\n (cname, 'm class) mapping \\\n (cname, cname set) mapping \\ \n (cname, (vname, cname \\ ty \\ fmod) mapping) mapping \\ \n (cname, (mname, cname \\ ty list \\ ty \\ 'm option) mapping) mapping\"\n\nlift_definition tabulate_class :: \"'m cdecl list \\ (cname, 'm class) mapping\"\nis \"class \\ Program\" .\n\nlift_definition tabulate_subcls :: \"'m cdecl list \\ (cname, cname set) mapping\"\nis \"\\P C. if is_class (Program P) C then Some {D. Program P \\ C \\\\<^sup>* D} else None\" .\n\nlift_definition tabulate_sees_field :: \"'m cdecl list \\ (cname, (vname, cname \\ ty \\ fmod) mapping) mapping\"\nis \"\\P C. if is_class (Program P) C then\n Some (\\F. if \\T fm D. Program P \\ C sees F:T (fm) in D then Some (field (Program P) C F) else None)\n else None\" .\n\nlift_definition tabulate_Method :: \"'m cdecl list \\ (cname, (mname, cname \\ ty list \\ ty \\ 'm option) mapping) mapping\"\nis \"\\P C. if is_class (Program P) C then\n Some (\\M. if \\Ts T mthd D. Program P \\ C sees M:Ts\\T=mthd in D then Some (method (Program P) C M) else None)\n else None\" .\n\nfun wf_prog_impl' :: \"'m prog_impl' \\ bool\"\nwhere\n \"wf_prog_impl' (P, c, s, f, m) \\\n c = tabulate_class P \\\n s = tabulate_subcls P \\\n f = tabulate_sees_field P \\\n m = tabulate_Method P\"\n\nsubsection {* Implementation type for tabulated lookup functions *}\n\ntypedef 'm prog_impl = \"{P :: 'm prog_impl'. wf_prog_impl' P}\"\n morphisms impl_of ProgRefine \nproof\n show \"([], Mapping.empty, Mapping.empty, Mapping.empty, Mapping.empty) \\ ?prog_impl\"\n apply clarsimp\n by transfer (simp_all add: fun_eq_iff is_class_def rel_funI)\nqed\n\nlemma impl_of_ProgImpl [simp]:\n \"wf_prog_impl' Pfsm \\ impl_of (ProgRefine Pfsm) = Pfsm\"\nby(simp add: ProgRefine_inverse)\n\ndefinition program :: \"'m prog_impl \\ 'm prog\"\nwhere \"program = Program \\ fst \\ impl_of\"\n\ncode_datatype program\n\nlemma prog_impl_eq_iff:\n \"Pi = Pi' \\ program Pi = program Pi'\"\napply(cases Pi)\napply(cases Pi')\napply(auto simp add: ProgRefine_inverse program_def ProgRefine_inject)\ndone\n\nlemma wf_prog_impl'_impl_of [simp, intro!]:\n \"wf_prog_impl' (impl_of Pi)\"\nusing impl_of[of Pi] by simp\n\nlemma ProgImpl_impl_of [simp, code abstype]:\n \"ProgRefine (impl_of Pi) = Pi\"\nby(rule impl_of_inverse)\n\nlemma program_ProgRefine [simp]: \"wf_prog_impl' Psfm \\ program (ProgRefine Psfm) = Program (fst Psfm)\"\nby(simp add: program_def)\n\nlemma classes_program [code]: \"classes (program P) = fst (impl_of P)\"\nby(simp add: program_def)\n\nlemma class_program [code]: \"class (program Pi) = Mapping.lookup (fst (snd (impl_of Pi)))\"\nby(cases Pi)(clarsimp simp add: tabulate_class_def lookup.rep_eq Mapping_inverse)\n\nsubsection {* Refining sub class and lookup functions to use precomputed mappings *}\n\ndeclare subcls'.equation [code del]\n\nlemma subcls'_program [code]: \n \"subcls' (program Pi) C D \\ \n C = D \\\n (case Mapping.lookup (fst (snd (snd (impl_of Pi)))) C of None \\ False\n | Some m \\ D \\ m)\"\napply(cases Pi)\napply(clarsimp simp add: subcls'_def tabulate_subcls_def lookup.rep_eq Mapping_inverse)\napply(auto elim!: rtranclp_tranclpE dest: subcls_is_class intro: tranclp_into_rtranclp)\ndone\n\nlemma subcls'_i_i_i_program [code]:\n \"subcls'_i_i_i P C D = (if subcls' P C D then Predicate.single () else bot)\"\nby(rule pred_eqI)(auto elim: subcls'_i_i_iE intro: subcls'_i_i_iI)\n\nlemma subcls'_i_i_o_program [code]:\n \"subcls'_i_i_o (program Pi) C = \n sup (Predicate.single C) (case Mapping.lookup (fst (snd (snd (impl_of Pi)))) C of None \\ bot | Some m \\ pred_of_set m)\"\nby(cases Pi)(fastforce simp add: subcls'_i_i_o_def subcls'_def tabulate_subcls_def lookup.rep_eq Mapping_inverse intro!: pred_eqI split: split_if_asm elim: rtranclp_tranclpE dest: subcls_is_class intro: tranclp_into_rtranclp)\n\nlemma rtranclp_FioB_i_i_subcls1_i_i_o_code [code_unfold]:\n \"rtranclp_FioB_i_i (subcls1_i_i_o P) = subcls'_i_i_i P\"\nby(auto simp add: fun_eq_iff subcls1_i_i_o_def subcls'_def rtranclp_FioB_i_i_def subcls'_i_i_i_def)\n\ndeclare Method.equation[code del]\nlemma Method_program [code]:\n \"program Pi \\ C sees M:Ts\\T=meth in D \\ \n (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of \n None \\ False\n | Some m \\ \n (case Mapping.lookup m M of \n None \\ False\n | Some (D', Ts', T', meth') \\ Ts = Ts' \\ T = T' \\ meth = meth' \\ D = D'))\"\nby(cases Pi)(auto split: split_if_asm dest: sees_method_is_class simp add: tabulate_Method_def lookup.rep_eq Mapping_inverse)\n\nlemma Method_i_i_i_o_o_o_o_program [code]:\n \"Method_i_i_i_o_o_o_o (program Pi) C M = \n (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of\n None \\ bot\n | Some m \\\n (case Mapping.lookup m M of\n None \\ bot\n | Some (D, Ts, T, meth) \\ Predicate.single (Ts, T, meth, D)))\"\nby(auto simp add: Method_i_i_i_o_o_o_o_def Method_program intro!: pred_eqI)\n\nlemma Method_i_i_i_o_o_o_i_program [code]:\n \"Method_i_i_i_o_o_o_i (program Pi) C M D = \n (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of\n None \\ bot\n | Some m \\\n (case Mapping.lookup m M of\n None \\ bot\n | Some (D', Ts, T, meth) \\ if D = D' then Predicate.single (Ts, T, meth) else bot))\"\nby(auto simp add: Method_i_i_i_o_o_o_i_def Method_program intro!: pred_eqI)\n\ndeclare sees_field.equation[code del]\n\nlemma sees_field_program [code]:\n \"program Pi \\ C sees F:T (fd) in D \\\n (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n None \\ False\n | Some m \\ \n (case Mapping.lookup m F of \n None \\ False\n | Some (D', T', fd') \\ T = T' \\ fd = fd' \\ D = D'))\"\nby(cases Pi)(auto split: split_if_asm dest: has_visible_field[THEN has_field_is_class] simp add: tabulate_sees_field_def lookup.rep_eq Mapping_inverse)\n\nlemma sees_field_i_i_i_o_o_o_program [code]:\n \"sees_field_i_i_i_o_o_o (program Pi) C F =\n (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n None \\ bot\n | Some m \\\n (case Mapping.lookup m F of\n None \\ bot\n | Some (D, T, fd) \\ Predicate.single(T, fd, D)))\"\nby(auto simp add: sees_field_program sees_field_i_i_i_o_o_o_def intro: pred_eqI)\n\nlemma sees_field_i_i_i_o_o_i_program [code]:\n \"sees_field_i_i_i_o_o_i (program Pi) C F D =\n (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n None \\ bot\n | Some m \\\n (case Mapping.lookup m F of\n None \\ bot\n | Some (D', T, fd) \\ if D = D' then Predicate.single(T, fd) else bot))\"\nby(auto simp add: sees_field_program sees_field_i_i_i_o_o_i_def intro: pred_eqI)\n\nlemma field_program [code]:\n \"field (program Pi) C F = \n (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of \n None \\ Code.abort (STR ''not_unique'') (\\_. Predicate.the bot)\n | Some m \\ \n (case Mapping.lookup m F of\n None \\ Code.abort (STR ''not_unique'') (\\_. Predicate.the bot)\n | Some (D', T, fd) \\ (D', T, fd)))\"\nunfolding field_def\nby(cases Pi)(fastforce simp add: Predicate.the_def tabulate_sees_field_def lookup.rep_eq Mapping_inverse split: split_if_asm intro: arg_cong[where f=The] dest: has_visible_field[THEN has_field_is_class] sees_field_fun)\n\nsubsection {* Implementation for precomputing mappings *}\n\ndefinition tabulate_program :: \"'m cdecl list \\ 'm prog_impl\"\nwhere \"tabulate_program P = ProgRefine (P, tabulate_class P, tabulate_subcls P, tabulate_sees_field P, tabulate_Method P)\"\n\nlemma impl_of_tabulate_program [code abstract]:\n \"impl_of (tabulate_program P) = (P, tabulate_class P, tabulate_subcls P, tabulate_sees_field P, tabulate_Method P)\"\nby(simp add: tabulate_program_def)\n\nlemma Program_code [code]:\n \"Program = program \\ tabulate_program\"\nby(simp add: program_def fun_eq_iff tabulate_program_def)\n\nsubsubsection {* @{term \"class\" } *}\n\nlemma tabulate_class_code [code]:\n \"tabulate_class = Mapping.of_alist\"\n by transfer (simp add: fun_eq_iff)\n\nsubsubsection {* @{term \"subcls\" } *}\n\ninductive subcls1' :: \"'m cdecl list \\ cname \\ cname \\ bool\"\nwhere \n find: \"C \\ Object \\ subcls1' ((C, D, rest) # P) C D\"\n| step: \"\\ C \\ Object; C \\ C'; subcls1' P C D \\ \\ subcls1' ((C', D', rest) # P) C D\"\n\ncode_pred\n (modes: i \\ i \\ o \\ bool)\n subcls1' .\n\nlemma subcls1_into_subcls1':\n assumes \"subcls1 (Program P) C D\"\n shows \"subcls1' P C D\"\nproof -\n from assms obtain rest where \"map_of P C = \\(D, rest)\\\" \"C \\ Object\" by cases simp\n thus ?thesis by(induct P)(auto split: split_if_asm intro: subcls1'.intros)\nqed\n\nlemma subcls1'_into_subcls1:\n assumes \"subcls1' P C D\"\n shows \"subcls1 (Program P) C D\"\nusing assms\nproof(induct)\n case find thus ?case by(auto intro: subcls1.intros)\nnext\n case step thus ?case by(auto elim!: subcls1.cases intro: subcls1.intros)\nqed\n\nlemma subcls1_eq_subcls1':\n \"subcls1 (Program P) = subcls1' P\"\nby(auto simp add: fun_eq_iff intro: subcls1_into_subcls1' subcls1'_into_subcls1)\n\ndefinition subcls'' :: \"'m cdecl list \\ cname \\ cname \\ bool\"\nwhere \"subcls'' P = (subcls1' P)^**\"\n\ncode_pred\n (modes: i \\ i \\ i \\ bool)\n [inductify] \n subcls'' .\n\nlemma subcls''_eq_subcls: \"subcls'' P = subcls (Program P)\"\nby(simp add: subcls''_def subcls1_eq_subcls1')\n\nlemma subclst_snd_classD: \n assumes \"subclst (Program P) C D\"\n shows \"D \\ fst ` snd ` set P\"\nusing assms\nby(induct)(fastforce elim!: subcls1.cases dest!: map_of_SomeD intro: rev_image_eqI)+\n\ndefinition check_acyclicity :: \"(cname, cname set) mapping \\ 'm cdecl list \\ unit\"\nwhere \"check_acyclicity _ _ = ()\"\n\ndefinition cyclic_class_hierarchy :: unit \nwhere [code del]: \"cyclic_class_hierarchy = ()\"\n\ndeclare [[code abort: cyclic_class_hierarchy]]\n\nlemma check_acyclicity_code:\n \"check_acyclicity mapping P =\n (let _ = \n map (\\(C, D, _).\n if C = Object then () \n else\n (case Mapping.lookup mapping D of \n None \\ ()\n | Some Cs \\ if C \\ Cs then cyclic_class_hierarchy else ()))\n P\n in ())\"\nby simp\n\nlemma tablulate_subcls_code [code]:\n \"tabulate_subcls P = \n (let cnames = map fst P;\n cnames' = map (fst \\ snd) P;\n mapping = Mapping.tabulate cnames (\\C. set (C # [D \\ cnames'. subcls'' P C D]));\n _ = check_acyclicity mapping P\n in mapping\n )\"\napply(auto simp add: tabulate_subcls_def Mapping.tabulate_def fun_eq_iff is_class_def o_def map_of_map2[simplified split_def] Mapping_inject)\n apply(subst map_of_map2[simplified split_def])\n apply(auto simp add: fun_eq_iff subcls''_eq_subcls map_of_map_K dest: subclst_snd_classD elim: rtranclp_tranclpE)[1]\napply(subst map_of_map2[simplified split_def])\napply(rule sym)\napply simp\napply(case_tac \"map_of P x\")\napply auto\ndone\n\nsubsubsection {* @{term Fields} *}\n\ntext {* \n Problem: Does not terminate for cyclic class hierarchies!\n This problem already occurs in Jinja's well-formedness checker: \n @{text wf_cdecl} calls @{text wf_mdecl} before checking for acyclicity, \n but @{text wf_J_mdecl} involves the type judgements, \n which in turn requires @{term \"Fields\"} (via @{term sees_field}).\n Checking acyclicity before executing @{term \"Fields'\"} for tabulation is difficult\n because we would have to intertwine tabulation and well-formedness checking.\n Possible (local) solution:\n additional termination parameter (like memoisation for @{term \"rtranclp\"}) \n and list option as error return parameter.\n*}\ninductive\n Fields' :: \"'m cdecl list \\ cname \\ ((vname \\ cname) \\ (ty \\ fmod)) list \\ bool\"\nfor P :: \"'m cdecl list\"\nwhere \n rec:\n \"\\ map_of P C = Some(D,fs,ms); C \\ Object; Fields' P D FDTs;\n FDTs' = map (\\(F,Tm). ((F,C),Tm)) fs @ FDTs \\\n \\ Fields' P C FDTs'\"\n| Object:\n \"\\ map_of P Object = Some(D,fs,ms); FDTs = map (\\(F,T). ((F,Object),T)) fs \\\n \\ Fields' P Object FDTs\"\n\nlemma Fields'_into_Fields:\n assumes \"Fields' P C FDTs\"\n shows \"Program P \\ C has_fields FDTs\"\nusing assms\nby induct(auto intro: Fields.intros)\n\nlemma Fields_into_Fields':\n assumes \"Program P \\ C has_fields FDTs\"\n shows \"Fields' P C FDTs\"\nusing assms\nby induct(auto intro: Fields'.intros)\n\nlemma Fields'_eq_Fields:\n \"Fields' P = Fields (Program P)\"\nby(auto simp add: fun_eq_iff intro: Fields'_into_Fields Fields_into_Fields')\n\ncode_pred \n (modes: i \\ i \\ o \\ bool)\n Fields' .\n\ndefinition fields' :: \"'m cdecl list \\ cname \\ ((vname \\ cname) \\ (ty \\ fmod)) list\"\nwhere \"fields' P C = (if \\FDTs. Fields' P C FDTs then THE FDTs. Fields' P C FDTs else [])\"\n\nlemma eval_Fields'_conv:\n \"Predicate.eval (Fields'_i_i_o P C) = Fields' P C\"\nby(auto intro: Fields'_i_i_oI elim: Fields'_i_i_oE intro!: ext)\n\nlemma fields'_code [code]:\n \"fields' P C = \n (let FDTs = Fields'_i_i_o P C in if Predicate.holds (FDTs \\= (\\_. Predicate.single ())) then Predicate.the FDTs else [])\"\nby(auto simp add: fields'_def holds_eq Fields'_i_i_o_def intro: Fields'_i_i_oI Predicate.the_eqI[THEN sym])\n\nlemma The_Fields [simp]:\n \"P \\ C has_fields FDTs \\ The (Fields P C) = FDTs\"\nby(auto dest: has_fields_fun)\n\nlemma tabulate_sees_field_code [code]:\n \"tabulate_sees_field P =\n Mapping.tabulate (map fst P) (\\C. Mapping.of_alist (map (\\((F, D), Tfm). (F, (D, Tfm))) (fields' P C)))\"\napply(simp add: tabulate_sees_field_def tabulate_def is_class_def fields'_def Fields'_eq_Fields Mapping_inject)\napply(rule ext)\napply clarsimp\napply(rule conjI)\n apply(clarsimp simp add: o_def)\n apply(subst map_of_map2[unfolded split_def])\n apply simp\n apply transfer\n apply(rule conjI)\n apply clarsimp\n apply(rule ext)\n apply clarsimp\n apply(rule conjI)\n apply(clarsimp simp add: sees_field_def Fields'_eq_Fields)\n apply(drule (1) has_fields_fun, clarsimp)\n apply clarify\n apply(rule sym)\n apply(rule ccontr)\n apply(clarsimp simp add: sees_field_def Fields'_eq_Fields)\n apply clarsimp\n apply(rule ext)\n apply(clarsimp simp add: sees_field_def)\napply(clarsimp simp add: o_def)\napply(subst map_of_map2[simplified split_def])\napply(rule sym)\napply(clarsimp)\napply(rule ccontr)\napply simp\ndone\n\nsubsubsection {* @{term \"Methods\" } *}\n\ntext {* Same termination problem as for @{term Fields'} *}\ninductive Methods' :: \"'m cdecl list \\ cname \\ (mname \\ (ty list \\ ty \\ 'm option) \\ cname) list \\ bool\"\n for P :: \"'m cdecl list\"\nwhere \n \"\\ map_of P Object = Some(D,fs,ms); Mm = map (\\(M, rest). (M, (rest, Object))) ms \\\n \\ Methods' P Object Mm\"\n| \"\\ map_of P C = Some(D,fs,ms); C \\ Object; Methods' P D Mm;\n Mm' = map (\\(M, rest). (M, (rest, C))) ms @ Mm \\\n \\ Methods' P C Mm'\"\n\nlemma Methods'_into_Methods:\n assumes \"Methods' P C Mm\"\n shows \"Program P \\ C sees_methods (map_of Mm)\"\nusing assms\napply induct\n apply(clarsimp simp add: o_def split_def)\n apply(rule sees_methods_Object)\n apply fastforce\n apply(rule ext)\n apply(subst map_of_map2[unfolded split_def])\n apply(simp add: o_def)\n\napply(rule sees_methods_rec)\n apply fastforce\n apply simp\n apply assumption\napply(clarsimp simp add: map_add_def map_of_map2)\ndone\n\nlemma Methods_into_Methods':\n assumes \"Program P \\ C sees_methods Mm\"\n shows \"\\Mm'. Methods' P C Mm' \\ Mm = map_of Mm'\"\nusing assms\nby induct(auto intro: Methods'.intros simp add: map_of_map2 map_add_def)\n\ncode_pred \n (modes: i \\ i \\ o \\ bool)\n Methods'\n.\n\ndefinition methods' :: \"'m cdecl list \\ cname \\ (mname \\ (ty list \\ ty \\ 'm option) \\ cname) list\"\nwhere \"methods' P C = (if \\Mm. Methods' P C Mm then THE Mm. Methods' P C Mm else [])\"\n\nlemma methods'_code [code]:\n \"methods' P C =\n (let Mm = Methods'_i_i_o P C\n in if Predicate.holds (Mm \\= (\\_. Predicate.single ())) then Predicate.the Mm else [])\"\nunfolding methods'_def\nby(auto simp add: holds_eq Methods'_i_i_o_def Predicate.the_def)\n\nlemma Methods'_fun:\n assumes \"Methods' P C Mm\"\n shows \"Methods' P C Mm' \\ Mm = Mm'\"\nusing assms\napply(induct arbitrary: Mm')\n apply(fastforce elim: Methods'.cases)\napply(rotate_tac -1)\napply(erule Methods'.cases)\n apply(fastforce)\napply clarify\napply(simp)\ndone\n\nlemma The_Methods' [simp]: \"Methods' P C Mm \\ The (Methods' P C) = Mm\"\nby(auto dest: Methods'_fun)\n\nlemma methods_def2 [simp]: \"Methods' P C Mm \\ methods' P C = Mm\"\nby(auto simp add: methods'_def)\n\nlemma tabulate_Method_code [code]:\n \"tabulate_Method P =\n Mapping.tabulate (map fst P) (\\C. Mapping.of_alist (map (\\(M, (rest, D)). (M, D, rest)) (methods' P C)))\"\napply(simp add: tabulate_Method_def tabulate_def o_def lookup.rep_eq Mapping_inject)\napply(rule ext)\napply clarsimp\napply(rule conjI)\n apply clarify\n apply(rule sym)\n apply(subst map_of_map2[unfolded split_def])\n apply(simp add: is_class_def)\n apply transfer\n apply(rule ext)\n apply(simp add: map_of_map2)\n apply(rule conjI)\n apply(clarsimp simp add: map_of_map2 Method_def)\n apply(drule Methods_into_Methods')\n apply clarsimp\n apply(simp add: split_def)\n apply(subst map_of_map2[unfolded split_def])\n apply simp\n apply clarify\n apply(clarsimp simp add: methods'_def)\n apply(frule Methods'_into_Methods)\n apply(clarsimp simp add: Method_def)\n apply(simp add: split_def)\n apply(subst map_of_map2[unfolded split_def])\n apply(fastforce intro: ccontr)\napply clarify\napply(rule sym)\napply(simp add: map_of_eq_None_iff is_class_def)\napply(simp only: set_map[symmetric] map_map o_def fst_conv)\napply simp\ndone\n\ntext {* Merge modules TypeRel, Decl and TypeRelRefine to avoid cyclic modules *}\n\ncode_identifier\n code_module TypeRel \\\n (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module TypeRelRefine \\\n (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module Decl \\\n (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n\nML_val {* @{code Program} *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Execute/TypeRelRefine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2801429109119031}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m3_kerberos5.thy (Isabelle/HOL 2016-1)\n ID: $Id: m3_kerberos5.thy 132890 2016-12-24 10:25:57Z csprenge $\n Authors: Ivano Somaini, ETH Zurich \n Christoph Sprenger, ETH Zurich \n\n Key distribution protocols\n Third refinement: core Kerberos V\n\n Copyright (c) 2009-2016 Ivano Somaini, Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Core Kerberos 5 (L3)\\\n\ntheory m3_kerberos5 imports m2_kerberos \"../Refinement/Message\"\nbegin\n\ntext \\\nWe model the core Kerberos 5 protocol:\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B, Na \\\\ \n \\mathrm{M2.} & S \\rightarrow A: & \\{Kab, B, Ts, Na\\}_{Kas}, \\{Kab, A, Ts\\}_{Kbs} \\\\\n \\mathrm{M3.} & A \\rightarrow B: & \\{A, Ta\\}_{Kab}, \\{Kab, A, Ts\\}_{Kbs} \\\\\n \\mathrm{M4.} & B \\rightarrow A: & \\{Ta\\}_{Kab} \\\\\n\\end{array}\n\\]\n\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\.\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\Setup\\\n(******************************************************************************)\n\ntext \\Now we can define the initial key knowledge.\\\n\noverloading ltkeySetup' \\ ltkeySetup begin\ndefinition ltkeySetup_def: \"ltkeySetup' \\ {(sharK C, A) | C A. A = C \\ A = Sv}\"\nend\n\nlemma corrKey_shrK_bad [simp]: \"corrKey = shrK`bad\"\nby (auto simp add: keySetup_def ltkeySetup_def corrKey_def)\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\The secure channels are star-shaped to/from the server. Therefore,\nwe have only one agent in the relation.\\\n\nrecord m3_state = \"m1_state\" +\n IK :: \"msg set\" \\ \\intruder knowledge\\\n\n\ntext \\Observable state:\n@{term \"runs\"}, @{term \"leak\"}, @{term \"clk\"}, and @{term \"cache\"}.\\\n\ntype_synonym\n m3_obs = \"m2_obs\"\n\ndefinition\n m3_obs :: \"m3_state \\ m3_obs\" where\n \"m3_obs s \\ \\ runs = runs s, leak = leak s, clk = clk s, cache = cache s \\\"\n\ntype_synonym\n m3_pred = \"m3_state set\"\n\ntype_synonym\n m3_trans = \"(m3_state \\ m3_state) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext \\Protocol events.\\\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m2_step1\"}\\\n m3_step1 :: \"[rid_t, agent, agent, nonce] \\ m3_trans\"\nwhere\n \"m3_step1 Ra A B Na \\ {(s, s1).\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n Na = Ra$na \\ \\ \\generated nonce\\\n\n \\ \\actions:\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n IK := insert \\Agent A, Agent B, Nonce Na\\ (IK s) \\ \\send M1\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m2_step2\"}\\\n m3_step2 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step2 \\ m1_step2\"\n\ndefinition \\ \\by @{text \"Server\"}, refines @{term m2_step3}\\\n m3_step3 :: \"[rid_t, agent, agent, key, nonce, time] \\ m3_trans\"\nwhere\n \"m3_step3 Rs A B Kab Na Ts \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh server run\\\n Kab = sesK (Rs$sk) \\ \\ \\fresh session key\\\n\n \\Agent A, Agent B, Nonce Na\\ \\ IK s \\ \\ \\recv \\M1\\\\\n Ts = clk s \\ \\ \\fresh timestamp\\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M2\\\\\n s1 = s\\\n runs := (runs s)(Rs \\ (Serv, [A, B], [aNon Na, aNum Ts])),\n IK := insert \\Crypt (shrK A) \\Key Kab, Agent B, Number Ts, Nonce Na\\,\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\\\\n (IK s)\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step4}\\\n m3_step4 :: \"[rid_t, agent, agent, nonce, key, time, time, msg] \\ m3_trans\"\nwhere\n \"m3_step4 Ra A B Na Kab Ts Ta X \\ {(s, s1).\n\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\ \\ \\key not yet recv'd\\\n Na = Ra$na \\ \\ \\generated nonce\\\n\n \\Crypt (shrK A) \\ \\recv \\M2\\\\\n \\Key Kab, Agent B, Number Ts, Nonce Na\\, X\\ \\ IK s \\\n\n \\ \\read current time\\\n Ta = clk s \\\n\n \\ \\check freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M3\\\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n IK := insert \\Crypt Kab \\Agent A, Number Ta\\, X\\ (IK s) \\ \\\\M3\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m2_step5}\\\n m3_step5 :: \"[rid_t, agent, agent, key, time, time] \\ m3_trans\"\nwhere\n \"m3_step5 Rb A B Kab Ts Ta \\ {(s, s1).\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n \\Crypt Kab \\Agent A, Number Ta\\, \\ \\recv \\M3\\\\\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\\\ \\ IK s \\\n\n \\ \\ensure freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\check authenticator's validity and replay; 'replays' with fresh authenticator ok!\\\n clk s < Ta + La \\\n (B, Kab, Ta) \\ cache s \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n cache := insert (B, Kab, Ta) (cache s),\n IK := insert (Crypt Kab (Number Ta)) (IK s) \\ \\send \\M4\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step6}\\\n m3_step6 :: \"[rid_t, agent, agent, nonce, key, time, time] \\ m3_trans\"\nwhere\n \"m3_step6 Ra A B Na Kab Ts Ta \\ {(s, s').\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]) \\ \\ \\knows key\\\n Na = Ra$na \\ \\ \\generated nonce\\\n clk s < Ts + Ls \\ \\ \\check session key's recentness\\\n\n Crypt Kab (Number Ta) \\ IK s \\ \\ \\recv \\M4\\\\\n\n \\ \\actions:\\\n s' = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))\n \\\n }\"\n\ntext \\Clock tick event\\\n\ndefinition \\ \\refines @{term \"m2_tick\"}\\\n m3_tick :: \"time \\ m3_trans\"\nwhere\n \"m3_tick \\ m1_tick\"\n\n\ntext \\Purge event: purge cache of expired timestamps\\\n\ndefinition \\ \\refines @{term \"m2_purge\"}\\\n m3_purge :: \"agent \\ m3_trans\"\nwhere\n \"m3_purge \\ m1_purge\"\n\n\ntext \\Session key compromise.\\\n\ndefinition \\ \\refines @{term m2_leak}\\\n m3_leak :: \"[rid_t, agent, agent, nonce, time] \\ m3_trans\"\nwhere\n \"m3_leak Rs A B Na Ts \\ {(s, s1).\n \\ \\guards:\\\n runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]) \\\n (clk s \\ Ts + Ls) \\ \\ \\only compromise 'old' session keys\\\n\n \\ \\actions:\\\n \\ \\record session key as leaked and add it to intruder knowledge\\\n s1 = s\\ leak := insert (sesK (Rs$sk), A, B, Na, Ts) (leak s),\n IK := insert (Key (sesK (Rs$sk))) (IK s) \\\n }\"\n\ntext \\Intruder fake event. The following \"Dolev-Yao\" event generates all\nintruder-derivable messages.\\\n\ndefinition \\ \\refines @{term \"m2_fake\"}\\\n m3_DY_fake :: \"m3_trans\"\nwhere\n \"m3_DY_fake \\ {(s, s1).\n\n \\ \\actions:\\\n s1 = s(| IK := synth (analz (IK s)) |) \\ \\take DY closure\\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\ndefinition\n m3_init :: \"m3_pred\"\nwhere\n \"m3_init \\ { \\\n runs = Map.empty,\n leak = shrK`bad \\ {undefined},\n clk = 0,\n cache = {},\n IK = Key`shrK`bad\n \\ }\"\n\ndefinition\n m3_trans :: \"m3_trans\" where\n \"m3_trans \\ (\\A B Ra Rb Rs Na Kab Ts Ta T X.\n m3_step1 Ra A B Na \\\n m3_step2 Rb A B \\\n m3_step3 Rs A B Kab Na Ts \\\n m3_step4 Ra A B Na Kab Ts Ta X \\\n m3_step5 Rb A B Kab Ts Ta \\\n m3_step6 Ra A B Na Kab Ts Ta \\\n m3_tick T \\\n m3_purge A \\\n m3_leak Rs A B Na Ts \\\n m3_DY_fake \\\n Id\n )\"\n\ndefinition\n m3 :: \"(m3_state, m3_obs) spec\" where\n \"m3 \\ \\\n init = m3_init,\n trans = m3_trans,\n obs = m3_obs\n \\\"\n\nlemmas m3_loc_defs =\n m3_def m3_init_def m3_trans_def m3_obs_def\n m3_step1_def m3_step2_def m3_step3_def m3_step4_def m3_step5_def\n m3_step6_def m3_tick_def m3_purge_def m3_leak_def m3_DY_fake_def\n\nlemmas m3_defs = m3_loc_defs m2_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\ntext \\Specialized injection that we can apply more aggressively.\\\n\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\n\ndeclare parts_Inj_IK [dest!]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\inv1: Secrecy of pre-distributed shared keys\\\n(*inv*************************************************************************)\n\ndefinition\n m3_inv1_lkeysec :: \"m3_pred\"\nwhere\n \"m3_inv1_lkeysec \\ {s. \\C.\n (Key (shrK C) \\ parts (IK s) \\ C \\ bad) \\\n (C \\ bad \\ Key (shrK C) \\ IK s)\n }\"\n\nlemmas m3_inv1_lkeysecI = m3_inv1_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_lkeysecE [elim] = m3_inv1_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_lkeysecD = m3_inv1_lkeysec_def [THEN setc_def_to_dest, rule_format]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv1_lkeysec_init [iff]:\n \"init m3 \\ m3_inv1_lkeysec\"\nby (auto simp add: m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec_trans [iff]:\n \"{m3_inv1_lkeysec} trans m3 {> m3_inv1_lkeysec}\"\nby (fastforce simp add: PO_hoare_defs m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec [iff]: \"reach m3 \\ m3_inv1_lkeysec\"\nby (rule inv_rule_basic) (fast+)\n\n\ntext \\Useful simplifier lemmas\\\n\nlemma m3_inv1_lkeysec_for_parts [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ parts (IK s) \\ C \\ bad\"\nby auto\n\nlemma m3_inv1_lkeysec_for_analz [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ analz (IK s) \\ C \\ bad\"\nby auto\n\n\nsubsubsection \\inv2: Session keys not used to encrypt other session keys\\\n(*invh*************************************************************************)\n\ntext \\Session keys are not used to encrypt other keys. Proof requires\ngeneralization to sets of session keys.\n\nNOTE: This invariant will be inherted from the corresponding L2 invariant\nusing the simulation relation.\n\\\n\ndefinition\n m3_inv2_sesK_compr :: \"m3_pred\"\nwhere\n \"m3_inv2_sesK_compr \\ {s. \\K KK.\n KK \\ range sesK \\\n (Key K \\ analz (Key`KK \\ (IK s))) = (K \\ KK \\ Key K \\ analz (IK s))\n }\"\n\nlemmas m3_inv2_sesK_comprI = m3_inv2_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv2_sesK_comprE = m3_inv2_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv2_sesK_comprD = m3_inv2_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Additional lemma\\\nlemmas insert_commute_Key = insert_commute [where x=\"Key K\" for K]\n\nlemmas m3_inv2_sesK_compr_simps =\n m3_inv2_sesK_comprD\n m3_inv2_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n m3_inv2_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n insert_commute_Key\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\nsubsubsection \\Message abstraction and simulation relation\\\n(******************************************************************************)\n\ntext \\Abstraction function on sets of messages.\\\n\ninductive_set\n abs_msg :: \"msg set \\ chmsg set\"\n for H :: \"msg set\"\nwhere\n am_M1:\n \"\\Agent A, Agent B, Nonce N\\ \\ H\n \\ Insec A B (Msg [aNon N]) \\ abs_msg H\"\n| am_M2a:\n \"Crypt (shrK C) \\Key K, Agent B, Number T, Nonce N\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt B, aNum T, aNon N]) \\ abs_msg H\"\n| am_M2b:\n \"Crypt (shrK C) \\Key K, Agent A, Number T\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt A, aNum T]) \\ abs_msg H\"\n| am_M3:\n \"Crypt K \\Agent A, Number T\\ \\ H\n \\ dAuth K (Msg [aAgt A, aNum T]) \\ abs_msg H\"\n| am_M4:\n \"Crypt K (Number T) \\ H\n \\ dAuth K (Msg [aNum T]) \\ abs_msg H\"\n\n\ntext \\R23: The simulation relation. This is a data refinement of\nthe insecure and secure channels of refinement 2.\\\n\ndefinition\n R23_msgs :: \"(m2_state \\ m3_state) set\" where\n \"R23_msgs \\ {(s, t). abs_msg (parts (IK t)) \\ chan s }\"\n\ndefinition\n R23_keys :: \"(m2_state \\ m3_state) set\" where\n \"R23_keys \\ {(s, t). \\KK K. KK \\ range sesK \\\n Key K \\ analz (Key`KK \\ (IK t)) \\ aKey K \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_non :: \"(m2_state \\ m3_state) set\" where\n \"R23_non \\ {(s, t). \\KK N. KK \\ range sesK \\\n Nonce N \\ analz (Key`KK \\ (IK t)) \\ aNon N \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_pres :: \"(m2_state \\ m3_state) set\" where\n \"R23_pres \\ {(s, t). runs s = runs t \\ leak s = leak t \\ clk s = clk t \\ cache s = cache t}\"\n\ndefinition\n R23 :: \"(m2_state \\ m3_state) set\" where\n \"R23 \\ R23_msgs \\ R23_keys \\ R23_non \\ R23_pres\"\n\nlemmas R23_defs =\n R23_def R23_msgs_def R23_keys_def R23_non_def R23_pres_def\n\n\ntext \\The mediator function is the identity here.\\\n\ndefinition\n med32 :: \"m3_obs \\ m2_obs\" where\n \"med32 \\ id\"\n\n\nlemmas R23_msgsI = R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_msgsE' [elim] = R23_msgs_def [THEN rel_def_to_dest, simplified, rule_format, THEN subsetD]\n\nlemmas R23_keysI = R23_keys_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_keysE [elim] = R23_keys_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_nonI = R23_non_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_nonE [elim] = R23_non_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_presI = R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_keysI R23_nonI R23_presI\n\n\ntext \\Simplifier lemmas for various instantiations (keys and nonces).\\\n\nlemmas R23_keys_simp = R23_keys_def [THEN rel_def_to_dest, simplified, rule_format]\nlemmas R23_keys_simps =\n R23_keys_simp\n R23_keys_simp [where KK=\"{}\", simplified]\n R23_keys_simp [where KK=\"{K'}\" for K', simplified]\n R23_keys_simp [where KK=\"insert K' KK\" for K' KK, simplified, OF _ conjI]\n\nlemmas R23_non_simp = R23_non_def [THEN rel_def_to_dest, simplified, rule_format]\nlemmas R23_non_simps =\n R23_non_simp\n R23_non_simp [where KK=\"{}\", simplified]\n R23_non_simp [where KK=\"{K}\" for K, simplified]\n R23_non_simp [where KK=\"insert K KK\" for K KK, simplified, OF _ conjI]\n\nlemmas R23_simps = R23_keys_simps R23_non_simps\n\n\nsubsubsection \\General lemmas\\\n(******************************************************************************)\n\ntext \\General facts about @{term \"abs_msg\"}\\\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n \"abs_msg (G \\ H) = abs_msg G \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n \"\\ m \\ abs_msg G; G \\ H \\ \\ m \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n \"\\ m \\ abs_msg H \\ \\ m \\ abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\Facts about @{term \"abs_msg\"} concerning abstraction of fakeable\nmessages. This is crucial for proving the refinement of the intruder event.\\\n\nlemma abs_msg_DY_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs; (s, t) \\ R23_keys; (s, t) \\ R23_non; t \\ m3_inv1_lkeysec \\\n \\ abs_msg (synth (analz (IK t))) \\ fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n\\ \\9 subgoals, deal with replays first\\\nprefer 2 apply (blast)\nprefer 3 apply (blast)\nprefer 4 apply (blast)\nprefer 5 apply (blast)\n\\ \\remaining 5 subgoals are real fakes\\\napply (intro fake_StatCh fake_DynCh, auto simp add: R23_simps)+\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\ntext \\Pair decomposition. These were set to \\texttt{elim!}, which is too\nagressive here.\\\n\ndeclare MPair_analz [rule del, elim]\ndeclare MPair_parts [rule del, elim]\n\n\ntext \\Protocol events.\\\n\nlemma PO_m3_step1_refines_m2_step1:\n \"{R23}\n (m2_step1 Ra A B Na), (m3_step1 Ra A B Na)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros) (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n \"{R23}\n (m2_step2 Rb A B), (m3_step2 Rb A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_step3_refines_m2_step3:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv2_sesK_compr \\ m3_inv1_lkeysec)}\n (m2_step3 Rs A B Kab Na Ts), (m3_step3 Rs A B Kab Na Ts)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_non\"\n \"(s, t) \\ R23_pres\"\n \"s \\ m2_inv3a_sesK_compr\"\n \"t \\ m3_inv2_sesK_compr\" \"t \\ m3_inv1_lkeysec\"\n \"Kab = sesK (Rs$sk)\" \"Rs \\ dom (runs t)\"\n \"\\ Agent A, Agent B, Nonce Na \\ \\ parts (IK t)\"\n let ?s'=\n \"s\\ runs := runs s(Rs \\ (Serv, [A, B], [aNon Na, aNum (clk t)])),\n chan := insert (Secure Sv A (Msg [aKey Kab, aAgt B, aNum (clk t), aNon Na]))\n (insert (Secure Sv B (Msg [aKey Kab, aAgt A, aNum (clk t)])) (chan s)) \\\"\n let ?t'=\n \"t\\ runs := runs t(Rs \\ (Serv, [A, B], [aNon Na, aNum (clk t)])),\n IK := insert\n \\ Crypt (shrK A) \\ Key Kab, Agent B, Number (clk t), Nonce Na \\,\n Crypt (shrK B) \\ Key Kab, Agent A, Number (clk t) \\ \\\n (IK t) \\\"\n \\ \\here we go\\\n have \"(?s', ?t') \\ R23_msgs\" using H\n by (-) (rule R23_intros, auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\" using H\n by (-) (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv2_sesK_compr_simps,\n auto simp add: R23_keys_simps)\n moreover\n have \"(?s', ?t') \\ R23_non\" using H\n by (-)\n (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv2_sesK_compr_simps R23_non_simps)\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (-) (rule R23_intros, auto)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs)\nqed\n\nlemma PO_m3_step4_refines_m2_step4:\n \"{R23 \\ UNIV \\ m3_inv1_lkeysec}\n (m2_step4 Ra A B Na Kab Ts Ta), (m3_step4 Ra A B Na Kab Ts Ta X)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_non\"\n \"(s, t) \\ R23_pres\" \"t \\ m3_inv1_lkeysec\"\n \"runs t Ra = Some (Init, [A, B], [])\" \"Na = Ra$na\"\n \"\\ Crypt (shrK A) \\Key Kab, Agent B, Number Ts, Nonce Na\\, X\\ \\ analz (IK t)\"\n let ?s' = \"s\\ runs := runs s(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum (clk t)])),\n chan := insert (dAuth Kab (Msg [aAgt A, aNum (clk t)])) (chan s) \\\"\n and ?t' = \"t\\ runs := runs t(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum (clk t)])),\n IK := insert \\Crypt Kab \\Agent A, Number (clk t)\\, X\\ (IK t) \\\"\n from H have\n \"Secure Sv A (Msg [aKey Kab, aAgt B, aNum Ts, aNon Na]) \\ chan s\"\n by (auto dest!: analz_into_parts elim!: MPair_parts)\n moreover\n from H have \"X \\ parts (IK t)\" by (auto)\n with H have \"(?s', ?t') \\ R23_msgs\" by (auto intro!: R23_intros) (auto)\n moreover\n from H have \"X \\ analz (IK t)\" by (auto)\n with H have \"(?s', ?t') \\ R23_keys\"\n by (auto intro!: R23_intros) (auto dest!: analz_cut intro: analz_monotonic)\n moreover\n from H have \"X \\ analz (IK t)\" by (auto)\n with H have \"(?s', ?t') \\ R23_non\"\n by (auto intro!: R23_intros) (auto dest!: analz_cut intro: analz_monotonic)\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (auto intro!: R23_intros)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs dest!: analz_Inj_IK)\nqed\n\nlemma PO_m3_step5_refines_m2_step5:\n \"{R23}\n (m2_step5 Rb A B Kab Ts Ta), (m3_step5 Rb A B Kab Ts Ta)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step6_refines_m2_step6:\n \"{R23}\n (m2_step6 Ra A B Na Kab Ts Ta), (m3_step6 Ra A B Na Kab Ts Ta)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_tick_refines_m2_tick:\n \"{R23}\n (m2_tick T), (m3_tick T)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_purge_refines_m2_purge:\n \"{R23}\n (m2_purge A), (m3_purge A)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\n\ntext \\Intruder events.\\\n\nlemma PO_m3_leak_refines_m2_leak:\n \"{R23}\n (m2_leak Rs A B Na Ts), (m3_leak Rs A B Na Ts)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs R23_simps intro!: R23_intros)\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n \"{R23 \\ m2_inv3a_sesK_compr \\ (m3_inv2_sesK_compr \\ m3_inv1_lkeysec)}\n m2_fake, m3_DY_fake\n {> R23}\"\napply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros\n del: abs_msg.cases)\napply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]\n del: abs_msg.cases)\napply (auto simp add: R23_simps)\ndone\n\n\ntext \\All together now...\\\n\nlemmas PO_m3_trans_refines_m2_trans =\n PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n PO_m3_step3_refines_m2_step3 PO_m3_step4_refines_m2_step4\n PO_m3_step5_refines_m2_step5 PO_m3_step6_refines_m2_step6\n PO_m3_tick_refines_m2_tick PO_m3_purge_refines_m2_purge\n PO_m3_leak_refines_m2_leak PO_m3_DY_fake_refines_m2_fake\n\n\nlemma PO_m3_refines_init_m2 [iff]:\n \"init m3 \\ R23``(init m2)\"\nby (auto simp add: R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv2_sesK_compr \\ m3_inv1_lkeysec)}\n (trans m2), (trans m3)\n {> R23}\"\nby (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\n (blast intro!: PO_m3_trans_refines_m2_trans)+\n\nlemma PO_m3_observation_consistent [iff]:\n \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m3_defs)\n\n\ntext \\Refinement result.\\\n\nlemma m3_refines_m2 [iff]:\n \"refines\n (R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv1_lkeysec))\n med32 m2 m3\"\nproof -\n have \"R23 \\ m2_inv3a_sesK_compr \\ UNIV \\ UNIV \\ m3_inv2_sesK_compr\"\n by (auto simp add: R23_def R23_keys_simps intro!: m3_inv2_sesK_comprI)\n thus ?thesis\n by (-) (rule Refinement_using_invariants, auto)\nqed\n\nlemma m3_implements_m2 [iff]:\n \"implements med32 m2 m3\"\nby (rule refinement_soundness) (auto)\n\n\nsubsection \\Inherited invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv3 (derived): Key secrecy for initiator\\\n(*invh*************************************************************************)\n\ndefinition\n m3_inv3_ikk_init :: \"m3_state set\"\nwhere\n \"m3_inv3_ikk_init \\ {s. \\A B Ra K Ts nl.\n runs s Ra = Some (Init, [A, B], aKey K # aNum Ts # nl) \\ A \\ good \\ B \\ good \\\n Key K \\ analz (IK s) \\\n (K, A, B, Ra$na, Ts) \\ leak s\n }\"\n\nlemmas m3_inv3_ikk_initI = m3_inv3_ikk_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_ikk_initE [elim] = m3_inv3_ikk_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_ikk_initD = m3_inv3_ikk_init_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv3_ikk_init: \"reach m3 \\ m3_inv3_ikk_init\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n show \"Range (R23 \\ m2_inv3a_sesK_compr \\ m3_inv1_lkeysec \\ m2_inv6_ikk_init \\ UNIV)\n \\ m3_inv3_ikk_init\"\n by (fastforce simp add: R23_def R23_keys_simps intro!: m3_inv3_ikk_initI)\nqed auto\n\n\nsubsubsection \\inv4 (derived): Key secrecy for responder\\\n(*invh*************************************************************************)\n\ndefinition\n m3_inv4_ikk_resp :: \"m3_state set\"\nwhere\n \"m3_inv4_ikk_resp \\ {s. \\A B Rb K Ts nl.\n runs s Rb = Some (Resp, [A, B], aKey K # aNum Ts # nl) \\ A \\ good \\ B \\ good \\\n Key K \\ analz (IK s) \\\n (\\Na. (K, A, B, Na, Ts) \\ leak s)\n }\"\n\nlemmas m3_inv4_ikk_respI = m3_inv4_ikk_resp_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv4_ikk_respE [elim] = m3_inv4_ikk_resp_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv4_ikk_respD = m3_inv4_ikk_resp_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv4_ikk_resp: \"reach m3 \\ m3_inv4_ikk_resp\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n show \"Range (R23 \\ m2_inv3a_sesK_compr \\ m3_inv1_lkeysec \\ m2_inv7_ikk_resp \\ UNIV)\n \\ m3_inv4_ikk_resp\"\n by (auto simp add: R23_def R23_keys_simps intro!: m3_inv4_ikk_respI)\n (elim m2_inv7_ikk_respE, auto)\nqed auto\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m3_kerberos5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2801429109119031}} {"text": "theory \"BrandsChaum_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: Distance bounding following Brands, Chaum *)\n\n(* text: \n\nWe model the distance bounding protocol following Brands and Chaum\n\n Stefan Brands and David Chaum. Distance-Bounding Protocols. EUROCRYPT '93 \n Lecture Notes in Computer Science 765, pp. 344--359, Springer, 1993.\n\nSince the Dolev-Yao model has no notion of time, we can only show that\nthe challenge-response steps have to happen in the right order.\n\n *)\n\nrole P\nwhere \"P =\n [ Send ''1'' <| sAV ''P'', PEnc ( sN ''m'' ) ( sN ''k'' ) |>\n , Recv ''2'' ( sMV ''a'' )\n , Send ''3'' ( PHash <| sMV ''a'', sN ''m'' |> )\n , Send ''4'' <| sN ''m'', sN ''k'',\n PEnc <| sMV ''a'', PHash <| sMV ''a'', sN ''m'' |> |> ( sSK ''P'' )\n |>\n ]\"\n\nrole V\nwhere \"V =\n [ Recv ''1'' <| sMV ''P'', sMV ''c'' |>\n , Send ''2'' ( sN ''a'' )\n , Recv ''3'' ( sMV ''b'' )\n , Recv ''4'' <| sMV ''m'', sMV ''k'',\n PEnc <| sN ''a'', sMV ''b'' |> ( PAsymSK ( sMV ''P'' ) )\n |>\n , MatchEq ''5'' ( MVar ''c'' ) ( PEnc ( sMV ''m'' ) ( sMV ''k'' ) )\n , MatchEq ''6'' ( MVar ''b'' ) ( PHash <| sN ''a'', sMV ''m'' |> )\n ]\"\n\nprotocol BrandsChaum\nwhere \"BrandsChaum = { P, V }\"\n\nlocale restricted_BrandsChaum_state = BrandsChaum_state\n\ntype_invariant BrandsChaum_msc_typing for BrandsChaum\nwhere \"BrandsChaum_msc_typing = mk_typing\n [ ((V, ''P''), (KnownT V_1))\n , ((P, ''a''), (KnownT P_2))\n , ((V, ''b''), (KnownT V_3))\n , ((V, ''c''), (KnownT V_1))\n , ((V, ''k''), (KnownT V_4))\n , ((V, ''m''), (KnownT V_4))\n ]\"\n\nsublocale BrandsChaum_state < BrandsChaum_msc_typing_state\nproof -\n have \"(t,r,s) : approx BrandsChaum_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF BrandsChaum_msc_typing.monoTyp, completeness_cases_rule])\n case (V_1_P t r s tid0)\n then interpret state: BrandsChaum_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = V_1_P\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (V_1_c t r s tid0)\n then interpret state: BrandsChaum_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = V_1_c\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (V_4_k t r s tid0)\n then interpret state: BrandsChaum_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = V_4_k\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (V_4_m t r s tid0)\n then interpret state: BrandsChaum_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = V_4_m\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n qed\n thus \"BrandsChaum_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext BrandsChaum_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\nlemma (in restricted_BrandsChaum_state) prover_recent:\n \"let\n prems =\n (% tid0.\n roleMap r tid0 = Some V &\n RLKR(s(MV ''P'' tid0)) ~: reveals t & ( tid0, V_6 ) : steps t);\n concs =\n (% tid0 tid1.\n roleMap r tid1 = Some P &\n s(MV ''P'' tid0) = s(AV ''P'' tid1) &\n s(MV ''m'' tid0) = LN ''m'' tid1 &\n s(MV ''k'' tid0) = LN ''k'' tid1 &\n LN ''a'' tid0 = s(MV ''a'' tid1) &\n predOrd t (St( tid1, P_1 )) (St( tid0, V_2 )) &\n predOrd t (St( tid0, V_2 )) (St( tid1, P_3 )) &\n predOrd t (St( tid1, P_3 )) (St( tid0, V_3 )))\n in ? f. inj_on f (Collect prems) & (! i. prems i --> concs i (f i))\"\n (is \"let prems = ?prems; concs = ?concs in ?P prems concs\")\nproof -\n { fix tid0 tid1\n assume facts: \"?prems tid0\"\n have \" ? tid1. ?concs tid0 tid1\"\n proof -\n note_unified facts = facts\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LN ''a'' tid0, Hash {| LN ''a'' tid0, s(MV ''m'' tid0) |} |}\n ( SK ( s(MV ''P'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (P_4_enc tid1) note_unified facts = this facts\n thus ?thesis proof(sources! \" LN ''a'' tid0 \")\n case V_2_a note_unified facts = this facts\n thus ?thesis proof(sources! \" LN ''m'' tid1 \")\n case P_1_m note_unified facts = this facts\n thus ?thesis proof(sources! \" LN ''k'' tid1 \")\n case P_4_k note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc ( LN ''m'' tid1 ) ( s(MV ''k'' tid0) ) \")\n case (P_1_enc tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \" Hash {| LN ''a'' tid0, LN ''m'' tid1 |} \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_3_hash tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_4_hash tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n next\n case P_4_m note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc ( LN ''m'' tid1 ) ( s(MV ''k'' tid0) ) \")\n case (P_1_enc tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \" Hash {| LN ''a'' tid0, LN ''m'' tid1 |} \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_3_hash tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (P_4_hash tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed\n }\n note niagree = this\n { fix i1 i2 j\n assume \"?concs i1 j & ?concs i2 j\"\n note_unified facts = this\n have \"i1 = i2\" using facts by simp\n }\n note conc_inj = this\n show ?thesis\n by (fast intro!: iagree_to_niagree elim!: niagree conc_inj)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/BrandsChaum_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2801154799540876}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | August 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | |\n | CSP-Prover on Isabelle2009-2 |\n | October 2010 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | CSP-Prover on Isabelle2017 |\n | April 2018 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory Domain_F_cpo\nimports Domain_F CSP_T.Domain_T_cpo Set_F_cpo \n CSP.CPO_pair CSP_T.CSP_T_continuous\nbegin\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*********************************************************\n Bottom in Dom_F\n *********************************************************)\n(*\ninstance domF :: (type) bot0\nby (intro_classes)\n*)\n\n\ninstantiation domF :: (type) bot0\nbegin\ndefinition\n bottom_domF_def : \"Bot == ({<>}t ,, {}f)\"\ninstance ..\nend\n\n(*\ndefs (overloaded)\n bottom_domF_def : \"Bot == ({<>}t ,, {}f)\"\n*)\n\nlemma bottom_domF: \"Bot <= (F::'a domF)\"\napply (simp add: bottom_domF_def pairF_def)\napply (simp add: subdomF_def Abs_domF_inverse)\ndone\n\ninstance domF :: (type) bot\napply (intro_classes)\nby (simp add: bottom_domF)\n\n(*** fstF and sndF ***)\n\nlemma fstF_bottom_domF[simp]: \"(fstF o Bot) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domF_def)\napply (simp add: bottom_domT_def)\napply (simp add: comp_def pairF)\ndone\n\nlemma sndF_bottom_domF[simp]: \"(sndF o Bot) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: bottom_domF_def)\napply (simp add: bottom_setF_def)\napply (simp add: comp_def pairF)\ndone\n\n(********************************************************** \n lemmas used in a proof that domain_F is a cpo.\n **********************************************************)\n\n(* LUB_TF TFs is an upper bound of TFs *)\n\ndefinition\n LUB_TF :: \"'a domTsetF set => 'a domTsetF\"\n where\n LUB_TF_def : \"LUB_TF TFs == (UnionT (fst ` TFs), UnionF (snd ` TFs))\"\n \ndefinition \n LUB_domF :: \"'a domF set => 'a domF\"\n where\n LUB_domF_def : \"LUB_domF Fs == Abs_domF (LUB_TF (Rep_domF ` Fs))\"\n\n(************* LUB_TF *************)\n\n(*** LUB_TF --> LUB ***)\n\nlemma LUB_TF_isLUB:\n \"TFs ~= {} ==> LUB_TF TFs isLUB TFs\"\napply (simp add: pair_LUB_decompo)\napply (simp add: LUB_TF_def)\napply (simp add: isLUB_UnionT isLUB_UnionF)\ndone\n\n(*** LUB --> LUB_TF ***)\n\nlemma isLUB_LUB_TF_only_if:\n \"[| TFs ~= {} ; TF isLUB TFs |] ==> TF = LUB_TF TFs\"\napply (insert LUB_TF_isLUB[of TFs])\nby (simp add: LUB_unique)\n\n(* iff *)\n\nlemma isLUB_LUB_TF : \"TFs ~= {} ==> TF isLUB TFs = (TF = LUB_TF TFs)\"\napply (rule iffI)\napply (simp add: isLUB_LUB_TF_only_if)\napply (simp add: LUB_TF_isLUB)\ndone\n\n(*** LUB TF = LUB_TF ***)\n\nlemma LUB_LUB_TF:\n \"TFs ~= {} ==> LUB TFs = LUB_TF TFs\"\nby (simp add: isLUB_LUB LUB_TF_isLUB)\n\n(****** LUB_TF TFs in domF ******)\n\n(* T3_F4 *)\n\nlemma LUB_TF_in_T3_F4: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_T3_F4 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_T3_F4_def)\napply (intro allI impI)\napply (elim bexE conjE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_iff HC_T3_F4_def)\nby (auto)\n\n(* F3 *)\n\nlemma LUB_TF_in_F3: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_F3 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_F3_def)\napply (intro allI impI)\n\napply (elim bexE conjE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\nby (auto)\n\n(* T2 *)\n\nlemma LUB_TF_in_T2: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> HC_T2 (LUB_TF TFs)\"\napply (simp add: LUB_TF_def HC_T2_def)\napply (intro allI impI)\n\napply (elim exE bexE)\napply (drule_tac x=\"x\" in bspec, simp)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\nby (auto)\n\n(*** LUB_TF TFs in domF ***)\n\nlemma LUB_TF_in: \n \"[| TFs ~= {} ; ALL TF:TFs. TF:domF |] ==> (LUB_TF TFs): domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: LUB_TF_in_T2)\napply (simp add: LUB_TF_in_F3)\napply (simp add: LUB_TF_in_T3_F4)\ndone\n\nlemma LUB_TF_in_Rep: \n \"Fs ~= {} ==> (LUB_TF (Rep_domF ` Fs)): domF\"\napply (rule LUB_TF_in)\napply (auto)\ndone\n\n(************* LUB_domF *************)\n\n(* isLUB lemma *)\n\nlemma TF_isLUB_domFs:\n \"[| TF:domF ; TF isLUB Rep_domF ` Fs |] ==> Abs_domF TF isLUB Fs\"\napply (simp add: isUB_def isLUB_def)\napply (rule conjI)\n\n(* ub *)\napply (intro allI impI)\napply (elim bexE conjE)\napply (drule_tac x=\"fst (Rep_domF y)\" in spec)\napply (drule_tac x=\"snd (Rep_domF y)\" in spec)\napply (simp add: subdomF_def Abs_domF_inverse)\n\n(* lub *)\napply (intro allI impI)\napply (elim bexE conjE)\napply (rotate_tac -1)\napply (drule_tac x=\"fst (Rep_domF y)\" in spec)\napply (rotate_tac -1)\napply (drule_tac x=\"snd (Rep_domF y)\" in spec)\napply (simp)\napply (drule mp)\n apply (intro allI impI)\n apply (simp add: image_def)\n apply (elim bexE conjE)\n apply (drule_tac x=\"x\" in spec)\n apply (simp)\n apply (simp add: subdomF_def)\napply (simp add: subdomF_def Abs_domF_inverse)\ndone\n\n(*** LUB_domF --> LUB ***)\n\nlemma LUB_domF_isLUB:\n \"Fs ~= {} ==> LUB_domF Fs isLUB Fs\"\napply (simp add: LUB_domF_def)\napply (rule TF_isLUB_domFs)\napply (simp add: LUB_TF_in)\napply (simp add: LUB_TF_isLUB)\ndone\n\nlemma LUB_domF_isLUB_I:\n \"[| Fs ~= {} ; F = LUB_domF Fs |] ==> F isLUB Fs\"\nby (simp add: LUB_domF_isLUB)\n\n(*** LUB --> LUB_domF ***)\n\nlemma isLUB_LUB_domF_only_if:\n \"[| Fs ~= {} ; F isLUB Fs |] ==> F = LUB_domF Fs\"\napply (insert LUB_domF_isLUB[of Fs])\nby (simp add: LUB_unique)\n\n(* iff *)\n\nlemma isLUB_LUB_domF : \"Fs ~= {} ==> F isLUB Fs = (F = LUB_domF Fs)\"\napply (rule iffI)\napply (simp add: isLUB_LUB_domF_only_if)\napply (simp add: LUB_domF_isLUB)\ndone\n\n(********************************************************** \n ( domF, <= ) is a CPO\n **********************************************************)\n\ninstance domF :: (type) cpo\napply (intro_classes)\napply (simp add: hasLUB_def)\napply (rule_tac x=\"LUB_domF X\" in exI)\nby (simp add: directed_def LUB_domF_isLUB)\n\n(********************************************************** \n ( domF, <= ) is a pointed CPO\n **********************************************************)\n\ninstance domF :: (type) cpo_bot\nby (intro_classes)\n\n(********************************************************** \n continuity of Abs_domF\n **********************************************************)\n\n(*** Abs_domF ***)\n\nlemma continuous_Abs_domF:\n \"[| ALL x. f x: domF ; continuous f |] ==> continuous (Abs_domF o f)\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (rule_tac x=\"x\" in exI, simp)\napply (rule TF_isLUB_domFs)\napply (simp)\n\napply (subgoal_tac \"Rep_domF ` (Abs_domF o f) ` X = f ` X\")\nby (auto simp add: image_def Abs_domF_inverse)\n\n(*** Rep_domF ***)\n\nlemma cont_Rep_domF: \"continuous Rep_domF\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (rule_tac x=\"LUB_domF X\" in exI)\n\napply (simp add: directed_def LUB_domF_isLUB)\napply (simp add: isLUB_LUB_TF)\napply (simp add: LUB_domF_def)\napply (simp add: LUB_TF_in Abs_domF_inverse)\ndone\n\n(*** fstF and sndF ***)\n\nlemma fstF_continuous: \"continuous fstF\"\napply (simp add: fstF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: fst_continuous)\ndone\n\nlemma sndF_continuous: \"continuous sndF\"\napply (simp add: sndF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: snd_continuous)\ndone\n\n(********************************************************** \n continuity decomposition\n **********************************************************)\n\n(*** if ***)\n\nlemma continuous_domF:\n \"[| ALL x. (f x, g x): domF ; continuous f ; continuous g |]\n ==> continuous (%x. (f x ,, g x))\"\napply (simp add: pairF_def)\napply (subgoal_tac \"(%x. Abs_domF (f x, g x)) = Abs_domF o (%x. (f x, g x))\")\napply (simp)\napply (rule continuous_Abs_domF)\napply (simp)\napply (simp add: pair_continuous)\napply (simp add: comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemmas continuous_domF_decompo_if = continuous_domF\n\n(*** only if ***)\n\nlemma continuous_domF_decompo_only_if_lm:\n \"[| ALL x. (f x, g x) : domF; continuous (%x. (f x , g x)) |]\n ==> continuous f & continuous g\"\napply (simp add: pair_continuous)\napply (simp add: comp_def)\ndone\n\nlemma continuous_domF_decompo_only_if:\n \"[| ALL x. (f x, g x) : domF; continuous (%x. (f x ,, g x)) |]\n ==> continuous f & continuous g\"\napply (rule continuous_domF_decompo_only_if_lm)\napply (simp)\napply (simp add: pairF_def)\napply (insert compo_continuous\n [of \"(%x. Abs_domF (f x, g x))\" \"Rep_domF\" ])\napply (simp add: comp_def)\napply (simp add: cont_Rep_domF)\napply (simp add: Abs_domF_inverse)\ndone\n\nlemma continuous_domF_decompo:\n \"ALL x. (f x, g x) : domF\n ==> continuous (%x. (f x ,, g x)) = (continuous f & continuous g)\"\napply (rule)\napply (simp add: continuous_domF_decompo_only_if)\napply (simp add: continuous_domF_decompo_if)\ndone\n\n(********************************************************** \n continuity of (op o fstF)\n **********************************************************)\n\n(* lemma continuous_op_fstF: \"continuous (op o fstF)\" *)\nlemma continuous_op_fstF: \"continuous ((o) fstF)\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (insert complete_cpo_lm)\napply (drule_tac x=\"X\" in spec)\napply (simp add: hasLUB_def)\n\napply (elim exE)\napply (rule_tac x=\"x\" in exI)\napply (simp)\napply (simp add: image_def)\napply (simp add: isLUB_def)\napply (simp add: isUB_def)\napply (rule)\n\n (* UB *)\n apply (intro allI impI)\n apply (elim conjE bexE) \n apply (simp)\n apply (drule_tac x=\"xa\" in spec)\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n\n (* LUB *)\n apply (intro allI impI)\n apply (elim conjE)\n\n apply (rotate_tac -1)\n apply (drule_tac x=\"(%pn. (y pn ,, maxFof (y pn)))\" in spec)\n apply (drule mp)\n\n apply (intro allI impI)\n apply (drule_tac x=\"fstF o ya\" in spec)\n apply (drule mp, fast)\n apply (simp add: order_prod_def)\n apply (intro allI impI)\n apply (drule_tac x=\"xa\" in spec)\n apply (simp add: subdomF_decompo)\n apply (simp add: pairF maxFof_domF)\n apply (rule)\n apply (simp add: subdomT_iff)\n apply (drule_tac x=\"s\" in spec)\n apply (simp add: pairF_domF_T2)\n apply (simp add: maxFof_max)\n\n apply (simp add: order_prod_def)\n apply (simp add: subdomF_decompo)\n apply (simp add: pairF maxFof_domF)\ndone\n\n(********************************************************** \n fstF-distribution over LUB\n **********************************************************)\n\nlemma dist_fstF_LUB:\n \"X ~= {} ==> fstF o LUB X = LUB (((o) fstF) ` X)\"\n(* \"X ~= {} ==> fstF o LUB X = LUB ((op o fstF) ` X)\" *)\napply (subgoal_tac \"X hasLUB\")\napply (rule sym)\napply (rule isLUB_LUB)\napply (simp add: isLUB_def isUB_def)\napply (rule)\n\n(* UB *)\n apply (intro allI impI)\n apply (simp add: image_iff)\n apply (simp add: comp_def)\n apply (elim bexE)\n apply (simp add: order_prod_def)\n apply (intro allI)\n apply (subgoal_tac \"x <= LUB X\")\n\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n apply (subgoal_tac \"LUB X isLUB X\")\n apply (simp add: isLUB_def isUB_def)\n apply (simp add: LUB_is)\n\n(* LUB *)\n apply (intro allI impI)\n apply (simp add: order_prod_def)\n apply (intro allI impI)\n apply (subgoal_tac \"(LUB X) isLUB X\")\n\n apply (simp add: prod_LUB_decompo)\n apply (simp add: proj_fun_def)\n apply (drule_tac x=\"x\" in spec)\n apply (subgoal_tac \"(%xa. xa x) ` X ~= {}\")\n\n apply (simp add: isLUB_LUB_domF)\n apply (simp add: LUB_domF_def)\n apply (simp add: fstF_def)\n apply (simp add: LUB_TF_in_Rep Abs_domF_inverse)\n apply (simp add: LUB_TF_def)\n apply (rule subdomTI)\n apply (simp)\n apply (elim conjE bexE)\n apply (drule_tac x=\"fstF o xa\" in spec)\n apply (drule mp)\n apply (simp add: image_iff)\n apply (rule_tac x=\"xa\" in bexI)\n apply (simp add: fstF_def)\n apply (simp)\n apply (drule_tac x=\"x\" in spec)\n apply (simp add: subdomT_iff)\n apply (drule_tac x=\"t\" in spec)\n apply (simp add: fstF_def)\n\n apply (force)\n apply (rule LUB_is)\n apply (simp)\n\napply (simp add: hasLUB_def)\napply (simp add: prod_LUB_decompo)\napply (simp add: proj_fun_def)\napply (rule_tac x=\"(%i. LUB_domF ((%x. x i) ` X))\" in exI)\napply (simp add: isLUB_LUB_domF)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/Domain_F_cpo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2801154799540876}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nsection \\\\isaheader{Hash Set}\\\ntheory HashSet\n imports \n \"../spec/SetSpec\" \n HashMap \n \"../gen_algo/SetByMap\" \n \"../gen_algo/SetGA\"\nbegin\ntext_raw \\\\label{thy:HashSet}\\\n(*@impl Set\n @type 'a::hashable hs\n @abbrv hs,h\n Hash sets based on red-black trees.\n*)\n\nsubsection \"Definitions\"\ntype_synonym\n 'a hs = \"('a::hashable,unit) hm\"\n\nsetup Locale_Code.open_block\ninterpretation hs_sbm: SetByMap hm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition hs_ops :: \"('a::hashable,'a hs) set_ops\"\n where [icf_rec_def]:\n \"hs_ops \\ hs_sbm.basic.dflt_ops\"\n\nsetup Locale_Code.open_block\ninterpretation hs: StdSet hs_ops\n unfolding hs_ops_def by (rule hs_sbm.basic.dflt_ops_impl)\ninterpretation hs: StdSet_no_invar hs_ops\n by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup \\ICF_Tools.revert_abbrevs \"hs\"\\\n\nlemmas hs_it_to_it_map_code_unfold[code_unfold] = \n it_to_it_map_fold'[OF pi_hm]\n\nlemma pi_hs[proper_it]: \"proper_it' hs.iteratei hs.iteratei\"\n unfolding hs.iteratei_def[abs_def]\n by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation pi_hs: proper_it_loc hs.iteratei hs.iteratei\n by unfold_locales (rule pi_hs)\n\ndefinition test_codegen where \"test_codegen \\ (\n hs.empty,\n hs.memb,\n hs.ins,\n hs.delete,\n hs.list_it,\n hs.sng,\n hs.isEmpty,\n hs.isSng,\n hs.ball,\n hs.bex,\n hs.size,\n hs.size_abort,\n hs.union,\n hs.union_dj,\n hs.diff,\n hs.filter,\n hs.inter,\n hs.subset,\n hs.equal,\n hs.disjoint,\n hs.disjoint_witness,\n hs.sel,\n hs.to_list,\n hs.from_list\n)\"\n\nexport_code test_codegen checking SML\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/impl/HashSet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.28011547995408753}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ProcParEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Procedures as Parameters\"\n\ntheory ProcParEx imports \"../Vcg\" begin\n\n\n\n\n\nlemma conseq_exploit_pre':\n \"\\\\s \\ S. \\,\\ \\ ({s} \\ P) c Q,A\\\n \\\n \\,\\\\ (P \\ S)c Q,A\"\n apply (rule HoarePartialDef.Conseq)\n apply clarify\n by (metis IntI insertI1 subset_refl)\n\n\nlemma conseq_exploit_pre'':\n \"\\\\Z. \\s \\ S Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S Z)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\nlemma conseq_exploit_pre''':\n \"\\\\s \\ S. \\Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\n\n \nrecord 'g vars = \"'g state\" +\n compare_' :: string\n n_' :: nat\n m_' :: nat\n b_' :: bool\n k_' :: nat\n \n\n\nprocedures compare(n,m|b) = \"NoBody\"\nprint_locale! compare_signature\n\n\ncontext compare_signature\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\b :== CALL compare(\\n,\\m)\"\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = true]]\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\nend\n\n\nprocedures\n LEQ (n,m | b) = \"\\b :== \\n \\ \\m\"\n LEQ_spec: \"\\\\. \\\\ {\\} PROC LEQ(\\n,\\m,\\b) \\\\b = (\\<^bsup>\\\\<^esup>n \\ \\<^bsup>\\\\<^esup>m)\\\"\n LEQ_modifies: \"\\\\. \\\\ {\\} PROC LEQ(\\n,\\m,\\b) {t. t may_only_modify_globals \\ in []}\"\n\n\n\ndefinition mx:: \"('a \\ 'a \\ bool) \\ 'a \\ 'a \\ 'a\"\n where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures\n Max (compare, n, m | k) = \n \"\\b :== DYNCALL \\compare(\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\"\n\n Max_spec: \"\\leq. \\\\. \\\\ \n ({\\} \\ {s. (\\\\. \\\\ {\\} \\b :== PROC \\<^bsup>s\\<^esup>compare(\\n,\\m) \\\\b = (leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m)\\) \\ \n (\\\\. \\\\ {\\} \\b :== PROC \\<^bsup>s\\<^esup>compare(\\n,\\m) {t. t may_only_modify_globals \\ in []})})\n PROC Max(\\compare,\\n,\\m,\\k)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\ (\\\\. \\\\{\\} \\b :== PROC \\compare(\\n,\\m) \\\\b = (leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m)\\) \\ \n (\\\\. \\\\ {\\} \\b :== PROC \\compare(\\n,\\m) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n fix \\:: \"('a,'b) vars_scheme\" and s::\"('a,'b) vars_scheme\" and leq\n assume compare_spec: \n \"\\\\. \\\\{\\} \\b :== PROC \\<^bsup>s\\<^esup>compare(\\n,\\m) \\\\b = leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n \n assume compare_modifies:\n \"\\\\. \\\\{\\} \\b :== PROC \\<^bsup>s\\<^esup>compare(\\n,\\m) \n {t. t may_only_modify_globals \\ in []}\"\n\n show \"\\\\({s} \\ {\\})\n \\b :== DYNCALL \\compare (\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n apply vcg\n apply (clarsimp simp add: mx_def)\n done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\(\\\\. \\\\ {\\} \\b :== PROC \\compare(\\n,\\m) \\\\b = (leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m)\\) \\ \n (\\\\. \\\\ {\\} \\b :== PROC \\compare(\\n,\\m) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \n \\(\\\\. \\\\ {\\} \\b :== PROC \\compare(\\n,\\m) \\\\b = (leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m)\\) \\ \n (\\\\. \\\\ {\\} \\b :== PROC \\compare(\\n,\\m) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nlocale Max_test = Max_spec + LEQ_spec + LEQ_modifies \nlemma (in Max_test) \n\n shows\n \"\\\\ {\\} \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\nproof -\n note Max_spec = Max_spec [where leq=\"(op \\)\"]\n show ?thesis\n apply vcg\n apply (clarsimp)\n apply (rule conjI)\n apply (rule LEQ_spec [simplified])\n apply (rule LEQ_modifies [simplified])\n done\nqed\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \\\\n' m'. \\\\ \\\\n=n' \\ \\m=m'\\ \\b :== PROC \\compare(\\n,\\m) \\\\b = (leq n' m')\\\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\nterm \"\\{s. \\<^bsup>s\\<^esup>n = n' \\ \\<^bsup>s\\<^esup>m = m'} = X\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\n m. \\\\ \\\\n=n \\ \\m=m\\ PROC LEQ(\\n,\\m,\\b) \\\\b = (n \\ m)\\\"\n apply vcg\n done\n\n\nlocale Max_test' = Max_impl + LEQ_impl\nlemma (in Max_test') \n shows\n \"\\n m. \\\\ \\\\n=n \\ \\m=m\\ \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) n m\\\"\nproof -\n note Max_spec = Max_spec5\n show ?thesis\n apply vcg\n apply (rule_tac x=\"op \\\" in exI)\n apply clarsimp\n apply (rule LEQ_spec [rule_format])\n done\nqed\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/ProcParEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5428632831725053, "lm_q1q2_score": 0.2799111203185267}} {"text": "theory PermEnvMisc\n imports PermEnvLeq\nbegin\n \n (* \n ####################################\n P2. weak disjointness lemmas\n ####################################\n *) \n\nlemma mini_disj_leq_use_env1: \"\\ mini_disj_use_env r_s r_ex; leq_use_env r_x r_s \\ \\ mini_disj_use_env r_x r_ex\" \n apply (simp add: leq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (rule_tac allI)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n\nlemma mini_disj_leq_use_env2: \"\\ mini_disj_use_env r_ex r_s; leq_use_env r_x r_s \\ \\ mini_disj_use_env r_ex r_x\" \n apply (simp add: leq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (rule_tac allI)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto) \n apply (case_tac \"r_x x\")\n apply (auto)\n done \n\nlemma mini_disj_comp_use_env: \"\\ mini_disj_use_env r_x r_ex; mini_disj_use_env r_s r_ex \\ \\ mini_disj_use_env (comp_use_env r_x r_s) r_ex\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE) \n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \nlemma mini_disj_comp_use_env_alt: \"\\ mini_disj_use_env r_ex r_x; mini_disj_use_env r_ex r_s \\ \\ mini_disj_use_env r_ex (comp_use_env r_x r_s)\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: comp_use_env_def)\n done \n\nlemma mini_disj_diff_use_env: \"mini_disj_use_env r_x (diff_use_env r_s r_x)\"\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n done \n\nlemma swp_mini_disj_use_env: \"\\ leq_use_env rx_p (diff_use_env r_s r_ex) \\ \\ mini_disj_use_env r_ex rx_p\" \n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in leq_use_none)\n apply (auto)\n apply (rule_tac diff_use_none_ex)\n apply (auto)\n done \n \nlemma mini_disj_empty_use_env: \"mini_disj_use_env empty_use_env r_s\"\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n \n \n (* \n ####################################\n P3. main disjointness lemmas\n ####################################\n *) \n\nlemma comm_disj_use_env: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env r_x r_s\"\n apply (simp add: disj_use_env_def)\n done \n \n (* - ordering lemmas *)\n \nlemma disj_leq_use_env1: \"\\ disj_use_env r_s r_ex; leq_use_env r_x r_s \\ \\ disj_use_env r_x r_ex\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env1)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env2)\n apply (auto)\n done\n\nlemma disj_leq_use_env2: \"\\ disj_use_env r_ex r_s; leq_use_env r_x r_s \\ \\ disj_use_env r_ex r_x\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env2)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env1)\n apply (auto)\n done \n \n (* - comp lemmas *)\n \nlemma disj_comp_use_env1: \"\\ disj_use_env r_s1 r_ex; disj_use_env r_s2 r_ex \\ \\ disj_use_env (comp_use_env r_s1 r_s2) r_ex\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env_alt)\n apply (auto)\n done\n\nlemma disj_comp_use_env2: \"\\ disj_use_env r_ex r_s1; disj_use_env r_ex r_s2 \\ \\ disj_use_env r_ex (comp_use_env r_s1 r_s2)\" \n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env_alt)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env)\n apply (auto)\n done\n\n (* - lemmas TO BE SORTED *) \n\nlemma gen_mini_disj_use_env1: \"\\ disj_use_env r_x r_s \\ \\ mini_disj_use_env r_x r_s\" \n apply (simp add: disj_use_env_def)\n done\n \nlemma gen_mini_disj_use_env2: \"\\ disj_use_env r_s r_x \\ \\ mini_disj_use_env r_x r_s\" \n apply (simp add: disj_use_env_def)\n done\n \nlemma disj_add_use_env: \"\\ r_x x = NoPerm; disj_use_env r_s r_x \\ \\ disj_use_env (add_use_env r_s x r) r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: add_use_env_def)\n done \n \nlemma disj_rem_use_env1: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env r_s (rem_use_env r_x x)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n done\n \nlemma disj_rem_use_envx: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env (rem_use_env r_s x) r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n done \n \nlemma disj_rem_use_env2: \"\\ r_s x = NoPerm; disj_use_env r_s (rem_use_env r_x x) \\ \\ disj_use_env r_s r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n done\n\nlemma disj_add_rem_use_env: \"\\ r_s x = NoPerm; disj_use_env r_s r_x \\ \\ disj_use_env (add_use_env r_s x r) (rem_use_env r_x x)\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: rem_use_env_def)\n done\n\nlemma double_weak_disj_use_env: \"\\ weak_use_env r_x; weak_use_env r_s \\ \\ disj_use_env r_x r_s\"\n apply (simp add: weak_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n done\nlemma lease_mini_disj_use_env: \"\\ mini_disj_use_env r_s (diff_use_env r_x r_ex); mini_disj_use_env r_ex r_s \\ \\ mini_disj_use_env r_s r_x\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done \n \nlemma lease_disj_use_env1: \"\\ disj_use_env r_s (diff_use_env r_x r_ex); mini_disj_use_env r_ex r_s \\ \\ disj_use_env r_s r_x\" \n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac lease_mini_disj_use_env)\n apply (auto)\n (* we expect a similar formulation to exist using this logic\n rx2a | rx2 + [infl r_s2a - r_s3], rx2a |> rx2 + [infl r_s2a - r_s3], rx2a |> r_s3 - EX, EX |> r_s3 - EX\n rx2 + [infl r_s2a - r_s3] |> rx2a - EX\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in mini_disj_leq_use_env2)\n *)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n \nlemma lease_disj_use_env2: \"\\ disj_use_env (diff_use_env r_x r_ex) r_s; mini_disj_use_env r_ex r_s \\ \\ disj_use_env r_x r_s\"\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac r_ex=\"r_ex\" in lease_disj_use_env1)\n apply (rule_tac comm_disj_use_env)\n apply (auto)\n done \n \n (* - empty lemmas *)\n \nlemma disj_empty_use_env1: \"disj_use_env r_s empty_use_env\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n\nlemma disj_empty_use_env2: \"disj_use_env empty_use_env r_s\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n \n (* - singleton lemmas *)\n \nlemma disj_one_use_env: \"\\ r_s x = NoPerm \\ \\ disj_use_env r_s (one_use_env x OwnPerm)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n done \n \n (* \n ####################################\n P3. weakness lemmas\n ####################################\n *) \n \nlemma leq_weak_use_env: \"\\ weak_use_env r_s; leq_use_env r_x r_s \\ \\ weak_use_env r_x\" \n apply (simp add: weak_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \nlemma weak_comp_use_env1: \"\\ weak_use_env (comp_use_env r_sa r_sb) \\ \\ weak_use_env r_sa\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sb x\")\n apply (auto)\n done\n \nlemma weak_comp_use_env2: \"\\ weak_use_env (comp_use_env r_sa r_sb) \\ \\ weak_use_env r_sb\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sa x\")\n apply (auto)\n done \n \nlemma dist_weak_comp_use_env: \"\\ weak_use_env r_sa; weak_use_env r_sb \\ \\ weak_use_env (comp_use_env r_sa r_sb)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sa x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n done \n \nlemma weak_diff_use_env: \"\\ weak_use_env r_s \\ \\ weak_use_env (diff_use_env r_s r_x)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done \n\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/PermEnvMisc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.27991112031852666}} {"text": "section \\Utilities for Interface Specifications and Implementations\\\ntheory Sepref_Intf_Util\nimports Sepref_Rules Sepref_Translate \"Lib/Term_Synth\" Sepref_Combinator_Setup\n \"Lib/Concl_Pres_Clarification\"\nkeywords \"sepref_decl_op\" :: thy_goal\n and \"sepref_decl_impl\" :: thy_goal\nbegin\n\nsubsection \\Relation Interface Binding\\\n definition INTF_OF_REL :: \"('a\\'b) set \\ 'c itself \\ bool\"\n where [simp]: \"INTF_OF_REL R I \\ True\"\n\n lemma intf_of_relI: \"INTF_OF_REL (R::(_\\'a) set) TYPE('a)\" by simp\n declare intf_of_relI[synth_rules] \\ \\Declare as fallback rule\\\n\n lemma standard_intf_of_rel_rules[synth_rules]:\n \"INTF_OF_REL unit_rel TYPE(unit)\"\n \"INTF_OF_REL bool_rel TYPE(bool)\"\n\n \"INTF_OF_REL R TYPE('a) \\ INTF_OF_REL (\\R\\option_rel) TYPE('a option)\"\n \"INTF_OF_REL R TYPE('a) \\ INTF_OF_REL (\\R\\list_rel) TYPE('a list)\"\n \"INTF_OF_REL R TYPE('a) \\ INTF_OF_REL (\\R\\nres_rel) TYPE('a nres)\"\n \"\\INTF_OF_REL R TYPE('a); INTF_OF_REL S TYPE('b)\\ \\ INTF_OF_REL (R\\\\<^sub>rS) TYPE('a\\'b)\"\n \"\\INTF_OF_REL R TYPE('a); INTF_OF_REL S TYPE('b)\\ \\ INTF_OF_REL (\\R,S\\sum_rel) TYPE('a+'b)\"\n \"\\INTF_OF_REL R TYPE('a); INTF_OF_REL S TYPE('b)\\ \\ INTF_OF_REL (R\\S) TYPE('a\\'b)\"\n \"\\INTF_OF_REL (R\\Sx undefined) TYPE('a)\\ \\ INTF_OF_REL (fref P R Sx) TYPE('a)\"\n by simp_all\n\n lemma synth_intf_of_relI: \n \"INTF_OF_REL R I \\ SYNTH_TERM R I\" \n \"INTF_OF_REL (Rx undefined) I \\ SYNTH_TERM Rx I\" \n by simp_all\n\n\nsubsection \\Operations with Precondition\\\n definition mop :: \"('a\\bool) \\ ('a\\'b nres) \\ 'a \\ 'b nres\"\n \\ \\Package operation with precondition\\\n where [simp]: \"mop P f \\ \\x. doN {ASSERT (P x); f x}\"\n \n lemma param_op_mop_iff:\n assumes \"(Q,P)\\R\\bool_rel\"\n shows \n \"(f, g) \\ [P]\\<^sub>f R \\ \\S\\nres_rel\n \\ \n (mop Q f, mop P g) \\ R \\\\<^sub>f \\S\\nres_rel\n \"\n using assms\n by (auto \n simp: mop_def fref_def pw_nres_rel_iff refine_pw_simps\n dest: fun_relD)\n\n lemma param_mopI:\n assumes \"(f,g) \\ [P]\\<^sub>f R \\ \\S\\nres_rel\" \n assumes \"(Q,P) \\ R \\ bool_rel\"\n shows \"(mop Q f, mop P g) \\ R \\\\<^sub>f \\S\\nres_rel\"\n using assms by (simp add: param_op_mop_iff)\n\n lemma mop_spec_rl: \"P x \\ mop P f x \\ f x\" by simp\n\n lemma mop_spec_rl_from_def: \n assumes \"f \\ mop P g\"\n assumes \"P x\"\n assumes \"g x \\ z\"\n shows \"f x \\ z\"\n using assms mop_spec_rl by simp\n\n lemma mop_leof_rl_from_def: \n assumes \"f \\ mop P g\"\n assumes \"P x \\ g x \\\\<^sub>n z\"\n shows \"f x \\\\<^sub>n z\"\n using assms \n by (simp add: pw_leof_iff refine_pw_simps)\n\n\n lemma assert_true_bind_conv: \"doN {ASSERT True; m} = m\" by simp \n\n lemmas mop_alt_unfolds = curry_def curry0_def mop_def uncurry_apply uncurry0_apply o_apply assert_true_bind_conv\n\nsubsection \\Constraints\\\nlemma add_is_pure_constraint: \"\\PROP P; CONSTRAINT is_pure A\\ \\ PROP P\" .\nlemma sepref_relpropI: \"P R = CONSTRAINT P R\" by simp\n\nsubsubsection \\Purity\\\nlemmas [constraint_simps] = the_pure_pure\ndefinition [constraint_abbrevs]: \"IS_PURE P R \\ is_pure R \\ P (the_pure R)\"\nlemma IS_PURE_pureI: \n \"P R \\ IS_PURE P (pure R)\"\n by (auto simp: IS_PURE_def)\n\nlemma [fcomp_norm_simps]: \"CONSTRAINT (IS_PURE \\) P \\ pure (the_pure P) = P\" \n by (simp add: IS_PURE_def)\n \nlemma [fcomp_norm_simps]: \"CONSTRAINT (IS_PURE P) A \\ P (the_pure A)\"\n by (auto simp: IS_PURE_def)\n\nlemma handle_purity1: \n \"CONSTRAINT (IS_PURE \\) A \\ CONSTRAINT \\ (the_pure A)\"\n by (auto simp: IS_PURE_def)\n\nlemma handle_purity2:\n \"CONSTRAINT (IS_PURE \\) A \\ CONSTRAINT is_pure A\"\n by (auto simp: IS_PURE_def)\n\n\n\n\nsubsection \\Composition\\\n(* TODO/FIXME: Overlaps with FCOMP! *)\n\n subsubsection \\Preconditions\\\n definition [simp]: \"tcomp_pre Q T P \\ \\a. Q a \\ (\\a'. (a', a) \\ T \\ P a')\"\n definition \"and_pre P1 P2 \\ \\x. P1 x \\ P2 x\"\n definition \"imp_pre P1 P2 \\ \\x. P1 x \\ P2 x\"\n\n lemma and_pre_beta: \"PP \\ P x \\ Q x \\ PP \\ and_pre P Q x\" by (auto simp: and_pre_def)\n lemma imp_pre_beta: \"PP \\ P x \\ Q x \\ PP \\ imp_pre P Q x\" by (auto simp: imp_pre_def)\n\n\n\n definition \"IMP_PRE P1 P2 \\ \\x. P1 x \\ P2 x\"\n lemma IMP_PRED: \"IMP_PRE P1 P2 \\ P1 x \\ P2 x\" unfolding IMP_PRE_def by auto\n lemma IMP_PRE_refl: \"IMP_PRE P P\" unfolding IMP_PRE_def by auto\n\n definition \"IMP_PRE_CUSTOM \\ IMP_PRE\"\n lemma IMP_PRE_CUSTOMD: \"IMP_PRE_CUSTOM P1 P2 \\ IMP_PRE P1 P2\" by (simp add: IMP_PRE_CUSTOM_def)\n lemma IMP_PRE_CUSTOMI: \"\\\\x. P1 x \\ P2 x\\ \\ IMP_PRE_CUSTOM P1 P2\" \n by (simp add: IMP_PRE_CUSTOM_def IMP_PRE_def)\n\n\n lemma imp_and_triv_pre: \"IMP_PRE P (and_pre (\\_. True) P)\"\n unfolding IMP_PRE_def and_pre_def by auto\n\n\nsubsubsection \\Premises\\ \n definition \"ALL_LIST A \\ (\\x\\set A. x)\" \n definition \"IMP_LIST A B \\ ALL_LIST A \\ B\"\n\n lemma to_IMP_LISTI:\n \"P \\ IMP_LIST [] P\" \n by (auto simp: IMP_LIST_def)\n\n lemma to_IMP_LIST: \"(P \\ IMP_LIST Ps Q) \\ Trueprop (IMP_LIST (P#Ps) Q)\"\n by (auto simp: IMP_LIST_def ALL_LIST_def intro!: equal_intr_rule)\n \n lemma from_IMP_LIST:\n \"Trueprop (IMP_LIST As B) \\ (ALL_LIST As \\ B)\"\n \"(ALL_LIST [] \\ B) \\ Trueprop B\"\n \"(ALL_LIST (A#As) \\ B) \\ (A \\ ALL_LIST As \\ B)\"\n by (auto simp: IMP_LIST_def ALL_LIST_def intro!: equal_intr_rule)\n \n lemma IMP_LIST_trivial: \"IMP_LIST A B \\ IMP_LIST A B\" .\n\n\n\nsubsubsection \\Composition Rules\\\n lemma hfcomp_tcomp_pre:\n assumes B: \"(g,h) \\ [Q]\\<^sub>f\\<^sub>d T \\ (\\x. \\U x\\nres_rel)\"\n assumes A: \"(f,g) \\ [P]\\<^sub>a\\<^sub>d RR' \\ S\"\n shows \"(f,h) \\ [tcomp_pre Q T P]\\<^sub>a\\<^sub>d hrp_comp RR' T \\ hrr_comp T S U\"\n using hfcomp[OF A B] by simp\n\n lemma transform_pre_param:\n assumes A: \"IMP_LIST Cns ((f, h) \\ [tcomp_pre Q T P]\\<^sub>a\\<^sub>d hrp_comp RR' T \\ hrr_comp T S U)\"\n assumes P: \"IMP_LIST Cns ((P,P') \\ T \\ bool_rel)\"\n assumes C: \"IMP_PRE PP' (and_pre P' Q)\"\n (*assumes D: \"IMP_LIST Cns (\\a c x y. (c,a)\\T \\ S c x y \\ S' a x y)\"*)\n shows \"IMP_LIST Cns ((f,h) \\ [PP']\\<^sub>a\\<^sub>d hrp_comp RR' T \\ hrr_comp T S U)\"\n unfolding from_IMP_LIST\n apply (rule hfref_cons) \n apply (rule A[unfolded from_IMP_LIST])\n apply assumption\n apply (drule IMP_PRED[OF C])\n using P[unfolded from_IMP_LIST] unfolding and_pre_def\n apply (auto dest: fun_relD) []\n apply simp_all\n done\n \n \n lemma hfref_mop_conv: \"((g,mop P f) \\ [Q]\\<^sub>a\\<^sub>d R \\ S) \\ (g,f) \\ [\\x. P x \\ Q x]\\<^sub>a\\<^sub>d R \\ S\"\n apply (simp add: hfref_to_ASSERT_conv)\n apply (fo_rule arg_cong fun_cong)+\n by (auto intro!: ext simp: pw_eq_iff refine_pw_simps)\n \n lemma hfref_op_to_mop:\n assumes R: \"(impl,f) \\ [Q]\\<^sub>a\\<^sub>d R \\ S\"\n assumes DEF: \"mf \\ mop P f\"\n assumes C: \"IMP_PRE PP' (imp_pre P Q)\"\n shows \"(impl,mf) \\ [PP']\\<^sub>a\\<^sub>d R \\ S\"\n unfolding DEF hfref_mop_conv\n apply (rule hfref_cons[OF R])\n using C\n by (auto simp: IMP_PRE_def imp_pre_def)\n \n lemma hfref_mop_to_op:\n assumes R: \"(impl,mf) \\ [Q]\\<^sub>a\\<^sub>d R \\ S\"\n assumes DEF: \"mf \\ mop P f\"\n assumes C: \"IMP_PRE PP' (and_pre Q P)\"\n shows \"(impl,f) \\ [PP']\\<^sub>a\\<^sub>d R \\ S\"\n using R unfolding DEF hfref_mop_conv \n apply (rule hfref_cons)\n using C\n apply (auto simp: and_pre_def IMP_PRE_def)\n done\n\n subsubsection \\Precondition Simplification\\\n\n lemma IMP_PRE_eqI:\n assumes \"\\x. P x \\ Q x\"\n assumes \"CNV P P'\"\n shows \"IMP_PRE P' Q\"\n using assms by (auto simp: IMP_PRE_def)\n\n lemma simp_and1:\n assumes \"Q \\ CNV P P'\"\n assumes \"PP \\ P' \\ Q\"\n shows \"PP \\ P \\ Q\" \n using assms by auto\n\n lemma simp_and2:\n assumes \"P \\ CNV Q Q'\"\n assumes \"PP \\ P \\ Q'\"\n shows \"PP \\ P \\ Q\" \n using assms by auto\n\n lemma triv_and1: \"Q \\ True \\ Q\" by blast\n\n lemma simp_imp:\n assumes \"P \\ CNV Q Q'\"\n assumes \"PP \\ Q'\"\n shows \"PP \\ (P \\ Q)\"\n using assms by auto\n\n lemma CNV_split:\n assumes \"CNV A A'\"\n assumes \"CNV B B'\"\n shows \"CNV (A \\ B) (A' \\ B')\" \n using assms by auto\n\n lemma CNV_prove:\n assumes \"P\" \n shows \"CNV P True\"\n using assms by auto\n\n lemma simp_pre_final_simp: \n assumes \"CNV P P'\"\n shows \"P' \\ P\"\n using assms by auto\n\n lemma auto_weaken_pre_uncurry_step':\n assumes \"PROTECT f a \\ f'\"\n shows \"PROTECT (uncurry f) (a,b) \\ f' b\" \n using assms\n by (auto simp: curry_def dest!: meta_eq_to_obj_eq intro!: eq_reflection)\n\n\nsubsection \\Protected Constants\\\nlemma add_PR_CONST_to_def: \"x\\y \\ PR_CONST x \\ y\" by simp\n\nsubsection \\Rule Collections\\\nnamed_theorems_rev sepref_mop_def_thms \\Sepref: mop - definition theorems\\\n\nnamed_theorems_rev sepref_fref_thms \\Sepref: fref-theorems\\\n\nnamed_theorems sepref_relprops_transform \\Sepref: Simp-rules to transform relator properties\\\nnamed_theorems sepref_relprops \\Sepref: Simp-rules to add CONSTRAINT-tags to relator properties\\\nnamed_theorems sepref_relprops_simps \\Sepref: Simp-rules to simplify relator properties\\\n\nsubsubsection \\Default Setup\\\n\n\n\nsubsection \\ML-Level Declarations\\\n\n ML \\\n signature SEPREF_INTF_UTIL = sig\n (* Miscellaneous*)\n val list_filtered_subterms: (term -> 'a option) -> term -> 'a list\n\n\n (* Interface types for relations *)\n val get_intf_of_rel: Proof.context -> term -> typ\n\n (* Constraints *)\n (* Convert relations to pure assertions *)\n val to_assns_rl: bool -> Proof.context -> thm -> thm\n (* Recognize, summarize and simplify CONSTRAINT - premises *)\n val cleanup_constraints: Proof.context -> thm -> thm\n\n (* Preconditions *)\n (* Simplify precondition. Goal must be in IMP_PRE or IMP_PRE_CUSTOM form. *)\n val simp_precond_tac: Proof.context -> tactic'\n\n\n (* Configuration options *)\n val cfg_def: bool Config.T (* decl_op: Define constant *)\n val cfg_ismop: bool Config.T (* decl_op: Specified term is mop *)\n val cfg_mop: bool Config.T (* decl_op, decl_impl: Derive mop *) \n val cfg_rawgoals: bool Config.T (* decl_op, decl_impl: Do not pre-process/solve goals *)\n\n\n (* TODO: Make do_cmd usable from ML-level! *)\n\n end\n\n structure Sepref_Intf_Util: SEPREF_INTF_UTIL = struct\n \n val cfg_debug = \n Attrib.setup_config_bool @{binding sepref_debug_intf_util} (K false)\n \n val dbg_trace = Sepref_Debugging.dbg_trace_msg cfg_debug \n val dbg_msg_tac = Sepref_Debugging.dbg_msg_tac cfg_debug \n fun dbg_trace_thm ctxt msg thm = \n Sepref_Debugging.dbg_trace cfg_debug ctxt (fn ctxt => \n Pretty.block [Pretty.str msg, Pretty.brk 1, Thm.pretty_thm ctxt thm] |> Pretty.string_of)\n fun dbg_trace_term ctxt msg t = \n Sepref_Debugging.dbg_trace cfg_debug ctxt (fn ctxt => \n Pretty.block [Pretty.str msg, Pretty.brk 1, Syntax.pretty_term ctxt t] |> Pretty.string_of)\n\n fun list_filtered_subterms f t = let\n fun r t = case f t of \n SOME a => [a]\n | NONE => (\n case t of \n t1$t2 => r t1 @ r t2\n | Abs (_,_,t) => r t\n | _ => []\n )\n in\n r t\n end\n \n fun get_intf_of_rel ctxt R = \n Term_Synth.synth_term @{thms synth_intf_of_relI} ctxt R\n |> fastype_of \n |> Refine_Util.dest_itselfT\n \n local\n fun add_is_pure_constraint ctxt v thm = let\n val v = Thm.cterm_of ctxt v\n val rl = Drule.infer_instantiate' ctxt [NONE, SOME v] @{thm add_is_pure_constraint}\n in\n thm RS rl\n end\n in \n fun to_assns_rl add_pure_constr ctxt thm = let\n val orig_ctxt = ctxt\n \n val (thm,ctxt) = yield_singleton (apfst snd oo Variable.importT) thm ctxt\n \n val (R,S) = case Thm.concl_of thm of @{mpat \"Trueprop (_\\fref _ ?R ?S)\"} => (R,S)\n | _ => raise THM(\"to_assns_rl: expected fref-thm\",~1,[thm])\n \n fun mk_cn_subst (fname,(iname,C,A)) = \n let\n val T' = A --> C --> @{typ assn}\n val v' = Free (fname,T')\n val ct' = @{mk_term \"the_pure ?v'\"} |> Thm.cterm_of ctxt\n in\n (v',(iname,ct'))\n end\n \n fun relation_flt (name,Type (@{type_name set},[Type (@{type_name prod},[C,A])])) = SOME (name,C,A)\n | relation_flt _ = NONE \n \n \n val vars = []\n |> Term.add_vars R \n |> Term.add_vars S\n |> map_filter (relation_flt) \n val (names,ctxt) = Variable.variant_fixes (map (#1 #> fst) vars) ctxt\n \n val cn_substs = map mk_cn_subst (names ~~ vars)\n \n \n val thm = Drule.infer_instantiate ctxt (map snd cn_substs) thm\n \n val thm = thm |> add_pure_constr ? fold (fn (v,_) => fn thm => add_is_pure_constraint ctxt v thm) cn_substs\n \n val thm = singleton (Variable.export ctxt orig_ctxt) thm\n in\n thm\n end\n \n fun cleanup_constraints ctxt thm = let\n val orig_ctxt = ctxt\n \n val (thm, ctxt) = yield_singleton (apfst snd oo Variable.import true) thm ctxt\n \n val xform_thms = Named_Theorems.get ctxt @{named_theorems sepref_relprops_transform}\n val rprops_thms = Named_Theorems.get ctxt @{named_theorems sepref_relprops}\n val simp_thms = Named_Theorems.get ctxt @{named_theorems sepref_relprops_simps}\n \n fun simp thms = Conv.fconv_rule (\n Simplifier.asm_full_rewrite \n (put_simpset HOL_basic_ss ctxt addsimps thms))\n \n (* Check for pure (the_pure R) - patterns *)\n \n local\n val (_,R,S) = case Thm.concl_of thm of\n @{mpat \"Trueprop (_\\hfref ?P ?R ?S)\"} => (P,R,S)\n | @{mpat \"Trueprop (_\\fref ?P ?R ?S)\"} => (P,R,S)\n | _ => raise THM(\"cleanup_constraints: Expected hfref or fref-theorem\",~1,[thm]) \n \n \n fun flt_pat @{mpat \"pure (the_pure ?A)\"} = SOME A | flt_pat _ = NONE\n \n val purify_terms = \n (list_filtered_subterms flt_pat R @ list_filtered_subterms flt_pat S)\n |> distinct op aconv\n \n val thm = fold (add_is_pure_constraint ctxt) purify_terms thm\n in\n val thm = thm\n end\n \n val thm = thm\n |> Local_Defs.unfold0 ctxt xform_thms\n |> Local_Defs.unfold0 ctxt rprops_thms\n \n val insts = map (fn \n @{mpat \"Trueprop (CONSTRAINT _ (the_pure _))\"} => @{thm handle_purity1}\n | _ => asm_rl \n ) (Thm.prems_of thm) \n \n val thm = (thm OF insts)\n |> Conv.fconv_rule Thm.eta_conversion\n |> simp @{thms handle_purity2}\n |> simp simp_thms\n \n val thm = singleton (Variable.export ctxt orig_ctxt) thm \n \n in\n thm\n end\n end \n \n fun simp_precond_tac ctxt = let\n fun simp_only thms = asm_full_simp_tac (put_simpset HOL_basic_ss ctxt addsimps thms)\n val rtac = resolve_tac ctxt\n \n val cnv_ss = ctxt delsimps @{thms CNV_def}\n \n (*val uncurry_tac = SELECT_GOAL (ALLGOALS (DETERM o SOLVED' (\n REPEAT' (rtac @{thms auto_weaken_pre_uncurry_step'}) \n THEN' rtac @{thms auto_weaken_pre_uncurry_finish}\n )))*)\n \n val prove_cnv_tac = SOLVED' (rtac @{thms CNV_prove} THEN' SELECT_GOAL (auto_tac ctxt))\n \n val do_cnv_tac = \n (cp_clarsimp_tac cnv_ss) THEN_ALL_NEW\n (TRY o REPEAT_ALL_NEW (match_tac ctxt @{thms CNV_split}))\n THEN_ALL_NEW (prove_cnv_tac ORELSE' rtac @{thms CNV_I})\n \n val final_simp_tac = \n rtac @{thms simp_pre_final_simp} \n THEN' cp_clarsimp_tac cnv_ss\n THEN' dbg_msg_tac (Sepref_Debugging.msg_subgoal \"final_simp_tac: Before CNV_I\") ctxt\n THEN' rtac @{thms CNV_I}\n THEN' dbg_msg_tac (Sepref_Debugging.msg_text \"Final-Simp done\") ctxt\n \n (*val curry_tac = let open Conv in\n CONVERSION (Refine_Util.HOL_concl_conv (fn ctxt => arg1_conv (\n top_conv ( fn _ => try_conv (rewr_conv @{thm uncurry_def})) ctxt)) ctxt)\n THEN' REPEAT' (EqSubst.eqsubst_tac ctxt [1] @{thms case_prod_eta})\n THEN' rtac @{thms CNV_I}\n end*)\n\n val simp_tupled_pre_tac = \n SELECT_GOAL (Local_Defs.unfold0_tac ctxt @{thms prod_casesK uncurry0_hfref_post})\n THEN' REPEAT' (EqSubst.eqsubst_tac ctxt [1] @{thms case_prod_eta})\n THEN' rtac @{thms CNV_I}\n\n val unfold_and_tac = rtac @{thms and_pre_beta} THEN_ALL_NEW simp_only @{thms split}\n \n val simp_and1_tac = \n rtac @{thms simp_and1} THEN' do_cnv_tac\n \n val simp_and2_tac = \n rtac @{thms simp_and2} THEN' do_cnv_tac\n \n val and_plan_tac = \n simp_and1_tac \n THEN' dbg_msg_tac (Sepref_Debugging.msg_subgoal \"State after and1\") ctxt\n THEN' (\n rtac @{thms triv_and1}\n ORELSE' \n dbg_msg_tac (Sepref_Debugging.msg_subgoal \"Invoking and2 on\") ctxt\n THEN' simp_and2_tac \n THEN' dbg_msg_tac (Sepref_Debugging.msg_subgoal \"State before final_simp_tac\") ctxt\n THEN' final_simp_tac\n )\n \n val unfold_imp_tac = rtac @{thms imp_pre_beta} THEN_ALL_NEW simp_only @{thms split}\n val simp_imp1_tac = \n rtac @{thms simp_imp} THEN' do_cnv_tac\n \n val imp_plan_tac = simp_imp1_tac THEN' final_simp_tac \n \n val imp_pre_tac = APPLY_LIST [\n simp_only @{thms split_tupled_all}\n THEN' Refine_Util.instantiate_tuples_subgoal_tac ctxt\n THEN' CASES' [\n (unfold_and_tac, ALLGOALS and_plan_tac),\n (unfold_imp_tac, ALLGOALS imp_plan_tac)\n ]\n ,\n simp_tupled_pre_tac\n ] \n \n val imp_pre_custom_tac = \n SELECT_GOAL (Local_Defs.unfold0_tac ctxt @{thms and_pre_def}) THEN'\n TRY o SOLVED' (SELECT_GOAL (auto_tac ctxt))\n \n in\n CASES' [\n (rtac @{thms IMP_PRE_eqI}, imp_pre_tac 1),\n (rtac @{thms IMP_PRE_CUSTOMI}, ALLGOALS imp_pre_custom_tac)\n ]\n end\n\n\n\n\n local\n fun inf_bn_aux name = \n case String.tokens (fn c => c = #\".\") name of\n [] => NONE\n | l => rev l |> hd |> Binding.name |> SOME\n in\n fun infer_basename (Const (\"_type_constraint_\",_)$t) = infer_basename t\n | infer_basename (Const (name,_)) = inf_bn_aux name\n | infer_basename (Free (name,_)) = inf_bn_aux name\n | infer_basename _ = NONE\n end \n \n val cfg_mop = Attrib.setup_config_bool @{binding sepref_register_mop} (K true)\n val cfg_ismop = Attrib.setup_config_bool @{binding sepref_register_ismop} (K false)\n val cfg_rawgoals = Attrib.setup_config_bool @{binding sepref_register_rawgoals} (K false)\n val cfg_transfer = Attrib.setup_config_bool @{binding sepref_decl_impl_transfer} (K true)\n val cfg_def = Attrib.setup_config_bool @{binding sepref_register_def} (K true)\n val cfg_register = Attrib.setup_config_bool @{binding sepref_decl_impl_register} (K true)\n \n local \n open Refine_Util\n val flags = \n parse_bool_config' \"mop\" cfg_mop\n || parse_bool_config' \"ismop\" cfg_ismop\n || parse_bool_config' \"rawgoals\" cfg_rawgoals\n || parse_bool_config' \"def\" cfg_def\n val parse_flags = parse_paren_list' flags \n\n val parse_name = Scan.option (Parse.binding --| @{keyword \":\"})\n val parse_relconds = Scan.optional (@{keyword \"where\"} |-- Parse.and_list1 (Scan.repeat1 Parse.prop) >> flat) []\n in\n\n val do_parser = parse_flags -- parse_name -- Parse.term --| @{keyword \"::\"} -- Parse.term -- parse_relconds\n end \n \n \n fun do_cmd ((((flags,name),opt_raw), relt_raw),relconds_raw) lthy = let\n local\n val ctxt = Refine_Util.apply_configs flags lthy\n in\n val flag_ismop = Config.get ctxt cfg_ismop\n val flag_mop = Config.get ctxt cfg_mop andalso not flag_ismop\n val flag_rawgoals = Config.get ctxt cfg_rawgoals\n val flag_def = Config.get ctxt cfg_def\n end\n \n open Sepref_Basic Sepref_Rules\n\n val relt = Syntax.parse_term lthy relt_raw\n val relconds = map (Syntax.parse_prop lthy) relconds_raw \n\n val _ = dbg_trace lthy \"Parse relation and relation conditions together\"\n val relt = Const (@{const_name \"Pure.term\"}, dummyT) $ relt\n local\n val l = Syntax.check_props lthy (relt::relconds)\n in\n val (relt, relconds) = (hd l, tl l) \n end\n val relt = Logic.dest_term relt\n\n val opt_pre = Syntax.parse_term lthy opt_raw\n \n\n val _ = dbg_trace lthy \"Infer basename\"\n val name = case name of \n SOME name => name\n | NONE => (\n case infer_basename opt_pre of \n NONE => (error \"Could not infer basename: You have to specify a basename\"; Binding.empty)\n | SOME name => name\n )\n \n \n fun qname s n = Binding.qualify true (Binding.name_of n) (Binding.name s)\n fun def name t_pre attribs lthy = let\n val t = Syntax.check_term lthy t_pre\n (*|> Thm.cterm_of lthy\n |> Drule.mk_term\n |> Local_Defs.unfold0 lthy @{thms PR_CONST_def}\n |> Drule.dest_term\n |> Thm.term_of*)\n \n val (_,lthy) = Local_Theory.begin_nested lthy \n val ((dt,(_,thm)),lthy) = Local_Theory.define \n ((name,Mixfix.NoSyn),((Thm.def_binding name,@{attributes [code]}@attribs),t)) lthy;\n val (lthy, lthy_old) = `Local_Theory.end_nested lthy\n val phi = Proof_Context.export_morphism lthy_old lthy\n val thm = Morphism.thm phi thm\n val dt = Morphism.term phi dt\n \n in\n ((dt,thm),lthy)\n end\n \n val _ = dbg_trace lthy \"Analyze Relation\"\n val (pre,args,res) = analyze_rel relt\n val specified_pre = is_some pre\n val pre = the_default (mk_triv_precond args) pre\n \n val def_thms = @{thms PR_CONST_def}\n \n val _ = dbg_trace lthy \"Define op\"\n val op_name = Binding.prefix_name (if flag_ismop then \"mop_\" else \"op_\") name\n val (def_thms,opc,lthy) = \n if flag_def then let\n val ((opc,op_def_thm),lthy) = def op_name opt_pre @{attributes [simp]} lthy\n val opc = Refine_Util.dummify_tvars opc\n val def_thms = op_def_thm::def_thms\n in\n (def_thms,opc,lthy)\n end\n else let\n val _ = dbg_trace lthy \"Refine type of opt_pre to get opc\"\n val opc = Syntax.check_term lthy opt_pre\n val new_ctxt = Variable.declare_term opc lthy\n val opc = singleton (Variable.export_terms new_ctxt lthy) opc\n |> Refine_Util.dummify_tvars\n in \n (def_thms,opc,lthy)\n end\n \n \n (* PR_CONST Heuristics *) \n fun pr_const_heuristics basename c_pre lthy = let\n val _ = dbg_trace lthy (\"PR_CONST heuristics \" ^ @{make_string} c_pre)\n\n val c = Syntax.check_term lthy c_pre\n in\n case c of\n @{mpat \"PR_CONST _\"} => ((c_pre,false),lthy)\n | Const _ => ((c_pre,false),lthy)\n | _ => let\n val (f,args) = strip_comb c\n \n val lthy = case f of Const _ => let\n val ctxt = Variable.declare_term c lthy\n val lhs = Autoref_Tagging.list_APP (f,args)\n val rhs = @{mk_term \"UNPROTECT ?c\"}\n val goal = Logic.mk_equals (lhs,rhs) |> Thm.cterm_of ctxt\n val tac = \n Local_Defs.unfold0_tac ctxt @{thms APP_def UNPROTECT_def}\n THEN ALLGOALS (simp_tac (put_simpset HOL_basic_ss ctxt))\n val thm = Goal.prove_internal ctxt [] goal (K tac)\n |> singleton (Variable.export ctxt lthy)\n \n val (_,lthy) = Local_Theory.note \n ((Binding.suffix_name \"_def_pat\" basename,@{attributes [def_pat_rules]}),[thm]) lthy\n \n val _ = Thm.pretty_thm lthy thm |> Pretty.string_of |> writeln\n in\n lthy\n end\n | _ => (\n Pretty.block [\n Pretty.str \"Complex operation pattern. Added PR_CONST but no pattern rules:\",\n Pretty.brk 1,Syntax.pretty_term lthy c]\n |> Pretty.string_of |> warning \n ; lthy)\n \n val c_pre = Const(@{const_name PR_CONST},dummyT)$c_pre\n in\n ((c_pre,true),lthy)\n end\n end \n\n val ((opc,_),lthy) = pr_const_heuristics op_name opc lthy\n\n (* Register *)\n val arg_intfs = map (get_intf_of_rel lthy) args\n val res_intf = get_intf_of_rel lthy res\n \n\n fun register basename c lthy = let\n val _ = dbg_trace lthy \"Register\"\n open Sepref_Basic\n val c = Syntax.check_term lthy c\n \n val ri = case (is_nresT (body_type (fastype_of c)), is_nresT res_intf) of\n (true,false) => mk_nresT res_intf\n | (false,true) => dest_nresT res_intf\n | _ => res_intf\n \n val iT = arg_intfs ---> ri\n \n val ((_,itype_thm),lthy) = Sepref_Combinator_Setup.sepref_register_single (Binding.name_of basename) c iT lthy\n val _ = Thy_Output.pretty_thm lthy itype_thm |> Pretty.string_of |> writeln\n \n in\n lthy\n end\n \n val lthy = register op_name opc lthy\n \n val _ = dbg_trace lthy \"Define pre\"\n val pre_name = Binding.prefix_name \"pre_\" name\n val ((prec,pre_def_thm),lthy) = def pre_name pre @{attributes [simp]} lthy\n val prec = Refine_Util.dummify_tvars prec\n val def_thms = pre_def_thm::def_thms\n \n (* Re-integrate pre-constant into type-context of relation. TODO: This is probably not clean/robust *)\n val pre = constrain_type_pre (fastype_of pre) prec |> Syntax.check_term lthy\n\n \n val _ = dbg_trace lthy \"Convert both, relation and operation to uncurried form, and add nres\"\n val _ = dbg_trace lthy \"Convert relation (arguments have already been separated by analyze-rel)\"\n val res = case res of \n @{mpat \"\\_. \\_\\nres_rel\"} => res\n | _ => @{mk_term \"\\x. \\?res x\\nres_rel\"}\n val relt = mk_rel (SOME pre,args,res)\n \n val _ = dbg_trace_term lthy \"Converted relation\" relt\n val _ = Syntax.check_term lthy relt\n |> dbg_trace_term lthy \"Converted relation (checked)\"\n \n val _ = dbg_trace lthy \"Convert operation\"\n val opcT = fastype_of (Syntax.check_term lthy opc)\n val op_is_nres = Sepref_Basic.is_nresT (body_type opcT)\n val (opcu, op_ar) = let\n val arity = binder_types #> length\n (* Arity of operation is number of arguments before result (which may be a fun-type! )*)\n val rel_absT = fastype_of #> body_type #> HOLogic.dest_setT #> HOLogic.dest_prodT #> snd (* TODO: Generalization of with Realtors.rel_absT. Maybe move? *)\n val res_ar = arity (rel_absT res |> not op_is_nres ? dest_nresT)\n\n val op_ar = arity opcT - res_ar\n \n val _ = op_ar = length args orelse \n raise TERM(\"Operation/relation arity mismatch: \" ^ string_of_int op_ar ^ \" vs \" ^ string_of_int (length args),[opc,relt])\n \n (* Add RETURN o...o if necessary*)\n val opc = \n if op_is_nres then opc\n else mk_compN_pre op_ar (Const(@{const_name Refine_Basic.RETURN},dummyT)) opc\n \n (* Add uncurry if necessary *) \n val opc = mk_uncurryN_pre op_ar opc\n in \n (opc, op_ar)\n end\n \n (* Build mop-variant *)\n val declare_mop = (specified_pre orelse not op_is_nres) andalso flag_mop\n \n val (mop_data,lthy) = if declare_mop then let\n val _ = dbg_trace lthy \"mop definition\"\n val mop_rhs = Const(@{const_name mop},dummyT) $ prec $ opcu\n |> mk_curryN_pre op_ar\n val mop_name = Binding.prefix_name \"mop_\" name\n val ((mopc,mop_def_thm),lthy) = def mop_name mop_rhs [] lthy\n val mopc = Refine_Util.dummify_tvars mopc\n \n val ((mopc,added_pr_const),lthy) = pr_const_heuristics mop_name mopc lthy\n\n val mop_def_thm' = if added_pr_const then \n mop_def_thm RS @{thm add_PR_CONST_to_def}\n else mop_def_thm\n\n val (_,lthy) = Local_Theory.note ((Binding.empty, @{attributes [sepref_mop_def_thms]}),[mop_def_thm']) lthy\n\n val _ = dbg_trace lthy \"mop alternative definition\"\n val alt_unfolds = @{thms mop_alt_unfolds}\n |> not specified_pre ? curry op :: pre_def_thm\n\n val mop_alt_thm = Local_Defs.unfold0 lthy alt_unfolds mop_def_thm\n |> Refine_Util.shift_lambda_leftN op_ar\n val (_,lthy) = Local_Theory.note ((Binding.suffix_name \"_alt\" mop_name,@{attributes [simp]}),[mop_alt_thm]) lthy\n \n val _ = dbg_trace lthy \"mop: register\"\n val lthy = register mop_name mopc lthy\n \n val _ = dbg_trace lthy \"mop: vcg theorem\"\n local\n val Ts = map Relators.rel_absT args\n val ctxt = Variable.declare_thm mop_def_thm lthy\n val ctxt = fold Variable.declare_typ Ts ctxt\n val (x,ctxt) = Refine_Util.fix_left_tuple_from_Ts \"x\" Ts ctxt\n \n val mop_def_thm = mop_def_thm\n |> Local_Defs.unfold0 ctxt @{thms curry_shl}\n \n fun prep_thm thm = (thm OF [mop_def_thm])\n |> Drule.infer_instantiate' ctxt [SOME (Thm.cterm_of ctxt x)]\n |> Local_Defs.unfold0 ctxt @{thms uncurry_apply uncurry0_apply o_apply}\n |> Local_Defs.unfold0 ctxt (def_thms @\n @{thms Product_Type.split HOL.True_implies_equals})\n |> singleton (Variable.export ctxt lthy)\n\n val thms = map prep_thm @{thms mop_spec_rl_from_def mop_leof_rl_from_def} \n\n in\n val (_,lthy) = Local_Theory.note ((qname \"vcg\" mop_name,@{attributes [refine_vcg]}),thms) lthy\n end\n \n in \n (SOME (mop_name,mopc,mop_def_thm),lthy)\n end\n else (NONE,lthy)\n \n \n val _ = dbg_trace lthy \"Build Parametricity Theorem\"\n val param_t = mk_pair_in_pre opcu opcu relt \n \n val _ = dbg_trace_term lthy \"Param Term\" param_t\n \n val param_t = param_t |> Syntax.check_term lthy \n |> HOLogic.mk_Trueprop\n |> curry Logic.list_implies relconds\n \n val _ = dbg_trace lthy \"Build Parametricity Theorem for Precondition\"\n val param_pre_t = \n let\n val pre_relt = Relators.mk_fun_rel (Relators.list_prodrel_left args) @{term bool_rel}\n \n val param_pre_t = mk_pair_in_pre prec prec pre_relt \n |> Syntax.check_term lthy\n |> HOLogic.mk_Trueprop\n |> curry Logic.list_implies relconds\n in\n param_pre_t\n end\n \n \n val _ = dbg_trace lthy \"Build goals\"\n val goals = [[ (param_t, []), (param_pre_t, []) ]]\n \n fun after_qed [[p_thm, pp_thm]] _ (*ctxt*) = \n let\n val _ = dbg_trace lthy \"after_qed\"\n val p_thm' = p_thm |> not specified_pre ? Local_Defs.unfold0 lthy [pre_def_thm]\n\n val (_,lthy) = Local_Theory.note ((qname \"fref\" op_name,@{attributes [sepref_fref_thms]}), [p_thm']) lthy\n val (_,lthy) = Local_Theory.note ((qname \"param\" pre_name,@{attributes [param]}), [pp_thm]) lthy\n\n val p'_unfolds = pre_def_thm :: @{thms True_implies_equals}\n val (_,lthy) = Local_Theory.note ((qname \"fref'\" op_name,[]), [Local_Defs.unfold0 lthy p'_unfolds p_thm]) lthy\n\n \n val lthy = case mop_data of NONE => lthy | \n SOME (mop_name,mopc,mop_def_thm) => let\n val _ = dbg_trace lthy \"Build and prove mop-stuff\"\n (* mop - parametricity theorem: (uncurry\\<^sup>n mopc,uncurry\\<^sup>n mopc) \\ args \\\\<^sub>f res *)\n val mopcu = mk_uncurryN_pre op_ar mopc\n val param_mop_t = mk_pair_in_pre mopcu mopcu (mk_rel (NONE,args,res))\n |> Syntax.check_term lthy\n |> HOLogic.mk_Trueprop\n |> curry Logic.list_implies relconds\n \n val ctxt = Proof_Context.augment param_mop_t lthy \n \n val tac = let\n val p_thm = Local_Defs.unfold0 ctxt @{thms PR_CONST_def} p_thm\n in\n Local_Defs.unfold0_tac ctxt (mop_def_thm :: @{thms PR_CONST_def uncurry_curry_id uncurry_curry0_id})\n THEN FIRSTGOAL (\n dbg_msg_tac (Sepref_Debugging.msg_subgoal \"Mop-param thm goal after unfolding\") ctxt THEN'\n resolve_tac ctxt @{thms param_mopI}\n THEN' SOLVED' (resolve_tac ctxt [p_thm] THEN_ALL_NEW assume_tac ctxt)\n THEN' SOLVED' (resolve_tac ctxt [pp_thm] THEN_ALL_NEW assume_tac ctxt)\n )\n end\n \n val pm_thm = Goal.prove_internal lthy [] (Thm.cterm_of ctxt param_mop_t) (K tac)\n |> singleton (Variable.export ctxt lthy)\n \n val (_,lthy) = Local_Theory.note ((qname \"fref\" mop_name,@{attributes [sepref_fref_thms]}), [pm_thm]) lthy\n val (_,lthy) = Local_Theory.note ((qname \"fref'\" mop_name,[]), [Local_Defs.unfold0 lthy p'_unfolds pm_thm]) lthy\n \n \n in\n lthy\n end\n \n \n in\n lthy\n end\n | after_qed thmss _ = raise THM (\"After-qed: Wrong thmss structure\",~1,flat thmss) \n \n fun std_tac ctxt = let\n val ptac = REPEAT_ALL_NEW_FWD (Parametricity.net_tac (Parametricity.get_dflt ctxt) ctxt)\n \n (* Massage simpset a bit *)\n val ctxt = ctxt\n |> Context_Position.set_visible false\n |> Context.proof_map (Thm.attribute_declaration Clasimp.iff_del @{thm pair_in_Id_conv})\n\n in\n if flag_rawgoals then\n all_tac\n else\n Local_Defs.unfold0_tac ctxt def_thms THEN ALLGOALS (\n TRY o SOLVED' (\n TRY o resolve_tac ctxt @{thms frefI}\n THEN' TRY o REPEAT_ALL_NEW (ematch_tac ctxt @{thms prod_relE})\n THEN' simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms split uncurry_apply uncurry0_apply})\n THEN' (\n SOLVED' (ptac THEN_ALL_NEW asm_full_simp_tac ctxt)\n ORELSE' SOLVED' (cp_clarsimp_tac ctxt THEN_ALL_NEW_FWD ptac THEN_ALL_NEW SELECT_GOAL (auto_tac ctxt))\n )\n )\n )\n \n end \n \n val rf_std = Proof.refine (Method.Basic (fn ctxt => SIMPLE_METHOD (std_tac ctxt)))\n #> Seq.the_result \"do_cmd: Standard proof tactic returned empty result sequence\"\n\n in\n Proof.theorem NONE after_qed goals lthy\n |> rf_std\n end\n\n val _ = Outer_Syntax.local_theory_to_proof @{command_keyword \"sepref_decl_op\"}\n \"\" (do_parser >> do_cmd)\n \n\n\n\n local\n \n fun unfold_PR_CONST_tac ctxt = SELECT_GOAL (Local_Defs.unfold0_tac ctxt @{thms PR_CONST_def})\n\n fun transfer_precond_rl fixedTs ctxt t R = let\n (*val tfrees = Term.add_tfreesT (fastype_of t) [] \n val t' = map_types (map_type_tfree (fn x => if member op= tfrees x then dummyT else TFree x)) t\n *) (* TODO: Brute force approach, that may generalize too much! *)\n\n (* Subtypes that contain fixed TFrees are mapped structurally, preserving the fixed types, \n all other types just become dummyT *) \n \n fun mapT (T as TFree (n,_)) = if member op = fixedTs n then (T, true) else (dummyT, false)\n | mapT (Type (name,Ts)) = let \n val Ts = map mapT Ts \n in \n if exists I (map snd Ts) then (Type (name,map fst Ts),true) else (dummyT,false) \n end\n | mapT (TVar _) = (dummyT,false)\n \n \n (*fun is_declared_TFree (TFree (n,_)) = Variable.is_declared ctxt n\n | is_declared_TFree _ = false\n fun mpaT T = if is_declared_TFree T then T else dummyT\n fun mpT T = if exists_subtype is_declared_TFree T then map_atyps mpaT T else dummyT\n *)\n val t' = map_types (fst o mapT) t\n \n val goal = Sepref_Basic.mk_pair_in_pre t t' R \n |> tap (dbg_trace_term ctxt \"Precond transfer term before checking\")\n |> Syntax.check_term ctxt\n |> Thm.cterm_of ctxt\n \n val thm = Drule.infer_instantiate' ctxt [NONE,SOME goal] @{thm IMP_LIST_trivial}\n\n in\n thm\n end\n \n \n (* Generate a hnr-thm for mop given one for op *)\n fun generate_mop_thm ctxt op_thm = let\n val orig_ctxt = ctxt\n \n val (op_thm, ctxt) = yield_singleton (apfst snd oo Variable.import true) op_thm ctxt\n \n (* Convert mop_def_thms to form uncurry^n f \\ mop P g *)\n val mop_def_thms = Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_mop_def_thms}\n |> map (Local_Defs.unfold0 ctxt @{thms curry_shl})\n \n fun fail_hnr_tac _ _ = raise THM(\"Invalid hnr-theorem\",~1,[op_thm]) \n fun fail_mop_def_tac i st = let\n val g = nth (Thm.prems_of st) (i-1)\n in\n raise TERM(\"Found no matching mop-definition\",[g])\n end\n \n (* Tactic to solve preconditions of hfref_op_to_mop *)\n val tac = APPLY_LIST [\n resolve_tac ctxt [op_thm] ORELSE' fail_hnr_tac,\n ((*unfold_PR_CONST_tac ctxt THEN'*) resolve_tac ctxt mop_def_thms) ORELSE' fail_mop_def_tac,\n simp_precond_tac ctxt ORELSE' Sepref_Debugging.error_tac' \"precond simplification failed\" ctxt\n ] 1\n \n (* Do synthesis *)\n val st = @{thm hfref_op_to_mop}\n val st = Goal.protect (Thm.nprems_of st) st\n val mop_thm = tac st |> Seq.hd |> Goal.conclude\n \n val mop_thm = singleton (Variable.export ctxt orig_ctxt) mop_thm\n |> Sepref_Rules.norm_fcomp_rule orig_ctxt\n in mop_thm end \n \n (* Generate a hnr-thm for op given one for mop *)\n fun generate_op_thm ctxt mop_thm = let (* TODO: Almost-clone of generate_mop_thm *)\n val orig_ctxt = ctxt\n \n val (mop_thm, ctxt) = yield_singleton (apfst snd oo Variable.import true) mop_thm ctxt\n \n (* Convert mop_def_thms to form uncurry^n f \\ mop P g *)\n val mop_def_thms = Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_mop_def_thms}\n |> map (Local_Defs.unfold0 ctxt @{thms curry_shl})\n \n fun fail_hnr_tac _ _ = raise THM(\"Invalid hnr-theorem\",~1,[mop_thm]) \n fun fail_mop_def_tac i st = let\n val g = nth (Thm.prems_of st) (i-1)\n in\n raise TERM(\"Found no matching mop-definition\",[g])\n end\n \n (* Tactic to solve preconditions of hfref_mop_to_op *)\n val tac = APPLY_LIST [\n resolve_tac ctxt [mop_thm] ORELSE' fail_hnr_tac,\n ((*unfold_PR_CONST_tac ctxt THEN'*) resolve_tac ctxt mop_def_thms) ORELSE' fail_mop_def_tac,\n simp_precond_tac ctxt ORELSE' Sepref_Debugging.error_tac' \"precond simplification failed\" ctxt\n ] 1\n \n (* Do synthesis *)\n val st = @{thm hfref_mop_to_op}\n val st = Goal.protect (Thm.nprems_of st) st\n val op_thm = tac st |> Seq.hd |> Goal.conclude\n \n val op_thm = singleton (Variable.export ctxt orig_ctxt) op_thm\n |> Sepref_Rules.norm_fcomp_rule orig_ctxt\n in op_thm end \n\n\n \n fun chk_result ctxt thm = let\n val (_,R,S) = case Thm.concl_of thm of\n @{mpat \"Trueprop (_\\hfref ?P ?R ?S)\"} => (P,R,S)\n | _ => raise THM(\"chk_result: Expected hfref-theorem\",~1,[thm]) \n \n fun err t = let\n val ts = Syntax.pretty_term ctxt t |> Pretty.string_of\n in\n raise THM (\"chk_result: Invalid pattern left in assertions: \" ^ ts,~1,[thm])\n end \n fun check_invalid (t as @{mpat \"hr_comp _ _\"}) = err t \n | check_invalid (t as @{mpat \"hrp_comp _ _\"}) = err t\n | check_invalid (t as @{mpat \"hrr_comp _ _ _\"}) = err t\n | check_invalid (t as @{mpat \"pure (the_pure _)\"}) = err t\n | check_invalid (t as @{mpat \"_ O _\"}) = err t\n | check_invalid _ = false\n \n \n val _ = exists_subterm check_invalid R \n val _ = exists_subterm check_invalid S\n in\n ()\n end\n\n fun to_IMP_LIST ctxt thm = \n (thm RS @{thm to_IMP_LISTI}) |> Local_Defs.unfold0 ctxt @{thms to_IMP_LIST}\n \n fun from_IMP_LIST ctxt thm = thm |> Local_Defs.unfold0 ctxt @{thms from_IMP_LIST} \n\n in\n \n local\n open Refine_Util\n val flags = \n parse_bool_config' \"mop\" cfg_mop\n || parse_bool_config' \"ismop\" cfg_ismop\n || parse_bool_config' \"transfer\" cfg_transfer\n || parse_bool_config' \"rawgoals\" cfg_rawgoals\n || parse_bool_config' \"register\" cfg_register\n val parse_flags = parse_paren_list' flags \n \n val parse_precond = Scan.option (@{keyword \"[\"} |-- Parse.term --| @{keyword \"]\"})\n \n val parse_fref_thm = Scan.option (@{keyword \"uses\"} |-- Parse.thm)\n val parse_fixed_types = Scan.optional (@{keyword \"fixes\"} |-- Scan.repeat1 Parse.typ) []\n \n in\n val di_parser = \n parse_flags \n -- Scan.optional (Parse.binding --| @{keyword \":\"}) Binding.empty \n -- parse_precond \n -- Parse.thm \n -- parse_fref_thm\n -- parse_fixed_types\n end \n \n fun di_cmd (((((flags,name), precond_raw), i_thm_raw), p_thm_raw), fixedTs_raw) lthy = let\n val i_thm = singleton (Attrib.eval_thms lthy) i_thm_raw\n val p_thm = map_option (singleton (Attrib.eval_thms lthy)) p_thm_raw\n \n fun map_fixed_Ts (T as TFree (n,_)) = if Variable.is_declared lthy n then n else raise TYPE (\"Fixed type must be declared\",[T],[]) \n | map_fixed_Ts T = raise TYPE (\"Only TFrees can be fixed\",[T],[])\n \n val fixedTs = map (map_fixed_Ts o Syntax.parse_typ lthy) fixedTs_raw \n \n local\n val ctxt = Refine_Util.apply_configs flags lthy\n in\n val flag_mop = Config.get ctxt cfg_mop\n val flag_ismop = Config.get ctxt cfg_ismop\n val flag_rawgoals = Config.get ctxt cfg_rawgoals\n val flag_transfer = Config.get ctxt cfg_transfer\n val flag_register = Config.get ctxt cfg_register\n end\n \n val fr_attribs = if flag_register then @{attributes [sepref_fr_rules]} else []\n\n\n val ctxt = lthy\n \n (* Compose with fref-theorem *)\n val _ = dbg_trace lthy \"Compose with fref\"\n\n local\n val hf_tcomp_pre = @{thm hfcomp_tcomp_pre} OF [asm_rl,i_thm]\n fun compose p_thm = let\n val p_thm = p_thm |> to_assns_rl false lthy \n in\n hf_tcomp_pre OF [p_thm]\n end\n \n in \n val thm = case p_thm of\n SOME p_thm => compose p_thm\n | NONE => let\n val p_thms = Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_fref_thms}\n \n fun err () = let\n val prem_s = nth (Thm.prems_of hf_tcomp_pre) 0 |> Syntax.pretty_term ctxt |> Pretty.string_of\n in\n error (\"Found no fref-theorem matching \" ^ prem_s)\n end\n \n in\n case get_first (try compose) p_thms of\n NONE => err ()\n | SOME thm => thm \n \n end\n end \n \n val (thm,ctxt) = yield_singleton (apfst snd oo Variable.import true) thm ctxt\n\n val _ = dbg_trace_thm lthy \"Theorem before transfer\" thm\n \n val _ = dbg_trace lthy \"Transfer Precond\"\n val thm = to_IMP_LIST ctxt thm\n val thm = thm RS @{thm transform_pre_param}\n \n local\n val (pre,R,pp_name,pp_type) = case Thm.prems_of thm of\n [@{mpat \"Trueprop (IMP_LIST _ ((?pre,_)\\?R))\"}, @{mpat \"Trueprop (IMP_PRE (mpaq_STRUCT (mpaq_Var ?pp_name ?pp_type)) _)\"}] => (pre,R,pp_name,pp_type)\n | _ => raise THM(\"di_cmd: Cannot recognize first prems of transform_pre_param: \", ~1,[thm])\n \n in\n val thm = if flag_transfer then thm OF [transfer_precond_rl fixedTs ctxt pre R] else thm\n \n val thm = case precond_raw of \n NONE => thm\n | SOME precond_raw => let\n val precond = Syntax.parse_term ctxt precond_raw\n |> Sepref_Basic.constrain_type_pre pp_type\n |> Syntax.check_term ctxt\n |> Thm.cterm_of ctxt\n \n val thm = Drule.infer_instantiate ctxt [(pp_name,precond)] thm\n val thm = thm OF [asm_rl,@{thm IMP_PRE_CUSTOMD}]\n in\n thm\n end\n \n end\n\n val _ = dbg_trace_thm lthy \"Transferred theorem\" thm\n \n val _ = dbg_trace lthy \"Build goals\"\n val goals = [map (fn x => (x,[])) (Thm.prems_of thm)]\n\n fun after_qed thmss _ = let\n val _ = dbg_trace lthy \"After QED\"\n val prems_thms = hd thmss\n \n val thm = thm OF prems_thms\n\n val thm = from_IMP_LIST ctxt thm\n\n (* Two rounds of cleanup-constraints, norm_fcomp *)\n val _ = dbg_trace lthy \"Cleanup\"\n val thm = thm\n |> cleanup_constraints ctxt\n |> Sepref_Rules.norm_fcomp_rule ctxt\n |> cleanup_constraints ctxt\n |> Sepref_Rules.norm_fcomp_rule ctxt\n \n val thm = thm \n |> singleton (Variable.export ctxt lthy)\n |> zero_var_indexes\n \n val _ = dbg_trace lthy \"Check Result\"\n val _ = chk_result lthy thm \n \n \n fun qname suffix = if Binding.is_empty name then name else Binding.suffix_name suffix name \n \n val thm_name = if flag_ismop then qname \"_hnr_mop\" else qname \"_hnr\"\n val (_,lthy) = Local_Theory.note ((thm_name,fr_attribs),[thm]) lthy\n\n val _ = Thm.pretty_thm lthy thm |> Pretty.string_of |> writeln\n\n (* Create mop theorem from op-theorem *)\n val cr_mop_thm = flag_mop andalso not flag_ismop\n val lthy = \n if cr_mop_thm then \n let \n val _ = dbg_trace lthy \"Create mop-thm\"\n val mop_thm = thm\n |> generate_mop_thm lthy\n |> zero_var_indexes\n\n val (_,lthy) = Local_Theory.note ((qname \"_hnr_mop\",fr_attribs),[mop_thm]) lthy\n val _ = Thm.pretty_thm lthy mop_thm |> Pretty.string_of |> writeln\n in lthy end \n else lthy\n\n (* Create op theorem from mop-theorem *)\n val cr_op_thm = flag_ismop\n val lthy = \n if cr_op_thm then \n let \n val _ = dbg_trace lthy \"Create op-thm\"\n val op_thm = thm\n |> generate_op_thm lthy\n |> zero_var_indexes\n\n val (_,lthy) = Local_Theory.note ((qname \"_hnr\",fr_attribs),[op_thm]) lthy\n val _ = Thm.pretty_thm lthy op_thm |> Pretty.string_of |> writeln\n in lthy end \n else lthy\n\n \n in \n lthy \n end\n \n fun std_tac ctxt = let \n val ptac = REPEAT_ALL_NEW_FWD ( \n Parametricity.net_tac (Parametricity.get_dflt ctxt) ctxt ORELSE' assume_tac ctxt\n )\n in\n if flag_rawgoals orelse not flag_transfer then\n all_tac\n else\n APPLY_LIST [\n SELECT_GOAL (Local_Defs.unfold0_tac ctxt @{thms from_IMP_LIST}) THEN' TRY o SOLVED' ptac,\n simp_precond_tac ctxt\n ] 1\n \n end\n \n val rf_std = Proof.refine (Method.Basic (fn ctxt => SIMPLE_METHOD (std_tac ctxt)))\n #> Seq.the_result \"di_cmd: Standard proof tactic returned empty result sequence\"\n\n in\n Proof.theorem NONE after_qed goals ctxt\n |> rf_std\n \n end\n \n val _ = Outer_Syntax.local_theory_to_proof @{command_keyword \"sepref_decl_impl\"}\n \"\" (di_parser >> di_cmd)\n end\n\n end \n \\ \n\nsubsection \\Obsolete Manual Specification Helpers\\\n\n (* Generate VCG-rules for operations *)\n lemma vcg_of_RETURN_np: \n assumes \"f \\ RETURN r\"\n shows \"SPEC (\\x. x=r) \\ m \\ f \\ m\"\n and \"SPEC (\\x. x=r) \\\\<^sub>n m \\ f \\\\<^sub>n m\"\n using assms\n by (auto simp: pw_le_iff pw_leof_iff)\n\n lemma vcg_of_RETURN:\n assumes \"f \\ do { ASSERT \\; RETURN r }\"\n shows \"\\\\; SPEC (\\x. x=r) \\ m\\ \\ f \\ m\"\n and \"\\\\ \\ SPEC (\\x. x=r) \\\\<^sub>n m\\ \\ f \\\\<^sub>n m\"\n using assms\n by (auto simp: pw_le_iff pw_leof_iff refine_pw_simps)\n\n \n\n lemma vcg_of_SPEC_np: \n assumes \"f \\ SPEC post\"\n shows \"SPEC post \\ m \\ f \\ m\"\n and \"SPEC post \\\\<^sub>n m \\ f \\\\<^sub>n m\"\n using assms\n by auto \n\n\n\n\n (* Generate parametricity rules to generalize \n plain operations to monadic ones. Use with FCOMP.\n *) \n lemma mk_mop_rl1:\n assumes \"\\x. mf x \\ doN {ASSERT (P x); RETURN (f x)}\"\n shows \"(RETURN o f, mf) \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl2:\n assumes \"\\x y. mf x y \\ doN {ASSERT (P x y); RETURN (f x y)}\"\n shows \"(RETURN oo f, mf) \\ Id \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl3:\n assumes \"\\x y z. mf x y z \\ doN {ASSERT (P x y z); RETURN (f x y z)}\"\n shows \"(RETURN ooo f, mf) \\ Id \\ Id \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl0_np:\n assumes \"mf \\ RETURN f\"\n shows \"(RETURN f, mf) \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl1_np:\n assumes \"\\x. mf x \\ RETURN (f x)\"\n shows \"(RETURN o f, mf) \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl2_np:\n assumes \"\\x y. mf x y \\ RETURN (f x y)\"\n shows \"(RETURN oo f, mf) \\ Id \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n lemma mk_mop_rl3_np:\n assumes \"\\x y z. mf x y z \\ RETURN (f x y z)\"\n shows \"(RETURN ooo f, mf) \\ Id \\ Id \\ Id \\ \\Id\\nres_rel\"\n unfolding assms[abs_def]\n by (auto intro!: nres_relI simp: pw_le_iff refine_pw_simps)\n\n\n\n lemma mk_op_rl0_np:\n assumes \"mf \\ RETURN f\"\n shows \"(uncurry0 mf, uncurry0 (RETURN f)) \\ unit_rel \\\\<^sub>f \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl1:\n assumes \"\\x. mf x \\ doN {ASSERT (P x); RETURN (f x)}\"\n shows \"(mf, RETURN o f) \\ [P]\\<^sub>f Id \\ \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl1_np:\n assumes \"\\x. mf x \\ RETURN (f x)\"\n shows \"(mf, (RETURN o f)) \\ Id \\\\<^sub>f \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl2:\n assumes \"\\x y. mf x y \\ doN {ASSERT (P x y); RETURN (f x y)}\"\n shows \"(uncurry mf, uncurry (RETURN oo f)) \\ [uncurry P]\\<^sub>f Id\\\\<^sub>rId \\ \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl2_np:\n assumes \"\\x y. mf x y \\ RETURN (f x y)\"\n shows \"(uncurry mf, uncurry (RETURN oo f)) \\ Id\\\\<^sub>rId \\\\<^sub>f \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl3:\n assumes \"\\x y z. mf x y z \\ doN {ASSERT (P x y z); RETURN (f x y z)}\"\n shows \"(uncurry2 mf, uncurry2 (RETURN ooo f)) \\ [uncurry2 P]\\<^sub>f (Id\\\\<^sub>rId)\\\\<^sub>rId \\ \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n lemma mk_op_rl3_np:\n assumes \"\\x y z. mf x y z \\ RETURN (f x y z)\"\n shows \"(uncurry2 mf, uncurry2 (RETURN ooo f)) \\ (Id\\\\<^sub>rId)\\\\<^sub>rId \\\\<^sub>f \\Id\\nres_rel\"\n apply (intro frefI nres_relI)\n apply (auto simp: assms)\n done\n\n\n\n\n\n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/Sepref_Intf_Util.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2799111126916564}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Semantics\n imports Weak_Early_Step_Semantics\nbegin\n\ndefinition weakFreeTransition :: \"pi \\ freeRes \\ pi \\ bool\" (\"_ \\\\<^sup>^_ \\ _\" [80, 80, 80] 80) \n where \"P \\\\<^sup>^\\ \\ P' \\ P \\\\ \\ P' \\ (\\ = \\ \\ P = P')\"\n\nlemma weakTransitionI:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n\n shows \"P \\\\ \\ P' \\ P \\\\<^sup>^\\ \\ P'\"\n and \"P \\\\<^sup>^\\ \\ P\"\nby(auto simp add: weakFreeTransition_def)\n\nlemma transitionCases[consumes 1, case_names Step Stay]:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n\n assumes \"P \\\\<^sup>^\\ \\ P'\"\n and \"P \\\\ \\ P' \\ F \\ P'\"\n and \"F (\\) P\"\n\n shows \"F \\ P'\"\nusing assms\nby(auto simp add: weakFreeTransition_def)\n\nlemma singleActionChain:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n\n assumes \"P \\\\ \\ P'\"\n\n shows \"P \\\\<^sup>^\\ \\ P'\"\nusing assms\nby(auto dest: singleActionChain intro: weakTransitionI)\n\nlemma Tau:\n fixes P :: pi\n\n shows \"\\.(P) \\\\<^sup>^ \\ \\ P\"\nby(auto intro: Weak_Early_Step_Semantics.Tau\n simp add: weakFreeTransition_def)\n\nlemma Input:\n fixes a :: name\n and x :: name\n and u :: name\n and P :: pi\n\n shows \"a.P \\\\<^sup>^ a \\ P[x::=u]\"\nby(auto intro: Weak_Early_Step_Semantics.Input\n simp add: weakFreeTransition_def)\n \nlemma Output:\n fixes a :: name\n and b :: name\n and P :: pi\n\n shows \"a{b}.P \\\\<^sup>^a[b] \\ P\"\nby(auto intro: Weak_Early_Step_Semantics.Output\n simp add: weakFreeTransition_def)\n\nlemma Par1F:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n and Q :: pi\n\n assumes \"P \\\\<^sup>^\\ \\ P'\"\n\n shows \"P \\ Q \\\\<^sup>^\\ \\ (P' \\ Q)\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.Par1F\n simp add: weakFreeTransition_def residual.inject)\n\nlemma Par2F:\n fixes Q :: pi\n and \\ :: freeRes\n and Q' :: pi\n and P :: pi\n\n assumes QTrans: \"Q \\\\<^sup>^\\ \\ Q'\"\n\n shows \"P \\ Q \\\\<^sup>^\\ \\ (P \\ Q')\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.Par2F\n simp add: weakFreeTransition_def residual.inject)\n\n\nlemma ResF:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n and x :: name\n\n assumes \"P \\\\<^sup>^\\ \\ P'\"\n and \"x \\ \\\"\n\n shows \"<\\x>P \\\\<^sup>^\\ \\ <\\x>P'\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.ResF\n simp add: weakFreeTransition_def residual.inject)\n\nlemma Bang:\n fixes P :: pi\n and Rs :: residual\n\n assumes \"P \\ !P \\\\<^sup>^\\ \\ P'\"\n and \"P' \\ P \\ !P\"\n \n shows \"!P \\\\<^sup>^\\ \\ P'\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.Bang\n simp add: weakFreeTransition_def residual.inject)\n\nlemma tauTransitionChain[simp]:\n fixes P :: pi\n and P' :: pi\n\n shows \"P \\\\<^sup>^\\ \\ P' = P \\\\<^sub>\\ P'\"\napply(auto dest: Weak_Early_Step_Semantics.tauTransitionChain\n simp add: weakFreeTransition_def)\nby(erule rtrancl.cases) (auto intro: transitionI)\n\nlemma tauStepTransitionChain[simp]:\n fixes P :: pi\n and P' :: pi\n\n assumes \"P \\ P'\"\n\n shows \"P \\\\ \\ P' = P \\\\<^sub>\\ P'\"\nusing assms\napply(auto dest: Weak_Early_Step_Semantics.tauTransitionChain\n simp add: weakFreeTransition_def)\nby(erule rtrancl.cases) (auto intro: transitionI)\n\nlemma chainTransitionAppend:\n fixes P :: pi\n and P' :: pi\n and Rs :: residual\n and a :: name\n and x :: name\n and P'' :: pi\n and \\ :: freeRes\n\n shows \"P \\\\<^sub>\\ P'' \\ P'' \\\\<^sup>^\\ \\ P' \\ P \\\\<^sup>^\\ \\ P'\"\n and \"P \\\\<^sup>^\\ \\ P'' \\ P'' \\\\<^sub>\\ P' \\ P \\\\<^sup>^\\ \\ P'\"\nby(auto intro: chainTransitionAppend simp add: weakFreeTransition_def dest: Weak_Early_Step_Semantics.tauTransitionChain)\n\nlemma freshTauTransition:\n fixes P :: pi\n and c :: name\n\n assumes \"P \\\\<^sup>^\\ \\ P'\"\n and \"c \\ P\"\n\n shows \"c \\ P'\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.freshTauTransition\n simp add: weakFreeTransition_def residual.inject)\n\nlemma freshOutputTransition:\n fixes P :: pi\n and a :: name\n and b :: name\n and P' :: pi\n and c :: name\n\n assumes \"P \\\\<^sup>^a[b] \\ P'\"\n and \"c \\ P\"\n\n shows \"c \\ P'\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.freshOutputTransition\n simp add: weakFreeTransition_def residual.inject)\n\nlemma eqvtI:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n and p :: \"name prm\"\n\n assumes \"P \\\\<^sup>^\\ \\ P'\"\n\n shows \"(p \\ P) \\\\<^sup>^(p \\ \\) \\ (p \\ P')\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.eqvtI\n simp add: weakFreeTransition_def residual.inject)\n\nlemma freshInputTransition:\n fixes P :: pi\n and a :: name\n and b :: name\n and P' :: pi\n and c :: name\n\n assumes \"P \\\\<^sup>^a \\ P'\"\n and \"c \\ P\"\n and \"c \\ b\"\n\n shows \"c \\ P'\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.freshInputTransition\n simp add: weakFreeTransition_def residual.inject)\n\nlemmas freshTransition = freshBoundOutputTransition freshOutputTransition\n freshInputTransition freshTauTransition\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2797749983543407}} {"text": "theory UserDataTypeInstance\n imports\n Main\n \"Ecore-GROOVE-Mapping.Instance_Model_Graph_Mapping\"\n UserDataTypeType\nbegin\n\nsection \"Definition of an instance model belonging to the introduction of an user defined data type\"\n\ndefinition imod_userdatatype :: \"'t Id \\ ('o, 't) instance_model\" where\n \"imod_userdatatype name = \\\n Tm = tmod_userdatatype name,\n Object = {},\n ObjectClass = (\\x. undefined),\n ObjectId = (\\x. undefined),\n FieldValue = (\\x. undefined),\n DefaultValue = (\\x. undefined)\n \\\"\n\nlemma imod_userdatatype_correct: \"instance_model (imod_userdatatype name)\"\nproof (intro imod_empty_any_type_model_correct)\n show \"type_model (Tm (imod_userdatatype name))\"\n unfolding imod_userdatatype_def\n using tmod_userdatatype_correct\n by simp\nqed (simp_all add: imod_userdatatype_def tmod_userdatatype_def)\n\nlemma imod_userdatatype_combine_correct:\n assumes \"instance_model Imod\"\n assumes new_userdatatype: \"name \\ Class (Tm Imod) \\ Enum (Tm Imod) \\ UserDataType (Tm Imod)\"\n assumes valid_identifier: \"\\x. x \\ Class (Tm Imod) \\ Enum (Tm Imod) \\ UserDataType (Tm Imod) \\ \\id_in_ns name (Identifier x) \\ \\id_in_ns x (Identifier name)\"\n shows \"instance_model (imod_combine Imod (imod_userdatatype name))\"\nproof (intro imod_combine_distinct_correct)\n show \"instance_model (imod_userdatatype name)\"\n by (fact imod_userdatatype_correct)\nnext\n show \"type_model (tmod_combine (Tm Imod) (Tm (imod_userdatatype name)))\"\n unfolding imod_userdatatype_def\n using assms instance_model.select_convs(1) instance_model.validity_type_model_consistent tmod_userdatatype_combine_correct\n by metis\nnext\n show \"UserDataType (Tm Imod) \\ UserDataType (Tm (imod_userdatatype name)) = {}\"\n unfolding imod_userdatatype_def tmod_userdatatype_def\n using new_userdatatype\n by simp\nqed (simp_all add: assms imod_userdatatype_def tmod_userdatatype_def)\n\n\n\nsection \"Encoding of an user defined data type as Node Type in GROOVE\"\n\ndefinition ig_userdatatype_as_node_type :: \"'t Id \\ 't \\ ('o, 't list, 't) instance_graph\" where\n \"ig_userdatatype_as_node_type name data_edge = \\\n TG = tg_userdatatype_as_node_type name data_edge,\n Id = {},\n N = {},\n E = {},\n ident = (\\x. undefined)\n \\\"\n\nlemma ig_userdatatype_as_node_type_correct: \"instance_graph (ig_userdatatype_as_node_type name data_edge)\"\nproof (intro ig_empty_any_type_graph_correct)\n show \"type_graph (TG (ig_userdatatype_as_node_type name data_edge))\"\n unfolding ig_userdatatype_as_node_type_def\n using tg_userdatatype_as_node_type_correct\n by simp\nqed (simp_all add: ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def)\n\nlemma ig_userdatatype_as_node_type_combine_correct:\n assumes \"instance_graph IG\"\n assumes combined_node_types: \"NT (TG IG) \\ {type (id_to_list name), LabDef.string} \\ {LabDef.string}\"\n shows \"instance_graph (ig_combine IG (ig_userdatatype_as_node_type name data_edge))\"\nproof (intro ig_combine_merge_no_containment_imod2_correct)\n show \"instance_graph (ig_userdatatype_as_node_type name data_edge)\"\n by (fact ig_userdatatype_as_node_type_correct)\nnext\n show \"ET (TG IG) \\ ET (TG (ig_userdatatype_as_node_type name data_edge)) = {}\"\n unfolding ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def\n using assms instance_graph.validity_type_graph type_graph.structure_edges_wellformed_src_node\n by fastforce\nnext\n have \"type_graph (tg_combine (TG IG) (tg_userdatatype_as_node_type name data_edge))\"\n using assms\n by (simp add: tg_userdatatype_as_node_type_combine_correct instance_graph.validity_type_graph)\n then show \"type_graph (tg_combine (TG IG) (TG (ig_userdatatype_as_node_type name data_edge)))\"\n unfolding ig_userdatatype_as_node_type_def\n by simp\nnext\n fix et n\n assume et_def: \"et \\ ET (TG IG)\"\n assume \"n \\ N IG \\ N (ig_userdatatype_as_node_type name data_edge)\"\n then have n_def: \"n \\ N IG\"\n unfolding ig_userdatatype_as_node_type_def\n by simp\n then have type_n_def: \"type\\<^sub>n n \\ NT (TG IG)\"\n using assms(1) instance_graph.validity_node_typed\n by blast\n then have type_n_not_name: \"type\\<^sub>n n \\ type (id_to_list name)\"\n using combined_node_types\n by fastforce\n assume \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ inh (TG (ig_userdatatype_as_node_type name data_edge)))\\<^sup>+\"\n then have inh_unfold_def: \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+\"\n unfolding ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def\n by simp\n show \"card {e \\ E IG. src e = n \\ type\\<^sub>e e = et} in m_out (mult (TG IG) et)\"\n proof (induct \"LabDef.string \\ NT (TG IG)\")\n case True\n then have \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name))})\\<^sup>+\"\n using IntD2 Un_insert_right inf_sup_absorb insert_absorb\n using inh_unfold_def assms(1) instance_graph.validity_type_graph type_graph.validity_inh_node\n by metis\n then have \"(type\\<^sub>n n, src et) \\ (inh (TG IG))\\<^sup>+\"\n proof (induct)\n case (base y)\n then show ?case\n using type_n_not_name\n by blast\n next\n case (step y z)\n then have \"y \\ NT (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node type_graph.validity_inh_trans)\n then have \"y \\ type (id_to_list name)\"\n using combined_node_types\n by blast\n then have \"(y, z) \\ inh (TG IG)\"\n using step.hyps(2)\n by blast\n then show ?case\n using step.hyps(3)\n by simp\n qed\n then have \"(type\\<^sub>n n, src et) \\ inh (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n then show ?case\n using assms(1) instance_graph.validity_outgoing_mult et_def n_def\n by blast\n next\n case False\n then have combined_node_types_empty: \"NT (TG IG) \\ {type (id_to_list name), LabDef.string} = {}\"\n using combined_node_types\n by blast\n then have type_n_not_string: \"type\\<^sub>n n \\ LabDef.string\"\n using type_n_def\n by blast\n have \"(type\\<^sub>n n, src et) \\ (inh (TG IG))\\<^sup>+\"\n using inh_unfold_def\n proof (induct)\n case (base y)\n then show ?case\n using type_n_not_name type_n_not_string\n by blast\n next\n case (step y z)\n then have \"y \\ NT (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node type_graph.validity_inh_trans)\n then have \"y \\ type (id_to_list name) \\ y \\ LabDef.string\"\n using combined_node_types_empty\n by blast\n then have \"(y, z) \\ inh (TG IG)\"\n using step.hyps(2)\n by blast\n then show ?case\n using step.hyps(3)\n by simp\n qed\n then have \"(type\\<^sub>n n, src et) \\ inh (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n then show ?case\n using assms(1) instance_graph.validity_outgoing_mult et_def n_def\n by blast\n qed\nnext\n fix et n\n assume \"et \\ ET (TG (ig_userdatatype_as_node_type name data_edge))\"\n then have et_def: \"et = (type (id_to_list name), LabDef.edge [data_edge], LabDef.string)\"\n unfolding ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def\n by simp\n then have src_et_def: \"src et = type (id_to_list name)\"\n by simp\n assume \"n \\ N IG \\ N (ig_userdatatype_as_node_type name data_edge)\"\n then have n_def: \"n \\ N IG\"\n unfolding ig_userdatatype_as_node_type_def\n by simp\n then have type_n_def: \"type\\<^sub>n n \\ NT (TG IG)\"\n using assms(1) instance_graph.validity_node_typed\n by blast\n then have type_n_not_name: \"type\\<^sub>n n \\ type (id_to_list name)\"\n using combined_node_types\n by fastforce\n have no_inh: \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+\"\n proof\n assume \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ {(LabDef.type (id_to_list name), LabDef.type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+\"\n then show \"False\"\n proof (cases)\n case base\n then have \"(type\\<^sub>n n, src et) = (type (id_to_list name), type (id_to_list name))\"\n using src_et_def assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node_alt combined_node_types\n by fastforce\n then show ?thesis\n using type_n_not_name\n by blast\n next\n case (step c)\n then have \"(c, src et) = (type (id_to_list name), type (id_to_list name))\"\n using src_et_def assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node_alt combined_node_types\n by fastforce\n then have c_def: \"c = type (id_to_list name)\"\n by simp\n have \"(inh (TG IG) \\ {(LabDef.type (id_to_list name), LabDef.type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+ = \n inh (TG IG) \\ {(LabDef.type (id_to_list name), LabDef.type (id_to_list name)), (LabDef.string, LabDef.string)}\"\n using assms(1) instance_graph.validity_type_graph tg_userdatatype_as_node_type_combine_inh tg_userdatatype_as_node_type_def type_graph.select_convs(3)\n by metis\n then have \"(type\\<^sub>n n, c) = (LabDef.type (id_to_list name), LabDef.type (id_to_list name))\"\n using step(1) c_def assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node_alt combined_node_types\n by fastforce\n then show ?thesis\n using type_n_not_name\n by blast\n qed\n qed\n assume \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ inh (TG (ig_userdatatype_as_node_type name data_edge)))\\<^sup>+\"\n then have \"(type\\<^sub>n n, src et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+\"\n unfolding ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def\n by simp\n then show \"card {e \\ E (ig_userdatatype_as_node_type name data_edge). src e = n \\ type\\<^sub>e e = et} in m_out (mult (TG (ig_userdatatype_as_node_type name data_edge)) et)\"\n using no_inh\n by blast\nnext\n fix et n\n assume et_def: \"et \\ ET (TG IG)\"\n assume \"n \\ N IG \\ N (ig_userdatatype_as_node_type name data_edge)\"\n then have n_def: \"n \\ N IG\"\n unfolding ig_userdatatype_as_node_type_def\n by simp\n then have type_n_def: \"type\\<^sub>n n \\ NT (TG IG)\"\n using assms(1) instance_graph.validity_node_typed\n by blast\n then have type_n_not_name: \"type\\<^sub>n n \\ type (id_to_list name)\"\n using combined_node_types\n by fastforce\n assume \"(type\\<^sub>n n, tgt et) \\ (inh (TG IG) \\ inh (TG (ig_userdatatype_as_node_type name data_edge)))\\<^sup>+\"\n then have inh_unfold_def: \"(type\\<^sub>n n, tgt et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name)), (LabDef.string, LabDef.string)})\\<^sup>+\"\n unfolding ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def\n by simp\n show \"card {e \\ E IG. tgt e = n \\ type\\<^sub>e e = et} in m_in (mult (TG IG) et)\"\n proof (induct \"LabDef.string \\ NT (TG IG)\")\n case True\n then have \"(type\\<^sub>n n, tgt et) \\ (inh (TG IG) \\ {(type (id_to_list name), type (id_to_list name))})\\<^sup>+\"\n using IntD2 Un_insert_right inf_sup_absorb insert_absorb\n using inh_unfold_def assms(1) instance_graph.validity_type_graph type_graph.validity_inh_node\n by metis\n then have \"(type\\<^sub>n n, tgt et) \\ (inh (TG IG))\\<^sup>+\"\n proof (induct)\n case (base y)\n then show ?case\n using type_n_not_name\n by blast\n next\n case (step y z)\n then have \"y \\ NT (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node type_graph.validity_inh_trans)\n then have \"y \\ type (id_to_list name)\"\n using combined_node_types\n by blast\n then have \"(y, z) \\ inh (TG IG)\"\n using step.hyps(2)\n by blast\n then show ?case\n using step.hyps(3)\n by simp\n qed\n then have \"(type\\<^sub>n n, tgt et) \\ inh (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n then show ?case\n using assms(1) instance_graph.validity_ingoing_mult et_def n_def\n by blast\n next\n case False\n then have combined_node_types_empty: \"NT (TG IG) \\ {type (id_to_list name), LabDef.string} = {}\"\n using combined_node_types\n by blast\n then have type_n_not_string: \"type\\<^sub>n n \\ LabDef.string\"\n using type_n_def\n by blast\n have \"(type\\<^sub>n n, tgt et) \\ (inh (TG IG))\\<^sup>+\"\n using inh_unfold_def\n proof (induct)\n case (base y)\n then show ?case\n using type_n_not_name type_n_not_string\n by blast\n next\n case (step y z)\n then have \"y \\ NT (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.structure_inheritance_wellformed_second_node type_graph.validity_inh_trans)\n then have \"y \\ type (id_to_list name) \\ y \\ LabDef.string\"\n using combined_node_types_empty\n by blast\n then have \"(y, z) \\ inh (TG IG)\"\n using step.hyps(2)\n by blast\n then show ?case\n using step.hyps(3)\n by simp\n qed\n then have \"(type\\<^sub>n n, tgt et) \\ inh (TG IG)\"\n by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n then show ?case\n using assms(1) instance_graph.validity_ingoing_mult et_def n_def\n by blast\n qed\nqed (simp_all add: ig_userdatatype_as_node_type_def tg_userdatatype_as_node_type_def assms)\n\n\nsubsection \"Transformation functions\"\n\ndefinition imod_userdatatype_to_ig_userdatatype_as_node_type :: \"'t Id \\ 't \\ ('o, 't) instance_model \\ ('o, 't list, 't) instance_graph\" where\n \"imod_userdatatype_to_ig_userdatatype_as_node_type name data_edge Imod = \\\n TG = tg_userdatatype_as_node_type name data_edge,\n Id = {},\n N = {},\n E = {},\n ident = (\\x. undefined)\n \\\"\n\nlemma imod_userdatatype_to_ig_userdatatype_as_node_type_proj:\n shows \"imod_userdatatype_to_ig_userdatatype_as_node_type name data_edge (imod_userdatatype name) = ig_userdatatype_as_node_type name data_edge\"\n unfolding imod_userdatatype_to_ig_userdatatype_as_node_type_def ig_userdatatype_as_node_type_def imod_userdatatype_def\n by simp\n\nlemma imod_userdatatype_to_ig_userdatatype_as_node_type_func:\n shows \"ig_combine_mapping_function (imod_userdatatype_to_ig_userdatatype_as_node_type name data_edge) (imod_userdatatype name) (ig_userdatatype_as_node_type name data_edge)\"\n by (intro ig_combine_mapping_function.intro)\n (simp_all add: imod_userdatatype_to_ig_userdatatype_as_node_type_def imod_userdatatype_def ig_userdatatype_as_node_type_def imod_combine_def)\n\ndefinition ig_userdatatype_as_node_type_to_imod_userdatatype :: \"'t Id \\ ('o, 't list, 't) instance_graph \\ ('o, 't) instance_model\" where\n \"ig_userdatatype_as_node_type_to_imod_userdatatype name IG = \\\n Tm = tmod_userdatatype name,\n Object = {},\n ObjectClass = (\\x. undefined),\n ObjectId = (\\x. undefined),\n FieldValue = (\\x. undefined),\n DefaultValue = (\\x. undefined)\n \\\"\n\nlemma ig_userdatatype_as_node_type_to_imod_userdatatype_proj:\n shows \"ig_userdatatype_as_node_type_to_imod_userdatatype name (ig_userdatatype_as_node_type name data_edge) = imod_userdatatype name\"\n unfolding ig_userdatatype_as_node_type_to_imod_userdatatype_def imod_userdatatype_def ig_userdatatype_as_node_type_def\n by simp\n\nlemma ig_userdatatype_as_node_type_to_imod_userdatatype_func:\n shows \"imod_combine_mapping_function (ig_userdatatype_as_node_type_to_imod_userdatatype name) (ig_userdatatype_as_node_type name data_edge) (imod_userdatatype name)\"\n by (intro imod_combine_mapping_function.intro)\n (simp_all add: ig_userdatatype_as_node_type_to_imod_userdatatype_def imod_userdatatype_def ig_userdatatype_as_node_type_def ig_combine_def)\n\nend", "meta": {"author": "RemcodM", "repo": "thesis-ecore-groove-formalisation", "sha": "a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca", "save_path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation", "path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation/thesis-ecore-groove-formalisation-a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca/isabelle/Ecore-GROOVE-Mapping-Library/UserDataTypeInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341024983754, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27976020886452774}} {"text": "theory ArityAnalysisPreImpl\nimports ArityAnalysisSig \"Env-Nominal\"\nbegin\n\ndefinition thunks_AE :: \"heap \\ AEnv\" where\n \"thunks_AE \\ = (\\ x . (if x \\ thunks \\ then up\\0 else \\))\"\n\nlemma edom_thunks_AE: \"edom (thunks_AE \\) \\ domA \\\"\n unfolding edom_def thunks_AE_def by (auto dest: set_mp[OF thunks_domA])\n\nlemma thunks_AE_eqvt[eqvt]:\n \"\\ \\ thunks_AE \\ = thunks_AE (\\ \\ \\)\"\n unfolding thunks_AE_def\n by perm_simp rule\n\nlemma thunks_AE_subst[simp]:\n \"thunks_AE \\[y::h=x] = thunks_AE \\\"\n unfolding thunks_AE_def by simp\n\nlemma thunks_AE_subst_approx:\n \"y \\ domA \\ \\ thunks_AE \\[y::h=x] \\ (thunks_AE \\)(y := \\, x := up\\0)\"\n by (auto intro!: fun_belowI dest!: contra_subsetD[OF edom_thunks_AE] simp add: edomIff)\n\nlocale ArityAnalysisPreImpl =\n fixes Afix :: \"(exp \\ (Arity \\ AEnv)) \\ heap \\ AEnv \\ AEnv\"\n assumes Afix_eqvt: \"p \\ Afix = Afix\"\n assumes Afix_cong[fundef_cong]:\n \"\\ (\\ e. size e \\ size_list (\\p. size (snd p)) heap1 \\ aexp1 e = aexp2 e); heap1 = heap2 \\\n \\ Afix aexp1 heap1 = Afix aexp2 heap2\"\nbegin\n \nnominal_function\n Aexp :: \"exp \\ (Arity \\ AEnv)\"\nwhere\n \"Aexp (Var x) = (\\ n . esing x\\(up\\n))\"\n| \"Aexp (Lam [x]. e) = (\\ n . (Aexp e \\ (pred \\ n) f|` (fv (Lam [x]. e))))\"\n| \"Aexp (App e x) = (\\ n . Aexp e \\ (inc \\ n) \\ (esing x \\ (up \\ 0)))\"\n| \"Aexp (Terms.Let as e) = (\\ n . (Afix Aexp as \\ (Aexp e \\ n \\ thunks_AE as)) f|` (fv (Terms.Let as e)))\"\n| \"Aexp (Bool b) = \\\"\n| \"Aexp (scrut ? e1 : e2) = (\\ n. Aexp scrut\\0 \\ Aexp e1\\n \\ Aexp e2\\n)\"\nproof-\ncase goal1\n note Afix_eqvt[eqvt]\n show ?case\n unfolding eqvt_def Aexp_graph_aux_def\n apply rule\n apply (perm_simp)\n apply (simp add: Abs_cfun_eqvt)\n done\nnext\ncase goal3 thus ?case by (metis Terms.exp_strong_exhaust)\nnext\ncase (goal10 x e x' e')\n from goal10(5)\n show ?case\n proof(rule eqvt_lam_case)\n fix \\ :: perm\n assume *: \"supp (-\\) \\* (fv (Lam [x]. e) :: var set)\" \n {\n fix n\n have \"Aexp_sumC (\\ \\ e)\\(pred\\n) f|` fv (Lam [x]. e) = (-\\ \\ Aexp_sumC (\\ \\ e)\\(pred\\n)) f|` fv (Lam [x]. e)\"\n by (rule env_restr_perm[symmetric, OF *]) simp\n also have \"\\ = ((Aexp_sumC e)\\(pred\\n)) f|` fv (Lam [x]. e)\"\n by (simp add: eqvt_at_apply[OF goal10(1)] pemute_minus_self)\n also note calculation\n }\n thus \"(\\ n. Aexp_sumC (\\ \\ e)\\(pred\\n) f|` fv (Lam [x]. e)) = (\\ n. Aexp_sumC e\\(pred\\n) f|` fv (Lam [x]. e))\" by simp\n qed\nnext\ncase (goal19 as body as' body')\n note Afix_eqvt[eqvt]\n\n from goal19(9)\n show ?case\n proof (rule eqvt_let_case)\n fix \\ :: perm\n assume *: \"supp (-\\) \\* (fv (Terms.Let as body) :: var set)\"\n \n { fix n\n have \"Afix Aexp_sumC (\\ \\ as)\\(Aexp_sumC (\\ \\ body)\\n \\ thunks_AE (\\ \\ as)) f|` fv (Terms.Let as body)\n = (- \\ \\ Afix Aexp_sumC (\\ \\ as)\\(Aexp_sumC (\\ \\ body)\\n \\ thunks_AE (\\ \\ as))) f|` fv (Terms.Let as body)\"\n by (rule env_restr_perm[OF *, symmetric]) simp\n also have \"- \\ \\ Afix Aexp_sumC (\\ \\ as)\\(Aexp_sumC (\\ \\ body)\\n \\ thunks_AE (\\ \\ as)) = \n Afix (- \\ \\ Aexp_sumC) as\\((- \\ \\ Aexp_sumC) body\\n \\ thunks_AE as)\"\n by (simp add: pemute_minus_self)\n also have \"Afix (- \\ \\ Aexp_sumC) as = Afix Aexp_sumC as\"\n by (rule Afix_cong[OF eqvt_at_apply[OF goal19(1)] refl])\n also have \"(- \\ \\ Aexp_sumC) body = Aexp_sumC body\"\n by (rule eqvt_at_apply[OF goal19(2)])\n also note calculation\n }\n thus \"(\\ n. Afix Aexp_sumC (\\ \\ as)\\(Aexp_sumC (\\ \\ body)\\n \\ thunks_AE (\\ \\ as)) f|` fv (Terms.Let as body)) =\n (\\ n. Afix Aexp_sumC as\\(Aexp_sumC body\\n \\ thunks_AE as) f|` fv (Terms.Let as body))\" by (simp only:)\n qed\nqed auto\n\nnominal_termination (eqvt) by lexicographic_order\nend\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/ArityAnalysisPreImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2797272536582714}} {"text": "theory Globalenvs\n imports Main\n Maps AST\n Integers Floats Values Memory\nbegin\n\n(** Global environments are a component of the dynamic semantics of\n all languages involved in the compiler. A global environment\n maps symbol names (names of functions and of global variables)\n to the corresponding memory addresses. It also maps memory addresses\n of functions to the corresponding function descriptions.\n\n Global environments, along with the initial memory state at the beginning\n of program execution, are built from the program of interest, as follows:\n- A distinct memory address is assigned to each function of the program.\n These function addresses use negative numbers to distinguish them from\n addresses of memory blocks. The associations of function name to function\n address and function address to function description are recorded in\n the global environment.\n- For each global variable, a memory block is allocated and associated to\n the name of the variable.\n\n These operations reflect (at a high level of abstraction) what takes\n place during program linking and program loading in a real operating\n system. *)\n\n(** Auxiliary function for initialization of global variables. *)\n\nfun store_zeros :: \"mem \\ block \\ Z \\ Z \\ (mem option)\" where\n \"store_zeros m b p n =\n (if n \\ 0 then Some m else\n (case Mem.store Mint8unsigned m b p (Vint 0) of\n Some m' \\ store_zeros m' b (p + 1) (n - 1)\n | None \\ None\n ))\"\n\nsection \\Symbol environments\\\n\n(** Symbol environments are a restricted view of global environments,\n focusing on symbol names and their associated blocks. They do not\n contain mappings from blocks to function or variable definitions. *)\n\nrecord Senv_t =\n senv_find_symbol :: \"ident \\ block option\"\n senv_public_symbol :: \"ident \\ bool\"\n senv_invert_symbol :: \"block \\ ident option\"\n senv_block_is_volatile :: \"block \\ bool\"\n senv_nextblock :: block\n\nlocale Senv'\nbegin\n\n(** Operations *)\nabbreviation \"find_symbol \\ senv_find_symbol\"\nabbreviation \"public_symbol \\ senv_public_symbol\"\nabbreviation \"invert_symbol \\ senv_invert_symbol\"\nabbreviation \"block_is_volatile \\ senv_block_is_volatile\"\nabbreviation \"nextblock \\ senv_nextblock\"\n\n(** Properties *)\n\nnamed_theorems inv_defs'\n\ndefinition [inv_defs']: \"find_symbol_injective se \\\n \\id1 id2 b. find_symbol se id1 = Some b \\ find_symbol se id2 = Some b \\ id1 = id2\"\n\ndefinition [inv_defs']: \"invert_find_symbol se \\\n \\id b. invert_symbol se b = Some id \\ find_symbol se id = Some b\"\n\ndefinition [inv_defs']: \"find_invert_symbol se \\\n \\id b. find_symbol se id = Some b \\ invert_symbol se b = Some id\"\n\ndefinition [inv_defs']: \"public_symbol_exists se \\\n \\id. public_symbol se id \\ (\\ b. find_symbol se id = Some b)\"\n\ndefinition [inv_defs']: \"find_symbol_below se \\\n \\id b. find_symbol se id = Some b \\ b < nextblock se\"\n\ndefinition [inv_defs']: \"block_is_volatile_below se \\\n \\b. block_is_volatile se b \\ b < nextblock se\"\n\ninductive invariants where\n \"\\ find_symbol_injective se;\n invert_find_symbol se;\n find_invert_symbol se;\n public_symbol_exists se;\n find_symbol_below se;\n block_is_volatile_below se \\ \\\n invariants se\"\n\nlemmas inv_def = inv_defs' invariants.simps[simplified]\n\ndefinition equiv :: \"Senv_t \\ Senv_t \\ bool\" where\n \"equiv se1 se2 =\n ((\\ ident. find_symbol se2 ident = find_symbol se1 ident)\n \\ (\\ ident. public_symbol se2 ident = public_symbol se1 ident)\n \\ (\\ b. block_is_volatile se2 b = block_is_volatile se1 b))\"\nend\n\ninterpretation Senv: Senv' .\n\nsection \\Global Environments\\\n\nrecord ('f, 'v) Genv_t =\n genv_public :: \"ident list\" (* which symbol names are public *)\n genv_symb :: \"block ITree\" (* mapping symbol -> block *)\n genv_defs :: \"(('f, 'v) globdef) PTree\" (* mapping block -> definition *)\n genv_next :: block (* next symbol pointer *)\n\nlocale Genv' =\n fixes ft :: \"'f itself\"\n fixes vt :: \"'v itself\"\nbegin\n\nnamed_theorems inv_defs'\n\ndefinition [inv_defs']: \"genv_symb_range ge \\\n \\id b. ITree.get id (genv_symb ge) = Some b \\ b < (genv_next ge)\"\n\ndefinition [inv_defs']: \"genv_defs_range ge \\\n \\b g. PTree.get b (genv_defs ge) = Some g \\ b < (genv_next ge)\"\n\ndefinition [inv_defs']: \"genv_vars_inj ge \\\n \\id1 id2 b.\n ITree.get id1 (genv_symb ge) = Some b \\ ITree.get id2 (genv_symb ge) = Some b \\ id1 = id2\"\n\ninductive invariants where\n \"\\genv_symb_range ge;\n genv_defs_range ge;\n genv_vars_inj ge\\ \\\n invariants ge\"\n\nlemmas inv_def = inv_defs' invariants.simps[simplified]\n\nsubsection \\Lookup functions\\\n\ncontext\n fixes ge :: \"('f, 'v) Genv_t\"\nbegin\n\n(** [find_symbol ge id] returns the block associated with the given name, if any *)\n\nfun find_symbol :: \"ident \\ (block option)\" where\n \"find_symbol ident = ITree.get ident (genv_symb ge)\"\n\n(** [symbol_address ge id ofs] returns a pointer into the block associated\n with [id], at byte offset [ofs]. [Vundef] is returned if no block is associated\n to [id]. *)\n\nfun symbol_address :: \"ident \\ m_ptrofs \\ val\" where\n \"symbol_address ident ofs =\n (case find_symbol ident of\n Some b \\ Vptr b ofs\n | None \\ Vundef\n )\"\n\n(** [public_symbol ge id] says whether the name [id] is public and defined. *)\n\nfun public_symbol :: \"ident \\ bool\" where\n \"public_symbol ident =\n (case find_symbol ident of\n None \\ False\n | Some _ \\ ident \\ set (genv_public ge)\n )\"\n\n(** [find_def ge b] returns the global definition associated with the given address. *)\n\nfun find_def :: \"block \\ (('f, 'v) globdef) option\" where\n \"find_def b = PTree.get b (genv_defs ge)\"\n\n(** [find_funct_ptr ge b] returns the function description associated with\n the given address. *)\n\nfun find_funct_ptr :: \"block \\ ('f option)\" where\n \"find_funct_ptr b = (case find_def b of Some (Gfun f) \\ Some f | _ \\ None )\"\n\n(** [find_funct] is similar to [find_funct_ptr], but the function address\n is given as a value, which must be a pointer with offset 0. *)\n\nfun find_funct :: \"val \\ ('f option)\" where\n \"find_funct v =\n (case v of\n Vptr b ofs \\ if ofs = 0 then find_funct_ptr b else None\n | _ \\ None\n )\"\n\n(** [invert_symbol ge b] returns the name associated with the given block, if any *)\n\n(* CompCert uses 'PTree.fold' here, which we can't because our tree doesn't have a structure *)\nfun invert_symbol :: \"block \\ (ident option)\" where\n \"invert_symbol b =\n (if \\id. (genv_symb ge) id = Some b\n then Some (THE id. (genv_symb ge) id = Some b)\n else None)\"\n\n(** [find_var_info ge b] returns the information attached to the variable\n at address [b]. *)\n\nfun find_var_info :: \"block \\ (('v globvar) option)\" where\n \"find_var_info b =\n (case find_def b of Some (Gvar v) \\ Some v | _ \\ None )\"\n\n(** [block_is_volatile ge b] returns [true] if [b] points to a global variable\n of volatile type, [false] otherwise. *)\n\nfun block_is_volatile :: \"block \\ bool\" where\n \"block_is_volatile b =\n (case find_var_info b of\n None \\ False\n | Some gv \\ (gvar_volatile gv)\n )\"\n\nsubsection \\Constructing the global environment\\\n\nfun add_global :: \"(ident * ('f, 'v) globdef) \\ ('f, 'v) Genv_t\" where\n \"add_global (ident, gdef) =\n Genv_t.make\n (genv_public ge)\n (ITree.set ident (genv_next ge) (genv_symb ge))\n (PTree.set (genv_next ge) gdef (genv_defs ge))\n ((genv_next ge) + 1)\"\n\nend\n\nfun add_globals :: \"('f, 'v) Genv_t \\ ((ident * ('f, 'v) globdef) list) \\ ('f, 'v) Genv_t\" where\n \"add_globals ge gl = List.foldl add_global ge gl\"\n\nfun empty_genv :: \"ident list \\ ('f, 'v) Genv_t\" where\n \"empty_genv pub = Genv_t.make pub ITree.empty PTree.empty 1\"\n\nfun globalenv :: \"('f, 'v) program \\ ('f, 'v) Genv_t\" where\n \"globalenv p = add_globals (empty_genv (prog_public p)) (prog_defs p)\"\n\nsubsection \\Coercing a global environment into a symbol environment\\\n\nfun to_senv :: \"('f, 'v) Genv_t \\ Senv_t\" where\n \"to_senv ge =\n Senv_t.make\n (Genv'.find_symbol ge)\n (Genv'.public_symbol ge)\n (Genv'.invert_symbol ge)\n (Genv'.block_is_volatile ge)\n (genv_next ge)\"\n\nlemma to_senv_invars:\n assumes \"Genv'.invariants ge\"\n shows \"Senv.invariants (to_senv ge)\"\n using assms\n unfolding Genv'.inv_def Senv.inv_def\n by (auto simp add: Senv_t.defs the_equality split: option.split)\n\nsection \\Construction of the initial memory state\\\n\ncontext\n fixes ge :: \"('f, 'v) Genv_t\"\nbegin\n\nfun store_init_data :: \"mem \\ block \\ Z \\ init_data \\ (mem option)\" where\n \"store_init_data m b p ident =\n (case ident of\n Init_int8 n \\ Mem.store Mint8unsigned m b p (Vint n)\n | Init_int16 n \\ Mem.store Mint16unsigned m b p (Vint n)\n | Init_int32 n \\ Mem.store Mint32 m b p (Vint n)\n | Init_int64 n \\ Mem.store Mint64 m b p (Vlong n)\n | Init_float32 n \\ Mem.store Mfloat32 m b p (Vsingle n)\n | Init_float64 n \\ Mem.store Mfloat64 m b p (Vfloat n)\n | Init_addrof symb ofs \\\n (case Genv'.find_symbol ge symb of\n None \\ None\n | Some b' \\ Mem.store Mptr m b p (Vptr b' ofs)\n )\n | Init_space n \\ Some m\n )\"\n\nfun store_init_data_list :: \"mem \\ block \\ Z \\ (init_data list) \\ (mem option)\" where\n \"store_init_data_list m b p idl =\n (case idl of\n [] \\ Some m\n | ident # idl' \\\n (case store_init_data m b p ident of\n None \\ None\n | Some m' \\ store_init_data_list m' b (p + init_data_size ident) idl'\n )\n )\"\n\nfun perm_globvar :: \"('v globvar) \\ permission\" where\n \"perm_globvar gv =\n (if (gvar_volatile gv) then Nonempty\n else if (gvar_readonly gv) then Readable\n else Writable)\"\n\nfun alloc_global :: \"mem \\ (ident * ('f, 'v) globdef) \\ (mem option)\" where\n \"alloc_global m idg =\n (case idg of\n (ident, Gfun f) \\\n let (m1, b) = Mem.alloc m 0 1 in\n Mem.drop_perm m1 b 0 1 Nonempty\n | (ident, Gvar v) \\\n let init = (gvar_init v) in\n let sz = init_data_list_size init in\n let (m1, b) = Mem.alloc m 0 sz in\n (case store_zeros m1 b 0 sz of\n None \\ None\n | Some m2 \\\n (case store_init_data_list m2 b 0 init of\n None \\ None\n | Some m3 \\ Mem.drop_perm m3 b 0 sz (perm_globvar v)\n )\n )\n )\"\n\nfun alloc_globals :: \"mem \\ ((ident * ('f, 'v) globdef) list) \\ (mem option)\" where\n \"alloc_globals m gl =\n (case gl of\n [] \\ Some m\n | g # gl' \\\n (case alloc_global m g of\n None \\ None\n | Some m' \\ alloc_globals m' gl'\n )\n )\"\nend\n\nfun init_mem :: \"('f, 'v) program \\ (mem option)\" where\n \"init_mem p = alloc_globals (Genv'.globalenv p) Mem.empty (prog_defs p)\"\n\nlemmas simps = find_symbol.simps symbol_address.simps public_symbol.simps find_def.simps\n find_funct_ptr.simps find_funct.simps invert_symbol.simps find_var_info.simps\n block_is_volatile.simps add_global.simps add_globals.simps empty_genv.simps globalenv.simps\n to_senv.simps store_init_data.simps store_init_data_list.simps perm_globvar.simps\n alloc_global.simps alloc_globals.simps init_mem.simps\n\nsection \\Check invariants\\\n\ncontext\n notes [simp] = Genv'.inv_def Genv_t.defs\nbegin\n\nlemma empty_inv: \"invariants (empty_genv pub)\"\n by auto\n\nlemma add_global_inv:\n \"invariants ge \\ add_global ge (ident, gdef) = ge' \\ invariants ge'\"\nproof (goal_cases)\n case 1\n\n let ?nb = \"genv_next ge\"\n\n {\n fix id b\n\n have \"ITree.get id (genv_symb ge') = Some b \\ b < (genv_next ge')\"\n apply (cases \"id = ident\")\n using 1 pos_less_trans\n by auto\n }\n\n note all = this\n\n {\n fix b g\n\n have \"PTree.get b (genv_defs ge') = Some g \\ b < (genv_next ge')\"\n apply (cases \"b = ?nb\")\n using 1 pos_less_trans\n by auto\n }\n\n note all = all this\n\n {\n fix id1 id2 b\n\n have \"ITree.get id1 (genv_symb ge') = Some b \\ ITree.get id2 (genv_symb ge') = Some b \\ id1 = id2\"\n apply (cases \"id1 = ident\"; cases \"id2 = ident\")\n using 1 apply auto\n by blast+\n }\n\n note all = all this\n\n then show ?case\n by simp\nqed\n\nlemma add_globals_inv:\n \"invariants ge \\ add_globals ge gl = ge' \\ invariants ge'\"\n apply (induction gl arbitrary: ge ge')\n apply simp\n using add_global_inv\n by (metis add_global.cases add_globals.simps foldl_Cons)\n\nlemma globalenv_inv:\n \"invariants ge \\ globalenv p = ge' \\ invariants ge'\"\n by (metis empty_inv add_globals_inv globalenv.simps)\n\nend\nend\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/compcert/Globalenvs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27960495277831177}} {"text": "section \\Binary compositionality theorem\\\n\ntext \\This theory provides the binary version of\nthe compositionality theorem for BD security.\nIt corresponds to Theorem 1 from \\<^cite>\\\"cosmedis-SandP2017\"\\\nand to Theorem 5 (the System Compositionality Theorem) from\n\\<^cite>\\\"BDsecurity-ITP2021\"\\.\n\\\n\ntheory Composing_Security\n imports Bounded_Deducibility_Security.BD_Security_TS\nbegin\n\n(* Preliminaries *)\n\n\nlemma list2_induct[case_names NilNil Cons1 Cons2]:\nassumes NN: \"P [] []\"\nand CN: \"\\x xs ys. P xs ys \\ P (x # xs) ys\"\nand NC: \"\\xs y ys. P xs ys \\ P xs (y # ys)\"\nshows \"P xs ys\"\nproof (induction xs)\n case Nil show ?case using NN NC by (induction ys) auto next\n case (Cons x xs) then show ?case using CN by auto\nqed\n\nlemma list22_induct[case_names NilNil ConsNil NilCons ConsCons]:\nassumes NN: \"P [] []\"\nand CN: \"\\x xs. P xs [] \\ P (x # xs) []\"\nand NC: \"\\y ys. P [] ys \\ P [] (y # ys)\"\nand CC: \"\\x xs y ys.\n P xs ys \\\n (\\ ys'. length ys' \\ Suc (length ys) \\ P xs ys') \\\n (\\ xs'. length xs' \\ Suc (length xs) \\ P xs' ys) \\\n P (x # xs) (y # ys)\"\nshows \"P xs ys\"\nproof (induction rule: measure_induct2[of \"\\xs ys. length xs + length ys\", case_names IH])\n case (IH xs ys) with assms show ?case by (cases xs; cases ys) auto\nqed\n\n\ncontext BD_Security_TS begin\n\ndeclare O_append[simp]\ndeclare V_append[simp]\ndeclare validFrom_Cons[simp]\ndeclare validFrom_append[simp]\n\ndeclare list_all_O_map[simp]\ndeclare never_O_Nil[simp]\ndeclare list_all_V_map[simp]\ndeclare never_V_Nil[simp]\n\nend (* BD_Security_NIO_Aut *)\n\n\nlocale Abstract_BD_Security_Comp =\n One: Abstract_BD_Security validSystemTraces1 V1 O1 B1 TT1 +\n Two: Abstract_BD_Security validSystemTraces2 V2 O2 B2 TT2 +\n Comp?: Abstract_BD_Security validSystemTraces V O B TT (* Note: the \"Comp\" prefix will be optional *)\nfor\n validSystemTraces1 :: \"'traces1 \\ bool\"\n and\n V1 :: \"'traces1 \\ 'values1\" and O1 :: \"'traces1 \\ 'observations1\"\n and\n TT1 :: \"'traces1 \\ bool\"\n and\n B1 :: \"'values1 \\ 'values1 \\ bool\"\n and\n(* *)\n validSystemTraces2 :: \"'traces2 \\ bool\"\n and\n V2 :: \"'traces2 \\ 'values2\" and O2 :: \"'traces2 \\ 'observations2\"\n and\n TT2 :: \"'traces2 \\ bool\"\n and\n B2 :: \"'values2 \\ 'values2 \\ bool\"\n and\n (* *)\n validSystemTraces :: \"'traces \\ bool\"\n and\n V :: \"'traces \\ 'values\" and O :: \"'traces \\ 'observations\"\n and\n TT :: \"'traces \\ bool\"\n and\n B :: \"'values \\ 'values \\ bool\"\n+\nfixes\n comp :: \"'traces1 \\ 'traces2 \\ 'traces \\ bool\"\n and\n compO :: \"'observations1 \\ 'observations2 \\ 'observations \\ bool\"\n and\n compV :: \"'values1 \\ 'values2 \\ 'values \\ bool\"\nassumes\nvalidSystemTraces:\n\"\\ tr. validSystemTraces tr \\\n (\\ tr1 tr2. validSystemTraces1 tr1 \\ validSystemTraces2 tr2 \\ comp tr1 tr2 tr)\"\nand\nV_comp:\n\"\\ tr1 tr2 tr.\n validSystemTraces1 tr1 \\ validSystemTraces2 tr2 \\ comp tr1 tr2 tr\n \\ compV (V1 tr1) (V2 tr2) (V tr)\"\nand\nO_comp:\n\"\\ tr1 tr2 tr.\n validSystemTraces1 tr1 \\ validSystemTraces2 tr2 \\ comp tr1 tr2 tr\n \\ compO (O1 tr1) (O2 tr2) (O tr)\"\nand\nTT_comp:\n\"\\ tr1 tr2 tr.\n validSystemTraces1 tr1 \\ validSystemTraces2 tr2 \\ comp tr1 tr2 tr\n \\ TT tr \\ TT1 tr1 \\ TT2 tr2\"\nand\nB_comp:\n\"\\ vl1 vl2 vl vl'.\n compV vl1 vl2 vl \\ B vl vl'\n \\ \\ vl1' vl2'. compV vl1' vl2' vl' \\ B1 vl1 vl1' \\ B2 vl2 vl2'\"\nand\nO_V_comp:\n\"\\ tr1 tr2 vl ol.\n validSystemTraces1 tr1 \\ validSystemTraces2 tr2 \\\n compV (V1 tr1) (V2 tr2) vl \\ compO (O1 tr1) (O2 tr2) ol\n \\ \\ tr. validSystemTraces tr \\ O tr = ol \\ V tr = vl\"\nbegin\n\nabbreviation secure where \"secure \\ Comp.secure\"\nabbreviation secure1 where \"secure1 \\ One.secure\"\nabbreviation secure2 where \"secure2 \\ Two.secure\"\n\ntheorem secure1_secure2_secure:\nassumes s1: secure1 and s2: secure2\nshows secure\nunfolding secure_def proof clarify\n fix tr vl vl'\n assume v: \"validSystemTraces tr\" and T: \"TT tr\" and B: \"B (V tr) vl'\"\n then obtain tr1 tr2 where v1: \"validSystemTraces1 tr1\" and v2: \"validSystemTraces2 tr2\"\n and tr: \"comp tr1 tr2 tr\" using validSystemTraces by blast\n have T1: \"TT1 tr1\" and T2: \"TT2 tr2\" using TT_comp[OF v1 v2 tr T] by auto\n have Vtr: \"compV (V1 tr1) (V2 tr2) (V tr)\" using V_comp[OF v1 v2 tr] .\n have Otr: \"compO (O1 tr1) (O2 tr2) (O tr)\" using O_comp[OF v1 v2 tr] .\n obtain vl1' vl2' where vl': \"compV vl1' vl2' vl'\" and\n B1: \"B1 (V1 tr1) vl1'\" and B2: \"B2 (V2 tr2) vl2'\" using B_comp[OF Vtr B] by auto\n obtain tr1' where v1': \"validSystemTraces1 tr1'\" and O1: \"O1 tr1 = O1 tr1'\" and vl1': \"vl1' = V1 tr1'\"\n using s1 v1 T1 B1 unfolding One.secure_def by fastforce\n obtain tr2' where v2': \"validSystemTraces2 tr2'\" and O2: \"O2 tr2 = O2 tr2'\" and vl2': \"vl2' = V2 tr2'\"\n using s2 v2 T2 B2 unfolding Two.secure_def by fastforce\n obtain tr' where \"validSystemTraces tr' \\ O tr' = O tr \\ V tr' = vl'\"\n using O_V_comp[OF v1' v2' vl'[unfolded vl1' vl2'] Otr[unfolded O1 O2]] by auto\n thus \"\\tr'. validSystemTraces tr' \\ O tr' = O tr \\ V tr' = vl'\" by auto\nqed\n\nend (* context BD_Security_Comp *)\n\n\ntype_synonym ('state1,'state2) cstate = \"'state1 \\ 'state2\"\ndatatype ('state1,'trans1,'state2,'trans2) ctrans = Trans1 'state2 'trans1 | Trans2 'state1 'trans2 | CTrans 'trans1 'trans2\ndatatype ('obs1,'obs2) cobs = Obs1 'obs1 | Obs2 'obs2 | CObs 'obs1 'obs2\ndatatype ('value1,'value2) \"cvalue\" = isValue1: Value1 'value1 | isValue2: Value2 'value2 | isCValue: CValue 'value1 'value2\n\n\nlocale BD_Security_TS_Comp =\n One: BD_Security_TS istate1 validTrans1 srcOf1 tgtOf1 \\1 f1 \\1 g1 T1 B1 +\n Two: BD_Security_TS istate2 validTrans2 srcOf2 tgtOf2 \\2 f2 \\2 g2 T2 B2\nfor\n istate1 :: \"'state1\" and validTrans1 :: \"'trans1 \\ bool\"\n and\n srcOf1 :: \"'trans1 \\ 'state1\" and tgtOf1 :: \"'trans1 \\ 'state1\"\n and\n \\1 :: \"'trans1 \\ bool\" and f1 :: \"'trans1 \\ 'value1\"\n and\n \\1 :: \"'trans1 \\ bool\" and g1 :: \"'trans1 \\ 'obs1\"\n and\n T1 :: \"'trans1 \\ bool\" and B1 :: \"'value1 list \\ 'value1 list \\ bool\"\n and\n (* *)\n istate2 :: \"'state2\" and validTrans2 :: \"'trans2 \\ bool\"\n and\n srcOf2 :: \"'trans2 \\ 'state2\" and tgtOf2 :: \"'trans2 \\ 'state2\"\n and\n \\2 :: \"'trans2 \\ bool\" and f2 :: \"'trans2 \\ 'value2\"\n and\n \\2 :: \"'trans2 \\ bool\" and g2 :: \"'trans2 \\ 'obs2\"\n and\n T2 :: \"'trans2 \\ bool\" and B2 :: \"'value2 list \\ 'value2 list \\ bool\"\n+\nfixes (* An identification of the communication transitions and of the synchronization predicate: *)\n isCom1 :: \"'trans1 \\ bool\" and isCom2 :: \"'trans2 \\ bool\"\nand\n sync :: \"'trans1 \\ 'trans2 \\ bool\"\nand\n isComV1 :: \"'value1 \\ bool\" and isComV2 :: \"'value2 \\ bool\"\nand\n syncV :: \"'value1 \\ 'value2 \\ bool\"\nand\n isComO1 :: \"'obs1 \\ bool\" and isComO2 :: \"'obs2 \\ bool\"\nand\n syncO :: \"'obs1 \\ 'obs2 \\ bool\"\n(* *)\nassumes\n isCom1_isComV1: \"\\ trn1. validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\ \\1 trn1 \\ isCom1 trn1 \\ isComV1 (f1 trn1)\"\nand\n isCom1_isComO1: \"\\ trn1. validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\ \\1 trn1 \\ isCom1 trn1 \\ isComO1 (g1 trn1)\"\nand\n isCom2_isComV2: \"\\ trn2. validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\ \\2 trn2 \\ isCom2 trn2 \\ isComV2 (f2 trn2)\"\nand\n isCom2_isComO2: \"\\ trn2. validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\ \\2 trn2 \\ isCom2 trn2 \\ isComO2 (g2 trn2)\"\nand\n sync_syncV:\n \"\\ trn1 trn2.\n validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\\n validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\\n isCom1 trn1 \\ isCom2 trn2 \\ \\1 trn1 \\ \\2 trn2 \\\n sync trn1 trn2 \\ syncV (f1 trn1) (f2 trn2)\"\nand\n sync_syncO:\n \"\\ trn1 trn2.\n validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\\n validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\\n isCom1 trn1 \\ isCom2 trn2 \\ \\1 trn1 \\ \\2 trn2 \\\n sync trn1 trn2 \\ syncO (g1 trn1) (g2 trn2)\"\nand\n sync_\\1_\\2:\n \"\\ trn1 trn2.\n validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\\n validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\\n isCom1 trn1 \\ isCom2 trn2 \\\n sync trn1 trn2 \\ \\1 trn1 \\ \\2 trn2\"\nand\n sync_\\_\\:\n\"\\ trn1 trn2.\n validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\\n validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\\n isCom1 trn1 \\ isCom2 trn2 \\\n \\1 trn1 \\ \\2 trn2 \\\n syncO (g1 trn1) (g2 trn2) \\\n (\\1 trn1 \\ \\2 trn2 \\ syncV (f1 trn1) (f2 trn2))\n \\\n sync trn1 trn2\"\nand (* Every communication is observable (which does not mean that everything in\n a communication is observable!): *)\n isCom1_\\1: \"\\ trn1. validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\ isCom1 trn1 \\ \\1 trn1\"\nand\n isCom2_\\2: \"\\ trn2. validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\ isCom2 trn2 \\ \\2 trn2\"\nand (* Lack of symmetry here: all the value-producing transitions of the second component\n need to be \"communicating\" (and hence proceed only synchronously) -- Technically, this tames shuffling...\n This restriction means that the only component that produces secrets is the first component -- the\n second component only receives secrets. *)\n isCom2_V2: \"\\ trn2. validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\ \\2 trn2 \\ isCom2 trn2\"\nand (* Added dummy assumption about the locale data not involved in any assumption: *)\n Dummy: \"istate1 = istate1 \\ srcOf1 = srcOf1 \\ tgtOf1 = tgtOf1 \\ T1 = T1 \\ B1 = B1 \\\n istate2 = istate2 \\ srcOf2 = srcOf2 \\ tgtOf2 = tgtOf2 \\ T2 = T2 \\ B2 = B2\"\nbegin\n\nlemma sync_\\1_\\2:\n \"\\ trn1 trn2.\n validTrans1 trn1 \\ One.reach (srcOf1 trn1) \\\n validTrans2 trn2 \\ Two.reach (srcOf2 trn2) \\\n isCom1 trn1 \\ isCom2 trn2 \\\n sync trn1 trn2 \\ \\1 trn1 \\ \\2 trn2\"\nusing isCom1_\\1 isCom2_\\2\nby auto\n\n\ndefinition icstate where \"icstate = (istate1,istate2)\"\n\nfun validTrans :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ bool\" where\n \"validTrans(Trans1 s2 trn1) = (validTrans1 trn1 \\ \\ isCom1 trn1)\"\n|\"validTrans (Trans2 s1 trn2) = (validTrans2 trn2 \\ \\ isCom2 trn2)\"\n|\"validTrans (CTrans trn1 trn2) =\n (validTrans1 trn1 \\ validTrans2 trn2 \\ isCom1 trn1 \\ isCom2 trn2 \\ sync trn1 trn2)\"\n\nfun srcOf :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ 'state1 \\ 'state2\" where\n \"srcOf (Trans1 s2 trn1) = (srcOf1 trn1, s2)\"\n|\"srcOf (Trans2 s1 trn2) = (s1, srcOf2 trn2)\"\n|\"srcOf (CTrans trn1 trn2) = (srcOf1 trn1, srcOf2 trn2)\"\n\nfun tgtOf :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ 'state1 \\ 'state2\" where\n \"tgtOf (Trans1 s2 trn1) = (tgtOf1 trn1, s2)\"\n|\"tgtOf (Trans2 s1 trn2) = (s1, tgtOf2 trn2)\"\n|\"tgtOf (CTrans trn1 trn2) = (tgtOf1 trn1, tgtOf2 trn2)\"\n\nfun \\ :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ bool\" where\n \"\\ (Trans1 s2 trn1) = \\1 trn1\"\n|\"\\ (Trans2 s1 trn2) = \\2 trn2\"\n|\"\\ (CTrans trn1 trn2) = (\\1 trn1 \\ \\2 trn2)\"\n\nfun f :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ ('value1,'value2) cvalue\" where\n \"f (Trans1 s2 trn1) = Value1 (f1 trn1)\"\n|\"f (Trans2 s1 trn2) = Value2 (f2 trn2)\"\n|\"f (CTrans trn1 trn2) = CValue (f1 trn1) (f2 trn2)\"\n\nfun \\ :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ bool\" where\n \"\\ (Trans1 s2 trn1) = \\1 trn1\"\n|\"\\ (Trans2 s1 trn2) = \\2 trn2\"\n|\"\\ (CTrans trn1 trn2) = (\\1 trn1 \\ \\2 trn2)\"\n\nfun g :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ ('obs1,'obs2) cobs\" where\n \"g (Trans1 s2 trn1) = Obs1 (g1 trn1)\"\n|\"g (Trans2 s1 trn2) = Obs2 (g2 trn2)\"\n|\"g (CTrans trn1 trn2) = CObs (g1 trn1) (g2 trn2)\"\n\nfun T :: \"('state1, 'trans1, 'state2, 'trans2) ctrans \\ bool\"\nwhere\n\"T (Trans1 s2 trn1) = T1 trn1\"\n|\n\"T (Trans2 s1 trn2) = T2 trn2\"\n|\n\"T (CTrans trn1 trn2) = (T1 trn1 \\ T2 trn2)\"\n\ninductive compV :: \"'value1 list \\ 'value2 list \\ ('value1, 'value2) cvalue list \\ bool\"\nwhere\n Nil[intro!,simp]: \"compV [] [] []\"\n|Step1[intro]:\n\"compV vl1 vl2 vl \\ \\ isComV1 v1\n \\ compV (v1 # vl1) vl2 (Value1 v1 # vl)\"\n|Step2[intro]:\n\"compV vl1 vl2 vl \\ \\ isComV2 v2\n \\ compV vl1 (v2 # vl2) (Value2 v2 # vl)\"\n|Com[intro]:\n\"compV vl1 vl2 vl \\ isComV1 v1 \\ isComV2 v2 \\ syncV v1 v2\n \\ compV (v1 # vl1) (v2 # vl2) (CValue v1 v2 # vl)\"\n\nlemma compV_cases_V[consumes 3, case_names Nil Step1 Com]:\nassumes v: \"Two.validFrom s2 tr2\"\nand c: \"compV vl1 (Two.V tr2) vl\"\nand rs2: \"Two.reach s2\"\nand Nil: \"vl1 = [] \\ Two.V tr2 = [] \\ vl = [] \\ P\"\nand Step1:\n\"\\vll1 vll2 vll v1.\n vl1 = v1 # vll1 \\\n Two.V tr2 = vll2 \\\n vl = Value1 v1 # vll \\\n compV vll1 vll2 vll \\ \\ isComV1 v1 \\ P\"\nand Com:\n\"\\vll1 vll2 vll v1 v2.\n vl1 = v1 # vll1 \\\n Two.V tr2 = v2 # vll2 \\\n vl = CValue v1 v2 # vll \\\n compV vll1 vll2 vll \\\n isComV1 v1 \\ isComV2 v2 \\ syncV v1 v2 \\ P\"\nshows P\nusing c proof cases\n case (Step2 vll2 vll1 v2)\n obtain tr2a trn2 tr2b where tr2: \"tr2 = tr2a @ trn2 # tr2b\" and\n \\2: \"\\2 trn2\" and f2: \"f2 trn2 = v2\"\n using \\Two.V tr2 = v2 # vll2\\ by (metis Two.V_eq_Cons append_Cons)\n have v2: \"validTrans2 trn2\" using tr2 v\n by (metis Nil_is_append_conv Two.validFrom_def Two.valid_ConsE\n Two.valid_append list.distinct(2) self_append_conv2)\n have rs2': \"Two.reach (srcOf2 trn2)\" using v rs2 unfolding tr2\n by (induction tr2a arbitrary: s2) (auto intro: Two.reach.Step)\n then have False using isCom2_V2[OF v2 rs2' \\2] \\\\ isComV2 v2\\\n using \\2 f2 isCom2_isComV2 v2 by blast\n thus ?thesis by simp\nqed (insert assms, auto)\n\n\ninductive compO :: \"'obs1 list \\ 'obs2 list \\ ('obs1, 'obs2) cobs list \\ bool\"\nwhere\n Nil[intro!,simp]: \"compO [] [] []\"\n|Step1[intro]:\n\"compO ol1 ol2 ol \\ \\ isComO1 o1\n \\ compO (o1 # ol1) ol2 (Obs1 o1 # ol)\"\n|Step2[intro]:\n\"compO ol1 ol2 ol \\ \\ isComO2 o2\n \\ compO ol1 (o2 # ol2) (Obs2 o2 # ol)\"\n|Com[intro]:\n\"compO ol1 ol2 ol \\ isComO1 o1 \\ isComO2 o2 \\ syncO o1 o2\n \\ compO (o1 # ol1) (o2 # ol2) (CObs o1 o2 # ol)\"\n\ndefinition B :: \"('value1,'value2) cvalue list \\ ('value1,'value2) cvalue list \\ bool\" where\n\"B vl vl' \\ \\ vl1 vl2. compV vl1 vl2 vl \\\n (\\ vl1' vl2'. compV vl1' vl2' vl' \\ B1 vl1 vl1' \\ B2 vl2 vl2')\"\n\ninductive ccomp ::\n\"'state1 \\ 'state2 \\ 'trans1 trace \\ 'trans2 trace \\\n ('state1, 'trans1, 'state2, 'trans2) ctrans trace \\ bool\"\nwhere\nNil[simp,intro!]: \"ccomp s1 s2 [] [] []\"\n|\nStep1[intro]:\n\"ccomp (tgtOf1 trn1) s2 tr1 tr2 tr \\ \\ isCom1 trn1 \\\n ccomp (srcOf1 trn1) s2 (trn1 # tr1) tr2 (Trans1 s2 trn1 # tr)\"\n|\nStep2[intro]:\n\"ccomp s1 (tgtOf2 trn2) tr1 tr2 tr \\ \\ isCom2 trn2 \\\n ccomp s1 (srcOf2 trn2) tr1 (trn2 # tr2) (Trans2 s1 trn2 # tr)\"\n|\nCom[intro]:\n\"ccomp (tgtOf1 trn1) (tgtOf2 trn2) tr1 tr2 tr \\\n isCom1 trn1 \\ isCom2 trn2 \\ sync trn1 trn2 \\\n ccomp (srcOf1 trn1) s2 (trn1 # tr1) (trn2 # tr2) (CTrans trn1 trn2 # tr)\"\n\n\ndefinition comp where \"comp \\ ccomp istate1 istate2\"\n\nend (* context BD_Security_TS_Comp *)\n\nsublocale BD_Security_TS_Comp \\ BD_Security_TS icstate validTrans srcOf tgtOf \\ f \\ g T B .\n\ncontext BD_Security_TS_Comp\nbegin\n\nlemma valid:\nassumes \"valid tr\" and \"srcOf (hd tr) = (s1,s2)\"\nshows\n\"\\tr1 tr2.\n One.validFrom s1 tr1 \\ Two.validFrom s2 tr2 \\\n ccomp s1 s2 tr1 tr2 tr\"\nusing assms proof(induction arbitrary: s1 s2)\n case (Singl trn)\n show ?case proof(cases trn)\n case (Trans1 s22 trn1)\n show ?thesis using Singl unfolding Trans1\n by (intro exI[of _ \"[trn1]\"] exI[of _ \"[]\"]) auto\n next\n case (Trans2 s11 trn2)\n show ?thesis using Singl unfolding Trans2\n by (intro exI[of _ \"[]::'trans1 trace\"] exI[of _ \"[trn2]\"]) auto\n next\n case (CTrans trn1 trn2)\n show ?thesis using Singl unfolding CTrans\n by (intro exI[of _ \"[trn1]\"] exI[of _ \"[trn2]\"]) auto\n qed\nnext\n case (Cons trn tr)\n show ?case proof(cases trn)\n case (Trans1 s22 trn1)\n let ?s1 = \"tgtOf1 trn1\"\n have s22[simp]: \"s22 = s2\" using \\srcOf (hd (trn # tr)) = (s1, s2)\\\n unfolding Trans1 by simp\n hence \"tgtOf trn = (?s1, s2)\" unfolding Trans1 by simp\n hence \"srcOf (hd tr) = (?s1, s2)\" using Cons.hyps(2) by auto\n from Cons.IH[OF this] obtain tr1 tr2 where\n 1: \"One.validFrom ?s1 tr1 \\ Two.validFrom s2 tr2 \\\n ccomp ?s1 s2 tr1 tr2 tr\" by auto\n show ?thesis using Cons.prems Cons.hyps 1 unfolding Trans1\n by (intro exI[of _ \"trn1 # tr1\"] exI[of _ \"tr2\"], cases tr2) auto\n next\n case (Trans2 s11 trn2)\n let ?s2 = \"tgtOf2 trn2\"\n have s11[simp]: \"s11 = s1\" using \\srcOf (hd (trn # tr)) = (s1, s2)\\\n unfolding Trans2 by simp\n hence \"tgtOf trn = (s1, ?s2)\" unfolding Trans2 by simp\n hence \"srcOf (hd tr) = (s1, ?s2)\" using Cons.hyps(2) by auto\n from Cons.IH[OF this] obtain tr1 tr2 where\n 1: \"One.validFrom s1 tr1 \\ Two.validFrom ?s2 tr2 \\\n ccomp s1 ?s2 tr1 tr2 tr\" by auto\n show ?thesis using Cons.prems Cons.hyps 1 unfolding Trans2\n by (intro exI[of _ \"tr1\"] exI[of _ \"trn2 # tr2\"], cases tr1) auto\n next\n case (CTrans trn1 trn2)\n let ?s1 = \"tgtOf1 trn1\" let ?s2 = \"tgtOf2 trn2\"\n have \"tgtOf trn = (?s1, ?s2)\" unfolding CTrans by simp\n hence \"srcOf (hd tr) = (?s1, ?s2)\" using Cons.hyps(2) by auto\n from Cons.IH[OF this] obtain tr1 tr2 where\n 1: \"One.validFrom ?s1 tr1 \\ Two.validFrom ?s2 tr2 \\\n ccomp ?s1 ?s2 tr1 tr2 tr\" by auto\n show ?thesis using Cons.prems Cons.hyps 1 unfolding CTrans\n by (intro exI[of _ \"trn1 # tr1\"] exI[of _ \"trn2 # tr2\"], cases tr2) auto\n qed\nqed\n\nlemma validFrom:\nassumes \"validFrom icstate tr\"\nshows \"\\tr1 tr2. One.validFrom istate1 tr1 \\ Two.validFrom istate2 tr2 \\ comp tr1 tr2 tr\"\nusing assms valid unfolding comp_def icstate_def validFrom_def by(cases tr) fastforce+\n\nlemma reach_reach12:\nassumes \"reach s\"\nobtains \"One.reach (fst s)\" and \"Two.reach (snd s)\"\nusing assms proof (induction rule: reach.induct)\n case Istate\n then show thesis using One.reach.Istate Two.reach.Istate unfolding icstate_def by auto\nnext\n case (Step s trn s')\n then show thesis\n using One.reach.Step[of \"fst s\" _ \"fst s'\"] Two.reach.Step[of \"snd s\" _ \"snd s'\"]\n by (auto elim: validTrans.elims)\nqed\n\nlemma compV_ccomp:\nassumes v: \"One.validFrom s1 tr1\" \"Two.validFrom s2 tr2\"\nand c: \"ccomp s1 s2 tr1 tr2 tr\"\nand rs1: \"One.reach s1\" and rs2: \"Two.reach s2\"\nshows \"compV (One.V tr1) (Two.V tr2) (V tr)\"\nusing c v rs1 rs2 proof(induction)\n case (Step1 trn1 s2 tr1 tr2 tr)\n moreover then have \"One.reach (tgtOf1 trn1)\"\n using One.reach.Step[of \"srcOf1 trn1\" trn1 \"tgtOf1 trn1\"] by auto\n ultimately show ?case by (cases \"\\1 trn1\") (auto simp: isCom1_isComV1)\nnext\n case (Step2 s1 trn2 tr1 tr2 tr)\n moreover then have \"Two.reach (tgtOf2 trn2)\"\n using Two.reach.Step[of \"srcOf2 trn2\" trn2 \"tgtOf2 trn2\"] by auto\n ultimately show ?case by (cases \"\\2 trn2\") (auto simp: isCom2_isComV2)\nnext\n case (Com trn1 trn2 tr1 tr2 tr s2)\n moreover then have \"One.reach (tgtOf1 trn1)\" \"Two.reach (tgtOf2 trn2)\"\n using One.reach.Step[of \"srcOf1 trn1\" trn1 \"tgtOf1 trn1\"]\n Two.reach.Step[of \"srcOf2 trn2\" trn2 \"tgtOf2 trn2\"]\n by auto\n ultimately show ?case\n by (cases \"\\1 trn1\"; cases \"\\2 trn2\"; simp add: isCom1_isComV1 isCom2_isComV2)\n (use sync_\\1_\\2 sync_syncV Com in auto)\nqed auto\n\nlemma compV:\nassumes \"One.validFrom istate1 tr1\" and \"Two.validFrom istate2 tr2\"\nand \"comp tr1 tr2 tr\"\nshows \"compV (One.V tr1) (Two.V tr2) (V tr)\"\nusing compV_ccomp assms One.reach.Istate Two.reach.Istate unfolding comp_def by auto\n\nlemma compO_ccomp:\nassumes v: \"One.validFrom s1 tr1\" \"Two.validFrom s2 tr2\"\nand c: \"ccomp s1 s2 tr1 tr2 tr\"\nand rs1: \"One.reach s1\" and rs2: \"Two.reach s2\"\nshows \"compO (One.O tr1) (Two.O tr2) (O tr)\"\nusing c v rs1 rs2 proof(induction)\n case (Step1 trn1 s2 tr1 tr2 tr)\n moreover then have \"One.reach (tgtOf1 trn1)\"\n using One.reach.Step[of \"srcOf1 trn1\" trn1 \"tgtOf1 trn1\"] by auto\n ultimately show ?case by (cases \"\\1 trn1\") (auto simp: isCom1_isComO1)\nnext\n case (Step2 s1 trn2 tr1 tr2 tr)\n moreover then have \"Two.reach (tgtOf2 trn2)\"\n using Two.reach.Step[of \"srcOf2 trn2\" trn2 \"tgtOf2 trn2\"] by auto\n ultimately show ?case by (cases \"\\2 trn2\") (auto simp: isCom2_isComO2)\nnext\n case (Com trn1 trn2 tr1 tr2 tr s2)\n moreover then have \"One.reach (tgtOf1 trn1)\" \"Two.reach (tgtOf2 trn2)\"\n using One.reach.Step[of \"srcOf1 trn1\" trn1 \"tgtOf1 trn1\"]\n Two.reach.Step[of \"srcOf2 trn2\" trn2 \"tgtOf2 trn2\"]\n by auto\n ultimately show ?case\n by (cases \"\\1 trn1\"; cases \"\\2 trn2\"; simp add: isCom1_isComO1 isCom2_isComO2)\n (use sync_\\1_\\2 sync_syncO Com in auto)\nqed auto\n\nlemma compO:\nassumes \"One.validFrom istate1 tr1\" and \"Two.validFrom istate2 tr2\"\nand \"comp tr1 tr2 tr\"\nshows \"compO (One.O tr1) (Two.O tr2) (O tr)\"\nusing compO_ccomp assms One.reach.Istate Two.reach.Istate unfolding comp_def by auto\n\nlemma T_ccomp:\nassumes v: \"One.validFrom s1 tr1\" \"Two.validFrom s2 tr2\"\nand c: \"ccomp s1 s2 tr1 tr2 tr\" and n: \"never T tr\"\nshows \"never T1 tr1 \\ never T2 tr2\"\nusing c n v by (induction) auto\n\nlemma T:\nassumes \"One.validFrom istate1 tr1\" and \"Two.validFrom istate2 tr2\"\nand \"comp tr1 tr2 tr\" and \"never T tr\"\nshows \"never T1 tr1 \\ never T2 tr2\"\nusing T_ccomp assms unfolding comp_def by auto\n\nlemma B:\nassumes \"compV vl1 vl2 vl\" and \"B vl vl'\"\nshows \"\\vl1' vl2'. compV vl1' vl2' vl' \\ B1 vl1 vl1' \\ B2 vl2 vl2'\"\nusing assms unfolding B_def by auto\n\nlemma pullback_O_V_aux:\nassumes \"One.validFrom s1 tr1\" \"Two.validFrom s2 tr2\"\nand \"One.reach s1\" \"Two.reach s2\"\nand \"compV (One.V tr1) (Two.V tr2) vl\"\nand \"compO (One.O tr1) (Two.O tr2) obl\"\nshows \"\\tr. validFrom (s1,s2) tr \\ O tr = obl \\ V tr = vl\"\nusing assms proof(induction tr1 tr2 arbitrary: s1 s2 vl obl rule: list22_induct)\n case (NilNil s1 s2 vl obl)\n thus ?case by (intro exI[of _ \"[]\"]) (auto elim: compV.cases compO.cases)\nnext\n case (ConsNil trn1 tr1 s1 s2 vl obl)\n let ?s1 = \"tgtOf1 trn1\"\n have trn1: \"validTrans1 trn1\" and tr1: \"One.validFrom ?s1 tr1\"\n and s1: \"srcOf1 trn1 = s1\" \"One.reach s1\" and rs2: \"Two.reach s2\" using ConsNil.prems by auto\n then have rs1': \"One.reach ?s1\" by (intro One.reach.Step[of s1 trn1 ?s1]) auto\n show ?case proof(cases \"isCom1 trn1\")\n case True note com1 = True\n hence \\1: \"\\1 trn1\" using trn1 isCom1_\\1 s1 by auto\n hence \"isComO1 (g1 trn1)\" using \\1 com1 s1 isCom1_isComO1 trn1 by blast\n hence False using \\compO (One.O (trn1 # tr1)) (Two.O []) obl\\\n using \\1 by (auto elim: compO.cases)\n thus ?thesis by simp\n next\n case False note com1 = False\n show ?thesis proof(cases \"\\1 trn1\")\n case True note \\1 = True\n hence comv1: \"\\ isComV1 (f1 trn1)\" using \\1 com1 isCom1_isComV1 trn1 s1 by blast\n with \\compV (One.V (trn1 # tr1)) (Two.V []) vl\\ \\1\n obtain vll where vl: \"vl = Value1 (f1 trn1) # vll\"\n and vll: \"compV (One.V tr1) (Two.V []) vll\" by (auto elim: compV.cases)\n show ?thesis proof(cases \"\\1 trn1\")\n case True note \\1 = True\n hence \"\\ isComO1 (g1 trn1)\" using \\1 com1 isCom1_isComO1 trn1 s1 by blast\n with \\compO (One.O (trn1 # tr1)) (Two.O []) obl\\ \\1\n obtain obll where obl: \"obl = Obs1 (g1 trn1) # obll\"\n and obll: \"compO (One.O tr1) (Two.O []) obll\" by (auto elim: compO.cases)\n from ConsNil.IH[OF tr1 _ rs1' rs2 vll obll] obtain trr where\n \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vll\" by auto\n thus ?thesis\n unfolding obl vl using trn1 com1 s1 \\1 \\1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case False note \\1 = False\n note obl = \\compO (One.O (trn1 # tr1)) (Two.O []) obl\\\n from ConsNil.IH[OF tr1 _ rs1' rs2 vll] obl \\1 obtain trr where\n \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vll\" by auto\n thus ?thesis\n unfolding obl vl using trn1 com1 s1 \\1 \\1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n next\n case False note \\1 = False\n note vl = \\compV (One.V (trn1 # tr1)) (Two.V []) vl\\\n show ?thesis proof(cases \"\\1 trn1\")\n case True note \\1 = True\n hence \"\\ isComO1 (g1 trn1)\" using \\1 com1 isCom1_isComO1 trn1 s1 by blast\n with \\compO (One.O (trn1 # tr1)) (Two.O []) obl\\ \\1\n obtain obll where obl: \"obl = Obs1 (g1 trn1) # obll\"\n and obll: \"compO (One.O tr1) (Two.O []) obll\" by (auto elim: compO.cases)\n from ConsNil.IH[OF tr1 _ rs1' rs2 _ obll] vl \\1 obtain trr where\n \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vl\" by auto\n thus ?thesis\n unfolding obl vl using trn1 com1 s1 \\1 \\1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case False note \\1 = False\n note obl = \\compO (One.O (trn1 # tr1)) (Two.O []) obl\\\n from ConsNil.IH[OF tr1 _ rs1' rs2 _] vl \\1 obl \\1 obtain trr where\n \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vl\" by fastforce\n thus ?thesis\n unfolding obl vl using trn1 com1 s1 \\1 \\1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n qed\n qed\nnext\n case (NilCons trn2 tr2 s1 s2 vl obl)\n let ?s2 = \"tgtOf2 trn2\"\n have trn2: \"validTrans2 trn2\" and tr2: \"Two.validFrom ?s2 tr2\"\n and s2: \"srcOf2 trn2 = s2\" \"Two.reach s2\" and rs1: \"One.reach s1\" using NilCons.prems by auto\n then have rs2': \"Two.reach ?s2\" by (intro Two.reach.Step[of s2 trn2 ?s2]) auto\n show ?case proof(cases \"isCom2 trn2\")\n case True note com2 = True\n hence \\2: \"\\2 trn2\" using trn2 isCom2_\\2 s2 by auto\n hence \"isComO2 (g2 trn2)\" using \\2 com2 isCom2_isComO2 trn2 s2 by blast\n hence False using \\compO (One.O []) (Two.O (trn2 # tr2)) obl\\\n using \\2 by (auto elim: compO.cases)\n thus ?thesis by simp\n next\n case False note com2 = False\n show ?thesis proof(cases \"\\2 trn2\")\n case True note \\2 = True\n hence comv1: \"\\ isComV2 (f2 trn2)\" using \\2 com2 isCom2_isComV2 trn2 s2 by blast\n with \\compV (One.V []) (Two.V (trn2 # tr2)) vl\\ \\2\n obtain vll where vl: \"vl = Value2 (f2 trn2) # vll\"\n and vll: \"compV (One.V []) (Two.V tr2) vll\" by (auto elim: compV.cases)\n show ?thesis proof(cases \"\\2 trn2\")\n case True note \\2 = True\n hence \"\\ isComO2 (g2 trn2)\" using \\2 com2 isCom2_isComO2 trn2 s2 by blast\n with \\compO (One.O []) (Two.O (trn2 # tr2)) obl\\ \\2\n obtain obll where obl: \"obl = Obs2 (g2 trn2) # obll\"\n and obll: \"compO (One.O []) (Two.O tr2) obll\" by (auto elim: compO.cases)\n from NilCons.IH[OF _ tr2 rs1 rs2' vll obll] obtain trr where\n \"validFrom (s1, ?s2) trr\" and \"O trr = obll \\ V trr = vll\" by auto\n thus ?thesis\n unfolding obl vl using trn2 com2 s2 \\2 \\2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n next\n case False note \\2 = False\n note obl = \\compO (One.O []) (Two.O (trn2 # tr2)) obl\\\n from NilCons.IH[OF _ tr2 rs1 rs2' vll] obl \\2 obtain trr where\n \"validFrom (s1, ?s2) trr\" and \"O trr = obl \\ V trr = vll\" by auto\n thus ?thesis\n unfolding obl vl using trn2 com2 s2 \\2 \\2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n qed\n next\n case False note \\2 = False\n note vl = \\compV (One.V []) (Two.V (trn2 # tr2)) vl\\\n show ?thesis proof(cases \"\\2 trn2\")\n case True note \\2 = True\n hence \"\\ isComO2 (g2 trn2)\" using \\2 com2 isCom2_isComO2 trn2 s2 by blast\n with \\compO (One.O []) (Two.O (trn2 # tr2)) obl\\ \\2\n obtain obll where obl: \"obl = Obs2 (g2 trn2) # obll\"\n and obll: \"compO (One.O []) (Two.O tr2) obll\" by (auto elim: compO.cases)\n from NilCons.IH[OF _ tr2 rs1 rs2' _ obll] vl \\2 obtain trr where\n \"validFrom (s1, ?s2) trr\" and \"O trr = obll \\ V trr = vl\" by auto\n thus ?thesis\n unfolding obl vl using trn2 com2 s2 \\2 \\2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n next\n case False note \\2 = False\n note obl = \\compO (One.O []) (Two.O (trn2 # tr2)) obl\\\n from NilCons.IH[OF _ tr2 rs1 rs2' _] vl \\2 obl \\2 obtain trr where\n \"validFrom (s1, ?s2) trr\" and \"O trr = obl \\ V trr = vl\" by fastforce\n thus ?thesis\n unfolding obl vl using trn2 com2 s2 \\2 \\2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n qed\n qed\n qed\nnext\n case (ConsCons trn1 tr1 trn2 tr2 s1 s2 vl obl)\n let ?s1 = \"tgtOf1 trn1\" let ?s2 = \"tgtOf2 trn2\"\n let ?tr1 = \"trn1 # tr1\" let ?tr2 = \"trn2 # tr2\"\n have trn1: \"validTrans1 trn1\" and tr1: \"One.validFrom ?s1 tr1\" and s1: \"srcOf1 trn1 = s1\" \"One.reach s1\"\n and trn2: \"validTrans2 trn2\" and tr2: \"Two.validFrom ?s2 tr2\" and s2: \"srcOf2 trn2 = s2\" \"Two.reach s2\"\n using ConsCons.prems by auto\n then have rs1': \"One.reach ?s1\" and rs2': \"Two.reach ?s2\"\n using One.reach.Step[of s1 trn1 ?s1] Two.reach.Step[of s2 trn2 ?s2] by auto\n note vl = \\compV (One.V ?tr1) (Two.V ?tr2) vl\\\n note obl = \\compO (One.O ?tr1) (Two.O ?tr2) obl\\\n note trr1 = \\One.validFrom s1 ?tr1\\ note trr2 = \\Two.validFrom s2 ?tr2\\\n show ?case proof(cases \"\\1 trn1 \\ \\1 trn1\")\n case False note \\\\1 = False\n hence com1: \"\\ isCom1 trn1\" using isCom1_\\1 trn1 s1 by blast\n from ConsCons.IH(2)[of ?tr2, OF _ tr1 trr2 rs1' s2(2)] vl obl \\\\1\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vl\"\n by fastforce\n thus ?thesis\n unfolding obl vl using trn1 com1 s1 \\\\1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case True note \\\\1 = True\n show ?thesis proof(cases \"\\2 trn2 \\ \\2 trn2\")\n case False note \\\\2 = False\n hence com2: \"\\ isCom2 trn2\" using isCom2_\\2 trn2 s2 by blast\n from ConsCons.IH(3)[of ?tr1, OF _ trr1 tr2 s1(2) rs2'] vl obl \\\\2\n obtain trr where \"validFrom (s1, ?s2) trr\" and \"O trr = obl \\ V trr = vl\"\n by fastforce\n thus ?thesis\n unfolding obl vl using trn2 com2 s2 \\\\2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n next\n case True note \\\\2 = True\n show ?thesis using obl ConsCons proof cases\n case Nil hence \\12: \"\\ \\1 trn1 \\ \\ \\2 trn2\" by auto\n hence obl: \"compO (One.O tr1) (Two.O ?tr2) obl\"\n \"compO (One.O tr1) (Two.O tr2) obl\"\n using obl by auto\n have \\12: \"\\1 trn1 \\ \\2 trn2\" using \\\\1 \\\\2 \\12 by auto\n show ?thesis using trr2 vl s2(2) proof(cases rule: compV_cases_V)\n case Nil hence False using \\12 by auto\n thus ?thesis by simp\n next\n case (Step1 vll1 vll2 vll v1)\n hence f1: \"f1 trn1 = v1\" and vll1: \"One.V tr1 = vll1\" using \\12 by auto\n hence vll: \"compV (One.V tr1) (Two.V ?tr2) vll\" using Step1 by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vll obl(1)]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 Step1 f1 \\12 \\12 isCom2_V2 isCom2_\\2 trn2 s2\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case (Com vll1 vll2 vll v1 v2)\n hence f1: \"f1 trn1 = v1\" and vll1: \"One.V tr1 = vll1\"\n and f2: \"f2 trn2 = v2\" and vll2: \"Two.V tr2 = vll2\"\n using \\12 by auto\n hence vll: \"compV (One.V tr1) (Two.V tr2) vll\" using Com by auto\n from ConsCons.IH(1)[OF tr1 tr2 rs1' rs2' vll obl(2)]\n obtain trr where \"validFrom (?s1, ?s2) trr\" and \"O trr = obl \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 Step1 f1 \\12 \\12 isCom2_V2 isCom2_\\2 trn2 s2\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n next\n case (Step1 obll1 obll ob1) note Step1O = Step1\n show ?thesis proof(cases \"\\1 trn1\")\n case True note \\1 = True\n hence g1: \"g1 trn1 = ob1\" and \"obll1 = One.O tr1\" using Step1 by auto\n hence obll: \"compO (One.O tr1) (Two.O ?tr2) obll\" using Step1 by auto\n have com1: \"\\ isCom1 trn1\" using Step1O \\1 g1 isCom1_isComO1 trn1 s1 by blast\n show ?thesis using trr2 vl s2(2) proof(cases rule: compV_cases_V)\n case Nil\n hence \\12: \"\\ \\1 trn1 \\ \\ \\2 trn2\" by auto\n hence vl: \"compV (One.V tr1) (Two.V ?tr2) vl\" using vl by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vl obll]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vl\"\n by auto\n thus ?thesis using trn1 Step1O g1 \\12 \\1 trn1 s1 isCom1_isComO1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case (Step1 vll1 vll2 vll v1) note Step1V = Step1\n show ?thesis proof(cases \"\\1 trn1\")\n case False note \\1 = False\n hence vl: \"compV (One.V tr1) (Two.V ?tr2) vl\" using vl by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vl obll]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vl\"\n by auto\n thus ?thesis using trn1 Step1O g1 \\1 \\1 trn1 s1 isCom1_isComO1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n next\n case True note \\1 = True\n hence f1: \"f1 trn1 = v1\" and \"vll1 = One.V tr1\" using Step1V by auto\n hence vll: \"compV (One.V tr1) (Two.V ?tr2) vll\" using Step1V com1 by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vll obll]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 Step1O Step1V f1 \\1 g1 \\1 \\1 trn1 s1 isCom1_isComO1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n next\n case (Com vll1 vll2 vll v1 v2)\n hence \\1: \"\\ \\1 trn1\" using com1 isCom1_isComV1[OF trn1] s1 by auto\n hence vl: \"compV (One.V tr1) (Two.V ?tr2) vl\" using vl by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vl obll]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obll \\ V trr = vl\"\n by auto\n thus ?thesis using trn1 Step1O g1 \\1 \\1 trn1 s1 isCom1_isComO1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n next\n case False note \\1 = False\n hence obl: \"compO (One.O tr1) (Two.O ?tr2) obl\" using obl by simp\n hence \\1: \"\\1 trn1\" and com1: \"\\ isCom1 trn1\" using \\\\1 \\1 isCom1_\\1 trn1 s1 by auto\n show ?thesis using trr2 vl s2(2) proof(cases rule: compV_cases_V)\n case Nil hence False using \\1 by auto\n thus ?thesis by simp\n next\n case Com hence False using \\1 com1 trn1 using isCom1_isComV1 s1 by auto\n thus ?thesis by simp\n next\n case (Step1 vll1 vll2 vll v1) note Step1V = Step1\n hence f1: \"f1 trn1 = v1\" and \"vll1 = One.V tr1\" using \\1 by auto\n hence vll: \"compV (One.V tr1) (Two.V ?tr2) vll\" using Step1V com1 by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vll obl]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 Step1O Step1V f1 \\1 \\1 \\1 trn1 s1 isCom1_isComV1\n by(intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n qed\n next\n case (Step2 obl2 obll ob2) note Step2O = Step2\n hence com2: \"\\ isCom2 trn2\" using isCom2_\\2[OF trn2] isCom2_isComO2[OF trn2] s2 by auto\n hence \\2: \"\\ \\2 trn2\" using isCom2_V2[OF trn2] s2 by auto\n hence vl: \"compV (One.V ?tr1) (Two.V tr2) vl\" using vl by simp\n have \\2: \"\\2 trn2\" using \\\\2 \\2 by simp\n hence g2: \"g2 trn2 = ob2\" and \"obl2 = Two.O tr2\" using Step2 by auto\n hence obll: \"compO (One.O ?tr1) (Two.O tr2) obll\" using Step2 by auto\n from ConsCons.IH(3)[OF _ trr1 tr2 s1(2) rs2' vl obll]\n obtain trr where \"validFrom (s1, ?s2) trr\" and \"O trr = obll \\ V trr = vl\" by auto\n thus ?thesis using trn1 Step2O g2 \\2 \\2 trn2 s2 isCom2_isComO2\n by (intro exI[of _ \"Trans2 s1 trn2 # trr\"]) auto\n next\n case (Com obll1 obll2 obll ob1 ob2) note ComO = Com\n show ?thesis\n proof(cases \"\\1 trn1\")\n case True note \\1 = True\n hence com1: \"isCom1 trn1\" using isCom1_isComO1[OF trn1] s1 ComO by auto\n show ?thesis proof(cases \"\\2 trn2\")\n case True note \\2 = True\n hence com2: \"isCom2 trn2\" using isCom2_isComO2[OF trn2] s2 ComO by auto\n have obll: \"compO (One.O tr1) (Two.O tr2) obll\" using obl ComO \\1 \\2 by auto\n have g1: \"g1 trn1 = ob1\" and \"obll1 = One.O tr1\" and\n g2: \"g2 trn2 = ob2\" and \"obll2 = Two.O tr2\"\n using \\1 \\2 ComO by auto\n have rs1: \"One.reach (srcOf1 trn1)\" and rs2: \"Two.reach (srcOf2 trn2)\"\n using s1 s2 by auto\n have sync: \"sync trn1 trn2\" proof(rule sync_\\_\\[OF trn1 rs1 trn2 rs2 com1 com2])\n show \"syncO (g1 trn1) (g2 trn2)\" using Com \\1 \\2 by auto\n next\n assume \\12: \"\\1 trn1\" \"\\2 trn2\"\n hence comV: \"isComV1 (f1 trn1) \\ isComV2 (f2 trn2)\"\n using com1 com2 isCom1_isComV1 isCom2_isComV2 trn1 trn2 rs1 rs2 by blast\n show \"syncV (f1 trn1) (f2 trn2)\" using vl \\12 comV by cases auto\n qed(insert \\1 \\2, auto)\n show ?thesis\n proof(cases \"\\1 trn1\")\n case True\n hence \\12: \"\\1 trn1 \\ \\2 trn2\" using sync_\\1_\\2[OF trn1 rs1 trn2 rs2 com1 com2 sync] by simp\n show ?thesis using trr2 vl s2(2) proof(cases rule: compV_cases_V)\n case Nil hence False using \\12 by auto\n thus ?thesis by simp\n next\n case Step1 hence False using \\12 com1 isCom1_isComV1[OF trn1] s1 by auto\n thus ?thesis by simp\n next\n case (Com vll1 vll2 vll v1 v2) note ComV = Com\n hence f1: \"f1 trn1 = v1\" and \"vll1 = One.V tr1\" and\n f2: \"f2 trn2 = v2\" and \"vll2 = Two.V tr2\"\n using \\12 by auto\n hence vll: \"compV (One.V tr1) (Two.V tr2) vll\" using ComV com1 com2 \\12 by auto\n from ConsCons.IH(1)[OF tr1 tr2 rs1' rs2' vll obll]\n obtain trr where \"validFrom (?s1, ?s2) trr\" and \"O trr = obll \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 trn2 ComO ComV f1 f2 \\12 g1 g2 \\1 \\2 com1 com2 sync s1 s2\n by (intro exI[of _ \"CTrans trn1 trn2 # trr\"]) auto\n qed\n next\n case False\n hence \\12: \"\\ \\1 trn1 \\ \\ \\2 trn2\" using sync_\\1_\\2[OF trn1 rs1 trn2 rs2 com1 com2 sync] by simp\n hence vl: \"compV (One.V tr1) (Two.V tr2) vl\" using vl by simp\n from ConsCons.IH(1)[OF tr1 tr2 rs1' rs2' vl obll]\n obtain trr where \"validFrom (?s1, ?s2) trr\" and \"O trr = obll \\ V trr = vl\" by auto\n thus ?thesis using trn1 trn2 ComO \\12 g1 g2 \\1 \\2 com1 com2 sync s1 s2\n by (intro exI[of _ \"CTrans trn1 trn2 # trr\"]) auto\n qed\n next\n case False\n hence \\2: \"\\2 trn2\" and com2: \"\\ isCom2 trn2\" using \\\\2 isCom2_\\2 trn2 s2 by auto\n have False using trr2 vl s2(2) \\2 com2 isCom2_V2[OF trn2] s2 by (cases rule: compV_cases_V) auto\n thus ?thesis by simp\n qed\n next\n case False note \\1 = False\n hence obl: \"compO (One.O tr1) (Two.O ?tr2) obl\" using obl by simp\n have \\1: \"\\1 trn1\" and com1: \"\\ isCom1 trn1\" using \\1 \\\\1 isCom1_\\1 trn1 s1 by auto\n show ?thesis using trr2 vl s2(2) proof(cases rule: compV_cases_V)\n case Nil hence False using \\1 by auto\n thus ?thesis by simp\n next\n case Com hence False using com1 \\1 isCom1_isComV1[OF trn1] s1 by auto\n thus ?thesis by simp\n next\n case (Step1 vll1 vll2 vll v1) note Step1V = Step1\n hence f1: \"f1 trn1 = v1\" and \"vll1 = One.V tr1\" using \\1 by auto\n hence vll: \"compV (One.V tr1) (Two.V ?tr2) vll\" using Step1V com1 by auto\n from ConsCons.IH(2)[OF _ tr1 trr2 rs1' s2(2) vll obl]\n obtain trr where \"validFrom (?s1, s2) trr\" and \"O trr = obl \\ V trr = vll\"\n by auto\n thus ?thesis using trn1 Step1V f1 \\1 \\1 trn1 s1 isCom1_isComO1 com1\n by (intro exI[of _ \"Trans1 s2 trn1 # trr\"]) auto\n qed\n qed\n qed\n qed\n qed\nqed\n\n\n\n\nlemma pullback_O_V:\nassumes \"One.validFrom istate1 tr1\" and \"Two.validFrom istate2 tr2\"\nand \"compV (One.V tr1) (Two.V tr2) vl\"\nand \"compO (One.O tr1) (Two.O tr2) ol\"\nshows \"\\tr. validFrom icstate tr \\ O tr = ol \\ V tr = vl\"\nusing assms pullback_O_V_aux One.reach.Istate Two.reach.Istate unfolding icstate_def by auto\n\nend (* context BD_Security_TS_Comp *)\n\n\nsublocale BD_Security_TS_Comp \\ K? : Abstract_BD_Security_Comp where\n validSystemTraces1 = \"One.validFrom istate1\" and V1 = One.V and O1 = One.O\n and TT1 = \"never T1\" and B1 = B1 and\n validSystemTraces2 = \"Two.validFrom istate2\" and V2 = Two.V and O2 = Two.O\n and TT2 = \"never T2\" and B2 = B2 and\n validSystemTraces = \"validFrom icstate\" and V = V and O = O\n and TT = \"never T\" and B = B and\n comp = comp and compO = compO and compV = compV\n apply standard\n subgoal using validFrom by fastforce\n subgoal using compV by fastforce\n subgoal using compO by fastforce\n subgoal using T by fastforce\n subgoal using B by fastforce\n subgoal using pullback_O_V by fastforce\n done\n\n\ncontext BD_Security_TS_Comp begin\n\n(* Just contemplating the theorem provided as a\nconsequence of the sublocale inclusion: *)\ntheorem \"secure1 \\ secure2 \\ secure\"\nusing secure1_secure2_secure .\n\nend (* context BD_Security_TS_Comp *)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BD_Security_Compositional/Composing_Security.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2796049527783117}} {"text": "theory MP_AbstractLock\n imports Main AbstractLock_Proof_Rules OpSem_Proof_Rules\nbegin\ndatatype PC =\n L1\n| L2\n| L3\n| L4\n| L5\n\n\n\nconsts t1 :: T \nconsts t2 :: T\nconsts d1 :: L\nconsts d2 :: L\nconsts l :: L\n\n\ndefinition \"thrdsvars \\ t1 \\ t2 \\ d1 \\ d2\"\n\n\nrecord prog_state =\n pc :: \"T \\ PC\"\n state :: surrey_state\n lstate :: lib_state\n r :: V\n r2 :: V\n loc1 :: bool\n loc2 :: bool\n rel1 :: bool\n rel2 :: bool\n ver1 :: V\n ver2 :: V\n\ndefinition \n \"update_pc t nv pcf \\ pcf (t := nv)\"\n\n\ndefinition prog :: \"T \\ prog_state \\ prog_state \\ bool \" where\n\"prog t s s' \\ \n(\nif t = t1\nthen\nif (pc s) t = L1\nthen\n [(state s) (lstate s) t LOCKACQ(l) (state s') (lstate s') (loc1 s') (ver1 s')]\n \\ (loc1 s' \\ pc s' = update_pc t L2 (pc s))\n \\ (\\ loc1 s' \\ pc s' = pc s) \n \\ (r s' = r s)\n \\ (r2 s' = r2 s)\n \\ (rel1 s' = rel1 s) \n \\ (rel2 s' = rel2 s) \n \\ (loc2 s' = loc2 s)\n \\ (ver2 s' = ver2 s)\nelse\nif (pc s) t = L2\nthen \n (state s) [d1 := 5]\\<^sub>t (state s')\n \\ pc s' = update_pc t L3 (pc s)\n \\ (lstate s = lstate s')\n \\ (r s = r s')\n \\ (rel1 s' = rel1 s)\n \\ (rel2 s' = rel2 s) \n \\ (loc2 s' = loc2 s)\n \\ (loc1 s' = loc1 s)\n \\ (ver2 s' = ver2 s)\nelse\nif (pc s) t = L3\nthen \n (state s) [d2 := 5]\\<^sub>t (state s')\n \\ pc s' = update_pc t L4 (pc s)\n \\ (lstate s = lstate s')\n \\ (r s = r s')\n \\ (rel1 s' = rel1 s)\n \\ (rel2 s' = rel2 s) \n \\ (loc2 s' = loc2 s)\n \\ (loc1 s' = loc1 s)\n \\ (ver2 s' = ver2 s)\nelse\nif (pc s) t = L4\nthen \n [(state s) (lstate s) t LOCKREL(l) (lstate s') (state s')] \n \\ pc s' = update_pc t L5 (pc s)\n \\ (state s = state s')\n \\ (r s = r s')\n \\ (loc1 s' = loc1 s) \n \\ (loc2 s' = loc2 s)\n \\ (rel2 s' = rel2 s)\n \\ (rel1 s' = True)\n \\ (ver2 s' = ver2 s)\nelse\nFalse\nelse\n\nif t = t2\nthen\nif (pc s) t = L1\nthen\n [(state s) (lstate s) t LOCKACQ(l) (state s') (lstate s') (loc2 s') (ver2 s')]\n \\ (loc2 s' = True \\ pc s' = update_pc t L2 (pc s))\n \\ (loc2 s' = False \\ pc s' = pc s) \\ (r s = r s') \\ (r2 s = r2 s')\n \\ (rel1 s' = rel1 s) \\ (rel2 s' = rel2 s) \\ (loc1 s = loc1 s')\nelse\nif (pc s) t = L2\nthen \n (state s) [r s' \\ d1]\\<^sub>t (state s')\n \\ pc s' = update_pc t L3 (pc s)\n \\ (lstate s = lstate s')\n \\ (rel1 s' = rel1 s) \\ (rel2 s' = rel2 s)\n \\ (loc2 s = loc2 s') \\ (loc1 s = loc1 s')\n \\ (ver2 s' = ver2 s)\nelse\nif (pc s) t = L3\nthen \n (state s) [r2 s' \\ d2]\\<^sub>t (state s')\n \\ pc s' = update_pc t L4 (pc s)\n \\ (lstate s = lstate s')\n \\ (rel1 s' = rel1 s) \\ (rel2 s' = rel2 s)\n \\ (loc2 s = loc2 s') \\ (loc1 s = loc1 s') \\ (r s = r s')\n \\ (ver2 s' = ver2 s)\nelse\nif (pc s) t = L4\nthen \n [(state s) (lstate s) t LOCKREL(l) (lstate s') (state s')] \n \\ pc s' = update_pc t L5 (pc s) \\\n (state s = state s') \\ (r s = r s')\n \\ (loc2 s' = loc2 s) \\ (loc1 s' = loc1 s) \n \\ (rel1 s' = rel1 s) \\ (rel2 s' = True) \\ (r s = r s')\n \\ (ver2 s' = ver2 s)\nelse\nFalse\nelse\nFalse\n)\n\"\n\ndefinition \"mutex s \\ (rel1 s \\ loc1 s) \\\n (rel2 s \\ loc2 s) \\\n \\ ((loc1 s \\ \\rel1 s) \\ (loc2 s \\ \\rel2 s))\"\n\n(* need to add that ver2 s = 0 \\ ver2 s = 2 *)\ndefinition \"global_inv s \\ (wfs (state s)) \\ (lib_wfs (lstate s) (state s)) \\ thrdsvars \\ mutex s \"\n\ndefinition \"init_state s \\ thrdsvars \\ (wfs (state s)) \\ (lib_wfs (lstate s) (state s)) \\ ([lib(l) =\\<^sub>t1 0] (lstate s)) \\ ([lib(l) =\\<^sub>t2 0] (lstate s))\n \\ ([d1 =\\<^sub>t1 0] (state s)) \\ ([d1 =\\<^sub>t2 0] (state s)) \n \\ ([d2 =\\<^sub>t1 0] (state s)) \\ ([d2 =\\<^sub>t2 0] (state s)) \n \\ (loc1 s = False) \\ (loc2 s = False) \n \\ (rel1 s = False) \\ (rel2 s = False) \\ (r s = 0)\n \\ cvd[lib(l), 0] (lstate s)\"\n\n\ndefinition \"prog_inv t p s \\ \n global_inv s \\\n (if t = t1 \n then\n let t' = t2 in \n (case p of\n L1 \\ (\\rel1 s) \\ (\\loc1 s) \n \\ ([d1 =\\<^sub>t 0] (state s))\n \\ ([d2 =\\<^sub>t 0] (state s))\n \\ (\\loc2 s \\ ([lib(l) =\\<^sub>t 0] (lstate s)) \\ (\\[lib(l) \\\\<^sub>t' 2] (lstate s)))\n \\ (\\loc2 s \\ ([lib(l) =\\<^sub>t' 0] (lstate s)) \\ (cvd[lib(l), 0] (lstate s)))\n \\ (loc2 s \\ \\rel2 s \\ cvd[lib(l), 1] (lstate s)) \n \\ (loc2 s \\ rel2 s \\ (cvv[lib(l), 0] (lstate s)))\n | L2 \\ (loc1 s) \\ (\\rel1 s)\n \\ ([d1 =\\<^sub>t 0] (state s))\n \\ ([d2 =\\<^sub>t 0] (state s))\n \\ (\\loc2 s \\ \\[lib(l) \\\\<^sub>t' 2] (lstate s))\n \\ cvv[lib(l),0] (lstate s) \n | L3 \\ (loc1 s) \\ (\\rel1 s) \n \\ ([d1 =\\<^sub>t 5] (state s))\n \\ ([d2 =\\<^sub>t 0] (state s))\n \\ (\\loc2 s \\ \\[lib(l) \\\\<^sub>t' 2] (lstate s))\n \\ cvv[lib(l),0] (lstate s) \n | L4 \\ (loc1 s) \\ (\\rel1 s)\n \\ (\\loc2 s \\ \\[lib(l) \\\\<^sub>t' 2] (lstate s))\n \\ ([d1 =\\<^sub>t 5] (state s))\n \\ ([d2 =\\<^sub>t 5] (state s))\n \\ cvv[lib(l),0] (lstate s) \n | L5 \\ (rel1 s) \\ (loc1 s)\n )\n else\n if t = t2 then\n let t' = t1 in \n (case p of\n L1 \\ \\rel2 s \\ \\loc2 s \n \\ (\n (rel1 s \\ ([lib(l) = 2]\\d1 =\\<^sub>t 5\\ (lstate s) (state s))\n \\ ([lib(l) = 2]\\d2 =\\<^sub>t 5\\ (lstate s) (state s))) \n \\ ( ([lib(l) =\\<^sub>t 0] (lstate s)) \\ [d1 =\\<^sub>t 0] (state s)\n \\ [d2 =\\<^sub>t 0] (state s))\n \\ (loc1 s \\ \\ rel1 s))\n \\ (\\loc1 s \\ ([lib(l) =\\<^sub>t' 0] (lstate s)) \\ (cvd[lib(l), 0] (lstate s)))\n \\ (loc1 s \\ \\rel1 s \\ cvd[lib(l), 1] (lstate s)) \n \\ (rel1 s \\ cvv[lib(l), 0] (lstate s))\n | L2 \\ \\rel2 s \\ loc2 s \\ (cvv[lib(l), 0] (lstate s))\n \\ (ver2 s = 2 \\ [d1 =\\<^sub>t 5] (state s) \\ [d2 =\\<^sub>t 5] (state s)) \n \\ (ver2 s = 0 \\ [d1 =\\<^sub>t 0] (state s) \\ [d2 =\\<^sub>t 0] (state s))\n | L3 \\ \\rel2 s \\ loc2 s \\ (cvv[lib(l), 0] (lstate s))\n \\ (ver2 s = 2 \\ r s = 5 \\ [d2 =\\<^sub>t 5] (state s)) \n \\ (ver2 s = 0 \\ r s = 0 \\ [d2 =\\<^sub>t 0] (state s))\n | L4 \\ loc2 s \\ \\rel2 s \\ (cvv[lib(l), 0] (lstate s))\n \\ (ver2 s = 2 \\ r s = 5 \\ r2 s = 5) \n \\ (ver2 s = 0 \\ r s = 0 \\ r2 s = 0)\n | L5 \\ loc2 s \\ rel2 s\n )\n\n else\n False)\n\"\n\n(* r s = 5 \\ r1 s = 5 \\ r s = 0 \\ r s = 0 *)\n\nlemmas autos = mutex_def global_inv_def update_pc_def prog_def prog_inv_def thrdsvars_def\n\nlemma init_inv:\n assumes \"init_state s\"\n and \"global_inv s\"\n and \"t\\{t1,t2}\"\n shows \"prog_inv t L1 s\"\n using assms\n apply (simp add: autos init_state_def)\n apply(intro conjI impI; elim disjE)\n using lib_d_obs_not_p_obs zero_neq_numeral apply blast\n apply blast\n apply blast\n by blast\n\nlemma global_inv_init:\n assumes \"init_state s\"\n shows \"global_inv s\"\n using assms\n apply (simp add: init_state_def autos)\n done\n\n\n\n\nlemma t1_local:\n assumes \"prog_inv t1 ((pc s) t1) s\" \n and \"prog t1 s s'\"\n shows \"prog_inv t1 ((pc s') t1) s'\"\n using assms \n apply(case_tac \"pc s t1\", simp_all)\n apply(case_tac \"pc s' t1\", simp_all)\n apply (simp_all add: prog_inv_def prog_def global_inv_def thrdsvars_def update_pc_def)\n apply(unfold mutex_def, elim conjE)\n apply (smt PC.distinct(1) fun_upd_same lock_acquire_def lock_acquire_step_def prod.sel(1) prod.sel(2))\n apply(intro conjI)\n using lock_acqure_wfs_pres apply blast\n using lock_acqure_lib_wfs_pres apply blast\n using lock_acquire_cvd_odd_false apply force\n apply blast+\n using lock_acquire_cvd_odd_false apply force\n apply (metis PC.distinct(1))\n \n apply (metis (full_types) PC.distinct(1) lock_acqure_successfulib_client_pres_d_obs)\n apply (metis (full_types) PC.distinct(1) lock_acqure_successfulib_client_pres_d_obs)\n\n apply (smt PC.distinct(1) add_le_same_cancel2 lock_acquire_successful_p_obs of_nat_0 of_nat_le_0_iff) \n defer \n apply (metis PC.distinct(4) PC.simps(10) fun_upd_same)\n apply (metis PC.distinct(11) PC.distinct(5) fun_upd_same)\n apply (metis PC.distinct(13) PC.distinct(7) fun_upd_same) \n apply (metis d_obs_WrX_other d_obs_WrX_set step_pres_lib_wfs wfs_preserved)\n apply (meson d_obs_WrX_other d_obs_WrX_set step_pres_lib_wfs wfs_preserved)\n apply (metis lock_release_lib_wfs_pres)\n apply(elim conjE)\n apply simp\n apply(cases \"loc2 s\", simp_all)\n apply(cases \"rel2 s\", simp_all)\n defer\n apply (metis PC.distinct(1) even_Suc even_zero lock_acquire_cvd_odd_false)\n apply(cases \"loc1 s'\", simp_all)\n apply(elim conjE)\n using cvd_cvv_val apply blast\n using cvv_lock_acquire_pres by blast\n\nlemma t2_local:\n assumes \"prog_inv t2 ((pc s) t2) s\" \n and \"prog t2 s s'\"\n shows \"prog_inv t2 ((pc s') t2) s'\"\n using assms \n apply(case_tac \"t1 \\ t2\")\n apply(case_tac \"pc s t2\", simp_all)\n apply(case_tac \"pc s' t2\", simp_all)\n apply (simp_all add: prog_inv_def prog_def global_inv_def thrdsvars_def update_pc_def)\n apply(unfold mutex_def)\n apply simp_all\n apply (smt PC.distinct(1) fun_upd_same lock_acquire_def lock_acquire_step_def prod.sel(1) prod.sel(2))\n apply(elim conjE, intro conjI) \n using lock_acqure_wfs_pres apply blast\n using lock_acqure_lib_wfs_pres apply blast\n apply (metis One_nat_def lock_acquire_cvd_odd_false odd_one)\n apply auto[1]\n apply (elim disjE conjE)\n using cvv_lock_acquire_pres apply blast\n apply (metis (full_types) PC.distinct(1) cvd_cvv_val cvv_lock_acquire_pres even_Suc even_zero lock_acquire_cvd_odd_false)\n apply (metis PC.distinct(1) even_Suc even_zero lock_acquire_cvd_odd_false)\n apply (intro conjI impI)\n apply (metis (full_types) PC.distinct(1) lock_acquire_cvd_odd_false lock_acquire_successful_c_o_s lock_acquire_successful_rv numeral_1_eq_Suc_0 numeral_One odd_one zero_neq_numeral)\n apply (metis (full_types) PC.distinct(1) lock_acquire_cvd_odd_false lock_acquire_successful_c_o_s lock_acquire_successful_rv numeral_1_eq_Suc_0 numeral_One odd_one zero_neq_numeral)\n defer\n apply (metis PC.distinct(3) PC.distinct(9) fun_upd_same)\n apply (metis PC.distinct(11) PC.distinct(5) fun_upd_same)\n apply (metis PC.distinct(13) PC.distinct(7) fun_upd_same)\n apply (metis d_obs_RdX_other d_obs_read_value step_pres_lib_wfs wfs_preserved)\n using d_obs_read_value step_pres_lib_wfs wfs_preserved apply blast\n apply (metis lock_release_lib_wfs_pres)\n apply (elim disjE)\n defer\n apply (metis (full_types) PC.distinct(1) lock_acqure_successfulib_client_pres_d_obs)\n apply (metis PC.distinct(1) even_Suc even_zero lock_acquire_cvd_odd_false)\n by (metis (full_types) PC.distinct(1) cvv_val)\n\nlemma t1_global:\n assumes \"prog_inv t1 ((pc s) t1) s\" \n and \"prog_inv t2 ((pc s) t2) s\" \n and \"prog t2 s s'\"\n shows \"prog_inv t1 ((pc s') t1) s'\"\n using assms \n apply(case_tac \"pc s t1\")\n apply(case_tac \"pc s t2\")\n apply(case_tac \"pc s' t1\")\n apply(simp_all add: prog_inv_def prog_def global_inv_def mutex_def thrdsvars_def update_pc_def)\n apply(intro conjI)\n using lock_acqure_wfs_pres apply blast\n using lock_acqure_lib_wfs_pres apply blast\n apply (metis (full_types) lock_acquire_successfulib_diff_t_d_p_obs_pres lock_acquire_unsuccessful_diff_t_d_p_obs_pres)\n \n apply (metis (full_types) lock_acquire_successfulib_diff_t_d_p_obs_pres lock_acquire_unsuccessful_diff_t_d_p_obs_pres)\n\n apply (metis (full_types) OpSem.null_def lock_acquire_successful_not_p_obs_pres lock_acquire_unsuccessful_d_obs_pres) \n \n apply (metis (full_types) lock_acquire_unsuccessful_d_obs_pres lock_acquire_unsuccessfulib_cvd_pres)\n\n apply (elim conjE, intro impI, simp) \n \n using lock_acquire_successfulib_cvd apply fastforce\n apply fastforce \n apply auto[3]\n using dobs_RdX_pres step_pres_lib_wfs wfs_preserved apply blast\n using dobs_RdX_pres step_pres_lib_wfs wfs_preserved apply blast\n apply(intro conjI)\n apply (metis lock_release_lib_wfs_pres)\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp)\n apply (metis cvv_release)\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp)\n using lock_acquire_cvd_odd_false apply fastforce\n apply (smt One_nat_def lock_acquire_cvd_odd_false lock_acquire_def lock_acquire_step_def odd_one prod.sel(1) prod.sel(2))\n apply (metis PC.distinct(9) even_Suc even_zero lock_acquire_cvd_odd_false)\n apply (metis One_nat_def PC.distinct(11) lock_acquire_cvd_odd_false odd_one)\n apply (metis PC.distinct(14) autos(3) fun_upd_def)\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp)\n apply (metis)\n apply (metis)\n apply (smt One_nat_def lock_acquire_cvd_odd_false lock_acquire_def lock_acquire_step_def odd_one prod.sel(1) prod.sel(2))\n apply (metis) \n apply (metis)\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp)\n apply (metis)\n apply (metis)\n apply (metis) \n apply (smt One_nat_def lock_acquire_cvd_odd_false lock_acquire_def lock_acquire_step_def odd_one prod.sel(1) prod.sel(2))\n apply (metis)\n apply blast+\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp) \n using lock_acquire_cvd_odd_false apply fastforce\n apply (metis PC.simps(10) autos(3) fun_upd_def)\n apply (smt One_nat_def lock_acquire_cvd_odd_false lock_acquire_def lock_acquire_step_def odd_one prod.sel(1) prod.sel(2))\n apply (metis PC.distinct(15) autos(3) fun_upd_def)\n apply (metis PC.distinct(17) autos(3) fun_upd_other)\n apply (metis)\n apply (metis)\n apply (metis)\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp) \n apply (metis PC.distinct(5) autos(3) fun_upd_apply)\n apply (metis PC.distinct(11) autos(3) fun_upd_other)\n apply (metis PC.distinct(15) autos(3) fun_upd_apply)\n apply (smt One_nat_def lock_acquire_cvd_odd_false lock_acquire_def lock_acquire_step_def odd_one prod.sel(1) prod.sel(2))\n apply (metis PC.simps(20) autos(3) fun_upd_apply)\n apply blast+\n apply(case_tac \"pc s t2\"; simp)\n apply(case_tac \"pc s' t1\"; simp) \n apply (metis PC.distinct(7) autos(3) fun_upd_other)\n apply (metis PC.distinct(13) autos(3) fun_upd_other)\n apply (metis PC.distinct(17) autos(3) fun_upd_other)\n apply (metis PC.distinct(19) autos(3) fun_upd_other) \n using lock_acqure_lib_wfs_pres lock_acqure_wfs_pres apply blast\n apply (smt PC.simps(25) autos(3) fun_upd_other step_pres_lib_wfs wfs_preserved)\n apply (smt PC.simps(25) autos(3) fun_upd_other step_pres_lib_wfs wfs_preserved)\n apply (smt PC.simps(25) autos(3) fun_upd_other lock_release_lib_wfs_pres)\n done\n\nlemma t2_global:\n assumes \"prog_inv t1 ((pc s) t1) s\" \n and \"prog_inv t2 ((pc s) t2) s\" \n and \"prog t1 s s'\"\n shows \"prog_inv t2 ((pc s') t2) s'\"\n using assms \n apply(subgoal_tac \"t1 \\ t2\")\n apply(simp add: prog_def)\n apply(case_tac \"pc s t1\", simp_all)\n apply(case_tac \"pc s t2\", simp_all)\n apply(case_tac \"pc s' t2\", simp_all)\n apply(simp_all add: prog_inv_def global_inv_def thrdsvars_def update_pc_def)\n apply(unfold mutex_def, elim conjE)\n apply simp\n apply(intro conjI) \n using lock_acqure_wfs_pres apply blast\n using lock_acqure_lib_wfs_pres apply blast\n apply (metis (full_types) lock_acquire_unsuccessful_d_obs_pres lock_acquire_unsuccessful_diff_t_d_p_obs_pres)\n \n apply (metis (full_types) lock_acquire_unsuccessful_d_obs_pres lock_acquire_unsuccessfulib_cvd_pres)\n using lock_acquire_successfulib_cvd apply force\n apply force\n apply auto[1]\n\n apply auto[1]\n \n apply auto[1]\n\n apply (intro conjI)\n apply (smt One_nat_def PC.simps(22) global_inv_def lock_acquire_cvd_odd_false lock_acquire_unsuccessful_diff_t_d_p_obs_pres lock_acqure_lib_wfs_pres lock_acqure_wfs_pres mutex_def odd_one thrdsvars_def)\n apply (smt One_nat_def PC.simps(23) global_inv_def lock_acquire_cvd_odd_false lock_acquire_unsuccessful_diff_t_d_p_obs_pres lock_acqure_lib_wfs_pres lock_acqure_wfs_pres mutex_def odd_one thrdsvars_def)\n apply (smt One_nat_def PC.simps(24) global_inv_def lock_acquire_cvd_odd_false lock_acqure_lib_wfs_pres lock_acqure_wfs_pres mutex_def odd_one thrdsvars_def)\n apply (smt PC.simps(25) fun_upd_other global_inv_def lock_acqure_lib_wfs_pres lock_acqure_wfs_pres mutex_def thrdsvars_def)\n defer defer defer\n apply (case_tac \"pc s t1\"; simp add: thrdsvars_def prog_def global_inv_def)\n apply (case_tac \"pc s t2\"; simp)\n apply (intro conjI)\n using lock_acqure_wfs_pres apply blast\n \n using lock_acqure_lib_wfs_pres apply blast\n apply (metis lock_acquire_cvd_odd_false numeral_1_eq_Suc_0 numeral_One odd_one)\n apply (case_tac \"pc s' t2\"; simp)\n apply auto[1]\n apply (metis PC.distinct(11) fun_upd_apply)\n apply (metis PC.distinct(15) fun_upd_other)\n using cvv_lock_acquire_pres apply blast\n apply auto[1]\n apply (intro conjI)\n using lock_acqure_wfs_pres apply blast\n using lock_acqure_lib_wfs_pres apply blast\n apply blast+\n apply auto[1]\n apply (case_tac \"pc s t2\"; simp)\n using step_pres_lib_wfs wfs_preserved apply blast\n using step_pres_lib_wfs wfs_preserved apply blast\n apply (case_tac \"pc s t2\"; simp)\n using step_pres_lib_wfs wfs_preserved apply blast\n using step_pres_lib_wfs wfs_preserved apply blast\n apply (case_tac \"pc s t2\"; simp)\n using step_pres_lib_wfs wfs_preserved apply blast\n apply (case_tac \"pc s t2\"; simp)\n using step_pres_lib_wfs wfs_preserved apply blast+\n apply (case_tac \"pc s t2\"; simp)\n apply (metis cvv_release lock_rel_c_obs_intro lock_release_lib_wfs_pres)\n apply blast+\n using lock_release_lib_wfs_pres apply force \n apply (metis lock_acquire_cvd_odd_false numeral_1_eq_Suc_0 numeral_One odd_one)\n apply (case_tac \"pc s' t2\"; simp)\n apply auto[1]\n apply (smt cvv_lock_acquire_pres lock_acquire_successfulib_diff_t_d_p_obs_pres lock_acquire_unsuccessful_diff_t_d_p_obs_pres)\n apply (metis PC.distinct(9) fun_upd_apply)\n apply (metis PC.distinct(11) fun_upd_other)\n apply auto[1]\n by (smt PC.simps(23) cvv_lock_acquire_pres lock_acquire_cvd_odd_false lock_acquire_unsuccessful_diff_t_d_p_obs_pres lock_acqure_lib_wfs_pres lock_acqure_wfs_pres numeral_1_eq_Suc_0 numeral_One odd_one)\n\nend\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/MP_AbstractLock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.27960226837805585}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection \\ICING variant\\\ntext\\We abstract and simplify from the protocol ICING in several ways. First, we only consider \nProofs of Consent (PoC), not Proofs of Provenance (PoP). Our framework does not support proving the\npath validation properties that PoPs provide, and it also currently does not support XOR, and \ndynamically changing hop fields.\nThus, instead of embedding $A_i \\oplus PoP_{0,1}$, we embed $A_i$ directly.\nWe also remove the payload from the Hash that is included in each packet.\n\nWe offer three versions of this protocol:\n\\begin{itemize}\n\\item @{text \"ICING\"}, which contains our best effort at modeling the protocol as accurately as \npossible.\n\\item @{text \"ICING_variant\"}, in which we strip down the protocol to what is required to obtain the\nsecurity guarantees and remove unnecessary fields.\n\\item @{text \"ICING_variant2\"}, in which we furthermore simplify the protocol. The key of the MAC in\nthis protocol is only the key of the AS, as opposed to a key derived specifically for this hop field.\nIn order to prove that this scheme is secure, we have to assume that ASes only occur once on an\nauthorized path, since otherwise the MAC for two different hop fields (by the same AS) would be the\nsame, and the AS could not distinguish the hop fields based on the MAC.\n\\end{itemize}\\\ntheory ICING_variant2\n imports\n \"../Parametrized_Dataplane_3_undirected\"\nbegin\n\nlocale icing_defs = network_assums_undirect _ _ _ auth_seg0 \n for auth_seg0 :: \"(msgterm \\ ahi list) set\"\n+ assumes auth_seg0_no_dups: \n \"\\(ainfo, hfs) \\ auth_seg0; hf \\ set hfs; hf' \\ set hfs; ASID hf' = ASID hf\\ \\ hf' = hf\"\nbegin\n\n(******************************************************************************)\nsubsection \\Hop validation check and extract functions\\\n(******************************************************************************)\ntype_synonym ICING_HF = \"(unit, unit) HF\"\n\ntext\\The term @{term \"sntag\"} simply is the AS key. We use it in the computation of @{term \"hf_valid\"}.\\\n\nfun sntag :: \"ahi \\ msgterm\" where\n \"sntag \\UpIF = upif, DownIF = downif, ASID = asid\\ = macKey asid\"\n\ntext\\The predicate @{term \"hf_valid\"} is given to the concrete parametrized model as a parameter.\nIt ensures the authenticity of the hop authenticator in the hop field. The predicate takes an \nexpiration timestamp (in this model always a numeric value, hence the matching on \n@{term \"Num PoC_i_expire\"}), the entire segment and the hop field to be validated.\\\nfun hf_valid :: \"msgterm \\ msgterm\n \\ ICING_HF list\n \\ ICING_HF \n \\ bool\" where \n \"hf_valid (Num PoC_i_expire) uinfo hfs \\AHI = ahi, UHI = uhi, HVF = x\\ \\ uhi = () \\ \n x = Mac[sntag ahi] (L ((Num PoC_i_expire)#(map (hf2term o AHI) hfs))) \\ uinfo = \\\"\n| \"hf_valid _ _ _ _ = False\"\n\ntext\\We can extract the entire path (past and future) from the hvf field.\\\nfun extr :: \"msgterm \\ ahi list\" where\n \"extr (Mac[_] (L hfs))\n = map term2hf (tl hfs)\"\n| \"extr _ = []\"\n\ntext\\Extract the authenticated info field from a hop validation field.\\\nfun extr_ainfo :: \"msgterm \\ msgterm\" where \n \"extr_ainfo (Mac[_] (L (Num ts # xs))) = Num ts\"\n| \"extr_ainfo _ = \\\"\n\nabbreviation term_ainfo :: \"msgterm \\ msgterm\" where\n \"term_ainfo \\ id\"\n\ntext\\An authenticated info field is always a number (corresponding to a timestamp). The \n unauthenticated info field is set to the empty term @{term \"\\\"}.\\\ndefinition auth_restrict where \n \"auth_restrict ainfo uinfo l \\ (\\ts. ainfo = Num ts) \\ (uinfo = \\)\"\n\ntext\\When observing a hop field, an attacker learns the HVF. UHI is empty and the AHI only contains \npublic information that are not terms.\\\nfun terms_hf :: \"ICING_HF \\ msgterm set\" where \n \"terms_hf hf = {HVF hf}\"\n\nabbreviation terms_uinfo :: \"msgterm \\ msgterm set\" where \n \"terms_uinfo x \\ {x}\"\n\nabbreviation no_oracle where \"no_oracle \\ (\\ _ _. True)\"\n\ntext\\We now define useful properties of the above definition.\\\nlemma hf_valid_invert:\n \"hf_valid tsn uinfo hfs hf \\\n(\\ ts ahi. tsn = Num ts \\ ahi = AHI hf \\\nUHI hf = () \\\nHVF hf = Mac[sntag ahi] (L ((Num ts)#(map (hf2term o AHI) hfs))) \\ uinfo = \\)\"\n apply(cases hf) by(auto elim!: hf_valid.elims)\n\nlemma hf_valid_auth_restrict[dest]: \"hf_valid ainfo uinfo hfs hf \\ auth_restrict ainfo uinfo l\"\n by(auto simp add: hf_valid_invert auth_restrict_def)\n\nlemma auth_restrict_ainfo[dest]: \"auth_restrict ainfo uinfo l \\ \\ts. ainfo = Num ts\"\n by(auto simp add: auth_restrict_def)\nlemma auth_restrict_uinfo[dest]: \"auth_restrict ainfo uinfo l \\ uinfo = \\\"\n by(auto simp add: auth_restrict_def)\n\n(******************************************************************************)\nsubsection\\Definitions and properties of the added intruder knowledge\\\n(******************************************************************************)\ntext\\Here we define a @{text \"ik_add\"} and @{text \"ik_oracle\"} as being empty, as these features are\nnot used in this instance model.\\\nprint_locale dataplane_3_undirected_defs\nsublocale dataplane_3_undirected_defs _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo \n term_ainfo terms_hf terms_uinfo no_oracle\n by unfold_locales\n\ndeclare parts_singleton[dest]\n\nabbreviation ik_add :: \"msgterm set\" where \"ik_add \\ {}\"\n\nabbreviation ik_oracle :: \"msgterm set\" where \"ik_oracle \\ {}\"\n\nlemma uinfo_empty[dest]: \"(ainfo, hfs) \\ auth_seg2 uinfo \\ uinfo = \\\"\n by(auto simp add: auth_seg2_def auth_restrict_def)\n\n(******************************************************************************)\nsubsection\\Properties of the intruder knowledge, including @{text \"ik_add\"} and @{text \"ik_oracle\"}\\\n (******************************************************************************)\ntext\\We now instantiate the parametrized model's definition of the intruder knowledge, using the\ndefinitions of @{text \"ik_add\"} and @{text \"ik_oracle\"} from above. We then prove the properties \nthat we need to instantiate the @{text \"dataplane_3_undirected\"} locale.\\\nprint_locale dataplane_3_undirected_ik_defs\nsublocale\n dataplane_3_undirected_ik_defs _ _ _ auth_seg0 terms_uinfo no_oracle hf_valid auth_restrict extr \n extr_ainfo term_ainfo terms_hf ik_add ik_oracle\n by unfold_locales\n\nlemma ik_hfs_form: \"t \\ parts ik_hfs \\ \\ t' . t = Hash t'\"\n apply auto apply(drule parts_singleton)\n by(auto simp add: auth_seg2_def hf_valid_invert)\n\ndeclare ik_hfs_def[simp del]\n\nlemma parts_ik_hfs[simp]: \"parts ik_hfs = ik_hfs\"\n by (auto intro!: parts_Hash ik_hfs_form)\n\ntext\\This lemma allows us not only to expand the definition of @{term \"ik_hfs\"}, but also \nto obtain useful properties, such as a term being a Hash, and it being part of a valid hop field.\\\nlemma ik_hfs_simp: \n \"t \\ ik_hfs \\ (\\t' . t = Hash t') \\ (\\hf . t = HVF hf\n \\ (\\hfs uinfo. hf \\ set hfs \\ (\\ainfo . (ainfo, hfs) \\ auth_seg2 uinfo\n \\ hf_valid ainfo uinfo hfs hf)))\" (is \"?lhs \\ ?rhs\")\nproof \n assume asm: \"?lhs\" \n then obtain ainfo uinfo hf hfs where \n dfs: \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\" \"t = HVF hf\"\n by(auto simp add: ik_hfs_def)\n then obtain uinfo where \"hfs_valid_prefix ainfo uinfo [] hfs = hfs\" \"(ainfo, AHIS hfs) \\ auth_seg0\"\n by(auto simp add: auth_seg2_def)\n then show \"?rhs\" using asm dfs\n by (auto 3 4 simp add: auth_seg2_def intro!: ik_hfs_form exI[of _ hf]) \nqed(auto simp add: ik_hfs_def)\n\nlemma ik_uinfo_empty[simp]: \"ik_uinfo = {\\}\" \n by(auto simp add: ik_uinfo_def auth_seg2_def auth_restrict_def intro!: exI[of _ \"[]\"])\ndeclare ik_uinfo_def[simp del]\n\n(******************************************************************************)\nsubsubsection \\Properties of Intruder Knowledge\\\n(******************************************************************************)\nlemma auth_ainfo[dest]: \"\\(ainfo, hfs) \\ auth_seg2 uinfo\\ \\ \\ ts . ainfo = Num ts\"\n by(auto simp add: auth_seg2_def)\n\nlemma Num_ik[intro]: \"Num ts \\ ik\"\n by(auto simp add: ik_def auth_seg2_def auth_restrict_def intro!: exI[of _ \"[]\"])\n\ntext \\There are no ciphertexts (or signatures) in @{term \"parts ik\"}. Thus, @{term \"analz ik\"}\nand @{term \"parts ik\"} are identical.\\\nlemma analz_parts_ik[simp]: \"analz ik = parts ik\"\n by(rule no_crypt_analz_is_parts)\n (auto simp add: ik_def auth_seg2_def ik_hfs_simp auth_restrict_def)\n\nlemma parts_ik[simp]: \"parts ik = ik\"\n by(auto 3 4 simp add: ik_def auth_seg2_def auth_restrict_def dest!: parts_singleton_set)\n\nlemma sntag_synth_bad: \"sntag ahi \\ synth ik \\ ASID ahi \\ bad\"\n apply(cases ahi)\n by(auto simp add: ik_def ik_hfs_simp)\n\nlemma back_subst_set_member: \"\\hf' \\ set hfs; hf' = hf\\ \\ hf \\ set hfs\" by simp\n\nlemma sntag_asid: \"sntag hf = sntag hf' \\ ASID hf' = ASID hf\" apply(cases hf, cases hf') by auto\n\nlemma map_hf2term_eq: \"map (\\x. hf2term (AHI x)) hfs = map (\\x. hf2term (AHI x)) hfs'\n\\ AHIS hfs' = AHIS hfs\" apply(induction hfs hfs' rule: list_induct2', auto) \n using term2hf_hf2term by (metis)\n(******************************************************************************)\nsubsection\\Direct proof goals for interpretation of @{text \"dataplane_3_undirected\"}\\\n(******************************************************************************)\n\nlemma COND_honest_hf_analz:\n assumes \"ASID (AHI hf) \\ bad\" \"hf_valid ainfo uinfo hfs hf\" \"terms_hf hf \\ synth (analz ik)\"\n \"no_oracle ainfo uinfo\" \"hf \\ set hfs\"\n shows \"terms_hf hf \\ analz ik\"\nproof-\n from assms(3) have hf_synth_ik: \"HVF hf \\ synth ik\" by auto\n then have \"\\hfs uinfo. hf \\ set hfs \\ (ainfo, hfs) \\ auth_seg2 uinfo\"\n using assms(1,2,4,5) \n apply(auto simp add: ik_def hf_valid_invert ik_hfs_simp)\n subgoal for ts' hf' hfs'\n apply (auto intro!: exI[of _ hfs'])\n apply(frule back_subst_set_member[where hfs=\"hfs'\"])\n apply(rule HF.equality)\n apply auto\n apply(drule sntag_asid)\n apply(drule map_hf2term_eq)\n using auth_seg0_no_dups \n by (metis (mono_tags, lifting) AHIS_set_rev HF.surjective auth_seg20 old.unit.exhaust)\n by(auto simp add: ik_hfs_simp ik_def hf_valid_invert sntag_synth_bad)\n then have \"HVF hf \\ ik\"\n using assms(2)\n by(auto simp add: ik_hfs_def intro!: ik_ik_hfs intro!: exI) \n then show ?thesis by auto\nqed\n\nlemma COND_terms_hf: \n assumes \"hf_valid ainfo uinfo hfs hf\" and \"HVF hf \\ ik\" and \"no_oracle ainfo uinfo\" and \"hf \\ set hfs\"\n shows \"\\hfs. hf \\ set hfs \\ (\\uinfo' . (ainfo, hfs) \\ auth_seg2 uinfo')\"\n using assms apply(auto 3 4 simp add: hf_valid_invert ik_hfs_simp ik_def dest: ahi_eq)\n subgoal for ts' hf' hfs'\n apply (auto intro!: exI[of _ hfs'])\n apply(frule back_subst_set_member[where hfs=\"hfs'\"])\n apply auto\n apply(rule HF.equality)\n apply auto\n apply(drule sntag_asid)\n apply(drule map_hf2term_eq)\n using auth_seg0_no_dups \n by (metis (mono_tags, lifting) AHIS_set_rev HF.surjective auth_seg20 old.unit.exhaust)\n done\n\nlemma COND_extr:\n \"\\hf_valid ainfo uinfo l hf\\ \\ extr (HVF hf) = AHIS l\"\n by(auto simp add: hf_valid_invert)\n\nlemma COND_hf_valid_uinfo:\n \"\\hf_valid ainfo uinfo l hf; hf_valid ainfo' uinfo' l' hf\\ \n \\ uinfo' = uinfo\"\n by(auto simp add: hf_valid_invert)\n\n(******************************************************************************)\nsubsection\\Instantiation of @{text \"dataplane_3_undirected\"} locale\\\n(******************************************************************************)\nprint_locale dataplane_3_undirected\nsublocale\n dataplane_3_undirected _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo term_ainfo terms_uinfo ik_add terms_hf \n ik_oracle no_oracle\n apply unfold_locales\n using COND_terms_hf COND_honest_hf_analz COND_extr COND_hf_valid_uinfo by auto\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/instances/ICING_variant2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4687906266262438, "lm_q1q2_score": 0.27960226837805585}} {"text": "theory Scratch\n imports Main \"HOL-Library.Mapping\"\nbegin\n\nfun reverse :: \"'a list => 'a list\" where\n \"reverse [] = []\" |\n \"reverse (x # xs) = reverse xs @ [x]\"\n\nvalue \"reverse [1::nat, 2, 3]\"\n\nvalue \"reverse (a # xs)\"\n\nlemma rev1: \"reverse (xs @ [a]) = a # reverse xs\"\n apply(induct xs)\n apply auto\n done\n\ntheorem \"reverse (reverse xs) = xs\"\n apply(induct xs)\n apply auto\n by (simp add:rev1)\n\ntype_synonym word = nat\ntype_synonym addr = nat\ntype_synonym buffer = \"nat list\"\ntype_synonym contract = buffer\n\nrecord frameState =\n contract :: addr\n codeContract :: addr\n code :: buffer\n pc :: nat\n stack :: \"nat list\"\n memory :: buffer\n memorySize :: nat\n calldata :: buffer\n callvalue :: nat\n caller :: addr\n gas :: nat\n returndata :: buffer\n static :: bool\n\nrecord subState =\n selfdestructs :: \"addr list\"\n touchedAccounts :: \"addr list\"\n\n(* refunds :: \"(addr, word) list\" *)\n\n\nrecord creationContext =\n creationContextCodehash :: word\n creationContextReversion :: \"(addr, buffer) mapping\"\n creationContextSubstate :: subState\n\nrecord callContext =\n callContextTarget :: addr\n callContextContext :: addr\n callContextOffset :: word\n callContextSize :: word\n callContextCodehash :: word\n callContextAbi :: \"word option\"\n callContextData :: buffer\n callContextReversion :: \"(addr, contract) mapping\"\n callContextSubState :: subState\n\ndatatype frameContext =\n CallContext \"callContext\"\n | CreationContext \"creationContext\"\n\n\nrecord frame =\n frameContext :: frameContext\n frameState :: frameState\n\ndatatype storageModel = ConcreteS | SymbolicS | InitialS\n\nrecord env =\n contracts :: \"(addr, contract) mapping\"\n chainId :: word\n storageModel :: storageModel\n sha3Crack :: \"(word, buffer) mapping\"\n\n(* keccakUsed :: [([SWord 8], SWord 256)] *)\n\n\nrecord block =\n coinbase :: addr\n timestamp :: word\n number :: word\n difficulty :: word\n gaslimit :: word\n maxCodeSize :: word\n(* schedule :: feeSchedule word*)\n\n\nrecord txState =\n gasprice :: word\n txgaslimit :: word\n origin :: addr\n toAddr :: addr\n val :: word\n substate :: subState\n isCreate :: bool\n txReversion :: \"(addr, contract) mapping\"\n\n\ndatatype error\n = BalanceTooLow word word\n | UnrecognizedOpcode word\n | SelfDestruction\n | StackUnderrun\n | BadJumpDestination\n | Revert buffer\n | NoSuchContract addr\n | OutOfGas word word\n | BadCheatCode \"word option\"\n | StackLimitExceeded\n | IllegalOverflow\n | StateChangeWhileStatic\n | InvalidMemoryAccess\n | CallDepthLimitReached\n | MaxCodeSizeExceeded word word\n | PrecompileFailure\n | UnexpectedSymbolicArg\n | DeadPath\n\ndatatype vmResult\n = VMFailure error\n | VMSuccess buffer\n\ndatatype log = Log addr buffer \"word list\"\n\nrecord vm =\n result :: \"vmResult option\"\n state :: frameState\n env :: env\n block :: block\n tx :: txState\n logs :: \"log list\"\n burned :: word\n\n\nend\n", "meta": {"author": "mhhf", "repo": "isabelle-test", "sha": "d93fe0fb0be099f04296d9c3377c07bf25636d88", "save_path": "github-repos/isabelle/mhhf-isabelle-test", "path": "github-repos/isabelle/mhhf-isabelle-test/isabelle-test-d93fe0fb0be099f04296d9c3377c07bf25636d88/test01/Scratch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.27957006238958393}} {"text": "theory Example_NetModel\nimports \"../TopoS_Interface\" \"../TopoS_Helper\"\nbegin\n\ntext{* A toy example that defines a valid network security requirement model *}\n\ndefinition default_node_properties :: \"bool\"\n where \"default_node_properties \\ False\"\n\nfun sinvar :: \"'v graph \\ ('v \\ bool) \\ bool\" where\n \"sinvar G nP = (\\ (e1,e2) \\ (edges G). (nP e1) \\ (nP e2))\"\n\nfun verify_globals :: \"'v graph \\ ('v \\ bool) \\ 'b \\ bool\" where\n \"verify_globals _ _ _ = True\"\n\n(* we will not define receiver_violation!! Works for both! *)\n\n\n\n\n \n-- \"The preliminaries: mostly, sinvar is monotonic\"\ninterpretation SecurityInvariant_preliminaries\nwhere sinvar = sinvar\nand verify_globals = verify_globals\n apply unfold_locales\n apply(frule_tac finite_distinct_list[OF valid_graph.finiteE])\n apply(erule_tac exE)\n apply(rename_tac list_edges)\n apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_mono])\n apply(auto)[6]\n apply(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def graph_ops)[2]\n apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_mono])\ndone\n\n\n-- \"With generic target focus\"\ninterpretation Example_NetModel: SecurityInvariant\nwhere default_node_properties = default_node_properties\nand sinvar = sinvar\nand verify_globals = verify_globals\nand receiver_violation = receiver_violation (*yep, that's a variable*)\n unfolding default_node_properties_def\n apply unfold_locales\n\n -- \"Secure bydefault\"\n apply(simp)\n apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply (simp add: graph_ops)\n apply (simp split: split_split_asm split_split)\n apply blast\n\n -- \"Uniqueness\"\n apply(simp add:default_node_properties_def)\n apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply (simp add: graph_ops)\n apply (simp split: split_split_asm split_split)\n -- \"proof by counter example: assume False is not the unique default parameter\"\n apply(rule_tac x=\"\\ nodes={vertex_1}, edges = {(vertex_1,vertex_1)} \\\" in exI, simp)\n apply(rule conjI)\n apply(simp add: valid_graph_def)\n apply(rule_tac x=\"(\\ x. default_node_properties)(vertex_1 := False)\" in exI, simp add:default_node_properties_def)\n apply(case_tac receiver_violation)\n apply(simp_all)\n apply(rule_tac x=\"{(vertex_1,vertex_1)}\" in exI, simp)+\ndone\n\n\ntext{*And we end up with a totally useless network security requirement model. I hope this was instructive.*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Examples/Example_NetModel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6992544085240401, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2795700523665314}} {"text": "(* Title: ZF/UNITY/SubstAx.thy\n Author: Sidi O Ehmety, Computer Laboratory\n Copyright 2001 University of Cambridge\n\nTheory ported from HOL.\n*)\n\nsection\\Weak LeadsTo relation (restricted to the set of reachable states)\\\n\ntheory SubstAx\nimports WFair Constrains\nbegin\n\ndefinition\n (* The definitions below are not `conventional', but yield simpler rules *)\n Ensures :: \"[i,i] => i\" (infixl \\Ensures\\ 60) where\n \"A Ensures B == {F \\ program. F \\ (reachable(F) \\ A) ensures (reachable(F) \\ B) }\"\n\ndefinition\n LeadsTo :: \"[i, i] => i\" (infixl \\\\w\\ 60) where\n \"A \\w B == {F \\ program. F:(reachable(F) \\ A) \\ (reachable(F) \\ B)}\"\n\n\n(*Resembles the previous definition of LeadsTo*)\n\n(* Equivalence with the HOL-like definition *)\nlemma LeadsTo_eq:\n\"st_set(B)==> A \\w B = {F \\ program. F:(reachable(F) \\ A) \\ B}\"\napply (unfold LeadsTo_def)\napply (blast dest: psp_stable2 leadsToD2 constrainsD2 intro: leadsTo_weaken)\ndone\n\nlemma LeadsTo_type: \"A \\w B <=program\"\nby (unfold LeadsTo_def, auto)\n\n(*** Specialized laws for handling invariants ***)\n\n(** Conjoining an Always property **)\nlemma Always_LeadsTo_pre: \"F \\ Always(I) ==> (F:(I \\ A) \\w A') \\ (F \\ A \\w A')\"\nby (simp add: LeadsTo_def Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\n\nlemma Always_LeadsTo_post: \"F \\ Always(I) ==> (F \\ A \\w (I \\ A')) \\ (F \\ A \\w A')\"\napply (unfold LeadsTo_def)\napply (simp add: Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\ndone\n\n(* Like 'Always_LeadsTo_pre RS iffD1', but with premises in the good order *)\nlemma Always_LeadsToI: \"[| F \\ Always(C); F \\ (C \\ A) \\w A' |] ==> F \\ A \\w A'\"\nby (blast intro: Always_LeadsTo_pre [THEN iffD1])\n\n(* Like 'Always_LeadsTo_post RS iffD2', but with premises in the good order *)\nlemma Always_LeadsToD: \"[| F \\ Always(C); F \\ A \\w A' |] ==> F \\ A \\w (C \\ A')\"\nby (blast intro: Always_LeadsTo_post [THEN iffD2])\n\n(*** Introduction rules \\ Basis, Trans, Union ***)\n\nlemma LeadsTo_Basis: \"F \\ A Ensures B ==> F \\ A \\w B\"\nby (auto simp add: Ensures_def LeadsTo_def)\n\nlemma LeadsTo_Trans:\n \"[| F \\ A \\w B; F \\ B \\w C |] ==> F \\ A \\w C\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply (blast intro: leadsTo_Trans)\ndone\n\nlemma LeadsTo_Union:\n\"[|(!!A. A \\ S ==> F \\ A \\w B); F \\ program|]==>F \\ \\(S) \\w B\"\napply (simp add: LeadsTo_def)\napply (subst Int_Union_Union2)\napply (rule leadsTo_UN, auto)\ndone\n\n(*** Derived rules ***)\n\nlemma leadsTo_imp_LeadsTo: \"F \\ A \\ B ==> F \\ A \\w B\"\napply (frule leadsToD2, clarify)\napply (simp (no_asm_simp) add: LeadsTo_eq)\napply (blast intro: leadsTo_weaken_L)\ndone\n\n(*Useful with cancellation, disjunction*)\nlemma LeadsTo_Un_duplicate: \"F \\ A \\w (A' \\ A') ==> F \\ A \\w A'\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_Un_duplicate2:\n \"F \\ A \\w (A' \\ C \\ C) ==> F \\ A \\w (A' \\ C)\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_UN:\n \"[|(!!i. i \\ I ==> F \\ A(i) \\w B); F \\ program|]\n ==>F:(\\i \\ I. A(i)) \\w B\"\napply (simp add: LeadsTo_def)\napply (simp (no_asm_simp) del: UN_simps add: Int_UN_distrib)\napply (rule leadsTo_UN, auto)\ndone\n\n(*Binary union introduction rule*)\nlemma LeadsTo_Un:\n \"[| F \\ A \\w C; F \\ B \\w C |] ==> F \\ (A \\ B) \\w C\"\napply (subst Un_eq_Union)\napply (rule LeadsTo_Union)\napply (auto dest: LeadsTo_type [THEN subsetD])\ndone\n\n(*Lets us look at the starting state*)\nlemma single_LeadsTo_I:\n \"[|(!!s. s \\ A ==> F:{s} \\w B); F \\ program|]==>F \\ A \\w B\"\napply (subst UN_singleton [symmetric], rule LeadsTo_UN, auto)\ndone\n\nlemma subset_imp_LeadsTo: \"[| A \\ B; F \\ program |] ==> F \\ A \\w B\"\napply (simp (no_asm_simp) add: LeadsTo_def)\napply (blast intro: subset_imp_leadsTo)\ndone\n\nlemma empty_LeadsTo: \"F \\ 0 \\w A \\ F \\ program\"\nby (auto dest: LeadsTo_type [THEN subsetD]\n intro: empty_subsetI [THEN subset_imp_LeadsTo])\ndeclare empty_LeadsTo [iff]\n\nlemma LeadsTo_state: \"F \\ A \\w state \\ F \\ program\"\nby (auto dest: LeadsTo_type [THEN subsetD] simp add: LeadsTo_eq)\ndeclare LeadsTo_state [iff]\n\nlemma LeadsTo_weaken_R: \"[| F \\ A \\w A'; A'<=B'|] ==> F \\ A \\w B'\"\napply (unfold LeadsTo_def)\napply (auto intro: leadsTo_weaken_R)\ndone\n\nlemma LeadsTo_weaken_L: \"[| F \\ A \\w A'; B \\ A |] ==> F \\ B \\w A'\"\napply (unfold LeadsTo_def)\napply (auto intro: leadsTo_weaken_L)\ndone\n\nlemma LeadsTo_weaken: \"[| F \\ A \\w A'; B<=A; A'<=B' |] ==> F \\ B \\w B'\"\nby (blast intro: LeadsTo_weaken_R LeadsTo_weaken_L LeadsTo_Trans)\n\nlemma Always_LeadsTo_weaken:\n\"[| F \\ Always(C); F \\ A \\w A'; C \\ B \\ A; C \\ A' \\ B' |]\n ==> F \\ B \\w B'\"\napply (blast dest: Always_LeadsToI intro: LeadsTo_weaken Always_LeadsToD)\ndone\n\n(** Two theorems for \"proof lattices\" **)\n\nlemma LeadsTo_Un_post: \"F \\ A \\w B ==> F:(A \\ B) \\w B\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_Un subset_imp_LeadsTo)\n\nlemma LeadsTo_Trans_Un: \"[| F \\ A \\w B; F \\ B \\w C |]\n ==> F \\ (A \\ B) \\w C\"\napply (blast intro: LeadsTo_Un subset_imp_LeadsTo LeadsTo_weaken_L LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\ndone\n\n(** Distributive laws **)\nlemma LeadsTo_Un_distrib: \"(F \\ (A \\ B) \\w C) \\ (F \\ A \\w C & F \\ B \\w C)\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_L)\n\nlemma LeadsTo_UN_distrib: \"(F \\ (\\i \\ I. A(i)) \\w B) \\ (\\i \\ I. F \\ A(i) \\w B) & F \\ program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_UN LeadsTo_weaken_L)\n\nlemma LeadsTo_Union_distrib: \"(F \\ \\(S) \\w B) \\ (\\A \\ S. F \\ A \\w B) & F \\ program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_Union LeadsTo_weaken_L)\n\n(** More rules using the premise \"Always(I)\" **)\n\nlemma EnsuresI: \"[| F:(A-B) Co (A \\ B); F \\ transient (A-B) |] ==> F \\ A Ensures B\"\napply (simp add: Ensures_def Constrains_eq_constrains)\napply (blast intro: ensuresI constrains_weaken transient_strengthen dest: constrainsD2)\ndone\n\nlemma Always_LeadsTo_Basis: \"[| F \\ Always(I); F \\ (I \\ (A-A')) Co (A \\ A');\n F \\ transient (I \\ (A-A')) |]\n ==> F \\ A \\w A'\"\napply (rule Always_LeadsToI, assumption)\napply (blast intro: EnsuresI LeadsTo_Basis Always_ConstrainsD [THEN Constrains_weaken] transient_strengthen)\ndone\n\n(*Set difference: maybe combine with leadsTo_weaken_L??\n This is the most useful form of the \"disjunction\" rule*)\nlemma LeadsTo_Diff:\n \"[| F \\ (A-B) \\w C; F \\ (A \\ B) \\w C |] ==> F \\ A \\w C\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken)\n\nlemma LeadsTo_UN_UN:\n \"[|(!!i. i \\ I ==> F \\ A(i) \\w A'(i)); F \\ program |]\n ==> F \\ (\\i \\ I. A(i)) \\w (\\i \\ I. A'(i))\"\napply (rule LeadsTo_Union, auto)\napply (blast intro: LeadsTo_weaken_R)\ndone\n\n(*Binary union version*)\nlemma LeadsTo_Un_Un:\n \"[| F \\ A \\w A'; F \\ B \\w B' |] ==> F:(A \\ B) \\w (A' \\ B')\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_R)\n\n(** The cancellation law **)\n\nlemma LeadsTo_cancel2: \"[| F \\ A \\w(A' \\ B); F \\ B \\w B' |] ==> F \\ A \\w (A' \\ B')\"\nby (blast intro: LeadsTo_Un_Un subset_imp_LeadsTo LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\n\nlemma Un_Diff: \"A \\ (B - A) = A \\ B\"\nby auto\n\nlemma LeadsTo_cancel_Diff2: \"[| F \\ A \\w (A' \\ B); F \\ (B-A') \\w B' |] ==> F \\ A \\w (A' \\ B')\"\napply (rule LeadsTo_cancel2)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Un_Diff)\ndone\n\nlemma LeadsTo_cancel1: \"[| F \\ A \\w (B \\ A'); F \\ B \\w B' |] ==> F \\ A \\w (B' \\ A')\"\napply (simp add: Un_commute)\napply (blast intro!: LeadsTo_cancel2)\ndone\n\nlemma Diff_Un2: \"(B - A) \\ A = B \\ A\"\nby auto\n\nlemma LeadsTo_cancel_Diff1: \"[| F \\ A \\w (B \\ A'); F \\ (B-A') \\w B' |] ==> F \\ A \\w (B' \\ A')\"\napply (rule LeadsTo_cancel1)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Diff_Un2)\ndone\n\n(** The impossibility law **)\n\n(*The set \"A\" may be non-empty, but it contains no reachable states*)\nlemma LeadsTo_empty: \"F \\ A \\w 0 ==> F \\ Always (state -A)\"\napply (simp (no_asm_use) add: LeadsTo_def Always_eq_includes_reachable)\napply (cut_tac reachable_type)\napply (auto dest!: leadsTo_empty)\ndone\n\n(** PSP \\ Progress-Safety-Progress **)\n\n(*Special case of PSP \\ Misra's \"stable conjunction\"*)\nlemma PSP_Stable: \"[| F \\ A \\w A'; F \\ Stable(B) |]==> F:(A \\ B) \\w (A' \\ B)\"\napply (simp add: LeadsTo_def Stable_eq_stable, clarify)\napply (drule psp_stable, assumption)\napply (simp add: Int_ac)\ndone\n\nlemma PSP_Stable2: \"[| F \\ A \\w A'; F \\ Stable(B) |] ==> F \\ (B \\ A) \\w (B \\ A')\"\napply (simp (no_asm_simp) add: PSP_Stable Int_ac)\ndone\n\nlemma PSP: \"[| F \\ A \\w A'; F \\ B Co B'|]==> F \\ (A \\ B') \\w ((A' \\ B) \\ (B' - B))\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains)\napply (blast dest: psp intro: leadsTo_weaken)\ndone\n\nlemma PSP2: \"[| F \\ A \\w A'; F \\ B Co B' |]==> F:(B' \\ A) \\w ((B \\ A') \\ (B' - B))\"\nby (simp (no_asm_simp) add: PSP Int_ac)\n\nlemma PSP_Unless:\n\"[| F \\ A \\w A'; F \\ B Unless B'|]==> F:(A \\ B) \\w ((A' \\ B) \\ B')\"\napply (unfold op_Unless_def)\napply (drule PSP, assumption)\napply (blast intro: LeadsTo_Diff LeadsTo_weaken subset_imp_LeadsTo)\ndone\n\n(*** Induction rules ***)\n\n(** Meta or object quantifier ????? **)\nlemma LeadsTo_wf_induct: \"[| wf(r);\n \\m \\ I. F \\ (A \\ f-``{m}) \\w\n ((A \\ f-``(converse(r) `` {m})) \\ B);\n field(r)<=I; A<=f-``I; F \\ program |]\n ==> F \\ A \\w B\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply auto\napply (erule_tac I = I and f = f in leadsTo_wf_induct, safe)\napply (drule_tac [2] x = m in bspec, safe)\napply (rule_tac [2] A' = \"reachable (F) \\ (A \\ f -`` (converse (r) ``{m}) \\ B) \" in leadsTo_weaken_R)\napply (auto simp add: Int_assoc)\ndone\n\n\nlemma LessThan_induct: \"[| \\m \\ nat. F:(A \\ f-``{m}) \\w ((A \\ f-``m) \\ B);\n A<=f-``nat; F \\ program |] ==> F \\ A \\w B\"\napply (rule_tac A1 = nat and f1 = \"%x. x\" in wf_measure [THEN LeadsTo_wf_induct])\napply (simp_all add: nat_measure_field)\napply (simp add: ltI Image_inverse_lessThan vimage_def [symmetric])\ndone\n\n\n(******\n To be ported ??? I am not sure.\n\n integ_0_le_induct\n LessThan_bounded_induct\n GreaterThan_bounded_induct\n\n*****)\n\n(*** Completion \\ Binary and General Finite versions ***)\n\nlemma Completion: \"[| F \\ A \\w (A' \\ C); F \\ A' Co (A' \\ C);\n F \\ B \\w (B' \\ C); F \\ B' Co (B' \\ C) |]\n ==> F \\ (A \\ B) \\w ((A' \\ B') \\ C)\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains Int_Un_distrib)\napply (blast intro: completion leadsTo_weaken)\ndone\n\nlemma Finite_completion_aux:\n \"[| I \\ Fin(X);F \\ program |]\n ==> (\\i \\ I. F \\ (A(i)) \\w (A'(i) \\ C)) \\\n (\\i \\ I. F \\ (A'(i)) Co (A'(i) \\ C)) \\\n F \\ (\\i \\ I. A(i)) \\w ((\\i \\ I. A'(i)) \\ C)\"\napply (erule Fin_induct)\napply (auto simp del: INT_simps simp add: Inter_0)\napply (rule Completion, auto)\napply (simp del: INT_simps add: INT_extend_simps)\napply (blast intro: Constrains_INT)\ndone\n\nlemma Finite_completion:\n \"[| I \\ Fin(X); !!i. i \\ I ==> F \\ A(i) \\w (A'(i) \\ C);\n !!i. i \\ I ==> F \\ A'(i) Co (A'(i) \\ C);\n F \\ program |]\n ==> F \\ (\\i \\ I. A(i)) \\w ((\\i \\ I. A'(i)) \\ C)\"\nby (blast intro: Finite_completion_aux [THEN mp, THEN mp])\n\nlemma Stable_completion:\n \"[| F \\ A \\w A'; F \\ Stable(A');\n F \\ B \\w B'; F \\ Stable(B') |]\n ==> F \\ (A \\ B) \\w (A' \\ B')\"\napply (unfold Stable_def)\napply (rule_tac C1 = 0 in Completion [THEN LeadsTo_weaken_R])\n prefer 5\n apply blast\napply auto\ndone\n\nlemma Finite_stable_completion:\n \"[| I \\ Fin(X);\n (!!i. i \\ I ==> F \\ A(i) \\w A'(i));\n (!!i. i \\ I ==>F \\ Stable(A'(i))); F \\ program |]\n ==> F \\ (\\i \\ I. A(i)) \\w (\\i \\ I. A'(i))\"\napply (unfold Stable_def)\napply (rule_tac C1 = 0 in Finite_completion [THEN LeadsTo_weaken_R], simp_all)\napply (rule_tac [3] subset_refl, auto)\ndone\n\nML \\\n(*proves \"ensures/leadsTo\" properties when the program is specified*)\nfun ensures_tac ctxt sact =\n SELECT_GOAL\n (EVERY [REPEAT (Always_Int_tac ctxt 1),\n eresolve_tac ctxt @{thms Always_LeadsTo_Basis} 1\n ORELSE (*subgoal may involve LeadsTo, leadsTo or ensures*)\n REPEAT (ares_tac ctxt [@{thm LeadsTo_Basis}, @{thm leadsTo_Basis},\n @{thm EnsuresI}, @{thm ensuresI}] 1),\n (*now there are two subgoals: co & transient*)\n simp_tac (ctxt addsimps (Named_Theorems.get ctxt \\<^named_theorems>\\program\\)) 2,\n Rule_Insts.res_inst_tac ctxt\n [(((\"act\", 0), Position.none), sact)] [] @{thm transientI} 2,\n (*simplify the command's domain*)\n simp_tac (ctxt addsimps [@{thm domain_def}]) 3,\n (* proving the domain part *)\n clarify_tac ctxt 3,\n dresolve_tac ctxt @{thms swap} 3, force_tac ctxt 4,\n resolve_tac ctxt @{thms ReplaceI} 3, force_tac ctxt 3, force_tac ctxt 4,\n asm_full_simp_tac ctxt 3, resolve_tac ctxt @{thms conjI} 3, simp_tac ctxt 4,\n REPEAT (resolve_tac ctxt @{thms state_update_type} 3),\n constrains_tac ctxt 1,\n ALLGOALS (clarify_tac ctxt),\n ALLGOALS (asm_full_simp_tac (ctxt addsimps [@{thm st_set_def}])),\n ALLGOALS (clarify_tac ctxt),\n ALLGOALS (asm_lr_simp_tac ctxt)]);\n\\\n\nmethod_setup ensures = \\\n Args.goal_spec -- Scan.lift Args.embedded_inner_syntax >>\n (fn (quant, s) => fn ctxt => SIMPLE_METHOD'' quant (ensures_tac ctxt s))\n\\ \"for proving progress properties\"\n\nend\n", "meta": {"author": "landonf", "repo": "isabelle-legacy", "sha": "e40f3ca7e9a42bb91e57fd15f969388e6e83f692", "save_path": "github-repos/isabelle/landonf-isabelle-legacy", "path": "github-repos/isabelle/landonf-isabelle-legacy/isabelle-legacy-e40f3ca7e9a42bb91e57fd15f969388e6e83f692/src/ZF/UNITY/SubstAx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2793037475083248}} {"text": "theory Channel\n imports\n \"../Fused_Resource\"\nbegin\n\nsection \\Channel specification\\\n\nlocale ideal_channel =\n fixes \n (*TODO: decide to either include or exlude this fixation,\n - if it is not included, then the types must be manually stated whenever channel locale is imported (c.f. OTP and DH)\n - also, the WT_intro rules for channel will have an unspecified valid_messages*)\n (* valid_messages :: \"'msg set\" and*)\n leak :: \"'msg \\ 'leak\" and\n editable :: bool\nbegin\n\n\nsubsection \\Data-types for Parties, State, Events, Input, and Output\\\n\ndatatype party = Alice | Bob\n\ntype_synonym s_shell = \"party set\"\ndatatype 'msg' s_kernel = State_Void | State_Store 'msg' | State_Collect 'msg' | State_Collected\ntype_synonym 'msg' state = \"'msg' s_kernel \\ s_shell\"\n\ndatatype event = Event_Shell party\n\ndatatype iadv_drop = Inp_Drop\ndatatype iadv_look = Inp_Look\ndatatype 'msg' iadv_fedit = Inp_Fedit 'msg'\ntype_synonym 'msg' iadv = \"iadv_drop + iadv_look + 'msg' iadv_fedit\"\n\ndatatype 'msg' iusr_alice = Inp_Send 'msg'\ndatatype iusr_bob = Inp_Recv\ntype_synonym 'msg' iusr = \"'msg' iusr_alice + iusr_bob\"\n\ndatatype oadv_drop = Out_Drop\ndatatype 'leak' oadv_look = Out_Look 'leak'\ndatatype oadv_fedit = Out_Fedit\ntype_synonym 'leak' oadv = \"oadv_drop + 'leak' oadv_look + oadv_fedit\"\n\ndatatype ousr_alice = Out_Send\ndatatype 'msg' ousr_bob = Out_Recv 'msg'\ntype_synonym 'msg' ousr = \"ousr_alice + 'msg' ousr_bob\"\n\n\nsubsubsection \\Basic lemmas for automated handling of party sets (i.e. @{text s_shell})\\\n\nlemma Alice_neq_iff [simp]: \"Alice \\ x \\ x = Bob\"\n by(cases x) simp_all\n\nlemma neq_Alice_iff [simp]: \"x \\ Alice \\ x = Bob\"\n by(cases x) simp_all\n\nlemma Bob_neq_iff [simp]: \"Bob \\ x \\ x = Alice\"\n by(cases x) simp_all\n\nlemma neq_Bob_iff [simp]: \"x \\ Bob \\ x = Alice\"\n by(cases x) simp_all\n\nlemma Alice_in_iff_nonempty: \"Alice \\ A \\ A \\ {}\" if \"Bob \\ A\"\n using that by(auto)(metis (full_types) party.exhaust)\n\nlemma Bob_in_iff_nonempty: \"Bob \\ A \\ A \\ {}\" if \"Alice \\ A\"\n using that by(auto)(metis (full_types) party.exhaust)\n\n\nsubsection \\Defining the event handler\\\n\nfun poke :: \"('msg state, event) handler\"\n where\n \"poke (s_kernel, parties) (Event_Shell party) =\n (if party \\ parties then \n return_pmf None \n else \n return_spmf (s_kernel, insert party parties))\"\n\nlemma poke_alt_def:\n \"poke = (\\(s, ps) e. map_spmf (Pair s) (case e of Event_Shell party \\ if party \\ ps then return_pmf None else return_spmf (insert party ps)))\"\n by(simp add: fun_eq_iff split: event.split)\n\nsubsection \\Defining the adversary interfaces\\\n\nfun iface_drop :: \"('msg state, iadv_drop, oadv_drop) oracle'\"\n where\n \"iface_drop _ _ = return_pmf None\"\n\nfun iface_look :: \"('msg state, iadv_look, 'leak oadv_look) oracle'\"\n where\n \"iface_look (State_Store msg, parties) _ =\n return_spmf (Out_Look (leak msg), State_Store msg, parties)\"\n | \"iface_look _ _ = return_pmf None\"\n\nfun iface_fedit :: \"('msg state, 'msg iadv_fedit, oadv_fedit) oracle'\"\n where\n \"iface_fedit (State_Store msg, parties) (Inp_Fedit msg') = \n (if editable then\n return_spmf (Out_Fedit, State_Collect msg', parties)\n else\n return_spmf (Out_Fedit, State_Collect msg, parties))\"\n | \"iface_fedit _ _ = return_pmf None\"\n\nabbreviation iface_adv :: \"('msg state, 'msg iadv, 'leak oadv) oracle'\"\n where\n \"iface_adv \\ plus_oracle iface_drop (plus_oracle iface_look iface_fedit)\"\n\nlemma in_set_spmf_iface_drop: \"ys' \\ set_spmf (iface_drop s x) \\ False\"\n by simp\n\nlemma in_set_spmf_iface_look: \"ys' \\ set_spmf (iface_look s x) \\\n (\\msg parties. s = (State_Store msg, parties) \\ ys' = (Out_Look (leak msg), State_Store msg, parties))\"\n by(cases \"(s, x)\" rule: iface_look.cases) simp_all\n\nlemma in_set_spmf_iface_fedit: \"ys' \\ set_spmf (iface_fedit s x) \\\n (\\msg parties msg'. s = (State_Store msg, parties) \\ x = (Inp_Fedit msg') \\\n ys' = (if editable then (Out_Fedit, State_Collect msg', parties) else (Out_Fedit, State_Collect msg, parties)))\"\n by(cases \"(s, x)\" rule: iface_fedit.cases) simp_all\n\nsubsection \\Defining the user interfaces\\\n\nfun iface_alice :: \"('msg state, 'msg iusr_alice, ousr_alice) oracle'\"\n where\n \"iface_alice (State_Void, parties) (Inp_Send msg) = \n (if Alice \\ parties then\n return_spmf (Out_Send, State_Store msg, parties)\n else\n return_pmf None)\"\n | \"iface_alice _ _ = return_pmf None\"\n\nfun iface_bob :: \"('msg state, iusr_bob, 'msg ousr_bob) oracle'\"\n where\n \"iface_bob (State_Collect msg, parties) _ = \n (if Bob \\ parties then\n return_spmf (Out_Recv msg, State_Collected, parties)\n else\n return_pmf None)\"\n | \"iface_bob _ _ = return_pmf None\"\n\nabbreviation iface_usr :: \"('msg state, 'msg iusr, 'msg ousr) oracle'\"\n where\n \"iface_usr \\ plus_oracle iface_alice iface_bob\"\n\nlemma in_set_spmf_iface_alice: \"ys' \\ set_spmf (iface_alice s x) \\\n (\\parties msg. s = (State_Void, parties) \\ x = Inp_Send msg \\ Alice \\ parties \\ ys' = (Out_Send, State_Store msg, parties))\"\n by(cases \"(s, x)\" rule: iface_alice.cases) simp_all\n\nlemma in_set_spmf_iface_bob: \"ys' \\ set_spmf (iface_bob s x) \\\n (\\msg parties. s = (State_Collect msg, parties) \\ Bob \\ parties \\ ys' = (Out_Recv msg, State_Collected, parties))\"\n by(cases \"(s, x)\" rule: iface_bob.cases) simp_all\n\nsubsection \\Defining the Fused Resource\\\n\nprimcorec core :: \"('msg state, event, 'msg iadv, 'msg iusr, 'leak oadv, 'msg ousr) core\" \n where\n \"cpoke core = poke\"\n | \"cfunc_adv core = iface_adv\"\n | \"cfunc_usr core = iface_usr\"\n\nsublocale fused_resource core \"(State_Void, {})\" .\n\n\nsubsubsection \\Lemma showing that the resulting resource is well-typed\\\n\nlemma WT_core [WT_intro]:\n \"WT_core (\\_full \\\\<^sub>\\ (\\_full \\\\<^sub>\\ \\_uniform (Inp_Fedit ` valid_messages) UNIV)) (\\_uniform (Inp_Send ` valid_messages) UNIV \\\\<^sub>\\ (\\_uniform UNIV (Out_Recv ` valid_messages)))\n (pred_prod (pred_s_kernel (\\msg. msg \\ valid_messages)) (\\_. True)) core\"\n apply(rule WT_core.intros)\n subgoal for s e s' by(cases \"(s, e)\" rule: poke.cases)(auto split: if_split_asm)\n subgoal for s x y s' by(cases \"(s, projl (projr x))\" rule: iface_look.cases)(auto split: if_split_asm)\n subgoal for s x y s' by(cases \"(s, projl x)\" rule: iface_alice.cases)(auto split: if_split_asm)\n done\n\nlemma WT_fuse [WT_intro]: \n assumes [WT_intro]: \"WT_rest \\_adv_rest \\_usr_rest I_rest rest\"\n shows \"((\\_full \\\\<^sub>\\ (\\_full \\\\<^sub>\\ \\_uniform (Inp_Fedit ` valid_messages) UNIV)) \\\\<^sub>\\ \\_adv_rest) \\\\<^sub>\\ \n ((\\_uniform (Inp_Send ` valid_messages) UNIV \\\\<^sub>\\ \\_uniform UNIV (Out_Recv ` valid_messages)) \\\\<^sub>\\ \\_usr_rest) \\res resource rest \\\"\n by(rule WT_intro)+ simp\n\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Specifications/Channel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.27930373356755983}} {"text": "theory Common_Primitive_Matcher\nimports Common_Primitive_Matcher_Generic\nbegin\n\n\nsubsection\\Primitive Matchers: IP Port Iface Matcher\\\n\n(*IPv4 matcher*)\nfun common_matcher :: \"('i::len common_primitive, ('i, 'a) tagged_packet_scheme) exact_match_tac\" where\n \"common_matcher (IIface i) p = bool_to_ternary (match_iface i (p_iiface p))\" |\n \"common_matcher (OIface i) p = bool_to_ternary (match_iface i (p_oiface p))\" |\n\n \"common_matcher (Src ip) p = bool_to_ternary (p_src p \\ ipt_iprange_to_set ip)\" |\n \"common_matcher (Dst ip) p = bool_to_ternary (p_dst p \\ ipt_iprange_to_set ip)\" |\n\n \"common_matcher (Prot proto) p = bool_to_ternary (match_proto proto (p_proto p))\" |\n\n \"common_matcher (Src_Ports (L4Ports proto ps)) p = bool_to_ternary (proto = p_proto p \\ p_sport p \\ ports_to_set ps)\" |\n \"common_matcher (Dst_Ports (L4Ports proto ps)) p = bool_to_ternary (proto = p_proto p \\ p_dport p \\ ports_to_set ps)\" |\n\n \"common_matcher (MultiportPorts (L4Ports proto ps)) p = bool_to_ternary (proto = p_proto p \\ (p_sport p \\ ports_to_set ps \\ p_dport p \\ ports_to_set ps))\" |\n\n \"common_matcher (L4_Flags flags) p = bool_to_ternary (match_tcp_flags flags (p_tcp_flags p))\" |\n\n \"common_matcher (CT_State S) p = bool_to_ternary (match_ctstate S (p_tag_ctstate p))\" |\n\n \"common_matcher (Extra _) p = TernaryUnknown\"\n\n\n\nlemma packet_independent_\\_unknown_common_matcher: \"packet_independent_\\_unknown common_matcher\"\n apply(simp add: packet_independent_\\_unknown_def)\n apply(clarify)\n apply(rename_tac a p1 p2)\n apply(case_tac a)\n apply(simp_all add: bool_to_ternary_Unknown)\n apply(rename_tac l4ports, case_tac l4ports; simp add: bool_to_ternary_Unknown; fail)+\n done\n\nlemma primitive_matcher_generic_common_matcher: \"primitive_matcher_generic common_matcher\"\n by unfold_locales simp_all\n\n (* What if we specify a port range where the start port is greater than the end port?\n For example, mathematically, {3 .. 2} = {}. Does iptables have the same behavior?\n For example, --source-port 1:0 raises an error on my system. For normal port specification, -m tcp, and -m multiport.\n There is also a manpage which states \"if the first port is greater than the second one they will be swapped.\"\n I also saw a system where such an empty port range (--source-port 1:0) was really this impossible range and caused a rule that could never match.\n Because \\ port. port \\ {}.\n The behaviour if the end of the port range is smaller than the start is not 100% consistent among iptables versions and different modules.\n In general, it would be best to raise an error if such a range occurs.\n *)\n\n text\\Warning: beware of the sloppy term `empty' portrange\\\n text\\An `empty' port range means it can never match! Basically, @{term \"MatchNot (Match (Src_Ports (L4Ports proto [(0,65535)])))\"} is False\\\n lemma \"\\ matches (common_matcher, \\) (MatchNot (Match (Src_Ports (L4Ports TCP [(0,65535)])))) a \n \\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {},\n p_payload = '''', p_tag_ctstate = CT_New\\\"\n by(simp add: primitive_matcher_generic_common_matcher primitive_matcher_generic.Ports_single_not)\n text\\An `empty' port range means it always matches! Basically, @{term \"(MatchNot (Match (Src_Ports (L4Ports any []))))\"} is True.\n This corresponds to firewall behavior, but usually you cannot specify an empty portrange in firewalls, but omission of portrange means no-port-restrictions, \n i.e. every port matches.\\\n lemma \"matches (common_matcher, \\) (MatchNot (Match (Src_Ports (L4Ports any [])))) a \n \\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {},\n p_payload = '''', p_tag_ctstate = CT_New\\\"\n by(simp add: primitive_matcher_generic_common_matcher primitive_matcher_generic.Ports_single_not)\n text\\If not a corner case, portrange matching is straight forward.\\\n lemma \"matches (common_matcher, \\) (Match (Src_Ports (L4Ports TCP [(1024,4096), (9999, 65535)]))) a \n \\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {},\n p_payload = '''', p_tag_ctstate = CT_New\\\"\n \"\\ matches (common_matcher, \\) (Match (Src_Ports (L4Ports TCP [(1024,4096), (9999, 65535)]))) a \n \\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=5000, p_dport=80, p_tcp_flags = {},\n p_payload = '''', p_tag_ctstate = CT_New\\\"\n \"\\matches (common_matcher, \\) (MatchNot (Match (Src_Ports (L4Ports TCP [(1024,4096), (9999, 65535)])))) a \n \\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {},\n p_payload = '''', p_tag_ctstate = CT_New\\\"\n by(simp_all add: primitive_matcher_generic_common_matcher primitive_matcher_generic.Ports_single_not primitive_matcher_generic.Ports_single)\n \n\n\n\ntext\\Lemmas when matching on @{term Src} or @{term Dst}\\\nlemma common_matcher_SrcDst_defined:\n \"common_matcher (Src m) p \\ TernaryUnknown\"\n \"common_matcher (Dst m) p \\ TernaryUnknown\"\n \"common_matcher (Src_Ports ps) p \\ TernaryUnknown\"\n \"common_matcher (Dst_Ports ps) p \\ TernaryUnknown\"\n \"common_matcher (MultiportPorts ps) p \\ TernaryUnknown\"\n apply(case_tac [!] m, case_tac [!] ps)\n apply(simp_all add: bool_to_ternary_Unknown)\n done\nlemma common_matcher_SrcDst_defined_simp:\n \"common_matcher (Src x) p \\ TernaryFalse \\ common_matcher (Src x) p = TernaryTrue\"\n \"common_matcher (Dst x) p \\ TernaryFalse \\ common_matcher (Dst x) p = TernaryTrue\"\napply (metis eval_ternary_Not.cases common_matcher_SrcDst_defined(1) ternaryvalue.distinct(1))\napply (metis eval_ternary_Not.cases common_matcher_SrcDst_defined(2) ternaryvalue.distinct(1))\ndone\n\n(*The primitive_matcher_generic does not know anything about IP addresses*)\nlemma match_simplematcher_SrcDst:\n \"matches (common_matcher, \\) (Match (Src X)) a p \\ p_src p \\ ipt_iprange_to_set X\"\n \"matches (common_matcher, \\) (Match (Dst X)) a p \\ p_dst p \\ ipt_iprange_to_set X\"\n by(simp_all add: match_raw_ternary bool_to_ternary_simps split: ternaryvalue.split)\nlemma match_simplematcher_SrcDst_not:\n \"matches (common_matcher, \\) (MatchNot (Match (Src X))) a p \\ p_src p \\ ipt_iprange_to_set X\"\n \"matches (common_matcher, \\) (MatchNot (Match (Dst X))) a p \\ p_dst p \\ ipt_iprange_to_set X\"\n apply(simp_all add: matches_case_ternaryvalue_tuple split: ternaryvalue.split)\n apply(case_tac [!] X)\n apply(simp_all add: bool_to_ternary_simps)\n done\nlemma common_matcher_SrcDst_Inter:\n \"(\\m\\set X. matches (common_matcher, \\) (Match (Src m)) a p) \\ p_src p \\ (\\x\\set X. ipt_iprange_to_set x)\"\n \"(\\m\\set X. matches (common_matcher, \\) (Match (Dst m)) a p) \\ p_dst p \\ (\\x\\set X. ipt_iprange_to_set x)\"\n by(simp_all add: match_raw_ternary bool_to_ternary_simps split: ternaryvalue.split)\n\n\n\n\n\nsubsection\\Basic optimisations\\\n text\\Perform very basic optimization. Remove matches to primitives which are essentially @{const MatchAny}\\\n fun optimize_primitive_univ :: \"'i::len common_primitive match_expr \\ 'i common_primitive match_expr\" where\n \"optimize_primitive_univ (Match (Src (IpAddrNetmask _ 0))) = MatchAny\" |\n \"optimize_primitive_univ (Match (Dst (IpAddrNetmask _ 0))) = MatchAny\" |\n (*missing: the other IPs ...*)\n \"optimize_primitive_univ (Match (IIface iface)) = (if iface = ifaceAny then MatchAny else (Match (IIface iface)))\" |\n \"optimize_primitive_univ (Match (OIface iface)) = (if iface = ifaceAny then MatchAny else (Match (OIface iface)))\" |\n (*missing: L4Ports. But this introduces a new match, which causes problems.\n \"optimize_primitive_univ (Match (Src_Ports (L4Ports proto [(s, e)]))) = (if s = 0 \\ e = 0xFFFF then (Match (Prot (Proto proto))) else (Match (Src_Ports (L4Ports proto [(s, e)]))))\" |\n \"optimize_primitive_univ (Match (Dst_Ports (L4Ports proto [(s, e)]))) = (if s = 0 \\ e = 0xFFFF then (Match (Prot (Proto proto))) else (Match (Dst_Ports (L4Ports proto [(s, e)]))))\" |*)\n \"optimize_primitive_univ (Match (Prot ProtoAny)) = MatchAny\" |\n \"optimize_primitive_univ (Match (L4_Flags (TCP_Flags m c))) = (if m = {} \\ c = {} then MatchAny else (Match (L4_Flags (TCP_Flags m c))))\" |\n \"optimize_primitive_univ (Match (CT_State ctstate)) = (if ctstate_is_UNIV ctstate then MatchAny else Match (CT_State ctstate))\" |\n \"optimize_primitive_univ (Match m) = Match m\" |\n (*\"optimize_primitive_univ (MatchNot (MatchNot m)) = (optimize_primitive_univ m)\" | --\"needed to preserve normalized condition\"*)\n \"optimize_primitive_univ (MatchNot m) = (MatchNot (optimize_primitive_univ m))\" |\n (*\"optimize_primitive_univ (MatchAnd (Match (Extra e1)) (Match (Extra e2))) = optimize_primitive_univ (Match (Extra (e1@'' ''@e2)))\" |\n -- \"can be done but normalization does not work afterwards\"*)\n \"optimize_primitive_univ (MatchAnd m1 m2) = MatchAnd (optimize_primitive_univ m1) (optimize_primitive_univ m2)\" |\n \"optimize_primitive_univ MatchAny = MatchAny\"\n\n lemma optimize_primitive_univ_unchanged_primitives:\n \"optimize_primitive_univ (Match a) = (Match a) \\ optimize_primitive_univ (Match a) = MatchAny\"\n by (induction \"(Match a)\" rule: optimize_primitive_univ.induct)\n (auto split: if_split_asm)\n \n \n lemma optimize_primitive_univ_correct_matchexpr: fixes m::\"'i::len common_primitive match_expr\"\n shows \"matches (common_matcher, \\) m = matches (common_matcher, \\) (optimize_primitive_univ m)\"\n proof(simp add: fun_eq_iff, clarify, rename_tac a p)\n fix a and p :: \"('i::len, 'a) tagged_packet_scheme\"\n have \"(max_word::16 word) = 65535\" by(simp add: max_word_def)\n hence port_range: \"\\s e port. s = 0 \\ e = 0xFFFF \\ (port::16 word) \\ 0xFFFF\" by simp\n have \"ternary_ternary_eval (map_match_tac common_matcher p m) = ternary_ternary_eval (map_match_tac common_matcher p (optimize_primitive_univ m))\"\n apply(induction m rule: optimize_primitive_univ.induct)\n by(simp_all add: port_range match_ifaceAny ipset_from_cidr_0 ctstate_is_UNIV)\n (*by(fastforce intro: arg_cong[where f=bool_to_ternary])+ if we add pots again*)\n thus \"matches (common_matcher, \\) m a p = matches (common_matcher, \\) (optimize_primitive_univ m) a p\"\n by(rule matches_iff_apply_f)\n qed\n \n corollary optimize_primitive_univ_correct: \"approximating_bigstep_fun (common_matcher, \\) p (optimize_matches optimize_primitive_univ rs) s = \n approximating_bigstep_fun (common_matcher, \\) p rs s\"\n using optimize_matches optimize_primitive_univ_correct_matchexpr by metis\n \n \nsubsection\\Abstracting over unknowns\\\n text\\remove @{const Extra} (i.e. @{const TernaryUnknown}) match expressions\\\n fun upper_closure_matchexpr :: \"action \\ 'i::len common_primitive match_expr \\ 'i common_primitive match_expr\" where\n \"upper_closure_matchexpr _ MatchAny = MatchAny\" |\n \"upper_closure_matchexpr Accept (Match (Extra _)) = MatchAny\" |\n \"upper_closure_matchexpr Reject (Match (Extra _)) = MatchNot MatchAny\" |\n \"upper_closure_matchexpr Drop (Match (Extra _)) = MatchNot MatchAny\" |\n \"upper_closure_matchexpr _ (Match m) = Match m\" |\n \"upper_closure_matchexpr Accept (MatchNot (Match (Extra _))) = MatchAny\" |\n \"upper_closure_matchexpr Drop (MatchNot (Match (Extra _))) = MatchNot MatchAny\" |\n \"upper_closure_matchexpr Reject (MatchNot (Match (Extra _))) = MatchNot MatchAny\" |\n \"upper_closure_matchexpr a (MatchNot (MatchNot m)) = upper_closure_matchexpr a m\" |\n \"upper_closure_matchexpr a (MatchNot (MatchAnd m1 m2)) = \n (let m1' = upper_closure_matchexpr a (MatchNot m1); m2' = upper_closure_matchexpr a (MatchNot m2) in\n (if m1' = MatchAny \\ m2' = MatchAny\n then MatchAny\n else \n if m1' = MatchNot MatchAny then m2' else\n if m2' = MatchNot MatchAny then m1'\n else\n MatchNot (MatchAnd (MatchNot m1') (MatchNot m2')))\n )\" |\n \"upper_closure_matchexpr _ (MatchNot m) = MatchNot m\" | \n \"upper_closure_matchexpr a (MatchAnd m1 m2) = MatchAnd (upper_closure_matchexpr a m1) (upper_closure_matchexpr a m2)\"\n \n lemma upper_closure_matchexpr_generic: \n \"a = Accept \\ a = Drop \\ remove_unknowns_generic (common_matcher, in_doubt_allow) a m = upper_closure_matchexpr a m\"\n by(induction a m rule: upper_closure_matchexpr.induct)\n (simp_all add: remove_unknowns_generic_simps2 bool_to_ternary_Unknown common_matcher_SrcDst_defined)\n \n fun lower_closure_matchexpr :: \"action \\ 'i::len common_primitive match_expr \\ 'i common_primitive match_expr\" where\n \"lower_closure_matchexpr _ MatchAny = MatchAny\" |\n \"lower_closure_matchexpr Accept (Match (Extra _)) = MatchNot MatchAny\" |\n \"lower_closure_matchexpr Reject (Match (Extra _)) = MatchAny\" |\n \"lower_closure_matchexpr Drop (Match (Extra _)) = MatchAny\" |\n \"lower_closure_matchexpr _ (Match m) = Match m\" |\n \"lower_closure_matchexpr Accept (MatchNot (Match (Extra _))) = MatchNot MatchAny\" |\n \"lower_closure_matchexpr Drop (MatchNot (Match (Extra _))) = MatchAny\" |\n \"lower_closure_matchexpr Reject (MatchNot (Match (Extra _))) = MatchAny\" |\n \"lower_closure_matchexpr a (MatchNot (MatchNot m)) = lower_closure_matchexpr a m\" |\n \"lower_closure_matchexpr a (MatchNot (MatchAnd m1 m2)) = \n (let m1' = lower_closure_matchexpr a (MatchNot m1); m2' = lower_closure_matchexpr a (MatchNot m2) in\n (if m1' = MatchAny \\ m2' = MatchAny\n then MatchAny\n else \n if m1' = MatchNot MatchAny then m2' else\n if m2' = MatchNot MatchAny then m1'\n else\n MatchNot (MatchAnd (MatchNot m1') (MatchNot m2')))\n )\" |\n \"lower_closure_matchexpr _ (MatchNot m) = MatchNot m\" | \n \"lower_closure_matchexpr a (MatchAnd m1 m2) = MatchAnd (lower_closure_matchexpr a m1) (lower_closure_matchexpr a m2)\"\n \n lemma lower_closure_matchexpr_generic: \n \"a = Accept \\ a = Drop \\ remove_unknowns_generic (common_matcher, in_doubt_deny) a m = lower_closure_matchexpr a m\"\n by(induction a m rule: lower_closure_matchexpr.induct)\n (simp_all add: remove_unknowns_generic_simps2 bool_to_ternary_Unknown common_matcher_SrcDst_defined)\n\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Primitive_Matchers/Common_Primitive_Matcher.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791787121629466, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.2792177507212934}} {"text": "subsection \\CISK (Controlled Interruptible Separation Kernel)\\\n\ntheory CISK\n imports ISK\nbegin\n\ntext \\\n This section presents a generic model of a Controlled Interruptible Separation Kernel (CISK).\n It formulates security, i.e., intransitive noninterference.\n For a presentation of this model, see Section 2 of~\\<^cite>\\\"Verbeek2013\"\\.\n\\\n\ntext \\\n First, a locale is defined that defines all generic functions and all proof obligations (see Section 2.3 of ~\\<^cite>\\\"Verbeek2013\"\\).\n\\\nlocale Controllable_Interruptible_Separation_Kernel = \\ \\CISK\\\nfixes kstep :: \"'state_t \\ 'action_t \\ 'state_t\" \\ \\Executes one atomic kernel action\\\n and output_f :: \"'state_t \\ 'action_t \\ 'output_t\" \\ \\Returns the observable behavior\\\n and s0 :: \"'state_t\" \\ \\The initial state\\\n and current :: \"'state_t => 'dom_t\" \\ \\Returns the currently active domain\\\n and cswitch :: \"time_t \\ 'state_t \\ 'state_t\" \\ \\Performs a context switch\\\n and interrupt :: \"time_t \\ bool\" \\ \\Returns t iff an interrupt occurs in the given state at the given time\\\n and kinvolved :: \"'action_t \\ 'dom_t set\" \\ \\Returns the set of domains that are involved in the given action\\\n and ifp :: \"'dom_t \\ 'dom_t \\ bool\" \\ \\The security policy.\\\n and vpeq :: \"'dom_t \\ 'state_t \\ 'state_t \\ bool\" \\ \\View partitioning equivalence\\\n and AS_set :: \"('action_t list) set\" \\ \\Returns a set of valid action sequences, i.e., the attack surface\\\n and invariant :: \"'state_t \\ bool\" \\ \\Returns an inductive state-invariant\\\n and AS_precondition :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns the preconditions under which the given action can be executed.\\ \n and aborting :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns true iff the action is aborted.\\\n and waiting :: \"'state_t \\ 'dom_t \\ 'action_t \\ bool\" \\ \\Returns true iff execution of the given action is delayed.\\\n and set_error_code :: \"'state_t \\ 'action_t \\ 'state_t\" \\ \\Sets an error code when actions are aborted.\\\nassumes vpeq_transitive: \" \\ a b c u. (vpeq u a b \\ vpeq u b c) \\ vpeq u a c\"\n and vpeq_symmetric: \"\\ a b u. vpeq u a b \\ vpeq u b a\"\n and vpeq_reflexive: \"\\ a u. vpeq u a a\"\n and ifp_reflexive: \"\\ u . ifp u u\" \n and weakly_step_consistent: \"\\ s t u a. vpeq u s t \\ vpeq (current s) s t \\ invariant s \\ AS_precondition s (current s) a \\ invariant t \\ AS_precondition t (current t) a \\ current s = current t \\ vpeq u (kstep s a) (kstep t a)\"\n and locally_respects: \"\\ a s u. \\ifp (current s) u \\ invariant s \\ AS_precondition s (current s) a \\ vpeq u s (kstep s a)\"\n and output_consistent: \"\\ a s t. vpeq (current s) s t \\ current s = current t \\ (output_f s a) = (output_f t a)\"\n and step_atomicity: \"\\ s a . current (kstep s a) = current s\"\n and cswitch_independent_of_state: \"\\ n s t . current s = current t \\ current (cswitch n s) = current (cswitch n t)\"\n and cswitch_consistency: \"\\ u s t n . vpeq u s t \\ vpeq u (cswitch n s) (cswitch n t)\"\n and empty_in_AS_set: \"[] \\ AS_set\"\n and invariant_s0: \"invariant s0\"\n and invariant_after_cswitch: \"\\ s n . invariant s \\ invariant (cswitch n s)\"\n and precondition_after_cswitch: \"\\ s d n a. AS_precondition s d a \\ AS_precondition (cswitch n s) d a\"\n and AS_prec_first_action: \"\\ s d aseq . invariant s \\ aseq \\ AS_set \\ aseq \\ [] \\ AS_precondition s d (hd aseq)\"\n and AS_prec_after_step: \"\\ s a a' . (\\ aseq \\ AS_set . is_sub_seq a a' aseq) \\ invariant s \\ AS_precondition s (current s) a \\ \\aborting s (current s) a \\ \\ waiting s (current s) a\\ AS_precondition (kstep s a) (current s) a'\"\n and AS_prec_dom_independent: \"\\ s d a a' . current s \\ d \\ AS_precondition s d a \\ AS_precondition (kstep s a') d a\"\n and spec_of_invariant: \"\\ s a . invariant s \\ invariant (kstep s a)\"\n and aborting_switch_independent: \"\\ n s . aborting (cswitch n s) = aborting s\"\n and aborting_error_update: \"\\ s d a' a . current s \\ d \\ aborting s d a \\ aborting (set_error_code s a') d a\"\n and aborting_after_step: \"\\ s a d . current s \\ d \\ aborting (kstep s a) d = aborting s d\" (* TODO: I think this PO can be removed *)\n and aborting_consistent: \"\\ s t u . vpeq u s t \\ aborting s u = aborting t u\"\n and waiting_switch_independent: \"\\ n s . waiting (cswitch n s) = waiting s\"\n and waiting_error_update: \"\\ s d a' a . current s \\ d \\ waiting s d a \\ waiting (set_error_code s a') d a\"\n and waiting_consistent: \"\\s t u a . vpeq (current s) s t \\ (\\ d \\ kinvolved a . vpeq d s t) \\ vpeq u s t \\ waiting s u a = waiting t u a\"\n and spec_of_waiting: \"\\ s a . waiting s (current s) a \\ kstep s a = s\"\n and set_error_consistent: \"\\ s t u a . vpeq u s t \\ vpeq u (set_error_code s a) (set_error_code t a)\"\n and set_error_locally_respects: \"\\ s u a . \\ifp (current s) u \\ vpeq u s (set_error_code s a)\"\n and current_set_error_code: \"\\ s a . current (set_error_code s a) = current s\"\n and precondition_after_set_error_code: \"\\ s d a a'. AS_precondition s d a \\ aborting s (current s) a' \\ AS_precondition (set_error_code s a') d a\"\n and invariant_after_set_error_code: \"\\ s a . invariant s \\ invariant (set_error_code s a)\"\n and involved_ifp: \"\\ s a . \\ d \\ (kinvolved a) . AS_precondition s (current s) a \\ ifp d (current s)\" \nbegin \n\nsubsubsection\\Execution semantics\\\n\ntext\\\n Control is based on generic functions \\emph{aborting}, \\emph{waiting} and \\emph{set\\_error\\_code}.\n Function \\emph{aborting} decides whether a certain action is aborting, given its domain and the state.\n If so, then function set\\_error\\_code will be used to update the state, possibly communicating to other domains that an action has been aborted.\n Function \\emph{waiting} can delay the execution of an action.\n This behavior is implemented in function CISK\\_control.\n\\\nfunction CISK_control :: \"'state_t \\ 'dom_t \\ 'action_t execution \\ ('action_t option \\ 'action_t execution \\ 'state_t)\"\nwhere \"CISK_control s d [] = (None,[],s)\" \\ \\The thread is empty\\\n | \"CISK_control s d ([]#[]) = (None,[],s)\" \\ \\The current action sequence has been finished and the thread has no next action sequences to execute\\\n | \"CISK_control s d ([]#(as'#execs')) = (None,as'#execs',s)\" \\ \\The current action sequence has been finished. Skip to the next sequence\\\n | \"CISK_control s d ((a#as)#execs') = (if aborting s d a then \n (None, execs',set_error_code s a)\n else if waiting s d a then\n (Some a, (a#as)#execs',s)\n else\n (Some a, as#execs',s))\" \\ \\Executing an action sequence\\\nby pat_completeness auto\ntermination by lexicographic_order\n\ntext\\\n Function \\emph{run} defines the execution semantics.\n This function is presented in ~\\<^cite>\\\"Verbeek2013\"\\ by pseudo code (see Algorithm 1).\n Before defining the run function, we define accessor functions for the control mechanism.\n Functions next\\_action, next\\_execs and next\\_state correspond to ``control.a'', ``control.x'' and ``control.s'' in ~\\<^cite>\\\"Verbeek2013\"\\.\n\\\nabbreviation next_action::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ 'action_t option\"\nwhere \"next_action \\ Kernel.next_action current CISK_control\"\nabbreviation next_execs::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ ('dom_t \\ 'action_t execution)\"\nwhere \"next_execs \\ Kernel.next_execs current CISK_control\"\nabbreviation next_state::\"'state_t \\ ('dom_t \\ 'action_t execution) \\ 'state_t\"\nwhere \"next_state \\ Kernel.next_state current CISK_control\"\ntext \\\n\\\ntext \\\n A thread is empty iff either it has no further action sequences to execute, or when the current action sequence is finished and there are no further action sequences to execute.\n\\\nabbreviation thread_empty::\"'action_t execution \\ bool\"\nwhere \"thread_empty exec \\ exec = [] \\ exec = [[]]\"\n\ntext\\\n The following function defines the execution semantics of CISK, using function CISK\\_control.\n\\\nfunction run :: \"time_t \\ 'state_t \\ ('dom_t \\ 'action_t execution) \\ 'state_t\"\nwhere \"run 0 s execs = s\"\n| \"interrupt (Suc n) \\ run (Suc n) s execs = run n (cswitch (Suc n) s) execs\"\n| \"\\interrupt (Suc n) \\ thread_empty(execs (current s)) \\ run (Suc n) s execs = run n s execs\"\n| \"\\interrupt (Suc n) \\ \\thread_empty(execs (current s)) \\\n run (Suc n) s execs = (let control_a = next_action s execs;\n control_s = next_state s execs;\n control_x = next_execs s execs in\n case control_a of None \\ run n control_s control_x\n | (Some a) \\ run n (kstep control_s a) control_x)\"\nusing not0_implies_Suc by (metis prod_cases3,auto)\ntermination by lexicographic_order\n\nsubsubsection \\Formulations of security\\\n\ntext\\\n The definitions of security as presented in Section 2.2 of~\\<^cite>\\\"Verbeek2013\"\\.\n\\\n\nabbreviation kprecondition\n where \"kprecondition s a \\ invariant s \\ AS_precondition s (current s) a\"\ndefinition realistic_execution\nwhere \"realistic_execution aseq \\ set aseq \\ AS_set\"\ndefinition realistic_executions :: \"('dom_t \\ 'action_t execution) \\ bool\"\nwhere \"realistic_executions execs \\ \\d. realistic_execution (execs d)\"\nabbreviation involved where \"involved \\ Kernel.involved kinvolved\"\nabbreviation step where \"step \\ Kernel.step kstep\"\nabbreviation purge where \"purge \\ Separation_Kernel.purge realistic_execution ifp\"\nabbreviation ipurge_l where \"ipurge_l \\ Separation_Kernel.ipurge_l kinvolved ifp\"\nabbreviation ipurge_r where \"ipurge_r \\ Separation_Kernel.ipurge_r realistic_execution kinvolved ifp\"\n\ndefinition NI_unrelated::bool\nwhere \"NI_unrelated\n \\ \\ execs a n . realistic_executions execs \\\n (let s_f = run n s0 execs in\n output_f s_f a = output_f (run n s0 (purge execs (current s_f))) a)\"\ndefinition NI_indirect_sources::bool\nwhere \"NI_indirect_sources\n \\ \\ execs a n. realistic_executions execs \\\n (let s_f = run n s0 execs in\n output_f (run n s0 (ipurge_l execs (current s_f))) a =\n output_f (run n s0 (ipurge_r execs (current s_f))) a)\"\ndefinition isecure::bool\nwhere \"isecure \\ NI_unrelated \\ NI_indirect_sources\"\n\n\nsubsubsection \\Proofs\\\ntext\\\n The final theorem is unwinding\\_implies\\_isecure\\_CISK.\n This theorem shows that any interpretation of locale CISK is secure.\n\n To prove this theorem, the refinement framework is used.\n CISK is a refinement of ISK, as the only idfference is the control function.\n In ISK, this function is a generic function called \\emph{control}, in CISK it is interpreted in function \\emph{CISK\\_control}.\n It is proven that function \\emph{CISK\\_control} satisfies all the proof obligations concerning generic function \\emph{control}.\n In other words, \\emph{CISK\\_control} is proven to be an interpretation of control.\n Therefore, all theorems on run\\_total apply to the run function of CISK as well.\n\\\n\nlemma next_action_consistent: \nshows \"\\ s t execs . vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ next_action s execs = next_action t execs\"\nproof-\n{\n fix s t execs\n assume vpeq: \"vpeq (current s) s t\"\n assume vpeq_involved: \"\\ d \\ involved (next_action s execs) . vpeq d s t\"\n assume current_s_t: \"current s = current t\"\n from aborting_consistent current_s_t vpeq\n have \"aborting t (current s) = aborting s (current s)\" by auto\n from current_s_t this waiting_consistent vpeq_involved\n have \"next_action s execs = next_action t execs\"\n unfolding Kernel.next_action_def \n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_execs_consistent:\nshows \"\\ s t execs . vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\nproof-\n{\n fix s t execs\n assume vpeq: \"vpeq (current s) s t\"\n assume vpeq_involved: \"\\ d \\ involved (next_action s execs) . vpeq d s t\"\n assume current_s_t: \"current s = current t\"\n from aborting_consistent current_s_t vpeq\n have 1: \"aborting t (current s) = aborting s (current s)\" by auto\n from 1 vpeq current_s_t vpeq_involved waiting_consistent[THEN spec,THEN spec,THEN spec,THEN spec,where x3=s and x2=t and x1=\"current s\" and x=\"the (next_action s execs)\"]\n have \"fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\n unfolding Kernel.next_action_def Kernel.involved_def\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_consistent:\nshows \"\\ s t u execs . vpeq (current s) s t \\ vpeq u s t \\ current s = current t \\ vpeq u (next_state s execs) (next_state t execs)\"\nproof-\n{\n fix s t u execs\n assume vpeq_s_t: \"vpeq (current s) s t \\ vpeq u s t\"\n assume current_s_t: \"current s = current t\"\n from vpeq_s_t current_s_t\n have \"vpeq u (next_state s execs) (next_state t execs)\"\n unfolding Kernel.next_state_def\n using aborting_consistent set_error_consistent\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma current_next_state:\nshows \"\\ s execs . current (next_state s execs) = current s\" \nproof-\n{\n fix s execs\n have \"current (next_state s execs) = current s\"\n unfolding Kernel.next_state_def\n using current_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma locally_respects_next_state:\nshows \"\\ s u execs. \\ifp (current s) u \\ vpeq u s (next_state s execs)\"\nproof-\n{\n fix s u execs\n assume \"\\ifp (current s) u\"\n hence \"vpeq u s (next_state s execs)\"\n unfolding Kernel.next_state_def\n using vpeq_reflexive set_error_locally_respects\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma CISK_control_spec:\nshows \"\\s d aseqs.\n case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\nproof-\n{\n fix s d aseqs\n have \"case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_after_cswitch:\nshows \"\\ s n d aseqs . fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\nproof-\n{\n fix s n d aseqs\n have \"fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\n using aborting_switch_independent waiting_switch_independent\n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\n\nlemma next_action_after_next_state:\nshows \"\\ s execs d . current s \\ d \\ fst (CISK_control (next_state s execs) d (execs d)) = None \\ fst (CISK_control (next_state s execs) d (execs d)) = fst (CISK_control s d (execs d))\"\nproof-\n{\n fix s execs d aseqs\n assume 1: \"current s \\ d\"\n have \"fst (CISK_control (next_state s execs) d aseqs) = None \\ fst (CISK_control (next_state s execs) d aseqs) = fst (CISK_control s d aseqs)\"\n proof(cases \"(s,d,aseqs)\" rule: CISK_control.cases,simp,simp,simp)\n case (4 sa da a as execs')\n thus ?thesis\n unfolding Kernel.next_state_def\n using aborting_error_update waiting_error_update 1\n by(cases \"(sa,current sa,execs (current sa))\" rule: CISK_control.cases,auto split: if_split_asm)\n qed\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_after_step:\nshows \"\\ s a d aseqs . current s \\ d \\ fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\nproof-\n{\n fix s a d aseqs\n assume 1: \"current s \\ d\"\n from this aborting_after_step \n have \"fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\n unfolding Kernel.step_def \n by(cases \"(s,d,aseqs)\" rule: CISK_control.cases,simp,simp,simp,cases a,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_precondition:\nshows \"\\s d a execs. AS_precondition s d a \\ AS_precondition (next_state s execs) d a\"\nproof-\n{\n fix s a d execs\n assume \"AS_precondition s d a\"\n hence \"AS_precondition (next_state s execs) d a\"\n unfolding Kernel.next_state_def\n using precondition_after_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_state_invariant:\nshows \"\\s execs. invariant s \\ invariant (next_state s execs)\"\nproof-\n{\n fix s execs\n assume \"invariant s\"\n hence \"invariant (next_state s execs)\"\n unfolding Kernel.next_state_def\n using invariant_after_set_error_code\n by(cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto)\n}\nthus ?thesis by auto\nqed\n\nlemma next_action_from_execs:\nshows \"\\ s execs . next_action s execs \\ (\\ a . a \\ actions_in_execution (execs (current s)))\"\nproof-\n{\n fix s execs\n {\n fix a\n assume 1: \"next_action s execs = Some a\"\n from 1 have \"a \\ actions_in_execution (execs (current s))\"\n unfolding Kernel.next_action_def actions_in_execution_def\n by (cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n }\n hence \"next_action s execs \\ (\\ a . a \\ actions_in_execution (execs (current s)))\"\n unfolding B_def\n by (cases \"next_action s execs\",auto)\n}\nthus ?thesis unfolding B_def by (auto)\nqed\n\nlemma next_execs_subset:\nshows \"\\s execs u . actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\nproof-\n{\n fix s execs u\n have \"actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\n unfolding Kernel.next_execs_def actions_in_execution_def\n by (cases \"(s,(current s),execs (current s))\" rule: CISK_control.cases,auto split: if_split_asm)\n}\nthus ?thesis by auto\nqed\n\n\ntheorem unwinding_implies_isecure_CISK:\nshows isecure\nproof-\n interpret int: Interruptible_Separation_Kernel kstep output_f s0 current cswitch interrupt kprecondition realistic_execution CISK_control kinvolved ifp vpeq AS_set invariant AS_precondition aborting waiting\n proof (unfold_locales)\n show \"\\a b c u. vpeq u a b \\ vpeq u b c \\ vpeq u a c\"\n using vpeq_transitive by blast\n show \"\\a b u. vpeq u a b \\ vpeq u b a\"\n using vpeq_symmetric by blast\n show \"\\a u. vpeq u a a\"\n using vpeq_reflexive by blast\n show \"\\u. ifp u u\"\n using ifp_reflexive by blast\n show \"\\ s t u a. vpeq u s t \\ vpeq (current s) s t \\ kprecondition s a \\ kprecondition t a \\ current s = current t \\ vpeq u (kstep s a) (kstep t a)\"\n using weakly_step_consistent by blast\n show \"\\ a s u. \\ifp (current s) u \\ kprecondition s a \\ vpeq u s (kstep s a)\"\n using locally_respects by blast\n show \"\\ a s t. vpeq (current s) s t \\ current s = current t \\ (output_f s a) = (output_f t a)\"\n using output_consistent by blast \n show \"\\ s a . current (kstep s a) = current s\"\n using step_atomicity by blast \n show \"\\ n s t . current s = current t \\ current (cswitch n s) = current (cswitch n t)\"\n using cswitch_independent_of_state by blast \n show \"\\ u s t n . vpeq u s t \\ vpeq u (cswitch n s) (cswitch n t)\"\n using cswitch_consistency by blast\n show \"\\s t execs. vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\ next_action s execs = next_action t execs\"\n using next_action_consistent by blast\n show \"\\s t execs.\n vpeq (current s) s t \\ (\\ d \\ involved (next_action s execs) . vpeq d s t) \\ current s = current t \\\n fst (snd (CISK_control s (current s) (execs (current s)))) = fst (snd (CISK_control t (current s) (execs (current s))))\"\n using next_execs_consistent by blast\n show \" \\s t u execs. vpeq (current s) s t \\ vpeq u s t \\ current s = current t \\ vpeq u (next_state s execs) (next_state t execs)\"\n using next_state_consistent by auto\n show \" \\s execs. current (next_state s execs) = current s\"\n using current_next_state by auto\n show \"\\s u execs. \\ ifp (current s) u \\ vpeq u s (next_state s execs)\"\n using locally_respects_next_state by auto\n show \"[] \\ AS_set\"\n using empty_in_AS_set by blast\n show \"\\ s n . invariant s \\ invariant (cswitch n s)\"\n using invariant_after_cswitch by blast\n show \"\\ s d n a. AS_precondition s d a \\ AS_precondition (cswitch n s) d a\"\n using precondition_after_cswitch by blast\n show \"invariant s0\"\n using invariant_s0 by blast\n show \"\\ s d aseq . invariant s \\ aseq \\ AS_set \\ aseq \\ [] \\ AS_precondition s d (hd aseq)\"\n using AS_prec_first_action by blast\n show \"\\s a a'. (\\aseq\\AS_set. is_sub_seq a a' aseq) \\ invariant s \\ AS_precondition s (current s) a \\ \\ aborting s (current s) a \\ \\ waiting s (current s) a \\\n AS_precondition (kstep s a) (current s) a'\"\n using AS_prec_after_step by blast \n show \"\\ s d a a' . current s \\ d \\ AS_precondition s d a \\ AS_precondition (kstep s a') d a\"\n using AS_prec_dom_independent by blast \n show \"\\ s a . invariant s \\ invariant (kstep s a)\"\n using spec_of_invariant by blast\n show \"\\s a. kprecondition s a \\ kprecondition s a\"\n by auto \n show \"\\aseq. realistic_execution aseq \\ set aseq \\ AS_set\"\n unfolding realistic_execution_def\n by auto\n show \"\\s a. \\ d \\ involved a. kprecondition s (the a) \\ ifp d (current s)\"\n using involved_ifp unfolding Kernel.involved_def by (auto split: option.splits)\n show \"\\s execs. next_action s execs \\ (\\a. a \\ actions_in_execution (execs (current s)))\"\n using next_action_from_execs by blast \n show \"\\s execs u. actions_in_execution (next_execs s execs u) \\ actions_in_execution (execs u)\"\n using next_execs_subset by blast \n show \"\\s d aseqs.\n case CISK_control s d aseqs of\n (a, aseqs', s') \\\n thread_empty aseqs \\ (a, aseqs') = (None, []) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ \\ aborting s' d (the a) \\ \\ waiting s' d (the a) \\ (a, aseqs') = (Some (hd (hd aseqs)), tl (hd aseqs) # tl aseqs) \\\n aseqs \\ [] \\ hd aseqs \\ [] \\ waiting s' d (the a) \\ (a, aseqs', s') = (Some (hd (hd aseqs)), aseqs, s) \\ (a, aseqs') = (None, tl aseqs)\"\n using CISK_control_spec by blast\n show \"\\s n d aseqs. fst (CISK_control (cswitch n s) d aseqs) = fst (CISK_control s d aseqs)\"\n using next_action_after_cswitch by auto\n show \"\\s execs d.\n current s \\ d \\\n fst (CISK_control (next_state s execs) d (execs d)) = None \\ fst (CISK_control (next_state s execs) d (execs d)) = fst (CISK_control s d (execs d))\"\n using next_action_after_next_state by auto\n show \"\\s a d aseqs. current s \\ d \\ fst (CISK_control (step s a) d aseqs) = fst (CISK_control s d aseqs)\"\n using next_action_after_step by auto\n show \"\\s d a execs. AS_precondition s d a \\ AS_precondition (next_state s execs) d a\"\n using next_state_precondition by auto\n show \"\\s execs. invariant s \\ invariant (next_state s execs)\"\n using next_state_invariant by auto\n show \"\\s a. waiting s (current s) a \\ kstep s a = s\"\n using spec_of_waiting by blast\n qed\n \n note interpreted = int.Interruptible_Separation_Kernel_axioms\n note run_total_induct = Interruptible_Separation_Kernel.run_total.induct[of kstep output_f s0 current cswitch kprecondition realistic_execution\n CISK_control kinvolved ifp vpeq AS_set invariant AS_precondition aborting waiting _ interrupt]\n have run_equals_run_total:\n \"\\ n s execs . run n s execs \\ Interruptible_Separation_Kernel.run_total kstep current cswitch interrupt CISK_control n s execs\"\n proof-\n fix n s execs\n show \"run n s execs \\ Interruptible_Separation_Kernel.run_total kstep current cswitch interrupt CISK_control n s execs\"\n using interpreted int.step_def\n by(induct n s execs rule: run_total_induct,auto split: option.splits)\n qed\n from interpreted\n have 0: \"Interruptible_Separation_Kernel.isecure_total kstep output_f s0 current cswitch interrupt realistic_execution CISK_control kinvolved ifp\"\n by (metis int.unwinding_implies_isecure_total)\n from 0 run_equals_run_total\n have 1: \"NI_unrelated\"\n by (metis realistic_executions_def int.isecure_total_def int.realistic_executions_def int.NI_unrelated_total_def NI_unrelated_def)\n from 0 run_equals_run_total\n have 2: \"NI_indirect_sources\"\n by (metis realistic_executions_def int.NI_indirect_sources_total_def int.isecure_total_def int.realistic_executions_def NI_indirect_sources_def)\n from 1 2 show ?thesis unfolding isecure_def by auto\nqed\n\nend\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CISC-Kernel/trace/Rushby-with-Control/CISK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.27919576383619693}} {"text": "(* Title: HOL/Auth/n_germanish_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanish Protocol Case Study*} \n\ntheory n_germanish_lemma_inv__1_on_rules imports n_germanish_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_t1 i)\\\n (\\ i. i\\N\\r=n_t2 i)\\\n (\\ i. i\\N\\r=n_t3 i)\\\n (\\ i. i\\N\\r=n_t4 i)\\\n (\\ i. i\\N\\r=n_t5 i)\\\n (\\ i. i\\N\\r=n_t6 N i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t2 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t2Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t3 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t3Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t4 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t4Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t5 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t5Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t6 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t6Vsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/germanish/n_germanish_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710234, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2791957580931744}} {"text": "theory Incredible_Completeness\nimports Natural_Deduction Incredible_Deduction Build_Incredible_Tree\nbegin\n\ntext \\\nThis theory takes the tree produced in @{theory Build_Incredible_Tree}, globalizes it using\n@{term globalize}, and then builds the incredible proof graph out of it.\n\\\n\ntype_synonym 'form vertex = \"('form \\ nat list)\"\ntype_synonym ('form, 'var) edge'' = \"('form vertex, 'form, 'var) edge'\"\n\nlocale Solved_Task =\n Abstract_Task freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP antecedent consequent rules assumptions conclusions\n for freshenLC :: \"nat \\ 'var \\ 'var\" \n and renameLCs :: \"('var \\ 'var) \\ 'form \\ 'form\" \n and lconsts :: \"'form \\ 'var set\" \n and closed :: \"'form \\ bool\"\n and subst :: \"'subst \\ 'form \\ 'form\" \n and subst_lconsts :: \"'subst \\ 'var set\" \n and subst_renameLCs :: \"('var \\ 'var) \\ ('subst \\ 'subst)\"\n and anyP :: \"'form\"\n and antecedent :: \"'rule \\ ('form, 'var) antecedent list\" \n and consequent :: \"'rule \\ 'form list\" \n and rules :: \"'rule stream\" \n and assumptions :: \"'form list\" \n and conclusions :: \"'form list\" +\n assumes solved: solved\nbegin\n\ntext \\Let us get our hand on concrete trees.\\\n\ndefinition ts :: \"'form \\ (('form entailment) \\ ('rule \\ 'form) NatRule) tree\" where\n \"ts c = (SOME t. snd (fst (root t)) = c \\ fst (fst (root t)) |\\| ass_forms \\ wf t \\ tfinite t)\"\n\nlemma\n assumes \"c |\\| conc_forms\"\n shows ts_conc: \"snd (fst (root (ts c))) = c\"\n and ts_context: \"fst (fst (root (ts c))) |\\| ass_forms\"\n and ts_wf: \"wf (ts c)\"\n and ts_finite[simp]: \"tfinite (ts c)\"\n unfolding atomize_conj conj_assoc ts_def\n apply (rule someI_ex)\n using solved assms\n by (force simp add: solved_def)\n\nabbreviation it' where\n \"it' c \\ globalize [fidx conc_forms c, 0] (freshenLC v_away) (to_it (ts c))\"\n\n\n\ndefinition vertices :: \"'form vertex fset\" where\n \"vertices = Abs_fset (Union ( set (map (\\ c. insert (c, []) ((\\ p. (c, 0 # p)) ` (it_paths (it' c)))) conclusions)))\"\n\nlemma mem_vertices: \"v |\\| vertices \\ (fst v \\ set conclusions \\ (snd v = [] \\ snd v \\ (op # 0) ` it_paths (it' (fst v))))\"\n unfolding vertices_def fmember.rep_eq ffUnion.rep_eq \n by (cases v)(auto simp add: Abs_fset_inverse Bex_def )\n\nlemma prefixeq_vertices: \"(c,is) |\\| vertices \\ prefixeq is' is \\ (c, is') |\\| vertices\"\n by (cases is') (auto simp add: mem_vertices intro!: imageI elim: it_paths_prefixeq)\n\nlemma none_vertices[simp]: \"(c, []) |\\| vertices \\ c \\ set conclusions\"\n by (simp add: mem_vertices)\n\nlemma some_vertices[simp]: \"(c, i#is) |\\| vertices \\ c \\ set conclusions \\ i = 0 \\ is \\ it_paths (it' c)\"\n by (auto simp add: mem_vertices)\n\nlemma vertices_cases[consumes 1, case_names None Some]:\n assumes \"v |\\| vertices\"\n obtains c where \"c \\ set conclusions\" and \"v = (c, [])\"\n | c \"is\" where \"c \\ set conclusions\" and \"is \\ it_paths (it' c)\" and \"v = (c, 0#is)\"\nusing assms by (cases v; rename_tac \"is\"; case_tac \"is\"; auto)\n\nlemma vertices_induct[consumes 1, case_names None Some]:\n assumes \"v |\\| vertices\"\n assumes \"\\ c. c \\ set conclusions \\ P (c, [])\"\n assumes \"\\ c is . c \\ set conclusions \\ is \\ it_paths (it' c) \\ P (c, 0#is)\"\n shows \"P v\"\nusing assms by (cases v; rename_tac \"is\"; case_tac \"is\"; auto)\n\nfun nodeOf :: \"'form vertex \\ ('form, 'rule) graph_node\" where\n \"nodeOf (pf, []) = Conclusion pf\"\n| \"nodeOf (pf, i#is) = iNodeOf (tree_at (it' pf) is)\"\n\nfun inst where\n \"inst (c,[]) = empty_subst\"\n |\"inst (c, i#is) = iSubst (tree_at (it' c) is)\" \n\nlemma terminal_is_nil[simp]: \"v |\\| vertices \\ outPorts (nodeOf v) = {||} \\ snd v = []\"\n by (induction v rule: nodeOf.induct)\n (auto elim: iNodeOf_outPorts[rotated] iwf_it)\n\nsublocale Vertex_Graph nodes inPorts outPorts vertices nodeOf.\n\ndefinition edge_from :: \"'form \\ nat list => ('form vertex \\ ('form,'var) out_port)\" where \n \"edge_from c is = ((c, 0 # is), Reg (iOutPort (tree_at (it' c) is)))\"\n\nlemma fst_edge_from[simp]: \"fst (edge_from c is) = (c, 0 # is)\"\n by (simp add: edge_from_def)\n\nfun in_port_at :: \"('form \\ nat list) \\ nat \\ ('form,'var) in_port\" where\n \"in_port_at (c, []) _ = plain_ant c\"\n | \"in_port_at (c, _#is) i = inPorts' (iNodeOf (tree_at (it' c) is)) ! i\"\n\ndefinition edge_to :: \"'form \\ nat list => ('form vertex \\ ('form,'var) in_port)\" where\n \"edge_to c is =\n (case rev is of [] \\ ((c, []), in_port_at (c, []) 0)\n | i#is \\ ((c, 0 # (rev is)), in_port_at (c, (0#rev is)) i))\"\n\nlemma edge_to_Nil[simp]: \"edge_to c [] = ((c, []), plain_ant c)\"\n by (simp add: edge_to_def)\n\nlemma edge_to_Snoc[simp]: \"edge_to c (is@[i]) = ((c, 0 # is), in_port_at ((c, 0 # is)) i)\"\n by (simp add: edge_to_def)\n\ndefinition edge_at :: \"'form \\ nat list => ('form, 'var) edge''\" where\n \"edge_at c is = (edge_from c is, edge_to c is)\"\n\nlemma fst_edge_at[simp]: \"fst (edge_at c is) = edge_from c is\" by (simp add: edge_at_def)\nlemma snd_edge_at[simp]: \"snd (edge_at c is) = edge_to c is\" by (simp add: edge_at_def)\n\n\nlemma hyps_exist':\n assumes \"c \\ set conclusions\"\n assumes \"is \\ it_paths (it' c)\"\n assumes \"tree_at (it' c) is = (HNode i s ants)\"\n shows \"subst s (freshen i anyP) \\ hyps_along (it' c) is\"\nproof-\n from assms(1)\n have \"plain_iwf (it' c) (fst (root (ts c)))\" by (rule iwf_it)\n moreover\n note assms(2,3)\n moreover\n have \"fst (fst (root (ts c))) |\\| ass_forms\"\n by (simp add: assms(1) ts_context)\n ultimately\n show ?thesis by (rule iwf_hyps_exist)\nqed\n\n\ndefinition hyp_edge_to :: \"'form \\ nat list => ('form vertex \\ ('form,'var) in_port)\" where\n \"hyp_edge_to c is = ((c, 0 # is), plain_ant anyP)\"\n\n(* TODO: Replace n and s by \"subst s (freshen n anyP)\" *)\ndefinition hyp_edge_from :: \"'form \\ nat list => nat \\ 'subst \\ ('form vertex \\ ('form,'var) out_port)\" where\n \"hyp_edge_from c is n s = \n ((c, 0 # hyp_port_path_for (it' c) is (subst s (freshen n anyP))),\n hyp_port_h_for (it' c) is (subst s (freshen n anyP)))\"\n\ndefinition hyp_edge_at :: \"'form \\ nat list => nat \\ 'subst \\ ('form, 'var) edge''\" where\n \"hyp_edge_at c is n s = (hyp_edge_from c is n s, hyp_edge_to c is)\"\n\nlemma fst_hyp_edge_at[simp]:\n \"fst (hyp_edge_at c is n s) = hyp_edge_from c is n s\" by (simp add:hyp_edge_at_def) \nlemma snd_hyp_edge_at[simp]:\n \"snd (hyp_edge_at c is n s) = hyp_edge_to c is\" by (simp add:hyp_edge_at_def)\n\ninductive_set edges where\n regular_edge: \"c \\ set conclusions \\ is \\ it_paths (it' c) \\ edge_at c is \\ edges\"\n | hyp_edge: \"c \\ set conclusions \\ is \\ it_paths (it' c) \\ tree_at (it' c) is = HNode n s ants \\ hyp_edge_at c is n s \\ edges\"\n\nsublocale Pre_Port_Graph nodes inPorts outPorts vertices nodeOf edges.\n\nlemma edge_from_valid_out_port:\n assumes \"p \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n shows \"valid_out_port (edge_from c p)\"\nusing assms\nby (auto simp add: edge_from_def intro: iwf_outPort iwf_it)\n\nlemma edge_to_valid_in_port:\n assumes \"p \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n shows \"valid_in_port (edge_to c p)\"\n using assms\n apply (auto simp add: edge_to_def inPorts_fset_of split: list.split elim!: it_paths_SnocE)\n apply (rule nth_mem)\n apply (drule (1) iwf_length_inPorts[OF iwf_it])\n apply auto\n done\n\nlemma hyp_edge_from_valid_out_port:\n assumes \"is \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n assumes \"tree_at (it' c) is = HNode n s ants\"\n shows \"valid_out_port (hyp_edge_from c is n s)\"\nusing assms\nby(auto simp add: hyp_edge_from_def intro: hyp_port_outPort it_paths_prefix hyp_port_prefix hyps_exist')\n\nlemma hyp_edge_to_valid_in_port:\n assumes \"is \\ it_paths (it' c)\"\n assumes \"c \\ set conclusions\"\n assumes \"tree_at (it' c) is = HNode n s ants\"\n shows \"valid_in_port (hyp_edge_to c is)\"\nusing assms by (auto simp add: hyp_edge_to_def)\n\n\ninductive scope' :: \"'form vertex \\ ('form,'var) in_port \\ 'form \\ nat list \\ bool\" where\n \"c \\ set conclusions \\\n is' \\ (op # 0) ` it_paths (it' c) \\\n prefixeq (is@[i]) is' \\ \n ip = in_port_at (c,is) i \\\n scope' (c, is) ip (c, is')\"\n\ninductive_simps scope_simp: \"scope' v i v'\"\ninductive_cases scope_cases: \"scope' v i v'\"\n\nlemma scope_valid:\n \"scope' v i v' \\ v' |\\| vertices\"\nby (auto elim: scope_cases)\n\nlemma scope_valid_inport:\n \"v' |\\| vertices \\ scope' v ip v' \\ (\\ i. fst v = fst v' \\ prefixeq (snd v@[i]) (snd v') \\ ip = in_port_at v i)\"\nby (cases v; cases v') (auto simp add: scope'.simps mem_vertices)\n\ndefinition terminal_path_from :: \"'form \\ nat list => ('form, 'var) edge'' list\" where\n \"terminal_path_from c is = map (edge_at c) (rev (inits is))\"\n\nlemma terminal_path_from_Nil[simp]:\n \"terminal_path_from c [] = [edge_at c []]\"\n by (simp add: terminal_path_from_def)\n\nlemma terminal_path_from_Snoc[simp]:\n \"terminal_path_from c (is @ [i]) = edge_at c (is@[i]) # terminal_path_from c is\"\n by (simp add: terminal_path_from_def)\n\nlemma path_terminal_path_from:\n \"c \\ set conclusions \\\n is \\ it_paths (it' c) \\\n path (c, 0 # is) (c, []) (terminal_path_from c is)\"\nby (induction \"is\" rule: rev_induct)\n (auto simp add: path_cons_simp intro!: regular_edge elim: it_paths_SnocE)\n\nlemma edge_step:\n assumes \"(((a, b), ba), ((aa, bb), bc)) \\ edges\"\n obtains \n i where \"a = aa\" and \"b = bb@[i]\" and \"bc = in_port_at (aa,bb) i\" and \"hyps (nodeOf (a, b)) ba = None\"\n | i where \"a = aa\" and \"prefixeq (b@[i]) bb\" and \"hyps (nodeOf (a, b)) ba = Some (in_port_at (a,b) i)\"\nusing assms\nproof(cases rule: edges.cases[consumes 1, case_names Reg Hyp])\n case (Reg c \"is\")\n then obtain i where \"a = aa\" and \"b = bb@[i]\" and \"bc = in_port_at (aa,bb) i\" and \"hyps (nodeOf (a, b)) ba = None\"\n by (auto elim!: edges.cases simp add: edge_at_def edge_from_def edge_to_def split: list.split list.split_asm)\n thus thesis by (rule that)\nnext\n case (Hyp c \"is\" n s)\n let ?i = \"hyp_port_i_for (it' c) is (subst s (freshen n anyP))\"\n from Hyp have \"a = aa\" and \"prefixeq (b@[?i]) bb\" and\n \"hyps (nodeOf (a, b)) ba = Some (in_port_at (a,b) ?i)\"\n by (auto simp add: edge_at_def edge_from_def edge_to_def hyp_edge_at_def hyp_edge_to_def hyp_edge_from_def\n intro: hyp_port_prefixeq hyps_exist' hyp_port_hyps)\n thus thesis by (rule that)\nqed\n\nlemma path_has_prefixes:\n assumes \"path v v' pth\"\n assumes \"snd v' = []\"\n assumes \"prefixeq (is' @ [i]) (snd v)\"\n shows \"((fst v, is'), (in_port_at (fst v, is') i)) \\ snd ` set pth\"\n using assms\n by (induction rule: path.induct)(auto elim!: edge_step dest: prefixeq_snocD)\n \nlemma in_scope: \"valid_in_port (v', p') \\ v \\ scope (v', p') \\ scope' v' p' v\"\nproof\n assume \"v \\ scope (v', p')\"\n hence \"v |\\| vertices\" and \"\\ pth t. path v t pth \\ terminal_vertex t \\ (v', p') \\ snd ` set pth\"\n by (auto simp add: scope.simps)\n from this\n show \"scope' v' p' v\"\n proof (induction rule: vertices_induct)\n case (None c)\n from None(2)[of \"(c, [])\" \"[]\", simplified, OF None(1)]\n have False.\n thus \"scope' v' p' (c, [])\"..\n next\n case (Some c \"is\")\n\n from `c \\ set conclusions` `is \\ it_paths (it' c)`\n have \"path (c, 0#is) (c, []) (terminal_path_from c is)\"\n by (rule path_terminal_path_from)\n moreover\n from `c \\ set conclusions`\n have \"terminal_vertex (c, [])\" by simp\n ultimately\n have \"(v', p') \\ snd ` set (terminal_path_from c is)\"\n by (rule Some(3))\n hence \"(v',p') \\ set (map (edge_to c) (inits is))\"\n unfolding terminal_path_from_def by auto\n then obtain is' where \"prefixeq is' is\" and \"(v',p') = edge_to c is'\"\n by auto\n show \"scope' v' p' (c, 0#is)\"\n proof(cases \"is'\" rule: rev_cases)\n case Nil\n with `(v',p') = edge_to c is'`\n have \"v' = (c, [])\" and \"p' = plain_ant c\"\n by (auto simp add: edge_to_def)\n with `c \\ set conclusions` `is \\ it_paths (it' c)`\n show ?thesis by (auto intro!: scope'.intros)\n next\n case (snoc is'' i)\n with `(v',p') = edge_to c is'`\n have \"v' = (c, 0 # is'')\" and \"p' = in_port_at v' i\"\n by (auto simp add: edge_to_def)\n with `c \\ set conclusions` `is \\ it_paths (it' c)` `prefixeq is' is`[unfolded snoc]\n show ?thesis\n by (auto intro!: scope'.intros)\n qed\n qed\nnext\n assume \"valid_in_port (v', p')\"\n assume \"scope' v' p' v\"\n then obtain c is' i \"is\" where\n \"v' = (c, is')\" and \"v = (c, is)\" and \"c \\ set conclusions\" and\n \"p' = in_port_at v' i\" and\n \"is \\ op # 0 ` it_paths (it' c)\" and \"prefixeq (is' @ [i]) is\"\n by (auto simp add: scope'.simps)\n\n from `scope' v' p' v`\n have \"(c, is) |\\| vertices\" unfolding `v = _` by (rule scope_valid)\n hence \"(c, is) \\ scope ((c, is'), p')\"\n proof(rule scope.intros)\n fix pth t\n assume \"path (c,is) t pth\"\n \n assume \"terminal_vertex t\"\n hence \"snd t = []\" by auto\n\n from path_has_prefixes[OF `path (c,is) t pth` `snd t = []`, simplified, OF `prefixeq (is' @ [i]) is`]\n show \"((c, is'), p') \\ snd ` set pth\" unfolding `p' = _ ` `v' = _ `.\n qed\n thus \"v \\ scope (v', p')\" using `v =_` `v' = _` by simp\nqed\n\nsublocale Port_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n show \"nodeOf ` fset vertices \\ sset nodes\"\n apply (auto simp add: fmember.rep_eq[symmetric] mem_vertices)\n apply (auto simp add: stream.set_map dest: iNodeOf_tree_at[OF iwf_it])\n done\n next\n\n have \"\\ e \\ edges. valid_out_port (fst e) \\ valid_in_port (snd e)\"\n by (auto elim!: edges.cases simp add: edge_at_def\n dest: edge_from_valid_out_port edge_to_valid_in_port\n dest: hyp_edge_from_valid_out_port hyp_edge_to_valid_in_port)\n \n thus \"\\(ps1, ps2)\\edges. valid_out_port ps1 \\ valid_in_port ps2\" by auto\nqed\n \n\nsublocale Scoped_Graph nodes inPorts outPorts vertices nodeOf edges hyps..\n\nlemma hyps_free_path_length:\n assumes \"path v v' pth\"\n assumes \"hyps_free pth\"\n shows \"length pth + length (snd v') = length (snd v)\"\nusing assms by induction (auto elim!: edge_step )\n\nfun vidx :: \"'form vertex \\ nat\" where\n \"vidx (c, []) = isidx [fidx conc_forms c]\"\n |\"vidx (c, _#is) = iAnnot (tree_at (it' c) is)\"\n\nlemma my_vidx_inj: \"inj_on vidx (fset vertices)\"\n by (rule inj_onI)\n (auto simp add: mem_vertices[unfolded fmember.rep_eq] iAnnot_globalize simp del: iAnnot.simps)\n\nlemma vidx_not_v_away[simp]: \"v |\\| vertices \\ vidx v \\ v_away\"\n by (cases v rule:vidx.cases) (auto simp add: iAnnot_globalize simp del: iAnnot.simps)\n\nsublocale Instantiation inPorts outPorts nodeOf hyps nodes edges vertices labelsIn labelsOut freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP vidx inst\nproof\n show \"inj_on vidx (fset vertices)\" by (rule my_vidx_inj)\nqed\n\nsublocale Well_Scoped_Graph nodes inPorts outPorts vertices nodeOf edges hyps\nproof\n fix v\\<^sub>1 p\\<^sub>1 v\\<^sub>2 p\\<^sub>2 p'\n assume assms: \"((v\\<^sub>1, p\\<^sub>1), (v\\<^sub>2, p\\<^sub>2)) \\ edges\" \"hyps (nodeOf v\\<^sub>1) p\\<^sub>1 = Some p'\"\n from assms(1) hyps_correct[OF assms(2)]\n have \"valid_out_port (v\\<^sub>1, p\\<^sub>1)\" and \"valid_in_port (v\\<^sub>2, p\\<^sub>2)\" and \"valid_in_port (v\\<^sub>1, p')\" and \"v\\<^sub>2 |\\| vertices\"\n using valid_edges by auto\n\n from assms\n have \"\\ i. fst v\\<^sub>1 = fst v\\<^sub>2 \\ prefixeq (snd v\\<^sub>1@[i]) (snd v\\<^sub>2) \\ p' = in_port_at v\\<^sub>1 i\"\n by (cases v\\<^sub>1; cases v\\<^sub>2; auto elim!: edge_step)\n hence \"scope' v\\<^sub>1 p' v\\<^sub>2\"\n unfolding scope_valid_inport[OF `v\\<^sub>2 |\\| vertices`].\n hence \"v\\<^sub>2 \\ scope (v\\<^sub>1, p')\"\n unfolding in_scope[OF `valid_in_port (v\\<^sub>1, p')`].\n thus \"(v\\<^sub>2, p\\<^sub>2) = (v\\<^sub>1, p') \\ v\\<^sub>2 \\ scope (v\\<^sub>1, p')\" ..\nqed\n\nsublocale Acyclic_Graph nodes inPorts outPorts vertices nodeOf edges hyps \nproof\n fix v pth\n assume \"path v v pth\" and \"hyps_free pth\"\n from hyps_free_path_length[OF this]\n show \"pth = []\" by simp\nqed\n\nsublocale Saturated_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n fix v p\n assume \"valid_in_port (v, p)\"\n thus \"\\e\\edges. snd e = (v, p)\"\n proof(induction v)\n fix c cis\n assume \"valid_in_port ((c, cis), p)\"\n hence \"c \\ set conclusions\" by (auto simp add: mem_vertices)\n\n show \"\\e\\edges. snd e = ((c, cis), p)\"\n proof(cases cis)\n case Nil\n with `valid_in_port ((c, cis), p)`\n have [simp]: \"p = plain_ant c\" by simp\n\n have \"[] \\ it_paths (it' c)\" by simp\n with `c \\ set conclusions`\n have \"edge_at c [] \\ edges\" by (rule regular_edge)\n moreover\n have \"snd (edge_at c []) = ((c, []), plain_ant c)\"\n by (simp add: edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Nil simp del: snd_edge_at)\n next\n case (Cons c' \"is\")\n with `valid_in_port ((c, cis), p)`\n have [simp]: \"c' = 0\" and \"is \\ it_paths (it' c)\"\n and \"p |\\| inPorts (iNodeOf (tree_at (it' c) is))\" by auto\n \n from this(3) obtain i where\n \"i < length (inPorts' (iNodeOf (tree_at (it' c) is)))\" and\n \"p = inPorts' (iNodeOf (tree_at (it' c) is)) ! i\"\n by (auto simp add: inPorts_fset_of in_set_conv_nth)\n\n show ?thesis\n proof (cases \"tree_at (it' c) is\")\n case [simp]: (RNode r ants)\n show ?thesis\n proof(cases r)\n case I\n hence \"\\ isHNode (tree_at (it' c) is)\" by simp\n from iwf_length_inPorts_not_HNode[OF iwf_it[OF `c \\ set conclusions`] `is \\ it_paths (it' c)` this]\n `i < length (inPorts' (iNodeOf (tree_at (it' c) is)))`\n have \"i < length (children (tree_at (it' c) is))\" by simp\n with `is \\ it_paths (it' c)`\n have \"is@[i] \\ it_paths (it' c)\" by (rule it_path_SnocI)\n from `c \\ set conclusions` this\n have \"edge_at c (is@[i]) \\ edges\" by (rule regular_edge)\n moreover\n have \"snd (edge_at c (is@[i])) = ((c, 0 # is), inPorts' (iNodeOf (tree_at (it' c) is)) ! i)\"\n by (simp add: edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Cons `p = _` simp del: snd_edge_at)\n next\n case (H n s)\n hence \"tree_at (it' c) is = HNode n s ants\" by simp\n from `c \\ set conclusions` `is \\ it_paths (it' c)` this\n have \"hyp_edge_at c is n s \\ edges\"..\n moreover\n from H `p |\\| inPorts (iNodeOf (tree_at (it' c) is))`\n have [simp]: \"p = plain_ant anyP\" by simp\n \n have \"snd (hyp_edge_at c is n s) = ((c, 0 # is), p)\"\n by (simp add: hyp_edge_to_def)\n ultimately\n show ?thesis by (auto simp add: Cons simp del: snd_hyp_edge_at)\n qed\n qed\n qed\n qed\nqed\n\nsublocale Pruned_Port_Graph nodes inPorts outPorts vertices nodeOf edges\nproof\n fix v \n assume \"v |\\| vertices\"\n thus \"\\pth v'. path v v' pth \\ terminal_vertex v'\"\n proof(induct rule: vertices_induct)\n case (None c)\n hence \"terminal_vertex (c,[])\" by simp\n with path.intros(1)\n show ?case by blast\n next\n case (Some c \"is\")\n hence \"path (c, 0 # is) (c, []) (terminal_path_from c is)\"\n by (rule path_terminal_path_from)\n moreover\n have \"terminal_vertex (c,[])\" using Some(1) by simp\n ultimately\n show ?case by blast\n qed\nqed\n\nsublocale Well_Shaped_Graph nodes inPorts outPorts vertices nodeOf edges hyps..\n\nsublocale sol:Solution inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP vidx inst edges\nproof\n fix v\\<^sub>1 p\\<^sub>1 v\\<^sub>2 p\\<^sub>2\n assume \"((v\\<^sub>1, p\\<^sub>1), (v\\<^sub>2, p\\<^sub>2)) \\ edges\"\n thus \"labelAtOut v\\<^sub>1 p\\<^sub>1 = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n proof(cases rule:edges.cases)\n case (regular_edge c \"is\")\n \n from `((v\\<^sub>1, p\\<^sub>1), v\\<^sub>2, p\\<^sub>2) = edge_at c is`\n have \"(v\\<^sub>1,p\\<^sub>1) = edge_from c is\" using fst_edge_at by (metis fst_conv)\n hence [simp]: \"v\\<^sub>1 = (c, 0 # is)\" by (simp add: edge_from_def)\n\n show ?thesis\n proof(cases \"is\" rule:rev_cases)\n case Nil\n let \"?t'\" = \"it' c\"\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t') (freshen (vidx v\\<^sub>1) (iOutPort ?t'))\"\n using regular_edge Nil by (simp add: labelAtOut_def edge_at_def edge_from_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t'\" by (simp add: Nil)\n also have \"subst (iSubst ?t') (freshen (iAnnot ?t') (iOutPort ?t')) = snd (fst (root (ts c)))\"\n unfolding iwf_subst_freshen_outPort[OF iwf_it[OF `c \\ set conclusions`]]..\n also have \"\\ = c\" using `c \\ set conclusions` by (simp add: ts_conc)\n also have \"\\ = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using `c \\ set conclusions` regular_edge Nil\n by (simp add: labelAtIn_def edge_at_def freshen_closed conclusions_closed closed_no_lconsts)\n finally show ?thesis.\n next\n case (snoc is' i)\n let \"?t1\" = \"tree_at (it' c) (is'@[i])\"\n let \"?t2\" = \"tree_at (it' c) is'\"\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t1) (freshen (vidx v\\<^sub>1) (iOutPort ?t1))\"\n using regular_edge snoc by (simp add: labelAtOut_def edge_at_def edge_from_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t1\" using snoc regular_edge(3) by simp\n also have \"subst (iSubst ?t1) (freshen (iAnnot ?t1) (iOutPort ?t1))\n = subst (iSubst ?t2) (freshen (iAnnot ?t2) (a_conc (inPorts' (iNodeOf ?t2) ! i)))\"\n by (rule iwf_edge_match[OF iwf_it[OF `c \\ set conclusions`] `is \\ it_paths (it' c)`[unfolded snoc]])\n also have \"iAnnot ?t2 = vidx (c, 0 # is')\" by simp\n also have \"subst (iSubst ?t2) (freshen (vidx (c, 0 # is')) (a_conc (inPorts' (iNodeOf ?t2) ! i))) = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using regular_edge snoc by (simp add: labelAtIn_def edge_at_def)\n finally show ?thesis.\n qed\n next\n case (hyp_edge c \"is\" n s ants)\n let ?f = \"subst s (freshen n anyP)\"\n let ?h = \"hyp_port_h_for (it' c) is ?f\"\n let ?his = \"hyp_port_path_for (it' c) is ?f\"\n let \"?t1\" = \"tree_at (it' c) ?his\"\n let \"?t2\" = \"tree_at (it' c) is\"\n\n from `c \\ set conclusions` `is \\ it_paths (it' c)` `tree_at (it' c) is = HNode n s ants`\n have \"?f \\ hyps_along (it' c) is\"\n by (rule hyps_exist')\n\n from `((v\\<^sub>1, p\\<^sub>1), v\\<^sub>2, p\\<^sub>2) = hyp_edge_at c is n s`\n have \"(v\\<^sub>1,p\\<^sub>1) = hyp_edge_from c is n s\" using fst_hyp_edge_at by (metis fst_conv)\n hence [simp]: \"v\\<^sub>1 = (c, 0 # ?his)\" by (simp add: hyp_edge_from_def)\n\n\n have \"labelAtOut v\\<^sub>1 p\\<^sub>1 = subst (iSubst ?t1) (freshen (vidx v\\<^sub>1) (labelsOut (iNodeOf ?t1) ?h))\"\n using hyp_edge by (simp add: hyp_edge_at_def hyp_edge_from_def labelAtOut_def)\n also have \"vidx v\\<^sub>1 = iAnnot ?t1\" by simp\n also have \"subst (iSubst ?t1) (freshen (iAnnot ?t1) (labelsOut (iNodeOf ?t1) ?h)) = ?f\" using `?f \\ hyps_along (it' c) is` by (rule local.hyp_port_eq[symmetric])\n also have \"\\ = subst (iSubst ?t2) (freshen (iAnnot ?t2) anyP)\" using hyp_edge by simp\n also have \"subst (iSubst ?t2) (freshen (iAnnot ?t2) anyP) = labelAtIn v\\<^sub>2 p\\<^sub>2\"\n using hyp_edge by (simp add: labelAtIn_def hyp_edge_at_def hyp_edge_to_def)\n finally show ?thesis.\n qed\nqed\n\n\nlemma node_disjoint_fresh_vars:\n assumes \"n \\ sset nodes\"\n assumes \"i < length (inPorts' n)\"\n assumes \"i' < length (inPorts' n)\"\n shows \"a_fresh (inPorts' n ! i) \\ a_fresh (inPorts' n ! i') = {} \\ i = i'\"\n using assms no_multiple_local_consts\n by (fastforce simp add: nodes_def stream.set_map)\n\nsublocale Well_Scoped_Instantiation freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut vidx inst edges local_vars\nproof\n fix v p var v'\n assume \"valid_in_port (v, p)\"\n hence \"v |\\| vertices\" by simp\n \n obtain c \"is\" where \"v = (c,is)\" by (cases v, auto)\n\n from `valid_in_port (v, p)` `v= _`\n have \"(c,is) |\\| vertices\" and \"p |\\| inPorts (nodeOf (c, is))\" by simp_all\n hence \"c \\ set conclusions\" by (simp add: mem_vertices)\n \n from `p |\\| _` obtain i where\n \"i < length (inPorts' (nodeOf (c, is)))\" and\n \"p = inPorts' (nodeOf (c, is)) ! i\" by (auto simp add: inPorts_fset_of in_set_conv_nth)\n hence \"p = in_port_at (c, is) i\" by (cases \"is\") auto\n\n assume \"v' |\\| vertices\"\n then obtain c' is' where \"v' = (c',is')\" by (cases v', auto)\n\n assume \"var \\ local_vars (nodeOf v) p\"\n hence \"var \\ a_fresh p\" by simp\n\n assume \"freshenLC (vidx v) var \\ subst_lconsts (inst v')\"\n then obtain is'' where \"is' = 0#is''\" and \"is'' \\ it_paths (it' c')\"\n using `v' |\\| vertices`\n by (cases is') (auto simp add: `v'=_`)\n\n note `freshenLC (vidx v) var \\ subst_lconsts (inst v')`\n also\n have \"subst_lconsts (inst v') = subst_lconsts (iSubst (tree_at (it' c') is''))\"\n by (simp add: `v'=_` `is'=_`)\n also\n from `is'' \\ it_paths (it' c')`\n have \"\\ \\ fresh_at_path (it' c') is'' \\ range (freshenLC v_away)\"\n by (rule globalize_local_consts)\n finally\n have \"freshenLC (vidx v) var \\ fresh_at_path (it' c') is''\"\n using `v |\\| vertices` by auto\n then obtain is''' where \"prefixeq is''' is''\" and \"freshenLC (vidx v) var \\ fresh_at (it' c') is'''\"\n unfolding fresh_at_path_def by auto\n then obtain i' is'''' where \"prefixeq (is''''@[i']) is''\" \n and \"freshenLC (vidx v) var \\ fresh_at (it' c') (is''''@[i'])\"\n using append_butlast_last_id[where xs = is''', symmetric]\n apply (cases \"is''' = []\")\n apply (auto simp del: fresh_at_snoc append_butlast_last_id)\n apply metis\n done\n\n from `is'' \\ it_paths (it' c')` `prefixeq (is''''@[i']) is''`\n have \"(is''''@[i']) \\ it_paths (it' c')\" by (rule it_paths_prefixeq)\n hence \"is'''' \\ it_paths (it' c')\" using append_prefixeqD it_paths_prefixeq by blast\n\n from this `freshenLC (vidx v) var \\ fresh_at (it' c') (is''''@[i'])`\n have \"c = c' \\ is = 0 # is'''' \\ var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')\"\n unfolding fresh_at_def' using `v |\\| vertices` `v' |\\| vertices`\n apply (cases \"is\")\n apply (auto split: if_splits simp add: iAnnot_globalize it_paths_butlast `v=_` `v'=_` `is'=_` simp del: iAnnot.simps)\n done\n hence \"c' = c\" and \"is = 0 # is''''\" and \"var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')\" by simp_all\n\n from `(is''''@[i']) \\ it_paths (it' c')`\n have \"i' < length (inPorts' (nodeOf (c, is)))\"\n using iwf_length_inPorts[OF iwf_it[OF `c \\ set conclusions`]]\n by (auto elim!: it_paths_SnocE simp add: `is=_` `c' = _` order.strict_trans2)\n\n have \"nodeOf (c, is) \\ sset nodes\"\n unfolding `is = _` `c' = _` nodeOf.simps\n by (rule iNodeOf_tree_at[OF iwf_it[OF `c \\ set conclusions`] `is'''' \\ it_paths (it' c')`[unfolded `c' = _`]])\n \n from `var \\ a_fresh (inPorts' (iNodeOf (tree_at (it' c') is'''')) ! i')`\n `var \\ a_fresh p` `p = inPorts' (nodeOf (c, is)) ! i`\n node_disjoint_fresh_vars[OF\n `nodeOf (c, is) \\ sset nodes`\n `i < length (inPorts' (nodeOf (c, is)))` `i' < length (inPorts' (nodeOf (c, is)))`]\n have \"i' = i\" by (auto simp add: `is=_` `c'=c`)\n \n from `prefixeq (is''''@[i']) is''`\n have \"prefixeq (is @ [i']) is'\" by (simp add: `is'=_` `is=_`)\n\n \n from `c \\ set conclusions` `is'' \\ it_paths (it' c')` `prefixeq (is @ [i']) is'`\n `p = in_port_at (c, is) i`\n have \"scope' v p v'\"\n unfolding `v=_` `v'=_` `c' = _` `is' = _` `i'=_` by (auto intro: scope'.intros)\n thus \"v' \\ scope (v, p)\" using `valid_in_port (v, p)` by (simp add: in_scope)\nqed\n\nsublocale Scoped_Proof_Graph freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP inPorts outPorts nodeOf hyps nodes vertices labelsIn labelsOut vidx inst edges local_vars..\n\n(* interpretation of @{term Tasked_Proof_Graph} has to be named to avoid name clashes in @{term Abstract_Task}. *)\nsublocale tpg:Tasked_Proof_Graph freshenLC renameLCs lconsts closed subst subst_lconsts subst_renameLCs anyP antecedent consequent rules assumptions conclusions\n vertices nodeOf edges vidx inst\nproof\n show \"set (map Conclusion conclusions) \\ nodeOf ` fset vertices\"\n proof-\n {\n fix c\n assume \"c \\ set conclusions\"\n hence \"(c, []) |\\| vertices\" by simp\n hence \"nodeOf (c, []) \\ nodeOf ` fset vertices\"\n unfolding fmember.rep_eq by (rule imageI)\n hence \"Conclusion c \\ nodeOf ` fset vertices\" by simp\n } thus ?thesis by auto\n qed\nqed \n\nend\n\nend", "meta": {"author": "nomeata", "repo": "isa-incredible", "sha": "10eb1d938879778196cc69bf86b1ed0d979512cc", "save_path": "github-repos/isabelle/nomeata-isa-incredible", "path": "github-repos/isabelle/nomeata-isa-incredible/isa-incredible-10eb1d938879778196cc69bf86b1ed0d979512cc/Incredible_Completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2791634971676872}} {"text": "section \\Implementation of Nondeterministic Generalized Büchi Automata\\\n\ntheory NGBA_Implement\nimports\n \"NGBA_Refine\"\n \"../../Basic/Implement\"\nbegin\n\n consts i_ngba_scheme :: \"interface \\ interface \\ interface\"\n\n context\n begin\n\n interpretation autoref_syn by this\n\n lemma ngba_scheme_itype[autoref_itype]:\n \"ngba ::\\<^sub>i \\L\\\\<^sub>i i_set \\\\<^sub>i \\S\\\\<^sub>i i_set \\\\<^sub>i (L \\\\<^sub>i S \\\\<^sub>i \\S\\\\<^sub>i i_set) \\\\<^sub>i \\\\S\\\\<^sub>i i_set\\\\<^sub>i i_list \\\\<^sub>i\n \\L, S\\\\<^sub>i i_ngba_scheme\"\n \"alphabet ::\\<^sub>i \\L, S\\\\<^sub>i i_ngba_scheme \\\\<^sub>i \\L\\\\<^sub>i i_set\"\n \"initial ::\\<^sub>i \\L, S\\\\<^sub>i i_ngba_scheme \\\\<^sub>i \\S\\\\<^sub>i i_set\"\n \"transition ::\\<^sub>i \\L, S\\\\<^sub>i i_ngba_scheme \\\\<^sub>i L \\\\<^sub>i S \\\\<^sub>i \\S\\\\<^sub>i i_set\"\n \"accepting ::\\<^sub>i \\L, S\\\\<^sub>i i_ngba_scheme \\\\<^sub>i \\\\S\\\\<^sub>i i_set\\\\<^sub>i i_list\"\n by auto\n\n end\n\n datatype ('label, 'state) ngbai = ngbai\n (alphabeti: \"'label list\")\n (initiali: \"'state list\")\n (transitioni: \"'label \\ 'state \\ 'state list\")\n (acceptingi: \"('state \\ bool) list\")\n\n definition ngbai_rel :: \"('label\\<^sub>1 \\ 'label\\<^sub>2) set \\ ('state\\<^sub>1 \\ 'state\\<^sub>2) set \\\n (('label\\<^sub>1, 'state\\<^sub>1) ngbai \\ ('label\\<^sub>2, 'state\\<^sub>2) ngbai) set\" where\n [to_relAPP]: \"ngbai_rel L S \\ {(A\\<^sub>1, A\\<^sub>2).\n (alphabeti A\\<^sub>1, alphabeti A\\<^sub>2) \\ \\L\\ list_rel \\\n (initiali A\\<^sub>1, initiali A\\<^sub>2) \\ \\S\\ list_rel \\\n (transitioni A\\<^sub>1, transitioni A\\<^sub>2) \\ L \\ S \\ \\S\\ list_rel \\\n (acceptingi A\\<^sub>1, acceptingi A\\<^sub>2) \\ \\S \\ bool_rel\\ list_rel}\"\n\n lemma ngbai_param[param]:\n \"(ngbai, ngbai) \\ \\L\\ list_rel \\ \\S\\ list_rel \\ (L \\ S \\ \\S\\ list_rel) \\\n \\S \\ bool_rel\\ list_rel \\ \\L, S\\ ngbai_rel\"\n \"(alphabeti, alphabeti) \\ \\L, S\\ ngbai_rel \\ \\L\\ list_rel\"\n \"(initiali, initiali) \\ \\L, S\\ ngbai_rel \\ \\S\\ list_rel\"\n \"(transitioni, transitioni) \\ \\L, S\\ ngbai_rel \\ L \\ S \\ \\S\\ list_rel\"\n \"(acceptingi, acceptingi) \\ \\L, S\\ ngbai_rel \\ \\S \\ bool_rel\\ list_rel\"\n unfolding ngbai_rel_def fun_rel_def by auto\n\n definition ngbai_ngba_rel :: \"('label\\<^sub>1 \\ 'label\\<^sub>2) set \\ ('state\\<^sub>1 \\ 'state\\<^sub>2) set \\\n (('label\\<^sub>1, 'state\\<^sub>1) ngbai \\ ('label\\<^sub>2, 'state\\<^sub>2) ngba) set\" where\n [to_relAPP]: \"ngbai_ngba_rel L S \\ {(A\\<^sub>1, A\\<^sub>2).\n (alphabeti A\\<^sub>1, alphabet A\\<^sub>2) \\ \\L\\ list_set_rel \\\n (initiali A\\<^sub>1, initial A\\<^sub>2) \\ \\S\\ list_set_rel \\\n (transitioni A\\<^sub>1, transition A\\<^sub>2) \\ L \\ S \\ \\S\\ list_set_rel \\\n (acceptingi A\\<^sub>1, accepting A\\<^sub>2) \\ \\S \\ bool_rel\\ list_rel}\"\n\n lemmas [autoref_rel_intf] = REL_INTFI[of ngbai_ngba_rel i_ngba_scheme]\n\n lemma ngbai_ngba_param[param, autoref_rules]:\n \"(ngbai, ngba) \\ \\L\\ list_set_rel \\ \\S\\ list_set_rel \\ (L \\ S \\ \\S\\ list_set_rel) \\\n \\S \\ bool_rel\\ list_rel \\ \\L, S\\ ngbai_ngba_rel\"\n \"(alphabeti, alphabet) \\ \\L, S\\ ngbai_ngba_rel \\ \\L\\ list_set_rel\"\n \"(initiali, initial) \\ \\L, S\\ ngbai_ngba_rel \\ \\S\\ list_set_rel\"\n \"(transitioni, transition) \\ \\L, S\\ ngbai_ngba_rel \\ L \\ S \\ \\S\\ list_set_rel\"\n \"(acceptingi, accepting) \\ \\L, S\\ ngbai_ngba_rel \\ \\S \\ bool_rel\\ list_rel\"\n unfolding ngbai_ngba_rel_def fun_rel_def by auto\n\n definition ngbai_ngba :: \"('label, 'state) ngbai \\ ('label, 'state) ngba\" where\n \"ngbai_ngba A \\ ngba (set (alphabeti A)) (set (initiali A)) (\\ a p. set (transitioni A a p)) (acceptingi A)\"\n definition ngbai_invar :: \"('label, 'state) ngbai \\ bool\" where\n \"ngbai_invar A \\ distinct (alphabeti A) \\ distinct (initiali A) \\ (\\ a p. distinct (transitioni A a p))\"\n\n lemma ngbai_ngba_id_param[param]: \"(ngbai_ngba, id) \\ \\L, S\\ ngbai_ngba_rel \\ \\L, S\\ ngba_rel\"\n proof\n fix Ai A\n assume 1: \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n have 2: \"ngbai_ngba Ai = ngba (set (alphabeti Ai)) (set (initiali Ai))\n (\\ a p. set (transitioni Ai a p)) (acceptingi Ai)\" unfolding ngbai_ngba_def by rule\n have 3: \"id A = ngba (id (alphabet A)) (id (initial A))\n (\\ a p. id (transition A a p)) (accepting A)\" by simp\n show \"(ngbai_ngba Ai, id A) \\ \\L, S\\ ngba_rel\" unfolding 2 3 using 1 by parametricity\n qed\n\n lemma ngbai_ngba_br: \"\\Id, Id\\ ngbai_ngba_rel = br ngbai_ngba ngbai_invar\"\n proof safe\n show \"(A, B) \\ \\Id, Id\\ ngbai_ngba_rel\" if \"(A, B) \\ br ngbai_ngba ngbai_invar\"\n for A and B :: \"('a, 'b) ngba\"\n using that unfolding ngbai_ngba_rel_def ngbai_ngba_def ngbai_invar_def\n by (auto simp: in_br_conv list_set_rel_def)\n show \"(A, B) \\ br ngbai_ngba ngbai_invar\" if \"(A, B) \\ \\Id, Id\\ ngbai_ngba_rel\"\n for A and B :: \"('a, 'b) ngba\"\n proof -\n have 1: \"(ngbai_ngba A, id B) \\ \\Id, Id\\ ngba_rel\" using that by parametricity\n have 2: \"ngbai_invar A\"\n using ngbai_ngba_param(2 - 5)[param_fo, OF that]\n by (auto simp: in_br_conv list_set_rel_def ngbai_invar_def)\n show ?thesis using 1 2 unfolding in_br_conv by auto\n qed\n qed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Automata/NBA/NGBA_Implement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.5, "lm_q1q2_score": 0.27916348981849526}} {"text": "theory CFGExit imports CFG begin\n\nsubsection \\Adds an exit node to the abstract CFG\\\n\nlocale CFGExit = CFG sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\" +\n fixes Exit::\"'node\" (\"'('_Exit'_')\")\n assumes Exit_source [dest]: \"\\valid_edge a; sourcenode a = (_Exit_)\\ \\ False\"\n and get_proc_Exit:\"get_proc (_Exit_) = Main\"\n and Exit_no_return_target:\n \"\\valid_edge a; kind a = Q\\\\<^bsub>p\\<^esub>f; targetnode a = (_Exit_)\\ \\ False\"\n and Entry_Exit_edge: \"\\a. valid_edge a \\ sourcenode a = (_Entry_) \\\n targetnode a = (_Exit_) \\ kind a = (\\s. False)\\<^sub>\\\"\n \n\nbegin\n\nlemma Entry_noteq_Exit [dest]:\n assumes eq:\"(_Entry_) = (_Exit_)\" shows \"False\"\nproof -\n from Entry_Exit_edge obtain a where \"sourcenode a = (_Entry_)\" \n and \"valid_edge a\" by blast\n with eq show False by simp(erule Exit_source)\nqed\n\nlemma Exit_noteq_Entry [dest]:\"(_Exit_) = (_Entry_) \\ False\"\n by(rule Entry_noteq_Exit[OF sym],simp)\n\n\n\n\nlemma [simp]: \"valid_node (_Exit_)\"\nproof -\n from Entry_Exit_edge obtain a where \"targetnode a = (_Exit_)\"\n and \"valid_edge a\" by blast\n thus ?thesis by(fastforce simp:valid_node_def)\nqed\n\n\nsubsubsection \\Definition of \\method_exit\\\\\n\ndefinition method_exit :: \"'node \\ bool\"\n where \"method_exit n \\ n = (_Exit_) \\ \n (\\a Q p f. n = sourcenode a \\ valid_edge a \\ kind a = Q\\\\<^bsub>p\\<^esub>f)\"\n\n\nlemma method_exit_cases:\n \"\\method_exit n; n = (_Exit_) \\ P;\n \\a Q f p. \\n = sourcenode a; valid_edge a; kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\ P\\ \\ P\"\nby(fastforce simp:method_exit_def)\n\n\nlemma method_exit_inner_path:\n assumes \"method_exit n\" and \"n -as\\\\<^sub>\\* n'\" shows \"as = []\"\n using \\method_exit n\\\nproof(rule method_exit_cases)\n assume \"n = (_Exit_)\"\n show ?thesis\n proof(cases as)\n case (Cons a' as')\n with \\n -as\\\\<^sub>\\* n'\\ have \"n = sourcenode a'\" and \"valid_edge a'\"\n by(auto elim:path_split_Cons simp:intra_path_def)\n with \\n = (_Exit_)\\ have \"sourcenode a' = (_Exit_)\" by simp\n with \\valid_edge a'\\ have False by(rule Exit_source)\n thus ?thesis by simp\n qed simp\nnext\n fix a Q f p\n assume \"n = sourcenode a\" and \"valid_edge a\" and \"kind a = Q\\\\<^bsub>p\\<^esub>f\"\n show ?thesis\n proof(cases as)\n case (Cons a' as')\n with \\n -as\\\\<^sub>\\* n'\\ have \"n = sourcenode a'\" and \"valid_edge a'\" \n and \"intra_kind (kind a')\"\n by(auto elim:path_split_Cons simp:intra_path_def)\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\valid_edge a'\\ \\n = sourcenode a\\ \n \\n = sourcenode a'\\ \\intra_kind (kind a')\\\n have False by(fastforce dest:return_edges_only simp:intra_kind_def)\n thus ?thesis by simp\n qed simp\nqed\n\n\nsubsubsection \\Definition of \\inner_node\\\\\n\ndefinition inner_node :: \"'node \\ bool\"\n where inner_node_def: \n \"inner_node n \\ valid_node n \\ n \\ (_Entry_) \\ n \\ (_Exit_)\"\n\n\nlemma inner_is_valid:\n \"inner_node n \\ valid_node n\"\nby(simp add:inner_node_def valid_node_def)\n\nlemma [dest]:\n \"inner_node (_Entry_) \\ False\"\nby(simp add:inner_node_def)\n\nlemma [dest]:\n \"inner_node (_Exit_) \\ False\" \nby(simp add:inner_node_def)\n\nlemma [simp]:\"\\valid_edge a; targetnode a \\ (_Exit_)\\ \n \\ inner_node (targetnode a)\"\n by(simp add:inner_node_def,rule ccontr,simp,erule Entry_target)\n\nlemma [simp]:\"\\valid_edge a; sourcenode a \\ (_Entry_)\\\n \\ inner_node (sourcenode a)\"\n by(simp add:inner_node_def,rule ccontr,simp,erule Exit_source)\n\nlemma valid_node_cases [consumes 1, case_names \"Entry\" \"Exit\" \"inner\"]:\n \"\\valid_node n; n = (_Entry_) \\ Q; n = (_Exit_) \\ Q;\n inner_node n \\ Q\\ \\ Q\"\napply(auto simp:valid_node_def)\n apply(case_tac \"sourcenode a = (_Entry_)\") apply auto\napply(case_tac \"targetnode a = (_Exit_)\") apply auto\ndone\n\n\nsubsubsection \\Lemmas on paths with \\(_Exit_)\\\\\n\nlemma path_Exit_source:\n \"\\n -as\\* n'; n = (_Exit_)\\ \\ n' = (_Exit_) \\ as = []\"\nproof(induct rule:path.induct)\n case (Cons_path n'' as n' a n)\n from \\n = (_Exit_)\\ \\sourcenode a = n\\ \\valid_edge a\\ have False \n by -(rule Exit_source,simp_all)\n thus ?case by simp\nqed simp\n\nlemma [dest]:\"(_Exit_) -as\\* n' \\ n' = (_Exit_) \\ as = []\"\n by(fastforce elim!:path_Exit_source)\n\nlemma Exit_no_sourcenode[dest]:\n assumes isin:\"(_Exit_) \\ set (sourcenodes as)\" and path:\"n -as\\* n'\"\n shows False\nproof -\n from isin obtain ns' ns'' where \"sourcenodes as = ns'@(_Exit_)#ns''\"\n by(auto dest:split_list simp:sourcenodes_def)\n then obtain as' as'' a where \"as = as'@a#as''\"\n and source:\"sourcenode a = (_Exit_)\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n with path have \"valid_edge a\" by(fastforce dest:path_split)\n with source show ?thesis by -(erule Exit_source)\nqed\n\n\n\nlemma vpa_no_slpa:\n \"\\valid_path_aux cs as; n -as\\* n'; valid_call_list cs n; cs \\ [];\n \\xs ys. as = xs@ys \\ (\\ same_level_path_aux cs xs \\ upd_cs cs xs \\ [])\\\n \\ \\a Q r fs. valid_edge a \\ kind a = Q:r\\\\<^bsub>get_proc n'\\<^esub>fs\"\nproof(induct arbitrary:n rule:vpa_induct)\n case (vpa_empty cs)\n from \\valid_call_list cs n\\ \\cs \\ []\\ obtain Q r fs where \"valid_edge (hd cs)\"\n and \"kind (hd cs) = Q:r\\\\<^bsub>get_proc n\\<^esub>fs\"\n apply(unfold valid_call_list_def)\n apply(drule hd_Cons_tl[THEN sym])\n apply(erule_tac x=\"[]\" in allE) \n apply(erule_tac x=\"hd cs\" in allE)\n by auto\n from \\n -[]\\* n'\\ have \"n = n'\" by fastforce\n with \\valid_edge (hd cs)\\ \\kind (hd cs) = Q:r\\\\<^bsub>get_proc n\\<^esub>fs\\ show ?case by blast\nnext\n case (vpa_intra cs a as)\n note IH = \\\\n. \\n -as\\* n'; valid_call_list cs n; cs \\ [];\n \\xs ys. as = xs@ys \\ \\ same_level_path_aux cs xs \\ upd_cs cs xs \\ []\\\n \\ \\a' Q' r' fs'. valid_edge a' \\ kind a' = Q':r'\\\\<^bsub>get_proc n'\\<^esub>fs'\\\n note all = \\\\xs ys. a#as = xs@ys \n \\ \\ same_level_path_aux cs xs \\ upd_cs cs xs \\ []\\\n from \\n -a#as\\* n'\\ have \"sourcenode a = n\" and \"valid_edge a\" \n and \"targetnode a -as\\* n'\"\n by(auto intro:path_split_Cons)\n from \\valid_call_list cs n\\ \\cs \\ []\\ obtain Q r fs where \"valid_edge (hd cs)\"\n and \"kind (hd cs) = Q:r\\\\<^bsub>get_proc n\\<^esub>fs\"\n apply(unfold valid_call_list_def)\n apply(drule hd_Cons_tl[THEN sym])\n apply(erule_tac x=\"[]\" in allE) \n apply(erule_tac x=\"hd cs\" in allE)\n by auto\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n with \\kind (hd cs) = Q:r\\\\<^bsub>get_proc n\\<^esub>fs\\ \\sourcenode a = n\\\n have \"kind (hd cs) = Q:r\\\\<^bsub>get_proc (targetnode a)\\<^esub>fs\" by simp\n from \\valid_call_list cs n\\ \\sourcenode a = n\\\n \\get_proc (sourcenode a) = get_proc (targetnode a)\\\n have \"valid_call_list cs (targetnode a)\"\n apply(clarsimp simp:valid_call_list_def)\n apply(erule_tac x=\"cs'\" in allE)\n apply(erule_tac x=\"c\" in allE)\n by(auto split:list.split)\n from all \\intra_kind (kind a)\\\n have \"\\xs ys. as = xs@ys \\ \\ same_level_path_aux cs xs \\ upd_cs cs xs \\ []\"\n apply clarsimp apply(erule_tac x=\"a#xs\" in allE)\n by(auto simp:intra_kind_def)\n from IH[OF \\targetnode a -as\\* n'\\ \\valid_call_list cs (targetnode a)\\\n \\cs \\ []\\ this] show ?case .\nnext\n case (vpa_Call cs a as Q r p fs)\n note IH = \\\\n. \\n -as\\* n'; valid_call_list (a#cs) n; a#cs \\ [];\n \\xs ys. as = xs@ys \\ \\ same_level_path_aux (a#cs) xs \\ upd_cs (a#cs) xs \\ []\\\n \\ \\a' Q' r' fs'. valid_edge a' \\ kind a' = Q':r'\\\\<^bsub>get_proc n'\\<^esub>fs'\\\n note all = \\\\xs ys.\n a#as = xs@ys \\ \\ same_level_path_aux cs xs \\ upd_cs cs xs \\ []\\\n from \\n -a#as\\* n'\\ have \"sourcenode a = n\" and \"valid_edge a\" \n and \"targetnode a -as\\* n'\"\n by(auto intro:path_split_Cons)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ have \"get_proc (targetnode a) = p\"\n by(rule get_proc_call)\n with \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ have \"kind a = Q:r\\\\<^bsub>get_proc (targetnode a)\\<^esub>fs\" by simp\n with \\valid_call_list cs n\\ \\valid_edge a\\ \\sourcenode a = n\\\n have \"valid_call_list (a#cs) (targetnode a)\"\n apply(clarsimp simp:valid_call_list_def)\n apply(case_tac cs') apply auto\n apply(erule_tac x=\"list\" in allE)\n apply(erule_tac x=\"c\" in allE)\n by(auto split:list.split simp:sourcenodes_def)\n from all \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"\\xs ys. as = xs@ys \n \\ \\ same_level_path_aux (a#cs) xs \\ upd_cs (a#cs) xs \\ []\"\n apply clarsimp apply(erule_tac x=\"a#xs\" in allE)\n by auto\n from IH[OF \\targetnode a -as\\* n'\\ \\valid_call_list (a#cs) (targetnode a)\\\n _ this] show ?case by simp\nnext\n case (vpa_ReturnEmpty cs a as Q p fx)\n from \\cs \\ []\\ \\cs = []\\ have False by simp\n thus ?case by simp\nnext\n case (vpa_ReturnCons cs a as Q p f c' cs')\n note IH = \\\\n. \\n -as\\* n'; valid_call_list cs' n; cs' \\ [];\n \\xs ys. as = xs@ys \\ \\ same_level_path_aux cs' xs \\ upd_cs cs' xs \\ []\\\n \\ \\a' Q' r' fs'. valid_edge a' \\ kind a' = Q':r'\\\\<^bsub>get_proc n'\\<^esub>fs'\\\n note all = \\\\xs ys. a#as = xs@ys \n \\ \\ same_level_path_aux cs xs \\ upd_cs cs xs \\ []\\\n from \\n -a#as\\* n'\\ have \"sourcenode a = n\" and \"valid_edge a\" \n and \"targetnode a -as\\* n'\"\n by(auto intro:path_split_Cons)\n from \\valid_call_list cs n\\ \\cs = c'#cs'\\ have \"valid_edge c'\"\n apply(clarsimp simp:valid_call_list_def)\n apply(erule_tac x=\"[]\" in allE)\n by auto\n show ?case\n proof(cases \"cs' = []\")\n case True\n with all \\cs = c'#cs'\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\a \\ get_return_edges c'\\ have False\n by(erule_tac x=\"[a]\" in allE,fastforce)\n thus ?thesis by simp\n next\n case False\n with \\valid_call_list cs n\\ \\cs = c'#cs'\\\n have \"valid_call_list cs' (sourcenode c')\"\n apply(clarsimp simp:valid_call_list_def)\n apply(hypsubst_thin)\n apply(erule_tac x=\"c'#cs'\" in allE)\n apply(auto simp:sourcenodes_def)\n apply(case_tac cs') apply auto\n apply(case_tac list) apply(auto simp:sourcenodes_def)\n done\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n have \"get_proc (sourcenode c') = get_proc (targetnode a)\"\n by(rule get_proc_get_return_edge)\n with \\valid_call_list cs' (sourcenode c')\\\n have \"valid_call_list cs' (targetnode a)\"\n apply(clarsimp simp:valid_call_list_def)\n apply(hypsubst_thin)\n apply(erule_tac x=\"cs'\" in allE)\n apply(erule_tac x=\"c\" in allE)\n by(auto split:list.split)\n from all \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\cs = c'#cs'\\ \\a \\ get_return_edges c'\\\n have \"\\xs ys. as = xs@ys \\ \\ same_level_path_aux cs' xs \\ upd_cs cs' xs \\ []\"\n apply clarsimp apply(erule_tac x=\"a#xs\" in allE)\n by auto \n from IH[OF \\targetnode a -as\\* n'\\ \\valid_call_list cs' (targetnode a)\\\n False this] show ?thesis .\n qed\nqed\n\n\nlemma valid_Exit_path_cases:\n assumes \"n -as\\\\<^sub>\\* (_Exit_)\" and \"as \\ []\"\n shows \"(\\a' as'. as = a'#as' \\ intra_kind(kind a')) \\\n (\\a' as' Q p f. as = a'#as' \\ kind a' = Q\\\\<^bsub>p\\<^esub>f) \\\n (\\as' as'' n'. as = as'@as'' \\ as' \\ [] \\ n -as'\\\\<^bsub>sl\\<^esub>* n')\"\nproof -\n from \\as \\ []\\ obtain a' as' where \"as = a'#as'\" by(cases as) auto\n thus ?thesis\n proof(cases \"kind a'\" rule:edge_kind_cases)\n case Intra with \\as = a'#as'\\ show ?thesis by simp\n next\n case Return with \\as = a'#as'\\ show ?thesis by simp\n next\n case (Call Q r p f)\n from \\n -as\\\\<^sub>\\* (_Exit_)\\ have \"n -as\\* (_Exit_)\" and \"valid_path_aux [] as\"\n by(simp_all add:vp_def valid_path_def)\n from \\n -as\\* (_Exit_)\\ \\as = a'#as'\\\n have \"sourcenode a' = n\" and \"valid_edge a'\" and \"targetnode a' -as'\\* (_Exit_)\"\n by(auto intro:path_split_Cons)\n from \\valid_path_aux [] as\\ \\as = a'#as'\\ Call\n have \"valid_path_aux [a'] as'\" by simp\n from \\valid_edge a'\\ Call\n have \"valid_call_list [a'] (targetnode a')\"\n apply(clarsimp simp:valid_call_list_def)\n apply(case_tac cs') \n by(auto intro:get_proc_call[THEN sym])\n show ?thesis\n proof(cases \"\\xs ys. as' = xs@ys \\ \n (\\ same_level_path_aux [a'] xs \\ upd_cs [a'] xs \\ [])\")\n case True\n with \\valid_path_aux [a'] as'\\ \\targetnode a' -as'\\* (_Exit_)\\\n \\valid_call_list [a'] (targetnode a')\\\n obtain ax Qx rx fsx where \"valid_edge ax\" and \"kind ax = Qx:rx\\\\<^bsub>get_proc (_Exit_)\\<^esub>fsx\"\n by(fastforce dest!:vpa_no_slpa)\n hence False by(fastforce intro:Main_no_call_target simp:get_proc_Exit)\n thus ?thesis by simp\n next\n case False\n then obtain xs ys where \"as' = xs@ys\" and \"same_level_path_aux [a'] xs\"\n and \"upd_cs [a'] xs = []\" by auto\n with Call have \"same_level_path (a'#xs)\" by(simp add:same_level_path_def)\n from \\upd_cs [a'] xs = []\\ have \"xs \\ []\" by auto\n with \\targetnode a' -as'\\* (_Exit_)\\ \\as' = xs@ys\\\n have \"targetnode a' -xs\\* last(targetnodes xs)\"\n apply(cases xs rule:rev_cases)\n by(auto intro:path_Append path_split path_edge simp:targetnodes_def)\n with \\sourcenode a' = n\\ \\valid_edge a'\\ \\same_level_path (a'#xs)\\\n have \"n -a'#xs\\\\<^bsub>sl\\<^esub>* last(targetnodes xs)\"\n by(fastforce intro:Cons_path simp:slp_def)\n with \\as = a'#as'\\ \\as' = xs@ys\\ Call \n have \"\\as' as'' n'. as = as'@as'' \\ as' \\ [] \\ n -as'\\\\<^bsub>sl\\<^esub>* n'\"\n by(rule_tac x=\"a'#xs\" in exI) auto\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma valid_Exit_path_descending_path:\n assumes \"n -as\\\\<^sub>\\* (_Exit_)\"\n obtains as' where \"n -as'\\\\<^sub>\\* (_Exit_)\" \n and \"set(sourcenodes as') \\ set(sourcenodes as)\"\n and \"\\a' \\ set as'. intra_kind(kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\nproof(atomize_elim)\n from \\n -as\\\\<^sub>\\* (_Exit_)\\\n show \"\\as'. n -as'\\\\<^sub>\\* (_Exit_) \\ set(sourcenodes as') \\ set(sourcenodes as)\\\n (\\a' \\ set as'. intra_kind(kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f))\"\n proof(induct as arbitrary:n rule:length_induct)\n fix as n\n assume IH:\"\\as''. length as'' < length as \\\n (\\n'. n' -as''\\\\<^sub>\\* (_Exit_) \\\n (\\as'. n' -as'\\\\<^sub>\\* (_Exit_) \\ set (sourcenodes as') \\ set (sourcenodes as'') \\\n (\\a'\\set as'. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f))))\"\n and \"n -as\\\\<^sub>\\* (_Exit_)\"\n show \"\\as'. n -as'\\\\<^sub>\\* (_Exit_) \\ set(sourcenodes as') \\ set(sourcenodes as)\\\n (\\a' \\ set as'. intra_kind(kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f))\"\n proof(cases \"as = []\")\n case True\n with \\n -as\\\\<^sub>\\* (_Exit_)\\ show ?thesis by(fastforce simp:sourcenodes_def vp_def)\n next\n case False\n with \\n -as\\\\<^sub>\\* (_Exit_)\\\n have \"((\\a' as'. as = a'#as' \\ intra_kind(kind a')) \\\n (\\a' as' Q p f. as = a'#as' \\ kind a' = Q\\\\<^bsub>p\\<^esub>f)) \\\n (\\as' as'' n'. as = as'@as'' \\ as' \\ [] \\ n -as'\\\\<^bsub>sl\\<^esub>* n')\"\n by(auto dest!:valid_Exit_path_cases)\n thus ?thesis apply -\n proof(erule disjE)+\n assume \"\\a' as'. as = a'#as' \\ intra_kind(kind a')\"\n then obtain a' as' where \"as = a'#as'\" and \"intra_kind(kind a')\" by blast\n from \\n -as\\\\<^sub>\\* (_Exit_)\\ \\as = a'#as'\\\n have \"sourcenode a' = n\" and \"valid_edge a'\" \n and \"targetnode a' -as'\\\\<^sub>\\* (_Exit_)\"\n by(auto intro:vp_split_Cons)\n from \\valid_edge a'\\ \\intra_kind(kind a')\\\n have \"sourcenode a' -[a']\\\\<^bsub>sl\\<^esub>* targetnode a'\"\n by(fastforce intro:path_edge intras_same_level_path simp:slp_def)\n from IH \\targetnode a' -as'\\\\<^sub>\\* (_Exit_)\\ \\as = a'#as'\\\n obtain xs where \"targetnode a' -xs\\\\<^sub>\\* (_Exit_)\" \n and \"set (sourcenodes xs) \\ set (sourcenodes as')\"\n and \"\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n apply(erule_tac x=\"as'\" in allE) by auto\n from \\sourcenode a' -[a']\\\\<^bsub>sl\\<^esub>* targetnode a'\\ \\targetnode a' -xs\\\\<^sub>\\* (_Exit_)\\\n have \"sourcenode a' -[a']@xs\\\\<^sub>\\* (_Exit_)\" by(rule slp_vp_Append)\n with \\sourcenode a' = n\\ have \"n -a'#xs\\\\<^sub>\\* (_Exit_)\" by simp\n moreover\n from \\set (sourcenodes xs) \\ set (sourcenodes as')\\ \\as = a'#as'\\\n have \"set (sourcenodes (a'#xs)) \\ set (sourcenodes as)\"\n by(auto simp:sourcenodes_def)\n moreover\n from \\\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\\ \n \\intra_kind(kind a')\\\n have \"\\a'\\set (a'#xs). intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n by fastforce\n ultimately show ?thesis by blast\n next\n assume \"\\a' as' Q p f. as = a'#as' \\ kind a' = Q\\\\<^bsub>p\\<^esub>f\"\n then obtain a' as' Q p f where \"as = a'#as'\" and \"kind a' = Q\\\\<^bsub>p\\<^esub>f\" by blast\n from \\n -as\\\\<^sub>\\* (_Exit_)\\ \\as = a'#as'\\\n have \"sourcenode a' = n\" and \"valid_edge a'\" \n and \"targetnode a' -as'\\\\<^sub>\\* (_Exit_)\"\n by(auto intro:vp_split_Cons)\n from IH \\targetnode a' -as'\\\\<^sub>\\* (_Exit_)\\ \\as = a'#as'\\\n obtain xs where \"targetnode a' -xs\\\\<^sub>\\* (_Exit_)\" \n and \"set (sourcenodes xs) \\ set (sourcenodes as')\"\n and \"\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n apply(erule_tac x=\"as'\" in allE) by auto\n from \\sourcenode a' = n\\ \\valid_edge a'\\ \\kind a' = Q\\\\<^bsub>p\\<^esub>f\\\n \\targetnode a' -xs\\\\<^sub>\\* (_Exit_)\\\n have \"n -a'#xs\\\\<^sub>\\* (_Exit_)\"\n by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n moreover\n from \\set (sourcenodes xs) \\ set (sourcenodes as')\\ \\as = a'#as'\\\n have \"set (sourcenodes (a'#xs)) \\ set (sourcenodes as)\"\n by(auto simp:sourcenodes_def)\n moreover\n from \\\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\\ \n \\kind a' = Q\\\\<^bsub>p\\<^esub>f\\\n have \"\\a'\\set (a'#xs). intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n by fastforce\n ultimately show ?thesis by blast\n next\n assume \"\\as' as'' n'. as = as'@as'' \\ as' \\ [] \\ n -as'\\\\<^bsub>sl\\<^esub>* n'\"\n then obtain as' as'' n' where \"as = as'@as''\" and \"as' \\ []\"\n and \"n -as'\\\\<^bsub>sl\\<^esub>* n'\" by blast\n from \\n -as\\\\<^sub>\\* (_Exit_)\\ \\as = as'@as''\\ \\as' \\ []\\\n have \"last(targetnodes as') -as''\\\\<^sub>\\* (_Exit_)\"\n by(cases as' rule:rev_cases,auto intro:vp_split simp:targetnodes_def)\n from \\n -as'\\\\<^bsub>sl\\<^esub>* n'\\ \\as' \\ []\\ have \"last(targetnodes as') = n'\"\n by(fastforce intro:path_targetnode simp:slp_def)\n from \\as = as'@as''\\ \\as' \\ []\\ have \"length as'' < length as\" by simp\n with IH \\last(targetnodes as') -as''\\\\<^sub>\\* (_Exit_)\\\n \\last(targetnodes as') = n'\\\n obtain xs where \"n' -xs\\\\<^sub>\\* (_Exit_)\" \n and \"set (sourcenodes xs) \\ set (sourcenodes as'')\"\n and \"\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n apply(erule_tac x=\"as''\" in allE) by auto\n from \\n -as'\\\\<^bsub>sl\\<^esub>* n'\\ obtain ys where \"n -ys\\\\<^sub>\\* n'\"\n and \"set(sourcenodes ys) \\ set(sourcenodes as')\"\n by(erule same_level_path_inner_path)\n from \\n -ys\\\\<^sub>\\* n'\\ \\n' -xs\\\\<^sub>\\* (_Exit_)\\ have \"n -ys@xs\\\\<^sub>\\* (_Exit_)\"\n by(fastforce intro:slp_vp_Append intra_path_slp)\n moreover\n from \\set (sourcenodes xs) \\ set (sourcenodes as'')\\\n \\set(sourcenodes ys) \\ set(sourcenodes as')\\ \\as = as'@as''\\\n have \"set (sourcenodes (ys@xs)) \\ set(sourcenodes as)\"\n by(auto simp:sourcenodes_def)\n moreover\n from \\\\a'\\set xs. intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\\\n \\n -ys\\\\<^sub>\\* n'\\\n have \"\\a'\\set (ys@xs). intra_kind (kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n by(fastforce simp:intra_path_def)\n ultimately show ?thesis by blast\n qed\n qed\n qed\nqed\n\n\nlemma valid_Exit_path_intra_path:\n assumes \"n -as\\\\<^sub>\\* (_Exit_)\" \n obtains as' pex where \"n -as'\\\\<^sub>\\* pex\" and \"method_exit pex\" \n and \"set(sourcenodes as') \\ set(sourcenodes as)\"\nproof(atomize_elim)\n from \\n -as\\\\<^sub>\\* (_Exit_)\\\n obtain as' where \"n -as'\\\\<^sub>\\* (_Exit_)\" \n and \"set(sourcenodes as') \\ set(sourcenodes as)\"\n and all:\"\\a' \\ set as'. intra_kind(kind a') \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n by(erule valid_Exit_path_descending_path)\n show \"\\as' pex. n -as'\\\\<^sub>\\* pex \\ method_exit pex \\ \n set(sourcenodes as') \\ set(sourcenodes as)\"\n proof(cases \"\\a' \\ set as'. \\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f\")\n case True\n then obtain asx ax asx' where [simp]:\"as' = asx@ax#asx'\" \n and \"\\Q f p. kind ax = Q\\\\<^bsub>p\\<^esub>f\" and \"\\a' \\ set asx. \\ (\\Q f p. kind a' = Q\\\\<^bsub>p\\<^esub>f)\"\n by(erule split_list_first_propE)\n with all have \"\\a' \\ set asx. intra_kind(kind a')\" by auto\n from \\n -as'\\\\<^sub>\\* (_Exit_)\\ have \"n -asx\\* sourcenode ax\"\n and \"valid_edge ax\" by(auto elim:path_split simp:vp_def)\n from \\n -asx\\* sourcenode ax\\ \\\\a' \\ set asx. intra_kind(kind a')\\\n have \"n -asx\\\\<^sub>\\* sourcenode ax\" by(simp add:intra_path_def)\n moreover\n from \\valid_edge ax\\ \\\\Q f p. kind ax = Q\\\\<^bsub>p\\<^esub>f\\\n have \"method_exit (sourcenode ax)\" by(fastforce simp:method_exit_def)\n moreover\n from \\set(sourcenodes as') \\ set(sourcenodes as)\\\n have \"set(sourcenodes asx) \\ set(sourcenodes as)\" by(simp add:sourcenodes_def)\n ultimately show ?thesis by blast\n next\n case False\n with all \\n -as'\\\\<^sub>\\* (_Exit_)\\ have \"n -as'\\\\<^sub>\\* (_Exit_)\" \n by(fastforce simp:vp_def intra_path_def)\n moreover have \"method_exit (_Exit_)\" by(simp add:method_exit_def)\n ultimately show ?thesis using \\set(sourcenodes as') \\ set(sourcenodes as)\\\n by blast\n qed\nqed\n\n\n\nend \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/StaticInter/CFGExit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2790285113400851}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Recycle_C\nimports Delete_C Retype_C\nbegin\n\ncontext kernel_m\nbegin\n\ndefinition\n \"replicateHider \\ replicate\"\n\nlemma collapse_foldl_replicate:\n \"replicate (length xs) v = xs \\\n foldl (@) [] (map (\\_. xs) ys)\n = replicateHider (length xs * length ys) v\"\n apply (induct ys rule: rev_induct)\n apply (simp add: replicateHider_def)\n apply (simp add: replicateHider_def)\n apply (subst add.commute, simp add: replicate_add)\n done\n\nlemma coerce_memset_to_heap_update_user_data:\n \"heap_update_list x (replicateHider 4096 0)\n = heap_update (Ptr x :: user_data_C ptr)\n (user_data_C (FCP (\\_. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps user_data_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps\n user_context_C_tag_def thread_state_C_tag_def seL4_Fault_C_tag_def\n lookup_fault_C_tag_def update_ti_t_ptr_0s\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n align_td_array' size_td_array)\n apply (simp add: typ_info_array')\n apply (subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: fcp_beta typ_info_word typ_info_ptr word_rsplit_0)\n apply fastforce\n apply (simp add: collapse_foldl_replicate)\n done\n\nlemma clift_foldl_hrs_mem_update:\n \"\\ \\x \\ set xs. hrs_htd s \\\\<^sub>t f x;\n \\x s. hrs_htd s \\\\<^sub>t f x \\ clift (hrs_mem_update (heap_update (f x) v) s)\n = g (clift s :: ('a :: c_type) ptr \\ 'a) x \\\n \\\n clift (hrs_mem_update (\\s. foldl (\\s x. heap_update (f x) v s) s xs) s)\n = foldl g (clift s :: 'a ptr \\ 'a) xs\"\n using [[hypsubst_thin]]\n apply (cases s, clarsimp)\n apply (induct xs arbitrary: a b)\n apply (simp add: hrs_mem_update_def)\n apply (clarsimp simp add: hrs_mem_update_def split_def hrs_htd_def)\n done\n\nlemma map_to_user_data_aligned:\n \"\\ map_to_user_data (ksPSpace s) x = Some y; pspace_aligned' s \\\n \\ is_aligned x pageBits\"\n apply (clarsimp simp: map_comp_eq projectKOs split: option.split_asm)\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps)\n done\n\nlemma help_force_intvl_range_conv:\n \"\\ is_aligned (p::word32) n; v = 2 ^ n; n < word_bits \\\n \\ {p ..+ v} = {p .. p + 2 ^ n - 1}\"\n by (simp add: intvl_range_conv word_bits_def)\n\nlemma cmap_relation_If_upd:\n \"\\ cmap_relation f g ptrfun rel; rel v v'; ptrfun ` S = S'; inj ptrfun \\\n \\ cmap_relation (\\x. if x \\ S then Some v else f x)\n (\\y. if y \\ S' then Some v' else g y)\n ptrfun rel\"\n apply (simp add: cmap_relation_def dom_If_Some)\n apply (rule context_conjI)\n apply blast\n apply clarsimp\n apply (case_tac \"x \\ S\")\n apply simp\n apply clarsimp\n apply (subst if_not_P)\n apply (clarsimp simp: inj_eq)\n apply (drule bspec, erule domI)\n apply simp\n done\n\nlemma length_replicateHider [simp]:\n \"length (replicateHider n x) = n\"\n by (simp add: replicateHider_def)\n\nlemma coerce_heap_update_to_heap_updates':\n \"n = chunk * m \\\n heap_update_list x (replicateHider n 0)\n = (\\s. foldl (\\s x. heap_update_list x (replicateHider chunk 0) s) s\n (map (\\n. x + (of_nat n * of_nat chunk)) [0 ..< m]))\"\n using [[hypsubst_thin]]\n apply clarsimp\n apply (induct m arbitrary: x)\n apply (rule ext, simp)\n apply (simp add: replicateHider_def)\n apply (rule ext)\n apply (simp only: map_upt_unfold map_Suc_upt[symmetric])\n apply (simp add: replicate_add[folded replicateHider_def]\n heap_update_list_concat_unfold\n o_def field_simps\n length_replicate[folded replicateHider_def])\n done\n\nlemma h_t_valid_dom_s:\n \"\\ h_t_valid htd c_guard p; x = ptr_val (p :: ('a :: mem_type) ptr);\n n = size_of TYPE ('a) \\\n \\ {x ..+ n} \\ {SIndexVal, SIndexTyp 0} \\ dom_s htd\"\n apply (clarsimp simp: h_t_valid_def valid_footprint_def Let_def\n intvl_def)\n apply (drule_tac x=k in spec, simp add: size_of_def)\n apply (clarsimp simp: dom_s_def)\n apply (drule_tac x=0 in map_leD, simp_all)\n done\n\nlemma user_data_at_rf_sr_dom_s:\n \"\\ typ_at' UserDataT x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (drule rf_sr_heap_user_data_relation)\n apply (drule user_data_at_ko)\n apply (erule_tac x=x in cmap_relationE1)\n apply (simp only: heap_to_user_data_def Let_def ko_at_projectKO_opt)\n apply simp\n apply (drule h_t_valid_clift)\n apply (simp add: h_t_valid_dom_s pageBits_def)\n done\n\nlemma intvl_2_power_times_decomp:\n \"\\y < 2 ^ (n - m). {x + y * 2 ^ m ..+ 2 ^ m} \\ S \\ T\n \\ m \\ n \\ n < word_bits\n \\ {(x :: word32) ..+ 2 ^ n} \\ S \\ T\"\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"of_nat k >> m\" in spec)\n apply (drule mp)\n apply (rule shiftr_less_t2n)\n apply (rule word_of_nat_less)\n apply (simp add: word_of_nat_less)\n apply (erule subsetD)\n apply (clarsimp simp: shiftl_t2n[simplified mult.commute mult.left_commute, symmetric]\n shiftr_shiftl1)\n apply (rule_tac x=\"unat (of_nat k && mask m :: word32)\" in exI)\n apply (simp add: field_simps word_plus_and_or_coroll2)\n apply (simp add: word_bits_def unat_less_power and_mask_less')\n done\n\nlemma flex_user_data_at_rf_sr_dom_s:\n \"\\ (\\p<2 ^ (pageBitsForSize sz - pageBits).\n typ_at' UserDataT (x + p * 2 ^ pageBits) s); (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBitsForSize sz} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=pageBits in intvl_2_power_times_decomp,\n simp_all add: pbfs_atleast_pageBits pbfs_less_wb')\n apply (erule allEI, clarsimp)\n apply (drule(1) user_data_at_rf_sr_dom_s)\n apply (erule subsetD)\n apply simp\n done\n\nlemma hrs_mem_update_fold_eq:\n \"hrs_mem_update (fold f xs)\n = fold (hrs_mem_update o f) xs\"\n apply (rule sym, induct xs)\n apply (simp add: hrs_mem_update_def)\n apply (simp add: hrs_mem_update_def fun_eq_iff)\n done\n\nlemma power_user_page_foldl_zero_ranges:\n \" \\p<2 ^ (pageBitsForSize sz - pageBits).\n hrs_htd hrs \\\\<^sub>t (Ptr (ptr + of_nat p * 0x1000) :: user_data_C ptr)\n \\ zero_ranges_are_zero rngs hrs\n \\ zero_ranges_are_zero rngs\n (hrs_mem_update (\\s. foldl (\\s x. heap_update (Ptr x) (user_data_C (arr x)) s) s\n (map (\\n. ptr + of_nat n * 0x1000) [0..<2 ^ (pageBitsForSize sz - pageBits)]))\n hrs)\"\n apply (simp add: foldl_conv_fold hrs_mem_update_fold_eq)\n apply (rule conjunct1)\n apply (rule fold_invariant[where P=\"\\hrs'. zero_ranges_are_zero rngs hrs'\n \\ hrs_htd hrs' = hrs_htd hrs\"\n and xs=xs and Q=\"\\x. x \\ set xs\" for xs], simp_all)\n apply (subst zero_ranges_are_zero_update, simp_all)\n apply clarsimp\n done\n\ndeclare replicate_numeral [simp]\n\nlemma coerce_memset_to_heap_update_pte:\n \"heap_update_list x (replicateHider 4 0)\n = heap_update (Ptr x :: pte_C ptr)\n (pte_C.pte_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pte_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: replicateHider_def)\n done\n\nlemma objBits_eq_by_type:\n fixes x :: \"'a :: pspace_storable\" and y :: 'a\n shows \"objBits x = objBits y\"\n apply (simp add: objBits_def)\n apply (rule objBits_type)\n apply (simp add: koTypeOf_injectKO)\n done\n\nlemma mapM_x_store_memset_ccorres_assist:\n fixes val :: \"'a :: pspace_storable\"\n assumes nofail: \"\\ snd (mapM_x (\\slot. setObject slot val) slots \\)\"\n assumes slots1: \"\\n < length slots. slots ! n = hd slots + (of_nat n << objBits val)\"\n assumes slots2: \"n = length slots * (2 ^ objBits val)\"\n assumes ptr: \"ptr = hd slots\"\n assumes ko: \"\\ko :: 'a. updateObject ko = updateObject_default ko\"\n \"\\ko :: 'a. (1 :: word32) < 2 ^ objBits ko\"\n assumes restr: \"set slots \\ S\"\n assumes worker: \"\\ptr s s' (ko :: 'a). \\ (s, s') \\ rf_sr; ko_at' ko ptr s; ptr \\ S \\\n \\ (s \\ ksPSpace := ksPSpace s (ptr \\ injectKO val)\\,\n globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr\n (replicateHider (2 ^ objBits val) (ucast c))))) s') \\ rf_sr\"\n assumes rf_sr: \"(\\, s) \\ rf_sr\"\n shows\n \"\\(rv, \\') \\ fst (mapM_x (\\slot. setObject slot val) slots \\).\n (\\', globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr (replicateHider n c)))) s) \\ rf_sr\"\n unfolding slots2 ptr using rf_sr slots1 nofail restr\nproof (induct slots arbitrary: s \\)\n case Nil\n show ?case\n using Nil.prems\n apply (simp add: mapM_x_def sequence_x_def return_def replicateHider_def)\n apply (simp add: rf_sr_def hrs_mem_update_def cstate_relation_def Let_def\n carch_state_relation_def cmachine_state_relation_def\n h_t_valid_clift_Some_iff)\n done\nnext\n case (Cons x xs tPre sPre)\n\n note nofail_bind = Cons.prems(3)[unfolded mapM_x_Cons K_bind_def]\n\n have obj_at: \"obj_at' (\\x :: 'a. True) x sPre\"\n using not_snd_bindI1[OF nofail_bind]\n apply (subst(asm) setObject_obj_at_pre, simp_all add: ko snd_bind)\n apply (clarsimp simp: stateAssert_def exec_get return_def)\n apply (simp add: koTypeOf_injectKO typ_at_to_obj_at')\n done\n\n note in_setObject = setObject_eq[OF _ _ objBits_eq_by_type obj_at,\n where ko=val, simplified ko, simplified]\n\n note nofail_mapM = not_snd_bindI2[OF nofail_bind, OF in_setObject]\n\n have hd_xs: \"xs \\ [] \\ hd xs = x + (2 ^ objBits val)\"\n using Cons.prems(2)[rule_format, where n=1]\n by (simp add: hd_conv_nth)\n\n show ?case\n using obj_at_ko_at'[OF obj_at] Cons.prems(4)\n apply (clarsimp simp add: mapM_x_Cons bind_def split_def)\n apply (rule rev_bexI, rule in_setObject)\n apply (cut_tac Cons.hyps[OF _ _ nofail_mapM])\n defer\n apply (rule worker, rule Cons.prems, assumption+)\n apply clarsimp\n apply (case_tac \"xs = []\", simp_all)[1]\n apply (insert Cons.prems, simp)[1]\n apply (frule_tac x=\"Suc n\" in spec)\n apply (simp add: hd_xs shiftl_t2n field_simps)\n apply assumption\n apply clarsimp\n apply (rule rev_bexI, assumption)\n apply (simp add: o_def)\n apply (case_tac \"xs = []\")\n apply (simp add: hrs_mem_update_def split_def replicateHider_def)\n apply (subst(asm) heap_update_list_concat_fold_hrs_mem)\n apply (simp add: hd_xs replicateHider_def)\n apply (simp add: replicateHider_def replicate_add)\n done\nqed\n\nlemma invalidateTLBByASID_ccorres:\n \"ccorres dc xfdc (valid_pde_mappings' and (\\_. asid \\ mask asid_bits))\n (UNIV \\ {s. asid_' s = asid}) []\n (invalidateTLBByASID asid) (Call invalidateTLBByASID_'proc)\"\n apply (cinit lift: asid_')\n apply (ctac(no_vcg) add: loadHWASID_ccorres)\n apply csymbr\n apply (simp add: case_option_If2 del: Collect_const)\n apply (rule ccorres_if_cond_throws2[where Q=\\ and Q'=\\])\n apply (clarsimp simp: pde_stored_asid_def to_bool_def split: if_split)\n apply (rule ccorres_return_void_C[unfolded dc_def])\n apply (simp add: dc_def[symmetric])\n apply csymbr\n apply (ctac add: invalidateTranslationASID_ccorres)\n apply vcg\n apply (wp hoare_drop_imps)\n apply (clarsimp simp: pde_stored_asid_def to_bool_def)\n done\n\nend\n\nlemma option_to_0_user_mem':\n \"option_to_0 \\ user_mem' as =(\\x. if x \\ {y. \\ pointerInUserData y as} then 0\n else underlying_memory (ksMachineState as) x) \"\n apply (rule ext)\n apply (simp add:user_mem'_def option_to_0_def split:if_splits)\n done\n\nlemma heap_to_user_data_in_user_mem'[simp]:\n \"\\pspace_aligned' as;pspace_distinct' as\\ \\ heap_to_user_data (ksPSpace as) (option_to_0 \\ user_mem' as) =\n heap_to_user_data (ksPSpace as)(underlying_memory (ksMachineState as))\"\n apply (rule ext)+\n apply (clarsimp simp: heap_to_user_data_def option_map_def\n split: option.splits)\n apply (subst option_to_0_user_mem')\n apply (subst map_option_byte_to_word_heap)\n apply (clarsimp simp: projectKO_opt_user_data map_comp_def\n split: option.split_asm kernel_object.split_asm)\n apply (frule(1) pspace_alignedD')\n apply (frule(1) pspace_distinctD')\n apply (subgoal_tac \"x + ucast off * 4 + xa && ~~ mask pageBits = x\" )\n apply (clarsimp simp: pointerInUserData_def typ_at'_def ko_wp_at'_def)\n apply (simp add: ARM.pageBits_def)\n apply (subst mask_lower_twice2[where n = 2 and m = 12,simplified,symmetric])\n apply (subst is_aligned_add_helper[THEN conjunct2,where n1 = 2])\n apply (erule aligned_add_aligned)\n apply (simp add: is_aligned_mult_triv2[where n = 2,simplified])\n apply (clarsimp simp: objBits_simps ARM.pageBits_def)\n apply simp\n apply (rule is_aligned_add_helper[THEN conjunct2])\n apply (simp add: ARM.pageBits_def objBits_simps)\n apply (rule word_less_power_trans2[where k = 2,simplified])\n apply (rule less_le_trans[OF ucast_less])\n apply simp+\n done\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ncrunch pde_mappings'[wp]: invalidateTLBByASID \"valid_pde_mappings'\"\ncrunch ksArchState[wp]: invalidateTLBByASID \"\\s. P (ksArchState s)\"\n\ncrunch gsMaxObjectSize[wp]: invalidateTLBByASID \"\\s. P (gsMaxObjectSize s)\"\ncrunch gsMaxObjectSize[wp]: deleteASIDPool \"\\s. P (gsMaxObjectSize s)\"\n (wp: crunch_wps getObject_inv loadObject_default_inv\n simp: crunch_simps)\nend\n\ncontext kernel_m begin\n\nlemma page_table_at_rf_sr_dom_s:\n \"\\ page_table_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ ptBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=2 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps ptBits_def pageBits_def\n word_bits_def pteBits_def)\n apply (clarsimp simp: page_table_at'_def intvl_def)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpte_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\nlemma clearMemory_setObject_PTE_ccorres:\n \"ccorres dc xfdc (page_table_at' ptr\n and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\n and (\\_. is_aligned ptr ptBits \\ ptr \\ 0 \\ pstart = addrFromPPtr ptr))\n (UNIV \\ {s. ptr___ptr_to_unsigned_long_' s = Ptr ptr} \\ {s. bits_' s = of_nat ptBits}) []\n (do x \\ mapM_x (\\a. setObject a ARM_H.InvalidPTE)\n [ptr , ptr + 2 ^ pteBits .e. ptr + 2 ^ ptBits - 1];\n doMachineOp (cleanCacheRange_PoU ptr (ptr + 2 ^ ptBits - 1) pstart)\n od)\n (Call clearMemory_'proc)\"\n apply (rule ccorres_gen_asm)+\n apply (cinit' lift: ptr___ptr_to_unsigned_long_' bits_')\n apply (rule ccorres_Guard_Seq)\n apply (rule ccorres_split_nothrow_novcg_dc)\n apply (rule_tac P=\"page_table_at' ptr and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\"\n in ccorres_from_vcg_nofail[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (subst ghost_assertion_size_logic[unfolded o_def])\n apply (simp add: ptBits_def pageBits_def pteBits_def)\n apply simp\n apply (clarsimp simp: replicateHider_def[symmetric])\n apply (frule is_aligned_no_overflow')\n apply (intro conjI)\n apply (clarsimp simp add: ptBits_def pageBits_def pteBits_def\n cong: StateSpace.state.fold_congs globals.fold_congs)\n apply (erule is_aligned_weaken, simp add: ptBits_def pageBits_def)\n apply (clarsimp simp: is_aligned_def ptBits_def pageBits_def pteBits_def)\n apply (simp add: unat_of_nat32 order_less_le_trans[OF pt_bits_stuff(2)]\n word_bits_def page_table_at_rf_sr_dom_s)\n apply (clarsimp simp add: ptBits_def pageBits_def pteBits_def\n cong: StateSpace.state.fold_congs globals.fold_congs)\n apply (simp add: upto_enum_step_def objBits_simps ptBits_def pageBits_def\n field_simps linorder_not_less[symmetric] archObjSize_def\n upto_enum_word split_def pteBits_def)\n apply (erule mapM_x_store_memset_ccorres_assist\n [unfolded split_def, OF _ _ _ _ _ _ subset_refl],\n simp_all add: shiftl_t2n hd_map objBits_simps archObjSize_def pteBits_def)[1]\n apply (rule cmap_relationE1, erule rf_sr_cpte_relation, erule ko_at_projectKO_opt)\n apply (subst coerce_memset_to_heap_update_pte)\n apply (clarsimp simp: rf_sr_def Let_def cstate_relation_def typ_heap_simps)\n apply (rule conjI)\n apply (simp add: cpspace_relation_def typ_heap_simps update_pte_map_tos\n update_pte_map_to_ptes carray_map_relation_upd_triv)\n apply (rule cmap_relation_updI, simp_all)[1]\n apply (simp add: cpte_relation_def Let_def pte_lift_def\n fcp_beta pte_get_tag_def pte_tag_defs)\n apply (simp add: carch_state_relation_def cmachine_state_relation_def\n typ_heap_simps update_pte_map_tos)\n apply csymbr\n apply (rule ccorres_Guard)\n apply (ctac add: cleanCacheRange_PoU_ccorres)\n apply (wp mapM_x_wp' setObject_ksPSpace_only updateObject_default_inv | simp)+\n apply (clarsimp simp: guard_is_UNIV_def ptBits_def pageBits_def pteBits_def)\n apply (clarsimp simp: ptBits_def pageBits_def pteBits_def)\n apply (frule is_aligned_addrFromPPtr_n, simp)\n apply (clarsimp simp: is_aligned_no_overflow'[where n=10, simplified] pageBits_def\n field_simps is_aligned_mask[symmetric] mask_AND_less_0)\n done\n\nlemma modify_gets_helper:\n \"do y \\ modify (ksPSpace_update (\\_. ps)); ps' \\ gets ksPSpace; f ps' od\n = do y \\ modify (ksPSpace_update (\\_. ps)); f ps od\"\n by (simp add: bind_def simpler_modify_def simpler_gets_def)\n\nlemma snd_lookupAround2_update:\n \"ps y \\ None \\\n snd (lookupAround2 x (ps (y \\ v'))) = snd (lookupAround2 x ps)\"\n apply (clarsimp simp: lookupAround2_def lookupAround_def Let_def\n dom_fun_upd2\n simp del: dom_fun_upd cong: if_cong option.case_cong)\n apply (clarsimp split: option.split if_split cong: if_cong)\n apply auto\n done\n\nlemma double_setEndpoint:\n \"do y \\ setEndpoint epptr v1; setEndpoint epptr v2 od\n = setEndpoint epptr v2\"\n apply (simp add: setEndpoint_def setObject_def bind_assoc split_def\n modify_gets_helper)\n apply (simp add: updateObject_default_def bind_assoc objBits_simps)\n apply (rule ext)\n apply (rule bind_apply_cong, rule refl)+\n apply (clarsimp simp add: in_monad projectKOs magnitudeCheck_assert\n snd_lookupAround2_update)\n apply (simp add: lookupAround2_known1 assert_opt_def projectKO_def projectKO_opt_ep\n alignCheck_assert)\n apply (simp add: bind_def simpler_modify_def)\n done\n\nlemma ccorres_inst_voodoo:\n \"\\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\n \\ \\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\"\n by simp\n\nlemma cpspace_relation_ep_update_ep2:\n \"\\ ko_at' (ep :: endpoint) epptr s;\n cmap_relation (map_to_eps (ksPSpace s))\n (cslift t) ep_Ptr (cendpoint_relation (cslift t));\n cendpoint_relation (cslift t') ep' endpoint;\n (cslift t' :: tcb_C ptr \\ tcb_C) = cslift t \\\n \\ cmap_relation (map_to_eps (ksPSpace s(epptr \\ KOEndpoint ep')))\n (cslift t(ep_Ptr epptr \\ endpoint))\n ep_Ptr (cendpoint_relation (cslift t'))\"\n apply (rule cmap_relationE1, assumption, erule ko_at_projectKO_opt)\n apply (rule_tac P=\"\\a. cmap_relation a b c d\" for b c d in rsubst,\n erule cmap_relation_upd_relI, assumption+)\n apply simp+\n apply (rule ext, simp add: map_comp_def projectKO_opt_ep split: if_split)\n done\n\nend\n\ncontext kernel_m begin\n\nlemma ccorres_subst_basic_helper:\n \"\\ \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ f s' = f' s';\n \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ (s, f' s') \\ rf_sr;\n \\s'. xf' (f' s') = v; \\rv' t t'. ceqv \\ xf' rv' t t' c (c' rv');\n ccorres rrel xf Q Q' hs a (c' v) \\\n \\ ccorres rrel xf (P and Q) {s. s \\ P' \\ f' s \\ Q'} hs a (Basic f ;; c)\"\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_add_return)\n apply (rule ccorres_split_nothrow[where xf'=xf' and r'=\"\\rv rv'. rv' = v\"])\n apply (rule ccorres_from_vcg[where P=P and P'=P'])\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: return_def)\n apply assumption\n apply simp\n apply wp\n apply vcg\n apply clarsimp\n done\n\nlemma ctcb_relation_blocking_ipc_badge:\n \"\\ ctcb_relation tcb ctcb; isBlockedOnSend (tcbState tcb) \\ \\\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend\"\n \"\\ ctcb_relation tcb ctcb;\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend \\\n \\ blockingIPCBadge (tcbState tcb)\n = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\"\n apply (clarsimp simp add: ctcb_relation_def)\n apply (simp add: isBlockedOnSend_def split: Structures_H.thread_state.split_asm)\n apply (clarsimp simp: cthread_state_relation_def)\n apply (clarsimp simp add: ctcb_relation_def cthread_state_relation_def)\n apply (cases \"tcbState tcb\", simp_all add: \"StrictC'_thread_state_defs\")\n done\n\nlemma cendpoint_relation_q_cong:\n \"\\ \\t rf. (t, rf) \\ ep_q_refs_of' ep \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t) \\\n \\ cendpoint_relation hp ep ep' = cendpoint_relation hp' ep ep'\"\n apply (cases ep, simp_all add: cendpoint_relation_def Let_def)\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n done\n\nlemma cnotification_relation_q_cong:\n \"\\\\t rf. (t, rf) \\ ntfn_q_refs_of' (ntfnObj ntfn) \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t)\\\n \\ cnotification_relation hp ntfn ntfn' = cnotification_relation hp' ntfn ntfn'\"\n apply (cases \"ntfnObj ntfn\", simp_all add: cnotification_relation_def Let_def)\n apply (auto intro: iffD1[OF tcb_queue_relation'_cong[OF refl refl refl]])\n done\n\nlemma tcbSchedEnqueue_ep_at:\n \"\\obj_at' (P :: endpoint \\ bool) ep\\\n tcbSchedEnqueue t\n \\\\rv. obj_at' P ep\\\"\n including no_pre\n apply (simp add: tcbSchedEnqueue_def unless_def null_def)\n apply (wp threadGet_wp, clarsimp, wp+)\n apply (clarsimp split: if_split, wp)\n done\n\nlemma ccorres_duplicate_guard:\n \"ccorres r xf (P and P) Q hs f f' \\ ccorres r xf P Q hs f f'\"\n by (erule ccorres_guard_imp, auto)\n\n\nlemma ep_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ep_q_refs_of' ep\"\n by (auto simp: ep_q_refs_of'_def split: endpoint.splits)\n\n\nlemma ntfn_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ntfn_q_refs_of' ntfn\"\n by (auto simp: ntfn_q_refs_of'_def split: ntfn.splits)\n\nlemma cancelBadgedSends_ccorres:\n \"ccorres dc xfdc (invs' and ep_at' ptr)\n (UNIV \\ {s. epptr_' s = Ptr ptr} \\ {s. badge_' s = bdg}) []\n (cancelBadgedSends ptr bdg) (Call cancelBadgedSends_'proc)\"\n apply (cinit lift: epptr_' badge_' simp: whileAnno_def)\n apply (simp add: list_case_return2\n cong: list.case_cong Structures_H.endpoint.case_cong call_ignore_cong\n del: Collect_const)\n apply (rule ccorres_pre_getEndpoint)\n apply (rule_tac R=\"ko_at' rv ptr\" and xf'=\"ret__unsigned_'\"\n and val=\"case rv of RecvEP q \\ scast EPState_Recv | IdleEP \\ scast EPState_Idle\n | SendEP q \\ scast EPState_Send\"\n in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV])\n apply vcg\n apply clarsimp\n apply (erule cmap_relationE1 [OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def\n split: Structures_H.endpoint.split_asm)\n apply ceqv\n apply wpc\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (rename_tac list)\n apply (simp add: Collect_True Collect_False endpoint_state_defs\n ccorres_cond_iffs dc_def[symmetric]\n del: Collect_const cong: call_ignore_cong)\n apply (rule ccorres_rhs_assoc)+\n apply (csymbr, csymbr)\n apply (drule_tac s = rv in sym, simp only:)\n apply (rule_tac P=\"ko_at' rv ptr and invs'\" in ccorres_cross_over_guard)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2)\n apply (rule ccorres_split_nothrow[where r'=dc and xf'=xfdc, OF _ ceqv_refl])\n apply (rule_tac P=\"ko_at' rv ptr\"\n in ccorres_from_vcg[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps setEndpoint_def)\n apply (rule rev_bexI)\n apply (rule setObject_eq; simp add: objBits_simps')[1]\n apply (clarsimp simp: rf_sr_def cstate_relation_def\n Let_def carch_state_relation_def\n cmachine_state_relation_def\n )\n apply (clarsimp simp: cpspace_relation_def\n update_ep_map_tos\n typ_heap_simps')\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def endpoint_state_defs)\n subgoal by simp\n apply (rule ccorres_symb_exec_r)\n apply (rule_tac xs=list in filterM_voodoo)\n apply (rule_tac P=\"\\xs s. (\\x \\ set xs \\ set list.\n st_tcb_at' (\\st. isBlockedOnSend st \\ blockingObject st = ptr) x s)\n \\ distinct (xs @ list) \\ ko_at' IdleEP ptr s\n \\ (\\p. \\x \\ set (xs @ list). \\rf. (x, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s\n \\ sch_act_wf (ksSchedulerAction s) s \\ valid_objs' s\"\n and P'=\"\\xs. {s. ep_queue_relation' (cslift s) (xs @ list)\n (head_C (queue_' s)) (end_C (queue_' s))}\n \\ {s. thread_' s = (case list of [] \\ tcb_Ptr 0\n | x # xs \\ tcb_ptr_to_ctcb_ptr x)}\"\n in ccorres_inst_voodoo)\n apply (induct_tac list)\n apply (rule allI)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_tmp_lift2 [OF _ _ refl])\n apply ceqv\n apply (simp add: ccorres_cond_iffs)\n apply (rule ccorres_rhs_assoc2)\n apply (rule ccorres_duplicate_guard, rule ccorres_split_nothrow_novcg_dc)\n apply (rule ccorres_from_vcg, rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (drule obj_at_ko_at', clarsimp)\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps tcb_queue_relation'_def)\n apply (case_tac x)\n apply (clarsimp simp: setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n carch_state_relation_def\n cmachine_state_relation_def\n cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n subgoal by (simp add: cendpoint_relation_def Let_def)\n subgoal by simp\n apply (clarsimp simp: tcb_at_not_NULL[OF pred_tcb_at']\n setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n carch_state_relation_def\n cmachine_state_relation_def\n cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def Let_def)\n apply (subgoal_tac \"tcb_at' (last (a # list)) \\ \\ tcb_at' a \\\")\n apply (clarsimp simp: is_aligned_neg_mask_weaken[\n OF is_aligned_tcb_ptr_to_ctcb_ptr[where P=\\]])\n subgoal by (simp add: tcb_queue_relation'_def EPState_Send_def mask_def)\n subgoal by (auto split: if_split)\n subgoal by simp\n apply (ctac add: rescheduleRequired_ccorres[unfolded dc_def])\n apply (rule hoare_pre, wp weak_sch_act_wf_lift_linear set_ep_valid_objs')\n apply (clarsimp simp: weak_sch_act_wf_def sch_act_wf_def)\n apply (fastforce simp: valid_ep'_def pred_tcb_at' split: list.splits)\n apply (simp add: guard_is_UNIV_def)\n apply (rule allI)\n apply (rename_tac a lista x)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_init_tmp_lift2, ceqv)\n apply (rule ccorres_guard_imp2)\n apply (simp add: bind_assoc dc_def[symmetric]\n del: Collect_const)\n apply (rule ccorres_cond_true)\n apply (rule ccorres_rhs_assoc)+\n apply (rule ccorres_pre_threadGet[where f=tcbState, folded getThreadState_def])\n apply (rule ccorres_move_c_guard_tcb)\n apply csymbr\n apply (rule ccorres_abstract_cleanup)\n apply csymbr\n apply (rule ccorres_move_c_guard_tcb)\n apply (rule_tac P=\\\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n and f'=\"\\s. s \\ next___ptr_to_struct_tcb_C_' := (case lista of [] \\ tcb_Ptr 0\n | v # vs \\ tcb_ptr_to_ctcb_ptr v) \\\"\n and xf'=\"next___ptr_to_struct_tcb_C_'\"\n in ccorres_subst_basic_helper)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule myvars.fold_congs, (rule refl)+)\n apply (clarsimp simp: tcb_queue_relation'_def use_tcb_queue_relation2\n tcb_queue_relation2_concat)\n apply (clarsimp simp: typ_heap_simps split: list.split)\n subgoal by (simp add: rf_sr_def)\n apply simp\n apply ceqv\n apply (rule_tac P=\"ret__unsigned=blockingIPCBadge rva\" in ccorres_gen_asm2)\n apply (rule ccorres_if_bind, rule ccorres_if_lhs)\n apply (simp add: bind_assoc dc_def[symmetric])\n apply (rule ccorres_rhs_assoc)+\n apply (ctac add: setThreadState_ccorres)\n apply (ctac add: tcbSchedEnqueue_ccorres)\n apply (rule_tac P=\"\\s. \\t \\ set (x @ a # lista). tcb_at' t s\"\n in ccorres_cross_over_guard)\n apply (rule ccorres_add_return, rule ccorres_split_nothrow[OF _ ceqv_refl])\n apply (rule_tac rrel=dc and xf=xfdc\n and P=\"\\s. (\\t \\ set (x @ a # lista). tcb_at' t s)\n \\ (\\p. \\t \\ set (x @ a # lista). \\rf. (t, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ distinct (x @ a # lista)\n \\ pspace_aligned' s \\ pspace_distinct' s\"\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n in ccorres_from_vcg)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: ball_Un)\n apply (rule exI, rule conjI)\n apply (rule exI, erule conjI)\n apply (intro conjI[rotated])\n apply (assumption)\n apply (fold_subgoals (prefix))[3]\n subgoal premises prems using prems by (fastforce intro: pred_tcb_at')+\n apply (clarsimp simp: return_def rf_sr_def cstate_relation_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def)\n apply (rule conjI, erule ctcb_relation_null_queue_ptrs)\n apply (rule null_ep_queue)\n subgoal by (simp add: o_def)\n apply (rule conjI)\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (rule cendpoint_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule(2) map_to_ko_atI2)\n apply (drule ko_at_state_refs_ofD')\n apply clarsimp\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (drule(2) map_to_ko_atI2, drule ko_at_state_refs_ofD')\n\n apply (rule cnotification_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n apply (rule conjI)\n apply (erule cready_queues_relation_not_queue_ptrs,\n auto dest: null_ep_schedD[unfolded o_def] simp: o_def)[1]\n apply (simp add: carch_state_relation_def\n cmachine_state_relation_def\n h_t_valid_clift_Some_iff)\n apply (rule ccorres_symb_exec_r2)\n apply (erule spec)\n apply vcg\n apply (vcg spec=modifies)\n apply wp\n apply simp\n apply vcg\n apply (wp hoare_vcg_const_Ball_lift tcbSchedEnqueue_ep_at\n sch_act_wf_lift)\n apply simp\n apply (vcg exspec=tcbSchedEnqueue_cslift_spec)\n apply (wp hoare_vcg_const_Ball_lift sts_st_tcb_at'_cases\n sts_sch_act sts_valid_queues setThreadState_oa_queued)\n apply (vcg exspec=setThreadState_cslift_spec)\n apply (simp add: ccorres_cond_iffs dc_def[symmetric])\n apply (rule ccorres_symb_exec_r2)\n apply (drule_tac x=\"x @ [a]\" in spec, simp add: dc_def[symmetric])\n apply vcg\n apply (vcg spec=modifies)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: pred_tcb_at' ball_Un)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n subgoal by (fastforce simp: valid_tcb_state'_def valid_objs'_maxDomain\n valid_objs'_maxPriority dest: pred_tcb_at')\n apply (clarsimp simp: tcb_at_not_NULL [OF pred_tcb_at'])\n apply (clarsimp simp: typ_heap_simps st_tcb_at'_def)\n apply (drule(1) obj_at_cslift_tcb)\n apply (clarsimp simp: ctcb_relation_blocking_ipc_badge)\n apply (rule conjI, simp add: \"StrictC'_thread_state_defs\" mask_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule rf_sr_cscheduler_relation)\n apply (clarsimp simp: cscheduler_action_relation_def st_tcb_at'_def\n split: scheduler_action.split_asm)\n apply (rename_tac word)\n apply (frule_tac x=word in tcbSchedEnqueue_cslift_precond_discharge)\n apply simp\n subgoal by clarsimp\n subgoal by clarsimp\n subgoal by clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (frule(3) tcbSchedEnqueue_cslift_precond_discharge)\n subgoal by clarsimp\n apply clarsimp\n apply (rule context_conjI)\n apply (clarsimp simp: tcb_queue_relation'_def)\n apply (erule iffD2[OF ep_queue_relation_shift[rule_format], rotated -1])\n subgoal by simp\n apply (rule_tac x=\"x @ a # lista\" in exI)\n apply (clarsimp simp: ball_Un)\n apply (rule conjI, fastforce)\n subgoal by (clarsimp simp: remove1_append)\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp obj_at_setObject3[where 'a=endpoint, folded setEndpoint_def])\n apply (simp add: objBits_simps')+\n apply (wp set_ep_valid_objs')\n apply vcg\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (clarsimp simp: guard_is_UNIV_def)\n apply (erule cmap_relationE1[OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps)\n apply (clarsimp simp: cendpoint_relation_def Let_def)\n subgoal by (clarsimp simp: tcb_queue_relation'_def neq_Nil_conv\n split: if_split_asm)\n apply clarsimp\n apply (frule ko_at_valid_objs', clarsimp)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_obj'_def valid_ep'_def)\n apply (frule sym_refs_ko_atD', clarsimp)\n apply (clarsimp simp: st_tcb_at_refs_of_rev')\n apply (rule conjI)\n subgoal by (auto simp: isBlockedOnSend_def elim!: pred_tcb'_weakenE)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n apply (drule sym_refsD, clarsimp)\n apply (drule(1) bspec)+\n by (auto simp: obj_at'_def projectKOs state_refs_of'_def pred_tcb_at'_def tcb_bound_refs'_def\n dest!: symreftype_inverse')\n\ndeclare Kernel_C.tcb_C_size [simp del]\n\nlemma cte_lift_ccte_relation:\n \"cte_lift cte' = Some ctel'\n \\ c_valid_cte cte'\n \\ ccte_relation (cte_to_H ctel') cte'\"\n by (simp add: ccte_relation_def)\n\nlemma updateFreeIndex_ccorres:\n \"\\s. \\ \\ ({s} \\ {s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'})\n c\n {t. \\cap. cap_untyped_cap_lift cap = (cap_untyped_cap_lift\n (cte_C.cap_C (the (cslift s (cte_Ptr srcSlot)))))\n \\ cap_untyped_cap_CL.capFreeIndex_CL := ((of_nat idx') >> 4) \\\n \\ cap_get_tag cap = scast cap_untyped_cap\n \\ t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr srcSlot)\n (cte_C.cap_C_update (\\_. cap) (the (cslift s (cte_Ptr srcSlot)))))\n (t_hrs_' (globals s))\n \\ t may_only_modify_globals s in [t_hrs]\n }\n \\ ccorres dc xfdc\n (valid_objs' and cte_wp_at' (\\cte. isUntypedCap (cteCap cte)\n \\ cap' = (cteCap cte)) srcSlot\n and untyped_ranges_zero'\n and (\\_. is_aligned (of_nat idx' :: word32) 4 \\ idx' \\ 2 ^ (capBlockSize cap')))\n {s. \\ capIsDevice cap'\n \\ region_actually_is_zero_bytes (capPtr cap' + of_nat idx') (capFreeIndex cap' - idx') s} hs\n (updateFreeIndex srcSlot idx') c\"\n (is \"_ \\ ccorres dc xfdc (valid_objs' and ?cte_wp_at' and _ and _) ?P' hs ?a c\")\n apply (rule ccorres_gen_asm)\n apply (simp add: updateFreeIndex_def getSlotCap_def updateCap_def)\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_split_noop_lhs, rule_tac cap'=cap' in updateTrackedFreeIndex_noop_ccorres)\n apply (rule ccorres_pre_getCTE)+\n apply (rename_tac cte cte2)\n apply (rule_tac P = \"\\s. ?cte_wp_at' s \\ cte2 = cte \\ cte_wp_at' ((=) cte) srcSlot s\"\n and P'=\"{s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'} \\ ?P'\" in ccorres_from_vcg)\n apply (rule allI, rule HoarePartial.conseq_exploit_pre, clarify)\n apply (drule_tac x=s in spec, rule conseqPre, erule conseqPost)\n defer\n apply clarsimp\n apply clarsimp\n apply (simp add: cte_wp_at_ctes_of)\n apply wp\n apply (clarsimp simp: isCap_simps cte_wp_at_ctes_of)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (frule(1) cte_lift_ccte_relation)\n apply (rule exI, intro conjI[rotated], assumption, simp_all)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule(1) rf_sr_ctes_of_cliftE)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (subgoal_tac \"ccap_relation (capFreeIndex_update (\\_. idx')\n (cteCap (the (ctes_of \\ srcSlot)))) cap\")\n apply (rule fst_setCTE [OF ctes_of_cte_at], assumption)\n apply (erule bexI [rotated])\n apply (clarsimp simp add: rf_sr_def cstate_relation_def Let_def\n cvariable_array_map_const_add_map_option[where f=\"tcb_no_ctes_proj\"]\n isCap_simps)\n apply (simp add:cpspace_relation_def)\n apply (clarsimp simp:typ_heap_simps' modify_map_def mex_def meq_def)\n apply (rule conjI)\n apply (rule cpspace_cte_relation_upd_capI, assumption+)\n apply (rule conjI)\n apply (rule setCTE_tcb_case, assumption+)\n apply (case_tac s', clarsimp)\n subgoal by (simp add: carch_state_relation_def cmachine_state_relation_def\n typ_heap_simps')\n\n apply (clarsimp simp: isCap_simps)\n apply (drule(1) cte_lift_ccte_relation,\n drule ccte_relation_ccap_relation)\n apply (simp add: cte_to_H_def)\n apply (frule cap_get_tag_isCap_unfolded_H_cap)\n apply (clarsimp simp: ccap_relation_def cap_lift_untyped_cap\n cap_to_H_simps cap_untyped_cap_lift_def\n is_aligned_shiftr_shiftl\n dest!: ccte_relation_ccap_relation)\n apply (rule unat_of_nat_eq unat_of_nat_eq[symmetric],\n erule order_le_less_trans,\n rule power_strict_increasing, simp_all)\n apply (rule unat_less_helper, rule order_le_less_trans[OF word_and_le1], simp add: mask_def)\n done\n\nend\n\nlemma ccap_relation_isDeviceCap2:\n \"\\ccap_relation cp cap; isUntypedCap cp\n \\ \\ (capIsDevice_CL (cap_untyped_cap_lift cap) = 0) = (\\ (capIsDevice cp))\"\n apply (frule cap_get_tag_UntypedCap)\n apply (simp add:cap_get_tag_isCap to_bool_def)\n done\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/crefine/ARM/Recycle_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.44552953503957277, "lm_q1q2_score": 0.2789568135575611}} {"text": "theory \"WMF_cert_auto\"\nimports\n \"../ESPLogic\"\nbegin\n\n(* section: Wide Mouthed Frog *)\n\n(* text: \n The protocol is modeled after the description in the SPORE library:\n\n http://www.lsv.ens-cachan.fr/Software/spore/wideMouthedFrog.html\n\n Note that we cannot reason about the timestamps in our current model.\n Furthermore, our current calculus for backwards reasoning is too weak\n to reason about the original protocol\n\n 1: I -> S: I, {TimeI, R, kIR}k(I,S)\n 2: R <- S: {TimeS, I, kIR}k(R,S)\n\n because the server S could receive the message {TimeI, R, kIR}k(I,S)\n arbitrarily many times from himself. Therefore, we added global constants\n identifying the different steps.\n *)\n\nrole I\nwhere \"I =\n [ Send ''1'' <| sAV ''I'', sAV ''R'',\n PEnc <| sC ''step1'', sN ''TimeI'', sAV ''R'', sN ''kIR'' |>\n ( sK ''I'' ''S'' )\n |>\n ]\"\n\nrole R\nwhere \"R =\n [ Recv ''2'' <| sMV ''S'', sMV ''I'',\n PEnc <| sC ''step2'', sMV ''TimeS'', sMV ''I'', sMV ''kIR'' |>\n ( PSymK ( sAV ''R'' ) ( sMV ''S'' ) )\n |>\n ]\"\n\nrole S\nwhere \"S =\n [ Recv ''1'' <| sMV ''I'', sMV ''R'',\n PEnc <| sC ''step1'', sMV ''TimeI'', sMV ''R'', sMV ''kIR'' |>\n ( PSymK ( sMV ''I'' ) ( sAV ''S'' ) )\n |>\n , Send ''2'' <| sAV ''S'', sMV ''I'',\n PEnc <| sC ''step2'', sN ''TimeS'', sMV ''I'', sMV ''kIR'' |>\n ( PSymK ( sMV ''R'' ) ( sAV ''S'' ) )\n |>\n ]\"\n\nprotocol WMF\nwhere \"WMF = { I, R, S }\"\n\nlocale restricted_WMF_state = WMF_state\n\ntype_invariant WMF_msc_typing for WMF\nwhere \"WMF_msc_typing = mk_typing\n [ ((R, ''I''), (KnownT R_2))\n , ((S, ''I''), (KnownT S_1))\n , ((S, ''R''), (KnownT S_1))\n , ((R, ''S''), (KnownT R_2))\n , ((S, ''TimeI''), (SumT (KnownT S_1) (NonceT I ''TimeI'')))\n , ((R, ''TimeS''), (SumT (KnownT R_2) (NonceT S ''TimeS'')))\n , ((R, ''kIR''), (SumT (KnownT R_2) (NonceT I ''kIR'')))\n , ((S, ''kIR''), (SumT (KnownT S_1) (NonceT I ''kIR'')))\n ]\"\n\nsublocale WMF_state < WMF_msc_typing_state\nproof -\n have \"(t,r,s) : approx WMF_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF WMF_msc_typing.monoTyp, completeness_cases_rule])\n case (R_2_I t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n by (fastsimp intro: event_predOrdI split: if_splits)\n next\n case (R_2_S t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n by (fastsimp intro: event_predOrdI split: if_splits)\n next\n case (R_2_TimeS t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n proof(sources! \"\n Enc {| LC ''step2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n qed (insert facts, ((fastsimp intro: event_predOrdI split: if_splits))+)?\n next\n case (R_2_kIR t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n proof(sources! \"\n Enc {| LC ''step2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n case (S_2_enc tid1) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid1), s(AV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid1) ) ) \")\n qed (insert facts, ((fastsimp intro: event_predOrdI split: if_splits))+)?\n qed (insert facts, ((fastsimp intro: event_predOrdI split: if_splits))+)?\n next\n case (S_1_I t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n by (fastsimp intro: event_predOrdI split: if_splits)\n next\n case (S_1_R t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n by (fastsimp intro: event_predOrdI split: if_splits)\n next\n case (S_1_TimeI t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (insert facts, ((fastsimp intro: event_predOrdI split: if_splits))+)?\n next\n case (S_1_kIR t r s tid0) note facts = this\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n show ?case using facts\n proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (insert facts, ((fastsimp intro: event_predOrdI split: if_splits))+)?\n qed\n thus \"WMF_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext WMF_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection: Secrecy Properties *)\n\nlemma (in restricted_WMF_state) I_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some I\"\n \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"LN ''kIR'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''kIR'' tid0 \")\n case I_1_kIR note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\nnext\n case (S_2_kIR tid1) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid1), s(MV ''R'' tid1),\n LN ''kIR'' tid0\n |}\n ( K ( s(MV ''I'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case (I_1_enc tid2) note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n qed (insert facts, (((clarsimp, order?) | order))+)?\nqed (insert facts, fastsimp+)?\n\nlemma (in restricted_WMF_state) S_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some S\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''R'' tid0)) ~: reveals t\"\n \"( tid0, S_1 ) : steps t\"\n \"s(MV ''kIR'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n next\n case (I_1_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastsimp dest: I_kIR_sec intro: event_predOrdI)\n qed (insert facts, fastsimp+)?\nqed\n\nlemma (in restricted_WMF_state) R_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some R\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''S'' tid0)) ~: reveals t\"\n \"( tid0, R_2 ) : steps t\"\n \"s(MV ''kIR'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n next\n case (S_2_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastsimp dest: S_kIR_sec intro: event_predOrdI)\n qed (insert facts, fastsimp+)?\nqed\n\n(* subsection: Authentication Properties *)\n\n(* text: \n The authentication guarantee for the initiator is trivial because it does not\n receive any confirmation that the responder received the new session-key.\n *)\n\nlemma (in restricted_WMF_state) S_ni_synch:\n assumes facts:\n \"roleMap r tid3 = Some S\"\n \"RLKR(s(AV ''S'' tid3)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid3)) ~: reveals t\"\n \"( tid3, S_1 ) : steps t\"\n shows\n \"(? tid1.\n roleMap r tid1 = Some I &\n s(AV ''I'' tid1) = s(MV ''I'' tid3) &\n s(AV ''R'' tid1) = s(MV ''R'' tid3) &\n s(AV ''S'' tid1) = s(AV ''S'' tid3) &\n LN ''TimeI'' tid1 = s(MV ''TimeI'' tid3) &\n LN ''kIR'' tid1 = s(MV ''kIR'' tid3) &\n predOrd t (St( tid1, I_1 )) (St( tid3, S_1 )))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid3), s(MV ''R'' tid3),\n s(MV ''kIR'' tid3)\n |}\n ( K ( s(MV ''I'' tid3) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n next\n case (I_1_enc tid4) note_unified facts = this facts\n thus ?thesis by (fastsimp intro: event_predOrdI split: if_splits)\n qed (insert facts, fastsimp+)?\nqed\n\nlemma (in restricted_WMF_state) R_ni_synch:\n assumes facts:\n \"roleMap r tid2 = Some R\"\n \"RLKR(s(AV ''R'' tid2)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid2)) ~: reveals t\"\n \"RLKR(s(MV ''S'' tid2)) ~: reveals t\"\n \"( tid2, R_2 ) : steps t\"\n shows\n \"(? tid1.\n (? tid3.\n roleMap r tid1 = Some I &\n roleMap r tid3 = Some S &\n s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n s(MV ''I'' tid2) = s(MV ''I'' tid3) &\n s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n s(AV ''R'' tid2) = s(MV ''R'' tid3) &\n s(AV ''S'' tid1) = s(MV ''S'' tid2) &\n s(MV ''S'' tid2) = s(AV ''S'' tid3) &\n LN ''TimeI'' tid1 = s(MV ''TimeI'' tid3) &\n s(MV ''TimeS'' tid2) = LN ''TimeS'' tid3 &\n LN ''kIR'' tid1 = s(MV ''kIR'' tid2) &\n s(MV ''kIR'' tid2) = s(MV ''kIR'' tid3) &\n predOrd t (St( tid1, I_1 )) (St( tid3, S_1 )) &\n predOrd t (St( tid3, S_1 )) (St( tid3, S_2 )) &\n predOrd t (St( tid3, S_2 )) (St( tid2, R_2 ))))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step2'', s(MV ''TimeS'' tid2), s(MV ''I'' tid2),\n s(MV ''kIR'' tid2)\n |}\n ( K ( s(AV ''R'' tid2) ) ( s(MV ''S'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n next\n case (S_2_enc tid3) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''step1'', s(MV ''TimeI'' tid3), s(AV ''R'' tid2),\n s(MV ''kIR'' tid2)\n |}\n ( K ( s(MV ''I'' tid2) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastsimp dest!: ltk_secrecy)\n next\n case (I_1_enc tid4) note_unified facts = this facts\n thus ?thesis by (fastsimp intro: event_predOrdI split: if_splits)\n qed (insert facts, fastsimp+)?\n qed (insert facts, fastsimp+)?\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/WMF_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2788923004410582}} {"text": "section {* Correctness of Type Checker *}\n\ntheory Wasm_Checker_Properties imports Wasm_Checker Wasm_Properties begin\n\nsubsection {* Soundness *}\n\nlemma b_e_check_single_type_sound:\n assumes \"type_update (Type x1) (to_ct_list t_in) (Type t_out) = Type x2\"\n \"c_types_agree (Type x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (Type x1) tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms(2) b_e_typing.weakening[OF assms(3)] type_update_type[OF assms(1)]\n by auto\n\nlemma b_e_check_single_top_sound:\n assumes \"type_update (TopType x1) (to_ct_list t_in) (Type t_out) = TopType x2\"\n \"c_types_agree (TopType x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (TopType x1) tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n obtain t_ag where t_ag_def:\"ct_suffix (to_ct_list t_out) x2\"\n \"tm = t_ag @ t_out\"\n \"c_types_agree (TopType x1) (t_ag @ t_in)\"\n using type_update_top_top[OF assms(1,2)]\n by fastforce\n hence \"\\ \\ [e] : (t_ag@t_in _> t_ag@t_out)\"\n using b_e_typing.weakening[OF assms(3)]\n by fastforce\n thus ?thesis\n using t_ag_def\n by fastforce\nqed\n\nlemma b_e_check_single_top_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (TopType []) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n shows \"\\tn. c_types_agree ts tn \\ suffix t_in tn\"\nproof (cases ts)\n case (TopType x1)\n then obtain t_int where \"consume (TopType x1) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using TopType ct_suffix_ct_list_eq_exists ct_suffix_ts_conv_suffix\n unfolding consume.simps\n by (metis append_Nil c_types_agree.simps(2) ct_suffix_def)\nnext\n case (Type x2)\n then obtain t_int where \"consume (Type x2) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using c_types_agree_id Type consume_type suffixI ct_suffix_ts_conv_suffix\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_type_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (Type t_out) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n \"c_types_agree ts' tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree ts tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms b_e_check_single_type_sound \nproof (cases ts)\n case (TopType x1)\n then obtain x1' where x_def:\"TopType x1' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(1) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_top_sound TopType\n by fastforce\nnext\n case (Type x2)\n then obtain x2' where x_def:\"Type x2' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(2) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_type_sound Type\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_sound_unop_testop_cvtop:\n assumes \"check_single \\ e tn' = tm'\"\n \"(e = (Unop t uw) \\ unop_t_agree op t)\n \\ (e = (Testop t uv) \\ is_int_t t)\n \\ (e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\n \\ (e = (Cvtop t1 Reinterpret t sx) \\ ((t1 \\ t) \\ t_length t1 = t_length t \\ sx = None))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"(e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\"\n using assms(2)\n by simp\n hence temp0:\"(e = (Cvtop t1 Convert t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,5) arity_1_result_def\n by (simp del: convert_cond.simps)\n have temp1:\"(e = (Cvtop t1 Reinterpret t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,2,5) arity_1_result_def\n by simp\n have 1:\"type_update tn' (to_ct_list [t]) (Type [arity_1_result e]) = tm'\"\n using assms arity_1_result_def\n unfolding to_ct_list_def\n apply (simp del: convert_cond.simps)\n apply fastforce\n done\n have \"\\ \\ [e] : ([t] _> [arity_1_result e])\"\n using assms(2) b_e_typing.intros(2,3,6,9,10)\n unfolding arity_1_result_def\n apply simp\n apply (metis (no_types, lifting) assms(1,5) b_e.simps(801,803,805) b_e_typing.reinterpret b_e_typing.testop check_single.simps(2))\n done\n thus ?thesis\n using b_e_check_single_type_not_bot_sound[OF 1 assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_check_single_sound_binop_relop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = Binop t iop \\ binop_t_agree op t)\n \\ (e = Relop t irop \\ relop_t_agree irop t))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"type_update tn' (to_ct_list [t,t]) (Type [arity_2_result e]) = tm'\"\n using assms arity_2_result_def\n unfolding to_ct_list_def\n by auto\n moreover\n have \"\\ \\ [e] : ([t,t] _> [arity_2_result e])\"\n using assms(2) b_e_typing.intros(4,5,7,8)\n unfolding arity_2_result_def\n by (metis (no_types) assms(1,2,5) b_e.simps(802,804) b_e_typing.relop binop check_single.simps(3))\n ultimately\n show ?thesis\n using b_e_check_single_type_not_bot_sound[OF _ assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_type_checker_sound:\n assumes \"b_e_type_checker \\ es (tn _> tm)\"\n shows \"\\ \\ es : (tn _> tm)\"\nproof -\n fix e tn'\n have \"b_e_type_checker \\ es (tn _> tm) \\\n \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check \\ es tn' = tm' \\\n c_types_agree tm' tm \\\n \\tn. c_types_agree tn' tn \\ \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check_single \\ e tn' = tm' \\\n c_types_agree tm' tm \\\n tn' \\ Bot \\\n tm' \\ Bot \\\n \\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn' tm)\n thus ?case\n by simp\n next\n case (2 \\ es' ts)\n show ?case\n proof (cases es')\n case Nil\n thus ?thesis\n using 2(5,6)\n by (simp add: b_e_type_empty)\n next\n case (Cons e es)\n thus ?thesis\n proof (cases ts)\n case (TopType x1)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) TopType Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(2)[OF Cons TopType check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(1)[OF Cons _ ts'_def] TopType c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case (Type x2)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) Type Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(4)[OF Cons Type check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(3)[OF Cons _ ts'_def] Type c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case Bot\n then show ?thesis\n using 2(5,6) Cons\n by auto\n qed\n qed\n next\n case (3 \\ v ts)\n hence \"type_update ts [] (Type [typeof v]) = tm'\"\n by simp\n moreover\n have \"\\ \\ [C v] : ([] _> [typeof v])\"\n using b_e_typing.intros(1)\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 3(3,4,2)]\n by (metis list.simps(8) to_ct_list_def)\n next\n case (4 \\ t op ts)\n hence \"unop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 4\n by fastforce\n next\n case (5 \\ t op ts)\n hence \"binop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 5\n by fastforce\n next\n case (6 \\ t op ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 6\n by fastforce\n next\n case (7 \\ t op ts)\n hence \"relop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 7\n by fastforce\n next\n case (8 \\ t1 t2 sx ts)\n hence \"convert_cond t1 t2 sx\"\n by (simp del: convert_cond.simps, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 8\n by fastforce\n next\n case (9 \\ t1 t2 sx ts)\n hence \"t1 \\ t2 \\ t_length t1 = t_length t2 \\ sx = None\"\n by (simp, presburger)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 9\n by fastforce\n next\n case (10 \\ ts)\n thus ?case\n using b_e_typing.intros(8) c_types_agree_not_bot_exists\n by blast\n next\n case (11 \\ ts)\n thus ?case\n using b_e_typing.intros(9,32)\n by fastforce\n next\n case (12 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n thus ?thesis\n proof (cases x1 rule: List.rev_cases)\n case Nil\n have \"\\ \\ [Drop] : (tm@[T_i32] _> tm)\"\n using b_e_typing.intros(10,32)\n by fastforce\n thus ?thesis\n using c_types_agree_top1 Nil TopType\n by fastforce\n next\n case (snoc ys y)\n hence temp1:\"(consume (TopType (ys@[y])) [TAny]) = tm'\"\n using 12 TopType type_update_empty\n by (metis check_single.simps(10))\n hence temp2:\"c_types_agree (TopType ys) tm\"\n using consume_top_geq[OF temp1] 12(2,3,4)\n by (metis Suc_leI add_diff_cancel_right' append_eq_conv_conj consume.simps(2)\n ct_suffix_def length_Cons length_append list.size(3) trans_le_add2\n zero_less_Suc)\n obtain t where \"ct_list_eq [y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc TopType\n by (simp add: to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(10,32)\n by fastforce\n qed\n next\n case (Type x2)\n thus ?thesis\n proof (cases x2 rule: List.rev_cases)\n case Nil\n hence \"(consume (Type []) [TAny]) = tm'\"\n using 12 Type type_update_empty\n by fastforce\n thus ?thesis\n using 12(4) ct_list_eq_def ct_suffix_def to_ct_list_def\n by simp\n next\n case (snoc ys y)\n hence temp1:\"(consume (Type (ys@[y])) [TAny]) = tm'\"\n using 12 Type type_update_empty\n by (metis check_single.simps(10))\n hence temp2:\"c_types_agree (Type ys) tm\"\n using 12(2,3,4) ct_suffix_def\n by (simp, metis One_nat_def butlast_conv_take butlast_snoc c_types_agree.simps(1)\n length_Cons list.size(3))\n obtain t where \"ct_list_eq [TSome y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc Type\n by (simp add: ct_list_eq_def to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(10,32)\n by fastforce\n qed\n qed simp\n next\n case (13 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"tm' = TopType [TAny]\"\n using TopType 13\n by simp\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 13(2) ct_suffix_def\n by (simp, metis Nil_is_append_conv append_butlast_last_id checker_type.inject(1)\n ct_prefixI ct_prefix_nil(2) produce.simps(1) produce_nil)\n have \"\\ \\ [Select] : ([t'',t'',T_i32] _> [t''])\"\n using b_e_typing.intros(11)\n by blast\n thus ?thesis\n using TopType 13 1 tm_def b_e_typing.intros(32) c_types_agree.simps(2) c_types_agree_top1\n by fastforce\n next\n case 2\n have \"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n unfolding check_single.simps\n by simp\n hence x1_def:\"ct_list_eq x1 [TSome T_i32]\" \"tm' = TopType [TAny]\"\n using type_update_select_length1[OF _ 2 13(4)]\n by simp_all\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 13(2) ct_suffix_def\n by (metis Nil_is_append_conv append_butlast_last_id c_types_agree.simps(2) ct_prefixI\n ct_prefix_nil(2) list.simps(8) to_ct_list_def)\n have \"c_types_agree (TopType x1) ((tm''@[t'',t''])@[T_i32])\"\n using x1_def(1)\n by (metis c_types_agree_top2 list.simps(8,9) to_ct_list_def)\n thus ?thesis\n using TopType b_e_typing.intros(11,32) tm_def\n by auto\n next\n case 3\n have \"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n unfolding check_single.simps\n by simp\n then obtain ct1 ct2 where x1_def:\"x1 = [ct1, ct2]\"\n \"ct_eq ct2 (TSome T_i32)\"\n \"tm' = TopType [ct1]\"\n using type_update_select_length2[OF _ 3 13(4)]\n by blast\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n \"ct_list_eq [ct1] [(TSome t'')]\"\n using 13(2) c_types_agree_imp_ct_list_eq[of \"[ct1]\" tm]\n by (metis append_Nil2 append_butlast_last_id append_eq_append_conv_if append_eq_conv_conj\n ct_list_eq_length diff_Suc_1 length_Cons length_butlast length_map\n list.simps(8,9) list.size(3) nat.distinct(2) to_ct_list_def)\n hence \"ct_list_eq x1 (to_ct_list [ t'', T_i32])\"\n using x1_def(1,2)\n unfolding ct_list_eq_def to_ct_list_def\n by fastforce\n hence \"c_types_agree (TopType x1) ((tm''@[t''])@[t'',T_i32])\"\n using c_types_agree_top2\n by blast\n thus ?thesis\n using TopType b_e_typing.intros(11,32) tm_def\n by auto\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n hence tm'_def:\"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n by simp\n then obtain tm_int where \"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = tm_int\"\n \"tm_int \\ Bot\"\n using nat_def 13(4)\n unfolding type_update_select.simps\n by fastforce\n then obtain x2 where x2_def:\"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = TopType x2\"\n using select_return_top_exists\n by fastforce\n have \"ct_suffix x1 [TAny, TAny, TSome T_i32] \\ ct_suffix [TAny, TAny, TSome T_i32] x1\"\n using tm'_def nat_def 13(4)\n by (simp, metis (full_types) produce.simps(6))\n hence tm'_eq:\"tm' = TopType x2\"\n using tm'_def nat_def 13(4) x2_def\n by force\n then obtain cts' ct1 ct2 ct3 where cts'_def:\"x1 = cts'@[ct1, ct2, ct3]\"\n \"ct_eq ct3 (TSome T_i32)\"\n using type_update_select_length3 tm'_def 4\n by blast\n then obtain c' cm' where tm_def:\"tm = cm'@[c']\"\n \"ct_suffix cts' (to_ct_list cm')\"\n \"ct_eq (x1 ! (length x1 - 2)) (TSome c')\"\n \"ct_eq (x1 ! (length x1 - 3)) (TSome c')\"\n using select_return_top_ct_eq[OF x2_def 4] tm'_eq 4 13(2)\n by fastforce\n then obtain as bs where cm'_def:\"cm' = as@bs\"\n \"ct_list_eq (to_ct_list bs) cts'\"\n using ct_list_eq_cons_ct_list1 ct_list_eq_ts_conv_eq\n by (metis ct_suffix_def to_ct_list_append(2))\n hence \"ct_eq ct1 (TSome c')\"\n \"ct_eq ct2 (TSome c')\"\n using cts'_def tm_def\n apply simp_all\n apply (metis append.assoc append_Cons append_Nil length_append_singleton nth_append_length)\n done\n hence \"c_types_agree ts (cm'@[c',c',T_i32])\"\n using c_types_agree_top2[of _ _ as] cm'_def(1) TopType\n ct_list_eq_concat[OF ct_list_eq_commute[OF cm'_def(2)]] cts'_def\n unfolding to_ct_list_def ct_list_eq_def\n by fastforce\n thus ?thesis\n using b_e_typing.intros(11,32) tm_def\n by auto\n qed\n next\n (* TODO: refactor *)\n case (Type x2)\n hence x2_cond:\"(length x2 \\ 3 \\ (x2!(length x2-2)) = (x2!(length x2-3)))\"\n using 13\n by (simp, meson)\n hence tm'_def:\"consume (Type x2) [TAny, TSome T_i32] = tm'\"\n using 13 Type\n by simp\n obtain ts' ts'' where cts_def:\"x2 = ts'@ ts''\" \"length ts'' = 3\"\n using x2_cond\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain t1 ts''2 where \"ts'' = t1#ts''2\" \"length ts''2 = Suc (Suc 0)\"\n using List.length_Suc_conv[of ts' \"Suc (Suc 0)\"]\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain t2 t3 where \"ts'' = [t1,t2,t3]\"\n using List.length_Suc_conv[of ts''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n hence cts_def2:\"x2 = ts'@ [t1,t2,t3]\"\n using cts_def\n by simp\n have ts'_suffix:\"ct_suffix [TAny, TSome T_i32] (to_ct_list (ts' @ [t1, t2, t3]))\"\n using tm'_def 13(4)\n by (simp, metis cts_def2)\n hence tm'_def:\"tm' = Type (ts'@[t1])\"\n using tm'_def 13(4) cts_def2\n by simp\n obtain as bs where \"(to_ct_list (ts' @ [t1])) @ (to_ct_list ([t2, t3])) = as@bs\"\n \"ct_list_eq bs [TAny, TSome T_i32]\"\n using ts'_suffix\n unfolding ct_suffix_def to_ct_list_def\n by fastforce\n hence \"t3 = T_i32\"\n unfolding to_ct_list_def ct_list_eq_def\n by (metis (no_types, lifting) Nil_is_map_conv append_eq_append_conv ct_eq.simps(1)\n length_Cons list.sel(1,3) list.simps(9) list_all2_Cons2 list_all2_lengthD)\n moreover\n have \"t1 = t2\"\n using x2_cond cts_def2\n by (simp, metis append.left_neutral append_Cons append_assoc length_append_singleton\n nth_append_length)\n ultimately\n have \"c_types_agree (Type x2) ((ts'@[t1,t1])@[T_i32])\"\n using cts_def2\n by simp\n thus ?thesis\n using b_e_typing.intros(11,32) Type tm'_def 13(2)\n by fastforce\n qed simp\n next\n case (14 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 14\n by (simp, meson)\n hence \"\\ \\ [Block (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(12)[OF _ 14(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 14(4,5,3)]\n by blast\n next\n case (15 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tn''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 15\n by (simp, meson)\n hence \"\\ \\ [Loop (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(13)[OF _ 15(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 15(4,5,3)]\n by blast\n next\n case (16 \\ tn'' tm'' es1 es2 ts)\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es1 (tn'' _> tm''))\"\n \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es2 (tn'' _> tm''))\"\n using 16\n by (simp, meson)+\n hence \"\\ \\ [If (tn'' _> tm'') es1 es2] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(14)[OF _ 16(1,2)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 16(5,6,4)]\n by blast\n next\n case (17 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i)) (TopType []) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 17\n by (simp, meson)\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 17(3,4)]\n b_e_typing.intros(15)\n b_e_typing.intros(32)\n by (metis suffix_def)\n next\n case (18 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i @ [T_i32])) (Type ((label \\)!i)) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 18\n by (simp, meson)\n hence \"\\ \\ [Br_if i] : ((label \\)!i @ [T_i32] _> (label \\)!i)\"\n using b_e_typing.intros(16)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 18(3,4,2)]\n by fastforce\n next\n case (19 \\ \"is\" i ts)\n then obtain tls where tls_def:\"(same_lab (is@[i]) (label \\)) = Some tls\"\n by fastforce\n hence \"type_update ts (to_ct_list (tls @ [T_i32])) (TopType []) = tm'\"\n using 19\n by simp\n thus ?case\n using b_e_check_single_top_not_bot_sound[OF _ 19(3,4)]\n b_e_typing.intros(17)[OF same_lab_conv_list_all[OF tls_def]]\n b_e_typing.intros(32)\n by (metis suffix_def)\n next\n case (20 \\ ts)\n then obtain ts_r where \"(return \\) = Some ts_r\"\n by fastforce\n moreover\n hence \"type_update ts (to_ct_list ts_r) (TopType []) = tm'\"\n using 20\n by simp\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 20(3,4)]\n b_e_typing.intros(18,32)\n by (metis suffix_def)\n next\n case (21 \\ i ts)\n obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n using 21\n by auto\n moreover\n have \"i < length (func_t \\)\"\n using 21\n by (simp, meson)\n hence \"\\ \\ [Call i] : (tn'' _> tm'')\"\n using b_e_typing.intros(19) func_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 21(3,4,2)]\n by fastforce\n next\n case (22 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n using 22\n by auto\n moreover\n have \"length (table \\) \\ 1 \\ i < length (types_t \\)\"\n using 22\n by (simp, meson)\n hence \"\\ \\ [Call_indirect i] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(20) type_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 22(3,4,2)]\n by fastforce\n next\n case (23 \\ i ts)\n hence \"type_update ts [] (Type [(local \\)!i]) = tm'\"\n by auto\n moreover\n have \"i < length (local \\)\"\n using 23\n by (simp, meson)\n hence \"\\ \\ [Get_local i] : ([] _> [(local \\)!i])\"\n using b_e_typing.intros(21)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 23(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (24 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 24\n by (simp, meson)\n hence \"\\ \\ [Set_local i] : ([(local \\)!i] _> [])\"\n using b_e_typing.intros(22)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 24(3,4,2)]\n by fastforce\n next\n case (25 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type [(local \\)!i]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 25\n by (simp, meson)\n hence \"\\ \\ [Tee_local i] : ([(local \\)!i] _> [(local \\)!i])\"\n using b_e_typing.intros(23)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 25(3,4,2)]\n by fastforce\n next\n case (26 \\ i ts)\n hence \"type_update ts [] (Type [tg_t ((global \\)!i)]) = tm'\"\n by auto\n moreover\n have \"i < length (global \\)\"\n using 26\n by (simp, meson)\n hence \"\\ \\ [Get_global i] : ([] _> [tg_t ((global \\)!i)])\"\n using b_e_typing.intros(24)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 26(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (27 \\ i ts)\n hence \"type_update ts (to_ct_list [tg_t ((global \\)!i)]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (global \\) \\ is_mut (global \\ ! i)\"\n using 27\n by (simp, meson)\n then obtain t where \"(global \\ ! i) = \\tg_mut = T_mut, tg_t = t\\\" \"i < length (global \\)\"\n unfolding is_mut_def\n by (cases \"global \\ ! i\", auto)\n hence \"\\ \\ [Set_global i] : ([tg_t (global \\ ! i)] _> [])\"\n using b_e_typing.intros(25)[of i \\ \"tg_t (global \\ ! i)\"]\n unfolding is_mut_def tg_t_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 27(3,4,2)]\n by fastforce\n next\n case (28 \\ t tp_sx a off ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [t]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \\ load_store_t_bounds a (option_projl tp_sx) t\"\n using 28\n by (simp, meson)\n hence \"\\ \\ [Load t tp_sx a off] : ([T_i32] _> [t])\"\n using b_e_typing.intros(26)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 28(3,4,2)]\n by fastforce\n next\n case (29 \\ t tp a off ts)\n hence \"type_update ts (to_ct_list [T_i32,t]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \\ load_store_t_bounds a tp t\"\n using 29\n by (simp, meson)\n hence \"\\ \\ [Store t tp a off] : ([T_i32,t] _> [])\"\n using b_e_typing.intros(27)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 29(3,4,2)]\n by fastforce\n next\n case (30 \\ ts)\n hence \"type_update ts [] (Type [T_i32]) = tm'\"\n by auto\n moreover\n have \"length (memory \\) \\ 1 \" \n using 30\n by (simp, meson)\n hence \"\\ \\ [Current_memory] : ([] _> [T_i32])\"\n using b_e_typing.intros(28)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 30(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (31 \\ ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [T_i32]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \" \n using 31\n by (simp, meson)\n hence \"\\ \\ [Grow_memory] : ([T_i32] _> [T_i32])\"\n using b_e_typing.intros(29)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 31(3,4,2)]\n by fastforce\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nsubsection {* Completeness *}\n\nlemma check_single_imp:\n assumes \"check_single \\ e ctn = ctm\"\n \"ctm \\ Bot\"\n shows \"check_single \\ e = id\n \\ check_single \\ e = (\\ctn. type_update_select ctn)\n \\ (\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\nproof -\n have True\n and True\n and \"check_single \\ e ctn = ctm \\\n ctm \\ Bot \\\n ?thesis\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn tm)\n thus ?case\n by simp\n next\n case (2 \\ es ts)\n thus ?case\n by simp\n next\n case (3 \\ v ts)\n thus ?case\n by fastforce\n next\n case (4 \\ t uu ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (5 \\ t uv ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (6 \\ t uw ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (7 \\ t ux ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (8 \\ t1 t2 sx ts)\n thus ?case\n by (simp del: convert_cond.simps, meson assms(2) type_update.simps)\n next\n case (9 \\ t1 t2 sx ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (10 \\ ts)\n thus ?case\n by fastforce\n next\n case (11 \\ ts)\n thus ?case\n by fastforce\n next\n case (12 \\ ts)\n thus ?case\n by fastforce\n next\n case (13 \\ ts)\n thus ?case\n by fastforce\n next\n case (14 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (15 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (16 \\ tn tm es1 es2 ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (17 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (18 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (19 \\ \"is\" ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (20 \\ ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (21 \\ i ts)\n then show ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (22 \\ i ts)\n thus ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (23 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (24 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (25 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (26 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (27 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (28 \\ t tp_sx a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (29 \\ t tp a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (30 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (31 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nlemma check_equiv_fold:\n \"check \\ es ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts es\"\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n obtain ts' where ts'_def:\"check \\ (e # es) ts = ts'\"\n by blast\n show ?case\n proof (cases \"ts = Bot\")\n case True\n thus ?thesis\n using ts'_def\n by (induction es, simp_all)\n next\n case False\n thus ?thesis\n using ts'_def Cons\n by (cases ts, simp_all)\n qed\nqed\n\nlemma check_neq_bot_snoc:\n assumes \"check \\ (es@[e]) ts \\ Bot\"\n shows \"check \\ es ts \\ Bot\"\n using assms\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by (cases ts, simp_all)\nnext\n case (Cons a es)\n thus ?case\n by (cases ts, simp_all)\nqed\n\nlemma check_unfold_snoc:\n assumes \"check \\ es ts \\ Bot\"\n shows \"check \\ (es@[e]) ts = check_single \\ e (check \\ es ts)\"\nproof -\n obtain f where f_def:\"f = (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts))\"\n by blast\n have f_simp:\"\\ts. ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n proof -\n fix ts\n show \"ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n using f_def\n by (cases ts, simp_all)\n qed\n have \"check \\ (es@[e]) ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts (es@[e])\"\n using check_equiv_fold\n by simp\n also\n have \"... = foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev (es@[e])) ts\"\n using foldl_conv_foldr\n by fastforce\n also\n have \"... = f e (foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev es) ts)\"\n using f_def\n by simp\n also\n have \"... = f e (check \\ es ts)\"\n using foldr_conv_foldl[of _ \"(rev es)\" ts] rev_rev_ident[of es] check_equiv_fold\n by simp\n also\n have \"... = check_single \\ e (check \\ es ts)\"\n using assms f_simp\n by simp\n finally\n show ?thesis .\nqed\n\nlemma check_single_imp_weakening:\n assumes \"check_single \\ e (Type t1s) = ctm\"\n \"ctm \\ Bot\"\n \"c_types_agree ctn t1s\"\n \"c_types_agree ctm t2s\"\n shows \"\\ctm'. check_single \\ e ctn = ctm' \\ c_types_agree ctm' t2s\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1,3,4)\n by fastforce\n next\n (* TODO: better proof *)\n case 2\n note outer_2 = 2\n hence t1s_cond:\"(length t1s \\ 3 \\ (t1s!(length t1s-2)) = (t1s!(length t1s-3)))\"\n using assms(1,2)\n by (simp, meson)\n hence ctm_def:\"ctm = consume (Type t1s) [TAny, TSome T_i32]\"\n using assms(1,2) 2\n by simp\n then obtain c_t where c_t_def:\"ctm = Type c_t\"\n using assms(2)\n by (meson consume.simps(1))\n hence t2s_eq:\"t2s = c_t\"\n using assms(4)\n by simp\n hence t2s_len:\"length t2s > 0\"\n using t1s_cond ctm_def c_t_def assms(2)\n by (metis Suc_leI Suc_n_not_le_n checker_type.inject(2) consume.simps(1)\n diff_is_0_eq dual_order.trans length_0_conv length_Cons length_greater_0_conv\n nat.simps(3) numeral_3_eq_3 take_eq_Nil)\n have t1s_suffix_full:\"ct_suffix [TAny, TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis consume.simps(1))\n hence t1s_suffix:\"ct_suffix [TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis append_butlast_last_id last.simps list.distinct(1))\n obtain t t1s' where t1s_suffix2:\"t1s = t1s'@[t,t,T_i32]\"\n using type_update_select_type_length3 assms(1) c_t_def outer_2\n by fastforce\n hence t2s_def:\"t2s = t1s'@[t]\"\n using ctm_def c_t_def t2s_eq t1s_suffix assms(2) t1s_suffix_full\n by simp\n show ?thesis\n using assms(1,3,4)\n proof (cases ctn)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using 2 TopType\n by simp\n thus ?thesis\n using ct_suffix_singleton to_ct_list_def t2s_len\n by auto\n next\n case 2\n hence \"ct_suffix [TSome T_i32] x1\"\n using assms(3) TopType ct_suffix_imp_ct_list_eq ct_suffix_shared t1s_suffix\n by (metis One_nat_def append_Nil c_types_agree.simps(2) ct_list_eq_commute ct_suffix_def\n diff_self_eq_0 drop_0 length_Cons list.size(3))\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using outer_2 TopType 2\n by simp\n thus ?thesis\n using t2s_len ct_suffix_singleton\n by (simp add: to_ct_list_def)\n next\n case 3\n have \"ct_list_eq (to_ct_list t1s) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2\n by (simp add: ct_list_eq_ts_conv_eq)\n hence temp1:\"to_ct_list t1s = (to_ct_list (t1s' @ [t])) @ (to_ct_list [t, T_i32])\"\n using t1s_suffix2 to_ct_list_def\n by simp\n hence \"ct_suffix (to_ct_list [t, T_i32]) (to_ct_list t1s)\"\n using ct_suffix_def[of \"(to_ct_list [t, T_i32])\" \"(to_ct_list t1s)\"]\n by (simp add: ct_suffix_cons_it)\n hence \"ct_suffix (to_ct_list [t, T_i32]) x1\"\n using assms(3) TopType 3\n by (simp, metis temp1 append_Nil ct_suffix_cons2 ct_suffix_def length_Cons length_map\n list.size(3) numeral_2_eq_2 to_ct_list_def)\n hence temp3:\"ct_list_eq (to_ct_list [t, T_i32]) x1\"\n using 3 ct_suffix_imp_ct_list_eq\n unfolding to_ct_list_def\n by (metis Suc_leI ct_list_eq_commute diff_is_0_eq drop_0 length_Cons length_map lessI\n list.size(3) numeral_2_eq_2)\n hence temp4:\"ct_suffix [TSome T_i32] x1\" \n using ct_suffix_less[of \"[TSome t]\" \"[TSome T_i32]\" x1]\n ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\"] ct_suffix_nil\n unfolding to_ct_list_def\n by fastforce\n hence \"ct_suffix (take 1 x1) (to_ct_list [t])\"\n using temp3 ct_suffix_nil ct_list_eq_commute ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\" \"(take 1 x1)\" \"(to_ct_list [t])\"]\n unfolding to_ct_list_def\n by (simp, metis butlast.simps(2) butlast_conv_take ct_list_eq_take diff_Suc_1 length_Cons\n list.distinct(1) list.size(3))\n thus ?thesis\n using TopType 2 3 ct_suffix_nil temp3 temp4 t2s_def to_ct_list_def\n apply (simp, safe)\n apply (metis append.assoc ct_suffix_def)\n done\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n obtain x1' x x' x'' where x1_split:\"x1 = x1'@[x,x',x'']\"\n proof -\n assume local_assms:\"(\\x1' x x' x''. x1 = x1' @ [x, x', x''] \\ thesis)\"\n obtain x1' x1'' where tn_split:\"x1 = x1'@x1''\"\n \"length x1'' = 3\"\n using 4\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain x x1''2 where \"x1'' = x#x1''2\" \"length x1''2 = Suc (Suc 0)\"\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain x' x'' where tn''_def:\"x1''= [x,x',x'']\"\n using List.length_Suc_conv[of x1''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n thus ?thesis\n using tn_split local_assms\n by simp\n qed\n hence a:\"ct_suffix (x1'@[x,x',x'']) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2 assms(3) TopType\n by simp\n hence b:\"ct_suffix (x1'@[x,x']) (to_ct_list (t1s' @ [t, t])) \\ (ct_eq x'' (TSome T_i32))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x,x'])\" \"x''\" \"to_ct_list (t1s' @ [t, t])\"]\n by fastforce\n hence c:\"ct_suffix (x1'@[x]) (to_ct_list (t1s' @ [t])) \\ (ct_eq x' (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x])\" \"x'\" \"to_ct_list (t1s' @ [t])\"]\n by fastforce\n hence d:\"ct_suffix x1' (to_ct_list t1s') \\ (ct_eq x (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1')\" \"x\" \"to_ct_list (t1s')\"]\n by fastforce\n have \"(take (length x1 - 3) x1) = x1'\"\n using x1_split\n by simp\n have x'_ind:\"(x1!(length x1-2)) = x'\"\n using x1_split List.nth_append_length[of \"x1' @ [x]\"]\n by simp\n have x_ind:\"(x1!(length x1-3)) = x\"\n using x1_split\n by simp\n have \"ct_suffix [TSome T_i32] x1\"\n using b x1_split ct_suffix_def ct_list_eq_def ct_suffixI[of x1 \"x1' @ [x, x']\"]\n by simp\n hence \"check_single \\ e (TopType x1) = (select_return_top x1 (x1!(length x1-2)) (x1!(length x1-3)))\"\n using type_update_select_conv_select_return_top[OF _ 4]\n unfolding 2\n by blast\n moreover\n have \"... = (TopType (x1'@[x])) \\ ... = (TopType (x1'@[x']))\"\n apply (cases x; cases x')\n using x1_split 4 nat_def 2 x_ind x'_ind c d\n by simp_all\n moreover\n have \"ct_suffix (x1'@[x]) (to_ct_list t2s)\"\n by (simp add: c t2s_def)\n moreover\n have \"ct_suffix (x1'@[x']) (to_ct_list t2s)\"\n using ct_suffix_unfold_one[symmetric, of x' \"(TSome t)\" x1' \"(to_ct_list t1s')\"] c d\n t2s_def\n unfolding to_ct_list_def\n by fastforce\n ultimately\n show ?thesis\n using TopType\n by auto\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where c_s_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence ctm_def:\"ctm = type_update (Type t1s) cons prods\"\n using assms(1)\n by fastforce\n hence cons_suffix:\"ct_suffix cons (to_ct_list t1s)\"\n using assms\n by (simp, metis (full_types) produce.simps(6))\n hence t_int_def:\"consume (Type t1s) cons = (Type (take (length t1s - length cons) t1s))\"\n using ctm_def\n by simp\n hence ctm_def2:\"ctm = produce (Type (take (length t1s - length cons) t1s)) prods\"\n using ctm_def\n by simp\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n hence \"ct_suffix x1 (to_ct_list t1s)\"\n using assms(3)\n by simp\n thus ?thesis\n using assms(2) ctm_def2\n proof (cases prods)\n case (TopType x1)\n thus ?thesis\n using consume_c_types_agree[OF t_int_def assms(3)] ctm_def2 assms(4) c_s_def\n by (metis c_types_agree.elims(2) produce.simps(3,4) type_update.simps)\n next\n case (Type x2)\n hence ctm_def3:\"ctm = Type ((take (length t1s - length cons) t1s)@ x2)\"\n using ctm_def2\n by simp\n have \"ct_suffix x1 cons \\ ct_suffix cons x1\"\n using ct_suffix_shared assms(3) TopType cons_suffix\n by auto\n thus ?thesis\n proof (rule disjE)\n assume \"ct_suffix x1 cons\"\n hence \"consume (TopType x1) cons = TopType []\"\n by (simp add: ct_suffix_length)\n hence \"check_single \\ e ctn = TopType (to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n thus ?thesis\n using TopType ctm_def3 assms(4) c_types_agree_top2 ct_list_eq_refl\n by auto\n next\n assume \"ct_suffix cons x1\"\n hence 4:\"consume (TopType x1) cons = TopType (take (length x1 - length cons ) x1)\"\n by (simp add: ct_suffix_length)\n hence 3:\"check_single \\ e ctn = TopType ((take (length x1 - length cons ) x1) @ to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n have \"((take (length t1s - length cons ) t1s) @ x2) = t2s\"\n using assms(4) ctm_def3\n by simp\n have \"c_types_agree (TopType (take (length x1 - length cons ) x1)) (take (length t1s - length cons) t1s)\"\n using consume_c_types_agree[OF t_int_def assms(3)] 4 TopType\n by simp\n hence \"c_types_agree (TopType (take (length x1 - length cons ) x1 @ to_ct_list x2)) (take (length t1s - length cons) t1s @ x2)\"\n unfolding c_types_agree.simps to_ct_list_def\n by (simp add: ct_suffix_cons2 ct_suffix_cons_it ct_suffix_extend_ct_list_eq)\n thus ?thesis\n using ctm_def3 assms 3\n by simp\n qed\n qed simp\n next\n case (Type x2)\n thus ?thesis\n using assms\n by simp\n next\n case Bot\n thus ?thesis\n using assms\n by simp\n qed\n qed\nqed\n\nlemma b_e_type_checker_compose:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n \"b_e_type_checker \\ [e] (t2s _> t3s)\"\n shows \"b_e_type_checker \\ (es @ [e]) (t1s _> t3s)\"\nproof -\n have \"c_types_agree (check_single \\ e (Type t2s)) t3s\"\n using assms(2)\n by simp\n then obtain ctm where ctm_def:\"check_single \\ e (Type t2s) = ctm\"\n \"c_types_agree ctm t3s\"\n \"ctm \\ Bot\"\n by fastforce\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n thus ?thesis\n using check_single_imp_weakening[OF ctm_def(1,3) ctn_def(2) ctm_def(2)]\n check_unfold_snoc[of \\ es \"(Type t1s)\" e]\n by simp\nqed\n\nlemma b_e_check_single_type_type:\n assumes \"check_single \\ e xs = (Type tm)\"\n shows \"\\tn. xs = (Type tn)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n note outer_2 = 2\n thus ?thesis\n using assms\n proof (cases xs)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = Suc 0\"\n | (3) \"length x1 = Suc (Suc 0)\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof cases\n case 1\n thus ?thesis\n using assms 2 TopType\n by simp\n next\n case 2\n thus ?thesis\n using assms outer_2 TopType produce_type_type\n by fastforce\n next\n case 3\n thus ?thesis\n using assms 2 TopType\n by (simp, metis checker_type.distinct(1) checker_type.distinct(5))\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n thus ?thesis\n using assms 2 TopType\n proof -\n {\n assume a1: \"produce (if ct_suffix [TAny, TAny, TSome T_i32] x1 then TopType (take (length x1 - length [TAny, TAny, TSome T_i32]) x1) else if ct_suffix x1 [TAny, TAny, TSome T_i32] then TopType [] else Bot) (select_return_top x1 (x1 ! Suc nat) (x1 ! nat)) = Type tm\"\n obtain tts :: \"checker_type \\ t list\" where\n f2: \"\\c. (\\ca ts. produce c ca \\ Type ts) \\ c = Type (tts c)\"\n using produce_type_type by moura\n then have f3: \"\\ts. \\ ct_suffix [TAny, TAny, TSome T_i32] x1 \\ Type tm \\ Type ts\"\n using a1 by fastforce\n then have \"\\ts. \\ ct_suffix x1 [TAny, TAny, TSome T_i32] \\ Type tm \\ Type ts\"\n using f2 a1 by fastforce\n then have False\n using f3 a1 by fastforce\n }\n thus ?thesis\n using assms 2 TopType nat_def\n by simp\n qed\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume xs cons) prods = (Type tm)\"\n using assms(1)\n by simp\n thus ?thesis\n using assms check_def consume_type_type produce_type_type\n by blast\n qed\nqed\n\nlemma b_e_check_single_weaken_type:\n assumes \"check_single \\ e (Type tn) = (Type tm)\"\n shows \"check_single \\ e (Type (ts@tn)) = Type (ts@tm)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1)\n by simp\n next\n case 2\n hence cond:\"(length tn \\ 3 \\ (tn!(length tn-2)) = (tn!(length tn-3)))\"\n using assms\n by (simp, metis checker_type.distinct(5))\n hence \"consume (Type tn) [TAny, TSome T_i32] = (Type tm)\"\n using assms 2\n by simp\n hence \"consume (Type (ts@tn)) [TAny, TSome T_i32] = (Type (ts@tm))\"\n using consume_weaken_type\n by blast\n moreover\n have \"(length (ts@tn) \\ 3 \\ ((ts@tn)!(length (ts@tn)-2)) = ((ts@tn)!(length (ts@tn)-3)))\"\n using cond\n by (simp, metis add.commute add_leE nth_append_length_plus numeral_Bit1 numeral_One\n one_add_one ordered_cancel_comm_monoid_diff_class.diff_add_assoc2)\n ultimately\n show ?thesis\n using 2\n by simp\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (Type tm)\"\n using assms(1)\n by simp\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis consume.simps(1) produce.simps(6))\n thus ?thesis\n using assms(1) check_def\n consume_weaken_type[OF t_int_def, of ts]\n produce_weaken_type[of t_int prods tm ts]\n by simp\n qed\nqed\n\nlemma b_e_check_single_weaken_top:\n assumes \"check_single \\ e (Type tn) = TopType tm\"\n shows \"check_single \\ e (Type (ts@tn)) = TopType tm\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n thus ?thesis\n using assms\n by (simp, metis checker_type.distinct(1) checker_type.distinct(3) consume.simps(1))\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (TopType tm)\"\n using assms(1)\n by simp\n moreover\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis checker_type.distinct(3) consume.simps(1) produce.simps(6))\n ultimately\n show ?thesis\n using check_def consume_weaken_type\n by (cases prods, auto)\n qed\nqed\n\nlemma b_e_check_weaken_type:\n assumes \"check \\ es (Type tn) = (Type tm)\"\n shows \"check \\ es (Type (ts@tn)) = (Type (ts@tm))\"\n using assms\nproof (induction es arbitrary: tn tm rule: List.rev_induct)\n case Nil\n thus ?case\n by simp\nnext\n case (snoc e es)\n hence \"check_single \\ e (check \\ es (Type tn)) = Type tm\"\n using check_unfold_snoc[OF check_neq_bot_snoc]\n by (metis checker_type.distinct(5))\n thus ?case\n using b_e_check_single_weaken_type b_e_check_single_type_type snoc\n by (metis check_unfold_snoc checker_type.distinct(5))\nqed\n\nlemma check_bot: \"check \\ es Bot = Bot\"\n by (simp add: list.case_eq_if)\n\nlemma b_e_check_weaken_top:\n assumes \"check \\ es (Type tn) = (TopType tm)\"\n shows \"check \\ es (Type (ts@tn)) = (TopType tm)\"\n using assms\nproof (induction es arbitrary: tn tm)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n show ?case\n proof (cases \"(check_single \\ e (Type tn))\")\n case (TopType x1)\n hence \"check_single \\ e (Type (ts@tn)) = TopType x1\"\n using b_e_check_single_weaken_top\n by blast\n thus ?thesis\n using TopType Cons\n by simp\n next\n case (Type x2)\n hence \"check_single \\ e (Type (ts@tn)) = Type (ts@x2)\"\n using b_e_check_single_weaken_type\n by blast\n thus ?thesis\n using Cons Type\n by fastforce\n next\n case Bot\n thus ?thesis\n using check_bot Cons\n by simp\n qed\n \nqed\n\nlemma b_e_type_checker_weaken:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n shows \"b_e_type_checker \\ es (ts@t1s _> ts@t2s)\"\nproof -\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_top[of \\ es t1s x1 ts]\n by (metis append_assoc b_e_type_checker.simps c_types_agree_imp_ct_list_eq c_types_agree_top2)\n next\n case (Type x2)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_type[of \\ es t1s x2 ts]\n by simp\n next\n case Bot\n thus ?thesis\n using ctn_def(3)\n by simp\n qed\nqed\n\nlemma b_e_type_checker_complete:\n assumes \"\\ \\ es : (tn _> tm)\"\n shows \"b_e_type_checker \\ es (tn _> tm)\"\n using assms\nproof (induction es \"(tn _> tm)\" arbitrary: tn tm rule: b_e_typing.induct)\n case (select \\ t)\n have \"ct_list_eq [TAny, TSome T_i32] [TSome t, TSome T_i32]\"\n by (simp add: to_ct_list_def ct_list_eq_def)\n thus ?case\n using ct_suffix_extend_ct_list_eq[OF ct_suffix_nil[of \"[TSome t]\"]] to_ct_list_def\n by auto\nnext\n case (br_table \\ ts \"is\" i t1s t2s)\n show ?case\n using list_all_conv_same_lab[OF br_table]\n by (auto simp add: to_ct_list_def ct_suffix_nil ct_suffix_cons_it)\nnext\n case (set_global i \\ t)\n thus ?case\n using to_ct_list_def ct_suffix_refl is_mut_def tg_t_def\n by auto\nnext\n case (composition \\ es t1s t2s e t3s)\n thus ?case\n using b_e_type_checker_compose\n by simp\nnext\n case (weakening \\ es t1s t2s ts)\n thus ?case\n using b_e_type_checker_weaken\n by simp\nqed (auto simp add: to_ct_list_def ct_suffix_refl ct_suffix_nil ct_suffix_cons_it\n ct_suffix_singleton_any)\n\ntheorem b_e_typing_equiv_b_e_type_checker:\n shows \"(\\ \\ es : tf) = (b_e_type_checker \\ es tf)\"\n using b_e_type_checker_sound b_e_type_checker_complete\n by (metis tf.exhaust)\n\nend\n", "meta": {"author": "conrad-watt", "repo": "wasm-pl-isabelle", "sha": "265f292250c01770d50d4ecda998ed5961c6719e", "save_path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle", "path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle/wasm-pl-isabelle-265f292250c01770d50d4ecda998ed5961c6719e/WebAssembly/Wasm_Checker_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2788922931629974}} {"text": "\ntext\\Facts about eta normalization involving theories\\\n\ntheory EtaNormProof\n imports EtaNorm Theory\n (* This means I need to restructure *)\n BetaNormProof\nbegin\n\nlemma term_ok'_decr: \"term_ok' \\ t \\ term_ok' \\ (decr i t)\"\n by (induction i t rule: decr.induct) auto\n\nlemma eta_preserves_term_ok': \"term_ok' \\ r \\ r \\\\<^sub>\\ s \\ term_ok' \\ s\"\nproof (induction r arbitrary: s)\n case (Ct n T)\n then show ?case \n apply (simp add: tinstT_def split: option.splits)\n (* Seems like I miss a simp rule for Ct*)\n using eta_reducible.simps(12) eta_step_imp_eta_reducible by blast\nnext\n case (Fv n T)\n then show ?case\n using eta.cases \n by blast\nnext\n case (Bv n)\n then show ?case \n by auto\nnext\n case (Abs R r)\n then show ?case \n using eta.cases \n by (fastforce simp add: term_ok'_decr)\nnext\n case (App f u)\n then show ?case \n apply - \n apply (erule eta_cases(2)) \n using term_ok'.simps(4) by blast+\nqed\n\nlemma eta_preserves_term_ok: \"term_ok \\ r \\ r \\\\<^sub>\\ s \\ term_ok \\ s\"\nproof -\n assume a1: \"term_ok \\ r\"\n assume a2: \"r \\\\<^sub>\\ s\"\n then have \"None \\ typ_of1 [] s\"\n using a1 eta_preserves_typ_of1 option.collapse wt_term_def typ_of_def \n by auto\n then show ?thesis\n using a2 a1 eta_preserves_term_ok' wt_term_def typ_of_def wf_term_iff_term_ok' term_ok_def\n by (meson eta_preserves_typ_of has_typ_iff_typ_of)\nqed\n\nlemma eta_star_preserves_term_ok': \"r \\\\<^sub>\\\\<^sup>* s \\ term_ok' \\ r \\ term_ok' \\ s\"\n by (induction rule: rtranclp.induct) (auto simp add: eta_preserves_term_ok')\n\ncorollary eta_star_preserves_term_ok: \"r \\\\<^sub>\\\\<^sup>* s \\ term_ok thy r \\ term_ok thy s\"\n using eta_star_preserves_term_ok' eta_star_preserves_typ_of1 wt_term_def typ_of_def by auto\n \ncorollary term_ok_eta_norm: \"term_ok thy t \\ eta_norm t = t'\\ term_ok thy t'\"\n using eta_norm_imp_eta_reds eta_star_preserves_term_ok by blast\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Metalogic_ProofChecker/EtaNormProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.27858760762158463}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ClosureEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory ClosureEx\nimports \"../Vcg\" \"../Simpl_Heap\" Closure\nbegin\n\n\nrecord globals = \n cnt_' :: \"ref \\ nat\"\n alloc_' :: \"ref list\"\n free_' :: \"nat\"\nrecord 'g vars = \"'g state\" +\n p_':: ref\n r_':: nat\n n_':: nat\n m_':: nat\n c_':: \"(string \\ ref) list \\ string\"\n d_':: \"(string \\ ref) list \\ string\"\n e_':: \"(string \\ nat) list \\ string\"\n\n\ndefinition \"var\\<^sub>n = [''n''\\ (\\x. n_'_update (\\_. x)),\n ''m''\\ (\\x. m_'_update (\\_. x))]\"\ndefinition \"upd\\<^sub>n = gen_upd var\\<^sub>n\"\n\nlemma upd\\<^sub>n_ap: \"upd\\<^sub>n (fst (ap es (es',p))) = upd\\<^sub>n es' \\ upd\\<^sub>n es\"\n by (simp add: upd\\<^sub>n_def gen_upd_ap)\n\n\nlemma\n\"\\\\\\\\n=n\\<^sub>0 \\ (\\i j. \\\\ \\\\n=i \\ \\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=i + j\\)\\ \n \\e :== (ap [(''n'',\\n)] \\e) \n \\\\j. \\\\ \\\\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=n\\<^sub>0 + j\\\\\"\napply vcg_step\napply clarify\napply (rule ap_closure [where var=var\\<^sub>n, folded upd\\<^sub>n_def])\napply clarsimp\napply (rename_tac s s')\napply (erule_tac x=\"n_' s\" in allE) \napply (erule_tac x=\"m_' s'\" in allE) \napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply (simp add: upd\\<^sub>n_def gen_upd_def var\\<^sub>n_def)\ndone\n\n\ndefinition \"var = [''p''\\ (\\x. p_'_update (\\_. x))]\"\ndefinition \"upd = gen_upd var\"\n\nprocedures Inc(p|r) =\n \"\\p\\\\cnt :== \\p\\\\cnt + 1;;\n \\r :== \\p\\\\cnt\"\n\nlemma (in Inc_impl)\n \"\\i p. \\\\ \\\\p\\\\cnt = i\\ \\r :== PROC Inc(\\p) \\\\r=i+1 \\ \\p\\\\cnt = i+1\\\"\n apply vcg\n apply simp\n done\n \nprocedures (imports Inc_signature) NewCounter(|c) =\n\"\\p :== NEW 1 [\\cnt :== 0];;\n \\c :== ([(''p'',\\p)],Inc_'proc)\" \n\n\nlocale NewCounter_impl' = NewCounter_impl + Inc_impl\nlemma (in NewCounter_impl')\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\n\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\nshows NewCounter_spec:\n \"\\alloc. \\\\ \\1 \\ \\free \\ \\alloc=alloc\\ \\c :== PROC NewCounter() \n \\\\p. p \\ set alloc \\ p \\ set \\alloc \\ p \\ Null \\ p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply clarsimp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\n\n\nlemma \"\\\\\\\\p. p \\ Null \\ p\\\\cnt = i \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=i+1\\\"\napply (rule conseq_extract_pre)\napply clarify\napply (rule dynCallClosureFix)\napply (simp only: Ball_def)\nprefer 3\napply (assumption)\nprefer 2\napply vcg_step\napply vcg_step\napply (simp only: simp_thms)\napply clarsimp\ndone\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=1\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (erule_tac x=0 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply simp\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\));;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=2\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\n\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n \\d :== \\c;;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\n_' := r_' t\\));;\n dynCallClosure (\\s. s) upd d_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\m_' := r_' t\\));;\n \\r :== \\n + \\m\n \\\\r=3\\\"\n\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/ex/ClosureEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.27858760041527236}} {"text": "(* Title: JinjaThreads/Common/Value.thy\n Author: David von Oheimb, Tobias Nipkow, Andreas Lochbihler\n\n Based on the Jinja theory Common/Value.thy by David von Oheimb and Tobias Nipkow\n\n*)\n\nheader {* \\isaheader{Jinja Values} *}\n\ntheory Value\nimports\n TypeRel\n \"~~/src/HOL/Word/Word\"\nbegin\n\ntype_synonym word32 = \"32 word\"\n\ndatatype 'addr val\n = Unit -- \"dummy result value of void expressions\"\n | Null -- \"null reference\"\n | Bool bool -- \"Boolean value\"\n | Intg word32 -- \"integer value\" \n | Addr 'addr -- \"addresses of objects, arrays and threads in the heap\"\n\nprimrec default_val :: \"ty \\ 'addr val\" -- \"default value for all types\"\nwhere\n \"default_val Void = Unit\"\n| \"default_val Boolean = Bool False\"\n| \"default_val Integer = Intg 0\"\n| \"default_val NT = Null\"\n| \"default_val (Class C) = Null\"\n| \"default_val (Array A) = Null\"\n\nlemma default_val_not_Addr: \"default_val T \\ Addr a\"\nby(cases T)(simp_all)\n\nlemma Addr_not_default_val: \"Addr a \\ default_val T\"\nby(cases T)(simp_all)\n\nprimrec the_Intg :: \"'addr val \\ word32\"\nwhere\n \"the_Intg (Intg i) = i\"\n\nprimrec the_Addr :: \"'addr val \\ 'addr\"\nwhere\n \"the_Addr (Addr a) = a\"\n\nfun is_Addr :: \"'addr val \\ bool\"\nwhere\n \"is_Addr (Addr a) = True\"\n| \"is_Addr _ = False\"\n\nlemma is_AddrE [elim!]:\n \"\\ is_Addr v; \\a. v = Addr a \\ thesis \\ \\ thesis\"\nby(cases v, auto)\n\nfun is_Intg :: \"'addr val \\ bool\"\nwhere\n \"is_Intg (Intg i) = True\"\n| \"is_Intg _ = False\"\n\nlemma is_IntgE [elim!]:\n \"\\ is_Intg v; \\i. v = Intg i \\ thesis \\ \\ thesis\"\nby(cases v, auto)\n\nfun is_Bool :: \"'addr val \\ bool\"\nwhere\n \"is_Bool (Bool b) = True\"\n| \"is_Bool _ = False\"\n\nlemma is_BoolE [elim!]:\n \"\\ is_Bool v; \\a. v = Bool a \\ thesis \\ \\ thesis\"\nby(cases v, auto)\n\ndefinition is_Ref :: \"'addr val \\ bool\"\nwhere \"is_Ref v \\ v = Null \\ is_Addr v\"\n\nlemma is_Ref_def2:\n \"is_Ref v = (v = Null \\ (\\a. v = Addr a))\"\n by (cases v) (auto simp add: is_Ref_def)\n\n\n\ndefinition undefined_value :: \"'addr val\" where \"undefined_value = Unit\"\n\nlemma undefined_value_not_Addr: \n \"undefined_value \\ Addr a\" \"Addr a \\ undefined_value\"\nby(simp_all add: undefined_value_def)\n\nclass addr =\n fixes hash_addr :: \"'a \\ int\"\n and monitor_finfun_to_list :: \"('a \\f nat) \\ 'a list\"\n assumes \"set (monitor_finfun_to_list f) = Collect (op $ (finfun_dom f))\"\n\nlocale addr_base =\n fixes addr2thread_id :: \"'addr \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Common/Value.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832804, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2784227154813871}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory PackedTypes\nimports \"../../lib/$L4V_ARCH/WordSetup\" CProof\nbegin\n\nsection {* Underlying definitions for the class axioms *}\n\ntext {* field_access / field_update is the identity for packed types *}\n\ndefinition\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext {* field_access is independent of the underlying bytes *}\n\ndefinition\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection {* Lemmas about td_fafu_idem *}\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: if_split_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have\n updeq: \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n\tby (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n\tusing mlt nlex xln lbs lbs' wf wfts `td_fafu_idem s` `wf_fd s`\n\tby (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply -\n apply (cases p')\n apply (simp split: if_split_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts `td_fafu_idem s` `wf_fd s`\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using `field_lookup_list (p' # ts') f 0 = Some (s, n)` by (simp split: option.splits)\nqed (clarsimp split: if_split_asm)+\n\nsubsection {* td_fa_hi *}\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"op @\"])\n apply (erule Cons_typ_desc.hyps, simp, simp)\n apply (erule Cons_typ_desc.hyps, simp, simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection {* Simp rules for deriving packed props from the type combinators *}\n\nsubsection {* td_fafu_idem *}\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fafu_idem_list_append)\n done\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\ field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\n(* Beer crime? *)\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply rule\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self)\n apply simp\n apply simp\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\ fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fafu_idem_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fafu_idem_array_n)\n apply simp\n done\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection {* td_fa_hi *}\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fa_hi_list_append)\n done\n\n(* Beer crime? *)\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fa_hi_list_append)\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fa_hi_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fa_hi_array_n)\n apply simp\n done\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection {* The type class and simp sets *}\n\ntext {* Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity *}\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n -- \"Axioms\"\n td_fafu_idem\n -- \"Combinators\"\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n -- \"Constructors\"\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n -- \"Axioms\"\n td_fa_hi\n -- \"Combinators\"\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n -- \"Constructors\"\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection {* Instances *}\n\ntext {* Words (of multiple of 8 size) are packed *}\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n apply(intro_classes)\n apply (rule td_fafu_idem_word)\n apply (rule td_fa_hi_word)\n done\nend\n\ntext {* Pointers are always packed *}\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n apply intro_classes\n apply (simp add: fa_fu_idem_def word_rsplit_rcat_size word_size)\n apply (simp add: fa_heap_indep_def)\n done\nend\n\ntext {* Arrays of packed types are in turn packed *}\n\nclass oneMB_packed = packed_type + oneMB_size\nclass twoToSix_packed = oneMB_packed + twoToSix_size\n\ninstance word :: (len8)oneMB_packed ..\ninstance word :: (len8)twoToSix_packed ..\n\ninstantiation array :: (oneMB_packed, fourthousand_count) packed_type\nbegin\ninstance\n apply(intro_classes)\n apply (simp add: td_fafu_idem_intro_simps)\n apply (simp add: td_fa_hi_intro_simps)\n done\nend\n\ninstance array :: (twoToSix_packed, fourthousand_count) oneMB_packed ..\n\nsection {* Theorems about packed types *}\n\nsubsection {* td_fa_hi *}\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows\n \"heap_update p v (heap_update p u h) = heap_update p v h\"\n apply(simp add:heap_update_def)\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply((subst heap_update_mem_same_point, simp, simp)+)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence)\n apply(simp)\n prefer 2\n apply(force)\n apply(simp)\n apply((subst heap_update_nmem_same, simp)+)\n apply(rule refl)\ndone\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"(hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp)) =\n (hrs_mem_update (heap_update p v) hp)\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection {* td_fafu_idem *}\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n apply assumption\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def using lbs\n apply -\n apply (rule heap_independence)\n apply simp\n apply (simp add: size_of_def)\n done\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n\n show ?case\n proof (cases n')\n case 0 thus ?thesis using `Suc m' < n'` by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using `Suc m' < n'` by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n(* Similar in TypHeap, but for w32 *)\nlemma unat_minus':\n fixes x :: \"'a :: len word\"\n shows \"x \\ 0 \\ unat (-x) = 2 ^ len_of TYPE('a) - unat x\"\n apply (simp add: unat_def word_minus_def)\n apply (simp add: int_word_uint zmod_zminus1_eq_if uint_0_iff)\n apply (subst nat_diff_distrib)\n apply simp\n apply (rule order_less_imp_le [OF uint_lt2p])\n apply (clarsimp simp: nat_power_eq)\n done\n\nlemma word_wrap_of_natD:\n fixes x :: \"'a :: len word\"\n assumes wraps: \"\\ x \\ x + of_nat n\"\n shows \"\\k. x + of_nat k = 0 \\ k \\ n\"\nproof -\n show ?thesis\n proof (rule exI [where x = \"unat (- x)\"], intro conjI)\n show \"x + of_nat (unat (-x)) = 0\"\n by simp\n next\n show \"unat (-x) \\ n\"\n proof (subst unat_minus')\n from wraps show \"x \\ 0\"\n\tby (rule contrapos_pn, simp add: not_le)\n next\n show \"2 ^ len_of TYPE('a) - unat x \\ n\" using wraps\n\tapply (simp add: no_olen_add_nat le_diff_conv not_less)\n\tapply (erule order_trans)\n\tapply (simp add: unat_of_nat)\n\tdone\n qed\n qed\nqed\n\nlemma nat_le_Suc_less:\n \"0 < y \\ (x \\ y - Suc 0) = (x < y)\"\n by arith\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(addr_bitsize)\"\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: addr_bitsize word) = n\" using szn szb\n by (simp add: unat_simps)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n\tby (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n\tapply -\n\tapply (drule c_guard_no_wrap)\n\tapply (simp add: std)\n\tdone\n\n have szt': \"size_td t < 2 ^ len_of TYPE(addr_bitsize)\"\n\tapply (subst std)\n\tapply (fold card_word)\n\tapply (fold addr_card_def)\n\tapply (rule max_size)\n\tdone\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n\tfrom xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n\t unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\t by (rule intvl_le_lower)\n next\n\tfrom szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: addr_bitsize word)\"\n\t apply -\n\t apply (rule of_nat_mono_maybe_le)\n\t apply simp_all\n\t done\n\twith al show \"ptr_val p \\ ptr_val p + of_nat n\"\n\t by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n\tby (simp add: word_le_nat_alt uofn)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n\tunfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\tapply -\n\tapply (drule (2) intvl_less_upper)\n\tapply (simp add: add.assoc)\n\tdone\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n\tby (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n\tapply -\n\tapply (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n apply (metis (hide_lams, mono_tags) add.commute of_nat_add)\n\tapply (erule (2) intvl_le_lower)\n\tdone\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: addr_bitsize word) = n + size_td t - 1\"\n\tusing t0 order_le_less_trans [OF szt1 szb]\n\tapply (subst Abs_fnat_homs(1))\n\tapply (subst unat_of_nat)\n\tapply simp\n\tdone\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n\tby (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n\tby simp\n\n show \"td_fafu_idem t\"\n\tby (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n\tby (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n\tusing wf_fd [where 'a = 'a]\n\tby (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n\tby (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n \tby (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n\tby (simp add: unat_sub [OF ofn] uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n\taccess_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n\tby simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n\tby (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n\t(update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n\t(replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n\thave \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n\tproof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n \t from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n\t by (subst add.commute, rule intvl_less_upper)\n\t show \"ptr_val p \\ x\" using xin al szb\n\t by (rule intvl_le_lower)\n\tqed\n\tthus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n\t by (simp add: word_le_nat_alt size_of_def unat_of_nat)\n\n\tshow \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n \t unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\t apply -\n\t apply (erule intvl_cut)\n\t apply simp\n\t apply (rule max_size)\n\t done\n\n\tshow \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n\t(* clag *)\n\tshow \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n\t using wf_fd [where 'a = 'a]\n\t by (simp add: length_fa_ti size_of_def std)\n\n\tshow \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n\t by (simp add: size_of_def)\n\n\thave \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n\t apply (subst heap_list_nth)\n\t apply (rule unx)\n\t apply simp\n\t done\n\n\tthus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n\t unfolding h_val_def\n\t by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2784227089085224}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Title: Confinement_S\n * Description: Rephrasing of the confinement proof using the concept of islands.\n *)\n\ntheory Islands_S\nimports Confine_S\nbegin\n\ndefinition\n island :: \"state \\ entity_id \\ entity_id set\" where\n \"island s x \\ {e\\<^sub>i. s \\ x \\* e\\<^sub>i}\"\n\ndefinition\n island_caps :: \"state \\ entity_id \\ cap set\" where\n \"island_caps s x \\ \\(caps_of s ` island s x)\"\n\nlemma island_caps_def2:\n \"island_caps s x \\ \\ e \\ island s x. caps_of s e\"\n by(simp add: island_caps_def)\n\nlemma island_caps_def3:\n \"island_caps s x = \\(direct_caps_of s ` island s x)\"\n apply (clarsimp simp: island_caps_def)\n apply rule\n apply (clarsimp simp: island_def caps_of_def)\n apply (drule store_connected_directly_tgs_connected)\n apply (metis directly_tgs_connected_rtrancl_into_rtrancl)\n apply (fastforce simp: caps_of_def store_connected_def)\n done\n\nlemma island_caps_dom:\n \"island_caps s e\\<^sub>x \\cap c =\n (\\e\\<^sub>i. (e\\<^sub>x, e\\<^sub>i) \\ tgs_connected s \\ caps_of s e\\<^sub>i \\cap c)\"\n by (auto simp add: island_caps_def caps_dominated_by_def island_def)\n\nlemma authority_confinement_islands:\n \"\\s' \\ execute cmds s;\n island_caps s x \\cap c\\\n \\ island_caps s' x \\cap c\"\n apply (simp add: island_caps_dom)\n apply clarsimp\n apply (frule (1) tgs_connected_preserved)\n apply (subst (asm) tgs_connected_comm_eq)\n apply (erule authority_confinement)\n apply clarsimp\n apply (erule_tac x=e\\<^sub>i' in allE)\n apply (erule impE)\n apply (metis (hide_lams, no_types) tgs_connected_comm_eq tgs_connected_def rtrancl_trans)\n apply clarsimp\n done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/spec/take-grant/Islands_S.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.27835816849624456}} {"text": "theory flash54Rev imports flashPub\nbegin\nsection{*Main defintions*}\n \n\nlemma lemmaOnPtrAtGetX[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv2 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv2 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\n\n\nlemma lemmaOnPtrAtGet[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv3 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv3 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\nlemma lemmaOnPtr1[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_Get )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGet)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr2[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGetX)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr3[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n \n\nabbreviation N::\"nat\" where \"N\\ M\"\nlemma NI_FAckVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1_HomeVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv3) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv54Aux: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule'' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"invHoldForRule3' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n then have \"?P3 s\" by(rule weak3)\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n have \"invHoldForRule3' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" \n \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) \n ( eqn ( IVar ( Para ''UniMsg_proc'' iInv3) ) (Const iInv2)) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv3) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n then have \"?P3 s\" by(rule weak3)\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n\t \n\t\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P3 s\"\n proof( unfold invHoldForRule3''_def,simp only:Let_def,( rule impI)+, rule ccontr)\n assume c1:\"\\f'. f' \\ invariants N \\ formEval f' s\" and c2:\"formEval (pre (NI_Remote_GetX_PutX iRule1 iRule2)) s \"\n and c3:\"\\ formEval (substFormByStatement (inv54 iInv1 iInv2 iInv3) (act (NI_Remote_GetX_PutX iRule1 iRule2))) s\"\n have d1:\" formEval (eqn (IVar (Para ''UniMsg_Cmd'' iInv1)) (Const UNI_Get)) s\" by(cut_tac a7 b1 c2 c3, auto)\n have d2:\"formEval (eqn (IVar (Para ''UniMsg_Cmd'' iRule1)) (Const UNI_GetX)) s\" by(cut_tac b1 c2 c3, auto)\n have d3:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iInv1)) (Const iInv2)) s\" by(cut_tac b1 c2 c3, auto)\n have d4:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iRule1)) (Const iRule2)) s\" by(cut_tac b1 c2 c3, auto)\n show False thm lemmaOnPtr2\n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 c1 c2 c3 d1 d2 d3 d4,blast )\n done\n qed\n \n \n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t } \n\t \n\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\n\nlemma NI_Remote_GetX_PutXVsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n by (metis NI_Remote_GetX_PutXVsInv54Aux a2 a3 a4 a5 a6 a7 a8 a9 local.a1 strengthEn)\n \nlemma NI_Remote_GetX_PutX_HomeVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv54: \n (*newRule2VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv3 \\ N\" and a6:\"iInv1~=iInv2 \" and a7:\"iInv1~=iInv3 \" and a8:\"iInv2~=iInv3 \" and a9:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\iRule2=iInv3) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\iRule2=iInv3) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1=iInv3\\iRule2=iInv1) \\(iRule1=iInv3\\iRule2=iInv2) \\(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 )) \\(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv3)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3\\(iRule2~=iInv1 \\iRule2~=iInv2 \\iRule2~=iInv3 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 a8 a9 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\(iRule1=iInv3) \\((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 a7 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv3)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 \\iRule1~=iInv3 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 a7 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv54: \n (*Rule1VsPInv3*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv3 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iInv1~=iInv3 \" and a7:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv54: \n (*Rule0VsPInv3*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv3 \\ N\" and a4:\"iInv1~=iInv2 \" and a5:\"iInv1~=iInv3 \" and a6:\"iInv2~=iInv3 \" \n\n shows \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n \n by (cut_tac a1 a2 a3 a4 a5, auto ) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash54Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2783581548544024}} {"text": "section \"Program Proof Rules\"\n\ntheory program_proof_rules\n imports \n invariant_simps \n unique_ids2\n single_invocation_correctness2\n \"Case_Labeling.Case_Labeling\"\n execution_invariants2\n execution_invariants_s\n execution_invariants_unused\n impl_language\n topological_sort\n program_verification_tactics\nbegin\n\ntext \"We define some proof rules for our implementation languages, so that \nwe can automate the generation of verification conditions.\n\nThe proof rules can simulate symbolic execution of a procedure.\nWe add some additional state compared to the system state in the semantics, so that we can derive\nadditional assumptions for the verification conditions.\"\n\ndefinition execution_s_check where\n \"execution_s_check \n progr \n i\n s_calls \n s_happensBefore \n s_callOrigin \n s_txOrigin \n s_knownIds \n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n tx\n firstTx\n ls\n \\ (\\trace S1 S'. \n (S1 ~~ (i, trace) \\\\<^sub>S* S')\n \\ (\\p t. (AInvoc p, t) \\ set trace)\n \\ state_wellFormed S1\n \\ calls S1 = s_calls\n \\ happensBefore S1 = updateHb s_happensBefore vis localCalls\n \\ callOrigin S1 = map_update_all s_callOrigin localCalls (the tx)\n \\ txOrigin S1 = s_txOrigin\n \\ knownIds S1 = s_knownIds\n \\ invocOp S1 = s_invocOp\n \\ invocRes S1 = s_invocRes\n \\ prog S1 = progr\n \\ generatedLocal = {x. generatedIds S1 x \\ i}\n \\ localState S1 i \\ ls\n \\ currentProc S1 i \\ toImpl\n \\ visibleCalls S1 i \\ (vis \\ set localCalls)\n \\ currentTx S1 i = tx\n \\ (\\tx'. tx \\ Some tx' \\ txStatus S1 tx' \\ Some Uncommitted)\n \\ (case tx of Some tx' \\ set localCalls = {c. callOrigin S1 c \\ tx'} | None \\ localCalls = [])\n \\ (sorted_by (happensBefore S1) localCalls)\n \\ (vis \\ set localCalls = {})\n \\ (dom s_callOrigin \\ set localCalls = {})\n \\ (Field s_happensBefore \\ set localCalls = {})\n \\ distinct localCalls\n \\ (firstTx \\ (\\c tx . callOrigin S1 c \\ tx \\ txOrigin S1 tx \\ i \\ txStatus S1 tx \\ Committed ))\n \\ (\\c. i_callOriginI_h s_callOrigin s_txOrigin c \\ i \\ c \\ vis)\n \\ (generatedLocalPrivate \\ generatedLocal)\n \\ (\\v\\generatedLocalPrivate. uid_is_private i S1 v)\n \\ traceCorrect_s trace)\"\n\nlemmas use_execution_s_check = execution_s_check_def[THEN meta_eq_to_obj_eq, THEN iffD1, rule_format, rotated]\n\nlemma beforeInvoc_execution_s_check: \n assumes \"s_invocOp i = None\"\n shows \"\nexecution_s_check progr i s_calls s_happensBefore s_callOrigin s_txOrigin s_knownIds s_invocOp s_invocRes generatedLocal generatedLocalPrivate vis localCalls tx firstTx ls\n\"\n using assms \n by (auto simp add: execution_s_check_def steps_s_cons_simp Let_def wf_localState_to_invocOp)\n\n\n\n\n\ntext \"It is sufficient to check with @{term execution_s_check} to ensure that the procedure is correct:\"\n\n\n\nlemma execution_s_check_sound:\n assumes ls_def: \"localState S i \\ ls\"\n and vis_def: \"visibleCalls S i \\ vis\"\n and progr_def: \"prog S = progr\"\n and toImpl: \"currentProc S i \\ toImpl\"\n and generatedLocal: \"generatedLocal = {x. generatedIds S x \\ i}\"\n and generatedLocalPrivate1: \"generatedLocalPrivate \\ generatedLocal\"\n and generatedLocalPrivate2: \"\\v\\generatedLocalPrivate. uid_is_private i S v\"\n and S_wf: \"state_wellFormed S\"\n and no_uncommitted: \"\\tx'. currentTx S i \\ Some tx' \\ txStatus S tx' \\ Some Uncommitted\"\n and no_currentTxn: \"currentTx S i = None\"\n and firstTx_def: \"(firstTx \\ (\\c tx . callOrigin S c \\ tx \\ txOrigin S tx \\ i \\ txStatus S tx \\ Committed ))\"\n and c: \"execution_s_check \n progr \n i\n (calls S)\n (happensBefore S)\n (callOrigin S)\n (txOrigin S)\n (knownIds S)\n (invocOp S)\n (invocRes S)\n generatedLocal\n generatedLocalPrivate\n vis\n []\n (currentTx S i)\n firstTx\n ls\"\n shows \"execution_s_correct S i\"\nproof (auto simp add: execution_s_correct_def)\n fix trace S'\n assume a0: \"S ~~ (i, trace) \\\\<^sub>S* S'\"\n\n\n from a0\n show \"traceCorrect_s trace\"\n proof (rule c[simplified execution_s_check_def, rule_format]; force?)\n show \"state_wellFormed S\"\n by (simp add: assms)\n\n show \"\\p t. (AInvoc p, t) \\ set trace\"\n using a0 assms no_more_invoc by blast\n\n\n show \"prog S = progr\"\n by (simp add: assms)\n\n show \" generatedLocal = {x. generatedIds S x \\ i}\"\n by (auto simp add: assms)\n\n show \"localState S i \\ ls\"\n by (simp add: assms(1))\n\n show \"currentProc S i \\ toImpl\"\n by (simp add: assms)\n\n show \"currentTx S i \\ Some tx' \\ txStatus S tx' \\ Some Uncommitted\" for tx'\n by (simp add: assms)\n\n show \"visibleCalls S i \\ (vis \\ set [])\"\n by (simp add: assms)\n\n show \"case currentTx S i of None \\ [] = [] | Some tx' \\ set [] = {c. callOrigin S c \\ tx'}\"\n by (simp add: no_currentTxn)\n\n show \"sorted_by (happensBefore S) []\"\n by (simp add: sorted_by_empty)\n show \"firstTx = (\\c tx. callOrigin S c \\ tx \\ txOrigin S tx \\ i \\ txStatus S tx \\ Committed)\"\n using firstTx_def by auto\n\n show \"\\c. i_callOriginI S c \\ i \\ c \\ vis\"\n apply (auto simp add: i_callOriginI_h_def split: option.splits)\n using S_wf state_wellFormed_ls_visibleCalls_callOrigin vis_def by blast\n\n show \"generatedLocalPrivate \\ generatedLocal\"\n by (simp add: generatedLocalPrivate1)\n\n show \"\\x. x \\ generatedLocalPrivate \\\n uid_is_private i S x\"\n by (simp add: generatedLocalPrivate2)\n\n\n qed\nqed\n\n\nlemma execution_s_check_sound2:\n assumes a1: \"localState S i \\ ls\"\n and a2': \"S \\ initialStates' progr i\"\n and a3: \"currentProc S i \\ toImpl\"\n and c: \"\\s_calls s_happensBefore s_callOrigin s_txOrigin s_knownIds s_invocOp s_invocRes.\n\\\ns_invocOp i = invocOp S i;\ns_invocRes i = None;\n\\tx. s_txOrigin tx \\ Some i\n\\ \\\n execution_s_check \n progr \n i\n s_calls\n s_happensBefore\n s_callOrigin\n s_txOrigin\n s_knownIds\n s_invocOp\n s_invocRes\n {}\n {}\n {}\n []\n None\n True\n ls\"\n shows \"execution_s_correct S i\"\n using a1\nproof (rule execution_s_check_sound)\n\n have a2: \"S \\ initialStates progr i\"\n using a2' by (simp add: initialStates'_same) \n\n show \"visibleCalls S i \\ {}\"\n using a2 by (auto simp add: initialStates_def)\n\n show \"prog S = progr\"\n using a2 by (auto simp add: initialStates_def)\n\n show \"currentProc S i \\ toImpl\"\n using a3 by simp\n\n show wf: \"state_wellFormed S\"\n\n using a2 initialStates_wellFormed by blast\n\n show \"{} = {x. generatedIds S x \\ i}\"\n using a2 wf_generated_ids_invocation_exists by (auto simp add: initialStates_def, blast)\n\n show currentTx: \"currentTx S i = None\"\n using a2 initialState_noTxns2 by blast\n\n\n show \"execution_s_check progr i (calls S) (happensBefore S) (callOrigin S) (txOrigin S) (knownIds S) (invocOp S)\n (invocRes S) {} {} {} [] (currentTx S i) True ls \"\n unfolding currentTx\n proof (rule c)\n show \"invocOp S i = invocOp S i\" by simp\n show \"invocRes S i = None\"\n by (simp add: a1 local.wf state_wellFormed_no_result_when_running)\n show \"\\tx. txOrigin S tx \\ Some i\"\n using a2 by (auto simp add: initialStates_def)\n\n qed\n\n show \"\\tx'. currentTx S i \\ Some tx' \\ txStatus S tx' \\ Some Uncommitted\"\n using a2 initialState_noTxns1 by blast\n\n show \"True = (\\c tx. callOrigin S c \\ tx \\ txOrigin S tx \\ i \\ txStatus S tx \\ Committed)\"\n by (meson \\visibleCalls S i \\ {}\\ empty_iff local.wf state_wellFormed_ls_visibleCalls_callOrigin)\n\n\nqed simp+\n\n\nlemma execution_s_check_sound3:\n assumes a1: \"localState S i \\ ls\"\n and a2: \"S \\ initialStates' progr i\"\n and a3: \"currentProc S i \\ toImpl\"\n and a4: \"invocOp S i \\ op\"\n and c: \"\\s_calls s_happensBefore s_callOrigin s_txOrigin s_knownIds s_invocOp s_invocRes.\n\\\n\\tx. s_txOrigin tx \\ Some i\n\\ \\\n execution_s_check \n progr \n i\n s_calls\n s_happensBefore\n s_callOrigin\n s_txOrigin\n s_knownIds\n (s_invocOp(i\\op))\n (s_invocRes(i:=None))\n {}\n {}\n {}\n []\n None\n True\n ls\"\n shows \"execution_s_correct S i\"\n by (smt a1 a2 a3 a4 c execution_s_check_sound2 fun_upd_triv)\n\nlemma traceCorrect_s_empty: \"traceCorrect_s [] \"\n by (simp add: traceCorrect_s_def) \n\nlemma case_trace_not_empty:\n assumes \"\\a trace'. trace = a#trace' \\ traceCorrect_s (a#trace')\"\n shows \"traceCorrect_s trace\"\n using assms by (cases trace, auto simp add: traceCorrect_s_empty)\n\nlemma case_trace_not_empty2:\n assumes \"\\action Inv trace'. trace = (action, Inv)#trace' \\ traceCorrect_s ((action, Inv)#trace')\"\n shows \"traceCorrect_s trace\"\n using assms by (cases trace, auto simp add: traceCorrect_s_empty)\n\nlemma case_trace_not_empty3:\n assumes \"S ~~ (i,trace) \\\\<^sub>S* S''\"\n and \"\\action S' Inv trace'. \\\n trace = (action, Inv)#trace'; \n S ~~ (i,action,Inv) \\\\<^sub>S S'; \n S' ~~ (i,trace') \\\\<^sub>S* S''\\ \\ Inv \\ traceCorrect_s (trace')\"\n shows \"traceCorrect_s trace\"\n by (metis assms(1) assms(2) case_trace_not_empty2 sndI steps_s_cons_simp traceCorrect_s_split)\n\n\nlemma sorted_by_updateHb:\n assumes \"set cs \\ vis = {}\"\n and \"set cs \\ Field hb = {}\"\n and \"distinct cs\"\n shows \"sorted_by (updateHb hb vis cs) cs\"\n using assms proof (induct cs arbitrary: hb vis)\ncase Nil\n then show ?case \n by (simp add: sorted_by_empty)\n\nnext\n case (Cons x xs)\n\n have \"distinct xs\"\n using Cons.prems(3) by auto\n\n\n from this\n have IH: \"sorted_by (updateHb (hb \\ vis \\ {x}) (insert x vis) xs) xs\"\n proof (fuzzy_rule Cons)\n\n show \" set xs \\ insert x vis = {}\"\n using Cons by auto\n show \" set xs \\ Field (hb \\ vis \\ {x}) = {}\"\n using Cons by (auto simp add: Field_def)\n qed\n\n show ?case \n proof (auto simp add: updateHb.simps)\n show \"sorted_by (updateHb (hb \\ vis \\ {x}) (insert x vis) xs) (x # xs)\"\n apply (auto simp add: sorted_by_cons_iff IH)\n using Cons.prems(1) Cons.prems(2) Cons.prems(3) FieldI1 updateHb_simp2 by fastforce\n qed\nqed\n\nlemma no_ainvoc:\n assumes \"\\p t. (AInvoc p, t) \\ set trace\"\n and \"trace = (action, Inv) # trace'\"\nand \"\\\\p t. (AInvoc p, t) \\ set trace; \\proc. action \\ AInvoc proc\\ \\ P\"\nshows \"P\"\n using assms by auto\n\nmethod show_proof_rule = \n (subst execution_s_check_def, intro allI impI, erule case_trace_not_empty3, erule(1) no_ainvoc, fuzzy_goal_cases Step)\n\ninductive_cases step_s_NewId: \"S ~~ (i, ANewId uidv, Inv) \\\\<^sub>S S'\"\n\nlemma execution_s_check_newId:\n assumes \"infinite (Collect P)\"\n and \"program_wellFormed progr\"\n and cont: \"\\v. \\P v; \nto_nat v \\ s_knownIds;\nto_nat v \\ generatedLocal;\nuniqueIds v = {to_nat v};\nuid_is_private' i s_calls s_invocOp s_invocRes s_knownIds (to_nat v)\n\\ \\ execution_s_check\n progr \n i\n s_calls \n s_happensBefore \n s_callOrigin \n s_txOrigin \n s_knownIds \n s_invocOp\n s_invocRes\n (generatedLocal \\ {to_nat v})\n (generatedLocalPrivate \\ {to_nat v})\n vis\n localCalls\n tx\n firstTx\n (cont v)\"\n\nshows\"execution_s_check\n progr \n i\n s_calls \n s_happensBefore \n s_callOrigin \n s_txOrigin \n s_knownIds \n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n tx\n firstTx\n (newId P \\ cont)\n\"\nproof show_proof_rule\n case (Step trace S1 S' action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (newId P \\ cont)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n obtain uidv\n where c0: \"localState S1 i \\ (newId P \\ cont)\"\n and c1: \"currentProc S1 i \\ toImpl\"\n and c2: \"action = ANewId uidv\"\n and c3: \"Inv\"\n and S'a_def: \"S'a = S1\\localState := localState S1(i \\ cont uidv), generatedIds := generatedIds S1(to_nat uidv \\ i)\\\"\n and c5: \"generatedIds S1 (to_nat uidv) = None\"\n and c6: \"uniqueIds uidv = {to_nat uidv}\"\n and c7: \"P uidv\"\n by (auto simp add: step_s.simps split:if_splits)\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof (intro conjI)\n show \"Inv\" using `Inv` .\n\n from `S'a ~~ (i, trace') \\\\<^sub>S* S'`\n show \"traceCorrect_s trace'\"\n proof (rule use_execution_s_check)\n\n\n have h1: \"new_unique_not_in_calls s_calls (to_nat uidv)\"\n using Step.calls_eq Step.prog_eq Step.state_wellFormed assms(2) c5 new_unique_not_in_calls_def wf_onlyGeneratedIdsInCalls by blast\n\n\n have h2: \"new_unique_not_in_calls_result s_calls (to_nat uidv)\"\n using Step.calls_eq Step.prog_eq Step.state_wellFormed assms(2) c5 new_unique_not_in_calls_result_def wf_onlyGeneratedIdsInCallResults by blast\n\n have h3: \"new_unique_not_in_invocOp s_invocOp (to_nat uidv)\"\n using Step.invocOp_eq Step.prog_eq Step.state_wellFormed assms(2) c5 new_unique_not_in_invocOp_def wf_onlyGeneratedIdsInInvocationOps by blast\n\n have h4: \"new_unique_not_in_invocRes s_invocRes (to_nat uidv)\"\n using Step.invocRes_eq Step.prog_eq Step.state_wellFormed assms(2) c5 new_unique_not_in_invocRes_def wf_onlyGeneratedIdsInInvocationRes by blast\n\n\n have h5: \"new_unique_not_in_other_invocations i S'a (to_nat uidv)\"\n unfolding new_unique_not_in_other_invocations_def\n proof (intro allI impI)\n fix i'\n assume a0: \"i' \\ i\"\n\n have \"program_wellFormed (prog S1)\"\n by (simp add: Step.prog_eq assms(2))\n\n\n obtain uids \n where \"uids\\dom (generatedIds S1)\" and \"invocation_cannot_guess_ids uids i' S1\"\n using wf_knownIds_subset_generatedIds_h(1)[OF `state_wellFormed S1` `program_wellFormed (prog S1)`]\n by auto\n\n\n from `uids\\dom (generatedIds S1)`\n and `generatedIds S1 (to_nat uidv) = None`\n have \" to_nat uidv \\ uids\"\n by auto\n\n\n show \"\\uids. to_nat uidv \\ uids \\ invocation_cannot_guess_ids uids i' S'a\"\n using Step.step_s \\invocation_cannot_guess_ids uids i' S1\\ \\to_nat uidv \\ uids\\ a0 c2 show_invocation_cannot_guess_ids_step_other step_s_to_step by fastforce\n qed\n\n\n\n have h6: \"to_nat uidv \\ s_knownIds\"\n using Step.knownIds_eq Step.prog_eq Step.state_wellFormed assms(2) c5 wf_onlyGeneratedIdsInKnownIds by blast\n\n\n show \"execution_s_check\n progr \n i\n s_calls \n s_happensBefore \n s_callOrigin \n s_txOrigin \n s_knownIds \n s_invocOp\n s_invocRes\n (generatedLocal \\ {to_nat uidv})\n (generatedLocalPrivate \\ {to_nat uidv})\n vis\n localCalls\n tx\n firstTx\n (cont uidv)\"\n proof (rule cont)\n show \"P uidv\"\n by (simp add: c7)\n\n \n show \"to_nat uidv \\ s_knownIds\"\n using h6 by auto\n\n show \"to_nat uidv \\ generatedLocal\"\n by (simp add: Step.generatedLocal_def c5)\n\n show \"uniqueIds uidv = {to_nat uidv}\"\n by (simp add: c6)\n\n show \"uid_is_private' i s_calls s_invocOp s_invocRes s_knownIds (to_nat uidv)\"\n by (simp add: h1 h2 h3 h4 h6 uid_is_private'_def)\n\n\n qed\n\n\n show \"\\p t. (AInvoc p, t) \\ set trace'\"\n using Step by auto\n\n show \"state_wellFormed S'a\"\n using Step state_wellFormed_combine_s1 by blast\n\n show \"case tx of None \\ localCalls = [] | Some tx' \\ set localCalls = {c. callOrigin S'a c \\ tx'}\"\n using Step.case_option by (auto simp add: S'a_def split: option.splits)\n\n show \"sorted_by (happensBefore S'a) localCalls\"\n using Step by (auto simp add:S'a_def )\n\n show \"generatedLocal \\ {to_nat uidv} = {x. generatedIds S'a x \\ i}\"\n by (auto simp add: S'a_def Step)\n\n show \"generatedLocalPrivate \\ {to_nat uidv} \\ generatedLocal \\ {to_nat uidv}\"\n apply (auto simp add: S'a_def Step)\n using Step.Ball uid_is_private_def by blast\n\n \n\n show \"uid_is_private i S'a v\" if \"v \\ generatedLocalPrivate \\ {to_nat uidv}\" for v\n using that proof auto\n\n show \"uid_is_private i S'a (to_nat uidv)\"\n using S'a_def h5 by (auto simp add: uid_is_private_def S'a_def Step h1 h2 h3 h4 h5 h6)\n\n \n\n show \"uid_is_private i S'a v\" if \"v \\ generatedLocalPrivate\"\n unfolding uid_is_private_def\n proof (intro conjI)\n\n have pre: \"uid_is_private i S1 v\" \n by (simp add: Step.Ball that)\n\n show \"new_unique_not_in_invocOp (invocOp S'a) v\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n\n\n show \"new_unique_not_in_calls (calls S'a) v\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n show \"new_unique_not_in_calls_result (calls S'a) v\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n show \"new_unique_not_in_invocRes (invocRes S'a) v\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n show \"v \\ knownIds S'a\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n show \"generatedIds S'a v \\ i\"\n using pre by (auto simp add: uid_is_private_def S'a_def)\n show \"new_unique_not_in_other_invocations i S'a v\"\n using pre proof (auto simp add: uid_is_private_def )\n\n show \"new_unique_not_in_other_invocations i S'a v\"\n if c0: \"new_unique_not_in_invocOp (invocOp S1) v\"\n and c1: \"new_unique_not_in_calls (calls S1) v\"\n and c2: \"new_unique_not_in_calls_result (calls S1) v\"\n and c3: \"new_unique_not_in_invocRes (invocRes S1) v\"\n and c4: \"v \\ knownIds S1\"\n and c5: \"generatedIds S1 v \\ i\"\n and c6: \"new_unique_not_in_other_invocations i S1 v\"\n \n using c6 proof (auto simp add: new_unique_not_in_other_invocations_def)\n fix i'\n assume a0: \"\\i'. i' \\ i \\ (\\uids. v \\ uids \\ invocation_cannot_guess_ids uids i' S1)\"\n and a1: \"i' \\ i\"\n\n obtain uids where \"v \\ uids\" and \"invocation_cannot_guess_ids uids i' S1\"\n using a0 a1 by auto\n\n have \"i \\ i'\" using a1 by simp\n\n have \"invocation_cannot_guess_ids uids i' S'a\"\n using `invocation_cannot_guess_ids uids i' S1` `S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n by (rule show_invocation_cannot_guess_ids_step_s_other)\n (auto simp add: `action = ANewId uidv` `i \\ i'`)\n\n\n thus \"\\uids. v \\ uids \\ invocation_cannot_guess_ids uids i' S'a\"\n using \\v \\ uids\\ by blast\n\n qed\n\n qed\n qed\n qed\n \n\n qed (simp add: S'a_def Step; fail)+\n qed\nqed\n\n\n\n\n\nlemma execution_s_check_beginAtomic:\n assumes \"program_wellFormed progr\"\n and cont: \"\\tx s_calls' s_happensBefore' s_callOrigin' s_txOrigin' s_knownIds' vis'\n s_invocOp' s_invocRes' .\n\\invariant progr\n \\calls = s_calls', \n happensBefore = s_happensBefore',\n callOrigin = s_callOrigin',\n txOrigin = s_txOrigin', \n knownIds = s_knownIds',\n invocOp = (s_invocOp'(i := s_invocOp i)), \n invocRes = s_invocRes'(i := None)\\;\ns_txOrigin' tx = None;\n\\i op. s_invocOp i \\ op \\ s_invocOp' i \\ op;\n\\c. s_callOrigin' c \\ Some tx;\nvis \\ vis';\nvis' \\ dom s_calls';\nfirstTx \\ (\\c tx. s_callOrigin' c \\ tx \\ s_txOrigin' tx \\ Some i);\n\\ \\consistency: \\\ncausallyConsistent s_happensBefore' vis';\ntransactionConsistent_atomic s_callOrigin' vis';\n\\v\\generatedLocalPrivate. uid_is_private' i s_calls' s_invocOp' s_invocRes' s_knownIds' v;\n\\ \\generic wellFormed and growth predicates (this is more like a backup, the important facts should be above) : \\\n\\some_generatedIds some_currentTx some_localState some_currentProc some_visibleCalls some_txStatus.\nstate_wellFormed \\\n calls = s_calls',\n happensBefore = s_happensBefore',\n callOrigin = s_callOrigin',\n txOrigin = s_txOrigin',\n knownIds = s_knownIds',\n invocOp = s_invocOp',\n invocRes = s_invocRes',\n prog = progr,\n txStatus = some_txStatus,\n generatedIds = some_generatedIds,\n localState = some_localState,\n currentProc = some_currentProc,\n visibleCalls = some_visibleCalls,\n currentTx = some_currentTx\\;\n \\some_generatedIds1 some_currentTx1 some_localState1 some_currentProc1 some_visibleCalls1 some_txStatus1\n some_generatedIds2 some_currentTx2 some_localState2 some_currentProc2 some_visibleCalls2 some_txStatus2.\nstate_monotonicGrowth i \\\n calls = s_calls,\n happensBefore = s_happensBefore,\n callOrigin = s_callOrigin,\n txOrigin = s_txOrigin,\n knownIds = s_knownIds,\n invocOp = s_invocOp,\n invocRes = s_invocRes,\n prog = progr,\n txStatus = some_txStatus1,\n generatedIds = some_generatedIds1,\n localState = some_localState1,\n currentProc = some_currentProc1,\n visibleCalls = some_visibleCalls1,\n currentTx = some_currentTx1\\ \n\\\n calls = s_calls',\n happensBefore = s_happensBefore',\n callOrigin = s_callOrigin',\n txOrigin = s_txOrigin',\n knownIds = s_knownIds',\n invocOp = s_invocOp',\n invocRes = s_invocRes',\n prog = progr,\n txStatus = some_txStatus2,\n generatedIds = some_generatedIds2,\n localState = some_localState2,\n currentProc = some_currentProc2,\n visibleCalls = some_visibleCalls2,\n currentTx = some_currentTx2\\\n\\ \\ execution_s_check\n progr \n i\n s_calls' \n s_happensBefore' \n s_callOrigin' \n (s_txOrigin'(tx \\ i))\n s_knownIds' \n (s_invocOp'(i := s_invocOp i))\n (s_invocRes'(i := None))\n generatedLocal\n generatedLocalPrivate\n vis'\n []\n (Some tx)\n firstTx\n (cont ())\"\n\n\nshows\"execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n []\n None\n firstTx\n (beginAtomic \\ cont)\n\"\nproof show_proof_rule\n case (Step trace S1 S_end action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (beginAtomic \\ cont)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n obtain t S' vis' vis''\n where c0: \"localState S1 i \\ (beginAtomic \\ cont)\"\n and c1: \"currentProc S1 i \\ toImpl\"\n and c2: \"action = ABeginAtomic t vis''\"\n and c3: \"Inv\"\n and c4: \"currentTx S1 i = None\"\n and c5: \"txStatus S1 t = None\"\n and c6: \"prog S' = prog S1\"\n and growth: \"state_monotonicGrowth i S1 S'\"\n and c8: \"\\x. txOrigin S1 x \\ i = txOrigin S' x \\ i\"\n and inv: \"invariant (prog S1) (invContext S')\"\n and c10: \"\\x. txStatus S' x \\ Some Uncommitted\"\n and wf_S': \"state_wellFormed S'\"\n and c12: \"state_wellFormed (S'\\txStatus := txStatus S'(t \\ Uncommitted), txOrigin := txOrigin S'(t \\ i), currentTx := currentTx S'(i \\ t), localState := localState S'(i \\ cont ()), visibleCalls := visibleCalls S'(i \\ vis'')\\)\"\n and c13: \"localState S' i \\ (beginAtomic \\ cont)\"\n and c14: \"currentProc S' i \\ toImpl\"\n and c15: \"currentTx S' i = None\"\n and c16: \"visibleCalls S1 i \\ vis'\"\n and c17: \"visibleCalls S' i \\ vis'\"\n and c18: \"chooseSnapshot vis'' vis' S'\"\n and c19: \"consistentSnapshot S' vis''\"\n and c20: \"txStatus S' t = None\"\n and c21: \"\\x. callOrigin S' x \\ Some t\"\n and c22: \"txOrigin S' t = None\"\n and S'a_def: \"S'a = S' \\txStatus := txStatus S'(t \\ Uncommitted), txOrigin := txOrigin S'(t \\ i), currentTx := currentTx S'(i \\ t), localState := localState S'(i \\ cont ()), visibleCalls := visibleCalls S'(i \\ vis'')\\\"\n by (auto simp add: step_s.simps)\n\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof (intro conjI)\n show \"Inv\" using `Inv` .\n\n from `S'a ~~ (i, trace') \\\\<^sub>S* S_end`\n show \"traceCorrect_s trace'\"\n proof (rule use_execution_s_check)\n\n show \"happensBefore S'a = updateHb (happensBefore S'a) vis'' []\"\n by simp\n\n show \"callOrigin S'a = map_update_all (callOrigin S'a) [] (the (Some t))\"\n by simp\n\n show \"\\p t. (AInvoc p, t) \\ set trace'\"\n using Step by auto\n\n\n show \" state_wellFormed S'a\"\n using S'a_def c12 by blast\n\n show \"currentProc S'a i \\ toImpl\"\n by (simp add: S'a_def c14)\n\n show \"localState S'a i \\ cont ()\"\n by (simp add: S'a_def)\n\n show \"visibleCalls S'a i \\ (vis'' \\ set [])\"\n by (simp add: S'a_def)\n\n show \"currentTx S'a i \\ t\"\n by (simp add: S'a_def)\n\n show \" \\tx'. Some t \\ Some tx' \\ txStatus S'a tx' \\ Some Uncommitted\"\n by (simp add: S'a_def c10)\n show \"case Some t of None \\ [] = [] | Some tx' \\ set [] = {c. callOrigin S'a c \\ tx'}\"\n by (simp add: S'a_def c21)\n show \"sorted_by (happensBefore S'a) []\"\n by (simp add: S'a_def sorted_by_empty)\n show \"vis'' \\ set [] = {}\"\n by simp\n show \"dom (callOrigin S'a) \\ set [] = {}\"\n by simp\n show \"Field (happensBefore S'a) \\ set [] = {}\"\n by simp\n\n show \"execution_s_check (prog S'a) i (calls S'a) (happensBefore S'a) (callOrigin S'a) (txOrigin S'a) (knownIds S'a)\n (invocOp S'a) (invocRes S'a) generatedLocal generatedLocalPrivate vis'' [] (Some t) firstTx (cont ())\"\n proof (fuzzy_rule cont)\n\n show \"progr = prog S'a\"\n by (simp add: S'a_def `prog S1 = progr` c6)\n\n show \"txOrigin S'(t \\ i) = txOrigin S'a\"\n by (simp add: S'a_def)\n\n show \"txOrigin S' t = None\"\n by (simp add: c22)\n\n\n show \" invariant progr\n \\calls = calls S'a, happensBefore = happensBefore S'a, callOrigin = callOrigin S'a,\n txOrigin = txOrigin S', knownIds = knownIds S'a, invocOp = (invocOp S'a)(i := s_invocOp i),\n invocRes = (invocRes S'a)(i := None)\\\"\n proof (fuzzy_rule inv)\n show \"prog S1 = progr\"\n by (simp add: Step)\n\n have cCalls: \"committedCalls S' = dom (calls S')\"\n by (simp add: c10 wf_S' committedCalls_allCommitted)\n\n have allTransactionsCommitted: \"committedTransactions S' = dom (txOrigin S')\"\n apply (auto simp add: dom_def)\n apply (metis wf_S' domD domIff option.simps(3) wf_transaction_status_iff_origin)\n by (metis c10 not_None_eq not_uncommitted_cases wf_S' wf_transaction_status_iff_origin)\n\n\n\n show \"invContext S' =\n \\calls = calls S'a, happensBefore = happensBefore S'a, callOrigin = callOrigin S'a,\n txOrigin = txOrigin S', knownIds = knownIds S'a, invocOp = (invocOp S'a)(i := s_invocOp i),\n invocRes = (invocRes S'a)(i := None)\\\"\n proof (auto simp add: invContextH_def S'a_def cCalls allTransactionsCommitted)\n show \"\\a b. (a, b) \\ happensBefore S' |r dom (calls S') \\ (a, b) \\ happensBefore S'\"\n by (simp add: restrict_relation_def)\n show \"\\a b. (a, b) \\ happensBefore S' \\ (a, b) \\ happensBefore S' |r dom (calls S')\"\n by (simp add: wf_S' happensBefore_in_calls_left happensBefore_in_calls_right restrict_relation_def)\n show \" callOrigin S' |` dom (calls S') = callOrigin S'\"\n by (metis wf_S' restrict_map_noop2 wellFormed_callOrigin_dom)\n show \"invocOp S' = (invocOp S')(i := s_invocOp i)\"\n using Step.invocOp_eq growth state_monotonicGrowth_invocOp_i by fastforce\n show \"invocRes S' = (invocRes S')(i := None)\"\n by (simp add: c13 fun_upd_idem wf_S' wf_localState_noReturn)\n qed\n qed\n\n show \"\\i op. s_invocOp i \\ op \\ invocOp S'a i \\ op\"\n apply(simp add: S'a_def)\n using Step.invocOp_eq growth state_monotonicGrowth_invocOp by blast\n\n show \"\\c. callOrigin S'a c \\ Some t\"\n using \\case Some t of None \\ [] = [] | Some tx' \\ set [] = {c. callOrigin S'a c \\ tx'}\\ by auto\n \n from `chooseSnapshot vis'' vis' S'`\n have \"vis' \\ vis''\"\n by (auto simp add: chooseSnapshot_def)\n\n have \"vis \\ vis'\"\n using `visibleCalls S1 i \\ (vis \\ set [])` c16 by auto\n\n show \"vis \\ vis''\"\n using \\vis \\ vis'\\ \\vis' \\ vis''\\ by auto\n\n \n show \"vis'' \\ dom (calls S'a)\"\n using `consistentSnapshot S' vis''`\n by (simp add: S'a_def consistentSnapshotH_def)\n\n show \"causallyConsistent (happensBefore S'a) vis''\"\n using `consistentSnapshot S' vis''`\n by (simp add: S'a_def consistentSnapshotH_def)\n\n show \"transactionConsistent_atomic (callOrigin S'a) vis''\"\n using `consistentSnapshot S' vis''`\n by (simp add: S'a_def consistentSnapshotH_def transactionConsistent_def)\n\n from `state_wellFormed S'`\n show \"\\some_generatedIds some_currentTx some_localState some_currentProc some_visibleCalls some_txStatus.\n state_wellFormed\n \\calls = calls S'a, happensBefore = happensBefore S'a, callOrigin = callOrigin S'a,\n txOrigin = txOrigin S', knownIds = knownIds S'a, invocOp = invocOp S'a,\n invocRes = invocRes S'a, prog = progr, txStatus = some_txStatus,\n generatedIds = some_generatedIds, localState = some_localState, currentProc = some_currentProc,\n visibleCalls = some_visibleCalls, currentTx = some_currentTx\\\"\n apply (simp add: S'a_def `prog S1 = progr`[symmetric])\n by (metis (full_types) c6 old.unit.exhaust state.surjective)\n\n have smg: \"state_monotonicGrowth i\n \\calls = calls S1, happensBefore = happensBefore S1, callOrigin = callOrigin S1,\n txOrigin = txOrigin S1, knownIds = knownIds S1, invocOp = invocOp S1,\n invocRes = invocRes S1, prog = prog S1, txStatus = txStatus S1,\n generatedIds = generatedIds S1, localState = localState S1, currentProc = currentProc S1,\n visibleCalls = visibleCalls S1, currentTx = currentTx S1\\\n \\calls = calls S', happensBefore = happensBefore S', callOrigin = callOrigin S',\n txOrigin = txOrigin S', knownIds = knownIds S', invocOp = invocOp S',\n invocRes = invocRes S', prog = prog S', txStatus = txStatus S',\n generatedIds = generatedIds S', localState = localState S', currentProc = currentProc S',\n visibleCalls = visibleCalls S', currentTx = currentTx S'\\\"\n by (fuzzy_rule `state_monotonicGrowth i S1 S'`, auto)\n\n\n\n show \" \\some_generatedIds1 some_currentTx1 some_localState1 some_currentProc1 some_visibleCalls1\n some_txStatus1 some_generatedIds2 some_currentTx2 some_localState2 some_currentProc2\n some_visibleCalls2 some_txStatus2.\n state_monotonicGrowth i\n \\calls = s_calls, happensBefore = s_happensBefore, callOrigin = s_callOrigin,\n txOrigin = s_txOrigin, knownIds = s_knownIds, invocOp = s_invocOp,\n invocRes = s_invocRes, prog = progr, txStatus = some_txStatus1,\n generatedIds = some_generatedIds1, localState = some_localState1, currentProc = some_currentProc1,\n visibleCalls = some_visibleCalls1, currentTx = some_currentTx1\\\n \\calls = calls S'a, happensBefore = happensBefore S'a, callOrigin = callOrigin S'a,\n txOrigin = txOrigin S', knownIds = knownIds S'a, invocOp = invocOp S'a,\n invocRes = invocRes S'a, prog = progr, txStatus = some_txStatus2,\n generatedIds = some_generatedIds2, localState = some_localState2, currentProc = some_currentProc2,\n visibleCalls = some_visibleCalls2, currentTx = some_currentTx2\\\"\n apply (simp add: S'a_def)\n apply (rule exI)+\n apply (fuzzy_rule smg)\n by (auto simp add: Step c6)\n\n\n \n\n show \"\\v\\generatedLocalPrivate.\n uid_is_private' i (calls S'a) (invocOp S'a) (invocRes S'a) (knownIds S'a) v\"\n proof (auto simp add: S'a_def )\n fix v::nat\n assume \"v\\generatedLocalPrivate\"\n with `\\v\\generatedLocalPrivate.\n uid_is_private i S1 v`\n have \"uid_is_private i S1 v\"\n by auto\n hence \"uid_is_private i S' v\"\n using Step.prog_eq assms(1) growth growth_still_hidden by blast\n\n thus \"uid_is_private' i (calls S') (invocOp S') (invocRes S') (knownIds S') v\"\n by (meson uid_is_private'_implies)\n qed\n\n show \"(invocOp S'a)(i := s_invocOp i) = invocOp S'a\"\n apply (auto simp add: S'a_def)\n apply (rule fun_upd_idem)\n using Step.invocOp_eq growth state_monotonicGrowth_invocOp_i by blast\n\n show \"(invocRes S'a)(i := None) = invocRes S'a\"\n apply (auto simp add: S'a_def)\n apply (rule fun_upd_idem)\n by (simp add: c13 state_wellFormed_no_result_when_running wf_S')\n\n\n show \"txOrigin S' tx \\ Some i\"\n if c0: \"firstTx\"\n and c1: \"callOrigin S'a c \\ tx\"\n for c tx\n using `firstTx = (\\c tx. callOrigin S1 c \\ tx \\ txOrigin S1 tx \\ i \\ txStatus S1 tx \\ Committed)`\n c0 c1\n apply (auto simp add: S'a_def )\n by (smt Step.All_implies_not_txStatus_eq Step.state_wellFormed c16 c17 c8 domD domIff growth state_monotonicGrowth_callOrigin state_wellFormed_ls_visibleCalls_callOrigin wellFormed_callOrigin_dom3 wellFormed_currentTx_unique_h(2) wellFormed_state_transaction_consistent(1) wellFormed_visibleCallsSubsetCalls2 wf_S')\n\n\n\n\n qed\n from `firstTx = (\\c tx. callOrigin S1 c \\ tx \\ txOrigin S1 tx \\ i \\ txStatus S1 tx \\ Committed)`\n show \"firstTx = (\\c tx. callOrigin S'a c \\ tx \\ txOrigin S'a tx \\ i \\ txStatus S'a tx \\ Committed)\"\n apply (auto simp add: S'a_def)\n apply (smt Step.state_wellFormed c16 c17 c4 c8 domExists_simp domIff growth state_monotonicGrowth_callOrigin state_wellFormed_ls_visibleCalls_callOrigin transactionConsistent_Committed wellFormed_callOrigin_dom3 wellFormed_visibleCallsSubsetCalls2 wf_S' wf_transactionConsistent_noTx)\n by (metis (mono_tags, lifting) Step.state_wellFormed c5 growth state_monotonicGrowth_callOrigin state_monotonicGrowth_txOrigin state_monotonicGrowth_txStatus2 wf_callOrigin_implies_txStatus_defined)\n\n show \"\\c. i_callOriginI S'a c \\ i \\ c \\ vis''\"\n apply (simp add: S'a_def i_callOriginI_h_def c21 split: option.splits if_splits)\n using c17 c18 chooseSnapshot_def state_wellFormed_ls_visibleCalls_callOrigin wf_S' by fastforce\n\n from `generatedLocal = {x. generatedIds S1 x \\ i}`\n show \"generatedLocal = {x. generatedIds S'a x \\ i}\"\n using growth state_monotonicGrowth_generatedIds_same1 by (simp add: S'a_def, fastforce)\n\n show \"generatedLocalPrivate \\ generatedLocal\"\n using Step.less_eq by blast\n\n show \"uid_is_private i S'a x\"\n if c0: \"x \\ generatedLocalPrivate\"\n for x\n proof -\n from c0 have \"uid_is_private i S1 x\"\n using Step by blast\n\n hence \"uid_is_private i S' x\"\n using Step.prog_eq assms(1) growth growth_still_hidden by blast\n\n show \"uid_is_private i S'a x\"\n unfolding uid_is_private_def\n proof (intro conjI)\n\n show \"new_unique_not_in_other_invocations i S'a x\"\n unfolding new_unique_not_in_other_invocations_def\n proof (intro allI impI)\n fix i' \n assume \"i' \\ i\"\n\n obtain uids where \"x \\ uids\" and \"invocation_cannot_guess_ids uids i' S'\"\n by (meson \\i' \\ i\\ \\uid_is_private i S' x\\ new_unique_not_in_other_invocations_def uid_is_private_def)\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n have \" S1 ~~ (i, ABeginAtomic t vis'', Inv) \\\\<^sub>S S'a\"\n by (simp add: `action = ABeginAtomic t vis''`)\n\n thm step_s_beginAtomic_to_steps\n from `state_monotonicGrowth i S1 S'`\n obtain tr\n where \"S1 ~~ tr \\* S'\"\n and \"\\(i', a)\\set tr. i' \\ i\"\n and \"\\i. (i, ACrash) \\ set tr\" \n by (auto simp add: state_monotonicGrowth_def)\n\n\n have \" S' ~~ (i, ABeginAtomic t vis'') \\ S'a\"\n using c13 c14 c15 c17 c18 c20 by (auto simp add: step.simps S'a_def state_ext)\n\n\n\n\n have \"invocation_cannot_guess_ids uids i' S'a\"\n using \\S' ~~ (i, ABeginAtomic t vis'') \\ S'a\\ \\i' \\ i\\ \\invocation_cannot_guess_ids uids i' S'\\ show_invocation_cannot_guess_ids_step_other by blast\n\n show \"\\uids. x \\ uids \\ invocation_cannot_guess_ids uids i' S'a\"\n using \\invocation_cannot_guess_ids uids i' S'a\\ \\x \\ uids\\ by auto\n\n qed\n\n qed (insert `uid_is_private i S' x`, simp add: S'a_def uid_is_private_def new_unique_not_in_other_invocations_def; fail)+\n\n\n qed\n\n qed (simp add: S'a_def Step; fail)+\n qed\nqed\n\n\n\nlemma execution_s_check_endAtomic:\n assumes \"program_wellFormed progr\"\n and \"s_txOrigin tx = None\"\n and tx_nonempty: \"localCalls \\ []\"\nand inv_cont: \"\n\\\ndistinct localCalls;\n\\c. c\\set localCalls \\ s_callOrigin c = None;\n\\c. c\\set localCalls \\ c \\ vis;\n\\c c'. c\\set localCalls \\ (c,c') \\ s_happensBefore;\n\\c c'. c\\set localCalls \\ (c',c) \\ s_happensBefore;\ninvocation_happensBeforeH\n (i_callOriginI_h (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i))) \n (updateHb s_happensBefore vis localCalls)\n= \n(if firstTx then\ninvocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore\n \\ {i' | i' c'. c' \\ vis \\ i_callOriginI_h s_callOrigin s_txOrigin c' \\ i' \n \\ (\\c''. i_callOriginI_h s_callOrigin s_txOrigin c'' \\ i' \\ c'' \\ vis ) } \\ {i}\nelse\ninvocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore\n- {i} \\ {i'. (i,i') \\ invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore })\n\\\n \\ invariant progr\n \\calls = s_calls, \n happensBefore = updateHb s_happensBefore vis localCalls,\n callOrigin = map_update_all s_callOrigin localCalls tx,\n txOrigin = s_txOrigin(tx \\ i), \n knownIds = s_knownIds,\n invocOp = s_invocOp, \n invocRes = s_invocRes\\\n\\ execution_s_check\n progr \n i\n s_calls \n (updateHb s_happensBefore vis localCalls) \n (map_update_all s_callOrigin localCalls tx) \n (s_txOrigin(tx \\ i))\n s_knownIds \n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n (vis \\ set localCalls)\n []\n None\n False\n (cont ())\n\"\n\n\nshows\"execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n (s_txOrigin(tx \\ i)) \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n (Some tx)\n firstTx\n (endAtomic \\ cont)\n\"\nproof show_proof_rule\n case (Step trace S1 S_end action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (endAtomic \\ cont)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n `currentTx S1 i \\ tx`\n have action_def: \"action = AEndAtomic\"\n and S'a_def: \"S'a = S1\n \\localState := localState S1(i \\ cont ()), currentTx := (currentTx S1)(i := None),\n txStatus := txStatus S1(tx \\ Committed)\\\"\n and S'a_wf: \"state_wellFormed S'a\"\n and Inv_def: \"Inv \\ \n invariant (prog S1)\n (invContextH (callOrigin S1) (txOrigin S1) (txStatus S1(tx \\ Committed)) (happensBefore S1)\n (calls S1) (knownIds S1) (invocOp S1) (invocRes S1))\"\n by (auto simp add: step_s.simps)\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof\n\n have allCommitted1: \n \"txStatus S1 tx' \\ Committed\" if \"tx' \\ tx\" and \"callOrigin S1 c \\ tx'\" for c tx'\n using that\n by (metis (no_types, lifting) Step.All_implies_not_txStatus_eq Step.state_wellFormed not_uncommitted_cases option.exhaust option.sel wf_no_txStatus_origin_for_nothing)\n\n have tx_uncommitted: \"txStatus S1 tx \\ Uncommitted\"\n using Step.currentTx_eq Step.state_wellFormed not_uncommitted_cases wellFormed_currentTx_unique_h(2) by blast\n\n have allCommitted2: \"txStatus S1 t \\ Committed \\ t \\ tx \\ txStatus S1 t \\ None\" for t\n apply (cases \"txStatus S1 t\", auto simp add: tx_uncommitted)\n using Step.All_implies_not_txStatus_eq txStatus.exhaust by force\n\n\n\n have committedCallsH_simp: \"committedCallsH (callOrigin S1) (txStatus S1(tx \\ Committed))\n = dom (calls S1)\"\n using wellFormed_callOrigin_dom[OF `state_wellFormed S1`]\n wf_callOrigin_and_calls[OF `state_wellFormed S1`]\n apply (auto simp add: committedCallsH_def isCommittedH_def exists_cases1 allCommitted2 )\n by (metis (mono_tags, lifting) allCommitted1 allCommitted2 domExists_simp)\n \n have h1: \"s_calls = calls S1\"\n by (simp add: Step)\n\n have h2: \"updateHb s_happensBefore vis localCalls = happensBefore S1 |r dom (calls S1)\"\n apply (simp add: Step)\n apply (subst restrict_relation_noop, auto simp add: Field_def)\n using Step.happensBefore_eq Step.state_wellFormed h1 happensBefore_in_calls_left happensBefore_in_calls_right by fastforce+\n \n\n have h3: \"map_update_all s_callOrigin localCalls tx = callOrigin S1 |` dom (calls S1)\"\n apply (simp add: Step)\n apply (subst restrict_map_noop)\n apply auto\n using Step.callOrigin_eq Step.state_wellFormed h1 wellFormed_callOrigin_dom by fastforce+\n\n\n\n have h4: \"s_txOrigin(tx\\i) =\n txOrigin S1 |` {t. t \\ tx \\ txStatus S1 t \\ Committed}\"\n apply (simp add: Step )\n apply (subst restrict_map_noop)\n apply (auto simp add: `s_txOrigin tx = None` allCommitted2 wf_transaction_status_iff_origin)\n by (metis Step.state_wellFormed Step.txOrigin_eq fun_upd_apply option.distinct(1) option.exhaust wf_transaction_status_iff_origin)\n\n have \"localCalls \\ []\"\n by (simp add: tx_nonempty)\n have \"distinct localCalls\"\n by (simp add: Step.distinct)\n have co_tx_none: \"\\c\\set localCalls. s_callOrigin c = None\"\n using Step.inf_eq2 by blast\n have to_tx_none: \" s_txOrigin tx = None\"\n by (simp add: assms(2))\n have co_not_tx: \"\\c. s_callOrigin c \\ Some tx\"\n using Step.callOrigin_eq Step.case_option co_tx_none map_update_all_Some_same by fastforce\n\n have hb_wf_l:\"\\c c'. (c, c') \\ s_happensBefore \\ \\t. s_callOrigin c \\ t\"\n using FieldI1 FieldI2 Step.state_wellFormed (* TODO Step(20) *) (* TODO Step(3) *) (* TODO Step(4) *) disjoint_iff_not_equal domExists_simp domIff map_update_all_get updateHb_simp2 wellFormed_happensBefore_calls_l wf_callOrigin_and_calls\n by (smt Step.callOrigin_eq Step.happensBefore_eq Step.inf_eq3 Step.state_wellFormed)\n have hb_wf_r: \"\\c c'. (c, c') \\ s_happensBefore \\ \\t. s_callOrigin c' \\ t\"\n by (metis FieldI2 Step.callOrigin_eq Step.happensBefore_eq Step.inf_eq3 Step.state_wellFormed disjoint_iff_not_equal map_update_all_get option.exhaust updateHb_simp2 wellFormed_happensBefore_calls_r wf_callOrigin_and_calls)\n\n have invocation_hb_simp:\n \"invocation_happensBeforeH\n (i_callOriginI_h (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i))) \n (updateHb s_happensBefore vis localCalls)\n= \n(if firstTx then\ninvocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore\n \\ {i' | i' c'. c' \\ vis \\ i_callOriginI_h s_callOrigin s_txOrigin c' \\ i' \n \\ (\\c''. i_callOriginI_h s_callOrigin s_txOrigin c'' \\ i' \\ c'' \\ vis ) } \\ {i}\nelse\ninvocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore\n- {i} \\ {i'. (i,i') \\ invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore })\"\n proof (rule if_cases)\n assume firstTx\n\n\n show \"invocation_happensBeforeH (i_callOriginI_h (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i)))\n (updateHb s_happensBefore vis localCalls) =\n invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore \\\n {i' | i' c'.\n c' \\ vis \\\n i_callOriginI_h s_callOrigin s_txOrigin c' \\ i' \\\n (\\c''. i_callOriginI_h s_callOrigin s_txOrigin c'' \\ i' \\ c'' \\ vis)} \\\n {i}\"\n using `localCalls \\ []` \n `distinct localCalls` co_tx_none to_tx_none co_not_tx hb_wf_l hb_wf_r\n proof (fuzzy_rule(noabs) invocation_happensBeforeH_one_transaction_simp2)\n\n show \"s_txOrigin t \\ Some i\" if \"s_callOrigin c \\ t\" for c t\n proof -\n from `s_callOrigin c \\ t`\n have \"c \\ set localCalls\"\n using co_tx_none by fastforce\n then have \"c \\ set localCalls \\ s_callOrigin c \\ t\"\n using that by blast\n then have f1: \"t \\ tx \\ callOrigin S1 c \\ t\"\n by (simp add: Step.callOrigin_eq map_update_all_get)\n have \"s_callOrigin c \\ Some tx\"\n using co_not_tx by blast\n then have \"t \\ tx\"\n using that by blast\n then have \"s_txOrigin(t \\ i) \\ s_txOrigin\"\n using f1\n by (metis Step.firstTx_def Step.txOrigin_eq \\firstTx\\ allCommitted1 fun_upd_idem_iff fun_upd_other)\n then show \"s_txOrigin t \\ Some i\"\n by (metis (no_types) fun_upd_triv)\n qed\n\n qed auto\n next\n assume \"\\ firstTx\"\n from this obtain old_c old_t \n where \"s_callOrigin old_c \\ old_t\"\n and \"s_txOrigin old_t \\ i\"\n and \"txStatus S1 old_t \\ Committed\"\n using Step.callOrigin_eq Step.firstTx_def Step.txOrigin_eq fun_upd_apply option.sel allCommitted2 map_update_all_Some_other by fastforce\n\n\n show \" invocation_happensBeforeH (i_callOriginI_h (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i)))\n (updateHb s_happensBefore vis localCalls) =\n invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore -\n {i} \\ {i'. (i, i') \\ invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore}\"\n using tx_nonempty `s_txOrigin old_t \\ i` co_tx_none `s_callOrigin old_c \\ old_t`\n hb_wf_l co_not_tx\n proof (fuzzy_rule invocation_happensBeforeH_more_transactions_simp2)\n\n show \"\\c c'. (c, c') \\ s_happensBefore \\ (c, c') \\ s_happensBefore\"\n by simp\n\n show \"Field s_happensBefore \\ set localCalls = {}\"\n by (simp add: Step.inf_eq3)\n\n show \"\\c. i_callOriginI_h s_callOrigin s_txOrigin c \\ i \\ c \\ vis\"\n by (simp add: Step.All_implies_member i_callOriginI_h_update_to2)\n\n show \"\\c c'. \\c' \\ vis; (c, c') \\ s_happensBefore\\ \\ c \\ vis\"\n proof -\n fix c :: callId and c' :: callId\n assume a1: \"c' \\ vis\"\n assume a2: \"(c, c') \\ s_happensBefore\"\n have f3: \"\\c. c \\ Field s_happensBefore \\ (\\ca. ca \\ set localCalls \\ c \\ ca)\"\n using Step.inf_eq3 by auto\n have f4: \"c' \\ Field s_happensBefore\"\n using a2 by (simp add: FieldI2)\n have \"c \\ Field s_happensBefore\"\n using a2 by (simp add: FieldI1)\n then show \"c \\ vis\"\n using f4 f3 a2 a1 \n by (metis Step.happensBefore_eq Step.state_wellFormed Step.visibleCalls_eq Un_iff updateHb_simp2 wf_vis_downwards_closed2)\n qed\n\n\n\n qed\n qed\n\n\n\n \n\n have inv_cont2: \"invariant progr\n \\calls = s_calls, happensBefore = updateHb s_happensBefore vis localCalls,\n callOrigin = map_update_all s_callOrigin localCalls tx, txOrigin = s_txOrigin(tx \\ i),\n knownIds = s_knownIds, invocOp = s_invocOp, invocRes = s_invocRes\\ \\\n execution_s_check progr i s_calls (updateHb s_happensBefore vis localCalls)\n (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i)) s_knownIds s_invocOp s_invocRes\n generatedLocal generatedLocalPrivate (vis \\ set localCalls) [] None False (cont ())\"\n using `distinct localCalls`\n proof (rule inv_cont)\n show h5: \"\\c. c \\ set localCalls \\ s_callOrigin c = None\"\n using co_tx_none by auto\n show h6: \"\\c c'. c \\ set localCalls \\ (c, c') \\ s_happensBefore\"\n using co_tx_none hb_wf_l by fastforce\n show h7: \"\\c c'. c \\ set localCalls \\ (c', c) \\ s_happensBefore\"\n using co_tx_none hb_wf_r by fastforce\n show \"\\c. c \\ set localCalls \\ c \\ vis\"\n using Step.inf_eq by blast\n\n show \"invocation_happensBeforeH (i_callOriginI_h (map_update_all s_callOrigin localCalls tx) (s_txOrigin(tx \\ i)))\n (updateHb s_happensBefore vis localCalls) =\n (if firstTx\n then invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore \\\n {i' | i' c'.\n c' \\ vis \\\n i_callOriginI_h s_callOrigin s_txOrigin c' \\ i' \\\n (\\c''. i_callOriginI_h s_callOrigin s_txOrigin c'' \\ i' \\ c'' \\ vis)} \\\n {i}\n else invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore -\n {i} \\\n {i'. (i, i') \\ invocation_happensBeforeH (i_callOriginI_h s_callOrigin s_txOrigin) s_happensBefore})\"\n by (auto simp add: committedCallsH_simp invocation_hb_simp)\n qed\n\n\n\n show \"Inv\"\n unfolding Inv_def invContextH_def\n proof (fuzzy_rule inv_cont2[THEN conjunct1])\n qed (auto simp add: committedCallsH_simp h1 h2 h3 h4, (auto simp add: Step))\n\n\n show \"traceCorrect_s trace'\"\n using `S'a ~~ (i, trace') \\\\<^sub>S* S_end`\n proof (rule use_execution_s_check)\n show \"\\p t. (AInvoc p, t) \\ set trace'\"\n using Step by auto\n\n show \"currentTx S'a i = None\"\n by (simp add: S'a_def)\n\n show \"state_wellFormed S'a\"\n using S'a_wf by auto\n\n show \"happensBefore S'a = updateHb (happensBefore S'a) (vis\\set localCalls) []\"\n by simp\n\n show \"callOrigin S'a = map_update_all (callOrigin S'a) [] (the None)\"\n by simp\n\n show \" localState S'a i \\ cont ()\"\n by (simp add: S'a_def Step)\n \n show \"currentProc S'a i \\ toImpl\"\n by (simp add: S'a_def Step)\n\n show \"visibleCalls S'a i \\ (vis \\ set localCalls \\ set [])\"\n by (simp add: S'a_def Step)\n\n show \"\\tx'. None \\ Some tx' \\ txStatus S'a tx' \\ Some Uncommitted\"\n by (simp add: S'a_def Step)\n\n show \"sorted_by (happensBefore S'a) []\"\n by (simp add: sorted_by_empty)\n\n show \"execution_s_check (prog S'a) i (calls S'a) (happensBefore S'a) (callOrigin S'a)\n (txOrigin S'a) (knownIds S'a) (invocOp S'a) (invocRes S'a)\n {x. generatedIds S'a x \\ i} generatedLocalPrivate (vis \\ set localCalls) [] None False (cont ())\"\n proof (fuzzy_rule inv_cont2[THEN conjunct2])\n qed (simp add: S'a_def Step)+\n\n obtain c where \"c\\set localCalls\"\n using `localCalls \\ []` by fastforce\n\n\n thm Step(4)\n find_theorems name: Step\n\n\n show \"False = (\\c tx. callOrigin S'a c \\ tx \\ txOrigin S'a tx \\ i \\ txStatus S'a tx \\ Committed)\"\n using \\c \\ set localCalls\\ by (auto simp add: S'a_def intro!: exI[where x=c] exI[where x=tx]\n Step.state_wellFormed Step.currentTx_eq state_wellFormed_current_transaction_origin\n Step.callOrigin_eq map_update_all_Some_same, simp add: Step.callOrigin_eq map_update_all_Some_same) \n\n show \"\\c. i_callOriginI S'a c \\ i \\ c \\ vis \\ set localCalls\"\n apply (auto simp add: S'a_def i_callOriginI_h_def split: option.splits)\n using Step.state_wellFormed Step.visibleCalls_eq state_wellFormed_ls_visibleCalls_callOrigin by fastforce\n\n show \"generatedLocalPrivate \\ {x. generatedIds S'a x \\ i}\"\n using Step by (simp add: S'a_def)\n\n fix x\n assume c0: \"x \\ generatedLocalPrivate\"\n\n from c0\n have \"uid_is_private i S1 x\"\n by (simp add: Step.Ball)\n\n show \"uid_is_private i S'a x\"\n unfolding uid_is_private_def\n proof (intro conjI)\n\n show \" new_unique_not_in_other_invocations i S'a x\"\n using Step.step_s \\uid_is_private i S1 x\\ action_def new_unique_not_in_other_invocations_maintained uid_is_private_def by blast\n\n qed (insert `uid_is_private i S1 x`, auto simp add: S'a_def uid_is_private_def new_unique_not_in_other_invocations_def)\n\n\n\n\n qed (simp add: S'a_def Step; fail)+\n qed\nqed\n\n\n\n\nlemma execution_s_check_pause:\n assumes cont: \"\n\\ \\\n\n\\\n execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n tx\n firstTx\n (cont ())\"\n\n\nshows\"execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n tx\n firstTx\n (pause \\ cont)\n\"\nproof show_proof_rule\n case (Step trace S1 S_end action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (pause \\ cont)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n have \"action = ALocal True\"\n and Inv\n and S'a_def: \"S'a = S1\\localState := localState S1(i \\ cont ())\\\"\n by (auto simp add: step_s.simps)\n\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof\n\n show \"Inv\" using `Inv` .\n\n show \"traceCorrect_s trace'\"\n using `S'a ~~ (i, trace') \\\\<^sub>S* S_end`\n proof (rule use_execution_s_check)\n show \"\\p t. (AInvoc p, t) \\ set trace'\"\n using Step by auto\n\n show \"state_wellFormed S'a\"\n using Step state_wellFormed_combine_s1 by blast\n\n from `case tx of None \\ localCalls = [] | Some tx' \\ set localCalls = {c. callOrigin S1 c \\ tx'}`\n show \"case tx of None \\ localCalls = [] | Some tx' \\ set localCalls = {c. callOrigin S'a c \\ tx'}\"\n by (auto simp add: S'a_def split: option.splits)\n\n show \"sorted_by (happensBefore S'a) localCalls\"\n using Step.sorted_by by (simp add: S'a_def )\n\n\n\n show \" execution_s_check progr i s_calls s_happensBefore s_callOrigin s_txOrigin s_knownIds\n s_invocOp s_invocRes {x. generatedIds S1 x \\ i} generatedLocalPrivate vis localCalls tx firstTx (cont ())\"\n proof (fuzzy_rule cont)\n show \"generatedLocal = {x. generatedIds S1 x \\ i}\"\n using Step.generatedLocal_def by blast\n qed\n\n show \"generatedLocalPrivate \\ {x. generatedIds S1 x \\ i}\"\n using Step.Ball uid_is_private_def by auto\n \n fix x\n assume a0: \"x \\ generatedLocalPrivate\"\n hence \"uid_is_private i S1 x\"\n by (simp add: Step.Ball)\n\n show \"uid_is_private i S'a x\"\n unfolding uid_is_private_def\n proof (intro conjI)\n show \"new_unique_not_in_other_invocations i S'a x\"\n using Step.step_s \\action = ALocal True\\ \\uid_is_private i S1 x\\ new_unique_not_in_other_invocations_maintained uid_is_private_def by blast\n qed (insert `uid_is_private i S1 x`, auto simp add:S'a_def uid_is_private_def new_unique_not_in_other_invocations_def)\n\n\n qed (simp add: S'a_def Step; fail)+\n qed\nqed\n\n\nlemma updateHb_restrict:\n \" updateHb hb vis cs |r S =\n updateHb (hb |r S) (vis \\ S) (filter (\\x. x \\ S) cs)\"\n by (induct cs arbitrary: vis hb,\n auto simp add: restrict_relation_def updateHb.simps,\n (metis (no_types, lifting) Int_iff Un_iff mem_Sigma_iff singletonD updateHb_cases)+)\n\n\n\nlemma execution_s_check_dbop:\n assumes progr_wf: \"program_wellFormed progr\"\n (* might add this to ensure progress: \n and query_res_exists: \"True\"*)\nand cont: \"\\c res. \\\nquerySpec progr op \\\n calls = s_calls |` (vis \\ set localCalls), \n happensBefore=updateHb (s_happensBefore |r vis) vis localCalls\\ res\n\\ \\\n\n\\\n\\ \\ \n execution_s_check\n progr \n i\n (s_calls(c \\ Call op res))\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n (generatedLocalPrivate - uniqueIds op - uniqueIds res)\n vis\n (localCalls @ [c])\n (Some tx)\n firstTx\n (cont res)\"\n\n\nshows\"execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPrivate\n vis\n localCalls\n (Some tx)\n firstTx\n (call op \\ cont)\n\"\nproof show_proof_rule\n case (Step trace S1 S_end action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (call op \\ cont)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n ` currentTx S1 i \\ tx`\n`visibleCalls S1 i \\ (vis \\ set localCalls)`\n obtain c res\n where c0: \"localState S1 i \\ (call op \\ cont)\"\n and c1: \"currentProc S1 i \\ toImpl\"\n and c2: \"currentTx S1 i \\ tx\"\n and c3: \"visibleCalls S1 i \\ (vis \\ set localCalls)\"\n and c4: \"action = ADbOp c op res\"\n and c5: \"Inv\"\n and S'a_def: \"S'a = S1 \\localState := localState S1(i \\ cont res), calls := calls S1(c \\ Call op res), callOrigin := callOrigin S1(c \\ tx), visibleCalls := visibleCalls S1(i \\ insert c (vis \\ set localCalls)), happensBefore := happensBefore S1 \\ (vis \\ set localCalls) \\ {c}\\\"\n and fresh_c: \"calls S1 c = None\"\n and qry: \"querySpec (prog S1) op (getContextH (calls S1) (happensBefore S1) (Some (vis \\ set localCalls))) res\"\n by (auto simp add: step_s.simps)\n\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof\n\n show \"Inv\" using `Inv` .\n\n show \"traceCorrect_s trace'\"\n using `S'a ~~ (i, trace') \\\\<^sub>S* S_end`\n proof (rule use_execution_s_check)\n show \"\\p t. (AInvoc p, t) \\ set trace'\"\n using Step by auto\n\n show \"state_wellFormed S'a\"\n using Step state_wellFormed_combine_s1 by blast\n\n show \"calls S'a = s_calls(c \\ Call op res)\"\n by (simp add: S'a_def Step)\n\n show \"happensBefore S'a = updateHb s_happensBefore vis (localCalls@[c])\"\n by (auto simp add: S'a_def Step\n updateHb_chain[symmetric, where vis'=\"set localCalls \\ vis\"]\n updateHb_single)\n\n have s: \"map_of (map (\\c. (c, tx)) localCalls) c = Some t\n \\ (c\\set localCalls \\ t = tx) \" for c t\n by (auto simp add: map_of_Some comp_def Step)\n\n\n show \"callOrigin S'a = map_update_all s_callOrigin (localCalls@[c]) (the (Some tx))\"\n by (auto simp add: map_update_all_get S'a_def Step map_add_def intro!: ext dest!: map_of_SomeD split: option.splits)\n\n show \"case Some tx of None \\ localCalls @ [c] = []\n | Some tx' \\ set (localCalls @ [c]) = {c. callOrigin S'a c \\ tx'}\"\n using Step.case_option Step.callOrigin_eq by (auto simp add: s S'a_def Step map_add_def map_of_None split: option.splits del: )\n\n\n have \"c \\ set localCalls\"\n using Step.state_wellFormed c3 fresh_c wellFormed_visibleCallsSubsetCalls2 by auto\n\n have \"c \\ vis\"\n by (meson Step.state_wellFormed UnCI c3 fresh_c wellFormed_visibleCallsSubsetCalls2)\n\n\n have \"callOrigin S1 c = None\"\n using wellFormed_callOrigin_dom[OF `state_wellFormed S1`] fresh_c by blast\n\n hence \"s_callOrigin c = None\"\n using `callOrigin S1 = map_update_all s_callOrigin localCalls (the (Some tx))`\n by (auto simp add: map_update_all_get split: if_splits)\n\n\n show \"sorted_by (happensBefore S'a) (localCalls @ [c])\"\n proof (auto simp add: sorted_by_append_iff sorted_by_single)\n from `sorted_by (happensBefore S1) localCalls`\n show \"sorted_by (happensBefore S'a) localCalls\"\n using \\c \\ set localCalls\\ by (auto simp add: S'a_def sorted_by_def)\n\n thm Step(18)\n\n show \"\\x. \\x \\ set localCalls; (c, x) \\ happensBefore S'a\\ \\ False\"\n apply (auto simp add: S'a_def Step)\n using Step.state_wellFormed Step.happensBefore_eq fresh_c wellFormed_happensBefore_calls_l apply blast\n using \\c \\ vis\\ apply blast \n using \\c \\ set localCalls\\ by auto\n qed\n\n from `vis \\ set (localCalls) = {}`\n show \"vis \\ set (localCalls @ [c]) = {}\"\n by (auto simp add: `c \\ vis`)\n\n\n show \"dom s_callOrigin \\ set (localCalls @ [c]) = {}\"\n apply (auto simp add: `s_callOrigin c = None`)\n using Step.inf_eq2 by blast \n\n have \"c \\ Field s_happensBefore\"\n by (metis Field_Un Step.happensBefore_eq Step.state_wellFormed UnI1 fresh_c updateHb_simp_split wellFormed_happensBefore_Field)\n\n from this and `Field s_happensBefore \\ set localCalls = {}`\n show \"Field s_happensBefore \\ set (localCalls @ [c]) = {}\"\n by auto\n\n from `distinct localCalls` and `c\\set localCalls`\n show \"distinct (localCalls @ [c])\"\n by auto\n\n show \" execution_s_check progr i (s_calls(c \\ Call op res)) s_happensBefore s_callOrigin\n s_txOrigin s_knownIds s_invocOp s_invocRes {x. generatedIds S1 x \\ i} (generatedLocalPrivate - uniqueIds op - uniqueIds res) vis\n (localCalls @ [c]) (Some tx) firstTx (cont res)\"\n proof (fuzzy_rule cont)\n show \"querySpec progr op\n \\calls = s_calls |` (vis \\ set localCalls),\n happensBefore = updateHb (s_happensBefore |r vis) vis localCalls\\\n res\"\n proof (fuzzy_rule qry; auto simp add: Step getContextH_def del: equalityI)\n have [simp]: \"s_happensBefore |r (vis \\ set localCalls) = (s_happensBefore |r vis)\"\n using `Field s_happensBefore \\ set localCalls = {}`\n by (auto simp add: restrict_relation_def Field_def)\n\n\n show \" updateHb s_happensBefore vis localCalls |r (vis \\ set localCalls) =\n updateHb (s_happensBefore |r vis) vis localCalls\"\n by (auto simp add: updateHb_restrict)\n qed\n\n from `generatedLocal = {x. generatedIds S1 x \\ i}`\n show \"generatedLocal = {x. generatedIds S1 x \\ i}\" .\n qed\n\n from `firstTx = (\\c tx. callOrigin S1 c \\ tx \\ txOrigin S1 tx \\ i \\ txStatus S1 tx \\ Committed)`\n show \"firstTx = (\\c tx. callOrigin S'a c \\ tx \\ txOrigin S'a tx \\ i \\ txStatus S'a tx \\ Committed)\"\n apply auto\n apply (auto simp add: S'a_def split: if_splits)\n using c2 not_uncommitted_cases wellFormed_currentTx_unique_h(2) \n apply (simp add: wellFormed_currentTx_unique_h(2) Step.state_wellFormed)\n using \\callOrigin S1 c = None\\ by force\n\n show \"generatedLocalPrivate - uniqueIds op - uniqueIds res \\ {x. generatedIds S1 x \\ i}\"\n using Step.Ball uid_is_private_def by auto\n\n \n fix x\n assume a0: \"x \\ generatedLocalPrivate - uniqueIds op - uniqueIds res\"\n hence \"uid_is_private i S1 x\"\n using Step.Ball by auto\n\n\n show \"uid_is_private i S'a x\"\n unfolding uid_is_private_def\n proof (intro conjI)\n\n show \"new_unique_not_in_other_invocations i S'a x\"\n using Step.step_s \\uid_is_private i S1 x\\ c4 new_unique_not_in_other_invocations_maintained uid_is_private_def by blast\n\n\n qed (insert a0 `uid_is_private i S1 x`, auto simp add: S'a_def uid_is_private_def new_unique_not_in_calls_def new_unique_not_in_calls_result_def new_unique_not_in_other_invocations_def)\n\n\n \n\n qed (simp add: S'a_def Step; fail)+\n qed\nqed\n\n\n\n\nlemma execution_s_check_return:\n assumes progr_wf: \"program_wellFormed progr\"\n and query_res_exists: \"True\"\nand inv: \"invariant progr\n \\\n calls = s_calls, \n happensBefore = s_happensBefore , \n callOrigin = s_callOrigin,\n txOrigin = s_txOrigin,\n knownIds = s_knownIds \\ uniqueIds res,\n invocOp = s_invocOp,\n invocRes = s_invocRes(i \\ res)\n \\\"\nshows\"execution_s_check\n progr \n i\n s_calls\n s_happensBefore \n s_callOrigin\n s_txOrigin \n s_knownIds\n s_invocOp\n s_invocRes\n generatedLocal\n generatedLocalPriate\n vis\n []\n None\n firstTx\n (return res)\n\"\nproof show_proof_rule\n case (Step trace S1 S_end action S'a Inv trace')\n\n\n from ` S1 ~~ (i, action, Inv) \\\\<^sub>S S'a`\n `localState S1 i \\ (return res)`\n `currentProc S1 i \\ toImpl`\n `\\proc. action \\ AInvoc proc`\n have c2: \"action = AReturn res\"\n and c3: \"currentTx S1 i = None\"\n and S'a_def: \"S'a = S1 \\localState := (localState S1)(i := None), currentProc := (currentProc S1)(i := None), visibleCalls := (visibleCalls S1)(i := None), invocRes := invocRes S1(i \\ res), knownIds := knownIds S1 \\ uniqueIds res\\\"\n and Inv_def: \"Inv \\ invariant (prog S1) (invContextH (callOrigin S1) (txOrigin S1) (txStatus S1) (happensBefore S1) (calls S1) (knownIds S1 \\ uniqueIds res) (invocOp S1) (invocRes S1(i \\ res)))\"\n by (auto simp add: step_s.simps)\n\n show \"Inv \\ traceCorrect_s trace'\"\n proof\n\n from `\\tx'. None \\ Some tx' \\ txStatus S1 tx' \\ Some Uncommitted`\n have txStatus1: \"txStatus S1 tx' \\ Some Uncommitted\" for tx'\n by auto\n\n have txStatus2: \"txStatus S1 tx \\ y\n \\ (txStatus S1 tx \\ Committed \\ y = Committed)\" for tx y\n apply auto\n using txStatus.exhaust txStatus1 by auto\n\n\n\n from `\\tx'. None \\ Some tx' \\ txStatus S1 tx' \\ Some Uncommitted`\n have txStatus3: \"txStatus S1 tx \\ Committed\n \\txStatus S1 tx \\ None\" for tx\n using txStatus.exhaust by (auto, blast)\n\n\n have commmitted: \"committedTransactions S1 = dom s_txOrigin\"\n apply (auto simp add: `txOrigin S1 = s_txOrigin`[symmetric] txStatus1)\n apply (simp add: Step.state_wellFormed txStatus3 wf_transaction_status_iff_origin)\n by (simp add: Step.state_wellFormed state_wellFormed_txStatus_txOrigin txStatus3)\n\n have committed2: \"committedCalls S1 = dom (calls S1)\"\n using Step.state_wellFormed committedCalls_allCommitted txStatus1 by blast \n\n hence committed3: \"committedCallsH s_callOrigin (txStatus S1) = dom s_calls\"\n by (simp add: Step)\n\n\n show \"Inv\" \n unfolding Inv_def invContextH_def\n proof (fuzzy_rule inv; (simp add: Step commmitted committed3))\n\n show \"s_callOrigin = s_callOrigin |` dom s_calls\"\n proof (rule restrict_map_noop[symmetric])\n show \"dom s_callOrigin \\ dom s_calls\"\n using Step.state_wellFormed Step.callOrigin_eq Step.calls_eq wellFormed_callOrigin_dom by fastforce\n qed\n\n show \"s_happensBefore = s_happensBefore |r dom s_calls\"\n proof (rule restrict_relation_noop[symmetric])\n show \"Field s_happensBefore \\ dom s_calls\"\n apply (auto simp add: Field_def)\n using Step.state_wellFormed Step.calls_eq Step.happensBefore_eq happensBefore_in_calls_left happensBefore_in_calls_right by fastforce+\n qed\n qed\n\n\n show \"traceCorrect_s trace'\"\n proof (cases trace')\n case Nil\n then show ?thesis\n using traceCorrect_s_empty by auto \n next\n case (Cons a list)\n\n obtain action' Inv' where a_def: \"a = (action', Inv')\"\n by force\n\n have no_invoc: \"\\proc. action' \\ AInvoc proc\"\n using `trace = (action, Inv) # trace'` `\\p t. (AInvoc p, t) \\ set trace` a_def local.Cons by auto\n\n\n\n from Cons `S'a ~~ (i, trace') \\\\<^sub>S* S_end`\n obtain S'' where \"S'a ~~ (i, (action', Inv')) \\\\<^sub>S S''\"\n using steps_s_cons_simp a_def by blast \n hence False\n using S'a_def no_invoc\n by (auto simp add: step_s.simps)\n thus \"traceCorrect_s trace'\" ..\n qed\n qed\nqed\n\nlemmas execution_s_check_endAtomic' = execution_s_check_endAtomic[rotated 3, OF context_conjI]\n \n\nlemmas repliss_proof_rules = \n execution_s_check_newId\n execution_s_check_beginAtomic\n execution_s_check_endAtomic'\n execution_s_check_pause\n execution_s_check_dbop\n execution_s_check_return\n\nmethod repliss_vcg_step = (rule repliss_proof_rules; (intro impI conjI)?; simp?; (intro impI conjI)?; repliss_vcg_step?)\n\nmethod repliss_vcg uses impl = ((simp add: impl)?, (unfold atomic_def skip_def)?, simp? , repliss_vcg_step)\n\n\ndeclare newId_def[language_construct_defs] \natomic_def[language_construct_defs] \nbeginAtomic_def [language_construct_defs] \ncall_def [language_construct_defs] \nskip_def [language_construct_defs] \nendAtomic_def [language_construct_defs] \nreturn_def[language_construct_defs] \n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/program_proof_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2782495874508384}} {"text": "theory regShiftFifo imports paraGste1\nbegin\nabbreviation rst::\"expType\" where\n\"rst \\ IVar (Ident ''rst'')\"\n\nabbreviation push::\"expType\" where\n\"push \\ IVar (Ident ''push'')\"\n\nabbreviation pop::\"expType\" where\n\"pop \\ IVar (Ident ''pop'')\"\n\nabbreviation dataIn::\"expType\" where\n\"dataIn \\ IVar (Ident ''dataIn'' )\"\n\n\n\nabbreviation LOW::\"expType\" where\n\"LOW \\ Const (boolV False)\"\nabbreviation HIGH::\"expType\" where\n\" HIGH \\ Const (boolV True)\"\n\nabbreviation emptyFifo::\"expType\" where\n\" emptyFifo \\ IVar (Ident ''empty'' ) \"\n\nabbreviation tail::\"expType\" where\n\" tail \\ IVar (Ident ''tail'' ) \"\n\nabbreviation head::\"expType\" where\n\" head \\ IVar (Ident ''head'' ) \"\n\n\nabbreviation full::\"expType\" where\n\" full \\ IVar (Ident ''full'' ) \"\n\ndefinition fullForm::\"nat\\formula\" where [simp]:\n\" fullForm DEPTH\\ eqn tail (Const (index DEPTH)) \"\n\nabbreviation mem::\"nat \\ expType\" where\n\"mem i \\ IVar (Para (Ident ''mem'') i)\"\n\ntype_synonym paraExpType=\"nat \\expType\"\n\n \n\nabbreviation dataOut::\"nat\\expType\" where\n\"dataOut DEPTH \\ read (Ident ''mem'') DEPTH (IVar (Ident ''tail'' ))\"\n\n\nabbreviation rstForm::\"formula\" where\n\"rstForm \\ (eqn rst HIGH)\"\n\nabbreviation emptyForm::\"formula\" where\n\"emptyForm \\ (eqn emptyFifo HIGH)\"\n \nabbreviation pushForm::\"formula\" where\n\"pushForm \\ andForm (andForm (eqn rst LOW) (eqn push HIGH)) (eqn pop LOW)\"\n\nabbreviation popForm::\"formula\" where\n\"popForm \\ andForm (andForm (eqn rst LOW) (eqn push LOW)) (eqn pop HIGH)\"\n\nabbreviation nPushPopForm::\"formula\" where\n\"nPushPopForm \\ andForm (andForm (eqn rst LOW) (eqn push LOW)) (eqn pop LOW)\"\n\nabbreviation pushDataForm::\"nat \\formula\" where\n\" pushDataForm D \\andForm pushForm (eqn dataIn (Const (index D)))\"\n\nabbreviation popDataForm::\"nat\\nat \\formula\" where\n\" popDataForm DEPTH D \\ (eqn (dataOut DEPTH) (Const (index D)))\"\n \nabbreviation nFullForm::\"nat \\formula\" where\n\"nFullForm DEPTH\\ neg (fullForm DEPTH)\"\n\nabbreviation nEmptyForm::\"formula\" where\n\"nEmptyForm \\ neg emptyForm \"\n\n\n\ndefinition vertexI::\"node\" where [simp]:\n\"vertexI \\Vertex 0\"\n\n(*DEPTH=LAST + 1*)\ndefinition vertexL::\"nat \\ node list\" where [simp]:\n\"vertexL LAST \\ vertexI # (map (%i. Vertex i) (down LAST))\"\n\ndefinition edgeL::\"nat \\ edge list\" where [simp]:\n \"edgeL LAST \\ [Edge vertexI ( Vertex 1)]\n @ [Edge ( Vertex 1) ( Vertex 3)]\t\t\n @ [Edge ( Vertex 1) ( Vertex 4)]\t\n \n\t\t@(map (%i. ( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) (upt 0 (LAST+2) )) (* self-loop*) \n\t @(map (%i. ( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) (upt 1 (LAST+2) )) (* self-loop*) \n\t \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) ( upt 1 (LAST+1)))\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) ( upt 1 (LAST+1)))\n\t\t\n\t\t@(map (%i. ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) ( upt 0 (LAST+1) )) \n\t\t@(map (%i. ( Edge (Vertex (2 * i + 4)) (Vertex (2 * i + 2))) ) ( upt 1 (LAST+1) ))\n\t\t@[Edge ( Vertex 4) ( Vertex 1)]\n\t \"\n\n\nprimrec node2Nat::\"node \\ nat\" where\n\"node2Nat (Vertex n) = n\"\n\n\ndefinition antOfRbFifo::\"nat\\edge\\formula\" where [simp]:\n\"antOfRbFifo D edge\\\n (let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if (from = 0) then rstForm\telse\n if (from=to) then nPushPopForm else\n (if ((from mod 2) =1) then\n (\n if ((from + 2)=to) then ( pushForm ) else\n if (from=(to + 2)) then popForm else\n pushDataForm D ) \n else popForm))\"\n\n\n\ndefinition consOfRbFifo::\"nat\\nat\\edge \\formula\" where [simp]:\n\"consOfRbFifo D LAST edge \\\n(let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if \t(((from mod 2) = 1) \\ ((to mod 2) = 1)) then\n (if from =1 then (andForm emptyForm (nFullForm LAST))\n else if (from = (2*LAST+3)) then (andForm nEmptyForm (fullForm LAST)) \n else andForm nEmptyForm (nFullForm LAST))\n else if (from=4 \\ to = 1) then popDataForm LAST D\n else if (from = (2*LAST+4)) then (andForm nEmptyForm (fullForm LAST)) \n else if (from =1 ) then (andForm emptyForm (nFullForm LAST))\n else if (from \\0) then (andForm nEmptyForm (nFullForm LAST))\n else chaos)\"\n\ndefinition rbFifoGsteSpec::\" nat\\nat\\gsteSpec\" where [simp]:\n\"rbFifoGsteSpec LAST data\\Graph vertexI (edgeL LAST ) (antOfRbFifo data ) (consOfRbFifo data LAST)\"\n\nprimrec applyPlusN::\"expType\\nat \\expType\" where\n\"applyPlusN e 0=e\" |\n\"applyPlusN e (Suc N) = uif ''+'' [applyPlusN e N, Const (index 1)]\"\n\ndefinition tagFunOfRegShiftFifo:: \" nat\\nodeTagFuncList\" where [simp]:\n\"tagFunOfRegShiftFifo DATA n \\ \n (let x=node2Nat n in\n let DataE=(Const (index DATA)) in\n if (x = 0) then [] else\n (if ((x mod 2) = 1) then \n (if (x =1) then \n [eqn tail (Const (index 0)), eqn emptyFifo (Const (boolV True))]\n else [eqn tail (Const (index (x div 2 - 1 ))), eqn emptyFifo (Const (boolV False))] )\n else \n (if (x = 2) then [] else\n [eqn tail (Const (index (x div 2 - 2 ))), eqn emptyFifo (Const (boolV False)), \n eqn (IVar (Para (Ident ''mem'') 0)) DataE ]) )\n )\n \n \"\n \n definition branch1::\"generalizeStatement\" where (*[simp]:*)\n\"branch1 \\ \n (let S1=assign (Ident ''tail'',(Const (index 0))) in\n let S2=assign (Ident ''empty'',HIGH) in\n Parallel [S1,S2])\"\n (*map (\\i. assign ((Para (Ident ''mem'') i), \n iteForm (eqn (Const (index i)) (Const (index 0))) dataIn \n (read (Ident ''mem'') LAST (uif ''-'' [(Const (index i)), (Const (index 1))])))) (upt 1 (LAST +1) )*) \n\ndefinition branch2::\"nat\\generalizeStatement\" where \n\"branch2 LAST \\ \n (let S1=\n map (\\i. assign ((Para (Ident ''mem'') i), (IVar (Para (Ident ''mem'') i)))) (upt 1 (LAST +1)) in\n let S4=assign ((Para (Ident ''mem'') 0), dataIn) in\n let tailPlus=uif ''+'' [tail, (Const (index 1))] in\n let S2=assign (Ident ''tail'',iteForm (neg (eqn emptyFifo HIGH)) tailPlus tail) in\n let S3=assign (Ident ''empty'',LOW) in\n Parallel ([S4,S2,S3]@S1))\" \n \ndefinition branch3::\"generalizeStatement\" where \n\"branch3 \\ \n (let S1=Parallel [assign (Ident ''empty'',HIGH)] in\n let S2=Parallel [ assign (Ident ''tail'', uif ''-'' [tail, (Const (index 1))])] in\n If (eqn tail (Const (index 0))) S1 S2)\" \n\ndefinition tagFunOfRbfifio:: \"nat \\ nat\\nodeTagFuncList\" where [simp]:\n\" tagFunOfRbfifio depth DATA n \\ \n (let x=node2Nat n in\n let DataE=(Const (index DATA)) in\n if (x = 0) then [] else\n (if ((x mod 2) = 1) then \n (if (x=1) then \n [eqn tail (Const (index 0)), eqn emptyFifo (Const (boolV True))]\n else [eqn tail (applyPlusN head (x div 2 )), eqn emptyFifo (Const (boolV False))] )\n else \n (if (x = (2)) then [] else\n [eqn tail (applyPlusN head ((x div 2) - 1)), eqn ( read (Ident ''mem'') depth tail) DataE ]) ))\n \"\nabbreviation shiftRegfifo::\" nat\\generalizeStatement\" where\n\"shiftRegfifo LAST\\ \n caseStatement \n [(eqn rst HIGH, branch1),\n (andForm (eqn push HIGH) (neg (eqn tail (Const (index LAST)))), branch2 LAST),\n (andForm (eqn pop HIGH) (eqn emptyFifo LOW), branch3)] \n \"\n \nconsts J::\" interpretFunType\" \n \naxiomatization where axiomOnIAdd [simp,intro]:\n\" J ''+'' [index m, index (Suc 0)] = index (m + 1)\" \n\naxiomatization where axiomOnISub [simp,intro ]: \" J ''-'' [index m, index 1] = index (m - 1)\" \n\n\nlemma consistencyOfRbfifo:\n assumes a:\"0 < LAST \"\n shows \"consistent' (shiftRegfifo LAST ) (J ) (rbFifoGsteSpec LAST data) (tagFunOfRegShiftFifo data)\"\n proof(unfold consistent'_def,rule allI,rule impI)\n fix e\n let ?G=\" (rbFifoGsteSpec LAST data)\"\n let ?M=\"( shiftRegfifo LAST )\"\n let ?tag=\"(tagFunOfRegShiftFifo data)\"\n let ?P =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f ( ?M))) (J ))\"\n assume a1:\"e \\ edgesOf (rbFifoGsteSpec LAST data)\"\n \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex 1) ( Vertex 3) |\n e=Edge ( Vertex 1) ( Vertex 4)|\n (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) |\n (\\i. 1\\i \\ i\\ LAST +1\\ e=( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) |\n \n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) |\n \n (\\i. 0\\i \\ i\\ LAST \\ e= ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex(2 * i + 4)) (Vertex(2 * i+2)))) |\n e=( Edge (Vertex 4) (Vertex 1))\"\n apply(cut_tac a1,auto) done\n \n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac b1, simp add:antOfRbFifo_def branch1_def) done\n }\n moreover\n {assume b1:\" (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 1)) (Vertex ( 2*i + 1))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n }\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 2)) (Vertex ( 2*i + 2))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac b2, simp add:antOfRbFifo_def substNIl) done\n } \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 3) \"\n have \"?P e\"\n apply(cut_tac a b1,auto simp add:branch2_def ) done\n }\n \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 4) \"\n let ?f=\"andForm (neg (eqn rst HIGH)) (andForm (eqn push HIGH) (neg (eqn tail (Const (index LAST )))) ) \"\n \n have \"?P e \"\n apply(cut_tac a b1 ,auto simp add:simp add:branch2_def) done\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i + 3))\" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have b2:\"i - 1 < LAST\" by(cut_tac a b1,auto)\n have \"?P e \"\n apply(cut_tac a b1 b2 ,auto simp add: antOfRbFifo_def branch2_def assms ) done\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i+4)) \"(is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have b2:\"i - 1 < LAST\" by(cut_tac a b1,auto)\n have \"?P e \"\n by(cut_tac a b1 b2 ,auto simp add: antOfRbFifo_def branch2_def assms)\n } \n \n moreover\n {assume b1:\"\\i. 0\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 3)) ( Vertex (2*i + 1)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n using axiomOnISub by(cut_tac a b1 ,auto simp add: antOfRbFifo_def branch3_def assms )\n }\n \n moreover\n {assume b1:\"\\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 4)) ( Vertex (2*i +2)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n \n have \"?P e \"\n using axiomOnISub apply(cut_tac a b1 ,auto simp add: antOfRbFifo_def branch3_def assms )\n done\n }\n moreover\n {assume b1:\"e=Edge (Vertex 4) ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1,auto simp add:antOfRbFifo_def Let_def branch3_def) done\n }\n ultimately show \"?P e\" by satx\n qed \n\nlemma testAux[simp]:\n \nshows \"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)@S))) s \n=expEval I (mem i) s) \\\n(expEval I e s =index i \\\n LAST < i\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)@S))) s \n=expEval I (caseExp S) s)\" (is \"?P LAST\")\nproof(induct_tac LAST,auto )qed \n\nlemma testAux1[simp]:\nshows \"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)))) s \n=expEval I (mem i) s)\"\nproof -\nhave a:\"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)@[]))) s \n=expEval I (mem i) s)\"\napply(cut_tac testAux [where S=\"[]\"],blast)done\nthen show ?thesis by auto\nqed\n\nlemma test[simp]:assumes a1: \"expEval I e s = (index i)\" and \n a2:\"i \\ LAST\"\n shows \"expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)))) s =\n expEval I (mem i) s\"\nproof -\nhave a:\"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)))) s \n=expEval I (mem i) s)\"\nby simp\n\nwith a1 a2 show ?thesis by blast\nqed\n\n(*lemma test'[simp]:assumes a1: \"eqn e (Const (index i))\" and \n a2:\"i \\ LAST\"\n shows \"eqn (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)))) \n (mem i) \"\nproof -\nhave a:\"(expEval I e s =index i \\\ni \\ LAST\\expEval I (caseExp ((map (\\i. (eqn e (Const (index i)), mem i)) (down LAST)))) s \n=expEval I (mem i) s)\"\nby simp\n\nwith a1 a2 show ?thesis by blast\nqed *)\n\nlemma instImply:\nassumes a:\"G=(rbFifoGsteSpec LAST data)\" and b:\"0 < LAST \" and c:\"tag=tagFunOfRegShiftFifo data\"\nshows\n\"\\ e. e \\edgesOf G\\ \ntautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) I\" \nproof(rule allI,rule impI,simp,rule allI,rule impI)\n fix e s\n assume a1:\"e \\ edgesOf G \" and a2:\"\n formEval I (antOf G e) s \\ formEval I (andListForm (tag (source e))) s\" \n let ?P =\"\\e. formEval I (consOf G e) s\" \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex 1) ( Vertex 3) |\n e=Edge ( Vertex 1) ( Vertex 4)|\n (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+1 )) (Vertex ( 2*i+1 ))) ) |\n (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex ( 2*i+2 )) (Vertex ( 2*i+2 ))) ) |\n \n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 3))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex (2 * i + 1)) (Vertex (2 * i + 4))) ) |\n \n (\\i. 0\\i \\ i\\ LAST \\ e= ( Edge (Vertex (2 * i + 3)) (Vertex (2 * i + 1))) ) |\n (\\i. 1\\i \\ i\\ LAST \\ e=( Edge (Vertex(2 * i + 4)) (Vertex(2 * i+2)))) |\n e=( Edge (Vertex 4) (Vertex 1))\"\n apply(cut_tac a a1,auto) done\n \n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1, auto simp add:antOfRbFifo_def)\n done\n }\n moreover\n {assume b1:\" (\\i. 0\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 1)) (Vertex ( 2*i + 1))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac a b c a2 b2, auto) done\n }\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ LAST+1 \\ e=( Edge (Vertex (2* i + 2)) (Vertex ( 2*i + 2))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n have \"?P e\"\n apply(cut_tac a b c a2 b2,auto) done\n } \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 3) \"\n \n have \"?P e\"\n apply(cut_tac a b c a2 b1,auto ) done\n }\n \n moreover\n {assume b1:\" e=Edge ( Vertex 1) ( Vertex 4) \"\n have \"?P e \"\n apply(cut_tac a b b1 c a2,auto simp add: antOfRbFifo_def ) done\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i + 3))\" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a b c a2 b1 ,auto simp add: antOfRbFifo_def assms )\n }\n \n moreover\n {assume b1:\" \\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 1)) ( Vertex (2*i+4)) \"(is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a b c a2 b1 ,auto simp add: antOfRbFifo_def assms)\n } \n \n moreover\n {assume b1:\"\\i. 0\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 3)) ( Vertex (2*i + 1)) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a b c a2 b1 ,auto simp add: antOfRbFifo_def assms )\n }\n \n moreover\n {assume b1:\"\\i. 1\\i \\ i\\ LAST \\ e=Edge ( Vertex (2*i + 4)) ( Vertex (2*i+2 )) \" (is \"\\i. ?Q i\")\n from b1 obtain i where b1:\"?Q i\" by blast\n have \"?P e \"\n by(cut_tac a b c a2 b1 ,auto simp add: antOfRbFifo_def Let_def assms)\n \n }\n moreover\n {assume b1:\"e=Edge (Vertex 4) ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b c a2 b1 ,auto) done\n }\n ultimately show \"?P e\" by satx\n qed \n\nlemma main: \nassumes a:\"G=(rbFifoGsteSpec LAST data)\" and b:\"0 < LAST \" \nand c:\"tag=tagFunOfRegShiftFifo data\" and\nd:\"M=(shiftRegfifo LAST )\"\nshows \" circuitSatGsteSpec M G J \" \nproof(rule mainLemma)\nhave a1:\"consistent' (shiftRegfifo LAST ) (J ) (rbFifoGsteSpec LAST data) (tagFunOfRegShiftFifo data)\" \n using b by (rule consistencyOfRbfifo)\nfrom a c d this show \"consistent' M (J ) G tag\"\n by simp \nnext\nfrom a b c show \"\\e. e \\ edgesOf G \\\n tautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) (J )\"\napply(rule instImply) done\nnext\nfrom a c show \"tag (initOf G) = []\"\napply auto done\nqed\nend\n", "meta": {"author": "raphelIos", "repo": "parametricGste", "sha": "91f5c8acc43eee2f070819ce47f6d1a8ca0712f7", "save_path": "github-repos/isabelle/raphelIos-parametricGste", "path": "github-repos/isabelle/raphelIos-parametricGste/parametricGste-91f5c8acc43eee2f070819ce47f6d1a8ca0712f7/regShiftFifo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.2782495874508384}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Close_Subst\n imports Agent\nbegin\n\ncontext substPsi\nbegin\n\ndefinition closeSubst :: \"('b::fs_name \\ ('a::fs_name, 'b, 'c::fs_name) psi \\ ('a, 'b, 'c) psi) set \\ ('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\nwhere \"closeSubst Rel \\ {(\\, P, Q) | \\ P Q. (\\\\. wellFormedSubst \\ \\ (\\, P[<\\>], Q[<\\>]) \\ Rel)}\"\n\nlemma closeSubstI:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\\\. wellFormedSubst \\ \\ (\\, P[<\\>], Q[<\\>]) \\ Rel\"\n\n shows \"(\\, P, Q) \\ closeSubst Rel\"\nusing assms\nby(unfold closeSubst_def) auto\n\nlemma closeSubstE:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n assumes \"(\\, P, Q) \\ closeSubst Rel\"\n and \"wellFormedSubst \\\"\n\n shows \"(\\, P[<\\>], Q[<\\>]) \\ Rel\"\nusing assms\nby(unfold closeSubst_def) auto\n\nlemma closeSubstClosed:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"eqvt Rel\"\n and \"(\\, P, Q) \\ closeSubst Rel\"\n\n shows \"(p \\ \\, p \\ P, p \\ Q) \\ closeSubst Rel\"\nproof(rule closeSubstI)\n fix \\\n assume \"wellFormedSubst(\\::(name list \\ 'a list) list)\"\n with \\(\\, P, Q) \\ closeSubst Rel\\ \\wellFormedSubst \\\\\n have \"(\\, P[<(rev p \\ \\)>], Q[<(rev p \\ \\)>]) \\ Rel\"\n by(rule_tac closeSubstE) auto\n hence \"(p \\ \\, p \\ (P[<(rev p \\ \\)>]), p \\ (Q[<(rev p \\ \\)>])) \\ Rel\"\n by(drule_tac p=p in eqvtI[OF \\eqvt Rel\\]) (simp add: eqvts)\n thus \"(p \\ \\, (p \\ P)[<\\>], (p \\ Q)[<\\>]) \\ Rel\"\n by(simp del: seqSubs_def add: eqvts)\nqed\n\nlemma closeSubstEqvt:\n assumes \"eqvt Rel\"\n\n shows \"eqvt(closeSubst Rel)\"\nproof(auto simp add: eqvt_def)\n fix \\ P Q p\n assume \"(\\, P, Q) \\ closeSubst Rel\"\n thus \"((p::name prm) \\ \\, p \\ P, p \\ Q) \\ closeSubst Rel\"\n by(drule_tac p=p in closeSubstClosed[OF \\eqvt Rel\\]) (simp add: eqvts)\nqed\n\nlemma closeSubstUnfold:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n assumes \"(\\, P, Q) \\ closeSubst Rel\"\n and \"wellFormedSubst \\\"\n\n shows \"(\\, P[<\\>], Q[<\\>]) \\ closeSubst Rel\"\nproof(rule closeSubstI)\n fix \\'::\"(name list \\ 'a list) list\"\n assume \"wellFormedSubst \\'\"\n with \\wellFormedSubst \\\\ have \"wellFormedSubst(\\@\\')\" by simp\n with \\(\\, P, Q) \\ closeSubst Rel\\ have \"(\\, P[<(\\@\\')>], Q[<(\\@\\')>]) \\ Rel\"\n by(rule closeSubstE)\n thus \"(\\, P[<\\>][<\\'>], Q[<\\>][<\\'>]) \\ Rel\"\n by simp\nqed\n\nend\n\nend\n \n\n \n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Close_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.27824958031685837}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CustomWordAbs\nimports \"../../AutoCorres\"\nbegin\n\ninstall_C_file \"custom_word_abs.c\"\n\nlemma [word_abs]:\n \"\\ abstract_val P x sint x'; abstract_val Q y sint y' \\ \\\n abstract_val (P \\ Q) (max x y)\n sint (x' xor (x' xor y') && - (if x' abstract_val P x unat x'; abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q \\ y < 32) (x mod (2 ^ y)) unat (x' && 2 ^ unat y' - (1 :: word32))\"\n apply (clarsimp simp del: shiftl_1 simp: shiftl_1 [symmetric])\n apply (fold mask_def)\n apply (subst word_mod_2p_is_mask [symmetric])\n apply (subst p2_gt_0)\n by (auto simp: unat_mod)\n\nlemma [word_abs]:\n \"\\ abstract_val P x unat (x' :: word32);\n abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q) (x + y > UINT_MAX) id (x' + y' < x')\"\n apply (subst not_le [symmetric], subst no_plus_overflow_unat_size)\n apply (clarsimp simp: not_less UINT_MAX_def word_size)\n apply arith\n done\n\nautocorres [unsigned_word_abs = b c] \"custom_word_abs.c\"\n\ncontext custom_word_abs begin\n\nlemma \"a' x y = max x y\"\n by (unfold a'_def, rule refl)\n\nlemma \"b' x 4 s = Some (x mod 16)\"\n by (unfold b'_def, simp)\n\nlemma \"c' x y = (if UINT_MAX < x + y then 1 else 0)\"\n by (unfold c'_def, simp)\n\nend\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/autocorres/tests/proof-tests/CustomWordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.629774621301746, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2781544498816435}} {"text": "theory Memory\nimports Main \"~~/src/HOL/Library/AList\" \n \"../Syntax/Type\" Int_Value \"../Syntax/Wf_Checker\"\nbegin\n\n\n\n\n\nsubsection \\Lens for Valuations\\\n definition \"l_ffld e name \\ (\n \\a. case map_of a name of None \\ EAssert e | Some b \\ return b,\n \\b a. do { assert (map_of a name \\ None) e; return (AList.update name b a) }\n )\"\n\n lemma elens_ffld[simp]: \"elens (l_ffld e name)\" \n unfolding l_ffld_def\n apply (unfold_locales) \n apply (e_vcg simp: update_conv update_triv split: option.splits)+\n done\n \n lemma l_ffld_get_spec[e_vcg]: \" \n e_spec (\\x. map_of a name = Some x) (\\e'. e'=e \\ map_of a name = None) False (eget (l_ffld e name) a)\" \n unfolding l_ffld_def by e_vcg\n\n lemma l_ffld_set_spec[e_vcg]: \" \n e_spec (\\a'. map_of a name \\ None \\ map_of a' = (map_of a)(name \\ b)) (\\_. map_of a name = None) False (eset (l_ffld e name) b a)\" \n unfolding l_ffld_def by (e_vcg simp: update_conv)\n\n\nsubsection \\Address Values\\\ntext \\\n An address holds a memory block, and a path into the value stored there, \n which identifies the part of that value the pointer points to.\n\\\n\ndatatype subscript = \n is_Idx: Idx (the_Idx: nat) \n| is_Memb: Memb (the_Memb: mname)\ninterpretation Idx: l_C1 is_Idx the_Idx subscript.Idx \"EDynamic EPtr\"\n by unfold_locales simp_all\ninterpretation Memb: l_C1 is_Memb the_Memb subscript.Memb \"EDynamic EPtr\"\n by unfold_locales simp_all\n\nhide_const (open) Idx Memb\ntype_synonym subpath = \"subscript list\"\n\ntype_synonym block_idx = nat\n\ntype_synonym addr = \"block_idx \\ subpath\"\n\nsubsection \\Values\\\n\ndatatype val = \n Null -- \\Null pointer\\\n| is_I: I (the_I: int_val) -- \\Integer\\\n| is_Addr: Addr (the_Addr: addr) -- \\Non-null pointer\\ \n| is_Array: Array (the_Array: \"val list\") -- \\Array (Block of consecutive values)\\\n| is_Struct: Struct (the_Struct: \"(mname \\ val) list\") -- \\Struct (Name-value assignment)\\\n| Uninit -- \\Uninitialized value\\\n\ninterpretation I: l_C1 is_I the_I I \"EStatic EType\" by (unfold_locales) auto\ninterpretation Addr: l_C1 is_Addr the_Addr Addr \"EStatic EType\" by (unfold_locales) auto\ninterpretation Array: l_C1 is_Array the_Array Array \"EStatic EType\" by (unfold_locales) auto\ninterpretation Struct: l_C1 is_Struct the_Struct Struct \"EStatic EType\" by (unfold_locales) auto\n\n(*definition l_Struct :: \"(val,(mname\\val) list,_) elens\" where \n \"l_Struct \\ ( \\(Struct _ ms) \\ return ms | _ \\ EAssert type_error,\n \\ms. \\(Struct sn _) \\ return (Struct sn ms) | _ \\ EAssert type_error)\"\n \nlemma elens_Struct[simp]: \"elens (l_Struct)\"\n apply unfold_locales\n unfolding l_Struct_def\n by (auto split: val.splits)\n\nlemma struct_get_spec[e_vcg]:\n \"e_spec (\\ms. is_Struct v \\ ms = the_Struct v) (\\e. \\is_Struct v \\ e=type_error) False (eget l_Struct v)\"\n apply (cases v)\n by (auto simp: l_Struct_def)\n\nlemma struct_set_spec[e_vcg]:\n \"e_spec (\\v'. \\n ms'. v=Struct n ms' \\ v'=Struct n ms) (\\e. \\is_Struct v \\ e=type_error) False (eset l_Struct ms v)\"\n apply (cases v)\n by (auto simp: l_Struct_def)\n\n\n\nsubsection \\Paths into Values\\\nprimrec l_subscript :: \"subscript \\ (val,val,_) elens\" where\n \"l_subscript (subscript.Idx i) = Array.l o\\<^sub>l l_nth (EDynamic EOverflow) i\"\n| \"l_subscript (subscript.Memb name) = Struct.l o\\<^sub>l l_ffld (EStatic EStructure) name\"\n\nlemma l_subscript_alt: \"l_subscript ss = (case ss of\n (subscript.Idx i) \\ Array.l o\\<^sub>l l_nth (EDynamic EOverflow) i\n| (subscript.Memb name) \\ Struct.l o\\<^sub>l l_ffld (EStatic EStructure) name)\"\n by (auto split: subscript.splits)\n\nprimrec l_subpath :: \"subpath \\ (val,val,_) elens\" where\n \"l_subpath [] = l_id\"\n| \"l_subpath (s#ss) = l_subscript s o\\<^sub>l l_subpath ss\"\n\nlemma elens_subscript[simp]: \"elens (l_subscript ss)\"\n by (cases ss) simp_all\n\nlemma elens_subpath[simp]: \"elens (l_subpath p)\"\n by (induction p) auto\n\nsubsection \\Memory\\\n\ndatatype mem_block = \n is_Block: Block ty bool (the_Block: val) \n -- \\Allocated memory block. The flag indicates structural memory,\n which is on stack or statically allocated, and thus cannot be \n freed by the program. \\\n| is_Freed: Freed ty\n -- \\Freed memory block. We retain its type, to be able to argue\n about valid memory evolutions, where blocks can be freed, but \n must not be re-allocated or change type. \\\n\n(* TODO: Check again why we need the type of a freed block, and explain here! *)\nprimrec block_ty :: \"mem_block \\ ty\" where\n \"block_ty (Block ty _ _) = ty\" | \"block_ty (Freed ty) = ty\"\n\nprimrec is_dynamic_block :: \"mem_block \\ bool\" where\n \"is_dynamic_block (Block _ s _) \\ \\s\" | \"is_dynamic_block (Freed _) = False\"\n\ndefinition l_Block :: \"(mem_block,val,_) elens\" where\n \"l_Block \\ (\n \\(Block _ _ v) \\ return v | _ \\ EAssert pointer_error,\n \\v. \\(Block ty s _) \\ return (Block ty s v) | _ \\ EAssert pointer_error)\"\n\nlemma elens_Block[simp]: \"elens (l_Block)\"\n apply unfold_locales\n unfolding l_Block_def\n by (auto split: mem_block.splits)\n\nlemma struct_get_spec[e_vcg]:\n \"e_spec (\\ms. is_Block v \\ ms = the_Block v) (\\e. \\is_Block v \\ e=pointer_error) False (eget l_Block v)\"\n apply (cases v)\n by (auto simp: l_Block_def)\n\nlemma struct_set_spec[e_vcg]:\n \"e_spec (\\v'. \\n s ms'. v=Block n s ms' \\ v'=Block n s ms) (\\e. \\is_Block v \\ e=pointer_error) False (eset l_Block ms v)\"\n apply (cases v)\n by (auto simp: l_Block_def)\n\nlemma [simp]: \n \"\\is_nonterm (eget l_Block a)\"\n \"\\is_nonterm (eset l_Block b a)\"\n by (auto simp: l_Block_def split: mem_block.splits)\n\n\n(*interpretation Block!: l_C1 is_Block the_Block Block \"EDynamic EPtr\"\n by (unfold_locales) auto\n*)\n\ntype_synonym memory = \"mem_block list\"\n\ndefinition is_valid_block :: \"memory \\ nat \\ bool\" where\n \"is_valid_block m bi \\ bi \\is_Freed (m!bi)\"\n\nabbreviation assert_valid_block :: \"memory \\ nat \\ unit\" where\n \"assert_valid_block m bi \\ assert (is_valid_block m bi) (EDynamic EPtr)\"\n\ntext \\Memory can only hold positive sized values\\\nfun nonzerosize_val :: \"val \\ bool\" where\n \"nonzerosize_val val.Null \\ True\"\n| \"nonzerosize_val (val.I _) \\ True\"\n| \"nonzerosize_val (val.Addr _) \\ True\"\n| \"nonzerosize_val (val.Array vs) \\ (\\v\\set vs. nonzerosize_val v)\"\n| \"nonzerosize_val (val.Struct ms) \\ (\\(_,v)\\set ms. nonzerosize_val v)\"\n| \"nonzerosize_val (val.Uninit) \\ True\"\n\ndefinition raw_alloc :: \"ty \\ bool \\ val \\ memory \\ (block_idx \\ memory)\" \n -- \\Allocate block initialized with value. \n The Boolean is set if the block is to be flagged as static or stack memory.\\\nwhere\n \"raw_alloc ty s v m \\ do {\n assert (nonzerosize_val v) type_error;\n let idx = length m;\n let m = m@[Block ty s v];\n return (idx,m)\n }\"\n\ndefinition raw_free :: \"bool \\ block_idx \\ memory \\ memory\" where\n \"raw_free allow_static bi m \\ do {\n assert_valid_block m bi;\n let blk = m!bi;\n assert (allow_static \\ is_dynamic_block blk) pointer_error;\n let ty = block_ty blk;\n let m = m[bi:=Freed ty];\n return m\n }\"\n\ndefinition l_raw_mem :: \"block_idx \\ (memory,val,_) elens\" where\n \"l_raw_mem bi \\ l_nth (EDynamic EPtr) bi o\\<^sub>l l_Block\"\n\nlemma elens_raw_mem[simp]: \"elens (l_raw_mem bi)\"\n unfolding l_raw_mem_def by simp\n\n\n\nsubsection \\Types\\\n\n\nfun new_val :: \"ty \\ val\" where\n \"new_val ty.Null = val.Uninit\"\n| \"new_val ty.I = val.Uninit\"\n| \"new_val (ty.Ptr _) = val.Uninit\"\n| \"new_val (ty.StructPtr _) = val.Uninit\"\n| \"new_val (ty.Array sz ty) = val.Array (replicate sz (new_val ty))\"\n| \"new_val (ty.Struct sn ms) = val.Struct (map (\\(x,T). (x, new_val T)) ms)\"\n\ndefinition alloc :: \"ty \\ bool \\ memory \\ (addr\\memory)\" \nwhere\n \"alloc ty static \\ \\ do {\n (bi,\\) \\ raw_alloc ty static (new_val ty) \\;\n return ((bi,[]),\\)\n }\"\n\n\ndefinition calloc :: \"ty \\ bool \\ nat \\ memory \\ (addr\\memory)\" \n -- \\Allocate an array of memory objects. Array size must be greater 0,\n as a zero size results in undefined behaviour. \\\nwhere\n \"calloc ty static n \\ \\ do {\n assert (n>0) overflow_error; \n let ty = ty.Array n ty;\n (bi,\\) \\ raw_alloc ty static (new_val ty) \\;\n return ((bi,[subscript.Idx 0]),\\)\n }\"\n\ndefinition cp_alloc :: \"ty \\ bool \\ val \\ memory \\ (addr\\memory)\" where\n \"cp_alloc ty static v \\ \\ do {\n (bi,\\) \\ raw_alloc ty static v \\;\n return ((bi,[]),\\)\n }\"\n\ndefinition free :: \"bool \\ addr \\ memory \\ memory\" where\n \"free allow_static \\ \\(bi,p) \\. do {\n (* Frees both, pointers created by cp_alloc and by calloc *)\n assert (p=[] \\ p=[subscript.Idx 0]) pointer_error;\n raw_free allow_static bi \\\n }\"\n\ndefinition l_addr :: \"addr \\ (memory,val,_) elens\" where\n \"l_addr \\ \\(bi,p). l_raw_mem bi o\\<^sub>l l_subpath p\"\n\nlemma elens_addr[simp]: \"elens (l_addr addr)\" by (simp add: l_addr_def split: prod.split)\n\ncontext \n fixes SM :: struct_map\n fixes \\ :: memory\nbegin\n\ndefinition MT :: \"nat \\ ty\" where\n \"MT i \\ if i then Some (block_ty (\\!i)) else None\"\n\ndefinition FREE :: \"nat set\" where\n \"FREE \\ { i . i \\ is_Freed (\\!i) }\"\n\nfun nty_eq :: \"ty \\ ty \\ bool\" where\n \"nty_eq (ty.StructPtr sn1) (ty.StructPtr sn2) \\ sn1=sn2\"\n| \"nty_eq (ty.StructPtr sn1) (ty.Ptr (ty.Struct sn2 _)) \\ sn1 = sn2\"\n| \"nty_eq (ty.Ptr (ty.Struct sn1 _)) (ty.StructPtr sn2) \\ sn1 = sn2\"\n| \"nty_eq (ty.Ptr (ty.Struct sn1 _)) (ty.Ptr (ty.Struct sn2 _)) \\ sn1 = sn2\"\n| \"nty_eq ty1 ty2 \\ ty1=ty2\"\n\nlemma nty_eq_refl[simp]:\n \"nty_eq ty ty\"\n apply (cases \"(ty,ty)\" rule: nty_eq.cases)\n apply (auto)\n done\n\nlemma nty_eq_sym: \"nty_eq ty1 ty2 \\ nty_eq ty2 ty1\"\n apply (cases \"(ty1, ty2)\" rule: nty_eq.cases)\n by auto\n\nlemma nty_eq_trans[trans]: \"\\nty_eq ty1 ty2; nty_eq ty2 ty3\\ \\ nty_eq ty1 ty3\"\n apply (cases \"(ty1, ty2)\" rule: nty_eq.cases)\n apply simp_all\n apply (cases \"(ty1, ty3)\" rule: nty_eq.cases)\n apply simp_all\n apply (cases \"(ty2, ty3)\" rule: nty_eq.cases)\n apply simp_all\n apply (cases \"(ty1, ty3)\" rule: nty_eq.cases)\n apply simp_all\n done \n\n\nfun wt_path :: \"ty \\ ty \\ subpath \\ bool\" where\n \"wt_path T ty [] \\ nty_eq ty T\"\n| \"wt_path T (ty.Array _ ty) (subscript.Idx _ # ss) \\ wt_path T ty ss\"\n| \"wt_path T (ty.Struct _ ms) (subscript.Memb name # ss) \\ (\n case map_of ms name of\n None \\ False\n | Some ty \\ wt_path T ty ss \n )\"\n| \"wt_path _ _ _ \\ False\"\n\nlemma nty_eq_nostruct_is_eq[simp]: \n \"\\\\ty.is_StructPtr ty; \\ty.is_Ptr ty\\ \\ nty_eq ty ty' \\ ty=ty'\"\n apply (cases ty; cases ty')\n apply (auto split: Option.bind_splits)\n done\n\nlemma nty_eq_ptr_cases:\n assumes \"nty_eq (ty.Ptr ty1) ty2\"\n obtains \n ty2' where \"ty2 = ty.Ptr ty2'\" \"ty1=ty2'\"\n | sn ms1 where \"ty1 = ty.Struct sn ms1\" \"ty2 = ty.StructPtr sn\" \n | sn ms1 ms2 where \"ty1 = ty.Struct sn ms1\" \"ty2 = ty.Ptr (ty.Struct sn ms2)\"\n using assms\n apply (cases \"(ty.Ptr ty1,ty2)\" rule: nty_eq.cases)\n apply auto\n done\n\nlemma nty_eq_struct_ptr_cases:\n assumes \"nty_eq (ty.StructPtr sn) ty2\"\n obtains \n \"ty2 = ty.StructPtr sn\"\n | ms2 where \"ty2 = ty.Ptr (ty.Struct sn ms2)\" \n using assms\n apply (cases \"(ty.StructPtr sn,ty2)\" rule: nty_eq.cases)\n apply auto\n done\n\n\nlemma wt_path_cong: \"nty_eq ty ty' \\ wt_path T ty p \\ wt_path T ty' p\"\n apply (induction T ty p arbitrary: ty' rule: wt_path.induct)\n apply (auto split: )\n apply (metis nty_eq_trans nty_eq_sym) \n apply (metis nty_eq_trans) \n apply (auto elim!: nty_eq_ptr_cases) []\n apply (auto elim!: nty_eq_struct_ptr_cases) []\n apply (auto elim!: nty_eq_ptr_cases) []\n apply (auto elim!: nty_eq_struct_ptr_cases) []\n done\n\nlemma wt_path_cong2: \"nty_eq T T' \\ wt_path T ty p \\ wt_path T' ty p\"\n apply (induction T ty p arbitrary: T' rule: wt_path.induct)\n apply (auto split: option.splits)\n apply (metis nty_eq_trans) \n apply (metis nty_eq_trans nty_eq_sym) \n done\n\ninductive wt_addr:: \"ty \\ addr \\ bool\" where\n \"\\ MT bi = Some bty; wt_path T bty p \\ \\ wt_addr T (bi,p)\"\n\ninductive wt_val:: \"ty \\ val \\ bool\" where\n \"wt_val (ty.Null) (val.Null)\"\n| \"wt_val (ty.I) (val.I _)\"\n| \"wt_val (ty.Ptr ty) (val.Null)\"\n| \"\\ wt_addr ty addr \\ \\ wt_val (ty.Ptr ty) (val.Addr addr)\"\n| \"wt_val (ty.StructPtr ty) (val.Null)\"\n| \"\\ SM sname = Some mts; wt_addr (ty.Struct sname mts) addr \\ \n \\ wt_val (ty.StructPtr sname) (val.Addr addr)\"\n| \"\\ length vs = sz; \\i < sz. wt_val ty (vs!i) \\ \\ wt_val (ty.Array sz ty) (val.Array vs)\"\n| \"\\ dom (map_of mts) = dom (map_of ms); \n \\n T v. map_of mts n = Some T \\ map_of ms n = Some v \\ wt_val T v \\ \n \\ wt_val (ty.Struct sname mts) (val.Struct ms)\"\n| \"wt_val (ty.Null) (val.Uninit)\"\n| \"wt_val (ty.I) (val.Uninit)\"\n| \"wt_val (ty.Ptr _) (val.Uninit)\"\n| \"wt_val (ty.StructPtr _) (val.Uninit)\"\n\ndefinition wt_block :: \"mem_block \\ bool\" where \n \"wt_block \\ \\\n (Block ty _ v) \\ wt_val ty v \\ wf_ty SM ty \\ nonzero_ty ty \\ nonzerosize_val v \n | (Freed ty) \\ nonzero_ty ty \\ wf_ty SM ty\"\n\ndefinition wt_mem :: \"bool\" where\n \"wt_mem \\ \\blk\\set \\. wt_block blk\"\n\ninductive_simps wt_val_ty_conv: \n \"wt_val (ty.I) v\"\n \"wt_val (ty.Ptr ty) v\"\n \"wt_val (ty.StructPtr sn) v\"\n \"wt_val (ty.Array n ty) v\"\n \"wt_val (ty.Struct sn mts) v\"\n \"wt_val (ty.Null) v\"\n\nend\n\nlemma wt_mem_empty[simp]: \"wt_mem SM []\"\n by (auto simp: wt_mem_def)\n\n\nlemma MT_wf_ty:\n assumes \"wt_mem SM \\\"\n assumes \"MT \\ bi = Some bty\"\n shows \"wf_ty SM bty\"\n using assms\n apply (auto simp: MT_def wt_mem_def \n split: split_if_asm)\n apply (auto dest!: nth_mem[of bi \\] dest!: bspec)\n apply (auto simp: wt_block_def split: mem_block.splits)\n done\n\n\ncontext wf_program_loc begin\n\nlemma wt_path_append[simp]: \n assumes \"wf_ty SM ty\" \n shows \"wt_path T ty (p1@p2) \\ \n (\\ty'. wf_ty SM ty' \\ wt_path ty' ty p1 \\ wt_path T ty' p2)\"\n using assms \n apply (induction T ty p1 rule: wt_path.induct)\n apply (auto split: option.splits)\n using wt_path_cong apply blast\n apply (auto simp: SM_mt_wf) []\n apply (auto simp: SM_mt_wf) [] \n done\n\nlemma wt_path_cons[simp]:\n assumes \"NO_MATCH [] p2\"\n assumes \"wf_ty SM ty\" \n shows \"wt_path T ty (s # p2) = (\\ty'. wf_ty SM ty' \\ wt_path ty' ty [s] \\ wt_path T ty' p2)\"\n using wt_path_append[of ty T \"[s]\" p2, OF assms(2)] by simp\n\n lemma wt_val_cong:\n assumes \"nty_eq ty ty'\"\n assumes \"wf_ty SM ty\" \"wf_ty SM ty'\"\n shows \"wt_val SM \\ ty b \\ wt_val SM \\ ty' b\"\n using assms\n apply (cases \"(ty,ty')\" rule: nty_eq.cases)\n apply simp_all\n apply (auto intro!: wt_val.intros elim!: wt_val.cases)\n done\n \n lemma wt_addr_cong:\n assumes \"nty_eq ty ty'\"\n assumes \"wf_ty SM ty\" \"wf_ty SM ty'\"\n shows \"wt_addr \\ ty addr \\ wt_addr \\ ty' addr\"\n using assms wt_path_cong2\n by (auto simp: wt_addr.simps) \n\nend\n\n(* TODO/FIXME: Also include constraint that static-flags remain unchanged *)\ndefinition mem_ord :: \"memory \\ memory \\ bool\" (infix \"\\\\<^sub>\\\" 50) where\n \"\\ \\\\<^sub>\\ \\' \\ length \\ \\ length \\' \n \\ (\\i. block_ty (\\!i) = block_ty (\\'!i))\n \\ (\\i. is_Freed (\\!i) \\ is_Freed (\\'!i))\"\n\nlemma mem_ord_alt: \"\\ \\\\<^sub>\\ \\' \\ MT \\ \\\\<^sub>m MT \\' \\ FREE \\ \\ FREE \\'\"\n apply rule\n apply (auto simp: mem_ord_def map_le_def MT_def dom_def FREE_def) []\n using leI apply (auto simp: mem_ord_def map_le_def MT_def dom_def FREE_def split: split_if_asm) []\n done\n\ndefinition mem_eq :: \"memory \\ memory \\ bool\" (infix \"=\\<^sub>\\\" 50) where\n \"\\ =\\<^sub>\\ \\' \\ \\ \\\\<^sub>\\ \\' \\ \\' \\\\<^sub>\\ \\\"\n\nlemma mem_ord_refl[simp]: \"\\ \\\\<^sub>\\ \\\"\n by (auto simp: mem_ord_def)\n\nlemma mem_ord_trans[trans]: \"\\\\1 \\\\<^sub>\\ \\2; \\2 \\\\<^sub>\\ \\3\\ \\ \\1 \\\\<^sub>\\ \\3\"\n by (auto simp: mem_ord_def)\n\nlemma mem_ord_antisym: \"\\ \\ \\\\<^sub>\\ \\'; \\'\\\\<^sub>\\ \\ \\ \\ \\ =\\<^sub>\\ \\'\"\n unfolding mem_eq_def by auto\n\nlemma mem_eq_refl[simp]: \"\\ =\\<^sub>\\ \\\"\n unfolding mem_eq_def by auto\n\nlemma mem_eq_sym: \"\\ =\\<^sub>\\ \\' \\ \\' =\\<^sub>\\ \\\"\n unfolding mem_eq_def by auto\n\nlemma mem_eq_trans[trans]: \"\\\\1 =\\<^sub>\\ \\2; \\2 =\\<^sub>\\ \\3\\ \\ \\1 =\\<^sub>\\ \\3\"\n by (auto simp: mem_eq_def dest: mem_ord_trans)\n\nlemma mem_eq_alt: \n \"\\ =\\<^sub>\\ \\' \\ MT \\ = MT \\' \\ FREE \\ = FREE \\'\"\n unfolding mem_eq_def mem_ord_alt\n by (auto intro: map_le_antisym)\n\nlemma mem_eqD1: \"\\ =\\<^sub>\\ \\' \\ \\ \\\\<^sub>\\ \\'\" by (auto simp: mem_eq_def)\nlemma mem_eqD2: \"\\ =\\<^sub>\\ \\' \\ \\' \\\\<^sub>\\ \\\" by (auto simp: mem_eq_def)\n\n\nlemma wt_addr_mono:\n assumes \"wt_addr \\ T addr\" \n assumes \"mem_ord \\ \\'\" \n shows \"wt_addr \\' T addr\" \n using assms\n by (auto elim!: wt_addr.cases intro: wt_addr.intros simp: mem_ord_alt)\n\nlemma wt_val_mono:\n assumes \"wt_val SM \\ T v\" \n assumes \"\\ \\\\<^sub>\\ \\'\" \n shows \"wt_val SM \\' T v\"\n using assms(1,2)\n by induction (auto intro: wt_val.intros dest: wt_addr_mono)\n\nlemma wt_new_val[simp]: \"wt_val SM \\ T (new_val T)\"\n apply (induction T)\n apply (auto intro: wt_val.intros)\n apply (rule wt_val.intros)\n apply (auto simp: map_of_map)\n apply rprems\n apply (erule map_of_SomeD)\n by (simp add: snds.simps) (* TODO: This should be in default simpset! *)\n\n\nlemma nonzero_ty_imp_nonzerosize_val:\n assumes \"wt_val SM \\ ty v\"\n assumes \"nonzero_ty ty\"\n shows \"nonzerosize_val v\"\n using assms\n apply induction\n apply auto\n apply (auto simp: in_set_conv_nth Bex_def) []\n apply (rename_tac mts ms) \n apply (case_tac mts; case_tac ms; simp)\n apply (auto)\n by (metis (full_types) case_prodI domD insert_iff map_of_SomeD snd_conv) \n\n\n \nlemma raw_alloc_spec[e_vcg]:\n assumes \"wt_mem SM \\\" \n assumes \"wt_val SM \\ ty v\" \n assumes \"nonzero_ty ty\" \"wf_ty SM ty\"\n shows \"nd_spec (\\(bi,\\'). \n bi\\length \\ \\ MT \\' bi = Some ty \\ \\ \\\\<^sub>\\ \\'\n \\ wt_mem SM \\') (raw_alloc ty static v \\)\"\nproof -\n have MTSS: \"\\ \\\\<^sub>\\ (\\ @ [Block ty static v])\"\n by (auto simp: mem_ord_def nth_append)\n\n show ?thesis \n using assms MTSS\n unfolding raw_alloc_def Let_def\n by (fastforce \n simp: wt_mem_def nth_append MT_def wt_block_def \n simp: nonzero_ty_imp_nonzerosize_val\n split: mem_block.splits intro: wt_val_mono[OF _ MTSS])\nqed \n\n\nlemma alloc_spec[e_vcg]:\n assumes \"wt_mem SM \\\" \n assumes \"nonzero_ty ty\" \"wf_ty SM ty\"\n shows \"nd_spec (\\(addr,\\'). \n \\ \\\\<^sub>\\ \\' \\ wt_mem SM \\' \\ wt_addr \\' ty addr) (alloc ty static \\)\"\nproof -\n show ?thesis \n using assms\n unfolding alloc_def \n apply (e_vcg \n intro!: wt_new_val \n simp: wt_addr.simps wt_val_ty_conv\n split: prod.splits)\n done\nqed \n\n\nlemma calloc_spec[e_vcg]:\n assumes \"wt_mem SM \\\" \n assumes \"nonzero_ty ty\" \"wf_ty SM ty\"\n shows \"nd_spec (\\(addr,\\'). \n \\ \\\\<^sub>\\ \\' \\ wt_mem SM \\' \\ wt_addr \\' ty addr) (calloc ty static n \\)\"\nproof -\n show ?thesis \n using assms\n unfolding calloc_def \n apply (e_vcg \n intro!: wt_new_val \n simp: wt_addr.simps wt_val_ty_conv\n split: prod.splits)\n done\nqed \n\nlemma cp_alloc_spec[e_vcg]:\n assumes \"wt_mem SM \\\" \n assumes \"wt_val SM \\ ty v\" \n assumes \"nonzero_ty ty\" \"wf_ty SM ty\"\n shows \"nd_spec (\\(addr,\\'). \n \\ \\\\<^sub>\\ \\' \\ wt_mem SM \\' \\ wt_addr \\' ty addr) (cp_alloc ty static v \\)\"\nproof -\n show ?thesis \n using assms\n unfolding cp_alloc_def \n apply (e_vcg intro!: wt_new_val simp: wt_addr.simps split: prod.splits)\n done\nqed \n\nlemma raw_free_spec_aux:\n assumes \"wt_mem SM \\\"\n assumes \"i\" \"\\!i = Block ty static v\"\n shows \"wt_mem SM (\\[i:=Freed ty])\" (is \"wt_mem SM ?\\'\") \nproof -\n from assms have LE: \"\\ \\\\<^sub>\\ ?\\'\"\n by (auto simp: mem_ord_def nth_list_update)\n\n show ?thesis \n using assms\n apply (auto simp: wt_mem_def elim!: in_set_upd_cases)\n apply (auto simp: wt_block_def split: mem_block.splits dest!: nth_mem) []\n apply (auto simp: wt_block_def wt_val_mono[OF _ LE] split: mem_block.splits) []\n done\nqed\n\nlemma raw_free_spec[e_vcg]:\n assumes \"wt_mem SM \\\" \n shows \"nd_spec (\\\\'. \\ \\\\<^sub>\\ \\' \\ wt_mem SM \\') (raw_free allow_static bi \\)\"\nproof -\n have \"nd_spec (\\\\'. \\ \\\\<^sub>\\ \\') (raw_free allow_static bi \\)\"\n unfolding raw_free_def \n by (e_vcg simp: is_valid_block_def mem_ord_def nth_list_update)\n hence aux: \"\\P. nd_spec (\\\\'. \\ \\\\<^sub>\\ \\' \\ P \\') (raw_free allow_static bi \\) \n \\ nd_spec P (raw_free allow_static bi \\)\"\n by (simp add: pw_espec_iff)\n\n show ?thesis \n apply (rule aux)\n using assms\n unfolding raw_free_def \n apply e_vcg'\n apply (cases \"\\!bi\")\n apply (simp_all add: raw_free_spec_aux is_valid_block_def)\n done\nqed \n\nlemma free_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n shows \"nd_spec (\\\\'. \\ \\\\<^sub>\\ \\' \\ wt_mem SM \\') (free allow_static addr \\)\"\n using assms unfolding free_def by (cases addr) e_vcg\n\nlemma is_BlockE: assumes \"is_Block b\" obtains ty static v where \"b = Block ty static v\"\n using assms by (cases b) auto\n\nlemma raw_mem_get_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"MT \\ bi = Some T\"\n shows \"nd_spec (wt_val SM \\ T) (eget (l_raw_mem bi) \\)\"\n using assms\n unfolding l_raw_mem_def wt_mem_def\n apply (e_vcg') \n apply (auto elim!: is_BlockE simp: dom_def wt_block_def split: mem_block.splits)\n using MT_def nth_mem by fastforce\n\n\nlemma raw_mem_set_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"MT \\ bi = Some T\"\n assumes \"wt_val SM \\ T v\"\n shows \"nd_spec (\\\\'. wt_mem SM \\' \\ \\ =\\<^sub>\\ \\') (eset (l_raw_mem bi) v \\)\"\nproof (cases \"is_Freed (\\!bi)\")\n case True\n thus ?thesis\n by (e_vcg simp: l_raw_mem_def)\n\nnext\n case False\n with assms(2) obtain static vh where X1: \"\\!bi = Block T static vh\" \"bi\"\n by (cases \"\\!bi\") (auto simp: MT_def split: split_if_asm)\n hence X2: \"Block T static vh \\ set \\\" \n by (auto simp: in_set_conv_nth)\n\n have MTEQ: \"\\ =\\<^sub>\\ \\[bi := Block T static v]\"\n using assms(2) X1\n by (auto simp: mem_eq_def mem_ord_def MT_def nth_list_update split: split_if_asm)\n hence MTSS: \"\\ \\\\<^sub>\\ \\[bi := Block T static v]\"\n by (auto simp: mem_eq_def)\n\n from assms(1) have [simp]: \"nonzero_ty T\" \"wf_ty SM T\" \n unfolding wt_mem_def MT_def wt_block_def\n using X2 by auto\n\n with assms(3) have [simp]: \"nonzerosize_val v\" \n by (blast intro: nonzero_ty_imp_nonzerosize_val)\n\n show ?thesis\n using assms X1 MTEQ \n unfolding l_raw_mem_def wt_mem_def[abs_def]\n apply (e_vcg' simp: in_set_conv_nth nth_list_update split: split_if_asm)\n apply (auto \n simp: wt_block_def \n split: mem_block.splits split_if_asm\n elim!: in_set_upd_cases\n intro: wt_val_mono[OF _ MTSS]\n )\n done \nqed\n\ncontext wf_program_loc\nbegin\n\ncontext begin\n\nprivate lemma dom_eq_SomeE: \n assumes \"dom a = dom b\" \n assumes \"a k = Some x\" \n obtains y where \"dom a = dom b\" \"b k = Some y\"\n using assms by auto\n\nlemma get_subpath_spec[e_vcg]:\n assumes \"wt_path T bty p\" \n assumes \"wt_val SM \\ bty b\"\n assumes \"wf_ty SM T\" \"wf_ty SM bty\"\n shows \"nd_spec (wt_val SM \\ T) (eget (l_subpath p) b)\"\n using assms\n apply (induction bty p arbitrary: b rule: wt_path.induct)\n apply (simp_all)\n\n apply (e_vcg dest: wt_val_cong)\n\n apply (erule wt_val.cases; clarsimp)\n apply e_vcg\n\n apply (erule wt_val.cases; clarsimp split: option.splits)\n apply (erule (1) dom_eq_SomeE)\n apply (e_vcg simp: SM_mt_wf)\n done\n\nlemma set_subpath_spec[e_vcg]:\n assumes \"wt_path T bty p\" \n assumes \"wt_val SM \\ bty b\"\n assumes \"wt_val SM \\ T v\"\n assumes \"wf_ty SM T\" \"wf_ty SM bty\"\n shows \"nd_spec (wt_val SM \\ bty) (eset (l_subpath p) v b)\"\n using assms\n apply (induction bty p arbitrary: b rule: wt_path.induct)\n apply (simp_all)\n \n apply (e_vcg dest: wt_val_cong)\n\n apply (erule wt_val.cases; clarsimp)\n apply (e_vcg intro!: wt_val.intros simp: nth_list_update)\n\n apply (erule wt_val.cases; clarsimp split: option.splits)\n apply (erule (1) dom_eq_SomeE)\n apply (e_vcg simp: SM_mt_wf\n intro!: wt_val.intros elim: dom_eq_SomeE split: split_if_asm)\n done\n\nend\n\nlemma get_addr_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ T addr\"\n assumes \"wf_ty SM T\"\n shows \"nd_spec (wt_val SM \\ T) (eget (l_addr addr) \\)\"\n using assms(1,2,3)\n unfolding l_addr_def \n apply (cases addr; clarsimp)\n apply (erule wt_addr.cases; clarsimp)\n apply (e_vcg simp: MT_wf_ty)\n done\n\nlemma set_addr_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ T addr\"\n assumes \"wt_val SM \\ T v\"\n assumes \"wf_ty SM T\"\n shows \"nd_spec (\\\\'. wt_mem SM \\' \\ \\ =\\<^sub>\\ \\') (eset (l_addr addr) v \\)\"\n using assms\n unfolding l_addr_def \n apply (cases addr; clarsimp)\n apply (erule wt_addr.cases; clarsimp)\n apply (e_vcg simp: MT_wf_ty)\n done\nend\n\nsubsection \\Memory Related Operations\\\n\ndefinition is_allocated_raw :: \"memory \\ nat \\ bool\" where\n \"is_allocated_raw \\ bi \\ bi \\ is_Block (\\!bi)\"\n\ndefinition is_allocated :: \"memory \\ addr \\ bool\" where\n \"is_allocated \\ \\ \\(bi,_). is_allocated_raw \\ bi\"\n\ndefinition resolve_subpath_array :: \"val \\ subpath \\ subpath \\ nat \\ nat\" \n -- \\Get index and array size for sub-path to array element.\n Throws pointer-error if this is not a path to an array. \\\nwhere\n \"resolve_subpath_array v p \\ do {\n j \\ eget (l_last pointer_error o\\<^sub>l Idx.l) p;\n p' \\ eget (l_butlast pointer_error) p;\n vs \\ eget (l_subpath p' o\\<^sub>l Array.l) v;\n return (p',j,length vs)\n }\"\n\n\ndefinition index_subpath :: \"val \\ int \\ subpath \\ subpath\" where\n \"index_subpath v i p \\ do {\n (_,j,len) \\ resolve_subpath_array v p;\n let j = int j + i;\n assert (j \\ 0 \\ nat j\\len) (EDynamic EPtr);\n p \\ eset (l_last (EDynamic EPtr) o\\<^sub>l Idx.l) (nat j) p;\n return p\n }\"\n\ndefinition index_addr :: \"memory \\ int \\ addr \\ addr\" where\n \"index_addr \\ \\\\ i (bi,p). do {\n v \\ eget (l_raw_mem bi) \\;\n p \\ index_subpath v i p;\n return (bi,p)\n }\"\n\ndefinition cnv_array_to_eptr :: \"memory \\ addr \\ addr\" \n -- \\Convert address of array to address of its first element\\\nwhere\n \"cnv_array_to_eptr \\ \\ \\(bi,p). do {\n eget (l_addr (bi,p) o\\<^sub>l Array.l) \\;\n return (bi,p@[subscript.Idx 0])\n }\"\n\n\n\nlemma norm_wt_subscript: \"NO_MATCH 0 n \\ \n wt_path T ty [subscript.Idx n] \\ wt_path T ty [subscript.Idx 0]\"\n by (cases ty) auto\n\ncontext wf_program_loc begin\n\nlemma index_subpath_spec[e_vcg]:\n assumes \"wt_val SM \\ ty v\"\n assumes \"wt_path T ty p\" \n assumes \"wf_ty SM T\" \"wf_ty SM ty\"\n shows \"nd_spec (wt_path T ty) (index_subpath v i p)\"\n using assms\n unfolding index_subpath_def resolve_subpath_array_def\n apply (cases p rule: rev_cases)\n apply e_vcg\n apply (e_vcg elim!: Idx.E Array.E elim: wt_val.cases simp: norm_wt_subscript)\n done\n\nlemma index_addr_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ T addr\"\n assumes \"wf_ty SM T\"\n shows \"nd_spec (wt_addr \\ T) (index_addr \\ i addr)\"\n using assms\n unfolding index_addr_def\n apply -\n apply (erule wt_addr.cases)\n apply (e_vcg intro: wt_addr.intros MT_wf_ty)\n done\n\nlemma cnv_array_to_eptr_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ (ty.Array n T) addr\"\n assumes \"wf_ty SM (ty.Array n T)\"\n shows \"nd_spec (wt_addr \\ T) (cnv_array_to_eptr \\ addr)\"\n using assms\n unfolding cnv_array_to_eptr_def\n apply -\n apply (erule wt_addr.cases)\n apply (e_vcg \n intro!: wt_addr.intros exI[where x=\"ty.Array n T\"] \n simp: MT_wf_ty wt_val_ty_conv)\n done\n \n\nend\n\ndefinition diff_subpath :: \"val \\ subpath \\ subpath \\ int\" where\n \"diff_subpath v p1 p2 \\ do {\n (p1',i1,l) \\ resolve_subpath_array v p1;\n (p2',i2,_) \\ resolve_subpath_array v p2;\n assert (p1'=p2') (EDynamic EPtr);\n return (int i1 - int i2)\n }\"\n\ndefinition diff_addr :: \"memory \\ addr \\ addr \\ int\" where\n \"diff_addr \\ \\\\ (bi1,p1) (bi2,p2). do {\n assert (is_allocated_raw \\ bi1) pointer_error;\n assert (is_allocated_raw \\ bi2) pointer_error;\n assert (bi1 = bi2) (EDynamic EPtr);\n v \\ eget (l_raw_mem bi2) \\;\n diff_subpath v p1 p2\n }\"\n\n\ncontext wf_program_loc begin\nlemma diff_subpath_spec[e_vcg]:\n assumes \"wt_val SM \\ ty v\"\n assumes \"wt_path T ty p1\" \n assumes \"wt_path T ty p2\" \n assumes \"wf_ty SM ty\"\n shows \"nd_spec (\\_. True) (diff_subpath v p1 p2)\"\n using assms\n unfolding diff_subpath_def resolve_subpath_array_def\n apply (e_vcg elim!: Idx.E Array.E elim: wt_val.cases simp: norm_wt_subscript)\n done\n\nlemma diff_addr_spec[e_vcg]:\n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ T addr1\"\n assumes \"wt_addr \\ T addr2\"\n assumes \"wf_ty SM T\"\n shows \"nd_spec (\\_. True) (diff_addr \\ addr1 addr2)\"\n using assms\n unfolding diff_addr_def\n apply (cases addr1, cases addr2)\n apply (e_vcg elim!: wt_addr.cases intro: MT_wf_ty)\n done\nend\n\ndefinition memb_subpath :: \"val \\ mname \\ subpath \\ subpath\" where\n \"memb_subpath v name p \\ do {\n let p = p@[subscript.Memb name];\n eget (l_subpath p) v;\n return p\n }\"\n\ndefinition memb_addr :: \"memory \\ mname \\ addr \\ addr\" where\n \"memb_addr \\ \\\\ name (bi,p). do {\n v \\ eget (l_raw_mem bi) \\;\n p \\ memb_subpath v name p;\n return (bi,p)\n }\"\n\ncontext wf_program_loc begin\n\nlemma memb_subpath_spec[e_vcg]:\n assumes \"wt_val SM \\ ty v\"\n assumes \"wt_path (ty.Struct sname ms) ty p\" \n assumes \"map_of ms name = Some T\"\n assumes \"wf_ty SM ty\" \"wf_ty SM (ty.Struct sname ms)\"\n shows \"nd_spec (wt_path T ty) (memb_subpath v name p)\"\n using assms\n unfolding memb_subpath_def\n apply (clarsimp simp: Let_def)\n apply (rule e_vcg)\n apply clarsimp\n apply (rule e_cons, rule e_vcg)\n apply (subst wt_path_append)\n apply (assumption)\n defer\n apply assumption\n apply (erule (1) SM_mt_wf)\n apply (auto intro!: exI[where x=\"(ty.Struct sname ms)\"])\n done\n\nlemma memb_addr_spec[e_vcg]: \n assumes \"wt_mem SM \\\"\n assumes \"wt_addr \\ (ty.Struct sname ms) addr\"\n assumes \"map_of ms name = Some T\"\n assumes \"wf_ty SM (ty.Struct sname ms)\"\n shows \"nd_spec (wt_addr \\ T) (memb_addr \\ name addr)\" \n using assms\n unfolding memb_addr_def\n by (e_vcg elim!: wt_addr.cases intro: wt_addr.intros MT_wf_ty)\n\nend\n\nfun valid_subpath :: \"val \\ subpath \\ bool\" where\n \"valid_subpath v [] \\ True\"\n| \"valid_subpath (val.Array vs) ([subscript.Idx i]) \\ i\\length vs\"\n| \"valid_subpath (val.Array vs) (subscript.Idx i#p) \\ i valid_subpath (vs!i) p\"\n| \"valid_subpath (val.Struct ms) (subscript.Memb n#p) \\ \n (case map_of ms n of None \\ False | Some v \\ valid_subpath v p)\"\n| \"valid_subpath _ _ \\ False\"\n\ndefinition valid_addr :: \"memory \\ addr \\ bool\" where\n \"valid_addr \\ \\ \\(bi,p). bi \\ (\n case \\!bi of\n Freed ty \\ False\n | Block ty _ v \\ valid_subpath v p \n )\"\n\nfun readable_subpath :: \"val \\ subpath \\ bool\" where\n \"readable_subpath v [] \\ True\"\n| \"readable_subpath (val.Array vs) (subscript.Idx i#p) \\ i readable_subpath (vs!i) p\"\n| \"readable_subpath (val.Struct ms) (subscript.Memb n#p) \\ \n (case map_of ms n of None \\ False | Some v \\ readable_subpath v p)\"\n| \"readable_subpath _ _ \\ False\"\n\ndefinition readable_addr :: \"memory \\ addr \\ bool\" where\n \"readable_addr \\ \\ \\(bi,p). bi \\ (\n case \\!bi of\n Freed ty \\ False\n | Block ty _ v \\ readable_subpath v p \n )\"\n\n\ncontext wf_program_loc begin\n\nlemma l_subpath_iff_readable_spec: \"e_spec \n (\\_. readable_subpath v p) \n (\\_. \\readable_subpath v p) \n False \n (eget (l_subpath p) v)\"\nproof -\n note [e_vcg del] = get_subpath_spec\n\n show ?thesis\n apply (induction v p rule: readable_subpath.induct)\n (* TODO: Why does splitting in e_vcg not work ?*)\n apply (e_vcg simp: l_subscript_alt;auto split: subscript.splits; e_vcg)+\n done\nqed\n\nlemma l_addr_iff_readable_spec: \"e_spec \n (\\_. readable_addr \\ addr) \n (\\_. \\readable_addr \\ addr) \n False \n (eget (l_addr addr) \\)\"\nproof -\n note [e_vcg del] = get_subpath_spec\n\n show ?thesis\n apply (cases addr)\n apply (clarsimp simp: readable_addr_def l_addr_def l_raw_mem_def)\n apply (e_vcg' vcg: l_subpath_iff_readable_spec)\n apply (auto split: mem_block.splits) \n done\nqed\n\n\nlemma \"readable_subpath v p \\ valid_subpath v p\"\n apply (induction v p rule: valid_subpath.induct)\n apply (auto split: option.splits)\n done\n\nlemma readable_addr_alt: \n \"readable_addr \\ addr \\ (\\v. eget (l_addr addr) \\ = return v)\"\n using l_addr_iff_readable_spec[of \\ addr] \n apply (cases \"eget (l_addr addr) \\\")\n apply (auto simp: pw_espec_iff)\n done\n\nend \n\ndatatype ptr_comp_res = PC_EQ | PC_NEQ | PC_LESS | PC_GREATER\n\n\ndefinition compare_addr :: \"memory \\ addr \\ addr \\ ptr_comp_res\" where\n \"compare_addr \\ addr1 addr2 \\ do {\n assert (valid_addr \\ addr1) pointer_error;\n assert (valid_addr \\ addr2) pointer_error;\n\n let (bi1,p1) = addr1;\n let (bi2,p2) = addr2;\n\n if bi1\\bi2 then do {\n (* Force addresses to be in allocated range, otherwise\n the result is undefined due to overlap effects *)\n assert (readable_addr \\ addr1) pointer_error;\n assert (readable_addr \\ addr2) pointer_error;\n return PC_NEQ\n } else do {\n let (prf,r1,r2) = split_common_prefix p1 p2;\n \n case (r1,r2) of\n ([],[]) \\ return PC_EQ\n | ([],_) \\ EAssert pointer_error \n | (_,[]) \\ EAssert pointer_error \n | (s1#rr1, s2#rr2) \\ do {\n (* Do not compare address with its prefix: They might be equal\n due to zero-indexing --- however, we set it to undefined. *)\n assert (rr1=[] \\ rr2=[]) pointer_error;\n (* If the path continues, force addresses to be in range, otherwise\n the result is undefined due to overlap effects *)\n assert (rr1\\[] \\ readable_addr \\ addr1 \\ readable_addr \\ addr2) pointer_error;\n case (s1,s2) of\n (subscript.Idx i1, subscript.Idx i2) \\ \n if i1 return PC_NEQ\n | _ \\ EAssert pointer_error (* TODO: Might want type-error here?! *)\n }\n }\n }\"\n\ndefinition \"addr_less \\ addr1 addr2 \\ do {\n pc \\ compare_addr \\ addr1 addr2;\n case pc of\n PC_EQ \\ return False\n | PC_NEQ \\ EAssert pointer_error\n | PC_LESS \\ return True\n | PC_GREATER \\ return False \n}\"\n\ndefinition \"addr_leq \\ addr1 addr2 \\ do {\n pc \\ compare_addr \\ addr1 addr2;\n case pc of\n PC_EQ \\ return True\n | PC_NEQ \\ EAssert pointer_error\n | PC_LESS \\ return True\n | PC_GREATER \\ return False \n}\"\n\ndefinition \"addr_eq \\ addr1 addr2 \\ do {\n pc \\ compare_addr \\ addr1 addr2;\n case pc of\n PC_EQ \\ return True\n | PC_NEQ \\ return False\n | PC_LESS \\ return False\n | PC_GREATER \\ return False \n}\"\n\nlemma is_allocated_rawE:\n assumes \"is_allocated_raw \\ bi\"\n obtains ty static v where \"bi\" \"\\!bi = Block ty static v\"\n using assms\n apply (cases \"\\!bi\")\n apply (auto simp: is_allocated_raw_def)\n done\n\nlemma wt_mem_block_imp:\n assumes \"\\!bi = Block ty static v\"\n assumes \"bi < length \\\"\n assumes \"wt_mem SM \\\" \n shows \n \"MT \\ bi = Some ty\" \n \"wt_val SM \\ ty v\" \"wf_ty SM ty\" \"nonzero_ty ty\" \"nonzerosize_val v\"\n using assms\n unfolding wt_mem_def wt_block_def\n by (auto simp: Ball_def in_set_conv_nth MT_def) \n\nlemma wt_path_idx_conv: \"wt_path T ty (subscript.Idx i#p) \n \\ (\\n mty. ty=ty.Array n mty \\ wt_path T mty p)\"\n apply (cases \"(T,ty,subscript.Idx i#p)\" rule: wt_path.cases)\n apply auto\n done\n\ncontext wf_program_loc begin\n\nlemma compare_addr_spec[e_vcg]:\n (*assumes \"wt_mem SM \\\" \n assumes \"wt_addr \\ T addr1\"\n assumes \"wt_addr \\ T addr2\"\n assumes \"wf_ty SM T\"*)\n shows \"nd_spec (\\_. True) (compare_addr \\ addr1 addr2)\"\n (*using assms(1-3)*)\n unfolding compare_addr_def\n apply (e_vcg')\n apply (clarsimp split: prod.split list.split subscript.split; safe?; clarsimp)\n apply e_vcg\n apply e_vcg\n apply e_vcg\n apply e_vcg\n apply e_vcg\n done\n\nend\nend\n", "meta": {"author": "glimonta", "repo": "thesis", "sha": "1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed", "save_path": "github-repos/isabelle/glimonta-thesis", "path": "github-repos/isabelle/glimonta-thesis/thesis-1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed/src/Semantics/Memory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.2781544498816434}} {"text": "(* Title: variants/b_fwdrreps/Aodv_Loop_Freedom.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke, Inria\n*)\n\nsection \"Lift and transfer invariants to show loop freedom\"\n\ntheory B_Aodv_Loop_Freedom\nimports AWN.OClosed_Transfer AWN.Qmsg_Lifting B_Global_Invariants B_Loop_Freedom\nbegin\n\nsubsection \\Lift to parallel processes with queues\\\n\nlemma par_step_no_change_on_send_or_receive:\n fixes \\ s a \\' s'\n assumes \"((\\, s), a, (\\', s')) \\ oparp_sos i (oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i) (seqp_sos \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G)\"\n and \"a \\ \\\"\n shows \"\\' i = \\ i\"\n using assms by (rule qmsg_no_change_on_send_or_receive)\n\nlemma par_nhop_quality_increases:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\ (otherwith ((=)) {i} (orecvmsg (\\\\ m.\n msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i} \\)\n global (\\\\. \\dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n proof (rule lift_into_qmsg [OF seq_nhop_quality_increases])\n show \"opaodv i \\\\<^sub>A (otherwith ((=)) {i}\n (orecvmsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n proof (rule ostep_invariant_weakenE [OF oquality_increases], simp_all)\n fix t :: \"(((nat \\ state) \\ (state, msg, pseqp, pseqp label) seqp), msg seq_action) transition\"\n assume \"onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\((\\, _), _, (\\', _)). \\j. quality_increases (\\ j) (\\' j)) t\"\n thus \"quality_increases (fst (fst t) i) (fst (snd (snd t)) i)\"\n by (cases t) (clarsimp dest!: onllD, metis aodv_ex_label)\n next\n fix \\ \\' a\n assume \"otherwith ((=)) {i}\n (orecvmsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)) \\ \\' a\"\n thus \"otherwith quality_increases {i} (orecvmsg (\\_. rreq_rrep_sn)) \\ \\' a\"\n by - (erule weaken_otherwith, auto)\n qed\n qed auto\n\nlemma par_rreq_rrep_sn_quality_increases:\n \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n proof -\n have \"opaodv i \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule ostep_invariant_weakenE [OF olocal_quality_increases])\n (auto dest!: onllD seqllD elim!: aodv_ex_labelE)\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nlemma par_rreq_rrep_nsqn_fresh_any_step:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n proof -\n have \"opaodv i \\\\<^sub>A (\\\\ _. (orecvmsg (\\_. rreq_rrep_sn)) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n proof (rule ostep_invariant_weakenE [OF rreq_rrep_nsqn_fresh_any_step_invariant])\n fix t\n assume \"onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\((\\, _), a, _). anycast (msg_fresh \\) a) t\"\n thus \"globala (\\(\\, a, \\'). anycast (msg_fresh \\) a) t\"\n by (cases t) (clarsimp dest!: onllD, metis aodv_ex_label)\n qed auto\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. (orecvmsg (\\_. rreq_rrep_sn)) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nlemma par_anycast_msg_zhops:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n proof -\n from anycast_msg_zhops initiali_aodv oaodv_trans aodv_trans\n have \"opaodv i \\\\<^sub>A (act TT, other (\\_ _. True) {i} \\)\n seqll i (onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\(_, a, _). anycast msg_zhops a))\"\n by (rule open_seq_step_invariant)\n hence \"opaodv i \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n proof (rule ostep_invariant_weakenE)\n fix t :: \"(((nat \\ state) \\ (state, msg, pseqp, pseqp label) seqp), msg seq_action) transition\"\n assume \"seqll i (onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\(_, a, _). anycast msg_zhops a)) t\"\n thus \"globala (\\(_, a, _). anycast msg_zhops a) t\"\n by (cases t) (clarsimp dest!: seqllD onllD, metis aodv_ex_label)\n qed simp_all\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nsubsection \\Lift to nodes\\\n\nlemma node_step_no_change_on_send_or_receive:\n assumes \"((\\, NodeS i P R), a, (\\', NodeS i' P' R')) \\ onode_sos\n (oparp_sos i (oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i) (seqp_sos \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G))\"\n and \"a \\ \\\"\n shows \"\\' i = \\ i\"\n using assms\n by (cases a) (auto elim!: par_step_no_change_on_send_or_receive)\n\nlemma node_nhop_quality_increases:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\n (otherwith ((=)) {i}\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i}\n \\) global (\\\\. \\dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n by (rule node_lift [OF par_nhop_quality_increases]) auto\n\nlemma node_quality_increases:\n \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule node_lift_step_statelessassm [OF par_rreq_rrep_sn_quality_increases]) simp\n\nlemma node_rreq_rrep_nsqn_fresh_any_step:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). castmsg (msg_fresh \\) a)\"\n by (rule node_lift_anycast_statelessassm [OF par_rreq_rrep_nsqn_fresh_any_step])\n\nlemma node_anycast_msg_zhops:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). castmsg msg_zhops a)\"\n by (rule node_lift_anycast_statelessassm [OF par_anycast_msg_zhops])\n\nlemma node_silent_change_only:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i \\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_ _. True) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). a \\ \\ \\ \\' i = \\ i)\"\n proof (rule ostep_invariantI, simp (no_asm), rule impI)\n fix \\ \\ a \\' \\'\n assume or: \"(\\, \\) \\ oreachable (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i\\\\<^sub>o)\n (\\\\ _. oarrivemsg (\\_ _. True) \\)\n (other (\\_ _. True) {i})\"\n and tr: \"((\\, \\), a, (\\', \\')) \\ trans (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i\\\\<^sub>o)\"\n and \"a \\ \\\\<^sub>n\"\n from or obtain p R where \"\\ = NodeS i p R\"\n by - (drule node_net_state, metis)\n with tr have \"((\\, NodeS i p R), a, (\\', \\'))\n \\ onode_sos (oparp_sos i (trans (opaodv i)) (trans qmsg))\"\n by simp\n thus \"\\' i = \\ i\" using \\a \\ \\\\<^sub>n\\ \n by (cases rule: onode_sos.cases)\n (auto elim: qmsg_no_change_on_send_or_receive)\n qed\n\nsubsection \\Lift to partial networks\\\n\nlemma arrive_rreq_rrep_nsqn_fresh_inc_sn [simp]:\n assumes \"oarrivemsg (\\\\ m. msg_fresh \\ m \\ P \\ m) \\ m\"\n shows \"oarrivemsg (\\_. rreq_rrep_sn) \\ m\"\n using assms by (cases m) auto\n\nlemma opnet_nhop_quality_increases:\n shows \"opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p \\\n (otherwith ((=)) (net_tree_ips p)\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases (net_tree_ips p) \\)\n global (\\\\. \\i\\net_tree_ips p. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n proof (rule pnet_lift [OF node_nhop_quality_increases])\n fix i R\n have \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\) globala (\\(\\, a, \\').\n castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a)\"\n proof (rule ostep_invariantI, simp (no_asm))\n fix \\ s a \\' s'\n assume or: \"(\\, s) \\ oreachable (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o)\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\)\n (other (\\_ _. True) {i})\"\n and tr: \"((\\, s), a, (\\', s')) \\ trans (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o)\"\n and am: \"oarrivemsg (\\_. rreq_rrep_sn) \\ a\"\n from or tr am have \"castmsg (msg_fresh \\) a\"\n by (auto dest!: ostep_invariantD [OF node_rreq_rrep_nsqn_fresh_any_step])\n moreover from or tr am have \"castmsg (msg_zhops) a\"\n by (auto dest!: ostep_invariantD [OF node_anycast_msg_zhops])\n ultimately show \"castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a\"\n by (case_tac a) auto\n qed\n thus \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, _).\n castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a)\"\n by rule auto\n next\n fix i R\n show \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, \\').\n a \\ \\ \\ (\\d. a \\ i:deliver(d)) \\ \\ i = \\' i)\"\n by (rule ostep_invariant_weakenE [OF node_silent_change_only]) auto\n next\n fix i R\n show \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, \\').\n a = \\ \\ (\\d. a = i:deliver(d)) \\ quality_increases (\\ i) (\\' i))\"\n by (rule ostep_invariant_weakenE [OF node_quality_increases]) auto\n qed simp_all\n\nsubsection \\Lift to closed networks\\\n\nlemma onet_nhop_quality_increases:\n shows \"oclosed (opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p)\n \\ (\\_ _ _. True, other quality_increases (net_tree_ips p) \\)\n global (\\\\. \\i\\net_tree_ips p. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n (is \"_ \\ (_, ?U \\) ?inv\")\n proof (rule inclosed_closed)\n from opnet_nhop_quality_increases\n show \"opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p\n \\ (otherwith ((=)) (net_tree_ips p) inoclosed, ?U \\) ?inv\"\n proof (rule oinvariant_weakenE)\n fix \\ \\' :: \"ip \\ state\" and a :: \"msg node_action\"\n assume \"otherwith ((=)) (net_tree_ips p) inoclosed \\ \\' a\"\n thus \"otherwith ((=)) (net_tree_ips p)\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)) \\ \\' a\"\n proof (rule otherwithEI)\n fix \\ :: \"ip \\ state\" and a :: \"msg node_action\"\n assume \"inoclosed \\ a\"\n thus \"oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\ a\"\n proof (cases a)\n fix ii ni ms\n assume \"a = ii\\ni:arrive(ms)\"\n moreover with \\inoclosed \\ a\\ obtain d di where \"ms = newpkt(d, di)\"\n by (cases ms) auto\n ultimately show ?thesis by simp\n qed simp_all\n qed\n qed\n qed\n\nsubsection \\Transfer into the standard model\\\n\ninterpretation aodv_openproc: openproc paodv opaodv id\n rewrites \"aodv_openproc.initmissing = initmissing\"\n proof -\n show \"openproc paodv opaodv id\"\n proof unfold_locales\n fix i :: ip\n have \"{(\\, \\). (\\ i, \\) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i \\ (\\j. j \\ i \\ \\ j \\ fst ` \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V j)} \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def\n proof (rule equalityD1)\n show \"\\f p. {(\\, \\). (\\ i, \\) \\ {(f i, p)} \\ (\\j. j \\ i\n \\ \\ j \\ fst ` {(f j, p)})} = {(f, p)}\"\n by (rule set_eqI) auto\n qed\n thus \"{ (\\, \\) |\\ \\ s. s \\ init (paodv i)\n \\ (\\ i, \\) = id s\n \\ (\\j. j\\i \\ \\ j \\ (fst o id) ` init (paodv j)) } \\ init (opaodv i)\"\n by simp\n next\n show \"\\j. init (paodv j) \\ {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def by simp\n next\n fix i s a s' \\ \\'\n assume \"\\ i = fst (id s)\"\n and \"\\' i = fst (id s')\"\n and \"(s, a, s') \\ trans (paodv i)\"\n then obtain q q' where \"s = (\\ i, q)\"\n and \"s' = (\\' i, q')\"\n and \"((\\ i, q), a, (\\' i, q')) \\ trans (paodv i)\" \n by (cases s, cases s') auto\n from this(3) have \"((\\, q), a, (\\', q')) \\ trans (opaodv i)\"\n by simp (rule open_seqp_action [OF aodv_wf])\n\n with \\s = (\\ i, q)\\ and \\s' = (\\' i, q')\\\n show \"((\\, snd (id s)), a, (\\', snd (id s'))) \\ trans (opaodv i)\"\n by simp\n qed\n then interpret opn: openproc paodv opaodv id .\n have [simp]: \"\\i. (SOME x. x \\ (fst o id) ` init (paodv i)) = aodv_init i\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def by simp\n hence \"\\i. openproc.initmissing paodv id i = initmissing i\"\n unfolding opn.initmissing_def opn.someinit_def initmissing_def\n by (auto split: option.split)\n thus \"openproc.initmissing paodv id = initmissing\" ..\n qed\n\ninterpretation aodv_openproc_par_qmsg: openproc_parq paodv opaodv id qmsg\n rewrites \"aodv_openproc_par_qmsg.netglobal = netglobal\"\n and \"aodv_openproc_par_qmsg.initmissing = initmissing\"\n proof -\n show \"openproc_parq paodv opaodv id qmsg\"\n by (unfold_locales) simp\n then interpret opq: openproc_parq paodv opaodv id qmsg .\n\n have im: \"\\\\. openproc.initmissing (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) \\\n = initmissing \\\"\n unfolding opq.initmissing_def opq.someinit_def initmissing_def\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G_def by (clarsimp cong: option.case_cong)\n thus \"openproc.initmissing (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) = initmissing\"\n by (rule ext)\n have \"\\P \\. openproc.netglobal (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) P \\\n = netglobal P \\\"\n unfolding opq.netglobal_def netglobal_def opq.initmissing_def initmissing_def opq.someinit_def\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G_def\n by (clarsimp cong: option.case_cong\n simp del: One_nat_def\n simp add: fst_initmissing_netgmap_default_aodv_init_netlift\n [symmetric, unfolded initmissing_def])\n thus \"openproc.netglobal (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) = netglobal\"\n by auto\n qed\n\nlemma net_nhop_quality_increases:\n assumes \"wf_net_tree n\"\n shows \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal\n (\\\\. \\i dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n (is \"_ \\ netglobal (\\\\. \\i. ?inv \\ i)\")\n proof -\n from \\wf_net_tree n\\\n have proto: \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal (\\\\. \\i\\net_tree_ips n. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n by (rule aodv_openproc_par_qmsg.close_opnet [OF _ onet_nhop_quality_increases])\n show ?thesis\n unfolding invariant_def opnet_sos.opnet_tau1\n proof (rule, simp only: aodv_openproc_par_qmsg.netglobalsimp\n fst_initmissing_netgmap_pair_fst, rule allI)\n fix \\ i\n assume sr: \"\\ \\ reachable (closed (pnet (\\i. paodv i \\\\ qmsg) n)) TT\"\n hence \"\\i\\net_tree_ips n. ?inv (fst (initmissing (netgmap fst \\))) i\"\n by - (drule invariantD [OF proto],\n simp only: aodv_openproc_par_qmsg.netglobalsimp\n fst_initmissing_netgmap_pair_fst)\n thus \"?inv (fst (initmissing (netgmap fst \\))) i\"\n proof (cases \"i\\net_tree_ips n\")\n assume \"i\\net_tree_ips n\"\n from sr have \"\\ \\ reachable (pnet (\\i. paodv i \\\\ qmsg) n) TT\" ..\n hence \"net_ips \\ = net_tree_ips n\" ..\n with \\i\\net_tree_ips n\\ have \"i\\net_ips \\\" by simp\n hence \"(fst (initmissing (netgmap fst \\))) i = aodv_init i\"\n by simp\n thus ?thesis by simp\n qed metis\n qed\n qed\n\nsubsection \\Loop freedom of AODV\\\n\ntheorem aodv_loop_freedom:\n assumes \"wf_net_tree n\"\n shows \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal (\\\\. \\dip. irrefl ((rt_graph \\ dip)\\<^sup>+))\"\n using assms by (rule aodv_openproc_par_qmsg.netglobal_weakenE\n [OF net_nhop_quality_increases inv_to_loop_freedom])\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AODV/variants/b_fwdrreps/B_Aodv_Loop_Freedom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27815444374356685}} {"text": "section\\Temporal Properties\\\ntext\\This theory presents some examples of temporal properties over the simple drinks machine.\\\n\ntheory Drinks_Machine_LTL\nimports \"Drinks_Machine\" \"Extended_Finite_State_Machines-devel.EFSM_LTL\"\nbegin\n\ndeclare One_nat_def [simp del]\n\nlemma P_ltl_step_0:\n assumes invalid: \"P (None, [], <>)\"\n assumes select: \"l = STR ''select'' \\ P (Some 1, [], <1 $:= Some (hd i), 2 $:= Some (Num 0)>)\"\n shows \"P (ltl_step drinks (Some 0) <> (l, i))\"\nproof-\n have length_i: \"\\d. (l, i) = (STR ''select'', [d]) \\ length i = 1\"\n by (induct i, auto)\n have length_i_2: \"\\d. i \\ [d] \\ length i \\ 1\"\n by (induct i, auto)\n show ?thesis\n apply (case_tac \"\\d. (l, i) = (STR ''select'', [d])\")\n apply (simp add: possible_steps_0 length_i select_def apply_updates_def)\n using select apply auto[1]\n by (simp add: possible_steps_0_invalid length_i_2 invalid)\nqed\n\nlemma P_ltl_step_1:\n assumes invalid: \"P (None, [], r)\"\n assumes coin: \"l = STR ''coin'' \\ P (Some 1, [value_plus (r $ 2) (Some (hd i))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))\"\n assumes vend_fail: \"value_gt (Some (Num 100)) (r $ 2) = trilean.true \\ P (Some 1, [],r)\"\n assumes vend: \"\\? value_gt (Some (Num 100)) (r $ 2) = trilean.true \\ P (Some 2, [r$1], r)\"\n shows \"P (ltl_step drinks (Some 1) r (l, i))\"\nproof-\n have length_i: \"\\s. \\d. (l, i) = (s, [d]) \\ length i = 1\"\n by (induct i, auto)\n have length_i_2: \"\\d. i \\ [d] \\ length i \\ 1\"\n by (induct i, auto)\n show ?thesis\n apply (case_tac \"\\d. (l, i) = (STR ''coin'', [d])\")\n apply (simp add: possible_steps_1_coin length_i coin_def apply_outputs_def apply_updates_def)\n using coin apply auto[1]\n apply (case_tac \"(l, i) = (STR ''vend'', [])\")\n apply (case_tac \"\\n. r $ 2 = Some (Num n)\")\n apply clarsimp\n subgoal for n\n apply (case_tac \"n \\ 100\")\n apply (simp add: drinks_vend_sufficient vend_def apply_updates_def apply_outputs_def)\n apply (metis finfun_upd_triv possible_steps_2_vend vend vend_ge_100)\n apply (simp add: drinks_vend_insufficient vend_fail_def apply_updates_def apply_outputs_def)\n apply (metis MaybeBoolInt.simps(1) finfun_upd_triv not_less value_gt_def vend_fail)\n done\n apply (simp add: drinks_vend_invalid invalid)\n by (simp add: drinks_no_possible_steps_1 length_i_2 invalid)\nqed\n\nlemma LTL_r2_not_always_gt_100: \"not (alw (check_exp (Gt (V (Rg 2)) (L (Num 100))))) (watch drinks i)\"\n using value_gt_def by auto\n\nlemma drinks_step_2_none: \"ltl_step drinks (Some 2) r e = (None, [], r)\"\n by (simp add: drinks_end ltl_step_none_2)\n\nlemma one_before_two_2:\n \"alw (\\x. statename (shd (stl x)) = Some 2 \\ statename (shd x) = Some 1) (make_full_observation drinks (Some 2) r [r $ 1] x2a)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (simp add: drinks_step_2_none)\n by (metis (mono_tags, lifting) alw_mono nxt.simps once_none_nxt_always_none option.distinct(1))\nqed\n\nlemma one_before_two_aux:\n assumes \"\\ p r i. j = nxt (make_full_observation drinks (Some 1) r p) i\"\n shows \"alw (\\x. nxt (state_eq (Some 2)) x \\ state_eq (Some 1) x) j\"\n using assms apply(coinduct)\n apply simp\n apply clarify\n apply standard\n apply simp\n apply simp\n subgoal for r i\n apply (case_tac \"shd (stl i)\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n by (simp add: one_before_two_2)\n done\n\nlemma LTL_nxt_2_means_vend:\n \"alw (nxt (state_eq (Some 2)) impl (state_eq (Some 1))) (watch drinks i)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (case_tac \"shd i\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n using one_before_two_aux by auto\nqed\n\nlemma costsMoney_aux:\n assumes \"\\p r i. j = (nxt (make_full_observation drinks (Some 1) r p) i)\"\n shows \"alw (\\xs. nxt (state_eq (Some 2)) xs \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n subgoal for r i\n apply (case_tac \"shd (stl i)\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (metis (no_types, lifting) drinks_step_2_none fst_conv make_full_observation.sel(2) nxt.simps nxt_alw once_none_always_none_aux)\n by simp\n done\n\n(* costsMoney: THEOREM drinks |- G(X(cfstate=State_2) => gval(value_ge(r_2, Some(NUM(100))))); *)\nlemma LTL_costsMoney:\n \"(alw (nxt (state_eq (Some 2)) impl (check_exp (Ge (V (Rg 2)) (L (Num 100)))))) (watch drinks i)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (cases \"shd i\")\n subgoal for l ip\n apply (case_tac \"l = STR ''select'' \\ length ip = 1\")\n defer\n apply (simp add: possible_steps_0_invalid)\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (state_eq None)\"])\n apply (simp add: once_none_nxt_always_none)\n apply (simp add: )\n apply (simp add: possible_steps_0 select_def)\n apply (rule disjI2)\n apply (simp only: nxt.simps[symmetric])\n using costsMoney_aux by auto\n done\nqed\n\nlemma LTL_costsMoney_aux:\n \"(alw (not (check_exp (Ge (V (Rg 2)) (L (Num 100)))) impl (not (nxt (state_eq (Some 2)))))) (watch drinks i)\"\n by (metis (no_types, lifting) LTL_costsMoney alw_mono)\n\nlemma implode_select: \"String.implode ''select'' = STR ''select''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_coin: \"String.implode ''coin'' = STR ''coin''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_vend: \"String.implode ''vend'' = STR ''vend''\"\n by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemmas implode_labels = implode_select implode_coin implode_vend\n\nlemma LTL_neverReachS2:\"(((((action_eq (''select'', [Str ''coke''])))\n aand\n (nxt ((action_eq (''coin'', [Num 100])))))\n aand\n (nxt (nxt((label_eq ''vend'' aand (input_eq []))))))\n impl\n (nxt (nxt (nxt (state_eq (Some 2))))))\n (watch drinks i)\"\n apply (simp add: implode_labels)\n apply (cases i)\n apply clarify \n apply simp\n apply (simp add: possible_steps_0 select_def)\n apply (case_tac \"shd x2\", clarify)\n apply (simp add: possible_steps_1_coin coin_def value_plus_def finfun_update_twist apply_updates_def)\n apply (case_tac \"shd (stl x2)\", clarify)\n by (simp add: drinks_vend_sufficient )\n\nlemma ltl_step_not_select:\n \"\\i. e = (STR ''select'', [i]) \\\n ltl_step drinks (Some 0) r e = (None, [], r)\"\n apply (cases e, clarify)\n subgoal for a b\n apply (rule ltl_step_none)\n apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def select_def)\n by (cases e, case_tac b, auto)\n done\n\nlemma ltl_step_select:\n \"ltl_step drinks (Some 0) <> (STR ''select'', [i]) = (Some 1, [], <1 $:= Some i, 2 $:= Some (Num 0)>)\"\n apply (rule ltl_step_some[of _ _ _ _ _ _ select])\n apply (simp add: possible_steps_0)\n apply (simp add: select_def)\n by (simp add: select_def finfun_update_twist apply_updates_def)\n\nlemma ltl_step_not_coin_or_vend:\n \"\\i. e = (STR ''coin'', [i]) \\\n e \\ (STR ''vend'', []) \\\n ltl_step drinks (Some 1) r e = (None, [], r)\"\n apply (cases e)\n subgoal for a b\n apply (simp del: ltl_step.simps)\n apply (rule ltl_step_none)\n apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def transitions)\n by (case_tac e, case_tac b, auto)\n done\n\nlemma ltl_step_coin:\n \"\\p r'. ltl_step drinks (Some 1) r (STR ''coin'', [i]) = (Some 1, p, r')\"\n by (simp add: possible_steps_1_coin)\n\nlemma alw_tl:\n \"alw \\ (make_full_observation e (Some 0) <> [] xs) \\\n alw \\\n (make_full_observation e (fst (ltl_step e (Some 0) <> (shd xs))) (snd (snd (ltl_step e (Some 0) <> (shd xs))))\n (fst (snd (ltl_step e (Some 0) <> (shd xs)))) (stl xs))\"\n by auto\n\nlemma stop_at_none:\n \"alw (\\xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs)\n (make_full_observation drinks None r p t)\"\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n by simp\n\nlemma drink_costs_money_aux:\n assumes \"\\p r t. j = make_full_observation drinks (Some 1) r p t\"\n shows \"alw (\\xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply (simp add: Str_def value_plus_never_string)\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n by simp\n\nlemma LTL_drinks_cost_money:\n \"alw (nxt (output_eq [Some (Str drink)]) impl (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\nproof(coinduction)\n case alw\n then show ?case\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply simp\n using drink_costs_money_aux\n apply simp\n by blast\nqed\n\nlemma steps_1_invalid:\n \"\\i. (a, b) = (STR ''coin'', [i]) \\\n \\i. (a, b) = (STR ''vend'', []) \\\n possible_steps drinks 1 r a b = {||}\"\n apply (simp add: possible_steps_empty drinks_def transitions can_take_transition_def can_take_def)\n by (induct b, auto)\n\nlemma output_vend_aux:\n assumes \"\\p r t. j = make_full_observation drinks (Some 1) r p t\"\n shows \"alw (\\xs. label_eq ''vend'' xs \\ output (shd (stl xs)) = [Some d] \\ check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n using assms apply coinduct\n apply clarsimp\n subgoal for r t\n apply (case_tac \"shd t\")\n apply (simp add: implode_vend del: ltl_step.simps)\n apply (rule P_ltl_step_1)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply auto[1]\n apply auto[1]\n apply simp\n apply standard\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n by simp\n done\n\ntext_raw\\\\snip{outputVend}{1}{2}{%\\\nlemma LTL_output_vend:\n \"alw (((label_eq ''vend'') aand (nxt (output_eq [Some d]))) impl\n (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\ntext_raw\\}%endsnip\\\nproof(coinduction)\n case alw\n then show ?case\n apply (simp add: implode_vend)\n apply (case_tac \"shd t\")\n apply (simp del: ltl_step.simps)\n apply (rule P_ltl_step_0)\n apply simp\n apply (rule disjI2)\n apply (rule alw_mono[of \"nxt (output_eq [])\"])\n apply (simp add: no_output_none_nxt)\n apply simp\n apply simp\n subgoal for a b\n using output_vend_aux[of \"(make_full_observation drinks (Some 1)\n <1 $:= Some (hd b), 2 $:= Some (Num 0)> [] (stl t))\" d]\n using implode_vend by auto\n done\nqed\n\ntext_raw\\\\snip{outputVendUnfolded}{1}{2}{%\\\nlemma LTL_output_vend_unfolded:\n \"alw (\\xs. (label (shd xs) = STR ''vend'' \\\n nxt (\\s. output (shd s) = [Some d]) xs) \\\n \\? value_gt (Some (Num 100)) (datastate (shd xs) $ 2) = trilean.true)\n (watch drinks t)\"\ntext_raw\\}%endsnip\\\n apply (insert LTL_output_vend[of d t])\n by (simp add: implode_vend)\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Extended_Finite_State_Machines", "sha": "3a7a6daf2cfc4f155a2ce259c255cf8f322f6268", "save_path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machines", "path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machines/Extended_Finite_State_Machines-3a7a6daf2cfc4f155a2ce259c255cf8f322f6268/Extended_Finite_State_Machines/examples/Drinks_Machine_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.27804580333872064}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory StringOrd\nimports \"~~/src/HOL/Main\"\nbegin\n\ndatatype anotherBL =\n BLNon\n | BLZer anotherBL\n | BLOne anotherBL\n | BLTwo anotherBL\n | BLThr anotherBL\n\nlemma twice_bound_meta_all:\n \"(\\a b. x = a \\ y = b \\ PROP Q a b) \\ (PROP Q x y)\"\n apply (rule equal_intr_rule)\n apply (erule meta_allE, erule meta_allE, erule meta_mp)\n apply simp\n apply clarsimp\n done\n\nfunction(sequential) anotherBL_ord :: \"anotherBL \\ anotherBL \\ bool\"\nwhere\n \"anotherBL_ord BLNon x = True\"\n | \"anotherBL_ord x BLNon = False\"\n | \"anotherBL_ord (BLZer x) (BLZer y) = anotherBL_ord x y\"\n | \"anotherBL_ord (BLZer x) y = True\"\n | \"anotherBL_ord x (BLZer y) = False\"\n | \"anotherBL_ord (BLOne x) (BLOne y) = anotherBL_ord x y\"\n | \"anotherBL_ord (BLOne x) y = True\"\n | \"anotherBL_ord x (BLOne y) = False\"\n | \"anotherBL_ord (BLTwo x) (BLTwo y) = anotherBL_ord x y\"\n | \"anotherBL_ord (BLTwo x) y = True\"\n | \"anotherBL_ord x (BLTwo y) = False\"\n | \"anotherBL_ord (BLThr x) (BLThr y) = anotherBL_ord x y\"\n apply simp_all\n apply (case_tac x, simp_all)\n apply (case_tac a, simp_all)\n apply (case_tac b, simp_all add: twice_bound_meta_all)[1]\n apply (case_tac b, simp_all add: twice_bound_meta_all)[1]\n apply (case_tac b, simp_all add: twice_bound_meta_all)[1]\n apply (case_tac b, simp_all add: twice_bound_meta_all)[1]\n done\n\ntermination anotherBL_ord\n apply (rule anotherBL_ord.termination)\n apply (rule wf_measure[where f=\"size_prod size size\"])\n apply simp+\n done\n\ninstantiation\n anotherBL :: ord\nbegin\n definition le_anotherBL: \"a \\ b \\ anotherBL_ord a b\"\n definition less_anotherBL: \"a < b \\ (anotherBL_ord a b \\ a \\ b)\"\n\n instance ..\nend\n\nlemma anotherBL_to_less_simps:\n \"(anotherBL_ord a b = v) \\ (a < b = (v \\ a \\ b))\"\n by (simp add: less_anotherBL)\n\nlemmas anotherBL_ords[simp] =\n anotherBL_ord.simps[folded le_anotherBL, simplified]\n anotherBL_ord.simps [THEN anotherBL_to_less_simps,\n simplified, folded less_anotherBL]\n\nlemma anotherBL_trans:\n \"\\ x \\ (y :: anotherBL); y \\ z \\ \\ x \\ z\"\n apply (rule ccontr)\n apply (erule rev_mp)+\n apply (induct y arbitrary: x z)\n apply (case_tac x, simp_all)[1]\n apply (case_tac x, simp_all(no_asm_simp))[1]\n apply (case_tac z, simp_all)[1]\n apply (case_tac x, simp_all(no_asm_simp))[1]\n apply (case_tac z, simp_all)[1]\n apply (case_tac z, simp_all)[1]\n apply (case_tac z, simp_all(no_asm_simp))[1]\n apply (case_tac x, simp_all)[1]\n apply (case_tac x, simp_all)[1]\n apply (case_tac z, simp_all(no_asm_simp))[1]\n apply (case_tac x, simp_all)[1]\n done\n\nlemma anotherBL_antisym:\n \"\\ x \\ y; (y :: anotherBL) \\ x \\ \\ x = y\"\n apply (erule rev_mp)+\n apply (induct x arbitrary: y)\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n done\n\nlemma anotherBL_total_ord:\n \"x \\ y \\ y \\ (x :: anotherBL)\"\n apply (induct x arbitrary: y)\n apply simp\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n apply (case_tac y, simp_all)[1]\n done\n\nlemma less_eq_conj_anotherBL:\n \"x < (y :: anotherBL) = (x \\ y \\ x \\ y)\"\n by (simp add: less_anotherBL le_anotherBL)\n\ninstantiation anotherBL :: linorder\nbegin\n\ninstance\n apply intro_classes\n apply (simp add: less_eq_conj_anotherBL)\n apply safe[1]\n apply (drule(1) anotherBL_antisym)\n apply simp\n apply (induct_tac x, simp_all)[1]\n apply (erule(1) anotherBL_trans)\n apply (erule(1) anotherBL_antisym)\n apply (rule anotherBL_total_ord)\n done\n\nend\n\nprimrec\n nibble_to_anbl :: \"nibble \\ anotherBL \\ anotherBL\"\nwhere\n \"nibble_to_anbl Nibble0 anbl = BLZer (BLZer anbl)\"\n| \"nibble_to_anbl Nibble1 anbl = BLZer (BLOne anbl)\"\n| \"nibble_to_anbl Nibble2 anbl = BLZer (BLTwo anbl)\"\n| \"nibble_to_anbl Nibble3 anbl = BLZer (BLThr anbl)\"\n| \"nibble_to_anbl Nibble4 anbl = BLOne (BLZer anbl)\"\n| \"nibble_to_anbl Nibble5 anbl = BLOne (BLOne anbl)\"\n| \"nibble_to_anbl Nibble6 anbl = BLOne (BLTwo anbl)\"\n| \"nibble_to_anbl Nibble7 anbl = BLOne (BLThr anbl)\"\n| \"nibble_to_anbl Nibble8 anbl = BLTwo (BLZer anbl)\"\n| \"nibble_to_anbl Nibble9 anbl = BLTwo (BLOne anbl)\"\n| \"nibble_to_anbl NibbleA anbl = BLTwo (BLTwo anbl)\"\n| \"nibble_to_anbl NibbleB anbl = BLTwo (BLThr anbl)\"\n| \"nibble_to_anbl NibbleC anbl = BLThr (BLZer anbl)\"\n| \"nibble_to_anbl NibbleD anbl = BLThr (BLOne anbl)\"\n| \"nibble_to_anbl NibbleE anbl = BLThr (BLTwo anbl)\"\n| \"nibble_to_anbl NibbleF anbl = BLThr (BLThr anbl)\"\n\nprimrec\n char_to_anbl :: \"char \\ anotherBL \\ anotherBL\"\nwhere\n \"char_to_anbl (Char nib nob) anbl = nibble_to_anbl nib (nibble_to_anbl nob anbl)\"\n\nprimrec\n string_to_anbl :: \"string \\ anotherBL\"\nwhere\n \"string_to_anbl [] = BLNon\"\n| \"string_to_anbl (chr # str) = char_to_anbl chr (string_to_anbl str)\"\n\nlemmas string_ord_simps\n = string_to_anbl.simps char_to_anbl.simps nibble_to_anbl.simps\n anotherBL_ords anotherBL.simps\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/StringOrd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2780457955695375}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory MultByAdd\nimports\n \"AutoCorres.AutoCorres\"\nbegin\n\n(* Parse the input file. *)\nexternal_file \"mult_by_add.c\"\ninstall_C_file \"mult_by_add.c\"\n\n(* Abstract the input file. *)\nautocorres [ ts_force nondet = mult_by_add ] \"mult_by_add.c\"\n\ncontext mult_by_add begin\n\n(*\n * Prove the function returns the correct result, and (simultaneously)\n * does not fail and terminates.\n *)\nlemma \"\\ \\s. True \\ mult_by_add' a b \\ \\r s. r = a * b \\!\"\n (* Unfold function definition. *)\n apply (clarsimp simp: mult_by_add'_def)\n\n (* Annotate while loop with an invariant and measure. *)\n apply (subst whileLoop_add_inv\n [where I=\"\\(a', r) s. (a' * b) + r = (a * b)\"\n and M=\"\\((a', _), s). unat a'\"])\n\n (* Run \"wp\" weakest precondition tactic, and solve verification *\n * conditions generated by it. *)\n apply wp\n apply (simp add: field_simps)\n apply unat_arith\n apply (simp add: split_def word_neq_0_conv[symmetric])\n apply (simp add: split_def | wp)+\n done\n\n(*\n * Equivalent partial-correctness proof using Simpl framework.\n *)\nlemma \"\\ \\ {s. s = t} \\ret__unsigned :== CALL mult_by_add(\\a, \\b) \\ (\\ret__unsigned = \\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\\"\n (* Unfold the body. *)\n apply vcg_step\n defer\n\n (* Annotate the while loop with an invariant and variant. *)\n apply (subst whileAnno_def)\n apply (subst whileAnno_def [symmetric,\n where I=\" \\ (\\a * \\b + \\result) = (\\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\\"\n and V=\"measure (\\s. unat (a_' s))\"])\n\n (* Solve the remaining conditions. *)\n apply vcg\n apply (fastforce intro: unat_mono simp: gt0_iff_gem1 field_simps less_1_simp scast_id)+\n done\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/examples/MultByAdd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5234203340678567, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.2780457876712683}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: Implem_lemmas.thy (Isabelle/HOL 2016-1)\n ID: $Id: Implem_lemmas.thy 132885 2016-12-23 18:41:32Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Auxiliary notions and lemmas for channel implementations.\n - message abstraction = inverse of (valid) impl, lifted to sets\n - extractable messages (those of non-confidential and \"broken\" channels)\n - lemmas for proving L2-L3 intruder refinement\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Lemmas Following from Channel Message Implementation Assumptions\\\n\ntheory Implem_lemmas\nimports Implem\nbegin\n\ntext \\These lemmas require the assumptions added in the @{locale \"valid_implem\"} locale.\\\n\ncontext semivalid_implem\nbegin\n(**************************************************************************************************)\nsubsection \\Message implementations and abstractions\\\n(**************************************************************************************************)\n\ntext \\Abstracting a set of messages into channel messages.\\\n\ndefinition\n abs :: \"msg set \\ chan set\"\nwhere\n \"abs S \\ {Chan x A B M | x A B M. M \\ payload \\ implem (Chan x A B M) \\ S}\"\n\nlemma absE [elim]: \n \"\\ X \\ abs H;\n \\ x A B M. X = Chan x A B M \\ M \\ payload \\ implem X \\ H \\ P \\\n \\ P\"\nby (auto simp add: abs_def)\n\nlemma absI [intro]: \"M \\ payload \\ implem (Chan x A B M) \\ H \\ Chan x A B M \\ abs H\"\nby (auto simp add: abs_def)\n\nlemma abs_mono: \"G \\ H \\ abs G \\ abs H\"\nby (auto simp add: abs_def)\n\nlemmas abs_monotone [simp] = abs_mono [THEN [2] rev_subsetD]\n\nlemma abs_empty [simp]: \"abs {} = {}\"\nby (auto simp add: abs_def)\n\nlemma abs_Un_eq: \"abs (G \\ H) = abs G \\ abs H\"\nby (auto simp add: abs_def)\n\ntext \\General lemmas about implementations and @{term abs}.\\\nlemma abs_insert_payload [simp]: \"M \\ payload \\ abs (insert M S) = abs S\"\nby (auto simp add: abs_def)\n\nlemma abs_insert_impl [simp]:\n \"M \\ payload \\ abs (insert (implem (Chan x A B M)) S) = insert (Chan x A B M) (abs S)\"\nby (auto simp add: abs_def)\n\nlemma extr_payload [simp, intro]:\n \"\\ X \\ extr Bad NI (abs I); NI \\ payload \\ \\ X \\ payload\"\nby (erule extr.induct, blast, auto)\n\nlemma abs_Un_LtK:\n \"K \\ range LtK \\ abs (K \\ S) = abs S\"\nby (auto simp add: abs_Un_eq)\n\nlemma abs_Un_keys_of [simp]:\n \"abs (keys_of A \\ S) = abs S\"\nby (auto intro!: abs_Un_LtK)\n\n\ntext \\Lemmas about @{term valid} and @{term abs}\\\n\nlemma abs_validSet: \"abs (S \\ valid) = abs S\"\nby (auto elim: absE intro: validI)\n\nlemma valid_abs: \"M \\ valid \\ \\ M'. M' \\ abs {M}\"\nby (auto elim: validE)\n\n\n(**************************************************************************************************)\nsubsection \\Extractable messages\\\n(**************************************************************************************************)\n\ntext \\\\extractable K I\\: subset of messages in $I$ which are implementations \n(not necessarily valid since we do not require that they are payload) and can be extracted \nusing the keys in K. It corresponds to L2 @{term extr}.\\\n\ndefinition\n extractable :: \"msg set \\ msg set \\ msg set\"\nwhere\n \"extractable K I \\\n {implInsec A B M | A B M. implInsec A B M \\ I} \\\n {implAuth A B M | A B M. implAuth A B M \\ I} \\\n {implConfid A B M | A B M. implConfid A B M \\ I \\ (A, B) \\ broken K} \\\n {implSecure A B M | A B M. implSecure A B M \\ I \\ (A, B) \\ broken K}\"\n\nlemma extractable_red: \"extractable K I \\ I\"\nby (auto simp add: extractable_def)\n\n\n\nlemma extractableE:\n \"X \\ extractable K I \\\n (\\A B M. X = implInsec A B M \\ X \\ I \\ P) \\\n (\\A B M. X = implAuth A B M \\ X \\ I \\ P) \\\n (\\A B M. X = implConfid A B M \\ X \\ I \\ (A, B) \\ broken K \\ P) \\\n (\\A B M. X = implSecure A B M \\ X \\ I \\ (A, B) \\ broken K \\ P) \\\n P\"\nby (auto simp add: extractable_def brokenI)\n\ntext \\General lemmas about implementations and extractable.\\\nlemma implem_extractable [simp]:\n \"\\ Keys_bad K Bad; implem (Chan x A B M) \\ extractable K I; M \\ payload \\ \n \\ M \\ extr Bad NI (abs I)\"\nby (erule extractableE, auto)\n\n\ntext \\Auxiliary lemmas about extractable messages: they are implementations.\\\nlemma valid_extractable [simp]: \"I \\ valid \\ extractable K I \\ valid\"\nby (auto intro: subset_trans extractable_red del: subsetI)\n\nlemma LtKeys_parts_extractable:\n \"I \\ valid \\ parts (extractable K I) \\ range LtK = {}\"\nby (auto dest: valid_extractable intro!: parts_valid_LtKeys_disjoint)\n\nlemma LtKeys_parts_extractable_elt [simp]: \n \"I \\ valid \\ LtK ltk \\ parts (extractable K I)\"\nby (blast dest: LtKeys_parts_extractable)\n\n\nlemma LtKeys_parts_implSecureSet: (* FIX: possibly problematic: not in normal form *)\n \"parts (implSecureSet Ag payload) \\ range LtK = {}\"\nby (auto intro!: parts_valid_LtKeys_disjoint intro: validI)\n\nlemma LtKeys_parts_implSecureSet_elt: \n \"LtK K \\ parts (implSecureSet Ag payload)\"\nusing LtKeys_parts_implSecureSet\nby auto\n\nlemmas LtKeys_parts = LtKeys_parts_payload parts_valid_LtKeys_disjoint\n LtKeys_parts_extractable LtKeys_parts_implSecureSet \n LtKeys_parts_implSecureSet_elt\n\n\nsubsubsection\\Partition $I$ to keep only the extractable messages\\\n(**************************************************************************************************)\n\ntext \\Partition the implementation set.\\\n\nlemma impl_partition:\n \"\\ NI \\ payload; I \\ valid \\ \\\n I \\ extractable K I \\\n implConfidSet (UNIV - broken K) payload \\\n implSecureSet (UNIV - broken K) payload\"\nby (auto dest!: subsetD [where A=I] elim!: valid_cases intro: extractableI)\n\n\nsubsubsection \\Partition of @{term \"extractable\"}\\\n(**************************************************************************************************)\n\ntext \\We partition the @{term \"extractable\"} set into insecure, confidential, authentic \nimplementations.\\\n\nlemma extractable_partition:\n \"\\Keys_bad K Bad; NI \\ payload; I \\ valid\\ \\\n extractable K I \\ \n implInsecSet (extr Bad NI (abs I)) \\\n implConfidSet UNIV (extr Bad NI (abs I)) \\\n implAuthSet (extr Bad NI (abs I)) \\\n implSecureSet UNIV (extr Bad NI (abs I))\"\napply (rule, frule valid_extractable, drule subsetD [where A=\"extractable K I\"], fast)\napply (erule valid_cases, auto)\ndone\n\n\n(**************************************************************************************************)\nsubsection \\Lemmas for proving intruder refinement (L2-L3)\\\n(**************************************************************************************************)\n\ntext \\Chain of lemmas used to prove the refinement for \\l3_dy\\. \nThe ultimate goal is to show @{prop [display] \n \"synth (analz (NI \\ I \\ K \\ Tags)) \\ synth (analz (extr Bad NI (abs I))) \\ -payload\"\n}\\\n\nsubsubsection \\First: we only keep the extractable messages\\\n\n\\ \\the \\synth\\ is probably not needed\\\nlemma analz_NI_I_K_analz_NI_EI:\nassumes HNI: \"NI \\ payload\"\n and HK: \"K \\ range LtK\"\n and HI: \"I \\ valid\"\nshows \"analz (NI \\ I \\ K \\ Tags) \\\n synth (analz (NI \\ extractable K I \\ K \\ Tags)) \\ -payload\"\nproof -\n from HNI HI\n have \"analz (NI \\ I \\ K \\ Tags) \\ \n analz (NI \\ (extractable K I \\\n implConfidSet (UNIV - broken K) payload \\\n implSecureSet (UNIV - broken K) payload)\n \\ K \\ Tags)\"\n by (intro analz_mono Un_mono impl_partition, simp_all)\n also have \"... \\ analz (implConfidSet (UNIV - broken K) payload \\\n (implSecureSet (UNIV - broken K) payload \\\n (extractable K I \\ NI \\ K \\ Tags)))\"\n by (auto)\n also have \"... \\ synth (analz (implSecureSet (UNIV - broken K) payload \\\n (extractable K I \\ NI \\ K \\ Tags))) \\ -payload\"\n proof (rule analz_Un_implConfidSet_2)\n show \"Enc_keys_clean (implSecureSet (UNIV - broken K) payload \n \\ (extractable K I \\ NI \\ K \\ Tags))\"\n by (auto simp add: HNI HI HK intro: validI)\n next\n from HK HI HNI \n show \"(UNIV - broken K) \\ \n broken (parts (\n implSecureSet (UNIV - broken K) payload \\\n (extractable K I \\ NI \\ K \\ Tags)) \\ range LtK) = {}\"\n by (auto simp add: LtKeys_parts \n LtKeys_parts_implSecureSet_elt [where Ag=\"- broken K\", simplified])\n qed (auto)\n also have \"... \\ synth (analz (extractable K I \\ NI \\ K \\ Tags)) \\ -payload\"\n proof (rule Un_least, rule synth_idem_payload)\n show \"analz (implSecureSet (UNIV - broken K) payload \\ \n (extractable K I \\ NI \\ K \\ Tags))\n \\ synth (analz (extractable K I \\ NI \\ K \\ Tags)) \\ -payload\"\n proof (rule analz_Un_implSecureSet_2)\n show \"Enc_keys_clean (extractable K I \\ NI \\ K \\ Tags)\"\n using HNI HK HI by auto\n next \n from HI HK HNI \n show \"(UNIV - broken K) \\ \n broken (parts (extractable K I \\ NI \\ K \\ Tags) \\ range LtK) = {}\"\n by (auto simp add: LtKeys_parts)\n qed (auto)\n next\n show \"-payload \\ synth (analz (extractable K I \\ NI \\ K \\ Tags)) \\ -payload\"\n by auto\n qed\n also have \"... \\ synth (analz (NI \\ extractable K I \\ K \\ Tags)) \\ -payload\"\n by (simp add: sup.left_commute sup_commute)\n finally show ?thesis .\nqed\n\n\nsubsubsection \\Only keep the extracted messages (instead of extractable)\\\n(**************************************************************************************************)\n\nlemma analz_NI_EI_K_synth_analz_NI_E_K:\nassumes HNI: \"NI \\ payload\"\n and HK: \"K \\ range LtK\"\n and HI: \"I \\ valid\"\n and Hbad: \"Keys_bad K Bad\"\nshows \"analz (NI \\ extractable K I \\ K \\ Tags)\n \\ synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\ -payload\"\nproof -\n from HNI HI Hbad\n have \"analz (NI \\ extractable K I \\ K \\ Tags) \\ \n analz (NI \\ (implInsecSet (extr Bad NI (abs I)) \\\n implConfidSet UNIV (extr Bad NI (abs I)) \\\n implAuthSet (extr Bad NI (abs I)) \\\n implSecureSet UNIV (extr Bad NI (abs I))) \\\n K \\ Tags)\"\n by (intro analz_mono Un_mono extractable_partition) (auto)\n\n also have \"... \\ analz (implInsecSet (extr Bad NI (abs I)) \\\n (implConfidSet UNIV (extr Bad NI (abs I)) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\\n (NI \\ K \\ Tags)))))\"\n by (auto)\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\\n (implConfidSet UNIV (extr Bad NI (abs I)) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags)))))) \n \\ -payload\"\n by (rule analz_Un_implInsecSet)\n (auto simp only: Un_commute [of \"extr _ _ _\" _] Un_assoc Un_absorb, \n auto simp add: HNI HK HI intro!: validI)\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags))))) \n \\ -payload\"\n proof (rule Un_least, rule synth_idem_payload)\n have \"analz (implConfidSet UNIV (extr Bad NI (abs I)) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ (K \\ extr Bad NI (abs I) \\ Tags)))))\n \\ synth (analz (extr Bad NI (abs I) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ (K \\ extr Bad NI (abs I) \\ Tags)))))) \n \\ -payload\"\n by (rule analz_Un_implConfidSet)\n (auto simp only: Un_commute [of \"extr _ _ _\" _] Un_assoc Un_absorb,\n auto simp add: HK HI HNI intro!: validI)\n then show \"analz (extr Bad NI (abs I) \\\n (implConfidSet UNIV (extr Bad NI (abs I)) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags)))))\n \\ synth (analz (extr Bad NI (abs I) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ K \\ Tags))))) \n \\ -payload\"\n by (simp add: inf_sup_aci(6) inf_sup_aci(7))\n next\n show \"-payload\n \\ synth (analz (extr Bad NI (abs I) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags))))) \n \\ -payload\"\n by blast\n qed\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags)))) \n \\ -payload\"\n proof (rule Un_least, rule synth_idem_payload)\n have \"analz (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ (K \\ (extr Bad NI (abs I) \\ Tags)))))\n \\ synth (analz (extr Bad NI (abs I) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ (K \\ (extr Bad NI (abs I) \\ Tags)))))) \n \\ -payload\"\n by (rule analz_Un_implAuthSet)\n (auto simp only: Un_commute [of \"extr _ _ _\" _] Un_assoc Un_absorb,\n auto simp add: HI HNI HK intro!: validI)\n then show \"analz (extr Bad NI (abs I) \\\n (implAuthSet (extr Bad NI (abs I)) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags))))\n \\ synth (analz (extr Bad NI (abs I) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ K \\ Tags)))) \n \\ -payload\"\n by (simp add: inf_sup_aci(6) inf_sup_aci(7))\n next\n show \"-payload\n \\ synth (analz (extr Bad NI (abs I) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \n \\ (NI \\ K \\ Tags)))) \n \\ -payload\"\n by blast\n qed\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\ (NI \\ K \\ Tags))) \n \\ -payload\"\n proof (rule Un_least, rule synth_idem_payload)\n have \"analz (implSecureSet UNIV (extr Bad NI (abs I)) \\ \n (NI \\ (K \\ (extr Bad NI (abs I) \\ Tags))))\n \\ synth (analz (extr Bad NI (abs I) \\\n (NI \\ (K \\ (extr Bad NI (abs I) \\ Tags))))) \n \\ -payload\"\n by (rule analz_Un_implSecureSet)\n (auto simp only: Un_commute [of \"extr _ _ _\" _] Un_assoc Un_absorb,\n auto simp add: HI HNI HK intro!: validI)\n then show \"analz (extr Bad NI (abs I) \\\n (implSecureSet UNIV (extr Bad NI (abs I)) \\ (NI \\ K \\ Tags)))\n \\ synth (analz (extr Bad NI (abs I) \\ (NI \\ K \\ Tags))) \n \\ -payload\"\n by (simp add: inf_sup_aci(6) inf_sup_aci(7))\n next\n show \"-payload\n \\ synth (analz (extr Bad NI (abs I)\\ (NI \\ K \\ Tags))) \n \\ -payload\"\n by blast\n qed\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\ -payload\"\n by (metis IK_subset_extr inf_sup_aci(6) set_eq_subset sup.absorb1)\n finally show ?thesis .\nqed\n\n\nsubsubsection \\Keys and Tags can be moved out of the @{term \"analz\"}\\\n\nlemma analz_LtKeys_Tag:\nassumes \"NI \\ payload\" and \"K \\ range LtK\"\nshows \"analz (NI \\ K \\ Tags) \\ analz NI \\ K \\ Tags\"\nproof \n fix X\n assume H: \"X \\ analz (NI \\ K \\ Tags) \"\n thus \"X \\ analz NI \\ K \\ Tags\" \n proof (induction X rule: analz.induct)\n case (Dec X Y) \n hence \"Enc X Y \\ payload\" using assms by auto\n moreover\n from Dec.IH(2) have \"Y \\ synth (analz NI \\ (K \\ Tags))\"\n by (auto simp add: Collect_disj_eq dest!: synth_Int2 )\n ultimately show ?case using Dec.IH(1) assms(2) \n by (auto dest!: synth_payload [THEN [2] rev_subsetD])\n next\n case (Adec_lt X Y)\n hence \"Aenc X (pubK Y) \\ payload \\ range LtK \\ Tags\" using assms\n by auto\n then show ?case by auto\n next\n case (Sign_getmsg X Y)\n hence \"Sign X (priK Y) \\ payload \\ range LtK \\ Tags\" using assms by auto\n then show ?case by auto\n next\n case (Adec_eph X Y)\n then show ?case using assms by (auto dest!: EpriK_synth)\n qed (insert assms, auto)\nqed\n\nlemma analz_NI_E_K_analz_NI_E:\n \"\\ NI \\ payload; K \\ range LtK; I \\ valid \\ \n \\ analz (extr Bad NI (abs I) \\ K \\ Tags) \\ analz (extr Bad NI (abs I)) \\ K \\ Tags\"\nby (rule analz_LtKeys_Tag) auto\n\n\nsubsubsection \\Final lemmas, using all the previous ones\\\n(**************************************************************************************************)\n\nlemma analz_NI_I_K_synth_analz_NI_E:\nassumes\n Hbad: \"Keys_bad K Bad\" and \n HNI: \"NI \\ payload\" and \n HK: \"K \\ range LtK\" and \n HI: \"I \\ valid\"\nshows \n \"analz (NI \\ I \\ K \\ Tags) \\ synth (analz (extr Bad NI (abs I))) \\ -payload\"\nproof -\n from HNI HK HI have \"analz (NI \\ I \\ K \\ Tags) \\\n synth (analz (NI \\ extractable K I \\ K \\ Tags)) \\ -payload\"\n by (rule analz_NI_I_K_analz_NI_EI)\n also have \"... \\ synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\ -payload\"\n proof (rule Un_least, simp_all)\n from Hbad HNI HK HI have \"analz (NI \\ extractable K I \\ K \\ Tags) \\\n synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\ -payload\"\n by (intro analz_NI_EI_K_synth_analz_NI_E_K)\n then show \"synth (analz (NI \\ extractable K I \\ K \\ Tags)) \\\n synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\ -payload\"\n by (rule synth_idem_payload)\n qed\n also have \"... \\ synth (analz (extr Bad NI (abs I))) \\ -payload\"\n proof (rule Un_least, simp_all)\n from HNI HK HI have \"analz (extr Bad NI (abs I) \\ K \\ Tags) \\\n analz (extr Bad NI (abs I)) \\ K \\ Tags\"\n by (rule analz_NI_E_K_analz_NI_E)\n also from HK have \"... \\ analz (extr Bad NI (abs I)) \\ -payload\"\n by auto\n also have \"... \\ synth (analz (extr Bad NI (abs I))) \\ -payload\"\n by auto\n finally show \"synth (analz (extr Bad NI (abs I) \\ K \\ Tags)) \\\n synth (analz (extr Bad NI (abs I))) \\ -payload\"\n by (rule synth_idem_payload)\n qed\n finally show ?thesis .\nqed\n\n\ntext \\Lemma actually used to prove the refinement.\\\nlemma synth_analz_NI_I_K_synth_analz_NI_E:\n \"\\ Keys_bad K Bad; NI \\ payload; K \\ range LtK; I \\ valid\\\n \\ synth (analz (NI \\ I \\ K \\ Tags)) \n \\ synth (analz (extr Bad NI (abs I))) \\ -payload\"\nby (intro synth_idem_payload analz_NI_I_K_synth_analz_NI_E) (assumption+)\n\n\nsubsubsection \\Partitioning @{term \"analz (ik)\"}\\\n(**************************************************************************************************)\ntext \\Two lemmas useful for proving the invariant\n @{term [display] \"analz ik \\ synth (analz (ik \\ payload \\ ik \\ valid \\ ik \\ range LtK \\ Tags))\"}\n\\\n\nlemma analz_Un_partition:\n \"analz S \\ synth (analz ((S \\ payload) \\ (S \\ valid) \\ (S \\ range LtK) \\ Tags)) \\\n H \\ payload \\ valid \\ range LtK \\\n analz (H \\ S) \\\n synth (analz (((H \\ S) \\ payload) \\ ((H \\ S) \\ valid) \\ ((H \\ S) \\ range LtK) \\ Tags))\"\nproof -\n assume \"H \\ payload \\ valid \\ range LtK\"\n then have HH:\"H = (H \\ payload) \\ (H \\ valid) \\ (H \\ range LtK)\"\n by auto\n assume HA:\n \"analz S \\ synth (analz ((S \\ payload) \\ (S \\ valid) \\ (S \\ range LtK) \\ Tags))\"\n then have \n \"analz (H \\ S) \\ \n synth (analz (H \\ ((S \\ payload) \\ (S \\ valid) \\ (S \\ range LtK) \\ Tags)))\"\n by (rule analz_synth_subset_Un2)\n also with HH have \n \"... \\ synth (analz (((H \\ payload) \\ (H \\ valid) \\ (H \\ range LtK)) \\ \n ((S \\ payload) \\ (S \\ valid) \\ (S \\ range LtK) \\ Tags)))\"\n by auto\n also have \"... = synth (analz (((H \\ S) \\ payload) \\ ((H \\ S) \\ valid) \\ \n ((H \\ S) \\ range LtK) \\ Tags))\"\n by (simp add: Un_left_commute sup.commute Int_Un_distrib2)\n finally show ?thesis .\nqed\n\nlemma analz_insert_partition:\n \"analz S \\ synth (analz ((S \\ payload) \\ (S \\ valid) \\ (S \\ range LtK) \\ Tags)) \\\n x \\ payload \\ valid \\ range LtK \\\n analz (insert x S) \\\n synth (analz (((insert x S) \\ payload) \\ ((insert x S) \\ valid) \\ \n ((insert x S) \\ range LtK) \\ Tags))\"\nby (simp only: insert_is_Un [of x S], erule analz_Un_partition, auto)\n\nend\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Implem_lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635841117624, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.27802408073410406}} {"text": "section \\ LTS by Hashmaps \\\ntheory RBT_DLTSImpl\nimports \"../../LTS_Impl\" \"../../DLTSByMap\"\nbegin\n\n\nsubsection \\DLTS\\\ninterpretation rs_dlts_defs: dltsbm_defs rm_ops rm_ops \n apply intro_locales\ndone\n\ntype_synonym ('V,'E) rs_dlts = \"('V, ('E, 'V) RBT.rbt) RBT.rbt\"\n\ndefinition rs_dlts_\\ :: \"('V::linorder,'E::linorder) rs_dlts \\ ('V \\ 'E \\ 'V) set\" \n where \"rs_dlts_\\ \\ rs_dlts_defs.dltsbm_\\\"\n\ndefinition \"rs_dlts_invar \\ rs_dlts_defs.dltsbm_invar\"\ndefinition \"rs_dlts_empty \\ rs_dlts_defs.dltsbm_empty\"\ndefinition \"rs_dlts_memb \\ rs_dlts_defs.dltsbm_memb\"\ndefinition \"rs_dlts_add \\ rs_dlts_defs.dltsbm_add\"\ndefinition \"rs_dlts_succ \\ rs_dlts_defs.dltsbm_succ\"\ndefinition \"rs_dlts_add_succs \\ rs_dlts_defs.dltsbm_add_succs\"\ndefinition \"rs_dlts_delete \\ rs_dlts_defs.dltsbm_delete\"\n\ndefinition \"rs_dlts_it \\ rs_dlts_defs.dltsbm_it rm_iteratei rm_iteratei\"\ndefinition \"rs_dlts_filter_it \\ rs_dlts_defs.dltsbm_filter_it rm_iteratei rm_iteratei\"\ndefinition \"rs_dlts_succ_it \\ rs_dlts_defs.dltsbm_succ_it\"\ndefinition \"rs_dlts_succ_label_it \\ rs_dlts_defs.dltsbm_succ_label_it rm_iteratei\"\ndefinition \"rs_dlts_pre_it \\ rs_dlts_defs.dltsbm_pre_it rm_iteratei\"\ndefinition \"rs_dlts_pre_label_it \\ rs_dlts_defs.dltsbm_pre_label_it rm_iteratei rm_iteratei\"\n\ndefinition \"rs_dlts_from_list \\ ltsga_from_list rs_dlts_empty rs_dlts_add\"\ndefinition \"rs_dlts_to_list \\ ltsga_to_list rs_dlts_it\"\ndefinition \"rs_dlts_from_collect_list \\ ltsga_from_collect_list rs_dlts_empty rs_dlts_add\"\ndefinition \"rs_dlts_to_collect_list \\ ltsga_to_collect_list rs_dlts_to_list\"\ndefinition \"rs_dlts_succ_ball \\ ltsga_succ_ball rs_dlts_succ_it\"\ndefinition \"rs_dlts_succ_bex \\ ltsga_succ_bex rs_dlts_succ_it\"\ndefinition \"rs_dlts_pre_ball \\ ltsga_pre_ball rs_dlts_pre_it\"\ndefinition \"rs_dlts_pre_bex \\ ltsga_pre_bex rs_dlts_pre_it\"\ndefinition \"rs_dlts_image_filter \\ ltsga_image_filter rs_dlts_empty rs_dlts_add rs_dlts_filter_it\"\ndefinition \"rs_dlts_filter \\ ltsga_filter rs_dlts_empty rs_dlts_add rs_dlts_filter_it\"\ndefinition \"rs_dlts_image \\ ltsga_image rs_dlts_image_filter\"\n\nlemmas rs_dlts_defs_raw = \n rs_dlts_defs.dltsbm_empty_def[abs_def]\n rs_dlts_defs.dltsbm_succ_def[abs_def]\n rs_dlts_defs.dltsbm_memb_def[abs_def]\n rs_dlts_defs.dltsbm_add_def[abs_def]\n rs_dlts_defs.dltsbm_add_succs_def[abs_def]\n rs_dlts_defs.dltsbm_delete_def[abs_def]\n rs_dlts_defs.dltsbm_it_alt_def\n rs_dlts_defs.dltsbm_filter_it_alt_def\n rs_dlts_defs.dltsbm_succ_it_def[abs_def]\n rs_dlts_defs.dltsbm_succ_label_it_alt_def\n rs_dlts_defs.dltsbm_pre_it_alt_def\n rs_dlts_defs.dltsbm_pre_label_it_alt_def\n ltsga_from_list_def[abs_def]\n ltsga_to_list_def[abs_def]\n ltsga_to_collect_list_def[abs_def]\n ltsga_succ_ball_def[abs_def]\n ltsga_succ_bex_def[abs_def]\n ltsga_pre_ball_def[abs_def]\n ltsga_pre_bex_def[abs_def]\n ltsga_reverse_def[abs_def]\n ltsga_image_filter_def[abs_def]\n ltsga_filter_def[abs_def]\n ltsga_image_def[abs_def]\n iterate_to_list_def[abs_def] o_def\n iterate_ball_def[abs_def] iterate_bex_def\n\nlemmas rs_dlts_defs = \n rs_dlts_\\_def\n rs_dlts_invar_def\n rs_dlts_empty_def\n rs_dlts_succ_def\n rs_dlts_memb_def\n rs_dlts_add_def\n rs_dlts_add_succs_def\n rs_dlts_delete_def\n rs_dlts_from_list_def\n rs_dlts_to_list_def\n rs_dlts_from_collect_list_def\n rs_dlts_to_collect_list_def\n rs_dlts_it_def\n rs_dlts_filter_it_def\n rs_dlts_succ_it_def\n rs_dlts_succ_label_it_def\n rs_dlts_pre_it_def\n rs_dlts_pre_label_it_def\n rs_dlts_succ_ball_def\n rs_dlts_succ_bex_def\n rs_dlts_pre_ball_def\n rs_dlts_pre_bex_def\n rs_dlts_image_filter_def\n rs_dlts_filter_def\n rs_dlts_image_def\n\nlemmas [code] = rs_dlts_defs[unfolded rs_dlts_defs_raw, simplified]\n\nlemmas rs_dlts_is_dlts_impl = rs_dlts_defs.dlts_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: dlts rs_dlts_\\ rs_dlts_invar \n using rs_dlts_is_dlts_impl .\nlemmas rs_dlts_empty_impl = rs_dlts_defs.dltsbm_empty_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: lts_empty rs_dlts_\\ rs_dlts_invar rs_dlts_empty \n using rs_dlts_empty_impl .\nlemmas rs_dlts_memb_impl = rs_dlts_defs.dltsbm_memb_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: lts_memb rs_dlts_\\ rs_dlts_invar rs_dlts_memb\n using rs_dlts_memb_impl .\nlemmas rs_dlts_add_impl = rs_dlts_defs.dltsbm_add_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: dlts_add rs_dlts_\\ rs_dlts_invar rs_dlts_add\n using rs_dlts_add_impl .\nlemmas rs_dlts_succ_impl = rs_dlts_defs.dltsbm_succ_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: dlts_succ rs_dlts_\\ rs_dlts_invar rs_dlts_succ\n using rs_dlts_succ_impl .\nlemmas rs_dlts_add_succs_impl = rs_dlts_defs.dltsbm_add_succs_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: dlts_add_succs rs_dlts_\\ rs_dlts_invar rs_dlts_add_succs\n using rs_dlts_add_succs_impl .\nlemmas rs_dlts_delete_impl = rs_dlts_defs.dltsbm_delete_correct[folded rs_dlts_defs]\ninterpretation rs_dlts: lts_delete rs_dlts_\\ rs_dlts_invar rs_dlts_delete \n using rs_dlts_delete_impl .\n\nlemmas rs_dlts_from_list_impl = \n dltsga_from_list_correct [OF rs_dlts_empty_impl rs_dlts_add_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: dlts_from_list rs_dlts_\\ rs_dlts_invar rs_dlts_from_list \n using rs_dlts_from_list_impl .\nlemmas rs_dlts_from_collect_list_impl = \n dltsga_from_collect_list_correct [OF rs_dlts_empty_impl rs_dlts_add_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: dlts_from_collect_list rs_dlts_\\ rs_dlts_invar rs_dlts_from_collect_list \n using rs_dlts_from_collect_list_impl .\n\nlemmas rs_dlts_it_impl = rs_dlts_defs.dltsbm_it_correct[folded rs_dlts_defs, \n simplified, \n OF rm.v1_iteratei_impl rm.v1_iteratei_impl,\n folded rs_dlts_defs]\ninterpretation rs_dlts: lts_iterator rs_dlts_\\ rs_dlts_invar rs_dlts_it \n using rs_dlts_it_impl .\n\ninterpretation rs_dlts: finite_lts rs_dlts_\\ rs_dlts_invar \n using ltsga_it_implies_finite[OF rs_dlts_it_impl] .\n\nlemmas rs_dlts_filter_it_impl = rs_dlts_defs.dltsbm_filter_it_correct[folded rs_dlts_defs, \n simplified, \n OF rm.v1_iteratei_impl rm.v1_iteratei_impl,\n folded rs_dlts_defs]\ninterpretation rs_dlts: lts_filter_it rs_dlts_\\ rs_dlts_invar rs_dlts_filter_it \n using rs_dlts_filter_it_impl .\n\nlemmas rs_dlts_succ_it_impl = rs_dlts_defs.dltsbm_succ_it_correct[folded rs_dlts_defs,\n simplified, \n folded rm_ops_def rs_ops_def rs_dlts_defs]\ninterpretation rs_dlts: lts_succ_it rs_dlts_\\ rs_dlts_invar rs_dlts_succ_it \n using rs_dlts_succ_it_impl .\n\nlemmas rs_dlts_succ_label_it_impl = rs_dlts_defs.dltsbm_succ_label_it_correct[folded rs_dlts_defs,\n simplified, \n OF rm.v1_iteratei_impl,\n folded rm_ops_def rs_ops_def rs_dlts_defs]\ninterpretation rs_dlts: lts_succ_label_it rs_dlts_\\ rs_dlts_invar rs_dlts_succ_label_it \n using rs_dlts_succ_label_it_impl .\n\nlemmas rs_dlts_pre_it_impl = rs_dlts_defs.dltsbm_pre_it_correct[folded rs_dlts_defs,\n simplified, \n OF rm.v1_iteratei_impl,\n folded rm_ops_def rs_ops_def rs_dlts_defs]\ninterpretation rs_dlts: lts_pre_it rs_dlts_\\ rs_dlts_invar rs_dlts_pre_it \n using rs_dlts_pre_it_impl .\n\nlemmas rs_dlts_pre_label_it_impl = rs_dlts_defs.dltsbm_pre_label_it_correct[folded rs_dlts_defs,\n simplified, \n OF rm.v1_iteratei_impl rm.v1_iteratei_impl,\n folded rm_ops_def rs_ops_def rs_dlts_defs]\ninterpretation rs_dlts: lts_pre_label_it rs_dlts_\\ rs_dlts_invar rs_dlts_pre_label_it \n using rs_dlts_pre_label_it_impl .\n\nlemmas rs_dlts_to_list_impl = ltsga_to_list_correct [OF rs_dlts_it_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_to_list rs_dlts_\\ rs_dlts_invar rs_dlts_to_list \n using rs_dlts_to_list_impl .\n\nlemmas rs_dlts_to_collect_list_impl = ltsga_to_collect_list_correct \n [OF rs_dlts_to_list_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_to_collect_list rs_dlts_\\ rs_dlts_invar rs_dlts_to_collect_list \n using rs_dlts_to_collect_list_impl .\n\nlemmas rs_dlts_succ_ball_impl = ltsga_succ_ball_correct [OF rs_dlts_succ_it_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_succ_ball rs_dlts_\\ rs_dlts_invar rs_dlts_succ_ball \n using rs_dlts_succ_ball_impl .\n\nlemmas rs_dlts_succ_bex_impl = ltsga_succ_bex_correct [OF rs_dlts_succ_it_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_succ_bex rs_dlts_\\ rs_dlts_invar rs_dlts_succ_bex \n using rs_dlts_succ_bex_impl .\n\nlemmas rs_dlts_pre_ball_impl = ltsga_pre_ball_correct [OF rs_dlts_pre_it_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_pre_ball rs_dlts_\\ rs_dlts_invar rs_dlts_pre_ball \n using rs_dlts_pre_ball_impl .\n\nlemmas rs_dlts_pre_bex_impl = ltsga_pre_bex_correct [OF rs_dlts_pre_it_impl, folded rs_dlts_defs]\ninterpretation rs_dlts: lts_pre_bex rs_dlts_\\ rs_dlts_invar rs_dlts_pre_bex \n using rs_dlts_pre_bex_impl .\n\nlemmas rs_dlts_image_filter_impl = dltsga_image_filter_correct [OF rs_dlts_empty_impl \n rs_dlts_add_impl rs_dlts_filter_it_impl, folded rs_dlts_image_filter_def]\ninterpretation rs_dlts: dlts_image_filter rs_dlts_\\ rs_dlts_invar rs_dlts_\\ rs_dlts_invar rs_dlts_image_filter\n using rs_dlts_image_filter_impl .\n\nlemmas rs_dlts_inj_image_filter_impl = dltsga_inj_image_filter_correct [OF rs_dlts_empty_impl \n rs_dlts_add_impl rs_dlts_filter_it_impl rs_dlts_is_dlts_impl, folded rs_dlts_image_filter_def]\ninterpretation rs_dlts: lts_inj_image_filter rs_dlts_\\ rs_dlts_invar \n rs_dlts_\\ rs_dlts_invar rs_dlts_image_filter\n using rs_dlts_inj_image_filter_impl .\n\nlemmas rs_dlts_filter_impl = dltsga_filter_correct [OF rs_dlts_empty_impl \n rs_dlts_add_impl rs_dlts_filter_it_impl rs_dlts_is_dlts_impl, folded rs_dlts_filter_def]\ninterpretation rs_dlts: lts_filter rs_dlts_\\ rs_dlts_invar rs_dlts_filter\n using rs_dlts_filter_impl .\n\nlemmas rs_dlts_image_impl = dltsga_image_correct [OF rs_dlts_image_filter_impl, folded rs_dlts_image_def]\ninterpretation rs_dlts: dlts_image rs_dlts_\\ rs_dlts_invar rs_dlts_\\ rs_dlts_invar rs_dlts_image\n using rs_dlts_image_impl .\n\ndefinition rs_dlts_ops :: \"('V::{linorder},'E::{linorder},('V,'E) rs_dlts) lts_ops\" where\n \"rs_dlts_ops \\ \\\n lts_op_\\ = rs_dlts_\\,\n lts_op_invar = rs_dlts_invar,\n lts_op_empty = rs_dlts_empty,\n lts_op_memb = rs_dlts_memb,\n lts_op_iterator = rs_dlts_it,\n lts_op_add = rs_dlts_add,\n lts_op_add_succs = rs_dlts_add_succs,\n lts_op_delete = rs_dlts_delete,\n lts_op_succ_ball = rs_dlts_succ_ball,\n lts_op_succ_bex = rs_dlts_succ_bex,\n lts_op_pre_ball = rs_dlts_pre_ball,\n lts_op_pre_bex = rs_dlts_pre_bex,\n lts_op_to_list = rs_dlts_to_list,\n lts_op_to_collect_list = rs_dlts_to_collect_list,\n lts_op_from_list = rs_dlts_from_list,\n lts_op_from_collect_list = rs_dlts_from_collect_list,\n lts_op_image_filter = rs_dlts_image_filter,\n lts_op_filter = rs_dlts_filter,\n lts_op_image = rs_dlts_image,\n lts_op_succ = rs_dlts_succ\\\"\n\nlemma rs_dlts_ops_unfold[code_unfold] :\n \"lts_op_\\ rs_dlts_ops = rs_dlts_\\\"\n \"lts_op_invar rs_dlts_ops = rs_dlts_invar\"\n \"lts_op_empty rs_dlts_ops = rs_dlts_empty\"\n \"lts_op_memb rs_dlts_ops = rs_dlts_memb\"\n \"lts_op_iterator rs_dlts_ops = rs_dlts_it\"\n \"lts_op_add rs_dlts_ops = rs_dlts_add\"\n \"lts_op_succ rs_dlts_ops = rs_dlts_succ\"\n \"lts_op_add_succs rs_dlts_ops = rs_dlts_add_succs\"\n \"lts_op_delete rs_dlts_ops = rs_dlts_delete\"\n \"lts_op_succ_ball rs_dlts_ops = rs_dlts_succ_ball\"\n \"lts_op_succ_bex rs_dlts_ops = rs_dlts_succ_bex\"\n \"lts_op_pre_ball rs_dlts_ops = rs_dlts_pre_ball\"\n \"lts_op_pre_bex rs_dlts_ops = rs_dlts_pre_bex\"\n \"lts_op_to_list rs_dlts_ops = rs_dlts_to_list\"\n \"lts_op_to_collect_list rs_dlts_ops = rs_dlts_to_collect_list\"\n \"lts_op_from_list rs_dlts_ops = rs_dlts_from_list\"\n \"lts_op_from_collect_list rs_dlts_ops = rs_dlts_from_collect_list\"\n \"lts_op_image_filter rs_dlts_ops = rs_dlts_image_filter\"\n \"lts_op_filter rs_dlts_ops = rs_dlts_filter\"\n by (simp_all add: rs_dlts_ops_def)\n\nlemma rs_dlts_impl: \"StdDLTS rs_dlts_ops\"\n apply (rule StdDLTS.intro)\n apply (simp_all add: rs_dlts_ops_def)\n apply unfold_locales\ndone\n\ninterpretation rs_dltsr: StdDLTS rs_dlts_ops by (rule rs_dlts_impl)\n\nend\n", "meta": {"author": "VTrelat", "repo": "Hopcroft_verif", "sha": "ede77c3a2105fd6722cf96896a297db294edf269", "save_path": "github-repos/isabelle/VTrelat-Hopcroft_verif", "path": "github-repos/isabelle/VTrelat-Hopcroft_verif/Hopcroft_verif-ede77c3a2105fd6722cf96896a297db294edf269/Isabelle/Automata_Malik_Tuerk/implementation/instantiations/RBT/RBT_DLTSImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.27799504301458494}} {"text": "section \\ Stateful-Failure Programs \\\n\ntheory utp_sfrd_prog\n imports\n \"UTP1.utp_full\"\n utp_sfrd_extchoice\nbegin\n\nsubsection \\ Conditionals \\\n\nlemma NCSP_cond_srea [closure]:\n assumes \"P is NCSP\" \"Q is NCSP\"\n shows \"P \\ b \\\\<^sub>R Q is NCSP\"\n by (rule NCSP_NSRD_intro, simp_all add: closure rdes assms unrest)\n\nsubsection \\ Guarded commands \\\n\nlemma GuardedCommR_NCSP_closed [closure]: \n assumes \"P is NCSP\"\n shows \"g \\\\<^sub>R P is NCSP\"\n by (simp add: gcmd_def closure assms)\n\nsubsection \\ Alternation \\\n\nlemma AlternateR_NCSP_closed [closure]:\n assumes \"\\ i. i \\ A \\ P(i) is NCSP\" \"Q is NCSP\"\n shows \"(if\\<^sub>R i\\A \\ g(i) \\ P(i) else Q fi) is NCSP\"\nproof (cases \"A = {}\")\n case True\n then show ?thesis\n by (simp add: assms)\nnext\n case False\n then show ?thesis\n by (simp add: AlternateR_def closure assms)\nqed\n\nlemma AlternateR_list_NCSP_closed [closure]:\n assumes \"\\ b P. (b, P) \\ set A \\ P is NCSP\" \"Q is NCSP\"\n shows \"(AlternateR_list A Q) is NCSP\"\n apply (simp add: AlternateR_list_def)\n apply (rule AlternateR_NCSP_closed)\n apply (auto simp add: assms)\n apply (metis assms(1) eq_snd_iff nth_mem)\n done\n\nsubsection \\ Specification Statement \\\n\ndefinition SpecC :: \"('a \\ 's) \\ 's upred \\ 's upred \\ ('s, 'e) action\" (\"_:[_,_]\\<^sub>C\" [999,0,0] 999) where\n[rdes_def]: \"SpecC frm pre post = \\<^bold>R\\<^sub>s([pre]\\<^sub>S\\<^sub>< \\ false \\ [frm:[post\\<^sup>>]]\\<^sub>S)\"\n\nlemma SpecC_is_NCSP [closure]: \"frm:[pre,post]\\<^sub>C is NCSP\"\n apply (simp add: SpecC_def)\n apply (rule NCSP_rdes_intro)\n apply (simp_all add: closure unrest)\n apply (rel_auto)+\n done\n\nlemma SpecC_skip: \"{}\\<^sub>v:[true,true]\\<^sub>C = Skip\"\n by (rdes_eq)\n\nlemma SpecC_false_pre: \"a:[false,q]\\<^sub>C = Chaos\"\n by (rdes_eq)\n\nlemma SpecC_false_post: \"a:[true,false]\\<^sub>C = Miracle\"\n by (rdes_eq)\n\nlemma SpecC_refine_seq:\n \"vwb_lens a \\ a:[p,q]\\<^sub>C \\ a:[p,r]\\<^sub>C ;; a:[r,q]\\<^sub>C\"\n by ((rdes_refine_split; rel_simp), metis vwb_lens.put_eq)\n\nsubsection \\ Assumptions \\\n\ndefinition AssumeCircus (\"[_]\\<^sub>C\") where\n\"[b]\\<^sub>C = b \\\\<^sub>R Skip\"\n\nlemma AssumeCircus_rdes_def [rdes_def]: \"[b]\\<^sub>C = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ false \\ [b]\\<^sub>c)\"\n unfolding AssumeCircus_def by rdes_eq\n\nlemma AssumeCircus_NCSP [closure]: \"[b]\\<^sub>C is NCSP\"\n by (simp add: AssumeCircus_def GuardedCommR_NCSP_closed NCSP_Skip)\n\nlemma AssumeCircus_AssumeR: \"Skip ;; [b]\\<^sup>\\\\<^sub>R = [b]\\<^sub>C\" \"[b]\\<^sup>\\\\<^sub>R ;; Skip = [b]\\<^sub>C\"\n by (rdes_eq)+\n\nlemma AssumeR_comp_AssumeCircus: \"P is NCSP \\ P ;; [b]\\<^sup>\\\\<^sub>R = P ;; [b]\\<^sub>C\"\n by (metis (no_types, opaque_lifting) AssumeCircus_AssumeR(1) RA1 Skip_right_unit)\n\nlemma gcmd_AssumeCircus: \n \"P is NCSP \\ b \\\\<^sub>R P = [b]\\<^sub>C ;; P\"\n by (simp add: AssumeCircus_def NCSP_implies_NSRD Skip_left_unit gcmd_seq_distr)\n\nlemma rdes_assume_pre_refine:\n assumes \"P is NCSP\"\n shows \"P \\ [b]\\<^sub>C ;; P\"\n by (rdes_refine cls: assms)\n\nsubsection \\ While Loops \\\n\nlemma NSRD_coerce_NCSP:\n \"P is NSRD \\ Skip ;; P ;; Skip is NCSP\"\n by (metis (no_types, opaque_lifting) CSP3_Skip CSP3_def CSP4_def Healthy_def NCSP_Skip NCSP_implies_CSP NCSP_intro NSRD_is_SRD RA1 SRD_seqr_closure)\n\ndefinition WhileC :: \"'s upred \\ ('s, 'e) action \\ ('s, 'e) action\" (\"while\\<^sub>C _ do _ od\") where\n\"while\\<^sub>C b do P od = Skip ;; while\\<^sub>R b do P od ;; Skip\"\n\nlemma WhileC_NCSP_closed [closure]:\n assumes \"P is NCSP\" \"P is Productive\"\n shows \"while\\<^sub>C b do P od is NCSP\"\n by (simp add: WhileC_def NSRD_coerce_NCSP assms closure)\n\ntheorem WhileC_iter_form:\n assumes \"P is NCSP\" \"P is Productive\"\n shows \"while\\<^sub>C b do P od = ([b]\\<^sub>C ;; P)\\<^sup>\\\\<^sup>C ;; [\\ b]\\<^sub>C\"\n by (simp add: WhileC_def WhileR_iter_form assms closure)\n (metis (no_types, lifting) StarC_def AssumeCircus_AssumeR(2) AssumeCircus_NCSP RA1 assms(1) csp_theory.Healthy_Sequence csp_theory.Star_Healthy csp_theory.Unit_Left sfrd_star_as_rdes_star)\n\ntheorem WhileC_rdes_def [rdes_def]:\n assumes \"P is CRC\" \"Q is CRR\" \"R is CRF\" \"$st\\ \\ Q\" \"R is R4\"\n shows \"while\\<^sub>C b do \\<^bold>R\\<^sub>s(P \\ Q \\ R) od = \n \\<^bold>R\\<^sub>s (([b]\\<^sub>c ;; R)\\<^sup>\\\\<^sup>c wp\\<^sub>r ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ (([b]\\<^sub>c ;; R)\\<^sup>\\\\<^sup>c ;; [b]\\<^sub>c ;; Q) \\ (([b]\\<^sub>c ;; R)\\<^sup>\\\\<^sup>c ;; [\\ b]\\<^sub>c))\" \n (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = ([b]\\<^sub>C ;; \\<^bold>R\\<^sub>s (P \\ Q \\ R))\\<^sup>\\\\<^sup>C ;; [\\ b]\\<^sub>C\"\n by (simp add: WhileC_iter_form assms closure unrest Productive_rdes_RR_intro)\n also have \"... = ?rhs\"\n by (simp add: rdes_def assms closure unrest rpred wp del: rea_star_wp)\n finally show ?thesis .\nqed\n\nlemma WhileC_false: \n \"P is NCSP \\ WhileC false P = Skip\"\n by (simp add: NCSP_implies_NSRD Skip_srdes_left_unit WhileC_def WhileR_false)\n\nlemma WhileC_unfold: \n assumes \"P is NCSP\" \"P is Productive\"\n shows \"WhileC b P = (P ;; WhileC b P) \\ b \\\\<^sub>R Skip\"\nproof -\n have \"WhileC b P = (Skip \\ [b]\\<^sub>C ;; P ;; ([b]\\<^sub>C ;; P)\\<^sup>\\\\<^sup>C) ;; [\\ b]\\<^sub>C\"\n by (simp add: WhileC_iter_form assms closure)\n (metis (no_types, lifting) AssumeCircus_NCSP RA1 StarC_unfold assms(1) csp_theory.Healthy_Sequence disj_upred_def)\n also have \"... = ([\\ b]\\<^sub>C \\ [b]\\<^sub>C ;; P ;; ([b]\\<^sub>C ;; P)\\<^sup>\\\\<^sup>C ;; [\\ b]\\<^sub>C)\"\n by (metis (no_types, lifting) AssumeCircus_AssumeR(1) RA1 csp_theory.Unit_self seqr_or_distl)\n also have \"... = (P ;; WhileC b P) \\ b \\\\<^sub>R Skip\"\n by (metis (no_types, lifting) AssumeCircus_AssumeR(2) NCSP_implies_NSRD RA1 WhileC_NCSP_closed WhileC_iter_form assms(1) assms(2) cond_srea_AssumeR_form csp_theory.Healthy_Sequence csp_theory.Healthy_Unit csp_theory.Unit_Left uinf_or utp_pred_laws.sup_commute)\n finally show ?thesis .\nqed\n\nsubsection \\ Iteration Construction \\\n\ndefinition IterateC :: \"'a set \\ ('a \\ 's upred) \\ ('a \\ ('s, 'e) action) \\ ('s, 'e) action\"\nwhere [upred_defs, ndes_simp]: \"IterateC A g P = while\\<^sub>C (\\ i\\A \\ g(i)) do (if\\<^sub>R i\\A \\ g(i) \\ P(i) fi) od\"\n\nlemma IterateC_IterateR_def: \"IterateC A g P = Skip ;; IterateR A g P ;; Skip\"\n by (simp add: IterateC_def IterateR_def WhileC_def)\n\ndefinition IterateC_list :: \"('s upred \\ ('s, 'e) action) list \\ ('s, 'e) action\" where \n[upred_defs, ndes_simp]:\n \"IterateC_list xs = IterateC {0.. i. map fst xs ! i) (\\ i. map snd xs ! i)\"\n\nsyntax\n \"_iter_C\" :: \"pttrn \\ logic \\ logic \\ logic \\ logic\" (\"do\\<^sub>C _\\_ \\ _ \\ _ od\")\n \"_iter_gcommC\" :: \"gcomms \\ logic\" (\"do\\<^sub>C/ _ /od\")\n\ntranslations\n \"_iter_C x A g P\" => \"CONST IterateC A (\\ x. g) (\\ x. P)\"\n \"_iter_C x A g P\" <= \"CONST IterateC A (\\ x. g) (\\ x'. P)\"\n \"_iter_gcommC cs\" \\ \"CONST IterateC_list cs\"\n \"_iter_gcommC (_gcomm_show cs)\" \\ \"CONST IterateC_list cs\"\n\nlemma IterateC_NCSP_closed [closure]:\n assumes \n \"\\ i. i \\ I \\ P(i) is NCSP\" \n \"\\ i. i \\ I \\ P(i) is Productive\"\n shows \"do\\<^sub>C i\\I \\ g(i) \\ P(i) od is NCSP\"\n by (simp add: IterateC_IterateR_def IterateR_NSRD_closed NCSP_implies_NSRD NSRD_coerce_NCSP assms(1) assms(2))\n\nlemma IterateC_list_NCSP_closed [closure]:\n assumes \n \"\\ b P. (b, P) \\ set A \\ P is NCSP\"\n \"\\ b P. (b, P) \\ set A \\ P is Productive\"\n shows \"IterateC_list A is NCSP\"\n apply (simp add: IterateC_list_def, rule IterateC_NCSP_closed)\n apply (metis assms atLeastLessThan_iff nth_map nth_mem prod.collapse)+\n done\n\nlemma IterateC_list_alt_def:\n \"IterateC_list xs = while\\<^sub>C (\\ b \\ set(map fst xs) \\ b) do AlternateR_list xs Chaos od\"\nproof -\n have \"(\\ i \\ {0.. (map fst xs) ! i) = (\\ b \\ set(map fst xs) \\ b)\"\n by (rel_auto, metis fst_conv in_set_conv_nth nth_map)\n thus ?thesis\n by (simp add: IterateC_list_def IterateC_def AlternateR_list_def)\nqed\n\nlemma IterateC_empty: \n \"do\\<^sub>C i\\{} \\ g(i) \\ P(i) od = Skip\"\n by (simp add: IterateC_IterateR_def IterateR_empty closure Skip_srdes_left_unit)\n\nlemma IterateC_singleton: \n assumes \"P k is NCSP\" \"P k is Productive\"\n shows \"do\\<^sub>C i\\{k} \\ g(i) \\ P(i) od = while\\<^sub>C g(k) do P(k) od\" (is \"?lhs = ?rhs\")\n by (simp add: IterateC_IterateR_def IterateR_singleton NCSP_implies_NSRD WhileC_def assms)\n\nlemma IterateC_outer_refine_intro:\n assumes \"I \\ {}\" \"\\ i. i \\ I \\ P i is NCSP\" \"\\ i. i \\ I \\ P i is Productive\"\n \"\\ i. i \\ I \\ S \\ (b i \\\\<^sub>R P i ;; S)\" \"S is NCSP\"\n \"S \\ [\\ (\\ i \\ I \\ b i)]\\<^sup>\\\\<^sub>R\"\n shows \"S \\ do\\<^sub>C i\\I \\ b(i) \\ P(i) od\"\nproof -\n have \"S \\ do\\<^sub>R i\\I \\ b(i) \\ P(i) od\"\n by (simp add: IterateR_outer_refine_intro NCSP_implies_NSRD assms)\n thus ?thesis\n unfolding IterateC_IterateR_def\n by (metis (full_types) Skip_left_unit Skip_right_unit assms(5) urel_dioid.mult_isol urel_dioid.mult_isor)\nqed\n\nlemma IterateC_outer_refine_init_intro:\n assumes \n \"\\ i. i \\ A \\ P i is NCSP\" \n \"\\ i. i \\ A \\ P i is Productive\" \n \"S is NCSP\" \"I is NCSP\"\n \"S \\ I ;; [\\ (\\ i \\ A \\ b i)]\\<^sup>\\\\<^sub>R\"\n \"\\ i. i \\ A \\ S \\ S ;; b i \\\\<^sub>R P i\"\n \"\\ i. i \\ A \\ S \\ I ;; b i \\\\<^sub>R P i\"\n shows \"S \\ I ;; do\\<^sub>C i\\A \\ b(i) \\ P(i) od\"\nproof (cases \"A = {}\")\n case True\n with assms(5) show ?thesis \n by (simp add: IterateC_empty assms closure Skip_right_unit AssumeR_true NSRD_right_unit)\nnext\n case False\n have \"S \\ I ;; do\\<^sub>R i\\A \\ b(i) \\ P(i) od\"\n by (simp add: IterateR_outer_refine_init_intro NCSP_implies_NSRD assms False)\n thus ?thesis\n unfolding IterateC_IterateR_def\n by (metis (no_types, opaque_lifting) RA1 Skip_right_unit assms(3) assms(4) urel_dioid.mult_isor) \nqed\n\n\nlemma IterateC_list_outer_refine_intro:\n assumes \n \"A \\ []\" \"S is NCSP\"\n \"\\ b P. (b, P) \\ set A \\ P is NCSP\"\n \"\\ b P. (b, P) \\ set A \\ P is Productive\"\n \"\\ b P. (b, P) \\ set A \\ S \\ (b \\\\<^sub>R P ;; S)\"\n \"S \\ [\\ (\\ (b, P) \\ set A \\ b)]\\<^sup>\\\\<^sub>R\" \n shows \"S \\ IterateC_list A\"\nproof -\n have \"(\\ i \\ {0.. (map fst A) ! i) = (\\ (b, P) \\ set A \\ b)\"\n by (rel_auto, metis nth_mem prod.exhaust_sel, metis fst_conv in_set_conv_nth nth_map)\n thus ?thesis\n apply (simp add: IterateC_list_def)\n apply (rule IterateC_outer_refine_intro)\n apply (simp_all add: closure assms)\n apply (metis assms(3) nth_mem prod.collapse)\n apply (metis assms(4) nth_mem prod.collapse)\n done\nqed\n\nlemma IterateC_list_outer_refine_init_intro:\n assumes \n \"S is NCSP\" \"I is NCSP\"\n \"\\ b P. (b, P) \\ set A \\ P is NCSP\"\n \"\\ b P. (b, P) \\ set A \\ P is Productive\"\n \"S \\ I ;; [\\ (\\ (b, P) \\ set A \\ b)]\\<^sup>\\\\<^sub>R\"\n \"\\ b P. (b, P) \\ set A \\ S \\ S ;; b \\\\<^sub>R P\"\n \"\\ b P. (b, P) \\ set A \\ S \\ I ;; b \\\\<^sub>R P\" \n shows \"S \\ I ;; IterateC_list A\"\nproof -\n have \"(\\ i \\ {0.. (map fst A) ! i) = (\\ (b, P) \\ set A \\ b)\"\n by (rel_auto, metis nth_mem prod.exhaust_sel, metis fst_conv in_set_conv_nth nth_map)\n thus ?thesis\n apply (simp add: IterateC_list_def)\n apply (rule IterateC_outer_refine_init_intro)\n apply (simp_all add: closure assms)\n apply (metis assms(3) nth_mem prod.collapse)\n apply (metis assms(4) nth_mem prod.collapse)\n done\nqed\n\nsubsection \\ Assignment \\\n\ndefinition AssignsCSP :: \"'\\ usubst \\ ('\\, '\\) action\" (\"\\_\\\\<^sub>C\") where\n[upred_defs]: \"AssignsCSP \\ = \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S))\" \n\nabbreviation \"AssignCSP x v \\ \\<^bold>R\\<^sub>s([&\\<^bold>v \\\\<^sub>u \\\\\\<^bsub>x\\<^esub>\\]\\<^sub>S\\<^sub>< \\ false \\ \\(true,[x \\\\<^sub>s v], \\[]\\))\"\n\nsyntax\n \"_assigns_csp\" :: \"svids \\ uexprs \\ logic\" (\"'(_') :=\\<^sub>C '(_')\") \n \"_assigns_csp\" :: \"svids \\ uexprs \\ logic\" (infixr \":=\\<^sub>C\" 64)\n\ntranslations\n \"_assigns_csp xs vs\" => \"CONST AssignsCSP (_mk_usubst id\\<^sub>s xs vs)\"\n \"_assigns_csp x v\" <= \"CONST AssignsCSP (CONST subst_upd id\\<^sub>s x v)\"\n \"_assigns_csp x v\" <= \"_assigns_csp (_spvar x) v\"\n \"x,y :=\\<^sub>C u,v\" <= \"CONST AssignsCSP (CONST subst_upd (CONST subst_upd (id\\<^sub>s) (CONST pr_var x) u) (CONST pr_var y) v)\"\n\nlemma preR_AssignsCSP [rdes]: \"pre\\<^sub>R(\\\\\\\\<^sub>C) = true\\<^sub>r\"\n by (rel_auto)\n\nlemma periR_AssignsCSP [rdes]: \"peri\\<^sub>R(\\\\\\\\<^sub>C) = false\"\n by (rel_auto)\n\nlemma postR_AssignsCSP [rdes]: \"post\\<^sub>R(\\\\\\\\<^sub>C) = \\(true,\\,\\[]\\)\"\n by (rel_auto)\n\nlemma AssignsCSP_rdes_def [rdes_def] : \"\\\\\\\\<^sub>C = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ false \\ \\(true,\\,\\[]\\))\"\n by (rel_auto)\n\nlemma AssignsCSP_CSP [closure]: \"\\\\\\\\<^sub>C is CSP\"\n by (simp add: AssignsCSP_def RHS_tri_design_is_SRD unrest)\n\nlemma AssignsCSP_CSP3 [closure]: \"\\\\\\\\<^sub>C is CSP3\"\n by (rule CSP3_intro, simp add: closure, rel_auto)\n\nlemma AssignsCSP_CSP4 [closure]: \"\\\\\\\\<^sub>C is CSP4\"\n by (rule CSP4_intro, simp add: closure, rel_auto+)\n\nlemma AssignsCSP_NCSP [closure]: \"\\\\\\\\<^sub>C is NCSP\"\n by (simp add: AssignsCSP_CSP AssignsCSP_CSP3 AssignsCSP_CSP4 NCSP_intro)\n\nlemma AssignsCSP_ICSP [closure]: \"\\\\\\\\<^sub>C is ICSP\"\n apply (rule ICSP_intro, simp add: closure, simp add: rdes_def)\n apply (rule ISRD1_rdes_intro)\n apply (simp_all add: closure)\n apply (rel_auto)\ndone\n\nlemma unproductive_AssignsCSP: \"\\ (\\\\\\\\<^sub>C is Productive)\"\n unfolding rdes_def by (rule unproductive_form, simp_all add: closure, rel_auto+)\n\nlemma AssignsCSP_as_AssignsR: \"\\\\\\\\<^sub>R ;; Skip = \\\\\\\\<^sub>C\"\n by (rdes_eq)\n\nlemma AssignC_init_refine_intro:\n assumes \n \"vwb_lens x\" \"$st:x \\ P\\<^sub>2\" \"$st:x \\ P\\<^sub>3\"\n \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q is NCSP\"\n \"\\<^bold>R\\<^sub>s([&x =\\<^sub>u \\k\\]\\<^sub>S\\<^sub>< \\ P\\<^sub>2 \\ P\\<^sub>3) \\ Q\"\n shows \"\\<^bold>R\\<^sub>s(true\\<^sub>r \\ P\\<^sub>2 \\ P\\<^sub>3) \\ (x :=\\<^sub>C \\k\\) ;; Q\"\n by (simp add: AssignsCSP_as_AssignsR[THEN sym] assms seqr_assoc Skip_left_unit AssignR_init_refine_intro closure)\n\nlemma AssignsCSP_refines_sinv: \n assumes \"`\\ \\ b`\"\n shows \"sinv\\<^sub>R(b) \\ \\\\\\\\<^sub>C\"\n apply (rdes_refine_split)\n apply (simp_all)\n apply (metis rea_st_cond_true st_cond_conj utp_pred_laws.inf.absorb_iff2 utp_pred_laws.inf_top_left)\n using assms apply (rel_auto)\n done\n\nsubsection \\ Assignment with update \\\n\ntext \\ There are different collections that we would like to assign to, but they all have different\n types and perhaps more importantly different conditions on the update being well defined. For example,\n for a list well-definedness equates to the index being less than the length etc. Thus we here set\n up a polymorphic constant for CSP assignment updates that can be specialised to different types. \\\n \ndefinition AssignCSP_update :: \n \"('f \\ 'k set) \\ ('f \\ 'k \\ 'v \\ 'f) \\ ('f \\ '\\) \\ \n ('k, '\\) uexpr \\ ('v, '\\) uexpr \\ ('\\, '\\) action\" where\n[upred_defs,rdes_def]: \"AssignCSP_update domf updatef x k v = \n \\<^bold>R\\<^sub>s([k \\\\<^sub>u uop domf (&x)]\\<^sub>S\\<^sub>< \\ false \\ \\(true,[x \\\\<^sub>s trop updatef (&x) k v], \\[]\\))\"\n\ntext \\ All different assignment updates have the same syntax; the type resolves which implementation\n to use. \\\n \nsyntax\n \"_csp_assign_upd\" :: \"svid \\ logic \\ logic \\ logic\" (\"_[_] :=\\<^sub>C _\" [61,0,62] 62)\n\ntranslations\n \"_csp_assign_upd x k v\" == \"CONST AssignCSP_update (CONST Relation_Toolkit.dom) (CONST uupd) x k v\"\n\nlemma AssignCSP_update_CSP [closure]:\n \"AssignCSP_update domf updatef x k v is CSP\"\n by (simp add: AssignCSP_update_def RHS_tri_design_is_SRD unrest)\n \nlemma preR_AssignCSP_update [rdes]: \n \"pre\\<^sub>R(AssignCSP_update domf updatef x k v) = [k \\\\<^sub>u uop domf (&x)]\\<^sub>S\\<^sub><\"\n by (rel_auto)\n\nlemma periR_AssignCSP_update [rdes]:\n \"peri\\<^sub>R(AssignCSP_update domf updatef x k v) = [k \\\\<^sub>u uop domf (&x)]\\<^sub>S\\<^sub><\"\n by (rel_simp)\n\nlemma post_AssignCSP_update [rdes]:\n \"post\\<^sub>R(AssignCSP_update domf updatef x k v) = \n (\\(true,[x \\\\<^sub>s trop updatef (&x) k v],\\[]\\) \\ (k \\\\<^sub>u uop domf (&x)) \\\\<^sub>R R1(true))\"\n by (rel_auto) \n\nlemma AssignCSP_update_NCSP [closure]:\n \"(AssignCSP_update domf updatef x k v) is NCSP\"\nproof (rule NCSP_intro)\n show \"(AssignCSP_update domf updatef x k v) is CSP\"\n by (simp add: closure)\n show \"(AssignCSP_update domf updatef x k v) is CSP3\"\n by (rule CSP3_SRD_intro, simp_all add: csp_do_def closure rdes unrest)\n show \"(AssignCSP_update domf updatef x k v) is CSP4\"\n by (rule CSP4_tri_intro, simp_all add: csp_do_def closure rdes unrest, rel_auto)\nqed\n\nsubsection \\ State abstraction \\\n\nlemma ref_unrest_abs_st [unrest]:\n \"$ref \\ P \\ $ref \\ \\P\\\\<^sub>S\"\n \"$ref\\ \\ P \\ $ref\\ \\ \\P\\\\<^sub>S\"\n by (rel_simp)+\n \nlemma NCSP_state_srea [closure]: \"P is NCSP \\ state 'a \\ P is NCSP\"\n apply (rule NCSP_NSRD_intro)\n apply (simp_all add: closure rdes)\n apply (simp_all add: state_srea_def unrest closure)\ndone\n\nsubsection \\ Guards \\\n\ndefinition GuardCSP ::\n \"'\\ cond \\\n ('\\, '\\) action \\\n ('\\, '\\) action\" where\n[upred_defs]: \"GuardCSP g A = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R(A)) \\ ((\\g\\\\<^sub>S\\<^sub>< \\ cmt\\<^sub>R(A)) \\ (\\\\ g\\\\<^sub>S\\<^sub><) \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n\nsyntax\n \"_GuardCSP\" :: \"logic \\ logic \\ logic\" (infixr \"&\\<^sub>C\" 60)\n\ntranslations\n \"_GuardCSP b P\" == \"CONST GuardCSP b P\"\n\nlemma Guard_tri_design:\n \"g &\\<^sub>C P = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P) \\ (peri\\<^sub>R(P) \\ \\g\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)) \\ (\\g\\\\<^sub>S\\<^sub>< \\ post\\<^sub>R(P)))\"\nproof -\n have \"(\\g\\\\<^sub>S\\<^sub>< \\ cmt\\<^sub>R P \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\) = (peri\\<^sub>R(P) \\ \\g\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)) \\ (\\g\\\\<^sub>S\\<^sub>< \\ post\\<^sub>R(P))\"\n by (rel_auto)\n thus ?thesis by (simp add: GuardCSP_def)\nqed\n\nlemma csp_do_cond_conj:\n assumes \"P is CRR\"\n shows \"(\\b\\\\<^sub>S\\<^sub>< \\ P) = \\(b, id\\<^sub>s, \\[]\\) ;; P\"\nproof -\n have \"(\\b\\\\<^sub>S\\<^sub>< \\ CRR(P)) = \\(b, id\\<^sub>s, \\[]\\) ;; CRR(P)\"\n by (rel_auto)\n thus ?thesis\n by (simp add: Healthy_if assms)\nqed\n \nlemma Guard_rdes_def [rdes_def]:\n assumes \"P is RR\" \"Q is CRR\" \"R is CRR\"\n shows \"g &\\<^sub>C \\<^bold>R\\<^sub>s(P \\ Q \\ R) = \\<^bold>R\\<^sub>s (([g]\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ ((\\(g, id\\<^sub>s, \\[]\\) ;; Q) \\ \\(\\g,\\[]\\,{}\\<^sub>u)) \\ (\\(g, id\\<^sub>s, \\[]\\) ;; R))\"\n (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = \\<^bold>R\\<^sub>s ((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ ((P \\\\<^sub>r Q) \\ \\g\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)) \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\\\<^sub>r R)))\"\n by (simp add: Guard_tri_design rdes assms closure)\n also have \"... = \\<^bold>R\\<^sub>s (([g]\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ ((\\g\\\\<^sub>S\\<^sub>< \\ Q) \\ \\(\\g,\\[]\\,{}\\<^sub>u)) \\ (\\g\\\\<^sub>S\\<^sub>< \\ R))\"\n by (rel_auto)\n also have \"... = \\<^bold>R\\<^sub>s (([g]\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ ((\\(g, id\\<^sub>s, \\[]\\) ;; Q) \\ \\(\\g,\\[]\\,{}\\<^sub>u)) \\ (\\(g, id\\<^sub>s, \\[]\\) ;; R))\"\n by (simp add: assms(2) assms(3) csp_do_cond_conj)\n finally show ?thesis .\nqed\n\nlemma Guard_rdes_def':\n assumes \"$ok\\ \\ P\"\n shows \"g &\\<^sub>C (\\<^bold>R\\<^sub>s(P \\ Q)) = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ (\\g\\\\<^sub>S\\<^sub>< \\ Q \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\nproof -\n have \"g &\\<^sub>C (\\<^bold>R\\<^sub>s(P \\ Q)) = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R (\\<^bold>R\\<^sub>s (P \\ Q))) \\ (\\g\\\\<^sub>S\\<^sub>< \\ cmt\\<^sub>R (\\<^bold>R\\<^sub>s (P \\ Q)) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: GuardCSP_def)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ (\\g\\\\<^sub>S\\<^sub>< \\ R1(R2c(cmt\\<^sub>s \\ (P \\ Q))) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: rea_pre_RHS_design rea_cmt_RHS_design)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ R1(R2c(\\g\\\\<^sub>S\\<^sub>< \\ R1(R2c(cmt\\<^sub>s \\ (P \\ Q))) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\)))\"\n by (metis (no_types, lifting) RHS_design_export_R1 RHS_design_export_R2c)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ R1(R2c(\\g\\\\<^sub>S\\<^sub>< \\ (cmt\\<^sub>s \\ (P \\ Q)) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\)))\"\n by (simp add: R1_R2c_commute R1_disj R1_extend_conj' R1_idem R2c_and R2c_disj R2c_idem)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ (\\g\\\\<^sub>S\\<^sub>< \\ (cmt\\<^sub>s \\ (P \\ Q)) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (metis (no_types, lifting) RHS_design_export_R1 RHS_design_export_R2c)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ cmt\\<^sub>s \\ (\\g\\\\<^sub>S\\<^sub>< \\ (cmt\\<^sub>s \\ (P \\ Q)) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: rdes_export_cmt)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ cmt\\<^sub>s \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: usubst)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r R1(R2c(pre\\<^sub>s \\ P))) \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: rdes_export_cmt)\n also from assms have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r (pre\\<^sub>s \\ P)) \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (rel_auto)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>s \\ P)\\true,false/$ok,$wait\\ \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: rdes_export_pre)\n also from assms have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r P)\\true,false/$ok,$wait\\ \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (rel_auto)\n also from assms have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ (\\g\\\\<^sub>S\\<^sub>< \\ (P \\ Q) \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (simp add: rdes_export_pre)\n also have \"... = \\<^bold>R\\<^sub>s((\\g\\\\<^sub>S\\<^sub>< \\\\<^sub>r P) \\ (\\g\\\\<^sub>S\\<^sub>< \\ Q \\ \\\\g\\\\<^sub>S\\<^sub>< \\ $tr\\ =\\<^sub>u $tr \\ $wait\\))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis .\nqed\n\nlemma CSP_Guard [closure]: \"b &\\<^sub>C P is CSP\"\n by (simp add: GuardCSP_def, rule RHS_design_is_SRD, simp_all add: unrest)\n\nlemma preR_Guard [rdes]: \"P is CSP \\ pre\\<^sub>R(b &\\<^sub>C P) = ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P)\"\n by (simp add: Guard_tri_design rea_pre_RHS_design usubst unrest R2c_preR R2c_lift_state_pre\n R2c_rea_impl R1_rea_impl R1_preR Healthy_if, rel_auto)\n\nlemma periR_Guard [rdes]:\n assumes \"P is NCSP\"\n shows \"peri\\<^sub>R(b &\\<^sub>C P) = (peri\\<^sub>R P \\ b \\\\<^sub>R \\(true,\\[]\\,{}\\<^sub>u))\"\nproof -\n have \"peri\\<^sub>R(b &\\<^sub>C P) = ((\\b\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P) \\\\<^sub>r (peri\\<^sub>R P \\ \\b\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)))\"\n by (simp add: assms Guard_tri_design rea_peri_RHS_design usubst unrest R1_rea_impl R2c_rea_not \n R2c_rea_impl R2c_preR R2c_periR R2c_tr'_minus_tr R2c_lift_state_pre R2c_condr closure\n Healthy_if R1_cond R1_tr'_eq_tr)\n also have \"... = ((pre\\<^sub>R P \\\\<^sub>r peri\\<^sub>R P) \\ \\b\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr))\"\n by (rel_auto)\n also have \"... = (peri\\<^sub>R P \\ \\b\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr))\" \n by (simp add: SRD_peri_under_pre add: unrest closure assms)\n finally show ?thesis\n by rel_auto\nqed\n \nlemma postR_Guard [rdes]:\n assumes \"P is NCSP\"\n shows \"post\\<^sub>R(b &\\<^sub>C P) = ([b]\\<^sub>S\\<^sub>< \\ post\\<^sub>R P)\"\nproof -\n have \"post\\<^sub>R(b &\\<^sub>C P) = ((\\b\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P) \\\\<^sub>r (\\b\\\\<^sub>S\\<^sub>< \\ post\\<^sub>R P))\"\n by (simp add: Guard_tri_design rea_post_RHS_design usubst unrest R2c_rea_not R2c_and R2c_rea_impl\n R2c_preR R2c_postR R2c_tr'_minus_tr R2c_lift_state_pre R2c_condr R1_rea_impl R1_extend_conj'\n R1_post_SRD closure assms)\n also have \"... = (\\b\\\\<^sub>S\\<^sub>< \\ (pre\\<^sub>R P \\\\<^sub>r post\\<^sub>R P))\"\n by (rel_auto)\n also have \"... = (\\b\\\\<^sub>S\\<^sub>< \\ post\\<^sub>R P)\"\n by (simp add: SRD_post_under_pre add: unrest closure assms)\n also have \"... = ([b]\\<^sub>S\\<^sub>< \\ post\\<^sub>R P)\"\n by (metis CSP_Guard R1_extend_conj R1_post_SRD calculation rea_st_cond_def) \n finally show ?thesis .\nqed\n \nlemma CSP3_Guard [closure]:\n assumes \"P is CSP\" \"P is CSP3\"\n shows \"b &\\<^sub>C P is CSP3\"\nproof -\n from assms have 1:\"$ref \\ P\\false/$wait\\\"\n by (simp add: CSP_Guard CSP3_iff)\n hence \"$ref \\ pre\\<^sub>R (P\\0/$tr\\)\" \"$ref \\ pre\\<^sub>R P\" \"$ref \\ cmt\\<^sub>R P\"\n by (pred_blast)+\n hence \"$ref \\ (b &\\<^sub>C P)\\false/$wait\\\"\n by (simp add: CSP3_iff GuardCSP_def RHS_def R1_def R2c_def R2s_def R3h_def design_def unrest usubst)\n thus ?thesis\n by (metis CSP3_intro CSP_Guard)\nqed\n\nlemma CSP4_Guard [closure]:\n assumes \"P is NCSP\"\n shows \"b &\\<^sub>C P is CSP4\"\nproof (rule CSP4_tri_intro[OF CSP_Guard])\n show \"(\\\\<^sub>r pre\\<^sub>R (b &\\<^sub>C P)) ;; R1 true = (\\\\<^sub>r pre\\<^sub>R (b &\\<^sub>C P))\"\n proof -\n have a:\"(\\\\<^sub>r pre\\<^sub>R P) ;; R1 true = (\\\\<^sub>r pre\\<^sub>R P)\"\n by (simp add: CSP4_neg_pre_unit assms closure)\n have \"(\\\\<^sub>r ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P)) ;; R1 true = (\\\\<^sub>r ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P))\"\n proof -\n have 1:\"(\\\\<^sub>r ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P)) = ([b]\\<^sub>S\\<^sub>< \\ (\\\\<^sub>r pre\\<^sub>R P))\"\n by (rel_auto)\n also have 2:\"... = ([b]\\<^sub>S\\<^sub>< \\ ((\\\\<^sub>r pre\\<^sub>R P) ;; R1 true))\"\n by (simp add: a)\n also have 3:\"... = (\\\\<^sub>r ([b]\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P)) ;; R1 true\"\n by (rel_auto)\n finally show ?thesis ..\n qed\n thus ?thesis\n by (simp add: preR_Guard periR_Guard NSRD_CSP4_intro closure assms unrest)\n qed\n show \"$st\\ \\ peri\\<^sub>R (b &\\<^sub>C P)\"\n by (simp add: preR_Guard periR_Guard NSRD_CSP4_intro closure assms unrest)\n show \"$ref\\ \\ post\\<^sub>R (b &\\<^sub>C P)\"\n by (simp add: preR_Guard postR_Guard NSRD_CSP4_intro closure assms unrest)\nqed\n\nlemma NCSP_Guard [closure]:\n assumes \"P is NCSP\"\n shows \"b &\\<^sub>C P is NCSP\"\nproof -\n have \"P is CSP\"\n using NCSP_implies_CSP assms by blast\n then show ?thesis\n by (metis (no_types) CSP3_Guard CSP3_commutes_CSP4 CSP4_Guard CSP4_Idempotent CSP_Guard Healthy_Idempotent Healthy_def NCSP_def assms comp_apply)\nqed\n\nlemma Productive_Guard [closure]:\n assumes \"P is CSP\" \"P is Productive\" \"$wait\\ \\ pre\\<^sub>R(P)\"\n shows \"b &\\<^sub>C P is Productive\"\nproof -\n have \"b &\\<^sub>C P = b &\\<^sub>C \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ (post\\<^sub>R(P) \\ $tr <\\<^sub>u $tr\\))\"\n by (metis Healthy_def Productive_form assms(1) assms(2))\n also have \"... =\n \\<^bold>R\\<^sub>s ((\\b\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P) \\\n ((pre\\<^sub>R P \\\\<^sub>r peri\\<^sub>R P) \\ \\b\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)) \\ (\\b\\\\<^sub>S\\<^sub>< \\ (pre\\<^sub>R P \\\\<^sub>r post\\<^sub>R P \\ $tr\\ >\\<^sub>u $tr)))\"\n by (simp add: Guard_tri_design rea_pre_RHS_design rea_peri_RHS_design rea_post_RHS_design unrest assms\n usubst R1_preR Healthy_if R1_rea_impl R1_peri_SRD R1_extend_conj' R2c_preR R2c_not R2c_rea_impl \n R2c_periR R2c_postR R2c_and R2c_tr_less_tr' R1_tr_less_tr') \n also have \"... = \\<^bold>R\\<^sub>s ((\\b\\\\<^sub>S\\<^sub>< \\\\<^sub>r pre\\<^sub>R P) \\ (peri\\<^sub>R P \\ \\b\\\\<^sub>S\\<^sub>< \\ ($tr\\ =\\<^sub>u $tr)) \\ ((\\b\\\\<^sub>S\\<^sub>< \\ post\\<^sub>R P) \\ $tr\\ >\\<^sub>u $tr))\"\n by (rel_auto)\n also have \"... = Productive(b &\\<^sub>C P)\"\n by (simp add: Productive_def Guard_tri_design RHS_tri_design_par unrest)\n finally show ?thesis\n by (simp add: Healthy_def')\nqed\n\nlemma Guard_refines_sinv: \n assumes \"P is NCSP\" \"sinv\\<^sub>R(b) \\ P\"\n shows \"sinv\\<^sub>R(b) \\ g &\\<^sub>C P\"\nproof -\n from assms\n have \"\\<^bold>R\\<^sub>s([b]\\<^sub>S\\<^sub>< \\ R1 true \\ [b]\\<^sub>S\\<^sub>>) \\ \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P))\"\n by (simp add: rdes_def NCSP_implies_CSP SRD_reactive_tri_design)\n thus ?thesis\n apply (simp add: RHS_tri_design_refine' closure unrest assms)\n apply (safe)\n apply (rdes_refine cls: assms(1))\n done\nqed\n\nsubsection \\ Basic events\\\n\ndefinition do\\<^sub>u ::\n \"('\\, '\\) uexpr \\ ('\\, '\\) action\" where\n[upred_defs]: \"do\\<^sub>u e = (($tr\\ =\\<^sub>u $tr \\ \\e\\\\<^sub>S\\<^sub>< \\\\<^sub>u $ref\\) \\ $wait\\ \\ U($tr\\ = $tr @ [\\e\\\\<^sub>S\\<^sub><] \\ $st\\ = $st))\"\n\ndefinition DoCSP :: \"('\\, '\\) uexpr \\ ('\\, '\\) action\" (\"do\\<^sub>C\") where\n[upred_defs]: \"DoCSP a = \\<^bold>R\\<^sub>s(true \\ do\\<^sub>u a)\"\n\nlemma R1_DoAct: \"R1(do\\<^sub>u(a)) = do\\<^sub>u(a)\"\n by (rel_auto)\n\nlemma R2c_DoAct: \"R2c(do\\<^sub>u(a)) = do\\<^sub>u(a)\"\n by (rel_auto)\n\nlemma DoCSP_alt_def: \"do\\<^sub>C(a) = R3h(CSP1($ok\\ \\ do\\<^sub>u(a)))\"\n apply (simp add: DoCSP_def RHS_def design_def impl_alt_def R1_R3h_commute R2c_R3h_commute R2c_disj\n R2c_not R2c_ok R2c_ok' R2c_and R2c_DoAct R1_disj R1_extend_conj' R1_DoAct)\n apply (rel_auto)\ndone\n\nlemma DoAct_unrests [unrest]:\n \"$ok \\ do\\<^sub>u(a)\" \"$wait \\ do\\<^sub>u(a)\"\n by (pred_auto)+\n\nlemma DoCSP_RHS_tri [rdes_def]:\n \"do\\<^sub>C(a) = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ (\\(true,\\[]\\,{a}\\<^sub>u) \\ \\(true,id\\<^sub>s,U([a]))))\"\n by (simp add: DoCSP_def do\\<^sub>u_def wait'_cond_def, rel_auto)\n\nlemma CSP_DoCSP [closure]: \"do\\<^sub>C(a) is CSP\"\n by (simp add: DoCSP_def do\\<^sub>u_def RHS_design_is_SRD unrest)\n\nlemma preR_DoCSP [rdes]: \"pre\\<^sub>R(do\\<^sub>C(a)) = true\\<^sub>r\"\n by (simp add: DoCSP_def rea_pre_RHS_design unrest usubst R2c_true)\n\nlemma periR_DoCSP [rdes]: \"peri\\<^sub>R(do\\<^sub>C(a)) = \\(true,\\[]\\,{a}\\<^sub>u)\"\n by (rel_auto) \n\nlemma postR_DoCSP [rdes]: \"post\\<^sub>R(do\\<^sub>C(a)) = \\(true,id\\<^sub>s,U([a]))\"\n by (rel_auto)\n\nlemma CSP3_DoCSP [closure]: \"do\\<^sub>C(a) is CSP3\"\n by (rule CSP3_intro[OF CSP_DoCSP])\n (simp add: DoCSP_def do\\<^sub>u_def RHS_def design_def R1_def R2c_def R2s_def R3h_def unrest usubst)\n\nlemma CSP4_DoCSP [closure]: \"do\\<^sub>C(a) is CSP4\"\n by (rule CSP4_tri_intro[OF CSP_DoCSP], simp_all add: preR_DoCSP periR_DoCSP postR_DoCSP unrest)\n\nlemma NCSP_DoCSP [closure]: \"do\\<^sub>C(a) is NCSP\"\n by (metis CSP3_DoCSP CSP4_DoCSP CSP_DoCSP Healthy_def NCSP_def comp_apply)\n\nlemma Productive_DoCSP [closure]:\n \"(do\\<^sub>C a :: ('\\, '\\) action) is Productive\"\nproof -\n have \"((\\(true,id\\<^sub>s,U([a])) \\ $tr\\ >\\<^sub>u $tr) :: ('\\, '\\) action)\n = (\\(true,id\\<^sub>s,U([a])))\"\n by (rel_auto, simp add: Prefix_Order.strict_prefixI')\n hence \"Productive(do\\<^sub>C a) = do\\<^sub>C a\"\n by (simp add: Productive_RHS_design_form DoCSP_RHS_tri unrest)\n thus ?thesis\n by (simp add: Healthy_def)\nqed\n\nlemma PCSP_DoCSP [closure]:\n \"(do\\<^sub>C a :: ('\\, '\\) action) is PCSP\"\n by (simp add: Healthy_comp NCSP_DoCSP Productive_DoCSP)\n\nlemma wp_rea_DoCSP_lemma:\n fixes P :: \"('\\, '\\) action\"\n assumes \"$ok \\ P\" \"$wait \\ P\"\n shows \"U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><] \\ $st\\ = $st) ;; P = (\\ $ref \\ P\\U($tr @ [\\a\\\\<^sub>S\\<^sub><])/$tr\\)\"\n using assms\n by (rel_auto, meson)\n\nlemma wp_rea_DoCSP:\n assumes \"P is NCSP\"\n shows \"U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><] \\ $st\\ = $st) wp\\<^sub>r pre\\<^sub>R P = \n (\\\\<^sub>r (\\\\<^sub>r pre\\<^sub>R P)\\U($tr @ [\\a\\\\<^sub>S\\<^sub><])/$tr\\)\"\n by (simp add: wp_rea_def wp_rea_DoCSP_lemma unrest usubst ex_unrest assms closure) \n\nlemma wp_rea_DoCSP_alt:\n assumes \"P is NCSP\"\n shows \"U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><] \\ $st\\ = $st) wp\\<^sub>r pre\\<^sub>R P = \n U($tr\\ \\ $tr @ [\\a\\\\<^sub>S\\<^sub><] \\\\<^sub>r (pre\\<^sub>R P)\\$tr @ [\\a\\\\<^sub>S\\<^sub><]/$tr\\)\" \n by (simp add: wp_rea_DoCSP assms rea_not_def R1_def usubst unrest, rel_auto)\n\nlemma DoCSP_refine_sinv: \"sinv\\<^sub>R(b) \\ do\\<^sub>C(a)\"\n by (rdes_refine)\n\nsubsection \\ Event prefix \\\n\ndefinition PrefixCSP ::\n \"('\\, '\\) uexpr \\\n ('\\, '\\) action \\\n ('\\, '\\) action\" (\"_ \\\\<^sub>C _\" [81, 80] 80) where\n[upred_defs]: \"PrefixCSP a P = (do\\<^sub>C(a) ;; CSP(P))\"\n\nabbreviation \"OutputCSP c v P \\ PrefixCSP (c\\v)\\<^sub>u P\"\n\nlemma CSP_PrefixCSP [closure]: \"PrefixCSP a P is CSP\"\n by (simp add: PrefixCSP_def closure)\n\nlemma CSP3_PrefixCSP [closure]:\n \"PrefixCSP a P is CSP3\"\n by (metis (no_types, opaque_lifting) CSP3_DoCSP CSP3_def Healthy_def PrefixCSP_def seqr_assoc)\n\nlemma CSP4_PrefixCSP [closure]:\n assumes \"P is CSP\" \"P is CSP4\"\n shows \"PrefixCSP a P is CSP4\"\n by (metis (no_types, opaque_lifting) CSP4_def Healthy_def PrefixCSP_def assms(1) assms(2) seqr_assoc)\n\nlemma NCSP_PrefixCSP [closure]:\n assumes \"P is NCSP\"\n shows \"PrefixCSP a P is NCSP\"\n by (metis (no_types, opaque_lifting) CSP3_PrefixCSP CSP3_commutes_CSP4 CSP4_Idempotent CSP4_PrefixCSP\n CSP_PrefixCSP Healthy_Idempotent Healthy_def NCSP_def NCSP_implies_CSP assms comp_apply)\n\nlemma Productive_PrefixCSP [closure]: \"P is NCSP \\ PrefixCSP a P is Productive\"\n by (simp add: Healthy_if NCSP_DoCSP NCSP_implies_NSRD NSRD_is_SRD PrefixCSP_def Productive_DoCSP Productive_seq_1)\n\nlemma PCSP_PrefixCSP [closure]: \"P is NCSP \\ PrefixCSP a P is PCSP\"\n by (simp add: Healthy_comp NCSP_PrefixCSP Productive_PrefixCSP)\n \nlemma PrefixCSP_Guarded [closure]: \"Guarded (PrefixCSP a)\"\nproof -\n have \"PrefixCSP a = (\\ X. do\\<^sub>C(a) ;; CSP(X))\"\n by (simp add: fun_eq_iff PrefixCSP_def)\n thus ?thesis\n using Guarded_if_Productive NCSP_DoCSP NCSP_implies_NSRD Productive_DoCSP by auto\nqed\n\nlemma PrefixCSP_type [closure]: \"PrefixCSP a \\ \\H\\\\<^sub>H \\ \\CSP\\\\<^sub>H\"\n using CSP_PrefixCSP by blast\n\nlemma PrefixCSP_Continuous [closure]: \"Continuous (PrefixCSP a)\"\n by (simp add: Continuous_def PrefixCSP_def ContinuousD[OF SRD_Continuous] seq_Sup_distl)\n\nlemma PrefixCSP_RHS_tri_lemma1:\n \"R1 (R2s (U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><]) \\ \\II\\\\<^sub>R)) = (U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><]) \\ \\II\\\\<^sub>R)\"\n by (rel_auto)\n\nlemma PrefixCSP_RHS_tri_lemma2:\n fixes P :: \"('\\, '\\) action\"\n assumes \"$ok \\ P\" \"$wait \\ P\"\n shows \"(U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><] \\ $st\\ = $st) \\ \\ $wait\\) ;; P = (\\ $ref \\ P\\U($tr @ [\\a\\\\<^sub>S\\<^sub><])/$tr\\)\"\n using assms\n by (rel_auto, meson, fastforce)\n\nlemma tr_extend_seqr:\n fixes P :: \"('\\, '\\) action\"\n assumes \"$ok \\ P\" \"$wait \\ P\" \"$ref \\ P\"\n shows \"U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><] \\ $st\\ = $st) ;; P = P\\U($tr @ [\\a\\\\<^sub>S\\<^sub><])/$tr\\\"\n using assms by (simp add: wp_rea_DoCSP_lemma assms unrest ex_unrest)\n \nlemma trace_ext_R1_closed [closure]: \"P is R1 \\ P\\$tr ^\\<^sub>u e/$tr\\ is R1\"\n by (rel_blast)\n \nlemma preR_PrefixCSP_NCSP [rdes]:\n assumes \"P is NCSP\"\n shows \"pre\\<^sub>R(PrefixCSP a P) = (\\(true,id\\<^sub>s,U([a])) wp\\<^sub>r pre\\<^sub>R P)\"\n by (simp add: PrefixCSP_def assms closure rdes rpred Healthy_if wp usubst unrest)\n\n(*\nlemma periR_PrefixCSP [rdes]:\n assumes \"P is NCSP\"\n shows \"peri\\<^sub>R(PrefixCSP a P) = (\\(true,\\[]\\,{a}\\<^sub>u) \\ (peri\\<^sub>R P)\\\\a\\\\\\<^sub>t)\"\nproof -\n have \"peri\\<^sub>R(PrefixCSP a P) = peri\\<^sub>R (do\\<^sub>C a ;; P)\"\n by (simp add: PrefixCSP_def closure assms Healthy_if)\n also have \"... = undefined\"\n apply (simp add: rdes closure assms rpred)\n also have \"... = ((\\(true,id,\\a\\) wp\\<^sub>r pre\\<^sub>R P) \\\\<^sub>r $tr\\ =\\<^sub>u $tr \\ \\a\\\\<^sub>S\\<^sub>< \\\\<^sub>u $ref\\ \\ peri\\<^sub>R P\\\\a\\\\\\<^sub>t)\"\n by (simp add: assms NSRD_CSP4_intro csp_enable_tr_empty closure rdes unrest ex_unrest usubst rpred csp_do_comp wp)\n also have \"... = (\\(true,\\[]\\,{a}\\<^sub>u) \\ ((\\(true,id,\\a\\) wp\\<^sub>r pre\\<^sub>R P) \\\\<^sub>r peri\\<^sub>R P\\\\a\\\\\\<^sub>t))\"\n by (rel_auto)\n also have \"... = (\\(true,\\[]\\,{a}\\<^sub>u) \\ ((pre\\<^sub>R(P) \\\\<^sub>r peri\\<^sub>R P)\\\\a\\\\\\<^sub>t))\"\n by (rel_auto)\n also have \"... = (\\(true,\\[]\\,{a}\\<^sub>u) \\ (peri\\<^sub>R P)\\\\a\\\\\\<^sub>t)\" \n by (simp add: SRD_peri_under_pre assms closure unrest)\n finally show ?thesis .\nqed\n \nlemma postR_PrefixCSP [rdes]:\n assumes \"P is NCSP\"\n shows \"post\\<^sub>R(PrefixCSP a P) = (post\\<^sub>R P)\\\\a\\\\\\<^sub>t\"\nproof -\n have \"post\\<^sub>R(PrefixCSP a P) = ((\\(true,\\a\\) \\\\<^sub>r (pre\\<^sub>R P)\\\\a\\\\\\<^sub>t) \\\\<^sub>r (post\\<^sub>R P)\\\\a\\\\\\<^sub>t)\"\n by (simp add: PrefixCSP_def assms Healthy_if) \n (simp add: assms Healthy_if wp closure rdes rpred wp_rea_DoCSP_lemma unrest ex_unrest usubst)\n also have \"... = (\\(true,\\a\\) \\ (pre\\<^sub>R P \\\\<^sub>r post\\<^sub>R P)\\\\a\\\\\\<^sub>t)\"\n by (rel_auto)\n also have \"... = (\\(true,\\a\\) \\ (post\\<^sub>R P)\\\\a\\\\\\<^sub>t)\" \n by (simp add: SRD_post_under_pre assms closure unrest)\n also have \"... = (post\\<^sub>R P)\\\\a\\\\\\<^sub>t\"\n by (rel_auto)\n finally show ?thesis .\nqed\n*) \n \nlemma PrefixCSP_RHS_tri:\n assumes \"P is NCSP\"\n shows \"PrefixCSP a P = \\<^bold>R\\<^sub>s (\\(true,id\\<^sub>s,U([a])) wp\\<^sub>r pre\\<^sub>R P \\ (\\(true,\\[]\\, {a}\\<^sub>u) \\ \\(true,id\\<^sub>s,U([a])) ;; peri\\<^sub>R P) \\ \\(true,id\\<^sub>s,U([a])) ;; post\\<^sub>R P)\"\n by (simp add: PrefixCSP_def Healthy_if unrest assms closure NSRD_composition_wp rdes rpred usubst wp)\n\ntext \\ For prefix, we can chose whether to propagate the assumptions or not, hence there\n are two laws. \\\n \nlemma PrefixCSP_rdes_def_1 [rdes_def]:\n assumes \"P is CRC\" \"Q is CRR\" \"R is CRR\"\n \"$st\\ \\ Q\" \"$ref\\ \\ R\"\n shows \"PrefixCSP a (\\<^bold>R\\<^sub>s(P \\ Q \\ R)) = \n \\<^bold>R\\<^sub>s (\\(true,id\\<^sub>s,U([a])) wp\\<^sub>r P \\ (\\(true,\\[]\\, {a}\\<^sub>u) \\ \\(true,id\\<^sub>s,U([a])) ;; Q) \\ \\(true,id\\<^sub>s,U([a])) ;; R)\"\n by (simp add: PrefixCSP_def Healthy_if assms closure, rdes_simp cls: assms)\n\n(*\nlemma PrefixCSP_rdes_def_2:\n assumes \"P is CRC\" \"Q is CRR\" \"R is CRR\"\n \"$st\\ \\ Q\" \"$ref\\ \\ R\"\n shows \"PrefixCSP a (\\<^bold>R\\<^sub>s(P \\ Q \\ R)) = \\<^bold>R\\<^sub>s((\\(true,\\a\\) \\\\<^sub>r P\\\\a\\\\\\<^sub>t) \\ (\\(true,\\[]\\, {a}\\<^sub>u) \\ (P\\Q)\\\\a\\\\\\<^sub>t) \\ (P\\R)\\\\a\\\\\\<^sub>t)\"\n apply (subst PrefixCSP_RHS_tri)\n apply (rule NCSP_rdes_intro)\n apply (simp_all add: assms rdes closure)\n apply (rel_auto)\n done\n*)\n\nsubsection \\ Guarded external choice \\\n\nabbreviation GuardedChoiceCSP :: \"'\\ set \\ ('\\ \\ ('\\, '\\) action) \\ ('\\, '\\) action\" where\n\"GuardedChoiceCSP A P \\ (\\ x\\A \\ PrefixCSP \\x\\ (P(x)))\"\n\nsyntax\n \"_GuardedChoiceCSP\" :: \"logic \\ logic \\ logic \\ logic\" (\"\\ _ \\ _ \\<^bold>\\ _\" [0,0,85] 86)\n\ntranslations\n \"\\ x\\A \\<^bold>\\ P\" == \"CONST GuardedChoiceCSP A (\\ x. P)\"\n\nlemma GuardedChoiceCSP [rdes_def]:\n assumes \"\\ x. P(x) is NCSP\" \"A \\ {}\"\n shows \"(\\ x\\A \\<^bold>\\ P(x)) =\n \\<^bold>R\\<^sub>s ((\\ x \\ A \\ \\(true,id\\<^sub>s,\\[x]\\) wp\\<^sub>r pre\\<^sub>R (P x)) \\\n ((\\ x \\ A \\ \\(true,\\[]\\, {\\x\\}\\<^sub>u)) \\ $tr\\ =\\<^sub>u $tr \\ (\\ x \\ A \\ \\(true,id\\<^sub>s,\\[x]\\) ;; peri\\<^sub>R (P x))) \\\n (\\ x \\ A \\ \\(true,id\\<^sub>s,\\[x]\\) ;; post\\<^sub>R (P x)))\"\n by (simp add: PrefixCSP_RHS_tri assms ExtChoice_tri_rdes closure unrest, rel_auto)\n\nsubsection \\ Input prefix \\\n\ndefinition InputCSP ::\n \"('a, '\\) chan \\ ('a \\ '\\ upred) \\ ('a \\ ('\\, '\\) action) \\ ('\\, '\\) action\" where\n[upred_defs]: \"InputCSP c A P = (\\ x\\UNIV \\ A(x) &\\<^sub>C PrefixCSP (c\\\\x\\)\\<^sub>u (P x))\"\n\ndefinition InputVarCSP :: \"('a, '\\) chan \\ ('a \\ '\\) \\ ('a \\ '\\ upred) \\ ('\\, '\\) action\" where\n[upred_defs, rdes_def]: \"InputVarCSP c x A = InputCSP c A (\\ v. \\[x \\\\<^sub>s \\v\\]\\\\<^sub>C)\"\n\ndefinition do\\<^sub>I :: \"\n ('a, '\\) chan \\\n ('a \\ ('\\, '\\) sfrd) \\\n ('a \\ ('\\, '\\) action) \\\n ('\\, '\\) action\" where\n\"do\\<^sub>I c x P = (\n ($tr\\ =\\<^sub>u $tr \\ {e | P(e) \\ (c\\\\e\\)\\<^sub>u} \\\\<^sub>u $ref\\ =\\<^sub>u {}\\<^sub>u)\n \\ $wait\\ \\\n (($tr\\ - $tr) \\\\<^sub>u {e | P(e) \\ U([(c\\\\e\\)\\<^sub>u])} \\ (c\\$x\\)\\<^sub>u =\\<^sub>u last\\<^sub>u($tr\\)))\"\n\nlemma InputCSP_CSP [closure]: \"InputCSP c A P is CSP\"\n by (simp add: CSP_ExtChoice InputCSP_def)\n\nlemma InputCSP_NCSP [closure]: \"\\ \\ v. P(v) is NCSP \\ \\ InputCSP c A P is NCSP\"\n apply (simp add: InputCSP_def)\n apply (rule NCSP_ExtChoice)\n apply (simp add: NCSP_Guard NCSP_PrefixCSP image_Collect_subsetI top_set_def)\n done\n\nlemma InputVarCSP_NCSP [closure]: \"InputVarCSP c x A is NCSP\"\n by (simp add: AssignsCSP_NCSP InputCSP_NCSP InputVarCSP_def)\n\nlemma Productive_InputCSP [closure]:\n \"\\ \\ v. P(v) is NCSP \\ \\ InputCSP x A P is Productive\"\n by (auto simp add: InputCSP_def unrest closure intro: Productive_ExtChoice)\n\nlemma Productive_InputVarCSP [closure]: \"InputVarCSP c x A is Productive\"\n by (simp add: InputVarCSP_def closure)\n\n(*\nlemma preR_InputCSP [rdes]:\n assumes \"\\ v. P(v) is NCSP\"\n shows \"pre\\<^sub>R(InputCSP a A P) = (\\ v \\ [A(v)]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true,\\(a\\\\v\\)\\<^sub>u\\) \\\\<^sub>r (pre\\<^sub>R (P(v)))\\\\(a\\\\v\\)\\<^sub>u\\\\\\<^sub>t)\"\n by (simp add: InputCSP_def rdes closure assms alpha usubst unrest)\n \nlemma periR_InputCSP [rdes]:\n assumes \"\\ v. P(v) is NCSP\"\n shows \"peri\\<^sub>R(InputCSP a A P) =\n ((\\ x \\ [A(x)]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true, \\[]\\, {(a\\\\x\\)\\<^sub>u}\\<^sub>u))) \n \\ $tr\\ =\\<^sub>u $tr \\\n (\\ x \\ [A(x)]\\<^sub>S\\<^sub>< \\ (peri\\<^sub>R (P x))\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t)\" \n by (simp add: InputCSP_def rdes closure assms, rel_auto)\n\nlemma postR_InputCSP [rdes]:\n assumes \"\\ v. P(v) is NCSP\"\n shows \"post\\<^sub>R(InputCSP a A P) =\n (\\ x \\ [A x]\\<^sub>S\\<^sub>< \\ post\\<^sub>R (P x)\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t)\"\n using assms by (simp add: InputCSP_def rdes closure assms usubst unrest)\n*)\n\nlemma R4_st_pred_conj_do [rpred]:\n \"((R4 [s\\<^sub>1]\\<^sub>S\\<^sub><) \\ \\(s\\<^sub>2,\\,t) ;; P) = R4(\\(s\\<^sub>1 \\ s\\<^sub>2,\\,t) ;; P) \"\n by (rel_auto)\n\nlemma unrest_ref'_R4 [unrest]: \"$ref\\ \\ P \\ $ref\\ \\ R4(P)\"\n by (simp add: R4_def unrest)\n\nlemma st_pred_conj_seq [rpred]:\n \"\\ P is RR; Q is RR \\ \\ ([s]\\<^sub>S\\<^sub>< \\ P ;; Q) = (([s]\\<^sub>S\\<^sub>< \\ P) ;; Q)\"\n by (metis (no_types, lifting) R1_seqr_closure RR_implies_R1 cond_st_distr cond_st_miracle seqr_left_zero)\n \nlemma InputCSP_rdes_def [rdes_def]:\n assumes \"\\ v. P(v) is CRC\" \"\\ v. Q(v) is CRR\" \"\\ v. R(v) is CRR\"\n \"\\ v. $st\\ \\ Q(v)\" \"\\ v. $ref\\ \\ R(v)\"\n shows \"InputCSP a A (\\ v. \\<^bold>R\\<^sub>s(P(v) \\ Q(v) \\ R(v))) = \n \\<^bold>R\\<^sub>s((\\ x \\ \\(A x,id\\<^sub>s,U([(a\\\\x\\)\\<^sub>u])) wp\\<^sub>r P x) \\\n ((\\ x \\ \\(A x,\\[]\\, {(a\\\\x\\)\\<^sub>u}\\<^sub>u) \\ \\(\\ A x,\\[]\\, {}\\<^sub>u)) \\ (\\ x \\ \\(A x,id\\<^sub>s,U([(a\\\\x\\)\\<^sub>u])) ;; Q x)) \\ \n (\\ x \\ \\(A x,id\\<^sub>s,U([(a\\\\x\\)\\<^sub>u])) ;; R x))\"\n by (simp add: InputCSP_def, rdes_simp cls: assms)\n\n(*\nlemma InputCSP_rdes_def [rdes_def]:\n assumes \"\\ v. P(v) is CRC\" \"\\ v. Q(v) is CRR\" \"\\ v. R(v) is CRR\"\n \"\\ v. $st\\ \\ Q(v)\" \"\\ v. $ref\\ \\ R(v)\"\n shows \"InputCSP a A (\\ v. \\<^bold>R\\<^sub>s(P(v) \\ Q(v) \\ R(v))) = \n \\<^bold>R\\<^sub>s( (\\ v \\ ([A(v)]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true,\\(a\\\\v\\)\\<^sub>u\\) \\\\<^sub>r (P v)\\\\(a\\\\v\\)\\<^sub>u\\\\\\<^sub>t))\n \\ (((\\ x \\ R5([A(x)]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true, \\[]\\, {(a\\\\x\\)\\<^sub>u}\\<^sub>u)))) \n \\\n (\\ x \\ [A(x)]\\<^sub>S\\<^sub>< \\ (P x \\ Q x)\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t))\n \\ (\\ x \\ [A x]\\<^sub>S\\<^sub>< \\ (P x \\ R x)\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t))\" (is \"?lhs = ?rhs\")\nproof -\n have 1:\"pre\\<^sub>R(?lhs) = (\\ v \\ [A v]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true,\\(a\\\\v\\)\\<^sub>u\\) \\\\<^sub>r P v\\\\(a\\\\v\\)\\<^sub>u\\\\\\<^sub>t)\" (is \"_ = ?A\")\n by (simp add: rdes NCSP_rdes_intro assms conj_comm closure)\n have 2:\"peri\\<^sub>R(?lhs) = (\\ x \\ [A x]\\<^sub>S\\<^sub>< \\\\<^sub>r \\(true,\\[]\\, {(a\\\\x\\)\\<^sub>u}\\<^sub>u)) \\ $tr\\ =\\<^sub>u $tr \\ (\\ x \\ [A x]\\<^sub>S\\<^sub>< \\ (P x \\\\<^sub>r Q x)\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t)\"\n (is \"_ = ?B\")\n by (simp add: rdes NCSP_rdes_intro assms closure)\n have 3:\"post\\<^sub>R(?lhs) = (\\ x \\ [A x]\\<^sub>S\\<^sub>< \\ (P x \\\\<^sub>r R x)\\\\(a\\\\x\\)\\<^sub>u\\\\\\<^sub>t)\"\n (is \"_ = ?C\")\n by (simp add: rdes NCSP_rdes_intro assms closure)\n have \"?lhs = \\<^bold>R\\<^sub>s(?A \\ ?B \\ ?C)\"\n by (subst SRD_reactive_tri_design[THEN sym], simp_all add: closure 1 2 3)\n also have \"... = ?rhs\"\n by (rel_auto)\n finally show ?thesis .\nqed\n*)\n\nsubsection \\ Renaming \\\n\ndefinition RenameCSP :: \"('s, 'e) action \\ ('e \\ 'f) \\ ('s, 'f) action\" (\"(_)\\_\\\\<^sub>C\" [999, 0] 999) where\n[upred_defs]: \"RenameCSP P f = \\<^bold>R\\<^sub>s((\\\\<^sub>r (\\\\<^sub>r pre\\<^sub>R(P))\\f\\\\<^sub>c ;; true\\<^sub>r) \\ ((peri\\<^sub>R(P))\\f\\\\<^sub>c) \\ ((post\\<^sub>R(P))\\f\\\\<^sub>c))\"\n\nlemma RenameCSP_rdes_def [rdes_def]: \n assumes \"P is CRC\" \"Q is CRR\" \"R is CRR\"\n shows \"(\\<^bold>R\\<^sub>s(P \\ Q \\ R))\\f\\\\<^sub>C = \\<^bold>R\\<^sub>s((\\\\<^sub>r (\\\\<^sub>r P)\\f\\\\<^sub>c ;; true\\<^sub>r) \\ Q\\f\\\\<^sub>c \\ R\\f\\\\<^sub>c)\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = \\<^bold>R\\<^sub>s ((\\\\<^sub>r (\\\\<^sub>r P)\\f\\\\<^sub>c ;; true\\<^sub>r) \\ (P \\\\<^sub>r Q)\\f\\\\<^sub>c \\ (P \\\\<^sub>r R)\\f\\\\<^sub>c)\"\n by (simp add: RenameCSP_def rdes closure assms)\n also have \"... = \\<^bold>R\\<^sub>s ((\\\\<^sub>r (\\\\<^sub>r CRC(P))\\f\\\\<^sub>c ;; true\\<^sub>r) \\ (CRC(P) \\\\<^sub>r CRR(Q))\\f\\\\<^sub>c \\ (CRC(P) \\\\<^sub>r CRR(R))\\f\\\\<^sub>c)\"\n by (simp add: Healthy_if assms)\n also have \"... = \\<^bold>R\\<^sub>s ((\\\\<^sub>r (\\\\<^sub>r CRC(P))\\f\\\\<^sub>c ;; true\\<^sub>r) \\ (CRR(Q))\\f\\\\<^sub>c \\ (CRR(R))\\f\\\\<^sub>c)\"\n by (rel_auto, (metis order_refl)+)\n also have \"... = ?rhs\"\n by (simp add: Healthy_if assms)\n finally show ?thesis .\nqed\n\nlemma RenameCSP_pre_CRC_closed:\n assumes \"P is CRR\"\n shows \"\\\\<^sub>r (\\\\<^sub>r P)\\f\\\\<^sub>c ;; R1 true is CRC\"\n apply (rule CRC_intro'')\n apply (simp add: unrest closure assms)\n apply (simp add: Healthy_def, simp add: RC1_def rpred closure CRC_idem assms seqr_assoc) \n done\n \nlemma RenameCSP_NCSP_closed [closure]:\n assumes \"P is NCSP\"\n shows \"P\\f\\\\<^sub>C is NCSP\"\n by (simp add: RenameCSP_def RenameCSP_pre_CRC_closed closure assms unrest)\n\nlemma csp_rename_false [rpred]: \n \"false\\f\\\\<^sub>c = false\"\n by (rel_auto)\n\nlemma umap_nil [simp]: \"map\\<^sub>u f \\[]\\ = \\[]\\\"\n by (rel_auto)\n\nlemma rename_Skip: \"Skip\\f\\\\<^sub>C = Skip\"\n by (rdes_eq)\n\nlemma rename_Chaos: \"Chaos\\f\\\\<^sub>C = Chaos\"\n by (rdes_eq_split; rel_simp; force)\n\nlemma rename_Miracle: \"Miracle\\f\\\\<^sub>C = Miracle\"\n by (rdes_eq)\n\nlemma rename_DoCSP: \"(do\\<^sub>C(a))\\f\\\\<^sub>C = do\\<^sub>C(\\f\\(a)\\<^sub>a)\"\n by (rdes_eq)\n \nsubsection \\ Algebraic laws \\\n\nlemma AssignCSP_conditional:\n assumes \"vwb_lens x\"\n shows \"x :=\\<^sub>C e \\ b \\\\<^sub>R x :=\\<^sub>C f = x :=\\<^sub>C (e \\ b \\ f)\" \n by (rdes_eq cls: assms)\n\nlemma AssignsCSP_id: \"\\id\\<^sub>s\\\\<^sub>C = Skip\"\n by (rel_auto)\n\nlemma Guard_comp:\n \"g &\\<^sub>C h &\\<^sub>C P = (g \\ h) &\\<^sub>C P\"\n by (rule antisym, rel_blast, rel_blast)\n\nlemma Guard_false [simp]: \"false &\\<^sub>C P = Stop\"\n by (simp add: GuardCSP_def Stop_def rpred closure alpha R1_design_R1_pre)\n\nlemma Guard_true [simp]:\n \"P is CSP \\ true &\\<^sub>C P = P\"\n by (simp add: GuardCSP_def alpha SRD_reactive_design_alt closure rpred)\n\nlemma Guard_conditional:\n assumes \"P is NCSP\"\n shows \"b &\\<^sub>C P = P \\ b \\\\<^sub>R Stop\" \n by (rdes_eq cls: assms)\n\nlemma Guard_expansion:\n assumes \"P is NCSP\"\n shows \"(g\\<^sub>1 \\ g\\<^sub>2) &\\<^sub>C P = (g\\<^sub>1 &\\<^sub>C P) \\ (g\\<^sub>2 &\\<^sub>C P)\"\n apply (rdes_eq_split cls: assms) \n apply (rel_simp', fastforce simp add: dual_order.order_iff_strict)\n apply (rel_simp', simp add: dual_order.order_iff_strict, fastforce)\n apply (rel_simp', simp add: dual_order.order_iff_strict, fastforce)\n done\n\nlemma Conditional_as_Guard:\n assumes \"P is NCSP\" \"Q is NCSP\"\n shows \"P \\ b \\\\<^sub>R Q = b &\\<^sub>C P \\ (\\ b) &\\<^sub>C Q\" \n by (rdes_eq' cls: assms; simp add: le_less)\n\nlemma PrefixCSP_dist:\n \"PrefixCSP a (P \\ Q) = (PrefixCSP a P) \\ (PrefixCSP a Q)\"\n using Continuous_Disjunctous Disjunctuous_def PrefixCSP_Continuous by auto\n\nlemma DoCSP_is_Prefix:\n \"do\\<^sub>C(a) = PrefixCSP a Skip\"\n by (simp add: PrefixCSP_def Healthy_if closure, metis CSP4_DoCSP CSP4_def Healthy_def)\n\nlemma PrefixCSP_seq:\n assumes \"P is CSP\" \"Q is CSP\"\n shows \"(PrefixCSP a P) ;; Q = (PrefixCSP a (P ;; Q))\"\n by (simp add: PrefixCSP_def seqr_assoc Healthy_if assms closure)\n\nlemma PrefixCSP_extChoice_dist:\n assumes \"P is NCSP\" \"Q is NCSP\" \"R is NCSP\"\n shows \"((a \\\\<^sub>C P) \\ (b \\\\<^sub>C Q)) ;; R = (a \\\\<^sub>C P ;; R) \\ (b \\\\<^sub>C Q ;; R)\"\n by (simp add: PCSP_PrefixCSP assms(1) assms(2) assms(3) extChoice_seq_distr)\n\nlemma GuardedChoiceCSP_dist: \n assumes \"\\ i. i\\A \\ P(i) is NCSP\" \"Q is NCSP\"\n shows \"\\ x\\A \\<^bold>\\ P(x) ;; Q = \\ x\\A \\<^bold>\\ (P(x) ;; Q)\"\n by (simp add: ExtChoice_seq_distr PrefixCSP_seq closure assms cong: ExtChoice_cong)\n\ntext \\ Alternation can be re-expressed as an external choice when the guards are disjoint \\\n\ndeclare ExtChoice_tri_rdes [rdes_def]\ndeclare ExtChoice_tri_rdes' [rdes_def del]\n\ndeclare extChoice_rdes_def [rdes_def]\ndeclare extChoice_rdes_def' [rdes_def del]\n\nlemma AlternateR_as_ExtChoice:\n assumes \n \"\\ i. i \\ A \\ P(i) is NCSP\" \"Q is NCSP\"\n \"\\ i j. \\ i \\ A; j \\ A; i \\ j \\ \\ (g i \\ g j) = false\" \n shows \"(if\\<^sub>R i\\A \\ g(i) \\ P(i) else Q fi) = \n (\\ i\\A \\ g(i) &\\<^sub>C P(i)) \\ (\\ i\\A \\ \\ g(i)) &\\<^sub>C Q\"\nproof (cases \"A = {}\")\n case True\n then show ?thesis by (simp add: ExtChoice_empty extChoice_Stop closure assms)\nnext\n case False\n show ?thesis\n \n proof -\n have 1:\"(\\ i \\ A \\ g i \\\\<^sub>R P i) = (\\ i \\ A \\ g i \\\\<^sub>R \\<^bold>R\\<^sub>s(pre\\<^sub>R(P i) \\ peri\\<^sub>R(P i) \\ post\\<^sub>R(P i)))\"\n by (rule UINF_cong, simp add: NCSP_implies_CSP SRD_reactive_tri_design assms(1))\n have 2:\"(\\ i\\A \\ g(i) &\\<^sub>C P(i)) = (\\ i\\A \\ g(i) &\\<^sub>C \\<^bold>R\\<^sub>s(pre\\<^sub>R(P i) \\ peri\\<^sub>R(P i) \\ post\\<^sub>R(P i)))\"\n by (rule ExtChoice_cong, simp add: NCSP_implies_NSRD NSRD_is_SRD SRD_reactive_tri_design assms(1))\n from assms(3) show ?thesis\n by (simp add: AlternateR_def 1 2)\n (rdes_eq' cls: assms(1-2) simps: False cong: UINF_cong USUP_cong ExtChoice_cong)\n qed\nqed\n\ndeclare ExtChoice_tri_rdes [rdes_def del]\ndeclare ExtChoice_tri_rdes' [rdes_def]\n\ndeclare extChoice_rdes_def [rdes_def del]\ndeclare extChoice_rdes_def' [rdes_def]\n\nfind_theorems R4\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/sf_rdes/utp_sfrd_prog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.27799504301458483}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ProcParEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2007-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader \"Examples for Procedures as Parameters using Statespaces\"\ntheory ProcParExSP imports \"../Vcg\" begin\n\n\n\n\n\n\n\nlemma conseq_exploit_pre':\n \"\\\\s \\ S. \\,\\ \\ ({s} \\ P) c Q,A\\\n \\\n \\,\\\\ (P \\ S)c Q,A\"\n apply (rule HoarePartialDef.Conseq)\n apply clarify\n by (metis IntI insertI1 subset_refl)\n\nlemma conseq_exploit_pre'':\n \"\\\\Z. \\s \\ S Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S Z)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\nlemma conseq_exploit_pre''':\n \"\\\\s \\ S. \\Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\n\nprocedures compare(i::nat,j::nat|r::bool) \"NoBody\"\n \n\nprint_locale! compare_signature\n\n\ncontext compare_impl\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\r :== CALL compare(\\i,\\j)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n(* FIXME: typing issue with modifies locale*)\nprocedures\n LEQ (i::nat,j::nat | r::bool) \"\\r :== \\i \\ \\j\"\n LEQ_spec: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) \\\\r = (\\<^bsup>\\\\<^esup>i \\ \\<^bsup>\\\\<^esup>j)\\\"\n\n LEQ_modifies: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) {t. t may_only_modify_globals \\ in []}\"\n\n\n\ndefinition mx:: \"('a \\ 'a \\ bool) \\ 'a \\ 'a \\ 'a\"\n where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures (imports compare_signature)\n Max (compare::string, n::nat, m::nat | k::nat) \n where b::bool\n in\n \"\\b :== DYNCALL \\compare(\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\"\n\n Max_spec: \"\\leq. \\\\. \\\\ \n ({\\} \\ {s. (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})})\n PROC Max(\\compare,\\n,\\m,\\k)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n\ncontext Max_spec\nbegin\nthm Max_spec\nend\ncontext Max_impl\nbegin\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\ (\\\\. \\\\{\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n fix \\:: \"('a, 'b, 'c, 'd) stateSP_scheme\" and s::\"('a, 'b, 'c, 'd) stateSP_scheme\" and leq\n assume compare_spec: \n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j\\\"\n \n assume compare_modifies:\n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \n {t. t may_only_modify_globals \\ in []}\"\n\n show \"\\\\({s} \\ {\\})\n \\b :== DYNCALL \\compare (\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n apply vcg\n apply (clarsimp simp add: mx_def)\n done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \n \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nprint_locale Max_spec\n\n(* We have to rename the parameters of the compare procedure to match the LEQ procedure *)\nlocale Max_test = Max_spec where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_spec + LEQ_modifies\n\nlemma (in Max_test) \n shows\n \"\\\\ {\\} \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\nproof -\n note Max_spec = Max_spec [where leq=\"(op \\)\"]\n show ?thesis\n apply vcg\n apply (clarsimp)\n apply (rule conjI)\n apply (rule LEQ_spec)\n apply (rule LEQ_modifies)\n done\nqed\n\n\n\n\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \\\\n' m'. \\\\ \\\\i=n' \\ \\j=m'\\ \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq n' m')\\\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\n m. \\\\ \\\\i=n \\ \\j=m\\ PROC LEQ(\\i,\\j,\\r) \\\\r = (n \\ m)\\\"\n apply vcg\n apply simp\n done\n\n\nprint_locale Max_impl\nlocale Max_test' = Max_impl where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_impl\nlemma (in Max_test') \n shows\n \"\\n m. \\\\ \\\\n=n \\ \\m=m\\ \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) n m\\\"\nproof -\n note Max_spec = Max_spec5\n show ?thesis\n apply vcg\n apply (rule_tac x=\"op \\\" in exI)\n apply clarsimp\n apply (rule LEQ_spec [rule_format])\n done\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/ex/ProcParExSP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984137988773, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.27799503531126085}} {"text": "(*\n *\n * Copyright 2017, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(DATA61_GPL)\n *)\n\n(*\n Test proofs for corres methods. Builds on AInvs image.\n*)\n\ntheory Corres_Test\nimports \"Refine.VSpace_R\" \"Lib.Corres_Method\"\nbegin\n\nchapter \\The Corres Method\\\n\nsection \\Introduction\\\n\ntext \\The @{method corres} method tries to do for corres-style refinement proofs what\n@{method wp} did for hoare logic proofs. The intention is to automate the application\nof corres calculational rules, so that the bulk of the manual proof is now handling\na verification condition. In general refinement proofs are difficult to automate, so here we\nexploit the fact that in l4v the abstract and executable specifications tend to be structurally\nsimilar. Corres proofs are based on the @{const corres_underlying} constant, which takes a number\nof parameters that allow it to be specialized for different flavours of refinement.\n\nA corres statement has the following form: @{term \"corres_underlying sr nf nf' r P P' f f'\"}, where\n@{term sr} is a state-relation, @{term nf} and @{term nf'} refer to whether or not the left and\nright hand functions may fail, @{term r} is a return value relation between the functions, @{term P}\nand @{term P'} are preconditions for the functions @{term f} and @{term f'} respectively. Informally\nthe statement says that: under the given preconditions, for every execution of @{term f'} there exists\nan execution of @{term f} that is related by the given state relation @{term sr} and return-value\nrelation @{term r}.\n\nIf the left and right side of a corres statement share similar structure, we can \"unzip\" the function\ninto one corres obligation for each atomic function. This is done through the application of\n @{thm corres_split}.\n\\\n\nthm corres_split[no_vars]\n\ntext \\Briefly this states that: given a corres goal proving refinement between @{term \"a >>= b\"} and\n @{term \"c >>= d\"}, we can decompose this into a proof showing refinement between @{term a} and\n@{term c}, and between @{term a} and @{term c}. Additionally @{term a} and @{term c} must establish\nappropriate postconditions to satisfy the obligations of proving refinement between @{term b} and @{term d}.\n\nThe first subgoal that is produced has an important characteristic: the preconditions for each\nside may only discuss the return value of its respective side. This means that rules such as\n@{term \"corres_underlying sr nf nf' r (\\s. x = x') (\\_. True) (f x) (f' x')\"} will not apply to a goal\n if @{term x} and @{term x'} are variables generated by applying @{thm corres_split} (i.e. the\nreturn values of functions).\n\nThis means that any such conditions must instead be phrased as an assumption to the rule, and our rule must be\nrephrased as follows:\n @{term \"x = x' \\ corres_underlying sr nf nf' r (\\_. True) (\\_. True) (f x) (f' x')\"}.\nThe result is that we must solve @{term \"x = x'\"} immediately after applying our rule. While this\nis not a major concern for a manual proof, it proves to be a significant obstacle if we're trying\nto focus on automating the \"corres\" part of the refinement.\n\\\n\nsection \\corres_underlyingK and corres_rv\\\n\ntext \\To remedy this situation, we augment the @{const corres_underlying} definition to include\nyet another flag: a single boolean. This new constant: @{const corres_underlyingK},\nwill form the basis of the calculus for our corres method.\\\n\nthm corres_underlyingK_def[no_vars]\n\ntext \\The boolean in @{const corres_underlyingK} can be thought of as a stateless precondition. It\nis used to propagate additional proof obligations for rules that either do not need to discuss\neither the left or right hand state, or must discuss bound variables from both sides.\\\n\nthm corresK_split[no_vars]\n\ntext \\In this split rule for @{const corres_underlyingK} we see that the additional precondition @{term F'}\nmay discuss both @{term rv} and @{term rv'}. To show that this condition is satisified, however,\nwe can't use hoare logic and instead need a new definition: @{const corres_rv}.\\\n\nthm corres_rv_def_I_know_what_I'm_doing[no_vars]\n\ntext \\This is a weaker form of @{const corres_underlying} that is only interested in the return value\nof the functions. In essence, it states the given functions will establish @{term Q} after executing,\nassuming the given return-value relation @{term r} holds, along with the given stateless precondition\n@{term F} and left/right preconditions @{term P} and @{term P'}.\n\nThe assumption in general is that corres_rv rules should never be written, instead corres_rv obligations\nshould be propagated into either the stateless precondition (@{term F} from @{term corres_underlyingK}),\nthe left precondition (@{term P}) or the right precondition @{term P'}. This is implicitly handled\nby @{method corres_rv} (called from @{method corres}) by applying one of the following rules to each conjunct:\\\n\nthm corres_rv_defer\nthm corres_rv_wp_left\nthm corres_rv_wp_right\n\ntext \\If none of these rules can be safely applied, then @{method corres_rv} will leave the\n obligation untouched. The user can manually apply one of them if desired, but this is liable to\n create unsolvable proof obligations. In the worst case, the user may manually solve the goal in-place.\\\n\nthm corres_rv_proveT[no_vars]\n\nsection \\The corres method\\\n\ntext \\The core algorithm of the corres method is simple:\n 1) start by applying any necessary weakening rules to ensure the goal has schematic preconditions\n 2) apply a known @{thm corres} or @{thm corresK} rule (see next section)\n 3) if unsuccessful, apply a split rule (i.e. @{thm corresK_split}) and go to 2\n\nImportantly, @{method corres} will not split a goal if it ultimately is not able to apply at least\none @{thm corres} or @{thm corresK} rule.\n\\\n\nsubsection \\The corres and corresK named_theorems\\\n\ntext \\To address the fact that existing refinement rules are phrased as @{const corres_underlying}\nand not @{const corres_underlyingK} there are two different named_theorems that are used for different\nkind of rules @{thm corres} and @{thm corresK}. A @{thm corres} rule is understood to be phrased\nwith @{const corres_underlying} and may have additional assumptions. These assumptions will be\npropagated through the additional @{term F} flag in @{const corres_underlyingK}, rather than presented\nas proof obligations immediately. A @{thm corresK} rule is understood to be phrased with\n@{const corres_underlyingK}, and is meant for calculational rules which may have proper assumptions that\nshould not be propagated.\n\\\nthm corresK\nthm corres\n\nsubsection \\The corresc method\\\n\ntext \\Similar to @{method wpc}, @{method corresc} can handle case statements in @{const corres_underlyingK}\nproof goals. Importantly, however, it is split into two sub-methods @{method corresc_left} and\n@{method corresc_right}, which perform case-splitting on each side respectively. The combined method\n@{method corresc}, however, attempts to discharge the contradictions that arise from the quadratic\nblowup of a case analysis on both the left and right sides.\\\n\nsubsection \\corres_concrete_r, corres_concrete_rE\\\n\ntext \\Some @{thm corresK} rules should only be applied if certain variables are concrete\n(i.e. not schematic) in the goal. These are classified separately with the named_theorems\n@{thm corres_concrete_r} and @{thm corres_concrete_rER}. The first\nindicates that the return value relation of the goal must be concrete, the second indicates that\nonly the left side of the error relation must be concrete.\\\n\nthm corres_concrete_r\nthm corres_concrete_rER\n\nsubsection \\The corres_search method\\\n\ntext \\The purpose of @{method corres_search} is to address cases where there is non-trivial control flow.\nIn particular: in the case where there is an \"if\" statement or either side needs to be symbolically\nexecuted. The core idea is that corres_search should be provided with a \"search\" rule that acts\nas an anchoring point. Symbolic execution and control flow is decomposed until either the given\nrule is successfully applied or all search branches are exhausted.\\\n\nsubsubsection \\Symbolic Execution\\\n\ntext \\Symbolic execution is handled by two named theorems:\n @{thm corres_symb_exec_ls} and @{thm corres_symb_exec_rs}, which perform symbolic execution on\nthe left and right hand sides of a corres goal.\\\n\nthm corres_symb_exec_ls\nthm corres_symb_exec_rs\n\ntext \\A function may be symbolically executed if it does not modify the state, i.e. its only purpose\nis to compute some value and return it. After being symbolically executed,\nthis value can only be discussed by the precondition of the associated side or the stateless\nprecondition of corresK. The resulting @{const corres_rv} goal has @{const corres_noop} as the\nfunction on the alternate side. This gives @{method corres_rv} a hint that the resulting obligation\nshould be aggressively re-written into a hoare triple over @{term m} if it can't be propagated\nback statelessly safely.\n\\\n\n\nsection \\Demo\\\n\n\ncontext begin interpretation Arch .\n\n(* VSpace_R *)\n\n\nlemmas load_hw_asid_corres_args[corres] =\n load_hw_asid_corres[@lift_corres_args]\n\nlemmas invalidate_asid_corres_args[corres] =\n invalidate_asid_corres[@lift_corres_args]\n\nlemmas invalidate_hw_asid_entry_corres_args[corres] =\n invalidate_hw_asid_entry_corres[@lift_corres_args]\n\nlemma invalidate_asid_entry_corres:\n \"corres dc (valid_vspace_objs and valid_asid_map\n and K (asid \\ mask asid_bits \\ asid \\ 0)\n and vspace_at_asid asid pd and valid_vs_lookup\n and unique_table_refs o caps_of_state\n and valid_global_objs and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (invalidate_asid_entry asid) (invalidateASIDEntry asid)\"\n apply (simp add: invalidate_asid_entry_def invalidateASIDEntry_def)\n apply_debug (trace) (* apply_trace between steps *)\n (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n corres (* weaken precondition *)\n continue (* split *)\n continue (* solve load_hw_asid *)\n continue (* split *)\n continue (* apply corres_when *)\n continue (* trivial simplification *)\n continue (* invalidate _hw_asid_entry *)\n finish (* invalidate_asid *)\n\n apply (corressimp wp: load_hw_asid_wp)+\n apply clarsimp\n apply (fastforce simp: pd_at_asid_uniq)\n done\n\n\ncrunch typ_at'[wp]: invalidateASIDEntry, flushSpace \"typ_at' T t\"\ncrunch ksCurThread[wp]: invalidateASIDEntry, flushSpace \"\\s. P (ksCurThread s)\"\ncrunch obj_at'[wp]: invalidateASIDEntry, flushSpace \"obj_at' P p\"\n\nlemmas flush_space_corres_args[corres] =\n flush_space_corres[@lift_corres_args]\n\nlemmas invalidate_asid_entry_corres_args[corres] =\n invalidate_asid_entry_corres[@lift_corres_args]\n\n\nlemma corres_inst_eq_ext:\n \"(\\x. corres_inst_eq (f x) (f' x)) \\ corres_inst_eq f f'\"\n by (auto simp add: corres_inst_eq_def)\n\nlemma delete_asid_corresb:\n notes [corres] = corres_gets_asid gct_corres set_asid_pool_corres and\n [@lift_corres_args, corres] = get_asid_pool_corres_inv'\n invalidate_asid_entry_corres\n set_vm_root_corres\n notes [wp] = set_asid_pool_asid_map_unmap set_asid_pool_vs_lookup_unmap'\n set_asid_pool_vspace_objs_unmap'\n invalidate_asid_entry_invalidates\n getASID_wp\n shows\n \"corres dc\n (invs and valid_etcbs and K (asid \\ mask asid_bits \\ asid \\ 0))\n (pspace_aligned' and pspace_distinct' and no_0_obj'\n and valid_arch_state' and cur_tcb')\n (delete_asid asid pd) (deleteASID asid pd)\"\n apply (simp add: delete_asid_def deleteASID_def)\n apply_debug (trace) (* apply_trace between steps *)\n (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n corres (* weaken precondition *)\n continue (* split *)\n continue (* gets rule *)\n continue (* corresc *)\n continue (* return rule *)\n continue (* split *)\n continue (* function application *)\n continue (* liftM rule *)\n continue (* get_asid_pool_corres_inv' *)\n continue (* function application *)\n continue (* function application *)\n continue (* corresK_when *)\n continue (* split *)\n continue (* flush_space_corres *)\n continue (* K_bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* invalidate_asid_entry_corres *)\n continue (* K_bind *)\n continue (* return bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* backtracking *)\n continue (* split *)\n continue (* function application *)\n continue (* set_asid_pool_corres *)\n continue (* K_bind *)\n continue (* K_bind *)\n continue (* split *)\n continue (* gct_corres *)\n continue (* set_vm_root_corres *)\n finish (* backtracking? *)\n apply (corressimp simp: mask_asid_low_bits_ucast_ucast\n | fold cur_tcb_def | wps)+\n apply (frule arm_asid_table_related,clarsimp)\n apply (rule conjI)\n apply (intro impI allI)\n apply (rule conjI)\n apply (safe; assumption?)\n apply (rule ext)\n apply (fastforce simp: inv_def dest: ucast_ucast_eq)\n apply (rule context_conjI)\n apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n apply (intro allI impI)\n apply (subgoal_tac \"vspace_at_asid asid pd s\")\n prefer 2\n apply (simp add: vspace_at_asid_def)\n apply (rule vs_lookupI)\n apply (simp add: vs_asid_refs_def)\n apply (rule image_eqI[OF refl])\n apply (rule graph_ofI)\n apply fastforce\n apply (rule r_into_rtrancl)\n apply simp\n apply (rule vs_lookup1I [OF _ _ refl], assumption)\n apply (simp add: vs_refs_def)\n apply (rule image_eqI[rotated], erule graph_ofI)\n apply (simp add: mask_asid_low_bits_ucast_ucast)\n prefer 2\n apply (intro allI impI context_conjI; assumption?)\n apply (rule aligned_distinct_relation_asid_pool_atI'; fastforce?)\n apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n apply (simp add: cur_tcb'_def)\n apply (safe; assumption?)\n apply (erule ko_at_weakenE)\n apply (clarsimp simp: graph_of_def)\n apply (fastforce split: if_split_asm)\n apply (frule invs_vspace_objs)\n apply (drule (2) valid_vspace_objsD)\n apply (erule ranE)\n apply (fastforce split: if_split_asm)\n apply (erule ko_at_weakenE)\n apply (clarsimp simp: graph_of_def)\n apply (fastforce split: if_split_asm)\n done\n\nlemma cte_wp_at_ex:\n \"cte_wp_at (\\_. True) p s \\ (\\cap. cte_wp_at ((=) cap) p s)\"\n by (simp add: cte_wp_at_def)\n\n(* Sadly broken:\nlemma set_vm_root_for_flush_corres:\n notes [corres] = gct_corres getSlotCap_corres\n shows\n \"corres (=)\n (cur_tcb and vspace_at_asid asid pd\n and K (asid \\ 0 \\ asid \\ mask asid_bits)\n and valid_asid_map and valid_vs_lookup\n and valid_vspace_objs and valid_global_objs\n and unique_table_refs o caps_of_state\n and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (set_vm_root_for_flush pd asid)\n (setVMRootForFlush pd asid)\"\n apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n apply corres\n apply_debug (trace) (tags \"corres_search\") (corres_search search: arm_context_switch_corres)\n continue (* step left *)\n continue (* if rule *)\n continue (* failed corres on first subgoal, trying next *)\n continue (* fail corres on last subgoal, trying reverse if rule *)\n continue (* can't make corres progress here, trying other goal *)\n finish (* successful goal discharged by corres *)\n\n apply (corressimp wp: get_cap_wp getSlotCap_wp)+\n apply (rule context_conjI)\n subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n apply (rule context_conjI)\n subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n apply (rule conjI)\n subgoal by (fastforce simp: isCap_simps)\n apply (drule cte_wp_at_ex)\n apply clarsimp\n apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n apply (drule cte_wp_at_norm')\n apply clarsimp\n apply (rule_tac x=\"cteCap cte\" in exI)\n apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n done\n\ntext \\Note we can wrap it all up in corressimp\\\n\nlemma set_vm_root_for_flush_corres':\n notes [corres] = gct_corres getSlotCap_corres\n shows\n \"corres (=)\n (cur_tcb and vspace_at_asid asid pd\n and K (asid \\ 0 \\ asid \\ mask asid_bits)\n and valid_asid_map and valid_vs_lookup\n and valid_vspace_objs and valid_global_objs\n and unique_table_refs o caps_of_state\n and valid_arch_state\n and pspace_aligned and pspace_distinct)\n (pspace_aligned' and pspace_distinct' and no_0_obj')\n (set_vm_root_for_flush pd asid)\n (setVMRootForFlush pd asid)\"\n apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n apply (corressimp search: arm_context_switch_corres\n wp: get_cap_wp getSlotCap_wp\n simp: isCap_simps)\n apply (rule context_conjI)\n subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n apply (rule context_conjI)\n subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n apply (rule conjI)\n subgoal by (fastforce)\n apply (drule cte_wp_at_ex)\n apply clarsimp\n apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n apply (drule cte_wp_at_norm')\n apply clarsimp\n apply (rule_tac x=\"cteCap cte\" in exI)\n apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n done\n*)\n\nend\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/lib/Corres_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.27791048282710323}} {"text": "section \\ Hiding \\\n\ntheory utp_circus_hiding\nimports utp_circus_parallel\nbegin\n\nsubsection \\ Hiding in peri- and postconditions \\\n\ndefinition hide_rea (\"hide\\<^sub>r\") where\n[upred_defs]: \"hide\\<^sub>r P E = (\\<^bold>\\ s \\ (P\\$tr^\\<^sub>u\\s\\,(\\E\\\\\\<^sub>u$ref\\)/$tr\\,$ref\\\\ \\ $tr\\ =\\<^sub>u $tr^\\<^sub>u(\\s\\\\\\<^sub>u\\-E\\)))\"\n\nlemma hide_rea_CRR_closed [closure]: \n assumes \"P is CRR\"\n shows \"hide\\<^sub>r P E is CRR\"\nproof -\n have \"CRR(hide\\<^sub>r (CRR P) E) = hide\\<^sub>r (CRR P) E\"\n by (rel_auto, fastforce+)\n thus ?thesis\n by (metis Healthy_def' assms)\nqed\n\nlemma hide_rea_CDC [closure]:\n assumes \"P is CDC\"\n shows \"hide\\<^sub>r P E is CDC\"\nproof -\n have \"CDC(hide\\<^sub>r (CDC P) E) = hide\\<^sub>r (CDC P) E\"\n by (rel_blast)\n thus ?thesis\n by (simp add: Healthy_if Healthy_intro assms)\nqed\n\nlemma hide_rea_false [rpred]: \"hide\\<^sub>r false E = false\"\n by (rel_auto)\n\nlemma hide_rea_disj [rpred]: \"hide\\<^sub>r (P \\ Q) E = (hide\\<^sub>r P E \\ hide\\<^sub>r Q E)\"\n by (rel_auto)\n\nlemma hide_rea_csp_enable [rpred]: \n \"hide\\<^sub>r \\(s, t, E) F = \\(s \\ E - \\F\\ =\\<^sub>u E, t \\\\<^sub>u \\-F\\, E)\"\n by (rel_auto)\n\nlemma hide_rea_csp_do [rpred]: \"hide\\<^sub>r \\(s,\\,t) E = \\(s,\\,t \\\\<^sub>u \\-E\\)\"\n by (rel_auto)\n\nlemma filter_eval [simp]: \n \"(bop Cons x xs) \\\\<^sub>u E = (bop Cons x (xs \\\\<^sub>u E) \\ x \\\\<^sub>u E \\ xs\\\\<^sub>uE)\"\n by (rel_simp)\n\nlemma hide_rea_seq [rpred]:\n assumes \"P is CRR\" \"$ref\\ \\ P\" \"Q is CRR\" \n shows \"hide\\<^sub>r (P ;; Q) E = hide\\<^sub>r P E ;; hide\\<^sub>r Q E\"\nproof -\n have\"hide\\<^sub>r (CRR(\\ $ref\\ \\ P) ;; CRR(Q)) E = hide\\<^sub>r (CRR(\\ $ref\\ \\ P)) E ;; hide\\<^sub>r (CRR Q) E\"\n apply (simp add: hide_rea_def usubst unrest CRR_seqr_form)\n apply (simp add: CRR_form)\n apply (rel_auto)\n using seq_filter_append apply fastforce\n apply (metis seq_filter_append)\n done\n thus ?thesis\n by (simp add: Healthy_if assms ex_unrest)\nqed\n\nlemma hide_rea_true_R1_true [rpred]: \n \"hide\\<^sub>r (R1 true) A ;; R1 true = R1 true\"\n by (rel_auto, metis append_Nil2 seq_filter_Nil)\n\nlemma hide_rea_shEx [rpred]: \"hide\\<^sub>r (\\<^bold>\\ i \\ P(i)) cs = (\\<^bold>\\ i \\ hide\\<^sub>r (P i) cs)\"\n by (rel_auto)\n\nlemma hide_rea_empty [rpred]: \n assumes \"P is RR\"\n shows \"hide\\<^sub>r P {} = P\"\nproof -\n have \"hide\\<^sub>r (RR P) {} = (RR P)\"\n by (rel_auto; force)\n thus ?thesis\n by (simp add: Healthy_if assms)\nqed\n\nlemma hide_rea_twice [rpred]: \"hide\\<^sub>r (hide\\<^sub>r P A) B = hide\\<^sub>r P (A \\ B)\"\n apply (rel_auto)\n apply (metis (no_types, opaque_lifting) semilattice_sup_class.sup_assoc)\n apply (metis (no_types, lifting) semilattice_sup_class.sup_assoc seq_filter_twice)\n done\n\nlemma st'_unrest_hide_rea [unrest]: \"$st\\ \\ P \\ $st\\ \\ hide\\<^sub>r P E\"\n by (simp add: hide_rea_def unrest)\n\nlemma ref'_unrest_hide_rea [unrest]: \"$ref\\ \\ P \\ $ref\\ \\ hide\\<^sub>r P E\"\n by (simp add: hide_rea_def unrest usubst)\n\nsubsection \\ Hiding in preconditions \\\n\ndefinition abs_rea :: \"('s, 'e) action \\ 'e set \\ ('s, 'e) action\" (\"abs\\<^sub>r\") where\n[upred_defs]: \"abs\\<^sub>r P E = (\\\\<^sub>r (hide\\<^sub>r (\\\\<^sub>r P) E ;; true\\<^sub>r))\"\n\nlemma abs_rea_false [rpred]: \"abs\\<^sub>r false E = false\"\n by (rel_simp, metis append.right_neutral seq_filter_Nil)\n\nlemma abs_rea_conj [rpred]: \"abs\\<^sub>r (P \\ Q) E = (abs\\<^sub>r P E \\ abs\\<^sub>r Q E)\"\n by (rel_blast)\n\nlemma abs_rea_true [rpred]: \"abs\\<^sub>r true\\<^sub>r E = true\\<^sub>r\"\n by (rel_auto)\n\nlemma abs_rea_RC_closed [closure]:\n assumes \"P is CRR\"\n shows \"abs\\<^sub>r P E is CRC\"\nproof -\n have \"RC1 (abs\\<^sub>r (CRR P) E) = abs\\<^sub>r (CRR P) E\"\n apply (rel_auto)\n apply (metis order_refl)\n apply blast\n done\n hence \"abs\\<^sub>r P E is RC1\"\n by (simp add: assms Healthy_if Healthy_intro closure)\n thus ?thesis\n by (rule_tac CRC_intro'', simp_all add: abs_rea_def closure assms unrest)\nqed\n\nlemma hide_rea_impl_under_abs:\n assumes \"P is CRC\" \"Q is CRR\"\n shows \"(abs\\<^sub>r P A \\\\<^sub>r hide\\<^sub>r (P \\\\<^sub>r Q) A) = (abs\\<^sub>r P A \\\\<^sub>r hide\\<^sub>r Q A)\"\n by (simp add: RC1_def abs_rea_def rea_impl_def rpred closure assms unrest)\n (rel_auto, metis order_refl )\n\nlemma abs_rea_not_CRR: \"P is CRR \\ abs\\<^sub>r (\\\\<^sub>r P) E = (\\\\<^sub>r hide\\<^sub>r P E ;; R1 true)\"\n by (simp add: abs_rea_def rpred closure)\n\nlemma abs_rea_wpR [rpred]: \n assumes \"P is CRR\" \"$ref\\ \\ P\" \"Q is CRC\"\n shows \"abs\\<^sub>r (P wp\\<^sub>r Q) A = (hide\\<^sub>r P A) wp\\<^sub>r (abs\\<^sub>r Q A)\"\n by (simp add: wp_rea_def abs_rea_not_CRR hide_rea_seq assms closure)\n (simp add: abs_rea_def rpred closure assms seqr_assoc)\n\nlemma abs_rea_empty [rpred]: \n assumes \"P is RC\"\n shows \"abs\\<^sub>r P {} = P\"\nproof -\n have \"abs\\<^sub>r (RC P) {} = (RC P)\"\n apply (rel_auto)\n apply (metis diff_add_cancel_left' order_refl plus_list_def)\n done\n thus ?thesis\n by (simp add: Healthy_if assms)\nqed\n\n\nlemma abs_rea_twice [rpred]: \n assumes \"P is CRC\"\n shows \"abs\\<^sub>r (abs\\<^sub>r P A) B = abs\\<^sub>r P (A \\ B)\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = abs\\<^sub>r (\\\\<^sub>r hide\\<^sub>r (\\\\<^sub>r P) A ;; R1 true) B\"\n by (simp add: abs_rea_def)\n thus ?thesis\n by (simp add: abs_rea_def rpred closure unrest seqr_assoc assms)\nqed\n\nsubsection \\ Hiding Operator \\\n\ntext \\ In common with the UTP book definition of hiding, this definition does not introduce\n divergence if there is an infinite sequence of events that are hidden. For this, we would\n need a more complex precondition which is left for future work. \\\n\ndefinition HideCSP :: \"('s, 'e) action \\ 'e set \\ ('s, 'e) action\" (infixl \"\\\\\\<^sub>C\" 80) where \n [upred_defs]: \n \"HideCSP P E = \\<^bold>R\\<^sub>s(abs\\<^sub>r(pre\\<^sub>R(P)) E \\ hide\\<^sub>r (peri\\<^sub>R(P)) E \\ hide\\<^sub>r (post\\<^sub>R(P)) E)\"\n\nlemma HideCSP_rdes_def [rdes_def]:\n assumes \"P is CRC\" \"Q is CRR\" \"R is CRR\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q \\ R) \\\\\\<^sub>C A = \\<^bold>R\\<^sub>s(abs\\<^sub>r(P) A \\ hide\\<^sub>r Q A \\ hide\\<^sub>r R A)\" (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = \\<^bold>R\\<^sub>s (abs\\<^sub>r P A \\ hide\\<^sub>r (P \\\\<^sub>r Q) A \\ hide\\<^sub>r (P \\\\<^sub>r R) A)\"\n by (simp add: HideCSP_def rdes assms closure)\n also have \"... = \\<^bold>R\\<^sub>s (abs\\<^sub>r P A \\ (abs\\<^sub>r P A \\\\<^sub>r hide\\<^sub>r (P \\\\<^sub>r Q) A) \\ (abs\\<^sub>r P A \\\\<^sub>r hide\\<^sub>r (P \\\\<^sub>r R) A))\"\n by (metis RHS_tri_design_conj conj_idem utp_pred_laws.sup.idem)\n also have \"... = ?rhs\"\n by (metis RHS_tri_design_conj assms conj_idem hide_rea_impl_under_abs utp_pred_laws.sup.idem)\n finally show ?thesis .\nqed\n\nlemma HideCSP_NCSP_closed [closure]: \"P is NCSP \\ P \\\\\\<^sub>C E is NCSP\"\n by (simp add: HideCSP_def closure unrest)\n\nlemma HideCSP_C2_closed [closure]: \n assumes \"P is NCSP\" \"P is C2\"\n shows \"P \\\\\\<^sub>C E is C2\"\n by (rdes_simp cls: assms, simp add: C2_rdes_intro closure unrest assms)\n\nlemma HideCSP_CACT_closed [closure]:\n assumes \"P is CACT\"\n shows \"P \\\\\\<^sub>C E is CACT\"\n by (rule CACT_intro, simp_all add: closure assms)\n\nlemma HideCSP_Chaos: \"Chaos \\\\\\<^sub>C E = Chaos\"\n by (rdes_simp)\n\nlemma HideCSP_Miracle: \"Miracle \\\\\\<^sub>C A = Miracle\"\n by (rdes_eq)\n\nlemma HideCSP_AssignsCSP:\n \"\\\\\\\\<^sub>C \\\\\\<^sub>C A = \\\\\\\\<^sub>C\"\n by (rdes_eq)\n\nlemma HideCSP_cond:\n assumes \"P is NCSP\" \"Q is NCSP\"\n shows \"(P \\ b \\\\<^sub>R Q) \\\\\\<^sub>C A = (P \\\\\\<^sub>C A \\ b \\\\<^sub>R Q \\\\\\<^sub>C A) \"\n by (rdes_eq cls: assms)\n\nlemma HideCSP_int_choice:\n assumes \"P is NCSP\" \"Q is NCSP\"\n shows \"(P \\ Q) \\\\\\<^sub>C A = (P \\\\\\<^sub>C A \\ Q \\\\\\<^sub>C A) \"\n by (rdes_eq cls: assms)\n\nlemma HideCSP_guard:\n assumes \"P is NCSP\"\n shows \"(b &\\<^sub>C P) \\\\\\<^sub>C A = b &\\<^sub>C (P \\\\\\<^sub>C A)\"\n by (rdes_eq cls: assms)\n\nlemma HideCSP_seq:\n assumes \"P is NCSP\" \"Q is NCSP\"\n shows \"(P ;; Q) \\\\\\<^sub>C A = (P \\\\\\<^sub>C A ;; Q \\\\\\<^sub>C A)\"\n by (rdes_eq_split cls: assms)\n\nlemma HideCSP_DoCSP [rdes_def]: \n \"do\\<^sub>C(a) \\\\\\<^sub>C A = (Skip \\ (a \\\\<^sub>u \\A\\) \\\\<^sub>R do\\<^sub>C(a))\"\n by (rdes_eq)\n\nlemma HideCSP_PrefixCSP:\n assumes \"P is NCSP\"\n shows \"(a \\\\<^sub>C P) \\\\\\<^sub>C A = ((P \\\\\\<^sub>C A) \\ (a \\\\<^sub>u \\A\\) \\\\<^sub>R (a \\\\<^sub>C (P \\\\\\<^sub>C A)))\"\n apply (simp add: PrefixCSP_def Healthy_if HideCSP_seq HideCSP_DoCSP closure assms rdes rpred)\n apply (simp add: HideCSP_NCSP_closed Skip_left_unit assms cond_st_distr)\n done\n\nlemma HideCSP_empty:\n assumes \"P is NCSP\" \n shows \"P \\\\\\<^sub>C {} = P\"\n by (rdes_eq cls: assms)\n\nlemma HideCSP_twice:\n assumes \"P is NCSP\" \n shows \"P \\\\\\<^sub>C A \\\\\\<^sub>C B = P \\\\\\<^sub>C (A \\ B)\"\n by (rdes_simp cls: assms)\n\nlemma HideCSP_Skip: \"Skip \\\\\\<^sub>C A = Skip\"\n by (rdes_eq)\n\nlemma HideCSP_Stop: \"Stop \\\\\\<^sub>C A = Stop\"\n by (rdes_eq)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/circus/utp_circus_hiding.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.27791048282710323}} {"text": "(* module countermem(clk,rst,counter,d,addr,q);\n parameter\t MSBD = 63;\n parameter\t DEPTH = 31;\n parameter\t MSBA = 4;\n input\t clk;\n input rst;\n input [MSBD:0] d;\n input [MSBA:0] addr;\n input\t counter;\n output [MSBD:0] q;\n\n\n reg [MSBD:0] mem[0:DEPTH];\n reg [MSBA:0] write_addr;\n //wire [MSBA:0] read_addr;\n\tinteger i;\n\n\tinitial begin\n\tfor (i = 0; i <= DEPTH; i = i + 1)\n\t mem[i] = 0;\n \twrite_addr = 0;\n end // initial begin\n\n\n always @ (posedge clk) begin\n\tif (rst) write_addr = 0;\n\telse if (counter) begin\n\t\tmem[write_addr] = d;\n\t write_addr = write_addr +1;\n\tend \n end // always @ (posedge clock)\n\t\n assign q = mem[write_addr-1-addr];\n\nendmodule // *)\ntheory counter imports paraGste1\nbegin\nabbreviation rst::\"varType\" where\n\"rst \\ (Ident ''rst'')\"\n\nabbreviation last::\"varType\" where\n\"last \\ (Ident ''last'')\"\n\n\n\ndefinition vertexI::\"node\" where [simp]:\n\"vertexI \\Vertex 0\"\n\n\ndefinition vertexL::\"nat \\ node list\" where [simp]:\n\"vertexL DEPTH \\ (map (%i. Vertex i) (upt 0 ( DEPTH +2)))\"\n\nlemma testUpto: \"upt 0 2=[0,1]\"\n by (simp add: upt_rec) \n\ndefinition edgeL::\"nat \\ edge list\" where [simp]:\n \"edgeL DEPTH \\ (Edge (Vertex (DEPTH +1)) (Vertex 1))#\n\t (map (%i. ( Edge (Vertex ( i )) (Vertex ( i + 1 ))) ) (upt 0 (DEPTH +1) )) \"\n\nlemma testUpto1:\"upt 1 3=[Suc 0,2]\" \nby (simp add: upt_rec) \n\nprimrec node2Nat::\"node \\ nat\" where\n\"node2Nat (Vertex n) = n\"\n\nabbreviation LOW::\"expType\" where\n\"LOW \\ Const (boolV False)\"\nabbreviation HIGH::\"expType\" where\n\"HIGH \\ Const (boolV True)\"\n\nabbreviation rstForm::\"formula\" where\n\"rstForm \\ (eqn (IVar rst) HIGH)\" \n\ndefinition antOfCounterMem::\"edge\\formula\" where [simp]:\n\"antOfCounterMem edge\\\n (let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if (\tfrom = 0) then rstForm\telse\n (neg rstForm))\"\n\n\n\ndefinition consOfCounterMem::\" edge \\formula\" where [simp]:\n\"consOfCounterMem edge \\\n(let from=node2Nat (source edge) in\n let to=node2Nat (sink edge) in\n if \t(from =0 ) then\n chaos\n else \n eqn (IVar last) (Const (index (from - 1)))\n \n )\"\n\ndefinition counterGsteSpec::\" nat\\gsteSpec\" where [simp]:\n\"counterGsteSpec DEPTH\\Graph vertexI (edgeL DEPTH ) \n (antOfCounterMem ) (consOfCounterMem )\"\n\n\n\ndefinition tagFunOfCounterMem:: \" nat\\nodeTagFuncList\" where [simp]:\n\"tagFunOfCounterMem DEPTH n \\ \n let x=node2Nat n in\n if (x = 0) then [] else\n [eqn (IVar last) (Const (index (x - 1)))]\n \"\n \n abbreviation branch1::\"generalizeStatement\" where \n\"branch1 \\ \n let S1=assign (last,(Const (index 0))) in\n Parallel [S1]\"\n \nabbreviation branch2::\"nat\\generalizeStatement\" where \n\"branch2 DEPTH \\ \n let S1= assign (last, \n iteForm (eqn (IVar last) (Const (index DEPTH))) (Const (index 0)) \n (uif ''+'' [IVar last, (Const (index 1))])) in\n Parallel [S1]\" \n \n\nabbreviation counterMem::\" nat\\generalizeStatement\" where\n\"counterMem DEPTH\\ \n caseStatement \n [(eqn (IVar rst) HIGH, branch1),\n (neg (eqn (IVar rst) HIGH ), branch2 DEPTH)] \n \"\n \n\nconsts J::\" interpretFunType\" \n \n\naxiomatization where axiomOnIAdd [simp,intro]:\n\" J ''+'' [index m, index (Suc 0)] = index ((m + 1))\" \n\nlemma consistencyOfcounterMem:\n assumes a:\"0 < DEPTH \"\n shows \"consistent' (counterMem DEPTH ) (J) (counterGsteSpec DEPTH ) \n (tagFunOfCounterMem DEPTH)\"\n proof(unfold consistent'_def,rule allI,rule impI)\n fix e\n let ?G=\" (counterGsteSpec DEPTH )\"\n let ?M=\"(counterMem DEPTH )\"\n let ?tag=\"(tagFunOfCounterMem DEPTH)\"\n let ?P =\"\\e. \n (let f=andListForm (?tag (sink e)) in\n let f'=andListForm (?tag (source e)) in\n tautlogy (implyForm (andForm f' (antOf ?G e)) (preCond1 f ( ?M))) (J))\"\n \n assume a1:\"e \\ edgesOf (counterGsteSpec DEPTH )\"\n \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex (DEPTH+1)) ( Vertex 1) |\n (\\i. 1\\i \\ i\\ DEPTH \\ e=( Edge (Vertex i) (Vertex ( i+1 ))) ) \"\n apply(cut_tac a a1,auto) done\n \n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1, simp )\n done\n }\n moreover\n {assume b1:\"e=Edge ( Vertex (DEPTH+1)) ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1, simp )\n done\n \n } \n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ DEPTH \\ e=( Edge (Vertex i) (Vertex ( i + 1 ))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n \n have \"?P e\"\n apply(cut_tac a b2 , auto simp add: Let_def)\n done\n }\n ultimately show \"?P e\" by satx\nqed\n \n\nlemma instImply:\nassumes a:\"G=(counterGsteSpec DEPTH)\" and b:\"0 < DEPTH \" and c:\"tag=tagFunOfCounterMem DEPTH\"\nshows\n\"\\ e. e \\edgesOf G\\ \ntautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) (J)\" \nproof(rule allI,rule impI,simp,rule allI,rule impI)\n fix e s\n assume a1:\"e \\ edgesOf G \" and a2:\"\n formEval (J) (antOf G e) s \\ formEval (J) (andListForm (tag (source e))) s\" \n let ?P =\"\\e. formEval (J) (consOf G e) s\" \n have \"e=Edge vertexI ( Vertex 1) | \n e=Edge ( Vertex (DEPTH+1)) ( Vertex 1) |\n (\\i. 1\\i \\ i\\ DEPTH \\ e=( Edge (Vertex i) (Vertex ( i+1 ))) ) \"\n apply(cut_tac a a1,auto) done\n moreover\n {assume b1:\"e=Edge vertexI ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b1, auto) done\n }\n\n moreover\n {assume b1:\"e=Edge ( Vertex (DEPTH+1)) ( Vertex 1)\"\n have \"?P e\"\n apply(cut_tac a b c a1 a2 b1, auto) \n done\n }\n\n moreover\n {assume b1:\" (\\i. 1\\i \\ i\\ DEPTH \\ e=( Edge (Vertex i) (Vertex ( i+1 ))) ) \" (is \"\\i. ?asm i\")\n from b1 obtain i where b2:\"?asm i\" by auto\n \n have \"?P e\"\n proof(cut_tac a b c a2 b2, auto) qed\n \n }\n \n ultimately show \"?P e\" by satx\n qed \n\nlemma main: \nassumes a:\"G=(counterGsteSpec DEPTH )\" and b:\"0 < DEPTH \" \nand c:\"tag=tagFunOfCounterMem DEPTH\" and\nd:\"M=(counterMem DEPTH )\"\nshows \" circuitSatGsteSpec M G (J)\" \nproof(rule mainLemma)\nhave a1:\"consistent' (counterMem DEPTH ) (J ) (counterGsteSpec DEPTH ) (tagFunOfCounterMem DEPTH)\" \n using b by (rule consistencyOfcounterMem)\nfrom a c d this show \"consistent' M (J) G tag\"\n by simp \nnext\nfrom a b c show \"\\e. e \\ edgesOf G \\\n tautlogy (implyForm (andForm (antOf G e) (andListForm (tag (source e)))) (consOf G e)) (J)\"\napply(rule instImply) done\nnext\nfrom a c show \"tag (initOf G) = []\"\napply auto done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/counter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2779104828271032}} {"text": "\\<^marker>\\creator Bernhard Pöttinger\\\n\ntheory Effectively_Acyclic_Maintain\n imports Effectively_Acyclic Effectively_Acyclic_Sourced_Path Effectively_Acyclic_Approximations\n Effectively_Acyclic_Equal_Capacity\nbegin\n\nparagraph \\Summary\\\ntext \\This theory proves @{cite \\th. 3\\ krishna20} / @{cite \\th. 3.38\\ krishna19a}.\n\nThe proof structure of theorem 3 is:\ntheorem 3 (@{term maintain_eff_acyclic_dom})\n- case @{term \"dom_fg h1 = dom_fg h1'\"} (@{term maintain_eff_acyclic_dom_eq})\n - Effective Acyclicity (@{term maintain_eff_acyclic_dom_eq'})\n - Subflowpreserving Extension (part of @{term maintain_eff_acyclic_dom})\n- case @{term \"dom_fg h1 \\ dom_fg h1'\"} (@{term maintain_eff_acyclic_dom_ne})\n\\\nsection \\Proof of Theorem 3.38\\\n\ntext \\Auxiliary lemma\\\n\nlemma alt_edge:\n fixes h h1 h2 :: \"('n,'m :: cancel_comm_monoid_add) fg\"\n assumes \"\\x y. edge_fg h2 x y \\ E\" \"\\x y. edge_fg h1 x y \\ E\" \"End_closed E\" \"xs \\ []\"\n shows \"\\x y. edge_fg (alt h1 h2 xs) x y \\ E\"\nproof (goal_cases)\n case (1 x y)\n have \"alt h1 h2 xs \\ {h1,h2}\" using alt_in[of xs h1 h2] assms by simp\n then consider (a) \"alt h1 h2 xs = h1\" | (b) \"alt h1 h2 xs = h2\" by blast\n then show ?case\n proof cases\n case a\n with assms show ?thesis by simp\n next\n case b\n with assms show ?thesis by simp\n qed\nqed\n\ntext \\Part on effective acyclicity of Case 1 (@{term \"h1 = dom_fg h1'\"}) of Theorem 3 in\n@{cite krishna20}, factored out to address symmetric cases\\\n\nlemma maintain_eff_acyclic_dom_eq':\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes \"pointwise_reduced E\" \"h = h1 + h2\" \"h \\ bot\" \"h' = h1' + h2'\" \"h' \\ bot\" \"h1' \\ bot\"\n \"h1 \\\\<^sub>S h1'\" \"dom_fg h1' \\ dom_fg h2' = {}\"\n \"\\n \\ dom_fg h1' - dom_fg h1. outf_fg h2 n = 0\"\n \"\\x y. edge_fg h x y \\ E\"\n \"eff_acyclic' h\" \"eff_acyclic' h1\" \"eff_acyclic' h1'\" \"eff_acyclic' h2\" \"eff_acyclic' h2'\"\n \"dom_fg h1 = dom_fg h1'\" \"dom_fg h2 = dom_fg h2'\" \"End_closed E\" \"id \\ E\"\n \"\\x y. edge_fg h2 x y \\ E\" \"\\x y. edge_fg h1 x y \\ E\" \"\\x y. edge_fg h1' x y \\ E\"\n \"\\x y. edge_fg h2' x y \\ E\" \"\\x y. edge_fg (h1' + h2') x y \\ E\"\n \"(\\_. 0) \\ E\" \"id \\ E\"\n \"\\n\\dom_fg h1. \\n'\\- dom_fg h1'. \\m\\inf_fg h1 n. cap_fg h1 n n' m = cap_fg h1' n n' m\"\n \"\\n\\dom_fg h2. \\n'\\- dom_fg h2'. \\m\\inf_fg h2 n. cap_fg h2 n n' m = cap_fg h2' n n' m\"\n \"\\x y. edge_fg (h1 + h2) x y \\ E\"\n and nbot: \"h1' + h2' \\ bot\" \"int_fg (h1' + h2') = int_fg (h1 + h2)\"\n and infeq: \"inf_fg (h1' + h2') = inf_fg (h1 + h2)\" \"int_fg h1' = int_fg h1\"\n and False: \"\\ (set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2')\"\n and True: \"hd ns \\ dom_fg h1'\"\n and nsdef:\n \"chain (edge_fg (h1' + h2')) ns n (inf_fg (h1 + h2) (hd ns)) \\ 0\"\n \"n \\ set ns\" \"set ns \\ dom_fg (h1' + h2')\"\n shows False\nproof -\n have *: \"h1 \\ bot\" \"h2 \\ bot\" using assms plus_fg_ops_exist by metis+\n\n let ?h' = \"h1' + h2'\"\n let ?h = \"h1 + h2\"\n let ?e' = \"edge_fg ?h'\"\n let ?e1' = \"edge_fg h1'\"\n let ?e2' = \"edge_fg h2'\"\n let ?e = \"edge_fg h\" let ?e1 = \"edge_fg h1\" let ?e2 = \"edge_fg h2\"\n let ?f' = \"flow_fg ?h'\"\n let ?N' = \"dom_fg ?h'\"\n let ?N1 = \"dom_fg h1\"\n let ?N2 = \"dom_fg h2\"\n let ?N1' = \"dom_fg h1'\"\n let ?N = \"dom_fg h\" let ?Na = \"dom_fg h1\" let ?Nb = \"dom_fg h2\"\n let ?i = \"inf_fg ?h\"\n let ?i' = \"inf_fg ?h'\"\n let ?i1 = \"inf_fg h1\"\n let ?f = \"flow_fg (h1 + h2)\"\n let ?f1 = \"flow_fg h1\"\n let ?f1' = \"flow_fg h1'\"\n let ?i1' = \"inf_fg h1'\"\n let ?i2' = \"inf_fg h2'\"\n\n let ?g1 = \"\\xs y. if set xs \\ ?Na then cap' (card ?Na) ?Na ?e' (hd (xs @ [y])) y else if set xs \\ ?Nb then cap' (card ?Nb) ?Nb ?e' (hd (xs @ [y])) y else 0\"\n let ?g2 = \"\\xs y. if set xs \\ ?Na then cap' (card ?Na) ?Na ?e1' (hd (xs @ [y])) y else if set xs \\ ?Nb then cap' (card ?Nb) ?Nb ?e2' (hd (xs @ [y])) y else 0\"\n let ?g3 = \"\\xs y. if set xs \\ ?Na then cap' (card ?Na) ?Na ?e1 (hd (xs @ [y])) y else if set xs \\ ?Nb then cap' (card ?Nb) ?Nb ?e2 (hd (xs @ [y])) y else 0\"\n let ?altg2 = \"\\h1 h2 xs y. if set xs \\ dom_fg h1 then cap' (card (dom_fg h1)) (dom_fg h1) (edge_fg h1) (hd (xs @ [y])) y else if set xs \\ dom_fg h2 then cap' (card (dom_fg h2)) (dom_fg h2) (edge_fg h2) (hd (xs @ [y])) y else 0\"\n let ?altg3 = \"\\h1 h2 xs y. if set xs \\ dom_fg h1 then cap' (card (dom_fg h1)) (dom_fg h1) (edge_fg h1) (hd (xs @ [y])) y else if set xs \\ dom_fg h2 then cap' (card (dom_fg h2)) (dom_fg h2) (edge_fg h2) (hd (xs @ [y])) y else 0\"\n let ?g4 = \"\\xs y. cap' (card ?N) ?N ?e (hd (xs @ [y])) y\"\n let ?P = \"\\ys. set ys \\ ?Na \\ ys \\ [] \\ length ys \\ card ?Na\"\n let ?Q = \"\\ys. set ys \\ ?Nb \\ ys \\ [] \\ length ys \\ card ?Nb\"\n let ?altP = \"\\h ys. set ys \\ dom_fg h \\ ys \\ [] \\ length ys \\ card (dom_fg h)\"\n let ?altQ = \"\\h ys. set ys \\ dom_fg h \\ ys \\ [] \\ length ys \\ card (dom_fg h)\"\n let ?alte = \"\\xs. if set xs \\ ?Na then ?e1 else ?e2\"\n\n let ?k = \"length ns\"\n\n have dom: \"dom_fg h1' \\ dom_fg h2' = {}\" \"ns \\ []\" \"set ns \\ dom_fg h1' \\ dom_fg h2'\"\n \"dom_fg h1' \\ dom_fg h2' = {}\" \"?N1 \\ ?N2 = {}\" \"?N1 \\ ?N2 = ?N\"\n using False nsdef ck_lists_props[of ns \"dom_fg (h1' + h2')\" ?k] nbot\n using assms apply blast\n using nsdef nbot \\h = h1 + h2\\ \\h \\ bot\\ by auto\n\n with False obtain n1 n2 where ***: \"n1 \\ set ns\" \"n2 \\ set ns\" \"n1 \\ dom_fg h1'\"\n \"n2 \\ dom_fg h2'\" \"n1 \\ n2\" \"n1 \\ dom_fg h2'\" \"n2 \\ dom_fg h1'\"\n by blast\n then have \"length ns \\ 2\"\n using assms dom by (meson length_ge_2)\n then have \"butlast ns \\ []\"\n by (cases ns, simp_all, case_tac list, simp_all)\n\n have \"\\xss. concat xss = ns \\ xss \\ [] \\ (\\xs\\set xss. xs \\ []) \\\n alternating (segment_fg h1') (segment_fg h2') xss\"\n apply (rule split_segments[of ns \"dom_fg h1'\" \"dom_fg h2'\"])\n using True dom by simp_all\n then obtain xss where xssdef: \"concat xss = ns\" \"xss \\ []\" \"\\xs \\ set xss. xs \\ []\"\n \"alternating (segment_fg h1') (segment_fg h2') xss\"\n by blast\n\n have \"chain ?e' ns n = chains ?e' xss n\"\n apply (subst chain_chains[of ns xss ?e' n], simp_all add: list.set_sel)\n using xssdef by (simp_all add: list.set_sel(2))\n also have \"... = chains' (chain ?e') xss n\"\n by (induction xss, simp, case_tac xss, auto)\n finally have XXX: \"chain ?e' ns n = chains' (chain ?e') xss n\" .\n\n have \"hd ns = hd (hd xss)\"\n using hd_hd_concat_hd[of ns xss] xssdef nsdef by simp\n then have \"0 < chains' (chain ?e') xss n (?i (hd (hd xss)))\"\n using nsdef XXX xssdef apply simp\n using gr_zeroI by blast\n also have \"... \\ chains' (chain ?e') xss n (?i1' (hd (hd xss)))\"\n apply (subst infeq[symmetric])\n apply (rule pos_endo_mono'_closed[OF inf_fg_le_inf_fg, where E=E])\n using assms nbot xssdef nsdef apply blast\n using xssdef nsdef apply (metis True concat.simps(2) hd_Cons_tl hd_append2 hd_in_set)\n using assms apply blast+\n apply (rule endo_chains'[OF \\End_closed E\\], clarsimp)\n apply (rule endo_chain_closed)\n using assms by (simp_all (no_asm))\n finally have GGG: \"chains' (chain ?e') xss n (?i1' (hd (hd xss))) \\ 0\"\n by simp\n have altpq: \"alternating ?P ?Q xss\"\n apply (subst \\?N1 = ?N1'\\)+\n apply (subst \\?N2 = dom_fg h2'\\)+\n apply (rule eff_acyclic_chain_length_le_card')\n using xssdef nsdef \\?N1 = ?N1'\\ apply simp\n using assms nbot apply blast+\n using GGG by simp\n\n have ne: \"length xss \\ 2\"\n using length_ge_2_alternating[of ?N1 ?N2 n2 n1 xss] xssdef assms *** by metis\n then have bl_xss_ne: \"butlast xss \\ []\"\n by (cases xss, simp_all, case_tac list, simp_all)\n\n have hdns: \"hd ns = hd (hd (butlast xss))\"\n proof -\n have B: \"hd (butlast xss) \\ []\"\n using xssdef by (simp add: bl_xss_ne in_set_butlastD)\n have C: \"hd (concat (butlast xss @ [last xss])) = hd ns\"\n using xssdef by simp\n then have D: \"hd (concat (butlast xss)) = hd ns\"\n by (metis bl_xss_ne B concat_append concat_eq_Nil_conv hd_append2 hd_in_set)\n then show ?thesis\n apply (cases \"butlast xss\")\n using bl_xss_ne apply blast\n using B by auto\n qed\n\n have sum: \"h = h2 + h1\"\n using \\h = h1 + h2\\ by (simp add: algebra_simps)\n\n show False\n proof (cases \"n \\ set (last xss)\")\n case True\n show ?thesis\n proof (cases \"hd (last xss) \\ ?Na\")\n case True\n then have \"\\ ?Q (last xss)\"\n using dom \\?N1 = ?N1'\\\n by (metis disjoint_iff_not_equal hd_in_set subsetD)\n then have altv: \"alt h1' h2' xss = h1'\" \"alt h1 h2 xss = h1\"\n using alt_odd[OF altpq xssdef(2), of h1' h2'] alt_odd[OF altpq xssdef(2), of h1 h2]\n by simp_all\n then have altv': \"alt h2 h1 (butlast xss) = h1\" \"alt h2' h1' (butlast xss) = h1'\"\n using alt_butlast[OF \\xss \\ []\\, of h1 h2] alt_butlast[OF \\xss \\ []\\, of h1' h2']\n by auto\n\n have \"set (last xss) \\ ?N1'\"\n using alternating_props[OF altpq] True dom \\?N1 = ?N1'\\ \\xss \\ []\\\n by (metis \\\\ ?Q (last xss)\\ last_in_set)\n\n have AUX: \"xs \\ set xss \\ chain (edge_fg (h1' + h2')) xs y = alt_chain h1' h2' xs y\" for xs y\n proof (goal_cases)\n case 1\n have \"\\ set xs \\ dom_fg h1' \\ set xs \\ dom_fg h2'\"\n using dom alternating_props[OF xssdef(4)] 1 by blast\n with 1 show ?case\n apply (clarsimp, intro conjI impI)\n apply (rule chain_cong'[OF edge_fg_plus_fg_on1[OF nbot(1)]], simp)\n by (rule chain_cong'[OF edge_fg_plus_fg_on2[OF nbot(1)]], simp)\n qed\n\n have \"chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)) =\n chains' (alt_chain h1' h2') (butlast xss) (hd (last xss)) (?i (hd ns))\"\n apply (rule chains'_cong[OF AUX])\n by (simp add: in_set_butlastD)\n also have \"... \\ chains' (alt_chain h1' h2') (butlast xss) (hd (last xss)) (?i1' (hd ns))\"\n apply (subst infeq(1)[symmetric])\n apply (rule pos_endo_mono'_closed[where f=\"chains' _ _ _\" and E=E, OF inf_fg_le_inf_fg])\n using \\hd ns \\ dom_fg h1'\\ \\?N1 = ?N1'\\ nbot\n by (auto intro!: endo_chains' endo_chain_closed simp: assms)\n also have \"... \\ inf_fg (alt h2' h1' (butlast xss)) (hd (last xss))\"\n using chains'_chain_inf_fg_le_inf_fg[of h1' h2' \"butlast xss\" \"last xss\"] hdns assms\n bl_xss_ne nbot alternating_to_alternating'[where xs=xss] xssdef\n by (metis (no_types, lifting))\n finally have DDD: \"chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)) \\\n inf_fg (alt h2' h1' (butlast xss)) (hd (last xss))\" .\n\n have \"0 < chain ?e' ns n (?i (hd ns))\"\n using nsdef gr_zeroI by blast\n also have \"... = chains' (chain ?e') xss n (?i (hd ns))\"\n using XXX by simp\n also have \"... =\n chain ?e' (last xss) n (chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)))\"\n by (rule chains'_append1, simp add: \\xss \\ []\\)\n also have \"... \\ chain ?e' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n apply (rule pos_endo_mono'_closed[where f=\"chain _ _ _\", where E=E])\n by (auto intro!: endo_chain_closed simp: assms DDD)\n finally have \"0 \\ chain ?e' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n by simp\n then have Y: \"0 \\ chain ?e1' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n apply (subst (asm) chain_cong')\n apply (rule edge_fg_plus_fg_on1)\n using nbot apply blast\n using \\set (last xss) \\ dom_fg h1'\\ apply blast\n by simp\n\n show ?thesis\n using contradict_eff_acyclic[of h1' \"last xss\" n E] altv' altv infeq Y nbot assms\n \\set (last xss) \\ ?N1'\\ \\n \\ set (last xss)\\ by metis\n next\n case False (* symmetric case *)\n then have \"\\ ?P (last xss)\"\n using dom \\?N1 = ?N1'\\\n by (metis hd_in_set subsetD)\n then have altv: \"alt h1' h2' xss = h2'\" \"alt h1 h2 xss = h2\"\n using alt_even[OF altpq xssdef(2), of h1' h2'] alt_even[OF altpq xssdef(2), of h1 h2]\n by simp_all\n then have altv': \"alt h2' h1' (butlast xss) = h2'\"\n using alt_butlast[OF \\xss \\ []\\, of h1' h2'] by simp\n\n have \"set (last xss) \\ ?N2\"\n using alternating_props[OF altpq] True dom \\?N1 = ?N1'\\ \\xss \\ []\\\n by (metis \\\\ ?P (last xss)\\ last_in_set)\n\n have AUX: \"xs \\ set (butlast xss)\n \\ chain (edge_fg (h1' + h2')) xs y = alt_chain h2' h1' xs y\" for xs y\n proof (goal_cases)\n case 1\n have \"\\ set xs \\ dom_fg h2' \\ set xs \\ dom_fg h1'\"\n using dom alternating_props[OF xssdef(4)] 1 by (meson in_set_butlastD)\n with 1 show ?case\n apply (clarsimp, intro conjI impI)\n apply (rule chain_cong'[OF edge_fg_plus_fg_on2[OF nbot(1)]], simp)\n by (rule chain_cong'[OF edge_fg_plus_fg_on1[OF nbot(1)]], simp)\n qed\n\n have AUX2: \"xs \\ set xss \\ alt_chain h1' h2' xs y = alt_chain h2' h1' xs y\" for xs y\n using dom by (smt alternating_props disjoint_iff_not_equal list.set_sel(1) subsetD xssdef(4))\n\n have \"chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)) =\n chains' (alt_chain h2' h1') (butlast xss) (hd (last xss)) (?i (hd ns))\"\n apply (rule chains'_cong[OF AUX])\n by (simp add: in_set_butlastD)\n also have \"... \\ chains' (alt_chain h2' h1') (butlast xss) (hd (last xss)) (?i1' (hd ns))\"\n apply (subst infeq(1)[symmetric])\n apply (rule pos_endo_mono'_closed[where f=\"chains' _ _ _\" and E=E, OF inf_fg_le_inf_fg])\n using \\hd ns \\ dom_fg h1'\\ \\?N1 = ?N1'\\ nbot\n by (auto intro!: endo_chains' endo_chain_closed simp: assms)\n also have \"... \\ inf_fg (alt h2' h1' (butlast xss)) (hd (last xss))\"\n apply (subst chains'_cong[OF AUX2[symmetric]], simp add: in_set_butlastD)\n using chains'_chain_inf_fg_le_inf_fg[of h1' h2' \"butlast xss\" \"last xss\"] hdns assms\n bl_xss_ne nbot alternating_to_alternating'[where xs=xss] xssdef\n by (metis (no_types, lifting))\n finally have DDD: \"chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)) \\\n inf_fg (alt h2' h1' (butlast xss)) (hd (last xss))\" .\n\n have \"0 < chain ?e' ns n (?i (hd ns))\"\n using nsdef gr_zeroI by blast\n also have \"... = chains' (chain ?e') xss n (?i (hd ns))\"\n using XXX by simp\n also have \"... =\n chain ?e' (last xss) n (chains' (chain ?e') (butlast xss) (hd (last xss)) (?i (hd ns)))\"\n by (rule chains'_append1, simp add: \\xss \\ []\\)\n also have \"... \\ chain ?e' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n apply (rule pos_endo_mono'_closed[where f=\"chain _ _ _\", where E=E])\n by (auto intro!: endo_chain_closed simp: assms DDD)\n finally have \"0 \\ chain ?e' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n by simp\n then have Y: \"0 \\ chain ?e2' (last xss) n (inf_fg (alt h2' h1' (butlast xss)) (hd (last xss)))\"\n apply (subst (asm) chain_cong')\n apply (rule edge_fg_plus_fg_on2[of h1' h2'])\n using nbot apply blast\n using \\set (last xss) \\ dom_fg h2\\ assms apply blast\n by simp\n\n have \"h2' \\ bot\" using assms\n by (meson plus_fg_bot_bot(2))\n\n then show ?thesis\n using contradict_eff_acyclic[of h2' \"last xss\" n E] altv' altv infeq Y nbot assms\n \\set (last xss) \\ dom_fg h2\\ \\n \\ set (last xss)\\ * by metis\n qed\n next\n case False\n\n have X1: \"\\xs y x x'. ?P xs \\ x \\ x' \\ chain ?e' xs y x \\ ?g1 xs y x'\"\n apply (split if_split, intro conjI impI, rule chain_le_cap'[where E=E])\n using assms dom_fg_finite[of h1] unfolding zero_fun_def by blast+\n\n have X2: \"\\xs y x x'. ?Q xs \\ x \\ x' \\ chain ?e' xs y x \\ ?g1 xs y x'\"\n apply (split if_split, intro conjI impI)\n subgoal using dom(1) \\?N1 = ?N1'\\\n by (metis assms(17) disjoint_iff_not_equal list.set_sel(1) subset_iff)\n apply (split if_splits, intro conjI impI)\n apply (rule chain_le_cap'[where E=E])\n using assms dom_fg_finite[of h2] unfolding zero_fun_def by blast+\n\n have X3: \"alternating ?P ?Q (butlast xss)\"\n using alternating_append1[of ?P ?Q \"butlast xss\" \"[last xss]\"] altpq xssdef\n by simp\n\n have X4: \"\\xs y x x'. ?P xs \\ x \\ x' \\ ?g1 xs y x \\ ?g2 xs y x'\"\n apply simp\n apply (subst \\dom_fg h1 = dom_fg h1'\\)+\n apply (subst cap'_cong_e[OF edge_fg_plus_fg_on1], simp_all add: nbot)\n apply (rule pos_endo_mono'_closed[OF _ endo_cap', where E=E])\n using assms dom_fg_finite[of h1'] unfolding zero_fun_def by blast+\n\n have X5: \"\\xs y x x'. ?Q xs \\ x \\ x' \\ ?g1 xs y x \\ ?g2 xs y x'\"\n apply clarsimp\n apply (intro conjI impI)\n apply (subst \\dom_fg h1 = dom_fg h1'\\)+\n using \\?N1' \\ dom_fg h2' = {}\\ \\?N1 = ?N1'\\\n apply (metis Int_subset_iff assms(17) set_empty subset_empty)\n apply (subst \\dom_fg h2 = dom_fg h2'\\)+\n apply (subst cap'_cong_e[OF edge_fg_plus_fg_on2], simp_all add: nbot)+\n apply (rule pos_endo_mono'_closed[OF _ endo_cap', where E=E])\n using assms dom_fg_finite[of h2'] unfolding zero_fun_def by blast+\n\n have \"\\xs \\ set xss. n \\ set xs\"\n using xssdef nsdef by auto\n then obtain nss1 ns1 ns2 nss2 where nss: \"concat xss = concat nss1 @ ns1 @ n # ns2 @ concat nss2\"\n \"xss = nss1 @ (ns1 @ n # ns2) # nss2\"\n using split_list_list[of xss n] by auto\n\n have nss2_ne: \"nss2 \\ []\" \"hd nss2 \\ []\"\n using False nss apply auto[1]\n using xssdef nss \n by (metis (no_types, lifting) False Un_iff insert_iff last.simps last_appendR list.distinct(1)\n list.set(2) list.set_sel(1) set_append)\n then have blub: \"hd (concat nss2) = hd (hd nss2)\"\n by (metis concat.simps(2) hd_Cons_tl hd_append2)\n\n let ?c = \"chain ?e' (n # ns2 @ concat nss2) n\"\n have \"?c \\ E\"\n apply (rule endo_chain_closed, rule endo_edge_fg_plus_fg)\n using \\?h' \\ bot\\ assms unfolding zero_fun_def by blast+\n then have red: \"\\x. ?c x \\ 0 \\ ?c (?c x) \\ 0\"\n using \\pointwise_reduced E\\ unfolding pointwise_reduced_def comp_def zero_fun_def by simp\n\n have \"chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2) n (?i (hd ns)) \\ 0\"\n using nsdef nss xssdef by metis\n then have \"chain ?e' (n # ns2 @ concat nss2) n (chain ?e' (concat nss1 @ ns1) n (?i (hd ns))) \\ 0\"\n using chain_append_nonempty[of ?e' \"concat nss1 @ ns1\" \"n # ns1 @ concat nss2\" n]\n by (metis append_assoc chain_append_nonempty hd_append2 list.distinct(1) list.sel(1))\n then have \"chain ?e' (n # ns2 @ concat nss2) n (chain ?e' (n # ns2 @ concat nss2) n (chain ?e' (concat nss1 @ ns1) n (?i (hd ns)))) \\ 0\"\n using red by simp\n then have \"chain ?e' (n # ns2) (hd (hd nss2)) (chain ?e' (n # ns2 @ concat nss2) n (chain ?e' (concat nss1 @ ns1) n (?i (hd ns)))) \\ 0\"\n using chain_append_not_zero(1)[of \"n # ns2 @ concat nss2\" \"n # ns2\" \"concat nss2\" \"edge_fg (h1' + h2')\" n\n \"chain (edge_fg (h1' + h2')) (n # ns2 @ concat nss2) n (chain (edge_fg (h1' + h2')) (concat nss1 @ ns1) n (inf_fg (h1 + h2) (hd ns)))\" E]\n using nss2_ne blub nss xssdef \\\\x y. edge_fg (h1' + h2') x y \\ E\\ \\End_closed E\\ by simp\n then have \"chain ?e' (n # ns2) (hd (hd nss2)) (chain ?e' (n # ns2 @ concat nss2) (hd ((n # ns2) @ [hd (hd nss2)])) (chain ?e' (concat nss1 @ ns1) n (?i (hd ns)))) \\ 0\"\n by simp\n then have \"chain ?e' (n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (chain ?e' (concat nss1 @ ns1) n (?i (hd ns))) \\ 0\"\n by (subst (asm) chain_append_nonempty[symmetric], simp)\n then have \"chain ?e' (n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (chain ?e' (concat nss1 @ ns1) (hd ((n # ns2 @ concat nss2 @ n # ns2) @ [hd (hd nss2)])) (?i (hd ns))) \\ 0\"\n by simp\n then have ne0: \"chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (?i (hd ns)) \\ 0\"\n by (subst (asm) chain_append_nonempty[symmetric], simp)\n then have \"0 < chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (?i (hd ns))\"\n using gr_zeroI by blast\n also have \"... = chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (?i' (hd ns))\"\n using infeq(1) by auto\n also have \"... \\ chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (?i1' (hd ns))\"\n apply (rule pos_endo_mono'_closed[OF inf_fg_le_inf_fg[of h1' h2' \"hd ns\" E]])\n using nbot True assms apply blast\n using nbot True assms apply blast\n using nbot True assms apply blast\n apply (rule endo_chain_closed)\n using nbot True assms by blast+\n finally have ne00: \"chain ?e' (concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2) (hd (hd nss2)) (?i1' (hd ns)) \\ 0\" by simp\n\n let ?ns = \"concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2\"\n let ?n = \"hd (hd nss2)\"\n let ?xss = \"xss @ [n # ns2]\"\n\n have \"ns1 @ n # ns2 \\ set xss\"\n using nss by simp\n then have \"?P (ns1 @ n # ns2) \\ ?Q (ns1 @ n # ns2)\"\n using alternating_props[OF altpq] by blast\n\n have Y1: \"?n \\ set (map hd xss)\"\n using nss nss2_ne by simp\n\n have Y2: \"?ns = concat ?xss\"\n using nss by simp\n\n have Y3: \"?n \\ set (map hd ?xss)\"\n using Y1 Y2 by simp\n\n have \"last nss2 = last xss\"\n using xssdef nss nss2_ne by simp\n\n have \"\\xss. concat xss = ?ns \\ xss \\ [] \\ (\\xs\\set xss. xs \\ []) \\\n alternating (segment_fg h1) (segment_fg h2) xss\"\n apply (rule split_segments[of ?ns ?N1 ?N2])\n apply simp\n apply simp\n apply (intro conjI)\n using assms nbot nsdef apply (metis dom_fg_plus_fg_iff in_mono)\n using assms dom nss xssdef subgoal\n by (metis set_append set_concat sup.boundedE)\n using \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ apply auto[1]\n using \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ apply auto[1]\n using assms(16) assms(17) dom(3) nss(1) xssdef(1) apply auto[1]\n using \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ apply auto[1]\n by (simp add: True Y2 assms(16) dom(2) xssdef(1))\n then obtain yss where yssdef: \"concat yss = ?ns\" \"yss \\ []\" \"\\xs\\set yss. xs \\ []\"\n \"alternating (segment_fg h1) (segment_fg h2) yss\"\n by auto\n\n have some_rule: \"alternating (segment_fg h1') (segment_fg h2') xs \\ xs = xs1 @ x1 # x2 # xs2 \\\n segment_fg h1' x1 \\ segment_fg h2' x2\" for xs xs1 x1 x2 xs2\n proof -\n assume A: \"alternating (segment_fg h1') (segment_fg h2') xs\" \"xs = xs1 @ x1 # x2 # xs2\"\n have \"alternating (segment_fg h1') (segment_fg h2') xs1\"\n using alternating_append1 A by auto\n then show ?thesis\n using A dom(3,4)\n apply (induction xs1 arbitrary: xs rule: alternating_induct'_symmetric[where a=h1' and b=h2'])\n apply simp\n apply simp\n apply (metis Int_commute Int_left_commute inf_bot_right le_iff_inf set_empty)\n apply simp\n subgoal premises prems for a b x y zs xs\n proof -\n have A: \"segment_fg b x1 = segment_fg a x2\"\n using prems by auto\n show ?thesis\n proof (cases \"segment_fg b x1\")\n case True\n then have B1: \"\\ segment_fg a x1\" using prems\n by (metis Int_assoc inf_bot_right le_iff_inf set_empty)\n from True have B2: \"\\segment_fg b x2\"\n by (metis Int_assoc Int_empty_right A le_iff_inf prems set_empty)\n show ?thesis using B1 B2 by auto\n next\n case False\n then have B1: \"segment_fg a x1\" using prems\n by (metis (mono_tags, lifting) UnCI alternating_props list.set_intros(1) set_append)\n from A False have \"\\ segment_fg a x2\" by blast\n then have \"\\segment_fg b x1\" using prems by auto\n then have B2: \"segment_fg b x2\"\n using A prems alternating_props[of \"segment_fg a\" \"segment_fg b\" \"zs @ x1 # x2 # xs2\"]\n by auto\n show ?thesis using B1 B2 by auto\n qed\n qed\n done\n qed\n\n have some_result: \"segment_fg h1' (ns1 @ n # ns2) \\ segment_fg h2' (hd nss2)\"\n apply (rule some_rule[of xss nss1 \"ns1 @ n # ns2\" \"hd nss2\" \"tl nss2\"])\n using xssdef apply simp\n using nss nss2_ne by simp\n then have \"segment_fg h1' (n # ns2) \\ segment_fg h2' (hd nss2)\"\n using nss2_ne apply auto\n using \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\\n using assms(16) assms(17) dom(1) by auto\n\n have HHH: \"set (n # ns2) \\ dom_fg h1 \\ set (n # ns2) \\ dom_fg h2\"\n using \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ by auto\n\n have BRUMM: \"\\xs \\ set xss. set xs \\ dom_fg h1' \\ \\ set xs \\ dom_fg h2'\"\n using nss xssdef dom nss2_ne\n by (metis (no_types, lifting) Int_assoc alternating_props inf_bot_right le_iff_inf set_empty)\n\n have \"\\ys yss. alternating' (segment_fg h1) (segment_fg h2) (butlast xss @ [last xss @ ys] @ yss) (hd nss2) \\\n concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2 = concat (butlast xss @ [last xss @ ys] @ yss) \\\n (\\xs\\set xss. xs \\ []) \\ last xss @ ys \\ [] \\ (\\xs\\set yss. xs \\ []) \\ ys @ concat yss = n # ns2 \\ (ys = [] \\ yss = [])\"\n apply (rule split_segments_extend[of \"dom_fg h1\" \"dom_fg h2\" xss ?ns \"n # ns2\" \"hd nss2\"])\n using xssdef nss \\?N1 = ?N1'\\ \\?N2 = dom_fg h2'\\ dom nsdef nbot nss2_ne HHH apply simp_all\n apply blast\n apply (meson disjoint_iff_not_equal dom(1))\n subgoal premises prems using BRUMM nss nss2_ne by simp\n using \\segment_fg h1' (n # ns2) = segment_fg h2' (hd nss2)\\ by auto\n then obtain zs zss where zss:\n \"alternating' (segment_fg h1) (segment_fg h2) (butlast xss @ [last xss @ zs] @ zss) (hd nss2)\"\n \"concat nss1 @ ns1 @ n # ns2 @ concat nss2 @ n # ns2 = concat (butlast xss @ [last xss @ zs] @ zss)\"\n \"\\xs\\set xss. xs \\ []\" \"last xss @ zs \\ []\" \"\\xs\\set zss. xs \\ []\"\n \"zs @ concat zss = n # ns2\" \"zs = [] \\ zss = []\" \"n # ns2 = zs @ concat zss\"\n by (metis (no_types, lifting))\n have zss': \"alternating (segment_fg h1) (segment_fg h2) (butlast xss @ [last xss @ zs] @ zss)\"\n apply (rule alternating'_to_alternating)\n using zss by blast\n\n let ?zss = \"butlast xss @ [last xss @ zs] @ zss\"\n\n have \"last xss = last nss2\" using nss nss2_ne by simp\n moreover have \"butlast xss = nss1 @ (ns1 @ n # ns2) # butlast nss2\"\n using nss nss2_ne by (simp add: butlast_append)\n ultimately have WWW: \"?zss = nss1 @ (ns1 @ n # ns2) # butlast nss2 @ [last nss2 @ zs] @ zss\"\n by simp\n have n_hd: \"?n = hd (hd (butlast nss2 @ [last nss2 @ zs] @ zss))\"\n by (metis \\last xss = last nss2\\ append_self_conv2 hd_append2 last_in_set\n list.sel(1) nss2_ne(1) snoc_eq_iff_butlast xssdef)\n then have MMM: \"?n = hd (concat (butlast nss2 @ [last nss2 @ zs] @ zss))\"\n using nss nss2_ne yssdef apply simp by (cases nss2, simp, case_tac list, simp, simp)\n\n let ?uss = \"butlast nss2 @ [last nss2 @ zs] @ zss\"\n\n have \"set (map hd xss) = set (map hd (butlast xss @ [last xss @ zs]))\"\n using \\xss \\ []\\ nss2_ne \\\\xs\\set xss. xs \\ []\\\n by (induction xss rule: list_nonempty_induct, simp_all)\n then have n_in_hd_zss: \"?n \\ set (map hd ?zss)\"\n using Y1 by auto\n\n have www: \"hd (hd (butlast xss @ (last xss @ zs) # zss)) = hd ns\"\n by (simp add: bl_xss_ne hdns)\n\n have mmm: \"inf_fg (h1 + h2) (hd ns) \\ inf_fg h1' (hd (hd (butlast xss @ (last xss @ zs) # zss)))\"\n apply (subst www, subst infeq(1)[symmetric])\n apply (rule inf_fg_le_inf_fg)\n using nbot apply simp\n apply (simp add: True)\n using assms by blast\n\n have ttt: \"hd (hd (nss1 @ (ns1 @ zs @ concat zss) # butlast nss2 @ (last nss2 @ zs) # zss)) = hd ns\"\n using xssdef nss zss by (metis \\hd ns = hd (hd xss)\\ append_self_conv2 hd_append2 list.sel(1))\n\n have zss_alt: \"alternating (len_segment_fg h1) (len_segment_fg h2) ?zss\"\n apply (subst \\?N1 = ?N1'\\)+\n apply (subst \\?N2 = dom_fg h2'\\)+\n apply (rule eff_acyclic_chain_length_le_card'[where E=E and n=\"hd (hd nss2)\"])\n using zss' \\?N1 = ?N1'\\ \\?N2 = dom_fg h2'\\ apply simp\n using nbot apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n apply (subst chains'_chain, simp)\n using xssdef zss apply safe\n apply (metis (mono_tags, lifting) alternating_props zss')\n apply (metis (mono_tags, lifting) alternating_props zss')+\n apply (metis (no_types, lifting) append_Nil append_Nil2 bl_xss_ne concat.simps(1) concat.simps(2) concat_append hd_append2 hdns ne00)\n apply (metis (no_types, lifting) append_Nil2 bl_xss_ne concat.simps(1) concat.simps(2) concat_append hd_append2 hdns ne00)\n by (metis (no_types, lifting) append_Nil2 bl_xss_ne concat.simps(1) concat.simps(2) concat_append hd_append2 hdns ne00)\n\n let ?PP = \"alt (len_segment_fg h2) (len_segment_fg h1) (nss1 @ [ns1 @ n # ns2])\"\n let ?QQ = \"alt (len_segment_fg h1) (len_segment_fg h2) (nss1 @ [ns1 @ n # ns2])\"\n\n have \"alternating (len_segment_fg h1) (len_segment_fg h2) (butlast (nss1 @ (ns1 @ n # ns2) # nss2) @ [last (nss1 @ (ns1 @ n # ns2) # nss2) @ zs] @ zss)\"\n using zss_alt nss by simp\n then have blub': \"alternating (len_segment_fg h1) (len_segment_fg h2) ((nss1 @ [ns1 @ n # ns2]) @ ?uss)\"\n using nss WWW by auto\n have uss_alt: \"alternating ?PP ?QQ ?uss\"\n by (fact alternating_append2[OF blub'])\n\n have blub': \"alternating (segment_fg h1') (segment_fg h2') ((nss1 @ [ns1 @ n # ns2] @ [hd nss2]) @ (tl nss2))\"\n using xssdef nss nss2_ne by simp\n have \"alternating' (\\xs. set xs \\ dom_fg h1') (\\xs. set xs \\ dom_fg h2') (butlast (nss1 @ [ns1 @ n # ns2] @ [hd nss2])) (last (nss1 @ [ns1 @ n # ns2] @ [hd nss2]))\"\n by (rule alternating_to_alternating'[OF alternating_consequence[OF alternating_append1[OF blub']]], simp_all)\n then have prefix_alt: \"alternating' (\\xs. set xs \\ dom_fg h1') (\\xs. set xs \\ dom_fg h2') (nss1 @ [ns1 @ n # ns2]) (hd nss2)\"\n by (simp add: butlast_append)\n\n have \"hd (concat (nss1 @ [ns1 @ n # ns2])) = hd ns\"\n using xssdef nss yssdef\n by (metis (no_types, lifting) concat.simps(1) concat.simps(2) concat_append hd_append list.sel(1))\n then have S1: \"hd (concat (nss1 @ [ns1 @ n # ns2]) @ [hd (concat (butlast nss2 @ [last nss2 @ zs] @ zss) @ [hd (hd nss2)])]) = hd ns\"\n by (metis \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ append_is_Nil_conv concat.simps(2) concat_append hd_append2)\n\n have S2: \"hd ns = hd (hd (butlast (nss1 @ (ns1 @ n # ns2) # nss2) @ (last nss2 @ zs) # zss))\"\n using xssdef nss yssdef bl_xss_ne hdns by auto\n have S3: \"hd ns = hd (hd (nss1 @ [ns1 @ n # ns2]))\"\n by (metis \\hd ns = hd (hd xss)\\ append_self_conv2 hd_append2 list.sel(1) nss(2))\n\n have dom_subs: \"dom_fg h1 \\ dom_fg h\" \"dom_fg h2 \\ dom_fg h\"\n using assms(2) assms(3) by auto\n\n have hds: \"\\ys \\ set ?zss. hd ys \\ dom_fg h\"\n apply (rule alternatingD[OF zss_alt])\n using dom_subs by fastforce+\n\n have \"\\a list. butlast nss2 = a # list \\ set (hd (butlast nss2)) \\ dom_fg (h1' + h2')\"\n using xssdef nss alternating_props[of \"segment_fg h1'\" \"segment_fg h2'\" xss] nss2_ne nbot\n apply simp\n by (metis (no_types, lifting) Un_iff append_butlast_last_id empty_set hd_append2 hd_in_set\n list.sel(1) list.set_intros(1) sup.coboundedI1 sup.coboundedI2 sup_bot.right_neutral)\n then have TOE: \"\\a list. butlast nss2 = a # list \\ hd (hd (butlast nss2)) \\ dom_fg (h1' + h2')\"\n using nss2_ne by (metis append_butlast_last_id hd_append2 hd_in_set in_mono list.simps(3))\n\n have hd_hd_uss_in_h1h2: \"hd (hd ?uss) \\ dom_fg (h1 + h2)\"\n apply (cases \"butlast nss2\")\n using xssdef yssdef nss assms nss2_ne nsdef \\h1' + h2' \\ bot\\\n apply (metis (no_types, lifting) Un_iff \\last xss = last nss2\\ append_is_Nil_conv\n append_self_conv2 hds list.set_sel(1) list.simps(3) set_append)\n by (metis TOE assms dom(6) hd_append list.simps(3) nbot(1) plus_fg_dom_un)\n\n have all_tl: \"\\x \\ set xs. P x \\ \\x \\ set (tl xs). P x\" for xs P\n by (induction xs, simp_all)\n\n have \"chain ?e' ?ns (hd (hd nss2)) = chains ?e' ?zss (hd (hd nss2))\"\n apply (subst chain_chains[of ?ns ?zss ?e' \"(hd (hd nss2))\"], simp_all add: list.set_sel)\n using yssdef zss xssdef zss' concat_append\n apply (metis (no_types, lifting) append.right_neutral append_self_conv2 concat.simps(2))\n by (rule all_tl, metis zss Un_iff in_set_butlastD insert_iff list.set(2) set_append)\n also have \"... = chains' (chain ?e') ?zss (hd (hd nss2))\"\n using chains'_chains[symmetric, of ?e' ?zss ?n] by auto\n finally have XXX: \"chain ?e' ?ns ?n = chains' (chain ?e') ?zss ?n\" .\n\n have alt_cases: \"\\ P z \\ \\ Q z \\ \\ alt P Q xs z\" for P Q xs z\n by (induction xs arbitrary: P Q, auto)\n\n have blub: \"\\xs y. xs \\ set (butlast nss2 @ [last nss2 @ zs] @ zss) \\\n (if set xs \\ dom_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) then cap_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) (hd (xs @ [y])) y\n else if set xs \\ dom_fg (alt h1 h2 (nss1 @ [ns1 @ n # ns2])) then cap_fg (alt h1 h2 (nss1 @ [ns1 @ n # ns2])) (hd (xs @ [y])) y else 0) =\n (if set xs \\ dom_fg h1 then cap_fg h1 (hd (xs @ [y])) y else if set xs \\ dom_fg h2 then cap_fg h2 (hd (xs @ [y])) y else 0)\"\n proof (goal_cases)\n case (1 xs y)\n then have **: \"xs \\ []\"\n apply auto\n using \\last nss2 = last xss\\ zss apply auto[1]\n apply (metis Un_iff \\butlast xss = nss1 @ (ns1 @ n # ns2) # butlast nss2\\\n in_set_butlastD insert_iff list.set(2) set_append zss(3))\n using zss by blast\n let ?zs = \"nss1 @ [ns1 @ n # ns2]\"\n have \"alt h1 h2 ?zs \\ {h1,h2}\" using alt_in[of ?zs h1 h2] by simp\n then consider (a) \"alt h1 h2 ?zs = h1\" | (b) \"alt h1 h2 ?zs = h2\" by blast\n then show ?case\n proof cases\n case a\n from a have \"alt h2 h1 ?zs = h2\" using alt_comm[of h1 h2 ?zs] by simp\n then show ?thesis\n using 1 a dom ** apply simp\n by (meson disjoint_iff_not_equal hd_in_set in_mono)\n next\n case b\n from b have \"alt h2 h1 ?zs = h1\" using alt_comm[of h1 h2 ?zs] by simp\n then show ?thesis\n using 1 b dom ** by simp\n qed\n qed\n\n have BRUM: \"hd (hd nss2) = hd (concat (butlast nss2 @ [last nss2 @ zs] @ zss) @ [hd (hd nss2)])\"\n using nss2_ne by (simp add: hd_append MMM)\n\n have AUXAUX:\n \"alternating' (segment_fg h1) (segment_fg h2) xss ys \\ hd ys \\ dom_fg (alt h2 h1 xss)\"\n for xss ys\n by (induction xss rule: alternating'_induct'[where a=h1 and aa=h1 and bb=h2 and b=h2], auto)\n\n have \"0 < chain ?e' ?ns ?n (?i (hd ns))\"\n using ne0 nss gr_zeroI by metis\n also have \"... = chains' (chain ?e') ?zss ?n (?i (hd ns))\"\n using XXX by simp\n also have \"... \\ chains' ?g1 ?zss ?n (?i (hd ns))\"\n by (rule alternating_chains'_mono[OF zss_alt X1 X2], simp_all)\n also have \"... \\ chains' ?g2 ?zss ?n (?i (hd ns))\"\n by (rule alternating_chains'_mono[OF zss_alt X4 X5], simp_all add: assms)\n also have \"... = chains' ?g3 ?zss ?n (?i (hd ns))\"\n apply (subst \\dom_fg h1 = dom_fg h1'\\)\n apply (subst \\dom_fg h1 = dom_fg h1'\\)\n apply (subst \\dom_fg h1 = dom_fg h1'\\)\n apply (subst \\dom_fg h2 = dom_fg h2'\\)\n apply (subst \\dom_fg h2 = dom_fg h2'\\)\n apply (subst \\dom_fg h2 = dom_fg h2'\\)\n apply (rule chains'_switch_world[of h1 h2 ?zss \"hd nss2\" h1' h2' E \"?i (hd ns)\"])\n using nss xssdef yssdef apply simp_all\n subgoal using nss2_ne zss apply safe using zss by simp_all\n using \\?N1 = ?N1'\\ apply simp\n using assms nss2_ne apply (simp_all (no_asm_simp))\n apply (metis Un_iff in_set_butlastD zss(3) zss(5))\n apply presburger\n apply presburger\n apply blast\n apply (subst S2, rule inf_fg_le_inf_fg)\n apply blast\n using S2 True by presburger\n also have \"... \\ chains' ?g3 ?zss ?n (?i1 (hd ns))\"\n apply (rule pos_endo_mono'_closed[OF inf_fg_le_inf_fg])\n using assms apply blast\n using True assms(16) apply blast\n apply blast\n apply (rule endo_chains')\n using assms apply blast\n apply auto[1]\n by (auto simp: assms endo_cap')+\n also have \"... = chains' ?g3 ?uss ?n (chains' ?g3 (nss1 @ [ns1 @ n # ns2]) (hd (concat ?uss @ [?n])) (?i1 (hd ns)))\"\n apply (rule chains'_append) using WWW apply simp using zss by (smt alternating_props zss')\n also have \"... = chains' ?g3 ?uss ?n (chains' ?g3 (nss1 @ [ns1 @ n # ns2]) (hd (concat ?uss @ [?n])) (?i1 (hd (hd (nss1 @ [ns1 @ n # ns2])))))\"\n using S3 by simp\n also have \"... = chains' ?g3 ?uss ?n (chains' ?g3 (nss1 @ [ns1 @ n # ns2]) (hd (hd nss2)) (?i1 (hd (hd (nss1 @ [ns1 @ n # ns2])))))\"\n by (metis (no_types, lifting) append_self_conv2 hd_append2 list.sel(1) MMM)\n also have \"... \\ chains' ?g3 ?uss ?n (inf_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) (hd (hd nss2)))\"\n apply (rule pos_endo_mono'_closed[where E=E and f=\"chains' ?g3 ?uss ?n\", OF chains'_cap_fg_inf_fg_le_inf_fg'[of \"\\h1' xs. set xs \\ dom_fg h1'\" h1 h2 _ _ h E]])\n apply (simp only: prefix_alt \\?N1 = ?N1'\\ \\?N2 = dom_fg h2'\\)\n using assms apply blast+\n using assms apply (simp_all (no_asm) add: zero_fun_def)\n apply (metis Un_iff \\butlast xss = nss1 @ (ns1 @ n # ns2) # butlast nss2\\ in_set_butlastD set_append zss(3))\n using zss nss \n subgoal premises prems proof -\n have \"alternating (segment_fg h1) (segment_fg h2) ((nss1 @ [ns1 @ n # ns2]) @ butlast nss2 @ [last nss2 @ zs] @ zss)\"\n using zss' WWW by simp\n then have \"alt (segment_fg h2) (segment_fg h1) (nss1 @ [ns1 @ n # ns2]) (hd (butlast nss2 @ [last nss2 @ zs]))\"\n using alternating_append_inner[of \"segment_fg h1\" \"segment_fg h2\" \"nss1 @ [ns1 @ n # ns2]\" \"butlast nss2 @ [last nss2 @ zs] @ zss\"] nss2_ne\n by (metis (no_types, lifting) append_is_Nil_conv append_self_conv2 hd_append2 list.simps(3))\n then have \"segment_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) (hd (butlast nss2 @ [last nss2 @ zs]))\"\n by (subst (asm) alt_P_P_hom[of segment_fg h2 h1], simp)\n then show ?thesis using nss2_ne zss(6)\n by (metis (no_types, lifting) append_Nil2 append_butlast_last_id list.set_sel(1) n_hd subsetD zss(7))\n qed\n apply (rule endo_chains'[where E=E], simp_all (no_asm), intro allI conjI impI)\n by (rule endo_cap'[where E=E], simp_all (no_asm) add: zero_fun_def)+\n also have \"... \\ (\\xs\\l_lists' (dom_fg h) (card (dom_fg h) * length ?uss). chain (edge_fg h) (hd (hd ?uss) # xs) ?n (inf_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) (hd (hd nss2))))\"\n apply (subst chains'_cong[OF blub[symmetric]], simp)\n apply (rule chains'_cap_inf_le_chain_sum[where E=E])\n apply (rule alternating_consequence[OF uss_alt])\n apply (safe, induction nss1 arbitrary: h1 h2, simp)\n apply auto[1]\n apply simp\n subgoal premises prems for x\n proof -\n have \"\\ (alt (len_segment_fg h2) (len_segment_fg h1) (nss1 @ [ns1 @ n # ns2]) [])\"\n by (rule alt_cases, auto)\n then show False using prems by auto\n qed\n apply (induction nss1 arbitrary: h1 h2)\n apply auto[1]\n apply simp\n subgoal premises prems for x\n proof -\n have \"\\ (alt (len_segment_fg h1) (len_segment_fg h2) (nss1 @ [ns1 @ n # ns2]) [])\"\n by (rule alt_cases, auto)\n then show False using prems by auto\n qed\n using \\h \\ bot\\ apply blast\n using alt_sum[of h2 h1] \\h = h1 + h2\\ apply (auto simp: algebra_simps)[1]\n subgoal apply simp using zss nss xssdef nss2_ne\n by (metis (no_types, lifting) Un_iff in_set_butlastD insert_iff last_in_set list.set(2) set_append)\n subgoal apply (subst alt_alt_to_alt) using AUXAUX[OF zss(1)] WWW by simp\n subgoal using nss xssdef zss' alternating_props[OF zss'] WWW nsdef \\?N1 = ?N1'\\ \\?N2 = dom_fg h2'\\ \\h = h1 + h2\\ \\h \\ bot\\\n by (smt UnCI plus_fg_dom_un set_append set_subset_Cons subsetD)\n using \"***\"(7) assms dom_subs(1) apply blast\n using assms apply blast\n using alt_edge assms\n apply (metis \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ append_is_Nil_conv concat.simps(1) concat.simps(2))\n using alt_edge assms\n apply (metis \\len_segment_fg h1 (ns1 @ n # ns2) \\ len_segment_fg h2 (ns1 @ n # ns2)\\ append_is_Nil_conv concat.simps(1) concat.simps(2))\n using assms apply simp_all\n using nss2_ne apply (cases nss2, blast)\n by (metis append_self_conv2 hd_append2 list.sel(1) list.simps(3) n_hd order_refl)\n finally obtain ys where ys: \"ys \\ l_lists' (dom_fg h) (card (dom_fg h) * length (butlast nss2 @ [last nss2 @ zs] @ zss))\"\n \"chain ?e (hd (hd ?uss) # ys) ?n (inf_fg (alt h2 h1 (nss1 @ [ns1 @ n # ns2])) (hd (concat ?uss @ [?n]))) \\ 0\"\n by (smt gr_implies_not_zero sum.not_neutral_contains_not_neutral nss2_ne BRUM)\n\n have alternating'_append1: \"alternating' P Q (xs @ ys) z \\ ys \\ [] \\ alternating' P Q xs (hd ys)\" for P Q xs ys z\n by (induction xs arbitrary: P Q, auto, cases ys, auto)\n\n show False\n apply (rule contradict_eff_acyclic_flow[OF \\eff_acyclic' h\\, where E=E and ns=\"hd (hd ?uss) # ys\" and n=\"?n\"])\n subgoal proof -\n let ?zs = \"nss1 @ [ns1 @ n # ns2]\"\n\n have ALT: \"alternating' (segment_fg h1) (segment_fg h2) (nss1 @ (ns1 @ n # ns2) # butlast nss2 @ [last nss2 @ zs] @ zss) (hd nss2)\"\n using WWW zss by presburger\n\n have \"alternating' (segment_fg h1) (segment_fg h2) ?zs (hd (butlast nss2 @ [last nss2 @ zs] @ zss))\"\n apply (rule alternating'_append1[of _ _ ?zs \"butlast nss2 @ [last nss2 @ zs] @ zss\"])\n using ALT by auto\n then have ALT: \"alternating' (segment_fg h1) (segment_fg h2) ?zs (hd (butlast nss2 @ [last nss2 @ zs]))\"\n using nss2_ne\n by (metis (no_types, lifting) append_self_conv2 hd_append2 not_Cons_self2)\n\n have S: \"hd (concat (butlast nss2 @ [last nss2 @ zs] @ zss) @ [hd (hd nss2)]) = hd (hd (hd (butlast nss2 @ [last nss2 @ zs] @ zss)) # ys)\"\n using nss2_ne by (cases nss2, simp, simp)\n\n have BRUM2: \"hd (hd (butlast nss2 @ [last nss2 @ zs])) = hd (concat (butlast nss2 @ [last nss2 @ zs] @ zss) @ [hd (hd nss2)])\"\n using nss2_ne BRUM n_hd zss(7) by auto\n\n have \"0 < chain ?e (hd (hd ?uss) # ys) ?n (inf_fg (alt h2 h1 ?zs) (hd (concat ?uss @ [?n])))\"\n using ys gr_zeroI by auto\n also have \"... \\ chain ?e (hd (hd ?uss) # ys) ?n (flow_fg h (hd (concat ?uss @ [?n])))\"\n using alternating_inf_fg_flow_fg[OF _ _ _ zss(1)]\n apply simp using n_hd[symmetric] BRUM2[symmetric] apply simp\n apply (rule pos_endo_mono'_closed[where f=\"chain _ _ _\" and E=E, OF alternating_inf_fg_flow_fg[OF _ _ _ ALT]])\n using assms apply blast\n using assms apply blast\n apply (metis \\last xss = last nss2\\ append_Nil append_butlast_last_id hd_append2 list.sel(1) nss2_ne(1) nss2_ne(2) zss(4))\n apply (simp add: assms(10) assms(18) endo_chain_closed_nonempty)\n using assms by blast\n finally show ?thesis \n using S by simp\n qed\n subgoal using nss2_ne apply (cases nss2, simp, simp, intro conjI)\n using assms(2) hd_hd_uss_in_h1h2 n_hd apply auto[1]\n using ys unfolding l_lists'_def by simp\n subgoal using nss2_ne by (cases nss2, simp, simp)\n using assms by blast+\n qed\nqed\n\n\ntext \\Case 1 (@{term \"h1 = dom_fg h1'\"}) of Theorem 3 in @{cite krishna20}\\\n\nlemma maintain_eff_acyclic_dom_eq:\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes \"pointwise_reduced E\" \"h = h1 + h2\" \"h \\ bot\" \"h1' \\ bot\" \"h1 \\\\<^sub>S h1'\" \"dom_fg h1' \\ dom_fg h2 = {}\"\n \"\\n \\ dom_fg h1' - dom_fg h1. outf_fg h2 n = 0\"\n \"\\x y. edge_fg h x y \\ E\"\n \"eff_acyclic' h\" \"eff_acyclic' h1\" \"eff_acyclic' h1'\" \"eff_acyclic' h2\"\n \"dom_fg h1 = dom_fg h1'\" \"End_closed E\" \"id \\ E\"\n \"\\x y. edge_fg h2 x y \\ E\" \"\\x y. edge_fg h1 x y \\ E\" \"\\x y. edge_fg h1' x y \\ E\" \"\\x y. edge_fg (h1' + h2) x y \\ E\"\n \"(\\_. 0) \\ E\" \"id \\ E\"\n \"\\n\\dom_fg h1. \\n'\\- dom_fg h1'. \\m\\inf_fg h1 n. cap_fg h1 n n' m = cap_fg h1' n n' m\"\n \"\\n\\dom_fg h2. \\n'\\- dom_fg h2. \\m\\inf_fg h2 n. cap_fg h2 n n' m = cap_fg h2 n n' m\" \"\\x y. edge_fg (h1 + h2) x y \\ E\"\n shows \"\\h'. h' = h1' + h2 \\ h' \\ bot \\ eff_acyclic' h' \\ h \\\\<^sub>S h'\"\nproof -\n have *: \"h1 \\ bot\" \"h2 \\ bot\" using assms plus_fg_ops_exist by auto\n then have **: \"int_fg h1 = int_fg h1'\" \"\\n \\ dom_fg h1. \\n' \\ -dom_fg h1. \\m \\ inf_fg h1 n. cap_fg h1 n n' m = cap_fg h1' n n' m\"\n using assms unfolding subflow_preserving_extension_def contextual_extension_def int_fg_def by (auto intro: fi_cong)\n\n have nbot: \"h1' + h2 \\ bot\" \"int_fg (h1' + h2) = int_fg (h1 + h2)\"\n using assms int_fg_fi_hom[of h1' h2] int_fg_fi_hom[of h1 h2] **\n by (metis int_fg_bot_bot int_fg_bot_bot')+\n then have infeq: \"inf_fg (h1' + h2) = inf_fg (h1 + h2)\" \"int_fg h1' = int_fg h1\"\n using int_fg_to_inf_fg ** by auto\n\n let ?h2' = \"h2\"\n have ext2: \"\\n \\ dom_fg h2. \\n' \\ -dom_fg h2. \\m \\ inf_fg h2 n. cap_fg h2 n n' m = cap_fg ?h2' n n' m\"\n by simp\n\n have ea_h1'h2: \"eff_acyclic' (h1' + ?h2')\"\n proof (rule ccontr)\n let ?h' = \"h1' + h2\"\n let ?h = \"h1 + h2\"\n let ?e' = \"edge_fg ?h'\"\n let ?e1' = \"edge_fg h1'\"\n let ?e2' = \"edge_fg h2\"\n let ?e = \"edge_fg h\" let ?e1 = \"edge_fg h1\" let ?e2 = \"edge_fg h2\"\n let ?f' = \"flow_fg ?h'\"\n let ?N' = \"dom_fg ?h'\"\n let ?N1 = \"dom_fg h1\"\n let ?N2 = \"dom_fg h2\"\n let ?N1' = \"dom_fg h1'\"\n let ?N = \"dom_fg h\" let ?Na = \"dom_fg h1\" let ?Nb = \"dom_fg h2\"\n let ?i = \"inf_fg ?h\"\n let ?i' = \"inf_fg ?h'\"\n let ?i1 = \"inf_fg h1\"\n let ?f = \"flow_fg (h1 + h2)\"\n let ?f1 = \"flow_fg h1\"\n let ?f1' = \"flow_fg h1'\"\n let ?i1' = \"inf_fg h1'\"\n let ?i2' = \"inf_fg ?h2'\"\n\n assume \"\\ eff_acyclic' ?h'\"\n then have \"\\xs y. chain (edge_fg (h1' + h2)) xs y (inf_fg (h1 + h2) (hd xs)) \\ 0 \\\n y \\ set xs \\ set xs \\ dom_fg (h1' + h2)\"\n apply (rule eff_acyclic_sourced_path_in_bigraph[of h1' h2 h1 h2 E])\n using assms nbot infeq apply blast+\n using assms unfolding zero_fun_def apply simp\n using infeq apply simp\n using ** assms by blast+\n then obtain ns n where nsdef:\n \"chain (edge_fg (h1' + h2)) ns n (inf_fg (h1 + h2) (hd ns)) \\ 0\"\n \"n \\ set ns\" \"set ns \\ dom_fg (h1' + h2)\"\n by blast\n\n let ?k = \"length ns\"\n\n show False\n proof (cases \"set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2\")\n case True\n then consider (a) \"set ns \\ dom_fg h1'\" | (b) \"set ns \\ dom_fg h2\"\n by auto\n then show ?thesis\n proof (cases)\n case a\n have \"0 < chain ?e1' ns n (?i' (hd ns))\"\n using nsdef assms a infeq chain_cong'[OF edge_fg_plus_fg_on1[of h1' h2], of \"ns\" n] nbot\n by (metis gr_zeroI)\n also have \"... \\ chain ?e1' ns n (?i1' (hd ns))\"\n apply (rule chain_mono[OF inf_fg_le_inf_fg[of h1' h2, where E=E], where E=E])\n using nbot assms apply blast\n apply (metis a equals0D hd_in_set nsdef(2) set_empty subset_code(1))\n using assms by blast+\n finally have T: \"chain ?e1' ns n (?i1' (hd ns)) \\ 0\"\n by simp\n show ?thesis\n using contradict_eff_acyclic[OF \\eff_acyclic' h1'\\ T, where E=E] assms nsdef a \n by metis\n next\n case b\n have \"0 < chain ?e2' ns n (?i' (hd ns))\"\n using nsdef assms b infeq chain_cong'[OF edge_fg_plus_fg_on2[of h1' h2], of \"ns\" n] nbot\n by (metis gr_zeroI)\n also have \"... \\ chain ?e2' ns n (?i2' (hd ns))\"\n apply (rule chain_mono[OF inf_fg_le_inf_fg2[of h1' h2, where E=E], where E=E])\n using assms nbot apply blast\n apply (metis b empty_iff hd_in_set list.set(1) nsdef(2) subset_code(1))\n using assms by blast+\n finally have T: \"chain ?e2' ns n (?i2' (hd ns)) \\ 0\"\n by simp\n show ?thesis\n using contradict_eff_acyclic[OF \\eff_acyclic' h2\\ T, where E=E] assms nsdef b *\n by metis\n qed\n next\n case False\n moreover have dom: \"dom_fg h1' \\ dom_fg h2 = {}\" \"ns \\ []\"\n \"set ns \\ dom_fg h1' \\ dom_fg h2\" \"dom_fg h1' \\ dom_fg h2 = {}\"\n \"?N1 \\ ?N2 = {}\" \"?N1 \\ ?N2 = ?N\"\n using False nsdef ck_lists_props[of ns \"dom_fg (h1' + h2)\" ?k] nbot\n using assms(6) apply blast\n using nsdef nbot \\h = h1 + h2\\ \\h \\ bot\\ by auto\n ultimately obtain n1 n2 where ***: \"n1 \\ set ns\" \"n2 \\ set ns\" \"n1 \\ dom_fg h1'\"\n \"n2 \\ dom_fg h2\" \"n1 \\ n2\" \"n1 \\ dom_fg h2\" \"n2 \\ dom_fg h1'\"\n by blast\n then have \"length ns \\ 2\"\n using length_ge_2[of ?N1 ?N2 n2 n1 ns] assms dom by blast+\n then have \"butlast ns \\ []\"\n by (cases ns, simp_all, case_tac list, simp_all)\n\n show ?thesis\n proof (cases \"hd ns \\ dom_fg h1'\")\n case True\n show ?thesis\n using maintain_eff_acyclic_dom_eq'[of E h h1 h2 \"h1' + h2\" h1' h2 ns n]\n using assms nbot infeq False True nsdef by blast+\n next\n case False\n then have blub: \"hd ns \\ dom_fg h2\"\n using dom(2) list.set_sel(1) nbot(1) nsdef(3) by auto\n have bla: \"h = h2 + h1\" \"h2 + h1' \\ bot\"\n using assms(2) plus_fg_comm apply blast\n by (simp add: nbot(1) plus_fg_comm)\n show ?thesis\n apply (rule maintain_eff_acyclic_dom_eq'[of E h h2 h1 \"h2 + h1'\" h2 h1' ns n])\n using assms nbot infeq False False nsdef \\\\ (set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2)\\ *\n subflow_preserving_extension_refl[of h2] blub bla assms nbot apply blast+\n using nbot assms apply (simp (no_asm) add: algebra_simps)\n using assms nbot infeq False False nsdef \\\\ (set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2)\\ *\n subflow_preserving_extension_refl[of h2] blub bla assms nbot apply blast+\n using nbot assms apply (simp (no_asm) add: algebra_simps)\n using assms nbot infeq False False nsdef \\\\ (set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2)\\ * \n subflow_preserving_extension_refl[of h2] blub bla assms nbot apply blast+\n using nbot assms apply (simp (no_asm) add: algebra_simps)\n using nbot assms infeq apply (simp (no_asm) add: algebra_simps)\n using assms nbot infeq False False nsdef \\\\ (set ns \\ dom_fg h1' \\ set ns \\ dom_fg h2)\\ *\n subflow_preserving_extension_refl[of h2] blub bla assms nbot apply blast+\n subgoal by (simp add: add.commute nsdef(1))\n apply (simp add: nsdef(2))\n by (simp add: add.commute dom(3) nbot(1))\n qed\n qed\n qed\n\n have ext': \"int_fg h \\ int_fg (h1' + h2)\"\n unfolding contextual_extension_def\n using \\h = h1 + h2\\ nbot \\h \\ bot\\ \\dom_fg h1 = dom_fg h1'\\\n by simp\n\n have dom: \"dom_fg (h1 + h2) = dom_fg (h1' + h2)\"\n by (metis dom_fi_int_fg nbot(2))\n\n have cap1: \"\\n\\dom_fg (h1 + h2). \\n'\\- dom_fg (h1' + h2). \\m\\inf_fg h n.\n cap_fg (h1 + h2) n n' m = cap_fg (h1' + h2) n n' m\"\n apply safe\n subgoal for n n' m\n apply (rule cap_fg_eq_cap_fg[of m \"h1 + h2\" n n' h1 h2 \"h1' + h2\" h1' h2 E])\n using assms dom apply blast\n using assms apply blast\n using dom apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using nbot apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n apply (simp add: assms(2) infeq(1))\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using dom apply blast\n using assms apply blast\n using assms apply blast\n using ea_h1'h2 apply blast\n using assms apply blast\n using assms apply blast\n using assms unfolding zero_fun_def apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n using assms apply blast\n done\n done\n\n have ext: \"h \\\\<^sub>S (h1' + h2)\"\n unfolding subflow_preserving_extension_def\n using ext' assms cap1 \n by (metis Diff_cancel dom empty_iff)\n\n show ?thesis\n apply (rule exI[where x=\"h1' + h2\"])\n using ea_h1'h2 nbot ext by simp\nqed\n\ntext \\@{cite \\lem. 3.39\\ krishna19a}, required by @{term maintain_eff_acyclic_dom_ne}\\\n\nlemma plus_fg_eff_acyclic:\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes \"h' = h0 + h\" \"h' \\ bot\" \"\\n n'. edge_fg h0 n n' = (\\_. 0)\" \"eff_acyclic' h\"\n \"\\x y. edge_fg h' x y \\ E\" \"End_closed E\" \"id \\ E\"\n shows \"eff_acyclic' h'\"\n unfolding eff_acyclic'_def eff_acyclic_def\nproof safe\n fix k ns\n show \"1 \\ k \\ ns \\ k_lists (dom_fg h') k\n \\ chain (edge_fg h') ns (hd ns) (flow_fg h' (hd ns)) = 0\"\n proof -\n assume A: \"k \\ 1\" \"ns \\ k_lists (dom_fg h') k\"\n \n show \"chain (edge_fg h') ns (hd ns) (flow_fg h' (hd ns)) = 0\"\n proof (cases \"set ns \\ dom_fg h\")\n case True\n then have X: \"ns \\ k_lists (dom_fg h) k\" \"edge_fg h' = edge_fg h on dom_fg h\"\n \"flow_fg h' = flow_fg h on dom_fg h\"\n using A edge_fg_plus_fg_on2 flow_fg_plus_fg_on2[of h0 h] assms\n unfolding k_lists_def\n by auto\n moreover have B: \"ns \\ k_lists (dom_fg h) k\"\n using True A unfolding k_lists_def by blast\n ultimately show ?thesis\n using A assms unfolding eff_acyclic'_def eff_acyclic_def\n apply (subst chain_cong[of _ _ \"edge_fg h\"])\n using on_eq_superset[OF True edge_fg_plus_fg_on2[of h0 h]] assms\n apply (simp add: k_lists_nonempty(2))\n apply (subst X(3))\n using True A B set_hd_in[of ns \"dom_fg h\"]\n unfolding k_lists_def\n by auto\n next\n case False\n then obtain n where B1: \"n \\ set ns\" \"n \\ -dom_fg h\" by auto\n then obtain ns1 ns2 where B2: \"ns = ns1 @ n # ns2\" using split_list[of n ns] by auto\n\n let ?e' = \"edge_fg h'\"\n\n have C: \"n \\ dom_fg h0\"\n proof -\n have \"dom_fg h0 \\ dom_fg h = {}\" \"dom_fg h0 \\ dom_fg h = dom_fg h'\"\n using assms by auto\n moreover have \"n \\ dom_fg h'\"\n using A B1 unfolding k_lists_def by blast\n ultimately show ?thesis\n using B1 by auto\n qed\n then have \"edge_fg h0 n (hd (ns2 @ [hd ns])) = (\\_. 0)\"\n using assms by simp\n then have C: \"?e' n (hd (ns2 @ [hd ns])) = (\\_. 0)\"\n using edge_fg_plus_fg_on1[of h0 h] assms C by simp\n have D: \"chain ?e' ns (hd ns) =\n chain ?e' (n # ns2) (hd ns) o chain ?e' ns1 (hd ((n # ns2) @ [hd ns]))\"\n using B1 B2 chain_append_nonempty[of \"edge_fg h'\" ns1 \"n#ns2\" \"hd ns\"]\n by auto\n then have \"chain ?e' ns (hd ns) =\n chain ?e' ns2 (hd ns) o ?e' n (hd (ns2 @ [hd ns])) o chain ?e' ns1 (hd ((n # ns2) @ [hd ns]))\"\n using B2 by (cases ns2, auto)\n then have \"chain ?e' ns (hd ns) = chain ?e' ns2 (hd ns) o 0 o chain (edge_fg h') ns1 n\"\n using C by auto\n then have \"chain ?e' ns (hd ns) = (\\_. 0)\"\n using endo_f_0_0_closed[of \"chain ?e' ns2 (hd ns)\" E] endo_chain_closed[of ?e' E] assms B2\n by fastforce\n then show ?thesis\n by simp\n qed\n qed\nqed\n\ntext \\@{cite \\lem. 3.40\\ krishna19a}, required by @{term maintain_eff_acyclic_dom_ne}\\\nlemma outf_eq_h0:\n assumes \"h' = h0 + h\" \"h' \\ bot\" \"\\x y. edge_fg h0 = (\\_ _ _. 0)\"\n shows \"\\n' \\ -dom_fg h'. outf_fg h' n' = outf_fg h n'\"\nproof\n fix x\n assume A: \"x \\ -dom_fg h'\"\n\n have \"outf_fg (h0 + h) x = outf_fg h0 x + outf_fg h x\"\n using outf_fg_plus_fg[of h0 h] A assms by simp\n also have \"... = (\\x' \\ dom_fg h0. edge_fg h0 x' x (flow_fg h0 x')) + outf_fg h x\"\n using outf_fg_unfold[of h0 x] A assms by fastforce\n finally show \"outf_fg h' x = outf_fg h x\"\n using assms by simp\nqed\n\ntext \\@{cite \\lem. 3.41\\ krishna19a}, required by @{term maintain_eff_acyclic_dom_ne}\\\nlemma cap_outside_eq_h':\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes \"h' = h0 + h\" \"h' \\ bot\" \"\\x y. edge_fg h0 = (\\_ _ _. 0)\" \"End_closed E\"\n \"\\x y. edge_fg h' x y \\ E\" \"\\x y. edge_fg h x y \\ E\" \"eff_acyclic' h\" \"id \\ E\" \"(\\_. 0) \\ E\"\n shows \"\\n \\ dom_fg h'. \\n' \\ -dom_fg h'. \\m \\ inf_fg h' n.\n cap_fg h' n n' m = (if n \\ dom_fg h then cap_fg h n n' m else 0)\"\nproof safe\n fix n n' m\n assume A: \"n \\ dom_fg h'\" \"n' \\ dom_fg h'\" \"m \\ inf_fg h' n\"\n\n let ?N' = \"dom_fg h'\" let ?e' = \"edge_fg h'\"\n let ?N = \"dom_fg h\" let ?e = \"edge_fg h\"\n let ?XS' = \"l_lists' ?N' (card ?N')\"\n let ?XS = \"l_lists' ?N (card ?N)\"\n let ?XS1' = \"{xs \\ ?XS'. set xs \\ ?N}\"\n let ?XS2' = \"{xs \\ ?XS'. \\ (set xs \\ ?N)}\"\n let ?XS1 = \"{xs \\ ?XS1'. length xs < card ?N}\"\n let ?XS2 = \"{xs \\ ?XS1'. length xs \\ card ?N}\"\n\n show \"cap_fg h' n n' m = (if n \\ dom_fg h then cap_fg h n n' m else 0)\"\n proof (cases \"n \\ dom_fg h\")\n case True\n\n have XS: \"?XS' = ?XS1' \\ ?XS2'\" \"?XS1' \\ ?XS2' = {}\"\n unfolding l_lists'_def by auto\n\n have XS2: \"?XS1' = ?XS1 \\ ?XS2\" \"?XS1 \\ ?XS2 = {}\"\n unfolding l_lists'_def by auto\n\n have F1: \"finite ?XS1'\"\n by simp\n have F2: \"finite ?XS2'\"\n by simp\n have F3: \"finite ?XS1\"\n by simp\n have F4: \"finite ?XS2\"\n by simp\n\n have Z: \"(\\ns\\?XS2'. chain2 ?e' n ns n' m) = 0\"\n apply (rule sum.neutral)\n proof\n fix xs\n assume A: \"xs \\ ?XS2'\"\n then obtain x where B: \"x \\ ?N\" \"x \\ set xs\" by auto\n then have \"x \\ dom_fg h'\" using assms A unfolding l_lists'_def by auto\n then have C: \"x \\ dom_fg h0\" using B assms by auto\n\n have E: \"?e' x = (\\_ _. 0)\"\n using edge_fg_plus_fg_on1[of h0 h] assms C by simp\n\n obtain xs1 xs2 where D: \"xs = xs1 @ x # xs2\"\n using split_list[OF B(2)] by auto\n have \"chain2 ?e' n xs n' m = chain ?e' (n # xs) n' m\"\n using chain2_chain by metis\n also have \"... = chain ?e' (x # xs2) n' (chain ?e' (n # xs1) (hd ((x # xs2) @ [n'])) m)\"\n using D chain_append_nonempty[of ?e' \"n # xs1\" \"x #xs2\" n' m] by simp\n also have \"... = chain ?e' (x # xs2) n' 0\"\n by (cases xs2, simp_all add: E)\n also have \"... = 0\"\n apply (rule endo_f_0_0_closed)\n apply (rule endo_chain_closed[where E=E], simp_all add: assms)\n apply (rule endo_edge_fg_plus_fg)\n using assms by simp_all\n finally show \"chain2 ?e' n xs n' m = 0\" .\n qed\n\n have ZZ: \"(\\ns\\?XS2. chain2 ?e n ns n' m) = 0\"\n apply (rule sum.neutral)\n proof\n fix xs\n assume AA: \"xs \\ ?XS2\"\n\n have \"chain2 ?e n xs n' m = chain ?e (n # xs) n' m\"\n using chain2_chain by metis\n also have \"... \\ chain ?e (n # xs) n' (inf_fg h' n)\"\n by (rule chain_mono[OF A(3), where E=E], simp_all add: assms)\n also have \"... \\ chain ?e (n # xs) n' (inf_fg h n)\"\n apply (subst \\h' = h0 + h\\, rule chain_mono[OF inf_fg_le_inf_fg2[of h0 h]])\n using assms True by simp_all\n also have \"... \\ chain ?e (n # xs) n' (flow_fg h n)\"\n apply (rule chain_mono[OF inf_fg_le_flow_fg])\n using assms True by auto\n also have \"... \\ chain ?e (n # xs) n' (flow_fg h (hd (n # xs)))\"\n by simp\n also have \"... = 0\"\n apply (rule eff_acyclic'_chain_eq_0)\n using assms True AA by auto\n finally show \"chain2 ?e n xs n' m = 0\" by simp\n qed\n\n have S: \"?XS1 = l_lists' ?N (card ?N)\"\n using assms unfolding l_lists'_def\n apply auto\n using plus_fg_dom_disj\n by (metis add.right_neutral add_leD2 card_Un_Int card_empty dom_fg_finite not_le)\n \n have \"cap_fg h' n n' m = \\ n n' m + (\\ns\\?XS'. chain2 ?e' n ns n' m)\"\n apply (rule cap_unrolled_closed') using assms True by simp_all\n also have \"... = \\ n n' m + (\\ns\\?XS1' \\ ?XS2'. chain2 ?e' n ns n' m)\"\n using XS by simp\n also have \"... = \\ n n' m + ((\\ns\\?XS1'. chain2 ?e' n ns n' m) +\n (\\ns\\?XS2'. chain2 ?e' n ns n' m))\"\n by (subst sum.union_disjoint[OF F1 F2 XS(2), symmetric], simp)\n also have \"... = \\ n n' m + (\\ns\\?XS1'. chain2 ?e' n ns n' m)\"\n using Z by simp\n also have \"... = \\ n n' m + (\\ns\\?XS1 \\ ?XS2. chain2 ?e' n ns n' m)\"\n using XS2 by presburger\n also have \"... = \\ n n' m + (\\ns\\?XS1 \\ ?XS2. chain2 ?e n ns n' m)\"\n apply (simp, rule sum.cong[OF _ chain2_cong_e], simp)\n using edge_fg_plus_fg_on2[of h0 h] assms True unfolding l_lists'_def by auto\n also have \"... = \\ n n' m + ((\\ns\\?XS1. chain2 ?e n ns n' m) +\n (\\ns\\?XS2. chain2 ?e n ns n' m))\"\n by (subst sum.union_disjoint[OF F3 F4 XS2(2), symmetric], simp)\n also have \"... = \\ n n' m + (\\ns\\?XS1. chain2 ?e n ns n' m)\"\n using ZZ by simp\n also have \"... = \\ n n' m + (\\ns\\l_lists' ?N (card ?N). chain2 ?e n ns n' m)\"\n using S by simp\n also have \"... = cap_fg h n n' m\"\n using cap_unrolled_closed'[of \"edge_fg h\" E \"dom_fg h\" n n'] assms True by auto\n finally show ?thesis\n using True\n by simp\n next\n case False\n then have D: \"n \\ dom_fg h0\"\n using assms A by simp\n then have \"edge_fg h0 n = (\\_ _. 0)\"\n using assms by simp\n then have E: \"edge_fg h' n = (\\_ _. 0)\"\n using edge_fg_plus_fg_on1[of h0 h] assms D by simp\n\n have \"cap_fg h' n n' m = \\ n n' m + (\\ns\\?XS'. chain2 ?e' n ns n' m)\"\n apply (rule cap_unrolled_closed') using assms False A by simp_all\n also have \"... = (\\ns\\?XS'. chain2 ?e' n ns n' m)\"\n using A unfolding \\_def by auto\n also have \"... = (\\ns\\?XS'. chain ?e' (n # ns) n' m)\"\n by (rule sum.cong, simp, rule chain2_chain)\n also have \"... = 0\"\n apply (rule sum.neutral, clarsimp)\n apply (case_tac x, simp add: E)\n apply (simp add: E)\n apply (rule endo_f_0_0_closed[where E=E])\n apply (rule endo_chain_closed, simp_all add: assms)\n apply (rule endo_edge_fg_plus_fg)\n using assms by simp_all\n finally show ?thesis\n using False by auto\n qed\nqed\n\ntext \\Case 2 @{term \"dom_fg h1 \\ dom_fg h1'\"} of @{cite \\th. 3\\ krishna20}\\\n\nlemma maintain_eff_acyclic_dom_ne:\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes nbot: \"h = h1 + h2\" \"h \\ bot\" \"h1' \\ bot\"\n and dom: \"dom_fg h1' \\ dom_fg h2 = {}\" \"dom_fg h1 \\ dom_fg h1'\"\n and edge: \"\\n \\ dom_fg h1' - dom_fg h1. outf_fg h2 n = 0\" \"\\x y. edge_fg h x y \\ E\"\n \"End_closed E\" \"id \\ E\" \"\\x y. edge_fg h2 x y \\ E\" \n \"\\x y. edge_fg h1 x y \\ E\" \"\\x y. edge_fg h1' x y \\ E\" \"\\x y. edge_fg (h1' + h2) x y \\ E\"\n \"(\\_. 0) \\ E\" \"pointwise_reduced E\"\n and ea: \"eff_acyclic' h\" \"eff_acyclic' h1\" \"eff_acyclic' h1'\" \"eff_acyclic' h2\"\n \"h1 \\\\<^sub>S h1'\" \n and cap: \"\\n\\dom_fg h1. \\n'\\- dom_fg h1'. \\m\\inf_fg h1 n. cap_fg h1 n n' m = cap_fg h1' n n' m\"\n \"\\n\\dom_fg h2. \\n'\\- dom_fg h2. \\m\\inf_fg h2 n. cap_fg h2 n n' m = cap_fg h2 n n' m\"\n shows \"\\h'. h' = h1' + h2 \\ h' \\ bot \\ eff_acyclic' h' \\ h \\\\<^sub>S h'\"\nproof -\n let ?h' = \"h1' + h2\" let ?h = \"h1 + h2\"\n let ?e' = \"edge_fg ?h'\" let ?e1' = \"edge_fg h1'\" let ?e2' = \"edge_fg h2\"\n let ?e = \"edge_fg h\" let ?e1 = \"edge_fg h1\" let ?e2 = \"edge_fg h2\"\n let ?f' = \"flow_fg ?h'\" let ?o1' = \"outf_fg h1'\"\n let ?N' = \"dom_fg ?h'\" let ?N1 = \"dom_fg h1\" let ?N2 = \"dom_fg h2\" let ?N1' = \"dom_fg h1'\"\n let ?N = \"dom_fg h\" let ?Na = \"dom_fg h1\" let ?Nb = \"dom_fg h2\"\n let ?i = \"inf_fg ?h\" let ?i' = \"inf_fg ?h'\" let ?i1 = \"inf_fg h1\"\n let ?f = \"flow_fg (h1 + h2)\" let ?f1 = \"flow_fg h1\" let ?f1' = \"flow_fg h1'\"\n let ?i1' = \"inf_fg h1'\" let ?o1 = \"outf_fg h1\" let ?f2 = \"flow_fg h2\"\n\n let ?Nc = \"?N1' - ?N1\" let ?ec = \"\\n n'. (\\_. 0)\" let ?fc = \"\\n. ?i1' n + ?o1 n\"\n let ?hc = \"fg ?Nc ?ec ?fc\"\n\n let ?h1'' = \"?hc + h1\"\n\n let ?N1'' = \"?Nc \\ ?N1\"\n let ?e1'' = \"combined ?Nc ?N1 (\\_ _. 0) ?ec ?e1\"\n let ?f1'' = \"combined ?Nc ?N1 0 ?fc ?f1\"\n\n have nbot_h1: \"h1 \\ bot\"\n using nbot by auto\n\n have E: \"?hc \\ bot\"\n by (rule fgI, auto)\n\n have I: \"?i1 = ?i1' on ?N1\" \"?N1 \\ ?N1'\" \"?o1 = ?o1' on -?N1'\"\n using ea nbot\n unfolding subflow_preserving_extension_def contextual_extension_def\n apply (auto simp: int_fg_def nbot_h1 subsetD)\n by (meson Compl_iff in_mono)\n\n have X1: \"?f1'' = \\x. ?i1' x + (\\x' \\ ?N1''. ?e1'' x' x (?f1'' x')) on ?N1''\"\n proof\n fix x\n assume A: \"x \\ ?N1''\"\n then show \"?f1'' x = ?i1' x + (\\x' \\ ?N1''. ?e1'' x' x (?f1'' x'))\"\n proof (cases \"x \\ ?Nc\")\n case True\n have \"?f1'' x = ?i1' x + (\\x' \\ ?N1. ?e1'' x' x (?f1'' x')) +\n (\\x' \\ ?Nc. ?e1'' x' x (?f1'' x'))\"\n using True outf_fg_unfold[of h1 x] nbot_h1 unfolding combined_def by simp\n then show ?thesis\n by (smt Diff_partition Un_commute add.assoc add.commute dom(2) dom_fg_finite sum.subset_diff)\n next\n case False\n then have A: \"x \\ ?N1\"\n using A by blast\n have \"?f1'' x = ?i1' x + (\\x' \\ ?N1. ?e1'' x' x (?f1'' x')) +\n (\\x' \\ ?Nc. ?e1'' x' x (?f1'' x'))\"\n using flow_eq_ne_bot[OF nbot_h1] A I unfolding combined_def by simp\n also have \"... = ?i1' x + (\\x' \\ ?N1 \\ ?Nc. ?e1'' x' x (?f1'' x'))\"\n using sum.union_disjoint[of ?N1 ?Nc]\n by (smt Diff_partition add.assoc add.commute dom(2) dom_fg_finite sum.subset_diff)\n finally show ?thesis\n by (simp add: Un_commute)\n qed\n qed\n\n have nbot'': \"fg ?N1'' ?e1'' ?f1'' \\ bot\"\n using X1 fgI[of ?N1'' ?f1'' ?i1' ?e1''] unfolding combined_def by auto\n have hch1_eq: \"?hc + fg ?N1 ?e1 ?f1 = fg ?N1'' ?e1'' ?f1''\"\n apply (rule plus_fg_fg)\n using E nbot_h1 fg_components[of h1]\n by auto\n then have hch1_nbot: \"?hc + h1 \\ bot\"\n using nbot_h1 fg_components[of h1] nbot''\n by simp\n have hch1_ea: \"eff_acyclic' (?hc + h1)\"\n apply (rule plus_fg_eff_acyclic[of \"?hc + h1\" ?hc h1 E], simp_all add: assms hch1_nbot E)\n using E apply auto[1]\n using endo_edge_fg_plus_fg[of E ?hc h1] assms hch1_nbot\n by simp\n\n have ***: \"?hc + h1 = fg ?N1'' ?e1'' ?f1''\"\n using fg_components[of h1] hch1_eq \\h1 \\ bot\\ by simp\n then have *: \"inf_fg ?h1'' = restrict ?N1'' 0 ?i1'\"\n using inf_fg_fg[of ?N1''] X1 dom_fg_finite \n by simp\n\n have **: \"outf_fg ?h1'' = outf_fg h1 on -?N1''\"\n using outf_eq_h0[of ?h1'' ?hc h1] nbot'' E hch1_nbot\n by auto\n\n have extfi: \"int_fg (?h1'') \\ int_fg h1'\"\n unfolding contextual_extension_def\n by (smt * ** *** Diff_cancel Diff_eq_empty_iff I(3) Un_Diff_cancel Un_commute\n dom(2) dom_fg_fg dom_fi_int_fg inf_fg_int_fg nbot'' nbot(3) outf_fi_int_fg subset_Un_eq)\n\n have hc_edge: \"\\x y. edge_fg ?hc x y \\ E\"\n using E edge by simp\n\n have cap: \"\\n \\ ?N1''. \\n' \\ -?N1'. \\m \\ inf_fg ?h1'' n. cap_fg ?h1'' n n' m = cap_fg h1' n n' m\"\n proof (safe, goal_cases)\n case (1 n n' m)\n then have A: \"n \\ ?Nc\" by simp\n then have \"cap_fg ?h1'' n n' m = 0\"\n using cap_outside_eq_h'[of ?h1'' ?hc h1 E] 1 E \\End_closed E\\\n endo_edge_fg_plus_fg[OF \\End_closed E\\ hch1_nbot hc_edge]\n \\eff_acyclic' h1\\ \\\\x y. edge_fg h1 x y \\ E\\ \\id \\ E\\ \\(\\_. 0) \\ E\\ hch1_nbot dom\n by (simp, metis (no_types, lifting) ComplI Un_absorb2 compl_sup)\n moreover have \"cap_fg h1' n n' m = 0\"\n proof -\n have \"inf_fg ?h1'' n \\ inf_fg ?hc n\"\n apply (rule inf_fg_le_inf_fg[of ?hc h1 n E])\n using 1 hch1_nbot edge E by simp_all\n then show ?thesis\n using ea 1 * unfolding subflow_preserving_extension_def\n by auto\n qed\n ultimately show ?case\n by simp\n next\n case (2 n n' m)\n then have \"cap_fg h1' n n' m = cap_fg h1 n n' m\"\n using ea inf_fg_le_inf_fg2[of ?hc h1 n E] edge hch1_nbot\n unfolding subflow_preserving_extension_def \n by auto\n moreover have \"cap_fg ?h1'' n n' m = cap_fg h1 n n' m\"\n using cap_outside_eq_h'[of ?h1'' ?hc h1 E] 2 E \\End_closed E\\\n using endo_edge_fg_plus_fg[OF \\End_closed E\\ hch1_nbot hc_edge]\n \\eff_acyclic' h1\\ \\\\x y. edge_fg h1 x y \\ E\\ \\id \\ E\\ \\(\\_. 0) \\ E\\ hch1_nbot dom\n apply auto by (smt ComplI Un_absorb2 compl_sup in_mono)\n ultimately show ?case by simp\n qed\n\n have h1''_ext_h1': \"?h1'' \\\\<^sub>S h1'\"\n unfolding subflow_preserving_extension_def\n apply (intro conjI impI)\n using extfi apply simp\n using cap hch1_nbot E apply simp\n using E hch1_nbot by auto\n\n let ?N1'' = \"dom_fg ?h1''\"\n let ?e1'' = \"edge_fg ?h1''\"\n let ?f1'' = \"flow_fg ?h1''\"\n\n let ?h'' = \"?h1'' + h2\"\n\n let ?N'' = \"?N1'' \\ ?N2\"\n let ?e'' = \"combined ?N1'' ?N2 (\\_ _. 0) ?e1'' ?e2\"\n let ?f'' = \"combined ?N1'' ?N2 0 ?f1'' ?f2\"\n let ?i'' = \"\\x. if x \\ ?N then ?i x else ?i1' x\"\n\n have X2: \"?f'' = \\x. ?i'' x + (\\x' \\ ?N''. ?e'' x' x (?f'' x')) on ?N''\"\n proof\n fix x\n assume \"x \\ ?N''\"\n then have \"x \\ ?N1 \\ ?N2 \\ ?Nc\"\n using hch1_nbot E by auto\n then consider (a) \"x \\ ?N1\" | (b) \"x \\ ?N2\" | (c) \"x \\ ?Nc\"\n using hch1_nbot plus_fg_dom_un[of ?hc h1] E nbot by blast\n then show \"?f'' x = ?i'' x + (\\x' \\ ?N''. ?e'' x' x (?f'' x'))\"\n proof cases\n case a\n have \"?f'' x = ?f1 x\"\n unfolding combined_def\n using nbot hch1_nbot E a flow_fg_plus_fg_on2'[of ?hc h1] by auto\n also have \"... = ?f x\"\n using flow_fg_plus_fg_on1'[of h1 h2 x] \\h = h1 + h2\\ \\h \\ bot\\ a by simp\n also have \"... = ?i x + (\\x' \\ ?N. ?e x' x (?f x'))\"\n using flow_eq_ne_bot[of \"h1 + h2\"] \\h = h1 + h2\\ \\h \\ bot\\ a by simp\n also have \"... = ?i x + (\\x' \\ ?N1. ?e x' x (?f x')) + (\\x' \\ ?N2. ?e x' x (?f x'))\"\n unfolding combined_def\n using nbot hch1_nbot E a flow_fg_plus_fg_on2'[of ?hc h1] a \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n apply auto\n apply (subst sum.union_disjoint[OF dom_fg_finite dom_fg_finite])\n using edge_fg_plus_fg_on1'[of ?hc h1] hch1_nbot a\n by (auto simp: algebra_simps)\n also have \"... = ?i x + (\\x' \\ ?N1. ?e'' x' x (?f'' x')) + (\\x' \\ ?N2. ?e x' x (?f x'))\"\n unfolding combined_def\n using nbot hch1_nbot E a edge_fg_plus_fg_on2'[of ?hc h1]\n using flow_fg_plus_fg_on2'[of ?hc h1] a \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n edge_fg_plus_fg_on1'[of h1 h2] flow_fg_plus_fg_on1'[of h1 h2]\n by auto\n also have \"... = ?i x + (\\x' \\ ?N1. ?e'' x' x (?f'' x')) + (\\x' \\ ?N2. ?e'' x' x (?f'' x'))\"\n unfolding combined_def\n using nbot hch1_nbot E a edge_fg_plus_fg_on2'[of h1 h2]\n using flow_fg_plus_fg_on2'[of h1 h2] a \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n apply auto\n apply (subst (2) sum.cong[where h=\"\\x'. edge_fg h2 x' x (flow_fg h2 x')\"])\n using dom by auto\n also have \"... = ?i x + (\\x' \\ ?N1 \\ ?N2. ?e'' x' x (?f'' x'))\"\n apply (subst sum.union_disjoint[OF dom_fg_finite dom_fg_finite])\n using nbot(1) nbot(2) plus_fg_dom_disj apply blast\n using add.assoc by blast\n also have \"... = ?i x + ((\\x' \\ ?N1 \\ ?N2. ?e'' x' x (?f'' x')) + (\\x' \\ ?Nc. ?e'' x' x (?f'' x')))\"\n unfolding combined_def\n using nbot hch1_nbot E a edge_fg_plus_fg_on1'[of ?hc h1]\n using flow_fg_plus_fg_on1'[of ?hc h1] a \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n by auto\n also have \"... = ?i x + (\\x' \\ ?N1 \\ ?N2 \\ ?Nc. ?e'' x' x (?f'' x'))\"\n apply (subst sum.union_disjoint[symmetric])\n using dom by auto\n finally show ?thesis\n using a \\h = h1 + h2\\ \\h \\ bot\\ hch1_nbot E\n apply simp\n apply (rule sum.cong)\n by auto\n next\n case b\n have \"?f'' x = ?f2 x\"\n unfolding combined_def\n using b hch1_nbot E \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n by auto\n also have \"... = ?f x\"\n using flow_fg_plus_fg_on2'[of h1 h2 x] \\h = h1 + h2\\ \\h \\ bot\\ b by simp\n also have \"... = ?i x + (\\x' \\ ?N. ?e x' x (?f x'))\"\n using flow_eq_ne_bot[of \"h1 + h2\"] \\h = h1 + h2\\ \\h \\ bot\\ b by simp\n also have \"... = ?i x + (\\x' \\ ?N1. ?e x' x (?f x')) + (\\x' \\ ?N2. ?e x' x (?f x'))\"\n unfolding combined_def\n using nbot hch1_nbot E b flow_fg_plus_fg_on2'[of ?hc h1] \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n apply auto\n apply (subst sum.union_disjoint[OF dom_fg_finite dom_fg_finite])\n using edge_fg_plus_fg_on1'[of ?hc h1] hch1_nbot\n by (auto simp: algebra_simps)\n also have \"... = ?i x + (\\x' \\ ?N1. ?e'' x' x (?f'' x')) + (\\x' \\ ?N2. ?e x' x (?f x'))\"\n unfolding combined_def\n using nbot hch1_nbot E b edge_fg_plus_fg_on2'[of ?hc h1]\n using flow_fg_plus_fg_on2'[of ?hc h1] \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n edge_fg_plus_fg_on1'[of h1 h2] flow_fg_plus_fg_on1'[of h1 h2]\n by auto\n also have \"... = ?i x + (\\x' \\ ?N1. ?e'' x' x (?f'' x')) + (\\x' \\ ?N2. ?e'' x' x (?f'' x'))\"\n unfolding combined_def\n using nbot hch1_nbot E b edge_fg_plus_fg_on2'[of h1 h2]\n using flow_fg_plus_fg_on2'[of h1 h2] \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n apply auto\n apply (subst (2) sum.cong[where h=\"\\x'. edge_fg h2 x' x (flow_fg h2 x')\"])\n using dom by auto\n also have \"... = ?i x + (\\x' \\ ?N1 \\ ?N2. ?e'' x' x (?f'' x'))\"\n apply (subst sum.union_disjoint[OF dom_fg_finite dom_fg_finite])\n using nbot(1) nbot(2) plus_fg_dom_disj apply blast\n using add.assoc by blast\n also have \"... = ?i x + ((\\x' \\ ?N1 \\ ?N2. ?e'' x' x (?f'' x')) +\n (\\x' \\ ?Nc. ?e'' x' x (?f'' x')))\"\n unfolding combined_def\n using nbot hch1_nbot E edge_fg_plus_fg_on1'[of ?hc h1]\n using flow_fg_plus_fg_on1'[of ?hc h1] \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\\n by auto\n also have \"... = ?i x + (\\x' \\ ?N1 \\ ?N2 \\ ?Nc. ?e'' x' x (?f'' x'))\"\n apply (subst sum.union_disjoint[symmetric])\n using dom by auto\n finally show ?thesis\n using b \\h = h1 + h2\\ \\h \\ bot\\ hch1_nbot E\n apply simp\n apply (rule sum.cong)\n by auto\n next\n case c\n\n have \"outf_fg h2 x = 0\"\n using edge c by simp\n then have \"(\\x' \\ ?N2. ?e2 x' x (?f2 x')) = 0\"\n using outf_fg_unfold[of h2 x]\n by (metis Diff_iff c disjoint_iff_not_equal dom(1) nbot(1) nbot(2) plus_fg_ops_exist)\n then have z: \"\\x'. x' \\ ?N2 \\ ?e2 x' x (?f2 x') = 0\"\n by simp\n\n have \"?f'' x = ?i1' x + ?o1 x\"\n unfolding combined_def\n using nbot hch1_nbot E flow_fg_plus_fg_on1'[of ?hc h1] c by auto\n also have \"... = ?i1' x + (\\x' \\ ?N1. ?e1 x' x (?f1 x'))\"\n apply (subst outf_fg_unfold)\n apply (simp_all add: c nbot_h1)\n using c by blast\n also have \"... = ?i1' x + (\\x' \\ ?N1. ?e'' x' x (?f'' x'))\"\n unfolding combined_def\n using nbot hch1_nbot E flow_fg_plus_fg_on2'[of ?hc h1] edge_fg_plus_fg_on2'[of ?hc h1] c\n by auto\n also have \"... = ?i1' x + ((\\x' \\ ?N1. ?e'' x' x (?f'' x')) +\n (\\x' \\ ?Nc. ?e'' x' x (?f'' x')))\"\n unfolding combined_def\n using nbot hch1_nbot E edge_fg_plus_fg_on1'[of ?hc h1] c\n by auto\n also have \"... = ?i1' x + (\\x' \\ ?N1 \\ ?Nc. ?e'' x' x (?f'' x'))\"\n by (subst sum.union_disjoint, simp_all)\n also have \"... = ?i1' x + ((\\x' \\ ?N1 \\ ?Nc. ?e'' x' x (?f'' x')) +\n (\\x' \\ ?N2. ?e'' x' x (?f'' x')))\"\n unfolding combined_def\n using nbot hch1_nbot E edge_fg_plus_fg_on1'[of ?hc h1] c \\?N1 \\ ?N1'\\ \\?N1' \\ ?N2 = {}\\ z\n by auto\n also have \"... = ?i1' x + (\\x' \\ ?N1 \\ ?Nc \\ ?N2. ?e'' x' x (?f'' x'))\"\n apply (subst sum.union_disjoint[symmetric])\n using dom by auto\n finally show ?thesis\n unfolding combined_def\n using nbot hch1_nbot E flow_fg_plus_fg_on1'[of ?hc h1] c apply auto\n using dom(1) apply blast\n apply (rule sum.cong)\n by auto\n qed\n qed\n\n have \"finite ?N''\"\n by simp\n then have h''_nbot: \"fg ?N'' ?e'' ?f'' \\ bot\"\n using X2 fgI[of ?N'' ?f'' ?i'' ?e''] unfolding combined_def \n using nbot hch1_nbot by blast\n\n have h1''h2_eq: \"?h1'' + h2 = fg ?N'' ?e'' ?f''\"\n apply (subst fg_components[of \"?h1''\", symmetric], simp add: hch1_nbot)\n apply (subst fg_components[of h2, symmetric])\n using nbot(1) nbot(2) plus_fg_ops_exist apply blast\n apply (rule plus_fg_fg)\n using hch1_nbot fg_components[of \"?h1''\"] apply simp\n using fg_components[of h2] nbot plus_fg_ops_exist[of h1 h2] apply simp\n using hch1_nbot dom E by auto\n then have h''_nbot: \"?h'' \\ bot\"\n using hch1_nbot fg_components[of ?h1''] h''_nbot\n by presburger\n have h''_ea: \"eff_acyclic' (?h1'' + h2)\"\n apply (rule plus_fg_eff_acyclic[of \"?h1'' + h2\" ?hc \"h1 + h2\" E])\n apply (simp_all add: assms E algebra_simps)\n apply (metis (no_types, lifting) add.commute add.left_commute h''_nbot)\n using ea(1) nbot(1) apply blast\n apply (rule endo_edge_fg_plus_fg[OF \\End_closed E\\ h''_nbot, simplified algebra_simps])\n apply (rule endo_edge_fg_plus_fg[OF \\End_closed E\\ hch1_nbot, simplified algebra_simps])\n subgoal using E assms by simp\n using assms by blast+\n\n have \"\\h'. h' = h1' + h2 \\ h' \\ bot \\ eff_acyclic' h' \\\n fg (dom_fg h1' - dom_fg h1) (\\n n' _. 0) (\\n. inf_fg h1' n + outf_fg h1 n) + h1 + h2 \\\\<^sub>S h'\"\n apply (rule maintain_eff_acyclic_dom_eq[of E ?h'' ?h1'' h2 h1'])\n using assms h''_nbot h''_ea h1''_ext_h1' hch1_ea apply (simp_all (no_asm))\n apply (metis (no_types, lifting) DiffD1 DiffD2 DiffI UnI2 hch1_nbot plus_fg_dom_un)\n apply (rule endo_edge_fg_plus_fg[of E \"?h1''\" h2], blast+)\n apply (rule endo_edge_fg_plus_fg[of E \"?hc\" h1])\n using hch1_nbot apply blast+\n using E apply simp\n apply blast+\n using dom nbot hch1_nbot E apply auto[1]\n apply (rule endo_edge_fg_plus_fg[of E \"?hc\" h1])\n using hch1_nbot apply blast+\n using E apply simp\n apply blast+\n using cap nbot hch1_nbot E apply simp\n apply (rule endo_edge_fg_plus_fg[of E \"?h1''\" h2], blast+)\n apply (rule endo_edge_fg_plus_fg[of E \"?hc\" h1])\n using hch1_nbot apply blast+\n using E apply simp\n apply blast+\n done\n then obtain h' where les1: \"h' = h1' + h2\" \"h' \\ bot\" \"eff_acyclic' h'\"\n \"fg (dom_fg h1' - dom_fg h1) (\\n n' _. 0) (\\n. inf_fg h1' n + outf_fg h1 n) + h1 + h2 \\\\<^sub>S h'\"\n by auto\n\n have AUX1: \"dom_fg ?h'' = dom_fg ?hc \\ dom_fg (h1 + h2)\"\n using h''_nbot plus_fg_ops_exist(1)[of ?h1'' h2] nbot by auto\n\n have inf'': \"\\x \\ ?N. inf_fg ?h'' x = ?i x\"\n proof\n fix x\n assume A: \"x \\ ?N\"\n\n have B: \"outf_fg ?hc x = 0\"\n using outf_fg_unfold[of ?hc x] plus_fg_dom_disj[of ?hc \"h1 + h2\"] h''_nbot A nbot\n plus_fg_ops_exist(1)[of ?hc \"h1 + h2\"] dom by (auto simp: algebra_simps)\n\n have C: \"inf_fg (h1 + h2) x = inf_fg ?h'' x + outf_fg ?hc x\"\n using flow_eq_to_sum[of \"h1 + h2\" ?hc] h''_nbot A dom nbot by (simp add: algebra_simps)\n\n show \"inf_fg (?hc + h1 + h2) x = inf_fg (h1 + h2) x\"\n using B C by simp\n qed\n\n have les2: \"h \\\\<^sub>S ?h''\"\n proof -\n have Y0: \"outf_fg ?h'' = outf_fg h on -dom_fg ?h''\"\n apply (rule outf_eq_h0[of ?h'' ?hc h])\n using \\h = h1 + h2\\ apply (auto simp: algebra_simps)\n using h''_nbot apply (simp add: algebra_simps)\n using E by simp\n\n have Y1: \"int_fg h \\ int_fg ?h''\"\n proof -\n have WWW: \"outf_fg ?hc = (\\_. 0)\"\n using outf_fg_unfold'[OF E] E by auto\n then have MMM: \"\\x \\ dom_fg (h1 + h2). inf_fg (h1 + h2) x = inf_fg ?h'' x\"\n using flow_eq_to_sum[of \"h1 + h2\" ?hc] using \\h = h1 + h2\\ \\h \\ bot\\ h''_nbot\n by (simp add: algebra_simps)\n\n have \"?h'' = ?hc + (h1 + h2)\"\n by (simp add: algebra_simps)\n\n show ?thesis\n unfolding contextual_extension_def\n using h''_nbot I \\h = h1 + h2\\ \\h \\ bot\\ E I nbot hch1_nbot MMM WWW\n apply auto\n by (metis (no_types, lifting) Un_iff inf_fg_int_fg)+\n qed\n\n have Y2: \"\\n \\ ?N. \\n' \\ -?N''. \\m \\ ?i n. cap_fg h n n' m = cap_fg ?h'' n n' m\"\n proof (safe, goal_cases)\n case (1 n n' m)\n then have \"n \\ dom_fg ?h''\" \"n' \\ -dom_fg ?h''\" \"m \\ inf_fg ?h'' n\"\n using h''_nbot nbot hch1_nbot inf'' by simp_all\n then show ?case\n using cap_outside_eq_h'[of ?h'' ?hc h E] \\h = h1 + h2\\ E edge h''_nbot\n endo_edge_fg_plus_fg[of E \"h1 + h2\" ?hc] 1 \\eff_acyclic' h\\ \\\\x y. edge_fg h x y \\ E\\\n \\id \\ E\\ \\(\\_. 0) \\ E\\\n by (simp add: algebra_simps)\n qed\n\n have Y3:\n \"\\n \\ dom_fg ?h'' - ?N. \\n' \\ -(dom_fg ?h''). \\m \\ inf_fg ?h'' n. cap_fg ?h'' n n' m = 0\"\n proof (safe, goal_cases)\n case (1 n n' m)\n then have \"n \\ dom_fg ?h''\" \"n' \\ -dom_fg ?h''\" \"m \\ inf_fg ?h'' n\"\n using h''_nbot nbot hch1_nbot inf'' by simp_all\n then show ?case\n using cap_outside_eq_h'[of ?h'' ?hc h E] \\h = h1 + h2\\ E edge h''_nbot\n endo_edge_fg_plus_fg[of E \"h1 + h2\" ?hc] 1 \\eff_acyclic' h\\ \\\\x y. edge_fg h x y \\ E\\\n \\id \\ E\\ \\(\\_. 0) \\ E\\\n by (simp add: algebra_simps)\n qed\n\n show ?thesis\n unfolding subflow_preserving_extension_def\n apply (intro conjI)\n using Y1 apply simp\n using Y2 nbot h''_nbot apply simp\n using Y3 by simp\n qed\n\n show ?thesis\n apply (rule exI[where x=\"h'\"])\n using les1 les2 subflow_preserving_extension_trans[of h ?h'' h'] h''_nbot nbot\n by simp\nqed\n\ntext \\@{cite \\th. 3\\ krishna20}\\\n\nlemma maintain_eff_acyclic_dom:\n fixes E :: \"('a \\ 'a :: pos_cancel_comm_monoid_add) set\"\n assumes nbot: \"h = h1 + h2\" \"h \\ bot\" \"h1' \\ bot\"\n and dom: \"dom_fg h1' \\ dom_fg h2 = {}\"\n and edge: \"\\n \\ dom_fg h1' - dom_fg h1. outf_fg h2 n = 0\" \"\\x y. edge_fg h x y \\ E\"\n \"End_closed E\" \"id \\ E\" \"\\x y. edge_fg h2 x y \\ E\" \n \"\\x y. edge_fg h1 x y \\ E\" \"\\x y. edge_fg h1' x y \\ E\" \"\\x y. edge_fg (h1' + h2) x y \\ E\"\n \"(\\_. 0) \\ E\" \"pointwise_reduced E\"\n and ea: \"eff_acyclic' h\" \"eff_acyclic' h1\" \"eff_acyclic' h1'\" \"eff_acyclic' h2\"\n \"h1 \\\\<^sub>S h1'\"\n shows \"\\h'. h' = h1' + h2 \\ h' \\ bot \\ eff_acyclic' h' \\ h \\\\<^sub>S h'\"\nproof (cases \"dom_fg h1 = dom_fg h1'\")\n case True\n show ?thesis\n apply (rule maintain_eff_acyclic_dom_eq)\n using True assms unfolding zero_fun_def subflow_preserving_extension_def by blast+\nnext\n case False\n then have False': \"dom_fg h1 \\ dom_fg h1'\"\n using ea unfolding subflow_preserving_extension_def contextual_extension_def by simp\n show ?thesis\n apply (rule maintain_eff_acyclic_dom_ne)\n using False' assms unfolding subflow_preserving_extension_def by blast+\nqed\n\nend\n", "meta": {"author": "bpoettinger", "repo": "Flow", "sha": "c95ea5f88a0a3d39e44421e0cc36139a3c3687de", "save_path": "github-repos/isabelle/bpoettinger-Flow", "path": "github-repos/isabelle/bpoettinger-Flow/Flow-c95ea5f88a0a3d39e44421e0cc36139a3c3687de/Effectively_Acyclic_Maintain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2779104828271032}} {"text": "theory Incredible_Correctness\nimports\n Abstract_Rules_To_Incredible\n Natural_Deduction\nbegin\n\ntext \\\nIn this theory, we prove that if we have a graph that proves a given abstract task (which is\nrepresented as the context @{term Tasked_Proof_Graph}), then we can prove @{term solved}.\n\\\n\ncontext Tasked_Proof_Graph\nbegin\n\ndefinition adjacentTo :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex \\ ('form, 'var) out_port)\" where\n \"adjacentTo v p = (SOME ps. (ps, (v,p)) \\ edges)\"\n\nfun isReg where\n \"isReg v p = (case p of Hyp h c \\ False | Reg c \\\n (case nodeOf v of\n Conclusion a \\ False\n | Assumption a \\ False\n | Rule r \\ True\n | Helper \\ True\n ))\"\n\nfun toNatRule where\n \"toNatRule v p = (case p of Hyp h c \\ Axiom | Reg c \\\n (case nodeOf v of\n Conclusion a \\ Axiom \\ \\a lie\\\n | Assumption a \\ Axiom\n | Rule r \\ NatRule (r,c)\n | Helper \\ Cut\n ))\"\n\n\ninductive_set global_assms' :: \"'var itself \\ 'form set\" for i where\n \"v |\\| vertices \\ nodeOf v = Assumption p \\ labelAtOut v (Reg p) \\ global_assms' i\"\n\nlemma finite_global_assms': \"finite (global_assms' i)\"\nproof-\n have \"finite (fset vertices)\" by (rule finite_fset)\n moreover\n have \"global_assms' i \\ (\\ v. case nodeOf v of Assumption p \\ labelAtOut v (Reg p)) ` fset vertices\"\n by (force simp add: global_assms'.simps fmember_iff_member_fset image_iff )\n ultimately\n show ?thesis by (rule finite_surj)\nqed\n\ncontext includes fset.lifting\nbegin\n lift_definition global_assms :: \"'var itself \\ 'form fset\" is global_assms' by (rule finite_global_assms')\n lemmas global_assmsI = global_assms'.intros[Transfer.transferred]\n lemmas global_assms_simps = global_assms'.simps[Transfer.transferred]\nend\n\nfun extra_assms :: \"('vertex \\ ('form, 'var) in_port) \\ 'form fset\" where\n \"extra_assms (v, p) = (\\ p. labelAtOut v p) |`| hyps_for (nodeOf v) p\"\n\nfun hyps_along :: \"('vertex, 'form, 'var) edge' list \\ 'form fset\" where\n \"hyps_along pth = ffUnion (extra_assms |`| snd |`| fset_from_list pth) |\\| global_assms TYPE('var)\"\n\nlemma hyps_alongE[consumes 1, case_names Hyp Assumption]:\n assumes \"f |\\| hyps_along pth\"\n obtains v p h where \"(v,p) \\ snd ` set pth\" and \"f = labelAtOut v h \" and \"h |\\| hyps_for (nodeOf v) p\"\n | v pf where \"v |\\| vertices\" and \"nodeOf v = Assumption pf\" \"f = labelAtOut v (Reg pf)\"\n using assms\n apply (auto simp add: fmember_iff_member_fset ffUnion.rep_eq global_assms_simps[unfolded fmember_iff_member_fset])\n apply (metis image_iff snd_conv)\n done\n\ntext \\Here we build the natural deduction tree, by walking the graph.\\\n\nprimcorec tree :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex, 'form, 'var) edge' list \\ (('form entailment), ('rule \\ 'form) NatRule) dtree\" where\n \"root (tree v p pth) =\n ((hyps_along ((adjacentTo v p,(v,p))#pth) \\ labelAtIn v p),\n (case adjacentTo v p of (v', p') \\ toNatRule v' p'\n ))\"\n | \"cont (tree v p pth) =\n (case adjacentTo v p of (v', p') \\\n (if isReg v' p' then ((\\ p''. tree v' p'' ((adjacentTo v p,(v,p))#pth)) |`| inPorts (nodeOf v')) else {||}\n ))\"\n\n\nlemma fst_root_tree[simp]: \"fst (root (tree v p pth)) = (hyps_along ((adjacentTo v p,(v,p))#pth) \\ labelAtIn v p)\" by simp\n\nlemma out_port_cases[consumes 1, case_names Assumption Hyp Rule Helper]:\n assumes \"p |\\| outPorts n\"\n obtains\n a where \"n = Assumption a\" and \"p = Reg a\"\n | r h c where \"n = Rule r\" and \"p = Hyp h c\"\n | r f where \"n = Rule r\" and \"p = Reg f\"\n | \"n = Helper\" and \"p = Reg anyP\"\n using assms by (atomize_elim, cases p; cases n) auto\n\nlemma hyps_for_fimage: \"hyps_for (Rule r) x = (if x |\\| f_antecedent r then (\\ f. Hyp f x) |`| (a_hyps x) else {||})\"\n apply (rule fset_eqI)\n apply (rename_tac p')\n apply (case_tac p')\n apply (auto simp add: split: if_splits out_port.splits)\n done\n\ntext \\Now we prove that the thus produced tree is well-formed.\\\n\ntheorem wf_tree:\n assumes \"valid_in_port (v,p)\"\n assumes \"terminal_path v t pth\"\n shows \"wf (tree v p pth)\"\nusing assms\nproof (coinduction arbitrary: v p pth)\ncase (wf v p pth)\n let ?t = \"tree v p pth\"\n from saturated[OF wf(1)]\n obtain v' p'\n where e:\"((v',p'),(v,p)) \\ edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n\n let ?e = \"((v',p'),(v,p))\"\n let ?pth' = \"?e#pth\"\n let ?\\ = \"hyps_along ?pth'\"\n let ?l = \"labelAtIn v p\"\n\n from e valid_edges have \"v' |\\| vertices\" and \"p' |\\| outPorts (nodeOf v')\" by auto\n hence \"nodeOf v' \\ sset nodes\" using valid_nodes by (meson image_eqI notin_fset subsetD)\n\n from \\?e \\ edges\\\n have s: \"labelAtOut v' p' = labelAtIn v p\" by (rule solved)\n\n from \\p' |\\| outPorts (nodeOf v')\\\n show ?case\n proof (cases rule: out_port_cases)\n case (Hyp r h c)\n\n from Hyp \\p' |\\| outPorts (nodeOf v')\\\n have \"h |\\| a_hyps c\" and \"c |\\| f_antecedent r\" by auto\n hence \"hyps (nodeOf v') (Hyp h c) = Some c\" using Hyp by simp\n\n from well_scoped[OF \\ _ \\ edges\\[unfolded Hyp] this]\n have \"(v, p) = (v', c) \\ v \\ scope (v', c)\".\n hence \"(v', c) \\ insert (v, p) (snd ` set pth)\"\n proof\n assume \"(v, p) = (v', c)\"\n thus ?thesis by simp\n next\n assume \"v \\ scope (v', c)\"\n from this terminal_path_end_is_terminal[OF wf(2)] terminal_path_is_path[OF wf(2)]\n have \"(v', c) \\ snd ` set pth\" by (rule scope_find)\n thus ?thesis by simp\n qed\n moreover\n\n\n from \\hyps (nodeOf v') (Hyp h c) = Some c\\\n have \"Hyp h c |\\| hyps_for (nodeOf v') c\" by simp\n hence \"labelAtOut v' (Hyp h c) |\\| extra_assms (v',c)\" by auto\n ultimately\n\n have \"labelAtOut v' (Hyp h c) |\\| ?\\\"\n by (fastforce simp add: fmember_iff_member_fset ffUnion.rep_eq)\n\n hence \"labelAtIn v p |\\| ?\\\" by (simp add: s[symmetric] Hyp fmember_iff_member_fset)\n thus ?thesis\n using Hyp\n apply (auto intro: exI[where x = ?t] simp add: eff.simps simp del: hyps_along.simps)\n done\n next\n case (Assumption f)\n\n from \\v' |\\| vertices\\ \\nodeOf v' = Assumption f\\\n have \"labelAtOut v' (Reg f) |\\| global_assms TYPE('var)\"\n by (rule global_assmsI)\n hence \"labelAtOut v' (Reg f) |\\| ?\\\" by auto\n hence \"labelAtIn v p |\\| ?\\\" by (simp add: s[symmetric] Assumption fmember_iff_member_fset)\n thus ?thesis using Assumption\n by (auto intro: exI[where x = ?t] simp add: eff.simps)\n next\n case (Rule r f)\n with \\nodeOf v' \\ sset nodes\\\n have \"r \\ sset rules\"\n by (auto simp add: nodes_def stream.set_map)\n\n from Rule\n have \"hyps (nodeOf v') p' = None\" by simp\n with e \\terminal_path v t pth\\\n have \"terminal_path v' t ?pth'\"..\n\n from Rule \\p' |\\| outPorts (nodeOf v')\\\n have \"f |\\| f_consequent r\" by simp\n hence \"f \\ set (consequent r)\" by (simp add: f_consequent_def)\n with \\r \\ sset rules\\\n have \"NatRule (r, f) \\ sset (smap NatRule n_rules)\"\n by (auto simp add: stream.set_map n_rules_def no_empty_conclusions)\n moreover\n\n {\n from \\f |\\| f_consequent r\\\n have \"f \\ set (consequent r)\" by (simp add: f_consequent_def)\n hence \"natEff_Inst (r, f) f (f_antecedent r)\"\n by (rule natEff_Inst.intros)\n hence \"eff (NatRule (r, f)) (?\\ \\ subst (inst v') (freshen (vidx v') f))\n ((\\ant. ((\\p. subst (inst v') (freshen (vidx v') p)) |`| a_hyps ant |\\| ?\\ \\ subst (inst v') (freshen (vidx v') (a_conc ant)))) |`| f_antecedent r)\"\n (is \"eff _ _ ?ants\")\n proof (rule eff.intros)\n fix ant f\n assume \"ant |\\| f_antecedent r\"\n from \\v' |\\| vertices\\ \\ant |\\| f_antecedent r\\\n have \"valid_in_port (v',ant)\" by (simp add: Rule)\n\n assume \"f |\\| ?\\\"\n thus \"freshenLC (vidx v') ` a_fresh ant \\ lconsts f = {}\"\n proof(induct rule: hyps_alongE)\n case (Hyp v'' p'' h'')\n\n from Hyp(1) snd_set_path_verties[OF terminal_path_is_path[OF \\terminal_path v' t ?pth'\\]]\n have \"v'' |\\| vertices\" by (force simp add: fmember_iff_member_fset)\n\n from \\terminal_path v' t ?pth'\\ Hyp(1)\n have \"v'' \\ scope (v', ant)\" by (rule hyps_free_path_not_in_scope)\n with \\valid_in_port (v',ant)\\ \\v'' |\\| vertices\\\n have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\ subst_lconsts (inst v'') = {}\"\n by (rule out_of_scope)\n moreover\n from hyps_free_vertices_distinct'[OF \\terminal_path v' t ?pth'\\] Hyp.hyps(1)\n have \"v'' \\ v'\" by (metis distinct.simps(2) fst_conv image_eqI list.set_map)\n hence \"vidx v'' \\ vidx v'\" using \\v' |\\| vertices\\ \\v'' |\\| vertices\\ by (meson vidx_inj inj_onD notin_fset)\n hence \"freshenLC (vidx v') ` a_fresh ant \\ freshenLC (vidx v'') ` lconsts (labelsOut (nodeOf v'') h'') = {}\"by auto\n moreover\n have \"lconsts f \\ lconsts (freshen (vidx v'') (labelsOut (nodeOf v'') h'')) \\ subst_lconsts (inst v'') \" using \\f = _\\\n by (simp add: labelAtOut_def fv_subst)\n ultimately\n show ?thesis\n by (fastforce simp add: lconsts_freshen)\n next\n case (Assumption v pf)\n hence \"f = subst (inst v) (freshen (vidx v) pf)\" by (simp add: labelAtOut_def)\n moreover\n from Assumption have \"Assumption pf \\ sset nodes\" using valid_nodes by (auto simp add: fmember_iff_member_fset)\n hence \"pf \\ set assumptions\" unfolding nodes_def by (auto simp add: stream.set_map)\n hence \"closed pf\" by (rule assumptions_closed)\n ultimately\n have \"lconsts f = {}\" by (simp add: closed_no_lconsts lconsts_freshen subst_closed freshen_closed)\n thus ?thesis by simp\n qed\n next\n fix ant\n assume \"ant |\\| f_antecedent r\"\n from \\v' |\\| vertices\\ \\ant |\\| f_antecedent r\\\n have \"valid_in_port (v',ant)\" by (simp add: Rule)\n moreover\n note \\v' |\\| vertices\\\n moreover\n hence \"v' \\ scope (v', ant)\" by (rule scopes_not_refl)\n ultimately\n have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\ subst_lconsts (inst v') = {}\"\n by (rule out_of_scope)\n thus \"freshenLC (vidx v') ` a_fresh ant \\ subst_lconsts (inst v') = {}\" by simp\n qed\n also\n have \"subst (inst v') (freshen (vidx v') f) = labelAtOut v' p'\" using Rule by (simp add: labelAtOut_def)\n also\n note \\labelAtOut v' p' = labelAtIn v p\\\n also\n have \"?ants = ((\\x. (extra_assms (v',x) |\\| hyps_along ?pth' \\ labelAtIn v' x)) |`| f_antecedent r)\"\n by (rule fimage_cong[OF refl])\n (auto simp add: labelAtIn_def labelAtOut_def Rule hyps_for_fimage fmember_iff_member_fset ffUnion.rep_eq)\n finally\n have \"eff (NatRule (r, f))\n (?\\, labelAtIn v p)\n ((\\x. extra_assms (v',x) |\\| ?\\ \\ labelAtIn v' x) |`| f_antecedent r)\".\n }\n moreover\n\n { fix x\n assume \"x |\\| cont ?t\"\n then obtain a where \"x = tree v' a ?pth'\" and \"a |\\| f_antecedent r\"\n by (auto simp add: Rule)\n note this(1)\n moreover\n\n from \\v' |\\| vertices\\ \\a |\\| f_antecedent r\\\n have \"valid_in_port (v',a)\" by (simp add: Rule)\n moreover\n\n note \\terminal_path v' t ?pth'\\\n ultimately\n\n have \"\\v p pth. x = tree v p pth \\ valid_in_port (v,p) \\ terminal_path v t pth\"\n by blast\n }\n ultimately\n\n show ?thesis using Rule\n by (auto intro!: exI[where x = ?t] simp add: comp_def funion_assoc)\n next\n case Helper\n from Helper\n have \"hyps (nodeOf v') p' = None\" by simp\n with e \\terminal_path v t pth\\\n have \"terminal_path v' t ?pth'\"..\n\n have \"labelAtIn v' (plain_ant anyP) = labelAtIn v p\"\n unfolding s[symmetric]\n using Helper by (simp add: labelAtIn_def labelAtOut_def)\n moreover\n { fix x\n assume \"x |\\| cont ?t\"\n\n hence \"x = tree v' (plain_ant anyP) ?pth'\"\n by (auto simp add: Helper)\n note this(1)\n moreover\n\n from \\v' |\\| vertices\\\n have \"valid_in_port (v',plain_ant anyP)\" by (simp add: Helper)\n moreover\n\n note \\terminal_path v' t ?pth'\\\n ultimately\n\n have \"\\v p pth. x = tree v p pth \\ valid_in_port (v,p) \\ terminal_path v t pth\"\n by blast\n }\n ultimately\n\n show ?thesis using Helper\n by (auto intro!: exI[where x = ?t] simp add: comp_def funion_assoc )\n qed\nqed\n\nlemma global_in_ass: \"global_assms TYPE('var) |\\| ass_forms\"\nproof\n fix x\n assume \"x |\\| global_assms TYPE('var)\"\n then obtain v pf where \"v |\\| vertices\" and \"nodeOf v = Assumption pf\" and \"x = labelAtOut v (Reg pf)\"\n by (auto simp add: global_assms_simps)\n from this (1,2) valid_nodes\n have \"Assumption pf \\ sset nodes\" by (auto simp add: fmember_iff_member_fset)\n hence \"pf \\ set assumptions\" by (auto simp add: nodes_def stream.set_map)\n hence \"closed pf\" by (rule assumptions_closed)\n with \\x = labelAtOut v (Reg pf)\\\n have \"x = pf\" by (auto simp add: labelAtOut_def lconsts_freshen closed_no_lconsts freshen_closed subst_closed)\n thus \"x |\\| ass_forms\" using \\pf \\ set assumptions\\ by (auto simp add: ass_forms_def)\nqed\n\nprimcorec edge_tree :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex, 'form, 'var) edge' tree\" where\n \"root (edge_tree v p) = (adjacentTo v p, (v,p))\"\n | \"cont (edge_tree v p) =\n (case adjacentTo v p of (v', p') \\\n (if isReg v' p' then ((\\ p. edge_tree v' p) |`| inPorts (nodeOf v')) else {||}\n ))\"\n\nlemma tfinite_map_tree: \"tfinite (map_tree f t) \\ tfinite t\"\nproof\n assume \"tfinite (map_tree f t)\"\n thus \"tfinite t\"\n by (induction \"map_tree f t\" arbitrary: t rule: tfinite.induct)\n (fastforce intro: tfinite.intros simp add: tree.map_sel)\nnext\n assume \"tfinite t\"\n thus \"tfinite (map_tree f t)\"\n by (induction t rule: tfinite.induct)\n (fastforce intro: tfinite.intros simp add: tree.map_sel)\nqed\n\n\nlemma finite_tree_edge_tree:\n \"tfinite (tree v p pth) \\ tfinite (edge_tree v p)\"\nproof-\n have \"map_tree (\\ _. ()) (tree v p pth) = map_tree (\\ _. ()) (edge_tree v p)\"\n by(coinduction arbitrary: v p pth)\n (fastforce simp add: tree.map_sel rel_fset_def rel_set_def split: prod.split out_port.split graph_node.split option.split)\n thus ?thesis by (metis tfinite_map_tree)\nqed\n\ncoinductive forbidden_path :: \"'vertex \\ ('vertex, 'form, 'var) edge' stream \\ bool\" where\n forbidden_path: \"((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2)) \\ edges \\ hyps (nodeOf v\\<^sub>1) p\\<^sub>1 = None \\ forbidden_path v\\<^sub>1 pth \\ forbidden_path v\\<^sub>2 (((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2))##pth)\"\n\nlemma path_is_forbidden:\n assumes \"valid_in_port (v,p)\"\n assumes \"ipath (edge_tree v p) es\"\n shows \"forbidden_path v es\"\nusing assms\nproof(coinduction arbitrary: v p es)\n case forbidden_path\n\n let ?es' = \"stl es\"\n\n from forbidden_path(2)\n obtain t' where \"root (edge_tree v p) = shd es\" and \"t' |\\| cont (edge_tree v p)\" and \"ipath t' ?es'\"\n by rule blast\n\n from \\root (edge_tree v p) = shd es\\\n have [simp]: \"shd es = (adjacentTo v p, (v,p))\" by simp\n\n from saturated[OF \\valid_in_port (v,p)\\]\n obtain v' p'\n where e:\"((v',p'),(v,p)) \\ edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n let ?e = \"((v',p'),(v,p))\"\n\n from e have \"p' |\\| outPorts (nodeOf v')\" using valid_edges by auto\n thus ?case\n proof(cases rule: out_port_cases)\n case Hyp\n with \\t' |\\| cont (edge_tree v p)\\\n have False by auto\n thus ?thesis..\n next\n case Assumption\n with \\t' |\\| cont (edge_tree v p)\\\n have False by auto\n thus ?thesis..\n next\n case (Rule r f)\n from \\t' |\\| cont (edge_tree v p)\\ Rule\n obtain a where [simp]: \"t' = edge_tree v' a\" and \"a |\\| f_antecedent r\" by auto\n\n have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n moreover\n\n have \"?e \\ edges\" using e by simp\n moreover\n\n from \\p' = Reg f\\ \\nodeOf v' = Rule r\\\n have \"hyps (nodeOf v') p' = None\" by simp\n moreover\n\n from e valid_edges have \"v' |\\| vertices\" by auto\n with \\nodeOf v' = Rule r\\ \\a |\\| f_antecedent r\\\n have \"valid_in_port (v', a)\" by simp\n moreover\n\n have \"ipath (edge_tree v' a) ?es'\" using \\ipath t' _\\ by simp\n ultimately\n\n show ?thesis by metis\n next\n case Helper\n from \\t' |\\| cont (edge_tree v p)\\ Helper\n have [simp]: \"t' = edge_tree v' (plain_ant anyP)\" by simp\n\n have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n moreover\n\n have \"?e \\ edges\" using e by simp\n moreover\n\n from \\p' = Reg anyP\\ \\nodeOf v' = Helper\\\n have \"hyps (nodeOf v') p' = None\" by simp\n moreover\n\n from e valid_edges have \"v' |\\| vertices\" by auto\n with \\nodeOf v' = Helper\\\n have \"valid_in_port (v', plain_ant anyP)\" by simp\n moreover\n\n have \"ipath (edge_tree v' (plain_ant anyP)) ?es'\" using \\ipath t' _\\ by simp\n ultimately\n\n show ?thesis by metis\n qed\nqed\n\nlemma forbidden_path_prefix_is_path:\n assumes \"forbidden_path v es\"\n obtains v' where \"path v' v (rev (stake n es))\"\n using assms\n apply (atomize_elim)\n apply (induction n arbitrary: v es)\n apply simp\n apply (simp add: path_snoc)\n apply (subst (asm) (2) forbidden_path.simps)\n apply auto\n done\n\nlemma forbidden_path_prefix_is_hyp_free:\n assumes \"forbidden_path v es\"\n shows \"hyps_free (rev (stake n es))\"\n using assms\n apply (induction n arbitrary: v es)\n apply (simp add: hyps_free_def)\n apply (subst (asm) (2) forbidden_path.simps)\n apply (force simp add: hyps_free_def)\n done\n\n\ntext \\And now we prove that the tree is finite, which requires the above notion of a\n@{term forbidden_path}, i.e.\\@ an infinite path.\\\n\ntheorem finite_tree:\n assumes \"valid_in_port (v,p)\"\n assumes \"terminal_vertex v\"\n shows \"tfinite (tree v p pth)\"\nproof(rule ccontr)\n let ?n = \"Suc (fcard vertices)\"\n assume \"\\ tfinite (tree v p pth)\"\n hence \"\\ tfinite (edge_tree v p)\" unfolding finite_tree_edge_tree.\n then obtain es :: \"('vertex, 'form, 'var) edge' stream\"\n where \"ipath (edge_tree v p) es\" using Konig by blast\n with \\valid_in_port (v,p)\\\n have \"forbidden_path v es\" by (rule path_is_forbidden)\n from forbidden_path_prefix_is_path[OF this] forbidden_path_prefix_is_hyp_free[OF this]\n obtain v' where \"path v' v (rev (stake ?n es))\" and \"hyps_free (rev (stake ?n es))\"\n by blast\n from this \\terminal_vertex v\\\n have \"terminal_path v' v (rev (stake ?n es))\" by (rule terminal_pathI)\n hence \"length (rev (stake ?n es)) \\ fcard vertices\"\n by (rule hyps_free_limited)\n thus False by simp\nqed\n\ntext \\The main result of this theory.\\\n\ntheorem solved\nunfolding solved_def\nproof(intro ballI allI conjI impI)\n fix c\n assume \"c |\\| conc_forms\"\n hence \"c \\ set conclusions\" by (auto simp add: conc_forms_def)\n from this(1) conclusions_present\n obtain v where \"v |\\| vertices\" and \"nodeOf v = Conclusion c\"\n by (auto, metis (no_types, lifting) image_iff image_subset_iff notin_fset)\n\n have \"valid_in_port (v, (plain_ant c))\"\n using \\v |\\| vertices\\ \\nodeOf _ = _ \\ by simp\n\n have \"terminal_vertex v\" using \\v |\\| vertices\\ \\nodeOf v = Conclusion c\\ by auto\n\n let ?t = \"tree v (plain_ant c) []\"\n\n have \"fst (root ?t) = (global_assms TYPE('var), c)\"\n using \\c \\ set conclusions\\ \\nodeOf _ = _\\\n by (auto simp add: labelAtIn_def conclusions_closed closed_no_lconsts freshen_def rename_closed subst_closed)\n moreover\n\n have \"global_assms TYPE('var) |\\| ass_forms\" by (rule global_in_ass)\n moreover\n\n from \\terminal_vertex v\\\n have \"terminal_path v v []\" by (rule terminal_path_empty)\n with \\valid_in_port (v, (plain_ant c))\\\n have \"wf ?t\" by (rule wf_tree)\n moreover\n\n from \\valid_in_port (v, plain_ant c)\\ \\terminal_vertex v\\\n have \"tfinite ?t\" by (rule finite_tree)\n ultimately\n\n show \"\\\\ t. fst (root t) = (\\ \\ c) \\ \\ |\\| ass_forms \\ wf t \\ tfinite t\" by blast\nqed\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Incredible_Proof_Machine/Incredible_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2778783953497328}} {"text": "(* Title: HOL/HOLCF/IOA/ShortExecutions.thy\n Author: Olaf Müller\n*)\n\ntheory ShortExecutions\nimports Traces\nbegin\n\ntext \\\n Some properties about \\Cut ex\\, defined as follows:\n\n For every execution ex there is another shorter execution \\Cut ex\\\n that has the same trace as ex, but its schedule ends with an external action.\n\\\n\ndefinition oraclebuild :: \"('a \\ bool) \\ 'a Seq \\ 'a Seq \\ 'a Seq\"\n where \"oraclebuild P =\n (fix \\\n (LAM h s t.\n case t of\n nil \\ nil\n | x ## xs \\\n (case x of\n UU \\ UU\n | Def y \\\n (Takewhile (\\x. \\ P x) \\ s) @@\n (y \\ (h \\ (TL \\ (Dropwhile (\\x. \\ P x) \\ s)) \\ xs)))))\"\n\ndefinition Cut :: \"('a \\ bool) \\ 'a Seq \\ 'a Seq\"\n where \"Cut P s = oraclebuild P \\ s \\ (Filter P \\ s)\"\n\ndefinition LastActExtsch :: \"('a,'s) ioa \\ 'a Seq \\ bool\"\n where \"LastActExtsch A sch \\ Cut (\\x. x \\ ext A) sch = sch\"\n\naxiomatization where\n Cut_prefixcl_Finite: \"Finite s \\ \\y. s = Cut P s @@ y\"\n\naxiomatization where\n LastActExtsmall1: \"LastActExtsch A sch \\ LastActExtsch A (TL \\ (Dropwhile P \\ sch))\"\n\naxiomatization where\n LastActExtsmall2: \"Finite sch1 \\ LastActExtsch A (sch1 @@ sch2) \\ LastActExtsch A sch2\"\n\nML \\\nfun thin_tac' ctxt j =\n rotate_tac (j - 1) THEN'\n eresolve_tac ctxt [thin_rl] THEN'\n rotate_tac (~ (j - 1))\n\\\n\n\nsubsection \\\\oraclebuild\\ rewrite rules\\\n\nlemma oraclebuild_unfold:\n \"oraclebuild P =\n (LAM s t.\n case t of\n nil \\ nil\n | x ## xs \\\n (case x of\n UU \\ UU\n | Def y \\\n (Takewhile (\\a. \\ P a) \\ s) @@\n (y \\ (oraclebuild P \\ (TL \\ (Dropwhile (\\a. \\ P a) \\ s)) \\ xs))))\"\n apply (rule trans)\n apply (rule fix_eq2)\n apply (simp only: oraclebuild_def)\n apply (rule beta_cfun)\n apply simp\n done\n\nlemma oraclebuild_UU: \"oraclebuild P \\ sch \\ UU = UU\"\n apply (subst oraclebuild_unfold)\n apply simp\n done\n\nlemma oraclebuild_nil: \"oraclebuild P \\ sch \\ nil = nil\"\n apply (subst oraclebuild_unfold)\n apply simp\n done\n\nlemma oraclebuild_cons:\n \"oraclebuild P \\ s \\ (x \\ t) =\n (Takewhile (\\a. \\ P a) \\ s) @@\n (x \\ (oraclebuild P \\ (TL \\ (Dropwhile (\\a. \\ P a) \\ s)) \\ t))\"\n apply (rule trans)\n apply (subst oraclebuild_unfold)\n apply (simp add: Consq_def)\n apply (simp add: Consq_def)\n done\n\n\nsubsection \\Cut rewrite rules\\\n\nlemma Cut_nil: \"Forall (\\a. \\ P a) s \\ Finite s \\ Cut P s = nil\"\n apply (unfold Cut_def)\n apply (subgoal_tac \"Filter P \\ s = nil\")\n apply (simp add: oraclebuild_nil)\n apply (rule ForallQFilterPnil)\n apply assumption+\n done\n\nlemma Cut_UU: \"Forall (\\a. \\ P a) s \\ \\ Finite s \\ Cut P s = UU\"\n apply (unfold Cut_def)\n apply (subgoal_tac \"Filter P \\ s = UU\")\n apply (simp add: oraclebuild_UU)\n apply (rule ForallQFilterPUU)\n apply assumption+\n done\n\nlemma Cut_Cons:\n \"P t \\ Forall (\\x. \\ P x) ss \\ Finite ss \\\n Cut P (ss @@ (t \\ rs)) = ss @@ (t \\ Cut P rs)\"\n apply (unfold Cut_def)\n apply (simp add: ForallQFilterPnil oraclebuild_cons TakewhileConc DropwhileConc)\n done\n\n\nsubsection \\Cut lemmas for main theorem\\\n\nlemma FilterCut: \"Filter P \\ s = Filter P \\ (Cut P s)\"\n apply (rule_tac A1 = \"\\x. True\" and Q1 = \"\\x. \\ P x\" and x1 = \"s\" in take_lemma_induct [THEN mp])\n prefer 3\n apply fast\n apply (case_tac \"Finite s\")\n apply (simp add: Cut_nil ForallQFilterPnil)\n apply (simp add: Cut_UU ForallQFilterPUU)\n text \\main case\\\n apply (simp add: Cut_Cons ForallQFilterPnil)\n done\n\nlemma Cut_idemp: \"Cut P (Cut P s) = (Cut P s)\"\n apply (rule_tac A1 = \"\\x. True\" and Q1 = \"\\x. \\ P x\" and x1 = \"s\" in\n take_lemma_less_induct [THEN mp])\n prefer 3\n apply fast\n apply (case_tac \"Finite s\")\n apply (simp add: Cut_nil ForallQFilterPnil)\n apply (simp add: Cut_UU ForallQFilterPUU)\n text \\main case\\\n apply (simp add: Cut_Cons ForallQFilterPnil)\n apply (rule take_reduction)\n apply auto\n done\n\nlemma MapCut: \"Map f\\(Cut (P \\ f) s) = Cut P (Map f\\s)\"\n apply (rule_tac A1 = \"\\x. True\" and Q1 = \"\\x. \\ P (f x) \" and x1 = \"s\" in\n take_lemma_less_induct [THEN mp])\n prefer 3\n apply fast\n apply (case_tac \"Finite s\")\n apply (simp add: Cut_nil)\n apply (rule Cut_nil [symmetric])\n apply (simp add: ForallMap o_def)\n apply (simp add: Map2Finite)\n text \\case \\\\ Finite s\\\\\n apply (simp add: Cut_UU)\n apply (rule Cut_UU)\n apply (simp add: ForallMap o_def)\n apply (simp add: Map2Finite)\n text \\main case\\\n apply (simp add: Cut_Cons MapConc ForallMap FiniteMap1 o_def)\n apply (rule take_reduction)\n apply auto\n done\n\nlemma Cut_prefixcl_nFinite [rule_format]: \"\\ Finite s \\ Cut P s \\ s\"\n apply (intro strip)\n apply (rule take_lemma_less [THEN iffD1])\n apply (intro strip)\n apply (rule mp)\n prefer 2\n apply assumption\n apply (tactic \"thin_tac' \\<^context> 1 1\")\n apply (rule_tac x = \"s\" in spec)\n apply (rule nat_less_induct)\n apply (intro strip)\n apply (rename_tac na n s)\n apply (case_tac \"Forall (\\x. \\ P x) s\")\n apply (rule take_lemma_less [THEN iffD2, THEN spec])\n apply (simp add: Cut_UU)\n text \\main case\\\n apply (drule divide_Seq3)\n apply (erule exE)+\n apply (erule conjE)+\n apply hypsubst\n apply (simp add: Cut_Cons)\n apply (rule take_reduction_less)\n text \\auto makes also reasoning about Finiteness of parts of \\s\\!\\\n apply auto\n done\n\nlemma execThruCut: \"is_exec_frag A (s, ex) \\ is_exec_frag A (s, Cut P ex)\"\n apply (case_tac \"Finite ex\")\n apply (cut_tac s = \"ex\" and P = \"P\" in Cut_prefixcl_Finite)\n apply assumption\n apply (erule exE)\n apply (rule exec_prefix2closed)\n apply (erule_tac s = \"ex\" and t = \"Cut P ex @@ y\" in subst)\n apply assumption\n apply (erule exec_prefixclosed)\n apply (erule Cut_prefixcl_nFinite)\n done\n\n\nsubsection \\Main Cut Theorem\\\n\nlemma exists_LastActExtsch:\n \"sch \\ schedules A \\ tr = Filter (\\a. a \\ ext A) \\ sch \\\n \\sch. sch \\ schedules A \\ tr = Filter (\\a. a \\ ext A) \\ sch \\ LastActExtsch A sch\"\n apply (unfold schedules_def has_schedule_def [abs_def])\n apply auto\n apply (rule_tac x = \"filter_act \\ (Cut (\\a. fst a \\ ext A) (snd ex))\" in exI)\n apply (simp add: executions_def)\n apply (pair ex)\n apply auto\n apply (rule_tac x = \"(x1, Cut (\\a. fst a \\ ext A) x2)\" in exI)\n apply simp\n\n text \\Subgoal 1: Lemma: propagation of execution through \\Cut\\\\\n apply (simp add: execThruCut)\n\n text \\Subgoal 2: Lemma: \\Filter P s = Filter P (Cut P s)\\\\\n apply (simp add: filter_act_def)\n apply (subgoal_tac \"Map fst \\ (Cut (\\a. fst a \\ ext A) x2) = Cut (\\a. a \\ ext A) (Map fst \\ x2)\")\n apply (rule_tac [2] MapCut [unfolded o_def])\n apply (simp add: FilterCut [symmetric])\n\n text \\Subgoal 3: Lemma: \\Cut\\ idempotent\\\n apply (simp add: LastActExtsch_def filter_act_def)\n apply (subgoal_tac \"Map fst \\ (Cut (\\a. fst a \\ ext A) x2) = Cut (\\a. a \\ ext A) (Map fst \\ x2)\")\n apply (rule_tac [2] MapCut [unfolded o_def])\n apply (simp add: Cut_idemp)\n done\n\n\nsubsection \\Further Cut lemmas\\\n\nlemma LastActExtimplnil: \"LastActExtsch A sch \\ Filter (\\x. x \\ ext A) \\ sch = nil \\ sch = nil\"\n apply (unfold LastActExtsch_def)\n apply (drule FilternPnilForallP)\n apply (erule conjE)\n apply (drule Cut_nil)\n apply assumption\n apply simp\n done\n\nlemma LastActExtimplUU: \"LastActExtsch A sch \\ Filter (\\x. x \\ ext A) \\ sch = UU \\ sch = UU\"\n apply (unfold LastActExtsch_def)\n apply (drule FilternPUUForallP)\n apply (erule conjE)\n apply (drule Cut_UU)\n apply assumption\n apply simp\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/ShortExecutions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2778783953497328}} {"text": "\n\ntheory OperatorAmbiguity\n imports \"LocalLexing2.Derivations\" Containers.Containers\n\nbegin\nlocale OperatorAmbiguity = CFG +\n fixes Priority :: \"(('a, 'b) rule \\ ('a, 'b) rule) set\"\n fixes Left :: \"(('a, 'b) rule \\ ('a, 'b) rule) set\"\n fixes Right:: \"(('a, 'b) rule \\ ('a, 'b) rule) set\"\n assumes Priority_between_alternates: \"\\((N1, r1), (N2, r2)) \\ Priority. (N1 = N2)\"\n assumes Priority_valid: \"\\((N1, r1), (N2, r2)) \\ Priority. ((N1 = hd r1 \\hd r1 = last r2) \\ ((N1 = hd r1 \\ last r1 = hd r2)))\"\n assumes Priority_is_strictpart: \"antisym Priority \\ trans Priority \\ irrefl Priority\"\n assumes Left_between_alternates: \"\\((N1, r1), (N2, r2)) \\ Left. (N1 = N2)\"\n assumes Left_valid: \"\\((N1, r1), (N2, r2)) \\ Left. (N1 = hd r1\\hd r2 = hd r1 \\hd r1 = last r1 \\hd r2 = last r2)\"\n assumes Right_between_alternates: \"\\((N1, r1), (N2, r2)) \\ Right. (N1 = N2)\"\n assumes Right_valid: \"\\((N1, r1), (N2, r2)) \\ Right. (N1 = hd r1\\hd r2 = hd r1 \\hd r1 = last r1 \\hd r2 = last r2)\"\n assumes Relation_safety: \"(Left \\ Right = {}) \\ (Priority \\ Right = {}) \\ (Left \\ Priority = {})\"\nbegin\n\n(*how to best define those kind of derivations? \\ need derivation sequence*)\n(*how do I define a precedence left derivation?\n \n! !precedencederivations have to be defined on their subtrees specifically*)\n(*actual way it works is all subtrees are precedenceleft derivations and root does not have any of the other*)\n(*along right/left spine?*)\n\n\nfun \"derive\"::\"('a, 'b) sentence \\ nat \\ ('a, 'b) rule \\ ('a, 'b)sentence\" where\n\"derive a n (N, r) = (take (n-1) a)@r@(drop n a) \"\n\nfun valid::\" ('a, 'b) sentence \\ ('a, 'b) rule \\ bool\" where\n\"valid s (N, r) = ((last r = N) \\(\\w . is_word w \\ s = w@[N]@r))\"\n\n(*one level for associativity, all others along, right/left spine*)\n\n(*this happens until \\ remember position of any other nonterminal and iterate all get applied to it*)\n(*splits derivation such that all children in leftmost expansion of leading rule are in left*)\nfun left_children::\"('a, 'b) rule \\ ('a, 'b) derivation \\ ('a, 'b) derivation \\ ('a, 'b) derivation\" where\n\"left_children (_, r) D = (if \\ is_nonterminal (hd r) then ([], D) \n else \n snd (foldr \n (\\(n, S, R) (N, left, right). if (n \\ N) then (n+ length R,left@[(n,S, R)], right) else (n ,left, right@[(n,S, R)])) D (0, [], [])))\"\n\n(*drop all until one derivation gets applied to the rightmost terminal*)\n(*potential bug length r*)\n(*splits derivatioin such that all children in rightmost expansion of leading rule are in right*)\nfun right_children::\"('a, 'b) rule \\ ('a, 'b) derivation \\ ('a, 'b) derivation \\ ('a, 'b) derivation\" where\n\"right_children (_, r) D = (if \\ is_nonterminal (last r) then ([], D) \n else \n snd (foldr \n (\\(n, S, R) (N, left, right). if (n < N) then (n+ length R,left@[(n,S, R)], right) else (n ,left, right@[(n,S, R)])) D (length r, [], [])))\"\n\nlemma left_children_safe: \"fst (left_children r D)@(snd (left_children r D)) = D\"\n apply(induct D)\n apply(auto)\n sorry\n\nlemma right_children_safe: \"fst (right_children r D)@(snd (right_children r D)) = D\"\n apply(induct D)\n apply(auto)\n sorry\n\n\nfun rightspine::\"('a, 'b) rule \\ ('a, 'b) derivation \\ ('a, 'b) rule set\" where \n\"rightspine (S, r) D = set (map snd (filter (\\(_, N, _). N = S)(takeWhile (\\(n, N, r). is_nonterminal (hd r)) (snd (right_children (S, r) D)))))\"\n\n(*\nfun leftspine::\"sentence \\ rule \\ derivation \\ rule set\" where\n\"leftspine s (S, r) D = set (snd (foldr (\\(n, rule) (a, d). let s = derive a n rule in (s, if valid s (S, r) then rule#d else d)) D (s@[S]@r ,[]))) \"\n*)\n\nfun rightexpansion::\"('a, 'b) derivation \\ ('a, 'b) derivation\" where\n\"rightexpansion [] = []\" |\n\"rightexpansion ((n, H, r)#D) = (if \\ is_nonterminal (last r) then [] else \n snd (foldr (\\(n1, H1, r1) (N, s). if n1 = N then \n (if is_nonterminal (last r1) then ((N + length r1), (n1, H1, r1)#s) else (N -1, (n1, H1, r1)#s))\n else (N, s)) D (n + length r, [])))\" \n\nfun leftspine::\"('a, 'b) rule \\ ('a, 'b) derivation \\ ('a, 'b) rule set\" where\n\"leftspine (S, r) D = (if \\ is_nonterminal (hd r) then {} else set (map snd (rightexpansion D)))\"\n\nfun PrecedenceLeftDerivation :: \"('a, 'b) sentence \\ ('a, 'b) derivation \\ ('a, 'b) sentence \\ bool\"\nwhere\n \"PrecedenceLeftDerivation a [] b = (a = b)\"\n| \"PrecedenceLeftDerivation a (d#D) b = (\\ x. LeftDerives1 a (fst d) (snd d) x \\ PrecedenceLeftDerivation x D b \\ \n (leftspine (snd d) D \\ ((Priority) `` {snd d}) = {}) \\ (rightspine (snd d) D \\ ((Priority) `` {snd d}) = {}))\"\n(*rotations are not as easy \\ have to show that no new conflicts arise*)\n(*or can we prove safety in another way?*)\n(*E\\ > \\E*)\nfun ambiguous1::\"('a, 'b) symbol \\ ('a, 'b) rule \\('a, 'b) rule \\ bool\" where\n\"ambiguous1 s (N1, r1) (N2, r2) = ((s = N1) \\(N1 = N2) \\ (N1 = hd r1 \\hd r1 = last r2))\"\n(*\\E > E\\*)\nfun ambiguous2::\"('a, 'b) symbol \\ ('a, 'b) rule \\ ('a, 'b) rule \\ bool\" where\n\"ambiguous2 s (N1, r1) (N2, r2) = ( (s = N1) \\(N1 = N2) \\ (N1 = hd r2 \\hd r2 = last r1))\"\n\n(*need additional lemma for derivation shift*)\n(*have to prove that left most holds*)\n(*direction of application should not *)\n(*keep a look at derivation_swap in derivation\n*)\n(*prove this by induction on D*)\n(*is_Word append*)\nlemma nth_append':\"(a@l) ! (n + length a) = l ! n \"\n apply(induct a, auto)\n done\n\nlemma Derives1_append:\"is_sentence u \\ Derives1 a n r b \\ Derives1 (u@a) (n + length u) r (u@b)\"\n apply(auto simp add: Derives1_def)\n apply(rule_tac x=\"u@x\" in exI)\n apply(rule_tac x=\"y\" in exI)\n apply(auto simp add: is_sentence_concat)\n done\nlemma LeftDerives1_append_word:\"LeftDerives1 a i r b \\ is_word u \\ LeftDerives1 (u@a) (i + (length u)) r (u@b)\"\n apply(auto simp add: Derives1_append LeftDerives1_def nth_append leftmost_def)\ndone\n(*possible take rules used: first subgoal is on shifting on operator*)\nlemma LeftDerivation_append_word:\"is_word u \\ LeftDerivation a D b \\ LeftDerivation (u@a) (derivation_shift D 0 (length u)) (u@b)\"\n apply(auto simp add: derivation_shift_def Derivation_take)\n apply(induct D arbitrary:u a b)\n apply(auto )\n apply(rule_tac x=\"u@x\" in exI)\n apply(simp add: LeftDerives1_append_word)\n done\n\nlemma nth_take:\"n < n1 \\ (take n1 l) ! n = l ! n \"\n apply(induct l, auto)\n done\n\nlemma nth_concat:\"n < length l \\ (take (length l) (l@a)) ! n = (l@a) ! n\"\n by(rule nth_take)\n \n \nlemma Derives1_concat:\"is_sentence d \\ Derives1 a i r b \\ Derives1 (a@d) i r (b@d)\"\n apply(auto simp add: Derives1_def)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"y@d\" in exI)\n apply(auto simp add: is_sentence_concat)\n done\n\nlemma LeftDerives1_concat:\"is_sentence d \\ LeftDerives1 a i r b \\ LeftDerives1 (a@d) i r (b@d)\"\n apply(auto simp add: LeftDerives1_def leftmost_def Derives1_concat nth_append)\ndone\n\nlemma LeftDerivation_concat: \"is_sentence d \\ LeftDerivation a D b \\ LeftDerivation (a@d) D (b@d)\"\n apply(induct D arbitrary: a b d)\n apply(auto )\n apply(rule_tac x=\"x@d\" in exI)\n apply(simp add: LeftDerives1_concat)\n done\n\ntheorem type1_derivation:\n assumes E:\"is_nonterminal E\" and \"(E, \\@[E]) \\ \\\" and \"(E, E#\\) \\ \\\" \n and v:\"is_word v\" and \nmu:\"is_word \\\" and root:\"LeftDerivation [E] D1 (\\@[E])\" and first_word:\"LeftDerivation \\ D2 v\" and tail:\"LeftDerivation [E] D3 (E#\\)\"\n and gamma:\"is_sentence \\\"\n shows \"LeftDerivation [E] (D1@[((length \\), (E, \\@[E]))]@(derivation_shift D2 0 (length \\))@(derivation_shift D3 0 (length (\\@v)))@[((length (\\@v)), (E, E#\\))]) (\\@v@E#\\@\\)\"\nproof -\n from assms have alphaE:\"LeftDerives1 [E] (0) (E, \\@[E]) (\\@[E])\" by (simp add: LeftDerives1_def leftmost_def Derives1_def)\n from assms have Ebeta:\"LeftDerives1 [E] (0) (E, E#\\) (E#\\)\" by (simp add: LeftDerives1_def leftmost_def Derives1_def)\n from mu and v have muv:\"is_word (\\@v)\" by simp\n from alphaE and mu have \"LeftDerives1 (\\@[E]) (length \\) (E, \\@[E]) (\\@\\@[E])\" using LeftDerives1_append_word by fastforce\n from this and root have seq1: \"LeftDerivation [E] (D1@[((length \\), (E, \\@[E]))]) (\\@\\@[E])\" by (auto simp add: LeftDerivation_LeftDerives1 )\n from first_word and mu have \"LeftDerivation (\\@\\) (derivation_shift D2 0 (length \\)) (\\@v)\" by (auto simp add: LeftDerivation_append_word)\n from this and E have \"LeftDerivation (\\@\\@[E]) (derivation_shift D2 0 (length \\)) (\\@v@[E])\" using LeftDerivation_concat apply(force simp: is_sentence_def is_symbol_def) done\n from seq1 and this have seq2:\"LeftDerivation [E] (D1@[((length \\), (E, \\@[E]))]@(derivation_shift D2 0 (length \\))) (\\@v@[E])\" using LeftDerivation_implies_append apply(force) done\n from tail and muv have \"LeftDerivation (\\@v@[E]) (derivation_shift D3 0 (length (\\@v))) (\\@v@(E#\\))\" using LeftDerivation_append_word by fastforce\n from this and seq2 have seq3:\"LeftDerivation [E] (D1@[((length \\), (E, \\@[E]))]@(derivation_shift D2 0 (length \\))@(derivation_shift D3 0 (length (\\@v))))(\\@v@(E#\\))\" using LeftDerivation_append by fastforce\n from Ebeta and gamma have \"LeftDerives1 (E#\\) 0 (E, E#\\) (E#\\@\\)\" using LeftDerives1_concat by fastforce\n from this and muv have \"LeftDerives1 (\\@v@E#\\) (length (\\@v)) (E, E#\\) (\\@v@E#\\@\\)\" using LeftDerives1_append_word by fastforce\n from this and seq3 have \"LeftDerivation [E] (D1@[((length \\), (E, \\@[E]))]@(derivation_shift D2 0 (length \\))@(derivation_shift D3 0 (length (\\@v)))@[((length (\\@v)), (E, E#\\))]) (\\@v@E#\\@\\)\" using LeftDerivation_append by auto\n from this show ?thesis by auto\nqed\n\n\ntheorem type2_derivation:\n assumes E:\"is_nonterminal E\" and \"(E, \\@[E]) \\ \\\" and beta:\"(E, E#\\) \\ \\\" \n and v:\"is_word v\" and \nmu:\"is_word \\\" and root:\"LeftDerivation [E] D1 (\\@[E])\" and first_word:\"LeftDerivation \\ D2 v\" and tail:\"LeftDerivation [E] D3 (E#\\)\"\n and gamma:\"is_sentence \\\"\nshows \"LeftDerivation [E] (D3@[(0, (E, E#\\))]@D1@[( (length \\),(E, \\@[E]))]@(derivation_shift D2 0 (length \\))) (\\@v@[E]@\\@\\)\"\nproof -\n from assms have alphaE:\"LeftDerives1 [E] (0) (E, \\@[E]) (\\@[E])\" by (simp add: LeftDerives1_def leftmost_def Derives1_def)\n from assms have Ebeta:\"LeftDerives1 [E] (0) (E, E#\\) (E#\\)\" by (simp add: LeftDerives1_def leftmost_def Derives1_def)\n from mu and v have muv:\"is_word (\\@v)\" by simp\n from beta have \"is_sentence (E#\\)\" by (simp)\n from this have \"is_sentence \\\" by (simp add: is_sentence_def)\n from this and gamma have betagamma:\"is_sentence (\\@\\)\" by (simp add: is_sentence_concat)\n from betagamma and E have Ebetagamma:\"is_sentence ([E]@\\@\\)\" by (simp add: is_sentence_def)\n from Ebeta and gamma have \"LeftDerives1 (E#\\) 0 (E, E#\\) (E#\\@\\)\" using LeftDerives1_concat by fastforce\n from this and tail have seq1:\"LeftDerivation [E] (D3@[(0, (E, E#\\))]) (E#\\@\\)\" by (auto simp add: LeftDerivation_LeftDerives1)\n from betagamma and root have \"LeftDerivation (E#\\@\\) D1 (\\@E#\\@\\)\" using LeftDerivation_concat by fastforce\n from this and seq1 have seq2:\"LeftDerivation [E] (D3@[(0, (E, E#\\))]@D1) (\\@E#\\@\\)\" using LeftDerivation_implies_append by fastforce\n from mu and alphaE have \"LeftDerives1 (\\@[E]) (length \\) (E, \\@[E]) (\\@\\@[E])\" using LeftDerives1_append_word by fastforce\n from betagamma and this have \"LeftDerives1 (\\@[E]@\\@\\) (length \\) (E, \\@[E]) (\\@\\@[E]@\\@\\)\" using LeftDerives1_concat by fastforce\n from this and seq2 have seq3:\"LeftDerivation [E] (D3@[(0, (E, E#\\))]@D1@[( (length \\),(E, \\@[E]))]) (\\@\\@[E]@\\@\\)\" using LeftDerivation_LeftDerives1 by fastforce\n from first_word and mu have \"LeftDerivation (\\@\\) (derivation_shift D2 0 (length \\)) (\\@v)\" using LeftDerivation_append_word by fastforce\n from this and Ebetagamma have \"LeftDerivation (\\@\\@[E]@\\@\\) (derivation_shift D2 0 (length \\)) (\\@v@[E]@\\@\\)\" using LeftDerivation_concat by fastforce\n from this and seq3 have \"LeftDerivation [E] (D3@[(0, (E, E#\\))]@D1@[( (length \\),(E, \\@[E]))]@(derivation_shift D2 0 (length \\))) (\\@v@[E]@\\@\\)\" using LeftDerivation_implies_append by fastforce\n from this show ?thesis by auto\nqed\n\ndefinition leftrecursive::\"('a, 'b) symbol \\ ('a, 'b) rule \\ bool\" where\n\"leftrecursive s R = (snd R \\ [] \\ is_nonterminal s \\ ((fst R) = s) \\ (last (snd R) = s))\"\n\n(*separation of sequence using LeftDerivation_append?*)\n(*imply existence of other rotation*)\n(*might have to fix E as start symbol \\ any other way to enable rotation(?)*)\n(*maybe not additional condition for splitting?*)\nfun split_derivation::\"('a, 'b) derivation \\ (nat \\ ('a, 'b) rule) \\ (('a, 'b)derivation \\ ('a, 'b)derivation)\" where\n\"split_derivation D d = (takeWhile (\\ s. s \\ d) D , dropWhile (\\ s. s \\ d) D)\"\n\n\nlemma is_sentence_drop:\n assumes \"is_sentence s\"\n shows \"is_sentence (drop i s)\"\nproof -\n have l:\"set (drop i s) \\ set s\" using set_drop_subset by fast\n from assms have \"\\ x \\ set s . is_symbol x\" using list_all_def is_sentence_def by metis\n with l have \"\\ x \\ set (drop i s) . is_symbol x\" by blast\n then show ?thesis using list_all_def is_sentence_def by metis\nqed\n\nlemma takedrop1: \" take (i-j) (drop j n) = drop j (take i n)\"\n apply(auto simp add: set_def drop_take )\n done\n\nlemma list_all_tl:\"list_all a p \\ list_all a (tl p)\"\n apply(induct p)\n apply(auto simp: tl_def)\n done\nlemma is_word_drop:\"is_word u \\ is_word ( drop j u)\"\n apply(auto simp add: is_word_def)\n apply(induct j arbitrary: u)\n apply(auto simp add: drop_0)\n apply(auto simp add: drop_Suc )\n apply(simp add: list_all_tl)\n done\nlemma take_invar: \"take i u = take (i+j-j) u\"\n apply(induct i)\n apply(auto simp add: take_Cons )\n done\nlemma is_word_drop1: \"j \\ i \\is_word (take i u) \\ is_word (take (i - j) (drop j u))\"\n apply(auto simp: take_drop ) \n using is_word_drop by simp\n\nlemma wordsmallerleftmost:\n assumes word:\"is_word (take i u)\" and left:\" leftmost j u\" and valid:\"i \\ length u\"\n shows \"i \\ j\"\nproof (rule ccontr)\n assume \"\\ i \\ j\"\n from this have greater:\"j < i\" by auto\n from left have nonterm:\"is_word (take j u) \\ is_nonterminal (u ! j) \\ (j < length u)\"apply(auto simp: leftmost_def) done\n from this and greater have \"(take i u) ! j = u ! j\" by auto\n from this and nonterm have non_terminal:\"is_nonterminal ((take i u) ! j)\" by auto\n from greater and valid have \"(length (take i u)) > j\" by auto\n from this and word and greater have terminal:\"is_terminal ((take i u) ! j)\" by (auto simp add: is_word_def list_all_length)\n from this and non_terminal show \"False\" using is_terminal_nonterminal by fastforce\nqed\nlemma LeftDerives1_take:\n assumes \"LeftDerives1 u n r v \\ is_word (take j u) \\ j \\ length u \"\n shows \"LeftDerives1 (drop j u) (n-j) r (drop j v)\"\nproof -\n from assms have leftmost:\"leftmost n u\" by (simp add: LeftDerives1_def)\n from this and assms have less:\"j \\ n\" using wordsmallerleftmost by fastforce\n from assms obtain x y N \\ where \n deriv1:\"u = x @ [N] @ y \\ v = x @ \\ @ y \\ is_sentence x \\ is_sentence y \\(N, \\) \\ \\ \\ r = (N, \\) \\ n = length x\" apply(simp add: LeftDerives1_def Derives1_def) by blast\n from this and less have \"j \\ length x\" by auto\n from this and deriv1 have lem:\"Derives1 (drop j u) (n -j) r (drop j v)\" apply (simp add:Derives1_def leftmost_def) apply(rule_tac x=\"drop j x\" in exI)\n apply(rule_tac x=\"y\" in exI) apply(auto) apply(simp add: is_sentence_drop) done\n from leftmost have smallerlength:\"n < length u\" by (simp add: leftmost_def)\n from deriv1 have c:\"length x <= length v\" by auto\n from leftmost and less have \"leftmost (n -j) (drop j u)\" apply (auto simp add: leftmost_def is_word_drop) using is_word_drop1 by fastforce\n from lem and this have head:\"LeftDerives1 (drop j u) (n -j) r (drop j v)\" by (auto simp add: LeftDerives1_def)\n from this show ?thesis by auto\n qed\nlemma LeftDerivation_take:\n shows \"LeftDerivation u D v \\ is_word(take j u) \\ j \\ length u\\ LeftDerivation (drop j u) (derivation_shift D j 0) (drop j v)\" \nproof (induction D arbitrary: u v)\n case Nil \n \n with Nil have \" u = v\" by auto\n with this show ?case by (auto simp add: derivation_shift_def)\nnext\n case (Cons d D)\n from Cons have \"(\\ x. LeftDerives1 u (fst d) (snd d) x \\ LeftDerivation x D v)\" by auto\n from this obtain c where first:\"LeftDerives1 u (fst d) (snd d) c\" and tail:\"LeftDerivation c D v\" by blast\n from this have fst:\"leftmost (fst d) u\" by (simp add: LeftDerives1_def)\n from fst and Cons have less:\"j \\ fst d\" using wordsmallerleftmost by fastforce \n from first obtain x y N \\ where \n deriv1:\"u = x @ [N] @ y \\ c = x @ \\ @ y \\ is_sentence x \\ is_sentence y \\(N, \\) \\ \\ \\ (snd d) = (N, \\) \\ (fst d) = length x\" apply(simp add: LeftDerives1_def Derives1_def) by blast\n from this and less have smaller_word:\"j \\ length x\" by auto\n from this and deriv1 have lem:\"Derives1 (drop j u) ((fst d) -j) (snd d) (drop j c)\" apply (simp add:Derives1_def leftmost_def) apply(rule_tac x=\"drop j x\" in exI)\n apply(rule_tac x=\"y\" in exI) apply(auto) apply(simp add: is_sentence_drop) done\n from fst have smallerlength:\"(fst d) < length u\" by (simp add: leftmost_def)\n from deriv1 have c:\"length x <= length c\" by auto\n from fst and less have \"leftmost ((fst d) -j) (drop j u)\" apply (auto simp add: leftmost_def is_word_drop) using is_word_drop1 by fastforce\n from lem and this have head:\"LeftDerives1 (drop j u) ((fst d) -j) (snd d) (drop j c)\" by (auto simp add: LeftDerives1_def) \n from first and deriv1 have \"is_word x\" by (auto simp: LeftDerives1_def)\n from smaller_word and deriv1 have \" take j c = take j u\" by auto\n from this and smaller_word and Cons and c have \"is_word (take j c) \\ j \\ length c\" by auto\n from this and tail and Cons have INH:\"LeftDerivation (drop j c) (derivation_shift D j 0) (drop j v)\" by fastforce\n from this and head show ?case by fastforce\nqed\n\nlemma split_preserves:\"(fst(split_derivation D d))@(snd(split_derivation D d)) = D\"\n apply(auto)\n done\n\n \n(*s look to be leftrecursive anyways*)\n\nlemma rotatetype1_type2_0:\n assumes valid:\"is_leftderivation s\" and s_deriv:\"s=\\@[E] \\ is_word \\\" and \n leftrecursive:\"leftrecursive E (snd d)\" and deriv:\"LeftDerivation s (d#D) s1\" and \n conflict:\"\\r1. r1 \\ rightspine (snd d) D \" \n shows head:\"\\ D1 .LeftDerivation [E] D1 (\\@[E])\" and \"LeftDerivation \\ D2 v \\ is_word v\" and tail:\"LeftDerivation [E] D3 (E#\\)\" \nproof - \n from valid have \"\\ D0 . LeftDerivation [\\] D0 s\" apply (simp add: is_leftderivation_def) using leftderives_implies_LeftDerivation by fastforce \n from this obtain D0 where \"LeftDerivation [\\] D0 s\" by blast\n from deriv have \" \\ x.(LeftDerives1 s (fst d) (snd d) x \\ LeftDerivation x D s1)\" by auto\n obtain \\ where \"\\ = (snd (snd d))\" by blast\n from s_deriv have l1:\"drop (length \\) s = [E]\" by auto\n from s_deriv have l2:\"is_word (take (length \\) s) \\ length \\ < length s\" by auto\n from l1 and l2 and deriv have lderiv:\"LeftDerivation (drop (length \\) s) (derivation_shift (d#D) (length \\) 0) (drop (length \\) s1)\" using LeftDerivation_take by fastforce\n (*prove that we have a follow up derivation with \\@[E]*)\n from this have \"LeftDerivation (drop (length \\) s) ((fst d - (length \\), snd d)#(derivation_shift D (length \\) 0)) (drop (length \\) s1)\" by simp\n from this have \" \\ x.(LeftDerives1 (drop (length \\) s) (fst d - (length \\)) (snd d) x \\ LeftDerivation x (derivation_shift (D) (length \\) 0) (drop (length \\)s1))\" by auto\n then obtain x1 where x1':\"LeftDerives1 (drop (length \\) s) (fst d - (length \\)) (snd d) x1\" and x2':\"LeftDerivation x1 (derivation_shift (D) (length \\) 0) (drop (length \\) s1)\" by blast\n from l1 and l2 and x1' have l3': \"LeftDerives1 [E] (fst d - (length \\)) (snd d) x1\" using LeftDerives1_take by fastforce\n from x1' have \"snd d \\ \\\" by (auto simp: LeftDerives1_def)\n from this and leftrecursive have l4:\"LeftDerives1 [E] 0 (snd d) (snd (snd d))\" apply(auto simp add: LeftDerives1_def Derives1_def leftmost_def leftrecursive_def) apply(rule_tac x=\"[]\" in exI) apply(rule_tac x=\"[]\" in exI) apply(rule_tac x=\"fst (snd d)\" in exI)\n apply(auto) done\n from l3' and l4 have \"0 = fst d- (length \\)\" apply (auto simp add: LeftDerives1_def) using leftmost_unique by fastforce\n from this and l4 and l3' have eq:\"x1 = (snd (snd d))\" apply(auto simp: LeftDerives1_def) using Derives1_unique_dest by fastforce\n obtain \\E where aE:\"\\E = (snd (snd d))\" by blast\n from this and leftrecursive have last:\"last (\\E)= E\" by (auto simp add: leftrecursive_def)\n from aE and leftrecursive have nonempty:\"\\E \\ []\" by (auto simp add: leftrecursive_def last_def)\n from aE obtain \\ where \"\\ = butlast \\E\" by blast\n from this and last and nonempty have \"\\@[E] = \\E\" by auto\n from this and aE and eq have aE1:\"x1 = (\\@[E])\" by auto\n from this and l4 and eq have \"LeftDerives1 [E] 0 (snd d) (\\@[E])\" by auto \n from aE1 and x2' have \"LeftDerivation (\\@[E]) (derivation_shift D (length \\) 0) (drop (length \\) s1)\" by auto\n obtain D' where \"D' = derivation_shift D (length \\) 0\" by blast\n\n show \"\\D1. LeftDerivation [E] D1 (\\ @ [E])\" sorry\n show \"LeftDerivation \\ D2 v \\ is_word v\" sorry\n show \"LeftDerivation [E] D3 (E # \\)\" sorry\nqed\n\n\nlemma rotatetype1_type2:\n assumes valid:\"is_leftderivation s\" and s_deriv:\"is_word (take (length s -1) s) \\ is_nonterminal (last s) \"and leftrecursive:\"leftrecursive E (snd d)\" and deriv:\"LeftDerivation s (d#D) s1\" and \" \\r1. r1 \\ leftspine (snd d) D \" \n shows \"\\ D1 .LeftDerivation [E] D1 (\\@[E]) \\ is_word \\\" and \"LeftDerivation \\ D2 v\" and tail':\"LeftDerivation [E] D3 (E#\\)\" \nproof - \n\n show \"\\D1. LeftDerivation [E] D1 (\\ @ [E]) \\ is_word \\\" sorry\n show \"LeftDerivation \\ D2 v\" sorry\n show \"LeftDerivation [E] D3 (E # \\)\" sorry\nqed\n(*prove theorems that enable a swap given an ambiguous rule pairing \\ i.e. this left spine, right spine thing*)\n(*transitivity *)\ntheorem soundness: \n shows \"LeftDerivation s D s1 \\\\ D1. PrecedenceLeftDerivation s D1 s1\"\nproof (induction D arbitrary: s s1)\n case Nil\n from Nil have \"s = s1\" by auto\n with this show ?case apply (rule_tac x=\"[]\" in exI) by auto\nnext\n case (Cons d D)\n then show ?case sorry\nqed\n(*alternative formulation of safety, formalize removal scheme*)\n\n(*theorem safety:\n sorry\n *)\n(*by induction on length of derivation sequences*)\n\n(*completeness relies on total order though*)\ntheorem completeness:\"PrecedenceLeftDerivation s D1 s1 \\ PrecedenceLeftDerivation s D2 s2 \\ D1 = D2\" \n sorry\nend\n\nend", "meta": {"author": "LocalLexingParser", "repo": "LocalLexingParser", "sha": "243c0257ba20c9f9ec389a1883c640ace77d1bbc", "save_path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser", "path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser/LocalLexingParser-243c0257ba20c9f9ec389a1883c640ace77d1bbc/thys/OperatorAmbiguity.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.27787839534973274}} {"text": "(*<*)\n\\\\ ********************************************************************\n * Project : CSP-RefTK - A Refinement Toolkit for HOL-CSP\n * Version : 1.0\n *\n * Author : Burkhart Wolff, Safouan Taha, Lina Ye.\n *\n * This file : A Normalization Theory\n *\n * Copyright (c) 2020 Université Paris-Saclay, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************\\\n(*>*)\n\nchapter\\ Normalisation of Deterministic CSP Processes \\\n\ntheory Process_norm\n\nimports \"Properties\" \"Fix_ind_ext\"\n\nbegin\n\nsection\\Deterministic normal-forms with explicit state\\\n\nabbreviation \"P_dnorm Tr Up \\ (\\ X. (\\ s. \\ e \\ (Tr s) \\ X (Up s e)))\"\n\nnotation P_dnorm (\"P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\_,_\\\" 60)\n\nlemma dnorm_cont[simp]:\n fixes Tr::\"'state::type \\ 'event::type set\" and Up::\"'state \\ 'event \\ 'state\"\n shows \"cont (\\X. (\\s. \\ e \\ (Tr s) \\ X (Ur s e)))\" (is \"cont ?f\")\nproof -\n have \"cont (\\X. ?f X s)\" for s by (simp add:cont_fun) \n then show ?thesis by simp\nqed\n\nsection\\Interleaving product lemma\\\n\nlemma dnorm_inter: \n fixes Tr\\<^sub>1 ::\"'state\\<^sub>1::type \\ 'event::type set\" and Tr\\<^sub>2::\"'state\\<^sub>2::type \\ 'event set\" \n and Up\\<^sub>1 ::\"'state\\<^sub>1 \\ 'event \\ 'state\\<^sub>1\" and Up\\<^sub>2::\"'state\\<^sub>2 \\ 'event \\ 'state\\<^sub>2\"\n defines P: \"P \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr\\<^sub>1,Up\\<^sub>1\\\" (is \"P \\ fix\\(\\ X. ?P X)\")\n defines Q: \"Q \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr\\<^sub>2,Up\\<^sub>2\\\" (is \"Q \\ fix\\(\\ X. ?Q X)\")\n\n assumes indep: \\\\s\\<^sub>1 s\\<^sub>2. Tr\\<^sub>1 s\\<^sub>1 \\ Tr\\<^sub>2 s\\<^sub>2 = {}\\\n\n defines Tr: \"Tr \\ (\\(s\\<^sub>1,s\\<^sub>2). Tr\\<^sub>1 s\\<^sub>1 \\ Tr\\<^sub>2 s\\<^sub>2)\"\n defines Up: \"Up \\ (\\(s\\<^sub>1,s\\<^sub>2) e. if e \\ Tr\\<^sub>1 s\\<^sub>1 then (Up\\<^sub>1 s\\<^sub>1 e,s\\<^sub>2)\n else if e \\ Tr\\<^sub>2 s\\<^sub>2 then (s\\<^sub>1, Up\\<^sub>2 s\\<^sub>2 e)\n else (s\\<^sub>1,s\\<^sub>2))\" \n defines S: \"S \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr,Up\\\" (is \"S \\ fix\\(\\ X. ?S X)\")\n \n shows \"(P s\\<^sub>1 ||| Q s\\<^sub>2) = S (s\\<^sub>1,s\\<^sub>2)\"\nproof -\n have P_rec: \"P = ?P P\" using fix_eq[of \"(\\ X. ?P X)\"] P by simp \n have Q_rec: \"Q = ?Q Q\" using fix_eq[of \"(\\ X. ?Q X)\"] Q by simp \n have S_rec: \"S = ?S S\" using fix_eq[of \"(\\ X. ?S X)\"] S by simp\n have dir1: \"\\ s\\<^sub>1 s\\<^sub>2. (P s\\<^sub>1 ||| Q s\\<^sub>2) \\ S (s\\<^sub>1, s\\<^sub>2)\"\n proof(subst P, subst Q, \n induct rule:parallel_fix_ind_inc[of \"\\x y. \\ s\\<^sub>1 s\\<^sub>2. (x s\\<^sub>1 ||| y s\\<^sub>2) \\ S (s\\<^sub>1,s\\<^sub>2)\"])\n case adm:1 \n then show ?case\n by (intro adm_all adm_below) (simp_all add: cont2cont_fun)\n next\n case base_fst:(2 y)\n then show ?case by (metis Inter_commute app_strict minimal par_Int_bot) \n next\n case base_snd:(3 x)\n then show ?case by (simp add: par_Int_bot)\n next\n case step:(4 x y)\n then show ?case (is \"\\ s\\<^sub>1 s\\<^sub>2. ?C s\\<^sub>1 s\\<^sub>2\")\n proof(intro allI)\n fix s\\<^sub>1 s\\<^sub>2\n show \"?C s\\<^sub>1 s\\<^sub>2\"\n apply(simp)\n apply(subst mprefix_Par_Int[where C=\"{}\", simplified])\n apply(subst S_rec, simp add: Tr Up mprefix_Un_distr)\n apply(intro mono_det_ref mono_mprefix_ref)\n using step(3)[simplified] indep apply simp\n using step(2)[simplified] indep by fastforce\n qed\n qed \n have dir2: \"\\ s\\<^sub>1 s\\<^sub>2. S (s\\<^sub>1, s\\<^sub>2) \\ (P s\\<^sub>1 ||| Q s\\<^sub>2)\"\n proof(subst S, induct rule:fix_ind_k[of \"\\x. \\ s\\<^sub>1 s\\<^sub>2. x (s\\<^sub>1,s\\<^sub>2) \\ (P s\\<^sub>1 ||| Q s\\<^sub>2)\" 1])\n case adm:1\n show ?case by (intro adm_all adm_below) (simp_all add: cont_fun) \n next\n case base_k_steps:2\n then show ?case by simp\n next\n case step:(3 x)\n then show ?case (is \"\\ s\\<^sub>1 s\\<^sub>2. ?C s\\<^sub>1 s\\<^sub>2\")\n proof(intro allI)\n fix s\\<^sub>1 s\\<^sub>2\n have P_rec_sym:\"Mprefix (Tr\\<^sub>1 s\\<^sub>1) (\\e. P (Up\\<^sub>1 s\\<^sub>1 e)) = P s\\<^sub>1\" using P_rec by metis\n have Q_rec_sym:\"Mprefix (Tr\\<^sub>2 s\\<^sub>2) (\\e. Q (Up\\<^sub>2 s\\<^sub>2 e)) = Q s\\<^sub>2\" using Q_rec by metis\n show \"?C s\\<^sub>1 s\\<^sub>2\"\n apply(simp add: Tr Up mprefix_Un_distr)\n apply(subst P_rec, subst Q_rec, subst mprefix_Par_Int[where C=\"{}\", simplified])\n apply(intro mono_det_ref mono_mprefix_ref)\n apply(subst Q_rec_sym, simp add:step[simplified])\n apply(subst P_rec_sym) using step[simplified] indep by fastforce\n qed\n qed\n from dir1 dir2 show ?thesis using below_antisym by blast\nqed\n\nsection \\Synchronous product lemma\\\nlemma dnorm_par: \n fixes Tr\\<^sub>1 ::\"'state\\<^sub>1::type \\ 'event::type set\" and Tr\\<^sub>2::\"'state\\<^sub>2::type \\ 'event set\" \n and Up\\<^sub>1 ::\"'state\\<^sub>1 \\ 'event \\ 'state\\<^sub>1\" and Up\\<^sub>2::\"'state\\<^sub>2 \\ 'event \\ 'state\\<^sub>2\"\n defines P: \"P \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr\\<^sub>1,Up\\<^sub>1\\\" (is \"P \\ fix\\(\\ X. ?P X)\")\n defines Q: \"Q \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr\\<^sub>2,Up\\<^sub>2\\\" (is \"Q \\ fix\\(\\ X. ?Q X)\")\n\n defines Tr: \"Tr \\ (\\(s\\<^sub>1,s\\<^sub>2). Tr\\<^sub>1 s\\<^sub>1 \\ Tr\\<^sub>2 s\\<^sub>2)\"\n defines Up: \"Up \\ (\\(s\\<^sub>1,s\\<^sub>2) e. (Up\\<^sub>1 s\\<^sub>1 e, Up\\<^sub>2 s\\<^sub>2 e))\" \n defines S: \"S \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr,Up\\\" (is \"S \\ fix\\(\\ X. ?S X)\")\n \n shows \"(P s\\<^sub>1 || Q s\\<^sub>2) = S (s\\<^sub>1,s\\<^sub>2)\"\nproof -\n have P_rec: \"P = ?P P\" using fix_eq[of \"(\\ X. ?P X)\"] P by simp \n have Q_rec: \"Q = ?Q Q\" using fix_eq[of \"(\\ X. ?Q X)\"] Q by simp \n have S_rec: \"S = ?S S\" using fix_eq[of \"(\\ X. ?S X)\"] S by simp\n have dir1: \"\\ s\\<^sub>1 s\\<^sub>2. (P s\\<^sub>1 || Q s\\<^sub>2) \\ S (s\\<^sub>1, s\\<^sub>2)\"\n proof(subst P, subst Q, \n induct rule:parallel_fix_ind[of \"\\x y. \\ s\\<^sub>1 s\\<^sub>2. (x s\\<^sub>1 || y s\\<^sub>2) \\ S (s\\<^sub>1,s\\<^sub>2)\"])\n case adm:1\n then show ?case\n by (intro adm_all adm_below) (simp_all add: cont2cont_fun)\n next\n case base:2\n then show ?case by (simp add: par_Int_bot)\n next\n case step:(3 x y)\n then show ?case (is \"\\ s\\<^sub>1 s\\<^sub>2. ?C s\\<^sub>1 s\\<^sub>2\")\n proof(intro allI)\n fix s\\<^sub>1 s\\<^sub>2\n show \"?C s\\<^sub>1 s\\<^sub>2\"\n apply(simp)\n apply(subst mprefix_Par_distr[where C=\"UNIV\", simplified])\n apply(subst S_rec, simp add: Tr Up mprefix_Un_distr)\n by (simp add:step mono_mprefix_ref)\n qed\n qed \n have dir2: \"\\ s\\<^sub>1 s\\<^sub>2. S (s\\<^sub>1, s\\<^sub>2) \\ (P s\\<^sub>1 || Q s\\<^sub>2)\"\n proof(subst S, induct rule:fix_ind_k[of \"\\x. \\ s\\<^sub>1 s\\<^sub>2. x (s\\<^sub>1,s\\<^sub>2) \\ (P s\\<^sub>1 || Q s\\<^sub>2)\" 1])\n case adm:1\n show ?case by (intro adm_all adm_below) (simp_all add: cont_fun) \n next\n case base_k_steps:2\n then show ?case by simp\n next\n case step:(3 x)\n then show ?case (is \"\\ s\\<^sub>1 s\\<^sub>2. ?C s\\<^sub>1 s\\<^sub>2\")\n proof(intro allI)\n fix s\\<^sub>1 s\\<^sub>2\n have P_rec_sym:\"Mprefix (Tr\\<^sub>1 s\\<^sub>1) (\\e. P (Up\\<^sub>1 s\\<^sub>1 e)) = P s\\<^sub>1\" using P_rec by metis\n have Q_rec_sym:\"Mprefix (Tr\\<^sub>2 s\\<^sub>2) (\\e. Q (Up\\<^sub>2 s\\<^sub>2 e)) = Q s\\<^sub>2\" using Q_rec by metis\n show \"?C s\\<^sub>1 s\\<^sub>2\"\n apply(simp add: Tr Up)\n apply(subst P_rec, subst Q_rec, subst mprefix_Par_distr[where C=\"UNIV\", simplified])\n apply(rule mono_mprefix_ref) \n using step by auto\n qed\n qed\n from dir1 dir2 show ?thesis using below_antisym by blast\nqed\n\nsection\\Consequences\\\n\\\\reachable states from one starting state\\\ninductive_set \\ for Tr ::\"'state::type \\ 'event::type set\" \n and Up::\"'state \\ 'event \\ 'state\" \n and s\\<^sub>0::'state \n where rbase: \"s\\<^sub>0 \\ \\ Tr Up s\\<^sub>0\"\n | rstep: \"s \\ \\ Tr Up s\\<^sub>0 \\ e \\ Tr s \\ Up s e \\ \\ Tr Up s\\<^sub>0\"\n\n\n\n\\\\Deadlock freeness\\\nlemma deadlock_free_dnorm_ :\n fixes Tr ::\"'state::type \\ 'event::type set\" \n and Up ::\"'state \\ 'event \\ 'state\" \n and s\\<^sub>0::'state \n assumes non_reachable_sink: \"\\s \\ \\ Tr Up s\\<^sub>0. Tr s \\ {}\"\n defines P: \"P \\ P\\<^sub>n\\<^sub>o\\<^sub>r\\<^sub>m\\Tr,Up\\\" (is \"P \\ fix\\(\\ X. ?P X)\")\n shows \"s \\ \\ Tr Up s\\<^sub>0 \\ deadlock_free_v2 (P s)\"\nproof(unfold deadlock_free_v2_FD DF\\<^sub>S\\<^sub>K\\<^sub>I\\<^sub>P_def, induct arbitrary:s rule:fix_ind)\n show \"adm (\\a. \\x. x \\ \\ Tr Up s\\<^sub>0 \\ a \\\\<^sub>F\\<^sub>D P x)\" by (simp add: le_FD_adm monofun_def) \nnext\n fix s :: \"'state\" \n show \"s \\ \\ Tr Up s\\<^sub>0 \\ \\ \\\\<^sub>F\\<^sub>D P s\" by simp\nnext\n fix s :: \"'state\" and x :: \"'event process\"\n have P_rec: \"P = ?P P\" using fix_eq[of \"(\\ X. ?P X)\"] P by simp \n assume 1 : \"\\s. s \\ \\ Tr Up s\\<^sub>0 \\ x \\\\<^sub>F\\<^sub>D P s\" \n and 2 : \"s \\ \\ Tr Up s\\<^sub>0 \"\n from 1 2 show \"(\\ x. (\\xa\\UNIV \\ x) \\ SKIP)\\x \\\\<^sub>F\\<^sub>D P s\"\n apply(simp add:failure_divergence_refine_def)\n apply(subst P_rec, rule_tac trans_FD[simplified failure_divergence_refine_def, \n rotated, OF Mprefix_refines_Mndet])\n apply(rule_tac CSP.mono_ndet_FD_left) \n by (metis CSP.mono_ndet_FD_right rstep empty_not_UNIV mndet_distrib mono_mndet_FD \n non_reachable_sink sup_top_left)\nqed\n\n\n\nlemmas deadlock_free_dnorm = deadlock_free_dnorm_[rotated, OF rbase, rule_format]\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CSP_RefTK/Process_norm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2778783882886352}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory AbstractArrays\nimports\n \"CLib.TypHeapLib\"\n \"Word_Lib.WordSetup\"\nbegin\n\n(*\n * Return a list of addresses that contain an element for an array at location\n * \"p\" of length \"n\".\n *)\nprimrec\n array_addrs :: \"('a::mem_type) ptr \\ nat \\ 'a ptr list\"\nwhere\n \"array_addrs _ 0 = []\"\n| \"array_addrs p (Suc n) = p # (array_addrs (p +\\<^sub>p 1) n)\"\n\ndeclare array_addrs.simps(2) [simp del]\n\n(* The first element is in the array if the array has non-zero length. *)\nlemma hd_in_array_addrs [simp]:\n \"(x \\ set (array_addrs x n)) = (n > 0)\"\n by (case_tac n, auto simp: array_addrs.simps(2))\n\nlemma array_addrs_1 [simp]:\n \"array_addrs p (Suc 0) = [p]\"\n \"array_addrs p 1 = [p]\"\n by (auto simp: array_addrs.simps(2))\n\n(* All array elements are aligned if the array itself is aligned. *)\nlemma array_addrs_ptr_aligned:\n \"\\ x \\ set (array_addrs p n); ptr_aligned p \\ \\ ptr_aligned x\"\n apply (induct n arbitrary: x p)\n apply clarsimp\n apply (clarsimp simp: array_addrs.simps(2))\n apply (erule disjE)\n apply clarsimp\n apply atomize\n apply (drule_tac x=x in spec)\n apply (drule_tac x=\"p +\\<^sub>p 1\" in spec)\n apply (clarsimp simp: ptr_aligned_plus)\n done\n\n(* Split off the last element in an array. *)\nlemma set_array_addrs_unfold_last:\n shows \"set (array_addrs a (Suc n)) = set (array_addrs a n) \\ {(a :: ('a::mem_type) ptr) +\\<^sub>p int n}\"\n (is \"?LHS a n = ?RHS a n\")\nproof (induct n arbitrary: a)\n fix a\n show \"?LHS a 0 = ?RHS a 0\"\n by clarsimp\nnext\n fix a n\n assume induct: \"\\a. ?LHS a n = ?RHS a n\"\n show \"?LHS a (Suc n) = ?RHS a (Suc n)\"\n apply (subst array_addrs.simps(2))\n apply (subst set_simps)\n apply (subst induct [where a=\"a +\\<^sub>p 1\"])\n apply (subst array_addrs.simps(2))\n apply (subst set_simps)\n apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps insert_commute)\n done\nqed\n\n(* Alternative representation of the set of array elements. *)\nlemma set_array_addrs:\n \"set (array_addrs (p :: ('a::mem_type) ptr) n)\n = {x. \\k. x = p +\\<^sub>p int k \\ k < n }\"\n apply (induct n arbitrary: p)\n apply (clarsimp simp: not_less)\n apply (subst set_array_addrs_unfold_last)\n apply atomize\n apply (drule_tac x=p in spec)\n apply (erule ssubst)\n apply (rule set_eqI)\n apply (rule iffI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply force\n apply force\n apply clarsimp\n apply (drule_tac x=k in spec)\n apply (clarsimp simp: not_less)\n apply (subgoal_tac \"k = n\")\n apply clarsimp\n apply clarsimp\n done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/autocorres/AbstractArrays.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2778365467729137}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Derived Hoare Rules for Partial Correctness *}\n\ntheory HoarePartial imports HoarePartialProps begin\n\nlemma conseq_no_aux:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A';\n \\s. s \\ P \\ (s\\P' \\ (Q' \\ Q) \\ (A' \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where P'=\"\\Z. P'\" and Q'=\"\\Z. Q'\" and A'=\"\\Z. A'\"]) auto\n\n\nlemma conseq_exploit_pre:\n \"\\\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> ({s} \\ P) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply clarify\n apply (rule_tac x=\"{s} \\ P\" in exI) \n apply (rule_tac x=\"Q\" in exI) \n apply (rule_tac x=\"A\" in exI) \n by simp\n\n\nlemma conseq:\"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq') blast\n\nlemma Lem: \"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n P \\ {s. \\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)}\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (unfold lem_def) \n apply (erule conseq)\n apply blast\n done\n\nlemma LemAnno:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ (\\t. t \\ Q' Z \\ t \\ Q)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma TrivPost: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma conseq_under_new_pre:\"\\\\,\\\\\\<^bsub>/F \\<^esub>P' c Q',A';\n \\s \\ P. s \\ P' \\ Q' \\ Q \\ A' \\ A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P c Q,A\"\napply (rule conseq)\napply (rule allI)\napply assumption\napply auto\ndone\n\n\n\nlemma DynComConseq:\n assumes \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A}\" \n shows \"\\,\\\\\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n using assms\n apply -\n apply (rule DynCom)\n apply clarsimp\n apply (rule Conseq)\n apply clarsimp\n apply blast\n done\n\nlemma SpecAnno: \n assumes consequence: \"P \\ {s. (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))}\"\n assumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant: \"\\Z. c Z = c undefined\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n from spec bdy_constant\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> ((P' Z)) (c undefined) (Q' Z),(A' Z)\"\n apply - \n apply (rule allI)\n apply (erule_tac x=Z in allE)\n apply (erule_tac x=Z in allE)\n apply simp\n done\n with consequence show ?thesis\n apply (simp add: specAnno_def)\n apply (erule conseq)\n apply blast\n done\nqed\n\nlemma SpecAnno': \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\n\nlemma SpecAnnoNoAbrupt: \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\ Q \\ \\,\\\\\\<^bsub>/F\\<^esub> P Skip Q,A\"\n by (rule hoarep.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\ {s. (f s) \\ Q} \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n by (rule hoarep.Basic [THEN conseqPre])\n\nlemma BasicCond: \n \"\\P \\ {s. (b s \\ f s\\Q) \\ (\\ b s \\ g s\\Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Basic (\\s. if b s then f s else g s) Q,A\"\n apply (rule Basic)\n apply auto\n done\n\nlemma Spec: \"P \\ {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoarep.Spec [THEN conseqPre])\n\nlemma SpecIf: \n \"\\P \\ {s. (b s \\ f s \\ Q) \\ (\\ b s \\ g s \\ Q \\ h s \\ Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n apply (rule Spec)\n apply (auto simp add: if_rel_def)\n done\n\n\nlemma Seq [trans, intro?]: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (rule hoarep.Seq)\n\nlemma SeqSwap: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c1 R,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c1 c2) Q,A\"\n by (rule Seq)\n\nlemma BSeq:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (unfold bseq_def) (rule Seq)\n\n\nlemma Cond: \n assumes wp: \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoarep.Cond [THEN conseqPre])\n from deriv_c1 \n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ b) c\\<^sub>1 Q,A\"\n by (rule conseqPre) blast\nnext\n from deriv_c2 \n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ - b) c\\<^sub>2 Q,A\"\n by (rule conseqPre) blast\nnext\n show \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" by (rule wp)\nqed \n\n\nlemma CondSwap: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A; P \\ {s. (s\\b \\ s\\P1) \\ (s\\b \\ s\\P2)}\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond)\n\nlemma Cond': \n \"\\P \\ {s. (b \\ P1) \\ (- b \\ P2)};\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule CondSwap) blast+\n\nlemma CondInv: \n assumes wp: \"P \\ Q\" \n assumes inv: \"Q \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from wp inv\n have \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n by blast\n from Cond [OF this deriv_c1 deriv_c2]\n show ?thesis .\nqed\n\nlemma CondInv': \n assumes wp: \"P \\ I\" \n assumes inv: \"I \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes wp': \"I \\ Q\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from CondInv [OF wp inv deriv_c1 deriv_c2]\n have \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\".\n from conseqPost [OF this wp' subset_refl]\n show ?thesis .\nqed\n \n\nlemma switchNil:\n \"P \\ Q \\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n by (simp add: Skip)\n \nlemma switchCons:\n \"\\P \\ {s. (v s \\ V \\ s \\ P\\<^sub>1) \\ (v s \\ V \\ s \\ P\\<^sub>2)}; \n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n by (simp add: Cond)\n\nlemma Guard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guard)\n\nlemma Guarantee:\n \"\\P \\ {s. s \\ g \\ s \\ R}; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\ g \\ s \\ R}\"])\napply assumption\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ {s. s \\ g \\ s \\ R}; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guarantee)\n\nlemma GuardStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule Guard)\n\n\nlemma GuaranteeAsGuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While: \n assumes P_I: \"P \\ I\" \n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> (I \\ b) c I,A\"\n assumes I_Q: \"I \\ -b \\ Q\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n from deriv_body P_I I_Q\n show ?thesis\n apply (simp add: whileAnno_def)\n apply (erule conseqPrePost [OF HoarePartialDef.While]) \n apply simp_all\n done\nqed\n\ntext {* @{term \"J\"} will be instantiated by tactic with @{term \"gs' \\ I\"} for\n those guards that are not stripped.*} \nlemma WhileAnnoG:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnno b J V (Seq c (guards gs Skip)))) Q,A \n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n by (simp add: whileAnnoG_def whileAnno_def while_def)\n\n\ntext {* This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"} *}\n\n\n\n\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnnoFix b J V (\\Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n using whileAnnoFix\n by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n assumes adapt: \"P \\ {s. s \\ P' s}\" \n assumes c: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (bind e c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\napply (rule allI)\napply (unfold bind_def)\napply (rule DynCom)\napply (rule ballI)\napply simp\napply (rule conseqPre)\napply (rule c [rule_format])\napply blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ init s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ R Z t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule bdy [rule_format])\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma BlockSwap:\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\nusing adapt bdy c \n by (rule Block)\n\n\nlemma BlockSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes bdy: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ R s t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return s t \\ R s t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule conseq [OF bdy])\napply clarsimp\napply blast\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma Throw: \"P \\ A \\ \\,\\\\\\<^bsub>/F\\<^esub> P Throw Q,A\"\n by (rule hoarep.Throw [THEN conseqPre])\n\nlemmas Catch = hoarep.Catch\nlemma CatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoarep.Catch)\n\nlemma raise: \"P \\ {s. f s \\ A} \\ \\,\\\\\\<^bsub>/F\\<^esub> P raise f Q,A\"\n apply (simp add: raise_def)\n apply (rule Seq)\n apply (rule Basic)\n apply (assumption)\n apply (rule Throw)\n apply (rule subset_refl)\n done\n\nlemma condCatch: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A));\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n apply (simp add: condCatch_def)\n apply (rule Catch)\n apply assumption\n apply (rule CondSwap)\n apply (assumption)\n apply (rule hoarep.Throw)\n apply blast\n done\n\nlemma condCatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A;\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A))\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n by (rule condCatch)\n\n\nlemma ProcSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def) \nby (rule BlockSpec)\n\nlemma ProcSpec':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\nlemma ProcSpecNoAbrupt:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall: \n\"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return (\\s t. c (result t))) Q,A\n\\ \\,\\\\\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n by (simp add: fcall_def)\n\n\nlemma ProcRec:\n assumes deriv_bodies: \n \"\\p\\Procs. \n \\Z. \\,\\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n by (intro strip)\n (rule CallRec' \n [OF _ Procs_defined deriv_bodies],\n simp_all)\n\nlemma ProcRec':\n assumes ctxt: \"\\' = \\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\"\n assumes deriv_bodies: \n \"\\p\\Procs. \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using ctxt deriv_bodies\n apply simp\n apply (erule ProcRec [OF _ Procs_defined])\n done\n\n\nlemma ProcRecList:\n assumes deriv_bodies: \n \"\\p\\set Procs. \n \\Z. \\,\\\\(\\p\\set Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes dist: \"distinct Procs\"\n assumes Procs_defined: \"set Procs \\ dom \\\"\n shows \"\\p\\set Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using deriv_bodies Procs_defined\n by (rule ProcRec)\n\nlemma ProcRecSpecs:\n \"\\\\(P,p,Q,A) \\ Specs. \\,\\\\Specs\\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\\\\n \\ \\(P,p,Q,A) \\ Specs. \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (auto intro: CallRec)\ndone\n\n\nlemma ProcRec1:\n assumes deriv_body: \n \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n from deriv_body p_defined\n have \"\\p\\{p}. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n by - (rule ProcRec [where A=\"\\p. A\" and P=\"\\p. P\" and Q=\"\\p. Q\"],\n simp_all)\n thus ?thesis\n by simp\nqed\n\nlemma ProcNoRec1:\n assumes deriv_body: \n \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_def: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\nfrom deriv_body\n have \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\n \\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: hoare_augment_context)\n from this p_def\n show ?thesis \n by (rule ProcRec1)\nqed\n\nlemma ProcBody:\n assumes WP: \"P \\ P'\"\n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> P' body Q,A\" \n assumes body: \"\\ p = Some body\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\Z. P'\" and Q=\"\\Z. Q\" and A=\"\\Z. A\"]) \napply (insert body)\napply simp\napply (rule hoare_augment_context [OF deriv_body])\napply blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\ p = Some body\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\=\\, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoarePartialProps.ProcModifyReturn \nlemmas ProcModifyReturnSameFaults = HoarePartialProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\nlemma ProcModifyReturnNoAbrSameFaults:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc: \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P}\"\n and Q'=\"\\Z. Q\" and A'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule DynCom)\napply clarsimp\napply (rule DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply (rule CatchSwap)\napply (rule SeqSwap)\napply (rule Throw) \napply (rule subset_refl)\napply (rule Basic)\napply (rule subset_refl)\napply (rule_tac R=\"{i. i \\ P' Z Z'}\" in Seq)\napply (rule Basic) \napply clarsimp\napply simp\napply (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply clarsimp\napply simp\napply clarsimp\napply (rule_tac P'=\"\\Z''. {t. t=Z'' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z''. Q\" and A'=\"\\Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply clarsimp\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc': \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t \\ Q' s Z. return s t \\ R s t) \\\n (\\t \\ A' s Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n from adapt have \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n by blast\n from this c p show ?thesis\n by (rule DynProc)\nqed\n\n\nlemma DynProcStaticSpec: \nassumes adapt: \"P \\ {s. s \\ S \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\s\\S. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from adapt have P_S: \"P \\ S\"\n by blast\n have \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ S) (dynCall init p return c) Q,A\"\n apply (rule DynProc [where P'=\"\\s Z. P' Z\" and Q'=\"\\s Z. Q' Z\" \n and A'=\"\\s Z. A' Z\", OF _ c])\n apply clarsimp\n apply (frule in_mono [rule_format, OF adapt])\n apply clarsimp\n using spec\n apply clarsimp\n done\n thus ?thesis\n by (rule conseqPre) (insert P_S,blast)\nqed\n\n\nlemma DynProcProcPar: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n using spec\n apply simp\n done\n\n\nlemma DynProcProcParNoAbrupt: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof - \n have \"P \\ {s. p s = q \\ (\\ Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ {} \\ return s t \\ A))}\"\n (is \"P \\ ?P'\")\n proof \n fix s\n assume P: \"s\\P\"\n with adapt obtain Z where\n Pre: \"p s = q \\ init s \\ P' Z\" and\n adapt_Norm: \"\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\\" \n by blast\n from adapt_Norm \n have \"\\t. t \\ Q' Z \\ return s t \\ R s t\"\n by auto\n then\n show \"s\\?P'\"\n using Pre by blast\n qed\n note P = this\n show ?thesis\n apply -\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n apply (insert spec)\n apply auto\n done\nqed\n\n\nlemma DynProcModifyReturnNoAbr: \n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then \n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturn)\nqed\n\n\nlemma ProcDynModifyReturnNoAbrSameFaults: \n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturnSameFaults)\nqed\n\n\nlemma ProcProcParModifyReturn: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n --{* @{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it. *}\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturn) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n --{* @{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it. *}\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call q (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnNoAbr: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n --{* @{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it. *}\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma ProcProcParModifyReturnNoAbrSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n --{* @{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it. *}\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \n \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma MergeGuards_iff: \"\\,\\\\\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip': \n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n from deriv_strip_triv have deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n by (auto intro: hoare_augment_context)\n from deriv_strip [simplified c'']\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n by (rule MarkGuardsD)\n with deriv \n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P c' Q,A\"\n by (rule CombineStrip)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n by (rule MarkGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n by (rule MergeGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n by (simp add: c)\n thus ?thesis\n by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'': \n assumes deriv: \"\\,\\\\\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\n apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c]) \n apply (insert c'')\n apply (subgoal_tac \"- {True} = {False}\")\n apply auto\n done\n\nlemma AsmUN:\n \"(\\Z. {(P Z, p, Q Z,A Z)}) \\ \\ \n \\ \n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n by (blast intro: hoarep.Asm)\n\nlemma augment_context': \n \"\\\\ \\ \\'; \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \n \\ \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_augment_context)\n\n\nlemma hoarep_strip: \n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z); F' \\ -F\\ \\ \n \\Z. strip F' \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_strip_\\)\n\nlemma augment_emptyFaults:\n \"\\\\Z. \\,{}\\\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI)\n\nlemma PostConjI' :\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]: \n assumes conj: \"\\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\" \n assumes E: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ S\"\n shows \"S\"\nproof -\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n moreover\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n ultimately show \"S\" \n by (rule E)\nqed\n\n\nsubsection {* Rules for Single-Step Proof \\label{sec:hoare-isar} *}\n\ntext {*\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar. \n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates. Reversed order is supported as well.\n*}\n\nlemma annotateI [trans]:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A; c = anno\\ \\ \\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\" \n by simp\n\nlemma annotate_normI:\n assumes deriv_anno: \"\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A\" \n assumes norm_eq: \"normalize c = normalize anno\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n from NormalizeI [OF deriv_anno] norm_eq\n have \"\\,\\\\\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n by simp\n from NormalizeD [OF this]\n show ?thesis .\nqed\n\nlemma annotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\ P \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P' c Q,A\"\n by (rule conseqPre)\n \nlemma [trans]: \"Q \\ Q' \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q',A\"\n by (rule conseqPost) blast+\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ (\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"(\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ (\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [trans]:\n \"(\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [intro?]: \"\\,\\\\\\<^bsub>/F\\<^esub> P Skip P,A\"\n by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond) auto\n \nlemma CondConj [trans, intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ \\ b s} c2 Q,A\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n by (rule Cond) auto\n \nlemma WhileInvInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b P V c) (P \\ -b),A\"\n by (rule While) auto\n\nlemma WhileInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A \n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b {s. undefined} V c) (P \\ -b),A\"\n by (unfold whileAnno_def) \n (rule HoarePartialDef.While [THEN conseqPrePost],auto)\n\nlemma WhileInvConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. P s} V c) {s. P s \\ \\ b s},A\"\n by (simp add: While Collect_conj_eq Collect_neg_eq)\n\nlemma WhileConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\ \n\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. undefined} V c) {s. P s \\ \\ b s},A\"\n by (unfold whileAnno_def) \n (simp add: HoarePartialDef.While [THEN conseqPrePost] \n Collect_conj_eq Collect_neg_eq)\n\n(* FIXME: Add rules for guarded while *)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/HoarePartial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.27783654677291364}} {"text": "theory SINVAR_DomainHierarchyNG_impl\nimports SINVAR_DomainHierarchyNG \"../TopoS_Interface_impl\"\nbegin\n\n\nsubsubsection {* SecurityInvariant DomainHierarchy List Implementation *}\n\ncode_identifier code_module SINVAR_DomainHierarchyNG_impl => (Scala) SINVAR_DomainHierarchyNG\n\nfun sinvar :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ bool\" where\n \"sinvar G nP = (\\ (s, r) \\ set (edgesL G). (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s))\"\n\n\ndefinition DomainHierarchyNG_sanity_check_config :: \"domainNameTrust list \\ domainTree \\ bool\" where\n \"DomainHierarchyNG_sanity_check_config host_attributes tree = (\\ c \\ set host_attributes.\n case c of Unassigned \\ True\n | DN (level, trust) \\ valid_hierarchy_pos tree level\n )\"\n\nfun verify_globals :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ domainTree \\ bool\" where\n \"verify_globals G nP tree = (\\ v \\ set (nodesL G). \n case (nP v) of Unassigned \\ True | DN (level, trust) \\ valid_hierarchy_pos tree level\n )\"\n\n(*TODO: to get rid of verify_globals\n this stronger DomainHierarchyNG_sanity_check_config sanity checker checks the config\n for all graphs!*)\nlemma \"DomainHierarchyNG_sanity_check_config c tree \\\n {x. \\v. nP v = x} = set c \\\n verify_globals G nP tree\"\n apply(simp add: DomainHierarchyNG_sanity_check_config_def split: if_split_asm)\n apply(clarify)\n apply(case_tac \"nP v\")\n apply(simp_all)\n apply(clarify)\n by force\n\n\ndefinition DomainHierarchyNG_offending_list:: \"'v list_graph \\ ('v \\ domainNameTrust) \\ ('v \\ 'v) list list\" where\n \"DomainHierarchyNG_offending_list G nP = (if sinvar G nP then\n []\n else \n [ [e \\ edgesL G. case e of (s,r) \\ \\ (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s) ] ])\"\n\n\n\nlemma \"DomainHierarchyNG.node_props P = \n (\\i. case node_properties P i of None \\ SINVAR_DomainHierarchyNG.default_node_properties | Some property \\ property)\"\nby(fact SecurityInvariant.node_props.simps[OF TopoS_DomainHierarchyNG, of \"P\"])\n\ndefinition \"NetModel_node_props P = (\\ i. (case (node_properties P) i of Some property \\ property | None \\ SINVAR_DomainHierarchyNG.default_node_properties))\"\n(*\n\n(*TODO does this work?*)\nlemma[code_unfold]: \"DomainHierarchyNG.node_props P = NetModel_node_props P\"\nby(simp add: NetModel_node_props_def)\n\ndefinition \"DomainHierarchyNG_eval G P = (wf_list_graph G \\\n sinvar G (SecurityInvariant.node_props SINVAR_DomainHierarchyNG.default_node_properties P))\"\n\n\ninterpretation DomainHierarchyNG_impl:TopoS_List_Impl \n where default_node_properties=SINVAR_DomainHierarchyNG.default_node_properties\n and sinvar_spec=SINVAR_DomainHierarchyNG.sinvar\n and sinvar_impl=sinvar\n and receiver_violation=SINVAR_DomainHierarchyNG.receiver_violation\n and offending_flows_impl=DomainHierarchyNG_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=DomainHierarchyNG_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(simp add: TopoS_DomainHierarchyNG list_graph_to_graph_def; fail)\n apply(rule conjI)\n apply(simp add: list_graph_to_graph_def DomainHierarchyNG_offending_set\n DomainHierarchyNG_offending_set_def DomainHierarchyNG_offending_list_def; fail)\n apply(rule conjI)\n apply(simp only: NetModel_node_props_def)\n apply(metis DomainHierarchyNG.node_props.simps DomainHierarchyNG.node_props_eq_node_props_formaldef)\n apply(simp only: DomainHierarchyNG_eval_def)\n apply(intro allI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_DomainHierarchyNG])\n apply(simp add: list_graph_to_graph_def)\ndone\n\n\nsubsubsection {* DomainHierarchyNG packing *}\n definition SINVAR_LIB_DomainHierarchyNG :: \"('v::vertex, domainNameTrust) TopoS_packed\" where\n \"SINVAR_LIB_DomainHierarchyNG \\ \n \\ nm_name = ''DomainHierarchyNG'', \n nm_receiver_violation = SINVAR_DomainHierarchyNG.receiver_violation,\n nm_default = SINVAR_DomainHierarchyNG.default_node_properties, \n nm_sinvar = sinvar,\n nm_offending_flows = DomainHierarchyNG_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = DomainHierarchyNG_eval\n \\\"\n interpretation SINVAR_LIB_DomainHierarchyNG_interpretation: TopoS_modelLibrary SINVAR_LIB_DomainHierarchyNG \n SINVAR_DomainHierarchyNG.sinvar\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_DomainHierarchyNG_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\n\n\n\n\n\ntext {*Examples:*}\ndefinition example_TUM_net :: \"string list_graph\" where\n \"example_TUM_net \\ \\ nodesL=[''Gateway'', ''LowerSVR'', ''UpperSRV''], \n edgesL=[\n (''Gateway'',''LowerSVR''), (''Gateway'',''UpperSRV''), \n (''LowerSVR'', ''Gateway''),\n (''UpperSRV'', ''Gateway'')\n ] \\\"\nvalue \"wf_list_graph example_TUM_net\"\n\ndefinition example_TUM_config :: \"string \\ domainNameTrust\" where\n \"example_TUM_config \\ ((\\ e. default_node_properties)\n (''Gateway'':= DN (''ACD''--''AISD''--Leaf, 1),\n ''LowerSVR'':= DN (''ACD''--''AISD''--Leaf, 0),\n ''UpperSRV'':= DN (''ACD''--Leaf, 0)\n ))\"\n\ndefinition example_TUM_hierarchy :: \"domainTree\" where\n\"example_TUM_hierarchy \\ (Department ''ACD'' [\n Department ''AISD'' []\n ])\"\n\nvalue \"verify_globals example_TUM_net example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net example_TUM_config\"\n\ndefinition example_TUM_net_invalid where\n\"example_TUM_net_invalid \\ example_TUM_net\\edgesL := \n (''LowerSRV'', ''UpperSRV'')#(edgesL example_TUM_net)\\\"\n\nvalue \"verify_globals example_TUM_net_invalid example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net_invalid example_TUM_config\"\nvalue \"DomainHierarchyNG_offending_list example_TUM_net_invalid example_TUM_config\"\n\n\nhide_const (open) NetModel_node_props\n\nhide_const (open) sinvar \n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Security_Invariants/SINVAR_DomainHierarchyNG_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.27781417252126983}} {"text": "(* Title: HOL/Library/Rewrite.thy\n Author: Christoph Traut, Lars Noschinski, TU Muenchen\n\nProof method \"rewrite\" with support for subterm-selection based on patterns.\n*)\n\ntheory Rewrite\nimports Main\nbegin\n\nconsts rewrite_HOLE :: \"'a::{}\" (\"\\\")\n\nlemma eta_expand:\n fixes f :: \"'a::{} \\ 'b::{}\"\n shows \"f \\ \\x. f x\" .\n\nlemma rewr_imp:\n assumes \"PROP A \\ PROP B\"\n shows \"(PROP A \\ PROP C) \\ (PROP B \\ PROP C)\"\n apply (rule Pure.equal_intr_rule)\n apply (drule equal_elim_rule2[OF assms]; assumption)\n apply (drule equal_elim_rule1[OF assms]; assumption)\n done\n\nlemma imp_cong_eq:\n \"(PROP A \\ (PROP B \\ PROP C) \\ (PROP B' \\ PROP C')) \\\n ((PROP B \\ PROP A \\ PROP C) \\ (PROP B' \\ PROP A \\ PROP C'))\"\n apply (intro Pure.equal_intr_rule)\n apply (drule (1) cut_rl; drule Pure.equal_elim_rule1 Pure.equal_elim_rule2; assumption)+\n apply (drule Pure.equal_elim_rule1 Pure.equal_elim_rule2; assumption)+\n done\n\nML_file \"cconv.ML\"\nML_file \"rewrite.ML\"\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Library/Rewrite.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2777921560835902}} {"text": "(* Author: Lukas Bulwahn, TU Muenchen, 2009 *)\n\ntheory Execute\nimports FJSound\nbegin\n\nsection {* Executing FeatherweightJava programs *}\ntext {* We execute FeatherweightJava programs using the predicate compiler. *}\n\ncode_pred (modes: i => i => i => bool,\n i => i => o => bool as supertypes_of) subtyping .\n\nthm subtyping.equation\n\ntext {* The reduction relation requires that we inverse the @{term List.append} function.\nTherefore, we define a new predicate append and derive introduction rules. *}\n\ndefinition append where \"append xs ys zs = (zs = xs @ ys)\"\n\nlemma [code_pred_intro]: \"append [] xs xs\"\nunfolding append_def by simp\n\nlemma [code_pred_intro]: \"append xs ys zs \\ append (x#xs) ys (x#zs)\"\nunfolding append_def by simp\n\ntext {* With this at hand, we derive new introduction rules for the reduction relation: *}\n\nlemma rc_invk_arg': \"CT \\ ei \\ ei' \\ append el (ei # er) e' \\ append el (ei' # er) e'' \\\nCT \\ MethodInvk e m e' \\ MethodInvk e m e''\"\nunfolding append_def by simp (rule reduction.intros(6))\n\nlemma rc_new_arg': \"CT \\ ei \\ ei' \\ append el (ei # er) e \\ append el (ei' # er) e'\n ==> CT \\ New C e \\ New C e'\"\nunfolding append_def by simp (rule reduction.intros(7))\n\nlemmas [code_pred_intro] = reduction.intros(1-5)\n rc_invk_arg' rc_new_arg' reduction.intros(8)\n\ncode_pred (modes: i => i => i => bool, i => i => o => bool as reduce) reduction\nproof -\n case append\n from this show thesis\n unfolding append_def by (cases xa) fastforce+\nnext\n case reduction\n from reduction.prems show thesis\n proof (cases rule: reduction.cases)\n case r_field\n with reduction(1) show thesis by fastforce\n next\n case r_invk\n with reduction(2) show thesis by fastforce\n next\n case r_cast\n with reduction(3) show thesis by fastforce\n next\n case rc_field\n with reduction(4) show thesis by fastforce\n next\n case rc_invk_recv\n with reduction(5) show thesis by fastforce\n next\n case rc_invk_arg\n with reduction(6) show thesis\n unfolding append_def by fastforce\n next\n case rc_new_arg\n with reduction(7) show thesis\n unfolding append_def by fastforce\n next\n case rc_cast\n with reduction(8) show thesis by fastforce\n qed\nqed\n\nthm reduction.equation\n\ncode_pred reductions .\n\nthm reductions.equation\n\ntext {* We also make the class typing executable: this requires that\n we derive rules for @{term \"method_typing\"}. *}\n\ndefinition method_typing_aux\nwhere\n \"method_typing_aux CT m D Cs C = (\\ (\\Ds D0. mtype(CT,m,D) = Ds \\ D0 \\ Cs = Ds \\ C = D0))\"\n\nlemma method_typing_aux:\n \"(\\Ds D0. mtype(CT,m,D) = Ds \\ D0 \\ Cs = Ds \\ C = D0) = (\\ method_typing_aux CT m D Cs C)\"\nunfolding method_typing_aux_def by auto\n\nlemma [code_pred_intro]:\n \"mtype(CT,m,D) = Ds \\ D0 \\ Cs \\ Ds \\ method_typing_aux CT m D Cs C\"\nunfolding method_typing_aux_def by auto\n\nlemma [code_pred_intro]:\n \"mtype(CT,m,D) = Ds \\ D0 \\ C \\ D0 \\ method_typing_aux CT m D Cs C\"\nunfolding method_typing_aux_def by auto\n\ndeclare method_typing.intros[unfolded method_typing_aux, code_pred_intro]\n\ndeclare class_typing.intros[unfolded append_def[symmetric], code_pred_intro]\n\ncode_pred (modes: i => i => bool) class_typing\nproof -\n case class_typing\n from class_typing.cases[OF class_typing.prems, of thesis] this(1) show thesis\n unfolding append_def by fastforce\nnext\n case method_typing\n from method_typing.cases[OF method_typing.prems, of thesis] this(1) show thesis\n unfolding append_def method_typing_aux_def by fastforce\nnext\n case method_typing_aux\n from this show thesis\n unfolding method_typing_aux_def by auto\nqed\n\nsubsection {* A simple example *}\n\ntext {* We now execute a simple FJ example program: *}\n\nabbreviation A :: className\nwhere \"A == Suc 0\"\n\nabbreviation B :: className\nwhere \"B == 2\"\n\nabbreviation cPair :: className\nwhere \"cPair == 3\"\n\ndefinition classA_Def :: classDef\nwhere\n \"classA_Def = \\ cName = A, cSuper = Object, cFields = [], cConstructor = \\kName = A, kParams = [], kSuper = [], kInits = []\\, cMethods = []\\\"\n\ndefinition\n \"classB_Def = \\ cName = B, cSuper = Object, cFields = [], cConstructor = \\kName = B, kParams = [], kSuper = [], kInits = []\\, cMethods = []\\\"\n\nabbreviation ffst :: varName\nwhere\n \"ffst == 4\"\n\nabbreviation fsnd :: varName\nwhere\n \"fsnd == 5\"\n\nabbreviation setfst :: methodName\nwhere\n \"setfst == 6\"\n\nabbreviation newfst :: varName\nwhere\n \"newfst == 7\"\n\ndefinition classPair_Def :: classDef\nwhere\n \"classPair_Def = \\ cName = cPair, cSuper = Object,\n cFields = [\\ vdName = ffst, vdType = Object \\, \\ vdName = fsnd, vdType = Object \\],\n cConstructor = \\ kName = cPair, kParams = [\\ vdName = ffst, vdType = Object \\, \\ vdName = fsnd, vdType = Object \\], kSuper = [], kInits = [ffst, fsnd]\\ ,\n cMethods = [\\ mReturn = cPair, mName = setfst, mParams = [\\vdName = newfst, vdType = Object \\],\n mBody = New cPair [Var newfst, FieldProj (Var this) fsnd] \\]\\\"\n\ndefinition exampleProg :: classTable\n where \"exampleProg = (((%x. None)(A := Some classA_Def))(B := Some classB_Def))(cPair := Some classPair_Def)\"\n\n\nvalue \"exampleProg \\ classA_Def OK\"\nvalue \"exampleProg \\ classB_Def OK\"\nvalue \"exampleProg \\ classPair_Def OK\"\n\n\nvalues \"{x. exampleProg \\ MethodInvk (New cPair [New A [], New B []]) setfst [New B []] \\* x}\"\nvalues \"{x. exampleProg \\ FieldProj (FieldProj (New cPair [New cPair [New A [], New B []], New A []]) ffst) fsnd \\* x}\"\n\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/FeatherweightJava/Execute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2777921560835902}} {"text": "(* This file requires:\n\n - An Isabelle Snapshot from no earlier than October 5, 2007\n\n*)\n\n(*\n This contains occurence typing with:\n - variables as tests\n - eta-expansion\n*)\n\ntheory TypedSchemePreOr\nimports Nominal\n\nbegin\n\nML {*ResAtp.set_prover \"vampire\"*}\n(* ML {* ThmDeps.enable() *} *) \n\n\n(* datatype definitions *)\natom_decl name\n\n\ndatatype ty =\n Top | Int | TT | FF | Arr \"ty\" \"ty\" \"latent_eff\" (\"_ \\ _ : _\" [100,100] 100) | Union \"ty list\" \nand latent_eff = NE | Latent ty\n\nconstdefs\n\"BoolTy == Union [TT , FF]\"\n\nprimrec (unchecked perm_ty)\n \"pi\\(ty.Top) = ty.Top\"\n \"pi\\(ty.Int) = ty.Int\"\n \"pi\\(TT) = TT\"\n \"pi\\(FF) = FF\"\n \"pi\\(\\ \\ \\ : L) = ((pi\\\\) \\ (pi\\\\) : (pi\\L))\"\n \"pi\\(Union l) = Union (pi\\l)\" \n \"pi\\latent_eff.NE = latent_eff.NE\"\n \"pi\\(Latent S) = Latent (pi\\S)\"\n\ndeclare perm_ty.simps[eqvt]\n\nlemma perm_ty_latent_eff_ty_list[simp]:\n fixes pi ::\"name prm\"\n and \\ ::\"ty\"\n and Ts ::\"ty list\"\n and l ::\"latent_eff\"\n shows \"pi\\\\ = \\\" and \"pi\\l = l\" and \"pi\\Ts = Ts\"\n by (induct \\ and l rule: ty_latent_eff.inducts) auto\n\ninstance ty :: pt_name\nby intro_classes auto\n\ninstance ty :: fs_name\nby intro_classes (simp add: supp_def)\n\ninstance latent_eff :: pt_name\nby intro_classes auto\n\ninstance latent_eff :: fs_name\nby intro_classes (simp add: supp_def)\n\nfun\n size_ty :: \"ty \\ nat\" and\n size_le :: \"latent_eff \\ nat\" \nwhere \n \"size_ty (ty.Int) = 1\"\n| \"size_ty (TT) = 1\"\n| \"size_ty (FF) = 1\"\n| \"size_ty (Top) = 1\"\n| \"size_ty (Union []) = 1\"\n| \"size_ty (Union (t#ts)) = size_ty t + size_ty (Union ts)\"\n| \"size_ty (T1 \\ T2 : L) = (size_ty T1) + (size_ty T2) + (size_le L)\"\n| \"size_le (Latent L) = size_ty L\"\n| \"size_le (latent_eff.NE) = 1\"\n\nlemma size_ty_pos:\n \"size_ty T > 0\"\nproof (induct T )\n fix l\n show \"0 < size_ty (Union l)\" by (induct l) auto\nqed (auto)\n\nnominal_datatype eff = NE | TE \"ty\" \"name\" | VE \"name\" | TT | FF\n\nnominal_datatype builtin = Add1 | NumberP | BooleanP | Nott | ProcP\n\nnominal_datatype trm = \n Var \"name\"\n | App \"trm\" \"trm\"\n | Abs \"\\name\\trm\" \"ty\"\n | Iff \"trm\" \"trm\" \"trm\"\n | Num \"nat\"\n | Bool \"bool\"\n | BI \"builtin\"\n\nabbreviation\n \"lam\" :: \"name \\ ty \\ trm \\ trm\" (\"Lam [_:_]._\" [100,100,100] 100) where\n \"Lam[x:T].b \\ trm.Abs x b T\"\n\n(* lemmas about names, types, effects *)\n\nlemma trm_finite_supp:\n fixes x::\"trm\"\n shows \"finite ((supp x)::name set)\"\n using fs_name_class.axioms[of x] by simp\n\nlemma pt_trm_inst: \"pt TYPE(trm) TYPE(name)\" using pt_name_inst by auto\n\nlemma fs_trm_inst: \"fs TYPE(trm) TYPE(name)\" using fs_name_inst by auto\n\nlemma perm_ty_latent[simp]: \n fixes T::\"ty\"\n and le::\"latent_eff\"\n and pi::\"name prm\"\n shows \"pi\\le = le \\ pi\\T = T\"\n by simp\n\nlemma perm_ty: \n fixes T::\"ty\"\n and le::\"latent_eff\"\n and pi::\"name prm\"\n shows \"pi\\T = T\"\n by simp\n\nlemma perm_builtin[simp]: \n fixes e::\"builtin\"\n and pi::\"name prm\"\n shows \"pi\\e = e\"\n by (induct rule: builtin.weak_induct) (simp_all)\n\nlemma fresh_ty[simp]:\n fixes x::\"name\" \n and T::\"ty\"\n shows \"x\\T\"\n by (simp add: fresh_def supp_def)\n\nlemma fresh_latent_eff[simp]:\n fixes x::\"name\" \n and T::\"latent_eff\"\n shows \"x\\T\"\n by (simp add: fresh_def supp_def)\n\nlemma fresh_builtin[simp]:\n fixes x::\"name\" \n and b::\"builtin\"\n shows \"x\\b\"\n by (simp add: fresh_def supp_def)\n\nlemma supp_latent_eff_ty:\n fixes T::ty and le::latent_eff\n shows \" supp le = ({}::name set) \\ supp T = ({}::name set)\"\n by (simp add: supp_def)\n\ntext {* size of a term *}\n\ninstance trm :: size ..\n\nnominal_primrec\n \"size (Var x) = 1\"\n \"size (BI b) = 1\"\n \"size (Bool b) = 1\"\n \"size (Num b) = 1\"\n \"size (App t1 t2) = (max (size t1) (size t2)) + 1\"\n \"size (Iff t1 t2 t3) = (max (size t1) (max (size t2) (size t3))) + 1\"\n \"size (Lam [a:T].t) = (size t) + 1\"\n by (auto simp add: fresh_nat, finite_guess+, fresh_guess+)\n\nabbreviation\n \"smaller_than_abb\" :: \"trm \\ trm \\ bool\" (\"_ \\ _\" [80,80] 80)\nwhere \n \"a \\ b == size a < size b\"\n\ntext {* complete induction on terms *}\n\nlemma trm_comp_induct[consumes 0, case_names Var App Lam BI Num Bool Iff]:\n fixes P::\"'a::fs_name \\ trm \\ bool\"\n and t::\"trm\"\n and x::\"'a::fs_name\"\n assumes a1:\"!! n z. (!! x t. (t \\ Var n) \\ P x t) \\ P z (Var n)\"\n and a2:\"!! t1 t2 z. (!! x t. (t \\ App t1 t2) \\ P x t) \\ (!! x. P x t1) \\ (!! x . P x t2)\n \\ P z (App t1 t2)\"\n and a3:\"!! a b z T. \\a \\ z ; (!! x t. (t \\ Lam[a:T].b) \\ P x t)\\ \\ (!! x . P x b) \\ P z (Lam[a:T].b)\"\n and a4:\"!! b z. (!! x t. (t \\ BI b) \\ P x t) \\ P z (BI b)\"\n and a5:\"!! n z. (!! x t. (t \\ Num n) \\ P x t) \\ P z (Num n)\"\n and a6:\"!! b z. (!! x t. (t \\ Bool b) \\ P x t) \\ P z (Bool b)\"\n and a7:\"!! t1 t2 t3 z. (!! x t. t \\ (Iff t1 t2 t3) \\ P x t) \n \\ (!! x. P x t1) \\ (!! x . P x t2) \\ (!! x. P x t3) \\ P z (Iff t1 t2 t3)\"\n shows \"P x t\"\nproof (induct t arbitrary: x taking:\"(% t :: trm. size t)\" rule: measure_induct_rule)\n case (less s x) thus ?case\n -- \"This would go through automatically, but I'm skeptical of that sort of thing\"\n proof (nominal_induct s avoiding: x rule: trm.induct)\n case (Var v) thus ?case using a1 by auto\n next\n case (App t1 t2) thus ?case using a2 by auto\n next\n case (Abs a b T) thus ?case using a3 by auto\n next\n case (Iff t1 t2 t3) thus ?case using a7 by auto\n next\n case (BI b) thus ?case using a4 by auto\n next\n case (Num n) thus ?case using a5 by auto\n next\n case (Bool b) thus ?case using a6 by auto \n qed\nqed \n\n\ntext {* closed terms *}\n\nconstdefs\nfv :: \"trm \\ name set\"\nfv_def[simp]:\"fv e == ((supp e):: name set)\"\n\nconstdefs\n closed :: \"trm \\ bool\"\n closed_def: \"closed e == (fv e = {})\"\n\n\nlemma closed_lam: --\"A statement about the free variables of lam bodies\"\n assumes \"closed (Lam[x:T].b)\" (is \"closed ?e\")\n shows \"fv b <= {x}\"\n proof -\n have \"(supp ([x].b)::name set) = supp b - {x}\" \n using fs_name_class.axioms abs_fun_supp[of b x] pt_trm_inst at_name_inst by auto\n hence \"supp ?e = ((((supp b):: name set) - {x}) :: name set)\" using supp_latent_eff_ty trm.supp by simp\n thus ?thesis using prems closed_def by auto \n qed\n\nlemma closed_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"closed e \\ closed (pi\\e)\"\nproof -\n have A:\"(pi\\fv e) = fv (pi\\e)\" using pt_perm_supp[of pi e] at_name_inst pt_trm_inst by auto\n assume \"closed e\"\n hence \"fv e = {}\" using closed_def by simp\n hence \"(pi\\fv e) = {}\" using empty_eqvt[of pi] by auto\n hence \"closed (pi\\e)\" using A closed_def by auto\n thus ?thesis .\nqed \n\n\ntext {* capture-avoiding substitution *}\n\nconsts subst :: \"trm \\ name \\ trm \\ trm\" (\"_[_::=_]\" [100,100,100] 100)\n\nnominal_primrec\n \"(Var x)[y::=t'] = (if x=y then t' else (Var x))\"\n \"(App t1 t2)[y::=t'] = App (t1[y::=t']) (t2[y::=t'])\"\n \"x\\(y,t',T) \\ (Lam[x:T].t)[y::=t'] = Lam[x:T].(t[y::=t'])\"\n \"(Iff tst thn els)[y::=t'] = (Iff (tst[y::=t']) (thn[y::=t']) (els[y::=t']))\"\n \"(BI c)[y::=t'] = (BI c)\"\n \"(Num c)[y::=t'] = (Num c)\"\n \"(Bool c)[y::=t'] = (Bool c)\"\n by (finite_guess+, auto simp add: abs_fresh, fresh_guess+)\n\nlemma subst_eqvt[simp, eqvt]:\n fixes pi:: \"name prm\"\n and t1:: \"trm\"\n and t2:: \"trm\"\n and a :: \"name\"\n shows \"pi\\(t1[b::=t2]) = (pi\\t1)[(pi\\b)::=(pi\\t2)]\"\nby (nominal_induct t1 avoiding: b t2 rule: trm.induct)\n (auto simp add: perm_bij fresh_prod fresh_atm fresh_bij)\n\nlemma subst_rename[rule_format]: \n shows \"c\\t1 \\ (t1[a::=t2] = ([(c,a)]\\t1)[c::=t2])\"\nby (nominal_induct t1 avoiding: a c t2 rule: trm.induct)\n (auto simp add: calc_atm fresh_atm abs_fresh fresh_nat trm.inject perm_nat_def perm_bool)\n\n\nlemma forget: \n assumes a: \"a\\t1\"\n shows \"t1[a::=t2] = t1\"\n using a\nby (nominal_induct t1 avoiding: a t2 rule: trm.induct)\n (auto simp add: abs_fresh fresh_atm)\n\n\nlemma subst_removes_var:\n assumes \"e1[x::=e0] = e2\" and \"x \\ e0\"\n shows \"x \\ e2\"\n using prems\nproof (nominal_induct e1 avoiding: e0 x e2 rule: trm.induct)\n case (Var v e0' x' e2')\n thus ?case using at_fresh[of x' v] at_name_inst\n by (cases \"x' = v\") auto\nnext\n case App thus ?case by auto\nnext\n case Iff thus ?case by auto\nnext\n case BI thus ?case by auto\nnext\n case Num thus ?case by (auto simp add: fresh_nat)\nnext\n case (Bool b) thus ?case \n by (auto simp add: fresh_def supp_bool trm.supp)\nnext\n case (Abs v e1' T e0' x' e2')\n let ?body = \"(e1'[x'::=e0'])\"\n have a:\"finite ((supp ?body) :: name set)\" using fs_name1 by auto\n have f:\"x' \\ (e1'[x'::=e0'])\" using Abs by auto\n hence \"v \\ (x',e0',T)\" using Abs by auto\n hence \"(Abs v e1' T)[x'::=e0'] = Abs v (e1'[x'::=e0']) T\" by auto\n hence \"\\ = e2'\" using Abs by auto\n have \"v \\ x'\" using `v \\ x'` at_fresh[of v x'] at_name_inst by auto\n hence \"x' \\ v\" using at_fresh[of x' v] at_name_inst by auto\n have \"x' \\ T\" using fresh_def supp_latent_eff_ty by auto\n have \"x' \\ [v].(e1'[x'::=e0'])\" using `v ~= x'` fresh_abs_funI1[of ?body x' v ] pt_trm_inst at_name_inst a f by auto\n hence \"x' \\ Abs v (e1'[x'::=e0']) T\" using f trm.fresh Abs by auto\n thus ?case using Abs by auto\nqed\n \n\nlemma fv_lam:\n fixes name\n shows \"fv (Lam[name:T].body) = fv body - {name}\"\nproof -\n have sT:\"supp T = ({} :: name set)\" using supp_latent_eff_ty by auto\n have \"fv (Lam[name:T].body) = (supp ([name].body):: name set) \\ supp T\" using trm.supp by auto\n also have \"\\ = (supp ([name].body):: name set)\" using sT by auto\n also have \"\\ = supp body - ({name} :: name set)\" \n using abs_fun_supp[of body name] at_name_inst pt_trm_inst fs_name1[of body] by simp\n also have \"\\ = fv body - {name}\" by simp\n finally show \"fv (Lam[name:T].body) = fv body - {name}\" by simp\nqed\n\nlemma subst_closed:\n assumes \"e1[x::=e0] = e2\" and \"closed e0\"\n shows \"fv e2 <= fv e1\"\n using prems\nproof (nominal_induct e1 avoiding: e0 x e2 rule: trm.induct)\n case (Var v e0' x' e2')\n thus ?case using at_fresh[of x' v] at_name_inst closed_def\n by (cases \"x' = v\") auto\nnext\n case (App rator rand e0' x' e2')\n let ?subrator = \"rator[x'::=e0']\"\n let ?subrand = \"rand[x'::=e0']\"\n have a:\"e2' = App ?subrator ?subrand\" using App by simp\n have s1:\"fv ?subrator <= fv rator\" using App by simp\n have s2:\"fv ?subrand <= fv rand\" using App by simp\n have b:\"fv e2' = fv ?subrator \\ fv ?subrand\" using trm.supp App a by simp\n have d:\"fv (App rator rand) = fv rator \\ fv rand\" using trm.supp by simp\n show ?case using d s1 s2 b by auto\nnext\n case BI thus ?case by auto\nnext\n case Num thus ?case by (auto simp add: fresh_nat)\nnext\n case (Bool b) thus ?case \n by (auto simp add: fresh_def supp_bool trm.supp)\nnext\n case (Iff tst thn els e0' x' e2')\n let ?subtst = \"tst[x'::=e0']\"\n let ?subthn = \"thn[x'::=e0']\"\n let ?subels = \"els[x'::=e0']\"\n have a:\"e2' = Iff ?subtst ?subthn ?subels\" using Iff by simp\n have s1:\"fv ?subtst <= fv tst\" using Iff by simp\n have s2:\"fv ?subthn <= fv thn\" using Iff by simp\n have s3:\"fv ?subels <= fv els\" using Iff by simp\n have b:\"fv e2' = fv ?subtst \\ fv ?subthn \\ fv ?subels\" using trm.supp Iff a by auto\n have d:\"fv (Iff tst thn els) = fv tst \\ fv thn \\ fv els\" using trm.supp by auto\n show ?case using d s1 s2 s3 b by auto\nnext\n case (Abs name body T e0' x' e2')\n have aa:\"fv (body[x'::=e0']) \\ fv body\" using Abs by auto\n have a:\"fv (Lam[name:T].body) = fv body - {name}\" using fv_lam by simp\n have b:\"fv (Lam[name:T].(body[x'::=e0'])) = fv (body[x'::=e0']) - {name}\" using fv_lam by simp\n have \"name \\ (e0',T,x')\" using Abs by auto\n hence c:\"(Lam[name:T].(body[x'::=e0'])) = (Lam[name:T].(body))[x'::=e0']\" by simp\n hence d:\"fv e2' = fv (body[x'::=e0']) - {name}\" using b Abs by auto\n thus ?case using a aa by auto\nqed\n\n\nlemma subst_only_var_closed:\n assumes \"closed e0\" and \"fv e1 <= {x}\"\n shows \"closed (e1[x::=e0])\"\nproof -\n let ?e2 = \"(e1[x::=e0])\"\n have a:\"fv ?e2 <= {x}\" using prems subst_closed[of e1 x e0 ?e2] by auto\n have \"x \\ e0\" using prems fresh_def[of x e0] closed_def[of e0] by auto\n hence \"x \\ ?e2\" using subst_removes_var[of e1 x e0 ?e2] by auto\n hence b:\"x \\ fv ?e2\" using fresh_def[of x ?e2] closed_def[of ?e2] by auto\n from a b have \"fv ?e2 = {}\" by auto\n thus ?thesis using closed_def by simp\nqed\n\nlemma beta_closed_closed:\n assumes \"closed (Lam[x:T].b)\" and \"closed v\"\n shows \"closed (b[x::=v])\"\n using prems closed_lam subst_only_var_closed\n by auto\n\n\ntext {* values *}\n\n\ninductive values :: \"trm \\ bool\" (\"_ : values\" [80])\nwhere\n abs_value[simp]: \"Lam[x:t].b : values\"\n| bi_value[simp]: \"BI c : values\"\n| num_value[simp]: \"Num n : values\"\n| bool_value[simp]: \"Bool b : values\"\n\nequivariance values\n\nabbreviation\n \"in_values\" :: \"trm \\ bool\" (\"_ \\ values\" [100] 100) where\n \"e \\ values \\ (e : values)\"\n\nabbreviation\n \"not_in_values\" :: \"trm \\ bool\" (\"_ \\ values\" [100] 100) where\n \"e \\ values \\ (~ e : values)\"\n\nlemma not_false_eqvt:\n fixes pi :: \"name prm\"\n and t :: \"trm\"\n assumes a:\"t ~= trm.Bool False\" and b:\"t : values\"\n shows \"(pi\\t) ~= trm.Bool False\"\n using b a\n by induct (auto simp add: perm_bool)\n\ninductive_cases iff_value:\"Iff a b c : values\"\ninductive_cases app_value:\"App a b : values\"\ninductive_cases var_value:\"Var a : values\"\n\nnominal_inductive values by (simp add: abs_fresh)\n\ntext {* Typing Constants *}\n\nconsts\n \\\\<^isub>\\ :: \"builtin \\ ty\"\n\nnominal_primrec\n \"\\\\<^isub>\\ NumberP = (Top \\ BoolTy : Latent ty.Int)\"\n \"\\\\<^isub>\\ BooleanP = (Top \\ BoolTy : Latent BoolTy)\"\n \"\\\\<^isub>\\ ProcP = (Top \\ BoolTy : Latent (Union [] \\ Top : latent_eff.NE))\"\n \"\\\\<^isub>\\ Add1 = (ty.Int \\ ty.Int : latent_eff.NE)\"\n \"\\\\<^isub>\\ Nott = (Top \\ BoolTy : latent_eff.NE)\"\n by simp_all\n\nlemma delta_t_eqvt[eqvt]:\n fixes pi :: \"name prm\"\n shows \"pi \\ \\\\<^isub>\\ b = \\\\<^isub>\\ (pi \\ b)\"\n by (nominal_induct b rule: builtin.induct) auto\n\n\n(* Delta Function *)\n\nconsts\n \\ :: \"builtin \\ trm \\ trm option\"\n add1_fun :: \"trm \\ trm option\"\n nott_fun :: \"trm \\ trm option\"\n numberp_fun :: \"trm \\ bool\"\n booleanp_fun :: \"trm \\ bool\"\n procp_fun :: \"trm \\ bool\"\n procp_bi_fun :: \"builtin \\ bool\"\n\nnominal_primrec\n \"add1_fun (Num n) = Some (Num (n+1))\"\n \"add1_fun (Lam[x:ty].b) = None\"\n \"add1_fun (Iff a b c) = None\"\n \"add1_fun (App a b) = None\"\n \"add1_fun (Bool a) = None\"\n \"add1_fun (BI a) = None\"\n \"add1_fun (Var a) = None\"\n by (auto, finite_guess+, fresh_guess+)\n\nnominal_primrec\n \"nott_fun (Num n) = (Some (Bool False))\"\n \"nott_fun (Lam[x:ty].b) = (Some (Bool False))\"\n \"nott_fun (Iff a b c) = (Some (Bool False))\"\n \"nott_fun (App a b) = (Some (Bool False))\"\n \"nott_fun (Bool b) = Some (Bool (~b))\"\n \"nott_fun (BI a) = (Some (Bool False))\"\n \"nott_fun (Var a) = (Some (Bool False))\"\n by (auto, finite_guess+, fresh_guess+)\n \n\nnominal_primrec\n \"booleanp_fun (Bool b) = True\"\n \"booleanp_fun (Num n) = False\"\n \"booleanp_fun (Abs a b c) = False\"\n \"booleanp_fun (App a b) = False\"\n \"booleanp_fun (BI c) = False\"\n \"booleanp_fun (Var v) = False\"\n \"booleanp_fun (Iff a b c) = False\"\n by (auto, finite_guess+, fresh_guess+)\n\nnominal_primrec\n \"procp_fun (Bool b) = False\"\n \"procp_fun (Num n) = False\"\n \"procp_fun (Abs a b c) = True\"\n \"procp_fun (App a b) = False\"\n \"procp_fun (BI c) = True\"\n \"procp_fun (Var v) = False\"\n \"procp_fun (Iff a b c) = False\"\n by (auto, finite_guess+, fresh_guess+)\n\nnominal_primrec\n \"numberp_fun (Bool b) = False\"\n \"numberp_fun (Num n) = True\"\n \"numberp_fun (Abs a b c) = False\"\n \"numberp_fun (App a b) = False\"\n \"numberp_fun (BI c) = False\"\n \"numberp_fun (Var v) = False\"\n \"numberp_fun (Iff a b c) = False\"\n by (auto, finite_guess+, fresh_guess+)\n\nnominal_primrec\n \"\\ Add1 t = add1_fun t\"\n \"\\ Nott t = nott_fun t\"\n \"\\ BooleanP t = Some (Bool (booleanp_fun t))\"\n \"\\ NumberP t = Some (Bool (numberp_fun t))\"\n \"\\ ProcP t = Some (Bool (procp_fun t))\"\nby simp_all\n\n\nlemma delta_eqvt:\n fixes pi :: \"name prm\"\n and b :: builtin\n and t :: \"trm\"\n shows \"\\ (pi\\b) (pi\\t) = \\ b t\"\nproof -\n have A:\"(pi\\b) = b\" by (nominal_induct b rule: builtin.induct) auto\n have B:\"\\ b (pi\\t) = \\ b t\"\n proof (nominal_induct rule: builtin.induct)\n case Add1\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_nat_def) \n next\n case Nott\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case BooleanP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case NumberP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case ProcP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n qed\n from A B show ?thesis by auto\nqed\n\nlemma delta_eqvt2[eqvt]:\n fixes pi :: \"name prm\"\n and b :: builtin\n and t :: \"trm\"\n shows \"(pi\\(\\ b t)) = \\ (pi\\b) (pi\\t)\"\nproof -\n have A:\"(pi\\b) = b\" by (nominal_induct b rule: builtin.induct) auto\n have B:\"\\ b (pi\\t) = (pi\\(\\ b t))\"\n proof (nominal_induct rule: builtin.induct)\n case Add1\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_nat_def) \n next\n case Nott\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case BooleanP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case NumberP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n next\n case ProcP\n thus ?case \n by (nominal_induct t rule: trm.induct) (auto simp add: perm_bool)\n qed\n from A B show ?thesis by auto\nqed\n\n\nlemma delta_closed:\n fixes b :: builtin and t::trm\n assumes \"\\ b t = Some v\"\n shows \"closed v\"\n using prems\n proof (nominal_induct b rule: builtin.induct)\n case Add1\n thus ?case \n by (nominal_induct t rule: trm.induct)\n (auto simp add: supp_nat closed_def trm.supp)\n next\n case Nott\n thus ?case\n by (nominal_induct t rule: trm.induct)\n (auto simp add: supp_def perm_bool closed_def trm.supp)\n next\n case BooleanP\n thus ?case\n by (nominal_induct t rule: trm.induct)\n (auto simp add: supp_def perm_bool closed_def trm.supp)\n next\n case NumberP\n thus ?case\n by (nominal_induct t rule: trm.induct)\n (auto simp add: supp_def perm_bool closed_def trm.supp)\n next\n case ProcP\n thus ?case\n by (nominal_induct t rule: trm.induct)\n (auto simp add: supp_def perm_bool closed_def trm.supp)\n qed\n\nlemma delta_value:\n fixes b :: builtin and t::trm\n assumes \"\\ b t = Some v\"\n shows \"v : values\"\n using prems\n proof (nominal_induct b rule: builtin.induct)\n case Add1\n thus ?case by (nominal_induct t rule: trm.induct) auto\n next\n case Nott\n thus ?case\n by (nominal_induct t rule: trm.induct) auto\n next\n case BooleanP\n thus ?case\n by (nominal_induct t rule: trm.induct) auto\n next\n case NumberP\n thus ?case\n by (nominal_induct t rule: trm.induct) auto\n next\n case ProcP\n thus ?case\n by (nominal_induct t rule: trm.induct) auto\n qed\n\ntext {* Evaluation contexts *}\n\n\ninductive_set ctxt :: \"(trm \\ trm) set\"\nwhere\n C_Hole[simp, intro]: \"(%t. t) \\ ctxt\"\n| C_App1[simp, intro]: \"E : ctxt \\ (%t . (App (E t) u)) : ctxt\"\n| C_App2[simp, intro]: \"E : ctxt \\ v : values \\ (%t . (App v (E t))) : ctxt\"\n| C_Iff[simp, intro]: \"E : ctxt \\ (%t . (Iff (E t) thn els)) : ctxt\"\n\nlemma ctxt_compose:\n assumes a:\"E1 : ctxt\" and b:\"E2 : ctxt\"\n shows \"(%t. E1 (E2 t)) : ctxt\"\n using a b\n by (induct E1) auto\n\nconstdefs\n closed_ctxt :: \"(trm \\ trm) \\ bool\"\n closed_ctxt_def[simp]:\"closed_ctxt C == (C : ctxt \\ closed (C (Num 3)))\" --\"3 is a trivially closed term\"\n\nlemma ctxt_closed:\n assumes \"closed_ctxt C\" \n shows \"closed (C e) = closed e\"\n using prems\nproof -\n have \"C : ctxt\" using prems by simp\n thus ?thesis using prems\n by (induct) (auto simp add: closed_def trm.supp)\nqed \n \nlemma closed_in_ctxt_closed_ctxt:\n assumes \"closed e\" and a:\"C : ctxt\" and \"e = C L\"\n shows \"closed L \\ closed_ctxt C\"\n using a prems \n proof (induct C arbitrary: L e rule: ctxt.induct)\n case C_Hole\n thus ?case by (auto simp add: closed_def trm.supp supp_nat)\n next\n case (C_App1 E arg L' e')\n have IH:\"!!e L. \\closed e; E \\ ctxt; e = E L\\ \\ closed L \\ closed_ctxt E\" using prems by blast\n have cl:\"closed (App (E L') arg)\" using `e' = (App (E L') arg)` `closed e'` by simp\n from cl have \"closed arg\"by (auto simp add: closed_def trm.supp)\n from cl have \"closed (E L')\" by (auto simp add: closed_def trm.supp)\n thus ?case using IH[of \"(E L')\" L'] `E : ctxt` `closed arg`\n by (auto simp add: trm.supp closed_def)\n next\n case (C_App2 E rator L' e')\n have IH:\"!!e L. \\closed e; E \\ ctxt; e = E L\\ \\ closed L \\ closed_ctxt E\" using prems by blast\n have cl:\"closed (App rator (E L'))\" using prems by blast\n from cl have \"closed rator\" by (auto simp add: closed_def trm.supp)\n from cl have \"closed (E L')\" by (auto simp add: closed_def trm.supp)\n thus ?case using IH[of \"(E L')\" L'] `E : ctxt` `closed rator`\n by (auto simp add: trm.supp closed_def)\n next\n case (C_Iff E thn els L' e')\n let ?trm = \"Iff (E L') thn els\"\n have IH:\"!!e L. \\closed e; E \\ ctxt; e = E L\\ \\ closed L \\ closed_ctxt E\" using prems by blast\n have cl:\"closed ?trm\" using prems by blast\n from cl have \"closed thn\" and \"closed els\" by (auto simp add: closed_def trm.supp)\n from cl have \"closed (E L')\" by (auto simp add: closed_def trm.supp)\n thus ?case using IH[of \"(E L')\" L'] `E : ctxt` `closed thn` `closed els`\n by (auto simp add: trm.supp closed_def)\n qed\n\nlemma closed_in_ctxt:\n assumes \"closed (C L)\"\n and \"C : ctxt\"\n shows \"closed L\"\n using `C : ctxt` `closed (C L)`\n by (induct C) (auto simp add: closed_def trm.supp)\n\n\ntext{* Reduction *}\n\ninductive reduce :: \"trm \\ trm \\ bool\" (\"_ \\ _\" [200,200] 200)\n where\n e_beta[simp]: \"v : values \\ x \\ v \\ (App (Lam[x:t].b) v) \\ (b[x::=v])\"\n | e_if_false[simp]: \"Iff (Bool False) e1 e2 \\ e2\"\n | e_if_true[simp]: \"v ~= Bool False \\ v : values \\ Iff v e1 e2 \\ e1\"\n | e_delta[simp]: \"\\v : values; \\ p v = Some e\\ \\ App (BI p) v \\ e\"\n\nequivariance reduce\n\nnominal_inductive reduce\n by (simp_all add: abs_fresh subst_removes_var)\n\ninductive\n \"step\" :: \"trm\\trm\\bool\" (\" _ \\ _\" [80,80]80)\nwhere\n step_one[intro]:\"\\E : ctxt; L \\ R\\ \\ E L \\ E R\"\n\ninductive\nstep_multi :: \"trm \\ trm \\ bool\" (\" _ \\\\<^sup>* _\" [80,80] 80)\nwhere \n sm_refl:\"a \\\\<^sup>* a\"\n| sm_trans:\"a \\ b \\ b \\\\<^sup>* c \\ a \\\\<^sup>* c\"\n\n(* doesn't work *)\n(* equivariance step *)\n\n\nconstdefs\nreduce_forever :: \"trm \\ bool\"\n\"reduce_forever e == \\e' . (e \\\\<^sup>* e') \\ (EX e''. e' \\ e'')\"\n\n\n(* reduction examples *)\n\n\nlemma \"(App (Lam [x:t].(Var x)) (Num 4)) \\ Num 4\"\n proof -\n have \"Num 4 : values\" \"x \\ Num 4\" by (auto simp add: fresh_nat)\n hence h:\"(App (Lam [x:t].(Var x)) (Num 4)) \\ ((Var x)[x::=(Num 4)])\" by (rule e_beta)\n have \"((Var x)[x::=(Num 4)]) = Num 4\" by auto\n thus ?thesis using h by auto\n qed\n\n(* some lemmas about reduction *)\n\n\nlemma if_val_reduces: \n assumes a:\"tst : values\"\n shows \"Iff tst thn els \\ thn \\ Iff tst thn els \\ els\"\n using a\nproof (nominal_induct tst rule: trm.induct)\n case (Bool b) \n thus ?case using e_if_true e_if_false\n by (cases b) (auto simp add: trm.inject)\nqed (auto)\n\n(* a helper lemma - whee abstraction *)\nlemma ex_help: \n assumes a:\"e = E t \\ E : ctxt \\ t \\ t'\"\n shows \"\\E t t' . e = E t \\ E \\ ctxt \\ t \\ t'\"\n using a by blast\n\nlemma reduce_in_ctxt:\n fixes e :: trm\n assumes ct:\"C : ctxt\"\n and ih:\"(EX E L R. e = E L \\ E : ctxt \\ L \\ R)\"\n shows \"(EX E L R. C e = E L \\ E : ctxt \\ L \\ R)\"\nproof -\n from ih ct obtain Enew tnew t'new where \"e = Enew tnew\" and 1:\"Enew \\ ctxt\" and g1:\"tnew \\ t'new\" by auto\n let ?E=\"(%t . C (Enew t))\"\n have g3:\"?E tnew = C e\" using `e = Enew tnew` by auto\n thus \"\\E t t' . C e = E t \\ E \\ ctxt \\ t \\ t'\"\n using ctxt_compose[OF ct 1] g1 g3 ex_help[of \"C e\" ?E tnew] by auto\nqed\n\ninductive_cases iff_bi_red : \"(Iff (Const (BI bi)) thn els) \\ e\"\ninductive_cases iff_red : \"(Iff tst thn els) \\ e\"\n\nlemma reduce_closed:\n assumes \"closed L\" and \"L \\ R\"\n shows \"closed R\"\n using `L \\ R` `closed L`\n proof (induct)\n case (e_beta v x t b) \n have a:\"closed (Abs x b t)\" using e_beta closed_def trm.supp by simp\n have b:\"closed v\" using e_beta closed_def trm.supp by simp\n from a b show ?case using e_beta beta_closed_closed by simp\n next\n case e_if_true thus ?case using closed_def trm.supp by auto\n next\n case e_if_false thus ?case using closed_def trm.supp by auto\n next\n case e_delta thus ?case using delta_closed by auto\n qed\n\n\nlemma step_closed:\n assumes A:\"closed e\" and B:\"(e :: trm) \\ e'\"\n shows \"closed e'\"\nproof - \n from B obtain E L R where C:\"E : ctxt\" \"e = E L\" \"L \\ R\" \"e' = E R\" by induct auto\n hence D:\"closed L\" \"closed_ctxt E\" using A closed_in_ctxt_closed_ctxt[of e E L] by auto\n hence \"closed R\" using C reduce_closed[of L R] by auto\n hence \"closed e'\" using C D ctxt_closed[of E R] by auto\n thus ?thesis .\nqed\n\nlemma multi_step_closed:\n assumes A:\"closed e\" and B:\"e \\\\<^sup>* e'\"\n shows \"closed e'\"\n using B A step_closed\n by induct auto\n \n\n\n\ntext {* \"partial order\" (not really) between effects *}\n\ninductive\n subeff :: \"eff \\ eff \\ bool\"(\"\\ _ F TT \\ \\ FF FF \\ \\ TT NE NE F1 eff.NE F1 eff.TT F1 eff.FF \\ T \\ T = FF\"\n by (induct rule: subeff.induct) auto\n\nlemma no_sub_TT: \n \"\\\\ T \\ T = TT\"\n by (induct rule: subeff.induct) auto\n\nconstdefs\n simple_eff :: \"eff \\ bool\"\n simple_eff_def[simp]:\"simple_eff e == e = eff.NE \\ e = FF \\ e = TT\"\n\nlemma simple_eff_cases[consumes 1, case_names NE FF TT]:\n fixes F::eff\n and P :: \"eff \\ bool\"\n assumes a:\"simple_eff F\"\n and a1:\"P NE\"\n and a2:\"P FF\"\n and a3:\"P TT\"\n shows \"P F\"\n using prems\nby (nominal_induct F rule: eff.induct) auto\n\nlemma simple_eff_below_ne:\n assumes \"simple_eff F\"\n shows \"\\ F F1 F2 F1 ty \\ bool\" (\"\\ _ <: _\" [60,60] 60)\nwhere\n S_Refl[intro]: \"\\ T <: T\"\n| S_Fun[intro]: \"\\\\ S1 <: T1 ; \\ T2 <: S2 ; eff = eff' \\ eff' = latent_eff.NE\\ \\ \\ (T1 \\ T2 : eff) <: (S1 \\ S2 : eff')\"\n| S_Top[intro]: \"\\ T <: Top\"\n| S_UnionAbove[intro]: \"\\T : set Ts ; \\ S <: T\\ \\ \\ S <: Union Ts\"\n| S_UnionBelow[intro]: \"\\!! T.( T : set Ts \\ \\ T <: S)\\ \\ \\ Union Ts <: S\"\n\nequivariance subtype\n\nnominal_inductive subtype done\n\n\ninductive_cases sub_arr_cases: \"\\ T <: S1 \\ S2 : L\"\n\nlemma subtype_arr_elim:\n \"\\\\ T <: S ; S = S0 \\ S1 : le\\ \\ (EX T0 T1. T = T0 \\ T1 : le \\ \\ S0 <: T0 \\ \\ T1 <: S1) \\ (EX T0 T1 le'. T = T0 \\ T1 : le' \\ le = latent_eff.NE \\ \\ S0 <: T0 \\ \\ T1 <: S1) \\ (EX Ts. T = Union Ts)\"\nproof (induct arbitrary: S0 S1 rule: subtype.induct)\n qed (auto)\n\nlemma S_TopE:\n assumes a: \"\\ Top <: T\"\n shows \"T = Top \\ (EX Ts T'. T = Union Ts \\ T' : set Ts \\ \\ Top <: T')\"\nusing a by (cases, auto) \n\nlemma S_ArrowE_left:\n assumes a: \"\\ S\\<^isub>1 \\ S\\<^isub>2 : L <: T\" \n shows \"T = Top \\ (\\T\\<^isub>1 T\\<^isub>2. T = T\\<^isub>1 \\ T\\<^isub>2 : L \\ \\ T\\<^isub>1 <: S\\<^isub>1 \\ \\ S\\<^isub>2 <: T\\<^isub>2) \\ \n (\\T\\<^isub>1 T\\<^isub>2. T = T\\<^isub>1 \\ T\\<^isub>2 : latent_eff.NE \\ \\ T\\<^isub>1 <: S\\<^isub>1 \\ \\ S\\<^isub>2 <: T\\<^isub>2) \\\n (EX Ts T1. T = Union Ts \\ T1 : set Ts \\ \\ S\\<^isub>1 \\ S\\<^isub>2 : L <: T1)\"\nusing a by (cases, auto simp add: ty.inject)\n\nlemma union_size_ty:\n assumes \"T : set Ts\"\n shows \"size_ty T < size_ty (Union Ts)\"\n using prems size_ty_pos\n by (induct Ts) auto\n\nfun size_ty3 :: \"ty*ty*ty \\ nat\"\nwhere \nsize_ty3_def[simp]:\"size_ty3 (a,b,c) = size_ty a + size_ty b + size_ty c\"\n\ninductive_cases union_sub_cases[consumes 1, case_names 1 2 3 4]:\"\\ Union Ts <: S\"\n\nlemma union_sub_elim: \n assumes A:\"\\ Union Ts <: T \" (is \"\\ ?S <: T\") \n and B:\" T1 : set Ts \"\n shows \"\\ T1 <: T\"\n using prems\nproof (induct \"X\"==\"(T1,?S,T)\" arbitrary: T1 Ts T taking: \"size_ty3\" rule: measure_induct_rule)\n case (less X)\n show \" \\ T1 <: T\" using `\\ Union Ts <: T` less \n proof (induct rule: union_sub_cases)\n case 1 thus ?case by auto\n next\n case 2 thus ?case by auto\n next\n case (3 T' Ts')\n have X_inst:\"X = (T1, ty.Union Ts, T)\" .\n have \"size_ty T' < size_ty T\" using 3 union_size_ty by auto\n hence \"\\ T1 <: T'\" using X_inst 3(4)[OF _ ` \\ ty.Union Ts <: T'` `T1 : set Ts`] by auto\n thus ?case using 3 by auto\n next\n case 4 thus ?case by auto\n qed\nqed\n\n\nlemma S_Trans[intro]:\n assumes \"\\S<:Q\" and \" \\Q<:T\"\n shows \"\\S<:T\" \nusing prems\nproof (induct \"X\"==\"(S,Q,T)\" arbitrary: S Q T taking: \"size_ty3\" rule: measure_induct_rule)\n case (less X S Q T)\n show \" \\ S <: T\" using `\\ S <: Q` less \n proof (induct S Q\\Q rule: subtype.induct) \n case S_Refl thus ?case by auto\n next\n case (S_Top A)\n have X_inst:\"X = (A,Q,T)\" .\n show ?case \n proof -\n {\n\tassume \"EX Ts T'. T = Union Ts \\ T' : set Ts \\ \\ Q <: T'\"\n\tthen obtain Ts T' where \"T = Union Ts \"\" T' : set Ts \"\" \\ Q <: T'\" by auto\n\thence \"size_ty T' < size_ty T\" using union_size_ty by auto\n\thence \"size_ty3 (A,Q,T') < size_ty3 (A,Q,T)\" by auto\n\thence \"\\ A <: T'\" using `\\ A <: Q` `\\ Q <: T'` using less(1)[of \"(A,Q,T')\" A Q T'] X_inst by auto\n\thence ?thesis using S_Top prems by auto\n }\n thus ?thesis using S_TopE S_Top by auto\n qed\n next\n case (S_Fun Q1 S1 S2 Q2 L L') \n hence rh_drv: \" \\ Q1 \\ Q2 : L' <: T\" by simp\n have X_inst:\"X = (S1 \\ S2 : L, Q1 \\ Q2 : L', T)\" using S_Fun by auto\n note `Q1 \\ Q2 : L' = Q` \n hence Q12_less: \"size_ty Q1 < size_ty Q\" \"size_ty Q2 < size_ty Q\" using size_ty_pos by auto\n have lh_drv_prm1: \" \\ Q1 <: S1\" by fact\n have lh_drv_prm2: \" \\ S2 <: Q2\" by fact \n have \"T=Top \\ (\\T1 T2 LL. T=T1\\T2 : LL \\ \\T1<:Q1 \\ \\Q2<:T2 \\ LL = L') \\ \n (\\T1 T2. T=T1\\T2 : latent_eff.NE \\ \\T1<:Q1 \\ \\Q2<:T2) \\\n (EX Ts T1. T = Union Ts \\ T1 : set Ts \\ \\ Q1 \\ Q2 : L' <: T1)\" \n using S_ArrowE_left[OF rh_drv] by auto\n moreover\n { \n assume \"\\T1 T2 LL. T=T1\\T2:LL \\ \\T1<:Q1 \\ \\Q2<:T2 \\ LL = L'\"\n then obtain T1 T2 LL\n\twhere T_inst: \"T = T1 \\ T2 : L'\" \n\tand rh_drv_prm1: \" \\ T1 <: Q1\"\n\tand rh_drv_prm2: \" \\ Q2 <: T2\"\n\tand LL': \"LL = L'\" by auto\n from X_inst T_inst have X_inst':\"X = (S1 \\ S2 : L, Q1 \\ Q2 : L', T1 \\ T2 : L')\" by simp\n hence \"size_ty3 (T1, Q1, S1) < size_ty3 X\" using size_ty_pos by auto \n from X_inst' lh_drv_prm1 rh_drv_prm1 have \" \\ T1 <: S1\" using S_Fun(6)[of _ T1 Q1 S1] size_ty_pos by auto\n moreover\n from X_inst' lh_drv_prm2 rh_drv_prm2 have \" \\ S2 <: T2\" using S_Fun(6)[of _ S2 Q2 T2] size_ty_pos by auto\n ultimately have \" \\ S1 \\ S2 : L <: T1 \\ T2 : LL\" using LL' S_Fun by (simp add: subtype.S_Fun)\n hence \" \\ S1 \\ S2 : L <: T\" using T_inst LL' by simp\n }\n moreover \n { \n assume \"EX Ts T1. T = Union Ts \\ T1 : set Ts \\ \\ Q1 \\ Q2 : L' <: T1\"\n then obtain Ts T1\n\twhere T_inst: \"T = Union Ts\"\n\tand elem: \"T1 : set Ts\"\n\tand sub:\"\\ Q1 \\ Q2 : L' <: T1\"\n\tby auto\n have sub':\"\\ S1 \\ S2 : L <: Q1 \\ Q2 : L'\" using S_Fun by simp\n have sz:\"size_ty T1 < size_ty T\" using T_inst elem union_size_ty by auto\n from X_inst T_inst have X_inst':\"X = (S1 \\ S2 : L, Q1 \\ Q2 : L', Union Ts)\" by simp\n from sub sub' X_inst' \n have \" \\ S1 \\ S2 : L <: T1\" using S_Fun(6)[OF _ sub' sub] sz T_inst by auto\n hence \" \\ S1 \\ S2 : L <: T\" using T_inst elem S_UnionAbove by auto \n }\n moreover\n {\n assume \"\\T1 T2. T=T1\\T2:latent_eff.NE \\ \\T1<:Q1 \\ \\Q2<:T2 \"\n then obtain T1 T2 LL\n\twhere T_inst: \"T = T1 \\ T2 : latent_eff.NE\" \n\tand rh_drv_prm1: \" \\ T1 <: Q1\"\n\tand rh_drv_prm2: \" \\ Q2 <: T2\"\n\t by auto\n from X_inst T_inst have X_inst':\"X = (S1 \\ S2 : L, Q1 \\ Q2 : L', T1 \\ T2 : latent_eff.NE)\" by simp\n hence \"size_ty3 (T1, Q1, S1) < size_ty3 X\" using size_ty_pos by auto \n from X_inst' lh_drv_prm1 rh_drv_prm1 have \" \\ T1 <: S1\" using S_Fun(6)[of _ T1 Q1 S1] size_ty_pos by auto\n moreover\n from X_inst' lh_drv_prm2 rh_drv_prm2 have \" \\ S2 <: T2\" using S_Fun(6)[of _ S2 Q2 T2] size_ty_pos by auto\n ultimately have \" \\ S1 \\ S2 : L <: T1 \\ T2 : latent_eff.NE\" using S_Fun by (simp add: subtype.S_Fun)\n hence \" \\ S1 \\ S2 : L <: T\" using T_inst by simp\n }\n ultimately show \" \\ S1 \\ S2 : L <: T\" by blast\n next\n case (S_UnionAbove T1 Ts S)\n have sub1:\"\\ S <: T1\" .\n hence sub2:\"\\ T1 <: T\" using S_UnionAbove union_sub_elim[of Ts T T1] by auto\n have sz:\"size_ty T1 < size_ty Q\" using S_UnionAbove union_size_ty by auto\n hence \"\\ S <: T\" using S_UnionAbove(4)[OF _ sub1 sub2] sz S_UnionAbove(7) by auto\n thus ?case .\n next\n case (S_UnionBelow Ts S)\n have \"!! T0. T0 : set Ts \\ \\ T0 <: T\"\n proof -\n\tfix T0\n\tassume \"T0 : set Ts\"\n\thence sz:\"size_ty T0 < size_ty (Union Ts)\" using union_size_ty by auto\n\thave s1:\"\\ T0 <: S\" using S_UnionBelow `T0 : set Ts` by auto\n\thave s2:\"\\ S <: T\" using S_UnionBelow by auto\n\tnote S_UnionBelow(6)\n\tthus \"\\ T0 <: T\" using S_UnionBelow(3)[OF _ s1 s2] sz `S = Q` by auto\n qed\n thus ?case ..\n qed\nqed\n\n\ntext {* type environments *}\n\ntypes varEnv = \"(name*ty) list\"\n\ntext {* valid contexts *}\ninductive\n valid :: \"(name\\ty) list \\ bool\"\nwhere\n v1[intro]: \"valid []\"\n | v2[intro]: \"\\valid \\;a\\\\\\\\ valid ((a,\\)#\\)\"\n\nequivariance valid\n\nnominal_inductive valid done\n\nlemma fresh_context[rule_format]: \n fixes \\ :: \"(name\\ty)list\"\n and a :: \"name\"\n assumes a: \"a\\\\\"\n shows \"\\(\\\\::ty. (a,\\)\\set \\)\"\nusing a\nby (induct \\)\n (auto simp add: fresh_prod fresh_list_cons fresh_atm)\n\nlemma valid_elim: \n fixes \\ :: \"(name\\ty)list\"\n and pi:: \"name prm\"\n and a :: \"name\"\n and \\ :: \"ty\"\n shows \"valid ((a,\\)#\\) \\ valid \\ \\ a\\\\\"\nby (ind_cases \"valid ((a,\\)#\\)\") simp\n\nlemma valid_unicity[rule_format]: \n assumes a: \"valid \\\"\n and b: \"(c,\\)\\set \\\"\n and c: \"(c,\\)\\set \\\"\n shows \"\\=\\\" \nusing a b c\nby (induct \\) (auto dest!: valid_elim fresh_context)\n\ndeclare fresh_list_cons[simp]\ndeclare fresh_list_nil[simp]\n\n(* environment operations *)\n\nconsts \n env_plus :: \"eff \\ varEnv => varEnv\"\n env_minus :: \"eff \\ varEnv => varEnv\"\n\n(* original type is the SECOND argument *)\n\nconstdefs\nless_ty :: \"((ty * ty) * ty * ty) set\"\n\"less_ty == {((a,b),c,d) . (size_ty b) < (size_ty d)}\"\n\nfunction (sequential)\n restrict :: \"ty \\ ty \\ ty\"\nwhere\n restrict_union: \"restrict r (Union (ls :: ty list)) = \n (if (\\ r <: Union ls) then r else (if (\\ Union ls <: r) then (Union ls) else Union (map (restrict r) ls)))\"\n| restrict_top:\"restrict r Top = r\"\n| restrict_other:\"restrict r T = (if (\\ r <: T) then r else T)\"\n by pat_completeness auto\ntermination using union_size_ty\n by (relation \"measure (% (a,b). size_ty b)\") auto\n\nlemma restrict_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"pi\\(restrict T1 T2) = restrict (pi\\T1) (pi\\T2)\"\nby (induct T2) (auto)\n\ntext {* this is the key lemma in the whole soundness proof *}\n\nfun simple_ty :: \"ty \\ bool\"\nwhere\n \"simple_ty ty.Int = True\"\n| \"simple_ty ty.TT = True\"\n| \"simple_ty ty.FF = True\"\n| \"simple_ty (A1 \\ A2 : L) = True\"\n(* | \"simple_ty (Union [ty.TT,ty.FF]) = True\" *)\n| \"simple_ty T = False\"\n\nlemma ty_cases[consumes 0, case_names Top Int TT FF Arr Union]:\n fixes P :: \"ty \\ bool\"\n and T :: ty\n assumes a1:\"P Top\"\n and a2:\"P ty.Int\"\n and a3:\"P ty.TT\"\n and a3':\"P ty.FF\"\n and a4:\"!! t1 t2 L. P (t1 \\ t2 : L)\"\n and a5:\"!! Ts . P (Union Ts)\"\n shows \"P T\"\n using ty_latent_eff.induct[of P \"(%e . True)\" \"(%e . True)\" T] prems\n by auto\n\ninductive_cases tt_below_union: \"\\ ty.TT <: ty.Union Ts\"\ninductive_cases ff_below_union: \"\\ ty.FF <: ty.Union Ts\"\n\n(* I believe this to be true without C, but it's easier to prove this way, and that's all we need *)\nlemma restrict_soundness:\n assumes A:\"\\ T0 <: T\"\n and B:\"\\ T0 <: S\"\n and C:\"simple_ty T0\"\n shows \"\\ T0 <: restrict S T\"\n using prems\nproof (induct T arbitrary: S T0 taking:\"size_ty\" rule: measure_induct_rule)\n case (less T S T0)\n thus ?case\n proof (induct T==T rule: ty_cases)\n case Top thus ?case by auto\n next\n case Int thus ?case by auto\n next\n case TT thus ?case by auto\n next\n case FF thus ?case by auto\n next\n case Arr thus ?case by auto\n next\n case (Union Ts)\n have r:\"restrict S T = (if (\\ S <:T) then S else (if (\\ T <: S) then T else Union (map (restrict S) Ts)))\" \n using prems restrict_union[of S Ts] by auto\n thus ?case\n proof -\n {\n\tassume \"\\ S <: T\"\n\thence \"restrict S T = S\" using r by simp\t\n\thence ?thesis using prems by auto\n }\n moreover\n {\n\tassume \"\\ T <: S\" \"~ (\\ S <: T)\"\n\thence \"restrict S T = T\" using r by simp\t\n\thence ?thesis using prems by auto\n }\n moreover\n {\n\tassume \"~ (\\ T <: S)\" \"~ (\\ S <: T)\"\n\thence req:\"restrict S T = Union (map (restrict S) Ts)\" using r by auto\n\thave T:\"\\ T0 <: Union Ts\" using prems by simp\n\thave \"?this \\ ?thesis\"\n\tproof (ind_cases \"\\ T0 <: Union Ts\")\n\t assume 0:\"Union Ts = T0\" thus ?thesis using `simple_ty T0` by (induct T0 rule: simple_ty.induct) auto\n\tnext\n\t fix Ts'\n\t assume \"T0 = ty.Union Ts'\" thus ?thesis using `simple_ty T0` by (induct T0 rule: simple_ty.induct) auto\n(* \n\t hence 1:\"T0 = Union [ty.TT,ty.FF]\" using `simple_ty T0` by (induct T0 rule: simple_ty.induct) auto\n\n have \"\\ ty.TT <: T0\" using 1 by auto\n hence \"\\ ty.TT <: Union Ts\" \"\\ ty.TT <: T\" \"\\ ty.TT <: S\" using T `\\ T0 <: S` `\\ T0 <: T` by auto\n hence \"EX \\ . \\ : set Ts \\ \\ ty.TT <: \\\" using tt_below_union by auto\n then guess \\ by auto\n hence \"size_ty \\ < size_ty T\" using prems union_size_ty by auto\n note prems(4)[OF `size_ty \\ < size_ty T` `\\ ty.TT <: \\` `\\ ty.TT <: S`, simplified]\n hence A_tt:\"\\ ty.TT <: restrict S \\\" .\n have mem:\"restrict S \\ : set (map (restrict S) Ts)\" using `\\ : set Ts` by auto\n hence \"\\ ty.TT <: Union (map (restrict S) Ts)\" using A_tt S_UnionAbove by auto\n hence tt_sub:\"\\ ty.TT <: restrict S T\" using req by auto\n\n have \"\\ ty.FF <: T0\" using 1 by auto\n hence \"\\ ty.FF <: Union Ts\" \"\\ ty.FF <: T\" \"\\ ty.FF <: S\" using T `\\ T0 <: S` `\\ T0 <: T` by auto\n hence \"EX \\ . \\ : set Ts \\ \\ ty.FF <: \\\" using ff_below_union by auto\n then guess \\ by auto\n hence \"size_ty \\ < size_ty T\" using prems union_size_ty by auto\n note prems(4)[OF `size_ty \\ < size_ty T` `\\ ty.FF <: \\` `\\ ty.FF <: S`, simplified]\n hence A_ff:\"\\ ty.FF <: restrict S \\\" .\n have mem:\"restrict S \\ : set (map (restrict S) Ts)\" using `\\ : set Ts` by auto\n hence \"\\ ty.FF <: Union (map (restrict S) Ts)\" using A_ff S_UnionAbove by auto\n hence ff_sub:\"\\ ty.FF <: restrict S T\" using req by auto\n\n from ff_sub tt_sub have \"\\ Union [ty.TT, ty.FF] <: restrict S T\" by auto\n thus ?thesis using 1 by auto\n*)\n next\n\t fix T'\n\t assume \"T' : set Ts\" \"\\ T0 <: T'\"\n\t have 1:\"\\ T0 <: restrict S T'\" using union_size_ty prems by auto\n\t have 2:\"set (map (restrict S) Ts) = (restrict S) ` set Ts\" by auto\n\t have 3:\"T' : set Ts\" using prems by auto\n\t have 4:\"restrict S T' : set (map (restrict S) Ts)\" using 2 3 by auto\n\t hence \"\\ T0 <: Union (map (restrict S) Ts)\" using subtype.S_UnionAbove[OF 4 1] by auto\n\t thus ?thesis using req by auto\n\tqed\n\thence ?thesis using T by simp\n }\n ultimately show ?thesis by auto\n qed\n qed\nqed\n\nfunction (sequential)\n remove :: \"ty \\ ty \\ ty\"\nwhere\n remove_union: \"remove r (Union (ls :: ty list)) = (if (\\ Union ls <: r) then (Union []) else Union (map (remove r) ls))\"\n| remove_other:\"remove r T = (if (\\ T <: r) then (Union []) else T)\"\n by pat_completeness auto\ntermination using union_size_ty\n by (relation \"measure (% (a,b). size_ty b)\") auto\n\nlemma remove_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"pi\\(remove T1 T2) = remove (pi\\T1) (pi\\T2)\"\nby (induct T2) (auto)\n\nlemma remove_soundness:\n assumes A:\"\\ T0 <: T\" and B:\"~ (\\ T0 <: S)\" and C:\"simple_ty T0\"\n shows \"\\ T0 <: remove S T\"\n using prems\nproof (induct T arbitrary: S T0 taking:\"size_ty\" rule: measure_induct_rule)\n case (less T S T0)\n thus ?case\n proof (induct T==T rule: ty_cases)\n case (Union Ts)\n have r:\"remove S T = (if (\\ T <:S) then (Union []) else Union (map (remove S) Ts))\" \n using prems remove_union[of S Ts] by auto\n thus ?case\n proof -\n {\n\tassume \"\\ T <: S\"\n\thence \"remove S T = (Union [])\" using r by simp\t\n\thence ?thesis using prems by auto\n }\n moreover\n {\n\tassume \"~ (\\ T <: S)\" \n\thence req:\"remove S T = Union (map (remove S) Ts)\" using r by auto\n\thave T:\"\\ T0 <: Union Ts\" using prems by simp\n\thave \"?this \\ ?thesis\"\n\tproof (ind_cases \"\\ T0 <: Union Ts\")\n\t assume 0:\"Union Ts = T0\" thus ?thesis using `simple_ty T0` by auto\n\tnext\n\t fix Ts'\n\t assume \"T0 = ty.Union Ts'\"\n\t thus ?thesis using `simple_ty T0` by auto\n\tnext\n\t fix T'\n\t assume \"T' : set Ts\" \"\\ T0 <: T'\"\n\t have 1:\"\\ T0 <: remove S T'\" using union_size_ty prems by auto\n\t have 2:\"set (map (remove S) Ts) = (remove S) ` set Ts\" by auto\n\t have 3:\"T' : set Ts\" using prems by auto\n\t have 4:\"remove S T' : set (map (remove S) Ts)\" using 2 3 by auto\n\t hence \"\\ T0 <: Union (map (remove S) Ts)\" using subtype.S_UnionAbove[OF 4 1] by auto\n\t thus ?thesis using req by auto\n\tqed\n\thence ?thesis using T by simp\n }\n ultimately show ?thesis by auto\n qed\n qed (auto)\nqed\n\nlemma restrict_remove_soundness:\n assumes A:\"\\ T0 <: T\" and B:\"simple_ty T0\"\n shows\n \"(\\ T0 <: S \\ \\ T0 <: restrict S T) \\ (~ (\\ T0 <: S) \\ \\ T0 <: remove S T)\"\nusing restrict_soundness[OF A _ B] remove_soundness[OF A _ B]\nby auto\n\nfun replace :: \"ty \\ ty \\ ty\"\nwhere\n \"replace t u = t\"\n\nfun mapfun :: \"(ty \\ ty \\ ty) \\ ty \\ name \\ (name*ty) \\ (name * ty)\"\nwhere\nmapfun_def: \"mapfun f T x (v,S) = (if (x = v) then (v, f T S) else (v,S))\" \n\n\nconstdefs\n envop :: \"(ty \\ ty \\ ty) \\ name \\ ty \\ (name*ty) list \\ (name*ty) list\"\n envop_def[simp]:\"envop f n t G == map (% (v,ty). (if (n = v) then (v,f t ty) else (v,ty))) G\"\n\nlemma envop_mapfun:\n shows \"map (mapfun f T x) \\ = envop f x T \\ \" using mapfun_def by auto\n\nlemma envop_fresh:\n fixes v::name\n assumes a:\"v \\ \\\" and c:\"valid \\\"\n shows \"v \\ (envop f n t \\)\"\n using c a\n by (induct \\ rule: valid.induct) auto\n\nlemma envop_valid:\n assumes \"valid \\\"\n shows \"valid (envop f n t \\)\"\n using assms envop_fresh\n by induct auto\n\nlemma envop_forget:\n assumes \"valid \\\" and \"x \\ \\\"\n shows \"envop f x T \\ = \\\"\n using prems\n proof (induct rule: valid.induct)\n case v1 thus ?case by auto\n next\n case (v2 \\' a S)\n have \"x ~= a\" and \"x \\ \\'\" using v2 fresh_list_cons fresh_atm[of x a] by auto\n hence A:\"envop f x T ((a,S)#\\') = (a,S)# (envop f x T \\')\" by auto\n thus ?case using v2 `x \\ \\'` by auto\n qed\n \n\nnominal_primrec \n \"env_plus (NE) G = G\"\n \"env_plus (TE T x) G = envop restrict x T G\"\n \"env_plus (VE x) G = envop remove x (ty.FF) G\"\n \"env_plus (TT) G = G\"\n \"env_plus (FF) G = G\"\n by auto\n\nlemma map_eqvt[eqvt]:\n fixes pi::\"name prm\"\n and l::\"('a::pt_name) list\"\n shows \"pi\\(map f l) = map (pi\\f) (pi\\l)\"\n by (induct l) perm_simp+\n\nlemma env_plus_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"pi\\(env_plus X G ) = env_plus (pi\\X) (pi\\G)\"\nproof (nominal_induct X rule: eff.induct)\n case (TE T x) thus ?case by (perm_simp add: eqvts split_def) auto\nnext\n case (VE x) thus ?case by (perm_simp add: eqvts split_def) auto\nqed(auto)\n\nnominal_primrec\n \"env_minus (NE) G = G\"\n \"env_minus (TE T x) G = envop remove x T G\"\n \"env_minus (VE x) G = envop replace x ty.FF G\"\n \"env_minus (TT) G = G\"\n \"env_minus (FF) G = G\"\n by auto\n\nlemma env_minus_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"pi\\(env_minus X G) = env_minus (pi\\X) (pi\\G)\"\nproof (nominal_induct X rule: eff.induct)\n case (TE T x) thus ?case\n by (perm_simp add: eqvts perm_fun_def split_def) auto\n case (VE x) thus ?case\n by (perm_simp add: eqvts perm_fun_def split_def) \nqed(auto)\n\nabbreviation env_plus_syn :: \"varEnv \\ eff \\ varEnv\" (\"_ |+ _\" [70,70] 70)\nwhere\n \"(G |+ eff) == env_plus eff G\"\n\nabbreviation env_minus_syn :: \"varEnv \\ eff \\ varEnv\" (\"_ |- _\" [70,70] 70)\nwhere\n \"(G |- eff) == env_minus eff G\"\n\n--\"Induction principle for type envs\"\nlemma env_induct[case_names Nil Cons]:\n fixes \\ :: varEnv\n assumes a1:\"P []\"\n and a2:\"!!G v T. P G \\ P ((v,T)#G)\"\n shows \"P \\\"\n using a1 a2\n by (induct \\) auto\n\nlemma envop_eqvt:\n fixes pi::\"name prm\"\n shows \"envop f (pi\\n) T (pi\\\\) = (pi\\ (envop f n T \\))\"\n proof (induct \\ rule: env_induct)\n case Nil thus ?case by auto\n next\n case (Cons G v T0) thus ?case using pt_bij4[of pi n v] pt_name_inst at_name_inst by auto\n qed\n \nlemma env_plus_eqvt:\n fixes pi::\"name prm\"\n shows \"(pi\\\\) |+ pi\\eff = pi\\(\\ |+ eff)\"\n by (nominal_induct eff avoiding: \\ rule: eff.induct)\n (auto simp add: eff.eqvts envop_eqvt simp del: envop_def)\n\nlemma env_minus_eqvt:\n fixes pi::\"name prm\"\n shows \"(pi\\\\) |- pi\\eff = pi\\(\\ |- eff)\"\n by (nominal_induct eff avoiding: \\ rule: eff.induct)\n (auto simp add: eff.eqvts envop_eqvt simp del: envop_def)\n\n\nlemma env_plus_simple_eff:\n assumes \"simple_eff eff\"\n shows \"\\ |+ eff = \\\"\n using prems \n by (induct eff rule: simple_eff_cases) auto\n \nlemma env_minus_simple_eff:\n assumes \"simple_eff eff\"\n shows \"\\ |- eff = \\\"\n using prems\n by (induct eff rule: simple_eff_cases) auto\n\nfun comb_eff :: \"eff \\ eff \\ eff \\ eff\"\nwhere\n \"comb_eff F1 F2 F3 = eff.NE\"\n\nlemma comb_eff_eqvt[eqvt]:\n fixes pi :: \"name prm\"\n shows \"(pi\\ (comb_eff F1 F2 F3)) = comb_eff (pi\\F1) (pi\\F2) (pi\\F3) \"\n using comb_eff.simps by auto\n\ntext {* type judgments *}\ninductive\n typing :: \"varEnv \\ trm \\ ty \\ eff \\ bool\" (\" _ \\ _ : _ ; _ \" [60,60,60,60] 60) \nwhere\n T_Var[intro]: \"\\valid \\; (v,T)\\set \\\\\\ \\ \\ Var v : T ; VE v\" \n| T_Const[intro]: \"valid \\ \\ \\\\<^isub>\\ b = T \\ \\ \\ (BI b) : T ; TT\"\n| T_Num[intro]: \"valid \\ \\ \\ \\ (Num n) : ty.Int ; TT\"\n| T_True[intro]: \"valid \\ \\ \\ \\ (Bool True) : ty.TT ; TT\"\n| T_False[intro]: \"valid \\ \\ \\ \\ (Bool False) : ty.FF ; FF\"\n| T_Abs[intro]: \"\\x \\ \\; ((x,T1)#\\) \\ b : T2; eff\\ \\ \\ \\ Lam [x:T1].b : (T1\\T2 : latent_eff.NE) ; TT\"\n| T_App[intro]: \"\\(\\ \\ e1 : U ; eff1) ; \\ U <: (T0 \\ T1 : le); (\\ \\ e2 : T; eff2) ; \\ T <: T0\\ \\ \\ \\ App e1 e2 : T1 ; NE\"\n| T_AppPred[intro]: \"\\\\ \\ e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S); \\ \\ e2 : T; VE x ; \\ T <: T0\\ \\ \\ \\ App e1 e2 : T1 ; TE S x\"\n| T_If[intro]: \"\\\\ \\ e1 : T1; eff1; (\\ |+ eff1) \\ e2 : T2; eff2; (\\ |- eff1) \\ e3 : T3; eff3; \\ T2 <: T; \\ T3 <: T\\ \\ \\ \\ (Iff e1 e2 e3) : T ; comb_eff eff1 eff2 eff3\"\n| T_AppPredTrue[intro]: \n \"\\\\ \\ e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S); \\ \\ e2 : T; eff2 ; \\ T <: T0; \\ T <: S\\ \\ \\ \\ App e1 e2 : T1 ; TT\"\n| T_AppPredFalse[intro]:\n \"\\\\ \\ e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S); \\ \\ e2 : T; eff2 ; \\ T <: T0; ~(\\ T <: S) ; e2 : values ; closed e2\\\n \\ \\ \\ App e1 e2 : T1 ; FF\"\n| T_IfTrue[intro]: \"\\\\ \\ e1 : T1 ; TT ; \\ \\ e2 : T2 ; eff; \\ T2 <: T\\ \\ \\ \\ (Iff e1 e2 e3) : T ; NE\" \n| T_IfFalse[intro]: \"\\\\ \\ e1 : T1 ; FF ; \\ \\ e3 : T3 ; eff; \\ T3 <: T\\ \\ \\ \\ (Iff e1 e2 e3) : T ; NE\"\n| T_AbsPred[intro]: \"\\x \\ \\; ((x,T1)#\\) \\ b : T2; TE S x\\ \\ \\ \\ Lam [x:T1].b : (T1\\T2 : Latent S) ; TT\"\n\nequivariance typing\n\nnominal_inductive typing \n by (auto simp add: abs_fresh)\n\ntext {* then we begin on preservation *}\n\nabbreviation\n \"sub\" :: \"(name\\ty) list \\ (name\\ty) list \\ bool\" (\" _ \\ _ \" [80,80] 80) where\n \"\\1 \\ \\2 \\ \\a \\. (a,\\)\\set \\1 \\ (a,\\)\\set \\2\"\n\nlemma envplus_empty:\n shows \"env_plus eff [] = []\"\n by (nominal_induct rule: eff.induct) auto\nlemma envminus_empty:\n shows \"env_minus eff [] = []\"\n by (nominal_induct rule: eff.induct) auto\n\nlemma w_lem1:\n fixes \\ \\'\n assumes \"\\ \\ \\'\" and a:\"valid \\'\"\n shows \"map f \\ \\ map f \\'\"\nproof -\n let ?mapfun = f\n from prems have \"set \\ <= set \\'\" by auto\n hence \"set (map ?mapfun \\) <= set (map ?mapfun \\')\" by auto\n hence \"(map ?mapfun \\) \\ (map ?mapfun \\')\" by blast\n thus ?thesis .\nqed\n \n \n\nlemma weakening_envplus: \n assumes b:\"\\ \\ \\'\" and a:\"valid \\'\"\n shows \"env_plus eff \\ \\ env_plus eff \\'\"\n using a prems w_lem1[of \\ \\']\n by (nominal_induct eff avoiding: \\ \\' rule: eff.induct) auto\n\nlemma weakening_envminus: \n assumes \"\\ \\ \\'\" and a:\"valid \\'\" and b:\"valid \\\"\n shows \"env_minus eff \\ \\ env_minus eff \\'\"\n using a prems w_lem1[of \\ \\']\n by (nominal_induct eff avoiding: \\ \\' rule: eff.induct) auto\n\nlemma envplus_valid:\n assumes \"valid \\\"\n shows \"valid (\\ |+ F)\"\n using prems\nproof (induct rule: valid.induct)\n case v1 thus ?case using envplus_empty by auto\nnext\n case (v2 \\' a T) \n\n from v2 show ?case\n proof (nominal_induct rule: eff.induct)\n case (TE S x)\n let ?op = \"restrict\"\n let ?G = \"((a, T) # \\')\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op S ty) else (v,ty)))\"\n have C:\"valid (map ?mapfun \\')\" using v2 `valid (\\' |+ TE S x)` by auto\n hence D:\"a \\ (map ?mapfun \\')\" using v2 envop_fresh `valid (\\' |+ TE S x)` by auto\n thus ?case\n proof (cases \"a = x\")\n case False\n from D have E:\"valid ((a,T)# (map ?mapfun \\'))\" using C by auto\n from False have B:\"?G |+ TE S x = ((a,T)# (map ?mapfun \\'))\" by auto\n thus ?thesis using E by auto\n next\n case True\n hence B:\"?G |+ TE S x = ((a,?op S T)# (map ?mapfun \\'))\" by auto\n from D have E:\"valid ((a,?op S T)# (map ?mapfun \\'))\" using C by auto\n thus ?thesis using B by auto\n qed\n next\n case (VE x) \n thus ?case \n proof -\n let ?op = \"remove\"\n let ?G = \"((a, T) # \\')\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op ty.FF ty) else (v,ty)))\"\n have C:\"valid (map ?mapfun \\')\" using v2 `valid (\\' |+ VE x)` by auto\n hence D:\"a \\ (map ?mapfun \\')\" using v2 envop_fresh `valid (\\' |+ VE x)` by auto\n thus ?case\n proof (cases \"a = x\")\n\tcase False\n\tfrom D have E:\"valid ((a,T)# (map ?mapfun \\'))\" using C by auto\n\tfrom False have B:\"?G |+ VE x = ((a,T)# (map ?mapfun \\'))\" by auto\n\tthus ?thesis using E by auto\n next\n\tcase True\n\thence B:\"?G |+ VE x = ((a,?op ty.FF T)# (map ?mapfun \\'))\" by auto\n\tfrom D have E:\"valid ((a,?op ty.FF T)# (map ?mapfun \\'))\" using C by auto\n\tthus ?thesis using B by auto\n qed\n qed\n qed (auto)\nqed\n\nlemma envminus_valid:\n assumes \"valid \\\"\n shows \"valid (\\ |- F)\"\n using prems \nproof (induct rule: valid.induct)\n case v1 thus ?case using envminus_empty by auto\nnext\n case (v2 \\' a T) thus ?case\n proof (nominal_induct rule: eff.induct)\n case (TE S x)\n let ?op = \"remove\"\n let ?G = \"((a, T) # \\')\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op S ty) else (v,ty)))\"\n have C:\"valid (map ?mapfun \\')\" using v2 `valid (\\' |- TE S x)` by auto\n hence D:\"a \\ (map ?mapfun \\')\" using v2 envop_fresh `valid (\\' |- TE S x)` by auto\n thus ?case\n proof (cases \"a = x\")\n case False\n from D have E:\"valid ((a,T)# (map ?mapfun \\'))\" using C by auto\n from False have B:\"?G |- TE S x = ((a,T)# (map ?mapfun \\'))\" by auto\n thus ?thesis using E by auto\n next\n case True\n hence B:\"?G |- TE S x = ((a,?op S T)# (map ?mapfun \\'))\" by auto\n from D have E:\"valid ((a,?op S T)# (map ?mapfun \\'))\" using C by auto\n thus ?thesis using B by auto\n qed\n next\n case (VE x) \n thus ?case \n proof -\n let ?op = \"replace\"\n let ?G = \"((a, T) # \\')\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op ty.FF ty) else (v,ty)))\"\n have C:\"valid (map ?mapfun \\')\" using v2 `valid (\\' |- VE x)` by auto\n hence D:\"a \\ (map ?mapfun \\')\" using v2 envop_fresh `valid (\\' |- VE x)` by auto\n thus ?case\n proof (cases \"a = x\")\n\tcase False\n\tfrom D have E:\"valid ((a,T)# (map ?mapfun \\'))\" using C by auto\n\tfrom False have B:\"?G |- VE x = ((a,T)# (map ?mapfun \\'))\" by auto\n\tthus ?thesis using E by auto\n next\n\tcase True\n\thence B:\"?G |- VE x = ((a,?op ty.FF T)# (map ?mapfun \\'))\" by auto\n\tfrom D have E:\"valid ((a,?op ty.FF T)# (map ?mapfun \\'))\" using C by auto\n\tthus ?thesis using B by auto\n qed\n qed\n qed (auto)\nqed\n\nlemma weakening: \n assumes a: \"\\1 \\ t : \\ ; F\" \n and b: \"valid \\2\" \n and c: \"\\1 \\ \\2\"\n and d:\"valid \\1\"\n shows \"\\2 \\ t:\\ ; F\"\nusing a b c d\nproof (nominal_induct \\1 t \\ F avoiding: \\2 rule: typing.strong_induct)\n case (T_If \\ t1 T1 F1 t2 T2 F2 t3 T3 F3 T \\2)\n have A:\"valid (\\ |+ F1)\" using T_If envplus_valid by auto\n have B:\"valid (\\ |- F1)\" using T_If envminus_valid by auto\n have A':\"valid (\\2 |+ F1)\" using T_If envplus_valid by auto\n have B':\"valid (\\2 |- F1)\" using T_If envminus_valid by auto\n have C:\"(\\ |+ F1) \\ (\\2 |+ F1)\" using T_If weakening_envplus by auto\n have D:\"(\\ |- F1) \\ (\\2 |- F1)\" using T_If weakening_envminus by auto\n show ?case using T_If A B C D A' B' by blast\nqed (auto | atomize)+ \n(* FIXME: before using meta-connectives and the new induction *)\n(* method, this was completely automatic *)\n(* need weakening lemmas about env+/- *)\n\n\nlemma \"[] \\ (Lam[x:Top]. (Iff (App (BI NumberP) (Var x)) (App (BI Add1) (Var x)) (Num 12))) : (Top \\ ty.Int : latent_eff.NE) ; TT\"\n apply (rule T_Abs)\n apply (auto simp add: fresh_def supp_def perm_fun_def)\n\n apply (rule T_If)\n apply auto\n apply (rule T_AppPred)\n apply (auto simp add: valid.intros)\n apply (rule T_App)\n apply (rule T_Const)\n defer\n apply ( simp add: valid.intros)\n apply (rule S_Refl)\n apply (rule T_Var)\n apply (simp add: valid.intros)+\n apply (rule S_Refl)\n apply (simp add: valid.intros)+\n \n done\n\n\n(* inductive cases about typing *)\n\ninductive_cases iff_t_cases : \"G \\ Iff tst thn els : t ; e\"\ninductive_cases app_bi_cases : \"G \\ App (Const (BI b)) rand : t ; e\"\ninductive_cases type_arr_case_num: \"\\ \\ ((Num n)) : (T1 \\ T2 : eff) ; eff'\"\ninductive_cases type_arr_case_bool: \"\\ \\ ((Bool b)) : (T1 \\ T2 : eff) ; eff'\"\ninductive_cases type_bi_case: \"\\ \\ ((BI b)) : t ; eff\"\ninductive_cases type_add1_case: \"\\ \\ ((BI Add1)) : t ; eff\"\ninductive_cases bi_typing_cases: \"\\ \\ (BI b) : t ; eff\"\ninductive_cases abs_ty_int: \"\\ \\ (Abs x body t) : ty.Int ; eff'\"\ninductive_cases abs_ty_bool: \"\\ \\ (Abs x body t) : BoolTy ; eff'\"\ninductive_cases const_ty_int: \"\\ \\ e : ty.Int ; eff'\"\ninductive_cases const_ty_bool: \"\\ \\ e : BoolTy ; eff'\"\ninductive_cases iff_false_ty: \"\\ \\ Iff (Bool False) thn els : t ; eff\"\ninductive_cases app_bi_ty: \"\\ \\ App (BI b) arg : t ; eff\"\n\n(* Typing Values*)\n\n\nlemma false_ty_elim[rule_format]: \n \"\\ \\ (trm.Bool False) : \\ ; eff \\ \\ = ty.FF \\ eff = FF \\ valid \\\"\napply (ind_cases \"\\ \\ (trm.Bool False) : \\ ; eff\")\napply (auto simp add: trm.inject)\ndone\n\nlemma num_ty_elim[rule_format]: \n \"\\ \\ (Num n) : \\ ; eff \\ \\ = ty.Int \\ eff = TT \\ valid \\\"\nby (ind_cases \"\\ \\ (Num n) : \\ ; eff\") auto\n\nlemma true_ty_elim[rule_format]: \n \"\\ \\ (trm.Bool True) : \\ ; eff \\ \\ = ty.TT \\ eff = TT \\ valid \\ \"\nby (ind_cases \"\\ \\ (trm.Bool True) : \\ ; eff\") \n (auto simp add: trm.inject)\n\nlemma bool_ty_elim[rule_format]: \n \"\\ \\ (trm.Bool b) : \\ ; eff \\ (\\ = ty.TT \\ \\ = ty.FF) \\ valid \\ \"\napply (ind_cases \"\\ \\ (trm.Bool b) : \\ ; eff\")\napply (auto simp add: trm.inject)\ndone\n\nlemma bi_ty_elim[rule_format]: \n \"\\ \\ (BI b) : \\ ; eff \\ eff = TT \\ \\ = \\\\<^isub>\\ b \\ valid \\\"\napply (ind_cases \"\\ \\ (BI b) : \\ ; eff\")\napply (auto simp add: trm.inject)\ndone\n\ninductive_cases bool_sub_int: \"\\ BoolTy <: ty.Int\"\ninductive_cases tt_sub_int: \"\\ ty.TT <: ty.Int\"\ninductive_cases ff_sub_int: \"\\ ty.FF <: ty.Int\"\nthm bool_sub_int\ninductive_cases arr_sub_int: \"\\ A\\B:L <: ty.Int\"\ninductive_cases int_sub_tt: \"\\ ty.Int <: ty.TT\"\ninductive_cases int_sub_ff: \"\\ ty.Int <: ty.FF\"\ninductive_cases arr_sub_tt: \"\\ A\\B:L <: ty.TT\"\ninductive_cases arr_sub_ff: \"\\ A\\B:L <: ty.FF\"\ninductive_cases int_sub_bool_cases: \"\\ ty.Int <: Union [ty.TT, ty.FF]\"\ninductive_cases arr_sub_bool_cases: \"\\ A\\B:L <: Union [ty.TT, ty.FF]\"\n\ndeclare BoolTy_def[simp]\n\n\nlemma int_sub_bool:\n assumes \"\\ ty.Int <: BoolTy\"\n shows \"P\"\n using prems\nproof -\n have \"\\ ty.Int <: ty.TT \\ \\ ty.Int <: ty.FF\" using prems int_sub_bool_cases by auto\n thus ?thesis using int_sub_ff int_sub_tt by auto\nqed\n\nlemma arr_sub_bool:\n assumes \"\\ A\\B:L <: BoolTy\"\n shows \"P\"\n using prems\nproof -\n have \"\\ A\\B:L <: ty.TT \\ \\ A\\B:L <: ty.FF\" using prems arr_sub_bool_cases[of A B L] by auto\n thus ?thesis using arr_sub_ff[of A B L] arr_sub_tt[of A B L] by auto\nqed\n\nthm int_sub_bool\n\ninductive_cases abs_ty_elim2[consumes 1, case_names 1]: \"\\ \\ Lam[x:S].b : T ; eff\"\n\nlemma int_value:\n assumes a:\"v : values\"\n and b:\"\\ \\ v : T ; F\"\n and c:\"\\ T <: ty.Int\"\n shows \"EX n. v = (Num n)\"\n using prems\nproof (induct rule: values.induct)\n case num_value thus ?case by auto\nnext\n case (bool_value b)\n hence \"T = ty.TT \\ T = ty.FF\" using bool_ty_elim by auto\n thus ?case using bool_value tt_sub_int ff_sub_int by auto\nnext\n case (abs_value b S x)\n thus ?case using arr_sub_int\n by (induct rule: abs_ty_elim2) auto\nnext\n case (bi_value b)\n thus ?case using bi_ty_elim[of \\ b T F] using arr_sub_int by (nominal_induct b rule: builtin.induct) auto\nqed\n\n \nlemma bool_value:\n assumes a:\"v : values\"\n and b:\"\\ \\ v : T ; F\"\n and c:\"\\ T <: BoolTy\"\n shows \"EX b. v = (Bool b)\"\n using prems\nproof (induct rule: values.induct)\n case num_value thus ?case using num_ty_elim[of \\ _ T F] int_sub_bool by auto\nnext\n case (bool_value b) thus ?case by auto\nnext\n case (abs_value b S x)\n thus ?case using arr_sub_bool \n by (induct rule: abs_ty_elim2) auto\nnext\n case (bi_value b)\n thus ?case using bi_ty_elim[of \\ b T F] using arr_sub_bool by (nominal_induct b rule: builtin.induct) auto\nqed\n\nlemma value_int_ty:\n assumes a:\"\\ \\ e : ty.Int ; eff\"\n and b: \"e : values\"\n shows \"EX n. e = (Num n)\"\n using b a int_value[of e _ ty.Int] by auto\n\nlemma value_bool_ty:\n assumes a:\"\\ \\ e : BoolTy ; eff\"\n and b: \"e : values\"\n shows \"EX b. e = (Bool b)\"\n using b a bool_value[OF b a] by auto\n\nlemma typing_bi:\n assumes a:\"\\ \\ (BI b) : t ; eff\"\n shows \"t = \\\\<^isub>\\ b\"\n using a bi_typing_cases[of \\ b t eff \"t = \\\\<^isub>\\ b\"]\n by (simp add: trm.inject) \n\ninductive_cases arr_sub_arr_cases:\"\\ A1 \\ A2 : L <: B1 \\ B2 : L'\"\n\nlemma typed_prim_reduce:\n assumes a:\"\\ \\ (BI b) : U ; eff\" and b:\"\\ \\ v : T ; eff'\" and c:\"v : values\"\n and sub:\"\\ T <: T0\" and d: \"\\ U <: T0 \\ T1 : le\" \n shows \"EX v'. \\ b v = Some v'\"\n using a b c d sub\n proof (nominal_induct b rule: builtin.induct)\n case Add1\n have \"U = \\\\<^isub>\\ Add1\" using Add1 typing_bi[of \\ Add1 \"U\" eff] by simp\n hence \"U = ty.Int \\ ty.Int : latent_eff.NE\" by auto\n hence \"\\ T <: ty.Int \" and \"le = latent_eff.NE\" using sub d arr_sub_arr_cases[of ty.Int ty.Int latent_eff.NE T0 T1 le] \n by auto\n hence \"EX n. v = (Num n)\" using c b int_value by auto\n then obtain n where \"v = (Num n)\" by auto\n thus ?case by (auto simp add: \\.simps)\n next\n case Nott show ?case using `v : values` Nott\n by (induct v rule: values.induct) auto\n next\n case NumberP thus ?case by auto\n next\n case BooleanP thus ?case by auto\n next\n case ProcP thus ?case by auto\n qed\n\n\ntext {* Progress together with necessary lemmas *}\n\n(* first some lemmas about decomposing various kinds of syntax *)\n\nlemma if_decomp:\n assumes b:\"closed tst \\ (\\E L R. tst = E L \\ E \\ ctxt \\ L \\ R) \\ tst : values\"\n and c:\"closed (Iff tst thn els)\"\n shows \"(EX E L R. (Iff tst thn els) = E L \\ E : ctxt \\ L \\ R) \\ (Iff tst thn els) : values\"\n proof -\n {\n assume \"tst : values\"\n hence \"EX E L R. Iff tst thn els = E L \\ E : ctxt \\ (L \\ R)\"\n using if_val_reduces[of tst thn els] ex_help[of \"Iff tst thn els\" \"(%t. t)\"] by auto\n }\n moreover\n {\n assume asm:\"~ tst : values\"\n have cl:\"closed tst\" using `closed (Iff tst thn els)` by (auto simp add: closed_def trm.supp)\n hence ih:\"\\E t t'. tst = E t \\ E \\ ctxt \\ t \\ t'\" using b asm by auto\n hence \"\\E t t' . Iff tst thn els = E t \\ E \\ ctxt \\ t \\ t'\"\n using reduce_in_ctxt[of \"(%t . (Iff t thn els))\"] ih by auto\n }\n ultimately show ?thesis by auto\n qed\n \n\ninductive_cases tt_sub_arr_cases: \"\\ ty.TT <:A1 \\ A2 : L\"\ninductive_cases ff_sub_arr_cases: \"\\ ty.FF <:A1 \\ A2 : L\"\ninductive_cases num_sub_arr_cases: \"\\ ty.Int <:A1 \\ A2 : L\"\n\nlemma app_decomp:\n assumes a:\" G \\ rator : U ; eff1\"\n and a':\"\\ U <: T0 \\ T1 : le\"\n and aa:\" G \\ rand : T ; eff\"\n and b:\"closed rator \\ (\\E L R. rator = E L \\ E \\ ctxt \\ L \\ R) \\ rator \\ values\"\n and bb:\"closed rand \\ (\\E L R. rand = E L \\ E \\ ctxt \\ L \\ R) \\ rand \\ values\"\n and c:\"closed (App rator rand)\"\n and sub:\"\\ T <: T0\"\n shows \"(EX E L R. (App rator rand) = E L \\ E : ctxt \\ L \\ R) \\ (App rator rand) : values\"\n proof -\n have well_typed:\"G \\ (App rator rand) : T1 ; eff.NE\"\n using T_App[of G rator U eff1 T0 T1 le rand T eff] a a' aa sub by auto\n have \"closed rator\" using c by (auto simp add: closed_def trm.supp)\n hence ih1:\"(\\E L R. rator = E L \\ E \\ ctxt \\ L \\ R) \\ rator \\ values\" using b by simp\n have \"closed rand\" using c by (auto simp add: closed_def trm.supp)\n hence ih2:\"(\\E L R. rand = E L \\ E \\ ctxt \\ L \\ R) \\ rand \\ values\" using bb by simp\n {\n assume asm1:\"rator \\ values\" and asm2:\"rand \\ values\"\n hence \"(EX E L R. (App rator rand) = E L \\ E : ctxt \\ L \\ R)\" using asm1 a aa a' sub well_typed\n proof (nominal_induct avoiding: rand rule: values.strong_induct )\n case (abs_value x t b)\n let ?E = \"(%t. t)\"\n let ?L = \"App (Abs x b t) rand\"\n have \"?L \\ (b[x::=rand])\" by (rule e_beta)\n thus ?case using ex_help[of ?L ?E ?L] by auto\n next\n case (bool_value b)\n\t hence \"U = ty.TT \\ U = ty.FF\" using true_ty_elim false_ty_elim by (cases b) auto\n\t thus ?case using tt_sub_arr_cases[of T0 T1 le] ff_sub_arr_cases[of T0 T1 le] `\\ U <: T0 \\ T1 : le` by blast\n next\n case (num_value b)\n\t hence \"U = ty.Int\" using num_ty_elim by auto\n\t thus ?case using num_sub_arr_cases[of T0 T1 le] num_value by auto\n next\n case (bi_value b) \n let ?E = \"(%t. t)\"\n let ?L = \"App ((BI b)) rand\"\n have h:\"\\v. (\\ b rand) = (Some v) \\ App ((BI b)) rand \\ v\" using bi_value by auto\n have \"EX v . (\\ b rand) = (Some v)\" using bi_value typed_prim_reduce[of G b U] by auto\n then obtain v' where \"(\\ b rand) = (Some v')\" by auto\n then show ?case using h[of v'] ex_help[of ?L ?E] by auto\n qed\n }\n moreover\n {\n assume asm1:\"rator \\ values\" and asm2:\"rand \\ values\"\n have \"\\E t t' . App rator rand = E t \\ E \\ ctxt \\ t \\ t'\"\n\tusing asm1 asm2 reduce_in_ctxt[of \"(%t . (App rator t))\"] ih2 by auto\n }\n moreover\n {\n assume asm:\"rator \\ values\"\n have \"\\E t t' . App rator rand = E t \\ E \\ ctxt \\ t \\ t'\"\n\tusing asm reduce_in_ctxt[of \"(%t . (App t rand))\"] ih1 by auto\n } \n ultimately show ?thesis by auto\n qed\n\n\n(* then the main lemma, that every well typed term can be decomposed\n into a context and a redex *)\n\nlemma decomposition:\n assumes a:\"closed e\" and b:\"\\ \\ e : t ; eff\"\n shows \"(EX E L R. e = E L \\ E : ctxt \\ L \\ R) \\ e : values\"\n using b a\nproof (induct rule: typing.induct)\n case T_Var\n thus ?case using closed_def by (auto simp add: at_supp at_name_inst trm.supp) \nnext\n case T_If\n thus ?case using if_decomp by auto\nnext\n case T_IfTrue\n thus ?case using if_decomp by auto\nnext\n case T_IfFalse\n thus ?case using if_decomp by auto\nnext\n case T_App\n thus ?case using app_decomp by auto\nnext\n case T_AppPred\n thus ?case using app_decomp by auto\nnext\n case T_AppPredTrue\n thus ?case using app_decomp by auto\nnext\n case T_AppPredFalse\n thus ?case using app_decomp by auto\nqed (simp_all) (* The value cases are automatic *)\n\n(* Now we conclude progress *)\n\ntheorem progress:\n assumes typed:\"\\ \\ e : t ; eff\" and cl:\"closed e\"\n shows \"e : values \\ (EX e'. e \\ e')\"\nproof (cases \"e : values\")\n case False\n hence \"(\\E L R. e = E L \\ E \\ ctxt \\ L \\ R)\" using decomposition[OF cl typed] by auto\n thus ?thesis by auto\nqed (simp)\n\n(* Some useful lemmas for deriving facts from typing derivations *)\n\ninductive_cases app_ty_elim2[consumes 1, case_names 1 2 3 4]: \"\\ \\ App t1 t2 : \\ ; eff\"\nthm app_ty_elim2\ninductive_cases iff_ty_elim2[consumes 1, case_names 1 2 3]: \"\\ \\ Iff t1 t2 t3 : T ; eff\"\nthm abs_ty_elim2\n\n(* slow *)\nlemma app_ty_elim[rule_format]: \n \"\\ \\ App t1 t2 : \\ ; eff \\ \n \\ T0 T0' T1 le eff' eff'' U. (\\ \\ t1 : U ; eff' \\ \\ \\ t2 : T0' ; eff'' \\ \\ U <: T0 \\ T1 : le \\ \\ T0' <: T0 \\ T1 = \\)\"\n apply (ind_cases \"\\ \\ App t1 t2 : \\ ; eff\")\n apply (auto simp add: trm.inject ty.inject)\n by metis+\n\nlemma abs_ty_elim_eff[rule_format]: \n \"\\\\ \\ Lam[a:T0].b : \\ ; eff\\ \\ eff = eff.TT\"\n by (ind_cases \"\\ \\ Lam[a:T0].b : \\ ; eff\")\n (auto simp add: trm.inject)\n\n\nlemma abs_ty_elim[rule_format]: \n \"\\\\ \\ Lam[a:T0].b : \\ ; eff ; a \\ \\\\ \\ \n \\ T1 eff' L S. ((a,T0)#\\ \\ b : T1 ; eff' \\ \\ = (T0 \\ T1 : L) \\ eff = eff.TT \\ ((eff' = TE S a \\ L = Latent S) \\ L = latent_eff.NE))\"\napply (ind_cases \"\\ \\ Lam[a:T0].b: \\ ; eff\")\napply(auto simp add: trm.distinct trm.inject alpha) \napply(drule_tac pi=\"[(a,x)]::name prm\" in typing.eqvt)\napply(auto)\napply(subgoal_tac \"([(a,x)]::name prm)\\\\ = \\\")(*A*)\napply(force simp add: calc_atm)\n(*A*)\napply(force intro!: pt_fresh_fresh[OF pt_name_inst, OF at_name_inst])\n\napply(drule_tac pi=\"[(a,x)]::name prm\" in typing.eqvt)\napply(auto)\napply(subgoal_tac \"([(a,x)]::name prm)\\\\ = \\\")(*A*)\napply(force simp add: calc_atm)\n(*A*)\napply(force intro!: pt_fresh_fresh[OF pt_name_inst, OF at_name_inst])\ndone\n\ninductive_cases abs_ty_cases[consumes 1, case_names 1 2]:\"\\ \\ Lam[a:T0].b: \\ ; eff\"\nthm abs_ty_cases\n\n(*\nlemma app_abs_ty_elim_eff[rule_format]: \n \"\\\\ \\ App (Abs x b T) t2 : \\ ; eff ; x \\ \\\\ \\ eff = eff.NE\"\n proof (ind_cases \"\\ \\ App (Abs x b T) t2 : \\ ; eff\", auto simp add: trm.inject abs_ty_elim)\n fix T0 S eff1 U \n assume \"\\ \\ Lam [x:T].b : U ; eff1 \"\" \\ U <: T0 \\ \\ : Latent S\" \"x \\ \\\"\n then obtain T1 L where \"U = T \\ T1 : L\" using abs_ty_elim[of \\ x b T \"U\" L] by auto\n thus False using prems arr_sub_arr_cases[of T _ latent_eff.NE T0 \\ \"Latent S\"] by (auto simp add: ty.inject)\n next\n fix T0 S eff1 U\n assume \"\\ \\ Lam [x:T].b : U ; eff1 \"\" \\ U <: T0 \\ \\ : Latent S\" \"x \\ \\\"\n then obtain T1 where \"U = T \\ T1 : latent_eff.NE\" using abs_ty_elim[of \\ x b T \"U\"] by auto\n thus False using prems arr_sub_arr_cases[of T _ latent_eff.NE T0 \\ \"Latent S\"] by (auto simp add: ty.inject)\n next\n fix T0 S eff1 U\n assume \"\\ \\ Lam [x:T].b : U ; eff1 \"\" \\ U <: T0 \\ \\ : Latent S\" \"x \\ \\\"\n then obtain T1 where \"U = T \\ T1 : latent_eff.NE\" using abs_ty_elim[of \\ x b T \"U\"] by auto\n thus False using prems arr_sub_arr_cases[of T _ latent_eff.NE T0 \\ \"Latent S\"] by (auto simp add: ty.inject)\n qed\n\n*)\nlemma if_ty_elim_weak[rule_format]: \n \"\\ \\ Iff t1 t2 t3: \\ ; eff \\ \\ T0 eff'. (\\ \\ t1 : T0 ; eff') \\ eff = NE\"\nby (ind_cases \"\\ \\ Iff t1 t2 t3: \\ ; eff\")\n (auto simp add: trm.inject)\n\nlemma if_ty_elim[rule_format]: \n \"\\ \\ Iff t1 t2 t3: \\ ; eff \\ \n (\\ T1 T2 T3 F1 F2 F3. (\\ \\ t1 : T1 ; F1) \\ \\ |+ F1 \\ t2 : T2 ; F2 \\ \\ |- F1 \\ t3 : T3 ; F3 \\ \\ T2 <: \\ \\ \\ T3 <: \\ \\ eff = NE)\n \\\n (\\ T1 T3 F3. (\\ \\ t1 : T1 ; FF) \\ \\ \\ t3 : T3 ; F3 \\ \\ T3 <: \\ \\ eff = NE)\n \\\n (\\ T1 T2 F2. (\\ \\ t1 : T1 ; TT) \\ \\ \\ t2 : T2 ; F2 \\ \\ T2 <: \\ \\ eff = NE)\"\nproof (ind_cases \"\\ \\ Iff t1 t2 t3: \\ ; eff\")\n fix e1 T1 eff1 e2 T2 eff2 e3 T3 eff3\n assume \"Iff t1 t2 t3 = Iff e1 e2 e3\"\" eff = eff.NE\"\" \\ \\ e1 : T1 ; eff1\"\" env_plus eff1 \\ \\ e2 : T2 ; eff2 \"\n \"env_minus eff1 \\ \\ e3 : T3 ; eff3\"\" \\ T2 <: \\\"\" \\ T3 <: \\\"\n hence A:\"t1 = e1\" \"t2 = e2\" \"t3 = e3\" using trm.inject by auto\n thus ?thesis using prems by blast \nnext\n fix e1 T1 e2 T2 effa e3\n assume \"Iff t1 t2 t3 = Iff e1 e2 e3\"\" eff = eff.NE\"\" \\ \\ e1 : T1 ; TT \"\" \\ \\ e2 : T2 ; effa \"\" \\ T2 <: \\\"\n thus ?thesis by (auto simp add: trm.inject)\nnext\n fix e1 T1 e2 T3 effa e3\n assume \"Iff t1 t2 t3 = Iff e1 e2 e3\"\" eff = eff.NE\"\" \\ \\ e1 : T1 ; FF \"\" \\ \\ e3 : T3 ; effa \"\" \\ T3 <: \\\"\n thus ?thesis by (auto simp add: trm.inject)\nqed\n\ninductive_cases iff_false_ty_cases: \"\\ \\ Iff (trm.Bool False) t2 t3: \\ ; eff\"\ninductive_cases ff_eff_cases: \"\\ \\ e : T; FF\"\ninductive_cases tt_eff_cases: \"\\ \\ e : T; TT\"\ninductive_cases ne_eff_cases: \"\\ \\ e : T; NE\"\n\n\nlemma if_true_ty_elim[rule_format]: \n \"\\\\ \\ Iff v t2 t3: \\ ; eff ; v : values; v ~= Bool False\\ \\\n \\ T0 eff'. ((\\ \\ t2 : T0 ; eff') \\ \\ T0 <: \\ \\ eff = NE)\" \nproof (ind_cases \"\\ \\ Iff (v) t2 t3: \\ ; eff\")\n fix eff1 eff2 T1 T2 e1 e2 e3 \n assume \"v : values\" \"env_plus eff1 \\ \\ e2 : T2 ; eff2\" \"Iff v t2 t3 = Iff e1 e2 e3\" \"\\ T2 <: \\\" \n \"\\ \\ e1 : T1 ; eff1\" \"eff = NE\"\n have \"\\ \\ v : T1 ; eff1\" using prems by (simp add: trm.inject)\n have \"eff1 = eff.NE \\ eff1 = FF \\ eff1 = TT\" using `v : values` `\\ \\ v : T1 ; eff1`\n proof (induct rule: values.induct)\n case (abs_value b T x) thus ?case using abs_value abs_ty_elim_eff by auto\n next\n case (num_value n) thus ?case using num_ty_elim by auto\n next\n case (bool_value n) thus ?case using false_ty_elim true_ty_elim by (cases n) auto\n next\n case bi_value thus ?case using bi_ty_elim by auto\n qed\n hence \"env_plus eff1 \\ = \\\" by auto\n hence \"\\ \\ e2 : T2 ; eff2 \\ \\ T2 <: \\\" using prems by auto\n thus ?thesis using prems by (auto simp add: trm.inject)\nnext\n fix e1 T2 e2 e3 effa\n assume \"Iff v t2 t3 = Iff e1 e2 e3\" \"\\ \\ e2 : T2 ; effa\" \"\\ T2 <: \\\" \"eff = NE\"\n thus ?thesis by (auto simp add: trm.inject)\nnext\n fix e1 T1 e3 T3 effa e2\n assume \"v : values\" \"v \\ trm.Bool False\" \"Iff v t2 t3 = Iff e1 e2 e3\" \"\\ \\ e1 : T1 ; FF\" \"eff = NE\"\n have \"v = e1\" using prems trm.inject by auto\n hence tv:\"\\ \\ v : T1 ; FF\" by simp\n have \"v = Bool False\" using `v : values` tv\n proof (induct v rule: values.induct)\n case (abs_value x T b) thus ?case using abs_ty_elim_eff[of \\ x b T T1 FF] by auto\n next\n case (num_value n) thus ?case using num_ty_elim[of _ _ _ FF] by auto\n next\n case (bool_value n) thus ?case using true_ty_elim[of _ _ FF] by (cases n) auto\n next\n case bi_value thus ?case using bi_ty_elim[of _ _ _ FF] by auto\n qed\n show ?thesis using `v = Bool False` `v ~= Bool False` by auto\nqed \n\n\nlemma if_false_ty_elim[rule_format]: \n \"\\ \\ Iff (trm.Bool False) t2 t3: \\ ; eff \\\n \\ T0 eff'. ((\\ \\ t3 : T0 ; eff') \\ \\ T0 <: \\ \\ eff = eff.NE)\" \nproof (ind_cases \"\\ \\ Iff (trm.Bool False) t2 t3: \\ ; eff\")\n fix e1 e2 e3 T1\n assume \"Iff (trm.Bool False) t2 t3 = Iff e1 e2 e3\" and \"\\ \\ e1 : T1 ; TT\"\n hence \"\\ \\ (trm.Bool False) : T1 ; TT\" by (simp add: trm.inject)\n hence \"TT = FF\" using false_ty_elim[of \\ T1 TT] by simp\n thus ?thesis by (simp)\nnext\n fix e1 e2 e3 T1 T3 effa\n assume \"Iff (trm.Bool False) t2 t3 = Iff e1 e2 e3\" and \" eff = eff.NE\"and\" \\ \\ e1 : T1 ; FF\" and \" \\ \\ e3 : T3 ; effa\"and \" \\ T3 <: \\\"\n thus ?thesis by (auto simp add: trm.inject)\nnext\n fix e1 e2 e3 T1 T3 eff1 eff3\n assume \"Iff (trm.Bool False) t2 t3 = Iff e1 e2 e3\" and \"eff = eff.NE\" \n and f:\"\\ \\ e1 : T1 ; eff1\" and g:\"env_minus eff1 \\ \\ e3 : T3 ; eff3\" and \"\\ T3 <: \\\"\n hence \"e1 = Bool False\" and \"t3 = e3\" by (auto simp add: trm.inject)\n hence \"eff1 = FF\" using f false_ty_elim by auto\n hence \"env_minus eff1 \\ = \\\" by simp\n hence \"\\ \\ e3 : T3 ; eff3\" using g by simp\n thus ?thesis using `t3 = e3` `\\ T3 <: \\` `eff = eff.NE` by auto\nqed \n\nlemma var_ty_elim:\n \"\\ \\ Var v : \\ ; eff \\ (v,\\) : set \\ \\ eff = VE v \\ valid \\\"\n by (ind_cases \"\\ \\ Var v : \\ ; eff\")\n (auto simp add: trm.inject)\n\ninductive_cases app_ty_ff:\"\\ \\ App e arg : T' ; FF\"\n \nlemma app_ty_ff_elim:\n \"\\ \\ App rator rand : T ; FF \\\n EX S T0 le F1 T0' F2 U. \\ \\ rator : U ; F1 \\ \\ \\ rand : T0' ; F2 \\ \\ T0' <: T0 \\ \\ U <: T0 \\ T : le \\\n le = Latent S \\ (~ (\\ T0' <: S)) \\ rand : values \\ closed rand\"\n proof (ind_cases \"\\ \\ App rator rand : T ; FF\")\n fix e1 T0 S eff1 e2 Ta eff2 U\n assume \"App rator rand = App e1 e2 \"\" \\ \\ e1 : U ; eff1 \" \"\\ U <: T0 \\ T : Latent S\"\n \"\\ \\ e2 : Ta ; eff2 \"\"\\ Ta <: T0\"\"~ (\\ Ta <: S)\" \"e2 : values\" \"closed e2\"\n have a:\" \\ \\ rator : U ; eff1 \" using prems trm.inject by auto\n have b:\"\\ \\ rand : Ta ; eff2\" using prems trm.inject by auto\n have c:\"rand : values\" \"closed rand\" using prems trm.inject by auto\n from a b c prems show ?thesis by blast\n qed\n \nlemma app_ty_tt_elim:\n \"\\ \\ App rator rand : T ; TT \\\n EX S T0 le F1 T0' F2 U. \\ \\ rator : U ; F1 \\ \\ \\ rand : T0' ; F2 \\ \\ T0' <: T0 \\ \\ U <: T0 \\ T : le \n \\ le = Latent S \\ \\ T0' <: S \"\n proof (ind_cases \"\\ \\ App rator rand : T ; TT\")\n fix e1 T0 S eff1 e2 Ta eff2 U\n assume \"App rator rand = App e1 e2 \"\" \\ \\ e1 : U ; eff1 \" \"\\ U <: T0 \\ T : Latent S\"\n \"\\ \\ e2 : Ta ; eff2 \"\"\\ Ta <: T0\"\" \\ Ta <: S\"\n have a:\" \\ \\ rator : U ; eff1 \" using prems trm.inject by auto\n have b:\"\\ \\ rand : Ta ; eff2\" using prems trm.inject by auto\n from a b prems show ?thesis by blast\n qed\n\ntext {* values don't have union types *}\n\nlemma value_simple_type:\n assumes A:\"\\ \\ v : T ; F\" and B:\"v : values\"\n shows \"simple_ty T\"\nusing B A\nproof (nominal_induct v avoiding: \\ rule: values.strong_induct)\n case (bi_value b) thus ?case using bi_ty_elim[of \\ b T F]\n by (nominal_induct b rule: builtin.induct) \n (auto simp add: trm.inject)\nnext\n case num_value thus ?case using num_ty_elim[OF num_value] by auto\nnext\n case bool_value thus ?case using bool_ty_elim[OF bool_value] by auto\nnext\n case (abs_value a T' b \\') thus ?case using abs_ty_elim[of \\' a b T' T F] by auto\nqed\n\ntext {* lemmas about the effects of closed terms *}\n\nlemma ve_not_closed:\n \"\\ \\ e : T ; eff.VE x \\\n x : supp e\"\n by (ind_cases \"\\ \\ e : T ; eff.VE x\")\n (auto simp add: eff.inject trm.supp at_supp supp_atm)\n\nlemma te_not_closed:\n \"\\ \\ e : T ; eff.TE T' x \\\n x : supp e\"\n proof (ind_cases \"\\ \\ e : T ; eff.TE T' x\")\n fix e1 T0 S eff1 e2 Ta xa\n assume \"e = App e1 e2\" \"TE T' x = TE S xa\" \"\\ \\ e2 : Ta ; VE xa\"\n have \"x = xa\" using prems eff.inject by auto\n hence \"\\ \\ e2 : Ta ; VE x\" using prems eff.inject by auto\n hence \"x : supp e2\" using ve_not_closed by auto\n thus \"x : supp e\" using prems trm.supp by auto\n qed\n\nlemma closed_eff:\n assumes \"closed e\" and \"\\ \\ e : T ; eff\"\n shows \"simple_eff eff\"\nusing prems\nproof (nominal_induct eff rule: eff.induct)\n case (VE name) thus ?case using ve_not_closed[of _ e _ name] closed_def by auto\nnext\n case (TE _ name) thus ?case using te_not_closed[of _ e _ _ name] closed_def by auto\nqed (auto)\n\nlemma closed_eff_below_NE:\n assumes \"closed e\" and \"\\ \\ e : T ; eff\"\n shows \"\\ eff \\ (Num n) : ty.Int ; eff\"\ninductive_cases trm_ty_int_case: \"\\ \\ e : ty.Int ; eff\"\ninductive_cases const_ty_bool_case: \"\\ \\ (Bool b) : BoolTy ; eff\"\n\nlemma add1_eff_ne:\n \"\\ \\ (App (BI Add1) v) : T1 ; eff1 \\ eff1 = eff.NE\"\nproof (ind_cases \" \\ \\ (App (BI Add1) v) : T1 ; eff1\")\n assume \"eff1 = eff.NE\" thus ?thesis by simp\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Add1) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Add1) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Add1 = U\" using type_add1_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = ty.Int \\ ty.Int : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of ty.Int ty.Int latent_eff.NE] by (auto simp add: ty.inject)\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Add1) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Add1) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Add1 = U\" using type_add1_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = ty.Int \\ ty.Int : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of ty.Int ty.Int latent_eff.NE] by (auto simp add: ty.inject)\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Add1) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Add1) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Add1 = U\" using type_add1_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = ty.Int \\ ty.Int : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of ty.Int ty.Int latent_eff.NE] by (auto simp add: ty.inject)\nqed\n\ninductive_cases type_nott_case: \"\\ \\ (BI Nott) : t ; e\"\n\nlemma nott_eff_ne:\n \"\\ \\ (App (BI Nott) v) : T1 ; eff1 \\ eff1 = eff.NE\"\nproof (ind_cases \" \\ \\ (App (BI Nott) v) : T1 ; eff1\")\n assume \"eff1 = eff.NE\" thus ?thesis by simp\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Nott) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Nott) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Nott = U\" using type_nott_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = Top \\ BoolTy : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of Top BoolTy latent_eff.NE] by (auto simp add: ty.inject)\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Nott) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Nott) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Nott = U\" using type_nott_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = Top \\ BoolTy : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of Top BoolTy latent_eff.NE] by (auto simp add: ty.inject)\nnext\n fix T0 T1 S eff1a e1 e2 U\n assume \"\\ \\ e1 : U ; eff1a\" \"App (BI Nott) v = App e1 e2\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence \"\\ \\ (BI Nott) : U ; eff1a\" by (simp add: trm.inject)\n hence \"\\\\<^isub>\\ Nott = U\" using type_nott_case[of \\ \"U\"] by (auto simp add: trm.inject)\n hence \"\\ = Top \\ BoolTy : latent_eff.NE\" by auto\n thus ?thesis using prems arr_sub_arr_cases[of Top BoolTy latent_eff.NE] by (auto simp add: ty.inject)\nqed\n\ninductive_cases type_booleanp_case: \"\\ \\ (BI BooleanP) : t ; e\"\n\nlemma value_eff:\n assumes \"v : values\" and \"\\ \\ v : T ; eff\"\n shows \"simple_eff eff\"\n using prems\n proof (induct v rule :values.induct)\n case abs_value thus ?case using abs_ty_elim_eff by auto\n next\n case num_value thus ?case using num_ty_elim by auto\n next\n case (bool_value b) thus ?case using true_ty_elim false_ty_elim by (cases b) auto\n next\n case bi_value thus ?case using bi_ty_elim by auto\n qed\n\nlemma booleanp_eff_simple:\n \"\\\\ \\ (App (BI BooleanP) v) : T1 ; eff1 ; v : values\\ \\ simple_eff eff1\"\nproof (ind_cases \" \\ \\ (App (BI BooleanP) v) : T1 ; eff1\")\n fix T0 T1 S eff1a e1 e2 xa T\n assume \"\\ \\ e2 : T ; VE xa\" \"App (BI BooleanP) v = App e1 e2\" \"v : values\"\n hence \"VE xa = eff.NE \\ VE xa = eff.TT \\ VE xa = eff.FF \" using value_eff[of v \\ T \"VE xa\"] \n by (auto simp add: trm.inject)\n thus ?thesis using ty.distinct by auto\nqed (auto)\n\nlemma numberp_eff_simple:\n \"\\\\ \\ (App (BI NumberP) v) : T1 ; eff1 ; v : values\\ \\ simple_eff eff1\"\nproof (ind_cases \" \\ \\ (App (BI NumberP) v) : T1 ; eff1\")\n fix T0 T1 S eff1a e1 e2 xa T\n assume \"\\ \\ e2 : T ; VE xa\" \"App (BI NumberP) v = App e1 e2\" \"v : values\"\n hence \"VE xa = eff.NE \\ VE xa = eff.TT \\ VE xa = eff.FF \" using value_eff[of v \\ T \"VE xa\"]\n by (auto simp add: trm.inject)\n thus ?thesis using ty.distinct by auto\nqed (auto)\n\nlemma procp_eff_simple:\n \"\\\\ \\ (App (BI ProcP) v) : T1 ; eff1 ; v : values\\ \\ simple_eff eff1\"\nproof (ind_cases \" \\ \\ (App (BI ProcP) v) : T1 ; eff1\")\n fix T0 T1 S eff1a e1 e2 xa T\n assume \"\\ \\ e2 : T ; VE xa\" \"App (BI ProcP) v = App e1 e2\" \"v : values\"\n hence \"VE xa = eff.NE \\ VE xa = eff.TT \\ VE xa = eff.FF \" using value_eff[of v \\ T \"VE xa\"]\n by (auto simp add: trm.inject)\n thus ?thesis using ty.distinct by auto\nqed (auto)\n\n\ninductive_cases app_boolp_ff: \"\\ \\ (App (BI BooleanP) v) : T1 ; FF\"\n\nlemma booleanp_FF_preserved:\n assumes \"\\ \\ (App (BI BooleanP) v) : T1 ; FF\" and \"v : values\" and \"\\ BooleanP v = Some u\"\n shows \"u = Bool False\"\n using `v : values` prems\n proof (induct v rule: values.induct)\n case (bool_value b)\n let ?P = \"\\ \\ App (BI BooleanP) (trm.Bool b) : T1 ; FF\" \n have \"?P ==> ?case\"\n proof (ind_cases ?P)\n fix S T e1 e2 T0 eff1 eff2 U\n assume \"App (BI BooleanP) (trm.Bool b) = App e1 e2\" \"\\ \\ e1 : U ; eff1 \" \"\\ \\ e2 : T ; eff2\"\n \"~ (\\ T <: S)\" \"e2 : values\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence a:\"\\ \\ (BI BooleanP) : U ; eff1 \" using trm.inject by auto\n from prems have b:\"\\ \\ Bool b : T ; eff2\" using trm.inject by auto\n\thave \"U = Top \\ BoolTy : Latent BoolTy\" using a bi_ty_elim[of \\ BooleanP \"U\"] by auto\n\thence c:\"S = BoolTy\" using prems arr_sub_arr_cases[of Top BoolTy _ T0 T1 \"Latent S\"] latent_eff.inject by auto\n from b have d:\"T = ty.TT \\ T = ty.FF\" using true_ty_elim false_ty_elim by (cases b) auto\n from c d have \"\\ T <: S\" by auto\n thus ?thesis using prems by auto\n qed\n thus ?case using bool_value by auto\n qed (auto)\n\nlemma typing_valid:\n assumes \"\\ \\ e : T ; F\"\n shows \"valid \\\"\nusing prems \nproof (induct)\n case (T_Abs a \\ T b T' F') thus ?case using valid_elim[of a T \\] by auto\nnext\n case (T_AbsPred a \\ T b T' F') thus ?case using valid_elim[of a T \\] by auto\nqed (auto)\n\n\nlemma booleanp_TT_preserved:\n assumes \"\\ \\ (App (BI BooleanP) v) : T1 ; TT\" and \"v : values\" and \"\\ BooleanP v = Some u\"\n shows \"u = Bool True\"\n proof -\n note app_ty_tt_elim[of \\ \"(BI BooleanP)\" v T1]\n then obtain A1 U T0 T1 S eff1 eff2 where \n A:\"\\ \\ (BI BooleanP) : U ; eff1\" \"\\ U <: A1 \\ T1 : Latent S\" \"\\ \\ v : T0 ; eff2\" \"\\ T0 <: A1\" \"\\ T0 <: S\"\n using prems by auto\n hence B:\"U = Top \\ BoolTy : Latent BoolTy \" using bi_ty_elim[of \\ BooleanP U] by auto\n hence C:\"\\ T0 <: BoolTy\" \n using prems arr_sub_arr_cases[of Top BoolTy \"Latent BoolTy\" _ _ \"Latent S\"] latent_eff.inject A by auto\n then obtain b where D:\"v = Bool b\" using A bool_value[of v \\ T0] prems by auto\n thus ?thesis using prems by auto\n qed\n\nlemma booleanp_soundness_eff:\n assumes \"\\ \\ App (BI BooleanP) v : T ; F\" and \"v : values\" and \"\\ BooleanP v = Some u\" and \"\\ \\ u : T' ; F'\"\n shows \"\\ F' T' F'] booleanp_FF_preserved by auto \n next\n case TT thus ?case using true_ty_elim[of \\ T' F'] booleanp_TT_preserved by auto \n qed\n qed\n\ninductive_cases app_nump_ff: \"\\ \\ (App (BI NumberP) v) : T1 ; FF\"\nthm app_nump_ff\n\nlemma numberp_FF_preserved:\n assumes \"\\ \\ (App (BI NumberP) v) : T1 ; FF\" and \"v : values\" and \"\\ NumberP v = Some u\"\n shows \"u = Bool False\"\n using `v : values` prems\n proof (induct v rule: values.induct)\n case (bool_value b) thus ?case by (cases b) auto\n next\n case (num_value b) \n let ?P = \"\\ \\ App (BI NumberP) (trm.Num b) : T1 ; FF\" \n have \"?P ==> ?case\"\n proof (ind_cases ?P)\n fix S T e1 e2 T0 eff1 eff2 U\n assume \"App (BI NumberP) (trm.Num b) = App e1 e2\" \"\\ \\ e1 : U ; eff1 \" \"\\ \\ e2 : T ; eff2\"\n \"~ (\\ T <: S)\" \"e2 : values\" \"\\ U <: T0 \\ T1 : Latent S\"\n hence a:\"\\ \\ (BI NumberP) : U ; eff1 \" using trm.inject by auto\n from prems have b:\"\\ \\ Num b : T ; eff2\" using trm.inject by auto\n\thave \"U = Top \\ BoolTy : Latent ty.Int\" using a bi_ty_elim[of \\ NumberP \"U\"] by auto\n\thence c:\"S = ty.Int\" using prems arr_sub_arr_cases[of Top _ _ T0 T1 \"Latent S\"] latent_eff.inject by auto\n from b have d:\"T = ty.Int\" using num_ty_elim by auto\n from c d have \"\\ T <: S\" by auto\n thus ?thesis using prems by auto\n qed\n thus ?case using num_value by auto\n qed (auto)\n\nlemma numberp_TT_preserved:\n assumes \"\\ \\ (App (BI NumberP) v) : T1 ; TT\" and \"v : values\" and \"\\ NumberP v = Some u\"\n shows \"u = Bool True\"\n proof -\n note app_ty_tt_elim[of \\ \"(BI NumberP)\" v T1]\n then obtain A1 U T0 T1 S eff1 eff2 where \n A:\"\\ \\ (BI NumberP) : U ; eff1\" \"\\ U <: A1 \\ T1 : Latent S\" \"\\ \\ v : T0 ; eff2\" \"\\ T0 <: A1\" \"\\ T0 <: S\"\n using prems by auto\n hence B:\"U = Top \\ BoolTy : Latent ty.Int \" using bi_ty_elim[of \\ NumberP U] by auto\n hence C:\"\\ T0 <: ty.Int\" \n using prems arr_sub_arr_cases[of Top BoolTy \"Latent ty.Int\" _ _ \"Latent S\"] latent_eff.inject A by auto\n then obtain b where D:\"v = Num b\" using A int_value[of v \\ T0] prems by auto\n thus ?thesis using prems by auto\n qed\n\nlemma numberp_soundness_eff:\n assumes \"\\ \\ App (BI NumberP) v : T ; F\" and \"v : values\" and \"\\ NumberP v = Some u\" and \"\\ \\ u : T' ; F'\"\n shows \"\\ F' T' F'] numberp_FF_preserved by auto \n next\n case TT thus ?case using true_ty_elim[of \\ T' F'] numberp_TT_preserved by auto \n qed\n qed\n\nlemma empty_un_bot:\n fixes T :: ty\n shows \"\\ Union [] <: T\"\n by auto\n\nlemma all_fun_ty_below:\n fixes S T :: ty\n shows \"\\ S \\ T : F <: (Union []) \\ Top : latent_eff.NE\"\n by (rule S_Fun) auto\n\ninductive_cases below_latent_ne_cases: \"\\ S \\ T : F <: S' \\ T' : latent_eff.NE\"\nthm below_latent_ne_cases\n\ninductive_cases app_procp_ff: \"\\ \\ (App (BI ProcP) v) : T1 ; FF\"\nthm app_nump_ff\nthm app_procp_ff\n\nlemma procp_FF_preserved:\n assumes \"\\ \\ (App (BI ProcP) v) : T1 ; FF\" and \"v : values\" and \"\\ ProcP v = Some u\"\n shows \"u = Bool False\"\n using `v : values` prems\n proof (nominal_induct v avoiding: \\ rule: values.strong_induct)\n case (bool_value b) thus ?case by (cases b) auto \n next\n case (num_value b) thus ?case by auto \n next\n case (abs_value x t b) \n let ?P = \"\\ \\ App (BI ProcP) (Lam[x:t].b) : T1 ; FF\" \n have \"?P ==> ?case\"\n proof (ind_cases ?P)\n fix e1 U eff1 T0 S e2 T eff2\n assume \"App (BI ProcP) (Lam [x:t].b) = App e1 e2 \"\" \\ \\ e1 : U ; eff1 \"\" \\ U <: T0 \\ T1 : Latent S \"\n\t \"\\ \\ e2 : T ; eff2 \"\" \\ T <: T0 \"\" \\ \\ T <: S \"\" e2 \\ values \"\" closed e2\"\n hence a:\"\\ \\ (BI ProcP) : U ; eff1 \" using trm.inject by auto\n from prems have b:\"\\ \\ Lam[x:t].b : T ; eff2\" using trm.inject by auto\n\thave \"U = Top \\ BoolTy : Latent (Union [] \\ Top : latent_eff.NE)\" using a bi_ty_elim[of \\ ProcP \"U\"] by auto\n\thence c:\"S = Union [] \\ Top : latent_eff.NE\" using prems arr_sub_arr_cases[of Top _ _ T0 T1 \"Latent S\"] latent_eff.inject by auto\n have \"EX A1 A2 L. T = A1 \\ A2 : L\" using abs_ty_elim[OF b `x \\ \\`] by auto\n\tthen obtain A1 A2 L where d:\"T = A1 \\ A2 : L\" by auto\n from c d have \"\\ T <: S\" using all_fun_ty_below by auto\n thus ?thesis using prems by auto\n qed\n thus ?case using abs_value by auto\n next\n case (bi_value c)\n let ?P = \"\\ \\ App (BI ProcP) (BI c) : T1 ; FF\" \n have \"?P ==> ?case\"\n proof (ind_cases ?P)\n fix e1 U eff1 T0 S e2 T eff2\n assume \"App (BI ProcP) (BI c) = App e1 e2 \"\" \\ \\ e1 : U ; eff1 \"\" \\ U <: T0 \\ T1 : Latent S \"\n\t\"\\ \\ e2 : T ; eff2 \"\" \\ T <: T0 \"\" \\ \\ T <: S \"\" e2 \\ values \"\" closed e2\"\n hence a:\"\\ \\ (BI ProcP) : U ; eff1 \" using trm.inject by auto\n from prems have b:\"\\ \\ (BI c) : T ; eff2\" using trm.inject by auto\n have \"U = Top \\ BoolTy : Latent (Union [] \\ Top : latent_eff.NE)\" using a bi_ty_elim[of \\ ProcP \"U\"] by auto\n hence c:\"S = Union [] \\ Top : latent_eff.NE\" using prems arr_sub_arr_cases[of Top _ _ T0 T1 \"Latent S\"] latent_eff.inject by auto\n have b':\"T = \\\\<^isub>\\ c\" using bi_ty_elim[OF b] by auto\n hence \"EX A1 A2 FA. T = A1 \\ A2 : FA\" by (nominal_induct c rule: builtin.induct) auto\n then obtain A1 A2 F where d:\"T = A1 \\ A2 : F\" by auto\n hence \"\\ T <: S\" using c d all_fun_ty_below by auto\n thus ?thesis using prems by auto\n qed\n thus ?case using bi_value by auto\n qed \n\nlemma proc_value:\n assumes \"\\ \\ v : T ; F\"\n and \"v : values\"\n and \"\\ T <: (A1 \\ A2 : latent_eff.NE)\"\n shows \"EX x b t. v = Lam[x:t].b \\ (EX c. v = BI c)\"\n using `v : values` prems\nproof (nominal_induct v avoiding: \\ rule: values.strong_induct)\n case abs_value thus ?case by auto\nnext\n case (bool_value b)\n hence \"T = ty.TT \\ T = ty.FF\" using bool_ty_elim by auto\n thus ?case using sub_arr_cases[of T A1 A2 latent_eff.NE] using bool_value by auto\nnext\n case (num_value b)\n hence \"T = ty.Int\" using num_ty_elim by auto\n thus ?case using sub_arr_cases[of T A1 A2 latent_eff.NE] using num_value by auto\nnext\n case (bi_value c) thus ?case by auto\nqed\n \n\nlemma procp_TT_preserved:\n assumes \"\\ \\ (App (BI ProcP) v) : T1 ; TT\" and \"v : values\" and \"\\ ProcP v = Some u\"\n shows \"u = Bool True\"\n proof -\n note app_ty_tt_elim[of \\ \"(BI ProcP)\" v T1]\n then obtain A1 U T0 T1 S eff1 eff2 where \n A:\"\\ \\ (BI ProcP) : U ; eff1\" \"\\ U <: A1 \\ T1 : Latent S\" \"\\ \\ v : T0 ; eff2\" \"\\ T0 <: A1\" \"\\ T0 <: S\"\n using prems by auto\n hence B:\"U = Top \\ BoolTy : Latent (Union [] \\ Top : latent_eff.NE) \" using bi_ty_elim[of \\ ProcP U] by auto\n hence C:\"\\ T0 <: (Union [] \\ Top : latent_eff.NE)\" \n using prems arr_sub_arr_cases[of Top BoolTy \"Latent (Union [] \\ Top : latent_eff.NE)\" _ _ \"Latent S\"] latent_eff.inject A \n by auto\n moreover\n {\n assume D:\"EX x b t. v = Lam[x:t].b\"\n then obtain x b t where \"v = Lam[x:t].b\" by auto\n hence ?thesis using prems by auto\n }\n moreover\n {\n assume \"EX c. v = BI c\"\n then obtain c where \"v = BI c\" by auto\n hence ?thesis using prems by (nominal_induct c rule: builtin.induct) auto\n }\n ultimately show ?thesis using prems proc_value[of \\ v T0 eff2 \"Union []\" Top] by auto\n qed\n\nlemma procp_soundness_eff:\n assumes \"\\ \\ App (BI ProcP) v : T ; F\" and \"v : values\" and \"\\ ProcP v = Some u\" and \"\\ \\ u : T' ; F'\"\n shows \"\\ F' T' F'] procp_FF_preserved by auto \n next\n case TT thus ?case using true_ty_elim[of \\ T' F'] procp_TT_preserved by auto \n qed\n qed\n\n\ntext {* soundness of the \\ rule *}\n\nlemma bool_sub_boolty[simp]: \"\\ ty.FF <: BoolTy\" \"\\ ty.TT <: BoolTy\" by auto\n\n\nlemma delta_soundness:\n assumes \"\\\\<^isub>\\ b = (T0 \\ T1 : le)\" and \"v : values\" and \"\\ \\ v : T ; eff1\" and \"\\ T <: T0\" \n and \"\\ \\ (App (BI b) v) : T1' ; eff\" and \"\\ T1 <: T1'\"\n and \"\\ b v = Some u\" and \"valid \\\"\n shows \"EX eff' T1'. \\ \\ u : T1' ; eff' \\ \\ eff' \\ T1' <: T1\"\n using prems\nproof (nominal_induct b rule: builtin.induct)\n case Add1\n hence a:\"eff = NE\" using add1_eff_ne[of \\ v T1' eff] by auto\n have \"EX eff'. \\ \\ u : T1 ; eff'\" using `v : values` `valid \\` Add1\n by (induct v rule: values.induct) (auto simp add: ty.inject)\n then obtain eff' where b:\"\\ \\ u : T1 ; eff'\" by auto\n have \"simple_eff eff'\" using delta_closed[of Add1 v u] closed_eff b Add1 by auto\n hence c:\"\\ eff' v T1' eff] by auto\n have \"EX eff' T1'. \\ \\ u : T1' ; eff' \\ \\ T1' <: T1\" using `v : values` `valid \\` Nott\n proof (induct v rule: values.induct) \n case (bool_value b)\n thus ?case using bool_value bool_sub_boolty by (cases b) auto\n next\n case num_value thus ?case using bool_sub_boolty by auto\n next\n case bi_value thus ?case using bool_sub_boolty by auto\n next\n case abs_value thus ?case using bool_sub_boolty by auto\n qed \n then obtain eff' T1' where b:\"\\ \\ u : T1' ; eff'\" and b':\"\\ T1' <: T1\" by auto\n have \"simple_eff eff'\" using delta_closed[of Nott v u] closed_eff b Nott by auto\n hence c:\"\\ eff' \" using typing_valid prems by auto\n have \"T1 = BoolTy\" using BooleanP by (simp add: ty.inject)\n then obtain bb where veq:\"\\ BooleanP v = Some (Bool bb)\" by (nominal_induct v rule: trm.induct) (auto)\n hence \"EX T1' eff'. \\ \\ u : T1' ; eff' \\ \\ T1' <: T1\" \n using `T1 = BoolTy` BooleanP bool_sub_boolty\n proof (cases bb)\n case True\n hence \"u = Bool True\" using veq BooleanP by auto\n hence \"\\ \\ u : ty.TT; TT\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n next\n case False\n hence \"u = Bool False\" using veq BooleanP by auto\n hence \"\\ \\ u : ty.FF; FF\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n qed\n then obtain T1a eff' where a:\"\\ \\ u : T1a ; eff'\" and a':\"\\ T1a <: T1\" by auto\n have c:\"simple_eff eff'\" using delta_closed[of BooleanP v u] closed_eff prems by auto \n have b:\"simple_eff eff\" using BooleanP booleanp_eff_simple by auto\n hence \"\\ eff' \\ App (BI BooleanP) v : T1' ; eff` `\\ BooleanP v = Some u` by auto\n hence \"eff'= FF\" using a false_ty_elim by auto\n thus ?case using FF by auto\n next\n case TT\n hence \"u = Bool True\" \n using booleanp_TT_preserved `v : values` `\\ \\ App (BI BooleanP) v : T1' ; eff` `\\ BooleanP v = Some u` by auto\n hence \"eff'= TT\" using a true_ty_elim by auto\n thus ?case using TT by auto\n qed\n thus ?case using a a' by auto\nnext\n case NumberP\n have \"valid \\\" using typing_valid prems by auto\n have \"T1 = BoolTy\" using NumberP by (simp add: ty.inject)\n then obtain bb where veq:\"\\ NumberP v = Some (Bool bb)\" by (nominal_induct v rule: trm.induct) (auto)\n hence \"EX T1' eff'. \\ \\ u : T1' ; eff' \\ \\ T1' <: T1\" \n using `T1 = BoolTy` NumberP bool_sub_boolty\n proof (cases bb)\n case True\n hence \"u = Bool True\" using veq NumberP by auto\n hence \"\\ \\ u : ty.TT; TT\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n next\n case False\n hence \"u = Bool False\" using veq NumberP by auto\n hence \"\\ \\ u : ty.FF; FF\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n qed\n then obtain T1a eff' where a:\"\\ \\ u : T1a ; eff'\" and a':\"\\ T1a <: T1\" by auto\n have c:\"simple_eff eff'\" using delta_closed[of NumberP v u] closed_eff prems by auto \n have b:\"simple_eff eff\" using NumberP numberp_eff_simple by auto\n hence \"\\ eff' \\ App (BI NumberP) v : T1' ; eff` `\\ NumberP v = Some u` by auto\n hence \"eff'= FF\" using a false_ty_elim by auto\n thus ?case using FF by auto\n next\n case TT\n hence \"u = Bool True\" \n using numberp_TT_preserved `v : values` `\\ \\ App (BI NumberP) v : T1' ; eff` `\\ NumberP v = Some u` by auto\n hence \"eff'= TT\" using a true_ty_elim by auto\n thus ?case using TT by auto\n qed\n thus ?case using a a' by auto\nnext\n case ProcP\n have \"valid \\\" using typing_valid prems by auto\n have \"T1 = BoolTy\" using ProcP by (simp add: ty.inject)\n then obtain bb where veq:\"\\ ProcP v = Some (Bool bb)\" by (nominal_induct v rule: trm.induct) (auto)\n hence \"EX T1' eff'. \\ \\ u : T1' ; eff' \\ \\ T1' <: T1\" \n using `T1 = BoolTy` ProcP bool_sub_boolty\n proof (cases bb)\n case True\n hence \"u = Bool True\" using veq ProcP by auto\n hence \"\\ \\ u : ty.TT; TT\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n next\n case False\n hence \"u = Bool False\" using veq ProcP by auto\n hence \"\\ \\ u : ty.FF; FF\" using `valid \\` by auto\n thus ?thesis using `T1 = BoolTy` bool_sub_boolty by auto\n qed\n then obtain T1a eff' where a:\"\\ \\ u : T1a ; eff'\" and a':\"\\ T1a <: T1\" by auto\n have c:\"simple_eff eff'\" using delta_closed[of ProcP v u] closed_eff prems by auto \n have b:\"simple_eff eff\" using ProcP procp_eff_simple by auto\n hence \"\\ eff' \\ App (BI ProcP) v : T1' ; eff` `\\ ProcP v = Some u` by auto\n hence \"eff'= FF\" using a false_ty_elim by auto\n thus ?case using FF by auto\n next\n case TT\n hence \"u = Bool True\" \n using procp_TT_preserved `v : values` `\\ \\ App (BI ProcP) v : T1' ; eff` `\\ ProcP v = Some u` by auto\n hence \"eff'= TT\" using a true_ty_elim by auto\n thus ?case using TT by auto\n qed\n thus ?case using a a' by auto\nqed\n\nlemma simple_eff_below_ve:\n assumes \"simple_eff F\"\n shows \"\\ F F F F = VE x\"\n using prems\n by induct auto\n\nconsts\n remove_env :: \"'a list => 'a => 'a list\" (\"_ - _\" [100,100] 100)\n\nprimrec\n \"[] - x = []\"\n \"(y#xs) - x = (if x=y then (xs - x) else y#(xs - x))\"\n\nlemma fresh_remove:\n fixes a::\"name\"\n and \\::\"(name\\ty) list\"\n assumes a: \"a\\\\\"\n shows \"a\\(\\ - (x,T))\"\nusing a\nby (induct \\) (auto simp add: fresh_list_cons)\n\nlemma valid_remove:\n fixes pair::\"name\\ty\"\n assumes a: \"valid \\\"\n shows \"valid (\\ - (x,T))\"\nusing a\nby (induct \\) (auto simp add: fresh_remove)\n\nlemma set_remove:\n assumes a: \"(a,T)\\set \\\"\n and b: \"a\\x\"\n shows \"(a,T)\\set (\\ - (x,T'))\"\nusing a b\nby (induct \\) (auto)\n\nlemma closed_elim:\"closed e \\ (supp e = ({}::name set))\" using closed_def by auto\n\nlemma set_remove_comm:\n shows \"set (l - a) = (set l) - {a}\"\n by (induct l) auto\n\n\nlemma envplus_set:\n shows \"set (\\ |+ TE T x) = (mapfun restrict T x) ` set \\\"\nproof -\n have A:\"!! a b. a = b \\ set a = set b\" by auto\n have \"\\ |+ TE T x = map (mapfun restrict T x) \\\" by auto\n hence \"set (\\ |+ TE T x) = set (map (mapfun restrict T x) \\)\" \n using A[of \"(\\ |+ TE T x)\" \"map (mapfun restrict T x) \\\"] by auto\n also have \"\\ = (mapfun restrict T x) ` set \\\" by auto\n ultimately show ?thesis by auto\nqed\n\nlemma envminus_set:\n shows \"set (\\ |- TE T x) = (mapfun remove T x) ` set \\\"\nproof -\n have A:\"!! a b. a = b \\ set a = set b\" by auto\n have \"\\ |- TE T x = map (mapfun remove T x) \\\" by auto\n hence \"set (\\ |- TE T x) = set (map (mapfun remove T x) \\)\" \n using A[of \"(\\ |- TE T x)\" \"map (mapfun remove T x) \\\"] by auto\n also have \"\\ = (mapfun remove T x) ` set \\\" by auto\n ultimately show ?thesis by auto\nqed\n\n\n\nlemma envplus_set_ve:\n shows \"set (\\ |+ VE x) = (mapfun remove ty.FF x) ` set \\\"\nproof -\n have A:\"!! a b. a = b \\ set a = set b\" by auto\n have \"\\ |+ VE x = map (mapfun remove ty.FF x) \\\" by auto\n hence \"set (\\ |+ VE x) = set (map (mapfun remove ty.FF x) \\)\" \n using A[of \"(\\ |+ VE x)\" \"map (mapfun remove ty.FF x) \\\"] by auto\n also have \"\\ = (mapfun remove ty.FF x) ` set \\\" by auto\n ultimately show ?thesis by auto\nqed\n\nlemma envminus_set_ve:\n shows \"set (\\ |- VE x) = (mapfun replace ty.FF x) ` set \\\"\nproof -\n have A:\"!! a b. a = b \\ set a = set b\" by auto\n have \"\\ |- VE x = map (mapfun replace ty.FF x) \\\" by auto\n hence \"set (\\ |- VE x) = set (map (mapfun replace ty.FF x) \\)\" \n using A[of \"(\\ |- VE x)\" \"map (mapfun replace ty.FF x) \\\"] by auto\n also have \"\\ = (mapfun replace ty.FF x) ` set \\\" by auto\n ultimately show ?thesis by auto\nqed\n\n\nlemma fresh_weakening:\n assumes a:\"x\\e\" and b:\"\\ \\ e : T ; F\" and c: \"valid \\\" \n shows \"(\\ - (x,T')) \\ e : T ; F\"\n using b a c \nproof (nominal_induct \\ e T F avoiding: x T' rule: typing.strong_induct)\n case T_Var thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case (T_App \\' _ _ t1 t2) thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)\nnext\n case T_Abs thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_AbsPred thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_AppPred thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_IfTrue thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_IfFalse thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_True thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_False thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_Num thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case T_Const thus ?case\n by(force simp add: fresh_atm abs_fresh set_remove valid_remove fresh_remove)+\nnext\n case (T_AppPredTrue \\' e1 U F1 T0 T1 S e2 T F2 x T')\n have A:\"x \\ e1\" \"x \\ e2\" using T_AppPredTrue by auto\n hence \"\\' - (x,T') \\ e1 : U; F1\" using T_AppPredTrue by auto\n also have \"\\' - (x,T') \\ e2 : T ; F2\" using T_AppPredTrue A by auto\n ultimately show ?case using T_AppPredTrue(3) `\\ T <: T0` `\\ T <: S` by auto\nnext\n case (T_AppPredFalse \\' e1 U F1 T0 T1 S e2 T F2 x T')\n have A:\"x \\ e1\" \"x \\ e2\" using T_AppPredFalse by auto\n hence \"\\' - (x,T') \\ e1 : U ; F1\" using T_AppPredFalse by auto\n also have \"\\' - (x,T') \\ e2 : T ; F2\" using T_AppPredFalse A by auto\n ultimately show ?case using `~ (\\ T <: S)` `\\ T <: T0` `e2 : values` `closed e2` T_AppPredFalse(3) by auto\nnext\n case (T_If \\' e1 T1 F1 e2 T2 F2 e3 T3 F3 T x)\n have A:\"x \\ e1\" \"x \\ e2\" \"x \\ e3\" using T_If by auto\n have \"\\' - (x,T') \\ e1 : T1 ; F1\" using T_If A by auto\n thus ?case using T_If\n proof (nominal_induct \"F1\" rule: eff.induct)\n case NE\n from NE have 1:\"\\' - (x, T') \\ e1 : T1 ; eff.NE\" by auto\n from NE have 2:\"(\\' - (x, T') |+ eff.NE) \\ e2 : T2 ; F2\" by auto\n from NE have 3:\"(\\' - (x, T') |- eff.NE) \\ e3 : T3 ; F3\" by auto\n from 1 2 3 show ?case using `\\ T2 <: T` `\\ T3 <: T` ..\n next\n case TT\n from TT have 1:\"\\' - (x, T') \\ e1 : T1 ; eff.TT\" by auto\n from TT have 2:\"(\\' - (x, T') |+ eff.TT) \\ e2 : T2 ; F2\" by auto\n from 1 2 show ?case using `\\ T2 <: T` by auto\n next\n case FF\n from FF have 1:\"\\' - (x, T') \\ e1 : T1 ; eff.FF\" by auto\n from FF have 3:\"(\\' - (x, T') |+ eff.FF) \\ e3 : T3 ; F3\" by auto\n from 1 3 show ?case using `\\ T3 <: T` by auto \n next\n case (VE z)\n from VE have 1:\"\\' - (x, T') \\ e1 : T1 ; VE z\" by auto\n have val1:\"valid (\\' |+ VE z)\" using VE envplus_valid[of \\' \"VE z\"] by auto\n have val2:\"valid (\\' |- VE z)\" using VE envminus_valid[of \\' \"VE z\"] by auto\n have \"valid (\\' |- VE z)\" using VE envminus_valid[of \\' \"VE z\"] by auto\n have A0:\"!!T0 . (\\' |- VE z) - (x, T0) \\ e3 : T3 ; F3\" using VE(7) A `valid (\\' |- VE z)` by auto\n\n have A:\"!!T0 . (\\' |+ VE z) - (x, T0) \\ e2 : T2 ; F2\" using VE(5) A `valid (\\' |+ VE z)` by auto\n let ?op = \"replace\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op ty.FF ty) else (v,ty)))\"\n have B:\"!! p. set ((\\' |+ VE z) - p) = ((mapfun remove ty.FF z) ` (set \\')) - {p}\" \n\tusing envplus_set_ve set_remove_comm[of \"(\\' |+ VE z)\"] by auto\n have image_lem:\"!! f S v. (f ` S) - {(f v)} <= (f ` (S - {v}))\" by auto\n note image_lem[of \"mapfun remove ty.FF z\" \"set \\'\" \"(x,T0)\"]\n \n have eq1:\"!! p. mapfun remove ty.FF z ` set \\' - {mapfun remove ty.FF z p} = set ((\\' |+ VE z) - (mapfun remove ty.FF z p))\" using envplus_set_ve set_remove_comm[of \"(\\' |+ VE z)\"] by auto\n\n have eq2:\"!! p. mapfun remove ty.FF z ` (set \\' - {p}) = set (\\' - p |+ VE z)\"\n proof -\n\tfix p\n\tshow \"mapfun remove ty.FF z ` (set \\' - {p}) = set (\\' - p |+ VE z)\"\n\t using envplus_set_ve[of _ \"\\' - p\"] set_remove_comm[of \\'] by auto\n qed\n have eq3:\"!! x T0. mapfun remove ty.FF z (x,T0) = (x, (if (x = z) then (remove ty.FF T0) else (T0)))\" by auto\n let ?removeT' = \"(if (x = z) then (remove ty.FF T') else (T'))\"\n have goal:\"((\\' |+ VE z) - (x,?removeT')) \\ ((\\' - (x,T')) |+ VE z)\"\n proof -\n\thave \" mapfun remove ty.FF z ` set \\' - {mapfun remove ty.FF z (x,T')} <= \n\t mapfun remove ty.FF z ` (set \\' - {(x,T')})\" using image_lem[of \"mapfun remove ty.FF z\" \"set \\'\" \"(x,T')\"] by auto\n\thence \" mapfun remove ty.FF z ` set \\' - {mapfun remove ty.FF z (x,T')} <= \n\t set ((\\' - ((x,T'))) |+ VE z)\" using eq2[of \" (x, T')\"] by auto\n\thence \"set ((\\' |+ VE z) - (mapfun remove ty.FF z (x,T'))) <= \n\t set ((\\' - ((x,T'))) |+ VE z)\" \n\t using eq1[of \"(x,T')\"] by auto\n\thence \"set ((\\' |+ VE z) - (x,?removeT')) <= set ((\\' - (x,T')) |+ VE z)\" using eq3 by auto\n\tthus ?thesis by auto\n qed\n have val3:\"valid ((\\' |+ VE z) - (x,?removeT'))\" using val1 valid_remove by auto\n have \"valid ((\\' - (x, T')))\" using `valid \\'` valid_remove envplus_valid by auto\n hence val4:\"valid ((\\' - (x, T')) |+ VE z)\" using envplus_valid[of \"\\' - (x, T')\" \"VE z\"] by auto\n from A have \"(\\' |+ VE z) - (x,?removeT') \\ e2 : T2 ; F2\" by auto\n hence 2:\"(\\' - (x, T')) |+ VE z \\ e2 : T2 ; F2\" using goal val3 val4\n\tweakening[of \"(\\' |+ VE z) - (x,?removeT')\" e2 T2 F2 \"\\' - (x,T') |+ VE z\"] by auto\n\n have eq4:\"!! p. mapfun replace ty.FF z ` set \\' - {mapfun replace ty.FF z p} = set ((\\' |- VE z) - (mapfun replace ty.FF z p))\" using envminus_set_ve[of _ \\'] set_remove_comm[of \"(\\' |- VE z)\"] by auto\n\n have eq5:\"!! p. mapfun replace ty.FF z ` (set \\' - {p}) = set (\\' - p |- VE z)\"\n proof -\n\tfix p\n\tshow \"mapfun replace ty.FF z ` (set \\' - {p}) = set (\\' - p |- VE z)\"\n\t using envminus_set_ve[of _ \"\\' - p\" ] set_remove_comm[of \\'] by auto\n qed\n have eq6:\"!! x T0. mapfun replace ty.FF z (x,T0) = (x, (if (x = z) then (replace ty.FF T0) else (T0)))\" by auto\n let ?replaceT' = \"(if (x = z) then (replace ty.FF T') else (T'))\"\n have goal':\"((\\' |- VE z) - (x,?replaceT')) \\ ((\\' - (x,T')) |- VE z)\"\n proof -\n\thave \" mapfun replace ty.FF z ` set \\' - {mapfun replace ty.FF z (x,T')} <= \n\t mapfun replace ty.FF z ` (set \\' - {(x,T')})\" using image_lem[of \"mapfun replace ty.FF z\" \"set \\'\" \"(x,T')\"] by auto\n\thence \" mapfun replace ty.FF z ` set \\' - {mapfun replace ty.FF z (x,T')} <= \n\t set ((\\' - ((x,T'))) |- VE z)\" using eq5[of \" (x, T')\"] by auto\n\thence \"set ((\\' |- VE z) - (mapfun replace ty.FF z (x,T'))) <= \n\t set ((\\' - ((x,T'))) |- VE z)\" \n\t using eq4[of \"(x,T')\"] by auto\n\thence \"set ((\\' |- VE z) - (x,?replaceT')) <= set ((\\' - (x,T')) |- VE z)\" using eq6 by auto\n\tthus ?thesis by auto\n qed\n have val5:\"valid ((\\' |- VE z) - (x,?replaceT'))\" using val2 valid_remove by auto\n have \"valid ((\\' - (x, T')))\" using `valid \\'` valid_remove envminus_valid by auto\n hence val6:\"valid ((\\' - (x, T')) |- VE z)\" using envminus_valid[of \"\\' - (x, T')\" \"VE z\"] by auto\n from A0 have \"(\\' |- VE z) - (x,?replaceT') \\ e3 : T3 ; F3\" by auto\n hence 3:\"(\\' - (x, T')) |- VE z \\ e3 : T3 ; F3\" using goal' val5 val6\n\tweakening[of \"(\\' |- VE z) - (x,?replaceT')\" e3 T3 F3 \"\\' - (x,T') |- VE z\"] by auto\n from 1 2 3 show ?case using `\\ T2 <: T` `\\ T3 <: T` ..\n next\n case (TE U z)\n from TE have 1:\"\\' - (x, T') \\ e1 : T1 ; TE U z\" by auto\n have val1:\"valid (\\' |+ TE U z)\" using TE envplus_valid[of \\' \"TE U z\"] by auto\n have val2:\"valid (\\' |- TE U z)\" using TE envminus_valid[of \\' \"TE U z\"] by auto\n have \"valid (\\' |- TE U z)\" using TE envminus_valid[of \\' \"TE U z\"] by auto\n have A0:\"!!T0 . (\\' |- TE U z) - (x, T0) \\ e3 : T3 ; F3\" using TE(7) A `valid (\\' |- TE U z)` by auto\n\n have A:\"!!T0 . (\\' |+ TE U z) - (x, T0) \\ e2 : T2 ; F2\" using TE(5) A `valid (\\' |+ TE U z)` by auto\n let ?op = \"remove\"\n let ?mapfun = \"(% (v,ty). (if (x = v) then (v,?op S ty) else (v,ty)))\"\n have B:\"!! p. set ((\\' |+ TE U z) - p) = ((mapfun restrict U z) ` (set \\')) - {p}\" \n\tusing envplus_set set_remove_comm[of \"(\\' |+ TE U z)\"] by auto\n have image_lem:\"!! f S v. (f ` S) - {(f v)} <= (f ` (S - {v}))\" by auto\n note image_lem[of \"mapfun restrict U z\" \"set \\'\" \"(x,T0)\"]\n \n have eq1:\"!! p. mapfun restrict U z ` set \\' - {mapfun restrict U z p} = set ((\\' |+ TE U z) - (mapfun restrict U z p))\" using envplus_set set_remove_comm[of \"(\\' |+ TE U z)\"] by auto\n\n have eq2:\"!! p. mapfun restrict U z ` (set \\' - {p}) = set (\\' - p |+ TE U z)\"\n proof -\n\tfix p\n\tshow \"mapfun restrict U z ` (set \\' - {p}) = set (\\' - p |+ TE U z)\"\n\t using envplus_set[of _ _ \"\\' - p\"] set_remove_comm[of \\'] by auto\n qed\n have eq3:\"!! x T0. mapfun restrict U z (x,T0) = (x, (if (x = z) then (restrict U T0) else (T0)))\" by auto\n let ?restrictT' = \"(if (x = z) then (restrict U T') else (T'))\"\n have goal:\"((\\' |+ TE U z) - (x,?restrictT')) \\ ((\\' - (x,T')) |+ TE U z)\"\n proof -\n\thave \" mapfun restrict U z ` set \\' - {mapfun restrict U z (x,T')} <= \n\t mapfun restrict U z ` (set \\' - {(x,T')})\" using image_lem[of \"mapfun restrict U z\" \"set \\'\" \"(x,T')\"] by auto\n\thence \" mapfun restrict U z ` set \\' - {mapfun restrict U z (x,T')} <= \n\t set ((\\' - ((x,T'))) |+ TE U z)\" using eq2[of \" (x, T')\"] by auto\n\thence \"set ((\\' |+ TE U z) - (mapfun restrict U z (x,T'))) <= \n\t set ((\\' - ((x,T'))) |+ TE U z)\" \n\t using eq1[of \"(x,T')\"] by auto\n\thence \"set ((\\' |+ TE U z) - (x,?restrictT')) <= set ((\\' - (x,T')) |+ TE U z)\" using eq3 by auto\n\tthus ?thesis by auto\n qed\n have val3:\"valid ((\\' |+ TE U z) - (x,?restrictT'))\" using val1 valid_remove by auto\n have \"valid ((\\' - (x, T')))\" using `valid \\'` valid_remove envplus_valid by auto\n hence val4:\"valid ((\\' - (x, T')) |+ TE U z)\" using envplus_valid[of \"\\' - (x, T')\" \"TE U z\"] by auto\n from A have \"(\\' |+ TE U z) - (x,?restrictT') \\ e2 : T2 ; F2\" by auto\n hence 2:\"(\\' - (x, T')) |+ TE U z \\ e2 : T2 ; F2\" using goal val3 val4\n\tweakening[of \"(\\' |+ TE U z) - (x,?restrictT')\" e2 T2 F2 \"\\' - (x,T') |+ TE U z\"] by auto\n\n have eq4:\"!! p. mapfun remove U z ` set \\' - {mapfun remove U z p} = set ((\\' |- TE U z) - (mapfun remove U z p))\" using envminus_set[of _ _ \\'] set_remove_comm[of \"(\\' |- TE U z)\"] by auto\n\n have eq5:\"!! p. mapfun remove U z ` (set \\' - {p}) = set (\\' - p |- TE U z)\"\n proof -\n\tfix p\n\tshow \"mapfun remove U z ` (set \\' - {p}) = set (\\' - p |- TE U z)\"\n\t using envminus_set[of _ _ \"\\' - p\" ] set_remove_comm[of \\'] by auto\n qed\n have eq6:\"!! x T0. mapfun remove U z (x,T0) = (x, (if (x = z) then (remove U T0) else (T0)))\" by auto\n let ?removeT' = \"(if (x = z) then (remove U T') else (T'))\"\n have goal':\"((\\' |- TE U z) - (x,?removeT')) \\ ((\\' - (x,T')) |- TE U z)\"\n proof -\n\thave \" mapfun remove U z ` set \\' - {mapfun remove U z (x,T')} <= \n\t mapfun remove U z ` (set \\' - {(x,T')})\" using image_lem[of \"mapfun remove U z\" \"set \\'\" \"(x,T')\"] by auto\n\thence \" mapfun remove U z ` set \\' - {mapfun remove U z (x,T')} <= \n\t set ((\\' - ((x,T'))) |- TE U z)\" using eq5[of \" (x, T')\"] by auto\n\thence \"set ((\\' |- TE U z) - (mapfun remove U z (x,T'))) <= \n\t set ((\\' - ((x,T'))) |- TE U z)\" \n\t using eq4[of \"(x,T')\"] by auto\n\thence \"set ((\\' |- TE U z) - (x,?removeT')) <= set ((\\' - (x,T')) |- TE U z)\" using eq6 by auto\n\tthus ?thesis by auto\n qed\n have val5:\"valid ((\\' |- TE U z) - (x,?removeT'))\" using val2 valid_remove by auto\n have \"valid ((\\' - (x, T')))\" using `valid \\'` valid_remove envminus_valid by auto\n hence val6:\"valid ((\\' - (x, T')) |- TE U z)\" using envminus_valid[of \"\\' - (x, T')\" \"TE U z\"] by auto\n from A0 have \"(\\' |- TE U z) - (x,?removeT') \\ e3 : T3 ; F3\" by auto\n hence 3:\"(\\' - (x, T')) |- TE U z \\ e3 : T3 ; F3\" using goal' val5 val6\n\tweakening[of \"(\\' |- TE U z) - (x,?removeT')\" e3 T3 F3 \"\\' - (x,T') |- TE U z\"] by auto\n from 1 2 3 show ?case using `\\ T2 <: T` `\\ T3 <: T` ..\n qed\n qed\n\nlemma fresh_weakening_cons:\n assumes \"valid ((a,S)#\\)\" (is \"valid ?\\\") and \"(a,S)# \\ \\ e : T ; F\" and \"a \\ e\"\n shows \"\\ \\ e : T ; F\"\n proof -\n have v1:\"valid \\\" using prems valid_elim by blast\n hence v2:\"valid (\\ - (a,S))\" using valid_remove by auto\n have A:\"?\\ - (a,S) \\ e : T ; F\" using prems fresh_weakening[of a e ?\\ T F S] by auto\n have \"?\\ - (a,S) = \\ - (a,S)\" by auto\n hence B:\"\\ - (a,S) \\ \\\" by (induct \\) auto\n thus ?thesis using A weakening[of _ e T F \\] v1 v2 by auto\n qed\n \n\nlemma closed_empty_env:\n assumes \"closed e\" and \"\\ \\ e : T ; F\" and \"valid \\\"\n shows \"[] \\ e : T ; F\"\n using `valid \\` prems\n proof (induct \\ rule: valid.induct)\n case v1 thus ?case by simp\n next\n case (v2 \\' a S)\n have \"a \\ e\" using `closed e` closed_def fresh_def[of a e] by auto\n thus ?case using v2 fresh_weakening_cons by auto\n qed\n\n\n\nlemma closed_any_env:\n assumes \"closed e\" and \"\\ \\ e : T ; F\" and val1:\"valid \\\" and val2:\"valid \\'\"\n shows \"\\' \\ e : T ; F\"\n using prems closed_empty_env weakening \n proof -\n have A:\"[] \\ e : T ; F\" using prems closed_empty_env by auto\n note weakening\n have B:\"[] \\ \\'\" by auto\n from A B val1 val2 have \"\\' \\ e : T ; F\" using weakening by blast\n thus ?thesis by simp\n qed \n\ninductive_cases ve_ty_elim: \"\\ \\ e : T ; VE x\" \n\nlemma te_ty_elim: \n \"\\ \\ t1 : T ; TE U z \\\n EX f A A1 Fn S B. t1 = (App f (Var z)) \\ \\ \\ f : B ; Fn \\ \\ B <: A1 \\ T : Latent U \\\n \\ \\ (Var z) : A ; VE z \\ \\ A <: A1 \"\n proof (ind_cases \"\\ \\ t1 : T ; TE U z\")\n fix e1 T0 eff1 e2 Ta x S B\n assume \"t1 = App e1 e2\" \"TE U z = TE S x\"\n \"\\ \\ e1 : B ; eff1 \"\" \\ \\ e2 : Ta ; VE x \" \"\\ B <: T0 \\ T : Latent S\"\n \"\\ Ta <: T0\"\n from prems have A:\"e2 = Var x\" using ve_ty_elim[of \\ e2 Ta x] eff.inject by auto\n hence B:\"t1 = App e1 (Var z)\" using prems trm.inject eff.inject by auto\n have C:\" \\ \\ (Var z) : Ta ; VE z\" using prems A trm.inject eff.inject by auto\n have D:\" \\ \\ e1 : B ; eff1\" using ty.inject latent_eff.inject prems eff.inject by auto\n have E:\"\\ B <: T0 \\ T : Latent U\" using ty.inject latent_eff.inject prems eff.inject by auto\n from `\\ Ta <: T0` B C D E show ?thesis by blast\n qed\n \n \n\nlemma unique_var_typing:\n assumes \"(x,T)#\\ \\ Var x : T; VE x\" and \"(x,T)#\\ \\ Var x : T' ; VE x\"\n shows \"T = T'\"\n proof (rule ccontr)\n assume \"T ~= T'\"\n have \"(x,T) : set ((x,T)#\\)\" using var_ty_elim[of _ x T \"VE x\"] prems by auto\n have \"(x,T') : set ((x,T)#\\)\" \"valid ((x,T)#\\)\" using var_ty_elim[of \"((x,T)#\\)\" x T' \"VE x\"] prems by auto\n hence A:\"(x,T') : set \\\" \"valid \\\" \"x \\ \\\" using prems valid_elim[of x T \\] by auto\n have \"x : supp \\\" using `valid \\` A\n proof (induct \\ rule: valid.induct)\n case v1 thus ?case by auto\n next\n case (v2 \\' a S) \n hence \"x \\ (a,S)\" \"x \\ \\'\" using fresh_list_cons by auto\n hence \"x \\ a\" by auto\n hence \"x ~= a\" using fresh_atm by auto\n hence \"(x,T') : set \\'\" using v2 by auto\n have \"valid \\'\" using v2 valid_elim[of a S \\'] by auto\n hence \"x : supp \\'\" using v2 `(x,T') : set \\'` `x \\ \\'` by auto\n hence \"x : supp (a,S) \\ supp \\'\" by auto\n hence \"x : (supp ((a,S)#\\') :: name set)\" using supp_list_cons[of \"(a,S)\" \\'] by force\n thus ?case by simp \n qed\n hence \"~ (x \\ \\)\" using fresh_def[of x \\] by blast\n thus False using `x \\ \\` by auto\n qed\n\ninductive_cases tt_sub_ff:\"\\ ty.TT <: ty.FF\"\ninductive_cases ff_sub_tt:\"\\ ty.FF <: ty.TT\"\n\nlemma value_effect_tt_or_ff:\n assumes \"v : values\" and \"\\ \\ v : T ; F\"\n shows \"F = FF \\ v = Bool False \\ F = TT \\ v ~= Bool False\"\n using prems\nproof (nominal_induct v avoiding: \\ rule: values.strong_induct)\n case num_value thus ?case using num_ty_elim by auto\nnext\n case bi_value thus ?case using bi_ty_elim by auto\nnext\n case abs_value thus ?case using abs_ty_elim[of \\ _ _ _ T F] by auto\nnext\n case (bool_value b)\n thus ?case using true_ty_elim false_ty_elim by (cases b) auto\nqed\n\nlemma remove_fresh_env:\n assumes A:\"y \\ \\\" and B:\"valid \\\"\n shows \"\\ - (y,T) = \\\"\n using B A\nproof (induct \\ rule: valid.induct)\n case v1 thus ?case by auto\nnext\n case (v2 \\' a S)\n have \"y \\ a\" \"y \\ \\'\" using `y \\ ((a, S) # \\')` using fresh_atm[of y a] fresh_list_cons by auto\n hence \"((a, S) # \\') - (y, T) = (a, S) # (\\' - (y, T))\" by auto\n thus ?case using v2 `y \\ \\'` by auto\nqed\n\n\nlemma subst_preserve_TE_app:\n assumes tapp:\"(y,T0)#\\ \\ App e1 e2 : T ; TE S x\"\n and neq:\"y \\ x\"\n and val:\"valid ((y,T0)#\\)\"\n and ih: \"!! t bc bf . \\t \\ App e1 e2; (y, T0) # \\ \\ t : bc ; bf \\ \n \\ \\T' F'. \\ \\ t[y::=v] : T' ; F' \\ \\ T' <: bc \\ \\ F' \\ (App e1 e2)[y::=v] : T ; TE S x\"\nproof -\n note te_ty_elim[OF tapp]\n then obtain f A A1 Fn Sa B\n where sz:\"App e1 e2 = App f (Var x)\"\n and tf:\"(y, T0) # \\ \\ f : B ; Fn \"\" \\ B <: A1 \\ T : Latent S\" \n and tvx:\"(y, T0) # \\ \\ Var x : A ; VE x\" and sub:\" \\ A <: A1\"\n by auto\n hence \"e1 = f\" and \"e2 = Var x\" using trm.inject by auto\n hence \"e2[y::=v] = Var x\" using `y \\ x` forget by auto\n hence tsub:\" (y, T0)#\\ \\ e2[y::=v] : A ; VE x\" using `e2=Var x` tvx by auto\n have fr:\"y \\ e2[y::=v]\" using `e2 = Var x``e2[y::=v] = Var x` `y \\ x` using fresh_atm by auto\n have \"y \\ \\\" \"valid \\\" using valid_elim[OF val] by auto\n hence \"((y, T0) # \\) - (y, T0) = \\\" using remove_fresh_env[OF `y \\ \\` `valid \\`] by auto\n hence te2:\"\\ \\ e2[y::=v] : A ; VE x\" using fresh_weakening[OF fr tsub `valid ((y,T0)#\\)`, of T0] by auto\n have szf:\"f \\ App e1 e2\" using sz by auto\n note ih[OF szf tf(1)]\n then obtain T' F' where tfsub:\"\\ \\ f[y::=v] : T' ; F' \"\" \\ T' <: B \" \"\\ F' T' <: A1 \\ T : Latent S \" using `\\ B <: A1 \\ T : Latent S` by auto\n hence \"\\ \\ (App f e2)[y::=v] : T ; TE S x\" using te2 tfsub `\\ A <: A1` by auto\n thus ?thesis using sz using trm.inject by auto\nqed\n\ninductive_cases te_elim_auto: \"\\ \\ e : T ; TE S x\"\nthm te_elim_auto\n\nlemma subst_preserve_TE:\n fixes v\n assumes tapp:\"(y,T0)#\\ \\ e : T ; TE S x\"\n and neq:\"y \\ x\"\n and val:\"valid ((y,T0)#\\)\"\n and ih: \"!! t bc bf . \\t \\ e; (y, T0) # \\ \\ t : bc ; bf \\ \n \\ \\T' F'. \\ \\ t[y::=v] : T' ; F' \\ \\ T' <: bc \\ \\ F' \\ e[y::=v] : T ; TE S x\"\nproof -\n obtain e1 e2 where \"e = App e1 e2\" using te_elim_auto[OF tapp, of thesis] by auto\n hence A:\"(y,T0)#\\ \\ App e1 e2 : T ; TE S x\" using tapp by auto\n note subst_preserve_TE_app[OF A neq val , of v]\n have \"!! t bc bf . \\t \\ App e1 e2; (y, T0) # \\ \\ t : bc ; bf \\ \n \\ \\T' F'. \\ \\ t[y::=v] : T' ; F' \\ \\ T' <: bc \\ \\ F' \\ App e1 e2[y::=v] : T ; TE S x\" using subst_preserve_TE_app[OF A neq val , of v] by auto\n thus ?thesis using `e = App e1 e2` by auto\nqed\n \ninductive_cases lam_latent_eff_elim_auto: \"\\ \\ Lam[x:T].b : S1 \\ S2 : Latent U ; F\"\nthm lam_latent_eff_elim_auto\n\nlemma preserve_subst:\n assumes \"(x,T0)#\\ \\ e : T ; F\" and \"\\ \\ e' : T1 ; G\" and \"\\ T1 <: T0\" and \"valid ((x,T0)#\\)\" \n and \"closed e'\" and \"e' : values\"\n shows \"EX T' F'. \\ \\ e[x::=e'] : T' ; F' \\ \\ T' <: T \\ \\ F' x e' T T1 T0 F G rule: trm_comp_induct)\n case (Var v)\n have a1: \"\\ \\e':T1;G\" by fact\n have a2: \"((x,T0)#\\) \\ Var v:T;F\" by fact\n hence a21: \"(v,T)\\set((x,T0)#\\)\" and a22: \"valid((x,T0)#\\)\" and a22b:\"F = VE v\"\n using var_ty_elim[of \"(x, T0) # \\\"] by auto\n from a22 have a23: \"valid \\\" and a24: \"x\\\\\" by (auto dest: valid_elim) \n from a24 have a25: \"\\(\\\\. (x,\\)\\set \\)\" by (rule fresh_context)\n show ?case\n proof (cases \"v=x\")\n assume case1: \"v=x\"\n hence \"(Var v)[x::=e'] = e'\" by simp\n hence A:\"\\ \\ (Var v)[x::=e'] : T1; G\" using Var by auto\n have \"simple_eff G\" using closed_eff `closed e'` prems by auto\n hence C:\"\\ G set \\\" by force\n with case1 a25 show False by force \n qed\n hence D:\"\\ T1 <: T\" using `\\ T1 <: T0` by auto\n have \"~ (\\S y. F = TE S y)\" using a22b by auto\n thus ?thesis using A a22b C D by blast\n next\n assume case2: \"v\\x\"\n with a21 have a26: \"(v,T)\\set \\\" by force\n have a27:\" Var v[x::=e'] = Var v\" using case2 by simp\n from a23 a26 a27 have \"\\ \\ Var v:T;VE v\" by force\n thus ?thesis using a27 a22b by auto\n qed\nnext\n case (Num n)\n have A:\"(Num n)[x::=e'] = Num n\" by auto\n have B:\"F = eff.TT\" using Num num_ty_elim by auto\n have \"T = ty.Int\" using num_ty_elim Num by auto\n hence \"\\ \\ (Num n)[x::=e'] : T ; eff.TT\" using Num A valid_elim[of x T0 \\] by auto\n thus ?case using Num B by auto\nnext\n case (Bool b)\n have v:\"valid \\\" using prems typing_valid by auto\n have A:\"(Bool b)[x::=e'] = Bool b\" by auto\n thus ?case \n proof (cases b)\n case True\n hence B:\"T = ty.TT\" and \"F = TT\" using Bool true_ty_elim by auto\n thus ?thesis using A v True by auto\n next\n case False\n hence B:\"T = ty.FF\" and \"F = FF\" using Bool false_ty_elim by auto\n thus ?thesis using A v False by auto\n qed\nnext\n case (BI b)\n have A:\"(BI b)[x::=e'] = (BI b)\" by auto\n have B:\"F = eff.TT\" using BI bi_ty_elim by auto\n have \"T = \\\\<^isub>\\ b\" using bi_ty_elim BI by auto\n hence \"\\ \\ (BI b)[x::=e'] : T ; eff.TT\" using BI A valid_elim[of x T0 \\] by auto\n thus ?case using BI B by auto\nnext\n case (App s1 s2 \\' x' e'' T' T1' T0' F' G')\n have ih_s1: \"\\c \\ T F T' F' e' \\. ((c,\\)#\\) \\ s1:T; F \\ closed e' \\ e' : values \\ valid ((c,\\)#\\) \\ \\\\ e': T' ; F' \\ \\ T' <: \\ \\ EX S G. \\ \\ s1[c::=e']:S ; G \\ \\ S <: T \\ \\ G c \\ T F T' F' e' \\. ((c,\\)#\\) \\ s2:T; F \\ closed e' \\ e' : values \\ valid ((c,\\)#\\) \\ \\\\ e': T' ; F' \\ \\ T' <: \\ \\ EX S G. \\ \\ s2[c::=e']:S ; G \\ \\ S <: T \\ \\ G ')\\App s1 s2 : T'; F'\" .\n from appty have\n elim1:\"\\T0 T0'a T1 le eff' eff'' U.(x',T0')#\\' \\ s1 :U;eff' \\ (x',T0')# \\'\\ s2 : T0'a;eff'' \\ \\ U <: T0\\T1:le \\ \\ T0'a <: T0 \\ T1 = T'\"\n using app_ty_elim by auto\n from appty \n have elim2:\"(x', T0') # \\' \\ App s1 s2 : T' ; FF \\ \\T0 T0'a leS eff' eff'' le U.(x',T0')#\\' \\ s1 :U;eff' \\ \n (x',T0')# \\'\\ s2 : T0'a;eff'' \\ \\ T0'a <: T0\\ \\ U <: T0\\T':le \\ le = Latent leS \\ ~ (\\ T0'a <: leS) \\ s2 : values \\ closed s2\"\n using app_ty_ff_elim[of \"((x',T0')#\\')\" s1 s2 T'] by blast\n have elim3:\"(x', T0') # \\' \\ App s1 s2 : T' ; TT \\ \\T0 T0'a leS eff' eff'' U le.(x',T0')#\\' \\ s1 :U;eff' \\ \n (x',T0')# \\'\\ s2 : T0'a;eff'' \\ \\ T0'a <: T0 \\ \\ U <: T0\\T':le \\ le = Latent leS \\ \\ T0'a <: leS \" \n using app_ty_tt_elim[of \"((x',T0')#\\')\" s1 s2 T'] by blast\n from elim1 obtain T0 T0'a T1 le eff' eff'' U where\n P:\"(x',T0')#\\' \\ s1 :U;eff'\"\" (x',T0')# \\'\\ s2 : T0'a;eff''\"\" \\ T0'a <: T0 \"\" T1 = T'\" \"\\ U <: T0\\T1:le\" by auto\n hence \"EX S1 G1. \\' \\ s1[x'::=e''] : S1 ; G1 \\ \\ S1 <: U \\ \\ G1 ' \\ s1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: U\" \"\\ G1 S1 <: T0\\T1:le\" using P Q by auto\n (* then apply ih_s2, get something about the substition of s2, and put it all back together. *)\n from P have \"EX S G. \\' \\ s2[x'::=e'']:S ; G \\ \\ S <: T0'a \\ \\ G ' T0'a eff''] App by auto\n then obtain S2 G2 where S:\"\\' \\ s2[x'::=e'']:S2 ; G2 \"\" \\ S2 <: T0'a\" \"\\ G2 S2 <: T0\" using P S by auto\n have L1:\"\\' \\ App ?ns1 ?ns2 : T1 ; NE\" using Q S sub1 sub2 by auto\n have L2:\"T1 = T'\" .\n show ?case using appty\n proof (nominal_induct F' rule: eff.induct)\n case NE thus ?case using L1 L2 by auto\n next\n case VE thus ?case using L1 L2 by auto\n next\n case (TE ty var) thus ?case using L1 L2 by auto\n next\n case TT\n from elim3 TT obtain T0 T0'a T1 le leS eff' eff'' U where\n P:\"(x',T0')#\\' \\ s1 :U;eff'\"\" (x',T0')# \\'\\ s2 : T0'a;eff''\"\" \\ T0'a <: T0 \"\" T1 = T'\" \"\\ U <: T0\\T1:le\"\n \"le = Latent leS\" \"\\ T0'a <: leS\" by auto\n hence \"EX S1 G1. \\' \\ s1[x'::=e''] : S1 ; G1 \\ \\ S1 <: U \\ \\ G1 ' \\ s1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: U\" \"\\ G1 S1 <: T0\\T1:le\" using P by auto\n (* then apply ih_s2, get something about the substition of s2, and put it all back together. *)\n from P have \"EX S G. \\' \\ s2[x'::=e'']:S ; G \\ \\ S <: T0'a \\ \\ G ' T0'a eff''] App by auto\n then obtain S2 G2 where S:\"\\' \\ s2[x'::=e'']:S2 ; G2 \"\" \\ S2 <: T0'a\" \"\\ G2 S2 <: leS\" using `\\ S2 <: T0'a` `\\ T0'a <: leS` by auto\n have L1:\"\\' \\ App ?ns1 ?ns2 : T1 ; TT\" using P Q R S noover T_AppPredFalse[of \\' \" s1[x'::=e'']\" U] by auto\n have L2:\"T1 = T'\" .\n from L1 L2 show ?case by auto\n next\n case FF\n from elim2 FF obtain T0 T0'a T1 le leS eff' eff'' U where\n P:\"(x',T0')#\\' \\ s1 :U;eff'\"\" (x',T0')# \\'\\ s2 : T0'a;eff''\"\" \\ T0'a <: T0 \"\" T1 = T'\" \"\\ U <: T0\\T1:le\"\n \"le = Latent leS\" \"~ (\\ T0'a <: leS)\" \"s2 :values\" \"closed s2\" by auto\n hence \"EX S1 G1. \\' \\ s1[x'::=e''] : S1 ; G1 \\ \\ S1 <: U \\ \\ G1 ' \\ s1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: U\" \"\\ G1 S1 <: T0\\T1:le\" using P by auto\n (* then apply ih_s2, get something about the substition of s2, and put it all back together. *)\n from P have \"EX S G. \\' \\ s2[x'::=e'']:S ; G \\ \\ S <: T0'a \\ \\ G ' T0'a eff''] App by auto\n then obtain S2 G2 where S:\"\\' \\ s2[x'::=e'']:S2 ; G2 \"\" \\ S2 <: T0'a\" \"\\ G2 s2\" using closed_def fresh_def[of x' s2] `closed s2` by auto\n hence \"s2 = ?ns2\" using forget by auto\n hence S':\"\\' \\ ?ns2 : T0'a ; eff''\" \n using `(x',T0')#\\' \\ s2 : T0'a ; eff''` fresh_weakening_cons `valid ((x',T0')#\\')` `x' \\ s2`\n by auto\n\n have noover: \"~(\\ T0'a <: leS)\" .\n have T:\"closed ?ns2\" \"?ns2 : values\" using `s2 = ?ns2` `closed s2` `s2 : values` by auto\n have L1:\"\\' \\ App ?ns1 ?ns2 : T1 ; FF\" using P Q R S' T noover by auto\n have L2:\"T1 = T'\" by fact\n from L1 L2 show ?case by auto\n qed\nnext\n case (Lam a body \\' x' e'' T' T1' T0' F' G' ty )\n hence f1: \"a\\\\'\" and f2: \"a\\x'\" and f2': \"x'\\a\" and f3: \"a\\e''\" and f4: \"a\\((x',T0')#\\')\"\n by (auto simp add: fresh_atm fresh_prod fresh_list_cons)\n have c1: \"((x',T0')#\\')\\Lam [a:ty].body : T' ; F'\" by fact\n(* hence \"\\\\2 eff L S. ((a,ty)#(x',T0')#\\') \\ body : \\2 ; eff \\ T'=ty\\\\2:L \\ F' = TT\" using f4 abs_ty_elim by auto *)\n then obtain \\2 eff L S where c11: \"T'=ty\\\\2:L\" and c12: \"((a,ty)#(x',T0')#\\') \\ body : \\2 ; eff\" and \"F' = TT\"\n and c13:\"L = latent_eff.NE \\ (eff = TE S a \\ L = Latent S)\" using f4 abs_ty_elim by blast\n from c12 have \"valid ((a,ty)#(x',T0')#\\')\" using Lam by auto\n hence ca: \"valid \\'\" and cb: \"a\\\\'\" and cc: \"x'\\\\'\" \n by (auto dest: valid_elim simp add: fresh_list_cons)\n have c2: \"((a,ty)#(x',T0')#\\') \\ ((x',T0')#(a,ty)#\\')\" by force\n have c3: \"valid ((x',T0')#(a,ty)#\\')\"\n by (rule v2, rule v2, auto simp add: fresh_list_cons fresh_prod ca cb cc f2' fresh_ty)\n from c12 c2 c3 have c14: \"((x',T0')#(a,ty)#\\') \\ body : \\2 ; eff\" using `valid ((a, ty) # (x', T0') # \\')`\n by (force intro: weakening)\n let ?inner\\ = \"(a,ty)#\\'\"\n have validig:\"valid ?inner\\\" using `a \\ \\'` `valid \\'` by auto\n have c15:\"\\' \\ ?inner\\\" by auto\n hence c16:\"?inner\\ \\ e'' : T1' ; G'\"\n using weakening[of \\' _ _ _ ?inner\\] `\\' \\ e'' : T1' ; G'` validig `valid \\'` by simp\n have \"EX TA0 FA0. ?inner\\ \\ body[x'::=e''] : TA0 ; FA0 \\ \\ TA0 <: \\2 \\ \\ FA0 \\2 eff e'' T1' G'] ` \\ T1' <: T0'` `valid ((x', T0') # (a, ty) # \\')` c14 `closed e''`\n `e'' : values`\n by auto\n then obtain TA0 FA0 where body_ty:\"?inner\\ \\ body[x'::=e''] : TA0 ; FA0 \"\" \\ TA0 <: \\2\" by auto\n hence L11:\"\\' \\ (Lam[a:ty].(body[x'::=e''])) : ty \\ TA0 : latent_eff.NE; eff.TT\" using `a \\ \\'` by auto \n note Lam(9)[OF _ _ `(a, ty)# \\' \\ e'' : T1' ; G'` `\\ T1' <: T0'` `valid ((x', T0')# (a, ty) # \\')` `closed e''` `e'' : values`]\n hence \"!! t bc bf . \\t \\ Lam [a:ty].body; (x', T0') #(a, ty)# \\' \\ t : bc ; bf \\\n\\ \\T' F'. (a, ty)#\\' \\ t[x'::=e''] : T' ; F' \\ \\ T' <: bc \\ \\ F' t \\ body; (x', T0') # (a, ty)#\\' \\ t : bc ; bf \\\n\\ \\T' F'. (a, ty)#\\' \\ t[x'::=e''] : T' ; F' \\ \\ T' <: bc \\ \\ F' \\' \\ (Lam[a:ty].(body[x'::=e''])) : ty \\ \\2 : Latent S; eff.TT\" \n proof -\n assume \"L = Latent S\"\n hence \"eff = TE S a\" using c13 by auto\n hence c12':\"(a, ty) # (x', T0') # \\' \\ body : \\2 ; TE S a\" using c12 by simp\n have c12'':\" (x', T0') # (a, ty) # \\' \\ body : \\2 ; TE S a\" using weakening[OF c12' _ c2 ] \n using `valid ((x', T0') # (a, ty) # \\')` `valid ((a, ty) # (x', T0') # \\')` by auto\n have f2':\"x' \\ a\" using f2 by auto\n note body_ty subst_preserve_TE[OF c12'' f2' `valid ((x', T0') # (a, ty) # \\')` , of e'']\n hence \"(a, ty) # \\' \\ body[x'::=e''] : \\2 ; TE S a\" using ih_body by auto\n hence \"?inner\\ \\ body[x'::=e''] : \\2 ; TE S a \" .\n thus ?thesis using `a \\ \\'` by auto\n qed\n (* from L11 L12 have L1:\"\\' \\ (Lam[a:ty].(body[x'::=e''])) : ty \\ TA0 : L; eff.TT\" using c13 by auto *)\n have L21:\"\\ ty \\ TA0 : L <: T'\" using c11 ` \\ TA0 <: \\2` by auto\n have L22: \"\\ ty \\ \\2 : L <: T'\" using c11 by auto\n have L3:\"(Lam[a:ty].body)[x'::=e''] = (Lam[a:ty].(body[x'::=e'']))\" using Lam by auto\n have L4:\"\\ eff.TT (Lam [a:ty].body) : T ; TE S x \\ False\"\n proof -\n fix Env a ty body T S x\n assume \"Env \\ (Lam [a:ty].body) : T ; TE S x\"\n have \" Env \\ (Lam [a:ty].body) : T ; TE S x \\ False\"\n by (ind_cases \" Env \\ (Lam [a:ty].body) : T ; TE S x\") \n thus False using prems by auto\n qed\n\n from L11 L12 L21 L22 L3 L4 L5[of \\' a _ ty ] c13\n \n show ?case by auto\nnext\n case (Iff t1 t2 t3 \\' x' e'' T' T0' T1' F' G')\n let ?\\ = \"(x', T1') # \\'\"\n have A:\"(\\ T1 T2 T3 F1 F2 F3. \n (?\\ \\ t1 : T1 ; F1) \\ ?\\ |+ F1 \\ t2 : T2 ; F2 \\ ?\\ |- F1 \\ t3 : T3 ; F3 \\ \\ T2 <: T' \\ \\ T3 <: T' \\ F' = NE)\n \\\n (\\ T1 T3 F3. (?\\ \\ t1 : T1 ; FF) \\ ?\\ \\ t3 : T3 ; F3 \\ \\ T3 <: T' \\ F' = NE)\n \\\n (\\ T1 T2 F2. (?\\ \\ t1 : T1 ; TT) \\ ?\\ \\ t2 : T2 ; F2 \\ \\ T2 <: T' \\ F' = NE)\" using Iff if_ty_elim by auto\n thus ?case\n proof -\n {\n assume \"(\\ T1 T2 T3 F1 F2 F3. \n (?\\ \\ t1 : T1 ; F1) \\ ?\\ |+ F1 \\ t2 : T2 ; F2 \\ ?\\ |- F1 \\ t3 : T3 ; F3 \\ \\ T2 <: T' \\ \\ T3 <: T' \\ F' = NE)\"\n then obtain T1 T2 T3 F1 F2 F3 where\n\t\"?\\ \\ t1 : T1 ; F1 \"\" ?\\ |+ F1 \\ t2 : T2 ; F2 \"\" ?\\ |- F1 \\ t3 : T3 ; F3 \"\" \\ T2 <: T'\"\"\\ T3 <: T'\"\"F' = NE\"\n\tby auto\n hence ?thesis\n proof (nominal_induct F1 rule: eff.induct)\n\tcase NE\n\tfrom NE have \"\\S1 G1. \\' \\ t1[x'::=e''] : S1 ; G1 \\ \\ S1 <: T1 \\ \\ G1 ' \\ t1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: T1 \"\" \\ G1 G1 \\ t2 : T2 ; F2)\" using prems by auto\n\thave p2:\"(?\\ \\ t3 : T3 ; F3)\" using prems by auto\n\tfrom p1 have \"\\S2 G2. \\' \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 ' \\ t2[x'::=e''] : S2 ; G2 \"\" \\ S2 <: T2 \"\" \\ G2 S3 G3. \\' \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 ' \\ t3[x'::=e''] : S3 ; G3 \"\" \\ S3 <: T3 \"\" \\ G3 ' |+ G1 \\ t2[x'::=e''] : S2 ; G2\" using B simple by auto\n\thave C':\"\\' |- G1 \\ t3[x'::=e''] : S3 ; G3\" using C simple by auto\n\thave D:\"\\ S2 <: T'\" using prems B by auto\n\thave E:\"\\ S3 <: T'\" using prems C by auto\n\tfrom A B' C' D E have \" \\' \\ Iff t1 t2 t3[x'::=e''] : T' ; comb_eff G1 G2 G3\" by (auto simp del: comb_eff.simps)\n\tthus ?case using `F' = NE` by auto\n next\n\tcase TT\n\tfrom TT have \"\\S1 G1. \\' \\ t1[x'::=e''] : S1 ; G1 \\ \\ S1 <: T1 \\ \\ G1 ' \\ t1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: T1 \"\" \\ G1 \\ t2 : T2 ; F2)\" using prems by auto\n\thave p2:\"(?\\ \\ t3 : T3 ; F3)\" using prems by auto\n\tfrom p1 have \"\\S2 G2. \\' \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 ' \\ t2[x'::=e''] : S2 ; G2 \"\" \\ S2 <: T2 \"\" \\ G2 S3 G3. \\' \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 ' \\ t3[x'::=e''] : S3 ; G3 \"\" \\ S3 <: T3 \"\" \\ G3 ' |+ G1 \\ t2[x'::=e''] : S2 ; G2\" using B simple by auto\n\thave C':\"\\' |- G1 \\ t3[x'::=e''] : S3 ; G3\" using C simple by auto\n\thave D:\"\\ S2 <: T'\" using prems B by auto\n\thave E:\"\\ S3 <: T'\" using prems C by auto\n\tfrom A B' C' D E have \" \\' \\ Iff t1 t2 t3[x'::=e''] : T' ; comb_eff G1 G2 G3\" by (auto simp del: comb_eff.simps)\n\tthus ?case using `F' = NE` by auto\n next\n\tcase FF\n\tfrom FF have \"\\S1 G1. \\' \\ t1[x'::=e''] : S1 ; G1 \\ \\ S1 <: T1 \\ \\ G1 ' \\ t1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: T1 \"\" \\ G1 \\ t2 : T2 ; F2)\" using prems by auto\n\thave p2:\"(?\\ \\ t3 : T3 ; F3)\" using prems by auto\n\tfrom p1 have \"\\S2 G2. \\' \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 ' \\ t2[x'::=e''] : S2 ; G2 \"\" \\ S2 <: T2 \"\" \\ G2 S3 G3. \\' \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 ' \\ t3[x'::=e''] : S3 ; G3 \"\" \\ S3 <: T3 \"\" \\ G3 ' |+ G1 \\ t2[x'::=e''] : S2 ; G2\" using B simple by auto\n\thave C':\"\\' |- G1 \\ t3[x'::=e''] : S3 ; G3\" using C simple by auto\n\thave D:\"\\ S2 <: T'\" using prems B by auto\n\thave E:\"\\ S3 <: T'\" using prems C by auto\n\tfrom A B' C' D E have \" \\' \\ Iff t1 t2 t3[x'::=e''] : T' ; comb_eff G1 G2 G3\" by (auto simp del: comb_eff.simps)\n\tthus ?case using `F' = NE` by auto\n next\n\tcase (VE z)\n\thence A:\"t1 = (Var z) \" \"?\\ \\ Var z : T1 ; VE z\"\n\t using ve_ty_elim[OF `?\\ \\ t1 : T1; VE z`] using eff.inject by auto\n\thave size1:\"(Var z\\Iff t1 t2 t3)\" using A by simp\n\tnote Iff(1)[of \"Var z\"]\n hence ih_f:\"!! c \\ \\ T F e' T0 F0 . \n (c,\\)#\\ \\ (Var z) : T ; F \\ \\ \\ e' : T0 ; F0 \\ \\ T0 <: \\ \\ valid ((c,\\)#\\) \\ closed e' \\ e' : values\n \\ EX T' F' . \\ \\ (Var z)[c::=e'] : T' ; F' \\ \\ T' <: T \\ \\ F' ' \\ (Var z)[x'::=e''] : A' ; Fn' \\ \\ A' <: T1 \\ \\ Fn' ' \\ (Var z)[x'::=e''] : A' ; Fn' \\ \\ A' <:T1\" by auto\n\tlet ?mapfun = \"(%f. (% (v,ty). (if (z = v) then (v,f ty.FF ty) else (v,ty))))\"\n let ?\\1 = \"(map (?mapfun remove) \\')\"\n let ?\\2 = \"(map (?mapfun replace) \\')\" \n have \"valid \\'\" using `valid ?\\` using valid_elim[of x' T1' \\'] by auto\n\tshow ?case \n\tproof (cases \"x' = z\")\n\t case True\n from A True have \"(Var z)[x'::=e''] = e''\" by auto\n hence D:\"\\' \\ (Var z)[x'::=e''] : T0' ; G'\" \"closed ((Var z)[x'::=e''])\" \"((Var z)[x'::=e'']) : values\"\n\t using Iff by auto\n have \"\\ T0' <: T1'\" .\n note var_ty_elim[of ?\\ z _ \"VE z\"]\n hence \"(x', T1') : set ?\\\" using A True by auto\n have \"?\\ \\ (Var x') : T1' ; VE x'\" using `valid ?\\` by auto\n\t have \"simple_ty T0'\" using `\\' \\ e'' : T0' ; G'` `e'' : values` value_simple_type by auto\n\t let ?mapfun = \"(%f. (% (v,ty). (if (z = v) then (v,f ty.FF ty) else (v,ty))))\"\n let ?\\1 = \"(map (?mapfun remove) \\')\"\n let ?\\2 = \"(map (?mapfun replace) \\')\" \n\n have \"?\\1 = envop remove z ty.FF \\'\" by auto\n have \"?\\2 = envop replace z ty.FF \\'\" by auto\n have \"x' \\ \\'\" using Iff valid_elim[of x' T1' \\'] by auto\n hence \"?\\1 = \\'\" using True envop_forget `valid \\'` by auto\n hence GA:\"?\\ |+ VE z = (x',remove ty.FF T1') # \\'\" using True by auto\n hence G1:\"\\ \\ t2 : T2; F2\" using `(?\\ |+ VE z)\\ t2 : T2 ; F2` by auto\n have \"?\\2 = \\'\" using `x' \\ \\'` True envop_forget `valid \\'` by auto\n hence \"?\\ |- VE z = (x',replace ty.FF T1') # \\'\" using True by auto\n\t hence GB:\"?\\ |- VE z = (x',ty.FF) # \\'\" by auto\n hence G2:\"\\ \\ t3 : T3; F3\" using `(?\\ |- VE z)\\ t3 : T3 ; F3` by auto\n have \"valid (?\\ |+ VE z)\" using `valid ?\\` envplus_valid[of ?\\ \"VE z\"] by auto\n hence G3:\"valid ((x',remove ty.FF T1') # \\')\" using GA by auto\n have \"valid (?\\ |- VE z)\" using `valid ?\\` envminus_valid[of ?\\ \"VE z\"] by auto\n hence G4:\"valid ((x',ty.FF) # \\')\" using GB by auto \n\t show ?thesis \n\t proof (cases \"e'' = Bool False\")\n\t case True\n\t hence \"(Var z)[x'::=e''] = Bool False\" using `x' = z` by auto\n\t hence \"t1[x'::=e''] = Bool False\" using `t1 = Var z` by auto\n\t hence X1:\"?\\ \\ t1[x'::=e''] : ty.FF ; FF\" using `valid ?\\` by auto\n\t have \"\\' \\ e'' : ty.FF ; FF\" using True `valid \\'` by auto\n\t note `?\\ |- VE z = (x', ty.FF) # \\'`\n\t hence \"valid ((x', ty.FF) # \\')\" using G4 by auto\n\t have X2:\"(x', ty.FF) # \\' \\ t3 : T3 ; F3\" using VE `?\\ |- VE z = (x', ty.FF) # \\'` by auto\n\t note Iff(4)[ OF X2 `\\' \\ e'' : ty.FF ; FF ` _ `valid ((x', ty.FF) # \\')`]\n\t then obtain T'' F'' where X3:\"\\' \\ t3[x'::=e''] : T'' ; F'' \" and X4:\" \\ T'' <: T3 \"\" \\ F'' T'' <: T'\" using `\\ T3 <: T'` by auto\n\t hence \"\\' \\ Iff (Bool False) (t2[x'::=e'']) (t3[x'::=e'']) : T'' ; NE\" using `valid \\'` X3 by auto\n\t hence \"\\' \\ (Iff t1 t2 t3)[x'::=e''] : T'' ; NE\" using ` t1[x'::=e''] = Bool False` by auto\n\t thus ?thesis using `\\ T'' <: T'` `F' = NE` by auto\n\t next\n\t case False\n\t hence \"(Var z)[x'::=e''] = e''\" using `x' = z` by auto\n\t hence \"t1[x'::=e''] = e''\" using `t1 = Var z` by auto\n\t hence X1:\"\\' \\ t1[x'::=e''] : T0' ; G'\" by auto\n\t have \"\\' \\ e'' : T0' ; G'\" .\n\t hence \"G' = TT\" using value_effect_tt_or_ff[OF `e'' : values` `\\' \\ e'' : T0' ; G'`] False by auto\n\t hence X2:\"\\' \\ t1[x'::=e''] : T0' ; TT\" using X1 by auto\n\t have \"\\ T0' <: T1'\" .\n\n\t have X3:\"\\ \\ T0' <: ty.FF\"\n\t proof (rule ccontr)\n\t assume \"\\\\ \\ T0' <: ty.FF\"\n\t hence \"\\ T0' <: ty.FF\" by simp\n\t hence \"\\ T0' <: BoolTy\" using BoolTy_def by auto\n\t hence \"EX b. e'' = Bool b\" using bool_value `e'' : values ` `\\' \\ e'' : T0' ; G'` by auto\n\t then obtain b where A:\"e'' = Bool b\" by auto\n\t thus False\n\t proof (cases b)\n\t\tcase False\n\t\tthus ?thesis using A `e'' ~= Bool False` by auto\n\t next\n\t\tcase True\n\t\thence \"T0' = ty.TT\" using `\\' \\ e'' : T0' ; G'` A true_ty_elim by auto\n\t\tthus ?thesis using `\\ T0' <: ty.FF` tt_sub_ff by auto\n\t qed\n\t qed\n\n\n\t \n\t let ?rty = \"remove ty.FF T1'\"\n\n\t note `?\\ |+ VE z = (x', ?rty) # \\'`\n\t hence \"valid ((x', ?rty) # \\')\" using G3 by auto\n\t have X2:\"(x', ?rty) # \\' \\ t2 : T2 ; F2\" using VE `?\\ |+ VE z = (x', ?rty) # \\'` by auto\n\t note Iff(3)[ OF X2 `\\' \\ e'' : T0' ; G' ` _ `valid ((x', ?rty) # \\')`]\n\t then obtain T'' F'' where X3:\"\\' \\ t2[x'::=e''] : T'' ; F'' \" and X4:\" \\ T'' <: T2 \"\" \\ F'' T0' <: T1'` X3 `simple_ty T0'`] by auto\n\t hence \"\\ T'' <: T'\" using `\\ T2 <: T'` by auto\n\t hence \"\\' \\ Iff e'' (t2[x'::=e'']) (t3[x'::=e'']) : T'' ; NE\" using `valid \\'` X3 `\\' \\ e'' : T0' ; G' ` \n\t `G' = TT` by auto\n\t hence \"\\' \\ (Iff t1 t2 t3)[x'::=e''] : T'' ; NE\" using ` t1[x'::=e''] = e''` by auto\n\t thus ?thesis using `\\ T'' <: T'` `F' = NE` by auto\n\t \n\t qed\n\tnext\n\t case False\n\t from A False have \"(Var z)[x'::=e''] = (Var z)\" by auto\n\t hence D:\"\\' \\ (Var z)[x'::=e''] : T1 ; VE z\" using False A \n proof -\n have q1:\"?\\ \\ Var z : T1 ; VE z\" using A by auto\n have \"x' \\ Var z\" using trm.fresh False fresh_atm by auto\n hence \"\\' \\ Var z : T1 ; VE z\" using q1 fresh_weakening_cons `valid ((x',T1')# \\')` by auto\n thus ?thesis using `(Var z)[x'::=e''] = Var z` by auto\n qed\n hence typetst: \"\\' \\ t1[x'::=e''] : T1 ; VE z\" using A by auto\n\t have F:\"?\\ |+ VE z = (x',T1') # ?\\1\" using False by auto\n hence H:\"(x',T1') # ?\\1 \\ t2 : T2 ; F2\" using `?\\ |+ VE z \\ t2 : T2 ; F2` by auto\n hence K:\"valid ?\\1\" using envop_valid `valid \\'` by auto\n have J:\"?\\1 \\ e'' : T0' ; G'\" using K `valid \\'` closed_any_env `closed e''` Iff by blast\n have \"x' \\ ?\\1\" using Iff valid_elim[of x' T1' \\'] envop_fresh[of x' \\' remove] `valid \\'` by auto\n hence \"valid ((x',T1')#?\\1)\" using `valid ?\\1` by auto\n hence ex1:\"\\S2 G2. ?\\1 \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 |- VE z = (x',T1') # ?\\2\" using False by auto\n hence H:\"(x',T1') # ?\\2 \\ t3 : T3 ; F3\" using `?\\ |- VE z \\ t3 : T3 ; F3` by auto\n hence K:\"valid ?\\2\" using envop_valid `valid \\'` by auto\n have J:\"?\\2 \\ e'' : T0' ; G'\" using K `valid \\'` closed_any_env `closed e''` Iff by blast\n have \"x' \\ ?\\2\" using Iff valid_elim[of x' T1' \\'] envop_fresh[of x' \\' _ z _] `valid \\'` by auto\n hence \"valid ((x',T1')#?\\2)\" using `valid ?\\2` by auto\n hence ex2:\"\\S3 G3. ?\\2 \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 1 \\ t2[x'::=e''] : S2 ; G2\"\" \\ S2 <: T'\" using `\\ T2 <: T'` by auto\n from ex2 obtain S3 G3 where 2:\"?\\2 \\ t3[x'::=e''] : S3 ; G3\"\" \\ S3 <: T'\" using `\\ T3 <: T'` by auto\n have 4:\"?\\1 = \\' |+ (VE z)\" by auto\n have 5:\"?\\2 = \\' |- (VE z)\" by auto\n have X:\"!! G G' e T F. G = G' \\ G \\ e : T ; F \\ G' \\ e : T ; F\" by auto\n from 1 4 have 6:\"\\' |+ (VE z) \\ t2[x'::=e''] : S2 ; G2\" using X[of ?\\1 \"\\' |+ (VE z)\" \" t2[x'::=e'']\" S2 G2]\n by blast\n from 2 5 have 7:\"\\' |- (VE z) \\ t3[x'::=e''] : S3 ; G3\" using X[of ?\\2 \"\\' |- (VE z)\" \" t3[x'::=e'']\" S3 G3]\n by blast\n \n from typetst 1 2 6 7 have \"\\' \\ (Iff t1 t2 t3)[x'::=e''] : T' ; comb_eff (VE z) G2 G3\" by (auto simp del: comb_eff.simps)\n\t thus ?thesis using `F' = NE` by auto\n\tqed\n next\n\tcase (TE U z)\n\thave \"EX f A A1 Fn B. t1 = (App f (Var z)) \\ (x', T1') # \\' \\ f : B ; Fn \\ \\ B <: A1 \\ T1 : Latent U \\\n\t (x', T1') # \\' \\ (Var z) : A ; VE z \\ \\ A <: A1\" \n using TE te_ty_elim[of ?\\ t1 T1 U z] by auto\n\tthen obtain f A1 A Fn B where A:\"t1 = (App f (Var z)) \"\" (x', T1') # \\' \\ f : B ; Fn\" \"\\ B <: A1 \\ T1 : Latent U\"\n\t \"(x', T1') # \\' \\ (Var z) : A ; VE z \"\" \\ A <: A1\" by auto\n\thave size1:\"(f\\Iff t1 t2 t3)\" using A(1) by (simp )\n\tnote Iff(1)[of f]\n hence ih_f:\"!! c \\ \\ T F e' T0 F0 . \n (c,\\)#\\ \\ f : T ; F \\ \\ \\ e' : T0 ; F0 \\ \\ T0 <: \\ \\ valid ((c,\\)#\\) \\ closed e' \\ e' : values\n \\ EX T' F' . \\ \\ f[c::=e'] : T' ; F' \\ \\ T' <: T \\ \\ F' ' \\ f[x'::=e''] : A' ; Fn' \\ \\ A' <: B \\ \\ Fn' ' \\ f[x'::=e''] : A' ; Fn' \\ \\ A' <:B\" by auto\n\tlet ?mapfun = \"(%f. (% (v,ty). (if (z = v) then (v,f U ty) else (v,ty))))\"\n let ?\\1 = \"(map (?mapfun restrict) \\')\"\n let ?\\2 = \"(map (?mapfun remove) \\')\" \n have \"valid \\'\" using `valid ?\\` using valid_elim[of x' T1' \\'] by auto\n\n\tshow ?case \n\tproof (cases \"x' = z\")\n\t case True\n from A True have \"(Var z)[x'::=e''] = e''\" by auto\n hence D:\"\\' \\ (Var z)[x'::=e''] : T0' ; G'\" \"closed ((Var z)[x'::=e''])\" \"((Var z)[x'::=e'']) : values\"\n\t using Iff by auto\n have \"\\ T0' <: T1'\" .\n note var_ty_elim[of ?\\ z A \"VE z\"]\n hence \"(x', A) : set ?\\\" using A True by auto\n have \"?\\ \\ (Var x') : T1' ; VE x'\" using `valid ?\\` by auto\n hence \"T1' = A\" using A unique_var_typing[of ] True by auto\n have \"\\ T0' <: T1'\" .\n hence \"\\ T0' <: A\" using `T1' = A` by simp\n\t have \"simple_ty T0'\" using `\\' \\ e'' : T0' ; G'` `e'' : values` value_simple_type by auto\n have or:\"\n (\\ T0' <: U \\ \\ T0' <: restrict U T1') \\\n (~ (\\ T0' <: U) \\ \\ T0' <: remove U T1')\" \n using `\\' \\ e'' : T0' ; G'` `e'' : values` `\\ T0' <: T1'` `closed e''` `simple_ty T0'`\n restrict_remove_soundness\n by auto\n have \"?\\1 = envop restrict z U \\'\" by auto\n have \"?\\2 = envop remove z U \\'\" by auto\n have \"x' \\ \\'\" using Iff valid_elim[of x' T1' \\'] by auto\n hence \"?\\1 = \\'\" using True envop_forget `valid \\'` by auto\n hence GA:\"?\\ |+ TE U z = (x',restrict U T1') # \\'\" using True by auto\n hence G1:\"\\ \\ t2 : T2; F2\" using `(?\\ |+ TE U z)\\ t2 : T2 ; F2` by auto\n have \"?\\2 = \\'\" using `x' \\ \\'` True envop_forget `valid \\'` by auto\n hence GB:\"?\\ |- TE U z = (x',remove U T1') # \\'\" using True by auto\n hence G2:\"\\ \\ t3 : T3; F3\" using `(?\\ |- TE U z)\\ t3 : T3 ; F3` by auto\n have \"valid (?\\ |+ TE U z)\" using `valid ?\\` envplus_valid[of ?\\ \"TE U z\"] by auto\n hence G3:\"valid ((x',restrict U T1') # \\')\" using GA by auto\n have \"valid (?\\ |- TE U z)\" using `valid ?\\` envminus_valid[of ?\\ \"TE U z\"] by auto\n hence G4:\"valid ((x',remove U T1') # \\')\" using GB by auto\n show ?thesis\n proof -\n {\n assume \"\\ T0' <: U \"\" \\ T0' <: restrict U T1'\"\n have 2:\"(x', restrict U T1') # \\' \\ t2 : T2 ; F2 \" using `?\\ |+ TE U z \\ t2 : T2 ; F2` GA by auto\n note Iff(2)[of x' \"restrict U T1'\" \\' T2 F2 e'' T0' G'] \n hence \"\\S2 G2. \\' \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 '|+ eff.TT \\ t2[x'::=e''] : S2 ; G2 \"\" \\ S2 <: T2 \"\" \\ G2 T0' <: A1\" \"\\ A' <: A1 \\ T1 : Latent U\" using A B D `\\ T0' <: A` by auto\n hence \"\\' \\ (App f (Var z))[x'::=e''] : T1 ; eff.TT\" using A B D `\\ T0' <: A` `\\ T0' <: U` \n\t\tusing T_AppPredTrue[of \\' _ A' Fn' A1 T1 U _ T0' G'] by auto\n hence L3:\"\\' \\ t1[x'::=e''] : T1 ; eff.TT\" using `t1 = App f (Var z)` by auto\n have \"\\ S2 <: T'\" using L1 `\\ T2 <: T'` by auto\n hence \"\\'\\ (Iff t1 t2 t3)[x'::=e''] : T' ; eff.NE\"\n using L3 ` \\'|+eff.TT \\ t2[x'::=e''] : S2 ; G2` by auto\n hence ?thesis using `F' = NE` by auto \n }\n moreover\n {\n assume \"~ (\\ T0' <: U) \"\" \\ T0' <: remove U T1'\"\n have 3:\"(x', remove U T1') # \\' \\ t3 : T3 ; F3 \" using `?\\ |- TE U z \\ t3 : T3 ; F3` GB by auto\n note Iff(3)[of x' \"remove U T1'\" \\' T3 F3 e'' T0' G'] \n hence \"\\S3 G3. \\' \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 '|+ eff.FF \\ t3[x'::=e''] : S3 ; G3 \"\" \\ S3 <: T3 \"\" \\ G3 T0' <: A1\" using A B D `\\ T0' <: A` by auto\n hence \"\\' \\ (App f (Var z))[x'::=e''] : T1 ; eff.FF\" using A B D `\\ T0' <: A` `~ (\\ T0' <: U)` \n\t\tusing T_AppPredFalse[of \\' _ A' Fn' A1 T1 U _ T0' G'] by auto\n hence L3:\"\\' \\ t1[x'::=e''] : T1 ; eff.FF\" using `t1 = App f (Var z)` by auto\n have \"\\ S3 <: T'\" using L1 `\\ T3 <: T'` by auto\n hence \"\\'\\ (Iff t1 t2 t3)[x'::=e''] : T' ; eff.NE\"\n using L3 ` \\'|+eff.FF \\ t3[x'::=e''] : S3 ; G3` by auto\n hence ?thesis using `F' = NE` by auto \n }\n ultimately show ?thesis using or by auto\n qed\n\tnext\n\t case False\n\t from A False have \"(Var z)[x'::=e''] = (Var z)\" by auto\n\t hence D:\"\\' \\ (Var z)[x'::=e''] : A ; VE z\" using False A\n proof -\n have q1:\"?\\ \\ Var z : A ; VE z\" .\n have \"x' \\ Var z\" using trm.fresh False fresh_atm by auto\n hence \"\\' \\ Var z : A ; VE z\" using q1 fresh_weakening_cons `valid ((x',T1')# \\')` by auto\n thus ?thesis using `(Var z)[x'::=e''] = Var z` by auto\n qed\n\t from A B D have \"\\' \\ App (f[x'::=e'']) ((Var z)[x'::=e'']) : T1 ; TE U z\" by auto\n hence typetst: \"\\' \\ t1[x'::=e''] : T1 ; TE U z\" using A by auto\n\t have F:\"?\\ |+ TE U z = (x',T1') # ?\\1\" using False by auto\n hence H:\"(x',T1') # ?\\1 \\ t2 : T2 ; F2\" using `?\\ |+ TE U z \\ t2 : T2 ; F2` by auto\n hence K:\"valid ?\\1\" using envop_valid `valid \\'` by auto\n have J:\"?\\1 \\ e'' : T0' ; G'\" using K `valid \\'` closed_any_env `closed e''` Iff by blast\n have \"x' \\ ?\\1\" using Iff valid_elim[of x' T1' \\'] envop_fresh[of x' \\' restrict z U] `valid \\'` by auto\n hence \"valid ((x',T1')#?\\1)\" using `valid ?\\1` by auto\n hence ex1:\"\\S2 G2. ?\\1 \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 |- TE U z = (x',T1') # ?\\2\" using False by auto\n hence H:\"(x',T1') # ?\\2 \\ t3 : T3 ; F3\" using `?\\ |- TE U z \\ t3 : T3 ; F3` by auto\n hence K:\"valid ?\\2\" using envop_valid `valid \\'` by auto\n have J:\"?\\2 \\ e'' : T0' ; G'\" using K `valid \\'` closed_any_env `closed e''` Iff by blast\n have \"x' \\ ?\\2\" using Iff valid_elim[of x' T1' \\'] envop_fresh[of x' \\' remove z U] `valid \\'` by auto\n hence \"valid ((x',T1')#?\\2)\" using `valid ?\\2` by auto\n hence ex2:\"\\S3 G3. ?\\2 \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 1 \\ t2[x'::=e''] : S2 ; G2\"\" \\ S2 <: T'\" using `\\ T2 <: T'` by auto\n from ex2 obtain S3 G3 where 2:\"?\\2 \\ t3[x'::=e''] : S3 ; G3\"\" \\ S3 <: T'\" using `\\ T3 <: T'` by auto\n have 4:\"?\\1 = \\' |+ (TE U z)\" by auto\n have 5:\"?\\2 = \\' |- (TE U z)\" by auto\n have X:\"!! G G' e T F. G = G' \\ G \\ e : T ; F \\ G' \\ e : T ; F\" by auto\n from 1 4 have 6:\"\\' |+ (TE U z) \\ t2[x'::=e''] : S2 ; G2\" using X[of ?\\1 \"\\' |+ (TE U z)\" \" t2[x'::=e'']\" S2 G2]\n by blast\n from 2 5 have 7:\"\\' |- (TE U z) \\ t3[x'::=e''] : S3 ; G3\" using X[of ?\\2 \"\\' |- (TE U z)\" \" t3[x'::=e'']\" S3 G3]\n by blast\n \n from typetst 1 2 6 7 have \"\\' \\ (Iff t1 t2 t3)[x'::=e''] : T' ; comb_eff (TE U z) G2 G3\" by (auto simp del: comb_eff.simps)\n\t thus ?thesis using `F' = NE` by auto\n\tqed\n qed\n }\n moreover\n {\n assume \"\\ T1 T3 F3. (?\\ \\ t1 : T1 ; FF) \\ ?\\ \\ t3 : T3 ; F3 \\ \\ T3 <: T' \\ F' = NE\"\n then obtain T1 T3 F3 where \"?\\ \\ t1 : T1 ; FF\" \"?\\ \\ t3 : T3 ; F3\" \"\\ T3 <: T'\" \"F' = NE\"\n\tby auto\n hence \"\\S1 G1. \\' \\ t1[x'::=e''] : S1 ; G1 \\ \\ S1 <: T1 \\ \\ G1 ' \\ t1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: T1 \"\" \\ G1 ' \\ t1[x'::=e''] : S1 ; FF \" using B no_sub_FF by auto\n from prems have \"\\S3 G3. \\' \\ t3[x'::=e''] : S3 ; G3 \\ \\ S3 <: T3 \\ \\ G3 ' \\ t3[x'::=e''] : S3 ; G3 \"\"\\ S3 <: T3\" by auto\n from B C D have \"\\' \\ (Iff (t1[x'::=e'']) (t2[x'::=e'']) (t3[x'::=e''])) : S3 ; eff.NE\" by auto\n hence ?thesis using `\\ T3 <: T'` `\\ S3 <: T3` `F' = NE` by auto\n }\n moreover\n {\n assume \"\\ T1 T2 F2. (?\\ \\ t1 : T1 ; TT) \\ ?\\ \\ t2 : T2 ; F2 \\ \\ T2 <: T' \\ F' = NE\"\n then obtain T1 T2 F2 where \"?\\ \\ t1 : T1 ; TT\" \"?\\ \\ t2 : T2 ; F2\" \"\\ T2 <: T'\" \"F' = NE\"\n\tby auto\n hence \"\\S1 G1. \\' \\ t1[x'::=e''] : S1 ; G1 \\ \\ S1 <: T1 \\ \\ G1 ' \\ t1[x'::=e''] : S1 ; G1 \"\" \\ S1 <: T1 \"\" \\ G1 ' \\ t1[x'::=e''] : S1 ; TT \" using B no_sub_TT by auto\n from prems have \"\\S2 G2. \\' \\ t2[x'::=e''] : S2 ; G2 \\ \\ S2 <: T2 \\ \\ G2 ' \\ t2[x'::=e''] : S2 ; G2 \"\"\\ S2 <: T2\" by auto\n from B C D have \"\\' \\ (Iff (t1[x'::=e'']) (t2[x'::=e'']) (t3[x'::=e''])) : S2 ; eff.NE\" by auto\n hence ?thesis using `\\ T2 <: T'` `\\ S2 <: T2` `F' = NE` by auto\n }\n ultimately show ?thesis using A by blast\n qed\nqed\n\nlemma subst_produces_TT:\n assumes ty:\"(x,T0)#\\ \\ e : T ; TE S x\"\n and vty:\"\\ \\ v : T0' ; F\"\n and A:\"\\ T0' <: T0\"\n and B:\"valid ((x,T0)#\\)\" \n and C:\"closed v\" and D:\"v : values\"\n and E:\"\\ T0' <: S\"\n shows \"EX T'. \\ \\ e[x::=v] : T' ; TT \\ \\ T' <: T\"\nproof -\n obtain f A A1 Fn Sa B\n where\n eq:\"e = App f (Var x)\" and fty:\"(x, T0) # \\ \\ f : B ; Fn \"\n and bsub:\" \\ B <: A1 \\ T : Latent S \" and xty:\" (x, T0) # \\ \\ Var x : A ; VE x \"\n and asub:\" \\ A <: A1\"\n using te_ty_elim[OF ty] by auto\n note preserve_subst[OF fty vty A B C D]\n then obtain T' F' where\n X1:\"\\ \\ f[x::=v] : T' ; F' \" and \" \\ T' <: B \"\" \\ F' T' <: A1 \\ T : Latent S\" using bsub by auto\n have \"(Var x)[x::=v] = v\" by simp\n hence X3:\"\\ \\ (Var x)[x::=v] : T0' ; F\" using vty by auto\n have \"(x, T0) # \\ \\ Var x : T0 ; VE x\" using `valid ((x, T0) # \\)` by auto\n hence \"T0 = A\" using xty unique_var_typing by auto\n hence \"\\ T0' <: A1\" using A asub by auto\n from X1 X2 X3 show ?thesis using T_AppPredTrue[OF X1 X2 X3 `\\ T0' <: A1` E] using asub E eq \n by auto\nqed\n \n\nlemma subst_produces_FF:\n assumes ty:\"(x,T0)#\\ \\ e : T ; TE S x\"\n and vty:\"\\ \\ v : T0' ; F\"\n and A:\"\\ T0' <: T0\"\n and B:\"valid ((x,T0)#\\)\" \n and C:\"closed v\" and D:\"v : values\"\n and E:\"~ \\ T0' <: S\"\n shows \"EX T'. \\ \\ e[x::=v] : T' ; FF \\ \\ T' <: T\"\nproof -\n obtain f A A1 Fn Sa B\n where\n eq:\"e = App f (Var x)\" and fty:\"(x, T0) # \\ \\ f : B ; Fn \"\n and bsub:\" \\ B <: A1 \\ T : Latent S \" and xty:\" (x, T0) # \\ \\ Var x : A ; VE x \"\n and asub:\" \\ A <: A1\"\n using te_ty_elim[OF ty] by auto\n note preserve_subst[OF fty vty A B C D]\n then obtain T' F' where\n X1:\"\\ \\ f[x::=v] : T' ; F' \" and \" \\ T' <: B \"\" \\ F' T' <: A1 \\ T : Latent S\" using bsub by auto\n have veq:\"(Var x)[x::=v] = v\" by simp\n hence X3:\"\\ \\ (Var x)[x::=v] : T0' ; F\" using vty by auto\n have \"(x, T0) # \\ \\ Var x : T0 ; VE x\" using `valid ((x, T0) # \\)` by auto\n hence \"T0 = A\" using xty unique_var_typing by auto\n hence \"\\ T0' <: A1\" using A asub by auto\n from X1 X2 X3 show ?thesis using T_AppPredFalse[OF X1 X2 X3 `\\ T0' <: A1` E] using asub E eq C D veq\n by auto\nqed\n\ninductive_cases beta_cases:\"App (Abs x b T) v \\ e \"\n\ninductive_cases beta_TT_cases:\"\\ \\ App (Abs x b T) v : T' ; TT\"\ninductive_cases beta_FF_cases:\"\\ \\ App (Abs x b T) v : T' ; FF\"\n\nlemma preserve_red:\n assumes typed:\"\\ \\ e : t ; eff\" and cl:\"closed e\"\n and red:\"e \\ e'\" and val:\"valid \\\"\n shows \"EX t' eff'. \\ \\ e' : t' ; eff' \\ \\ t' <: t \\ \\ eff' t rule: reduce.strong_induct)\n case (e_delta v' p v \\ T)\n thm app_ty_elim[of \\ \"(BI p)\" v' T eff]\n hence \"\\T0 T0' T1 le eff' eff'' U. \\ \\ BI p : U ; eff' \\ \\ \\ v' : T0' ; eff'' \\ \\ U <: T0 \\ T1 : le \n \\ \\ T0' <: T0 \\ T1 = T\"\n using app_ty_elim[of \\ \"(BI p)\" v' T eff] by simp\n then obtain T0 T0' T1 le eff' eff'' U where \n A1:\" \\ \\ BI p : U ; eff'\" and A2:\"\\ \\ v' : T0' ; eff''\" and A3:\"\\ T0' <: T0\"\n and A4:\"T1 = T\" and A5:\"\\ U <: T0 \\ T1 : le\"\n by auto\n hence \"U = \\\\<^isub>\\ p\" using e_delta typing_bi[of \\ p _ eff'] by simp\n then obtain A0 A1 LA where \"\\\\<^isub>\\ p = A0 \\ A1 : LA\" \"U = A0 \\ A1 : LA\" by (nominal_induct p rule: builtin.induct) auto\n hence \"\\ A0 \\ A1 : LA <: T0 \\ T1 : le\" using `\\ U <: T0 \\ T1 : le` by auto\n hence B:\"le = LA \\ le = latent_eff.NE\" \"\\ T0 <: A0\" \"\\ A1 <: T1\" using arr_sub_arr_cases[of A0 A1 LA T0 T1 le] by auto\n have C1:\" \\ \\ App (BI p) v' : T1 ; eff\" using prems `T1 = T` by auto\n have C2:\"\\ T0' <: A0\" and C3:\"\\ A1 <: T \" using B A3 A4 by auto\n have C4:\"valid \\\" .\n note delta_soundness[OF `\\\\<^isub>\\ p = A0 \\ A1 : LA` `v' : values` `\\ \\ v' : T0' ; eff''` C2 e_delta(3) C3 `\\ p v' = Some v` C4]\n then obtain A1' eff' where \"\\ \\ v : A1' ; eff' \"\" \\ eff' A1' <: A1\" by auto\n thus ?case using C3 by auto\n next\n case (e_if_false thn els \\' t') \n have \"eff = NE\" using if_false_ty_elim[of _ _ _ _ eff] e_if_false by auto\n have \" \\T0 eff'. \\' \\ els : T0 ; eff' \\ \\ T0 <: t' \" using if_false_ty_elim[of \\' thn els t' eff] e_if_false by auto\n then obtain T0 eff' where f:\"\\' \\ els : T0 ; eff'\" and g:\"\\ T0 <: t'\" by auto\n have \"closed els\" using e_if_false closed_def trm.supp by auto\n hence \"simple_eff eff'\" using closed_eff f by auto\n hence h:\"\\ eff' ' t') \n have \"eff = NE\" using if_true_ty_elim[of \\' v thn els _ eff] e_if_true by auto\n have \" \\T0 eff'. \\' \\ thn : T0 ; eff' \\ \\ T0 <: t' \" using if_true_ty_elim[of \\' v thn els t' eff] e_if_true by auto\n then obtain T0 eff' where f:\"\\' \\ thn : T0 ; eff'\" and g:\"\\ T0 <: t'\" by auto\n have \"closed thn\" using e_if_true closed_def trm.supp by auto\n hence \"simple_eff eff'\" using closed_eff f by auto\n hence h:\"\\ eff' ' T')\n hence \"simple_eff eff\" using closed_eff by auto\n thm app_ty_elim[of \\' \"(Lam[x:T].b)\" v t eff]\n (* hence \"eff = NE\" using app_abs_ty_elim_eff by auto *)\n from e_beta have \"\\T0 T0' T1 le eff' eff'' U. \\' \\ Abs x b T : U ; eff' \\ \\' \\ v : T0' ; eff'' \n \\ \\ T0' <: T0 \\ T1 = T' \\ \\ U <: T0 \\ T1 : le\"\n using app_ty_elim[of \\' \"Abs x b T\" v T' eff] by blast\n then obtain T0 T0' T1 le eff' eff'' U where \" \\' \\ Lam[x:T].b :U; eff'\" and \"\\' \\ v : T0' ; eff''\" \n and \"\\ T0' <: T0\" and \"T1 = T'\" and usub:\"\\ U <: T0 \\ T1 : le \" by auto\n hence \"\\T1a eff2 L S. (x,T)#\\' \\ b : T1a ; eff2 \\ U = T \\ T1a : L \\ (L = Latent S \\ eff2 = TE S x \\ L = latent_eff.NE)\"\n using abs_ty_elim[of \\' x b T \"U\" eff'] e_beta `x \\ \\'` by auto\n then obtain T1a eff2 L S where bty:\"(x,T)#\\' \\ b : T1a ; eff2\" and ueq:\"U = T \\ T1a : L\"\n and \"(L = Latent S \\ eff2 = TE S x \\ L = latent_eff.NE)\"\n by auto\n have \"closed v\" using e_beta closed_def trm.supp by auto\n have \"v : values\" using e_beta beta_cases[of _ _ _ v _ \"v : values\"] trm.inject by auto\n have \"\\ T0 <: T\" using usub ueq arr_sub_arr_cases[of T T1a L T0 T1 le] by auto\n have \"\\ T1a <: T1\" using usub ueq arr_sub_arr_cases[of T T1a L T0 T1 le] by auto\n hence \"\\ T1a <: T'\" using `T1 = T'` by simp\n have \"\\ T0' <: T\" using ` \\ T0' <: T0` `\\T0<:T` by auto\n have \" \\T'a F'. \\' \\ b[x::=v] : T'a ; F' \\ \\ T'a <: T1a\"\n using preserve_subst[of x T \\' b T1a eff2 v T0' eff''] `\\' \\ v : T0' ; eff''` bty `\\ T0' <: T` `x \\ \\'` `valid \\'` \n `closed v` `v : values`\n by auto\n then obtain T'a F' where a:\"\\' \\ b[x::=v] : T'a ; F'\" and b:\"\\ T'a <: T1a\" by auto\n have \"closed (b[x::=v])\" using e_beta reduce_closed by blast\n hence c:\"simple_eff F'\" using a closed_eff by auto\n have ?case using `simple_eff eff` e_beta a b\n\n proof (induct eff rule: simple_eff_cases)\n case NE thus ?case using simple_eff_below_ne[of F'] c a b `\\ T1a <: T'` by auto\n next\n case TT\n obtain U T0 Ta S eff1 eff2 where X1:\"\\' \\ (Lam [x:T].b) : U ; eff1 \" and X2:\"\\ U <: T0 \\ T' : Latent S\" and\n\tX3:\" \\' \\ v : Ta ; eff2 \" \"\\ Ta <: T0\"\" \\ Ta <: S\"\n\tusing trm.inject beta_TT_cases[OF TT(5), of thesis]\n\tby auto\n note abs_ty_elim[OF X1 `x \\ \\'`]\n then obtain T1' eff' L S' where f:\n\t\"(x, T) # \\' \\ b : T1' ; eff' \"\n\t\" U = T \\ T1' : L \"\n\t\" eff1 = eff.TT \"\n\t\" (eff' = TE S' x \\ L = Latent S' \\ L = latent_eff.NE)\" \n\tby auto\n hence \"eff' = TE S x\" \"\\ T0 <: T\" \"\\ T1' <: T'\"using `U = T \\ T1' : L` X2 using arr_sub_arr_cases[of T T1' L T0 T' \"Latent S\"] \n\tby auto\n hence X4:\"(x, T) # \\' \\ b : T1' ; TE S x\" using f by auto\n have valcons:\"valid ((x,T)#\\')\" using `valid \\'` `x \\ \\'` by auto\n have \"\\ Ta <: T\" using `\\ Ta <: T0``\\ T0 <: T` by auto\n have \"EX T2'. \\' \\ b[x::=v] : T2' ; TT \\ \\ T2' <: T1'\" using X3 \n\tusing subst_produces_TT[OF X4 `\\' \\ v : Ta ; eff2` `\\ Ta <: T` valcons ` closed v`` v \\ values` `\\ Ta <: S`] \n\tby auto\n \n thus ?case using `\\ T1' <: T'` by auto\n next\n case FF\n obtain U T0 Ta S eff1 eff2 where X1:\"\\' \\ (Lam [x:T].b) : U ; eff1 \" and X2:\"\\ U <: T0 \\ T' : Latent S\" and\n\tX3:\" \\' \\ v : Ta ; eff2 \" \"\\ Ta <: T0\"\"~ \\ Ta <: S\"\n\tusing trm.inject beta_FF_cases[OF FF(5), of thesis]\n\tby auto\n note abs_ty_elim[OF X1 `x \\ \\'`]\n then obtain T1' eff' L S' where f:\n\t\"(x, T) # \\' \\ b : T1' ; eff' \"\n\t\" U = T \\ T1' : L \"\n\t\" eff1 = eff.TT \"\n\t\" (eff' = TE S' x \\ L = Latent S' \\ L = latent_eff.NE)\" \n\tby auto\n hence \"eff' = TE S x\" \"\\ T0 <: T\" \"\\ T1' <: T'\" using `U = T \\ T1' : L` X2 using arr_sub_arr_cases[of T T1' L T0 T' \"Latent S\"] \n\tby auto\n hence X4:\"(x, T) # \\' \\ b : T1' ; TE S x\" using f by auto\n have valcons:\"valid ((x,T)#\\')\" using `valid \\'` `x \\ \\'` by auto\n have \"\\ Ta <: T\" using `\\ Ta <: T0``\\ T0 <: T` by auto\n\n hence \"EX T2'. \\' \\ b[x::=v] : T2' ; FF \\ \\ T2' <: T1'\" using X3 \n\tusing subst_produces_FF[OF X4 `\\' \\ v : Ta ; eff2` `\\ Ta <: T` valcons ` closed v`` v \\ values` _] \n\tby auto \n thus ?case using `\\ T1' <: T'` by auto\n qed\n thus ?case .\n qed\n\nlemma value_no_ctxt:\n assumes \"v : values\" and \"v = E t\" and \"E : ctxt\"\n shows \"E = (% t . t)\"\n using prems\n proof (induct)\n case bi_value show ?case using `E : ctxt` bi_value\n by (induct E rule: ctxt.induct) (auto simp add: trm.inject)\n next\n case num_value show ?case using `E : ctxt` num_value\n by (induct E rule: ctxt.induct) (auto simp add: trm.inject)\n next\n case abs_value show ?case using `E : ctxt` abs_value\n by (induct E rule: ctxt.induct) (auto simp add: trm.inject)\n next\n case bool_value show ?case using `E : ctxt` bool_value\n by (induct E rule: ctxt.induct) (auto simp add: trm.inject)\n qed\n\n\nlemma subst_in_ctxt_preserves_type:\n assumes a:\"\\ \\ u : T ; F\"\n and b:\"C : ctxt\"\n and c:\"u = C e\"\n and \"~ (e : values)\"\n and \"closed (C e)\" and \"closed (C e')\"\n and \"!! T0 F0 . \\ \\ e : T0 ; F0 \\ EX T1 F1. \\ \\ e' : T1 ; F1 \\ \\ T1 <: T0 \\ \\ F1 \\ C e' : S ; G \\ \\ S <: T \\ \\ G \\ e : T ; F\" using C_Hole by simp\n hence \"EX S G. \\ \\ e' : S; G \\ \\ S <: T \\ \\ G \\ App (E t) arg : T' ; F'\" using C_App1 by auto\n hence D:\"simple_eff F'\" using C_App1 closed_eff by auto\n thus ?case using C_App1 A B C\n proof (induct rule: simple_eff_cases)\n case NE\n hence \"EX T0 T0' T1 le eff' eff'' U. \\ \\ E t :U ; eff' \\ \\ \\ arg : T0' ; eff'' \\ \\ U <: T0 \\ T1 : le\n\t \\ \\ T0' <: T0 \\ T1 = T'\"\n using app_ty_elim by auto\n then obtain T0 T0' le eff' eff'' U\n where a:\"\\ \\ E t : U ; eff'\" and b:\"\\ \\ arg : T0' ; eff''\" and c:\"\\ T0' <: T0\" and d:\"\\ U <: T0 \\ T' : le\"\n\t by auto\n have \"\\S G. \\ \\ E t' : S ; G \\ \\ S <: U \\ \\ G values` C_App1 by auto\n then obtain S G where et'ty:\"\\ \\ E t' : S ; G \" and subarr:\" \\ S <: U \" and \"\\ G \\ App (E t') arg : T' ; NE\" using b c d by auto\n thus ?case by auto\n next\n case FF\n have \"EX S T0 T0' le F1 F2 U. \\ \\ E t : U ; F1 \\ \\ \\ arg : T0' ; F2 \\ \\ T0' <: T0 \\ le = Latent S \\ \n\t ~ (\\ T0' <: S) \\ arg : values \\ closed arg \\ \\ U <: T0 \\ T' : le\"\n using `\\ \\ App (E t) arg : T' ; FF` app_ty_ff_elim[of \\ \"E t\" arg T'] by blast\n then obtain S T0 T0' F1 F2 U where a:\"\\ \\ E t :U ; F1\" and b:\"\\ \\ arg : T0' ; F2 \" \n\t and c:\"\\ T0' <: T0 \" and d:\" ~ (\\ T0' <: S)\" \"closed arg\" \"arg : values\" \" \\ U <: T0 \\ T' : Latent S\"\n by auto\n have \"\\S' G. \\ \\ E t' : S' ; G \\ \\ S' <: U \\ \\ G \\ E t' : S' ; G \" and subarr:\" \\ S' <: U\" and \"\\ G \\ App (E t') arg : T' ; FF\" using b c d by auto\n thus ?case by auto\n next\n case TT\n have \"EX S T0 T0' le F1 F2 U. \\ \\ E t : U ; F1 \\ \\ \\ arg : T0' ; F2 \\ \\ T0' <: T0 \\ \n\t le = Latent S \\ \\ T0' <: S \\ \\ U <: T0 \\ T' : le\"\n using `\\ \\ App (E t) arg : T' ; TT` app_ty_tt_elim[of \\ \"E t\" arg T'] by blast\n then obtain S T0 T0' F1 F2 U where a:\"\\ \\ E t : U ; F1\" and b:\"\\ \\ arg : T0' ; F2 \" \n\t and c:\"\\ T0' <: T0 \" and d:\"\\ T0' <: S\" \"\\ U <: T0 \\ T' : Latent S\"\n by auto\n have \"\\S' G. \\ \\ E t' : S' ; G \\ \\ S' <: U \\ \\ G \\ E t' : S' ; G \" and subarr:\" \\ S' <: U \" and \"\\ G \\ App (E t') arg : T' ; TT\" using b c d by auto\n thus ?case by auto\n qed\n next\n case (C_App2 E v u' t t' T' F')\n have A:\"closed (E t)\" and B:\"closed (E t')\" using C_App2 closed_def trm.supp by auto\n have C:\"\\ \\ App v (E t) : T' ; F'\" using C_App2 by auto\n hence D:\"simple_eff F'\" using C_App2 closed_eff by auto\n thus ?case using C_App2 A B C\n proof (induct rule: simple_eff_cases)\n case NE\n\thave \"\\T0 T0' T1 le eff' eff'' U. \\ \\ v : U ; eff' \\ \\ \\ E t : T0' ; eff'' \\ \\ T0' <: T0 \n\t \\ T1 = T' \\ \\ U <: T0 \\ T1 : le\"\n\t using app_ty_elim[of \\ v \"E t\" T' F'] `\\ \\ App v (E t) : T' ; F'` by blast\n\tthen obtain T0 T0' le eff' eff'' U\n\t where a:\"\\ \\ v : U ; eff'\" \" \\ \\ E t : T0' ; eff'' \" \"\\ T0' <: T0\" \"\\ U <: T0 \\ T' : le\" by auto\n\thence \"\\S G. \\ \\ E t' : S ; G \\ \\ S <: T0' \\ \\ G \\ E t' : S ; G \"\" \\ S <: T0'\" by auto\n\thence \"\\ \\ App v (E t') : T' ; eff.NE\" using a `\\ T0' <: T0` by auto\n\tthus ?case by auto\n next\n case FF \n\thave \"\\S T0 T0' le eff' eff'' U. \\ \\ v : U ; eff' \\ \\ \\ E t : T0' ; eff'' \\ \\ T0' <: T0 \\ le = Latent S \\ ~ (\\ T0' <: S) \\ E t : values \\ closed (E t) \\ \\ U <: T0 \\ T' : le\"\t \n\t using app_ty_ff_elim[of \\ v \"E t\" T'] `\\ \\ App v (E t) : T' ; FF` by blast\n\tthen obtain S T0 T0' le eff' eff'' U \n\t where \"\\ \\ v : U ; eff' \"\" \\ \\ E t : T0' ; eff'' \"\" \\ T0' <: T0 \" \" ~ (\\ T0' <: S) \"\n\t \" E t : values \"\" closed (E t)\"\n\t by auto\n\thence \"E = (% t. t)\" using value_no_ctxt[of \"E t\" E t] `E : ctxt` by simp\n\thence \"t : values\" using `E t : values` by simp\n\tthus ?case using `t \\ values` by auto\n next\n case TT\n\thave \"\\S T0 T0' le eff' eff'' U. \\ \\ v : U ; eff' \\ \\ \\ E t : T0' ; eff'' \\ \\ T0' <: T0 \\ \n\t le = Latent S \\ \\ T0' <: S \\ \\ U <: T0 \\ T' : le\"\n\t using app_ty_tt_elim[of \\ v \"E t\" T'] `\\ \\ App v (E t) : T' ; TT` by blast\n\tthen obtain S T0 T0' le eff' eff'' U\n\t where a:\"\\ \\ v : U ; eff' \"\" \\ \\ E t : T0' ; eff'' \"\" \\ T0' <: T0 \" \" \\ T0' <: S\" \"\\ U <: T0 \\ T' : Latent S\"\n\t by auto\n\thence \"\\S' G. \\ \\ E t' : S' ; G \\ \\ S' <: T0' \\ \\ G \\ E t' : S' ; G \"\" \\ S' <: T0'\" by auto\n\thave \"\\ S' <: S\" using ` \\ S' <: T0'` `\\ T0' <: S` by auto\n\thave \"\\ S' <: T0\" using `\\ S' <: T0'` `\\ T0' <: T0` by auto\n\thence \"\\ \\ App v (E t') : T' ; TT\" using b T_AppPredTrue[OF a(1) a(5) b(1) `\\ S' <: T0` ] using `\\ S' <: S` by auto\n\tthus ?case by auto\n qed\n next\n case (C_Iff E thn els u' t t' T' F')\n have A:\"closed (E t)\" and B:\"closed (E t')\" using C_Iff closed_def trm.supp by auto\n have C:\"\\ \\ Iff (E t) thn els: T' ; F'\" using C_Iff by auto\n hence\n\tbigor:\n\t\"(\\T1 T2 T3 F1 F2 F3. \\ \\ E t : T1 ; F1 \\ \\ |+ F1 \\ thn : T2 ; F2 \\ \\ |- F1 \\ els : T3 ; F3 \\ \\ T2 <: T' \\ \\ T3 <: T' \\ F' = eff.NE) \\\n\t(\\T1 T3 F3. \\ \\ E t : T1 ; FF \\ \\ \\ els : T3 ; F3 \\ \\ T3 <: T' \\ F' = eff.NE) \\\n\t(\\T1 T2 F2. \\ \\ E t : T1 ; TT \\ \\ \\ thn : T2 ; F2 \\ \\ T2 <: T' \\ F' = eff.NE)\"\n\tusing if_ty_elim[of \\ \"(E t)\" thn els T' F'] by auto\n thus ?case\n\tproof -\n\t {\n\t assume \"(\\T1 T2 T3 F1 F2 F3. \\ \\ E t : T1 ; F1 \\ \\ |+ F1 \\ thn : T2 ; F2 \\ \\ |- F1 \\ els : T3 ; F3 \\ \\ T2 <: T' \\ \\ T3 <: T' \\ F' = eff.NE)\"\n\t then obtain T1 T2 T3 F1 F2 F3 where \n\t P:\"\\ \\ E t : T1 ; F1\"\"\\ |+ F1 \\ thn : T2 ; F2\"\"\\ |- F1 \\ els : T3 ; F3\"\"\\ T2 <: T'\"\"\\ T3 <: T'\"\"F' = eff.NE\"\n\t by auto\n\t have \"closed (E t)\" and \"closed (E t')\" using prems trm.supp closed_def by auto\n\t hence \"EX T1' F1'. \\ \\ E t' : T1' ; F1' \\ \\ T1' <: T1 \\ \\ F1' \\ E t' : T1' ; F1' \"\" \\ T1' <: T1 \"\" \\ F1' |+ F1 = \\\" \"\\ |- F1 = \\\" \"\\ |+ F1' = \\\" \"\\ |- F1' = \\\" by (auto simp add: env_plus_simple_eff)\n\t hence \"\\ |+ F1' \\ thn : T2 ; F2 \" \"\\ |- F1' \\ els : T3 ; F3\" using P by auto\n\t hence \"\\ \\ Iff (E t') thn els : T'; comb_eff F1' F2 F3\" using `\\ \\ E t' : T1' ; F1'` ` \\ T2 <: T' `` \\ T3 <: T'`\n\t by (auto simp del: comb_eff.simps)\n\t hence ?thesis using `F' = NE` by auto\n\t }\n\t moreover\n\t {\n\t assume \"(\\T1 T3 F3. \\ \\ E t : T1 ; FF \\ \\ \\ els : T3 ; F3 \\ \\ T3 <: T' \\ F' = eff.NE)\"\n\t then obtain T1 T3 F3 where P:\"\\ \\ E t : T1 ; FF \"\" \\ \\ els : T3 ; F3 \"\" \\ T3 <: T'\"\" F' = eff.NE\"\n\t by auto\n\t have \"closed (E t)\" and \"closed (E t')\" using prems trm.supp closed_def by auto\n\t hence \"EX T1' F1'. \\ \\ E t' : T1' ; F1' \\ \\ T1' <: T1 \\ \\ F1' \\ E t' : T1' ; F1' \"\" \\ T1' <: T1 \"\" \\ F1' \\ E t' : T1' ; FF \" using Q by auto\n\t hence ?thesis using P by auto\n\t }\n\t moreover\n\t {\n\t assume \"(\\T1 T2 F2. \\ \\ E t : T1 ; TT \\ \\ \\ thn : T2 ; F2 \\ \\ T2 <: T' \\ F' = eff.NE)\"\n\t then obtain T1 T2 F2 where P:\"\\ \\ E t : T1 ; TT \"\" \\ \\ thn : T2 ; F2 \"\" \\ T2 <: T'\"\" F' = eff.NE\"\n\t by auto\n\t have \"closed (E t)\" and \"closed (E t')\" using prems trm.supp closed_def by auto\n\t hence \"EX T1' F1'. \\ \\ E t' : T1' ; F1' \\ \\ T1' <: T1 \\ \\ F1' \\ E t' : T1' ; F1' \"\" \\ T1' <: T1 \"\" \\ F1' \\ E t' : T1' ; TT \" using Q by auto\n\t hence ?thesis using P by auto\n\t }\n\t ultimately show ?thesis using bigor by blast\n\tqed\n qed \n \n\nlemma typing_ctxt:\n assumes a:\"\\ \\ C L : T ; eff\"\n and b:\"C : ctxt\"\n shows \"EX T' eff'. \\ \\ L : T' ; eff'\"\n using b a\n proof(induct C arbitrary: T eff rule: ctxt.induct )\n case C_Hole thus ?case by auto\n next\n case (C_App1 C' arg S)\n hence ih: \"!! T0 eff. \\ \\ C' L : T0 ; eff \\ \\T' a. \\ \\ L : T' ; a\" by simp\n obtain T0 T0' T1 le eff' eff'' U where \"\\ \\ C' L : U ; eff'\" \"\\ \\ arg : T0' ; eff''\" \"\\ T0' <: T0 \\ T1 = S\" \n \"\\ U <: T0 \\ T1 : le\"\n using app_ty_elim[of \\ \"C' L\" arg S eff] ` \\ \\ App (C' L) arg : S ; eff` by blast\n thus ?case using ih by auto\n next\n case (C_App2 C' rator S F)\n hence ih: \"!! T0 eff. \\ \\ C' L : T0 ; eff \\ \\T' a. \\ \\ L : T' ; a\" by simp\n obtain T0 T0' T1 le eff' eff'' U where \"\\ \\ rator : U ; eff'\" \"\\ \\ C' L : T0' ; eff''\" \"\\ T0' <: T0 \\ T1 = S\" \n \"\\ U <: T0 \\ T1 : le\"\n using app_ty_elim[of \\ rator \"C' L\" S F] ` \\ \\ App rator (C' L) : S ; F` by blast\n thus ?case using ih by auto\n next\n case (C_Iff C' thn els S F)\n hence ih: \"!! T0 eff. \\ \\ C' L : T0 ; eff \\ \\T' a. \\ \\ L : T' ; a\" by simp\n obtain T0 eff' where \"\\ \\ C' L : T0 ; eff'\"\n using if_ty_elim[of \\ \"C' L\" thn els S F] ` \\ \\ Iff (C' L) thn els : S ; F` by auto\n thus ?case using ih by auto\n qed\n\ninductive_cases step_cases: \"(e::trm) \\ e'\"\n\n\ninductive_cases bi_reduce:\"BI b \\ x\"\ninductive_cases bool_reduce:\"Bool b \\ x\"\ninductive_cases abs_reduce:\"(Lam[a:T].b) \\ x\"\ninductive_cases num_reduce:\"Num n \\ x\"\n\nlemma value_reduce_step:\n assumes A:\"v : values\" and B:\"v \\ (v'::trm)\"\n shows \"v \\ v'\"\n using B A\n proof(induct)\n fix E L R\n assume \"E : ctxt\" \"L \\ R\" \"E L \\ values\"\n hence \"E L = L\" and \"E R = R\" using value_no_ctxt by auto\n thus \"E L \\ E R\" using prems by auto\n qed\n\nlemma value_not_step:\n assumes \"v : values\"\n shows \"~ (EX v'. v \\ v')\"\nproof(rule ccontr, simp)\n assume \"\\v'. v \\ v'\"\n then obtain v' where A:\"v \\ v'\" by auto\n show False using `v : values` A\n proof (induct v rule: values.induct)\n case (bi_value b) thus ?case using bi_reduce by auto\n next\n case num_value thus ?case using num_reduce by auto\n next\n case abs_value thus ?case using abs_reduce by blast\n next\n case bool_value thus ?case using bool_reduce by auto\n qed\n qed\n\n\nlemma value_not_reduce:\n fixes v v' :: trm\n assumes \"v : values\"\n shows \"~ (EX v'. v \\ v')\"\nproof (rule ccontr)\n assume \"\\ \\ (\\v'. v \\ v')\"\n then obtain v' where \"v \\ v'\" by auto\n hence A:\"v \\ v'\" using value_reduce_step prems by auto\n show False using `v : values` A value_not_step by auto\nqed\n\n\ntheorem preservation:\n fixes e e' :: trm\n assumes typed:\"\\ \\ e : t ; eff\" and cl:\"closed e\"\n and red:\"e \\ e'\"\n shows \"EX t' eff'. \\ \\ e' : t' ; eff' \\ \\ t' <: t \\ \\ eff' \" using typing_valid typed by auto\n obtain C L R where \"e = C L\" \"e' = C R\" and \"L \\ R\" and \"C : ctxt\" using red step_cases[of e e' thesis] by auto\n hence f:\"EX T F. \\ \\ L : T ; F\" using typed typing_ctxt by auto\n have \"L \\ values\" using `L \\ R` value_not_step by auto\n have \"closed L\" and \"closed_ctxt C\" using closed_in_ctxt_closed_ctxt[of e C L] `C : ctxt` cl `e = C L` by auto\n hence \"closed R\" using reduce_closed[of L R] `L \\ R` by auto\n hence \"closed (C R)\" and \"closed (C L)\" using `closed_ctxt C` ctxt_closed[of C L] ctxt_closed[of C R] `closed L` by auto\n have \" \\T0 F0. \\ \\ L : T0 ; F0 \\ \\T1 F1. \\ \\ R : T1 ; F1 \\ \\ T1 <: T0 \\ \\ F1 \\ L : T0 ; F0 \\ (\\T1 F1. \\ \\ R : T1 ; F1 \\ \\ T1 <: T0 \\ \\ F1 R` closed_in_ctxt[of C L] cl preserve_red[of \\ L T0 F0 R] `closed L` val by auto\n qed\n hence \"\\S G. \\ \\ C R : S ; G \\ \\ S <: t \\ \\ G e t eff C L R] typed `e = C L` `closed (C L)` `closed (C R)`\n `L \\ values`by auto\n thus ?thesis using `e' = C R` by auto\nqed\n\ntext {* soundness *}\n\nlemma soundness_finite:\n fixes e e' e'' :: trm\n assumes A:\"\\ \\ e : T ; F\" and B:\"e \\\\<^sup>* e'\" and C:\"~ (EX e''. e' \\ e'')\" and E:\"closed e\"\n shows \"EX T' F'. (e' : values \\ \\ \\ e' : T' ; F' \\ \\ T' <: T \\ \\ F' T F rule: step_multi.induct)\n case (sm_refl v)\n have \"v : values\" using sm_refl progress[of \\ v T F] by auto\n thus ?case using sm_refl by auto\nnext\n case (sm_trans a b c)\n have \"closed b\" \"closed c\" using `closed a` `b \\\\<^sup>* c` `a \\ b` step_closed[of a b] multi_step_closed[of b c] by auto\n then obtain T' F' where 1:\"\\ \\ b : T' ; F'\" \"\\ T' <: T\" \"\\ F' a T F b] sm_trans by auto\n then obtain T'' F'' where 2:\"\\ \\ c : T'' ; F''\" \"\\ T'' <: T'\" \"\\ F'' T' F'] sm_trans `closed b` by blast\n have \"\\ T'' <: T\" using 1 2 by auto\n have 3:\"simple_eff F\" using prems closed_eff by auto\n have 4:\"simple_eff F'\" using 1 prems closed_eff `closed b` by auto\n have 5:\"simple_eff F''\" using prems closed_eff `closed c` by auto\n from 3 4 5 have \"\\ F'' T'' <: T` by auto\nqed\n\ntext\n{*\n interesting fact:\n let e = (Iff True 3 x)\n then [] \\ e : Int ; NE\n but e is not closed\n*}\n\n\ntheorem soundness:\n assumes A:\"\\ \\ e : T ; F\" and E:\"closed e\" \n shows \"reduce_forever e \\ (EX v T' F'. (v : values \\ e \\\\<^sup>* v \\ \\ \\ v : T' ; F' \\ \\ T' <: T \\ \\ F' \\<^sup>* e') \\ ~(EX e''. e' \\ e'')\" by (auto simp add: reduce_forever_def)\n then obtain e'::trm where B:\"e \\\\<^sup>* e'\" and C:\"~ (EX e''. e' \\ e'')\" by auto\n hence ?thesis using soundness_finite[OF A B C E] by auto\n }\n moreover\n {\n assume \"reduce_forever e\" \n hence ?thesis by simp\n }\n ultimately show ?thesis by auto\nqed\n\ntext {* simpler type system, without silly rules *}\n\ninductive\n typing2 :: \"varEnv \\ trm \\ ty \\ eff \\ bool\" (\" _ \\\\<^isub>2 _ : _ ; _ \" [60,60,60,60] 60) \nwhere\n T2_Var[intro]: \"\\valid \\; (v,T)\\set \\\\\\ \\ \\\\<^isub>2 Var v : T ; VE v\" \n| T2_Const[intro]: \"valid \\ \\ \\\\<^isub>\\ b = T \\ \\ \\\\<^isub>2 (BI b) : T ; TT\"\n| T2_Num[intro]: \"valid \\ \\ \\ \\\\<^isub>2 (Num n) : ty.Int ; TT\"\n| T2_True[intro]: \"valid \\ \\ \\ \\\\<^isub>2 (Bool True) : ty.TT ; TT\"\n| T2_False[intro]: \"valid \\ \\ \\ \\\\<^isub>2 (Bool False) : ty.FF ; FF\"\n| T2_Abs[intro]: \"\\x \\ \\; ((x,T1)#\\) \\\\<^isub>2 b : T2; eff\\ \\ \\ \\\\<^isub>2 Lam [x:T1].b : (T1\\T2 : latent_eff.NE) ; TT\"\n| T2_App[intro]: \"\\\\ \\\\<^isub>2 e1 : U ; eff1 ; \\ U <: (T0 \\ T1 : le); \\ \\\\<^isub>2 e2 : T; eff2 ; \\ T <: T0\\ \\ \\ \\\\<^isub>2 App e1 e2 : T1 ; NE\"\n| T2_AppPred[intro]: \"\\\\ \\\\<^isub>2 e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S); \\ \\\\<^isub>2 e2 : T; VE x ; \\ T <: T0\\ \\ \\ \\\\<^isub>2 App e1 e2 : T1 ; TE S x\"\n| T2_If[intro]: \"\\\\ \\\\<^isub>2 e1 : T1; eff1; (\\ |+ eff1) \\\\<^isub>2 e2 : T2; eff2; (\\ |- eff1) \\\\<^isub>2 e3 : T3; eff3; \\ T2 <: T; \\ T3 <: T\\ \\\n \\ \\\\<^isub>2 (Iff e1 e2 e3) : T ; comb_eff eff1 eff2 eff3\"\n| T2_AbsPred[intro]: \"\\x \\ \\; ((x,T1)#\\) \\\\<^isub>2 b : T2; TE S x\\ \\ \\ \\\\<^isub>2 Lam [x:T1].b : (T1\\T2 : Latent S) ; TT\"\n\nlemma typing2_typing:\n assumes \"\\ \\\\<^isub>2 e : T ; F\"\n shows \"\\ \\ e : T ; F\"\n using prems\n by induct (auto simp del: comb_eff.simps)\n\nlemma typing2_soundness1:\n assumes A:\"\\ \\\\<^isub>2 e : T ; F\" and E:\"closed e\" \n shows \"reduce_forever e \\ (EX v T' F'. (v : values \\ e \\\\<^sup>* v \\ \\ \\ v : T' ; F' \\ \\ T' <: T \\ \\ F' \\\\<^isub>2 e : ty.Int ; F\" and E:\"closed e\" \n shows \"reduce_forever e \\ (EX v F'. (v : values \\ (e \\\\<^sup>* v) \\ \\ \\\\<^isub>2 v : ty.Int ; F' \\ \\ F' (EX v T' F'. (v : values \\ (e \\\\<^sup>* v) \\ \\ \\ v : T' ; F' \\ \\ T' <: ty.Int \\ \\ F' (e \\\\<^sup>* v) \\ \\ \\ v : T' ; F' \\ \\ T' <: ty.Int \\ \\ F' \\\\<^isub>2 v : ty.Int ; F'\" using num_ty_elim[of \\ _ T' F'] `\\ \\ v : T' ; F'` by auto\n thus ?thesis using `\\ F' \\<^sup>* v)` by auto\n qed (auto)\nqed\n\nlemma typing2_soundness_help:\n assumes A:\"\\ \\\\<^isub>2 e : \\ ; F\" and E:\"closed e\" \n and B: \"((\\v T' F'. v \\ values \\ \\ \\ v : T' ; F' \\ \\ T' <: \\ \\ \\ F' \n (reduce_forever e \\ (\\v F'. v \\ values \\ \\ \\\\<^isub>2 v : \\ ; F' \\ \\ F' (\\v F'. v \\ values \\ \\ \\\\<^isub>2 v : \\ ; F' \\ \\ F' \\\\<^isub>2 e : T ; F\" and E:\"closed e\" and sub:\"\\ T <: BoolTy\"\n shows \"reduce_forever e \\ (EX v F' T'. (v : values \\ (e \\\\<^sup>* v) \\ \\ \\\\<^isub>2 v : T' ; F' \\ \\ F' \\ T' <: T))\"\nproof -\n from typing2_soundness1[OF A E]\n have B:\"reduce_forever e \\ (EX v T' F'. (v : values \\ (e \\\\<^sup>* v) \\ \\ \\ v : T' ; F' \\ \\ T' <: T \\ \\ F' (e \\\\<^sup>* v) \\ \\ \\ v : T' ; F' \\ \\ T' <: T \\ \\ F' \\ v : T' ; F'`] sub by auto\n hence \"\\ \\\\<^isub>2 Bool b : T' ; F'\" using `\\ \\ v : T' ; F'`\n true_ty_elim[of \\ T' F'] false_ty_elim[of \\ T' F']\n by (cases b) auto\n thus ?thesis using `v = Bool b` `e \\\\<^sup>* v` `v : values` `\\ F' T' <: T` by blast\n qed (auto)\nqed\n\nconstdefs\n ground_type :: \"ty \\ bool\"\n \"ground_type t == t = ty.Int \\ t = BoolTy \\ t = ty.TT \\ t = ty.FF\"\n\n\nlemma supp_env:\n \"(a,b) : set (\\ :: varEnv) \\ a : supp \\\"\n by (induct \\) (auto simp add: supp_list_cons supp_prod supp_atm)\n\nlemma envop_supp:\n assumes \"valid \\\"\n shows \"x : (supp (envop f n t \\)) \\ x : (supp \\ :: name set)\"\nproof -\n assume A:\"x : (supp (envop f n t \\))\"\n have \"!! a. a \\ (supp \\ :: name set) \\ a \\ supp (envop f n t \\)\"\n proof -\n fix a\n show \"a \\ (supp \\ :: name set) \\ a \\ supp (envop f n t \\)\"\n using fresh_def[of a \"envop f n t \\\"] envop_fresh[OF _ `valid \\`] fresh_def[of a \\]\n by auto\n qed\n hence \"(supp (envop f n t \\)) <= (supp \\ :: name set)\" by blast\n thus ?thesis using A by auto\nqed\n\ndeclare envop_def[simp del]\n\nlemma envplus_supp:\n assumes \"valid \\\"\n shows \"(supp (\\ |+ F) :: name set) <= (supp \\ :: name set)\"\n using prems\n apply (nominal_induct F rule: eff.induct)\n apply (auto simp add: envop_supp)\n done\n\nlemma envminus_supp:\n assumes \"valid \\\"\n shows \"(supp (\\ |- F) :: name set) <= (supp \\ :: name set)\"\n using prems\n apply (nominal_induct F rule: eff.induct)\n apply (auto simp add: envop_supp)\n done\n\nlemma env_supp_typing2:\n assumes \"\\ \\\\<^isub>2 e : T ; F\"\n shows \"fv e <= supp \\\"\n using prems\nproof (induct \\ e T F rule: typing2.induct)\n case T2_Var\n thus ?case by (auto simp add: trm.supp supp_atm supp_env)\nnext\n case T2_App thus ?case by (auto simp add: trm.supp)\nnext\n case T2_AppPred thus ?case by (auto simp add: trm.supp)\nnext\n case (T2_If \\ _ _ F)\n have \"valid \\\" using typing_valid typing2_typing[OF T2_If(1)] by auto\n thus ?case using T2_If envminus_supp[OF `valid \\`, of F] envplus_supp[OF `valid \\`, of F]\n by (auto simp add: trm.supp)\nnext\n case T2_Abs thus ?case \n by (auto simp add: trm.supp fv_lam abs_supp supp_list_cons supp_prod supp_latent_eff_ty supp_atm)\nnext\n case T2_AbsPred thus ?case \n by (auto simp add: trm.supp fv_lam abs_supp supp_list_cons supp_prod supp_latent_eff_ty supp_atm)\nnext\n case (T2_Const \\ b) thus ?case\n by (nominal_induct b rule: builtin.induct)\n (auto simp add: trm.supp builtin.supp)\nqed (auto simp add: trm.supp supp_nat supp_bool)\n\nlemma empty_env_typing2_closed:\n assumes \"[] \\\\<^isub>2 e : T ; F\"\n shows \"closed e\"\n using env_supp_typing2[OF prems] closed_def prems supp_list_nil\n by auto\n\ntheorem ground_type_soundness:\n assumes A:\"[] \\\\<^isub>2 e : T ; F\" and B:\"ground_type T\"\n shows \"reduce_forever e \\ (EX v T' F'. (v : values \\ (e \\\\<^sup>* v) \\ [] \\\\<^isub>2 v : T' ; F' \\ \\ T' <: T \\ \\ F' (EX v F'. (v : values \\ (e \\\\<^sup>* v) \\ [] \\\\<^isub>2 v : ty.Int ; F' \\ \\ F' T <: BoolTy\" using B by (auto simp add: ground_type_def)\n hence \"reduce_forever e \\ (EX v F' T'. (v : values \\ (e \\\\<^sup>* v) \\ [] \\\\<^isub>2 v : T' ; F' \\ \\ F' \\ T' <: T))\"\n using typing2_soundness_bool[OF A E] by auto\n hence ?thesis using prems by auto\n }\n ultimately show ?thesis using B ground_type_def by auto\nqed\n\n\nend\n\n\nlemma unique_decomposition: \n assumes a:\"closed e\"\n shows \"\\E : ctxt; E t = e; E' : ctxt; E' t' = e\\ \\ E = E'\"\n using a\n proof (nominal_induct e rule: trm.induct)\n case (Var v)\n have f1:\"E = (%t. t)\" using Var by cases auto\n have f2:\"E'= (%t. t)\" using `E' : ctxt` Var by cases auto\n from f1 f2 show ?case by simp\n next\n case (Bool c)\n have f1:\"E = (%t. t)\" using Bool by cases auto\n have f2:\"E'= (%t. t)\" using `E' : ctxt` Bool by cases auto\n from f1 f2 show ?case by simp\n next\n case (Num c)\n have f1:\"E = (%t. t)\" using Num by cases auto\n have f2:\"E'= (%t. t)\" using `E' : ctxt` Num by cases auto\n from f1 f2 show ?case by simp\n next\n case Abs\n have f1:\"E = (%t. t)\" using `E : ctxt` Abs by cases auto\n have f2:\"E'= (%t. t)\" using `E' : ctxt` Abs by cases auto\n from f1 f2 show ?case by simp\n next\n case (Iff tst thn els)\n {\n assume \"tst \\ values\"\n hence \"EX E L R. tst = E L \\ E \\ ctxt \\ L \\ R\" using decomposition \n have f1:\"E = (%t. t)\" using `E : ctxt` Iff apply cases apply (auto simp add: trm.inject)\n have f2:\"E'= (%t. t)\" using `E' : ctxt` Iff by cases auto\n from f1 f2 have ?case by simp\n {\n oops\n \nlemma fresh_fact: \n fixes a::\"name\"\n assumes a: \"a\\t1\"\n and b: \"a\\t2\"\n shows \"a\\(t1[b::=t2])\"\nusing a b\nby (nominal_induct t1 avoiding: a b t2 rule: trm.induct)\n (auto simp add: abs_fresh fresh_atm)\n\nlemma id_subs: \"t[x::=Var x] = t\"\nby (nominal_induct t avoiding: x rule: trm.induct)\n (simp_all add: fresh_atm)\n\nlemma random_eqvt[simp]:\n fixes pi :: \"name prm\"\nshows \"\\T. T \\ set Ts \\ \\ T <: S \\ \\ pi \\ T <: pi \\ S \\\n \\T. T \\ set (pi \\ Ts) \\ \\ T <: pi \\ S\"\nproof - \n assume 0:\"\\T. T \\ set Ts \\ \\ T <: S \\ \\ pi \\ T <: pi \\ S\"\n hence 1:\"!! T. T \\ set Ts \\ \\ T <: S \\ \\ pi \\ T <: pi \\ S\" by auto\n have A:\"(pi \\ Ts) = Ts\" by (induct Ts) auto\n have B:\"pi \\ S = S\" by auto\n have \"!! T. T \\ set (pi \\ Ts) \\ \\ T <: pi \\ S\"\n proof -\n fix T\n assume \"T \\ set (pi \\ Ts)\"\n hence \"T : set Ts\" using A by auto\n hence \"\\ T <: S\" using 1 by auto\n thus \"\\ T <: pi \\ S\" using B by auto\n qed\n thus ?thesis by auto\nqed\n\n\ntext {* complete induction on typing derivations *}\n\nlemma typing_induct_complete[consumes 1, case_names T_Var T_Const T_Num T_True T_False T_App T_Lam T_AppPred T_If \n T_AppPredTrue T_AppPredFalse T_IfTrue T_IfFalse]:\n fixes P :: \"'a::fs_name\\(name\\ty) list \\ trm \\ ty \\ eff \\ bool\"\n and \\ :: \"(name\\ty) list\"\n and t :: \"trm\"\n and T :: \"ty\"\n and F :: \"eff\"\n and x :: \"'a::fs_name\"\n assumes a: \"\\ \\ t : T ; F\"\n and a1: \"\\\\ (a::name) \\ x. valid \\ \\ (a,\\) \\ set \\ \\ \n (!! x t T \\ F. (t\\Var a) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ valid \\ \\ P x \\ (Var a) \\ (VE a)\"\n and a2: \"!! \\ b T x. \\\\<^isub>\\ b = T \\ \n (!! x t T \\ F. (t\\BI b) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ valid \\ \\ P x \\ (BI b) T NE\"\n and a3: \"!! \\ n x. (!! x t T \\ F. (t\\Num n) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ valid \\ \\ \n P x \\ (Num n) ty.Int NE\"\n and a4: \"!! \\ x. (!! x t T \\ F. (t\\Bool True) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ valid \\ \\ \n P x \\ (Bool True) BoolTy TT\"\n and a5: \"!! \\ x. (!! x t T \\ F. (t\\Bool False) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ valid \\ \\ \n P x \\ (Bool False) BoolTy FF\"\n and a6: \"\\\\ \\ \\ t1 t2 x F1 F2 le \\0 U. (!! x t T \\ F. (t\\App t1 t2) \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ \n \\ \\ t1 : U ; F1 \\ \\ U <: \\\\\\:le \\ (\\z. P z \\ t1 U F1) \\ \\ \\ t2 : \\0 ; F2 \\ (\\z. P z \\ t2 \\0 F2) \\ \\ \\0 <: \\\n \\ P x \\ (App t1 t2) \\ NE\"\n and a7: \"\\a \\ \\ \\ t x F0. a\\x \\ a\\\\ \\ ((a,\\) # \\) \\ t : \\ ; F0 \\ (\\z. P z ((a,\\)#\\) t \\ F0) \\\n (!! x t' T \\ F. (t'\\Lam[a:\\].t) \\ \\ \\ t' : T ; F \\ P x \\ t' T F) \n \\ P x \\ (Lam [a:\\].t) (\\\\\\:latent_eff.NE) NE\"\n and a8: \"\\\\ \\ \\ t1 t2 x F1 \\0 S v U. \n (!! x t T \\ F. t \\ App t1 t2 \\ \\ \\ t : T ; F \\ P x \\ t T F) \\ \n \\ \\ t1 : U ; F1 \\ \\ U <: (\\\\\\:Latent S) \\ (\\z. P z \\ t1 U F1) \\ \\ \\ t2 : \\0 ; VE v \\ \n (\\z. P z \\ t2 \\0 (VE v)) \n \\ \\ \\0 <: \\ \\ P x \\ (App t1 t2) \\ (TE S v)\"\n and a9: \"!! \\ e1 e2 e3 T1 T2 T3 T eff1 eff2 eff3 x. \n \\\\ \\ e1 : T1; eff1; !!z. P z \\ e1 T1 eff1; (\\ |+ eff1) \\ e2 : T2; eff2; !!z. P z (\\|+ eff1) e2 T2 eff2; \n (!! x t T \\ F. t \\ Iff e1 e2 e3 \\ \\ \\ t : T ; F \\ P x \\ t T F);\n (\\ |- eff1) \\ e3 : T3; eff3; !!z. P z (\\|- eff1) e3 T3 eff3; \\ T2 <: T; \\ T3 <: T\\\n \\ P x \\ (Iff e1 e2 e3) T NE\"\n and a10: \"!! \\ e1 e2 T0 T1 T S eff1 eff2 x U. \n \\\\ \\ e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S) ; !!z. P z \\ e1 U eff1;\n (!! x t T \\ F. t \\ App e1 e2 \\ \\ \\ t : T ; F \\ P x \\ t T F);\n \\ \\ e2 : T; eff2 ; !! z. P z \\ e2 T eff2; \\ T <: T0; \\ T <: S\\ \\ P x \\ (App e1 e2) T1 TT\"\n and a11: \"!! \\ e1 e2 T0 T1 T S eff1 eff2 x U. \n \\\\ \\ e1 : U; eff1; \\ U <: (T0 \\ T1 : Latent S) ; !!z. P z \\ e1 U eff1;\n (!! x t T \\ F. t \\ App e1 e2 \\ \\ \\ t : T ; F \\ P x \\ t T F);\n \\ \\ e2 : T; eff2 ; !! z. P z \\ e2 T eff2; \\ T <: T0; ~(\\ T <: S) ; e2 : values ; closed e2\\\n \\ P x \\ (App e1 e2) T1 FF\"\n and a12: \"!! \\ e1 e2 e3 T T1 T2 eff x. \\\\ \\ e1 : T1 ; TT ; !! z. P z \\ e1 T1 TT; \n (!! x t T \\ F. t \\ Iff e1 e2 e3 \\ \\ \\ t : T ; F \\ P x \\ t T F);\n \\ \\ e2 : T2 ; eff; !!z .P z \\ e2 T2 eff; \\ T2 <: T\\ \\ P x \\ (Iff e1 e2 e3) T NE\"\n and a13: \"!! \\ e1 e2 e3 T T1 T3 eff x. \\\\ \\ e1 : T1 ; FF ; !! z. P z \\ e1 T1 FF; \n (!! x t T \\ F. t \\ Iff e1 e2 e3 \\ \\ \\ t : T ; F \\ P x \\ t T F);\n \\ \\ e3 : T3 ; eff; !!z .P z \\ e3 T3 eff; \\ T3 <: T\\ \\ P x \\ (Iff e1 e2 e3) T NE\"\n shows \"P x \\ t T F\"\n using a\n proof (nominal_induct t avoiding: x \\ T F rule: trm_comp_induct)\n case (Var v) \n thus ?case using a1 var_ty_elim[of \\ v T F] by auto\n next\n case (App t1 t2 x \\ T)\n show ?case using App(4)\n proof (induct rule: app_ty_elim2)\n case 1 thus ?thesis using a6 App trm.inject ty.inject by auto\n next\n case 2 thus ?thesis using a8 App trm.inject ty.inject by auto\n next\n case 3 thus ?thesis using a10 App trm.inject ty.inject by auto\n next\n case 4 thus ?thesis using a11 App trm.inject ty.inject by auto\n qed\n next\n case Iff\n show ?case using Iff(5)\n proof (induct rule: iff_ty_elim2)\n case 1 thus ?thesis using a9 Iff trm.inject ty.inject by auto\n next\n case 2 thus ?thesis using a12 Iff trm.inject ty.inject by auto\n next\n case 3 thus ?thesis using a13 Iff trm.inject ty.inject by auto\n qed\n next\n case (Lam v b x \\ S1 F S2)\n show ?case using Lam abs_ty_elim[of \\ v b S2 S1 F] a7 by (auto simp add: trm.inject ty.inject)\n next\n case (BI b) thus ?case using bi_ty_elim[of \\ b T F] trm.inject a2 by auto\n next\n case (Num n) thus ?case using num_ty_elim[of \\ n T F] trm.inject a3 by auto\n next\n case (Bool b) thus ?case using true_ty_elim[of \\ T F] false_ty_elim[of \\ T F] trm.inject a4 a5 by (cases b) auto\nqed\n\n\n", "meta": {"author": "samth", "repo": "samth.github.io", "sha": "5005dd35a90a9c0d92c485b0551cb3ef993f462b", "save_path": "github-repos/isabelle/samth-samth.github.io", "path": "github-repos/isabelle/samth-samth.github.io/samth.github.io-5005dd35a90a9c0d92c485b0551cb3ef993f462b/TypedScheme.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.27779215608359015}} {"text": "theory PermEnvMisc\n imports PermEnvLeq\nbegin\n \n (* \n ####################################\n P2. weak disjointness lemmas\n ####################################\n *) \n\nlemma mini_disj_leq_use_env1: \"\\ mini_disj_use_env r_s r_ex; leq_use_env r_x r_s \\ \\ mini_disj_use_env r_x r_ex\" \n apply (simp add: leq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (rule_tac allI)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n\nlemma mini_disj_leq_use_env2: \"\\ mini_disj_use_env r_ex r_s; leq_use_env r_x r_s \\ \\ mini_disj_use_env r_ex r_x\" \n apply (simp add: leq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (rule_tac allI)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto) \n apply (case_tac \"r_x x\")\n apply (auto)\n done \n\nlemma mini_disj_comp_use_env: \"\\ mini_disj_use_env r_x r_ex; mini_disj_use_env r_s r_ex \\ \\ mini_disj_use_env (comp_use_env r_x r_s) r_ex\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE) \n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \nlemma mini_disj_comp_use_env_alt: \"\\ mini_disj_use_env r_ex r_x; mini_disj_use_env r_ex r_s \\ \\ mini_disj_use_env r_ex (comp_use_env r_x r_s)\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: comp_use_env_def)\n done \n\nlemma mini_disj_diff_use_env: \"mini_disj_use_env r_x (diff_use_env r_s r_x)\"\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n\nlemma swp_mini_disj_use_env: \"\\ leq_use_env rx_p (diff_use_env r_s r_ex) \\ \\ mini_disj_use_env r_ex rx_p\" \n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in leq_use_none)\n apply (auto)\n apply (rule_tac diff_use_none_ex)\n apply (auto)\n done \n \nlemma mini_disj_empty_use_env: \"mini_disj_use_env empty_use_env r_s\"\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n \n \n (* \n ####################################\n P3. main disjointness lemmas\n ####################################\n *) \n\nlemma comm_disj_use_env: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env r_x r_s\"\n apply (simp add: disj_use_env_def)\n done \n \n (* - ordering lemmas *)\n \nlemma disj_leq_use_env1: \"\\ disj_use_env r_s r_ex; leq_use_env r_x r_s \\ \\ disj_use_env r_x r_ex\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env1)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env2)\n apply (auto)\n done\n\nlemma disj_leq_use_env2: \"\\ disj_use_env r_ex r_s; leq_use_env r_x r_s \\ \\ disj_use_env r_ex r_x\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env2)\n apply (auto)\n apply (rule_tac mini_disj_leq_use_env1)\n apply (auto)\n done \n \n (* - comp lemmas *)\n \nlemma disj_comp_use_env1: \"\\ disj_use_env r_s1 r_ex; disj_use_env r_s2 r_ex \\ \\ disj_use_env (comp_use_env r_s1 r_s2) r_ex\"\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env_alt)\n apply (auto)\n done\n\nlemma disj_comp_use_env2: \"\\ disj_use_env r_ex r_s1; disj_use_env r_ex r_s2 \\ \\ disj_use_env r_ex (comp_use_env r_s1 r_s2)\" \n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env_alt)\n apply (auto)\n apply (rule_tac mini_disj_comp_use_env)\n apply (auto)\n done\n\n (* - lemmas TO BE SORTED *) \n\nlemma gen_mini_disj_use_env1: \"\\ disj_use_env r_x r_s \\ \\ mini_disj_use_env r_x r_s\" \n apply (simp add: disj_use_env_def)\n done\n \nlemma gen_mini_disj_use_env2: \"\\ disj_use_env r_s r_x \\ \\ mini_disj_use_env r_x r_s\" \n apply (simp add: disj_use_env_def)\n done\n \nlemma disj_add_use_env: \"\\ r_x x = NoPerm; disj_use_env r_s r_x \\ \\ disj_use_env (add_use_env r_s x r) r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: add_use_env_def)\n done \n \nlemma disj_rem_use_env1: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env r_s (rem_use_env r_x x)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n done\n \nlemma disj_rem_use_envx: \"\\ disj_use_env r_s r_x \\ \\ disj_use_env (rem_use_env r_s x) r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n done \n \nlemma disj_rem_use_env2: \"\\ r_s x = NoPerm; disj_use_env r_s (rem_use_env r_x x) \\ \\ disj_use_env r_s r_x\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: rem_use_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n done\n\nlemma disj_add_rem_use_env: \"\\ r_s x = NoPerm; disj_use_env r_s r_x \\ \\ disj_use_env (add_use_env r_s x r) (rem_use_env r_x x)\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: rem_use_env_def)\n done\n\nlemma double_weak_disj_use_env: \"\\ weak_use_env r_x; weak_use_env r_s \\ \\ disj_use_env r_x r_s\"\n apply (simp add: weak_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n done\n \n (* - empty lemmas *)\n \nlemma disj_empty_use_env1: \"disj_use_env r_s empty_use_env\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n\nlemma disj_empty_use_env2: \"disj_use_env empty_use_env r_s\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n \n (* - singleton lemmas *)\n \nlemma disj_one_use_env: \"\\ r_s x = NoPerm \\ \\ disj_use_env r_s (one_use_env x OwnPerm)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n done \n \n (* \n ####################################\n P3. weakness lemmas\n ####################################\n *) \n \nlemma leq_weak_use_env: \"\\ weak_use_env r_s; leq_use_env r_x r_s \\ \\ weak_use_env r_x\" \n apply (simp add: weak_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_s x\")\n apply (auto)\n done \n \nlemma weak_comp_use_env1: \"\\ weak_use_env (comp_use_env r_sa r_sb) \\ \\ weak_use_env r_sa\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sb x\")\n apply (auto)\n done\n \nlemma weak_comp_use_env2: \"\\ weak_use_env (comp_use_env r_sa r_sb) \\ \\ weak_use_env r_sb\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sa x\")\n apply (auto)\n done \n \nlemma dist_weak_comp_use_env: \"\\ weak_use_env r_sa; weak_use_env r_sb \\ \\ weak_use_env (comp_use_env r_sa r_sb)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_sa x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n apply (case_tac \"r_sb x\")\n apply (auto)\n done \n \nlemma weak_diff_use_env: \"\\ weak_use_env r_s \\ \\ weak_use_env (diff_use_env r_s r_x)\" \n apply (simp add: weak_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done \n\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/PermEnvMisc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2776401202318738}} {"text": "theory SingleInstruction_CFG\nimports SSA_CFG Generic_Interpretation\nbegin\n\ndatatype node'_part = PhisUses | Defs\ntype_synonym 'node node' = \"'node \\ node'_part\"\n\nlemma node'_cases:\n obtains (PhisUses) n' where \"n = (n',PhisUses)\"\n| (Defs) n' where \"n = (n',Defs)\"\n by (cases n, case_tac b, auto)\n\nlemma[dest!]: \"x \\ PhisUses \\ x = Defs\" by (cases x, simp)\nlemma[dest!]: \"x \\ Defs \\ x = PhisUses\" by (cases x, auto)\n\ninstantiation node'_part :: linorder\nbegin\n definition[simp]: \"less_node'_part n m \\ n = PhisUses \\ m = Defs\"\n\n definition[simp]: \"less_eq_node'_part (n::node'_part) m \\ n = m \\ n < m\"\n\n instance by intro_classes auto\nend\n\nlocale SingleInstruction_CFG = CFG_base \\n predecessors Entry \"defs\" \"uses\"\n+ graph_Entry \\n predecessors Entry\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry :: \"'node\" and\n \"defs\" :: \"'node \\ 'var::linorder set\" and\n \"uses\" :: \"'node \\ 'var set\" +\nassumes defs_finite: \"finite (defs n)\"\nassumes uses_in_\\n: \"v \\ uses n \\ n \\ set \\n\"\nassumes uses_finite: \"finite (uses n)\"\nbegin\n definition[code]: \"disj_\\n = List.maps (\\n. [(n, PhisUses), (n, Defs)]) \\n\"\n definition[code]: \"disj_predecessors \\ \\(n,part). case part of\n PhisUses \\ map (\\n. (n, Defs)) (predecessors n)\n | Defs \\ if n \\ set \\n then [(n, PhisUses)] else []\"\n definition[code]: \"disj_Entry = (Entry, PhisUses)\"\n definition[code]: \"disj_defs \\ \\(n,part). case part of\n PhisUses \\ {}\n | Defs \\ defs n\"\n definition[code]: \"disj_uses \\ \\(n,part). case part of\n PhisUses \\ uses n\n | Defs \\ {}\"\n\n declare List.maps_def[simp]\n\n lemma disj_\\n[simp]: \"(n,p) \\ set disj_\\n \\ n \\ set \\n\"\n by (cases p, auto simp: disj_\\n_def)\n\n lemma distinct_disj_\\n: \"distinct disj_\\n\"\n unfolding disj_\\n_def List.maps_def\n by (rule distinct_concat, auto simp: \\n_distinct inj_on_def distinct_map)\n\n sublocale disj: graph_path_base disj_\\n disj_predecessors .\n\n lemma disj_inEdges_pred: \"set (disj.inEdges n) = pred (disj.\\ ()) n\"\n by (cases n, auto simp: \"disj.inEdges_def\" pred_def disj.\\e_def)\n\n lemma PhisUses_disj_predecessors [simp]: \"(n,PhisUses) \\ set (disj_predecessors m) \\ m = (n,Defs) \\ n \\ set \\n\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n\n lemma Defs_disj_predecessors [simp]: \"(n,Defs) \\ set (disj_predecessors m) \\ (\\m'. m = (m',PhisUses) \\ n \\ set (predecessors m'))\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n\n lemma disj_predecessor_is_node: \"n \\ set (disj_predecessors m) \\ n \\ set disj_\\n\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n\n lemma disj_successor_is_node: \"n \\ set (disj_predecessors m) \\ m \\ set disj_\\n\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n\n lemma finite_disj_\\e: \"finite disj.\\e\"\n by (rule finite_subset[of _ \"set disj_\\n \\ {()} \\ set disj_\\n\"])\n (auto simp: disj.\\e_def dest: disj_predecessor_is_node disj_successor_is_node)\n\n sublocale disj: graph_path disj_\\n disj_predecessors\n apply unfold_locales\n apply (simp add: disj_\\n_def)\n apply (simp add: finite_disj_\\e)\n apply (auto simp: disj.\\e_def dest: disj_predecessor_is_node)[1]\n apply (auto simp: disj.\\e_def dest: disj_successor_is_node)[1]\n apply (rule set_iterator_I)\n prefer 3\n apply (simp add: foldri_def)\n apply (simp add: distinct_disj_\\n)\n apply simp\n unfolding disj_inEdges_pred[symmetric]\n apply (rule set_iterator_foldri_correct)\n unfolding \"disj.inEdges_def\"\n apply (auto simp: disj_predecessors_def distinct_map distinct_predecessors split: node'_part.split)\n done\n\n definition \"disj_pathElems p ns p' \\\n let ns = List.maps (\\n. [(n, PhisUses), (n, Defs)]) ns in\n let ns = if p = Defs then tl ns else ns in\n if p' = PhisUses then butlast ns else ns\"\n\n lemma disj_pathElems_empty [simp]: \"disj_pathElems p [] p' = []\"\n by (auto simp: disj_pathElems_def Let_def)\n\n lemma hd_disj_pathElems [simp]: \"disj_pathElems p ns p' \\ [] \\ hd (disj_pathElems p ns p') = (hd ns,p)\"\n by (cases ns, auto simp: disj_pathElems_def Let_def)\n\n lemma disj_pathElems_trivial [simp]: \"disj_pathElems p [n] p = [(n,p)]\"\n by (auto simp: disj_pathElems_def Let_def)\n\n lemma disj_pathElems_cons_Defs [simp]: \"ns \\ [] \\ disj_pathElems Defs (n#ns) p' = (n, Defs)#disj_pathElems PhisUses ns p'\"\n by (auto simp: disj_pathElems_def Let_def)\n\n lemma disj_pathElems_cons_PhisUses: \"ns \\ [] \\ disj_pathElems PhisUses ns p' = (hd ns, PhisUses)#disj_pathElems Defs ns p'\"\n by (cases ns, auto simp: disj_pathElems_def Let_def)\n\n lemma butlast_Defs_in_disj_pathElems: \"n \\ set (butlast ns) \\ (n, Defs) \\ set (disj_pathElems PhisUses ns p)\"\n by (cases ns rule: rev_cases, auto simp: disj_pathElems_def Let_def butlast_append)\n\n lemma path2_to_disj_path2:\n assumes \"path2 n ns m\" \"p \\ p'\"\n shows \"disj.path2 (n,p) (disj_pathElems p ns p') (m,p')\"\n using assms(1) proof (induction rule: path2_induct)\n case empty_path\n have[simp]: \"m \\ set \\n\" using assms by auto\n show ?case\n proof (cases \"p = p'\")\n case True\n thus ?thesis\n by auto\n next\n case False\n with empty_path assms(2) have [simp]: \"p = PhisUses\" \"p' = Defs\"\n by auto\n show ?thesis\n by (simp add: disj_pathElems_cons_PhisUses, rule disj.Cons_path2, rule disj.empty_path2, auto)\n qed\n next\n case (Cons_path ns n' n)\n have IH: \"disj.path2 (n,p) (disj_pathElems p ns p') (m,p')\"\n by (rule Cons_path.IH)\n hence [simp]: \"ns \\ []\" by (cases ns, auto)\n from IH have [simp]: \"hd ns = n\" by - (frule disj.path2_hd, subst(asm) hd_disj_pathElems, auto)\n show ?case\n apply (cases p)\n apply simp\n apply (subst disj_pathElems_cons_PhisUses)\n apply simp\n apply simp\n apply (rule disj.Cons_path2)\n apply (rule disj.Cons_path2)\n using IH apply simp\n using Cons_path.hyps(2) apply auto[2]\n apply auto[1]\n apply (subst disj_pathElems_cons_PhisUses)\n apply simp\n apply (rule disj.Cons_path2)\n apply (rule disj.Cons_path2)\n using IH apply simp\n using IH Cons_path.hyps(2) by auto\n qed\n\n lemma disj_path2_to_path2:\n assumes \"disj.path2 n ns m\"\n obtains ns' where \"path2 (fst n) ns' (fst m)\" \"disj_pathElems (snd n) ns' (snd m) = ns\"\n using assms proof (induction rule: \"disj.path2_induct\")\n case empty_path\n from assms have \"fst m \\ set \\n\"\n by - (drule disj.path2_tl_in_\\n, auto simp: disj_\\n_def)\n thus ?case by - (rule empty_path(1), auto simp: disj_pathElems_trivial)\n next\n case (Cons_path ns n' n)\n show ?case\n proof (rule Cons_path.IH)\n fix ns'\n assume ns': \"fst n\\ns'\\fst m\" \"disj_pathElems (snd n) ns' (snd m) = ns\"\n hence[simp]: \"ns' \\ []\" by auto\n show thesis\n proof (cases n' rule: node'_cases)\n case[simp]: (PhisUses n')\n from Cons_path(2) have[simp]: \"n' = fst n\" \"snd n = Defs\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n from ns' show ?thesis\n by - (rule Cons_path.prems(1), auto dest: path2_hd simp: disj_pathElems_cons_PhisUses)\n next\n case[simp]: (Defs n')\n from Cons_path(2) have \"n' \\ set (predecessors (fst n))\" and[simp]: \"snd n = PhisUses\"\n by (auto simp: disj_predecessors_def split: node'_part.splits)\n with Cons_path(3) ns' show ?thesis\n by - (rule Cons_path.prems(1), auto simp: disj_pathElems_cons_Defs)\n qed\n qed\n qed\n\n sublocale disj: CFG disj_\\n disj_predecessors disj_Entry disj_defs disj_uses\n apply unfold_locales\n apply (simp add: disj_\\n_def disj_Entry_def)\n apply (simp add: disj_predecessors_def disj_Entry_def)\n apply (subst(asm) disj_\\n_def disj_Entry_def)\n apply (auto simp: disj_Entry_def dest!: Entry_reaches path2_to_disj_path2[where p=PhisUses])[1]\n apply (auto simp: disj_defs_def disj_uses_def split: node'_part.splits)[1]\n apply (auto simp: disj_defs_def split: node'_part.split intro: defs_finite)[1]\n apply (auto simp: disj_uses_def disj_\\n_def split: node'_part.splits intro: uses_in_\\n)[1]\n apply (auto simp: disj_uses_def split: node'_part.splits intro: uses_finite)\n done\nend\n\nlocale SingleInstruction_CFG_wf = SingleInstruction_CFG \\n predecessors Entry \"defs\" \"uses\"\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry :: \"'node\" and\n \"defs\" :: \"'node \\ 'var::linorder set\" and\n \"uses\" :: \"'node \\ 'var set\" +\n(* note that, in contrast to @{term defAss'}, the last node must be excluded *)\nassumes def_ass_uses: \"\\m \\ set \\n. \\v \\ uses m. \\ns. Entry\\ns\\m \\ (\\n \\ set (butlast ns). v \\ defs n)\"\nbegin\n lemma disj_defAss':\n assumes \"m \\ set disj_\\n\" \"v \\ disj_uses m\"\n shows \"disj.defAss' m v\"\n proof (rule \"disj.defAss'I\")\n fix ns\n assume \"disj.path2 disj_Entry ns m\"\n then obtain ns' where ns': \"Entry\\ns'\\fst m\" \"disj_pathElems PhisUses ns' (snd m) = ns\"\n by (rule disj_path2_to_path2, simp add: disj_Entry_def)\n with assms(2) obtain n where \"n \\ set (butlast ns')\" \"v \\ defs n\"\n using def_ass_uses[rule_format, of \"fst m\" v ns'] by (auto simp: disj_uses_def dest!: path2_tl_in_\\n split:node'_part.splits)\n with ns'(2) show \"\\n\\set ns. v \\ disj_defs n\"\n by - (rule bexI[where x=\"(n,Defs)\"], auto simp: disj_defs_def butlast_Defs_in_disj_pathElems)\n qed\n\n sublocale disj: CFG_Construct_linorder disj_\\n disj_predecessors disj_Entry disj_defs disj_uses\n by unfold_locales (auto intro!: disj_defAss')\n\n lift_definition disj_cfg_wf :: \"('node node', 'var) gen_cfg_wf\" is \"\\\n gen_\\n = disj_\\n,\n gen_predecessors = disj_predecessors,\n gen_Entry = disj_Entry,\n gen_defs = disj_defs,\n gen_uses = disj_uses\n \\\"\n by simp unfold_locales\n\n \n\n (*\n definition \"ssa_defs n = disj.defs' (n,Defs)\"\n definition \"ssa_uses n = disj.uses' (n,PhisUses)\"\n definition \"ssa_phis = Mapping.map (\\(n,v). ((n,PhisUses),v)) id disj.phis'_code\"\n\n sublocale ssa: CFG_SSA_Transformed \\n predecessors Entry defs \"uses\" ssa_defs ssa_uses \"Mapping.lookup ssa_phis\" disj.var\n apply unfold_locales\n *)\n\n definition \"disj_ssa_cfg \\ let (uses,phis) = disj.uses'_phis' in \\\n gen_\\n = disj_\\n,\n gen_predecessors = disj_predecessors,\n gen_Entry = disj_Entry,\n gen_defs = disj_defs,\n gen_uses = disj_uses,\n gen_ssa_defs = disj.defs',\n gen_ssa_uses = uses,\n gen_phis = phis,\n gen_var = gen_wf_var\n \\\"\nend\n\ntypedef ('node, 'var) si_cfg_wf = \"{g :: ('node::linorder, 'var::linorder) gen_cfg.\n SingleInstruction_CFG_wf (gen_\\n g) (gen_predecessors g) (gen_Entry g) (gen_defs g) (gen_uses g)}\"\napply (rule exI[where x=\"trivial_gen_cfg undefined\"])\napply auto\napply unfold_locales\nby (auto simp: gen_cfg.defs graph_path_base.path2_def pred_def \"graph_path_base.\\e_def\" \"graph_path_base_base.inEdges_def\" List.maps_def intro!: graph_path_base.path.intros(1) exI)\n\n\nsetup_lifting type_definition_si_cfg_wf\n\nlift_definition si_wf_\\n :: \"('node::linorder, 'var::linorder) si_cfg_wf \\ 'node list\" is gen_\\n .\nlift_definition si_wf_predecessors :: \"('node::linorder, 'var::linorder) si_cfg_wf \\ 'node \\ 'node list\" is gen_predecessors .\nlift_definition si_wf_Entry :: \"('node::linorder, 'var::linorder) si_cfg_wf \\ 'node\" is gen_Entry .\nlift_definition si_wf_defs :: \"('node::linorder, 'var::linorder) si_cfg_wf \\ 'node \\ 'var set\" is gen_defs .\nlift_definition si_wf_uses :: \"('node::linorder, 'var::linorder) si_cfg_wf \\ 'node \\ 'var set\" is gen_uses .\n\nglobal_interpretation si_wf: SingleInstruction_CFG_wf \"si_wf_\\n g\" \"si_wf_predecessors g\" \"si_wf_Entry g\" \"si_wf_defs g\" \"si_wf_uses g\"\nfor g\ndefines\n si_wf_disj_\\n = \"si_wf.disj_\\n\" and\n si_wf_disj_predecessors = \"si_wf.disj_predecessors\" and\n si_wf_disj_Entry = \"si_wf.disj_Entry\" and\n si_wf_disj_defs = \"si_wf.disj_defs\" and\n si_wf_disj_uses = \"si_wf.disj_uses\" and\n si_wf_disj_cfg_wf = \"si_wf.disj_cfg_wf\"\n by transfer\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/SingleInstruction_CFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.27751764800417367}} {"text": "chapter \\Forward Analysis on DBMs\\\n\ntheory DBM_Operations\n imports DBM_Basics\nbegin\n\nsection \\Auxiliary\\\n\nlemma gt_swap:\n fixes a b c :: \"'t :: time\"\n assumes \"c < a + b\"\n shows \"c < b + a\"\nby (simp add: add.commute assms)\n\nlemma le_swap:\n fixes a b c :: \"'t :: time\"\n assumes \"c \\ a + b\"\n shows \"c \\ b + a\"\nby (simp add: add.commute assms)\n\nabbreviation clock_numbering :: \"('c \\ nat) \\ bool\"\nwhere\n \"clock_numbering v \\ \\ c. v c > 0\"\n\nsection \\Time Lapse\\\n\ndefinition up :: \"('t::time) DBM \\ ('t::time) DBM\"\nwhere\n \"up M \\\n \\ i j. if i > 0 then if j = 0 then \\ else min (dbm_add (M i 0) (M 0 j)) (M i j) else M i j\"\n\nlemma dbm_entry_dbm_lt:\n assumes \"dbm_entry_val u (Some c1) (Some c2) a\" \"a \\ b\"\n shows \"dbm_entry_val u (Some c1) (Some c2) b\"\nusing assms\nproof (cases, auto, goal_cases)\n case 1 thus ?case by (cases, auto)\nnext\n case 2 thus ?case by (cases, auto)\nqed\n\nlemma dbm_entry_dbm_min2:\n assumes \"dbm_entry_val u None (Some c) (min a b)\"\n shows \"dbm_entry_val u None (Some c) b\"\nusing dbm_entry_val_mono_2[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min3:\n assumes \"dbm_entry_val u (Some c) None (min a b)\"\n shows \"dbm_entry_val u (Some c) None b\"\nusing dbm_entry_val_mono_3[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min:\n assumes \"dbm_entry_val u (Some c1) (Some c2) (min a b)\"\n shows \"dbm_entry_val u (Some c1) (Some c2) b\"\nusing dbm_entry_val_mono_1[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min3':\n assumes \"dbm_entry_val u (Some c) None (min a b)\"\n shows \"dbm_entry_val u (Some c) None a\"\nusing dbm_entry_val_mono_3[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min2':\n assumes \"dbm_entry_val u None (Some c) (min a b)\"\n shows \"dbm_entry_val u None (Some c) a\"\nusing dbm_entry_val_mono_2[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min':\n assumes \"dbm_entry_val u (Some c1) (Some c2) (min a b)\"\n shows \"dbm_entry_val u (Some c1) (Some c2) a\"\nusing dbm_entry_val_mono_1[folded less_eq, OF assms] by auto\n\nlemma DBM_up_complete': \"clock_numbering v \\ u \\ ([M]\\<^bsub>v,n\\<^esub>)\\<^sup>\\ \\ u \\ [up M]\\<^bsub>v,n\\<^esub>\"\nunfolding up_def DBM_zone_repr_def DBM_val_bounded_def zone_delay_def\nproof (safe, goal_cases)\n case prems: (2 u d c)\n hence *: \"dbm_entry_val u None (Some c) (M 0 (v c))\" by auto\n thus ?case\n proof (cases, goal_cases)\n case (1 d')\n have \"- (u c + d) \\ - u c\" using \\d \\ 0\\ by simp\n with 1(2) have \"- (u c + d)\\ d'\" by (blast intro: order.trans)\n thus ?case unfolding cval_add_def using 1 by fastforce\n next\n case (2 d')\n have \"- (u c + d) \\ - u c\" using \\d \\ 0\\ by simp\n with 2(2) have \"- (u c + d) < d'\" by (blast intro: order_le_less_trans)\n thus ?case unfolding cval_add_def using 2 by fastforce\n qed auto\nnext\n case prems: (4 u d c1 c2)\n then have\n \"dbm_entry_val u (Some c1) None (M (v c1) 0)\" \"dbm_entry_val u None (Some c2) (M 0 (v c2))\"\n by auto\n from dbm_entry_val_add_4[OF this] prems have\n \"dbm_entry_val u (Some c1) (Some c2) (min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2)))\"\n by (auto split: split_min)\n with prems(1) show ?case\n by (cases \"min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2))\", auto simp: cval_add_def)\nqed auto\n\nfun theLe :: \"('t::time) DBMEntry \\ 't\" where\n \"theLe (Le d) = d\" |\n \"theLe (Lt d) = d\" |\n \"theLe \\ = 0\"\n\nlemma DBM_up_sound':\n assumes \"clock_numbering' v n\" \"u \\ [up M]\\<^bsub>v,n\\<^esub>\"\n shows \"u \\ ([M]\\<^bsub>v,n\\<^esub>)\\<^sup>\\\"\nunfolding DBM_zone_repr_def zone_delay_def using assms\nproof (clarsimp, goal_cases)\n case A: 1\n obtain S_Max_Le where S_Max_Le:\n \"S_Max_Le = {d - u c | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d}\"\n by auto\n obtain S_Max_Lt where S_Max_Lt:\n \"S_Max_Lt = {d - u c | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d}\"\n by auto\n obtain S_Min_Le where S_Min_Le:\n \"S_Min_Le = {- d - u c| c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d}\"\n by auto\n obtain S_Min_Lt where S_Min_Lt:\n \"S_Min_Lt = {- d - u c | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d}\"\n by auto\n have \"finite {c. 0 < v c \\ v c \\ n}\"\n using A(2,3)\n proof (induction n)\n case 0\n then have \"{c. 0 < v c \\ v c \\ 0} = {}\" by auto\n then show ?case by (metis finite.emptyI) \n next\n case (Suc n)\n then have \"finite {c. 0 < v c \\ v c \\ n}\" by auto\n moreover have \"{c. 0 < v c \\ v c \\ Suc n} = {c. 0 < v c \\ v c \\ n} \\ {c. v c = Suc n}\" by auto\n moreover have \"finite {c. v c = Suc n}\"\n proof (cases \"{c. v c = Suc n} = {}\", auto)\n fix c assume \"v c = Suc n\"\n then have \"{c. v c = Suc n} = {c}\" using Suc.prems(2) by auto\n then show ?thesis by auto\n qed\n ultimately show ?case by auto\n qed\n then have \"\\ f. finite {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\" by auto\n moreover have\n \"\\ f K. {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n \\ {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\"\n by auto\n ultimately have 1:\n \"\\ f K. finite {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" using finite_subset\n by fast\n have \"\\ f K. theLe o K = id \\ finite {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (safe, goal_cases)\n case prems: (1 f K)\n then have\n \"{(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n = (\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 a b)\n then have \"(a, K b) \\ {(c, K d) |c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" by auto\n moreover from 1(1) have \"theLe (K b) = b\" by (simp add: pointfree_idE)\n ultimately show ?case by force\n qed\n moreover from 1 have\n \"finite ((\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n ultimately show ?case by auto\n qed\n then have finI:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n \n have\n \"finite ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d})\"\n by (rule finI, auto)\n moreover have\n \"S_Min_Le = ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d})\"\n using S_Min_Le by auto\n ultimately have fin_min_le: \"finite S_Min_Le\" by auto\n \n have\n \"finite ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d})\"\n by (rule finI, auto)\n moreover have\n \"S_Min_Lt = ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d})\"\n using S_Min_Lt by auto\n ultimately have fin_min_lt: \"finite S_Min_Lt\" by auto\n\n have \"finite ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d})\"\n by (rule finI, auto)\n moreover have\n \"S_Max_Le = ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d})\"\n using S_Max_Le by auto\n ultimately have fin_max_le: \"finite S_Max_Le\" by auto\n\n have\n \"finite ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d})\"\n by (rule finI, auto)\n moreover have\n \"S_Max_Lt = ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d})\"\n using S_Max_Lt by auto\n ultimately have fin_max_lt: \"finite S_Max_Lt\" by auto\n\n { fix x assume \"x \\ S_Min_Le\"\n hence \"x \\ 0\" unfolding S_Min_Le\n proof (safe, goal_cases)\n case (1 c d)\n with A(1) have \"- u c \\ d\" unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n thus ?case by (simp add: minus_le_iff)\n qed\n } note Min_Le_le_0 = this\n have Min_Lt_le_0: \"x < 0\" if \"x \\ S_Min_Lt\" for x using that unfolding S_Min_Lt\n proof (safe, goal_cases)\n case (1 c d)\n with A(1) have \"- u c < d\" unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n thus ?case by (simp add: minus_less_iff)\n qed\n text \\\n The following basically all use the same proof.\n Only the first is not completely identical but nearly identical.\n\\\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n with S_Min_Le S_Max_Le have \"l \\ r\"\n proof (safe, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c \\ d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) \\ d'\" by (simp add: add_diff_eq diff_le_eq)\n hence \"- u c - d \\ d' - u c'\" by (simp add: add.commute le_diff_eq) \n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n with S_Min_Le S_Max_Le have \"l \\ r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c \\ d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) \\ d'\" by (simp add: add_diff_eq diff_le_eq)\n hence \"- u c - d \\ d' - u c'\" by (simp add: add.commute le_diff_eq) \n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Le\"\n with S_Min_Lt S_Max_Le have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq) \n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note LE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Lt\"\n with S_Min_Le S_Max_Lt have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq) \n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EL = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Lt\"\n with S_Min_Lt S_Max_Lt have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq) \n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note LL = this\n obtain m where m: \"\\ t \\ S_Min_Le. m \\ t\" \"\\ t \\ S_Min_Lt. m > t\"\n \"\\ t \\ S_Max_Le. m \\ t\" \"\\ t \\ S_Max_Lt. m < t\" \"m \\ 0\"\n proof -\n assume m:\"(\\m. \\t\\S_Min_Le. t \\ m \\\n \\t\\S_Min_Lt. t < m \\ \\t\\S_Max_Le. m \\ t \\ \\t\\S_Max_Lt. m < t \\ m \\ 0 \\ thesis)\"\n let ?min_le = \"Max S_Min_Le\"\n let ?min_lt = \"Max S_Min_Lt\" \n let ?max_le = \"Min S_Max_Le\"\n let ?max_lt = \"Min S_Max_Lt\"\n show thesis\n proof (cases \"S_Min_Le = {} \\ S_Min_Lt = {}\")\n case True\n note T = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True T by (intro m[of ?d']) auto\n next\n case False\n let ?d =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n obtain a :: \"'b\" where a: \"a < 0\" using non_trivial_neg by auto\n let ?d' = \"min 0 (?d + a)\"\n { fix x assume \"x \\ S_Max_Le\"\n with fin_max_le a have \"min 0 (Min S_Max_Le + a) \\ x\"\n by (metis Min_le add_le_same_cancel1 le_less_trans less_imp_le min.cobounded2 not_less)\n then have \"min 0 (Min S_Max_Le + a) \\ x\" by auto\n } note 1 = this\n { fix x assume x: \"x \\ S_Max_Lt\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < ?max_lt\"\n by (meson a add_less_same_cancel1 min.cobounded1 min.strict_coboundedI2 order.strict_trans2) \n also from fin_max_lt x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < x\" .\n } note 2 = this\n { fix x assume x: \"x \\ S_Max_Le\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ ?max_le\"\n by (metis le_add_same_cancel1 linear not_le a min_le_iff_disj)\n also from fin_max_le x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ x\" .\n } note 3 = this\n show thesis using False T a 1 2 3\n proof ((intro m[of ?d']), auto, goal_cases)\n case 1 then show ?case\n by (metis Min.coboundedI add_less_same_cancel1 dual_order.strict_trans2 fin_max_lt\n min.boundedE not_le)\n qed\n qed\n next\n case False\n note F = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True Min_Le_le_0 Min_Lt_le_0 by (intro m[of ?d']) auto\n next\n case False\n let ?r =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n\n have 1: \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" if \"x \\ S_Min_Le\" for x\n using that fin_min_le by (simp add: max.coboundedI2)+\n \n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LE[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt \\ x\" by auto\n } note 3 = this\n \n have 4: \"?min_le \\ x\" if \"x \\ S_Max_Le\" \"y \\ S_Min_Le\" for x y\n using EE[OF Max_in[OF fin_min_le], OF _ that(1)] that by auto\n \n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LL[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt < x\" by auto\n } note 5 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from EL[OF Max_in[OF fin_min_le], OF this, OF x(1)] have \"?min_le < x\" by auto\n } note 6 = this\n {\n fix x y assume x: \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from Min_Le_le_0[OF Max_in[OF fin_min_le], OF this] have \"?min_le \\ 0\" by auto\n } note 7 = this\n {\n fix x y assume x: \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from Min_Lt_le_0[OF Max_in[OF fin_min_lt], OF this] have \"?min_lt < 0\" \"?min_lt \\ 0\" by auto\n } note 8 = this\n show thesis\n proof (cases \"?l < ?r\")\n case False\n then have *: \"S_Max_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n with \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ obtain y where y:\"y \\ S_Max_Lt\" by auto\n note 1 = 1 this\n { fix x y assume A: \"x \\ S_Min_Le\" \"y \\ S_Max_Lt\"\n with EL[OF Max_in[OF fin_min_le] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Le < Min S_Max_Lt\" by auto\n } note ** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n show ?case\n proof (cases \"S_Min_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Min_Lt \\ {}\")\n case True\n then show False using 1 T True ** *** by auto\n next\n case False with 1 T ** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Min_Le = {} \\ S_Min_Lt = {})\\ show ?thesis by auto\n qed\n qed\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Le\"\n with LE[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_le]]\n have \"Max S_Min_Lt < Min S_Max_Le\" by auto\n } note **** = this\n from F False have **: \"S_Min_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n show ?case\n proof (cases \"S_Max_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Max_Lt \\ {}\")\n case True\n then show False using 1 T True **** *** by auto\n next\n case False with 1 T **** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ show ?thesis by auto\n qed\n qed\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI2)\n also have \"?min_lt < ?min_le\"\n proof (rule ccontr, goal_cases)\n case 1\n with x ** have 1: \"?l = ?min_lt\" by (auto simp: max.absorb1)\n have 2: \"?min_lt < ?max_le\" using * ****[OF x] by auto\n show False\n proof (cases \"S_Max_Lt = {}\")\n case False\n then have \"?min_lt < ?max_lt\" using * ***[OF x] by auto\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n next\n case True\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n qed\n qed\n finally have \"x < max ?min_lt ?min_le\" by (simp add: max.strict_coboundedI2) \n } note 2 = this\n show thesis using F False 1 2 3 4 5 6 7 8 * ** by ((intro m[of ?l]), auto)\n next\n case True\n then obtain d where d: \"?l < d\" \"d < ?r\" using dense by auto\n let ?d' = \"min 0 d\"\n {\n fix t assume \"t \\ S_Min_Le\"\n then have \"t \\ ?l\" using 1 by auto\n with d have \"t \\ d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Min_Lt\"\n then have \"t \\ max ?min_lt ?min_le\" using fin_min_lt by (simp add: max.coboundedI1)\n with t Min_Lt_le_0 have \"t \\ ?l\" using fin_min_lt by auto\n with d have \"t < d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Le\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_le by (simp add: min.coboundedI2)\n then have \"?r \\ t\" using fin_max_le t by auto\n with d have \"d \\ t\" by auto\n then have \"min 0 d \\ t\" by (simp add: min.coboundedI2)\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Lt\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_lt by (simp add: min.coboundedI1)\n then have \"?r \\ t\" using fin_max_lt t by auto\n with d have \"d < t\" by auto\n then have \"min 0 d < t\" by (simp add: min.strict_coboundedI2)\n }\n ultimately show thesis using Min_Le_le_0 Min_Lt_le_0 by ((intro m[of ?d']), auto)\n qed\n qed\n qed\n qed\n obtain u' where \"u' = (u \\ m)\" by blast\n hence u': \"u = (u' \\ (-m))\" unfolding cval_add_def by force\n have \"DBM_val_bounded v u' M n\" unfolding DBM_val_bounded_def\n proof (auto, goal_cases)\n case 1 with A(1,2) show ?case unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n next\n case (3 c)\n thus ?case\n proof (cases \"M (v c) 0\", goal_cases)\n case (1 x1)\n hence \"m \\ x1 - u c\" using m(3) S_Max_Le A(2) by blast\n hence \"u c + m \\ x1\" by (simp add: add.commute le_diff_eq)\n thus ?case using u' 1(2) unfolding cval_add_def by auto\n next\n case (2 x2)\n hence \"m < x2 - u c\" using m(4) S_Max_Lt A(2) by blast\n hence \"u c + m < x2\" by (metis add_less_cancel_left diff_add_cancel gt_swap)\n thus ?case using u' 2(2) unfolding cval_add_def by auto\n next\n case 3 thus ?case by auto\n qed\n next\n case (2 c) thus ?case\n proof (cases \"M 0 (v c)\", goal_cases)\n case (1 x1)\n hence \"- x1 - u c \\ m\" using m(1) S_Min_Le A(2) by blast\n hence \"- u c - m \\ x1\" using diff_le_eq neg_le_iff_le by fastforce\n thus ?case using u' 1(2) unfolding cval_add_def by auto\n next\n case (2 x2)\n hence \"- x2 - u c < m\" using m(2) S_Min_Lt A(2) by blast\n hence \"- u c - m < x2\" using diff_less_eq neg_less_iff_less by fastforce \n thus ?case using u' 2(2) unfolding cval_add_def by auto\n next\n case 3 thus ?case by auto\n qed\n next\n case (4 c1 c2)\n from A(2) have \"v c1 > 0\" \"v c2 \\ 0\" by auto\n then have B: \"(up M) (v c1) (v c2) = min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2))\"\n unfolding up_def by simp\n \n show ?case\n proof (cases \"(dbm_add (M (v c1) 0) (M 0 (v c2))) < (M (v c1) (v c2))\")\n case False\n with B have \"(up M) (v c1) (v c2) = M (v c1) (v c2)\" by (auto split: split_min)\n with A(1) 4 have\n \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding DBM_zone_repr_def unfolding DBM_val_bounded_def by fastforce\n thus ?thesis using u' by cases (auto simp add: cval_add_def)\n next\n case True\n with B have \"(up M) (v c1) (v c2) = dbm_add (M (v c1) 0) (M 0 (v c2))\" by (auto split: split_min)\n with A(1) 4 have\n \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) 0) (M 0 (v c2)))\"\n unfolding DBM_zone_repr_def unfolding DBM_val_bounded_def by fastforce\n with True dbm_entry_dbm_lt have\n \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding less by fast\n thus ?thesis using u' by cases (auto simp add: cval_add_def)\n qed\n qed\n with m(5) u' show ?case by fastforce\nqed\n\nsection \\From Clock Constraints to DBMs\\\n\nfun And :: \"('t :: time) DBM \\ 't DBM \\ 't DBM\" where\n \"And M1 M2 = (\\ i j. min (M1 i j) (M2 i j))\"\n\nfun abstr :: \"('c, 't::time) cconstraint \\ 't DBM \\ ('c \\ nat) \\ 't DBM\"\nwhere\n \"abstr (AND cc1 cc2) M v = And (abstr cc1 M v) (abstr cc2 M v)\" |\n \"abstr (EQ c d) M v =\n (\\ i j . if i = 0 \\ j = v c then Le (-d) else if i = v c \\ j = 0 then Le d else M i j)\" |\n \"abstr (LT c d) M v =\n (\\ i j . if i = 0 \\ j = v c then \\ else if i = v c \\ j = 0 then Lt d else M i j)\" |\n \"abstr (LE c d) M v =\n (\\ i j . if i = 0 \\ j = v c then \\ else if i = v c \\ j = 0 then Le d else M i j)\" |\n \"abstr (GT c d) M v =\n (\\ i j. if i = 0 \\ j = v c then Lt (- d) else if i = v c \\ j = 0 then \\ else M i j)\" |\n \"abstr (GE c d) M v =\n (\\ i j. if i = 0 \\ j = v c then Le (- d) else if i = v c \\ j = 0 then \\ else M i j)\"\n\nlemma abstr_id1:\n \"c \\ collect_clks cc \\ clock_numbering' v n \\ \\ c \\ collect_clks cc. v c \\ n\n \\ abstr cc M v 0 (v c) = M 0 (v c)\"\nby (induction cc) auto\n\nlemma abstr_id2:\n \"c \\ collect_clks cc \\ clock_numbering' v n \\ \\ c \\ collect_clks cc. v c \\ n\n \\ abstr cc M v (v c) 0 = M (v c) 0\"\nby (induction cc) auto\n\ntext \\\n This lemma is trivial because we constrained our theory to difference constraints.\n\\\n\nlemma abstr_id3:\n \"clock_numbering v \\ abstr cc M v (v c1) (v c2) = M (v c1) (v c2)\"\nproof goal_cases\n case 1\n have \"\\c. v c = 0 \\ False\"\n proof -\n fix c assume \"v c = 0\"\n moreover from 1 have \"v c > 0\" by auto\n ultimately show False by linarith\n qed\n then show ?case by ((induction cc), auto, fastforce)\nqed\n\nlemma dbm_abstr_soundness :\n \"\\u \\ cc; clock_numbering' v n; \\ c \\ collect_clks cc. v c \\ n\\\n \\ DBM_val_bounded v u (abstr cc (\\ i j. \\) v) n\"\nproof (unfold DBM_val_bounded_def, auto, goal_cases)\n case 1\n from this(3) have \"abstr cc (\\i j. \\) v 0 0 = \\\" by (induction cc) auto\n then show ?case unfolding dbm_le_def by auto\nnext\n case (2 c)\n then have \"clock_numbering' v n\" by auto\n note A = 2(1) this 2(5,2)\n show ?case\n proof (cases \"c \\ collect_clks cc\")\n case True\n then show ?thesis using A(1,4)\n proof (induction rule: collect_clks.induct)\n case (1 cc1 cc2)\n { assume cc: \"c \\ collect_clks cc1\" \"c \\ collect_clks cc2\"\n with 1 have ?case by auto linarith\n } note both = this\n show ?case\n proof (cases \"c \\ collect_clks cc1\")\n case True\n note cc1 = this\n with 1 have *: \"dbm_entry_val u None (Some c) (abstr cc1 (\\i j. \\) v 0 (v c))\" by auto\n show ?thesis\n proof (cases \"c \\ collect_clks cc2\")\n case True with cc1 both show ?thesis by auto\n next\n case False\n from abstr_id1[OF False A(2)] 1(5)\n have\n \"min (abstr cc1 (\\i j. \\) v 0 (v c)) (abstr cc2 (\\i j. \\) v 0 (v c))\n = abstr cc1 (\\i j. \\) v 0 (v c)\"\n by (simp add: any_le_inf min.absorb1)\n with * show ?thesis by auto\n qed\n next\n case False\n note cc1 = this\n show ?thesis\n proof (cases \"c \\ collect_clks cc2\")\n case True\n with 1 have *: \"dbm_entry_val u None (Some c) (abstr cc2 (\\i j. \\) v 0 (v c))\" by auto\n from abstr_id1[OF cc1 A(2)] 1(5)\n have\n \"min (abstr cc1 (\\i j. \\) v 0 (v c)) (abstr cc2 (\\i j. \\) v 0 (v c))\n = abstr cc2 (\\i j. \\) v 0 (v c)\"\n by (simp add: any_le_inf min.absorb2)\n with * show ?thesis by auto\n next\n case False\n with 1 cc1 show ?thesis by auto\n qed\n qed\n qed auto\n next\n case False\n from abstr_id1[OF this A(2,4)] show ?thesis by auto\n qed\nnext\n case (3 c)\n then have \"clock_numbering' v n\" by auto\n note A = 3(1) this 3(5,2)\n from A(2) have gt0: \"v c > 0\" by auto\n show ?case\n proof (cases \"c \\ collect_clks cc\")\n case True\n then show ?thesis using A(1,4)\n proof (induction rule: collect_clks.induct)\n case (1 cc1 cc2)\n { assume cc: \"c \\ collect_clks cc1\" \"c \\ collect_clks cc2\"\n with 1 have ?case by auto linarith\n } note both = this\n show ?case\n proof (cases \"c \\ collect_clks cc1\")\n case True\n note cc1 = this\n with 1 have *: \"dbm_entry_val u (Some c) None (abstr cc1 (\\i j. \\) v (v c) 0)\" by auto\n show ?thesis\n proof (cases \"c \\ collect_clks cc2\")\n case True with cc1 both show ?thesis by auto\n next\n case False\n from abstr_id2[OF False A(2)] 1(5)\n have\n \"min (abstr cc1 (\\i j. \\) v (v c) 0) (abstr cc2 (\\i j. \\) v (v c) 0)\n = abstr cc1 (\\i j. \\) v (v c) 0\"\n by (simp add: any_le_inf min.absorb1)\n with * show ?thesis by auto\n qed\n next\n case False\n note cc1 = this\n show ?thesis\n proof (cases \"c \\ collect_clks cc2\")\n case True\n with 1 have *: \"dbm_entry_val u (Some c) None (abstr cc2 (\\i j. \\) v (v c) 0)\"\n by auto\n from abstr_id2[OF cc1 A(2)] 1(5)\n have\n \"min (abstr cc1 (\\i j. \\) v (v c) 0) (abstr cc2 (\\i j. \\) v (v c) 0)\n = abstr cc2 (\\i j. \\) v (v c) 0\"\n by (simp add: any_le_inf min.absorb2)\n with * show ?thesis by auto\n next\n case False\n with 1 cc1 show ?thesis by auto\n qed\n qed\n qed (insert gt0, auto)\n next\n case False\n from abstr_id2[OF this A(2,4)] show ?thesis by auto\n qed\nnext\n text \\Trivial because of missing difference constraints\\\n case (4 c1 c2)\n from abstr_id3[OF this(3)] have \"abstr cc (\\i j. \\) v (v c1) (v c2) = \\\" by auto\n then show ?case by auto\nqed\n\nlemma dbm_abstr_completeness:\n \"\\DBM_val_bounded v u (abstr cc (\\ i j. \\) v) n; \\c. v c > 0; \\ c \\ collect_clks cc. v c \\ n\\\n \\ u \\ cc\"\nproof (induction cc, goal_cases)\n case (1 cc1 cc2)\n then have AND: \"u \\ [abstr (AND cc1 cc2) (\\i j. \\) v]\\<^bsub>v,n\\<^esub>\" by (simp add: DBM_zone_repr_def)\n from 1 have \"\\i j. i \\ n \\ j \\ n\n \\ (abstr (AND cc1 cc2) (\\i j. \\) v) i j \\ (abstr cc1 (\\i j. \\) v) i j\"\n by (simp add: less_eq[symmetric])\n from DBM_le_subset[OF this AND] 1 have \"u \\ cc1\" unfolding DBM_zone_repr_def by auto\n from 1 have \"\\i j. i \\ n \\ j \\ n\n \\ (abstr (AND cc1 cc2) (\\i j. \\) v) i j \\ (abstr cc2 (\\i j. \\) v) i j\"\n by (simp add: less_eq[symmetric])\n from DBM_le_subset[OF this AND] 1 have \"u \\ cc2\" unfolding DBM_zone_repr_def by auto\n from \\u \\ cc1\\ \\u \\ cc2\\ show ?case by auto\nnext\n case (2 c d)\n from this have \"v c \\ n\" by auto\n with 2(1) have \"dbm_entry_val u (Some c) None ((abstr (LT c d) (\\i j. \\) v) (v c) 0)\"\n by (auto simp: DBM_val_bounded_def)\n moreover from 2(2) have \"v c > 0\" by auto\n ultimately show ?case by auto\nnext\n case (3 c d)\n from this have \"v c \\ n\" by auto\n with 3(1) have \"dbm_entry_val u (Some c) None ((abstr (LE c d) (\\i j. \\) v) (v c) 0)\"\n by (auto simp: DBM_val_bounded_def)\n moreover from 3(2) have \"v c > 0\" by auto\n ultimately show ?case by auto\nnext\n case (4 c d)\n from this have c: \"v c > 0\" \"v c \\ n\" by auto\n with 4(1) have B:\n \"dbm_entry_val u (Some c) None ((abstr (EQ c d) (\\i j. \\) v) (v c) 0)\"\n \"dbm_entry_val u None (Some c) ((abstr (EQ c d) (\\i j. \\) v) 0 (v c))\"\n by (auto simp: DBM_val_bounded_def)\n from c B have \"u c \\ d\" \"- u c \\ -d\" by auto\n then show ?case by auto\nnext\n case (5 c d)\n from this have \"v c \\ n\" by auto\n with 5(1) have \"dbm_entry_val u None (Some c) ((abstr (GT c d) (\\i j. \\) v) 0 (v c))\"\n by (auto simp: DBM_val_bounded_def)\n moreover from 5(2) have \"v c > 0\" by auto\n ultimately show ?case by auto\nnext\n case (6 c d)\n from this have \"v c \\ n\" by auto\n with 6(1) have \"dbm_entry_val u None (Some c) ((abstr (GE c d) (\\i j. \\) v) 0 (v c))\"\n by (auto simp: DBM_val_bounded_def)\n moreover from 6(2) have \"v c > 0\" by auto\n ultimately show ?case by auto\nqed\n\nlemma dbm_abstr_zone_eq:\n assumes \"clock_numbering' v n\" \"\\c\\collect_clks cc. v c \\ n\"\n shows \"[abstr cc (\\i j. \\) v]\\<^bsub>v,n\\<^esub> = {u. u \\ cc}\"\nusing dbm_abstr_soundness dbm_abstr_completeness assms unfolding DBM_zone_repr_def by metis\n\n\nsection \\Zone Intersection\\\n\nlemma DBM_and_complete:\n assumes \"DBM_val_bounded v u M1 n\" \"DBM_val_bounded v u M2 n\"\n shows \"DBM_val_bounded v u (And M1 M2) n\"\nusing assms unfolding DBM_val_bounded_def by (auto simp: min_def)\n\nlemma DBM_and_sound1:\n assumes \"DBM_val_bounded v u (And M1 M2) n\"\n shows \"DBM_val_bounded v u M1 n\"\nunfolding DBM_val_bounded_def\nusing assms\nproof (safe, goal_cases)\n case 1\n then show ?case unfolding DBM_val_bounded_def by (auto simp: less_eq[symmetric])\nnext\n case (2 c)\n then have \"(And M1 M2) 0 (v c) \\ M1 0 (v c)\" by simp\n from dbm_entry_val_mono_2[folded less_eq, OF _ this, of u] 2 show ?case\n unfolding DBM_val_bounded_def by auto\nnext\n case (3 c)\n then have \"(And M1 M2) (v c) 0 \\ M1 (v c) 0\" by simp\n from dbm_entry_val_mono_3[folded less_eq, OF _ this, of u] 3 show ?case\n unfolding DBM_val_bounded_def by auto\nnext\n case (4 c1 c2)\n then have \"(And M1 M2) (v c1) (v c2) \\ M1 (v c1) (v c2)\" by simp\n from dbm_entry_val_mono_1[folded less_eq, OF _ this, of u] 4 show ?case\n unfolding DBM_val_bounded_def by auto\nqed\n\nlemma DBM_and_sound2:\n assumes \"DBM_val_bounded v u (And M1 M2) n\"\n shows \"DBM_val_bounded v u M2 n\"\nunfolding DBM_val_bounded_def\nusing assms\nproof (safe, goal_cases)\n case 1\n then show ?case unfolding DBM_val_bounded_def by (auto simp: less_eq[symmetric])\nnext\n case (2 c)\n then have \"(And M1 M2) 0 (v c) \\ M2 0 (v c)\" by simp\n from dbm_entry_val_mono_2[folded less_eq, OF _ this, of u] 2 show ?case\n unfolding DBM_val_bounded_def by auto\nnext\n case (3 c)\n then have \"(And M1 M2) (v c) 0 \\ M2 (v c) 0\" by simp\n from dbm_entry_val_mono_3[folded less_eq, OF _ this, of u] 3 show ?case\n unfolding DBM_val_bounded_def by auto\nnext\n case (4 c1 c2)\n then have \"(And M1 M2) (v c1) (v c2) \\ M2 (v c1) (v c2)\" by simp\n from dbm_entry_val_mono_1[folded less_eq, OF _ this, of u] 4 show ?case\n unfolding DBM_val_bounded_def by auto\nqed\n\n\nsection \\Clock Reset\\\n\ndefinition\n DBM_reset :: \"('t :: time) DBM \\ nat \\ nat \\ 't \\ 't DBM \\ bool\"\nwhere\n \"DBM_reset M n k d M' \\\n (\\ j \\ n. 0 < j \\ k \\ j\\ M' k j = \\ \\ M' j k = \\) \\ M' k 0 = Le d \\ M' 0 k = Le (- d)\n \\ M' k k = M k k\n \\ (\\i \\ n. \\j \\ n.\n i \\ k \\ j \\ k \\ M' i j = min (dbm_add (M i k) (M k j)) (M i j))\"\n\n\nlemma DBM_reset_mono:\n assumes \"DBM_reset M n k d M'\" \"i \\ n\" \"j \\ n\" \"i \\ k\" \"j \\ k\"\n shows \"M' i j \\ M i j\"\nusing assms unfolding DBM_reset_def by auto\n\nlemma DBM_reset_len_mono:\n assumes \"DBM_reset M n k d M'\" \"k \\ set xs\" \"i \\ k\" \"j \\ k\" \"set (i # j # xs) \\ {0..n}\"\n shows \"len M' i j xs \\ len M i j xs\"\nusing assms by (induction xs arbitrary: i) (auto intro: add_mono DBM_reset_mono)\n\nlemma DBM_reset_neg_cycle_preservation:\n assumes \"DBM_reset M n k d M'\" \"len M i i xs < Le 0\" \"set (k # i # xs) \\ {0..n}\"\n shows \"\\ j. \\ ys. set (j # ys) \\ {0..n} \\ len M' j j ys < Le 0\"\nproof (cases \"xs = []\")\n case Nil: True\n show ?thesis\n proof (cases \"k = i\")\n case True\n with Nil assms have \"len M' i i [] < Le 0\" unfolding DBM_reset_def by auto\n moreover from assms have \"set (i # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n next\n case False\n with Nil assms DBM_reset_mono have \"len M' i i [] < Le 0\" by fastforce\n moreover from assms have \"set (i # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n qed\nnext\n case False\n with assms obtain j ys where cycle:\n \"len M j j ys < Le 0\" \"distinct (j # ys)\" \"j \\ set (i # xs)\" \"set ys \\ set xs\"\n by (metis negative_len_shortest neutral)\n show ?thesis\n proof (cases \"k \\ set (j # ys)\")\n case False\n with cycle assms have \"len M' j j ys \\ len M j j ys\" by - (rule DBM_reset_len_mono, auto)\n moreover from cycle assms have \"set (j # ys) \\ {0..n}\" by auto\n ultimately show ?thesis using cycle(1) by fastforce\n next\n case True\n then obtain l where l: \"(l, k) \\ set (arcs j j ys)\"\n proof (cases \"j = k\", goal_cases)\n case True\n show ?thesis\n proof (cases \"ys = []\")\n case T: True\n with True show ?thesis by (auto intro: that)\n next\n case False\n then obtain z zs where \"ys = zs @ [z]\" by (metis append_butlast_last_id)\n from arcs_decomp[OF this] True show ?thesis by (auto intro: that)\n qed\n next\n case False\n from arcs_set_elem2[OF False True] show ?thesis by (blast intro: that)\n qed\n show ?thesis\n proof (cases \"ys = []\")\n case False\n from cycle_rotate_2'[OF False l, of M] cycle(1) obtain zs where rotated:\n \"len M l l (k # zs) < Le 0\" \"set (l # k # zs) = set (j # ys)\" \"1 + length zs = length ys\"\n by auto\n with length_eq_distinct[OF this(2)[symmetric] cycle(2)] have \"distinct (l # k # zs)\" by auto\n note rotated = rotated(1,2) this\n from this(2) cycle(3,4) assms(3) have n_bound: \"set (l # k # zs) \\ {0..n}\" by auto\n then have \"l \\ n\" by auto\n show ?thesis\n proof (cases zs)\n case Nil\n with rotated have \"M l k + M k l < Le 0\" \"l \\ k\" by auto\n with assms(1) \\l \\ n\\ have \"M' l l < Le 0\" unfolding DBM_reset_def mult min_def by auto\n with \\l \\ n\\ have \"len M' l l [] < Le 0\" \"set [l] \\ {0..n}\" by auto\n then show ?thesis by blast\n next\n case (Cons w ws)\n with n_bound have *: \"set (w # l # ws) \\ {0..n}\" by auto\n from Cons n_bound rotated(3) have \"w \\ n\" \"w \\ k\" \"l \\ k\" by auto\n with assms(1) \\l \\ n\\ have\n \"M' l w \\ M l k + M k w\"\n unfolding DBM_reset_def mult min_def by auto\n moreover from Cons rotated assms * have\n \"len M' w l ws \\ len M w l ws\"\n by - (rule DBM_reset_len_mono, auto)\n ultimately have\n \"len M' l l zs \\ len M l l (k # zs)\"\n using Cons by (auto intro: add_mono simp add: assoc[symmetric])\n with n_bound rotated(1) show ?thesis by fastforce\n qed\n next\n case T: True\n with True cycle have \"M j j < Le 0\" \"j = k\" by auto\n with assms(1) have \"len M' k k [] < Le 0\" unfolding DBM_reset_def by simp\n moreover from assms(3) have \"set (k # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n qed\n qed\nqed\n\ntext \\Implementation of DBM reset\\\n\ndefinition reset :: \"('t::time) DBM \\ nat \\ nat \\ 't \\ 't DBM\"\nwhere\n \"reset M n k d =\n (\\ i j.\n if i = k \\ j = 0 then Le d\n else if i = 0 \\ j = k then Le (-d)\n else if i = k \\ j \\ k then \\\n else if i \\ k \\ j = k then \\\n else if i = k \\ j = k then M k k\n else min (dbm_add (M i k) (M k j)) (M i j)\n )\"\n\nfun reset' :: \"('t::time) DBM \\ nat \\ 'c list \\ ('c \\ nat) \\ 't \\ 't DBM\"\nwhere\n \"reset' M n [] v d = M\" |\n \"reset' M n (c # cs) v d = reset (reset' M n cs v d) n (v c) d\"\n\nlemma DBM_reset_reset:\n \"0 < k \\ k \\ n \\ DBM_reset M n k d (reset M n k d)\"\nunfolding DBM_reset_def by (auto simp: reset_def)\n\nlemma DBM_reset_complete:\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M n\"\n shows \"DBM_val_bounded v (u(c := d)) M' n\"\nunfolding DBM_val_bounded_def using assms\nproof (auto, goal_cases)\n case 1\n then have *: \"M 0 0 \\ Le 0\" unfolding DBM_val_bounded_def less_eq by auto\n from 1 have **: \"M' 0 0 = min (M 0 (v c) + M (v c) 0) (M 0 0)\" unfolding DBM_reset_def mult by auto\n show ?case\n proof (cases \"M 0 (v c) + M (v c) 0 \\ M 0 0\")\n case False\n with * ** show ?thesis unfolding min_def less_eq by auto\n next\n case True\n have \"dbm_entry_val u (Some c) (Some c) (M (v c) 0 + M 0 (v c))\"\n by (metis DBM_val_bounded_def assms(2,4) dbm_entry_val_add_4 mult)\n then have \"M (v c) 0 + M 0 (v c) \\ Le 0\"\n unfolding less_eq dbm_le_def by (cases \"M (v c) 0 + M 0 (v c)\") auto\n with True ** have \"M' 0 0 \\ Le 0\" by (simp add: comm)\n then show ?thesis unfolding less_eq .\n qed\nnext\n case (2 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n hence F:\"v c' \\ v c\" using 2 by metis\n hence *:\"M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c'))\"\n using F 2(1,2,4,6) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M 0 (v c)) (M (v c) (v c')) < M 0 (v c')\")\n case False\n with * have \"M' 0 (v c') = M 0 (v c')\" by (auto split: split_min)\n hence \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n using 2(3,6) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' 0 (v c') = dbm_add (M 0 (v c)) (M (v c) (v c'))\" by (auto split: split_min)\n from 2 have \"dbm_entry_val u None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u (Some c) (Some c') (M (v c) (v c'))\"\n unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"- u c' \\ d + d'\"\n by (metis diff_minus_eq_add less_diff_eq less_le_trans minus_diff_eq minus_le_iff not_le)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G1(3) have \"u c - u c' - u c < d + d'\" using add_le_less_mono by fastforce\n hence \"- u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G2(3) have \"u c - u c' - u c < d' + d\" using add_le_less_mono by fastforce\n hence \"- u c' < d' + d\" by simp\n hence \"- u c' < d + d'\"\n by (metis (hide_lams, no_types) diff_0_right diff_minus_eq_add minus_add_distrib minus_diff_eq)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G2(3) have \"u c - u c' - u c < d + d'\" using add_strict_mono by fastforce\n hence \"- u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with 2 show ?thesis unfolding DBM_reset_def by auto\n qed\nnext\n case (3 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n hence F:\"v c' \\ v c\" using 3 by metis\n hence *:\"M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0)\"\n using F 3(1,2,4,6) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M (v c') (v c)) (M (v c) 0) < M (v c') 0\")\n case False\n with * have \"M' (v c') 0 = M (v c') 0\" by (auto split: split_min)\n hence \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n using 3(3,6) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' (v c') 0 = dbm_add (M (v c') (v c)) (M (v c) 0)\" by (auto split: split_min)\n from 3 have \"dbm_entry_val u (Some c') (Some c) (M (v c') (v c))\"\n \"dbm_entry_val u (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"u c' \\ d + d'\" using ordered_ab_semigroup_add_class.add_mono\n by fastforce \n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G1(3) have \"u c + u c' - u c < d + d'\" using add_le_less_mono by fastforce\n hence \"u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G2(3) have \"u c + u c' - u c < d' + d\" using add_le_less_mono by fastforce\n hence \"u c' < d' + d\" by simp\n hence \"u c' < d + d'\"\n by (metis (hide_lams, no_types) diff_0_right diff_minus_eq_add minus_add_distrib minus_diff_eq)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G2(3) have \"u c + u c' - u c < d + d'\" using add_strict_mono by fastforce\n hence \"u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case 3 thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with 3 show ?thesis unfolding DBM_reset_def by auto\n qed\nnext\n case (4 c1 c2)\n show ?case\n proof (cases \"c = c1\")\n case False\n note F1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with F1 4 have F: \"v c \\ v c1\" \"v c \\ v c2\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n hence *:\"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using 4(1,2,6,7) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M (v c1) (v c)) (M (v c) (v c2)) < M (v c1) (v c2)\")\n case False\n with * have \"M' (v c1) (v c2) = M (v c1) (v c2)\" by (auto split: split_min)\n hence \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n using 4(3,6,7) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' (v c1) (v c2) = dbm_add (M (v c1) (v c)) (M (v c) (v c2))\" by (auto split: split_min)\n from 4 have \"dbm_entry_val u (Some c1) (Some c) (M (v c1) (v c))\"\n \"dbm_entry_val u (Some c) (Some c2) (M (v c) (v c2))\" unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"u c1 - u c2 \\ d + d'\"\n by (metis (hide_lams, no_types) ab_semigroup_add_class.add_ac(1) add_le_cancel_right\n add_left_mono diff_add_cancel dual_order.refl dual_order.trans)\n thus ?case using 1 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (2 d')\n from add_less_le_mono[OF this(2) G1(3)] have \"- u c2 + u c1 < d' + d\" by simp\n hence \"u c1 - u c2 < d + d'\" by (simp add: add.commute) \n thus ?case using 2 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from add_less_le_mono[OF G2(3) this(2)] have \"u c1 - u c2 < d + d'\"\n by (metis (hide_lams, no_types) ab_semigroup_add_class.add_ac(1) add_le_cancel_right\n diff_add_cancel dual_order.order_iff_strict dual_order.strict_trans2)\n thus ?case using 1 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (2 d')\n from add_strict_mono[OF this(2) G2(3)] have \"- u c2 + u c1 < d' + d\" by simp\n hence \"- u c2 + u c1 < d + d'\"\n by (metis (full_types) diff_0 diff_minus_eq_add minus_add_distrib minus_diff_eq)\n hence \"u c1 - u c2 < d + d'\" by (metis add_diff_cancel_left diff_0 diff_0_right diff_add_cancel)\n thus ?case using 2 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with F1 4 have F: \"v c \\ v c1\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n thus ?thesis using 4(1,2,4,6,7) True unfolding DBM_reset_def by auto\n qed\n next\n case True\n note T1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with T1 4 have F: \"v c \\ v c2\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n thus ?thesis using 4(1,2,7) True unfolding DBM_reset_def by auto\n next\n case True\n then have *: \"M' (v c1) (v c1) = M (v c1) (v c1)\"\n using T1 4 unfolding DBM_reset_def by auto\n from 4(1,3) True T1 have \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by auto\n then show ?thesis by (cases rule: dbm_entry_val.cases, auto simp: * True[symmetric] T1)\n qed\n qed\nqed\n\nlemma DBM_reset_sound_empty:\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\"\n \"\\ u . \\ DBM_val_bounded v u M' n\"\n shows \"\\ DBM_val_bounded v u M n\"\nusing assms DBM_reset_complete by metis\n\nlemma DBM_reset_diag_preservation:\n \"\\k\\n. M k k \\ \\ \\ DBM_reset M n i d M' \\ \\k\\n. M' k k \\ \\\"\n apply auto\n apply (case_tac \"k = i\")\n apply (simp add: DBM_reset_def less[symmetric])\n apply (case_tac \"k = 0\")\nby (auto simp add: DBM_reset_def less[symmetric] neutral split: split_min)\n\nlemma FW_diag_preservation:\n \"\\k\\n. M k k \\ \\ \\ \\k\\n. (FW M n) k k \\ \\\"\nproof clarify\n fix k assume A: \"\\k\\n. M k k \\ \\\" \"k \\ n\"\n then have \"M k k \\ \\\" by auto\n with fw_mono[of n n n k k M n] A show \"FW M n k k \\ \\\" by auto\nqed\n\nlemma DBM_reset_not_cyc_free_preservation:\n assumes \"\\ cyc_free M n\" \"DBM_reset M n k d M'\" \"k \\ n\"\n shows \"\\ cyc_free M' n\"\nproof -\n from assms(1) obtain i xs where \"i \\ n\" \"set xs \\ {0..n}\" \"len M i i xs < Le 0\"\n unfolding neutral by auto\n with DBM_reset_neg_cycle_preservation[OF assms(2) this(3)] assms(3) obtain j ys where\n \"set (j # ys) \\ {0..n}\" \"len M' j j ys < Le 0\"\n by auto\n then show ?thesis unfolding neutral by force\nqed\n\nlemma DBM_reset_complete_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\" \"k \\ n\"\n \"DBM_reset M n k d M'\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n from assms(5) have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n from empty_not_cyc_free[OF _ this] have \"\\ cyc_free M n\" using assms(2) by auto\n from DBM_reset_not_cyc_free_preservation[OF this assms(4,3)] have \"\\ cyc_free M' n\" by auto\n then obtain i xs where \"i \\ n\" \"set xs \\ {0..n}\" \"len M' i i xs < \\\" by auto\n from DBM_val_bounded_neg_cycle[OF _ this assms(1)] show ?thesis by fast\nqed\n\nlemma DBM_reset_complete_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\"\n \"DBM_reset (FW M n) n (v c) d M'\" \"\\ u . \\ DBM_val_bounded v u (FW M n) n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n note A = assms\n from A(4) have \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_detects_empty_zone[OF A(1), of M] A(2)\n obtain i where i: \"i \\ n\" \"FW M n i i < Le 0\" by blast\n with A(3,4) have \"M' i i < Le 0\"\n unfolding DBM_reset_def by (cases \"i = v c\", auto split: split_min)\n with fw_mono[of n n n i i M' n] i have \"FW M' n i i < Le 0\" by auto\n with FW_detects_empty_zone[OF A(1), of M'] A(2) i\n have \"[FW M' n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_zone_equiv[OF A(1)] show ?thesis by (auto simp: DBM_zone_repr_def)\nqed\n\nlemma DBM_reset_complete_empty1:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\"\n \"DBM_reset (FW M n) n (v c) d M'\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n from assms have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_zone_equiv[OF assms(1)] have\n \"\\ u . \\ DBM_val_bounded v u (FW M n) n\"\n unfolding DBM_zone_repr_def by auto\n from DBM_reset_complete_empty[OF assms(1-3) this] show ?thesis by auto\nqed\n\ntext \\\n Lemma \\FW_canonical_id\\ allows us to prove correspondences between reset and canonical,\n like for the two below.\n Can be left out for the rest because of the triviality of the correspondence.\n\\\n\nlemma DBM_reset_empty'':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset M n (v c) d M'\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nproof\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M' n\"\n using DBM_reset_complete_empty'[OF assms(1) _ assms(3,4)] assms(2) by auto\n thus \"[M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n assume \"[M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M' n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M n\" using DBM_reset_sound_empty[OF assms(2-4)] by auto\n thus \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset (FW M n) n (v c) d M'\"\n shows \"[FW M n]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nproof\n assume A: \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u (FW M n) n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M' n\"\n using DBM_reset_complete_empty[of n v M, OF assms(1) _ assms(4)] assms(2,3) by auto\n thus \"[M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n assume \"[M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M' n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u (FW M n) n\" using DBM_reset_sound_empty[OF assms(2-)] by auto\n thus \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset_empty':\n assumes \"canonical M n\" \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset (FW M n) n (v c) d M'\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nusing FW_canonical_id[OF assms(1)] DBM_reset_empty[OF assms(2-)] by simp\n\nlemma DBM_reset_sound':\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M' n\"\n \"DBM_val_bounded v u'' M n\"\n obtains d' where \"DBM_val_bounded v (u(c := d')) M n\"\nusing assms\nproof (auto, goal_cases)\n case 1\n note A = this\n obtain S_Min_Le where S_Min_Le:\n \"S_Min_Le = {u c' - d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = Le d}\n \\ {-d | d. M 0 (v c) = Le d}\" by auto\n obtain S_Min_Lt where S_Min_Lt:\n \"S_Min_Lt = {u c' - d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = Lt d}\n \\ {-d | d. M 0 (v c) = Lt d}\" by auto\n obtain S_Max_Le where S_Max_Le:\n \"S_Max_Le = {u c' + d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = Le d}\n \\ {d | d. M (v c) 0 = Le d}\" by auto\n obtain S_Max_Lt where S_Max_Lt:\n \"S_Max_Lt = {u c' + d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = Lt d}\n \\ {d | d. M (v c) 0 = Lt d}\" by auto\n\n have \"finite {c. 0 < v c \\ v c \\ n}\" using A(6,7)\n proof (induction n)\n case 0\n then have \"{c. 0 < v c \\ v c \\ 0} = {}\" by auto\n then show ?case by (metis finite.emptyI) \n next\n case (Suc n)\n then have \"finite {c. 0 < v c \\ v c \\ n}\" by auto\n moreover have \"{c. 0 < v c \\ v c \\ Suc n} = {c. 0 < v c \\ v c \\ n} \\ {c. v c = Suc n}\" by auto\n moreover have \"finite {c. v c = Suc n}\"\n proof (cases \"{c. v c = Suc n} = {}\", auto)\n fix c assume \"v c = Suc n\"\n then have \"{c. v c = Suc n} = {c}\" using Suc.prems(2) by auto\n then show ?thesis by auto\n qed\n ultimately show ?case by auto\n qed\n then have \"\\ f. finite {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\" by auto\n moreover have\n \"\\ f K. {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n \\ {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\"\n by auto\n ultimately have B:\n \"\\ f K. finite {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n using finite_subset by fast\n have \"\\ f K. theLe o K = id \\ finite {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto, goal_cases)\n case (1 f K)\n then have\n \"{(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n = (\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 a b)\n then have \"(a, K b) \\ {(c, K d) |c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" by auto\n moreover from 1(1) have \"theLe (K b) = b\" by (simp add: pointfree_idE)\n ultimately show ?case by force\n qed\n moreover from B have\n \"finite ((\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n ultimately show ?case by auto\n qed\n then have finI:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ f M (v c') = K d})\"\n by auto\n have finI1:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ f M (v c') = K d})\"\n proof goal_cases\n case (1 f g K)\n have\n \"g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ f M (v c') = K d}\n \\ g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ f M (v c') = K d}\"\n by auto\n from finite_subset[OF this finI[OF 1, of g f]] show ?case .\n qed\n have \"\\ f. finite {b. f M (v c) = b}\" by auto\n moreover have \"\\ f K. {K d | d. f M (v c) = K d} \\ {b. f M (v c) = b}\" by auto\n ultimately have B: \"\\ f K. finite {K d | d. f M (v c) = K d}\" using finite_subset by fast\n\n have \"\\ f K. theLe o K = id \\ finite {d | d. f M (v c) = K d}\"\n proof (auto, goal_cases)\n case (1 f K)\n then have \"{d | d. f M (v c) = K d} = theLe ` {K d | d. f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 x)\n have \"K x \\ {K d |d. K x = K d}\" by auto\n moreover from 1 have \"theLe (K x) = x\" by (simp add: pointfree_idE)\n ultimately show ?case by auto\n qed\n moreover from B have \"finite {K d |d. f M (v c) = K d}\" by auto\n ultimately show ?case by auto\n qed\n then have C: \"\\ f g K. theLe o K = id \\ finite (g ` {d | d. f M (v c) = K d})\" by auto\n have finI2: \"\\ f g K. theLe o K = id \\ finite ({g d | d. f M (v c) = K d})\"\n proof goal_cases\n case (1 f g K)\n have \"{g d |d. f M (v c) = K d} = g ` {d | d. f M (v c) = K d}\" by auto\n with C 1 show ?case by auto\n qed\n\n { fix K :: \"'b \\ 'b DBMEntry\" assume A: \"theLe o K = id\"\n then have\n \"finite ((\\(c,d). u c - d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d})\"\n by (intro finI1, auto)\n moreover have\n \"{u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\n = ((\\(c,d). u c - d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d})\"\n by auto\n ultimately have \"finite {u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\"\n by auto\n moreover have \"finite {- d |d. M 0 (v c) = K d}\" using A by (intro finI2, auto)\n ultimately have\n \"finite ({u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\n \\ {- d |d. M 0 (v c) = K d})\"\n by (auto simp: S_Min_Le)\n } note fin1 = this\n have fin_min_le: \"finite S_Min_Le\" unfolding S_Min_Le by (rule fin1, auto)\n have fin_min_lt: \"finite S_Min_Lt\" unfolding S_Min_Lt by (rule fin1, auto)\n\n { fix K :: \"'b \\ 'b DBMEntry\" assume A: \"theLe o K = id\"\n then have \"finite ((\\(c,d). u c + d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d})\"\n by (intro finI1, auto)\n moreover have\n \"{u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\n = ((\\(c,d). u c + d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d})\"\n by auto\n ultimately have \"finite {u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\"\n by auto\n moreover have \"finite {d |d. M (v c) 0 = K d}\" using A by (intro finI2, auto)\n ultimately have\n \"finite ({u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\n \\ {d |d. M (v c) 0 = K d})\"\n by (auto simp: S_Min_Le)\n } note fin2 = this\n have fin_max_le: \"finite S_Max_Le\" unfolding S_Max_Le by (rule fin2, auto)\n have fin_max_lt: \"finite S_Max_Lt\" unfolding S_Max_Lt by (rule fin2, auto)\n\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n then have \"l \\ r\"\n proof (auto simp: S_Min_Le S_Max_Le, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have\n \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have\n \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have\n \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by auto \n with 1 have \"u c1 - u c2 \\ d1 + d2\" by auto\n thus ?case\n by (metis (hide_lams, no_types) add_diff_cancel_left diff_0_right diff_add_cancel diff_eq_diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast \n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' \\ d + r\" by auto\n thus ?case by (metis add_diff_cancel_left add_le_cancel_right diff_0_right diff_add_cancel)\n next\n case (3 d c' d')\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast \n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' \\ d + d'\" by auto\n thus ?case\n by (metis add_uminus_conv_diff diff_le_eq minus_add_distrib minus_le_iff)\n next\n case (4 d)\n text \\\n Here is the reason we need the assumption that the zone was not empty before the reset.\n We cannot deduce anything from the current value of \\c\\ itself because we reset it.\n We can only ensure that we can reset the value of \\c\\ by using the value from the\n alternative assignment.\n This case is only relevant if the tightest bounds for \\d\\ were given by its original\n lower and upper bounds. If they would overlap, the original zone would be empty.\n \\\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c \\ r\" by auto\n thus ?case by (metis minus_le_iff order.trans)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Lt\"\n then have \"l < r\"\n proof (auto simp: S_Min_Le S_Max_Lt, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n then show ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis add.commute diff_less_eq uminus_add_conv_diff)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c < r\" by auto\n thus ?case by (metis minus_le_iff neq_iff not_le order.strict_trans)\n qed\n } note EL = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Le\"\n then have \"l < r\"\n proof (auto simp: S_Min_Lt S_Max_Le, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n thus ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis add.commute diff_less_eq uminus_add_conv_diff)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c < d\" \"u'' c \\ r\" by auto\n thus ?case by (meson less_le_trans minus_less_iff)\n qed\n } note LE = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Lt\"\n then have \"l < r\"\n proof (auto simp: S_Min_Lt S_Max_Lt, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis \n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n then show ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0\\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis ab_group_add_class.ab_diff_conv_add_uminus add.commute diff_less_eq)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c < r\" by auto\n thus ?case by (metis minus_le_iff neq_iff not_le order.strict_trans)\n qed\n } note LL = this\n\n obtain d' where d':\n \"\\ t \\ S_Min_Le. d' \\ t\" \"\\ t \\ S_Min_Lt. d' > t\"\n \"\\ t \\ S_Max_Le. d' \\ t\" \"\\ t \\ S_Max_Lt. d' < t\"\n proof -\n assume m:\n \"\\d'. \\\\t\\S_Min_Le. t \\ d'; \\t\\S_Min_Lt. t < d'; \\t\\S_Max_Le. d' \\ t; \\t\\S_Max_Lt. d' < t\\\n \\ thesis\"\n let ?min_le = \"Max S_Min_Le\"\n let ?min_lt = \"Max S_Min_Lt\" \n let ?max_le = \"Min S_Max_Le\"\n let ?max_lt = \"Min S_Max_Lt\"\n \n show thesis\n proof (cases \"S_Min_Le = {} \\ S_Min_Lt = {}\")\n case True\n note T = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True T by (intro m[of ?d']) auto\n next\n case False\n let ?d =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n obtain a :: \"'b\" where a: \"a < 0\" using non_trivial_neg by auto\n let ?d' = \"min 0 (?d + a)\"\n { fix x assume \"x \\ S_Max_Le\"\n with fin_max_le a have \"min 0 (Min S_Max_Le + a) \\ x\"\n by (metis Min.boundedE add_le_same_cancel1 empty_iff less_imp_le min.coboundedI2)\n then have \"min 0 (Min S_Max_Le + a) \\ x\" by auto\n } note 1 = this\n { fix x assume x: \"x \\ S_Max_Lt\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < ?max_lt\"\n by (meson a add_less_same_cancel1 min.cobounded1 min.strict_coboundedI2 order.strict_trans2) \n also from fin_max_lt x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < x\" .\n } note 2 = this\n { fix x assume x: \"x \\ S_Max_Le\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ ?max_le\"\n by (metis le_add_same_cancel1 linear not_le a min_le_iff_disj)\n also from fin_max_le x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ x\" .\n } note 3 = this\n show thesis using False T a 1 2 3\n proof ((intro m[of ?d']), auto, goal_cases)\n case 1 then show ?case\n by (metis Min.in_idem add.commute fin_max_lt leD le_add_same_cancel2 min.orderI\n min_less_iff_disj not_less_iff_gr_or_eq)\n qed\n qed\n next\n case False\n note F = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n obtain a :: \"'b\" where \"a < 0\" using non_trivial_neg by blast\n then have a: \"-a > 0\" using non_trivial_neg by simp\n then obtain a :: \"'b\" where a: \"a > 0\" by blast\n let ?d' = \"?l + a\"\n {\n fix x assume x: \"x \\ S_Min_Le\"\n then have \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" using fin_min_le by (simp add: max.coboundedI2)+\n then have \"x \\ max ?min_lt ?min_le + a\" \"x \\ ?min_le + a\" using a by (simp add: add_increasing2)+\n } note 1 = this\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI1)+\n then have \"x < ?d'\" using a x by (auto simp add: add.commute add_strict_increasing)\n } note 2 = this\n show thesis using True F a 1 2 by ((intro m[of ?d']), auto)\n next\n case False\n let ?r =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n have 1: \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" if \"x \\ S_Min_Le\" for x\n by (simp add: max.coboundedI2 that fin_min_le)+\n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LE[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt \\ x\" by auto\n } note 3 = this\n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Le\"\n with EE[OF Max_in[OF fin_min_le], OF _ x(1)] have \"?min_le \\ x\" by auto\n } note 4 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LL[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt < x\" by auto\n } note 5 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from EL[OF Max_in[OF fin_min_le], OF this, OF x(1)] have \"?min_le < x\" by auto\n } note 6 = this\n \n show thesis\n proof (cases \"?l < ?r\")\n case False\n then have *: \"S_Max_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n with \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ obtain y where y:\"y \\ S_Max_Lt\" by auto\n note 1 = 1 this\n { fix x y assume A: \"x \\ S_Min_Le\" \"y \\ S_Max_Lt\"\n with EL[OF Max_in[OF fin_min_le] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Le < Min S_Max_Lt\" by auto\n } note ** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n show ?case\n proof (cases \"S_Min_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Min_Lt \\ {}\")\n case True\n then show False using 1 T True ** *** by auto\n next\n case False with 1 T ** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Min_Le = {} \\ S_Min_Lt = {})\\ show ?thesis by auto\n qed\n qed\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Le\"\n with LE[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_le]]\n have \"Max S_Min_Lt < Min S_Max_Le\" by auto\n } note **** = this\n from F False have **: \"S_Min_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n show ?case\n proof (cases \"S_Max_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Max_Lt \\ {}\")\n case True\n then show False using 1 T True **** *** by auto\n next\n case False with 1 T **** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ show ?thesis by auto\n qed\n qed\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI2)\n also have \"?min_lt < ?min_le\"\n proof (rule ccontr, goal_cases)\n case 1\n with x ** have 1: \"?l = ?min_lt\" by (auto simp: max.absorb1)\n have 2: \"?min_lt < ?max_le\" using * ****[OF x] by auto\n show False\n proof (cases \"S_Max_Lt = {}\")\n case False\n then have \"?min_lt < ?max_lt\" using * ***[OF x] by auto\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n next\n case True\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n qed\n qed\n finally have \"x < max ?min_lt ?min_le\" by (simp add: max.strict_coboundedI2) \n } note 2 = this\n show thesis using F False 1 2 3 4 5 6 * ** by ((intro m[of ?l]), auto)\n next\n case True\n then obtain d where d: \"?l < d\" \"d < ?r\" using dense by auto\n let ?d' = \"d\"\n {\n fix t assume \"t \\ S_Min_Le\"\n then have \"t \\ ?l\" using 1 by auto\n with d have \"t \\ d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Min_Lt\"\n then have \"t \\ max ?min_lt ?min_le\" using fin_min_lt by (simp add: max.coboundedI1)\n with t have \"t \\ ?l\" using fin_min_lt by auto\n with d have \"t < d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Le\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_le by (simp add: min.coboundedI2)\n then have \"?r \\ t\" using fin_max_le t by auto\n with d have \"d \\ t\" by auto\n then have \"d \\ t\" by (simp add: min.coboundedI2)\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Lt\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_lt by (simp add: min.coboundedI1)\n then have \"?r \\ t\" using fin_max_lt t by auto\n with d have \"d < t\" by auto\n then have \"d < t\" by (simp add: min.strict_coboundedI2)\n }\n ultimately show thesis by ((intro m[of ?d']), auto)\n qed\n qed\n qed\n qed\n have \"DBM_val_bounded v (u(c := d')) M n\" unfolding DBM_val_bounded_def\n proof (auto, goal_cases)\n case 1\n with A show ?case unfolding DBM_reset_def DBM_val_bounded_def by auto\n next\n case (2 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n with A(2,7) have \"v c \\ v c'\" by auto\n hence *:\"M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c'))\"\n using A(2,3,6,7) 2 unfolding DBM_reset_def by auto\n from 2 A(2,4) have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min2 * have \"dbm_entry_val u None (Some c') (M 0 (v c'))\" by auto\n thus ?thesis using False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M 0 (v c)\", goal_cases)\n case (1 t)\n hence \"-t \\ S_Min_Le\" unfolding S_Min_Le by force\n hence \"d' \\ -t\" using d' by auto\n thus ?case using 1 by (auto simp: minus_le_iff)\n next\n case (2 t)\n hence \"-t \\ S_Min_Lt\" unfolding S_Min_Lt by force\n hence \"d' > -t\" using d' by auto\n thus ?case using 2 by (auto simp: minus_less_iff)\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case (3 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n with A(2,7) have \"v c \\ v c'\" by auto\n hence *:\"M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0)\"\n using A(2,3,6,7) 3 unfolding DBM_reset_def by auto\n from 3 A(2,4) have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min3 * have \"dbm_entry_val u (Some c') None (M (v c') 0)\" by auto\n thus ?thesis using False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M (v c) 0\", goal_cases)\n case (1 t)\n hence \"t \\ S_Max_Le\" unfolding S_Max_Le by force\n hence \"d' \\ t\" using d' by auto\n thus ?case using 1 by (auto simp: minus_le_iff)\n next\n case (2 t)\n hence \"t \\ S_Max_Lt\" unfolding S_Max_Lt by force\n hence \"d' < t\" using d' by auto\n thus ?case using 2 by (auto simp: minus_less_iff)\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case (4 c1 c2)\n show ?case\n proof (cases \"c = c1\")\n case False\n note F1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with A(2,6,7) F1 have \"v c \\ v c1\" \"v c \\ v c2\" by auto\n hence *:\"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(2,3,6,7) 4 unfolding DBM_reset_def by auto\n from 4 A(2,4) have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min * have \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\" by auto\n thus ?thesis using F1 False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M (v c1) (v c)\", goal_cases)\n case (1 t)\n hence \"u c1 - t \\ S_Min_Le\" unfolding S_Min_Le using A F1 4 by blast\n hence \"d' \\ u c1 - t\" using d' by auto\n hence \"t + d' \\ u c1\" by (metis le_swap add_le_cancel_right diff_add_cancel) \n hence \"u c1 - d' \\ t\" by (metis add_le_imp_le_right diff_add_cancel) \n thus ?case using 1 F1 by auto\n next\n case (2 t)\n hence \"u c1 - t \\ S_Min_Lt\" unfolding S_Min_Lt using A 4 F1 by blast\n hence \"d' > u c1 - t\" using d' by auto\n hence \"d' + t > u c1\" by (metis add_strict_right_mono diff_add_cancel)\n hence \"u c1 - d' < t\" by (metis gt_swap add_less_cancel_right diff_add_cancel)\n thus ?case using 2 F1 by auto\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case True\n note T = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n show ?thesis\n proof (cases \"M (v c) (v c2)\", goal_cases)\n case (1 t)\n hence \"u c2 + t \\ S_Max_Le\" unfolding S_Max_Le using A 4 False by blast\n hence \"d' \\ u c2 + t\" using d' by auto\n hence \"d' - u c2 \\ t\"\n by (metis (hide_lams, no_types) add_diff_cancel_left add_ac(1) add_le_cancel_right\n add_right_cancel diff_add_cancel)\n thus ?case using 1 T False by auto\n next\n case (2 t)\n hence \"u c2 + t \\ S_Max_Lt\" unfolding S_Max_Lt using A 4 False by blast\n hence \"d' < u c2 + t\" using d' by auto\n hence \"d' - u c2 < t\" by (metis gt_swap add_less_cancel_right diff_add_cancel)\n thus ?case using 2 T False by force\n next\n case 3 thus ?case using T by auto\n qed\n next\n case True\n from A 4 have *:\"dbm_entry_val u'' (Some c1) (Some c1) (M (v c1) (v c1))\"\n unfolding DBM_val_bounded_def by auto\n show ?thesis using True T\n proof (simp add: True T, cases \"M (v c1) (v c1)\", goal_cases)\n case (1 t)\n with * have \"0 \\ t\" by auto\n thus ?case using 1 by auto\n next\n case (2 t)\n with * have \"0 < t\" by auto\n thus ?case using 2 by auto\n next\n case 3 thus ?case by auto\n qed\n qed\n qed\n qed\n thus ?thesis using A(1) by blast\nqed\n\nlemma DBM_reset_sound2:\n assumes \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M' n\"\n shows \"u c = d\"\nusing assms unfolding DBM_val_bounded_def DBM_reset_def\nby fastforce\n\nlemma DBM_reset_sound'':\n fixes M v c n d\n defines \"M' \\ reset M n (v c) d\"\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_val_bounded v u M' n\"\n \"DBM_val_bounded v u'' M n\"\n obtains d' where \"DBM_val_bounded v (u(c := d')) M n\"\nproof -\n assume A:\"\\d'. DBM_val_bounded v (u(c := d')) M n \\ thesis\"\n from assms DBM_reset_reset[of \"v c\" n M d]\n have *:\"DBM_reset M n (v c) d M'\" by (auto simp add: M'_def)\n with DBM_reset_sound'[of v n c M d M', OF _ _ this] assms obtain d' where\n \"DBM_val_bounded v (u(c := d')) M n\" by auto\n with A show thesis by auto\nqed\n\nlemma DBM_reset_sound:\n fixes M v c n d\n defines \"M' \\ reset M n (v c) d\"\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"u \\ [M']\\<^bsub>v,n\\<^esub>\"\n obtains d' where \"u(c := d') \\[M]\\<^bsub>v,n\\<^esub>\"\nproof (cases \"[M]\\<^bsub>v,n\\<^esub> = {}\")\n case False\n then obtain u' where \"DBM_val_bounded v u' M n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset_sound''[OF assms(3-4) _ this] assms(1,5) that show ?thesis\n unfolding DBM_zone_repr_def by auto\nnext\n case True\n with DBM_reset_complete_empty'[OF assms(2) _ _ DBM_reset_reset, of \"v c\" M u d] assms show ?thesis\n unfolding DBM_zone_repr_def by simp\nqed\n\nlemma DBM_reset'_complete':\n assumes \"DBM_val_bounded v u M n\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"\\ u'. DBM_val_bounded v u' (reset' M n cs v d) n\"\nusing assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n let ?M' = \"reset' M n cs v d\"\n let ?M'' = \"reset ?M' n (v c) d\"\n from Cons obtain u' where u': \"DBM_val_bounded v u' ?M' n\" by fastforce\n from Cons(3,4) have \"0 < v c\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this] have **: \"DBM_reset ?M' n (v c) d ?M''\" by fast\n from Cons(4) have \"v c \\ n\" by auto\n from DBM_reset_complete[of v n c ?M' d ?M'', OF Cons(3) this ** u']\n have \"DBM_val_bounded v (u'(c := d)) (reset (reset' M n cs v d) n (v c) d) n\" by fast\n thus ?case by auto\nqed\n\nlemma DBM_reset'_complete:\n assumes \"DBM_val_bounded v u M n\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"DBM_val_bounded v ([cs \\ d]u) (reset' M n cs v d) n\"\nusing assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n let ?M' = \"reset' M n cs v d\"\n let ?M'' = \"reset ?M' n (v c) d\"\n from Cons have *: \"DBM_val_bounded v ([cs\\d]u) (reset' M n cs v d) n\" by fastforce\n from Cons(3,4) have \"0 < v c\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this] have **: \"DBM_reset ?M' n (v c) d ?M''\" by fast\n from Cons(4) have \"v c \\ n\" by auto\n from DBM_reset_complete[of v n c ?M' d ?M'', OF Cons(3) this ** *]\n have ***:\"DBM_val_bounded v ([c#cs\\d]u) (reset (reset' M n cs v d) n (v c) d) n\" by simp\n have \"reset' M n (c#cs) v d = reset (reset' M n cs v d) n (v c) d\" by auto\n with *** show ?case by presburger\nqed\n\nlemma DBM_reset'_sound_empty:\n assumes \"clock_numbering' v n\" \"\\c \\ set cs. v c \\ n\"\n \"\\ u . \\ DBM_val_bounded v u (reset' M n cs v d) n\"\n shows \"\\ DBM_val_bounded v u M n\"\nusing assms DBM_reset'_complete by metis\n\nfun set_clocks :: \"'c list \\ 't::time list\\ ('c,'t) cval \\ ('c,'t) cval\"\nwhere\n \"set_clocks [] _ u = u\" |\n \"set_clocks _ [] u = u\" |\n \"set_clocks (c#cs) (t#ts) u = (set_clocks cs ts (u(c:=t)))\"\n\nlemma DBM_reset'_sound':\n fixes M v c n d cs\n assumes \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n \"DBM_val_bounded v u (reset' M n cs v d) n\" \"DBM_val_bounded v u'' M n\"\n shows \"\\ts. DBM_val_bounded v (set_clocks cs ts u) M n\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil\n hence \"DBM_val_bounded v (set_clocks [] [] u) M n\" by auto\n thus ?case by blast\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from DBM_reset'_complete[OF Cons(5) Cons(2)] Cons(3)\n have u'': \"DBM_val_bounded v ([cs\\d]u'') ?M'' n\" by fastforce\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound''[OF Cons(2) this u'']\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" by blast\n from Cons.IH[OF Cons.prems(1) _ ** Cons.prems(4)] Cons.prems(2)\n obtain ts where ts:\"DBM_val_bounded v (set_clocks cs ts (u(c' := d'))) M n\" by fastforce\n hence \"DBM_val_bounded v (set_clocks (c' # cs) (d'#ts) u) M n\" by auto\n thus ?case by fast\nqed\n\nlemma DBM_reset'_resets:\n fixes M v c n d cs\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n \"DBM_val_bounded v u (reset' M n cs v d) n\"\n shows \"\\c \\ set cs. u c = d\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil thus ?case by auto\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from Cons(4,5) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound2[OF this(1) _ Cons(5), of ?M'' d] DBM_reset_reset[OF _ this(1), of ?M'' d] Cons(3)\n have c':\"u c' = d\" by auto\n from Cons(4,5) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n with DBM_reset_sound[OF Cons.prems(1,2) this(1)]\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" unfolding DBM_zone_repr_def by blast\n from Cons.IH[OF Cons.prems(1,2) _ **] Cons.prems(3) have \"\\c\\set cs. (u(c' := d')) c = d\" by auto\n thus ?case using c'\n apply safe\n apply (rename_tac c)\n apply (case_tac \"c = c'\")\n by auto\nqed\n\nlemma DBM_reset'_resets':\n fixes M v c n d cs\n assumes \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\" \"DBM_val_bounded v u (reset' M n cs v d) n\"\n \"DBM_val_bounded v u'' M n\"\n shows \"\\c \\ set cs. u c = d\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil thus ?case by auto\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from DBM_reset'_complete[OF Cons(5) Cons(2)] Cons(3)\n have u'': \"DBM_val_bounded v ([cs\\d]u'') ?M'' n\" by fastforce\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound2[OF this(1) _ Cons(4), of ?M'' d] DBM_reset_reset[OF _ this(1), of ?M'' d] Cons(2)\n have c':\"u c' = d\" by auto\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound''[OF Cons(2) this u'']\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" by blast\n from Cons.IH[OF Cons.prems(1) _ ** Cons.prems(4)] Cons.prems(2)\n have \"\\c\\set cs. (u(c' := d')) c = d\" by auto\n thus ?case using c'\n apply safe\n apply (rename_tac c)\n apply (case_tac \"c = c'\")\n by auto\nqed\n\nlemma DBM_reset'_neg_diag_preservation':\n assumes \"k\\n\" \"M k k < \\\" \"clock_numbering v\" \"\\ c \\ set cs. v c \\ n\"\n shows \"reset' M n cs v d k k < \\\" using assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n then have IH: \"reset' M n cs v d k k < \\\" by auto\n from Cons.prems have \"v c > 0\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this, of \"reset' M n cs v d\" d] \\k \\ n\\\n have \"reset (reset' M n cs v d) n (v c) d k k \\ reset' M n cs v d k k\" unfolding DBM_reset_def\n by (cases \"v c = k\", simp add: less[symmetric], case_tac \"k = 0\", auto simp: less[symmetric])\n with IH show ?case by auto\nqed\n\nlemma DBM_reset'_complete_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n \"\\ c \\ set cs. v c \\ n\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ u . \\ DBM_val_bounded v u (reset' M n cs v d) n\" using assms\nproof (induction cs)\n case Nil then show ?case by simp\nnext\n case (Cons c cs)\n then have \"\\u. \\ DBM_val_bounded v u (reset' M n cs v d) n\" by auto\n from Cons.prems(2,3) DBM_reset_complete_empty'[OF Cons.prems(1) _ _ DBM_reset_reset this] \n show ?case by auto\nqed\n\nlemma DBM_reset'_complete_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n \"\\ c \\ set cs. v c \\ n\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ u . \\ DBM_val_bounded v u (reset' (FW M n) n cs v d) n\" using assms\nproof -\n note A = assms\n from A(4) have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_zone_equiv[OF A(1)] have \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_detects_empty_zone[OF A(1)] A(2) obtain i where i: \"i \\ n\" \"FW M n i i < Le 0\" by blast\n with DBM_reset'_neg_diag_preservation' A(2,3) have\n \"reset' (FW M n) n cs v d i i < Le 0\"\n by (auto simp: neutral)\n with fw_mono[of n n n i i \"reset' (FW M n) n cs v d\" n] i\n have \"FW (reset' (FW M n) n cs v d) n i i < Le 0\" by auto\n with FW_detects_empty_zone[OF A(1), of \"reset' (FW M n) n cs v d\"] A(2,3) i\n have \"[FW (reset' (FW M n) n cs v d) n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_zone_equiv[OF A(1), of \"reset' (FW M n) n cs v d\"] A(3,4)\n show ?thesis by (auto simp: DBM_zone_repr_def)\nqed\n\nlemma DBM_reset'_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [reset' (FW M n) n cs v d]\\<^bsub>v,n\\<^esub> = {}\"\nproof\n let ?M' = \"reset' (FW M n) n cs v d\"\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n with DBM_reset'_complete_empty[OF assms] show \"[?M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n let ?M' = \"reset' (FW M n) n cs v d\"\n assume A: \"[?M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u ?M' n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset'_sound_empty[OF assms(2,3) this] have \"\\ u. \\ DBM_val_bounded v u (FW M n) n\" by auto\n with FW_zone_equiv[OF assms(1)] show \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset'_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [reset' M n cs v d]\\<^bsub>v,n\\<^esub> = {}\"\nproof\n let ?M' = \"reset' M n cs v d\"\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n with DBM_reset'_complete_empty'[OF assms] show \"[?M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n let ?M' = \"reset' M n cs v d\"\n assume A: \"[?M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u ?M' n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset'_sound_empty[OF assms(2,3) this] have \"\\ u. \\ DBM_val_bounded v u M n\" by auto\n with FW_zone_equiv[OF assms(1)] show \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset'_sound:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n and \"\\c\\set cs. v c \\ n\"\n and \"u \\ [reset' M n cs v d]\\<^bsub>v,n\\<^esub>\"\n shows \"\\ts. set_clocks cs ts u \\ [M]\\<^bsub>v,n\\<^esub>\"\nproof -\n from DBM_reset'_empty[OF assms(1-3)] assms(4) obtain u' where \"u' \\ [M]\\<^bsub>v,n\\<^esub>\" by blast\n with DBM_reset'_sound'[OF assms(2,3)] assms(4) show ?thesis unfolding DBM_zone_repr_def by blast\nqed\n\nsection \\Misc Preservation Lemmas\\\n\nlemma get_const_sum[simp]:\n \"a \\ \\ \\ b \\ \\ \\ get_const a \\ \\ \\ get_const b \\ \\ \\ get_const (a + b) \\ \\\"\nby (cases a) (cases b, auto simp: mult)+\n\nlemma sum_not_inf_dest:\n assumes \"a + b \\ \\\"\n shows \"a \\ \\ \\ b \\ \\\"\nusing assms by (cases a; cases b; simp add: mult)\n\nlemma sum_not_inf_int:\n assumes \"a + b \\ \\\" \"get_const a \\ \\\" \"get_const b \\ \\\"\n shows \"get_const (a + b) \\ \\\"\nusing assms sum_not_inf_dest by fastforce\n\nlemma int_fw_upd:\n \"\\ i \\ n. \\ j \\ n. m i j \\ \\ \\ get_const (m i j) \\ \\ \\ k \\ n \\ i \\ n \\ j \\ n\n \\ i' \\ n \\ j' \\ n \\ (fw_upd m k i j i' j') \\ \\\n \\ get_const (fw_upd m k i j i' j') \\ \\\"\nproof (goal_cases)\n case 1\n show ?thesis\n proof (cases \"i = i' \\ j = j'\")\n case True\n with 1 show ?thesis by (fastforce simp: fw_upd_def upd_def min_def dest: sum_not_inf_dest)\n next\n case False\n with 1 show ?thesis by (auto simp : fw_upd_def upd_def)\n qed\nqed\n\nlemma fw_int_aux_c:\n assumes \"\\ i \\ n. \\ j \\ n. M i j \\ \\ \\ get_const (M i j) \\ \\\" \"a \\ n\" \"b \\ n\" \"c \\ n\"\n \"i \\ n\" \"j \\ n\" \"((fw M n) 0 0 c) i j \\ \\\"\n shows \"get_const (((fw M n) 0 0 c) i j) \\ \\\"\nusing assms\n apply (induction c arbitrary: i j)\n apply (auto simp: fw_upd_def upd_def min_def)[]\n apply (case_tac \"M 0 0 = \\\")\n apply (simp add: mult)\n apply simp\n apply (fastforce simp: min_def fw_upd_def upd_def dest: sum_not_inf_dest)\ndone\n\nlemma fw_int_aux_Suc_b:\n assumes \"\\ i \\ n. \\ j \\ n. (fw M n) a b n i j \\ \\ \\ get_const ((fw M n) a b n i j) \\ \\\"\n \"a \\ n\" \"Suc b \\ n\" \"c \\ n\" \"i \\ n\" \"j \\ n\" \"((fw M n) a (Suc b) c) i j \\ \\\"\n shows \"get_const (((fw M n) a (Suc b) c) i j) \\ \\\"\nusing assms by (induction c arbitrary: i j) (auto intro: int_fw_upd[of n])\n\nlemma fw_int_aux_b:\n assumes \"\\ i \\ n. \\ j \\ n. M i j \\ \\ \\ get_const (M i j) \\ \\\" \"a \\ n\" \"b \\ n\" \"c \\ n\"\n \"i \\ n\" \"j \\ n\" \"((fw M n) 0 b c) i j \\ \\\"\n shows \"get_const (((fw M n) 0 b c) i j) \\ \\\" using assms\n apply (induction b arbitrary: i j c)\n apply (blast intro: fw_int_aux_c)\n apply (rule fw_int_aux_Suc_b[of n])\nby auto\n\nlemma fw_int_aux_Suc_a:\n assumes \"\\ i \\ n. \\ j \\ n. (fw M n) a n n i j \\ \\ \\ get_const ((fw M n) a n n i j) \\ \\\"\n \"Suc a \\ n\" \"b \\ n\" \"c \\ n\" \"i \\ n\" \"j \\ n\" \"((fw M n) (Suc a) b c) i j \\ \\\"\n shows \"get_const (((fw M n) (Suc a) b c) i j) \\ \\\"\nusing assms\nproof (induction b arbitrary: i j c)\n case 0\n then show ?case\n by (induction c arbitrary: i j) (auto intro: int_fw_upd[of n])\nnext\n case (Suc b)\n then show ?case by (intro fw_int_aux_Suc_b) auto\nqed\n\nlemma fw_int_preservation:\n assumes \"\\ i \\ n. \\ j \\ n. M i j \\ \\ \\ get_const (M i j) \\ \\\" \"a \\ n\" \"b \\ n\" \"c \\ n\"\n \"i \\ n\" \"j \\ n\" \"((fw M n) a b c) i j \\ \\\"\n shows \"get_const (((fw M n) a b c) i j) \\ \\\"\nusing assms\n apply (induction a arbitrary: i j b c)\n apply (blast intro: fw_int_aux_b)\n apply (rule fw_int_aux_Suc_a[of n])\nby auto\n\nlemma FW_int_preservation:\n assumes \"\\ i \\ n. \\ j \\ n. M i j \\ \\ \\ get_const (M i j) \\ \\\"\n shows \"\\ i \\ n. \\ j \\ n. FW M n i j \\ \\ \\ get_const (FW M n i j) \\ \\\"\nby (blast intro: fw_int_preservation[OF assms(1)])\n\nabbreviation \"dbm_int M n \\ \\ i\\n. \\ j\\n. M i j \\ \\ \\ get_const (M i j) \\ \\\"\n\nlemma And_int_preservation:\n assumes \"dbm_int M1 n\" \"dbm_int M2 n\"\n shows \"dbm_int (And M1 M2) n\"\nusing assms by (auto simp: min_def)\n\nlemma up_int_preservation:\n \"dbm_int M n \\ dbm_int (up M) n\"\nunfolding up_def min_def\n apply safe\n apply (case_tac \"i = 0\")\n apply fastforce\n apply (case_tac \"j = 0\")\n apply fastforce\n apply auto\nunfolding mult[symmetric] by (auto dest: sum_not_inf_dest)\n\n(* Definitely a candidate for cleaning *)\nlemma DBM_reset_int_preservation':\n assumes \"dbm_int M n\" \"DBM_reset M n k d M'\" \"d \\ \\\" \"k \\ n\"\n shows \"dbm_int M' n\"\nproof clarify\n fix i j\n assume A: \"i \\ n\" \"j \\ n\" \"M' i j \\ \\\"\n from assms(2) show \"get_const (M' i j) \\ \\\" unfolding DBM_reset_def\n apply (cases \"i = k\"; cases \"j = k\")\n apply simp\n using A assms(1,4) apply presburger\n apply (cases \"j = 0\")\n using assms(3) apply simp\n using A apply simp\n apply simp\n apply (cases \"i = 0\")\n using assms(3) apply simp\n using A apply simp\n using A apply simp\n apply (simp split: split_min, safe)\n subgoal\n proof goal_cases\n case 1\n then have *: \"M i k + M k j \\ \\\" unfolding mult min_def by meson\n with sum_not_inf_dest have \"M i k \\ \\\" \"M k j \\ \\\" by auto\n with 1(3,4) assms(1,4) have \"get_const (M i k) \\ \\\" \"get_const (M k j) \\ \\\" by auto\n with sum_not_inf_int[folded mult, OF *] show ?case unfolding mult by auto\n qed\n subgoal\n proof goal_cases\n case 1\n then have *: \"M i j \\ \\\" unfolding mult min_def by meson\n with 1(3,4) assms(1,4) show ?case by auto\n qed\n done\nqed\n\nlemma DBM_reset_int_preservation:\n assumes \"dbm_int M n\" \"d \\ \\\" \"0 < k\" \"k \\ n\"\n shows \"dbm_int (reset M n k d) n\"\nusing assms(3-) DBM_reset_int_preservation'[OF assms(1) DBM_reset_reset assms(2)] by blast\n\nlemma DBM_reset'_int_preservation:\n assumes \"dbm_int M n\" \"d \\ \\\" \"\\c. v c > 0\" \"\\ c \\ set cs. v c \\ n\"\n shows \"dbm_int (reset' M n cs v d) n\" using assms\nproof (induction cs)\n case Nil then show ?case by simp\nnext\n case (Cons c cs)\n from Cons.IH[OF Cons.prems(1,2,3)] Cons.prems(4) have \"dbm_int (reset' M n cs v d) n\" by fastforce\n from DBM_reset_int_preservation[OF this Cons.prems(2), of \"v c\"] Cons.prems(3,4) show ?case by auto\nqed\n\nlemma int_zone_dbm:\n assumes \"clock_numbering' v n\"\n \"\\ (_,d) \\ collect_clock_pairs cc. d \\ \\\" \"\\ c \\ collect_clks cc. v c \\ n\"\n obtains M where \"{u. u \\ cc} = [M]\\<^bsub>v,n\\<^esub>\"\n and \"\\ i \\ n. \\ j \\ n. M i j \\ \\ \\ get_const (M i j) \\ \\\"\nproof -\n let ?M = \"abstr cc (\\i j. \\) v\"\n from assms(2) have \"\\ i \\ n. \\ j \\ n. ?M i j \\ \\ \\ get_const (?M i j) \\ \\\"\n by (induction cc) (auto simp: min_def)\n with dbm_abstr_zone_eq[OF assms(1) assms(3)] show ?thesis by (auto intro: that)\nqed\n\nlemma reset_set1:\n \"\\c \\ set cs. ([cs\\d]u) c = d\"\nby (induction cs) auto\n\nlemma reset_set11:\n \"\\c. c \\ set cs \\ ([cs\\d]u) c = u c\"\nby (induction cs) auto\n\nlemma reset_set2:\n \"\\c. c \\ set cs \\ (set_clocks cs ts u)c = u c\"\nproof (induction cs arbitrary: ts u)\n case Nil then show ?case by auto\nnext\n case Cons then show ?case\n proof (cases ts, goal_cases)\n case Nil then show ?thesis by simp\n next\n case (2 a') then show ?case by auto\n qed\nqed\n\nlemma reset_set:\n assumes \"\\ c \\ set cs. u c = d\"\n shows \"[cs\\d](set_clocks cs ts u) = u\"\nproof\n fix c\n show \"([cs\\d]set_clocks cs ts u) c = u c\"\n proof (cases \"c \\ set cs\")\n case True\n hence \"([cs\\d]set_clocks cs ts u) c = d\" using reset_set1 by fast\n also have \"d = u c\" using assms True by auto\n finally show ?thesis by auto\n next\n case False\n hence \"([cs\\d]set_clocks cs ts u) c = set_clocks cs ts u c\" by (simp add: reset_set11)\n also with False have \"\\ = u c\" by (simp add: reset_set2)\n finally show ?thesis by auto\n qed\nqed\n\nabbreviation global_clock_numbering ::\n \"('a, 'c, 't :: time, 's) ta \\ ('c \\ nat) \\ nat \\ bool\"\nwhere\n \"global_clock_numbering A v n \\\n clock_numbering' v n \\ (\\ c \\ clk_set A. v c \\ n) \\ (\\k\\n. k > 0 \\ (\\c. v c = k))\"\n\nlemma dbm_int_abstr:\n assumes \"\\ (x, m) \\ collect_clock_pairs g. m \\ \\\"\n shows \"dbm_int (abstr g (\\i j. \\) v) n\"\nusing assms\n apply (induction g)\n apply auto[]\nunfolding min_def by auto\n\nlemma dbm_int_inv_abstr:\n assumes \"\\(x,m) \\ clkp_set A. m \\ \\\"\n shows \"dbm_int (abstr (inv_of A l) (\\i j. \\) v) n\"\nproof -\n from assms have \"\\ (x, m) \\ collect_clock_pairs (inv_of A l). m \\ \\\"\n unfolding clkp_set_def collect_clki_def inv_of_def using Nats_subset_Ints by auto\n from dbm_int_abstr[OF this] show ?thesis .\nqed\n\nlemma dbm_int_guard_abstr:\n assumes \"valid_abstraction A X k\" \"A \\ l \\\\<^bsup>g,a,r\\<^esup> l'\"\n shows \"dbm_int (abstr g (\\i j. \\) v) n\"\nproof -\n from assms have \"\\(x,m) \\ clkp_set A. m \\ k x \\ x \\ X \\ m \\ \\\"\n by (auto elim: valid_abstraction.cases)\n then have \"\\ (x, m) \\ collect_clock_pairs g. m \\ \\\"\n unfolding clkp_set_def collect_clkt_def using assms(2) Nats_subset_Ints by fastforce\n from dbm_int_abstr[OF this] show ?thesis .\nqed\n\nlemma collect_clks_id: \"collect_clks cc = fst ` collect_clock_pairs cc\" by (induction cc) auto\n\nsubsection \\Unused theorems\\\n\n\n\nlemma canonical_cyc_free2:\n \"canonical M n \\ cyc_free M n \\ (\\i \\ n. M i i \\ \\)\"\n apply safe\n apply (simp add: cyc_free_diag_dest')\nusing canonical_cyc_free by blast\n\nlemma DBM_reset'_diag_preservation:\n assumes \"\\k\\n. M k k \\ \\\" \"clock_numbering v\" \"\\ c \\ set cs. v c \\ n\"\n shows \"\\k\\n. reset' M n cs v d k k \\ \\\" using assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n then have IH: \"\\k\\n. reset' M n cs v d k k \\ \\\" by auto\n from Cons.prems have \"v c > 0\" \"v c \\ n\" by auto\n from DBM_reset_diag_preservation[of n \"reset' M n cs v d\", OF IH DBM_reset_reset, of \"v c\", OF this]\n show ?case by simp\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Timed_Automata/DBM_Operations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2774742096432722}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartialDef.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Hoare Logic for Partial Correctness\\\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\ 'p \\ 's assn \\ 's assn)\"\n\nsubsection \\Validity of Hoare Tuples: \\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\ndefinition\n valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n (\"_\\\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\s t. \\\\\\c,s\\ \\ t \\ s \\ Normal ` P \\ t \\ Fault ` F\n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n\ndefinition\n cvalid::\n \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n (\"_,_\\\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n nvalid :: \"[('s,'p,'f) body,nat,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n (\"_\\_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \\ \\s t. \\\\\\c,s \\ =n\\ t \\ s \\ Normal ` P \\ t \\ Fault ` F\n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n\n\ndefinition\n cnvalid::\n \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_,_\\_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ASCII)\n valid (\"_|='/_/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60) and\n cvalid (\"_,_|='/_/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60) and\n nvalid (\"_|=_:'/_/ _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60) and\n cnvalid (\"_,_|=_:'/_/ _ _ _,_\" [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection \\Properties of Validity\\\n\nlemma valid_iff_nvalid: \"\\\\\\<^bsub>/F\\<^esub> P c Q,A = (\\n. \\\\n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n apply (simp only: valid_def nvalid_def exec_iff_execn )\n apply (blast dest: exec_final_notin_to_execn)\n done\n\nlemma cnvalid_to_cvalid: \"(\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A) \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n apply fast\n done\n\nlemma nvalidI:\n \"\\\\s t. \\\\\\\\c,Normal s \\ =n\\ t;s \\ P; t\\ Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: nvalid_def)\n\nlemma validI:\n \"\\\\s t. \\\\\\\\c,Normal s \\ \\ t;s \\ P; t\\Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: valid_def)\n\nlemma cvalidI:\n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P;t\\Fault ` F\\\n \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A;\\(P,p,Q,A)\\\\. \\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P;t\\Fault ` F\\\n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI:\n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n \\\\\\c,Normal s \\ =n\\ t;s \\ P;t\\Fault ` F\\\n \\ t \\ Normal ` Q \\ Abrupt ` A\\\n \\ \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD:\n \"\\\\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A;\\(P,p,Q,A)\\\\. \\\\n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n \\\\\\c,Normal s \\ =n\\ t;s \\ P;\n t\\Fault ` F\\\n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n assumes validn:\"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n fix s t\n assume exec: \"\\\\\\c,Normal s \\ =n\\ t\"\n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F'\"\n with F' have \"t \\ Fault ` F\"\n by blast\n with exec P validn\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n assumes validn:\"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n fix s t\n assume exec: \"\\\\\\c,Normal s \\ \\ t\"\n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F'\"\n with F' have \"t \\ Fault ` F\"\n by blast\n with exec P validn\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n assumes validn:\"\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F' \\ -F\"\n shows \"strip F' \\\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n fix s t\n assume exec_strip: \"strip F' \\\\\\c,Normal s \\ =n\\ t\"\n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F\"\n from exec_strip obtain t' where\n exec: \"\\\\\\c,Normal s \\ =n\\ t'\" and\n t': \"t' \\ Fault ` (-F') \\ t'=t\" \"\\ isFault t' \\ t'=t\"\n by (blast dest: execn_strip_to_execn)\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"t' \\ Fault ` F\")\n case True\n with t' F F' have False\n by blast\n thus ?thesis ..\n next\n case False\n with exec P validn\n have *: \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: nvalid_def)\n with t' have \"t'=t\"\n by auto\n with * show ?thesis\n by simp\n qed\nqed\n\n\nlemma valid_to_valid_strip:\n assumes valid:\"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F' \\ -F\"\n shows \"strip F' \\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n fix s t\n assume exec_strip: \"strip F' \\\\\\c,Normal s \\ \\ t\"\n assume P: \"s \\ P\"\n assume F: \"t \\ Fault ` F\"\n from exec_strip obtain t' where\n exec: \"\\\\\\c,Normal s \\ \\ t'\" and\n t': \"t' \\ Fault ` (-F') \\ t'=t\" \"\\ isFault t' \\ t'=t\"\n by (blast dest: exec_strip_to_exec)\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"t' \\ Fault ` F\")\n case True\n with t' F F' have False\n by blast\n thus ?thesis ..\n next\n case False\n with exec P valid\n have *: \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by (auto simp add: valid_def)\n with t' have \"t'=t\"\n by auto\n with * show ?thesis\n by simp\n qed\nqed\n\n\nsubsection \\The Hoare Rules: \\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\nlemma mono_WeakenContext: \"A \\ B \\\n (\\(P, c, Q, A'). (\\, \\, F, P, c, Q, A') \\ A) x \\\n (\\(P, c, Q, A'). (\\, \\, F, P, c, Q, A') \\ B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\,\\\\\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\,\\\\\\<^bsub>/F\\<^esub> {s. f s \\ Q} (Basic f) Q,A\"\n\n| Spec: \"\\,\\\\\\<^bsub>/F\\<^esub> {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} (Spec r) Q,A\"\n\n| Seq: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| Cond: \"\\\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c\\<^sub>1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> (P \\ - b) c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n\n| Guard: \"\\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\f \\ F; \\,\\\\\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n \"\\(P,p,Q,A) \\ Specs;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\ \\ \\,\\\\Specs\\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A \\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n \"\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> P (c s) Q,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\,\\\\\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\(P,p,Q,A) \\ \\\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A; \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n \\ \\This is a hack rule that enables us to derive completeness for\n an arbitrary context \\\\\\, from completeness for an empty context.\\\n\n\n\ntext \\Does not work, because of rule ExFalso, the context \\\\\\ is to blame.\n A weaker version with empty context can be derived from soundness\n and completeness later on.\\\nlemma hoare_strip_\\:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"strip (-F) \\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof induct\n case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n case While thus ?case by (iprover intro: hoarep.While)\nnext\n case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\ \\ init p\n result return )\n from CallRec.hyps\n have \"\\p\\Procs. \\Z. (strip \\),\\ \\\n (\\\\<^bsub>p\\Procs\\<^esub>\n \\\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n Post p Z, Abr p Z)})\\\n (Pre p Z) (the (\\ p)) (R p Z),(Abr' p Z)\" by blast\n hence \"\\p\\Procs. \\Z. (strip \\),\\ \\\n (\\\\<^bsub>p\\Procs\\<^esub>\n \\\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n Post p Z, Abr p Z)})\\\n (Pre p Z) (the ((strip \\) p)) (R p Z),(Abr' p Z)\"\n by (auto intro: hoarep.StripI)\n then show ?case\n apply -\n apply (rule hoarep.CallRec)\n apply (assumption | simp only:dom_strip)+\n done*)\nnext\n case DynCom\n thus ?case\n by - (rule hoarep.DynCom,best elim!: ballE exE)\nnext\n case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next\n case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n case ExFalso\n thus ?case\n oops\n\nlemma hoare_augment_context:\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\\\'. \\ \\ \\' \\ \\,\\'\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n case CallRec\n case (CallRec P p Q A Specs \\ F \\')\n from CallRec.prems\n have \"\\\\Specs\n \\ \\'\\Specs\"\n by blast\n with CallRec.hyps (2)\n have \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\ \\,\\'\\Specs \\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A\"\n by fastforce\n\n with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n case (Conseq P \\ F c Q A \\')\n from Conseq\n have \"\\s \\ P.\n (\\P' Q' A'. \\,\\' \\\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A)\"\n by blast\n with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n case (ExFalso \\ F P c Q A \\')\n have valid_ctxt: \"\\n. \\,\\\\n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\ \\'\" by fact+\n hence \"\\n. \\,\\'\\n:\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cnvalid_def) blast\n moreover have invalid: \"\\ \\\\\\<^bsub>/F\\<^esub> P c Q,A\" by fact\n ultimately show ?case\n by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection \\Some Derived Rules\\\n\nlemma Conseq': \"\\s. s \\ P \\\n (\\P' Q' A'.\n (\\ Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\\n (\\Z. s \\ P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)))\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where ?P'=\"\\Z. P'\" and ?Q'=\"\\Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\,\\\\\\<^bsub>/F\\<^esub> P' c Q,A \\ P \\ P' \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q',A' \\ Q' \\ Q \\ A' \\ A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq) auto\n\n\nlemma CallRec':\n \"\\p\\Procs; Procs \\ dom \\;\n \\p\\Procs.\n \\Z. \\,\\ \\ (\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply blast\napply blast\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.27747420964327213}} {"text": "theory WordArrayScorres\n imports\n WordArrayMono\n \"build/Generated_SCorres_Normal\"\n AutoCorres.AutoCorres\nbegin\n\nsection \"Shallow word array method definitions\"\n\nprimrec swa_to_list\n where\n\"swa_to_list (SWA xs) = xs\"\n\nfun list_to_swa\n where\n\"list_to_swa xs = SWA xs\"\n\n\noverloading swa_length \\ wordarray_length\nbegin\ndefinition swa_length :: \"'a WordArray \\ 32 word\"\n where\n\"swa_length x = (of_nat (length (swa_to_list x)) :: 32 word)\"\nend (* of overloading *)\n\noverloading swa_get \\ wordarray_get\nbegin\ndefinition swa_get :: \"('a WordArray, 32 word, 'a) WordArrayGetP \\ 'a\"\n where\n\"swa_get x = \n (let arr = swa_to_list (WordArrayGetP.arr\\<^sub>f x);\n i = unat (WordArrayGetP.idx\\<^sub>f x);\n v = WordArrayGetP.val\\<^sub>f x\n in if i < length arr then arr ! i else v)\"\nend (* of overloading *)\n\noverloading swa_put \\ wordarray_put\nbegin\ndefinition swa_put :: \"('a WordArray, 32 word, 'a) WordArrayGetP \\ 'a WordArray\"\n where\n\"swa_put x = \n (let arr = swa_to_list (WordArrayGetP.arr\\<^sub>f x);\n i = unat (WordArrayGetP.idx\\<^sub>f x);\n v = WordArrayGetP.val\\<^sub>f x\n in list_to_swa (arr[i:= v]))\"\nend (* of overloading *)\n\noverloading swa_get_opt \\ wordarray_get_opt\nbegin\ndefinition swa_get_opt :: \"('a WordArray, 32 word) WordArrayGetOP \\ (unit, 'a) Opt\"\n where\n\"swa_get_opt x = \n (let arr = swa_to_list (WordArrayGetOP.arr\\<^sub>f x);\n i = unat (WordArrayGetOP.idx\\<^sub>f x)\n in if i < length arr then Something (arr ! i) else Nothing ())\"\nend (* of overloading *)\n\noverloading\n valRel_WordArrayWord \\ valRel\nbegin\ndefinition valRel_WordArrayWord:\n\"\\\\' x v. \n valRel_WordArrayWord (\\' :: (funtyp, vabstyp) vabsfuns) (x :: (('a::len8) word) WordArray) (v :: (funtyp, vabstyp) vval) \\ \n (if len_of TYPE('a) = 8 then \n \\xs xs'. v = VAbstract (VWA (TPrim (Num U8)) xs) \\ xs' = swa_to_list x \\ length xs' = length xs \\ (\\i < length xs. (xs ! i) = VPrim (LU8 (ucast (xs' ! i))))\n else if len_of TYPE('a) = 16 then \n \\xs xs'. v = VAbstract (VWA (TPrim (Num U16)) xs) \\ xs' = swa_to_list x \\ length xs' = length xs \\ (\\i < length xs. (xs ! i) = VPrim (LU16 (ucast (xs' ! i))))\n else if len_of TYPE('a) = 32 then \n \\xs xs'. v = VAbstract (VWA (TPrim (Num U32)) xs) \\ xs' = swa_to_list x \\ length xs' = length xs \\ (\\i < length xs. (xs ! i) = VPrim (LU32 (ucast (xs' ! i))))\n else if len_of TYPE('a) = 64 then \n \\xs xs'. v = VAbstract (VWA (TPrim (Num U64)) xs) \\ xs' = swa_to_list x \\ length xs' = length xs \\ (\\i < length xs. (xs ! i) = VPrim (LU64 (ucast (xs' ! i))))\n else False)\"\nend\n\nsublocale level0_value \\ shallow l0v_typing\n by (unfold_locales)\n\nsublocale WordArrayValue \\ shallow wa_abs_typing_v\n by (unfold_locales)\n\ncontext WordArrayValue begin\n\nlemma wordarray_length_scorres:\n \"\\ ''wordarray_length'' = vwa_length \n \\ scorres (wordarray_length :: ('a :: len8) word WordArray \\ 32 word) \n (AFun ''wordarray_length'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_length_def swa_length_def valRel_WordArrayWord\n apply (clarsimp split: if_splits)\n done\n\nlemma wordarray_get_u8_scorres:\n \"\\ ''wordarray_get'' = vwa_get \n \\ scorres \n (wordarray_get :: (8 word WordArray, 32 word, 8 word) WordArrayGetP \\ 8 word) \n (AFun ''wordarray_get'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_def swa_get_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_u16_scorres:\n \"\\ ''wordarray_get'' = vwa_get \n \\ scorres \n (wordarray_get :: (16 word WordArray, 32 word, 16 word) WordArrayGetP \\ 16 word) \n (AFun ''wordarray_get'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_def swa_get_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_u32_scorres:\n \"\\ ''wordarray_get'' = vwa_get \n \\ scorres \n (wordarray_get :: (32 word WordArray, 32 word, 32 word) WordArrayGetP \\ 32 word) \n (AFun ''wordarray_get'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_def swa_get_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_u64_scorres:\n \"\\ ''wordarray_get'' = vwa_get \n \\ scorres \n (wordarray_get :: (64 word WordArray, 32 word, 64 word) WordArrayGetP \\ 64 word) \n (AFun ''wordarray_get'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_def swa_get_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_put_u8_scorres:\n \"\\ ''wordarray_put'' = vwa_put \n \\ scorres \n (wordarray_put :: (8 word WordArray, 32 word, 8 word) WordArrayGetP \\ 8 word WordArray) \n (AFun ''wordarray_put'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_put_def swa_put_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n by (metis (no_types, hide_lams) nth_list_update_eq nth_list_update_neq)\n\nlemma wordarray_put_u16_scorres:\n \"\\ ''wordarray_put'' = vwa_put \n \\ scorres (wordarray_put :: (16 word WordArray, 32 word, 16 word) WordArrayGetP \\ 16 word WordArray) (AFun ''wordarray_put'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_put_def swa_put_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n by (metis (no_types, hide_lams) nth_list_update_eq nth_list_update_neq)\n\nlemma wordarray_put_u32_scorres:\n \"\\ ''wordarray_put'' = vwa_put \n \\ scorres (wordarray_put :: (32 word WordArray, 32 word, 32 word) WordArrayGetP \\ 32 word WordArray) (AFun ''wordarray_put'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_put_def swa_put_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n by (metis (no_types, hide_lams) nth_list_update_eq nth_list_update_neq)\n\nlemma wordarray_put_u64_scorres:\n \"\\ ''wordarray_put'' = vwa_put \n \\ scorres (wordarray_put :: (64 word WordArray, 32 word, 64 word) WordArrayGetP \\ 64 word WordArray) (AFun ''wordarray_put'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_put_def swa_put_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n by (metis (no_types, hide_lams) nth_list_update_eq nth_list_update_neq)\n\n\nlemma wordarray_get_opt_u8_scorres:\n \"\\ ''wordarray_get_opt'' = vwa_get_opt \n \\ scorres (wordarray_get_opt :: (8 word WordArray, 32 word) WordArrayGetOP \\ (unit, 8 word) Opt) (AFun ''wordarray_get_opt'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_opt_def swa_get_opt_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_opt_u16_scorres:\n \"\\ ''wordarray_get_opt'' = vwa_get_opt \n \\ scorres (wordarray_get_opt :: (16 word WordArray, 32 word) WordArrayGetOP \\ (unit, 16 word) Opt) (AFun ''wordarray_get_opt'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_opt_def swa_get_opt_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_opt_u32_scorres:\n \"\\ ''wordarray_get_opt'' = vwa_get_opt \n \\ scorres (wordarray_get_opt :: (32 word WordArray, 32 word) WordArrayGetOP \\ (unit, 32 word) Opt) (AFun ''wordarray_get_opt'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_opt_def swa_get_opt_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nlemma wordarray_get_opt_u64_scorres:\n \"\\ ''wordarray_get_opt'' = vwa_get_opt \n \\ scorres (wordarray_get_opt :: (64 word WordArray, 32 word) WordArrayGetOP \\ (unit, 64 word) Opt) (AFun ''wordarray_get_opt'' ts []) \\ \\\"\n apply (clarsimp simp: scorres_def)\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding vwa_get_opt_def swa_get_opt_def valRel_WordArrayWord valRel_records\n apply (clarsimp split: if_splits simp: Let_def ucast_id valRel_records)\n done\n\nend (* of context *)\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/WordArrayScorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.27745444903196853}} {"text": "(* Title: ZF/Induct/Datatypes.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1994 University of Cambridge\n*)\n\nsection \\Sample datatype definitions\\\n\ntheory Datatypes imports Main begin\n\nsubsection \\A type with four constructors\\\n\ntext \\\n It has four contructors, of arities 0--3, and two parameters \\A\\ and \\B\\.\n\\\n\nconsts\n data :: \"[i, i] => i\"\n\ndatatype \"data(A, B)\" =\n Con0\n | Con1 (\"a \\ A\")\n | Con2 (\"a \\ A\", \"b \\ B\")\n | Con3 (\"a \\ A\", \"b \\ B\", \"d \\ data(A, B)\")\n\nlemma data_unfold: \"data(A, B) = ({0} + A) + (A \\ B + A \\ B \\ data(A, B))\"\n by (fast intro!: data.intros [unfolded data.con_defs]\n elim: data.cases [unfolded data.con_defs])\n\ntext \\\n \\medskip Lemmas to justify using @{term data} in other recursive\n type definitions.\n\\\n\nlemma data_mono: \"[| A \\ C; B \\ D |] ==> data(A, B) \\ data(C, D)\"\n apply (unfold data.defs)\n apply (rule lfp_mono)\n apply (rule data.bnd_mono)+\n apply (rule univ_mono Un_mono basic_monos | assumption)+\n done\n\nlemma data_univ: \"data(univ(A), univ(A)) \\ univ(A)\"\n apply (unfold data.defs data.con_defs)\n apply (rule lfp_lowerbound)\n apply (rule_tac [2] subset_trans [OF A_subset_univ Un_upper1, THEN univ_mono])\n apply (fast intro!: zero_in_univ Inl_in_univ Inr_in_univ Pair_in_univ)\n done\n\nlemma data_subset_univ:\n \"[| A \\ univ(C); B \\ univ(C) |] ==> data(A, B) \\ univ(C)\"\n by (rule subset_trans [OF data_mono data_univ])\n\n\nsubsection \\Example of a big enumeration type\\\n\ntext \\\n Can go up to at least 100 constructors, but it takes nearly 7\n minutes \\dots\\ (back in 1994 that is).\n\\\n\nconsts\n enum :: i\n\ndatatype enum =\n C00 | C01 | C02 | C03 | C04 | C05 | C06 | C07 | C08 | C09\n | C10 | C11 | C12 | C13 | C14 | C15 | C16 | C17 | C18 | C19\n | C20 | C21 | C22 | C23 | C24 | C25 | C26 | C27 | C28 | C29\n | C30 | C31 | C32 | C33 | C34 | C35 | C36 | C37 | C38 | C39\n | C40 | C41 | C42 | C43 | C44 | C45 | C46 | C47 | C48 | C49\n | C50 | C51 | C52 | C53 | C54 | C55 | C56 | C57 | C58 | C59\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/ZF/Induct/Datatypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091673, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.27732402265207723}} {"text": "(* @LICENSE(NICTA_CORE) *)\n\n(* Author: Rafal Kolanski, NICTA & UNSW \n\n Machine setup for 32-bit little-endian ARM.\n\n Machines should export the types:\n * machine_word \n * virtual/physical address width types: paddr_word, vaddr_word\n\n Machines should export the functions:\n * machine_w2b - transform words to bytes (of size \\ machine_word)\n * machine_b2w - transform bytes to words (of size \\ machine_word)\n\n FIXME: these can be derived if we know paddr_word, vaddr_word\n * address types: vaddr, paddr\n * memory_size - size of physical memory address space in bytes\n * addr_space_size - size of virtual memory address space in bytes\n\n Understanding is: a virtual pointer carrying a virtual address resolves to\n a physical address; the smallest granularity of memory is a byte.\n*)\n\ntheory MachineARM\nimports Pointers Word_Lib.Word_Lib\nbegin\n\ntext \\Address types\\\n\ntype_synonym machine_word = \"32 word\"\ntype_synonym vaddr_word = \"32 word\"\ntype_synonym paddr_word = \"32 word\"\n\ntype_synonym vaddr = \"(vaddr_word,virtual) addr_t\"\ntype_synonym paddr = \"(paddr_word,physical) addr_t\"\n\ntranslations\n (type) \"paddr\" <=(type) \"(32 word,physical) addr_t\"\n (type) \"vaddr\" <=(type) \"(32 word,virtual) addr_t\"\n (*XXX: these can be derived, but you'd have to expand vaddr_word etc.*)\n\ntext \\Memory size\\\n\ndefinition\n memory_size :: nat where\n \"memory_size \\ 2 ^ size (addr_val(undefined::paddr))\"\ndefinition\n addr_space_size :: nat where\n \"addr_space_size \\ 2 ^ size (addr_val(undefined::vaddr))\"\n\n(*XXX: not derivable*)\nlemma memory_size: \"memory_size = 2 ^ 32\" (*XXX: used to be [simp]*)\n by (simp add: memory_size_def word_size)\nlemma addr_space_size: \"addr_space_size = 2 ^ 32\" (*XXX: used to be [simp]*)\n by (simp add: addr_space_size_def word_size)\n\ntext \\Endianness setup\\\n\ndefinition\n machine_w2b :: \"'a::len0 word \\ 8 word list\" where\n \"machine_w2b \\ rev \\ word_rsplit\"\n\ndefinition\n machine_b2w :: \"8 word list => 'b :: len0 word\" where\n \"machine_b2w \\ word_rcat \\ rev\"\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Page_Tables/MachineARM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091673, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.27732402265207723}} {"text": "(* Title: Jinja/Compiler/Compiler.thy\n\n Author: Tobias Nipkow\n Copyright TUM 2003\n*)\n\nheader {* \\isaheader{Combining Stages 1 and 2} *}\n\ntheory Compiler\nimports Correctness1 Correctness2\nbegin\n\ndefinition J2JVM :: \"J_prog \\ jvm_prog\"\nwhere \n \"J2JVM \\ compP\\<^sub>2 \\ compP\\<^sub>1\"\n\ntheorem comp_correct:\nassumes wwf: \"wwf_J_prog P\"\nand method: \"P \\ C sees M:Ts\\T = (pns,body) in C\"\nand eval: \"P \\ \\body,(h,[this#pns [\\] vs])\\ \\ \\e',(h',l')\\\"\nand sizes: \"size vs = size pns + 1\" \"size rest = max_vars body\"\nshows \"J2JVM P \\ (None,h,[([],vs@rest,C,M,0)]) -jvm\\ (exception e',h',[])\"\n(*<*)\nproof -\n let ?P\\<^sub>1 = \"compP\\<^sub>1 P\"\n have fv: \"fv body \\ set (this#pns)\"\n using wwf method by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)\n have init: \"[this#pns [\\] vs] \\\\<^sub>m [this#pns [\\] vs@rest]\"\n using sizes by simp\n have \"?P\\<^sub>1 \\ C sees M: Ts\\T = (compE\\<^sub>1 (this#pns) body) in C\"\n using sees_method_compP[OF method, of \"\\(pns,e). compE\\<^sub>1 (this#pns) e\"]\n by(simp)\n moreover obtain ls' where\n \"?P\\<^sub>1 \\\\<^sub>1 \\compE\\<^sub>1 (this#pns) body, (h, vs@rest)\\ \\ \\fin\\<^sub>1 e', (h',ls')\\\"\n using eval\\<^sub>1_eval[OF wwf eval fv init] sizes by auto\n ultimately show ?thesis using comp\\<^sub>2_correct eval_final[OF eval]\n by(fastforce simp add:J2JVM_def final_def)\nqed\n(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/Compiler/Compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.27728270691759843}} {"text": "(* Title: HOL/Statespace/StateFun.thy\n Author: Norbert Schirmer, TU Muenchen\n*)\n\nsection \\State Space Representation as Function \\label{sec:StateFun}\\\n\ntheory StateFun imports DistinctTreeProver\nbegin\n\n\ntext \\The state space is represented as a function from names to\nvalues. We neither fix the type of names nor the type of values. We\ndefine lookup and update functions and provide simprocs that simplify\nexpressions containing these, similar to HOL-records.\n\nThe lookup and update function get constructor/destructor functions as\nparameters. These are used to embed various HOL-types into the\nabstract value type. Conceptually the abstract value type is a sum of\nall types that we attempt to store in the state space.\n\nThe update is actually generalized to a map function. The map supplies\nbetter compositionality, especially if you think of nested state\nspaces.\\\n\ndefinition K_statefun :: \"'a \\ 'b \\ 'a\" where \"K_statefun c x \\ c\"\n\nlemma K_statefun_apply [simp]: \"K_statefun c x = c\"\n by (simp add: K_statefun_def)\n\nlemma K_statefun_comp [simp]: \"(K_statefun c \\ f) = K_statefun c\"\n by (rule ext) (simp add: comp_def)\n\nlemma K_statefun_cong [cong]: \"K_statefun c x = K_statefun c x\"\n by (rule refl)\n\ndefinition lookup :: \"('v \\ 'a) \\ 'n \\ ('n \\ 'v) \\ 'a\"\n where \"lookup destr n s = destr (s n)\"\n\ndefinition update ::\n \"('v \\ 'a1) \\ ('a2 \\ 'v) \\ 'n \\ ('a1 \\ 'a2) \\ ('n \\ 'v) \\ ('n \\ 'v)\"\n where \"update destr constr n f s = s(n := constr (f (destr (s n))))\"\n\nlemma lookup_update_same:\n \"(\\v. destr (constr v) = v) \\ lookup destr n (update destr constr n f s) =\n f (destr (s n))\"\n by (simp add: lookup_def update_def)\n\nlemma lookup_update_id_same:\n \"lookup destr n (update destr' id n (K_statefun (lookup id n s')) s) =\n lookup destr n s'\"\n by (simp add: lookup_def update_def)\n\nlemma lookup_update_other:\n \"n\\m \\ lookup destr n (update destr' constr m f s) = lookup destr n s\"\n by (simp add: lookup_def update_def)\n\n\nlemma id_id_cancel: \"id (id x) = x\"\n by (simp add: id_def)\n\nlemma destr_contstr_comp_id: \"(\\v. destr (constr v) = v) \\ destr \\ constr = id\"\n by (rule ext) simp\n\n\n\nlemma block_conj_cong: \"(P \\ Q) = (P \\ Q)\"\n by simp\n\nlemma conj1_False: \"P \\ False \\ (P \\ Q) \\ False\"\n by simp\n\nlemma conj2_False: \"Q \\ False \\ (P \\ Q) \\ False\"\n by simp\n\nlemma conj_True: \"P \\ True \\ Q \\ True \\ (P \\ Q) \\ True\"\n by simp\n\nlemma conj_cong: \"P \\ P' \\ Q \\ Q' \\ (P \\ Q) \\ (P' \\ Q')\"\n by simp\n\n\nlemma update_apply: \"(update destr constr n f s x) =\n (if x=n then constr (f (destr (s n))) else s x)\"\n by (simp add: update_def)\n\nlemma ex_id: \"\\x. id x = y\"\n by (simp add: id_def)\n\nlemma swap_ex_eq:\n \"\\s. f s = x \\ True \\\n \\s. x = f s \\ True\"\n apply (rule eq_reflection)\n apply auto\n done\n\nlemmas meta_ext = eq_reflection [OF ext]\n\n(* This lemma only works if the store is welltyped:\n \"\\x. s ''n'' = (c x)\"\n or in general when c (d x) = x,\n (for example: c=id and d=id)\n *)\nlemma \"update d c n (K_statespace (lookup d n s)) s = s\"\n apply (simp add: update_def lookup_def)\n apply (rule ext)\n apply simp\n oops\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics_Framework/Statespace/StateFun.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2772827069175984}} {"text": "(* Title: Stateful_Typing.thy\n Author: Andreas Viktor Hess, DTU\n SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection \\Extending the Typing Result to Stateful Constraints\\\n\ntheory Stateful_Typing\nimports Typing_Result Stateful_Strands\nbegin\n\ntext \\Locale setup\\\nlocale stateful_typed_model = typed_model arity public Ana \\\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,'var) term \\ (('fun,'var) term list \\ ('fun,'var) term list)\"\n and \\::\"('fun,'var) term \\ ('fun,'atom::finite) term_type\"\n +\n fixes Pair::\"'fun\"\n assumes Pair_arity: \"arity Pair = 2\"\n and Ana_subst': \"\\f T \\ K M. Ana (Fun f T) = (K,M) \\ Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\,M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\nbegin\n\nlemma Ana_invar_subst'[simp]: \"Ana_invar_subst \\\"\nusing Ana_subst' unfolding Ana_invar_subst_def by force\n\ndefinition pair where\n \"pair d \\ case d of (t,t') \\ Fun Pair [t,t']\"\n\nfun tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s::\n \"(('fun,'var) term \\ ('fun,'var) term) list \\\n ('fun,'var) dbstatelist \\\n (('fun,'var) term \\ ('fun,'var) term) list list\"\nwhere\n \"tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s [] D = [[]]\"\n| \"tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) D =\n concat (map (\\d. map ((#) (pair (s,t), pair d)) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)) D)\"\n\ntext \\\n A translation/reduction \\tr\\ from stateful constraints to (lists of) \"non-stateful\" constraints.\n The output represents a finite disjunction of constraints whose models constitute exactly the\n models of the input constraint. The typing result for \"non-stateful\" constraints is later lifted\n to the stateful setting through this reduction procedure.\n\\\nfun tr::\"('fun,'var) stateful_strand \\ ('fun,'var) dbstatelist \\ ('fun,'var) strand list\"\nwhere\n \"tr [] D = [[]]\"\n| \"tr (send\\ts\\#A) D = map ((#) (send\\ts\\\\<^sub>s\\<^sub>t)) (tr A D)\"\n| \"tr (receive\\ts\\#A) D = map ((#) (receive\\ts\\\\<^sub>s\\<^sub>t)) (tr A D)\"\n| \"tr (\\ac: t \\ t'\\#A) D = map ((#) (\\ac: t \\ t'\\\\<^sub>s\\<^sub>t)) (tr A D)\"\n| \"tr (insert\\t,s\\#A) D = tr A (List.insert (t,s) D)\"\n| \"tr (delete\\t,s\\#A) D =\n concat (map (\\Di. map (\\B. (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])@B)\n (tr A [d\\D. d \\ set Di]))\n (subseqs D))\"\n| \"tr (\\ac: t \\ s\\#A) D =\n concat (map (\\B. map (\\d. \\ac: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#B) D) (tr A D))\"\n| \"tr (\\X\\\\\\: F \\\\: F'\\#A) D =\n map ((@) (map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))) (tr A D)\"\n\ntext \\Type-flaw resistance of stateful constraint steps\\\nfun tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Equality _ t t') = ((\\\\. Unifier \\ t t') \\ \\ t = \\ t')\"\n| \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks X F F') = (\n (F' = [] \\ (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F-set X. \\a. \\ (Var x) = TAtom a)) \\\n (\\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F') \\\n T = [] \\ (\\s \\ set T. s \\ Var ` set X)))\"\n| \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p _ = True\"\n\ntext \\Type-flaw resistance of stateful constraints\\\ndefinition tfr\\<^sub>s\\<^sub>s\\<^sub>t where \"tfr\\<^sub>s\\<^sub>s\\<^sub>t S \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) \\ list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S\"\n\n\n\nsubsection \\Minor Lemmata\\\nlemma pair_in_pair_image_iff:\n \"pair (s,t) \\ pair ` P \\ (s,t) \\ P\"\nunfolding pair_def by fast\n\nlemma subst_apply_pairs_pair_image_subst:\n \"pair ` set (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) = pair ` set F \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nunfolding subst_apply_pairs_def pair_def by (induct F) auto\n\nlemma Ana_subst_subterms_cases:\n fixes \\::\"('fun,'var) subst\"\n assumes t: \"t \\\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n and s: \"s \\ set (snd (Ana t))\"\n shows \"(\\u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M. t = u \\ \\ \\ s \\ set (snd (Ana u)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. t \\ \\ x)\"\nproof (cases \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\")\n case True\n then obtain u where u: \"u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M\" \"t = u \\ \\\" by moura\n show ?thesis\n proof (cases u)\n case (Var x)\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M\" using fv_subset_subterms[OF u(1)] by simp\n thus ?thesis using u(2) Var by fastforce\n next\n case (Fun f T)\n hence \"set (snd (Ana t)) = set (snd (Ana u)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using Ana_subst'[of f T _ _ \\] u(2) by (cases \"Ana u\") auto\n thus ?thesis using s u by blast\n qed\nqed (use s t subterms\\<^sub>s\\<^sub>e\\<^sub>t_subst in blast)\n\nlemma Ana_snd_subst_nth_inv:\n fixes \\::\"('fun,'var) subst\" and f ts\n defines \"R \\ snd (Ana (Fun f ts \\ \\))\"\n assumes r: \"r = R ! i\" \"i < length R\"\n shows \"r = snd (Ana (Fun f ts)) ! i \\ \\\"\nproof -\n obtain K R where \"Ana (Fun f ts) = (K,R)\" by (metis surj_pair)\n thus ?thesis using Ana_subst'[of f ts K R \\] r unfolding R_def by auto\nqed\n\nlemma Ana_snd_subst_inv:\n fixes \\::\"('fun,'var) subst\"\n assumes r: \"r \\ set (snd (Ana (Fun f ts \\ \\)))\"\n shows \"\\t \\ set (snd (Ana (Fun f ts))). r = t \\ \\\"\nproof -\n obtain K R where \"Ana (Fun f ts) = (K,R)\" by (metis surj_pair)\n thus ?thesis using Ana_subst'[of f ts K R \\] r by auto\nqed\n\n\nlemma fun_pair_eq[dest]: \"pair d = pair d' \\ d = d'\"\nproof -\n obtain t s t' s' where \"d = (t,s)\" \"d' = (t',s')\" by moura\n thus \"pair d = pair d' \\ d = d'\" unfolding pair_def by simp\nqed\n\nlemma fun_pair_subst: \"pair d \\ \\ = pair (d \\\\<^sub>p \\)\"\nusing surj_pair[of d] unfolding pair_def by force \n\nlemma fun_pair_subst_set: \"pair ` M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = pair ` (M \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\nproof\n show \"pair ` M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ pair ` (M \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using fun_pair_subst[of _ \\] by fastforce\n\n show \"pair ` (M \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ pair ` M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n proof\n fix t assume t: \"t \\ pair ` (M \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n then obtain p where p: \"p \\ M\" \"t = pair (p \\\\<^sub>p \\)\" by blast\n thus \"t \\ pair ` M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" using fun_pair_subst[of p \\] by force\n qed\nqed\n\nlemma fun_pair_eq_subst: \"pair d \\ \\ = pair d' \\ \\ \\ d \\\\<^sub>p \\ = d' \\\\<^sub>p \\\"\nby (metis fun_pair_subst fun_pair_eq[of \"d \\\\<^sub>p \\\" \"d' \\\\<^sub>p \\\"])\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_pair_image_cons[simp]:\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (x#S) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (send\\ts\\#S) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (receive\\ts\\#S) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\ac: t \\ t'\\#S) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (insert\\t,s\\#S) = {pair (t,s)} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (delete\\t,s\\#S) = {pair (t,s)} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\ac: t \\ s\\#S) = {pair (t,s)} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\X\\\\\\: F \\\\: G\\#S) = pair ` set G \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\nunfolding setops\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_pair_image_subst_cons[simp]:\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (x#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (x \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (send\\ts\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (receive\\ts\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\ac: t \\ t'\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (insert\\t,s\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = {pair (t,s) \\ \\} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (delete\\t,s\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = {pair (t,s) \\ \\} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\ac: t \\ s\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = {pair (t,s) \\ \\} \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\X\\\\\\: F \\\\: G\\#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) =\n pair ` set (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing subst_sst_cons[of _ S \\] unfolding setops\\<^sub>s\\<^sub>s\\<^sub>t_def pair_def by auto\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs: \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ \\s s'. t = pair (s,s')\"\nproof (induction A)\n case (Cons a A) thus ?case\n by (cases a) (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma fun_pair_wf\\<^sub>t\\<^sub>r\\<^sub>m: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t' \\ wf\\<^sub>t\\<^sub>r\\<^sub>m (pair (t,t'))\"\nusing Pair_arity unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def pair_def by auto\n\nlemma wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_pairs: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (pair ` set F)\"\nusing fun_pair_wf\\<^sub>t\\<^sub>r\\<^sub>m by blast\n\nlemma wf_fun_pair_ineqs_map:\n assumes \"wf\\<^sub>s\\<^sub>t X A\"\n shows \"wf\\<^sub>s\\<^sub>t X (map (\\d. \\Y\\\\\\: [(pair (t, s), pair d)]\\\\<^sub>s\\<^sub>t) D@A)\"\nusing assms by (induct D) auto\n\nlemma wf_fun_pair_negchecks_map:\n assumes \"wf\\<^sub>s\\<^sub>t X A\"\n shows \"wf\\<^sub>s\\<^sub>t X (map (\\G. \\Y\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) M@A)\"\nusing assms by (induct M) auto\n\nlemma wf_fun_pair_eqs_ineqs_map:\n fixes A::\"('fun,'var) strand\"\n assumes \"wf\\<^sub>s\\<^sub>t X A\" \"Di \\ set (subseqs D)\" \"\\(t,t') \\ set D. fv t \\ fv t' \\ X\"\n shows \"wf\\<^sub>s\\<^sub>t X ((map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])@A)\"\nproof -\n let ?c1 = \"map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di\"\n let ?c2 = \"map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]\"\n have 1: \"wf\\<^sub>s\\<^sub>t X (?c2@A)\" using wf_fun_pair_ineqs_map[OF assms(1)] by simp\n have 2: \"\\(t,t') \\ set Di. fv t \\ fv t' \\ X\" \n using assms(2,3) by (meson contra_subsetD subseqs_set_subset(1))\n have \"wf\\<^sub>s\\<^sub>t X (?c1@B)\" when \"wf\\<^sub>s\\<^sub>t X B\" for B::\"('fun,'var) strand\"\n using 2 that by (induct Di) auto\n thus ?thesis using 1 by simp\nqed\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_wt_subst_ex:\n assumes \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and t: \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\s \\. s \\ trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\nusing t\nproof (induction S)\n case (Cons s S) thus ?case\n proof (cases \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\")\n case False\n hence \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n using Cons.prems trms\\<^sub>s\\<^sub>s\\<^sub>t_subst_cons[of s S \\]\n by auto\n then obtain u where u: \"u \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s\" \"t = u \\ rm_vars (set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)) \\\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst'' by blast\n thus ?thesis\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_subst_cons[of s S \\]\n wt_subst_rm_vars[OF \\(1), of \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)\"]\n wf_trms_subst_rm_vars'[OF \\(2), of \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)\"]\n by fastforce\n qed auto\nqed simp\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_wt_subst_ex:\n assumes \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and t: \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\s \\. s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\nusing t\nproof (induction S)\n case (Cons x S) thus ?case\n proof (cases x)\n case (Insert t' s)\n hence \"t = pair (t',s) \\ \\ \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using Cons.prems subst_sst_cons[of _ S \\]\n unfolding pair_def by (force simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis\n using Insert Cons.IH \\ by (cases \"t = pair (t', s) \\ \\\") (fastforce, auto)\n next\n case (Delete t' s)\n hence \"t = pair (t',s) \\ \\ \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using Cons.prems subst_sst_cons[of _ S \\]\n unfolding pair_def by (force simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis\n using Delete Cons.IH \\ by (cases \"t = pair (t', s) \\ \\\") (fastforce, auto)\n next\n case (InSet ac t' s)\n hence \"t = pair (t',s) \\ \\ \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using Cons.prems subst_sst_cons[of _ S \\]\n unfolding pair_def by (force simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis\n using InSet Cons.IH \\ by (cases \"t = pair (t', s) \\ \\\") (fastforce, auto)\n next\n case (NegChecks X F F')\n hence \"t \\ pair ` set (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using Cons.prems subst_sst_cons[of _ S \\]\n unfolding pair_def by (force simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis\n proof\n assume \"t \\ pair ` set (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\n then obtain s where s: \"t = s \\ rm_vars (set X) \\\" \"s \\ pair ` set F'\"\n using subst_apply_pairs_pair_image_subst[of F' \"rm_vars (set X) \\\"] by auto\n thus ?thesis\n using NegChecks setops\\<^sub>s\\<^sub>s\\<^sub>t_pair_image_cons(8)[of X F F' S]\n wt_subst_rm_vars[OF \\(1), of \"set X\"]\n wf_trms_subst_rm_vars'[OF \\(2), of \"set X\"]\n by fast\n qed (use Cons.IH in auto)\n qed (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def subst_sst_cons[of _ S \\])\nqed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s:\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\"\nproof -\n show \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n proof (induction A)\n case (Cons a A)\n hence 0: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\" by auto\n thus ?case\n proof (cases a)\n case (NegChecks X F F')\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F')\" using 0 by simp\n thus ?thesis using NegChecks wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_pairs[of F'] 0 by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def dest: fun_pair_wf\\<^sub>t\\<^sub>r\\<^sub>m)\n qed (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\" by fast\nqed\n\nlemma SMP_MP_split:\n assumes \"t \\ SMP M\"\n and M: \"\\m \\ M. is_Fun m\"\n shows \"(\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\n t \\ SMP ((subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ \\((set \\ fst \\ Ana) ` M)) - M)\"\n (is \"?P t \\ ?Q t\")\nusing assms(1)\nproof (induction t rule: SMP.induct)\n case (MP t)\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" \"M \\\\<^sub>s\\<^sub>e\\<^sub>t Var = M\" by simp_all\n thus ?case using MP by metis\nnext\n case (Subterm t t')\n show ?case using Subterm.IH\n proof\n assume \"?P t\"\n then obtain s \\ where s: \"s \\ M\" \"t = s \\ \\\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" by moura\n then obtain f T where fT: \"s = Fun f T\" using M by fast\n\n have \"(\\s'. s' \\ s \\ t' = s' \\ \\) \\ (\\x \\ fv s. t' \\ \\ x)\"\n using subterm_subst_unfold[OF Subterm.hyps(2)[unfolded s(2)]] by blast\n thus ?thesis\n proof\n assume \"\\s'. s' \\ s \\ t' = s' \\ \\\"\n then obtain s' where s': \"s' \\ s\" \"t' = s' \\ \\\" by moura\n show ?thesis\n proof (cases \"s' \\ M\")\n case True thus ?thesis using s' \\ by blast\n next\n case False\n hence \"s' \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ \\((set \\ fst \\ Ana) ` M)) - M\" using s'(1) s(1) by force\n thus ?thesis using SMP.Substitution[OF SMP.MP[of s'] \\] s' by presburger\n qed\n next\n assume \"\\x \\ fv s. t' \\ \\ x\"\n then obtain x where x: \"x \\ fv s\" \"t' \\ \\ x\" by moura\n have \"Var x \\ M\" using M by blast\n hence \"Var x \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ \\((set \\ fst \\ Ana) ` M)) - M\"\n using s(1) var_is_subterm[OF x(1)] by blast\n hence \"\\ x \\ SMP ((subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ \\((set \\ fst \\ Ana) ` M)) - M)\"\n using SMP.Substitution[OF SMP.MP[of \"Var x\"] \\] by auto\n thus ?thesis using SMP.Subterm x(2) by presburger\n qed\n qed (metis SMP.Subterm[OF _ Subterm.hyps(2)])\nnext\n case (Substitution t \\)\n show ?case using Substitution.IH\n proof\n assume \"?P t\"\n then obtain \\ where \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by moura\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\" \"t \\ \\ \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t (\\ \\\\<^sub>s \\)\"\n using wt_subst_compose[of \\, OF _ Substitution.hyps(2)]\n wf_trm_subst_compose[of \\ _ \\, OF _ wf_trm_subst_rangeD[OF Substitution.hyps(3)]]\n wf_trm_subst_range_iff\n by (argo, blast, auto)\n thus ?thesis by blast\n next\n assume \"?Q t\" thus ?thesis using SMP.Substitution[OF _ Substitution.hyps(2,3)] by meson\n qed\nnext\n case (Ana t K T k)\n show ?case using Ana.IH\n proof\n assume \"?P t\"\n then obtain \\ where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by moura\n then obtain s where s: \"s \\ M\" \"t = s \\ \\\" by auto\n then obtain f S where fT: \"s = Fun f S\" using M by (cases s) auto\n obtain K' T' where s_Ana: \"Ana s = (K', T')\" by (metis surj_pair)\n hence \"set K = set K' \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"set T = set T' \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using Ana_subst'[of f S K' T'] fT Ana.hyps(2) s(2) by auto\n then obtain k' where k': \"k' \\ set K'\" \"k = k' \\ \\\" using Ana.hyps(3) by fast\n show ?thesis\n proof (cases \"k' \\ M\")\n case True thus ?thesis using k' \\(1,2) by blast\n next\n case False\n hence \"k' \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ \\((set \\ fst \\ Ana) ` M)) - M\" using k'(1) s_Ana s(1) by force\n thus ?thesis using SMP.Substitution[OF SMP.MP[of k'] \\(1,2)] k'(2) by presburger\n qed\n next\n assume \"?Q t\" thus ?thesis using SMP.Ana[OF _ Ana.hyps(2,3)] by meson\n qed\nqed\n\nlemma setops_subterm_trms:\n assumes t: \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\n and s: \"s \\ t\"\n shows \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nproof -\n obtain u u' where u: \"pair (u,u') \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\" \"t = pair (u,u')\"\n using t setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs[of _ S] by blast\n hence \"s \\ u \\ s \\ u'\" using s unfolding pair_def by auto\n thus ?thesis using u setops\\<^sub>s\\<^sub>s\\<^sub>t_member_iff[of u u' S] unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by force\nqed\n\nlemma setops_subterms_cases:\n assumes t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n shows \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S) \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\"\nproof -\n obtain s s' where s: \"pair (s,s') \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\" \"t \\ pair (s,s')\"\n using t setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs[of _ S] by blast\n hence \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\ t \\ s \\ t \\ s'\" unfolding pair_def by auto\n thus ?thesis using s setops\\<^sub>s\\<^sub>s\\<^sub>t_member_iff[of s s' S] unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by force\nqed\n\nlemma setops_SMP_cases:\n assumes \"t \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n and \"\\p. Ana (pair p) = ([], [])\"\n shows \"(\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nproof -\n have 0: \"\\((set \\ fst \\ Ana) ` pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) = {}\"\n proof (induction S)\n case (Cons x S) thus ?case\n using assms(2) by (cases x) (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n \n have 1: \"\\m \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S. is_Fun m\"\n proof (induction S)\n case (Cons x S) thus ?case\n unfolding pair_def by (cases x) (auto simp add: assms(2) setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n have 2:\n \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) \\\n \\((set \\ fst \\ Ana) ` (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)) - pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\n \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n using 0 setops_subterms_cases by fast\n\n show ?thesis\n using SMP_MP_split[OF assms(1) 1] SMP_mono[OF 2] SMP_subterms_eq[of \"trms\\<^sub>s\\<^sub>s\\<^sub>t S\"]\n by blast\nqed\n\nlemma constraint_model_priv_const_in_constr_prefix:\n assumes A: \"wf\\<^sub>s\\<^sub>s\\<^sub>t A\"\n and I: \"I \\\\<^sub>s A\"\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range I)\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\"\n and c: \"\\public c\"\n \"arity c = 0\"\n \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n shows \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing const_subterms_subst_cases[OF c(3)]\nproof\n assume \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>s\\<^sub>s\\<^sub>t A\" thus ?thesis using ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset by blast \nnext\n assume \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t A). x \\ subst_domain I \\ Fun c [] \\ I x\"\n then obtain x where x: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t A)\" \"Fun c [] \\ I x\" by blast\n \n have 0: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (I x)\" \"wf'\\<^sub>s\\<^sub>s\\<^sub>t {} A\" \"Fun c [] \\ I = Fun c []\"\n using I A by simp_all\n\n have 1: \"x \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n using x(1) in_ik\\<^sub>s\\<^sub>s\\<^sub>t_iff[of _ A] unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n hence 2: \"\\v \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t A. Fun c [] \\ I \\ I v\" using 0(3) x(2) by force\n\n\n obtain A\\<^sub>p\\<^sub>r\\<^sub>e A\\<^sub>s\\<^sub>u\\<^sub>f where A': \"\\(\\w \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e. Fun c [] \\ I w)\"\n \"(\\ts. A = A\\<^sub>p\\<^sub>r\\<^sub>e@send\\ts\\#A\\<^sub>s\\<^sub>u\\<^sub>f \\ Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t set ts \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\\n (\\s u. A = A\\<^sub>p\\<^sub>r\\<^sub>e@\\assign: s \\ u\\#A\\<^sub>s\\<^sub>u\\<^sub>f \\ Fun c [] \\ s \\ I \\ \\(Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t (I ` fv u))) \\\n (\\s u. A = A\\<^sub>p\\<^sub>r\\<^sub>e@\\assign: s \\ u\\#A\\<^sub>s\\<^sub>u\\<^sub>f \\ (Fun c [] \\ s \\ I \\ Fun c [] \\ u \\ I))\"\n (is \"?X \\ ?Y \\ ?Z\")\n using wf\\<^sub>s\\<^sub>s\\<^sub>t_strand_first_Send_var_split[OF 0(2) 2] by force\n\n show ?thesis using A'(2)\n proof (elim disjE)\n assume ?X\n then obtain ts where ts: \"A = A\\<^sub>p\\<^sub>r\\<^sub>e@send\\ts\\#A\\<^sub>s\\<^sub>u\\<^sub>f\" \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t set ts \\\\<^sub>s\\<^sub>e\\<^sub>t I\" by blast\n hence \"I \\\\<^sub>s (A\\<^sub>p\\<^sub>r\\<^sub>e@[send\\ts\\])\"\n using I(1) strand_sem_append_stateful[of \"{}\" \"{}\" \"A\\<^sub>p\\<^sub>r\\<^sub>e@[send\\ts\\]\" A\\<^sub>s\\<^sub>u\\<^sub>f I] by auto\n hence \"(ik\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e) \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ t \\ I\" when \"t \\ set ts\" for t\n using that strand_sem_append_stateful[of \"{}\" \"{}\" A\\<^sub>p\\<^sub>r\\<^sub>e \"[send\\ts\\]\" I]\n strand_sem_stateful.simps(2)[of _ _ ts \"[]\"]\n unfolding list_all_iff by force\n hence \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n using ts(2) c(1) private_fun_deduct_in_ik by fast\n hence \"Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e\"\n using A'(1) const_subterms_subst_cases[of c I \"ik\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e\"]\n ik\\<^sub>s\\<^sub>s\\<^sub>t_fv_subset_wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t[of A\\<^sub>p\\<^sub>r\\<^sub>e]\n by fast\n thus ?thesis\n using ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset[of \"A\\<^sub>p\\<^sub>r\\<^sub>e\"] unfolding ts(1) by fastforce\n next\n assume ?Y\n then obtain s u where su:\n \"A = A\\<^sub>p\\<^sub>r\\<^sub>e@\\assign: s \\ u\\#A\\<^sub>s\\<^sub>u\\<^sub>f\" \"Fun c [] \\ s \\ I\" \"\\(Fun c [] \\\\<^sub>s\\<^sub>e\\<^sub>t I ` fv u)\"\n by fast\n hence \"s \\ I = u \\ I\"\n using I(1) strand_sem_append_stateful[of \"{}\" \"{}\" \"A\\<^sub>p\\<^sub>r\\<^sub>e@[\\assign: s \\ u\\]\" A\\<^sub>s\\<^sub>u\\<^sub>f I]\n strand_sem_append_stateful[of _ _ A\\<^sub>p\\<^sub>r\\<^sub>e \"[\\assign: s \\ u\\]\" I]\n by auto\n hence \"Fun c [] \\ u\" using su(2,3) const_subterm_subst_var_obtain[of c u I] by auto\n thus ?thesis unfolding su(1) by auto\n next\n assume ?Z\n then obtain s u where su:\n \"A = A\\<^sub>p\\<^sub>r\\<^sub>e@\\assign: s \\ u\\#A\\<^sub>s\\<^sub>u\\<^sub>f\" \"Fun c [] \\ s \\ I \\ Fun c [] \\ u \\ I\"\n by fast\n hence \"(s,u) \\\\<^sub>p I \\ dbupd\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e I {}\"\n using I(1) strand_sem_append_stateful[of \"{}\" \"{}\" \"A\\<^sub>p\\<^sub>r\\<^sub>e@[\\assign: s \\ u\\]\" A\\<^sub>s\\<^sub>u\\<^sub>f I]\n strand_sem_append_stateful[of _ _ A\\<^sub>p\\<^sub>r\\<^sub>e \"[\\assign: s \\ u\\]\" I]\n unfolding db\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n then obtain s' u' where su': \"insert\\s',u'\\ \\ set A\\<^sub>p\\<^sub>r\\<^sub>e\" \"s \\ I = s' \\ I\" \"u \\ I = u' \\ I\"\n using db\\<^sub>s\\<^sub>s\\<^sub>t_in_cases[of \"s \\ I\" \"u \\ I\" A\\<^sub>p\\<^sub>r\\<^sub>e I \"[]\"] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of A\\<^sub>p\\<^sub>r\\<^sub>e I \"[]\"]\n by fastforce\n\n have \"fv s' \\ fv u' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t A\\<^sub>p\\<^sub>r\\<^sub>e\"\n using su'(1) unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n hence \"Fun c [] \\ s' \\ Fun c [] \\ u'\"\n using su(2) A'(1) su'(2,3)\n const_subterm_subst_cases[of c s' I]\n const_subterm_subst_cases[of c u' I]\n by auto\n thus ?thesis using su'(1) unfolding su(1) by force\n qed\nqed\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_empty_case:\n assumes \"tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D = []\"\n shows \"D = []\" \"F \\ []\"\nproof -\n show \"F \\ []\" using assms by (auto intro: ccontr)\n\n have \"tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F (a#A) \\ []\" for a A\n by (induct F \"a#A\" rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct) fastforce+\n thus \"D = []\" using assms by (cases D) simp_all\nqed\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_elem_length_eq:\n assumes \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\"\n shows \"length G = length F\" \nusing assms by (induct F D arbitrary: G rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct) auto\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_index:\n assumes \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"i < length F\"\n shows \"\\d \\ set D. G ! i = (pair (F ! i), pair d)\"\nusing assms\nproof (induction F D arbitrary: i G rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D)\n obtain d G' where G:\n \"d \\ set D\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\"\n \"G = (pair (s,t), pair d)#G'\"\n using \"2.prems\"(1) by moura\n show ?case\n using \"2.IH\"[OF G(1,2)] \"2.prems\"(2) G(1,3)\n by (cases i) auto\nqed simp\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_cons:\n assumes \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"d \\ set D\"\n shows \"(pair (s,t), pair d)#G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) D)\"\nusing assms by auto\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_has_pair_lists:\n assumes \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"g \\ set G\"\n shows \"\\f \\ set F. \\d \\ set D. g = (pair f, pair d)\"\nusing assms\nproof (induction F D arbitrary: G rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D)\n obtain d G' where G:\n \"d \\ set D\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\"\n \"G = (pair (s,t), pair d)#G'\"\n using \"2.prems\"(1) by moura\n show ?case\n using \"2.IH\"[OF G(1,2)] \"2.prems\"(2) G(1,3)\n by (cases \"g \\ set G'\") auto\nqed simp\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_pair_lists:\n assumes \"f \\ set F\" \"d \\ set D\"\n shows \"\\G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D). (pair f, pair d) \\ set G\"\n (is \"?P F D f d\")\nproof -\n have \"\\f \\ set F. \\d \\ set D. ?P F D f d\"\n proof (induction F D rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D)\n hence IH: \"\\f \\ set F. \\d \\ set D. ?P F D f d\" by metis\n moreover have \"\\d \\ set D. ?P ((s,t)#F) D (s,t) d\"\n proof\n fix d assume d: \"d \\ set D\"\n then obtain G where G: \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\"\n using tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_empty_case(1) by force\n hence \"(pair (s, t), pair d)#G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) D)\"\n using d by auto\n thus \"?P ((s,t)#F) D (s,t) d\" using d G by auto\n qed\n ultimately show ?case by fastforce\n qed simp\n thus ?thesis by (metis assms)\nqed\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_db_append_subset:\n \"set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D) \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F (D@E))\" (is ?A)\n \"set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F E) \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F (D@E))\" (is ?B)\nproof -\n show ?A\n proof (induction F D rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D)\n show ?case\n proof\n fix G assume \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) D)\"\n then obtain d G' where G':\n \"d \\ set D\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"G = (pair (s,t), pair d)#G'\"\n by moura\n have \"d \\ set (D@E)\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F (D@E))\" using \"2.IH\"[OF G'(1)] G'(1,2) by auto\n thus \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) (D@E))\" using G'(3) by auto\n qed\n qed simp\n\n show ?B\n proof (induction F E rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F E)\n show ?case\n proof\n fix G assume \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) E)\"\n then obtain d G' where G':\n \"d \\ set E\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F E)\" \"G = (pair (s,t), pair d)#G'\"\n by moura\n have \"d \\ set (D@E)\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F (D@E))\" using \"2.IH\"[OF G'(1)] G'(1,2) by auto\n thus \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F) (D@E))\" using G'(3) by auto\n qed\n qed simp\nqed\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_trms_subset:\n \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D) \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\ pair ` set F \\ pair ` set D\"\nproof (induction F D arbitrary: G rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D G)\n obtain d G' where G:\n \"d \\ set D\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"G = (pair (s,t), pair d)#G'\"\n using \"2.prems\"(1) by moura\n \n show ?case using \"2.IH\"[OF G(1,2)] G(1,3) by auto\nqed simp\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_trms_subset':\n \"\\(trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ` set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)) \\ pair ` set F \\ pair ` set D\"\nusing tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_trms_subset by blast\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_vars_subset:\n \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s D\"\nproof (induction F D arbitrary: G rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F D G)\n obtain d G' where G:\n \"d \\ set D\" \"G' \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)\" \"G = (pair (s,t), pair d)#G'\"\n using \"2.prems\"(1) by moura\n \n show ?case using \"2.IH\"[OF G(1,2)] G(1,3) unfolding pair_def by auto\nqed simp\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_vars_subset': \"\\(fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ` set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F D)) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s D\"\nusing tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_vars_subset[of _ F D] by blast\n\n\nlemma tr_trms_subset:\n \"A' \\ set (tr A D) \\ trms\\<^sub>s\\<^sub>t A' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\"\nproof (induction A D arbitrary: A' rule: tr.induct)\n case 1 thus ?case by simp\nnext\n case (2 t A D)\n then obtain A'' where A'': \"A' = send\\t\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\" by moura\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\" by (metis \"2.IH\")\n thus ?case using A'' by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nnext\n case (3 t A D)\n then obtain A'' where A'': \"A' = receive\\t\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\" by moura\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\" by (metis \"3.IH\")\n thus ?case using A'' by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nnext\n case (4 ac t t' A D)\n then obtain A'' where A'': \"A' = \\ac: t \\ t'\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\" by moura\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\" by (metis \"4.IH\")\n thus ?case using A'' by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nnext\n case (5 t s A D)\n hence \"A' \\ set (tr A (List.insert (t,s) D))\" by simp\n hence \"trms\\<^sub>s\\<^sub>t A' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set (List.insert (t, s) D)\"\n by (metis \"5.IH\")\n thus ?case by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nnext\n case (6 t s A D)\n from 6 obtain Di A'' B C where A'':\n \"Di \\ set (subseqs D)\" \"A'' \\ set (tr A [d\\D. d \\ set Di])\" \"A' = (B@C)@A''\"\n \"B = map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di\"\n \"C = map (\\d. Inequality [] [(pair (t,s) , pair d)]) [d\\D. d \\ set Di]\"\n by moura\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set [d\\D. d \\ set Di]\"\n by (metis \"6.IH\")\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) \\ pair ` set D\"\n by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n moreover have \"trms\\<^sub>s\\<^sub>t (B@C) \\ insert (pair (t,s)) (pair ` set D)\"\n using A''(4,5) subseqs_set_subset[OF A''(1)] by auto\n moreover have \"pair (t,s) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A)\" by (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n ultimately show ?case using A''(3) trms\\<^sub>s\\<^sub>t_append[of \"B@C\" A'] by auto\nnext\n case (7 ac t s A D)\n from 7 obtain d A'' where A'':\n \"d \\ set D\" \"A'' \\ set (tr A D)\"\n \"A' = \\ac: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#A''\"\n by moura\n hence \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\" by (metis \"7.IH\")\n moreover have \"trms\\<^sub>s\\<^sub>t A' = {pair (t,s), pair d} \\ trms\\<^sub>s\\<^sub>t A''\"\n using A''(1,3) by auto\n ultimately show ?case using A''(1) by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nnext\n case (8 X F F' A D)\n from 8 obtain A'' where A'':\n \"A'' \\ set (tr A D)\" \"A' = (map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))@A''\"\n by moura\n\n define B where \"B \\ \\(trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ` set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))\"\n\n have \"trms\\<^sub>s\\<^sub>t A'' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\" by (metis A''(1) \"8.IH\")\n hence \"trms\\<^sub>s\\<^sub>t A' \\ B \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D\"\n using A'' B_def by auto\n moreover have \"B \\ pair ` set F' \\ pair ` set D\"\n using tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_trms_subset'[of F' D] B_def by simp\n moreover have \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (\\X\\\\\\: F \\\\: F'\\#A) = pair ` set F' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A\"\n by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n ultimately show ?case by auto\nqed\n\nlemma tr_vars_subset:\n assumes \"A' \\ set (tr A D)\"\n shows \"fv\\<^sub>s\\<^sub>t A' \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ (\\(t,t') \\ set D. fv t \\ fv t')\" (is ?P)\n and \"bvars\\<^sub>s\\<^sub>t A' \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A\" (is ?Q)\nproof -\n show ?P using assms\n proof (induction A arbitrary: A' D rule: strand_sem_stateful_induct)\n case (ConsIn A' D ac t s A)\n then obtain A'' d where *:\n \"d \\ set D\" \"A' = \\ac: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#A''\"\n \"A'' \\ set (tr A D)\"\n by moura\n hence \"fv\\<^sub>s\\<^sub>t A'' \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ (\\(t,t')\\set D. fv t \\ fv t')\" by (metis ConsIn.IH)\n thus ?case using * unfolding pair_def by auto\n next\n case (ConsDel A' D t s A)\n define Dfv where \"Dfv \\ \\D::('fun,'var) dbstatelist. (\\(t,t')\\set D. fv t \\ fv t')\"\n define fltD where \"fltD \\ \\Di. filter (\\d. d \\ set Di) D\"\n define constr where\n \"constr \\ \\Di. (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) (fltD Di))\"\n from ConsDel obtain A'' Di where *:\n \"Di \\ set (subseqs D)\" \"A' = (constr Di)@A''\" \"A'' \\ set (tr A (fltD Di))\"\n unfolding constr_def fltD_def by moura\n hence \"fv\\<^sub>s\\<^sub>t A'' \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ Dfv (fltD Di)\"\n unfolding Dfv_def constr_def fltD_def by (metis ConsDel.IH)\n moreover have \"Dfv (fltD Di) \\ Dfv D\" unfolding Dfv_def constr_def fltD_def by auto\n moreover have \"Dfv Di \\ Dfv D\"\n using subseqs_set_subset(1)[OF *(1)] unfolding Dfv_def constr_def fltD_def by fast\n moreover have \"fv\\<^sub>s\\<^sub>t (constr Di) \\ fv t \\ fv s \\ (Dfv Di \\ Dfv (fltD Di))\"\n unfolding Dfv_def constr_def fltD_def pair_def by auto\n moreover have \"fv\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) = fv t \\ fv s \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A\" by auto\n moreover have \"fv\\<^sub>s\\<^sub>t A' = fv\\<^sub>s\\<^sub>t (constr Di) \\ fv\\<^sub>s\\<^sub>t A''\" using * by force\n ultimately have \"fv\\<^sub>s\\<^sub>t A' \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) \\ Dfv D\" by auto\n thus ?case unfolding Dfv_def fltD_def constr_def by simp\n next\n case (ConsNegChecks A' D X F F' A)\n then obtain A'' where A'':\n \"A'' \\ set (tr A D)\" \"A' = (map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))@A''\"\n by moura\n\n define B where \"B \\ \\(fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ` set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))\"\n\n have 1: \"fv\\<^sub>s\\<^sub>t (map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D)) \\ (B \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) - set X\"\n unfolding B_def by auto\n\n have 2: \"B \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s D\"\n using tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_vars_subset'[of F' D]\n unfolding B_def by simp\n\n have \"fv\\<^sub>s\\<^sub>t A' \\ ((fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s D \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) - set X) \\ fv\\<^sub>s\\<^sub>t A''\"\n using 1 2 A''(2) by fastforce\n thus ?case using ConsNegChecks.IH[OF A''(1)] by auto\n qed fastforce+\n\n show ?Q using assms by (induct A arbitrary: A' D rule: strand_sem_stateful_induct) fastforce+\nqed\n\nlemma tr_vars_disj:\n assumes \"A' \\ set (tr A D)\" \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n and \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n shows \"fv\\<^sub>s\\<^sub>t A' \\ bvars\\<^sub>s\\<^sub>t A' = {}\"\nusing assms tr_vars_subset by fast\n\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_alt_def:\n \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S =\n ((\\ac t t'. Equality ac t t' \\ set S \\ (\\\\. Unifier \\ t t') \\ \\ t = \\ t') \\\n (\\X F F'. NegChecks X F F' \\ set S \\ (\n (F' = [] \\ (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F-set X. \\a. \\ (Var x) = TAtom a)) \\\n (\\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F') \\\n T = [] \\ (\\s \\ set T. s \\ Var ` set X)))))\"\n (is \"?P S = ?Q S\")\nproof\n show \"?P S \\ ?Q S\"\n proof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\n qed simp\n\n show \"?Q S \\ ?P S\"\n proof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\n qed simp\nqed\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_Nil[simp]: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t []\"\nby (simp add: tfr\\<^sub>s\\<^sub>s\\<^sub>t_def setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_append: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ tfr\\<^sub>s\\<^sub>s\\<^sub>t A\"\nproof -\n assume assms: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n let ?M = \"trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A\"\n let ?N = \"trms\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n let ?P = \"\\t t'. \\x \\ fv t \\ fv t'. \\a. \\ (Var x) = Var a\"\n let ?Q = \"\\X t t'. X = [] \\ (\\x \\ (fv t \\ fv t')-set X. \\a. \\ (Var x) = Var a)\"\n have *: \"SMP ?M - Var`\\ \\ SMP ?N - Var`\\\" \"?M \\ ?N\"\n using SMP_mono[of ?M ?N] setops\\<^sub>s\\<^sub>s\\<^sub>t_append[of A B]\n by auto\n { fix s t assume **: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?N\" \"s \\ SMP ?M - Var`\\\" \"t \\ SMP ?M - Var`\\\" \"(\\\\. Unifier \\ s t)\"\n hence \"s \\ SMP ?N - Var`\\\" \"t \\ SMP ?N - Var`\\\" using * by auto\n hence \"\\ s = \\ t\" using **(1,4) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n } moreover have \"\\t \\ ?N. wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\t \\ ?M. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using * by blast\n ultimately have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?N \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t ?M\" unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?M\" using assms unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by metis\n thus \"tfr\\<^sub>s\\<^sub>s\\<^sub>t A\" using assms unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by simp\nqed\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_append': \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ tfr\\<^sub>s\\<^sub>s\\<^sub>t B\"\nproof -\n assume assms: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n let ?M = \"trms\\<^sub>s\\<^sub>s\\<^sub>t B \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t B\"\n let ?N = \"trms\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n let ?P = \"\\t t'. \\x \\ fv t \\ fv t'. \\a. \\ (Var x) = Var a\"\n let ?Q = \"\\X t t'. X = [] \\ (\\x \\ (fv t \\ fv t')-set X. \\a. \\ (Var x) = Var a)\"\n have *: \"SMP ?M - Var`\\ \\ SMP ?N - Var`\\\" \"?M \\ ?N\"\n using SMP_mono[of ?M ?N] setops\\<^sub>s\\<^sub>s\\<^sub>t_append[of A B]\n by auto\n { fix s t assume **: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?N\" \"s \\ SMP ?M - Var`\\\" \"t \\ SMP ?M - Var`\\\" \"(\\\\. Unifier \\ s t)\"\n hence \"s \\ SMP ?N - Var`\\\" \"t \\ SMP ?N - Var`\\\" using * by auto\n hence \"\\ s = \\ t\" using **(1,4) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n } moreover have \"\\t \\ ?N. wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\t \\ ?M. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using * by blast\n ultimately have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?N \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t ?M\" unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ?M\" using assms unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by metis\n thus \"tfr\\<^sub>s\\<^sub>s\\<^sub>t B\" using assms unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by simp\nqed\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_cons: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\ tfr\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing tfr\\<^sub>s\\<^sub>s\\<^sub>t_append'[of \"[a]\" A] by simp\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst:\n assumes s: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s) \\ range_vars \\ = {}\"\n shows \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\nproof (cases s)\n case (Equality a t t')\n thus ?thesis\n proof (cases \"\\\\. Unifier \\ (t \\ \\) (t' \\ \\)\")\n case True\n hence \"\\\\. Unifier \\ t t'\" by (metis subst_subst_compose[of _ \\])\n moreover have \"\\ t = \\ (t \\ \\)\" \"\\ t' = \\ (t' \\ \\)\" by (metis wt_subst_trm''[OF assms(2)])+\n ultimately have \"\\ (t \\ \\) = \\ (t' \\ \\)\" using s Equality by simp\n thus ?thesis using Equality True by simp\n qed simp\nnext\n case (NegChecks X F G)\n let ?P = \"\\F G. G = [] \\ (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F-set X. \\a. \\ (Var x) = TAtom a)\"\n let ?Q = \"\\F G. \\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set G) \\\n T = [] \\ (\\s \\ set T. s \\ Var ` set X)\"\n let ?\\ = \"rm_vars (set X) \\\"\n\n have \"?P F G \\ ?Q F G\" using NegChecks assms(1) by simp\n hence \"?P (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) \\ ?Q (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\)\"\n proof\n assume *: \"?P F G\"\n have \"G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\ = []\" using * by simp\n moreover have \"\\a. \\ (Var x) = TAtom a\" when x: \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) - set X\" for x\n proof -\n obtain t t' where t: \"(t,t') \\ set (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\)\" \"x \\ fv t \\ fv t' - set X\"\n using x(1) by auto\n then obtain u u' where u: \"(u,u') \\ set F\" \"u \\ ?\\ = t\" \"u' \\ ?\\ = t'\"\n unfolding subst_apply_pairs_def by auto\n obtain y where y: \"y \\ fv u \\ fv u' - set X\" \"x \\ fv (?\\ y)\"\n using t(2) u(2,3) rm_vars_fv_obtain by fast\n hence a: \"\\a. \\ (Var y) = TAtom a\" using u * by auto\n \n have a': \"\\ (Var y) = \\ (?\\ y)\"\n using wt_subst_trm''[OF wt_subst_rm_vars[OF \\(1), of \"set X\"], of \"Var y\"]\n by simp\n\n have \"(\\z. ?\\ y = Var z) \\ (\\c. ?\\ y = Fun c [])\"\n proof (cases \"?\\ y \\ subst_range \\\")\n case True thus ?thesis\n using a a' \\(2) const_type_inv_wf\n by (cases \"?\\ y\") fastforce+\n qed fastforce\n hence \"?\\ y = Var x\" using y(2) by fastforce\n hence \"\\ (Var x) = \\ (Var y)\" using a' by simp\n thus ?thesis using a by presburger\n qed\n ultimately show ?thesis by simp\n next\n assume *: \"?Q F G\"\n have **: \"set X \\ range_vars ?\\ = {}\"\n using \\(3) NegChecks rm_vars_img_fv_subset[of \"set X\" \\] by auto\n have \"?Q (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\)\"\n using ineq_subterm_inj_cond_subst[OF ** *]\n trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst[of F \"rm_vars (set X) \\\"]\n subst_apply_pairs_pair_image_subst[of G \"rm_vars (set X) \\\"]\n by (metis (no_types, lifting) image_Un)\n thus ?thesis by simp\n qed\n thus ?thesis using NegChecks by simp\nqed simp_all\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_all_wt_subst_apply:\n assumes S: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ range_vars \\ = {}\"\n shows \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nproof -\n have \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s) \\ range_vars \\ = {}\" when \"s \\ set S\" for s\n using that \\(3) unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def range_vars_alt_def by fastforce\n thus ?thesis\n using tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst[OF _ \\(1,2)] S\n unfolding list_all_iff\n by (auto simp add: subst_apply_stateful_strand_def)\nqed\n\nlemma tfr_setops_if_tfr_trms:\n assumes \"Pair \\ \\(funs_term ` SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S))\"\n and \"\\p. Ana (pair p) = ([], [])\"\n and \"\\s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S. \\t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S. (\\\\. Unifier \\ s t) \\ \\ s = \\ t\"\n and \"\\s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S. \\t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S.\n (\\\\ \\ \\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\\n Unifier \\ (s \\ \\) (t \\ \\))\n \\ (\\\\. Unifier \\ s t)\"\n and tfr: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nproof -\n have 0: \"t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var \\ t \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n when \"t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\" for t\n using that SMP_union by blast\n\n have 1: \"s \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n when st: \"s \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"\\\\. Unifier \\ s t\"\n for s t\n proof -\n have \"(\\\\. s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ s \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n using st setops_SMP_cases[of s S] assms(2) by blast\n moreover {\n fix \\ assume \\: \"s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n then obtain s' where s': \"s' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\" \"s = s' \\ \\\" by blast\n then obtain u u' where u: \"s' = Fun Pair [u,u']\"\n using setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs[of s'] unfolding pair_def by fast\n hence *: \"s = Fun Pair [u \\ \\, u' \\ \\]\" using \\ s' by simp\n\n obtain f T where fT: \"t = Fun f T\" using st(2) by (cases t) auto\n hence \"f \\ Pair\" using st(2) assms(1) by auto\n hence False using st(3) * fT s' u by fast\n } ultimately show ?thesis by meson\n qed\n \n have 2: \"\\ s = \\ t\"\n when \"s \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"\\\\. Unifier \\ s t\"\n for s t\n using that tfr unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n \n have 3: \"\\ s = \\ t\"\n when st: \"s \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"t \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"\\\\. Unifier \\ s t\"\n for s t\n proof -\n let ?P = \"\\s \\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n have \"(\\\\. ?P s \\) \\ s \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n \"(\\\\. ?P t \\) \\ t \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t S) - range Var\"\n using setops_SMP_cases[of _ S] assms(2) st(1,2) by auto\n hence \"(\\\\ \\'. ?P s \\ \\ ?P t \\') \\ \\ s = \\ t\" by (metis 1 2 st)\n moreover {\n fix \\ \\' assume *: \"?P s \\\" \"?P t \\'\"\n then obtain s' t' where **:\n \"s' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\" \"t' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S\" \"s = s' \\ \\\" \"t = t' \\ \\'\"\n by blast\n hence \"\\\\. Unifier \\ s' t'\" using st(3) assms(4) * by blast\n hence \"\\ s' = \\ t'\" using assms(3) ** by blast\n hence \"\\ s = \\ t\" using * **(3,4) wt_subst_trm''[of \\ s'] wt_subst_trm''[of \\' t'] by argo\n } ultimately show ?thesis by blast\n qed\n \n show ?thesis using 0 1 2 3 unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by metis\nqed\n\nend\n\n\nsubsection \\The Typing Result for Stateful Constraints\\\n\nsubsubsection \\Correctness of the Constraint Reduction\\\ncontext stateful_typed_model\nbegin\n\ncontext\nbegin\nprivate lemma tr_wf':\n assumes \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n and \"\\(t,t') \\ set D. fv t \\ fv t' \\ X\"\n and \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n and \"A' \\ set (tr A D)\"\n shows \"wf\\<^sub>s\\<^sub>t X A'\"\nproof -\n define P where\n \"P = (\\(D::('fun,'var) dbstatelist) (A::('fun,'var) stateful_strand).\n (\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {})\"\n\n have \"P D A\" using assms(1,4) by (simp add: P_def)\n with assms(5,3,2) show ?thesis\n proof (induction A arbitrary: A' D X rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n case 1 thus ?case by simp\n next\n case (2 X ts A A')\n then obtain A'' where A'': \"A' = receive\\ts\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\" \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\ X\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"\\(s,s') \\ set D. fv s \\ fv s' \\ X\" \"P D A\"\n using 2(1,2,3,4) apply (force, force)\n using 2(5) unfolding P_def by force\n show ?case using \"2.IH\"[OF A''(2) *] A''(1,3) by simp\n next\n case (3 X ts A A')\n then obtain A'' where A'': \"A' = send\\ts\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (X \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)) A\"\n \"\\(s,s') \\ set D. fv s \\ fv s' \\ X \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\" \"P D A\"\n using 3(1,2,3,4) apply (force, force)\n using 3(5) unfolding P_def by force\n show ?case using \"3.IH\"[OF A''(2) *] A''(1) by simp\n next\n case (4 X t t' A A')\n then obtain A'' where A'': \"A' = \\assign: t \\ t'\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\" \"fv t' \\ X\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (X \\ fv t) A\" \"\\(s,s') \\ set D. fv s \\ fv s' \\ X \\ fv t\" \"P D A\"\n using 4(1,2,3,4) apply (force, force)\n using 4(5) unfolding P_def by force\n show ?case using \"4.IH\"[OF A''(2) *] A''(1,3) by simp\n next\n case (5 X t t' A A')\n then obtain A'' where A'': \"A' = \\check: t \\ t'\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"P D A\"\n using 5(3) apply force\n using 5(5) unfolding P_def by force\n show ?case using \"5.IH\"[OF A''(2) *(1) 5(4) *(2)] A''(1) by simp\n next\n case (6 X t s A A')\n hence A': \"A' \\ set (tr A (List.insert (t,s) D))\" \"fv t \\ X\" \"fv s \\ X\" by auto\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"\\(s,s') \\ set (List.insert (t,s) D). fv s \\ fv s' \\ X\" using 6 by auto\n have **: \"P (List.insert (t,s) D) A\" using 6(5) unfolding P_def by force\n show ?case using \"6.IH\"[OF A'(1) * **] A'(2,3) by simp\n next\n case (7 X t s A A')\n let ?constr = \"\\Di. (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])\"\n from 7 obtain Di A'' where A'':\n \"A' = ?constr Di@A''\" \"A'' \\ set (tr A [d\\D. d \\ set Di])\"\n \"Di \\ set (subseqs D)\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"\\(t',s') \\ set [d\\D. d \\ set Di]. fv t' \\ fv s' \\ X\"\n using 7 by auto\n have **: \"P [d\\D. d \\ set Di] A\" using 7 unfolding P_def by force\n have ***: \"\\(t, t') \\ set D. fv t \\ fv t' \\ X\" using 7 by auto\n show ?case\n using \"7.IH\"[OF A''(2) * **] A''(1) wf_fun_pair_eqs_ineqs_map[OF _ A''(3) ***]\n by simp\n next\n case (8 X t s A A')\n then obtain d A'' where A'':\n \"A' = \\assign: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#A''\"\n \"A'' \\ set (tr A D)\" \"d \\ set D\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (X \\ fv t \\ fv s) A\" \"\\(t',s')\\set D. fv t' \\ fv s' \\ X \\ fv t \\ fv s\" \"P D A\"\n using 8(1,2,3,4) apply (force, force)\n using 8(5) unfolding P_def by force\n have **: \"fv (pair d) \\ X\" using A''(3) \"8.prems\"(3) unfolding pair_def by fastforce\n have ***: \"fv (pair (t,s)) = fv s \\ fv t\" unfolding pair_def by auto\n show ?case using \"8.IH\"[OF A''(2) *] A''(1) ** *** unfolding pair_def by (simp add: Un_assoc)\n next\n case (9 X t s A A')\n then obtain d A'' where A'':\n \"A' = \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#A''\"\n \"A'' \\ set (tr A D)\" \"d \\ set D\"\n by moura\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\"\"P D A\"\n using 9(3) apply force\n using 9(5) unfolding P_def by force\n have **: \"fv (pair d) \\ X\" using A''(3) \"9.prems\"(3) unfolding pair_def by fastforce\n have ***: \"fv (pair (t,s)) = fv s \\ fv t\" unfolding pair_def by auto\n show ?case using \"9.IH\"[OF A''(2) *(1) 9(4) *(2)] A''(1) ** *** by (simp add: Un_assoc)\n next\n case (10 X Y F F' A A')\n from 10 obtain A'' where A'':\n \"A' = (map (\\G. \\Y\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))@A''\" \"A'' \\ set (tr A D)\"\n by moura\n\n have *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X A\" \"\\(t',s') \\ set D. fv t' \\ fv s' \\ X\" using 10 by auto\n \n have \"bvars\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t (\\Y\\\\\\: F \\\\: F'\\#A)\" \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (\\Y\\\\\\: F \\\\: F'\\#A)\" by auto\n hence **: \"P D A\" using 10 unfolding P_def by blast\n\n show ?case using \"10.IH\"[OF A''(2) * **] A''(1) wf_fun_pair_negchecks_map by simp\n qed\nqed\n\nprivate lemma tr_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s:\n assumes \"A' \\ set (tr A [])\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t A')\"\nusing tr_trms_subset[OF assms(1)] setops\\<^sub>s\\<^sub>s\\<^sub>t_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s(2)[OF assms(2)]\nby auto\n\nlemma tr_wf:\n assumes \"A' \\ set (tr A [])\"\n and \"wf\\<^sub>s\\<^sub>s\\<^sub>t A\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A)\" \n shows \"wf\\<^sub>s\\<^sub>t {} A'\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t A')\"\n and \"fv\\<^sub>s\\<^sub>t A' \\ bvars\\<^sub>s\\<^sub>t A' = {}\"\nusing tr_wf'[OF _ _ _ _ assms(1)]\n tr_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s[OF assms(1,3)]\n tr_vars_disj[OF assms(1)]\n assms(2)\nby fastforce+\n\nprivate lemma fun_pair_ineqs:\n assumes \"d \\\\<^sub>p \\ \\\\<^sub>p \\ \\ d' \\\\<^sub>p \\\"\n shows \"pair d \\ \\ \\ \\ \\ pair d' \\ \\\"\nproof -\n have \"d \\\\<^sub>p (\\ \\\\<^sub>s \\) \\ d' \\\\<^sub>p \\\" using assms subst_pair_compose by metis\n hence \"pair d \\ (\\ \\\\<^sub>s \\) \\ pair d' \\ \\\" using fun_pair_eq_subst by metis\n thus ?thesis by simp\nqed\n\nprivate lemma tr_Delete_constr_iff_aux1:\n assumes \"\\d \\ set Di. (t,s) \\\\<^sub>p \\ = d \\\\<^sub>p \\\"\n and \"\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\"\n shows \"\\M; (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])\\\\<^sub>d \\\"\nproof -\n from assms(2) have\n \"\\M; map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]\\\\<^sub>d \\\"\n proof (induction D)\n case (Cons d D)\n hence IH: \"\\M; map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D . d \\ set Di]\\\\<^sub>d \\\" by auto\n thus ?case\n proof (cases \"d \\ set Di\")\n case False\n hence \"(t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\" using Cons by simp\n hence \"pair (t,s) \\ \\ \\ pair d \\ \\\" using fun_pair_eq_subst by metis\n moreover have \"\\t (\\::('fun,'var) subst). subst_domain \\ = {} \\ t \\ \\ = t\" by auto\n ultimately have \"\\\\. subst_domain \\ = {} \\ pair (t,s) \\ \\ \\ \\ \\ pair d \\ \\ \\ \\\" by metis\n thus ?thesis using IH by (simp add: ineq_model_def)\n qed simp\n qed simp\n moreover {\n fix B assume \"\\M; B\\\\<^sub>d \\\" \n with assms(1) have \"\\M; (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@B\\\\<^sub>d \\\"\n unfolding pair_def by (induction Di) auto\n } ultimately show ?thesis by metis\nqed\n\nprivate lemma tr_Delete_constr_iff_aux2:\n assumes \"ground M\"\n and \"\\M; (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])\\\\<^sub>d \\\"\n shows \"(\\d \\ set Di. (t,s) \\\\<^sub>p \\ = d \\\\<^sub>p \\) \\ (\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\)\"\nproof -\n let ?c1 = \"map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di\"\n let ?c2 = \"map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]\"\n\n have \"M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = M\" using assms(1) subst_all_ground_ident by metis\n moreover have \"ik\\<^sub>s\\<^sub>t ?c1 = {}\" by auto\n ultimately have *:\n \"\\M; map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di\\\\<^sub>d \\\"\n \"\\M; map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]\\\\<^sub>d \\\"\n using strand_sem_split(3,4)[of M ?c1 ?c2 \\] assms(2) by auto\n \n from *(1) have 1: \"\\d \\ set Di. (t,s) \\\\<^sub>p \\ = d \\\\<^sub>p \\\" unfolding pair_def by (induct Di) auto\n from *(2) have 2: \"\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\"\n proof (induction D arbitrary: Di)\n case (Cons d D) thus ?case\n proof (cases \"d \\ set Di\")\n case False\n hence IH: \"\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\" using Cons by force\n have \"\\t (\\::('fun,'var) subst). subst_domain \\ = {} \\ ground (subst_range \\) \\ \\ = Var\"\n by auto\n moreover have \"ineq_model \\ [] [((pair (t,s)), (pair d))]\"\n using False Cons.prems by simp\n ultimately have \"pair (t,s) \\ \\ \\ pair d \\ \\\" by (simp add: ineq_model_def)\n thus ?thesis using IH unfolding pair_def by force\n qed simp\n qed simp\n\n show ?thesis by (metis 1 2)\nqed\n\nprivate lemma tr_Delete_constr_iff:\n fixes \\::\"('fun,'var) subst\"\n assumes \"ground M\"\n shows \"set Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {(t,s) \\\\<^sub>p \\} \\ (t,s) \\\\<^sub>p \\ \\ (set D - set Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\n \\M; (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])\\\\<^sub>d \\\"\nproof -\n let ?constr = \"(map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di])\"\n { assume \"set Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {(t,s) \\\\<^sub>p \\}\" \"(t,s) \\\\<^sub>p \\ \\ (set D - set Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n hence \"\\d \\ set Di. (t,s) \\\\<^sub>p \\ = d \\\\<^sub>p \\\" \"\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\"\n by auto\n hence \"\\M; ?constr\\\\<^sub>d \\\" using tr_Delete_constr_iff_aux1 by simp\n } moreover {\n assume \"\\M; ?constr\\\\<^sub>d \\\"\n hence \"\\d \\ set Di. (t,s) \\\\<^sub>p \\ = d \\\\<^sub>p \\\" \"\\d \\ set D - set Di. (t,s) \\\\<^sub>p \\ \\ d \\\\<^sub>p \\\"\n using assms tr_Delete_constr_iff_aux2 by auto\n hence \"set Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {(t,s) \\\\<^sub>p \\} \\ (t,s) \\\\<^sub>p \\ \\ (set D - set Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\" by force\n } ultimately show ?thesis by metis\nqed\n\nprivate lemma tr_NotInSet_constr_iff:\n fixes \\::\"('fun,'var) subst\"\n assumes \"\\(t,t') \\ set D. (fv t \\ fv t') \\ set X = {}\"\n shows \"(\\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ (t,s) \\\\<^sub>p \\ \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\)\n \\ \\M; map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) D\\\\<^sub>d \\\"\nproof -\n { assume \"\\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ (t,s) \\\\<^sub>p \\ \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n with assms have \"\\M; map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) D\\\\<^sub>d \\\"\n proof (induction D)\n case (Cons d D)\n obtain t' s' where d: \"d = (t',s')\" by moura\n have \"\\M; map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) D\\\\<^sub>d \\\"\n \"map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) (d#D) =\n \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t#map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) D\"\n using Cons by auto\n moreover have\n \"\\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ pair (t, s) \\ \\ \\ \\ \\ pair d \\ \\\"\n using fun_pair_ineqs[of \\ _ \"(t,s)\" \\ d] Cons.prems(2) by auto\n moreover have \"(fv t' \\ fv s') \\ set X = {}\" using Cons.prems(1) d by auto\n hence \"\\\\. subst_domain \\ = set X \\ pair d \\ \\ = pair d\" using d unfolding pair_def by auto\n ultimately show ?case by (simp add: ineq_model_def)\n qed simp\n } moreover {\n fix \\::\"('fun,'var) subst\"\n assume \"\\M; map (\\d. \\X\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) D\\\\<^sub>d \\\"\n and \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n with assms have \"(t,s) \\\\<^sub>p \\ \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n proof (induction D)\n case (Cons d D)\n obtain t' s' where d: \"d = (t',s')\" by moura\n have \"(t,s) \\\\<^sub>p \\ \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n \"pair (t,s) \\ \\ \\ \\ \\ pair d \\ \\ \\ \\\"\n using Cons d by (auto simp add: ineq_model_def simp del: subst_range.simps)\n moreover have \"pair d \\ \\ = pair d\"\n using Cons.prems(1) fun_pair_subst[of d \\] d \\(1) unfolding pair_def by auto\n ultimately show ?case unfolding pair_def by force\n qed simp\n } ultimately show ?thesis by metis\nqed\n\nlemma tr_NegChecks_constr_iff:\n \"(\\G\\set L. ineq_model \\ X (F@G)) \\ \\M; map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) L\\\\<^sub>d \\\" (is ?A)\n \"negchecks_model \\ D X F F' \\ \\M; D; [\\X\\\\\\: F \\\\: F'\\]\\\\<^sub>s \\\" (is ?B)\nproof -\n show ?A by (induct L) auto\n show ?B by simp\nqed\n\nlemma tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_sem_equiv:\n fixes \\::\"('fun,'var) subst\"\n assumes \"\\(t,t') \\ set D. (fv t \\ fv t') \\ set X = {}\"\n shows \"negchecks_model \\ (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) X F F' \\\n (\\G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D). ineq_model \\ X (F@G))\"\nproof -\n define P where\n \"P \\ \\\\::('fun,'var) subst. subst_domain \\ = set X \\ ground (subst_range \\)\" \n\n define Ineq where\n \"Ineq \\ \\(\\::('fun,'var) subst) F. \\(s,t) \\ set F. s \\ \\ \\\\<^sub>s \\ \\ t \\ \\ \\\\<^sub>s \\\"\n\n define Ineq' where\n \"Ineq' \\ \\(\\::('fun,'var) subst) F. \\(s,t) \\ set F. s \\ \\ \\\\<^sub>s \\ \\ t \\ \\\"\n \n define Notin where\n \"Notin \\ \\(\\::('fun,'var) subst) D F'. \\(s,t) \\ set F'. (s,t) \\\\<^sub>p \\ \\\\<^sub>s \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n\n have sublmm:\n \"((s,t) \\\\<^sub>p \\ \\\\<^sub>s \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (list_all (\\d. Ineq' \\ [(pair (s,t),pair d)]) D)\"\n for s t \\ D\n unfolding pair_def by (induct D) (auto simp add: Ineq'_def)\n\n have \"Notin \\ D F' \\ (\\G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D). Ineq' \\ G)\"\n (is \"?A \\ ?B\")\n when \"P \\\" for \\\n proof\n show \"?A \\ ?B\"\n proof (induction F' D rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F' D)\n show ?case\n proof (cases \"Notin \\ D F'\")\n case False\n hence \"(s,t) \\\\<^sub>p \\ \\\\<^sub>s \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using \"2.prems\"\n by (auto simp add: Notin_def)\n hence \"pair (s,t) \\ \\ \\\\<^sub>s \\ \\ pair d \\ \\\" when \"d \\ set D\" for d\n using that sublmm Ball_set[of D \"\\d. Ineq' \\ [(pair (s,t), pair d)]\"]\n by (simp add: Ineq'_def)\n moreover have \"\\d \\ set D. \\G'. G = (pair (s,t), pair d)#G'\"\n when \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((s,t)#F') D)\" for G\n using that tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_index[OF that, of 0] by force\n ultimately show ?thesis by (simp add: Ineq'_def)\n qed (auto dest: \"2.IH\" simp add: Ineq'_def)\n qed (simp add: Notin_def)\n\n have \"\\?A \\ \\?B\"\n proof (induction F' D rule: tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s.induct)\n case (2 s t F' D)\n hence \"\\Notin \\ D F'\" \"D \\ []\" unfolding Notin_def by auto\n then obtain G where G: \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D)\" \"\\Ineq' \\ G\"\n using \"2.IH\" by (cases D) auto\n\n obtain d where d: \"d \\ set D\" \"pair (s,t) \\ \\ \\\\<^sub>s \\ = pair d \\ \\\"\n using \"2.prems\"\n unfolding pair_def by (auto simp add: Notin_def)\n thus ?case\n using G(2) tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_cons[OF G(1) d(1)]\n by (auto simp add: Ineq'_def)\n qed (simp add: Ineq'_def)\n thus \"?B \\ ?A\" by metis\n qed\n hence *: \"(\\\\. P \\ \\ Ineq \\ F \\ Notin \\ D F') \\\n (\\G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D). \\\\. P \\ \\ Ineq \\ F \\ Ineq' \\ G)\"\n by auto\n\n have \"t \\ \\ = t\"\n when \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D)\" \"(s,t) \\ set G\" \"P \\\"\n for \\ s t G\n using assms that(3) tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_has_pair_lists[OF that(1,2)]\n unfolding pair_def by (fastforce simp add: P_def)\n hence **: \"Ineq' \\ G = Ineq \\ G\"\n when \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D)\" \"P \\\"\n for \\ G\n using that unfolding Ineq_def Ineq'_def by force\n\n have ***: \"negchecks_model \\ (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) X F F' \\ (\\\\. P \\ \\ Ineq \\ F \\ Notin \\ D F')\"\n unfolding P_def Ineq_def Notin_def negchecks_model_def by blast\n\n have \"ineq_model \\ X (F@G) \\ (\\\\. P \\ \\ Ineq \\ (F@G))\" for G\n unfolding P_def Ineq_def ineq_model_def by blast\n hence ****: \"ineq_model \\ X (F@G) \\ (\\\\. P \\ \\ Ineq \\ F \\ Ineq \\ G)\" for G\n unfolding Ineq_def by fastforce\n\n show ?thesis\n using * ** *** **** by simp\nqed\n\nlemma tr_sem_equiv':\n assumes \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n and \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n and \"ground M\"\n and \\: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\ \\ (\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\)\" (is \"?P \\ ?Q\")\nproof\n have \\_grounds: \"\\t. fv (t \\ \\) = {}\" by (rule interpretation_grounds[OF \\])\n have \"\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\\" when ?P using that assms(1,2,3)\n proof (induction A arbitrary: D rule: strand_sem_stateful_induct)\n case (ConsRcv M D ts A)\n have \"\\(set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground ((set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M)\"\n using \\ ConsRcv.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain A' where A': \"A' \\ set (tr A D)\" \"\\(set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M; A'\\\\<^sub>d \\\" by (metis ConsRcv.IH)\n thus ?case by auto\n next\n case (ConsSnd M D ts A)\n have \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"\\t \\ set ts. M \\ t \\ \\\"\n using \\ ConsSnd.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain A' where A': \"A' \\ set (tr A D)\" \"\\M; A'\\\\<^sub>d \\\" by (metis ConsSnd.IH)\n thus ?case using * by auto\n next\n case (ConsEq M D ac t t' A)\n have \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"t \\ \\ = t' \\ \\\"\n using \\ ConsEq.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain A' where A': \"A' \\ set (tr A D)\" \"\\M; A'\\\\<^sub>d \\\" by (metis ConsEq.IH)\n thus ?case using * by auto\n next\n case (ConsIns M D t s A)\n have \"\\M; set (List.insert (t,s) D) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n \"\\(t,t') \\ set (List.insert (t,s) D). (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n using ConsIns.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain A' where A': \"A' \\ set (tr A (List.insert (t,s) D))\" \"\\M; A'\\\\<^sub>d \\\"\n by (metis ConsIns.IH)\n thus ?case by auto\n next\n case (ConsDel M D t s A)\n have *: \"\\M; (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {(t,s) \\\\<^sub>p \\}; A\\\\<^sub>s \\\"\n \"\\(t,t')\\set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n using ConsDel.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain Di where Di:\n \"Di \\ set D\" \"Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {(t,s) \\\\<^sub>p \\}\" \"(t,s) \\\\<^sub>p \\ \\ (set D - Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using subset_subst_pairs_diff_exists'[of \"set D\"] by moura\n hence **: \"(set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {(t,s) \\\\<^sub>p \\} = (set D - Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\" by blast\n\n obtain Di' where Di': \"set Di' = Di\" \"Di' \\ set (subseqs D)\"\n using subset_sublist_exists[OF Di(1)] by moura\n hence ***: \"(set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {(t,s) \\\\<^sub>p \\} = (set [d\\D. d \\ set Di'] \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using Di ** by auto\n \n define constr where \"constr \\\n map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di'@\n map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di']\"\n \n have ****: \"\\(t,t')\\set [d\\D. d \\ set Di']. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n using *(2) Di(1) Di'(1) subseqs_set_subset[OF Di'(2)] by simp\n have \"set D - Di = set [d\\D. d \\ set Di']\" using Di Di' by auto\n hence *****: \"\\M; set [d\\D. d \\ set Di'] \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n using *(1) ** by metis\n obtain A' where A': \"A' \\ set (tr A [d\\D. d \\ set Di'])\" \"\\M; A'\\\\<^sub>d \\\"\n using ConsDel.IH[OF ***** **** *(3,4)] by moura\n hence constr_sat: \"\\M; constr\\\\<^sub>d \\\"\n using Di Di' *(1) *** tr_Delete_constr_iff[OF *(4), of \\ Di' t s D] \n unfolding constr_def by auto\n\n have \"constr@A' \\ set (tr (Delete t s#A) D)\" using A'(1) Di' unfolding constr_def by auto\n moreover have \"ik\\<^sub>s\\<^sub>t constr = {}\" unfolding constr_def by auto\n hence \"\\M \\\\<^sub>s\\<^sub>e\\<^sub>t \\; constr\\\\<^sub>d \\\" \"\\M \\ (ik\\<^sub>s\\<^sub>t constr \\\\<^sub>s\\<^sub>e\\<^sub>t \\); A'\\\\<^sub>d \\\"\n using constr_sat A'(2) subst_all_ground_ident[OF *(4)] by simp_all\n ultimately show ?case\n using strand_sem_append(2)[of _ _ \\]\n subst_all_ground_ident[OF *(4), of \\]\n by metis\n next\n case (ConsIn M D ac t s A)\n have \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"(t,s) \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using \\ ConsIn.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n then obtain A' where A': \"A' \\ set (tr A D)\" \"\\M; A'\\\\<^sub>d \\\" by (metis ConsIn.IH)\n moreover obtain d where \"d \\ set D\" \"pair (t,s) \\ \\ = pair d \\ \\\"\n using * unfolding pair_def by auto\n ultimately show ?case using * by auto\n next\n case (ConsNegChecks M D X F F' A)\n let ?ineqs = \"(map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))\"\n have 1: \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" \"ground M\" using ConsNegChecks by auto\n have 2: \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \n using ConsNegChecks.prems(2,3) \\ unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by fastforce+\n \n have 3: \"negchecks_model \\ (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) X F F'\" using ConsNegChecks.prems(1) by simp\n from 1 2 obtain A' where A': \"A' \\ set (tr A D)\" \"\\M; A'\\\\<^sub>d \\\" by (metis ConsNegChecks.IH)\n \n have 4: \"\\(t,t') \\ set D. (fv t \\ fv t') \\ set X = {}\"\n using ConsNegChecks.prems(2) unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n \n have \"\\M; ?ineqs\\\\<^sub>d \\\"\n using 3 tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_sem_equiv[OF 4] tr_NegChecks_constr_iff\n by metis\n moreover have \"ik\\<^sub>s\\<^sub>t ?ineqs = {}\" by auto\n moreover have \"M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = M\" using 1(2) \\ by (simp add: subst_all_ground_ident)\n ultimately show ?case\n using strand_sem_append(2)[of M ?ineqs \\ A'] A'\n by force\n qed simp\n thus \"?P \\ ?Q\" by metis\n\n have \"(\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\) \\ ?P\" using assms(1,2,3)\n proof (induction A arbitrary: D rule: strand_sem_stateful_induct)\n case (ConsRcv M D ts A)\n have \"\\A' \\ set (tr A D). \\(set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M; A'\\\\<^sub>d \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground ((set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M)\"\n using \\ ConsRcv.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n hence \"\\(set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" by (metis ConsRcv.IH)\n thus ?case by auto\n next\n case (ConsSnd M D ts A)\n have \"\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"\\t \\ set ts. M \\ t \\ \\\"\n using \\ ConsSnd.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n hence \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" by (metis ConsSnd.IH)\n thus ?case using * by auto\n next\n case (ConsEq M D ac t t' A)\n have \"\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"t \\ \\ = t' \\ \\\"\n using \\ ConsEq.prems unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n hence \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" by (metis ConsEq.IH)\n thus ?case using * by auto\n next\n case (ConsIns M D t s A)\n hence \"\\A' \\ set (tr A (List.insert (t,s) D)). \\M; A'\\\\<^sub>d \\\"\n \"\\(t,t') \\ set (List.insert (t,s) D). (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto+\n hence \"\\M; set (List.insert (t,s) D) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" by (metis ConsIns.IH)\n thus ?case by auto\n next\n case (ConsDel M D t s A)\n define constr where \"constr \\\n \\Di. map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di@\n map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]\"\n let ?flt = \"\\Di. filter (\\d. d \\ set Di) D\"\n\n have \"\\Di \\ set (subseqs D). \\B' \\ set (tr A (?flt Di)). B = constr Di@B'\"\n when \"B \\ set (tr (delete\\t,s\\#A) D)\" for B\n using that unfolding constr_def by auto\n then obtain A' Di where A':\n \"constr Di@A' \\ set (tr (Delete t s#A) D)\"\n \"A' \\ set (tr A (?flt Di))\"\n \"Di \\ set (subseqs D)\"\n \"\\M; constr Di@A'\\\\<^sub>d \\\"\n using ConsDel.prems(1) by blast\n\n have 1: \"\\(t,t')\\set (?flt Di). (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" using ConsDel.prems(2) by auto\n have 2: \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" using ConsDel.prems(3) by force+\n have \"ik\\<^sub>s\\<^sub>t (constr Di) = {}\" unfolding constr_def by auto\n hence 3: \"\\M; A'\\\\<^sub>d \\\"\n using subst_all_ground_ident[OF ConsDel.prems(4)] A'(4)\n strand_sem_split(4)[of M \"constr Di\" A' \\]\n by simp\n have IH: \"\\M; set (?flt Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n by (metis ConsDel.IH[OF _ 1 2 ConsDel.prems(4)] 3 A'(2))\n\n have \"\\M; constr Di\\\\<^sub>d \\\"\n using subst_all_ground_ident[OF ConsDel.prems(4)] strand_sem_split(3) A'(4)\n by metis\n hence *: \"set Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {(t,s) \\\\<^sub>p \\}\" \"(t,s) \\\\<^sub>p \\ \\ (set D - set Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using tr_Delete_constr_iff[OF ConsDel.prems(4), of \\ Di t s D] unfolding constr_def by auto\n have 4: \"set (?flt Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ = (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {((t,s) \\\\<^sub>p \\)}\"\n proof\n show \"set (?flt Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {((t,s) \\\\<^sub>p \\)}\"\n proof\n fix u u' assume u: \"(u,u') \\ set (?flt Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n then obtain v v' where v: \"(v,v') \\ set D - set Di\" \"(v,v') \\\\<^sub>p \\ = (u,u')\" by auto\n hence \"(u,u') \\ (t,s) \\\\<^sub>p \\\" using * by force\n thus \"(u,u') \\ (set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {((t,s) \\\\<^sub>p \\)}\"\n using u v * subseqs_set_subset[OF A'(3)] by auto\n qed\n show \"(set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - {((t,s) \\\\<^sub>p \\)} \\ set (?flt Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using * subseqs_set_subset[OF A'(3)] by force\n qed\n\n show ?case using 4 IH by simp\n next\n case (ConsIn M D ac t s A)\n have \"\\A' \\ set (tr A D). \\M; A'\\\\<^sub>d \\\"\n \"\\(t,t') \\ set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"ground M\"\n and *: \"(t,s) \\\\<^sub>p \\ \\ set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using ConsIn.prems(1,2,3,4) apply (fastforce, fastforce, fastforce, fastforce)\n using ConsIn.prems(1) tr.simps(7)[of ac t s A D] unfolding pair_def by fastforce\n hence \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\" by (metis ConsIn.IH)\n moreover obtain d where \"d \\ set D\" \"pair (t,s) \\ \\ = pair d \\ \\\"\n using * unfolding pair_def by auto\n ultimately show ?case using * by auto\n next\n case (ConsNegChecks M D X F F' A)\n let ?ineqs = \"(map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))\"\n\n obtain B where B:\n \"?ineqs@B \\ set (tr (NegChecks X F F'#A) D)\" \"\\M; ?ineqs@B\\\\<^sub>d \\\" \"B \\ set (tr A D)\"\n using ConsNegChecks.prems(1) by moura\n moreover have \"M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = M\"\n using ConsNegChecks.prems(4) \\ by (simp add: subst_all_ground_ident)\n moreover have \"ik\\<^sub>s\\<^sub>t ?ineqs = {}\" by auto\n ultimately have \"\\M; B\\\\<^sub>d \\\" using strand_sem_split(4)[of M ?ineqs B \\] by simp\n moreover have \"\\(t,t')\\set D. (fv t \\ fv t') \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n using ConsNegChecks.prems(2,3) unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force+\n ultimately have \"\\M; set D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\; A\\\\<^sub>s \\\"\n by (metis ConsNegChecks.IH B(3) ConsNegChecks.prems(4))\n moreover have \"\\(t, t')\\set D. (fv t \\ fv t') \\ set X = {}\"\n using ConsNegChecks.prems(2) unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n ultimately show ?case\n using tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_sem_equiv tr_NegChecks_constr_iff\n B(2) strand_sem_split(3)[of M ?ineqs B \\] \\M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = M\\\n by simp\n qed simp\n thus \"?Q \\ ?P\" by metis\nqed\n\nlemma tr_sem_equiv:\n assumes \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" and \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"\\ \\\\<^sub>s A \\ (\\A' \\ set (tr A []). (\\ \\ \\A'\\))\"\nusing tr_sem_equiv'[OF _ assms(1) _ assms(2), of \"[]\" \"{}\"]\nunfolding constr_sem_d_def\nby auto\n\nend\n\nend\n\n\nsubsubsection \\Typing Result Locale Definition\\\n\nlocale stateful_typing_result =\n stateful_typed_model arity public Ana \\ Pair\n+ typing_result arity public Ana \\\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,'var) term \\ (('fun,'var) term list \\ ('fun,'var) term list)\"\n and \\::\"('fun,'var) term \\ ('fun,'atom::finite) term_type\"\n and Pair::\"'fun\"\n\n\nsubsubsection \\Type-Flaw Resistance Preservation of the Constraint Reduction\\\ncontext stateful_typing_result\nbegin\n\ncontext\nbegin\n\nprivate lemma tr_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p:\n assumes \"A' \\ set (tr A D)\" \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p A\"\n and \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" (is \"?P0 A D\")\n and \"\\(t,s) \\ set D. (fv t \\ fv s) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" (is \"?P1 A D\")\n and \"\\t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D. \\t' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set D.\n (\\\\. Unifier \\ t t') \\ \\ t = \\ t'\" (is \"?P3 A D\")\n shows \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A'\"\nproof -\n have sublmm: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p A\" \"?P0 A D\" \"?P1 A D\" \"?P3 A D\"\n when p: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a#A)\" \"?P0 (a#A) D\" \"?P1 (a#A) D\" \"?P3 (a#A) D\"\n for a A D\n using p(1) apply (simp add: tfr\\<^sub>s\\<^sub>s\\<^sub>t_def)\n using p(2) fv\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset bvars\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset apply fast\n using p(3) bvars\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset apply fast\n using p(4) setops\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset by fast\n\n show ?thesis using assms\n proof (induction A D arbitrary: A' rule: tr.induct)\n case 1 thus ?case by simp\n next\n case (2 t A D)\n note prems = \"2.prems\"\n note IH = \"2.IH\"\n from prems(1) obtain A'' where A'': \"A' = send\\t\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\"\n by moura\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\" using IH[OF A''(2)] prems(5) sublmm[OF prems(2,3,4,5)] by meson\n thus ?case using A''(1) by simp\n next\n case (3 t A D)\n note prems = \"3.prems\"\n note IH = \"3.IH\"\n from prems(1) obtain A'' where A'': \"A' = receive\\t\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\"\n by moura\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\" using IH[OF A''(2)] prems(5) sublmm[OF prems(2,3,4,5)] by meson\n thus ?case using A''(1) by simp\n next\n case (4 ac t t' A D)\n note prems = \"4.prems\"\n note IH = \"4.IH\"\n from prems(1) obtain A'' where A'':\n \"A' = \\ac: t \\ t'\\\\<^sub>s\\<^sub>t#A''\" \"A'' \\ set (tr A D)\"\n by moura\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\" using IH[OF A''(2)] prems(5) sublmm[OF prems(2,3,4,5)] by meson\n moreover have \"(\\\\. Unifier \\ t t') \\ \\ t = \\ t'\" using prems(2) by (simp add: tfr\\<^sub>s\\<^sub>s\\<^sub>t_def)\n ultimately show ?case using A''(1) by auto\n next\n case (5 t s A D)\n note prems = \"5.prems\"\n note IH = \"5.IH\"\n from prems(1) have A': \"A' \\ set (tr A (List.insert (t,s) D))\" by simp\n \n have 1: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p A\" using sublmm[OF prems(2,3,4,5)] by simp\n \n have \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (Insert t s#A) \\ pair`set D =\n pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair`set (List.insert (t,s) D)\"\n by (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n hence 3: \"?P3 A (List.insert (t,s) D)\" using prems(5) by metis\n moreover have \"?P1 A (List.insert (t, s) D)\" using prems(3,4) bvars\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset[of A] by auto\n ultimately have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A'\" using IH[OF A' sublmm(1,2)[OF prems(2,3,4,5)] _ 3] by metis\n thus ?case using A'(1) by auto\n next\n case (6 t s A D)\n note prems = \"6.prems\"\n note IH = \"6.IH\"\n \n define constr where constr:\n \"constr \\ (\\Di. (map (\\d. \\check: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t) Di)@\n (map (\\d. \\[]\\\\\\: [(pair (t,s), pair d)]\\\\<^sub>s\\<^sub>t) [d\\D. d \\ set Di]))\"\n \n from prems(1) obtain Di A'' where A'':\n \"A' = constr Di@A''\" \"A'' \\ set (tr A [d\\D. d \\ set Di])\"\n \"Di \\ set (subseqs D)\"\n unfolding constr by auto\n \n define Q1 where \"Q1 \\ (\\(F::(('fun,'var) term \\ ('fun,'var) term) list) X.\n \\x \\ (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) - set X. \\a. \\ (Var x) = TAtom a)\"\n\n define Q2 where \"Q2 \\ (\\(F::(('fun,'var) term \\ ('fun,'var) term) list) X.\n \\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))\"\n \n have \"set [d\\D. d \\ set Di] \\ set D\"\n \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` set [d\\D. d \\ set Di]\n \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) \\ pair ` set D\"\n by (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n hence *: \"?P3 A [d\\D. d \\ set Di]\" using prems(5) by blast\n have **: \"?P1 A [d\\D. d \\ set Di]\" using prems(4,5) by auto\n have 1: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\"\n using IH[OF A''(3,2) sublmm(1,2)[OF prems(2,3,4,5)] ** *]\n by metis\n \n have 2: \"\\ac: u \\ u'\\\\<^sub>s\\<^sub>t \\ set A'' \\\n (\\d \\ set Di. u = pair (t,s) \\ u' = pair d)\"\n when \"\\ac: u \\ u'\\\\<^sub>s\\<^sub>t \\ set A'\" for ac u u'\n using that A''(1) unfolding constr by force\n have 3: \"Inequality X U \\ set A' \\ Inequality X U \\ set A'' \\\n (\\d \\ set [d\\D. d \\ set Di].\n U = [(pair (t,s), pair d)] \\ Q2 [(pair (t,s), pair d)] X)\"\n for X U\n using A''(1) unfolding Q2_def constr by force\n have 4:\n \"\\d\\set D. (\\\\. Unifier \\ (pair (t,s)) (pair d)) \\ \\ (pair (t,s)) = \\ (pair d)\"\n using prems(5) by (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n \n { fix ac u u'\n assume a: \"\\ac: u \\ u'\\\\<^sub>s\\<^sub>t \\ set A'\" \"\\\\. Unifier \\ u u'\"\n hence \"\\ac: u \\ u'\\\\<^sub>s\\<^sub>t \\ set A'' \\ (\\d \\ set Di. u = pair (t,s) \\ u' = pair d)\"\n using 2 by metis\n hence \"\\ u = \\ u'\"\n using 1(1) 4 subseqs_set_subset[OF A''(3)] a(2) tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of A'']\n by blast\n } moreover {\n fix u U\n assume \"\\U\\\\\\: u\\\\<^sub>s\\<^sub>t \\ set A'\"\n hence \"\\U\\\\\\: u\\\\<^sub>s\\<^sub>t \\ set A'' \\\n (\\d \\ set [d\\D. d \\ set Di]. u = [(pair (t,s), pair d)] \\ Q2 u U)\"\n using 3 by metis\n hence \"Q1 u U \\ Q2 u U\"\n using 1 4 subseqs_set_subset[OF A''(3)] tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of A'']\n unfolding Q1_def Q2_def\n by blast\n } ultimately show ?case using tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of A'] unfolding Q1_def Q2_def by blast\n next\n case (7 ac t s A D)\n note prems = \"7.prems\"\n note IH = \"7.IH\"\n\n from prems(1) obtain d A'' where A'':\n \"A' = \\ac: (pair (t,s)) \\ (pair d)\\\\<^sub>s\\<^sub>t#A''\"\n \"A'' \\ set (tr A D)\" \"d \\ set D\"\n by moura\n\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\"\n using IH[OF A''(2) sublmm(1,2,3)[OF prems(2,3,4,5)] sublmm(4)[OF prems(2,3,4,5)]]\n by metis\n moreover have \"(\\\\. Unifier \\ (pair (t,s)) (pair d)) \\ \\ (pair (t,s)) = \\ (pair d)\"\n using prems(2,5) A''(3) unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n ultimately show ?case using A''(1) by fastforce\n next\n case (8 X F F' A D)\n note prems = \"8.prems\"\n note IH = \"8.IH\"\n\n define constr where \"constr = (map (\\G. \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t) (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D))\"\n\n define Q1 where \"Q1 \\ (\\(F::(('fun,'var) term \\ ('fun,'var) term) list) X.\n \\x \\ (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) - set X. \\a. \\ (Var x) = TAtom a)\"\n\n define Q2 where \"Q2 \\ (\\(M::('fun,'var) terms) X.\n \\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))\"\n\n have Q2_subset: \"Q2 M' X\" when \"M' \\ M\" \"Q2 M X\" for X M M'\n using that unfolding Q2_def by auto\n\n have Q2_supset: \"Q2 (M \\ M') X\" when \"Q2 M X\" \"Q2 M' X\" for X M M'\n using that unfolding Q2_def by auto\n\n from prems(1) obtain A'' where A'': \"A' = constr@A''\" \"A'' \\ set (tr A D)\"\n using constr_def by moura\n\n have 0: \"F' = [] \\ constr = [\\X\\\\\\: F\\\\<^sub>s\\<^sub>t]\" unfolding constr_def by simp\n\n have 1: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A''\"\n using IH[OF A''(2) sublmm(1,2,3)[OF prems(2,3,4,5)] sublmm(4)[OF prems(2,3,4,5)]]\n by metis\n\n have 2: \"(F' = [] \\ Q1 F X) \\ Q2 (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F') X\"\n using prems(2) unfolding Q1_def Q2_def by simp\n \n have 3: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p constr\" when \"F' = []\" \"Q1 F X\"\n using that 0 2 tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of constr] unfolding Q1_def by auto\n\n { fix c assume \"c \\ set constr\"\n hence \"\\G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D). c = \\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t\" unfolding constr_def by force\n } moreover {\n fix G\n assume G: \"G \\ set (tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' D)\"\n and c: \"\\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t \\ set constr\"\n and e: \"Q2 (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F') X\"\n\n have d_Q2: \"Q2 (pair ` set D) X\" unfolding Q2_def\n proof (intro allI impI)\n fix f T assume \"Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (pair ` set D)\"\n then obtain d where d: \"d \\ set D\" \"Fun f T \\ subterms (pair d)\" by auto\n hence \"fv (pair d) \\ set X = {}\" using prems(4) unfolding pair_def by force\n thus \"T = [] \\ (\\s \\ set T. s \\ Var ` set X)\"\n by (metis fv_disj_Fun_subterm_param_cases d(2))\n qed\n\n have \"trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F@G) \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F' \\ pair ` set D\"\n using tr\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_trms_subset[OF G] by auto\n hence \"Q2 (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F@G)) X\" using Q2_subset[OF _ Q2_supset[OF e d_Q2]] by metis\n hence \"tfr\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: (F@G)\\\\<^sub>s\\<^sub>t)\" by (metis Q2_def tfr\\<^sub>s\\<^sub>t\\<^sub>p.simps(2))\n } ultimately have 4: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p constr\" when \"Q2 (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F') X\"\n using that Ball_set by blast\n\n have 5: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p constr\" using 2 3 4 by metis\n\n show ?case using 1 5 A''(1) by simp\n qed\nqed\n\nlemma tr_tfr:\n assumes \"A' \\ set (tr A [])\" and \"tfr\\<^sub>s\\<^sub>s\\<^sub>t A\" and \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\n shows \"tfr\\<^sub>s\\<^sub>t A'\"\nproof -\n have *: \"trms\\<^sub>s\\<^sub>t A' \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A\" using tr_trms_subset[OF assms(1)] by simp\n hence \"SMP (trms\\<^sub>s\\<^sub>t A') \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\" using SMP_mono by simp\n moreover have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A)\" using assms(2) unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by fast\n ultimately have 1: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t A')\" by (metis tfr_subset(2)[OF _ *])\n\n have **: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p A\" using assms(2) unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by fast\n have \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ SMP (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t A) - Var`\\\"\n using setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs unfolding pair_def by auto\n hence ***: \"\\t \\ pair`setops\\<^sub>s\\<^sub>s\\<^sub>t A. \\t' \\ pair`setops\\<^sub>s\\<^sub>s\\<^sub>t A. (\\\\. Unifier \\ t t') \\ \\ t = \\ t'\"\n using assms(2) unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n have 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p A'\"\n using tr_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p[OF assms(1) ** assms(3)] *** unfolding pair_def by fastforce\n\n show ?thesis by (metis 1 2 tfr\\<^sub>s\\<^sub>t_def)\nqed\n\nend\n\nend\n\n\nsubsubsection \\Theorem: The Stateful Typing Result\\\ncontext stateful_typing_result\nbegin\n\ntheorem stateful_typing_result:\n assumes \"wf\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n and \"tfr\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n and \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"\\ \\\\<^sub>s \\\"\n obtains \\\\<^sub>\\\n where \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\"\n and \"\\\\<^sub>\\ \\\\<^sub>s \\\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\nproof -\n obtain \\' where \\':\n \"\\' \\ set (tr \\ [])\" \"\\ \\ \\\\'\\\"\n using tr_sem_equiv[of \\] assms(1,4,5)\n by auto\n\n have *: \"wf\\<^sub>s\\<^sub>t {} \\'\"\n \"fv\\<^sub>s\\<^sub>t \\' \\ bvars\\<^sub>s\\<^sub>t \\' = {}\"\n \"tfr\\<^sub>s\\<^sub>t \\'\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t \\')\"\n using tr_wf[OF \\'(1) assms(1,3)]\n tr_tfr[OF \\'(1) assms(2)] assms(1)\n by metis+\n\n obtain \\\\<^sub>\\ where \\\\<^sub>\\:\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"\\{}; \\'\\\\<^sub>d \\\\<^sub>\\\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\<^sub>\\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\\\<^sub>\\)\"\n using wt_attack_if_tfr_attack_d \n * Ana_invar_subst' assms(4)\n \\'(2)\n unfolding constr_sem_d_def\n by moura\n\n thus ?thesis\n using that tr_sem_equiv[of \\] assms(1,3) \\'(1)\n unfolding constr_sem_d_def\n by auto\nqed\n\nend\n\n\nsubsection \\Proving Type-Flaw Resistance Automatically\\\ndefinition pair' where\n \"pair' pair_fun d \\ case d of (t,t') \\ Fun pair_fun [t,t']\"\n\nfun comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ pair_fun (\\_: t \\ t'\\) = (mgu t t' \\ None \\ \\ t = \\ t')\"\n| \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ pair_fun (\\X\\\\\\: F \\\\: F'\\) = (\n (F' = [] \\ (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. is_Var (\\ (Var x)))) \\\n (\\u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair' pair_fun ` set F').\n is_Fun u \\ (args u = [] \\ (\\s \\ set (args u). s \\ Var ` set X))))\"\n| \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p _ _ _ = True\"\n\ndefinition comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t where\n \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t arity Ana \\ pair_fun M S \\\n list_all (comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ pair_fun) S \\\n list_all (wf\\<^sub>t\\<^sub>r\\<^sub>m' arity) (trms_list\\<^sub>s\\<^sub>s\\<^sub>t S) \\\n has_all_wt_instances_of \\ (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair' pair_fun ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) M \\\n comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M\"\n\nlocale stateful_typed_model' = stateful_typed_model arity public Ana \\ Pair\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,(('fun,'atom::finite) term_type \\ nat)) term\n \\ (('fun,(('fun,'atom) term_type \\ nat)) term list\n \\ ('fun,(('fun,'atom) term_type \\ nat)) term list)\"\n and \\::\"('fun,(('fun,'atom) term_type \\ nat)) term \\ ('fun,'atom) term_type\"\n and Pair::\"'fun\"\n +\n assumes \\_Var_fst': \"\\\\ n m. \\ (Var (\\,n)) = \\ (Var (\\,m))\"\n and Ana_const': \"\\c T. arity c = 0 \\ Ana (Fun c T) = ([], [])\"\nbegin\n\nsublocale typed_model'\nby (unfold_locales, rule \\_Var_fst', metis Ana_const', metis Ana_subst')\n\nlemma pair_code:\n \"pair d = pair' Pair d\"\nby (simp add: pair_def pair'_def)\n\nend\n\nlocale stateful_typing_result' =\n stateful_typed_model' arity public Ana \\ Pair + stateful_typing_result arity public Ana \\ Pair\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,(('fun,'atom::finite) term_type \\ nat)) term\n \\ (('fun,(('fun,'atom) term_type \\ nat)) term list\n \\ ('fun,(('fun,'atom) term_type \\ nat)) term list)\"\n and \\::\"('fun,(('fun,'atom) term_type \\ nat)) term \\ ('fun,'atom) term_type\"\n and Pair::\"'fun\"\nbegin\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p: \"tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a = comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ Pair a\"\nproof (cases a)\n case (Equality ac t t')\n thus ?thesis\n using mgu_always_unifies[of t _ t'] mgu_gives_MGU[of t t']\n by auto\nnext\n case (NegChecks X F F')\n thus ?thesis\n using tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(2)[of X F F']\n comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(2)[of \\ Pair X F F']\n Fun_range_case(2)[of \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ pair ` set F')\"]\n unfolding is_Var_def pair_code[symmetric]\n by auto\nqed auto\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t:\n assumes \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t arity Ana \\ Pair M S\"\n shows \"tfr\\<^sub>s\\<^sub>s\\<^sub>t S\"\nunfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def\nproof\n have comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_M: \"comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M\"\n using assms unfolding comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by blast\n\n have SMP_repr_M: \"finite_SMP_representation arity Ana \\ M\"\n using comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_M unfolding comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n \n have wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_S: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n and S_trms_instance_M: \"has_all_wt_instances_of \\ (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S) M\"\n using assms setops\\<^sub>s\\<^sub>s\\<^sub>t_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s(2)[of S] trms_list\\<^sub>s\\<^sub>s\\<^sub>t_is_trms\\<^sub>s\\<^sub>s\\<^sub>t[of S]\n finite_SMP_representationD[OF SMP_repr_M]\n unfolding comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t_def comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def list_all_iff pair_code[symmetric] wf\\<^sub>t\\<^sub>r\\<^sub>m_code[symmetric]\n finite_SMP_representation_def\n by (meson, argo, argo)\n\n show \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n using tfr_subset(3)[OF tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t[OF comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_M] SMP_SMP_subset]\n SMP_I'[OF wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_S wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_M S_trms_instance_M]\n by blast\n\n have \"list_all (comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ Pair) S\" by (metis assms comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S\" by (induct S) (simp_all add: tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p)\nqed\n\nlemma tfr\\<^sub>s\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t':\n fixes S\n defines \"M \\ SMP0 Ana \\ (trms_list\\<^sub>s\\<^sub>s\\<^sub>t S@map pair (setops_list\\<^sub>s\\<^sub>s\\<^sub>t S))\"\n assumes comp_tfr: \"comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t arity Ana \\ Pair (set M) S\"\n shows \"tfr\\<^sub>s\\<^sub>s\\<^sub>t S\"\nby (rule tfr\\<^sub>s\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t[OF comp_tfr[unfolded M_def]])\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Stateful_Protocol_Composition_and_Typing/Stateful_Typing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5, "lm_q1q2_score": 0.27723523248021364}} {"text": "theory \"Andrew_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: Andrew Secure RPC *)\n\n(* text: \n We do not have the original model of the Isabelle/OFMC AndrewRPC protocol.\n Therefore, we orient ourself on the SPORE library model.\n\n Notable differences:\n\n 1. Instead of implicit typing, we are using explicit global constants to\n discern messages.\n *)\n\nrole I\nwhere \"I =\n [ Send ''1'' <| sAV ''I'',\n PEnc <| sC ''TT1'', sN ''ni'' |> ( sK ''I'' ''R'' )\n |>\n , Recv ''2'' ( PEnc <| sC ''TT2'', PHash <| sC ''TT1'', sN ''ni'' |>,\n sMV ''nr''\n |>\n ( sK ''I'' ''R'' )\n )\n , Send ''3'' ( PEnc <| sC ''TT3'', PHash <| sC ''TT1'', sMV ''nr'' |> |>\n ( sK ''I'' ''R'' )\n )\n , Recv ''4'' ( PEnc <| sC ''TT4'', sMV ''kIR'', sMV ''nr2'' |>\n ( sK ''I'' ''R'' )\n )\n ]\"\n\nrole R\nwhere \"R =\n [ Recv ''1'' <| sMV ''I'',\n PEnc <| sC ''TT1'', sMV ''ni'' |> ( PSymK ( sMV ''I'' ) ( sAV ''R'' ) )\n |>\n , Send ''2'' ( PEnc <| sC ''TT2'', PHash <| sC ''TT1'', sMV ''ni'' |>,\n sN ''nr''\n |>\n ( PSymK ( sMV ''I'' ) ( sAV ''R'' ) )\n )\n , Recv ''3'' ( PEnc <| sC ''TT3'', PHash <| sC ''TT1'', sN ''nr'' |> |>\n ( PSymK ( sMV ''I'' ) ( sAV ''R'' ) )\n )\n , Send ''4'' ( PEnc <| sC ''TT4'', sN ''kIR'', sN ''nr2'' |>\n ( PSymK ( sMV ''I'' ) ( sAV ''R'' ) )\n )\n ]\"\n\nprotocol Andrew\nwhere \"Andrew = { I, R }\"\n\nlocale restricted_Andrew_state = Andrew_state\n\ntype_invariant Andrew_msc_typing for Andrew\nwhere \"Andrew_msc_typing = mk_typing\n [ ((R, ''I''), (KnownT R_1))\n , ((I, ''kIR''), (SumT (KnownT I_4) (NonceT R ''kIR'')))\n , ((R, ''ni''), (SumT (KnownT R_1) (NonceT I ''ni'')))\n , ((I, ''nr''), (SumT (KnownT I_2) (NonceT R ''nr'')))\n , ((I, ''nr2''), (SumT (KnownT I_4) (NonceT R ''nr2'')))\n ]\"\n\nsublocale Andrew_state < Andrew_msc_typing_state\nproof -\n have \"(t,r,s) : approx Andrew_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF Andrew_msc_typing.monoTyp, completeness_cases_rule])\n case (I_2_nr t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = I_2_nr\n thus ?case\n proof(sources! \"\n Enc {| LC ''TT2'', Hash {| LC ''TT1'', LN ''ni'' tid0 |},\n s(MV ''nr'' tid0)\n |}\n ( K ( s(AV ''I'' tid0) ) ( s(AV ''R'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (I_4_kIR t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = I_4_kIR\n thus ?case\n proof(sources! \"\n Enc {| LC ''TT4'', s(MV ''kIR'' tid0), s(MV ''nr2'' tid0) |}\n ( K ( s(AV ''I'' tid0) ) ( s(AV ''R'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (I_4_nr2 t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = I_4_nr2\n thus ?case\n proof(sources! \"\n Enc {| LC ''TT4'', s(MV ''kIR'' tid0), s(MV ''nr2'' tid0) |}\n ( K ( s(AV ''I'' tid0) ) ( s(AV ''R'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (R_1_I t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_1_I\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (R_1_ni t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_1_ni\n thus ?case\n proof(sources! \"\n Enc {| LC ''TT1'', s(MV ''ni'' tid0) |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''R'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n qed\n thus \"Andrew_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Andrew_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection: Security Properties *)\n\nlemma (in restricted_Andrew_state) R_sec_kIR:\n assumes facts:\n \"roleMap r tid0 = Some R\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n \"LN ''kIR'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''kIR'' tid0 \")\n case R_4_kIR note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Andrew_state) I_sec_kIR:\n assumes facts:\n \"roleMap r tid0 = Some I\"\n \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"( tid0, I_4 ) : steps t\"\n \"s(MV ''kIR'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''TT4'', s(MV ''kIR'' tid0), s(MV ''nr2'' tid0) |}\n ( K ( s(AV ''I'' tid0) ) ( s(AV ''R'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (R_4_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: R_sec_kIR intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) I_ni_agree:\n assumes facts:\n \"roleMap r tid1 = Some I\"\n \"RLKR(s(AV ''I'' tid1)) ~: reveals t\"\n \"RLKR(s(AV ''R'' tid1)) ~: reveals t\"\n \"( tid1, I_4 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some R &\n s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n s(MV ''nr2'' tid1) = LN ''nr2'' tid2 &\n s(MV ''kIR'' tid1) = LN ''kIR'' tid2)\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''TT4'', s(MV ''kIR'' tid1), s(MV ''nr2'' tid1) |}\n ( K ( s(AV ''I'' tid1) ) ( s(AV ''R'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (R_4_enc tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) R_ni_agree:\n assumes facts:\n \"roleMap r tid1 = Some R\"\n \"RLKR(s(AV ''R'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid1)) ~: reveals t\"\n \"( tid1, R_4 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some I &\n s(MV ''I'' tid1) = s(AV ''I'' tid2) &\n s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n s(MV ''ni'' tid1) = LN ''ni'' tid2 & LN ''nr'' tid1 = s(MV ''nr'' tid2))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''TT3'', Hash {| LC ''TT1'', LN ''nr'' tid1 |} |}\n ( K ( s(MV ''I'' tid1) ) ( s(AV ''R'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (I_3_enc tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''TT2'', Hash {| LC ''TT1'', LN ''ni'' tid2 |}, LN ''nr'' tid1\n |}\n ( K ( s(AV ''I'' tid2) ) ( s(AV ''R'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (R_2_enc tid3) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/Andrew_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5, "lm_q1q2_score": 0.27723523248021364}} {"text": "theory Pierson (*** Benzmüller, Fuenmayor & Lomfeld, 2020 ***) \n imports GeneralKnowledge\nbegin (*** Pierson v. Post \"wild animal\" case **)\n\n(*case-specific 'world-vocabulary'*)\nconsts \\::\"e\" (*appropriated animal (fox in this case) *)\nconsts Pursue::\"c\\e\\\\\"\nconsts Capture::\"c\\e\\\\\"\n\n(*case-specific taxonomic (legal domain) knowledge*)\naxiomatization where \n CW1: \"\\(\\<^bold>\\c. Capture c \\ \\<^bold>\\ \\<^bold>\\Domestic \\) \\<^bold>\\ appWildAnimal\\\" and\n CW2: \"\\\\<^bold>\\c. Pursue c \\ \\<^bold>\\ Intent c\\\" and\n CW3: \"\\\\<^bold>\\c. Capture c \\ \\<^bold>\\ Poss c\\\"\n\nlemma True nitpick[satisfy,card i=4] oops (*satisfiable*)\n\n(****************** pro-Pierson's argument ****************) \nabbreviation \"Pierson_facts \\ \\Fox \\ \\<^bold>\\ (FreeRoaming \\) \\<^bold>\\ \n (\\<^bold>\\Pet \\) \\<^bold>\\ Pursue p \\ \\<^bold>\\ (\\<^bold>\\Pursue d \\) \\<^bold>\\ Capture d \\\\\"\n\n(*decision for defendant (Pierson) is compatible with premises*)\nlemma \"Pierson_facts \\ \\\\<^bold>\\INCONS\\<^sup>p\\ \\ \\\\<^bold>\\INCONS\\<^sup>d\\ \\ \\For p \\<^bold>\\ For d\\\"\n nitpick[satisfy,card i=4] oops (* (non-trivial) model found*)\n\n(*decision for plaintiff (Post) is compatible with premises*)\nlemma \"Pierson_facts \\ \\\\<^bold>\\INCONS\\<^sup>p\\ \\ \\\\<^bold>\\INCONS\\<^sup>d\\ \\ \\For d \\<^bold>\\ For p\\\"\n nitpick[satisfy,card i=4] oops (* (non-trivial) model found*)\n\n(*decision for defendant (Pierson) is provable*)\ntheorem assumes Pierson_facts shows \"\\For p \\<^bold>\\ For d\\\"\n by (metis assms CW1 CW2 W6 W8 ForAx R2 F1 other.simps(2) rBR)\n\n(*while a decision for the plaintiff is not*)\nlemma assumes Pierson_facts shows \"\\For d \\<^bold>\\ For p\\\"\n nitpick[card i=4] oops (*counterexample found*)\n\n(****************** pro-Post's argument ****************)\n(* Theory amendment: the animal is not free-roaming since it\n is being chased by a professional hunter (Post) *)\nconsts Hunter::\"c\\\\\"\naxiomatization where (*case-specific legal rule for hunters*)\n R5: \"\\(Hunter x \\<^bold>\\ Pursue x \\) \\<^bold>\\ (STAB\\<^sup>x\\ \\<^bold>\\\\<^sub>v EFFI\\<^sup>x)\\\"\n\nabbreviation \"Post_facts \\ \\Fox \\ \\<^bold>\\ (\\<^bold>\\FreeRoaming \\) \\<^bold>\\\n Hunter p \\<^bold>\\ Pursue p \\ \\<^bold>\\ (\\<^bold>\\Pursue d \\) \\<^bold>\\ Capture d \\\\\"\n\n(*decision for defendant (Pierson) is compatible with premises*)\nlemma \"Post_facts \\ \\\\<^bold>\\INCONS\\<^sup>p\\ \\ \\\\<^bold>\\INCONS\\<^sup>d\\ \\ \\For p \\<^bold>\\ For d\\\"\n nitpick[satisfy,card i=4] oops (* (non-trivial) model found*)\n\n(*decision for plaintiff (Post) is compatible with premises too*)\nlemma \"Post_facts \\ \\\\<^bold>\\INCONS\\<^sup>p\\ \\ \\\\<^bold>\\INCONS\\<^sup>d\\ \\ \\For d \\<^bold>\\ For p\\\"\n nitpick[satisfy,card i=4] oops (* (non-trivial) model found*)\n\n(*indeed, a decision for plaintiff (Post) now becomes provable*)\ntheorem assumes Post_facts shows \"\\For d \\<^bold>\\ For p\\\" \n using assms by (metis CW3 ForAx R5 F3 other.simps rBR)\n\n(*while a decision for the defendant is now refutable*)\nlemma assumes Post_facts shows \"\\For p \\<^bold>\\ For d\\\" \n nitpick[card i=4] oops (* counterexample found*)\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/Pierson.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5, "lm_q1q2_score": 0.27723523248021364}} {"text": "(* Title: Service_Matrix.thy\n Authors: Cornelius Diekmann, Max Haslbeck\n*)\n(*IPPartitioning.thy\n Original Author: Max Haslbeck, 2015*)\nsection\\Service Matrices\\\ntheory Service_Matrix\nimports \"Common/List_Product_More\"\n \"Common/IP_Partition_Preliminaries\"\n \"Common/GroupF\"\n \"Common/IP_Addr_WordInterval_toString\"\n \"Primitives/Primitives_toString\"\n SimpleFw_Semantics\n IP_Addresses.WordInterval_Sorted\nbegin\n\n\nsubsection\\IP Address Space Partition\\\n\n(* could be generalized more *)\nfun extract_IPSets_generic0\n :: \"('i::len simple_match \\ 'i word \\ nat) \\ 'i simple_rule list \\ ('i wordinterval) list\"\n where\n \"extract_IPSets_generic0 _ [] = []\" |\n \"extract_IPSets_generic0 sel ((SimpleRule m _)#ss) = (ipcidr_tuple_to_wordinterval (sel m)) #\n (extract_IPSets_generic0 sel ss)\"\n\nlemma extract_IPSets_generic0_length: \"length (extract_IPSets_generic0 sel rs) = length rs\"\n by(induction rs rule: extract_IPSets_generic0.induct) (simp_all)\n\n\n(*\nThe order in which extract_IPSets returns the collected IP ranges heavily influences the running time\nof the subsequent algorithms.\nFor example:\n1) iterating through the ruleset and collecting all source and destination ips:\n 10:10:49 elapsed time, 38:41:17 cpu time, factor 3.80\n2) iterating through the ruleset and first returning all source ips and iterating again and then return all destination ips:\n 3:39:56 elapsed time, 21:08:34 cpu time, factor 5.76\n\nTo get a more deterministic runtime, we are sorting the output. As a performance optimization, we also remove duplicate entries.\nWe use mergesort_remdups, which does a mergesort (i.e sorts!) and removes duplicates and mergesort_by_rel which does a mergesort\n(without removing duplicates) and allows to specify the relation we use to sort.\nIn theory, the largest ip ranges (smallest prefix length) should be put first, the following evaluation shows that this may not\nbe the fastest solution. The reason might be that access_matrix_pretty_ipv4 picks (almost randomly) one IP from the result and\nthere are fast and slower choices. The faster choices are the ones where the firewall ruleset has a decision very early. \nTherefore, the running time is still a bit unpredictable.\n\nHere is the data:\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs))))\n (2:47:04 elapsed time, 17:08:01 cpu time, factor 6.15)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_remdups ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs)))\n (2:41:03 elapsed time, 16:56:46 cpu time, factor 6.31)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs)))\n (5:52:28 elapsed time, 41:50:10 cpu time, factor 7.12)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\)\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs))))\n (3:10:57 elapsed time, 19:12:25 cpu time, factor 6.03)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups\n (extract_src_dst_ips rs [])))\n (2:49:57 elapsed time, 17:10:49 cpu time, factor 6.06)\n\nmap ipcidr_tuple_to_wordinterval ((mergesort_remdups (extract_src_dst_ips rs [])))\n (2:43:44 elapsed time, 16:57:49 cpu time, factor 6.21)\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups (extract_src_dst_ips rs [])))\n (2:47:37 elapsed time, 16:54:47 cpu time, factor 6.05)\n\nThere is a clear looser: not using mergesort_remdups\nThere is no clear winner. We will just stick to mergesort_remdups.\n\n*)\n\n(*check the the order of mergesort_remdups did not change*)\nlemma \"mergesort_remdups [(1::ipv4addr, 2::nat), (8,0), (8,1), (2,2), (2,4), (1,2), (2,2)] =\n [(1, 2), (2, 2), (2, 4), (8, 0), (8, 1)]\" by eval\n\n\n(*a tail-recursive implementation*)\nfun extract_src_dst_ips\n :: \"'i::len simple_rule list \\ ('i word \\ nat) list \\ ('i word \\ nat) list\" where\n \"extract_src_dst_ips [] ts = ts\" |\n \"extract_src_dst_ips ((SimpleRule m _)#ss) ts = extract_src_dst_ips ss (src m # dst m # ts)\"\n\nlemma extract_src_dst_ips_length: \"length (extract_src_dst_ips rs acc) = 2*length rs + length acc\"\nproof(induction rs arbitrary: acc)\ncase (Cons r rs) thus ?case by(cases r, simp)\nqed(simp)\n\ndefinition extract_IPSets\n :: \"'i::len simple_rule list \\ ('i wordinterval) list\" where\n \"extract_IPSets rs \\ map ipcidr_tuple_to_wordinterval (mergesort_remdups (extract_src_dst_ips rs []))\"\nlemma extract_IPSets:\n \"set (extract_IPSets rs) = set (extract_IPSets_generic0 src rs) \\ set (extract_IPSets_generic0 dst rs)\"\nproof -\n { fix acc\n have \"ipcidr_tuple_to_wordinterval ` set (extract_src_dst_ips rs acc) =\n ipcidr_tuple_to_wordinterval ` set acc \\ set (extract_IPSets_generic0 src rs) \\\n set (extract_IPSets_generic0 dst rs)\"\n proof(induction rs arbitrary: acc)\n case (Cons r rs ) thus ?case\n apply(cases r)\n apply(simp)\n by fast\n qed(simp)\n } thus ?thesis unfolding extract_IPSets_def by(simp_all add: extract_IPSets_def mergesort_remdups_correct)\nqed\n\nlemma \"(a::nat) div 2 + a mod 2 \\ a\" by fastforce\n\nlemma merge_length: \"length (merge l1 l2) \\ length l1 + length l2\"\nby(induction l1 l2 rule: merge.induct) auto\n\nlemma merge_list_length: \"length (merge_list as ls) \\ length (concat (as @ ls))\"\nproof(induction as ls rule: merge_list.induct)\ncase (5 l1 l2 acc2 ls)\n have \"length (merge l2 acc2) \\ length l2 + length acc2\" using merge_length by blast\n with 5 show ?case by simp\nqed(simp_all)\n\nlemma mergesort_remdups_length: \"length (mergesort_remdups as) \\ length as\"\nunfolding mergesort_remdups_def\nproof -\n have \"concat ([] @ (map (\\x. [x]) as)) = as\" by simp\n with merge_list_length show \"length (merge_list [] (map (\\x. [x]) as)) \\ length as\" by metis\nqed\n\nlemma extract_IPSets_length: \"length (extract_IPSets rs) \\ 2 * length rs\"\napply(simp add: extract_IPSets_def)\nusing extract_src_dst_ips_length mergesort_remdups_length by (metis add.right_neutral list.size(3)) \n\n\n(*\nexport_code extract_IPSets in SML\nwhy you no work?\n*)\n\n\nlemma extract_equi0:\n \"set (map wordinterval_to_set (extract_IPSets_generic0 sel rs)) =\n (\\(base,len). ipset_from_cidr base len) ` sel ` match_sel ` set rs\"\n proof(induction rs)\n case (Cons r rs) thus ?case\n apply(cases r, simp)\n using wordinterval_to_set_ipcidr_tuple_to_wordinterval by fastforce\n qed(simp)\n\nlemma src_ipPart_motivation:\nfixes rs\ndefines \"X \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs\"\nassumes \"\\A \\ X. B \\ A \\ B \\ A = {}\" and \"s1 \\ B\" and \"s2 \\ B\"\nshows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\"\nproof -\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\ ?thesis\"\n proof(induction rs)\n case Nil thus ?case by simp\n next\n case (Cons r rs)\n { fix m\n from \\s1 \\ B\\ \\s2 \\ B\\ have \n \"B \\ (case src m of (x, xa) \\ ipset_from_cidr x xa) \\ B \\ (case src m of (x, xa) \n \\ ipset_from_cidr x xa) = {} \\\n simple_matches m (p\\p_src := s1\\) \\ simple_matches m (p\\p_src := s2\\)\"\n apply(cases m)\n apply(rename_tac iiface oiface srca dst proto sports dports)\n apply(case_tac srca)\n apply(simp add: simple_matches.simps)\n by blast\n } note helper=this\n from Cons[simplified] show ?case\n apply(cases r, rename_tac m a)\n apply(simp)\n apply(case_tac a)\n using helper apply force+\n done\n qed\n with assms show ?thesis by blast\nqed\n\n \nlemma src_ipPart:\n assumes \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 src rs))) A\"\n \"B \\ A\" \"s1 \\ B\" \"s2 \\ B\"\n shows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\"\nproof -\n from src_ipPart_motivation[OF _ assms(3) assms(4)]\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\\n simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\" by fast\n thus ?thesis using assms(1) assms(2)\n unfolding ipPartition_def\n by (metis (full_types) Int_commute extract_equi0)\nqed\n \n(*basically a copy of src_ipPart*)\nlemma dst_ipPart:\n assumes \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 dst rs))) A\"\n \"B \\ A\" \"s1 \\ B\" \"s2 \\ B\"\n shows \"simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\nproof -\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` dst ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\\n simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\n proof(induction rs)\n case Nil thus ?case by simp\n next\n case (Cons r rs)\n { fix m\n from \\s1 \\ B\\ \\s2 \\ B\\ have\n \"B \\ (case dst m of (x, xa) \\ ipset_from_cidr x xa) \\ B \\ (case dst m of (x, xa) \n \\ ipset_from_cidr x xa) = {} \\\n simple_matches m (p\\p_dst := s1\\) \\ simple_matches m (p\\p_dst := s2\\)\"\n apply(cases m)\n apply(rename_tac iiface oiface src dsta proto sports dports)\n apply(case_tac dsta)\n apply(simp add: simple_matches.simps)\n by blast\n } note helper=this\n from Cons show ?case\n apply(simp)\n apply(case_tac r, rename_tac m a)\n apply(simp)\n apply(case_tac a)\n using helper apply force+\n done\n qed\n thus ?thesis using assms(1) assms(2)\n unfolding ipPartition_def\n by (metis (full_types) Int_commute extract_equi0)\nqed\n\n\n\n(* OPTIMIZED PARTITIONING *)\n\ndefinition wordinterval_list_to_set :: \"'a::len wordinterval list \\ 'a::len word set\" where\n \"wordinterval_list_to_set ws = \\(set (map wordinterval_to_set ws))\"\n\nlemma wordinterval_list_to_set_compressed:\n \"wordinterval_to_set (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)) =\n wordinterval_list_to_set xs\"\n proof(induction xs)\n qed(simp_all add: wordinterval_compress wordinterval_list_to_set_def)\n\nfun partIps :: \"'a::len wordinterval \\ 'a::len wordinterval list \n \\ 'a::len wordinterval list\" where\n \"partIps _ [] = []\" |\n \"partIps s (t#ts) = (if wordinterval_empty s then (t#ts) else\n (if wordinterval_empty (wordinterval_intersection s t)\n then (t#(partIps s ts))\n else\n (if wordinterval_empty (wordinterval_setminus t s)\n then (t#(partIps (wordinterval_setminus s t) ts))\n else (wordinterval_intersection t s)#((wordinterval_setminus t s)#\n (partIps (wordinterval_setminus s t) ts)))))\"\n\n\nlemma \"partIps (WordInterval (1::ipv4addr) 1) [WordInterval 0 1] = [WordInterval 1 1, WordInterval 0 0]\" by eval\n\nlemma partIps_length: \"length (partIps s ts) \\ (length ts) * 2\"\nproof(induction ts arbitrary: s)\ncase Cons thus ?case \n apply(simp)\n using le_Suc_eq by blast\nqed(simp)\n\nfun partitioningIps :: \"'a::len wordinterval list \\ 'a::len wordinterval list \\\n 'a::len wordinterval list\" where\n \"partitioningIps [] ts = ts\" |\n \"partitioningIps (s#ss) ts = partIps s (partitioningIps ss ts)\"\n\n\nlemma partitioningIps_length: \"length (partitioningIps ss ts) \\ (2^length ss) * length ts\"\nproof(induction ss)\ncase Nil thus ?case by simp\nnext\ncase (Cons s ss)\n have \"length (partIps s (partitioningIps ss ts)) \\ length (partitioningIps ss ts) * 2\"\n using partIps_length by fast\n with Cons show ?case by force\nqed\n\nlemma partIps_equi: \"map wordinterval_to_set (partIps s ts) = \n partList4 (wordinterval_to_set s) (map wordinterval_to_set ts)\"\n proof(induction ts arbitrary: s)\n qed(simp_all)\n\nlemma partitioningIps_equi: \"map wordinterval_to_set (partitioningIps ss ts)\n = (partitioning1 (map wordinterval_to_set ss) (map wordinterval_to_set ts))\"\n apply(induction ss arbitrary: ts)\n apply(simp; fail)\n apply(simp add: partIps_equi)\n done\n\n \ndefinition getParts :: \"'i::len simple_rule list \\ 'i wordinterval list\" where\n \"getParts rs = partitioningIps (extract_IPSets rs) [wordinterval_UNIV]\"\n\nlemma partitioningIps_foldr: \"partitioningIps ss ts = foldr partIps ss ts\"\n by(induction ss) (simp_all)\n\nlemma getParts_foldr: \"getParts rs = foldr partIps (extract_IPSets rs) [wordinterval_UNIV]\"\n by(simp add: getParts_def partitioningIps_foldr)\n\nlemma getParts_length: \"length (getParts rs) \\ 2^(2 * length rs)\"\nproof -\n from partitioningIps_length[where ss=\"extract_IPSets rs\" and ts=\"[wordinterval_UNIV]\"] have\n 1: \"length (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]) \\ 2 ^ length (extract_IPSets rs)\" by simp\n from extract_IPSets_length have \"(2::nat) ^ length (extract_IPSets rs) \\ 2 ^ (2 * length rs)\" by simp\n with 1 have \"length (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]) \\ 2 ^ (2 * length rs)\" by linarith\n thus ?thesis by(simp add: getParts_def) \nqed\n\nlemma getParts_ipPartition: \"ipPartition (set (map wordinterval_to_set (extract_IPSets rs)))\n (set (map wordinterval_to_set (getParts rs)))\"\nproof -\n have hlp_rule: \"{} \\ set (map wordinterval_to_set ts) \\ disjoint_list (map wordinterval_to_set ts) \\ \n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\ \n ipPartition (set (map wordinterval_to_set ss)) \n (set (map wordinterval_to_set (partitioningIps ss ts)))\" for ts ss::\"'a wordinterval list\"\n by (metis ipPartitioning_helper_opt partitioningIps_equi wordinterval_list_to_set_def)\n have \"disjoint_list [UNIV]\" by(simp add: disjoint_list_def disjoint_def)\n have \"ipPartition (set (map wordinterval_to_set ss)) \n (set (map wordinterval_to_set (partitioningIps ss [wordinterval_UNIV])))\"\n for ss::\"'a wordinterval list\"\n apply(rule hlp_rule)\n apply(simp_all add: wordinterval_list_to_set_def \\disjoint_list [UNIV]\\)\n done\n thus ?thesis\n unfolding getParts_def by blast\nqed\n\n\nlemma getParts_complete: \"wordinterval_list_to_set (getParts rs) = UNIV\"\n proof -\n have \"{} \\ set (map wordinterval_to_set ts) \\\n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\ \n wordinterval_list_to_set (partitioningIps ss ts) = (wordinterval_list_to_set ts)\"\n for ss ts::\"'a wordinterval list\"\n using complete_helper by (metis partitioningIps_equi wordinterval_list_to_set_def)\n hence \"wordinterval_list_to_set (getParts rs) = wordinterval_list_to_set [wordinterval_UNIV]\"\n unfolding getParts_def by(simp add: wordinterval_list_to_set_def)\n also have \"\\ = UNIV\" by (simp add: wordinterval_list_to_set_def)\n finally show ?thesis .\nqed\n\ntheorem getParts_samefw: \n assumes \"A \\ set (map wordinterval_to_set (getParts rs))\" \"s1 \\ A\" \"s2 \\ A\" \n shows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\) \\\n simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\nproof -\n let ?X=\"(set (map wordinterval_to_set (getParts rs)))\"\n from getParts_ipPartition have \"ipPartition (set (map wordinterval_to_set (extract_IPSets rs))) ?X\" .\n hence \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 src rs))) ?X \\\n ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 dst rs))) ?X\"\n by(simp add: extract_IPSets ipPartitionUnion image_Un)\n thus ?thesis using assms dst_ipPart src_ipPart by blast\nqed\n\n\nlemma partIps_nonempty: \"ts \\ [] \\ partIps s ts \\ []\"\n by(induction ts arbitrary: s) simp_all\nlemma partitioningIps_nonempty: \"ts \\ [] \\ partitioningIps ss ts \\ []\"\nproof(induction ss arbitrary: ts)\n case Nil thus ?case by simp\n next\n case (Cons s ss) thus ?case\n apply(cases ts)\n apply(simp; fail)\n apply(simp)\n using partIps_nonempty by blast\nqed\n\n(*\nlemma partIps_nonempty: \"\\t \\ set ts. \\ wordinterval_empty t \n \\ {} \\ set (map wordinterval_to_set (partIps s ts))\"\n apply(induction ts arbitrary: s)\n apply(simp; fail)\n apply(simp)\n by blast\n*)\n\nlemma getParts_nonempty: \"getParts rs \\ []\" by(simp add: getParts_def partitioningIps_nonempty)\nlemma getParts_nonempty_elems: \"\\w\\set (getParts rs). \\ wordinterval_empty w\"\n unfolding getParts_def\n proof -\n have partitioning_nonempty: \"\\t \\ set ts. \\ wordinterval_empty t \\\n {} \\ set (map wordinterval_to_set (partitioningIps ss ts))\"\n for ts ss::\"'a wordinterval list\"\n proof(induction ss arbitrary: ts)\n case Nil thus ?case by auto\n case Cons thus ?case by (simp add: partIps_equi partList4_empty)\n qed\n have \"\\t \\ set [wordinterval_UNIV].\\ wordinterval_empty t\" by(simp)\n with partitioning_nonempty have\n \"{} \\ set (map wordinterval_to_set (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]))\" \n by blast\n thus \"\\w\\set (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]). \\ wordinterval_empty w\" by auto\n qed\n\n(* HELPER FUNCTIONS UNIFICATION *)\n\nfun getOneIp :: \"'a::len wordinterval \\ 'a::len word\" where\n \"getOneIp (WordInterval b _) = b\" |\n \"getOneIp (RangeUnion r1 r2) = (if wordinterval_empty r1 then getOneIp r2\n else getOneIp r1)\"\n\nlemma getOneIp_elem: \"\\ wordinterval_empty W \\ wordinterval_element (getOneIp W) W\"\n by (induction W) simp_all\n\nrecord parts_connection = pc_iiface :: string\n pc_oiface :: string\n pc_proto :: primitive_protocol\n pc_sport :: \"16 word\"\n pc_dport :: \"16 word\"\n\n\n\n(* SAME FW DEFINITIONS AND PROOFS *)\n\n\n\ndefinition same_fw_behaviour :: \"\\<^cancel>\\'pkt_ext itself \\\\ 'i::len word \\ 'i word \\ 'i simple_rule list \\ bool\" where\n \"same_fw_behaviour \\<^cancel>\\TYPE('pkt_ext)\\ a b rs \\\n \\(p:: 'i::len simple_packet).\n simple_fw rs (p\\p_src:=a\\) = simple_fw rs (p\\p_src:=b\\) \\\n simple_fw rs (p\\p_dst:=a\\) = simple_fw rs (p\\p_dst:=b\\)\"\n\nlemma getParts_same_fw_behaviour:\n \"A \\ set (map wordinterval_to_set (getParts rs)) \\ s1 \\ A \\ s2 \\ A \\ \n same_fw_behaviour s1 s2 rs\"\n unfolding same_fw_behaviour_def\n using getParts_samefw by blast\n\ndefinition \"runFw s d c rs = simple_fw rs \\p_iiface=pc_iiface c,p_oiface=pc_oiface c,\n p_src=s,p_dst=d,\n p_proto=pc_proto c,\n p_sport=pc_sport c,p_dport=pc_dport c,\n p_tcp_flags={TCP_SYN},\n p_payload=''''\\\"\n\ntext\\We use @{const runFw} for executable code, but in general, everything applies to generic packets\\\ndefinition runFw_scheme :: \"'i::len word \\ 'i word \\ 'b parts_connection_scheme \\\n ('i, 'a) simple_packet_scheme \\ 'i simple_rule list \\ state\"\n where\n\"runFw_scheme s d c p rs = simple_fw rs\n (p\\p_iiface:=pc_iiface c,\n p_oiface:=pc_oiface c,\n p_src:=s,\n p_dst:=d,\n p_proto:=pc_proto c,\n p_sport:=pc_sport c,\n p_dport:=pc_dport c\\)\"\n\nlemma runFw_scheme: \"runFw s d c rs = runFw_scheme s d c p rs\"\n apply(simp add: runFw_def runFw_scheme_def)\n apply(case_tac p)\n apply(simp)\n apply(thin_tac _, simp)\nproof(induction rs)\n case Nil thus ?case by(simp; fail)\nnext\n case(Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r) simp\n from simple_matches_extended_packet[symmetric, of _ \"pc_iiface c\" \"pc_oiface c\"\n s d \"pc_proto c\" \"pc_sport c\" \"pc_dport c\" _ _ _ \"{TCP_SYN}\" \"[]\"]\n have pext: \"simple_matches m\n \\p_iiface = pc_iiface c, p_oiface = pc_oiface c, p_src = s, p_dst = d, p_proto = pc_proto c, p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = tcp_flags2, p_payload = payload2, \\ = aux\\ =\n simple_matches m\n \\p_iiface = pc_iiface c, p_oiface = pc_oiface c, p_src = s, p_dst = d, p_proto = pc_proto c, p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = {TCP_SYN}, p_payload = []\\\" for tcp_flags2 payload2 and aux::'c by fast\n show ?case\n apply(simp add: r, cases a, simp)\n using Cons.IH by(simp add: pext)+\nqed \n\n\nlemma has_default_policy_runFw: \"has_default_policy rs \\ runFw s d c rs = Decision FinalAllow \\ runFw s d c rs = Decision FinalDeny\"\n by(simp add: runFw_def has_default_policy)\n\ndefinition same_fw_behaviour_one :: \"'i::len word \\ 'i word \\ 'a parts_connection_scheme \\ 'i simple_rule list \\ bool\" where\n \"same_fw_behaviour_one ip1 ip2 c rs \\\n \\d s. runFw ip1 d c rs = runFw ip2 d c rs \\ runFw s ip1 c rs = runFw s ip2 c rs\"\n\n\n\ntext\\Is an equivalence relation\\\nlemma same_fw_behaviour_one_equi:\n \"same_fw_behaviour_one x x c rs\"\n \"same_fw_behaviour_one x y c rs = same_fw_behaviour_one y x c rs\"\n \"same_fw_behaviour_one x y c rs \\ same_fw_behaviour_one y z c rs \\ same_fw_behaviour_one x z c rs\"\n unfolding same_fw_behaviour_one_def by metis+\n\nlemma same_fw_behaviour_equi:\n \"same_fw_behaviour x x rs\"\n \"same_fw_behaviour x y rs = same_fw_behaviour y x rs\"\n \"same_fw_behaviour x y rs \\ same_fw_behaviour y z rs \\ same_fw_behaviour x z rs\"\n unfolding same_fw_behaviour_def by auto\n\nlemma runFw_sameFw_behave: \n fixes W :: \"'i::len word set set\"\n shows\n \"\\A \\ W. \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs \\ \\ W = UNIV \\\n \\B \\ W. \\b \\ B. runFw ip1 b c rs = runFw ip2 b c rs \\\n \\B \\ W. \\b \\ B. runFw b ip1 c rs = runFw b ip2 c rs \\\n same_fw_behaviour_one ip1 ip2 c rs\"\nproof -\n assume a1: \"\\A \\ W. \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs\"\n and a2: \"\\ W = UNIV \"\n and a3: \"\\B \\ W. \\b \\ B. runFw ip1 b c rs = runFw ip2 b c rs\"\n and a4: \"\\B \\ W. \\b \\ B. runFw b ip1 c rs = runFw b ip2 c rs\"\n\n \n have relation_lem: \"\\D \\ W. \\d1 \\ D. \\d2 \\ D. \\s. f s d1 = f s d2 \\ \\ W = UNIV \\\n \\B \\ W. \\b \\ B. f s1 b = f s2 b \\\n f s1 d = f s2 d\" for W and f::\"'c \\ 'b \\ 'd\" and s1 d s2\n by (metis UNIV_I Union_iff)\n\n from a1 have a1':\"\\A\\W. \\a1\\A. \\a2\\A. \\s. runFw s a1 c rs = runFw s a2 c rs\"\n unfolding same_fw_behaviour_one_def by fast\n from relation_lem[OF a1' a2 a3] have s1: \"\\ d. runFw ip1 d c rs = runFw ip2 d c rs\" by simp\n\n from a1 have a1'':\"\\A\\W. \\a1\\A. \\a2\\A. \\d. runFw a1 d c rs = runFw a2 d c rs\"\n unfolding same_fw_behaviour_one_def by fast\n from relation_lem[OF a1'' a2 a4] have s2: \"\\ s. runFw s ip1 c rs = runFw s ip2 c rs\" by simp\n from s1 s2 show \"same_fw_behaviour_one ip1 ip2 c rs\"\n unfolding same_fw_behaviour_one_def by fast\nqed\n\nlemma sameFw_behave_sets:\n \"\\w\\set A. \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs \\\n \\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs \\\n \\w1\\set A. \\w2\\set A.\n \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n assume a1: \"\\w\\set A. \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs\" and\n \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n from this have \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n using same_fw_behaviour_one_equi(3) by metis\n from a1 this show \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n using same_fw_behaviour_one_equi(3) by metis\nqed\n \n\n\n\ndefinition groupWIs :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs c rs = (let W = getParts rs in \n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp W))) in\n groupF f W))\"\n\n\n\nlemma groupWIs_not_empty: \"groupWIs c rs \\ []\"\n proof -\n have \"getParts rs \\ []\" by(simp add: getParts_def partitioningIps_nonempty)\n with groupF_empty have \"\\f. groupF f (getParts rs) \\ []\" by blast\n thus ?thesis by(simp add: groupWIs_def Let_def) blast\n qed\nlemma groupWIs_not_empty_elem: \"V \\ set (groupWIs c rs) \\ V \\ []\"\n by(simp add: groupWIs_def Let_def groupF_empty_elem)\nlemma groupWIs_not_empty_elems: \n assumes V: \"V \\ set (groupWIs c rs)\" and w: \"w \\ set V\"\n shows \"\\ wordinterval_empty w\"\n proof -\n have \"\\w\\set (concat (groupWIs c rs)). \\ wordinterval_empty w\"\n apply(subst groupWIs_def)\n apply(subst Let_def)+\n apply(subst groupF_concat_set)\n using getParts_nonempty_elems by blast\n from this V w show ?thesis by auto\n qed\n\nlemma groupParts_same_fw_wi0:\n assumes \"V \\ set (groupWIs c rs)\"\n shows \"\\w \\ set (map wordinterval_to_set V). \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n have \"\\A\\set (map wordinterval_to_set (concat (groupWIs c rs))). \n \\a1\\A. \\a2\\A. same_fw_behaviour_one a1 a2 c rs\"\n apply(subst groupWIs_def)\n apply(subst Let_def)+\n apply(subst set_map)\n apply(subst groupF_concat_set)\n using getParts_same_fw_behaviour same_fw_spec by fastforce\n from this assms show ?thesis by force\nqed\n\nlemma groupWIs_same_fw_not: \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n A \\ B \\\n \\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\nproof -\n assume asm: \"A \\ set (groupWIs c rs)\" \"B \\ set (groupWIs c rs)\" \"A \\ B\"\n from this have b1: \"\\aw \\ set A. \\bw \\ set B.\n (map (\\d. runFw (getOneIp aw) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp aw) c rs) (map getOneIp (getParts rs))) \\\n (map (\\d. runFw (getOneIp bw) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp bw) c rs) (map getOneIp (getParts rs)))\"\n apply(simp add: groupWIs_def Let_def)\n using groupF_nequality by fastforce\n have same_behave_runFw_not:\n \"(map (\\d. runFw x1 d c rs) W, map (\\s. runFw s x1 c rs) W) \\\n (map (\\d. runFw x2 d c rs) W, map (\\s. runFw s x2 c rs) W) \\\n \\ same_fw_behaviour_one x1 x2 c rs\" for x1 x2 W\n by (simp add: same_fw_behaviour_one_def) (blast)\n have \"\\C \\ set (groupWIs c rs). \\c \\ set C. getOneIp c \\ wordinterval_to_set c\"\n apply(simp add: groupWIs_def Let_def)\n using getParts_nonempty_elems groupF_set getOneIp_elem by fastforce\n from this b1 asm have\n \"\\aw \\ set (map wordinterval_to_set A). \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. (map (\\d. runFw a d c rs) (map getOneIp (getParts rs)), map (\\s. runFw s a c rs) (map getOneIp (getParts rs))) \\\n (map (\\d. runFw b d c rs) (map getOneIp (getParts rs)), map (\\s. runFw s b c rs) (map getOneIp (getParts rs)))\"\n by (simp) (blast)\n from this same_behave_runFw_not asm\n have \" \\aw \\ set (map wordinterval_to_set A). \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\" by fast\n from this groupParts_same_fw_wi0[of A c rs] groupParts_same_fw_wi0[of B c rs] asm\n have \"\\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\n apply(simp) using same_fw_behaviour_one_equi(3) by blast\n from this groupParts_same_fw_wi0[of A c rs] groupParts_same_fw_wi0[of B c rs] asm\n show \"\\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\n apply(simp) using same_fw_behaviour_one_equi(3) by fast\nqed\n\n\n\n\n\n(*beginning is copy&paste of previous proof*)\nlemma groupParts_same_fw_wi1:\n \"V \\ set (groupWIs c rs) \\ \\w1 \\ set V. \\w2 \\ set V.\n \\a1 \\ wordinterval_to_set w1. \\a2 \\ wordinterval_to_set w2. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n assume asm: \"V \\ set (groupWIs c rs)\"\n from getParts_same_fw_behaviour same_fw_spec\n have b1: \"\\A \\ set (map wordinterval_to_set (getParts rs)) . \\a1 \\ A. \\a2 \\ A.\n same_fw_behaviour_one a1 a2 c rs\" by fast\n from getParts_complete have complete: \"\\(set (map wordinterval_to_set (getParts rs))) = UNIV\"\n by(simp add: wordinterval_list_to_set_def)\n from getParts_nonempty_elems have nonempty: \"\\w\\set (getParts rs). \\ wordinterval_empty w\" by simp\n\n { fix W x1 x2\n assume a1: \"\\A \\ set (map wordinterval_to_set W). \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs\"\n and a2: \"wordinterval_list_to_set W = UNIV\"\n and a3: \"\\w \\ set W. \\ wordinterval_empty w\"\n and a4: \"(map (\\d. runFw x1 d c rs) (map getOneIp W), map (\\s. runFw s x1 c rs) (map getOneIp W)) =\n (map (\\d. runFw x2 d c rs) (map getOneIp W), map (\\s. runFw s x2 c rs) (map getOneIp W))\"\n from a3 a4 getOneIp_elem\n have b1: \"\\B \\ set (map wordinterval_to_set W). \\b \\ B. runFw x1 b c rs = runFw x2 b c rs\"\n by fastforce\n from a3 a4 getOneIp_elem\n have b2: \"\\B \\ set (map wordinterval_to_set W). \\b \\ B. runFw b x1 c rs = runFw b x2 c rs\"\n by fastforce\n from runFw_sameFw_behave[OF a1 _ b1 b2] a2[unfolded wordinterval_list_to_set_def] have\n \"same_fw_behaviour_one x1 x2 c rs\" by simp\n } note same_behave_runFw=this\n\n from same_behave_runFw[OF b1 getParts_complete nonempty]\n groupF_equality[of \"(\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp (getParts rs))))\"\n \"(getParts rs)\"] asm\n have b2: \"\\a1\\set V. \\a2\\set V. same_fw_behaviour_one (getOneIp a1) (getOneIp a2) c rs\"\n apply(subst (asm) groupWIs_def)\n apply(subst (asm) Let_def)+\n by fast\n from groupWIs_not_empty_elems asm have \"\\w \\ set V. \\ wordinterval_empty w\" by blast\n from this b2 getOneIp_elem\n have b3: \"\\w1\\set (map wordinterval_to_set V). \\w2\\set (map wordinterval_to_set V). \n \\ip1\\ w1. \\ip2\\w2.\n same_fw_behaviour_one ip1 ip2 c rs\" by (simp) (blast)\n from groupParts_same_fw_wi0 asm \n have \"\\A\\set (map wordinterval_to_set V). \\a1\\ A. \\a2\\ A. same_fw_behaviour_one a1 a2 c rs\" \n by metis\n from sameFw_behave_sets[OF this b3]\n show \"\\w1 \\ set V. \\w2 \\ set V.\n \\a1 \\ wordinterval_to_set w1. \\a2 \\ wordinterval_to_set w2. same_fw_behaviour_one a1 a2 c rs\"\n by force\nqed\n\nlemma groupParts_same_fw_wi2: \"V \\ set (groupWIs c rs) \\\n \\ip1 \\ wordinterval_list_to_set V.\n \\ip2 \\ wordinterval_list_to_set V.\n same_fw_behaviour_one ip1 ip2 c rs\"\n using groupParts_same_fw_wi0 groupParts_same_fw_wi1\n apply (simp add: wordinterval_list_to_set_def)\n by fast\n\nlemma groupWIs_same_fw_not2: \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n A \\ B \\\n \\ip1 \\ wordinterval_list_to_set A.\n \\ip2 \\ wordinterval_list_to_set B.\n \\ same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: wordinterval_list_to_set_def)\n using groupWIs_same_fw_not by fastforce\n\n(*I like this version -- corny*)\nlemma \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n \\ip1 \\ wordinterval_list_to_set A.\n \\ip2 \\ wordinterval_list_to_set B. same_fw_behaviour_one ip1 ip2 c rs\n \\ A = B\"\nusing groupWIs_same_fw_not2 by blast\n\n\nlemma groupWIs_complete: \"(\\x\\ set (groupWIs c rs). wordinterval_list_to_set x) = (UNIV::'i::len word set)\"\n proof -\n have \"(\\ y \\ (\\x\\ set (groupWIs c rs). set x). wordinterval_to_set y) = (UNIV::'i word set)\"\n apply(simp add: groupWIs_def Let_def groupF_Union_set)\n using getParts_complete wordinterval_list_to_set_def by fastforce\n thus ?thesis by(simp add: wordinterval_list_to_set_def)\nqed\n\n\n(*begin groupWIs1 and groupWIs2 optimization*)\n definition groupWIs1 :: \"'a parts_connection_scheme \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs1 c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) W,\n map (\\s. runFw s (getOneIp wi) c rs) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P)))))\"\n \n lemma groupWIs_groupWIs1_equi: \"groupWIs1 c rs = groupWIs c rs\"\n apply(subst groupWIs1_def)\n apply(subst groupWIs_def)\n using groupF_tuple by metis\n \n definition simple_conn_matches :: \"'i::len simple_match \\ parts_connection \\ bool\" where\n \"simple_conn_matches m c \\\n (match_iface (iiface m) (pc_iiface c)) \\\n (match_iface (oiface m) (pc_oiface c)) \\\n (match_proto (proto m) (pc_proto c)) \\\n (simple_match_port (sports m) (pc_sport c)) \\\n (simple_match_port (dports m) (pc_dport c))\"\n \n lemma simple_conn_matches_simple_match_any: \"simple_conn_matches simple_match_any c\"\n apply(simp add: simple_conn_matches_def)\n apply(simp add: simple_match_any_def match_ifaceAny)\n apply(subgoal_tac \"(65535::16 word) = max_word\")\n apply(simp)\n by(simp add: max_word_def)\n \n lemma has_default_policy_simple_conn_matches:\n \"has_default_policy rs \\ has_default_policy [r\\rs . simple_conn_matches (match_sel r) c]\"\n apply(induction rs rule: has_default_policy.induct)\n apply(simp; fail)\n apply(simp add: simple_conn_matches_simple_match_any; fail)\n apply(simp)\n apply(intro conjI)\n apply(simp split: if_split_asm; fail)\n apply(simp add: has_default_policy_fst split: if_split_asm)\n done\n \n \n lemma filter_conn_fw_lem: \n \"runFw s d c (filter (\\r. simple_conn_matches (match_sel r) c) rs) = runFw s d c rs\"\n apply(simp add: runFw_def simple_conn_matches_def match_sel_def)\n apply(induction rs \"\\p_iiface = pc_iiface c, p_oiface = pc_oiface c,\n p_src = s, p_dst = d, p_proto = pc_proto c, \n p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = {TCP_SYN},p_payload=''''\\\"\n rule: simple_fw.induct)\n apply(simp add: simple_matches.simps)+\n done\n \n \n (*performance: despite optimization, this function takes quite long and can be optimized*)\n definition groupWIs2 :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs2 c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let filterW = (filter (\\r. simple_conn_matches (match_sel r) c) rs) in\n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c filterW) W,\n map (\\s. runFw s (getOneIp wi) c filterW) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P))))))\"\n \n lemma groupWIs1_groupWIs2_equi: \"groupWIs2 c rs = groupWIs1 c rs\"\n by(simp add: groupWIs2_def groupWIs1_def filter_conn_fw_lem)\n \n \n lemma groupWIs_code[code]: \"groupWIs c rs = groupWIs2 c rs\"\n using groupWIs1_groupWIs2_equi groupWIs_groupWIs1_equi by metis\n(*end groupWIs1 and groupWIs2 optimization*)\n\n\n(*begin groupWIs3 optimization*)\n fun matching_dsts :: \"'i::len word \\ 'i simple_rule list \\ 'i wordinterval \\ 'i wordinterval\" where\n \"matching_dsts _ [] _ = Empty_WordInterval\" |\n \"matching_dsts s ((SimpleRule m Accept)#rs) acc_dropped =\n (if simple_match_ip (src m) s then\n wordinterval_union (wordinterval_setminus (ipcidr_tuple_to_wordinterval (dst m)) acc_dropped) (matching_dsts s rs acc_dropped)\n else\n matching_dsts s rs acc_dropped)\" |\n \"matching_dsts s ((SimpleRule m Drop)#rs) acc_dropped =\n (if simple_match_ip (src m) s then\n matching_dsts s rs (wordinterval_union (ipcidr_tuple_to_wordinterval (dst m)) acc_dropped)\n else\n matching_dsts s rs acc_dropped)\"\n \n lemma matching_dsts_pull_out_accu:\n \"wordinterval_to_set (matching_dsts s rs (wordinterval_union a1 a2)) = wordinterval_to_set (matching_dsts s rs a2) - wordinterval_to_set a1\"\n apply(induction s rs a2 arbitrary: a1 a2 rule: matching_dsts.induct)\n apply(simp_all)\n by blast+\n \n (*a copy of matching_dsts*)\n fun matching_srcs :: \"'i::len word \\ 'i simple_rule list \\ 'i wordinterval \\ 'i wordinterval\" where\n \"matching_srcs _ [] _ = Empty_WordInterval\" |\n \"matching_srcs d ((SimpleRule m Accept)#rs) acc_dropped =\n (if simple_match_ip (dst m) d then\n wordinterval_union (wordinterval_setminus (ipcidr_tuple_to_wordinterval (src m)) acc_dropped) (matching_srcs d rs acc_dropped)\n else\n matching_srcs d rs acc_dropped)\" |\n \"matching_srcs d ((SimpleRule m Drop)#rs) acc_dropped =\n (if simple_match_ip (dst m) d then\n matching_srcs d rs (wordinterval_union (ipcidr_tuple_to_wordinterval (src m)) acc_dropped)\n else\n matching_srcs d rs acc_dropped)\"\n \n lemma matching_srcs_pull_out_accu:\n \"wordinterval_to_set (matching_srcs d rs (wordinterval_union a1 a2)) = wordinterval_to_set (matching_srcs d rs a2) - wordinterval_to_set a1\"\n apply(induction d rs a2 arbitrary: a1 a2 rule: matching_srcs.induct)\n apply(simp_all)\n by blast+\n \n \n lemma matching_dsts: \"\\r \\ set rs. simple_conn_matches (match_sel r) c \\\n wordinterval_to_set (matching_dsts s rs Empty_WordInterval) = {d. runFw s d c rs = Decision FinalAllow}\"\n proof(induction rs)\n case Nil thus ?case by (simp add: runFw_def)\n next\n case (Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r, blast)\n \n from Cons.prems r have simple_match_ip_Accept: \"\\d. simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m Accept # rs) = Decision FinalAllow \\ simple_match_ip (dst m) d \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n { fix d a\n have \"\\ simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m a # rs) = Decision FinalAllow \\ runFw s d c rs = Decision FinalAllow\"\n apply(cases a)\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)+\n } note not_simple_match_ip=this\n \n from Cons.prems r have simple_match_ip_Drop: \"\\d. simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m Drop # rs) = Decision FinalAllow \\ \\ simple_match_ip (dst m) d \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n show ?case\n proof(cases a)\n case Accept with r Cons show ?thesis\n apply(simp, intro conjI impI)\n apply(simp add: simple_match_ip_Accept wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n next\n case Drop with r Cons show ?thesis\n apply(simp,intro conjI impI)\n apply(simp add: simple_match_ip_Drop matching_dsts_pull_out_accu wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n qed\n qed\n lemma matching_srcs: \"\\r \\ set rs. simple_conn_matches (match_sel r) c \\\n wordinterval_to_set (matching_srcs d rs Empty_WordInterval) = {s. runFw s d c rs = Decision FinalAllow}\"\n proof(induction rs)\n case Nil thus ?case by (simp add: runFw_def)\n next\n case (Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r, blast)\n \n from Cons.prems r have simple_match_ip_Accept: \"\\s. simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m Accept # rs) = Decision FinalAllow \\\n simple_match_ip (src m) s \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n { fix s a\n have \"\\ simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m a # rs) = Decision FinalAllow \\ runFw s d c rs = Decision FinalAllow\"\n apply(cases a)\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)+\n } note not_simple_match_ip=this\n \n from Cons.prems r have simple_match_ip_Drop: \"\\s. simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m Drop # rs) = Decision FinalAllow \\\n \\ simple_match_ip (src m) s \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n show ?case\n proof(cases a)\n case Accept with r Cons show ?thesis\n apply(simp, intro conjI impI)\n apply(simp add: simple_match_ip_Accept wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n next\n case Drop with r Cons show ?thesis\n apply(simp,intro conjI impI)\n apply(simp add: simple_match_ip_Drop matching_srcs_pull_out_accu wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n qed\n qed\n \n \n \n (*TODO: if we can get wordinterval_element to log runtime ...*)\n definition groupWIs3_default_policy :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs3_default_policy c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let filterW = (filter (\\r. simple_conn_matches (match_sel r) c) rs) in\n (let f = (\\wi. let mtch_dsts = (matching_dsts (getOneIp wi) filterW Empty_WordInterval);\n mtch_srcs = (matching_srcs (getOneIp wi) filterW Empty_WordInterval) in \n (map (\\d. wordinterval_element d mtch_dsts) W,\n map (\\s. wordinterval_element s mtch_srcs) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P))))))\"\n \n \n lemma groupWIs3_default_policy_groupWIs2:\n fixes rs :: \"'i::len simple_rule list\"\n assumes \"has_default_policy rs\"\n shows \"groupWIs2 c rs = groupWIs3_default_policy c rs\"\n proof -\n { fix filterW s d\n from matching_dsts[where c=c] have \"filterW = filter (\\r. simple_conn_matches (match_sel r) c) rs \\\n wordinterval_element d (matching_dsts s filterW Empty_WordInterval) \\ runFw s d c filterW = Decision FinalAllow\"\n by force\n } note matching_dsts_filterW=this[simplified]\n \n { fix filterW s d\n from matching_srcs[where c=c] have \"filterW = filter (\\r. simple_conn_matches (match_sel r) c) rs \\\n wordinterval_element s (matching_srcs d filterW Empty_WordInterval) \\ runFw s d c filterW = Decision FinalAllow\"\n by force\n } note matching_srcs_filterW=this[simplified]\n \n { fix W and rs :: \"'i::len simple_rule list\"\n assume assms': \"has_default_policy rs\"\n have \"groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs = Decision FinalAllow) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs = Decision FinalAllow) (map getOneIp W))) W =\n groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp W))) W\"\n proof -\n { (*unused fresh generic variables. 'a is used for the tuple already*)\n fix f1::\"'w \\ 'u \\ 'v\" and f2::\" 'w \\ 'u \\ 'x\" and x and y and g1::\"'w \\ 'u \\ 'y\" and g2::\"'w \\ 'u \\ 'z\" and W::\"'u list\"\n assume 1: \"\\w \\ set W. (f1 x) w = (f1 y) w \\ (f2 x) w = (f2 y) w\"\n and 2: \"\\w \\ set W. (g1 x) w = (g1 y) w \\ (g2 x) w = (g2 y) w\"\n have \"\n ((map (f1 x) W, map (g1 x) W) = (map (f1 y) W, map (g1 y) W)) \n \\\n ((map (f2 x) W, map (g2 x) W) = (map (f2 y) W, map (g2 y) W))\"\n proof -\n from 1 have p1: \"(map (f1 x) W = map (f1 y) W \\ map (f2 x) W = map (f2 y) W)\" by(induction W)(simp_all)\n from 2 have p2: \"(map (g1 x) W = map (g1 y) W \\ map (g2 x) W = map (g2 y) W)\" by(induction W)(simp_all)\n from p1 p2 show ?thesis by fast\n qed\n } note map_over_tuples_equal_helper=this\n \n show ?thesis\n apply(rule groupF_cong)\n apply(intro ballI)\n apply(rule map_over_tuples_equal_helper)\n using has_default_policy_runFw[OF assms'] by metis+\n qed\n } note has_default_policy_groupF=this[simplified]\n \n from assms show ?thesis\n apply(simp add: groupWIs3_default_policy_def groupWIs_code[symmetric])\n apply(subst groupF_tuple[symmetric])\n apply(simp add: Let_def)\n apply(simp add: matching_srcs_filterW matching_dsts_filterW)\n apply(subst has_default_policy_groupF)\n apply(simp add: has_default_policy_simple_conn_matches; fail)\n apply(simp add: groupWIs_def Let_def filter_conn_fw_lem)\n done\n qed\n \n \n definition groupWIs3 :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs3 c rs = (if has_default_policy rs then groupWIs3_default_policy c rs else groupWIs2 c rs)\"\n \n lemma groupWIs3: \"groupWIs3 = groupWIs\"\n by(simp add: fun_eq_iff groupWIs3_def groupWIs_code groupWIs3_default_policy_groupWIs2) \n\n(*end groupWIs3 optimization*)\n\n(*construct partitions. main function!*)\ndefinition build_ip_partition :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list\" where\n \"build_ip_partition c rs = map\n (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)))\n (groupWIs3 c rs)\"\n\n\ntheorem build_ip_partition_same_fw: \"V \\ set (build_ip_partition c rs) \\\n \\ip1::'i::len word \\ wordinterval_to_set V.\n \\ip2::'i::len word \\ wordinterval_to_set V.\n same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: build_ip_partition_def groupWIs3)\n using wordinterval_list_to_set_compressed groupParts_same_fw_wi2 wordinterval_sort by blast\n\ntheorem build_ip_partition_same_fw_min: \"A \\ set (build_ip_partition c rs) \\ B \\ set (build_ip_partition c rs) \\ \n A \\ B \\\n \\ip1::'i::len word \\ wordinterval_to_set A.\n \\ip2::'i::len word \\ wordinterval_to_set B.\n \\ same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: build_ip_partition_def groupWIs3)\n using groupWIs_same_fw_not2 wordinterval_list_to_set_compressed wordinterval_sort by blast\n\ntheorem build_ip_partition_complete: \"(\\x\\set (build_ip_partition c rs). wordinterval_to_set x) = (UNIV :: 'i::len word set)\"\n proof -\n have \"wordinterval_to_set (foldr wordinterval_union x Empty_WordInterval) = \\(set (map wordinterval_to_set x))\"\n for x::\"'i wordinterval list\"\n by(induction x) simp_all\n thus ?thesis\n apply(simp add: build_ip_partition_def groupWIs3 wordinterval_compress wordinterval_sort)\n using groupWIs_complete[simplified wordinterval_list_to_set_def] by simp\n qed\n\n\n\nlemma build_ip_partition_no_empty_elems: \"wi \\ set (build_ip_partition c rs) \\ \\ wordinterval_empty wi\"\n proof -\n assume \"wi \\ set (build_ip_partition c rs)\"\n hence assm: \"wi \\ (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval))) ` set (groupWIs c rs)\"\n by(simp add: build_ip_partition_def groupWIs3)\n from assm obtain wi_orig where 1: \"wi_orig \\ set (groupWIs c rs)\" and\n 2: \"wi = wordinterval_sort (wordinterval_compress (foldr wordinterval_union wi_orig Empty_WordInterval))\" by blast\n from 1 groupWIs_not_empty_elem have i1: \"wi_orig \\ []\" by blast\n from 1 groupWIs_not_empty_elems have i2: \"\\w. w \\ set wi_orig \\ \\ wordinterval_empty w\" by simp\n from i1 i2 have \"wordinterval_to_set (foldr wordinterval_union wi_orig Empty_WordInterval) \\ {}\"\n by(induction wi_orig) simp_all\n with 2 show ?thesis by(simp add: wordinterval_compress wordinterval_sort)\n qed\n\n\nlemma build_ip_partition_disjoint: \n \"V1 \\ set (build_ip_partition c rs) \\ V2 \\ set (build_ip_partition c rs) \\\n V1 \\ V2 \\\n wordinterval_to_set V1 \\ wordinterval_to_set V2 = {}\"\n by (meson build_ip_partition_same_fw_min int_not_emptyD same_fw_behaviour_one_equi(1))\n\n\nlemma map_wordinterval_to_set_distinct:\n assumes distinct: \"distinct xs\"\n and disjoint: \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2 = {})\" \n and notempty: \"\\x \\ set xs. \\ wordinterval_empty x\"\n shows \"distinct (map wordinterval_to_set xs)\"\n proof -\n have \"\\ wordinterval_empty x1 \\ \n wordinterval_to_set x1 \\ wordinterval_to_set x2 = {} \\ \n wordinterval_to_set x1 \\ wordinterval_to_set x2\" for x1::\"('b::len) wordinterval\" and x2\n by auto\n with disjoint notempty have \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2)\"\n by force\n with distinct show \"distinct (map wordinterval_to_set xs)\"\n proof(induction xs)\n case Cons thus ?case by simp fast\n qed(simp)\n qed\n\nlemma map_getOneIp_distinct: assumes\n distinct: \"distinct xs\"\n and disjoint: \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2 = {})\" \n and notempty: \"\\x \\ set xs. \\ wordinterval_empty x\"\n shows \"distinct (map getOneIp xs)\"\n proof -\n have \"\\ wordinterval_empty x \\ \\ wordinterval_empty xa \\ \n wordinterval_to_set x \\ wordinterval_to_set xa = {} \\ getOneIp x \\ getOneIp xa\"\n for x xa::\"'b::len wordinterval\"\n by(fastforce dest: getOneIp_elem)\n with disjoint notempty have \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ getOneIp x1 \\ getOneIp x2)\"\n by metis\n with distinct show ?thesis\n proof(induction xs)\n case Cons thus ?case by simp fast\n qed(simp)\n qed\n\n\nlemma getParts_disjoint_list: \"disjoint_list (map wordinterval_to_set (getParts rs))\"\nproof-\n have disjoint_list_partitioningIps: \n \"{} \\ set (map wordinterval_to_set ts) \\ disjoint_list (map wordinterval_to_set ts) \\ \n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\\n disjoint_list (map wordinterval_to_set (partitioningIps ss ts))\"\n for ts::\"'a::len wordinterval list\" and ss\n by (simp add: partitioning1_disjoint_list partitioningIps_equi wordinterval_list_to_set_def)\n have \"{} \\ set (map wordinterval_to_set [wordinterval_UNIV])\"\n and \"disjoint_list (map wordinterval_to_set [wordinterval_UNIV])\"\n and \"wordinterval_list_to_set (extract_IPSets rs) \\ wordinterval_list_to_set [wordinterval_UNIV]\"\n by(simp add: wordinterval_list_to_set_def disjoint_list_def disjoint_def)+\n thus ?thesis\n unfolding getParts_def by(rule disjoint_list_partitioningIps)\nqed\n\nlemma build_ip_partition_distinct: \"distinct (map wordinterval_to_set (build_ip_partition c rs))\"\nproof -\n have \n \"(wordinterval_to_set \\ (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)))) ws\n = \\(set (map wordinterval_to_set ws))\" for ws::\"'a::len wordinterval list\"\n proof(induction ws)\n qed(simp_all add: wordinterval_compress wordinterval_sort)\n hence hlp1: \"map wordinterval_to_set (build_ip_partition c rs) =\n map (\\x. \\(set (map wordinterval_to_set x))) (groupWIs c rs)\"\n unfolding build_ip_partition_def groupWIs3 by auto\n\n \\ \\generic rule\\\n have \"\\x \\ set xs. \\ wordinterval_empty x \\\n disjoint_list (map wordinterval_to_set xs) \\\n distinct (map (\\x. \\(set (map wordinterval_to_set x))) (groupF f xs))\"\n for f::\"'x::len wordinterval \\ 'y\" and xs::\"'x::len wordinterval list\"\n proof(induction f xs rule: groupF.induct)\n case 1 thus ?case by simp\n next\n case (2 f x xs)\n have hlp_internal:\n \"\\ (set (map (\\x. \\(set (map wordinterval_to_set x))) (groupF f xs))) =\n \\ (set (map wordinterval_to_set xs))\" for f::\"'x wordinterval \\ 'y\" and xs\n by(induction f xs rule: groupF.induct) (auto)\n\n from 2(2,3) have \"wordinterval_to_set x \\ \\(wordinterval_to_set ` set xs) = {}\"\n by(auto simp add: disjoint_def disjoint_list_def)\n hence \"\\ (wordinterval_to_set x) \\ \\(wordinterval_to_set ` set xs)\" using 2(2) by auto\n hence \"\\ wordinterval_to_set x \\ \\(set (map wordinterval_to_set [y\\xs . f x \\ f y]))\" by auto\n hence \"\\ wordinterval_to_set x \\ (\\x\\{xa \\ set xs. f x = f xa}.\n wordinterval_to_set x) \\ \\ (set (map (\\x. \\(set (map wordinterval_to_set x))) (groupF f [y\\xs . f x \\ f y])))\" \n unfolding hlp_internal by blast\n hence g1: \"wordinterval_to_set x \\ (\\x\\{xa \\ set xs. f x = f xa}. wordinterval_to_set x)\n \\ (\\x. \\x\\set x. wordinterval_to_set x) ` set (groupF f [y\\xs . f x \\ f y])\" by force\n \n from 2(3) have \"distinct (map wordinterval_to_set [y\\xs . f x \\ f y])\"\n by (simp add: disjoint_list_def distinct_map_filter) \n moreover from 2 have \"disjoint (wordinterval_to_set ` {xa \\ set xs. f x \\ f xa})\"\n by(simp add: disjoint_def disjoint_list_def)\n ultimately have g2: \"distinct (map (\\x. \\x\\set x. wordinterval_to_set x) (groupF f [y\\xs . f x \\ f y]))\"\n using 2(1,2) unfolding disjoint_list_def by(simp)\n\n from g1 g2 show ?case by simp\n qed\n with getParts_disjoint_list getParts_nonempty_elems have\n \"distinct\n (map (\\x. \\(set (map wordinterval_to_set x)))\n (groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp (getParts rs))))\n (getParts rs)))\" by blast\n\n thus ?thesis unfolding hlp1 groupWIs_def Let_def by presburger\nqed\n\nlemma build_ip_partition_distinct': \"distinct (build_ip_partition c rs)\"\n using build_ip_partition_distinct distinct_mapI by blast\n\n\nsubsection\\Service Matrix over an IP Address Space Partition\\\n\n\ndefinition simple_firewall_without_interfaces :: \"'i::len simple_rule list \\ bool\" where\n \"simple_firewall_without_interfaces rs \\ \\m \\ match_sel ` set rs. iiface m = ifaceAny \\ oiface m = ifaceAny\"\n\nlemma simple_fw_no_interfaces:\n assumes no_ifaces: \"simple_firewall_without_interfaces rs\"\n shows \"simple_fw rs p = simple_fw rs (p\\ p_iiface:= x, p_oiface:= y\\)\"\nproof -\n from no_ifaces have \"\\r\\set rs. iiface (match_sel r) = ifaceAny \\ oiface (match_sel r) = ifaceAny\"\n by(simp add: simple_firewall_without_interfaces_def)\n thus ?thesis apply(induction rs p rule:simple_fw.induct)\n by(simp_all add: simple_matches.simps match_ifaceAny)\nqed\n \nlemma runFw_no_interfaces:\n assumes no_ifaces: \"simple_firewall_without_interfaces rs\"\n shows \"runFw s d c rs = runFw s d (c\\ pc_iiface:= x, pc_oiface:= y\\) rs\"\n apply(simp add: runFw_def)\n apply(subst simple_fw_no_interfaces[OF no_ifaces])\n by(simp)\n\n\n\n(*only defined for simple_firewall_without_interfaces*)\ndefinition access_matrix \n :: \"parts_connection \\ 'i::len simple_rule list \\ ('i word \\ 'i wordinterval) list \\ ('i word \\ 'i word) list\" \n where\n \"access_matrix c rs \\\n (let W = build_ip_partition c rs;\n R = map getOneIp W\n in\n (zip R W, [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_nodes_defined:\n \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ s \\ dom (map_of V)\" and\n \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ d \\ dom (map_of V)\"\n by(auto simp add: access_matrix_def Let_def all_pairs_def)\n\ntext\\For all the entries @{term E} of the matrix, the access is allowed\\\nlemma \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ runFw s d c rs = Decision FinalAllow\"\n by(auto simp add: access_matrix_def Let_def)\ntext\\However, the entries are only a representation of a whole set of IP addresses. \n For all IP addresses which the entries represent, the access must be allowed.\\\n\n\n(*TODO: move to generic library*)\nlemma map_of_zip_map: \"map_of (zip (map f rs) rs) k = Some v \\ k = f v\"\n apply(induction rs)\n apply(simp)\n apply(simp split: if_split_asm)\n done\n\nlemma access_matrix_sound: assumes matrix: \"(V,E) = access_matrix c rs\" and\n repr: \"(s_repr, d_repr) \\ set E\" and\n s_range: \"(map_of V) s_repr = Some s_range\" and s: \"s \\ wordinterval_to_set s_range\" and\n d_range: \"(map_of V) d_repr = Some d_range\" and d: \"d \\ wordinterval_to_set d_range\"\n shows \"runFw s d c rs = Decision FinalAllow\"\n proof -\n let ?part=\"(build_ip_partition c rs)\"\n have V: \"V = (zip (map getOneIp ?part) ?part)\"\n using matrix by(simp add: access_matrix_def Let_def)\n (*have \"E = [(s, d)\\all_pairs (map getOneIp ?part). runFw s d c rs = Decision FinalAllow]\"\n using matrix by(simp add: access_matrix_def Let_def)\n with repr have \"(s_repr, d_repr) \\ set (all_pairs (map getOneIp ?part))\" by simp\n hence \"s_repr \\ set (map getOneIp ?part)\" and\n \"d_repr \\ set (map getOneIp ?part)\"\n by(simp add: all_pairs_set)+*)\n (*from s_range have \"(s_repr, s_range) \\ set V\" by (simp add: map_of_SomeD)*)\n\n from matrix repr have repr_Allow: \"runFw s_repr d_repr c rs = Decision FinalAllow\"\n by(auto simp add: access_matrix_def Let_def)\n\n have s_range_in_part: \"s_range \\ set ?part\" using V s_range by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n with build_ip_partition_no_empty_elems have \"\\ wordinterval_empty s_range\" by simp\n\n have d_range_in_part: \"d_range \\ set ?part\" using V d_range by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n with build_ip_partition_no_empty_elems have \"\\ wordinterval_empty d_range\" by simp\n\n from map_of_zip_map V s_range have \"s_repr = getOneIp s_range\" by fast\n with \\\\ wordinterval_empty s_range\\ getOneIp_elem wordinterval_element_set_eq \n have \"s_repr \\ wordinterval_to_set s_range\" by blast \n\n from map_of_zip_map V d_range have \"d_repr = getOneIp d_range\" by fast\n with \\\\ wordinterval_empty d_range\\ getOneIp_elem wordinterval_element_set_eq \n have \"d_repr \\ wordinterval_to_set d_range\" by blast \n\n from s_range_in_part have s_range_in_part': \"s_range \\ set (build_ip_partition c rs)\" by simp\n from d_range_in_part have d_range_in_part': \"d_range \\ set (build_ip_partition c rs)\" by simp\n\n from build_ip_partition_same_fw[OF s_range_in_part', unfolded same_fw_behaviour_one_def] s\n \\s_repr \\ wordinterval_to_set s_range\\ have \n \"\\d. runFw s_repr d c rs = runFw s d c rs\" by blast\n with repr_Allow have 1: \"runFw s d_repr c rs = Decision FinalAllow\" by simp\n\n from build_ip_partition_same_fw[OF d_range_in_part', unfolded same_fw_behaviour_one_def] d\n \\d_repr \\ wordinterval_to_set d_range\\ have \n \"\\s. runFw s d_repr c rs = runFw s d c rs\" by blast\n with 1 have 2: \"runFw s d c rs = Decision FinalAllow\" by simp\n thus ?thesis .\nqed\n\n\nlemma distinct_map_getOneIp_obtain: \"v \\ set xs \\ distinct (map getOneIp xs) \\ \n \\s_repr. map_of (zip (map getOneIp xs) xs) s_repr = Some v\"\n proof(induction xs)\n case Nil thus ?case by simp\n next\n case (Cons x xs)\n consider \"v = x\" | \"v \\ set xs\" using Cons.prems(1) by fastforce\n thus ?case\n proof(cases)\n case 1 thus ?thesis by simp blast\n next\n case 2 with Cons.IH Cons.prems(2) obtain s_repr where\n s_repr: \"map_of (zip (map getOneIp xs) xs) s_repr = Some v\" by force\n show ?thesis\n proof(cases \"s_repr \\ getOneIp x\")\n case True with Cons.prems s_repr show ?thesis by(rule_tac x=s_repr in exI, simp)\n next\n case False with Cons.prems s_repr show ?thesis by(fastforce elim: in_set_zipE)\n qed\n qed\n qed\n\n\nlemma access_matrix_complete:\n fixes rs :: \"'i::len simple_rule list\"\n assumes matrix: \"(V,E) = access_matrix c rs\" and\n allow: \"runFw s d c rs = Decision FinalAllow\"\n shows \"\\s_repr d_repr s_range d_range. (s_repr, d_repr) \\ set E \\\n (map_of V) s_repr = Some s_range \\ s \\ wordinterval_to_set s_range \\\n (map_of V) d_repr = Some d_range \\ d \\ wordinterval_to_set d_range\"\n proof -\n let ?part=\"(build_ip_partition c rs)\"\n have V: \"V = zip (map getOneIp ?part) ?part\"\n using matrix by(simp add: access_matrix_def Let_def)\n have E: \"E = [(s, d)\\all_pairs (map getOneIp ?part). runFw s d c rs = Decision FinalAllow]\"\n using matrix by(simp add: access_matrix_def Let_def)\n\n have build_ip_partition_obtain:\n \"\\V. V \\ set (build_ip_partition c rs) \\ s \\ wordinterval_to_set V\" for s\n using build_ip_partition_complete by blast\n\n have distinct_map_getOneIp_build_ip_partition_obtain:\n \"v \\ set (build_ip_partition c rs) \\\n \\s_repr. map_of (zip (map getOneIp (build_ip_partition c rs)) (build_ip_partition c rs)) s_repr = Some v\"\n for v and rs :: \"'i::len simple_rule list\"\n proof(erule distinct_map_getOneIp_obtain)\n show \"distinct (map getOneIp (build_ip_partition c rs))\" \n apply(rule map_getOneIp_distinct)\n subgoal using build_ip_partition_distinct' by blast\n subgoal using build_ip_partition_disjoint build_ip_partition_distinct' by blast\n subgoal using build_ip_partition_no_empty_elems[simplified] by auto\n done\n qed\n\n from build_ip_partition_obtain obtain s_range where\n \"s_range \\ set ?part\" and \"s \\ wordinterval_to_set s_range\" by blast\n from this distinct_map_getOneIp_build_ip_partition_obtain V obtain s_repr where\n ex_s1: \"(map_of V) s_repr = Some s_range\" and ex_s2: \"s \\ wordinterval_to_set s_range\"\n by blast\n\n\n from build_ip_partition_obtain obtain d_range where\n \"d_range \\ set ?part\" and \"d \\ wordinterval_to_set d_range\" by blast\n from this distinct_map_getOneIp_build_ip_partition_obtain V obtain d_repr where\n ex_d1: \"(map_of V) d_repr = Some d_range\" and ex_d2: \"d \\ wordinterval_to_set d_range\"\n by blast\n\n have 1: \"s_repr \\ getOneIp ` set (build_ip_partition c rs)\"\n using V \\map_of V s_repr = Some s_range\\ by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n have 2: \"d_repr \\ getOneIp ` set (build_ip_partition c rs)\"\n using V \\map_of V d_repr = Some d_range\\ by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n\n have \"runFw s_repr d_repr c rs = Decision FinalAllow\"\n proof -\n have f1: \"(\\w wa p ss. \\ same_fw_behaviour_one w wa (p::parts_connection) ss \\\n (\\wb wc. runFw w wb p ss = runFw wa wb p ss \\ runFw wc w p ss = runFw wc wa p ss)) \\\n (\\w wa p ss. (\\wb wc. runFw w wb (p::parts_connection) ss \\ runFw wa wb p ss \\ runFw wc w p ss \\ runFw wc wa p ss) \\\n same_fw_behaviour_one w wa p ss)\"\n unfolding same_fw_behaviour_one_def by blast\n from \\s_range \\ set (build_ip_partition c rs)\\ have f2: \"same_fw_behaviour_one s s_repr c rs\"\n by (metis (no_types) map_of_zip_map V build_ip_partition_no_empty_elems\n build_ip_partition_same_fw ex_s1 ex_s2 getOneIp_elem wordinterval_element_set_eq)\n from \\d_range \\ set (build_ip_partition c rs)\\ have \"same_fw_behaviour_one d_repr d c rs\"\n by (metis (no_types) map_of_zip_map V build_ip_partition_no_empty_elems\n build_ip_partition_same_fw ex_d1 ex_d2 getOneIp_elem wordinterval_element_set_eq)\n with f1 f2 show ?thesis\n using allow by metis\n qed\n \n hence ex1: \"(s_repr, d_repr) \\ set E\" by(simp add: E all_pairs_set 1 2)\n \n thus ?thesis using ex1 ex_s1 ex_s2 ex_d1 ex_d2 by blast \nqed\n\n\ntheorem access_matrix:\n fixes rs :: \"'i::len simple_rule list\"\n assumes matrix: \"(V,E) = access_matrix c rs\"\n shows \"(\\s_repr d_repr s_range d_range. (s_repr, d_repr) \\ set E \\\n (map_of V) s_repr = Some s_range \\ s \\ wordinterval_to_set s_range \\\n (map_of V) d_repr = Some d_range \\ d \\ wordinterval_to_set d_range)\n \\\n runFw s d c rs = Decision FinalAllow\"\nusing matrix access_matrix_sound access_matrix_complete by blast\n\ntext\\\nFor a @{typ \"'i::len simple_rule list\"} and a fixed @{typ parts_connection}, \nwe support to partition the IP address space; for IP addresses of arbitrary length (eg., IPv4, IPv6).\n\nAll members of a partition have the same access rights:\n@{thm build_ip_partition_same_fw [no_vars]}\n\nMinimal:\n@{thm build_ip_partition_same_fw_min [no_vars]}\n\n\nThe resulting access control matrix is sound and complete:\n\n@{thm access_matrix [no_vars]}\n\nTheorem reads: \nFor a fixed connection, you can look up IP addresses (source and destination pairs) in the matrix \nif and only if the firewall accepts this src,dst IP address pair for the fixed connection.\nNote: The matrix is actually a graph (nice visualization!), you need to look up IP addresses \nin the Vertices and check the access of the representants in the edges. If you want to visualize\nthe graph (e.g. with Graphviz or tkiz): The vertices are the node description (i.e. header; \n @{term \"dom V\"} is the label for each node which will also be referenced in the edges,\n @{term \"ran V\"} is the human-readable description for each node (i.e. the full IP range it represents)), \nthe edges are the edges. Result looks nice. Theorem also tells us that this visualization is correct.\n\\\n\n\n\n\n(*construct an ip partition and print it in some usable format\n returns:\n (vertices, edges) where\n vertices = (name, list of ip addresses this vertex corresponds to)\n and edges = (name \\ name) list\n\n Note that the WordInterval is already sorted, which is important for prettyness!\n*)\ntext\\Only defined for @{const simple_firewall_without_interfaces}\\\ndefinition access_matrix_pretty_ipv4\n :: \"parts_connection \\ 32 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv4 c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let (V,E) = (access_matrix c rs);\n formatted_nodes =\n map (\\(v_repr, v_range). (ipv4addr_toString v_repr, ipv4addr_wordinterval_toString v_range)) V;\n formatted_edges =\n map (\\(s,d). (ipv4addr_toString s, ipv4addr_toString d)) E\n in\n (formatted_nodes, formatted_edges)\n )\"\n\ndefinition access_matrix_pretty_ipv4_code\n :: \"parts_connection \\ 32 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv4_code c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let W = build_ip_partition c rs;\n R = map getOneIp W;\n U = all_pairs R\n in\n (zip (map ipv4addr_toString R) (map ipv4addr_wordinterval_toString W), \n map (\\(x,y). (ipv4addr_toString x, ipv4addr_toString y)) [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_pretty_ipv4_code[code]: \"access_matrix_pretty_ipv4 = access_matrix_pretty_ipv4_code\"\n by(simp add: fun_eq_iff access_matrix_pretty_ipv4_def access_matrix_pretty_ipv4_code_def Let_def access_matrix_def map_prod_fun_zip)\n\n\ndefinition access_matrix_pretty_ipv6\n :: \"parts_connection \\ 128 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv6 c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let (V,E) = (access_matrix c rs);\n formatted_nodes =\n map (\\(v_repr, v_range). (ipv6addr_toString v_repr, ipv6addr_wordinterval_toString v_range)) V;\n formatted_edges =\n map (\\(s,d). (ipv6addr_toString s, ipv6addr_toString d)) E\n in\n (formatted_nodes, formatted_edges)\n )\"\n\ndefinition access_matrix_pretty_ipv6_code\n :: \"parts_connection \\ 128 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv6_code c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let W = build_ip_partition c rs;\n R = map getOneIp W;\n U = all_pairs R\n in\n (zip (map ipv6addr_toString R) (map ipv6addr_wordinterval_toString W), \n map (\\(x,y). (ipv6addr_toString x, ipv6addr_toString y)) [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_pretty_ipv6_code[code]: \"access_matrix_pretty_ipv6 = access_matrix_pretty_ipv6_code\"\n by(simp add: fun_eq_iff access_matrix_pretty_ipv6_def access_matrix_pretty_ipv6_code_def Let_def access_matrix_def map_prod_fun_zip)\n\n \n\ndefinition parts_connection_ssh where\n \"parts_connection_ssh \\ \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP, pc_sport=10000, pc_dport=22\\\"\n\ndefinition parts_connection_http where\n \"parts_connection_http \\ \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP, pc_sport=10000, pc_dport=80\\\"\n\n\ndefinition mk_parts_connection_TCP :: \"16 word \\ 16 word \\ parts_connection\" where\n \"mk_parts_connection_TCP sport dport = \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP,\n pc_sport=sport, pc_dport=dport\\\"\n\nlemma \"mk_parts_connection_TCP 10000 22 = parts_connection_ssh\"\n \"mk_parts_connection_TCP 10000 80 = parts_connection_http\"\n by(simp_all add: mk_parts_connection_TCP_def parts_connection_ssh_def parts_connection_http_def)\n\n\nvalue[code] \"partitioningIps [WordInterval (0::ipv4addr) 0] [WordInterval 0 2, WordInterval 0 2]\"\n\n\ntext_raw\\\nHere is an example of a really large and complicated firewall:\n\n\n\\begin{figure}\n\\centering\n\\resizebox{\\linewidth}{!}{%\n\\tikzset{every loop/.style={looseness=1}}\n\\tikzset{myptr/.style={decoration={markings,mark=at position 1 with %\n {\\arrow[scale=2,>=latex]{>}}},shorten >=0.1cm,shorten <=0.2cm, postaction={decorate}}}%\n\\tikzset{myloop/.style={-to}}%\n\\begin{tikzpicture}\n\\node (m) at (2,-2) {$\\{224.0.0.0 .. 239.255.255.255\\}$};\n\n\\node[align=left] (inet) at (-3,8.5) {$\\{0.0.0.0 .. 126.255.255.255\\} \\cup \\{128.0.0.0 .. 131.159.13.255\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{131.159.16.0 .. 131.159.19.255\\} \\cup \\{131.159.22.0 .. 138.246.253.4\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{138.246.253.11 .. 185.86.231.255\\} \\cup \\{185.86.236.0 .. 188.1.239.85\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{188.1.239.87 .. 188.95.232.63\\} \\cup \\{188.95.232.224 .. 188.95.232.255\\} \\cup $\\\\\n\t\t\t\t\t\t\t\t\t $ \\{188.95.240.0 .. 192.48.106.255\\} \\cup \\{192.48.108.0 .. 223.255.255.255\\} \\cup $\\\\\n\t\t\t\t\t\t\t\t\t $ \\{240.0.0.0 .. 255.255.255.255\\}$};\n\\node[align=left] (internal) at (-5,-10) {$\\{131.159.14.0 .. 131.159.14.7\\} \\cup \\{131.159.14.12 .. 131.159.14.25\\} \\cup $ \\\\ \n$ 131.159.14.27 \\cup \\{131.159.14.29 .. 131.159.14.33\\} \\cup $ \\\\ \n$ \\{131.159.14.38 .. 131.159.14.39\\} \\cup 131.159.14.41 \\cup $ \\\\ \n$ \\{131.159.14.43 .. 131.159.14.51\\} \\cup \\{131.159.14.53 .. 131.159.14.55\\} \\cup $ \\\\ \n$ \\{131.159.14.57 .. 131.159.14.59\\} \\cup \\{131.159.14.61 .. 131.159.14.68\\} \\cup $ \\\\ \n$ 131.159.14.70 .. 131.159.14.82\\} \\cup \\{131.159.14.84 .. 131.159.14.103\\} \\cup $ \\\\ \n$ \\{131.159.14.105 .. 131.159.14.124\\} \\cup \\{131.159.14.126 .. 131.159.14.136\\} \\cup $ \\\\ \n$ \\{131.159.14.138 .. 131.159.14.139\\} \\cup \\{131.159.14.141 .. 131.159.14.144\\} \\cup $ \\\\ \n$ \\{131.159.14.147 .. 131.159.14.154\\} \\cup \\{131.159.14.157 .. 131.159.14.162\\} \\cup $ \\\\ \n$ \\{131.159.14.164 .. 131.159.14.168\\} \\cup \\{131.159.14.170 .. 131.159.14.200\\} \\cup $ \\\\ \n$ \\{131.159.14.202 .. 131.159.14.213\\} \\cup \\{131.159.14.215 .. 131.159.15.4\\} \\cup $ \\\\ \n$ 131.159.15.6 \\cup \\{131.159.15.14 .. 131.159.15.15\\} \\cup $ \\\\ \n$ \\{131.159.15.21 .. 131.159.15.22\\} \\cup 131.159.15.26 \\cup 131.159.15.28 \\cup $ \\\\ \n$ 131.159.15.30 \\cup \\{131.159.15.33 .. 131.159.15.35\\} \\cup $ \\\\ \n$ \\{131.159.15.37 .. 131.159.15.38\\} \\cup 131.159.15.40 \\cup $ \\\\ \n$ \\{131.159.15.45 .. 131.159.15.46\\} \\cup \\{131.159.15.48 .. 131.159.15.49\\} \\cup $ \\\\ \n$ \\{131.159.15.52 .. 131.159.15.55\\} \\cup 131.159.15.57 \\cup 131.159.15.59 \\cup $ \\\\ \n$ \\{131.159.15.61 .. 131.159.15.67\\} \\cup \\{131.159.15.70 .. 131.159.15.196\\} \\cup $ \\\\ \n$ \\{131.159.15.198 .. 131.159.15.227\\} \\cup \\{131.159.15.229 .. 131.159.15.233\\} \\cup $ \\\\ \n$ \\{131.159.15.235 .. 131.159.15.246\\} \\cup \\{131.159.15.250 .. 131.159.15.255\\} \\cup $ \\\\ \n$ \\{131.159.20.0 .. 131.159.20.20\\} \\cup \\{131.159.20.22 .. 131.159.20.28\\} \\cup $ \\\\ \n$ \\{131.159.20.30 .. 131.159.20.35\\} \\cup \\{131.159.20.37 .. 131.159.20.44\\} \\cup $ \\\\ \n$ \\{131.159.20.46 .. 131.159.20.51\\} \\cup \\{131.159.20.53 .. 131.159.20.58\\} \\cup $ \\\\ \n$ \\{131.159.20.60 .. 131.159.20.62\\} \\cup \\{131.159.20.64 .. 131.159.20.70\\} \\cup $ \\\\ \n$ \\{131.159.20.72 .. 131.159.20.73\\} \\cup \\{131.159.20.75 .. 131.159.20.84\\} \\cup $ \\\\ \n$ \\{131.159.20.86 .. 131.159.20.96\\} \\cup \\{131.159.20.98 .. 131.159.20.119\\} \\cup $ \\\\ \n$ \\{131.159.20.121 .. 131.159.20.138\\} \\cup \\{131.159.20.140 .. 131.159.20.149\\} \\cup $ \\\\ \n$ \\{131.159.20.152 .. 131.159.20.154\\} \\cup \\{131.159.20.156 .. 131.159.20.159\\} \\cup $ \\\\ \n$ \\{131.159.20.161 .. 131.159.20.164\\} \\cup \\{131.159.20.167 .. 131.159.20.179\\} \\cup $ \\\\ \n$ \\{131.159.20.181 .. 131.159.20.184\\} \\cup \\{131.159.20.186 .. 131.159.20.199\\} \\cup $ \\\\ \n$ \\{131.159.20.201 .. 131.159.20.232\\} \\cup \\{131.159.20.235 .. 131.159.20.255\\} \\cup $ \\\\ \n$ \\{185.86.232.0 .. 185.86.235.255\\} \\cup \\{188.95.233.0 .. 188.95.233.3\\} \\cup $ \\\\ \n$ \\{188.95.233.5 .. 188.95.233.8\\} \\cup \\{188.95.233.10 .. 188.95.233.255\\} \\cup $ \\\\ \n$ \\{192.48.107.0 .. 192.48.107.255\\}$}; \n\n\\node[align=left] (srvs) at (10,0) {$\\{131.159.14.8 .. 131.159.14.11\\} \\cup 131.159.14.26 \\cup 131.159.14.28 \\cup $ \\\\ \n$ \\{131.159.14.34 .. 131.159.14.37\\} \\cup 131.159.14.40 \\cup 131.159.14.42 \\cup $ \\\\ \n$ 131.159.14.52 \\cup 131.159.14.56 \\cup 131.159.14.60 \\cup 131.159.14.69 \\cup $ \\\\ \n$ 131.159.14.83 \\cup 131.159.14.104 \\cup 131.159.14.125 \\cup 131.159.14.137 \\cup $ \\\\ \n$ 131.159.14.140 \\cup \\{131.159.14.145 .. 131.159.14.146\\} \\cup $ \\\\ \n$ \\{131.159.14.155 .. 131.159.14.156\\} \\cup 131.159.14.163 \\cup 131.159.14.169 \\cup $ \\\\ \n$ 131.159.14.201 \\cup 131.159.14.214 \\cup 131.159.15.5 \\cup $ \\\\ \n$ \\{131.159.15.7 .. 131.159.15.13\\} \\cup \\{131.159.15.16 .. 131.159.15.20\\} \\cup $ \\\\ \n$ \\{131.159.15.23 .. 131.159.15.25\\} \\cup 131.159.15.27 \\cup 131.159.15.29 \\cup $ \\\\ \n$ \\{131.159.15.31 .. 131.159.15.32\\} \\cup 131.159.15.36 \\cup 131.159.15.39 \\cup $ \\\\ \n$ \\{131.159.15.41 .. 131.159.15.44\\} \\cup 131.159.15.47 \\cup 131.159.15.51 \\cup $ \\\\ \n$ 131.159.15.56 \\cup 131.159.15.58 \\cup 131.159.15.60 \\cup $ \\\\ \n$ \\{131.159.15.68 .. 131.159.15.69\\} \\cup 131.159.15.197 \\cup 131.159.15.228 \\cup $ \\\\ \n$ 131.159.15.234 \\cup \\{131.159.15.247 .. 131.159.15.249\\} \\cup 131.159.20.21 \\cup $ \\\\ \n$ 131.159.20.29 \\cup 131.159.20.36 \\cup 131.159.20.45 \\cup 131.159.20.52 \\cup $ \\\\ \n$ 131.159.20.59 \\cup 131.159.20.63 \\cup 131.159.20.71 \\cup 131.159.20.74 \\cup $ \\\\ \n$ 131.159.20.85 \\cup 131.159.20.97 \\cup 131.159.20.120 \\cup 131.159.20.139 \\cup $ \\\\ \n$ \\{131.159.20.150 .. 131.159.20.151\\} \\cup 131.159.20.155 \\cup 131.159.20.160 \\cup $ \\\\ \n$ \\{131.159.20.165 .. 131.159.20.166\\} \\cup 131.159.20.180 \\cup 131.159.20.185 \\cup $ \\\\ \n$ 131.159.20.200 \\cup \\{131.159.20.233 .. 131.159.20.234\\} \\cup $ \\\\ \n$ \\{131.159.21.0 .. 131.159.21.255\\} \\cup \\{188.95.232.192 .. 188.95.232.223\\} \\cup $ \\\\ \n$ 188.95.233.4 \\cup 188.95.233.9 \\cup \\{188.95.234.0 .. 188.95.239.255\\}$}; \n\n\\node[align=left] (ips1) at (-3,-1) {$188.1.239.86 \\cup \\{188.95.232.64 .. 188.95.232.191\\}$};\n\n\\node[align=left] (ips2) at (10,-8) {$\\{138.246.253.6 .. 138.246.253.10\\}$};\n\n\\node[align=left] (ip3) at (5,-6) {$138.246.253.5$};\n\n\\node[align=left] (ip4) at (4.5,-8) {$131.159.15.50$};\n\n\\node[align=left] (l) at (8,-10) {$\\{127.0.0.0 .. 127.255.255.255\\}$};\n\n\n\n\\draw[myloop] (m) to[loop above] (m);\n\\draw[myptr] (m) to (srvs);\n\\draw[myptr] (inet) to (m);\n\\draw[myptr] (inet) to (srvs);\n\\draw[myptr,shorten <=-0.8cm] (internal) to (m);\n\\draw[myptr] (internal) to (inet);\n\\draw[myloop] (internal) to[loop above] (internal);\n\\draw[myptr] (internal) to (srvs);\n\\draw[myptr] (internal) to (ips1);\n\\draw[myptr] (internal) to (ips2);\n\\draw[myptr] (internal) to (ip3);\n\\draw[myptr] (internal) to (ip4);\n\\draw[myptr] (internal) to (l);\n\\draw[myptr] (srvs) to (m);\n\\draw[myptr] (srvs) to (inet);\n\\draw[myptr] (srvs) to (internal);\n\\draw[myloop] (srvs) to[loop above] (srvs);\n\\draw[myptr] (srvs) to (ips1);\n\\draw[myptr] (srvs) to (ips2);\n\\draw[myptr] (srvs) to (ip3);\n\\draw[myptr] (srvs) to (ip4);\n\\draw[myptr] (srvs) to (l);\n\\draw[myptr] (ips1) to (m);\n\\draw[myptr] (ips1) to (inet);\n\\draw[myptr] (ips1) to (internal);\n\\draw[myptr] (ips1) to (srvs);\n\\draw[myloop] (ips1.west) to[loop left] (ips1);\n\\draw[myptr] (ips1) to (ips2);\n\\draw[myptr] (ips1) to (ip3);\n\\draw[myptr] (ips1) to (ip4);\n\\draw[myptr] (ips1) to (l);\n\\draw[myptr] (ips2) to (m);\n\\draw[myptr] (ips2) to (srvs);\n\\draw[myptr] (ips2) to (ip4);\n\\draw[myptr] (ip3) to (m);\n\\draw[myptr] (ip3) to (internal);\n\\draw[myptr] (ip3) to (srvs);\n\\draw[myptr] (ip3) to (ip4);\n\\draw[myptr] (ip4) to (m);\n\\draw[myptr] (ip4) to (inet);\n\\draw[myptr] (ip4) to (internal);\n\\draw[myptr] (ip4) to (srvs);\n\\draw[myptr] (ip4) to (ips1);\n\\draw[myptr] (ip4) to (ips2);\n\\draw[myptr] (ip4) to (ip3);\n\\draw[myloop] (ip4) to[loop below] (ip4);\n\\draw[myptr] (ip4) to (l);\n\n\\end{tikzpicture}%\n}\n\\caption{TUM ssh Service Matrix}\n\\label{fig:tumssh}\n\\end{figure}\n\n\\\n\n\nend \n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Simple_Firewall/Service_Matrix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2770372241015033}} {"text": "(* Title: Tree Automata\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nsection \"Executable Implementation of Tree Automata\"\ntheory Ta_impl\nimports \n Main\n Collections.CollectionsV1 \n Ta AbsAlgo\n \"HOL-Library.Code_Target_Numeral\" \nbegin\n\n\n\n\ntext_raw \\\\label{sec:taimpl}\\\n\ntext \\\n In this theory, an effcient executable implementation of non-deterministic \n tree automata and basic algorithms is defined.\n\n The algorithms use red-black trees to represent sets of states or rules \n where appropriate.\n\\\n\nsubsection \"Prelude\"\n\n \\ \\Make rules hashable\\\ninstantiation ta_rule :: (hashable,hashable) hashable\nbegin\nfun hashcode_of_ta_rule \n :: \"('Q1::hashable,'Q2::hashable) ta_rule \\ hashcode\" \n where\n \"hashcode_of_ta_rule (q \\ f qs) = hashcode q + hashcode f + hashcode qs\"\n\ndefinition [simp]: \"hashcode = hashcode_of_ta_rule\"\n\ndefinition \"def_hashmap_size::(('a,'b) ta_rule itself \\ nat) == (\\_. 32)\"\n\ninstance \n by (intro_classes)(auto simp add: def_hashmap_size_ta_rule_def)\nend\n\n\n \\ \\Make wrapped states hashable\\\ninstantiation ustate_wrapper :: (hashable,hashable) hashable\nbegin\n definition \"hashcode x == (case x of USW1 a \\ 2 * hashcode a | USW2 b \\ 2 * hashcode b + 1)\"\n definition \"def_hashmap_size = (\\_ :: (('a,'b) ustate_wrapper) itself. def_hashmap_size TYPE('a) + def_hashmap_size TYPE('b))\"\n\n instance using def_hashmap_size[where ?'a=\"'a\"] def_hashmap_size[where ?'a=\"'b\"]\n by(intro_classes)(simp_all add: bounded_hashcode_bounds def_hashmap_size_ustate_wrapper_def split: ustate_wrapper.split)\n\nend\n\nsubsubsection \\Ad-Hoc instantiations of generic Algorithms\\\nsetup Locale_Code.open_block\ninterpretation hll_idx: build_index_loc hm_ops ls_ops ls_ops by unfold_locales\ninterpretation ll_set_xy: g_set_xy_loc ls_ops ls_ops \n by unfold_locales\n\ninterpretation lh_set_xx: g_set_xx_loc ls_ops hs_ops\n by unfold_locales\ninterpretation lll_iflt_cp: inj_image_filter_cp_loc ls_ops ls_ops ls_ops\n by unfold_locales\ninterpretation hhh_cart: cart_loc hs_ops hs_ops hs_ops by unfold_locales\ninterpretation hh_set_xy: g_set_xy_loc hs_ops hs_ops \n by unfold_locales\n\ninterpretation llh_set_xyy: g_set_xyy_loc ls_ops ls_ops hs_ops\n by unfold_locales\n\ninterpretation hh_map_to_nat: map_to_nat_loc hs_ops hm_ops by unfold_locales\ninterpretation hh_set_xy: g_set_xy_loc hs_ops hs_ops by unfold_locales\ninterpretation lh_set_xy: g_set_xy_loc ls_ops hs_ops by unfold_locales\ninterpretation hh_set_xx: g_set_xx_loc hs_ops hs_ops by unfold_locales\ninterpretation hs_to_fifo: set_to_list_loc hs_ops fifo_ops by unfold_locales\n\nsetup Locale_Code.close_block\n\nsubsection \"Generating Indices of Rules\"\ntext \\\n Rule indices are pieces of extra information that may be attached to a \n tree automaton.\n There are three possible rule indices\n \\begin{description}\n \\item[f] index of rules by function symbol\n \\item[s] index of rules by lhs\n \\item[sf] index of rules\n \\end{description}\n\\\n\ndefinition build_rule_index \n :: \"(('q,'l) ta_rule \\ 'i::hashable) \\ ('q,'l) ta_rule ls \n \\ ('i,('q,'l) ta_rule ls) hm\"\n where \"build_rule_index == hll_idx.idx_build\"\n\ndefinition \"build_rule_index_f \\ == build_rule_index (\\r. rhsl r) \\\"\ndefinition \"build_rule_index_s \\ == build_rule_index (\\r. lhs r) \\\"\ndefinition \"build_rule_index_sf \\ == build_rule_index (\\r. (lhs r, rhsl r)) \\\"\n\nlemma build_rule_index_f_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows \"hll_idx.is_index rhsl (ls_\\ \\) (build_rule_index_f \\)\"\n apply (unfold build_rule_index_f_def build_rule_index_def)\n apply (simp add: hll_idx.idx_build_is_index)\n done\n\nlemma build_rule_index_s_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows\n \"hll_idx.is_index lhs (ls_\\ \\) (build_rule_index_s \\)\"\n by (unfold build_rule_index_s_def build_rule_index_def)\n (simp add: hll_idx.idx_build_is_index)\n\nlemma build_rule_index_sf_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows\n \"hll_idx.is_index (\\r. (lhs r, rhsl r)) (ls_\\ \\) (build_rule_index_sf \\)\"\n by (unfold build_rule_index_sf_def build_rule_index_def)\n (simp add: hll_idx.idx_build_is_index)\n\nsubsection \"Tree Automaton with Optional Indices\"\n\ntext \\\n A tree automaton contains a hashset of initial states, a list-set of rules and\n several (optional) rule indices.\n\\\n\nrecord (overloaded) ('q,'l) hashedTa =\n \\ \\Initial states\\\n hta_Qi :: \"'q hs\" \n \\ \\Rules\\\n hta_\\ :: \"('q,'l) ta_rule ls\" \n \\ \\Rules by function symbol\\\n hta_idx_f :: \"('l,('q,'l) ta_rule ls) hm option\" \n \\ \\Rules by lhs state\\\n hta_idx_s :: \"('q,('q,'l) ta_rule ls) hm option\" \n \\ \\Rules by lhs state and function symbol\\\n hta_idx_sf :: \"('q\\'l,('q,'l) ta_rule ls) hm option\" \n\n \\ \\Abstraction of a concrete tree automaton to an abstract one\\\ndefinition hta_\\ \n where \"hta_\\ H = \\ ta_initial = hs_\\ (hta_Qi H), ta_rules = ls_\\ (hta_\\ H) \\\"\n\n \\ \\Builds the f-index if not present\\\ndefinition \"hta_ensure_idx_f H ==\n case hta_idx_f H of \n None \\ H\\ hta_idx_f := Some (build_rule_index_f (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\n \\ \\Builds the s-index if not present\\\ndefinition \"hta_ensure_idx_s H ==\n case hta_idx_s H of \n None \\ H\\ hta_idx_s := Some (build_rule_index_s (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\n \\ \\Builds the sf-index if not present\\\ndefinition \"hta_ensure_idx_sf H ==\n case hta_idx_sf H of \n None \\ H\\ hta_idx_sf := Some (build_rule_index_sf (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\nlemma hta_ensure_idx_f_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_f H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_f_def hta_\\_def split: option.split)\nlemma hta_ensure_idx_s_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_s H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_s_def hta_\\_def split: option.split)\nlemma hta_ensure_idx_sf_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_sf H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_sf_def hta_\\_def split: option.split)\n\nlemma hta_ensure_idx_other[simp]:\n \"hta_Qi (hta_ensure_idx_f H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_f H) = hta_\\ H\"\n \n \"hta_Qi (hta_ensure_idx_s H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_s H) = hta_\\ H\"\n \n \"hta_Qi (hta_ensure_idx_sf H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_sf H) = hta_\\ H\"\n by (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n split: option.split)\n\n \\ \\Check whether the f-index is present\\\ndefinition \"hta_has_idx_f H == hta_idx_f H \\ None\"\n \\ \\Check whether the s-index is present\\\ndefinition \"hta_has_idx_s H == hta_idx_s H \\ None\"\n \\ \\Check whether the sf-index is present\\\ndefinition \"hta_has_idx_sf H == hta_idx_sf H \\ None\"\n\nlemma hta_idx_f_pres\n [simp, intro!]: \"hta_has_idx_f (hta_ensure_idx_f H)\" and\n [simp, intro]: \"hta_has_idx_s H \\ hta_has_idx_s (hta_ensure_idx_f H)\" and\n [simp, intro]: \"hta_has_idx_sf H \\ hta_has_idx_sf (hta_ensure_idx_f H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_f_def \n split: option.split)\n\nlemma hta_idx_s_pres\n [simp, intro!]: \"hta_has_idx_s (hta_ensure_idx_s H)\" and\n [simp, intro]: \"hta_has_idx_f H \\ hta_has_idx_f (hta_ensure_idx_s H)\" and\n [simp, intro]: \"hta_has_idx_sf H \\ hta_has_idx_sf (hta_ensure_idx_s H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_s_def \n split: option.split)\n\nlemma hta_idx_sf_pres\n [simp, intro!]: \"hta_has_idx_sf (hta_ensure_idx_sf H)\" and\n [simp, intro]: \"hta_has_idx_f H \\ hta_has_idx_f (hta_ensure_idx_sf H)\" and\n [simp, intro]: \"hta_has_idx_s H \\ hta_has_idx_s (hta_ensure_idx_sf H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_sf_def \n split: option.split)\n\ntext \\\n The lookup functions are only defined if the required index is present. \n This enforces generation of the index before applying lookup functions.\n\\\n \\ \\Lookup rules by function symbol\\\ndefinition \"hta_lookup_f f H == hll_idx.lookup f (the (hta_idx_f H))\"\n \\ \\Lookup rules by lhs-state\\\ndefinition \"hta_lookup_s q H == hll_idx.lookup q (the (hta_idx_s H))\"\n \\ \\Lookup rules by function symbol and lhs-state\\\ndefinition \"hta_lookup_sf q f H == hll_idx.lookup (q,f) (the (hta_idx_sf H))\"\n\n\n \\ \\This locale defines the invariants of a tree automaton\\\nlocale hashedTa =\n fixes H :: \"('Q::hashable,'L::hashable) hashedTa\"\n\n \\ \\The involved sets satisfy their invariants\\\n assumes invar[simp, intro!]: \n \"hs_invar (hta_Qi H)\"\n \"ls_invar (hta_\\ H)\"\n\n \\ \\The indices are correct, if present\\\n assumes index_correct:\n \"hta_idx_f H = Some idx_f \n \\ hll_idx.is_index rhsl (ls_\\ (hta_\\ H)) idx_f\"\n \"hta_idx_s H = Some idx_s \n \\ hll_idx.is_index lhs (ls_\\ (hta_\\ H)) idx_s\"\n \"hta_idx_sf H = Some idx_sf \n \\ hll_idx.is_index (\\r. (lhs r, rhsl r)) (ls_\\ (hta_\\ H)) idx_sf\"\n\nbegin\n \\ \\Inside this locale, some shorthand notations for the sets of \n rules and initial states are used\\\n abbreviation \"\\ == hta_\\ H\"\n abbreviation \"Qi == hta_Qi H\"\n\n \\ \\The lookup-xxx operations are correct\\\n lemma hta_lookup_f_correct: \n \"hta_has_idx_f H \\ ls_\\ (hta_lookup_f f H) = {r\\ls_\\ \\ . rhsl r = f}\"\n \"hta_has_idx_f H \\ ls_invar (hta_lookup_f f H)\"\n apply (cases \"hta_has_idx_f H\")\n apply (unfold hta_has_idx_f_def hta_lookup_f_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(1)] \n index_def)\n done\n\n lemma hta_lookup_s_correct: \n \"hta_has_idx_s H \\ ls_\\ (hta_lookup_s q H) = {r\\ls_\\ \\ . lhs r = q}\"\n \"hta_has_idx_s H \\ ls_invar (hta_lookup_s q H)\"\n apply (cases \"hta_has_idx_s H\")\n apply (unfold hta_has_idx_s_def hta_lookup_s_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(2)] \n index_def)\n done\n\n lemma hta_lookup_sf_correct: \n \"hta_has_idx_sf H \n \\ ls_\\ (hta_lookup_sf q f H) = {r\\ls_\\ \\ . lhs r = q \\ rhsl r = f}\"\n \"hta_has_idx_sf H \\ ls_invar (hta_lookup_sf q f H)\"\n apply (cases \"hta_has_idx_sf H\")\n apply (unfold hta_has_idx_sf_def hta_lookup_sf_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(3)] \n index_def)\n done\n\n \\ \\The ensure-index operations preserve the invariants\\\n lemma hta_ensure_idx_f_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_f H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n lemma hta_ensure_idx_s_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_s H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n lemma hta_ensure_idx_sf_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_sf H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n text \\The abstract tree automaton satisfies the invariants for an abstract\n tree automaton\\\n lemma hta_\\_is_ta[simp, intro!]: \"tree_automaton (hta_\\ H)\"\n apply unfold_locales\n apply (unfold hta_\\_def)\n apply auto\n done\n\nend\n\n\\ \\Add some lemmas to simpset -- also outside the locale\\\nlemmas [simp, intro] = \n hashedTa.hta_ensure_idx_f_correct\n hashedTa.hta_ensure_idx_s_correct\n hashedTa.hta_ensure_idx_sf_correct\n\n \\ \\Build a tree automaton from a set of initial states and a set of rules\\\ndefinition \"init_hta Qi \\ == \n \\ hta_Qi= Qi, \n hta_\\ = \\, \n hta_idx_f = None, \n hta_idx_s = None, \n hta_idx_sf = None \n \\\"\n\n \\ \\Building a tree automaton from a valid tree automaton yields again a \n valid tree automaton. This operation has the only effect of removing \n the indices.\\\nlemma (in hashedTa) init_hta_is_hta: \n \"hashedTa (init_hta (hta_Qi H) (hta_\\ H))\"\n apply (unfold_locales)\n apply (unfold init_hta_def)\n apply (auto)\n done\n\nsubsection \"Algorithm for the Word Problem\"\n\nlemma r_match_by_laz: \"r_match L l = list_all_zip (\\Q q. q\\Q) L l\"\n by (unfold r_match_alt list_all_zip_alt)\n auto\n\n\ntext \"Executable function that computes the set of accepting states for \n a given tree\"\nfun faccs' where\n \"faccs' H (NODE f ts) = (\n let Qs = List.map (faccs' H) ts in\n ll_set_xy.g_image_filter (\\r. case r of (q \\ f' qs) \\ \n if list_all_zip (\\Q q. ls_memb q Q) Qs qs then Some (lhs r) else None\n ) \n (hta_lookup_f f H)\n )\"\n\n \\ \\Executable algorithm to decide the word-problem. The first version \n depends on the f-index to be present, the second version computes the \n index if not present.\\\ndefinition \"hta_mem' t H == \\lh_set_xx.g_disjoint (faccs' H t) (hta_Qi H)\"\ndefinition \"hta_mem t H == hta_mem' t (hta_ensure_idx_f H)\"\n\ncontext hashedTa\nbegin\n\n lemma faccs'_invar:\n assumes HI[simp, intro!]: \"hta_has_idx_f H\"\n shows \"ls_invar (faccs' H t)\" (is ?T1) \n \"list_all ls_invar (List.map (faccs' H) ts)\" (is ?T2)\n proof -\n have \"?T1 \\ ?T2\"\n apply (induct rule: compat_tree_tree_list.induct)\n apply (auto simp add: ll_set_xy.image_filter_correct hta_lookup_f_correct)\n done\n thus ?T1 ?T2 by auto\n qed\n\n declare faccs'_invar(1)[simp, intro]\n\n lemma faccs'_correct:\n assumes HI[simp, intro!]: \"hta_has_idx_f H\"\n shows \n \"ls_\\ (faccs' H t) = faccs (ls_\\ (hta_\\ H)) t\" (is ?T1)\n \"List.map ls_\\ (List.map (faccs' H) ts) \n = List.map (faccs (ls_\\ (hta_\\ H))) ts\" (is ?T2)\n proof -\n have \"?T1 \\ ?T2\"\n proof (induct rule: compat_tree_tree_list.induct)\n case (NODE f ts)\n let ?\\ = \"(ls_\\ (hta_\\ H))\"\n have \"faccs ?\\ (NODE f ts) = (\n let Qs = List.map (faccs ?\\) ts in\n {q. \\r\\?\\. r_matchc q f Qs r })\"\n by (rule faccs.simps)\n also note NODE.hyps[symmetric]\n finally have \n 1: \"faccs ?\\ (NODE f ts) \n = ( let Qs = List.map ls_\\ (List.map (faccs' H) ts) in\n {q. \\r\\?\\. r_matchc q f Qs r })\" .\n {\n fix Qsc:: \"'Q ls list\"\n assume QI: \"list_all ls_invar Qsc\"\n let ?Qs = \"List.map ls_\\ Qsc\"\n have \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = { q. \\qs. (q \\ f qs)\\?\\ \\ r_match ?Qs qs }\"\n apply (safe)\n apply (case_tac r)\n apply auto [1]\n apply force\n done\n also have \"\\ = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ r_match ?Qs qs}\"\n apply auto\n apply force\n apply (case_tac xa)\n apply auto\n done\n finally have \n 1: \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ r_match ?Qs qs}\" \n by auto\n from QI have \n [simp]: \"!!qs. list_all_zip (\\Q q. q\\ls_\\ Q) Qsc qs \n \\ list_all_zip (\\Q q. ls_memb q Q) Qsc qs\"\n apply (induct Qsc)\n apply (case_tac qs)\n apply auto [2]\n apply (case_tac qs)\n apply (auto simp add: ls.correct) [2]\n done\n have 2: \"!!qs. r_match ?Qs qs = list_all_zip (\\a b. ls_memb b a) Qsc qs\"\n apply (unfold r_match_by_laz)\n apply (simp add: list_all_zip_map1)\n done\n from 1 have \n \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ \n list_all_zip (\\a b. ls_memb b a) Qsc qs}\" \n by (simp only: 2)\n also have \n \"\\ = lhs ` { r\\ls_\\ (hta_lookup_f f H). \n case r of (q \\ f' qs) \\ \n list_all_zip (\\a b. ls_memb b a) Qsc qs}\" \n by (simp add: hta_lookup_f_correct)\n also have \n \"\\ = ls_\\ ( ll_set_xy.g_image_filter \n ( \\r. case r of (q \\ f' qs) \\ \n (if (list_all_zip (\\Q q. ls_memb q Q) Qsc qs) then Some (lhs r) else None))\n (hta_lookup_f f H)\n )\"\n apply (simp add: ll_set_xy.image_filter_correct hta_lookup_f_correct)\n apply (auto split: ta_rule.split)\n apply (rule_tac x=xa in exI)\n apply auto\n apply (case_tac a)\n apply (simp add: image_iff)\n apply (rule_tac x=a in exI)\n apply auto\n done\n finally have \n \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = ls_\\ ( ll_set_xy.g_image_filter \n (\\r. case r of (q \\ f' qs) \\ \n (if (list_all_zip (\\Q q. ls_memb q Q) Qsc qs) then Some (lhs r) else None))\n (hta_lookup_f f H))\" .\n } note 2=this\n \n from \n 1 \n 2[ where Qsc2 = \"(List.map (faccs' H) ts)\", \n simplified faccs'_invar[OF HI]] \n show ?case by simp\n qed simp_all\n thus ?T1 ?T2 by auto\n qed\n\n \\ \\Correctness of the algorithms for the word problem\\\n lemma hta_mem'_correct: \n \"hta_has_idx_f H \\ hta_mem' t H \\ t\\ta_lang (hta_\\ H)\"\n apply (unfold ta_lang_def hta_\\_def hta_mem'_def)\n apply (auto simp add: lh_set_xx.disjoint_correct faccs'_correct faccs_alt)\n done\n\n theorem hta_mem_correct: \"hta_mem t H \\ t\\ta_lang (hta_\\ H)\"\n using hashedTa.hta_mem'_correct[OF hta_ensure_idx_f_correct, simplified]\n apply (unfold hta_mem_def)\n apply simp\n done\n\nend\n\n\nsubsection \"Product Automaton and Intersection\"\n\nsubsubsection \"Brute Force Product Automaton\"\ntext \\\n In this section, an algorithm that computes the product \n automaton without reduction is implemented. While the runtime is always\n quadratic, this algorithm is very simple and the constant factors are \n smaller than that of the version with integrated reduction.\n Moreover, lazy languages like Haskell seem to profit from this algorithm.\n\\\n\ndefinition \\_prod_h \n :: \"('q1::hashable,'l::hashable) ta_rule ls \n \\ ('q2::hashable,'l) ta_rule ls \\ ('q1\\'q2,'l) ta_rule ls\" \n where \"\\_prod_h \\1 \\2 == \n lll_iflt_cp.inj_image_filter_cp (\\(r1,r2). r_prod r1 r2) \n (\\(r1,r2). rhsl r1 = rhsl r2 \n \\ length (rhsq r1) = length (rhsq r2)) \n \\1 \\2\"\n\nlemma r_prod_inj: \n \"\\ rhsl r1 = rhsl r2; length (rhsq r1) = length (rhsq r2); \n rhsl r1' = rhsl r2'; length (rhsq r1') = length (rhsq r2'); \n r_prod r1 r2 = r_prod r1' r2' \\ \\ r1=r1' \\ r2=r2'\"\n apply (cases r1, cases r2, cases r1', cases r2')\n apply (auto dest: zip_inj)\n done\n\nlemma \\_prod_h_correct:\n assumes INV[simp]: \"ls_invar \\1\" \"ls_invar \\2\"\n shows \n \"ls_\\ (\\_prod_h \\1 \\2) = \\_prod (ls_\\ \\1) (ls_\\ \\2)\"\n \"ls_invar (\\_prod_h \\1 \\2)\"\n apply (unfold \\_prod_def \\_prod_h_def)\n apply (subst lll_iflt_cp.inj_image_filter_cp_correct)\n apply simp_all [2]\n using r_prod_inj\n apply (auto intro!: inj_onI) []\n apply auto []\n apply (case_tac xa, case_tac y, simp, blast)\n apply force\n apply simp\n done\n\ndefinition \"hta_prodWR H1 H2 == \n init_hta (hhh_cart.cart (hta_Qi H1) (hta_Qi H2)) (\\_prod_h (hta_\\ H1) (hta_\\ H2))\"\n\nlemma hta_prodWR_correct_aux: \n assumes A: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"hta_\\ (hta_prodWR H1 H2) = ta_prod (hta_\\ H1) (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_prodWR H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using A .\n show ?T1 ?T2\n apply (unfold hta_prodWR_def init_hta_def hta_\\_def ta_prod_def)\n apply (simp add: hhh_cart.cart_correct \\_prod_h_correct)\n apply (unfold_locales)\n apply (simp_all add: hhh_cart.cart_correct \\_prod_h_correct)\n done\nqed\n \nlemma hta_prodWR_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_prodWR H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (hta_prodWR H1 H2)\"\n by (simp_all add: hta_prodWR_correct_aux[OF TA] ta_prod_correct_aux1)\n\nsubsubsection \"Product Automaton with Forward-Reduction\"\ntext \\\n A more elaborated algorithm combines forward-reduction and the product \n construction, i.e. product rules are only created ,,by need''.\n\\\n\n \\ \\State of the product-automaton DFS-algorithm\\\ntype_synonym ('q1,'q2,'l) pa_state \n = \"('q1\\'q2) hs \\ ('q1\\'q2) list \\ ('q1\\'q2,'l) ta_rule ls\"\n\n \\ \\Abstraction mapping to algorithm specified in \n Section~\\ref{sec:absalgo}.\\\ndefinition pa_\\ \n :: \"('q1::hashable,'q2::hashable,'l::hashable) pa_state \n \\ ('q1,'q2,'l) frp_state\"\n where \"pa_\\ S == let (Q,W,\\d)=S in (hs_\\ Q,W,ls_\\ \\d)\"\n\ndefinition pa_cond \n :: \"('q1::hashable,'q2::hashable,'l::hashable) pa_state \\ bool\" \n where \"pa_cond S == let (Q,W,\\d) = S in W\\[]\"\n\n \\ \\Adds all successor states to the set of discovered states and to the \n worklist\\\nfun pa_upd_rule \n :: \"('q1\\'q2) hs \\ ('q1\\'q2) list \n \\ (('q1::hashable)\\('q2::hashable)) list \n \\ (('q1\\'q2) hs \\ ('q1\\'q2) list)\" \n where\n \"pa_upd_rule Q W [] = (Q,W)\" |\n \"pa_upd_rule Q W (qp#qs) = (\n if \\ hs_memb qp Q then\n pa_upd_rule (hs_ins qp Q) (qp#W) qs\n else pa_upd_rule Q W qs\n )\"\n\n\ndefinition pa_step \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ ('q1,'q2,'l) pa_state \\ ('q1,'q2,'l) pa_state\"\n where \"pa_step H1 H2 S == let \n (Q,W,\\d)=S;\n (q1,q2)=hd W\n in \n ls_iteratei (hta_lookup_s q1 H1) (\\_. True) (\\r1 res. \n ls_iteratei (hta_lookup_sf q2 (rhsl r1) H2) (\\_. True) (\\r2 res.\n if (length (rhsq r1) = length (rhsq r2)) then\n let \n rp=r_prod r1 r2;\n (Q,W,\\d) = res;\n (Q',W') = pa_upd_rule Q W (rhsq rp)\n in\n (Q',W',ls_ins_dj rp \\d)\n else\n res\n ) res\n ) (Q,tl W,\\d)\n \"\n\ndefinition pa_initial \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ ('q1,'q2,'l) pa_state\"\nwhere \"pa_initial H1 H2 == \n let Qip = hhh_cart.cart (hta_Qi H1) (hta_Qi H2) in (\n Qip,\n hs_to_list Qip,\n ls_empty ()\n )\"\n\ndefinition pa_invar_add:: \n \"('q1::hashable,'q2::hashable,'l::hashable) pa_state set\" \n where \"pa_invar_add == { (Q,W,\\d). hs_invar Q \\ ls_invar \\d }\"\n\ndefinition \"pa_invar H1 H2 == \n pa_invar_add \\ {s. (pa_\\ s) \\ frp_invar (hta_\\ H1) (hta_\\ H2)}\"\n\ndefinition \"pa_det_algo H1 H2 \n == \\ dwa_cond=pa_cond, \n dwa_step = pa_step H1 H2, \n dwa_initial = pa_initial H1 H2, \n dwa_invar = pa_invar H1 H2 \\\"\n\nlemma pa_upd_rule_correct:\n assumes INV[simp, intro!]: \"hs_invar Q\"\n assumes FMT: \"pa_upd_rule Q W qs = (Q',W')\"\n shows\n \"hs_invar Q'\" (is ?T1)\n \"hs_\\ Q' = hs_\\ Q \\ set qs\" (is ?T2)\n \"\\Wn. distinct Wn \\ set Wn = set qs - hs_\\ Q \\ W'=Wn@W\" (is ?T3)\nproof -\n from INV FMT have \"?T1 \\ ?T2 \\ ?T3\"\n proof (induct qs arbitrary: Q W Q' W')\n case Nil thus ?case by simp\n next\n case (Cons q qs Q W Q' W')\n show ?case \n proof (cases \"q\\hs_\\ Q\")\n case True \n obtain Qh Wh where RF: \"pa_upd_rule Q W qs = (Qh,Wh)\" by force\n with True Cons.prems have [simp]: \"Q'=Qh\" \"W'=Wh\"\n by (auto simp add: hs.correct)\n from Cons.hyps[OF Cons.prems(1) RF] have\n \"hs_invar Qh\" \n \"hs_\\ Qh = hs_\\ Q \\ set qs\" \n \"(\\Wn. distinct Wn \\ set Wn = set qs - hs_\\ Q \\ Wh = Wn @ W)\"\n by auto\n thus ?thesis using True by auto\n next\n case False\n with Cons.prems have RF: \"pa_upd_rule (hs_ins q Q) (q#W) qs = (Q',W')\"\n by (auto simp add: hs.correct)\n\n from Cons.hyps[OF _ RF] Cons.prems(1) have\n \"hs_invar Q'\" \n \"hs_\\ Q' = insert q (hs_\\ Q) \\ set (qs)\"\n \"\\Wn. distinct Wn \n \\ set Wn = set qs - insert q (hs_\\ Q) \n \\ W' = Wn @ q # W\"\n by (auto simp add: hs.correct)\n thus ?thesis using False by auto\n qed\n qed\n thus ?T1 ?T2 ?T3 by auto\nqed\n\n\nlemma pa_step_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n assumes INV: \"(Q,W,\\d)\\pa_invar H1 H2\"\n assumes COND: \"pa_cond (Q,W,\\d)\"\n shows \n \"(pa_step H1 H2 (Q,W,\\d))\\pa_invar_add\" (is ?T1)\n \"(pa_\\ (Q,W,\\d), pa_\\ (pa_step H1 H2 (Q,W,\\d))) \n \\ frp_step (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2))\" (is ?T2)\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n from COND obtain q1 q2 Wtl where \n [simp]: \"W=(q1,q2)#Wtl\" \n by (cases W) (auto simp add: pa_cond_def)\n\n from INV have [simp]: \"hs_invar Q\" \"ls_invar \\d\" \n by (auto simp add: pa_invar_add_def pa_invar_def)\n\n define inv where \"inv = (\\\\p (Q', W', \\d'). \n hs_invar Q' \n \\ ls_invar \\d' \n \\ (\\Wn. distinct Wn \n \\ set Wn = (f_succ \\p `` {(q1,q2)}) - hs_\\ Q \n \\ W'=Wn@Wtl \n \\ hs_\\ Q'=hs_\\ Q \\ (f_succ \\p `` {(q1,q2)}))\n \\ (ls_\\ \\d' = ls_\\ \\d \\ {r\\\\p. lhs r = (q1,q2) }))\"\n\n have G: \"inv (\\_prod (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2))) \n (pa_step H1 H2 (Q,W,\\d))\"\n apply (unfold pa_step_def)\n apply simp\n apply (rule_tac \n I=\"\\it1 res. inv (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2))) res\"\n in ls.iterate_rule_P)\n \\ \\Invar\\\n apply (simp add: h1.hta_lookup_s_correct)\n \\ \\Initial\\\n apply (fastforce simp add: inv_def \\_prod_def h1.hta_lookup_s_correct \n f_succ_alt)\n \\ \\Step\\\n apply (rule_tac \n I=\"\\it2 res. inv ( \\_prod (ls_\\ (hta_\\ H1) - it) (ls_\\ (hta_\\ H2)) \n \\ \\_prod {x} (ls_\\ (hta_\\ H2) - it2)) \n res\" \n in ls.iterate_rule_P)\n \\ \\Invar\\\n apply (simp add: h2.hta_lookup_sf_correct)\n \\ \\Init\\\n apply (case_tac \\)\n apply (simp add: inv_def h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n apply (force simp add: f_succ_alt elim: \\_prodE intro: \\_prodI) [1]\n \\ \\Step\\\n defer \\ \\Requires considerably more work: Deferred to Isar proof below\\\n \\ \\Final\\\n apply (simp add: h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n apply (auto) [1]\n apply (subgoal_tac \n \"ls_\\ (hta_\\ H1) - (it - {x}) = (ls_\\ (hta_\\ H1) - it) \\ {x}\")\n apply (simp add: \\_prod_insert)\n apply (subst Un_commute)\n apply simp\n apply blast\n \\ \\Final\\\n apply force\n proof goal_cases\n case prems: (1 r1 it1 resxh r2 it2 resh)\n \\ \\Resolve lookup-operations\\\n hence G': \n \"it1 \\ {r \\ ls_\\ (hta_\\ H1). lhs r = q1}\" \n \"it2 \\ {r \\ ls_\\ (hta_\\ H2). lhs r = q2 \\ rhsl r = rhsl r1}\"\n by (simp_all add: h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n\n \\ \\Basic reasoning setup\\\n from prems(1,4) G' have \n [simp]: \"ls_\\ (hta_\\ H2) - (it2 - {r2}) = (ls_\\ (hta_\\ H2) - it2) \\ {r2}\"\n by auto\n obtain Qh Wh \\dh Q' W' \\d' where [simp]: \"resh=(Qh,Wh,\\dh)\" \n by (cases resh) fastforce\n from prems(6) have INVAH[simp]: \"hs_invar Qh\" \"ls_invar \\dh\" \n by (auto simp add: inv_def)\n\n \\ \\The involved rules have the same label, and their lhs is determined\\\n from prems(1,4) G' obtain l qs1 qs2 where \n RULE_FMT: \"r1 = (q1 \\ l qs1)\" \"r2=(q2 \\ l qs2)\"\n apply (cases r1, cases r2)\n apply force\n done\n\n {\n \\ \\If the rhs have different lengths, the algorithm ignores the rule:\\\n assume LEN: \"length (rhsq r1) \\ length (rhsq r2)\"\n \n hence [simp]: \"\\_prod_sng2 {r1} r2 = {}\"\n by (auto simp add: \\_prod_sng2_def split: ta_rule.split)\n\n have ?case using prems \n by (simp add: LEN \\_prod_insert)\n } moreover {\n \\ \\If the rhs have the same length, the rule is inserted\\\n assume LEN: \"length (rhsq r1) = length (rhsq r2)\"\n hence [simp]: \"length qs1 = length qs2\" by (simp add: RULE_FMT)\n\n hence [simp]: \"\\_prod_sng2 {r1} r2 = {(q1,q2) \\ l (zip qs1 qs2)}\"\n using prems(1,4) G'\n by (auto simp add: \\_prod_sng2_def RULE_FMT)\n\n \\ \\Obtain invariant of previous state\\\n from prems(6)[unfolded inv_def, simplified] obtain Wn where INVH:\n \"distinct Wn\"\n \"set Wn = f_succ (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)) \n `` {(q1, q2)} - hs_\\ Q\"\n \"Wh = Wn @ Wtl\" \n \"hs_\\ Qh = hs_\\ Q \n \\ f_succ (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2))\n \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)) \n `` {(q1, q2)}\" \n \"ls_\\ \\dh = ls_\\ \\d \n \\ {r. ( r \\ \\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ r \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)\n ) \\ lhs r = (q1, q2)\n }\"\n by blast\n\n \\ \\Required to justify disjoint insert\\\n have RPD: \"r_prod r1 r2 \\ ls_\\ \\dh\" \n proof -\n from INV[unfolded pa_invar_def frp_invar_def frp_invar_add_def]\n have LSDD: \n \"ls_\\ \\d = {r \\ \\_prod (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2)). \n lhs r \\ hs_\\ Q - set W}\"\n by (auto simp add: pa_\\_def hta_\\_def)\n have \"r_prod r1 r2 \\ ls_\\ \\d\"\n proof\n assume \"r_prod r1 r2 \\ ls_\\ \\d\"\n with LSDD have \"lhs (r_prod r1 r2) \\ set W\" by auto\n moreover from prems(1,4) G' have \"lhs (r_prod r1 r2) = (q1,q2)\" \n by (cases r1, cases r2) auto\n ultimately show False by simp\n qed\n moreover from prems(6) have \"ls_\\ \\dh = \n ls_\\ \\d \\ \n {r. ( r \\ \\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ r \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)\n ) \\ lhs r = (q1, q2)}\" (is \"_= _ \\ ?s\")\n by (simp add: inv_def)\n moreover have \"r_prod r1 r2 \\ ?s\" using prems(1,4) G'(2) LEN\n apply (cases r1, cases r2)\n apply (auto simp add: \\_prod_def)\n done\n ultimately show ?thesis by blast\n qed\n\n \\ \\Correctness of result of @{text pa_upd_rule}\\\n obtain Q' W' where \n PAUF: \"(pa_upd_rule Qh Wh (rhsq (r_prod r1 r2))) = (Q',W')\" \n by force\n from pa_upd_rule_correct[OF INVAH(1) PAUF] obtain Wnn where UC:\n \"hs_invar Q'\"\n \"hs_\\ Q' = hs_\\ Qh \\ set (rhsq (r_prod r1 r2))\"\n \"distinct Wnn\" \n \"set Wnn = set (rhsq (r_prod r1 r2)) - hs_\\ Qh\" \n \"W' = Wnn @ Wh\"\n by blast\n\n \\ \\Put it all together\\\n have ?case\n apply (simp add: LEN Let_def ls.ins_dj_correct[OF INVAH(2) RPD] \n PAUF inv_def UC(1))\n apply (intro conjI)\n apply (rule_tac x=\"Wnn@Wn\" in exI)\n apply (auto simp add: f_succ_alt \\_prod_insert RULE_FMT UC INVH \n \\_prod_sng2_def \\_prod_sng1_def)\n done\n } ultimately show ?case by blast\n qed\n from G show ?T1\n by (cases \"pa_step H1 H2 (Q,W,\\d)\")\n (simp add: pa_invar_add_def inv_def)\n from G show ?T2\n by (cases \"pa_step H1 H2 (Q,W,\\d)\")\n (auto simp add: inv_def pa_\\_def Let_def intro: frp_step.intros)\n\nqed\n \n \n\n \\ \\The product-automaton algorithm is a precise implementation of its\n specification\\\nlemma pa_pref_frp: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n\n shows \"wa_precise_refine (det_wa_wa (pa_det_algo H1 H2)) \n (frp_algo (hta_\\ H1) (hta_\\ H2)) \n pa_\\\"\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n \n show ?thesis\n apply (unfold_locales)\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_\\_def \n pa_cond_def frp_algo_def frp_cond_def) [1]\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_cond_def\n hta_\\_def frp_algo_def frp_cond_def \n intro!: pa_step_correct(2)[OF TA]) [1]\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_\\_def \n hta_\\_def pa_cond_def frp_algo_def frp_cond_def\n pa_invar_def pa_step_def pa_initial_def \n hs.correct ls.correct Let_def hhh_cart.cart_correct \n intro: frp_initial.intros\n ) [3]\n done\nqed\n\n\n \\ \\The product automaton algorithm is a correct while-algorithm\\\nlemma pa_while_algo: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n\n shows \"while_algo (det_wa_wa (pa_det_algo H1 H2))\"\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n interpret ref: wa_precise_refine \"(det_wa_wa (pa_det_algo H1 H2))\" \n \"(frp_algo (hta_\\ H1) (hta_\\ H2))\" \n \"pa_\\\" \n using pa_pref_frp[OF TA idx] .\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: frp_while_algo)\n apply (simp add: det_wa_wa_def pa_det_algo_def pa_invar_def frp_algo_def)\n\n apply (auto simp add: det_wa_wa_def pa_det_algo_def) [1]\n apply (rule pa_step_correct(1)[OF TA idx])\n apply (auto simp add: pa_invar_def frp_algo_def) [2]\n \n apply (simp add: det_wa_wa_def pa_det_algo_def pa_initial_def \n pa_invar_add_def Let_def hhh_cart.cart_correct ls.correct)\n done\nqed\n \n\\ \\By definition, the product automaton algorithm is deterministic\\\nlemmas pa_det_while_algo = det_while_algo_intro[OF pa_while_algo]\n\n\\ \\Transferred correctness lemma\\\nlemmas pa_inv_final = \n wa_precise_refine.transfer_correctness[OF pa_pref_frp frp_inv_final]\n\n\n\\ \\The next two definitions specify the product-automata algorithm. The first\n version requires the s-index of the first and the sf-index of the second\n automaton to be present, while the second version computes the required \n indices, if necessary\\\ndefinition \"hta_prod' H1 H2 ==\n let (Q,W,\\d) = while pa_cond (pa_step H1 H2) (pa_initial H1 H2) in\n init_hta (hhh_cart.cart (hta_Qi H1) (hta_Qi H2)) \\d\n \"\n\ndefinition \"hta_prod H1 H2 == \n hta_prod' (hta_ensure_idx_s H1) (hta_ensure_idx_sf H2)\"\n\n\nlemma hta_prod'_correct_aux:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n shows \"hta_\\ (hta_prod' H1 H2) \n = ta_fwd_reduce (ta_prod (hta_\\ H1) (hta_\\ H2))\" (is ?T1)\n \"hashedTa (hta_prod' H1 H2)\" (is ?T2)\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n interpret dwa: det_while_algo \"pa_det_algo H1 H2\" \n using pa_det_while_algo[OF TA idx] .\n\n have LC: \"while pa_cond (pa_step H1 H2) (pa_initial H1 H2) = dwa.loop\"\n by (unfold dwa.loop_def)\n (simp add: pa_det_algo_def)\n\n from dwa.while_proof'[OF pa_inv_final[OF TA idx]]\n show ?T1\n apply (unfold dwa.loop_def)\n apply (simp add: hta_prod'_def init_hta_def hta_\\_def pa_det_algo_def)\n apply (cases \"(while pa_cond (pa_step H1 H2) (pa_initial H1 H2))\")\n apply (simp add: pa_\\_def hhh_cart.cart_correct hta_\\_def)\n done\n\n show ?T2\n apply (simp add: hta_prod'_def LC)\n apply (rule dwa.while_proof)\n apply (case_tac s)\n apply (simp add: pa_det_algo_def pa_invar_add_def pa_invar_def init_hta_def)\n apply unfold_locales\n apply (simp_all add: hhh_cart.cart_correct)\n done\nqed\n\ntheorem hta_prod'_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes HI: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n shows \n \"ta_lang (hta_\\ (hta_prod' H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n\n \"hashedTa (hta_prod' H1 H2)\"\n by (simp_all add: hta_prod'_correct_aux[OF TA HI] ta_prod_correct_aux1)\n\nlemma hta_prod_correct_aux:\n assumes TA[simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"hta_\\ (hta_prod H1 H2) = ta_fwd_reduce (ta_prod (hta_\\ H1) (hta_\\ H2))\"\n \"hashedTa (hta_prod H1 H2)\"\n by (unfold hta_prod_def)\n (simp_all add: hta_prod'_correct_aux)\n \ntheorem hta_prod_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_prod H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (hta_prod H1 H2)\"\n by (simp_all add: hta_prod_correct_aux[OF TA] ta_prod_correct_aux1)\n\n\nsubsection \"Remap States\"\n\n\\ \\Mapping the states of an automaton\\\ndefinition hta_remap \n :: \"('q::hashable \\ 'qn::hashable) \\ ('q,'l::hashable) hashedTa \n \\ ('qn,'l) hashedTa\" \n where \"hta_remap f H == \n init_hta (hh_set_xy.g_image f (hta_Qi H)) \n (ll_set_xy.g_image (remap_rule f) (hta_\\ H))\"\n \nlemma (in hashedTa) hta_remap_correct:\n shows \"hta_\\ (hta_remap f H) = ta_remap f (hta_\\ H)\"\n \"hashedTa (hta_remap f H)\"\n apply (auto \n simp add: hta_remap_def init_hta_def hta_\\_def \n hh_set_xy.image_correct ll_set_xy.image_correct ta_remap_def)\n apply (unfold_locales)\n apply (auto simp add: hh_set_xy.image_correct ll_set_xy.image_correct)\n done\n\n\nsubsubsection \"Reindex Automaton\"\ntext \\\n In this section, an algorithm for re-indexing the states of the automaton to\n an initial segment of the naturals is implemented. The language of the \n automaton is not changed by the reindexing operation.\n\\\n\n \\ \\Set of states of a rule\\\nfun rule_states_l where\n \"rule_states_l (q \\ f qs) = ls_ins q (ls.from_list qs)\"\n\nlemma rule_states_l_correct[simp]: \n \"ls_\\ (rule_states_l r) = rule_states r\"\n \"ls_invar (rule_states_l r)\"\n by (cases r, simp add: ls.correct)+\n\ndefinition \"hta_\\_states H \n == (llh_set_xyy.g_Union_image id (ll_set_xy.g_image_filter \n (\\r. Some (rule_states_l r)) (hta_\\ H)))\"\n\ndefinition \"hta_states H ==\n hs_union (hta_Qi H) (hta_\\_states H)\"\n\nlemma (in hashedTa) hta_\\_states_correct:\n \"hs_\\ (hta_\\_states H) = \\_states (ta_rules (hta_\\ H))\"\n \"hs_invar (hta_\\_states H)\"\nproof (simp_all add: hta_\\_def hta_\\_states_def, goal_cases)\n case 1\n have \n [simp]: \"ls_\\ (ll_set_xy.g_image_filter (\\x. Some (rule_states_l x)) \\) \n = rule_states_l ` ls_\\ \\\"\n by (auto simp add: ll_set_xy.image_filter_correct)\n show ?case\n apply (simp add: \\_states_def)\n apply (subst\n llh_set_xyy.Union_image_correct[\n of \"(ll_set_xy.g_image_filter (\\x. Some (rule_states_l x)) \\)\", \n simplified])\n apply (auto simp add: ll_set_xy.image_filter_correct)\n done\n(*next\n case goal2 thus ?case\n apply (rule llh.Union_image_correct)\n apply (auto simp add: ls.image_filter_correct)\n done*)\nqed\n\n\n\ndefinition \"reindex_map H == \n \\q. the (hm_lookup q (hh_map_to_nat.map_to_nat (hta_states H)))\"\n\ndefinition hta_reindex \n :: \"('Q::hashable,'L::hashable) hashedTa \\ (nat,'L) hashedTa\" where\n \"hta_reindex H == hta_remap (reindex_map H) H\"\n\ndeclare hta_reindex_def [code del]\n\n \\ \\This version is more efficient, as the map is only computed once\\\n\n\n\nlemma (in hashedTa) reindex_map_correct:\n \"inj_on (reindex_map H) (ta_rstates (hta_\\ H))\"\nproof -\n have [simp]: \n \"reindex_map H = the \\ hm_\\ (hh_map_to_nat.map_to_nat (hta_states H))\"\n by (rule ext)\n (simp add: reindex_map_def hm.correct \n hh_map_to_nat.map_to_nat_correct(4) \n hta_states_correct)\n\n show ?thesis\n apply (simp add: hta_states_correct(1)[symmetric])\n apply (rule inj_on_map_the)\n apply (simp_all add: hh_map_to_nat.map_to_nat_correct hta_states_correct(2))\n done\nqed\n\ntheorem (in hashedTa) hta_reindex_correct:\n \"ta_lang (hta_\\ (hta_reindex H)) = ta_lang (hta_\\ H)\"\n \"hashedTa (hta_reindex H)\"\n apply (unfold hta_reindex_def)\n apply (simp_all \n add: hta_remap_correct tree_automaton.remap_lang[OF hta_\\_is_ta] \n reindex_map_correct)\n done\n\nsubsection \"Union\"\n\ntext \"Computes the union of two automata\"\ndefinition hta_union \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ (('q1,'q2) ustate_wrapper,'l) hashedTa\" \n where \"hta_union H1 H2 == \n init_hta (hs_union (hh_set_xy.g_image USW1 (hta_Qi H1)) \n (hh_set_xy.g_image USW2 (hta_Qi H2))) \n (ls_union_dj (ll_set_xy.g_image (remap_rule USW1) (hta_\\ H1)) \n (ll_set_xy.g_image (remap_rule USW2) (hta_\\ H2)))\"\n\nlemma hta_union_correct': \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \"hta_\\ (hta_union H1 H2) \n = ta_union_wrap (hta_\\ H1) (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_union H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using TA .\n show ?T1 ?T2 \n apply (auto \n simp add: hta_union_def init_hta_def hta_\\_def \n hs.correct ls.correct \n ll_set_xy.image_correct hh_set_xy.image_correct\n ta_remap_def ta_union_def ta_union_wrap_def)\n apply (unfold_locales)\n apply (auto \n simp add: hs.correct ls.correct)\n done\nqed\n\ntheorem hta_union_correct: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_union H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_union H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using TA .\n show ?T1 ?T2\n by (simp_all add: hta_union_correct'[OF TA] ta_union_wrap_correct)\nqed\n\nsubsection \"Operators to Construct Tree Automata\"\ntext \\\n This section defines operators that add initial states and rules to a tree \n automaton, and thus incrementally construct a tree automaton from the empty\n automaton.\n\\\n\n\\ \\The empty automaton\\\ndefinition hta_empty :: \"unit \\ ('q::hashable,'l::hashable) hashedTa\" \n where \"hta_empty u == init_hta (hs_empty ()) (ls_empty ())\"\nlemma hta_empty_correct [simp, intro!]: \n shows \"(hta_\\ (hta_empty ())) = ta_empty\"\n \"hashedTa (hta_empty ())\"\n apply (auto\n simp add: init_hta_def hta_empty_def hta_\\_def \\_states_def ta_empty_def\n hs.correct ls.correct)\n apply (unfold_locales)\n apply (auto simp add: hs.correct ls.correct)\n done\n\n\\ \\Add an initial state to the automaton\\\ndefinition hta_add_qi \n :: \"'q \\ ('q::hashable,'l::hashable) hashedTa \\ ('q,'l) hashedTa\" \n where \"hta_add_qi qi H == init_hta (hs_ins qi (hta_Qi H)) (hta_\\ H)\"\n\nlemma (in hashedTa) hta_add_qi_correct[simp, intro!]:\n shows \"hta_\\ (hta_add_qi qi H) \n = \\ ta_initial = insert qi (ta_initial (hta_\\ H)), \n ta_rules = ta_rules (hta_\\ H) \n \\\"\n \"hashedTa (hta_add_qi qi H)\"\n apply (auto \n simp add: init_hta_def hta_add_qi_def hta_\\_def \\_states_def \n hs.correct)\n apply (unfold_locales)\n apply (auto simp add: hs.correct)\n done\n\nlemmas [simp, intro] = hashedTa.hta_add_qi_correct\n\n\\ \\Add a rule to the automaton\\\ndefinition hta_add_rule \n :: \"('q,'l) ta_rule \\ ('q::hashable,'l::hashable) hashedTa \n \\ ('q,'l) hashedTa\" \n where \"hta_add_rule r H == init_hta (hta_Qi H) (ls_ins r (hta_\\ H))\"\n\nlemma (in hashedTa) hta_add_rule_correct[simp, intro!]:\n shows \"hta_\\ (hta_add_rule r H) \n = \\ ta_initial = ta_initial (hta_\\ H), \n ta_rules = insert r (ta_rules (hta_\\ H)) \n \\\"\n \"hashedTa (hta_add_rule r H)\"\n apply (auto \n simp add: init_hta_def hta_add_rule_def hta_\\_def \n \\_states_def ls.correct)\n apply (unfold_locales)\n apply (auto simp add: ls.correct)\n done\n\nlemmas [simp, intro] = hashedTa.hta_add_rule_correct\n\n\n \\ \\Reduces an automaton to the given set of states\\\ndefinition \"hta_reduce H Q ==\n init_hta (hs_inter Q (hta_Qi H)) \n (ll_set_xy.g_image_filter \n (\\r. if hs_memb (lhs r) Q \\ list_all (\\q. hs_memb q Q) (rhsq r) then Some r else None) \n (hta_\\ H))\n\"\n\ntheorem (in hashedTa) hta_reduce_correct:\n assumes INV[simp]: \"hs_invar Q\"\n shows\n \"hta_\\ (hta_reduce H Q) = ta_reduce (hta_\\ H) (hs_\\ Q)\" (is ?T1)\n \"hashedTa (hta_reduce H Q)\" (is ?T2)\n apply (auto \n simp add: \n hta_reduce_def ta_reduce_def hta_\\_def init_hta_def \n hs.correct ls.correct\n (*hs_correct ls_correct *)\n list_all_iff \n reduce_rules_def rule_states_simp \n ll_set_xy.image_filter_correct\n split: \n ta_rule.split_asm\n ) [1]\n apply (unfold_locales)\n apply (unfold hta_reduce_def init_hta_def)\n apply (auto simp add: hs.correct ls.correct)\n done\n\n\n\nsubsection \"Backwards Reduction and Emptiness Check\"\n\ntext \\\n The algorithm uses a map from states to the set of rules that contain \n the state on their rhs.\n\\\n\n \\ \\Add an entry to the index\\\ndefinition \"rqrm_add q r res ==\n case hm_lookup q res of\n None \\ hm_update q (ls_ins r (ls_empty ())) res |\n Some s \\ hm_update q (ls_ins r s) res\n \"\n\n \\ \\Lookup the set of rules with given state on rhs\\\ndefinition \"rqrm_lookup rqrm q == case hm_lookup q rqrm of\n None \\ ls_empty () |\n Some s \\ s\n \"\n\n \\ \\Build the index from a set of rules\\\ndefinition build_rqrm \n :: \"('q::hashable,'l::hashable) ta_rule ls \n \\ ('q,('q,'l) ta_rule ls) hm\" \n where\n \"build_rqrm \\ ==\n ls_iteratei \\ (\\_. True)\n (\\r res. \n foldl (\\res q. rqrm_add q r res) res (rhsq r)\n )\n (hm_empty ())\n \"\n\n\\ \\Whether the index satisfies the map and set invariants\\\ndefinition \"rqrm_invar rqrm == \n hm_invar rqrm \\ (\\q. ls_invar (rqrm_lookup rqrm q))\"\n\\ \\Whether the index really maps a state to the set of rules with this \n state on their rhs\\\ndefinition \"rqrm_prop \\ rqrm == \n \\q. ls_\\ (rqrm_lookup rqrm q) = {r\\\\. q\\set (rhsq r)}\"\n\nlemma rqrm_\\_lookup_update[simp]: \n \"rqrm_invar rqrm \\ \n ls_\\ (rqrm_lookup (rqrm_add q r rqrm) q') \n = ( if q=q' then \n insert r (ls_\\ (rqrm_lookup rqrm q')) \n else \n ls_\\ (rqrm_lookup rqrm q')\n )\"\n by (simp \n add: rqrm_lookup_def rqrm_add_def rqrm_invar_def hm.correct \n ls.correct \n split: option.split_asm option.split)\n\nlemma rqrm_propD: \n \"rqrm_prop \\ rqrm \\ ls_\\ (rqrm_lookup rqrm q) = {r\\\\. q\\set (rhsq r)}\"\n by (simp add: rqrm_prop_def)\n\nlemma build_rqrm_correct:\n fixes \\\n assumes [simp]: \"ls_invar \\\"\n shows \"rqrm_invar (build_rqrm \\)\" (is ?T1) and\n \"rqrm_prop (ls_\\ \\) (build_rqrm \\)\" (is ?T2)\nproof -\n have \"rqrm_invar (build_rqrm \\) \\ \n (\\q. ls_\\ (rqrm_lookup (build_rqrm \\) q) = {r\\ls_\\ \\. q\\set (rhsq r)})\"\n apply (unfold build_rqrm_def)\n apply (rule_tac \n I=\"\\it res. (rqrm_invar res) \n \\ (\\q. ls_\\ (rqrm_lookup res q) \n = {r\\ls_\\ \\ - it. q\\set (rhsq r)})\" \n in ls.iterate_rule_P)\n \\ \\Invar\\\n apply simp\n \\ \\Initial\\\n apply (simp add: hm_correct ls_correct rqrm_lookup_def rqrm_invar_def)\n \\ \\Step\\\n apply (rule_tac \n I=\"\\res itl itr. \n (rqrm_invar res) \n \\ (\\q. ls_\\ (rqrm_lookup res q) \n = {r\\ls_\\ \\ - it. q\\set (rhsq r)} \n \\ {r. r=x \\ q\\set itl})\" \n in Misc.foldl_rule_P)\n \\ \\Initial\\\n apply simp\n \\ \\Step\\\n apply (intro conjI)\n apply (simp \n add: rqrm_invar_def rqrm_add_def rqrm_lookup_def hm_correct \n ls_correct \n split: option.split option.split_asm)\n apply simp\n apply (simp \n add: rqrm_add_def rqrm_lookup_def hm_correct ls_correct \n split: option.split option.split_asm)\n apply (auto) [1]\n \\ \\Final\\\n apply auto [1]\n \\ \\Final\\\n apply simp\n done\n thus ?T1 ?T2 by (simp_all add: rqrm_prop_def)\nqed\n\n\\ \\A state of the basic algorithm contains a set of discovered states, \n a worklist and a map from rules to the number of distinct states on \n its RHS that have not yet been discovered or are still on the worklist\\\ntype_synonym ('Q,'L) brc_state \n = \"'Q hs \\ 'Q list \\ (('Q,'L) ta_rule, nat) hm\"\n\n\\ \\Abstraction to @{text \\'}-level:\\\ndefinition brc_\\ \n :: \"('Q::hashable,'L::hashable) brc_state \\ ('Q,'L) br'_state\"\n where \"brc_\\ == \\(Q,W,rcm). (hs_\\ Q, set W, hm_\\ rcm)\"\n\ndefinition brc_invar_add :: \"('Q::hashable,'L::hashable) brc_state set\" \n where\n \"brc_invar_add == {(Q,W,rcm). \n hs_invar Q \\ \n distinct W \\ \n hm_invar rcm\n \\<^cancel>\\\\ set W \\ hs_\\ Q\\}\n \"\n\ndefinition \"brc_invar \\ == brc_invar_add \\ {s. brc_\\ s \\ br'_invar \\}\"\n\ndefinition brc_cond :: \"('q::hashable,'l::hashable) brc_state \\ bool\" \n where \"brc_cond == \\(Q,W,rcm). W\\[]\"\n\ndefinition brc_inner_step \n :: \"('q,'l) ta_rule \\ ('q::hashable,'l::hashable) brc_state \n \\ ('q,'l) brc_state\"\n where \n \"brc_inner_step r == \\(Q,W,rcm). \n let c=the (hm_lookup r rcm);\n rcm' = hm_update r (c-(1::nat)) rcm;\n Q' = (if c \\ 1 then hs_ins (lhs r) Q else Q);\n W' = (if c \\ 1 \\ \\ hs_memb (lhs r) Q then lhs r # W else W) in\n (Q',W',rcm')\"\n\ndefinition brc_step \n :: \"('q,('q,'l) ta_rule ls) hm \n \\ ('q::hashable,'l::hashable) brc_state \n \\ ('q,'l) brc_state\" \nwhere \n \"brc_step rqrm == \\(Q,W,rcm).\n ls_iteratei (rqrm_lookup rqrm (hd W)) (\\_. True) brc_inner_step \n (Q,tl W, rcm)\"\n\n \\ \\Initial concrete state\\\ndefinition brc_iq :: \"('q,'l) ta_rule ls \\ 'q::hashable hs\" \n where \"brc_iq \\ == lh_set_xy.g_image_filter (\\r. \n if rhsq r = [] then Some (lhs r) else None) \\\"\n\ndefinition brc_rcm_init \n :: \"('q::hashable,'l::hashable) ta_rule ls \n \\ (('q,'l) ta_rule,nat) hm\" \n where \"brc_rcm_init \\ == \n ls_iteratei \\ (\\_. True) \n (\\r res. hm_update r ((length (remdups (rhsq r)))) res) \n (hm_empty ())\"\n\ndefinition brc_initial \n :: \"('q::hashable,'l::hashable) ta_rule ls \\ ('q,'l) brc_state\" \n where \"brc_initial \\ == \n let iq=brc_iq \\ in \n (iq, hs_to_list (iq), brc_rcm_init \\)\"\n\ndefinition \"brc_det_algo rqrm \\ == \\\n dwa_cond = brc_cond,\n dwa_step = brc_step rqrm,\n dwa_initial = brc_initial \\,\n dwa_invar = brc_invar (ls_\\ \\)\n\\\"\n\n \\ \\Additional facts needed from the abstract level\\\nlemma brc_inv_imp_WssQ: \"brc_\\ (Q,W,rcm)\\br'_invar \\ \\ set W \\ hs_\\ Q\"\n by (auto simp add: brc_\\_def br'_invar_def br'_\\_def br_invar_def)\n\nlemma brc_iq_correct: \n assumes [simp]: \"ls_invar \\\"\n shows \"hs_invar (brc_iq \\)\"\n \"hs_\\ (brc_iq \\) = br_iq (ls_\\ \\)\"\n by (auto simp add: brc_iq_def br_iq_def lh_set_xy.image_filter_correct)\n\nlemma brc_rcm_init_correct:\n assumes INV[simp]: \"ls_invar \\\"\n shows \"r\\ls_\\ \\ \n \\ hm_\\ (brc_rcm_init \\) r = Some ((card (set (rhsq r))))\" \n (is \"_ \\ ?T1 r\") and\n \"hm_invar (brc_rcm_init \\)\" (is ?T2)\nproof -\n have G: \"(\\r\\ls_\\ \\. ?T1 r) \\ ?T2\"\n apply (unfold brc_rcm_init_def)\n apply (rule_tac \n I=\"\\it res. hm_invar res \n \\ (\\r\\ls_\\ \\ - it. hm_\\ res r = Some ((card (set (rhsq r)))))\" \n in ls.iterate_rule_P)\n \\ \\Invar\\\n apply simp\n \\ \\Init\\\n apply (auto simp add: hm_correct) [1]\n \\ \\Step\\\n apply (rule conjI)\n apply (simp add: hm.update_correct)\n\n apply (simp only: hm_correct hs_correct INV)\n apply (rule ballI)\n apply (case_tac \"r=x\")\n apply (auto \n simp add: length_remdups_card \n intro!: arg_cong[where f=card]) [1]\n apply simp\n \\ \\Final\\\n apply simp\n done\n from G show ?T2 by auto\n fix r\n assume \"r\\ls_\\ \\\"\n thus \"?T1 r\" using G by auto\nqed\n\nlemma brc_inner_step_br'_desc: \n \"\\ (Q,W,rcm)\\brc_invar \\ \\ \\ brc_\\ (brc_inner_step r (Q,W,rcm)) = (\n if the (hm_\\ rcm r) \\ 1 then \n insert (lhs r) (hs_\\ Q) \n else hs_\\ Q, \n if the (hm_\\ rcm r) \\ 1 \\ (lhs r) \\ hs_\\ Q then \n insert (lhs r) (set W) \n else (set W), \n ((hm_\\ rcm)(r \\ the (hm_\\ rcm r) - 1))\n )\"\n by (simp \n add: brc_invar_def brc_invar_add_def brc_\\_def brc_inner_step_def Let_def \n hs_correct hm_correct)\n\nlemma brc_step_invar:\n assumes RQRM: \"rqrm_invar rqrm\"\n shows \"\\ \\\\brc_invar_add; brc_\\ \\\\br'_invar \\; brc_cond \\ \\ \n \\ (brc_step rqrm \\)\\brc_invar_add\"\n apply (cases \\)\n apply (simp add: brc_step_def)\n apply (rule_tac I=\"\\it (Q,W,rcm). (Q,W,rcm)\\brc_invar_add \\ set W \\ hs_\\ Q\" \n in ls.iterate_rule_P)\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (case_tac b)\n apply (simp add: brc_invar_add_def distinct_tl brc_cond_def)\n apply (auto simp add: brc_invar_add_def distinct_tl brc_cond_def \n dest!: brc_inv_imp_WssQ) [1]\n apply (case_tac \\)\n apply (auto simp add: brc_invar_add_def br_invar_def brc_inner_step_def \n Let_def hs_correct hm_correct) [1]\n apply (case_tac \\)\n apply simp\n done\n\n\nlemma brc_step_abs:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes A: \"\\\\brc_invar \\\" \"brc_cond \\\" \n shows \"(brc_\\ \\, brc_\\ (brc_step rqrm \\)) \\ br'_step \\\"\nproof -\n obtain Q W rcm where [simp]: \"\\=(Q,W,rcm)\" by (cases \\) auto\n from A show ?thesis\n apply (simp add: brc_step_def)\n apply (rule \n br'_inner_step_proof[OF ls.v1_iteratei_impl, \n where cinvar=\"\\it (Q,W,rcm). (Q,W,rcm)\\brc_invar_add \n \\ set W \\ hs_\\ Q\" and \n q=\"hd W\"])\n apply (case_tac W) \n apply (auto simp add: brc_cond_def brc_invar_add_def brc_invar_def \n dest!: brc_inv_imp_WssQ) [2]\n prefer 6\n apply (simp add: brc_\\_def)\n apply (case_tac \\)\n apply (auto \n simp add: brc_invar_def brc_invar_add_def brc_inner_step_def \n Let_def hm_correct hs_correct) [1]\n apply (auto \n simp add: brc_invar_add_def brc_inner_step_def brc_\\_def \n br'_inner_step_def Let_def hm_correct hs_correct) [1]\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (simp add: rqrm_propD[OF RQRM(2)])\n apply (case_tac W)\n apply (simp_all add: brc_\\_def brc_cond_def brc_invar_def) [2]\n apply (case_tac W)\n apply (simp_all add: brc_\\_def brc_cond_def brc_invar_def \n brc_invar_add_def) [2]\n done\nqed\n \nlemma brc_initial_invar: \"ls_invar \\ \\ (brc_initial \\)\\brc_invar_add\"\n by (simp \n add: brc_invar_add_def brc_initial_def brc_iq_correct Let_def \n brc_rcm_init_correct hs_correct)\n\nlemma brc_cond_abs: \"brc_cond \\ \\ (brc_\\ \\)\\br'_cond\"\n apply (cases \\)\n apply (simp add: brc_cond_def br'_cond_def brc_\\_def)\n done\n\nlemma brc_initial_abs: \n \"ls_invar \\ \\ brc_\\ (brc_initial \\) \\ br'_initial (ls_\\ \\)\"\n by (auto \n simp add: brc_initial_def Let_def brc_\\_def brc_iq_correct \n brc_rcm_init_correct hs_correct \n intro: br'_initial.intros)\n\nlemma brc_pref_br':\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\"\n shows \"wa_precise_refine (det_wa_wa (brc_det_algo rqrm \\)) \n (br'_algo (ls_\\ \\)) \n brc_\\\"\n apply (unfold_locales)\n apply (simp_all add: brc_det_algo_def br'_algo_def det_wa_wa_def)\n apply (simp add: brc_cond_abs)\n apply (auto simp add: brc_step_abs[OF RQRM]) [1]\n apply (simp add: brc_initial_abs)\n apply (auto simp add: brc_invar_def) [1]\n apply (simp add: brc_cond_abs)\n done\n\nlemma brc_while_algo:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\"\n shows \"while_algo (det_wa_wa (brc_det_algo rqrm \\))\"\nproof -\n from brc_pref_br'[OF RQRM INV] interpret \n ref: wa_precise_refine \"(det_wa_wa (brc_det_algo rqrm \\))\" \n \"(br'_algo (ls_\\ \\))\" \n brc_\\ .\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: br'_while_algo)\n apply (simp_all add: det_wa_wa_def brc_det_algo_def br'_algo_def)\n apply (simp add: brc_invar_def)\n apply (auto simp add: brc_step_invar) [1]\n apply (simp add: brc_initial_invar)\n done\nqed\n\nlemmas brc_det_while_algo =\n det_while_algo_intro[OF brc_while_algo]\n\n\nlemma fst_brc_\\: \"fst (brc_\\ s) = hs_\\ (fst s)\" \n by (cases s) (simp add: brc_\\_def)\n\nlemmas brc_invar_final =\n wa_precise_refine.transfer_correctness[OF \n brc_pref_br' br'_invar_final, unfolded fst_brc_\\]\n\ndefinition \"hta_bwd_reduce H == \n let rqrm = build_rqrm (hta_\\ H) in \n hta_reduce \n H \n (fst (while brc_cond (brc_step rqrm) (brc_initial (hta_\\ H))))\n\"\n\ntheorem (in hashedTa) hta_bwd_reduce_correct:\n shows \"hta_\\ (hta_bwd_reduce H) \n = ta_reduce (hta_\\ H) (b_accessible (ls_\\ (hta_\\ H)))\" (is ?T1)\n \"hashedTa (hta_bwd_reduce H)\" (is ?T2)\nproof -\n interpret det_while_algo \"(brc_det_algo (build_rqrm \\) \\)\"\n by (rule brc_det_while_algo)\n (simp_all add: build_rqrm_correct)\n\n have LC: \"(while brc_cond (brc_step (build_rqrm \\)) (brc_initial \\)) = loop\"\n by (unfold loop_def)\n (simp add: brc_det_algo_def)\n\n from while_proof'[OF brc_invar_final] have \n G1: \"hs_\\ (fst loop) = b_accessible (ls_\\ \\)\" \n by (simp add: build_rqrm_correct)\n have G2: \"loop \\ brc_invar (ls_\\ \\)\"\n by (rule while_proof)\n (simp add: brc_det_algo_def)\n hence [simp]: \"hs_invar (fst loop)\"\n by (cases loop)\n (simp add: brc_invar_def brc_invar_add_def)\n\n show ?T1 ?T2\n by (simp_all add: hta_bwd_reduce_def LC hta_reduce_correct G1)\n \nqed\n\nsubsubsection \\Emptiness Check with Witness Computation\\\n\ndefinition brec_construct_witness \n :: \"('q::hashable,'l::hashable tree) hm \\ ('q,'l) ta_rule \\ 'l tree\"\n where \"brec_construct_witness Qm r == \n NODE (rhsl r) (List.map (\\q. the (hm_lookup q Qm)) (rhsq r))\"\n\nlemma brec_construct_witness_correct: \n \"\\hm_invar Qm\\ \\ \n brec_construct_witness Qm r = construct_witness (hm_\\ Qm) r\"\n by (auto \n simp add: construct_witness_def brec_construct_witness_def hm_correct)\n\ntype_synonym ('Q,'L) brec_state \n = \"(('Q,'L tree) hm \n \\ 'Q fifo \n \\ (('Q,'L) ta_rule, nat) hm \n \\ 'Q option)\"\n\n\n \\ \\Abstractions\\\ndefinition brec_\\ \n :: \"('Q::hashable,'L::hashable) brec_state \\ ('Q,'L) brw_state\"\n where \"brec_\\ == \\(Q,W,rcm,f). (hm_\\ Q, set (fifo_\\ W), (hm_\\ rcm))\"\n\ndefinition brec_inner_step \n :: \"'q hs \\ ('q,'l) ta_rule \n \\ ('q::hashable,'l::hashable) brec_state \n \\ ('q,'l) brec_state\"\n where \"brec_inner_step Qi r == \\(Q,W,rcm,qwit). \n let c=the (hm_lookup r rcm); \n cond = c \\ 1 \\ hm_lookup (lhs r) Q = None;\n rcm' = hm_update r (c-(1::nat)) rcm;\n Q' = ( if cond then \n hm_update (lhs r) (brec_construct_witness Q r) Q \n else Q);\n W' = (if cond then fifo_enqueue (lhs r) W else W);\n qwit' = (if c \\ 1 \\ hs_memb (lhs r) Qi then Some (lhs r) else qwit)\n in\n (Q',W',rcm',qwit')\"\n\ndefinition brec_step \n :: \"('q,('q,'l) ta_rule ls) hm \\ 'q hs \n \\ ('q::hashable,'l::hashable) brec_state \n \\ ('q,'l) brec_state\" \n where \"brec_step rqrm Qi == \\(Q,W,rcm,qwit).\n let (q,W')=fifo_dequeue W in \n ls_iteratei (rqrm_lookup rqrm q) (\\_. True) \n (brec_inner_step Qi) (Q,W',rcm,qwit)\n \"\n\ndefinition brec_iqm \n :: \"('q::hashable,'l::hashable) ta_rule ls \\ ('q,'l tree) hm\" \n where \"brec_iqm \\ == \n ls_iteratei \\ (\\_. True) (\\r m. if rhsq r = [] then \n hm_update (lhs r) (NODE (rhsl r) []) m \n else m) \n (hm_empty ())\"\n\ndefinition brec_initial \n :: \"'q hs \\ ('q::hashable,'l::hashable) ta_rule ls \n \\ ('q,'l) brec_state\" \n where \"brec_initial Qi \\ == \n let iq=brc_iq \\ in \n ( brec_iqm \\, \n hs_to_fifo.g_set_to_listr iq, \n brc_rcm_init \\,\n hh_set_xx.g_disjoint_witness iq Qi)\"\n\ndefinition brec_cond \n :: \"('q,'l) brec_state \\ bool\" \n where \"brec_cond == \\(Q,W,rcm,qwit). \\ fifo_isEmpty W \\ qwit = None\"\n\ndefinition brec_invar_add\n :: \"'Q set \\ ('Q::hashable,'L::hashable) brec_state set\" \n where\n \"brec_invar_add Qi == {(Q,W,rcm,qwit). \n hm_invar Q \\ \n distinct (fifo_\\ W) \\ \n hm_invar rcm \\\n ( case qwit of \n None \\ Qi \\ dom (hm_\\ Q) = {} | \n Some q \\ q\\Qi \\ dom (hm_\\ Q))}\n \"\n\ndefinition \"brec_invar Qi \\ == brec_invar_add Qi \\ {s. brec_\\ s \\ brw_invar \\}\"\n\ndefinition \"brec_invar_inner Qi == \n brec_invar_add Qi \\ {(Q,W,_,_). set (fifo_\\ W) \\ dom (hm_\\ Q)}\"\n\nlemma brec_invar_cons: \n \"\\\\brec_invar Qi \\ \\ \\\\brec_invar_inner Qi\"\n apply (cases \\)\n apply (simp add: brec_invar_def brw_invar_def br'_invar_def br_invar_def\n brec_\\_def brw_\\_def br'_\\_def brec_invar_inner_def)\n done\n\nlemma brec_brw_invar_cons: \n \"brec_\\ \\ \\ brw_invar Qi \\ set (fifo_\\ (fst (snd \\))) \\ dom (hm_\\ (fst \\))\"\n apply (cases \\)\n apply (simp add: brec_invar_def brw_invar_def br'_invar_def br_invar_def\n brec_\\_def brw_\\_def br'_\\_def)\n done\n\ndefinition \"brec_det_algo rqrm Qi \\ == \\\n dwa_cond=brec_cond,\n dwa_step=brec_step rqrm Qi,\n dwa_initial=brec_initial Qi \\,\n dwa_invar=brec_invar (hs_\\ Qi) (ls_\\ \\)\n\\\"\n\nlemma brec_iqm_correct':\n assumes INV[simp]: \"ls_invar \\\"\n shows \n \"dom (hm_\\ (brec_iqm \\)) = {lhs r | r. r\\ls_\\ \\ \\ rhsq r = []}\" (is ?T1)\n \"witness_prop (ls_\\ \\) (hm_\\ (brec_iqm \\))\" (is ?T2)\n \"hm_invar (brec_iqm \\)\" (is ?T3)\nproof -\n have \"?T1 \\ ?T2 \\ ?T3\"\n apply (unfold brec_iqm_def)\n apply (rule_tac \n I=\"\\it m. hm_invar m \n \\ dom (hm_\\ m) = {lhs r | r. r\\ls_\\ \\ - it \\ rhsq r = []} \n \\ witness_prop (ls_\\ \\) (hm_\\ m)\" \n in ls.iterate_rule_P)\n apply simp\n apply (auto simp add: hm_correct witness_prop_def) [1]\n apply (auto simp add: hm_correct witness_prop_def) [1]\n apply (case_tac x)\n apply (auto intro: accs.intros) [1]\n apply simp\n done\n thus ?T1 ?T2 ?T3 by auto\nqed\n\nlemma brec_iqm_correct:\n assumes INV[simp]: \"ls_invar \\\"\n shows \"hm_\\ (brec_iqm \\) \\ brw_iq (ls_\\ \\)\"\nproof -\n have \"(\\q t. hm_\\ (brec_iqm \\) q = Some t \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ q = lhs r \\ t = NODE (rhsl r) [])) \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ hm_\\ (brec_iqm \\) (lhs r) \\ None)\" \n apply (unfold brec_iqm_def)\n apply (rule_tac I=\"\\it m. (\n (hm_invar m) \\ \n (\\q t. hm_\\ m q = Some t \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ q = lhs r \\ t = NODE (rhsl r) [])) \\ \n (\\r\\ls_\\ \\-it. rhsq r = [] \\ hm_\\ m (lhs r) \\ None)\n )\" \n in ls.iterate_rule_P)\n apply simp\n apply (simp add: hm_correct)\n apply (auto simp add: hm_correct) [1]\n apply (auto simp add: hm_correct) [1]\n done\n thus ?thesis by (blast intro: brw_iq.intros)\nqed\n\nlemma brec_inner_step_brw_desc: \n \"\\ \\\\brec_invar_inner (hs_\\ Qi) \\ \n \\ (brec_\\ \\, brec_\\ (brec_inner_step Qi r \\)) \\ brw_inner_step r\"\n apply (cases \\)\n apply (rule brw_inner_step.intros)\n apply (simp only: )\n apply (simp only: brec_\\_def split_conv)\n apply (simp only: brec_inner_step_def brec_\\_def Let_def split_conv)\n apply (auto \n simp add: brec_invar_inner_def brec_invar_add_def brec_\\_def \n brec_inner_step_def \n Let_def hs_correct hm_correct fifo_correct\n brec_construct_witness_correct)\n done\n\n\nlemma brec_step_invar:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes [simp]: \"hs_invar Qi\"\n shows \"\\ \\\\brec_invar_add (hs_\\ Qi); brec_\\ \\ \\ brw_invar \\; brec_cond \\ \\ \n \\ (brec_step rqrm Qi \\)\\brec_invar_add (hs_\\ Qi)\"\n apply (frule brec_brw_invar_cons)\n apply (cases \\)\n apply (simp add: brec_step_def fifo_correct)\n apply (case_tac \"fifo_\\ b\")\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (rule_tac s=b in fifo.removelE)\n apply simp\n apply simp\n apply simp\n\n apply (rule_tac \n I=\"\\it (Q,W,rcm,qwit). (Q,W,rcm,qwit)\\brec_invar_add (hs_\\ Qi) \n \\ set (fifo_\\ W) \\ dom (hm_\\ Q)\" \n in ls.iterate_rule_P)\n apply simp\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (simp \n add: brec_invar_def brec_invar_add_def distinct_tl brec_cond_def \n fifo_correct)\n apply (case_tac \\)\n apply (auto \n simp add: brec_invar_add_def brec_inner_step_def Let_def hs_correct \n hm_correct fifo_correct split: option.split_asm) [1]\n apply (case_tac \\)\n apply simp\n done\n\nlemma brec_step_abs:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes INV[simp]: \"hs_invar Qi\"\n assumes A': \"\\\\brec_invar (hs_\\ Qi) \\\"\n assumes COND: \"brec_cond \\\"\n shows \"(brec_\\ \\, brec_\\ (brec_step rqrm Qi \\)) \\ brw_step \\\"\nproof -\n from A' have A: \"(brec_\\ \\)\\brw_invar \\\" \"\\\\brec_invar_add (hs_\\ Qi)\"\n by (simp_all add: brec_invar_def)\n\n obtain Q W rcm qwit where [simp]: \"\\=(Q,W,rcm,qwit)\" by (cases \\) blast\n from A COND show ?thesis\n apply (simp add: brec_step_def fifo_correct)\n apply (case_tac \"fifo_\\ W\")\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (rule_tac s=W in fifo.removelE)\n apply simp\n apply simp\n apply simp\n\n apply (rule brw_inner_step_proof[\n OF ls.v1_iteratei_impl, \n where cinvar=\"\\it \\. \\\\brec_invar_inner (hs_\\ Qi)\" and \n q=\"hd (fifo_\\ W)\"])\n apply assumption\n apply (frule brec_brw_invar_cons)\n apply (simp_all \n add: brec_cond_def brec_invar_add_def fifo_correct\n brec_invar_inner_def) [1]\n prefer 6\n apply (simp add: brec_\\_def)\n apply (case_tac \\)\n apply (auto \n simp add: brec_invar_add_def brec_inner_step_def Let_def hm_correct \n hs_correct fifo_correct brec_invar_inner_def \n split: option.split_asm) [1]\n apply (blast intro: brec_inner_step_brw_desc)\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (simp \n add: rqrm_propD[OF RQRM(2)] fifo_correct)\n apply (simp_all \n add: brec_\\_def brec_cond_def brec_invar_def fifo_correct) [1]\n apply (simp_all \n add: brec_\\_def brec_cond_def brec_invar_add_def fifo_correct) [1]\n done\nqed\n \nlemma brec_invar_initial: \n \"\\ls_invar \\; hs_invar Qi\\ \\ (brec_initial Qi \\) \\ brec_invar_add (hs_\\ Qi)\"\n apply (auto \n simp add: brec_invar_add_def brec_initial_def brc_iq_correct \n brec_iqm_correct' hs_correct hs.isEmpty_correct Let_def \n brc_rcm_init_correct br_iq_def \n hh_set_xx.disjoint_witness_correct \n hs_to_fifo.g_set_to_listr_correct \n split: option.split)\n apply (auto simp add: brc_iq_correct \n hh_set_xx.disjoint_witness_None br_iq_def) [1]\n\n apply (drule hh_set_xx.disjoint_witness_correct[simplified])\n apply simp\n\n apply (drule hh_set_xx.disjoint_witness_correct[simplified])\n apply (simp add: brc_iq_correct br_iq_def)\n done\n\nlemma brec_cond_abs: \n \"\\\\\\brec_invar Qi \\\\ \\ brec_cond \\ \\ (brec_\\ \\)\\brw_cond Qi\"\n apply (cases \\)\n apply (auto \n simp add: brec_cond_def brw_cond_def brec_\\_def brec_invar_def \n brec_invar_add_def fifo_correct\n split: option.split_asm)\n done\n\nlemma brec_initial_abs: \n \"\\ ls_invar \\; hs_invar Qi \\ \n \\ brec_\\ (brec_initial Qi \\) \\ brw_initial (ls_\\ \\)\"\n by (auto simp add: brec_initial_def Let_def brec_\\_def \n brc_iq_correct brc_rcm_init_correct brec_iqm_correct \n br_iq_def fifo_correct hs_to_fifo.g_set_to_listr_correct \n intro: brw_initial.intros[unfolded br_iq_def])\n\nlemma brec_pref_brw:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\" \"hs_invar Qi\"\n shows \"wa_precise_refine (det_wa_wa (brec_det_algo rqrm Qi \\)) \n (brw_algo (hs_\\ Qi) (ls_\\ \\)) \n brec_\\\"\n apply (unfold_locales)\n apply (simp_all add: det_wa_wa_def brec_det_algo_def brw_algo_def)\n apply (auto simp add: brec_cond_abs brec_step_abs brec_initial_abs)\n apply (simp add: brec_invar_def)\n done\n\nlemma brec_while_algo:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\" \"hs_invar Qi\"\n shows \"while_algo (det_wa_wa (brec_det_algo rqrm Qi \\))\"\nproof -\n interpret ref: \n wa_precise_refine \"(det_wa_wa (brec_det_algo rqrm Qi \\))\" \n \"(brw_algo (hs_\\ Qi) (ls_\\ \\))\" \n \"brec_\\\" \n using brec_pref_brw[OF RQRM INV] . \n\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: brw_while_algo)\n apply (simp_all add: det_wa_wa_def brec_det_algo_def brw_algo_def)\n apply (simp add: brec_invar_def)\n apply (auto simp add: brec_step_invar[OF RQRM INV(2)]) [1]\n apply (simp add: brec_invar_initial) [1]\n done\nqed\n\nlemma fst_brec_\\: \"fst (brec_\\ \\) = hm_\\ (fst \\)\"\n by (cases \\) (simp add: brec_\\_def)\n\nlemmas brec_invar_final = \n wa_precise_refine.transfer_correctness[\n OF brec_pref_brw brw_invar_final, \n unfolded fst_brec_\\]\n\nlemmas brec_det_algo = det_while_algo_intro[OF brec_while_algo]\n\ndefinition \"hta_is_empty_witness H == \n let rqrm = build_rqrm (hta_\\ H);\n (Q,_,_,qwit) = (while brec_cond (brec_step rqrm (hta_Qi H)) \n (brec_initial (hta_Qi H) (hta_\\ H))) \n in\n case qwit of \n None \\ None |\n Some q \\ (hm_lookup q Q)\n\"\n\ntheorem (in hashedTa) hta_is_empty_witness_correct:\n shows [rule_format]: \"hta_is_empty_witness H = Some t \n \\ t\\ta_lang (hta_\\ H)\" (is ?T1)\n \"hta_is_empty_witness H = None \\ ta_lang (hta_\\ H) = {}\" (is ?T2)\nproof -\n\n interpret det_while_algo \"(brec_det_algo (build_rqrm \\) Qi \\)\"\n by (rule brec_det_algo)\n (simp_all add: build_rqrm_correct)\n\n have LC: \n \"(while brec_cond (brec_step (build_rqrm \\) Qi) (brec_initial Qi \\)) = loop\"\n by (unfold loop_def)\n (simp add: brec_det_algo_def)\n\n from while_proof'[OF brec_invar_final] have X:\n \"hs_\\ Qi \\ dom (hm_\\ (fst loop)) = {} \n \\ (hs_\\ Qi \\ b_accessible (ls_\\ \\) = {})\"\n \"witness_prop (ls_\\ \\) (hm_\\ (fst loop))\"\n by (simp_all add: build_rqrm_correct)\n\n obtain Q W rcm qwit where \n [simp]: \"loop = (Q,W,rcm,qwit)\" \n by (case_tac \"loop\") blast\n\n from loop_invar have I: \"loop \\ brec_invar (hs_\\ Qi) (ls_\\ \\)\" \n by (simp add: brec_det_algo_def)\n hence INVARS[simp]: \"hm_invar Q\" \"hm_invar rcm\" \n by (simp_all add: brec_invar_def brec_invar_add_def) \n \n {\n assume C: \"hta_is_empty_witness H = Some t\"\n then obtain q where \n [simp]: \"qwit=Some q\" and \n LUQ: \"hm_lookup q Q = Some t\"\n by (unfold hta_is_empty_witness_def)\n (simp add: LC split: option.split_asm)\n from LUQ have QqF: \"hm_\\ Q q = Some t\" by (simp add: hm_correct)\n from I have QMEM: \"q\\hs_\\ Qi\" \n by (simp_all add: brec_invar_def brec_invar_add_def)\n moreover from witness_propD[OF X(2)] QqF have \"accs (ls_\\ \\) t q\" by simp\n ultimately have \"t\\ta_lang (hta_\\ H)\"\n by (auto simp add: ta_lang_def hta_\\_def)\n } moreover {\n assume C: \"hta_is_empty_witness H = None\"\n hence DJ: \"hs_\\ Qi \\ dom (hm_\\ Q) = {}\" using I\n by (auto simp add: hta_is_empty_witness_def LC brec_invar_def \n brec_invar_add_def hm_correct \n split: option.split_asm)\n with X have \"hs_\\ Qi \\ b_accessible (ls_\\ \\) = {}\" \n by (simp add: brec_\\_def)\n with empty_if_no_b_accessible[of \"hta_\\ H\"] have \"ta_lang (hta_\\ H) = {}\"\n by (simp add: hta_\\_def)\n } ultimately show ?T1 ?T2 by auto\nqed\n\nsubsection \\Interface for Natural Number States and Symbols\\\n text_raw \\\\label{sec:htai_intf}\\\ntext \\\n The library-interface is statically instantiated to use natural numbers \n as both, states and symbols.\n\n This interface is easier to use from ML and OCaml, because there is no \n overhead with typeclass emulation.\n\\\n\ntype_synonym htai = \"(nat,nat) hashedTa\"\n\ndefinition htai_mem :: \"_ \\ htai \\ bool\" \n where \"htai_mem == hta_mem\"\ndefinition htai_prod :: \"htai \\ htai \\ htai\" \n where \"htai_prod H1 H2 == hta_reindex (hta_prod H1 H2)\"\ndefinition htai_prodWR :: \"htai \\ htai \\ htai\" \n where \"htai_prodWR H1 H2 == hta_reindex (hta_prodWR H1 H2)\"\ndefinition htai_union :: \"htai \\ htai \\ htai\" \n where \"htai_union H1 H2 == hta_reindex (hta_union H1 H2)\"\ndefinition htai_empty :: \"unit \\ htai\"\n where \"htai_empty == hta_empty\"\ndefinition htai_add_qi :: \"_ \\ htai \\ htai\" \n where \"htai_add_qi == hta_add_qi\"\ndefinition htai_add_rule :: \"_ \\ htai \\ htai\" \n where \"htai_add_rule == hta_add_rule\"\ndefinition htai_bwd_reduce :: \"htai \\ htai\" \n where \"htai_bwd_reduce == hta_bwd_reduce\"\ndefinition htai_is_empty_witness :: \"htai \\ _\" \n where \"htai_is_empty_witness == hta_is_empty_witness\"\ndefinition htai_ensure_idx_f :: \"htai \\ htai\" \n where \"htai_ensure_idx_f == hta_ensure_idx_f\"\ndefinition htai_ensure_idx_s :: \"htai \\ htai\" \n where \"htai_ensure_idx_s == hta_ensure_idx_s\"\ndefinition htai_ensure_idx_sf :: \"htai \\ htai\" \n where \"htai_ensure_idx_sf == hta_ensure_idx_sf\"\n\ndefinition htaip_prod :: \"htai \\ htai \\ (nat * nat,nat) hashedTa\" \n where \"htaip_prod == hta_prod\"\ndefinition htaip_prodWR :: \"htai \\ htai \\ (nat * nat,nat) hashedTa\" \n where \"htaip_prodWR == hta_prodWR\"\ndefinition htaip_reindex :: \"(nat * nat,nat) hashedTa \\ htai\" \n where \"htaip_reindex == hta_reindex\"\n\nlocale htai = hashedTa +\n constrains H :: htai\nbegin\n lemmas htai_mem_correct = hta_mem_correct[folded htai_mem_def]\n\n lemma htai_empty_correct[simp]:\n \"hta_\\ (htai_empty ()) = ta_empty\"\n \"hashedTa (htai_empty ())\"\n by (auto simp add: htai_empty_def hta_empty_correct)\n\n lemmas htai_add_qi_correct = hta_add_qi_correct[folded htai_add_qi_def]\n lemmas htai_add_rule_correct = hta_add_rule_correct[folded htai_add_rule_def]\n\n lemmas htai_bwd_reduce_correct = \n hta_bwd_reduce_correct[folded htai_bwd_reduce_def]\n lemmas htai_is_empty_witness_correct = \n hta_is_empty_witness_correct[folded htai_is_empty_witness_def]\n\n lemmas htai_ensure_idx_f_correct = \n hta_ensure_idx_f_correct[folded htai_ensure_idx_f_def]\n lemmas htai_ensure_idx_s_correct = \n hta_ensure_idx_s_correct[folded htai_ensure_idx_s_def]\n lemmas htai_ensure_idx_sf_correct = \n hta_ensure_idx_sf_correct[folded htai_ensure_idx_sf_def]\n\nend\n\nlemma htai_prod_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_prod H1 H2)) = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_prod H1 H2)\"\n apply (unfold htai_prod_def)\n apply (auto simp add: hta_prod_correct hashedTa.hta_reindex_correct)\n done\n\nlemma htai_prodWR_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_prodWR H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_prodWR H1 H2)\"\n apply (unfold htai_prodWR_def)\n apply (auto simp add: hta_prodWR_correct hashedTa.hta_reindex_correct)\n done\n\nlemma htai_union_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_union H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_union H1 H2)\"\n apply (unfold htai_union_def)\n apply (auto simp add: hta_union_correct hashedTa.hta_reindex_correct)\n done\n\nsubsection \\Interface Documentation\\ text_raw\\\\label{sec:intf_doc}\\\ntext \\\n This section contains a documentation of the executable tree-automata\n interface. The documentation contains a description of each function along\n with the relevant correctness lemmas.\n\\\n\ntext \\\n ML/OCaml users should note, that there is an interface that has the fixed type\n Int for both states and function symbols. This interface is simpler to use\n from ML/OCaml than the generic one, as it requires no overhead to emulate\n Isabelle/HOL type-classes.\n\n The functions of this interface start with the prefix {\\em htai} instead of\n {\\em hta}, but have the same semantics otherwise \n (cf Section~\\ref{sec:htai_intf}).\n\\\n\nsubsubsection \\Building a Tree Automaton\\\ntext_raw \\\n \\newcommand{\\fundesc}[2]{{\\bf Function: #1}\\\\#2}\n\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_empty}}{\n Returns a tree automaton with no states and no rules. \n }\n \n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_empty_correct}:] @{thm hta_empty_correct[no_vars]}\n \\item[@{thm [source] ta_empty_lang}:] @{thm ta_empty_lang[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_add_qi}}{\n Adds an initial state to the given automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_add_qi_correct}]\n @{thm hashedTa.hta_add_qi_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_add_rule}}{\n Adds a rule to the given automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_add_rule_correct}:]\n @{thm hashedTa.hta_add_rule_correct[no_vars]}\n \\end{description}\n\\\n\nsubsubsection \\Basic Operations\\\n\ntext \\\n The tree automata of this library may have some optional indices, that \n accelerate computation. The tree-automata operations will compute the \n indices if necessary, but due to the pure nature of the Isabelle-language,\n the computed index cannot be stored for the next usage. Hence, before using a\n bulk of tree-automaton operations on the same tree-automata, the relevant \n indexes should be pre-computed.\n\\\n\ntext \\\n \\fundesc{\n @{const [show_types] hta_ensure_idx_f}\\\\\n @{const [show_types] hta_ensure_idx_s}\\\\\n @{const [show_types] hta_ensure_idx_sf}\n }{\n Computes an index for a tree automaton, if it is not yet present.\n }\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_mem}, @{const [show_types] hta_mem'}}{\n Check whether a tree is accepted by the tree automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_mem_correct}:]\n @{thm hashedTa.hta_mem_correct[no_vars]}\n \\item[@{thm [source] hashedTa.hta_mem'_correct}:]\n @{thm hashedTa.hta_mem'_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_prod}, @{const [show_types] hta_prod'}}{\n Compute the product automaton. The computed automaton is in \n forward-reduced form. \n The language of the product automaton is the intersection of \n the languages of the two argument automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_prod_correct_aux}:] \n @{thm hta_prod_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prod_correct}:] \n @{thm hta_prod_correct[no_vars]}\n \\item[@{thm [source] hta_prod'_correct_aux}:] \n @{thm hta_prod'_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prod'_correct}:] \n @{thm hta_prod'_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_prodWR}}{\n Compute the product automaton by brute-force algorithm. \n The resulting automaton is not reduced.\n The language of the product automaton is the intersection of \n the languages of the two argument automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_prodWR_correct_aux}:]\n @{thm hta_prodWR_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prodWR_correct}:] \n @{thm hta_prodWR_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_union}}{\n Compute the union of two tree automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_union_correct'}:] @{thm hta_union_correct'[no_vars]}\n \\item[@{thm [source] hta_union_correct}:] @{thm hta_union_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_reduce}}{\n Reduce the automaton to the given set of states. All initial states outside\n this set will be removed. Moreover, all rules that contain states outside \n this set are removed, too.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_reduce_correct}:]\n @{thm hashedTa.hta_reduce_correct[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_bwd_reduce}}{\n Compute the backwards-reduced version of a tree automata.\n States from that no tree can be produced are removed. \n Backwards reduction does not change the language of the automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_bwd_reduce_correct}:]\n @{thm hashedTa.hta_bwd_reduce_correct[no_vars]}\n \\item[@{thm [source] ta_reduce_b_acc}:] @{thm ta_reduce_b_acc[no_vars]}\n \\end{description}\n\\\n\ntext \\\n \\fundesc{@{const [show_types] hta_is_empty_witness}}{\n Check whether the language of the automaton is empty.\n If the language is not empty, a tree of the language is returned.\n\n The following property is not (yet) formally proven, but should hold: \n If a tree is returned, the language contains no tree with a smaller depth\n than the returned one.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_is_empty_witness_correct}:]\n @{thm hashedTa.hta_is_empty_witness_correct[no_vars]}\n \\end{description}\n\\\n\nsubsection \\Code Generation\\\n\n(* TODO/FIXME: There seems to be no way to reference the project-directory,\n in order to control the placement of the generated code files.\n The code-generation in this file only dumps the generated code to standard output.\n Hence it is safe to include this file from other projects.\n\n Actual code generation is done in Ta_impl_codegen.thy\n *)\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in SML \n module_name Ta\n\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in Haskell \n module_name Ta\n (string_classes)\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in OCaml \n module_name Ta\n\n(* If this statement fails with an error from ML, this indicates a problem \n with the code-generator. The most frequent problem in this context is, that\n the code generator generates code that violates the ML value-restriction.\n*)\n\nML \\\n @{code hta_mem};\n @{code hta_mem'};\n @{code hta_prod};\n @{code hta_prod'};\n @{code hta_prodWR};\n @{code hta_union};\n @{code hta_empty};\n @{code hta_add_qi};\n @{code hta_add_rule};\n @{code hta_reduce};\n @{code hta_bwd_reduce};\n @{code hta_is_empty_witness};\n @{code hta_ensure_idx_f};\n @{code hta_ensure_idx_s};\n @{code hta_ensure_idx_sf};\n @{code htai_mem};\n @{code htai_prod};\n @{code htai_prodWR};\n @{code htai_union};\n @{code htai_empty};\n @{code htai_add_qi};\n @{code htai_add_rule};\n @{code htai_bwd_reduce};\n @{code htai_is_empty_witness};\n @{code htai_ensure_idx_f};\n @{code htai_ensure_idx_s};\n @{code htai_ensure_idx_sf};\n (*@{code ls_size};\n @{code hs_size};\n @{code rs_size}*)\n\\\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Tree-Automata/Ta_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2770372241015032}} {"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\nsection \\RB Model Simpl proofs\\\n\ntext \\\n Due to problems importing both SIMPL and COMPLX we split the files and have all the proofs\n using SIMPL in this file\n\\\n\ntheory CleanQ_RBModel_Simpl\n(*<*) \n imports Main \n CleanQ_RB\n CleanQ_RBModel\n \"../Simpl/Vcg\"\n(*>*) \nbegin\n\n(* ==================================================================================== *)\nsubsection \\Integration in SIMPL\\\n(* ==================================================================================== *)\n\nlemma CleanQ_RB_enq_x_preserves_invariants : \n \"\\\\ \\ rb' = \\RingRB \\ CleanQ_RB_Invariants K \\RingRB \\ b \\ rSX \\RingRB \\ \n CleanQ_RB_enq_x_possible \\RingRB \\ \n \\RingRB :== (CleanQ_RB_enq_x b \\RingRB) \n \\ CleanQ_RB_Invariants K \\RingRB \\\" \n apply(vcg)\n by (meson CleanQ_RB_enq_x_inv_all) \n\nlemma CleanQ_RB_enq_y_preserves_invariants : \n \"\\\\ \\ rb' = \\RingRB \\ CleanQ_RB_Invariants K \\RingRB \\ b \\ rSY \\RingRB \\ \n CleanQ_RB_enq_y_possible \\RingRB \\ \n \\RingRB :== (CleanQ_RB_enq_y b \\RingRB) \n \\ CleanQ_RB_Invariants K \\RingRB \\\" \n apply(vcg)\n by (meson CleanQ_RB_enq_y_inv_all) \n\nlemma CleanQ_RB_deq_x_preserves_invariants : \n \"\\\\ \\ rb' = \\RingRB \\ CleanQ_RB_Invariants K \\RingRB \\ CleanQ_RB_deq_x_possible \\RingRB \\ \n \\RingRB :== (CleanQ_RB_deq_x \\RingRB) \n \\ CleanQ_RB_Invariants K \\RingRB \\\" \n apply(vcg)\n using CleanQ_RB_deq_x_all_inv by blast\n \nlemma CleanQ_RB_deq_y_preserves_invariants : \n \"\\\\ \\ rb' = \\RingRB \\ CleanQ_RB_Invariants K \\RingRB \\ CleanQ_RB_deq_y_possible \\RingRB \\ \n \\RingRB :== (CleanQ_RB_deq_y \\RingRB) \n \\ CleanQ_RB_Invariants K \\RingRB \\\" \n apply(vcg)\n using CleanQ_RB_deq_y_all_inv by blast\n\nend ", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_RBModel_Simpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2769825767168243}} {"text": "(* Title: HOL/Auth/OtwayRees_Bad.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\n\nsection\\The Otway-Rees Protocol: The Faulty BAN Version\\\n\ntheory OtwayRees_Bad imports Public begin\n\ntext\\The FAULTY version omitting encryption of Nonce NB, as suggested on \npage 247 of\n Burrows, Abadi and Needham (1988). A Logic of Authentication.\n Proc. Royal Soc. 426\n\nThis file illustrates the consequences of such errors. We can still prove\nimpressive-looking properties such as \\Spy_not_see_encrypted_key\\, yet\nthe protocol is open to a middleperson attack. Attempting to prove some key\nlemmas indicates the possibility of this attack.\\\n\ninductive_set otway :: \"event list set\"\n where\n Nil: \\ \\The empty trace\\\n \"[] \\ otway\"\n\n | Fake: \\ \\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"\\evsf \\ otway; X \\ synth (analz (knows Spy evsf))\\\n \\ Says Spy B X # evsf \\ otway\"\n\n \n | Reception: \\ \\A message that has been sent can be received by the\n intended recipient.\\\n \"\\evsr \\ otway; Says A B X \\set evsr\\\n \\ Gets B X # evsr \\ otway\"\n\n | OR1: \\ \\Alice initiates a protocol run\\\n \"\\evs1 \\ otway; Nonce NA \\ used evs1\\\n \\ Says A B \\Nonce NA, Agent A, Agent B,\n Crypt (shrK A) \\Nonce NA, Agent A, Agent B\\\\\n # evs1 \\ otway\"\n\n | OR2: \\ \\Bob's response to Alice's message.\n This variant of the protocol does NOT encrypt NB.\\\n \"\\evs2 \\ otway; Nonce NB \\ used evs2;\n Gets B \\Nonce NA, Agent A, Agent B, X\\ \\ set evs2\\\n \\ Says B Server\n \\Nonce NA, Agent A, Agent B, X, Nonce NB,\n Crypt (shrK B) \\Nonce NA, Agent A, Agent B\\\\\n # evs2 \\ otway\"\n\n | OR3: \\ \\The Server receives Bob's message and checks that the three NAs\n match. Then he sends a new session key to Bob with a packet for\n forwarding to Alice.\\\n \"\\evs3 \\ otway; Key KAB \\ used evs3;\n Gets Server\n \\Nonce NA, Agent A, Agent B,\n Crypt (shrK A) \\Nonce NA, Agent A, Agent B\\,\n Nonce NB,\n Crypt (shrK B) \\Nonce NA, Agent A, Agent B\\\\\n \\ set evs3\\\n \\ Says Server B\n \\Nonce NA,\n Crypt (shrK A) \\Nonce NA, Key KAB\\,\n Crypt (shrK B) \\Nonce NB, Key KAB\\\\\n # evs3 \\ otway\"\n\n | OR4: \\ \\Bob receives the Server's (?) message and compares the Nonces with\n those in the message he previously sent the Server.\n Need \\<^term>\\B \\ Server\\ because we allow messages to self.\\\n \"\\evs4 \\ otway; B \\ Server;\n Says B Server \\Nonce NA, Agent A, Agent B, X', Nonce NB,\n Crypt (shrK B) \\Nonce NA, Agent A, Agent B\\\\\n \\ set evs4;\n Gets B \\Nonce NA, X, Crypt (shrK B) \\Nonce NB, Key K\\\\\n \\ set evs4\\\n \\ Says B A \\Nonce NA, X\\ # evs4 \\ otway\"\n\n | Oops: \\ \\This message models possible leaks of session keys. The nonces\n identify the protocol run.\\\n \"\\evso \\ otway;\n Says Server B \\Nonce NA, X, Crypt (shrK B) \\Nonce NB, Key K\\\\\n \\ set evso\\\n \\ Notes Spy \\Nonce NA, Nonce NB, Key K\\ # evso \\ otway\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\ntext\\A \"possibility property\": there are traces that reach the end\\\nlemma \"\\B \\ Server; Key K \\ used []\\\n \\ \\NA. \\evs \\ otway.\n Says B A \\Nonce NA, Crypt (shrK A) \\Nonce NA, Key K\\\\\n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n [THEN otway.OR1, THEN otway.Reception,\n THEN otway.OR2, THEN otway.Reception,\n THEN otway.OR3, THEN otway.Reception, THEN otway.OR4])\napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n \"\\Gets B X \\ set evs; evs \\ otway\\ \\ \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\nsubsection\\For reasoning about the encrypted portion of messages\\\n\nlemma OR2_analz_knows_Spy:\n \"\\Gets B \\N, Agent A, Agent B, X\\ \\ set evs; evs \\ otway\\\n \\ X \\ analz (knows Spy evs)\"\nby blast\n\nlemma OR4_analz_knows_Spy:\n \"\\Gets B \\N, X, Crypt (shrK B) X'\\ \\ set evs; evs \\ otway\\\n \\ X \\ analz (knows Spy evs)\"\nby blast\n\nlemma Oops_parts_knows_Spy:\n \"Says Server B \\NA, X, Crypt K' \\NB,K\\\\ \\ set evs\n \\ K \\ parts (knows Spy evs)\"\nby blast\n\ntext\\Forwarding lemma: see comments in OtwayRees.thy\\\nlemmas OR2_parts_knows_Spy =\n OR2_analz_knows_Spy [THEN analz_into_parts]\n\n\ntext\\Theorems of the form \\<^term>\\X \\ parts (spies evs)\\ imply that\nNOBODY sends messages containing X!\\\n\ntext\\Spy never sees a good agent's shared key!\\\nlemma Spy_see_shrK [simp]:\n \"evs \\ otway \\ (Key (shrK A) \\ parts (knows Spy evs)) = (A \\ bad)\"\nby (erule otway.induct, force,\n drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ otway \\ (Key (shrK A) \\ analz (knows Spy evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"\\Key (shrK A) \\ parts (knows Spy evs); evs \\ otway\\ \\ A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection\\Proofs involving analz\\\n\ntext\\Describes the form of K and NA when the Server sends this message. Also\n for Oops case.\\\nlemma Says_Server_message_form:\n \"\\Says Server B \\NA, X, Crypt (shrK B) \\NB, Key K\\\\ \\ set evs;\n evs \\ otway\\\n \\ K \\ range shrK \\ (\\i. NA = Nonce i) \\ (\\j. NB = Nonce j)\"\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\ndone\n\n\n(****\n The following is to prove theorems of the form\n\n Key K \\ analz (insert (Key KAB) (knows Spy evs)) \\\n Key K \\ analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext\\Session keys are not used to encrypt other session keys\\\n\ntext\\The equality makes the induction hypothesis easier to apply\\\nlemma analz_image_freshK [rule_format]:\n \"evs \\ otway \\\n \\K KK. KK \\ -(range shrK) \\\n (Key K \\ analz (Key`KK \\ (knows Spy evs))) =\n (K \\ KK | Key K \\ analz (knows Spy evs))\"\napply (erule otway.induct)\napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy)\napply (drule_tac [5] OR2_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n \"\\evs \\ otway; KAB \\ range shrK\\ \\\n (Key K \\ analz (insert (Key KAB) (knows Spy evs))) =\n (K = KAB | Key K \\ analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\The Key K uniquely identifies the Server's message.\\\nlemma unique_session_keys:\n \"\\Says Server B \\NA, X, Crypt (shrK B) \\NB, K\\\\ \\ set evs;\n Says Server B' \\NA',X',Crypt (shrK B') \\NB',K\\\\ \\ set evs;\n evs \\ otway\\ \\ X=X' \\ B=B' \\ NA=NA' \\ NB=NB'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply blast+ \\ \\OR3 and OR4\\\ndone\n\n\ntext\\Crucial secrecy property: Spy does not see the keys sent in msg OR3\n Does not in itself guarantee security: an attack could violate\n the premises, e.g. by having \\<^term>\\A=Spy\\\\\nlemma secrecy_lemma:\n \"\\A \\ bad; B \\ bad; evs \\ otway\\\n \\ Says Server B\n \\NA, Crypt (shrK A) \\NA, Key K\\,\n Crypt (shrK B) \\NB, Key K\\\\ \\ set evs \\\n Notes Spy \\NA, NB, Key K\\ \\ set evs \\\n Key K \\ analz (knows Spy evs)\"\napply (erule otway.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (drule_tac [6] OR4_analz_knows_Spy)\napply (drule_tac [4] OR2_analz_knows_Spy)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes)\napply spy_analz \\ \\Fake\\\napply (blast dest: unique_session_keys)+ \\ \\OR3, OR4, Oops\\\ndone\n\n\nlemma Spy_not_see_encrypted_key:\n \"\\Says Server B\n \\NA, Crypt (shrK A) \\NA, Key K\\,\n Crypt (shrK B) \\NB, Key K\\\\ \\ set evs;\n Notes Spy \\NA, NB, Key K\\ \\ set evs;\n A \\ bad; B \\ bad; evs \\ otway\\\n \\ Key K \\ analz (knows Spy evs)\"\nby (blast dest: Says_Server_message_form secrecy_lemma)\n\n\nsubsection\\Attempting to prove stronger properties\\\n\ntext\\Only OR1 can have caused such a part of a message to appear. The premise\n \\<^term>\\A \\ B\\ prevents OR2's similar-looking cryptogram from being picked \n up. Original Otway-Rees doesn't need it.\\\nlemma Crypt_imp_OR1 [rule_format]:\n \"\\A \\ bad; A \\ B; evs \\ otway\\\n \\ Crypt (shrK A) \\NA, Agent A, Agent B\\ \\ parts (knows Spy evs) \\\n Says A B \\NA, Agent A, Agent B,\n Crypt (shrK A) \\NA, Agent A, Agent B\\\\ \\ set evs\"\nby (erule otway.induct, force,\n drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\ntext\\Crucial property: If the encrypted message appears, and A has used NA\n to start a run, then it originated with the Server!\n The premise \\<^term>\\A \\ B\\ allows use of \\Crypt_imp_OR1\\\\\ntext\\Only it is FALSE. Somebody could make a fake message to Server\n substituting some other nonce NA' for NB.\\\nlemma \"\\A \\ bad; A \\ B; evs \\ otway\\\n \\ Crypt (shrK A) \\NA, Key K\\ \\ parts (knows Spy evs) \\\n Says A B \\NA, Agent A, Agent B,\n Crypt (shrK A) \\NA, Agent A, Agent B\\\\\n \\ set evs \\\n (\\B NB. Says Server B\n \\NA,\n Crypt (shrK A) \\NA, Key K\\,\n Crypt (shrK B) \\NB, Key K\\\\ \\ set evs)\"\napply (erule otway.induct, force,\n drule_tac [4] OR2_parts_knows_Spy, simp_all)\napply blast \\ \\Fake\\\napply blast \\ \\OR1: it cannot be a new Nonce, contradiction.\\\ntxt\\OR3 and OR4\\\napply (simp_all add: ex_disj_distrib)\n prefer 2 apply (blast intro!: Crypt_imp_OR1) \\ \\OR4\\\ntxt\\OR3\\\napply clarify\n(*The hypotheses at this point suggest an attack in which nonce NB is used\n in two different roles:\n Gets Server\n \\Nonce NA, Agent Aa, Agent A,\n Crypt (shrK Aa) \\Nonce NA, Agent Aa, Agent A\\, Nonce NB,\n Crypt (shrK A) \\Nonce NA, Agent Aa, Agent A\\\\\n \\ set evs3\n Says A B\n \\Nonce NB, Agent A, Agent B,\n Crypt (shrK A) \\Nonce NB, Agent A, Agent B\\\\\n \\ set evs3;\n*)\n\n\n(*Thus the key property A_can_trust probably fails too.*)\noops\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/OtwayRees_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.27698257671682425}} {"text": "section \\Example\\\n\ntext \\We provide an example in order to prove that our locale is non-vacuous.\nThis example corresponds to the computation and associated snapshot described\nin Section 4 of~\\cite{chandy}.\\\n\ntheory Example\n imports\n Snapshot\n\nbegin\n\ndatatype PType = P | Q\ndatatype MType = M | M'\ndatatype SType = S_Wait | S_Send | T_Wait | T_Send\n\nfun trans :: \"PType \\ SType \\ SType \\ bool\" where\n \"trans p s s' = False\"\n\nfun send :: \"channel_id \\ PType \\ PType \\ SType\n \\ SType \\ MType \\ bool\" where\n \"send c p q s s' m = ((c = 0 \\ p = P \\ q = Q\n \\ s = S_Send \\ s' = S_Wait \\ m = M)\n \\ (c = 1 \\ p = Q \\ q = P\n \\ s = T_Send \\ s' = T_Wait \\ m = M'))\"\n\nfun recv :: \"channel_id \\ PType \\ PType \\ SType\n \\ SType \\ MType \\ bool\" where\n \"recv c p q s s' m = ((c = 1 \\ p = P \\ q = Q\n \\ s = S_Wait \\ s' = S_Send \\ m = M')\n \\ (c = 0 \\ p = Q \\ q = P\n \\ s = T_Wait \\ s' = T_Send \\ m = M))\"\n\nfun chan :: \"nat \\ (PType * PType) option\" where\n \"chan n = (if n = 0 then Some (P, Q)\n else if n = 1 then Some (Q, P)\n else None)\"\n\nabbreviation init :: \"(PType, SType, MType) configuration\" where\n \"init \\ \\\n states = (%p. if p = P then S_Send else T_Send),\n msgs = (%d. []),\n process_snapshot = (%p. None),\n channel_snapshot = (%d. ([], NotStarted))\n \\\"\n\nabbreviation t0 where \"t0 \\ Snapshot P\"\n\nabbreviation s1 :: \"(PType, SType, MType) configuration\" where\n \"s1 \\ \\\n states = (%p. if p = P then S_Send else T_Send),\n msgs = (%d. if d = 0 then [Marker] else []),\n process_snapshot = (%p. if p = P then Some S_Send else None),\n channel_snapshot = (%d. if d = 1 then ([], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t1 where \"t1 \\ Send 0 P Q S_Send S_Wait M\"\n\nabbreviation s2 :: \"(PType, SType, MType) configuration\" where\n \"s2 \\ \\\n states = (%p. if p = P then S_Wait else T_Send),\n msgs = (%d. if d = 0 then [Marker, Msg M] else []),\n process_snapshot = (%p. if p = P then Some S_Send else None),\n channel_snapshot = (%d. if d = 1 then ([], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t2 where \"t2 \\ Send 1 Q P T_Send T_Wait M'\"\n\nabbreviation s3 :: \"(PType, SType, MType) configuration\" where\n \"s3 \\ \\\n states = (%p. if p = P then S_Wait else T_Wait),\n msgs = (%d. if d = 0 then [Marker, Msg M] else if d = 1 then [Msg M'] else []),\n process_snapshot = (%p. if p = P then Some S_Send else None),\n channel_snapshot = (%d. if d = 1 then ([], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t3 where \"t3 \\ Snapshot Q\"\n\nabbreviation s4 :: \"(PType, SType, MType) configuration\" where\n \"s4 \\ \\\n states = (%p. if p = P then S_Wait else T_Wait),\n msgs = (%d. if d = 0 then [Marker, Msg M] else if d = 1 then [Msg M', Marker] else []),\n process_snapshot = (%p. if p = P then Some S_Send else Some T_Wait),\n channel_snapshot = (%d. if d = 1 then ([], Recording) else if d = 0 then ([], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t4 where \"t4 \\ RecvMarker 0 Q P\"\n\nabbreviation s5 :: \"(PType, SType, MType) configuration\" where\n \"s5 \\ \\\n states = (%p. if p = P then S_Wait else T_Wait),\n msgs = (%d. if d = 0 then [Msg M] else if d = 1 then [Msg M', Marker] else []),\n process_snapshot = (%p. if p = P then Some S_Send else Some T_Wait),\n channel_snapshot = (%d. if d = 0 then ([], Done) else if d = 1 then ([], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t5 where \"t5 \\ Recv 1 P Q S_Wait S_Send M'\"\n\nabbreviation s6 :: \"(PType, SType, MType) configuration\" where\n \"s6 \\ \\\n states = (%p. if p = P then S_Send else T_Wait),\n msgs = (%d. if d = 0 then [Msg M] else if d = 1 then [Marker] else []),\n process_snapshot = (%p. if p = P then Some S_Send else Some T_Wait),\n channel_snapshot = (%d. if d = 0 then ([], Done) else if d = 1 then ([M'], Recording) else ([], NotStarted))\n \\\"\n\nabbreviation t6 where \"t6 \\ RecvMarker 1 P Q\"\n\nabbreviation s7 :: \"(PType, SType, MType) configuration\" where\n \"s7 \\ \\\n states = (%p. if p = P then S_Send else T_Wait),\n msgs = (%d. if d = 0 then [Msg M] else if d = 1 then [] else []),\n process_snapshot = (%p. if p = P then Some S_Send else Some T_Wait),\n channel_snapshot = (%d. if d = 0 then ([], Done) else if d = 1 then ([M'], Done) else ([], NotStarted))\n \\\"\n\nlemma s7_no_marker:\n shows\n \"\\cid. Marker \\ set (msgs s7 cid)\"\n by simp\n\ninterpretation computation chan trans send recv init s7\nproof\n have \"distributed_system chan\"\n proof\n show \"\\i. \\p. chan i = Some (p, p)\" by simp\n qed\n show \"\\p q. p \\ q \\ (\\p q. \\i. chan i = Some (p, q))\\<^sup>+\\<^sup>+ p q\"\n proof ((rule allI)+, rule impI)\n fix p q :: PType assume \"p \\ q\"\n then have \"(p = P \\ q = Q) \\ (p = Q \\ q = P)\"\n using PType.exhaust by auto\n then have \"\\i. chan i = Some (p, q)\" by (elim disjE) auto\n then show \"(\\p q. \\i. chan i = Some (p, q))\\<^sup>+\\<^sup>+ p q\" by blast\n qed\n show \"finite {i. \\p q. chan i = Some (p, q)}\"\n proof -\n have \"{i. \\p q. chan i = Some (p, q)} = {0,1}\" by auto\n then show ?thesis by simp\n qed\n show \"1 < card (UNIV :: PType set)\"\n proof -\n have \"(UNIV :: PType set) = {P, Q}\"\n using PType.exhaust by blast\n then have \"card (UNIV :: PType set) = 2\" \n by (metis One_nat_def PType.distinct(1) Suc_1 card.insert card_empty finite.emptyI finite.insertI insert_absorb insert_not_empty singletonD)\n then show ?thesis by auto\n qed\n show \"finite (UNIV :: PType set)\"\n proof -\n have \"(UNIV :: PType set) = {P, Q}\"\n using PType.exhaust by blast\n then show ?thesis \n by (metis finite.emptyI finite.insertI)\n qed\n show \"\\i. \\p. chan i = Some (p, p)\" by simp\n show \"\\i. (\\p q. chan i = Some (p, q)) \\ Marker \\ set (msgs init i)\" by auto\n show \"\\i. chan i = None \\ msgs init i = []\" by auto\n show \"\\p. \\ ps init p \\ None\" by auto\n show \"\\i. cs init i = ([], NotStarted)\" by auto\n show \"\\t. distributed_system.trace chan Example.trans send recv init t s7\"\n proof -\n let ?t = \"[t0, t1, t2, t3, t4, t5, t6]\"\n have \"distributed_system.next chan trans send recv init t0 s1\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t0 init\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n then show ?thesis \n by (simp add: \\distributed_system chan\\ distributed_system.next_snapshot)\n qed\n moreover have \"distributed_system.next chan trans send recv s1 t1 s2\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t1 s1\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n then show ?thesis \n by (simp add: \\distributed_system chan\\ distributed_system.next_send)\n qed\n moreover have \"distributed_system.next chan trans send recv s2 t2 s3\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t2 s2\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n moreover have \"\\r. r \\ P \\ r = Q\" using PType.exhaust by auto\n ultimately show ?thesis by (simp add: `distributed_system chan` distributed_system.next_send)\n qed\n moreover have \"distributed_system.next chan trans send recv s3 t3 s4\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t3 s3\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n moreover have \"\\p'. p' \\ P \\ p' = Q\" using PType.exhaust by auto\n ultimately show ?thesis by (simp add: `distributed_system chan` distributed_system.next_snapshot)\n qed\n moreover have \"distributed_system.next chan trans send recv s4 t4 s5\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t4 s4\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n then show ?thesis\n by (simp add: `distributed_system chan` distributed_system.next_def)\n qed\n moreover have \"distributed_system.next chan trans send recv s5 t5 s6\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t5 s5\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n then show ?thesis\n by (simp add: `distributed_system chan` distributed_system.next_def)\n qed\n moreover have \"distributed_system.next chan trans send recv s6 t6 s7\"\n proof -\n have \"distributed_system.can_occur chan trans send recv t6 s6\"\n using \\distributed_system chan\\ distributed_system.can_occur_def by fastforce\n then show ?thesis\n by (simp add: `distributed_system chan` distributed_system.next_def)\n qed\n ultimately have \"distributed_system.trace chan trans send recv init ?t s7\" \n by (meson \\distributed_system chan\\ distributed_system.trace.simps)\n then show ?thesis by blast\n qed\n show \"\\t i cid. distributed_system.trace chan Example.trans send recv init t s7 \\\n Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t i) cid) \\\n (\\j\\i. Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t j) cid))\"\n proof ((rule allI)+, (rule impI)+)\n fix t i cid\n assume asm: \"distributed_system.trace chan Example.trans send recv init t s7 \\\n Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t i) cid)\"\n have tr_exists: \"distributed_system.trace chan Example.trans send recv init t s7\" using asm by blast\n have marker_in_channel: \"Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t i) cid)\" using asm by simp\n have s7_is_fin: \"s7 = (distributed_system.s chan Example.trans send recv init t (length t))\" \n by (metis (no_types, lifting) \\distributed_system chan\\ \\distributed_system.trace chan Example.trans send recv init t s7\\ distributed_system.exists_trace_for_any_i distributed_system.trace_and_start_determines_end order_refl take_all)\n have \"i < length t\"\n proof (rule ccontr)\n assume \"~ i < length t\"\n then have \"distributed_system.trace chan Example.trans send recv\n (distributed_system.s chan Example.trans send recv init t (length t))\n []\n (distributed_system.s chan Example.trans send recv init t i)\" \n by (metis (no_types, lifting) \\distributed_system chan\\ distributed_system.exists_trace_for_any_i distributed_system.trace.simps distributed_system.trace_and_start_determines_end not_less s7_is_fin take_all tr_exists)\n then have \"Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t i) cid)\"\n proof -\n have \"distributed_system.s chan Example.trans send recv init t i = s7\" \n using \\distributed_system chan\\ \\distributed_system.trace chan Example.trans send recv (distributed_system.s chan Example.trans send recv init t (length t)) [] (distributed_system.s chan Example.trans send recv init t i)\\ distributed_system.trace.simps s7_is_fin by fastforce\n then show ?thesis using s7_no_marker by simp\n qed\n then show False using marker_in_channel by simp\n qed\n then show \"(\\j\\i. Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t j) cid))\"\n proof -\n have \"distributed_system.trace chan Example.trans send recv\n (distributed_system.s chan Example.trans send recv init t i)\n (take ((length t) - i) (drop i t))\n (distributed_system.s chan Example.trans send recv init t (length t))\" \n using \\distributed_system chan\\ \\i < length t\\ distributed_system.exists_trace_for_any_i_j less_imp_le_nat tr_exists by blast\n then have \"Marker \\ set (msgs (distributed_system.s chan Example.trans send recv init t (length t)) cid)\"\n proof -\n have \"distributed_system.s chan Example.trans send recv init t (length t) = s7\" \n by (simp add: s7_is_fin)\n then show ?thesis using s7_no_marker by simp\n qed\n then show ?thesis \n using \\i < length t\\ less_imp_le_nat by blast\n qed\n qed\n show \"\\t p. distributed_system.trace chan Example.trans send recv init t s7 \\\n (\\i. ps (distributed_system.s chan Example.trans send recv init t i) p \\ None \\ i \\ length t)\"\n proof ((rule allI)+, rule impI)\n fix t p\n assume \"distributed_system.trace chan Example.trans send recv init t s7\"\n have s7_is_fin: \"s7 = (distributed_system.s chan Example.trans send recv init t (length t))\" \n by (metis (no_types, lifting) \\distributed_system chan\\ \\distributed_system.trace chan Example.trans send recv init t s7\\ distributed_system.exists_trace_for_any_i distributed_system.trace_and_start_determines_end order_refl take_all)\n moreover have \"has_snapshotted s7 p\" by simp\n ultimately show \"(\\i. ps (distributed_system.s chan Example.trans send recv init t i) p \\ None \\ i \\ length t)\"\n by auto\n qed\nqed\n\nend\n", "meta": {"author": "ThreeFx", "repo": "chandy-lamport-formalization", "sha": "a2ad5daf2fd37ee70c9f086b73e156cc068d2134", "save_path": "github-repos/isabelle/ThreeFx-chandy-lamport-formalization", "path": "github-repos/isabelle/ThreeFx-chandy-lamport-formalization/chandy-lamport-formalization-a2ad5daf2fd37ee70c9f086b73e156cc068d2134/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2766969043668829}} {"text": "(* Title: HOL/Auth/n_mutualEx_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_on_inis imports n_mutualEx_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\\\n (\\ p__Inv0. p__Inv0\\N\\f=inv__2 p__Inv0)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\\\n (\\ p__Inv0. p__Inv0\\N\\f=inv__4 p__Inv0)\\\n (\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__5 p__Inv0 p__Inv1)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0. p__Inv0\\N\\f=inv__2 p__Inv0)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0. p__Inv0\\N\\f=inv__4 p__Inv0)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__5 p__Inv0 p__Inv1)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2765676477434113}} {"text": "theory flash9Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_InvVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_InvAck_1_HomeVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_2VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_GetXVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_Nak1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_Nak2VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_Nak3VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_PutX1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak2VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak3VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Put1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Put2VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Put3VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Put )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_NakVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Nak_ClearVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Nak_HomeVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Remote_GetX_NakVsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_Remote_Get_Put1VsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv9: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ReplaceHomeVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceShrVldVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ShWbVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_ShWb )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX1VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_PutVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_PutXVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Remote_GetVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma PI_Remote_GetXVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma PI_Remote_PutXVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreVsInv9: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreHomeVsInv9: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv9 iInv1 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash9Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27654215343838406}} {"text": "theory SATDecision\nimports ModelIso \"HOL-Library.Finite_Map\"\nbegin\n\nsubsection \\AMS\\\n\ndefinition equiv_classes :: \"('a \\ 'b) \\ 'a set set\" where\n \"equiv_classes m = { {x. m x = Some y} | y. y \\ ran m}\"\n\nlemma classes_distinct: \"\\c1 \\ equiv_classes m; c2 \\ equiv_classes m\\ \\ c1=c2 \\ c1\\c2={}\"\n by (auto simp: equiv_classes_def)\n\ndatatype len = One | AtLeastTwo\ntype_synonym abst_var = \"var fset\"\n\ntypedef ams = \"{(V,E,\\,\\)::\n (abst_var fset \\ (abst_var,(abst_var\\len)) fmap \\ abst_var fset fset \\ nat) | V E \\ \\.\n (\\v\\fset V. v\\{||}) \\ (\\v\\fset V. Nil |\\|v) \\ (\\v1 v2. v1 |\\| V \\ v2 |\\| V \\ v1=v2 \\ v1 |\\| v2 = {||})\n \\ fmdom E |\\| V \\ fmimage (Abs_fmap (Some\\fst)) (fmran E) |\\| V \\ (\\v\\ fset (fmdom E). Nil |\\| v)\n \\ (\\R1 R2. R1 |\\| \\ \\ R2 |\\| \\ \\ R1=R2 \\ R1 |\\| R2 = {||}) \\ \n (\\R\\fset \\. R |\\| V \\ R |\\| fmdom E = {||} \\ (\\v\\fset R. Nil |\\| v))}\"\nproof -\n define ams :: \"(abst_var fset \\ (abst_var,(abst_var\\len)) fmap \\ abst_var fset fset \\ nat)\" \n where \"ams \\ ({|{|Nil|}|}, fmempty, {||}, 0)\"\n then have \"ams \\ {(V, E, \\, \\) |V E \\ \\. (\\v\\fset V. v \\ {||}) \\(\\v\\fset V. var.Nil |\\| v) \\\n (\\v1 v2. v1 |\\| V \\ v2 |\\| V \\ v1 = v2 \\ v1 |\\| v2 = {||}) \\ fmdom E |\\| V \\\n fmimage (Abs_fmap (Some \\ fst)) (fmran E) |\\| V \\ (\\v\\fset (fmdom E). var.Nil |\\| v) \\\n (\\R1 R2. R1 |\\| \\ \\ R2 |\\| \\ \\ R1 = R2 \\ R1 |\\| R2 = {||}) \\\n (\\R\\fset \\. R |\\| V \\ R |\\| fmdom E = {||} \\ (\\v\\fset R. var.Nil |\\| v))}\"\n by simp\n then show ?thesis by meson\nqed\n\nend", "meta": {"author": "firefighterduck", "repo": "ssl", "sha": "395041934a253815e77c405f24e5932b96b8e98d", "save_path": "github-repos/isabelle/firefighterduck-ssl", "path": "github-repos/isabelle/firefighterduck-ssl/ssl-395041934a253815e77c405f24e5932b96b8e98d/SATDecision.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316991792861, "lm_q2_score": 0.41111086923216794, "lm_q1q2_score": 0.2764028692619368}} {"text": "theory Benchmark_Set_LC\nimports \n Benchmark_Set\n Containers.Set_Impl\n \"HOL-Library.Code_Target_Nat\"\nbegin\n\nlemma [code_unfold del]: \"card \\ Cardinality.card'\" by(simp)\n\ninstantiation word :: (len) ceq begin\ndefinition \"CEQ('a word) = Some (=)\"\ninstance by(intro_classes)(simp add: ceq_word_def)\nend\n\ninstantiation word :: (len) compare begin\ndefinition \"compare_word = (comparator_of :: 'a word comparator)\"\ninstance by(intro_classes)(simp add: compare_word_def comparator_of)\nend\n\ninstantiation word :: (len) ccompare begin\ndefinition \"CCOMPARE('a word) = Some compare\"\ninstance by(intro_classes)(simp add: ccompare_word_def comparator_compare)\nend\n\ninstantiation word :: (len) set_impl begin\ndefinition \"SET_IMPL('a word) = Phantom('a word) set_RBT\"\ninstance ..\nend\n\ninstantiation word :: (len) proper_interval begin\n\nfun proper_interval_word :: \"'a word option \\ 'a word option \\ bool\"\nwhere\n \"proper_interval_word None None = True\"\n| \"proper_interval_word None (Some y) = (y \\ 0)\"\n| \"proper_interval_word (Some x) None = (x \\ - 1)\"\n| \"proper_interval_word (Some x) (Some y) = (x < y \\ x \\ y - 1)\"\n\ninstance\nproof\n let ?pi = \"proper_interval :: 'a word proper_interval\"\n show \"?pi None None = True\" by simp\n fix y\n show \"?pi None (Some y) = (\\z. z < y)\"\n using word_neq_0_conv [of y] by auto\n fix x\n show \"?pi (Some x) None = (\\z. x < z)\"\n using word_order.not_eq_extremum [of x] by auto\n\n have \"(x < y \\ x \\ y - 1) = (\\z>x. z < y)\" (is \"?lhs \\ ?rhs\")\n proof\n assume ?lhs\n then obtain \"x < y\" \"x \\ y - 1\" ..\n have \"0 \\ uint x\" by simp\n also have \"\\ < uint y\" using \\x < y\\ by(simp add: word_less_def)\n finally have \"0 < uint y\" .\n then have \"y - 1 < y\" by(simp add: word_less_def uint_sub_if' not_le)\n moreover from \\0 < uint y\\ \\x < y\\ \\x \\ y - 1\\\n have \"x < y - 1\" by(simp add: word_less_def uint_sub_if' uint_arith_simps(3))\n ultimately show ?rhs by blast\n next\n assume ?rhs\n then obtain z where z: \"x < z\" \"z < y\" by blast\n have \"0 \\ uint z\" by simp\n also have \"\\ < uint y\" using \\z < y\\ by(simp add: word_less_def)\n finally show ?lhs using z by(auto simp add: word_less_def uint_sub_if')\n qed\n thus \"?pi (Some x) (Some y) = (\\z>x. z < y)\" by simp\nqed\n\nend\n\ninstantiation word :: (len) cproper_interval begin\ndefinition \"cproper_interval = (proper_interval :: 'a word proper_interval)\"\ninstance by( intro_classes, simp add: cproper_interval_word_def ccompare_word_def \n compare_word_def le_lt_comparator_of ID_Some proper_interval_class.axioms)\nend\n\ninstantiation word :: (len) cenum begin\ndefinition \"CENUM('a word) = None\"\ninstance by(intro_classes)(simp_all add: cEnum_word_def)\nend\n\nnotepad begin\n have \"Benchmark_Set.complete 30 40 (12345, 67899) = (32, 4294967296)\" by eval\nend\n\nend\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Containers/ITP-2013/Benchmark_Set_LC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2760794156570931}} {"text": "theory Ipassmt\nimports Common_Primitive_Syntax\n \"../Semantics_Ternary/Primitive_Normalization\"\n \"../../Simple_Firewall/Primitives/Iface\"\n \"../../Simple_Firewall/Common/IP_Addr_WordInterval_toString\" (*for debug pretty-printing*)\n \"../../Automatic_Refinement/Lib/Misc\" (*dependnecy!*)\nbegin\n\n text\\A mapping from an interface to its assigned ip addresses in CIDR notation\\\n type_synonym 'i ipassignment=\"iface \\ ('i word \\ nat) list\" (*technically, a set*)\n\n\nsubsection\\Sanity checking for an @{typ \"'i ipassignment\"}.\\\n\n text\\warning if interface map has wildcards\\\n definition ipassmt_sanity_nowildcards :: \"'i ipassignment \\ bool\" where\n \"ipassmt_sanity_nowildcards ipassmt \\ \\ iface \\ dom ipassmt. \\ iface_is_wildcard iface\"\n\n text\\Executable of the @{typ \"'i ipassignment\"} is given as a list.\\\n \n\n\n (* use this in all exported code*)\n (*TODO: generate useful error message in exported code*)\n definition map_of_ipassmt :: \"(iface \\ ('i word \\ nat) list) list \\ iface \\ ('i word \\ nat) list\" where\n \"map_of_ipassmt ipassmt = (\n if\n distinct (map fst ipassmt) \\ ipassmt_sanity_nowildcards (map_of ipassmt)\n then\n map_of ipassmt\n else undefined (*undefined_ipassmt_must_be_distinct_and_dont_have_wildcard_interfaces*))\"\n\n\n text\\some additional (optional) sanity checks\\\n \n text\\sanity check that there are no zone-spanning interfaces\\\n definition ipassmt_sanity_disjoint :: \"'i::len ipassignment \\ bool\" where\n \"ipassmt_sanity_disjoint ipassmt \\ \\ i1 \\ dom ipassmt. \\ i2 \\ dom ipassmt. i1 \\ i2 \\\n ipcidr_union_set (set (the (ipassmt i1))) \\ ipcidr_union_set (set (the (ipassmt i2))) = {}\"\n \n lemma[code_unfold]: \"ipassmt_sanity_disjoint (map_of ipassmt) \\\n (let Is = fst` set ipassmt in \n (\\ i1 \\ Is. \\ i2 \\ Is. i1 \\ i2 \\ wordinterval_empty (wordinterval_intersection (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1)))) (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))))\"\n apply(simp add: ipassmt_sanity_disjoint_def Map.dom_map_of_conv_image_fst)\n apply(simp add: ipcidr_union_set_def)\n apply(simp add: l2wi)\n apply(simp add: ipcidr_to_interval_def)\n using ipset_from_cidr_ipcidr_to_interval by blast\n \n \n text\\Checking that the ipassmt covers the complete ipv4 address space.\\\n definition ipassmt_sanity_complete :: \"(iface \\ ('i::len word \\ nat) list) list \\ bool\" where\n \"ipassmt_sanity_complete ipassmt \\ distinct (map fst ipassmt) \\ (\\(ipcidr_union_set ` set ` (ran (map_of ipassmt)))) = UNIV\"\n\n lemma[code_unfold]: \"ipassmt_sanity_complete ipassmt \\ distinct (map fst ipassmt) \\ (let range = map snd ipassmt in \n wordinterval_eq (wordinterval_Union (map (l2wi \\ (map ipcidr_to_interval)) range)) wordinterval_UNIV\n )\"\n apply(cases \"distinct (map fst ipassmt)\")\n apply(simp add: ipassmt_sanity_complete_def)\n apply(simp add: Map.ran_distinct)\n apply(simp add: wordinterval_eq_set_eq wordinterval_Union)\n apply(simp add: l2wi)\n apply(simp add: ipcidr_to_interval_def)\n apply(simp add: ipcidr_union_set_def ipset_from_cidr_ipcidr_to_interval; fail)\n apply(simp add: ipassmt_sanity_complete_def)\n done\n\n\n\n value[code] \"ipassmt_sanity_nowildcards (map_of [(Iface ''eth1.1017'', [(ipv4addr_of_dotdecimal (131,159,14,240), 28)])])\"\n\n fun collect_ifaces' :: \"'i::len common_primitive rule list \\ iface list\" where\n \"collect_ifaces' [] = []\" |\n \"collect_ifaces' ((Rule m a)#rs) = filter (\\iface. iface \\ ifaceAny) (\n (map (\\x. case x of Pos i \\ i | Neg i \\ i) (fst (primitive_extractor (is_Iiface, iiface_sel) m))) @\n (map (\\x. case x of Pos i \\ i | Neg i \\ i) (fst (primitive_extractor (is_Oiface, oiface_sel) m))) @ collect_ifaces' rs)\"\n\n definition collect_ifaces :: \"'i::len common_primitive rule list \\ iface list\" where\n \"collect_ifaces rs \\ mergesort_remdups (collect_ifaces' rs)\"\n lemma \"set (collect_ifaces rs) = set (collect_ifaces' rs)\"\n by(simp add: collect_ifaces_def mergesort_remdups_correct)\n\n text\\sanity check that all interfaces mentioned in the ruleset are also listed in the ipassmt. May fail for wildcard interfaces in the ruleset.\\\n\n (*primitive_extractor requires normalized_nnf_primitives*)\n definition ipassmt_sanity_defined :: \"'i::len common_primitive rule list \\ 'i ipassignment \\ bool\" where\n \"ipassmt_sanity_defined rs ipassmt \\ \\ iface \\ set (collect_ifaces rs). iface \\ dom ipassmt\"\n\n lemma[code]: \"ipassmt_sanity_defined rs ipassmt \\ (\\ iface \\ set (collect_ifaces rs). ipassmt iface \\ None)\"\n by(simp add: ipassmt_sanity_defined_def Map.domIff)\n \n lemma \"ipassmt_sanity_defined [\n Rule (MatchAnd (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192,168,0,0)) 24))) (Match (IIface (Iface ''eth1.1017'')))) action.Accept,\n Rule (MatchAnd (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192,168,0,0)) 24))) (Match (IIface (ifaceAny)))) action.Accept,\n Rule MatchAny action.Drop]\n (map_of [(Iface ''eth1.1017'', [(ipv4addr_of_dotdecimal (131,159,14,240), 28)])])\" by eval\n\n\n\n (*TODO: use and add code equation*)\n definition ipassmt_ignore_wildcard :: \"'i::len ipassignment \\ 'i ipassignment\" where\n \"ipassmt_ignore_wildcard ipassmt \\ \\k. case ipassmt k of None \\ None \n | Some ips \\ if ipcidr_union_set (set ips) = UNIV then None else Some ips\"\n\n lemma ipassmt_ignore_wildcard_le: \"ipassmt_ignore_wildcard ipassmt \\\\<^sub>m ipassmt\"\n apply(simp add: ipassmt_ignore_wildcard_def map_le_def)\n apply(clarify)\n apply(simp split: option.split_asm if_split_asm)\n done\n\n definition ipassmt_ignore_wildcard_list:: \"(iface \\ ('i::len word \\ nat) list) list \\ (iface \\ ('i word \\ nat) list) list\" where\n \"ipassmt_ignore_wildcard_list ipassmt = filter (\\(_,ips). \\ wordinterval_eq (l2wi (map ipcidr_to_interval ips)) wordinterval_UNIV) ipassmt\"\n\n (*distinct fst ipassmt notwendig?*)\n lemma \"distinct (map fst ipassmt) \\\n map_of (ipassmt_ignore_wildcard_list ipassmt) = ipassmt_ignore_wildcard (map_of ipassmt)\"\n apply(simp add: ipassmt_ignore_wildcard_list_def ipassmt_ignore_wildcard_def)\n apply(simp add: wordinterval_eq_set_eq)\n apply(simp add: l2wi)\n apply(simp add: ipcidr_to_interval_def)\n apply(simp add: fun_eq_iff)\n apply(clarify)\n apply(induction ipassmt)\n apply(simp; fail)\n apply(simp)\n apply(simp split:option.split option.split_asm)\n apply(simp add: ipcidr_union_set_def ipset_from_cidr_ipcidr_to_interval)\n apply(simp add: case_prod_unfold)\n by blast\n (*apply(safe)\n apply(simp_all)\n by (simp add: rev_image_eqI)*)\n \n\n \n text\\Debug algorithm with human-readable output\\\n definition debug_ipassmt_generic\n :: \"('i::len wordinterval \\ string) \\\n (iface \\ ('i word \\ nat) list) list \\ 'i common_primitive rule list \\ string list\" where\n \"debug_ipassmt_generic toStr ipassmt rs \\ let ifaces = (map fst ipassmt) in [\n ''distinct: '' @ (if distinct ifaces then ''passed'' else ''FAIL!'')\n , ''ipassmt_sanity_nowildcards: '' @\n (if ipassmt_sanity_nowildcards (map_of ipassmt)\n then ''passed'' else ''fail: ''@list_toString iface_sel (filter iface_is_wildcard ifaces))\n , ''ipassmt_sanity_defined (interfaces defined in the ruleset are also in ipassmt): '' @ \n (if ipassmt_sanity_defined rs (map_of ipassmt)\n then ''passed'' else ''fail: ''@list_toString iface_sel [i \\ (collect_ifaces rs). i \\ set ifaces])\n , ''ipassmt_sanity_disjoint (no zone-spanning interfaces): '' @\n (if ipassmt_sanity_disjoint (map_of ipassmt)\n then ''passed'' else ''fail: ''@list_toString (\\(i1,i2). ''('' @ iface_sel i1 @ '','' @ iface_sel i2 @ '')'')\n [(i1,i2) \\ List.product ifaces ifaces. i1 \\ i2 \\\n \\ wordinterval_empty (wordinterval_intersection\n (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1))))\n (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))\n ])\n , ''ipassmt_sanity_disjoint excluding UNIV interfaces: '' @\n (let ipassmt = ipassmt_ignore_wildcard_list ipassmt;\n ifaces = (map fst ipassmt)\n in\n (if ipassmt_sanity_disjoint (map_of ipassmt)\n then ''passed'' else ''fail: ''@list_toString (\\(i1,i2). ''('' @ iface_sel i1 @ '','' @ iface_sel i2 @ '')'')\n [(i1,i2) \\ List.product ifaces ifaces. i1 \\ i2 \\\n \\ wordinterval_empty (wordinterval_intersection\n (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1))))\n (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))\n ]))\n , ''ipassmt_sanity_complete: '' @ \n (if ipassmt_sanity_complete ipassmt\n then ''passed''\n else ''the following is not covered: '' @ \n toStr (wordinterval_setminus wordinterval_UNIV (wordinterval_Union (map (l2wi \\ (map ipcidr_to_interval)) (map snd ipassmt)))))\n , ''ipassmt_sanity_complete excluding UNIV interfaces: '' @\n (let ipassmt = ipassmt_ignore_wildcard_list ipassmt\n in\n (if ipassmt_sanity_complete ipassmt\n then ''passed''\n else ''the following is not covered: '' @\n toStr (wordinterval_setminus wordinterval_UNIV (wordinterval_Union (map (l2wi \\ (map ipcidr_to_interval)) (map snd ipassmt))))))\n ]\"\n\n definition \"debug_ipassmt_ipv4 \\ debug_ipassmt_generic ipv4addr_wordinterval_toString\"\n definition \"debug_ipassmt_ipv6 \\ debug_ipassmt_generic ipv6addr_wordinterval_toString\"\n\n\n lemma dom_ipassmt_ignore_wildcard:\n \"i\\dom (ipassmt_ignore_wildcard ipassmt) \\ i \\ dom ipassmt \\ ipcidr_union_set (set (the (ipassmt i))) \\ UNIV\"\n apply(simp add: ipassmt_ignore_wildcard_def)\n apply(rule)\n apply(clarify)\n apply(simp split: option.split_asm if_split_asm)\n apply blast\n apply(clarify)\n apply(simp)\n done\n\n lemma ipassmt_ignore_wildcard_the:\n \"ipassmt i = Some ips \\ ipcidr_union_set (set ips) \\ UNIV \\ (the (ipassmt_ignore_wildcard ipassmt i)) = ips\"\n \"ipassmt_ignore_wildcard ipassmt i = Some ips \\ the (ipassmt i) = ips\"\n \"ipassmt_ignore_wildcard ipassmt i = Some ips \\ ipcidr_union_set (set ips) \\ UNIV\"\n by (simp_all add: ipassmt_ignore_wildcard_def split: option.split_asm if_split_asm)\n \n\n lemma ipassmt_sanity_disjoint_ignore_wildcards:\n \"ipassmt_sanity_disjoint (ipassmt_ignore_wildcard ipassmt) \\\n (\\i1\\dom ipassmt.\n \\i2\\dom ipassmt.\n ipcidr_union_set (set (the (ipassmt i1))) \\ UNIV \\\n ipcidr_union_set (set (the (ipassmt i2))) \\ UNIV \\\n i1 \\ i2 \n \\ ipcidr_union_set (set (the (ipassmt i1))) \\ ipcidr_union_set (set (the (ipassmt i2))) = {})\"\n apply(simp add: ipassmt_sanity_disjoint_def)\n apply(rule)\n apply(clarify)\n apply(simp)\n subgoal for i1 i2 ips1 ips2\n apply(erule_tac x=i1 in ballE)\n prefer 2\n using dom_ipassmt_ignore_wildcard apply (metis domI option.sel)\n apply(erule_tac x=i2 in ballE)\n prefer 2\n using dom_ipassmt_ignore_wildcard apply (metis domI domIff option.sel)\n by(simp add: ipassmt_ignore_wildcard_the; fail)\n apply(clarify)\n apply(simp)\n subgoal for i1 i2 ips1 ips2\n apply(erule_tac x=i1 in ballE)\n prefer 2\n using dom_ipassmt_ignore_wildcard apply auto[1]\n apply(erule_tac x=i2 in ballE)\n prefer 2\n using dom_ipassmt_ignore_wildcard apply auto[1]\n by(simp add: ipassmt_ignore_wildcard_the)\n done\n\n text\\Confusing names: @{const ipassmt_sanity_nowildcards} refers to wildcard interfaces.\n @{const ipassmt_ignore_wildcard} refers to the UNIV ip range.\n\\\n lemma ipassmt_sanity_nowildcards_ignore_wildcardD:\n \"ipassmt_sanity_nowildcards ipassmt \\ ipassmt_sanity_nowildcards (ipassmt_ignore_wildcard ipassmt)\"\n by (simp add: dom_ipassmt_ignore_wildcard ipassmt_sanity_nowildcards_def)\n \n\n lemma ipassmt_disjoint_nonempty_inj:\n assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n and ifce: \"ipassmt ifce = Some i_ips\"\n and a: \"ipcidr_union_set (set i_ips) \\ {}\"\n and k: \"ipassmt k = Some i_ips\"\n shows \"k = ifce\"\n proof(rule ccontr)\n assume \"k \\ ifce\"\n with ifce k ipassmt_disjoint have \"ipcidr_union_set (set (the (ipassmt k))) \\ ipcidr_union_set (set (the (ipassmt ifce))) = {}\"\n unfolding ipassmt_sanity_disjoint_def by fastforce\n thus False using a ifce k by auto \n qed\n\n lemma ipassmt_ignore_wildcard_None_Some:\n \"ipassmt_ignore_wildcard ipassmt ifce = None \\ ipassmt ifce = Some ips \\ ipcidr_union_set (set ips) = UNIV\"\n by (metis domI domIff dom_ipassmt_ignore_wildcard option.sel)\n \n\n (*can this lemma be somehow useful?\n maybe when rewriting, we can try to rewrite in the ignore_wildcard space and just constrain the the other area?*)\n lemma ipassmt_disjoint_ignore_wildcard_nonempty_inj:\n assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint (ipassmt_ignore_wildcard ipassmt)\"\n and ifce: \"ipassmt ifce = Some i_ips\"\n and a: \"ipcidr_union_set (set i_ips) \\ {}\"\n and k: \"(ipassmt_ignore_wildcard ipassmt) k = Some i_ips\"\n shows \"k = ifce\"\n proof(rule ccontr)\n assume \"k \\ ifce\"\n show False\n proof(cases \"(ipassmt_ignore_wildcard ipassmt) ifce\")\n case (Some i_ips') (*proofs mainly by sledgehammer*)\n hence \"i_ips' = i_ips\" using ifce ipassmt_ignore_wildcard_the(2) by fastforce\n hence \"(ipassmt_ignore_wildcard ipassmt) k = Some i_ips\" using Some ifce ipassmt_ignore_wildcard_def k by auto \n thus False using Some \\i_ips' = i_ips\\ \\k \\ ifce\\ a ipassmt_disjoint ipassmt_disjoint_nonempty_inj by blast\n next\n case None\n with ipassmt_ignore_wildcard_None_Some have \"ipcidr_union_set (set i_ips) = UNIV\" using ifce by auto \n thus False using ipassmt_ignore_wildcard_the(3) k by blast \n qed\n qed\n\n lemma ipassmt_disjoint_inj_k: \n assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n and ifce: \"ipassmt ifce = Some ips\"\n and k: \"ipassmt k = Some ips'\"\n and a: \"p \\ ipcidr_union_set (set ips)\"\n and b: \"p \\ ipcidr_union_set (set ips')\"\n shows \"k = ifce\"\n proof(rule ccontr)\n assume \"k \\ ifce\"\n with ipassmt_disjoint have\n \"ipcidr_union_set (set (the (ipassmt k))) \\ ipcidr_union_set (set (the (ipassmt ifce))) = {}\"\n unfolding ipassmt_sanity_disjoint_def using ifce k by blast\n hence \"ipcidr_union_set (set ips') \\ ipcidr_union_set (set ips) = {}\" by(simp add: k ifce)\n thus False using a b by blast\n qed\n\n (*might also work when we ignore UNIVs in the ipassmt? (not tested)*)\n lemma ipassmt_disjoint_matcheq_iifce_srcip:\n assumes ipassmt_nowild: \"ipassmt_sanity_nowildcards ipassmt\"\n and ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n and ifce: \"ipassmt ifce = Some i_ips\"\n and p_ifce: \"ipassmt (Iface (p_iiface p)) = Some p_ips \\ p_src p \\ ipcidr_union_set (set p_ips)\"\n shows \"match_iface ifce (p_iiface p) \\ p_src p \\ ipcidr_union_set (set i_ips)\"\n proof\n assume \"match_iface ifce (p_iiface p)\"\n thus \"p_src p \\ ipcidr_union_set (set i_ips)\"\n apply(cases \"ifce = Iface (p_iiface p)\")\n using ifce p_ifce apply force\n by (metis domI iface.sel iface_is_wildcard_def ifce ipassmt_nowild ipassmt_sanity_nowildcards_def match_iface.elims(2) match_iface_case_nowildcard)\n next\n assume a: \"p_src p \\ ipcidr_union_set (set i_ips)\"\n --\\basically, we need to reverse the map @{term ipassmt}\\\n\n from ipassmt_disjoint_nonempty_inj[OF ipassmt_disjoint ifce] a have ipassmt_inj: \"\\k. ipassmt k = Some i_ips \\ k = ifce\" by blast\n\n from ipassmt_disjoint_inj_k[OF ipassmt_disjoint ifce _ a] have ipassmt_inj_k:\n \"\\k ips'. ipassmt k = Some ips' \\ p_src p \\ ipcidr_union_set (set ips') \\ k = ifce\" by simp\n\n have ipassmt_inj_p: \"\\ips'. p_src p \\ ipcidr_union_set (set ips') \\ (\\k. ipassmt k = Some ips') \\ ips' = i_ips\"\n apply(clarify)\n apply(rename_tac ips' k)\n apply(subgoal_tac \"k = ifce\")\n using ifce apply simp\n using ipassmt_inj_k by simp\n\n from p_ifce have \"(Iface (p_iiface p)) = ifce\" using ipassmt_inj_p ipassmt_inj by blast \n\n thus \"match_iface ifce (p_iiface p)\" using match_iface_refl by blast \n qed\n\n\n\n definition ipassmt_generic_ipv4 :: \"(iface \\ (32 word \\ nat) list) list\" where\n \"ipassmt_generic_ipv4 = [(Iface ''lo'', [(ipv4addr_of_dotdecimal (127,0,0,0),8)])]\"\n\n definition ipassmt_generic_ipv6 :: \"(iface \\ (128 word \\ nat) list) list\" where\n \"ipassmt_generic_ipv6 = [(Iface ''lo'', [(1,128)])]\" (*::1/128*)\n\n\n\nsubsection\\IP Assignment difference\\\n text\\Compare two ipassmts. Returns a list of tuples\n First entry of the tuple: things which are in the left ipassmt but not in the right.\n Second entry of the tupls: things which are in the right ipassmt but not in the left.\\\n definition ipassmt_diff\n :: \"(iface \\ ('i::len word \\ nat) list) list \\ (iface \\ ('i::len word \\ nat) list) list\n \\ (iface \\ ('i word \\ nat) list \\ ('i word \\ nat) list) list\"\n where\n \"ipassmt_diff a b \\ let\n t = \\s. (case s of None \\ Empty_WordInterval\n | Some s \\ wordinterval_Union (map ipcidr_tuple_to_wordinterval s));\n k = \\x y d. cidr_split (wordinterval_setminus (t (map_of x d)) (t (map_of y d)))\n in\n [(d, (k a b d, k b a d)). d \\ remdups (map fst (a @ b))]\"\n \n \n text\\If an interface is defined in both ipassignments and there is no difference\n then the two ipassignements describe the same IP range for this interface.\\\n lemma ipassmt_diff_ifce_equal: \"(ifce, [], []) \\ set (ipassmt_diff ipassmt1 ipassmt2) \\\n ifce \\ dom (map_of ipassmt1) \\ ifce \\ dom (map_of ipassmt2) \\\n ipcidr_union_set (set (the ((map_of ipassmt1) ifce))) =\n ipcidr_union_set (set (the ((map_of ipassmt2) ifce)))\"\n proof -\n have cidr_empty: \"[] = cidr_split r \\ wordinterval_to_set r = {}\" for r :: \"'a wordinterval\"\n apply(subst cidr_split_prefix[symmetric])\n by(simp)\n show \"(ifce, [], []) \\ set (ipassmt_diff ipassmt1 ipassmt2) \\\n ifce \\ dom (map_of ipassmt1) \\ ifce \\ dom (map_of ipassmt2) \\\n ipcidr_union_set (set (the ((map_of ipassmt1) ifce))) =\n ipcidr_union_set (set (the ((map_of ipassmt2) ifce)))\"\n apply(simp add: ipassmt_diff_def Let_def ipcidr_union_set_uncurry)\n apply(simp add: Set.image_iff)\n apply(elim conjE)\n apply(drule cidr_empty)+\n apply(simp)\n apply(simp add: domIff)\n apply(elim exE)\n apply(simp add: wordinterval_Union wordinterval_to_set_ipcidr_tuple_to_wordinterval_uncurry)\n done\n qed\n\n lemma ipcidr_union_cidr_split[simp]: \"ipcidr_union_set (set (cidr_split a)) = wordinterval_to_set a\"\n by(simp add: ipcidr_union_set_uncurry cidr_split_prefix)\n\n lemma \n defines \"assmt as ifce \\ ipcidr_union_set (set (the ((map_of as ifce))))\"\n assumes diffs: \"(ifce, d1, d2) \\ set (ipassmt_diff ipassmt1 ipassmt2)\"\n and doms: \"ifce \\ dom (map_of ipassmt1)\" \"ifce \\ dom (map_of ipassmt2)\"\n shows \"ipcidr_union_set (set d1) = assmt ipassmt1 ifce - assmt ipassmt2 ifce\"\n \"ipcidr_union_set (set d2) = assmt ipassmt2 ifce - assmt ipassmt1 ifce\"\n using assms by (clarsimp simp add: ipassmt_diff_def Let_def assmt_def wordinterval_Union; simp add: ipcidr_union_set_uncurry uncurry_def wordinterval_to_set_ipcidr_tuple_to_wordinterval_uncurry)+\n \n \n text\\Explanation for interface @{term \"Iface ''a''\"}: \n Left ipassmt: The IP range 4/30 contains the addresses 4,5,6,7\n Diff: right ipassmt contains 6/32, so 4,5,7 is only in the left ipassmt.\n IP addresses 4,5 correspond to subnet 4/30.\\\n lemma \"ipassmt_diff (ipassmt_generic_ipv4 @ [(Iface ''a'', [(4,30)])])\n (ipassmt_generic_ipv4 @ [(Iface ''a'', [(6,32), (0,30)]), (Iface ''b'', [(42,32)])]) =\n [(Iface ''lo'', [], []),\n (Iface ''a'', [(4, 31),(7, 32)],\n [(0, 30)]\n ),\n (Iface ''b'', [], [(42, 32)])]\" by eval\n\nend", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Primitive_Matchers/Ipassmt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2760794156570931}} {"text": "theory Common_Primitive_toString\nimports \"../../Simple_Firewall/Primitives/Primitives_toString\"\n Common_Primitive_Matcher\nbegin\n\n\nsection\\Firewall toString Functions\\\n\nfun ipt_ipv4range_toString :: \"32 ipt_iprange \\ string\" where\n \"ipt_ipv4range_toString (IpAddr ip) = ipv4addr_toString ip\" |\n \"ipt_ipv4range_toString (IpAddrNetmask ip n) = ipv4addr_toString ip@''/''@string_of_nat n\" |\n \"ipt_ipv4range_toString (IpAddrRange ip1 ip2) = ipv4addr_toString ip1@''-''@ipv4addr_toString ip2\"\n\nfun ipt_ipv6range_toString :: \"128 ipt_iprange \\ string\" where\n \"ipt_ipv6range_toString (IpAddr ip) = ipv6addr_toString ip\" |\n \"ipt_ipv6range_toString (IpAddrNetmask ip n) = ipv6addr_toString ip@''/''@string_of_nat n\" |\n \"ipt_ipv6range_toString (IpAddrRange ip1 ip2) = ipv6addr_toString ip1@''-''@ipv6addr_toString ip2\"\n\ndefinition ipv4addr_wordinterval_pretty_toString :: \"32 wordinterval \\ string\" where\n \"ipv4addr_wordinterval_pretty_toString wi = list_toString ipt_ipv4range_toString (wi_to_ipt_iprange wi)\"\n\nlemma \"ipv4addr_wordinterval_pretty_toString \n (RangeUnion (RangeUnion (WordInterval 0x7F000000 0x7FFFFFFF) (WordInterval 0x1020304 0x1020306))\n (WordInterval 0x8080808 0x8080808)) = ''[127.0.0.0/8, 1.2.3.4-1.2.3.6, 8.8.8.8]''\" by eval\n \n\n\nfun action_toString :: \"action \\ string\" where\n \"action_toString action.Accept = ''-j ACCEPT''\" |\n \"action_toString action.Drop = ''-j DROP''\" |\n \"action_toString action.Reject = ''-j REJECT''\" |\n \"action_toString (action.Call target) = ''-j ''@target@'' (call)''\" |\n \"action_toString (action.Goto target) = ''-g ''@target\" |\n \"action_toString action.Empty = ''''\" |\n \"action_toString action.Log = ''-j LOG''\" |\n \"action_toString action.Return = ''-j RETURN''\" |\n \"action_toString action.Unknown = ''!!!!!!!!!!! UNKNOWN !!!!!!!!!!!''\"\n\n\nfun common_primitive_toString :: \"('i::len word \\ string) \\ 'i common_primitive \\ string\" where\n \"common_primitive_toString ipToStr (Src (IpAddr ip)) = ''-s ''@ipToStr ip\" |\n \"common_primitive_toString ipToStr (Dst (IpAddr ip)) = ''-d ''@ipToStr ip\" |\n \"common_primitive_toString ipToStr (Src (IpAddrNetmask ip n)) = ''-s ''@ipToStr ip@''/''@string_of_nat n\" |\n \"common_primitive_toString ipToStr (Dst (IpAddrNetmask ip n)) = ''-d ''@ipToStr ip@''/''@string_of_nat n\" |\n \"common_primitive_toString ipToStr (Src (IpAddrRange ip1 ip2)) = ''-m iprange --src-range ''@ipToStr ip1@''-''@ipToStr ip2\" |\n \"common_primitive_toString ipToStr (Dst (IpAddrRange ip1 ip2)) = ''-m iprange --dst-range ''@ipToStr ip1@''-''@ipToStr ip2\" |\n \"common_primitive_toString _ (IIface ifce) = iface_toString ''-i '' ifce\" |\n \"common_primitive_toString _ (OIface ifce) = iface_toString ''-o '' ifce\" |\n \"common_primitive_toString _ (Prot prot) = ''-p ''@protocol_toString prot\" |\n \"common_primitive_toString _ (Src_Ports (L4Ports prot pts)) = ''-m ''@primitive_protocol_toString prot@'' --spts '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (Dst_Ports (L4Ports prot pts)) = ''-m ''@primitive_protocol_toString prot@'' --dpts '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (MultiportPorts (L4Ports prot pts)) = ''-p ''@primitive_protocol_toString prot@'' -m multiport --ports '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (CT_State S) = ''-m state --state ''@ctstate_set_toString S\" |\n \"common_primitive_toString _ (L4_Flags (TCP_Flags c m)) = ''--tcp-flags ''@ipt_tcp_flags_toString c@'' ''@ipt_tcp_flags_toString m\" |\n \"common_primitive_toString _ (Extra e) = ''~~''@e@''~~''\"\n\n\ndefinition common_primitive_ipv4_toString :: \"32 common_primitive \\ string\" where\n \"common_primitive_ipv4_toString \\ common_primitive_toString ipv4addr_toString\"\n\ndefinition common_primitive_ipv6_toString :: \"128 common_primitive \\ string\" where\n \"common_primitive_ipv6_toString \\ common_primitive_toString ipv6addr_toString\"\n\n\nfun common_primitive_match_expr_toString\n :: \"('i common_primitive \\ string) \\ 'i common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_toString toStr MatchAny = ''''\" |\n \"common_primitive_match_expr_toString toStr (Match m) = toStr m\" |\n \"common_primitive_match_expr_toString toStr (MatchAnd m1 m2) =\n common_primitive_match_expr_toString toStr m1 @'' '' @ common_primitive_match_expr_toString toStr m2\" |\n \"common_primitive_match_expr_toString toStr (MatchNot (Match m)) = ''! ''@toStr m\" |\n \"common_primitive_match_expr_toString toStr (MatchNot m) = ''NOT (''@common_primitive_match_expr_toString toStr m@'')''\"\n\ndefinition common_primitive_match_expr_ipv4_toString :: \"32 common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_ipv4_toString \\ common_primitive_match_expr_toString common_primitive_ipv4_toString\"\n\ndefinition common_primitive_match_expr_ipv6_toString :: \"128 common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_ipv6_toString \\ common_primitive_match_expr_toString common_primitive_ipv6_toString\"\n\nfun common_primitive_rule_toString :: \"32 common_primitive rule \\ string\" where\n \"common_primitive_rule_toString (Rule m a) = common_primitive_match_expr_ipv4_toString m @'' ''@action_toString a\"\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Primitive_Matchers/Common_Primitive_toString.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.2760780728050361}} {"text": "(* Title: JinjaDCI/BV/BVExec.thy\n\n Author: Tobias Nipkow, Gerwin Klein, Susannah Mansky\n Copyright 2000 TUM, 2020 UIUC\n\n Based on the Jinja theory BV/BVExec.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\ Kildall for the JVM \\label{sec:JVM} \\\n\ntheory BVExec\nimports Jinja.Abstract_BV TF_JVM\nbegin\n\ndefinition kiljvm :: \"jvm_prog \\ nat \\ nat \\ ty \\ \n instr list \\ ex_table \\ ty\\<^sub>i' err list \\ ty\\<^sub>i' err list\"\nwhere\n \"kiljvm P mxs mxl T\\<^sub>r is xt \\\n kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) \n (exec P mxs T\\<^sub>r xt is)\"\n\ndefinition wt_kildall :: \"jvm_prog \\ cname \\ staticb \\ ty list \\ ty \\ nat \\ nat \\ \n instr list \\ ex_table \\ bool\"\nwhere\n \"wt_kildall P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\\n 0 < size is \\ \n (let first = Some ([],(case b of Static \\ [] | NonStatic \\ [OK (Class C')])\n @(map OK Ts)@(replicate mxl\\<^sub>0 Err));\n start = (OK first)#(replicate (size is - 1) (OK None));\n result = kiljvm P mxs\n ((case b of Static \\ 0 | NonStatic \\ 1)+size Ts+mxl\\<^sub>0)\n T\\<^sub>r is xt start\n in \\n < size is. result!n \\ Err)\"\n\ndefinition wf_jvm_prog\\<^sub>k :: \"jvm_prog \\ bool\"\nwhere\n \"wf_jvm_prog\\<^sub>k P \\\n wf_prog (\\P C' (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). wt_kildall P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt) P\"\n\n\ntheorem (in start_context) is_bcv_kiljvm:\n \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n(*<*)\nproof -\n let ?n = \"length is\"\n have \"Semilat A r f\" using semilat_JVM[OF wf]\n by (simp add: Semilat.intro sl_def2)\n moreover have \"acc r\" using wf by simp blast\n moreover have \"top r Err\" by (simp add: JVM_le_unfold)\n moreover have \"pres_type step ?n A\" by (rule exec_pres_type)\n moreover have \"bounded step ?n\" by (rule bounded_step)\n moreover have \"mono r step ?n A\" using step_mono[OF wf] by simp\n ultimately have \"is_bcv r Err step ?n A (kildall r f step)\"\n by(rule is_bcv_kildall)\n moreover have kileq: \"kiljvm P mxs mxl T\\<^sub>r is xt = kildall r f step\"\n using f_def kiljvm_def r_def step_def_exec by blast\n ultimately show ?thesis by simp\nqed\n(*>*)\n\n(* FIXME: move? *)\nlemma subset_replicate [intro?]: \"set (replicate n x) \\ {x}\"\n by (induct n) auto\n\nlemma in_set_replicate:\n assumes \"x \\ set (replicate n y)\"\n shows \"x = y\"\n(*<*)\nproof -\n note assms\n also have \"set (replicate n y) \\ {y}\" ..\n finally show ?thesis by simp\nqed\n(*>*)\n\nlemma (in start_context) start_in_A [intro?]:\n \"0 < size is \\ start \\ list (size is) A\"\n using Ts C\n(*<*)\nproof(cases b)\nqed (force simp: JVM_states_unfold intro!: listI list_appendI\n dest!: in_set_replicate)+\n(*>*)\n\n\ntheorem (in start_context) wt_kil_correct:\n assumes wtk: \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n shows \"\\\\s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n(*<*)\nproof -\n from wtk obtain res where \n result: \"res = kiljvm P mxs mxl T\\<^sub>r is xt start\" and\n success: \"\\n < size is. res!n \\ Err\" and\n instrs: \"0 < size is\" \n by (unfold wt_kildall_def) simp\n \n have bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n by (rule is_bcv_kiljvm)\n \n from instrs have \"start \\ list (size is) A\" ..\n with bcv success result have \n \"\\ts\\list (size is) A. start [\\\\<^sub>r] ts \\ wt_step r Err step ts\"\n by (unfold is_bcv_def) blast\n then obtain \\s' where\n in_A: \"\\s' \\ list (size is) A\" and\n s: \"start [\\\\<^sub>r] \\s'\" and\n w: \"wt_step r Err step \\s'\"\n by blast\n hence wt_err_step: \"wt_err_step (sup_state_opt P) step \\s'\"\n by (simp add: wt_err_step_def JVM_le_Err_conv)\n\n from in_A have l: \"size \\s' = size is\" by simp \n moreover {\n from in_A have \"check_types P mxs mxl \\s'\" by (simp add: check_types_def)\n also from w have \"\\x \\ set \\s'. x \\ Err\" \n by (auto simp add: wt_step_def all_set_conv_all_nth)\n hence [symmetric]: \"map OK (map ok_val \\s') = \\s'\" \n by (auto intro!: map_idI simp add: wt_step_def)\n finally have \"check_types P mxs mxl (map OK (map ok_val \\s'))\" .\n } \n moreover { \n from s have \"start!0 \\\\<^sub>r \\s'!0\" by (rule le_listD) simp\n moreover\n from instrs w l \n have \"\\s'!0 \\ Err\" by (unfold wt_step_def) simp\n then obtain \\s0 where \"\\s'!0 = OK \\s0\" by auto\n ultimately\n have \"wt_start P C b Ts mxl\\<^sub>0 (map ok_val \\s')\" using l instrs\n by (unfold wt_start_def) \n (cases b; simp add: lesub_def JVM_le_Err_conv Err.le_def)\n }\n moreover \n from in_A have \"set \\s' \\ A\" by simp \n with wt_err_step bounded_step\n have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\s')\"\n by (auto intro: wt_err_imp_wt_app_eff simp add: l)\n ultimately\n have \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\s')\"\n using instrs by (simp add: wt_method_def2 check_types_def del: map_map)\n thus ?thesis by blast\nqed\n(*>*)\n\n\ntheorem (in start_context) wt_kil_complete:\n assumes wtm: \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n shows \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n(*<*)\nproof -\n from wtm obtain\n instrs: \"0 < size is\" and\n length: \"length \\s = length is\" and \n ck_type: \"check_types P mxs mxl (map OK \\s)\" and\n wt_start: \"wt_start P C b Ts mxl\\<^sub>0 \\s\" and\n app_eff: \"wt_app_eff (sup_state_opt P) app eff \\s\"\n by (simp add: wt_method_def2 check_types_def)\n\n from ck_type\n have in_A: \"set (map OK \\s) \\ A\" \n by (simp add: check_types_def) \n with app_eff in_A bounded_step\n have \"wt_err_step (sup_state_opt P) (err_step (size \\s) app eff) (map OK \\s)\"\n by - (erule wt_app_eff_imp_wt_err,\n auto simp add: exec_def length states_def)\n hence wt_err: \"wt_err_step (sup_state_opt P) step (map OK \\s)\" \n by (simp add: length)\n have is_bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n by (rule is_bcv_kiljvm)\n moreover from instrs have \"start \\ list (size is) A\" ..\n moreover\n let ?\\s = \"map OK \\s\" \n have less_\\s: \"start [\\\\<^sub>r] ?\\s\"\n proof (rule le_listI)\n from length instrs\n show \"length start = length (map OK \\s)\" by simp\n next\n fix n\n from wt_start have \"P \\ ok_val (start!0) \\' \\s!0\" \n by (cases b; simp add: wt_start_def)\n moreover from instrs length have \"0 < length \\s\" by simp\n ultimately have \"start!0 \\\\<^sub>r ?\\s!0\" \n by (simp add: JVM_le_Err_conv lesub_def)\n moreover {\n fix n'\n have \"OK None \\\\<^sub>r ?\\s!n\"\n by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n split: err.splits)\n hence \"\\n = Suc n'; n < size start\\ \\ start!n \\\\<^sub>r ?\\s!n\" by simp\n }\n ultimately\n show \"n < size start \\ start!n \\\\<^sub>r ?\\s!n\" by (cases n, blast+) \n qed\n moreover\n from ck_type length\n have \"?\\s \\ list (size is) A\"\n by (auto intro!: listI simp add: check_types_def)\n moreover\n from wt_err have \"wt_step r Err step ?\\s\" \n by (simp add: wt_err_step_def JVM_le_Err_conv)\n ultimately\n have \"\\p. p < size is \\ kiljvm P mxs mxl T\\<^sub>r is xt start ! p \\ Err\" \n by (unfold is_bcv_def) blast\n with instrs \n show \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\" by (unfold wt_kildall_def) simp\nqed\n(*>*)\n\n\ntheorem jvm_kildall_correct:\n \"wf_jvm_prog\\<^sub>k P = wf_jvm_prog P\"\n(*<*)\nproof -\n let ?\\ = \"\\C M. let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C M in \n SOME \\s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n let ?A = \"\\P C' (M, b, Ts, T\\<^sub>r, mxs, mxl\\<^sub>0, is, xt). wt_kildall P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n let ?B\\<^sub>\\ = \"\\\\. (\\P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\ C M))\"\n\n show ?thesis proof(rule iffI)\n \\ \\soundness\\\n assume wt: \"wf_jvm_prog\\<^sub>k P\"\n then have \"wf_prog ?A P\" by(simp add: wf_jvm_prog\\<^sub>k_def)\n moreover {\n fix wf_md C M b Ts Ca T m bd\n assume \"wf_prog wf_md P\" and sees: \"P \\ Ca sees M, b : Ts\\T = m in Ca\" and\n \"set Ts \\ types P\" and \"bd = (M, b, Ts, T, m)\" and\n \"?A P Ca bd\"\n then have \"(?B\\<^sub>\\ ?\\) P Ca bd\" using sees_method_is_class[OF sees]\n by (auto dest!: start_context.wt_kil_correct [OF start_context.intro] \n intro: someI)\n }\n ultimately have \"wf_prog (?B\\<^sub>\\ ?\\) P\" by(rule wf_prog_lift)\n then have \"wf_jvm_prog\\<^bsub>?\\\\<^esub> P\" by (simp add: wf_jvm_prog_phi_def)\n thus \"wf_jvm_prog P\" by (unfold wf_jvm_prog_def) fast\n next \n \\ \\completeness\\\n assume wt: \"wf_jvm_prog P\"\n then obtain \\ where \"wf_prog (?B\\<^sub>\\ \\) P\" by(clarsimp simp: wf_jvm_prog_def wf_jvm_prog_phi_def)\n moreover {\n fix wf_md C M b Ts Ca T m bd\n assume \"wf_prog wf_md P\" and sees: \"P \\ Ca sees M, b : Ts\\T = m in Ca\" and\n \"set Ts \\ types P\" and \"bd = (M, b, Ts, T, m)\" and\n \"(?B\\<^sub>\\ \\) P Ca bd\"\n then have \"?A P Ca bd\" using sees_method_is_class[OF sees]\n by (auto intro!: start_context.wt_kil_complete start_context.intro)\n }\n ultimately have \"wf_prog ?A P\" by(rule wf_prog_lift)\n thus \"wf_jvm_prog\\<^sub>k P\" by (simp add: wf_jvm_prog\\<^sub>k_def)\n qed\nqed\n(*>*)\n\nend\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/JinjaDCI/BV/BVExec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2760657113907823}} {"text": "(* Title: SSA_Semantics.thy\n Author: Sebastian Ullrich\n*)\n\nsection {* Proof of Semantic Equivalence *}\n\ntheory SSA_Semantics\nimports SSA_CFG\nbegin\n\ntype_synonym ('node, 'var) state = \"'var \\ 'node\"\n\ncontext CFG_SSA_Transformed\nbegin\n definition step ::\n \"'node \\ ('node, 'var) state \\ ('node, 'var) state\"\n where\n \"step m s v \\ if v \\ oldDefs m then Some m else s v\"\n\n no_notation Refine_Basic.conc_fun (\"\\\")\n\n inductive bs :: \"'node list \\ ('node, 'var) state \\ bool\" (infix \"\\\" 50)\n where\n \"Entry\\ns\\last ns \\ ns\\(fold (step) ns Map.empty)\"\n\n\n definition ssaStep ::\n \"'node \\ nat \\ ('node, 'val) state \\ ('node, 'val) state\"\n where\n \"ssaStep m i s v \\\n if v \\ defs m then\n Some m\n else\n case phis (m,v) of\n Some phiParams \\ s (phiParams ! i)\n | None \\ s v\"\n\n inductive ssaBS :: \"'node list \\ ('node, 'val) state \\ bool\" (infix \"\\\\<^sub>s\" 50)\n where\n empty: \"[Entry]\\\\<^sub>s(ssaStep (Entry) 0 Map.empty)\"\n | snoc: \"\\ns\\\\<^sub>ss; last ns = predecessors m ! i; m \\ set \\n; i < length (predecessors m)\\ \\\n (ns@[m])\\\\<^sub>s(ssaStep m i s)\"\n\n lemma ssaBS_I:\n assumes \"Entry\\ns\\n\"\n obtains s where \"ns\\\\<^sub>ss\"\n using assms\n proof (atomize_elim, induction rule:path2_rev_induct)\n case (snoc ns m' m)\n then obtain s where s: \"ns\\\\<^sub>ss\" by auto\n from snoc.hyps(2) obtain i where \"m' = predecessors m ! i\" \"i < length (predecessors m)\" by (auto simp:in_set_conv_nth)\n with snoc.hyps snoc.prems s show ?case by -(rule exI, erule ssaBS.snoc, auto dest:path2_last)\n qed (auto intro: ssaBS.empty)\n\n lemma ssaBS_nonempty[simp]: \"\\ ([]\\\\<^sub>ss)\"\n by (rule notI, cases rule: ssaBS.cases, auto)\n\n lemma ssaBS_hd[simp]: \"ns\\\\<^sub>ss \\ hd ns = Entry\"\n apply (induction rule: ssaBS.induct)\n apply (auto simp: hd_append)[1]\n by (case_tac ns; simp)\n\n lemma equiv_aux:\n assumes \"ns\\s\" \"ns\\\\<^sub>ss'\" \"last ns\\ms\\m\" \"v \\ allUses m\" \"\\n \\ set (tl ms). var v \\ var ` allDefs n\"\n shows \"s (var v) = s' v\"\n using assms(2) assms(1,3-) proof (induction arbitrary: v s ms m)\n case empty\n have \"v \\ defs (Entry)\"\n proof-\n from empty.prems(2,3) have \"defAss m v\" by - (rule allUses_def_ass, auto)\n with empty.prems(2) obtain n where n: \"n \\ set ms\" \"v \\ allDefs n\" by - (drule defAssD, auto)\n with empty.prems(4) have \"n \\ set (tl ms)\" by auto\n with empty.prems(2) n have \"n = Entry\" by (cases ms, auto dest: path2_hd)\n with n(2) show ?thesis by (auto simp: allDefs_def)\n qed\n with empty.prems(1) show ?case\n by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def split: option.split)\n next\n case (snoc ns s' n i)\n from snoc.prems(2) have[simp]: \"n \\ set \\n\" \"m \\ set \\n\" by auto\n from snoc.prems(2,3) have[simp]: \"v \\ allVars\" by - (rule allUses_in_allVars, auto)\n from snoc.hyps(4) have[simp]: \"n \\ Entry\" using Entry_unreachable len_greater_imp_nonempty by blast\n\n show ?case\n proof (cases \"var v \\ var ` allDefs n\")\n case True\n\n have[simp]: \"defNode v = n\" (is \"?n\\<^sub>v = _\")\n proof-\n from True obtain v' where v': \"v' \\ allDefs n\" \"var v' = var v\" by auto\n from snoc.prems(3) have \"defAss m v\" by - (rule allUses_def_ass, auto)\n moreover from snoc.prems(1) obtain ns' where ns': \"Entry\\ns'\\n\" \"set ns' \\ set (ns@[n])\" \"distinct ns'\"\n by (auto elim!: bs.cases intro: simple_path2)\n ultimately have \"?n\\<^sub>v \\ set (ns'@tl ms)\"\n using snoc.prems(2) by - (drule defAss_defNode, auto elim!: bs.cases dest: path2_app)\n moreover {\n let ?n'' = \"last (butlast ns')\"\n assume asm: \"?n\\<^sub>v \\ set (butlast ns')\"\n with ns'(1,3) have[simp]: \"?n\\<^sub>v \\ n\" by (cases ns' rule: rev_cases, auto dest!: path2_last)\n from ns'(1) have \"length ns' \\ 2\" using \\n \\ Entry\\ path2_nontrivial by blast\n with ns' have bns': \"Entry\\butlast ns'\\?n''\" \"?n'' \\ set (predecessors n)\"\n by (auto elim: path2_unsnoc)\n with asm obtain ns'' where ns'': \"?n\\<^sub>v\\ns''\\?n''\" \"suffixeq ns'' (butlast ns')\" \"?n\\<^sub>v \\ set (tl ns'')\"\n by - (rule path2_split_first_last, auto)\n with bns' snoc.prems(2) have \"?n\\<^sub>v\\(ns''@[n])@tl ms\\m\" by - (rule path2_app, auto)\n hence \"defNode v' \\ set (tl (ns''@[n]@tl ms))\"\n using v' snoc.prems(3,4) bns'(2) ns''(1,3)\n by - (rule conventional''[of v _ m], auto intro!: path2_app simp: path2_not_Nil)\n with ns' ns''(1) v'(1) have False by (auto simp: path2_not_Nil)\n }\n ultimately show ?thesis using snoc.prems(4) ns'(1) by (cases ns' rule: rev_cases, auto dest: path2_last)\n qed\n from `v \\ allVars` show ?thesis\n proof (cases rule: defNode_cases)\n case simpleDef\n thus ?thesis using snoc.prems(1) by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def)\n next\n case phi\n {\n fix v'\n assume asm: \"v' \\ defs n\" \"var v = var v'\"\n with phi have \"v' = v\" using allDefs_var_disjoint[of n v' v]\n \\defNode v = n\\ \\v \\ allVars\\ defNode(2) defs_in_allDefs snoc.hyps(3) by blast\n with asm(1) phi have False using simpleDefs_phiDefs_disjoint[of n]\n by (auto dest!: phi_phiDefs)\n }\n note 1 = this\n {\n fix vs\n assume asm: \"Entry\\ns @ [n]\\n\" \"phis (n, v) = Some vs\" \"var v \\ var ` defs n\"\n let ?n' = \"last ns\"\n from asm(1) have \"length ns \\ 1\"\n by (metis One_nat_def \\n \\ Entry\\ append_Nil graph_path_base.path2_def le_0_eq length_0_conv list.sel(1) not_less_eq_eq)\n hence \"Entry\\ns\\?n'\"\n by - (rule path2_unsnoc[OF asm(1)], auto)\n moreover have \"vs ! i \\ phiUses ?n'\" using snoc.hyps(2,4) phis_wf[OF asm(2)]\n by - (rule phiUsesI[OF _ asm(2)], auto simp: set_zip)\n ultimately have \"fold (step) ns Map.empty (var (vs ! i)) = s' (vs ! i)\"\n by - (rule snoc.IH[where ms4=\"[?n']\" and m4=\"?n'\"], auto intro!: bs.intros)\n hence \"fold (step) ns Map.empty (var v) = s' (vs ! i)\" using phis_same_var[OF asm(2), of \"vs ! i\"] snoc.hyps(4) phis_wf[OF asm(2)]\n by auto\n }\n thus ?thesis using phi snoc.prems(1)\n by - (erule bs.cases, auto dest!: 1 simp: step_def ssaStep_def oldDefs_def phi_def)\n qed\n next\n case False\n hence \"phis (n, v) = None\" by (auto simp: allDefs_def phiDefs_def)\n moreover have \"fold (step) ns Map.empty (var v) = s' v\"\n proof-\n from snoc.hyps(1) have \"length ns \\ 1\" by (cases ns, auto)\n moreover from snoc.prems(2,4) False have \"\\n \\ set ms. var v \\ var ` allDefs n\"\n by (cases ms, auto simp: phiDefs_def dest: path2_hd)\n ultimately show ?thesis\n using snoc.prems(1,2,3) by - (rule snoc.IH[where ms4=\"last ns#ms\"], auto elim!: bs.cases intro!: bs.intros elim: path2_unsnoc intro!: Cons_path2)\n qed\n ultimately show ?thesis\n using snoc.prems(1) False by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def defs_in_allDefs)\n qed\n qed\n\n theorem equiv:\n assumes \"ns\\s\" \"ns\\\\<^sub>ss'\" \"v \\ uses (last ns)\"\n shows \"s (var v) = s' v\"\n using assms by - (rule equiv_aux[where ms=\"[last ns]\"], auto elim!: bs.cases)\nend\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/SSA_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.27606570462603597}} {"text": "(* Title: JinjaThreads/Compiler/Compiler1.thy\n Author: Andreas Lochbihler, Tobias Nipkow\n\n Based on Jinja/Compiler/Compiler1\n*)\n\nheader {* \\isaheader{Compilation Stage 1} *}\n\ntheory Compiler1 imports\n PCompiler\n J1State\n ListIndex \nbegin\n\ndefinition fresh_var :: \"vname list \\ vname\"\nwhere \"fresh_var Vs \\ Auxiliary.concat (STR ''V'' # Vs)\"\n\nlemma fresh_var_fresh: \"fresh_var Vs \\ set Vs\"\nproof -\n have \"\\V \\ set Vs. length (String.explode V) < length (String.explode (fresh_var Vs))\"\n by(induct Vs)(auto simp add: fresh_var_def Auxiliary.concat_def STR_inverse implode_def)\n thus ?thesis by auto\nqed\n\ntext{* Replacing variable names by indices. *}\n\nfunction compE1 :: \"vname list \\ 'addr expr \\ 'addr expr1\"\n and compEs1 :: \"vname list \\ 'addr expr list \\ 'addr expr1 list\"\nwhere\n \"compE1 Vs (new C) = new C\"\n| \"compE1 Vs (newA T\\e\\) = newA T\\compE1 Vs e\\\"\n| \"compE1 Vs (Cast T e) = Cast T (compE1 Vs e)\"\n| \"compE1 Vs (e instanceof T) = (compE1 Vs e) instanceof T\"\n| \"compE1 Vs (Val v) = Val v\"\n| \"compE1 Vs (Var V) = Var(index Vs V)\"\n| \"compE1 Vs (e\\bop\\e') = (compE1 Vs e)\\bop\\(compE1 Vs e')\"\n| \"compE1 Vs (V:=e) = (index Vs V):= (compE1 Vs e)\"\n| \"compE1 Vs (a\\i\\) = (compE1 Vs a)\\compE1 Vs i\\\"\n| \"compE1 Vs (a\\i\\:=e) = (compE1 Vs a)\\compE1 Vs i\\:=compE1 Vs e\"\n| \"compE1 Vs (a\\length) = compE1 Vs a\\length\"\n| \"compE1 Vs (e\\F{D}) = compE1 Vs e\\F{D}\"\n| \"compE1 Vs (e\\F{D}:=e') = compE1 Vs e\\F{D}:=compE1 Vs e'\"\n| \"compE1 Vs (e\\M(es)) = (compE1 Vs e)\\M(compEs1 Vs es)\"\n| \"compE1 Vs {V:T=vo; e} = {(size Vs):T=vo; compE1 (Vs@[V]) e}\"\n| \"compE1 Vs (sync\\<^bsub>U\\<^esub> (o') e) = sync\\<^bsub>length Vs\\<^esub> (compE1 Vs o') (compE1 (Vs@[fresh_var Vs]) e)\"\n| \"compE1 Vs (insync\\<^bsub>U\\<^esub> (a) e) = insync\\<^bsub>length Vs\\<^esub> (a) (compE1 (Vs@[fresh_var Vs]) e)\"\n| \"compE1 Vs (e1;;e2) = (compE1 Vs e1);;(compE1 Vs e2)\"\n| \"compE1 Vs (if (b) e1 else e2) = (if (compE1 Vs b) (compE1 Vs e1) else (compE1 Vs e2))\"\n| \"compE1 Vs (while (b) e) = (while (compE1 Vs b) (compE1 Vs e))\"\n| \"compE1 Vs (throw e) = throw (compE1 Vs e)\"\n| \"compE1 Vs (try e1 catch(C V) e2) = try(compE1 Vs e1) catch(C (size Vs)) (compE1 (Vs@[V]) e2)\"\n\n| \"compEs1 Vs [] = []\"\n| \"compEs1 Vs (e#es) = compE1 Vs e # compEs1 Vs es\"\nby pat_completeness auto\ntermination\napply(relation \"case_sum (\\p. size (snd p)) (\\p. size_list size (snd p)) <*mlex*> {}\")\napply(rule wf_mlex[OF wf_empty])\napply(rule mlex_less, simp)+\ndone\n\nlemmas compE1_compEs1_induct =\n compE1_compEs1.induct[case_names New NewArray Cast InstanceOf Val Var BinOp LAss AAcc AAss ALen FAcc FAss Call Block Synchronized InSynchronized Seq Cond While throw TryCatch Nil Cons]\n\nlemma compEs1_conv_map [simp]: \"compEs1 Vs es = map (compE1 Vs) es\"\nby(induct es) simp_all\n\nlemmas compEs1_map_Val = compEs1_conv_map\n\nlemma compE1_eq_Val [simp]: \"compE1 Vs e = Val v \\ e = Val v\"\napply(cases e, auto)\ndone\n\nlemma Val_eq_compE1 [simp]: \"Val v = compE1 Vs e \\ e = Val v\"\napply(cases e, auto)\ndone\n\nlemma compEs1_eq_map_Val [simp]: \"compEs1 Vs es = map Val vs \\ es = map Val vs\"\napply(induct es arbitrary: vs)\napply(auto, blast)\ndone\n\nlemma compE1_eq_Var [simp]: \"compE1 Vs e = Var V \\ (\\V'. e = Var V' \\ V = index Vs V')\"\nby(cases e, auto)\n\nlemma compE1_eq_Call [simp]:\n \"compE1 Vs e = obj\\M(params) \\ (\\obj' params'. e = obj'\\M(params') \\ compE1 Vs obj' = obj \\ compEs1 Vs params' = params)\"\nby(cases e, auto)\n\nlemma length_compEs2 [simp]:\n \"length (compEs1 Vs es) = length es\"\nby(simp add: compEs1_conv_map)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows expr_locks_compE1 [simp]: \"expr_locks (compE1 Vs e) = expr_locks e\"\n and expr_lockss_compEs1 [simp]: \"expr_lockss (compEs1 Vs es) = expr_lockss es\"\nby(induct Vs e and Vs es rule: compE1_compEs1.induct)(auto intro: ext)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows contains_insync_compE1 [simp]: \"contains_insync (compE1 Vs e) = contains_insync e\"\n and contains_insyncs_compEs1 [simp]: \"contains_insyncs (compEs1 Vs es) = contains_insyncs es\"\nby(induct Vs e and Vs es rule: compE1_compEs1.induct)simp_all\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows max_vars_compE1: \"max_vars (compE1 Vs e) = max_vars e\"\n and max_varss_compEs1: \"max_varss (compEs1 Vs es) = max_varss es\"\napply(induct Vs e and Vs es rule: compE1_compEs1.induct)\napply(auto)\ndone\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows \\: \"size Vs = n \\ \\ (compE1 Vs e) n\"\n and \\s: \"size Vs = n \\ \\s (compEs1 Vs es) n\"\napply(induct Vs e and Vs es arbitrary: n and n rule: compE1_compEs1.induct)\napply auto\ndone\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows fv_compE1: \"fv e \\ set Vs \\ fv (compE1 Vs e) = (index Vs) ` (fv e)\"\n and fvs_compEs1: \"fvs es \\ set Vs \\ fvs (compEs1 Vs es) = (index Vs) ` (fvs es)\"\nproof(induct Vs e and Vs es rule: compE1_compEs1_induct)\n case (Block Vs V ty vo exp)\n have IH: \"fv exp \\ set (Vs @ [V]) \\ fv (compE1 (Vs @ [V]) exp) = index (Vs @ [V]) ` fv exp\" by fact\n from `fv {V:ty=vo; exp} \\ set Vs` have fv': \"fv exp \\ set (Vs @ [V])\" by auto\n from IH[OF this] have IH': \"fv (compE1 (Vs @ [V]) exp) = index (Vs @ [V]) ` fv exp\" .\n have \"fv (compE1 (Vs @ [V]) exp) - {length Vs} = index Vs ` (fv exp - {V})\"\n proof(rule equalityI[OF subsetI subsetI])\n fix x\n assume x: \"x \\ fv (compE1 (Vs @ [V]) exp) - {length Vs}\"\n hence \"x \\ length Vs\" by simp\n from x IH' have \"x \\ index (Vs @ [V]) ` fv exp\" by simp\n thus \"x \\ index Vs ` (fv exp - {V})\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index (Vs @ [V]) y\"\n and y: \"y \\ fv exp\"\n have \"y \\ V\"\n proof\n assume [simp]: \"y = V\"\n hence \"x = length Vs\" by simp\n with `x \\ length Vs` show False by contradiction\n qed\n moreover with fv' y have \"y \\ set Vs\" by auto\n ultimately have \"index (Vs @ [V]) y = index Vs y\" by(simp)\n thus ?thesis using y `y \\ V` by auto\n qed\n next\n fix x\n assume x: \"x \\ index Vs ` (fv exp - {V})\"\n thus \"x \\ fv (compE1 (Vs @ [V]) exp) - {length Vs}\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index Vs y\"\n and y: \"y \\ fv exp - {V}\"\n with fv' have \"y \\ set Vs\" \"y \\ V\" by auto\n hence \"index Vs y = index (Vs @ [V]) y\" by simp\n with y have \"x \\ index (Vs @ [V]) ` fv exp\" by auto\n thus ?thesis using IH' `y \\ set Vs` by simp\n qed\n qed\n thus ?case by simp\nnext\n case (Synchronized Vs V exp1 exp2)\n have IH1: \"fv exp1 \\ set Vs \\ fv (compE1 Vs exp1) = index Vs ` fv exp1\" \n and IH2: \"fv exp2 \\ set (Vs @ [fresh_var Vs]) \\ fv (compE1 (Vs @ [fresh_var Vs]) exp2) = index (Vs @ [fresh_var Vs]) ` fv exp2\"\n by fact+\n from `fv (sync\\<^bsub>V\\<^esub> (exp1) exp2) \\ set Vs` have fv1: \"fv exp1 \\ set Vs\"\n and fv2: \"fv exp2 \\ set Vs\" by auto\n from fv2 have fv2': \"fv exp2 \\ set (Vs @ [fresh_var Vs])\" by auto\n have \"index (Vs @ [fresh_var Vs]) ` fv exp2 = index Vs ` fv exp2\"\n proof(rule equalityI[OF subsetI subsetI])\n fix x\n assume x: \"x \\ index (Vs @ [fresh_var Vs]) ` fv exp2\"\n thus \"x \\ index Vs ` fv exp2\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index (Vs @ [fresh_var Vs]) y\"\n and y: \"y \\ fv exp2\"\n from y fv2 have \"y \\ set Vs\" by auto\n moreover hence \"y \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n ultimately show ?thesis using y by(auto)\n qed\n next\n fix x\n assume x: \"x \\ index Vs ` fv exp2\"\n thus \"x \\ index (Vs @ [fresh_var Vs]) ` fv exp2\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index Vs y\"\n and y: \"y \\ fv exp2\"\n from y fv2 have \"y \\ set Vs\" by auto\n moreover hence \"y \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n ultimately have \"index Vs y = index (Vs @ [fresh_var Vs]) y\" by simp\n thus ?thesis using y by(auto)\n qed\n qed\n with IH1[OF fv1] IH2[OF fv2'] show ?case by(auto)\nnext\n case (InSynchronized Vs V a exp)\n have IH: \"fv exp \\ set (Vs @ [fresh_var Vs]) \\ fv (compE1 (Vs @ [fresh_var Vs]) exp) = index (Vs @ [fresh_var Vs]) ` fv exp\"\n by fact\n from `fv (insync\\<^bsub>V\\<^esub> (a) exp) \\ set Vs` have fv: \"fv exp \\ set Vs\" by simp\n hence fv': \"fv exp \\ set (Vs @ [fresh_var Vs])\" by auto\n have \"index (Vs @ [fresh_var Vs]) ` fv exp = index Vs ` fv exp\"\n proof(rule equalityI[OF subsetI subsetI])\n fix x\n assume \"x \\ index (Vs @ [fresh_var Vs]) ` fv exp\"\n thus \"x \\ index Vs ` fv exp\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index (Vs @ [fresh_var Vs]) y\"\n and y: \"y \\ fv exp\"\n from y fv have \"y \\ set Vs\" by auto\n moreover hence \"y \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n ultimately have \"index (Vs @ [fresh_var Vs]) y = index Vs y\" by simp\n thus ?thesis using y by simp\n qed\n next\n fix x\n assume \"x \\ index Vs ` fv exp\"\n thus \"x \\ index (Vs @ [fresh_var Vs]) ` fv exp\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index Vs y\"\n and y: \"y \\ fv exp\"\n from y fv have \"y \\ set Vs\" by auto\n moreover hence \"y \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n ultimately have \"index Vs y = index (Vs @ [fresh_var Vs]) y\" by simp\n thus ?thesis using y by auto\n qed\n qed\n with IH[OF fv'] show ?case by simp\nnext\n case (TryCatch Vs exp1 C V exp2)\n have IH1: \"fv exp1 \\ set Vs \\ fv (compE1 Vs exp1) = index Vs ` fv exp1\" \n and IH2: \"fv exp2 \\ set (Vs @ [V]) \\ fv (compE1 (Vs @ [V]) exp2) = index (Vs @ [V]) ` fv exp2\"\n by fact+\n from `fv (try exp1 catch(C V) exp2) \\ set Vs` have fv1: \"fv exp1 \\ set Vs\"\n and fv2: \"fv exp2 \\ set (Vs @ [V])\" by auto\n have \"index (Vs @ [V]) ` fv exp2 - {length Vs} = index Vs ` (fv exp2 - {V})\" \n proof(rule equalityI[OF subsetI subsetI])\n fix x\n assume x: \"x \\ index (Vs @ [V]) ` fv exp2 - {length Vs}\"\n hence \"x \\ length Vs\" by simp\n from x have \"x \\ index (Vs @ [V]) ` fv exp2\" by auto\n thus \"x \\ index Vs ` (fv exp2 - {V})\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index (Vs @ [V]) y\"\n and y: \"y \\ fv exp2\"\n have \"y \\ V\"\n proof\n assume [simp]: \"y = V\"\n hence \"x = length Vs\" by simp\n with `x \\ length Vs` show False by contradiction\n qed\n moreover with fv2 y have \"y \\ set Vs\" by auto\n ultimately have \"index (Vs @ [V]) y = index Vs y\" by(simp)\n thus ?thesis using y `y \\ V` by auto\n qed\n next\n fix x\n assume x: \"x \\ index Vs ` (fv exp2 - {V})\"\n thus \"x \\ index (Vs @ [V]) ` fv exp2 - {length Vs}\"\n proof(rule imageE)\n fix y\n assume [simp]: \"x = index Vs y\"\n and y: \"y \\ fv exp2 - {V}\"\n with fv2 have \"y \\ set Vs\" \"y \\ V\" by auto\n hence \"index Vs y = index (Vs @ [V]) y\" by simp\n with y have \"x \\ index (Vs @ [V]) ` fv exp2\" by auto\n thus ?thesis using `y \\ set Vs` by simp\n qed\n qed\n with IH1[OF fv1] IH2[OF fv2] show ?case by auto\nqed(auto)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows syncvars_compE1: \"fv e \\ set Vs \\ syncvars (compE1 Vs e)\"\n and syncvarss_compEs1: \"fvs es \\ set Vs \\ syncvarss (compEs1 Vs es)\"\nproof(induct Vs e and Vs es rule: compE1_compEs1_induct)\n case (Block Vs V ty vo exp)\n from `fv {V:ty=vo; exp} \\ set Vs` have \"fv exp \\ set (Vs @ [V])\" by auto\n from `fv exp \\ set (Vs @ [V]) \\ syncvars (compE1 (Vs @ [V]) exp)`[OF this] show ?case by(simp)\nnext\n case (Synchronized Vs V exp1 exp2)\n note IH1 = `fv exp1 \\ set Vs \\ syncvars (compE1 Vs exp1)`\n note IH2 = `fv exp2 \\ set (Vs @ [fresh_var Vs]) \\ syncvars (compE1 (Vs @ [fresh_var Vs]) exp2)`\n from `fv (sync\\<^bsub>V\\<^esub> (exp1) exp2) \\ set Vs` have fv1: \"fv exp1 \\ set Vs\"\n and fv2: \"fv exp2 \\ set Vs\" and fv2': \"fv exp2 \\ set (Vs @ [fresh_var Vs])\" by auto\n have \"length Vs \\ index (Vs @ [fresh_var Vs]) ` fv exp2\"\n proof\n assume \"length Vs \\ index (Vs @ [fresh_var Vs]) ` fv exp2\"\n thus False\n proof(rule imageE)\n fix x\n assume x: \"length Vs = index (Vs @ [fresh_var Vs]) x\"\n and x': \"x \\ fv exp2\"\n from x' fv2 have \"x \\ set Vs\" \"x \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n with x show ?thesis by(simp)\n qed\n qed\n with IH1[OF fv1] IH2[OF fv2'] fv2' show ?case by(simp add: fv_compE1)\nnext\n case (InSynchronized Vs V a exp)\n note IH = `fv exp \\ set (Vs @ [fresh_var Vs]) \\ syncvars (compE1 (Vs @ [fresh_var Vs]) exp)`\n from `fv (insync\\<^bsub>V\\<^esub> (a) exp) \\ set Vs` have fv: \"fv exp \\ set Vs\"\n and fv': \"fv exp \\ set (Vs @ [fresh_var Vs])\" by auto\n have \"length Vs \\ index (Vs @ [fresh_var Vs]) ` fv exp\"\n proof\n assume \"length Vs \\ index (Vs @ [fresh_var Vs]) ` fv exp\"\n thus False\n proof(rule imageE)\n fix x\n assume x: \"length Vs = index (Vs @ [fresh_var Vs]) x\"\n and x': \"x \\ fv exp\"\n from x' fv have \"x \\ set Vs\" \"x \\ (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n with x show ?thesis by(simp)\n qed\n qed\n with IH[OF fv'] fv' show ?case by(simp add: fv_compE1)\nnext\n case (TryCatch Vs exp1 C V exp2)\n note IH1 = `fv exp1 \\ set Vs \\ syncvars (compE1 Vs exp1)`\n note IH2 = `fv exp2 \\ set (Vs @ [V]) \\ syncvars (compE1 (Vs @ [V]) exp2)`\n from `fv (try exp1 catch(C V) exp2) \\ set Vs` have fv1: \"fv exp1 \\ set Vs\"\n and fv2: \"fv exp2 \\ set (Vs @ [V])\" by auto\n from IH1[OF fv1] IH2[OF fv2] show ?case by auto\nqed auto\n\nlemma (in heap_base) synthesized_call_compP [simp]:\n \"synthesized_call (compP f P) h aMvs = synthesized_call P h aMvs\"\nby(simp add: synthesized_call_def)\n\n\nprimrec fin1 :: \"'addr expr \\ 'addr expr1\"\nwhere\n \"fin1 (Val v) = Val v\"\n| \"fin1 (throw e) = throw (fin1 e)\"\n\nlemma comp_final: \"final e \\ compE1 Vs e = fin1 e\"\nby(erule finalE, simp_all)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n shows [simp]: \"max_vars (compE1 Vs e) = max_vars e\"\n and \"max_varss (compEs1 Vs es) = max_varss es\"\nby (induct Vs e and Vs es rule: compE1_compEs1_induct)(simp_all)\n\ntext{* Compiling programs: *}\n\ndefinition compP1 :: \"'addr J_prog \\ 'addr J1_prog\"\nwhere\n \"compP1 \\ compP (\\C M Ts T (pns,body). compE1 (this#pns) body)\"\n\ndeclare compP1_def[simp]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Compiler/Compiler1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2760656978612895}} {"text": "theory ARMv8_Syntax\n imports ARMv8_Rules ARMv8_Inter\nbegin\n\ndatatype register = r\\<^sub>0 | r\\<^sub>1 | r\\<^sub>2 | r\\<^sub>3 | r\\<^sub>4 | r\\<^sub>5\n\nsyntax\n \"_quote\" :: \"'b \\ ('a \\ 'b)\" (\"(\\_\\)\" [0] 1000)\n \"_antiquote\" :: \"('a \\ 'b) \\ 'b\" (\"\\_\" [1000] 1000)\n \"_Assert\" :: \"'a \\ 'a set\" (\"(\\_\\)\" [0] 1000)\n\ntranslations\n \"\\b\\\" \\ \"CONST Collect \\b\\\"\n\nparse_translation \\\n let\n fun quote_tr [t] = Syntax_Trans.quote_tr \\<^syntax_const>\\_antiquote\\ t\n | quote_tr ts = raise TERM (\"quote_tr\", ts);\n in [(\\<^syntax_const>\\_quote\\, K quote_tr)] end\n\\\n\ntype_synonym ('v,'r,'a) thread = \"(('v,'a) grel \\ ('v,'a) grel \\ ('v,'r,'a) pred \\ ('v,'r,'a) pred \\ ('v,'r,'a) com_armv8 \\ ('v,'r,'a) pred)\"\ntype_synonym ('v,'r,'a) threads = \"('v,'r,'a) thread list\"\n\ndefinition addI\n where \"addI I \\ \\x. x ! 0 + I\"\n\ndefinition subI\n where \"subI I \\ \\x. x ! 0 - I\"\n\ndefinition addR\n where \"addR \\ \\x. x ! 0 + x ! 1\"\n\ndefinition subR\n where \"subR \\ \\x. x ! 0 - x ! 1\"\n\ndefinition modI\n where \"modI I \\ \\x. x ! 0 mod I\"\n\ndefinition modR\n where \"modR \\ \\x. x ! 0 mod x ! 1\"\n\ndefinition movI\n where \"movI I \\ \\x. I\"\n\ndefinition ODD :: \"'b \\ ((nat,'b) exp \\ (nat \\ nat \\ bool) \\ (nat,'b) exp)\"\n where \"ODD r = (Exp (\\x. x ! 0 mod 2) [Var r], (=), Val 1)\"\n\ndefinition NEQ :: \"'b \\ 'b \\ ((nat,'b) exp \\ (nat \\ nat \\ bool) \\ (nat,'b) exp)\"\n where \"NEQ r1 r2 = (Var r1, (\\), Var r2)\"\n\ndefinition LE :: \"'b \\ 'b \\ ((nat,'b) bexp)\"\n where \"LE r1 r2 = Exp\\<^sub>B (\\x. x!0 < x!1) [Var r1, Var r2]\"\n\ndefinition Z :: \"'b \\ ((nat,'b) bexp)\"\n where \"Z r = Exp\\<^sub>B (\\x. x!0 = 0) [Var r]\"\n\nsyntax\n \"_Load\" :: \"'r \\ 'r \\ 'v set \\ ('v,'r,'a) com_armv8\" (\"(_ := [_]~_)\" [70, 65] 61)\n \"_LoadC\" :: \"'r \\ 'r \\ 'v set \\ 'c \\ ('v,'r,'a) com_armv8\" (\"(_ := [_ + #_]~_)\" [70, 65] 61)\n \"_LoadIC\" :: \"('v,'r,'a) pred \\ 'r \\ 'r \\ 'v set \\ 'c \\ ('v,'r,'a) com_armv8\" (\"(\\_\\ _ := [_ + #_]~_)\" [20, 70, 65] 61)\n\n \"_Store\" :: \"'r \\ 'r \\ 'v set \\ ('v,'r,'a) com_armv8\" (\"([_] := _ ~ _)\" [70, 65] 61)\n \"_StoreI\" :: \"('v,'r,'a) pred \\ 'r \\ 'v \\ 'r \\ 'v set \\ ('v,'r,'a) com_armv8\" (\"(\\_\\ [_ + #_] := _ ~ _)\" [20, 70, 65] 61)\n \"_StoreIA\" :: \"('v,'r,'a) pred \\ 'r \\ 'v \\ 'r \\ 'v set \\ ('v,'r,'a) auxfn \\ ('v,'r,'a) com_armv8\" (\"(\\_\\ [_ + #_] := _ ~ _ :\\<^sub>a _)\" [20, 70, 65] 61)\n \n \"_Fence\" :: \"(nat,'b,'a) com_armv8\" (\"(fence)\" 61)\n \"_CFence\" :: \"(nat,'b,'a) com_armv8\" (\"(cfence)\" 61)\n \"_Cas\" :: \"('v,'r,'a) pred \\ 'r \\ 'r \\ 'r \\ 'r \\ 'v set \\ ('v,'r,'a) auxfn \\ ('v,'b,'a) com_armv8\" (\"(\\_\\ _ := cas _ _ _ ~ _, _)\" [20, 70, 65] 61)\n\n \"_AddI\" :: \"'b \\ 'b \\ nat \\ (nat,'b,'a) com_armv8\" (\"(_ := _ + #_)\" [70, 65, 65] 61)\n \"_SubI\" :: \"'b \\ 'b \\ nat \\ (nat,'b,'a) com_armv8\" (\"(_ := _ - #_)\" [70, 65, 65] 61)\n\n \"_AddR\" :: \"'b \\ 'b \\ 'b \\ (nat,'b,'a) com_armv8\" (\"(_ := _ + _)\" [70, 65, 65] 61)\n \"_SubR\" :: \"'b \\ 'b \\ 'b \\ (nat,'b,'a) com_armv8\" (\"(_ := _ - _)\" [70, 65, 65] 61)\n\n \"_ModI\" :: \"'b \\ 'b \\ nat \\ (nat,'b,'a) com_armv8\" (\"(_ := _ % #_)\" [70, 65, 65] 61)\n \"_ModR\" :: \"'b \\ 'b \\ 'b \\ (nat,'b,'a) com_armv8\" (\"(_ := _ % _)\" [70, 65, 65] 61)\n \"_MovI\" :: \"'b \\ nat \\ (nat,'b,'a) com_armv8\" (\"(_ := #_)\" [70, 65] 61)\n \"_Seq\" :: \"(nat,'b,'a) com_armv8 \\ (nat,'b,'a) com_armv8 \\ (nat,'b,'a) com_armv8\" (\"(_;/ _)\" [60,61] 60)\n\n \"_If\" :: \"((nat,'b) exp \\ (nat \\ nat \\ bool) \\ (nat,'b) exp) \\ (nat,'b,'a) com_armv8 \\ (nat,'b,'a) com_armv8 \\ (nat,'b,'a) com_armv8\" \n (\"(if _/ then _ //else _ /fi)\" [0,0,0] 61)\n \"_If1\" :: \"'b \\ ('v,'r,'a) com_armv8 \\ ('v,'r,'a) com_armv8\" \n (\"(if _/ then _ /fi)\" [0,0] 61)\n \"_Spec\" :: \"('v,'a) grel \\ ('v,'a) grel \\ ('v,'r,'a) pred \\ ('v,'r,'a) pred \\ ('v,'r,'a) com_armv8 \\ ('v,'r,'a) pred \\ ('v,'r,'a) thread\"\n (\"(R: _ //G:_ //I: _ //P: _ //{ _ } //Q: _)\" [0,0,0,0] 61)\n \"_AuxAssign\" :: \"idt \\ 'b \\ ('v,'r,'a) auxfn\" (\"(\\<^sup>a_ :=/ _)\" [70, 65] 61)\n\ntranslations\n \"\\<^sup>ax := a\" \\ \"CONST state_rec.more o \\\\(state_rec.more_update (_update_name x (\\_. a)))\\\"\n\n \"x := [a]~v\" \\ \"CONST Load (CONST UNIV) v (CONST Var a) x (CONST state_rec.more)\"\n \"x := [a + #I]~v\" \\ \"CONST Load (CONST UNIV) v (CONST Exp (CONST addI I) [CONST Var a]) x (CONST state_rec.more)\"\n \"\\P\\ x := [a + #I]~v\" \\ \"CONST Load \\P\\ v (CONST Exp (CONST addI I) [CONST Var a]) x (CONST state_rec.more)\"\n\n \"[a] := r ~ v\" \\ \"CONST Store (CONST UNIV) v (CONST Var a) r (CONST state_rec.more)\"\n \"\\P\\ [a + #I] := x ~ v\" \\ \"CONST Store \\P\\ v (CONST Exp (CONST addI I) [CONST Var a]) x (CONST state_rec.more)\"\n \"\\P\\ [ra + #I] := r ~ v :\\<^sub>a a\" \\ \"CONST Store \\P\\ v (CONST Exp (CONST addI I) [CONST Var ra]) r a\"\n\n \"\\P\\ r\\<^sub>1 := cas r\\<^sub>2 r\\<^sub>3 r\\<^sub>4 ~ v, a\" \\ \"CONST CAS \\P\\ v r\\<^sub>2 r\\<^sub>3 r\\<^sub>4 r\\<^sub>1 1 0 a\"\n\n \"X := Y - #I\" \\ \"CONST Op X (CONST Exp (CONST subI I) [CONST Var Y])\"\n \"X := Y + #I\" \\ \"CONST Op X (CONST Exp (CONST addI I) [CONST Var Y])\"\n \"X := Y + Z\" \\ \"CONST Op X (CONST Exp (CONST addR) [CONST Var Y, CONST Var Z])\"\n \"X := Y - Z\" \\ \"CONST Op X (CONST Exp (CONST subR) [CONST Var Y, CONST Var Z])\"\n \"X := Y % #I\" \\ \"CONST Op X (CONST Exp (CONST modI I) [CONST Var Y])\"\n \"X := Y % Z\" \\ \"CONST Op X (CONST Exp (CONST modR) [CONST Var Y, CONST Var Z])\"\n\n \"X := #I\" \\ \"CONST Op X (CONST Exp (CONST movI I) [])\"\n \"fence\" \\ \"CONST Fence\"\n \"cfence\" \\ \"CONST Fence\"\n \"c\\<^sub>1 ; c\\<^sub>2\" \\ \"CONST Seq c\\<^sub>1 c\\<^sub>2\"\n \"if b then c\\<^sub>1 else c\\<^sub>2 fi\" \\ \"CONST If b c\\<^sub>1 c\\<^sub>2\"\n \"if b then c\\<^sub>1 fi\" \\ \"CONST If b c\\<^sub>1 (CONST Skip)\"\n \"R: R G: G I: I P: P {c} Q: Q\" \\ \"(\\R\\,\\G\\,\\I\\,\\P\\,c,\\Q\\)\"\n\ndefinition inv2\n where \"inv2 I \\ {(m,m'). m \\ glb ` I \\ m' \\ glb ` I}\"\n\nfun fn_valid :: \"('v::equal,'r::equal,'a) threads \\ bool\"\n where \n \"fn_valid [(R,G,I,P,c,Q)] = (stable\\<^sub>t R Q \\ wellformed R G \\ guar\\<^sub>c c (inv2 I \\ G) \\ \n (stable\\<^sub>t R Q \\ P \\ wp (inv2 I \\ R) c Q) \\\n (wellformed R G \\ rif_checks c R G))\" |\n \"fn_valid _ = undefined\"\n\nnonterminal prgs\n\nsyntax\n \"_PAR\" :: \"prgs \\ 'a\" (\"COBEGIN//_//COEND\" 60)\n \"_FN\" :: \"prgs \\ 'a\" (\"FNBEGIN//_//FNEND\" 60)\n \"_prg\" :: \"'a \\ prgs\" (\"_\" 57)\n \"_prgs\" :: \"['a, prgs] \\ prgs\" (\"_//\\//_\" [60,57] 57)\n\ntranslations\n \"_prg a\" \\ \"[a]\"\n \"_prgs a ps\" \\ \"a # ps\"\n \"_FN t\" \\ \"CONST fn_valid t\"\n\nsyntax\n \"_before\" :: \"'b \\ 'a\" (\"\\<^sup>1_\" [100] 400)\n \"_after\" :: \"'b \\ 'a\" (\"\\<^sup>2_\" [100] 400)\n \"_mem\" :: \"'g \\ 'a\" (\"\\<^sup>s[_]\")\n \"_mbefore\" :: \"'g \\ 'a\" (\"\\<^sup>1[_]\")\n \"_mafter\" :: \"'g \\ 'a\" (\"\\<^sup>2[_]\")\n \"_reg\" :: \"'r \\ 'a\" (\"\\<^sup>r_\" [100] 1000)\n \"_rbefore\" :: \"'r \\ 'a\" (\"\\<^sup>1\\<^sup>r_\")\n \"_rafer\" :: \"'r \\ 'a\" (\"\\<^sup>2\\<^sup>r_\")\n \"_aux\" :: \"'b \\ 'a\" (\"\\<^sup>a_\" [100] 1000)\n \"_abefore\" :: \"'b \\ 'a\" (\"\\<^sup>1\\<^sup>a_\" [100] 400)\n \"_aafer\" :: \"'b \\ 'a\" (\"\\<^sup>2\\<^sup>a_\" [100] 400)\n\ndefinition gld :: \"('v,'r,'a) state \\ ('v \\ 'v)\"\n where \"gld m \\ \\v. st m (Glb v)\"\n\ntranslations\n \"\\<^sup>1x\" \\ \"x (\\CONST fst)\"\n \"\\<^sup>2x\" \\ \"x (\\CONST snd)\"\n \"\\<^sup>s[X]\" \\ \"(\\CONST gld) X\"\n \"\\<^sup>1[X]\" \\ \"(CONST st (\\CONST fst)) X\"\n \"\\<^sup>2[X]\" \\ \"(CONST st (\\CONST snd)) X\"\n \"\\<^sup>rX\" \\ \"(\\CONST rg) X\"\n \"\\<^sup>1\\<^sup>rX\" \\ \"(CONST rg (\\CONST fst)) X\"\n \"\\<^sup>2\\<^sup>rX\" \\ \"(CONST rg (\\CONST snd)) X\"\n \"\\<^sup>aX\" \\ \"X (\\CONST state_rec.more)\"\n \"\\<^sup>1\\<^sup>aX\" \\ \"X (CONST state_rec.more (\\CONST fst))\"\n \"\\<^sup>2\\<^sup>aX\" \\ \"X (CONST state_rec.more (\\CONST snd))\"\n\n(*\nsyntax\n \"_before\" :: \"'b \\ 'a\" (\"\\<^sup>1_\" [100] 400)\n \"_after\" :: \"'b \\ 'a\" (\"\\<^sup>2_\" [100] 400)\n \"_mem\" :: \"'b \\ 'a\" (\"\\_\\\")\n \"_mat\" :: \"'b \\ 'a\" (\"\\<^sup>0\\_\\\")\n \"_mbefore\" :: \"'b \\ 'a\" (\"\\<^sup>1\\_\\\")\n \"_mafter\" :: \"'b \\ 'a\" (\"\\<^sup>2\\_\\\")\n \"_reg\" :: \"'r \\ 'a\" (\"\\<^bold>r_\" [1000] 1000)\n \"_rar\" :: \"'r \\ 'a\" (\"\\<^sup>0\\<^bold>r_\" [100] 1000)\n \"_rbefore\" :: \"'r \\ 'a\" (\"\\<^sup>1\\<^bold>r_\")\n \"_rafer\" :: \"'r \\ 'a\" (\"\\<^sup>2\\<^bold>r_\")\n \"_val\" :: \"'b \\ 'a\" (\"#_\" [100] 1000)\n \"_aux\" :: \"'b \\ 'a\" (\"\\<^sup>a_\" [100] 1000)\n \"_abefore\" :: \"'b \\ 'a\" (\"\\<^sup>1\\<^sup>a_\" [100] 400)\n \"_aafer\" :: \"'b \\ 'a\" (\"\\<^sup>2\\<^sup>a_\" [100] 400)\n\ntranslations\n \"\\<^sup>1x\" \\ \"x (\\CONST fst)\"\n \"\\<^sup>2x\" \\ \"x (\\CONST snd)\"\n \"\\X\\\" \\ \"CONST Var (CONST Glb X)\"\n \"\\<^sup>0\\X\\\" \\ \"(CONST st (\\CONST glb)) X\"\n \"\\<^sup>1\\X\\\" \\ \"(CONST st (\\CONST fst)) X\"\n \"\\<^sup>2\\X\\\" \\ \"(CONST st (\\CONST snd)) X\"\n \"\\<^bold>rX\" \\ \"CONST Var (CONST Var X)\"\n \"\\<^sup>0\\<^bold>rX\" \\ \"(\\CONST rg) X\"\n \"\\<^sup>1\\<^bold>rX\" \\ \"(CONST rg (\\CONST fst)) X\"\n \"\\<^sup>2\\<^bold>rX\" \\ \"(CONST rg (\\CONST snd)) X\"\n \"#X\" \\ \"CONST Val X\"\n \"\\<^sup>aX\" \\ \"X (\\CONST state_rec.more)\"\n \"\\<^sup>1\\<^sup>aX\" \\ \"X (CONST state_rec.more (\\CONST fst))\"\n \"\\<^sup>2\\<^sup>aX\" \\ \"X (CONST state_rec.more (\\CONST snd))\"\n*)\n\nsyntax\n \"_con\" :: \"nat \\ 'a\" (\"=[_]\" [100] 1000)\n \"_inc\" :: \"nat \\ 'a\" (\"\\[_]\" [100] 1000)\n\ntranslations\n \"=[X]\" \\ \"(CONST st (\\CONST snd)) X = (CONST st (\\CONST fst)) X\"\n \"\\[X]\" \\ \"(CONST st (\\CONST snd)) X \\ (CONST st (\\CONST fst)) X\"\n\n\n\nlemma [simp]:\n \"reflexive R \\ stabilize R {} = {}\"\n by (auto simp: reflexive_def stabilize_def)\n\nlemma [simp]:\n \"reflexive R \\ stabilize R (assert P) = assert P\"\n by (auto simp: assert_def)\n\nlemma [simp]:\n \"{m. m(a :=\\<^sub>s e) \\ (assert P)} = assert P\"\n by (auto simp: assert_def)\n\nlemma [simp]:\n \"reflexive R \\ UNIV \\ stabilize R P = (\\m. m \\ P)\"\n by (auto simp: reflexive_def stabilize_def assert_def glb_def)\n\nlemma [simp]:\n \"stabilize R (P \\ Q) = stabilize R P \\ stabilize R Q\"\n by (auto simp: stabilize_def)\n\nlemma [simp]:\n \"{m. (f m) \\ assert P} = assert P\"\n by (auto simp: assert_def)\n\nlemma [simp]:\n \"UNIV \\ assert P = P\"\n by (auto simp: assert_def)\n\nlemma [simp]:\n \"x(aux: state_rec.more) = x\"\n by (auto simp: aux_upd_def)\n\nlemma [simp]:\n \"st (glb (x(Glb z :=\\<^sub>s e))) = (st (glb x))(z := e)\"\n by (auto simp: st_upd_def glb_def)\n\nlemma [simp]:\n \"st (glb (x(aux:f ))) = (st (glb x))\"\n by (auto simp: st_upd_def glb_def)\n\nlemma glb_in [intro!]:\n assumes \"\\l. \\ st = (\\v. case v of Reg v \\ l v | _ \\ st m v), \\ = state_rec.more m \\ \\ P\"\n shows \"glb m \\ glb ` P\"\nproof -\n obtain l where \"\\ st = (\\v. case v of Reg v \\ l v | _ \\ st m v), \\ = state_rec.more m \\ \\ P\"\n (is \"?m \\ P\")\n using assms by auto\n hence \"glb ?m \\ glb ` P\" by auto\n moreover have \"glb m = glb ?m\" by (auto simp: glb_def)\n ultimately show ?thesis by auto\nqed\n\nlemma a:\n \"glb x = glb y \\ st x (Glb e) = st y (Glb e)\"\n unfolding glb_def\n by (metis state_rec.select_convs(1))\n\nlemma b:\n \"glb x = glb y \\ state_rec.more x = state_rec.more y\"\n unfolding glb_def by simp\n\nlemma [simp]:\n \"st (glb x) y = st x (Glb y)\"\n unfolding glb_def by auto\n\nfun chain\n where \"chain [] Q = Q\" | \"chain (a#xs) Q = chain xs (wpre a Q)\"\ndeclare chain.simps [simp del]\n\nlemma chain_singleI:\n \"wpre a Q = chain [a] Q\"\n unfolding chain.simps by auto\n\nlemma chain_singleI':\n \"stabilize R Q = chain [env R] Q\"\n unfolding chain.simps by auto\n\nlemma chain_lastE:\n \"chain (xs @ [a]) Q = wpre a ( (chain xs Q))\"\n by (induct xs arbitrary: Q) (auto simp: chain.simps)\n\nlemma chain_lastI:\n \"chain [a] (chain xs Q) = chain (xs@[a]) Q\"\n by (induct xs) (auto simp: chain_lastE chain.simps)\n\nlemma chain_merge:\n \"chain l (chain l' Q) = chain (l'@l) Q\"\n by (induct l' arbitrary: Q) (simp add: chain.simps)+\n\nlemma stabilize_mono:\n \"P \\ Q \\ stabilize R P \\ stabilize R Q\"\n unfolding stabilize_def by auto\n\nlemma pre_mono:\n \"P \\ Q \\ wpre a P \\ wpre a Q\"\n using stabilize_mono apply (cases a) apply (auto)\n by blast\n\nlemma chain_mono:\n \"P \\ Q \\ chain xs P \\ chain xs Q\"\n by (induct xs arbitrary: P Q) (auto simp: pre_mono stabilize_mono chain.simps)\n\nlemma chain1_wpre:\n \"P \\ chain xs (wpre a Q) \\ P \\ chain (a#xs) Q\"\n unfolding chain.simps .\n\nlemma chain1_stab:\n \"P \\ chain xs (stabilize R Q) \\ P \\ chain (env R#xs) Q\"\n unfolding chain.simps by auto\n\nlemma chain0:\n \"P \\ Q \\ P \\ chain [] Q\"\n unfolding chain.simps .\n\nlemma chain_extend:\n \"P \\ chain xs (Q \\ X) \\ P \\ chain xs Q\"\n using chain_mono[of \"Q \\ X\" Q] by (auto simp: )\n\nlemma chain_rewrite:\n \"X \\ Q \\ P \\ chain xs X \\ P \\ chain xs Q\"\n using chain_mono by blast\n\ndefinition str where\n \"str R P \\ if P \\ stabilize R P then P else UNIV\"\n\nlemma str_mono:\n \"Q \\ P \\ Q \\ str R P\"\n unfolding str_def by (auto simp: )\n\nlemma stabilize_univ:\n \"UNIV \\ stabilize R UNIV\"\n unfolding stabilize_def by auto\n\nlemma stabilize_str:\n \"str R P \\ stabilize R (str R P)\"\n unfolding str_def stabilize_def by simp\n\nlemma [simp]: \"wpre a (P \\ Q) = (wpre a P \\ wpre a Q)\"\n by (cases a, auto)\n\nlemma chain_inter: \"chain l (P \\ Q) = (chain l P \\ chain l Q)\"\n by (induct l arbitrary: P Q, auto simp: chain.simps)\n\nlemma stable_stabilize:\n \"stable\\<^sub>t R Q \\ Q \\ stabilize R Q\"\n unfolding stabilize_def stable_def step\\<^sub>t_def\n by auto\n\nlemma strI:\n \"stable\\<^sub>t R Q \\ K \\ chain l (str R Q) \\ K \\ chain (env R#l) Q\"\n unfolding chain.simps str_def apply simp\n using stable_stabilize\n by (metis (mono_tags) chain_rewrite)\n\nlemma envI:\n \"stable\\<^sub>t R Q \\ K \\ chain l (Q) \\ K \\ chain (env R#l) Q\"\n unfolding chain.simps str_def apply simp\n using stable_stabilize\n by (metis (mono_tags) chain_rewrite)\n\nlemma ir_str:\n \"wpre (ir r e) (str R Q) \\ str R (wpre (ir r e) Q)\"\n apply (auto simp: str_def stabilize_def st_upd_def)\n apply (subgoal_tac \"rg (x\\st := (st x)(Reg r := ev\\<^sub>E (rg m') e)\\) = rg (m'\\st := (st m')(Reg r := ev\\<^sub>E (rg m') e)\\)\")\n apply (subgoal_tac \"(glb (x\\st := (st x)(Reg r := ev\\<^sub>E (rg m') e)\\), glb (m'\\st := (st m')(Reg r := ev\\<^sub>E (rg m') e)\\)) \\ R\")\n apply blast\n apply (auto simp: glb_def)[1]\n unfolding rg_def apply auto[1]\n done\n\nlemma cm_str:\n \"wpre (cm b) (str R Q) \\ str R (wpre (cm b) Q)\"\n by (auto simp: str_def stabilize_def st_upd_def)\n\nlemma ncm_str:\n \"wpre (ncm b) (str R Q) \\ str R (wpre (ncm b) Q)\"\n by (auto simp: str_def stabilize_def st_upd_def)\n\nlemma ign_str:\n \"Q \\ str R Q\"\n by (auto simp: str_def)\n\nlemma [simp]:\n \"state_rec.more (glb x) = state_rec.more x\"\n unfolding glb_def by auto\n\nend", "meta": {"author": "UQ-PAC", "repo": "wmm-rg", "sha": "7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2", "save_path": "github-repos/isabelle/UQ-PAC-wmm-rg", "path": "github-repos/isabelle/UQ-PAC-wmm-rg/wmm-rg-7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2/ARMv8/ARMv8_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2760252823944037}} {"text": "section \\The Second Monotonicity Calculus\\\ntheory Mcalc2\nimports Mono\nbegin\n\n\n\nsubsection\\Extension policies\\\n\ntext\\Extension policy: copy, true or false extension:\\\n\ndatatype epol = Cext | Text | Fext\n\ntext\\Problem with infinite knowledge and predicate-extension policy:\\\n\nlocale ProblemIkPol = ProblemIk wtFsym wtPsym arOf resOf parOf \\ infTp\nfor wtFsym :: \"'fsym \\ bool\" and wtPsym :: \"'psym \\ bool\"\nand arOf :: \"'fsym \\ 'tp list\"\nand resOf and parOf and \\ and infTp\n+ fixes (* the predicate-extension policy *) pol :: \"'tp \\ 'psym \\ epol\"\nand (* guard of a variable occurring in a certain literal of a certain clause: *)\n grdOf ::\n\"('fsym, 'psym) cls \\ ('fsym, 'psym) lit \\ var \\ ('fsym, 'psym) lit\"\n\n\ncontext ProblemIkPol begin\n\nsubsection\\Naked variables\\\n\nfun nv2T where\n\"nv2T (Var x) = {x}\"\n|\n\"nv2T (Fn f Tl) = {}\"\n\nfun nv2L where\n\"nv2L (Pos (Eq T1 T2)) = nv2T T1 \\ nv2T T2\"\n|\n\"nv2L (Neg (Eq T1 T2)) = {}\"\n|\n\"nv2L (Pos (Pr p Tl)) = {x \\ \\ (set (map nv2T Tl)) . pol (tpOfV x) p = Fext}\"\n|\n\"nv2L (Neg (Pr p Tl)) = {x \\ \\ (set (map nv2T Tl)) . pol (tpOfV x) p = Text}\"\n\ndefinition \"nv2C c \\ \\ (set (map nv2L c))\"\n\nlemma in_nv2T: \"x \\ nv2T T \\ T = Var x\"\napply(cases T)\n apply (metis equals0D nv2T.simps singleton_iff)\n by simp\n\nlemma nv2T_vars[simp]: \"x \\ nv2T T \\ x \\ vars T\"\nby (induct T, auto split: if_splits)\n\nlemma nv2L_varsL[simp]:\nassumes \"x \\ nv2L l\" shows \"x \\ varsL l\"\nproof (cases l)\n case (Pos at)\n show ?thesis proof(cases at)\n case (Pr p Tl) thus ?thesis using assms unfolding Pos\n apply(cases \"pol (tpOfV x) p\", simp_all) by (metis nv2T_vars)\n qed(insert assms, unfold Pos, auto)\nnext\n case (Neg at)\n show ?thesis proof(cases at)\n case (Pr p Tl) thus ?thesis using assms unfolding Neg\n apply(cases \"pol (tpOfV x) p\", simp_all) by (metis nv2T_vars)\n qed(insert assms, unfold Neg, auto)\nqed\n\nlemma nv2C_varsC[simp]: \"x \\ nv2C c \\ x \\ varsC c\"\nunfolding varsC_def nv2C_def by (induct c, auto)\n\nsubsection\\The calculus\\\n\ntext\\The notion of a literal being a guard for a (typed) variable:\\\n\nfun isGuard :: \"var \\ ('fsym,'psym) lit \\ bool\" where\n\"isGuard x (Pos (Eq T1 T2)) \\ False\"\n|\n\"isGuard x (Neg (Eq T1 T2)) \\\n (T1 = Var x \\ (\\ f Tl. T2 = Fn f Tl)) \\\n (T2 = Var x \\ (\\ f Tl. T1 = Fn f Tl))\"\n|\n\"isGuard x (Pos (Pr p Tl)) \\ x \\ \\ (set (map nv2T Tl)) \\ pol (tpOfV x) p = Text\"\n|\n\"isGuard x (Neg (Pr p Tl)) \\ x \\ \\ (set (map nv2T Tl)) \\ pol (tpOfV x) p = Fext\"\n\n\ntext\\The monotonicity calculus from the Classen et. al. paper, applied\nto non-infinite types only: it checks that any variable in any literal of any clause\nis indeed guarded by its guard:\\\n\ninductive mcalc2 (infix \"\\2\" 40) where\n [simp]: \"infTp \\ \\ \\ \\2 c\"\n|[simp]: \"(\\ l x. \\l \\ set c; x \\ nv2L l; tpOfV x = \\\\\n \\ isGuard x (grdOf c l x)) \\ \\ \\2 c\"\n\nlemma mcalc2_iff:\n\"\\ \\2 c \\\n infTp \\ \\ (\\ l x. l \\ set c \\ x \\ nv2L l \\ tpOfV x = \\ \\ isGuard x (grdOf c l x))\"\nunfolding mcalc2.simps by auto\n\nend (* context ProblemIk *)\n\nlocale ProblemIkPolMcalc2 = ProblemIkPol wtFsym wtPsym arOf resOf parOf \\ infTp pol grdOf\nfor wtFsym :: \"'fsym \\ bool\" and wtPsym :: \"'psym \\ bool\"\nand arOf :: \"'fsym \\ 'tp list\"\nand resOf and parOf and \\ and infTp and pol and grdOf\n+ assumes\n(* well-definednedd of the guard: *)\n grdOf: \"\\ c l x. \\c \\ \\; l \\ set c; x \\ nv2L l; \\ infTp (tpOfV x)\\\n \\ grdOf c l x \\ set c\"\nand mcalc2: \"\\ \\ c. c \\ \\ \\ \\ \\2 c\"\nbegin\nlemma wtL_grdOf[simp]:\nassumes \"c \\ \\\" and \"l \\ set c\" and \"x \\ nv2L l\" and \"\\ infTp (tpOfV x)\"\nshows \"wtL (grdOf c l x)\"\nusing grdOf[OF assms] by (metis assms list_all_iff wtC_def wtPB_def wt_\\)\nend\n\nlocale ModelIkPolMcalc2 =\nModelIk wtFsym wtPsym arOf resOf parOf \\ infTp intT intF intP +\nProblemIkPolMcalc2 wtFsym wtPsym arOf resOf parOf \\ infTp pol grdOf\nfor wtFsym :: \"'fsym \\ bool\" and wtPsym :: \"'psym \\ bool\"\nand arOf :: \"'fsym \\ 'tp list\"\nand resOf and parOf and \\ and infTp pol and grdOf and intT and intF and intP\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Sort_Encodings/Mcalc2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2760252823944037}} {"text": "theory Failures_Stable_TickTock\n imports Failures_TickTock Failures\nbegin\n\nthm sf2f_def F2f_def mkF24_def ttproc2F_def\n\n(* mapping from tick-tock to stable failures (with stable tick) *)\ndefinition tt2sf :: \"'a ttprocess \\ 'a process\" where\n \"tt2sf P = \n ({ (t, X) | t X. (map (\\ e. [ttevt2F e]\\<^sub>E) t) @ [[ttevt2F ` X]\\<^sub>R] \\ P }\n \\ {(t, X) | t X. (map (\\ e. [ttevt2F e]\\<^sub>E) t) @ [[Tick]\\<^sub>E] \\ P \\ X \\ UNIV-{tick}}\n \\ {(t @ [tick], X) | t X. (map (\\ e. [ttevt2F e]\\<^sub>E) t) @ [[Tick]\\<^sub>E] \\ P \\ X \\ UNIV}, \n {tt2T y |y. y \\ P})\"\n\nlemma end_tick_in_traces:\n \"\\P. ttWF (map (\\e. [ttevt2F e]\\<^sub>E) a @ [[Tick]\\<^sub>E]) \\\n map (\\e. [ttevt2F e]\\<^sub>E) a @ [[Tick]\\<^sub>E] \\ P \\\n a @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P}))\"\n apply (induct a, simp_all)\n using traces_def apply force\n apply (case_tac a1, simp_all)\n apply (metis Nil_is_append_conv neq_Nil_conv ttWF.simps(8))\nproof -\n fix a1 a2 P x2\n assume ind_hyp: \"\\P. map (\\e. [ttevt2F e]\\<^sub>E) a2 @ [[Tick]\\<^sub>E] \\ P \\\n a2 @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P}))\"\n assume \"[Event x2]\\<^sub>E # map (\\e. [ttevt2F e]\\<^sub>E) a2 @ [[Tick]\\<^sub>E] \\ P\"\n then have \"a2 @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ {t. [Event x2]\\<^sub>E # t \\ P}},\n {tt2T y |y. y \\ {t. [Event x2]\\<^sub>E # t \\ P}}))\"\n using ind_hyp by force\n then show \"evt x2 # a2 @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P}))\"\n by (smt mem_Collect_eq snd_conv traces_def tt2T.simps(2))\nqed\n\nlemma end_refusal_ttWF_eq:\n \"ttWF (map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R])\n \\ Some (a, b) = tt2F (map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R])\"\n apply (induct a, auto)\n using Some_tt2F_set apply fastforce\n apply (case_tac a1, auto)\n apply (metis Nil_is_append_conv neq_Nil_conv ttWF.simps(8))\n by (metis fst_conv option.simps(5) snd_conv)\n\nlemma tt2F_Some_ref_end_refusal:\n \"\\a. Some (a, b) = tt2F y \\\n y = map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R]\n \\ y = map (\\e. [ttevt2F e]\\<^sub>E) a @ [[(ttevt2F ` b) \\ {Tock}]\\<^sub>R]\"\n apply (induct y rule:ttWF.induct, auto)\n apply (smt image_def mem_Collect_eq ttevent.exhaust ttevt2F.simps(1) ttevt2F.simps(2))\n apply (case_tac xa, auto)\n apply (metis image_eqI mem_Collect_eq ttevt2F.simps(1))\n apply (metis mem_Collect_eq rev_image_eqI ttevt2F.simps(2))\n by (case_tac \"tt2F \\\", auto)\n\nlemma tt2F_Some_ref_end_refusal_in_TT1:\n \"TT1 P \\ Some (a, b) = tt2F y \\ y \\ P \\\n map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R] \\ P\"\nproof -\n assume TT1_P: \"TT1 P\"\n assume y_in_P: \"y \\ P\"\n assume tt2F_y_Some: \"Some (a, b) = tt2F y\"\n\n have \"y = map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R]\n \\ y = map (\\e. [ttevt2F e]\\<^sub>E) a @ [[(ttevt2F ` b) \\ {Tock}]\\<^sub>R]\"\n using tt2F_Some_ref_end_refusal tt2F_y_Some by blast\n then show \"map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R] \\ P\"\n using y_in_P\n proof auto\n have \"map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R]\n \\\\<^sub>C map (\\e. [ttevt2F e]\\<^sub>E) a @ [[insert Tock (ttevt2F ` b)]\\<^sub>R]\"\n by (induct a, auto)\n then show \"map (\\e. [ttevt2F e]\\<^sub>E) a @ [[insert Tock (ttevt2F ` b)]\\<^sub>R] \\ P\n \\ map (\\e. [ttevt2F e]\\<^sub>E) a @ [[ttevt2F ` b]\\<^sub>R] \\ P\"\n using TT1_P TT1_def by blast\n qed\nqed\n\nlemma end_tick_in_traces_imp_in_ttproc:\n \"\\P. s @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P}))\n \\ map (\\e. [ttevt2F e]\\<^sub>E) s @ [[Tick]\\<^sub>E] \\ P\"\nproof (induct s, auto)\n fix P\n show \"[tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P})) \\ [[Tick]\\<^sub>E] \\ P\"\n by (smt append_Nil mem_Collect_eq snd_conv tick_tt2T_concat_TickE traces_def tt2T_tick_exists_Cons)\nnext\n fix a s P\n assume ind_hyp: \"\\P. s @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P})) \\\n map (\\e. [ttevt2F e]\\<^sub>E) s @ [[Tick]\\<^sub>E] \\ P\"\n assume \"a # s @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P}))\"\n then have \"s @ [tick]\n \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ {t. [ttevt2F a]\\<^sub>E # t \\ P}},\n {tt2T y |y. y \\ {t. [ttevt2F a]\\<^sub>E # t \\ P}}))\"\n unfolding traces_def\n proof auto\n fix y\n assume case_assms: \"a # s @ [tick] = tt2T y\" \"y \\ P\"\n then obtain y' where y'_assms: \"s @ [tick] = tt2T y' \\ y = [ttevt2F a]\\<^sub>E # y'\"\n apply (cases y, auto, cases a, auto, case_tac aa, auto, case_tac x1, auto)\n apply (metis append_Cons neq_Nil_conv self_append_conv2 tt2T.simps(1) tt2T.simps(7))\n apply (case_tac aa, auto, case_tac x1, auto)\n by (metis append_Cons neq_Nil_conv self_append_conv2 tt2T.simps(1) tt2T.simps(7))\n then have \"map (\\e. [ttevt2F e]\\<^sub>E) s @ [[Tick]\\<^sub>E] \\ {t. [ttevt2F a]\\<^sub>E # t \\ P}\"\n using ind_hyp[where P=\"{t. [ttevt2F a]\\<^sub>E # t \\ P}\"] case_assms(2) traces_def by fastforce\n then show \"\\y. s @ [tick] = tt2T y \\ [ttevt2F a]\\<^sub>E # y \\ P\"\n using y'_assms case_assms(2) by blast\n qed\n then show \"a # s @ [tick] \\ traces(({(s, X). \\y. Some (s, X) = tt2F y \\ y \\ P}, {tt2T y |y. y \\ P})) \\\n [ttevt2F a]\\<^sub>E # map (\\e. [ttevt2F e]\\<^sub>E) s @ [[Tick]\\<^sub>E] \\ P\"\n using ind_hyp by blast\nqed\n\nlemma tt2sf_eq_mkF24_ttproc2F:\n assumes P_wf: \"\\x\\P. ttWF x\" and TT1_P: \"TT1 P\"\n shows \"tt2sf P = mkF24 (ttproc2F P)\"\n unfolding mkF24_def tt2sf_def ttproc2F_def\n apply auto\n using assms end_refusal_ttWF_eq apply blast\n using assms end_tick_in_traces apply blast\n using assms end_tick_in_traces apply blast\n apply (simp add: TT1_P tt2F_Some_ref_end_refusal_in_TT1)\n apply (simp add: TT1_P tt2F_Some_ref_end_refusal_in_TT1)\n using end_tick_in_traces_imp_in_ttproc apply blast\n using end_tick_in_traces_imp_in_ttproc apply blast\n using end_tick_in_traces_imp_in_ttproc apply blast\n by (auto simp add: traces_def)\n \nend\n ", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures_Stable_TickTock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2760252823944037}} {"text": "(* Title: Mapping_Exts.thy\n Author: Denis Lohner, Sebastian Ullrich\n*)\n\nsubsection \"Mapping Extensions\"\n\ntext \\Some lifted definition on mapping and efficient implementations.\\\n\ntheory Mapping_Exts\nimports \"HOL-Library.Mapping\" FormalSSA_Misc\nbegin\n\nlift_definition mapping_delete_all :: \"('a \\ bool) \\ ('a,'b) mapping \\ ('a,'b) mapping\"\n is \"\\P m x. if (P x) then None else m x\" .\nlift_definition map_keys :: \"('a \\ 'b) \\ ('a,'c) mapping \\ ('b,'c) mapping\"\n is \"\\f m x. if f -` {x} \\ {} then m (THE k. f -` {x} = {k}) else None\" .\nlift_definition map_values :: \"('a \\ 'b \\ 'c option) \\ ('a,'b) mapping \\ ('a,'c) mapping\"\n is \"\\f m x. Option.bind (m x) (f x)\" .\nlift_definition restrict_mapping :: \"('a \\ 'b) \\ 'a set \\ ('a, 'b) mapping\"\n is \"\\f. restrict_map (Some \\ f)\" .\nlift_definition mapping_add :: \"('a, 'b) mapping \\ ('a, 'b) mapping \\ ('a, 'b) mapping\"\n is \"(++)\" .\n\ndefinition \"mmap = Mapping.map id\"\n\nlemma lookup_map_keys: \"Mapping.lookup (map_keys f m) x = (if f -` {x} \\ {} then Mapping.lookup m (THE k. f -` {x} = {k}) else None)\"\napply transfer ..\n\nlemma Mapping_Mapping_lookup [simp, code_unfold]: \"Mapping.Mapping (Mapping.lookup m) = m\" by transfer simp\ndeclare Mapping.lookup.abs_eq[simp]\n\nlemma Mapping_eq_lookup: \"m = m' \\ Mapping.lookup m = Mapping.lookup m'\" by transfer simp\n\nlemma map_of_map_if_conv:\n \"map_of (map (\\k. (k, f k)) xs) x = (if (x \\ set xs) then Some (f x) else None)\"\n by (clarsimp simp: map_of_map_restrict)\n\nlemma Mapping_lookup_map: \"Mapping.lookup (Mapping.map f g m) a = map_option g (Mapping.lookup m (f a))\"\n by transfer simp\n\nlemma Mapping_lookup_map_default: \"Mapping.lookup (Mapping.map_default k d f m) k' = (if k = k'\n then (Some \\ f) (case Mapping.lookup m k of None \\ d | Some x \\ x)\n else Mapping.lookup m k')\"\n unfolding Mapping.map_default_def Mapping.default_def\n by transfer auto\n\nlemma Mapping_lookup_mapping_add: \"Mapping.lookup (mapping_add m1 m2) k =\n case_option (Mapping.lookup m1 k) Some (Mapping.lookup m2 k)\"\n by transfer (simp add: map_add_def)\n\nlemma Mapping_lookup_map_values: \"Mapping.lookup (map_values f m) k =\n Option.bind (Mapping.lookup m k) (f k)\"\n by transfer simp\n\nlemma lookup_fold_update [simp]: \"Mapping.lookup (fold (\\n. Mapping.update n (g n)) xs m) x\n = (if (x \\ set xs) then Some (g x) else Mapping.lookup m x)\"\n by transfer (rule fold_update_conv)\n\nlemma mapping_eq_iff: \"m1 = m2 \\ (\\k. Mapping.lookup m1 k = Mapping.lookup m2 k)\"\n by transfer auto\n\nlemma lookup_delete: \"Mapping.lookup (Mapping.delete k m) k' = (if k = k' then None else Mapping.lookup m k')\"\n by transfer auto\n\nlemma keys_map_values: \"Mapping.keys (map_values f m) = Mapping.keys m - {k\\Mapping.keys m. f k (the (Mapping.lookup m k)) = None}\"\n by transfer (auto simp add: bind_eq_Some_conv)\n\nlemma map_default_eq: \"Mapping.map_default k v f m = m \\ (\\v. Mapping.lookup m k = Some v \\ f v = v)\"\n apply (clarsimp simp: Mapping.map_default_def Mapping.default_def)\n by transfer' (auto simp: fun_eq_iff split: if_splits)\n\nlemma lookup_update_cases: \"Mapping.lookup (Mapping.update k v m) k' = (if k=k' then Some v else Mapping.lookup m k')\"\nby (cases \"k=k'\", simp_all add: Mapping.lookup_update Mapping.lookup_update_neq)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Formal_SSA/Mapping_Exts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.27602527531745247}} {"text": "(* TODO: Move to Refine-Monadic *)\ntheory Refine_Monadic_Add\nimports Refine_Monadic_Thin\nbegin\n\n lemma option_rel_inv_conv:\n \"(x,Some v')\\\\V\\option_rel \\ (\\v. x=Some v \\ (v,v')\\V)\"\n \"(Some v,x')\\\\V\\option_rel \\ (\\v'. x'=Some v' \\ (v,v')\\V)\"\n subgoal by (cases x; auto)\n subgoal by (cases x'; auto)\n done\n\n\n\n definition \"monadic_WHILEIT I b f s \\ do {\n RECT (\\D s. do {\n ASSERT (I s);\n bv \\ b s;\n if bv then do {\n s \\ f s;\n D s\n } else do {RETURN s}\n }) s\n }\"\n \n \n \n lemma WHILEIT_to_monadic: \"WHILEIT I b f s = monadic_WHILEIT I (\\s. RETURN (b s)) f s\"\n unfolding WHILEIT_def monadic_WHILEIT_def\n unfolding WHILEI_body_def bind_ASSERT_eq_if\n by (simp cong: if_cong)\n \n\nlemma monadic_WHILEIT_refine[refine]: \n assumes [refine]: \"(s',s) \\ R\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s \\ \\ I' s'\" \n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s' \\ \\ b' s' \\\\bool_rel (b s)\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s'; nofail (b s); inres (b s) True \\ \\ f' s' \\\\R (f s)\"\n shows \"monadic_WHILEIT I' b' f' s' \\\\R (monadic_WHILEIT I b f s)\"\n unfolding monadic_WHILEIT_def\n by (refine_rcg bind_refine'; assumption?; auto)\n \nlemma monadic_WHILEIT_refine_WHILEIT[refine]: \n assumes [refine]: \"(s',s) \\ R\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s \\ \\ I' s'\" \n assumes [THEN order_trans,refine_vcg]: \"\\s' s. \\ (s',s)\\R; I s; I' s' \\ \\ b' s' \\ SPEC (\\r. r = b s)\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s'; b s \\ \\ f' s' \\\\R (f s)\"\n shows \"monadic_WHILEIT I' b' f' s' \\\\R (WHILEIT I b f s)\"\n unfolding WHILEIT_to_monadic\n by (refine_vcg; assumption?; auto)\n \nlemma monadic_WHILEIT_refine_WHILET[refine]: \n assumes [refine]: \"(s',s) \\ R\"\n assumes [THEN order_trans,refine_vcg]: \"\\s' s. \\ (s',s)\\R \\ \\ b' s' \\ SPEC (\\r. r = b s)\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; b s \\ \\ f' s' \\\\R (f s)\"\n shows \"monadic_WHILEIT (\\_. True) b' f' s' \\\\R (WHILET b f s)\"\n unfolding WHILET_def\n by (refine_vcg; assumption?) \n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/Refine_Monadic_Add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.27600819866722237}} {"text": "theory \"WooLam_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: Woo and Lam Mutual Authentication Protocol *)\n\n(* text: \n Modeled after the description in the SPORE library:\n\n http://www.lsv.ens-cachan.fr/Software/spore/wooLamMutual.html\n\n Notable differences:\n\n 1. We are using explicit global constants to discern between different\n encryptions instead of the implicit typing, which introduces\n ambiguities. This implies that we are not precisely modeling the Woo and\n Lam protocol of the SPORE library and hence we may miss some attacks\n possible on it. However, every implementation of the SPORE model could\n easily be changed to our version and benefit from the full correctness\n proof.\n *)\n\nrole A\nwhere \"A =\n [ Send ''1'' <| sAV ''A'', sN ''na'' |>\n , Recv ''2'' <| sMV ''B'', sMV ''nb'' |>\n , Send ''3'' ( PEnc <| sC ''enc3'', sAV ''A'', sMV ''B'', sN ''na'',\n sMV ''nb''\n |>\n ( sK ''A'' ''S'' )\n )\n , Recv ''6'' <| PEnc <| sC ''enc51'', sMV ''B'', sN ''na'', sMV ''nb'',\n sMV ''kab''\n |>\n ( sK ''A'' ''S'' ),\n PEnc <| sC ''enc6'', sN ''na'', sMV ''nb'' |> ( sMV ''kab'' )\n |>\n , Send ''7'' ( PEnc <| sC ''enc7'', sMV ''nb'' |> ( sMV ''kab'' ) )\n ]\"\n\nrole B\nwhere \"B =\n [ Recv ''1'' <| sMV ''A'', sMV ''na'' |>\n , Send ''2'' <| sAV ''B'', sN ''nb'' |>\n , Recv ''3'' ( sMV ''Ticket1'' )\n , Send ''4'' <| sMV ''Ticket1'',\n PEnc <| sC ''enc4'', sMV ''A'', sAV ''B'', sMV ''na'', sN ''nb'' |>\n ( sK ''B'' ''S'' )\n |>\n , Recv ''5'' <| sMV ''Ticket2'',\n PEnc <| sC ''enc52'', sMV ''A'', sMV ''na'', sN ''nb'', sMV ''kab'' |>\n ( sK ''B'' ''S'' )\n |>\n , Send ''6'' <| sMV ''Ticket2'',\n PEnc <| sC ''enc6'', sMV ''na'', sN ''nb'' |> ( sMV ''kab'' )\n |>\n , Recv ''7'' ( PEnc <| sC ''enc7'', sN ''nb'' |> ( sMV ''kab'' ) )\n ]\"\n\nrole S\nwhere \"S =\n [ Recv ''4'' <| PEnc <| sC ''enc3'', sMV ''A'', sMV ''B'', sMV ''na'',\n sMV ''nb''\n |>\n ( PSymK ( sMV ''A'' ) ( sAV ''S'' ) ),\n PEnc <| sC ''enc4'', sMV ''A'', sMV ''B'', sMV ''na'', sMV ''nb'' |>\n ( PSymK ( sMV ''A'' ) ( sAV ''S'' ) )\n |>\n , Send ''5'' <| PEnc <| sC ''enc51'', sMV ''B'', sMV ''na'', sMV ''nb'',\n sN ''kab''\n |>\n ( PSymK ( sMV ''A'' ) ( sAV ''S'' ) ),\n PEnc <| sC ''enc52'', sMV ''A'', sMV ''na'', sMV ''nb'', sN ''kab'' |>\n ( PSymK ( sMV ''B'' ) ( sAV ''S'' ) )\n |>\n ]\"\n\nprotocol WooLam\nwhere \"WooLam = { A, B, S }\"\n\nlocale restricted_WooLam_state = WooLam_state\n\ntype_invariant WooLam_msc_typing for WooLam\nwhere \"WooLam_msc_typing = mk_typing\n [ ((B, ''A''), (KnownT B_1))\n , ((S, ''A''), (SumT (KnownT S_4) AgentT))\n , ((A, ''B''), (KnownT A_2))\n , ((S, ''B''), (SumT (KnownT S_4) AgentT))\n , ((B, ''Ticket1''), (KnownT B_3))\n , ((B, ''Ticket2''), (KnownT B_5))\n , ((A, ''kab''), (SumT (KnownT A_6) (NonceT S ''kab'')))\n , ((B, ''kab''), (SumT (KnownT B_5) (NonceT S ''kab'')))\n , ((B, ''na''), (KnownT B_1))\n , ((S, ''na''), (SumT (KnownT S_4) (NonceT A ''na'')))\n , ((A, ''nb''), (KnownT A_2))\n , ((S, ''nb''), (SumT (KnownT S_4) (NonceT B ''nb'')))\n ]\"\n\nsublocale WooLam_state < WooLam_msc_typing_state\nproof -\n have \"(t,r,s) : approx WooLam_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF WooLam_msc_typing.monoTyp, completeness_cases_rule])\n case (A_2_B t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_2_nb t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_nb\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_6_kab t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_6_kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc51'', s(MV ''B'' tid0), LN ''na'' tid0, s(MV ''nb'' tid0),\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_1_A t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_A\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_1_na t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_na\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_5_Ticket2 t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_5_Ticket2\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_5_kab t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_5_kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc52'', s(MV ''A'' tid0), s(MV ''na'' tid0), LN ''nb'' tid0,\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''B'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_4_A t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_4_A\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid0), s(MV ''B'' tid0),\n s(MV ''na'' tid0), s(MV ''nb'' tid0)\n |}\n ( K ( s(MV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_4_B t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_4_B\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid0), s(MV ''B'' tid0),\n s(MV ''na'' tid0), s(MV ''nb'' tid0)\n |}\n ( K ( s(MV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_4_na t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_4_na\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid0), s(MV ''B'' tid0),\n s(MV ''na'' tid0), s(MV ''nb'' tid0)\n |}\n ( K ( s(MV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_4_nb t r s tid0)\n then interpret state: WooLam_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_4_nb\n thus ?case\n proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid0), s(MV ''B'' tid0),\n s(MV ''na'' tid0), s(MV ''nb'' tid0)\n |}\n ( K ( s(MV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n qed\n thus \"WooLam_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext WooLam_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection: Secrecy Properties *)\n\nlemma (in restricted_WooLam_state) S_sec_kab:\n assumes facts:\n \"roleMap r tid0 = Some S\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid0)) ~: reveals t\"\n \"LN ''kab'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''kab'' tid0 \")\n case S_5_kab note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n case S_5_kab_1 note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_WooLam_state) A_sec_kab:\n assumes facts:\n \"roleMap r tid0 = Some A\"\n \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid0)) ~: reveals t\"\n \"( tid0, A_6 ) : steps t\"\n \"s(MV ''kab'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc51'', s(MV ''B'' tid0), LN ''na'' tid0, s(MV ''nb'' tid0),\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WooLam_state) B_sec_kab:\n assumes facts:\n \"roleMap r tid0 = Some B\"\n \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n \"( tid0, B_5 ) : steps t\"\n \"s(MV ''kab'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc52'', s(MV ''A'' tid0), s(MV ''na'' tid0), LN ''nb'' tid0,\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''B'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc_1 tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WooLam_state) A_sec_inv_kab:\n assumes facts:\n \"roleMap r tid0 = Some A\"\n \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid0)) ~: reveals t\"\n \"( tid0, A_6 ) : steps t\"\n \"inv(s(MV ''kab'' tid0)) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc51'', s(MV ''B'' tid0), LN ''na'' tid0, s(MV ''nb'' tid0),\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''A'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WooLam_state) B_sec_inv_kab:\n assumes facts:\n \"roleMap r tid0 = Some B\"\n \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n \"( tid0, B_5 ) : steps t\"\n \"inv(s(MV ''kab'' tid0)) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc52'', s(MV ''A'' tid0), s(MV ''na'' tid0), LN ''nb'' tid0,\n s(MV ''kab'' tid0)\n |}\n ( K ( s(AV ''B'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc_1 tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* subsection: Authentication *)\n\nlemma (in restricted_WooLam_state) na_first_send:\n assumes facts:\n \"roleMap r tid1 = Some A\"\n \"LN ''na'' tid1 : knows t\"\n shows \"predOrd t (St( tid1, A_1 )) (Ln(LN ''na'' tid1))\"\nusing facts proof(sources! \" LN ''na'' tid1 \")\n case A_1_na note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\nnext\n case A_3_na note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\nnext\n case (S_5_na tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid2), s(MV ''B'' tid2), LN ''na'' tid1,\n s(MV ''nb'' tid2)\n |}\n ( K ( s(MV ''A'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n case (A_3_enc tid3) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nnext\n case (S_5_na_1 tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid2), s(MV ''B'' tid2), LN ''na'' tid1,\n s(MV ''nb'' tid2)\n |}\n ( K ( s(MV ''A'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n case (A_3_enc tid3) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_WooLam_state) nb_first_send:\n assumes facts:\n \"roleMap r tid1 = Some B\"\n \"LN ''nb'' tid1 : knows t\"\n shows \"predOrd t (St( tid1, B_2 )) (Ln(LN ''nb'' tid1))\"\nusing facts proof(sources! \" LN ''nb'' tid1 \")\n case B_2_nb note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\nnext\n case B_4_nb note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\nnext\n case B_6_nb note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\nnext\n case (S_5_nb tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid2), s(MV ''B'' tid2),\n s(MV ''na'' tid2), LN ''nb'' tid1\n |}\n ( K ( s(MV ''A'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nnext\n case (S_5_nb_1 tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid2), s(MV ''B'' tid2),\n s(MV ''na'' tid2), LN ''nb'' tid1\n |}\n ( K ( s(MV ''A'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_WooLam_state) A_ni_synch:\n assumes facts:\n \"roleMap r tid1 = Some A\"\n \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid1)) ~: reveals t\"\n \"( tid1, A_6 ) : steps t\"\n shows\n \"(? tid2.\n (? tid3.\n roleMap r tid2 = Some B &\n roleMap r tid3 = Some S &\n s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n s(MV ''B'' tid1) = s(AV ''B'' tid2) &\n s(AV ''S'' tid1) = s(AV ''S'' tid2) &\n LN ''na'' tid1 = s(MV ''na'' tid2) &\n s(MV ''nb'' tid1) = LN ''nb'' tid2 &\n s(MV ''kab'' tid1) = s(MV ''kab'' tid2) &\n s(AV ''A'' tid1) = s(MV ''A'' tid3) &\n s(MV ''B'' tid1) = s(MV ''B'' tid3) &\n s(AV ''S'' tid1) = s(AV ''S'' tid3) &\n LN ''na'' tid1 = s(MV ''na'' tid3) &\n s(MV ''nb'' tid1) = s(MV ''nb'' tid3) &\n s(MV ''kab'' tid1) = LN ''kab'' tid3 &\n predOrd t (St( tid1, A_1 )) (St( tid2, B_1 )) &\n predOrd t (St( tid2, B_1 )) (St( tid2, B_2 )) &\n predOrd t (St( tid2, B_2 )) (St( tid1, A_2 )) &\n predOrd t (St( tid1, A_2 )) (St( tid1, A_3 )) &\n predOrd t (St( tid1, A_3 )) (St( tid3, S_4 )) &\n predOrd t (St( tid3, S_4 )) (St( tid3, S_5 )) &\n predOrd t (St( tid3, S_5 )) (St( tid2, B_5 )) &\n predOrd t (St( tid2, B_5 )) (St( tid2, B_6 )) &\n predOrd t (St( tid2, B_6 )) (St( tid1, A_6 )) &\n predOrd t (St( tid2, B_3 )) (St( tid2, B_4 )) &\n predOrd t (St( tid2, B_4 )) (St( tid3, S_4 ))))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc51'', s(MV ''B'' tid1), LN ''na'' tid1, s(MV ''nb'' tid1),\n s(MV ''kab'' tid1)\n |}\n ( K ( s(AV ''A'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(AV ''A'' tid1), s(MV ''B'' tid1), LN ''na'' tid1,\n s(MV ''nb'' tid1)\n |}\n ( K ( s(AV ''A'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (A_3_enc tid3) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc4'', s(AV ''A'' tid1), s(MV ''B'' tid1), LN ''na'' tid1,\n s(MV ''nb'' tid1)\n |}\n ( K ( s(AV ''A'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_4_enc tid3) note_unified facts = this facts\n have f1: \"roleMap r tid1 = Some A\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''na'' tid1 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts na_first_send[OF f1 f2, simplified]\n have f1: \"roleMap r tid3 = Some B\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''nb'' tid3 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts nb_first_send[OF f1 f2, simplified]\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc6'', LN ''na'' tid1, LN ''nb'' tid3 |}\n ( LN ''kab'' tid2 ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n next\n case (B_6_enc tid4) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc52'', s(AV ''A'' tid1), LN ''na'' tid1, LN ''nb'' tid3,\n LN ''kab'' tid2\n |}\n ( K ( s(AV ''A'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc_1 tid4) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WooLam_state) B_ni_synch:\n assumes facts:\n \"roleMap r tid2 = Some B\"\n \"RLKR(s(AV ''B'' tid2)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid2)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid2)) ~: reveals t\"\n \"( tid2, B_7 ) : steps t\"\n shows\n \"(? tid1.\n (? tid3.\n roleMap r tid1 = Some A &\n roleMap r tid3 = Some S &\n s(MV ''A'' tid2) = s(AV ''A'' tid1) &\n s(AV ''B'' tid2) = s(MV ''B'' tid1) &\n s(AV ''S'' tid2) = s(AV ''S'' tid1) &\n s(MV ''na'' tid2) = LN ''na'' tid1 &\n LN ''nb'' tid2 = s(MV ''nb'' tid1) &\n s(MV ''kab'' tid2) = s(MV ''kab'' tid1) &\n s(MV ''A'' tid2) = s(MV ''A'' tid3) &\n s(AV ''B'' tid2) = s(MV ''B'' tid3) &\n s(AV ''S'' tid2) = s(AV ''S'' tid3) &\n s(MV ''na'' tid2) = s(MV ''na'' tid3) &\n LN ''nb'' tid2 = s(MV ''nb'' tid3) &\n s(MV ''kab'' tid2) = LN ''kab'' tid3 &\n predOrd t (St( tid1, A_1 )) (St( tid2, B_1 )) &\n predOrd t (St( tid2, B_1 )) (St( tid2, B_2 )) &\n predOrd t (St( tid2, B_2 )) (St( tid1, A_2 )) &\n predOrd t (St( tid1, A_2 )) (St( tid1, A_3 )) &\n predOrd t (St( tid1, A_3 )) (St( tid3, S_4 )) &\n predOrd t (St( tid3, S_4 )) (St( tid3, S_5 )) &\n predOrd t (St( tid3, S_5 )) (St( tid2, B_5 )) &\n predOrd t (St( tid2, B_5 )) (St( tid2, B_6 )) &\n predOrd t (St( tid2, B_6 )) (St( tid1, A_6 )) &\n predOrd t (St( tid1, A_6 )) (St( tid1, A_7 )) &\n predOrd t (St( tid1, A_7 )) (St( tid2, B_7 )) &\n predOrd t (St( tid2, B_3 )) (St( tid2, B_4 )) &\n predOrd t (St( tid2, B_4 )) (St( tid3, S_4 ))))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc52'', s(MV ''A'' tid2), s(MV ''na'' tid2), LN ''nb'' tid2,\n s(MV ''kab'' tid2)\n |}\n ( K ( s(AV ''B'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_5_enc_1 tid3) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid2), s(AV ''B'' tid2),\n s(MV ''na'' tid2), LN ''nb'' tid2\n |}\n ( K ( s(MV ''A'' tid2) ) ( s(AV ''S'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (A_3_enc tid4) note_unified facts = this facts\n have f1: \"roleMap r tid4 = Some A\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''na'' tid4 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts na_first_send[OF f1 f2, simplified]\n have f1: \"roleMap r tid2 = Some B\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''nb'' tid2 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts nb_first_send[OF f1 f2, simplified]\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc7'', LN ''nb'' tid2 |} ( LN ''kab'' tid3 ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n next\n case (A_7_enc tid5) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc4'', s(AV ''A'' tid4), s(AV ''B'' tid2), LN ''na'' tid4,\n LN ''nb'' tid2\n |}\n ( K ( s(AV ''A'' tid4) ) ( s(AV ''S'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_4_enc tid6) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc6'', LN ''na'' tid5, LN ''nb'' tid2 |}\n ( LN ''kab'' tid3 ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_sec_kab intro: event_predOrdI)\n next\n case (B_6_enc tid6) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WooLam_state) S_ni_synch:\n assumes facts:\n \"roleMap r tid3 = Some S\"\n \"RLKR(s(AV ''S'' tid3)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid3)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid3)) ~: reveals t\"\n \"( tid3, S_4 ) : steps t\"\n shows\n \"(? tid1.\n (? tid2.\n roleMap r tid1 = Some A &\n roleMap r tid2 = Some B &\n s(MV ''A'' tid2) = s(AV ''A'' tid1) &\n s(AV ''B'' tid2) = s(MV ''B'' tid1) &\n s(AV ''S'' tid2) = s(AV ''S'' tid1) &\n s(MV ''na'' tid2) = LN ''na'' tid1 &\n LN ''nb'' tid2 = s(MV ''nb'' tid1) &\n s(MV ''A'' tid2) = s(MV ''A'' tid3) &\n s(AV ''B'' tid2) = s(MV ''B'' tid3) &\n s(AV ''S'' tid2) = s(AV ''S'' tid3) &\n s(MV ''na'' tid2) = s(MV ''na'' tid3) &\n LN ''nb'' tid2 = s(MV ''nb'' tid3) &\n predOrd t (St( tid1, A_1 )) (St( tid2, B_1 )) &\n predOrd t (St( tid2, B_1 )) (St( tid2, B_2 )) &\n predOrd t (St( tid2, B_2 )) (St( tid1, A_2 )) &\n predOrd t (St( tid1, A_2 )) (St( tid1, A_3 )) &\n predOrd t (St( tid1, A_3 )) (St( tid3, S_4 )) &\n predOrd t (St( tid2, B_3 )) (St( tid2, B_4 )) &\n predOrd t (St( tid2, B_4 )) (St( tid3, S_4 ))))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc3'', s(MV ''A'' tid3), s(MV ''B'' tid3),\n s(MV ''na'' tid3), s(MV ''nb'' tid3)\n |}\n ( K ( s(MV ''A'' tid3) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (A_3_enc tid4) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''enc4'', s(AV ''A'' tid4), s(MV ''B'' tid3), LN ''na'' tid4,\n s(MV ''nb'' tid3)\n |}\n ( K ( s(AV ''A'' tid4) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_4_enc tid5) note_unified facts = this facts\n have f1: \"roleMap r tid4 = Some A\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''na'' tid4 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts na_first_send[OF f1 f2, simplified]\n have f1: \"roleMap r tid5 = Some B\" using facts by (auto intro: event_predOrdI)\n have f2: \"LN ''nb'' tid5 : knows t\" using facts by (auto intro: event_predOrdI)\n note facts = facts nb_first_send[OF f1 f2, simplified]\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/WooLam_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.2760081986672223}} {"text": "theory TransformTools\nimports \"Launchbury.Nominal-HOLCF\" Launchbury.Terms Launchbury.Substitution Launchbury.Env\nbegin\n\ndefault_sort type\n\nfun lift_transform :: \"('a::cont_pt \\ exp \\ exp) \\ ('a\\<^sub>\\ \\ exp \\ exp)\"\n where \"lift_transform t Ibottom e = e\"\n | \"lift_transform t (Iup a) e = t a e\"\n\nlemma lift_transform_simps[simp]:\n \"lift_transform t \\ e = e\"\n \"lift_transform t (up\\a) e = t a e\"\n apply (metis inst_up_pcpo lift_transform.simps(1))\n apply (simp add: up_def cont_Iup)\n done\n\nlemma lift_transform_eqvt[eqvt]: \"\\ \\ lift_transform t a e = lift_transform (\\ \\ t) (\\ \\ a) (\\ \\ e)\"\n by (cases \"a\") simp_all\n\nlemma lift_transform_fun_cong[fundef_cong]:\n \"(\\ a. t1 a e1 = t2 a e1) \\ a1 = a2 \\ e1 = e2 \\ lift_transform t1 a1 e1 = lift_transform t2 a2 e2\"\n by (cases \"(t2,a2,e2)\" rule: lift_transform.cases) auto\n\nlemma subst_lift_transform: \n assumes \"\\ a. (t a e)[x ::= y] = t a (e[x ::= y])\"\n shows \"(lift_transform t a e)[x ::=y] = lift_transform t a (e[x ::= y])\"\n using assms by (cases a) auto\n\ndefinition\n map_transform :: \"('a::cont_pt \\ exp \\ exp) \\ (var \\ 'a\\<^sub>\\) \\ heap \\ heap\"\n where \"map_transform t ae = map_ran (\\ x e . lift_transform t (ae x) e)\"\n\nlemma map_transform_eqvt[eqvt]: \"\\ \\ map_transform t ae = map_transform (\\ \\ t) (\\ \\ ae)\"\n unfolding map_transform_def by simp\n\nlemma domA_map_transform[simp]: \"domA (map_transform t ae \\) = domA \\\"\n unfolding map_transform_def by simp\n\nlemma length_map_transform[simp]: \"length (map_transform t ae xs) = length xs\"\n unfolding map_transform_def map_ran_def by simp\n \nlemma map_transform_delete:\n \"map_transform t ae (delete x \\) = delete x (map_transform t ae \\)\"\n unfolding map_transform_def by (simp add: map_ran_delete)\n\nlemma map_transform_restrA:\n \"map_transform t ae (restrictA S \\) = restrictA S (map_transform t ae \\)\"\n unfolding map_transform_def by (auto simp add: map_ran_restrictA)\n\nlemma delete_map_transform_env_delete:\n \"delete x (map_transform t (env_delete x ae) \\) = delete x (map_transform t ae \\)\"\n unfolding map_transform_def by (induction \\) auto\n\nlemma map_transform_Nil[simp]:\n \"map_transform t ae [] = []\"\n unfolding map_transform_def by simp\n\nlemma map_transform_Cons:\n \"map_transform t ae ((x,e)# \\) = (x, lift_transform t (ae x) e) # (map_transform t ae \\)\"\n unfolding map_transform_def by simp\n\nlemma map_transform_append:\n \"map_transform t ae (\\@\\) = map_transform t ae \\ @ map_transform t ae \\\"\n unfolding map_transform_def by (simp add: map_ran_append)\n\nlemma map_transform_fundef_cong[fundef_cong]:\n \"(\\x e a. (x,e) \\ set m1 \\ t1 a e = t2 a e) \\ ae1 = ae2 \\ m1 = m2 \\ map_transform t1 ae1 m1 = map_transform t2 ae2 m2\"\n by (induction m2 arbitrary: m1)\n (fastforce simp add: map_transform_Nil map_transform_Cons intro!: lift_transform_fun_cong)+\n\nlemma map_transform_cong:\n \"(\\x. x \\ domA m1 \\ ae x = ae' x) \\ m1 = m2 \\ map_transform t ae m1 = map_transform t ae' m2\"\n unfolding map_transform_def by (auto intro!: map_ran_cong dest: domA_from_set)\n\nlemma map_of_map_transform: \"map_of (map_transform t ae \\) x = map_option (lift_transform t (ae x)) (map_of \\ x)\"\n unfolding map_transform_def by (simp add: map_ran_conv)\n\nlemma supp_map_transform_step:\n assumes \"\\ x e a. (x, e) \\ set \\ \\ supp (t a e) \\ supp e\"\n shows \"supp (map_transform t ae \\) \\ supp \\\"\n using assms\n apply (induction \\)\n apply (auto simp add: supp_Nil supp_Cons map_transform_Nil map_transform_Cons supp_Pair pure_supp)\n apply (case_tac \"ae a\")\n apply (fastforce)+\n done\n\nlemma subst_map_transform: \n assumes \"\\ x' e a. (x',e) : set \\ \\ (t a e)[x ::= y] = t a (e[x ::= y])\"\n shows \"(map_transform t ae \\)[x ::h=y] = map_transform t ae (\\[x ::h= y])\"\n using assms\n apply (induction \\)\n apply (auto simp add: map_transform_Nil map_transform_Cons)\n apply (subst subst_lift_transform)\n apply auto\n done\n\nlocale supp_bounded_transform = \n fixes trans :: \"'a::cont_pt \\ exp \\ exp\"\n assumes supp_trans: \"supp (trans a e) \\ supp e\"\nbegin\n lemma supp_lift_transform: \"supp (lift_transform trans a e) \\ supp e\"\n by (cases \"(trans, a, e)\" rule:lift_transform.cases) (auto dest!: subsetD[OF supp_trans])\n\n lemma supp_map_transform: \"supp (map_transform trans ae \\) \\ supp \\\"\n unfolding map_transform_def\n by (induction \\) (auto simp add: supp_Pair supp_Cons dest!: subsetD[OF supp_lift_transform])\n\n lemma fresh_transform[intro]: \"a \\ e \\ a \\ trans n e\"\n by (auto simp add: fresh_def) (auto dest!: subsetD[OF supp_trans])\n\n lemma fresh_star_transform[intro]: \"a \\* e \\ a \\* trans n e\"\n by (auto simp add: fresh_star_def)\n\n lemma fresh_map_transform[intro]: \"a \\ \\ \\ a \\ map_transform trans ae \\\"\n unfolding fresh_def using supp_map_transform by auto\n\n lemma fresh_star_map_transform[intro]: \"a \\* \\ \\ a \\* map_transform trans ae \\\"\n by (auto simp add: fresh_star_def)\nend\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/TransformTools.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2759746035997862}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\ntheory TraceMonadLemmas\nimports TraceMonadVCG\nbegin\n\nlemma mapM_Cons:\n \"mapM f (x # xs) = do\n y \\ f x;\n ys \\ mapM f xs;\n return (y # ys)\n od\"\n and mapM_Nil:\n \"mapM f [] = return []\"\n by (simp_all add: mapM_def sequence_def)\n\nlemma mapM_x_Cons:\n \"mapM_x f (x # xs) = do\n y \\ f x;\n mapM_x f xs\n od\"\n and mapM_x_Nil:\n \"mapM_x f [] = return ()\"\n by (simp_all add: mapM_x_def sequence_x_def)\n\nlemma mapM_append:\n \"mapM f (xs @ ys) = (do\n fxs \\ mapM f xs;\n fys \\ mapM f ys;\n return (fxs @ fys)\n od)\"\n by (induct xs, simp_all add: mapM_Cons mapM_Nil bind_assoc)\n\nlemma mapM_x_append:\n \"mapM_x f (xs @ ys) = (do\n x \\ mapM_x f xs;\n mapM_x f ys\n od)\"\n by (induct xs, simp_all add: mapM_x_Cons mapM_x_Nil bind_assoc)\n\nlemma mapM_map:\n \"mapM f (map g xs) = mapM (f o g) xs\"\n by (induct xs; simp add: mapM_Nil mapM_Cons)\n\nlemma mapM_x_map:\n \"mapM_x f (map g xs) = mapM_x (f o g) xs\"\n by (induct xs; simp add: mapM_x_Nil mapM_x_Cons)\n\nprimrec\n repeat_n :: \"nat \\ ('s, unit) tmonad \\ ('s, unit) tmonad\"\nwhere\n \"repeat_n 0 f = return ()\"\n | \"repeat_n (Suc n) f = do f; repeat_n n f od\"\n\nlemma repeat_n_mapM_x:\n \"repeat_n n f = mapM_x (\\_. f) (replicate n ())\"\n by (induct n, simp_all add: mapM_x_Cons mapM_x_Nil)\n\ndefinition\n repeat :: \"('s, unit) tmonad \\ ('s, unit) tmonad\"\nwhere\n \"repeat f = do n \\ select UNIV; repeat_n n f od\"\n\ndefinition\n env_step :: \"('s,unit) tmonad\"\nwhere\n \"env_step =\n (do\n s' \\ select UNIV;\n put_trace_elem (Env, s');\n put s'\n od)\"\n\nabbreviation\n \"env_n_steps n \\ repeat_n n env_step\"\n\nlemma elem_select_bind:\n \"(tr, res) \\ (do x \\ select S; f x od) s\n = (\\x \\ S. (tr, res) \\ f x s)\"\n by (simp add: bind_def select_def)\n\nlemma select_bind_UN:\n \"(do x \\ select S; f x od) = (\\s. \\x \\ S. f x s)\"\n by (rule ext, auto simp: elem_select_bind)\n\nlemma select_early:\n \"S \\ {}\n \\ do x \\ f; y \\ select S; g x y od\n = do y \\ select S; x \\ f; g x y od\"\n apply (simp add: bind_def select_def Sigma_def)\n apply (rule ext)\n apply (fastforce elim: rev_bexI image_eqI[rotated] split: tmres.split_asm)\n done\n\nlemma repeat_n_choice:\n \"S \\ {}\n \\ repeat_n n (do x \\ select S; f x od)\n = (do xs \\ select {xs. set xs \\ S \\ length xs = n}; mapM_x f xs od)\"\n apply (induct n; simp?)\n apply (simp add: select_def bind_def mapM_x_Nil cong: conj_cong)\n apply (simp add: select_early bind_assoc)\n apply (subst select_early)\n apply simp\n apply (auto intro: exI[where x=\"replicate n xs\" for n xs])[1]\n apply (simp(no_asm) add: fun_eq_iff set_eq_iff elem_select_bind)\n apply (simp only: conj_comms[where Q=\"length xs = n\" for xs n])\n apply (simp only: ex_simps[symmetric] conj_assoc length_Suc_conv, simp)\n apply (auto simp: mapM_x_Cons)\n done\n\nlemma repeat_choice:\n \"S \\ {}\n \\ repeat (do x \\ select S; f x od)\n = (do xs \\ select {xs. set xs \\ S}; mapM_x f xs od)\"\n apply (simp add: repeat_def repeat_n_choice)\n apply (simp(no_asm) add: fun_eq_iff set_eq_iff elem_select_bind)\n done\n\nlemma put_trace_append:\n \"put_trace (xs @ ys) = do put_trace ys; put_trace xs od\"\n by (induct xs; simp add: bind_assoc)\n\nlemma put_trace_elem_put_comm:\n \"do y \\ put_trace_elem x; put s od\n = do y \\ put s; put_trace_elem x od\"\n by (simp add: put_def put_trace_elem_def bind_def insert_commute)\n\nlemma put_trace_put_comm:\n \"do y \\ put_trace xs; put s od\n = do y \\ put s; put_trace xs od\"\n apply (rule sym; induct xs; simp)\n apply (simp add: bind_assoc put_trace_elem_put_comm)\n apply (simp add: bind_assoc[symmetric])\n done\n\nlemma mapM_x_comm:\n \"(\\x \\ set xs. do y \\ g; f x od = do y \\ f x; g od)\n \\ do y \\ g; mapM_x f xs od = do y \\ mapM_x f xs; g od\"\n apply (induct xs; simp add: mapM_x_Nil mapM_x_Cons)\n apply (simp add: bind_assoc[symmetric], simp add: bind_assoc)\n done\n\nlemma mapM_x_split:\n \"(\\x \\ set xs. \\y \\ set xs. do z \\ g y; f x od = do (z :: unit) \\ f x; g y od)\n \\ mapM_x (\\x. do z \\ f x; g x od) xs = do y \\ mapM_x f xs; mapM_x g xs od\"\n apply (induct xs; simp add: mapM_x_Nil mapM_x_Cons bind_assoc)\n apply (subst bind_assoc[symmetric], subst mapM_x_comm[where f=f and g=\"g x\" for x])\n apply simp\n apply (simp add: bind_assoc)\n done\n\nlemma mapM_x_put:\n \"mapM_x put xs = unless (xs = []) (put (last xs))\"\n apply (induct xs rule: rev_induct)\n apply (simp add: mapM_x_Nil unless_def when_def)\n apply (simp add: mapM_x_append mapM_x_Cons mapM_x_Nil)\n apply (simp add: bind_def unless_def when_def put_def return_def)\n done\n\nlemma put_trace_mapM_x:\n \"put_trace xs = mapM_x put_trace_elem (rev xs)\"\n by (induct xs; simp add: mapM_x_Nil mapM_x_append mapM_x_Cons)\n\nlemma rev_surj:\n \"surj rev\"\n by (rule_tac f=rev in surjI, simp)\n\nlemma select_image:\n \"select (f ` S) = do x \\ select S; return (f x) od\"\n by (auto simp add: bind_def select_def return_def Sigma_def)\n\nlemma env_steps_repeat:\n \"env_steps = repeat env_step\"\n apply (simp add: env_step_def repeat_choice env_steps_def\n select_early)\n apply (simp add: put_trace_elem_put_comm)\n apply (simp add: mapM_x_split put_trace_elem_put_comm put_trace_put_comm\n mapM_x_put)\n apply (simp add: put_trace_mapM_x rev_map mapM_x_map o_def)\n apply (subst rev_surj[symmetric], simp add: select_image bind_assoc)\n apply (rule arg_cong2[where f=bind, OF refl ext])\n apply (simp add: bind_def get_def put_def unless_def when_def return_def)\n apply (simp add: last_st_tr_def hd_map hd_rev)\n done\n\nlemma repeat_n_plus:\n \"repeat_n (n + m) f = do repeat_n n f; repeat_n m f od\"\n by (induct n; simp add: bind_assoc)\n\nlemma repeat_eq_twice[simp]:\n \"(do x \\ repeat f; repeat f od) = repeat f\"\n apply (simp add: repeat_def select_early)\n apply (simp add: bind_assoc repeat_n_plus[symmetric, simplified])\n apply (simp add: bind_def select_def Sigma_def)\n apply (rule ext, fastforce intro: exI[where x=0])\n done\n\nlemmas bind_then_eq = arg_cong2[where f=bind, OF _ refl]\nlemmas repeat_eq_twice_then[simp]\n = repeat_eq_twice[THEN bind_then_eq, simplified bind_assoc]\n\nlemmas env_steps_eq_twice[simp]\n = repeat_eq_twice[where f=env_step, folded env_steps_repeat]\nlemmas env_steps_eq_twice_then[simp]\n = env_steps_eq_twice[THEN bind_then_eq, simplified bind_assoc]\n\nlemmas mapM_collapse_append = mapM_append[symmetric, THEN bind_then_eq,\n simplified bind_assoc, simplified]\n\nlemma prefix_closed_mapM[rule_format, wp_split]:\n \"(\\x \\ set xs. prefix_closed (f x)) \\ prefix_closed (mapM f xs)\"\n apply (induct xs)\n apply (simp add: mapM_def sequence_def)\n apply (clarsimp simp: mapM_Cons)\n apply (intro prefix_closed_bind allI; clarsimp)\n done\n\nlemma modify_id:\n \"modify id = return ()\"\n by (simp add: modify_def get_def bind_def put_def return_def)\n\nlemma modify_modify:\n \"(do x \\ modify f; modify (g x) od) = modify (g () o f)\"\n by (simp add: bind_def simpler_modify_def)\n\nlemmas modify_modify_bind = arg_cong2[where f=bind,\n OF modify_modify refl, simplified bind_assoc]\n\nlemma select_single:\n \"select {x} = return x\"\n by (simp add: select_def return_def)\n\nlemma put_then_get[unfolded K_bind_def]:\n \"do put s; get od = do put s; return s od\"\n by (simp add: put_def bind_def get_def return_def)\n\nlemmas put_then_get_then\n = put_then_get[THEN bind_then_eq, simplified bind_assoc return_bind]\n\nlemmas bind_promote_If\n = if_distrib[where f=\"\\f. bind f g\" for g]\n if_distrib[where f=\"\\g. bind f g\" for f]\n\nlemma bind_promote_If2:\n \"do x \\ f; if P then g x else h x od\n = (if P then bind f g else bind f h)\"\n by simp\n\nlemma exec_put_trace[unfolded K_bind_def]:\n \"(do put_trace xs; f od) s\n = (\\n \\ {n. 0 < n \\ n \\ length xs}. {(drop n xs, Incomplete)})\n \\ ((\\(a, b). (a @ xs, b)) ` f s)\"\n apply (simp add: put_trace_eq_drop bind_def)\n apply (safe; (clarsimp split: if_split_asm)?;\n fastforce intro: bexI[where x=0] rev_bexI)\n done\n\nlemma if_fun_lift:\n \"(if P then f else g) x = (if P then f x else g x)\"\n by simp\n\nlemma UN_If_distrib:\n \"(\\x \\ S. if P x then A x else B x)\n = ((\\x \\ S \\ {x. P x}. A x) \\ (\\x \\ S \\ {x. \\ P x}. B x))\"\n by (fastforce split: if_split_asm)\n\nlemma Await_redef:\n \"Await P = do\n s1 \\ select {s. P s};\n env_steps;\n s \\ get;\n select (if P s then {()} else {})\n od\"\n apply (simp add: Await_def env_steps_def bind_assoc)\n apply (cases \"{s. P s} = {}\")\n apply (simp add: select_def bind_def get_def)\n apply (rule ext)\n apply (simp add: exec_get select_bind_UN put_then_get_then)\n apply (simp add: bind_promote_If2 if_fun_lift if_distrib[where f=select])\n apply (simp add: exec_put_trace cong: if_cong)\n apply (simp add: put_def bind_def select_def cong: if_cong)\n apply (strengthen equalityI)\n apply clarsimp\n apply (strengthen exI[where x=\"s # xs\" for s xs])\n apply (strengthen exI[where x=\"Suc n\" for n])\n apply simp\n apply blast\n done\n\nlemma bind_apply_cong':\n \"f s = f' s\n \\ (\\rv s'. (rv, s') \\ mres (f s) \\ g rv s' = g' rv s')\n \\ bind f g s = bind f' g' s\"\n apply (simp add: bind_def)\n apply (rule SUP_cong; simp?)\n apply (clarsimp split: tmres.split)\n apply (drule spec2, drule mp, erule in_mres)\n apply simp\n done\n\nlemmas bind_apply_cong = bind_apply_cong'[rule_format]\n\nlemma select_empty_bind[simp]:\n \"select {} >>= f = select {}\"\n by (simp add: select_def bind_def)\n\nlemma fail_bind[simp]:\n \"fail >>= f = fail\"\n by (simp add: bind_def fail_def)\n\nlemma eq_Me_neq_Env:\n \"(x = Me) = (x \\ Env)\"\n by (cases x; simp)\n\nlemma validI_invariant_imp:\n assumes v: \"\\P\\,\\R\\ f \\G\\,\\Q\\\"\n and P: \"\\s0 s. P s0 s \\ I s0\"\n and R: \"\\s0 s. I s0 \\ R s0 s \\ I s\"\n and G: \"\\s0 s. I s0 \\ G s0 s \\ I s\"\n shows \"\\P\\,\\R\\ f \\\\s0 s. I s0 \\ I s \\ G s0 s\\,\\\\rv s0 s. I s0 \\ Q rv s0 s\\\"\nproof -\n { fix tr s0 i\n assume r: \"rely_cond R s0 tr\" and g: \"guar_cond G s0 tr\"\n and I: \"I s0\"\n hence imp: \"\\(_, s, s') \\ trace_steps (rev tr) s0. I s \\ I s'\"\n apply (clarsimp simp: guar_cond_def rely_cond_def)\n apply (drule(1) bspec)+\n apply (clarsimp simp: eq_Me_neq_Env)\n apply (metis R G)\n done\n hence \"i < length tr \\ I (snd (rev tr ! i))\"\n using I\n apply (induct i)\n apply (clarsimp simp: neq_Nil_conv[where xs=\"rev tr\" for tr, simplified])\n apply clarsimp\n apply (drule bspec, fastforce simp add: trace_steps_nth)\n apply simp\n done\n }\n note I = this\n show ?thesis\n using v\n apply (clarsimp simp: validI_def rely_def imp_conjL)\n apply (drule spec2, drule(1) mp)+\n apply clarsimp\n apply (frule P[rule_format])\n apply (clarsimp simp: guar_cond_def trace_steps_nth I last_st_tr_def\n hd_append last_rev[symmetric]\n last_conv_nth rev_map)\n done\nqed\n\nlemma validI_guar_post_conj_lift:\n \"\\P\\,\\R\\ f \\G1\\,\\Q1\\\n \\ \\P\\,\\R\\ f \\G2\\,\\Q2\\\n \\ \\P\\,\\R\\ f \\\\s0 s. G1 s0 s \\ G2 s0 s\\,\\\\rv s0 s. Q1 rv s0 s \\ Q2 rv s0 s\\\"\n apply (frule validI_prefix_closed)\n apply (subst validI_def, clarsimp simp: rely_def)\n apply (drule(3) validI_D)+\n apply (auto simp: guar_cond_def)\n done\n\nlemmas modify_prefix_closed[simp] =\n modify_wp[THEN valid_validI_wp[OF no_trace_all(3)], THEN validI_prefix_closed]\nlemmas await_prefix_closed[simp] = Await_sync_twp[THEN validI_prefix_closed]\n\nlemma repeat_prefix_closed[intro!]:\n \"prefix_closed f \\ prefix_closed (repeat f)\"\n apply (simp add: repeat_def)\n apply (rule prefix_closed_bind; clarsimp)\n apply (rename_tac n)\n apply (induct_tac n; simp)\n apply (auto intro: prefix_closed_bind)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/TraceMonadLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2759745958884768}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory MultByAdd\nimports\n \"../../AutoCorres\"\nbegin\n\n(* Parse the input file. *)\ninstall_C_file \"mult_by_add.c\"\n\n(* Abstract the input file. *)\nautocorres [ ts_force nondet = mult_by_add ] \"mult_by_add.c\"\n\ncontext mult_by_add begin\n\n(*\n * Prove the function returns the correct result, and (simultaneously)\n * does not fail and terminates.\n *)\nlemma \"\\ \\s. True \\ mult_by_add' a b \\ \\r s. r = a * b \\!\"\n (* Unfold function definition. *)\n apply (clarsimp simp: mult_by_add'_def)\n\n (* Annotate while loop with an invariant and measure. *)\n apply (subst whileLoop_add_inv\n [where I=\"\\(a', r) s. (a' * b) + r = (a * b)\"\n and M=\"\\((a', _), s). unat a'\"])\n\n (* Run \"wp\" weakest precondition tactic, and solve verification *\n * conditions generated by it. *)\n apply wp\n apply (simp add: field_simps)\n apply unat_arith\n apply (simp add: split_def word_neq_0_conv[symmetric])\n apply (simp add: split_def | wp)+\n done\n\n(*\n * Equivalent partial-correctness proof using Simpl framework.\n *)\nlemma \"\\ \\ {s. s = t} \\ret__unsigned :== CALL mult_by_add(\\a, \\b) \\ (\\ret__unsigned = \\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\\"\n (* Unfold the body. *)\n apply vcg_step\n defer\n\n (* Annotate the while loop with an invariant and variant. *)\n apply (subst whileAnno_def)\n apply (subst whileAnno_def [symmetric,\n where I=\" \\ (\\a * \\b + \\result) = (\\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\\"\n and V=\"measure (\\s. unat (a_' s))\"])\n\n (* Solve the remaining conditions. *)\n apply vcg\n apply (fastforce intro: unat_mono simp: gt0_iff_gem1 field_simps less_1_simp scast_id)+\n done\n\nend\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/tests/examples/MultByAdd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.27597458817716736}} {"text": "(* Title: JinjaThreads/Basic/Set_without_equal.thy\n Author: Andreas Lochbihler\n*)\n\ntheory Set_without_equal\nimports Main\nbegin\n\ntext \\\n Adapt @{type \"set\"} code setup such that @{const \"insert\"}, \n @{const \"union\"}, and @{term \"set_of_pred\"} do not generate\n sort constraint @{class equal}.\n\\\n\ndefinition insert' :: \"'a \\ 'a set \\ 'a set\"\nwhere \"insert' = Set.insert\"\n\ndefinition union' :: \"'a set \\ 'a set \\ 'a set\"\nwhere \"union' A B = sup A B\"\n\ndeclare\n insert'_def [symmetric, code_unfold]\n union'_def [symmetric, code_unfold]\n\nlemma insert'_code:\n \"insert' x (set xs) = set (x # xs)\"\n by (rule set_eqI) (simp add: insert'_def)\n\nlemma union'_code:\n \"union' (set xs) (set ys) = set (xs @ ys)\"\n by (rule set_eqI) (simp add: union'_def fun_eq_iff)\n\ndeclare\n insert'_code [code]\n union'_code [code]\n\ntext \\Merge name spaces to avoid cyclic module dependencies\\\n\ncode_identifier\n code_module Set_without_equal \\\n (SML) Set and (Haskell) Set and (OCaml) Set\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Basic/Set_without_equal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.27590740667197156}} {"text": "section \\Correctness of Type Checker\\\n\ntheory Wasm_Checker_Properties imports Wasm_Checker Wasm_Properties begin\n\nsubsection \\Soundness\\\n\nlemma b_e_check_single_type_sound:\n assumes \"type_update (Type x1) (to_ct_list t_in) (Type t_out) = Type x2\"\n \"c_types_agree (Type x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (Type x1) tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms(2) b_e_typing.intros(35)[OF assms(3)] type_update_type[OF assms(1)]\n by auto\n\nlemma b_e_check_single_top_sound:\n assumes \"type_update (TopType x1) (to_ct_list t_in) (Type t_out) = TopType x2\"\n \"c_types_agree (TopType x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (TopType x1) tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n obtain t_ag where t_ag_def:\"ct_suffix (to_ct_list t_out) x2\"\n \"tm = t_ag @ t_out\"\n \"c_types_agree (TopType x1) (t_ag @ t_in)\"\n using type_update_top_top[OF assms(1,2)]\n by fastforce\n hence \"\\ \\ [e] : (t_ag@t_in _> t_ag@t_out)\"\n using b_e_typing.intros(35)[OF assms(3)]\n by fastforce\n thus ?thesis\n using t_ag_def\n by fastforce\nqed\n\nlemma b_e_check_single_top_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (TopType []) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n shows \"\\tn. c_types_agree ts tn \\ suffix t_in tn\"\nproof (cases ts)\n case (TopType x1)\n then obtain t_int where \"consume (TopType x1) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using TopType ct_suffix_ct_list_eq_exists ct_suffix_ts_conv_suffix\n unfolding consume.simps\n by (metis append_Nil c_types_agree.simps(2) ct_suffix_def)\nnext\n case (Type x2)\n then obtain t_int where \"consume (Type x2) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using c_types_agree_id Type consume_type suffixI ct_suffix_ts_conv_suffix\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_type_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (Type t_out) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n \"c_types_agree ts' tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree ts tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms b_e_check_single_type_sound \nproof (cases ts)\n case (TopType x1)\n then obtain x1' where x_def:\"TopType x1' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(1) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_top_sound TopType\n by fastforce\nnext\n case (Type x2)\n then obtain x2' where x_def:\"Type x2' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(2) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_type_sound Type\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_sound_unop_testop_cvtop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = (Unop_i t uu) \\ e = (Testop t uv)) \\ is_int_t t)\n \\ (e = (Unop_f t uw) \\ is_float_t t)\n \\ (e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\n \\ (e = (Cvtop t1 Reinterpret t sx) \\ ((t1 \\ t) \\ t_length t1 = t_length t \\ sx = None))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"(e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\"\n using assms(2)\n by simp\n hence temp0:\"(e = (Cvtop t1 Convert t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,5) arity_1_result_def\n by (simp del: convert_cond.simps)\n have temp1:\"(e = (Cvtop t1 Reinterpret t sx)) \\ (type_update tn' [TSome t] (Type [arity_1_result e]) = tm')\"\n using assms(1,2,5) arity_1_result_def\n by simp\n have 1:\"type_update tn' (to_ct_list [t]) (Type [arity_1_result e]) = tm'\"\n using assms arity_1_result_def\n unfolding to_ct_list_def\n apply (simp del: convert_cond.simps)\n apply (metis (no_types, lifting) temp0 temp1 b_e.simps(978,979,982) check_single.simps(2) check_single.simps(3) check_single.simps(6) type_update.simps)\n done\n have \"\\ \\ [e] : ([t] _> [arity_1_result e])\"\n using assms(2) b_e_typing.intros(2,3,6,9,10)\n unfolding arity_1_result_def\n by fastforce\n thus ?thesis\n using b_e_check_single_type_not_bot_sound[OF 1 assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_check_single_sound_binop_relop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = Binop_i t iop \\ is_int_t t)\n \\ (e = Binop_f t fop \\ is_float_t t)\n \\ (e = Relop_i t irop \\ is_int_t t)\n \\ (e = Relop_f t frop \\ is_float_t t))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"type_update tn' (to_ct_list [t,t]) (Type [arity_2_result e]) = tm'\"\n using assms arity_2_result_def\n unfolding to_ct_list_def\n by auto\n moreover\n have \"\\ \\ [e] : ([t,t] _> [arity_2_result e])\"\n using assms(2) b_e_typing.intros(4,5,7,8)\n unfolding arity_2_result_def\n by fastforce\n ultimately\n show ?thesis\n using b_e_check_single_type_not_bot_sound[OF _ assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_type_checker_sound:\n assumes \"b_e_type_checker \\ es (tn _> tm)\"\n shows \"\\ \\ es : (tn _> tm)\"\nproof -\n fix e tn'\n have \"b_e_type_checker \\ es (tn _> tm) \\\n \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check \\ es tn' = tm' \\\n c_types_agree tm' tm \\\n \\tn. c_types_agree tn' tn \\ \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check_single \\ e tn' = tm' \\\n c_types_agree tm' tm \\\n tn' \\ Bot \\\n tm' \\ Bot \\\n \\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn' tm)\n thus ?case\n by simp\n next\n case (2 \\ es' ts)\n show ?case\n proof (cases es')\n case Nil\n thus ?thesis\n using 2(5,6)\n by (simp add: b_e_type_empty)\n next\n case (Cons e es)\n thus ?thesis\n proof (cases ts)\n case (TopType x1)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) TopType Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(2)[OF Cons TopType check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(1)[OF Cons _ ts'_def] TopType c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case (Type x2)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) Type Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(4)[OF Cons Type check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(3)[OF Cons _ ts'_def] Type c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case Bot\n then show ?thesis\n using 2(5,6) Cons\n by auto\n qed\n qed\n next\n case (3 \\ v ts)\n hence \"type_update ts [] (Type [typeof v]) = tm'\"\n by simp\n moreover\n have \"\\ \\ [C v] : ([] _> [typeof v])\"\n using b_e_typing.intros(1)\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 3(3,4,2)]\n by (metis list.simps(8) to_ct_list_def)\n next\n case (4 \\ t uu ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 4\n by fastforce\n next\n case (5 \\ t uv ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 5\n by fastforce\n next\n case (6 \\ t uw ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 6\n by fastforce\n next\n case (7 \\ t ux ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 7\n by fastforce\n next\n case (8 \\ t uy ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 8\n by fastforce\n next\n case (9 \\ t uz ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 9\n by fastforce\n next\n case (10 \\ t va ts)\n hence \"is_float_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 10\n by fastforce\n next\n case (11 \\ t1 t2 sx ts)\n hence \"convert_cond t1 t2 sx\"\n by (simp del: convert_cond.simps, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 11\n by fastforce\n next\n case (12 \\ t1 t2 sx ts)\n hence \"t1 \\ t2 \\ t_length t1 = t_length t2 \\ sx = None\"\n by (simp, presburger)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 12\n by fastforce\n next\n case (13 \\ ts)\n thus ?case\n using b_e_typing.intros(11) c_types_agree_not_bot_exists\n by blast\n next\n case (14 \\ ts)\n thus ?case\n using b_e_typing.intros(12,35)\n by fastforce\n next\n case (15 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n thus ?thesis\n proof (cases x1 rule: List.rev_cases)\n case Nil\n have \"\\ \\ [Drop] : (tm@[T_i32] _> tm)\"\n using b_e_typing.intros(13,35)\n by fastforce\n thus ?thesis\n using c_types_agree_top1 Nil TopType\n by fastforce\n next\n case (snoc ys y)\n hence temp1:\"(consume (TopType (ys@[y])) [TAny]) = tm'\"\n using 15 TopType type_update_empty\n by (metis check_single.simps(13))\n hence temp2:\"c_types_agree (TopType ys) tm\"\n using consume_top_geq[OF temp1] 15(2,3,4)\n by (metis Suc_leI add_diff_cancel_right' append_eq_conv_conj consume.simps(2)\n ct_suffix_def length_Cons length_append list.size(3) trans_le_add2\n zero_less_Suc)\n obtain t where \"ct_list_eq [y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc TopType\n by (simp add: to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(13,35)\n by fastforce\n qed\n next\n case (Type x2)\n thus ?thesis\n proof (cases x2 rule: List.rev_cases)\n case Nil\n hence \"(consume (Type []) [TAny]) = tm'\"\n using 15 Type type_update_empty\n by fastforce\n thus ?thesis\n using 15(4) ct_list_eq_def ct_suffix_def to_ct_list_def\n by simp\n next\n case (snoc ys y)\n hence temp1:\"(consume (Type (ys@[y])) [TAny]) = tm'\"\n using 15 Type type_update_empty\n by (metis check_single.simps(13))\n hence temp2:\"c_types_agree (Type ys) tm\"\n using 15(2,3,4) ct_suffix_def\n by (simp, metis One_nat_def butlast_conv_take butlast_snoc c_types_agree.simps(1)\n length_Cons list.size(3))\n obtain t where \"ct_list_eq [TSome y] (to_ct_list [t])\"\n using ct_list_eq_exists\n unfolding ct_list_eq_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_eq snoc Type\n by (simp add: ct_list_eq_def to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(13,35)\n by fastforce\n qed\n qed simp\n next\n case (16 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"tm' = TopType [TAny]\"\n using TopType 16\n by simp\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 16(2) ct_suffix_def\n by (simp, metis Nil_is_append_conv append_butlast_last_id checker_type.inject(1)\n ct_prefixI ct_prefix_nil(2) produce.simps(1) produce_nil)\n have \"\\ \\ [Select] : ([t'',t'',T_i32] _> [t''])\"\n using b_e_typing.intros(14)\n by blast\n thus ?thesis\n using TopType 16 1 tm_def b_e_typing.intros(35) c_types_agree.simps(2) c_types_agree_top1\n by fastforce\n next\n case 2\n have \"type_update_select (TopType x1) = tm'\"\n using 16 TopType\n unfolding check_single.simps\n by simp\n hence x1_def:\"ct_list_eq x1 [TSome T_i32]\" \"tm' = TopType [TAny]\"\n using type_update_select_length1[OF _ 2 16(4)]\n by simp_all\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 16(2) ct_suffix_def\n by (metis Nil_is_append_conv append_butlast_last_id c_types_agree.simps(2) ct_prefixI\n ct_prefix_nil(2) list.simps(8) to_ct_list_def)\n have \"c_types_agree (TopType x1) ((tm''@[t'',t''])@[T_i32])\"\n using x1_def(1)\n by (metis c_types_agree_top2 list.simps(8,9) to_ct_list_def)\n thus ?thesis\n using TopType b_e_typing.intros(14,35) tm_def\n by auto\n next\n case 3\n have \"type_update_select (TopType x1) = tm'\"\n using 16 TopType\n unfolding check_single.simps\n by simp\n then obtain ct1 ct2 where x1_def:\"x1 = [ct1, ct2]\"\n \"ct_eq ct2 (TSome T_i32)\"\n \"tm' = TopType [ct1]\"\n using type_update_select_length2[OF _ 3 16(4)]\n by blast\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n \"ct_list_eq [ct1] [(TSome t'')]\"\n using 16(2) c_types_agree_imp_ct_list_eq[of \"[ct1]\" tm]\n by (metis append_Nil2 append_butlast_last_id append_eq_append_conv_if append_eq_conv_conj\n ct_list_eq_length diff_Suc_1 length_Cons length_butlast length_map\n list.simps(8,9) list.size(3) nat.distinct(2) to_ct_list_def)\n hence \"ct_list_eq x1 (to_ct_list [ t'', T_i32])\"\n using x1_def(1,2)\n unfolding ct_list_eq_def to_ct_list_def\n by fastforce\n hence \"c_types_agree (TopType x1) ((tm''@[t''])@[t'',T_i32])\"\n using c_types_agree_top2\n by blast\n thus ?thesis\n using TopType b_e_typing.intros(14,35) tm_def\n by auto\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n hence tm'_def:\"type_update_select (TopType x1) = tm'\"\n using 16 TopType\n by simp\n then obtain tm_int where \"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = tm_int\"\n \"tm_int \\ Bot\"\n using nat_def 16(4)\n unfolding type_update_select.simps\n by fastforce\n then obtain x2 where x2_def:\"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = TopType x2\"\n using select_return_top_exists\n by fastforce\n have \"ct_suffix x1 [TAny, TAny, TSome T_i32] \\ ct_suffix [TAny, TAny, TSome T_i32] x1\"\n using tm'_def nat_def 16(4)\n by (simp, metis (full_types) produce.simps(6))\n hence tm'_eq:\"tm' = TopType x2\"\n using tm'_def nat_def 16(4) x2_def\n by force\n then obtain cts' ct1 ct2 ct3 where cts'_def:\"x1 = cts'@[ct1, ct2, ct3]\"\n \"ct_eq ct3 (TSome T_i32)\"\n using type_update_select_length3 tm'_def 4\n by blast\n then obtain c' cm' where tm_def:\"tm = cm'@[c']\"\n \"ct_suffix cts' (to_ct_list cm')\"\n \"ct_eq (x1 ! (length x1 - 2)) (TSome c')\"\n \"ct_eq (x1 ! (length x1 - 3)) (TSome c')\"\n using select_return_top_ct_eq[OF x2_def 4] tm'_eq 4 16(2)\n by fastforce\n then obtain as bs where cm'_def:\"cm' = as@bs\"\n \"ct_list_eq (to_ct_list bs) cts'\"\n using ct_list_eq_cons_ct_list1 ct_list_eq_ts_conv_eq\n by (metis ct_suffix_def to_ct_list_append(2))\n hence \"ct_eq ct1 (TSome c')\"\n \"ct_eq ct2 (TSome c')\"\n using cts'_def tm_def\n apply simp_all\n apply (metis append.assoc append_Cons append_Nil length_append_singleton nth_append_length)\n done\n hence \"c_types_agree ts (cm'@[c',c',T_i32])\"\n using c_types_agree_top2[of _ _ as] cm'_def(1) TopType\n ct_list_eq_concat[OF ct_list_eq_commute[OF cm'_def(2)]] cts'_def\n unfolding to_ct_list_def ct_list_eq_def\n by fastforce\n thus ?thesis\n using b_e_typing.intros(14,35) tm_def\n by auto\n qed\n next\n (* TODO: refactor *)\n case (Type x2)\n hence x2_cond:\"(length x2 \\ 3 \\ (x2!(length x2-2)) = (x2!(length x2-3)))\"\n using 16\n by (simp, meson)\n hence tm'_def:\"consume (Type x2) [TAny, TSome T_i32] = tm'\"\n using 16 Type\n by simp\n obtain ts' ts'' where cts_def:\"x2 = ts'@ ts''\" \"length ts'' = 3\"\n using x2_cond\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain t1 ts''2 where \"ts'' = t1#ts''2\" \"length ts''2 = Suc (Suc 0)\"\n using List.length_Suc_conv[of ts' \"Suc (Suc 0)\"]\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain t2 t3 where \"ts'' = [t1,t2,t3]\"\n using List.length_Suc_conv[of ts''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n hence cts_def2:\"x2 = ts'@ [t1,t2,t3]\"\n using cts_def\n by simp\n have ts'_suffix:\"ct_suffix [TAny, TSome T_i32] (to_ct_list (ts' @ [t1, t2, t3]))\"\n using tm'_def 16(4)\n by (simp, metis cts_def2)\n hence tm'_def:\"tm' = Type (ts'@[t1])\"\n using tm'_def 16(4) cts_def2\n by simp\n obtain as bs where \"(to_ct_list (ts' @ [t1])) @ (to_ct_list ([t2, t3])) = as@bs\"\n \"ct_list_eq bs [TAny, TSome T_i32]\"\n using ts'_suffix\n unfolding ct_suffix_def to_ct_list_def\n by fastforce\n hence \"t3 = T_i32\"\n unfolding to_ct_list_def ct_list_eq_def\n by (metis (no_types, lifting) Nil_is_map_conv append_eq_append_conv ct_eq.simps(1)\n length_Cons list.sel(1,3) list.simps(9) list_all2_Cons2 list_all2_lengthD)\n moreover\n have \"t1 = t2\"\n using x2_cond cts_def2\n by (simp, metis append.left_neutral append_Cons append_assoc length_append_singleton\n nth_append_length)\n ultimately\n have \"c_types_agree (Type x2) ((ts'@[t1,t1])@[T_i32])\"\n using cts_def2\n by simp\n thus ?thesis\n using b_e_typing.intros(14,35) Type tm'_def 16(2)\n by fastforce\n qed simp\n next\n case (17 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 17\n by (simp, meson)\n hence \"\\ \\ [Block (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(15)[OF _ 17(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 17(4,5,3)]\n by blast\n next\n case (18 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tn''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 18\n by (simp, meson)\n hence \"\\ \\ [Loop (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(16)[OF _ 18(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 18(4,5,3)]\n by blast\n next\n case (19 \\ tn'' tm'' es1 es2 ts)\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es1 (tn'' _> tm''))\"\n \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es2 (tn'' _> tm''))\"\n using 19\n by (simp, meson)+\n hence \"\\ \\ [If (tn'' _> tm'') es1 es2] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(17)[OF _ 19(1,2)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 19(5,6,4)]\n by blast\n next\n case (20 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i)) (TopType []) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 20\n by (simp, meson)\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 20(3,4)]\n b_e_typing.intros(18)\n b_e_typing.intros(35)\n by (metis suffix_def)\n next\n case (21 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i @ [T_i32])) (Type ((label \\)!i)) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 21\n by (simp, meson)\n hence \"\\ \\ [Br_if i] : ((label \\)!i @ [T_i32] _> (label \\)!i)\"\n using b_e_typing.intros(19)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 21(3,4,2)]\n by fastforce\n next\n case (22 \\ \"is\" i ts)\n then obtain tls where tls_def:\"(same_lab (is@[i]) (label \\)) = Some tls\"\n by fastforce\n hence \"type_update ts (to_ct_list (tls @ [T_i32])) (TopType []) = tm'\"\n using 22\n by simp\n thus ?case\n using b_e_check_single_top_not_bot_sound[OF _ 22(3,4)]\n b_e_typing.intros(20)[OF same_lab_conv_list_all[OF tls_def]]\n b_e_typing.intros(35)\n by (metis suffix_def)\n next\n case (23 \\ ts)\n then obtain ts_r where \"(return \\) = Some ts_r\"\n by fastforce\n moreover\n hence \"type_update ts (to_ct_list ts_r) (TopType []) = tm'\"\n using 23\n by simp\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 23(3,4)]\n b_e_typing.intros(21,35)\n by (metis suffix_def)\n next\n case (24 \\ i ts)\n obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n using 24\n by auto\n moreover\n have \"i < length (func_t \\)\"\n using 24\n by (simp, meson)\n hence \"\\ \\ [Call i] : (tn'' _> tm'')\"\n using b_e_typing.intros(22) func_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 24(3,4,2)]\n by fastforce\n next\n case (25 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n using 25\n by auto\n moreover\n have \"(table \\) \\ None \\ i < length (types_t \\)\"\n using 25\n by (simp, meson)\n hence \"\\ \\ [Call_indirect i] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(23) type_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 25(3,4,2)]\n by fastforce\n next\n case (26 \\ i ts)\n hence \"type_update ts [] (Type [(local \\)!i]) = tm'\"\n by auto\n moreover\n have \"i < length (local \\)\"\n using 26\n by (simp, meson)\n hence \"\\ \\ [Get_local i] : ([] _> [(local \\)!i])\"\n using b_e_typing.intros(24)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 26(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (27 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 27\n by (simp, meson)\n hence \"\\ \\ [Set_local i] : ([(local \\)!i] _> [])\"\n using b_e_typing.intros(25)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 27(3,4,2)]\n by fastforce\n next\n case (28 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type [(local \\)!i]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 28\n by (simp, meson)\n hence \"\\ \\ [Tee_local i] : ([(local \\)!i] _> [(local \\)!i])\"\n using b_e_typing.intros(26)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 28(3,4,2)]\n by fastforce\n next\n case (29 \\ i ts)\n hence \"type_update ts [] (Type [tg_t ((global \\)!i)]) = tm'\"\n by auto\n moreover\n have \"i < length (global \\)\"\n using 29\n by (simp, meson)\n hence \"\\ \\ [Get_global i] : ([] _> [tg_t ((global \\)!i)])\"\n using b_e_typing.intros(27)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 29(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (30 \\ i ts)\n hence \"type_update ts (to_ct_list [tg_t ((global \\)!i)]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (global \\) \\ is_mut (global \\ ! i)\"\n using 30\n by (simp, meson)\n then obtain t where \"(global \\ ! i) = \\tg_mut = T_mut, tg_t = t\\\" \"i < length (global \\)\"\n unfolding is_mut_def\n by (cases \"global \\ ! i\", auto)\n hence \"\\ \\ [Set_global i] : ([tg_t (global \\ ! i)] _> [])\"\n using b_e_typing.intros(28)[of i \\ \"tg_t (global \\ ! i)\"]\n unfolding is_mut_def tg_t_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 30(3,4,2)]\n by fastforce\n next\n case (31 \\ t tp_sx a off ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [t]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"(memory \\) \\ None \\ load_store_t_bounds a (option_projl tp_sx) t\"\n using 31\n by (simp, meson)\n hence \"\\ \\ [Load t tp_sx a off] : ([T_i32] _> [t])\"\n using b_e_typing.intros(29)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 31(3,4,2)]\n by fastforce\n next\n case (32 \\ t tp a off ts)\n hence \"type_update ts (to_ct_list [T_i32,t]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"(memory \\) \\ None \\ load_store_t_bounds a tp t\"\n using 32\n by (simp, meson)\n hence \"\\ \\ [Store t tp a off] : ([T_i32,t] _> [])\"\n using b_e_typing.intros(30)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 32(3,4,2)]\n by fastforce\n next\n case (33 \\ ts)\n hence \"type_update ts [] (Type [T_i32]) = tm'\"\n by auto\n moreover\n have \"memory \\ \\ None\" \n using 33\n by (simp, meson)\n hence \"\\ \\ [Current_memory] : ([] _> [T_i32])\"\n using b_e_typing.intros(31)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 33(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (34 \\ ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [T_i32]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"memory \\ \\ None\" \n using 34\n by (simp, meson)\n hence \"\\ \\ [Grow_memory] : ([T_i32] _> [T_i32])\"\n using b_e_typing.intros(32)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 34(3,4,2)]\n by fastforce\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nsubsection \\Completeness\\\n\nlemma check_single_imp:\n assumes \"check_single \\ e ctn = ctm\"\n \"ctm \\ Bot\"\n shows \"check_single \\ e = id\n \\ check_single \\ e = (\\ctn. type_update_select ctn)\n \\ (\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\nproof -\n have True\n and True\n and \"check_single \\ e ctn = ctm \\\n ctm \\ Bot \\\n ?thesis\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn tm)\n thus ?case\n by simp\n next\n case (2 \\ es ts)\n thus ?case\n by simp\n next\n case (3 \\ v ts)\n thus ?case\n by fastforce\n next\n case (4 \\ t uu ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (5 \\ t uv ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (6 \\ t uw ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (7 \\ t ux ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (8 \\ t uy ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (9 \\ t uz ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (10 \\ t va ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (11 \\ t1 t2 sx ts)\n thus ?case\n by (simp del: convert_cond.simps, meson assms(2) type_update.simps)\n next\n case (12 \\ t1 t2 sx ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (13 \\ ts)\n thus ?case\n by fastforce\n next\n case (14 \\ ts)\n thus ?case\n by fastforce\n next\n case (15 \\ ts)\n thus ?case\n by fastforce\n next\n case (16 \\ ts)\n thus ?case\n by fastforce\n next\n case (17 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (18 \\ tn tm es ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (19 \\ tn tm es1 es2 ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (20 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (21 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (22 \\ \"is\" ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (23 \\ ts)\n thus ?case\n by (simp, metis assms(2) option.case_eq_if type_update.simps)\n next\n case (24 \\ i ts)\n then show ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (25 \\ i ts)\n thus ?case\n by (simp, metis (no_types, lifting) assms(2) tf.case tf.exhaust type_update.simps)\n next\n case (26 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (27 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (28 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (29 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (30 \\ i ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (31 \\ t tp_sx a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (32 \\ t tp a off ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (33 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n next\n case (34 \\ ts)\n thus ?case\n by (simp, meson assms(2) type_update.simps)\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nlemma check_equiv_fold:\n \"check \\ es ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts es\"\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n obtain ts' where ts'_def:\"check \\ (e # es) ts = ts'\"\n by blast\n show ?case\n proof (cases \"ts = Bot\")\n case True\n thus ?thesis\n using ts'_def\n by (induction es, simp_all)\n next\n case False\n thus ?thesis\n using ts'_def Cons\n by (cases ts, simp_all)\n qed\nqed\n\nlemma check_neq_bot_snoc:\n assumes \"check \\ (es@[e]) ts \\ Bot\"\n shows \"check \\ es ts \\ Bot\"\n using assms\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by (cases ts, simp_all)\nnext\n case (Cons a es)\n thus ?case\n by (cases ts, simp_all)\nqed\n\nlemma check_unfold_snoc:\n assumes \"check \\ es ts \\ Bot\"\n shows \"check \\ (es@[e]) ts = check_single \\ e (check \\ es ts)\"\nproof -\n obtain f where f_def:\"f = (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts))\"\n by blast\n have f_simp:\"\\ts. ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n proof -\n fix ts\n show \"ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n using f_def\n by (cases ts, simp_all)\n qed\n have \"check \\ (es@[e]) ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts (es@[e])\"\n using check_equiv_fold\n by simp\n also\n have \"... = foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev (es@[e])) ts\"\n using foldl_conv_foldr\n by fastforce\n also\n have \"... = f e (foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev es) ts)\"\n using f_def\n by simp\n also\n have \"... = f e (check \\ es ts)\"\n using foldr_conv_foldl[of _ \"(rev es)\" ts] rev_rev_ident[of es] check_equiv_fold\n by simp\n also\n have \"... = check_single \\ e (check \\ es ts)\"\n using assms f_simp\n by simp\n finally\n show ?thesis .\nqed\n\nlemma check_single_imp_weakening:\n assumes \"check_single \\ e (Type t1s) = ctm\"\n \"ctm \\ Bot\"\n \"c_types_agree ctn t1s\"\n \"c_types_agree ctm t2s\"\n shows \"\\ctm'. check_single \\ e ctn = ctm' \\ c_types_agree ctm' t2s\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1,3,4)\n by fastforce\n next\n (* TODO: better proof *)\n case 2\n note outer_2 = 2\n hence t1s_cond:\"(length t1s \\ 3 \\ (t1s!(length t1s-2)) = (t1s!(length t1s-3)))\"\n using assms(1,2)\n by (simp, meson)\n hence ctm_def:\"ctm = consume (Type t1s) [TAny, TSome T_i32]\"\n using assms(1,2) 2\n by simp\n then obtain c_t where c_t_def:\"ctm = Type c_t\"\n using assms(2)\n by (meson consume.simps(1))\n hence t2s_eq:\"t2s = c_t\"\n using assms(4)\n by simp\n hence t2s_len:\"length t2s > 0\"\n using t1s_cond ctm_def c_t_def assms(2)\n by (metis Suc_leI Suc_n_not_le_n checker_type.inject(2) consume.simps(1)\n diff_is_0_eq dual_order.trans length_0_conv length_Cons length_greater_0_conv\n nat.simps(3) numeral_3_eq_3 take_eq_Nil)\n have t1s_suffix_full:\"ct_suffix [TAny, TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis consume.simps(1))\n hence t1s_suffix:\"ct_suffix [TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis append_butlast_last_id last.simps list.distinct(1))\n obtain t t1s' where t1s_suffix2:\"t1s = t1s'@[t,t,T_i32]\"\n using type_update_select_type_length3 assms(1) c_t_def outer_2\n by fastforce\n hence t2s_def:\"t2s = t1s'@[t]\"\n using ctm_def c_t_def t2s_eq t1s_suffix assms(2) t1s_suffix_full\n by simp\n show ?thesis\n using assms(1,3,4)\n proof (cases ctn)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using 2 TopType\n by simp\n thus ?thesis\n using ct_suffix_singleton to_ct_list_def t2s_len\n by auto\n next\n case 2\n hence \"ct_suffix [TSome T_i32] x1\"\n using assms(3) TopType ct_suffix_imp_ct_list_eq ct_suffix_shared t1s_suffix\n by (metis One_nat_def append_Nil c_types_agree.simps(2) ct_list_eq_commute ct_suffix_def\n diff_self_eq_0 drop_0 length_Cons list.size(3))\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using outer_2 TopType 2\n by simp\n thus ?thesis\n using t2s_len ct_suffix_singleton\n by (simp add: to_ct_list_def)\n next\n case 3\n have \"ct_list_eq (to_ct_list t1s) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2\n by (simp add: ct_list_eq_ts_conv_eq)\n hence temp1:\"to_ct_list t1s = (to_ct_list (t1s' @ [t])) @ (to_ct_list [t, T_i32])\"\n using t1s_suffix2 to_ct_list_def\n by simp\n hence \"ct_suffix (to_ct_list [t, T_i32]) (to_ct_list t1s)\"\n using ct_suffix_def[of \"(to_ct_list [t, T_i32])\" \"(to_ct_list t1s)\"]\n by (simp add: ct_suffix_cons_it)\n hence \"ct_suffix (to_ct_list [t, T_i32]) x1\"\n using assms(3) TopType 3\n by (simp, metis temp1 append_Nil ct_suffix_cons2 ct_suffix_def length_Cons length_map\n list.size(3) numeral_2_eq_2 to_ct_list_def)\n hence temp3:\"ct_list_eq (to_ct_list [t, T_i32]) x1\"\n using 3 ct_suffix_imp_ct_list_eq\n unfolding to_ct_list_def\n by (metis Suc_leI ct_list_eq_commute diff_is_0_eq drop_0 length_Cons length_map lessI\n list.size(3) numeral_2_eq_2)\n hence temp4:\"ct_suffix [TSome T_i32] x1\" \n using ct_suffix_less[of \"[TSome t]\" \"[TSome T_i32]\" x1]\n ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\"] ct_suffix_nil\n unfolding to_ct_list_def\n by fastforce\n hence \"ct_suffix (take 1 x1) (to_ct_list [t])\"\n using temp3 ct_suffix_nil ct_list_eq_commute ct_suffix_extend_ct_list_eq[of \"[]\" \"[]\" \"(take 1 x1)\" \"(to_ct_list [t])\"]\n unfolding to_ct_list_def\n by (simp, metis butlast.simps(2) butlast_conv_take ct_list_eq_take diff_Suc_1 length_Cons\n list.distinct(1) list.size(3))\n thus ?thesis\n using TopType 2 3 ct_suffix_nil temp3 temp4 t2s_def to_ct_list_def\n apply (simp, safe)\n apply (metis append.assoc ct_suffix_def)\n done\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n obtain x1' x x' x'' where x1_split:\"x1 = x1'@[x,x',x'']\"\n proof -\n assume local_assms:\"(\\x1' x x' x''. x1 = x1' @ [x, x', x''] \\ thesis)\"\n obtain x1' x1'' where tn_split:\"x1 = x1'@x1''\"\n \"length x1'' = 3\"\n using 4\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain x x1''2 where \"x1'' = x#x1''2\" \"length x1''2 = Suc (Suc 0)\"\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain x' x'' where tn''_def:\"x1''= [x,x',x'']\"\n using List.length_Suc_conv[of x1''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n thus ?thesis\n using tn_split local_assms\n by simp\n qed\n hence a:\"ct_suffix (x1'@[x,x',x'']) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2 assms(3) TopType\n by simp\n hence b:\"ct_suffix (x1'@[x,x']) (to_ct_list (t1s' @ [t, t])) \\ (ct_eq x'' (TSome T_i32))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x,x'])\" \"x''\" \"to_ct_list (t1s' @ [t, t])\"]\n by fastforce\n hence c:\"ct_suffix (x1'@[x]) (to_ct_list (t1s' @ [t])) \\ (ct_eq x' (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x])\" \"x'\" \"to_ct_list (t1s' @ [t])\"]\n by fastforce\n hence d:\"ct_suffix x1' (to_ct_list t1s') \\ (ct_eq x (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1')\" \"x\" \"to_ct_list (t1s')\"]\n by fastforce\n have \"(take (length x1 - 3) x1) = x1'\"\n using x1_split\n by simp\n have x'_ind:\"(x1!(length x1-2)) = x'\"\n using x1_split List.nth_append_length[of \"x1' @ [x]\"]\n by simp\n have x_ind:\"(x1!(length x1-3)) = x\"\n using x1_split\n by simp\n have \"ct_suffix [TSome T_i32] x1\"\n using b x1_split ct_suffix_def ct_list_eq_def ct_suffixI[of x1 \"x1' @ [x, x']\"]\n by simp\n hence \"check_single \\ e (TopType x1) = (select_return_top x1 (x1!(length x1-2)) (x1!(length x1-3)))\"\n using type_update_select_conv_select_return_top[OF _ 4]\n unfolding 2\n by blast\n moreover\n have \"... = (TopType (x1'@[x])) \\ ... = (TopType (x1'@[x']))\"\n apply (cases x; cases x')\n using x1_split 4 nat_def 2 x_ind x'_ind c d\n by simp_all\n moreover\n have \"ct_suffix (x1'@[x]) (to_ct_list t2s)\"\n by (simp add: c t2s_def)\n moreover\n have \"ct_suffix (x1'@[x']) (to_ct_list t2s)\"\n using ct_suffix_unfold_one[symmetric, of x' \"(TSome t)\" x1' \"(to_ct_list t1s')\"] c d\n t2s_def\n unfolding to_ct_list_def\n by fastforce\n ultimately\n show ?thesis\n using TopType\n by auto\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where c_s_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence ctm_def:\"ctm = type_update (Type t1s) cons prods\"\n using assms(1)\n by fastforce\n hence cons_suffix:\"ct_suffix cons (to_ct_list t1s)\"\n using assms\n by (simp, metis (full_types) produce.simps(6))\n hence t_int_def:\"consume (Type t1s) cons = (Type (take (length t1s - length cons) t1s))\"\n using ctm_def\n by simp\n hence ctm_def2:\"ctm = produce (Type (take (length t1s - length cons) t1s)) prods\"\n using ctm_def\n by simp\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n hence \"ct_suffix x1 (to_ct_list t1s)\"\n using assms(3)\n by simp\n thus ?thesis\n using assms(2) ctm_def2\n proof (cases prods)\n case (TopType x1)\n thus ?thesis\n using consume_c_types_agree[OF t_int_def assms(3)] ctm_def2 assms(4) c_s_def\n by (metis c_types_agree.elims(2) produce.simps(3,4) type_update.simps)\n next\n case (Type x2)\n hence ctm_def3:\"ctm = Type ((take (length t1s - length cons) t1s)@ x2)\"\n using ctm_def2\n by simp\n have \"ct_suffix x1 cons \\ ct_suffix cons x1\"\n using ct_suffix_shared assms(3) TopType cons_suffix\n by auto\n thus ?thesis\n proof (rule disjE)\n assume \"ct_suffix x1 cons\"\n hence \"consume (TopType x1) cons = TopType []\"\n by (simp add: ct_suffix_length)\n hence \"check_single \\ e ctn = TopType (to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n thus ?thesis\n using TopType ctm_def3 assms(4) c_types_agree_top2 ct_list_eq_refl\n by auto\n next\n assume \"ct_suffix cons x1\"\n hence 4:\"consume (TopType x1) cons = TopType (take (length x1 - length cons ) x1)\"\n by (simp add: ct_suffix_length)\n hence 3:\"check_single \\ e ctn = TopType ((take (length x1 - length cons ) x1) @ to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n have \"((take (length t1s - length cons ) t1s) @ x2) = t2s\"\n using assms(4) ctm_def3\n by simp\n have \"c_types_agree (TopType (take (length x1 - length cons ) x1)) (take (length t1s - length cons) t1s)\"\n using consume_c_types_agree[OF t_int_def assms(3)] 4 TopType\n by simp\n hence \"c_types_agree (TopType (take (length x1 - length cons ) x1 @ to_ct_list x2)) (take (length t1s - length cons) t1s @ x2)\"\n unfolding c_types_agree.simps to_ct_list_def\n by (simp add: ct_suffix_cons2 ct_suffix_cons_it ct_suffix_extend_ct_list_eq)\n thus ?thesis\n using ctm_def3 assms 3\n by simp\n qed\n qed simp\n next\n case (Type x2)\n thus ?thesis\n using assms\n by simp\n next\n case Bot\n thus ?thesis\n using assms\n by simp\n qed\n qed\nqed\n\nlemma b_e_type_checker_compose:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n \"b_e_type_checker \\ [e] (t2s _> t3s)\"\n shows \"b_e_type_checker \\ (es @ [e]) (t1s _> t3s)\"\nproof -\n have \"c_types_agree (check_single \\ e (Type t2s)) t3s\"\n using assms(2)\n by simp\n then obtain ctm where ctm_def:\"check_single \\ e (Type t2s) = ctm\"\n \"c_types_agree ctm t3s\"\n \"ctm \\ Bot\"\n by fastforce\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n thus ?thesis\n using check_single_imp_weakening[OF ctm_def(1,3) ctn_def(2) ctm_def(2)]\n check_unfold_snoc[of \\ es \"(Type t1s)\" e]\n by simp\nqed\n\nlemma b_e_check_single_type_type:\n assumes \"check_single \\ e xs = (Type tm)\"\n shows \"\\tn. xs = (Type tn)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n note outer_2 = 2\n thus ?thesis\n using assms\n proof (cases xs)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = Suc 0\"\n | (3) \"length x1 = Suc (Suc 0)\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof cases\n case 1\n thus ?thesis\n using assms 2 TopType\n by simp\n next\n case 2\n thus ?thesis\n using assms outer_2 TopType produce_type_type\n by fastforce\n next\n case 3\n thus ?thesis\n using assms 2 TopType\n by (simp, metis checker_type.distinct(1) checker_type.distinct(5))\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n thus ?thesis\n using assms 2 TopType\n proof -\n {\n assume a1: \"produce (if ct_suffix [TAny, TAny, TSome T_i32] x1 then TopType (take (length x1 - length [TAny, TAny, TSome T_i32]) x1) else if ct_suffix x1 [TAny, TAny, TSome T_i32] then TopType [] else Bot) (select_return_top x1 (x1 ! Suc nat) (x1 ! nat)) = Type tm\"\n obtain tts :: \"checker_type \\ t list\" where\n f2: \"\\c. (\\ca ts. produce c ca \\ Type ts) \\ c = Type (tts c)\"\n using produce_type_type by moura\n then have f3: \"\\ts. \\ ct_suffix [TAny, TAny, TSome T_i32] x1 \\ Type tm \\ Type ts\"\n using a1 by fastforce\n then have \"\\ts. \\ ct_suffix x1 [TAny, TAny, TSome T_i32] \\ Type tm \\ Type ts\"\n using f2 a1 by fastforce\n then have False\n using f3 a1 by fastforce\n }\n thus ?thesis\n using assms 2 TopType nat_def\n by simp\n qed\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume xs cons) prods = (Type tm)\"\n using assms(1)\n by simp\n thus ?thesis\n using assms check_def consume_type_type produce_type_type\n by blast\n qed\nqed\n\nlemma b_e_check_single_weaken_type:\n assumes \"check_single \\ e (Type tn) = (Type tm)\"\n shows \"check_single \\ e (Type (ts@tn)) = Type (ts@tm)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1)\n by simp\n next\n case 2\n hence cond:\"(length tn \\ 3 \\ (tn!(length tn-2)) = (tn!(length tn-3)))\"\n using assms\n by (simp, metis checker_type.distinct(5))\n hence \"consume (Type tn) [TAny, TSome T_i32] = (Type tm)\"\n using assms 2\n by simp\n hence \"consume (Type (ts@tn)) [TAny, TSome T_i32] = (Type (ts@tm))\"\n using consume_weaken_type\n by blast\n moreover\n have \"(length (ts@tn) \\ 3 \\ ((ts@tn)!(length (ts@tn)-2)) = ((ts@tn)!(length (ts@tn)-3)))\"\n using cond\n by (simp, metis add.commute add_leE nth_append_length_plus numeral_Bit1 numeral_One\n one_add_one ordered_cancel_comm_monoid_diff_class.diff_add_assoc2)\n ultimately\n show ?thesis\n using 2\n by simp\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (Type tm)\"\n using assms(1)\n by simp\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis consume.simps(1) produce.simps(6))\n thus ?thesis\n using assms(1) check_def\n consume_weaken_type[OF t_int_def, of ts]\n produce_weaken_type[of t_int prods tm ts]\n by simp\n qed\nqed\n\nlemma b_e_check_single_weaken_top:\n assumes \"check_single \\ e (Type tn) = TopType tm\"\n shows \"check_single \\ e (Type (ts@tn)) = TopType tm\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n thus ?thesis\n using assms\n by (simp, metis checker_type.distinct(1) checker_type.distinct(3) consume.simps(1))\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (TopType tm)\"\n using assms(1)\n by simp\n moreover\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis checker_type.distinct(3) consume.simps(1) produce.simps(6))\n ultimately\n show ?thesis\n using check_def consume_weaken_type\n by (cases prods, auto)\n qed\nqed\n\nlemma b_e_check_weaken_type:\n assumes \"check \\ es (Type tn) = (Type tm)\"\n shows \"check \\ es (Type (ts@tn)) = (Type (ts@tm))\"\n using assms\nproof (induction es arbitrary: tn tm rule: List.rev_induct)\n case Nil\n thus ?case\n by simp\nnext\n case (snoc e es)\n hence \"check_single \\ e (check \\ es (Type tn)) = Type tm\"\n using check_unfold_snoc[OF check_neq_bot_snoc]\n by (metis checker_type.distinct(5))\n thus ?case\n using b_e_check_single_weaken_type b_e_check_single_type_type snoc\n by (metis check_unfold_snoc checker_type.distinct(5))\nqed\n\nlemma check_bot: \"check \\ es Bot = Bot\"\n by (simp add: list.case_eq_if)\n\nlemma b_e_check_weaken_top:\n assumes \"check \\ es (Type tn) = (TopType tm)\"\n shows \"check \\ es (Type (ts@tn)) = (TopType tm)\"\n using assms\nproof (induction es arbitrary: tn tm)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n show ?case\n proof (cases \"(check_single \\ e (Type tn))\")\n case (TopType x1)\n hence \"check_single \\ e (Type (ts@tn)) = TopType x1\"\n using b_e_check_single_weaken_top\n by blast\n thus ?thesis\n using TopType Cons\n by simp\n next\n case (Type x2)\n hence \"check_single \\ e (Type (ts@tn)) = Type (ts@x2)\"\n using b_e_check_single_weaken_type\n by blast\n thus ?thesis\n using Cons Type\n by fastforce\n next\n case Bot\n thus ?thesis\n using check_bot Cons\n by simp\n qed\n \nqed\n\nlemma b_e_type_checker_weaken:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n shows \"b_e_type_checker \\ es (ts@t1s _> ts@t2s)\"\nproof -\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_top[of \\ es t1s x1 ts]\n by (metis append_assoc b_e_type_checker.simps c_types_agree_imp_ct_list_eq c_types_agree_top2)\n next\n case (Type x2)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_type[of \\ es t1s x2 ts]\n by simp\n next\n case Bot\n thus ?thesis\n using ctn_def(3)\n by simp\n qed\nqed\n\nlemma b_e_type_checker_complete:\n assumes \"\\ \\ es : (tn _> tm)\"\n shows \"b_e_type_checker \\ es (tn _> tm)\"\n using assms\nproof (induction es \"(tn _> tm)\" arbitrary: tn tm rule: b_e_typing.induct)\n case (select \\ t)\n have \"ct_list_eq [TAny, TSome T_i32] [TSome t, TSome T_i32]\"\n by (simp add: to_ct_list_def ct_list_eq_def)\n thus ?case\n using ct_suffix_extend_ct_list_eq[OF ct_suffix_nil[of \"[TSome t]\"]] to_ct_list_def\n by auto\nnext\n case (br_table \\ ts \"is\" i t1s t2s)\n show ?case\n using list_all_conv_same_lab[OF br_table]\n by (auto simp add: to_ct_list_def ct_suffix_nil ct_suffix_cons_it)\nnext\n case (set_global i \\ t)\n thus ?case\n using to_ct_list_def ct_suffix_refl is_mut_def tg_t_def\n by auto\nnext\n case (composition \\ es t1s t2s e t3s)\n thus ?case\n using b_e_type_checker_compose\n by simp\nnext\n case (weakening \\ es t1s t2s ts)\n thus ?case\n using b_e_type_checker_weaken\n by simp\nqed (auto simp add: to_ct_list_def ct_suffix_refl ct_suffix_nil ct_suffix_cons_it\n ct_suffix_singleton_any)\n\ntheorem b_e_typing_equiv_b_e_type_checker:\n shows \"(\\ \\ es : (tn _> tm)) = (b_e_type_checker \\ es (tn _> tm))\"\n using b_e_type_checker_sound b_e_type_checker_complete\n by blast\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WebAssembly/Wasm_Checker_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.27580666368281753}} {"text": "theory CoCallFix\nimports CoCallAnalysisSig CoCallAnalysisBinds ArityAnalysisSig \"../Launchbury/Env-Nominal\" ArityAnalysisFix\nbegin\n\n\nlocale CoCallArityAnalysis =\n fixes cccExp :: \"exp \\ (Arity \\ AEnv \\ CoCalls)\"\nbegin\n\ndefinition Aexp :: \"exp \\ (Arity \\ AEnv)\"\n where \"Aexp e = (\\ a. fst (cccExp e \\ a))\"\n\nsublocale ArityAnalysis Aexp.\n\nabbreviation Aexp_syn' (\"\\\\<^bsub>_\\<^esub>\") where \"\\\\<^bsub>a\\<^esub> \\ (\\e. Aexp e\\a)\"\nabbreviation Aexp_bot_syn' (\"\\\\<^sup>\\\\<^bsub>_\\<^esub>\") where \"\\\\<^sup>\\\\<^bsub>a\\<^esub> \\ (\\e. fup\\(Aexp e)\\a)\"\n\nlemma Aexp_eq:\n \"\\\\<^bsub>a\\<^esub> e = fst (cccExp e \\ a)\"\n unfolding Aexp_def by (rule beta_cfun) (intro cont2cont)\n\nlemma fup_Aexp_eq:\n \"fup\\(Aexp e)\\a = fst (fup\\(cccExp e)\\a)\"\n by (cases a)(simp_all add: Aexp_eq)\n\n\ndefinition CCexp :: \"exp \\ (Arity \\ CoCalls)\" where \"CCexp \\ = (\\ a. snd (cccExp \\\\a))\"\nlemma CCexp_eq:\n \"CCexp e\\a = snd (cccExp e \\ a)\"\n unfolding CCexp_def by (rule beta_cfun) (intro cont2cont)\n\nlemma fup_CCexp_eq:\n \"fup\\(CCexp e)\\a = snd (fup\\(cccExp e)\\a)\"\n by (cases a)(simp_all add: CCexp_eq)\n\nsublocale CoCallAnalysis CCexp.\n\ndefinition CCfix :: \"heap \\ (AEnv \\ CoCalls) \\ CoCalls\"\n where \"CCfix \\ = (\\ aeG. (\\ G'. ccBindsExtra \\\\(fst aeG , G') \\ snd aeG))\"\n\nlemma CCfix_eq:\n \"CCfix \\\\(ae,G) = (\\ G'. ccBindsExtra \\\\(ae, G') \\ G)\"\n unfolding CCfix_def\n by simp\n\nlemma CCfix_unroll: \"CCfix \\\\(ae,G) = ccBindsExtra \\\\(ae, CCfix \\\\(ae,G)) \\ G\"\n unfolding CCfix_eq\n apply (subst fix_eq)\n apply simp\n done\n\nlemma fup_ccExp_restr_subst': \n assumes \"\\ a. cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n shows \"cc_restr S (fup\\(CCexp e[x::=y])\\a) = cc_restr S (fup\\(CCexp e)\\a)\"\n using assms\n by (cases a) (auto simp del: cc_restr_cc_restr simp add: cc_restr_cc_restr[symmetric])\n\nlemma ccBindsExtra_restr_subst': \n assumes \"\\ x' e a. (x',e) \\ set \\ \\ cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n assumes \"x \\ S\"\n assumes \"y \\ S\"\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (ccBindsExtra \\[x::h=y]\\(ae, G)) \n = cc_restr S (ccBindsExtra \\\\(ae f|` S , cc_restr S G))\"\n apply (simp add: ccBindsExtra_simp ccBinds_eq ccBind_eq Int_absorb2[OF assms(4)] fv_subst_int[OF assms(3,2)])\n apply (intro arg_cong2[where f = \"op \\\"] refl arg_cong[OF mapCollect_cong])\n apply (subgoal_tac \"k \\ S\")\n apply (auto intro: fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]] simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] ccSquare_def)[1]\n apply (metis assms(4) contra_subsetD domI dom_map_of_conv_domA)\n apply (subgoal_tac \"k \\ S\")\n apply (auto intro: fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]]\n simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] ccSquare_def cc_restr_twist[where S = S] simp del: cc_restr_cc_restr)[1]\n apply (subst fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]], assumption)\n apply (simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] )\n apply (subst fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]], assumption)\n apply (simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] )\n apply (metis assms(4) contra_subsetD domI dom_map_of_conv_domA)\n done\n\nlemma ccBindsExtra_restr:\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (ccBindsExtra \\\\(ae, G)) = cc_restr S (ccBindsExtra \\\\(ae f|` S, cc_restr S G))\"\n using assms\n apply (simp add: ccBindsExtra_simp ccBinds_eq ccBind_eq Int_absorb2)\n apply (intro arg_cong2[where f = \"op \\\"] refl arg_cong[OF mapCollect_cong])\n apply (subgoal_tac \"k \\ S\")\n apply simp\n apply (metis contra_subsetD domI dom_map_of_conv_domA)\n apply (subgoal_tac \"k \\ S\")\n apply simp\n apply (metis contra_subsetD domI dom_map_of_conv_domA)\n done\n\nlemma CCfix_restr:\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (CCfix \\\\(ae, G)) = cc_restr S (CCfix \\\\(ae f|` S, cc_restr S G))\"\n unfolding CCfix_def\n apply simp\n apply (rule parallel_fix_ind[where P = \"\\ x y . cc_restr S x = cc_restr S y\"])\n apply simp\n apply rule\n apply simp\n apply (subst (1 2) ccBindsExtra_restr[OF assms])\n apply (auto)\n done\n\nlemma ccField_CCfix:\n shows \"ccField (CCfix \\\\(ae, G)) \\ fv \\ \\ ccField G\"\n unfolding CCfix_def\n apply simp\n apply (rule fix_ind[where P = \"\\ x . ccField x \\ fv \\ \\ ccField G\"])\n apply (auto dest!: set_mp[OF ccField_ccBindsExtra])\n done\n\n\nlemma CCfix_restr_subst':\n assumes \"\\ x' e a. (x',e) \\ set \\ \\ cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n assumes \"x \\ S\"\n assumes \"y \\ S\"\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (CCfix \\[x::h=y]\\(ae, G)) = cc_restr S (CCfix \\\\(ae f|` S, cc_restr S G))\"\n unfolding CCfix_def\n apply simp\n apply (rule parallel_fix_ind[where P = \"\\ x y . cc_restr S x = cc_restr S y\"])\n apply simp\n apply rule\n apply simp\n apply (subst ccBindsExtra_restr_subst'[OF assms], assumption)\n apply (subst ccBindsExtra_restr[OF assms(4)]) back \n apply (auto)\n done\n\n\nend\n\nlemma Aexp_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.Aexp cccExp e) = CoCallArityAnalysis.Aexp (\\ \\ cccExp) (\\ \\ e)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.Aexp_eq by perm_simp rule\n\nlemma CCexp_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCexp cccExp e) = CoCallArityAnalysis.CCexp (\\ \\ cccExp) (\\ \\ e)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.CCexp_eq by perm_simp rule\n\nlemma CCfix_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCfix cccExp \\) = CoCallArityAnalysis.CCfix (\\ \\ cccExp) (\\ \\ \\)\"\n unfolding CoCallArityAnalysis.CCfix_def by perm_simp (simp_all add: Abs_cfun_eqvt)\n\nlemma ccFix_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.CCfix cccexp1 heap1 = CoCallArityAnalysis.CCfix cccexp2 heap2\"\n unfolding CoCallArityAnalysis.CCfix_def\n apply (rule arg_cong) back\n apply (rule ccBindsExtra_cong)\n apply (auto simp add: CoCallArityAnalysis.CCexp_def)\n done\n\n\ncontext CoCallArityAnalysis\nbegin\ndefinition cccFix :: \"heap \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix \\ = (\\ i. (Afix \\\\(fst i \\ (\\_.up\\0) f|` thunks \\), CCfix \\\\(Afix \\\\(fst i \\ (\\_.up\\0) f|` (thunks \\)), snd i)))\"\n\nlemma cccFix_eq:\n \"cccFix \\\\i = (Afix \\\\(fst i \\ (\\_.up\\0) f|` thunks \\), CCfix \\\\(Afix \\\\(fst i \\ (\\_.up\\0) f|` (thunks \\)), snd i))\"\n unfolding cccFix_def\n by (rule beta_cfun)(intro cont2cont)\nend\n\nlemma cccFix_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix cccExp \\) = CoCallArityAnalysis.cccFix (\\ \\ cccExp) (\\ \\ \\)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.cccFix_eq by perm_simp rule\n\nlemma cccFix_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.cccFix cccexp1 heap1 = CoCallArityAnalysis.cccFix cccexp2 heap2\"\n unfolding CoCallArityAnalysis.cccFix_def\n apply (rule cfun_eqI)\n apply auto\n apply (rule arg_cong[OF Afix_cong], auto simp add: CoCallArityAnalysis.Aexp_def)[1]\n apply (rule arg_cong2[OF ccFix_cong Afix_cong ])\n apply (auto simp add: CoCallArityAnalysis.Aexp_def)\n done\n\n\nsubsubsection {* The non-recursive case *}\n\ndefinition ABind_nonrec :: \"var \\ exp \\ AEnv \\ CoCalls \\ Arity\\<^sub>\\\"\nwhere\n \"ABind_nonrec x e = (\\ i. (if isVal e \\ x--x\\(snd i) then fst i x else up\\0))\"\n\nlemma ABind_nonrec_eq:\n \"ABind_nonrec x e\\(ae,G) = (if isVal e \\ x--x\\G then ae x else up\\0)\"\n unfolding ABind_nonrec_def\n apply (subst beta_cfun)\n apply (rule cont_if_else_above)\n apply auto\n by (metis in_join join_self_below(4))\n\nlemma ABind_nonrec_eqvt[eqvt]: \"\\ \\ (ABind_nonrec x e) = ABind_nonrec (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n apply (case_tac xa, simp)\n unfolding ABind_nonrec_eq\n by perm_simp rule\n\nlemma ABind_nonrec_above_arg:\n \"ae x \\ ABind_nonrec x e \\ (ae, G)\"\nunfolding ABind_nonrec_eq by auto\n\ndefinition Aheap_nonrec where\n \"Aheap_nonrec x e = (\\ i. esing x\\(ABind_nonrec x e\\i))\"\n\nlemma Aheap_nonrec_simp:\n \"Aheap_nonrec x e\\i = esing x\\(ABind_nonrec x e\\i)\"\n unfolding Aheap_nonrec_def by simp\n\nlemma Aheap_nonrec_lookup[simp]:\n \"(Aheap_nonrec x e\\i) x = ABind_nonrec x e\\i\"\n unfolding Aheap_nonrec_simp by simp\n\nlemma Aheap_nonrec_eqvt'[eqvt]:\n \"\\ \\ (Aheap_nonrec x e) = Aheap_nonrec (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding Aheap_nonrec_simp\n by (perm_simp, rule)\n\n\ncontext CoCallArityAnalysis\nbegin\n\n definition Afix_nonrec\n where \"Afix_nonrec x e = (\\ i. fup\\(Aexp e)\\(ABind_nonrec x e \\ i) \\ fst i)\"\n\n lemma Afix_nonrec_eq[simp]:\n \"Afix_nonrec x e \\ i = fup\\(Aexp e)\\(ABind_nonrec x e \\ i) \\ fst i\"\n unfolding Afix_nonrec_def\n by (rule beta_cfun) simp\n\n definition CCfix_nonrec\n where \"CCfix_nonrec x e = (\\ i. ccBind x e \\ (Aheap_nonrec x e\\i, snd i) \\ ccProd (fv e) (ccNeighbors x (snd i) - (if isVal e then {} else {x})) \\ snd i)\"\n\n lemma CCfix_nonrec_eq[simp]:\n \"CCfix_nonrec x e \\ i = ccBind x e\\(Aheap_nonrec x e\\i, snd i) \\ ccProd (fv e) (ccNeighbors x (snd i) - (if isVal e then {} else {x})) \\ snd i\"\n unfolding CCfix_nonrec_def\n by (rule beta_cfun) (intro cont2cont)\n\n definition cccFix_nonrec :: \"var \\ exp \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix_nonrec x e = (\\ i. (Afix_nonrec x e \\i , CCfix_nonrec x e \\i))\"\n\n lemma cccFix_nonrec_eq[simp]:\n \"cccFix_nonrec x e\\i = (Afix_nonrec x e \\i , CCfix_nonrec x e \\i)\"\n unfolding cccFix_nonrec_def\n by (rule beta_cfun) (intro cont2cont)\n\nend\n\n\nlemma AFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.Afix_nonrec cccExp x e) = CoCallArityAnalysis.Afix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.Afix_nonrec_eq\n by perm_simp rule\n\n\nlemma CCFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCfix_nonrec cccExp x e) = CoCallArityAnalysis.CCfix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.CCfix_nonrec_eq\n by perm_simp rule\n\nlemma cccFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix_nonrec cccExp x e) = CoCallArityAnalysis.cccFix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.cccFix_nonrec_eq\n by perm_simp rule\n\nsubsubsection {* Combining the cases *}\n\ncontext CoCallArityAnalysis\nbegin\n definition cccFix_choose :: \"heap \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix_choose \\ = (if nonrec \\ then case_prod cccFix_nonrec (hd \\) else cccFix \\)\"\n\n lemma cccFix_choose_simp1[simp]:\n \"\\ nonrec \\ \\ cccFix_choose \\ = cccFix \\\"\n unfolding cccFix_choose_def by simp\n\n lemma cccFix_choose_simp2[simp]:\n \"x \\ fv e \\ cccFix_choose [(x,e)] = cccFix_nonrec x e\"\n unfolding cccFix_choose_def nonrec_def by auto\n\nend\n\nlemma cccFix_choose_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix_choose cccExp \\) = CoCallArityAnalysis.cccFix_choose (\\ \\ cccExp) (\\ \\ \\)\"\n unfolding CoCallArityAnalysis.cccFix_choose_def \n apply (cases nonrec \\ rule: eqvt_cases[where x = \\])\n apply (perm_simp, rule)\n apply simp\n apply (erule nonrecE)\n apply (simp )\n\n apply simp\n done\n\nlemma cccFix_nonrec_cong[fundef_cong]:\n \"cccexp1 e = cccexp2 e \\ CoCallArityAnalysis.cccFix_nonrec cccexp1 x e = CoCallArityAnalysis.cccFix_nonrec cccexp2 x e\"\n apply (rule cfun_eqI)\n unfolding CoCallArityAnalysis.cccFix_nonrec_eq\n unfolding CoCallArityAnalysis.Afix_nonrec_eq\n unfolding CoCallArityAnalysis.CCfix_nonrec_eq\n unfolding CoCallArityAnalysis.fup_Aexp_eq\n apply (simp only: )\n apply (rule arg_cong[OF ccBind_cong])\n apply simp\n unfolding CoCallArityAnalysis.CCexp_def\n apply simp\n done\n\nlemma cccFix_choose_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.cccFix_choose cccexp1 heap1 = CoCallArityAnalysis.cccFix_choose cccexp2 heap2\"\n unfolding CoCallArityAnalysis.cccFix_choose_def\n apply (rule cfun_eqI)\n apply (auto elim!: nonrecE)\n apply (rule arg_cong[OF cccFix_nonrec_cong], auto)\n apply (rule arg_cong[OF cccFix_cong], auto)[1]\n done\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CoCallFix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.27573012226707305}} {"text": "(* Title: Uint.thy\n Author: Peter Lammich, TU Munich\n Author: Andreas Lochbihler, ETH Zurich\n*)\n\nchapter \\Unsigned words of default size\\\n\ntheory Uint imports\n Code_Target_Word_Base\nbegin\n\ntext \\\n This theory provides access to words in the target languages of the code generator\n whose bit width is the default of the target language. To that end, the type \\uint\\\n models words of width \\dflt_size\\, but \\dflt_size\\ is known only to be positive.\n\n Usage restrictions:\n Default-size words (type \\uint\\) cannot be used for evaluation, because \n the results depend on the particular choice of word size in the target language\n and implementation. Symbolic evaluation has not yet been set up for \\uint\\.\n\\\n\ntext \\The default size type\\\ntypedecl dflt_size\n\ninstantiation dflt_size :: typerep begin\ndefinition \"typerep_class.typerep \\ \\_ :: dflt_size itself. Typerep.Typerep (STR ''Uint.dflt_size'') []\"\ninstance ..\nend\n\nconsts dflt_size_aux :: \"nat\"\nspecification (dflt_size_aux) dflt_size_aux_g0: \"dflt_size_aux > 0\"\n by auto\nhide_fact dflt_size_aux_def\n\ninstantiation dflt_size :: len begin\ndefinition \"len_of_dflt_size (_ :: dflt_size itself) \\ dflt_size_aux\"\ninstance by(intro_classes)(simp add: len_of_dflt_size_def dflt_size_aux_g0)\nend\n\nabbreviation \"dflt_size \\ len_of (TYPE (dflt_size))\"\n\ncontext includes integer.lifting begin\nlift_definition dflt_size_integer :: integer is \"int dflt_size\" .\ndeclare dflt_size_integer_def[code del]\n \\ \\The code generator will substitute a machine-dependent value for this constant\\\n\nlemma dflt_size_by_int[code]: \"dflt_size = nat_of_integer dflt_size_integer\"\nby transfer simp\n\nlemma dflt_size[simp]: \n \"dflt_size > 0\"\n \"dflt_size \\ Suc 0\"\n \"\\ dflt_size < Suc 0\"\n using len_gt_0[where 'a=dflt_size]\n by (simp_all del: len_gt_0)\nend\n\ndeclare prod.Quotient[transfer_rule]\n\nsection \\Type definition and primitive operations\\\n\ntypedef uint = \"UNIV :: dflt_size word set\" .. \n\nsetup_lifting type_definition_uint\n\ntext \\Use an abstract type for code generation to disable pattern matching on @{term Abs_uint}.\\\ndeclare Rep_uint_inverse[code abstype]\n\ndeclare Quotient_uint[transfer_rule]\n\ninstantiation uint :: \"{neg_numeral, modulo, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint :: uint is \"0 :: dflt_size word\" .\nlift_definition one_uint :: uint is \"1\" .\nlift_definition plus_uint :: \"uint \\ uint \\ uint\" is \"(+) :: dflt_size word \\ _\" .\nlift_definition minus_uint :: \"uint \\ uint \\ uint\" is \"(-)\" .\nlift_definition uminus_uint :: \"uint \\ uint\" is uminus .\nlift_definition times_uint :: \"uint \\ uint \\ uint\" is \"(*)\" .\nlift_definition divide_uint :: \"uint \\ uint \\ uint\" is \"(div)\" .\nlift_definition modulo_uint :: \"uint \\ uint \\ uint\" is \"(mod)\" .\ninstance by standard (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint :: linorder begin\nlift_definition less_uint :: \"uint \\ uint \\ bool\" is \"(<)\" .\nlift_definition less_eq_uint :: \"uint \\ uint \\ bool\" is \"(\\)\" .\ninstance by standard (transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint.rep_eq less_eq_uint.rep_eq\n\ninstantiation uint :: bit_operations begin\nlift_definition bitNOT_uint :: \"uint \\ uint\" is bitNOT .\nlift_definition bitAND_uint :: \"uint \\ uint \\ uint\" is bitAND .\nlift_definition bitOR_uint :: \"uint \\ uint \\ uint\" is bitOR .\nlift_definition bitXOR_uint :: \"uint \\ uint \\ uint\" is bitXOR .\nlift_definition test_bit_uint :: \"uint \\ nat \\ bool\" is test_bit .\nlift_definition set_bit_uint :: \"uint \\ nat \\ bool \\ uint\" is set_bit .\nlift_definition lsb_uint :: \"uint \\ bool\" is lsb .\nlift_definition shiftl_uint :: \"uint \\ nat \\ uint\" is shiftl .\nlift_definition shiftr_uint :: \"uint \\ nat \\ uint\" is shiftr .\nlift_definition msb_uint :: \"uint \\ bool\" is msb .\ninstance ..\nend\n\ninstantiation uint :: bit_comprehension begin\nlift_definition set_bits_uint :: \"(nat \\ bool) \\ uint\" is \"set_bits\" .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint.rep_eq lsb_uint.rep_eq msb_uint.rep_eq\n\ninstantiation uint :: equal begin\nlift_definition equal_uint :: \"uint \\ uint \\ bool\" is \"equal_class.equal\" .\ninstance by standard (transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint.rep_eq\n\ninstantiation uint :: size begin\nlift_definition size_uint :: \"uint \\ nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint.rep_eq\n\nlift_definition sshiftr_uint :: \"uint \\ nat \\ uint\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint_of_int :: \"int \\ uint\" is \"word_of_int\" .\n\nlemma of_bool_integer_transfer [transfer_rule]:\n \"(rel_fun (=) pcr_integer) of_bool of_bool\"\nby(auto simp add: integer.pcr_cr_eq cr_integer_def split: bit.split)\n\ntext \\Use pretty numerals from integer for pretty printing\\\n\ncontext includes integer.lifting begin\n\nlift_definition Uint :: \"integer \\ uint\" is \"word_of_int\" .\n\nlemma Rep_uint_numeral [simp]: \"Rep_uint (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint_def Abs_uint_inverse numeral.simps plus_uint_def)\n\n\n\nlemma numeral_uint [code_unfold]: \"numeral n = Uint (numeral n)\"\nby transfer simp\n\nlemma Rep_uint_neg_numeral [simp]: \"Rep_uint (- numeral n) = - numeral n\"\nby(simp only: uminus_uint_def)(simp add: Abs_uint_inverse)\n\nlemma neg_numeral_uint [code_unfold]: \"- numeral n = Uint (- numeral n)\"\nby transfer(simp add: cr_uint_def)\n\nend\n\nlemma Abs_uint_numeral [code_post]: \"Abs_uint (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint_def numeral.simps plus_uint_def Abs_uint_inverse)\n\nlemma Abs_uint_0 [code_post]: \"Abs_uint 0 = 0\"\nby(simp add: zero_uint_def)\n\nlemma Abs_uint_1 [code_post]: \"Abs_uint 1 = 1\"\nby(simp add: one_uint_def)\n\nsection \\Code setup\\\n\ncode_printing code_module Uint \\ (SML)\n\\\nstructure Uint : sig\n val set_bit : Word.word -> IntInf.int -> bool -> Word.word\n val shiftl : Word.word -> IntInf.int -> Word.word\n val shiftr : Word.word -> IntInf.int -> Word.word\n val shiftr_signed : Word.word -> IntInf.int -> Word.word\n val test_bit : Word.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n let val mask = Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n in if b then Word.orb (x, mask)\n else Word.andb (x, Word.notb mask)\n end\n\nfun shiftl x n =\n Word.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n Word.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n Word.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n Word.andb (x, Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word.fromInt 0\n\nend; (* struct Uint *)\\\ncode_reserved SML Uint\n\ncode_printing code_module Uint \\ (Haskell)\n \\module Uint(Int, Word, dflt_size) where\n\n import qualified Prelude\n import Data.Int(Int)\n import Data.Word(Word)\n import qualified Data.Bits\n\n dflt_size :: Prelude.Integer\n dflt_size = Prelude.toInteger (bitSize_aux (0::Word)) where\n bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Int\n bitSize_aux = Data.Bits.bitSize\\\n and (Haskell_Quickcheck)\n \\module Uint(Int, Word, dflt_size) where\n\n import qualified Prelude\n import Data.Int(Int)\n import Data.Word(Word)\n import qualified Data.Bits\n\n dflt_size :: Prelude.Int\n dflt_size = bitSize_aux (0::Word) where\n bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Int\n bitSize_aux = Data.Bits.bitSize\n\\\ncode_reserved Haskell Uint dflt_size\n\ntext \\\n OCaml and Scala provide only signed bit numbers, so we use these and \n implement sign-sensitive operations like comparisons manually.\n\\\n\ncode_printing code_module \"Uint\" \\ (OCaml)\n\\module Uint : sig\n type t = int\n val dflt_size : Z.t\n val less : t -> t -> bool\n val less_eq : t -> t -> bool\n val set_bit : t -> Z.t -> bool -> t\n val shiftl : t -> Z.t -> t\n val shiftr : t -> Z.t -> t\n val shiftr_signed : t -> Z.t -> t\n val test_bit : t -> Z.t -> bool\n val int_mask : int\n val int32_mask : int32\n val int64_mask : int64\nend = struct\n\ntype t = int\n\nlet dflt_size = Z.of_int Sys.int_size;;\n\n(* negative numbers have their highest bit set, \n so they are greater than positive ones *)\nlet less x y =\n if x<0 then\n y<0 && x 0;;\n\nlet int_mask =\n if Sys.int_size < 32 then lnot 0 else 0xFFFFFFFF;;\n\nlet int32_mask = \n if Sys.int_size < 32 then Int32.pred (Int32.shift_left Int32.one Sys.int_size)\n else Int32.of_string \"0xFFFFFFFF\";;\n\nlet int64_mask = \n if Sys.int_size < 64 then Int64.pred (Int64.shift_left Int64.one Sys.int_size)\n else Int64.of_string \"0xFFFFFFFFFFFFFFFF\";;\n\nend;; (*struct Uint*)\\\ncode_reserved OCaml Uint\n\ncode_printing code_module Uint \\ (Scala)\n\\object Uint {\ndef dflt_size : BigInt = BigInt(32)\n\ndef less(x: Int, y: Int) : Boolean =\n if (x < 0) y < 0 && x < y\n else y < 0 || x < y\n\ndef less_eq(x: Int, y: Int) : Boolean =\n if (x < 0) y < 0 && x <= y\n else y < 0 || x <= y\n\ndef set_bit(x: Int, n: BigInt, b: Boolean) : Int =\n if (b)\n x | (1 << n.intValue)\n else\n x & (1 << n.intValue).unary_~\n\ndef shiftl(x: Int, n: BigInt) : Int = x << n.intValue\n\ndef shiftr(x: Int, n: BigInt) : Int = x >>> n.intValue\n\ndef shiftr_signed(x: Int, n: BigInt) : Int = x >> n.intValue\n\ndef test_bit(x: Int, n: BigInt) : Boolean =\n (x & (1 << n.intValue)) != 0\n\n} /* object Uint */\\\ncode_reserved Scala Uint\n\n\ntext \\\n OCaml's conversion from Big\\_int to int demands that the value fits into a signed integer.\n The following justifies the implementation.\n\\\n\ncontext includes integer.lifting begin\ndefinition wivs_mask :: int where \"wivs_mask = 2^ dflt_size - 1\"\nlift_definition wivs_mask_integer :: integer is wivs_mask .\n\n\ndefinition wivs_shift :: int where \"wivs_shift = 2 ^ dflt_size\"\nlift_definition wivs_shift_integer :: integer is wivs_shift .\nlemma [code]: \"wivs_shift_integer = 2 ^ dflt_size\"\n by transfer (simp add: wivs_shift_def)\n\ndefinition wivs_index :: nat where \"wivs_index == dflt_size - 1\"\nlift_definition wivs_index_integer :: integer is \"int wivs_index\".\nlemma wivs_index_integer_code[code]: \"wivs_index_integer = dflt_size_integer - 1\"\n by transfer (simp add: wivs_index_def of_nat_diff)\n\ndefinition wivs_overflow :: int where \"wivs_overflow == 2^ (dflt_size - 1)\"\nlift_definition wivs_overflow_integer :: integer is wivs_overflow .\nlemma [code]: \"wivs_overflow_integer = 2 ^ (dflt_size - 1)\"\n by transfer (simp add: wivs_overflow_def)\n\ndefinition wivs_least :: int where \"wivs_least == - wivs_overflow\"\nlift_definition wivs_least_integer :: integer is wivs_least .\nlemma [code]: \"wivs_least_integer = - (2 ^ (dflt_size - 1))\"\n by transfer (simp add: wivs_overflow_def wivs_least_def)\n\ndefinition Uint_signed :: \"integer \\ uint\" where\n \"Uint_signed i = (if i < wivs_least_integer \\ wivs_overflow_integer \\ i then undefined Uint i else Uint i)\"\n\nlemma Uint_code [code]:\n \"Uint i = \n (let i' = i AND wivs_mask_integer in \n if i' !! wivs_index then Uint_signed (i' - wivs_shift_integer) else Uint_signed i')\"\n including undefined_transfer \n unfolding Uint_signed_def\n apply transfer\n apply (rule word_of_int_via_signed)\n by (simp_all add: wivs_mask_def wivs_shift_def wivs_index_def wivs_overflow_def \n wivs_least_def bin_mask_conv_pow2 shiftl_int_def)\n\nlemma Uint_signed_code [code abstract]:\n \"Rep_uint (Uint_signed i) = \n (if i < wivs_least_integer \\ i \\ wivs_overflow_integer then Rep_uint (undefined Uint i) else word_of_int (int_of_integer_symbolic i))\"\n unfolding Uint_signed_def Uint_def int_of_integer_symbolic_def word_of_integer_def\n by(simp add: Abs_uint_inverse)\nend\n\ntext \\\n Avoid @{term Abs_uint} in generated code, use @{term Rep_uint'} instead. \n The symbolic implementations for code\\_simp use @{term Rep_uint}.\n\n The new destructor @{term Rep_uint'} is executable.\n As the simplifier is given the [code abstract] equations literally, \n we cannot implement @{term Rep_uint} directly, because that makes code\\_simp loop.\n\n If code generation raises Match, some equation probably contains @{term Rep_uint} \n ([code abstract] equations for @{typ uint} may use @{term Rep_uint} because\n these instances will be folded away.)\n\\\n\ndefinition Rep_uint' where [simp]: \"Rep_uint' = Rep_uint\"\n\nlemma Rep_uint'_code [code]: \"Rep_uint' x = (BITS n. x !! n)\"\nunfolding Rep_uint'_def by transfer simp\n\nlift_definition Abs_uint' :: \"dflt_size word \\ uint\" is \"\\x :: dflt_size word. x\" .\n\nlemma Abs_uint'_code [code]:\n \"Abs_uint' x = Uint (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\ndeclare [[code drop: \"term_of_class.term_of :: uint \\ _\"]]\n\nlemma term_of_uint_code [code]:\n defines \"TR \\ typerep.Typerep\" and \"bit0 \\ STR ''Numeral_Type.bit0''\" \n shows\n \"term_of_class.term_of x = \n Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint.uint.Abs_uint'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR (STR ''Uint.dflt_size'') []], TR (STR ''Uint.uint'') []]))\n (term_of_class.term_of (Rep_uint' x))\"\n by(simp add: term_of_anything)\n\ntext \\Important:\n We must prevent the reflection oracle (eval-tac) to \n use our machine-dependent type.\n\\\n\ncode_printing\n type_constructor uint \\\n (SML) \"Word.word\" and\n (Haskell) \"Uint.Word\" and\n (OCaml) \"Uint.t\" and\n (Scala) \"Int\" and\n (Eval) \"*** \\\"Error: Machine dependent type\\\" ***\" and\n (Quickcheck) \"Word.word\" \n| constant dflt_size_integer \\\n (SML) \"(IntInf.fromLarge (Int.toLarge Word.wordSize))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.wordSize\" and\n (Haskell) \"Uint.dflt'_size\" and\n (OCaml) \"Uint.dflt'_size\" and\n (Scala) \"Uint.dflt'_size\"\n| constant Uint \\\n (SML) \"Word.fromLargeInt (IntInf.toLarge _)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.fromInt\" and\n (Haskell) \"(Prelude.fromInteger _ :: Uint.Word)\" and\n (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint.Word)\" and\n (Scala) \"_.intValue\"\n| constant Uint_signed \\\n (OCaml) \"Z.to'_int\"\n| constant \"0 :: uint\" \\\n (SML) \"(Word.fromInt 0)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"(Word.fromInt 0)\" and\n (Haskell) \"(0 :: Uint.Word)\" and\n (OCaml) \"0\" and\n (Scala) \"0\"\n| constant \"1 :: uint\" \\\n (SML) \"(Word.fromInt 1)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"(Word.fromInt 1)\" and\n (Haskell) \"(1 :: Uint.Word)\" and\n (OCaml) \"1\" and\n (Scala) \"1\"\n| constant \"plus :: uint \\ _ \" \\\n (SML) \"Word.+ ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.+ ((_), (_))\" and\n (Haskell) infixl 6 \"+\" and\n (OCaml) \"Pervasives.(+)\" and\n (Scala) infixl 7 \"+\"\n| constant \"uminus :: uint \\ _\" \\\n (SML) \"Word.~\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.~\" and\n (Haskell) \"negate\" and\n (OCaml) \"Pervasives.(~-)\" and\n (Scala) \"!(- _)\"\n| constant \"minus :: uint \\ _\" \\\n (SML) \"Word.- ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.- ((_), (_))\" and\n (Haskell) infixl 6 \"-\" and\n (OCaml) \"Pervasives.(-)\" and\n (Scala) infixl 7 \"-\"\n| constant \"times :: uint \\ _ \\ _\" \\\n (SML) \"Word.* ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.* ((_), (_))\" and\n (Haskell) infixl 7 \"*\" and\n (OCaml) \"Pervasives.( * )\" and\n (Scala) infixl 8 \"*\"\n| constant \"HOL.equal :: uint \\ _ \\ bool\" \\\n (SML) \"!((_ : Word.word) = _)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"!((_ : Word.word) = _)\" and\n (Haskell) infix 4 \"==\" and\n (OCaml) \"(Pervasives.(=):Uint.t -> Uint.t -> bool)\" and\n (Scala) infixl 5 \"==\"\n| class_instance uint :: equal \\\n (Haskell) -\n| constant \"less_eq :: uint \\ _ \\ bool\" \\\n (SML) \"Word.<= ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.<= ((_), (_))\" and\n (Haskell) infix 4 \"<=\" and\n (OCaml) \"Uint.less'_eq\" and\n (Scala) \"Uint.less'_eq\"\n| constant \"less :: uint \\ _ \\ bool\" \\\n (SML) \"Word.< ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.< ((_), (_))\" and\n (Haskell) infix 4 \"<\" and\n (OCaml) \"Uint.less\" and\n (Scala) \"Uint.less\"\n| constant \"bitNOT :: uint \\ _\" \\\n (SML) \"Word.notb\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.notb\" and\n (Haskell) \"Data'_Bits.complement\" and\n (OCaml) \"Pervasives.lnot\" and\n (Scala) \"_.unary'_~\"\n| constant \"bitAND :: uint \\ _\" \\\n (SML) \"Word.andb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.andb ((_),/ (_))\" and\n (Haskell) infixl 7 \"Data_Bits..&.\" and\n (OCaml) \"Pervasives.(land)\" and\n (Scala) infixl 3 \"&\"\n| constant \"bitOR :: uint \\ _\" \\\n (SML) \"Word.orb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.orb ((_),/ (_))\" and\n (Haskell) infixl 5 \"Data_Bits..|.\" and\n (OCaml) \"Pervasives.(lor)\" and\n (Scala) infixl 1 \"|\"\n| constant \"bitXOR :: uint \\ _\" \\\n (SML) \"Word.xorb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.xorb ((_),/ (_))\" and\n (Haskell) \"Data'_Bits.xor\" and\n (OCaml) \"Pervasives.(lxor)\" and\n (Scala) infixl 2 \"^\"\n\ndefinition uint_divmod :: \"uint \\ uint \\ uint \\ uint\" where\n \"uint_divmod x y = \n (if y = 0 then (undefined ((div) :: uint \\ _) x (0 :: uint), undefined ((mod) :: uint \\ _) x (0 :: uint)) \n else (x div y, x mod y))\"\n\ndefinition uint_div :: \"uint \\ uint \\ uint\" \nwhere \"uint_div x y = fst (uint_divmod x y)\"\n\ndefinition uint_mod :: \"uint \\ uint \\ uint\" \nwhere \"uint_mod x y = snd (uint_divmod x y)\"\n\nlemma div_uint_code [code]: \"x div y = (if y = 0 then 0 else uint_div x y)\"\nincluding undefined_transfer unfolding uint_divmod_def uint_div_def\nby transfer(simp add: word_div_def)\n\nlemma mod_uint_code [code]: \"x mod y = (if y = 0 then x else uint_mod x y)\"\nincluding undefined_transfer unfolding uint_mod_def uint_divmod_def\nby transfer(simp add: word_mod_def)\n\ndefinition uint_sdiv :: \"uint \\ uint \\ uint\"\nwhere [code del]:\n \"uint_sdiv x y =\n (if y = 0 then undefined ((div) :: uint \\ _) x (0 :: uint)\n else Abs_uint (Rep_uint x sdiv Rep_uint y))\"\n\ndefinition div0_uint :: \"uint \\ uint\"\nwhere [code del]: \"div0_uint x = undefined ((div) :: uint \\ _) x (0 :: uint)\"\ndeclare [[code abort: div0_uint]]\n\ndefinition mod0_uint :: \"uint \\ uint\"\nwhere [code del]: \"mod0_uint x = undefined ((mod) :: uint \\ _) x (0 :: uint)\"\ndeclare [[code abort: mod0_uint]]\n\ndefinition wivs_overflow_uint :: uint \n where \"wivs_overflow_uint \\ 1 << (dflt_size - 1)\"\n\n(* TODO: Move to Word *)\nlemma dflt_size_word_pow_ne_zero [simp]:\n \"(2 :: 'a word) ^ (LENGTH('a::len) - Suc 0) \\ 0\"\nproof\n assume \"(2 :: 'a word) ^ (LENGTH('a::len) - Suc 0) = 0\"\n then have \"unat ((2 :: 'a word) ^ (LENGTH('a::len) - Suc 0)) = unat 0\"\n by simp\n then show False by (simp add: unat_p2)\nqed\n\nlemma uint_divmod_code [code]:\n \"uint_divmod x y =\n (if wivs_overflow_uint \\ y then if x < y then (0, x) else (1, x - y)\n else if y = 0 then (div0_uint x, mod0_uint x)\n else let q = (uint_sdiv (x >> 1) y) << 1;\n r = x - q * y\n in if r \\ y then (q + 1, r - y) else (q, r))\"\n including undefined_transfer \n unfolding uint_divmod_def uint_sdiv_def div0_uint_def mod0_uint_def\n wivs_overflow_uint_def\n by transfer (simp add: divmod_via_sdivmod)\n\nlemma uint_sdiv_code [code abstract]:\n \"Rep_uint (uint_sdiv x y) =\n (if y = 0 then Rep_uint (undefined ((div) :: uint \\ _) x (0 :: uint))\n else Rep_uint x sdiv Rep_uint y)\"\nunfolding uint_sdiv_def by(simp add: Abs_uint_inverse)\n\ntext \\\n Note that we only need a translation for signed division, but not for the remainder\n because @{thm uint_divmod_code} computes both with division only.\n\\\n\ncode_printing\n constant uint_div \\\n (SML) \"Word.div ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.div ((_), (_))\" and\n (Haskell) \"Prelude.div\"\n| constant uint_mod \\\n (SML) \"Word.mod ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.mod ((_), (_))\" and\n (Haskell) \"Prelude.mod\"\n| constant uint_divmod \\\n (Haskell) \"divmod\"\n| constant uint_sdiv \\\n (OCaml) \"Pervasives.('/)\" and\n (Scala) \"_ '/ _\"\n\ndefinition uint_test_bit :: \"uint \\ integer \\ bool\"\nwhere [code del]:\n \"uint_test_bit x n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (test_bit :: uint \\ _) x n\n else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint_code [code]:\n \"test_bit x n \\ n < dflt_size \\ uint_test_bit x (integer_of_nat n)\"\n including undefined_transfer integer.lifting unfolding uint_test_bit_def\n by transfer (auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint_test_bit_code [code]:\n \"uint_test_bit w n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (test_bit :: uint \\ _) w n else Rep_uint w !! nat_of_integer n)\"\nunfolding uint_test_bit_def\nby(simp add: test_bit_uint.rep_eq)\n\ncode_printing constant uint_test_bit \\\n (SML) \"Uint.test'_bit\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.test'_bit\" and\n (Haskell) \"Data'_Bits.testBitBounded\" and\n (OCaml) \"Uint.test'_bit\" and\n (Scala) \"Uint.test'_bit\"\n\ndefinition uint_set_bit :: \"uint \\ integer \\ bool \\ uint\"\nwhere [code del]:\n \"uint_set_bit x n b =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (set_bit :: uint \\ _) x n b\n else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint_code [code]:\n \"set_bit x n b = (if n < dflt_size then uint_set_bit x (integer_of_nat n) b else x)\"\n including undefined_transfer integer.lifting unfolding uint_set_bit_def\n by (transfer) (auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint_set_bit_code [code abstract]:\n \"Rep_uint (uint_set_bit w n b) = \n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (set_bit :: uint \\ _) w n b)\n else set_bit (Rep_uint w) (nat_of_integer n) b)\"\nincluding undefined_transfer integer.lifting unfolding uint_set_bit_def by transfer simp\n\ncode_printing constant uint_set_bit \\\n (SML) \"Uint.set'_bit\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.set'_bit\" and\n (Haskell) \"Data'_Bits.setBitBounded\" and\n (OCaml) \"Uint.set'_bit\" and\n (Scala) \"Uint.set'_bit\"\n\nlift_definition uint_set_bits :: \"(nat \\ bool) \\ uint \\ nat \\ uint\" is set_bits_aux .\n\nlemma uint_set_bits_code [code]:\n \"uint_set_bits f w n =\n (if n = 0 then w \n else let n' = n - 1 in uint_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint [code]:\n \"(BITS n. f n) = uint_set_bits f 0 dflt_size\"\n by transfer (simp add: set_bits_conv_set_bits_aux)\n\nlemma lsb_code [code]: fixes x :: uint shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\ndefinition uint_shiftl :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_shiftl x n = (if n < 0 \\ dflt_size_integer \\ n then undefined (shiftl :: uint \\ _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint_code [code]: \"x << n = (if n < dflt_size then uint_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint_shiftl_code [code abstract]:\n \"Rep_uint (uint_shiftl w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (shiftl :: uint \\ _) w n) else Rep_uint w << (nat_of_integer n))\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftl_def by transfer simp\n\ncode_printing constant uint_shiftl \\\n (SML) \"Uint.shiftl\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftl\" and\n (Haskell) \"Data'_Bits.shiftlBounded\" and\n (OCaml) \"Uint.shiftl\" and\n (Scala) \"Uint.shiftl\"\n\ndefinition uint_shiftr :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_shiftr x n = (if n < 0 \\ dflt_size_integer \\ n then undefined (shiftr :: uint \\ _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint_code [code]: \"x >> n = (if n < dflt_size then uint_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint_shiftr_code [code abstract]:\n \"Rep_uint (uint_shiftr w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (shiftr :: uint \\ _) w n) else Rep_uint w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint_shiftr_def by transfer simp\n\ncode_printing constant uint_shiftr \\\n (SML) \"Uint.shiftr\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftr\" and\n (Haskell) \"Data'_Bits.shiftrBounded\" and\n (OCaml) \"Uint.shiftr\" and\n (Scala) \"Uint.shiftr\"\n\ndefinition uint_sshiftr :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_sshiftr x n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined sshiftr_uint x n else sshiftr_uint x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n \"size x \\ n \\ x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint_code [code]:\n \"x >>> n = \n (if n < dflt_size then uint_sshiftr x (integer_of_nat n) else \n if x !! wivs_index then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_sshiftr_def\nby transfer(simp add: not_less sshiftr_beyond word_size wivs_index_def)\n\nlemma uint_sshiftr_code [code abstract]:\n \"Rep_uint (uint_sshiftr w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined sshiftr_uint w n) else Rep_uint w >>> (nat_of_integer n))\"\nincluding undefined_transfer unfolding uint_sshiftr_def by transfer simp\n\ncode_printing constant uint_sshiftr \\\n (SML) \"Uint.shiftr'_signed\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftr'_signed\" and\n (Haskell) \n \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint.Int) _)) :: Uint.Word)\" and\n (OCaml) \"Uint.shiftr'_signed\" and\n (Scala) \"Uint.shiftr'_signed\"\n\nlemma uint_msb_test_bit: \"msb x \\ (x :: uint) !! wivs_index\"\nby transfer(simp add: msb_nth wivs_index_def)\n\nlemma msb_uint_code [code]: \"msb x \\ uint_test_bit x wivs_index_integer\"\n apply(simp add: uint_test_bit_def uint_msb_test_bit \n wivs_index_integer_code dflt_size_integer_def wivs_index_def)\n by (metis (full_types) One_nat_def dflt_size(2) less_iff_diff_less_0 \n nat_of_integer_of_nat of_nat_1 of_nat_diff of_nat_less_0_iff wivs_index_def)\n\nlemma uint_of_int_code [code]: \"uint_of_int i = (BITS n. i !! n)\"\nby transfer(simp add: word_of_int_conv_set_bits test_bit_int_def[abs_def])\n\nsection \\Quickcheck setup\\\n\ndefinition uint_of_natural :: \"natural \\ uint\"\nwhere \"uint_of_natural x \\ Uint (integer_of_natural x)\"\n\ninstantiation uint :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint \\ qc_random_cnv uint_of_natural\"\ndefinition \"exhaustive_uint \\ qc_exhaustive_cnv uint_of_natural\"\ndefinition \"full_exhaustive_uint \\ qc_full_exhaustive_cnv uint_of_natural\"\ninstance ..\nend\n\ninstantiation uint :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n \"\\i. (Uint i, Uint (- i))\" \"0\"\n \"Typerep.Typerep (STR ''Uint.uint'') []\" .\n\ndefinition \"narrowing_uint d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint itself \\ _\"]]\nlemmas partial_term_of_uint [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Native_Word/Uint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044133, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.27573012226707294}} {"text": "section {*FUNCTION\\_\\_DPDA\\_RMPE\\_\\_DPDA\\_REMOVE\\_MASS\\_PUSHING\\_EDGES*}\ntheory\n FUNCTION__DPDA_RMPE__DPDA_REMOVE_MASS_PUSHING_EDGES\n\nimports\n PRJ_12_04_04_04__ENTRY\n\nbegin\n\ndefinition mass_push_edges_splitted :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"mass_push_edges_splitted G \\\n \\ (\\e \\ epda_delta G. F_DPDA_RMPUE__edge_if e)\"\n\ndefinition mass_push_edges_splitted_ALT :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"mass_push_edges_splitted_ALT G \\\n \\ (\\e \\ epda_delta G. length (edge_push e) > 2)\"\n\nlemma mass_push_edges_splitted_ALT_vs_mass_push_edges_splitted: \"\n mass_push_edges_splitted_ALT G = mass_push_edges_splitted G\"\n apply(simp add: F_DPDA_RMPUE__edge_if_def mass_push_edges_splitted_ALT_def mass_push_edges_splitted_def)\n apply(force)\n done\n\ndefinition F_DPDA_RMPUE__edge_else__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\"\n where\n \"F_DPDA_RMPUE__edge_else__RL e \\\n \\edge_src = case edge_src e of cons_state_or_edge_nat_old q \\ q,\n edge_event = edge_event e,\n edge_pop = edge_pop e,\n edge_push = edge_push e,\n edge_trg = case edge_trg e of cons_state_or_edge_nat_old q \\ q\\\"\n\ndefinition F_DPDA_RMPUE__edge_then_i_th__LR :: \"\n ('state, 'event, 'stack) epda_step_label\n \\ nat\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label option\"\n where\n \"F_DPDA_RMPUE__edge_then_i_th__LR e i \\\n if i = 0\n then None\n else Some \\edge_src = the (F_DPDA_RMPUE__state e (i - Suc 0)),\n edge_event = None,\n edge_pop = [(rev (edge_push e)) ! (i-Suc 0)],\n edge_push = [(rev (edge_push e)) !i] @ [(rev (edge_push e)) ! (i-Suc 0)],\n edge_trg = the (F_DPDA_RMPUE__state e i)\\\"\n\ndefinition F_DPDA_RMPUE__conf_i_th__LR :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epda_step_label\n \\ nat\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf option\"\n where\n \"F_DPDA_RMPUE__conf_i_th__LR c e i \\\n if iepdaS_conf_state = the (F_DPDA_RMPUE__state e i),\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack =\n (if i = 0\n then edge_pop e\n else drop (length (edge_push e) - (Suc i)) (edge_push e))\n @ tl (epdaS_conf_stack c)\\\n else None\"\n\ndefinition F_DPDA_RMPUE__conf_old__LR :: \"\n ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RMPUE__conf_old__LR c \\\n \\epdaS_conf_state = cons_state_or_edge_nat_old (epdaS_conf_state c),\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\"\n\ndefinition F_DPDA_RMPUE__conf_old__LR_rev :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RMPUE__conf_old__LR_rev c \\\n case epdaS_conf_state c of cons_state_or_edge_nat_old q\n \\ \\epdaS_conf_state = q,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\n | cons_state_or_edge_nat_new e n\n \\ \\epdaS_conf_state = edge_trg e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = take (length (edge_push e) - Suc n) (edge_push e) @ epdaS_conf_stack c\\\"\n\nlemma F_DPDA_RMPUE__preserves_epda: \"\n valid_dpda G\n \\ valid_epda (F_DPDA_RMPUE G)\"\n apply(simp add: valid_epda_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rule finite_imageI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(rule finite_imageI)\n apply (metis finite_less_ub le_SucI le_refl)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp only: F_DPDA_RMPUE__edge_then_def)\n apply(rule finite_big_union2)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n s=\"(\\m. \\n\\ N. n < m)\" for N\n in ssubst)\n apply(rename_tac x)(*strict*)\n apply(rule finite_nat_set_iff_bounded)\n apply(rename_tac x)(*strict*)\n apply(rule_tac\n x=\"length(edge_push x)\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule conjI)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(blast)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G xa\")\n apply(rename_tac xa)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac xa)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G xa\")\n apply(rename_tac x xa)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"xa\"\n in ballE)\n apply(rename_tac xa xb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(subgoal_tac \"cons_state_or_edge_nat_new xa xb \\ (\\i. the (if i = 0 then Some (cons_state_or_edge_nat_old (edge_src xa)) else if Suc i < length (edge_push xa) then Some (cons_state_or_edge_nat_new xa i) else if Suc i = length (edge_push xa) then Some (cons_state_or_edge_nat_old (edge_trg xa)) else None)) ` {i. Suc i \\ length (edge_push xa)}\")\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule inMap)\n apply(rule_tac\n x=\"xb\"\n in bexI)\n apply(rename_tac xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G. the (F_DPDA_RMPUE__state xa (Suc xb)) \\ (\\i. the (F_DPDA_RMPUE__state x i)) ` {i. Suc i \\ length (edge_push x)})\")\n apply(rename_tac xa xb)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"xa\"\n in bexI)\n apply(rename_tac xa xb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule inMap)\n apply(rule_tac\n x=\"Suc xb\"\n in bexI)\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: suffix_def option_to_set_def)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(subgoal_tac \"set(edge_push xa)\\ epda_gamma G\")\n apply(rename_tac xa xb)(*strict*)\n prefer 2\n apply(rule valid_epda_push_in_gamma)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac xa xb)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(case_tac \"rev (edge_push xa) ! xb = epda_box G\")\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n A=\"set (edge_push xa)\"\n in set_mp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(case_tac \"rev (edge_push xa) ! xb = epda_box G\")\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"[rev (edge_push xa) ! Suc xb]\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule_tac\n A=\"set (edge_push xa)\"\n in set_mp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(erule_tac\n P=\"edge_push xa = aa @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"rev aa ! xb \\ set aa\")\n apply(rename_tac xa xb a aa)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa xb a)(*strict*)\n apply(subgoal_tac \"rev (edge_push xa) ! Suc xb \\ set(edge_push xa)\")\n apply(rename_tac xa xb a)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule_tac\n A=\"set (edge_push xa)\"\n in set_mp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(erule_tac\n P=\"edge_push xa = aa @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"rev aa ! xb \\ set aa\")\n apply(rename_tac xa xb a aa)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa xb a)(*strict*)\n apply(subgoal_tac \"rev (edge_push xa) ! Suc xb \\ set(edge_push xa)\")\n apply(rename_tac xa xb a)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule_tac\n A=\"set (edge_push xa)\"\n in set_mp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac xa xb)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def kleene_star_def append_language_def F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule_tac\n A=\"set (edge_push xa)\"\n in set_mp)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(erule_tac\n P=\"edge_push xa = aa @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa xb a aa ab)(*strict*)\n apply(subgoal_tac \"rev aa ! xb \\ set aa\")\n apply(rename_tac xa xb a aa ab)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a aa ab)(*strict*)\n apply(force)\n apply(rename_tac xa xb a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa xb a)(*strict*)\n apply(subgoal_tac \"rev (edge_push xa) ! Suc xb \\ set(edge_push xa)\")\n apply(rename_tac xa xb a)(*strict*)\n prefer 2\n apply(rule rev_nth_in_set)\n apply(force)\n apply(rename_tac xa xb a)(*strict*)\n apply(force)\n apply(rename_tac xa xb)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def kleene_star_def append_language_def F_DPDA_RMPUE__edge_if_def)\n done\n\nlemma F_DPDA_RMPUE__preserves_PDA: \"\n valid_dpda G\n \\ valid_pda (F_DPDA_RMPUE G)\"\n apply(simp add: valid_pda_def)\n apply(rule conjI)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: valid_epda_def valid_pda_def valid_dpda_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n done\n\ntheorem F_DPDA_RMPUE__preserves_read_edges_seperated: \"\n valid_dpda G\n \\ read_edges_seperated G\n \\ read_edges_seperated (F_DPDA_RMPUE G)\"\n apply(simp add: read_edges_seperated_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def FB_executing_edge_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(simp add: FB_executing_edge_def)\n apply(clarsimp)\n apply(rename_tac x y)(*strict*)\n apply(simp add: strict_executing_edge_def F_DPDA_SEE__edge_else_def FB_executing_edge_def empty_push_edge_def multiple_push_edge_def)\n done\n\ntheorem F_DPDA_RMPUE__preserves_neutral_edges_removed: \"\n valid_dpda G\n \\ neutral_edges_removed G\n \\ neutral_edges_removed (F_DPDA_RMPUE G)\"\n apply(simp add: neutral_edges_removed_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"edge_pop x \\ []\")\n apply(rename_tac x)(*strict*)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac xa xb)(*strict*)\n apply(simp add: FB_neutral_edge_def)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def FB_neutral_edge_def)\n apply(clarsimp)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(force)\n done\n\ntheorem F_DPDA_RMPUE__preserves_push_and_pop_edges_seperated: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ push_and_pop_edges_seperated (F_DPDA_RMPUE G)\"\n apply(simp add: push_and_pop_edges_seperated_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: FB_neutral_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac x w b)(*strict*)\n apply(force)\n done\n\ntheorem F_DPDA_RMPUE__produces_mass_push_edges_splitted: \"\n valid_dpda G\n \\ mass_push_edges_splitted (F_DPDA_RMPUE G)\"\n apply(simp add: mass_push_edges_splitted_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__edge_then_def)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__edge_else_def)\n done\n\ntheorem F_DPDA_RMPUE__preserves_pop_edges_seperated: \"\n valid_dpda G\n \\ pop_edges_seperated G\n \\ pop_edges_seperated (F_DPDA_RMPUE G)\"\n apply(simp add: pop_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: FB_neutral_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: strict_empty_push_edge_def empty_push_edge_def)\n apply(rename_tac e)(*strict*)\n apply(simp add: strict_empty_push_edge_def empty_push_edge_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def F_DPDA_SPPE__edge_if_def)\n done\n\nlemma bexE_image_disj: \"\n \\X \\ (f1 ` A) \\ (f2 ` B). P X\n \\ ((\\X \\ f1 ` A. P X) \\ Q)\n \\ ((\\X \\ f2 ` B. P X) \\ Q)\n \\ Q\"\n apply(force)\n done\n\ntheorem F_DPDA_RMPUE__produces_push_edges_seperated: \"\n valid_dpda G\n \\ valid_pda (F_DPDA_RMPUE G)\n \\ read_edges_seperated (F_DPDA_RMPUE G)\n \\ mass_push_edges_splitted (F_DPDA_RMPUE G)\n \\ push_and_pop_edges_seperated (F_DPDA_RMPUE G)\n \\ push_edges_seperated (F_DPDA_RMPUE G)\"\n apply(simp add: push_and_pop_edges_seperated_def mass_push_edges_splitted_def F_DPDA_RMPUE__edge_if_def push_edges_seperated_def read_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(erule_tac\n x=\"e\"\n and P=\"\\e. FB_executing_edge e \\ strict_executing_edge e\"\n in ballE)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(erule_tac\n x=\"e\"\n and P=\"\\e. \\ Suc (Suc 0) < length (edge_push e)\"\n in ballE)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(simp add: multiple_push_edge_def)\n apply(subgoal_tac \"length (edge_push e) = Suc (Suc 0)\")\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (edge_pop e) = Suc 0\")\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(simp add: valid_pda_def)\n apply(rename_tac e)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label (F_DPDA_RMPUE G) e\")\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def valid_pda_def)\n apply(rename_tac e)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: strict_multiple_push_edge_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(case_tac \"edge_event e\")\n apply(rename_tac e)(*strict*)\n apply(force)\n apply(rename_tac e a)(*strict*)\n apply(simp add: FB_executing_edge_def)\n apply(simp add: strict_executing_edge_def)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule bexE_image_disj)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: FB_neutral_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(erule_tac\n P=\"\\y. edge_event x = Some y\"\n in disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(case_tac \"edge_push x\")\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push x = w' @ [x']\")\n apply(rename_tac x a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac x a list)(*strict*)\n apply(thin_tac \"edge_push x= a # list\")\n apply(clarsimp)\n apply(rename_tac x w' x')(*strict*)\n apply(simp add: suffix_def)\n done\n\ndefinition F_DPDA_RMPUE__relation_structure__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_structure__LR G1 G2 \\\n valid_dpda G1\n \\ G2 = F_DPDA_RMPUE G1\n \\ push_and_pop_edges_seperated G1\n \\ read_edges_seperated G1\"\n\ndefinition F_DPDA_RMPUE__relation_configuration__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR c1\"\n\ndefinition F_DPDA_RMPUE__relation_initial_configuration__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR c1\"\n\ndefinition F_DPDA_RMPUE__relation_effect__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_effect__LR G1 G2 w1 w2 \\\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ w1 = w2\"\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RMPUE__relation_structure__LR G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ valid_epda G2)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply (metis F_DPDA_RMPUE__preserves_epda)\n done\n\ndefinition F_DPDA_RMPUE__relation_step_simulation__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ((('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label, (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e c1' c2 d \\\n if F_DPDA_RMPUE__edge_if e\n then d = (\\n.\n if n < length (edge_push e)\n then Some (pair (F_DPDA_RMPUE__edge_then_i_th__LR e n) (the (F_DPDA_RMPUE__conf_i_th__LR (F_DPDA_RMPUE__conf_old__LR c1) e n)))\n else None)\n else d = der2\n (F_DPDA_RMPUE__conf_old__LR c1)\n (F_DPDA_RMPUE__edge_else e)\n (F_DPDA_RMPUE__conf_old__LR c1')\"\n\ndefinition F_DPDA_RMPUE__relation_initial_simulation__LR :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ ((('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label, (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_simulation__LR G1 G2 c1 d \\\n d = der1 (F_DPDA_RMPUE__conf_old__LR c1)\"\n\nlemma F_DPDA_RMPUE__conf_old__LR_preserves_configurations: \"\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR c1 \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_preserves_initial_configurations: \"\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_preserves_marking_configurations: \"\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_marking_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR c1 \\ epdaS_marking_configurations G2\"\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__initial_simulation_preserves_derivation: \"\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ epdaS.derivation_initial G2 (der1 (F_DPDA_RMPUE__conf_old__LR c1))\"\n apply(rule epdaS.derivation_initialI)\n apply(rule epdaS.der1_is_derivation)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(clarsimp)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_initial_configurations)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation: \"\n \\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RMPUE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 (the (get_configuration (d2 n))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_initial_simulation__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule F_DPDA_RMPUE__initial_simulation_preserves_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_initial_configuration__LR_def)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def valid_pda_def valid_dpda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__relation_step_simulation__LR_maps_to_derivation: \"\n F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(clarsimp)\n apply(simp add: epdaS.derivation_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(rule conjI)\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_i_th__LR_def)\n apply(rename_tac i nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_i_th__LR_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__edge_else_def F_DPDA_RMPUE__edge_then_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(rename_tac nat w)(*strict*)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI1)\n apply(force)\n apply(force)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI2)\n apply(force)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac nat w)(*strict*)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(simp only: F_DPDA_RMPUE__conf_i_th__LR_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(simp only: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(simp only: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(simp only: F_DPDA_RMPUE__conf_i_th__LR_def)\n apply(clarsimp)\n apply(simp only: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (Suc nat)=length(edge_push e1)\")\n apply(rename_tac nat w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(simp only: F_DPDA_RMPUE__conf_i_th__LR_def)\n apply(clarsimp)\n apply(simp only: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac nat w)(*strict*)\n apply(rule conjI)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_i_th__LR_def option_to_list_def)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_i_th__LR_def option_to_list_def F_DPDA_RMPUE__conf_old__LR_def)\n apply(subgoal_tac \"valid_epda_step_label G1 e1\")\n apply(rename_tac nat w)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac nat w)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(subgoal_tac \"length (edge_pop e1) = Suc 0\")\n apply(rename_tac nat w)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\x. edge_pop e1 = [x]\")\n apply(rename_tac nat w)(*strict*)\n prefer 2\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac nat w)(*strict*)\n apply(force)\n apply(rename_tac nat w a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac nat w a list)(*strict*)\n apply(force)\n apply(rename_tac nat w a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat w x)(*strict*)\n apply(case_tac nat)\n apply(rename_tac nat w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac w x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w x)(*strict*)\n apply(simp add: suffix_def)\n apply(erule disjE)\n apply(rename_tac w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x y)(*strict*)\n apply(simp add: read_edges_seperated_def)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac w x y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w x y)(*strict*)\n apply(simp add: FB_executing_edge_def)\n apply(simp add: strict_executing_edge_def)\n apply(rename_tac w x)(*strict*)\n apply(case_tac \"edge_push e1\")\n apply(rename_tac w x)(*strict*)\n apply(force)\n apply(rename_tac w x a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push e1 = w' @ [x']\")\n apply(rename_tac w x a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w x a list)(*strict*)\n apply(thin_tac \"edge_push e1= a # list\")\n apply(clarify)\n apply(rename_tac w x a list w' x')(*strict*)\n apply(erule_tac\n x=\"w'\"\n in allE)\n apply(erule_tac\n x=\"x'\"\n in allE)\n apply(clarsimp)\n apply(rename_tac w w' x')(*strict*)\n apply(rule last_drop_rev_nth)\n apply(force)\n apply(rename_tac nat w x nata)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac w x nata)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"rev (edge_push e1) ! (Suc nata)\"\n and s=\"drop (length (edge_push e1) - (Suc (Suc nata))) (edge_push e1) ! 0\"\n in ssubst)\n apply(rename_tac w x nata)(*strict*)\n apply(rule rev_drop_nth)\n apply(force)\n apply(rename_tac w x nata)(*strict*)\n apply(rule_tac\n x=\"tl(drop (length (edge_push e1) - Suc (Suc nata)) (edge_push e1))@w\"\n in exI)\n apply(case_tac \"drop (length (edge_push e1) - Suc (Suc nata)) (edge_push e1)\")\n apply(rename_tac w x nata)(*strict*)\n apply(force)\n apply(rename_tac w x nata a list)(*strict*)\n apply(rule conjI)\n apply(rename_tac w x nata a list)(*strict*)\n apply(force)\n apply(rename_tac w x nata a list)(*strict*)\n apply(rule_tac\n t=\"rev (edge_push e1) ! Suc (Suc nata)\"\n and s=\"drop (length (edge_push e1) - (Suc (Suc (Suc nata)))) (edge_push e1) ! 0\"\n in ssubst)\n apply(rename_tac w x nata a list)(*strict*)\n apply(rule rev_drop_nth)\n apply(force)\n apply(rename_tac w x nata a list)(*strict*)\n apply(case_tac \"drop (length (edge_push e1) - Suc (Suc (Suc nata))) (edge_push e1)\")\n apply(rename_tac w x nata a list)(*strict*)\n apply(force)\n apply(rename_tac w x nata a list aa lista)(*strict*)\n apply(rule drop_nth_tl_double_head)\n apply(clarsimp)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def F_DPDA_RMPUE__relation_structure__LR_def F_DPDA_RMPUE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI2)\n apply(force)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n done\n\nlemma F_DPDA_RMPUE__conf_i_th__LR_F_DPDA_RMPUE__conf_old__LR_preserve_configuration: \"\n valid_dpda G1\n \\ c1 \\ epdaS_configurations G1\n \\ epdaS_conf_stack c1 \\ must_terminated_by (epda_gamma G1) (epda_box G1)\n \\ F_DPDA_RMPUE__edge_if e1\n \\ e1 \\ epda_delta G1\n \\ the (F_DPDA_RMPUE__conf_i_th__LR (F_DPDA_RMPUE__conf_old__LR c1) e1 0) \\ epdaS_configurations (F_DPDA_RMPUE G1)\"\n apply(simp add: epdaS_configurations_def F_DPDA_RMPUE__conf_i_th__LR_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(rule conjI)\n apply(rename_tac q i s)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def)\n apply(subgoal_tac \"valid_epda_step_label G1 e1\")\n apply(rename_tac q i s)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(rename_tac q i s)(*strict*)\n apply(rule valid_epda_pop_in_gamma)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: must_terminated_by_def may_terminated_by_def kleene_star_def append_language_def F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac q i x a aa ab)(*strict*)\n apply(case_tac a)\n apply(rename_tac q i x a aa ab)(*strict*)\n apply(clarsimp)\n apply(rename_tac q i x a aa ab ac list)(*strict*)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__LR_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.derivation_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_i_th__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(rule F_DPDA_RMPUE__conf_i_th__LR_F_DPDA_RMPUE__conf_old__LR_preserve_configuration)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule set_mp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule epda_stack_is_must_terminated_by)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RMPUE__relation_structure__LR_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: get_configuration_def F_DPDA_RMPUE__conf_i_th__LR_def F_DPDA_RMPUE__relation_configuration__LR_def F_DPDA_RMPUE__conf_old__LR_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e1 = [x]\")\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"length(edge_push e1)-Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp only: maximum_of_domain_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__conf_i_th__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(simp add: read_edges_seperated_def push_and_pop_edges_seperated_def)\n apply(erule_tac\n x=\"e1\"\n and P=\"\\e1. \\ F_DPDA_SPPE__edge_if e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_event e1\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(clarsimp)\n apply(simp add: FB_executing_edge_def)\n apply(simp add: strict_executing_edge_def empty_push_edge_def multiple_push_edge_def F_DPDA_SPPE__edge_if_def F_DPDA_RMPUE__edge_if_def)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(subgoal_tac \"\\x. edge_pop e1=[x]\")\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__LR_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis (full_types) epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: get_configuration_def der2_def F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp (no_asm) add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_configuration__LR F_DPDA_RMPUE__relation_structure__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimLR\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LR\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation_marking_condition: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(subgoal_tac \"c=c1'\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_def)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc deri1n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n apply(rule_tac\n x=\"deri2n+n\"\n in exI)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR c1'\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i-deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RMPUE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der1_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_configuration__LR F_DPDA_RMPUE__relation_structure__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation_marking_condition)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RMPUE__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RMPUE__relation_initial_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation_marked_effect: \"\n \\G1 G2. F_DPDA_RMPUE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RMPUE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RMPUE__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__LR_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RMPUE__relation_initial_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_initial_configuration__LR F_DPDA_RMPUE__relation_effect__LR F_DPDA_RMPUE__relation_structure__LR F_DPDA_RMPUE__relation_initial_simulation__LR F_DPDA_RMPUE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimLR_inst_relation_step_simulation_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimLR_inst_relation_initial_simulation_marked_effect)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimLR\" : ATS_Simulation_Configuration_Weak_Marked_Effect\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LR\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms )\n done\n\nlemma F_DPDA_RMPUE__preserves_lang1: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ epdaS.marked_language G \\ epdaS.marked_language (F_DPDA_RMPUE G)\"\n apply(rule_tac\n t=\"epdaS.marked_language G\"\n and s=\"epdaS.finite_marked_language G\"\n in subst)\n apply (rule epdaS.AX_marked_language_finite)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaS.marked_language (F_DPDA_RMPUE G)\"\n and s=\"epdaS.finite_marked_language (F_DPDA_RMPUE G)\"\n in ssubst)\n apply(rule sym)\n apply(rule epdaS.AX_marked_language_finite)\n apply (rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(subgoal_tac \"left_total_on (F_DPDA_RMPUE__relation_effect__LR SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_epdaS_RMP_StateSimLR.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n prefer 2\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__LR_def)\n done\n\ndefinition F_DPDA_RMPUE__relation_TSstructure__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\\n valid_dpda G2\n \\ G1 = F_DPDA_RMPUE G2\n \\ push_and_pop_edges_seperated G2\n \\ read_edges_seperated G2\"\n\ndefinition F_DPDA_RMPUE__relation_configuration__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR_rev c1\"\n\ndefinition F_DPDA_RMPUE__relation_initial_configuration__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR_rev c1\"\n\ndefinition F_DPDA_RMPUE__relation_effect__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_effect__RL G1 G2 w1 w2 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ w1 = w2\"\n\ndefinition F_DPDA_RMPUE__relation_step_simulation__LRRL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event , 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event , 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 c1 e c1' c2 d \\\n case edge_trg e of cons_state_or_edge_nat_old q\n \\ (case edge_src e of cons_state_or_edge_nat_old q\n \\ d = der2\n (F_DPDA_RMPUE__conf_old__LR_rev c1)\n (F_DPDA_RMPUE__edge_else__RL e)\n (F_DPDA_RMPUE__conf_old__LR_rev c1')\n | cons_state_or_edge_nat_new e' n\n \\ d = der1 (F_DPDA_RMPUE__conf_old__LR_rev c1))\n | cons_state_or_edge_nat_new e' n\n \\ (case edge_src e of cons_state_or_edge_nat_old q\n \\ d = der2\n (F_DPDA_RMPUE__conf_old__LR_rev c1)\n e'\n (F_DPDA_RMPUE__conf_old__LR_rev c1')\n | cons_state_or_edge_nat_new e' n\n \\ d = der1 (F_DPDA_RMPUE__conf_old__LR_rev c1))\"\n\ndefinition F_DPDA_RMPUE__relation_initial_simulation__LRRL :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event , 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ (('state, 'event , 'stack) epda_step_label, ('state, 'event , 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_simulation__LRRL G1 G2 c1 d \\\n d = der1 (F_DPDA_RMPUE__conf_old__LR_rev c1)\"\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR_rev c1 \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(case_tac q)\n apply(rename_tac q i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s qa x ia)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(case_tac ia)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(case_tac \"Suc (Suc nat) < length (edge_push x)\")\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac q i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac ia)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(case_tac \"Suc (Suc nata) < length (edge_push x)\")\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x nata)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s x nata)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rule_tac\n B=\"set (edge_push x)\"\n in subset_trans)\n apply(rename_tac i s x nata)(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac i s x nata)(*strict*)\n apply(rule valid_epda_push_in_gamma)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_preserves_initial_configurations: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR_rev c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RMPUE__relation_initial_simulation__LRRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_initial_simulation__LRRL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_initial_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RMPUE__relation_initial_configuration__RL_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__relation_step_simulation__LRRL_maps_to_derivation: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LRRL_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac q qa)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE__edge_else__RL_def)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac q qa w x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac xa)\n apply(rename_tac q qa w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac q qa w x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(thin_tac \" c1 \\ epdaS.get_accessible_configurations (F_DPDA_RMPUE G2)\")\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(case_tac x)\n apply(rename_tac w x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(rename_tac epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat q w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations (F_DPDA_RMPUE G2)\")\n apply(rename_tac epda_step_label_ext nat q w)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac epda_step_label_ext nat q w)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat q w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac epda_step_label_ext nat q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat q w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rename_tac epda_step_label_exta nat q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat q w x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac epda_step_label_ext nat q w x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac epda_step_label_ext nat q w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext q w xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac epda_step_label_ext q w xa)(*strict*)\n prefer 2\n apply(rename_tac epda_step_label_ext q w xa nat)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext q w xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w)(*strict*)\n apply(rename_tac e w)\n apply(rename_tac e w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: read_edges_seperated_def)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w)(*strict*)\n apply(case_tac \"edge_event e\")\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(rename_tac e w a)(*strict*)\n apply(clarsimp)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac e w)(*strict*)\n apply(clarsimp)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def)\n apply(simp add: push_and_pop_edges_seperated_def)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w)(*strict*)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(subgoal_tac \"\\x. edge_pop e=[x]\")\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n and P=\"\\e. valid_epda_step_label G2 e\"\n in ballE)\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w)(*strict*)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w)(*strict*)\n apply(case_tac \"edge_pop e\")\n apply(rename_tac e w)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w x)(*strict*)\n apply(case_tac \"edge_push e\")\n apply(rename_tac e w x)(*strict*)\n apply(force)\n apply(rename_tac e w x a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push e = w' @ [x']\")\n apply(rename_tac e w x a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac e w x a list)(*strict*)\n apply(thin_tac \"edge_push e= a # list\")\n apply(clarsimp)\n apply(rename_tac e w w' x')(*strict*)\n apply (metis One_nat_def append_take_drop_id last_drop_rev_nth length_0_conv less_zeroE)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_step_relation_step_simulation: \"\n \\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LRRL_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__LRRL_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LRRL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RMPUE__relation_structure__LR_def F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations G1\")\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext nat w)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def epda_step_labels_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext nat w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_exta nat w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' q epda_step_label_ext nat w x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G2 c1 c1' q epda_step_label_ext nat w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' q epda_step_label_ext nat w x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"Suc (Suc nat) = length (edge_push epda_step_label_ext)\")\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat w)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat w nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_ext w nata)(*strict*)\n apply(rule take_nth_rev)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' q epda_step_label_ext nat w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__LRRL_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LRRL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.der2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def epda_step_labels_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_exta nat q x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac xa)\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_exta nat q x xa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.AX_step_relation_preserves_belongsC)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp (no_asm) add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rename_tac e1 n e2 m)\n apply(rename_tac G1 G2 c1 c2 e1a c1' e1 n e2 m)(*strict*)\n apply(subgoal_tac \"e1=e2 \\ n=Suc m\")\n apply(rename_tac G1 G2 c1 c2 e1a c1' e1 n e2 m)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1a c1' e1 n e2 m)(*strict*)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations G1\")\n apply(rename_tac G1 G2 c1 e1a c1' e1 n e2 m)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e1 n e2 m)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1a c1' e1 n e2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e1 n e2 m x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e1 n e2 m x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G2 c1 c1' e1 n e2 m x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e1 n e2 m x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e1 e2 m xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac G2 c1 c1' e1 e2 m xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e1 e2 m xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e1 n e2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e1 n e2 m x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1a c1' e1 n e2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1a c1' e2 m)(*strict*)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations G1\")\n apply(rename_tac G1 G2 c1 e1a c1' e2 m)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp only: epdaS_step_relation_def)\n apply(subgoal_tac \"\\epdaS_conf_state = edge_trg e2, epdaS_conf_scheduler = option_to_list (edge_event e1a) @ epdaS_conf_scheduler c1', epdaS_conf_stack = take (length (edge_push e2) - Suc m) (edge_push e2) @ epdaS_conf_stack c1\\ = \\epdaS_conf_state = edge_trg e2, epdaS_conf_scheduler = epdaS_conf_scheduler c1', epdaS_conf_stack = take (length (edge_push e2) - Suc (Suc m)) (edge_push e2) @ epdaS_conf_stack c1'\\\")\n apply(rename_tac G2 c1 e1a c1' e2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m)(*strict*)\n apply(subgoal_tac \"\\x y. edge_pop e1a = [x] \\ edge_push e1a = [y,x]\")\n apply(rename_tac G2 c1 e1a c1' e2 m)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m w)(*strict*)\n apply(simp add: epda_step_labels_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1a c1' e2 m w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 m w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G2 c1 e1a c1' e2 m)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: F_DPDA_RMPUE_def epda_step_labels_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n prefer 2\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 m x y w xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def epda_step_labels_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n prefer 2\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 m x y w xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1a c1' e2 m x y w xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 m w xa xb)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac xb)\n apply(rename_tac G2 c1 c1' e2 m w xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 m w xa xb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' e2 w nat)(*strict*)\n apply(case_tac \"Suc (Suc (Suc nat)) < length (edge_push e2)\")\n apply(rename_tac G2 c1 c1' e2 w nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' e2 w nat)(*strict*)\n apply(clarsimp)\n apply(rule take_rev_append_nth)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RMPUE__relation_TSstructure__RL G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply (metis F_DPDA_RMPUE__preserves_epda)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ valid_epda G2)\"\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply (metis valid_dpda_def valid_pda_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_configuration__RL F_DPDA_RMPUE__relation_TSstructure__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation epdaS_epdaS_RMP_StateSimRL_step_relation_step_simulation epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimRL\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__RL\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__RL\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_TSstructure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LRRL\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LRRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_preserves_marking_configurations: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS_marking_configurations G1\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR_rev c1 \\ epdaS_marking_configurations G2\"\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat)(*strict*)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_step_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR_rev ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n t=\"ca\"\n and s=\"the (get_configuration (derivation_append deri1 (der2 c1 e1 c1') deri1n i))\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(subgoal_tac \"c=c1'\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc deri1n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n apply(rule_tac\n x=\"deri2n+n\"\n in exI)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR_rev c1'\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(rule_tac\n x=\"derivation_append deri1 (der2 c1 e1 c1') deri1n \"\n in exI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply (rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply (metis epdaS.derivation_initial_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c option b)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n x=\"Suc deri1n\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i-deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RMPUE__relation_initial_simulation__LRRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RMPUE__conf_old__LR_rev ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der1_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_configuration__RL F_DPDA_RMPUE__relation_TSstructure__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimRL_inst_relation_step_simulation_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation_marking_condition)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_step_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RMPUE__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RMPUE__relation_initial_configuration__RL_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RMPUE__relation_initial_simulation__LRRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RMPUE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RMPUE__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__RL_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RMPUE__relation_initial_configuration__RL_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_DPDA_RMPUE__relation_configuration__RL F_DPDA_RMPUE__relation_initial_configuration__RL F_DPDA_RMPUE__relation_effect__RL F_DPDA_RMPUE__relation_TSstructure__RL F_DPDA_RMPUE__relation_initial_simulation__LRRL F_DPDA_RMPUE__relation_step_simulation__LRRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimRL_inst_relation_step_simulation_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RMP_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RMP_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulation_marked_effect)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimRL\" : ATS_Simulation_Configuration_Weak_Marked_Effect\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__RL\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__RL\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_TSstructure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LRRL\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LRRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms)\n done\n\nlemma F_DPDA_RMPUE__preserves_lang2: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ epdaS.marked_language G \\ epdaS.marked_language (F_DPDA_RMPUE G)\"\n apply(rule_tac\n t=\"epdaS.marked_language G\"\n and s=\"epdaS.finite_marked_language G\"\n in subst)\n apply (rule epdaS.AX_marked_language_finite)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaS.marked_language (F_DPDA_RMPUE G)\"\n and s=\"epdaS.finite_marked_language (F_DPDA_RMPUE G)\"\n in ssubst)\n apply(rule sym)\n apply(rule epdaS.AX_marked_language_finite)\n apply (rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(subgoal_tac \"left_total_on (F_DPDA_RMPUE__relation_effect__RL SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule_tac\n ?G2.0=\"G\"\n in epdaS_epdaS_RMP_StateSimRL.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_effect__RL_def)\n done\n\ntheorem F_DPDA_RMPUE__preserves_lang: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ epdaS.marked_language G = epdaS.marked_language (F_DPDA_RMPUE G)\"\n apply(rule order_antisym)\n apply (metis F_DPDA_RMPUE__preserves_lang1)\n apply (metis F_DPDA_RMPUE__preserves_lang2)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_reflects_steps_OO: \"\n x \\ epda_delta G\n \\ epdaS_step_relation (F_DPDA_RMPUE G) c (F_DPDA_RMPUE__edge_else x) c1\n \\ epdaS_step_relation G (F_DPDA_RMPUE__conf_old__LR_rev c) x (F_DPDA_RMPUE__conf_old__LR_rev c1)\"\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def F_DPDA_RMPUE__edge_else_def)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations2: \"\n valid_dpda G2\n \\ c1' \\ epdaS_configurations (F_DPDA_RMPUE G2)\n \\ F_DPDA_RMPUE__conf_old__LR_rev c1' \\ epdaS_configurations G2\"\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(case_tac q)\n apply(rename_tac q i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s qa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac ia)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac i s x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s qa x ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(case_tac \"Suc (Suc nat) < length (edge_push x)\")\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x nat)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s x nat)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac i s x nat)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac ia)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(case_tac \"Suc (Suc nata) < length (edge_push x)\")\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x nata)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s x nata)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(rule conjI)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(rule_tac\n B=\"set (edge_push x)\"\n in subset_trans)\n apply(rename_tac i s x nata)(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac i s x nata)(*strict*)\n apply(rule valid_epda_push_in_gamma)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_rev_preserves_steps_ON: \"\n e1 \\ epda_delta (F_DPDA_RMPUE G2)\n \\ epdaS_step_relation (F_DPDA_RMPUE G2) c1' e1 c1\n \\ valid_dpda G2\n \\ push_and_pop_edges_seperated G2\n \\ read_edges_seperated G2\n \\ edge_trg e1 = cons_state_or_edge_nat_new e n\n \\ edge_src e1 = cons_state_or_edge_nat_old q\n \\ epdaS_step_relation G2 (F_DPDA_RMPUE__conf_old__LR_rev c1') e (F_DPDA_RMPUE__conf_old__LR_rev c1)\"\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(subgoal_tac \"n=Suc 0\")\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(erule disjE)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac w x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n prefer 2\n apply(rename_tac w x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac w x xa)(*strict*)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac w x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp add: option_to_list_def)\n apply(case_tac \"edge_event e\")\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(rename_tac w a)(*strict*)\n apply(clarsimp)\n apply(simp add: push_and_pop_edges_seperated_def read_edges_seperated_def)\n apply(erule_tac\n x=\"e\"\n and P=\"\\e. \\ F_DPDA_SPPE__edge_if e\"\n in ballE)\n apply(rename_tac w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w a)(*strict*)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w a)(*strict*)\n apply(simp add: strict_executing_edge_def F_DPDA_SPPE__edge_if_def empty_push_edge_def multiple_push_edge_def FB_executing_edge_def)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(subgoal_tac \"\\x. edge_pop e=[x]\")\n apply(rename_tac w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac w a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(simp add: push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(erule_tac\n x=\"e\"\n in ballE)\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(case_tac \"edge_push e\")\n apply(rename_tac w)(*strict*)\n apply(force)\n apply(rename_tac w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push e = w' @ [x']\")\n apply(rename_tac w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac w a list)(*strict*)\n apply(thin_tac \"edge_push e= a # list\")\n apply(clarsimp)\n apply(rename_tac w w' x')(*strict*)\n apply (metis Suc_length Suc_lessD butn_def hd_conv_nth hd_rev length_0_conv length_drop length_rotate1 not_Cons_self nth_drop_0 rotate_simps take_1_rev take_eq_Nil take_last list.sel(2))\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n done\n\nlemma F_DPDA_RMPUE__state_injective: \"\n the (F_DPDA_RMPUE__state xa x) = the (F_DPDA_RMPUE__state xa xb)\n \\ Suc x < length (edge_push xa)\n \\ Suc xb < length (edge_push xa)\n \\ x = xb\"\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac x)\n apply(clarsimp)\n apply(case_tac xb)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(case_tac xb)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma RMP_edge_pop_is_single: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ x \\ epda_delta G\n \\ F_DPDA_RMPUE__edge_if x\n \\ \\y. edge_pop x = [y]\"\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_pop x\")\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(case_tac \"list\")\n apply(rename_tac a list)(*strict*)\n prefer 2\n apply(rename_tac a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma RMP_edge_event_is_none: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ x \\ epda_delta G\n \\ F_DPDA_RMPUE__edge_if x\n \\ edge_event x = None\"\n apply(simp add: F_DPDA_RMPUE__edge_if_def read_edges_seperated_def push_and_pop_edges_seperated_def)\n apply(simp add: FB_executing_edge_def empty_push_edge_def multiple_push_edge_def F_DPDA_SPPE__edge_if_def)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. (\\y. edge_event x = Some y) \\ (\\w b. edge_push x = w @ [b] \\ edge_pop x = [b])\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_push x\")\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push x = w' @ [x']\")\n apply(rename_tac a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(thin_tac \"edge_push x= a # list\")\n apply(clarsimp)\n apply(rename_tac w' x')(*strict*)\n apply(case_tac \"edge_event x\")\n apply(rename_tac w' x')(*strict*)\n apply(force)\n apply(rename_tac w' x' a)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_executing_edge_def)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac w' x' a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w' x' a)(*strict*)\n apply(case_tac \"edge_pop x\")\n apply(rename_tac w' x' a)(*strict*)\n apply(force)\n apply(rename_tac w' x' a aa list)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__edge_then_not_between_OO: \"\n edge_src e1 = cons_state_or_edge_nat_old q\n \\ edge_trg e1 = cons_state_or_edge_nat_old qa\n \\ e1 \\ F_DPDA_RMPUE__edge_then x\n \\ x \\ epda_delta G\n \\ F_DPDA_RMPUE__edge_if x\n \\ Q\"\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac xa)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(force)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac xa nat)(*strict*)\n apply(clarsimp)\n done\n\ntheorem F_DPDA_RMPUE__preserves_is_forward_edge_deterministic_accessible: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ epdaS.is_forward_edge_deterministic_accessible (F_DPDA_RMPUE G)\"\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e1 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e2 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e1)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 w wa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e2)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e1) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e2) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e1 \\ epda_delta (F_DPDA_RMPUE G)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e2 \\ epda_delta (F_DPDA_RMPUE G)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(erule_tac\n x=\"F_DPDA_RMPUE__conf_old__LR_rev c\"\n in ballE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x=\"F_DPDA_RMPUE__conf_old__LR_rev c1\"\n in allE)\n apply(erule_tac\n x=\"F_DPDA_RMPUE__conf_old__LR_rev c2\"\n in allE)\n apply(subgoal_tac \"(\\x\\ epda_delta G \\ Collect F_DPDA_RMPUE__edge_if. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G \\ {e. \\ F_DPDA_RMPUE__edge_if e}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G \\ Collect F_DPDA_RMPUE__edge_if. e2 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G \\ {e. \\ F_DPDA_RMPUE__edge_if e}. e2 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(subgoal_tac \"F_DPDA_RMPUE__conf_old__LR_rev c \\ epdaS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(thin_tac \"F_DPDA_RMPUE__conf_old__LR_rev c \\ epdaS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(rule_tac\n ?c1.0=\"c\"\n in epdaS_epdaS_RMP_StateSimRL.get_accessible_configurations_transfer)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply (metis F_DPDA_RMPUE__conf_old__LR_rev_preserves_configurations2 F_DPDA_RMPUE__preserves_epda epdaS.get_accessible_configurations_are_configurations2)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rename_tac c c1 c2 e1 e2 cA cB)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e1=edge_src e2\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac c c1 c2 e1 e2 q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac c c1 c2 e1 e2 q qa)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G \\ Collect F_DPDA_RMPUE__edge_if. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac c c1 c2 e1 e2 q qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(rule_tac\n q=\"q\"\n and ?e1.0=\"e1\"\n in F_DPDA_RMPUE__edge_then_not_between_OO)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q qa x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(subgoal_tac \"epdaS_step_relation G (F_DPDA_RMPUE__conf_old__LR_rev c) x (F_DPDA_RMPUE__conf_old__LR_rev c1)\")\n apply(rename_tac c c1 c2 e2 q qa x)(*strict*)\n prefer 2\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_reflects_steps_OO)\n apply(rename_tac c c1 c2 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_trg e2\")\n apply(rename_tac c c1 c2 e2 q qa x qb)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 q qa x qb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(rule_tac\n q=\"q\"\n and ?e1.0=\"e2\"\n in F_DPDA_RMPUE__edge_then_not_between_OO)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x qb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q qa x qb xa)(*strict*)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 q qa x qb xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 q qa x qb xa)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_reflects_steps_OO)\n apply(rename_tac c c1 c2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 q qa x qb xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x epda_step_label_ext nat)(*strict*)\n apply(rename_tac e n)\n apply(rename_tac c c1 c2 e2 q qa x e n)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 q qa x e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q qa e n xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q qa e n xa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q e n xa x w wa wb)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc x) < length (edge_push xa)\")\n apply(rename_tac c c1 c2 q e n xa x w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q e n xa x w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(rule_tac\n q=\"q\"\n in F_DPDA_RMPUE__conf_old__LR_rev_preserves_steps_ON)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 q qa x e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q qa x e n xa)(*strict*)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 q qa x e n xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 q qa x e n xa)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_reflects_steps_OO)\n apply(rename_tac c c1 c2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 q qa x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q epda_step_label_ext nat)(*strict*)\n apply(rename_tac e n)\n apply(rename_tac c c1 c2 e1 e2 q e n)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G \\ Collect F_DPDA_RMPUE__edge_if. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac c c1 c2 e1 e2 q e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(subgoal_tac \"epdaS_step_relation G (F_DPDA_RMPUE__conf_old__LR_rev c) e (F_DPDA_RMPUE__conf_old__LR_rev c1)\")\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n prefer 2\n apply(rule_tac\n q=\"q\"\n in F_DPDA_RMPUE__conf_old__LR_rev_preserves_steps_ON)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_trg e2\")\n apply(rename_tac c c1 c2 e1 e2 q e n x qa)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n apply(rule_tac\n q=\"q\"\n in F_DPDA_RMPUE__edge_then_not_between_OO)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 q e n x qa xa)(*strict*)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 e1 q e n x qa xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 q n x qa xa)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 q n x qa xa w wa wb)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__edge_else_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q n x xa w wa wb xb)(*strict*)\n apply(case_tac \"Suc (Suc xb) < length (edge_push x)\")\n apply(rename_tac c c1 c2 q n x xa w wa wb xb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 q n x xa w wa wb xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 q e n x qa xa)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_rev_reflects_steps_OO)\n apply(rename_tac c c1 c2 e1 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 q e n x qa xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q e n x epda_step_label_ext nat)(*strict*)\n apply(rename_tac e n)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(subgoal_tac \"epdaS_step_relation G (F_DPDA_RMPUE__conf_old__LR_rev c) e (F_DPDA_RMPUE__conf_old__LR_rev c2)\")\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n prefer 2\n apply(rule_tac\n q=\"q\"\n in F_DPDA_RMPUE__conf_old__LR_rev_preserves_steps_ON)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n apply(subgoal_tac \"F_DPDA_RMPUE__conf_old__LR_rev c1=F_DPDA_RMPUE__conf_old__LR_rev c2\")\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"n=Suc 0\")\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n prefer 2\n apply(thin_tac \"edge_trg e1 = cons_state_or_edge_nat_new e na\")\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(rename_tac c c1 c2 e1 e2 q x e n xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e n xa xb xc)(*strict*)\n apply(case_tac xc)\n apply(rename_tac c c1 c2 q x e n xa xb xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e n xa xb)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push xa)\")\n apply(rename_tac c c1 c2 q x e n xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e n xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e n xa xb xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e n xa xb nat)(*strict*)\n apply(case_tac \"Suc (Suc (Suc nat)) < length (edge_push xa)\")\n apply(rename_tac c c1 c2 q x e n xa xb nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 q x e n xa xb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q x e xb nat)(*strict*)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 q x e xb nat qa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 q x e xb nat epda_step_label_exta nata)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n apply(subgoal_tac \"na=Suc 0\")\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n prefer 2\n apply(thin_tac \"edge_trg e2 = cons_state_or_edge_nat_new e n\")\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q na x e xa xb xc)(*strict*)\n apply(case_tac xb)\n apply(rename_tac c c1 c2 q na x e xa xb xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q na x e xa xc)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac c c1 c2 q na x e xa xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q na x e xa xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q na x e xa xb xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q na x e xa xc nat)(*strict*)\n apply(case_tac \"Suc (Suc (Suc nat)) < length (edge_push x)\")\n apply(rename_tac c c1 c2 q na x e xa xc nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 q na x e xa xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 q e xa xc nat)(*strict*)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 q e xa xc nat qa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 q e xa xc nat epda_step_label_exta nata)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q na x e n xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply(subgoal_tac \"c1=c2\")\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply(rule_tac\n G=\"F_DPDA_RMPUE G\"\n in epdaS_step_relation_injective_on_edge)\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply (metis F_DPDA_RMPUE__preserves_PDA)\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 q x e xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_rev_def)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2 q ea na x e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 q ea na x e n xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac c c1 c2 e1 e2 q e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 q e n x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac c c1 c2 e1 e2 epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n)\n apply(rename_tac c c1 c2 e1 e2 e n)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G \\ Collect F_DPDA_RMPUE__edge_if. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac c c1 c2 e1 e2 e n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 e n x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e2 e n x q)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 e n x epda_step_label_exta nat)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 e n)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e1 e2 e n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e n x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e n x xa q)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e n x xa epda_step_label_exta nat)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 e n x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa xb xc)(*strict*)\n apply(case_tac xb)\n apply(rename_tac c c1 c2 e n x xa xb xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa xc)(*strict*)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e n x xa xc q)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e n x xa xc epda_step_label_exta nat)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e n x xa xb xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa xc nat)(*strict*)\n apply(case_tac xc)\n apply(rename_tac c c1 c2 e n x xa xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa nat)(*strict*)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e n x xa nat q)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e n x xa nat epda_step_label_exta nata)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e n x xa xc nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa nat nata)(*strict*)\n apply(subgoal_tac \"nat=nata\")\n apply(rename_tac c c1 c2 e n x xa nat nata)(*strict*)\n prefer 2\n apply (metis DT_state_or_edge_nat.simps(2) nat.inject)\n apply(rename_tac c c1 c2 e n x xa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa nata)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e n x xa nata w)(*strict*)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e n x xa nata w q)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e n x xa nata w epda_step_label_exta nat)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__preserves_DPDA: \"\n valid_dpda G\n \\ push_and_pop_edges_seperated G\n \\ read_edges_seperated G\n \\ valid_dpda (F_DPDA_RMPUE G)\"\n apply(simp (no_asm) add: valid_dpda_def)\n apply(rule conjI)\n apply(rule F_DPDA_RMPUE__preserves_PDA)\n apply(force)\n apply (metis F_DPDA_RMPUE__preserves_is_forward_edge_deterministic_accessible)\n done\n\ndefinition F_DPDA_RMPUE__conf_old__LR_revX :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RMPUE__conf_old__LR_revX c \\\n case epdaS_conf_state c of cons_state_or_edge_nat_old q\n \\ \\epdaS_conf_state = q,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\n | cons_state_or_edge_nat_new e n\n \\ \\epdaS_conf_state = edge_src e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = (edge_pop e) @ drop (Suc n) (epdaS_conf_stack c)\\\"\n\ndefinition F_DPDA_RMPUE__relation_labels__LR2 :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda_step_label\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_labels__LR2 G1 G2 e1 e2 \\\n F_DPDA_RMPUE__relation_structure__LR G1 G2\n \\ e1 \\ F_DPDA_DRE__revert_F_DPDA_RMPUE G1 {e2}\"\n\ndefinition F_DPDA_RMPUE__relation_labels__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_labels__RL2 G1 G2 e2 e1 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ e1 \\ F_DPDA_DRE__revert_F_DPDA_RMPUE G2 {e2}\"\n\nlemma epdaS_epdaS_RMP_StateSimLRReach_ATS_Simulation_Configuration_WeakReach_axioms: \"\n ATS_Simulation_Configuration_WeakReach_axioms epda_step_labels epdaS_step_relation epdaS_configurations epda_step_labels epdaS_step_relation F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_structure__LR F_DPDA_RMPUE__relation_step_simulation__LR F_DPDA_RMPUE__relation_labels__LR2\"\n apply(simp add: ATS_Simulation_Configuration_WeakReach_axioms_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def epda_step_labels_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(subgoal_tac \"Suc 0 < length (edge_push e1)\")\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_i_th__LR_def)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rule disjI1)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"(F_DPDA_RMPUE__edge_else e1)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp only: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimLRReach\" : ATS_Simulation_Configuration_WeakReach\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LR\"\n (* relation_labelsLR *)\n \"F_DPDA_RMPUE__relation_labels__LR2\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLRReach_ATS_Simulation_Configuration_WeakReach_axioms)\n done\n\ndefinition F_DPDA_RMPUE__relation_configuration__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR_revX c1\"\n\ndefinition F_DPDA_RMPUE__relation_initial_configuration__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_configuration__RL2 G1 G2 c1 c2 \\\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RMPUE__conf_old__LR_revX c1\"\n\ndefinition F_DPDA_RMPUE__relation_initial_simulation__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event , 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ (('state, 'event , 'stack) epda_step_label, ('state, 'event , 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_initial_simulation__RL2 G1 G2 c1 d \\\n d = der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\"\n\ndefinition F_DPDA_RMPUE__relation_step_simulation__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge_nat, 'event , 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event, 'stack) epda_step_label\n \\ (('state, 'event, 'stack) DT_state_or_edge_nat, 'event , 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RMPUE__relation_step_simulation__RL2 G1 G2 c1 e c1' c2 d \\\n case edge_trg e of cons_state_or_edge_nat_old q\n \\ (case edge_src e of cons_state_or_edge_nat_old q\n \\ d = der2\n (F_DPDA_RMPUE__conf_old__LR_revX c1)\n (F_DPDA_RMPUE__edge_else__RL e)\n (F_DPDA_RMPUE__conf_old__LR_revX c1')\n | cons_state_or_edge_nat_new e' n\n \\ d = der2\n (F_DPDA_RMPUE__conf_old__LR_revX c1)\n e'\n (F_DPDA_RMPUE__conf_old__LR_revX c1'))\n | cons_state_or_edge_nat_new e' n\n \\ (case edge_src e of cons_state_or_edge_nat_old q\n \\ d = der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\n | cons_state_or_edge_nat_new e' n\n \\ d = der1 (F_DPDA_RMPUE__conf_old__LR_revX c1))\"\n\nlemma F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR_revX c1 \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(case_tac q)\n apply(rename_tac q i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s qa x ia)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(case_tac ia)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(case_tac \"Suc (Suc nat) < length (edge_push x)\")\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa x ia)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac q i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(erule disjE)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac i s epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac ia)\n apply(rename_tac i s epda_step_label_ext nat x ia)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x ia nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(case_tac \"Suc (Suc nata) < length (edge_push x)\")\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i s epda_step_label_ext nat x nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x nata)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i s x nata)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rule conjI)\n apply(rename_tac i s x nata)(*strict*)\n apply(rule valid_epda_pop_in_gamma)\n apply(rename_tac i s x nata)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i s x nata)(*strict*)\n apply(force)\n apply(rename_tac i s x nata)(*strict*)\n apply (metis set_drop_subset subset_trans)\n done\n\nlemma F_DPDA_RMPUE__conf_old__LR_revX_preserves_initial_configurations: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RMPUE__conf_old__LR_revX c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulationX: \"\n (\\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RMPUE__relation_initial_configuration__RL2 G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RMPUE__relation_initial_simulation__RL2 G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_initial_simulation__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_initial_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RMPUE__relation_initial_configuration__RL2_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma pre_states_are_also_new: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ ea \\ epda_delta G2\n \\ F_DPDA_RMPUE__edge_if ea\n \\ Suc (Suc (Suc n)) = length (edge_push ea)\n \\ epdaS.derivation_initial G1 d\n \\ d i = Some (pair e \\epdaS_conf_state = cons_state_or_edge_nat_new ea (Suc n), epdaS_conf_scheduler = option_to_list None @ epdaS_conf_scheduler c1', epdaS_conf_stack = rev (edge_push ea) ! Suc n # w\\)\n \\ k \\ n\n \\ k \\ i \\ epdaS_conf_state (the (get_configuration (d (i - k)))) = cons_state_or_edge_nat_new ea (Suc n - k)\"\n apply(induct k)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e c. d (i-k) = Some (pair e c)\")\n apply(rename_tac k)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"i\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac k)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(rename_tac k eb c)(*strict*)\n apply(case_tac \"k=i\")\n apply(rename_tac k eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac eb c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(rename_tac k eb c)(*strict*)\n apply(clarsimp)\n apply(case_tac i)\n apply(rename_tac k eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac k eb c nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (nat-k) = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac k eb c nat)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac k eb c nat)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac k eb c nat)(*strict*)\n apply(force)\n apply(rename_tac k eb c nat)(*strict*)\n apply(force)\n apply(rename_tac k eb c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac k eb c nat e1 e2 c1 c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e2 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e2 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac k eb c nat e1 c1 c2 wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply (metis F_DPDA_RMPUE__edge_else_def DT_state_or_edge_nat.simps(3) Suc_diff_le equal_derivation_conf_coincide le_SucE)\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac k eb c nat e1 e2 c1 c2 wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac k eb c nat e1 c1 c2 wa x xa)(*strict*)\n apply(subgoal_tac \"Suc nat - k=Suc (nat-k)\")\n apply(rename_tac k eb c nat e1 c1 c2 wa x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k eb c nat e1 c1 c2 wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac k c nat e1 c1 wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac k c nat e1 c1 wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x xa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x nata)(*strict*)\n apply(case_tac \"Suc (Suc (Suc nata)) < length (edge_push x)\")\n apply(rename_tac k c nat e1 c1 wa x nata)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa x nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac k c nat e1 c1 wa nata)(*strict*)\n apply (metis Suc_leD Suc_le_mono diff_Suc_Suc diff_diff_cancel diff_le_self le_Suc_eq)\n done\n\nlemma stack_content_translates_back: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ ea \\ epda_delta G2\n \\ F_DPDA_RMPUE__edge_if ea\n \\ Suc (Suc (Suc n)) = length (edge_push ea)\n \\ epdaS.derivation_initial G1 d\n \\ d i = Some (pair e \\epdaS_conf_state = cons_state_or_edge_nat_new ea (Suc n), epdaS_conf_scheduler = option_to_list None @ epdaS_conf_scheduler c1', epdaS_conf_stack = rev (edge_push ea) ! Suc n # w\\)\n \\ \\k\\n. k \\ i \\ epdaS_conf_state (the (get_configuration (d (i - k)))) = cons_state_or_edge_nat_new ea (Suc n - k)\n \\ d (i - n) = Some (pair eb c)\n \\ i \\ n\n \\ d (i - Suc n) = Some (pair ec ca)\n \\ k \\ Suc n\n \\ epdaS_conf_stack (the (get_configuration (d (i - Suc n + k)))) = drop (length (edge_push ea) - Suc k) (edge_push ea) @ drop (Suc 0) (epdaS_conf_stack ca)\"\n apply(induct k)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (i-Suc n) = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e2 c2)(*strict*)\n apply(subgoal_tac \"Suc(i-Suc n)=i-n\")\n apply(rename_tac e2 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac e2 wa)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e2 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e2 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac e2 wa)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac e2 wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac e2 wa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac e2 wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2 wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac wa x xa)(*strict*)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac wa x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac wa)(*strict*)\n apply(case_tac \"edge_push ea\")\n apply(rename_tac wa)(*strict*)\n apply(force)\n apply(rename_tac wa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push ea = w' @ [x']\")\n apply(rename_tac wa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac wa a list)(*strict*)\n apply(thin_tac \"edge_push ea = a # list\")\n apply(clarsimp)\n apply(rename_tac wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac wa x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac wa x nat)(*strict*)\n apply(case_tac \"Suc (Suc nat) < length (edge_push x)\")\n apply(rename_tac wa x nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc (Suc nat)) < length (edge_push x)\")\n apply(rename_tac wa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac wa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac wa x nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc nat) = length (edge_push x)\")\n apply(rename_tac wa x nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac wa x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d (i-Suc n+k) = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac k)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac k)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(force)\n apply(rename_tac k)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def get_configuration_def)\n apply(clarsimp)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e2 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e2 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n apply(subgoal_tac \"Suc (i - Suc n + k) = i-n+k\")\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n apply(subgoal_tac \"Suc (i + k - Suc n) = i-n+k\")\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(erule_tac\n x=\"n-k\"\n in allE)\n apply(clarsimp)\n apply(rename_tac k e1 e2 c1 c2 wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 e2 c1 c2 wa x)(*strict*)\n apply(subgoal_tac \"n-k \\ i \\ epdaS_conf_state (the (case d (i - (n-k)) of None \\ None | Some (pair e c) \\ Some c)) = cons_state_or_edge_nat_new ea (Suc n - (n-k))\")\n apply(rename_tac k e1 e2 c1 c2 wa x)(*strict*)\n prefer 2\n apply(erule_tac\n x=\"n-k\"\n in allE)\n apply(clarsimp)\n apply(rename_tac k e1 e2 c1 c2 wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x xa)(*strict*)\n apply(case_tac \"edge_push ea\")\n apply(rename_tac k e1 c1 c2 wa x xa)(*strict*)\n apply(force)\n apply(rename_tac k e1 c1 c2 wa x xa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push ea = w' @ [x']\")\n apply(rename_tac k e1 c1 c2 wa x xa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac k e1 c1 c2 wa x xa a list)(*strict*)\n apply(thin_tac \"edge_push ea = a # list\")\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x xa w' x')(*strict*)\n apply(case_tac w')\n apply(rename_tac k e1 c1 c2 wa x xa w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x xa w' x' a list)(*strict*)\n apply(subgoal_tac \"\\w'' x'. w' = w'' @ [x']\")\n apply(rename_tac k e1 c1 c2 wa x xa w' x' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac k e1 c1 c2 wa x xa w' x' a list)(*strict*)\n apply(thin_tac \"w' = a # list\")\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x xa x' w'' x'a)(*strict*)\n apply(case_tac xa)\n apply(rename_tac k e1 c1 c2 wa x xa x' w'' x'a)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac k e1 c1 c2 wa x xa x' w'' x'a nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a nat)(*strict*)\n apply(case_tac \"Suc (Suc (Suc nat)) < length (edge_push x)\")\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat)(*strict*)\n defer\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc nat) = length (edge_push x)\")\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k e1 c1 c2 wa x x' w'' x'a nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat)(*strict*)\n apply(subgoal_tac \"\\x. x#drop (length w'' - nat) w'' = drop (length w'' - Suc nat) w''\")\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat)(*strict*)\n prefer 2\n apply(rule drop_with_elem_head)\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(rule_tac\n t=\"drop (length w'' - Suc nat) w''\"\n and s=\"x # drop (length w'' - nat) w''\"\n in ssubst)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(rule_tac\n t=\"(x # drop (length w'' - nat) w'') @ x'a # x' # drop (Suc 0) (epdaS_conf_stack ca)\"\n and s=\"x # (drop (length w'' - nat) w'' @ x'a # x' # drop (Suc 0) (epdaS_conf_stack ca))\"\n in ssubst)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(rule_tac\n t=\"drop (length w'' - nat) w'' @ x'a # x' # drop (Suc 0) (epdaS_conf_stack ca)\"\n and s=\"(x'a # rev w'') ! nat # wa\"\n in ssubst)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(rule_tac\n t=\"rev w'' ! nat # (x'a # rev w'') ! nat # wa\"\n and s=\"(rev w'' ! nat # (x'a # rev w'') ! nat#[]) @ wa\"\n in ssubst)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(rule_tac\n t=\"[rev w'' ! nat, (x'a # rev w'') ! nat]\"\n and s=\"[x,(x'a # rev w'') ! nat]\"\n in ssubst)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(clarsimp)\n apply(rule drop_with_elem_head2)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(force)\n apply(rename_tac e1 c1 c2 wa x' w'' x'a nat x)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RMPUE__relation_step_simulation__RL2_maps_to_derivation: \"\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2\n \\ F_DPDA_RMPUE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac q qa)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def F_DPDA_RMPUE__edge_else__RL_def)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac q qa w x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac xa)\n apply(rename_tac q qa w x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w x)(*strict*)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(rename_tac q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac q w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac q qa w x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(thin_tac \" c1 \\ epdaS.get_accessible_configurations (F_DPDA_RMPUE G2)\")\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(case_tac x)\n apply(rename_tac w x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(rename_tac epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac q epda_step_label_ext nat)(*strict*)\n apply(rename_tac e n)\n apply(rename_tac q e n)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_conf_stack c1'=(edge_push e)@w\")\n apply(rename_tac q e n)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac q e n)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac q e n)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rule conjI)\n apply(rename_tac q e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac q e n)(*strict*)\n apply(rule conjI)\n apply(rename_tac q e n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(rename_tac q e n)(*strict*)\n apply(rule conjI)\n apply(rename_tac q e n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac q e n)(*strict*)\n apply(rule conjI)\n apply(rename_tac q e n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w wa nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc (Suc nat)) = length (edge_push e)\")\n apply(rename_tac e w wa nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w wa nat)(*strict*)\n apply(clarsimp)\n apply (metis RMP_edge_event_is_none)\n apply(rename_tac q e n w wa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac q e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac e n w wa x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w wa nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc (Suc nat)) = length (edge_push e)\")\n apply(rename_tac e w wa nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e w wa nat)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(rename_tac q e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n w wa x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac e w wa nat)(*strict*)\n apply (metis append_eq_conv_conj drop_Suc_Cons)\n apply(rename_tac q e n)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac q e n)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac q e n)(*strict*)\n apply(erule disjE)\n apply(rename_tac q e n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac q e n x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac q e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac q e n x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac q e n x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e n x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n x xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac e n x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac e nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc (Suc nat)) = length (edge_push e)\")\n apply(rename_tac e nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac e nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)\n apply(rename_tac e n)(*strict*)\n apply(rule_tac\n t=\"edge_push e\"\n and s=\"drop (length(edge_push e)-Suc(Suc (Suc n))) (edge_push e)\"\n in ssubst)\n apply(rename_tac e n)(*strict*)\n apply (metis diff_Suc_Suc diff_self_eq_0 drop_0)\n apply(rename_tac e n)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_conf_stack c1 = drop (length (edge_push e) - Suc (Suc n)) (edge_push e) @ w\")\n apply(rename_tac e n)(*strict*)\n apply(erule exE)+\n apply(rename_tac e n w)(*strict*)\n apply(rule_tac\n x=\"w\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac e n w wa)(*strict*)\n apply(case_tac \"edge_push e\")\n apply(rename_tac e n w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa a list)(*strict*)\n apply(clarsimp)\n apply(case_tac list)\n apply(rename_tac e n w wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w wa a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w a aa lista)(*strict*)\n apply(rule_tac\n t=\"(rev lista @ [aa, a]) ! Suc (length lista)\"\n and s=\"([aa, a]) ! (Suc (length lista)- (length (rev lista)))\"\n in ssubst)\n apply(rename_tac e n w a aa lista)(*strict*)\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac e n w a aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n)(*strict*)\n apply(subgoal_tac \"\\w. c1=\\epdaS_conf_state = cons_state_or_edge_nat_new e (Suc n), epdaS_conf_scheduler = option_to_list None @ epdaS_conf_scheduler c1', epdaS_conf_stack = rev (edge_push e) ! Suc n # w\\\")\n apply(rename_tac e n)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac e n w)(*strict*)\n apply(case_tac c1)\n apply(rename_tac e n w epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(thin_tac \"epdaS_step_relation G1 \\epdaS_conf_state = cons_state_or_edge_nat_new e (Suc n), epdaS_conf_scheduler = option_to_list None @ epdaS_conf_scheduler c1', epdaS_conf_stack = rev (edge_push e) ! Suc n # w\\ \\edge_src = cons_state_or_edge_nat_new e (Suc n), edge_event = None, edge_pop = [rev (edge_push e) ! Suc n], edge_push = [rev (edge_push e) ! Suc (Suc n), rev (edge_push e) ! Suc n], edge_trg = cons_state_or_edge_nat_old (edge_trg e)\\ c1'\")\n apply(rename_tac e n w)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac e n w d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac e n w d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac e n w d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac e n w d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac e n w d i option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac e n w d i option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac ea n w d i e)(*strict*)\n apply(subgoal_tac \"\\k\\n. i\\k \\ epdaS_conf_state (the(get_configuration(d (i-k)))) = cons_state_or_edge_nat_new ea ((Suc n)-k) \")\n apply(rename_tac ea n w d i e)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(rule pre_states_are_also_new)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e k)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e)(*strict*)\n apply(subgoal_tac \"\\e c. d (i-n) = Some (pair e c)\")\n apply(rename_tac ea n w d i e)(*strict*)\n prefer 2\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(rule_tac\n m=\"i\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac ea n w d i e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ea n w d i e)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac ea n w d i e)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(case_tac \"i=n\")\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac ea n w d e eb c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def F_DPDA_RMPUE__relation_TSstructure__RL_def epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac ea n w d e c)(*strict*)\n apply(simp add: F_DPDA_RMPUE_def get_configuration_def)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(subgoal_tac \"\\e c. d (i-Suc n) = Some (pair e c)\")\n apply(rename_tac ea n w d i e eb c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"i\"\n in epdaS.pre_some_position_is_some_position)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(force)\n apply(rename_tac ea n w d i e eb c)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n apply(subgoal_tac \"\\k\\Suc n. epdaS_conf_stack (the(get_configuration(d (i-Suc n+k)))) = drop (length (edge_push ea) - Suc k) (edge_push ea) @ drop(Suc 0)(epdaS_conf_stack ca) \")\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n apply(erule_tac\n x=\"Suc n\"\n and P=\"\\k. k \\ Suc n \\ epdaS_conf_stack (the (get_configuration (d (i - Suc n + k)))) = drop (length (edge_push ea) - Suc k) (edge_push ea) @ drop (Suc 0) (epdaS_conf_stack ca)\"\n in allE)\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"(Suc (i - Suc n + n)) = i\")\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea n w d i e eb c ec ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac ea n w d i e eb c ec ca k)(*strict*)\n apply(rule stack_content_translates_back)\n apply(rename_tac ea n w d i e eb c ec ca k)(*strict*)\n apply(force)+\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_step_relation_step_simulationX: \"\n \\G1 G2. F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RMPUE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__RL2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis epdaS_epdaS_RMP_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RMPUE__relation_structure__LR_def F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac ex1 n1 ex2 n2)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex1 n1 ex2 n2 x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c2 c1' ex1 n1 ex2 n2 x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex1 n1 ex2 n2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex1 ex2 n2 xa)(*strict*)\n apply(case_tac \"xa\")\n apply(rename_tac G1 G2 c1 c2 c1' ex1 ex2 n2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex1 ex2 n2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule_tac\n ?e1.0=\"\\edge_src = cons_state_or_edge_nat_new ex2 (Suc nat), edge_event = None, edge_pop = [rev (edge_push ex2) ! Suc nat], edge_push = [rev (edge_push ex2) ! Suc (Suc nat), rev (edge_push ex2) ! Suc nat], edge_trg = cons_state_or_edge_nat_new ex2 (Suc (Suc nat))\\\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations G1\")\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(rename_tac ex nx q)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nx q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' ex nx q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nx q x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c2 c1' ex nx q x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nx q x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex q xa)(*strict*)\n apply(case_tac \"xa\")\n apply(rename_tac G1 G2 c1 c2 c1' ex q xa)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 c1' ex q xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex q xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule_tac\n ?e1.0=\"\\edge_src = cons_state_or_edge_nat_old (edge_src ex), edge_event = None, edge_pop = [rev (edge_push ex) ! 0], edge_push = [rev (edge_push ex) ! Suc 0, rev (edge_push ex) ! 0], edge_trg = cons_state_or_edge_nat_new ex (Suc 0)\\\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(thin_tac \"c1 \\ epdaS.get_accessible_configurations G1\")\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def push_and_pop_edges_seperated_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. \\ F_DPDA_SPPE__edge_if ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(erule disjE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w y)(*strict*)\n apply(simp add: read_edges_seperated_def)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. length (edge_pop ex) = Suc 0\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w y)(*strict*)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(case_tac \"edge_push ex\")\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push ex = w' @ [x']\")\n apply(rename_tac G2 c1 c1' ex w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a list)(*strict*)\n apply(thin_tac \"edge_push ex = a # list\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rule F_DPDA_RMPUE__relation_step_simulation__RL2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext nat)(*strict*)\n apply(rename_tac ex nx)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' q ex nx x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c2 c1' q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nx x xa)(*strict*)\n apply(case_tac \"xa\")\n apply(rename_tac G1 G2 c1 c2 c1' ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nx x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(subgoal_tac \"Suc (Suc (Suc nat)) = length (edge_push ex)\")\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.der2_belongs)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def epda_step_labels_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule_tac\n ?e1.0=\"\\edge_src = cons_state_or_edge_nat_new ex (Suc nat), edge_event = None, edge_pop = [rev (edge_push ex) ! Suc nat], edge_push = [rev (edge_push ex) ! Suc (Suc nat), rev (edge_push ex) ! Suc nat], edge_trg = cons_state_or_edge_nat_old (edge_trg ex)\\\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.AX_step_relation_preserves_belongsC)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp (no_asm) add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule_tac\n ?e1.0=\"\\edge_src = cons_state_or_edge_nat_new ex (Suc nat), edge_event = None, edge_pop = [rev (edge_push ex) ! Suc nat], edge_push = [rev (edge_push ex) ! Suc (Suc nat), rev (edge_push ex) ! Suc nat], edge_trg = cons_state_or_edge_nat_old (edge_trg ex)\\\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 c1' ex nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex nat)(*strict*)\n apply(simp add: der2_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRLReach_inst_ATS_Simulation_Configuration_WeakReach_axioms: \"\n ATS_Simulation_Configuration_WeakReach_axioms epda_step_labels epdaS_step_relation epdaS_configurations epda_step_labels epdaS_step_relation F_DPDA_RMPUE__relation_configuration__RL2 F_DPDA_RMPUE__relation_TSstructure__RL F_DPDA_RMPUE__relation_step_simulation__RL2 F_DPDA_RMPUE__relation_labels__RL2\"\n apply(simp add: ATS_Simulation_Configuration_WeakReach_axioms_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"(F_DPDA_RMPUE__edge_else__RL e1)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n prefer 2\n apply(rule disjI2)\n apply(simp add: F_DPDA_RMPUE__edge_else_def F_DPDA_RMPUE__edge_else__RL_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n t=\"epda_delta G2\"\n and s=\"epda_step_labels G2\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n i=\"Suc 0\"\n and d=\"(der2 (F_DPDA_RMPUE__conf_old__LR_revX c1) (F_DPDA_RMPUE__edge_else__RL e1) (F_DPDA_RMPUE__conf_old__LR_revX c1'))\"\n in epdaS.belongs_step_labels)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q epda_step_label_ext nat)(*strict*)\n apply(rename_tac ex nx)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"ex\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(subgoal_tac \"Suc (Suc xa) = length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rule_tac\n x=\"Suc nat\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_exta nat q x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta q xa)(*strict*)\n apply(rename_tac ex qx xa)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c1' ex qx xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(subgoal_tac \"\\c. epdaS_step_relation G2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex c\")\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(erule_tac\n x=\"der2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex c\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(simp add: get_configuration_def der2_def der1_def)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(erule_tac x=\"ex\"in allE)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(erule conjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(rule epdaS_step_exists)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(rule_tac\n i=\"0\"\n and d=\"der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\"\n in epdaS.belongs_configurations)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(rule_tac\n x=\"epdaS_conf_scheduler c1'\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(case_tac \"edge_event ex\")\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_executing_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(erule_tac\n x=\"ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(simp add: strict_executing_edge_def push_and_pop_edges_seperated_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. length (edge_pop ex) = Suc 0\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. \\ F_DPDA_SPPE__edge_if ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(case_tac \"edge_event ex\")\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(case_tac \"edge_pop ex\")\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(case_tac \"edge_push ex\")\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push ex = w' @ [x']\")\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n apply(thin_tac \"edge_push ex = aa # list\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rename_tac ex1 n1 ex2 n2)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n prefer 2\n apply(rule epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(subgoal_tac \"\\c. epdaS_step_relation G2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex2 c\")\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(erule_tac\n x=\"der2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex2 c\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(simp add: get_configuration_def der2_def der1_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(erule_tac x=\"ex2\"in allE)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(erule conjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(erule_tac\n x=\"Suc nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(rule epdaS_step_exists)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(rule_tac\n i=\"0\"\n and d=\"der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\"\n in epdaS.belongs_configurations)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(rule_tac\n x=\"epdaS_conf_scheduler c1'\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat w)(*strict*)\n apply(case_tac \"edge_event ex2\")\n apply(rename_tac G1 G2 c1 c1' ex2 nat w)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat w a)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_executing_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n apply(erule_tac\n x=\"ex2\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RMPUE__relation_configuration__RL2 F_DPDA_RMPUE__relation_initial_configuration__RL2 F_DPDA_RMPUE__relation_TSstructure__RL F_DPDA_RMPUE__relation_initial_simulation__RL2 F_DPDA_RMPUE__relation_step_simulation__RL2\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def epdaS_epdaS_RMP_StateSimRL_inst_relation_initial_simulationX epdaS_epdaS_RMP_StateSimRL_step_relation_step_simulationX epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_RMP_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimRLReach\" : ATS_Simulation_Configuration_WeakReach\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__RL2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__RL2\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_TSstructure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__RL2\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__RL2\"\n (* relation_labelsRL *)\n \"F_DPDA_RMPUE__relation_labels__RL2\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RMP_StateSimRLReach_inst_ATS_Simulation_Configuration_WeakReach_axioms)\n done\n\ndefinition F_DPDA_RMPUE__SpecInput :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_RMPUE__SpecInput G \\\n valid_dpda G\n \\ neutral_edges_removed G\n \\ read_edges_seperated G\n \\ push_and_pop_edges_seperated G\n \\ pop_edges_seperated G\"\n\ndefinition F_DPDA_RMPUE__SpecOutput :: \"\n ('stateA, 'event, 'stackA) epda\n \\ ('stateB, 'event, 'stackB) epda\n \\ bool\"\n where\n \"F_DPDA_RMPUE__SpecOutput Gi Go \\\n valid_dpda Go\n \\ epdaS.marked_language Gi = epdaS.marked_language Go\n \\ neutral_edges_removed Go\n \\ read_edges_seperated Go\n \\ mass_push_edges_splitted Go\n \\ push_and_pop_edges_seperated Go\n \\ push_edges_seperated Go\n \\ pop_edges_seperated Go\"\n\nlemma F_DPDA_RMPUE__SOUND: \"\n F_DPDA_RMPUE__SpecInput G\n \\ F_DPDA_RMPUE__SpecOutput G (F_DPDA_RMPUE G)\"\n apply(simp add: F_DPDA_RMPUE__SpecInput_def F_DPDA_RMPUE__SpecOutput_def)\n apply(rule context_conjI)\n apply(rule F_DPDA_RMPUE__preserves_DPDA)\n apply(force)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply (rule F_DPDA_RMPUE__preserves_lang)\n apply(force)\n apply(force)\n apply(force)\n apply(rule context_conjI)\n apply (metis F_DPDA_RMPUE__preserves_neutral_edges_removed)\n apply(rule context_conjI)\n apply (metis F_DPDA_RMPUE__preserves_read_edges_seperated)\n apply(rule context_conjI)\n apply (rule F_DPDA_RMPUE__produces_mass_push_edges_splitted)\n apply(force)\n apply(rule context_conjI)\n apply (metis F_DPDA_RMPUE__preserves_push_and_pop_edges_seperated)\n apply(rule context_conjI)\n apply (rule F_DPDA_RMPUE__produces_push_edges_seperated)\n apply(force)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(force)\n apply(force)\n apply (metis F_DPDA_RMPUE__preserves_pop_edges_seperated)\n done\n\nlemma F_DPDA_DRE__revert_F_DPDA_RMPUE_SOUND_scheduled_case_rev_id: \"\n F_DPDA_RMPUE__SpecInput G' \\\n x \\ epda_delta G' \\\n p \\ epda_delta (F_DPDA_RMPUE G') \\\n p \\ F_DPDA_RMPUE__edge_then x \\ p = F_DPDA_RMPUE__edge_else x \\\n epdaS.derivation_initial (F_DPDA_RMPUE G')\n d \\\n d n = Some (pair (Some p) c) \\\n epdaS.derivation_initial G' d2 \\\n d2 n2 = Some (pair e2 c2) \\\n a \\ F_DPDA_DRE__revert_F_DPDA_RMPUE G' {p} \\ a = x\"\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(subgoal_tac \"\\p1. edge_pop a=[p1]\")\n prefer 2\n apply(simp add: F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac x=\"a\" and P=\"\\a. valid_epda_step_label G' a\"in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_pop a\")\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"\\p1. edge_pop x=[p1]\")\n prefer 2\n apply(simp add: F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G' x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(case_tac \"edge_pop x\")\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"\\w. edge_push a \\ [] \\ edge_push a=w@(edge_pop a)\")\n prefer 2\n apply(clarsimp)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. valid_epda_step_label G' a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. length (edge_pop a) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. (\\y. edge_event a = Some y) \\ edge_push a = edge_pop a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_push a\")\n apply(clarsimp)\n apply(subgoal_tac \"\\w' x'. edge_push a = w' @ [x']\")\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(thin_tac \"edge_push a = aa # list\")\n apply(clarsimp)\n apply(erule_tac\n P=\"p \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(force)\n apply(force)\n apply(subgoal_tac \"\\w. edge_push x \\ [] \\ edge_push x=w@(edge_pop x)\")\n prefer 2\n apply(clarsimp)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G' x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. length (edge_pop x) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. (\\y. edge_event x = Some y) \\ edge_push x = edge_pop x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_push x\")\n apply(clarsimp)\n apply(subgoal_tac \"\\w' x'. edge_push x = w' @ [x']\")\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(thin_tac \"edge_push x = aa # list\")\n apply(clarsimp)\n apply(erule_tac\n P=\"p \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(erule_tac\n P=\"p \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(erule disjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac p1 p1a i ia)\n apply(case_tac i)\n apply(case_tac ia)\n prefer 2\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(case_tac \"Suc (Suc 0) < length (edge_push a)\")\n prefer 2\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc 0) < length (edge_push a)\")\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (Suc 0) = length (edge_push x)\")\n prefer 2\n apply(force)\n apply(subgoal_tac \"Suc (Suc 0) = length (edge_push a)\")\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"edge_event a=None\")\n apply(subgoal_tac \"edge_event x=None\")\n apply(case_tac a)\n apply(case_tac x)\n apply(clarsimp)\n apply(erule_tac\n P=\"edge_push \\ []\"\n in impE)\n apply(force)\n apply(erule impE)\n apply(force)\n apply(clarsimp)\n apply(case_tac w)\n apply(clarsimp)\n apply(case_tac list)\n prefer 2\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac wa)\n apply(clarsimp)\n apply(case_tac list)\n prefer 2\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G' x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. length (edge_pop x) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. (\\y. edge_event x = Some y) \\ edge_push x = edge_pop x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_event x\")\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. valid_epda_step_label G' a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. length (edge_pop a) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. (\\y. edge_event a = Some y) \\ edge_push a = edge_pop a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_event a\")\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac ia)\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac p1a i)\n apply(case_tac i)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc 0) < length (edge_push x)\")\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (Suc 0) = length (edge_push x)\")\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"edge_event x=None\")\n apply(case_tac a)\n apply(case_tac x)\n apply(clarsimp)\n apply(case_tac \"edge_pusha\")\n apply(clarsimp)\n apply(subgoal_tac \"\\w' x'. edge_pusha = w' @ [x']\")\n prefer 2\n apply(rule_tac\n n=\"length list\"\n in NonEmptyListHasTailElem)\n apply(force)\n apply(thin_tac \"edge_pusha = a # list\")\n apply(clarsimp)\n apply(case_tac \"w'\")\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G' x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. length (edge_pop x) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. (\\y. edge_event x = Some y) \\ edge_push x = edge_pop x\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"x\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_event x\")\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(erule_tac\n P=\"F_DPDA_RMPUE__edge_else x \\ F_DPDA_RMPUE__edge_then a\"\n in disjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def F_DPDA_RMPUE__state_def F_DPDA_RMPUE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac p1a i)\n apply(case_tac i)\n apply(clarsimp)\n apply(case_tac \"Suc (Suc 0) < length (edge_push a)\")\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (Suc 0) = length (edge_push a)\")\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"edge_event a=None\")\n apply(case_tac a)\n apply(case_tac x)\n apply(clarsimp)\n apply(case_tac \"edge_push\")\n apply(clarsimp)\n apply(subgoal_tac \"\\w' x'. edge_push = w' @ [x']\")\n prefer 2\n apply(rule_tac\n n=\"length list\"\n in NonEmptyListHasTailElem)\n apply(force)\n apply(thin_tac \"edge_push = a # list\")\n apply(clarsimp)\n apply(case_tac \"w'\")\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: FB_executing_edge_def strict_executing_edge_def read_edges_seperated_def F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def push_and_pop_edges_seperated_def F_DPDA_SPPE__edge_if_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. valid_epda_step_label G' a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. length (edge_pop a) = Suc 0\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n and P=\"\\a. (\\y. edge_event a = Some y) \\ edge_push a = edge_pop a\"\n in ballE)\n prefer 2\n apply(force)\n apply(erule_tac\n x=\"a\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(case_tac \"edge_event a\")\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n done\n\nlemma F_DPDA_DRE__revert_F_DPDA_RMPUE_SOUND_scheduled_case: \"\n F_DPDA_RMPUE__SpecInput G'\n \\ F_DPDA_DRE__revert_F_DPDA_RMPUE G' (epdaS_accessible_edges (F_DPDA_RMPUE G')) = epdaS_accessible_edges G'\"\n apply(rule order_antisym)\n apply(simp add: epdaS_accessible_edges_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(simp add: epdaS_accessible_edges_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(subgoal_tac \"\\d2 n2 e2 c2. epdaS.derivation_initial SSG2 d2 \\ d2 n2 = Some (pair e2 c2) \\ (case SSe1 of None \\ True | Some e1' \\ \\k d2'. epdaS.derivation SSG2 d2' \\ the (get_configuration (d2' 0)) = the (get_configuration (d2 n2)) \\ (case get_label (derivation_append d2 d2' n2 k) of None \\ False | Some e2' \\ F_DPDA_RMPUE__relation_labels__LR2 SSG1 SSG2 e1' e2'))\" for SSe1 SSG1 SSG2)\n apply(rename_tac x d n c)(*strict*)\n prefer 2\n apply(rule_tac\n ?G1.0=\"G'\"\n and ?d1.0=\"d\"\n and ?G2.0=\"F_DPDA_RMPUE G'\"\n in epdaS_epdaS_RMP_StateSimLRReach.ATS_Simulation_Configuration_WeakReach_exists)\n apply(rename_tac x d n c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(case_tac \"(get_label (derivation_append d2 d2' n2 k))\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(rule_tac\n x=\"a\"\n in exI)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(case_tac \"derivation_append d2 d2' n2 k\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"\\c. d2' 0 = Some (pair None c)\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"epdaS.derivation_initial (F_DPDA_RMPUE G') (derivation_append d2 d2' n2)\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n t=\"epda_delta (F_DPDA_RMPUE G')\"\n and s=\"epda_step_labels (F_DPDA_RMPUE G')\"\n in ssubst)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n i=\"k\"\n and d=\"derivation_append d2 d2' n2\"\n in epdaS.belongs_step_labels)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rename_tac x p d n c)(*strict*)\n apply(subgoal_tac \"\\d2 n2 e2 c2. epdaS.derivation_initial SSG2 d2 \\ d2 n2 = Some (pair e2 c2) \\ (case SSe1 of None \\ True | Some e1' \\ \\k d2'. epdaS.derivation SSG2 d2' \\ the (get_configuration (d2' 0)) = the (get_configuration (d2 n2)) \\ (case get_label (derivation_append d2 d2' n2 k) of None \\ False | Some e2' \\ F_DPDA_RMPUE__relation_labels__RL2 SSG1 SSG2 e1' e2'))\" for SSe1 SSG1 SSG2)\n apply(rename_tac x p d n c)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"G'\"\n and ?d1.0=\"d\"\n and ?G1.0=\"F_DPDA_RMPUE G'\"\n in epdaS_epdaS_RMP_StateSimRLReach.ATS_Simulation_Configuration_WeakReach_exists)\n apply(rename_tac x p d n c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(rename_tac x p d n c)(*strict*)\n apply(force)\n apply(rename_tac x p d n c)(*strict*)\n apply(force)\n apply(rename_tac x p d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(case_tac \"(get_label (derivation_append d2 d2' n2 k))\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(case_tac \"derivation_append d2 d2' n2 k\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"\\c. d2' 0 = Some (pair None c)\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"epdaS.derivation_initial G' (derivation_append d2 d2' n2)\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"derivation_append d2 d2' n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"k\"\n in exI)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(clarsimp)\n apply(rule F_DPDA_DRE__revert_F_DPDA_RMPUE_SOUND_scheduled_case_rev_id)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_configuration_compatible_with_marking_configurations: \"\n(\\G1 G2.\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2 \\\n c1 \\ epdaS_marking_configurations G1 \\ c2 \\ epdaS_marking_configurations G2))\"\n apply(clarsimp)\n apply(simp add: epdaS_marking_configurations_def)\n apply(subgoal_tac \"c2 \\ epdaS_configurations G2\")\n prefer 2\n apply (metis (full_types) F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def F_DPDA_RMPUE_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(case_tac c1)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant: \"\n (\\G1 G2.\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. F_DPDA_RMPUE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2\n d2 \\\n maximum_of_domain d2 0 \\\n c1' \\ epdaS_marking_configurations G1)))))\"\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def der1_def)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def epdaS_marking_configurations_def F_DPDA_RMPUE__relation_configuration__RL2_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def der1_def)\n apply(simp add: epdaS_step_relation_def epdaS_marking_configurations_def F_DPDA_RMPUE__relation_configuration__RL2_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE_def)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_step_simulationReach: \"\n \\G1 G2.\n F_DPDA_RMPUE__relation_TSstructure__RL G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. epdaS.derivation G2 d2 \\\n epdaS.belongs G2 d2 \\\n the (get_configuration (d2 0)) = c2 \\\n F_DPDA_RMPUE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2\n d2 \\\n (\\n. maximum_of_domain d2 n \\\n F_DPDA_RMPUE__relation_configuration__RL2 G1 G2 c1'\n (the (get_configuration (d2 n))) \\\n (\\k e2. (\\c2. d2 k = Some (pair (Some e2) c2)) \\\n F_DPDA_RMPUE__relation_labels__RL2 G1 G2 e1 e2) \\\n n = 0 \\\n (\\e2. Ex (epdaS_step_relation G2 c2 e2) \\\n F_DPDA_RMPUE__relation_labels__RL2 G1 G2 e1 e2))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"(F_DPDA_RMPUE__edge_else__RL e1)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n prefer 2\n apply(rule disjI2)\n apply(simp add: F_DPDA_RMPUE__edge_else_def F_DPDA_RMPUE__edge_else__RL_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n t=\"epda_delta G2\"\n and s=\"epda_step_labels G2\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(rule_tac\n i=\"Suc 0\"\n and d=\"(der2 (F_DPDA_RMPUE__conf_old__LR_revX c1) (F_DPDA_RMPUE__edge_else__RL e1) (F_DPDA_RMPUE__conf_old__LR_revX c1'))\"\n in epdaS.belongs_step_labels)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n q qa)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n q epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q epda_step_label_ext nat)(*strict*)\n apply(rename_tac ex nx)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"ex\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n q ex nx x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n q ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(subgoal_tac \"Suc (Suc xa) = length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nx x xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rule_tac\n x=\"Suc nat\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext nat q x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_exta nat q x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta nat q x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' epda_step_label_exta q xa)(*strict*)\n apply(rename_tac ex qx xa)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c1' ex qx xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex qx xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(subgoal_tac \"\\c. epdaS_step_relation G2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex c\")\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(clarsimp)\n apply(simp add: der1_def get_configuration_def)\n apply(erule_tac x=\"ex\" in allE)\n apply(erule disjE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex c)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(erule conjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(rule epdaS_step_exists)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(rule_tac\n i=\"0\"\n and d=\"der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\"\n in epdaS.belongs_configurations)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(rule_tac\n x=\"epdaS_conf_scheduler c1'\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(case_tac \"edge_event ex\")\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_executing_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(erule_tac\n x=\"ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex w)(*strict*)\n apply(simp add: strict_executing_edge_def push_and_pop_edges_seperated_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. length (edge_pop ex) = Suc 0\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n and P=\"\\ex. \\ F_DPDA_SPPE__edge_if ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(erule_tac\n x=\"ex\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(case_tac \"edge_event ex\")\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n prefer 2\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_SPPE__edge_if_def)\n apply(case_tac \"edge_pop ex\")\n apply(rename_tac G2 c1 c1' ex w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(case_tac \"edge_push ex\")\n apply(rename_tac G2 c1 c1' ex w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. edge_push ex = w' @ [x']\")\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G2 c1 c1' ex w a aa list)(*strict*)\n apply(thin_tac \"edge_push ex = aa # list\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(rule epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n epda_step_label_ext nat epda_step_label_exta nata)(*strict*)\n apply(rename_tac ex1 n1 ex2 n2)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x) \\ (\\x\\ epda_delta G2 \\ {e. (\\ F_DPDA_RMPUE__edge_if e)}. e1 = F_DPDA_RMPUE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def)\n apply(simp add: F_DPDA_RMPUE_def)\n apply(blast)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. F_DPDA_RMPUE__edge_if e}. e1 \\ F_DPDA_RMPUE__edge_then x\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_else_def)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n ex1 n1 ex2 n2 x)(*strict*)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(case_tac \"Suc (Suc xa) < length (edge_push x)\")\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 n1 ex2 n2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa)(*strict*)\n apply(case_tac xa)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex1 ex2 n2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n prefer 2\n apply(rule epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n ex2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(subgoal_tac \"\\c. epdaS_step_relation G2 (F_DPDA_RMPUE__conf_old__LR_revX c1) ex2 c\")\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac x=\"ex2\" in allE)\n apply(erule disjE)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(erule conjE)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(erule_tac\n x=\"Suc nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__state_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(rule epdaS_step_exists)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(rule_tac\n i=\"0\"\n and d=\"der1 (F_DPDA_RMPUE__conf_old__LR_revX c1)\"\n in epdaS.belongs_configurations)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n apply(rule_tac\n x=\"epdaS_conf_scheduler c1'\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' ex2 nat w)(*strict*)\n apply(case_tac \"edge_event ex2\")\n apply(rename_tac G1 G2 c1 c1' ex2 nat w)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' ex2 nat w a)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_executing_edge_def FB_executing_edge_def F_DPDA_RMPUE__edge_if_def F_DPDA_RMPUE__relation_TSstructure__RL_def read_edges_seperated_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n apply(erule_tac\n x=\"ex2\"\n in ballE)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G2 c1 c1' ex2 nat w a)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 G2 c1 c1' ex2 nat)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RMPUE__conf_old__LR_revX_def prefix_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimRLRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms: \"\n ATS_Simulation_Configuration_WeakRequired_axioms epda_step_labels epdaS_step_relation\n epdaS_configurations epda_step_labels epdaS_step_relation\n F_DPDA_RMPUE__relation_configuration__RL2 F_DPDA_RMPUE__relation_TSstructure__RL\n F_DPDA_RMPUE__relation_step_simulation__RL2 F_DPDA_RMPUE__relation_labels__RL2\n epdaS_marking_configurations epdaS_marking_configurations\"\n apply(simp add: ATS_Simulation_Configuration_WeakRequired_axioms_def\n epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_configuration_compatible_with_marking_configurations\n epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant\n epdaS_epdaS_RMP_StateSimRLRequired__inst__AX_relation_step_simulationReach)\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimRLRequired\" : ATS_Simulation_Configuration_WeakRequired\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__RL2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__RL2\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_TSstructure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__RL2\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__RL2\"\n (* relation_labelsRL *)\n \"F_DPDA_RMPUE__relation_labels__RL2\"\n (* marking_configurations1 *)\n \"epdaS_marking_configurations\"\n (* marking_configurations2 *)\n \"epdaS_marking_configurations\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RMP_StateSimRLRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLRRequired__inst__AX_relation_configuration_compatible_with_marking_configurations: \"\n(\\G1 G2.\n F_DPDA_RMPUE__relation_structure__LR G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\\n c1 \\ epdaS_marking_configurations G1 \\ c2 \\ epdaS_marking_configurations G2))\"\n apply(clarsimp)\n apply(simp add: epdaS_marking_configurations_def)\n apply(subgoal_tac \"c2 \\ epdaS_configurations G2\")\n prefer 2\n apply (metis F_DPDA_RMPUE__conf_old__LR_preserves_configurations F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def F_DPDA_RMPUE__relation_configuration__LR_def F_DPDA_RMPUE__relation_TSstructure__RL_def F_DPDA_RMPUE__relation_configuration__RL2_def F_DPDA_RMPUE_def F_DPDA_RMPUE__conf_old__LR_revX_def F_DPDA_RMPUE__conf_old__LR_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLRRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant: \"\n (\\G1 G2.\n F_DPDA_RMPUE__relation_structure__LR G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2\n d2 \\\n maximum_of_domain d2 0 \\\n c1' \\ epdaS_marking_configurations G1)))))\"\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def)\n apply(clarsimp)\n apply(case_tac \"Suc 0 < length (edge_push e1)\")\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der2_def)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLRquired__inst__AX_relation_step_simulationReach: \"\n \\G1 G2.\n F_DPDA_RMPUE__relation_structure__LR G1 G2 \\\n (\\c1 c2.\n F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. epdaS.derivation G2 d2 \\\n epdaS.belongs G2 d2 \\\n the (get_configuration (d2 0)) = c2 \\\n F_DPDA_RMPUE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2\n d2 \\\n (\\n. maximum_of_domain d2 n \\\n F_DPDA_RMPUE__relation_configuration__LR G1 G2 c1'\n (the (get_configuration (d2 n))) \\\n (\\k e2. (\\c2. d2 k = Some (pair (Some e2) c2)) \\\n F_DPDA_RMPUE__relation_labels__LR2 G1 G2 e1 e2) \\\n n = 0 \\\n (\\e2. Ex (epdaS_step_relation G2 c2 e2) \\\n F_DPDA_RMPUE__relation_labels__LR2 G1 G2 e1 e2))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def epda_step_labels_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_step_simulation__LR_def)\n apply(case_tac \"F_DPDA_RMPUE__edge_if e1\")\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(subgoal_tac \"Suc 0 < length (edge_push e1)\")\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RMPUE__edge_if_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__edge_then_i_th__LR_def)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(simp add: F_DPDA_RMPUE__edge_then_def)\n apply(rule disjI1)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule_tac\n x=\"(F_DPDA_RMPUE__edge_else e1)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(rename_tac G1 c1 e1 c1' n)(*strict*)\n apply(simp only: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RMP_StateSimLRRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms: \"\n ATS_Simulation_Configuration_WeakRequired_axioms epda_step_labels epdaS_step_relation\n epdaS_configurations epda_step_labels epdaS_step_relation\n F_DPDA_RMPUE__relation_configuration__LR F_DPDA_RMPUE__relation_structure__LR\n F_DPDA_RMPUE__relation_step_simulation__LR F_DPDA_RMPUE__relation_labels__LR2\n epdaS_marking_configurations epdaS_marking_configurations\"\n apply(simp add: ATS_Simulation_Configuration_WeakRequired_axioms_def\n epdaS_epdaS_RMP_StateSimLRRequired__inst__AX_relation_configuration_compatible_with_marking_configurations\n epdaS_epdaS_RMP_StateSimLRRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant\n epdaS_epdaS_RMP_StateSimLRquired__inst__AX_relation_step_simulationReach\n )\n done\n\ninterpretation \"epdaS_epdaS_RMP_StateSimLRRequired\" : ATS_Simulation_Configuration_WeakRequired\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RMPUE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RMPUE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RMPUE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RMPUE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RMPUE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RMPUE__relation_step_simulation__LR\"\n (* relation_labelsLR *)\n \"F_DPDA_RMPUE__relation_labels__LR2\"\n (* marking_configurations1 *)\n \"epdaS_marking_configurations\"\n (* marking_configurations2 *)\n \"epdaS_marking_configurations\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RMP_StateSimLRRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms)\n done\n\nlemma F_DPDA_DRE__revert_F_DPDA_RMPUE_SOUND_scheduled_case_epdaS_required_edges: \"\n F_DPDA_RMPUE__SpecInput G'\n \\ F_DPDA_DRE__revert_F_DPDA_RMPUE G' (epdaS_required_edges (F_DPDA_RMPUE G')) = epdaS_required_edges G'\"\n apply(rule order_antisym)\n apply(simp add: epdaS_required_edges_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(subgoal_tac \"\\m. n+m=k\")\n prefer 2\n apply(rule_tac x=\"k-n\" in exI)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?G1.0=\"F_DPDA_RMPUE G'\" and ?G2.0=\"G'\" and ?n1'=\"n+m\" in epdaS_epdaS_RMP_StateSimRLRequired.ATS_Simulation_Configuration_WeakRequired_exists_ALT)\n apply(simp add: F_DPDA_RMPUE__relation_TSstructure__RL_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(clarsimp)\n apply (metis epdaS.is_forward_deterministic_accessible_def epdaS_dependency_between_determinism_properties valid_dpda_def valid_pda_def)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"d2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2\" in exI)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_labels__RL2_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(clarsimp)\n apply(rule conjI)\n prefer 2\n apply(rule_tac x=\"n2'\" in exI)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__relation_configuration__RL2_def epdaS_marking_configurations_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?c1.0=\"ca\" in\n F_DPDA_RMPUE__conf_old__LR_revX_preserves_configurations)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(simp add: F_DPDA_RMPUE__conf_old__LR_revX_def F_DPDA_RMPUE_def)\n apply(case_tac \"epdaS_conf_state ca\")\n apply(clarsimp)\n apply(clarsimp)\n apply(rule_tac ?n2.0=\"n2\" and d=\"d\" and ?d2.0=\"d2\" in F_DPDA_DRE__revert_F_DPDA_RMPUE_SOUND_scheduled_case_rev_id)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(simp add: epdaS_required_edges_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n apply(subgoal_tac \"\\m. n+m=k\")\n prefer 2\n apply(rule_tac x=\"k-n\" in exI)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?G2.0=\"F_DPDA_RMPUE G'\" and ?G1.0=\"G'\" and ?n1'=\"n+m\" in epdaS_epdaS_RMP_StateSimLRRequired.ATS_Simulation_Configuration_WeakRequired_exists_ALT)\n apply(simp add: F_DPDA_RMPUE__relation_structure__LR_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(clarsimp)\n apply(simp add: epdaS.is_forward_deterministic_accessible_def)\n apply(rule conjI)\n prefer 2\n apply(rule F_DPDA_RMPUE__preserves_is_forward_edge_deterministic_accessible)\n apply(force)\n apply(force)\n apply(force)\n apply(rule epdaS_is_forward_target_deterministic_accessible)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"e2\" in exI)\n apply(rule conjI)\n apply(rule_tac\n t=\"epda_delta SSX\" \n and s=\"epda_step_labels SSX\" for SSX\n in ssubst)\n apply(simp add: epda_step_labels_def)\n apply(rule_tac\n i=\"n2\" and d=\"d2\"\n in epdaS.belongs_step_labels)\n prefer 2\n apply(force)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rule F_DPDA_RMPUE__preserves_epda)\n apply(simp add: F_DPDA_RMPUE__SpecInput_def)\n apply(force)\n apply(rule conjI)\n apply(rule_tac x=\"d2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2'\" in exI)\n apply(clarsimp)\n apply (metis F_DPDA_RMPUE__conf_old__LR_preserves_marking_configurations F_DPDA_RMPUE__relation_configuration__LR_def)\n apply(simp add: F_DPDA_RMPUE__relation_labels__LR2_def F_DPDA_DRE__revert_F_DPDA_RMPUE_def)\n done\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_04_04/FUNCTION__DPDA_RMPE__DPDA_REMOVE_MASS_PUSHING_EDGES.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.27573011618249416}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory FastMap\nimports\n LemmaBucket\nbegin\n\ntext \\\n Efficient rules and tactics for working with large lookup tables (maps).\n\n Features:\n \\<^item> Define a binary lookup tree for any lookup table (requires linorder keys)\n \\<^item> Conversion from lookup tree to lookup lists\n \\<^item> Pre-computation of lookup results and domain/range sets\n\n See FastMap_Test for examples.\n\\\n\n(*\n * TODO:\n *\n * • Storing the auxilliary list theorems with Local_Theory.notes\n * takes quadratic time. Unfortunately, this seems to be a problem\n * deep inside the Isabelle implementation. One might try to wrap\n * the lists in new constants, but Local_Theory.define also takes\n * quadratic time.\n *\n * • Still a bit slower than the StaticFun package. Streamline the\n * rulesets and proofs.\n *\n * • We use a lot of manual convs for performance and to avoid\n * relying on the dynamic simpset. However, we should clean up the\n * convs and move as much as possible to (simp only:) invocations.\n *\n * Note that running simp on deeply nested terms (e.g. lists)\n * always takes quadratic time and we can't use it there. This is\n * because rewritec unconditionally calls eta_conversion (urgh).\n *\n * • The injectivity prover currently hardcodes inj_def into the\n * simpset. This should be changed at some point, probably by\n * asking the user to prove it beforehand.\n *\n * • The key ordering prover is currently hardcoded to simp_tac;\n * this should also be generalised. On the other hand, the user\n * could work around this by manually supplying a simpset with\n * precisely the needed theorems.\n *\n * • Using the simplifier to evaluate tree lookups is still quite\n * slow because it looks at the entire tree term (even though\n * most of it is irrelevant for any given lookup). We should\n * provide a tactic or simproc to do this.\n *\n * We already generate lookup theorems for keys in the map, so\n * this tactic should be optimised for missing keys.\n *\n * • The linorder requirement can be cumbersome. It arises because\n * we express the map_of conversion as a general theorem using\n * lookup_tree_valid. An alternative approach is to extend what\n * StaticFun does, and cleverly extract the set of all relevant\n * bindings from the tree on a case-by-case basis.\n *\n * We would still need to evaluate the key ordering function on\n * the input keys, but any arbitrary relation would be allowed.\n * This one probably calls for a wizard.\n *)\n\nlocale FastMap begin\n\ntext \\\n Binary lookup tree. This is largely an implementation detail, so we\n choose the structure to make automation easier (e.g. separate fields\n for the key and value).\n\n We could reuse HOL.Tree instead, but the proofs would need changing.\n\\\ndatatype ('k, 'v) Tree =\n Leaf\n | Node 'k 'v \"('k, 'v) Tree\" \"('k, 'v) Tree\"\n\nprimrec lookup_tree :: \"('k \\ 'ok :: linorder) \\ ('k, 'v) Tree \\ 'k \\ 'v option\"\n where\n \"lookup_tree key Leaf x = None\"\n | \"lookup_tree key (Node k v l r) x =\n (if key x = key k then Some v\n else if key x < key k then lookup_tree key l x\n else lookup_tree key r x)\"\n\ntext \\\n Predicate for well-formed lookup trees.\n This states that the keys are distinct and appear in ascending order.\n It also returns the lowest and highest keys in the tree (or None for empty trees).\n\\\nprimrec lookup_tree_valid ::\n \"('k \\ 'ok :: linorder) \\ ('k, 'v) Tree \\ bool \\ ('k \\ 'k) option\"\n where\n \"lookup_tree_valid key Leaf = (True, None)\"\n | \"lookup_tree_valid key (Node k v lt rt) =\n (let (lt_valid, lt_range) = lookup_tree_valid key lt;\n (rt_valid, rt_range) = lookup_tree_valid key rt;\n lt_low = (case lt_range of None \\ k | Some (low, high) \\ low);\n rt_high = (case rt_range of None \\ k | Some (low, high) \\ high)\n in (lt_valid \\ rt_valid \\\n (case lt_range of None \\ True | Some (low, high) \\ key high < key k) \\\n (case rt_range of None \\ True | Some (low, high) \\ key k < key low),\n Some (lt_low, rt_high)))\"\n\nlemma lookup_tree_valid_simps':\n \"lookup_tree_valid key Leaf = (True, None)\"\n \"lookup_tree_valid key (Node k v Leaf Leaf) = (True, Some (k, k))\"\n \"\\ lookup_tree_valid key (Node lk lv llt lrt) = (True, Some (llow, lhigh));\n key lhigh < key k\n \\ \\ lookup_tree_valid key (Node k v (Node lk lv llt lrt) Leaf) =\n (True, Some (llow, k))\"\n \"\\ lookup_tree_valid key (Node rk rv rlt rrt) = (True, Some (rlow, rhigh));\n key k < key rlow\n \\ \\ lookup_tree_valid key (Node k v Leaf (Node rk rv rlt rrt)) =\n (True, Some (k, rhigh))\"\n \"\\ lookup_tree_valid key (Node lk lv llt lrt) = (True, Some (llow, lhigh));\n lookup_tree_valid key (Node rk rv rlt rrt) = (True, Some (rlow, rhigh));\n key lhigh < key k;\n key k < key rlow\n \\ \\ lookup_tree_valid key (Node k v (Node lk lv llt lrt) (Node rk rv rlt rrt)) =\n (True, Some (llow, rhigh))\"\n by auto\n\nlemma lookup_tree_valid_empty:\n \"lookup_tree_valid key tree = (True, None) \\ tree = Leaf\"\n apply (induct tree)\n apply simp\n apply (fastforce split: prod.splits option.splits if_splits)\n done\n\nlemma lookup_tree_valid_range:\n \"lookup_tree_valid key tree = (True, Some (low, high)) \\ key low \\ key high\"\n apply (induct tree arbitrary: low high)\n apply simp\n apply (fastforce split: prod.splits option.splits if_splits)\n done\n\nlemma lookup_tree_valid_in_range:\n \"lookup_tree_valid key tree = (True, Some (low, high)) \\\n lookup_tree key tree k = Some v \\\n key k \\ {key low .. key high}\"\n apply (induct tree arbitrary: k v low high)\n apply simp\n apply (fastforce split: prod.splits option.splits if_split_asm\n dest: lookup_tree_valid_empty lookup_tree_valid_range)\n done\n\nlemma lookup_tree_valid_in_range_None:\n \"lookup_tree_valid key tree = (True, Some (low, high)) \\\n key k \\ {key low .. key high} \\\n lookup_tree key tree k = None\"\n using lookup_tree_valid_in_range by fastforce\n\ntext \\\n Flatten a lookup tree into an assoc-list.\n As long as the tree is well-formed, both forms are equivalent.\n\\\nprimrec lookup_tree_to_list :: \"('k, 'v) Tree \\ ('k \\ 'v) list\"\n where\n \"lookup_tree_to_list Leaf = []\"\n | \"lookup_tree_to_list (Node k v lt rt) =\n lookup_tree_to_list lt @ [(k, v)] @ lookup_tree_to_list rt\"\n\nlemma lookup_tree_to_list_range:\n \"lookup_tree_valid key tree = (True, Some (low, high)) \\\n (k, v) \\ set (lookup_tree_to_list tree) \\\n key k \\ {key low .. key high}\"\n apply (induct tree arbitrary: k v low high)\n apply simp\n apply (fastforce split: prod.splits option.splits if_split_asm\n dest: lookup_tree_valid_empty lookup_tree_valid_range)\n done\n\nlemma lookup_tree_dom_distinct_sorted_:\n \"fst (lookup_tree_valid key tree) \\\n distinct (lookup_tree_to_list tree) \\ sorted (map (key o fst) (lookup_tree_to_list tree))\"\n apply (induct tree)\n apply simp\n apply (fastforce simp: sorted_append\n split: prod.splits option.splits if_splits\n dest: lookup_tree_valid_empty lookup_tree_valid_range\n lookup_tree_valid_in_range lookup_tree_to_list_range\n elim: lookup_tree_valid_in_range_None)\n done\n\nlemmas lookup_tree_dom_distinct = lookup_tree_dom_distinct_sorted_[THEN conjunct1]\nlemmas lookup_tree_dom_sorted = lookup_tree_dom_distinct_sorted_[THEN conjunct2]\n\n(* This goal is eta-expanded and flipped, which seems to help its proof *)\nlemma lookup_tree_to_list_of_:\n \"fst (lookup_tree_valid key tree) \\\n map_of (map (apfst key) (lookup_tree_to_list tree)) (key k) = lookup_tree key tree k\"\n apply (induct tree arbitrary: k)\n apply simp\n (* this big blob just does case distinctions of both subtrees and\n all possible lookup results within each, then solves *)\n (* slow 10s *)\n by (fastforce simp: apfst_def map_prod_def map_add_def\n split: prod.splits option.splits if_splits\n dest: lookup_tree_valid_empty lookup_tree_valid_range lookup_tree_valid_in_range\n elim: lookup_tree_valid_in_range_None)\n\n(* Standard form of above *)\nlemma lookup_tree_to_list_of:\n \"fst (lookup_tree_valid key tree) \\\n lookup_tree key tree = map_of (map (apfst key) (lookup_tree_to_list tree)) o key\"\n apply (rule ext)\n apply (simp add: lookup_tree_to_list_of_)\n done\n\nlemma map_of_key:\n \"inj key \\ map_of (map (apfst key) binds) o key = map_of binds\"\n apply (rule ext)\n apply (induct binds)\n apply simp\n apply (clarsimp simp: inj_def dom_def)\n done\n\nlemma lookup_tree_to_list_of_distinct:\n \"\\ fst (lookup_tree_valid key tree);\n lookup_tree_to_list tree = binds;\n lookup_tree key tree = map_of (map (apfst key) binds) o key\n \\ \\ distinct (map (key o fst) binds)\"\n apply (drule sym[where t = binds])\n apply clarsimp\n apply (thin_tac \"binds = _\")\n apply (induct tree)\n apply simp\n apply (fastforce simp: map_add_def lookup_tree_to_list_of\n split: prod.splits option.splits if_splits\n dest: lookup_tree_valid_empty lookup_tree_valid_range\n lookup_tree_valid_in_range lookup_tree_to_list_range\n elim: lookup_tree_valid_in_range_None)\n done\n\n(* Top-level rule for converting to lookup list.\n We add a distinctness assertion for inferring the range of values. *)\nlemma lookup_tree_to_list_of_gen:\n \"\\ inj key;\n fst (lookup_tree_valid key tree);\n lookup_tree_to_list tree = binds\n \\ \\ lookup_tree key tree = map_of binds \\ distinct (map fst binds)\"\n using lookup_tree_to_list_of\n apply (fastforce intro: lookup_tree_to_list_of_distinct\n simp: map_of_key distinct_inj)\n done\n\ntext \\\n Domain and range of a @{const map_of}.\n Like @{thm dom_map_of_conv_image_fst} but leaving out the set bloat.\n\\\nlemma dom_map_of_conv_list:\n \"dom (map_of xs) = set (map fst xs)\"\n by (simp add: dom_map_of_conv_image_fst)\n\nlemma ran_map_of_conv_list:\n \"distinct (map fst xs) \\ ran (map_of xs) = set (map snd xs)\"\n by (erule distinct_map_via_ran)\n\ntext \\\n Read lookup rules from a @{const map_of}.\n\\\n\nlemma map_of_lookups:\n \"m = map_of binds \\ distinct (map fst binds) \\\n list_all (\\(k, v). m k = Some v) binds\"\n apply (induct binds)\n apply simp\n apply (force simp: list_all_iff)\n done\n\n(* Helper for converting from maps defined as @{const fun_upd} chains,\n * which are applied in reverse order *)\nlemma map_of_rev:\n \"distinct (map fst binds) \\\n map_of (rev binds) = map_of binds\"\n apply (subgoal_tac \"distinct (map fst (rev binds))\")\n apply (rule ext)\n apply (induct binds)\n apply simp\n apply (force simp: map_add_def split: option.splits)\n apply (metis distinct_rev rev_map)\n done\n\nlemma list_all_dest:\n \"list_all P [(x, y)] \\ P (x, y)\"\n \"list_all P ((x, y) # z # xs) \\ (P (x, y) \\ list_all P (z # xs))\"\n by auto\n\n(* Install lookup rules that don't depend on if_cong/if_weak_cong setup *)\nlemma lookup_tree_simps':\n \"lookup_tree key Leaf x = None\"\n \"key x = key k \\ lookup_tree key (Node k v l r) x = Some v\"\n \"key x < key k \\ lookup_tree key (Node k v l r) x = lookup_tree key l x\"\n \"key x > key k \\ lookup_tree key (Node k v l r) x = lookup_tree key r x\"\n by auto\nend\n\ndeclare FastMap.lookup_tree.simps[simp del]\ndeclare FastMap.lookup_tree_simps'[simp]\n\nML \\\nstructure FastMap = struct\n\n(* utils *)\nfun mk_optionT typ = Type (\"Option.option\", [typ])\nfun dest_optionT (Type (\"Option.option\", [typ])) = typ\n | dest_optionT t = raise TYPE (\"dest_optionT\", [t], [])\n\n(* O(1) version of thm RS @{thm eq_reflection} *)\nfun then_eq_reflection thm = let\n val (x, y) = Thm.dest_binop (Thm.dest_arg (Thm.cprop_of thm));\n val cT = Thm.ctyp_of_cterm x;\n val rule = @{thm eq_reflection} |> Thm.instantiate' [SOME cT] [SOME x, SOME y];\n in Thm.implies_elim rule thm end;\n\nval lhs_conv = Conv.fun_conv o Conv.arg_conv\nval rhs_conv = Conv.arg_conv\n(* first order rewr_conv *)\nfun fo_rewr_conv rule ct = let\n val (pure_eq, eqn) =\n ((true, Thm.instantiate (Thm.first_order_match (Thm.lhs_of rule, ct)) rule)\n handle TERM _ =>\n (false, Thm.instantiate (Thm.first_order_match\n (fst (Thm.dest_binop (Thm.dest_arg (Thm.cprop_of rule))), ct)) rule))\n handle Pattern.MATCH => raise CTERM (\"fo_rewr_conv\", [Thm.cprop_of rule, ct]);\n in if pure_eq then eqn else then_eq_reflection eqn end;\nfun fo_rewrs_conv rules = Conv.first_conv (map fo_rewr_conv rules);\n\n(* Evaluate a term with rewrite rules. Unlike the simplifier, this\n * does only one top-down pass, but that's enough for tasks like\n * pushing List.map through a list. Also runs much faster. *)\nfun fo_topdown_rewr_conv rules ctxt =\n Conv.top_conv (K (Conv.try_conv (fo_rewrs_conv rules))) ctxt\n\n(* Allow recursive conv in cv2, deferred by function application *)\ninfix 1 then_conv'\nfun (cv1 then_conv' cv2) ct =\n let\n val eq1 = cv1 ct;\n val eq2 = cv2 () (Thm.rhs_of eq1);\n in\n if Thm.is_reflexive eq1 then eq2\n else if Thm.is_reflexive eq2 then eq1\n else Thm.transitive eq1 eq2\n end;\n\n(*\n * Helper that makes it easier to describe where to apply a conv.\n * This takes a skeleton term and applies the conversion wherever \"HERE\"\n * appears in the skeleton.\n *\n * FIXME: use HOL-Library.Rewrite instead\n *)\nfun conv_at skel conv ctxt ct = let\n fun mismatch current_skel current_ct =\n raise TERM (\"conv_at mismatch\", [current_skel, Thm.term_of current_ct, skel, Thm.term_of ct])\n\n fun walk (Free (\"HERE\", _)) _ ct = conv ct\n | walk (skel as skel_f $ skel_x) ctxt ct =\n (case Thm.term_of ct of\n _ $ _ => Conv.combination_conv (walk skel_f ctxt) (walk skel_x ctxt) ct\n | _ => mismatch skel ct)\n | walk (skel as Abs (_, _, skel_body)) ctxt ct =\n (case Thm.term_of ct of\n Abs _ => Conv.abs_conv (fn (_, ctxt') => walk skel_body ctxt') ctxt ct\n | _ => mismatch skel ct)\n (* Also check that Consts match the skeleton pattern *)\n | walk (skel as Const (skel_name, _)) _ ct =\n if (case Thm.term_of ct of Const (name, _) => name = skel_name | _ => false)\n then Thm.reflexive ct\n else mismatch skel ct\n (* Default case *)\n | walk _ _ ct = Thm.reflexive ct\n in walk skel ctxt ct end\n\nfun gconv_at_tac pat conv ctxt = Conv.gconv_rule (conv_at pat conv ctxt) 1 #> Seq.succeed\n\n\n(* Tree builder code, copied from StaticFun *)\n\n(* Actually build the tree -- theta (n lg(n)) *)\nfun build_tree' _ mk_leaf [] = mk_leaf\n | build_tree' mk_node mk_leaf xs = let\n val len = length xs\n val (ys, zs) = chop (len div 2) xs\n in case zs of [] => error \"build_tree': impossible\"\n | ((a, b) :: zs) => mk_node a b (build_tree' mk_node mk_leaf ys)\n (build_tree' mk_node mk_leaf zs)\n end\n\nfun build_tree xs = case xs of [] => error \"build_tree : empty\"\n | (idx, v) :: _ => let\n val idxT = fastype_of idx\n val vT = fastype_of v\n val treeT = Type (@{type_name FastMap.Tree}, [idxT, vT])\n val mk_leaf = Const (@{const_name FastMap.Leaf}, treeT)\n val node = Const (@{const_name FastMap.Node},\n idxT --> vT --> treeT --> treeT --> treeT)\n fun mk_node a b l r = node $ a $ b $ l $ r\n in\n build_tree' mk_node mk_leaf xs\n end\n\nfun define_partial_map_tree map_name mappings ord_term ctxt = let\n val (idxT, vT) = apply2 fastype_of (hd mappings)\n val treeT = Type (@{type_name FastMap.Tree}, [idxT, vT])\n val lookup = Const (@{const_name FastMap.lookup_tree},\n fastype_of ord_term --> treeT --> idxT\n --> Type (@{type_name option}, [vT]))\n val map_term = lookup $ ord_term $ build_tree mappings\n val ((map_const, (_, map_def)), ctxt) =\n Local_Theory.define ((map_name, NoSyn), ((Thm.def_binding map_name, []), map_term)) ctxt\n in\n ((map_const, map_def), ctxt)\n end\n\n(* Prove key ordering theorems. This lets us issue precise error messages\n when the user gives us keys whose ordering cannot be verified.\n We will also need these thms to prove the lookup_tree_valid property. *)\nfun prove_key_ord_thms tree_name keyT mappings get_key simp_ctxt ctxt =\n let\n val solver = simp_tac (simp_ctxt ctxt [] []) 1;\n in\n fst (split_last mappings) ~~ tl mappings\n |> map_index (fn (i, ((k1, _), (k2, _))) => let\n val prop = Const (@{const_name less}, keyT --> keyT --> HOLogic.boolT) $\n (get_key $ k1) $ (get_key $ k2)\n |> HOLogic.mk_Trueprop;\n in case try (Goal.prove ctxt [] [] prop) (K solver) of\n SOME x => x\n | _ => raise TERM (tree_name ^ \": failed to prove less-than ordering for keys #\" ^\n string_of_int i ^ \", #\" ^ string_of_int (i + 1),\n [prop])\n end)\n end;\n\n(* Prove lookup_tree_valid *)\nfun prove_tree_valid tree_name mappings kT keyT tree_term get_key simp_ctxt ctxt = let\n val key_ord_thms = prove_key_ord_thms tree_name keyT mappings get_key simp_ctxt ctxt;\n val treeT = fastype_of tree_term\n val valid_resultT = HOLogic.mk_prodT (HOLogic.boolT, mk_optionT (HOLogic.mk_prodT (kT, kT)))\n val tree_valid_prop =\n HOLogic.mk_Trueprop (\n Const (@{const_name fst}, valid_resultT --> HOLogic.boolT) $\n (Const (@{const_name FastMap.lookup_tree_valid},\n (kT --> keyT) --> treeT --> valid_resultT) $\n get_key $ tree_term))\n val solver = simp_tac (put_simpset HOL_basic_ss ctxt\n addsimps (@{thms prod.sel FastMap.lookup_tree_valid_simps'} @\n key_ord_thms)) 1\n in Goal.prove ctxt [] [] tree_valid_prop (K solver) end\n\nfun solve_simp_tac name ctxt = SUBGOAL (fn (t, i) =>\n (simp_tac ctxt THEN_ALL_NEW SUBGOAL (fn (t', _) =>\n raise TERM (name ^ \": unsolved\", [t, t']))) i)\n\nfun convert_to_lookup_list kT valT mappings map_const map_def tree_valid_thm simp_ctxt ctxt = let\n val lookupT = fastype_of map_const\n (* map_eq = \" = map_of \" *)\n val bindT = HOLogic.mk_prodT (kT, valT)\n val lookup_list = HOLogic.mk_list bindT (map HOLogic.mk_prod mappings)\n val map_of_Const = Const (@{const_name map_of}, HOLogic.listT bindT --> lookupT)\n val map_eq = HOLogic.mk_eq (map_const, map_of_Const $ lookup_list)\n (* distinct_pred = \"distinct (map fst )\" *)\n val distinct_pred =\n Const (@{const_name distinct}, HOLogic.listT kT --> HOLogic.boolT) $\n (Const (@{const_name map}, (bindT --> kT) --> HOLogic.listT bindT --> HOLogic.listT kT) $\n Const (@{const_name fst}, bindT --> kT) $\n lookup_list)\n val convert_prop = HOLogic.mk_Trueprop (\n HOLogic.mk_conj (map_eq, distinct_pred)\n )\n fun TIMED desc tac = fn st =>\n Seq.make (K (Timing.timeap_msg (\"tactic timing for \" ^ desc)\n (fn () => Seq.pull (tac st)) ()))\n\n val append_basecase = @{thm append.simps(1)}\n val append_rec = @{thm append.simps(2)}\n val lookup_tree_to_list_basecase = @{thm FastMap.lookup_tree_to_list.simps(1)}\n val lookup_tree_to_list_rec = @{thm FastMap.lookup_tree_to_list.simps(2)[simplified append.simps]}\n\n val lookup_tree_to_list_eval = let\n fun append_conv () =\n fo_rewr_conv append_basecase else_conv\n (fo_rewr_conv append_rec then_conv'\n (fn () => rhs_conv (append_conv ())))\n fun to_map_conv () =\n fo_rewr_conv lookup_tree_to_list_basecase else_conv\n (fo_rewr_conv lookup_tree_to_list_rec then_conv'\n (fn () => lhs_conv (to_map_conv ())) then_conv'\n (fn () => rhs_conv (rhs_conv (to_map_conv ()))) then_conv\n append_conv ())\n in to_map_conv () end\n\n val solver =\n TIMED \"unfold\" (gconv_at_tac @{term \"Trueprop (HERE = map_of dummy1 \\ dummy2)\"}\n (K map_def) ctxt)\n THEN\n TIMED \"main rule\" (resolve_tac ctxt @{thms FastMap.lookup_tree_to_list_of_gen} 1)\n THEN\n TIMED \"solve inj\" (solve_simp_tac \"solve inj\"\n (simp_ctxt ctxt @{thms simp_thms} @{thms inj_def}) 1)\n THEN\n TIMED \"resolve valid\" (resolve_tac ctxt [tree_valid_thm] 1)\n THEN\n TIMED \"convert tree\" (gconv_at_tac @{term \"Trueprop (HERE = dummy1)\"}\n lookup_tree_to_list_eval ctxt)\n THEN\n resolve_tac ctxt @{thms refl} 1\n val convert_thm = Goal.prove ctxt [] [] convert_prop (K solver)\n in convert_thm end\n\n(* Obtain domain and range from lookup list *)\nfun domain_range_common dom_ran_const xT xs map_const lookup_list_eqn intro_conv_tac ctxt = let\n val mapT = fastype_of map_const\n val prop = HOLogic.mk_Trueprop (\n HOLogic.mk_eq (\n Const (dom_ran_const, mapT --> HOLogic.mk_setT xT) $ map_const,\n Const (@{const_name set}, HOLogic.listT xT --> HOLogic.mk_setT xT) $\n (HOLogic.mk_list xT xs)\n ))\n val lookup_list_eqn' = then_eq_reflection lookup_list_eqn\n val map_fst_snd_conv = fo_topdown_rewr_conv @{thms list.map prod.sel} ctxt\n val solver =\n (gconv_at_tac @{term \"Trueprop (dom_ran_dummy1 HERE = dummy2)\"}\n (K lookup_list_eqn') ctxt)\n THEN\n intro_conv_tac\n THEN\n gconv_at_tac @{term \"Trueprop (HERE = dummy1)\"} map_fst_snd_conv ctxt\n THEN\n resolve_tac ctxt @{thms refl} 1\n in Goal.prove ctxt [] [] prop (K solver) end;\n\nfun tree_domain kT mappings map_const lookup_list_eqn ctxt =\n domain_range_common\n @{const_name dom} kT (map fst mappings) map_const lookup_list_eqn\n (* like (subst dom_map_of_conv_list) but faster *)\n (resolve_tac ctxt @{thms FastMap.dom_map_of_conv_list[THEN trans]} 1)\n ctxt;\n\nfun tree_range valT mappings map_const lookup_list_eqn map_distinct_thm ctxt =\n domain_range_common\n @{const_name ran} valT (map snd mappings) map_const lookup_list_eqn\n (* like (subst ran_map_of_conv_list) but faster *)\n (resolve_tac ctxt @{thms FastMap.ran_map_of_conv_list[THEN trans]} 1 THEN\n resolve_tac ctxt [map_distinct_thm] 1)\n ctxt;\n\n\n(* Choosing names for the const and its theorems. The constant will be named with\n map_name; Local_Theory.define may also add extra names (e.g. _def) *)\ntype name_opts = {\n map_name: string,\n tree_valid_thm: string,\n to_lookup_list: string,\n keys_distinct_thm: string,\n lookup_thms: string,\n domain_thm: string,\n range_thm: string\n};\n\nfun name_opts_default (map_name: string): name_opts = {\n map_name = map_name,\n tree_valid_thm = map_name ^ \"_tree_valid\",\n to_lookup_list = map_name ^ \"_to_lookup_list\",\n keys_distinct_thm = map_name ^ \"_keys_distinct\",\n lookup_thms = map_name ^ \"_lookups\",\n domain_thm = map_name ^ \"_domain\",\n range_thm = map_name ^ \"_range\"\n};\n\n(* Top level interface *)\nfun define_map\n (name_opts: name_opts)\n (mappings: (term * term) list)\n (get_key: term) (* function to get linorder key, must be injective *)\n (extra_simps: thm list)\n (minimal_simp: bool) (* true: start with minimal simpset; extra_simps must be adequate *)\n ctxt = let\n fun simp_ctxt ctxt basic_simps more_simps = if minimal_simp\n then put_simpset HOL_basic_ss ctxt addsimps (basic_simps @ extra_simps @ more_simps)\n else ctxt addsimps (extra_simps @ more_simps)\n\n val (kT, keyT) = dest_funT (fastype_of get_key)\n val valT = fastype_of (snd (hd mappings))\n\n val _ = tracing (#map_name name_opts ^ \": defining tree\")\n val start = Timing.start ()\n val ((map_const, map_def), ctxt) =\n define_partial_map_tree\n (Binding.name (#map_name name_opts))\n mappings get_key ctxt\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n\n val _ = tracing (#map_name name_opts ^ \": proving tree is well-formed\")\n val start = Timing.start ()\n val _ $ _ $ tree_term = Thm.term_of (Thm.rhs_of map_def)\n val tree_valid_thm =\n prove_tree_valid (#map_name name_opts) mappings kT keyT tree_term get_key simp_ctxt ctxt\n val (_, ctxt) = ctxt |> Local_Theory.notes\n [((Binding.name (#tree_valid_thm name_opts), []), [([tree_valid_thm], [])])]\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n\n val _ = tracing (#map_name name_opts ^ \": converting tree to map\")\n val start = Timing.start ()\n val convert_thm =\n convert_to_lookup_list kT valT mappings map_const map_def tree_valid_thm simp_ctxt ctxt\n val [lookup_list_eqn, map_distinct_thm] = HOLogic.conj_elims ctxt convert_thm\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n val _ = tracing (#map_name name_opts ^ \": storing map and distinctness theorems\")\n val start = Timing.start ()\n val (_, ctxt) = ctxt |> Local_Theory.notes\n [((Binding.name (#to_lookup_list name_opts), []), [([lookup_list_eqn], [])]),\n ((Binding.name (#keys_distinct_thm name_opts), []), [([map_distinct_thm], [])])]\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n\n val _ = tracing (#map_name name_opts ^ \": obtaining lookup rules\")\n val start = Timing.start ()\n fun dest_list_all_conv () =\n fo_rewr_conv @{thm FastMap.list_all_dest(1)} else_conv\n (fo_rewr_conv @{thm FastMap.list_all_dest(2)} then_conv'\n (fn () => rhs_conv (dest_list_all_conv())))\n val combined_lookup_thm =\n (convert_thm RS @{thm FastMap.map_of_lookups})\n |> Conv.fconv_rule (conv_at @{term \"Trueprop HERE\"} (dest_list_all_conv ()) ctxt)\n val _ = tracing (\" splitting... \" ^ Timing.message (Timing.result start))\n val lookup_thms =\n HOLogic.conj_elims ctxt combined_lookup_thm\n |> map (Conv.fconv_rule (conv_at @{term \"Trueprop HERE\"}\n (fo_rewr_conv @{thm prod.case[THEN eq_reflection]}) ctxt))\n\n val _ = if length lookup_thms = length mappings then () else\n raise THM (\"wrong number of lookup thms: \" ^ string_of_int (length lookup_thms) ^\n \" instead of \" ^ string_of_int (length mappings), 0,\n lookup_thms)\n val (_, ctxt) = ctxt |> Local_Theory.notes\n [((Binding.name (#lookup_thms name_opts), []), [(lookup_thms, [])])]\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n\n (* domain and range *)\n val _ = tracing (#map_name name_opts ^ \": getting domain and range\")\n val start = Timing.start ()\n val domain_thm = timeap_msg \" calculate domain\"\n (tree_domain kT mappings map_const lookup_list_eqn) ctxt\n val range_thm = timeap_msg \" calculate range\"\n (tree_range valT mappings map_const lookup_list_eqn map_distinct_thm) ctxt\n val (_, ctxt) = ctxt |> Local_Theory.notes\n [((Binding.name (#domain_thm name_opts), []), [([domain_thm], [])]),\n ((Binding.name (#range_thm name_opts), []), [([range_thm], [])])]\n val _ = tracing (\" done: \" ^ Timing.message (Timing.result start))\n in ctxt end\n\nend\n\\\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/FastMap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.44552953503957277, "lm_q1q2_score": 0.2756849589374827}} {"text": "theory IICF_List_MsetO\nimports \"../Intf/IICF_Multiset\"\nbegin\n\n definition \"lmso_assn A \\ hr_comp (list_assn A) (br mset (\\_. True))\"\n lemmas [fcomp_norm_unfold] = lmso_assn_def[symmetric]\n\n lemma lmso_is_pure[safe_constraint_rules]: \"is_pure A \\ is_pure (lmso_assn A)\"\n unfolding lmso_assn_def by safe_constraint\n\n lemma lmso_empty_aref: \"(uncurry0 (RETURN []), uncurry0 (RETURN op_mset_empty)) \\ unit_rel \\\\<^sub>f \\br mset (\\_. True)\\nres_rel\"\n by (auto intro!: frefI nres_relI simp: in_br_conv)\n \n (* \n definition [simp]: \"list_single x \\ [x]\"\n lemma lmso_single_aref: \"(RETURN o list_single,RETURN o op_mset_single) \\ Id \\\\<^sub>f \\br mset (\\_. True)\\nres_rel\" \n by (auto intro!: frefI nres_relI simp: in_br_conv)\n *) \n\n lemma lmso_is_empty_aref: \"(RETURN o List.null, RETURN o op_mset_is_empty) \\ br mset (\\_. True) \\\\<^sub>f \\bool_rel\\nres_rel\" \n by (auto intro!: frefI nres_relI simp: in_br_conv List.null_def split: list.split)\n\n\n lemma lmso_insert_aref: \"(uncurry (RETURN oo (#) ), uncurry (RETURN oo op_mset_insert)) \\ (Id \\\\<^sub>r br mset (\\_. True)) \\\\<^sub>f \\br mset (\\_. True)\\nres_rel\" \n by (auto intro!: frefI nres_relI simp: in_br_conv)\n \n (* \n lemma list_single_hnr: \"(return o list_single, RETURN o list_single) \\ A\\<^sup>d \\\\<^sub>a list_assn A\" \n apply sepref_to_hoare\n apply sep_auto\n done \n *)\n \n definition [simp]: \"hd_tl l \\ (hd l, tl l)\"\n\n lemma hd_tl_opt[sepref_opt_simps]: \"hd_tl l = (case l of (x#xs) \\ (x,xs) | _ \\ CODE_ABORT (\\_. (hd l, tl l)))\" \n by (auto split: list.split)\n\n lemma lmso_pick_aref: \"(RETURN o hd_tl,op_mset_pick) \\ [\\m. m\\{#}]\\<^sub>f br mset (\\_. True) \\ \\Id \\\\<^sub>r br mset (\\_. True)\\nres_rel\" \n by (auto intro!: frefI nres_relI simp: in_br_conv pw_le_iff refine_pw_simps neq_Nil_conv algebra_simps)\n \n lemma hd_tl_hnr: \"(return o hd_tl,RETURN o hd_tl) \\ [\\l. \\is_Nil l]\\<^sub>a (list_assn A)\\<^sup>d \\ prod_assn A (list_assn A)\"\n apply sepref_to_hoare\n subgoal for l li by (cases l; cases li; sep_auto)\n done \n\n sepref_decl_impl (no_register) lmso_empty: hn_Nil[to_hfref] uses lmso_empty_aref .\n definition [simp]: \"op_lmso_empty \\ op_mset_empty\"\n sepref_register op_lmso_empty\n lemma lmso_fold_custom_empty: \n \"{#} = op_lmso_empty\"\n \"op_mset_empty = op_lmso_empty\"\n \"mop_mset_empty = RETURN op_lmso_empty\"\n by auto\n lemmas [sepref_fr_rules] = lmso_empty_hnr[folded op_lmso_empty_def] \n\n (*\n sepref_decl_impl (no_register) lmso_single: list_single_hnr uses lmso_single_aref .\n definition [simp]: \"op_lmso_single \\ op_mset_single\"\n sepref_register op_lmso_single\n lemma lmso_fold_custom_single: \n \"{#x#} = op_lmso_single x\"\n \"op_mset_single x = op_lmso_single x\"\n \"mop_mset_single x = RETURN (op_lmso_single x)\"\n by auto\n lemmas [sepref_fr_rules] = lmso_single_hnr[folded op_lmso_single_def] \n *) \n\n \n\n sepref_decl_impl lmso_is_empty: list_null_hnr uses lmso_is_empty_aref .\n\n sepref_decl_impl lmso_insert: hn_Cons[to_hfref] uses lmso_insert_aref .\n\n (* As parametricity heuristics of sepref_decl_impl fails here,\n we use FCOMP and some dummy-lemma to still get the automation benefits of \n sepref_decl_impl. *)\n context notes [simp] = in_br_conv and [split] = list.splits begin\n text \\Dummy lemma, to exloit \\sepref_decl_impl\\ automation without parametricity stuff.\\\n private lemma op_mset_pick_dummy_param: \"(op_mset_pick, op_mset_pick) \\ Id \\\\<^sub>f \\Id\\nres_rel\" \n by (auto intro!: frefI nres_relI)\n\n sepref_decl_impl lmso_pick: hd_tl_hnr[FCOMP lmso_pick_aref] uses op_mset_pick_dummy_param by simp\n end \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/IICF_List_MsetO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27567241587655955}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__1_on_rules imports n_mutualEx_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.39981164073979497, "lm_q1q2_score": 0.2755924096181455}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Andrew Boyton, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\nchapter \"Defining some separation logic maps-to predicates on top of the instantiation.\"\n\ntheory Separation_D\nimports Abstract_Separation_D\nbegin\n\ntype_synonym sep_pred = \"sep_state \\ bool\"\n\ndefinition\n state_sep_projection :: \"cdl_state \\ sep_state\"\nwhere\n \"state_sep_projection \\ \\s. SepState (cdl_objects s) (cdl_ghost_state s)\"\n\n(* This turns a separation logic predicate into a predicate on the capDL state. *)\nabbreviation\n lift' :: \"(sep_state \\ 'a) \\ cdl_state \\ 'a\" (\"<_>\")\nwhere\n \"

s \\ P (state_sep_projection s)\"\n\n(* The generalisation of the maps to operator for separation logic. *)\ndefinition\n sep_map_general :: \"cdl_object_id \\ cdl_object \\ cdl_components \\ sep_pred\"\nwhere\n \"sep_map_general p obj gs \\ \\s. sep_heap s = [p \\ obj] \\ sep_ghost_state s p = gs\"\n\n(* Alternate definition without the [p \\ obj] notation. *)\nlemma sep_map_general_def2:\n \"sep_map_general p obj gs s =\n (dom (sep_heap s) = {p} \\ ko_at obj p (sep_heap s) \\ sep_ghost_state s p = gs)\"\n apply (clarsimp simp: sep_map_general_def object_at_def)\n apply (rule)\n apply clarsimp\n apply (clarsimp simp: fun_upd_def)\n apply (rule ext)\n apply (fastforce simp: dom_def split:if_split)\n done\n\n(* There is an object there. *)\ndefinition\n sep_map_i :: \"cdl_object_id \\ cdl_object \\ sep_pred\" (\"_ \\i _\" [76,71] 76)\nwhere\n \"p \\i obj \\ sep_map_general p obj UNIV\"\n\n(* The fields are there (and there are no caps). *)\ndefinition\n sep_map_f :: \"cdl_object_id \\ cdl_object \\ sep_pred\" (\"_ \\f _\" [76,71] 76)\nwhere\n \"p \\f obj \\ sep_map_general p (update_slots empty obj) {None}\"\n\n(* There is that cap there. *)\ndefinition\n sep_map_c :: \"cdl_cap_ref \\ cdl_cap \\ sep_pred\" (\"_ \\c _\" [76,71] 76)\nwhere\n \"p \\c cap \\ \\s. let (obj_id, slot) = p; heap = sep_heap s in\n \\obj. sep_map_general obj_id obj {Some slot} s \\ object_slots obj = [slot \\ cap]\"\n\ndefinition\n sep_any :: \"('a \\ 'b \\ sep_pred) \\ ('a \\ sep_pred)\" where\n \"sep_any m \\ (\\p s. \\v. (m p v) s)\"\n\nabbreviation \"sep_any_map_i \\ sep_any sep_map_i\"\nnotation sep_any_map_i (\"_ \\i -\" 76)\n\nabbreviation \"sep_any_map_c \\ sep_any sep_map_c\"\nnotation sep_any_map_c (\"_ \\c -\" 76)\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/ex/capDL/Separation_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.27556782027100685}} {"text": "section \\Control Flow Graph\\\ntheory SM_Cfg\nimports \n SM_Syntax \n \"../Lib/LTS\" \n \"../Lib/SOS_Misc_Add\" \nbegin\n text \\\n We define the control flow graph of SM, in the style of\n an structural operational semantics.\n\\\n\n\n text \\\n The edges of the CFG are labeled with actions. These are\n assignments, tests, and skip.\n Assignment actions come in three versions: Assignment to local variables,\n assignment to global variables, and assignment to variables without\n specification of a scope. These will be mapped to local or global variables,\n depending on the scope.\n\\\n datatype action = \n AAssign exp ident exp | AAssign_local exp ident exp | AAssign_global exp ident exp\n | ATest exp | ASkip\n\n text \\\n Moreover, the semantics uses internal actions to handle break and continue\n statements. For well-formed programs, this type of actions will\n never be exposed\n\\\n datatype brk_ctd = AIBreak | AIContinue\n\n text \\\n The control flow graph is a graph over commands, labeled with actions\n\\\n inductive cfg :: \"cmd \\ (action + brk_ctd) \\ cmd \\ bool\" where\n Ass: \"cfg (Assign c x e) (Inl (AAssign c x e)) Skip\"\n | Assl: \"cfg (Assign_local c x e) (Inl (AAssign_local c x e)) Skip\"\n | Assg: \"cfg (Assign_global c x e) (Inl (AAssign_global c x e)) Skip\"\n | Test: \"cfg (Test e) (Inl (ATest e)) Skip\"\n\n | Seq1: \"cfg (Seq Skip c2) (Inl ASkip) c2\"\n | Seq2': \"\\ cfg c1 e Skip \\ \\ cfg (Seq c1 c2) e c2\"\n | Seq2: \"\\ cfg c1 e c1'; c1'\\Skip \\ \\ cfg (Seq c1 c2) e (Seq c1' c2)\"\n\n | Or1: \"cfg c1 e c1' \\ cfg (Or c1 c2) e c1'\"\n | Or2: \"cfg c2 e c2' \\ cfg (Or c1 c2) e c2'\"\n\n | Break: \"cfg (Break) (Inr AIBreak) Invalid\"\n | Continue: \"cfg (Continue) (Inr AIContinue) Invalid\"\n \n | Iterate1: \"cfg (Iterate Skip c) (Inl ASkip) (Iterate c c)\"\n | Iterate2': \"\\ cfg c (Inl e) Skip \\ \\ cfg (Iterate c cb) (Inl e) (Iterate cb cb)\"\n | Iterate2: \"\\ cfg c (Inl e) c'; c'\\Skip \\ \\ cfg (Iterate c cb) (Inl e) (Iterate c' cb)\"\n | IterateBrk: \"\\ cfg c (Inr AIBreak) _ \\ \\ cfg (Iterate c cb) (Inl ASkip) Skip\"\n | IterateCtd: \"\\ cfg c (Inr AIContinue) _ \\ \\ cfg (Iterate c cb) (Inl ASkip) (Iterate cb cb)\"\n\n inductive_cases Seq_cases: \"cfg (Seq c1 c2) e c'\"\n\nsection \\Reachable Nodes\\\n\ninterpretation cfg_lts: LTS cfg .\n\ntext \\Finite set of reachable CFG nodes\\\n\nprimrec reachable_term_order_aux :: \"cmd \\ nat\" where\n \"reachable_term_order_aux (Assign c x e) = 0\"\n| \"reachable_term_order_aux (Assign_local c x e) = 0\"\n| \"reachable_term_order_aux (Assign_global c x e) = 0\"\n| \"reachable_term_order_aux (Test e) = 0\"\n| \"reachable_term_order_aux (Skip) = 0\"\n| \"reachable_term_order_aux (Seq c1 c2) = reachable_term_order_aux c1 + reachable_term_order_aux c2\"\n| \"reachable_term_order_aux (Or c1 c2) = reachable_term_order_aux c1 + reachable_term_order_aux c2\"\n| \"reachable_term_order_aux (Break) = 0\"\n| \"reachable_term_order_aux (Continue) = 0\"\n| \"reachable_term_order_aux (Iterate c1 c2) = reachable_term_order_aux c1 + reachable_term_order_aux c2\"\n| \"reachable_term_order_aux Invalid = 0\"\n\nfunction approx_reachable :: \"cmd \\ cmd set\" where\n \"approx_reachable (Assign c x e) = {Assign c x e, Skip}\"\n| \"approx_reachable (Assign_local c x e) = {Assign_local c x e, Skip}\"\n| \"approx_reachable (Assign_global c x e) = {Assign_global c x e, Skip}\"\n| \"approx_reachable (Test e) = {Test e, Skip}\"\n| \"approx_reachable (Skip) = {Skip}\"\n| \"approx_reachable (Seq c1 c2) = (approx_reachable c2) \\ (do { c1\\approx_reachable c1; {Seq c1 c2} })\"\n| \"approx_reachable (Or c1 c2) = insert (Or c1 c2) (approx_reachable c1 \\ approx_reachable c2)\"\n| \"approx_reachable (Break) = {Break,Invalid}\"\n| \"approx_reachable (Continue) = {Continue,Invalid}\"\n| \"approx_reachable (Iterate c1 c2) = insert Skip\n (do { c1\\approx_reachable c1; {Iterate c1 c2} })\n \\ (do { c2'\\approx_reachable c2; {Iterate c2' c2} })\"\n| \"approx_reachable Invalid = {Invalid}\"\nby pat_completeness auto\n\ntermination\n apply (relation \"reachable_term_order_aux <*mlex*> measure size\")\n apply (metis wf_measure wf_mlex)\n apply (auto simp: mlex_prod_def)\n done\n\nlemma finite_approx_reachable[simp, intro!]: \"finite (approx_reachable c)\"\n by (induction c rule: approx_reachable.induct) auto\n\nlemma approx_reachable_refl[simp]: \"c\\approx_reachable c\"\n by (induction c rule: approx_reachable.induct) auto\n\nlemma approx_reachable_closed:\n assumes \"c\\approx_reachable c0\"\n assumes \"cfg c a c'\"\n shows \"c'\\approx_reachable c0\"\n using assms\n apply (induction c0 arbitrary: c c' rule: approx_reachable.induct)\n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) []\n apply (auto elim: cfg.cases) []\n apply (auto, erule cfg.cases, simp_all, force+) []\n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) [] \n apply (auto elim: cfg.cases) []\n apply (auto elim: cfg.cases) [] \n done\n\nlemma approx_reachable_approx: \"cfg_lts.reachable c c' \\ c'\\approx_reachable c\"\n unfolding cfg_lts.reachable_def\nproof safe\n fix p\n assume \"cfg_lts.path c p c'\"\n thus \"c'\\approx_reachable c\"\n by (induction p arbitrary: c' rule: rev_induct)\n (auto intro: approx_reachable_closed)\nqed\n\nlemma finite_cfg_reachable: \"finite (Collect (cfg_lts.reachable c))\"\n apply (rule finite_subset[OF _ finite_approx_reachable])\n using approx_reachable_approx by auto\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/RefPoint/SM_Cfg.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2755316336191705}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ProcParEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2007-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Procedures as Parameters using Statespaces\"\ntheory ProcParExSP imports \"../Vcg\" begin\n\n\n\n\n\n\n\nlemma conseq_exploit_pre':\n \"\\\\s \\ S. \\,\\ \\ ({s} \\ P) c Q,A\\\n \\\n \\,\\\\ (P \\ S)c Q,A\"\n apply (rule HoarePartialDef.Conseq)\n apply clarify\n by (metis IntI insertI1 subset_refl)\n\nlemma conseq_exploit_pre'':\n \"\\\\Z. \\s \\ S Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S Z)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\nlemma conseq_exploit_pre''':\n \"\\\\s \\ S. \\Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\n\nprocedures compare(i::nat,j::nat|r::bool) \"NoBody\"\n\n\nprint_locale! compare_signature\n\n\ncontext compare_impl\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\r :== CALL compare(\\i,\\j)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n(* FIXME: typing issue with modifies locale*)\nprocedures\n LEQ (i::nat,j::nat | r::bool) \"\\r :== \\i \\ \\j\"\n LEQ_spec: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) \\\\r = (\\<^bsup>\\\\<^esup>i \\ \\<^bsup>\\\\<^esup>j)\\\"\n\n LEQ_modifies: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) {t. t may_only_modify_globals \\ in []}\"\n\n\n\ndefinition mx:: \"('a \\ 'a \\ bool) \\ 'a \\ 'a \\ 'a\"\n where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures (imports compare_signature)\n Max (compare::string, n::nat, m::nat | k::nat)\n where b::bool\n in\n \"\\b :== DYNCALL \\compare(\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\"\n\n Max_spec: \"\\leq. \\\\. \\\\\n ({\\} \\ {s. (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\\n (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})})\n PROC Max(\\compare,\\n,\\m,\\k)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n\ncontext Max_spec\nbegin\nthm Max_spec\nend\ncontext Max_impl\nbegin\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n\nlemma (in Max_impl ) Max_spec1:\nshows\n\"\\\\ leq. \\\\\n ({\\} \\ \\ (\\\\. \\\\{\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\\n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n fix \\:: \"('a, 'b, 'c, 'd) stateSP_scheme\" and s::\"('a, 'b, 'c, 'd) stateSP_scheme\" and leq\n assume compare_spec:\n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j\\\"\n\n assume compare_modifies:\n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j)\n {t. t may_only_modify_globals \\ in []}\"\n\n show \"\\\\({s} \\ {\\})\n \\b :== DYNCALL \\compare (\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n apply vcg\n apply (clarsimp simp add: mx_def)\n done\n qed\n\n\nlemma (in Max_impl) Max_spec2:\nshows\n\"\\\\ leq. \\\\\n ({\\} \\ \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\\n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3:\nshows\n\"\\n m leq. \\\\\n (\\\\n=n \\ \\m=m\\ \\\n \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\\n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nprint_locale Max_spec\n\n(* We have to rename the parameters of the compare procedure to match the LEQ procedure *)\nlocale Max_test = Max_spec where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_spec + LEQ_modifies\n\nlemma (in Max_test)\n shows\n \"\\\\ {\\} \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (\\) \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\nproof -\n note Max_spec = Max_spec [where leq=\"(\\)\"]\n show ?thesis\n apply vcg\n apply (clarsimp)\n apply (rule conjI)\n apply (rule LEQ_spec)\n apply (rule LEQ_modifies)\n done\nqed\n\n\n\n\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\n m leq. \\\\\n (\\\\n=n \\ \\m=m\\ \\ \\\\n' m'. \\\\ \\\\i=n' \\ \\j=m'\\ \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq n' m')\\\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\n m. \\\\ \\\\i=n \\ \\j=m\\ PROC LEQ(\\i,\\j,\\r) \\\\r = (n \\ m)\\\"\n apply vcg\n apply simp\n done\n\n\nprint_locale Max_impl\nlocale Max_test' = Max_impl where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_impl\nlemma (in Max_test')\n shows\n \"\\n m. \\\\ \\\\n=n \\ \\m=m\\ \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (\\) n m\\\"\nproof -\n note Max_spec = Max_spec5\n show ?thesis\n apply vcg\n apply (rule_tac x=\"(\\)\" in exI)\n apply clarsimp\n apply (rule LEQ_spec [rule_format])\n done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/ProcParExSP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2755047358918898}} {"text": "section \\\\isaheader{Specification of Sequences}\\\ntheory ListSpec \nimports ICF_Spec_Base\nbegin\n\n(*@intf List\n @abstype 'a list\n This interface specifies sequences.\n*)\n\nsubsection \"Definition\"\nlocale list =\n \\ \\Abstraction to HOL-lists\\\n fixes \\ :: \"'s \\ 'x list\"\n \\ \\Invariant\\\n fixes invar :: \"'s \\ bool\"\n\nlocale list_no_invar = list +\n assumes invar[simp, intro!]: \"\\l. invar l\"\n\nsubsection \"Functions\"\n\nlocale list_empty = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes empty :: \"unit \\ 's\"\n assumes empty_correct:\n \"\\ (empty ()) = []\"\n \"invar (empty ())\"\n\n\nlocale list_isEmpty = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes isEmpty :: \"'s \\ bool\"\n assumes isEmpty_correct:\n \"invar s \\ isEmpty s \\ \\ s = []\"\n\nlocale poly_list_iteratei = list +\n constrains \\ :: \"'s \\ 'x list\"\nbegin \n definition iteratei where\n iteratei_correct[code_unfold]: \"iteratei s \\ foldli (\\ s)\"\n definition iterate where\n iterate_correct[code_unfold]: \"iterate s \\ foldli (\\ s) (\\_. True)\"\nend\n\nlocale poly_list_rev_iteratei = list +\n constrains \\ :: \"'s \\ 'x list\"\nbegin \n definition rev_iteratei where\n rev_iteratei_correct[code_unfold]: \"rev_iteratei s \\ foldri (\\ s)\"\n definition rev_iterate where\n rev_iterate_correct[code_unfold]: \"rev_iterate s \\ foldri (\\ s) (\\_. True)\"\nend\n\n(*\nlocale list_iteratei = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes iteratei :: \"'s \\ ('x,'\\) set_iterator\"\n assumes iteratei_correct:\n \"invar s \\ iteratei s = foldli (\\ s)\"\nbegin\n lemma iteratei_no_sel_rule:\n \"invar s \\ distinct (\\ s) \\ set_iterator (iteratei s) (set (\\ s))\"\n by (simp add: iteratei_correct set_iterator_foldli_correct)\nend\n\nlemma list_iteratei_iteratei_linord_rule:\n \"list_iteratei \\ invar iteratei \\ invar s \\ distinct (\\ s) \\ sorted (\\ s) \\\n set_iterator_linord (iteratei s) (set (\\ s))\"\n by (simp add: list_iteratei_def set_iterator_linord_foldli_correct)\n\nlemma list_iteratei_iteratei_rev_linord_rule:\n \"list_iteratei \\ invar iteratei \\ invar s \\ distinct (\\ s) \\ sorted (rev (\\ s)) \\\n set_iterator_rev_linord (iteratei s) (set (\\ s))\"\n by (simp add: list_iteratei_def set_iterator_rev_linord_foldli_correct)\n\n\nlocale list_reverse_iteratei = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes reverse_iteratei :: \"'s \\ ('x,'\\) set_iterator\"\n assumes reverse_iteratei_correct:\n \"invar s \\ reverse_iteratei s = foldri (\\ s)\"\nbegin\n lemma reverse_iteratei_no_sel_rule:\n \"invar s \\ distinct (\\ s) \\ set_iterator (reverse_iteratei s) (set (\\ s))\"\n by (simp add: reverse_iteratei_correct set_iterator_foldri_correct)\nend\n\nlemma list_reverse_iteratei_iteratei_linord_rule:\n \"list_reverse_iteratei \\ invar iteratei \\ invar s \\ distinct (\\ s) \\ sorted (rev (\\ s)) \\\n set_iterator_linord (iteratei s) (set (\\ s))\"\n by (simp add: list_reverse_iteratei_def set_iterator_linord_foldri_correct)\n\nlemma list_reverse_iteratei_iteratei_rev_linord_rule:\n \"list_reverse_iteratei \\ invar iteratei \\ invar s \\ distinct (\\ s) \\ sorted (\\ s) \\\n set_iterator_rev_linord (iteratei s) (set (\\ s))\"\n by (simp add: list_reverse_iteratei_def set_iterator_rev_linord_foldri_correct)\n*)\n\nlocale list_size = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes size :: \"'s \\ nat\"\n assumes size_correct:\n \"invar s \\ size s = length (\\ s)\"\n \nlocale list_appendl = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes appendl :: \"'x \\ 's \\ 's\"\n assumes appendl_correct:\n \"invar s \\ \\ (appendl x s) = x#\\ s\"\n \"invar s \\ invar (appendl x s)\"\nbegin\n abbreviation (input) \"push \\ appendl\" \n lemmas push_correct = appendl_correct\nend\n\nlocale list_removel = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes removel :: \"'s \\ ('x \\ 's)\"\n assumes removel_correct:\n \"\\invar s; \\ s \\ []\\ \\ fst (removel s) = hd (\\ s)\"\n \"\\invar s; \\ s \\ []\\ \\ \\ (snd (removel s)) = tl (\\ s)\"\n \"\\invar s; \\ s \\ []\\ \\ invar (snd (removel s))\"\nbegin\n lemma removelE: \n assumes I: \"invar s\" \"\\ s \\ []\" \n obtains s' where \"removel s = (hd (\\ s), s')\" \"invar s'\" \"\\ s' = tl (\\ s)\"\n proof -\n from removel_correct(1,2,3)[OF I] have \n C: \"fst (removel s) = hd (\\ s)\"\n \"\\ (snd (removel s)) = tl (\\ s)\"\n \"invar (snd (removel s))\" .\n from that[of \"snd (removel s)\", OF _ C(3,2), folded C(1)] show thesis\n by simp\n qed\n\n\n text \\The following shortcut notations are not meant for generating efficient code,\n but solely to simplify reasoning\\\n (* TODO: Is this actually used somewhere ? *)\n (*\n definition \"head s == fst (removef s)\"\n definition \"tail s == snd (removef s)\"\n\n lemma tail_correct: \"\\invar F; \\ F \\ []\\ \\ \\ (tail F) = tl (\\ F)\"\n by (simp add: tail_def removef_correct)\n\n \n\n lemma removef_split: \"removef F = (head F, tail F)\"\n apply (cases \"removef F\")\n apply (simp add: head_def tail_def)\n done\n *)\n \n abbreviation (input) \"pop \\ removel\"\n lemmas pop_correct = removel_correct\n\n abbreviation (input) \"dequeue \\ removel\"\n lemmas dequeue_correct = removel_correct\nend\n\nlocale list_leftmost = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes leftmost :: \"'s \\ 'x\"\n assumes leftmost_correct:\n \"\\invar s; \\ s \\ []\\ \\ leftmost s = hd (\\ s)\"\nbegin\n abbreviation (input) top where \"top \\ leftmost\"\n lemmas top_correct = leftmost_correct\nend\n\nlocale list_appendr = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes appendr :: \"'x \\ 's \\ 's\"\n assumes appendr_correct: \n \"invar s \\ \\ (appendr x s) = \\ s @ [x]\"\n \"invar s \\ invar (appendr x s)\"\nbegin\n abbreviation (input) \"enqueue \\ appendr\"\n lemmas enqueue_correct = appendr_correct\nend\n\nlocale list_remover = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes remover :: \"'s \\ 's \\ 'x\"\n assumes remover_correct: \n \"\\invar s; \\ s \\ []\\ \\ \\ (fst (remover s)) = butlast (\\ s)\"\n \"\\invar s; \\ s \\ []\\ \\ snd (remover s) = last (\\ s)\"\n \"\\invar s; \\ s \\ []\\ \\ invar (fst (remover s))\"\n\nlocale list_rightmost = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes rightmost :: \"'s \\ 'x\"\n assumes rightmost_correct:\n \"\\invar s; \\ s \\ []\\ \\ rightmost s = List.last (\\ s)\"\nbegin\n abbreviation (input) bot where \"bot \\ rightmost\"\n lemmas bot_correct = rightmost_correct\nend\n\nsubsubsection \"Indexing\"\nlocale list_get = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes get :: \"'s \\ nat \\ 'x\"\n assumes get_correct:\n \"\\invar s; i s)\\ \\ get s i = \\ s ! i\"\n\nlocale list_set = list +\n constrains \\ :: \"'s \\ 'x list\"\n fixes set :: \"'s \\ nat \\ 'x \\ 's\"\n assumes set_correct:\n \"\\invar s; i s)\\ \\ \\ (set s i x) = (\\ s) [i := x]\"\n \"\\invar s; i s)\\ \\ invar (set s i x)\"\n\nrecord ('a,'s) list_ops = \n list_op_\\ :: \"'s \\ 'a list\"\n list_op_invar :: \"'s \\ bool\"\n list_op_empty :: \"unit \\ 's\"\n list_op_isEmpty :: \"'s \\ bool\"\n list_op_size :: \"'s \\ nat\"\n list_op_appendl :: \"'a \\ 's \\ 's\"\n list_op_removel :: \"'s \\ 'a \\ 's\"\n list_op_leftmost :: \"'s \\ 'a\"\n list_op_appendr :: \"'a \\ 's \\ 's\"\n list_op_remover :: \"'s \\ 's \\ 'a\"\n list_op_rightmost :: \"'s \\ 'a\"\n list_op_get :: \"'s \\ nat \\ 'a\"\n list_op_set :: \"'s \\ nat \\ 'a \\ 's\"\n\nlocale StdListDefs = \n poly_list_iteratei \"list_op_\\ ops\" \"list_op_invar ops\"\n + poly_list_rev_iteratei \"list_op_\\ ops\" \"list_op_invar ops\"\n for ops :: \"('a,'s,'more) list_ops_scheme\"\nbegin\n abbreviation \\ where \"\\ \\ list_op_\\ ops\"\n abbreviation invar where \"invar \\ list_op_invar ops\"\n abbreviation empty where \"empty \\ list_op_empty ops\"\n abbreviation isEmpty where \"isEmpty \\ list_op_isEmpty ops\"\n abbreviation size where \"size \\ list_op_size ops\"\n abbreviation appendl where \"appendl \\ list_op_appendl ops\"\n abbreviation removel where \"removel \\ list_op_removel ops\"\n abbreviation leftmost where \"leftmost \\ list_op_leftmost ops\"\n abbreviation appendr where \"appendr \\ list_op_appendr ops\"\n abbreviation remover where \"remover \\ list_op_remover ops\"\n abbreviation rightmost where \"rightmost \\ list_op_rightmost ops\"\n abbreviation get where \"get \\ list_op_get ops\"\n abbreviation set where \"set \\ list_op_set ops\"\nend\n\nlocale StdList = StdListDefs ops\n + list \\ invar\n + list_empty \\ invar empty \n + list_isEmpty \\ invar isEmpty \n + list_size \\ invar size \n + list_appendl \\ invar appendl \n + list_removel \\ invar removel \n + list_leftmost \\ invar leftmost \n + list_appendr \\ invar appendr \n + list_remover \\ invar remover \n + list_rightmost \\ invar rightmost \n + list_get \\ invar get \n + list_set \\ invar set \n for ops :: \"('a,'s,'more) list_ops_scheme\"\nbegin\n lemmas correct = \n empty_correct\n isEmpty_correct\n size_correct\n appendl_correct\n removel_correct\n leftmost_correct\n appendr_correct\n remover_correct\n rightmost_correct\n get_correct\n set_correct\n\nend\n\nlocale StdList_no_invar = StdList + list_no_invar \\ invar\n \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/spec/ListSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2755047358918898}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nheader {* \\isaheader{Map Implementation by Associative Lists} *}\ntheory ListMapImpl\nimports \n \"../spec/MapSpec\" \n \"../../Lib/Assoc_List\" \n \"../gen_algo/MapGA\"\nbegin\ntext_raw {*\\label{thy:ListMapImpl}*}\n\n(*@impl Map\n @type 'a lm\n @abbrv lm,l\n Maps implemented by associative lists. If you need efficient \n @{text \"insert_dj\"} operation, you should use list sets with explicit \n invariants (lmi).\n*)\n\ntype_synonym ('k,'v) lm = \"('k,'v) assoc_list\"\n\ndefinition [icf_rec_def]: \"lm_basic_ops \\ \\\n bmap_op_\\ = Assoc_List.lookup,\n bmap_op_invar = \\_. True,\n bmap_op_empty = (\\_::unit. Assoc_List.empty),\n bmap_op_lookup = (\\k m. Assoc_List.lookup m k),\n bmap_op_update = Assoc_List.update,\n bmap_op_update_dj = Assoc_List.update,\n bmap_op_delete = Assoc_List.delete,\n bmap_op_list_it = Assoc_List.iteratei\n\\\"\n\nsetup Locale_Code.open_block\ninterpretation lm_basic!: StdBasicMapDefs lm_basic_ops .\ninterpretation lm_basic!: StdBasicMap lm_basic_ops\n apply unfold_locales\n apply (simp_all add: icf_rec_unf \n Assoc_List.lookup_empty' Assoc_List.iteratei_correct)\n done\nsetup Locale_Code.close_block\n\ndefinition [icf_rec_def]: \"lm_ops \\ lm_basic.dflt_ops\"\nsetup Locale_Code.open_block\ninterpretation lm!: StdMapDefs lm_ops .\ninterpretation lm!: StdMap lm_ops \n unfolding lm_ops_def\n by (rule lm_basic.dflt_ops_impl)\ninterpretation lm!: StdMap_no_invar lm_ops \n by unfold_locales (simp add: icf_rec_unf)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"lm\"*}\n\nlemma pi_lm[proper_it]: \n \"proper_it' Assoc_List.iteratei Assoc_List.iteratei\"\n unfolding Assoc_List.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm: proper_it_loc Assoc_List.iteratei Assoc_List.iteratei\n apply unfold_locales\n apply (rule pi_lm)\n done\n\nlemma pi_lm'[proper_it]: \n \"proper_it' lm.iteratei lm.iteratei\"\n unfolding lm.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm': proper_it_loc lm.iteratei lm.iteratei\n apply unfold_locales\n apply (rule pi_lm')\n done\n\n\ntext {* Code generator test *}\ndefinition \"test_codegen \\ (\n lm.add ,\n lm.add_dj ,\n lm.ball ,\n lm.bex ,\n lm.delete ,\n lm.empty ,\n lm.isEmpty ,\n lm.isSng ,\n lm.iterate ,\n lm.iteratei ,\n lm.list_it ,\n lm.lookup ,\n lm.restrict ,\n lm.sel ,\n lm.size ,\n lm.size_abort ,\n lm.sng ,\n lm.to_list ,\n lm.to_map ,\n lm.update ,\n lm.update_dj)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/impl/ListMapImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2755047284487132}} {"text": "section \"Invariant Context Simplifications\"\ntheory invContext_simps\nimports repliss_sem\nbegin\n\n\ntext \"Here we prove various simplifications for the invariant contexts.\"\n\n\nlemma invContext_unchanged_happensBefore:\n assumes \"co c \\ t\" and \"ts t \\ Uncommitted\"\n shows \"invContextH co to ts (hbOld \\ vis \\ {c}) cs ki io ir \n = invContextH co to ts hbOld cs ki io ir \"\n using assms by (auto simp add: invContextH_def restrict_relation_def committedCallsH_def isCommittedH_def)\n\nlemma invContext_unchanged_happensBefore2:\n assumes \"co c = None\"\n shows \"invContextH co to ts (hbOld \\ vis \\ {c}) cs ki io ir \n = invContextH co to ts hbOld cs ki io ir \"\n using assms by (auto simp add: invContextH_def restrict_relation_def committedCallsH_def isCommittedH_def)\n\nlemma committedCallsH_notin:\n assumes \"co c = None\"\n shows \"c \\ committedCallsH co ts\"\n by (simp add: assms committedCallsH_def isCommittedH_def)\n\nlemma committedCallsH_in:\n shows \"(c \\ committedCallsH co ts) \\ (case co c of None \\ False | Some t \\ ts t \\ Committed) \"\n by (auto simp add: committedCallsH_def isCommittedH_def split: option.splits)\n\n\n\nlemma committedCalls_unchanged_callOrigin:\n assumes a1: \"ts t \\ Uncommitted\"\n and a2: \"co c = None\"\n shows \"committedCallsH (co(c \\ t)) ts = committedCallsH co ts\"\n using a1 a2 by (auto simp add: committedCallsH_def isCommittedH_def)\n\nlemma invContextH_map_update_all:\n assumes \"co c = None\" and \"ts t \\ Uncommitted\"\n shows \"invContextH (co(c \\ t)) to ts hb cs ki io ir =\n invContextH co to ts hb cs ki io ir \"\n using assms by (auto simp add: invContextH_def committedCallsH_notin committedCalls_unchanged_callOrigin)\n\n\n\nlemma invContextH_update_calls:\n assumes \"co c \\ t\" and \"ts t \\ Uncommitted\"\n shows \"invContextH co to ts hb (cs(c \\ newCall)) ki io ir =\n invContextH co to ts hb cs ki io ir \"\n using assms by (auto simp add: invContextH_def committedCallsH_in)\n\n\n\nlemma committedCallsH_update_uncommitted:\n assumes \"ts t = None\"\n shows \"committedCallsH co (ts(t \\ Uncommitted))\n = committedCallsH co ts\"\n using assms by (auto simp add: committedCallsH_def isCommittedH_def, force)\n\n\nlemma invContextH_update_txstatus:\n assumes \"ts t = None\" \n shows \"invContextH co to (ts(t\\Uncommitted)) hb cs ki io ir =\n invContextH co to ts hb cs ki io ir \"\n using assms by (auto simp add: invContextH_def restrict_map_def committedCallsH_update_uncommitted)\n\nlemmas invContextH_simps = invContextH_update_calls invContextH_map_update_all invContextH_update_txstatus\n\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/invContext_simps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.27506938359538013}} {"text": "subsection \\Stuttering\\\n\ntheory Stuttering\n imports\n Semantics.IRStepThms\nbegin\n\ninductive stutter:: \"IRGraph \\ MapState \\ Params \\ FieldRefHeap \\ ID \\ ID \\ bool\" (\"_ _ _ _ \\ _ \\ _\" 55)\n for g m p h where\n\n StutterStep:\n \"\\g, p \\ (nid,m,h) \\ (nid',m,h)\\\n \\ g m p h \\ nid \\ nid'\" |\n\n Transitive:\n \"\\g, p \\ (nid,m,h) \\ (nid'',m,h);\n g m p h \\ nid'' \\ nid'\\\n \\ g m p h \\ nid \\ nid'\"\n\nlemma stuttering_successor:\n assumes \"(g, p \\ (nid, m, h) \\ (nid', m, h))\"\n shows \"{P'. (g m p h \\ nid \\ P')} = {nid'} \\ {nid''. (g m p h \\ nid' \\ nid'')}\"\nproof -\n have nextin: \"nid' \\ {P'. (g m p h \\ nid \\ P')}\"\n using assms StutterStep by blast\n have nextsubset: \"{nid''. (g m p h \\ nid' \\ nid'')} \\ {P'. (g m p h \\ nid \\ P')}\"\n by (metis Collect_mono assms stutter.Transitive)\n have \"\\n \\ {P'. (g m p h \\ nid \\ P')} . n = nid' \\ n \\ {nid''. (g m p h \\ nid' \\ nid'')}\"\n using stepDet\n by (metis (no_types, lifting) Pair_inject assms mem_Collect_eq stutter.simps)\n then show ?thesis\n using insert_absorb mk_disjoint_insert nextin nextsubset by auto\nqed\n\nend", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Proofs/Stuttering.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.27506937629073963}} {"text": "(*** This file is part of Lem. eth-isabelle project just uses it. See lem-license. ***)\n\nchapter {* Generated by Lem from list.lem. *}\n\ntheory \"Lem_list\" \n\nimports \n \t Main\n\t \"Lem_bool\" \n\t \"Lem_maybe\" \n\t \"Lem_basic_classes\" \n\t \"Lem_function\" \n\t \"Lem_tuple\" \n\t \"Lem_num\" \n\t \"Lem\" \n\nbegin \n\n \n\n(*open import Bool Maybe Basic_classes Function Tuple Num*)\n\n(*open import {coq} `Coq.Lists.List`*)\n(*open import {isabelle} `$LIB_DIR/Lem`*)\n(*open import {hol} `lemTheory` `listTheory` `rich_listTheory` `sortingTheory`*)\n\n(* ========================================================================== *)\n(* Basic list functions *)\n(* ========================================================================== *)\n\n(* The type of lists as well as list literals like [], [1;2], ... are hardcoded. \n Thus, we can directly dive into derived definitions. *)\n\n\n(* ----------------------- *)\n(* cons *)\n(* ----------------------- *)\n\n(*val :: : forall 'a. 'a -> list 'a -> list 'a*)\n\n\n(* ----------------------- *)\n(* Emptyness check *)\n(* ----------------------- *)\n\n(*val null : forall 'a. list 'a -> bool*)\n(*let null l= match l with [] -> true | _ -> false end*)\n\n(* ----------------------- *)\n(* Length *)\n(* ----------------------- *)\n\n(*val length : forall 'a. list 'a -> nat*)\n(*let rec length l= \n match l with\n | [] -> 0\n | x :: xs -> (Instance_Num_NumAdd_nat.+) (length xs) 1\n end*)\n\n(* ----------------------- *)\n(* Equality *)\n(* ----------------------- *)\n\n(*val listEqual : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\n(*val listEqualBy : forall 'a. ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\n\nfun listEqualBy :: \"('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" listEqualBy eq ([]) ([]) = ( True )\"\n|\" listEqualBy eq ([]) (_ # _) = ( False )\"\n|\" listEqualBy eq (_ # _) ([]) = ( False )\"\n|\" listEqualBy eq (x # xs) (y # ys) = ( (eq x y \\ listEqualBy eq xs ys))\" \ndeclare listEqualBy.simps [simp del]\n\n\n\n(* ----------------------- *)\n(* compare *)\n(* ----------------------- *)\n\n(*val lexicographicCompare : forall 'a. Ord 'a => list 'a -> list 'a -> ordering*)\n(*val lexicographicCompareBy : forall 'a. ('a -> 'a -> ordering) -> list 'a -> list 'a -> ordering*)\n\nfun lexicographicCompareBy :: \"('a \\ 'a \\ ordering)\\ 'a list \\ 'a list \\ ordering \" where \n \" lexicographicCompareBy cmp ([]) ([]) = ( EQ )\"\n|\" lexicographicCompareBy cmp ([]) (_ # _) = ( LT )\"\n|\" lexicographicCompareBy cmp (_ # _) ([]) = ( GT )\"\n|\" lexicographicCompareBy cmp (x # xs) (y # ys) = ( (\n (case cmp x y of \n LT => LT\n | GT => GT\n | EQ => lexicographicCompareBy cmp xs ys\n )\n ))\" \ndeclare lexicographicCompareBy.simps [simp del]\n\n\n(*val lexicographicLess : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessBy less1 less_eq1 ([]) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 (x # xs) (y # ys) = ( ((less1 x y) \\ ((less_eq1 x y) \\ (lexicographicLessBy less1 less_eq1 xs ys))))\" \ndeclare lexicographicLessBy.simps [simp del]\n\n\n(*val lexicographicLessEq : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessEqBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessEqBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessEqBy less1 less_eq1 ([]) ([]) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessEqBy less1 less_eq1 (x # xs) (y # ys) = ( (less1 x y \\ (less_eq1 x y \\ lexicographicLessEqBy less1 less_eq1 xs ys)))\" \ndeclare lexicographicLessEqBy.simps [simp del]\n\n\n\ndefinition instance_Basic_classes_Ord_list_dict :: \" 'a Ord_class \\('a list)Ord_class \" where \n \" instance_Basic_classes_Ord_list_dict dict_Basic_classes_Ord_a = ((|\n\n compare_method = (lexicographicCompareBy \n (compare_method dict_Basic_classes_Ord_a)),\n\n isLess_method = (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isLessEqual_method = (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isGreater_method = (\\ x y. (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x)),\n\n isGreaterEqual_method = (\\ x y. (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x))|) )\"\n\n\n\n(* ----------------------- *)\n(* Append *)\n(* ----------------------- *)\n\n(*val ++ : forall 'a. list 'a -> list 'a -> list 'a*) (* originally append *)\n(*let rec ++ xs ys= match xs with\n | [] -> ys\n | x :: xs' -> x :: (xs' ++ ys)\n end*)\n\n(* ----------------------- *)\n(* snoc *)\n(* ----------------------- *)\n\n(*val snoc : forall 'a. 'a -> list 'a -> list 'a*)\n(*let snoc e l= l ++ [e]*)\n\n\n(* ----------------------- *)\n(* Reverse *)\n(* ----------------------- *)\n\n(* First lets define the function [reverse_append], which is\n closely related to reverse. [reverse_append l1 l2] appends the list [l2] to the reverse of [l1].\n This can be implemented more efficienctly than appending and is\n used to implement reverse. *)\n\n(*val reverseAppend : forall 'a. list 'a -> list 'a -> list 'a*) (* originally named rev_append *)\n(*let rec reverseAppend l1 l2= match l1 with \n | [] -> l2\n | x :: xs -> reverseAppend xs (x :: l2)\n end*)\n\n(* Reversing a list *)\n(*val reverse : forall 'a. list 'a -> list 'a*) (* originally named rev *)\n(*let reverse l= reverseAppend l []*)\n\n(* ----------------------- *)\n(* Map *)\n(* ----------------------- *)\n\n(*val map_tr : forall 'a 'b. list 'b -> ('a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) map_tr :: \" 'b list \\('a \\ 'b)\\ 'a list \\ 'b list \" where \n \" map_tr rev_acc f ([]) = ( List.rev rev_acc )\"\n|\" map_tr rev_acc f (x # xs) = ( map_tr ((f x) # rev_acc) f xs )\" \nby pat_completeness auto\n\n\n(* taken from: https://blogs.janestreet.com/optimizing-list-map/ *)\n(*val count_map : forall 'a 'b. ('a -> 'b) -> list 'a -> nat -> list 'b*)\nfunction (sequential,domintros) count_map :: \"('a \\ 'b)\\ 'a list \\ nat \\ 'b list \" where \n \" count_map f ([]) ctr = ( [])\"\n|\" count_map f (hd1 # tl1) ctr = ( f hd1 # \n (if ctr <( 5000 :: nat) then count_map f tl1 (ctr +( 1 :: nat)) \n else map_tr [] f tl1))\" \nby pat_completeness auto\n\n \n(*val map : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n(*let map f l= count_map f l 0*)\n\n(* ----------------------- *)\n(* Reverse Map *)\n(* ----------------------- *)\n\n(*val reverseMap : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n\n\n(* ========================================================================== *)\n(* Folding *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* fold left *)\n(* ----------------------- *)\n\n(*val foldl : forall 'a 'b. ('a -> 'b -> 'a) -> 'a -> list 'b -> 'a*) (* originally foldl *)\n\n(*let rec foldl f b l= match l with\n | [] -> b\n | x :: xs -> foldl f (f b x) xs\nend*)\n\n\n(* ----------------------- *)\n(* fold right *)\n(* ----------------------- *)\n\n(*val foldr : forall 'a 'b. ('a -> 'b -> 'b) -> 'b -> list 'a -> 'b*) (* originally foldr with different argument order *)\n(*let rec foldr f b l= match l with\n | [] -> b\n | x :: xs -> f x (foldr f b xs)\nend*)\n\n\n(* ----------------------- *)\n(* concatenating lists *)\n(* ----------------------- *)\n\n(*val concat : forall 'a. list (list 'a) -> list 'a*) (* before also called flatten *)\n(*let concat= foldr (++) []*)\n\n\n(* -------------------------- *)\n(* concatenating with mapping *)\n(* -------------------------- *)\n\n(*val concatMap : forall 'a 'b. ('a -> list 'b) -> list 'a -> list 'b*)\n\n\n(* ------------------------- *)\n(* universal qualification *)\n(* ------------------------- *)\n\n(*val all : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally for_all *)\n(*let all P l= foldl (fun r e -> P e && r) true l*)\n\n\n\n(* ------------------------- *)\n(* existential qualification *)\n(* ------------------------- *)\n\n(*val any : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally exist *)\n(*let any P l= foldl (fun r e -> P e || r) false l*)\n\n\n(* ------------------------- *)\n(* dest_init *)\n(* ------------------------- *)\n\n(* get the initial part and the last element of the list in a safe way *)\n\n(*val dest_init : forall 'a. list 'a -> maybe (list 'a * 'a)*) \n\nfun dest_init_aux :: \" 'a list \\ 'a \\ 'a list \\ 'a list*'a \" where \n \" dest_init_aux rev_init last_elem_seen ([]) = ( (List.rev rev_init, last_elem_seen))\"\n|\" dest_init_aux rev_init last_elem_seen (x # xs) = ( dest_init_aux (last_elem_seen # rev_init) x xs )\" \ndeclare dest_init_aux.simps [simp del]\n\n\nfun dest_init :: \" 'a list \\('a list*'a)option \" where \n \" dest_init ([]) = ( None )\"\n|\" dest_init (x # xs) = ( Some (dest_init_aux [] x xs))\" \ndeclare dest_init.simps [simp del]\n\n\n\n(* ========================================================================== *)\n(* Indexing lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* index / nth with maybe *)\n(* ------------------------- *)\n\n(*val index : forall 'a. list 'a -> nat -> maybe 'a*)\n\n(*let rec index l n= match l with \n | [] -> Nothing\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then Just x else index xs ((Instance_Num_NumMinus_nat.-)n 1)\nend*)\n\n(* ------------------------- *)\n(* findIndices *)\n(* ------------------------- *)\n\n(* [findIndices P l] returns the indices of all elements of list [l] that satisfy predicate [P]. \n Counting starts with 0, the result list is sorted ascendingly *)\n(*val findIndices : forall 'a. ('a -> bool) -> list 'a -> list nat*)\n\nfun findIndices_aux :: \" nat \\('a \\ bool)\\ 'a list \\(nat)list \" where \n \" findIndices_aux (i::nat) P ([]) = ( [])\"\n|\" findIndices_aux (i::nat) P (x # xs) = ( if P x then i # findIndices_aux (i +( 1 :: nat)) P xs else findIndices_aux (i +( 1 :: nat)) P xs )\" \ndeclare findIndices_aux.simps [simp del]\n\n(*let findIndices P l= findIndices_aux 0 P l*)\n\n\n\n(* ------------------------- *)\n(* findIndex *)\n(* ------------------------- *)\n\n(* findIndex returns the first index of a list that satisfies a given predicate. *)\n(*val findIndex : forall 'a. ('a -> bool) -> list 'a -> maybe nat*)\n(*let findIndex P l= match findIndices P l with\n | [] -> Nothing\n | x :: _ -> Just x\nend*)\n\n(* ------------------------- *)\n(* elemIndices *)\n(* ------------------------- *)\n\n(*val elemIndices : forall 'a. Eq 'a => 'a -> list 'a -> list nat*)\n\n(* ------------------------- *)\n(* elemIndex *)\n(* ------------------------- *)\n\n(*val elemIndex : forall 'a. Eq 'a => 'a -> list 'a -> maybe nat*)\n\n\n(* ========================================================================== *)\n(* Creating lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* genlist *)\n(* ------------------------- *)\n\n(* [genlist f n] generates the list [f 0; f 1; ... (f (n-1))] *)\n(*val genlist : forall 'a. (nat -> 'a) -> nat -> list 'a*)\n\n\n(*let rec genlist f n= \n match n with\n | 0 -> []\n | n' + 1 -> snoc (f n') (genlist f n')\n end*)\n\n\n(* ------------------------- *)\n(* replicate *)\n(* ------------------------- *)\n\n(*val replicate : forall 'a. nat -> 'a -> list 'a*)\n(*let rec replicate n x= \n match n with\n | 0 -> []\n | n' + 1 -> x :: replicate n' x\n end*)\n\n\n(* ========================================================================== *)\n(* Sublists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* splitAt *)\n(* ------------------------- *)\n\n(* [splitAt n xs] returns a tuple (xs1, xs2), with append xs1 xs2 = xs and \n length xs1 = n. If there are not enough elements \n in [xs], the original list and the empty one are returned. *)\n(*val splitAtAcc : forall 'a. list 'a -> nat -> list 'a -> (list 'a * list 'a)*)\nfunction (sequential,domintros) splitAtAcc :: \" 'a list \\ nat \\ 'a list \\ 'a list*'a list \" where \n \" splitAtAcc revAcc n l = ( \n (case l of\n [] => (List.rev revAcc, [])\n | x # xs => if n \\( 0 :: nat) then (List.rev revAcc, l) else splitAtAcc (x # revAcc) (n-( 1 :: nat)) xs\n ))\" \nby pat_completeness auto\n\n\n(*val splitAt : forall 'a. nat -> list 'a -> (list 'a * list 'a)*)\n(*let rec splitAt n l= \n splitAtAcc [] n l*)\n\n\n(* ------------------------- *)\n(* take *)\n(* ------------------------- *)\n\n(* take n xs returns the prefix of xs of length n, or xs itself if n > length xs *)\n(*val take : forall 'a. nat -> list 'a -> list 'a*)\n(*let take n l= fst (splitAt n l)*)\n\n\n\n(* ------------------------- *)\n(* drop *)\n(* ------------------------- *)\n\n(* [drop n xs] drops the first [n] elements of [xs]. It returns the empty list, if [n] > [length xs]. *)\n(*val drop : forall 'a. nat -> list 'a -> list 'a*)\n(*let drop n l= snd (splitAt n l)*)\n\n(* ------------------------- *)\n(* dropWhile *)\n(* ------------------------- *)\n\n(* [dropWhile p xs] drops the first elements of [xs] that satisfy [p]. *)\n(*val dropWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\nfun dropWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" dropWhile p l = ( (case l of \n [] => []\n | x # xs => if p x then dropWhile p xs else l\n))\" \ndeclare dropWhile.simps [simp del]\n\n\n\n(* ------------------------- *)\n(* takeWhile *)\n(* ------------------------- *)\n\n(* [takeWhile p xs] takes the first elements of [xs] that satisfy [p]. *)\n(*val takeWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\nfun takeWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" takeWhile p ([]) = ( [])\"\n|\" takeWhile p (x # xs) = ( if p x then x # takeWhile p xs else [])\" \ndeclare takeWhile.simps [simp del]\n\n\n(* ------------------------- *)\n(* splitWhile *)\n(* ------------------------- *)\n\n(*val splitWhile : forall 'a. ('a -> bool) -> list 'a -> (list 'a * list 'a)*)\ndefinition splitWhile :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" splitWhile p xs = ( (takeWhile p xs, dropWhile p xs))\"\n\n\n\n(* ------------------------- *)\n(* isPrefixOf *)\n(* ------------------------- *)\n\n(*val isPrefixOf : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\nfun isPrefixOf :: \" 'a list \\ 'a list \\ bool \" where \n \" isPrefixOf ([]) _ = ( True )\"\n|\" isPrefixOf (_ # _) ([]) = ( False )\"\n|\" isPrefixOf (x # xs) (y # ys) = ( (x = y) \\ isPrefixOf xs ys )\" \ndeclare isPrefixOf.simps [simp del]\n\n\n(* ------------------------- *)\n(* update *)\n(* ------------------------- *)\n(*val update : forall 'a. list 'a -> nat -> 'a -> list 'a*)\n(*let rec update l n e= \n match l with\n | [] -> []\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then e :: xs else x :: (update xs ((Instance_Num_NumMinus_nat.-) n 1) e)\nend*)\n\n\n\n(* ========================================================================== *)\n(* Searching lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* Membership test *)\n(* ------------------------- *)\n\n(* The membership test, one of the basic list functions, is actually tricky for\n Lem, because it is tricky, which equality to use. From Lem`s point of \n perspective, we want to use the equality provided by the equality type - class.\n This allows for example to check whether a set is in a list of sets.\n\n However, in order to use the equality type class, elem essentially becomes\n existential quantification over lists. For types, which implement semantic\n equality (=) with syntactic equality, this is overly complicated. In\n our theorem prover backend, we would end up with overly complicated, harder\n to read definitions and some of the automation would be harder to apply.\n Moreover, nearly all the old Lem generated code would change and require \n (hopefully minor) adaptions of proofs.\n\n For now, we ignore this problem and just demand, that all instances of\n the equality type class do the right thing for the theorem prover backends. \n*)\n\n(*val elem : forall 'a. Eq 'a => 'a -> list 'a -> bool*)\n(*val elemBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> bool*)\n\ndefinition elemBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ bool \" where \n \" elemBy eq e l = ( ((\\ x \\ (set l). (eq e) x)))\"\n\n(*let elem= elemBy (=)*)\n\n(* ------------------------- *)\n(* Find *)\n(* ------------------------- *)\n(*val find : forall 'a. ('a -> bool) -> list 'a -> maybe 'a*) (* previously not of maybe type *)\n(*let rec find P l= match l with \n | [] -> Nothing\n | x :: xs -> if P x then Just x else find P xs\nend*)\n\n\n(* ----------------------------- *)\n(* Lookup in an associative list *)\n(* ----------------------------- *)\n(*val lookup : forall 'a 'b. Eq 'a => 'a -> list ('a * 'b) -> maybe 'b*)\n(*val lookupBy : forall 'a 'b. ('a -> 'a -> bool) -> 'a -> list ('a * 'b) -> maybe 'b*)\n\n(* DPM: eta-expansion for Coq backend type-inference. *)\ndefinition lookupBy :: \"('a \\ 'a \\ bool)\\ 'a \\('a*'b)list \\ 'b option \" where \n \" lookupBy eq k m = ( map_option (\\ x . snd x) (List.find (\\ (k', _) . eq k k') m))\"\n\n\n(* ------------------------- *)\n(* filter *)\n(* ------------------------- *)\n(*val filter : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\n(*let rec filter P l= match l with\n | [] -> []\n | x :: xs -> if (P x) then x :: (filter P xs) else filter P xs\n end*)\n\n\n(* ------------------------- *)\n(* partition *)\n(* ------------------------- *)\n(*val partition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\n(*let partition P l= (filter P l, filter (fun x -> not (P x)) l)*)\n\n(*val reversePartition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\ndefinition reversePartition :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" reversePartition P l = ( List.partition P (List.rev l))\"\n\n\n\n(* ------------------------- *)\n(* delete first element *)\n(* with certain property *)\n(* ------------------------- *)\n\n(*val deleteFirst : forall 'a. ('a -> bool) -> list 'a -> maybe (list 'a)*) \n(*let rec deleteFirst P l= match l with\n | [] -> Nothing\n | x :: xs -> if (P x) then Just xs else Maybe.map (fun xs' -> x :: xs') (deleteFirst P xs)\n end*)\n\n\n(*val delete : forall 'a. Eq 'a => 'a -> list 'a -> list 'a*)\n(*val deleteBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> list 'a*)\n\ndefinition deleteBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ 'a list \" where \n \" deleteBy eq x l = ( case_option l id (delete_first (eq x) l))\"\n\n\n\n(* ========================================================================== *)\n(* Zipping and unzipping lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* zip *)\n(* ------------------------- *)\n\n(* zip takes two lists and returns a list of corresponding pairs. If one input list is short, excess elements of the longer list are discarded. *)\n(*val zip : forall 'a 'b. list 'a -> list 'b -> list ('a * 'b)*) (* before combine *)\n(*let rec zip l1 l2= match (l1, l2) with\n | (x :: xs, y :: ys) -> (x, y) :: zip xs ys\n | _ -> []\nend*)\n\n(* ------------------------- *)\n(* unzip *)\n(* ------------------------- *)\n\n(*val unzip: forall 'a 'b. list ('a * 'b) -> (list 'a * list 'b)*)\n(*let rec unzip l= match l with\n | [] -> ([], [])\n | (x, y) :: xys -> let (xs, ys) = unzip xys in (x :: xs, y :: ys)\nend*)\n\n(* ------------------------- *)\n(* distinct elements *)\n(* ------------------------- *)\n\n(*val allDistinct : forall 'a. Eq 'a => list 'a -> bool*)\nfun allDistinct :: \" 'a list \\ bool \" where \n \" allDistinct ([]) = ( True )\"\n|\" allDistinct (x # l') = ( \\ (Set.member x (set l')) \\ allDistinct l' )\" \ndeclare allDistinct.simps [simp del]\n\n\n(* some more useful functions *)\n(*val mapMaybe : forall 'a 'b. ('a -> maybe 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapMaybe :: \"('a \\ 'b option)\\ 'a list \\ 'b list \" where \n \" mapMaybe f ([]) = ( [])\"\n|\" mapMaybe f (x # xs) = (\n (case f x of\n None => mapMaybe f xs\n | Some y => y # (mapMaybe f xs)\n ))\" \nby pat_completeness auto\n\n\n(*val mapi : forall 'a 'b. (nat -> 'a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapiAux :: \"(nat \\ 'b \\ 'a)\\ nat \\ 'b list \\ 'a list \" where \n \" mapiAux f (n :: nat) ([]) = ( [])\"\n|\" mapiAux f (n :: nat) (x # xs) = ( (f n x) # mapiAux f (n +( 1 :: nat)) xs )\" \nby pat_completeness auto\n\ndefinition mapi :: \"(nat \\ 'a \\ 'b)\\ 'a list \\ 'b list \" where \n \" mapi f l = ( mapiAux f(( 0 :: nat)) l )\"\n\n\n(*val deletes: forall 'a. Eq 'a => list 'a -> list 'a -> list 'a*)\ndefinition deletes :: \" 'a list \\ 'a list \\ 'a list \" where \n \" deletes xs ys = (\n List.foldl ((\\ x y. remove1 y x)) xs ys )\"\n\n\n(* ========================================================================== *)\n(* Comments (not clean yet, please ignore the rest of the file) *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* skipped from Haskell Lib*)\n(* ----------------------- \n\nintersperse :: a -> [a] -> [a]\nintercalate :: [a] -> [[a]] -> [a]\ntranspose :: [[a]] -> [[a]]\nsubsequences :: [a] -> [[a]]\npermutations :: [a] -> [[a]]\nfoldl` :: (a -> b -> a) -> a -> [b] -> aSource\nfoldl1` :: (a -> a -> a) -> [a] -> aSource\n\nand\nor\nsum\nproduct\nmaximum\nminimum\nscanl\nscanr\nscanl1\nscanr1\nAccumulating maps\n\nmapAccumL :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\nmapAccumR :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\n\niterate :: (a -> a) -> a -> [a]\nrepeat :: a -> [a]\ncycle :: [a] -> [a]\nunfoldr\n\n\ntakeWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhileEnd :: (a -> Bool) -> [a] -> [a]Source\nspan :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak p is equivalent to span (not . p).\nstripPrefix :: Eq a => [a] -> [a] -> Maybe [a]Source\ngroup :: Eq a => [a] -> [[a]]Source\ninits :: [a] -> [[a]]Source\ntails :: [a] -> [[a]]Source\n\n\nisPrefixOf :: Eq a => [a] -> [a] -> BoolSource\nisSuffixOf :: Eq a => [a] -> [a] -> BoolSource\nisInfixOf :: Eq a => [a] -> [a] -> BoolSource\n\n\n\nnotElem :: Eq a => a -> [a] -> BoolSource\n\nzip3 :: [a] -> [b] -> [c] -> [(a, b, c)]Source\nzip4 :: [a] -> [b] -> [c] -> [d] -> [(a, b, c, d)]Source\nzip5 :: [a] -> [b] -> [c] -> [d] -> [e] -> [(a, b, c, d, e)]Source\nzip6 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [(a, b, c, d, e, f)]Source\nzip7 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [(a, b, c, d, e, f, g)]Source\n\nzipWith :: (a -> b -> c) -> [a] -> [b] -> [c]Source\nzipWith3 :: (a -> b -> c -> d) -> [a] -> [b] -> [c] -> [d]Source\nzipWith4 :: (a -> b -> c -> d -> e) -> [a] -> [b] -> [c] -> [d] -> [e]Source\nzipWith5 :: (a -> b -> c -> d -> e -> f) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f]Source\nzipWith6 :: (a -> b -> c -> d -> e -> f -> g) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g]Source\nzipWith7 :: (a -> b -> c -> d -> e -> f -> g -> h) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [h]Source\n\n\nunzip3 :: [(a, b, c)] -> ([a], [b], [c])Source\nunzip4 :: [(a, b, c, d)] -> ([a], [b], [c], [d])Source\nunzip5 :: [(a, b, c, d, e)] -> ([a], [b], [c], [d], [e])Source\nunzip6 :: [(a, b, c, d, e, f)] -> ([a], [b], [c], [d], [e], [f])Source\nunzip7 :: [(a, b, c, d, e, f, g)] -> ([a], [b], [c], [d], [e], [f], [g])Source\n\n\nlines :: String -> [String]Source\nwords :: String -> [String]Source\nunlines :: [String] -> StringSource\nunwords :: [String] -> StringSource\nnub :: Eq a => [a] -> [a]Source\ndelete :: Eq a => a -> [a] -> [a]Source\n\n() :: Eq a => [a] -> [a] -> [a]Source\nunion :: Eq a => [a] -> [a] -> [a]Source\nintersect :: Eq a => [a] -> [a] -> [a]Source\nsort :: Ord a => [a] -> [a]Source\ninsert :: Ord a => a -> [a] -> [a]Source\n\n\nnubBy :: (a -> a -> Bool) -> [a] -> [a]Source\ndeleteBy :: (a -> a -> Bool) -> a -> [a] -> [a]Source\ndeleteFirstsBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nunionBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nintersectBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\ngroupBy :: (a -> a -> Bool) -> [a] -> [[a]]Source\nsortBy :: (a -> a -> Ordering) -> [a] -> [a]Source\ninsertBy :: (a -> a -> Ordering) -> a -> [a] -> [a]Source\nmaximumBy :: (a -> a -> Ordering) -> [a] -> aSource\nminimumBy :: (a -> a -> Ordering) -> [a] -> aSource\ngenericLength :: Num i => [b] -> iSource\ngenericTake :: Integral i => i -> [a] -> [a]Source\ngenericDrop :: Integral i => i -> [a] -> [a]Source\ngenericSplitAt :: Integral i => i -> [b] -> ([b], [b])Source\ngenericIndex :: Integral a => [b] -> a -> bSource\ngenericReplicate :: Integral i => i -> a -> [a]Source\n\n\n*)\n\n\n(* ----------------------- *)\n(* skipped from Lem Lib *)\n(* ----------------------- \n\n\nval for_all2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval exists2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c \nval rev_map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c\nval fold_left2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'a) -> 'a -> list 'b -> list 'c -> 'a\nval fold_right2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'c) -> list 'a -> list 'b -> 'c -> 'c\n\n\n(* now maybe result and called lookup *)\nval assoc : forall 'a 'b. 'a -> list ('a * 'b) -> 'b\nlet inline {ocaml} assoc = Ocaml.List.assoc\n\n\nval mem_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> bool\nval remove_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> list ('a * 'b)\n\n\n\nval stable_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\nval fast_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\n\nval merge : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a -> list 'a\nval intersect : forall 'a. list 'a -> list 'a -> list 'a\n\n\n*)\n\n(*val catMaybes : forall 'a. list (maybe 'a) -> list 'a*)\nfunction (sequential,domintros) catMaybes :: \"('a option)list \\ 'a list \" where \n \" catMaybes ([]) = (\n [])\"\n|\" catMaybes (None # xs') = (\n catMaybes xs' )\"\n|\" catMaybes (Some x # xs') = (\n x # catMaybes xs' )\" \nby pat_completeness auto\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/lem/Lem_list.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2750693689860991}} {"text": "section {*LR1\\_Property\\_Satisfaction\\_\\_entire\\_derivation\\_tree\\_invariant*}\ntheory\n LR1_Property_Satisfaction__entire_derivation_tree_invariant\n\nimports\n PRJ_12_04_06_06_11__ENTRY\n\nbegin\n\ndefinition EValidSplitExt_no_elim_before_nonterminal :: \"\n ('q, 's, 't) ESplit\n \\ bool\"\n where\n \"EValidSplitExt_no_elim_before_nonterminal S \\\n \\k < length S. \n (\\A. ESplitItem_elem (S ! k) = Some (teA A))\n \\ (\\i \\ k. ESplitItem_elim (S ! i) = [])\"\n\ndefinition EValidSplitExt_no_pop_in_prods_before_nonterminal :: \"\n ('q, 's, 't) ESplit\n \\ bool\"\n where\n \"EValidSplitExt_no_pop_in_prods_before_nonterminal S \\\n \\k < length S. \n (\\A. ESplitItem_elem (S ! k) = Some (teA A)) \n \\ (\\i \\ k. \\j < length (ESplitItem_prods (S ! i)) . prod_rhs (ESplitItem_prods (S ! i) ! j) \\ [])\"\n\ndefinition Eident_line :: \"\n ('q, 's, 't) ESplitItem\n \\ bool\"\n where\n \"Eident_line S \\\n (ESplitItem_prods S = []\n \\ ESplitItem_elim S = [])\"\n\ndefinition Eident_lines :: \"\n ('q, 's, 't) ESplit\n \\ nat set\"\n where\n \"Eident_lines S \\\n {n. n < length S\n \\ Eident_line (S ! n) }\"\n\ndefinition EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal :: \"\n ('q, 's, 't) ESplit\n \\ bool\"\n where\n \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal S \\\n (\\k < length S. (\\A. ESplitItem_elem (S ! k) = Some (teA A)) \\ (\\i < k. i \\ Eident_lines S))\"\n\ndefinition EValidSplitExt :: \"\n ('q, 's, 't) ESplit\n \\ bool\"\n where\n \"EValidSplitExt S \\\n (EValidSplitExt_no_elim_before_nonterminal S\n \\ EValidSplitExt_no_pop_in_prods_before_nonterminal S\n \\ EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal S)\"\n\nlemma entirely_ignored_can_not_happend_to_early: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G (S@SX#SY#SZ#S')\n \\ EValidSplitExt (S@SX#SY#SZ#S')\n \\ ESplitItem_elim SY = []\n \\ ESplitItem_prods SY = []\n \\ ESplitItem_to SX = X#to\n \\ ESplitItem_ignore SX = ig\n \\ ESplitItem_ignore SZ = c @ to @ ig\n \\ Q\"\n apply(simp add: EValidSplit_def)\n apply(clarsimp)\n apply(simp add: EValidSplit_interline_def)\n apply(erule_tac x=\"length S\" in allE')\n apply(erule_tac\n x=\"Suc(length S)\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(S @ SX # SY # SZ # S') ! (length S) = SX\")\n prefer 2\n apply(force)\n apply(subgoal_tac \"(S @ SX # SY # SZ # S') ! Suc (length S) = SY\")\n prefer 2\n apply (metis drop_append2 drop_nth_hlp1)\n apply(subgoal_tac \"(S @ SX # SY # SZ # S') ! Suc (Suc(length S)) = SSX\" for SSX)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(clarsimp)\n apply(simp add: EValidSplit_interlineX_def)\n apply(case_tac \"ESplitItem_from SY\")\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"SY\"\n in ballE_prime)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"SY \\ set (butlast (S @ SX # SY # SZ # S'))\")\n apply(force)\n apply(thin_tac \"SY \\ set (butlast (S @ SX # SY # SZ # S'))\")\n apply(rule_tac\n xs=\"S'\"\n in rev_cases)\n apply(clarsimp)\n apply(rule_tac\n t=\"butlast (S @ [SX, SY, SZ])\"\n in ssubst)\n apply(rule butlast_direct)\n apply(force)\n apply(force)\n apply(rename_tac ys y)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"butlast (S @ SX # SY # SZ # ys @ [y])\"\n in ssubst)\n apply(rename_tac ys y)(*strict*)\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac ys y)(*strict*)\n apply(force)\n apply(rename_tac a)(*strict*)\n apply(case_tac \"ESplitItem_from SX\")\n apply(rename_tac a)(*strict*)\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"SX\"\n in ballE_prime)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(subgoal_tac \"SX \\ set (butlast (S @ SX # SY # SZ # S'))\")\n apply(rename_tac a)(*strict*)\n apply(force)\n apply(rename_tac a)(*strict*)\n apply(rule_tac\n xs=\"S'\"\n in rev_cases)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (S @ [SX, SY, SZ]) = SSX\" for SSX)\n apply(rename_tac a)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(rename_tac a ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (S @ SX # SY # SZ # ys @ [y]) = SSX\" for SSX)\n apply(rename_tac a ys y)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac a aa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(case_tac \"ESplitItem_to SX\")\n apply(rename_tac a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a aa ab list)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa)(*strict*)\n apply(subgoal_tac \"ESplitItem_to SY = []\")\n apply(rename_tac aa)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_ValidItem_def)\n apply(clarsimp)\n apply(simp add: EValidSplitItem_def EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac aa d da db)(*strict*)\n apply(simp add: cfgLM.trans_der_def option_to_list_def)\n apply(clarsimp)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"SY\"\n and A=\"set (butlast (S @ SX # SY # SZ # S'))\"\n in ballE)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_to SY\")\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(force)\n apply(rename_tac aa d da db e eb a list)(*strict*)\n apply(force)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(subgoal_tac \"SY \\ set (butlast (S @ SX # SY # SZ # S'))\")\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(force)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(rule_tac\n xs=\"S'\"\n in rev_cases)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (S @ [SX, SY, SZ]) = SSX\" for SSX)\n apply(rename_tac aa d da db e eb)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac aa d da db e eb)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa d da db e eb ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa d da db e eb ys y dc ea)(*strict*)\n apply(subgoal_tac \"butlast ((S @ SX # SY # SZ # ys) @ [y]) = SSX\" for SSX)\n apply(rename_tac aa d da db e eb ys y dc ea)(*strict*)\n prefer 2\n apply(rule_tac\n w=\"S @ SX # SY # SZ # ys\"\n in butlast_direct)\n apply(force)\n apply(rename_tac aa d da db e eb ys y dc ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_from SZ\")\n apply(rename_tac aa)(*strict*)\n prefer 2\n apply(rename_tac aa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac aa)(*strict*)\n apply(clarsimp)\n apply(simp add: EValidSplit_produce_or_elim_def)\n done\n\nlemma restrict_equal_before_step_nonterminal: \"\n F2LR1inputx G' G\n \\ split_TSstructure G'\n \\ Esplit_signature S2 = w @ teB b # liftB \\1 @ teA A2 # liftB \\2\n \\ EValidSplit G' S2\n \\ EValidSplit G' (S2a @ S2b)\n \\ Esplit_step_relation G' S2 \\prod_lhs = A2, prod_rhs = []\\ (S2a @ S2b)\n \\ Esplit_signature S2a = w @ [teB b]\n \\ length S2a = Suc (length w)\n \\ Esplit_signature S2b = liftB \\1 @ liftB \\2\n \\ EValidSplitExt S2\n \\ EValidSplitExt (S2a @ S2b)\n \\ restrict G G' S2 (Suc(length w)) = restrict G G' (S2a @ S2b) (Suc (length w))\"\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"min (length S2) (Suc (length w))\"\n and s=\"Suc (length w)\"\n in ssubst)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n S=\"S2\"\n and S'=\"[]\"\n in EValidSplit_Esplit_signature_length)\n apply(force)\n apply(clarsimp)\n apply(force)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"0\\ x \\ x \\ SSX\" for SSX)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule nat_seq_in_interval)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: Esplit_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply (simp add: Esplit_signature_append)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1\"\n and S'=\"SL#S2\"\n in EValidSplit_Esplit_signature_length)\n apply(force)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply (rule_tac\n w=\"SL\"\n and v=\"S2\"\n in Esplit_signature_Cons)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(subgoal_tac \"Esplit_signature S1 @ Esplit_signature [SL] @ Esplit_signature S2 = w @ teB b # liftB \\1 @ teA A2 # liftB \\2\")\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(thin_tac \"Esplit_signature S1 @ Esplit_signature (SL # S2) = w @ teB b # liftB \\1 @ teA A2 # liftB \\2\")\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(thin_tac \"Esplit_signature (SL # S2) = Esplit_signature [SL] @ Esplit_signature S2\")\n apply(subgoal_tac \"Esplit_signature [SL] = [teA A2]\")\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Esplit_signature S2 = liftB \\2\")\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply(rule_tac\n ?w1.0=\"Esplit_signature S1\"\n and A=\"A2\"\n in equal_terminal_suffix)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(rule setA_liftB)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"strict_prefix S1 S2a \\ SSX\" for SSX)\n apply(rename_tac x S1 SL S2)(*strict*)\n prefer 2\n apply(rule mutual_strict_prefix_prefix)\n apply(rule sym)\n apply(force)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(erule disjE)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac x S1 SL S2)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac x SL S2 c)(*strict*)\n apply (simp add: Esplit_signature_append)\n apply(subgoal_tac \"(S2a @ c @ SL # S2) ! x = SSX\" for SSX)\n apply(rename_tac x SL S2 c)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac x SL S2 c)(*strict*)\n apply(clarsimp)\n done\n\ntheorem Esplit_derivation_enforces_EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal: \"\n Esplit_TSstructure G\n \\ F2LR1inputx G G'\n \\ split_TSstructure G\n \\ Esplit.derivation_initial G d\n \\ d n = Some (pair e S)\n \\ k ESplitItem_elem (S!k) = Some (teA A)\n \\ i i \\ (Eident_lines S)\"\n apply(induct n arbitrary: e S k A i)\n apply(rename_tac e S k A i)(*strict*)\n apply(simp add: Esplit.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac S k A i)(*strict*)\n apply(simp add: Esplit_initial_configurations_def)\n apply(rename_tac n e S k A i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e S k A i)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d\"\n and n=\"n\"\n and m=\"Suc n\"\n in Esplit.step_detail_before_some_position)\n apply(rename_tac n e S k A i)(*strict*)\n apply(rule Esplit.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e S k A i)(*strict*)\n apply(force)\n apply(rename_tac n e S k A i)(*strict*)\n apply(force)\n apply(rename_tac n e S k A i)(*strict*)\n apply(clarsimp)\n apply(rename_tac n S k A i e1 e2 c1)(*strict*)\n apply(simp add: Esplit_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n k A i e1 e2 S1 SL S2)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"S1 @ SL # S2\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"length S1\"\n in meta_allE)\n apply(clarsimp)\n apply(case_tac e2)\n apply(rename_tac n k A i e1 e2 S1 SL S2 prod_lhsa prod_rhsa)(*strict*)\n apply(rename_tac A w)\n apply(rename_tac n k Aa i e1 e2 S1 SL S2 A w)(*strict*)\n apply(erule_tac\n x=\"A\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac n k Aa i e1 S1 SL S2 A w)(*strict*)\n apply(thin_tac \"Esplit.derivation_initial G d\")\n apply(thin_tac \"d (Suc n) = Some (pair (Some \\prod_lhs = A, prod_rhs = w\\) (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (nth_opt S2 0) @ drop (Suc 0) S2))\")\n apply(rename_tac n k Aa i e1 S1 SL S2 A w)(*strict*)\n apply(thin_tac \"d n = Some (pair e1 (S1 @ SL # S2))\")\n apply(case_tac \"iprod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (nth_opt S2 0) @ drop (Suc 0) S2) ! i\")\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(rule nth_eq_ignore_append)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(force)\n apply(rename_tac n k Aa i e1 S1 SL S2 A w)(*strict*)\n apply(subgoal_tac \"length S1\\i\")\n apply(rename_tac n k Aa i e1 S1 SL S2 A w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n k Aa i e1 S1 SL S2 A w)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(subgoal_tac \"length(Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL)) = SSX\" for SSX)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n prefer 2\n apply(rule Xstep_gen_length)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(case_tac S2)\n apply(rename_tac k Aa i S1 SL S2 A w)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(simp add: nth_opt_def)\n apply(simp add: Xstep_mergeL_def)\n apply(case_tac \"Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL)\")\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(subgoal_tac \"k < length S1 + (length (if True then [] else Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # butlast (Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) + length (case ESplitItem_elem (if True then Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ else last (Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) of None \\ [Xstep_merge1 (last (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) EmptyESplitItem] | Some e \\ [last (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))]))\")\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"True\"\n and s=\"Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL) = []\"\n in ssubst)\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(thin_tac \"k < length S1 + (length (if Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL) = [] then [] else Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # butlast (Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) + length (case ESplitItem_elem (if Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL) = [] then Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ else last (Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) of None \\ [Xstep_merge1 (last (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))) EmptyESplitItem] | Some e \\ [last (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\ # Xstep_gen (filterA (tl w)) (ESplitItem_to SL @ ESplitItem_ignore SL))]))\")\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_elem (Xstep_elem SL \\prod_lhs = A, prod_rhs = w\\)\")\n apply(rename_tac k Aa i S1 SL A w)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A w a list)(*strict*)\n apply(case_tac w)\n apply(rename_tac k Aa i S1 SL A w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(subgoal_tac \"a#list=[]\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(rule_tac\n t=\"a#list\"\n and s=\"Xstep_gen [] (ESplitItem_to SL @ ESplitItem_ignore SL)\"\n in ssubst)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(rule_tac\n t=\"[]\"\n and s=\"Xstep_gen [] (ESplitItem_to SL @ ESplitItem_ignore SL)\"\n in subst)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(thin_tac \"Xstep_gen [] (ESplitItem_to SL @ ESplitItem_ignore SL) = a # list\")\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A w a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac k Aa i S1 SL A a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa lista ab listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(subgoal_tac \"listb=[]\")\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n prefer 2\n apply(rule LR1_at_most_two_symbols)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a aa ab)(*strict*)\n apply(case_tac ab)\n apply(rename_tac k Aa i S1 SL A a aa ab ac)(*strict*)\n prefer 2\n apply(rename_tac k Aa i S1 SL A a aa ab b)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a aa b)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(rename_tac k Aa i S1 SL A a aa ab ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a aa ac)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(subgoal_tac \"nat_seq 0 0 = [0]\")\n apply(rename_tac k Aa i S1 SL A a aa ac)(*strict*)\n prefer 2\n apply (metis natUptTo_n_n)\n apply(rename_tac k Aa i S1 SL A a aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A aa ac)(*strict*)\n apply(simp add: Xstep_elem_def)\n apply(simp add: Xstep_gen_def)\n apply(simp add: nth_opt_def)\n apply(case_tac \"Suc k = Suc (Suc (length S1))\")\n apply(rename_tac k Aa i S1 SL A aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n apply(subgoal_tac \"(S1 @ [SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa, teA ac]\\], ESplitItem_elem := Some aa, ESplitItem_to := ac # ESplitItem_to SL\\, \\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\]) ! Suc (length S1) = [\\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\]!SSX\" for SSX)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa i S1 SL A aa)(*strict*)\n apply(case_tac \"i=length S1\")\n apply(rename_tac Aa i S1 SL A aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa S1 SL A aa)(*strict*)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(rename_tac Aa i S1 SL A aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL S2 A w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A w a list)(*strict*)\n apply(simp add: nth_opt_def)\n apply(case_tac w)\n apply(rename_tac k Aa i S1 SL A w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(simp add: Xstep_mergeL_def)\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_elem_def)\n apply(simp add: nth_opt_def)\n apply(simp add: Xstep_merge1_def)\n apply(case_tac \"strict_prefix (ESplitItem_elim a) (ESplitItem_to (Xstep_elem SL \\prod_lhs = A, prod_rhs = []\\))\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_merge1_toWasNotEliminated_def Xstep_elem_def)\n apply(case_tac \"length S1=k\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(subgoal_tac \"length S1 < k\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = ESplitItem_elim SL, ESplitItem_from = ESplitItem_from SL, ESplitItem_ignore = ESplitItem_ignore SL, ESplitItem_elim_prods = ESplitItem_elim_prods SL, ESplitItem_prods = ESplitItem_prods SL @ \\prod_lhs = A, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods a) @ ESplitItem_prods a, ESplitItem_elem = ESplitItem_elem a, ESplitItem_to = ESplitItem_to a @ drop (length (ESplitItem_elim a) + length (option_to_list (ESplitItem_from a))) (ESplitItem_to SL)\\ # list) ! k = SSlistX\" for SSlistX)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(S1 @ \\ESplitItem_elim = ESplitItem_elim SL, ESplitItem_from = ESplitItem_from SL, ESplitItem_ignore = ESplitItem_ignore SL, ESplitItem_elim_prods = ESplitItem_elim_prods SL, ESplitItem_prods = ESplitItem_prods SL @ \\prod_lhs = A, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods a) @ ESplitItem_prods a, ESplitItem_elem = ESplitItem_elem a, ESplitItem_to = ESplitItem_to a @ drop (length (ESplitItem_elim a) + length (option_to_list (ESplitItem_from a))) (ESplitItem_to SL)\\ # list) ! k = list ! (k - Suc (length S1))\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(rule Esplit_signature_Cons_not_empty_setA2)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_merge1_toWasEliminated_def Xstep_elem_def)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = ESplitItem_elim SL @ option_to_list (ESplitItem_from SL) @ drop (length (ESplitItem_to SL)) (ESplitItem_elim a), ESplitItem_from = ESplitItem_from a, ESplitItem_ignore = ESplitItem_ignore a, ESplitItem_elim_prods = ESplitItem_elim_prods SL @ (ESplitItem_prods SL @ \\prod_lhs = A, prod_rhs = []\\ # foldl (@) [] (take (length (ESplitItem_to SL)) (ESplitItem_elim_prods a))) # drop (length (ESplitItem_to SL)) (ESplitItem_elim_prods a), ESplitItem_prods = ESplitItem_prods a, ESplitItem_elem = ESplitItem_elem a, ESplitItem_to = ESplitItem_to a\\ # list) ! k = SSlistX\" for SSlistX)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(S1 @ \\ESplitItem_elim = ESplitItem_elim SL @ option_to_list (ESplitItem_from SL) @ drop (length (ESplitItem_to SL)) (ESplitItem_elim a), ESplitItem_from = ESplitItem_from a, ESplitItem_ignore = ESplitItem_ignore a, ESplitItem_elim_prods = ESplitItem_elim_prods SL @ (ESplitItem_prods SL @ \\prod_lhs = A, prod_rhs = []\\ # foldl (@) [] (take (length (ESplitItem_to SL)) (ESplitItem_elim_prods a))) # drop (length (ESplitItem_to SL)) (ESplitItem_elim_prods a), ESplitItem_prods = ESplitItem_prods a, ESplitItem_elem = ESplitItem_elem a, ESplitItem_to = ESplitItem_to a\\ # list) ! k = list ! (k - Suc (length S1))\")\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(rule Esplit_signature_Cons_not_empty_setA2)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A w a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac k Aa i S1 SL A a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(simp add: Xstep_mergeL_def)\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_elem_def)\n apply(simp add: nth_opt_def)\n apply(simp add: Xstep_elem_def)\n apply(subgoal_tac \"(S1 @ SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa]\\], ESplitItem_elem := nth_opt [aa] 0\\ # a # list) ! k = (a#list)!SSX\" for SSX)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(S1 @ SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa]\\], ESplitItem_elem := nth_opt [aa] 0\\ # a # list) ! k = (a # list) ! (k - Suc (length S1))\")\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(case_tac \"k-Suc(length S1)\")\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(clarsimp)\n apply(rule Esplit_signature_Cons_not_empty_setA)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa nat)(*strict*)\n apply(clarsimp)\n apply(rule Esplit_signature_Cons_not_empty_setA2)\n apply(rename_tac k Aa i S1 SL A a list aa nat)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa nat)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa nat)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa lista ab listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(subgoal_tac \"listb=[]\")\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n prefer 2\n apply(rule LR1_at_most_two_symbols)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ab listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ab)(*strict*)\n apply(case_tac ab)\n apply(rename_tac k Aa i S1 SL A a list aa ab ac)(*strict*)\n prefer 2\n apply(rename_tac k Aa i S1 SL A a list aa ab b)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa b)(*strict*)\n apply(rule LR1_terminal_only_at_front_in_prods)\n apply(rename_tac k Aa i S1 SL A a list aa b)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa b)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ab ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(simp add: Xstep_mergeL_def)\n apply(simp add: Xstep_gen_def)\n apply(subgoal_tac \"nat_seq 0 0 = [0]\")\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n prefer 2\n apply (metis natUptTo_n_n)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_elem_def)\n apply(simp add: nth_opt_def)\n apply(subgoal_tac \"(S1 @ SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa, teA ac]\\], ESplitItem_elem := Some aa, ESplitItem_to := ac # ESplitItem_to SL\\ # \\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\ # a # list) ! k = (SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa, teA ac]\\], ESplitItem_elem := Some aa, ESplitItem_to := ac # ESplitItem_to SL\\ # \\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\ # a # list)!SSX\" for SSX)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(case_tac \"k-length S1\")\n apply(rename_tac k Aa i S1 SL A a list aa ac)(*strict*)\n apply(clarsimp)\n apply(rename_tac k Aa i S1 SL A a list aa ac nat)(*strict*)\n apply(subgoal_tac \"k=Suc nat+length S1\")\n apply(rename_tac k Aa i S1 SL A a list aa ac nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac k Aa i S1 SL A a list aa ac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa i S1 SL A a list aa ac nat)(*strict*)\n apply(case_tac nat)\n apply(rename_tac Aa i S1 SL A a list aa ac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa i S1 SL A a list aa)(*strict*)\n apply(subgoal_tac \"i=length S1\")\n apply(rename_tac Aa i S1 SL A a list aa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac Aa i S1 SL A a list aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa S1 SL A a list aa)(*strict*)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(rename_tac Aa i S1 SL A a list aa ac nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(case_tac \"i=Suc(length S1)\")\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa, teA ac]\\], ESplitItem_elem := Some aa, ESplitItem_to := ac # ESplitItem_to SL\\ # \\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\ # a # list) ! Suc (length S1) = (\\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\ # a # list)!SSY\" for SSY)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(clarsimp)\n apply(case_tac nata)\n apply(rename_tac Aa S1 SL A a list aa ac nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa S1 SL A a list aa ac)(*strict*)\n apply(rule Esplit_signature_Cons_not_empty_setA)\n apply(rename_tac Aa S1 SL A a list aa ac)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nata nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac Aa S1 SL A a list aa ac nat)(*strict*)\n apply(rule Esplit_signature_Cons_not_empty_setA2)\n apply(rename_tac Aa S1 SL A a list aa ac nat)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nat)(*strict*)\n apply(force)\n apply(rename_tac Aa S1 SL A a list aa ac nat)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"(S1 @ SL\\ESplitItem_prods := ESplitItem_prods SL @ [\\prod_lhs = A, prod_rhs = [aa, teA ac]\\], ESplitItem_elem := Some aa, ESplitItem_to := ac # ESplitItem_to SL\\ # \\ESplitItem_elim = [], ESplitItem_from = Some ac, ESplitItem_ignore = ESplitItem_to SL @ ESplitItem_ignore SL, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA ac), ESplitItem_to = []\\ # a # list) ! i = (a#list)!SSX\" for SSX)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(force)\n apply(rename_tac Aa i S1 SL A a list aa ac nata)(*strict*)\n apply(clarsimp)\n apply(case_tac \"i F2LR1inputx G G'\n \\ split_TSstructure G\n \\ Esplit.derivation_initial G d\n \\ d n = Some (pair e S)\n \\ EValidSplitExt S\"\n apply(simp add: EValidSplitExt_def)\n apply(rule conjI)\n apply(simp add: EValidSplitExt_no_elim_before_nonterminal_def)\n apply(clarsimp)\n apply(rename_tac k A i)(*strict*)\n apply(rule Esplit_derivation_enforces_EValidSplitExt_no_elim_before_nonterminal)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rename_tac k A i)(*strict*)\n apply(force)\n apply(rule conjI)\n apply(simp add: EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(clarsimp)\n apply(rename_tac k A i j)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac k A i j)(*strict*)\n prefer 2\n apply(rule Esplit_derivation_enforces_EValidSplitExt_no_pop_in_prods_before_nonterminal)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(rename_tac k A i j)(*strict*)\n apply(force)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(rule allI)\n apply(rename_tac k)(*strict*)\n apply(rule impI)\n apply(rule impI)\n apply(rule allI)\n apply(rename_tac k i)(*strict*)\n apply(rule impI)\n apply(erule exE)+\n apply(rename_tac k i A)(*strict*)\n apply(rule Esplit_derivation_enforces_EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n apply(rename_tac k i A)(*strict*)\n apply(force)\n done\n\nhide_fact Esplit_derivation_enforces_EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal\n (* important entirely_ignored_can_not_happend_to_early *)\n (* important Esplit_derivation_enforces_EValidSplitExt *)\n (* important restrict_equal_before_step_nonterminal *)\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_06_11/LR1_Property_Satisfaction__entire_derivation_tree_invariant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.27496568816602907}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Bisim_Subst_SC\n imports Weak_Late_Bisim_Subst Strong_Late_Bisim_Subst_SC\nbegin\n\n(******** Structural Congruence **********)\n\n(******** The \\-operator *****************)\n\nlemma resComm:\n fixes P :: pi\n \n shows \"<\\a><\\b>P \\\\<^sup>s <\\b><\\a>P\"\nproof -\n have \"<\\a><\\b>P \\\\<^sup>s <\\b><\\a>P\"\n by(rule Strong_Late_Bisim_Subst_SC.resComm)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n(******** Match *********)\n\nlemma matchId:\n fixes a :: name\n and P :: pi\n\n shows \"[a\\a]P \\\\<^sup>s P\"\nproof -\n have \"[a\\a]P \\\\<^sup>s P\" by(rule Strong_Late_Bisim_Subst_SC.matchId)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n(******** Mismatch *********)\n\n\n\n shows \"[a\\a]P \\\\<^sup>s \\\"\nproof -\n have \"[a\\a]P \\\\<^sup>s \\\" by(rule Strong_Late_Bisim_Subst_SC.mismatchNil)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n(******** The +-operator *********)\n\nlemma sumSym:\n fixes P :: pi\n and Q :: pi\n \n shows \"P \\ Q \\\\<^sup>s Q \\ P\"\nproof -\n have \"P \\ Q \\\\<^sup>s Q \\ P\" by(rule Strong_Late_Bisim_Subst_SC.sumSym)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n\n\n\n\n(******** The |-operator *********)\n\nlemma parZero:\n fixes P :: pi\n\n shows \"P \\ \\ \\\\<^sup>s P\"\nproof -\n have \"P \\ \\ \\\\<^sup>s P\" by(rule Strong_Late_Bisim_Subst_SC.parZero)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nlemma parSym:\n fixes P :: pi\n and Q :: pi\n\n shows \"P \\ Q \\\\<^sup>s Q \\ P\"\nproof -\n have \"P \\ Q \\\\<^sup>s Q \\ P\" by(rule Strong_Late_Bisim_Subst_SC.parSym)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n\n\n assumes \"x \\ P\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s P \\ <\\x>Q\"\nproof -\n from `x \\ P` have \"<\\x>(P \\ Q) \\\\<^sup>s P \\ <\\x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nlemma scopeExtPar':\n fixes P :: pi\n and Q :: pi\n and x :: name\n\n assumes \"x \\ Q\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s (<\\x>P) \\ Q\"\nproof -\n from `x \\ Q` have \"<\\x>(P \\ Q) \\\\<^sup>s (<\\x>P) \\ Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar')\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\n\n\n shows \"(P \\ Q) \\ R \\\\<^sup>s P \\ (Q \\ R)\"\nproof -\n have \"(P \\ Q) \\ R \\\\<^sup>s P \\ (Q \\ R)\" by(rule Strong_Late_Bisim_Subst_SC.parAssoc)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nlemma freshRes:\n fixes P :: pi\n and a :: name\n\n assumes \"a \\ P\"\n\n shows \"<\\a>P \\\\<^sup>s P\"\nusing assms\nproof -\n from `a \\ P` have \"<\\a>P \\\\<^sup>s P\" by(rule Strong_Late_Bisim_Subst_SC.scopeFresh)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nlemma scopeExtSum:\n fixes P :: pi\n and Q :: pi\n and x :: name\n \n assumes \"x \\ P\"\n\n shows \"<\\x>(P \\ Q) \\\\<^sup>s P \\ <\\x>Q\"\nproof -\n from `x \\ P` have \"<\\x>(P \\ Q) \\\\<^sup>s P \\ <\\x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtSum)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nlemma bangSC:\n fixes P\n\n shows \"!P \\\\<^sup>s P \\ !P\"\nproof -\n have \"!P \\\\<^sup>s P \\ !P\" by(rule Strong_Late_Bisim_Subst_SC.bangSC)\n thus ?thesis by(rule strongBisimWeakBisim)\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Late_Bisim_Subst_SC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.274965688166029}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | December 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law\nimports CSP_F_law_SKIP CSP_F_law_ref\n CSP_F_law_dist CSP_F_law_alpha_par \n CSP_F_law_step CSP_F_law_rep_par \n CSP_F_law_fix\n CSP_F_law_DIV CSP_F_law_SKIP_DIV \n CSP_F_law_step_ext CSP_F_law_norm \n CSP_T.CSP_T_law\nbegin\n\n(*********************************************************\n SKIP , DIV and Internal choice\n *********************************************************)\n\n(*** |~| ***)\n\nlemma cspF_SKIP_DIV_Int_choice: \n \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n (P |~| Q) =F[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_idem)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_unit)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_unit)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_idem)\napply (rule cspF_reflex)\ndone\n\n(*** !! ***)\n\nlemma cspF_SKIP_DIV_Rep_int_choice_sum: \n \"[| ALL c: sumset C. (Qf c = SKIP | Qf c = DIV) |] ==>\n (!! c:C .. Qf c) =F[M1,M2] \n (if (EX c: sumset C. Qf c = SKIP) then SKIP else DIV)\"\napply (case_tac \" sumset C={}\")\napply (simp add: cspF_Rep_int_choice_empty)\napply (case_tac \"ALL c: sumset C. Qf c = DIV\")\n apply (simp)\n apply (rule cspF_rw_left)\n apply (rule cspF_Rep_int_choice_const)\n apply (simp)\n apply (force)\n apply (simp)\n\n apply (simp)\n apply (elim bexE)\n apply (frule_tac x=\"c\" in bspec)\n apply (simp_all)\n apply (intro conjI impI)\n\n apply (rule cspF_rw_left)\n apply (subgoal_tac \n \"!! :C .. Qf =F[M1,M1]\n !! :({c:C. Qf c = SKIP}s Uns {c:C. Qf c ~= SKIP}s) .. Qf\")\n apply (simp (no_asm))\n apply (rule cspF_decompo)\n apply (simp)\n apply (simp)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_Rep_int_choice_union_Int)\n apply (simp)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_decompo)\n apply (rule cspF_Rep_int_choice_const)\n apply (force)\n apply (rule ballI)\n apply (simp)\n apply (case_tac \" sumset ({c:C. Qf c ~= SKIP}s) ={}\")\n apply (rule cspF_Rep_int_choice_DIV)\n apply (simp)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_Rep_int_choice_const)\n apply (simp_all)\n apply (intro allI impI)\n apply (subgoal_tac \"Qf ca = DIV\")\n apply (simp)\n apply (force)\n apply (simp)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_unit)\n apply (simp)\ndone\n\nlemma cspF_SKIP_DIV_Rep_int_choice_nat: \n \"[| ALL n:N. (Qf n = SKIP | Qf n = DIV) |] ==>\n (!nat n:N .. Qf n) =F[M1,M2] \n (if (EX n:N. Qf n = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemma cspF_SKIP_DIV_Rep_int_choice_set: \n \"[| ALL X:Xs. (Qf X = SKIP | Qf X = DIV) |] ==>\n (!set X:Xs .. Qf X) =F[M1,M2] \n (if (EX X:Xs. Qf X = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemmas cspF_SKIP_DIV_Rep_int_choice =\n cspF_SKIP_DIV_Rep_int_choice_sum\n cspF_SKIP_DIV_Rep_int_choice_nat\n cspF_SKIP_DIV_Rep_int_choice_set\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2749234837159158}} {"text": "theory TopoS_Interface_impl\nimports \"Lib/FiniteGraph\" \"Lib/FiniteListGraph\" TopoS_Interface TopoS_Helper\nbegin\n\nsection\\Executable Implementation with Lists\\\n text \\Correspondence List Implementation and set Specification\\\n \n subsection\\Abstraction from list implementation to set specification\\\n text\\Nomenclature: \\_spec\\ is the specification, \\_impl\\ the corresponding implementation.\\\n\n text\\\\_spec\\ and \\_impl\\ only need to comply for @{const wf_graph}s. \n We will always require the stricter @{const wf_list_graph}, which implies @{const wf_graph}.\n\\\n lemma \"wf_list_graph G \\ wf_graph (list_graph_to_graph G)\"\n by %invisible (metis wf_list_graph_def wf_list_graph_iff_wf_graph)\n\n locale TopoS_List_Impl = \n fixes default_node_properties :: \"'a\" (\"\\\") \n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\"\n and sinvar_impl::\"('v::vertex) list_graph \\ ('v::vertex \\ 'a) \\ bool\"\n and receiver_violation :: \"bool\"\n and offending_flows_impl::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n and node_props_impl::\"('v::vertex, 'a) TopoS_Params \\ ('v \\ 'a)\"\n and eval_impl::\"('v::vertex) list_graph \\ ('v, 'a) TopoS_Params \\ bool\"\n assumes\n spec: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\" \\ \\specification is valid\\\n and\n sinvar_spec_impl: \"wf_list_graph G \\ \n (sinvar_spec (list_graph_to_graph G) nP) = (sinvar_impl G nP)\"\n and\n offending_flows_spec_impl: \"wf_list_graph G \\ \n (SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP) = \n set`set (offending_flows_impl G nP)\"\n and \n node_props_spec_impl: \n \"SecurityInvariant.node_props_formaldef default_node_properties P = node_props_impl P\"\n and\n eval_spec_impl:\n \"(distinct (nodesL G) \\ distinct (edgesL G) \\ \n SecurityInvariant.eval sinvar_spec default_node_properties (list_graph_to_graph G) P ) = \n (eval_impl G P)\"\n\n subsection \\Security Invariants Packed\\\n\n text \\We pack all necessary functions and properties of a security invariant in a struct-like data structure.\\\n record ('v::vertex, 'a) TopoS_packed =\n nm_name :: \"string\"\n nm_receiver_violation :: \"bool\"\n nm_default :: \"'a\"\n nm_sinvar::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ bool\"\n nm_offending_flows::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n nm_node_props::\"('v::vertex, 'a) TopoS_Params \\ ('v \\ 'a)\" \n nm_eval::\"('v::vertex) list_graph \\ ('v, 'a)TopoS_Params \\ bool\"\n \n\n\n text\\The packed list implementation must comply with the formal definition.\\\n locale TopoS_modelLibrary =\n fixes m :: \"('v::vertex, 'a) TopoS_packed\" \\ \\concrete model implementation\\\n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\" \\ \\specification\\\n assumes\n name_not_empty: \"length (nm_name m) > 0\"\n and\n impl_spec: \"TopoS_List_Impl \n (nm_default m)\n sinvar_spec\n (nm_sinvar m)\n (nm_receiver_violation m)\n (nm_offending_flows m)\n (nm_node_props m)\n (nm_eval m)\"\n\n\n\n subsection\\Helpful Lemmata\\\n\n text\\show that @{term \"sinvar\"} complies\\\n lemma TopoS_eval_impl_proofrule: \n assumes inst: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\"\n assumes ev: \"\\nP. wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"\n (distinct (nodesL G) \\ distinct (edgesL G) \\ \n SecurityInvariant.eval sinvar_spec default_node_properties (list_graph_to_graph G) P) =\n (wf_list_graph G \\ sinvar_impl G (SecurityInvariant.node_props default_node_properties P))\"\n proof (cases \"wf_list_graph G\")\n case True\n hence \"sinvar_spec (list_graph_to_graph G) (SecurityInvariant.node_props default_node_properties P) =\n sinvar_impl G (SecurityInvariant.node_props default_node_properties P)\"\n using ev by blast\n\n with inst show ?thesis\n unfolding wf_list_graph_def \n by (simp add: wf_list_graph_iff_wf_graph SecurityInvariant.eval_def)\n next\n case False\n hence \"(distinct (nodesL G) \\ distinct (edgesL G) \\ wf_list_graph_axioms G) = False\"\n unfolding wf_list_graph_def by blast\n with False show ?thesis\n unfolding SecurityInvariant.eval_def[OF inst]\n by (fastforce simp: wf_list_graph_iff_wf_graph)\n qed\n\n\nsubsection \\Helper lemmata\\\n\n text\\Provide @{term sinvar} function and get back a function that computes the list of offending flows\n \n Exponential time!\n\\\n definition Generic_offending_list:: \"('v list_graph \\ ('v \\ 'a) \\ bool )\\ 'v list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\" where\n \"Generic_offending_list sinvar G nP = [f \\ (subseqs (edgesL G)). \n (\\ sinvar G nP \\ sinvar (FiniteListGraph.delete_edges G f) nP) \\ \n (\\(e1, e2)\\set f. \\ sinvar (add_edge e1 e2 (FiniteListGraph.delete_edges G f)) nP)]\"\n \n \n text\\proof rule: if @{term sinvar} complies, @{const Generic_offending_list} complies\\\n lemma Generic_offending_list_correct: \n assumes valid: \"wf_list_graph G\"\n assumes spec_impl: \"\\G nP. wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP = \n set`set( Generic_offending_list sinvar_impl G nP )\"\n proof -\n have \"\\ P G. set ` {x \\ set (subseqs (edgesL G)). P G (set x)} = {x \\ set ` set (subseqs (edgesL G)). P G (x)}\"\n by fastforce\n hence subset_subseqs_filter: \"\\ G P. {f. f \\ edges (list_graph_to_graph G) \\ P G f} \n = set ` set [f\\subseqs (edgesL G) . P G (set f)]\"\n unfolding list_graph_to_graph_def\n by (auto simp: subseqs_powset)\n\n from valid delete_edges_wf have \"\\f. wf_list_graph(FiniteListGraph.delete_edges G f)\" by fast\n with spec_impl[symmetric] FiniteListGraph.delete_edges_correct[of \"G\"] have impl_spec_delete:\n \"\\f. sinvar_impl (FiniteListGraph.delete_edges G f) nP = \n sinvar_spec (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)) nP\" by simp\n\n from spec_impl[OF valid, symmetric] have impl_spec_not:\n \"(\\ sinvar_impl G nP) = (\\ sinvar_spec (list_graph_to_graph G) nP)\" by auto\n\n from spec_impl[symmetric, OF FiniteListGraph.add_edge_wf[OF FiniteListGraph.delete_edges_wf[OF valid]]] have impl_spec_allE:\n \"\\ e1 e2 E. sinvar_impl (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E)) nP =\n sinvar_spec (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E))) nP\" by simp\n\n have list_graph: \"\\ e1 e2 G f. (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G f))) = \n (FiniteGraph.add_edge e1 e2 (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)))\"\n by(simp add: FiniteListGraph.add_edge_correct FiniteListGraph.delete_edges_correct)\n \n show ?thesis \n unfolding SecurityInvariant_withOffendingFlows.set_offending_flows_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_def\n Generic_offending_list_def\n apply(subst impl_spec_delete)\n apply(subst impl_spec_not)\n apply(subst impl_spec_allE)\n apply(subst list_graph)\n apply(rule subset_subseqs_filter)\n done\n qed\n\n lemma all_edges_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\(e1, e2)\\ (edges (list_graph_to_graph G)). P (list_graph_to_graph G) e1 e2) = (\\(e1, e2)\\set (edgesL G). Pl G e1 e2)\"\n unfolding list_graph_to_graph_def\n by simp\n\n lemma all_nodes_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\n \\ (nodes (list_graph_to_graph G)). P (list_graph_to_graph G) n) = (\\ n \\set (nodesL G). Pl G n)\"\n unfolding list_graph_to_graph_def\n by simp\n\n\n\n\n\n\n fun minimalize_offending_overapprox :: \"('v list_graph \\ bool) \\ \n ('v \\ 'v) list \\ ('v \\ 'v) list \\ 'v list_graph \\ ('v \\ 'v) list\" where\n \"minimalize_offending_overapprox _ [] keep _ = keep\" |\n \"minimalize_offending_overapprox m (f#fs) keep G = (if m (delete_edges G (fs@keep)) then\n minimalize_offending_overapprox m fs keep G\n else\n minimalize_offending_overapprox m fs (f#keep) G\n )\"\n\n thm minimalize_offending_overapprox_boundnP (*is usage of this one better?*)\n lemma minimalize_offending_overapprox_spec_impl:\n assumes valid: \"wf_list_graph (G::'v::vertex list_graph)\"\n and spec_impl: \"\\G nP::('v \\ 'a). wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"minimalize_offending_overapprox (\\G. sinvar_impl G nP) fs keeps G =\n TopoS_withOffendingFlows.minimalize_offending_overapprox (\\G. sinvar_spec G nP) fs keeps (list_graph_to_graph G)\"\n apply(subst minimalize_offending_overapprox_boundnP)\n using valid spec_impl apply(induction fs arbitrary: keeps)\n apply(simp add: SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox.simps; fail)\n apply(simp add: SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox.simps)\n apply (metis FiniteListGraph.delete_edges_wf delete_edges_list_set list_graph_correct(5))\n done\n\n text\\With @{const minimalize_offending_overapprox}, we can get one offending flow\\\n lemma minimalize_offending_overapprox_gives_some_offending_flow:\n assumes wf: \"wf_list_graph G\"\n and NetModelLib: \"TopoS_modelLibrary m sinvar_spec\"\n and violation: \"\\ (nm_sinvar m) G nP\"\n shows \"set (minimalize_offending_overapprox (\\G. (nm_sinvar m) G nP) (edgesL G) [] G) \\\n SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP\"\n proof -\n from wf have wfG: \"wf_graph (list_graph_to_graph G)\"\n by (simp add: wf_list_graph_def wf_list_graph_iff_wf_graph)\n from wf have dist_edges: \"distinct (edgesL G)\" by (simp add: wf_list_graph_def)\n\n let ?spec_algo=\"TopoS_withOffendingFlows.minimalize_offending_overapprox\n (\\G. sinvar_spec G nP) (edgesL G) [] (list_graph_to_graph G)\"\n\n note spec=TopoS_List_Impl.spec[OF TopoS_modelLibrary.impl_spec[OF NetModelLib]]\n\n from spec have spec_prelim: \"SecurityInvariant_preliminaries sinvar_spec\"\n by(simp add: SecurityInvariant_def)\n from spec_prelim SecurityInvariant_preliminaries.sinvar_monoI have mono:\n \"SecurityInvariant_withOffendingFlows.sinvar_mono sinvar_spec\" by blast\n \n from spec_prelim have empty_edges: \"sinvar_spec \\nodes = set (nodesL G), edges = {}\\ nP\"\n using SecurityInvariant_preliminaries.defined_offending \n SecurityInvariant_withOffendingFlows.sinvar_mono_imp_sinvar_mono \n SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows \n mono empty_subsetI graph.simps(1) \n list_graph_to_graph_def local.wf wf_list_graph_def wf_list_graph_iff_wf_graph\n by (metis)\n\n (*TODO: tune*)\n have spec_impl: \"wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = (nm_sinvar m) G nP\" for G nP\n using NetModelLib TopoS_List_Impl.sinvar_spec_impl TopoS_modelLibrary.impl_spec by fastforce\n \n from minimalize_offending_overapprox_spec_impl[OF wf] spec_impl have alog_spec:\n \"minimalize_offending_overapprox (\\G. (nm_sinvar m) G nP) fs keeps G =\n TopoS_withOffendingFlows.minimalize_offending_overapprox (\\G. sinvar_spec G nP) fs keeps (list_graph_to_graph G)\"\n for fs keeps by blast\n\n (*TODO: tune*)\n from spec_impl violation have\n \"SecurityInvariant_withOffendingFlows.is_offending_flows sinvar_spec (set (edgesL G)) (list_graph_to_graph G) nP\"\n apply(simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply(intro conjI)\n apply (simp add: local.wf; fail)\n apply(simp add: FiniteGraph.delete_edges_simp2 list_graph_to_graph_def)\n apply(simp add: empty_edges)\n done\n hence goal: \"SecurityInvariant_withOffendingFlows.is_offending_flows_min_set sinvar_spec\n (set ?spec_algo) (list_graph_to_graph G) nP\"\n apply(subst minimalize_offending_overapprox_boundnP) (*we do this subst pretty often. is this the right abstraction here?*)\n apply(rule SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_minimalize_offending_overapprox[OF\n mono wfG _ _ dist_edges])\n apply(simp add: list_graph_to_graph_def)+\n done\n\n from SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox_subseteq_input[of\n \"sinvar_spec\" \"(edgesL G)\" \"[]\"] have subset_edges:\n \"set ?spec_algo \\ edges (list_graph_to_graph G)\" \n apply(subst minimalize_offending_overapprox_boundnP)\n by(simp add: list_graph_to_graph_def)\n\n from goal show ?thesis\n by(simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def alog_spec subset_edges)\n qed\n\n\n\n\n\n\n(*TODO: this should be a header of TopoS_Libary. The header should be printed BEFORE the imports are processed. *)\nsection\\Security Invariant Library\\\n(*The SINVAR_* theory files all use the \"subsection\" command. Here is the top-section.*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Interface_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2749234837159158}} {"text": "section \\Sets Bounded by a Finite Cardinal $>2$ Are Not BNFs\\\n\n(*<*)\ntheory Finitely_Bounded_Set_Counterexample\nimports\n \"HOL-Cardinals.Cardinals\"\nbegin\n(*>*)\n\ntext \\Do not import this theory. It contains an inconsistent axiomatization.\nThe point is to exhibit the particular inconsistency.\\\n\ntypedef ('a, 'k) bset (\"_ set[_]\" [22, 21] 21) =\n \"{A :: 'a set. |A| 'b) \\ 'a set['k] \\ 'b set['k]\" is image\n using card_of_image ordLeq_ordLess_trans by blast\n\ninductive rel_bset :: \"('a \\ 'b \\ bool) \\ ('a, 'k) bset \\ ('b, 'k) bset \\ bool\" for R where\n \"set_bset x \\ {(x, y). R x y} \\ rel_bset R (map_bset fst x) (map_bset snd x)\"\n\ntext \\\nWe axiomatize the relator commutation property and show that we can deduce @{term False} from it.\n\nWe cannot do this with a locale, since we need the fully polymorphic version of the following axiom.\n\\\n\naxiomatization where\n inconsistent: \"rel_bset R1 OO rel_bset R2 \\ rel_bset (R1 OO R2)\"\n\nbnf \"('a, 'k) bset\"\n map: map_bset\n sets: set_bset\n bd: \"|UNIV :: 'k set| +c natLeq\"\n rel: rel_bset\nproof (standard, goal_cases)\n case 1 then show ?case\n by transfer simp\nnext\n case 2 then show ?case\n apply (rule ext)\n apply transfer\n apply auto\n done\nnext\n case 3 then show ?case\n apply transfer\n apply (auto simp: image_iff)\n done\nnext\n case 4 then show ?case\n apply (rule ext)\n apply transfer\n apply simp\n done\nnext\n case 5 then show ?case by (simp add: card_order_csum natLeq_card_order)\nnext\n case 6 then show ?case by (simp add: cinfinite_csum natLeq_cinfinite)\nnext\n case 7 then show ?case\n apply transfer\n apply (erule ordLeq_transitive[OF ordLess_imp_ordLeq ordLeq_csum1])\n apply simp\n done\nnext\n case 8 then show ?case by (rule inconsistent) \\ \\BAAAAAMMMM\\\nnext\n case 9 then show ?case\n by (auto simp: fun_eq_iff intro: rel_bset.intros elim: rel_bset.cases)\nqed\n\nlemma card_option_finite[simp]:\n assumes \"finite (UNIV :: 'k set)\"\n shows \"card (UNIV :: 'k option set) = Suc (card (UNIV :: 'k set))\"\n (is \"card ?L = Suc (card ?R)\")\nproof -\n have \"card ?L = Suc (card (?L - {None}))\" by (rule card.remove) (auto simp: assms)\n also have \"card (?L - {None}) = card ?R\"\n by (rule bij_betw_same_card[of the])\n (auto simp: bij_betw_def inj_on_def image_iff intro!: bexI[of _ \"Some x\" for x])\n finally show ?thesis .\nqed\n\ndatatype ('a :: enum) x = A | B \"'a option\" | C\n\nabbreviation \"Bs \\ B ` (insert None (Some ` set Enum.enum))\"\n\nlemma UNIV_x[simp]:\n \"(UNIV :: ('a :: enum) x set) = {A, C} \\ Bs\"\n (is \"_ = ?R\")\nproof (intro set_eqI iffI)\n fix x :: \"'a x\" show \"x \\ ?R\" by (cases x) (auto simp add: enum_UNIV)\nqed simp\n\nlemma Collect_split_in_rel: \"{(x, y). in_rel R x y} = R\"\n by auto\n\nlift_definition X :: \"('a :: enum x, 'a x) bset\" is \"insert A Bs\"\n by (subst finite_card_of_iff_card3) (auto simp: card_insert card_Diff_singleton_if)\n\nlift_definition Y :: \"('a :: enum x, 'a x) bset\" is \"insert C Bs\"\n by (subst finite_card_of_iff_card3) (auto simp: card_insert card_Diff_singleton_if)\n\nlift_definition Z :: \"('a :: enum x, 'a x) bset\" is \"{A, C}\"\n by (subst finite_card_of_iff_card3) (auto simp: card_insert card_Diff_singleton_if)\n\nlift_definition R :: \"('a x \\ 'a x, 'a :: enum x) bset\" is \"insert (A, A) ((\\B. (B, C)) ` Bs)\"\n by (subst finite_card_of_iff_card3)\n (auto simp: card_insert card_Diff_singleton_if image_iff card_image inj_on_def)\n\nlift_definition S :: \"('a x \\ 'a x, 'a :: enum x) bset\" is \"insert (C, C) ((\\B. (A, B)) ` Bs)\"\n by (subst finite_card_of_iff_card3)\n (auto simp: card_insert card_Diff_singleton_if image_iff card_image inj_on_def)\n\nlift_definition in_brel :: \"('a \\ 'b, 'k) bset \\ 'a \\ 'b \\ bool\" is in_rel .\n\nlemma False\nproof -\n have \"rel_bset (in_brel R) X Z\"\n unfolding bset.in_rel mem_Collect_eq\n apply (intro exI[of _ R])\n apply transfer\n apply (auto simp: image_iff)\n done\n moreover\n have \"rel_bset (in_brel S) Z Y\"\n unfolding bset.in_rel mem_Collect_eq\n apply (intro exI[of _ S])\n apply transfer\n apply (auto simp: image_iff)\n done\n ultimately have \"rel_bset (in_brel R OO in_brel S) X Y\"\n unfolding bset.rel_compp by blast\n moreover\n have *: \"insert (A, A) ((\\B. (B, C)) ` Bs) O insert (C, C) ((\\B. (A, B)) ` Bs) =\n ((\\B. (B, C)) ` Bs) \\ ((\\B. (A, B)) ` Bs)\" (is \"_ = ?RS\" ) by auto\n have \"\\ rel_bset (in_brel R OO in_brel S) X Y\"\n unfolding bset.in_rel mem_Collect_eq\n proof (transfer, safe, unfold relcompp_in_rel * Collect_split_in_rel)\n fix Z :: \"('a :: enum x \\ 'a x) set\"\n note enum_UNIV[simp] UNIV_option_conv[symmetric, simp]\n assume \"Z \\ ?RS\" \"fst ` Z = insert A Bs\" \"snd ` Z = insert C Bs\"\n then have \"Z = ?RS\" unfolding fst_eq_Domain snd_eq_Range by auto\n moreover assume \"|Z| Z = ?RS\\\n by (subst (asm) finite_card_of_iff_card3, simp, simp, subst (asm) card_Un_disjoint)\n (auto simp: card_insert card_Diff_singleton_if card_image inj_on_def split: if_splits)\n qed\n ultimately show False by blast\nqed\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Probabilistic_System_Zoo/Finitely_Bounded_Set_Counterexample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2748883140527326}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Bisimulation\n imports Weak_Simulation Weak_Stat_Imp Bisim_Struct_Cong\nbegin\n\ncontext env begin\n\nlemma monoCoinduct: \"\\x y xa xb xc P Q \\.\n x \\ y \\\n (\\ \\ Q \\<{(xc, xb, xa). x xc xb xa}> P) \\\n (\\ \\ Q \\<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakSimMonotonic)\nby(auto dest: le_funE)\n\nlemma monoCoinduct2: \"\\x y xa xb xc P Q \\.\n x \\ y \\\n (\\ \\ Q \\<{(xc, xb, xa). x xc xb xa}> P) \\\n (\\ \\ Q \\<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakStatImpMonotonic)\nby(auto dest: le_funE)\n\ncoinductive_set weakBisim :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\" \nwhere\n step: \"\\\\ \\ P \\ Q; \\ \\ P \\ Q;\n \\\\'. (\\ \\ \\', P, Q) \\ weakBisim; (\\, Q, P) \\ weakBisim\\ \\ (\\, P, Q) \\ weakBisim\"\nmonos monoCoinduct monoCoinduct2\n\nabbreviation\n weakBisimJudge (\"_ \\ _ \\ _\" [70, 70, 70] 65) where \"\\ \\ P \\ Q \\ (\\, P, Q) \\ weakBisim\"\nabbreviation\n weakBisimNilJudge (\"_ \\ _\" [70, 70] 65) where \"P \\ Q \\ \\ \\ P \\ Q\"\n\nlemma weakBisimCoinductAux[consumes 1]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\ \\ P \\<(X \\ weakBisim)> Q) \\\n (\\ \\ P \\<(X \\ weakBisim)> Q) \\\n (\\\\'. (\\ \\ \\', P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ weakBisim) \\\n ((\\, Q, P) \\ X \\ (\\, Q, P) \\ weakBisim)\"\n\n shows \"(\\, P, Q) \\ weakBisim\"\nproof -\n have \"X \\ weakBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakBisim}\" by auto\n with assms show ?thesis\n by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakBisimCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ \\' \\ R \\<(X \\ weakBisim)> S\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ \\' \\ R \\<(X \\ weakBisim)> S\"\n and \"\\\\' R S \\''. (\\', R, S) \\ X \\ (\\' \\ \\'', R, S) \\ X \\ \\' \\ \\'' \\ R \\ S\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ (\\', S, R) \\ X \\ \\' \\ S \\ R\"\n\n shows \"\\ \\ P \\ Q\"\nproof -\n have \"X \\ weakBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakBisim}\" by auto\n with assms show ?thesis\n by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakBisimWeakCoinductAux[consumes 1]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\ Q \\ \\ \\ P \\ Q \\\n (\\\\'. (\\ \\ \\', P, Q) \\ X) \\ (\\, Q, P) \\ X\" \n\n shows \"\\ \\ P \\ Q\"\nusing assms\nby(coinduct rule: weakBisimCoinductAux) (blast intro: weakSimMonotonic weakStatImpMonotonic)\n\nlemma weakBisimWeakCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\ Q\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\ Q\"\n and \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X\"\n\n shows \"(\\, P, Q) \\ weakBisim\"\nproof -\n have \"X \\ weakBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakBisim}\" by auto\n with assms show ?thesis\n by(coinduct rule: weakBisimWeakCoinductAux) blast\nqed\n\nlemma weakBisimE:\n fixes P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: 'b\n and \\' :: 'b\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\ Q\"\n and \"\\ \\ P \\ Q\"\n and \"\\ \\ \\' \\ P \\ Q\"\n and \"\\ \\ Q \\ P\"\nusing assms\nby(auto intro: weakBisim.cases simp add: rtrancl_def)\n\nlemma weakBisimI:\n fixes P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: 'b\n\n assumes \"\\ \\ P \\ Q\"\n and \"\\ \\ P \\ Q\"\n and \"\\\\'. \\ \\ \\' \\ P \\ Q\"\n and \"\\ \\ Q \\ P\"\n\n shows \"\\ \\ P \\ Q\"\nusing assms\nby(rule_tac weakBisim.step) (auto simp add: rtrancl_def)\n\nlemma weakBisimReflexive:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n\n shows \"\\ \\ P \\ P\"\nproof -\n let ?X = \"{(\\, P, P) | \\ P. True}\"\n have \"(\\, P, P) \\ ?X\" by simp\n thus ?thesis\n by(coinduct rule: weakBisimWeakCoinduct, auto intro: weakSimReflexive weakStatImpReflexive)\nqed\n\nlemma weakBisimClosed:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n \n assumes \"\\ \\ P \\ Q\"\n\n shows \"(p \\ \\) \\ (p \\ P) \\ (p \\ Q)\"\nproof -\n let ?X = \"{(p \\ \\, p \\ P, p \\ Q) | (p::name prm) \\ P Q. \\ \\ P \\ Q}\"\n have \"eqvt ?X\"\n apply(auto simp add: eqvt_def)\n apply(rule_tac x=\"pa@p\" in exI)\n by(auto simp add: pt2[OF pt_name_inst])\n from \\\\ \\ P \\ Q\\ have \"(p \\ \\, p \\ P, p \\ Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: weakBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n {\n fix \\ P Q p\n assume \"\\ \\ P \\ (Q::('a, 'b, 'c) psi)\"\n hence \"\\ \\ P \\ Q\" by(rule weakBisimE)\n hence \"\\ \\ P \\ Q\"\n apply(rule_tac A=weakBisim in weakStatImpMonotonic, auto)\n by(rule_tac x=\"[]::name prm\" in exI) auto\n with \\eqvt ?X\\ have \"((p::name prm) \\ \\) \\ (p \\ P) \\ (p \\ Q)\"\n by(rule weakStatImpClosed)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?case by blast\n next\n case(cSim \\ P Q)\n {\n fix p :: \"name prm\"\n fix \\ P Q\n assume \"\\ \\ P \\ Q\"\n hence \"\\ \\ P \\ Q\"\n apply(rule_tac A=weakBisim in weakSimMonotonic, auto)\n by(rule_tac x=\"[]::name prm\" in exI) auto\n with \\eqvt ?X\\ have \"((p::name prm) \\ \\) \\ (p \\ P) \\ (p \\ Q)\"\n by(rule_tac weakSimClosed)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?case\n by(blast dest: weakBisimE)\n next\n case(cExt \\ P Q \\')\n {\n fix p :: \"name prm\"\n fix \\ P Q \\'\n assume \"\\\\'. (\\ \\ \\', P, Q) \\ weakBisim\"\n hence \"((p \\ \\) \\ \\', p \\ P, p \\ Q) \\ ?X\"\n apply(auto, rule_tac x=p in exI)\n apply(rule_tac x=\"\\ \\ (rev p \\ \\')\" in exI)\n by(auto simp add: eqvts)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?case\n by(blast dest: weakBisimE)\n next\n case(cSym \\ P Q)\n thus ?case\n by(blast dest: weakBisimE)\n qed\nqed\n\nlemma weakBisimEqvt[simp]:\n shows \"eqvt weakBisim\"\nby(auto simp add: eqvt_def weakBisimClosed)\n\nlemma statEqWeakBisim:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n \n assumes \"\\ \\ P \\ Q\"\n and \"\\ \\ \\'\"\n\n shows \"\\' \\ P \\ Q\"\nproof -\n let ?X = \"{(\\', P, Q) | \\ P Q \\'. \\ \\ P \\ Q \\ \\ \\ \\'}\"\n from \\\\ \\ P \\ Q\\ \\\\ \\ \\'\\ have \"(\\', P, Q) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cStatImp \\' P Q)\n from \\(\\', P, Q) \\ ?X\\ obtain \\ where \"\\ \\ P \\ Q\" and \"\\ \\ \\'\"\n by auto\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\ Q\" by(rule weakBisimE)\n moreover note \\\\ \\ \\'\\\n moreover have \"\\\\ P Q \\'. \\\\ \\ P \\ Q; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?X \\ weakBisim\"\n by auto\n ultimately show ?case by(rule weakStatImpStatEq)\n next\n case(cSim \\' P Q)\n from \\(\\', P, Q) \\ ?X\\ obtain \\ where \"\\ \\ P \\ Q\" and \"\\ \\ \\'\"\n by auto\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\ Q\" by(blast dest: weakBisimE)\n moreover have \"eqvt ?X\"\n by(auto simp add: eqvt_def) (metis weakBisimClosed AssertionStatEqClosed)\n hence \"eqvt(?X \\ weakBisim)\" by auto\n moreover note \\\\ \\ \\'\\\n moreover have \"\\\\ P Q \\'. \\\\ \\ P \\ Q; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?X \\ weakBisim\"\n by auto\n ultimately show ?case by(rule weakSimStatEq)\n next\n case(cExt \\' P Q \\'')\n from \\(\\', P, Q) \\ ?X\\ obtain \\ where \"\\ \\ P \\ Q\" and \"\\ \\ \\'\"\n by auto\n from \\\\ \\ P \\ Q\\ have \"\\ \\ \\'' \\ P \\ Q\" by(rule weakBisimE)\n moreover from \\\\ \\ \\'\\ have \"\\ \\ \\'' \\ \\' \\ \\''\" by(rule Composition)\n ultimately show ?case by blast\n next\n case(cSym \\' P Q)\n from \\(\\', P, Q) \\ ?X\\ obtain \\ where \"\\ \\ P \\ Q\" and \"\\ \\ \\'\"\n by auto\n from \\\\ \\ P \\ Q\\ have \"\\ \\ Q \\ P\" by(rule weakBisimE)\n thus ?case using \\\\ \\ \\'\\ by auto\n qed\nqed\n\nlemma weakBisimTransitive:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes PQ: \"\\ \\ P \\ Q\"\n and QR: \"\\ \\ Q \\ R\"\n\n shows \"\\ \\ P \\ R\"\nproof -\n let ?X = \"{(\\, P, R) | \\ P R. \\Q. \\ \\ P \\ Q \\ \\ \\ Q \\ R}\" \n from PQ QR have \"(\\, P, R) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cStatImp \\ P R)\n from \\(\\, P, R) \\ ?X\\ obtain Q where \"\\ \\ P \\ Q\" and \"\\ \\ Q \\ R\" by blast\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\ Q\" by(rule weakBisimE)\n moreover note \\\\ \\ Q \\ R\\\n moreover have \"?X \\ ?X \\ weakBisim\" by auto\n moreover note weakBisimE(1)\n moreover from weakBisimE(2) have \"\\\\ P Q P'. \\\\ \\ P \\ Q; \\ \\ P \\\\<^sup>^\\<^sub>\\ P'\\ \\ \\Q'. \\ \\ Q \\\\<^sup>^\\<^sub>\\ Q' \\ \\ \\ P' \\ Q'\"\n by(metis weakBisimE(4) weakSimTauChain)\n ultimately show ?case by(rule weakStatImpTransitive)\n next\n case(cSim \\ P R)\n {\n fix \\ P Q R\n assume \"\\ \\ P \\ Q\" and \"\\ \\ Q \\ R\"\n moreover have \"eqvt ?X\"\n by(force simp add: eqvt_def dest: weakBisimClosed)\n with weakBisimEqvt have \"eqvt (?X \\ weakBisim)\" by blast\n moreover have \"?X \\ ?X \\ weakBisim\" by auto\n moreover note weakBisimE(2)\n ultimately have \"\\ \\ P \\<(?X \\ weakBisim)> R\"\n by(rule_tac weakSimTransitive) auto\n }\n with \\(\\, P, R) \\ ?X\\ show ?case\n by(blast dest: weakBisimE)\n next\n case(cExt \\ P R \\')\n thus ?case by(blast dest: weakBisimE)\n next\n case(cSym \\ P R)\n thus ?case by(blast dest: weakBisimE)\n qed\nqed\n\nlemma strongBisimWeakBisim:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\ Q\"\nproof -\n from \\\\ \\ P \\ Q\\\n show ?thesis\n proof(coinduct rule: weakBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n from \\\\ \\ P \\ Q\\ have \"insertAssertion(extractFrame P) \\ \\\\<^sub>F insertAssertion(extractFrame Q) \\\"\n by(metis bisimE FrameStatEq_def)\n moreover from \\\\ \\ P \\ Q\\ have \"\\\\'. \\ \\ \\' \\ P \\ Q\" by(rule bisimE)\n ultimately show ?case by(rule statImpWeakStatImp)\n next\n case(cSim \\ P Q)\n note \\\\ \\ P \\ Q\\\n moreover have \"\\\\ P Q. \\ \\ P \\ Q \\ insertAssertion(extractFrame Q) \\ \\\\<^sub>F insertAssertion(extractFrame P) \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n ultimately show ?case using bisimE(2) bisimE(3)\n by(rule strongSimWeakSim)\n next\n case(cExt \\ P Q \\')\n from \\\\ \\ P \\ Q\\ show ?case\n by(rule bisimE)\n next\n case(cSym \\ P Q)\n from \\\\ \\ P \\ Q\\ show ?case\n by(rule bisimE)\n qed\nqed\n\nlemma structCongWeakBisim:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"P \\\\<^sub>s Q\"\n\n shows \"P \\ Q\"\nusing assms\nby(metis structCongBisim strongBisimWeakBisim)\n\nlemma simTauChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n\n assumes \"(\\, P, Q) \\ Rel\"\n and \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\"\n and Sim: \"\\\\ P Q. (\\, P, Q) \\ Rel \\ \\ \\ P \\[Rel] Q\"\n \n obtains P' where \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and \"(\\, P', Q') \\ Rel\"\nproof -\n assume A: \"\\P'. \\\\ \\ P \\\\<^sup>^\\<^sub>\\ P'; (\\, P', Q') \\ Rel\\ \\ thesis\"\n from \\\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\\ \\(\\, P, Q) \\ Rel\\ A show ?thesis\n proof(induct arbitrary: P thesis rule: tauChainInduct)\n case(TauBase Q P)\n moreover have \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P\" by simp\n ultimately show ?case by blast\n next\n case(TauStep Q Q' Q'' P)\n from \\(\\, P, Q) \\ Rel\\ obtain P' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and \"(\\, P', Q') \\ Rel\"\n by(rule TauStep)\n from \\(\\, P', Q') \\ Rel\\ have \"\\ \\ P' \\[Rel] Q'\" by(rule Sim)\n then obtain P'' where P'Chain: \"\\ \\ P' \\\\ \\ P''\" and \"(\\, P'', Q'') \\ Rel\"\n using \\\\ \\ Q' \\\\ \\ Q''\\ by(drule_tac simE) auto\n from PChain P'Chain have \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" by(auto dest: tauActTauChain)\n thus ?case using \\(\\, P'', Q'') \\ Rel\\ by(rule TauStep)\n qed\nqed\n\nlemma quietBisimNil:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"quiet P\"\n\n shows \"\\ \\ P \\ \\\"\nproof -\n let ?X = \"{(\\, \\, P) | \\ P. quiet P} \\ {(\\, P, \\) | \\ P. quiet P}\"\n\n from \\quiet P\\ have \"(\\, P, \\) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n thus ?case\n apply(simp add: weakStatImp_def)\n apply(rule allI)\n apply(rule_tac x=Q in exI)\n apply auto\n apply(drule_tac \\=\\ in quietFrame)\n apply(rule_tac G=\"\\\\, \\\\\" in FrameStatImpTrans)\n using Identity\n apply(simp add: AssertionStatEq_def)\n apply(simp add: FrameStatEq_def)\n apply(drule_tac \\=\\ in quietFrame)\n apply(rule_tac G=\"\\\\, \\\\\" in FrameStatImpTrans)\n apply auto\n defer\n using Identity\n apply(simp add: AssertionStatEq_def)\n apply(simp add: FrameStatEq_def)\n done\n next\n case(cSim \\ P Q)\n moreover have \"eqvt ?X\" by(auto simp add: eqvt_def intro: quietEqvt)\n ultimately show ?case\n apply auto\n apply(rule quietSim)\n apply auto\n apply(auto simp add: weakSimulation_def)\n done\n next\n case(cExt \\ P Q \\')\n thus ?case by blast\n next\n case(cSym \\ P Q)\n thus ?case by blast\n qed\nqed\n\nlemma weakTransitiveWeakCoinduct[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes p: \"(\\, P, Q) \\ X\"\n and Eqvt: \"eqvt X\"\n and rStatImp: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\ Q\"\n and rSim: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\<({(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\\n (\\, P', Q') \\ X \\\n \\ \\ Q' \\ Q})> Q\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X\"\n and rSym: \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X\"\n\n shows \"\\ \\ P \\ Q\"\nproof -\n let ?X = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ X \\ \\ \\ Q' \\ Q}\"\n from p have \"(\\, P, Q) \\ ?X\"\n by(blast intro: bisimReflexive)\n thus ?thesis\n proof(coinduct rule: weakBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n {\n fix \\'\n from \\(\\ , P, Q) \\ ?X\\ obtain P' Q' where \"\\ \\ P \\ P'\" and \"(\\, P', Q') \\ X\" and \"\\ \\ Q' \\ Q\" by auto\n from \\(\\, P', Q') \\ X\\ obtain Q'' Q''' where Q'Chain: \"\\ \\ Q' \\\\<^sup>^\\<^sub>\\ Q''\"\n and PImpQ: \"insertAssertion (extractFrame P') \\ \\\\<^sub>F insertAssertion (extractFrame Q'') \\\"\n and Q''Chain: \"\\ \\ \\' \\ Q'' \\\\<^sup>^\\<^sub>\\ Q'''\" and \"(\\ \\ \\', P', Q''') \\ X\"\n apply(drule_tac rStatImp) by(auto simp add: weakStatImp_def) blast\n from \\\\ \\ Q' \\ Q\\ have \"\\ \\ Q \\ Q'\" by(rule bisimE)\n then obtain Q'''' where \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q''''\" and \"\\ \\ Q'''' \\ Q''\" using \\\\ \\ Q' \\\\<^sup>^\\<^sub>\\ Q''\\ bisimE(2)\n by(rule simTauChain)\n note \\\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q''''\\\n moreover have \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q'''') \\\"\n proof -\n from \\\\ \\ P \\ P'\\ have \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame P') \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n moreover from \\\\ \\ Q'''' \\ Q''\\ have \"insertAssertion (extractFrame Q'') \\ \\\\<^sub>F insertAssertion (extractFrame Q'''') \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n ultimately show ?thesis using PImpQ by(blast intro: FrameStatImpTrans)\n qed\n moreover from \\\\ \\ Q'''' \\ Q''\\ have \"\\ \\ \\' \\ Q'''' \\ Q''\" by(metis bisimE)\n then obtain Q''''' where Q''''Chain: \"\\ \\ \\' \\ Q'''' \\\\<^sup>^\\<^sub>\\ Q'''''\" and \"\\ \\ \\' \\ Q''''' \\ Q'''\" using Q''Chain bisimE(2)\n by(rule simTauChain)\n moreover from \\\\ \\ P \\ P'\\ \\(\\ \\ \\' , P', Q''') \\ X\\ \\\\ \\ \\' \\ Q''''' \\ Q'''\\ have \"(\\ \\ \\', P, Q''''') \\ ?X\" by(auto dest: bisimE)\n ultimately have \"\\Q' Q''. \\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'' \\ insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q'') \\ \\ \\ \\ \\' \\ Q'' \\\\<^sup>^\\<^sub>\\ Q' \\ (\\ \\ \\', P, Q') \\ ?X\" by blast\n }\n with \\(\\, P, Q) \\ ?X\\ show ?case by(simp add: weakStatImp_def) blast\n next\n case(cSim \\ P Q)\n from \\(\\, P, Q) \\ ?X\\ obtain P' Q' where \"\\ \\ P \\ P'\" and \"(\\, P', Q') \\ X\" and \"\\ \\ Q' \\ Q\" by auto\n from \\(\\, P', Q') \\ X\\ have \"\\ \\ P' \\ Q'\" \n by(rule rSim)\n moreover from \\\\ \\ Q' \\ Q\\ have \"\\ \\ Q' \\[bisim] Q\" by(rule bisimE)\n moreover from \\eqvt X\\ have \"eqvt ?X\"\n apply(auto simp add: eqvt_def)\n apply(drule_tac p=p in bisimClosed)\n apply(drule_tac p=p in bisimClosed)\n apply(rule_tac x=\"p \\ P'\" in exI, simp)\n by(rule_tac x=\"p \\ Q'\" in exI, auto)\n moreover from \\\\ \\ Q' \\ Q\\ have \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame Q') \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n moreover have \"{(\\, P, R) | \\ P R. \\Q. (\\, P, Q) \\ ?X \\ \\ \\ Q \\ R} \\ ?X\"\n by(blast intro: bisimTransitive)\n moreover note bisimE(3)\n ultimately have \"\\ \\ P' \\ Q\" by(rule strongAppend) \n moreover have \"{(\\, P, R) | \\ P R. \\Q. \\ \\ P \\ Q \\ (\\, Q, R) \\ ?X} \\ ?X\"\n by(blast intro: bisimTransitive)\n moreover {\n fix \\ P Q\n\n assume \"\\ \\ P \\ Q\"\n moreover have \"\\\\ P Q. \\ \\ P \\ Q \\ insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P) \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n ultimately have \"\\ \\ P \\ Q\" using bisimE(2) bisimE(3)\n by(rule strongSimWeakSim)\n }\n ultimately show ?case using \\\\ \\ P \\ P'\\ \\eqvt ?X\\\n by(rule_tac weakSimTransitive)\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: bisimE intro: rExt)\n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: bisimE intro: rSym)\n qed\nqed\n\n\n\n assumes p: \"(\\, P, Q) \\ X\"\n and Eqvt: \"eqvt X\"\n and rStatImp: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\<(X \\ weakBisim)> Q\"\n and rSim: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\<({(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\\n (\\, P', Q') \\ (X \\ weakBisim) \\\n \\ \\ Q' \\ Q})> Q\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X \\ weakBisim\"\n and rSym: \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X \\ weakBisim\"\n\n shows \"\\ \\ P \\ Q\"\nproof -\n from p have \"(\\, P, Q) \\ X \\ weakBisim\" by auto\n moreover from \\eqvt X\\ have \"eqvt(X \\ weakBisim)\" by auto\n ultimately show ?thesis\n proof(coinduct rule: weakTransitiveWeakCoinduct)\n case(cStatImp \\ P Q)\n thus ?case by(blast dest: rStatImp weakBisimE(1) weakStatImpMonotonic)\n next\n case(cSim \\ P Q)\n thus ?case by(fastforce intro: rSim weakBisimE(2) weakSimMonotonic bisimReflexive)\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: weakBisimE rExt) \n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: weakBisimE rSym)\n qed\nqed\n\nlemma weakTransitiveCoinduct2[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes p: \"(\\, P, Q) \\ X\"\n and Eqvt: \"eqvt X\"\n and rStatImp: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\ Q\"\n and rSim: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\<({(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ X \\ \\ \\ Q' \\ Q})> Q\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X\"\n and rSym: \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X\"\n\n shows \"\\ \\ P \\ Q\"\nproof -\n let ?X = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ X \\ \\ \\ Q' \\ Q}\"\n let ?Y = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ X \\ \\ \\ Q' \\ Q}\"\n\n from \\eqvt X\\ have \"eqvt ?X\"\n apply(auto simp add: eqvt_def)\n apply(drule_tac p=p in bisimClosed)\n apply(drule_tac p=p in weakBisimClosed)\n apply(rule_tac x=\"p \\ P'\" in exI, simp)\n by(rule_tac x=\"p \\ Q'\" in exI, auto)\n from \\eqvt X\\ have \"eqvt ?Y\"\n apply(auto simp add: eqvt_def)\n apply(drule_tac p=p in weakBisimClosed)\n apply(drule_tac p=p in weakBisimClosed)\n apply(rule_tac x=\"p \\ P'\" in exI, simp)\n by(rule_tac x=\"p \\ Q'\" in exI, auto)\n\n {\n fix \\ P Q\n assume \"(\\, P, Q) \\ ?X\"\n then obtain P' Q' where \"\\ \\ P \\ P'\" and \"(\\, P', Q') \\ X\" and \"\\ \\ Q' \\ Q\"\n by auto\n note \\\\ \\ P \\ P'\\\n moreover from \\(\\, P', Q') \\ X\\ have \"\\ \\ P' \\ Q'\" by(rule rSim)\n moreover note \\eqvt ?X\\\n moreover have \"{(\\, P, R) | \\ P R. \\Q. \\ \\ P \\ Q \\ (\\, Q, R) \\ ?X} \\ ?X\"\n by(blast intro: weakBisimTransitive)\n ultimately have \"\\ \\ P \\ Q'\" using weakBisimE(2) by(rule weakSimTransitive)\n moreover from \\\\ \\ Q' \\ Q\\ have \"\\ \\ Q' \\[bisim] Q\" by(rule bisimE)\n moreover note \\eqvt ?X\\\n moreover from \\\\ \\ Q' \\ Q\\ have \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame Q') \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n moreover have \"{(\\, P, R) | \\ P R. \\Q. (\\, P, Q) \\ ?X \\ \\ \\ Q \\ R} \\ ?X\"\n by(blast dest: bisimTransitive)\n moreover note bisimE(3)\n ultimately have \"\\ \\ P \\ Q\" by(rule_tac strongAppend) \n }\n note Goal = this\n\n from p have \"(\\, P, Q) \\ ?Y\" by(blast intro: weakBisimReflexive bisimReflexive rSym)\n thus ?thesis\n proof(coinduct rule: weakBisimWeakCoinduct)\n next\n case(cStatImp \\ P Q)\n {\n fix \\'\n\n from \\(\\, P, Q) \\ ?Y\\ obtain R S where \"\\ \\ P \\ R\" and \"(\\, R, S) \\ X\" and \"\\ \\ S \\ Q\" by auto\n from \\\\ \\ P \\ R\\ obtain R'' R' \n where RChain: \"\\ \\ R \\\\<^sup>^\\<^sub>\\ R''\" \n and PImpR'': \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame R'') \\\"\n and R''Chain: \"\\ \\ \\' \\ R'' \\\\<^sup>^\\<^sub>\\ R'\" \n and \"\\ \\ \\' \\ P \\ R'\"\n apply(drule_tac weakBisimE) by(simp add: weakStatImp_def) blast\n\n from \\(\\, R, S) \\ X\\ have \"(\\, S, R) \\ ?X\" by(blast intro: weakBisimReflexive bisimReflexive rSym)\n with RChain obtain S'' where SChain: \"\\ \\ S \\\\<^sup>^\\<^sub>\\ S''\" and \"(\\, S'', R'') \\ ?X\" using Goal\n by(rule weakSimTauChain)\n\n from \\(\\, S'', R'') \\ ?X\\ obtain T U where \"\\ \\ S'' \\ T\" and \"(\\, T, U) \\ X\" and \"\\ \\ U \\ R''\"\n by auto\n from \\\\ \\ U \\ R''\\ have R''ImpU: \"insertAssertion (extractFrame R'') \\ \\\\<^sub>F insertAssertion (extractFrame U) \\\"\n by(drule_tac bisimE) (simp add: FrameStatEq_def)\n \n from \\(\\, T, U) \\ X\\ weakStatImp_def\n obtain T'' T' where TChain: \"\\ \\ T \\\\<^sup>^\\<^sub>\\ T''\"\n and UImpT'': \"insertAssertion (extractFrame U) \\ \\\\<^sub>F insertAssertion (extractFrame T'') \\\"\n and T''Chain: \"\\ \\ \\' \\ T'' \\\\<^sup>^\\<^sub>\\ T'\" \n and \"(\\ \\ \\', U, T') \\ X\"\n by(blast dest: rStatImp rSym)\n\n from TChain \\\\ \\ S'' \\ T\\ weakBisimE(2) obtain S''' where S''Chain: \"\\ \\ S'' \\\\<^sup>^\\<^sub>\\ S'''\" and \"\\ \\ S''' \\ T''\"\n by(rule weakSimTauChain)\n\n from \\\\ \\ S''' \\ T''\\ weakStatImp_def\n obtain S''''' S'''' where S'''Chain: \"\\ \\ S''' \\\\<^sup>^\\<^sub>\\ S'''''\"\n and T''ImpS''''': \"insertAssertion (extractFrame T'') \\ \\\\<^sub>F insertAssertion (extractFrame S''''') \\\"\n and S'''''Chain: \"\\ \\ \\' \\ S''''' \\\\<^sup>^\\<^sub>\\ S''''\" \n and \"\\ \\ \\' \\ T'' \\ S''''\"\n by(metis weakBisimE)\n \n from SChain S''Chain S'''Chain have \"\\ \\ S \\\\<^sup>^\\<^sub>\\ S'''''\" by auto\n moreover from \\\\ \\ S \\ Q\\ have \"\\ \\ Q \\ S\" by(rule weakBisimE)\n ultimately obtain Q''' where QChain: \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'''\" and \"\\ \\ Q''' \\ S'''''\" using weakBisimE(2)\n by(rule weakSimTauChain)\n from \\\\ \\ Q''' \\ S'''''\\ have \"\\ \\ S''''' \\ Q'''\" by(rule weakBisimE)\n then obtain Q'' Q' where Q'''Chain: \"\\ \\ Q''' \\\\<^sup>^\\<^sub>\\ Q''\"\n and S'''''ImpQ'': \"insertAssertion (extractFrame S''''') \\ \\\\<^sub>F insertAssertion (extractFrame Q'') \\\"\n and Q''Chain: \"\\ \\ \\' \\ Q'' \\\\<^sup>^\\<^sub>\\ Q'\" \n and \"\\ \\ \\' \\ S''''' \\ Q'\" using weakStatImp_def\n by(metis weakBisimE)\n\n from QChain Q'''Chain have \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q''\" by auto\n moreover from PImpR'' R''ImpU UImpT'' T''ImpS''''' S'''''ImpQ''\n have \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q'') \\\"\n by(blast dest: FrameStatImpTrans)\n\n moreover from \\\\ \\ U \\ R''\\ have \"\\ \\ \\' \\ U \\ R''\" by(metis weakBisimE strongBisimWeakBisim)\n with R''Chain obtain U' where UChain: \"\\ \\ \\' \\ U \\\\<^sup>^\\<^sub>\\ U'\" and \"\\ \\ \\' \\ U' \\ R'\" using weakBisimE(2)\n by(rule weakSimTauChain)\n from \\\\ \\ \\' \\ U' \\ R'\\ have \"\\ \\ \\' \\ R' \\ U'\" by(rule weakBisimE)\n from \\(\\ \\ \\', U, T') \\ X\\ have \"(\\ \\ \\', T', U) \\ ?X\" by(blast intro: rSym weakBisimReflexive bisimReflexive)\n with UChain obtain T''' where T'Chain: \"\\ \\ \\' \\ T' \\\\<^sup>^\\<^sub>\\ T'''\" and \"(\\ \\ \\', T''', U') \\ ?X\" using Goal\n by(rule weakSimTauChain)\n from \\(\\ \\ \\', T''', U') \\ ?X\\ have \"(\\ \\ \\', U', T''') \\ ?Y\" \n by(blast dest: weakBisimE rSym strongBisimWeakBisim)\n from T''Chain T'Chain have \"\\ \\ \\' \\ T'' \\\\<^sup>^\\<^sub>\\ T'''\" by auto\n then obtain S'''''' where S''''Chain: \"\\ \\ \\' \\ S'''' \\\\<^sup>^\\<^sub>\\ S''''''\" and \"\\ \\ \\' \\ T''' \\ S''''''\" \n using \\\\ \\ \\' \\ T'' \\ S''''\\ weakBisimE(2)\n apply(drule_tac weakBisimE(4))\n by(rule weakSimTauChain) (auto dest: weakBisimE(4))\n from S'''''Chain S''''Chain have \"\\ \\ \\' \\ S''''' \\\\<^sup>^\\<^sub>\\ S''''''\" by auto\n\n with \\\\ \\ \\' \\ S''''' \\ Q'\\\n obtain Q'''' where Q'Chain: \"\\ \\ \\' \\ Q' \\\\<^sup>^\\<^sub>\\ Q''''\" and \"\\ \\ \\' \\ S'''''' \\ Q''''\" using weakBisimE(2)\n apply(drule_tac weakBisimE(4))\n by(rule weakSimTauChain) (auto dest: weakBisimE(4))\n\n from Q''Chain Q'Chain have \"\\ \\ \\' \\ Q'' \\\\<^sup>^\\<^sub>\\ Q''''\" by auto\n moreover from \\\\ \\ \\' \\ P \\ R'\\ \\\\ \\ \\' \\ R' \\ U'\\ \\(\\ \\ \\', U', T''') \\ ?Y\\ \\\\ \\ \\' \\ T''' \\ S''''''\\\n \\\\ \\ \\' \\ S'''''' \\ Q''''\\\n have \"(\\ \\ \\', P, Q'''') \\ ?Y\"\n by auto (blast dest: weakBisimTransitive)\n ultimately have \"\\Q'' Q'. \\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'' \\ insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame Q'') \\ \\ \\ \\ \\' \\ Q'' \\\\<^sup>^\\<^sub>\\ Q' \\ (\\ \\ \\', P, Q') \\ ?Y\"\n by blast\n }\n thus ?case by(simp add: weakStatImp_def)\n next\n case(cSim \\ P Q)\n moreover {\n fix \\ P P' Q' Q\n assume \"\\ \\ P \\ P'\" and \"(\\, P', Q') \\ X\" and \"\\ \\ Q' \\ Q\"\n from \\(\\, P', Q') \\ X\\ have \"(\\, P', Q') \\ ?X\"\n by(blast intro: weakBisimReflexive bisimReflexive)\n moreover from \\\\ \\ Q' \\ Q\\ have \"\\ \\ Q' \\ Q\" by(rule weakBisimE)\n moreover note \\eqvt ?Y\\\n moreover have \"{(\\, P, R) | \\ P R. \\Q. (\\, P, Q) \\ ?X \\ \\ \\ Q \\ R} \\ ?Y\"\n by(blast dest: weakBisimTransitive strongBisimWeakBisim)\n ultimately have \"\\ \\ P' \\ Q\" using Goal\n by(rule weakSimTransitive)\n note \\\\ \\ P \\ P'\\ this \\eqvt ?Y\\\n moreover have \"{(\\, P, R) | \\ P R. \\Q. \\ \\ P \\ Q \\ (\\, Q, R) \\ ?Y} \\ ?Y\"\n by(blast dest: weakBisimTransitive)\n ultimately have \"\\ \\ P \\ Q\" using weakBisimE(2)\n by(rule weakSimTransitive)\n } \n ultimately show ?case by auto\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: bisimE weakBisimE intro: rExt)\n next\n case(cSym \\ P Q) \n thus ?case by(blast dest: bisimE(4) weakBisimE(4) rSym)\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weak_Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.27480192246452306}} {"text": "theory RedSafeCase\n imports WTLemma RedSafeUnpack\nbegin \n \n (* ###### case lemmas *) \n\nlemma safe_app_op_case: \"\\ app_red_exp OpApp (s1, AppExp (OpExp xop) v) ax (s2, e2); FunTy tx tau r a = op_type xop \\ \\ well_typed env r_s1 e2 tau r_s1 empty_use_env\"\n apply (case_tac v)\n apply (auto)\n apply (case_tac ax)\n apply (auto)\n (* given xop: op, x1: const, assuming tau matches the return type of xop, we want to show that e2 is well-typed.\n now e2 can either be an op or a const.\n *)\n apply (case_tac \"\\ (\\ rop. e2 = OpExp rop)\")\n apply (case_tac \"\\ (\\ c. e2 = ConstExp c)\")\n apply (auto)\n apply (case_tac xop)\n apply (auto)\n (* the hard part is proving that e2 will have the right type. *)\n apply (case_tac xop)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n (* op case, same thing *)\n apply (case_tac xop)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n done \n\nlemma well_typed_state_add_vars: \"\\ well_typed_state s1 env rs_map; fresh_var s1 x; well_typed_mem_value env r_s tau v; proper_mem_value rs_map v;\n sub_use_env s1 r_s; sep_nres_map r_s (rem_env rs_map x) \\ \\\n well_typed_state (add_env s1 x v) (add_env env (Loc x) tau) (add_env rs_map x r_s)\"\n (* starts by proving the validity of the env + res map *)\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (rule_tac dist_add_sub_env)\n apply (simp)\n apply (simp add: valid_nres_map_def)\n apply (auto)\n (* the state is still fully covered by the map *)\n apply (simp add: full_nres_map_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n (* prove disjointness remains *)\n apply (rule_tac disj_add_nres_map)\n apply (auto)\n (* prove containment remains *)\n apply (rule_tac add_sub_nres_map2)\n apply (rule_tac add_sub_nres_map1)\n apply (simp_all)\n apply (simp add: fresh_var_def)\n (* now it remains to prove that all the values are still well-typed. we do the x = xa case first *)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"x = xa\")\n apply (case_tac \"add_env s1 x v x\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"add_env env (Loc x) tau (Loc x)\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" in nres_add_same)\n apply (simp)\n apply (rule_tac well_typed_mv_add_vars)\n apply (simp add: add_env_def)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"Loc x\" in allE)\n apply (auto)\n (* proper mem value *)\n apply (rule_tac proper_add_mv)\n apply (simp add: add_env_def)\n apply (simp add: nres_lookup_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: full_nres_map_def)\n apply (simp add: fresh_var_def)\n apply (rule_tac leq_empty_use_env)\n (* now we do that x \\ xa case *)\n apply (simp add: add_env_def)\n apply (case_tac \"s1 xa\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"env (Loc xa)\")\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"xa\" in nres_add_diff)\n apply (simp_all)\n apply (rule_tac well_typed_mv_add_vars)\n apply (auto)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"Loc x\" in allE)\n apply (auto)\n (* properness *)\n apply (rule_tac proper_add_mv)\n apply (simp)\n apply (simp add: fresh_var_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: full_nres_map_def)\n apply (simp add: nres_lookup_def)\n apply (rule_tac leq_empty_use_env)\n done \n\n \nlemma sacc_make_act_case: \"\n \\well_typed_state s1 env rs_map; app_red_exp ConstApp (s1, AppExp (ConstExp c) v) (MakeAct x) (s2, e2); valid_exp_use_env s1 rs_map r_f;\n well_typed env r_s1 v t1 r_s2 rx2; leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))); leq_use_env rx r_s3;\n FunTy t1 t2 r a \\ const_type c; c \\ FixConst; ax = MakeAct x; leq_use_env r_s1 r_f\\\n \\ well_typed (add_env env (Loc x) t2) (add_use_env r_s1 (Loc x) OwnPerm) e2 t2 r_s3 rx\"\n (* e2 will always be the generated variable *)\n apply (case_tac \"e2 \\ VarExp (LocType x x)\")\n apply (case_tac c)\n apply (auto)\n (* simple var reqs *)\n apply (simp add: add_env_def)\n apply (case_tac c)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac c)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac ereq_leq_use_envx)\n apply (simp add: add_use_env_def)\n (* prelim: x2 is fresh *)\n apply (case_tac \"\\ fresh_var s1 x\")\n apply (case_tac c)\n apply (auto)\n (* prelim: cs is empty, remove elim *)(*\n apply (case_tac \"\\ cs = {}\")\n apply (case_tac c)\n apply (auto)*)\n (* prelim: r_s3 \\ r_s1 *)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n (* we can achieve the desired permissions by removing x from the end perms + reqs (which is okay since they dont appear anywhere else yet). *)\n apply (rule_tac x=\"one_use_env (Loc x) OwnPerm\" in exI)\n apply (auto)\n (* - the end perm bound is possible since we assume r_s3 didnt already contain x2 *)\n apply (rule_tac t=\" leq_use_env r_s3 (diff_use_env (add_use_env r_s1 (Loc x) OwnPerm) (comp_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)))\" and\n s=\" leq_use_env (rem_use_env r_s3 (Loc x)) (diff_use_env (add_use_env r_s1 (Loc x) OwnPerm) (comp_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)))\" in subst)\n apply (cut_tac r_s=\"r_s3\" and x=\"Loc x\" in ignore_rem_use_env)\n apply (rule_tac r_s=\"r_s1\" in leq_use_none)\n apply (auto)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sub_use_env_def)\n apply (auto)\n apply (simp add: fresh_var_def)\n apply (cut_tac r_x=\"r_s1\" and r_s=\"r_f\" and x=\"Loc x\" in leq_use_none)\n apply (auto)\n (* - given this, we can finish proving the bound *)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_rem_use_env)\n apply (rule_tac dist_rem_leq_use_env)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac weak_ereq_use_env)\n apply (case_tac c)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: unlim_def)\n apply (rule_tac rhs_add_leq_use_env)\n apply (auto)\n (* - unrolling definitions to prove the subtracter bound *)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: add_use_env_def)\n (* - proving the requirement bound *)\n apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)\" in trans_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (rule_tac diff_one_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n done \n \nlemma add_env_force_ex: \"\\ \\ z. add_env s x v z = add_env s x w z \\ \\ v = w\" \n apply (erule_tac x=\"x\" in allE)\n apply (simp add: add_env_def)\n done\n \nlemma add_env_force: \"\\ add_env s x v = add_env s x w \\ \\ v = w\" \n apply (rule_tac s=\"s\" and x=\"x\" and v=\"v\" and w=\"w\" in add_env_force_ex)\n apply (auto)\n done\n \nlemma disj_add_use_env: \"\\ disj_use_env r_s r_x; r_s x = NoPerm \\ \\ disj_use_env r_s (add_use_env r_x x r)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n done\n \nlemma strong_disj_add_use_env: \"\\ strong_disj_use_env r_s r_x; r_s x = NoPerm \\ \\ strong_disj_use_env r_s (add_use_env r_x x r)\" \n apply (simp add: strong_disj_use_env_def)\n apply (simp add: add_use_env_def)\n done \n\nlemma add_valid_exp_use_env: \"\\ valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s; fresh_var s x \\ \\\n valid_exp_use_env (add_env s x v) (add_env rs_map x empty_use_env) (add_use_env r_s (Loc x) OwnPerm)\" \n apply (simp add: valid_exp_use_env_def) \n apply (auto)\n (* domain preservation *)\n apply (rule_tac rhs_add_sub_use_env)\n apply (rule_tac add_sub_use_env)\n apply (simp)\n apply (simp add: add_env_def)\n (* separation *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (simp add: nres_add_same)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (simp add: nres_add_diff)\n apply (erule_tac x=\"xa\" in allE)\n apply (rule_tac comm_strong_disj_use_env)\n apply (rule_tac strong_disj_add_use_env)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp)\n apply (simp add: valid_nres_map_def)\n apply (simp add: sub_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: sub_use_env_def)\n apply (simp add: fresh_var_def)\n apply (auto)\n done\n\n\n \n (*\n the hard part that we're dealing with right now is that at the end using pairs does NOT work for the WRITE constants,\n since we want \"use\" permission for the array, but \"own\" permission for the value being written.\n\n what this suggests is that we have to allow for constant + application to be a value.\n even if we do this, we need to give them all their own unique cases, just like for unpacking.\n - this is more complicated than it is with constants, since the contents of the first arg will generally be somewhat complex.\n\n *)\n \n\nlemma saccmk2_var_type: \"\\ env (Loc x) = Some (ChanTy t c_end) \\ \\\n well_typed env (one_use_env (Loc x) OwnPerm) (VarExp (LocType x x)) (ChanTy t c_end) (one_use_env (Loc x) OwnPerm) (one_use_env (Loc x) OwnPerm)\" \n apply (auto)\n apply (rule_tac ereq_leq_use_envx)\n apply (simp add: one_use_env_def)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac weak_ereq_use_env)\n apply (simp add: unlim_def)\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac ereq_leq_use_envx)\n apply (simp add: one_use_env_def)\n done\n \nlemma saccmk2_pair_type: \"\\ well_typed env (one_use_env x1 OwnPerm) v1 t1 (one_use_env x1 OwnPerm) (one_use_env x1 OwnPerm);\n well_typed env (one_use_env x2 OwnPerm) v2 t2 (one_use_env x2 OwnPerm) (one_use_env x2 OwnPerm);\n r_s1 x1 = OwnPerm; r_s1 x2 = OwnPerm; r_s2 x1 = NoPerm; r_s2 x2 = NoPerm;\n leq_use_env r_s2 r_s1; leq_use_env rx r_s2; is_own r; x1 \\ x2 \\ \\\n well_typed env r_s1 (PairExp v1 v2) (PairTy t1 t2 r) r_s2 rx\"\n apply (auto)\n apply (rule_tac x=\"r_s1\" in exI)\n apply (rule_tac x=\"r_s1\" in exI)\n apply (rule_tac x=\"one_use_env x1 OwnPerm\" in exI)\n apply (auto)\n apply (rule_tac r_s=\"one_use_env x1 OwnPerm\" in well_typed_incr_simul_perm)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp)\n apply (rule_tac x=\"one_use_env x2 OwnPerm\" in exI)\n apply (auto)\n apply (rule_tac r_s=\"one_use_env x2 OwnPerm\" in well_typed_incr_simul_perm)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp)\n apply (simp add: is_own_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: is_own_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: is_own_def)\n apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n apply (auto)\n apply (simp add: is_own_def)\n apply (simp add: one_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (rule_tac x=\"add_use_env (one_use_env x1 OwnPerm) x2 OwnPerm\" in exI)\n apply (auto)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: add_use_env_def)\n apply (auto)\n apply (rule_tac add_leq_use_env)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (auto)\n apply (simp add: pair_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: leq_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: is_own_def)\n done\n \nlemma sacc_mk2_act_case: \"\n \\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; well_typed env r_s1 v t1 r_s2 rx2; proper_exp rs_map (AppExp (ConstExp c) v);\n leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; leq_use_env rx r_s3;\n leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f; FunTy t1 t2 r a \\ const_type c; c \\ FixConst; ax = Mk2Act x31 x32;\n is_value v; app_con s1 c v (Mk2Act x31 x32) (s2, e2)\\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\\n well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\\n safe_act s1 (infl_use_env r_f r_s3) g_ax \\ corr_act (Mk2Act x31 x32) g_ax\"\n apply (case_tac c)\n apply (auto)\n apply (cut_tac eq_own)\n apply (auto)\n apply (rule_tac x=\"Add2ResAct x31 x32 t\" in exI)\n apply (auto)\n apply (cut_tac env=\"add_env (add_env env (Loc x31) (ChanTy t SEnd)) (Loc x32) (ChanTy t REnd)\" and\n ?r_s1.0=\"add_use_env (add_use_env r_s1 (Loc x31) OwnPerm) (Loc x32) OwnPerm\" and\n ?r_s2.0=\"r_s3\" and ?v1.0=\"VarExp (LocType x31 x31)\" and ?v2.0=\"VarExp (LocType x32 x32)\" and ?t1.0=\"ChanTy t SEnd\" and ?t2.0=\"ChanTy t REnd\"\n and ?x1.0=\"Loc x31\" and ?x2.0=\"Loc x32\" in saccmk2_pair_type)\n apply (rule_tac saccmk2_var_type)\n apply (simp add: add_env_def)\n apply (rule_tac saccmk2_var_type)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: add_use_env_def)\n apply (rule_tac r_s=\"r_f\" in leq_use_none)\n apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (simp add: fresh_var_def)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sub_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"r_f\" in leq_use_none)\n apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (simp add: fresh_var_def)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sub_use_env_def)\n apply (auto)\n apply (rule_tac rhs_add_leq_use_env)\n apply (rule_tac rhs_add_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"ChanTy t REnd\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: is_own_def)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3a\" in exI)\n apply (rule_tac x=\"rx1a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exb\" in exI)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: is_own_def)\n (* proving the state remains proper *)\n apply (simp add: proper_exp_def)\n apply (auto)\n apply (rule_tac x=\"[]\" in exI)\n apply (simp)\n apply (rule_tac x=\"[]\" in exI)\n apply (simp)\n (* proving the state remains well-typed: environment containment *)\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (rule_tac dist_add_sub_env)\n apply (rule_tac dist_add_sub_env)\n apply (simp)\n (* res_map validity: completeness *)\n apply (simp add: valid_nres_map_def)\n apply (auto)\n apply (rule_tac add_full_nres_map)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* - disjointness *)\n apply (rule_tac disj_add_nres_map)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n apply (simp add: sep_nres_map_def)\n apply (simp add: empty_strong_disj_use_env1)\n apply (simp add: sep_nres_map_def)\n apply (simp add: empty_strong_disj_use_env1)\n (* - element containment *)\n apply (rule_tac dist_add_sub_nres_map)\n apply (rule_tac dist_add_sub_nres_map)\n apply (simp)\n apply (rule_tac empty_sub_use_env)\n apply (rule_tac empty_sub_use_env)\n (* proving that the memory is still well-typed. starting with x = x31 / x = x32 *)\n apply (case_tac \"x = x31\")\n apply (simp add: add_env_def)\n apply (case_tac \"x = x32\")\n apply (simp add: add_env_def)\n (* - otherwise compare with the originals *)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"s1 x\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"env (Loc x)\")\n apply (auto)\n apply (rule_tac well_typed_mv_add_vars)\n apply (rule_tac well_typed_mv_add_vars)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_env_def)\n apply (auto)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_env_def)\n apply (simp add: add_env_def)\n apply (auto)\n (* - properness *)\n apply (rule_tac proper_add_mv)\n apply (rule_tac proper_add_mv)\n apply (simp)\n apply (simp add: fresh_var_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: full_nres_map_def)\n apply (simp add: nres_lookup_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: fresh_var_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: full_nres_map_def)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (rule_tac leq_empty_use_env)\n (* proving the new res_map is still valid: expression map containment *)\n apply (simp add: valid_exp_use_env_def)\n apply (auto)\n apply (rule_tac rhs_add_sub_use_env)\n apply (rule_tac rhs_add_sub_use_env)\n apply (rule_tac add_sub_use_env)\n apply (rule_tac add_sub_use_env)\n apply (simp)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n (* map separation *)\n apply (rule_tac add_sep_nres_map)\n apply (rule_tac add_sep_nres_map)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (simp add: well_typed_state_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: sub_nres_map_def)\n apply (rule_tac add_strong_disj_use_env)\n apply (rule_tac add_strong_disj_use_env)\n apply (auto)\n apply (case_tac \"\\xa. nres_lookup rs_map x xa \\ NoPerm \\ (\\y. xa = Loc y \\ (\\ya. s1 y = Some ya))\")\n apply (erule_tac x=\"Loc x31\" in allE)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_use_env_def)\n apply (case_tac \"\\xa. nres_lookup rs_map x xa \\ NoPerm \\ (\\y. xa = Loc y \\ (\\ya. s1 y = Some ya))\")\n apply (erule_tac x=\"Loc x32\" in allE)\n apply (simp add: fresh_var_def)\n apply (simp add: sub_use_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (simp add: fresh_var_def)\n apply (simp add: fresh_var_def)\n done\n \n \n (* the idea is that if we added a permission, we required it to be a variable not already in the env, ie a variable free in e2.\n so then we can remove x by default. *)\n (* in general, this statement says that given a constant-application, the result can be typed with a certain env + perm set,\n so that the state remains well-typed relative to the env + global perm_map, and the env + perm set remains valid *)\nlemma safe_app_con_case: \"\\ well_typed_state s1 env rs_map;\n app_red_exp ConstApp (s1, AppExp (ConstExp c) v) ax (s2, e2); valid_exp_use_env s1 rs_map r_f;\n well_typed env r_s1 v t1 r_s2 rx2; proper_exp rs_map (AppExp (ConstExp c) v);\n leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; disj_use_env rx1 (lift_use_env rx2 r);\n leq_use_env rx r_s3; leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f;\n FunTy t1 t2 r a \\ const_type c; c \\ FixConst\\\n \\ \\g_ax . well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s3) g_ax \\ corr_act ax g_ax\"\n apply (case_tac ax)\n apply (auto)\n (* no action cases *)\n apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" and env=\"env\" in well_typed_perm_leq)\n apply (auto)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac sares_unpack_case)\n apply (auto)\n apply (simp add: upc_init_abbrev_def)\n apply (rule_tac x=\"r_s1\" in exI)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3a\" in exI)\n apply (rule_tac x=\"rx1a\" in exI)\n apply (auto)\n (* new resource cases. in all cases t2 should be the correct type to add *)\n apply (rule_tac x=\"AddResAct x2 t2 empty_use_env\" in exI)\n apply (auto)\n (* - lemma for main well-typedness statement *)\n apply (rule_tac ?s2.0=\"s2\" and ?rx1.0=\"rx1\" in sacc_make_act_case)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n (* - proper expression *)\n apply (case_tac c)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n (* - well typed state. *)\n apply (case_tac \"\\ (\\ v. s2 = add_env s1 x2 v)\")\n apply (case_tac c)\n apply (auto)\n apply (rule_tac well_typed_state_add_vars)\n apply (auto)\n apply (case_tac c)\n apply (auto)\n (* - wt mem val: array case *)\n apply (case_tac c)\n apply (auto)\n apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue []\" in add_env_force)\n apply (auto)\n apply (simp add: pure_fun_def)\n (* - valid res list *)\n apply (rule_tac x=\"\\ x. None\" in exI)\n apply (simp add: valid_res_list_def)\n (* - properness *)\n apply (case_tac c)\n apply (auto)\n apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue []\" in add_env_force)\n apply (simp)\n apply (auto)\n (* - x22 is contained in rs_map (true because x22 is the empty set) *)\n apply (simp add: sub_use_env_def)\n apply (simp add: empty_use_env_def)\n (* - map separation + strength *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env1)\n (* - valid use env. *)\n apply (case_tac \"\\ (\\ v. s2 = add_env s1 x2 v)\")\n apply (case_tac c)\n apply (auto)\n apply (rule_tac add_valid_exp_use_env)\n apply (simp add: well_typed_state_def)\n apply (simp)\n apply (case_tac c)\n apply (auto)\n apply (case_tac c)\n apply (auto)\n apply (simp add: fresh_var_def)\n apply (rule_tac leq_empty_use_env)\n (* dual new resource case. (basically only channel creation) *)\n apply (rule_tac sacc_mk2_act_case)\n apply (auto)\n (* resource usage case. (currently empty) *)\n apply (case_tac c)\n apply (auto)\n(*\n apply (case_tac c)\n apply (auto)\n apply (case_tac c)\n apply (auto)*)\n done \n\n \nlemma well_typed_empty_state: \"well_typed_state empty_env empty_env empty_env\"\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (simp add: sub_env_def)\n apply (simp add: empty_env_def)\n apply (simp add: valid_nres_map_def)(*\n apply (simp add: disj_res_map_def)\n apply (auto)\n apply (simp add: lookup_res_def)\n apply (rule_tac empty_strong_disj_use_env1)*)\n apply (auto)\n apply (simp add: full_nres_map_def)\n apply (simp add: empty_env_def)\n apply (simp add: disj_nres_map_def)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: empty_env_def)\n apply (rule_tac empty_strong_disj_use_env1)\n apply (simp add: sub_nres_map_def)\n apply (simp add: sub_use_env_def)\n apply (simp add: nres_lookup_def)\n apply (simp add: empty_env_def)\n apply (simp add: empty_use_env_def) \n apply (simp add: empty_env_def)\n done\n\n \nfun state_vars where\n \"state_vars s = { x | x. s x \\ None }\"\n \ndefinition fv_restr_env where\n \"fv_restr_env e s = (\\ x. if x \\ free_vars e then s x else None)\"\n \nlemma fv_restr_env_use: \"\\ x \\ free_vars e \\ \\ fv_restr_env e s x = s x\" \n apply (simp add: fv_restr_env_def)\n done\n \nlemma dist_rem_contain_env: \"\\ contain_env s s' \\ \\ contain_env (rem_env s x) (rem_env s' x)\" \n apply (simp add: contain_env_def)\n apply (simp add: rem_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"s' xa\")\n apply (auto)\n apply (simp add: rem_env_def)\n done\n\nlemma fv_contain_env: \"\\ free_vars e' \\ free_vars e \\ \\ contain_env (fv_restr_env e s) (fv_restr_env e' s)\" \n apply (simp add: contain_env_def)\n apply (simp add: fv_restr_env_def)\n apply (auto)\n apply (case_tac \"s x\")\n apply (auto)\n apply (simp add: fv_restr_env_def)\n apply (auto)\n done\n\nlemma rem_fv_contain_env: \"\\ free_vars e' - {x} \\ free_vars e \\ \\ contain_env (fv_restr_env e (rem_env s x)) (fv_restr_env e' (rem_env s x))\" \n apply (simp add: contain_env_def)\n apply (simp add: fv_restr_env_def)\n apply (auto)\n apply (simp add: rem_env_def)\n apply (auto)\n apply (case_tac \"s xa\")\n apply (auto)\n apply (simp add: fv_restr_env_def)\n apply (simp add: rem_env_def)\n apply (auto)\n done\n \nlemma rem_fv_restr_env: \"rem_env (fv_restr_env e s) x = fv_restr_env e (rem_env s x)\" \n apply (case_tac \"\\ (\\ y. rem_env (fv_restr_env e s) x y = fv_restr_env e (rem_env s x) y)\")\n apply (auto)\n apply (simp add: rem_env_def)\n apply (simp add: fv_restr_env_def)\n apply (case_tac \"x = y\")\n apply (auto)\n apply (case_tac \"x \\ free_vars e\")\n apply (auto)\n apply (simp add: fv_restr_env_def)\n apply (case_tac \"y \\ free_vars e\")\n apply (auto)\n done\n\n \n (* the question is, how do we allow for replicable pairs while enforcing full resource disjointness?\n i guess the \"natural\" way to do it based on what we already have is to simply allow pairs that contain\n values that are not unique to also be values.\n\n - if x is in the end perms, x is in the reqs. if r is own, (lift rx r) subtracts it out.\n - if r is not own, it means that e is replicable, in which case it is again not a var,\n - x is not in the end perms, which is trivial\n\n an even cleaner solution is to make a \"replicable\" pair value and type accordingly.\n in this case e is still a var, however at the level of reduction semantics, we can keep\n the var out of the name set.\n *)\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/RedSafeCase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514763, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2747723727132529}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n \"~~/src/HOL/Word/WordBitwise\"\n WordBitwise_Signed\n Hex_Words\n Norm_Words\nbegin\n\ntext \\Additional bit and type syntax that forces word types.\\\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n wordNOT :: \"'a::len0 word \\ 'a word\" (\"~~ _\" [70] 71)\nwhere\n \"~~ x == NOT x\"\n\nabbreviation\n wordAND :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"&&\" 64)\nwhere\n \"a && b == a AND b\"\n\nabbreviation\n wordOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"||\" 59)\nwhere\n \"a || b == a OR b\"\n\nabbreviation\n wordXOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"xor\" 59)\nwhere\n \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565327, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2745014577715254}} {"text": "section \\\\isaheader{Generic Map To Set Converter}\\\ntheory Gen_Map2Set\nimports \n \"../Intf/Intf_Map\"\n \"../Intf/Intf_Set\"\n \"../Intf/Intf_Comp\"\n \"../../Iterator/Iterator\"\nbegin\n\nlemma map_fst_unit_distinct_eq[simp]:\n fixes l :: \"('k\\unit) list\"\n shows \"distinct (map fst l) \\ distinct l\"\n by (induct l) auto\n\ndefinition \n map2set_rel :: \"\n (('ki\\'k) set \\ (unit\\unit) set \\ ('mi\\('k\\unit))set) \\ \n ('ki\\'k) set \\ \n ('mi\\('k set)) set\"\n where \n map2set_rel_def_internal: \n \"map2set_rel R Rk \\ \\Rk,Id::(unit\\_) set\\R O {(m,dom m)| m. True}\"\n\nlemma map2set_rel_def: \"\\Rk\\(map2set_rel R) \n = \\Rk,Id::(unit\\_) set\\R O {(m,dom m)| m. True}\"\n unfolding map2set_rel_def_internal[abs_def] by (simp add: relAPP_def)\n\nlemma map2set_relI:\n assumes \"(s,m')\\\\Rk,Id\\R\" and \"s'=dom m'\"\n shows \"(s,s')\\\\Rk\\map2set_rel R\"\n using assms unfolding map2set_rel_def by blast\n\nlemma map2set_relE:\n assumes \"(s,s')\\\\Rk\\map2set_rel R\"\n obtains m' where \"(s,m')\\\\Rk,Id\\R\" and \"s'=dom m'\"\n using assms unfolding map2set_rel_def by blast\n\nlemma map2set_rel_sv[relator_props]:\n \"single_valued (\\Rk,Id\\Rm) \\ single_valued (\\Rk\\map2set_rel Rm)\"\n unfolding map2set_rel_def\n by (auto intro: single_valuedI dest: single_valuedD)\n\nlemma map2set_empty[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP e op_map_empty (\\Rk,Id\\R)\"\n shows \"(e,{})\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by auto\n\nlemmas [autoref_rel_intf] = \n REL_INTFI[of \"map2set_rel R\" i_set] for R\n\n\ndefinition \"map2set_insert i k s \\ i k () s\"\nlemma map2set_insert[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP i op_map_update (Rk \\ Id \\ \\Rk,Id\\R \\ \\Rk,Id\\R)\"\n shows \n \"(map2set_insert i,Set.insert)\\Rk\\\\Rk\\map2set_rel R \\ \\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def map2set_insert_def[abs_def]\n by (force dest: fun_relD)\n\ndefinition \"map2set_memb l k s \\ case l k s of None \\ False | Some _ \\ True\"\nlemma map2set_memb[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP l op_map_lookup (Rk \\ \\Rk,Id\\R \\ \\Id\\option_rel)\"\n shows \"(map2set_memb l ,(\\))\n \\ Rk\\\\Rk\\map2set_rel R\\Id\"\n using assms\n unfolding map2set_rel_def map2set_memb_def[abs_def]\n by (force dest: fun_relD split: option.splits)\n \nlemma map2set_delete[autoref_rules_raw]:\n assumes \"PRIO_TAG_GEN_ALGO\"\n assumes \"GEN_OP d op_map_delete (Rk\\\\Rk,Id\\R\\\\Rk,Id\\R)\"\n shows \"(d,op_set_delete)\\Rk\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by (force dest: fun_relD)\n\nlemma map2set_to_sorted_list[autoref_ga_rules]:\n fixes it :: \"'m \\ ('k\\unit) list\"\n assumes A: \"GEN_ALGO_tag (is_map_to_sorted_list ordR Rk Id R it)\"\n shows \"is_set_to_sorted_list ordR Rk (map2set_rel R) \n (it_to_list (map_iterator_dom o (foldli o it)))\"\nproof -\n { \n fix l::\"('k\\unit) list\"\n have \"\\l0. foldli l (\\_. True) (\\x \\. \\ @ [fst x]) l0 = l0@map fst l\"\n by (induct l) auto\n }\n hence S: \"it_to_list (map_iterator_dom o (foldli o it)) = map fst o it\"\n unfolding it_to_list_def[abs_def] map_iterator_dom_def[abs_def]\n set_iterator_image_def set_iterator_image_filter_def\n by (auto)\n show ?thesis\n unfolding S\n using assms\n unfolding is_map_to_sorted_list_def is_set_to_sorted_list_def\n apply clarsimp\n apply (erule map2set_relE)\n apply (drule spec, drule spec)\n apply (drule (1) mp)\n apply (elim exE conjE)\n apply (rule_tac x=\"map fst l'\" in exI)\n apply (rule conjI)\n apply parametricity\n\n unfolding it_to_sorted_list_def\n apply (simp add: map_to_set_dom)\n apply (simp add: sorted_wrt_map key_rel_def[abs_def])\n done\nqed\n\nlemma map2set_to_list[autoref_ga_rules]:\n fixes it :: \"'m \\ ('k\\unit) list\"\n assumes A: \"GEN_ALGO_tag (is_map_to_list Rk Id R it)\"\n shows \"is_set_to_list Rk (map2set_rel R) \n (it_to_list (map_iterator_dom o (foldli o it)))\"\n using assms unfolding is_set_to_list_def is_map_to_list_def\n by (rule map2set_to_sorted_list)\n\n\n(*lemma map2set_it_simp[iterator_simps]:\n \"foldli ((map fst o it) x) c f s = foldli (it x) c (\\(k,v) s. f k s) s\" \n by (simp add: foldli_map comp_def fn_fst_conv)\n*)\n\ntext \\Transfering also non-basic operations results in specializations\n of map-algorithms to also be used for sets\\\nlemma map2set_union[autoref_rules_raw]:\n assumes \"MINOR_PRIO_TAG (- 9)\"\n assumes \"GEN_OP u (++) (\\Rk,Id\\R\\\\Rk,Id\\R\\\\Rk,Id\\R)\"\n shows \"(u,(\\))\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\\\\Rk\\map2set_rel R\"\n using assms\n unfolding map2set_rel_def\n by (force dest: fun_relD)\n\nlemmas [autoref_ga_rules] = cmp_unit_eq_linorder \nlemmas [autoref_rules_raw] = param_cmp_unit\n\nlemma cmp_lex_zip_unit[simp]:\n \"cmp_lex (cmp_prod cmp cmp_unit) (map (\\k. (k, ())) l)\n (map (\\k. (k, ())) m) =\n cmp_lex cmp l m\"\n apply (induct cmp l m rule: cmp_lex.induct)\n apply (auto split: comp_res.split)\n done\n\nlemma cmp_img_zip_unit[simp]:\n \"cmp_img (\\m. map (\\k. (k,())) (f m)) (cmp_lex (cmp_prod cmp1 cmp_unit))\n = cmp_img f (cmp_lex cmp1)\"\n unfolding cmp_img_def[abs_def]\n apply (intro ext)\n apply simp\n done\n\n(* TODO: Move *)\n\nlemma map2set_finite[relator_props]:\n assumes \"finite_map_rel (\\Rk,Id\\R)\"\n shows \"finite_set_rel (\\Rk\\map2set_rel R)\"\n using assms\n unfolding map2set_rel_def finite_set_rel_def finite_map_rel_def\n by auto\n\nlemma map2set_cmp[autoref_rules_raw]:\n assumes ELO: \"SIDE_GEN_ALGO (eq_linorder cmpk)\"\n assumes MPAR:\n \"GEN_OP cmp (cmp_map cmpk cmp_unit) (\\Rk,Id\\R \\ \\Rk,Id\\R \\ Id)\"\n assumes FIN: \"PREFER finite_map_rel (\\Rk, Id\\R)\"\n shows \"(cmp,cmp_set cmpk)\\\\Rk\\map2set_rel R \\ \\Rk\\map2set_rel R \\ Id\"\nproof -\n interpret linorder \"comp2le cmpk\" \"comp2lt cmpk\"\n using ELO by (simp add: eq_linorder_class_conv)\n\n show ?thesis\n using MPAR\n unfolding cmp_map_def cmp_set_def\n apply simp\n apply parametricity\n apply (drule cmp_extend_paramD)\n apply (insert FIN, fastforce simp add: finite_map_rel_def) []\n apply (simp add: sorted_list_of_map_def[abs_def])\n apply (auto simp: map2set_rel_def cmp_img_def[abs_def] dest: fun_relD) []\n\n apply (insert map2set_finite[OF FIN[unfolded autoref_tag_defs]],\n fastforce simp add: finite_set_rel_def)\n done\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/GenCF/Gen/Gen_Map2Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.27450145777152535}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: Implem_asymmetric.thy (Isabelle/HOL 2016-1)\n ID: $Id: Implem_asymmetric.thy 132885 2016-12-23 18:41:32Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Asymmetric channel implementation (local interpretation) using\n public-key encryption and signatures.\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Asymmetric Implementation of Channel Messages\\\n\ntheory Implem_asymmetric\nimports Implem\nbegin\n\n(**************************************************************************************************)\nsubsection \\Implementation of channel messages\\\n(**************************************************************************************************)\n\nfun implem_asym :: \"chan \\ msg\" where\n \"implem_asym (Insec A B M) = \\InsecTag, Agent A, Agent B, M\\\"\n |\"implem_asym (Confid A B M) = Aenc \\Agent A, M\\ (pubK B)\"\n |\"implem_asym (Auth A B M) = Sign \\Agent B, M\\ (priK A)\"\n |\"implem_asym (Secure A B M) = Sign (Aenc \\SecureTag, Agent A, M\\ (pubK B)) (priK A)\"\n\n\ntext \\\nFirst step: @{locale \"basic_implem\"}. \nTrivial as there are no assumption, this locale just defines some useful abbreviations and valid.\n\\\ninterpretation asym: basic_implem implem_asym\ndone\n\n\ntext \\Second step: @{locale \"semivalid_implem\"}.\nHere we prove some basic properties such as injectivity and some properties about the \ninteraction of sets of implementation messages with @{term analz}; these properties are \nproved as separate lemmas as the proofs are more complex. \n\\\n\ntext \\Auxiliary: simpler definitions of the \\implSets\\ for the proofs, using the \n\\msgSet\\ definitions. \n\\\n\nabbreviation implInsecSet_aux :: \"msg set \\ msg set\"\nwhere \"implInsecSet_aux G \\ PairSet Tags (PairSet AgentSet (PairSet AgentSet G))\"\n\nabbreviation implAuthSet_aux :: \"msg set \\ msg set\"\nwhere \"implAuthSet_aux G \\ SignSet (PairSet AgentSet G) (range priK)\"\n\nabbreviation implConfidSet_aux :: \"(agent * agent) set \\ msg set \\ msg set\"\nwhere \"implConfidSet_aux Ag G \\ AencSet (PairSet AgentSet G) (pubK` (Ag `` UNIV))\"\n\nabbreviation implSecureSet_aux :: \"(agent * agent) set \\ msg set \\ msg set\"\nwhere \"implSecureSet_aux Ag G \\\n SignSet (AencSet (PairSet Tags (PairSet AgentSet G)) (pubK` (Ag `` UNIV))) (range priK)\"\n\ntext \\These auxiliary definitions are overapproximations.\\\n\nlemma implInsecSet_implInsecSet_aux: \"asym.implInsecSet G \\ implInsecSet_aux G\"\nby auto\n\nlemma implAuthSet_implAuthSet_aux: \"asym.implAuthSet G \\ implAuthSet_aux G\"\nby auto\n\nlemma implConfidSet_implConfidSet_aux: \"asym.implConfidSet Ag G \\ implConfidSet_aux Ag G\"\nby (auto, blast)\n\nlemma implSecureSet_implSecureSet_aux: \"asym.implSecureSet Ag G \\ implSecureSet_aux Ag G\"\nby (auto, blast)\n\nlemmas implSet_implSet_aux =\n implInsecSet_implInsecSet_aux implAuthSet_implAuthSet_aux\n implConfidSet_implConfidSet_aux implSecureSet_implSecureSet_aux\n\ndeclare Enc_keys_clean_msgSet_Un [intro]\n\n\n(**************************************************************************************************)\nsubsection \\Lemmas to pull implementation sets out of @{term analz}\\\n(**************************************************************************************************)\n\ntext \\\nAll these proofs are similar:\n\\begin{enumerate}\n\\item prove the lemma for the @{term \"implSet_aux\"} and with the set added outside of \n @{term analz} given explicitly,\n\\item prove the lemma for the @{term \"implSet_aux\"} but with payload, and\n\\item prove the lemma for the @{term \"implSet\"}.\n\\end{enumerate}\nThere are two cases for the confidential and secure messages:\nthe general case (the payloads stay in @{term analz}) and the case where the key is unknown\n(the messages cannot be opened and are completely removed from the @{term analz}).\n\\\n\n\nsubsubsection \\Pull @{term PairAgentSet} out of \\analz\\\\\n(**************************************************************************************************)\n\nlemma analz_Un_PairAgentSet:\nshows\n \"analz (PairSet AgentSet G \\ H) \\ PairSet AgentSet G \\ AgentSet \\ analz (G \\ H)\"\nproof -\n have \"analz (PairSet AgentSet G \\ H) \\ PairSet AgentSet G \\ analz (AgentSet \\ G \\ H)\"\n by (rule analz_Un_PairSet)\n also have \"... \\ PairSet AgentSet G \\ AgentSet \\ analz (G \\ H)\"\n apply (simp only: Un_assoc)\n apply (intro Un_mono analz_Un_AgentSet, fast)\n done \n finally show ?thesis .\nqed\n\n\nsubsubsection \\Pull @{term implInsecSet} out of @{term analz}\\\n(**************************************************************************************************)\n\nlemma analz_Un_implInsecSet_aux_aux:\nassumes \"Enc_keys_clean (G \\ H)\"\nshows \"analz (implInsecSet_aux G \\ H) \\ implInsecSet_aux G \\ Tags \\ synth (analz (G \\ H))\"\nproof -\n have \"analz (implInsecSet_aux G \\ H) \\ \n implInsecSet_aux G \\ analz (Tags \\ PairSet AgentSet (PairSet AgentSet G) \\ H)\"\n by (rule analz_Un_PairSet)\n also have \"... \\ implInsecSet_aux G \\ Tags \\ analz (PairSet AgentSet (PairSet AgentSet G) \\ H)\"\n using assms\n apply - \n apply (simp only: Un_assoc, rule Un_mono, fast)\n apply (rule analz_Un_Tag, blast)\n done\n also have \"... \\ implInsecSet_aux G \\ Tags \\ PairSet AgentSet (PairSet AgentSet G) \\ AgentSet \n \\ analz (PairSet AgentSet G \\ H)\"\n apply -\n apply (simp only: Un_assoc, (rule Un_mono, fast)+)\n apply (simp only: Un_assoc [symmetric], rule analz_Un_PairAgentSet)\n done\n also have \n \"... \\ implInsecSet_aux G \\ Tags \\ PairSet AgentSet (PairSet AgentSet G) \\ AgentSet \n \\ PairSet AgentSet G \\ AgentSet \\ analz (G \\ H)\"\n apply -\n apply (simp only: Un_assoc, (rule Un_mono, fast)+)\n apply (simp only: Un_assoc [symmetric], rule analz_Un_PairAgentSet)\n done\n also have \"... \\ implInsecSet_aux G \\ Tags \\ synth (analz (G \\ H))\"\n apply - \n apply (simp only: Un_assoc, (rule Un_mono, fast)+, auto)\n done\n finally show ?thesis .\nqed\n\nlemma analz_Un_implInsecSet_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implInsecSet_aux G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implInsecSet_aux_aux], auto)\n\nlemma analz_Un_implInsecSet:\n \"Enc_keys_clean (G \\ H) \\\n analz (asym.implInsecSet G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implInsecSet_aux G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\napply (blast dest: analz_Un_implInsecSet_aux)\ndone\n\n\nsubsection \\Pull @{term implConfidSet} out of @{term analz}\\\n(**************************************************************************************************)\n\nlemma analz_Un_implConfidSet_aux_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implConfidSet_aux Ag G \\ H) \\ \n implConfidSet_aux Ag G \\ PairSet AgentSet G \\\n synth (analz (G \\ H))\"\napply (rule subset_trans [OF analz_Un_AencSet], blast, blast)\napply (simp only: Un_assoc, rule Un_mono, simp)\napply (rule subset_trans [OF analz_Un_PairAgentSet], blast)\ndone\n\nlemma analz_Un_implConfidSet_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implConfidSet_aux Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implConfidSet_aux_aux], auto)\n\nlemma analz_Un_implConfidSet:\n \"Enc_keys_clean (G \\ H) \\\n analz (asym.implConfidSet Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implConfidSet_aux Ag G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\nusing analz_Un_implConfidSet_aux apply blast\ndone\n\ntext \\Pull @{term implConfidSet} out of @{term analz}, 2nd case where the agents are honest.\\\n\nlemma analz_Un_implConfidSet_aux_aux_2:\n \"Enc_keys_clean H \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (implConfidSet_aux Ag G \\ H) \\ implConfidSet_aux Ag G \\ synth (analz H)\"\napply (rule subset_trans [OF analz_Un_AencSet2], simp)\napply (auto dest:analz_into_parts)\ndone\n\nlemma analz_Un_implConfidSet_aux_2:\n \"Enc_keys_clean H \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (implConfidSet_aux Ag G \\ H) \\ synth (analz H) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implConfidSet_aux_aux_2], auto)\n\nlemma analz_Un_implConfidSet_2:\n \"Enc_keys_clean H \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (asym.implConfidSet Ag G \\ H) \\ synth (analz H) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implConfidSet_aux Ag G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\nusing analz_Un_implConfidSet_aux_2 apply auto\ndone\n\n\nsubsection \\Pull @{term implAuthSet} out of @{term analz}\\\n(**************************************************************************************************)\n\nlemma analz_Un_implAuthSet_aux_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implAuthSet_aux G \\ H) \\ implAuthSet_aux G \\ synth (analz (G \\ H))\"\napply (rule subset_trans [OF analz_Un_SignSet], blast, blast)\napply (rule Un_mono, blast)\napply (rule subset_trans [OF analz_Un_PairAgentSet], blast)\ndone\n\nlemma analz_Un_implAuthSet_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implAuthSet_aux G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implAuthSet_aux_aux], auto)\n\nlemma analz_Un_implAuthSet:\n \"Enc_keys_clean (G \\ H) \\\n analz (asym.implAuthSet G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implAuthSet_aux G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\nusing analz_Un_implAuthSet_aux apply blast\ndone\n\n\nsubsection \\Pull @{term implSecureSet} out of @{term analz}\\\n(**************************************************************************************************)\n\nlemma analz_Un_implSecureSet_aux_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implSecureSet_aux Ag G \\ H) \\\n implSecureSet_aux Ag G \\ AencSet (PairSet Tags (PairSet AgentSet G)) (pubK` (Ag`` UNIV)) \\ \n PairSet Tags (PairSet AgentSet G) \\ Tags \\ PairSet AgentSet G \\\n synth (analz (G \\ H))\"\napply (rule subset_trans [OF analz_Un_SignSet], blast, blast)\napply (simp only:Un_assoc, rule Un_mono, simp)\napply (rule subset_trans [OF analz_Un_AencSet], blast, blast)\napply (rule Un_mono, simp)\napply (rule subset_trans [OF analz_Un_PairSet], rule Un_mono, simp, simp only: Un_assoc)\napply (rule subset_trans [OF analz_Un_Tag], blast)\napply (rule Un_mono, simp)\napply (rule subset_trans [OF analz_Un_PairAgentSet], blast)\ndone\n\nlemma analz_Un_implSecureSet_aux:\n \"Enc_keys_clean (G \\ H) \\\n analz (implSecureSet_aux Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implSecureSet_aux_aux], auto)\n\nlemma analz_Un_implSecureSet:\n \"Enc_keys_clean (G \\ H) \\\n analz (asym.implSecureSet Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implSecureSet_aux Ag G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\nusing analz_Un_implSecureSet_aux apply blast\ndone\n\ntext \\\nPull @{term implSecureSet} out of @{term analz}, 2nd case, where the agents are honest. \n\\\nlemma analz_Un_implSecureSet_aux_aux_2:\n \"Enc_keys_clean (G \\ H) \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (implSecureSet_aux Ag G \\ H) \\ \n implSecureSet_aux Ag G \\ AencSet (PairSet Tags (PairSet AgentSet G)) (pubK` (Ag`` UNIV)) \\\n synth (analz H)\"\napply (rule subset_trans [OF analz_Un_SignSet], blast, blast)\napply (simp only: Un_assoc, rule Un_mono, simp)\napply (rule subset_trans [OF analz_Un_AencSet2], simp)\napply (auto dest: analz_into_parts)\ndone\n\nlemma analz_Un_implSecureSet_aux_2:\n \"Enc_keys_clean (G \\ H) \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (implSecureSet_aux Ag G \\ H) \\ synth (analz H) \\ -payload\"\nby (rule subset_trans [OF analz_Un_implSecureSet_aux_aux_2], auto)\n\nlemma analz_Un_implSecureSet_2:\n \"Enc_keys_clean (G \\ H) \\\n Ag \\ broken (parts H \\ range LtK) = {} \\\n analz (asym.implSecureSet Ag G \\ H) \\\n synth (analz H) \\ -payload\"\napply (rule subset_trans [of _ \"analz (implSecureSet_aux Ag G \\ H)\" _])\napply (rule analz_mono, rule Un_mono, blast intro!: implSet_implSet_aux, simp)\nusing analz_Un_implSecureSet_aux_2 apply auto\ndone\n\ndeclare Enc_keys_clean_msgSet_Un [rule del]\n\n\nsubsection \\Locale interpretations\\\n(**************************************************************************************************)\n\ninterpretation asym: semivalid_implem implem_asym\nproof (unfold_locales)\n fix x A B M x' A' B' M'\n show \"implem_asym (Chan x A B M) = implem_asym (Chan x' A' B' M') \\\n x = x' \\ A = A' \\ B = B' \\ M = M'\"\n by (cases x, (cases x', auto)+)\nnext\n fix M' M x x' A A' B B'\n assume \"M' \\ payload\" \"implem_asym (Chan x A B M) \\ parts {implem_asym (Chan x' A' B' M')}\"\n then show \"x = x' \\ A = A' \\ B = B' \\ M = M'\"\n by (cases \"x\", auto,(cases x', auto)+)\nnext\n fix I\n assume \"I \\ asym.valid\"\n then show \"Enc_keys_clean I\"\n proof (simp add: Enc_keys_clean_def, intro allI impI)\n fix X Y\n assume \"Enc X Y \\ parts I\"\n obtain x A B M where \"M \\ payload\" and \"Enc X Y \\ parts {implem_asym (Chan x A B M)}\"\n using parts_singleton [OF \\Enc X Y \\ parts I\\] \\I \\ asym.valid\\\n by (auto elim!: asym.validE)\n then show \"Y \\ range LtK \\ Y \\ payload\" by (cases x, auto)\n qed\nnext\n fix Z\n show \"composed (implem_asym Z)\"\n proof (cases Z, simp)\n fix x A B M\n show \"composed (implem_asym (Chan x A B M))\" by (cases x, auto)\n qed\nnext\n fix x A B M\n show \"implem_asym (Chan x A B M) \\ payload\"\n by (cases x, auto)\nnext\n fix X K\n assume \"X \\ asym.valid\"\n then obtain x A B M where \"M \\ payload\" \"X = implem_asym (Chan x A B M)\" \n by (auto elim: asym.validE)\n then show \"LtK K \\ parts {X}\"\n by (cases x, auto)\nnext\n fix G H\n assume \"G \\ payload\" \"Enc_keys_clean H\"\n hence \"Enc_keys_clean (G \\ H)\" by (auto intro: Enc_keys_clean_Un)\n then show \"analz ({implem_asym (Insec A B M) |A B M. M \\ G} \\ H) \\ \n synth (analz (G \\ H)) \\ - payload\"\n by (rule analz_Un_implInsecSet)\nnext\n fix G H\n assume \"G \\ payload\" \"Enc_keys_clean H\"\n hence \"Enc_keys_clean (G \\ H)\" by (auto intro: Enc_keys_clean_Un)\n then show \"analz ({implem_asym (Auth A B M) |A B M. M \\ G} \\ H) \\ \n synth (analz (G \\ H)) \\ - payload\"\n by (rule analz_Un_implAuthSet)\nnext\n fix G H Ag\n assume \"G \\ payload\" \"Enc_keys_clean H\"\n hence \"Enc_keys_clean (G \\ H)\" by (auto intro: Enc_keys_clean_Un)\n then show \"analz ({implem_asym (Confid A B M) |A B M. (A, B) \\ Ag \\ M \\ G} \\ H) \\ \n synth (analz (G \\ H)) \\ - payload\"\n by (rule analz_Un_implConfidSet)\nnext\n fix G H Ag\n assume \"G \\ payload\" \"Enc_keys_clean H\"\n hence \"Enc_keys_clean (G \\ H)\" by (auto intro: Enc_keys_clean_Un)\n then show \"analz ({implem_asym (Secure A B M) |A B M. (A, B) \\ Ag \\ M \\ G} \\ H) \\ \n synth (analz (G \\ H)) \\ - payload\"\n by (rule analz_Un_implSecureSet)\nnext\n fix G H Ag\n assume \"G \\ payload\" (*unused*)\n assume \"Enc_keys_clean H\"\n moreover assume \"Ag \\ broken (parts H \\ range LtK) = {}\"\n ultimately show \"analz ({implem_asym (Confid A B M) |A B M. (A, B) \\ Ag \\ M \\ G} \\ H) \\ \n synth (analz H) \\ - payload\"\n by (rule analz_Un_implConfidSet_2)\nnext\n fix G H Ag\n assume \"G \\ payload\" \"Enc_keys_clean H\"\n hence \"Enc_keys_clean (G \\ H)\" by (auto intro: Enc_keys_clean_Un)\n moreover assume \"Ag \\ broken (parts H \\ range LtK) = {}\"\n ultimately \n show \"analz ({implem_asym (Secure A B M) |A B M. (A, B) \\ Ag \\ M \\ G} \\ H) \\ \n synth (analz H) \\ - payload\"\n by (rule analz_Un_implSecureSet_2)\nqed\n\n\ntext \\\nThird step: @{locale \"valid_implem\"}. The lemmas giving conditions on $M$, $A$ and $B$ for \n@{prop [display] \"implXXX A B M \\ synth (analz Z)\"}.\n\\\n\nlemma implInsec_synth_analz:\n \"H \\ payload \\ asym.valid \\ range LtK \\ Tags \\\n asym.implInsec A B M \\ synth (analz H) \\\n asym.implInsec A B M \\ I \\ M \\ synth (analz H)\"\napply (erule synth.cases, auto)\ndone\n\nlemma implConfid_synth_analz:\n \"H \\ payload \\ asym.valid \\ range LtK \\ Tags \\\n asym.implConfid A B M \\ synth (analz H) \\\n asym.implConfid A B M \\ H \\ M \\ synth (analz H)\"\napply (erule synth.cases, auto)\napply (frule asym.analz_valid [where x=confid], auto)\ndone\n\nlemma implAuth_synth_analz:\n \"H \\ payload \\ asym.valid \\ range LtK \\ Tags \\\n asym.implAuth A B M \\ synth (analz H) \\\n asym.implAuth A B M \\ H \\ (M \\ synth (analz H) \\ (A, B) \\ broken H)\"\napply (erule synth.cases, auto)\napply (frule asym.analz_valid [where x=auth], auto)\napply (frule asym.analz_valid [where x=auth], auto)\napply (blast dest: asym.analz_LtKeys)\ndone\n\nlemma implSecure_synth_analz:\n \"H \\ payload \\ asym.valid \\ range LtK \\ Tags \\\n asym.implSecure A B M \\ synth (analz H) \\\n asym.implSecure A B M \\ H \\ (M \\ synth (analz H) \\ (A, B) \\ broken H)\"\nproof (erule synth.cases, simp_all)\n fix X\n assume H:\"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n assume H':\"Sign (Aenc \\SecureTag, Agent A, M\\ (pubK B)) (priK A) = X\"\n \" X \\ analz H\"\n hence \"asym.implSecure A B M \\ analz H\" by auto\n with H have \"asym.implSecure A B M \\ H\" by (rule asym.analz_valid)\n with H' show \"X \\ H \\ M \\ synth (analz H) \\ (A, B) \\ broken H\"\n by auto\nnext\n fix X Y\n assume H:\"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n assume H':\"Aenc \\SecureTag, Agent A, M\\ (pubK B) = X \\ priK A = Y\"\n \"X \\ synth (analz H)\" \"Y \\ synth (analz H)\"\n hence \"priK A \\ analz H\" by auto\n with H have HAgents:\"(A, B) \\ broken H \" by (auto dest: asym.analz_LtKeys)\n from H' have \"Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ synth (analz H)\" by auto\n then have \"Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ analz H \\ \n M \\ synth (analz H)\"\n by (rule synth.cases, auto)\n then show \"Sign X Y \\ H \\ M \\ synth (analz H) \\ (A, B) \\ broken H\"\n proof\n assume \"M \\ synth (analz H)\"\n with HAgents show ?thesis by auto\n next\n assume \"Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ analz H\"\n hence \"Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ parts H\" by (rule analz_into_parts)\n from H obtain Z where \n \"Z \\ H\" and H'':\"Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ parts {Z}\"\n using parts_singleton [OF \\Aenc \\SecureTag, Agent A, M\\ (pubK B) \\ parts H\\] \n by blast\n moreover with H have \"Z \\ asym.valid\" by (auto dest!: subsetD)\n moreover with H'' have \"Z = asym.implSecure A B M\"\n by (auto) (erule asym.valid_cases, auto)\n ultimately have \"asym.implSecure A B M \\ H\" by auto\n with H' show ?thesis by auto\n qed\nqed\n\n\n\ninterpretation asym: valid_implem implem_asym\nproof (unfold_locales)\n fix H A B M\n assume \"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n \"implem_asym (Insec A B M) \\ synth (analz H)\"\n then show \"implem_asym (Insec A B M) \\ H \\ M \\ synth (analz H)\"\n by (rule implInsec_synth_analz)\nnext\n fix H A B M\n assume \"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n \"implem_asym (Confid A B M) \\ synth (analz H)\"\n then show \"implem_asym (Confid A B M) \\ H \\ M \\ synth (analz H)\"\n by (rule implConfid_synth_analz)\nnext\n fix H A B M\n assume \"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n \"implem_asym (Auth A B M) \\ synth (analz H)\"\n then show \"implem_asym (Auth A B M) \\ H \\ \n M \\ synth (analz H) \\ (A, B) \\ broken H\"\n by (rule implAuth_synth_analz)\nnext\n fix H A B M\n assume \"H \\ payload \\ asym.valid \\ range LtK \\ Tags\"\n \"implem_asym (Secure A B M) \\ synth (analz H)\"\n then show \"implem_asym (Secure A B M) \\ H \\ \n M \\ synth (analz H) \\ (A, B) \\ broken H\"\n by (rule implSecure_synth_analz)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Implem_asymmetric.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883449573377, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2743681294919253}} {"text": "theory TopoS_Composition_Theory\nimports TopoS_Interface TopoS_Helper\nbegin\n\nsection\\Composition Theory\\\n\ntext\\Several invariants may apply to one policy.\\\n\ntext\\The security invariants are all collected in a list. \nThe list corresponds to the security requirements. \nThe list should have the type @{typ \"('v graph \\ bool) list\"}, i.e.\\ a list of predicates over the policy. \nWe need in instantiated security invariant, i.e.\\ get rid of @{typ \"'a\"} and @{typ \"'b\"}\\\n\n \\ \\An instance (configured) a security invariant I.e.\\ a concrete security requirement, in different terminology.\\\n record ('v) SecurityInvariant_configured =\n c_sinvar::\"('v) graph \\ bool\"\n c_offending_flows::\"('v) graph \\ ('v \\ 'v) set set\"\n c_isIFS::\"bool\"\n\n \\ \\parameters 1-3 are the @{text \"SecurityInvariant\"}:\n @{text sinvar} @{text \"\\\"} @{text \"receiver_violation\"}\n\n Fourth parameter is the host attribute mapping @{text nP}\n\n \n TODO: probably check @{text \"wf_graph\"} here and optionally some host-attribute sanity checker as in DomainHierachy.\\\n fun new_configured_SecurityInvariant ::\n \"((('v::vertex) graph \\ ('v \\ 'a) \\ bool) \\ 'a \\ bool \\ ('v \\ 'a)) \\ ('v SecurityInvariant_configured) option\" where \n \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = \n ( \n if SecurityInvariant sinvar defbot receiver_violation then \n Some \\ \n c_sinvar = (\\G. sinvar G nP),\n c_offending_flows = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP),\n c_isIFS = receiver_violation\n \\\n else None\n )\"\n\n declare new_configured_SecurityInvariant.simps[simp del]\n\n lemma new_configured_TopoS_sinvar_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_sinvar (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = (\\G. sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n lemma new_configured_TopoS_offending_flows_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_offending_flows (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = \n (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n\ntext\\We now collect all the core properties of a security invariant, but without the @{typ \"'a\"} @{typ \"'b\"} \n types, so it is instantiated with a concrete configuration.\\\nlocale configured_SecurityInvariant =\n fixes m :: \"('v::vertex) SecurityInvariant_configured\"\n assumes\n \\ \\As in SecurityInvariant definition\\\n valid_c_offending_flows:\n \"c_offending_flows m G = {F. F \\ (edges G) \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\ (e1, e2) \\ F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\"\n and\n \\ \\A empty network can have no security violations\\\n defined_offending:\n \"\\ wf_graph \\ nodes = N, edges = {} \\ \\ \\ c_sinvar m \\ nodes = N, edges = {}\\\"\n and\n \\ \\prohibiting more does not decrease security\\\n mono_sinvar:\n \"\\ wf_graph \\ nodes = N, edges = E \\; E' \\ E; c_sinvar m \\ nodes = N, edges = E \\ \\ \\ \n c_sinvar m \\ nodes = N, edges = E' \\\"\n begin\n (*compatibility with other definitions*)\n lemma sinvar_monoI: \n \"SecurityInvariant_withOffendingFlows.sinvar_mono (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact mono_sinvar)\n\n text\\if the network where nobody communicates with anyone fulfilles its security requirement,\n the offending flows are always defined.\\\n lemma defined_offending': \n \"\\ wf_graph G; \\ c_sinvar m G \\ \\ c_offending_flows m G \\ {}\"\n proof -\n assume a1: \"wf_graph G\"\n and a2: \"\\ c_sinvar m G\"\n have subst_set_offending_flows: \n \"\\nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n by(simp add: valid_c_offending_flows fun_eq_iff \n SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n\n from a1 have wfG_empty: \"wf_graph \\nodes = nodes G, edges = {}\\\" by(simp add:wf_graph_def)\n\n from a1 have \"\\nP. \\ c_sinvar m G \\ SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP \\ {}\"\n apply(frule_tac finite_distinct_list[OF wf_graph.finiteE])\n apply(erule_tac exE)\n apply(rename_tac list_edges)\n apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_monoI])\n by(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def delete_edges_simp2 defined_offending[OF wfG_empty])\n \n thus ?thesis by(simp add: a2 subst_set_offending_flows)\n qed\n\n (* The offending flows definitions are equal, compatibility *)\n lemma subst_offending_flows: \"\\ nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n apply (unfold SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n by(simp add: valid_c_offending_flows)\n\n text\\all the @{term SecurityInvariant_preliminaries} stuff must hold, for an arbitrary @{term nP}\\\n lemma SecurityInvariant_preliminariesD:\n \"SecurityInvariant_preliminaries (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n proof(unfold_locales, goal_cases)\n case 1 thus ?case using defined_offending' by(simp add: subst_offending_flows)\n next case 2 thus ?case by(fact mono_sinvar)\n next case 3 thus ?case by(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_monoI])\n qed\n\n lemma negative_mono:\n \"\\ N E' E. wf_graph \\ nodes = N, edges = E \\ \\ \n E' \\ E \\ \\ c_sinvar m \\ nodes = N, edges = E' \\ \\ \\ c_sinvar m \\ nodes = N, edges = E \\\"\n by(blast dest: mono_sinvar)\n\n \n subsection\\Reusing Lemmata\\\n lemmas mono_extend_set_offending_flows =\n SecurityInvariant_preliminaries.mono_extend_set_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm mono_extend_set_offending_flows [no_vars]}\\\n\n lemmas offending_flows_union_mono =\n SecurityInvariant_preliminaries.offending_flows_union_mono[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm offending_flows_union_mono [no_vars]}\\\n\n lemmas sinvar_valid_remove_flattened_offending_flows =\n SecurityInvariant_preliminaries.sinvar_valid_remove_flattened_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm sinvar_valid_remove_flattened_offending_flows [no_vars]}\\\n\n lemmas sinvar_valid_remove_SOME_offending_flows =\n SecurityInvariant_preliminaries.sinvar_valid_remove_SOME_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm sinvar_valid_remove_SOME_offending_flows [no_vars]}\\\n\n\n lemmas sinvar_valid_remove_minimalize_offending_overapprox =\n SecurityInvariant_preliminaries.sinvar_valid_remove_minimalize_offending_overapprox[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm sinvar_valid_remove_minimalize_offending_overapprox [no_vars]}\\\n \n\n lemmas empty_offending_contra =\n SecurityInvariant_withOffendingFlows.empty_offending_contra[where sinvar=\"(\\G nP. c_sinvar m G)\", simplified subst_offending_flows]\n text\\@{thm empty_offending_contra [no_vars]}\\\n\n lemmas Un_set_offending_flows_bound_minus_subseteq = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm Un_set_offending_flows_bound_minus_subseteq [no_vars]}\\\n\n lemmas Un_set_offending_flows_bound_minus_subseteq' = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq'[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text\\@{thm Un_set_offending_flows_bound_minus_subseteq' [no_vars]}\\\nend\n\nthm configured_SecurityInvariant_def\ntext\\@{thm configured_SecurityInvariant_def [no_vars]}\\\n\nthm configured_SecurityInvariant.mono_sinvar\ntext\\@{thm configured_SecurityInvariant.mono_sinvar [no_vars]}\\\n\n\n\ntext\\\n Naming convention:\n m :: network security requirement\n M :: network security requirement list\n\\\n\n text\\The function @{term new_configured_SecurityInvariant} takes some tuple and if it returns a result,\n the locale assumptions are automatically fulfilled.\\\n theorem new_configured_SecurityInvariant_sound: \n \"\\ new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m \\ \\\n configured_SecurityInvariant m\"\n proof -\n assume a: \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m\"\n hence NetModel: \"SecurityInvariant sinvar defbot receiver_violation\"\n by(simp add: new_configured_SecurityInvariant.simps split: if_split_asm)\n hence NetModel_p: \"SecurityInvariant_preliminaries sinvar\" by(simp add: SecurityInvariant_def)\n\n from a have c_eval: \"c_sinvar m = (\\G. sinvar G nP)\"\n and c_offending: \"c_offending_flows m = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n and \"c_isIFS m = receiver_violation\"\n by(auto simp add: new_configured_SecurityInvariant.simps NetModel split: if_split_asm)\n\n have monoI: \"SecurityInvariant_withOffendingFlows.sinvar_mono sinvar\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n from SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows[OF monoI, symmetric]\n SecurityInvariant_preliminaries.defined_offending[OF NetModel_p]\n have eval_empty_graph: \"\\ N nP. wf_graph \\nodes = N, edges = {}\\ \\ sinvar \\nodes = N, edges = {}\\ nP\"\n by fastforce\n\n show ?thesis\n apply(unfold_locales)\n apply(simp add: c_eval c_offending SecurityInvariant_withOffendingFlows.set_offending_flows_def SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply(simp add: c_eval eval_empty_graph)\n apply(simp add: c_eval,drule(3) SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n done\n qed\n\ntext\\All security invariants are valid according to the definition\\\ndefinition valid_reqs :: \"('v::vertex) SecurityInvariant_configured list \\ bool\" where\n \"valid_reqs M \\ \\ m \\ set M. configured_SecurityInvariant m\"\n\n subsection \\Algorithms\\\n text\\A (generic) security invariant corresponds to a type of security requirements (type: @{typ \"'v graph \\ ('v \\ 'a) \\ bool\"}).\n A configured security invariant is a security requirement in a scenario specific setting (type: @{typ \"'v graph \\ bool\"}).\n I.e., it is a security requirement as listed in the requirements document.\n All security requirements are fulfilled for a fixed policy @{term G} if all security requirements are fulfilled for @{term G}.\\\n\n\n text\\Get all possible offending flows from all security requirements\\\n definition get_offending_flows :: \"'v SecurityInvariant_configured list \\ 'v graph \\ (('v \\ 'v) set set)\" where\n \"get_offending_flows M G = (\\m\\set M. c_offending_flows m G)\" \n\n (*Note: only checks sinvar, not eval!! No 'a 'b type variables here*)\n definition all_security_requirements_fulfilled :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"all_security_requirements_fulfilled M G \\ \\m \\ set M. (c_sinvar m) G\"\n \n text\\Generate a valid topology from the security requirements\\\n (*constant G, remove after algorithm*)\n fun generate_valid_topology :: \"'v SecurityInvariant_configured list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology [] G = G\" |\n \"generate_valid_topology (m#Ms) G = delete_edges (generate_valid_topology Ms G) (\\ (c_offending_flows m G))\"\n\n \\ \\return all Access Control Strategy models from a list of models\\\n definition get_ACS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_ACS M \\ [m \\ M. \\ c_isIFS m]\"\n \\ \\return all Information Flows Strategy models from a list of models\\\n definition get_IFS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_IFS M \\ [m \\ M. c_isIFS m]\"\n lemma get_ACS_union_get_IFS: \"set (get_ACS M) \\ set (get_IFS M) = set M\"\n by(auto simp add: get_ACS_def get_IFS_def)\n \n\n subsection\\Lemmata\\\n lemma valid_reqs1: \"valid_reqs (m # M) \\ configured_SecurityInvariant m\"\n by(simp add: valid_reqs_def)\n lemma valid_reqs2: \"valid_reqs (m # M) \\ valid_reqs M\"\n by(simp add: valid_reqs_def)\n lemma get_offending_flows_alt1: \"get_offending_flows M G = \\ {c_offending_flows m G | m. m \\ set M}\"\n apply(simp add: get_offending_flows_def)\n by fastforce\n lemma get_offending_flows_un: \"\\(get_offending_flows M G) = (\\m\\set M. \\(c_offending_flows m G))\"\n apply(simp add: get_offending_flows_def)\n by blast\n \n \n lemma all_security_requirements_fulfilled_mono:\n \"\\ valid_reqs M; E' \\ E; wf_graph \\ nodes = V, edges = E \\ \\ \\ \n all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ \\\n all_security_requirements_fulfilled M \\ nodes = V, edges = E' \\\"\n apply(induction M arbitrary: E' E)\n apply(simp_all add: all_security_requirements_fulfilled_def)\n apply(rename_tac m M E' E)\n apply(rule conjI)\n apply(erule(2) configured_SecurityInvariant.mono_sinvar[OF valid_reqs1])\n apply(simp_all)\n apply(drule valid_reqs2)\n apply blast\n done\n\n subsection\\generate valid topology\\\n (*\n lemma generate_valid_topology_def_delete_multiple: \n \"generate_valid_topology M G = delete_edges (generate_valid_topology M G) (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges (generate_valid_topology M G) - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n by blast\n qed*)\n lemma generate_valid_topology_nodes:\n \"nodes (generate_valid_topology M G) = (nodes G)\"\n apply(induction M arbitrary: G)\n by(simp_all add: graph_ops)\n\n lemma generate_valid_topology_def_alt:\n \"generate_valid_topology M G = delete_edges G (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges G - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n apply(rule)\n apply(simp add: generate_valid_topology_nodes)\n by blast\n qed\n \n lemma wf_graph_generate_valid_topology: \"wf_graph G \\ wf_graph (generate_valid_topology M G)\"\n proof(induction M arbitrary: G)\n qed(simp_all)\n \n lemma generate_valid_topology_mono_models:\n \"edges (generate_valid_topology (m#M) \\ nodes = V, edges = E \\) \\ edges (generate_valid_topology M \\ nodes = V, edges = E \\)\"\n proof(induction M arbitrary: E m)\n case Nil thus ?case by(simp add: delete_edges_simp2)\n case Cons thus ?case by(simp add: delete_edges_simp2)\n qed\n \n lemma generate_valid_topology_subseteq_edges:\n \"edges (generate_valid_topology M G) \\ (edges G)\"\n proof(induction M arbitrary: G)\n case Cons thus ?case by (simp add: delete_edges_simp2) blast\n qed(simp)\n\n text\\@{term generate_valid_topology} generates a valid topology (Policy)!\\\n theorem generate_valid_topology_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\ \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\"\n proof(induction M arbitrary: V E)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n\n from Cons(3) have valid_rmUnOff: \"wf_graph \\nodes = V, edges = E - \\(c_offending_flows m \\nodes = V, edges = E\\) \\\"\n by(simp add: wf_graph_remove_edges)\n \n from configured_SecurityInvariant.sinvar_valid_remove_flattened_offending_flows[OF validReq Cons(3)]\n have valid_eval_rmUnOff: \"c_sinvar m \\nodes = V, edges = E - \\(c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n \n from generate_valid_topology_subseteq_edges have edges_gentopo_subseteq: \n \"edges (generate_valid_topology M \\nodes = V, edges = E\\) - \\(c_offending_flows m \\nodes = V, edges = E\\)\n \\\n E - \\(c_offending_flows m \\nodes = V, edges = E\\)\" by fastforce\n \n from configured_SecurityInvariant.mono_sinvar[OF validReq valid_rmUnOff edges_gentopo_subseteq valid_eval_rmUnOff]\n have \"c_sinvar m \\nodes = V, edges = (edges (generate_valid_topology M \\nodes = V, edges = E\\)) - \\(c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n from this have goal1: \n \"c_sinvar m (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\(c_offending_flows m \\nodes = V, edges = E\\)))\"\n by(simp add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF \\valid_reqs M\\ Cons(3)] have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\" .\n\n have generate_valid_topology_EX_graph_record:\n \"\\ hypE. (generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\ \"\n apply(induction M arbitrary: V E)\n by(simp_all add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from generate_valid_topology_EX_graph_record obtain E_IH where E_IH_prop:\n \"(generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by metis\n \n \\ \\@{thm IH[simplified E_IH_prop]}\\\n \\ \\@{thm all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH IH[simplified E_IH_prop]]}\\\n \n from all_security_requirements_fulfilled_mono[OF \\valid_reqs M\\ _ valid_G_E_IH IH[simplified E_IH_prop]] have mono_rule:\n \"\\ E'. E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" .\n \n have \"all_security_requirements_fulfilled M \n (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\(c_offending_flows m \\nodes = V, edges = E\\)))\"\n apply(subst E_IH_prop)\n apply(simp add: delete_edges_simp2)\n apply(rule mono_rule)\n by fast\n \n from this have goal2:\n \"(\\ma\\set M.\n c_sinvar ma (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\(c_offending_flows m \\nodes = V, edges = E\\))))\"\n by(simp add: all_security_requirements_fulfilled_def)\n \n from goal1 goal2 \n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \\nodes = V, edges = E\\)\" \n by (simp add: all_security_requirements_fulfilled_def)\n qed\n\n\n lemma generate_valid_topology_as_set: \n \"generate_valid_topology M G = delete_edges G (\\m \\ set M. (\\ (c_offending_flows m G)))\"\n apply(induction M arbitrary: G)\n apply(simp_all add: delete_edges_simp2 generate_valid_topology_nodes) by fastforce\n\n lemma c_offending_flows_subseteq_edges: \"configured_SecurityInvariant m \\ \\(c_offending_flows m G) \\ edges G\"\n apply(clarify)\n apply(simp only: configured_SecurityInvariant.valid_c_offending_flows)\n apply(thin_tac \"configured_SecurityInvariant x\" for x)\n by auto\n\n\n text\\Does it also generate a maximum topology? It does, if the security invariants are in ENF-form. That means, if \n all security invariants can be expressed as a predicate over the edges, \n @{term \"\\P. \\G. c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1,v2))\"}\\\n definition max_topo :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"max_topo M G \\ all_security_requirements_fulfilled M G \\ (\n \\ (v1, v2) \\ (nodes G \\ nodes G) - (edges G). \\ all_security_requirements_fulfilled M (add_edge v1 v2 G))\"\n\n lemma unique_offending_obtain: \n assumes m: \"configured_SecurityInvariant m\" and unique: \"c_offending_flows m G = {F}\"\n obtains P where \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" and \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\" and \n \"(\\(v1,v2) \\ edges G - F. P (v1, v2))\"\n proof -\n assume EX: \"(\\P. F = {(v1, v2). (v1, v2) \\ edges G \\ \\ P (v1, v2)} \\ c_sinvar m G = (\\(v1, v2)\\edges G. P (v1, v2)) \\ \\(v1, v2)\\edges G - F. P (v1, v2) \\ thesis)\"\n\n from unique c_offending_flows_subseteq_edges[OF m] have \"F \\ edges G\" by force\n from this obtain P where \"F = {e \\ edges G. \\ P e}\" by (metis double_diff set_diff_eq subset_refl)\n hence 1: \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" by auto\n\n from configured_SecurityInvariant.valid_c_offending_flows[OF m] have \"c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\" .\n\n from this unique have \"\\ c_sinvar m G\" and 2: \"c_sinvar m (delete_edges G F)\" and \n 3: \"(\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))\" by auto\n\n from this \\F = {e \\ edges G. \\ P e}\\ have x3: \"\\ e \\ edges G - F. P e\" by (metis (lifting) mem_Collect_eq set_diff_eq)\n hence 4: \"\\(v1,v2) \\ edges G - F. P (v1, v2)\" by blast\n\n have \"F \\ {}\" by (metis assms(1) assms(2) configured_SecurityInvariant.empty_offending_contra insertCI)\n from this \\F = {e \\ edges G. \\ P e}\\ \\\\ c_sinvar m G\\ have 5: \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\"\n apply(simp add: graph_ops)\n by(blast)\n\n from EX[of P] unique 1 x3 5 show ?thesis by fast\n qed\n\n lemma enf_offending_flows:\n assumes vm: \"configured_SecurityInvariant m\" and enf: \"\\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n shows \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n proof -\n { fix G\n from vm configured_SecurityInvariant.valid_c_offending_flows have offending_formaldef:\n \"c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\\n (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\" by auto\n have \"c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n proof(cases \"c_sinvar m G\")\n case True thus ?thesis \\ \\@{term \"{}\"}\\\n by(simp add: offending_formaldef)\n next\n case False thus ?thesis by(auto simp add: offending_formaldef graph_ops enf)\n qed\n } thus ?thesis by simp\n qed\n \n \nlemma enf_not_fulfilled_if_in_offending:\n assumes validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n shows \"\\x \\ (\\m\\set M. \\(c_offending_flows m (fully_connected G))).\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = insert x E\\\"\n unfolding all_security_requirements_fulfilled_def\n proof(simp, clarify, rename_tac m F a b)\n let ?G=\"(fully_connected G)\"\n fix m F v1 v2\n assume \"m \\ set M\" and \"F \\ c_offending_flows m ?G\" and \"(v1, v2) \\ F\"\n \n from validRs have valid_mD:\"\\m. m \\ set M \\ configured_SecurityInvariant m \" \n by(simp add: valid_reqs_def)\n \n from \\m \\ set M\\ valid_mD have \"configured_SecurityInvariant m\" by simp\n\n from enf \\m \\ set M\\ obtain P where enf_m: \"\\G. c_sinvar m G = (\\e\\edges G. P e)\" by blast\n \n from \\(v1, v2) \\ F\\ have \"F \\ {}\" by auto\n\n from enf_offending_flows[OF \\configured_SecurityInvariant m\\ \\\\G. c_sinvar m G = (\\e\\edges G. P e)\\] have\n offending: \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\" by simp\n from \\F \\ c_offending_flows m ?G\\ \\F \\ {}\\ have \"F = {e \\ edges ?G. \\ P e}\"\n by(simp split: if_split_asm add: offending)\n from this \\(v1, v2) \\ F\\ have \"\\ P (v1, v2)\" by simp\n\n from this enf_m have \"\\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" by(simp)\n thus \"\\m\\set M. \\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" using \\m \\ set M\\\n apply(rule_tac x=\"m\" in bexI)\n by simp_all\nqed\n \n\n theorem generate_valid_topology_max_topo: \"\\ valid_reqs M; wf_graph G;\n \\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\\ \\ \n max_topo M (generate_valid_topology M (fully_connected G))\"\n proof -\n let ?G=\"(fully_connected G)\"\n assume validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n\n obtain V E where VE_prop: \"\\ nodes = V, edges = E \\ = generate_valid_topology M ?G\" by (metis graph.cases)\n hence VE_prop_asset:\n \"\\ nodes = V, edges = E \\ = \\ nodes = V, edges = V \\ V - (\\m\\set M. \\(c_offending_flows m ?G))\\\"\n by(simp add: fully_connected_def generate_valid_topology_as_set delete_edges_simp2)\n\n from VE_prop_asset have E_prop: \"E = V \\ V - (\\m\\set M. \\(c_offending_flows m ?G))\" by fast\n from VE_prop have V_prop: \"nodes G = V\"\n by (simp add: fully_connected_def delete_edges_simp2 generate_valid_topology_def_alt)\n from VE_prop have V_full_prop: \"nodes (generate_valid_topology M ?G) = V\" by (metis graph.select_convs(1))\n from VE_prop have E_full_prop: \"edges (generate_valid_topology M ?G) = E\" by (metis graph.select_convs(2))\n\n from VE_prop wf_graph_generate_valid_topology[OF fully_connected_wf[OF wfG]]\n have wfG_VE: \"wf_graph \\ nodes = V, edges = E \\\" by force\n\n from generate_valid_topology_sound[OF validRs wfG_VE] fully_connected_wf[OF wfG] have VE_all_valid: \n \"all_security_requirements_fulfilled M \\ nodes = V, edges = V \\ V - (\\m\\set M. \\(c_offending_flows m ?G))\\\"\n by (metis VE_prop VE_prop_asset fully_connected_def generate_valid_topology_sound validRs)\n hence goal1: \"all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))\" by (metis VE_prop VE_prop_asset)\n\n from validRs have valid_mD:\"\\m. m \\ set M \\ configured_SecurityInvariant m \" \n by(simp add: valid_reqs_def)\n\n from c_offending_flows_subseteq_edges[where G=\"?G\"] validRs have hlp1: \"(\\m\\set M. \\(c_offending_flows m ?G)) \\ V \\ V\"\n apply(simp add: fully_connected_def V_prop)\n using valid_reqs_def by blast\n have \"\\A B. A - (A - B) = B \\ A\" by fast \n from E_prop hlp1 have \"V \\ V - E = (\\m\\set M. \\(c_offending_flows m ?G))\" by force\n\n\n from enf_not_fulfilled_if_in_offending[OF validRs wfG enf]\n have \"\\(v1, v2) \\ (\\m\\set M. \\(c_offending_flows m ?G)).\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\" by simp\n \n from this \\V \\ V - E = (\\m\\set M. \\(c_offending_flows m ?G))\\ have \"\\(v1, v2) \\ V \\ V - E.\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\" by simp\n hence goal2: \"(\\(v1, v2)\\nodes (generate_valid_topology M ?G) \\ nodes (generate_valid_topology M ?G) -\n edges (generate_valid_topology M ?G).\n \\ all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M ?G)))\"\n proof(unfold V_full_prop E_full_prop graph_ops)\n assume a: \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V, edges = E \\ {(v1, v2)}\\\"\n have \"\\(v1, v2)\\V \\ V - E. V \\ {v1, v2} = V\" by blast\n hence \"\\(v1, v2)\\V \\ V - E. \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\ = \\nodes = V, edges = E \\ {(v1, v2)}\\\" by blast\n from this a show \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\\"\n \\ \\TODO: this should be trivial ...\\\n apply(simp)\n apply(rule ballI)\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply(simp; fail)\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply(simp; fail)\n apply(clarify)\n by presburger\n qed\n \n from goal1 goal2 show ?thesis\n unfolding max_topo_def by presburger\n qed\n\n lemma enf_all_valid_policy_subset_of_max:\n assumes validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n and nodesG': \"nodes G = nodes G'\"\n shows \"\\ wf_graph G';\n all_security_requirements_fulfilled M G'\\ \\ \n edges G' \\ edges (generate_valid_topology M (fully_connected G))\"\n using nodesG' apply(cases \"generate_valid_topology M (fully_connected G)\", rename_tac V E, simp)\n apply(cases \"G'\", rename_tac V' E', simp)\n apply(subgoal_tac \"nodes G = V\")\n prefer 2\n apply (metis fully_connected_def generate_valid_topology_nodes graph.select_convs(1))\n apply(simp)\n proof(rule ccontr)\n fix V E V' E'\n assume a5: \"all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" and\n a6: \"generate_valid_topology M (fully_connected G) = \\nodes = V, edges = E\\\" and\n a10: \"wf_graph \\nodes = V, edges = E'\\\" and\n contr: \"\\ E' \\ E\"\n \n from wfG a6 have \"wf_graph \\nodes = V, edges = E\\\"\n by (metis fully_connected_wf wf_graph_generate_valid_topology)\n with a10 have EE'subsets: \"fst ` E \\ V \\ snd ` E \\ V \\ fst ` E' \\ V \\ snd ` E' \\ V\"\n by(simp add: wf_graph_def)\n hence EE'subsets': \"E \\ V \\ V \\ E' \\ V \\ V\" by auto\n \n from generate_valid_topology_max_topo[OF validRs wfG enf]\n have m1: \"all_security_requirements_fulfilled M \\nodes = V, edges = E\\\" and\n m2: \"(\\x\\V \\ V - E. case x of (v1, v2) \\ \\ all_security_requirements_fulfilled M (add_edge v1 v2 \\nodes = V, edges = E\\))\"\n by(simp add: max_topo_def a6)+\n \n from m2 have m2': \"\\x\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x E\\\"\n apply(simp add: add_edge_def)\n apply(rule ballI, rename_tac x)\n apply(erule_tac x=x in ballE, simp_all)\n apply(case_tac x, simp)\n by (simp add: insert_absorb)\n \n show False\n proof(cases \"V = {}\")\n case True\n with EE'subsets a10 have \"E = {}\" and \"E' = {}\"\n by(simp add: wf_graph_def)+\n with True contr show ?thesis by simp\n next\n case False\n with EE'subsets' contr obtain x where x: \"x \\ E' \\ x \\ E \\ x \\ V \\ V\"\n by blast\n from m2' x have \"\\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x E\\\"\n by (simp)\n \n from a6 x have x_offedning: \"x \\ (\\m\\set M. \\(c_offending_flows m (fully_connected G)))\"\n apply(simp add: generate_valid_topology_as_set delete_edges_simp2 fully_connected_def)\n by blast\n \n from enf_not_fulfilled_if_in_offending[OF validRs wfG enf] x_offedning have\n 1: \"\\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x myE\\\" for myE by blast\n \n from x have insertxE': \"insert x E' = E'\" by blast\n with a5 have\n \"all_security_requirements_fulfilled M \\nodes = V, edges = insert x E'\\\" by simp\n with insertxE' all_security_requirements_fulfilled_mono[OF validRs _ a10 a5] have \n 2: \"all_security_requirements_fulfilled M \\nodes = V, edges = insert x {}\\\" by blast\n from 1 2 show ?thesis by blast\n qed\n qed\n \n\n\n subsection\\More Lemmata\\\n lemma (in configured_SecurityInvariant) c_sinvar_valid_imp_no_offending_flows: \n \"c_sinvar m G \\ c_offending_flows m G = {}\"\n by(simp add: valid_c_offending_flows)\n\n lemma all_security_requirements_fulfilled_imp_no_offending_flows:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ (\\m\\set M. \\(c_offending_flows m G)) = {}\"\n proof(induction M)\n case Cons thus ?case\n unfolding all_security_requirements_fulfilled_def\n apply(simp)\n by(blast dest: valid_reqs2 valid_reqs1 configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows)\n qed(simp)\n\n corollary all_security_requirements_fulfilled_imp_get_offending_empty:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ get_offending_flows M G = {}\"\n apply(frule(1) all_security_requirements_fulfilled_imp_no_offending_flows)\n apply(simp add: get_offending_flows_def)\n apply(thin_tac \"all_security_requirements_fulfilled M G\")\n apply(simp add: valid_reqs_def)\n apply(clarify)\n using configured_SecurityInvariant.empty_offending_contra by fastforce\n \n corollary generate_valid_topology_does_nothing_if_valid:\n \"\\ valid_reqs M; all_security_requirements_fulfilled M G\\ \\ \n generate_valid_topology M G = G\"\n by(simp add: generate_valid_topology_as_set graph_ops all_security_requirements_fulfilled_imp_no_offending_flows)\n\n\n lemma mono_extend_get_offending_flows: \"\\ valid_reqs M;\n wf_graph \\nodes = V, edges = E\\;\n E' \\ E;\n F' \\ get_offending_flows M \\nodes = V, edges = E'\\ \\ \\\n \\F\\get_offending_flows M \\nodes = V, edges = E\\. F' \\ F\"\n proof(induction M)\n case Nil thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons.prems have \"configured_SecurityInvariant m\"\n and \"valid_reqs M\" using valid_reqs2 valid_reqs1 by blast+\n from Cons.prems(4) have\n \"F' \\ c_offending_flows m \\nodes = V, edges = E'\\ \\\n (F' \\ get_offending_flows M \\nodes = V, edges = E'\\)\"\n by(simp add: get_offending_flows_def)\n from this show ?case\n proof(elim disjE, goal_cases)\n case 1\n with \\configured_SecurityInvariant m\\ Cons.prems(2,3,4) obtain F where\n \"F\\c_offending_flows m \\nodes = V, edges = E\\\" and \"F' \\ F\"\n by(blast dest: configured_SecurityInvariant.mono_extend_set_offending_flows)\n hence \"F\\get_offending_flows (m # M) \\nodes = V, edges = E\\\"\n by (simp add: get_offending_flows_def)\n with \\F' \\ F\\ show ?case by blast\n next\n case 2 with Cons \\valid_reqs M\\ show ?case by(simp add: get_offending_flows_def) blast\n qed\n qed\n\n lemma get_offending_flows_subseteq_edges: \"valid_reqs M \\ F \\ get_offending_flows M \\nodes = V, edges = E\\ \\ F \\ E\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(simp add: configured_SecurityInvariant.valid_c_offending_flows)\n by blast\n\n thm configured_SecurityInvariant.offending_flows_union_mono\n lemma get_offending_flows_union_mono: \"\\valid_reqs M; \n wf_graph \\nodes = V, edges = E\\; E' \\ E \\ \\\n \\(get_offending_flows M \\nodes = V, edges = E'\\) \\ \\(get_offending_flows M \\nodes = V, edges = E\\)\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(drule(2) configured_SecurityInvariant.offending_flows_union_mono)\n apply(simp add: get_offending_flows_def)\n by auto\n\n thm configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'\n lemma Un_set_offending_flows_bound_minus_subseteq':\"\\valid_reqs M; \n wf_graph \\nodes = V, edges = E\\; E' \\ E;\n \\(get_offending_flows M \\nodes = V, edges = E\\) \\ X \\ \\ \\(get_offending_flows M \\nodes = V, edges = E - E'\\) \\ X - E'\"\n proof(induction M)\n case Nil thus ?case by (simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons.prems(1) valid_reqs2 have \"valid_reqs M\" by force\n from Cons.prems(1) valid_reqs1 have \"configured_SecurityInvariant m\" by force\n from Cons.prems(4) have \"\\(get_offending_flows M \\nodes = V, edges = E\\) \\ X\" by(simp add: get_offending_flows_def)\n from Cons.IH[OF \\valid_reqs M\\ Cons.prems(2) Cons.prems(3) \\\\(get_offending_flows M \\nodes = V, edges = E\\) \\ X\\] have IH: \"\\(get_offending_flows M \\nodes = V, edges = E - E'\\) \\ X - E'\" .\n from Cons.prems(4) have \"\\(c_offending_flows m \\nodes = V, edges = E\\) \\ X\" by(simp add: get_offending_flows_def)\n from configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'[OF \\configured_SecurityInvariant m\\ Cons.prems(2) \\\\(c_offending_flows m \\nodes = V, edges = E\\) \\ X\\] have \"\\(c_offending_flows m \\nodes = V, edges = E - E'\\) \\ X - E'\" .\n from this IH show ?case by(simp add: get_offending_flows_def)\n qed\n\n \n\n\n (*ENF has uniquely defined offending flows*)\n lemma ENF_uniquely_defined_offedning: \"valid_reqs M \\ wf_graph G \\ \n \\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e) \\ \n \\m \\ set M. \\G. \\ c_sinvar m G \\ (\\OFF. c_offending_flows m G = {OFF})\"\n apply -\n apply(induction M)\n apply(simp; fail)\n apply(rename_tac m M)\n apply(frule valid_reqs1)\n apply(drule valid_reqs2)\n apply(simp)\n apply(elim conjE)\n apply(erule_tac x=m in ballE)\n apply(simp_all; fail)\n apply(erule exE, rename_tac P)\n apply(drule_tac P=P in enf_offending_flows)\n apply(simp; fail)\n apply(simp; fail)\n done\n\n lemma assumes \"configured_SecurityInvariant m\"\n and \"\\G. \\ c_sinvar m G \\ (\\OFF. c_offending_flows m G = {OFF})\"\n shows \"\\OFF_P. \\G. c_offending_flows m G = (if c_sinvar m G then {} else {OFF_P G})\"\n proof -\n from assms have \"\\OFF_P. \n c_offending_flows m G = (if c_sinvar m G then {} else {OFF_P G})\" for G\n apply(erule_tac x=G in allE)\n apply(cases \"c_sinvar m G\")\n apply(drule configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows, simp)\n apply(simp; fail)\n apply(simp)\n by meson\n with assms show ?thesis by metis\n qed\n (*TODO: generate_valid_topology_max_topo for sinvars with unique offending flows in general*)\n\n\n\n text\\Hilber's eps operator example\\\n lemma \"(SOME x. x : {1::nat, 2, 3}) = x \\ x = 1 \\ x = 2 \\ x = 3\"\n proof -\n have \"(SOME x. x \\ {1::nat, 2, 3}) \\ {1::nat, 2, 3}\" unfolding some_in_eq by simp\n thus \"(SOME x. x : {1::nat, 2, 3}) = x \\ x = 1 \\ x = 2 \\ x = 3\" by fast\n qed\n\n (*TODO: remove the offending flows from the graph for each iteration. requires proof arbitrary: G\n allows to put expensive invariants at back of list and hope that sinvar is true until the are evaluated*)\n text\\Only removing one offending flow should be enough\\\n fun generate_valid_topology_SOME :: \"'v SecurityInvariant_configured list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology_SOME [] G = G\" |\n \"generate_valid_topology_SOME (m#Ms) G = (if c_sinvar m G\n then generate_valid_topology_SOME Ms G\n else delete_edges (generate_valid_topology_SOME Ms G) (SOME F. F \\ c_offending_flows m G)\n )\"\n\n lemma generate_valid_topology_SOME_nodes: \"nodes (generate_valid_topology_SOME M \\nodes = V, edges = E\\) = V\"\n proof(induction M)\n qed(simp_all add: delete_edges_simp2)\n\n theorem generate_valid_topology_SOME_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\ \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"\n proof(induction M)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n \n from configured_SecurityInvariant.sinvar_valid_remove_SOME_offending_flows[OF validReq] have\n \"c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\\n c_sinvar m \\nodes = V, edges = E - (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\)\\\" .\n\n have generate_valid_topology_SOME_edges: \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) \\ E\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(auto simp add: delete_edges_simp2)\n\n from configured_SecurityInvariant.mono_sinvar[OF validReq Cons.prems(2),\n of \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"]\n generate_valid_topology_SOME_edges\n have \"c_sinvar m \\nodes = V, edges = E\\ \\\n c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\\\"\n by simp\n moreover from configured_SecurityInvariant.defined_offending'[OF validReq Cons.prems(2)] have not_sinvar_off:\n \"\\ c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ \\ {}\" by blast\n ultimately have goal_sinvar_m:\n \"c_offending_flows m \\nodes = V, edges = E\\ = {} \\ \n c_sinvar m (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"\n using generate_valid_topology_SOME_nodes \n by (metis graph.select_convs(1) graph.select_convs(2) graph_eq_intro)\n\n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF \\valid_reqs M\\ Cons(3)] have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\" .\n\n have goal_rm_SOME_m: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\\n c_sinvar m (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\n (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n proof - (*sledgehammered*)\n assume a1: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n have f2: \"(\\r ra p. \\ r \\ ra \\ (p::'a \\ 'a) \\ r \\ p \\ ra) = (\\r ra p. \\ r \\ ra \\ (p::'a \\ 'a) \\ r \\ p \\ ra)\"\n by meson\n have f3: \"wf_graph \\nodes = V, edges = E - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\\\"\n by (simp add: Cons.prems(2) wf_graph_remove_edges)\n have \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\) \\ E - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\"\n using f2 generate_valid_topology_SOME_edges[of M V E] by blast\n then have \"c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\\\"\n using f3 a1 \\c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\ c_sinvar m \\nodes = V, edges = E - (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\)\\\\ configured_SecurityInvariant.negative_mono validReq by blast\n then show \"c_sinvar m (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n by (simp add: generate_valid_topology_SOME_nodes graph_ops(5))\n qed\n\n have wf_graph_generate_valid_topology_SOME: \"wf_graph G \\ wf_graph (generate_valid_topology_SOME M G)\"\n for G (*TODO: tune*)\n apply(cases G)\n apply(simp add: wf_graph_def generate_valid_topology_SOME_nodes)\n using generate_valid_topology_SOME_edges by (meson dual_order.trans image_mono rev_finite_subset) \n\n { assume notempty: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n hence \"\\ hypE. (generate_valid_topology_SOME M \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\\"\n proof(induction M arbitrary: V E)\n qed(simp_all add: delete_edges_simp2 generate_valid_topology_SOME_nodes)\n from this obtain E_IH where E_IH_prop:\n \"(generate_valid_topology_SOME M \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology_SOME[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by simp\n \n from all_security_requirements_fulfilled_mono[OF \\valid_reqs M\\ _ valid_G_E_IH ] IH E_IH_prop\n have mono_rule: \"E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" for E' by simp\n \n have \"all_security_requirements_fulfilled M\n (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\n (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n unfolding E_IH_prop by(auto simp add: delete_edges_simp2 intro:mono_rule)\n } note goal_fulfilled_M=this\n\n have no_offending: \"c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ = {}\"\n by (simp add: configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows validReq)\n\n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology_SOME (m # M) \\nodes = V, edges = E\\)\"\n apply(simp add: all_security_requirements_fulfilled_def)\n apply(intro conjI impI)\n subgoal using goal_sinvar_m no_offending by blast\n subgoal using IH by(simp add: all_security_requirements_fulfilled_def; fail)\n subgoal using goal_rm_SOME_m not_sinvar_off by blast \n subgoal using goal_fulfilled_M not_sinvar_off by(simp add: all_security_requirements_fulfilled_def)\n done\n qed\n\n \n lemma generate_valid_topology_SOME_def_alt:\n \"generate_valid_topology_SOME M G = delete_edges G (\\m \\ set M. if c_sinvar m G then {} else (SOME F. F \\ c_offending_flows m G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have IH :\"edges (generate_valid_topology_SOME M G) =\n edges G - (\\m\\set M. if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G)\"\n by simp\n hence \"\\ c_sinvar m G \\ \n edges (generate_valid_topology_SOME (m # M) G) =\n (edges G) - (\\m\\set (m#M). if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G)\"\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n by blast\n with Cons.IH show ?case by(simp add: get_offending_flows_def delete_edges_simp2)\n qed\n\n lemma generate_valid_topology_SOME_superset:\n \"\\ valid_reqs M; wf_graph G \\ \\ \n edges (generate_valid_topology M G) \\ edges (generate_valid_topology_SOME M G)\"\n proof -\n have isabelle2016_1_helper:\n \"x \\ (\\m\\set M. if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G) \\\n (\\m\\set M. \\ c_sinvar m G \\ (c_sinvar m G \\ x \\ (SOME F. F \\ c_offending_flows m G)))\"\n for x by auto\n have 1: \"m\\set M \\ \\ c_sinvar m G \\ (c_sinvar m G \\ x \\ (SOME F. F \\ c_offending_flows m G)) \\\n c_offending_flows m G \\ {} \\\n x \\ \\(\\m\\set M. c_offending_flows m G)\"\n for x m\n apply(simp)\n apply(rule_tac x=m in bexI)\n apply(simp_all)\n using some_in_eq by blast\n \n show \"valid_reqs M \\ wf_graph G \\ ?thesis\"\n unfolding generate_valid_topology_SOME_def_alt generate_valid_topology_def_alt\n apply (rule delete_edges_edges_mono)\n apply (auto simp add: delete_edges_simp2 get_offending_flows_def valid_reqs_def)\n apply (metis (full_types) configured_SecurityInvariant.defined_offending' some_in_eq)\n done\n qed\n\n\n\n\n text\\Notation:\n @{const generate_valid_topology_SOME}: non-deterministic choice\n \\generate_valid_topology_some\\: executable which selects always the same\n\\\n fun generate_valid_topology_some :: \"'v SecurityInvariant_configured list \\ ('v\\'v) list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology_some [] _ G = G\" |\n \"generate_valid_topology_some (m#Ms) Es G = (if c_sinvar m G\n then generate_valid_topology_some Ms Es G\n else delete_edges (generate_valid_topology_some Ms Es G) (set (minimalize_offending_overapprox (c_sinvar m) Es [] G))\n )\"\n theorem generate_valid_topology_some_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\; set Es = E; distinct Es \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"\n proof(induction M)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n \n from configured_SecurityInvariant.sinvar_valid_remove_minimalize_offending_overapprox[OF\n validReq Cons.prems(2) _ Cons.prems(3) Cons.prems(4)] have rm_off_valid:\n \"\\ c_sinvar m \\nodes = V, edges = E\\\\\n c_sinvar m \\nodes = V, edges = E - (set (minimalize_offending_overapprox (c_sinvar m) Es [] \\nodes = V, edges = E\\))\\\"\n apply(subst(asm) minimalize_offending_overapprox_boundnP[symmetric]) (*TODO: type for nP unspecified!*)\n by blast\n\n have generate_valid_topology_some_nodes: \"nodes (generate_valid_topology_some M Es \\nodes = V, edges = E\\) = V\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(simp_all add: delete_edges_simp2)\n\n\n have generate_valid_topology_some_edges: \"edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\) \\ E\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(auto simp add: delete_edges_simp2)\n \n from configured_SecurityInvariant.mono_sinvar[OF validReq Cons.prems(2),\n of \"edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"]\n generate_valid_topology_some_edges\n have \"c_sinvar m \\nodes = V, edges = E\\ \\\n c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\\\"\n by simp\n moreover from configured_SecurityInvariant.defined_offending'[OF validReq Cons.prems(2)] have not_sinvar_off:\n \"\\ c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ \\ {}\" by blast\n ultimately have goal_sinvar_m:\n \"c_offending_flows m \\nodes = V, edges = E\\ = {} \\ \n c_sinvar m (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"\n using generate_valid_topology_some_nodes \n by (metis graph.select_convs(1) graph.select_convs(2) graph_eq_intro)\n\n \n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF \\valid_reqs M\\ Cons(3)] Cons.prems have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\" by simp\n\n \n\n\n have wf_graph_generate_valid_topology_some: \"wf_graph G \\ wf_graph (generate_valid_topology_some M Es G)\"\n for G (*TODO: tune*)\n apply(cases G)\n apply(simp add: wf_graph_def generate_valid_topology_some_nodes)\n using generate_valid_topology_some_edges by (meson dual_order.trans image_mono rev_finite_subset) \n\n \n { assume notempty: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n hence \"\\ hypE. (generate_valid_topology_some M Es \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\\"\n proof(induction M arbitrary: V E)\n qed(simp_all add: delete_edges_simp2 generate_valid_topology_some_nodes)\n from this obtain E_IH where E_IH_prop:\n \"(generate_valid_topology_some M Es \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology_some[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by simp\n \n from all_security_requirements_fulfilled_mono[OF \\valid_reqs M\\ _ valid_G_E_IH ] IH E_IH_prop\n have mono_rule: \"E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" for E' by simp\n \n have \"all_security_requirements_fulfilled M\n (delete_edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\n (set (minimalize_offending_overapprox (c_sinvar m) Es [] \\nodes = V, edges = E\\)))\"\n unfolding E_IH_prop by(auto simp add: delete_edges_simp2 intro:mono_rule)\n } note goal_fulfilled_M=this\n\n have no_offending: \"c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ = {}\"\n by (simp add: configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows validReq)\n\n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology_some (m # M) Es \\nodes = V, edges = E\\)\"\n apply(simp add: all_security_requirements_fulfilled_def)\n apply(intro conjI impI)\n subgoal using goal_sinvar_m no_offending by blast\n subgoal using IH by(simp add: all_security_requirements_fulfilled_def; fail)\n subgoal using rm_off_valid by (metis (no_types, lifting) Cons.prems(2) Diff_mono \n configured_SecurityInvariant.mono_sinvar delete_edges_simp2 generate_valid_topology_some_edges\n generate_valid_topology_some_nodes order_refl validReq wf_graph_remove_edges) (*TODO!*)\n subgoal using goal_fulfilled_M not_sinvar_off by(simp add: all_security_requirements_fulfilled_def)\n done\n qed\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Composition_Theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.27428992993550894}} {"text": "(*<*)\ntheory Monitor\n imports\n Formula\n Optimized_Join\n \"MFOTL_Monitor_Devel.Abstract_Monitor\"\n \"HOL-Library.While_Combinator\"\n \"HOL-Library.Mapping\"\n \"Deriving.Derive\"\n \"Generic_Join_Devel.Generic_Join_Correctness\"\nbegin\n(*>*)\n\nsection \\Generic monitoring algorithm\\\n\ntext \\The algorithm defined here abstracts over the implementation of the temporal operators.\\\n\nsubsection \\Monitorable formulas\\\n\ndefinition \"mmonitorable \\ \\ safe_formula \\ \\ Formula.future_bounded \\\"\ndefinition \"mmonitorable_regex b g r \\ safe_regex b g r \\ Regex.pred_regex Formula.future_bounded r\"\n\ndefinition is_simple_eq :: \"Formula.trm \\ Formula.trm \\ bool\" where\n \"is_simple_eq t1 t2 = (Formula.is_Const t1 \\ (Formula.is_Const t2 \\ Formula.is_Var t2) \\\n Formula.is_Var t1 \\ Formula.is_Const t2)\"\n\nfun mmonitorable_exec :: \"Formula.formula \\ bool\" where\n \"mmonitorable_exec (Formula.Eq t1 t2) = is_simple_eq t1 t2\"\n| \"mmonitorable_exec (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var y))) = (x = y)\"\n| \"mmonitorable_exec (Formula.Pred e ts) = list_all (\\t. Formula.is_Var t \\ Formula.is_Const t) ts\"\n| \"mmonitorable_exec (Formula.Let p \\ \\) = ({0..} \\ Formula.fv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Neg \\) = (fv \\ = {} \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Or \\ \\) = (fv \\ = fv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.And \\ \\) = (mmonitorable_exec \\ \\\n (safe_assignment (fv \\) \\ \\ mmonitorable_exec \\ \\\n fv \\ \\ fv \\ \\ (is_constraint \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))))\"\n| \"mmonitorable_exec (Formula.Ands l) = (let (pos, neg) = partition mmonitorable_exec l in\n pos \\ [] \\ list_all mmonitorable_exec (map remove_neg neg) \\\n \\(set (map fv neg)) \\ \\(set (map fv pos)))\"\n| \"mmonitorable_exec (Formula.Exists \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Agg y \\ b f \\) = (mmonitorable_exec \\ \\\n y + b \\ Formula.fv \\ \\ {0.. Formula.fv \\ \\ Formula.fv_trm f \\ Formula.fv \\)\"\n| \"mmonitorable_exec (Formula.Prev I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Next I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Since \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Until \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\ bounded I \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.MatchP I r) = Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Past Strict r\"\n| \"mmonitorable_exec (Formula.MatchF I r) = (Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Futu Strict r \\ bounded I)\"\n| \"mmonitorable_exec _ = False\"\n\nlemma cases_Neg_iff:\n \"(case \\ of formula.Neg \\ \\ P \\ | _ \\ False) \\ (\\\\. \\ = formula.Neg \\ \\ P \\)\"\n by (cases \\) auto\n\nlemma safe_formula_mmonitorable_exec: \"safe_formula \\ \\ Formula.future_bounded \\ \\ mmonitorable_exec \\\"\nproof (induct \\ rule: safe_formula.induct)\n case (8 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (9 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (10 l)\n from \"10.prems\"(2) have bounded: \"Formula.future_bounded \\\" if \"\\ \\ set l\" for \\\n using that by (auto simp: list.pred_set)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have \"set poss \\ set posm\"\n proof (rule subsetI)\n fix x assume \"x \\ set poss\"\n then have \"x \\ set l\" \"safe_formula x\" using posnegs by simp_all\n then have \"mmonitorable_exec x\" using \"10.hyps\"(1) bounded by blast\n then show \"x \\ set posm\" using \\x \\ set poss\\ posnegm posnegs by simp\n qed\n then have \"set negm \\ set negs\" using posnegm posnegs by auto\n obtain \"poss \\ []\" \"list_all safe_formula (map remove_neg negs)\"\n \"(\\x\\set negs. fv x) \\ (\\x\\set poss. fv x)\"\n using \"10.prems\"(1) posnegs by simp\n then have \"posm \\ []\" using \\set poss \\ set posm\\ by auto\n moreover have \"list_all mmonitorable_exec (map remove_neg negm)\"\n proof -\n let ?l = \"map remove_neg negm\"\n have \"\\x. x \\ set ?l \\ mmonitorable_exec x\"\n proof -\n fix x assume \"x \\ set ?l\"\n then obtain y where \"y \\ set negm\" \"x = remove_neg y\" by auto\n then have \"y \\ set negs\" using \\set negm \\ set negs\\ by blast\n then have \"safe_formula x\"\n unfolding \\x = remove_neg y\\ using \\list_all safe_formula (map remove_neg negs)\\\n by (simp add: list_all_def)\n show \"mmonitorable_exec x\"\n proof (cases \"\\z. y = Formula.Neg z\")\n case True\n then obtain z where \"y = Formula.Neg z\" by blast\n then show ?thesis\n using \"10.hyps\"(2)[OF posnegs refl] \\x = remove_neg y\\ \\y \\ set negs\\ posnegs bounded\n \\safe_formula x\\ by fastforce\n next\n case False\n then have \"remove_neg y = y\" by (cases y) simp_all\n then have \"y = x\" unfolding \\x = remove_neg y\\ by simp\n show ?thesis\n using \"10.hyps\"(1) \\y \\ set negs\\ posnegs \\safe_formula x\\ unfolding \\y = x\\\n by auto\n qed\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n moreover have \"(\\x\\set negm. fv x) \\ (\\x\\set posm. fv x)\"\n using \\\\ (fv ` set negs) \\ \\ (fv ` set poss)\\ \\set poss \\ set posm\\ \\set negm \\ set negs\\\n by fastforce\n ultimately show ?case using posnegm by simp\nnext\n case (15 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (16 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (17 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nnext\n case (18 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nqed (auto simp add: is_simple_eq_def list.pred_set)\n\nlemma safe_assignment_future_bounded: \"safe_assignment X \\ \\ Formula.future_bounded \\\"\n unfolding safe_assignment_def by (auto split: formula.splits)\n\nlemma is_constraint_future_bounded: \"is_constraint \\ \\ Formula.future_bounded \\\"\n by (induction rule: is_constraint.induct) simp_all\n\nlemma mmonitorable_exec_mmonitorable: \"mmonitorable_exec \\ \\ mmonitorable \\\"\nproof (induct \\ rule: mmonitorable_exec.induct)\n case (7 \\ \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (auto simp: cases_Neg_iff intro: safe_assignment_future_bounded is_constraint_future_bounded)\nnext\n case (8 l)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have pos_monitorable: \"list_all mmonitorable_exec posm\" using posnegm by (simp add: list_all_iff)\n have neg_monitorable: \"list_all mmonitorable_exec (map remove_neg negm)\"\n using \"8.prems\" posnegm by (simp add: list_all_iff)\n have \"set posm \\ set poss\"\n using \"8.hyps\"(1) posnegs posnegm unfolding mmonitorable_def by auto\n then have \"set negs \\ set negm\"\n using posnegs posnegm by auto\n\n have \"poss \\ []\" using \"8.prems\" posnegm \\set posm \\ set poss\\ by auto\n moreover have \"list_all safe_formula (map remove_neg negs)\"\n using neg_monitorable \"8.hyps\"(2)[OF posnegm refl] \\set negs \\ set negm\\\n unfolding mmonitorable_def by (auto simp: list_all_iff)\n moreover have \"\\ (fv ` set negm) \\ \\ (fv ` set posm)\"\n using \"8.prems\" posnegm by simp\n then have \"\\ (fv ` set negs) \\ \\ (fv ` set poss)\"\n using \\set posm \\ set poss\\ \\set negs \\ set negm\\ by fastforce\n ultimately have \"safe_formula (Formula.Ands l)\" using posnegs by simp\n moreover have \"Formula.future_bounded (Formula.Ands l)\"\n proof -\n have \"list_all Formula.future_bounded posm\"\n using pos_monitorable \"8.hyps\"(1) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n moreover have fnegm: \"list_all Formula.future_bounded (map remove_neg negm)\"\n using neg_monitorable \"8.hyps\"(2) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n then have \"list_all Formula.future_bounded negm\"\n proof -\n have \"\\x. x \\ set negm \\ Formula.future_bounded x\"\n proof -\n fix x assume \"x \\ set negm\"\n have \"Formula.future_bounded (remove_neg x)\" using fnegm \\x \\ set negm\\ by (simp add: list_all_iff)\n then show \"Formula.future_bounded x\" by (cases x) auto\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n ultimately have \"list_all Formula.future_bounded l\" using posnegm by (auto simp: list_all_iff)\n then show ?thesis by (auto simp: list_all_iff)\n qed\n ultimately show ?case unfolding mmonitorable_def ..\nnext\n case (13 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: cases_Neg_iff)\nnext\n case (14 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: one_enat_def cases_Neg_iff)\nnext\n case (15 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nnext\n case (16 I r)\n then show ?case\n by (auto 0 3 elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nqed (auto simp add: mmonitorable_def mmonitorable_regex_def is_simple_eq_def one_enat_def list.pred_set)\n\nlemma monitorable_formula_code[code]: \"mmonitorable \\ = mmonitorable_exec \\\"\n using mmonitorable_exec_mmonitorable safe_formula_mmonitorable_exec mmonitorable_def\n by blast\n\nsubsection \\Handling regular expressions\\\n\ndatatype mregex =\n MSkip nat\n | MTestPos nat\n | MTestNeg nat\n | MPlus mregex mregex\n | MTimes mregex mregex\n | MStar mregex\n\nprimrec ok where\n \"ok _ (MSkip n) = True\"\n| \"ok m (MTestPos n) = (n < m)\"\n| \"ok m (MTestNeg n) = (n < m)\"\n| \"ok m (MPlus r s) = (ok m r \\ ok m s)\"\n| \"ok m (MTimes r s) = (ok m r \\ ok m s)\"\n| \"ok m (MStar r) = ok m r\"\n\nprimrec from_mregex where\n \"from_mregex (MSkip n) _ = Regex.Skip n\"\n| \"from_mregex (MTestPos n) \\s = Regex.Test (\\s ! n)\"\n| \"from_mregex (MTestNeg n) \\s = (if safe_formula (Formula.Neg (\\s ! n))\n then Regex.Test (Formula.Neg (Formula.Neg (Formula.Neg (\\s ! n))))\n else Regex.Test (Formula.Neg (\\s ! n)))\"\n| \"from_mregex (MPlus r s) \\s = Regex.Plus (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MTimes r s) \\s = Regex.Times (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MStar r) \\s = Regex.Star (from_mregex r \\s)\"\n\nprimrec to_mregex_exec where\n \"to_mregex_exec (Regex.Skip n) xs = (MSkip n, xs)\"\n| \"to_mregex_exec (Regex.Test \\) xs = (if safe_formula \\ then (MTestPos (length xs), xs @ [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg (length xs), xs @ [\\']) | _ \\ (MSkip 0, xs))\"\n| \"to_mregex_exec (Regex.Plus r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MPlus mr ms, zs))\"\n| \"to_mregex_exec (Regex.Times r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MTimes mr ms, zs))\"\n| \"to_mregex_exec (Regex.Star r) xs =\n (let (mr, ys) = to_mregex_exec r xs in (MStar mr, ys))\"\n\nprimrec shift where\n \"shift (MSkip n) k = MSkip n\"\n| \"shift (MTestPos i) k = MTestPos (i + k)\"\n| \"shift (MTestNeg i) k = MTestNeg (i + k)\"\n| \"shift (MPlus r s) k = MPlus (shift r k) (shift s k)\"\n| \"shift (MTimes r s) k = MTimes (shift r k) (shift s k)\"\n| \"shift (MStar r) k = MStar (shift r k)\"\n\nprimrec to_mregex where\n \"to_mregex (Regex.Skip n) = (MSkip n, [])\"\n| \"to_mregex (Regex.Test \\) = (if safe_formula \\ then (MTestPos 0, [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg 0, [\\']) | _ \\ (MSkip 0, []))\"\n| \"to_mregex (Regex.Plus r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MPlus mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Times r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MTimes mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Star r) =\n (let (mr, ys) = to_mregex r in (MStar mr, ys))\"\n\nlemma shift_0: \"shift r 0 = r\"\n by (induct r) auto\n\nlemma shift_shift: \"shift (shift r k) j = shift r (k + j)\"\n by (induct r) auto\n\nlemma to_mregex_to_mregex_exec:\n \"case to_mregex r of (mr, \\s) \\ to_mregex_exec r xs = (shift mr (length xs), xs @ \\s)\"\n by (induct r arbitrary: xs)\n (auto simp: shift_shift ac_simps split: formula.splits prod.splits)\n\nlemma to_mregex_to_mregex_exec_Nil[code]: \"to_mregex r = to_mregex_exec r []\"\n using to_mregex_to_mregex_exec[where xs=\"[]\" and r = r] by (auto simp: shift_0)\n\nlemma ok_mono: \"ok m mr \\ m \\ n \\ ok n mr\"\n by (induct mr) auto\n\nlemma from_mregex_cong: \"ok m mr \\ (\\i < m. xs ! i = ys ! i) \\ from_mregex mr xs = from_mregex mr ys\"\n by (induct mr) auto\n\nlemma not_Neg_cases:\n \"(\\\\. \\ \\ Formula.Neg \\) \\ (case \\ of formula.Neg \\ \\ f \\ | _ \\ x) = x\"\n by (cases \\) auto\n\nlemma to_mregex_exec_ok:\n \"to_mregex_exec r xs = (mr, ys) \\ \\zs. ys = xs @ zs \\ set zs = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: xs mr ys)\n case (Skip x)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Star r)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nqed\n\nlemma ok_shift: \"ok (i + m) (Monitor.shift r i) \\ ok m r\"\n by (induct r) auto\n\nlemma to_mregex_ok: \"to_mregex r = (mr, ys) \\ set ys = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: mr ys)\n case (Skip x)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Star r)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nqed\n\nlemma from_mregex_shift: \"from_mregex (shift r (length xs)) (xs @ ys) = from_mregex r ys\"\n by (induct r) (auto simp: nth_append)\n\nlemma from_mregex_to_mregex: \"safe_regex m g r \\ case_prod from_mregex (to_mregex r) = r\"\n by (induct r rule: safe_regex.induct)\n (auto dest: to_mregex_ok intro!: from_mregex_cong simp: nth_append from_mregex_shift cases_Neg_iff\n split: prod.splits modality.splits)\n\nlemma from_mregex_eq: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ from_mregex mr \\s = r\"\n using from_mregex_to_mregex[of m g r] by auto\n\nlemma from_mregex_to_mregex_exec: \"safe_regex m g r \\ case_prod from_mregex (to_mregex_exec r xs) = r\"\nproof (induct r arbitrary: xs rule: safe_regex_induct)\n case (Plus b g r s)\n from Plus(3) Plus(1)[of xs] Plus(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesF g r s)\n from TimesF(3) TimesF(2)[of xs] TimesF(1)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesP g r s)\n from TimesP(3) TimesP(1)[of xs] TimesP(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (Star b g r)\n from Star(2) Star(1)[of xs] show ?case\n by (auto split: prod.splits)\nqed (auto split: prod.splits simp: cases_Neg_iff)\n\n\nderive linorder mregex\n\nsubsubsection \\LPD\\\n\ndefinition saturate where\n \"saturate f = while (\\S. f S \\ S) f\"\n\nlemma saturate_code[code]:\n \"saturate f S = (let S' = f S in if S' = S then S else saturate f S')\"\n unfolding saturate_def Let_def\n by (subst while_unfold) auto\n\ndefinition \"MTimesL r S = MTimes r ` S\"\ndefinition \"MTimesR R s = (\\r. MTimes r s) ` R\"\n\nprimrec LPD where\n \"LPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"LPD (MTestPos \\) = {}\"\n| \"LPD (MTestNeg \\) = {}\"\n| \"LPD (MPlus r s) = (LPD r \\ LPD s)\"\n| \"LPD (MTimes r s) = MTimesR (LPD r) s \\ LPD s\"\n| \"LPD (MStar r) = MTimesR (LPD r) (MStar r)\"\n\nprimrec LPDi where\n \"LPDi 0 r = {r}\"\n| \"LPDi (Suc i) r = (\\s \\ LPD r. LPDi i s)\"\n\nlemma LPDi_Suc_alt: \"LPDi (Suc i) r = (\\s \\ LPDi i r. LPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"LPDs r = (\\i. LPDi i r)\"\n\nlemma LPDs_refl: \"r \\ LPDs r\"\n by (auto simp: LPDs_def intro: exI[of _ 0])\nlemma LPDs_trans: \"r \\ LPD s \\ s \\ LPDs t \\ r \\ LPDs t\"\n by (force simp: LPDs_def LPDi_Suc_alt simp del: LPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma LPDi_Test:\n \"LPDi i (MSkip 0) \\ {MSkip 0}\"\n \"LPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma LPDs_Test:\n \"LPDs (MSkip 0) \\ {MSkip 0}\"\n \"LPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding LPDs_def using LPDi_Test by blast+\n\nlemma LPDi_MSkip: \"LPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF LPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma LPDs_MSkip: \"LPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding LPDs_def using LPDi_MSkip by auto\n\nlemma LPDi_Plus: \"LPDi i (MPlus r s) \\ {MPlus r s} \\ LPDi i r \\ LPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma LPDs_Plus: \"LPDs (MPlus r s) \\ {MPlus r s} \\ LPDs r \\ LPDs s\"\n unfolding LPDs_def using LPDi_Plus[of _ r s] by auto\n\nlemma LPDi_Times:\n \"LPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesR (\\j \\ i. LPDi j r) s \\ (\\j \\ i. LPDi j s)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesR_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma LPDs_Times: \"LPDs (MTimes r s) \\ {MTimes r s} \\ MTimesR (LPDs r) s \\ LPDs s\"\n unfolding LPDs_def using LPDi_Times[of _ r s] by (force simp: MTimesR_def)\n\nlemma LPDi_Star: \"j \\ i \\ LPDi j (MStar r) \\ {MStar r} \\ MTimesR (\\j \\ i. LPDi j r) (MStar r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesR_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF LPDi_Times])\nqed simp\n\nlemma LPDs_Star: \"LPDs (MStar r) \\ {MStar r} \\ MTimesR (LPDs r) (MStar r)\"\n unfolding LPDs_def using LPDi_Star[OF order_refl, of _ r] by (force simp: MTimesR_def)\n\nlemma finite_LPDs: \"finite (LPDs r)\"\nproof (induct r)\n case (MSkip n)\n then show ?case by (intro finite_subset[OF LPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF LPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF LPDs_Times]) (simp add: MTimesR_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF LPDs_Star]) (simp add: MTimesR_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addLPD r \\ \\S. insert r S \\ Set.bind (insert r S) LPD\"\n\nprivate lemma mono_addLPD: \"mono (addLPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma LPDs_aux1: \"lfp (addLPD r) \\ LPDs r\"\n by (rule lfp_induct[OF mono_addLPD], auto intro: LPDs_refl LPDs_trans simp: Set.bind_def)\n\nprivate lemma LPDs_aux2: \"LPDi i r \\ lfp (addLPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) (auto simp: LPDi_Suc_alt simp del: LPDi.simps)\nqed\n\nlemma LPDs_alt: \"LPDs r = lfp (addLPD r)\"\n using LPDs_aux1 LPDs_aux2 by (force simp: LPDs_def)\n\nlemma LPDs_code[code]:\n \"LPDs r = saturate (addLPD r) {}\"\n unfolding LPDs_alt saturate_def\n by (rule lfp_while[OF mono_addLPD _ finite_LPDs, of r]) (auto simp: LPDs_refl LPDs_trans Set.bind_def)\n\nend\n\nsubsubsection \\RPD\\\n\nprimrec RPD where\n \"RPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"RPD (MTestPos \\) = {}\"\n| \"RPD (MTestNeg \\) = {}\"\n| \"RPD (MPlus r s) = (RPD r \\ RPD s)\"\n| \"RPD (MTimes r s) = MTimesL r (RPD s) \\ RPD r\"\n| \"RPD (MStar r) = MTimesL (MStar r) (RPD r)\"\n\nprimrec RPDi where\n \"RPDi 0 r = {r}\"\n| \"RPDi (Suc i) r = (\\s \\ RPD r. RPDi i s)\"\n\nlemma RPDi_Suc_alt: \"RPDi (Suc i) r = (\\s \\ RPDi i r. RPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"RPDs r = (\\i. RPDi i r)\"\n\nlemma RPDs_refl: \"r \\ RPDs r\"\n by (auto simp: RPDs_def intro: exI[of _ 0])\nlemma RPDs_trans: \"r \\ RPD s \\ s \\ RPDs t \\ r \\ RPDs t\"\n by (force simp: RPDs_def RPDi_Suc_alt simp del: RPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma RPDi_Test:\n \"RPDi i (MSkip 0) \\ {MSkip 0}\"\n \"RPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma RPDs_Test:\n \"RPDs (MSkip 0) \\ {MSkip 0}\"\n \"RPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding RPDs_def using RPDi_Test by blast+\n\nlemma RPDi_MSkip: \"RPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF RPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma RPDs_MSkip: \"RPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding RPDs_def using RPDi_MSkip by auto\n\nlemma RPDi_Plus: \"RPDi i (MPlus r s) \\ {MPlus r s} \\ RPDi i r \\ RPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma RPDi_Suc_RPD_Plus:\n \"RPDi (Suc i) r \\ RPDs (MPlus r s)\"\n \"RPDi (Suc i) s \\ RPDs (MPlus r s)\"\n unfolding RPDs_def by (force intro!: exI[of _ \"Suc i\"])+\n\nlemma RPDs_Plus: \"RPDs (MPlus r s) \\ {MPlus r s} \\ RPDs r \\ RPDs s\"\n unfolding RPDs_def using RPDi_Plus[of _ r s] by auto\n\nlemma RPDi_Times:\n \"RPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesL r (\\j \\ i. RPDi j s) \\ (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesL_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma RPDs_Times: \"RPDs (MTimes r s) \\ {MTimes r s} \\ MTimesL r (RPDs s) \\ RPDs r\"\n unfolding RPDs_def using RPDi_Times[of _ r s] by (force simp: MTimesL_def)\n\nlemma RPDi_Star: \"j \\ i \\ RPDi j (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesL_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF RPDi_Times])\nqed simp\n\nlemma RPDs_Star: \"RPDs (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (RPDs r)\"\n unfolding RPDs_def using RPDi_Star[OF order_refl, of _ r] by (force simp: MTimesL_def)\n\nlemma finite_RPDs: \"finite (RPDs r)\"\nproof (induct r)\n case MSkip\n then show ?case by (intro finite_subset[OF RPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF RPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF RPDs_Times]) (simp add: MTimesL_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF RPDs_Star]) (simp add: MTimesL_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addRPD r \\ \\S. insert r S \\ Set.bind (insert r S) RPD\"\n\nprivate lemma mono_addRPD: \"mono (addRPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma RPDs_aux1: \"lfp (addRPD r) \\ RPDs r\"\n by (rule lfp_induct[OF mono_addRPD], auto intro: RPDs_refl RPDs_trans simp: Set.bind_def)\n\nprivate lemma RPDs_aux2: \"RPDi i r \\ lfp (addRPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) (auto simp: RPDi_Suc_alt simp del: RPDi.simps)\nqed\n\nlemma RPDs_alt: \"RPDs r = lfp (addRPD r)\"\n using RPDs_aux1 RPDs_aux2 by (force simp: RPDs_def)\n\nlemma RPDs_code[code]:\n \"RPDs r = saturate (addRPD r) {}\"\n unfolding RPDs_alt saturate_def\n by (rule lfp_while[OF mono_addRPD _ finite_RPDs, of r]) (auto simp: RPDs_refl RPDs_trans Set.bind_def)\n\nend\n\nsubsection \\The executable monitor\\\n\ntype_synonym ts = nat\n\ntype_synonym 'a mbuf2 = \"'a table list \\ 'a table list\"\ntype_synonym 'a mbufn = \"'a table list list\"\ntype_synonym 'a msaux = \"(ts \\ 'a table) list\"\ntype_synonym 'a muaux = \"(ts \\ 'a table \\ 'a table) list\"\ntype_synonym 'a mr\\aux = \"(ts \\ (mregex, 'a table) mapping) list\"\ntype_synonym 'a ml\\aux = \"(ts \\ 'a table list \\ 'a table) list\"\n\ndatatype mconstraint = MEq | MLess | MLessEq\n\nrecord aggargs =\n aggargs_cols :: \"nat set\"\n aggargs_n :: nat\n aggargs_g0 :: bool\n aggargs_y :: nat\n aggargs_\\ :: \"Formula.agg_op\"\n aggargs_b :: nat\n aggargs_f :: \"Formula.trm\"\n\nrecord args =\n args_ivl :: \\\n args_n :: nat\n args_L :: \"nat set\"\n args_R :: \"nat set\"\n args_pos :: bool\n args_agg :: \"aggargs option\"\n\ndefinition init_args :: \"\\ \\ nat \\ nat set \\ nat set \\ bool \\ aggargs option \\ args\" where\n \"init_args I n L R pos agg = \\args_ivl = I, args_n = n, args_L = L, args_R = R,\n args_pos = pos, args_agg = agg\\\"\n\ndefinition init_aggargs :: \"nat set \\ nat \\ bool \\ nat \\ Formula.agg_op \\ nat \\\n Formula.trm \\ aggargs\" where\n \"init_aggargs cols n g0 y \\ b f = \\aggargs_cols = cols, aggargs_n = n, aggargs_g0 = g0,\n aggargs_y = y, aggargs_\\ = \\, aggargs_b = b, aggargs_f = f\\\"\n\nfun meval_trm :: \"Formula.trm \\ event_data tuple \\ event_data\" where\n \"meval_trm (Formula.Var x) v = the (v ! x)\"\n| \"meval_trm (Formula.Const x) v = x\"\n| \"meval_trm (Formula.Plus x y) v = meval_trm x v + meval_trm y v\"\n| \"meval_trm (Formula.Minus x y) v = meval_trm x v - meval_trm y v\"\n| \"meval_trm (Formula.UMinus x) v = - meval_trm x v\"\n| \"meval_trm (Formula.Mult x y) v = meval_trm x v * meval_trm y v\"\n| \"meval_trm (Formula.Div x y) v = meval_trm x v div meval_trm y v\"\n| \"meval_trm (Formula.Mod x y) v = meval_trm x v mod meval_trm y v\"\n| \"meval_trm (Formula.F2i x) v = EInt (integer_of_event_data (meval_trm x v))\"\n| \"meval_trm (Formula.I2f x) v = EFloat (double_of_event_data (meval_trm x v))\"\n\ndefinition packagg :: \"args \\ Formula.formula \\ Formula.formula\" where\n \"packagg args f = (case args_agg args of None \\ f\n | Some aggargs \\ Formula.Agg (aggargs_y aggargs)\n (aggargs_\\ aggargs) (aggargs_b aggargs) (aggargs_f aggargs) f)\"\n\ndefinition eval_agg :: \"nat \\ bool \\ nat \\ Formula.agg_op \\ nat \\ Formula.trm \\\n event_data table \\ event_data table\" where\n \"eval_agg n g0 y \\ b f rel = (if g0 \\ rel = empty_table\n then singleton_table n y (eval_agg_op \\ {})\n else (\\k.\n let group = Set.filter (\\x. drop b x = k) rel;\n M = (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` meval_trm f ` group\n in k[y:=Some (eval_agg_op \\ M)]) ` (drop b) ` rel)\"\n\ndefinition eval_aggargs :: \"aggargs \\ event_data table \\ event_data table\" where\n \"eval_aggargs args = eval_agg (aggargs_n args) (aggargs_g0 args)\n (aggargs_y args) (aggargs_\\ args) (aggargs_b args) (aggargs_f args)\"\n\ndefinition eval_args_agg :: \"args \\ event_data table \\ event_data table\" where\n \"eval_args_agg args X = (case args_agg args of None \\ X | Some aggargs \\ eval_aggargs aggargs X)\"\n\ndefinition type_restr :: \"aggargs \\ event_data table \\ bool\" where\n \"type_restr args X = (let Z = meval_trm (aggargs_f args) ` X;\n all_int = Z \\ range EInt;\n all_float = Z \\ range EFloat;\n all_string = Z \\ range EString in\n case aggargs_\\ args of (Formula.Agg_Cnt, _) \\ True\n | (Formula.Agg_Min, _) \\ all_int \\ all_string\n | (Formula.Agg_Max, _) \\ all_int \\ all_string\n | (Formula.Agg_Sum, _) \\ all_int\n | (Formula.Agg_Avg, _) \\ all_int\n | (Formula.Agg_Med, _) \\ all_int)\"\n\nlemma meval_trm_cong: \"(\\i. i \\ Formula.fv_trm f \\ ts ! i = ts' ! i) \\\n meval_trm f ts = meval_trm f ts'\"\n by (induction f ts rule: meval_trm.induct) auto\n\ndefinition safe_aggargs :: \"aggargs \\ bool\" where\n \"safe_aggargs args = (aggargs_y args < aggargs_n args \\\n (\\i \\ aggargs_cols args. i < aggargs_b args + aggargs_n args) \\\n aggargs_y args + aggargs_b args \\ aggargs_cols args \\\n {0.. aggargs_cols args \\\n Formula.fv_trm (aggargs_f args) \\ aggargs_cols args \\\n aggargs_g0 args = (aggargs_cols args \\ {0.. True | Some aggargs \\\n n = aggargs_b aggargs + aggargs_n aggargs \\ R = aggargs_cols aggargs \\ safe_aggargs aggargs)\"\n\nlocale msaux =\n fixes valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n assumes valid_init_msaux: \"L \\ R \\ valid_aggargs n R agg \\\n valid_msaux (init_args I n L R pos agg) 0 (init_msaux (init_args I n L R pos agg)) []\"\n assumes valid_add_new_ts_msaux: \"valid_msaux args cur aux auxlist \\ nt \\ cur \\\n valid_msaux args nt (add_new_ts_msaux args nt aux)\n (filter (\\(t, rel). memR (args_ivl args) (nt - t)) auxlist)\"\n assumes valid_join_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n valid_msaux args cur (join_msaux args rel1 aux)\n (map (\\(t, rel). (t, join rel (args_pos args) rel1)) auxlist)\"\n assumes valid_add_new_table_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_R args) rel2 \\\n valid_msaux args cur (add_new_table_msaux args rel2 aux)\n (case auxlist of\n [] => [(cur, rel2)]\n | ((t, y) # ts) \\ if t = cur then (t, y \\ rel2) # ts else (cur, rel2) # auxlist)\"\n assumes valid_result_msaux: \"valid_msaux args cur aux auxlist \\ result_msaux args aux =\n eval_args_agg args (foldr (\\) [rel. (t, rel) \\ auxlist, memL (args_ivl args) (cur - t)] {})\"\n\nfun check_before :: \"\\ \\ ts \\ (ts \\ 'a \\ 'b) \\ bool\" where\n \"check_before I dt (t, a, b) \\ \\ memR I (dt - t)\"\n\nfun proj_thd :: \"('a \\ 'b \\ 'c) \\ 'c\" where\n \"proj_thd (t, a1, a2) = a2\"\n\ndefinition update_until :: \"args \\ event_data table \\ event_data table \\ ts \\ event_data muaux \\ event_data muaux\" where\n \"update_until args rel1 rel2 nt aux =\n (map (\\x. case x of (t, a1, a2) \\ (t, if (args_pos args) then join a1 True rel1 else a1 \\ rel1,\n if mem (args_ivl args) (nt - t) then a2 \\ join rel2 (args_pos args) a1 else a2)) aux) @\n [(nt, rel1, if memL (args_ivl args) 0 then rel2 else empty_table)]\"\n\nlemma map_proj_thd_update_until: \"map proj_thd (takeWhile (check_before (args_ivl args) nt) auxlist) =\n map proj_thd (takeWhile (check_before (args_ivl args) nt) (update_until args rel1 rel2 nt auxlist))\"\nproof (induction auxlist)\n case Nil\n then show ?case by (simp add: update_until_def)\nnext\n case (Cons a auxlist)\n then show ?case\n by (auto simp add: update_until_def split: if_splits prod.splits)\nqed\n\nfun eval_until :: \"\\ \\ ts \\ event_data muaux \\ event_data table list \\ event_data muaux\" where\n \"eval_until I nt [] = ([], [])\"\n| \"eval_until I nt ((t, a1, a2) # aux) = (if \\ memR I (nt - t) then\n (let (xs, aux) = eval_until I nt aux in (a2 # xs, aux)) else ([], (t, a1, a2) # aux))\"\n\nlemma eval_until_length:\n \"eval_until I nt auxlist = (res, auxlist') \\ length auxlist = length res + length auxlist'\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlemma eval_until_res: \"eval_until I nt auxlist = (res, auxlist') \\\n res = map proj_thd (takeWhile (check_before I nt) auxlist)\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: prod.splits)\n\nlemma eval_until_auxlist': \"eval_until I nt auxlist = (res, auxlist') \\\n auxlist' = drop (length res) auxlist\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlocale muaux =\n fixes valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ ts \\ 'muaux \\ event_data table list \\ 'muaux\"\n assumes valid_init_muaux: \"L \\ R \\ valid_aggargs n R aggargs \\\n valid_muaux (init_args I n L R pos aggargs) 0 (init_muaux (init_args I n L R pos aggargs)) []\"\n assumes valid_add_new_muaux: \"valid_muaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n table (args_n args) (args_R args) rel2 \\\n nt \\ cur \\\n valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux)\n (update_until args rel1 rel2 nt auxlist)\"\n assumes valid_length_muaux: \"valid_muaux args cur aux auxlist \\ length_muaux args aux = length auxlist\"\n assumes valid_eval_muaux: \"valid_muaux args cur aux auxlist \\ nt \\ cur \\\n eval_muaux args nt aux = (res, aux') \\ eval_until (args_ivl args) nt auxlist = (res', auxlist') \\\n valid_muaux args cur aux' auxlist' \\ res = map (eval_args_agg args) res'\"\n\nlocale maux = msaux valid_msaux init_msaux add_new_ts_msaux join_msaux add_new_table_msaux result_msaux +\n muaux valid_muaux init_muaux add_new_muaux length_muaux eval_muaux\n for valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n and valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ nat \\ 'muaux \\ event_data table list \\ 'muaux\"\n\ndatatype (dead 'msaux, dead 'muaux) mformula =\n MRel \"event_data table\"\n | MPred Formula.name \"Formula.trm list\"\n | MLet Formula.name nat \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\"\n | MAnd \"nat set\" \"('msaux, 'muaux) mformula\" bool \"nat set\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MAndAssign \"('msaux, 'muaux) mformula\" \"nat \\ Formula.trm\"\n | MAndRel \"('msaux, 'muaux) mformula\" \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm\"\n | MAnds \"nat set list\" \"nat set list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\"\n | MOr \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MNeg \"('msaux, 'muaux) mformula\"\n | MExists \"('msaux, 'muaux) mformula\"\n | MAgg bool nat Formula.agg_op nat \"Formula.trm\" \"('msaux, 'muaux) mformula\"\n | MPrev \\ \"('msaux, 'muaux) mformula\" bool \"event_data table list\" \"ts list\"\n | MNext \\ \"('msaux, 'muaux) mformula\" bool \"ts list\"\n | MSince args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" \"'msaux\"\n | MUntil args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" ts \"'muaux\"\n | MMatchP \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" \"event_data mr\\aux\"\n | MMatchF \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" ts \"event_data ml\\aux\"\n\nrecord ('msaux, 'muaux) mstate =\n mstate_i :: nat\n mstate_m :: \"('msaux, 'muaux) mformula\"\n mstate_n :: nat\n\nfun eq_rel :: \"nat \\ Formula.trm \\ Formula.trm \\ event_data table\" where\n \"eq_rel n (Formula.Const x) (Formula.Const y) = (if x = y then unit_table n else empty_table)\"\n| \"eq_rel n (Formula.Var x) (Formula.Const y) = singleton_table n x y\"\n| \"eq_rel n (Formula.Const x) (Formula.Var y) = singleton_table n y x\"\n| \"eq_rel n _ _ = undefined\"\n\nlemma regex_atms_size: \"x \\ regex.atms r \\ size x < regex.size_regex size r\"\n by (induct r) auto\n\nlemma atms_size:\n assumes \"x \\ atms r\"\n shows \"size x < Regex.size_regex size r\"\nproof -\n { fix y assume \"y \\ regex.atms r\" \"case y of formula.Neg z \\ x = z | _ \\ False\"\n then have \"size x < Regex.size_regex size r\"\n by (cases y rule: formula.exhaust) (auto dest: regex_atms_size)\n }\n with assms show ?thesis\n unfolding atms_def\n by (auto split: formula.splits dest: regex_atms_size)\nqed\n\nfun split_assignment :: \"nat set \\ Formula.formula \\ nat \\ Formula.trm\" where\n \"split_assignment X (Formula.Eq t1 t2) = (case (t1, t2) of\n (Formula.Var x, Formula.Var y) \\ if x \\ X then (y, t1) else (x, t2)\n | (Formula.Var x, _) \\ (x, t2)\n | (_, Formula.Var y) \\ (y, t1))\"\n| \"split_assignment _ _ = undefined\"\n\nfun split_constraint :: \"Formula.formula \\ Formula.trm \\ bool \\ mconstraint \\ Formula.trm\" where\n \"split_constraint (Formula.Eq t1 t2) = (t1, True, MEq, t2)\"\n| \"split_constraint (Formula.Less t1 t2) = (t1, True, MLess, t2)\"\n| \"split_constraint (Formula.LessEq t1 t2) = (t1, True, MLessEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Eq t1 t2)) = (t1, False, MEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Less t1 t2)) = (t1, False, MLess, t2)\"\n| \"split_constraint (Formula.Neg (Formula.LessEq t1 t2)) = (t1, False, MLessEq, t2)\"\n| \"split_constraint _ = undefined\"\n\ndefinition (in maux) \"init_since minit0 n agg \\ I \\ =\n (let args = (\\b. (init_args I n (Formula.fv \\) (Formula.fv \\) b agg)) in\n if safe_formula \\\n then MSince (args True) (minit0 n \\) (minit0 n \\) ([], []) [] (init_msaux (args True))\n else (case \\ of\n Formula.Neg \\' \\ MSince (args False) (minit0 n \\') (minit0 n \\) ([], []) [] (init_msaux (args False))\n | _ \\ undefined))\"\n\nlemma (in maux) init_since_cong[fundef_cong]:\n assumes \"\\\\ m. size \\ \\ size \\ + size \\ \\ minit0 m \\ = minit0' m \\\"\n shows \"init_since minit0 n agg \\ I \\ = init_since minit0' n agg \\ I \\\"\n using assms\n by (auto simp: init_since_def split: formula.splits)\n\ndefinition (in maux) \"init_until minit0 n agg \\ I \\ =\n (let args = (\\b. (init_args I n (Formula.fv \\) (Formula.fv \\) b agg)) in\n if safe_formula \\\n then MUntil (args True) (minit0 n \\) (minit0 n \\) ([], []) [] 0 (init_muaux (args True))\n else (case \\ of\n Formula.Neg \\' \\ MUntil (args False) (minit0 n \\') (minit0 n \\) ([], []) [] 0 (init_muaux (args False))\n | _ \\ undefined))\"\n\nlemma (in maux) init_until_cong[fundef_cong]:\n assumes \"\\\\ m. size \\ \\ size \\ + size \\ \\ minit0 m \\ = minit0' m \\\"\n shows \"init_until minit0 n agg \\ I \\ = init_until minit0' n agg \\ I \\\"\n using assms\n by (auto simp: init_until_def split: formula.splits)\n\nfunction (in maux) (sequential) minit0 :: \"nat \\ Formula.formula \\ ('msaux, 'muaux) mformula\" where\n \"minit0 n (Formula.Neg \\) = (if fv \\ = {} then MNeg (minit0 n \\) else MRel empty_table)\"\n| \"minit0 n (Formula.Eq t1 t2) = MRel (eq_rel n t1 t2)\"\n| \"minit0 n (Formula.Pred e ts) = MPred e ts\"\n| \"minit0 n (Formula.Let p \\ \\) = MLet p (Formula.nfv \\) (minit0 (Formula.nfv \\) \\) (minit0 n \\)\"\n| \"minit0 n (Formula.Or \\ \\) = MOr (minit0 n \\) (minit0 n \\) ([], [])\"\n| \"minit0 n (Formula.And \\ \\) = (if safe_assignment (fv \\) \\ then\n MAndAssign (minit0 n \\) (split_assignment (fv \\) \\)\n else if safe_formula \\ then\n MAnd (fv \\) (minit0 n \\) True (fv \\) (minit0 n \\) ([], [])\n else if is_constraint \\ then\n MAndRel (minit0 n \\) (split_constraint \\)\n else (case \\ of Formula.Neg \\ \\\n MAnd (fv \\) (minit0 n \\) False (fv \\) (minit0 n \\) ([], [])))\"\n| \"minit0 n (Formula.Ands l) = (let (pos, neg) = partition safe_formula l in\n let mpos = map (minit0 n) pos in\n let mneg = map (minit0 n) (map remove_neg neg) in\n let vpos = map fv pos in\n let vneg = map fv neg in\n MAnds vpos vneg (mpos @ mneg) (replicate (length l) []))\"\n| \"minit0 n (Formula.Exists \\) = MExists (minit0 (Suc n) \\)\"\n| \"minit0 n (Formula.Agg y \\ b f \\) =\n (let default = MAgg (fv \\ \\ {0.. b f (minit0 (b + n) \\) in\n (case \\ of Formula.Since \\' I \\' \\\n let agg = Some (init_aggargs (fv \\) n (fv \\ \\ {0.. b f) in\n init_since minit0 (b + n) agg \\' I \\'\n | Formula.Until \\' I \\' \\\n let agg = Some (init_aggargs (fv \\) n (fv \\ \\ {0.. b f) in\n init_until minit0 (b + n) agg \\' I \\'\n | _ \\ default))\"\n| \"minit0 n (Formula.Prev I \\) = MPrev I (minit0 n \\) True [] []\"\n| \"minit0 n (Formula.Next I \\) = MNext I (minit0 n \\) True []\"\n| \"minit0 n (Formula.Since \\ I \\) = init_since minit0 n None \\ I \\\"\n| \"minit0 n (Formula.Until \\ I \\) = init_until minit0 n None \\ I \\\"\n| \"minit0 n (Formula.MatchP I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchP I mr (sorted_list_of_set (RPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] [])\"\n| \"minit0 n (Formula.MatchF I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchF I mr (sorted_list_of_set (LPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] 0 [])\"\n| \"minit0 n _ = undefined\"\n by pat_completeness auto\ntermination (in maux)\n by (relation \"measure (\\(_, \\). size \\)\")\n (auto simp: less_Suc_eq_le size_list_estimation' size_remove_neg\n dest!: to_mregex_ok[OF sym] atms_size)\n\ndefinition (in maux) minit :: \"Formula.formula \\ ('msaux, 'muaux) mstate\" where\n \"minit \\ = (let n = Formula.nfv \\ in \\mstate_i = 0, mstate_m = minit0 n \\, mstate_n = n\\)\"\n\ndefinition (in maux) minit_safe where\n \"minit_safe \\ = (if mmonitorable_exec \\ then minit \\ else undefined)\"\n\nfun mprev_next :: \"\\ \\ event_data table list \\ ts list \\ event_data table list \\ event_data table list \\ ts list\" where\n \"mprev_next I [] ts = ([], [], ts)\"\n| \"mprev_next I xs [] = ([], xs, [])\"\n| \"mprev_next I xs [t] = ([], xs, [t])\"\n| \"mprev_next I (x # xs) (t # t' # ts) = (let (ys, zs) = mprev_next I xs (t' # ts)\n in ((if mem I ((t' - t)) then x else empty_table) # ys, zs))\"\n\nfun mbuf2_add :: \"event_data table list \\ event_data table list \\ event_data mbuf2 \\ event_data mbuf2\" where\n \"mbuf2_add xs' ys' (xs, ys) = (xs @ xs', ys @ ys')\"\n\nfun mbuf2_take :: \"(event_data table \\ event_data table \\ 'b) \\ event_data mbuf2 \\ 'b list \\ event_data mbuf2\" where\n \"mbuf2_take f (x # xs, y # ys) = (let (zs, buf) = mbuf2_take f (xs, ys) in (f x y # zs, buf))\"\n| \"mbuf2_take f (xs, ys) = ([], (xs, ys))\"\n\nfun mbuf2t_take :: \"(event_data table \\ event_data table \\ ts \\ 'b \\ 'b) \\ 'b \\\n event_data mbuf2 \\ ts list \\ 'b \\ event_data mbuf2 \\ ts list\" where\n \"mbuf2t_take f z (x # xs, y # ys) (t # ts) = mbuf2t_take f (f x y t z) (xs, ys) ts\"\n| \"mbuf2t_take f z (xs, ys) ts = (z, (xs, ys), ts)\"\n\nlemma size_list_length_diff1: \"xs \\ [] \\ [] \\ set xs \\\n size_list (\\xs. length xs - Suc 0) xs < size_list length xs\"\nproof (induct xs)\n case (Cons x xs)\n then show ?case\n by (cases xs) auto\nqed simp\n\nfun mbufn_add :: \"event_data table list list \\ event_data mbufn \\ event_data mbufn\" where\n \"mbufn_add xs' xs = List.map2 (@) xs xs'\"\n\nfunction mbufn_take :: \"(event_data table list \\ 'b \\ 'b) \\ 'b \\ event_data mbufn \\ 'b \\ event_data mbufn\" where\n \"mbufn_take f z buf = (if buf = [] \\ [] \\ set buf then (z, buf)\n else mbufn_take f (f (map hd buf) z) (map tl buf))\"\n by pat_completeness auto\ntermination by (relation \"measure (\\(_, _, buf). size_list length buf)\")\n (auto simp: comp_def Suc_le_eq size_list_length_diff1)\n\nfun mbufnt_take :: \"(event_data table list \\ ts \\ 'b \\ 'b) \\\n 'b \\ event_data mbufn \\ ts list \\ 'b \\ event_data mbufn \\ ts list\" where\n \"mbufnt_take f z buf ts =\n (if [] \\ set buf \\ ts = [] then (z, buf, ts)\n else mbufnt_take f (f (map hd buf) (hd ts) z) (map tl buf) (tl ts))\"\n\nfun match :: \"Formula.trm list \\ event_data list \\ (nat \\ event_data) option\" where\n \"match [] [] = Some Map.empty\"\n| \"match (Formula.Const x # ts) (y # ys) = (if x = y then match ts ys else None)\"\n| \"match (Formula.Var x # ts) (y # ys) = (case match ts ys of\n None \\ None\n | Some f \\ (case f x of\n None \\ Some (f(x \\ y))\n | Some z \\ if y = z then Some f else None))\"\n| \"match _ _ = None\"\n\ndefinition (in maux) update_since :: \"args \\ event_data table \\ event_data table \\ ts \\\n 'msaux \\ event_data table \\ 'msaux\" where\n \"update_since args rel1 rel2 nt aux =\n (let aux0 = join_msaux args rel1 (add_new_ts_msaux args nt aux);\n aux' = add_new_table_msaux args rel2 aux0\n in (result_msaux args aux', aux'))\"\n\ndefinition \"lookup = Mapping.lookup_default empty_table\"\n\nfun \\_lax where\n \"\\_lax guard \\s (MSkip n) = (if n = 0 then guard else empty_table)\"\n| \"\\_lax guard \\s (MTestPos i) = join guard True (\\s ! i)\"\n| \"\\_lax guard \\s (MTestNeg i) = join guard False (\\s ! i)\"\n| \"\\_lax guard \\s (MPlus r s) = \\_lax guard \\s r \\ \\_lax guard \\s s\"\n| \"\\_lax guard \\s (MTimes r s) = join (\\_lax guard \\s r) True (\\_lax guard \\s s)\"\n| \"\\_lax guard \\s (MStar r) = guard\"\n\nfun r\\_strict where\n \"r\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"r\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MPlus r s) = r\\_strict n \\s r \\ r\\_strict n \\s s\"\n| \"r\\_strict n \\s (MTimes r s) = \\_lax (r\\_strict n \\s r) \\s s\"\n| \"r\\_strict n \\s (MStar r) = unit_table n\"\n\nfun l\\_strict where\n \"l\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"l\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MPlus r s) = l\\_strict n \\s r \\ l\\_strict n \\s s\"\n| \"l\\_strict n \\s (MTimes r s) = \\_lax (l\\_strict n \\s s) \\s r\"\n| \"l\\_strict n \\s (MStar r) = unit_table n\"\n\nfun r\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"r\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"r\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"r\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"r\\ \\ X \\s (MPlus r s) = r\\ \\ X \\s r \\ r\\ \\ X \\s s\"\n| \"r\\ \\ X \\s (MTimes r s) = r\\ (\\t. \\ (MTimes r t)) X \\s s \\ \\_lax (r\\ \\ X \\s r) \\s s\"\n| \"r\\ \\ X \\s (MStar r) = r\\ (\\t. \\ (MTimes (MStar r) t)) X \\s r\"\n\nfun l\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"l\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"l\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"l\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"l\\ \\ X \\s (MPlus r s) = l\\ \\ X \\s r \\ l\\ \\ X \\s s\"\n| \"l\\ \\ X \\s (MTimes r s) = l\\ (\\t. \\ (MTimes t s)) X \\s r \\ \\_lax (l\\ \\ X \\s s) \\s r\"\n| \"l\\ \\ X \\s (MStar r) = l\\ (\\t. \\ (MTimes t (MStar r))) X \\s r\"\n\nlift_definition mrtabulate :: \"mregex list \\ (mregex \\ 'b table) \\ (mregex, 'b table) mapping\"\n is \"\\ks f. (map_of (List.map_filter (\\k. let fk = f k in if fk = empty_table then None else Some (k, fk)) ks))\" .\n\nlemma lookup_tabulate:\n \"distinct xs \\ lookup (mrtabulate xs f) x = (if x \\ set xs then f x else empty_table)\"\n unfolding lookup_default_def lookup_def\n by transfer (auto simp: Let_def map_filter_def map_of_eq_None_iff o_def image_image dest!: map_of_SomeD\n split: if_splits option.splits)\n\ndefinition update_matchP :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\\n event_data mr\\aux \\ event_data table \\ event_data mr\\aux\" where\n \"update_matchP n I mr mrs rels nt aux =\n (let aux = (case [(t, mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = nt then r\\_strict n rels mr else {}))).\n (t, rel) \\ aux, memR I (nt - t)]\n of [] \\ [(nt, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = nt then x # aux'\n else (nt, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\n in (foldr (\\) [lookup rel mr. (t, rel) \\ aux, memL I (nt - t)] {}, aux))\"\n\ndefinition update_matchF_base where\n \"update_matchF_base n I mr mrs rels nt =\n (let X = mrtabulate mrs (l\\_strict n rels)\n in ([(nt, rels, if memL I 0 then lookup X mr else empty_table)], X))\"\n\ndefinition update_matchF_step where\n \"update_matchF_step I mr mrs nt = (\\(t, rels', rel) (aux', X).\n (let Y = mrtabulate mrs (l\\ id X rels')\n in ((t, rels', if mem I ((nt - t)) then rel \\ lookup Y mr else rel) # aux', Y)))\"\n\ndefinition update_matchF :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\ event_data ml\\aux \\ event_data ml\\aux\" where\n \"update_matchF n I mr mrs rels nt aux =\n fst (foldr (update_matchF_step I mr mrs nt) aux (update_matchF_base n I mr mrs rels nt))\"\n\nfun eval_matchF :: \"\\ \\ mregex \\ ts \\ event_data ml\\aux \\ event_data table list \\ event_data ml\\aux\" where\n \"eval_matchF I mr nt [] = ([], [])\"\n| \"eval_matchF I mr nt ((t, rels, rel) # aux) = (if \\ memR I (nt - t) then\n (let (xs, aux) = eval_matchF I mr nt aux in (rel # xs, aux)) else ([], (t, rels, rel) # aux))\"\n\nprimrec map_split where\n \"map_split f [] = ([], [])\"\n| \"map_split f (x # xs) =\n (let (y, z) = f x; (ys, zs) = map_split f xs\n in (y # ys, z # zs))\"\n\nfun eval_assignment :: \"nat \\ Formula.trm \\ event_data tuple \\ event_data tuple\" where\n \"eval_assignment (x, t) y = (y[x:=Some (meval_trm t y)])\"\n\nfun eval_constraint0 :: \"mconstraint \\ event_data \\ event_data \\ bool\" where\n \"eval_constraint0 MEq x y = (x = y)\"\n| \"eval_constraint0 MLess x y = (x < y)\"\n| \"eval_constraint0 MLessEq x y = (x \\ y)\"\n\nfun eval_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ event_data tuple \\ bool\" where\n \"eval_constraint (t1, p, c, t2) x = (eval_constraint0 c (meval_trm t1 x) (meval_trm t2 x) = p)\"\n\ndefinition \"lookahead_ts nts' nts ts t = hd (nts' @ rev (nts @ ts) @ [t])\"\n\nlemma lookahead_ts_code[code]: \"lookahead_ts nts' nts ts t =\n (case nts' of t # _ \\ t\n | [] \\ (case ts of _ # _ \\ last ts\n | [] \\ (case nts of _ # _ \\ last nts\n | [] \\ t)))\"\n by (auto simp: lookahead_ts_def hd_append hd_rev split: list.splits)\n\nprimrec (in maux) meval :: \"nat \\ ts list \\ Formula.database \\ ('msaux, 'muaux) mformula \\\n event_data table list \\ ('msaux, 'muaux) mformula\" where\n \"meval n ts db (MRel rel) = (replicate (length ts) rel, MRel rel)\"\n| \"meval n ts db (MPred e tms) = (map (\\X. (\\f. Table.tabulate f 0 n) ` Option.these\n (match tms ` X)) (case Mapping.lookup db e of None \\ replicate (length ts) {} | Some xs \\ xs), MPred e tms)\"\n| \"meval n ts db (MLet p m \\ \\) =\n (let (xs, \\) = meval m ts db \\; (ys, \\) = meval n ts (Mapping.update p (map (image (map the)) xs) db) \\\n in (ys, MLet p m \\ \\))\"\n| \"meval n ts db (MAnd A_\\ \\ pos A_\\ \\ buf) =\n (let (xs, \\) = meval n ts db \\; (ys, \\) = meval n ts db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. bin_join n A_\\ r1 pos A_\\ r2) (mbuf2_add xs ys buf)\n in (zs, MAnd A_\\ \\ pos A_\\ \\ buf))\"\n| \"meval n ts db (MAndAssign \\ conf) =\n (let (xs, \\) = meval n ts db \\ in (map (\\r. eval_assignment conf ` r) xs, MAndAssign \\ conf))\"\n| \"meval n ts db (MAndRel \\ conf) =\n (let (xs, \\) = meval n ts db \\ in (map (Set.filter (eval_constraint conf)) xs, MAndRel \\ conf))\"\n| \"meval n ts db (MAnds A_pos A_neg L buf) =\n (let R = map (meval n ts db) L in\n let buf = mbufn_add (map fst R) buf in\n let (zs, buf) = mbufn_take (\\xs zs. zs @ [mmulti_join n A_pos A_neg xs]) [] buf in\n (zs, MAnds A_pos A_neg (map snd R) buf))\"\n| \"meval n ts db (MOr \\ \\ buf) =\n (let (xs, \\) = meval n ts db \\; (ys, \\) = meval n ts db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. r1 \\ r2) (mbuf2_add xs ys buf)\n in (zs, MOr \\ \\ buf))\"\n| \"meval n ts db (MNeg \\) =\n (let (xs, \\) = meval n ts db \\ in (map (\\r. (if r = empty_table then unit_table n else empty_table)) xs, MNeg \\))\"\n| \"meval n ts db (MExists \\) =\n (let (xs, \\) = meval (Suc n) ts db \\ in (map (\\r. tl ` r) xs, MExists \\))\"\n| \"meval n ts db (MAgg g0 y \\ b f \\) =\n (let (xs, \\) = meval (b + n) ts db \\ in (map (eval_agg n g0 y \\ b f) xs, MAgg g0 y \\ b f \\))\"\n| \"meval n ts db (MPrev I \\ first buf nts) =\n (let (xs, \\) = meval n ts db \\\n in if first \\ ts = [] then ([], MPrev I \\ True (buf @ xs) (nts @ ts))\n else let (zs, buf, nts) = mprev_next I (buf @ xs) (nts @ ts)\n in (if first then empty_table # zs else zs, MPrev I \\ False buf nts))\"\n| \"meval n ts db (MNext I \\ first nts) =\n (let (xs, \\) = meval n ts db \\;\n (xs, first) = (case (xs, first) of (_ # xs, True) \\ (xs, False) | a \\ a);\n (zs, _, nts) = mprev_next I xs (nts @ ts)\n in (zs, MNext I \\ first nts))\"\n| \"meval n ts db (MSince args \\ \\ buf nts aux) =\n (let (xs, \\) = meval (args_n args) ts db \\; (ys, \\) = meval (args_n args) ts db \\;\n ((zs, aux), buf, nts) = mbuf2t_take (\\r1 r2 t (zs, aux).\n let (z, aux) = update_since args r1 r2 t aux\n in (zs @ [z], aux)) ([], aux) (mbuf2_add xs ys buf) (nts @ ts)\n in (zs, MSince args \\ \\ buf nts aux))\"\n| \"meval n ts db (MUntil args \\ \\ buf nts t aux) =\n (let (xs, \\) = meval (args_n args) ts db \\; (ys, \\) = meval (args_n args) ts db \\;\n (aux, buf, nts') = mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ ts);\n nt = lookahead_ts nts' nts ts t;\n (zs, aux) = eval_muaux args nt aux\n in (zs, MUntil args \\ \\ buf nts' nt aux))\"\n| \"meval n ts db (MMatchP I mr mrs \\s buf nts aux) =\n (let (xss, \\s) = map_split id (map (meval n ts db) \\s);\n ((zs, aux), buf, nts) = mbufnt_take (\\rels t (zs, aux).\n let (z, aux) = update_matchP n I mr mrs rels t aux\n in (zs @ [z], aux)) ([], aux) (mbufn_add xss buf) (nts @ ts)\n in (zs, MMatchP I mr mrs \\s buf nts aux))\"\n| \"meval n ts db (MMatchF I mr mrs \\s buf nts t aux) =\n (let (xss, \\s) = map_split id (map (meval n ts db) \\s);\n (aux, buf, nts') = mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ ts);\n nt = lookahead_ts nts' nts ts t;\n (zs, aux) = eval_matchF I mr nt aux\n in (zs, MMatchF I mr mrs \\s buf nts' nt aux))\"\n\ndefinition (in maux) mstep :: \"Formula.database \\ ts \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\" where\n \"mstep tdb st =\n (let (xs, m) = meval (mstate_n st) [snd tdb] (fst tdb) (mstate_m st)\n in (List.enumerate (mstate_i st) xs,\n \\mstate_i = mstate_i st + length xs, mstate_m = m, mstate_n = mstate_n st\\))\"\n\nsubsection \\Verdict delay\\\n\ncontext fixes \\ :: Formula.trace begin\n\nfun progress :: \"(Formula.name \\ nat) \\ Formula.formula \\ nat \\ nat\" where\n \"progress P (Formula.Pred e ts) j = (case P e of None \\ j | Some k \\ k)\"\n| \"progress P (Formula.Let p \\ \\) j = progress (P(p \\ progress P \\ j)) \\ j\"\n| \"progress P (Formula.Eq t1 t2) j = j\"\n| \"progress P (Formula.Less t1 t2) j = j\"\n| \"progress P (Formula.LessEq t1 t2) j = j\"\n| \"progress P (Formula.Neg \\) j = progress P \\ j\"\n| \"progress P (Formula.Or \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.And \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Ands l) j = (if l = [] then j else Min (set (map (\\\\. progress P \\ j) l)))\"\n| \"progress P (Formula.Exists \\) j = progress P \\ j\"\n| \"progress P (Formula.Agg y \\ b f \\) j = progress P \\ j\"\n| \"progress P (Formula.Prev I \\) j = (if j = 0 then 0 else min (Suc (progress P \\ j)) j)\"\n| \"progress P (Formula.Next I \\) j = progress P \\ j - 1\"\n| \"progress P (Formula.Since \\ I \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Until \\ I \\) j =\n Inf {i. \\k. k < j \\ k \\ min (progress P \\ j) (progress P \\ j) \\ memR I (\\ \\ k - \\ \\ i)}\"\n| \"progress P (Formula.MatchP I r) j = min_regex_default (progress P) r j\"\n| \"progress P (Formula.MatchF I r) j =\n Inf {i. \\k. k < j \\ k \\ min_regex_default (progress P) r j \\ memR I (\\ \\ k - \\ \\ i)}\"\n\ndefinition \"progress_regex P = min_regex_default (progress P)\"\n\ndeclare progress.simps[simp del]\nlemmas progress_simps[simp] = progress.simps[folded progress_regex_def[THEN fun_cong, THEN fun_cong]]\n\nend\n\ndefinition \"pred_mapping Q = pred_fun (\\_. True) (pred_option Q)\"\ndefinition \"rel_mapping Q = rel_fun (=) (rel_option Q)\"\n\nlemma pred_mapping_alt: \"pred_mapping Q P = (\\p \\ dom P. Q (the (P p)))\"\n unfolding pred_mapping_def pred_fun_def option.pred_set dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_alt: \"rel_mapping Q P P' = (dom P = dom P' \\ (\\p \\ dom P. Q (the (P p)) (the (P' p))))\"\n unfolding rel_mapping_def rel_fun_def rel_option_iff dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_map_upd[simp]: \"Q x y \\ rel_mapping Q P P' \\ rel_mapping Q (P(p \\ x)) (P'(p \\ y))\"\n by (auto simp: rel_mapping_alt)\n\nlemma pred_mapping_map_upd[simp]: \"Q x \\ pred_mapping Q P \\ pred_mapping Q (P(p \\ x))\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_empty[simp]: \"pred_mapping Q Map.empty\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono: \"pred_mapping Q P \\ Q \\ R \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono_strong: \"pred_mapping Q P \\\n (\\p. p \\ dom P \\ Q (the (P p)) \\ R (the (P p))) \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma progress_mono_gen: \"j \\ j' \\ rel_mapping (\\) P P' \\ progress \\ P \\ j \\ progress \\ P' \\ j'\"\nproof (induction \\ arbitrary: P P')\n case (Pred e ts)\n then show ?case\n by (force simp: rel_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[THEN order_trans])\nnext\n case (Until \\ I \\)\n from Until(1,2)[of P P'] Until.prems show ?case\n by (auto 0 3 dest: memR_nonzeroD less_\\D spec[of _ j'] intro!: cInf_superset_mono)\nnext\n case (MatchF I r)\n from MatchF(1)[of _ P P'] MatchF.prems show ?case\n by (auto 0 3 simp: Min_le_iff progress_regex_def dest: memR_nonzeroD less_\\D spec[of _ j']\n elim!: order_trans less_le_trans intro!: cInf_superset_mono)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma rel_mapping_reflp: \"reflp Q \\ rel_mapping Q P P\"\n by (auto simp: rel_mapping_alt reflp_def)\n\nlemmas progress_mono = progress_mono_gen[OF _ rel_mapping_reflp[unfolded reflp_def], simplified]\n\nlemma progress_le_gen: \"pred_mapping (\\x. x \\ j) P \\ progress \\ P \\ j \\ j\"\nproof (induction \\ arbitrary: P)\n case (Pred e ts)\n then show ?case\n by (auto simp: pred_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[where a=\"progress \\ P (hd l) j\", THEN order_trans])\nnext\n case (Until \\ I \\)\n then show ?case\n by (auto intro!: cInf_lower)\nnext\n case (MatchF I r)\n then show ?case\n by (auto intro!: cInf_lower)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma progress_le: \"progress \\ Map.empty \\ j \\ j\"\n using progress_le_gen[of _ Map.empty] by auto\n\nlemma progress_0_gen[simp]:\n \"pred_mapping (\\x. x = 0) P \\ progress \\ P \\ 0 = 0\"\n using progress_le_gen[of 0 P] by auto\n\nlemma progress_0[simp]:\n \"progress \\ Map.empty \\ 0 = 0\"\n by (auto simp: pred_mapping_alt)\n\ndefinition max_mapping :: \"('b \\ 'a option) \\ ('b \\ 'a option) \\ 'b \\ ('a :: linorder) option\" where\n \"max_mapping P P' x = (case (P x, P' x) of\n (None, None) \\ None\n | (Some x, None) \\ None\n | (None, Some x) \\ None\n | (Some x, Some y) \\ Some (max x y))\"\n\ndefinition Max_mapping :: \"('b \\ 'a option) set \\ 'b \\ ('a :: linorder) option\" where\n \"Max_mapping Ps x = (if (\\P \\ Ps. P x \\ None) then Some (Max ((\\P. the (P x)) ` Ps)) else None)\"\n\nlemma dom_max_mapping[simp]: \"dom (max_mapping P1 P2) = dom P1 \\ dom P2\"\n unfolding max_mapping_def by (auto split: option.splits)\n\nlemma dom_Max_mapping[simp]: \"dom (Max_mapping X) = (\\P \\ X. dom P)\"\n unfolding Max_mapping_def by (auto split: if_splits)\n\nlemma Max_mapping_coboundedI:\n assumes \"finite X\" \"\\Q \\ X. dom Q = dom P\" \"P \\ X\"\n shows \"rel_mapping (\\) P (Max_mapping X)\"\n unfolding rel_mapping_alt\nproof (intro conjI ballI)\n from assms(3) have \"X \\ {}\" by auto\n then show \"dom P = dom (Max_mapping X)\" using assms(2) by auto\nnext\n fix p\n assume \"p \\ dom P\"\n with assms show \"the (P p) \\ the (Max_mapping X p)\"\n by (force simp add: Max_mapping_def intro!: Max.coboundedI imageI)\nqed\n\nlemma rel_mapping_trans: \"P OO Q \\ R \\\n rel_mapping P P1 P2 \\ rel_mapping Q P2 P3 \\ rel_mapping R P1 P3\"\n by (force simp: rel_mapping_alt dom_def set_eq_iff)\n\nabbreviation range_mapping :: \"nat \\ nat \\ ('b \\ nat option) \\ bool\" where\n \"range_mapping i j P \\ pred_mapping (\\x. i \\ x \\ x \\ j) P\"\n\nlemma range_mapping_relax:\n \"range_mapping i j P \\ i' \\ i \\ j' \\ j \\ range_mapping i' j' P\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_max_mapping[simp]:\n \"range_mapping i j1 P1 \\ range_mapping i j2 P2 \\ range_mapping i (max j1 j2) (max_mapping P1 P2)\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_Max_mapping[simp]:\n \"finite X \\ X \\ {} \\ \\x\\X. range_mapping i (j x) (P x) \\ range_mapping i (Max (j ` X)) (Max_mapping (P ` X))\"\n by (force simp: pred_mapping_alt Max_mapping_def dom_def image_iff\n intro!: Max_ge_iff[THEN iffD2] split: if_splits)\n\nlemma pred_mapping_le:\n \"pred_mapping ((\\) i) P1 \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma pred_mapping_le':\n \"pred_mapping ((\\) j) P1 \\ i \\ j \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma max_mapping_cobounded1: \"dom P1 \\ dom P2 \\ rel_mapping (\\) P1 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_cobounded2: \"dom P2 \\ dom P1 \\ rel_mapping (\\) P2 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_fun_upd2[simp]:\n \"max_mapping P1 (P2(p := y))(p \\ x) = (max_mapping P1 P2)(p \\ x)\"\n by (auto simp: max_mapping_def)\n\nlemma rel_mapping_max_mapping_fun_upd: \"dom P2 \\ dom P1 \\ p \\ dom P2 \\ the (P2 p) \\ y \\\n rel_mapping (\\) P2 (max_mapping P1 P2(p \\ y))\"\n by (auto simp: rel_mapping_alt max_mapping_def split: option.splits)\n\nlemma progress_ge_gen: \"Formula.future_bounded \\ \\\n \\P j. dom P = S \\ range_mapping i j P \\ i \\ progress \\ P \\ j\"\nproof (induction \\ arbitrary: i S)\n case (Pred e ts)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: option.splits if_splits simp: rel_mapping_alt pred_mapping_alt dom_def)\nnext\n case (Let p \\ \\)\n from Let.prems obtain P2 j2 where P2: \"dom P2 = insert p S\" \"range_mapping i j2 P2\"\n \"i \\ progress \\ P2 \\ j2\"\n by (atomize_elim, intro Let(2)) (force simp: pred_mapping_alt rel_mapping_alt dom_def)+\n from Let.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (the (P2 p)) j1 P1\"\n \"the (P2 p) \\ progress \\ P1 \\ j1\"\n by (atomize_elim, intro Let(1)) auto\n let ?P12 = \"max_mapping P1 P2\"\n from P1 P2 have le1: \"progress \\ P1 \\ j1 \\ progress \\ (?P12(p := P1 p)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n from P1 P2 have le2: \"progress \\ P2 \\ j2 \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n show ?case\n unfolding progress.simps\n proof (intro exI[of _ \"?P12(p := P1 p)\"] exI[of _ \"max j1 j2\"] conjI)\n show \"dom (?P12(p := P1 p)) = S\"\n using P1 P2 by (auto simp: dom_def max_mapping_def)\n next\n show \"range_mapping i (max j1 j2) (?P12(p := P1 p))\"\n using P1 P2 by (force simp add: pred_mapping_alt dom_def max_mapping_def split: option.splits)\n next\n have \"i \\ progress \\ P2 \\ j2\" by fact\n also have \"... \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n using le2 by blast\n also have \"... \\ progress \\ (?P12(p := P1 p)(p\\progress \\ (?P12(p := P1 p)) \\ (max j1 j2))) \\ (max j1 j2)\"\n by (auto intro!: progress_mono_gen simp: le1 rel_mapping_alt)\n finally show \"i \\ ...\" .\n qed\nnext\n case (Eq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Less _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (LessEq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Or \\1 \\2)\n from Or(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Or(1)[of S i] by auto\n moreover\n from Or(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Or(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Or \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (And \\1 \\2)\n from And(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using And(1)[of S i] by auto\n moreover\n from And(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using And(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.And \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (Ands l)\n show ?case proof (cases \"l = []\")\n case True\n then show ?thesis\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: if_splits simp: pred_mapping_alt)\n next\n case False\n then obtain \\ where \"\\ \\ set l\" by (cases l) auto\n from Ands.prems have \"\\\\\\set l. Formula.future_bounded \\\"\n by (simp add: list.pred_set)\n { fix \\\n assume \"\\ \\ set l\"\n with Ands.prems obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Ands(1)[of \\ S i]) (auto simp: list.pred_set)\n then have \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\Pj. ?P Pj\")\n by (intro exI[of _ \"(P, j)\"]) auto\n }\n then have \"\\\\\\set l. \\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\\\\\set l. \\Pj. ?P Pj \\\")\n by blast\n with Ands(1) Ands.prems False have \"\\Pjf. \\\\\\set l. ?P (Pjf \\) \\\"\n by (auto simp: Ball_def intro: choice)\n then obtain Pjf where Pjf: \"\\\\\\set l. ?P (Pjf \\) \\\" ..\n define Pf where \"Pf = fst o Pjf\"\n define jf where \"jf = snd o Pjf\"\n have *: \"dom (Pf \\) = S\" \"range_mapping i (jf \\) (Pf \\)\" \"i \\ progress \\ (Pf \\) \\ (jf \\)\"\n if \"\\ \\ set l\" for \\\n using Pjf[THEN bspec, OF that] unfolding Pf_def jf_def by auto\n with False show ?thesis\n unfolding progress.simps eq_False[THEN iffD2, OF False] if_False\n by ((subst Min_ge_iff; simp add: False),\n intro exI[where x=\"MAX \\\\set l. jf \\\"] exI[where x=\"Max_mapping (Pf ` set l)\"]\n conjI ballI order.trans[OF *(3) progress_mono_gen] Max_mapping_coboundedI)\n (auto simp: False *[OF \\\\ \\ set l\\] \\\\ \\ set l\\)\n qed\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n then obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Prev(1)) (auto simp: pred_mapping_alt dom_def)\n with Prev(2) have\n \"dom P = S \\ range_mapping i (max i j) P \\ i \\ progress \\ P (formula.Prev I \\) (max i j)\"\n by (auto simp: le_Suc_eq max_def pred_mapping_alt split: if_splits\n elim: order.trans[OF _ progress_mono])\n then show ?case by blast\nnext\n case (Next I \\)\n then obtain P j where \"dom P = S\" \"range_mapping (Suc i) j P\" \"Suc i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Next(1)) (auto simp: pred_mapping_alt dom_def)\n then show ?case\n by (intro exI[of _ P] exI[of _ j]) (auto 0 3 simp: pred_mapping_alt dom_def)\nnext\n case (Since \\1 I \\2)\n from Since(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Since(1)[of S i] by auto\n moreover\n from Since(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Since(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Since \\1 I \\2) (max j1 j2)\"\n by (auto elim!: order.trans[OF _ progress_mono_gen] simp: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"])\n (auto elim!: pred_mapping_le intro: max_mapping_cobounded1)\nnext\n case (Until \\1 I \\2)\n from Until.prems obtain m where \"\\ memR I m\"\n by (auto simp: bounded_memR)\n then obtain i' where \"i < i'\" and 1: \"\\ memR I (\\ \\ i' - \\ \\ i)\"\n using ex_le_\\[where x=\"\\ \\ i + m\" and s=\\ and i=\"Suc i\"]\n by atomize_elim (auto simp add: less_eq_Suc_le memR_antimono)\n from Until.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (Suc i') j1 P1\" \"Suc i' \\ progress \\ P1 \\1 j1\"\n by (atomize_elim, intro Until(1)) (auto simp: pred_mapping_alt dom_def)\n from Until.prems obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping (Suc i') j2 P2\" \"Suc i' \\ progress \\ P2 \\2 j2\"\n by (atomize_elim, intro Until(2)) (auto simp: pred_mapping_alt dom_def)\n let ?P12 = \"max_mapping P1 P2\"\n have \"i \\ progress \\ ?P12 (Formula.Until \\1 I \\2) (max j1 j2)\"\n unfolding progress.simps\n proof (intro cInf_greatest, goal_cases nonempty greatest)\n case nonempty\n then show ?case\n by (auto simp: trans_le_add1[OF \\_mono] intro!: exI[of _ \"max j1 j2\"])\n next\n case (greatest x)\n from P1(2,3) have \"i' < j1\"\n by (auto simp: less_eq_Suc_le intro!: progress_le_gen elim!: order.trans pred_mapping_mono_strong)\n then have \"i' < max j1 j2\" by simp\n have \"progress \\ P1 \\1 j1 \\ progress \\ ?P12 \\1 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded1)\n moreover have \"progress \\ P2 \\2 j2 \\ progress \\ ?P12 \\2 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded2)\n ultimately have \"i' \\ min (progress \\ ?P12 \\1 (max j1 j2)) (progress \\ ?P12 \\2 (max j1 j2))\"\n using P1(3) P2(3) by simp\n with greatest \\i' < max j1 j2\\ have \"memR I (\\ \\ i' - \\ \\ x)\"\n by simp\n with 1 have \"\\ \\ i < \\ \\ x\"\n by (auto 0 3 elim: contrapos_np)\n then show ?case by (auto dest!: less_\\D)\n qed\n with P1 P2 \\i < i'\\ show ?case\n by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) (auto simp: range_mapping_relax)\nnext\n case (MatchP I r)\n then show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchP.prems show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"] exI[of _ i])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set)\n next\n case False\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj))\"\n let ?pickP = \"fst o pick\" let ?pickj = \"snd o pick\"\n from MatchP have pick: \"\\ \\ regex.atms r \\ dom (?pickP \\) = S \\\n range_mapping i (?pickj \\) (?pickP \\) \\ i \\ progress \\ (?pickP \\) \\ (?pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n with False show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"Max_mapping (?pickP ` regex.atms r)\"] exI[of _ \"Max (?pickj ` regex.atms r)\"])\n (auto simp: Max_mapping_coboundedI\n order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen])\n qed\nnext\n case (MatchF I r)\n from MatchF.prems obtain m where \"\\ memR I m\"\n by (auto simp: bounded_memR)\n then obtain i' where \"i < i'\" and i': \"\\ memR I (\\ \\ i' - \\ \\ i)\"\n using ex_le_\\[where x=\"\\ \\ i + m\" and s=\\ and i=\"Suc i\"]\n by atomize_elim (auto simp add: less_eq_Suc_le memR_antimono)\n have ix: \"i \\ x\" if \"memR I (\\ \\ i' - \\ \\ x)\" for x\n using i' less_\\D[of \\ i x] that by (auto 0 3 simp: diff_le_mono2 elim: contrapos_np)\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchF.prems ix show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some (Suc i') else None\"] exI[of _ \"Suc i'\"])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set add.commute less_Suc_eq\n intro!: cInf_greatest dest!: spec[of _ i'] less_imp_le[THEN \\_mono, of _ i' \\])\n next\n case False\n then obtain \\ where \\: \"\\ \\ regex.atms r\" by auto\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj))\"\n define pickP where \"pickP = fst o pick\" define pickj where \"pickj = snd o pick\"\n from MatchF have pick: \"\\ \\ regex.atms r \\ dom (pickP \\) = S \\\n range_mapping (Suc i') (pickj \\) (pickP \\) \\ Suc i' \\ progress \\ (pickP \\) \\ (pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set pickj_def pickP_def\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n let ?P = \"Max_mapping (pickP ` regex.atms r)\" let ?j = \"Max (pickj ` regex.atms r)\"\n from pick[OF \\] False \\ have \"Suc i' \\ ?j\"\n by (intro order_trans[OF pick[THEN conjunct2, THEN conjunct2], OF \\] order_trans[OF progress_le_gen])\n (auto simp: Max_ge_iff dest: range_mapping_relax[of _ _ _ 0, OF _ _ order_refl, simplified])\n moreover\n note i' ix\n moreover\n from MatchF.prems have \"Regex.pred_regex Formula.future_bounded r\"\n by auto\n ultimately show ?thesis using \\_mono[of _ ?j \\] less_\\D[of \\ i] pick False\n by (intro exI[of _ \"?j\"] exI[of _ \"?P\"])\n (auto 0 3 intro!: cInf_greatest\n order_trans[OF le_SucI[OF order_refl] order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen]]\n range_mapping_Max_mapping[OF _ _ ballI[OF range_mapping_relax[of \"Suc i'\" _ _ i, OF _ _ order_refl]]]\n simp: ac_simps Suc_le_eq trans_le_add2 Max_mapping_coboundedI progress_regex_def\n dest: spec[of _ \"i'\"] spec[of _ ?j])\n qed\nqed (auto split: option.splits)\n\nlemma progress_ge: \"Formula.future_bounded \\ \\ \\j. i \\ progress \\ Map.empty \\ j\"\n using progress_ge_gen[of \\ \"{}\" i \\]\n by auto\n\n\n\nlemma progress_time_conv:\n assumes \"\\i \\ i = \\ \\' i\"\n shows \"progress \\ P \\ j = progress \\' P \\ j\"\n using assms proof (induction \\ arbitrary: P)\n case (Until \\1 I \\2)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with Until show ?case\n proof (cases \"bounded I\")\n case True\n then show ?thesis\n proof (cases \"j\")\n case (Suc n)\n with * Until show ?thesis\n using \\_mono[THEN trans_le_add1]\n by (auto 6 0\n intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=n] cInf_restrict_nat[symmetric, where x=n]])\n qed simp\n qed (simp add: bounded_memR)\nnext\n case (MatchF I r)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with MatchF show ?case using \\_mono[THEN trans_le_add1]\n by (cases \"bounded I\"; cases j)\n ((auto 6 0 simp: progress_le_gen progress_regex_def intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=\"j-1\"] cInf_restrict_nat[symmetric, where x=\"j-1\"]]) [])+\nqed (auto simp: progress_regex_def)\n\nlemma Inf_UNIV_nat: \"(Inf UNIV :: nat) = 0\"\n by (simp add: cInf_eq_minimum)\n\nlemma progress_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"progress \\ P \\ (plen \\) = progress \\' P \\ (plen \\)\"\n using assms by (auto intro: progress_time_conv \\_prefix_conv)\n\nlemma bounded_rtranclp_mono:\n fixes n :: \"'x :: linorder\"\n assumes \"\\i j. R i j \\ j < n \\ S i j\" \"\\i j. R i j \\ i \\ j\"\n shows \"rtranclp R i j \\ j < n \\ rtranclp S i j\"\nproof (induct rule: rtranclp_induct)\n case (step y z)\n then show ?case\n using assms(1,2)[of y z]\n by (auto elim!: rtrancl_into_rtrancl[to_pred, rotated])\nqed auto\n\nlemma sat_prefix_conv_gen:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ P \\ (plen \\) \\ dom V = dom V' \\ dom P = dom V \\\n pred_mapping (\\x. x \\ plen \\) P \\\n (\\p i \\. p \\ dom V \\ i < the (P p) \\ the (V p) i = the (V' p) i) \\\n Formula.sat \\ V v i \\ \\ Formula.sat \\' V' v i \\\"\nproof (induction \\ arbitrary: P V V' v i)\n case (Pred e ts)\n from Pred.prems(1,4) have \"i < plen \\\"\n by (blast intro!: order.strict_trans2 progress_le_gen)\n show ?case proof (cases \"V e\")\n case None\n then have \"V' e = None\" using \\dom V = dom V'\\ by auto\n with None \\_prefix_conv[OF assms(1,2) \\i < plen \\\\] show ?thesis by simp\n next\n case (Some a)\n obtain a' where \"V' e = Some a'\" using Some \\dom V = dom V'\\ by auto\n then have \"i < the (P e)\"\n using Pred.prems(1-3) by (auto split: option.splits)\n then have \"the (V e) i = the (V' e) i\"\n using Some by (intro Pred.prems(5)) (simp_all add: domI)\n with Some \\V' e = Some a'\\ show ?thesis by simp\n qed\nnext\n case (Let p \\ \\)\n let ?V = \"\\V \\. (V(p \\ \\i. {v. length v = Formula.nfv \\ \\ Formula.sat \\ V v i \\}))\"\n show ?case unfolding sat.simps proof (rule Let.IH(2))\n from Let.prems show \"i < progress \\ (P(p \\ progress \\ P \\ (plen \\))) \\ (plen \\)\"\n by simp\n from Let.prems show \"dom (?V V \\) = dom (?V V' \\')\"\n by simp\n from Let.prems show \"dom (P(p \\ progress \\ P \\ (plen \\))) = dom (?V V \\)\"\n by simp\n from Let.prems show \"pred_mapping (\\x. x \\ plen \\) (P(p \\ progress \\ P \\ (plen \\)))\"\n by (auto intro!: pred_mapping_map_upd elim!: progress_le_gen)\n next\n fix p' i \\'\n assume 1: \"p' \\ dom (?V V \\)\" and 2: \"i < the ((P(p \\ progress \\ P \\ (plen \\))) p')\"\n show \"the (?V V \\ p') i = the (?V V' \\' p') i\" proof (cases \"p' = p\")\n case True\n with Let 2 show ?thesis by auto\n next\n case False\n with 1 2 show ?thesis by (auto intro!: Let.prems(5))\n qed\n qed\nnext\n case (Eq t1 t2)\n show ?case by simp\nnext\n case (Neg \\)\n then show ?case by simp\nnext\n case (Or \\1 \\2)\n then show ?case by auto\nnext\n case (Ands l)\n from Ands.prems have \"\\\\\\set l. i < progress \\ P \\ (plen \\)\"\n by (cases l) simp_all\n with Ands show ?case unfolding sat_Ands by blast\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n with \\_prefix_conv[OF assms(1,2)] show ?case\n by (cases i) (auto split: if_splits)\nnext\n case (Next I \\)\n then have \"Suc i < plen \\\"\n by (auto intro: order.strict_trans2[OF _ progress_le_gen[of _ P \\ \\]])\n with Next.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong Next) auto\nnext\n case (Since \\1 I \\2)\n then have \"i < plen \\\"\n by (auto elim!: order.strict_trans2[OF _ progress_le_gen])\n with Since.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong ex_cong ball_cong Since) auto\nnext\n case (Until \\1 I \\2)\n from Until.prems have [simp]: \"bounded I\"\n by (cases \"bounded I\") (auto simp: bounded_memR Inf_UNIV_nat)\n from Until.prems obtain j where \"\\ memR I (\\ \\ j - \\ \\ i)\"\n \"j \\ progress \\ P \\1 (plen \\)\" \"j \\ progress \\ P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < progress \\ P \\1 (plen \\)\" and 2: \"k < progress \\ P \\2 (plen \\)\"\n if \"memR I (\\ \\ k - \\ \\ i)\" for k\n using that\n by (auto 0 3 elim!: order.strict_trans2[rotated] elim: contrapos_np intro!: less_\\D[of \\ k j])\n have 3: \"k < plen \\\" if \"memR I (\\ \\ k - \\ \\ i)\" for k\n using 1[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n\n from Until.prems have \"i < progress \\' P (Formula.Until \\1 I \\2) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by simp\n then obtain j where \"\\ memR I (\\ \\' j - \\ \\' i)\"\n \"j \\ progress \\' P \\1 (plen \\)\" \"j \\ progress \\' P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"k < progress \\ P \\1 (plen \\)\" and 21: \"k < progress \\ P \\2 (plen \\)\"\n if \"memR I (\\ \\' k - \\ \\' i)\" for k\n unfolding progress_prefix_conv[OF assms(1,2)]\n using that\n by (auto 0 3 elim!: order.strict_trans2[rotated] elim: contrapos_np intro!: less_\\D[of \\' k j])\n have 31: \"k < plen \\\" if \"memR I (\\ \\' k - \\ \\' i)\" for k\n using 11[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n thm order.trans[OF _ progress_le_gen]\n\n show ?case unfolding sat.simps\n proof ((intro ex_cong iffI; elim conjE), goal_cases LR RL)\n case (LR j)\n with Until.IH(1)[OF 1] Until.IH(2)[OF 2] \\_prefix_conv[OF assms(1,2) 3] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute memR_antimono dest: less_imp_le order.trans[OF \\_mono, rotated])\n next\n case (RL j)\n with Until.IH(1)[OF 11] Until.IH(2)[OF 21] \\_prefix_conv[OF assms(1,2) 31] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute memR_antimono dest: less_imp_le order.trans[OF \\_mono, rotated])\n qed\nnext\n case (MatchP I r)\n then have \"i < plen \\\"\n by (force simp: pred_mapping_alt elim!: order.strict_trans2[OF _ progress_le_gen])\n with MatchP.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro ex_cong conj_cong match_cong_strong MatchP) (auto simp: progress_regex_def split: if_splits)\nnext\n case (MatchF I r)\n from MatchF.prems have [simp]: \"bounded I\"\n by (cases \"bounded I\") (auto simp: bounded_memR Inf_UNIV_nat)\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n from MatchF.prems(1) obtain j where \"\\ memR I (\\ \\ j - \\ \\ i)\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < plen \\\" if \"memR I (\\ \\ k - \\ \\ i)\" for k\n by (meson \\_mono diff_le_mono memR_antimono not_le_imp_less that)\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n then obtain j where \"\\ memR I (\\ \\' j - \\ \\' i)\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 2: \"k < plen \\\" if \"memR I (\\ \\' k - \\ \\' i)\" for k\n by (meson \\_mono diff_le_mono memR_antimono not_le_imp_less that)\n from MatchF.prems(1,4) True show ?thesis\n unfolding sat.simps conj_commute[of \"memL _ _\"]\n proof (intro ex_cong conj_cong match_cong_strong, goal_cases memL memR sat)\n case (memL j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 1, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (memR j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n qed auto\n next\n case False\n from MatchF.prems(1) False obtain j where \"\\ memR I (\\ \\ j - \\ \\ i)\" \"(\\x\\regex.atms r. j \\ progress \\ P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"memR I (\\ \\ k - \\ \\ i)\" for k \\\n using that\n by (auto 0 3 elim!: contrapos_np[of _ \"_ < _\"] simp: diff_le_mono)\n then have 2: \"k < plen \\\" if \"memR I (\\ \\ k - \\ \\ i)\" \"regex.atms r \\ {}\" for k\n using that\n by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n with False obtain j where \"\\ memR I (\\ \\' j - \\ \\' i)\" \"(\\x\\regex.atms r. j \\ progress \\' P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"memR I (\\ \\' k - \\ \\' i)\" for k \\\n using that using progress_prefix_conv[OF assms(1,2)]\n by (auto 0 3 elim!: contrapos_np[of _ \"_ < _\"] simp: diff_le_mono)\n have 21: \"k < plen \\\" if \"memR I (\\ \\' k - \\ \\' i)\" for k\n using 11[OF that(1)] False by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n show ?thesis unfolding sat.simps conj_commute[of \"memL _ _\"]\n proof ((intro ex_cong conj_cong match_cong_strong MatchF(1)[OF _ _ MatchF(3-6)]; assumption?), goal_cases memR memL progress)\n case (memR j)\n with False show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (memL j)\n with False show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 21, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (progress j k z)\n with False show ?case\n by (elim 1[rotated])\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto simp: diff_le_mono memR_antimono elim!: contrapos_np[of _ False])\n qed\n qed\nqed auto\n\nlemma sat_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ Map.empty \\ (plen \\) \\\n Formula.sat \\ Map.empty v i \\ \\ Formula.sat \\' Map.empty v i \\\"\n by (erule sat_prefix_conv_gen[OF assms]) auto\n\nlemma progress_remove_neg[simp]: \"progress \\ P (remove_neg \\) j = progress \\ P \\ j\"\n by (cases \\) simp_all\n\nlemma safe_progress_get_and: \"safe_formula \\ \\\n Min ((\\\\. progress \\ P \\ j) ` set (get_and_list \\)) = progress \\ P \\ j\"\n by (induction \\ rule: get_and_list.induct) auto\n\nlemma progress_convert_multiway: \"safe_formula \\ \\ progress \\ P (convert_multiway \\) j = progress \\ P \\ j\"\nproof (induction \\ arbitrary: P rule: safe_formula_induct)\n case (And_safe \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ \\)\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (get_and_list ?c\\ @ get_and_list ?c\\)\"\n using And_safe by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_safe.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (And_Not \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ (Formula.Neg \\))\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (Formula.Neg ?c\\ # get_and_list ?c\\)\"\n using And_Not by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_Not.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (Ands l)\n then show ?case\n unfolding progress.simps convert_multiway.simps\n by (force simp: list.pred_set convert_multiway_remove_neg intro!: Sup.SUP_cong)\nnext\n case (MatchP I r)\n from MatchP show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nnext\n case (MatchF I r)\n from MatchF show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] arg_cong[of _ _ Inf] arg_cong[of _ _ \"(\\) _\"]\n image_cong Collect_cong all_cong1 imp_cong conj_cong image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nqed auto\n\n\nsubsection \\Specification\\\n\ndefinition pprogress :: \"Formula.formula \\ Formula.prefix \\ nat\" where\n \"pprogress \\ \\ = (THE n. \\\\. prefix_of \\ \\ \\ progress \\ Map.empty \\ (plen \\) = n)\"\n\nlemma pprogress_eq: \"prefix_of \\ \\ \\ pprogress \\ \\ = progress \\ Map.empty \\ (plen \\)\"\n unfolding pprogress_def using progress_prefix_conv\n by blast\n\nlocale future_bounded_mfodl =\n fixes \\ :: Formula.formula\n assumes future_bounded: \"Formula.future_bounded \\\"\n\nsublocale future_bounded_mfodl \\ sliceable_timed_progress \"Formula.nfv \\\" \"Formula.fv \\\" \"relevant_events \\\"\n \"\\\\ v i. Formula.sat \\ Map.empty v i \\\" \"pprogress \\\"\nproof (unfold_locales, goal_cases)\n case (1 x)\n then show ?case by (simp add: fvi_less_nfv)\nnext\n case (2 v v' \\ i)\n then show ?case by (simp cong: sat_fv_cong[rule_format])\nnext\n case (3 v S \\ i)\n then show ?case\n using sat_slice_iff[symmetric] by simp\nnext\n case (4 \\ \\')\n moreover obtain \\ where \"prefix_of \\' \\\"\n using ex_prefix_of ..\n moreover have \"prefix_of \\ \\\"\n using prefix_of_antimono[OF \\\\ \\ \\'\\ \\prefix_of \\' \\\\] .\n ultimately show ?case\n by (simp add: pprogress_eq plen_mono progress_mono)\nnext\n case (5 \\ x)\n obtain j where \"x \\ progress \\ Map.empty \\ j\"\n using future_bounded progress_ge by blast\n then have \"x \\ pprogress \\ (take_prefix j \\)\"\n by (simp add: pprogress_eq[of _ \\])\n then show ?case by force\nnext\n case (6 \\ \\ \\' i v)\n then have \"i < progress \\ Map.empty \\ (plen \\)\"\n by (simp add: pprogress_eq)\n with 6 show ?case\n using sat_prefix_conv by blast\nnext\n case (7 \\ \\')\n then have \"plen \\ = plen \\'\"\n by transfer (simp add: list_eq_iff_nth_eq)\n moreover obtain \\ \\' where \"prefix_of \\ \\\" \"prefix_of \\' \\'\"\n using ex_prefix_of by blast+\n moreover have \"\\i < plen \\. \\ \\ i = \\ \\' i\"\n using 7 calculation\n by transfer (simp add: list_eq_iff_nth_eq)\n ultimately show ?case\n by (simp add: pprogress_eq progress_time_conv)\nqed\n\nlocale verimon_spec =\n fixes \\ :: Formula.formula\n assumes monitorable: \"mmonitorable \\\"\n\nsublocale verimon_spec \\ future_bounded_mfodl\n using monitorable by unfold_locales (simp add: mmonitorable_def)\n\n\nsubsection \\Correctness\\\n\nsubsubsection \\Invariants\\\n\ndefinition wf_mbuf2 :: \"nat \\ nat \\ nat \\ (nat \\ event_data table \\ bool) \\ (nat \\ event_data table \\ bool) \\\n event_data mbuf2 \\ bool\" where\n \"wf_mbuf2 i ja jb P Q buf \\ i \\ ja \\ i \\ jb \\ (case buf of (xs, ys) \\\n list_all2 P [i.. list_all2 Q [i.. 'b \\ 'c \\ bool) \\ 'a list \\ 'b list \\ 'c list \\ bool\" for P :: \"('a \\ 'b \\ 'c \\ bool)\" where\n \"list_all3 P [] [] []\"\n| \"P a1 a2 a3 \\ list_all3 P q1 q2 q3 \\ list_all3 P (a1 # q1) (a2 # q2) (a3 # q3)\"\n\nlemma list_all3_list_all2D: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma list_all2_list_all3I: \"length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs \\\n list_all3 P xs ys zs\"\n by (induct xs ys arbitrary: zs rule: list_induct2)\n (auto simp: list_all2_Cons1 intro: list_all3.intros)\n\nlemma list_all3_list_all2_eq: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n using list_all2_list_all3I list_all3_list_all2D by blast\n\nlemma list_all3_mapD: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n by (induct \"map f xs\" \"map g ys\" \"map h zs\" arbitrary: xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_mapI: \"list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs \\\n list_all3 P (map f xs) (map g ys) (map h zs)\"\n by (induct xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_map_iff: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n using list_all3_mapD list_all3_mapI by blast\n\nlemmas list_all3_map =\n list_all3_map_iff[where g=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and g=id, unfolded list.map_id id_apply]\n\nlemma list_all3_conv_all_nth:\n \"list_all3 P xs ys zs =\n (length xs = length ys \\ length ys = length zs \\ (\\i < length xs. P (xs!i) (ys!i) (zs!i)))\"\n by (auto simp add: list_all3_list_all2_eq list_all2_conv_all_nth)\n\nlemma list_all3_refl [intro?]:\n \"(\\x. x \\ set xs \\ P x x x) \\ list_all3 P xs xs xs\"\n by (simp add: list_all3_conv_all_nth)\n\ndefinition wf_mbufn :: \"nat \\ nat list \\ (nat \\ event_data table \\ bool) list \\ event_data mbufn \\ bool\" where\n \"wf_mbufn i js Ps buf \\ list_all3 (\\P j xs. i \\ j \\ list_all2 P [i.. _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula \\ Formula.formula \\ event_data mbuf2 \\ bool\" where\n \"wf_mbuf2' \\ P V j n R \\ \\ buf \\ wf_mbuf2 (min (progress \\ P \\ j) (progress \\ P \\ j))\n (progress \\ P \\ j) (progress \\ P \\ j)\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) buf\"\n\ndefinition wf_mbufn' :: \"Formula.trace \\ _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula Regex.regex \\ event_data mbufn \\ bool\" where\n \"wf_mbufn' \\ P V j n R r buf \\ (case to_mregex r of (mr, \\s) \\\n wf_mbufn (progress_regex \\ P r j) (map (\\\\. progress \\ P \\ j) \\s)\n (map (\\\\ i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n buf)\"\n\nlemma wf_mbuf2'_UNIV_alt: \"wf_mbuf2' \\ P V j n UNIV \\ \\ buf \\ (case buf of (xs, ys) \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] xs \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] ys)\"\n unfolding wf_mbuf2'_def wf_mbuf2_def\n by (simp add: mem_restr_UNIV[THEN eqTrueI, abs_def] split: prod.split)\n\ndefinition wf_ts :: \"Formula.trace \\ _ \\ nat \\ Formula.formula \\ Formula.formula \\ ts list \\ bool\" where\n \"wf_ts \\ P j \\ \\ ts \\ list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j).. _ \\ nat \\ Formula.formula Regex.regex \\ ts list \\ bool\" where\n \"wf_ts_regex \\ P j r ts \\ list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j.. I \\ \\ Formula.Since (if pos then \\ else Formula.Neg \\) I \\\"\n\ndefinition \"agg_b args = (case args_agg args of None \\ 0 | Some aggargs \\ aggargs_b aggargs)\"\ndefinition \"agg_n args = (case args_agg args of None \\ args_n args | Some aggargs \\ aggargs_n aggargs)\"\n\ndefinition (in msaux) wf_since_aux :: \"Formula.trace \\ _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'msaux \\ nat \\ bool\" where\n \"wf_since_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n valid_aggargs (args_n args) (Formula.fv \\) (args_agg args) \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR (args_ivl args) (\\ \\ (ne - 1) - t) \\ (\\i. \\ \\ i = t) \\\n qtable (args_n args) (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR (args_ivl args) (\\ \\ (ne - 1) - t) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n\ndefinition wf_matchP_aux :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data mr\\aux \\ nat \\ bool\" where\n \"wf_matchP_aux \\ V n R I r aux ne \\ sorted_wrt (\\x y. fst x > fst y) aux \\\n (\\t X. (t, X) \\ set aux \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ memR I (\\ \\ (ne-1) - t) \\ (\\i. \\ \\ i = t) \\\n (case to_mregex r of (mr, \\s) \\\n (\\ms \\ RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1)\n (Formula.MatchP (point (\\ \\ (ne-1) - t)) (from_mregex ms \\s)))\n (lookup X ms)))) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ memR I (\\ \\ (ne-1) - t) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set aux))\"\n\nlemma qtable_mem_restr_UNIV: \"qtable n A(mem_restr UNIV) Q X = wf_table n A Q X\"\n unfolding qtable_def by auto\n\nlemma (in msaux) wf_since_aux_UNIV_alt:\n \"wf_since_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n valid_aggargs (args_n args) (Formula.fv \\) (args_agg args) \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR (args_ivl args) (\\ \\ (ne - 1) - t) \\ (\\i. \\ \\ i = t) \\\n wf_table (args_n args) (Formula.fv \\)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR (args_ivl args) (\\ \\ (ne - 1) - t) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n unfolding wf_since_aux_def qtable_mem_restr_UNIV ..\n\ndefinition wf_until_auxlist :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\ bool \\\n Formula.formula \\ \\ \\ Formula.formula \\ event_data muaux \\ nat \\ bool\" where\n \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. if pos then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length auxlist \\ mem I ((\\ \\ j - \\ \\ i)) \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) r2)\n auxlist [ne.. _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'muaux \\ nat \\ bool\" where\n \"wf_until_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n valid_aggargs (args_n args) (Formula.fv \\) (args_agg args) \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n wf_until_auxlist \\ V (args_n args) R (args_pos args) \\ (args_ivl args) \\ auxlist ne)\"\n\nlemma (in muaux) wf_until_aux_UNIV_alt:\n \"wf_until_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n valid_aggargs (args_n args) (Formula.fv \\) (args_agg args) \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n wf_table (args_n args) (Formula.fv \\) (\\v. if (args_pos args)\n then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n wf_table (args_n args) (Formula.fv \\) (\\v. \\j. i \\ j \\ j < ne + length auxlist \\ mem (args_ivl args) (\\ \\ j - \\ \\ i) \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\)) r2)\n auxlist [ne.. _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data ml\\aux \\ nat \\ nat \\ bool\" where\n \"wf_matchF_aux \\ V n R I r aux ne k \\ (case to_mregex r of (mr, \\s) \\\n list_all2 (\\x i. case x of (t, rels, rel) \\ t = \\ \\ i \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) i \\)) \\s rels \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length aux + k \\ mem I ((\\ \\ j - \\ \\ i)) \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel)\n aux [ne.. V n R I r st i =\n (case st of (aux, Y) \\ aux \\ [] \\ wf_matchF_aux \\ V n R I r aux i 0 \\\n (case to_mregex r of (mr, \\s) \\ \\ms \\ LPDs mr.\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux - 1)) (lookup Y ms)))\"\n\ndefinition lift_envs' :: \"nat \\ event_data list set \\ event_data list set\" where\n \"lift_envs' b R = (\\(xs,ys). xs @ ys) ` ({xs. length xs = b} \\ R)\"\n\nfun formula_of_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ Formula.formula\" where\n \"formula_of_constraint (t1, True, MEq, t2) = Formula.Eq t1 t2\"\n| \"formula_of_constraint (t1, True, MLess, t2) = Formula.Less t1 t2\"\n| \"formula_of_constraint (t1, True, MLessEq, t2) = Formula.LessEq t1 t2\"\n| \"formula_of_constraint (t1, False, MEq, t2) = Formula.Neg (Formula.Eq t1 t2)\"\n| \"formula_of_constraint (t1, False, MLess, t2) = Formula.Neg (Formula.Less t1 t2)\"\n| \"formula_of_constraint (t1, False, MLessEq, t2) = Formula.Neg (Formula.LessEq t1 t2)\"\n\ninductive (in maux) wf_mformula :: \"Formula.trace \\ nat \\ _ \\ _ \\\n nat \\ event_data list set \\ ('msaux, 'muaux) mformula \\ Formula.formula \\ bool\"\n for \\ j where\n Eq: \"is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1. x < n \\ \\x\\Formula.fv_trm t2. x < n \\\n wf_mformula \\ j P V n R (MRel (eq_rel n t1 t2)) (Formula.Eq t1 t2)\"\n | neq_Var: \"x < n \\\n wf_mformula \\ j P V n R (MRel empty_table) (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var x)))\"\n | Pred: \"\\x\\Formula.fv (Formula.Pred e ts). x < n \\\n \\t\\set ts. Formula.is_Var t \\ Formula.is_Const t \\\n wf_mformula \\ j P V n R (MPred e ts) (Formula.Pred e ts)\"\n | Let: \"wf_mformula \\ j P V m UNIV \\ \\' \\\n wf_mformula \\ j (P(p \\ progress \\ P \\' j))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\'})) n R \\ \\' \\\n {0.. Formula.fv \\' \\ b \\ m \\ m = Formula.nfv \\' \\\n wf_mformula \\ j P V n R (MLet p m \\ \\) (Formula.Let p \\' \\')\"\n | And: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if pos then \\ = Formula.And \\' \\'\n else \\ = Formula.And \\' (Formula.Neg \\') \\ Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MAnd (fv \\') \\ pos (fv \\') \\ buf) \\\"\n | AndAssign: \"wf_mformula \\ j P V n R \\ \\' \\\n x < n \\ x \\ Formula.fv \\' \\ Formula.fv_trm t \\ Formula.fv \\' \\ (x, t) = conf \\\n \\' = Formula.Eq (Formula.Var x) t \\ \\' = Formula.Eq t (Formula.Var x) \\\n wf_mformula \\ j P V n R (MAndAssign \\ conf) (Formula.And \\' \\')\"\n | AndRel: \"wf_mformula \\ j P V n R \\ \\' \\\n \\' = formula_of_constraint conf \\\n (let (t1, _, _, t2) = conf in Formula.fv_trm t1 \\ Formula.fv_trm t2 \\ Formula.fv \\') \\\n wf_mformula \\ j P V n R (MAndRel \\ conf) (Formula.And \\' \\')\"\n | Ands: \"list_all2 (\\\\ \\'. wf_mformula \\ j P V n R \\ \\') l (l_pos @ map remove_neg l_neg) \\\n wf_mbufn (progress \\ P (Formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (l_pos @ map remove_neg l_neg)) (map (\\\\ i.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (l_pos @ map remove_neg l_neg)) buf \\\n (l_pos, l_neg) = partition safe_formula l' \\\n l_pos \\ [] \\\n list_all safe_formula (map remove_neg l_neg) \\\n A_pos = map fv l_pos \\\n A_neg = map fv l_neg \\\n \\(set A_neg) \\ \\(set A_pos) \\\n wf_mformula \\ j P V n R (MAnds A_pos A_neg l buf) (Formula.Ands l')\"\n | Or: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n Formula.fv \\' = Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MOr \\ \\ buf) (Formula.Or \\' \\')\"\n | Neg: \"wf_mformula \\ j P V n R \\ \\' \\ Formula.fv \\' = {} \\\n wf_mformula \\ j P V n R (MNeg \\) (Formula.Neg \\')\"\n | Exists: \"wf_mformula \\ j P V (Suc n) (lift_envs R) \\ \\' \\\n wf_mformula \\ j P V n R (MExists \\) (Formula.Exists \\')\"\n | Agg: \"wf_mformula \\ j P V (b + n) (lift_envs' b R) \\ \\' \\\n y < n \\\n y + b \\ Formula.fv \\' \\\n {0.. Formula.fv \\' \\\n Formula.fv_trm f \\ Formula.fv \\' \\\n g0 = (Formula.fv \\' \\ {0..\n wf_mformula \\ j P V n R (MAgg g0 y \\ b f \\) (Formula.Agg y \\ b f \\')\"\n | Prev: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ j = 0 \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [min (progress \\ P \\' j) (j-1).. P \\' j] buf \\\n list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\' j) (j-1)..\n wf_mformula \\ j P V n R (MPrev I \\ first buf nts) (Formula.Prev I \\')\"\n | Next: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ progress \\ P \\' j = 0 \\\n list_all2 (\\i t. t = \\ \\ i) [progress \\ P \\' j - 1..\n wf_mformula \\ j P V n R (MNext I \\ first nts) (Formula.Next I \\')\"\n | Since: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n mem_restr R = mem_restr (lift_envs' (agg_b args) R') \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n wf_since_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Since \\'' I \\') j) \\\n wf_mformula \\ j P V (agg_n args) R' (MSince args \\ \\ buf nts aux) (packagg args (Formula.Since \\'' I \\'))\"\n | Until: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n mem_restr R = mem_restr (lift_envs' (agg_b args) R') \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n t = (if j = 0 then 0 else \\ \\ (min (j - 1) (min (progress \\ P \\' j) (progress \\ P \\' j)))) \\\n wf_until_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Until \\'' I \\') j) \\\n progress \\ P (Formula.Until \\'' I \\') j + length_muaux args aux = min (progress \\ P \\' j) (progress \\ P \\' j) \\\n wf_mformula \\ j P V (agg_n args) R' (MUntil args \\ \\ buf nts t aux) (packagg args (Formula.Until \\'' I \\'))\"\n | MatchP: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (RPDs mr) \\\n safe_regex Past Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j) \\\n wf_mformula \\ j P V n R (MMatchP I mr mrs \\s buf nts aux) (Formula.MatchP I r)\"\n | MatchF: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (LPDs mr) \\\n safe_regex Futu Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n t = (if j = 0 then 0 else \\ \\ (min (j - 1) (progress_regex \\ P r j))) \\\n wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j \\\n wf_mformula \\ j P V n R (MMatchF I mr mrs \\s buf nts t aux) (Formula.MatchF I r)\"\n\ndefinition (in maux) wf_mstate :: \"Formula.formula \\ Formula.prefix \\ event_data list set \\ ('msaux, 'muaux) mstate \\ bool\" where\n \"wf_mstate \\ \\ R st \\ mstate_n st = Formula.nfv \\ \\ (\\\\. prefix_of \\ \\ \\\n mstate_i st = progress \\ Map.empty \\ (plen \\) \\\n wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\)\"\n\n\nsubsubsection \\Initialisation\\\n\n\nlemma wf_mbuf2'_0: \"pred_mapping (\\x. x = 0) P \\ wf_mbuf2' \\ P V 0 n R \\ \\ ([], [])\"\n unfolding wf_mbuf2'_def wf_mbuf2_def by simp\n\nlemma wf_mbufn'_0: \"to_mregex r = (mr, \\s) \\ pred_mapping (\\x. x = 0) P \\ wf_mbufn' \\ P V 0 n R r (replicate (length \\s) [])\"\n unfolding wf_mbufn'_def wf_mbufn_def map_replicate_const[symmetric]\n by (auto simp: list_all3_map intro: list_all3_refl simp: Min_eq_iff progress_regex_def)\n\nlemma wf_ts_0: \"wf_ts \\ P 0 \\ \\ []\"\n unfolding wf_ts_def by simp\n\nlemma wf_ts_regex_0: \"wf_ts_regex \\ P 0 r []\"\n unfolding wf_ts_regex_def by simp\n\nlemma (in msaux) wf_since_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n valid_aggargs n (Formula.fv \\') agg \\\n wf_since_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b agg) \\' \\' (init_msaux (init_args I n (Formula.fv \\') (Formula.fv \\') b agg)) 0\"\n unfolding wf_since_aux_def\n by (auto intro!: valid_init_msaux) (simp add: init_args_def)\n\nlemma (in muaux) wf_until_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n valid_aggargs n (Formula.fv \\') agg \\\n wf_until_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b agg) \\' \\' (init_muaux (init_args I n (Formula.fv \\') (Formula.fv \\') b agg)) 0\"\n unfolding wf_until_aux_def wf_until_auxlist_def\n by (auto intro!: valid_init_muaux) (simp add: init_args_def)\n\nlemma wf_matchP_aux_Nil: \"wf_matchP_aux \\ V n R I r [] 0\"\n unfolding wf_matchP_aux_def by simp\n\nlemma wf_matchF_aux_Nil: \"wf_matchF_aux \\ V n R I r [] 0 k\"\n unfolding wf_matchF_aux_def by simp\n\nlemma fv_regex_alt: \"safe_regex m g r \\ Formula.fv_regex r = (\\\\ \\ atms r. Formula.fv \\)\"\n unfolding fv_regex_alt atms_def\n by (auto 0 3 dest: safe_regex_safe_formula)\n\nlemmas to_mregex_atms =\n to_mregex_ok[THEN conjunct1, THEN equalityD1, THEN set_mp, rotated]\n\nlemma (in maux) wf_minit0_op:\n assumes \"safe_formula \\\" \"fv \\ \\ fv \\\"\n \"wf_mformula \\ 0 P V n R (minit0 n \\) \\\" \"wf_mformula \\ 0 P V n R (minit0 n \\) \\\"\n \"args_type_restr \\ V n R \\ args\"\n \"valid_aggargs n (fv \\) (args_agg args)\"\n \"pred_mapping (\\x. x = 0) P\"\n \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n \"args = init_args I n (Formula.fv \\) (Formula.fv \\) b agg\"\n \"\\' = (if b then \\ else formula.Neg \\)\"\n \"safe_formula \\' \\ b\"\n \"(op = formula.Since \\ init = init_since) \\ (op = formula.Until \\ init = init_until)\"\n shows \"wf_mformula \\ 0 P V (agg_n args) R' (init minit0 n agg \\' I \\) (packagg args (op \\' I \\))\"\nproof -\n have args_props: \"args_n args = n\" \"args_pos args = b\" \"args_ivl args = I\"\n \"args_L args = fv \\\" \"args_R args = fv \\\" \"args_agg args = agg\"\n by (auto simp: assms(9) init_args_def agg_n_def agg_b_def packagg_def split: option.splits)\n have args_fold: \"b \\ init_args I n (Formula.fv \\) (Formula.fv \\) True agg = args\"\n \"\\b \\ init_args I n (Formula.fv \\) (Formula.fv \\) False agg = args\"\n using assms(9)\n by auto\n show ?thesis\n using assms(12)\n proof (rule disjE)\n assume \"op = formula.Since \\ init = init_since\"\n then show ?thesis\n using assms(1-8,10-11) valid_length_muaux[OF valid_init_muaux[OF assms(2)], of n agg I b, folded assms(9)]\n by (auto simp: init_since_def init_until_def args_fold args_props valid_aggargs_def simp del: progress_simps\n intro!: wf_mformula.Since[where ?args = \"args\", unfolded args_props] wf_mbuf2'_0 wf_ts_0\n wf_since_aux_Nil[where ?I = I and ?n = n and ?\\' = \\ and ?\\' = \\ and ?b = b and ?agg = agg, folded assms(9)])\n next\n assume \"op = formula.Until \\ init = init_until\"\n then show ?thesis\n using assms(1-8,10-11) valid_length_muaux[OF valid_init_muaux[OF assms(2)], of n agg I b, folded assms(9)]\n by (auto simp: init_since_def init_until_def args_fold args_props valid_aggargs_def simp del: progress_simps\n intro!: wf_mformula.Until[where ?args = \"args\", unfolded args_props] wf_mbuf2'_0 wf_ts_0\n wf_until_aux_Nil[where ?I = I and ?n = n and ?\\' = \\ and ?\\' = \\ and ?b = b and ?agg = agg, folded assms(9)])\n qed\nqed\n\nlemma mem_restr_lift_envs'_append[simp]:\n \"length xs = b \\ mem_restr (lift_envs' b R) (xs @ ys) = mem_restr R ys\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: list_all2_append list.rel_map intro!: exI[where x=\"map the xs\"] list.rel_refl)\n\nlemma mem_restr_lift_envs'_zero[simp]: \"mem_restr (lift_envs' 0 R) = mem_restr R\"\n using mem_restr_lift_envs'_append[of \"[]\" 0]\n by auto\n\nlemma (in maux) wf_minit0: \"safe_formula \\ \\ \\x\\Formula.fv \\. x < n \\\n pred_mapping (\\x. x = 0) P \\\n wf_mformula \\ 0 P V n R (minit0 n \\) \\\"\nproof (induction arbitrary: n R P V rule: safe_formula_induct)\n case (Eq_Const c d)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var1 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var2 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (neq_Var x y)\n then show ?case by (auto intro!: wf_mformula.neq_Var)\nnext\n case (Pred e ts)\n then show ?case by (auto intro!: wf_mformula.Pred)\nnext\n case (Let p \\ \\)\n with fvi_less_nfv show ?case\n by (auto simp: pred_mapping_alt dom_def intro!: wf_mformula.Let Let(4,5))\nnext\n case (And_assign \\ \\)\n then have 1: \"\\x\\fv \\. x < n\" by simp\n from 1 \\safe_assignment (fv \\) \\\\\n obtain x t where\n \"x < n\" \"x \\ fv \\\" \"fv_trm t \\ fv \\\"\n \"\\ = Formula.Eq (Formula.Var x) t \\ \\ = Formula.Eq t (Formula.Var x)\"\n unfolding safe_assignment_def by (force split: formula.splits trm.splits)\n with And_assign show ?case\n by (auto intro!: wf_mformula.AndAssign split: trm.splits)\nnext\n case (And_safe \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (And_constraint \\ \\)\n from \\fv \\ \\ fv \\\\ \\is_constraint \\\\\n obtain t1 p c t2 where\n \"(t1, p, c, t2) = split_constraint \\\"\n \"formula_of_constraint (split_constraint \\) = \\\"\n \"fv_trm t1 \\ fv_trm t2 \\ fv \\\"\n by (induction rule: is_constraint.induct) auto\n with And_constraint show ?case\n by (auto 0 3 intro!: wf_mformula.AndRel)\nnext\n case (And_Not \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (Ands l pos neg)\n note posneg = \"Ands.hyps\"(1)\n let ?wf_minit = \"\\x. wf_mformula \\ 0 P V n R (minit0 n x)\"\n let ?pos = \"filter safe_formula l\"\n let ?neg = \"filter (Not \\ safe_formula) l\"\n have \"list_all2 ?wf_minit ?pos pos\"\n using Ands.IH(1) Ands.prems posneg by (auto simp: list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all2 ?wf_minit (map remove_neg ?neg) (map remove_neg neg)\"\n using Ands.IH(2) Ands.prems posneg by (auto simp: list.rel_map list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all3 (\\_ _ _. True) (?pos @ map remove_neg ?neg) (?pos @ map remove_neg ?neg) l\"\n by (auto simp: list_all3_conv_all_nth comp_def sum_length_filter_compl)\n moreover have \"l \\ [] \\ (MIN \\\\set l. (0 :: nat)) = 0\"\n by (cases l) (auto simp: Min_eq_iff)\n ultimately show ?case using Ands.hyps Ands.prems(2)\n by (auto simp: wf_mbufn_def list_all3_map list.rel_map map_replicate_const[symmetric] subset_eq\n map_map[symmetric] map_append[symmetric] simp del: map_map map_append\n intro!: wf_mformula.Ands list_all2_appendI)\nnext\n case (Neg \\)\n then show ?case by (auto intro!: wf_mformula.Neg)\nnext\n case (Or \\ \\)\n then show ?case by (auto intro!: wf_mformula.Or wf_mbuf2'_0)\nnext\n case (Exists \\)\n then show ?case by (auto simp: fvi_Suc_bound intro!: wf_mformula.Exists)\nnext\n case (Agg y \\ b f \\)\n define default where \"default = MAgg (fv \\ \\ {0.. b f (minit0 (b + n) \\)\"\n have fv_le: \"\\x\\fv \\. x < b + n\"\n using Agg\n by (auto intro!: fvi_plus_bound)\n have wf_default: \"wf_mformula \\ 0 P V n R default (formula.Agg y \\ b f \\)\"\n using Agg\n by (auto simp: default_def intro!: wf_mformula.Agg Agg.IH fvi_plus_bound)\n {\n fix y0 \\' I \\' op init\n assume op_def: \"(op = formula.Since \\ init = init_since) \\ (op = formula.Until \\ init = init_until)\"\n assume agg_def: \"\\ = op \\' I \\'\"\n define aggargs where \"aggargs = Some (init_aggargs (fv \\) n (fv \\ \\ {0.. b f)\"\n have \"wf_mformula \\ 0 P V n R (init minit0 (b + n) aggargs \\' I \\') (formula.Agg y \\ b f (op \\' I \\'))\"\n proof (cases \"safe_formula \\'\")\n case True\n have IH: \"wf_mformula \\ 0 P V (b + n) (lift_envs' b R) (minit0 (b + n) \\') \\'\"\n \"wf_mformula \\ 0 P V (b + n) (lift_envs' b R) (minit0 (b + n) \\') \\'\"\n using Agg(4,7) True fv_le op_def\n by (auto simp: agg_def(1) intro!: Agg(5))\n have fv_subsume: \"fv \\' \\ fv \\' = fv \\'\"\n using Agg agg_def(1) op_def\n by auto\n show ?thesis\n using wf_minit0_op[where ?b=True and ?agg=aggargs]\n Agg agg_def(1) op_def IH fv_le True\n by (auto simp: packagg_def aggargs_def init_args_def init_aggargs_def agg_n_def agg_b_def\n fv_subsume type_restr_def valid_aggargs_def safe_aggargs_def)\n next\n case False\n obtain \\'' where \\'_def: \"\\' = formula.Neg \\''\" \"safe_formula \\''\"\n using Agg(4) op_def False\n by (auto simp: agg_def(1) split: formula.splits)\n have IH: \"wf_mformula \\ 0 P V (b + n) (lift_envs' b R) (minit0 (b + n) \\'') \\''\"\n \"wf_mformula \\ 0 P V (b + n) (lift_envs' b R) (minit0 (b + n) \\') \\'\"\n using Agg(4,7) \\'_def(2) fv_le op_def\n by (auto simp: agg_def(1) \\'_def(1) intro!: Agg(5))\n have fv_subsume: \"fv \\'' \\ fv \\' = fv \\'\"\n using Agg agg_def(1) op_def \\'_def\n by auto\n show ?thesis\n using wf_minit0_op[where ?b=False and ?\\=\\'' and ?agg=aggargs]\n Agg agg_def(1) op_def IH fv_le False\n by (auto simp: \\'_def packagg_def aggargs_def init_args_def init_aggargs_def agg_n_def agg_b_def\n fv_subsume type_restr_def valid_aggargs_def safe_aggargs_def)\n qed\n }\n then show ?case\n using wf_default\n by (fastforce simp: default_def[symmetric] split: formula.splits prod.splits agg_type.splits)\nnext\n case (Prev I \\)\n thm wf_mformula.Prev[where P=P]\n then show ?case by (auto intro!: wf_mformula.Prev)\nnext\n case (Next I \\)\n then show ?case by (auto intro!: wf_mformula.Next)\nnext\n case (Since \\ I \\)\n then show ?case\n using wf_minit0_op[where ?b=True and ?agg=None]\n by (auto simp: init_args_def agg_n_def agg_b_def packagg_def valid_aggargs_def)\nnext\n case (Not_Since \\ I \\)\n then show ?case\n using wf_minit0_op[where ?b=False and ?agg=None and ?\\=\\]\n by (auto simp: init_args_def agg_n_def agg_b_def packagg_def valid_aggargs_def)\nnext\n case (Until \\ I \\)\n then show ?case\n using wf_minit0_op[where ?b=True and ?agg=None]\n by (auto simp: init_args_def agg_n_def agg_b_def packagg_def valid_aggargs_def)\nnext\n case (Not_Until \\ I \\)\n then show ?case\n using wf_minit0_op[where ?b=False and ?agg=None and ?\\=\\]\n by (auto simp: init_args_def agg_n_def agg_b_def packagg_def valid_aggargs_def)\nnext\n case (MatchP I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchP list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchP_aux_Nil\n dest!: to_mregex_atms)\nnext\n case (MatchF I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt progress_le Min_eq_iff progress_regex_def\n simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchF list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchF_aux_Nil\n dest!: to_mregex_atms)\nqed\n\nlemma (in maux) wf_mstate_minit: \"safe_formula \\ \\ wf_mstate \\ pnil R (minit \\)\"\n unfolding wf_mstate_def minit_def Let_def\n by (auto intro!: wf_minit0 fvi_less_nfv)\n\n\nsubsubsection \\Evaluation\\\n\nlemma match_wf_tuple: \"Some f = match ts xs \\\n wf_tuple n (\\t\\set ts. Formula.fv_trm t) (Table.tabulate f 0 n)\"\n by (induction ts xs arbitrary: f rule: match.induct)\n (fastforce simp: wf_tuple_def split: if_splits option.splits)+\n\nlemma match_fvi_trm_None: \"Some f = match ts xs \\ \\t\\set ts. x \\ Formula.fv_trm t \\ f x = None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_fvi_trm_Some: \"Some f = match ts xs \\ t \\ set ts \\ x \\ Formula.fv_trm t \\ f x \\ None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_eval_trm: \"\\t\\set ts. \\i\\Formula.fv_trm t. i < n \\ Some f = match ts xs \\\n map (Formula.eval_trm (Table.tabulate (\\i. the (f i)) 0 n)) ts = xs\"\nproof (induction ts xs arbitrary: f rule: match.induct)\n case (3 x ts y ys)\n from 3(1)[symmetric] 3(2,3) show ?case\n by (auto 0 3 dest: match_fvi_trm_Some sym split: option.splits if_splits intro!: eval_trm_fv_cong)\nqed (auto split: if_splits)\n\nlemma wf_tuple_tabulate_Some: \"wf_tuple n A (Table.tabulate f 0 n) \\ x \\ A \\ x < n \\ \\y. f x = Some y\"\n unfolding wf_tuple_def by auto\n\nlemma ex_match: \"wf_tuple n (\\t\\set ts. Formula.fv_trm t) v \\\n \\t\\set ts. (\\x\\Formula.fv_trm t. x < n) \\ (Formula.is_Var t \\ Formula.is_Const t) \\\n \\f. match ts (map (Formula.eval_trm (map the v)) ts) = Some f \\ v = Table.tabulate f 0 n\"\nproof (induction ts \"map (Formula.eval_trm (map the v)) ts\" arbitrary: v rule: match.induct)\n case (3 x ts y ys)\n then show ?case\n proof (cases \"x \\ (\\t\\set ts. Formula.fv_trm t)\")\n case True\n with 3 show ?thesis\n by (auto simp: insert_absorb dest!: wf_tuple_tabulate_Some meta_spec[of _ v])\n next\n case False\n with 3(3,4) have\n *: \"map (Formula.eval_trm (map the v)) ts = map (Formula.eval_trm (map the (v[x := None]))) ts\"\n by (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n from False 3(2-4) obtain f where\n \"match ts (map (Formula.eval_trm (map the v)) ts) = Some f\" \"v[x := None] = Table.tabulate f 0 n\"\n unfolding *\n by (atomize_elim, intro 3(1)[of \"v[x := None]\"])\n (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n moreover from False this have \"f x = None\" \"length v = n\"\n by (auto dest: match_fvi_trm_None[OF sym] arg_cong[of _ _ length])\n ultimately show ?thesis using 3(3)\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def)\n qed\nqed (auto simp: wf_tuple_def intro: nth_equalityI)\n\nlemma eq_rel_eval_trm: \"v \\ eq_rel n t1 t2 \\ is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1 \\ Formula.fv_trm t2. x < n \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2\"\n by (cases t1; cases t2) (simp_all add: is_simple_eq_def singleton_table_def split: if_splits)\n\nlemma in_eq_rel: \"wf_tuple n (Formula.fv_trm t1 \\ Formula.fv_trm t2) v \\\n is_simple_eq t1 t2 \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2 \\\n v \\ eq_rel n t1 t2\"\n by (cases t1; cases t2)\n (auto simp: is_simple_eq_def singleton_table_def wf_tuple_def unit_table_def\n intro!: nth_equalityI split: if_splits)\n\nlemma table_eq_rel: \"is_simple_eq t1 t2 \\\n table n (Formula.fv_trm t1 \\ Formula.fv_trm t2) (eq_rel n t1 t2)\"\n by (cases t1; cases t2; simp add: is_simple_eq_def)\n\nlemma wf_tuple_Suc_fviD: \"wf_tuple (Suc n) (Formula.fvi b \\) v \\ wf_tuple n (Formula.fvi (Suc b) \\) (tl v)\"\n unfolding wf_tuple_def by (simp add: fvi_Suc nth_tl)\n\nlemma table_fvi_tl: \"table (Suc n) (Formula.fvi b \\) X \\ table n (Formula.fvi (Suc b) \\) (tl ` X)\"\n unfolding table_def by (auto intro: wf_tuple_Suc_fviD)\n\nlemma wf_tuple_Suc_fvi_SomeI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (Some x # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma wf_tuple_Suc_fvi_NoneI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (None # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma qtable_project_fv: \"qtable (Suc n) (fv \\) (mem_restr (lift_envs R)) P X \\\n qtable n (Formula.fvi (Suc 0) \\) (mem_restr R)\n (\\v. \\x. P ((if 0 \\ fv \\ then Some x else None) # v)) (tl ` X)\"\n using neq0_conv by (fastforce simp: image_iff Bex_def fvi_Suc elim!: qtable_cong dest!: qtable_project)\n\nlemma nth_list_update_alt: \"xs[i := x] ! j = (if i < length xs \\ i = j then x else xs ! j)\"\n by auto\n\nlemma wf_tuple_upd_None: \"wf_tuple n A xs \\ A - {i} = B \\ wf_tuple n B (xs[i:=None])\"\n unfolding wf_tuple_def\n by (auto simp: nth_list_update_alt)\n\nlemma mem_restr_upd_None: \"mem_restr R xs \\ mem_restr R (xs[i:=None])\"\n unfolding mem_restr_def\n by (auto simp: list_all2_conv_all_nth nth_list_update_alt)\n\nlemma mem_restr_dropI: \"mem_restr (lift_envs' b R) xs \\ mem_restr R (drop b xs)\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: append_eq_conv_conj list_all2_append2)\n\nlemma mem_restr_dropD:\n assumes \"b \\ length xs\" and \"mem_restr R (drop b xs)\"\n shows \"mem_restr (lift_envs' b R) xs\"\nproof -\n let ?R = \"\\a b. a \\ None \\ a = Some b\"\n from assms(2) obtain v where \"v \\ R\" and \"list_all2 ?R (drop b xs) v\"\n unfolding mem_restr_def ..\n show ?thesis unfolding mem_restr_def proof\n have \"list_all2 ?R (take b xs) (map the (take b xs))\"\n by (auto simp: list.rel_map intro!: list.rel_refl)\n moreover note \\list_all2 ?R (drop b xs) v\\\n ultimately have \"list_all2 ?R (take b xs @ drop b xs) (map the (take b xs) @ v)\"\n by (rule list_all2_appendI)\n then show \"list_all2 ?R xs (map the (take b xs) @ v)\" by simp\n show \"map the (take b xs) @ v \\ lift_envs' b R\"\n unfolding lift_envs'_def using assms(1) \\v \\ R\\ by auto\n qed\nqed\n\nlemma wf_tuple_append: \"wf_tuple a {x \\ A. x < a} xs \\\n wf_tuple b {x - a | x. x \\ A \\ x \\ a} ys \\\n wf_tuple (a + b) A (xs @ ys)\"\n unfolding wf_tuple_def by (auto simp: nth_append eq_diff_iff)\n\nlemma wf_tuple_map_Some: \"length xs = n \\ {0.. A \\ wf_tuple n A (map Some xs)\"\n unfolding wf_tuple_def by auto\n\nlemma wf_tuple_drop: \"wf_tuple (b + n) A xs \\ {x - b | x. x \\ A \\ x \\ b} = B \\\n wf_tuple n B (drop b xs)\"\n unfolding wf_tuple_def by force\n\nlemma ecard_image: \"inj_on f A \\ ecard (f ` A) = ecard A\"\n unfolding ecard_def by (auto simp: card_image dest: finite_imageD)\n\nlemma meval_trm_eval_trm: \"wf_tuple n A x \\ fv_trm t \\ A \\ \\i\\A. i < n \\\n meval_trm t x = Formula.eval_trm (map the x) t\"\n unfolding wf_tuple_def\n by (induction t) simp_all\n\nlemma list_update_id: \"xs ! i = z \\ xs[i:=z] = xs\"\n by (induction xs arbitrary: i) (auto split: nat.split)\n\nlemma qtable_wf_tupleD: \"qtable n A P Q X \\ \\x\\X. wf_tuple n A x\"\n unfolding qtable_def table_def by blast\n\nlemma qtable_eval_agg:\n assumes inner: \"qtable (b + n) (Formula.fv \\) (mem_restr (lift_envs' b R))\n (\\v. Formula.sat \\ V (map the v) i \\) rel\"\n and n: \"\\x\\Formula.fv (Formula.Agg y \\ b f \\). x < n\"\n and fresh: \"y + b \\ Formula.fv \\\"\n and b_fv: \"{0.. Formula.fv \\\"\n and f_fv: \"Formula.fv_trm f \\ Formula.fv \\\"\n and g0: \"g0 = (Formula.fv \\ \\ {0.. b f \\)) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)) (eval_agg n g0 y \\ b f rel)\"\n (is \"qtable _ ?fv _ ?Q ?rel'\")\nproof -\n define M where \"M = (\\v. {(x, ecard Zs) | x Zs.\n Zs = {zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\ \\ Formula.eval_trm (zs @ v) f = x} \\\n Zs \\ {}})\"\n have f_fvi: \"Formula.fvi_trm b f \\ Formula.fvi b \\\"\n using f_fv by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n show ?thesis proof (cases \"g0 \\ rel = empty_table\")\n case True\n then have [simp]: \"Formula.fvi b \\ = {}\"\n by (auto simp: g0 fvi_iff_fv(1)[where b=b])\n then have [simp]: \"Formula.fvi_trm b f = {}\"\n using f_fvi by auto\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\" by (simp add: eval_agg_def True)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n have \"\\ Formula.sat \\ V (zs @ map the v) i \\\" if [simp]: \"length zs = b\" for zs\n proof -\n let ?zs = \"map2 (\\z i. if i \\ Formula.fv \\ then Some z else None) zs [0.. fv \\. x < b} ?zs\"\n by (simp add: wf_tuple_def)\n then have \"wf_tuple (b + n) (Formula.fv \\) (?zs @ v[y:=None])\"\n using \\wf_tuple n ?fv v\\ True\n by (auto simp: g0 intro!: wf_tuple_append wf_tuple_upd_None)\n then have \"\\ Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\\"\n using True \\mem_restr R v\\\n by (auto simp del: map_append dest!: in_qtableI[OF inner, rotated -1]\n intro!: mem_restr_upd_None)\n also have \"Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\ \\ Formula.sat \\ V (zs @ map the v) i \\\"\n using True by (auto simp: g0 nth_append intro!: sat_fv_cong)\n finally show ?thesis .\n qed\n then have M_empty: \"M (map the v) = {}\"\n unfolding M_def by blast\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0 singleton_table_def)\n have \"v \\ singleton_table n y (the (v ! y))\" \"length v = n\"\n using \\wf_tuple n ?fv v\\ unfolding wf_tuple_def singleton_table_def\n by (auto simp add: tabulate_alt map_nth\n intro!: trans[OF map_cong[where g=\"(!) v\", simplified nth_map, OF refl], symmetric])\n then show \"v \\ eval_agg n g0 y \\ b f rel\"\n if \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0)\n qed\n next\n case non_default_case: False\n have union_fv: \"{0.. (\\x. x + b) ` Formula.fvi b \\ = fv \\\"\n using b_fv\n by (auto simp: fvi_iff_fv(1)[where b=b] intro!: image_eqI[where b=x and x=\"x - b\" for x])\n have b_n: \"\\x\\fv \\. x < b + n\"\n proof\n fix x assume \"x \\ fv \\\"\n show \"x < b + n\" proof (cases \"x \\ b\")\n case True\n with \\x \\ fv \\\\ have \"x - b \\ ?fv\"\n by (simp add: fvi_iff_fv(1)[where b=b])\n then show ?thesis using n f_fvi by (auto simp: Un_absorb2)\n qed simp\n qed\n\n define M' where \"M' = (\\k. let group = Set.filter (\\x. drop b x = k) rel;\n images = meval_trm f ` group\n in (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` images)\"\n have M'_M: \"M' (drop b x) = M (map the (drop b x))\" if \"x \\ rel\" \"mem_restr (lift_envs' b R) x\" for x\n proof -\n from that have wf_x: \"wf_tuple (b + n) (fv \\) x\"\n by (auto elim!: in_qtableE[OF inner])\n then have wf_zs_x: \"wf_tuple (b + n) (fv \\) (map Some zs @ drop b x)\"\n if \"length zs = b\" for zs\n using that b_fv\n by (auto intro!: wf_tuple_append wf_tuple_map_Some wf_tuple_drop)\n have 1: \"(length zs = b \\ Formula.sat \\ V (zs @ map the (drop b x)) i \\ \\\n Formula.eval_trm (zs @ map the (drop b x)) f = y) \\\n (\\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ meval_trm f a = y)\"\n (is \"?A \\ (\\a. ?B a)\") for y zs\n proof (intro iffI conjI)\n assume ?A\n then have \"?B (map Some zs @ drop (length zs) x)\"\n using in_qtableI[OF inner wf_zs_x] \\mem_restr (lift_envs' b R) x\\\n meval_trm_eval_trm[OF wf_zs_x f_fv b_n]\n by (auto intro!: mem_restr_dropI)\n then show \"\\a. ?B a\" ..\n next\n assume \"\\a. ?B a\"\n then obtain a where \"?B a\" ..\n then have \"a \\ rel\" and a_eq: \"a = map Some zs @ drop b x\"\n using append_take_drop_id[of b a] by auto\n then have \"length a = b + n\"\n using inner unfolding qtable_def table_def\n by (blast intro!: wf_tuple_length)\n then show \"length zs = b\"\n using wf_tuple_length[OF wf_x] unfolding a_eq by simp\n then have \"mem_restr (lift_envs' b R) a\"\n using \\mem_restr _ x\\ unfolding a_eq by (auto intro!: mem_restr_dropI)\n then show \"Formula.sat \\ V (zs @ map the (drop b x)) i \\\"\n using in_qtableE[OF inner \\a \\ rel\\]\n by (auto simp: a_eq sat_fv_cong[THEN iffD1, rotated -1])\n from \\?B a\\ show \"Formula.eval_trm (zs @ map the (drop b x)) f = y\"\n using meval_trm_eval_trm[OF wf_zs_x f_fv b_n, OF \\length zs = b\\]\n unfolding a_eq by simp\n qed\n have 2: \"map Some (map the (take b a)) = take b a\" if \"a \\ rel\" for a\n using that b_fv inner[THEN qtable_wf_tupleD]\n unfolding table_def wf_tuple_def\n by (auto simp: list_eq_iff_nth_eq)\n have 3: \"ecard {zs. \\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ P a} =\n ecard {a. a \\ rel \\ drop b a = drop b x \\ P a}\" (is \"ecard ?A = ecard ?B\") for P\n proof -\n have \"ecard ?A = ecard ((\\zs. map Some zs @ drop b x) ` ?A)\"\n by (auto intro!: ecard_image[symmetric] inj_onI)\n also have \"(\\zs. map Some zs @ drop b x) ` ?A = ?B\"\n by (subst (1 2) eq_commute) (auto simp: image_iff, metis \"2\" append_take_drop_id)\n finally show ?thesis .\n qed\n show ?thesis\n unfolding M_def M'_def\n by (auto simp: non_default_case Let_def image_def Set.filter_def 1 3, metis \"2\")\n qed\n have drop_lift: \"mem_restr (lift_envs' b R) x\" if \"x \\ rel\" \"mem_restr R ((drop b x)[y:=z])\" for x z\n proof -\n have \"(drop b x)[y:=None] = (drop b x)[y:=drop b x ! y]\" proof -\n from \\x \\ rel\\ have \"drop b x ! y = None\"\n using fresh n inner[THEN qtable_wf_tupleD]\n by (simp add: add.commute wf_tuple_def)\n then show ?thesis by simp\n qed\n then have \"(drop b x)[y:=None] = drop b x\" by simp\n moreover from \\x \\ rel\\ have \"length x = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n moreover from that(2) have \"mem_restr R ((drop b x)[y:=z, y:=None])\"\n by (rule mem_restr_upd_None)\n ultimately show ?thesis\n by (auto intro!: mem_restr_dropD)\n qed\n\n {\n fix v\n assume \"mem_restr R v\"\n have \"v \\ (\\k. k[y:=Some (eval_agg_op \\ (M' k))]) ` drop b ` rel \\\n v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n (is \"v \\ ?A \\ v \\ ?B\")\n proof\n assume \"v \\ ?A\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M' (drop b v')))]\"\n by auto\n then have \"M' (drop b v') = M (map the (drop b v'))\"\n using \\mem_restr R v\\ by (auto intro!: M'_M drop_lift)\n with * show \"v \\ ?B\" by simp\n next\n assume \"v \\ ?B\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n by auto\n then have \"M (map the (drop b v')) = M' (drop b v')\"\n using \\mem_restr R v\\ by (auto intro!: M'_M[symmetric] drop_lift)\n with * show \"v \\ ?A\" by simp\n qed\n then have \"v \\ eval_agg n g0 y \\ b f rel \\ v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n by (simp add: non_default_case eval_agg_def M'_def Let_def)\n }\n note alt = this\n\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\"\n using inner[THEN qtable_wf_tupleD] n f_fvi\n by (auto simp: eval_agg_def non_default_case table_def wf_tuple_def Let_def nth_list_update\n fvi_iff_fv[where b=b] add.commute)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n then have length_v: \"length v = n\" by (simp add: wf_tuple_def)\n\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n proof -\n from that obtain v' where \"v' \\ rel\"\n \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n using alt[OF \\mem_restr R v\\] by blast\n then have length_v': \"length v' = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n have \"Formula.sat \\ V (map the v') i \\\"\n using \\v' \\ rel\\ \\mem_restr R v\\\n by (auto simp: \\v = _\\ elim!: in_qtableE[OF inner] intro!: drop_lift \\v' \\ rel\\)\n then have \"Formula.sat \\ V (map the (take b v') @ map the v) i \\\"\n proof (rule sat_fv_cong[THEN iffD1, rotated], intro ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"map the v' ! x = (map the (take b v') @ map the v) ! x\"\n by (auto simp: \\v = _\\ nth_append)\n qed\n then have 1: \"M (map the v) \\ {}\" by (force simp: M_def length_v')\n\n have \"y < length (drop b v')\" using n by (simp add: length_v')\n moreover have \"Formula.sat \\ V (zs @ map the v) i \\ \\\n Formula.sat \\ V (zs @ map the (drop b v')) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the v) f =\n Formula.eval_trm (zs @ map the (drop b v')) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the v))\"\n by (simp add: M_def \\v = _\\ conj_commute cong: conj_cong)\n with 1 show ?thesis by (auto simp: M_def)\n qed\n\n show \"v \\ eval_agg n g0 y \\ b f rel\"\n if sat_Agg: \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n proof -\n obtain zs where \"length zs = b\" and \"map Some zs @ v[y:=None] \\ rel\"\n proof (cases \"fv \\ \\ {0.. empty_table\" by (simp add: g0)\n then obtain x where \"x \\ rel\" by auto\n have \"(\\i < n. (v[y:=None]) ! i = None)\"\n using True \\wf_tuple n ?fv v\\ f_fv\n by (fastforce simp: wf_tuple_def fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n moreover have x: \"(\\i < n. drop b x ! i = None) \\ length x = b + n\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] f_fv\n by (auto simp: wf_tuple_def)\n ultimately have \"v[y:=None] = drop b x\"\n unfolding list_eq_iff_nth_eq by (auto simp: length_v)\n with \\x \\ rel\\ have \"take b x @ v[y:=None] \\ rel\" by simp\n moreover have \"map (Some \\ the) (take b x) = take b x\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] b_fv\n by (subst map_cong[where g=id, OF refl]) (auto simp: wf_tuple_def in_set_conv_nth)\n ultimately have \"map Some (map the (take b x)) @ v[y:=None] \\ rel\" by simp\n then show thesis using x[THEN conjunct2] by (fastforce intro!: that[rotated])\n next\n case False\n with sat_Agg obtain zs where \"length zs = b\" and \"Formula.sat \\ V (zs @ map the v) i \\\"\n by auto\n then have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\\"\n using fresh\n by (auto simp: map_update not_less nth_append elim!: sat_fv_cong[THEN iffD1, rotated]\n intro!: nth_list_update_neq[symmetric])\n then have \"map Some zs @ v[y:=None] \\ rel\"\n using b_fv f_fv fresh\n by (auto intro!: in_qtableI[OF inner] wf_tuple_append wf_tuple_map_Some\n wf_tuple_upd_None \\wf_tuple n ?fv v\\ mem_restr_upd_None \\mem_restr R v\\\n simp: \\length zs = b\\ set_eq_iff fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n force+\n with that \\length zs = b\\ show thesis by blast\n qed\n then have 1: \"v[y:=None] \\ drop b ` rel\" by (intro image_eqI) auto\n\n have y_length: \"y < length v\" using n by (simp add: length_v)\n moreover have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\ \\\n Formula.sat \\ V (zs @ map the v) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the (v[y:=None])) f =\n Formula.eval_trm (zs @ map the v) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the (v[y:=None])))\"\n using sat_Agg by (simp add: M_def cong: conj_cong) (simp cong: rev_conj_cong)\n then have 2: \"v ! y = Some (eval_agg_op \\ (M (map the (v[y:=None]))))\"\n using \\wf_tuple n ?fv v\\ y_length by (auto simp add: wf_tuple_def)\n show ?thesis\n unfolding alt[OF \\mem_restr R v\\]\n by (rule image_eqI[where x=\"v[y:=None]\"]) (use 1 2 in \\auto simp: y_length list_update_id\\)\n qed\n qed\n qed\nqed\n\nlemma mprev_next_NilE[elim!]: \"mprev_next I xs ts = (ys, [], []) \\\n (xs = [] \\ ts = [] \\ ys = [] \\ R) \\ R\"\n by (induct I xs ts arbitrary: ys rule: mprev_next.induct) (auto split: prod.splits)\n\nlemma mprev: \"mprev_next I xs ts = (ys, xs', ts') \\\n list_all2 P [i.. list_all2 (\\i t. t = \\ \\ i) [i.. i \\ j' \\ i \\ j \\\n list_all2 (\\i X. if mem I ((\\ \\ (Suc i) - \\ \\ i)) then P i X else X = empty_table)\n [i..\n list_all2 P [min j' (if i = j then j else j-1)..\n list_all2 (\\i t. t = \\ \\ i) [min j' (if i = j then j else j-1)..\n list_all2 P [Suc i.. list_all2 (\\i t. t = \\ \\ i) [i.. Suc i \\ j' \\ i \\ j \\\n list_all2 (\\i X. if mem I ((\\ \\ (Suc i) - \\ \\ i)) then P (Suc i) X else X = empty_table)\n [i..\n list_all2 P [Suc (min (j'-1) ((if i = j then j else j-1)))..\n list_all2 (\\i t. t = \\ \\ i) [min (j'-1) ((if i = j then j else j-1)).. A \\ A \\ set xs \\ x \\ foldr (\\) xs {}\"\n by (induction xs) auto\n\nlemma in_foldr_UnE: \"x \\ foldr (\\) xs {} \\ (\\A. A \\ set xs \\ x \\ A \\ P) \\ P\"\n by (induction xs) auto\n\nlemma sat_the_restrict: \"fv \\ \\ A \\ Formula.sat \\ V (map the (restrict A v)) i \\ = Formula.sat \\ V (map the v) i \\\"\n by (rule sat_fv_cong) (auto intro!: map_the_restrict)\n\nlemma eps_the_restrict: \"fv_regex r \\ A \\ Regex.eps (Formula.sat \\ V (map the (restrict A v))) i r = Regex.eps (Formula.sat \\ V (map the v)) i r\"\n by (rule eps_fv_cong) (auto intro!: map_the_restrict)\n\nlemma sorted_wrt_filter[simp]: \"sorted_wrt R xs \\ sorted_wrt R (filter P xs)\"\n by (induct xs) auto\n\nlemma concat_map_filter[simp]:\n \"concat (map f (filter P xs)) = concat (map (\\x. if P x then f x else []) xs)\"\n by (induct xs) auto\n\nlemma map_filter_alt:\n \"map f (filter P xs) = concat (map (\\x. if P x then [f x] else []) xs)\"\n by (induct xs) auto\n\nlemma qtable_eval_args_agg:\n \"qtable (agg_n args) (fv (packagg args \\)) (mem_restr R') (\\v. Formula.sat \\ V (map the v) ne (packagg args \\)) (eval_args_agg args rel)\"\n if q: \"qtable (args_n args) (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel\"\n and mr: \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n and valid_aggargs: \"valid_aggargs (args_n args) (fv \\) (args_agg args)\"\nproof (cases \"args_agg args\")\n case None\n have pack: \"packagg args \\ = \\\"\n by (auto simp add: packagg_def None)\n have \"mem_restr R' = mem_restr R\"\n using mr mem_restr_lift_envs'_append[of \"[]\" 0]\n by (auto simp: agg_b_def None)\n then show ?thesis\n using q\n unfolding pack\n by (auto simp: eval_args_agg_def agg_n_def None)\nnext\n case (Some aggargs)\n have n_def: \"agg_n args = aggargs_n aggargs\" \"args_n args = aggargs_b aggargs + aggargs_n aggargs\"\n using valid_aggargs\n by (auto simp: agg_n_def Some valid_aggargs_def)\n have x_in_colsD: \"x + aggargs_b aggargs \\ aggargs_cols aggargs \\ x < aggargs_n aggargs\" for x\n using valid_aggargs\n by (auto simp: valid_aggargs_def Some safe_aggargs_def)\n show ?thesis\n unfolding packagg_def Some eval_args_agg_def\n apply (auto simp del: sat.simps fvi.simps simp: eval_aggargs_def n_def)\n apply (rule qtable_eval_agg)\n using q valid_aggargs mr\n by (auto simp: n_def agg_b_def Some valid_aggargs_def safe_aggargs_def\n fvi_iff_fv[where ?b=\"aggargs_b aggargs\"] fvi_trm_iff_fv_trm[where ?b=\"aggargs_b aggargs\"]\n dest!: x_in_colsD)\nqed\n\nlemma (in maux) update_since:\n assumes pre: \"wf_since_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel2\"\n and result_eq: \"(rel, aux') = update_since args rel1 rel2 (\\ \\ ne) aux\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n and mr: \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n shows \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n and \"qtable (agg_n args) (Formula.fv (packagg args (Sincep pos \\ I \\))) (mem_restr R') (\\v. Formula.sat \\ V (map the v) ne (packagg args (Sincep pos \\ I \\))) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv \\) v\"\n note sat.simps[simp del]\n from pre[unfolded wf_since_aux_def] obtain cur auxlist where aux: \"valid_msaux args cur aux auxlist\"\n \"sorted_wrt (\\x y. fst y < fst x) auxlist\"\n \"\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR I (\\ \\ (ne - 1) - t) \\\n (\\i. \\ \\ i = t) \\\n qtable n (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\)) X\"\n \"\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ memR I (\\ \\ (ne - 1) - t) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)\"\n and cur_def:\n \"cur = (if ne = 0 then 0 else \\ \\ (ne - 1))\"\n unfolding args_ivl args_n args_pos by blast\n from pre[unfolded wf_since_aux_def] have fv_sub: \"Formula.fv \\ \\ Formula.fv \\\" by simp\n\n define aux0 where \"aux0 = join_msaux args rel1 (add_new_ts_msaux args (\\ \\ ne) aux)\"\n define auxlist0 where \"auxlist0 = [(t, join rel pos rel1). (t, rel) \\ auxlist, memR I (\\ \\ ne - t)]\"\n have tabL: \"table (args_n args) (args_L args) rel1\"\n using qtable1[unfolded qtable_def] unfolding args_n[symmetric] args_L[symmetric] by simp\n have cur_le: \"cur \\ \\ \\ ne\"\n unfolding cur_def by auto\n have valid0: \"valid_msaux args (\\ \\ ne) aux0 auxlist0\" unfolding aux0_def auxlist0_def\n using valid_join_msaux[OF valid_add_new_ts_msaux[OF aux(1)], OF cur_le tabL]\n by (auto simp: args_ivl args_pos cur_def map_filter_alt split_beta cong: map_cong)\n from aux(2) have sorted_auxlist0: \"sorted_wrt (\\x y. fst x > fst y) auxlist0\"\n unfolding auxlist0_def\n by (induction auxlist) (auto simp add: sorted_wrt_append)\n have in_auxlist0_1: \"(t, X) \\ set auxlist0 \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ memR I (\\ \\ ne - t) \\\n (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (Formula.sat \\ V (map the v) (ne-1) (Sincep pos \\ (point (\\ \\ (ne-1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\))) X\" for t X\n unfolding auxlist0_def using fvi_subset\n by (auto 0 1 elim!: qtable_join[OF _ qtable1] simp: sat_the_restrict Sincep_def dest!: aux(3))\n then have in_auxlist0_le_\\: \"(t, X) \\ set auxlist0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_auxlist0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ memR I (\\ \\ ne - t) \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set auxlist0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set auxlist\"\n by (atomize_elim, intro aux(4))\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\memR I (\\ \\ ne - t)\\ have \"(t, join X pos rel1) \\ set auxlist0\"\n unfolding auxlist0_def by (auto elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set auxlist0\"\n by blast\n qed\n have auxlist0_Nil: \"auxlist0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ memR I (\\ \\ ne - t) \\\n (\\i. \\ \\ i = t))\"\n using in_auxlist0_2 by (auto)\n\n have aux'_eq: \"aux' = add_new_table_msaux args rel2 aux0\"\n using result_eq unfolding aux0_def update_since_def Let_def by simp\n define auxlist' where\n auxlist'_eq: \"auxlist' = (case auxlist0 of\n [] \\ [(\\ \\ ne, rel2)]\n | x # auxlist' \\ (if fst x = \\ \\ ne then (fst x, snd x \\ rel2) # auxlist' else (\\ \\ ne, rel2) # x # auxlist'))\"\n have tabR: \"table (args_n args) (args_R args) rel2\"\n using qtable2[unfolded qtable_def] unfolding args_n[symmetric] args_R[symmetric] by simp\n have valid': \"valid_msaux args (\\ \\ ne) aux' auxlist'\"\n unfolding aux'_eq auxlist'_eq using valid_add_new_table_msaux[OF valid0 tabR]\n by (auto simp: not_le split: list.splits option.splits if_splits)\n have sorted_auxlist': \"sorted_wrt (\\x y. fst x > fst y) auxlist'\"\n unfolding auxlist'_eq\n using sorted_auxlist0 in_auxlist0_le_\\ by (cases auxlist0) fastforce+\n have in_auxlist'_1: \"t \\ \\ \\ ne \\ memR I (\\ \\ ne - t) \\ (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)) X\"\n if auxlist': \"(t, X) \\ set auxlist'\" for t X\n proof (cases auxlist0)\n case Nil\n with auxlist' show ?thesis\n unfolding auxlist'_eq Sincep_def using qtable2 auxlist0_Nil\n by (auto simp: zero_enat_def[symmetric] sat_Since_rec[where i=ne]\n dest: spec[of _ \"\\ \\ (ne-1)\"] elim!: qtable_cong[OF _ refl])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with auxlist' Cons t have \"X = snd a \\ rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 by (auto split: if_splits)\n moreover from in_auxlist0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ (ne - 1)\" \"memR I (\\ \\ ne - fst a)\" \"\\i. \\ \\ i = fst a\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1)\n (Sincep pos \\ (point (\\ \\ (ne - 1) - fst a)) \\) \\ (if pos then Formula.sat \\ V (map the v) ne \\\n else \\ Formula.sat \\ V (map the v) ne \\)) (snd a)\"\n by (auto simp: True[symmetric] zero_enat_def[symmetric])\n ultimately show ?thesis unfolding Sincep_def using qtable2 t True\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(6) elim!: qtable_union)\n next\n case False\n with auxlist' Cons t have \"X = rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 in_auxlist0_le_\\[of \"fst a\" \"snd a\"] by (auto split: if_splits)\n with auxlist' Cons t False show ?thesis\n unfolding auxlist'_eq Sincep_def using qtable2 in_auxlist0_2[of \"\\ \\ (ne-1)\"] in_auxlist0_le_\\[of \"fst a\" \"snd a\"] sorted_auxlist0\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(3) zero_enat_def[symmetric] enat_0_iff not_le\n elim!: qtable_cong[OF _ refl] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with auxlist' Cons have \"(t, X) \\ set auxlist0\"\n unfolding auxlist'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ (ne - 1)\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\)) X\"\n using in_auxlist0_1 by blast+\n with False auxlist' Cons show ?thesis\n unfolding auxlist'_eq Sincep_def\n by (fastforce simp: sat_Since_rec[where i=ne] sat.simps(6)\n diff_diff_right[where i=\"\\ \\ ne\" and j=\"\\ \\ _ + \\ \\ ne\" and k=\"\\ \\ (ne - 1)\",\n OF trans_le_add2, simplified] elim!: qtable_cong[OF _ refl] order_trans dest: le_\\_less)\n qed\n qed\n\n have in_auxlist'_2: \"\\X. (t, X) \\ set auxlist'\" if \"t \\ \\ \\ ne\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases auxlist0)\n case Nil\n with True show ?thesis unfolding auxlist'_eq by (simp add: zero_enat_def[symmetric])\n next\n case (Cons a as)\n with True show ?thesis unfolding auxlist'_eq\n by (cases \"fst a = \\ \\ ne\") (auto simp: zero_enat_def[symmetric])\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set auxlist0\" using \\memR I (\\ \\ ne - t)\\ \\\\i. \\ \\ i = t\\\n using \\_mono[of \"ne - 1\" \"ne\" \\] by (atomize_elim) (auto intro!: in_auxlist0_2 simp del: \\_mono)\n then show ?thesis unfolding auxlist'_eq using False \\memR I (\\ \\ ne - t)\\\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n using pre\n unfolding wf_since_aux_def args_ivl args_n args_pos\n by (auto simp add: fv_sub dest: in_auxlist'_1 intro: sorted_auxlist' in_auxlist'_2\n intro!: exI[of _ auxlist'] valid')\n\n have rel_msaux: \"rel = result_msaux args aux'\"\n using result_eq by (auto simp add: update_since_def Let_def)\n have rel_eq: \"rel = eval_args_agg args (foldr (\\) [rel. (t, rel) \\ auxlist', memL I (\\ \\ ne - t)] {})\"\n by (auto simp: args_ivl rel_msaux valid_result_msaux[OF valid'])\n have rel_alt: \"rel = eval_args_agg args (\\(t, rel) \\ set auxlist'. if memL I (\\ \\ ne - t) then rel else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI arg_cong[where ?f=\"\\x. eval_args_agg args x\"])\n have qtable_since: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ I \\))\n (\\(t, rel) \\ set auxlist'. if memL I (\\ \\ ne - t) then rel else empty_table)\"\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n memL I (\\ \\ ne - t) \\ Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n unfolding Sincep_def\n proof (rule iffI, erule sat_Since_point, goal_cases left right)\n case (left j)\n then show ?case using in_auxlist'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_Since_pointD dest: in_auxlist'_1)\n qed\n qed (auto dest!: in_auxlist'_1 intro!: qtable_empty)\n have fv: \"fv (Sincep pos \\ I \\) = fv \\\"\n using fvi_subset\n by (auto simp: Sincep_def)\n show \"qtable (agg_n args) (fv (packagg args (Sincep pos \\ I \\))) (mem_restr R') (\\v. Formula.sat \\ V (map the v) ne (packagg args (Sincep pos \\ I \\))) rel\"\n unfolding rel_alt\n apply (rule qtable_eval_args_agg[OF _ mr])\n using qtable_since pre\n by (auto simp: args_n fv wf_since_aux_def)\nqed\n\nlemma fv_regex_from_mregex:\n \"ok (length \\s) mr \\ fv_regex (from_mregex mr \\s) \\ (\\\\ \\ set \\s. fv \\)\"\n by (induct mr) (auto simp: Bex_def in_set_conv_nth)+\n\nlemma qtable_\\_lax:\n assumes \"ok (length \\s) mr\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and \"fv_regex (from_mregex mr \\s) \\ A\" and \"qtable n A (mem_restr R) Q guard\"\n shows \"qtable n A (mem_restr R)\n (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s) \\ Q v) (\\_lax guard rels mr)\"\n using assms\nproof (induct mr)\n case (MPlus mr1 mr2)\n from MPlus(3-6) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n then have \"fv_regex (from_mregex mr1 \\s) \\ A\" \"fv_regex (from_mregex mr2 \\s) \\ A\"\n using fv_regex_from_mregex[of \\s mr1] fv_regex_from_mregex[of \\s mr2] by (auto simp: subset_eq)\n with MTimes(3-6) show ?case\n by (auto simp: eps_the_restrict restrict_idle intro!: qtable_join[OF MTimes(1,2)])\nqed (auto split: prod.splits if_splits simp: qtable_empty_iff list_all2_conv_all_nth\n in_set_conv_nth restrict_idle sat_the_restrict\n intro: in_qtableI qtableI elim!: qtable_join[where A=A and C=A])\n\nlemma nullary_qtable_cases: \"qtable n {} P Q X \\ (X = empty_table \\ X = unit_table n)\"\n by (simp add: qtable_def table_empty)\n\nlemma qtable_empty_unit_table:\n \"qtable n {} R P empty_table \\ qtable n {} R (\\v. \\ P v) (unit_table n)\"\n by (auto intro: qtable_unit_table simp add: qtable_empty_iff)\n\nlemma qtable_unit_empty_table:\n \"qtable n {} R P (unit_table n) \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (auto intro!: qtable_empty elim: in_qtableE simp add: wf_tuple_empty unit_table_def)\n\nlemma qtable_nonempty_empty_table:\n \"qtable n {} R P X \\ x \\ X \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (frule nullary_qtable_cases) (auto dest: qtable_unit_empty_table)\n\n\nlemma qtable_r\\_strict:\n assumes \"safe_regex Past Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (r\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma qtable_l\\_strict:\n assumes \"safe_regex Futu Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (l\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma rtranclp_False: \"(\\i j. False)\\<^sup>*\\<^sup>* = (=)\"\nproof -\n have \"(\\i j. False)\\<^sup>*\\<^sup>* i j \\ i = j\" for i j :: 'a\n by (induct i j rule: rtranclp.induct) auto\n then show ?thesis\n by (auto intro: exI[of _ 0])\nqed\n\ninductive ok_rctxt for \\s where\n \"ok_rctxt \\s id id\"\n| \"ok_rctxt \\s \\ \\' \\ ok_rctxt \\s (\\t. \\ (MTimes mr t)) (\\t. \\' (Regex.Times (from_mregex mr \\s) t))\"\n\nlemma ok_rctxt_swap: \"ok_rctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_rctxt.induct) auto\n\nlemma ok_rctxt_cong: \"ok_rctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_rctxt.induct) simp_all\n\nlemma qtable_r\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_rctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` RPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.rpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (r\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_rctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(2) qtable_\\_lax[OF _ _ _ MTimes(1)]]\n elim!: ok_rctxt.intros(2) simp: MTimesL_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_rctxt.intros simp: MTimesL_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_r\\ = qtable_r\\\\[OF _ _ _ ok_rctxt.intros(1), unfolded rpd\\_rpd image_id id_apply]\n\ninductive ok_lctxt for \\s where\n \"ok_lctxt \\s id id\"\n| \"ok_lctxt \\s \\ \\' \\ ok_lctxt \\s (\\t. \\ (MTimes t mr)) (\\t. \\' (Regex.Times t (from_mregex mr \\s)))\"\n\nlemma ok_lctxt_swap: \"ok_lctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_lctxt.induct) auto\n\nlemma ok_lctxt_cong: \"ok_lctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_lctxt.induct) simp_all\n\nlemma qtable_l\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_lctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` LPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.lpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (l\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_lctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(1) qtable_\\_lax[OF _ _ _ MTimes(2)]]\n elim!: ok_lctxt.intros(2) simp: MTimesR_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_lctxt.intros simp: MTimesR_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_l\\ = qtable_l\\\\[OF _ _ _ ok_lctxt.intros(1), unfolded lpd\\_lpd image_id id_apply]\n\nlemma RPD_fv_regex_le:\n \"ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesL_def split: nat.splits)+\n\nlemma RPD_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPD mr \\ safe_regex Past g (from_mregex ms \\s)\"\nproof (induct Past g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesP g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesP(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le TimesP(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma RPDi_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> safe_regex Past g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: RPD_safe)\n\nlemma RPDs_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> safe_regex Past g (from_mregex ms \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe)\n\nlemma RPD_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le)\nqed\n\nlemma RPDi_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: RPD_safe_fv_regex RPD_safe)\n\nlemma RPDs_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe_fv_regex)\n\nlemma RPD_ok: \"ok m mr \\ ms \\ RPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesL_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesL_def)\nqed (auto split: nat.splits)\n\nlemma RPDi_ok: \"ok m mr \\ ms \\ RPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: RPD_ok)\n\nlemma RPDs_ok: \"ok m mr \\ ms \\ RPDs mr \\ ok m ms\"\n unfolding RPDs_def by (auto intro: RPDi_ok)\n\nlemma LPD_fv_regex_le:\n \"ms \\ LPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesR_def split: nat.splits)+\n\nlemma LPD_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPD mr ==> safe_regex Futu g (from_mregex ms \\s)\"\nproof (induct Futu g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesF g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesF(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits dest: TimesF(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma LPDi_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: LPD_safe)\n\nlemma LPDs_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe)\n\nlemma LPD_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPD mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le)\nqed\n\nlemma LPDi_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: LPD_safe_fv_regex LPD_safe)\n\nlemma LPDs_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe_fv_regex)\n\nlemma LPD_ok: \"ok m mr \\ ms \\ LPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesR_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesR_def)\nqed (auto split: nat.splits)\n\nlemma LPDi_ok: \"ok m mr \\ ms \\ LPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: LPD_ok)\n\nlemma LPDs_ok: \"ok m mr \\ ms \\ LPDs mr \\ ok m ms\"\n unfolding LPDs_def by (auto intro: LPDi_ok)\n\nlemma update_matchP:\n assumes pre: \"wf_matchP_aux \\ V n R I r aux ne\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel) \\s rels\"\n and result_eq: \"(rel, aux') = update_matchP n I mr mrs rels (\\ \\ ne) aux\"\n shows \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n and \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv_regex r) v\"\n let ?update = \"\\rel t. mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = \\ \\ ne then r\\_strict n rels mr else {}))\"\n note sat.simps[simp del]\n\n define aux0 where \"aux0 = [(t, ?update rel t). (t, rel) \\ aux, memR I (\\ \\ ne - t)]\"\n have sorted_aux0: \"sorted_wrt (\\x y. fst x > fst y) aux0\"\n using pre[unfolded wf_matchP_aux_def, THEN conjunct1]\n unfolding aux0_def\n by (induction aux) (auto simp add: sorted_wrt_append)\n { fix ms\n assume \"ms \\ RPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Past Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"RPD ms \\ RPDs mr\"\n using safe RPDs_safe RPDs_safe_fv_regex mr from_mregex_to_mregex RPDs_ok to_mregex_ok RPDs_trans\n by fastforce+\n } note * = this\n have **: \"\\ \\ ne - (\\ \\ i + \\ \\ ne - \\ \\ (ne - Suc 0)) = \\ \\ (ne - Suc 0) - \\ \\ i\" for i\n by (metis (no_types, lifting) Nat.diff_diff_right \\_mono add.commute add_diff_cancel_left diff_le_self le_add2 order_trans)\n have ***: \"\\ \\ i = \\ \\ ne\"\n if \"\\ \\ ne \\ \\ \\ i\" \"\\ \\ i \\ \\ \\ (ne - Suc 0)\" \"ne > 0\" for i\n by (metis (no_types, lifting) Suc_pred \\_mono diff_le_self le_\\_less le_antisym not_less_eq that)\n then have in_aux0_1: \"(t, X) \\ set aux0 \\ ne \\ 0 \\ t \\ \\ \\ ne \\ memR I (\\ \\ ne - t) \\\n (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\" for t X\n unfolding aux0_def using safe mr mrs\n by (auto simp: lookup_tabulate map_of_map_restrict restrict_map_def finite_RPDs * ** RPDs_trans diff_le_mono2\n intro!: sat_MatchP_rec[of \\ _ _ ne, THEN iffD2]\n qtable_union[OF qtable_r\\[OF _ _ qtables] qtable_r\\_strict[OF _ _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point 0) r)\" _ ms for ms]\n qtable_cong[OF qtable_r\\[OF _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point (\\ \\ (ne - Suc 0) - \\ \\ i)) r)\"\n _ _ \"(\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - \\ \\ i)) (from_mregex ms \\s)))\" for ms i]\n dest!: assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct1, rule_format]\n sat_MatchP_rec[\"of\" \\ _ _ ne, THEN iffD1]\n elim!: bspec order.trans[OF _ \\_mono] bexI[rotated] split: option.splits if_splits) (* slow 7 sec *)\n then have in_aux0_le_\\: \"(t, X) \\ set aux0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_aux0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ memR I (\\ \\ ne - t) \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set aux0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set aux\"\n by (atomize_elim, intro assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct2, rule_format])\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\memR I (\\ \\ ne - t)\\ have \"(t, ?update X t) \\ set aux0\"\n unfolding aux0_def by (auto simp: id_def elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set aux0\"\n by blast\n qed\n have aux0_Nil: \"aux0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ memR I (\\ \\ ne - t) \\\n (\\i. \\ \\ i = t))\"\n using in_aux0_2 by (cases \"ne = 0\") (auto)\n\n have aux'_eq: \"aux' = (case aux0 of\n [] \\ [(\\ \\ ne, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = \\ \\ ne then x # aux'\n else (\\ \\ ne, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\"\n using result_eq unfolding aux0_def update_matchP_def Let_def by simp\n have sorted_aux': \"sorted_wrt (\\x y. fst x > fst y) aux'\"\n unfolding aux'_eq\n using sorted_aux0 in_aux0_le_\\ by (cases aux0) (fastforce)+\n\n have in_aux'_1: \"t \\ \\ \\ ne \\ memR I (\\ \\ ne - t) \\ (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\"\n if aux': \"(t, X) \\ set aux'\" for t X\n proof (cases aux0)\n case Nil\n with aux' show ?thesis\n unfolding aux'_eq using safe mrs qtables aux0_Nil *\n by (auto simp: zero_enat_def[symmetric] sat_MatchP_rec[where i=ne]\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict]\n dest: spec[of _ \"\\ \\ (ne-1)\"])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with aux' Cons t have \"X = snd a\"\n unfolding aux'_eq using sorted_aux0 by auto\n moreover from in_aux0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ ne\" \"memR I (\\ \\ ne - fst a)\" \"\\i. \\ \\ i = fst a\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - fst a)) (from_mregex ms \\s))) (lookup (snd a) ms)\"\n by auto\n ultimately show ?thesis using t True\n by auto\n next\n case False\n with aux' Cons t have \"X = mrtabulate mrs (r\\_strict n rels)\"\n unfolding aux'_eq using sorted_aux0 in_aux0_le_\\[of \"fst a\" \"snd a\"] by auto\n with aux' Cons t False show ?thesis\n unfolding aux'_eq using safe mrs qtables * in_aux0_2[of \"\\ \\ (ne-1)\"] in_aux0_le_\\[of \"fst a\" \"snd a\"] sorted_aux0\n by (auto simp: sat_MatchP_rec[where i=ne] zero_enat_def[symmetric] enat_0_iff not_le\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with aux' Cons have \"(t, X) \\ set aux0\"\n unfolding aux'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ ne\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms)\"\n using in_aux0_1 by blast+\n with False aux' Cons show ?thesis\n unfolding aux'_eq by auto\n qed\n qed\n\n have in_aux'_2: \"\\X. (t, X) \\ set aux'\" if \"t \\ \\ \\ ne\" \"memR I (\\ \\ ne - t)\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases aux0)\n case Nil\n with True show ?thesis unfolding aux'_eq by simp\n next\n case (Cons a as)\n with True show ?thesis unfolding aux'_eq using eq_fst_iff[of t a]\n by (cases \"fst a = \\ \\ ne\") auto\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set aux0\" using \\memR I (\\ \\ ne - t)\\ \\\\i. \\ \\ i = t\\\n by atomize_elim (auto intro!: in_aux0_2)\n then show ?thesis unfolding aux'_eq using False\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n unfolding wf_matchP_aux_def using mr\n by (auto dest: in_aux'_1 intro: sorted_aux' in_aux'_2)\n\n have rel_eq: \"rel = foldr (\\) [lookup rel mr. (t, rel) \\ aux', memL I (\\ \\ ne - t)] {}\"\n unfolding aux'_eq aux0_def\n using result_eq by (simp add: update_matchP_def Let_def)\n have rel_alt: \"rel = (\\(t, rel) \\ set aux'. if memL I (\\ \\ ne - t) then lookup rel mr else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)\n show \"qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\n unfolding rel_alt\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n memL I (\\ \\ ne - t) \\ Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) r)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n proof (rule iffI, erule sat_MatchP_point, goal_cases left right)\n case (left j)\n then show ?case using in_aux'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_MatchP_pointD dest: in_aux'_1)\n qed\n qed (auto dest!: in_aux'_1 intro!: qtable_empty dest!: bspec[OF _ RPDs_refl]\n simp: from_mregex_eq[OF safe mr])\nqed\n\nlemma length_update_until: \"length (update_until args rel1 rel2 nt aux) = Suc (length aux)\"\n unfolding update_until_def by simp\n\nlemma wf_update_until_auxlist:\n assumes pre: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_auxlist \\ V n R pos \\ I \\ (update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist) ne\"\n unfolding wf_until_auxlist_def length_update_until\n unfolding update_until_def list.rel_map add_Suc_right upt.simps eqTrueI[OF le_add1] if_True\nproof (rule list_all2_appendI, unfold list.rel_map, goal_cases old new)\n case old\n show ?case\n proof (rule list.rel_mono_strong[OF assms(1)[unfolded wf_until_auxlist_def]]; safe, goal_cases mono1 mono2)\n case (mono1 i X Y v)\n then show ?case\n by (fastforce simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq\n elim!: qtable_join[OF _ qtable1] qtable_union[OF _ qtable1])\n next\n case (mono2 i X Y v)\n then show ?case using fvi_subset\n by (auto 0 3 simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq split: if_splits\n elim!: qtable_union[OF _ qtable_join_fixed[OF qtable2]]\n elim: qtable_cong[OF _ refl] intro: exI[of _ \"ne + length auxlist\"]) (* slow 8 sec*)\n qed\nnext\n case new\n then show ?case\n by (auto intro!: qtable_empty qtable1 qtable2[THEN qtable_cong] exI[of _ \"ne + length auxlist\"]\n simp: args_ivl args_n args_pos less_Suc_eq zero_enat_def[symmetric])\nqed\n\nlemma (in muaux) wf_update_until:\n assumes pre: \"wf_until_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_aux \\ V R args \\ \\ (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) ne \\\n length_muaux args (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) = Suc (length_muaux args aux)\"\nproof -\n from pre obtain cur auxlist where valid_aux: \"valid_muaux args cur aux auxlist\" and\n cur: \"cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1))\" and\n pre_list: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n unfolding wf_until_aux_def args_ivl args_n args_pos by auto\n have length_aux: \"length_muaux args aux = length auxlist\"\n using valid_length_muaux[OF valid_aux] .\n define nt where \"nt \\ \\ \\ (ne + length_muaux args aux)\"\n have nt_mono: \"cur \\ nt\"\n unfolding cur nt_def length_aux by simp\n define auxlist' where \"auxlist' \\ update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist\"\n have length_auxlist': \"length auxlist' = Suc (length auxlist)\"\n unfolding auxlist'_def by (auto simp add: length_update_until)\n have tab1: \"table (args_n args) (args_L args) rel1\"\n using qtable1 unfolding args_n[symmetric] args_L[symmetric] by (auto simp add: qtable_def)\n have tab2: \"table (args_n args) (args_R args) rel2\"\n using qtable2 unfolding args_n[symmetric] args_R[symmetric] by (auto simp add: qtable_def)\n have fv_sub: \"fv \\ \\ fv \\\"\n using pre unfolding wf_until_aux_def by auto\n moreover have valid_add_new_auxlist: \"valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux) auxlist'\"\n using valid_add_new_muaux[OF valid_aux tab1 tab2 nt_mono]\n unfolding auxlist'_def nt_def length_aux .\n moreover have \"length_muaux args (add_new_muaux args rel1 rel2 nt aux) = Suc (length_muaux args aux)\"\n using valid_length_muaux[OF valid_add_new_auxlist] unfolding length_auxlist' length_aux[symmetric] .\n moreover have \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist' ne\"\n using wf_update_until_auxlist[OF pre_list qtable1[unfolded length_aux] qtable2[unfolded length_aux] fv_sub args_ivl args_n args_pos]\n unfolding auxlist'_def .\n moreover have \"\\ \\ (ne + length auxlist) = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\"\n unfolding cur length_auxlist' by auto\n ultimately show ?thesis\n using pre\n unfolding wf_until_aux_def nt_def length_aux args_ivl args_n args_pos\n by fast\nqed\n\nlemma length_update_matchF_base:\n \"length (fst (update_matchF_base I mr mrs nt entry st)) = Suc 0\"\n by (auto simp: Let_def update_matchF_base_def)\n\nlemma length_update_matchF_step:\n \"length (fst (update_matchF_step I mr mrs nt entry st)) = Suc (length (fst st))\"\n by (auto simp: Let_def update_matchF_step_def split: prod.splits)\n\nlemma length_foldr_update_matchF_step:\n \"length (fst (foldr (update_matchF_step I mr mrs nt) aux base)) = length aux + length (fst base)\"\n by (induct aux arbitrary: base) (auto simp: Let_def length_update_matchF_step)\n\nlemma length_update_matchF: \"length (update_matchF n I mr mrs rels nt aux) = Suc (length aux)\"\n unfolding update_matchF_def update_matchF_base_def length_foldr_update_matchF_step\n by (auto simp: Let_def)\n\nlemma wf_update_matchF_base_invar:\n assumes safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_base n I mr mrs rels (\\ \\ j)) j\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n show ?thesis\n unfolding wf_matchF_invar_def wf_matchF_aux_def update_matchF_base_def mr prod.case Let_def mrs\n using safe\n by (auto simp: * from_mregex qtables qtable_empty_iff zero_enat_def[symmetric]\n lookup_tabulate finite_LPDs eps_match less_Suc_eq LPDs_refl\n intro!: qtable_cong[OF qtable_l\\_strict[where \\s=\\s]] intro: qtables exI[of _ j]\n split: option.splits)\nqed\n\nlemma Un_empty_table[simp]: \"rel \\ empty_table = rel\" \"empty_table \\ rel = rel\"\n unfolding empty_table_def by auto\n\nlemma wf_matchF_invar_step:\n assumes wf: \"wf_matchF_invar \\ V n R I r st (Suc i)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and rel: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < i + length (fst st) \\ mem I ((\\ \\ j - \\ \\ i)) \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n and entry: \"entry = (\\ \\ i, rels, rel)\"\n and nt: \"nt = \\ \\ (i + length (fst st))\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_step I mr mrs nt entry st) i\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n { fix aux X ms\n assume \"st = (aux, X)\" \"ms \\ LPDs mr\"\n with wf mr have \"qtable n (fv_regex r) (mem_restr R)\n (\\v. Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux))\n (l\\ (\\x. x) X rels ms)\"\n by (intro qtable_cong[OF qtable_l\\[where \\s=\\s and A=\"fv_regex r\" and\n Q=\"\\v r. Regex.match (Formula.sat \\ V v) r (Suc i) (i + length aux)\", OF _ _ qtables]])\n (auto simp: wf_matchF_invar_def * LPDs_trans lpd_match[of i] elim!: bspec)\n } note l\\ = this\n have \"lookup (mrtabulate mrs f) ms = f ms\" if \"ms \\ LPDs mr\" for ms and f :: \"mregex \\ 'a table\"\n using that mrs by (fastforce simp: lookup_tabulate finite_LPDs split: option.splits)+\n then show ?thesis\n using wf mr mrs entry nt LPDs_trans\n by (auto 0 3 simp: Let_def wf_matchF_invar_def update_matchF_step_def wf_matchF_aux_def mr * LPDs_refl\n list_all2_Cons1 append_eq_Cons_conv upt_eq_Cons_conv Suc_le_eq qtables\n lookup_tabulate finite_LPDs id_def l\\ from_mregex less_Suc_eq\n intro!: qtable_union[OF rel l\\] qtable_cong[OF rel]\n intro: exI[of _ \"i + length _\"]\n split: if_splits prod.splits)\nqed\n\nlemma wf_update_matchF_invar:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne (length (fst st) - 1)\"\n and wf: \"wf_matchF_invar \\ V n R I r st (ne + length aux)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and j: \"j = ne + length aux + length (fst st) - 1\"\n shows \"wf_matchF_invar \\ V n R I r (foldr (update_matchF_step I mr mrs (\\ \\ j)) aux st) ne\"\n using pre wf unfolding j\nproof (induct aux arbitrary: ne)\n case (Cons entry aux)\n from Cons(1)[of \"Suc ne\"] Cons(2,3) show ?case\n unfolding foldr.simps o_apply\n by (intro wf_matchF_invar_step[where rels = \"fst (snd entry)\" and rel = \"snd (snd entry)\"])\n (auto simp: safe mr mrs wf_matchF_aux_def wf_matchF_invar_def list_all2_Cons1 append_eq_Cons_conv\n Suc_le_eq upt_eq_Cons_conv length_foldr_update_matchF_step add.assoc split: if_splits)\nqed simp\n\n\nlemma wf_update_matchF:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne 0\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and nt: \"nt = \\ \\ (ne + length aux)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length aux) \\) rel) \\s rels\"\n shows \"wf_matchF_aux \\ V n R I r (update_matchF n I mr mrs rels nt aux) ne 0\"\n unfolding update_matchF_def using wf_update_matchF_base_invar[OF safe mr mrs qtables, of I]\n unfolding nt\n by (intro wf_update_matchF_invar[OF _ _ safe mr mrs, unfolded wf_matchF_invar_def split_beta, THEN conjunct2, THEN conjunct1])\n (auto simp: length_update_matchF_base wf_matchF_invar_def update_matchF_base_def Let_def pre)\n\nlemma wf_until_aux_Cons: \"wf_until_auxlist \\ V n R pos \\ I \\ (a # aux) ne \\\n wf_until_auxlist \\ V n R pos \\ I \\ aux (Suc ne)\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong)\n\nlemma wf_matchF_aux_Cons: \"wf_matchF_aux \\ V n R I r (entry # aux) ne i \\\n wf_matchF_aux \\ V n R I r aux (Suc ne) i\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong split: prod.splits)\n\nlemma wf_until_aux_Cons1: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\ t = \\ \\ ne\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons1: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\ t = \\ \\ ne\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma wf_until_aux_Cons3: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux) \\ mem I ((\\ \\ j - \\ \\ ne)) \\\n Formula.sat \\ V (map the v) j \\ \\ (\\k\\{ne.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) a2\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons3: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux + i) \\ mem I ((\\ \\ j - \\ \\ ne)) \\\n Regex.match (Formula.sat \\ V (map the v)) r ne j)) rel\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma upt_append: \"a \\ b \\ b \\ c \\ [a.. ja'\" \"jb \\ jb'\"\n shows \"wf_mbuf2 i ja' jb' P Q (mbuf2_add xs ys buf)\"\n using assms unfolding wf_mbuf2_def\n by (auto 0 3 simp: list_all2_append2 upt_append dest: list_all2_lengthD\n intro: exI[where x=\"[i..j j'. [j..) js js'\"\n shows \"wf_mbufn i js' Ps (mbufn_add xss buf)\"\n unfolding wf_mbufn_def list_all3_conv_all_nth\nproof safe\n show \"length Ps = length js'\" \"length js' = length (mbufn_add xss buf)\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth by auto\nnext\n fix k assume k: \"k < length Ps\"\n then show \"i \\ js' ! k\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth\n by (auto 0 4 dest: spec[of _ i])\n from k have \" [i..i z. \\x y. P i x \\ Q i y \\ z = f x y) [i.. xs = [] \\ ys = []\"\n \"list_all3 P xs [] zs \\ xs = [] \\ zs = []\"\n \"list_all3 P [] ys zs \\ ys = [] \\ zs = []\"\n unfolding list_all3_conv_all_nth by auto\n\nlemma list_all3_Cons:\n \"list_all3 P xs ys (z # zs) \\ (\\x xs' y ys'. xs = x # xs' \\ ys = y # ys' \\ P x y z \\ list_all3 P xs' ys' zs)\"\n \"list_all3 P xs (y # ys) zs \\ (\\x xs' z zs'. xs = x # xs' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs' ys zs')\"\n \"list_all3 P (x # xs) ys zs \\ (\\y ys' z zs'. ys = y # ys' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs ys' zs')\"\n unfolding list_all3_conv_all_nth\n by (auto simp: length_Suc_conv Suc_length_conv nth_Cons split: nat.splits)\n\nlemma list_all3_mono_strong: \"list_all3 P xs ys zs \\\n (\\x y z. x \\ set xs \\ y \\ set ys \\ z \\ set zs \\ P x y z \\ Q x y z) \\\n list_all3 Q xs ys zs\"\n by (induct xs ys zs rule: list_all3.induct) (auto intro: list_all3.intros)\n\ndefinition Mini where\n \"Mini i js = (if js = [] then i else Min (set js))\"\n\nlemma wf_mbufn_in_set_Mini:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ Mini i js = i\"\n unfolding in_set_conv_nth\nproof (elim exE conjE)\n fix k\n have \"i \\ j\" if \"j \\ set js\" for j\n using that assms unfolding wf_mbufn_def list_all3_conv_all_nth in_set_conv_nth by auto\n moreover assume \"k < length buf\" \"buf ! k = []\"\n ultimately show ?thesis using assms\n unfolding Mini_def wf_mbufn_def list_all3_conv_all_nth\n by (auto 0 4 dest!: spec[of _ k] intro: Min_eqI simp: in_set_conv_nth)\nqed\n\nlemma wf_mbufn_notin_set:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ j \\ set js \\ i < j\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth\n by (cases \"i \\ set js\") (auto intro: le_neq_implies_less simp: in_set_conv_nth)\n\nlemma wf_mbufn_map_tl:\n \"wf_mbufn i js Ps buf \\ [] \\ set buf \\ wf_mbufn (Suc i) js Ps (map tl buf)\"\n by (auto simp: wf_mbufn_def list_all3_map Suc_le_eq\n dest: rel_funD[OF tl_transfer] elim!: list_all3_mono_strong le_neq_implies_less)\n\nlemma list_all3_list_all2I: \"list_all3 (\\x y z. Q x z) xs ys zs \\ list_all2 Q xs zs\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma mbuf2t_take_eqD:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n shows \"wf_mbuf2 (min ja jb) ja jb P Q buf'\"\n and \"list_all2 R [min ja jb.. set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n from nonempty rec.prems(2) have \"Mini i js = Mini (Suc i) js\"\n unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k. k \\ set js \\ k \\ j\"\n and \"k = Mini (i + length nts) js\"\n shows \"wf_mbufn k js Ps buf'\"\n and \"list_all2 R [k.. []\"\n using that by (fastforce simp flip: length_greater_0_conv)\n with 2 show ?case\n using wf_mbufn_in_set_Mini[OF 2(2)] wf_mbufn_notin_set[OF 2(2)]\n by (subst (asm) mbufnt_take.simps) (force simp: Mini_def wf_mbufn_def\n dest!: IH(2)[rotated, OF _ wf_mbufn_map_tl[OF 2(2)] *]\n split: if_splits prod.splits)\nqed\n\nlemma mbuf2t_take_induct[consumes 5, case_names base step]:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n and \"U i z\"\n and \"\\k x y t z. i \\ k \\ Suc k \\ ja \\ Suc k \\ jb \\\n P k x \\ Q k y \\ R k t \\ U k z \\ U (Suc k) (f x y t z)\"\n shows \"U (min ja jb) z'\"\n using assms unfolding wf_mbuf2_def\n by (induction f z buf nts arbitrary: i z' buf' nts' rule: mbuf2t_take.induct)\n (auto simp add: list_all2_Cons2 upt_eq_Cons_conv less_eq_Suc_le min_absorb1 min_absorb2\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated] split: prod.split)\n\nlemma list_all2_hdD:\n assumes \"list_all2 P [i.. []\"\n shows \"P i (hd xs)\" \"i < j\"\n using assms unfolding list_all2_conv_all_nth\n by (auto simp: hd_conv_nth intro: zero_less_diff[THEN iffD1] dest!: spec[of _ 0])\n\nlemma list_all2_lastD:\n assumes \"list_all2 P [i.. []\"\n shows \"P (j - 1) (last xs)\"\n using assms list_all2_hdD(2)[OF assms, THEN less_imp_add_positive] unfolding list_all2_conv_all_nth\n by (auto dest!: spec[of _ \"length xs - 1\"] simp: last_conv_nth Suc_le_eq)\n\nlemma mbufn_take_induct[consumes 3, case_names base step]:\n assumes \"mbufn_take f z buf = (z', buf')\"\n and \"wf_mbufn i js Ps buf\"\n and \"U i z\"\n and \"\\k xs z. i \\ k \\ Suc k \\ Mini i js \\\n list_all2 (\\P x. P k x) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n shows \"U (Mini i js) z'\"\n using assms unfolding wf_mbufn_def\nproof (induction f z buf arbitrary: i z' buf' rule: mbufn_take.induct)\n case rec: (1 f z buf)\n show ?case proof (cases \"buf = []\")\n case True\n with rec.prems show ?thesis unfolding Mini_def by simp\n next\n case nonempty: False\n show ?thesis proof (cases \"[] \\ set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n with nonempty rec.prems(2) have more: \"Suc i \\ Mini i js\"\n using diff_is_0_eq not_le unfolding Mini_def\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n then have \"Mini i js = Mini (Suc i) js\" unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"mbufn_take f (f (map hd buf) z) (map tl buf) = (z', buf')\"\n using nonempty False rec.prems by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k xs z. Suc i \\ k \\ Suc k \\ Mini (Suc i) js \\\n list_all2 (\\P. P k) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n by (rule rec.prems(4)) (auto simp: Mini_def)\n qed\n qed\n qed\nqed\n\nlemma mbufnt_take_induct[consumes 5, case_names base step]:\n assumes \"mbufnt_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbufn i js Ps buf\"\n and \"list_all2 R [i..k. k \\ set js \\ k \\ j\"\n and \"U i z\"\n and \"\\k xs t z. i \\ k \\ Suc k \\ Mini j js \\\n list_all2 (\\P x. P k x) Ps xs \\ R k t \\ U k z \\ U (Suc k) (f xs t z)\"\n shows \"U (Mini (i + length nts) js) z'\"\n using assms\nproof (induction f z buf nts arbitrary: i z' buf' nts' rule: mbufnt_take.induct)\n case (1 f z buf nts)\n then have *: \"list_all2 R [Suc i.. []\" \"nts = []\"\n using that unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)]\n by (fastforce simp: Mini_def list_all3_Cons neq_Nil_conv)\n with 1(2-7) list_all2_hdD[OF 1(4)] show ?case\n unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)] wf_mbufn_notin_set[OF 1(3)]\n by (subst (asm) mbufnt_take.simps)\n (auto simp add: Mini_def list.rel_map Suc_le_eq\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated]\n list_all3_mono_strong[THEN list_all3_list_all2I[of _ _ js]] list_all2_hdD\n dest!: 1(1)[rotated, OF _ wf_mbufn_map_tl[OF 1(3)] * _ 1(7)] split: prod.split if_splits)\nqed\n\nlemma mbuf2_take_add':\n assumes eq: \"mbuf2_take f (mbuf2_add xs ys buf) = (zs, buf')\"\n and pre: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and rm: \"rel_mapping (\\) P P'\"\n and xs: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"list_all2 (\\i Z. \\X Y.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) Y \\\n Z = f X Y)\n [min (progress \\ P \\ j) (progress \\ P \\ j).. P' \\ j') (progress \\ P' \\ j')] zs\"\n using pre rm unfolding wf_mbuf2'_def\n by (force intro!: mbuf2_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm])+\n\nlemma mbuf2t_take_add':\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"wf_ts \\ P' j' \\ \\ nts'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def wf_ts_def\n by (auto intro!: mbuf2t_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen)\n\nlemma ok_0_atms: \"ok 0 mr \\ regex.atms (from_mregex mr []) = {}\"\n by (induct mr) auto\n\nlemma ok_0_progress: \"ok 0 mr \\ progress_regex \\ P (from_mregex mr []) j = j\"\n by (drule ok_0_atms) (auto simp: progress_regex_def)\n\nlemma atms_empty_atms: \"safe_regex m g r \\ atms r = {} \\ regex.atms r = {}\"\n by (induct r rule: safe_regex_induct) (auto split: if_splits simp: cases_Neg_iff)\n\nlemma atms_empty_progress: \"safe_regex m g r \\ atms r = {} \\ progress_regex \\ P r j = j\"\n by (drule atms_empty_atms) (auto simp: progress_regex_def)\n\nlemma to_mregex_empty_progress: \"safe_regex m g r \\ to_mregex r = (mr, []) \\\n progress_regex \\ P r j = j\"\n using from_mregex_eq ok_0_progress to_mregex_ok atms_empty_atms by fastforce\n\nlemma progress_regex_le: \"pred_mapping (\\x. x \\ j) P \\ progress_regex \\ P r j \\ j\"\n by (auto intro!: progress_le_gen simp: Min_le_iff progress_regex_def)\n\nlemma Neg_acyclic: \"formula.Neg x = x \\ P\"\n by (induct x) auto\n\nlemma case_Neg_in_iff: \"x \\ (case y of formula.Neg \\' \\ {\\'} | _ \\ {}) \\ y = formula.Neg x\"\n by (cases y) auto\n\nlemma atms_nonempty_progress:\n \"safe_regex m g r \\ atms r \\ {} \\ (\\\\. progress \\ P \\ j) ` atms r = (\\\\. progress \\ P \\ j) ` regex.atms r\"\n by (frule atms_empty_atms; simp)\n (auto 0 3 simp: atms_def image_iff case_Neg_in_iff elim!: disjE_Not2 dest: safe_regex_safe_formula)\n\nlemma to_mregex_nonempty_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ \\s \\ [] \\\n progress_regex \\ P r j = (MIN \\\\set \\s. progress \\ P \\ j)\"\n using atms_nonempty_progress to_mregex_ok unfolding progress_regex_def by fastforce\n\nlemma to_mregex_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\\n progress_regex \\ P r j = (if \\s = [] then j else (MIN \\\\set \\s. progress \\ P \\ j))\"\n using to_mregex_nonempty_progress to_mregex_empty_progress unfolding progress_regex_def by auto\n\nlemma mbufnt_take_add':\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n shows \"wf_mbufn' \\ P' V j' n R r buf'\"\n and \"wf_ts_regex \\ P' j' r nts'\"\n using pre_buf pre_nts bounded rm mr safe xss \\j \\ j'\\ unfolding wf_mbufn'_def wf_ts_regex_def\n using atms_empty_progress[of m g r] to_mregex_ok[OF mr]\n by (auto 0 3 simp: list.rel_map to_mregex_empty_progress to_mregex_nonempty_progress Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n dest: list_all2_lengthD elim!: mbufnt_take_eqD[OF eq wf_mbufn_add])\n\nlemma mbuf2t_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n and base: \"U (min (progress \\ P \\ j) (progress \\ P \\ j)) z\"\n and step: \"\\k X Y z. min (progress \\ P \\ j) (progress \\ P \\ j) \\ k \\\n Suc k \\ progress \\ P' \\ j' \\ Suc k \\ progress \\ P' \\ j' \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) Y \\\n U k z \\ U (Suc k) (f X Y (\\ \\ k) z)\"\n shows \"U (min (progress \\ P' \\ j') (progress \\ P' \\ j')) z'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def\n by (blast intro!: mbuf2t_take_induct[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen base step)\n\nlemma mbufnt_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n and base: \"U (progress_regex \\ P r j) z\"\n and step: \"\\k Xs z. progress_regex \\ P r j \\ k \\ Suc k \\ progress_regex \\ P' r j' \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\)) \\s Xs \\\n U k z \\ U (Suc k) (f Xs (\\ \\ k) z)\"\n shows \"U (progress_regex \\ P' r j') z'\"\n using pre_buf pre_nts bounded rm \\j \\ j'\\ to_mregex_progress[OF safe mr, of \\ P' j'] to_mregex_empty_progress[OF safe, of mr \\ P j] base\n unfolding wf_mbufn'_def mr prod.case\n by (fastforce dest!: mbufnt_take_induct[OF eq wf_mbufn_add[OF _ xss] pre_nts, of U]\n simp: list.rel_map le_imp_diff_is_add ac_simps Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n intro!: base step dest: list_all2_lengthD split: if_splits)\n\nlemma progress_Until_le: \"progress \\ P (Formula.Until \\ I \\) j \\ min (progress \\ P \\ j) (progress \\ P \\ j)\"\n by (auto simp: trans_le_add1 intro!: cInf_lower)\n\nlemma progress_MatchF_le: \"progress \\ P (Formula.MatchF I r) j \\ progress_regex \\ P r j\"\n by (auto simp: trans_le_add1 progress_regex_def intro!: cInf_lower)\n\nlemma list_all2_upt_Cons: \"P a x \\ list_all2 P [Suc a.. Suc a \\ b \\\n list_all2 P [a.. list_all2 P [b..\n a \\ b \\ b \\ c \\ list_all2 P [a..x. R x x) xs ys\"\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth)\n\nlemma map_split_map: \"map_split f (map g xs) = map_split (f o g) xs\"\n by (induct xs) auto\n\nlemma map_split_alt: \"map_split f xs = (map (fst o f) xs, map (snd o f) xs)\"\n by (induct xs) (auto split: prod.splits)\n\nlemma fv_formula_of_constraint: \"fv (formula_of_constraint (t1, p, c, t2)) = fv_trm t1 \\ fv_trm t2\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct) simp_all\n\nlemma (in maux) wf_mformula_wf_set: \"wf_mformula \\ j P V n R \\ \\' \\ wf_set n (Formula.fv \\')\"\n unfolding wf_set_def\nproof (induction rule: wf_mformula.induct)\n case (AndRel P V n R \\ \\' \\' conf)\n then show ?case by (auto simp: fv_formula_of_constraint dest!: subsetD)\nnext\n case (Ands P V n R l l_pos l_neg l' buf A_pos A_neg)\n from Ands.IH have \"\\\\'\\set (l_pos @ map remove_neg l_neg). \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \"_ @ _\"] del: set_append)\n then have \"\\\\'\\set (l_pos @ l_neg). \\x\\fv \\'. x < n\"\n by (auto dest: bspec[where x=\"remove_neg _\"])\n then show ?case using Ands.hyps(2) by auto\nnext\n case (Agg P V b n R \\ \\' y f g0 \\)\n then have \"Formula.fvi_trm b f \\ Formula.fvi b \\'\"\n by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n with Agg show ?case by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=b])\nnext\n case (Since P V n R \\ \\' \\ \\' args \\'' I R' buf nts aux)\n then have valid: \"valid_aggargs n (Formula.fv \\') (args_agg args)\"\n by (auto simp: wf_since_aux_def)\n then show ?case\n using Since(3,6,11,14,15)\n proof (cases \"args_agg args\")\n case (Some aggargs)\n have \"Formula.fvi_trm (aggargs_b aggargs) (aggargs_f aggargs) \\ Formula.fvi (aggargs_b aggargs) (formula.Since \\' I \\')\"\n using valid\n by (auto simp: fvi_trm_iff_fv_trm[where b=\"aggargs_b aggargs\"] fvi_iff_fv[where b=\"aggargs_b aggargs\"] valid_aggargs_def safe_aggargs_def Some)\n then show ?thesis\n using Since(3,6,11,14,15) valid\n by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=\"aggargs_b aggargs\"] packagg_def agg_n_def Some valid_aggargs_def safe_aggargs_def split: if_splits)\n qed (auto simp: packagg_def agg_n_def split: if_splits)\nnext\n case (Until P V n R \\ \\' \\ \\' args \\'' I R' buf nts t aux)\n then have valid: \"valid_aggargs n (Formula.fv \\') (args_agg args)\"\n by (auto simp: wf_until_aux_def)\n then show ?case\n using Until(3,6,11,16,17)\n proof (cases \"args_agg args\")\n case (Some aggargs)\n have \"Formula.fvi_trm (aggargs_b aggargs) (aggargs_f aggargs) \\ Formula.fvi (aggargs_b aggargs) (formula.Since \\' I \\')\"\n using valid\n by (auto simp: fvi_trm_iff_fv_trm[where b=\"aggargs_b aggargs\"] fvi_iff_fv[where b=\"aggargs_b aggargs\"] valid_aggargs_def safe_aggargs_def Some)\n then show ?thesis\n using Until(3,6,11,16,17) valid\n by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=\"aggargs_b aggargs\"] packagg_def agg_n_def Some valid_aggargs_def safe_aggargs_def split: if_splits)\n qed (auto simp: packagg_def agg_n_def split: if_splits)\nnext\n case (MatchP r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchP have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nnext\n case (MatchF r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchF have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nqed (auto simp: fvi_Suc split: if_splits)\n\nlemma qtable_mmulti_join:\n assumes pos: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_pos Q_pos L_pos\"\n and neg: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_neg Q_neg L_neg\"\n and C_eq: \"C = \\(set A_pos)\" and L_eq: \"L = L_pos @ L_neg\"\n and \"A_pos \\ []\" and fv_subset: \"\\(set A_neg) \\ \\(set A_pos)\"\n and restrict_pos: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_pos\"\n and restrict_neg: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_neg\"\n and Qs: \"\\x. wf_tuple n C x \\ P x \\ Q x \\\n list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n shows \"qtable n C P Q (mmulti_join n A_pos A_neg L)\"\nproof (rule qtableI)\n from pos have 1: \"list_all2 (\\A X. table n A X \\ wf_set n A) A_pos L_pos\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n moreover from neg have \"list_all2 (\\A X. table n A X \\ wf_set n A) A_neg L_neg\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n ultimately have L: \"list_all2 (\\A X. table n A X \\ wf_set n A) (A_pos @ A_neg) (L_pos @ L_neg)\"\n by (rule list_all2_appendI)\n note in_join_iff = mmulti_join_correct[OF \\A_pos \\ []\\ L]\n from 1 have take_eq: \"take (length A_pos) (L_pos @ L_neg) = L_pos\"\n by (auto dest!: list_all2_lengthD)\n from 1 have drop_eq: \"drop (length A_pos) (L_pos @ L_neg) = L_neg\"\n by (auto dest!: list_all2_lengthD)\n\n note mmulti_join.simps[simp del]\n show \"table n C (mmulti_join n A_pos A_neg L)\"\n unfolding C_eq L_eq table_def by (simp add: in_join_iff)\n show \"Q x\" if \"x \\ mmulti_join n A_pos A_neg L\" \"wf_tuple n C x\" \"P x\" for x\n using that(2,3)\n proof (rule Qs[THEN iffD2, OF _ _ conjI])\n have pos': \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n and neg': \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using that(1) unfolding L_eq in_join_iff take_eq drop_eq by simp_all\n show \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n using pos pos' restrict_pos that(2,3)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n have fv_subset': \"\\i. i < length A_neg \\ A_neg ! i \\ C\"\n using fv_subset unfolding C_eq by (auto simp: Sup_le_iff)\n show \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using neg neg' restrict_neg that(2,3)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n wf_tuple_restrict_simple[OF _ fv_subset'])\n qed\n show \"x \\ mmulti_join n A_pos A_neg L\" if \"wf_tuple n C x\" \"P x\" \"Q x\" for x\n unfolding L_eq in_join_iff take_eq drop_eq\n proof (intro conjI)\n from that have pos': \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n and neg': \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using Qs[THEN iffD1] by auto\n show \"wf_tuple n (\\A\\set A_pos. A) x\"\n using \\wf_tuple n C x\\ unfolding C_eq by simp\n show \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n using pos pos' restrict_pos that(1,2)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n C_eq wf_tuple_restrict_simple[OF _ Sup_upper])\n show \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using neg neg' restrict_neg that(1,2)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n qed\nqed\n\nlemma nth_filter: \"i < length (filter P xs) \\\n (\\i'. i' < length xs \\ P (xs ! i') \\ Q (xs ! i')) \\ Q (filter P xs ! i)\"\n by (metis (lifting) in_set_conv_nth set_filter mem_Collect_eq)\n\nlemma nth_partition: \"i < length xs \\\n (\\i'. i' < length (filter P xs) \\ Q (filter P xs ! i')) \\\n (\\i'. i' < length (filter (Not \\ P) xs) \\ Q (filter (Not \\ P) xs ! i')) \\ Q (xs ! i)\"\n by (metis (no_types, lifting) in_set_conv_nth set_filter mem_Collect_eq comp_apply)\n\nlemma qtable_bin_join:\n assumes \"qtable n A P Q1 X\" \"qtable n B P Q2 Y\" \"\\ b \\ B \\ A\" \"C = A \\ B\"\n \"\\x. wf_tuple n C x \\ P x \\ P (restrict A x) \\ P (restrict B x)\"\n \"\\x. b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ Q2 (restrict B x)\"\n \"\\x. \\ b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ \\ Q2 (restrict B x)\"\n shows \"qtable n C P Q (bin_join n A X b B Y)\"\n using qtable_join[OF assms] bin_join_table[of n A X B Y b] assms(1,2)\n by (auto simp add: qtable_def)\n\nlemma restrict_update: \"y \\ A \\ y < length x \\ restrict A (x[y:=z]) = restrict A x\"\n unfolding restrict_def by (auto simp add: nth_list_update)\n\nlemma qtable_assign:\n assumes \"qtable n A P Q X\"\n \"y < n\" \"insert y A = A'\" \"y \\ A\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ P (restrict A x')\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ Q' (x[y:=Some (f x)])\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ Q' x' \\ Q (restrict A x') \\ x' ! y = Some (f (restrict A x'))\"\n shows \"qtable n A' P Q' ((\\x. x[y:=Some (f x)]) ` X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\" unfolding qtable_def by simp\n then show \"table n A' ?Y\"\n unfolding table_def wf_tuple_def using assms(2,3)\n by (auto simp: nth_list_update)\nnext\n fix x'\n assume \"x' \\ ?Y\" \"wf_tuple n A' x'\" \"P x'\"\n then obtain x where \"x \\ X\" and x'_eq: \"x' = x[y:=Some (f x)]\" by blast\n then have \"wf_tuple n A x\"\n using assms(1) unfolding qtable_def table_def by blast\n then have \"y < length x\" using assms(2) by (simp add: wf_tuple_def)\n with \\wf_tuple n A x\\ have \"restrict A x' = x\"\n unfolding x'_eq by (simp add: restrict_update[OF assms(4)] restrict_idle)\n with \\wf_tuple n A' x'\\ \\P x'\\ have \"P x\"\n using assms(5) by blast\n with \\wf_tuple n A x\\ \\x \\ X\\ have \"Q x\"\n using assms(1) by (elim in_qtableE)\n with \\wf_tuple n A x\\ \\P x\\ show \"Q' x'\"\n unfolding x'_eq by (rule assms(6))\nnext\n fix x'\n assume \"wf_tuple n A' x'\" \"P x'\" \"Q' x'\"\n then have \"wf_tuple n A (restrict A x')\"\n using assms(3) by (auto intro!: wf_tuple_restrict_simple)\n moreover have \"P (restrict A x')\"\n using \\wf_tuple n A' x'\\ \\P x'\\ by (rule assms(5))\n moreover have \"Q (restrict A x')\" and y: \"x' ! y = Some (f (restrict A x'))\"\n using \\wf_tuple n A' x'\\ \\P x'\\ \\Q' x'\\ by (auto dest!: assms(7))\n ultimately have \"restrict A x' \\ X\" by (intro in_qtableI[OF assms(1)])\n moreover have \"x' = (restrict A x')[y:=Some (f (restrict A x'))]\"\n using y assms(2,3) \\wf_tuple n A (restrict A x')\\ \\wf_tuple n A' x'\\\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def nth_list_update nth_restrict)\n ultimately show \"x' \\ ?Y\" by simp\nqed\n\nlemma sat_the_update: \"y \\ fv \\ \\ Formula.sat \\ V (map the (x[y:=z])) i \\ = Formula.sat \\ V (map the x) i \\\"\n by (rule sat_fv_cong) (metis map_update nth_list_update_neq)\n\nlemma progress_constraint: \"progress \\ P (formula_of_constraint c) j = j\"\n by (induction rule: formula_of_constraint.induct) simp_all\n\nlemma qtable_filter:\n assumes \"qtable n A P Q X\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ R x \\ Q' x\"\n shows \"qtable n A P Q' (Set.filter R X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\"\n unfolding qtable_def by simp\n then show \"table n A ?Y\"\n unfolding table_def wf_tuple_def by simp\nnext\n fix x\n assume \"x \\ ?Y\" \"wf_tuple n A x\" \"P x\"\n with assms show \"Q' x\" by (auto elim!: in_qtableE)\nnext\n fix x\n assume \"wf_tuple n A x\" \"P x\" \"Q' x\"\n with assms show \"x \\ Set.filter R X\" by (auto intro!: in_qtableI)\nqed\n\nlemma eval_constraint_sat_eq: \"wf_tuple n A x \\ fv_trm t1 \\ A \\ fv_trm t2 \\ A \\\n \\i\\A. i < n \\ eval_constraint (t1, p, c, t2) x =\n Formula.sat \\ V (map the x) i (formula_of_constraint (t1, p, c, t2))\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct)\n (simp_all add: meval_trm_eval_trm)\n\ndeclare progress_le_gen[simp]\n\ndefinition \"wf_envs \\ j \\ P P' V db =\n (dom V = dom P \\\n Mapping.keys db = dom P \\ (\\k \\ {j ..< j + \\}. {p. p \\ fst ` \\ \\ k}) \\\n rel_mapping (\\) P P' \\\n pred_mapping (\\i. i \\ j) P \\\n pred_mapping (\\i. i \\ j + \\) P' \\\n (\\p \\ Mapping.keys db - dom P. the (Mapping.lookup db p) = map (\\k. {ts. (p, ts) \\ \\ \\ k}) [j ..< j + \\]) \\\n (\\p \\ dom P. list_all2 (\\i X. X = the (V p) i) [the (P p).. event_data list) set \\ Formula.database\" is\n \"\\X p. (if p \\ fst ` X then Some [{ts. (p, ts) \\ X}] else None)\" .\n\nlemma wf_envs_mk_db: \"wf_envs \\ j 1 Map.empty Map.empty Map.empty (mk_db (\\ \\ j))\"\n unfolding wf_envs_def mk_db_def\n by transfer (force split: if_splits simp: image_iff rel_mapping_alt)\n\nlemma wf_envs_update:\n assumes wf_envs: \"wf_envs \\ j \\ P P' V db\"\n and m_eq: \"m = Formula.nfv \\\"\n and in_fv: \"{0 ..< m} \\ fv \\\"\n and xs: \"list_all2 (\\i. qtable m (Formula.fv \\) (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ (j + \\)] xs\"\n shows \"wf_envs \\ j \\ (P(p \\ progress \\ P \\ j)) (P'(p \\ progress \\ P' \\ (j + \\)))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\}))\n (Mapping.update p (map (image (map the)) xs) db)\"\n unfolding wf_envs_def\nproof (intro conjI ballI, goal_cases)\n case 3\n from assms show ?case\n by (auto simp: wf_envs_def pred_mapping_alt progress_le progress_mono_gen\n intro!: rel_mapping_map_upd)\nnext\n case (6 p')\n with assms show ?case by (cases \"p' \\ dom P\") (auto simp: wf_envs_def lookup_update')\nnext\n case (7 p')\n from xs in_fv have \"list_all2 (\\x y. map the ` y = {v. length v = m \\ Formula.sat \\ V v x \\})\n [progress \\ P \\ j.. P' \\ (j + \\)] xs\"\n by (elim list.rel_mono_strong) (auto 0 3 simp: wf_tuple_def nth_append\n elim!: in_qtableE in_qtableI intro!: image_eqI[where x=\"map Some _\"])\n moreover have \"list_all2 (\\i X. X = the (V p') i) [the (P p').. p'\"\n proof -\n from that 7 have \"p' \\ dom P\" by simp\n with wf_envs show ?thesis by (simp add: wf_envs_def)\n qed\n ultimately show ?case\n by (simp add: list.rel_map image_iff lookup_update')\nqed (use assms in \\auto simp: wf_envs_def\\)\n\nlemma wf_envs_P_simps[simp]:\n \"wf_envs \\ j \\ P P' V db \\ pred_mapping (\\i. i \\ j) P\"\n \"wf_envs \\ j \\ P P' V db \\ pred_mapping (\\i. i \\ j + \\) P'\"\n \"wf_envs \\ j \\ P P' V db \\ rel_mapping (\\) P P'\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_le[simp]:\n \"wf_envs \\ j \\ P P' V db \\ progress \\ P \\ j \\ j\"\n \"wf_envs \\ j \\ P P' V db \\ progress \\ P' \\ (j + \\) \\ j + \\\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_regex_le[simp]:\n \"wf_envs \\ j \\ P P' V db \\ progress_regex \\ P r j \\ j\"\n \"wf_envs \\ j \\ P P' V db \\ progress_regex \\ P' r (j + \\) \\ j + \\\"\n unfolding wf_envs_def by (auto simp: progress_regex_le)\n\nlemma wf_envs_progress_mono[simp]:\n \"wf_envs \\ j \\ P P' V db \\ a \\ b \\ progress \\ P \\ a \\ progress \\ P' \\ b\"\n unfolding wf_envs_def\n by (auto simp: progress_mono_gen)\n\nlemma qtable_wf_tuple_cong: \"qtable n A P Q X \\ A = B \\ (\\v. wf_tuple n A v \\ P v \\ Q v = Q' v) \\ qtable n B P Q' X\"\n unfolding qtable_def table_def by blast\n\nlemma list_all2_replicate[simp]: \"list_all2 R (replicate m x) xs \\ length xs = m \\ (\\i < m. R x (xs ! i))\"\n by (auto simp: list_all2_conv_all_nth)\n\nlemma list_all2_replicate2[simp]: \"list_all2 R xs (replicate m x) \\ length xs = m \\ (\\i < m. R (xs ! i) x)\"\n by (auto simp: list_all2_conv_all_nth)\n\ndefinition \"Untilp pos \\ I \\ \\ Formula.Until (if pos then \\ else Formula.Neg \\) I \\\"\n\nlemma (in maux) update_until':\n \"wf_until_aux \\ V R args \\'' \\'' aux'' (Monitor.progress \\ P' (formula.Until \\''' I \\'') (j + \\)) \\\n Monitor.progress \\ P (formula.Until \\''' I \\'') j + length zs =\n Monitor.progress \\ P' (formula.Until \\''' I \\'') (j + \\) \\\n Monitor.progress \\ P (formula.Until \\''' I \\'') j + length zs + length_muaux args aux'' =\n min (Monitor.progress \\ P' \\''' (j + \\)) (Monitor.progress \\ P' \\'' (j + \\)) \\\n list_all2 (\\i. qtable (agg_n args) (fv (packagg args (Untilp pos \\'' I \\''))) (mem_restr R')\n (\\v. Formula.sat \\ V (map the v) i (packagg args (Untilp pos \\'' I \\''))))\n [Monitor.progress \\ P (formula.Until \\''' I \\'') j..<\n Monitor.progress \\ P (formula.Until \\''' I \\'') j + length zs] zs \\\n nt = (if j + \\ = 0 then 0 else \\ \\ (min (j + \\ - 1) (min (Monitor.progress \\ P' \\'' (j + \\)) (Monitor.progress \\ P' \\'' (j + \\)))))\"\n if q1: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [Monitor.progress \\ P \\'' j.. P' \\'' (j + \\)] xs\"\n and q2: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [Monitor.progress \\ P \\'' j.. P' \\'' (j + \\)] ys\"\n and eq1: \"mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ map (\\ \\) [j ..< j + \\]) = (aux', buf', nts')\"\n and eq2: \"eval_muaux args nt aux' = (zs, aux'')\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and wf_envs: \"wf_envs \\ j \\ P P' V db\"\n and fvi_sub: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_until_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Until \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n and args_pos: \"pos = args_pos args\"\n and t: \"t = (if j = 0 then 0 else \\ \\ (min (j - 1) (min (progress \\ P \\'' j) (progress \\ P \\'' j))))\"\n and nt0: \"nt = lookahead_ts nts' nts (map (\\ \\) [j ..< j + \\]) t\"\n and length_aux: \"progress \\ P (Formula.Until \\''' I \\'') j + length_muaux args aux = min (progress \\ P \\'' j) (progress \\ P \\'' j)\"\n and nts_snoc: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\'' j) (progress \\ P \\'' j)..< j + \\] (nts @ map (\\ \\) [j ..< j + \\])\"\n and mr: \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n and valid_aggargs: \"valid_aggargs n (fv \\'') (args_agg args)\"\nproof -\n note sat.simps[simp del] progress_simps[simp del]\n define ne where \"ne \\ progress \\ P (Formula.Until \\''' I \\'') j\"\n have \\''': \"progress \\ P \\''' j = progress \\ P \\'' j\" \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all add: progress.simps split: if_splits)\n have update1: \"wf_until_aux \\ V R args \\'' \\'' aux' (progress \\ P (Formula.Until \\''' I \\'') j) \\\n ne + length_muaux args aux' = min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\))\"\n using q1 q2 nts_snoc length_aux aux fvi_sub \n unfolding \\'''\n by (elim mbuf2t_take_add_induct'[where j'=\"j + \\\", OF eq1 wf_envs_P_simps[OF wf_envs] buf])\n (auto simp: args_n args_L args_R ne_def wf_update_until split: option.splits)\n then obtain cur auxlist' where valid_aux': \"valid_muaux args cur aux' auxlist'\" and\n cur: \"cur = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\" and\n wf_auxlist': \"wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' (progress \\ P (Formula.Until \\''' I \\'') j)\"\n unfolding wf_until_aux_def ne_def args_ivl args_n args_pos by auto\n have length_aux': \"length_muaux args aux' = length auxlist'\"\n using valid_length_muaux[OF valid_aux'] .\n have nts': \"wf_ts \\ P' (j + \\) \\'' \\'' nts'\"\n using q1 q2 wf_envs nts_snoc\n unfolding wf_ts_def\n by (intro mbuf2t_take_eqD(2)[OF eq1]) (auto intro: wf_mbuf2_add buf[unfolded wf_mbuf2'_def])\n have nt: \"nt = (if j + \\ = 0 then 0 else \\ \\ (min (j + \\ - 1) (min (progress \\ P' \\'' (j + \\)) (progress \\ P' \\'' (j + \\)))))\"\n using nts nts' unfolding nt0 t\n apply (auto simp: hd_append hd_rev last_map wf_ts_def lookahead_ts_def)\n using list_all2_hdD(1) list_all2_hdD(2) apply fastforce\n using list_all2_lastD apply fastforce\n apply (metis (mono_tags) list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n apply (metis (mono_tags, lifting) add_gr_0 list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n apply (metis (mono_tags, lifting) add_gr_0 list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n done\n define zs'' where \"zs'' = fst (eval_until I nt auxlist')\"\n define auxlist'' where \"auxlist'' = snd (eval_until I nt auxlist')\"\n have current_w_le: \"cur \\ nt\"\n proof (cases nts')\n case Nil\n have p_le: \"min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\ j + \\\"\n using wf_envs_progress_le[OF wf_envs]\n by (auto simp: min_def le_diff_conv)\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux'] nt\n using Nil by (auto simp: \\''' intro!: \\_mono)\n next\n case (Cons nt x)\n have progress_\\''': \"progress \\ P' \\'' (j + \\) = progress \\ P' \\''' (j + \\)\"\n using pos by (auto simp add: progress.simps split: if_splits)\n have p_le: \"min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\ j + \\\"\n using wf_envs_progress_le[OF wf_envs]\n by (auto simp: min_def le_diff_conv)\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux'] Cons progress_\\''' nt\n by (auto split: if_splits list.splits intro!: \\_mono)\n qed\n have valid_aux'': \"valid_muaux args cur aux'' auxlist''\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n by (auto simp add: args_ivl zs''_def auxlist''_def)\n have length_aux'': \"length_muaux args aux'' = length auxlist''\"\n using valid_length_muaux[OF valid_aux''] .\n have eq2': \"eval_until I nt auxlist' = (zs'', auxlist'')\"\n by (auto simp: zs''_def auxlist''_def)\n have length_aux'_aux'': \"length_muaux args aux' = length zs'' + length_muaux args aux''\"\n using eval_until_length[OF eq2'] unfolding length_aux' length_aux'' .\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (j + \\) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' i \\\n i + length auxlist' = min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist'' (progress \\ P' (Formula.Until \\''' I \\'') (j + \\)) \\\n i + length zs'' = progress \\ P' (Formula.Until \\''' I \\'') (j + \\) \\\n i + length zs'' + length auxlist'' = min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\\n list_all2 (\\i. qtable n (Formula.fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Untilp pos \\'' I \\'')))\n [i.. V n R pos \\'' I \\'' aux' (Suc i)\"\n by (rule wf_until_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv \\'') (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem I ((\\ \\ j - \\ \\ i)) \\ Formula.sat \\ V (map the v) j \\'' \\\n (\\k\\{i.. V (map the v) k \\'' else \\ Formula.sat \\ V (map the v) k \\''))) a2\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons3)\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' =\n min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\))\"\n by simp\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (j + \\)\"\n if \"memR I (nt - t)\"\n using that nts' unfolding wf_ts_def progress.simps nt\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv \\'''\n intro!: cInf_lower \\_mono diff_le_mono simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.Until \\''' I \\'') (j + \\)\"\n if \"\\ memR I (nt - t)\"\n proof -\n have \\_min: \"\\ \\ (min (j + \\ - 1) k) = min (\\ \\ (j + \\ - 1)) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"j + \\ \\ progress \\ P' \\ (j + \\) \\ progress \\ P' \\ (j + \\) = (j + \\)\" for \\\n using wf_envs_progress_le[OF wf_envs, of \\] by auto\n let ?X = \"{i. \\k. k < j + \\ \\ k \\ min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\ memR I (\\ \\ k - \\ \\ i)}\"\n let ?min = \"min (j + \\ - 1) (min (progress \\ P' \\'' (j + \\)) (progress \\ P' \\'' (j + \\)))\"\n have \"\\ \\ ?min \\ \\ \\ (j + \\)\"\n by (rule \\_mono) auto\n from that have \"?X \\ {}\"\n by (auto simp: \\''' intro!: exI[of _ \"progress \\ P' \\'' (j + \\)\"])\n show ?thesis\n using that nts' Suc_i_aux' unfolding wf_ts_def progress.simps nt\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto 0 3 simp: 1 \\''' list_all2_Cons2 upt_eq_Cons_conv\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"]\n intro: diff_le_mono diff_le_mono2 order_trans[OF diff_le_mono diff_le_mono2] \\_mono\n elim!: contrapos_np[of _ \"Suc i \\ _\"])\n qed\n moreover have *: \"k < progress \\ P' \\ (j + \\)\" if\n \"\\ memR I (nt - \\ \\ i)\"\n \"memR I (\\ \\ k - \\ \\ i)\" \"\\ = \\'' \\ \\ = \\''\" for k \\\n using that nts' unfolding wf_ts_def nt\n by (auto simp: list_all2_Cons2 upt_eq_Cons_conv\n simp del: upt_Suc split: list.splits if_splits\n elim!: contrapos_np[of _ \"k < _\"] intro!: diff_le_mono diff_le_mono2)\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, a1, a2)\\\n by (auto simp: \\''' 1 sat.simps upt_conv_Cons Untilp_def dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n qed\n note wf_aux'' = this[OF wf_envs_progress_mono[OF wf_envs le_add1]\n wf_auxlist' conjunct2[OF update1, unfolded ne_def length_aux']]\n have zs_def: \"zs = map (eval_args_agg args) zs''\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n unfolding eval_args_agg_def\n by (auto simp add: args_ivl zs''_def auxlist''_def split: option.splits)\n have len_zs'': \"length zs'' = length zs\"\n by (auto simp: zs_def)\n have fv: \"fv (Untilp pos \\'' I \\'') = fv \\''\"\n using fvi_sub\n by (auto simp: Untilp_def)\n have \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Untilp pos \\'' I \\'')))\n [Monitor.progress \\ P (formula.Until \\''' I \\'') j..<\n Monitor.progress \\ P' (formula.Until \\''' I \\'') (j + \\)] zs''\"\n using wf_aux''\n by auto\n then have list_all2_zs: \"list_all2 (\\i. qtable (agg_n args) (fv (packagg args (Untilp pos \\'' I \\''))) (mem_restr R')\n (\\v. Formula.sat \\ V (map the v) i (packagg args (Untilp pos \\'' I \\''))))\n [Monitor.progress \\ P (formula.Until \\''' I \\'') j..<\n Monitor.progress \\ P' (formula.Until \\''' I \\'') (j + \\)] zs\"\n unfolding zs_def list_all2_map2\n apply (rule list_all2_mono)\n apply (rule qtable_eval_args_agg[of _ _ R])\n apply (auto simp: mr args_n fv valid_aggargs)\n done\n have \"progress \\ P (formula.Until \\''' I \\'') j + length auxlist' =\n progress \\ P' (formula.Until \\''' I \\'') (j + \\) + length auxlist''\"\n using wf_aux'' valid_aux'' length_aux'_aux''\n by (auto simp add: ne_def length_aux' length_aux'')\n then have \"cur =\n (if progress \\ P' (formula.Until \\''' I \\'') (j + \\) + length auxlist'' = 0 then 0\n else \\ \\ (progress \\ P' (formula.Until \\''' I \\'') (j + \\) + length auxlist'' - 1))\"\n unfolding cur ne_def by auto\n then show \"wf_until_aux \\ V R args \\'' \\'' aux'' (progress \\ P' (formula.Until \\''' I \\'') (j + \\)) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs = progress \\ P' (formula.Until \\''' I \\'') (j + \\) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs + length_muaux args aux'' = min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\\n list_all2 (\\i. qtable (agg_n args) (fv (packagg args (Untilp pos \\'' I \\''))) (mem_restr R') (\\v. Formula.sat \\ V (map the v) i (packagg args (Untilp pos \\'' I \\''))))\n [progress \\ P (formula.Until \\''' I \\'') j.. P (formula.Until \\''' I \\'') j + length zs] zs \\\n nt = (if j + \\ = 0 then 0 else \\ \\ (min (j + \\ - 1) (min (progress \\ P' \\'' (j + \\)) (progress \\ P' \\'' (j + \\)))))\"\n using aux wf_aux'' valid_aux'' fvi_sub list_all2_zs\n unfolding wf_until_aux_def length_aux'' args_ivl args_n args_pos nt len_zs''\n by (auto simp only: length_aux'')\nqed\n\nlemma progress_packagg[simp]: \"Monitor.progress \\ P (packagg args \\) j = Monitor.progress \\ P \\ j\"\n by (auto simp: packagg_def split: option.splits)\n\nlemma (in maux) meval:\n assumes \"wf_mformula \\ j P V n R \\ \\'\" \"wf_envs \\ j \\ P P' V db\"\n shows \"case meval n (map (\\ \\) [j ..< j + \\]) db \\ of (xs, \\\\<^sub>n) \\ wf_mformula \\ (j + \\) P' V n R \\\\<^sub>n \\' \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (j + \\)] xs\"\n using assms\nproof (induction \\ arbitrary: db P P' V n R \\')\n case (MRel rel)\n then show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp add: ball_Un intro: wf_mformula.intros table_eq_rel eq_rel_eval_trm\n in_eq_rel qtable_empty qtable_unit_table intro!: qtableI)\nnext\n case (MPred e ts)\n then show ?case\n proof (cases \"e \\ dom P\")\n case True\n with MPred(2) have \"e \\ Mapping.keys db\" \"e \\ dom P'\" \"e \\ dom V\"\n \"list_all2 (\\i X. X = the (V e) i) [the (P e)..x. _ = tabulate x 0 n\", OF refl]\n elim!: list.rel_mono_strong bexI[rotated] dest: ex_match\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff\n list.map_comp keys_dom_lookup)\n next\n note MPred(1)\n moreover\n case False\n moreover\n from False MPred(2) have \"e \\ dom P'\" \"e \\ dom V\"\n unfolding wf_envs_def rel_mapping_alt by auto\n moreover\n from False MPred(2) have *: \"e \\ (\\k \\ {j ..< j + \\}. fst ` \\ \\ k) \\ e \\ Mapping.keys db\"\n unfolding wf_envs_def by auto\n from False MPred(2) have\n \"e \\ Mapping.keys db \\ Mapping.lookup db e = Some (map (\\k. {ts. (e, ts) \\ \\ \\ k}) [j ..< j + \\])\"\n unfolding wf_envs_def keys_dom_lookup by (metis Diff_iff domD option.sel)\n with * have \"(case Mapping.lookup db e of None \\ replicate \\ {} | Some xs \\ xs) =\n map (\\k. {ts. (e, ts) \\ \\ \\ k}) [j ..< j + \\]\"\n by (cases \"e \\ (\\k \\ {j ..< j + \\}. fst ` \\ \\ k)\")\n (auto 0 3 simp: image_iff keys_dom_lookup list.rel_eq[symmetric] list.rel_map\n intro: list.rel_refl split: option.splits)\n ultimately show ?thesis\n by (cases rule: wf_mformula.cases)\n (fastforce intro!: wf_mformula.Pred qtableI list.rel_refl dest: ex_match cong: option.case\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff)\n qed\nnext\n case (MLet p m \\1 \\2)\n from MLet.prems(1) obtain \\1' \\2' where Let: \"\\' = Formula.Let p \\1' \\2'\" and\n 1: \"wf_mformula \\ j P V m UNIV \\1 \\1'\" and\n fv: \"m = Formula.nfv \\1'\" \"{0.. fv \\1'\" and\n 2: \"wf_mformula \\ j (P(p \\ progress \\ P \\1' j))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\1'}))\n n R \\2 \\2'\"\n by (cases rule: wf_mformula.cases) auto\n obtain xs \\1_new where e1: \"meval m (map (\\ \\) [j ..< j + \\]) db \\1 = (xs, \\1_new)\" and\n wf1: \"wf_mformula \\ (j + \\) P' V m UNIV \\1_new \\1'\" and\n res1: \"list_all2 (\\i. qtable m (fv \\1') (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\1'))\n [progress \\ P \\1' j.. P' \\1' (j + \\)] xs\"\n using MLet(1)[OF 1(1) MLet.prems(2)] by (auto simp: eqTrueI[OF mem_restr_UNIV, abs_def])\n from MLet(2)[OF 2 wf_envs_update[OF MLet.prems(2) fv res1]] wf1 e1 fv\n show ?case unfolding Let\n by (auto simp: fun_upd_def intro!: wf_mformula.Let)\nnext\n case (MAnd A_\\ \\ pos A_\\ \\ buf)\n from MAnd.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: sat_the_restrict simp del: bin_join.simps\n dest!: MAnd.IH split: if_splits prod.splits intro!: wf_mformula.And qtable_bin_join\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MAndAssign \\ conf)\n from MAndAssign.prems obtain \\'' x t \\'' where\n wf_envs: \"wf_envs \\ j \\ P P' V db\" and\n \\'_eq: \"\\' = formula.And \\'' \\''\" and\n wf_\\: \"wf_mformula \\ j P V n R \\ \\''\" and\n \"x < n\" and\n \"x \\ fv \\''\" and\n fv_t_subset: \"fv_trm t \\ fv \\''\" and\n conf: \"(x, t) = conf\" and\n \\''_eqs: \"\\'' = formula.Eq (trm.Var x) t \\ \\'' = formula.Eq t (trm.Var x)\"\n by (cases rule: wf_mformula.cases)\n from wf_\\ wf_envs obtain xs \\\\<^sub>n where\n meval_eq: \"meval n (map (\\ \\) [j ..< j + \\]) db \\ = (xs, \\\\<^sub>n)\" and\n wf_\\\\<^sub>n: \"wf_mformula \\ (j + \\) P' V n R \\\\<^sub>n \\''\" and\n xs: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [progress \\ P \\'' j.. P' \\'' (j + \\)] xs\"\n by (auto dest!: MAndAssign.IH)\n have progress_eqs:\n \"progress \\ P \\' j = progress \\ P \\'' j\"\n \"progress \\ P' \\' (j + \\) = progress \\ P' \\'' (j + \\)\"\n using \\''_eqs wf_envs_progress_le[OF wf_envs] by (auto simp: \\'_eq)\n\n show ?case proof (simp add: meval_eq, intro conjI)\n show \"wf_mformula \\ (j + \\) P' V n R (MAndAssign \\\\<^sub>n conf) \\'\"\n unfolding \\'_eq\n by (rule wf_mformula.AndAssign) fact+\n next\n show \"list_all2 (\\i. qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (j + \\)] (map ((`) (eval_assignment conf)) xs)\"\n unfolding list.rel_map progress_eqs conf[symmetric] eval_assignment.simps\n using xs\n proof (rule list.rel_mono_strong)\n fix i X\n assume qtable: \"qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'') X\"\n then show \"qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\')\n ((\\y. y[x := Some (meval_trm t y)]) ` X)\"\n proof (rule qtable_assign)\n show \"x < n\" by fact\n show \"insert x (fv \\'') = fv \\'\"\n using \\''_eqs fv_t_subset by (auto simp: \\'_eq)\n show \"x \\ fv \\''\" by fact\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\') v\" and \"mem_restr R v\"\n then show \"mem_restr R (restrict (fv \\'') v)\" by simp\n\n assume sat: \"Formula.sat \\ V (map the v) i \\'\"\n then have A: \"Formula.sat \\ V (map the (restrict (fv \\'') v)) i \\''\" (is ?A)\n by (simp add: \\'_eq sat_the_restrict)\n have \"map the v ! x = Formula.eval_trm (map the v) t\"\n using sat \\''_eqs by (auto simp: \\'_eq)\n also have \"... = Formula.eval_trm (map the (restrict (fv \\'') v)) t\"\n using fv_t_subset by (auto simp: map_the_restrict intro!: eval_trm_fv_cong)\n finally have \"map the v ! x = meval_trm t (restrict (fv \\'') v)\"\n using meval_trm_eval_trm[of n \"fv \\''\" \"restrict (fv \\'') v\" t]\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (fastforce simp: \\'_eq intro!: wf_tuple_restrict)\n then have B: \"v ! x = Some (meval_trm t (restrict (fv \\'') v))\" (is ?B)\n using \\''_eqs wf_v \\x < n\\ by (auto simp: wf_tuple_def \\'_eq)\n from A B show \"?A \\ ?B\" ..\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\'') v\" and \"mem_restr R v\"\n and sat: \"Formula.sat \\ V (map the v) i \\''\"\n let ?v = \"v[x := Some (meval_trm t v)]\"\n from sat have A: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\x \\ fv \\''\\ by (simp add: sat_the_update)\n have \"y \\ fv_trm t \\ x \\ y\" for y\n using fv_t_subset \\x \\ fv \\''\\ by auto\n then have B: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\''_eqs meval_trm_eval_trm[of n \"fv \\''\" v t] \\x < n\\\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (auto simp: wf_tuple_def map_update intro!: eval_trm_fv_cong)\n from A B show \"Formula.sat \\ V (map the ?v) i \\'\"\n by (simp add: \\'_eq)\n qed\n qed\n qed\nnext\n case (MAndRel \\ conf)\n from MAndRel.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: progress_constraint progress_le list.rel_map fv_formula_of_constraint\n Un_absorb2 wf_mformula_wf_set[unfolded wf_set_def] split: prod.splits\n dest!: MAndRel.IH[where db2=db and P2=P and P'2=P'] eval_constraint_sat_eq[THEN iffD2]\n intro!: wf_mformula.AndRel\n elim!: list.rel_mono_strong qtable_filter eval_constraint_sat_eq[THEN iffD1])\nnext\n case (MAnds A_pos A_neg l buf)\n note mbufn_take.simps[simp del] mbufn_add.simps[simp del] mmulti_join.simps[simp del]\n\n from MAnds.prems obtain pos neg l' where\n wf_l: \"list_all2 (wf_mformula \\ j P V n R) l (pos @ map remove_neg neg)\" and\n wf_buf: \"wf_mbufn (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (pos @ map remove_neg neg))\n (map (\\\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (pos @ map remove_neg neg)) buf\" and\n posneg: \"(pos, neg) = partition safe_formula l'\" and\n \"pos \\ []\" and\n safe_neg: \"list_all safe_formula (map remove_neg neg)\" and\n A_eq: \"A_pos = map fv pos\" \"A_neg = map fv neg\" and\n fv_subset: \"\\ (set A_neg) \\ \\ (set A_pos)\" and\n \"\\' = Formula.Ands l'\"\n by (cases rule: wf_mformula.cases) simp\n have progress_eq: \"progress \\ P' (formula.Ands l') (j + \\) =\n Mini (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P' \\ (j + \\)) (pos @ map remove_neg neg))\"\n using \\pos \\ []\\ posneg\n by (auto simp: Mini_def image_Un[symmetric] Collect_disj_eq[symmetric] intro!: arg_cong[where f=Min])\n\n have join_ok: \"qtable n (\\ (fv ` set l')) (mem_restr R)\n (\\v. list_all (Formula.sat \\ V (map the v) k) l')\n (mmulti_join n A_pos A_neg L)\"\n if args_ok: \"list_all2 (\\x. qtable n (fv x) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k x))\n (pos @ map remove_neg neg) L\"\n for k L\n proof (rule qtable_mmulti_join)\n let ?ok = \"\\A Qi X. qtable n A (mem_restr R) Qi X \\ wf_set n A\"\n let ?L_pos = \"take (length A_pos) L\"\n let ?L_neg = \"drop (length A_pos) L\"\n have 1: \"length pos \\ length L\"\n using args_ok by (auto dest!: list_all2_lengthD)\n show \"list_all3 ?ok A_pos (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) ?L_pos\"\n using args_ok wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth nth_append\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R]\n dest: order.strict_trans2[OF _ 1])\n from args_ok have prems_neg: \"list_all2 (\\\\. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k (remove_neg \\))) neg ?L_neg\"\n by (auto simp: A_eq list_all2_append1 list.rel_map)\n show \"list_all3 ?ok A_neg (map (\\\\ v. Formula.sat \\ V (map the v) k (remove_neg \\)) neg) ?L_neg\"\n using prems_neg wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length nth_append less_diff_conv\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R _ \"remove_neg _\", simplified])\n show \"\\(fv ` set l') = \\(set A_pos)\"\n using fv_subset posneg unfolding A_eq by auto\n show \"L = take (length A_pos) L @ drop (length A_pos) L\" by simp\n show \"A_pos \\ []\" using \\pos \\ []\\ A_eq by simp\n\n fix x :: \"event_data tuple\"\n assume \"wf_tuple n (\\ (fv ` set l')) x\" and \"mem_restr R x\"\n then show \"list_all (\\A. mem_restr R (restrict A x)) A_pos\"\n and \"list_all (\\A. mem_restr R (restrict A x)) A_neg\"\n by (simp_all add: list.pred_set)\n\n have \"list_all Formula.is_Neg neg\"\n using posneg safe_neg\n by (auto 0 3 simp add: list.pred_map elim!: list.pred_mono_strong\n intro: formula.exhaust[of \\ \"Formula.is_Neg \\\" for \\])\n then have \"list_all (\\\\. Formula.sat \\ V (map the v) i (remove_neg \\) \\\n \\ Formula.sat \\ V (map the v) i \\) neg\" for v i\n by (fastforce simp: Formula.is_Neg_def elim!: list.pred_mono_strong)\n then show \"list_all (Formula.sat \\ V (map the x) k) l' =\n (list_all2 (\\A Qi. Qi (restrict A x)) A_pos\n (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg\n (map (\\\\ v. Formula.sat \\ V (map the v) k\n (remove_neg \\))\n neg))\"\n using posneg\n by (auto simp add: A_eq list_all2_conv_all_nth list_all_length sat_the_restrict\n elim: nth_filter nth_partition[where P=safe_formula and Q=\"Formula.sat _ _ _ _\"])\n qed fact\n\n from MAnds.prems(2) show ?case\n unfolding \\\\' = Formula.Ands l'\\\n by (auto 0 3 simp add: list.rel_map progress_eq map2_map_map list_all3_map\n list_all3_list_all2_conv list.pred_map\n simp del: set_append map_append progress_simps split: prod.splits\n intro!: wf_mformula.Ands[OF _ _ posneg \\pos \\ []\\ safe_neg A_eq fv_subset]\n list.rel_mono_strong[OF wf_l] wf_mbufn_add[OF wf_buf]\n list.rel_flip[THEN iffD1, OF list.rel_mono_strong, OF wf_l]\n list.rel_refl join_ok[unfolded list.pred_set]\n dest!: MAnds.IH[OF _ _ MAnds.prems(2), rotated]\n elim!: wf_mbufn_take list_all2_appendI\n elim: mbufn_take_induct[OF _ wf_mbufn_add[OF wf_buf]])\nnext\n case (MOr \\ \\ buf)\n from MOr.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto dest!: MOr.IH split: if_splits prod.splits intro!: wf_mformula.Or qtable_union\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MNeg \\)\n have *: \"qtable n {} (mem_restr R) (\\v. P v) X \\\n \\ qtable n {} (mem_restr R) (\\v. \\ P v) empty_table \\ x \\ X \\ False\" for P x X\n using nullary_qtable_cases qtable_unit_empty_table by fastforce\n from MNeg.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto 0 4 intro!: wf_mformula.Neg dest!: MNeg.IH\n simp add: list.rel_map\n dest: nullary_qtable_cases qtable_unit_empty_table intro!: qtable_empty_unit_table\n elim!: list.rel_mono_strong elim: *)\nnext\n case (MExists \\)\n from MExists.prems show ?case\n by (cases rule: wf_mformula.cases)\n (force simp: list.rel_map fvi_Suc sat_fv_cong nth_Cons'\n intro!: wf_mformula.Exists dest!: MExists.IH qtable_project_fv\n elim!: list.rel_mono_strong table_fvi_tl qtable_cong sat_fv_cong[THEN iffD1, rotated -1]\n split: if_splits)+\nnext\n case (MAgg g0 y \\ b f \\)\n from MAgg.prems show ?case\n using wf_mformula_wf_set[OF MAgg.prems(1), unfolded wf_set_def]\n by (cases rule: wf_mformula.cases)\n (auto 0 3 simp add: list.rel_map simp del: sat.simps fvi.simps split: prod.split\n intro!: wf_mformula.Agg qtable_eval_agg dest!: MAgg.IH elim!: list.rel_mono_strong)\nnext\n case (MPrev I \\ first buf nts)\n from MPrev.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Prev \\)\n let ?xs = \"fst (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n let ?\\ = \"snd (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n let ?ls = \"fst (mprev_next I (buf @ ?xs) (nts @ map (\\ \\) [j ..< j + \\]))\"\n let ?rs = \"fst (snd (mprev_next I (buf @ ?xs) (nts @ map (\\ \\) [j ..< j + \\])))\"\n let ?ts = \"snd (snd (mprev_next I (buf @ ?xs) (nts @ map (\\ \\) [j ..< j + \\])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?i = \"min (progress \\ P \\ j) (j - 1)\"\n let ?j = \"j + \\\"\n let ?j' = \"progress \\ P' \\ (j + \\)\"\n define mini where \"mini = min ?j' (if ?i = ?j then ?j else ?j - 1)\"\n from Prev MPrev.IH[OF _ MPrev.prems(2), of n R \\] have IH: \"wf_mformula \\ (j + \\) P' V n R ?\\ \\\" and\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (j + \\)] ?xs\" by auto\n with Prev(4,5) MPrev.prems(2) have\n \"list_all2 (\\i X. if mem I ((\\ \\ (Suc i) - \\ \\ i)) then ?P i X else X = empty_table) [?i..\n list_all2 ?P [mini.. list_all2 (\\i t. t = \\ \\ i) [mini..< ?j] ?ts\"\n unfolding mini_def\n by (intro mprev) (auto intro!: list_all2_upt_append list_all2_appendI order.trans[OF min.cobounded1]\n list.rel_refl simp: list.rel_map)\n moreover have \"min (Suc (progress \\ P \\ j)) j = Suc (min (progress \\ P \\ j) (j-1))\" if \"j > 0\" for P j\n using that by auto\n ultimately show ?thesis using Prev(1,3) MPrev.prems(2) IH\n upt_conv_Cons[OF zero_less_Suc, of \"min (Monitor.progress \\ P' \\ \\) (\\ - Suc 0)\"]\n by (auto 0 3 simp: map_Suc_upt[symmetric] list.rel_map qtable_empty_iff mini_def\n simp del: upt_Suc elim!: wf_mformula.Prev list.rel_mono_strong dest: wf_envs_progress_le\n split: prod.split if_split_asm) (* slow 25 sec*)\n qed\nnext\n case (MNext I \\ first nts)\n from MNext.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Next \\)\n\n have min[simp]:\n \"min (progress \\ P \\ j - Suc 0) (j - Suc 0) = progress \\ P \\ j - Suc 0\"\n \"min (progress \\ P' \\ (j + \\) - Suc 0) (j + \\ - Suc 0) = progress \\ P' \\ (j + \\) - Suc 0\"\n using wf_envs_progress_le[OF MNext.prems(2), of \\] by auto\n\n let ?xs = \"fst (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n let ?ys = \"case (?xs, first) of (_ # xs, True) \\ xs | _ \\ ?xs\"\n let ?\\ = \"snd (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n let ?ls = \"fst (mprev_next I ?ys (nts @ map (\\ \\) [j ..< j + \\]))\"\n let ?rs = \"fst (snd (mprev_next I ?ys (nts @ map (\\ \\) [j ..< j + \\])))\"\n let ?ts = \"snd (snd (mprev_next I ?ys (nts @ map (\\ \\) [j ..< j + \\])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?i = \"progress \\ P \\ j - 1\"\n let ?j = \"j + \\\"\n let ?j' = \"progress \\ P' \\ (j + \\)\"\n define mini where \"mini = min (?j' - 1) (if ?i = ?j then ?j else ?j - 1)\"\n\n from Next MNext.IH[OF _ MNext.prems(2), of n R \\] have IH: \"wf_mformula \\ (j + \\) P' V n R ?\\ \\\"\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (j + \\)] ?xs\" by auto\n with Next have \"list_all2 (\\i X. if mem I ((\\ \\ (Suc i) - \\ \\ i)) then ?P (Suc i) X else X = empty_table)\n [?i..\n list_all2 ?P [Suc mini.. list_all2 (\\i t. t = \\ \\ i) [mini.. P \\ j < progress \\ P' \\ (j + \\)\"\n using that wf_envs_progress_le[OF MNext.prems(2), of \\] unfolding mini_def\n by (intro mnext)\n (auto simp: list_all2_Cons2 upt_eq_Cons_conv list.rel_map\n intro!: list_all2_upt_append list_all2_appendI list.rel_refl split: list.splits)\n then show ?thesis using wf_envs_progress_le[OF MNext.prems(2), of \\]\n upt_add_eq_append[of 0 j \\] upt_add_eq_append[of \"?j' - 1\" j \\]\n wf_envs_progress_mono[OF MNext.prems(2), of j \"j + \\\" \\, simplified] Next IH\n by (cases \"progress \\ P' \\ (j + \\) > progress \\ P \\ j\")\n (auto 0 3 simp: qtable_empty_iff le_Suc_eq le_diff_conv mini_def list.rel_map\n elim!: wf_mformula.Next list.rel_mono_strong list_all2_appendI intro!: list.rel_refl\n split: prod.split list.splits if_split_asm) (* slow 15 sec*)\n qed\nnext\n case (MSince args \\ \\ buf nts aux db P P' V n' R' \\')\n note sat.simps[simp del]\n from MSince.prems obtain \\'' \\''' \\'' I n R where Since_eq: \"\\' = packagg args (Formula.Since \\''' I \\'')\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_since_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Since \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n and mr: \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n and agg_n: \"agg_n args = n'\"\n by (cases rule: wf_mformula.cases) auto\n have \\''': \"Formula.fv \\''' = Formula.fv \\''\" \"progress \\ P \\''' j = progress \\ P \\'' j\"\n \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all split: if_splits)\n from MSince.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j)..< j + \\] (nts @ map (\\ \\) [j ..< j + \\])\"\n using nts unfolding wf_ts_def\n by (subst upt_add_eq_append) (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] list.rel_map\n intro!: list_all2_appendI list.rel_refl)\n note upd_since = update_since[OF _ _ _ _ _ args_ivl args_n args_L args_R refl mr]\n have update: \"wf_since_aux \\ V R args \\'' \\'' (snd (zs, aux')) (progress \\ P' (Formula.Since \\''' I \\'') (j + \\)) \\\n list_all2 (\\i. qtable (agg_n args) (Formula.fv (packagg args (Formula.Since \\''' I \\''))) (mem_restr R')\n (\\v. Formula.sat \\ V (map the v) i (packagg args (Formula.Since \\''' I \\''))))\n [progress \\ P (Formula.Since \\''' I \\'') j.. P' (Formula.Since \\''' I \\'') (j + \\)] (fst (zs, aux'))\"\n if eval_\\: \"fst (meval n (map (\\ \\) [j ..< j + \\]) db \\) = xs\"\n and eval_\\: \"fst (meval n (map (\\ \\) [j ..< j + \\]) db \\) = ys\"\n and eq: \"mbuf2t_take (\\r1 r2 t (zs, aux).\n case update_since args r1 r2 t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbuf2_add xs ys buf) (nts @ map (\\ \\) [j ..< j + \\]) = ((zs, aux'), buf', nts')\"\n for xs ys zs aux' buf' nts'\n unfolding progress_simps \\'''\n proof (rule mbuf2t_take_add_induct'[where j=j and j'=\"j + \\\" and z'=\"(zs, aux')\",\n OF eq wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc],\n goal_cases xs ys _ base step)\n case xs\n then show ?case\n using MSince.IH(1)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case ys\n then show ?case\n using MSince.IH(2)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case base\n then show ?case\n using aux by (simp add: \\''')\n next\n case (step k X Y z)\n then show ?case\n using fvi_subset pos\n by (auto 0 3 simp: args_ivl args_n args_L args_R Un_absorb1 Sincep_def\n elim!: upd_since(1) list_all2_appendI dest!: upd_since(2)\n split: prod.split if_splits option.splits)\n qed simp\n with MSince.IH(1)[OF \\ MSince.prems(2)] MSince.IH(2)[OF \\ MSince.prems(2)] show ?case\n by (auto 0 3 simp: Since_eq args_n agg_n[symmetric] split: prod.split\n intro!: wf_mformula.Since[OF _ _ pos pos_eq args_ivl args_n args_L args_R mr fvi_subset]\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc])\nnext\n case (MUntil args \\ \\ buf nts t aux db P P' V n' R' \\')\n note sat.simps[simp del] progress_simps[simp del]\n from MUntil.prems obtain \\'' \\''' \\'' I n R where Until_eq: \"\\' = packagg args (Formula.Until \\''' I \\'')\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_until_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Until \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n and mr: \"mem_restr R = mem_restr (lift_envs' (agg_b args) R')\"\n and agg_n: \"agg_n args = n'\"\n and t: \"t = (if j = 0 then 0 else \\ \\ (min (j - 1) (min (progress \\ P \\'' j) (progress \\ P \\'' j))))\"\n and length_aux: \"progress \\ P (Formula.Until \\''' I \\'') j + length_muaux args aux =\n min (progress \\ P \\'' j) (progress \\ P \\'' j)\"\n by (cases rule: wf_mformula.cases) (auto)\n define pos where args_pos: \"pos = args_pos args\"\n have \\''': \"progress \\ P \\''' j = progress \\ P \\'' j\" \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all add: progress.simps split: if_splits)\n from MUntil.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j)..< j + \\] (nts @ map (\\ \\) [j ..< j + \\])\"\n using nts unfolding wf_ts_def\n by (subst upt_add_eq_append) (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] list.rel_map\n intro!: list_all2_appendI list.rel_refl)\n have valid: \"valid_aggargs n (fv \\'') (args_agg args)\"\n using aux\n by (auto simp: wf_until_aux_def args_n)\n define xs where \"xs = fst (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n define ys where \"ys = fst (meval n (map (\\ \\) [j ..< j + \\]) db \\)\"\n have list_all2_xs: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [Monitor.progress \\ P \\'' j.. P' \\'' (j + \\)] xs\"\n using MUntil(1)[OF \\ MUntil(4)]\n by (auto simp: xs_def split: prod.splits)\n have list_all2_ys: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [Monitor.progress \\ P \\'' j.. P' \\'' (j + \\)] ys\"\n using MUntil(2)[OF \\ MUntil(4)]\n by (auto simp: ys_def split: prod.splits)\n have Untilp: \"Untilp pos \\'' I \\'' = formula.Until \\''' I \\''\"\n using pos\n by (auto simp: Untilp_def args_pos split: if_splits)\n have update:\n \"wf_until_aux \\ V R args \\'' \\'' aux'' (progress \\ P' (formula.Until \\''' I \\'') (j + \\)) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs = progress \\ P' (formula.Until \\''' I \\'') (j + \\) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs + length_muaux args aux'' = min (progress \\ P' \\''' (j + \\)) (progress \\ P' \\'' (j + \\)) \\\n list_all2 (\\i. qtable (agg_n args) (fv (packagg args (formula.Until \\''' I \\''))) (mem_restr R') (\\v. Formula.sat \\ V (map the v) i (packagg args (formula.Until \\''' I \\''))))\n [progress \\ P (formula.Until \\''' I \\'') j.. P (formula.Until \\''' I \\'') j + length zs] zs \\\n nt = (if j + \\ = 0 then 0 else \\ \\ (min (j + \\ - 1) (min (progress \\ P' \\'' (j + \\)) (progress \\ P' \\'' (j + \\)))))\"\n if nt0: \"nt = lookahead_ts nts' nts (map (\\ \\) [j ..< j + \\]) t\"\n and eq1: \"mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ map (\\ \\) [j ..< j + \\]) = (aux', buf', nts')\"\n and eq2: \"eval_muaux args nt aux' = (zs, aux'')\"\n for aux' aux'' zs nt nts' buf'\n using update_until'[OF list_all2_xs list_all2_ys eq1 eq2 pos MUntil(4) fvi_subset buf nts aux args_ivl args_n args_L args_R args_pos t nt0 length_aux nts_snoc mr valid]\n by (auto simp: args_n agg_n_def Untilp split: option.splits)\n from MUntil.IH(1)[OF \\ MUntil.prems(2)] MUntil.IH(2)[OF \\ MUntil.prems(2)] pos pos_eq fvi_subset show ?case\n unfolding meval.simps Let_def\n by (auto simp: args_ivl args_n args_pos agg_n[symmetric] Until_eq \\''' progress.simps(6) Let_def xs_def ys_def\n split: prod.split if_splits dest!: update[OF refl, rotated]\n intro!: wf_mformula.Until[OF _ _ _ _ args_ivl args_n args_L args_R mr fvi_subset]\n elim!: list.rel_mono_strong qtable_cong\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc])\nnext\n case (MMatchP I mr mrs \\s buf nts aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del]\n from MMatchP.prems obtain r \\s where eq: \"\\' = Formula.MatchP I r\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j)\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..< j + \\] (nts @ map (\\ \\) [j ..< j + \\])\"\n using nts unfolding wf_ts_regex_def\n by (subst upt_add_eq_append) (auto simp add: wf_envs_progress_regex_le[OF MMatchP.prems(2)] list.rel_map\n intro!: list_all2_appendI list.rel_refl)\n have update: \"wf_matchP_aux \\ V n R I r (snd (zs, aux')) (progress \\ P' (Formula.MatchP I r) (j + \\)) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchP I r)))\n [progress \\ P (Formula.MatchP I r) j.. P' (Formula.MatchP I r) (j + \\)] (fst (zs, aux'))\"\n if eval: \"map (fst o meval n (map (\\ \\) [j ..< j + \\]) db) \\s = xss\"\n and eq: \"mbufnt_take (\\rels t (zs, aux).\n case update_matchP n I mr mrs rels t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbufn_add xss buf) (nts @ map (\\ \\) [j ..< j + \\]) = ((zs, aux'), buf', nts')\"\n for xss zs aux' buf' nts'\n unfolding progress_simps\n proof (rule mbufnt_take_add_induct'[where j'=\"j + \\\" and z'=\"(zs, aux')\", OF eq wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc],\n goal_cases xss _ base step)\n case xss\n then show ?case\n using eval \\s\n by (auto simp: list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map\n list.rel_flip[symmetric, of _ \\s \\s] dest!: MMatchP.IH(1)[OF _ _ MMatchP.prems(2)]\n elim!: list.rel_mono_strong split: prod.splits)\n next\n case base\n then show ?case\n using aux by auto\n next\n case (step k Xs z)\n then show ?case\n by (auto simp: Un_absorb1 mrs safe mr elim!: update_matchP(1) list_all2_appendI\n dest!: update_matchP(2) split: prod.split)\n qed simp\n then show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchP.IH[OF _ _ MMatchP.prems(2)] split: prod.splits)\nnext\n case (MMatchF I mr mrs \\s buf nts t aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del] progress_simps[simp del]\n from MMatchF.prems obtain r \\s where eq: \"\\' = Formula.MatchF I r\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0\"\n and t: \"t = (if j = 0 then 0 else \\ \\ (min (j - 1) (progress_regex \\ P r j)))\"\n and length_aux: \"progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [progress_regex \\ P r j..< j + \\] (nts @ map (\\ \\) [j ..< j + \\])\"\n using nts unfolding wf_ts_regex_def\n by (subst upt_add_eq_append) (auto simp add: wf_envs_progress_regex_le[OF MMatchF.prems(2)] list.rel_map\n intro!: list_all2_appendI list.rel_refl)\n {\n fix xss zs aux' aux'' buf' nts' nt\n assume eval: \"map (fst o meval n (map (\\ \\) [j ..< j + \\]) db) \\s = xss\"\n and nt0: \"nt = lookahead_ts nts' nts (map (\\ \\) [j ..< j + \\]) t\"\n and eq1: \"mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ map (\\ \\) [j ..< j + \\]) =\n (aux', buf', nts')\"\n and eq2: \"eval_matchF I mr nt aux' = (zs, aux'')\"\n have update1: \"wf_matchF_aux \\ V n R I r aux' (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux' = progress_regex \\ P' r (j + \\)\"\n using eval nts_snoc nts_snoc length_aux aux \\s\n by (elim mbufnt_take_add_induct'[where j'=\"j + \\\", OF eq1 wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf])\n (auto simp: length_update_matchF\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)]\n elim: wf_update_matchF[OF _ safe mr mrs] elim!: list.rel_mono_strong)\n from MMatchF.prems(2) have nts': \"wf_ts_regex \\ P' (j + \\) r nts'\"\n using eval eval nts_snoc \\s\n unfolding wf_ts_regex_def\n apply (intro mbufnt_take_eqD(2)[OF eq1 wf_mbufn_add[where js'=\"map (\\\\. progress \\ P' \\ (j + \\)) \\s\",\n OF buf[unfolded wf_mbufn'_def mr prod.case]]])\n apply (auto simp: to_mregex_progress[OF safe mr] Mini_def\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n list_all2_Cons1 elim!: list.rel_mono_strong intro!: list.rel_refl_strong\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)])\n apply (auto simp: list_all2_conv_all_nth)\n done\n have nt: \"nt = (if j + \\ = 0 then 0 else \\ \\ (min (j + \\ - 1) (progress_regex \\ P' r (j + \\))))\"\n using nts nts' unfolding nt0 t\n apply (auto simp: hd_append hd_rev last_map wf_ts_regex_def lookahead_ts_def)\n using list_all2_hdD(1) list_all2_hdD(2) apply fastforce\n using list_all2_lastD apply fastforce\n apply (metis (mono_tags) list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n apply (metis (mono_tags, lifting) add_gr_0 list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n apply (metis (mono_tags, lifting) add_gr_0 list_all2_hdD(1) list_all2_hdD(2) min.absorb2 Suc_diff_Suc diff_zero less_Suc_eq_le)\n done\n have \"i \\ progress \\ P' (Formula.MatchF I r) (j + \\) \\\n wf_matchF_aux \\ V n R I r aux' i 0 \\\n i + length aux' = progress_regex \\ P' r (j + \\) \\\n wf_matchF_aux \\ V n R I r aux'' (progress \\ P' (Formula.MatchF I r) (j + \\)) 0 \\\n i + length zs = progress \\ P' (Formula.MatchF I r) (j + \\) \\\n i + length zs + length aux'' = progress_regex \\ P' r (j + \\) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchF I r)))\n [i.. V n R I r aux' (Suc i) 0\"\n by (rule wf_matchF_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, rels, rel)\\ by (rule wf_matchF_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem I ((\\ \\ j - \\ \\ i)) \\ Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n unfolding \\a = (t, rels, rel)\\ using wf_matchF_aux_Cons3 by force\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' = progress_regex \\ P' r (j + \\)\"\n by simp\n have \"i \\ progress \\ P' (Formula.MatchF I r) (j + \\)\"\n if \"memR I (nt - t)\"\n using that nts' unfolding wf_ts_regex_def progress_simps nt\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv\n intro!: cInf_lower \\_mono diff_le_mono simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.MatchF I r) (j + \\)\"\n if \"\\ memR I (nt - t)\"\n proof -\n have \\_min: \"\\ \\ (min (j + \\ - 1) k) = min (\\ \\ (j + \\ - 1) ) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"j + \\ \\ progress \\ P' \\ (j + \\) \\ progress \\ P' \\ (j + \\) = (j + \\)\" for \\\n using wf_envs_progress_le[OF MMatchF.prems(2), of \\] by auto\n have min_Suc[simp]: \"min j (j + \\) = j\" by auto\n let ?X = \"{i. \\k. k < j + \\ \\ k \\ progress_regex \\ P' r (j + \\) \\ memR I (\\ \\ k - \\ \\ i)}\"\n let ?min = \"min (j + \\ - 1) (progress_regex \\ P' r (j + \\))\"\n have \"\\ \\ ?min \\ \\ \\ (j + \\)\"\n by (rule \\_mono) auto\n from that have \"?X \\ {}\"\n by (auto intro!: exI[of _ \"progress_regex \\ P' r (j + \\)\"])\n show ?thesis\n using that nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]\n unfolding wf_ts_regex_def progress_simps nt\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto 0 3 simp: 1 list_all2_Cons2 upt_eq_Cons_conv\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"]\n intro!: diff_le_mono diff_le_mono2 order_trans[OF diff_le_mono diff_le_mono2] \\_mono\n elim!: contrapos_np[of _ \"Suc i \\ _\"])\n qed\n moreover have *: \"k < progress_regex \\ P' r (j + \\)\" if\n \"\\ memR I (nt - \\ \\ i)\"\n \"memR I (\\ \\ k - \\ \\ i)\" for k\n using that nts' unfolding wf_ts_regex_def nt\n by (auto simp: list_all2_Cons2 upt_eq_Cons_conv\n simp del: upt_Suc split: list.splits if_splits\n elim!: contrapos_np[of _ \"k < _\"] intro!: diff_le_mono diff_le_mono2)\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, rels, rel)\\\n by (auto simp: 1 sat.simps upt_conv_Cons dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n\n qed\n note conjI[OF nt this[OF progress_mono_gen[OF le_add1] conjunct1[OF update1] conjunct2[OF update1]]]\n }\n note update = this[OF refl refl, rotated]\n from MMatchF.prems(2) show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map Let_def\n intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)] update split: prod.splits)\nqed\n\n\nsubsubsection \\Monitor step\\\n\nlemma (in maux) wf_mstate_mstep: \"wf_mstate \\ \\ R st \\ last_ts \\ \\ snd tdb \\\n wf_mstate \\ (psnoc \\ tdb) R (snd (mstep (map_prod mk_db id tdb) st))\"\n unfolding wf_mstate_def mstep_def Let_def\n by (fastforce simp add: progress_mono le_imp_diff_is_add split: prod.splits\n elim!: prefix_of_psnocE dest: meval[OF _ wf_envs_mk_db] list_all2_lengthD)\n\ndefinition \"flatten_verdicts Vs = (\\ (set (map (\\(i, X). (\\v. (i, v)) ` X) Vs)))\"\n\nlemma flatten_verdicts_append[simp]:\n \"flatten_verdicts (Vs @ Us) = flatten_verdicts Vs \\ flatten_verdicts Us\"\n by (induct Vs) (auto simp: flatten_verdicts_def)\n\nlemma (in maux) mstep_output_iff:\n assumes \"wf_mstate \\ \\ R st\" \"last_ts \\ \\ snd tdb\" \"prefix_of (psnoc \\ tdb) \\\" \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n progress \\ Map.empty \\ (plen \\) \\ i \\ i < progress \\ Map.empty \\ (Suc (plen \\)) \\\n wf_tuple (Formula.nfv \\) (Formula.fv \\) v \\ Formula.sat \\ Map.empty (map the v) i \\\"\nproof -\n from prefix_of_psnocE[OF assms(3,2)] have \"prefix_of \\ \\\"\n \"\\ \\ (plen \\) = fst tdb\" \"\\ \\ (plen \\) = snd tdb\" by auto\n moreover from assms(1) \\prefix_of \\ \\\\ have \"mstate_n st = Formula.nfv \\\"\n \"mstate_i st = progress \\ Map.empty \\ (plen \\)\" \"wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\"\n unfolding wf_mstate_def by blast+\n moreover from meval[OF \\wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\\ wf_envs_mk_db] obtain Vs st' where\n \"meval (mstate_n st) [\\ \\ (plen \\)] (mk_db (\\ \\ (plen \\))) (mstate_m st) = (Vs, st')\"\n \"wf_mformula \\ (Suc (plen \\)) Map.empty Map.empty (mstate_n st) R st' \\\"\n \"list_all2 (\\i. qtable (mstate_n st) (fv \\) (mem_restr R) (\\v. Formula.sat \\ Map.empty (map the v) i \\))\n [progress \\ Map.empty \\ (plen \\).. Map.empty \\ (Suc (plen \\))] Vs\" by auto\n moreover from this assms(4) have \"qtable (mstate_n st) (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ Map.empty (map the v) i \\) (Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"\n if \"progress \\ Map.empty \\ (plen \\) \\ i\" \"i < progress \\ Map.empty \\ (Suc (plen \\))\"\n using that by (auto simp: list_all2_conv_all_nth\n dest!: spec[of _ \"(i - progress \\ Map.empty \\ (plen \\))\"])\n ultimately show ?thesis\n using assms(4) unfolding mstep_def Let_def flatten_verdicts_def\n by (auto simp: in_set_enumerate_eq list_all2_conv_all_nth progress_mono le_imp_diff_is_add\n elim!: in_qtableE in_qtableI intro!: bexI[of _ \"(i, Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"])\nqed\n\n\nsubsubsection \\Monitor function\\\n\nlocale verimon = verimon_spec + maux\n\nlemma (in verimon) mstep_mverdicts:\n assumes wf: \"wf_mstate \\ \\ R st\"\n and le[simp]: \"last_ts \\ \\ snd tdb\"\n and restrict: \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n (i, v) \\ M (psnoc \\ tdb) - M \\\"\nproof -\n obtain \\ where p2: \"prefix_of (psnoc \\ tdb) \\\"\n using ex_prefix_of by blast\n with le have p1: \"prefix_of \\ \\\" by (blast elim!: prefix_of_psnocE)\n show ?thesis\n unfolding M_def\n by (auto 0 3 simp: p2 progress_prefix_conv[OF _ p1] sat_prefix_conv[OF _ p1] not_less\n pprogress_eq[OF p1] pprogress_eq[OF p2]\n dest: mstep_output_iff[OF wf le p2 restrict, THEN iffD1] spec[of _ \\]\n mstep_output_iff[OF wf le _ restrict, THEN iffD1] progress_sat_cong[OF p1]\n intro: mstep_output_iff[OF wf le p2 restrict, THEN iffD2] p1)\nqed\n\ncontext maux\nbegin\n\nprimrec msteps0 where\n \"msteps0 [] st = ([], st)\"\n| \"msteps0 (tdb # \\) st =\n (let (V', st') = mstep (map_prod mk_db id tdb) st; (V'', st'') = msteps0 \\ st' in (V' @ V'', st''))\"\n\nprimrec msteps0_stateless where\n \"msteps0_stateless [] st = []\"\n| \"msteps0_stateless (tdb # \\) st = (let (V', st') = mstep (map_prod mk_db id tdb) st in V' @ msteps0_stateless \\ st')\"\n\nlemma msteps0_msteps0_stateless: \"fst (msteps0 w st) = msteps0_stateless w st\"\n by (induct w arbitrary: st) (auto simp: split_beta)\n\nlift_definition msteps :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\"\n is msteps0 .\n\nlift_definition msteps_stateless :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list\"\n is msteps0_stateless .\n\nlemma msteps_msteps_stateless: \"fst (msteps w st) = msteps_stateless w st\"\n by transfer (rule msteps0_msteps0_stateless)\n\nlemma msteps0_snoc: \"msteps0 (\\ @ [tdb]) st =\n (let (V', st') = msteps0 \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by (induct \\ arbitrary: st) (auto split: prod.splits)\n\nlemma msteps_psnoc: \"last_ts \\ \\ snd tdb \\ msteps (psnoc \\ tdb) st =\n (let (V', st') = msteps \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by transfer' (auto simp: msteps0_snoc split: list.splits prod.splits if_splits)\n\ndefinition monitor where\n \"monitor \\ \\ = msteps_stateless \\ (minit_safe \\)\"\n\nend\n\nlemma Suc_length_conv_snoc: \"(Suc n = length xs) = (\\y ys. xs = ys @ [y] \\ length ys = n)\"\n by (cases xs rule: rev_cases) auto\n\nlemma (in verimon) wf_mstate_msteps: \"wf_mstate \\ \\ R st \\ mem_restr R v \\ \\ \\ \\' \\\n X = msteps (pdrop (plen \\) \\') st \\ wf_mstate \\ \\' R (snd X) \\\n ((i, v) \\ flatten_verdicts (fst X)) = ((i, v) \\ M \\' - M \\)\"\nproof (induct \"plen \\' - plen \\\" arbitrary: X st \\ \\')\n case 0\n from 0(1,4,5) have \"\\ = \\'\" \"X = ([], st)\"\n by (transfer; auto)+\n with 0(2) show ?case unfolding flatten_verdicts_def by simp\nnext\n case (Suc x)\n from Suc(2,5) obtain \\'' tdb where \"x = plen \\'' - plen \\\" \"\\ \\ \\''\"\n \"\\' = psnoc \\'' tdb\" \"pdrop (plen \\) (psnoc \\'' tdb) = psnoc (pdrop (plen \\) \\'') tdb\"\n \"last_ts (pdrop (plen \\) \\'') \\ snd tdb\" \"last_ts \\'' \\ snd tdb\"\n \"\\'' \\ psnoc \\'' tdb\"\n proof (atomize_elim, transfer, elim exE, goal_cases prefix)\n case (prefix _ _ \\' _ \\_tdb)\n then show ?case\n proof (cases \\_tdb rule: rev_cases)\n case (snoc \\ tdb)\n with prefix show ?thesis\n by (intro bexI[of _ \"\\' @ \\\"] exI[of _ tdb])\n (force simp: sorted_append append_eq_Cons_conv split: list.splits if_splits)+\n qed simp\n qed\n with Suc(1)[OF this(1) Suc.prems(1,2) this(2) refl] Suc.prems show ?case\n unfolding msteps_msteps_stateless[symmetric]\n by (auto simp: msteps_psnoc split_beta mstep_mverdicts\n dest: mono_monitor[THEN set_mp, rotated] intro!: wf_mstate_mstep)\nqed\n\nlemma (in verimon) wf_mstate_msteps_stateless:\n assumes \"wf_mstate \\ \\ R st\" \"mem_restr R v\" \"\\ \\ \\'\"\n shows \"(i, v) \\ flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) \\ (i, v) \\ M \\' - M \\\"\n using wf_mstate_msteps[OF assms refl] unfolding msteps_msteps_stateless by simp\n\nlemma (in verimon) wf_mstate_msteps_stateless_UNIV: \"wf_mstate \\ \\ UNIV st \\ \\ \\ \\' \\\n flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) = M \\' - M \\\"\n by (auto dest: wf_mstate_msteps_stateless[OF _ mem_restr_UNIV])\n\nlemma (in verimon) mverdicts_Nil: \"M pnil = {}\"\n by (simp add: M_def pprogress_eq)\n\ncontext maux\nbegin\n\nlemma minit_safe_minit: \"mmonitorable \\ \\ minit_safe \\ = minit \\\"\n unfolding minit_safe_def monitorable_formula_code by simp\n\nlemma wf_mstate_minit_safe: \"mmonitorable \\ \\ wf_mstate \\ pnil R (minit_safe \\)\"\n using wf_mstate_minit minit_safe_minit mmonitorable_def by metis\n\nend\n\nlemma (in verimon) monitor_mverdicts: \"flatten_verdicts (monitor \\ \\) = M \\\"\n unfolding monitor_def using monitorable\n by (subst wf_mstate_msteps_stateless_UNIV[OF wf_mstate_minit_safe, simplified])\n (auto simp: mmonitorable_def mverdicts_Nil)\n\nsubsection \\Collected correctness results\\\n\ncontext verimon\nbegin\n\ntext \\We summarize the main results proved above.\n\\begin{enumerate}\n\\item The term @{term M} describes semantically the monitor's expected behaviour:\n\\begin{itemize}\n\\item @{thm[source] mono_monitor}: @{thm mono_monitor[no_vars]}\n\\item @{thm[source] sound_monitor}: @{thm sound_monitor[no_vars]}\n\\item @{thm[source] complete_monitor}: @{thm complete_monitor[no_vars]}\n\\item @{thm[source] sliceable_M}: @{thm sliceable_M[no_vars]}\n\\end{itemize}\n\\item The executable monitor's online interface @{term minit_safe} and @{term mstep}\n preserves the invariant @{term wf_mstate} and produces the the verdicts according\n to @{term M}:\n\\begin{itemize}\n\\item @{thm[source] wf_mstate_minit_safe}: @{thm wf_mstate_minit_safe[no_vars]}\n\\item @{thm[source] wf_mstate_mstep}: @{thm wf_mstate_mstep[no_vars]}\n\\item @{thm[source] mstep_mverdicts}: @{thm mstep_mverdicts[no_vars]}\n\\end{itemize}\n\\item The executable monitor's offline interface @{term monitor} implements @{term M}:\n\\begin{itemize}\n\\item @{thm[source] monitor_mverdicts}: @{thm monitor_mverdicts[no_vars]}\n\\end{itemize}\n\\end{enumerate}\n\\\n\nend\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "EmanueleFWM", "repo": "verimon-optimized-aggregations", "sha": "62096c661eb0ccf422139da229c34bc2dc735e5b", "save_path": "github-repos/isabelle/EmanueleFWM-verimon-optimized-aggregations", "path": "github-repos/isabelle/EmanueleFWM-verimon-optimized-aggregations/verimon-optimized-aggregations-62096c661eb0ccf422139da229c34bc2dc735e5b/thys/MFODL_Monitor_Devel/Monitor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.2742023990032687}} {"text": "(* Title: Tree Automata\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nheader \"Executable Implementation of Tree Automata\"\ntheory Ta_impl\nimports \n Main\n \"../Collections/ICF/CollectionsV1\" \n Ta AbsAlgo\n \"~~/src/HOL/Library/Code_Target_Numeral\" \nbegin\n\n\n\n\ntext_raw {*\\label{sec:taimpl}*}\n\ntext {*\n In this theory, an effcient executable implementation of non-deterministic \n tree automata and basic algorithms is defined.\n\n The algorithms use red-black trees to represent sets of states or rules \n where appropriate.\n *}\n\nsubsection \"Prelude\"\n\n -- \"Make rules hashable\"\ninstantiation ta_rule :: (hashable,hashable) hashable\nbegin\nfun hashcode_of_ta_rule \n :: \"('Q1::hashable,'Q2::hashable) ta_rule \\ hashcode\" \n where\n \"hashcode_of_ta_rule (q \\ f qs) = hashcode q + hashcode f + hashcode qs\"\n\ndefinition [simp]: \"hashcode = hashcode_of_ta_rule\"\n\ndefinition \"def_hashmap_size::(('a,'b) ta_rule itself \\ nat) == (\\_. 32)\"\n\ninstance \n by (intro_classes)(auto simp add: def_hashmap_size_ta_rule_def)\nend\n\n\n -- \"Make wrapped states hashable\"\ninstantiation ustate_wrapper :: (hashable,hashable) hashable\nbegin\n definition \"hashcode x == (case x of USW1 a \\ 2 * hashcode a | USW2 b \\ 2 * hashcode b + 1)\"\n definition \"def_hashmap_size = (\\_ :: (('a,'b) ustate_wrapper) itself. def_hashmap_size TYPE('a) + def_hashmap_size TYPE('b))\"\n\n instance using def_hashmap_size[where ?'a=\"'a\"] def_hashmap_size[where ?'a=\"'b\"]\n by(intro_classes)(simp_all add: bounded_hashcode_bounds def_hashmap_size_ustate_wrapper_def split: ustate_wrapper.split)\n\nend\n\nsubsubsection {* Ad-Hoc instantiations of generic Algorithms *}\nsetup Locale_Code.open_block\ninterpretation hll_idx!: build_index_loc hm_ops ls_ops ls_ops by unfold_locales\ninterpretation ll_set_xy!: g_set_xy_loc ls_ops ls_ops \n by unfold_locales\n\ninterpretation lh_set_xx!: g_set_xx_loc ls_ops hs_ops\n by unfold_locales\ninterpretation lll_iflt_cp: inj_image_filter_cp_loc ls_ops ls_ops ls_ops\n by unfold_locales\ninterpretation hhh_cart: cart_loc hs_ops hs_ops hs_ops by unfold_locales\ninterpretation hh_set_xy!: g_set_xy_loc hs_ops hs_ops \n by unfold_locales\n\ninterpretation llh_set_xyy!: g_set_xyy_loc ls_ops ls_ops hs_ops\n by unfold_locales\n\ninterpretation hh_map_to_nat!: map_to_nat_loc hs_ops hm_ops by unfold_locales\ninterpretation hh_set_xy!: g_set_xy_loc hs_ops hs_ops by unfold_locales\ninterpretation lh_set_xy!: g_set_xy_loc ls_ops hs_ops by unfold_locales\ninterpretation hh_set_xx!: g_set_xx_loc hs_ops hs_ops by unfold_locales\ninterpretation hs_to_fifo!: set_to_list_loc hs_ops fifo_ops by unfold_locales\n\nsetup Locale_Code.close_block\n\nsubsection \"Generating Indices of Rules\"\ntext {*\n Rule indices are pieces of extra information that may be attached to a \n tree automaton.\n There are three possible rule indices\n \\begin{description}\n \\item[f] index of rules by function symbol\n \\item[s] index of rules by lhs\n \\item[sf] index of rules\n \\end{description}\n *}\n\ndefinition build_rule_index \n :: \"(('q,'l) ta_rule \\ 'i::hashable) \\ ('q,'l) ta_rule ls \n \\ ('i,('q,'l) ta_rule ls) hm\"\n where \"build_rule_index == hll_idx.idx_build\"\n\ndefinition \"build_rule_index_f \\ == build_rule_index (\\r. rhsl r) \\\"\ndefinition \"build_rule_index_s \\ == build_rule_index (\\r. lhs r) \\\"\ndefinition \"build_rule_index_sf \\ == build_rule_index (\\r. (lhs r, rhsl r)) \\\"\n\nlemma build_rule_index_f_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows \"hll_idx.is_index rhsl (ls_\\ \\) (build_rule_index_f \\)\"\n apply (unfold build_rule_index_f_def build_rule_index_def)\n apply (simp add: hll_idx.idx_build_is_index)\n done\n\nlemma build_rule_index_s_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows\n \"hll_idx.is_index lhs (ls_\\ \\) (build_rule_index_s \\)\"\n by (unfold build_rule_index_s_def build_rule_index_def)\n (simp add: hll_idx.idx_build_is_index)\n\nlemma build_rule_index_sf_correct[simp]: \n assumes I[simp, intro!]: \"ls_invar \\\"\n shows\n \"hll_idx.is_index (\\r. (lhs r, rhsl r)) (ls_\\ \\) (build_rule_index_sf \\)\"\n by (unfold build_rule_index_sf_def build_rule_index_def)\n (simp add: hll_idx.idx_build_is_index)\n\nsubsection \"Tree Automaton with Optional Indices\"\n\ntext {*\n A tree automaton contains a hashset of initial states, a list-set of rules and\n several (optional) rule indices.\n *}\n\nrecord ('q,'l) hashedTa =\n -- \"Initial states\"\n hta_Qi :: \"'q hs\" \n -- \"Rules\"\n hta_\\ :: \"('q,'l) ta_rule ls\" \n -- \"Rules by function symbol\"\n hta_idx_f :: \"('l,('q,'l) ta_rule ls) hm option\" \n -- \"Rules by lhs state\"\n hta_idx_s :: \"('q,('q,'l) ta_rule ls) hm option\" \n -- \"Rules by lhs state and function symbol\"\n hta_idx_sf :: \"('q\\'l,('q,'l) ta_rule ls) hm option\" \n\n -- \"Abstraction of a concrete tree automaton to an abstract one\"\ndefinition hta_\\ \n where \"hta_\\ H = \\ ta_initial = hs_\\ (hta_Qi H), ta_rules = ls_\\ (hta_\\ H) \\\"\n\n -- \"Builds the f-index if not present\"\ndefinition \"hta_ensure_idx_f H ==\n case hta_idx_f H of \n None \\ H\\ hta_idx_f := Some (build_rule_index_f (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\n -- \"Builds the s-index if not present\"\ndefinition \"hta_ensure_idx_s H ==\n case hta_idx_s H of \n None \\ H\\ hta_idx_s := Some (build_rule_index_s (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\n -- \"Builds the sf-index if not present\"\ndefinition \"hta_ensure_idx_sf H ==\n case hta_idx_sf H of \n None \\ H\\ hta_idx_sf := Some (build_rule_index_sf (hta_\\ H)) \\ |\n Some _ \\ H\n \"\n\nlemma hta_ensure_idx_f_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_f H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_f_def hta_\\_def split: option.split)\nlemma hta_ensure_idx_s_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_s H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_s_def hta_\\_def split: option.split)\nlemma hta_ensure_idx_sf_correct_\\[simp]: \n \"hta_\\ (hta_ensure_idx_sf H) = hta_\\ H\" \n by (simp add: hta_ensure_idx_sf_def hta_\\_def split: option.split)\n\nlemma hta_ensure_idx_other[simp]:\n \"hta_Qi (hta_ensure_idx_f H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_f H) = hta_\\ H\"\n \n \"hta_Qi (hta_ensure_idx_s H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_s H) = hta_\\ H\"\n \n \"hta_Qi (hta_ensure_idx_sf H) = hta_Qi H\" \n \"hta_\\ (hta_ensure_idx_sf H) = hta_\\ H\"\n by (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n split: option.split)\n\n -- \"Check whether the f-index is present\"\ndefinition \"hta_has_idx_f H == hta_idx_f H \\ None\"\n -- \"Check whether the s-index is present\"\ndefinition \"hta_has_idx_s H == hta_idx_s H \\ None\"\n -- \"Check whether the sf-index is present\"\ndefinition \"hta_has_idx_sf H == hta_idx_sf H \\ None\"\n\nlemma hta_idx_f_pres\n [simp, intro!]: \"hta_has_idx_f (hta_ensure_idx_f H)\" and\n [simp, intro]: \"hta_has_idx_s H \\ hta_has_idx_s (hta_ensure_idx_f H)\" and\n [simp, intro]: \"hta_has_idx_sf H \\ hta_has_idx_sf (hta_ensure_idx_f H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_f_def \n split: option.split)\n\nlemma hta_idx_s_pres\n [simp, intro!]: \"hta_has_idx_s (hta_ensure_idx_s H)\" and\n [simp, intro]: \"hta_has_idx_f H \\ hta_has_idx_f (hta_ensure_idx_s H)\" and\n [simp, intro]: \"hta_has_idx_sf H \\ hta_has_idx_sf (hta_ensure_idx_s H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_s_def \n split: option.split)\n\nlemma hta_idx_sf_pres\n [simp, intro!]: \"hta_has_idx_sf (hta_ensure_idx_sf H)\" and\n [simp, intro]: \"hta_has_idx_f H \\ hta_has_idx_f (hta_ensure_idx_sf H)\" and\n [simp, intro]: \"hta_has_idx_s H \\ hta_has_idx_s (hta_ensure_idx_sf H)\"\n by (simp_all \n add: hta_has_idx_f_def hta_has_idx_s_def hta_has_idx_sf_def \n hta_ensure_idx_sf_def \n split: option.split)\n\ntext {*\n The lookup functions are only defined if the required index is present. \n This enforces generation of the index before applying lookup functions.\n *}\n -- \"Lookup rules by function symbol\"\ndefinition \"hta_lookup_f f H == hll_idx.lookup f (the (hta_idx_f H))\"\n -- \"Lookup rules by lhs-state\"\ndefinition \"hta_lookup_s q H == hll_idx.lookup q (the (hta_idx_s H))\"\n -- \"Lookup rules by function symbol and lhs-state\"\ndefinition \"hta_lookup_sf q f H == hll_idx.lookup (q,f) (the (hta_idx_sf H))\"\n\n\n -- \"This locale defines the invariants of a tree automaton\"\nlocale hashedTa =\n fixes H :: \"('Q::hashable,'L::hashable) hashedTa\"\n\n -- \"The involved sets satisfy their invariants\"\n assumes invar[simp, intro!]: \n \"hs_invar (hta_Qi H)\"\n \"ls_invar (hta_\\ H)\"\n\n -- \"The indices are correct, if present\"\n assumes index_correct:\n \"hta_idx_f H = Some idx_f \n \\ hll_idx.is_index rhsl (ls_\\ (hta_\\ H)) idx_f\"\n \"hta_idx_s H = Some idx_s \n \\ hll_idx.is_index lhs (ls_\\ (hta_\\ H)) idx_s\"\n \"hta_idx_sf H = Some idx_sf \n \\ hll_idx.is_index (\\r. (lhs r, rhsl r)) (ls_\\ (hta_\\ H)) idx_sf\"\n\nbegin\n -- \"Inside this locale, some shorthand notations for the sets of \n rules and initial states are used\"\n abbreviation \"\\ == hta_\\ H\"\n abbreviation \"Qi == hta_Qi H\"\n\n -- {* The lookup-xxx operations are correct *}\n lemma hta_lookup_f_correct: \n \"hta_has_idx_f H \\ ls_\\ (hta_lookup_f f H) = {r\\ls_\\ \\ . rhsl r = f}\"\n \"hta_has_idx_f H \\ ls_invar (hta_lookup_f f H)\"\n apply (cases \"hta_has_idx_f H\")\n apply (unfold hta_has_idx_f_def hta_lookup_f_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(1)] \n index_def)\n done\n\n lemma hta_lookup_s_correct: \n \"hta_has_idx_s H \\ ls_\\ (hta_lookup_s q H) = {r\\ls_\\ \\ . lhs r = q}\"\n \"hta_has_idx_s H \\ ls_invar (hta_lookup_s q H)\"\n apply (cases \"hta_has_idx_s H\")\n apply (unfold hta_has_idx_s_def hta_lookup_s_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(2)] \n index_def)\n done\n\n lemma hta_lookup_sf_correct: \n \"hta_has_idx_sf H \n \\ ls_\\ (hta_lookup_sf q f H) = {r\\ls_\\ \\ . lhs r = q \\ rhsl r = f}\"\n \"hta_has_idx_sf H \\ ls_invar (hta_lookup_sf q f H)\"\n apply (cases \"hta_has_idx_sf H\")\n apply (unfold hta_has_idx_sf_def hta_lookup_sf_def)\n apply (auto \n simp add: hll_idx.lookup_correct[OF index_correct(3)] \n index_def)\n done\n\n -- {* The ensure-index operations preserve the invariants *}\n lemma hta_ensure_idx_f_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_f H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n lemma hta_ensure_idx_s_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_s H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n lemma hta_ensure_idx_sf_correct[simp, intro!]: \"hashedTa (hta_ensure_idx_sf H)\"\n apply (unfold_locales)\n apply (auto)\n apply (auto \n simp add: hta_ensure_idx_f_def hta_ensure_idx_s_def hta_ensure_idx_sf_def \n index_correct \n split: option.split_asm)\n done\n\n text {* The abstract tree automaton satisfies the invariants for an abstract\n tree automaton *}\n lemma hta_\\_is_ta[simp, intro!]: \"tree_automaton (hta_\\ H)\"\n apply unfold_locales\n apply (unfold hta_\\_def)\n apply auto\n done\n\nend\n\n-- \"Add some lemmas to simpset -- also outside the locale\"\nlemmas [simp, intro] = \n hashedTa.hta_ensure_idx_f_correct\n hashedTa.hta_ensure_idx_s_correct\n hashedTa.hta_ensure_idx_sf_correct\n\n -- \"Build a tree automaton from a set of initial states and a set of rules\"\ndefinition \"init_hta Qi \\ == \n \\ hta_Qi= Qi, \n hta_\\ = \\, \n hta_idx_f = None, \n hta_idx_s = None, \n hta_idx_sf = None \n \\\"\n\n -- \"Building a tree automaton from a valid tree automaton yields again a \n valid tree automaton. This operation has the only effect of removing \n the indices.\"\nlemma (in hashedTa) init_hta_is_hta: \n \"hashedTa (init_hta (hta_Qi H) (hta_\\ H))\"\n apply (unfold_locales)\n apply (unfold init_hta_def)\n apply (auto)\n done\n\nsubsection \"Algorithm for the Word Problem\"\n\nlemma r_match_by_laz: \"r_match L l = list_all_zip (\\Q q. q\\Q) L l\"\n by (unfold r_match_alt list_all_zip_alt)\n auto\n\n\ntext \"Executable function that computes the set of accepting states for \n a given tree\"\nfun faccs' where\n \"faccs' H (NODE f ts) = (\n let Qs = List.map (faccs' H) ts in\n ll_set_xy.g_image_filter (\\r. case r of (q \\ f' qs) \\ \n if list_all_zip (\\Q q. ls_memb q Q) Qs qs then Some (lhs r) else None\n ) \n (hta_lookup_f f H)\n )\"\n\n -- \"Executable algorithm to decide the word-problem. The first version \n depends on the f-index to be present, the second version computes the \n index if not present.\"\ndefinition \"hta_mem' t H == \\lh_set_xx.g_disjoint (faccs' H t) (hta_Qi H)\"\ndefinition \"hta_mem t H == hta_mem' t (hta_ensure_idx_f H)\"\n\ncontext hashedTa\nbegin\n\n lemma faccs'_invar:\n assumes HI[simp, intro!]: \"hta_has_idx_f H\"\n shows \"ls_invar (faccs' H t)\" (is ?T1) \n \"list_all ls_invar (List.map (faccs' H) ts)\" (is ?T2)\n proof -\n have \"?T1 \\ ?T2\"\n apply (induct rule: compat_tree_tree_list.induct)\n apply (auto simp add: ll_set_xy.image_filter_correct hta_lookup_f_correct)\n done\n thus ?T1 ?T2 by auto\n qed\n\n declare faccs'_invar(1)[simp, intro]\n\n lemma faccs'_correct:\n assumes HI[simp, intro!]: \"hta_has_idx_f H\"\n shows \n \"ls_\\ (faccs' H t) = faccs (ls_\\ (hta_\\ H)) t\" (is ?T1)\n \"List.map ls_\\ (List.map (faccs' H) ts) \n = List.map (faccs (ls_\\ (hta_\\ H))) ts\" (is ?T2)\n proof -\n have \"?T1 \\ ?T2\"\n proof (induct rule: compat_tree_tree_list.induct)\n case (NODE f ts)\n let ?\\ = \"(ls_\\ (hta_\\ H))\"\n have \"faccs ?\\ (NODE f ts) = (\n let Qs = List.map (faccs ?\\) ts in\n {q. \\r\\?\\. r_matchc q f Qs r })\"\n by (rule faccs.simps)\n also note NODE.hyps[symmetric]\n finally have \n 1: \"faccs ?\\ (NODE f ts) \n = ( let Qs = List.map ls_\\ (List.map (faccs' H) ts) in\n {q. \\r\\?\\. r_matchc q f Qs r })\" .\n {\n fix Qsc:: \"'Q ls list\"\n assume QI: \"list_all ls_invar Qsc\"\n let ?Qs = \"List.map ls_\\ Qsc\"\n have \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = { q. \\qs. (q \\ f qs)\\?\\ \\ r_match ?Qs qs }\"\n apply (safe)\n apply (case_tac r)\n apply auto [1]\n apply force\n done\n also have \"\\ = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ r_match ?Qs qs}\"\n apply auto\n apply force\n apply (case_tac xa)\n apply auto\n done\n finally have \n 1: \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ r_match ?Qs qs}\" \n by auto\n from QI have \n [simp]: \"!!qs. list_all_zip (\\Q q. q\\ls_\\ Q) Qsc qs \n \\ list_all_zip (\\Q q. ls_memb q Q) Qsc qs\"\n apply (induct Qsc)\n apply (case_tac qs)\n apply auto [2]\n apply (case_tac qs)\n apply (auto simp add: ls.correct) [2]\n done\n have 2: \"!!qs. r_match ?Qs qs = list_all_zip (\\a b. ls_memb b a) Qsc qs\"\n apply (unfold r_match_by_laz)\n apply (simp add: list_all_zip_map1)\n done\n from 1 have \n \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = lhs ` { r\\{r\\?\\. rhsl r = f}. \n case r of (q \\ f' qs) \\ \n list_all_zip (\\a b. ls_memb b a) Qsc qs}\" \n by (simp only: 2)\n also have \n \"\\ = lhs ` { r\\ls_\\ (hta_lookup_f f H). \n case r of (q \\ f' qs) \\ \n list_all_zip (\\a b. ls_memb b a) Qsc qs}\" \n by (simp add: hta_lookup_f_correct)\n also have \n \"\\ = ls_\\ ( ll_set_xy.g_image_filter \n ( \\r. case r of (q \\ f' qs) \\ \n (if (list_all_zip (\\Q q. ls_memb q Q) Qsc qs) then Some (lhs r) else None))\n (hta_lookup_f f H)\n )\"\n apply (simp add: ll_set_xy.image_filter_correct hta_lookup_f_correct)\n apply (auto split: ta_rule.split)\n apply (rule_tac x=xa in exI)\n apply auto\n apply (case_tac a)\n apply (simp add: image_iff)\n apply (rule_tac x=a in exI)\n apply auto\n done\n finally have \n \"{ q. \\r\\?\\. r_matchc q f ?Qs r } \n = ls_\\ ( ll_set_xy.g_image_filter \n (\\r. case r of (q \\ f' qs) \\ \n (if (list_all_zip (\\Q q. ls_memb q Q) Qsc qs) then Some (lhs r) else None))\n (hta_lookup_f f H))\" .\n } note 2=this\n \n from \n 1 \n 2[ where Qsc2 = \"(List.map (faccs' H) ts)\", \n simplified faccs'_invar[OF HI]] \n show ?case by simp\n qed simp_all\n thus ?T1 ?T2 by auto\n qed\n\n -- \"Correctness of the algorithms for the word problem\"\n lemma hta_mem'_correct: \n \"hta_has_idx_f H \\ hta_mem' t H \\ t\\ta_lang (hta_\\ H)\"\n apply (unfold ta_lang_def hta_\\_def hta_mem'_def)\n apply (auto simp add: lh_set_xx.disjoint_correct faccs'_correct faccs_alt)\n done\n\n theorem hta_mem_correct: \"hta_mem t H \\ t\\ta_lang (hta_\\ H)\"\n using hashedTa.hta_mem'_correct[OF hta_ensure_idx_f_correct, simplified]\n apply (unfold hta_mem_def)\n apply simp\n done\n\nend\n\n\nsubsection \"Product Automaton and Intersection\"\n\nsubsubsection \"Brute Force Product Automaton\"\ntext {*\n In this section, an algorithm that computes the product \n automaton without reduction is implemented. While the runtime is always\n quadratic, this algorithm is very simple and the constant factors are \n smaller than that of the version with integrated reduction.\n Moreover, lazy languages like Haskell seem to profit from this algorithm.\n*}\n\ndefinition \\_prod_h \n :: \"('q1::hashable,'l::hashable) ta_rule ls \n \\ ('q2::hashable,'l) ta_rule ls \\ ('q1\\'q2,'l) ta_rule ls\" \n where \"\\_prod_h \\1 \\2 == \n lll_iflt_cp.inj_image_filter_cp (\\(r1,r2). r_prod r1 r2) \n (\\(r1,r2). rhsl r1 = rhsl r2 \n \\ length (rhsq r1) = length (rhsq r2)) \n \\1 \\2\"\n\nlemma r_prod_inj: \n \"\\ rhsl r1 = rhsl r2; length (rhsq r1) = length (rhsq r2); \n rhsl r1' = rhsl r2'; length (rhsq r1') = length (rhsq r2'); \n r_prod r1 r2 = r_prod r1' r2' \\ \\ r1=r1' \\ r2=r2'\"\n apply (cases r1, cases r2, cases r1', cases r2')\n apply (auto dest: zip_inj)\n done\n\nlemma \\_prod_h_correct:\n assumes INV[simp]: \"ls_invar \\1\" \"ls_invar \\2\"\n shows \n \"ls_\\ (\\_prod_h \\1 \\2) = \\_prod (ls_\\ \\1) (ls_\\ \\2)\"\n \"ls_invar (\\_prod_h \\1 \\2)\"\n apply (unfold \\_prod_def \\_prod_h_def)\n apply (subst lll_iflt_cp.inj_image_filter_cp_correct)\n apply simp_all [2]\n using r_prod_inj\n apply (auto intro!: inj_onI) []\n apply auto []\n apply (case_tac xa, case_tac y, simp, blast)\n apply force\n apply simp\n done\n\ndefinition \"hta_prodWR H1 H2 == \n init_hta (hhh_cart.cart (hta_Qi H1) (hta_Qi H2)) (\\_prod_h (hta_\\ H1) (hta_\\ H2))\"\n\nlemma hta_prodWR_correct_aux: \n assumes A: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"hta_\\ (hta_prodWR H1 H2) = ta_prod (hta_\\ H1) (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_prodWR H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using A .\n show ?T1 ?T2\n apply (unfold hta_prodWR_def init_hta_def hta_\\_def ta_prod_def)\n apply (simp add: hhh_cart.cart_correct \\_prod_h_correct)\n apply (unfold_locales)\n apply (simp_all add: hhh_cart.cart_correct \\_prod_h_correct)\n done\nqed\n \nlemma hta_prodWR_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_prodWR H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (hta_prodWR H1 H2)\"\n by (simp_all add: hta_prodWR_correct_aux[OF TA] ta_prod_correct_aux1)\n\nsubsubsection \"Product Automaton with Forward-Reduction\"\ntext {*\n A more elaborated algorithm combines forward-reduction and the product \n construction, i.e. product rules are only created ,,by need''.\n*}\n\n -- \"State of the product-automaton DFS-algorithm\"\ntype_synonym ('q1,'q2,'l) pa_state \n = \"('q1\\'q2) hs \\ ('q1\\'q2) list \\ ('q1\\'q2,'l) ta_rule ls\"\n\n -- {* Abstraction mapping to algorithm specified in \n Section~\\ref{sec:absalgo}.*}\ndefinition pa_\\ \n :: \"('q1::hashable,'q2::hashable,'l::hashable) pa_state \n \\ ('q1,'q2,'l) frp_state\"\n where \"pa_\\ S == let (Q,W,\\d)=S in (hs_\\ Q,W,ls_\\ \\d)\"\n\ndefinition pa_cond \n :: \"('q1::hashable,'q2::hashable,'l::hashable) pa_state \\ bool\" \n where \"pa_cond S == let (Q,W,\\d) = S in W\\[]\"\n\n -- \"Adds all successor states to the set of discovered states and to the \n worklist\"\nfun pa_upd_rule \n :: \"('q1\\'q2) hs \\ ('q1\\'q2) list \n \\ (('q1::hashable)\\('q2::hashable)) list \n \\ (('q1\\'q2) hs \\ ('q1\\'q2) list)\" \n where\n \"pa_upd_rule Q W [] = (Q,W)\" |\n \"pa_upd_rule Q W (qp#qs) = (\n if \\ hs_memb qp Q then\n pa_upd_rule (hs_ins qp Q) (qp#W) qs\n else pa_upd_rule Q W qs\n )\"\n\n\ndefinition pa_step \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ ('q1,'q2,'l) pa_state \\ ('q1,'q2,'l) pa_state\"\n where \"pa_step H1 H2 S == let \n (Q,W,\\d)=S;\n (q1,q2)=hd W\n in \n ls_iteratei (hta_lookup_s q1 H1) (\\_. True) (\\r1 res. \n ls_iteratei (hta_lookup_sf q2 (rhsl r1) H2) (\\_. True) (\\r2 res.\n if (length (rhsq r1) = length (rhsq r2)) then\n let \n rp=r_prod r1 r2;\n (Q,W,\\d) = res;\n (Q',W') = pa_upd_rule Q W (rhsq rp)\n in\n (Q',W',ls_ins_dj rp \\d)\n else\n res\n ) res\n ) (Q,tl W,\\d)\n \"\n\ndefinition pa_initial \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ ('q1,'q2,'l) pa_state\"\nwhere \"pa_initial H1 H2 == \n let Qip = hhh_cart.cart (hta_Qi H1) (hta_Qi H2) in (\n Qip,\n hs_to_list Qip,\n ls_empty ()\n )\"\n\ndefinition pa_invar_add:: \n \"('q1::hashable,'q2::hashable,'l::hashable) pa_state set\" \n where \"pa_invar_add == { (Q,W,\\d). hs_invar Q \\ ls_invar \\d }\"\n\ndefinition \"pa_invar H1 H2 == \n pa_invar_add \\ {s. (pa_\\ s) \\ frp_invar (hta_\\ H1) (hta_\\ H2)}\"\n\ndefinition \"pa_det_algo H1 H2 \n == \\ dwa_cond=pa_cond, \n dwa_step = pa_step H1 H2, \n dwa_initial = pa_initial H1 H2, \n dwa_invar = pa_invar H1 H2 \\\"\n\nlemma pa_upd_rule_correct:\n assumes INV[simp, intro!]: \"hs_invar Q\"\n assumes FMT: \"pa_upd_rule Q W qs = (Q',W')\"\n shows\n \"hs_invar Q'\" (is ?T1)\n \"hs_\\ Q' = hs_\\ Q \\ set qs\" (is ?T2)\n \"\\Wn. distinct Wn \\ set Wn = set qs - hs_\\ Q \\ W'=Wn@W\" (is ?T3)\nproof -\n from INV FMT have \"?T1 \\ ?T2 \\ ?T3\"\n proof (induct qs arbitrary: Q W Q' W')\n case Nil thus ?case by simp\n next\n case (Cons q qs Q W Q' W')\n show ?case \n proof (cases \"q\\hs_\\ Q\")\n case True \n obtain Qh Wh where RF: \"pa_upd_rule Q W qs = (Qh,Wh)\" by force\n with True Cons.prems have [simp]: \"Q'=Qh\" \"W'=Wh\"\n by (auto simp add: hs.correct)\n from Cons.hyps[OF Cons.prems(1) RF] have\n \"hs_invar Qh\" \n \"hs_\\ Qh = hs_\\ Q \\ set qs\" \n \"(\\Wn. distinct Wn \\ set Wn = set qs - hs_\\ Q \\ Wh = Wn @ W)\"\n by auto\n thus ?thesis using True by auto\n next\n case False\n with Cons.prems have RF: \"pa_upd_rule (hs_ins q Q) (q#W) qs = (Q',W')\"\n by (auto simp add: hs.correct)\n\n from Cons.hyps[OF _ RF] Cons.prems(1) have\n \"hs_invar Q'\" \n \"hs_\\ Q' = insert q (hs_\\ Q) \\ set (qs)\"\n \"\\Wn. distinct Wn \n \\ set Wn = set qs - insert q (hs_\\ Q) \n \\ W' = Wn @ q # W\"\n by (auto simp add: hs.correct)\n thus ?thesis using False by auto\n qed\n qed\n thus ?T1 ?T2 ?T3 by auto\nqed\n\n\nlemma pa_step_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n assumes INV: \"(Q,W,\\d)\\pa_invar H1 H2\"\n assumes COND: \"pa_cond (Q,W,\\d)\"\n shows \n \"(pa_step H1 H2 (Q,W,\\d))\\pa_invar_add\" (is ?T1)\n \"(pa_\\ (Q,W,\\d), pa_\\ (pa_step H1 H2 (Q,W,\\d))) \n \\ frp_step (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2))\" (is ?T2)\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n from COND obtain q1 q2 Wtl where \n [simp]: \"W=(q1,q2)#Wtl\" \n by (cases W) (auto simp add: pa_cond_def)\n\n from INV have [simp]: \"hs_invar Q\" \"ls_invar \\d\" \n by (auto simp add: pa_invar_add_def pa_invar_def)\n\n def inv == \"\\\\p (Q', W', \\d'). \n hs_invar Q' \n \\ ls_invar \\d' \n \\ (\\Wn. distinct Wn \n \\ set Wn = (f_succ \\p `` {(q1,q2)}) - hs_\\ Q \n \\ W'=Wn@Wtl \n \\ hs_\\ Q'=hs_\\ Q \\ (f_succ \\p `` {(q1,q2)}))\n \\ (ls_\\ \\d' = ls_\\ \\d \\ {r\\\\p. lhs r = (q1,q2) })\"\n\n have G: \"inv (\\_prod (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2))) \n (pa_step H1 H2 (Q,W,\\d))\"\n apply (unfold pa_step_def)\n apply simp\n apply (rule_tac \n I=\"\\it1 res. inv (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2))) res\"\n in ls.iterate_rule_P)\n -- \"Invar\"\n apply (simp add: h1.hta_lookup_s_correct)\n -- \"Initial\"\n apply (fastforce simp add: inv_def \\_prod_def h1.hta_lookup_s_correct \n f_succ_alt)\n -- \"Step\"\n apply (rule_tac \n I=\"\\it2 res. inv ( \\_prod (ls_\\ (hta_\\ H1) - it) (ls_\\ (hta_\\ H2)) \n \\ \\_prod {x} (ls_\\ (hta_\\ H2) - it2)) \n res\" \n in ls.iterate_rule_P)\n -- \"Invar\"\n apply (simp add: h2.hta_lookup_sf_correct)\n -- \"Init\"\n apply (case_tac \\)\n apply (simp add: inv_def h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n apply (force simp add: f_succ_alt elim: \\_prodE intro: \\_prodI) [1]\n -- \"Step\"\n defer -- \"Requires considerably more work: Deferred to Isar proof below\"\n -- \"Final\"\n apply (simp add: h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n apply (auto) [1]\n apply (subgoal_tac \n \"ls_\\ (hta_\\ H1) - (it - {x}) = (ls_\\ (hta_\\ H1) - it) \\ {x}\")\n apply (simp add: \\_prod_insert)\n apply (subst Un_commute)\n apply simp\n apply blast\n -- \"Final\"\n apply force\n proof -\n case (goal1 r1 it1 resxh r2 it2 resh)\n -- \"Resolve lookup-operations\"\n hence G': \n \"it1 \\ {r \\ ls_\\ (hta_\\ H1). lhs r = q1}\" \n \"it2 \\ {r \\ ls_\\ (hta_\\ H2). lhs r = q2 \\ rhsl r = rhsl r1}\"\n by (simp_all add: h1.hta_lookup_s_correct h2.hta_lookup_sf_correct)\n\n -- \"Basic reasoning setup\"\n from goal1(1,4) G' have \n [simp]: \"ls_\\ (hta_\\ H2) - (it2 - {r2}) = (ls_\\ (hta_\\ H2) - it2) \\ {r2}\"\n by auto\n obtain Qh Wh \\dh Q' W' \\d' where [simp]: \"resh=(Qh,Wh,\\dh)\" \n by (cases resh) fastforce\n from goal1(6) have INVAH[simp]: \"hs_invar Qh\" \"ls_invar \\dh\" \n by (auto simp add: inv_def)\n\n -- \"The involved rules have the same label, and their lhs is determined\"\n from goal1(1,4) G' obtain l qs1 qs2 where \n RULE_FMT: \"r1 = (q1 \\ l qs1)\" \"r2=(q2 \\ l qs2)\"\n apply (cases r1, cases r2)\n apply force\n done\n\n {\n -- \"If the rhs have different lengths, the algorithm ignores the rule: \"\n assume LEN: \"length (rhsq r1) \\ length (rhsq r2)\"\n \n hence [simp]: \"\\_prod_sng2 {r1} r2 = {}\"\n by (auto simp add: \\_prod_sng2_def split: ta_rule.split)\n\n have ?case using goal1 \n by (simp add: LEN \\_prod_insert)\n } moreover {\n -- \"If the rhs have the same length, the rule is inserted\"\n assume LEN: \"length (rhsq r1) = length (rhsq r2)\"\n hence [simp]: \"length qs1 = length qs2\" by (simp add: RULE_FMT)\n\n hence [simp]: \"\\_prod_sng2 {r1} r2 = {(q1,q2) \\ l (zip qs1 qs2)}\"\n using goal1(1,4) G'\n by (auto simp add: \\_prod_sng2_def RULE_FMT)\n\n -- \"Obtain invariant of previous state\"\n from goal1(6)[unfolded inv_def, simplified] obtain Wn where INVH:\n \"distinct Wn\"\n \"set Wn = f_succ (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)) \n `` {(q1, q2)} - hs_\\ Q\"\n \"Wh = Wn @ Wtl\" \n \"hs_\\ Qh = hs_\\ Q \n \\ f_succ (\\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2))\n \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)) \n `` {(q1, q2)}\" \n \"ls_\\ \\dh = ls_\\ \\d \n \\ {r. ( r \\ \\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ r \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)\n ) \\ lhs r = (q1, q2)\n }\"\n by blast\n\n -- \"Required to justify disjoint insert\"\n have RPD: \"r_prod r1 r2 \\ ls_\\ \\dh\" \n proof -\n from INV[unfolded pa_invar_def frp_invar_def frp_invar_add_def]\n have LSDD: \n \"ls_\\ \\d = {r \\ \\_prod (ls_\\ (hta_\\ H1)) (ls_\\ (hta_\\ H2)). \n lhs r \\ hs_\\ Q - set W}\"\n by (auto simp add: pa_\\_def hta_\\_def)\n have \"r_prod r1 r2 \\ ls_\\ \\d\"\n proof\n assume \"r_prod r1 r2 \\ ls_\\ \\d\"\n with LSDD have \"lhs (r_prod r1 r2) \\ set W\" by auto\n moreover from goal1(1,4) G' have \"lhs (r_prod r1 r2) = (q1,q2)\" \n by (cases r1, cases r2) auto\n ultimately show False by simp\n qed\n moreover from goal1(6) have \"ls_\\ \\dh = \n ls_\\ \\d \\ \n {r. ( r \\ \\_prod (ls_\\ (hta_\\ H1) - it1) (ls_\\ (hta_\\ H2)) \n \\ r \\ \\_prod {r1} (ls_\\ (hta_\\ H2) - it2)\n ) \\ lhs r = (q1, q2)}\" (is \"_= _ \\ ?s\")\n by (simp add: inv_def)\n moreover have \"r_prod r1 r2 \\ ?s\" using goal1(1,4) G'(2) LEN\n apply (cases r1, cases r2)\n apply (auto simp add: \\_prod_def)\n done\n ultimately show ?thesis by blast\n qed\n\n -- {* Correctness of result of @{text pa_upd_rule} *}\n obtain Q' W' where \n PAUF: \"(pa_upd_rule Qh Wh (rhsq (r_prod r1 r2))) = (Q',W')\" \n by force\n from pa_upd_rule_correct[OF INVAH(1) PAUF] obtain Wnn where UC:\n \"hs_invar Q'\"\n \"hs_\\ Q' = hs_\\ Qh \\ set (rhsq (r_prod r1 r2))\"\n \"distinct Wnn\" \n \"set Wnn = set (rhsq (r_prod r1 r2)) - hs_\\ Qh\" \n \"W' = Wnn @ Wh\"\n by blast\n\n -- \"Put it all together\"\n have ?case\n apply (simp add: LEN Let_def ls.ins_dj_correct[OF INVAH(2) RPD] \n PAUF inv_def UC(1))\n apply (intro conjI)\n apply (rule_tac x=\"Wnn@Wn\" in exI)\n apply (auto simp add: f_succ_alt \\_prod_insert RULE_FMT UC INVH \n \\_prod_sng2_def \\_prod_sng1_def)\n done\n } ultimately show ?case by blast\n qed\n from G show ?T1\n by (cases \"pa_step H1 H2 (Q,W,\\d)\")\n (simp add: pa_invar_add_def inv_def)\n from G show ?T2\n by (cases \"pa_step H1 H2 (Q,W,\\d)\")\n (auto simp add: inv_def pa_\\_def Let_def intro: frp_step.intros)\n\nqed\n \n \n\n -- \"The product-automaton algorithm is a precise implementation of its\n specification\"\nlemma pa_pref_frp: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n\n shows \"wa_precise_refine (det_wa_wa (pa_det_algo H1 H2)) \n (frp_algo (hta_\\ H1) (hta_\\ H2)) \n pa_\\\"\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n \n show ?thesis\n apply (unfold_locales)\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_\\_def \n pa_cond_def frp_algo_def frp_cond_def) [1]\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_cond_def\n hta_\\_def frp_algo_def frp_cond_def \n intro!: pa_step_correct(2)[OF TA]) [1]\n apply (auto simp add: det_wa_wa_def pa_det_algo_def pa_\\_def \n hta_\\_def pa_cond_def frp_algo_def frp_cond_def\n pa_invar_def pa_step_def pa_initial_def \n hs.correct ls.correct Let_def hhh_cart.cart_correct \n intro: frp_initial.intros\n ) [3]\n done\nqed\n\n\n -- \"The product automaton algorithm is a correct while-algorithm\"\nlemma pa_while_algo: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx[simp]: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n\n shows \"while_algo (det_wa_wa (pa_det_algo H1 H2))\"\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n interpret ref: wa_precise_refine \"(det_wa_wa (pa_det_algo H1 H2))\" \n \"(frp_algo (hta_\\ H1) (hta_\\ H2))\" \n \"pa_\\\" \n using pa_pref_frp[OF TA idx] .\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: frp_while_algo)\n apply (simp add: det_wa_wa_def pa_det_algo_def pa_invar_def frp_algo_def)\n\n apply (auto simp add: det_wa_wa_def pa_det_algo_def) [1]\n apply (rule pa_step_correct(1)[OF TA idx])\n apply (auto simp add: pa_invar_def frp_algo_def) [2]\n \n apply (simp add: det_wa_wa_def pa_det_algo_def pa_initial_def \n pa_invar_add_def Let_def hhh_cart.cart_correct ls.correct)\n done\nqed\n \n-- \"By definition, the product automaton algorithm is deterministic\"\nlemmas pa_det_while_algo = det_while_algo_intro[OF pa_while_algo]\n\n-- \"Transferred correctness lemma\"\nlemmas pa_inv_final = \n wa_precise_refine.transfer_correctness[OF pa_pref_frp frp_inv_final]\n\n\n-- \"The next two definitions specify the product-automata algorithm. The first\n version requires the s-index of the first and the sf-index of the second\n automaton to be present, while the second version computes the required \n indices, if necessary\"\ndefinition \"hta_prod' H1 H2 ==\n let (Q,W,\\d) = while pa_cond (pa_step H1 H2) (pa_initial H1 H2) in\n init_hta (hhh_cart.cart (hta_Qi H1) (hta_Qi H2)) \\d\n \"\n\ndefinition \"hta_prod H1 H2 == \n hta_prod' (hta_ensure_idx_s H1) (hta_ensure_idx_sf H2)\"\n\n\nlemma hta_prod'_correct_aux:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes idx: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n shows \"hta_\\ (hta_prod' H1 H2) \n = ta_fwd_reduce (ta_prod (hta_\\ H1) (hta_\\ H2))\" (is ?T1)\n \"hashedTa (hta_prod' H1 H2)\" (is ?T2)\nproof -\n interpret h1: hashedTa H1 by fact\n interpret h2: hashedTa H2 by fact\n\n interpret dwa: det_while_algo \"pa_det_algo H1 H2\" \n using pa_det_while_algo[OF TA idx] .\n\n have LC: \"while pa_cond (pa_step H1 H2) (pa_initial H1 H2) = dwa.loop\"\n by (unfold dwa.loop_def)\n (simp add: pa_det_algo_def)\n\n from dwa.while_proof'[OF pa_inv_final[OF TA idx]]\n show ?T1\n apply (unfold dwa.loop_def)\n apply (simp add: hta_prod'_def init_hta_def hta_\\_def pa_det_algo_def)\n apply (cases \"(while pa_cond (pa_step H1 H2) (pa_initial H1 H2))\")\n apply (simp add: pa_\\_def hhh_cart.cart_correct hta_\\_def)\n done\n\n show ?T2\n apply (simp add: hta_prod'_def LC)\n apply (rule dwa.while_proof)\n apply (case_tac s)\n apply (simp add: pa_det_algo_def pa_invar_add_def pa_invar_def init_hta_def)\n apply unfold_locales\n apply (simp_all add: hhh_cart.cart_correct)\n done\nqed\n\ntheorem hta_prod'_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n assumes HI: \"hta_has_idx_s H1\" \"hta_has_idx_sf H2\"\n shows \n \"ta_lang (hta_\\ (hta_prod' H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n\n \"hashedTa (hta_prod' H1 H2)\"\n by (simp_all add: hta_prod'_correct_aux[OF TA HI] ta_prod_correct_aux1)\n\nlemma hta_prod_correct_aux:\n assumes TA[simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"hta_\\ (hta_prod H1 H2) = ta_fwd_reduce (ta_prod (hta_\\ H1) (hta_\\ H2))\"\n \"hashedTa (hta_prod H1 H2)\"\n by (unfold hta_prod_def)\n (simp_all add: hta_prod'_correct_aux)\n \ntheorem hta_prod_correct:\n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_prod H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (hta_prod H1 H2)\"\n by (simp_all add: hta_prod_correct_aux[OF TA] ta_prod_correct_aux1)\n\n\nsubsection \"Remap States\"\n\n-- \"Mapping the states of an automaton\"\ndefinition hta_remap \n :: \"('q::hashable \\ 'qn::hashable) \\ ('q,'l::hashable) hashedTa \n \\ ('qn,'l) hashedTa\" \n where \"hta_remap f H == \n init_hta (hh_set_xy.g_image f (hta_Qi H)) \n (ll_set_xy.g_image (remap_rule f) (hta_\\ H))\"\n \nlemma (in hashedTa) hta_remap_correct:\n shows \"hta_\\ (hta_remap f H) = ta_remap f (hta_\\ H)\"\n \"hashedTa (hta_remap f H)\"\n apply (auto \n simp add: hta_remap_def init_hta_def hta_\\_def \n hh_set_xy.image_correct ll_set_xy.image_correct ta_remap_def)\n apply (unfold_locales)\n apply (auto simp add: hh_set_xy.image_correct ll_set_xy.image_correct)\n done\n\n\nsubsubsection \"Reindex Automaton\"\ntext {*\n In this section, an algorithm for re-indexing the states of the automaton to\n an initial segment of the naturals is implemented. The language of the \n automaton is not changed by the reindexing operation.\n*}\n\n -- \"Set of states of a rule\"\nfun rule_states_l where\n \"rule_states_l (q \\ f qs) = ls_ins q (ls.from_list qs)\"\n\nlemma rule_states_l_correct[simp]: \n \"ls_\\ (rule_states_l r) = rule_states r\"\n \"ls_invar (rule_states_l r)\"\n by (cases r, simp add: ls.correct)+\n\ndefinition \"hta_\\_states H \n == (llh_set_xyy.g_Union_image id (ll_set_xy.g_image_filter \n (\\r. Some (rule_states_l r)) (hta_\\ H)))\"\n\ndefinition \"hta_states H ==\n hs_union (hta_Qi H) (hta_\\_states H)\"\n\nlemma (in hashedTa) hta_\\_states_correct:\n \"hs_\\ (hta_\\_states H) = \\_states (ta_rules (hta_\\ H))\"\n \"hs_invar (hta_\\_states H)\"\nproof (simp_all add: hta_\\_def hta_\\_states_def)\n case goal1\n have \n [simp]: \"ls_\\ (ll_set_xy.g_image_filter (\\x. Some (rule_states_l x)) \\) \n = rule_states_l ` ls_\\ \\\"\n by (auto simp add: ll_set_xy.image_filter_correct)\n show ?case\n apply (simp add: \\_states_def)\n apply (subst\n llh_set_xyy.Union_image_correct[\n of \"(ll_set_xy.g_image_filter (\\x. Some (rule_states_l x)) \\)\", \n simplified])\n apply (auto simp add: ll_set_xy.image_filter_correct)\n done\n(*next\n case goal2 thus ?case\n apply (rule llh.Union_image_correct)\n apply (auto simp add: ls.image_filter_correct)\n done*)\nqed\n\n\n\ndefinition \"reindex_map H == \n \\q. the (hm_lookup q (hh_map_to_nat.map_to_nat (hta_states H)))\"\n\ndefinition hta_reindex \n :: \"('Q::hashable,'L::hashable) hashedTa \\ (nat,'L) hashedTa\" where\n \"hta_reindex H == hta_remap (reindex_map H) H\"\n\ndeclare hta_reindex_def [code del]\n\n -- \"This version is more efficient, as the map is only computed once\"\n\n\n\nlemma (in hashedTa) reindex_map_correct:\n \"inj_on (reindex_map H) (ta_rstates (hta_\\ H))\"\nproof -\n have [simp]: \n \"reindex_map H = the \\ hm_\\ (hh_map_to_nat.map_to_nat (hta_states H))\"\n by (rule ext)\n (simp add: reindex_map_def hm.correct \n hh_map_to_nat.map_to_nat_correct(4) \n hta_states_correct)\n\n show ?thesis\n apply (simp add: hta_states_correct(1)[symmetric])\n apply (rule inj_on_map_the)\n apply (simp_all add: hh_map_to_nat.map_to_nat_correct hta_states_correct(2))\n done\nqed\n\ntheorem (in hashedTa) hta_reindex_correct:\n \"ta_lang (hta_\\ (hta_reindex H)) = ta_lang (hta_\\ H)\"\n \"hashedTa (hta_reindex H)\"\n apply (unfold hta_reindex_def)\n apply (simp_all \n add: hta_remap_correct tree_automaton.remap_lang[OF hta_\\_is_ta] \n reindex_map_correct)\n done\n\nsubsection \"Union\"\n\ntext \"Computes the union of two automata\"\ndefinition hta_union \n :: \"('q1::hashable,'l::hashable) hashedTa \n \\ ('q2::hashable,'l) hashedTa \n \\ (('q1,'q2) ustate_wrapper,'l) hashedTa\" \n where \"hta_union H1 H2 == \n init_hta (hs_union (hh_set_xy.g_image USW1 (hta_Qi H1)) \n (hh_set_xy.g_image USW2 (hta_Qi H2))) \n (ls_union_dj (ll_set_xy.g_image (remap_rule USW1) (hta_\\ H1)) \n (ll_set_xy.g_image (remap_rule USW2) (hta_\\ H2)))\"\n\nlemma hta_union_correct': \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \"hta_\\ (hta_union H1 H2) \n = ta_union_wrap (hta_\\ H1) (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_union H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using TA .\n show ?T1 ?T2 \n apply (auto \n simp add: hta_union_def init_hta_def hta_\\_def \n hs.correct ls.correct \n ll_set_xy.image_correct hh_set_xy.image_correct\n ta_remap_def ta_union_def ta_union_wrap_def)\n apply (unfold_locales)\n apply (auto \n simp add: hs.correct ls.correct)\n done\nqed\n\ntheorem hta_union_correct: \n assumes TA: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (hta_union H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\" (is ?T1)\n \"hashedTa (hta_union H1 H2)\" (is ?T2)\nproof -\n interpret a1: hashedTa H1 + a2: hashedTa H2 using TA .\n show ?T1 ?T2\n by (simp_all add: hta_union_correct'[OF TA] ta_union_wrap_correct)\nqed\n\nsubsection \"Operators to Construct Tree Automata\"\ntext {*\n This section defines operators that add initial states and rules to a tree \n automaton, and thus incrementally construct a tree automaton from the empty\n automaton.\n *}\n\n-- \"The empty automaton\"\ndefinition hta_empty :: \"unit \\ ('q::hashable,'l::hashable) hashedTa\" \n where \"hta_empty u == init_hta (hs_empty ()) (ls_empty ())\"\nlemma hta_empty_correct [simp, intro!]: \n shows \"(hta_\\ (hta_empty ())) = ta_empty\"\n \"hashedTa (hta_empty ())\"\n apply (auto\n simp add: init_hta_def hta_empty_def hta_\\_def \\_states_def ta_empty_def\n hs.correct ls.correct)\n apply (unfold_locales)\n apply (auto simp add: hs.correct ls.correct)\n done\n\n-- \"Add an initial state to the automaton\"\ndefinition hta_add_qi \n :: \"'q \\ ('q::hashable,'l::hashable) hashedTa \\ ('q,'l) hashedTa\" \n where \"hta_add_qi qi H == init_hta (hs_ins qi (hta_Qi H)) (hta_\\ H)\"\n\nlemma (in hashedTa) hta_add_qi_correct[simp, intro!]:\n shows \"hta_\\ (hta_add_qi qi H) \n = \\ ta_initial = insert qi (ta_initial (hta_\\ H)), \n ta_rules = ta_rules (hta_\\ H) \n \\\"\n \"hashedTa (hta_add_qi qi H)\"\n apply (auto \n simp add: init_hta_def hta_add_qi_def hta_\\_def \\_states_def \n hs.correct)\n apply (unfold_locales)\n apply (auto simp add: hs.correct)\n done\n\nlemmas [simp, intro] = hashedTa.hta_add_qi_correct\n\n-- \"Add a rule to the automaton\"\ndefinition hta_add_rule \n :: \"('q,'l) ta_rule \\ ('q::hashable,'l::hashable) hashedTa \n \\ ('q,'l) hashedTa\" \n where \"hta_add_rule r H == init_hta (hta_Qi H) (ls_ins r (hta_\\ H))\"\n\nlemma (in hashedTa) hta_add_rule_correct[simp, intro!]:\n shows \"hta_\\ (hta_add_rule r H) \n = \\ ta_initial = ta_initial (hta_\\ H), \n ta_rules = insert r (ta_rules (hta_\\ H)) \n \\\"\n \"hashedTa (hta_add_rule r H)\"\n apply (auto \n simp add: init_hta_def hta_add_rule_def hta_\\_def \n \\_states_def ls.correct)\n apply (unfold_locales)\n apply (auto simp add: ls.correct)\n done\n\nlemmas [simp, intro] = hashedTa.hta_add_rule_correct\n\n\n -- \"Reduces an automaton to the given set of states\"\ndefinition \"hta_reduce H Q ==\n init_hta (hs_inter Q (hta_Qi H)) \n (ll_set_xy.g_image_filter \n (\\r. if hs_memb (lhs r) Q \\ list_all (\\q. hs_memb q Q) (rhsq r) then Some r else None) \n (hta_\\ H))\n\"\n\ntheorem (in hashedTa) hta_reduce_correct:\n assumes INV[simp]: \"hs_invar Q\"\n shows\n \"hta_\\ (hta_reduce H Q) = ta_reduce (hta_\\ H) (hs_\\ Q)\" (is ?T1)\n \"hashedTa (hta_reduce H Q)\" (is ?T2)\n apply (auto \n simp add: \n hta_reduce_def ta_reduce_def hta_\\_def init_hta_def \n hs.correct ls.correct\n (*hs_correct ls_correct *)\n list_all_iff \n reduce_rules_def rule_states_simp \n ll_set_xy.image_filter_correct\n split: \n ta_rule.split_asm\n ) [1]\n apply (unfold_locales)\n apply (unfold hta_reduce_def init_hta_def)\n apply (auto simp add: hs.correct ls.correct)\n done\n\n\n\nsubsection \"Backwards Reduction and Emptiness Check\"\n\ntext {*\n The algorithm uses a map from states to the set of rules that contain \n the state on their rhs.\n*}\n\n -- \"Add an entry to the index\"\ndefinition \"rqrm_add q r res ==\n case hm_lookup q res of\n None \\ hm_update q (ls_ins r (ls_empty ())) res |\n Some s \\ hm_update q (ls_ins r s) res\n \"\n\n -- \"Lookup the set of rules with given state on rhs\"\ndefinition \"rqrm_lookup rqrm q == case hm_lookup q rqrm of\n None \\ ls_empty () |\n Some s \\ s\n \"\n\n -- \"Build the index from a set of rules\"\ndefinition build_rqrm \n :: \"('q::hashable,'l::hashable) ta_rule ls \n \\ ('q,('q,'l) ta_rule ls) hm\" \n where\n \"build_rqrm \\ ==\n ls_iteratei \\ (\\_. True)\n (\\r res. \n foldl (\\res q. rqrm_add q r res) res (rhsq r)\n )\n (hm_empty ())\n \"\n\n-- \"Whether the index satisfies the map and set invariants\"\ndefinition \"rqrm_invar rqrm == \n hm_invar rqrm \\ (\\q. ls_invar (rqrm_lookup rqrm q))\"\n-- \"Whether the index really maps a state to the set of rules with this \n state on their rhs\"\ndefinition \"rqrm_prop \\ rqrm == \n \\q. ls_\\ (rqrm_lookup rqrm q) = {r\\\\. q\\set (rhsq r)}\"\n\nlemma rqrm_\\_lookup_update[simp]: \n \"rqrm_invar rqrm \\ \n ls_\\ (rqrm_lookup (rqrm_add q r rqrm) q') \n = ( if q=q' then \n insert r (ls_\\ (rqrm_lookup rqrm q')) \n else \n ls_\\ (rqrm_lookup rqrm q')\n )\"\n by (simp \n add: rqrm_lookup_def rqrm_add_def rqrm_invar_def hm.correct \n ls.correct \n split: option.split_asm option.split)\n\nlemma rqrm_propD: \n \"rqrm_prop \\ rqrm \\ ls_\\ (rqrm_lookup rqrm q) = {r\\\\. q\\set (rhsq r)}\"\n by (simp add: rqrm_prop_def)\n\nlemma build_rqrm_correct:\n fixes \\\n assumes [simp]: \"ls_invar \\\"\n shows \"rqrm_invar (build_rqrm \\)\" (is ?T1) and\n \"rqrm_prop (ls_\\ \\) (build_rqrm \\)\" (is ?T2)\nproof -\n have \"rqrm_invar (build_rqrm \\) \\ \n (\\q. ls_\\ (rqrm_lookup (build_rqrm \\) q) = {r\\ls_\\ \\. q\\set (rhsq r)})\"\n apply (unfold build_rqrm_def)\n apply (rule_tac \n I=\"\\it res. (rqrm_invar res) \n \\ (\\q. ls_\\ (rqrm_lookup res q) \n = {r\\ls_\\ \\ - it. q\\set (rhsq r)})\" \n in ls.iterate_rule_P)\n -- \"Invar\"\n apply simp\n -- \"Initial\"\n apply (simp add: hm_correct ls_correct rqrm_lookup_def rqrm_invar_def)\n -- \"Step\"\n apply (rule_tac \n I=\"\\res itl itr. \n (rqrm_invar res) \n \\ (\\q. ls_\\ (rqrm_lookup res q) \n = {r\\ls_\\ \\ - it. q\\set (rhsq r)} \n \\ {r. r=x \\ q\\set itl})\" \n in Misc.foldl_rule_P)\n -- \"Initial\"\n apply simp\n -- \"Step\"\n apply (intro conjI)\n apply (simp \n add: rqrm_invar_def rqrm_add_def rqrm_lookup_def hm_correct \n ls_correct \n split: option.split option.split_asm)\n apply simp\n apply (simp \n add: rqrm_add_def rqrm_lookup_def hm_correct ls_correct \n split: option.split option.split_asm)\n apply (auto) [1]\n -- \"Final\"\n apply auto [1]\n -- \"Final\"\n apply simp\n done\n thus ?T1 ?T2 by (simp_all add: rqrm_prop_def)\nqed\n\n-- {* \n A state of the basic algorithm contains a set of discovered states, \n a worklist and a map from rules to the number of distinct states on \n its RHS that have not yet been discovered or are still on the worklist\n*}\ntype_synonym ('Q,'L) brc_state \n = \"'Q hs \\ 'Q list \\ (('Q,'L) ta_rule, nat) hm\"\n\n-- {* Abstraction to @{text \\'}-level: *}\ndefinition brc_\\ \n :: \"('Q::hashable,'L::hashable) brc_state \\ ('Q,'L) br'_state\"\n where \"brc_\\ == \\(Q,W,rcm). (hs_\\ Q, set W, hm_\\ rcm)\"\n\ndefinition brc_invar_add :: \"('Q::hashable,'L::hashable) brc_state set\" \n where\n \"brc_invar_add == {(Q,W,rcm). \n hs_invar Q \\ \n distinct W \\ \n hm_invar rcm\n (*\\ set W \\ hs_\\ Q *)}\n \"\n\ndefinition \"brc_invar \\ == brc_invar_add \\ {s. brc_\\ s \\ br'_invar \\}\"\n\ndefinition brc_cond :: \"('q::hashable,'l::hashable) brc_state \\ bool\" \n where \"brc_cond == \\(Q,W,rcm). W\\[]\"\n\ndefinition brc_inner_step \n :: \"('q,'l) ta_rule \\ ('q::hashable,'l::hashable) brc_state \n \\ ('q,'l) brc_state\"\n where \n \"brc_inner_step r == \\(Q,W,rcm). \n let c=the (hm_lookup r rcm);\n rcm' = hm_update r (c-(1::nat)) rcm;\n Q' = (if c \\ 1 then hs_ins (lhs r) Q else Q);\n W' = (if c \\ 1 \\ \\ hs_memb (lhs r) Q then lhs r # W else W) in\n (Q',W',rcm')\"\n\ndefinition brc_step \n :: \"('q,('q,'l) ta_rule ls) hm \n \\ ('q::hashable,'l::hashable) brc_state \n \\ ('q,'l) brc_state\" \nwhere \n \"brc_step rqrm == \\(Q,W,rcm).\n ls_iteratei (rqrm_lookup rqrm (hd W)) (\\_. True) brc_inner_step \n (Q,tl W, rcm)\"\n\n -- \"Initial concrete state\"\ndefinition brc_iq :: \"('q,'l) ta_rule ls \\ 'q::hashable hs\" \n where \"brc_iq \\ == lh_set_xy.g_image_filter (\\r. \n if rhsq r = [] then Some (lhs r) else None) \\\"\n\ndefinition brc_rcm_init \n :: \"('q::hashable,'l::hashable) ta_rule ls \n \\ (('q,'l) ta_rule,nat) hm\" \n where \"brc_rcm_init \\ == \n ls_iteratei \\ (\\_. True) \n (\\r res. hm_update r ((length (remdups (rhsq r)))) res) \n (hm_empty ())\"\n\ndefinition brc_initial \n :: \"('q::hashable,'l::hashable) ta_rule ls \\ ('q,'l) brc_state\" \n where \"brc_initial \\ == \n let iq=brc_iq \\ in \n (iq, hs_to_list (iq), brc_rcm_init \\)\"\n\ndefinition \"brc_det_algo rqrm \\ == \\\n dwa_cond = brc_cond,\n dwa_step = brc_step rqrm,\n dwa_initial = brc_initial \\,\n dwa_invar = brc_invar (ls_\\ \\)\n\\\"\n\n -- \"Additional facts needed from the abstract level\"\nlemma brc_inv_imp_WssQ: \"brc_\\ (Q,W,rcm)\\br'_invar \\ \\ set W \\ hs_\\ Q\"\n by (auto simp add: brc_\\_def br'_invar_def br'_\\_def br_invar_def)\n\nlemma brc_iq_correct: \n assumes [simp]: \"ls_invar \\\"\n shows \"hs_invar (brc_iq \\)\"\n \"hs_\\ (brc_iq \\) = br_iq (ls_\\ \\)\"\n by (auto simp add: brc_iq_def br_iq_def lh_set_xy.image_filter_correct)\n\nlemma brc_rcm_init_correct:\n assumes INV[simp]: \"ls_invar \\\"\n shows \"r\\ls_\\ \\ \n \\ hm_\\ (brc_rcm_init \\) r = Some ((card (set (rhsq r))))\" \n (is \"_ \\ ?T1 r\") and\n \"hm_invar (brc_rcm_init \\)\" (is ?T2)\nproof -\n have G: \"(\\r\\ls_\\ \\. ?T1 r) \\ ?T2\"\n apply (unfold brc_rcm_init_def)\n apply (rule_tac \n I=\"\\it res. hm_invar res \n \\ (\\r\\ls_\\ \\ - it. hm_\\ res r = Some ((card (set (rhsq r)))))\" \n in ls.iterate_rule_P)\n -- \"Invar\"\n apply simp\n -- \"Init\"\n apply (auto simp add: hm_correct) [1]\n -- \"Step\"\n apply (rule conjI)\n apply (simp add: hm.update_correct)\n\n apply (simp only: hm_correct hs_correct INV)\n apply (rule ballI)\n apply (case_tac \"r=x\")\n apply (auto \n simp add: length_remdups_card \n intro!: arg_cong[where f=card]) [1]\n apply simp\n -- \"Final\"\n apply simp\n done\n from G show ?T2 by auto\n fix r\n assume \"r\\ls_\\ \\\"\n thus \"?T1 r\" using G by auto\nqed\n\nlemma brc_inner_step_br'_desc: \n \"\\ (Q,W,rcm)\\brc_invar \\ \\ \\ brc_\\ (brc_inner_step r (Q,W,rcm)) = (\n if the (hm_\\ rcm r) \\ 1 then \n insert (lhs r) (hs_\\ Q) \n else hs_\\ Q, \n if the (hm_\\ rcm r) \\ 1 \\ (lhs r) \\ hs_\\ Q then \n insert (lhs r) (set W) \n else (set W), \n ((hm_\\ rcm)(r \\ the (hm_\\ rcm r) - 1))\n )\"\n by (simp \n add: brc_invar_def brc_invar_add_def brc_\\_def brc_inner_step_def Let_def \n hs_correct hm_correct)\n\nlemma brc_step_invar:\n assumes RQRM: \"rqrm_invar rqrm\"\n shows \"\\ \\\\brc_invar_add; brc_\\ \\\\br'_invar \\; brc_cond \\ \\ \n \\ (brc_step rqrm \\)\\brc_invar_add\"\n apply (cases \\)\n apply (simp add: brc_step_def)\n apply (rule_tac I=\"\\it (Q,W,rcm). (Q,W,rcm)\\brc_invar_add \\ set W \\ hs_\\ Q\" \n in ls.iterate_rule_P)\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (case_tac b)\n apply (simp add: brc_invar_add_def distinct_tl brc_cond_def)\n apply (auto simp add: brc_invar_add_def distinct_tl brc_cond_def \n dest!: brc_inv_imp_WssQ) [1]\n apply (case_tac \\)\n apply (auto simp add: brc_invar_add_def br_invar_def brc_inner_step_def \n Let_def hs_correct hm_correct) [1]\n apply (case_tac \\)\n apply simp\n done\n\n\nlemma brc_step_abs:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes A: \"\\\\brc_invar \\\" \"brc_cond \\\" \n shows \"(brc_\\ \\, brc_\\ (brc_step rqrm \\)) \\ br'_step \\\"\nproof -\n obtain Q W rcm where [simp]: \"\\=(Q,W,rcm)\" by (cases \\) auto\n from A show ?thesis\n apply (simp add: brc_step_def)\n apply (rule \n br'_inner_step_proof[OF ls.v1_iteratei_impl, \n where cinvar=\"\\it (Q,W,rcm). (Q,W,rcm)\\brc_invar_add \n \\ set W \\ hs_\\ Q\" and \n q=\"hd W\"])\n apply (case_tac W) \n apply (auto simp add: brc_cond_def brc_invar_add_def brc_invar_def \n dest!: brc_inv_imp_WssQ) [2]\n prefer 6\n apply (simp add: brc_\\_def)\n apply (case_tac \\)\n apply (auto \n simp add: brc_invar_def brc_invar_add_def brc_inner_step_def \n Let_def hm_correct hs_correct) [1]\n apply (auto \n simp add: brc_invar_add_def brc_inner_step_def brc_\\_def \n br'_inner_step_def Let_def hm_correct hs_correct) [1]\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (simp add: rqrm_propD[OF RQRM(2)])\n apply (case_tac W)\n apply (simp_all add: brc_\\_def brc_cond_def brc_invar_def) [2]\n apply (case_tac W)\n apply (simp_all add: brc_\\_def brc_cond_def brc_invar_def \n brc_invar_add_def) [2]\n done\nqed\n \nlemma brc_initial_invar: \"ls_invar \\ \\ (brc_initial \\)\\brc_invar_add\"\n by (simp \n add: brc_invar_add_def brc_initial_def brc_iq_correct Let_def \n brc_rcm_init_correct hs_correct)\n\nlemma brc_cond_abs: \"brc_cond \\ \\ (brc_\\ \\)\\br'_cond\"\n apply (cases \\)\n apply (simp add: brc_cond_def br'_cond_def brc_\\_def)\n done\n\nlemma brc_initial_abs: \n \"ls_invar \\ \\ brc_\\ (brc_initial \\) \\ br'_initial (ls_\\ \\)\"\n by (auto \n simp add: brc_initial_def Let_def brc_\\_def brc_iq_correct \n brc_rcm_init_correct hs_correct \n intro: br'_initial.intros)\n\nlemma brc_pref_br':\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\"\n shows \"wa_precise_refine (det_wa_wa (brc_det_algo rqrm \\)) \n (br'_algo (ls_\\ \\)) \n brc_\\\"\n apply (unfold_locales)\n apply (simp_all add: brc_det_algo_def br'_algo_def det_wa_wa_def)\n apply (simp add: brc_cond_abs)\n apply (auto simp add: brc_step_abs[OF RQRM]) [1]\n apply (simp add: brc_initial_abs)\n apply (auto simp add: brc_invar_def) [1]\n apply (simp add: brc_cond_abs)\n done\n\nlemma brc_while_algo:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\"\n shows \"while_algo (det_wa_wa (brc_det_algo rqrm \\))\"\nproof -\n from brc_pref_br'[OF RQRM INV] interpret \n ref: wa_precise_refine \"(det_wa_wa (brc_det_algo rqrm \\))\" \n \"(br'_algo (ls_\\ \\))\" \n brc_\\ .\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: br'_while_algo)\n apply (simp_all add: det_wa_wa_def brc_det_algo_def br'_algo_def)\n apply (simp add: brc_invar_def)\n apply (auto simp add: brc_step_invar) [1]\n apply (simp add: brc_initial_invar)\n done\nqed\n\nlemmas brc_det_while_algo =\n det_while_algo_intro[OF brc_while_algo]\n\n\nlemma fst_brc_\\: \"fst (brc_\\ s) = hs_\\ (fst s)\" \n by (cases s) (simp add: brc_\\_def)\n\nlemmas brc_invar_final =\n wa_precise_refine.transfer_correctness[OF \n brc_pref_br' br'_invar_final, unfolded fst_brc_\\]\n\ndefinition \"hta_bwd_reduce H == \n let rqrm = build_rqrm (hta_\\ H) in \n hta_reduce \n H \n (fst (while brc_cond (brc_step rqrm) (brc_initial (hta_\\ H))))\n\"\n\ntheorem (in hashedTa) hta_bwd_reduce_correct:\n shows \"hta_\\ (hta_bwd_reduce H) \n = ta_reduce (hta_\\ H) (b_accessible (ls_\\ (hta_\\ H)))\" (is ?T1)\n \"hashedTa (hta_bwd_reduce H)\" (is ?T2)\nproof -\n interpret det_while_algo \"(brc_det_algo (build_rqrm \\) \\)\"\n by (rule brc_det_while_algo)\n (simp_all add: build_rqrm_correct)\n\n have LC: \"(while brc_cond (brc_step (build_rqrm \\)) (brc_initial \\)) = loop\"\n by (unfold loop_def)\n (simp add: brc_det_algo_def)\n\n from while_proof'[OF brc_invar_final] have \n G1: \"hs_\\ (fst loop) = b_accessible (ls_\\ \\)\" \n by (simp add: build_rqrm_correct)\n have G2: \"loop \\ brc_invar (ls_\\ \\)\"\n by (rule while_proof)\n (simp add: brc_det_algo_def)\n hence [simp]: \"hs_invar (fst loop)\"\n by (cases loop)\n (simp add: brc_invar_def brc_invar_add_def)\n\n show ?T1 ?T2\n by (simp_all add: hta_bwd_reduce_def LC hta_reduce_correct G1)\n \nqed\n\nsubsubsection {* Emptiness Check with Witness Computation *}\n\ndefinition brec_construct_witness \n :: \"('q::hashable,'l::hashable tree) hm \\ ('q,'l) ta_rule \\ 'l tree\"\n where \"brec_construct_witness Qm r == \n NODE (rhsl r) (List.map (\\q. the (hm_lookup q Qm)) (rhsq r))\"\n\nlemma brec_construct_witness_correct: \n \"\\hm_invar Qm\\ \\ \n brec_construct_witness Qm r = construct_witness (hm_\\ Qm) r\"\n by (auto \n simp add: construct_witness_def brec_construct_witness_def hm_correct)\n\ntype_synonym ('Q,'L) brec_state \n = \"(('Q,'L tree) hm \n \\ 'Q fifo \n \\ (('Q,'L) ta_rule, nat) hm \n \\ 'Q option)\"\n\n\n -- \"Abstractions\"\ndefinition brec_\\ \n :: \"('Q::hashable,'L::hashable) brec_state \\ ('Q,'L) brw_state\"\n where \"brec_\\ == \\(Q,W,rcm,f). (hm_\\ Q, set (fifo_\\ W), (hm_\\ rcm))\"\n\ndefinition brec_inner_step \n :: \"'q hs \\ ('q,'l) ta_rule \n \\ ('q::hashable,'l::hashable) brec_state \n \\ ('q,'l) brec_state\"\n where \"brec_inner_step Qi r == \\(Q,W,rcm,qwit). \n let c=the (hm_lookup r rcm); \n cond = c \\ 1 \\ hm_lookup (lhs r) Q = None;\n rcm' = hm_update r (c-(1::nat)) rcm;\n Q' = ( if cond then \n hm_update (lhs r) (brec_construct_witness Q r) Q \n else Q);\n W' = (if cond then fifo_enqueue (lhs r) W else W);\n qwit' = (if c \\ 1 \\ hs_memb (lhs r) Qi then Some (lhs r) else qwit)\n in\n (Q',W',rcm',qwit')\"\n\ndefinition brec_step \n :: \"('q,('q,'l) ta_rule ls) hm \\ 'q hs \n \\ ('q::hashable,'l::hashable) brec_state \n \\ ('q,'l) brec_state\" \n where \"brec_step rqrm Qi == \\(Q,W,rcm,qwit).\n let (q,W')=fifo_dequeue W in \n ls_iteratei (rqrm_lookup rqrm q) (\\_. True) \n (brec_inner_step Qi) (Q,W',rcm,qwit)\n \"\n\ndefinition brec_iqm \n :: \"('q::hashable,'l::hashable) ta_rule ls \\ ('q,'l tree) hm\" \n where \"brec_iqm \\ == \n ls_iteratei \\ (\\_. True) (\\r m. if rhsq r = [] then \n hm_update (lhs r) (NODE (rhsl r) []) m \n else m) \n (hm_empty ())\"\n\ndefinition brec_initial \n :: \"'q hs \\ ('q::hashable,'l::hashable) ta_rule ls \n \\ ('q,'l) brec_state\" \n where \"brec_initial Qi \\ == \n let iq=brc_iq \\ in \n ( brec_iqm \\, \n hs_to_fifo.g_set_to_listr iq, \n brc_rcm_init \\,\n hh_set_xx.g_disjoint_witness iq Qi)\"\n\ndefinition brec_cond \n :: \"('q,'l) brec_state \\ bool\" \n where \"brec_cond == \\(Q,W,rcm,qwit). \\ fifo_isEmpty W \\ qwit = None\"\n\ndefinition brec_invar_add\n :: \"'Q set \\ ('Q::hashable,'L::hashable) brec_state set\" \n where\n \"brec_invar_add Qi == {(Q,W,rcm,qwit). \n hm_invar Q \\ \n distinct (fifo_\\ W) \\ \n hm_invar rcm \\\n ( case qwit of \n None \\ Qi \\ dom (hm_\\ Q) = {} | \n Some q \\ q\\Qi \\ dom (hm_\\ Q))}\n \"\n\ndefinition \"brec_invar Qi \\ == brec_invar_add Qi \\ {s. brec_\\ s \\ brw_invar \\}\"\n\ndefinition \"brec_invar_inner Qi == \n brec_invar_add Qi \\ {(Q,W,_,_). set (fifo_\\ W) \\ dom (hm_\\ Q)}\"\n\nlemma brec_invar_cons: \n \"\\\\brec_invar Qi \\ \\ \\\\brec_invar_inner Qi\"\n apply (cases \\)\n apply (simp add: brec_invar_def brw_invar_def br'_invar_def br_invar_def\n brec_\\_def brw_\\_def br'_\\_def brec_invar_inner_def)\n done\n\nlemma brec_brw_invar_cons: \n \"brec_\\ \\ \\ brw_invar Qi \\ set (fifo_\\ (fst (snd \\))) \\ dom (hm_\\ (fst \\))\"\n apply (cases \\)\n apply (simp add: brec_invar_def brw_invar_def br'_invar_def br_invar_def\n brec_\\_def brw_\\_def br'_\\_def)\n done\n\ndefinition \"brec_det_algo rqrm Qi \\ == \\\n dwa_cond=brec_cond,\n dwa_step=brec_step rqrm Qi,\n dwa_initial=brec_initial Qi \\,\n dwa_invar=brec_invar (hs_\\ Qi) (ls_\\ \\)\n\\\"\n\nlemma brec_iqm_correct':\n assumes INV[simp]: \"ls_invar \\\"\n shows \n \"dom (hm_\\ (brec_iqm \\)) = {lhs r | r. r\\ls_\\ \\ \\ rhsq r = []}\" (is ?T1)\n \"witness_prop (ls_\\ \\) (hm_\\ (brec_iqm \\))\" (is ?T2)\n \"hm_invar (brec_iqm \\)\" (is ?T3)\nproof -\n have \"?T1 \\ ?T2 \\ ?T3\"\n apply (unfold brec_iqm_def)\n apply (rule_tac \n I=\"\\it m. hm_invar m \n \\ dom (hm_\\ m) = {lhs r | r. r\\ls_\\ \\ - it \\ rhsq r = []} \n \\ witness_prop (ls_\\ \\) (hm_\\ m)\" \n in ls.iterate_rule_P)\n apply simp\n apply (auto simp add: hm_correct witness_prop_def) [1]\n apply (auto simp add: hm_correct witness_prop_def) [1]\n apply (case_tac x)\n apply (auto intro: accs.intros) [1]\n apply simp\n done\n thus ?T1 ?T2 ?T3 by auto\nqed\n\nlemma brec_iqm_correct:\n assumes INV[simp]: \"ls_invar \\\"\n shows \"hm_\\ (brec_iqm \\) \\ brw_iq (ls_\\ \\)\"\nproof -\n have \"(\\q t. hm_\\ (brec_iqm \\) q = Some t \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ q = lhs r \\ t = NODE (rhsl r) [])) \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ hm_\\ (brec_iqm \\) (lhs r) \\ None)\" \n apply (unfold brec_iqm_def)\n apply (rule_tac I=\"\\it m. (\n (hm_invar m) \\ \n (\\q t. hm_\\ m q = Some t \n \\ (\\r\\ls_\\ \\. rhsq r = [] \\ q = lhs r \\ t = NODE (rhsl r) [])) \\ \n (\\r\\ls_\\ \\-it. rhsq r = [] \\ hm_\\ m (lhs r) \\ None)\n )\" \n in ls.iterate_rule_P)\n apply simp\n apply (simp add: hm_correct)\n apply (auto simp add: hm_correct) [1]\n apply (auto simp add: hm_correct) [1]\n done\n thus ?thesis by (blast intro: brw_iq.intros)\nqed\n\nlemma brec_inner_step_brw_desc: \n \"\\ \\\\brec_invar_inner (hs_\\ Qi) \\ \n \\ (brec_\\ \\, brec_\\ (brec_inner_step Qi r \\)) \\ brw_inner_step r\"\n apply (cases \\)\n apply (rule brw_inner_step.intros)\n apply (simp only: )\n apply (simp only: brec_\\_def split_conv)\n apply (simp only: brec_inner_step_def brec_\\_def Let_def split_conv)\n apply (auto \n simp add: brec_invar_inner_def brec_invar_add_def brec_\\_def \n brec_inner_step_def \n Let_def hs_correct hm_correct fifo_correct\n brec_construct_witness_correct)\n done\n\n\nlemma brec_step_invar:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes [simp]: \"hs_invar Qi\"\n shows \"\\ \\\\brec_invar_add (hs_\\ Qi); brec_\\ \\ \\ brw_invar \\; brec_cond \\ \\ \n \\ (brec_step rqrm Qi \\)\\brec_invar_add (hs_\\ Qi)\"\n apply (frule brec_brw_invar_cons)\n apply (cases \\)\n apply (simp add: brec_step_def fifo_correct)\n apply (case_tac \"fifo_\\ b\")\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (rule_tac s=b in fifo.removelE)\n apply simp\n apply simp\n apply simp\n\n apply (rule_tac \n I=\"\\it (Q,W,rcm,qwit). (Q,W,rcm,qwit)\\brec_invar_add (hs_\\ Qi) \n \\ set (fifo_\\ W) \\ dom (hm_\\ Q)\" \n in ls.iterate_rule_P)\n apply simp\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (simp \n add: brec_invar_def brec_invar_add_def distinct_tl brec_cond_def \n fifo_correct)\n apply (case_tac \\)\n apply (auto \n simp add: brec_invar_add_def brec_inner_step_def Let_def hs_correct \n hm_correct fifo_correct split: option.split_asm) [1]\n apply (case_tac \\)\n apply simp\n done\n\nlemma brec_step_abs:\n assumes RQRM: \"rqrm_invar rqrm\" \"rqrm_prop \\ rqrm\"\n assumes INV[simp]: \"hs_invar Qi\"\n assumes A': \"\\\\brec_invar (hs_\\ Qi) \\\"\n assumes COND: \"brec_cond \\\"\n shows \"(brec_\\ \\, brec_\\ (brec_step rqrm Qi \\)) \\ brw_step \\\"\nproof -\n from A' have A: \"(brec_\\ \\)\\brw_invar \\\" \"\\\\brec_invar_add (hs_\\ Qi)\"\n by (simp_all add: brec_invar_def)\n\n obtain Q W rcm qwit where [simp]: \"\\=(Q,W,rcm,qwit)\" by (cases \\) blast\n from A COND show ?thesis\n apply (simp add: brec_step_def fifo_correct)\n apply (case_tac \"fifo_\\ W\")\n apply (simp \n add: brec_invar_def distinct_tl brec_cond_def fifo_correct\n )\n apply (rule_tac s=W in fifo.removelE)\n apply simp\n apply simp\n apply simp\n\n apply (rule brw_inner_step_proof[\n OF ls.v1_iteratei_impl, \n where cinvar=\"\\it \\. \\\\brec_invar_inner (hs_\\ Qi)\" and \n q=\"hd (fifo_\\ W)\"])\n apply assumption\n apply (frule brec_brw_invar_cons)\n apply (simp_all \n add: brec_cond_def brec_invar_add_def fifo_correct\n brec_invar_inner_def) [1]\n prefer 6\n apply (simp add: brec_\\_def)\n apply (case_tac \\)\n apply (auto \n simp add: brec_invar_add_def brec_inner_step_def Let_def hm_correct \n hs_correct fifo_correct brec_invar_inner_def \n split: option.split_asm) [1]\n apply (blast intro: brec_inner_step_brw_desc)\n apply (simp add: RQRM[unfolded rqrm_invar_def])\n apply (simp \n add: rqrm_propD[OF RQRM(2)] fifo_correct)\n apply (simp_all \n add: brec_\\_def brec_cond_def brec_invar_def fifo_correct) [1]\n apply (simp_all \n add: brec_\\_def brec_cond_def brec_invar_add_def fifo_correct) [1]\n done\nqed\n \nlemma brec_invar_initial: \n \"\\ls_invar \\; hs_invar Qi\\ \\ (brec_initial Qi \\) \\ brec_invar_add (hs_\\ Qi)\"\n apply (auto \n simp add: brec_invar_add_def brec_initial_def brc_iq_correct \n brec_iqm_correct' hs_correct hs.isEmpty_correct Let_def \n brc_rcm_init_correct br_iq_def \n hh_set_xx.disjoint_witness_correct \n hs_to_fifo.g_set_to_listr_correct \n split: option.split)\n apply (auto simp add: brc_iq_correct \n hh_set_xx.disjoint_witness_None br_iq_def) [1]\n\n apply (drule hh_set_xx.disjoint_witness_correct[simplified])\n apply simp\n\n apply (drule hh_set_xx.disjoint_witness_correct[simplified])\n apply (simp add: brc_iq_correct br_iq_def)\n done\n\nlemma brec_cond_abs: \n \"\\\\\\brec_invar Qi \\\\ \\ brec_cond \\ \\ (brec_\\ \\)\\brw_cond Qi\"\n apply (cases \\)\n apply (auto \n simp add: brec_cond_def brw_cond_def brec_\\_def brec_invar_def \n brec_invar_add_def fifo_correct\n split: option.split_asm)\n done\n\nlemma brec_initial_abs: \n \"\\ ls_invar \\; hs_invar Qi \\ \n \\ brec_\\ (brec_initial Qi \\) \\ brw_initial (ls_\\ \\)\"\n by (auto simp add: brec_initial_def Let_def brec_\\_def \n brc_iq_correct brc_rcm_init_correct brec_iqm_correct \n br_iq_def fifo_correct hs_to_fifo.g_set_to_listr_correct \n intro: brw_initial.intros[unfolded br_iq_def])\n\nlemma brec_pref_brw:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\" \"hs_invar Qi\"\n shows \"wa_precise_refine (det_wa_wa (brec_det_algo rqrm Qi \\)) \n (brw_algo (hs_\\ Qi) (ls_\\ \\)) \n brec_\\\"\n apply (unfold_locales)\n apply (simp_all add: det_wa_wa_def brec_det_algo_def brw_algo_def)\n apply (auto simp add: brec_cond_abs brec_step_abs brec_initial_abs)\n apply (simp add: brec_invar_def)\n done\n\nlemma brec_while_algo:\n assumes RQRM[simp]: \"rqrm_invar rqrm\" \"rqrm_prop (ls_\\ \\) rqrm\"\n assumes INV[simp]: \"ls_invar \\\" \"hs_invar Qi\"\n shows \"while_algo (det_wa_wa (brec_det_algo rqrm Qi \\))\"\nproof -\n interpret ref: \n wa_precise_refine \"(det_wa_wa (brec_det_algo rqrm Qi \\))\" \n \"(brw_algo (hs_\\ Qi) (ls_\\ \\))\" \n \"brec_\\\" \n using brec_pref_brw[OF RQRM INV] . \n\n show ?thesis\n apply (rule ref.wa_intro)\n apply (simp add: brw_while_algo)\n apply (simp_all add: det_wa_wa_def brec_det_algo_def brw_algo_def)\n apply (simp add: brec_invar_def)\n apply (auto simp add: brec_step_invar[OF RQRM INV(2)]) [1]\n apply (simp add: brec_invar_initial) [1]\n done\nqed\n\nlemma fst_brec_\\: \"fst (brec_\\ \\) = hm_\\ (fst \\)\"\n by (cases \\) (simp add: brec_\\_def)\n\nlemmas brec_invar_final = \n wa_precise_refine.transfer_correctness[\n OF brec_pref_brw brw_invar_final, \n unfolded fst_brec_\\]\n\nlemmas brec_det_algo = det_while_algo_intro[OF brec_while_algo]\n\ndefinition \"hta_is_empty_witness H == \n let rqrm = build_rqrm (hta_\\ H);\n (Q,_,_,qwit) = (while brec_cond (brec_step rqrm (hta_Qi H)) \n (brec_initial (hta_Qi H) (hta_\\ H))) \n in\n case qwit of \n None \\ None |\n Some q \\ (hm_lookup q Q)\n\"\n\ntheorem (in hashedTa) hta_is_empty_witness_correct:\n shows [rule_format]: \"hta_is_empty_witness H = Some t \n \\ t\\ta_lang (hta_\\ H)\" (is ?T1)\n \"hta_is_empty_witness H = None \\ ta_lang (hta_\\ H) = {}\" (is ?T2)\nproof -\n\n interpret det_while_algo \"(brec_det_algo (build_rqrm \\) Qi \\)\"\n by (rule brec_det_algo)\n (simp_all add: build_rqrm_correct)\n\n have LC: \n \"(while brec_cond (brec_step (build_rqrm \\) Qi) (brec_initial Qi \\)) = loop\"\n by (unfold loop_def)\n (simp add: brec_det_algo_def)\n\n from while_proof'[OF brec_invar_final] have X:\n \"hs_\\ Qi \\ dom (hm_\\ (fst loop)) = {} \n \\ (hs_\\ Qi \\ b_accessible (ls_\\ \\) = {})\"\n \"witness_prop (ls_\\ \\) (hm_\\ (fst loop))\"\n by (simp_all add: build_rqrm_correct)\n\n obtain Q W rcm qwit where \n [simp]: \"loop = (Q,W,rcm,qwit)\" \n by (case_tac \"loop\") blast\n\n from loop_invar have I: \"loop \\ brec_invar (hs_\\ Qi) (ls_\\ \\)\" \n by (simp add: brec_det_algo_def)\n hence INVARS[simp]: \"hm_invar Q\" \"hm_invar rcm\" \n by (simp_all add: brec_invar_def brec_invar_add_def) \n \n {\n assume C: \"hta_is_empty_witness H = Some t\"\n then obtain q where \n [simp]: \"qwit=Some q\" and \n LUQ: \"hm_lookup q Q = Some t\"\n by (unfold hta_is_empty_witness_def)\n (simp add: LC split: option.split_asm)\n from LUQ have QqF: \"hm_\\ Q q = Some t\" by (simp add: hm_correct)\n from I have QMEM: \"q\\hs_\\ Qi\" \n by (simp_all add: brec_invar_def brec_invar_add_def)\n moreover from witness_propD[OF X(2)] QqF have \"accs (ls_\\ \\) t q\" by simp\n ultimately have \"t\\ta_lang (hta_\\ H)\"\n by (auto simp add: ta_lang_def hta_\\_def)\n } moreover {\n assume C: \"hta_is_empty_witness H = None\"\n hence DJ: \"hs_\\ Qi \\ dom (hm_\\ Q) = {}\" using I\n by (auto simp add: hta_is_empty_witness_def LC brec_invar_def \n brec_invar_add_def hm_correct \n split: option.split_asm)\n with X have \"hs_\\ Qi \\ b_accessible (ls_\\ \\) = {}\" \n by (simp add: brec_\\_def)\n with empty_if_no_b_accessible[of \"hta_\\ H\"] have \"ta_lang (hta_\\ H) = {}\"\n by (simp add: hta_\\_def)\n } ultimately show ?T1 ?T2 by auto\nqed\n\nsubsection {* Interface for Natural Number States and Symbols *}\n text_raw {*\\label{sec:htai_intf}*}\ntext {*\n The library-interface is statically instantiated to use natural numbers \n as both, states and symbols.\n\n This interface is easier to use from ML and OCaml, because there is no \n overhead with typeclass emulation.\n*}\n\ntype_synonym htai = \"(nat,nat) hashedTa\"\n\ndefinition htai_mem :: \"_ \\ htai \\ bool\" \n where \"htai_mem == hta_mem\"\ndefinition htai_prod :: \"htai \\ htai \\ htai\" \n where \"htai_prod H1 H2 == hta_reindex (hta_prod H1 H2)\"\ndefinition htai_prodWR :: \"htai \\ htai \\ htai\" \n where \"htai_prodWR H1 H2 == hta_reindex (hta_prodWR H1 H2)\"\ndefinition htai_union :: \"htai \\ htai \\ htai\" \n where \"htai_union H1 H2 == hta_reindex (hta_union H1 H2)\"\ndefinition htai_empty :: \"unit \\ htai\"\n where \"htai_empty == hta_empty\"\ndefinition htai_add_qi :: \"_ \\ htai \\ htai\" \n where \"htai_add_qi == hta_add_qi\"\ndefinition htai_add_rule :: \"_ \\ htai \\ htai\" \n where \"htai_add_rule == hta_add_rule\"\ndefinition htai_bwd_reduce :: \"htai \\ htai\" \n where \"htai_bwd_reduce == hta_bwd_reduce\"\ndefinition htai_is_empty_witness :: \"htai \\ _\" \n where \"htai_is_empty_witness == hta_is_empty_witness\"\ndefinition htai_ensure_idx_f :: \"htai \\ htai\" \n where \"htai_ensure_idx_f == hta_ensure_idx_f\"\ndefinition htai_ensure_idx_s :: \"htai \\ htai\" \n where \"htai_ensure_idx_s == hta_ensure_idx_s\"\ndefinition htai_ensure_idx_sf :: \"htai \\ htai\" \n where \"htai_ensure_idx_sf == hta_ensure_idx_sf\"\n\ndefinition htaip_prod :: \"htai \\ htai \\ (nat * nat,nat) hashedTa\" \n where \"htaip_prod == hta_prod\"\ndefinition htaip_prodWR :: \"htai \\ htai \\ (nat * nat,nat) hashedTa\" \n where \"htaip_prodWR == hta_prodWR\"\ndefinition htaip_reindex :: \"(nat * nat,nat) hashedTa \\ htai\" \n where \"htaip_reindex == hta_reindex\"\n\nlocale htai = hashedTa +\n constrains H :: htai\nbegin\n lemmas htai_mem_correct = hta_mem_correct[folded htai_mem_def]\n\n lemma htai_empty_correct[simp]:\n \"hta_\\ (htai_empty ()) = ta_empty\"\n \"hashedTa (htai_empty ())\"\n by (auto simp add: htai_empty_def hta_empty_correct)\n\n lemmas htai_add_qi_correct = hta_add_qi_correct[folded htai_add_qi_def]\n lemmas htai_add_rule_correct = hta_add_rule_correct[folded htai_add_rule_def]\n\n lemmas htai_bwd_reduce_correct = \n hta_bwd_reduce_correct[folded htai_bwd_reduce_def]\n lemmas htai_is_empty_witness_correct = \n hta_is_empty_witness_correct[folded htai_is_empty_witness_def]\n\n lemmas htai_ensure_idx_f_correct = \n hta_ensure_idx_f_correct[folded htai_ensure_idx_f_def]\n lemmas htai_ensure_idx_s_correct = \n hta_ensure_idx_s_correct[folded htai_ensure_idx_s_def]\n lemmas htai_ensure_idx_sf_correct = \n hta_ensure_idx_sf_correct[folded htai_ensure_idx_sf_def]\n\nend\n\nlemma htai_prod_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_prod H1 H2)) = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_prod H1 H2)\"\n apply (unfold htai_prod_def)\n apply (auto simp add: hta_prod_correct hashedTa.hta_reindex_correct)\n done\n\nlemma htai_prodWR_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_prodWR H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_prodWR H1 H2)\"\n apply (unfold htai_prodWR_def)\n apply (auto simp add: hta_prodWR_correct hashedTa.hta_reindex_correct)\n done\n\nlemma htai_union_correct:\n assumes [simp]: \"hashedTa H1\" \"hashedTa H2\"\n shows \n \"ta_lang (hta_\\ (htai_union H1 H2)) \n = ta_lang (hta_\\ H1) \\ ta_lang (hta_\\ H2)\"\n \"hashedTa (htai_union H1 H2)\"\n apply (unfold htai_union_def)\n apply (auto simp add: hta_union_correct hashedTa.hta_reindex_correct)\n done\n\nsubsection {* Interface Documentation *} text_raw{*\\label{sec:intf_doc}*}\ntext {*\n This section contains a documentation of the executable tree-automata\n interface. The documentation contains a description of each function along\n with the relevant correctness lemmas.\n*}\n\ntext {*\n ML/OCaml users should note, that there is an interface that has the fixed type\n Int for both states and function symbols. This interface is simpler to use\n from ML/OCaml than the generic one, as it requires no overhead to emulate\n Isabelle/HOL type-classes.\n\n The functions of this interface start with the prefix {\\em htai} instead of\n {\\em hta}, but have the same semantics otherwise \n (cf Section~\\ref{sec:htai_intf}).\n*}\n\nsubsubsection {* Building a Tree Automaton *}\ntext_raw {*\n \\newcommand{\\fundesc}[2]{{\\bf Function: #1}\\\\#2}\n\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_empty}}{\n Returns a tree automaton with no states and no rules. \n }\n \n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_empty_correct}:] @{thm hta_empty_correct[no_vars]}\n \\item[@{thm [source] ta_empty_lang}:] @{thm ta_empty_lang[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_add_qi}}{\n Adds an initial state to the given automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_add_qi_correct}]\n @{thm hashedTa.hta_add_qi_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_add_rule}}{\n Adds a rule to the given automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_add_rule_correct}:]\n @{thm hashedTa.hta_add_rule_correct[no_vars]}\n \\end{description}\n*}\n\nsubsubsection {* Basic Operations *}\n\ntext {*\n The tree automata of this library may have some optional indices, that \n accelerate computation. The tree-automata operations will compute the \n indices if necessary, but due to the pure nature of the Isabelle-language,\n the computed index cannot be stored for the next usage. Hence, before using a\n bulk of tree-automaton operations on the same tree-automata, the relevant \n indexes should be pre-computed.\n*}\n\ntext {*\n \\fundesc{\n @{const [show_types] hta_ensure_idx_f}\\\\\n @{const [show_types] hta_ensure_idx_s}\\\\\n @{const [show_types] hta_ensure_idx_sf}\n }{\n Computes an index for a tree automaton, if it is not yet present.\n }\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_mem}, @{const [show_types] hta_mem'}}{\n Check whether a tree is accepted by the tree automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_mem_correct}:]\n @{thm hashedTa.hta_mem_correct[no_vars]}\n \\item[@{thm [source] hashedTa.hta_mem'_correct}:]\n @{thm hashedTa.hta_mem'_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_prod}, @{const [show_types] hta_prod'}}{\n Compute the product automaton. The computed automaton is in \n forward-reduced form. \n The language of the product automaton is the intersection of \n the languages of the two argument automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_prod_correct_aux}:] \n @{thm hta_prod_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prod_correct}:] \n @{thm hta_prod_correct[no_vars]}\n \\item[@{thm [source] hta_prod'_correct_aux}:] \n @{thm hta_prod'_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prod'_correct}:] \n @{thm hta_prod'_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_prodWR}}{\n Compute the product automaton by brute-force algorithm. \n The resulting automaton is not reduced.\n The language of the product automaton is the intersection of \n the languages of the two argument automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_prodWR_correct_aux}:]\n @{thm hta_prodWR_correct_aux[no_vars]}\n \\item[@{thm [source] hta_prodWR_correct}:] \n @{thm hta_prodWR_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_union}}{\n Compute the union of two tree automata.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hta_union_correct'}:] @{thm hta_union_correct'[no_vars]}\n \\item[@{thm [source] hta_union_correct}:] @{thm hta_union_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_reduce}}{\n Reduce the automaton to the given set of states. All initial states outside\n this set will be removed. Moreover, all rules that contain states outside \n this set are removed, too.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_reduce_correct}:]\n @{thm hashedTa.hta_reduce_correct[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_bwd_reduce}}{\n Compute the backwards-reduced version of a tree automata.\n States from that no tree can be produced are removed. \n Backwards reduction does not change the language of the automaton.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_bwd_reduce_correct}:]\n @{thm hashedTa.hta_bwd_reduce_correct[no_vars]}\n \\item[@{thm [source] ta_reduce_b_acc}:] @{thm ta_reduce_b_acc[no_vars]}\n \\end{description}\n*}\n\ntext {*\n \\fundesc{@{const [show_types] hta_is_empty_witness}}{\n Check whether the language of the automaton is empty.\n If the language is not empty, a tree of the language is returned.\n\n The following property is not (yet) formally proven, but should hold: \n If a tree is returned, the language contains no tree with a smaller depth\n than the returned one.\n }\n \\paragraph{Relevant Lemmas}\n \\begin{description}\n \\item[@{thm [source] hashedTa.hta_is_empty_witness_correct}:]\n @{thm hashedTa.hta_is_empty_witness_correct[no_vars]}\n \\end{description}\n*}\n\nsubsection {* Code Generation *}\n\n(* TODO/FIXME: There seems to be no way to reference the project-directory,\n in order to control the placement of the generated code files.\n The code-generation in this file only dumps the generated code to standard output.\n Hence it is safe to include this file from other projects.\n\n Actual code generation is done in Ta_impl_codegen.thy\n *)\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in SML \n module_name Ta\n\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in Haskell \n module_name Ta\n (string_classes)\n\nexport_code \n hta_mem hta_mem' hta_prod hta_prod' hta_prodWR hta_union \n hta_empty hta_add_qi hta_add_rule\n hta_reduce hta_bwd_reduce hta_is_empty_witness\n hta_ensure_idx_f hta_ensure_idx_s hta_ensure_idx_sf\n\n htai_mem htai_prod htai_prodWR htai_union \n htai_empty htai_add_qi htai_add_rule\n htai_bwd_reduce htai_is_empty_witness\n htai_ensure_idx_f htai_ensure_idx_s htai_ensure_idx_sf\n\n (*ls_size hs_size rs_size*)\n in OCaml \n module_name Ta\n\n(* If this statement fails with an error from ML, this indicates a problem \n with the code-generator. The most frequent problem in this context is, that\n the code generator generates code that violates the ML value-restriction.\n*)\n\nML {*\n @{code hta_mem};\n @{code hta_mem'};\n @{code hta_prod};\n @{code hta_prod'};\n @{code hta_prodWR};\n @{code hta_union};\n @{code hta_empty};\n @{code hta_add_qi};\n @{code hta_add_rule};\n @{code hta_reduce};\n @{code hta_bwd_reduce};\n @{code hta_is_empty_witness};\n @{code hta_ensure_idx_f};\n @{code hta_ensure_idx_s};\n @{code hta_ensure_idx_sf};\n @{code htai_mem};\n @{code htai_prod};\n @{code htai_prodWR};\n @{code htai_union};\n @{code htai_empty};\n @{code htai_add_qi};\n @{code htai_add_rule};\n @{code htai_bwd_reduce};\n @{code htai_is_empty_witness};\n @{code htai_ensure_idx_f};\n @{code htai_ensure_idx_s};\n @{code htai_ensure_idx_sf};\n (*@{code ls_size};\n @{code hs_size};\n @{code rs_size}*)\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Tree-Automata/Ta_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2741680986886312}} {"text": "header {* Execution rules for threads *}\n\ntheory KPL_execution_thread imports \n KPL_state\nbegin\n\ntext {* Evaluate a local expression down to a word *}\nfun eval_word :: \"local_expr \\ thread_state \\ word\"\nwhere\n \"eval_word (Loc (Var v)) \\ = l \\ (Inl v)\"\n(* eval_word (Loc (Name n)) \\ = undefined *)\n| \"eval_word Lid \\ = l \\ LID\"\n| \"eval_word Gid \\ = l \\ GID\"\n| \"eval_word eTrue \\ = 1\"\n| \"eval_word (e1 \\* e2) \\ = \n (eval_word e1 \\ * eval_word e2 \\)\"\n| \"eval_word (\\* e) \\ = (if eval_word e \\ = 0 then 1 else 0)\"\n\ntext {* Evaluate a local expression down to a boolean *}\nfun eval_bool :: \"local_expr \\ thread_state \\ bool\"\nwhere\n \"eval_bool e \\ = (eval_word e \\ \\ 0)\"\n\ntext {* Abstraction level: none, equality abstraction, or adversarial abstraction *}\ndatatype abs_level = No_Abst | Eq_Abst | Adv_Abst\n\ntext {* The rules of Figure 4, plus two additional rules \n for adversarial abstraction (Fig 7b) *}\ninductive step_t \n :: \"abs_level \\ (thread_state \\ pred_basic_stmt) \\ thread_state \\ bool\" \nwhere\n T_Disabled: \n \"\\ (eval_bool p \\) \\ step_t a (\\, (b, p)) \\\"\n| T_Assign: \n \"\\ eval_bool p \\ ; l' = (l \\) (Inl v := eval_word e \\) \\ \n \\ step_t a (\\, (Assign (Var v) e, p)) (\\ (| l := l' |))\"\n| T_Read: \n \"\\ eval_bool p \\ ; l' = (l \\) (Inl v := sh \\ (eval_word e \\)) ;\n R' = R \\ \\ { eval_word e \\ } ; a \\ {No_Abst, Eq_Abst} \\ \n \\ step_t a (\\, (Read (Var v) e, p)) (\\ (| l := l', R := R' |))\"\n| T_Write: \n \"\\ eval_bool p \\ ; \n sh' = (sh \\) (eval_word e1 \\ := eval_word e2 \\) ;\n W' = W \\ \\ { eval_word e1 \\ } ; a \\ {No_Abst, Eq_Abst} \\ \n \\ step_t a (\\, (Write e1 e2, p)) (\\ (| sh := sh', W := W' |))\"\n| T_Read_Adv:\n \"\\ eval_bool p \\ ; l' = (l \\) (Inl v := asterisk) ;\n R' = R \\ \\ { eval_word e \\ } \\ \n \\ step_t Adv_Abst (\\, (Read (Var v) e, p)) (\\ (| l := l', R := R' |))\"\n| T_Write_Adv:\n \"\\ eval_bool p \\ ; W' = W \\ \\ { eval_word e1 \\ } \\ \n \\ step_t Adv_Abst (\\, (Write e1 e2, p)) (\\ (| (* sh := sh',*) W := W' |))\"\n\ntext {* Rephrasing @{text T_Assign} to make it more usable *}\nlemma T_Assign_helper: \n \"\\ eval_bool p \\ ; l' = (l \\) (Inl v := eval_word e \\) ; \\' = \\ (| l := l' |) \\ \n \\ step_t a (\\, (Assign (Var v) e, p)) \\'\"\nby (auto simp add: step_t.T_Assign)\n\ntext {* Rephrasing @{text T_Read} to make it more usable *}\nlemma T_Read_helper: \n \"\\ eval_bool p \\ ; l' = (l \\) (Inl v := sh \\ (eval_word e \\)) ;\n R' = R \\ \\ { eval_word e \\ } ; a \\ {No_Abst, Eq_Abst} ; \n \\' = \\ (| l := l', R := R' |) \\ \n \\ step_t a (\\, (Read (Var v) e, p)) \\'\"\nby (auto simp add: step_t.T_Read)\n\ntext {* Rephrasing @{text T_Write} to make it more usable *}\nlemma T_Write_helper:\n \"\\ eval_bool p \\ ; \n sh' = (sh \\) (eval_word e1 \\ := eval_word e2 \\) ;\n W' = W \\ \\ { eval_word e1 \\ } ; a \\ {No_Abst, Eq_Abst} ;\n \\' = \\ (| sh := sh', W := W' |) \\ \n \\ step_t a (\\, (Write e1 e2, p)) \\'\"\nby (auto simp add: step_t.T_Write)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/GPU_Kernel_PL/KPL_execution_thread.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.274039806276561}} {"text": "theory TopoS_Stateful_Policy_Algorithm\nimports TopoS_Stateful_Policy TopoS_Composition_Theory\nbegin\n\nsection{*Stateful Policy -- Algorithm*}\n\nsubsection{* Some unimportant lemmata *}\n lemma False_set: \"{(r, s). False} = {}\" by simp\n lemma valid_reqs_ACS_D: \"valid_reqs M \\ valid_reqs (get_ACS M)\"\n by(simp add: valid_reqs_def get_ACS_def)\n lemma valid_reqs_IFS_D: \"valid_reqs M \\ valid_reqs (get_IFS M)\"\n by(simp add: valid_reqs_def get_IFS_def)\n lemma all_security_requirements_fulfilled_ACS_D: \"all_security_requirements_fulfilled M G \\\n all_security_requirements_fulfilled (get_ACS M) G\"\n by(simp add: all_security_requirements_fulfilled_def get_ACS_def)\n lemma all_security_requirements_fulfilled_IFS_D: \"all_security_requirements_fulfilled M G \\\n all_security_requirements_fulfilled (get_IFS M) G\"\n by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n lemma all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph:\n \"\\ valid_reqs M; E' \\ E; wf_graph \\ nodes = V, edges = Efix \\ E \\ \\ \\ \n all_security_requirements_fulfilled M \n (stateful_policy_to_network_graph \\ hosts = V, flows_fix = Efix, flows_state = E \\)\\\n all_security_requirements_fulfilled M \n (stateful_policy_to_network_graph \\ hosts = V, flows_fix = Efix, flows_state = E' \\)\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n apply(drule all_security_requirements_fulfilled_mono[where E=\"Efix \\ E \\ backflows E\" and E'=\"Efix \\ E' \\ backflows E'\" and V=\"V\"])\n apply(thin_tac \"wf_graph G\" for G)\n apply(thin_tac \"all_security_requirements_fulfilled M G\" for M G)\n apply(simp add: backflows_def, blast)\n apply(thin_tac \"all_security_requirements_fulfilled M G\" for M G)\n apply(simp add: wf_graph_def)\n apply(simp add: backflows_def)\n using [[simproc add: finite_Collect]] apply(auto)[1]\n apply(simp_all)\n done\n\n\nsubsection {* Sketch for generating a stateful policy from a simple directed policy *}\n text{* Having no stateful flows, we trivially get a valid stateful policy. *}\n lemma trivial_stateful_policy_compliance:\n \"\\ wf_graph \\ nodes = V, edges = E \\; valid_reqs M; all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ \\ \\ \n stateful_policy_compliance \\ hosts = V, flows_fix = E, flows_state = {} \\ \\ nodes = V, edges = E \\ M\"\n apply(unfold_locales)\n apply(simp_all add: wf_graph_def stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n apply(simp add: get_IFS_def get_ACS_def all_security_requirements_fulfilled_def)\n apply(clarify)\n apply(drule valid_reqs_ACS_D) \n apply(drule all_security_requirements_fulfilled_ACS_D)\n apply(drule(1) all_security_requirements_fulfilled_imp_get_offending_empty)\n by force\n\n\n text{*trying better*}\n\n text{*First, filtering flows that cause no IFS violations*}\n (*the edges front of the list are more likely to be kept*)\n fun filter_IFS_no_violations_accu :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations_accu G M accu [] = accu\" |\n \"filter_IFS_no_violations_accu G M accu (e#Es) = (if\n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (e#accu) \\)\n then filter_IFS_no_violations_accu G M (e#accu) Es\n else filter_IFS_no_violations_accu G M accu Es)\"\n definition filter_IFS_no_violations :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_IFS_no_violations G M Es = filter_IFS_no_violations_accu G M [] Es\"\n\n\n lemma filter_IFS_no_violations_subseteq_input: \"set (filter_IFS_no_violations G M Es) \\ set Es\"\n apply(subgoal_tac \"\\ accu. set (filter_IFS_no_violations_accu G M accu Es) \\ set Es \\ set accu\")\n apply(erule_tac x=\"[]\" in allE)\n apply(simp add: filter_IFS_no_violations_def)\n unfolding filter_IFS_no_violations_def\n apply(induct_tac Es)\n apply(simp_all)\n apply force\n done\n lemma filter_IFS_no_violations_accu_correct_induction: \"valid_reqs (get_IFS M) \\ wf_graph \\ nodes = V, edges = E \\ \\\n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (accu) \\) \\ \n (set accu) \\ (set edgesList) \\ E \\ \n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (filter_IFS_no_violations_accu \\ nodes = V, edges = E \\ M accu edgesList) \\)\"\n apply(induction edgesList arbitrary: accu)\n by(simp_all)\n lemma filter_IFS_no_violations_correct: \"\\valid_reqs (get_IFS M); wf_graph G;\n all_security_requirements_fulfilled (get_IFS M) G; \n (set edgesList) \\ edges G \\ \\ \n all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList) \\)\"\n unfolding filter_IFS_no_violations_def\n apply(case_tac G, simp)\n apply(drule(1) filter_IFS_no_violations_accu_correct_induction[where accu=\"[]\", simplified])\n apply(simp_all)\n by(simp add: stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n lemma filter_IFS_no_violations_accu_no_IFS: \"valid_reqs (get_IFS M) \\ wf_graph G \\ get_IFS M = [] \\\n (set accu) \\ (set edgesList) \\ edges G \\ \n filter_IFS_no_violations_accu G M accu edgesList = rev(edgesList)@accu\"\n apply(induction edgesList arbitrary: accu)\n by(simp_all add: all_security_requirements_fulfilled_def)\n\n\n lemma filter_IFS_no_violations_accu_maximal_induction: \"valid_reqs (get_IFS M) \\ wf_graph \\ nodes = V, edges = E \\ \\ \n set accu \\ E \\ set edgesList \\ E \\\n \\ e \\ E - (set accu \\ set edgesList).\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = {e} \\ (set accu) \\)\n \\\n let stateful = set (filter_IFS_no_violations_accu \\ nodes = V, edges = E \\ M accu edgesList) in\n (\\ e \\ E - stateful.\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = {e} \\ stateful \\))\"\n proof(induction edgesList arbitrary: accu)\n case Nil thus ?case by(simp add: Let_def)\n next\n case(Cons e Es)\n from Cons.prems(3) Cons.prems(2) have \"fst ` set accu \\ V\" and \"snd ` set accu \\ V\"\n by(auto simp add: wf_graph_def)\n --\"@{const wf_graph} for some complicated structures\"\n from Cons.prems(2) this Cons.prems(4) have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = insert e (insert ea (set accu)) \\\"\n by(auto simp add: wf_graph_def)\n from backflows_wf[OF this] wf_graph_union_edges[OF Cons.prems(2)]\n have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = E \\ backflows (insert e (insert ea (set accu))) \\\" by (simp)\n hence \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = E \\ set accu \\ backflows (insert e (insert ea (set accu))) \\\" \n by (metis Cons.prems(3) sup.order_iff)\n from this Cons.prems(4)\n have \"\\ea. ea\\E \\ wf_graph \\ nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu))))) \\\"\n by(simp add: insert_absorb)\n hence validgraph1: \"\\ea. ea\\E - (set (e # accu) \\ set Es) \\ \n wf_graph \\ nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu))))) \\\" by(simp)\n\n have validgraph2: \"\\ ea. \n insert ea (E \\ set accu \\ backflows (insert ea (set accu))) \\ insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu)))))\"\n apply(simp add: backflows_def)\n by blast\n \n from all_security_requirements_fulfilled_mono[OF Cons.prems(1) validgraph2 validgraph1] have neg_mono:\n \"\\ea. ea \\ E - (set (e # accu) \\ set Es) \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n \\nodes = V, edges = insert ea (E \\ set accu \\ backflows (insert ea (set accu)))\\\n \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n \\nodes = V, edges = insert e (insert ea (E \\ set accu \\ backflows (insert e (insert ea (set accu)))))\\\"\n apply(simp)\n by blast\n\n from Cons.prems(5) have \"\\ea. ea\\E - (set (e # accu) \\ set Es) \\\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \n \\hosts = V, flows_fix = E, flows_state = {ea} \\ set (e # accu)\\)\"\n apply(erule_tac x=\"ea\" in ballE)\n prefer 2\n apply simp\n apply(simp only: stateful_policy_to_network_graph_def all_flows_def stateful_policy.select_convs)\n apply(simp)\n apply(frule(1) neg_mono[simplified])\n by(simp)\n hence goalTrue:\n \"\\ ea\\E - (set (e # accu) \\ set Es). \n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = {ea} \\ set (e # accu)\\)\"\n by simp\n \n show ?case\n apply(simp add: Let_def)\n apply(rule conjI)\n\n apply(rule impI)\n apply(thin_tac \"_\") (*dont't need it*)\n using Cons.IH[where accu=\"e # accu\", OF Cons.prems(1) Cons.prems(2) _ _ goalTrue, simplified Let_def] Cons.prems(3) Cons.prems(4)\n apply(auto) [1]\n\n apply(rule impI)\n using Cons.IH[where accu=\"accu\", OF Cons.prems(1) Cons.prems(2), simplified Let_def] Cons.prems(5) Cons.prems(3) Cons.prems(4)\n apply(auto)\n done\n qed\n lemma filter_IFS_no_violations_maximal: \"\\valid_reqs (get_IFS M); wf_graph G;\n (set edgesList) = edges G \\ \\ \n let stateful = set (filter_IFS_no_violations G M edgesList) in \n \\ e \\ edges G - stateful.\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ stateful \\)\"\n unfolding filter_IFS_no_violations_def\n apply(case_tac G, simp)\n apply(drule(1) filter_IFS_no_violations_accu_maximal_induction[where accu=\"[]\" and edgesList=\"edgesList\"])\n by(simp_all)\n\n --\"It is not only maximal for single flows but all non-empty subsets\"\n corollary filter_IFS_no_violations_maximal_allsubsets: \n assumes a1: \"valid_reqs (get_IFS M)\"\n and a2: \"wf_graph G\"\n and a4: \"(set edgesList) = edges G\"\n shows \"let stateful = set (filter_IFS_no_violations G M edgesList) in \n \\ E \\ edges G - stateful. E \\ {} \\\n \\ all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = E \\ stateful \\)\"\n proof -\n let ?stateful = \"set (filter_IFS_no_violations G M edgesList)\"\n from filter_IFS_no_violations_maximal[OF a1 a2 a4] have not_fulfilled_single: \n \"\\e\\edges G - ?stateful. \\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n by(simp add: Let_def)\n have neg_mono:\n \"\\ e E. e \\ E \\ E \\ edges G - ?stateful \\ E \\ {} \\\n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\) \\ \n \\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ ?stateful\\)\"\n proof -\n fix e E\n assume h1: \"e \\ E\"\n and h2: \"E \\ edges G - ?stateful\"\n and h3: \"E \\ {}\"\n and h4: \"\\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n \n from filter_IFS_no_violations_subseteq_input a4 have \"?stateful \\ edges G\" by blast\n hence \"edges G \\ (E \\ ?stateful) = edges G\" using h2 by blast\n from a2 this have validgraph1: \"wf_graph \\nodes = nodes G, edges = edges G \\ (E \\ ?stateful)\\\"\n by(case_tac G, simp)\n \n from h1 h2 h3 have subseteq: \"({e} \\ ?stateful) \\ (E \\ ?stateful)\" by blast\n\n have revimp: \"\\A B. (A \\ B) \\ (\\ B \\ \\ A)\" by fast\n \n from all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph[OF a1 subseteq validgraph1] h4\n show \"\\ all_security_requirements_fulfilled (get_IFS M) \n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ ?stateful\\)\" \n apply(rule revimp)\n by assumption\n qed\n \n show ?thesis\n proof(simp add: Let_def,rule allI,rule impI, rule impI)\n fix E\n assume h1: \"E \\ edges G - ?stateful\"\n and h2: \"E \\ {}\"\n\n from h1 h2 obtain e where e_prop1: \"e \\ E\" by blast \n from this h1 have \"e \\ edges G - ?stateful\" by blast\n from this not_fulfilled_single have e_prop2: \"\\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = {e} \\ ?stateful\\)\"\n by simp\n \n from neg_mono[OF e_prop1 h1 h2 e_prop2]\n show \" \\ all_security_requirements_fulfilled (get_IFS M)\n (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = E \\ set (filter_IFS_no_violations G M edgesList)\\)\"\n .\n qed\n qed\n \n --\"soundness and completeness\"\n thm filter_IFS_no_violations_correct filter_IFS_no_violations_maximal\n\n\n\n\n\n text{*Next *}\n (*\"\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ ). F \\ backflows (filternew_flows_state \\)\"*)\n (*first in list are more likely to be kept*)\n fun filter_compliant_stateful_ACS_accu :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS_accu G M accu [] = accu\" |\n \"filter_compliant_stateful_ACS_accu G M accu (e#Es) = (if\n e \\ backflows (edges G) \\ (\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = nodes G, flows_fix = edges G, flows_state = set (e#accu) \\). F \\ backflows (set (e#accu)))\n then filter_compliant_stateful_ACS_accu G M (e#accu) Es\n else filter_compliant_stateful_ACS_accu G M accu Es)\"\n definition filter_compliant_stateful_ACS :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ ('v \\ 'v) list\" where\n \"filter_compliant_stateful_ACS G M Es = filter_compliant_stateful_ACS_accu G M [] Es\"\n\n\n lemma filter_compliant_stateful_ACS_subseteq_input: \"set (filter_compliant_stateful_ACS G M Es) \\ set Es\"\n apply(subgoal_tac \"\\ accu. set (filter_compliant_stateful_ACS_accu G M accu Es) \\ set Es \\ set accu\")\n apply(erule_tac x=\"[]\" in allE)\n apply(simp add: filter_compliant_stateful_ACS_def)\n apply(induct_tac Es)\n apply(simp_all)\n apply (metis Un_insert_right set_simps(2) set_subset_Cons set_union subset_trans)\n done\n lemma filter_compliant_stateful_ACS_accu_correct_induction: \"valid_reqs (get_ACS M) \\ wf_graph \\ nodes = V, edges = E \\ \\\n (set accu) \\ (set edgesList) \\ E \\ \n \\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set (accu) \\). F \\ backflows (set accu) \\ \n (\\a \\ set accu. a \\ (backflows E)) \\\n \\ = \\ hosts = V, flows_fix = E, flows_state = set (filter_compliant_stateful_ACS_accu \\ nodes = V, edges = E \\ M accu edgesList) \\ \\\n \\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof(induction edgesList arbitrary: accu)\n case Nil\n from Nil(5) have \"backflows (set accu) = backflows {e \\ set accu. e \\ backflows E}\" by (metis (lifting) Collect_cong Collect_mem_eq)\n from this Nil(4) have \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu\\). F \\ backflows {e \\ set accu. e \\ backflows E}\" by simp\n from this Nil(6) show ?case by(simp add: filternew_flows_state_alt2)\n next\n case (Cons e Es)\n from Cons.IH[OF Cons.prems(1) Cons.prems(2)] Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6)\n show ?case by(simp add: filternew_flows_state_alt2 split: if_split_asm)\n qed\n\n \n lemma filter_compliant_stateful_ACS_accu_no_side_effects: \"valid_reqs (get_ACS M) \\ wf_graph G \\\n \\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G) \\\n (set accu) \\ (set edgesList) \\ edges G \\ \n (\\a \\ set accu. a \\ (backflows (edges G))) \\\n filter_compliant_stateful_ACS_accu G M accu edgesList = rev([ e \\ edgesList. e \\ backflows (edges G)])@accu\"\n apply(simp add: backflows_minus_backflows)\n apply(induction edgesList arbitrary: accu)\n apply(simp)\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n apply(rule impI)\n apply(case_tac G, simp, rename_tac V E)\n thm Un_set_offending_flows_bound_minus_subseteq'[where X=\"backflows E - E\" and E=\"E \\ backflows E\"]\n apply(drule_tac X=\"backflows E - E\" and E=\"E \\ backflows E\" and E'=\"(E \\ backflows E) - (insert a (E \\ set accu \\ backflows (insert a (set accu))))\" in Un_set_offending_flows_bound_minus_subseteq')\n defer\n prefer 2\n apply blast\n apply auto[1]\n apply(subgoal_tac \"E \\ backflows E - (E \\ backflows E - insert a (E \\ set accu \\ backflows (insert a (set accu)))) = insert a (E \\ set accu \\ backflows (insert a (set accu)))\")\n apply(simp)\n prefer 2\n apply (metis Un_assoc Un_least Un_mono backflows_subseteq double_diff insert_def insert_subset subset_refl)\n apply(subgoal_tac \"backflows (insert a (set accu)) \\ backflows E - E - (E \\ backflows E - insert a (E \\ set accu \\ backflows (insert a (set accu))))\")\n apply(blast)\n apply(simp add: backflows_def)\n apply fast\n using FiniteGraph.backflows_wf FiniteGraph.wf_graph_union_edges by metis\n\n\n\n lemma filter_compliant_stateful_ACS_correct: \n assumes a1: \"valid_reqs (get_ACS M)\"\n and a2: \"wf_graph G\"\n and a3: \"set edgesList \\ edges G\" \n and a4: \"all_security_requirements_fulfilled (get_ACS M) G\"\n and a5: \"\\ = \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_compliant_stateful_ACS G M edgesList) \\\"\n shows \"\\F \\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof -\n obtain V E where VE: \"G = \\ nodes = V, edges = E \\\" by(case_tac G, blast)\n from VE a2 have wfVE: \"wf_graph \\ nodes = V, edges = E \\\" by simp\n from VE a3 have \"set edgesList \\ E\" by simp\n\n from a5 VE have a5': \"\\ = \\hosts = V, flows_fix = E, flows_state = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M [] edgesList)\\\"\n unfolding filter_compliant_stateful_ACS_def\n by(simp)\n\n from all_security_requirements_fulfilled_imp_get_offending_empty[OF a1 a4] VE\n have \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = {}\\). F \\ backflows {}\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def backflows_def False_set)\n\n from filter_compliant_stateful_ACS_accu_correct_induction[where accu=\"[]\" and edgesList=\"edgesList\", simplified, OF a1 wfVE `set edgesList \\ E` this a5']\n show ?thesis .\n qed\n\n\n lemma filter_compliant_stateful_ACS_accu_induction_maximal:\"\\ valid_reqs (get_ACS M); wf_graph \\ nodes = V, edges = E \\;\n (set edgesList) \\ E;\n (set accu) \\ E; \n stateful = set (filter_compliant_stateful_ACS_accu \\ nodes = V, edges = E \\ M accu edgesList);\n \\e \\ E - (set edgesList \\ set accu \\ {e \\ E. e \\ backflows E}).\n \\ (\\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = set accu \\ {e} \\) \n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = set accu \\ {e} \\))\n \\ \\\n \\e \\ E - (stateful \\ {e \\ E. e \\ backflows E}). (* E - {computed stateful flows plus trivial stateful flows} *)\n \\ (\\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\) \n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\))\"\n proof(induction edgesList arbitrary: accu E)\n case Nil from Nil(5)[simplified] Nil(6) show ?case by(simp)\n next\n case (Cons a Es)\n --\"case distinction\"\n let ?caseDistinction=\"a \\ backflows (E) \\ (\\F\\get_offending_flows (get_ACS M)\n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu)\\).\n F \\ backflows (set (a # accu)))\"\n from Cons.prems(3) have \"set Es \\ E\" by simp\n\n show ?case\n proof(cases ?caseDistinction)\n assume CaseTrue: ?caseDistinction\n from CaseTrue have \n \"set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu (a # Es)) = \n set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M (a # accu) Es)\"\n by(simp)\n from this Cons.prems(5) have statefulsimp:\n \"stateful = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M (a # accu) Es)\" by simp\n from Cons.prems(3) Cons.prems(4) have \"set (a # accu) \\ E\" by simp\n\n have \"\\e\\E - (set Es \\ set (a # accu) \\ {e \\ E. e \\ backflows E}).\n \\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n proof(rule ballI)\n fix e\n assume h1: \"e \\ E - (set Es \\ set (a # accu) \\ {e \\ E. e \\ backflows E})\"\n\n from conjunct1[OF CaseTrue] have filternew_flows_state_moveout_a:\n \"filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\ = \n {a} \\ filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\\"\n apply(simp add: filternew_flows_state_alt) by blast\n\n have backflowssubseta: \"\\X. backflows X \\ backflows ({a} \\ X)\" by(simp add: backflows_def, blast)\n\n from Cons.prems(6) h1 have \n \"\\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\" by simp\n from this obtain dat_offender where \n dat_in: \"dat_offender \\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\"\n and dat_offends: \"dat_offender \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\" by blast\n\n have wfGraphA: \"wf_graph (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n proof(simp add: stateful_policy_to_network_graph_def all_flows_def)\n from Cons.prems(2) h1 Cons.prems(3) Cons.prems(4)\n have \"wf_graph \\nodes=V, edges = insert e (insert a (set accu)) \\\" \n apply(auto simp add: wf_graph_def) by force\n from this backflows_wf\n have vgh1: \"wf_graph \\nodes = V, edges = backflows (insert e (insert a (set accu)))\\\" by auto\n from Cons.prems(2) wf_graph_add_subset_edges h1 Cons.prems(3) Cons.prems(4)\n have vgh2: \"wf_graph \\nodes = V, edges = insert e ((insert a E) \\ set accu)\\\"\n proof -\n have f1: \"e \\ E - (set Es \\ insert a (set accu) \\ {R \\ E. R \\ backflows E})\"\n using h1 by simp\n have f2: \"insert a (set accu) \\ E\"\n using `set (a # accu) \\ E` by simp\n have f3: \"e \\ E\"\n using f1 by fastforce\n have \"E \\ insert a (set accu) = E\"\n using f2 by fastforce\n thus \"wf_graph \\nodes = V, edges = insert e (insert a E \\ set accu)\\\"\n using f3 Cons.prems(2) Un_insert_right insert_absorb sup_commute by fastforce\n qed\n from vgh1 vgh2 wf_graph_union_edges\n show \"wf_graph \\nodes = V, edges = insert e (insert a (E \\ set accu \\ backflows (insert e (insert a (set accu)))))\\\" by fastforce\n qed\n \n from dat_in have dat_in_simplified: \n \"dat_offender \\ \\get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def)\n\n have subsethlp: \"insert e (E \\ set accu \\ backflows (insert e (set accu))) \\ E \\ (set (a # accu) \\ {e}) \\ backflows (set (a # accu) \\ {e})\"\n apply(simp)\n apply(rule, blast)\n apply(rule, blast)\n apply(rule)\n apply(simp add: backflows_def, fast)\n done\n\n from get_offending_flows_union_mono[OF \n Cons.prems(1) \n wfGraphA[simplified stateful_policy_to_network_graph_def all_flows_def graph.select_convs stateful_policy.select_convs],\n OF subsethlp]\n dat_in_simplified have dat_in_a: \"dat_offender \\ \\get_offending_flows (get_ACS M) \n (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def, fast)\n\n have \"dat_offender \\ (snd a, fst a)\"\n proof(rule ccontr)\n assume \"\\ dat_offender \\ (snd a, fst a)\"\n hence hlpassm: \"dat_offender = (snd a, fst a)\" by simp\n from this obtain a1 a2 where \"dat_offender = (a2, a1)\" by blast\n \n \n have \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\ \\ \n insert e (E \\ set accu \\ backflows (insert e (set accu)))\"\n by (metis Cons.prems(1) Sup_le_iff get_offending_flows_subseteq_edges)\n from this h1 have UN_get_subset: \n \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = insert e (E \\ set accu \\ backflows (insert e (set accu)))\\ \\ \n (E \\ set accu \\ backflows (insert e (set accu)))\"\n by blast\n\n from dat_offends have dat_offends_simplified: \n \"dat_offender \\ backflows (insert e (set accu)) - E\"\n by(simp only: filternew_flows_state_alt stateful_policy.select_convs backflows_minus_backflows, simp)\n \n from conjunct1[OF CaseTrue] hlpassm have \"dat_offender \\ E\"\n by(simp add: backflows_def, fastforce)\n from dat_in_simplified UN_get_subset this have \"dat_offender \\ set accu \\ backflows (insert e (set accu))\" by blast\n from this Cons.prems(4) `dat_offender \\ E` have \"dat_offender \\ backflows (insert e (set accu))\" by blast\n from dat_offends_simplified[simplified] this have \"dat_offender \\ E\" by simp\n from `dat_offender \\ E` `dat_offender \\ E` show False by simp\n qed\n\n from this dat_offends have \n \"dat_offender \\ backflows ({a} \\ filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\"\n apply(simp add: backflows_def) by force\n\n from dat_in_a this\n show \"\\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set (a # accu) \\ {e}\\)\"\n apply(subst filternew_flows_state_moveout_a) by blast\n qed\n\n from Cons.IH[OF Cons.prems(1) Cons.prems(2) `set Es \\ E` `set (a # accu) \\ E` statefulsimp this ] show \"?case\" \n by(simp)\n next\n assume CaseFalse: \"\\ ?caseDistinction\"\n\n from CaseFalse have funapplysimp: \n \"set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu (a # Es)) = \n set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu Es)\"\n by auto\n from this Cons.prems(5) have statefulsimp:\n \"stateful = set (filter_compliant_stateful_ACS_accu \\nodes = V, edges = E\\ M accu Es)\" by simp\n from Cons.prems(4) have \"set accu \\ E\" .\n\n have \"a \\ E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E})\\ \\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\"\n proof(rule ccontr)\n assume h1: \"a \\ E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E})\"\n and \"\\ \\\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\"\n hence hccontr: \"\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\)\" by simp\n\n moreover from h1 have stateful_to_graph: \"stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\ = \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def, blast)\n moreover have \"backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {a}\\) = backflows (insert a (set accu)) - E\"\n by(simp add: filternew_flows_state_alt backflows_minus_backflows)\n ultimately have hccontr_simp:\n \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\ \\ backflows (insert a (set accu)) - E\" by simp\n\n from Cons.prems(3) Cons.prems(4) have backaaccusubE: \"backflows (set (a # accu)) \\ backflows E\" by(simp add: backflows_def, fastforce)\n from h1 have \"a \\ backflows E\" by fastforce\n from backaaccusubE `a \\ backflows E` have \"a \\ backflows (insert a (set accu))\" by auto\n\n\n from `a \\ backflows E` CaseFalse have \"\\ (\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set (a # accu)\\). F \\ backflows (set (a # accu)))\" by(simp)\n from this stateful_to_graph have \"\\ (\\F\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ set accu \\ backflows (insert a (set accu))\\. F \\ backflows (insert a (set accu)))\" by(simp)\n from this hccontr_simp show False by blast\n qed\n from Cons.prems(6)[simplified funapplysimp statefulsimp] this\n have \"\\e\\E - (set Es \\ set accu \\ {e \\ E. e \\ backflows E}).\n \\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\n \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = set accu \\ {e}\\)\"\n by auto\n\n from Cons.IH[OF Cons.prems(1) Cons.prems(2) `set Es \\ E` `set accu \\ E` statefulsimp this]\n show ?case by simp\n qed\n qed\n\n\n\n\n\n\n \n\n lemma filter_compliant_stateful_ACS_maximal: \"\\ valid_reqs (get_ACS M); wf_graph \\ nodes = V, edges = E \\;\n (set edgesList) = E;\n stateful = set (filter_compliant_stateful_ACS \\ nodes = V, edges = E \\ M edgesList)\n \\ \\\n \\e \\ E - (stateful \\ {e \\ E. e \\ backflows E}). (* E - {computed stateful flows plus trivial stateful flows} *)\n \\ (\\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\) \n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ {e} \\))\"\n apply(drule(1) filter_compliant_stateful_ACS_accu_induction_maximal[where accu=\"[]\", simplified])\n apply(blast)\n apply(simp add: filter_compliant_stateful_ACS_def)\n apply(simp)\n apply fastforce\n apply(simp add: filter_compliant_stateful_ACS_def)\n done\n\n\n lemma filter_compliant_stateful_ACS_maximal_allsubsets:\n assumes a1: \"valid_reqs (get_ACS M)\" and a2: \"wf_graph \\ nodes = V, edges = E \\\"\n and a3: \"(set edgesList) = E\"\n and a4: \"stateful = set (filter_compliant_stateful_ACS \\ nodes = V, edges = E \\ M edgesList)\"\n and a5: \"X \\ E - (stateful \\ backflows E)\" and a6: \"X \\ {}\"\n shows \"\n \\ (\\ get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\ hosts = V, flows_fix = E, flows_state = stateful \\ X \\) \n \\ backflows (filternew_flows_state \\ hosts = V, flows_fix = E, flows_state = stateful \\ X \\))\"\n proof(rule ccontr, simp)\n from a5 have \"X \\ E\" by blast\n assume accontr: \"\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ X\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ X\\)\"\n hence \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ (stateful \\ X) \\ backflows (stateful \\ X)\\ \\ backflows (stateful \\ X) - E\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def filternew_flows_state_alt backflows_minus_backflows)\n hence \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ X \\ backflows (stateful \\ X)\\ \\ backflows (stateful \\ X) - E\"\n using a4 a3 filter_compliant_stateful_ACS_subseteq_input by (metis Diff_subset_conv Un_Diff_cancel Un_assoc a3 bot.extremum_unique sup_bot_right)\n hence accontr_simp: \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ (backflows stateful) \\ (backflows X)\\ \\ backflows (stateful \\ X) - E\"\n using Set.Un_absorb2[OF `X \\ E`] backflows_un[of \"stateful\" \"X\"] by (metis Un_assoc)\n \n from a2 a5 have \"finite X\" apply(simp add: wf_graph_def) by (metis (full_types) finite_Diff finite_subset)\n from a6 obtain x where \"x \\ X\" by blast\n\n\n from `x \\ X` a5 have xX_simp1: \"(backflows X) - (backflows (X - {x}) - E) = backflows {x}\"\n apply(simp add: backflows_def) by fast\n from a5 have \"X \\ stateful = {}\" by auto\n from `x \\ X` this have xX_simp2: \"(backflows stateful) - (backflows (X - {x}) - E) = backflows stateful\"\n apply(simp add: backflows_def) by fast\n have xX_simp3:\"backflows (stateful \\ X) - (backflows (X - {x}) - E) = backflows (stateful \\ {x})\"\n apply(simp only: backflows_un)\n using xX_simp1 xX_simp2 by blast\n\n have xX_simp4: \"backflows (stateful \\ X) - E - (backflows (X - {x}) - E) = backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp add: filternew_flows_state_alt backflows_minus_backflows)\n using xX_simp3 by auto\n\n\n have xX_simp5: \"(E \\ backflows stateful \\ backflows X) - (backflows (X - {x}) - E) = E \\ backflows stateful \\ backflows {x}\"\n using xX_simp3[simplified backflows_un] by blast\n\n have Eexpand: \"E \\ stateful \\ {x} = E\" \n using a4 a3 filter_compliant_stateful_ACS_subseteq_input a5 `x\\X` by blast\n\n have \"backflows (stateful \\ X) - E - backflows (X - {x}) = (backflows (stateful \\ X) - E) - backflows (X - {x})\" by simp\n from `finite X` backflows_finite have finite: \"finite (backflows (X - {x}) - E)\" by auto\n from a2 a4 a3 filter_compliant_stateful_ACS_subseteq_input have \"wf_graph \\nodes = V, edges = stateful\\\" by (metis Diff_partition wf_graph_remove_edges_union)\n from backflows_wf[OF this] have \"wf_graph \\nodes = V, edges = backflows stateful\\\" .\n from a2 `X \\ E` have \"wf_graph \\nodes = V, edges = X\\\" by (metis double_diff dual_order.refl wf_graph_remove_edges)\n from backflows_wf[OF this] have \"wf_graph \\nodes = V, edges = backflows X\\\" .\n from this wf_graph_union_edges `wf_graph \\nodes = V, edges = backflows stateful\\` a2 have wfG: \n \"wf_graph \\nodes = V, edges = E \\ backflows stateful \\ backflows X\\\" by metis\n\n from `x\\X` have subset: \"backflows (X - {x}) - E \\ E \\ backflows stateful \\ backflows X\" apply(simp add: backflows_def) by fast\n\n from Un_set_offending_flows_bound_minus_subseteq'[OF a1 wfG subset accontr_simp] have\n \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = (E \\ backflows stateful \\ backflows X) - (backflows (X - {x}) - E)\\ \\ (backflows (stateful \\ X) - E) - (backflows (X - {x}) - E)\" by simp\n from this xX_simp4 xX_simp5 have trans1:\n \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ backflows stateful \\ backflows {x}\\ \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\" by simp\n\n hence \"\\get_offending_flows (get_ACS M) \\nodes = V, edges = E \\ backflows (stateful \\ {x})\\ \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp only: backflows_un) by (metis Un_assoc)\n hence contr1: \"\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\"\n apply(simp only: stateful_policy_to_network_graph_def all_flows_def stateful_policy.select_convs)\n using Eexpand by (metis Un_assoc)\n \n\n from filter_compliant_stateful_ACS_maximal[OF a1 a2 a3 a4] have\n \"\\e\\E - (stateful \\ {e \\ E. e \\ backflows E}). \\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {e}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {e}\\)\" .\n from this a5 `x \\ X` have contr2: \"\\ \\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\) \\ backflows (filternew_flows_state \\hosts = V, flows_fix = E, flows_state = stateful \\ {x}\\)\" by blast\n\n from contr1 contr2\n show \"False\" by simp\n qed\n\n\n text{*@{term filter_compliant_stateful_ACS} is correct and maximal*}\n thm filter_compliant_stateful_ACS_correct filter_compliant_stateful_ACS_maximal\n\n\n text{*Getting those together. We cannot say @{text \"edgesList = E\"} here because one filters first. I guess filtering ACS first is easier, ...*}\n\n\n\n\n\n\n\n\n\n\n definition generate_valid_stateful_policy_IFSACS :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ 'v stateful_policy\" where\n \"generate_valid_stateful_policy_IFSACS G M edgesList \\ (let filterIFS = filter_IFS_no_violations G M edgesList in\n (let filterACS = filter_compliant_stateful_ACS G M filterIFS in \\ hosts = nodes G, flows_fix = edges G, flows_state = set filterACS \\))\"\n\n lemma generate_valid_stateful_policy_IFSACS_wf_stateful_policy: assumes wfG: \"wf_graph G\"\n and edgesList: \"(set edgesList) = edges G\"\n shows \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n proof -\n from wfG show ?thesis\n apply(simp add: generate_valid_stateful_policy_IFSACS_def wf_stateful_policy_def)\n apply(auto simp add: wf_graph_def)\n using edgesList filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by (metis set_rev_mp)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_select_simps:\n shows \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\"\n and \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\"\n and \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ set edgesList\"\n proof -\n show \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n show \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n show \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ set edgesList\"\n apply(simp add: generate_valid_stateful_policy_IFSACS_def)\n using filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by (metis subset_trans)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_all_security_requirements_fulfilled_IFS: assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n shows \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS G M edgesList))\"\n proof -\n have simp3: \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) \\ edges G\" using generate_valid_stateful_policy_IFSACS_select_simps(3) edgesList by fast\n\n have \"set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList)) \\ set (filter_IFS_no_violations G M edgesList)\"\n using filter_compliant_stateful_ACS_subseteq_input edgesList by (metis)\n from backflows_subseteq this have \n \"backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList))) \\ backflows (set (filter_IFS_no_violations G M edgesList))\" by metis\n hence subseteqhlp1:\n \"edges G \\ backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList))) \\ edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\" by blast\n\n from high_level_policy_valid have \"all_security_requirements_fulfilled (get_IFS M) G\" by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n from filter_IFS_no_violations_correct[OF valid_reqs_IFS_D[OF validReqs] wfG this edgesList] have \n \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList)\\)\" .\n from this edgesList have goalIFS:\n \"all_security_requirements_fulfilled (get_IFS M) \\nodes = nodes G, edges = edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\\\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n by (metis Un_absorb2 filter_IFS_no_violations_subseteq_input order_trans)\n\n\n from wfG filter_IFS_no_violations_subseteq_input[where Es=\"edgesList\" and G=\"G\" and M=\"M\"] edgesList have \n \"wf_graph \\nodes = nodes G, edges = set (filter_IFS_no_violations G M edgesList)\\\" \n apply(case_tac G, simp)\n by (metis le_iff_sup wf_graph_remove_edges_union)\n from backflows_wf[OF this] have\n \"wf_graph \\nodes = nodes G, edges = backflows (set (filter_IFS_no_violations G M edgesList))\\\" by(simp)\n from this wf_graph_union_edges wfG have \n \"wf_graph \\nodes = nodes G, edges = edges G \\ backflows (set (filter_IFS_no_violations G M edgesList))\\\" \n by (metis graph.cases graph.select_convs(1) graph.select_convs(2))\n\n from all_security_requirements_fulfilled_mono[OF valid_reqs_IFS_D[OF validReqs] subseteqhlp1 this goalIFS]\n have \"all_security_requirements_fulfilled (get_IFS M) \\nodes = nodes G, edges = edges G \\ backflows (set (filter_compliant_stateful_ACS G M (filter_IFS_no_violations G M edgesList)))\\\"\n .\n thus ?thesis\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def generate_valid_stateful_policy_IFSACS_select_simps simp3 Un_absorb2)\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n qed\n\n theorem generate_valid_stateful_policy_IFSACS_stateful_policy_compliance:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS G M edgesList\"\n shows \"stateful_policy_compliance \\ G M\"\n proof -\n have 1: \"wf_stateful_policy \\\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 2: \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 3: \"hosts \\ = nodes G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_select_simps(1))\n have 4: \"flows_fix \\ \\ edges G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_select_simps(2))\n have 5: \" all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\)\"\n apply(simp add: Tau)\n using generate_valid_stateful_policy_IFSACS_all_security_requirements_fulfilled_IFS[OF validReqs wfG high_level_policy_valid] edgesList by blast\n have 6: \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n using filter_compliant_stateful_ACS_correct[OF valid_reqs_ACS_D[OF validReqs] wfG _ _ Tau[simplified generate_valid_stateful_policy_IFSACS_def Let_def]] all_security_requirements_fulfilled_ACS_D[OF high_level_policy_valid]\n edgesList filter_IFS_no_violations_subseteq_input by metis\n\n from 1 2 3 4 5 6 validReqs high_level_policy_valid wfG\n show ?thesis\n unfolding stateful_policy_compliance_def by simp\n qed\n\n\n\n\n\n definition generate_valid_stateful_policy_IFSACS_2 :: \"'v::vertex graph \\ 'v SecurityInvariant_configured list \\ ('v \\ 'v) list \\ 'v stateful_policy\" where\n \"generate_valid_stateful_policy_IFSACS_2 G M edgesList \\ \n \\ hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList) \\ set (filter_compliant_stateful_ACS G M edgesList) \\\"\n\n\n lemma generate_valid_stateful_policy_IFSACS_2_wf_stateful_policy: assumes wfG: \"wf_graph G\"\n and edgesList: \"(set edgesList) = edges G\"\n shows \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS_2 G M edgesList)\"\n proof -\n from wfG show ?thesis\n apply(simp add: generate_valid_stateful_policy_IFSACS_2_def wf_stateful_policy_def)\n apply(auto simp add: wf_graph_def)\n using edgesList filter_IFS_no_violations_subseteq_input by (metis set_rev_mp)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_2_select_simps:\n shows \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\"\n and \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\"\n and \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) \\ set edgesList\"\n proof -\n show \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n show \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n show \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) \\ set edgesList\"\n apply(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n using filter_compliant_stateful_ACS_subseteq_input by (metis inf.coboundedI2)\n qed\n\n lemma generate_valid_stateful_policy_IFSACS_2_all_security_requirements_fulfilled_IFS: assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n shows \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList))\"\n proof -\n have subseteq: \"set (filter_IFS_no_violations G M edgesList) \\ set (filter_compliant_stateful_ACS G M edgesList) \\ set (filter_IFS_no_violations G M edgesList)\" by blast\n\n from wfG filter_IFS_no_violations_subseteq_input edgesList\n have wfG': \"wf_graph \\nodes = nodes G, edges = edges G \\ set (filter_IFS_no_violations G M edgesList)\\\" \n by (metis graph_eq_intro Un_absorb2 graph.select_convs(1) graph.select_convs(2) order.trans)\n\n from high_level_policy_valid have \"all_security_requirements_fulfilled (get_IFS M) G\" by(simp add: all_security_requirements_fulfilled_def get_IFS_def)\n from filter_IFS_no_violations_correct[OF valid_reqs_IFS_D[OF validReqs] wfG this edgesList] have \n \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = set (filter_IFS_no_violations G M edgesList)\\)\" .\n\n\n from all_security_requirements_fulfilled_mono_stateful_policy_to_network_graph[OF valid_reqs_IFS_D[OF validReqs] subseteq wfG' this]\n have \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList))\"\n by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n thus ?thesis .\n qed\n\n\n lemma generate_valid_stateful_policy_IFSACS_2_filter_compliant_stateful_ACS:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) \\ edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS_2 G M edgesList\"\n shows \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n proof- \n let ?filterACS = \"set (filter_compliant_stateful_ACS G M edgesList)\"\n let ?filterIFS = \"set (filter_IFS_no_violations G M edgesList)\"\n from all_security_requirements_fulfilled_ACS_D[OF high_level_policy_valid] have \"all_security_requirements_fulfilled (get_ACS M) G\" .\n\n from filter_compliant_stateful_ACS_correct[OF valid_reqs_ACS_D[OF validReqs] wfG edgesList this] have \n \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = ?filterACS\\). \n F \\ backflows (?filterACS) - edges G\"\n apply(simp)\n apply(simp add: backflows_minus_backflows[symmetric])\n by(simp add: filternew_flows_state_alt)\n hence \"\\F\\get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\. F \\ backflows (?filterACS) - edges G\"\n apply(simp add: stateful_policy_to_network_graph_def all_flows_def)\n using filter_compliant_stateful_ACS_subseteq_input by (metis (lifting, no_types) Un_absorb2 edgesList order_trans)\n from this validReqs have offending_filterACS_upperbound:\n \"\\m. m \\ set (get_ACS M) \\ \n \\c_offending_flows m \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\ \\ \n backflows (?filterACS) - edges G\"\n by(simp add: valid_reqs_def get_offending_flows_def, blast)\n\n from wfG filter_compliant_stateful_ACS_subseteq_input edgesList have \"wf_graph \\nodes = nodes G, edges = ?filterACS\\\"\n by (metis graph.cases graph.select_convs(1) graph.select_convs(2) le_iff_sup wf_graph_remove_edges_union)\n from this backflows_wf have \"wf_graph \\nodes = nodes G, edges = backflows (?filterACS)\\\" by blast\n moreover have \"wf_graph \\nodes = nodes G, edges = edges G\\\" using wfG by(case_tac G, simp)\n ultimately have wfG1: \"wf_graph \\nodes = nodes G, edges = edges G \\ backflows (?filterACS)\\\"\n using wf_graph_union_edges by blast\n \n from edgesList have edgesUnsimp: \"edges G \\ (?filterACS \\ ?filterIFS) = edges G\"\n using filter_IFS_no_violations_subseteq_input filter_compliant_stateful_ACS_subseteq_input by blast\n\n --\"We set up a ?REM that we use in the @{thm configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq} lemma\"\n let ?REM = \"(backflows (?filterACS) - backflows (?filterIFS)) - edges G\"\n\n have REM_gives_desired_upper_bound: \"(backflows (?filterACS) - edges G) - ?REM = backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: backflows_def, blast)\n\n have REM_gives_desired_edges: \"(edges G \\ backflows (?filterACS)) - ?REM = edges G \\ (backflows (?filterACS \\ ?filterIFS))\"\n by(simp add: backflows_def, blast)\n\n from wfG have \"finite (edges G)\" using wf_graph_def by blast\n hence \"finite (backflows ?filterACS)\" using backflows_finite by (metis List.finite_set)\n hence finite1: \"finite (backflows (?filterACS) - backflows (?filterIFS) - edges G)\" by fast\n\n from configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq[where E'=\"?REM\" and X=\"(backflows (?filterACS) - edges G)\",\n OF _ wfG1 offending_filterACS_upperbound, simplified REM_gives_desired_upper_bound REM_gives_desired_edges\n ] valid_reqs_ACS_D[OF validReqs, unfolded valid_reqs_def]\n have \"\\m. m \\ set (get_ACS M) \\\n \\F\\c_offending_flows m \\nodes = nodes G, edges = edges G \\ backflows (?filterACS \\ ?filterIFS)\\.\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\" by blast\n hence \"\\F\\get_offending_flows (get_ACS M)\n \\nodes = nodes G, edges = edges G \\ (backflows (?filterACS \\ ?filterIFS))\\. F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n using get_offending_flows_def by fast\n hence \"\\F\\get_offending_flows (get_ACS M)\n \\nodes = nodes G, edges = edges G \\ (?filterACS \\ ?filterIFS) \\ (backflows (?filterACS \\ ?filterIFS))\\.\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: edgesUnsimp)\n hence \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\hosts = nodes G, flows_fix = edges G, flows_state = ?filterACS \\ ?filterIFS\\).\n F \\ backflows (?filterACS \\ ?filterIFS) - edges G\"\n by(simp add: stateful_policy_to_network_graph_def all_flows_def)\n\n thus ?thesis\n apply(simp add: Tau generate_valid_stateful_policy_IFSACS_2_def)\n apply(simp add: filternew_flows_state_alt backflows_minus_backflows)\n by (metis inf_commute)\n qed\n \n\n\n\n\n theorem generate_valid_stateful_policy_IFSACS_2_stateful_policy_compliance:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and Tau: \"\\ = generate_valid_stateful_policy_IFSACS_2 G M edgesList\"\n shows \"stateful_policy_compliance \\ G M\"\n proof -\n have 1: \"wf_stateful_policy \\\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_wf_stateful_policy[OF wfG edgesList])\n have 2: \"wf_stateful_policy (generate_valid_stateful_policy_IFSACS G M edgesList)\"\n by(simp add: generate_valid_stateful_policy_IFSACS_wf_stateful_policy[OF wfG edgesList])\n have 3: \"hosts \\ = nodes G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_select_simps(1))\n have 4: \"flows_fix \\ \\ edges G\"\n apply(simp add: Tau)\n by(simp add: generate_valid_stateful_policy_IFSACS_2_select_simps(2))\n have 5: \"all_security_requirements_fulfilled (get_IFS M) (stateful_policy_to_network_graph \\)\"\n apply(simp add: Tau)\n using generate_valid_stateful_policy_IFSACS_2_all_security_requirements_fulfilled_IFS[OF validReqs wfG high_level_policy_valid] edgesList by blast\n have 6: \"\\F\\get_offending_flows (get_ACS M) (stateful_policy_to_network_graph \\). F \\ backflows (filternew_flows_state \\)\"\n using generate_valid_stateful_policy_IFSACS_2_filter_compliant_stateful_ACS[OF \n validReqs wfG high_level_policy_valid]\n Tau edgesList by auto\n\n from 1 2 3 4 5 6 validReqs high_level_policy_valid wfG\n show ?thesis\n unfolding stateful_policy_compliance_def by simp\n qed\n\n\n\n\n\n text{*\n If there are no IFS requirements and the ACS requirements cause no side effects,\n effectively, the graph can be considered as undirected graph! \n *}\n lemma generate_valid_stateful_policy_IFSACS_2_noIFS_noACSsideeffects_imp_fullgraph:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and no_ACS_sideeffects: \"\\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G)\"\n and no_IFS: \"get_IFS M = []\"\n shows \"stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = undirected G\"\n proof -\n from filter_IFS_no_violations_accu_no_IFS[OF valid_reqs_IFS_D[OF validReqs] wfG no_IFS] edgesList\n have \"filter_IFS_no_violations G M edgesList = rev edgesList\"\n by(simp add: filter_IFS_no_violations_def)\n from this filter_compliant_stateful_ACS_subseteq_input have flows_state_IFS: \"flows_state (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = set (filter_compliant_stateful_ACS G M edgesList)\"\n by(auto simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n have flowsfix: \"flows_fix (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = edges G\" by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n have hosts: \"hosts (generate_valid_stateful_policy_IFSACS_2 G M edgesList) = nodes G\" by(simp add: generate_valid_stateful_policy_IFSACS_2_def)\n\n from filter_compliant_stateful_ACS_accu_no_side_effects[OF valid_reqs_ACS_D[OF validReqs] wfG no_ACS_sideeffects] have \n \"filter_compliant_stateful_ACS G M edgesList = rev [e\\edgesList . e \\ backflows (edges G)]\"\n by(simp add: filter_compliant_stateful_ACS_def edgesList)\n hence filterACS: \"set (filter_compliant_stateful_ACS G M edgesList) = edges G - (backflows (edges G))\" using edgesList by force\n\n show ?thesis\n apply(simp add: undirected_backflows stateful_policy_to_network_graph_def all_flows_def)\n apply(simp add: hosts filterACS flows_state_IFS flowsfix)\n apply(simp add: backflows_minus_backflows)\n by fast\n qed\n lemma generate_valid_stateful_policy_IFSACS_noIFS_noACSsideeffects_imp_fullgraph:\n assumes validReqs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and high_level_policy_valid: \"all_security_requirements_fulfilled M G\"\n and edgesList: \"(set edgesList) = edges G\"\n and no_ACS_sideeffects: \"\\F \\ get_offending_flows (get_ACS M) \\nodes = nodes G, edges = edges G \\ backflows (edges G)\\. F \\ (backflows (edges G)) - (edges G)\"\n and no_IFS: \"get_IFS M = []\"\n shows \"stateful_policy_to_network_graph (generate_valid_stateful_policy_IFSACS G M edgesList) = undirected G\"\n proof -\n from filter_IFS_no_violations_accu_no_IFS[OF valid_reqs_IFS_D[OF validReqs] wfG no_IFS] edgesList\n have \"filter_IFS_no_violations G M edgesList = rev edgesList\"\n by(simp add: filter_IFS_no_violations_def)\n from this filter_compliant_stateful_ACS_subseteq_input have flows_state_IFS: \"flows_state (generate_valid_stateful_policy_IFSACS G M edgesList) = set (filter_compliant_stateful_ACS G M (rev edgesList))\"\n by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n have flowsfix: \"flows_fix (generate_valid_stateful_policy_IFSACS G M edgesList) = edges G\" by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n have hosts: \"hosts (generate_valid_stateful_policy_IFSACS G M edgesList) = nodes G\" by(simp add: generate_valid_stateful_policy_IFSACS_def)\n\n from filter_compliant_stateful_ACS_accu_no_side_effects[OF valid_reqs_ACS_D[OF validReqs] wfG no_ACS_sideeffects] have \n \"filter_compliant_stateful_ACS G M (rev edgesList) = [e\\edgesList . e \\ backflows (edges G)]\"\n apply(simp add: filter_compliant_stateful_ACS_def edgesList) by (metis rev_filter rev_swap)\n hence filterACS: \"set (filter_compliant_stateful_ACS G M (rev edgesList)) = edges G - (backflows (edges G))\" using edgesList by force\n\n show ?thesis\n apply(simp add: undirected_backflows stateful_policy_to_network_graph_def all_flows_def)\n apply(simp add: hosts filterACS flows_state_IFS flowsfix)\n apply(simp add: backflows_minus_backflows)\n by fast\n qed\n\n\n(*\ntext{* In the repo history, we see failed attempts which try to prove that under composition, the IFS and ACS filtering is also maximal.\n I guess this does not hold in general. Needs a counter example. *}\n\n*)\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/TopoS_Stateful_Policy_Algorithm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.27401711314153415}} {"text": "section \\Sets Bounded by a Finite Cardinal $>2$ Are Not BNFs\\\n\n(*<*)\ntheory Finitely_Bounded_Set_Counterexample\nimports\n \"HOL-Cardinals.Cardinals\"\nbegin\n(*>*)\n\ntext \\Do not import this theory. It contains an inconsistent axiomatization.\nThe point is to exhibit the particular inconsistency.\\\n\ntypedef ('a, 'k) bset (\"_ set[_]\" [22, 21] 21) =\n \"{A :: 'a set. |A| 'b) \\ 'a set['k] \\ 'b set['k]\" is image\n using card_of_image ordLeq_ordLess_trans by blast\n\ninductive rel_bset :: \"('a \\ 'b \\ bool) \\ ('a, 'k) bset \\ ('b, 'k) bset \\ bool\" for R where\n \"set_bset x \\ {(x, y). R x y} \\ rel_bset R (map_bset fst x) (map_bset snd x)\"\n\ntext \\\nWe axiomatize the relator commutation property and show that we can deduce @{term False} from it.\n\nWe cannot do this with a locale, since we need the fully polymorphic version of the following axiom.\n\\\n\naxiomatization where\n inconsistent: \"rel_bset R1 OO rel_bset R2 \\ rel_bset (R1 OO R2)\"\n\nbnf \"('a, 'k) bset\"\n map: map_bset\n sets: set_bset\n bd: \"natLeq +c card_suc ( |UNIV :: 'k set| )\"\n rel: rel_bset\nproof (standard, goal_cases)\n case 1 then show ?case\n by transfer simp\nnext\n case 2 then show ?case\n apply (rule ext)\n apply transfer\n apply auto\n done\nnext\n case 3 then show ?case\n apply transfer\n apply (auto simp: image_iff)\n done\nnext\n case 4 then show ?case\n apply (rule ext)\n apply transfer\n apply simp\n done\nnext\n case 5 then show ?case by (rule card_order_bd_fun)\nnext\n case 6 then show ?case by (rule Cinfinite_bd_fun[THEN conjunct1])\nnext\n case 7 then show ?case by (rule regularCard_bd_fun)\nnext\n case 8 then show ?case\n by transfer\n (erule ordLess_ordLeq_trans[OF _ ordLeq_transitive[OF _ ordLeq_csum2]];\n simp add: card_suc_greater ordLess_imp_ordLeq Card_order_card_suc)\nnext\n case 9 then show ?case by (rule inconsistent) \\ \\BAAAAAMMMM\\\nnext\n case 10 then show ?case\n by (auto simp: fun_eq_iff intro: rel_bset.intros elim: rel_bset.cases)\nqed\n\nlemma card_option_finite[simp]:\n assumes \"finite (UNIV :: 'k set)\"\n shows \"card (UNIV :: 'k option set) = Suc (card (UNIV :: 'k set))\"\n (is \"card ?L = Suc (card ?R)\")\nproof -\n have \"card ?L = Suc (card (?L - {None}))\" by (rule card.remove) (auto simp: assms)\n also have \"card (?L - {None}) = card ?R\"\n by (rule bij_betw_same_card[of the])\n (auto simp: bij_betw_def inj_on_def image_iff intro!: bexI[of _ \"Some x\" for x])\n finally show ?thesis .\nqed\n\ndatatype ('a :: enum) x = A | B \"'a option\" | C\n\nabbreviation \"Bs \\ B ` (insert None (Some ` set Enum.enum))\"\n\nlemma UNIV_x[simp]:\n \"(UNIV :: ('a :: enum) x set) = {A, C} \\ Bs\"\n (is \"_ = ?R\")\nproof (intro set_eqI iffI)\n fix x :: \"'a x\" show \"x \\ ?R\" by (cases x) (auto simp add: enum_UNIV)\nqed simp\n\nlemma Collect_split_in_rel: \"{(x, y). in_rel R x y} = R\"\n by auto\n\nlift_definition X :: \"('a :: enum x, 'a x) bset\" is \"insert A Bs\"\n by (subst finite_card_of_iff_card3) (auto simp: card.insert_remove card_Diff_singleton_if)\n\nlift_definition Y :: \"('a :: enum x, 'a x) bset\" is \"insert C Bs\"\n by (subst finite_card_of_iff_card3) (auto simp: card.insert_remove card_Diff_singleton_if)\n\nlift_definition Z :: \"('a :: enum x, 'a x) bset\" is \"{A, C}\"\n by (subst finite_card_of_iff_card3) (auto simp: card.insert_remove card_Diff_singleton_if)\n\nlift_definition R :: \"('a x \\ 'a x, 'a :: enum x) bset\" is \"insert (A, A) ((\\B. (B, C)) ` Bs)\"\n by (subst finite_card_of_iff_card3)\n (auto simp: card.insert_remove card_Diff_singleton_if image_iff card_image inj_on_def)\n\nlift_definition S :: \"('a x \\ 'a x, 'a :: enum x) bset\" is \"insert (C, C) ((\\B. (A, B)) ` Bs)\"\n by (subst finite_card_of_iff_card3)\n (auto simp: card.insert_remove card_Diff_singleton_if image_iff card_image inj_on_def)\n\nlift_definition in_brel :: \"('a \\ 'b, 'k) bset \\ 'a \\ 'b \\ bool\" is in_rel .\n\nlemma False\nproof -\n have \"rel_bset (in_brel R) X Z\"\n unfolding bset.in_rel mem_Collect_eq\n apply (intro exI[of _ R])\n apply transfer\n apply (auto simp: image_iff)\n done\n moreover\n have \"rel_bset (in_brel S) Z Y\"\n unfolding bset.in_rel mem_Collect_eq\n apply (intro exI[of _ S])\n apply transfer\n apply (auto simp: image_iff)\n done\n ultimately have \"rel_bset (in_brel R OO in_brel S) X Y\"\n unfolding bset.rel_compp by blast\n moreover\n have *: \"insert (A, A) ((\\B. (B, C)) ` Bs) O insert (C, C) ((\\B. (A, B)) ` Bs) =\n ((\\B. (B, C)) ` Bs) \\ ((\\B. (A, B)) ` Bs)\" (is \"_ = ?RS\" ) by auto\n have \"\\ rel_bset (in_brel R OO in_brel S) X Y\"\n unfolding bset.in_rel mem_Collect_eq\n proof (transfer, safe, unfold relcompp_in_rel * Collect_split_in_rel)\n fix Z :: \"('a :: enum x \\ 'a x) set\"\n note enum_UNIV[simp] UNIV_option_conv[symmetric, simp]\n assume \"Z \\ ?RS\" \"fst ` Z = insert A Bs\" \"snd ` Z = insert C Bs\"\n then have \"Z = ?RS\" unfolding fst_eq_Domain snd_eq_Range by auto\n moreover assume \"|Z| Z = ?RS\\\n by (subst (asm) finite_card_of_iff_card3, simp, simp, subst (asm) card_Un_disjoint)\n (auto simp: card.insert_remove card_Diff_singleton_if card_image inj_on_def split: if_splits)\n qed\n ultimately show False by blast\nqed\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Probabilistic_System_Zoo/Finitely_Bounded_Set_Counterexample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2740171072132698}} {"text": "(*\n * Copyright 2018-2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory VHDL_Hoare\n imports Femto_VHDL_raw\nbegin\n\ntext \\This theory is the first attempt for defining a Hoare logic for VHDL sequential statement.\nAs the exploration continues, I realise that we can only prove the soundness in this first attempt\nbut not the completeness. The second attempt is shown in @{theory_text \"VHDL_Hoare_Complete\"}. Even\nthough we cannot show that it is complete, many theorems and definitions in this theory are useful\nfor defining a sound and complete Hoare logic in @{theory_text \"VHDL_Hoare_Complete\"}.\\\n\nsubsection \\Hoare Logic for @{typ \"'signal seq_stmt\"}\\\n\ntype_synonym 'signal worldline = \"'signal \\ nat \\ val\"\ntype_synonym 'signal worldline_init = \"'signal state \\ ('signal \\ nat \\ val)\"\n\n\ntext \\The type @{typ \"'signal worldline\"} represent the concept of ``worlds'' which are required\nfor the axiomatic semantics of VHDL specified in @{cite Breuer1995}. As can be seen from the\ndefinition, this type represents a function with two arguments: @{term \"signal :: 'signal\"} and\n@{term \"time :: nat\"} to a set of value.\n\nCompared to the standard ``worlds'' for defining the axiomatic semantics of sequential programming\nlanguage --- e.g. @{typ \"'variable \\ val\"} --- we have added the notion of @{term \"time :: nat\"}\nhere. For example, when we do assignment in VHDL, we can specify the time when this assignment will\nhappen in the future. This construct is, of course, absent from the typical assignment in sequential\nprogramming language where assignments happen instantaneously. It is due to this notion of time, we\nadd a suffix ``line'' in the type @{typ \"'signal worldline\"}.\n\nWhat is the relationship between @{typ \"'signal worldline\"} with the context @{term \"\\ :: 'signal\nstate\"}, @{term \"\\ :: 'signal event\"}, @{term \"\\ :: 'signal trans_raw\"}, @{term \"\\' \\ :: 'signal\ntrans_raw\"} in the semantics @{term \"t, \\, \\, \\, def \\ < ss, \\> \\\\<^sub>s \\'\"}? The answer is that the latter\nis the refined version of the former. We shall show the formal relationship later in this theory.\n\\\n\ndefinition worldline_upd :: \"'signal worldline_init \\ 'signal \\ nat \\ val \\ 'signal worldline_init\"\n (\"_[_, _:= _]\") where\n \"worldline_upd w s t v = (fst w, \\s' t'. if s' \\ s \\ t' < t then snd w s' t' else v)\"\n\ndefinition worldline_inert_upd :: \"'signal worldline_init \\ 'signal \\ nat \\ nat \\ val \\ 'signal worldline_init\"\n (\"_[_, _, _ := _]\") where\n \"worldline_inert_upd w s t dly v = (fst w,\n (\\s' t'. let\n time = if snd w s t = v \\ snd w s (t + dly) \\ v then t + dly\n else GREATEST n. n \\ t + dly \\ (snd w s (n - 1) \\ v) \\ snd w s n = v\n in\n if s' \\ s \\ t' < t then snd w s' t' else if t' < time then snd w s' t else v))\"\n\ndefinition to_worldline_init_bit :: \"'signal worldline_init \\ 'signal \\ nat \\ 'signal worldline_init\" where\n \"to_worldline_init_bit w sig b = ((fst w)(sig := to_bit b (fst w sig)), \n (snd w)(sig := to_bit b o (snd w sig)))\"\n\nfun worldline_inert_upd2 :: \"'signal worldline_init \\ 'signal \\ nat \\ nat \\ val \\ 'signal worldline_init\"\n where\n \"worldline_inert_upd2 w s t dly (Bv v) = worldline_inert_upd w s t dly (Bv v)\"\n| \"worldline_inert_upd2 w s t dly (Lv sign bs) = \n (fst w, (snd w)(s := \\n. let \n w' = \\b. snd (worldline_inert_upd (to_worldline_init_bit w s b) s t dly (Bv (bs ! b))); \n time = if \\n. t < n \\ n \\ t + dly \\ (\\b \\ set [0..< length bs] . w' b s (n - 1) \\ w' b s n) then \n LEAST n. t < n \\ n \\ t + dly \\ (\\b \\ set [0..< length bs] . w' b s (n - 1) \\ w' b s n)\n else t + dly\n in if n < t then snd w s n else if n < time then snd w s t else Lv sign (map (\\b. bval_of (snd (worldline_inert_upd (to_worldline_init_bit w s b) s t dly (Bv (bs ! b))) s n)) [0..These are the two constructs we can use to update or modify a @{typ \"'signal worldline\"}. Note\nthat the syntax between these two are quite similar. The only difference is the number of arguments\non the left of the equality sign: @{term \"worldline_upd\"} has two while @{term\n\"worldline_inert_upd\"} has three. As the names suggest, they correspond to the transport delay\nassignment @{term \"Bassign_trans\"} and inertial delay assignment @{term \"Bassign_inert\"}.\\\n\ntype_synonym 'signal assn = \"'signal worldline_init \\ bool\"\n\nsubsection \\Validity of Hoare proof rules\\\n\ndefinition worldline_raw ::\n \"nat \\ 'signal state \\ 'signal trans_raw \\ 'signal state \\ 'signal trans_raw \\ 'signal worldline_init\" where\n \"worldline_raw t \\ \\ def \\ = (def, \\s' t'. if t' < t then signal_of (def s') \\ s' t' else signal_of (\\ s') \\ s' t')\"\n\ntext \\@{term \"worldline_raw\"} is a constructor here. Note that we have used the same identifier (name)\nfor the constructor and the type here. This construct is the link from the operational semantics's\nworld such as @{typ \"'signal state\"}, @{typ \"'signal trans_raw\"} to the axiomatic semantics's\nworld @{typ \"'signal worldline\"}.\n\nAn observant reader might have noticed that there is no @{typ \"'signal event\"} when we construct\n@{typ \"'signal worldline\"}. This is because, as Breuer and Kloos~@{cite \"Breuer1995\"} argued, the\nnotion of event can be reconstructed from the notion of @{typ \"'signal worldline\"}. Or,\nalternatively, the notion of event is inherent in @{typ \"'signal worldline\"}. Simply find the\nsignals which have different values from those at the previous time correspondingly suffices for\nreconstructing the event at every time point.\\\n\ndefinition difference_raw :: \"'signal worldline_init \\ nat \\ 'signal \\ val\" where\n \"difference_raw w t = (if t = 0 then\n (\\s. if snd w s t \\ fst w s then Some (snd w s t) else None)\n else\n (\\s. if snd w s t \\ snd w s (t - 1) then Some (snd w s t) else None))\"\n\nlemma difference_raw_alt_def:\n \"difference_raw w t = (let\n base = if t = 0 then fst w else (\\s. snd w s (t - 1))\n in\n (\\s. if snd w s t \\ base s then Some (snd w s t) else None))\"\n unfolding difference_raw_def Let_def by auto\n\ndefinition derivative_raw :: \"'signal worldline_init \\ nat \\ 'signal trans_raw\"\n where \"derivative_raw \\ (\\w t n. if n \\ t then Map.empty else difference_raw w n)\"\n\ndefinition derivative_hist_raw :: \"'signal worldline_init \\ nat \\ 'signal trans_raw\"\n where \"derivative_hist_raw \\ \\w t n. if t \\ n then Map.empty else difference_raw w n\"\n\ntext \\ The function @{term \"derivative_raw\"} is a function to obtain the transaction\n@{term \"\\ :: 'signal trans_raw\"} in the operational semantics @{term \"b_seq_exec\"}. Note that to\nuse @{typ \"'signal worldline\"} as a context to define the axiomatic semantics of VHDL, it is always\npaired with a time variable @{term \"t :: nat\"}. This variable denotes the current time of the\ncomputation; anything strictly before this time is a history (related to the notion of behaviour\n@{term \"\\ :: 'signal trans_raw\"}) and anything after this time is a prediction (related to\nthe notion of transaction @{term \"\\ :: 'signal trans_raw\"}).\n\nThe naming ``derivative'' signifies that this function acts similarly to a derivative in the\nreal number calculus. Hence, the derivative here only record those values which are different\n(via @{term \"difference_raw\"}) from the value at the previous time (hence the name ``difference''\nas the derivative counterpart for discrete-time signal).\n\nWhy do we still have the suffix ``raw'' in @{term \"derivative_raw\"}? Because we will still lift\nthis definition further as will be explained in @{theory_text \"VHDL_Hoare_Complete\"}.\n\\\n\nlemma derivative_raw_zero:\n assumes \"\\n \\ d. \\s. snd w s n = snd w s d\" and \"d \\ t\"\n shows \"derivative_raw w t = 0\"\nproof\n fix n :: nat\n have \"n \\ t \\ t < n\" by auto\n moreover\n { assume \"n \\ t\"\n hence \"derivative_raw w t n = 0\"\n unfolding derivative_raw_def by (auto simp add: zero_fun_def zero_option_def) }\n moreover\n { assume \"t < n\"\n hence \"derivative_raw w t n = difference_raw w n\"\n unfolding derivative_raw_def by auto\n also have \"... = 0\"\n proof -\n have \"\\s. snd w s n = snd w s d\"\n using assms(1) `d \\ t` `t < n` by (meson le_eq_less_or_eq le_less_trans)\n moreover have \"\\s. snd w s (n - 1) = snd w s d\"\n using assms(1) `d \\ t` `t < n`\n by (metis Suc_diff_1 diff_is_0_eq' diff_less_mono leI less_Suc_eq_le not_less_zero)\n ultimately have \"\\s. snd w s n = snd w s (n - 1)\"\n by auto\n thus ?thesis\n using `t < n` unfolding difference_raw_def by (auto simp add: zero_option_def zero_fun_def)\n qed\n finally have \"derivative_raw w t n = 0\"\n by auto }\n ultimately show \"derivative_raw w t n = 0 n\"\n by (auto simp add: zero_fun_def)\nqed\n\nlemma\n \"n < t \\ (derivative_raw w t) n = 0\"\n by (auto simp add:derivative_raw_def zero_fun_def zero_option_def)\n\nlemma lookup_derivative_in_between:\n \"t < n \\ derivative_raw w t n = difference_raw w n\"\n by (auto simp add: derivative_raw_def)\n\nlemma\n assumes \"\\n \\ d. \\s. snd w s n = snd w s d\" and \"d < n\"\n shows \"derivative_raw w t n = 0\"\nproof -\n have \"n \\ t \\ t < n\" by auto\n moreover\n { assume \"n \\ t\"\n hence \"derivative_raw w t n = 0\"\n unfolding derivative_raw_def by (auto simp add: zero_fun_def zero_option_def) }\n moreover\n { assume \"t < n\"\n hence \"derivative_raw w t n = difference_raw w n\"\n unfolding derivative_raw_def by auto\n also have \"... = 0\"\n proof -\n have \"\\s. snd w s n = snd w s d\"\n using assms le_eq_less_or_eq by blast\n moreover have \"\\s. snd w s (n - 1) = snd w s d\"\n using assms by (metis Suc_diff_1 le_less_trans less_Suc_eq_le zero_le)\n ultimately have \"\\s. snd w s n = snd w s (n - 1)\"\n by auto\n thus ?thesis\n using `t < n` unfolding difference_raw_def by (auto simp add: zero_fun_def zero_option_def)\n qed\n ultimately have \"derivative_raw w t n = 0\"\n by auto }\n ultimately show \"derivative_raw w t n = 0\"\n by auto\nqed\n\nlemma signal_of_derivative_hist_raw:\n fixes w :: \"'signal worldline_init\"\n assumes \"t' < t\"\n shows \"signal_of (fst w s') (derivative_hist_raw w t) s' t' = snd w s' t'\"\n using assms\nproof (induction t')\n case 0\n have *: \"derivative_hist_raw w t 0 = difference_raw w 0\"\n using 0 by (auto simp add: derivative_hist_raw_def difference_raw_def)\n have \"snd w s' 0 \\ fst w s' \\ snd w s' 0 = fst w s'\"\n by auto\n moreover\n { assume \"snd w s' 0 = fst w s'\"\n hence \"inf_time (to_trans_raw_sig (derivative_hist_raw w t)) s' 0 = None\"\n unfolding sym[OF inf_time_none_iff] to_trans_raw_sig_def\n by (smt \\derivative_hist_raw w t 0 = difference_raw w 0\\ difference_raw_def domIff neq0_conv)\n hence \"signal_of (fst w s') (derivative_hist_raw w t) s' 0 = fst w s'\"\n unfolding to_signal_def comp_def by auto\n also have \"... = snd w s' 0\"\n using `snd w s' 0 = fst w s'` by auto\n finally have ?case\n by auto }\n moreover\n { assume \"snd w s' 0 \\ fst w s'\"\n have \"inf_time (to_trans_raw_sig (derivative_hist_raw w t)) s' 0 = Some 0\"\n proof (intro inf_time_someI)\n show \"0 \\ dom (to_trans_raw_sig (derivative_hist_raw w t) s')\"\n unfolding to_trans_raw_sig_def dom_def mem_Collect_eq * difference_raw_def\n using `snd w s' 0 \\ fst w s'` by auto\n qed (auto)\n hence \"signal_of (fst w s') (derivative_hist_raw w t) s' 0 = the (to_trans_raw_sig (derivative_hist_raw w t) s' 0)\"\n unfolding to_signal_def comp_def by auto\n also have \"... = snd w s' 0\"\n unfolding to_trans_raw_sig_def * difference_raw_def using `snd w s' 0 \\ fst w s'`\n by auto\n finally have ?case\n by auto }\n ultimately show ?case\n by blast\nnext\n case (Suc t')\n have \"snd w s' (Suc t') = snd w s' t' \\ snd w s' (Suc t') \\ snd w s' t'\"\n by auto\n moreover\n { assume \"snd w s' (Suc t') \\ snd w s' t'\"\n have \"derivative_hist_raw w t (Suc t') = difference_raw w (Suc t')\"\n using Suc by (auto simp add: derivative_hist_raw_def)\n moreover have \"difference_raw w (Suc t') s' = Some (snd w s' (Suc t'))\"\n using Suc `snd w s' (Suc t') \\ snd w s' t'` unfolding difference_raw_def by auto\n ultimately have \"derivative_hist_raw w t (Suc t') s' = Some (snd w s' (Suc t'))\"\n by auto\n hence ?case\n by (intro trans_some_signal_of', simp) }\n moreover\n { assume \" snd w s' (Suc t') = snd w s' t'\"\n have \"derivative_hist_raw w t (Suc t') = difference_raw w (Suc t')\"\n using Suc by (auto simp add : derivative_hist_raw_def)\n moreover have \"difference_raw w (Suc t') s' = None\"\n using Suc `snd w s' (Suc t') = snd w s' t'` unfolding difference_raw_def by auto\n ultimately have \"derivative_hist_raw w t (Suc t') s' = None\"\n by auto\n hence \"signal_of (fst w s') (derivative_hist_raw w t) s' (Suc t') = signal_of (fst w s') (derivative_hist_raw w t) s' t'\"\n by (intro signal_of_suc_sig) (simp add: zero_option_def)\n also have \"... = snd w s' t'\"\n using Suc Suc_lessD by blast\n finally have ?case\n using `snd w s' (Suc t') = snd w s' t'` by auto }\n ultimately show ?case\n by blast\nqed\n\nlemma signal_of_derivative_hist_raw2:\n assumes \"t \\ t'\" and \"0 < t\"\n shows \"signal_of (fst w s') (derivative_hist_raw w t) s' t' = snd w s' (t - 1)\"\nproof -\n have \"t - 1 < t\"\n using assms by auto\n have \"signal_of (fst w s') (derivative_hist_raw w t) s' t' = signal_of (fst w s') (derivative_hist_raw w t) s' t\"\n using assms\n by (intro signal_of_less_ind')(auto simp add: derivative_hist_raw_def zero_option_def)\n also have \"... = signal_of (fst w s') (derivative_hist_raw w t) s' (t - 1)\"\n by (intro signal_of_less_sig) (auto simp add: derivative_hist_raw_def zero_option_def)\n also have \"... = snd w s' (t - 1)\"\n using signal_of_derivative_hist_raw[OF `t - 1 < t`] by metis\n finally show \"signal_of (fst w s') (derivative_hist_raw w t) s' t' = snd w s' (t - 1)\"\n by auto\nqed\n\nlemma signal_of_derivative_hist_raw3:\n assumes \"0 \\ t'\" \n shows \"signal_of (fst w s') (derivative_hist_raw w 0) s' t' = fst w s'\"\nproof -\n have \"derivative_hist_raw w 0 = (\\n. Map.empty)\"\n unfolding derivative_hist_raw_def by auto\n hence \"inf_time (to_trans_raw_sig (derivative_hist_raw w 0)) s' t' = inf_time (to_trans_raw_sig (\\n. Map.empty)) s' t'\"\n by auto\n also have \"... = inf_time (\\n. Map.empty) s' t'\"\n unfolding to_trans_raw_sig_def by auto\n also have \"... = None\"\n using inf_time_none_iff by force\n finally show ?thesis\n unfolding to_signal_def comp_def by auto\nqed\n\nlemma signal_of_derivative_raw_t:\n assumes \"\\ s' = snd w s' t\"\n shows \"signal_of (\\ s') (derivative_raw w t) s' t = snd w s' t\"\nproof -\n have \"derivative_raw w t t = Map.empty\"\n using assms by (auto simp add: derivative_raw_def)\n have *: \"\\n. 0 < n \\ n \\ t \\ derivative_raw w t n = 0\"\n by (auto simp add: derivative_raw_def zero_fun_def zero_option_def)\n have \"signal_of (\\ s') (derivative_raw w t) s' t = signal_of (\\ s') (derivative_raw w t) s' 0\"\n using * by (cases \"t = 0\")(rule_tac[!] signal_of_less_ind, simp_all)\n also have \"... = \\ s'\"\n by(intro signal_of_zero) (auto simp add: derivative_raw_def zero_option_def)\n finally show ?thesis\n using assms by auto\nqed\n\nlemma signal_of_derivative_raw:\n assumes \"t \\ t'\"\n assumes \"snd w s' t = \\ s'\"\n shows \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' t'\"\n using assms\nproof (induction t')\n case 0\n hence \"t = 0\" by auto\n have lookup: \"derivative_raw w 0 0 = Map.empty\"\n by (auto simp add: derivative_raw_def)\n hence \" signal_of (\\ s') (derivative_raw w t) s' 0 = signal_of (\\ s') (derivative_raw w 0) s' 0\"\n unfolding `t = 0` by auto\n also have \"... = \\ s'\"\n using lookup signal_of_zero by (metis (no_types, lifting) zero_option_def)\n also have \"... = snd w s' 0\"\n using `snd w s' t = \\ s'` `t = 0` by auto\n finally show ?case by auto\nnext\n case (Suc t')\n hence \"Suc t' = t \\ t < Suc t'\"\n by auto\n moreover\n { assume \"Suc t' = t\"\n have lookup: \"derivative_raw w t (Suc t') = Map.empty\"\n unfolding `Suc t' = t` by (auto simp add: derivative_raw_def)\n have \" \\n. 0 < n \\ n \\ Suc t' \\ (derivative_raw w t) n = 0\"\n unfolding `Suc t' = t` by (auto simp add: derivative_raw_def zero_fun_def zero_option_def)\n hence \" signal_of (\\ s') (derivative_raw w t) s' (Suc t') = signal_of (\\ s') (derivative_raw w t) s' 0\"\n by (intro signal_of_less_ind, simp_all)\n also have \"... = \\ s'\"\n by (metis (full_types, hide_lams) Suc.prems(2) \\Suc t' = t\\ assms(2) calculation\n signal_of_derivative_raw_t)\n also have \"... = snd w s' (Suc t')\"\n using `snd w s' t = \\ s'` `Suc t' = t` by auto\n finally have ?case unfolding `Suc t' = t` by auto }\n moreover\n { assume \"t < Suc t'\"\n hence \"t \\ t'\"\n by auto\n hence lookup: \" (derivative_raw w t) (Suc t') = difference_raw w (Suc t')\"\n by (auto simp add: derivative_raw_def)\n have \"snd w s' (Suc t') = snd w s' t' \\ snd w s' (Suc t') \\ snd w s' t'\"\n by auto\n moreover\n { assume \"snd w s' (Suc t') = snd w s' t'\"\n hence \"difference_raw w (Suc t') s' = None\"\n unfolding difference_raw_def by auto\n hence \"(derivative_raw w t) (Suc t') s' = None\"\n using lookup by auto\n hence \"signal_of (\\ s') (derivative_raw w t) s' (Suc t') = signal_of (\\ s') (derivative_raw w t) s' t'\"\n by(intro signal_of_suc_sig)(simp add: zero_option_def)\n also have \"... = snd w s' t'\"\n using Suc(1)[OF `t \\ t'` Suc(3)] by auto\n also have \"... = snd w s' (Suc t')\"\n using `snd w s' (Suc t') = snd w s' t'` by auto\n finally have ?case by auto }\n moreover\n { assume \"snd w s' (Suc t') \\ snd w s' t'\"\n hence \"difference_raw w (Suc t') s' = Some (snd w s' (Suc t'))\"\n unfolding difference_raw_def by auto\n hence \"(derivative_raw w t) (Suc t') s' = Some (snd w s' (Suc t'))\"\n using lookup by auto\n hence ?case\n by (intro trans_some_signal_of') }\n ultimately have ?case by blast }\n ultimately show ?case by auto\nqed\n\nlemma signal_of_derivative_raw2:\n assumes \"\\n\\d. snd w s' n = snd w s' d\"\n assumes \"d \\ t'\"\n assumes \"snd w s' t = \\ s'\"\n shows \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' d\"\nproof -\n have \"\\n. d < n \\ n \\ t' \\ (derivative_raw w t) n s' = 0\"\n proof -\n fix n\n assume \"d < n\" and \"n \\ t'\"\n have \"n \\ t \\ t < n\" by auto\n moreover\n { assume \"n \\ t\"\n hence \"derivative_raw w t n s' = 0\"\n unfolding derivative_raw_def by (auto simp add: zero_fun_def zero_option_def) }\n moreover\n { assume \"t < n\"\n have \"snd w s' n = snd w s' d\"\n using assms `d < n` using less_imp_le_nat by blast\n also have \"... = snd w s' (n-1)\"\n using `d < n` assms(1) by (metis Suc_diff_1 less_Suc_eq_0_disj less_Suc_eq_le\n less_imp_Suc_add)\n finally have \"snd w s' n = snd w s' (n - 1)\"\n by auto\n hence \"derivative_raw w t n s' = difference_raw w n s'\"\n using `t < n` unfolding derivative_raw_def by auto\n also have \"... = None\"\n unfolding difference_raw_def using \\snd w s' n = snd w s' (n-1)\\ `t < n` by auto\n finally have \"derivative_raw w t n s' = 0\"\n unfolding zero_option_def by auto }\n ultimately show \"derivative_raw w t n s' = 0\"\n by auto\n qed\n from signal_of_less_ind'[where \\=\" (derivative_raw w t)\", OF this]\n have *: \"signal_of (\\ s') (derivative_raw w t) s' t' = signal_of (\\ s') (derivative_raw w t) s' d\"\n using assms(2) using le_eq_less_or_eq by auto\n have \"t \\ t' \\ t' < t\" by auto\n moreover\n { assume \"t \\ t'\"\n have \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' t'\"\n using signal_of_derivative_raw[OF `t \\ t'`, of \"w\" \"s'\" \"\\\", OF assms(3)] by auto\n also have \"... = snd w s' d\"\n using assms(1-2) by blast\n finally have \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' d\"\n by auto }\n moreover\n { assume \"t' < t\"\n have \"signal_of (\\ s') (derivative_raw w t) s' d = signal_of (\\ s') (derivative_raw w t) s' 0\"\n proof (intro signal_of_less_ind')\n fix n\n assume \"0 < n\" and \"n \\ d\"\n thus \"derivative_raw w t n s' = 0\"\n unfolding derivative_raw_def using `d \\ t'` `t' < t` by (auto simp add: zero_option_def)\n qed (auto)\n also have \"... = \\ s'\"\n by (intro signal_of_zero)(auto intro!: signal_of_zero simp add: derivative_raw_def\n zero_option_def)\n also have \"... = snd w s' t\"\n using assms(3) by auto\n also have \"... = snd w s' d\"\n using assms(1) `t' < t` `d \\ t'` by (meson less_trans not_le)\n finally have \"signal_of (\\ s') (derivative_raw w t) s' d = snd w s' d\"\n by auto\n hence \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' d\"\n using * by auto }\n ultimately show ?thesis by auto\nqed\n\nlemma signal_of_derivative_raw':\n assumes \"t \\ t'\" and \"t \\ d\"\n assumes \"\\n s. d < n \\ snd w s n = snd w s d\"\n assumes \"snd w s' t = \\ s'\"\n shows \"signal_of (\\ s') (derivative_raw w t) s' t' = snd w s' t'\"\n using assms by (metis signal_of_derivative_raw)\n\nlemma signal_of_derivative_raw_degree_lt_now:\n assumes \"\\n\\ d. \\s. snd w s n = snd w s d\"\n assumes \"d < t\"\n shows \"signal_of (\\ s') (derivative_raw w t) s' t' = \\ s'\"\nproof -\n have \"derivative_raw w t = 0\"\n using derivative_raw_zero assms by (simp add: derivative_raw_zero)\n moreover have \"signal_of (\\ s') 0 s' t' = \\ s'\"\n using signal_of_empty unfolding zero_fun_def by metis\n ultimately show ?thesis by auto\nqed\n\nlemma signal_of2_derivative_before_now:\n assumes \"t' < t\"\n shows \"signal_of def (derivative_raw w t) s' t' = def\"\nproof -\n have *: \"\\k. k < t \\ (derivative_raw w t) k = Map.empty\"\n by (auto simp add: derivative_raw_def)\n hence \"\\n. 0 < n \\ n \\ t' \\ (derivative_raw w t) n = 0\"\n using `t' < t` unfolding derivative_raw_def by (auto simp add: zero_fun_def zero_option_def)\n hence \"signal_of def (derivative_raw w t) s' t' = signal_of def (derivative_raw w t) s' 0\"\n by (intro signal_of_less_ind, simp_all)\n also have \"... = def\"\n by (intro signal_of_zero, auto simp add: derivative_raw_def zero_option_def)\n finally show \"signal_of def (derivative_raw w t) s' t' = def\"\n by auto\nqed\n\ntext \\non-stuttering\\\n\ndefinition non_stuttering :: \"'signal trans_raw_sig \\ 'signal state \\ 'signal \\ bool\" where\n \"non_stuttering \\ \\ s \\ (\\k1 k2.\n k1 < k2 \\ k1 \\ keys (\\ s) \\ k2 \\ keys (\\ s)\n \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (\\ s)) \\ \\ s k1 \\ \\ s k2)\n \\ (keys (\\ s) \\ {} \\ \\ s \\ the (\\ s (LEAST k. k \\ keys (\\ s))))\"\n\nlemma two_successive_keys_diff_value:\n fixes \\ :: \"'a trans_raw_sig\"\n assumes \"non_stuttering \\ \\ s\"\n assumes \"t1 \\ keys (\\ s)\" and \"t2 \\ keys (\\ s)\"\n defines \"v1 \\ the (\\ s t1)\"\n defines \"v2 \\ the (\\ s t2)\"\n assumes \"\\n>t1. n < t2 \\ \\ s n = 0\"\n assumes \"t1 < t2\"\n shows \"v1 \\ v2\"\nproof -\n have \"\\k. t1 < k \\ k < t2 \\ k \\ keys (\\ s)\"\n using `\\n>t1. n < t2 \\ \\ s n = 0` by (simp add: keys_def)\n with assms(1-3) show ?thesis\n using `t1 < t2` unfolding v1_def v2_def non_stuttering_def\n proof -\n assume a1: \"(\\k1 k2. k1 < k2 \\ k1 \\ keys (\\ s) \\ k2 \\ keys (\\ s) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (\\ s)) \\ \\ s k1 \\ \\ s k2) \\ (keys (\\ s) \\ {} \\ \\ s \\ the (\\ s (LEAST k. k \\ keys (\\ s))))\"\n have \"\\n f. (n::nat) \\ {n. f n \\ (None::val option)} \\ f n \\ None\"\n by fastforce\n then show \"the (\\ s t1) \\ the (\\ s t2)\"\n using a1 by (metis \\\\k. t1 < k \\ k < t2 \\ k \\ keys (\\ s)\\ \\t1 < t2\\ \\t1 \\ keys (\\ s)\\ \\t2 \\ keys (\\ s)\\ keys_def option.collapse zero_option_def)\n qed\nqed\n\nlemma derivative_raw_of_worldline_specific:\n fixes \\ :: \"'a state\"\n fixes def \\\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n defines \"w \\ worldline_raw t \\ \\ def \\\"\n assumes \"\\s. non_stuttering (to_trans_raw_sig \\) \\ s\"\n shows \"derivative_raw w t = \\\"\nproof (rule ext)\n fix k\n have \"\\ t = 0\"\n using assms(1) by auto\n have \"k \\ t \\ t < k\" by auto\n moreover\n { assume \"k \\ t\"\n hence \"(derivative_raw w t) k = 0\"\n by (auto simp add: derivative_raw_def zero_fun_def zero_option_def)\n also have \"... = \\ k\"\n using assms(1) `k \\ t` by auto\n finally have \"derivative_raw w t k = \\ k\"\n by auto }\n moreover\n { assume \"t < k\"\n hence \"derivative_raw w t k = difference_raw w k\"\n unfolding derivative_raw_def by auto\n also have \"... = \\ k\"\n proof (rule ext)\n fix s\n have \"snd w s k \\ snd w s (k - 1) \\ snd w s k = snd w s (k - 1)\"\n by auto\n moreover\n { assume \"snd w s k \\ snd w s (k - 1)\"\n hence \"signal_of (\\ s) \\ s k \\ signal_of (\\ s) \\ s (k - 1)\"\n unfolding w_def worldline_raw_def using `t < k` by (simp add: discrete)\n have lnone: \" (to_trans_raw_sig \\ s) k \\ 0\"\n proof (rule ccontr)\n assume \"\\ (to_trans_raw_sig \\ s) k \\ 0\"\n hence \" (to_trans_raw_sig \\ s) k = 0\"\n by auto\n hence \" \\ k s = 0\"\n unfolding to_trans_raw_sig_def by auto\n hence \"signal_of (\\ s) \\ s k = signal_of (\\ s) \\ s (k - 1)\"\n by (intro signal_of_less_sig)\n with `signal_of (\\ s) \\ s k \\ signal_of (\\ s) \\ s (k - 1)` show False\n by auto\n qed\n then obtain val where \"to_trans_raw_sig \\ s k = Some val\"\n by (metis not_None_eq zero_fun_def zero_fun_def zero_option_def)\n hence \"\\ k s = Some val\"\n by (auto simp add: to_trans_raw_sig_def)\n hence inf: \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s k = Some k\"\n by (auto intro!: some_inf_time'[where \\=\"def(s := val)\"])\n have \"difference_raw w k s = Some (snd w s k)\"\n unfolding difference_raw_def using `snd w s k \\ snd w s (k - 1)` using \\t < k\\ by auto\n also have \"... = (to_trans_raw_sig \\ s) k\"\n unfolding w_def worldline_raw_def using `t < k` unfolding Femto_VHDL_raw.to_signal_def\n comp_def using inf \\ (to_trans_raw_sig \\ s) k = Some val\\ by auto\n also have \"... = \\ k s\"\n by (auto simp add: to_trans_raw_sig_def)\n finally have \"difference_raw w k s = \\ k s\"\n by auto }\n moreover\n { assume \"snd w s k = snd w s (k - 1)\"\n hence sig_same: \"signal_of (\\ s) \\ s k = signal_of (\\ s) \\ s (k - 1)\"\n unfolding w_def worldline_raw_def using `t < k` by auto\n have lnone: \" (to_trans_raw_sig \\ s) k = None\"\n proof (rule ccontr)\n assume \" (to_trans_raw_sig \\ s) k \\ None\"\n then obtain val where \" (to_trans_raw_sig \\ s) k = Some val\"\n by blast\n hence \" \\ k s = Some val\"\n by (auto simp add: to_trans_raw_sig_def)\n hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s k = Some k\"\n by (auto intro!: some_inf_time'[where \\=\"def(s := val)\"])\n hence \"signal_of (\\ s) \\ s k = val\"\n unfolding Femto_VHDL_raw.to_signal_def comp_def by (simp add: \\ (to_trans_raw_sig \\ s) k = Some val\\)\n with sig_same have \"signal_of (\\ s) \\ s (k - 1) = val\"\n by auto\n from signal_of_elim[OF this]\n have \"(\\m\\k - 1. (to_trans_raw_sig \\ s) m = Some val) \\\n (\\m\\k - 1. (to_trans_raw_sig \\ s) m = None \\ val = \\ s)\"\n by (metis to_trans_raw_sig_def)\n moreover\n { assume \"(\\m\\k - 1. (to_trans_raw_sig \\ s) m = Some val)\"\n then obtain m where \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k-1) = Some m\" and \" (to_trans_raw_sig \\ s) m = Some val\"\n using `signal_of (\\ s) \\ s (k - 1) = val` unfolding Femto_VHDL_raw.to_signal_def comp_def\n by (smt \\to_trans_raw_sig \\ s k = Some val\\ \\to_trans_raw_sig \\ s k \\ None\\\n inf_time_noneE2 inf_time_some_exists keys_def mem_Collect_eq option.case_eq_if\n option.collapse zero_option_def)\n have \"m < k\"\n using inf_time_at_most[OF `Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k-1) = Some m`]\n \\t < k\\ by linarith\n moreover have \"m \\ keys (to_trans_raw_sig \\ s)\"\n using `to_trans_raw_sig \\ s m = Some val` unfolding keys_def by (auto simp add: zero_option_def)\n moreover have \"k \\ keys (to_trans_raw_sig \\ s)\"\n using `\\ k s = Some val` unfolding keys_def to_trans_raw_sig_def by (auto simp add: zero_option_def)\n moreover have \"\\n. m < n \\ n < k \\ n \\ keys (to_trans_raw_sig \\ s)\"\n proof (rule ccontr)\n assume \"\\ (\\n. m < n \\ n < k \\ n \\ keys (to_trans_raw_sig \\ s))\"\n then obtain n where \"m < n\" and \"n < k\" and \"n \\ keys (to_trans_raw_sig \\ s)\"\n by auto\n with inf_time_someE[OF `Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k-1) = Some m`]\n show False\n unfolding dom_is_keys by auto\n qed\n ultimately have \"to_trans_raw_sig \\ s m \\ to_trans_raw_sig \\ s k\"\n using assms(3) unfolding non_stuttering_def by metis\n hence \"Some val \\ Some val\"\n using \\(to_trans_raw_sig \\ s) m = Some val\\ \\\\ k s = Some val\\\n unfolding to_trans_raw_sig_def by auto\n hence False by auto }\n moreover\n { assume \"(\\m\\k - 1. (to_trans_raw_sig \\ s) m = None \\ val = \\ s)\"\n hence must_zero: \"\\m. m < k \\ (to_trans_raw_sig \\ s) m = 0\" and \"val = \\ s\"\n by (auto simp add: zero_option_def)\n have \"(LEAST n. n \\ keys (to_trans_raw_sig \\ s)) = k\"\n proof (rule Least_equality)\n show \"k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ s)\"\n using `\\ k s = Some val` unfolding to_trans_raw_sig_def keys_def\n by (auto simp add: zero_option_def)\n next\n { fix y\n assume \"\\ k \\ y\" hence \"y < k\" by auto\n with must_zero have \"y \\ keys (to_trans_raw_sig \\ s)\"\n by (simp add: keys_def) }\n thus \"\\y. y \\ keys (to_trans_raw_sig \\ s) \\ k \\ y\"\n by auto\n qed\n moreover have \"keys (to_trans_raw_sig \\ s) \\ {}\"\n using `\\ k s = Some val` \\Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s k = Some k\\\n inf_time_some_exists by fastforce\n ultimately have \"\\ s \\ val\"\n using assms(3) `\\ k s = Some val` unfolding non_stuttering_def\n using \\to_trans_raw_sig \\ s k = Some val\\ by auto\n hence False\n using `val = \\ s` by auto }\n ultimately show False by auto\n qed\n hence \"difference_raw w k s = \\ k s\"\n unfolding difference_raw_def using `snd w s k = snd w s (k - 1)` `t < k`\n by (auto simp add:to_trans_raw_sig_def) }\n ultimately show \"difference_raw w k s = \\ k s\"\n by auto\n qed\n finally have \"derivative_raw w t k = \\ k\"\n by auto }\n ultimately show \" derivative_raw w t k = \\ k\"\n by auto\nqed\n\nlemma current_sig_and_prev_same:\n assumes \"signal_of def \\ s k = signal_of def \\ s (k - 1)\"\n assumes \"0 < k\"\n assumes \"non_stuttering (to_trans_raw_sig \\) state s\"\n assumes \"state s = def\"\n shows \"\\ k s = 0\"\nproof (rule ccontr)\n assume \"\\ k s \\ 0\"\n then obtain val where \"\\ k s = Some val\"\n by (metis not_None_eq zero_fun_def zero_fun_def zero_option_def)\n hence \"signal_of def \\ s k = val\"\n using trans_some_signal_of'[of \"\\\" \"k\" \"s\" \"def_state(s := val)\" \"def\"] by auto\n have \"the (to_trans_raw_sig \\ s k) = val\"\n using `\\ k s = Some val` by (auto simp add: to_trans_raw_sig_def)\n have \"k \\ dom (to_trans_raw_sig \\ s)\"\n using ` \\ k s = Some val` by ( auto simp add: to_trans_raw_sig_def)\n hence \"k \\ keys (to_trans_raw_sig \\ s)\"\n by (auto simp add: keys_def to_trans_raw_sig_def zero_option_def)\n obtain k' where \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k - 1) = None \\\n Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k - 1) = Some k'\"\n using option.exhaust_sel by blast\n moreover\n { assume inf_none: \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k - 1) = None\"\n hence noneE: \"\\t\\dom ( (to_trans_raw_sig \\ s)). (k - 1) < t\"\n by (simp add: inf_time_none_iff)\n have *: \"\\n. n < k \\ (to_trans_raw_sig \\ s) n = 0\"\n proof (rule ccontr)\n assume \"\\ (\\n. n < k \\ (to_trans_raw_sig \\ s) n = 0)\"\n then obtain n where \"n < k\" and \" (to_trans_raw_sig \\ s) n \\ 0\"\n by auto\n hence \"n \\ dom ( (to_trans_raw_sig \\ s))\"\n by (simp add: domIff zero_option_def)\n hence \"k - 1 < n\" using noneE by auto\n with `n < k` show False by auto\n qed\n have \"signal_of def \\ s (k - 1) = def\"\n using inf_none unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n have \"k \\ keys (to_trans_raw_sig \\ s)\"\n using ` \\ k s = Some val` \\signal_of def \\ s (k - 1) = def\\\n \\signal_of def \\ s k = signal_of def \\ s (k - 1)\\ inf_none inf_time_less\n some_inf_time' \\k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ s)\\ by blast\n hence \"keys (to_trans_raw_sig \\ s) \\ {}\"\n by auto\n moreover have \"(LEAST n. n \\ keys (to_trans_raw_sig \\ s)) = k\"\n proof (rule Least_equality)\n { fix y\n assume \"\\ k \\ y\" hence \"y < k\" by auto\n hence \"y \\ keys (to_trans_raw_sig \\ s)\"\n using * by (simp add: keys_def) }\n thus \"\\y. y \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ s) \\ k \\ y\"\n by auto\n qed (simp add: `k \\ keys (to_trans_raw_sig \\ s)`)\n ultimately have \"state s \\ the (\\ k s)\"\n using assms(3) unfolding non_stuttering_def by (simp add: to_trans_raw_sig_def)\n hence \"val \\ def\"\n using assms(3-4) by (simp add: \\\\ k s = Some val\\)\n hence \"signal_of def \\ s k \\ signal_of def \\ s (k - 1)\"\n using `signal_of def \\ s k = val` `signal_of def \\ s (k - 1) = def`\n by auto\n with `signal_of def \\ s k = signal_of def \\ s (k - 1)` have \"False\" by auto }\n moreover\n { assume inf_some: \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) s (k - 1) = Some k'\"\n have \"\\t\\dom ( (to_trans_raw_sig \\ s)). t \\ k-1 \\ t \\ k'\"\n using inf_time_someE[OF inf_some] by auto\n hence \"\\n>k'. n < k \\ (to_trans_raw_sig \\ s) n = None\"\n by (metis diff_Suc_1 domIff le_add1 less_imp_Suc_add not_le)\n have \"k' < k\"\n using inf_time_at_most[OF inf_some] \\0 < k\\ by linarith\n have \"k' \\ dom ( (to_trans_raw_sig \\ s))\"\n by (metis (full_types) dom_def inf_some inf_time_some_exists keys_def zero_option_def)\n hence \"k' \\ keys (to_trans_raw_sig \\ s)\"\n by (auto simp add: keys_def to_trans_raw_sig_def zero_option_def)\n obtain val' where \" (to_trans_raw_sig \\ s) k' = Some val'\"\n using `k' \\ dom ( (to_trans_raw_sig \\ s))` by auto\n hence \"the ( (to_trans_raw_sig \\ s) k') = val'\"\n by ( auto simp add: to_trans_raw_sig_def)\n hence \"val \\ val'\"\n using two_successive_keys_diff_value[OF `non_stuttering (to_trans_raw_sig \\) state s`\n `k' \\ keys (to_trans_raw_sig \\ s)` `k \\ keys (to_trans_raw_sig \\ s)` _ `k' < k`]\n `\\n>k'. n < k \\ (to_trans_raw_sig \\ s) n = None` `the ( (to_trans_raw_sig \\ s) k) = val`\n unfolding zero_option_def by auto\n hence \"signal_of def \\ s (k - 1) = val'\"\n using inf_some `the ( (to_trans_raw_sig \\ s) k') = val'`\n unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n with `signal_of def \\ s k = val` have \"False\"\n using `val \\ val'` `signal_of def \\ s k = signal_of def \\ s (k - 1)` by auto }\n ultimately show False by auto\nqed\n\ntext \\Here is an important result. In case that the history @{term \"\\ :: 'a trans_raw\"} is\nnon-stuttering, the derivative raw of the worldline @{term \"w = worldline_raw t \\ \\ \\\"} is exactly the\nhistory @{term \"\\\"}.\\\n\n\\ \\It does not make any sense to have @{term \"\\ 0 \\ 0\"} in the theorem below. Suppose that it is so.\nHence we have the history at zero is different from the initial state @{term \"def\"}. This means that\nthere is a delta delay transition at time zero for setting the new value at zero. Why don't we set\nthe time we wish at time zero directly in @{term \"def\"}?\\\n\nlemma derivative_is_history:\n fixes \\ :: \"'a state\"\n fixes def \\\n assumes *: \"\\n. t \\ n \\ \\ n = 0\"\n defines \"w \\ worldline_raw t \\ \\ def \\\"\n assumes \"\\s. non_stuttering (to_trans_raw_sig \\) def s\"\n shows \"derivative_hist_raw w t = \\\"\nproof (rule ext)\n fix k\n have \"k = 0 \\ 0 < k \\ k < t \\ t < k \\ t = k\"\n by auto\n moreover\n { assume \"t < k\"\n hence \"derivative_hist_raw w t k = Map.empty\"\n by (auto simp add: derivative_hist_raw_def)\n also have \"... = \\ k\"\n using * `t < k` unfolding zero_fun_def zero_option_def by auto\n finally have \"derivative_hist_raw w t k = \\ k\"\n using `t < k` by auto }\n moreover\n { assume \"0 < k \\ k < t\"\n hence \"(derivative_hist_raw w t) k = difference_raw w k\"\n by (auto simp add: derivative_hist_raw_def)\n also have \"... = \\ k\"\n unfolding difference_raw_def\n proof (rule ext)\n fix s\n have \"non_stuttering (to_trans_raw_sig \\) def s\"\n using assms(3) by auto\n have \"snd w s k = snd w s (k - 1) \\ snd w s k \\ snd w s (k - 1)\"\n by auto\n moreover\n { assume \"snd w s k = snd w s (k - 1)\"\n have \"signal_of (def s) \\ s k = signal_of (def s) \\ s (k - 1)\"\n using `0 < k \\ k < t` `snd w s k = snd w s (k - 1)` unfolding w_def worldline_raw_def by auto\n have \"\\ k s = 0\"\n using current_sig_and_prev_same \\0 < k \\ k < t\\\n \\non_stuttering (to_trans_raw_sig \\) def s\\ \\signal_of (def s) \\ s k = signal_of (def s) \\ s (k - 1)\\\n by fastforce\n hence \"(if snd w s k \\ snd w s (k - 1) then Some (snd w s k) else None) = \\ k s\"\n using `snd w s k = snd w s (k-1)` by (auto simp add: zero_option_def) }\n moreover\n { assume \"snd w s k \\ snd w s (k - 1)\"\n have \"signal_of (def s) \\ s k \\ signal_of (def s) \\ s (k - 1)\"\n using `0 < k \\ k < t` `snd w s k \\ snd w s (k - 1)` unfolding w_def worldline_raw_def\n by (simp add: less_imp_diff_less)\n hence \"\\ k s \\ 0\"\n using signal_of_less_sig by fastforce\n have \"the (\\ k s) = signal_of (def s) \\ s k \"\n proof -\n obtain m where \"\\ k s = Some m\"\n using `\\ k s \\ 0` zero_option_def by fastforce\n then obtain \\ where \"\\ k s = Some (\\ s)\"\n by simp\n thus ?thesis\n using trans_some_signal_of' by fastforce\n qed\n also have \"... = snd w s k\"\n unfolding w_def worldline_raw_def using `0 < k \\ k < t` by auto\n finally have \"(if snd w s k \\ snd w s (k - 1) then Some (snd w s k) else None) =\\ k s\"\n using `snd w s k \\ snd w s (k - 1)` by (smt \\\\ k s \\ 0\\ option.collapse zero_option_def) }\n ultimately show \"(if k = 0 then \\s. if snd w s k \\ get_time w s then Some (snd w s k) else None else (\\s. if snd w s k \\ snd w s (k - 1) then Some (snd w s k) else None)) s = \\ k s\"\n using `0 < k \\ k < t` by auto\n qed\n finally have \"derivative_hist_raw w t k = \\ k\"\n using `0 < k \\ k < t` by auto }\n moreover\n { assume \"t = k\"\n hence \"\\ k = 0\"\n using * by auto\n hence \"derivative_hist_raw w t k = \\ k\"\n using `t = k` by (auto simp add: derivative_hist_raw_def zero_fun_def zero_option_def) }\n moreover\n { assume \"k = 0\"\n have \"t = 0 \\ 0 < t\" by auto\n moreover\n { assume \"t = 0\"\n hence \" derivative_hist_raw w t k = \\ k\"\n using * by (auto simp add: derivative_hist_raw_def zero_fun_def zero_option_def) }\n moreover\n { assume \"0 < t\"\n hence \" derivative_hist_raw w t k = difference_raw w 0\"\n unfolding `k = 0` by (auto simp add: derivative_hist_raw_def)\n also have \"... = \\ 0\"\n proof (rule ext)\n fix s\n have \"non_stuttering (to_trans_raw_sig \\) def s\"\n using assms(3) by auto\n obtain val where \" \\ 0 s = None \\ \\ 0 s = Some val\"\n by (meson not_None_eq)\n moreover\n { assume \"\\ 0 s = None\"\n have \"snd w s 0 = signal_of (def s) \\ s 0\"\n unfolding w_def worldline_raw_def using `0 < t` by auto\n also have \"... = def s\"\n using ` \\ 0 s = None` signal_of_empty by (metis signal_of_zero zero_option_def)\n finally have \"snd w s 0 = def s\"\n by auto\n hence \"difference_raw w 0 s = None\"\n unfolding difference_raw_def\n by (simp add: w_def worldline_raw_def)\n also have \"... = \\ 0 s\"\n using ` \\ 0 s = None` by auto\n finally have \"difference_raw w 0 s = \\ 0 s\"\n by auto }\n moreover\n { assume \"\\ 0 s = Some val\"\n hence \" (to_trans_raw_sig \\ s) 0 \\ None\"\n by (auto simp add: to_trans_raw_sig_def)\n have \"0 \\ keys (to_trans_raw_sig \\ s)\"\n using ` \\ 0 s = Some val`\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n hence \"keys (to_trans_raw_sig \\ s) \\ {}\"\n by auto\n hence \"val \\ def s\"\n using `non_stuttering (to_trans_raw_sig \\) def s`\n unfolding non_stuttering_def\n by (metis (full_types) Least_eq_0 \\0 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ s)\\ \\\\ 0\n s = Some val\\ option.sel to_trans_raw_sig_def)\n hence \"snd w s 0 = signal_of (def s) \\ s 0\"\n unfolding w_def worldline_raw_def using `0 < t` by auto\n also have \"... \\ def s\"\n using ` \\ 0 s = Some val` unfolding `val \\ def s`\n by (metis (mono_tags) \\val \\ def s\\ le_zero_eq signal_of_val_eq to_trans_raw_sig_def)\n finally have \"snd w s 0 \\ def s\"\n by auto\n hence \"difference_raw w 0 s = Some (snd w s 0)\"\n unfolding difference_raw_def\n by (simp add: w_def worldline_raw_def)\n also have \"... = Some (signal_of (def s) \\ s 0)\"\n unfolding w_def worldline_raw_def using \\0 < t\\ by auto\n also have \"... = \\ 0 s\"\n using `\\ 0 s = Some val`\n by (metis (mono_tags) leD order_refl signal_of_intro to_trans_raw_sig_def)\n finally have \"difference_raw w 0 s = \\ 0 s\"\n by auto }\n ultimately show \"difference_raw w 0 s = \\ 0 s\"\n by auto\n qed\n finally have \"(derivative_hist_raw w t) k = \\ k\"\n unfolding `k = 0` by auto }\n ultimately have \"(derivative_hist_raw w t) k = \\ k\"\n by auto }\n ultimately show \"(derivative_hist_raw w t) k = \\ k\"\n by auto\nqed\n\ntext \\Similar to @{thm \"derivative_is_history\"}, the derivative of a worldline constructed by the\nconstructor @{term \"worldline t \\ \\ \\\"} is exactly the transaction @{term \"\\\"} provided that the\ntransaction @{term \"\\\"} is non-stuttering with respect to the initial state @{term \"\\ :: 'a\nstate\"}.\\\n\nlemma derivative_raw_of_worldline:\n fixes \\ :: \"'a state\"\n fixes def \\\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n defines \"w \\ worldline_raw t \\ \\ def \\\"\n assumes \"\\s. non_stuttering (to_trans_raw_sig \\) \\ s\"\n shows \"derivative_raw w t = \\\"\nproof (cases \"\\ = 0\", rule_tac[!] ext)\n case True\n fix n\n have \"n \\ t \\ t < n\" by auto\n moreover\n { assume \"n \\ t\"\n hence \"derivative_raw w t n = \\ n\"\n unfolding derivative_raw_def using True by (auto simp add: zero_fun_def zero_option_def) }\n moreover\n { assume \"t < n\"\n hence \"derivative_raw w t n = difference_raw w n\"\n unfolding derivative_raw_def by auto\n { fix s\n have \"snd (worldline_raw t \\ \\ def \\) s n = signal_of (\\ s) \\ s n\"\n unfolding worldline_raw_def using `t < n` by auto\n also have \"... = \\ s\"\n unfolding True by (rule signal_of_empty)\n finally have \"snd (worldline_raw t \\ \\ def \\) s n = \\ s\"\n by auto }\n hence *: \"\\s. snd (worldline_raw t \\ \\ def \\) s n = \\ s\"\n by auto\n { fix s\n have \"snd (worldline_raw t \\ \\ def \\) s (n-1) = signal_of (\\ s) \\ s (n-1)\"\n unfolding worldline_raw_def using `t < n` by auto\n also have \"... = \\ s\"\n unfolding True by (rule signal_of_empty)\n finally have \"snd (worldline_raw t \\ \\ def \\) s (n-1) = \\ s\"\n by auto }\n hence \"\\s. snd (worldline_raw t \\ \\ def \\) s (n-1) = \\ s\"\n by auto\n with * have \"\\s. snd w s n = snd w s (n-1)\"\n unfolding w_def by auto\n hence \"difference_raw w n = Map.empty\"\n using `t < n` unfolding difference_raw_def by auto\n also have \"... = \\ n\"\n using True by (auto simp add: zero_fun_def zero_option_def)\n finally have \"derivative_raw w t n = \\ n\"\n using `derivative_raw w t n = difference_raw w n` by auto }\n ultimately show \"derivative_raw w t n = \\ n\"\n by auto\nnext\n case False\n fix x\n show \"derivative_raw w t x = \\ x \"\n using assms(3) nat_less_le\n by (simp add: derivative_raw_of_worldline_specific assms(1) w_def)\nqed\n\nlemma preempted_keys_subset_of:\n fixes dly t :: nat\n fixes sig :: \"'signal\"\n fixes \\ :: \"'signal trans_raw\"\n defines \"\\' \\ preempt_raw sig \\ (t + dly)\"\n shows \"k \\ keys (to_trans_raw_sig \\' sig) \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n unfolding \\'_def preempt_raw_def\nproof -\n assume \"k \\ Femto_VHDL_raw.keys (to_trans_raw_sig (\\t'. if t + dly \\ t' then (\\ t')(sig := None) else \\ t') sig)\"\n then have f1: \"(if t + dly \\ k then (\\ k)(sig := None) else \\ k) sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n then have \"\\ t + dly \\ k\"\n by force\n then show ?thesis\n using f1 by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\nqed\n\nlemma preempt_raw_preserves_non_stuttering:\n fixes dly t :: nat\n fixes sig :: \"'signal'\"\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ preempt_raw sig \\ (t + dly)\"\n shows \"non_stuttering (to_trans_raw_sig \\') \\ sig\"\nproof -\n { fix k1 k2\n assume \"k1 \\ keys (to_trans_raw_sig \\' sig)\" and \"k2 \\ keys (to_trans_raw_sig \\' sig)\"\n hence \"k1 \\ keys (to_trans_raw_sig \\ sig)\" and \"k2 \\ keys (to_trans_raw_sig \\ sig)\"\n by (simp add: \\'_def preempted_keys_subset_of)+\n have \"k2 < t + dly\"\n using `k2 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def to_trans_raw_sig_def preempt_raw_def\n keys_def using leI zero_option_def by fastforce\n assume \"k1 < k2\"\n assume \"\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig)\"\n have \"\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n proof (rule ccontr)\n assume \"\\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\ sig))\"\n then obtain k where \"k1 < k\" and \"k < k2\" and \"k \\ keys (to_trans_raw_sig \\ sig)\"\n by auto\n have \"k2 \\ t + dly\"\n using `k2 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def to_trans_raw_sig_def preempt_raw_def\n using \\k2 < t + dly\\ le_less by blast\n hence \"k < t + dly\"\n using `k < k2` by auto\n hence \"k \\ keys (to_trans_raw_sig \\' sig)\"\n using `k \\ keys (to_trans_raw_sig \\ sig)` unfolding \\'_def to_trans_raw_sig_def preempt_raw_def\n by (simp add: keys_def)\n thus False\n using `\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig)` `k1 sig k1 \\ to_trans_raw_sig \\ sig k2\"\n using assms(1) `k1 < k2` `k1 \\ keys (to_trans_raw_sig \\ sig)` `k2 \\ keys (to_trans_raw_sig \\ sig)`\n unfolding non_stuttering_def by auto\n moreover have \"to_trans_raw_sig \\ sig k2 = to_trans_raw_sig \\' sig k2\"\n using `k2 < t + dly` unfolding \\'_def to_trans_raw_sig_def preempt_raw_def by auto\n moreover have \"to_trans_raw_sig \\ sig k1 = to_trans_raw_sig \\' sig k1\"\n using `k1 < k2` `k2 < t + dly` unfolding \\'_def to_trans_raw_sig_def preempt_raw_def\n by auto\n ultimately have \"to_trans_raw_sig \\' sig k1 \\ to_trans_raw_sig \\' sig k2\"\n by auto }\n note first_po = this\n { assume *: \"keys (to_trans_raw_sig \\' sig) \\ {}\"\n hence \"keys (to_trans_raw_sig \\ sig) \\ {}\"\n unfolding \\'_def to_trans_raw_sig_def preempt_raw_def\n proof -\n have \"\\f n. (n::nat) \\ {n. f n \\ (0::bool option)} \\ None \\ f n\"\n using zero_option_def by auto\n then have \"\\n. \\ n sig \\ 0\"\n proof -\n have \"\\n. n \\ {n. to_trans_raw_sig \\' sig n \\ 0} \\ n \\ {n. to_trans_raw_sig \\ sig n \\ 0}\"\n by (metis \\'_def keys_def preempted_keys_subset_of)\n then have f1: \"\\n. to_trans_raw_sig \\' sig n = 0 \\ to_trans_raw_sig \\ sig n \\ 0\"\n by blast\n have \"\\n. to_trans_raw_sig \\' sig n \\ 0\"\n using \"*\" keys_def by fastforce\n then show ?thesis\n using f1 by (metis (lifting) to_trans_raw_sig_def)\n qed\n then show \"Femto_VHDL_raw.keys (\\n. \\ n sig) \\ {}\"\n by (simp add: keys_def)\n qed\n hence **: \"\\ sig \\ the (to_trans_raw_sig \\ sig (LEAST n. n \\ keys (to_trans_raw_sig \\ sig)))\"\n using assms(1) unfolding non_stuttering_def by auto\n have subset: \"keys (to_trans_raw_sig \\' sig) \\ keys (to_trans_raw_sig \\ sig)\"\n unfolding \\'_def preempt_raw_def to_trans_raw_sig_def keys_def\n by (simp add: Collect_mono zero_option_def)\n define least_key' where \"least_key' = (LEAST n. n \\ keys (to_trans_raw_sig \\' sig))\"\n have \"least_key' \\ keys (to_trans_raw_sig \\' sig)\"\n proof -\n have \"\\k. k \\ keys (to_trans_raw_sig \\' sig)\"\n using * by auto\n thus ?thesis\n by (metis LeastI_ex least_key'_def)\n qed\n have \"least_key' < t + dly\"\n proof (rule ccontr)\n assume \"\\ least_key' < t + dly\"\n hence \"t + dly \\ least_key'\" by auto\n hence \"\\' least_key' sig = None\"\n unfolding \\'_def preempt_raw_def by auto\n hence \"least_key' \\ keys (to_trans_raw_sig \\' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n with `least_key' \\ keys (to_trans_raw_sig \\' sig)` show False\n by auto\n qed\n have \"(LEAST n. n \\ keys (to_trans_raw_sig \\ sig)) = least_key'\"\n proof (rule Least_equality)\n show \"least_key' \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig)\"\n using `least_key' \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)` subset\n by auto\n next\n { fix y\n assume \"\\ least_key' \\ y\" hence \"y < least_key'\" by auto\n hence \"y \\ keys (to_trans_raw_sig \\' sig)\"\n unfolding least_key'_def using not_less_Least by blast\n have \"y < t + dly\"\n using `y < least_key'` `least_key' < t + dly` by auto\n hence \"y \\ keys (to_trans_raw_sig \\ sig)\"\n using `y \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def preempt_raw_def\n by (simp add: keys_def to_trans_raw_sig_def) }\n thus \"\\y. y \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig) \\ least_key' \\ y\"\n by auto\n qed\n hence \"\\ sig \\ the (to_trans_raw_sig \\' sig least_key')\"\n using ** `least_key' < t + dly`\n by (metis \\'_def not_le preempt_raw_def to_trans_raw_sig_def) }\n with first_po show ?thesis\n unfolding non_stuttering_def by auto\nqed\n\nlemma purge_trans_post_preserve_non_stuttering:\n fixes \\ sig t dly cur_val\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ purge_raw \\ t dly sig (\\ sig) cur_val\"\n defines \"\\'' \\ trans_post_raw sig cur_val (\\ sig) \\' t dly\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n shows \"non_stuttering (to_trans_raw_sig \\'') \\ sig\"\nproof (cases \"cur_val = \\ sig\")\n case False\n let ?s1 = \"signal_of (\\ sig) \\ sig t\"\n let ?s2 = \"signal_of (\\ sig) \\ sig (t + dly)\"\n let ?k2 = \"inf_time (to_trans_raw_sig \\) sig (t + dly)\"\n have \"(?s1 = cur_val \\ ?s2 \\ cur_val) \\ (?s1 \\ cur_val \\ ?s2 = cur_val)\"\n by auto\n moreover\n { assume \"?s1 = cur_val \\ ?s2 \\ cur_val\"\n hence lookup: \"\\' = override_on \\ (\\n. (\\ n)(sig := None)) {t <.. t + dly} \"\n unfolding \\'_def purge_raw_def by auto\n hence \"\\ t sig = None\"\n using assms(4) by (simp add: zero_fun_def zero_option_def)\n have \"post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n proof -\n have *: \"(\\i>t. i \\ t + (dly - 1) \\ \\' i sig = None)\"\n using lookup unfolding override_on_def by transfer' auto\n hence \"\\' t sig = None\"\n using lookup `\\ t sig = None` unfolding override_on_def by auto\n hence \"(\\i\\t. i \\ t + (dly - 1) \\ \\' i sig = None)\"\n using * using le_eq_less_or_eq by blast\n thus ?thesis\n using post_necessary_raw_correctness2 False\n by (metis \"*\" \\\\' t sig = None\\ \\'_def assms(4) leI order_refl purge_preserve_trans_removal_nonstrict)\n qed\n hence lookup2: \"\\'' = post_raw sig cur_val \\' (t + dly)\"\n unfolding \\''_def trans_post_raw_def by auto\n have *: \"\\k \\ keys (to_trans_raw_sig \\'' sig). k = t + dly\"\n proof\n fix k\n assume \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n have \"k \\ keys (to_trans_raw_sig \\' sig) \\ k = t + dly\"\n proof (rule ccontr)\n assume \"\\ (k \\ keys (to_trans_raw_sig \\' sig) \\ k = t + dly)\"\n hence \"k \\ keys (to_trans_raw_sig \\' sig)\" and \"k \\ t + dly\"\n by auto\n hence \"k < t + dly \\ k > t + dly\"\n by auto\n moreover\n { assume \"k > t + dly\"\n hence \"\\'' k sig = None\"\n unfolding lookup2 post_raw_def by auto\n hence \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n with `k \\ keys (to_trans_raw_sig \\'' sig)` have False\n by auto }\n moreover\n { assume \"k < t + dly\"\n hence \"\\'' k sig = \\' k sig\"\n unfolding lookup2 post_raw_def by auto\n also have \"... = None\"\n unfolding lookup using \\k < t + dly\\ assms(4)\n by (metis \\\\ (k \\ keys (to_trans_raw_sig \\' sig) \\ k = t + dly)\\ domIff dom_def keys_def\n lookup to_trans_raw_sig_def zero_option_def)\n finally have \"\\'' k sig = None\"\n by auto\n hence \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n with `k \\ keys (to_trans_raw_sig \\'' sig)` have False\n by auto }\n ultimately show False\n by auto\n qed\n moreover have \"k \\ keys (to_trans_raw_sig \\' sig)\"\n proof (rule ccontr)\n assume \"\\ k \\ keys (to_trans_raw_sig \\' sig)\"\n hence \"k \\ keys (to_trans_raw_sig \\' sig)\"\n by auto\n have \"k > t + dly\"\n proof (rule ccontr)\n assume \"\\ k > t + dly\"\n hence \"k \\ t + dly\"\n by auto\n hence \"\\' k sig = None\"\n unfolding lookup using assms(4)\n by (metis (mono_tags, lifting) One_nat_def \\\\ t sig = None\\ add.right_neutral\n fun_upd_same greaterThanAtMost_iff leI less_Suc_eq_le nat_add_left_cancel_le\n override_on_apply_in override_on_apply_notin zero_less_one)\n hence \"k \\ keys (to_trans_raw_sig \\' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n with `k \\ keys (to_trans_raw_sig \\' sig)` show False by auto\n qed\n hence \"\\'' k sig = None\"\n unfolding lookup2 post_raw_def by auto\n hence \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n with `k \\ keys (to_trans_raw_sig \\'' sig)` show False\n by auto\n qed\n ultimately show \"k = t + dly\"\n by auto\n qed\n have \"\\'' (t + dly) sig \\ None\"\n unfolding lookup2 post_raw_def by simp\n hence \"t + dly \\ keys (to_trans_raw_sig \\'' sig)\"\n by (metis domIff dom_def keys_def to_trans_raw_sig_def zero_option_def)\n { fix k1 k2 :: nat\n assume \"k1 < k2\"\n assume \"k1 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)\"\n assume \"k2 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)\"\n hence \"k1 = k2\"\n using `k1 \\ keys (to_trans_raw_sig \\'' sig)` using * by metis\n with `k1 < k2` have False by auto\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n hence first_po: \"(\\k1 k2.\n k1 < k2 \\\n k1 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig) \\\n k2 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)) \\\n to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2)\"\n by auto\n have \"Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig) \\ {}\"\n using \\t + dly \\ keys (to_trans_raw_sig \\'' sig)\\ by auto\n have \"(LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)) = t + dly\"\n unfolding * by (meson \"*\" LeastI \\t + dly \\ keys (to_trans_raw_sig \\'' sig)\\)\n hence \"the (to_trans_raw_sig \\'' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig))) = cur_val\"\n using * unfolding to_trans_raw_sig_def lookup2 post_raw_def by simp\n hence \" \\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)))\"\n using False by auto\n with first_po have ?thesis\n unfolding non_stuttering_def by auto }\n moreover\n { assume \"?s1 \\ (cur_val) \\ ?s2 = cur_val\"\n hence lookup: \"\\' = override_on \\ (\\n. (\\ n)(sig := None)) ({t <..< the ?k2} \\ {the ?k2 <.. t + dly}) \"\n unfolding \\'_def purge_raw_def Let_def by auto\n hence \"\\ t sig = None\"\n using assms(4) by (simp add: zero_fun_def zero_option_def)\n have \"?s1 \\ cur_val\" and \"?s2 = cur_val \"\n using`?s1 \\ cur_val \\ ?s2 = cur_val` by auto\n have *: \"\\n>t. n \\ t + dly \\ \\ n sig = Some cur_val\"\n using switch_signal_ex_mapping[of \"\\\", OF `?s1 \\ cur_val` `?s2 = cur_val`]\n assms(4) by (simp add: zero_fun_def)\n obtain time where \"?k2 = Some time \\ time \\ t + dly\"\n by (metis False \\signal_of (\\ sig) \\ sig t \\ cur_val \\ signal_of (\\ sig) \\ sig (t + dly)\n = cur_val\\ comp_def inf_time_at_most option.case_eq_if option.collapse to_signal_def)\n hence time_greatest: \"time = (GREATEST l. l \\ keys (to_trans_raw_sig \\ sig) \\ l \\ t + dly)\"\n by (simp add: inf_time_when_exist)\n have \"time \\ keys (to_trans_raw_sig \\ sig)\"\n using GreatestI_ex_nat[where P=\"\\x. x \\ keys (to_trans_raw_sig \\ sig) \\ x \\ t + dly\"] *\n by (meson \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\\n inf_time_some_exists)\n hence \"t < time\"\n using assms(4)\n by (metis domIff dom_def keys_def not_less to_trans_raw_sig_def zero_fun_def zero_option_def)\n have time_greatest': \"\\n > time. n < t + dly \\ \\ n sig = None\"\n unfolding time_greatest\n using Greatest_le_nat[where P=\"\\x. x \\ keys (to_trans_raw_sig \\ sig) \\ x \\ t + dly\" and b=\"t + dly\"]\n by (metis (mono_tags) domIff dom_def keys_def nat_le_linear not_le to_trans_raw_sig_def zero_option_def)\n have \"\\ time sig = Some cur_val\"\n proof (rule ccontr)\n assume \"\\ \\ time sig = Some cur_val\"\n hence \"\\ time sig \\ Some cur_val\"\n proof -\n have \"to_trans_raw_sig \\ sig time \\ 0\"\n using \\time \\ keys (to_trans_raw_sig \\ sig)\\ keys_def by blast\n then have \"\\ time sig \\ None\"\n by (simp add: to_trans_raw_sig_def zero_option_def)\n then show ?thesis\n using \\\\ time sig \\ Some cur_val\\ by force\n qed\n have \"inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time\"\n proof (intro inf_time_someI)\n show \"time \\ dom (to_trans_raw_sig \\ sig)\"\n by (metis \\time \\ keys (to_trans_raw_sig \\ sig)\\ dom_def keys_def zero_option_def)\n next\n show \"time \\ t + dly\"\n using \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\ by blast\n next\n show \"\\ta\\dom (to_trans_raw_sig \\ sig). ta \\ t + dly \\ ta \\ time\"\n using time_greatest'\n by (meson \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\\n inf_time_someE)\n qed\n hence \"?s2 \\ cur_val\"\n using \\\\ time sig \\ Some cur_val\\ unfolding to_signal_def comp_def\n by (metis \\time \\ keys (to_trans_raw_sig \\ sig)\\ domIff dom_def keys_def option.exhaust_sel\n option.simps(5) to_trans_raw_sig_def zero_option_def)\n with `?s2 = cur_val` show False by auto\n qed\n have not_nec: \"time < t + dly \\ \\ post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n proof -\n assume \"time < t + dly\"\n have \"(\\i\\t + (dly - 1). \\' i sig = Some cur_val \\ (\\j>i. j \\ t + (dly - 1) \\ \\' j sig = None))\"\n proof (intro exI[where x=\"time\"], intro conjI)\n show \"time \\ t + (dly - 1)\"\n using \\time < t + dly\\ by linarith\n next\n show \"\\' time sig = Some cur_val\"\n by (simp add: \\\\ time sig = Some cur_val\\ \\inf_time (to_trans_raw_sig \\) sig (t + dly) =\n Some time \\ time \\ t + dly\\ local.lookup)\n next\n show \"\\j>time. j \\ t + (dly - 1) \\ \\' j sig = None\"\n by (smt Suc_diff_1 \\t < time\\ \\time < t + dly\\ add_Suc_right fun_upd_triv le_imp_less_Suc\n less_add_same_cancel1 less_trans lookup override_on_apply_in override_on_apply_notin\n time_greatest')\n qed\n thus \"\\ post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n unfolding post_necessary_raw_correctness by auto\n qed\n have nec: \"time = t + dly \\ post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n proof -\n assume \"time = t + dly\"\n hence \"\\' = override_on \\ (\\n. (\\ n)(sig := None)) ({t <..< t + dly})\"\n unfolding lookup\n using \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\ by auto\n hence \"\\i\\t + (dly - 1). \\' i sig = None\"\n using assms(4)\n by (smt Suc_diff_1 \\\\ t sig = None\\ \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time\n \\ time \\ t + dly\\ \\t < time\\ \\time = t + dly\\ \\'_def add_Suc_right add_diff_cancel_left'\n add_diff_cancel_right' fun_upd_eqD fun_upd_triv greaterThanLessThan_iff le_diff_conv\n le_imp_less_Suc not_less override_on_apply_in purge_preserve_trans_removal_nonstrict\n zero_less_diff)\n hence \"(\\i\\t + (dly - 1). \\' i sig = None) \\ cur_val \\ \\ sig\"\n using False by blast\n thus \"post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n unfolding post_necessary_raw_correctness2 by auto\n qed\n have \"time < t + dly \\ time = t + dly\"\n using \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\\n le_neq_implies_less by blast\n moreover\n { assume \"time < t + dly\"\n hence \"\\ post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n using not_nec by auto\n hence \"\\'' = preempt_raw sig \\' (t + dly)\"\n unfolding \\''_def trans_post_raw_def by auto\n have *: \"\\k \\ keys (to_trans_raw_sig \\'' sig). k = the ?k2\"\n proof\n fix k\n assume \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n hence in_prime: \"k \\ keys (to_trans_raw_sig \\' sig)\"\n unfolding `\\'' = preempt_raw sig \\' (t + dly)` by (simp add: preempted_keys_subset_of)\n hence \"k \\ {t <..< the ?k2} \\ k \\ {the ?k2 <.. t + dly}\"\n unfolding lookup\n proof -\n assume \"k \\ keys (to_trans_raw_sig (override_on \\ (\\n. (\\ n)(sig := None)) ({t<..) sig (t + dly))} \\ {the (inf_time (to_trans_raw_sig \\) sig (t + dly))<..t + dly})) sig)\"\n then have \"override_on \\ (\\n. (\\ n)(sig := None)) ({t<..) sig (t + dly))} \\ {the (inf_time (to_trans_raw_sig \\) sig (t + dly))<..t + dly}) k sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n then show ?thesis\n by force\n qed\n have \"\\ k \\ t\"\n using `k \\ keys (to_trans_raw_sig \\' sig)` assms(4)\n by (metis \\'_def domIff dom_def keys_def purge_raw_before_now_unchanged\n to_trans_raw_sig_def zero_fun_def zero_option_def)\n hence \"k = the ?k2 \\ k \\ t + dly\"\n using \\k \\ {t<..) sig (t + dly))} \\ k \\ {the (inf_time\n (to_trans_raw_sig \\) sig (t + dly))<..t + dly}\\ by auto\n moreover have \"\\ k \\ t + dly\"\n using \\k \\ keys (to_trans_raw_sig \\'' sig)\\ unfolding `\\'' = preempt_raw sig \\' (t + dly)` preempt_raw_def\n proof -\n assume \"k \\ keys (to_trans_raw_sig (\\t'. if t + dly \\ t' then (\\' t')(sig := None) else \\' t') sig)\"\n then have \"(if t + dly \\ k then (\\' k)(sig := None) else \\' k) sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n then show ?thesis\n by force\n qed\n ultimately show \"k = the ?k2\"\n by auto\n qed\n { fix k1 k2 :: nat\n assume \"k1 < k2\"\n assume \"k1 \\ keys (to_trans_raw_sig \\'' sig)\" and \"k2 \\ keys (to_trans_raw_sig \\'' sig)\"\n hence \"k1 = k2\"\n using * by metis\n with `k1 < k2` have False by auto\n assume \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\"\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n using `False` by auto }\n hence first_po: \"(\\k1 k2.\n k1 < k2 \\ k1 \\ keys (to_trans_raw_sig \\'' sig) \\ k2 \\ keys (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig)) \\\n to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2)\"\n by auto\n have \"time \\ keys (to_trans_raw_sig \\' sig)\"\n proof -\n have \"\\' time sig = \\ time sig\"\n unfolding lookup using `time < t + dly` `t < time` `?k2 = Some time \\ time \\ t + dly`\n by auto\n with \\\\ time sig = Some cur_val\\ have \"\\' time sig \\ 0\"\n by (simp add: zero_option_def)\n thus ?thesis\n unfolding keys_def to_trans_raw_sig_def by auto\n qed\n moreover have \"\\'' time sig = \\' time sig\"\n unfolding `\\'' = preempt_raw sig \\' (t + dly)` preempt_raw_def\n using `time < t + dly` by auto\n ultimately have \"time \\ keys (to_trans_raw_sig \\'' sig)\"\n by (simp add: keys_def to_trans_raw_sig_def)\n hence \"keys (to_trans_raw_sig \\'' sig) \\ {}\"\n by (metis (full_types) domIff dom_def empty_iff keys_def to_trans_raw_sig_def\n zero_option_def)\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = time\"\n using * `?k2 = Some time \\ time \\ t + dly`\n by (simp add: Least_equality \\time \\ keys (to_trans_raw_sig \\'' sig)\\)\n moreover have \"\\' time sig = \\ time sig\"\n unfolding lookup\n by (simp add: \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\)\n ultimately have \" \\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n using False `\\'' time sig = \\' time sig` `\\ time sig = Some cur_val`\n by (metis option.sel to_trans_raw_sig_def)\n hence ?thesis\n using first_po unfolding non_stuttering_def by auto }\n moreover\n { assume \"time = t + dly\"\n hence \"post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n using nec by auto\n hence \\''_new_def: \"\\'' = post_raw sig cur_val \\' (t + dly)\"\n unfolding \\''_def trans_post_raw_def by auto\n have *: \"\\k \\ keys (to_trans_raw_sig \\'' sig). k = t + dly\"\n proof\n fix k\n assume k_in_keys: \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n have \"k \\ t + dly\"\n proof (rule ccontr)\n assume \"\\ k \\ t + dly\"\n hence \"t + dly < k\"\n by auto\n hence \"\\'' k sig = None\"\n unfolding \\''_new_def post_raw_def by auto\n hence \"k \\ keys (to_trans_raw_sig \\'' sig)\"\n unfolding to_trans_raw_sig_def by (simp add: keys_def zero_option_def)\n with k_in_keys show False\n by auto\n qed\n moreover have \"t < k\"\n proof (rule ccontr)\n assume \"\\ t < k\"\n hence \"k \\ t\"\n by auto\n hence \"\\'' k sig = \\' k sig\"\n unfolding \\''_new_def post_raw_def using \"*\" by auto\n also have \"... = \\ k sig\"\n unfolding lookup using `k \\ t`\n by (metis \\'_def local.lookup purge_raw_before_now_unchanged)\n also have \"... = None\"\n using assms(4) `k \\ t` using \\\\ t sig = None\\ by auto\n finally have \"\\'' k sig = None\"\n by auto\n with k_in_keys show False\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n qed\n ultimately show \"k = t + dly\"\n using k_in_keys unfolding \\''_new_def to_trans_raw_sig_def post_raw_def\n proof -\n assume a1: \"k \\ keys (\\n. (if n = t + dly then \\' n(sig \\ cur_val) else if t + dly < n then (\\' n)(sig := None) else \\' n) sig)\"\n assume a2: \"t < k\"\n have f3: \"(if k = t + dly then \\' k(sig \\ cur_val) else if t + dly < k then (\\' k)(sig := None) else \\' k) sig \\ 0\"\n using a1 by (simp add: keys_def)\n have f4: \"\\n. if n = t + dly then (if n = t + dly then \\' n(sig \\ cur_val) else if t + dly < n then (\\' n)(sig := None) else \\' n) sig = (\\' n(sig \\ cur_val)) sig else if t + dly < n then (if n = t + dly then \\' n(sig \\ cur_val) else if t + dly < n then (\\' n)(sig := None) else \\' n) sig = ((\\' n)(sig := None)) sig else (if n = t + dly then \\' n(sig \\ cur_val) else if t + dly < n then (\\' n)(sig := None) else \\' n) sig = \\' n sig\"\n by presburger\n { assume \"\\ t + dly < k\"\n moreover\n { assume \"(if k = t + dly then \\' k(sig \\ cur_val) else if t + dly < k then (\\' k)(sig := None) else \\' k) sig = \\' k sig\"\n have \"\\ k < t + dly\"\n using f3 a2 \\inf_time (to_trans_raw_sig \\) sig (t + dly) = Some time \\ time \\ t + dly\\ \\time = t + dly\\ local.lookup zero_option_def by auto\n then have ?thesis\n using \\k \\ t + dly\\ le_neq_implies_less by blast }\n ultimately have ?thesis\n using f4 by meson }\n then show ?thesis\n using f3 zero_option_def by fastforce\n qed\n qed\n { fix k1 k2 :: nat\n assume \"k1 < k2\"\n assume \"k1 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)\"\n assume \"k2 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)\"\n hence \"k1 = k2\"\n using `k1 \\ keys (to_trans_raw_sig \\'' sig)` * by metis\n with `k1 < k2` have False by auto\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n hence first_po: \"(\\k1 k2.\n k1 < k2 \\\n k1 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig) \\\n k2 \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)) \\\n to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2)\"\n by auto\n have \"keys (to_trans_raw_sig \\'' sig) \\ {}\"\n proof -\n have \"\\'' (t + dly) sig = Some cur_val\"\n unfolding \\''_new_def post_raw_def by auto\n thus ?thesis\n by (metis domIff dom_def empty_iff keys_def option.distinct(1) to_trans_raw_sig_def zero_option_def)\n qed\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly\"\n by (smt \"*\" Collect_empty_eq LeastI \\keys (to_trans_raw_sig \\'' sig) \\ {}\\ keys_def mem_Collect_eq)\n hence \"the (to_trans_raw_sig \\'' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig))) = cur_val\"\n unfolding \\''_new_def post_raw_def by (simp add: to_trans_raw_sig_def)\n hence \" \\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\'' sig)))\"\n using False by auto\n with first_po have ?thesis\n unfolding non_stuttering_def by auto }\n ultimately have ?thesis\n by auto }\n ultimately show ?thesis\n by auto\nnext\n case True\n let ?s1 = \"signal_of (\\ sig) \\ sig t\"\n let ?s2 = \"signal_of (\\ sig) \\ sig (t + dly)\"\n let ?k2 = \"inf_time (to_trans_raw_sig \\) sig (t + dly)\"\n have \"(?s1 = cur_val \\ ?s2 \\ cur_val) \\ (?s1 \\ cur_val \\ ?s2 = cur_val)\"\n by auto\n moreover\n { assume \"?s1 = cur_val \\ ?s2 \\ cur_val\"\n hence lookup: \"\\' = override_on \\ (\\n. (\\ n)(sig := None)) {t <.. t + dly} \"\n unfolding \\'_def purge_raw_def by auto\n have \"\\ t sig = None\"\n using assms(4) by (auto simp add: zero_fun_def zero_option_def)\n have \"\\n \\ t. \\ n = 0\"\n using assms(4) by (auto simp add: zero_option_def)\n have \"\\ post_necessary_raw (dly - 1) \\' t sig cur_val (\\ sig)\"\n proof -\n have *: \"(\\i. i \\ t + (dly - 1) \\ \\' i sig = None)\"\n using lookup unfolding override_on_def\n by (simp add: assms(4) not_less zero_fun_def zero_option_def)\n thus ?thesis\n using post_necessary_raw_correctness True\n by (metis assms(1) le_add2 not_add_less1 signal_of_intro)\n qed\n hence lookup2: \"\\'' = preempt_raw sig \\' (t + dly)\"\n unfolding \\''_def trans_post_raw_def by auto\n hence \"to_trans_raw_sig \\'' sig = 0\"\n using `\\n \\ t. \\ n = 0` `\\ t sig = None` lookup\n unfolding preempt_raw_def to_trans_raw_sig_def override_on_def zero_fun_def zero_option_def\n by (intro ext, simp)\n with True have ?thesis\n unfolding non_stuttering_def Let_def keys_def by (simp add: zero_fun_def) }\n moreover\n { assume \"?s1 \\ cur_val \\ ?s2 = cur_val\"\n have \"inf_time (to_trans_raw_sig \\) sig t = None\"\n unfolding sym[OF inf_time_none_iff] using assms(4)\n by (metis domIff not_less to_trans_raw_sig_def zero_fun_def zero_option_def)\n hence \"signal_of (\\ sig) \\ sig t = (\\ sig)\"\n unfolding to_signal_def comp_def by auto\n also have \"... = cur_val\"\n using True by auto\n finally have \"signal_of (\\ sig) \\ sig t = cur_val\"\n by auto\n with \\?s1 \\ cur_val \\ ?s2 = cur_val\\ have False\n by auto\n hence ?thesis\n by auto }\n ultimately show ?thesis\n by auto\nqed\n\nlemma purge'_trans_post_preserve_non_stuttering_bv:\n fixes \\ sig t dly cur_val b\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ purge_raw' \\ t dly sig (\\ sig) (Bv b)\"\n defines \"\\'' \\ trans_post_raw sig (Bv b) (\\ sig) \\' t dly\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n shows \"non_stuttering (to_trans_raw_sig \\'') \\ sig\"\n using purge_trans_post_preserve_non_stuttering assms\n unfolding purge_raw'_def by auto\n\n(* lemma signal_of_to_trans_raw_bit:\n assumes \"signal_of def \\ sig t = Lv sign bs\"\n shows \"signal_of (Bv (lval_of def ! b)) (to_trans_raw_bit def \\ b sig) sig t = Bv (bs ! b)\"\nproof -\n have \"signal_of (Bv (case def of Lv sign bs \\ bs ! b | Bv b' \\ b')) (to_trans_raw_bit def \\ b sig) sig t = Bv (bs ! b)\"\n using to_bit_signal_of' assms by (metis to_bit.simps(2)) \n thus ?thesis\n sledgehammer\n *)\n\n(* lemma keys_unchanged_to_trans_raw_bit:\n assumes \"\\k. k \\ keys (to_trans_raw_sig \\ sig) \\ (type_of o the) (\\ k sig) \\ Bty\"\n shows \"\\k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit def \\ b sig) sig) \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n using assms\n unfolding to_trans_raw_sig_def to_trans_raw_bit_def keys_def by (auto simp add: zero_fun_def zero_option_def split: option.splits val.splits)\n *)\n\nlemma purge'_trans_post_preserve_non_stuttering_lv:\n fixes \\ sig t dly cur_val sign bs\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)\"\n defines \"\\'' \\ trans_post_raw sig (Lv sign bs) (\\ sig) \\' t dly\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n shows \"non_stuttering (to_trans_raw_sig \\'') \\ sig\"\nproof -\n have 1: \"\\' = combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..'_def purge_raw'_def by auto\n have \"post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig) \\ \n \\ post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig)\"\n by auto\n moreover\n { assume \"post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig)\"\n hence 0: \"\\'' = post_raw sig (Lv sign bs) \\' (t + dly)\" and \"signal_of (\\ sig) \\' sig (t + (dly - 1)) \\ Lv sign bs\"\n unfolding \\''_def trans_post_raw_def by auto\n have ?thesis\n unfolding non_stuttering_def \n proof (rule, rule, rule, rule)\n fix k1 k2\n assume \"k1 < k2 \\ k1 \\ keys (to_trans_raw_sig \\'' sig) \\ k2 \\ keys (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\"\n hence \"k1 < k2\" and \"k1 \\ keys (to_trans_raw_sig \\'' sig)\" and \"k2 \\ keys (to_trans_raw_sig \\'' sig)\" and \n 2: \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\" by auto\n have \"k2 \\ t + dly\"\n proof (rule ccontr)\n assume \"\\ k2 \\ t + dly\" hence \"t + dly < k2\" by auto\n hence \"\\'' k2 sig = None\"\n using `\\'' = post_raw sig (Lv sign bs) \\' (t + dly)` unfolding post_raw_def by auto\n with `k2 \\ keys (to_trans_raw_sig \\'' sig)` show False \n unfolding to_trans_raw_sig_def keys_def zero_option_def by auto\n qed\n have \"k1 \\ keys (to_trans_raw_sig \\' sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\'' sig)` unfolding 0 post_raw_def to_trans_raw_sig_def keys_def zero_option_def\n using \\k1 < k2\\ \\k2 \\ t + dly\\ by auto\n have 3: \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig))\"\n using `k2 \\ t + dly` 0 2 `k1 < k2` unfolding post_raw_def \n by (metis domIff dom_def dual_order.asym keys_def less_le_trans to_trans_raw_sig_def zero_option_def)\n have \"k2 < t \\ k2 \\ t\"\n by auto\n moreover\n { assume \"k2 < t\"\n hence \"\\'' k2 sig = \\' k2 sig\"\n using 0 unfolding post_raw_def by auto\n also have \"... = \\ k2 sig\"\n using 1 `k2 < t` unfolding combine_trans_bit_def Let_def by auto\n finally have \"\\'' k2 sig = \\ k2 sig\"\n by auto\n hence \"False\"\n by (metis (full_types) \\k1 < k2 \\ k1 \\ keys (to_trans_raw_sig \\'' sig) \\ k2 \\ keys\n (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\\\n \\k2 < t\\ assms(4) domIff dom_def keys_def less_imp_le_nat to_trans_raw_sig_def\n zero_fun_def zero_option_def)\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n moreover\n { assume \"k2 \\ t\"\n have \"dly = 0 \\ dly \\ 0\"\n by auto\n moreover\n { assume \"dly = 0\"\n hence \"k2 = t\" \n using \\k2 \\ t + dly\\ \\t \\ k2\\ by linarith\n have \"k1 < t\"\n using `k1 < k2` `k2 = t` by auto\n hence \"\\'' k1 sig = \\' k1 sig\"\n using 0 unfolding post_raw_def by auto\n also have \"... = \\ k1 sig\"\n using `k1 < t` unfolding 1 combine_trans_bit_def Let_def by auto\n also have \"... = 0\"\n using `k1 < t` assms(4) by (auto simp add: zero_fun_def zero_option_def)\n finally have \"\\'' k1 sig = 0\"\n by auto\n hence \"k1 \\ keys (to_trans_raw_sig \\'' sig)\"\n unfolding to_trans_raw_sig_def keys_def by auto\n with `k1 \\ keys (to_trans_raw_sig \\'' sig)` have False\n by auto\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n moreover\n { assume \"dly \\ 0\"\n have \"k2 = t + dly \\ k2 < t + dly\"\n using `k2 \\ t + dly` by auto\n moreover\n { assume \"k2 = t + dly\"\n hence \"\\'' k2 sig = Some (Lv sign bs)\"\n unfolding 0 post_raw_def by auto\n have \"t < k1\"\n proof (rule ccontr)\n assume \"\\ t < k1\" hence \"k1 \\ t\" by auto\n hence \"\\'' k1 sig = \\' k1 sig\"\n using ` dly \\ 0` unfolding 0 post_raw_def by auto\n also have \"... = \\ k1 sig\"\n unfolding 1 combine_trans_bit_def using `k1 \\ t` by auto\n also have \"... = 0\"\n using assms(4) by (simp add: \\k1 \\ t\\ zero_fun_def)\n finally have \"\\'' k1 sig = 0\"\n by auto\n with `k1 \\ keys (to_trans_raw_sig \\'' sig)` show False\n by (simp add: keys_def to_trans_raw_sig_def)\n qed\n hence \"\\'' k1 sig = \\' k1 sig\"\n using `k1 < k2` `k2 = t + dly` unfolding 0 post_raw_def by auto\n have \"inf_time (to_trans_raw_sig \\') sig (t + (dly - 1)) = Some k1\"\n proof (rule inf_time_someI)\n show \"k1 \\ dom (to_trans_raw_sig \\' sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` by (simp add: dom_def keys_def zero_option_def)\n next\n show \"k1 \\ t + (dly - 1)\"\n using \\k1 < k2\\ \\k2 = t + dly\\ by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig \\' sig)\"\n assume \"k1 < ta\"\n assume \"ta \\ t + (dly - 1)\"\n have \"ta < k2\"\n using \\dly \\ 0\\ \\k2 = t + dly\\ \\ta \\ t + (dly - 1)\\ by linarith\n hence \"ta \\ keys (to_trans_raw_sig \\' sig)\"\n using 3 \\k1 < ta\\ by blast\n with `ta \\ dom (to_trans_raw_sig \\' sig)` have False\n by (simp add: dom_def keys_def zero_option_def) }\n thus \"\\ta\\dom (to_trans_raw_sig \\' sig). ta \\ t + (dly - 1) \\ ta \\ k1\"\n using leI by blast\n qed\n hence \"the (to_trans_raw_sig \\' sig k1) \\ Lv sign bs\"\n using `(signal_of (\\ sig) \\' sig (t + (dly - 1)) \\ Lv sign bs)`\n unfolding to_signal_def comp_def by auto\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by (metis \\\\'' k1 sig = \\' k1 sig\\ \\\\'' k2 sig = Some (Lv sign bs)\\ option.sel to_trans_raw_sig_def) }\n moreover\n { assume \"k2 < t + dly\"\n hence \"\\'' k2 sig = \\' k2 sig\"\n using 0 unfolding post_raw_def by auto\n have \"t < k2\"\n proof (rule ccontr)\n assume \"\\ t < k2\" hence \"k2 \\ t\" by auto\n hence \"\\' k2 sig = \\ k2 sig\"\n unfolding 1 combine_trans_bit_def by auto\n also have \"... = 0\"\n using assms by (simp add: \\k2 \\ t\\ zero_fun_def)\n finally have \"\\'' k2 sig = 0\"\n by (simp add: \\\\'' k2 sig = \\' k2 sig\\)\n with `k2 \\ keys (to_trans_raw_sig \\'' sig)` show False\n by (simp add: keys_def to_trans_raw_sig_def)\n qed\n hence \"k2 \\ keys (to_trans_raw_sig \\' sig)\"\n using `k2 \\ keys (to_trans_raw_sig \\'' sig)` \n by (simp add: \\\\'' k2 sig = \\' k2 sig\\ keys_def to_trans_raw_sig_def)\n hence \"\\' k2 sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n hence k2inset: \"k2 \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..' k2 sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..k2 < t + dly\\ \\t < k2\\ by auto\n hence 4: \"(lval_of o the) (\\' k2 sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' k2 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' k2 sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n unfolding ** using \\b \\ set [0.. \n by (simp add: val.case_eq_if)\n thus \"(lval_of \\ the) (\\' k2 sig) ! b = bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n using 4 by auto\n qed\n have helper: \"\\f. length (map f [0.. length bs - 0\"\n by auto\n have \"k2 \\ fold (\\) (map keys\n (map (\\\\. to_trans_raw_sig \\ sig)\n (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. fold (\\)\n (map (\\x. keys\n (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ x sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! x)) (Bv (bs ! x))) sig))\n [0.. set [0..< length bs]\" and \"k2 \\ keys (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig)\"\n using member_fold_union[OF helper2] by auto\n hence purge_neq: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k2 sig \\ 0\"\n unfolding keys_def to_trans_raw_sig_def by auto\n have the_time: \"Some k2 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b2 sig)) sig (t + dly)\" and \n sig_neq: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t \\ Bv (bs ! b2)\" and \n sig_eq: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig (t + dly) = Bv (bs ! b2)\"\n using `t < k2` `k2 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k2` `k2 < t + dly`] \n by auto\n moreover hence \"to_trans_raw_bit (\\ sig) \\ b2 sig k2 sig = Some (Bv (bs ! b2))\"\n unfolding to_signal_def comp_def to_trans_raw_sig_def \n by (smt inf_time_some_exists keys_def mem_Collect_eq not_None_eq option.sel\n option.simps(5) zero_option_def)\n ultimately have \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k2 sig = Some (Bv (bs ! b2))\"\n using `t < k2` `k2 < t + dly` unfolding purge_raw_def Let_def \n by (smt \"3\" UnE \\k1 < k2\\ \\k2 \\ keys (to_trans_raw_sig \\' sig)\\ greaterThanAtMost_iff greaterThanLessThan_iff option.sel override_on_apply_notin)\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k2 = Bv (bs ! b2)\"\n using trans_some_signal_of' by (metis o_apply option.sel )\n hence \"(lval_of o the) (\\' k2 sig) ! b2 = bs ! b2\"\n using 5[OF `b2 \\ set [0..< length bs]`] by auto\n\n have \"k1 < t + dly\"\n using `k1 < k2` `k2 < t + dly` by auto\n have \"t < k1\"\n proof (rule ccontr)\n assume \"\\ t < k1\" hence \"k1 \\ t\" by auto\n hence \"\\' k1 sig = \\ k1 sig\"\n unfolding 1 combine_trans_bit_def by auto\n also have \"... = 0\"\n using assms by (simp add: \\k1 \\ t\\ zero_fun_def)\n finally have \"\\' k1 sig = 0\"\n by (simp)\n with `k1 \\ keys (to_trans_raw_sig \\' sig)` show False\n by (simp add: keys_def to_trans_raw_sig_def)\n qed\n have \"\\' k1 sig \\ None\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` \n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n hence k1inset: \"k1 \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\) (map keys\n (map (\\\\. to_trans_raw_sig \\ sig)\n (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. fold (\\)\n (map (\\x. keys\n (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ x sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! x)) (Bv (bs ! x))) sig))\n [0.. set [0..< length bs]\" and \"k1 \\ keys (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ b1 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (Bv (bs ! b1))) sig)\"\n using member_fold_union[OF k1inset'] by auto \n hence purge_neq: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b1 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (Bv (bs ! b1)) k1 sig \\ 0\"\n unfolding keys_def to_trans_raw_sig_def by auto\n have \"Some k1 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b1 sig)) sig (t + dly)\" and \n \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig t \\ Bv (bs ! b1)\" and \n \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig (t + dly) = Bv (bs ! b1)\"\n using `t < k1` `k1 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k1` `k1 < t + dly`] \n by auto\n have \"Some k1 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b1 sig)) sig (t + dly)\" and \n \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig t \\ Bv (bs ! b1)\" and \n \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig (t + dly) = Bv (bs ! b1)\"\n using `t < k1` `k1 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k1` `k1 < t + dly`] \n by auto\n hence \"\\' k1 sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..k1 < t + dly\\ \\t < k1\\ k1inset by auto\n hence 5: \"(lval_of o the) (\\' k1 sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' k1 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' k1 sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n unfolding **\n using \\b \\ set [0.. by (simp add: val.case_eq_if)\n thus \"(lval_of \\ the) (\\' k1 sig) ! b = bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n using 5 by auto\n qed\n \n have \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k1 sig = None\"\n using `t < k1` `k1 < k2` sig_neq sig_eq the_time unfolding purge_raw_def Let_def\n by (smt Un_iff fun_upd_eqD fun_upd_triv greaterThanLessThan_iff option.sel override_on_apply_in)\n have 7: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k1 = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig t\"\n proof (intro signal_of_less_ind')\n fix n\n assume \"t < n\" and \"n \\ k1\"\n thus \" purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) n sig = 0\"\n using `k1 < k2` sig_neq sig_eq the_time unfolding purge_raw_def Let_def\n apply (auto simp add: override_on_def to_trans_raw_bit_def zero_option_def zero_fun_def split: option.splits val.splits intro!: ext)\n apply (metis linorder_neqE_nat not_le option.sel)\n using \\k2 \\ t + dly\\ apply linarith\n apply (metis le_less_trans option.sel)\n using \\k1 < t + dly\\ by linarith\n next\n show \"t \\ k1\"\n using `t < k1` by auto\n qed \n also have \"... = signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t \"\n proof (rule signal_of_equal_when_trans_equal_upto)\n fix n \n assume \"n \\ t\"\n thus \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) n = to_trans_raw_bit (\\ sig) \\ b2 sig n\"\n unfolding purge_raw_def Let_def override_on_def \n by (smt Un_iff \\t \\ k2\\ greaterThanAtMost_iff greaterThanLessThan_iff leD less_le_trans option.sel the_time)\n qed (auto)\n also have \"... \\ Bv (bs ! b2)\"\n using sig_neq by auto\n finally have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k1 \\ Bv (bs ! b2)\"\n by auto\n moreover have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t = (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2))\"\n apply (rule signal_of_def)\n using assms(4)\n unfolding to_trans_raw_bit_def by (simp add: zero_fun_def zero_option_def)\n ultimately have \"(lval_of o the) (\\' k1 sig) ! b2 \\ bs ! b2\"\n using 6[OF `b2 \\ set [0 ..< length bs]`] \n using \"7\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig t = signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t\\ by auto\n with `(lval_of o the) (\\' k2 sig) ! b2 = bs ! b2` have \"\\' k1 sig \\ \\' k2 sig\"\n by auto\n moreover have \"\\'' k1 sig = \\' k1 sig\"\n using 0 `t < k1` `k1 < t + dly` unfolding post_raw_def by auto\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n using `\\'' k2 sig = \\' k2 sig` unfolding to_trans_raw_sig_def by auto }\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n ultimately show \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto \n next\n have \"t + dly \\ keys (to_trans_raw_sig \\'' sig)\"\n unfolding 0 post_raw_def to_trans_raw_sig_def keys_def by (auto simp add: zero_fun_def zero_option_def)\n hence \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ t + dly\"\n using Least_le by (simp add: Least_le)\n hence \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) < t + dly\"\n by auto\n moreover\n { assume \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly\"\n hence \"(to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))) = Some (Lv sign bs)\"\n using 0 unfolding post_raw_def by (simp add: to_trans_raw_sig_def)\n have \"\\n. n < t + dly \\ to_trans_raw_sig \\'' sig n = 0\"\n using `(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly`\n not_less_Least unfolding 0 post_raw_def by (smt keys_def mem_Collect_eq)\n have \"0 < dly \\ dly = 0\"\n by auto\n moreover \n { assume \"0 < dly\"\n have \"signal_of (\\ sig) \\' sig (t + (dly - 1)) = \\ sig\"\n apply (intro signal_of_def)\n using `\\n. n < t + dly \\ to_trans_raw_sig \\'' sig n = 0` \n unfolding to_trans_raw_sig_def 0 post_raw_def \n proof -\n fix n :: nat\n assume a1: \"n \\ t + (dly - 1)\"\n assume a2: \"\\n. n < t + dly \\ (if n = t + dly then \\' n(sig \\ Lv sign bs) else if t + dly < n then (\\' n)(sig := None) else \\' n) sig = 0\"\n have \"Suc 0 \\ dly\"\n by (metis (no_types) Suc_leI \\0 < dly\\)\n then show \"\\' n sig = 0\"\n using a2 a1 by simp\n qed\n hence \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n using \\post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig)\\ \\to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Lv sign bs)\\ by auto }\n moreover\n { assume \"dly = 0\"\n hence \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t\"\n using `(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly` by auto\n have \"to_trans_raw_sig \\'' sig t = Some (Lv sign bs)\"\n unfolding 0 \n using \"0\" \\(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = t + dly\\ \\dly = 0\\\n \\to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Lv sign\n bs)\\ by auto\n have \"signal_of (\\ sig) \\' sig (t + (dly - 1)) = signal_of (\\ sig) \\' sig t\"\n using `dly = 0` by auto\n also have \"... = \\ sig\"\n using assms(4) \n by (metis \\'_def purge_preserve_trans_removal_nonstrict' signal_of_def zero_fun_def)\n finally have \"signal_of (\\ sig) \\' sig (t + (dly - 1)) = \\ sig\"\n by auto\n hence \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n using \\post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig)\\ \\to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Lv sign bs)\\ by auto }\n ultimately have \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n by auto }\n moreover\n { assume lt: \" (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) < t + dly\"\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ keys (to_trans_raw_sig \\'' sig)\"\n using LeastI by (metis \\t + dly \\ keys (to_trans_raw_sig \\'' sig)\\) \n hence \"to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ 0\"\n unfolding keys_def by auto\n with lt have \"\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig \\ 0\"\n unfolding 0 post_raw_def to_trans_raw_sig_def by auto\n have \"t < (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))\"\n proof (rule ccontr)\n assume \"\\ t < (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))\"\n hence \" (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ t\"\n by auto\n hence \"\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = 0\"\n using assms(4)\n unfolding 1 combine_trans_bit_def Let_def by (auto simp add :zero_fun_def)\n with `\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig \\ 0`\n show False\n unfolding to_trans_raw_sig_def by auto\n qed\n hence \"\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\"\n using lt unfolding 0 post_raw_def by auto\n let ?t = \"LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)\"\n have **: \"?t \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..' ?t sig \\ 0` `t < ?t` `?t < t + dly` unfolding 1 combine_trans_bit_def\n using not_le zero_option_def by fastforce\n hence \"?t \\ fold (\\) (map keys (map (\\\\. to_trans_raw_sig \\ sig) \n (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\) (map (keys \\ ((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))))) [0..x\\set (map (keys \\ ((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))))) [0.. x)\"\n using member_fold_union[OF *] unfolding empty_iff by auto\n then obtain b where \"?t \\ keys (((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))) b)\" and \n \"b \\ set [0..< length bs]\" by auto\n hence \"?t \\ keys (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) n sig)\"\n unfolding comp_def to_trans_raw_sig_def by auto\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig \\ 0\"\n unfolding keys_def by auto\n from purge_raw_neq_0_imp[OF this `t < ?t` `?t < t + dly`]\n have inf_time: \" inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some ?t\"\n and sig_neq: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \"\n and sig_eq: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\" \n by auto\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig = \n to_trans_raw_bit (\\ sig) \\ b sig ?t sig\"\n using `t < ?t` `?t < t + dly` unfolding purge_raw_def Let_def by auto\n also have \"... = Some (Bv (bs ! b))\"\n using sig_eq inf_time unfolding to_signal_def comp_def \n by (metis (mono_tags, lifting) \\purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\\n sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) (LEAST k. k \\ keys (to_trans_raw_sig\n \\'' sig)) sig \\ 0\\ calculation option.collapse option.simps(5) to_trans_raw_sig_def\n zero_option_def)\n finally have ***: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig = Some (Bv (bs ! b))\"\n by auto\n have \"\\' ?t sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..?t < t + dly\\ \\t < ?t\\ by auto\n hence 4: \"(lval_of o the) (\\' ?t sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' ?t sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' ?t sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using \\b \\ set [0.. unfolding ** by (simp add: val.case_eq_if)\n thus \"(lval_of \\ the) (\\' ?t sig) ! b = bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using 4 by auto\n qed\n hence h: \"(lval_of o the) (\\' ?t sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using `b \\ set [0..< length bs]` by auto\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t = Bv (bs ! b)\"\n proof (rule signal_of_intro, rule, rule)\n show \"?t \\ ?t\" by auto\n next\n have \"to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig \n (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Bv (bs ! b))\"\n using *** unfolding to_trans_raw_sig_def by auto\n moreover have \"(\\j>LEAST k. k \\ keys (to_trans_raw_sig \\'' sig).\n j \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig j = None)\"\n by auto\n ultimately show \" to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Bv (bs ! b)) \\\n (\\j>LEAST k. k \\ keys (to_trans_raw_sig \\'' sig).\n j \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig j = None) \\\n (\\i\\LEAST k. k \\ keys (to_trans_raw_sig \\'' sig). purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) i sig = None) \\\n Bv (bs ! b) = (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b))\"\n by auto\n qed\n hence \"bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t) = bs ! b\"\n by auto\n hence \"(lval_of o the) (\\' ?t sig) ! b = bs ! b\"\n using h by auto\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t = (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b))\"\n apply (intro signal_of_def)\n using assms(4) unfolding to_trans_raw_bit_def by (simp add: zero_fun_def zero_option_def)\n hence \" (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b) \\ bs ! b\"\n using sig_neq by auto\n hence \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n using \\(lval_of \\ the) (\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig) ! b =\n bs ! b\\ \\\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys\n (to_trans_raw_sig \\'' sig)) sig\\ comp_apply to_trans_raw_sig_def \n apply auto\n subgoal \n proof -\n assume a1: \"\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\"\n assume a2: \"\\ sig = the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n assume a3: \"case the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))) of Bv b \\ b | Lv sign bs \\ bs ! b\"\n assume a4: \"\\ lval_of (the (\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig)) ! b\"\n have \"Some (Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) (Bv (bs ! n))) [0..'' sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig))\"\n using a1 by (metis (no_types) \\\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = Some (Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. to_trans_raw_sig_def)\n then have f5: \"Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) (Bv (bs ! n))) [0.. sig\"\n using a2 by (metis (no_types, lifting) option.sel)\n then have \"map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) (Bv (bs ! n))) [0.. sig)\"\n by (metis (no_types, lifting) val.sel(3))\n then have \"Lv sign (lval_of (\\ sig)) = \\ sig\"\n using f5 by presburger\n then show False\n using a4 a3 a2 a1 by (metis to_trans_raw_sig_def val.case(2))\n qed\n subgoal\n proof -\n assume a1: \"\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\"\n assume a2: \"\\ sig = the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n assume \"\\ (case the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))) of Bv b \\ b | Lv sign bs \\ bs ! b)\"\n assume a3: \"bs ! b\"\n have \"Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) (Bv (bs ! n))) [0.. sig\"\n using a2 a1 by (metis (lifting) \\\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = Some (Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. option.sel to_trans_raw_sig_def)\n then have \"Lv sign ((lval_of \\ the) (\\' (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)) sig)) = \\ sig\"\n by (metis (lifting) \"4\") \n then show False\n using a3 \n by (metis \\(lval_of \\ the) (\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig) ! b = bs ! b\\ \\\\ (case the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))) of Bv b \\ b | Lv sign bs \\ bs ! b)\\ a2 val.simps(6))\n qed\n done }\n ultimately have \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n by auto\n thus \"keys (to_trans_raw_sig \\'' sig) \\ {} \\ \\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n by auto\n qed }\n moreover\n { assume \"\\ post_necessary_raw (dly - 1) \\' t sig (Lv sign bs) (\\ sig)\"\n hence 0: \"\\'' = preempt_raw sig \\' (t + dly)\"\n unfolding \\''_def trans_post_raw_def by auto\n have ?thesis\n unfolding non_stuttering_def\n proof (rule, rule, rule, rule)\n fix k1 k2\n assume \"k1 < k2 \\ k1 \\ keys (to_trans_raw_sig \\'' sig) \\ k2 \\ keys (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\"\n hence \"k1 < k2\" and \"k1 \\ keys (to_trans_raw_sig \\'' sig)\" and \"k2 \\ keys (to_trans_raw_sig \\'' sig)\" and \n 2: \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\" by auto\n have \"k2 \\ t + dly\"\n proof (rule ccontr)\n assume \"\\ k2 \\ t + dly\" hence \"t + dly < k2\" by auto\n hence \"\\'' k2 sig = None\"\n using `\\'' = preempt_raw sig \\' (t + dly)` unfolding preempt_raw_def by auto\n with `k2 \\ keys (to_trans_raw_sig \\'' sig)` show False \n unfolding to_trans_raw_sig_def keys_def zero_option_def by auto\n qed\n have \"k1 \\ keys (to_trans_raw_sig \\' sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\'' sig)` unfolding 0 preempt_raw_def to_trans_raw_sig_def keys_def zero_option_def\n using \\k1 < k2\\ \\k2 \\ t + dly\\ by auto\n have 3: \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig))\"\n using `k2 \\ t + dly` 0 2 `k1 < k2` unfolding preempt_raw_def \n by (metis domIff dom_def dual_order.asym keys_def less_le_trans to_trans_raw_sig_def zero_option_def)\n have \"k2 < t \\ k2 \\ t\"\n by auto\n moreover\n { assume \"k2 < t\"\n hence \"\\'' k2 sig = \\' k2 sig\"\n using 0 unfolding preempt_raw_def by auto\n also have \"... = \\ k2 sig\"\n using 1 `k2 < t` unfolding combine_trans_bit_def Let_def by auto\n finally have \"\\'' k2 sig = \\ k2 sig\"\n by auto\n hence \"False\"\n by (metis (full_types) \\k1 < k2 \\ k1 \\ keys (to_trans_raw_sig \\'' sig) \\ k2 \\ keys\n (to_trans_raw_sig \\'' sig) \\ (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\'' sig))\\\n \\k2 < t\\ assms(4) domIff dom_def keys_def less_imp_le_nat to_trans_raw_sig_def\n zero_fun_def zero_option_def)\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n moreover\n { assume \"k2 \\ t\"\n have \"dly = 0 \\ dly \\ 0\"\n by auto\n moreover\n { assume \"dly = 0\"\n hence \"k2 = t\" \n using \\k2 \\ t + dly\\ \\t \\ k2\\ by linarith\n have \"k1 < t\"\n using `k1 < k2` `k2 = t` by auto\n hence \"\\'' k1 sig = \\' k1 sig\"\n using 0 unfolding preempt_raw_def by auto\n also have \"... = \\ k1 sig\"\n using `k1 < t` unfolding 1 combine_trans_bit_def Let_def by auto\n also have \"... = 0\"\n using `k1 < t` assms(4) by (auto simp add: zero_fun_def zero_option_def)\n finally have \"\\'' k1 sig = 0\"\n by auto\n hence \"k1 \\ keys (to_trans_raw_sig \\'' sig)\"\n unfolding to_trans_raw_sig_def keys_def by auto\n with `k1 \\ keys (to_trans_raw_sig \\'' sig)` have False\n by auto\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n moreover\n { assume \"dly \\ 0\"\n have \"k2 = t + dly \\ k2 < t + dly\"\n using `k2 \\ t + dly` by auto\n moreover\n { assume \"k2 = t + dly\"\n hence \"\\'' k2 sig = None\"\n unfolding 0 preempt_raw_def by auto\n hence False \n using `k2 \\ keys (to_trans_raw_sig \\'' sig)` unfolding keys_def to_trans_raw_sig_def\n by (simp add: zero_option_def)\n hence \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n moreover\n { assume \"k2 < t + dly\"\n hence \"\\'' k2 sig = \\' k2 sig\"\n using 0 unfolding preempt_raw_def by auto\n have \"t < k2\"\n proof (rule ccontr)\n assume \"\\ t < k2\" hence \"k2 \\ t\" by auto\n hence \"\\' k2 sig = \\ k2 sig\"\n unfolding 1 combine_trans_bit_def by auto\n also have \"... = 0\"\n using assms by (simp add: \\k2 \\ t\\ zero_fun_def)\n finally have \"\\'' k2 sig = 0\"\n by (simp add: \\\\'' k2 sig = \\' k2 sig\\)\n with `k2 \\ keys (to_trans_raw_sig \\'' sig)` show False\n by (simp add: keys_def to_trans_raw_sig_def)\n qed\n hence \"k2 \\ keys (to_trans_raw_sig \\' sig)\"\n using `k2 \\ keys (to_trans_raw_sig \\'' sig)` \n by (simp add: \\\\'' k2 sig = \\' k2 sig\\ keys_def to_trans_raw_sig_def)\n hence \"\\' k2 sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n hence k2inset: \"k2 \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..' k2 sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..k2 < t + dly\\ \\t < k2\\ by auto\n hence 4: \"(lval_of o the) (\\' k2 sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' k2 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' k2 sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k2))\n (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n using \\b \\ set [0.. unfolding ** \n by (simp add: nth_map val.case_eq_if)\n thus \"(lval_of o the) (\\' k2 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k2)\"\n using 4 by auto\n qed\n have helper: \"\\f. length (map f [0.. length bs - 0\"\n by auto\n have \"k2 \\ fold (\\) (map keys\n (map (\\\\. to_trans_raw_sig \\ sig)\n (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. fold (\\)\n (map (\\x. keys\n (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ x sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! x)) (Bv (bs ! x))) sig))\n [0.. set [0..< length bs]\" and \"k2 \\ keys (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig)\"\n using member_fold_union[OF helper2] by auto\n hence purge_neq: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k2 sig \\ 0\"\n unfolding keys_def to_trans_raw_sig_def by auto\n have the_time: \"Some k2 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b2 sig)) sig (t + dly)\" and \n sig_neq: \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t \\ Bv (bs ! b2)\" and \n sig_eq: \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig (t + dly) = Bv (bs ! b2)\"\n using `t < k2` `k2 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k2` `k2 < t + dly`] \n by auto\n moreover hence \"to_trans_raw_bit (\\ sig) \\ b2 sig k2 sig = Some (Bv (bs ! b2))\"\n unfolding to_signal_def comp_def to_trans_raw_sig_def \n by (smt inf_time_some_exists keys_def mem_Collect_eq not_None_eq option.sel\n option.simps(5) zero_option_def)\n ultimately have \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k2 sig = Some (Bv (bs ! b2))\"\n using `t < k2` `k2 < t + dly` unfolding purge_raw_def Let_def \n by (smt \"3\" UnE \\k1 < k2\\ \\k2 \\ keys (to_trans_raw_sig \\' sig)\\ greaterThanAtMost_iff greaterThanLessThan_iff option.sel override_on_apply_notin)\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k2 = Bv (bs ! b2)\"\n using trans_some_signal_of' by (metis o_apply option.sel )\n hence \"(lval_of o the) (\\' k2 sig) ! b2 = bs ! b2\"\n using 5[OF `b2 \\ set [0..< length bs]`] by auto\n\n have \"k1 < t + dly\"\n using `k1 < k2` `k2 < t + dly` by auto\n have \"t < k1\"\n proof (rule ccontr)\n assume \"\\ t < k1\" hence \"k1 \\ t\" by auto\n hence \"\\' k1 sig = \\ k1 sig\"\n unfolding 1 combine_trans_bit_def by auto\n also have \"... = 0\"\n using assms by (simp add: \\k1 \\ t\\ zero_fun_def)\n finally have \"\\' k1 sig = 0\"\n by (simp)\n with `k1 \\ keys (to_trans_raw_sig \\' sig)` show False\n by (simp add: keys_def to_trans_raw_sig_def)\n qed\n have \"\\' k1 sig \\ None\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` \n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n hence k1inset: \"k1 \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\) (map keys\n (map (\\\\. to_trans_raw_sig \\ sig)\n (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. fold (\\)\n (map (\\x. keys\n (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ x sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! x)) (Bv (bs ! x))) sig))\n [0.. set [0..< length bs]\" and \"k1 \\ keys (to_trans_raw_sig\n (purge_raw (to_trans_raw_bit (\\ sig) \\ b1 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (Bv (bs ! b1))) sig)\"\n using member_fold_union[OF k1inset'] by auto \n hence purge_neq: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b1 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (Bv (bs ! b1)) k1 sig \\ 0\"\n unfolding keys_def to_trans_raw_sig_def by auto\n have \"Some k1 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b1 sig)) sig (t + dly)\" and \n \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig t \\ Bv (bs ! b1)\" and \n \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig (t + dly) = Bv (bs ! b1)\"\n using `t < k1` `k1 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k1` `k1 < t + dly`] \n by auto\n have \"Some k1 = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b1 sig)) sig (t + dly)\" and \n \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig t \\ Bv (bs ! b1)\" and \n \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b1)) (to_trans_raw_bit (\\ sig) \\ b1 sig) sig (t + dly) = Bv (bs ! b1)\"\n using `t < k1` `k1 < t + dly` purge_raw_neq_0_imp[OF purge_neq `t < k1` `k1 < t + dly`] \n by auto\n hence \"\\' k1 sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..k1 < t + dly\\ \\t < k1\\ k1inset by auto\n hence 5: \"(lval_of o the) (\\' k1 sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' k1 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' k1 sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig k1))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n using \\b \\ set [0.. unfolding ** by (simp add: val.case_eq_if)\n thus \"(lval_of o the) (\\' k1 sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig k1)\"\n using 5 by auto\n qed\n \n have \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) k1 sig = None\"\n using `t < k1` `k1 < k2` sig_neq sig_eq the_time unfolding purge_raw_def Let_def\n by (smt Un_iff fun_upd_eqD fun_upd_triv greaterThanLessThan_iff option.sel override_on_apply_in)\n have 7: \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k1 = \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig t\"\n proof (intro signal_of_less_ind')\n fix n\n assume \"t < n\" and \"n \\ k1\"\n thus \" purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) n sig = 0\"\n using `k1 < k2` sig_neq sig_eq the_time unfolding purge_raw_def Let_def\n apply (auto simp add: override_on_def to_trans_raw_bit_def zero_option_def zero_fun_def split: option.splits val.splits intro!: ext)\n apply (metis linorder_neqE_nat not_le option.sel)\n using \\k1 < t + dly\\ apply linarith\n apply (metis le_less_trans option.sel)\n using \\k1 < t + dly\\ by linarith\n next\n show \"t \\ k1\"\n using `t < k1` by auto\n qed \n also have \"... = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t \"\n proof (rule signal_of_equal_when_trans_equal_upto)\n fix n \n assume \"n \\ t\"\n thus \"purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2)) n = to_trans_raw_bit (\\ sig) \\ b2 sig n\"\n unfolding purge_raw_def Let_def override_on_def \n by (smt Un_iff \\t \\ k2\\ greaterThanAtMost_iff greaterThanLessThan_iff leD less_le_trans option.sel the_time)\n qed (auto)\n also have \"... \\ Bv (bs ! b2)\"\n using sig_neq by auto\n finally have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (Bv (bs ! b2))) sig k1 \\ Bv (bs ! b2)\"\n by auto\n moreover have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t = (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2))\"\n apply (rule signal_of_def)\n using assms(4)\n unfolding to_trans_raw_bit_def by (simp add: zero_fun_def zero_option_def)\n ultimately have \"(lval_of o the) (\\' k1 sig) ! b2 \\ bs ! b2\"\n using 6[OF `b2 \\ set [0 ..< length bs]`] \n using \"7\" \n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b2)) (purge_raw\n (to_trans_raw_bit (\\ sig) \\ b2 sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs\n ! b2)) (Bv (bs ! b2))) sig t = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\\n bs ! b2)) (to_trans_raw_bit (\\ sig) \\ b2 sig) sig t\\ by auto\n with `(lval_of o the) (\\' k2 sig) ! b2 = bs ! b2` have \"\\' k1 sig \\ \\' k2 sig\"\n by auto\n moreover have \"\\'' k1 sig = \\' k1 sig\"\n using 0 `t < k1` `k1 < t + dly` unfolding preempt_raw_def by auto\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n using `\\'' k2 sig = \\' k2 sig` unfolding to_trans_raw_sig_def by auto }\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n ultimately have \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto }\n ultimately show \"to_trans_raw_sig \\'' sig k1 \\ to_trans_raw_sig \\'' sig k2\"\n by auto \n next \n { assume \"keys (to_trans_raw_sig \\'' sig) \\ {}\"\n have lt: \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) < t + dly\"\n proof (rule ccontr)\n assume \"\\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) < t + dly\"\n hence atmost: \"t + dly \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))\"\n by auto\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ keys (to_trans_raw_sig \\'' sig)\"\n using `keys (to_trans_raw_sig \\'' sig) \\ {}` by (meson LeastI all_not_in_conv)\n hence \"to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ 0\"\n unfolding keys_def by auto\n moreover have \"to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = 0\"\n using atmost unfolding 0 to_trans_raw_sig_def preempt_raw_def by (auto simp add: zero_option_def)\n ultimately show False\n by auto\n qed\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ keys (to_trans_raw_sig \\'' sig)\"\n using `keys (to_trans_raw_sig \\'' sig) \\ {}` by (meson LeastI all_not_in_conv) \n hence \"to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ 0\"\n unfolding keys_def by auto\n with lt have \"\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig \\ 0\"\n unfolding 0 preempt_raw_def to_trans_raw_sig_def by auto\n have \"t < (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))\"\n proof (rule ccontr)\n assume \"\\ t < (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig))\"\n hence \" (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ t\"\n by auto\n hence \"\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = 0\"\n using assms(4)\n unfolding 1 combine_trans_bit_def Let_def by (auto simp add :zero_fun_def)\n with `\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig \\ 0`\n show False\n unfolding to_trans_raw_sig_def by auto\n qed\n hence \"\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\"\n using lt unfolding 0 preempt_raw_def by auto\n let ?t = \"LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)\"\n have **: \"?t \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..' ?t sig \\ 0` `t < ?t` `?t < t + dly` unfolding 1 combine_trans_bit_def\n using not_le zero_option_def by force\n hence \"?t \\ fold (\\) (map keys (map (\\\\. to_trans_raw_sig \\ sig) (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\) (map (keys \\ ((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))))) [0..x\\set (map (keys \\ ((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))))) [0.. x)\"\n using member_fold_union[OF *] unfolding empty_iff by auto\n then obtain b where \"?t \\ keys (((\\\\. to_trans_raw_sig \\ sig) \\ (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))) b)\" and \n \"b \\ set [0..< length bs]\" by auto\n hence \"?t \\ keys (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) n sig)\"\n unfolding comp_def to_trans_raw_sig_def by auto\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig \\ 0\"\n unfolding keys_def by auto\n from purge_raw_neq_0_imp[OF this `t < ?t` `?t < t + dly`]\n have inf_time: \" inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some ?t\"\n and sig_neq: \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \"\n and sig_eq: \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\" \n by auto\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig = \n to_trans_raw_bit (\\ sig) \\ b sig ?t sig\"\n using `t < ?t` `?t < t + dly` unfolding purge_raw_def Let_def by auto\n also have \"... = Some (Bv (bs ! b))\"\n using sig_eq inf_time unfolding to_signal_def comp_def \n by (metis (mono_tags, lifting) \\purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\\n sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) (LEAST k. k \\ keys\n (to_trans_raw_sig \\'' sig)) sig \\ 0\\ calculation option.collapse option.simps(5)\n to_trans_raw_sig_def zero_option_def)\n finally have ***: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?t sig = Some (Bv (bs ! b))\"\n by auto\n have \"\\' ?t sig = Some\n (Lv sign\n (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..?t < t + dly\\ \\t < ?t\\ by auto\n hence 4: \"(lval_of o the) (\\' ?t sig) = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..b. b \\ set [0..< length bs] \\ (lval_of o the) (\\' ?t sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n proof -\n fix b\n assume \"b \\ set [0 ..< length bs]\"\n have \"(lval_of o the) (\\' ?t sig) ! b = (map (\\p. bval_of (signal_of (get_time p) (snd p) sig ?t))\n (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n have **: \"?complex = bval_of\n (signal_of\n (fst (zip (map (\\n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. set [0 ..< length bs]` by auto\n ultimately have \"?complex = bval_of \n (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using \\b \\ set [0.. unfolding ** by (simp add: val.case_eq_if)\n thus \" (lval_of o the) (\\' ?t sig) ! b = bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using 4 by auto\n qed\n hence h: \"(lval_of o the) (\\' ?t sig) ! b = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t)\"\n using `b \\ set [0..< length bs]` by auto\n have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?t = Bv (bs ! b)\"\n proof (rule signal_of_intro, rule, rule)\n show \"?t \\ ?t\" by auto\n next\n have \"to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) = Some (Bv (bs ! b))\"\n using *** unfolding to_trans_raw_sig_def by auto\n moreover have \"(\\j>LEAST k. k \\ keys (to_trans_raw_sig \\'' sig).\n j \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\ to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (lval_of (\\ sig) ! b)) (Bv (bs ! b))) sig j = None)\"\n by auto\n ultimately show \" to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig\n (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) =\n Some (Bv (bs ! b)) \\\n (\\j>LEAST k. k \\ keys (to_trans_raw_sig \\'' sig).\n j \\ (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) \\\n to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig j = None) \\\n (\\i\\LEAST k. k \\ keys (to_trans_raw_sig \\'' sig). purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) i sig = None) \\\n Bv (bs ! b) = Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)\"\n by auto\n qed\n hence \"bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))(Bv (bs ! b))) sig ?t) = bs ! b\"\n by auto\n hence \"(lval_of o the) (\\' ?t sig) ! b = bs ! b\"\n using h by auto\n have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t = (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))\"\n apply (intro signal_of_def)\n using assms(4) unfolding to_trans_raw_bit_def by (simp add: zero_fun_def zero_option_def)\n hence \"(case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b) \\ bs ! b\"\n using sig_neq by auto\n hence \"\\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n proof -\n { assume \"Lv sign ((lval_of \\ the) (\\'' (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)) sig)) \\ the (\\'' (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)) sig)\"\n moreover\n { assume \"map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case the (to_trans_raw_sig \\'' sig (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig))) of Bv b \\ b | Lv s bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! n)) (Bv (bs ! n))) [0.. (lval_of \\ the) (\\'' (LEAST n. n \\ keys (to_trans_raw_sig \\'' sig)) sig)\"\n then have ?thesis\n by (metis \"4\" \\\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\\) (* > 1.0 s, timed out *) }\n ultimately have ?thesis\n by (simp add: \\\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = Some (Lv sign (map (\\p. bval_of (signal_of (get_time p) (snd p) sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))) (zip (map (\\n. Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. \\\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\\) }\n then show ?thesis\n by (metis \\(case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b) \\ bs ! b\\ \\(lval_of \\ the) (\\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig) ! b = bs ! b\\ \\\\'' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig = \\' (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)) sig\\ to_trans_raw_sig_def val.simps(6))\n qed }\n thus \"keys (to_trans_raw_sig \\'' sig) \\ {} \\ \\ sig \\ the (to_trans_raw_sig \\'' sig (LEAST k. k \\ keys (to_trans_raw_sig \\'' sig)))\"\n by auto\n qed }\n ultimately show ?thesis\n by auto\nqed\n\nlemma purge'_trans_post_preserve_non_stuttering:\n fixes \\ sig t dly cur_val\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ purge_raw' \\ t dly sig (\\ sig) cur_val\"\n defines \"\\'' \\ trans_post_raw sig cur_val (\\ sig) \\' t dly\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n shows \"non_stuttering (to_trans_raw_sig \\'') \\ sig\"\n using purge'_trans_post_preserve_non_stuttering_bv purge'_trans_post_preserve_non_stuttering_lv\n by (metis \\''_def \\'_def assms(1) assms(4) val.exhaust)\n \nlemma post_raw_preserves_non_stuttering:\n fixes dly t val\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n defines \"\\' \\ post_raw sig val \\ (t + dly)\"\n assumes \"post_necessary_raw (dly-1) \\ t sig val (\\ sig)\"\n assumes \"\\n \\ t. \\ n = 0\"\n assumes \"0 < dly\"\n shows \"non_stuttering (to_trans_raw_sig \\') \\ sig\"\nproof -\n have cases: \"(\\i val'. i \\ t + (dly - 1) \\ \\ i sig = Some val' \\ val' \\ val \\ (\\j>i. j \\ t + (dly - 1) \\ \\ j sig = None)) \\\n (\\i\\t + (dly - 1). \\ i sig = None) \\ val \\ \\ sig\"\n using assms(3) unfolding post_necessary_raw_correctness2 by auto\n { fix k1 k2\n assume \"k1 \\ keys (to_trans_raw_sig \\' sig)\" and \"k2 \\ keys (to_trans_raw_sig \\' sig)\"\n assume \"k1 < k2\"\n assume \"\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig)\"\n have \"k2 \\ t + dly\"\n using `k2 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def post_raw_def to_trans_raw_sig_def\n proof -\n assume \"k2 \\ keys (\\n. (if n = t + dly then \\ n(sig \\ val) else if t + dly < n then (\\ n)(sig := None) else \\ n) sig)\"\n then have \"k2 \\ {n. (if n = t + dly then \\ n(sig \\ val) else if t + dly < n then (\\ n)(sig := None) else \\ n) sig \\ 0}\"\n by (simp add: keys_def)\n then show ?thesis\n using leI zero_option_def by fastforce\n qed\n hence \"k2 = t + dly \\ k2 < t + dly\"\n by auto\n moreover\n { assume \"k2 = t + dly\"\n hence \"to_trans_raw_sig \\' sig k2 = Some val\"\n unfolding \\'_def post_raw_def to_trans_raw_sig_def by auto\n consider (case1) \"(\\i val'. i \\ t + (dly - 1) \\ \\ i sig = Some val' \\ val' \\ val \\ (\\j>i. j \\ t + (dly - 1) \\ \\ j sig = None))\"\n | (case2) \"(\\i\\t. i \\ t + (dly - 1) \\ \\ i sig = None) \\ val \\ \\ sig\"\n using cases by auto\n hence \"to_trans_raw_sig \\' sig k1 \\ to_trans_raw_sig \\' sig k2\"\n proof (cases)\n case case1\n then obtain i val' where \"i\\t\" and \"i \\ t + (dly-1)\" and \"\\ i sig = Some val'\" and \"val' \\ val\"\n \"\\j>i. j \\ t + (dly - 1) \\ \\ j sig = None\"\n by (metis assms(4) nat_le_linear option.distinct(1) zero_fun_def zero_option_def)\n have \"k1 < t + dly\"\n using `k1 < k2` `k2 \\ t + dly` by auto\n have \"k1 \\ keys (to_trans_raw_sig \\ sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def to_trans_raw_sig_def post_raw_def\n proof -\n assume a1: \"k1 \\ Femto_VHDL_raw.keys (\\n. (if n = t + dly then \\ n(sig \\ val) else if t + dly < n then (\\ n)(sig := None) else \\ n) sig)\"\n have \"\\ t + dly \\ k1\"\n by (meson \\k1 < t + dly\\ not_le)\n then show \"k1 \\ Femto_VHDL_raw.keys (\\n. \\ n sig)\"\n using a1 by (simp add: keys_def)\n qed\n have *: \"\\j>k1. j < t + dly \\ \\ j sig = None\"\n using `\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig)` unfolding `k2 = t + dly`\n \\'_def post_raw_def to_trans_raw_sig_def by (simp add: keys_def zero_option_def)\n have \"i = k1\"\n proof (rule ccontr)\n assume \"\\ i = k1\" hence \"i < k1 \\ k1 < i\" by auto\n moreover\n { assume \"i < k1\"\n hence \"\\j>i. j \\ t + (dly-1) \\ \\ j sig \\ None\"\n using `k1 < k2` `k2 = t + dly` `k1 \\ keys (to_trans_raw_sig \\ sig)`\n apply(intro exI[where x=\"k1\"])\n unfolding to_trans_raw_sig_def keys_def\n by (smt Suc_diff_1 \\t \\ i\\ add_Suc_right dual_order.order_iff_strict less_Suc_eq_le\n less_add_same_cancel1 less_trans mem_Collect_eq zero_option_def)\n with `\\j>i. j \\ t + (dly - 1) \\ \\ j sig = None` have \"False\" by auto }\n moreover\n { assume \"k1 < i\"\n hence \"\\j>k1. j < t + dly \\ \\ j sig \\ None\"\n using `i \\ t + (dly-1)` `\\ i sig = Some val'`\n by (intro exI[where x=\"i\"])(metis (no_types, hide_lams) One_nat_def Suc_diff_1\n add.right_neutral add_Suc_right assms(4) diff_is_0_eq' less_Suc_eq_le nat_le_linear\n not_le option.distinct(1) zero_fun_def zero_option_def)\n with * have False by auto }\n ultimately show False by auto\n qed\n thus \"to_trans_raw_sig \\' sig k1 \\ to_trans_raw_sig \\' sig k2\"\n using `i = k1` `\\ i sig = Some val'` `to_trans_raw_sig \\' sig k2 = Some val`\n by (metis \\k1 < k2\\ \\k2 = t + dly\\ \\val' \\ val\\ \\'_def add_less_same_cancel1\n less_imp_add_positive not_less_zero option.sel post_raw_def to_trans_raw_sig_def)\n next\n case case2\n have \"k1 < t + dly\"\n using `k1 < k2` `k2 \\ t + dly` by auto\n moreover have \"k1 \\ keys (to_trans_raw_sig \\ sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def to_trans_raw_sig_def post_raw_def\n proof -\n assume a1: \"k1 \\ Femto_VHDL_raw.keys (\\n. (if n = t + dly then \\ n(sig \\ val) else if t + dly < n then (\\ n)(sig := None) else \\ n) sig)\"\n have \"\\ t + dly \\ k1\"\n by (meson \\k1 < t + dly\\ not_le)\n then show \"k1 \\ Femto_VHDL_raw.keys (\\n. \\ n sig)\"\n using a1 by (simp add: keys_def)\n qed\n moreover hence \"t < k1\"\n using assms(4)\n by (metis domIff dom_def keys_def leI to_trans_raw_sig_def zero_fun_def zero_option_def)\n ultimately have \"\\i\\t. i \\ t + (dly - 1) \\ \\ i sig \\ None\"\n apply (intro exI[where x=\"k1\"])\n unfolding to_trans_raw_sig_def keys_def by (simp add: zero_option_def)\n with case2 have \"False\" by auto\n then show ?thesis by auto\n qed }\n moreover\n { assume \"k2 < t + dly\"\n hence \"k2 \\ keys (to_trans_raw_sig \\ sig)\"\n using `k2 \\ keys (to_trans_raw_sig \\' sig)` unfolding \\'_def post_raw_def to_trans_raw_sig_def\n by (simp add: keys_def)\n moreover have \"k1 \\ keys (to_trans_raw_sig \\ sig)\"\n using `k1 \\ keys (to_trans_raw_sig \\' sig)` `k1 < k2` `k2 < t + dly`\n unfolding \\'_def post_raw_def to_trans_raw_sig_def by (simp add: keys_def)\n moreover have \"\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n using `\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig \\' sig)` `k1 < k2` `k2 < t +dly`\n unfolding \\'_def post_raw_def to_trans_raw_sig_def by (simp add: keys_def)\n ultimately have \"to_trans_raw_sig \\ sig k1 \\ to_trans_raw_sig \\ sig k2\"\n using assms(1) `k1 < k2` unfolding non_stuttering_def by auto\n moreover have \"to_trans_raw_sig \\ sig k1 = to_trans_raw_sig \\' sig k1\" and\n \"to_trans_raw_sig \\ sig k2 = to_trans_raw_sig \\' sig k2\"\n using `k1 < k2` `k2 < t +dly` unfolding \\'_def post_raw_def to_trans_raw_sig_def\n by auto\n ultimately have \"to_trans_raw_sig \\' sig k1 \\ to_trans_raw_sig \\' sig k2\"\n by auto }\n ultimately have \"to_trans_raw_sig \\' sig k1 \\ to_trans_raw_sig \\' sig k2\"\n by auto }\n note first_po = this\n { assume \"keys (to_trans_raw_sig \\' sig) \\ {}\"\n { assume \"(\\i\\t. i \\ t + (dly - 1) \\ \\ i sig = None) \\ val \\ \\ sig\"\n hence *: \"(\\i. i \\ t + (dly - 1) \\ \\' i sig = None)\" and \"val \\ \\ sig\"\n unfolding \\'_def post_raw_def using `0 < dly` assms(4)\n by (smt Suc_diff_1 add_Suc_right fun_upd_same le_add1 le_imp_less_Suc less_irrefl_nat nat_le_linear)+\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\' sig)) = t + dly\"\n proof (intro Least_equality)\n show \"t + dly \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)\"\n unfolding \\'_def post_raw_def to_trans_raw_sig_def keys_def by (auto simp add: zero_option_def)\n next\n { fix y\n assume \"\\ t + dly \\ y\" hence \"y < t + dly\" by auto\n hence \"\\' y sig = None\"\n using * by auto\n hence \"y \\ keys (to_trans_raw_sig \\' sig)\"\n using * unfolding \\'_def to_trans_raw_sig_def keys_def post_raw_def\n by (auto simp add: zero_option_def) }\n thus \"\\y. y \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig) \\ t + dly \\ y\"\n by auto\n qed\n hence \"\\ sig \\ the (to_trans_raw_sig \\' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)))\"\n using \\'_def `val \\ \\ sig` unfolding post_raw_def to_trans_raw_sig_def by auto }\n moreover\n { assume \"(\\i val'. i \\ t + (dly - 1) \\ \\ i sig = Some val' \\ val' \\ val \\ (\\j>i. j \\ t + (dly - 1) \\ \\ j sig = None))\"\n then obtain i val' where \"i \\ t\" and \"i \\ t + (dly - 1)\" and \"\\ i sig = Some val'\" and\n \"\\j>i. j < t + (dly - 1) \\ \\ j sig = None\"\n by (metis assms(4) nat_le_linear nat_less_le option.distinct(1) zero_fun_def zero_option_def)\n hence **: \"i \\ keys (to_trans_raw_sig \\ sig)\"\n unfolding keys_def to_trans_raw_sig_def by (auto simp add: zero_option_def)\n hence *: \"i \\ keys (to_trans_raw_sig \\' sig)\"\n using `i \\ t + (dly - 1)` `0 < dly` unfolding \\'_def post_raw_def to_trans_raw_sig_def\n keys_def by auto\n define least_key where \"least_key = (LEAST k. k \\ keys (to_trans_raw_sig \\' sig))\"\n have \"least_key \\ t + (dly - 1)\"\n using Least_le[where P=\"\\k. k \\ keys (to_trans_raw_sig \\' sig)\", OF *] `i \\ t + (dly-1)`\n unfolding least_key_def by auto\n have \"(LEAST k. k \\ keys (to_trans_raw_sig \\ sig)) = least_key\"\n proof (rule Least_equality)\n have \"least_key \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)\"\n using LeastI[where P=\"\\k. k \\ keys (to_trans_raw_sig \\' sig)\", OF *]\n unfolding least_key_def by auto\n then obtain val' where \"\\' least_key sig = Some val'\"\n unfolding keys_def to_trans_raw_sig_def by (auto simp add: zero_option_def)\n hence \"\\ least_key sig = Some val'\"\n unfolding \\'_def post_raw_def using `least_key \\ t + (dly - 1)` `0 < dly`\n by (smt Suc_diff_1 add_Suc_right fun_upd_same le_imp_less_Suc not_le option.distinct(1)\n order_refl)\n thus \" least_key \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig)\"\n unfolding to_trans_raw_sig_def keys_def by (auto simp add: zero_option_def)\n next\n { fix y\n assume \"\\ least_key \\ y\" hence \"y < least_key\" by auto\n hence \"y \\ keys (to_trans_raw_sig \\' sig)\"\n using not_less_Least unfolding least_key_def by auto\n have \"y < t + (dly - 1)\"\n using `y < least_key` `least_key \\ t + (dly - 1)` by auto\n hence \"\\' y sig = \\ y sig\"\n unfolding \\'_def post_raw_def by auto\n hence \"y \\ keys (to_trans_raw_sig \\ sig)\"\n using `y \\ keys (to_trans_raw_sig \\' sig)` by (simp add: keys_def to_trans_raw_sig_def) }\n thus \"\\y. y \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig) \\ least_key \\ y\"\n by auto\n qed\n note least_key_alt_def = sym[OF this]\n have ***: \"\\ sig \\ the (to_trans_raw_sig \\ sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig)))\"\n using assms(1) unfolding non_stuttering_def using \"**\" by blast\n have \"the (to_trans_raw_sig \\ sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig))) =\n the (to_trans_raw_sig \\ sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)))\"\n using least_key_alt_def unfolding least_key_def by auto\n also have \"... = the (to_trans_raw_sig \\ sig least_key)\"\n unfolding least_key_def by auto\n also have \"... = the (to_trans_raw_sig \\' sig least_key)\"\n unfolding \\'_def post_raw_def to_trans_raw_sig_def using `least_key \\ t + (dly -1)`\n `0 < dly` by auto\n finally have \"the (to_trans_raw_sig \\ sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\ sig))) =\n the (to_trans_raw_sig \\' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)))\"\n unfolding least_key_def by auto\n with *** have \"\\ sig \\ the (to_trans_raw_sig \\' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)))\"\n by auto }\n ultimately have \"\\ sig \\ the (to_trans_raw_sig \\' sig (LEAST k. k \\ Femto_VHDL_raw.keys (to_trans_raw_sig \\' sig)))\"\n using cases by auto }\n note second_po = this\n with first_po show ?thesis\n unfolding non_stuttering_def by auto\nqed\n\nlemma trans_post_preserves_non_stuttering:\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ s\"\n assumes \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n assumes \"cs = Bassign_trans sig e dly\"\n shows \"non_stuttering (to_trans_raw_sig \\') \\ s\"\n using assms\nproof (induction cs arbitrary: \\ \\')\n case (Bcase x1 x2)\n then show ?case by force\nnext\n case (Bassign_trans sig e dly)\n obtain x where \"t , \\ , \\ , \\, def \\ e \\\\<^sub>b x\"\n by (meson Bassign_trans.prems(2) seq_cases_trans)\n hence \\'_def: \"\\' = trans_post_raw sig x (\\ sig) \\ t dly\"\n using Bassign_trans.prems(2) beval_raw_deterministic by (metis seq_cases_trans)\n have prev_zero: \"\\n. n < t \\ to_trans_raw_sig \\ s n = 0\"\n using Bassign_trans(3) unfolding to_trans_raw_sig_def\n by (auto simp add: zero_fun_def zero_option_def)\n have \"sig \\ s \\ sig = s\" by auto\n moreover\n { assume \"sig \\ s\"\n hence \"to_trans_raw_sig \\' s = to_trans_raw_sig \\ s\"\n using \\'_def unfolding trans_post_raw_def to_trans_raw_sig_def preempt_raw_def post_raw_def\n by auto\n hence ?case\n using Bassign_trans(1) unfolding non_stuttering_def Let_def by auto }\n moreover\n { assume \"sig = s\"\n have \"post_necessary_raw (dly-1) \\ t sig x (\\ sig) \\\n \\ post_necessary_raw (dly-1) \\ t sig x (\\ sig)\" by auto\n moreover\n { assume notnec: \"\\ post_necessary_raw (dly-1) \\ t sig x (\\ sig)\"\n have look: \" \\' = preempt_raw sig ( \\) (t + dly)\"\n using notnec unfolding \\'_def trans_post_raw_def by auto\n hence ?case\n using preempt_raw_preserves_non_stuttering[OF Bassign_trans(1)] by (simp add: \\sig = s\\) }\n moreover\n { assume nec: \"post_necessary_raw (dly-1) \\ t sig x (\\ sig)\"\n hence lookup: \"\\' = post_raw sig x \\ (t + dly)\"\n unfolding \\'_def by (auto simp add: trans_post_raw_def)\n have \"0 < dly \\ dly = 0\"\n by auto\n moreover\n { assume \"0 < dly \"\n hence ?case\n using post_raw_preserves_non_stuttering[OF Bassign_trans(1)]\n using Bassign_trans.prems(3) \\0 < dly\\ \\sig = s\\ using lookup nec by blast }\n moreover\n { assume \"dly = 0\"\n hence nec': \"post_necessary_raw 0 \\ t sig x (\\ sig)\" and lookup': \"\\' = post_raw sig x \\ t\"\n using nec lookup by auto\n have keys': \"keys (to_trans_raw_sig \\' s) = {t}\"\n proof \n { fix k\n assume \"k \\ keys (to_trans_raw_sig \\' s)\"\n hence \"to_trans_raw_sig \\' s k \\ 0\"\n unfolding keys_def by auto\n have \"\\ k < t\"\n proof (rule ccontr)\n assume \"\\ \\ k < t\" hence \"k < t\" by auto\n hence \"to_trans_raw_sig \\' s k = 0\"\n using prev_zero unfolding lookup' post_raw_def by (simp add: to_trans_raw_sig_def)\n with `to_trans_raw_sig \\' s k \\ 0` show False by auto\n qed\n moreover have \"\\ k > t\"\n proof (rule ccontr)\n assume \"\\ \\ k > t\" hence \"k > t\" by auto\n hence \"to_trans_raw_sig \\' s k = 0\"\n unfolding lookup' post_raw_def\n proof -\n have \"k \\ t\"\n using \\t < k\\ by blast\n then show \"to_trans_raw_sig (\\n. if n = t then \\ n(sig \\ x) else if t < n then (\\ n)(sig := None) else \\ n) s k = 0\"\n by (simp add: \\sig = s\\ \\t < k\\ to_trans_raw_sig_def zero_option_def)\n qed\n with `to_trans_raw_sig \\' s k \\ 0` show False \n by auto\n qed\n ultimately have \"k = t\"\n by auto }\n thus \"keys (to_trans_raw_sig \\' s) \\ {t}\"\n by auto\n have \"t \\ keys (to_trans_raw_sig \\' s)\"\n unfolding lookup' post_raw_def \n by (simp add: \\sig = s\\ keys_def to_trans_raw_sig_def zero_option_def)\n thus \"{t} \\ keys (to_trans_raw_sig \\' s)\"\n by auto\n qed\n have least: \"(LEAST k. k \\ {t}) = t\"\n by (meson LeastI_ex singleton_iff)\n have \"(\\i val'. i \\ t \\ \\ i sig = Some val' \\ val' \\ x \\ (\\j>i. j \\ t \\ \\ j sig = None)) \\ (\\i\\t. \\ i sig = None) \\ x \\ \\ sig\"\n using nec' unfolding post_necessary_raw_correctness2 by auto\n hence \"(\\i\\t. \\ i sig = None) \\ x \\ \\ sig\"\n by (metis Bassign_trans.prems(3) add.right_neutral option.distinct(1) zero_fun_def\n zero_option_def)\n hence \" \\ s \\ the (to_trans_raw_sig \\' s (LEAST k. k \\ {t}))\"\n unfolding lookup' post_raw_def least to_trans_raw_sig_def \\sig = s\\ by auto\n hence ?case\n unfolding non_stuttering_def keys' by blast }\n ultimately have ?case by auto }\n ultimately have ?case by auto }\n ultimately show ?case by auto\nnext\n case (Bcomp cs1 cs2)\n have False\n using `Bcomp cs1 cs2 = Bassign_trans sig e dly` by auto\n then show ?case by auto\nnext\n case (Bguarded x1 cs1 cs2)\n have \"False\"\n using `Bguarded x1 cs1 cs2 = Bassign_trans sig e dly` by auto\n then show ?case by auto\nnext\n case (Bassign_inert x1 x2 x3)\n then show ?case by auto\nnext\n case Bnull\n then show ?case by auto\nqed\n\nlemma b_seq_exec_preserves_non_stuttering:\n assumes \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ s\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n assumes \"nonneg_delay cs\"\n shows \"non_stuttering (to_trans_raw_sig \\') \\ s\"\n using assms\nproof (induction rule: b_seq_exec.inducts)\n case (1 t \\ \\ \\ def \\)\n then show ?case by auto\nnext\n case (2 t \\ \\ \\ def ss1 \\ \\'' ss2 \\')\n hence *: \"non_stuttering (to_trans_raw_sig \\'') \\ s\"\n using nonneg_delay.simps(2) by blast\n have \"b_seq_exec t \\ \\ \\ def ss2 \\'' \\'\"\n by (simp add: \"2.hyps\"(2))\n moreover have \"\\n. n < t \\ \\'' n = 0\"\n using \"2.hyps\"(1) \"2.prems\"(2) b_seq_exec_preserve_trans_removal less_imp_le_nat by blast\n ultimately show ?case\n by (metis \"*\" \"2.IH\"(2) \"2.hyps\"(1) \"2.prems\"(2) \"2.prems\"(3) \\\\n. n < t \\ \\'' n = 0\\\n nonneg_delay.simps(2) nonneg_delay_same order.not_eq_order_implies_strict)\nnext\n case (3 t \\ \\ \\ def guard ss1 \\ \\' ss2)\n then show ?case\n using nonneg_delay.simps(3) by blast\nnext\n case (4 t \\ \\ \\ def guard ss2 \\ \\' ss1)\n then show ?case\n using nonneg_delay.simps(3) by blast\nnext\n case (5 t \\ \\ \\ def e x sig \\ dly \\')\n then show ?case\n by (meson b_seq_exec.intros(5) trans_post_preserves_non_stuttering)\nnext\n case (6 t \\ \\ \\ def e x sig \\ dly \\')\n hence \\'_def': \"\\' = trans_post_raw sig x (\\ sig) (purge_raw' \\ t dly sig (\\ sig) x) t dly\"\n using 6 by (simp add: inr_post_raw'_def)\n let ?\\ = \"purge_raw' \\ t dly sig (\\ sig) x\"\n have \"s = sig \\ s \\ sig\"\n by auto\n moreover\n { assume \"s \\ sig\"\n hence \"\\n. to_trans_raw_sig \\' s n = to_trans_raw_sig \\ s n\"\n using \\'_def'\n by (metis \"6.hyps\"(2) inr_post_raw_does_not_affect_other_sig' to_trans_raw_sig_def)\n hence \"to_trans_raw_sig \\' s = to_trans_raw_sig \\ s\"\n by blast\n hence ?case\n using 6 unfolding non_stuttering_def Let_def by auto }\n moreover\n { assume \"s = sig\"\n moreover have 3: \"\\n. n \\ t \\ ?\\ n = 0\"\n by (simp add: \"6.prems\"(2) purge_preserve_trans_removal_nonstrict')\n obtain cs2 where cs2_def: \"cs2 = Bassign_trans sig e dly\"\n by auto\n hence 2: \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n using \\'_def' by (meson \"6.hyps\"(1) b_seq_exec.intros(5))\n hence ?case\n using \"6.prems\"(1) \"6.prems\"(2) \\'_def' calculation\n purge'_trans_post_preserve_non_stuttering by metis }\n ultimately show ?case\n by auto\nqed auto\n\ntext \\end of non stuttering\\\n\ntext \\The type @{typ \"'signal assn\"} represents a predicate over a worldline, i.e., a property\nabout a worldline. The pre- and post-condition of a VHDL sequential statement will be of this type.\\\n\ndefinition state_of_world :: \"'signal worldline_init \\ nat \\ 'signal state\" where\n \"state_of_world w t = (\\s. snd w s t)\"\n\ndefinition event_of_world :: \"'signal worldline_init \\ nat \\ 'signal event\" where\n \"event_of_world w t = (if t = 0 then {s :: 'signal. snd w s t \\ fst w s} else\n {s :: 'signal. snd w s t \\ snd w s (t - 1)})\"\n\ndefinition beh_of_world_raw :: \"'signal worldline_init \\ nat \\ nat \\ 'signal \\ val\" where\n \"beh_of_world_raw w t = (\\t'. if t' < t then (\\s. Some (snd w s t')) else Map.empty)\"\n\ninductive beval_world_raw :: \"'signal worldline_init \\ nat \\ 'signal bexp \\ val \\ bool\"\n where\n \" state_of_world w t = \\ \\ event_of_world w t = \\ \\ derivative_hist_raw w t = \\ \\\n t, \\, \\, \\, (fst w) \\ exp \\\\<^sub>b x \\ beval_world_raw w t exp x\"\n\ninductive_cases beval_world_raw_cases [elim!]: \"beval_world_raw w t exp x\"\n\nlemma beval_world_raw_deterministic:\n assumes \"beval_world_raw w t exp x1\"\n assumes \"beval_world_raw w t exp x2\"\n shows \"x2 = x1\"\n using assms(1) assms(2) beval_raw_deterministic beval_world_raw_cases by blast\n\ntext \\As promised in the beginning of this theory, we show the first relationship from @{typ\n\"'signal worldline\"} to the realm of @{typ \"'signal state\"}, @{typ \"'signal event\"}, and @{typ\n\"'signal trans_raw\"}.\n\nFor @{term \"state_of_world\"}, the definition is obvious. We need a function abstraction --- instead\nof simply giving an argument to function @{term \"w :: 'signal worldline\"} to return another function\n--- here because the different order of the arguments: in @{typ \"'signal worldline\"} the name of the\nsignal comes before the time.\n\nEvent represents the set of signals whose values are different from the previous time. Here is the\ndilemma: what happens at time @{term \"0::nat\"}? There is no such time as @{term \"0 - 1\"} as this\nwill evaluate to @{term \"0\"} in natural numbers. Nevertheless, event at time @{term \"0 :: nat\"}\nhas different interpretation: it is the set of signals whose values are different from the default\nvalues, i.e., @{term \"Bv False :: val\"}. The expression for else-statement in @{term \"event_of_world\"}\nis obvious.\n\nNote that @{term \"beh_of_world\"} requires a lift_definition instead of standard definition\nconstruct; this is due to @{typ \"'signal trans_raw\"}. Its raw version @{term \"beh_of_world_raw\"}\nonly maps until the time @{term \"t\"} only. This is because behaviour is synonymous with history in\nour definition and, according to the order of time, we do not have any ``mapping'' from time now\nuntil the future.\n\\\n\ninductive\n seq_hoare :: \"nat \\ 'signal assn \\ 'signal seq_stmt \\ 'signal assn \\ bool\"\n (\"\\\\<^sub>_ ({(1_)}/ (_)/ {(1_)})\" 50) where\nNull: \"\\\\<^sub>t {P} Bnull {P}\"\n\n| Assign: \"\\\\<^sub>t {\\w . (\\x. beval_world_raw w t exp x \\ P (w[sig, t + dly := x]))} Bassign_trans sig exp dly {P}\"\n\n| AssignI: \"\\\\<^sub>t {\\w . (\\x. beval_world_raw w t exp x \\ P (worldline_inert_upd2 w sig t dly x))} Bassign_inert sig exp dly {P}\"\n\n| Comp: \"\\ \\\\<^sub>t {P} s1 {Q}; \\\\<^sub>t {Q} s2 {R}\\ \\ \\\\<^sub>t {P} Bcomp s1 s2 {R}\"\n\n| If: \" \\\\<^sub>t {\\w . P w \\ (\\x. beval_world_raw w t g x \\ bval_of x)} s1 {Q} \\\n \\\\<^sub>t {\\w . P w \\ (\\x. beval_world_raw w t g x \\ \\ bval_of x)} s2 {Q} \\\n \\\\<^sub>t {P} Bguarded g s1 s2 {Q}\"\n\n| Conseq: \"\\\\w . P' w \\ P w ; \\\\<^sub>t {P} s {Q}; \\w . Q w \\ Q' w \\ \\ \\\\<^sub>t {P'} s {Q'}\"\n\n| Bcase_empty_choices: \"\\\\<^sub>t {P} Bcase exp [] {P}\"\n\n| Bcase_others: \"\\\\<^sub>t {P} ss {Q} \\ \\\\<^sub>t {P} Bcase exp ((Others, ss) # choices) {Q}\"\n\n| Bcase_if: \"\\\\<^sub>t {\\w. P w \\ (\\x. beval_world_raw w t exp x \\ beval_world_raw w t exp' x)} ss {Q}\n \\ \\\\<^sub>t {\\w. P w \\ (\\x x'. beval_world_raw w t exp x \\ beval_world_raw w t exp' x' \\ x \\ x')} Bcase exp choices {Q}\n \\ \\\\<^sub>t {P} Bcase exp ( (Explicit exp', ss) # choices) {Q}\"\n\ntext \\The inductive definition @{term \"seq_hoare\"} is similar to the inductive definition @{term\n\"hoare\"} in @{theory_text \"Hoare\"}. Rules other than @{thm \"Assign\"} and @{thm \"AssignI\"} are\nstandard; we explain those two only here. As can be seen, the construct @{term \"worldline_upd\"} and\n@{term \"worldline_inert_upd\"} are designed for the purpose of defining the axiomatic semantics\nof VHDL. We show how it makes sense later in the soundness property.\\\n\ninductive_cases seq_hoare_ic: \"\\\\<^sub>t {P} s {Q}\"\n\ninductive_cases seq_hoare_cases_null [elim!]: \"\\\\<^sub>t {P} Bnull {Q}\" and\n seq_hoare_cases_assign : \"\\\\<^sub>t {P} Bassign_trans sig exp dly {Q}\" and\n seq_hoare_cases_assign_inert : \"\\\\<^sub>t {P} Bassign_inert sig exp dly {Q}\" and\n seq_hoare_cases_comp : \"\\\\<^sub>t {P} Bcomp s1 s2 {Q}\" and\n seq_hoare_cases_if : \"\\\\<^sub>t {P} Bguarded g s1 s2 {Q}\" and\n seq_hoare_cases_bcase : \"\\\\<^sub>t {P} Bcase exp choices {Q}\"\n\nlemma BnullE:\n assumes \"\\\\<^sub>t {P} s {Q}\"\n assumes \"s = Bnull\"\n shows \"\\w . P w \\ Q w \"\n using assms\n by (induction rule:seq_hoare.induct, auto)\n\nlemma BnullE':\n \"\\\\<^sub>t {P} Bnull {Q} \\ \\w . P w \\ Q w \"\n by (simp add: BnullE)\n\nlemma BassignE:\n assumes \"\\\\<^sub>t {P} s {Q}\"\n assumes \"s = Bassign_trans sig exp dly\"\n shows \"\\w . P w \\ (\\x. beval_world_raw w t exp x \\ Q (w[sig, t + dly := x]))\"\n using assms\nproof (induction rule:seq_hoare.induct)\n case (Conseq P' P t s Q Q')\n then show ?case by metis\nqed (auto)\n\nlemma BassignE2:\n assumes \"\\\\<^sub>t {P} s {Q}\"\n assumes \"s = Bassign_trans sig exp dly\"\n shows \"\\w x. P w \\ beval_world_raw w t exp x \\ Q (w[sig, t + dly := x])\"\n using BassignE[OF assms] beval_world_raw_deterministic by metis\n\nlemma Bassign_inertE:\n assumes \"\\\\<^sub>t {P} s {Q}\"\n assumes \"s = Bassign_inert sig exp dly\"\n shows \"\\w. P w \\ (\\x. beval_world_raw w t exp x \\ Q (worldline_inert_upd2 w sig t dly x))\"\n using assms\nproof (induction rule: seq_hoare.induct)\n case (Conseq P' P t s Q Q')\n then show ?case by metis\nqed auto\n\nlemma Bassign_inertE2:\n assumes \"\\\\<^sub>t {P} s {Q}\"\n assumes \"s = Bassign_inert sig exp dly\"\n shows \"\\w x. P w \\ beval_world_raw w t exp x \\ Q (worldline_inert_upd2 w sig t dly x)\"\n using Bassign_inertE[OF assms] beval_world_raw_deterministic by metis\n\nlemma BcompE:\n assumes \"\\\\<^sub>t {P} s {R}\"\n assumes \"s = Bcomp s1 s2\"\n shows \"\\Q. \\\\<^sub>t {P} s1 {Q} \\ \\\\<^sub>t {Q} s2 {R}\"\n using assms\nproof (induction rule:seq_hoare.induct)\n case (Comp t P s1 Q s2 R)\n then show ?case by blast\nnext\n case (Conseq P' P t s Q Q')\n then show ?case\n by (metis seq_hoare.Conseq)\nqed auto\n\nlemmas [simp] = seq_hoare.Null seq_hoare.Assign seq_hoare.Comp seq_hoare.If\n seq_hoare.Bcase_empty_choices seq_hoare.Bcase_if seq_hoare.Bcase_others\nlemmas [intro!] = seq_hoare.Null seq_hoare.Assign seq_hoare.Comp seq_hoare.If\n seq_hoare.Bcase_empty_choices seq_hoare.Bcase_if seq_hoare.Bcase_others\n\n\n\n\n\nlemma Assign':\n assumes \"\\w. P w \\ (\\x. beval_world_raw w t exp x \\ Q (worldline_upd w sig (t + dly) x))\"\n shows \"\\\\<^sub>t {P} Bassign_trans sig exp dly {Q}\"\n using assms by (simp add: strengthen_pre)\n\ndefinition\nseq_hoare_valid :: \"nat \\ 'signal assn \\ 'signal seq_stmt \\ 'signal assn \\ bool\" (\"\\\\<^sub>_ {(1_)}/ (_)/ {(1_)}\" 50)\nwhere \"\\\\<^sub>t {P} s {Q} \\ (\\\\ \\ \\ \\ \\' w w' def . context_invariant t \\ \\ \\ def \\\n \\ (\\s. non_stuttering (to_trans_raw_sig \\) \\ s)\n \\ (\\s. non_stuttering (to_trans_raw_sig \\) def s)\n \\ w = worldline_raw t \\ \\ def \\\n \\ P w\n \\ (t, \\, \\, \\, def \\ < s, \\> \\\\<^sub>s \\')\n \\ w' = worldline_raw t \\ \\ def \\' \\ Q w')\"\n\ntext \\The definition @{term \"seq_hoare_valid\"} shall be the basis to define the soundness of the\nHoare logic rules. Note that the symbol of `\\` has @{term \"t\"} as its subscript which indicates\nthat the validity is a function of time. Here is the diagram explaining the definition of the\nvalidity:\n\\\n\n(*\n P w \\ Q w\n \\ \\\n w = worldline t \\ \\ \\ w' = worldline t \\ \\ \\'\n \\ \\\n \\ \\\\<^sub>c \\'\n*)\n\n\nsubsection \\Soundness\\\n\nlemma Bcomp_hoare_valid:\n assumes \"\\\\<^sub>t {P} s1 {Q}\" and \"\\\\<^sub>t {Q} s2 {R}\"\n assumes \"nonneg_delay (Bcomp s1 s2)\"\n shows \"\\\\<^sub>t {P} Bcomp s1 s2 {R}\"\n unfolding seq_hoare_valid_def\nproof (rule)+\n fix \\ :: \"'a state\"\n fix \\ \\ \\' :: \"'a trans_raw\"\n fix \\ :: \"'a event\"\n fix w w' :: \"'a worldline_init\"\n fix def\n assume \"context_invariant t \\ \\ \\ def \\ \\ All (non_stuttering (to_trans_raw_sig \\) \\) \\ All (non_stuttering (to_trans_raw_sig \\) def) \\\n w = worldline_raw t \\ \\ def \\ \\ P w \\\n t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\' \\ w' = worldline_raw t \\ \\ def \\'\"\n hence \"context_invariant t \\ \\ \\ def \\\" and \"w = worldline_raw t \\ \\ def \\\" and \"P w\" and \"All (non_stuttering (to_trans_raw_sig \\) \\)\"\n and \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n and \"t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\' \" and 2: \"w' = worldline_raw t \\ \\ def \\'\"\n by auto\n then obtain \\'' where 0: \"t, \\, \\, \\, def \\ < s1, \\> \\\\<^sub>s \\''\" and 1: \"t, \\, \\, \\, def \\ < s2, \\''> \\\\<^sub>s \\'\"\n using seq_cases_bcomp by blast\n define w'' where \"w'' = worldline_raw t \\ \\ def \\''\"\n hence \"Q w''\"\n using `\\\\<^sub>t {P} s1 {Q}` unfolding seq_hoare_valid_def\n using \\P w\\ \\context_invariant t \\ \\ \\ def \\\\ \\t , \\ , \\ , \\, def \\ < s1 , \\> \\\\<^sub>s \\''\\ \\w = worldline_raw t \\ \\ def \\\\\n \\All (non_stuttering (to_trans_raw_sig \\) \\)\\ \\All (non_stuttering (to_trans_raw_sig \\) def)\\\n by blast\n have \"context_invariant t \\ \\ \\ def \\''\"\n using b_seq_exec_preserves_context_invariant[OF `context_invariant t \\ \\ \\ def \\` 0] assms(3)\n by auto\n moreover have \"\\s. non_stuttering (to_trans_raw_sig \\') \\ s\"\n proof -\n have \"\\s. non_stuttering (to_trans_raw_sig \\'') \\ s\"\n using b_seq_exec_preserves_non_stuttering[OF 0] `All (non_stuttering (to_trans_raw_sig \\) \\)`\n `context_invariant t \\ \\ \\ def \\` assms(3) by (simp add: context_invariant_def)\n thus ?thesis\n using b_seq_exec_preserves_non_stuttering[OF 1]\n `context_invariant t \\ \\ \\ def \\` assms(3)\n by (meson calculation context_invariant_def nonneg_delay.simps(2))\n qed\n ultimately show \"R w'\"\n using `\\\\<^sub>t {Q} s2 {R}` `w'' = worldline_raw t \\ \\ def \\''` `Q w''` 1 2 unfolding seq_hoare_valid_def\n by (metis (full_types, hide_lams) \"0\" \\context_invariant t \\ \\ \\ def \\ \\ All (non_stuttering\n (to_trans_raw_sig \\) \\) \\ All (non_stuttering (to_trans_raw_sig \\) def) \\ w = worldline_raw t \\ \\ def \\ \\ P w \\ t , \\ , \\ , \\, def \\ >\n \\\\<^sub>s \\' \\ w' = worldline_raw t \\ \\ def \\'\\ assms(3) b_seq_exec_preserves_non_stuttering\n context_invariant_def nonneg_delay.simps(2))\nqed\n\nlemma Bnull_sound:\n \"\\\\<^sub>t {P} Bnull {Q} \\ \\\\<^sub>t {P} Bnull {Q}\"\n by (auto dest!: BnullE' simp add: seq_hoare_valid_def)\n\nlemma state_of_world:\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n shows \"state_of_world w t = \\\"\nproof\n fix x\n have \"signal_of (\\ x) \\ x t = \\ x\"\n proof -\n have True: \"(to_trans_raw_sig \\ x) t = 0\"\n using assms(2) by (auto simp add: to_trans_raw_sig_def zero_fun_def)\n hence \"\\k \\ dom ((to_trans_raw_sig \\ x)). t \\ k\"\n using assms(2) unfolding to_trans_raw_sig_def\n by (metis domIff linear zero_option_def)\n moreover have \"t \\ dom ( (to_trans_raw_sig \\ x))\"\n using True by (simp add: domIff zero_option_def)\n ultimately have \"\\k \\ dom ( (to_trans_raw_sig \\ x)). t < k\"\n using nat_less_le by auto\n hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) x t = None\"\n by (auto simp add: inf_time_none_iff)\n thus \"signal_of (\\ x) \\ x t = \\ x\"\n unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n qed\n thus \"state_of_world w t x = \\ x\"\n unfolding state_of_world_def assms worldline_raw_def by auto\nqed\n\nlemma beval_beh_of_world:\n assumes \"beval_raw t \\ \\ \\ def exp x\"\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"\\n. t \\ n \\ \\ n = 0\"\n shows \"beval_raw t \\ \\ (beh_of_world_raw w t) def exp x\"\n using assms\nproof (induction rule: beval_raw.inducts)\n case (4 t \\ \\ \\ def sig n)\n have \"t , \\ , \\ , (beh_of_world_raw w t), def \\ Bsig_delayed sig n \\\\<^sub>b (signal_of (def sig) (beh_of_world_raw w t) sig (t - n))\"\n by (meson beval_raw.intros(4))\n have *: \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) \\ sig (t - n))\"\n by (meson beval_raw.intros(4))\n have \"0 < n \\ 0 < t \\ (t \\ 0 \\ n = 0) \\ t = 0\"\n by auto\n moreover\n { assume \"0 < n \\ 0 < t\"\n hence \" (beh_of_world_raw w t) (t - n) = Some \\ (\\s. snd w s (t - n))\"\n unfolding beh_of_world_raw_def comp_def by auto\n hence \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = snd w sig (t - n)\"\n by (auto dest!:trans_some_signal_of)\n also have \"... = signal_of (def sig) \\ sig (t - n)\"\n using `0 < n \\ 0 < t` unfolding 4 worldline_raw_def by auto\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) \\ sig (t - n))\"\n using * by auto\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) (beh_of_world_raw w t) sig (t - n))\"\n using \\snd w sig (t - n) = signal_of (def sig) \\ sig (t - n)\\ calculation by auto\n hence ?case\n using \\t , \\ , \\ , beh_of_world_raw w t, def \\ Bsig_delayed sig n \\\\<^sub>b signal_of (def sig)\n (beh_of_world_raw w t) sig (t - n)\\ \\snd w sig (t - n) = signal_of (def sig) \\ sig (t - n)\\\n calculation by auto }\n moreover\n { assume \"t \\ 0 \\ n = 0 \\ t = 0\"\n moreover\n { assume \"t = 0\"\n hence \"t - n = 0\" by auto\n have \"beh_of_world_raw w t = 0\" unfolding `t = 0`\n by (auto simp add: beh_of_world_raw_def zero_fun_def zero_option_def)\n hence \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) 0 sig 0\"\n unfolding `t - n = 0` by auto\n also have \"... = def sig\"\n using signal_of_empty[of \"def sig\" \"sig\" \"0\"] by auto\n finally have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = def sig\"\n by auto\n have \"\\ = 0\"\n using 4 unfolding `t = 0` by (auto simp add: zero_fun_def)\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) \\ sig 0)\"\n using `t - n = 0` \"*\" by auto\n also have \"... = def sig\"\n unfolding `\\ = 0` using signal_of_empty[of \"def sig\"] by metis\n finally have \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (def sig)\"\n by auto\n hence ?case\n using `signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = def sig`\n by (simp add: \\\\ = 0\\ \\beh_of_world_raw w t = 0\\) }\n moreover\n { assume \"t \\ 0 \\ n = 0\"\n have \" \\ t = 0\"\n using 4 by auto\n have \" (beh_of_world_raw w t) t = 0\"\n unfolding beh_of_world_raw_def\n by (metis (full_types) less_not_refl map_add_subsumed1 map_add_subsumed2 map_le_def\n zero_fun_def zero_option_def)\n have *: \" (beh_of_world_raw w t) (t - 1) = Some o (\\s. snd w s (t - 1))\"\n using `t \\ 0 \\ n = 0` unfolding beh_of_world_raw_def by auto\n have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) (beh_of_world_raw w t) sig t\"\n using `t \\ 0 \\ n = 0` by auto\n also have \"... = signal_of (def sig) (beh_of_world_raw w t) sig (t - 1)\"\n using signal_of_less[where \\=\"beh_of_world_raw w t\", OF `(beh_of_world_raw w t) t = 0`]\n by metis\n also have \"... = snd w sig (t - 1)\"\n using * by(auto dest!: trans_some_signal_of)\n also have \"... = signal_of (def sig) \\ sig (t - 1)\"\n using `t \\ 0 \\ n = 0` unfolding 4(1) worldline_raw_def by auto\n also have \"... = signal_of (def sig) \\ sig t\"\n using signal_of_less[where \\=\"\\\", OF ` \\ t = 0`] by metis\n also have \"... = signal_of (def sig) \\ sig (t - n)\"\n using `t \\ 0 \\ n = 0` by auto\n finally have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) \\ sig (t - n)\"\n by auto\n hence ?case\n using \\t , \\ , \\ , beh_of_world_raw w t, def \\ Bsig_delayed sig n \\\\<^sub>b signal_of (def sig)\n (beh_of_world_raw w t) sig (t - n)\\ by auto }\n ultimately have ?case by auto }\n ultimately show ?case by auto\nqed (metis beval_raw.intros)+\n\nlemma beval_beh_of_world':\n assumes \"beval_raw t \\ \\ \\' def exp x\"\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"\\n. t \\ n \\ \\ n = 0\"\n assumes \"\\' = beh_of_world_raw w t\"\n shows \"beval_raw t \\ \\ \\ def exp x\"\n using assms\nproof (induction rule: beval_raw.inducts)\n case (4 t \\ \\ \\' def sig n)\n have *: \"t , \\ , \\ , \\, def \\ Bsig_delayed sig n \\\\<^sub>b signal_of (def sig) \\ sig (t - n)\"\n by (meson beval_raw.intros(4))\n\n have \"0 < n \\ 0 < t \\ (t \\ 0 \\ n = 0) \\ t = 0\"\n by auto\n moreover\n { assume \"0 < n \\ 0 < t\"\n hence \" (beh_of_world_raw w t) (t - n) = Some \\ (\\s. snd w s (t - n))\"\n unfolding beh_of_world_raw_def comp_def by auto\n hence \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = snd w sig (t - n)\"\n by (auto dest!:trans_some_signal_of)\n also have \"... = signal_of (def sig) \\ sig (t - n)\"\n using `0 < n \\ 0 < t` unfolding 4 worldline_raw_def by auto\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) \\ sig (t - n))\"\n using * by auto\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) (beh_of_world_raw w t) sig (t - n))\"\n using \\snd w sig (t - n) = signal_of (def sig) \\ sig (t - n)\\ calculation by auto\n hence ?case\n using \"4.prems\"(3) by metis }\n moreover\n { assume \"t \\ 0 \\ n = 0 \\ t = 0\"\n moreover\n { assume \"t = 0\"\n hence \"t - n = 0\" by auto\n have \"beh_of_world_raw w t = 0\" unfolding `t = 0`\n by (auto simp add: beh_of_world_raw_def zero_fun_def zero_option_def)\n hence \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) 0 sig 0\"\n unfolding `t - n = 0` by auto\n also have \"... = def sig\"\n using signal_of_empty[of \"def sig\" \"sig\" \"0\"] by auto\n finally have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = def sig\"\n by auto\n have \"\\ = 0\"\n using 4 unfolding `t = 0` by (auto simp add: zero_fun_def)\n hence \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (signal_of (def sig) \\ sig 0)\"\n using `t - n = 0` \"*\" by auto\n also have \"... = def sig\"\n unfolding `\\ = 0` using signal_of_empty[of \"def sig\"] by metis\n finally have \"beval_raw t \\ \\ \\ def (Bsig_delayed sig n) (def sig)\"\n by auto\n hence ?case\n using `signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = def sig`\n by (simp add: \"4.prems\"(3)) }\n moreover\n { assume \"t \\ 0 \\ n = 0\"\n have \" \\ t = 0\"\n using 4 by auto\n have \" (beh_of_world_raw w t) t = 0\"\n unfolding beh_of_world_raw_def\n by (metis (full_types) less_not_refl map_add_subsumed1 map_add_subsumed2 map_le_def\n zero_fun_def zero_option_def)\n have *: \" (beh_of_world_raw w t) (t - 1) = Some o (\\s. snd w s (t - 1))\"\n using `t \\ 0 \\ n = 0` unfolding beh_of_world_raw_def by auto\n have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) (beh_of_world_raw w t) sig t\"\n using `t \\ 0 \\ n = 0` by auto\n also have \"... = signal_of (def sig) (beh_of_world_raw w t) sig (t - 1)\"\n using signal_of_less[where \\=\"beh_of_world_raw w t\", OF `(beh_of_world_raw w t) t = 0`]\n by metis\n also have \"... = snd w sig (t - 1)\"\n using * by(auto dest!: trans_some_signal_of)\n also have \"... = signal_of (def sig) \\ sig (t - 1)\"\n using `t \\ 0 \\ n = 0` unfolding 4(1) worldline_raw_def by auto\n also have \"... = signal_of (def sig) \\ sig t\"\n using signal_of_less[where \\=\"\\\", OF ` \\ t = 0`] by metis\n also have \"... = signal_of (def sig) \\ sig (t - n)\"\n using `t \\ 0 \\ n = 0` by auto\n finally have \"signal_of (def sig) (beh_of_world_raw w t) sig (t - n) = signal_of (def sig) \\ sig (t - n)\"\n by auto\n hence ?case\n using \"4.prems\"(3) beval_raw.intros(4) by fastforce }\n ultimately have ?case by auto }\n ultimately show ?case by auto\nqed (metis beval_raw.intros)+\n\nlemma beval_beh_of_world_iff:\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"\\n. t \\ n \\ \\ n = 0\"\n shows \"beval_raw t \\ \\ \\ def exp = beval_raw t \\ \\ (beh_of_world_raw w t) def exp\"\nproof (rule, rule)\n fix x\n assume \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\"\n show \"t , \\ , \\ , beh_of_world_raw w t, def \\ exp \\\\<^sub>b x\"\n using beval_beh_of_world[OF `t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x` assms] by auto\nnext\n fix x\n assume \"t , \\ , \\ , beh_of_world_raw w t, def \\ exp \\\\<^sub>b x\"\n thus \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x \"\n using beval_beh_of_world'[OF _ assms] by blast\nqed\n\ntext \\Note that the definition of @{term \"\\\"} below will only be preserved by VHDL code which does\nnot contain a zero time signal assignment. That is, in every assignment statement, be it of transport\nor inertial type, must have nonzero delay. Check @{thm \"context_invariant\"} and note the assumption\n@{term \"t < next_time t \\'\"}.\\\n\nlemma beval_beval_world_raw:\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"\\n. n \\ t \\ \\ n = 0\"\n assumes gam: \"\\ = {s. \\ s \\ signal_of (def s) \\ s (t - 1)}\"\n assumes beh: \"\\n. t \\ n \\ \\ n = 0\"\n assumes \"\\s. non_stuttering (to_trans_raw_sig \\) def s\"\n shows \"beval_raw t \\ \\ \\ def exp = beval_world_raw w t exp\"\nproof (rule, rule)\n fix x\n assume \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x \"\n have \"state_of_world w t = \\\"\n using state_of_world[OF assms(1) assms(2)] by auto\n moreover have \"event_of_world w t = \\\"\n proof (cases \"0 < t\")\n case True\n fix s\n have \"snd w s t = \\ s\"\n using `state_of_world w t = \\` unfolding state_of_world_def by auto\n moreover have \"snd w s (t - 1) = signal_of (def s) \\ s (t - 1)\"\n unfolding assms(1) worldline_raw_def using True by auto\n ultimately show ?thesis\n unfolding event_of_world_def assms(3)\n using True\n by (smt Collect_cong \\state_of_world w t = \\\\ assms(1) diff_less less_numeral_extra(3)\n snd_conv state_of_world_def worldline_raw_def zero_less_one)\n next\n case False\n hence \"t = 0\" by auto\n hence ev: \"event_of_world w t = {s. snd w s 0 \\ def s}\"\n unfolding event_of_world_def by (simp add: assms(1) worldline_raw_def)\n have \\_def': \"\\ = {s. \\ s \\ signal_of (def s) \\ s 0}\"\n using `t = 0` gam by auto\n have \"\\ = 0\"\n using beh unfolding `t = 0` by (auto simp add: zero_fun_def)\n hence \"\\s. signal_of (def s) \\ s 0 = def s\"\n using signal_of_empty by metis\n hence \"\\ = {s. \\ s \\ def s}\"\n using \\_def' by auto\n moreover have \"\\s. snd w s 0 = \\ s\"\n using `state_of_world w t = \\` `t = 0` unfolding state_of_world_def by auto\n ultimately have \"\\ = {s. snd w s 0 \\ def s}\"\n by auto\n thus ?thesis using ev by auto\n qed\n moreover have \"derivative_hist_raw w t = \\\"\n by (simp add: assms(1) assms(5) beh derivative_is_history)\n ultimately have \" beval_raw t (state_of_world w t) (event_of_world w t) (derivative_hist_raw w t) def exp =\n beval_raw t \\ \\ \\ def exp\"\n by auto\n thus \"beval_world_raw w t exp x\"\n by (simp add: \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ assms(1) beval_world_raw.intros worldline_raw_def)\nnext\n fix x\n assume \"beval_world_raw w t exp x\"\n hence \"beval_raw t (state_of_world w t) (event_of_world w t) (derivative_hist_raw w t) def exp x\"\n by (simp add: assms(1) beval_world_raw.simps worldline_raw_def)\n have \"state_of_world w t = \\\"\n using state_of_world[OF assms(1) assms(2)] by auto\n moreover have \"event_of_world w t = \\\"\n proof (cases \"0 < t\")\n case True\n fix s\n have \"snd w s t = \\ s\"\n using `state_of_world w t = \\` unfolding state_of_world_def by auto\n moreover have \"snd w s (t - 1) = signal_of (def s) \\ s (t - 1)\"\n unfolding assms(1) worldline_raw_def using True by auto\n ultimately show ?thesis\n unfolding event_of_world_def assms(3)\n using True\n by (smt Collect_cong \\state_of_world w t = \\\\ assms(1) diff_less less_numeral_extra(3)\n snd_conv state_of_world_def worldline_raw_def zero_less_one)\n next\n case False\n hence \"t = 0\" by auto\n hence ev: \"event_of_world w t = {s. snd w s 0 \\ def s}\"\n unfolding event_of_world_def by (simp add: assms(1) worldline_raw_def)\n have \\_def': \"\\ = {s. \\ s \\ signal_of (def s) \\ s 0}\"\n using `t = 0` gam by auto\n have \"\\ = 0\"\n using beh unfolding `t = 0` by (auto simp add: zero_fun_def)\n hence \"\\s. signal_of (def s) \\ s 0 = def s\"\n using signal_of_empty by metis\n hence \"\\ = {s. \\ s \\ def s}\"\n using \\_def' by auto\n moreover have \"\\s. snd w s 0 = \\ s\"\n using `state_of_world w t = \\` `t = 0` unfolding state_of_world_def by auto\n ultimately have \"\\ = {s. snd w s 0 \\ def s}\"\n by auto\n thus ?thesis using ev by auto\n qed\n moreover have \"derivative_hist_raw w t = \\\"\n by (simp add: assms(1) assms(5) beh derivative_is_history)\n ultimately have \"beval_raw t \\ \\ \\ def exp x\"\n using \\t , state_of_world w t , event_of_world w t , derivative_hist_raw w t, def \\ exp \\\\<^sub>b x\\ by blast\n thus \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\"\n using beval_beh_of_world' assms(1) beh by blast\nqed\n\nlemma beval_beval_world_raw_ci:\n assumes \"w = worldline_raw t \\ \\ def \\\"\n assumes \"context_invariant t \\ \\ \\ def \\ \"\n assumes \"\\s. non_stuttering (to_trans_raw_sig \\) def s\"\n shows \"beval_raw t \\ \\ \\ def exp = beval_world_raw w t exp\"\nproof -\n have 0: \"\\n. n \\ t \\ \\ n = 0\" and\n 1: \"\\ = {s. \\ s \\ signal_of (def s) \\ s (t - 1)}\" and\n 3: \"\\n. t \\ n \\ \\ n = 0\"\n using assms(2) unfolding context_invariant_def by auto\n show ?thesis\n using beval_beval_world_raw[OF assms(1) 0 1 3 assms(3)] by auto\nqed\n\nlemma Bguarded_hoare_valid:\n assumes \"\\\\<^sub>t {\\a. P a \\ (\\x. beval_world_raw a t g x \\ bval_of x)} s1 {Q}\" and \"\\\\<^sub>t {\\a. P a \\ (\\x. beval_world_raw a t g x \\ \\ bval_of x)} s2 {Q}\"\n shows \"\\\\<^sub>t {P} Bguarded g s1 s2 {Q}\"\n unfolding seq_hoare_valid_def\nproof (rule)+\n fix \\ :: \"'a state\"\n fix \\ \\ \\' :: \"'a trans_raw\"\n fix \\ :: \"'a event\"\n fix w w' :: \"'a worldline_init\"\n fix def\n assume \"context_invariant t \\ \\ \\ def \\ \\ All (non_stuttering (to_trans_raw_sig \\) \\) \\ All (non_stuttering (to_trans_raw_sig \\) def) \\\n w = worldline_raw t \\ \\ def \\ \\ P w \\\n t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\' \\ w' = worldline_raw t \\ \\ def \\'\"\n hence s: \"t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\'\" and w: \"w = worldline_raw t \\ \\ def \\\"\n and c: \"context_invariant t \\ \\ \\ def \\\" and p: \"P w\" and w': \"w' = worldline_raw t \\ \\ def \\'\" and\n \"All (non_stuttering (to_trans_raw_sig \\) \\)\" and \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n by auto\n obtain x where \"t, \\, \\, \\, def \\ g \\\\<^sub>b x\"\n using s by (metis seq_cases_bguarded)\n hence \"is_Bv x\"\n using beval_raw_deterministic s by (metis seq_cases_bguarded val.discI(1))\n have \"bval_of x \\ \\ bval_of x\"\n by auto\n moreover\n { assume \"bval_of x \"\n hence \\'_def: \"t , \\ , \\ , \\, def \\ < s1 , \\> \\\\<^sub>s \\'\"\n using s \\is_Bv x\\ \\t , \\ , \\ , \\, def \\ g \\\\<^sub>b x\\ beval_raw_deterministic val.collapse(1)\n by (metis seq_cases_bguarded val.inject(1))\n have \"beval_world_raw w t g x\"\n using `bval_of x` beval_beval_world_raw[OF w] c unfolding context_invariant_def\n using \\t , \\ , \\ , \\, def \\ g \\\\<^sub>b x\\\n by (simp add: \\All (non_stuttering (to_trans_raw_sig \\) def)\\)\n with `P w` have \" Q w'\"\n using assms(1) c w \\'_def w' \\All (non_stuttering (to_trans_raw_sig \\) \\)\\\n \\All (non_stuttering (to_trans_raw_sig \\) def)\\\n unfolding seq_hoare_valid_def using \\bval_of x\\ by metis }\n moreover\n { assume \"\\ bval_of x\"\n hence \\'_def: \"t, \\, \\, \\, def \\ < s2, \\> \\\\<^sub>s \\'\"\n using s \\is_Bv x\\ \\t , \\ , \\ , \\, def \\ g \\\\<^sub>b x\\ beval_raw_deterministic val.collapse(1)\n by (metis dual_order.irrefl less_irrefl neq_iff seq_cases_bguarded val.sel(1))\n have \"beval_world_raw w t g x\"\n using `\\ bval_of x` beval_beval_world_raw[OF w] c unfolding context_invariant_def\n using \\t , \\ , \\ , \\, def \\ g \\\\<^sub>b x\\ \\All (non_stuttering (to_trans_raw_sig \\) def)\\\n by auto\n with `P w` have \"Q w'\"\n using assms(2) c w \\'_def w' \\All (non_stuttering (to_trans_raw_sig \\) \\)\\\n unfolding seq_hoare_valid_def using \\\\ bval_of x\\ \\All (non_stuttering (to_trans_raw_sig \\) def)\\\n by metis }\n ultimately show \"Q w'\" by auto\nqed\n\nlemma lift_trans_post_worldline_upd:\n assumes \"\\ = worldline_raw t \\ \\ def \\\"\n assumes \"beval_world_raw \\ t exp x\"\n assumes \\'_def: \"\\' = trans_post_raw sig x (\\ sig) \\ t dly\"\n assumes \"\\i < t. \\ i = 0\"\n assumes \"0 < dly\"\n shows \"worldline_raw t \\ \\ def \\' = \\[sig, t + dly := x]\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n fix s' t'\n have \"t' < t \\ t' \\ t\" by auto\n moreover\n { assume \"t' < t\"\n hence 0: \" snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (def s') \\ s' t'\"\n unfolding worldline_raw_def by auto\n have \"t' < t + dly\"\n using `t' < t` by auto\n hence \"snd (\\[sig, t + dly := x]) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_upd_def by auto\n also have \"... = signal_of (def s') \\ s' t'\"\n using `t' < t` unfolding worldline_raw_def by auto\n finally have \"snd (\\[sig, t + dly := x]) s' t' = signal_of (def s') \\ s' t'\"\n by auto\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t'\"\n using 0 by auto }\n moreover\n { assume \"t' \\ t\"\n hence 0: \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n unfolding worldline_raw_def by auto\n have \"t' < t + dly \\ t' \\ t + dly\"\n by auto\n moreover\n { assume \"t' < t + dly\"\n have \"snd (\\[sig, t + dly := x]) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n using `t' < t + dly` unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_upd_def by auto\n also have \"... = signal_of (\\ s') \\ s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n finally have 1: \"snd (\\[sig, t + dly := x]) s' t' = signal_of (\\ s') \\ s' t'\"\n by auto\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n also have \"... = signal_of (\\ s') \\ s' t'\"\n using signal_of_trans_post2[OF `t' < t + dly`] unfolding \\'_def by metis\n also have \"... = snd (\\[sig, t + dly := x]) s' t'\"\n using 1 by auto\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t'\"\n by auto }\n moreover\n { assume \"t' \\ t + dly\"\n have \"s' = sig \\ s' \\ sig\" by auto\n moreover\n { assume \"s' = sig\"\n hence 2: \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (snd (\\[sig, t + dly := x]) s' t')\"\n using `t' \\ t + dly` `\\ = worldline_raw t \\ \\ def \\` worldline_upd_def\n by (smt assms(2) le_eq_less_or_eq not_less_iff_gr_or_eq snd_conv)\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n moreover have \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (signal_of (\\ s') \\' s' t')\"\n using signal_of_trans_post3[OF `t + dly \\ t'`, of _ \"\\ s'\" \"sig\"] \\'_def\n `\\ = worldline_raw t \\ \\ def \\` \\s' = sig\\ assms(2-5) by auto\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t' \"\n using 2 beval_world_raw_deterministic by metis }\n moreover\n { assume \"s' \\ sig\"\n hence \"sig \\ s'\" by auto\n hence \"snd (\\[sig, t + dly := x]) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_upd_def by auto\n also have \"... = signal_of (\\ s') \\ s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n finally have 3: \"snd (\\[sig, t + dly := x]) s' t' = signal_of (\\ s') \\ s' t'\"\n by auto\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n also have \"... = signal_of (\\ s') \\ s' t'\"\n unfolding \\'_def using signal_of_trans_post[OF `sig \\ s'`] by metis\n also have \"... = snd (\\[sig, t + dly := x]) s' t'\"\n using 3 by auto\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t' \"\n by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t' \"\n by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t' \"\n by auto }\n ultimately show \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t + dly := x]) s' t'\"\n by auto\nqed (simp add: assms(1) worldline_raw_def worldline_upd_def)\n\nlemma Bassign_trans_sound:\n assumes \"0 < dly\"\n shows \"\\\\<^sub>t {P} Bassign_trans sig exp dly {Q} \\ \\\\<^sub>t {P} Bassign_trans sig exp dly {Q}\"\nproof -\n assume \"\\\\<^sub>t {P} Bassign_trans sig exp dly {Q}\"\n hence imp: \"\\w. P w \\ (\\x. beval_world_raw w t exp x \\ Q (w[sig, t + dly := x]))\"\n by (auto dest!: BassignE)\n { fix \\ :: \"'a state\"\n fix \\ \\' \\ :: \"'a trans_raw\"\n fix w w' :: \"'a worldline_init\"\n fix \\ def\n assume \"context_invariant t \\ \\ \\ def \\\"\n hence \"\\n. n \\ t \\ \\ n = 0\"\n unfolding context_invariant_def by auto\n assume \"w = worldline_raw t \\ \\ def \\\"\n assume \"P w\"\n assume \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assume \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n then obtain x where \"beval_raw t \\ \\ \\ def exp x\" and \"\\' = trans_post_raw sig x (\\ sig) \\ t dly\"\n by (metis seq_cases_trans)\n moreover have \"beval_raw t \\ \\ \\ def exp = beval_world_raw w t exp\"\n using `w = worldline_raw t \\ \\ def \\` \\context_invariant t \\ \\ \\ def \\\\ beval_beval_world_raw_ci\n \\All (non_stuttering (to_trans_raw_sig \\) def)\\ by blast\n ultimately have \\'_def: \"\\' = trans_post_raw sig x (\\ sig) \\ t dly\"\n by auto\n have \"snd (worldline_raw t \\ \\ def \\') = snd (w[sig, t + dly := x])\"\n using \\w = worldline_raw t \\ \\ def \\\\ \\'_def lift_trans_post_worldline_upd `\\n. n \\ t \\ \\ n = 0` `0 < dly`\n by (metis \\beval_raw t \\ \\ \\ def exp = beval_world_raw w t exp\\ \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ less_imp_le_nat)\n with imp and `P w` have \"Q(w[sig, t + dly := x])\"\n by (metis (full_types) \\beval_raw t \\ \\ \\ def exp = beval_world_raw w t exp\\ \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ beval_world_raw_deterministic)\n assume \"w' = worldline_raw t \\ \\ def \\'\"\n hence \"Q w'\"\n using `Q(w[sig, t + dly := x])` `snd (worldline_raw t \\ \\ def \\') = snd (w[sig, t + dly := x])`\n by (simp add: \\w = worldline_raw t \\ \\ def \\\\ worldline_raw_def worldline_upd_def) }\n thus \" \\\\<^sub>t {P} Bassign_trans sig exp dly {Q}\"\n unfolding seq_hoare_valid_def by meson\nqed\n\nlemma lift_inr_post_worldline_upd:\n assumes \"\\ = worldline_raw t \\ \\ def \\\"\n assumes \"context_invariant t \\ \\ \\ def \\\"\n assumes \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n assumes \"0 < dly\"\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n assumes \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assumes \"beval_world_raw \\ t exp (Bv v)\"\n shows \"worldline_raw t \\ \\ def \\' = worldline_inert_upd2 \\ sig t dly (Bv v)\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n fix s' t'\n have \"beval_raw t \\ \\ \\ def exp (Bv v)\"\n using assms beval_beval_world_raw_ci by metis\n have \"\\' = inr_post_raw' sig (Bv v) (\\ sig) \\ t dly\"\n using assms(3) \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b(Bv v)\\ beval_raw_deterministic by (metis seq_cases_inert)\n moreover have \"beval_raw t \\ \\ \\ def exp = beval_world_raw \\ t exp\"\n using `\\ = worldline_raw t \\ \\ def \\ ` and `context_invariant t \\ \\ \\ def \\`\n by (simp add: assms(6) beval_beval_world_raw_ci)\n hence \\'_def: \"\\' = inr_post_raw' sig(Bv v) (\\ sig) \\ t dly\"\n by (simp add: calculation)\n have \"context_invariant t \\ \\ \\ def \\'\"\n using b_seq_exec_preserves_context_invariant[OF assms(2-3)] `0 < dly` by auto\n\n have \"\\n. n \\ t \\ \\ n = 0\"\n using assms(2) unfolding context_invariant_def by auto\n have \"s' \\ sig \\ t' < t \\ s' = sig \\ t \\ t'\"\n by auto\n moreover\n { assume \"s' \\ sig \\ t' < t\"\n moreover\n { assume \"t' < t\"\n hence 0: \" snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (def s') \\ s' t'\"\n unfolding worldline_raw_def by auto\n have \"t' < t + dly\"\n using `t' < t` by auto\n hence \"snd (\\[sig, t, dly :=(Bv v)]) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_inert_upd_def by (simp add: \\t' < t\\)\n also have \"... = signal_of (def s') \\ s' t'\"\n using `t' < t` unfolding worldline_raw_def by auto\n finally have \"snd (\\[sig, t, dly :=(Bv v)]) s' t' = signal_of (def s') \\ s' t'\"\n by auto\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly :=(Bv v)]) s' t'\"\n using 0 by auto }\n moreover\n { assume \"s' \\ sig\"\n hence \"snd (\\[sig, t, dly :=(Bv v)]) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n unfolding worldline_inert_upd_def `\\ = worldline_raw t \\ \\ def \\` by auto\n also have \"... = snd (worldline_raw t \\ \\ def \\') s' t'\"\n proof -\n have \"\\n. (to_trans_raw_sig \\ s') n = (to_trans_raw_sig \\' s') n\"\n using `s' \\ sig` unfolding \\'_def inr_post_raw'_def\n by (metis purge_raw_does_not_affect_other_sig' to_trans_raw_sig_def trans_post_raw_diff_sig)\n hence \"signal_of (\\ s') \\ s' t' = signal_of (\\ s') \\' s' t'\"\n by (meson signal_of_equal_when_trans_sig_equal_upto)\n thus ?thesis\n unfolding worldline_raw_def by auto\n qed\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly :=(Bv v)]) s' t'\"\n by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := Bv v]) s' t'\"\n by auto }\n moreover\n { assume \"s' = sig \\ t \\ t'\"\n have \"(snd \\ sig t = (Bv v) \\ snd \\ sig (t + dly) \\ (Bv v)) \\ (snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v))\"\n by auto\n moreover\n { assume \"snd \\ sig t = (Bv v) \\ snd \\ sig (t + dly) \\ (Bv v)\"\n have \"t + dly \\ t' \\ t' < t + dly\" and \"s' = sig\" and \"t \\ t'\"\n using leI \\s' = sig \\ t \\ t'\\ by auto\n moreover\n { assume \"t + dly \\ t'\"\n hence 2: \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (snd (\\[sig, t, dly := (Bv v)]) s' t')\"\n using `s' = sig` `\\ = worldline_raw t \\ \\ def \\` worldline_inert_upd_def\n using \\snd \\ sig t = (Bv v) \\ snd \\ sig (t + dly) \\ (Bv v)\\ assms(1)\n by (smt \\s' = sig \\ t \\ t'\\ assms(7) not_le snd_conv)\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n hence \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (signal_of (\\ s') \\' s' t')\"\n using signal_of_inr_post'[OF `t + dly \\ t'`, of _ \"\\ s'\" \"sig\"] \\'_def\n `\\ = worldline_raw t \\ \\ def \\` using \\\\n. n \\ t \\ \\ n = 0\\ \\s' = sig \\ t \\ t'\\ `0 < dly`\n assms(7) by auto\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t' \"\n using 2 \\snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\\\n beval_world_raw_deterministic by metis }\n moreover\n { assume \"t' < t + dly\"\n hence \"snd (\\[sig, t, dly := (Bv v)]) s' t' = snd \\ sig t\"\n unfolding worldline_inert_upd_def using `s' = sig` using \\s' = sig \\ t \\ t'\\\n using \\snd \\ sig t = (Bv v) \\ snd \\ sig (t + dly) \\ (Bv v)\\ by auto\n also have \"... = signal_of (\\ sig) \\ sig t\"\n unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_raw_def by auto\n also have \"... = \\ sig\"\n proof -\n have True: \"\\ t sig = None\"\n using `\\n. n \\ t \\ \\ n = 0` by (auto simp add: zero_fun_def zero_option_def)\n have \"\\k. k \\dom ((to_trans_raw_sig \\ sig)) \\ t < k\"\n proof (rule ccontr)\n fix k\n assume in_dom: \"k \\dom ((to_trans_raw_sig \\ sig))\"\n assume \"\\ t < k\" hence \"k \\ t\" by auto\n hence \"\\ k sig = None\"\n using `\\n. n \\ t \\ \\ n = 0` True by (metis dual_order.antisym leI zero_fun_def zero_option_def)\n hence \"k \\ dom ((to_trans_raw_sig \\ sig))\"\n unfolding to_trans_raw_sig_def by auto\n with in_dom show \"False\" by auto\n qed\n hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) sig t = None\"\n by (meson inf_time_none_iff)\n then show ?thesis\n unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n qed\n finally have l: \"snd (\\[sig, t, dly := (Bv v)]) s' t' = \\ sig\"\n by auto\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n unfolding worldline_raw_def using `s' = sig \\ t \\ t'` by auto\n also have \"... = \\ s'\"\n proof -\n have 0: \"signal_of (\\ s') \\ s' t = (Bv v) \\ signal_of (\\ s') \\ s' (t + dly) \\ (Bv v)\"\n using `snd \\ sig t = (Bv v) \\ snd \\ sig (t + dly) \\ (Bv v)` \\s' = sig\\\n unfolding assms(1) worldline_raw_def by auto\n thus ?thesis\n using signal_of_inr_post3[OF `t \\ t'` `t' < t + dly` `\\n. n \\ t \\ \\ n = 0`] \\s' = sig\\\n unfolding \\'_def inr_post_raw'_eq_inr_post_raw\n by (meson \\\\n. n \\ t \\ \\ n = 0\\ \\s' = sig \\ t \\ t'\\ \\t' < t + dly\\ signal_of_inr_post3)\n qed\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = \\ s'\"\n by auto\n with l have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t' \"\n using `s' = sig` by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t' \"\n by auto }\n moreover\n { assume \"snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\"\n hence sig_not_eq: \"signal_of (\\ sig) \\ sig t \\ (Bv v)\" and sig_eq: \"signal_of (\\ sig) \\ sig (t + dly) = (Bv v)\"\n unfolding assms(1) worldline_raw_def by auto\n hence exist_mapping: \"\\k > t. k\\t + dly \\ \\ k sig = Some (Bv v)\"\n using switch_signal_ex_mapping[of \"\\\", OF sig_not_eq] `\\n. n \\ t \\ \\ n = 0`\n by (simp add: zero_fun_def)\n let ?time = \"GREATEST n. n \\ t + dly \\ (snd \\ sig (n - 1) \\ (Bv v)) \\ snd \\ sig n = (Bv v)\"\n have \"?time \\ t' \\ t' < ?time\" and \"s' = sig\" and \"t \\ t'\"\n using \\s' = sig \\ t \\ t'\\ by auto\n moreover\n { assume \"?time \\ t'\"\n hence 2: \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (snd (\\[sig, t, dly := (Bv v)]) s' t')\"\n using `s' = sig` unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_inert_upd_def\n using \\snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\\\n \\s' = sig \\ t \\ t'\\ assms(1) using assms(7) by auto\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t' \\ t` unfolding worldline_raw_def by auto\n also have \"... = (Bv v)\"\n unfolding \\'_def \\s' = sig\\ inr_post_raw'_eq_inr_post_raw\n proof (rule signal_of_inr_post4)\n show \"signal_of (\\ sig) \\ sig t \\ (Bv v)\"\n using \\snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\\\n by (simp add: assms(1) worldline_raw_def)\n next\n show \"signal_of (\\ sig) \\ sig (t + dly) = (Bv v)\"\n using \\snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\\\n by (simp add: assms(1) worldline_raw_def)\n next\n have \"?time = (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v))\" (is \"_ = ?time2\")\n proof (rule Greatest_equality)\n have \"?time2 \\ t + dly\" and \"\\ ?time2 sig = Some (Bv v)\"\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ \\ n sig = Some (Bv v)\" and b=\"t + dly\"]\n exist_mapping by auto\n have \"t < ?time2\"\n by (metis (no_types, lifting) \\\\n. n \\ t \\ \\ n = 0\\\n \\\\ (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) sig = Some (Bv v)\\ leI\n option.distinct(1) zero_fun_def zero_option_def)\n have \"signal_of (\\ sig) \\ sig ?time2 = (Bv v)\"\n using trans_some_signal_of'[of \"\\\", OF `\\ ?time2 sig = Some (Bv v)`]\n by auto\n hence \"snd \\ sig ?time2 = (Bv v)\"\n using `t < ?time2` unfolding assms(1) worldline_raw_def by auto\n have \"signal_of (\\ sig) \\ sig (?time2 - 1) \\ (Bv v)\"\n proof (cases \"\\n. t < n \\ n < ?time2 \\ \\ n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time2 - 1 \\ \\ n sig = 0\"\n by (auto simp add: zero_option_def)\n have \"signal_of (\\ sig) \\ sig (?time2 - 1) = signal_of (\\ sig) \\ sig t\"\n using signal_of_less_ind'[of \"t\" \"?time2 - 1\" \"\\\" \"sig\", OF none] `t < ?time2`\n by auto\n also have \"... \\ (Bv v)\"\n using sig_not_eq by auto\n finally show \"signal_of (\\ sig) \\ sig (?time2 - 1) \\ (Bv v)\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time2 \\ \\ n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time2\" and \"\\ ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time2 \\ \\ n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time2 \\ \\ x sig \\ None\" and b=\"?time2\"]\n by (smt \\t < (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\\n \\ n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig \\) sig (?time2 - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig \\ sig)\"\n using `\\ ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time2 - 1\"\n using `?key1 < ?time2` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig \\ sig)\"\n assume \"ta \\ ?time2 - 1\"\n assume \"?key1 < ta\"\n hence \"\\ ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time2 - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig \\ sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig \\ sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig \\ sig). ta \\ ?time2 - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have \"\\ ?key1 sig \\ \\ ?time2 sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig \\ sig)\"\n using `\\ ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time2 \\ keys (to_trans_raw_sig \\ sig)\"\n using `\\ ?time2 sig = Some (Bv v)`\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"\\k. ?key1 < k \\ k < ?time2 \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis\n using `?key1 < ?time2` assms(5) unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n hence \"\\ ?key1 sig \\ Some (Bv v)\"\n using \\\\ (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) sig = Some (Bv v)\\\n \\\\ (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\ \\ n sig \\ None) sig \\ None\\ by auto\n thus ?thesis\n unfolding to_signal_def comp_def using inf_some\n by (metis (no_types, lifting) \\\\ (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly \\\n \\ n sig = Some (Bv v)) \\ \\ n sig \\ None) sig \\ None\\ not_None_eq option.sel\n option.simps(5) to_trans_raw_sig_def)\n qed\n hence \"snd \\ sig (?time2 - 1) \\ (Bv v)\"\n using `t < ?time2` unfolding assms(1) worldline_raw_def by (simp add: leD)\n thus \"?time2 \\ t + dly \\ snd \\ sig (?time2 - 1) \\ (Bv v) \\ snd \\ sig ?time2 = (Bv v)\"\n using \\(GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\ t + dly\\\n \\snd \\ sig (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) = (Bv v)\\ by blast\n next\n fix y\n assume \"y \\ t + dly \\ snd \\ sig (y - 1) \\ (Bv v) \\ snd \\ sig y = (Bv v)\"\n hence \"y \\ t + dly\" and \"snd \\ sig (y - 1) \\ (Bv v)\" and \"snd \\ sig y = (Bv v)\"\n by auto\n have \"?time2 \\ t + dly\" and \"\\ ?time2 sig = Some (Bv v)\"\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ \\ n sig = Some (Bv v)\" and b=\"t + dly\"]\n exist_mapping by auto\n hence \"t < ?time2\"\n by (metis (no_types, lifting) \\\\n. n \\ t \\ \\ n = 0\\ leI\n option.distinct(1) zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time2\"\n using `t < ?time2` by linarith }\n moreover\n { assume \"t < y\"\n hence \"snd \\ sig (y - 1) = signal_of (\\ sig) \\ sig (y - 1)\"\n unfolding assms(1) worldline_raw_def by auto\n hence 0: \"... \\ (Bv v)\"\n using `snd \\ sig (y - 1) \\ (Bv v)` by auto\n have \"snd \\ sig y = signal_of (\\ sig) \\ sig y\"\n unfolding assms(1) worldline_raw_def using `t < y` by auto\n hence 1: \"... = (Bv v)\"\n using `snd \\ sig y = (Bv v)` `t < y` by auto\n have \"\\ y sig = Some (Bv v)\"\n proof (rule ccontr)\n assume \"\\ \\ y sig = Some (Bv v)\"\n then obtain x' where \"\\ y sig = None \\ \\ y sig = Some x' \\ x' \\ (Bv v)\"\n using domIff by fastforce\n moreover\n { assume \"\\ y sig = None\"\n hence \"signal_of (\\ sig) \\ sig y = signal_of (\\ sig) \\ sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False by auto }\n moreover\n { assume \"\\ y sig = Some x' \\ x' \\ (Bv v)\"\n hence \"signal_of (\\ sig) \\ sig y = x'\" and \"x' \\ (Bv v)\"\n using trans_some_signal_of' by fastforce+\n with 1 have False by auto }\n ultimately show False by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time2\"\n by (metis (mono_tags, lifting) Greatest_le_nat) }\n ultimately show \"y \\ ?time2\"\n by auto\n qed\n thus \"(GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\ t'\"\n using \\(GREATEST n. n \\ t + dly \\ snd \\ sig (n - 1) \\ Bv v \\ snd \\ sig n = Bv v) \\ t'\\ by linarith\n next\n show \"\\n. n \\ t \\ \\ n = 0\"\n using \\\\n. n \\ t \\ \\ n = 0\\ by auto\n qed\n hence \"beval_world_raw (worldline_raw t \\ \\ def \\) t exp (Bv v)\"\n using assms(1) assms(7) by metis\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t' \"\n using 2 by (metis \\signal_of (\\ s') \\' s' t' = (Bv v)\\ beval_world_raw_deterministic calculation) }\n moreover\n { assume \" t' < ?time\"\n hence \"snd (\\[sig, t, dly := (Bv v)]) s' t' = snd \\ sig t\"\n unfolding worldline_inert_upd_def using `s' = sig` using \\s' = sig \\ t \\ t'\\\n using \\snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\\ by auto\n also have \"... = signal_of (\\ sig) \\ sig t\"\n unfolding `\\ = worldline_raw t \\ \\ def \\` worldline_raw_def by auto\n also have \"... = \\ sig\"\n proof -\n have True: \"\\ t sig = None\"\n using `\\n. n \\ t \\ \\ n = 0` by (auto simp add: zero_fun_def zero_option_def)\n have \"\\k. k \\dom ((to_trans_raw_sig \\ sig)) \\ t < k\"\n proof (rule ccontr)\n fix k\n assume in_dom: \"k \\dom ((to_trans_raw_sig \\ sig))\"\n assume \"\\ t < k\" hence \"k \\ t\" by auto\n hence \"\\ k sig = None\"\n using `\\n. n \\ t \\ \\ n = 0` True by (metis dual_order.antisym leI zero_fun_def zero_option_def)\n hence \"k \\ dom ((to_trans_raw_sig \\ sig))\"\n unfolding to_trans_raw_sig_def by auto\n with in_dom show \"False\" by auto\n qed\n hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\) sig t = None\"\n by (meson inf_time_none_iff)\n then show ?thesis\n unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n qed\n finally have l: \"snd (\\[sig, t, dly := (Bv v)]) s' t' = \\ sig\"\n by auto\n have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n unfolding worldline_raw_def using `s' = sig \\ t \\ t'` by auto\n also have \"... = \\ s'\"\n unfolding \\'_def \\s' = sig\\ inr_post_raw'_eq_inr_post_raw\n proof(rule signal_of_inr_post2)\n show \"t \\ t'\"\n by (simp add: \\s' = sig \\ t \\ t'\\)\n next\n show \"\\n. n \\ t \\ \\ n = 0\"\n using \\\\n. n \\ t \\ \\ n = 0\\ by blast\n next\n show \"\\ sig \\ (Bv v)\"\n using \\snd \\ sig t = signal_of (\\ sig) \\ sig t\\ \\snd \\ sig t \\ (Bv v) \\ snd \\ sig (t + dly) = (Bv v)\\\n \\signal_of (\\ sig) \\ sig t = \\ sig\\ by simp\n next\n show \"signal_of (\\ sig) \\ sig (t + dly) = (Bv v)\"\n using sig_eq by blast\n next\n have \"?time = (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v))\" (is \"_ = ?time2\")\n proof (rule Greatest_equality)\n have \"?time2 \\ t + dly\" and \"\\ ?time2 sig = Some (Bv v)\"\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ \\ n sig = Some (Bv v)\" and b=\"t + dly\"]\n exist_mapping by auto\n have \"t < ?time2\"\n by (metis (no_types, lifting) \\\\n. n \\ t \\ \\ n = 0\\ \\\\ (GREATEST n. n \\ t + dly \\ \\ n\n sig = Some (Bv v)) sig = Some (Bv v)\\ leI option.distinct(1) zero_fun_def zero_option_def)\n have \"signal_of (\\ sig) \\ sig ?time2 = (Bv v)\"\n using trans_some_signal_of'[of \"\\\", OF `\\ ?time2 sig = Some (Bv v)`]\n by auto\n hence \"snd \\ sig ?time2 = (Bv v)\"\n using `t < ?time2` unfolding assms(1) worldline_raw_def by auto\n have \"signal_of (\\ sig) \\ sig (?time2 - 1) \\ (Bv v)\"\n proof (cases \"\\n. t < n \\ n < ?time2 \\ \\ n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time2 - 1 \\ \\ n sig = 0\"\n by (auto simp add: zero_option_def)\n have \"signal_of (\\ sig) \\ sig (?time2 - 1) = signal_of (\\ sig) \\ sig t\"\n using signal_of_less_ind'[of \"t\" \"?time2 - 1\" \"\\\" \"sig\", OF none] `t < ?time2`\n by auto\n also have \"... \\ (Bv v)\"\n using sig_not_eq by auto\n finally show \"signal_of (\\ sig) \\ sig (?time2 - 1) \\ (Bv v)\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time2 \\ \\ n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time2\" and \"\\ ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time2 \\ \\ n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time2 \\ \\ x sig \\ None\" and b=\"?time2\"]\n by (smt \\t < (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\\n \\ n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig \\) sig (?time2 - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig \\ sig)\"\n using `\\ ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time2 - 1\"\n using `?key1 < ?time2` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig \\ sig)\"\n assume \"ta \\ ?time2 - 1\"\n assume \"?key1 < ta\"\n hence \"\\ ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time2 - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig \\ sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig \\ sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig \\ sig). ta \\ ?time2 - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have \"\\ ?key1 sig \\ \\ ?time2 sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig \\ sig)\"\n using `\\ ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time2 \\ keys (to_trans_raw_sig \\ sig)\"\n using `\\ ?time2 sig = Some (Bv v)`\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"\\k. ?key1 < k \\ k < ?time2 \\ k \\ keys (to_trans_raw_sig \\ sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis\n using `?key1 < ?time2` assms(5) unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n hence \"\\ ?key1 sig \\ Some (Bv v)\"\n using \\\\ (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) sig =\n Some (Bv v)\\ \\\\ (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly\n \\ \\ n sig = Some (Bv v)) \\ \\ n sig \\ None) sig \\ None\\ by auto\n thus ?thesis\n unfolding to_signal_def comp_def using inf_some\n by (metis (no_types, lifting) \\\\ (GREATEST n. t < n \\ n < (GREATEST n. n \\ t + dly \\\n \\ n sig = Some (Bv v)) \\ \\ n sig \\ None) sig \\ None\\ not_None_eq option.sel\n option.simps(5) to_trans_raw_sig_def)\n qed\n hence \"snd \\ sig (?time2 - 1) \\ (Bv v)\"\n using `t < ?time2` unfolding assms(1) worldline_raw_def by (simp add: leD)\n thus \"?time2 \\ t + dly \\ snd \\ sig (?time2 - 1) \\ (Bv v) \\ snd \\ sig ?time2 = (Bv v)\"\n using \\(GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) \\ t + dly\\\n \\snd \\ sig (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v)) = (Bv v)\\ by blast\n next\n fix y\n assume \"y \\ t + dly \\ snd \\ sig (y - 1) \\ (Bv v) \\ snd \\ sig y = (Bv v)\"\n hence \"y \\ t + dly\" and \"snd \\ sig (y - 1) \\ (Bv v)\" and \"snd \\ sig y = (Bv v)\"\n by auto\n have \"?time2 \\ t + dly\" and \"\\ ?time2 sig = Some (Bv v)\"\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ \\ n sig = Some (Bv v)\" and b=\"t + dly\"]\n exist_mapping by auto\n hence \"t < ?time2\"\n by (metis (no_types, lifting) \\\\n. n \\ t \\ \\ n = 0\\ leI\n option.distinct(1) zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time2\"\n using `t < ?time2` by linarith }\n moreover\n { assume \"t < y\"\n hence \"snd \\ sig (y - 1) = signal_of (\\ sig) \\ sig (y - 1)\"\n unfolding assms(1) worldline_raw_def by auto\n hence 0: \"... \\ (Bv v)\"\n using `snd \\ sig (y - 1) \\ (Bv v)` by auto\n have \"snd \\ sig y = signal_of (\\ sig) \\ sig y\"\n unfolding assms(1) worldline_raw_def using `t < y` by auto\n hence 1: \"... = (Bv v)\"\n using `snd \\ sig y = (Bv v)` `t < y` by auto\n have \"\\ y sig = Some (Bv v)\"\n proof (rule ccontr)\n assume \"\\ \\ y sig = Some (Bv v)\"\n then obtain x' where \"\\ y sig = None \\ \\ y sig = Some x' \\ x' \\ (Bv v)\"\n using domIff by fastforce\n moreover\n { assume \"\\ y sig = None\"\n hence \"signal_of (\\ sig) \\ sig y = signal_of (\\ sig) \\ sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False by auto }\n moreover\n { assume \"\\ y sig = Some x' \\ x' \\ (Bv v)\"\n hence \"signal_of (\\ sig) \\ sig y = x'\" and \"x' \\ (Bv v)\"\n using trans_some_signal_of' by fastforce+\n with 1 have False by auto }\n ultimately show False by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time2\"\n by (metis (mono_tags, lifting) Greatest_le_nat) }\n ultimately show \"y \\ ?time2\"\n by auto\n qed\n thus \"t' < (GREATEST n. n \\ t + dly \\ \\ n sig = Some (Bv v))\"\n using \\t' < (GREATEST n. n \\ t + dly \\ snd \\ sig (n - 1) \\ (Bv v) \\ snd \\ sig n = (Bv v))\\\n by linarith\n qed\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = \\ s'\"\n by auto\n with l have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t' \"\n using `s' = sig` by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t'\"\n by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (\\[sig, t, dly := (Bv v)]) s' t'\"\n by auto }\n ultimately show \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Bv v)) s' t' \"\n by (simp add: assms(1) worldline_inert_upd_def worldline_raw_def)\nqed (simp add: assms(1) worldline_inert_upd_def worldline_raw_def)\n\nlemma to_bit_signal_of_eq:\n \"signal_of (Bv (bs ! b)) (to_trans_raw_bit (Lv sign bs) \\ b sig) sig t = v \\ to_bit b (signal_of (Lv sign bs) \\ sig t) = v\"\n by (metis (no_types, lifting) to_bit_signal_of' val.case_eq_if val.collapse(1) val.distinct(1) val.sel(3))\n\nlemma non_stuttering_to_trans_raw_bit:\n assumes \" non_stuttering (to_trans_raw_sig \\) \\ sig\"\n shows \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) (to_bit b o \\) sig\"\n unfolding non_stuttering_def\nproof (rule)+\n fix k1 k2 :: nat\n assume \"k1 < k2 \\\n k1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\\n k2 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\\n (\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig))\"\n hence \"k1 < k2\" and \"k1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\" \n and \"k2 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\" \n and *: \"(\\k. k1 < k \\ k < k2 \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig))\"\n by auto\n hence \"to_trans_raw_bit (\\ sig) \\ b sig k1 sig \\ None\" and \"to_trans_raw_bit (\\ sig) \\ b sig k2 sig \\ None\" and \"0 < k2\"\n unfolding keys_def to_trans_raw_sig_def by (auto simp add: zero_option_def)\n hence \"\\ k2 sig \\ None\" and \"to_bit b (signal_of (\\ sig) \\ sig (k2 - 1)) \\ to_bit b (the (\\ k2 sig))\"\n unfolding to_trans_raw_bit_def by (auto split: option.splits)\n have \" inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (k2 - 1) = Some k1\"\n proof (rule inf_time_someI)\n show \" k1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using \\ k1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \n unfolding dom_def keys_def zero_option_def by auto\n next\n show \"k1 \\ k2 - 1\" using \\k1 < k2\\ by auto\n next\n show \"\\t\\dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). t \\ k2 - 1 \\ t \\ k1\"\n using * unfolding dom_def keys_def zero_option_def using leI by force\n qed\n hence \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (k2 - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k1)\"\n unfolding to_bit_signal_of'_eq[THEN sym] to_signal_def comp_def by auto\n moreover have \" the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k2) = to_bit b (the (\\ k2 sig))\"\n using \\0 < k2\\ \\to_bit b (signal_of (\\ sig) \\ sig (k2 - 1)) \\ to_bit b (the (\\ k2 sig))\\\n unfolding to_trans_raw_sig_def to_trans_raw_bit_def using \\\\ k2 sig \\ None\\ by auto\n ultimately have \"to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k1 \\ to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k2\"\n using to_bit_signal_of'_eq \n using \\to_bit b (signal_of (\\ sig) \\ sig (k2 - 1)) \\ to_bit b (the (\\ k2 sig))\\ by fastforce\n moreover assume \"to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k1 = to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig k2\"\n ultimately show False\n by auto\nnext\n { assume ex: \" keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ {}\"\n let ?time = \"(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig))\"\n have \"?time \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using ex by (meson LeastI all_not_in_conv)\n have \"\\ ?time sig \\ None\"\n proof -\n have \"\\n v. to_trans_raw_bit v \\ n sig (LEAST n. n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ None}) sig \\ None\"\n by (metis \\(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ domD dom_def keys_def option.simps(3) to_trans_raw_sig_def zero_option_def)\n then have \"\\ (LEAST n. n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ None}) sig \\ None\"\n by (smt option.simps(4) to_trans_raw_bit_def)\n then show ?thesis\n by (simp add: keys_def zero_option_def)\n qed\n have \"?time = 0 \\ ?time \\ 0\"\n by auto\n moreover\n { assume \"?time = 0\"\n hence \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time sig) \\ to_bit b (\\ sig)\"\n unfolding to_trans_raw_bit_def \n proof -\n assume a1: \"(LEAST k. k \\ keys (to_trans_raw_sig (\\n siga. if siga \\ sig then \\ n siga else case \\ n siga of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ siga (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) = 0\"\n have \"0 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using \\(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) = 0\\ \\(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ by presburger\n then have \"to_trans_raw_bit (\\ sig) \\ b sig 0 sig \\ None\"\n by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n then have f2: \"(case \\ 0 sig of None \\ None | Some v \\ if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b v then None else if to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) \\ None\"\n by (smt option.case_eq_if to_trans_raw_bit_def) \n then have f3: \"\\ 0 sig \\ None\"\n by (metis option.case_eq_if)\n obtain vv :: \"val option \\ val\" where\n \"\\z za v. (z = None \\ Some (vv z) = z) \\ (za \\ None \\ za \\ Some (v::val))\"\n by (metis (full_types) not_None_eq)\n then have f4: \"\\z za f. z = None \\ (case z of None \\ za::val option | Some x \\ f x) = f (vv z)\"\n by (metis (full_types) option.case_eq_if option.sel)\n then have f5: \"(if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b (vv (\\ 0 sig)) then None else if to_bit b (\\ sig) = to_bit b (vv (\\ 0 sig)) then None else Some (to_bit b (vv (\\ 0 sig)))) \\ None \\ \\ 0 sig = None\"\n using f2 by smt\n { assume \"(if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b (vv (\\ 0 sig)) then None else if True \\ to_bit b (\\ sig) = to_bit b (vv (\\ 0 sig)) then None else Some (to_bit b (vv (\\ 0 sig)))) \\ Some (to_bit b (\\ sig))\"\n have \"\\ 0 sig \\ None \\ the (if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b (vv (\\ 0 sig)) then None else if True \\ to_bit b (\\ sig) = to_bit b (vv (\\ 0 sig)) then None else Some (to_bit b (vv (\\ 0 sig)))) \\ to_bit b (\\ sig)\"\n using f5 f3 by force }\n then have \"\\ 0 sig \\ None \\ the (if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b (vv (\\ 0 sig)) then None else if True \\ to_bit b (\\ sig) = to_bit b (vv (\\ 0 sig)) then None else Some (to_bit b (vv (\\ 0 sig)))) \\ to_bit b (\\ sig)\"\n by simp\n then have \"the (if False then \\ 0 sig else case \\ 0 sig of None \\ None | Some v \\ if (0::nat) < 0 \\ to_bit b (signal_of (\\ sig) \\ sig (0 - 1)) = to_bit b v then None else if to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) \\ to_bit b (\\ sig)\"\n using f4 by (metis (no_types, lifting))\n then show \"the (if sig \\ sig then \\ (LEAST n. n \\ keys (to_trans_raw_sig (\\n a. if a \\ sig then \\ n a else case \\ n a of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ a (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) sig else case \\ (LEAST n. n \\ keys (to_trans_raw_sig (\\n a. if a \\ sig then \\ n a else case \\ n a of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ a (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) sig of None \\ None | Some v \\ if 0 < (LEAST n. n \\ keys (to_trans_raw_sig (\\n a. if a \\ sig then \\ n a else case \\ n a of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ a (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) \\ to_bit b (signal_of (\\ sig) \\ sig ((LEAST n. n \\ keys (to_trans_raw_sig (\\n a. if a \\ sig then \\ n a else case \\ n a of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ a (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) - 1)) = to_bit b v then None else if (LEAST n. n \\ keys (to_trans_raw_sig (\\n a. if a \\ sig then \\ n a else case \\ n a of None \\ None | Some v \\ if 0 < n \\ to_bit b (signal_of (\\ sig) \\ a (n - 1)) = to_bit b v then None else if n = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) sig)) = 0 \\ to_bit b (\\ sig) = to_bit b v then None else Some (to_bit b v)) \\ to_bit b (\\ sig)\"\n using a1 by presburger\n qed\n hence \" (to_bit b o \\) sig \\ the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time)\"\n proof -\n have f1: \"\\n. n \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ 0\"\n by (simp add: keys_def)\n have \"\\v n. \\b. to_bit n v = Bv b\"\n by (metis to_bit.elims)\n then obtain bb :: \"val \\ nat \\ bool\" where\n f2: \"\\n v. to_bit n v = Bv (bb v n)\"\n by moura\n moreover\n { assume \"\\n. Bv (bb (\\ sig) n) \\ \\ sig\"\n then have \"\\f v. Some (\\ sig) = Some (f sig) \\ signal_of v (to_trans_raw_bit (\\ sig) \\ b sig) sig (LEAST n. n \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) \\ f sig\"\n using f2 by (metis to_bit.simps(1) to_bit_signal_of')\n then have \"the (to_trans_raw_bit (\\ sig) \\ b sig (LEAST n. n \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) sig) \\ \\ sig\"\n using f1 by (metis \\(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ option.collapse to_trans_raw_sig_def trans_some_signal_of' zero_option_def) }\n ultimately show ?thesis\n by (metis \\the (to_trans_raw_bit (\\ sig) \\ b sig (LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) sig) \\ to_bit b (\\ sig)\\ comp_apply to_trans_raw_sig_def)\n qed }\n moreover\n { assume \"?time \\ 0\"\n hence \" to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) \\ to_bit b (the (\\ ?time sig))\"\n using \\?time \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\\n unfolding to_trans_raw_sig_def keys_def to_trans_raw_bit_def by (smt mem_Collect_eq neq0_conv option.case_eq_if zero_option_def)\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) = (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b))\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (rule signal_of_def)\n fix n \n assume \"n \\ ?time - 1\"\n thus \" to_trans_raw_bit (\\ sig) \\ b sig n sig = 0\"\n proof -\n have \"n \\ (LEAST n. n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ 0}) - 1\"\n by (metis \\n \\ (LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) - 1\\ keys_def)\n then have f1: \"\\na. na \\ (LEAST n. n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ 0}) - 1 \\ \\ na \\ n\"\n by (meson le_trans)\n have \"(LEAST n. n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ 0}) \\ 0\"\n by (metis \\(LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)) \\ 0\\ keys_def)\n then have \"n \\ {n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig n \\ 0}\"\n using f1 by (metis Least_le diff_le_self le_antisym minus_eq zero_neq_one)\n then show ?thesis\n by (simp add: to_trans_raw_sig_def)\n qed\n qed\n ultimately have \"(to_bit b \\ \\) sig \\ to_bit b (the (\\ ?time sig))\"\n unfolding comp_def\n by (metis to_bit.simps(1) to_bit.simps(2) val.case_eq_if val.collapse(1) val.collapse(2))\n moreover have \" to_bit b (the (\\ ?time sig)) = the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time)\"\n using \\\\ ?time sig \\ None\\ \\to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) \\ to_bit b (the (\\ ?time sig))\\\n unfolding to_trans_raw_sig_def to_trans_raw_bit_def apply auto\n by (smt inf_time_at_most le_zero_eq option.exhaust option.sel option.simps(4) option.simps(5) to_signal_def) \n ultimately have \" (to_bit b \\ \\) sig \\ the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time)\"\n by auto }\n ultimately have \"(to_bit b \\ \\) sig \\\n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig\n (LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)))\"\n by auto }\n thus \"keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ {} \\\n (to_bit b \\ \\) sig \\\n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig\n (LEAST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)))\"\n by auto\nqed\n \nlemma lift_inr_post_worldline_upd2:\n assumes \"\\ = worldline_raw t \\ \\ def \\\"\n assumes \"context_invariant t \\ \\ \\ def \\\"\n assumes \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n assumes \"0 < dly\"\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n assumes \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assumes \"beval_world_raw \\ t exp (Lv sign bs)\"\n shows \"worldline_raw t \\ \\ def \\' = worldline_inert_upd2 \\ sig t dly (Lv sign bs)\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n fix s' t'\n have \"beval_raw t \\ \\ \\ def exp (Lv sign bs)\"\n using assms beval_beval_world_raw_ci by metis\n have \"\\' = inr_post_raw' sig (Lv sign bs) (\\ sig) \\ t dly\"\n using assms(3) \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b(Lv sign bs)\\ beval_raw_deterministic by (metis seq_cases_inert)\n moreover have \"beval_raw t \\ \\ \\ def exp = beval_world_raw \\ t exp\"\n using `\\ = worldline_raw t \\ \\ def \\ ` and `context_invariant t \\ \\ \\ def \\`\n by (simp add: assms(6) beval_beval_world_raw_ci)\n hence \\'_def: \"\\' = inr_post_raw' sig(Lv sign bs) (\\ sig) \\ t dly\"\n by (simp add: calculation)\n have \"context_invariant t \\ \\ \\ def \\'\"\n using b_seq_exec_preserves_context_invariant[OF assms(2-3)] `0 < dly` by auto\n\n have \"\\n. n \\ t \\ \\ n = 0\"\n using assms(2) unfolding context_invariant_def by auto\n have \"s' \\ sig \\ t' < t \\ s' = sig \\ t \\ t'\"\n by auto\n moreover\n { assume \"s' = sig \\ t \\ t'\"\n hence \"t + dly \\ t' \\ t' < t + dly\" and \"s' = sig\" and \"t \\ t'\"\n by auto\n moreover\n { assume \"t + dly \\ t'\"\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n unfolding worldline_raw_def snd_conv by auto\n also have \"... = signal_of (\\ s') (inr_post_raw' sig (Lv sign bs) (\\ sig) \\ t dly) s' t'\"\n unfolding \\'_def by auto\n also have \"... = signal_of (\\ s') (trans_post_raw sig (Lv sign bs) (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) t dly) s' t'\"\n unfolding inr_post_raw'_def by auto\n also have \"... = Lv sign bs\"\n unfolding `s' = sig`\n proof (intro signal_of_trans_post3)\n show \"t + dly \\ t'\"\n using `t + dly \\ t'` by auto\n next\n show \"\\i t dly sig (\\ sig) (Lv sign bs) i = 0\"\n using assms(2) unfolding purge_raw'_def combine_trans_bit_def context_invariant_def by auto\n next\n show \"0 < dly\"\n by (simp add: assms(4))\n qed\n also have \"... = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t'\"\n unfolding worldline_inert_upd2.simps snd_conv `s' = sig`\n proof -\n have \"bs = map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0..b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0.. sig i[sig, t, dly := Bv (bs ! i)] sig t')\"\n by auto\n also have \"... = bs ! i\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv\n proof (cases \"((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t = Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! i)\")\n case False\n hence \"((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t \\ Bv (bs ! i)\" and \n \"((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (t + dly) = Bv (bs ! i)\"\n by auto\n have *: \"\\k\\t + dly. ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (k - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig k = Bv (bs ! i) \"\n proof (rule ccontr)\n assume \"\\ (\\k\\t + dly. ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (k - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig k = Bv (bs ! i))\"\n hence ind: \"\\k. k \\ t + dly \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (k - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig k \\ Bv (bs ! i)\"\n by auto\n { fix k\n assume \"t \\ k\"\n assume \"k \\ t + dly\"\n hence \"((snd \\)(sig := to_bit i \\ snd \\ sig)) sig k \\ Bv (bs ! i)\"\n using ind `t \\ k` `((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t \\ Bv (bs ! i)`\n proof (induction \"k - t\" arbitrary: t dly)\n case 0\n then show ?case by auto\n next\n case (Suc x)\n hence 0: \"x = k - Suc t\" and 1: \"k \\ Suc t + (dly - 1)\"\n by linarith+\n have \"k = Suc x + t\"\n using Suc by linarith\n have 3: \"\\k. k \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (k - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig k \\ Bv (bs ! i)\"\n using Suc(4) \n by (metis (no_types, lifting) One_nat_def Suc.hyps(2) Suc.prems(1) Suc_pred add_Suc_shift less_add_same_cancel1 less_le_trans zero_less_Suc zero_less_diff)\n have 4: \"Suc t \\ k\"\n using \\k = Suc x + t\\ by linarith\n have 5: \"((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! i)\"\n using Suc by (metis \"3\" diff_Suc_1 le_add1)\n show ?case \n using Suc(1)[OF 0 1 3 4 5] by auto\n qed }\n with `((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (t + dly) = Bv (bs ! i)`\n show False\n by auto\n qed\n have \"(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig n = Bv (bs ! i)) \\ t + dly\"\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig n = Bv (bs ! i)\" and b=\"t + dly\", OF *]\n by auto\n thus \"bval_of (let time = if ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t = Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! i) then t + dly\n else GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig n = Bv (bs ! i)\n in if sig \\ sig \\ t' < t then ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t' else if t' < time then ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t else Bv (bs ! i)) = bs ! i\"\n using False using \\t + dly \\ t'\\ by auto\n next\n case True\n thus \"bval_of (let time = if ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t = Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! i) then t + dly\n else GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! i) \\ ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig n = Bv (bs ! i)\n in if sig \\ sig \\ t' < t then ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t' else if t' < time then ((snd \\)(sig := to_bit i \\ snd \\ sig)) sig t else Bv (bs ! i)) = bs ! i\"\n using \\t + dly \\ t'\\ by auto\n qed\n finally show \" bs ! i = map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0..)\n (sig :=\n \\n. let w' = \\b. snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)];\n time =\n if \\n>t. n \\ t + dly \\ (\\b\\set [0.. w' b sig n)\n then LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. w' b sig n) else t + dly\n in if n < t then snd \\ sig n\n else if n < time then snd \\ sig t else Lv sign (map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) [0..t \\ t'\\ \n proof ( cases \"\\n>t. n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)]) sig (n - 1) \\ snd (to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)]) sig n)\")\n case True\n let ?w' = \"\\b. snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)]\"\n have \"(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n)) \\ t + dly\"\n using True \n by (metis (mono_tags, lifting) LeastI_ex)\n then show ?thesis \n using True \\t + dly \\ t'\\ \\bs = map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0..\n by auto\n next\n case False\n then show ?thesis \n using \\t + dly \\ t'\\ \\bs = map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0..\n by auto\n qed\n qed\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t'\"\n by auto }\n moreover\n { assume \"t' < t + dly\"\n hence \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ s') \\' s' t'\"\n using `t \\ t'` unfolding worldline_raw_def snd_conv by auto \n also have \"... = signal_of (\\ s') (inr_post_raw' sig (Lv sign bs) (\\ sig) \\ t dly) s' t'\"\n unfolding \\'_def by auto \n also have \"... = signal_of (\\ s') (trans_post_raw sig (Lv sign bs) (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) t dly) s' t'\"\n unfolding inr_post_raw'_def by auto\n also have \"... = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n unfolding `s' = sig` signal_of_trans_post2[OF `t' < t + dly`] by auto\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n by auto\n let ?w' = \"\\b. snd (to_worldline_init_bit \\ sig b)[sig, t, dly := Bv (bs ! b)]\"\n have \"\\n>t. n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n) \\ \n \\ (\\n>t. n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n))\"\n by auto\n moreover\n { assume thereis: \"\\n>t. n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n)\"\n let ?zeit = \"LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n)\"\n define zeit where \"zeit = ?zeit\"\n have \"t < ?zeit\" and \"?zeit \\ t + dly\" and \"\\b\\set [0.. ?w' b sig ?zeit\"\n using LeastI_ex[OF thereis] by auto\n then obtain index where \"index \\ set [0..< length bs]\" and \"?w' index sig (?zeit - 1) \\ ?w' index sig ?zeit\"\n by auto\n have \"?w' index sig (zeit - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\"\n proof (cases \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index)\")\n case True\n then show ?thesis \n using \\?zeit \\ t + dly\\\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n by (smt One_nat_def Suc_leI Suc_pred \\(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) \\ t + dly\\ \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ diff_less le_eq_less_or_eq le_zero_eq less_numeral_extra(1) less_trans not_le zeit_def)\n next\n case False\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n by auto\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! index)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n thus False\n using False le_add1 by blast\n qed\n let ?time_again =\"GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n\n have \"t < ?time_again\"\n using * \n proof -\n have f1: \"\\p n na. (n::nat) \\ Greatest p \\ (\\n. \\ n \\ na \\ p n) \\ \\ p n\"\n by (metis (lifting) Greatest_le_nat)\n obtain nn :: nat where\n f2: \"Bv (bs ! index) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig nn \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn - 1) \\ nn \\ t + dly \\ t < nn\"\n by (metis (no_types) \"*\")\n then have \"nn \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n using f1 by force\n then show ?thesis\n using f2 by (meson less_le_trans)\n qed\n hence \"?time_again - 1 < ?time_again\"\n by auto\n have \"?time_again \\ t + dly\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time_again - 1) \\ Bv (bs ! index)\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig ?time_again = Bv (bs ! index)\"\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * by smt\n have \"?w' index sig (?time_again - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\"\n using \\t < ?time_again\\ \\?time_again - 1 < ?time_again\\ False\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n moreover have \"?w' index sig (?time_again) = Bv (bs ! index)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using False \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by auto\n ultimately have \"?w' index sig (?time_again - 1) \\ ?w' index sig ?time_again\"\n using False by auto\n hence \"?zeit \\ ?time_again\"\n proof -\n have \"t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly \\ (\\n. n \\ set [0.. snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) - 1) \\ snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)))\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly\\ \\index \\ set [0.. \\snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) - 1) \\ snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by blast\n then show ?thesis\n by (simp add: Bex_def_raw Least_le)\n qed\n \n show ?thesis \n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv\n by (smt False One_nat_def Suc_leI Suc_pred \\?zeit \\ ?time_again\\ \\t <\n (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig\n b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t,\n dly := Bv (bs ! b)] sig n))\\ le_eq_less_or_eq le_zero_eq lessI less_trans not_le\n zeit_def)\n qed\n also have \"... = (to_bit index \\ snd (worldline_raw t \\ \\ def \\) sig) t\"\n unfolding assms(1) fun_upd_def by auto\n also have \"... = to_bit index (signal_of (\\ sig) \\ sig t)\"\n unfolding worldline_raw_def snd_conv by auto\n finally have \"?w' index sig (zeit - 1) = to_bit index (signal_of (\\ sig) \\ sig t)\"\n by auto\n have \"\\ zeit < t\"\n using \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd\n to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ not_le zeit_def \n by linarith\n have \"\\ zeit - 1 < t\"\n using \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ zeit_def by linarith\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\"\n proof (rule ccontr)\n assume \"\\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t = Bv (bs ! index)\"\n by auto\n have \"zeit < t + dly \\ zeit = t + dly\"\n using \\(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) \\ t + dly\\ le_eq_less_or_eq zeit_def by blast \n moreover\n { assume \"zeit < t + dly\"\n hence \"?w' index sig zeit = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using \\\\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ \\\\ zeit < t\\ by auto\n hence False\n using \\?w' index sig (zeit - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\\n \\?w' index sig (?zeit - 1) \\ ?w' index sig (?zeit)\\ zeit_def by auto }\n moreover\n { assume \"zeit = t + dly\"\n hence \"?w' index sig zeit = Bv (bs ! index)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using \\\\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ by auto\n with \\?w' index sig (zeit - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\ have False\n unfolding \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t = Bv (bs ! index)\\\n using \\?w' index sig (zeit - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\\n \\?w' index sig (?zeit - 1) \\ ?w' index sig (?zeit)\\ zeit_def by auto }\n ultimately show False\n by auto\n qed\n hence \"?w' index sig (zeit - 1) \\ Bv (bs ! index)\"\n using \\snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig (zeit -\n 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\ by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index) \\ zeit = t + dly\"\n proof (rule ccontr)\n assume as: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index)\"\n assume \"\\ zeit = t + dly\" hence \"zeit < t + dly\"\n using \\?zeit \\ t + dly\\ unfolding zeit_def by auto\n hence \"?w' index sig zeit = ?w' index sig (zeit - 1)\"\n using \\\\ zeit < t\\ \\\\ zeit - 1 < t\\ as\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n thus False\n using \\?w' index sig (?zeit - 1) \\ ?w' index sig ?zeit\\ unfolding zeit_def\n by auto\n qed\n have \"?w' index sig (zeit) = Bv (bs ! index) \"\n proof (cases \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index)\")\n case True\n then show ?thesis \n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index) \\ zeit = t + dly\\\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n next\n case False\n let ?time_again =\"GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n have cond1: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\" and cond2: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n using False using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ by blast+\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! index)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n thus False\n using False le_add1 by blast\n qed\n { assume \"\\ ?w' index sig zeit = Bv (bs ! index)\"\n hence \"zeit < ?time_again\"\n using cond1 cond2\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using \\\\ zeit < t\\ by presburger\n hence \"?w' index sig zeit = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\"\n using cond1 cond2\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n by (simp add: \\\\ zeit < t\\)\n hence \"?w' index sig zeit = ?w' index sig (zeit - 1)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t = (to_bit index \\ snd (worldline_raw t \\ \\ def \\) sig) t\\ \\(to_bit index \\ snd (worldline_raw t \\ \\ def \\) sig) t = to_bit index (signal_of (\\ sig) \\ sig t)\\ \\snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig (zeit - 1) = to_bit index (signal_of (\\ sig) \\ sig t)\\ by auto\n hence False\n using \\?w' index sig (?zeit - 1) \\ ?w' index sig (?zeit)\\ zeit_def \n by auto }\n thus ?thesis \n by auto\n qed\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ \n zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv\n proof -\n assume \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n let ?time_again =\"GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n have cond1: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\" and cond2: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ apply blast\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ by blast\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! index)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n thus False\n using cond2 le_add1 by blast\n qed \n have \"t < ?time_again\"\n using * \n proof -\n have f1: \"\\p n na. (n::nat) \\ Greatest p \\ (\\n. \\ n \\ na \\ p n) \\ \\ p n\"\n by (metis (lifting) Greatest_le_nat)\n obtain nn :: nat where\n f2: \"Bv (bs ! index) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig nn \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn - 1) \\ nn \\ t + dly \\ t < nn\"\n by (metis (no_types) \"*\")\n then have \"nn \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n using f1 by force\n then show ?thesis\n using f2 by (meson less_le_trans)\n qed\n hence \"?time_again - 1 < ?time_again\"\n by auto\n have \"?time_again \\ t + dly\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time_again - 1) \\ Bv (bs ! index)\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig ?time_again = Bv (bs ! index)\"\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * by smt\n have \"?w' index sig (?time_again - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\"\n using \\t < ?time_again\\ \\?time_again - 1 < ?time_again\\ cond1 cond2\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n moreover have \"?w' index sig (?time_again) = Bv (bs ! index)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using cond1 cond2 \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by auto\n ultimately have \"?w' index sig (?time_again - 1) \\ ?w' index sig ?time_again\"\n using cond1 cond2 by auto\n hence \"?zeit \\ ?time_again\"\n proof -\n have \"t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly \\ (\\n. n \\ set [0.. snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) - 1) \\ snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)))\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly\\ \\index \\ set [0.. \\snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) - 1) \\ snd to_worldline_init_bit \\ sig index[sig, t, dly := Bv (bs ! index)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by blast\n then show ?thesis\n by (simp add: Bex_def_raw Least_le)\n qed\n hence \"zeit \\ ?time_again\"\n unfolding zeit_def by auto\n moreover have \"\\ zeit < ?time_again\"\n by (smt One_nat_def Suc_leI Suc_pred \\?w' index sig (?time_again - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\ \n \\?w' index sig (?time_again) = Bv (bs ! index)\\ \\?w' index sig (zeit) = Bv (bs ! index)\\ \n \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig\n (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs !\n index))\\ \\t < ?zeit\\ cond1 gr_implies_not0\n leD not_less_iff_gr_or_eq prod.sel(2) worldline_inert_upd_def zeit_def)\n thus ?thesis\n using calculation le_eq_less_or_eq by blast\n qed\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ \n ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit) = Bv (bs ! index)\"\n proof -\n assume \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n hence \"zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by blast\n have cond1: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\" and cond2: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ apply blast\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ by blast\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t \\ Bv (bs ! index)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! index)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)\"\n by auto\n thus False\n using cond2 le_add1 by blast\n qed \n thus ?thesis\n proof -\n obtain nn :: \"(nat \\ bool) \\ nat \\ nat\" where\n f1: \"\\p n na nb. (\\ p n \\ p (Greatest p) \\ p (nn p na)) \\ (\\ p nb \\ \\ nn p na \\ na \\ p (Greatest p))\"\n by (metis (lifting) GreatestI_ex_nat)\n then have \"\\n na. (\\ n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n \\ Bv (bs ! index)) \\ zeit \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index) \\ nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) na \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) na - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) na) = Bv (bs ! index)\"\n by (smt \\zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\) \n moreover\n { assume \"\\n\\t + dly. ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)\"\n { assume \"\\n. (n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ (\\ zeit \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit \\ Bv (bs ! index))\"\n then have \"\\n. (n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ (\\ (GREATEST n. n \\ t + dly \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) - 1) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ Bv (bs ! index))\"\n using \\zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by force\n then have \"\\n. \\ nn (\\n. n \\ t + dly \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n - 1) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n) \\ Bv (bs ! index)\"\n using f1 by smt }\n then have \"(\\n. \\ nn (\\n. n \\ t + dly \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\) (sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n - 1) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (nn (\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) n) \\ Bv (bs ! index)) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index)\"\n by blast }\n ultimately show ?thesis\n using \"*\" by blast\n qed\n qed\n have \"\\b2. b2 < length bs \\ bval_of (snd to_worldline_init_bit \\ sig b2[sig, t, dly := Bv (bs ! b2)] sig t') = bval_of (to_bit b2 (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n proof-\n fix b\n assume \"b < length bs\"\n have *: \"bval_of (snd (to_worldline_init_bit \\ sig b)[sig, t, dly := Bv (bs ! b)] sig t') = bval_of\n (let time =\n if ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t = Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! b) then t + dly\n else GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)\n in if t' < time then ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t else Bv (bs ! b))\"\n using `t \\ t'` unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t = Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! b) \\ \n ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\"\n by auto\n moreover\n { assume \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t = Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! b)\"\n hence \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t)\"\n using `t' < t + dly` unfolding * by auto\n also have \"... = bval_of (to_bit b (signal_of (\\ sig) \\ sig t))\"\n unfolding assms(1) worldline_raw_def snd_conv by auto\n also have \"... = bval_of (to_bit b (\\ sig))\"\n proof -\n have \"inf_time (to_trans_raw_sig \\) sig t = None\"\n using assms(2) unfolding context_invariant_def \n proof -\n assume a1: \"(\\n\\t. \\ n = 0) \\ \\ = {s. \\ s \\ signal_of (def s) \\ s (t - 1)} \\ (\\n\\t. \\ n = 0)\"\n have \"\\f a n. \\na. (na \\ n \\ inf_time f (a::'a) n = None) \\ (na \\ keys (f a) \\ inf_time f a n = None)\"\n by (metis (lifting) inf_time_def)\n then obtain nn :: \"('a \\ nat \\ val option) \\ 'a \\ nat \\ nat\" where\n f2: \"\\f a n. (nn f a n \\ n \\ inf_time f a n = None) \\ (nn f a n \\ keys (f a) \\ inf_time f a n = None)\"\n by moura\n moreover\n { assume \"nn (to_trans_raw_sig \\) sig t \\ t\"\n then have \"\\ (nn (to_trans_raw_sig \\) sig t) sig = None\"\n using a1 by (simp add: zero_fun_def zero_option_def)\n then have ?thesis\n using f2 by (metis domIff dom_def keys_def to_trans_raw_sig_def zero_option_def) }\n ultimately show ?thesis\n by blast\n qed\n thus ?thesis\n unfolding to_signal_def comp_def by auto\n qed \n also have \"... = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n proof (cases \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t'\")\n case None\n then show ?thesis \n unfolding to_signal_def comp_def by auto\n next\n case (Some a)\n have \"t < a\"\n proof (rule ccontr)\n assume \"\\ t < a\" hence \"a \\ t\" by auto\n have \"a \\ keys (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)\" and \"a \\ t'\"\n using Some unfolding inf_time_def by (meson Some inf_time_some_exists)+\n hence \" purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ 0\"\n unfolding keys_def to_trans_raw_sig_def by auto\n hence \"\\ a sig \\ 0\"\n unfolding purge_raw'_def combine_trans_bit_def using `a \\ t` by auto\n with assms(2) show False\n unfolding context_invariant_def using `a \\ t` by (simp add: zero_fun_def)\n qed\n have \"a < t + dly\"\n using `t' < t + dly` by (meson Some inf_time_some_exists le_less_trans)\n have \"a \\ fold (\\)\n (map (keys \\ (\\\\ n. \\ n sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\)\n (map (keys \\ (\\\\ n. \\ n sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. t dly sig (\\ sig) (Lv sign bs) a sig \\ 0\"\n using inf_time_some_exists[OF Some] \n unfolding keys_def to_trans_raw_sig_def by auto\n moreover have \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = 0\"\n using anotin `a < t + dly` `t < a` unfolding purge_raw'_def combine_trans_bit_def zero_option_def\n Let_def to_trans_raw_sig_def by auto\n ultimately show False \n by auto\n qed\n hence \" (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig a) = Some\n (Lv sign \n (map (\\p. bval_of ((to_signal (get_time p) \\ (\\\\ sig n. \\ n sig)) (snd p) sig a))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..n. (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. sig of Bv b \\ b | Lv sign bs \\ bs ! b))\n (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) n) sig a))\"\n unfolding to_bit.simps comp_def nth_map[OF len] to_trans_raw_sig_def nth_zip[OF len2 len3] nth_map[OF len4] len5 fst_conv \n snd_conv by auto\n also have \"... = Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)\"\n proof -\n have \" to_bit b (signal_of (\\ sig) \\ sig t) = Bv (bs ! b) \\ to_bit b (signal_of (\\ sig) \\ sig (t + dly)) \\ Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t = Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! b)`\n unfolding assms(1) worldline_raw_def snd_conv by auto\n hence \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t = Bv (bs ! b) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) \\ Bv (bs ! b)\"\n unfolding to_bit_signal_of'_eq[THEN sym] by auto\n hence \"inf_time (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)))) sig a = None\"\n unfolding to_trans_raw_sig_def purge_raw_def comp_def\n using assms(2) unfolding context_invariant_def Let_def inf_time_none_iff[THEN sym]\n by (smt \\a < t + dly\\ domIff fun_upd_eqD fun_upd_triv greaterThanAtMost_iff leI\n le_trans less_imp_le_nat option.simps(4) override_on_apply_in\n override_on_apply_notin to_trans_raw_bit_def zero_fun_def zero_option_def)\n thus ?thesis\n unfolding to_signal_def comp_def by auto\n qed\n then show ?thesis \n unfolding to_signal_def comp_def\n by (smt Some \\Bv (bval_of (signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs !\n b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\\n b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a)) = Bv (case \\ sig of Bv b \\ b | Lv\n sign bs \\ bs ! b)\\ \\to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig\n a = Some (Lv sign (map (\\p. bval_of ((to_signal (get_time p) \\ (\\\\ sig n. \\ n sig))\n (snd p) sig a)) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))\n [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv\n (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..\n calculation option.sel option.simps(5) to_bit.simps(1) to_bit.simps(2) val.case_eq_if\n val.collapse(1) val.collapse(2))\n qed \n finally have \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n moreover\n { assume 1: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\"\n let ?time = \"(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n have exist: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b) \"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n hence ind: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n by auto\n { fix n\n assume \"n \\ t + dly\"\n assume \"t < n\"\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n using ind 1\n proof (induction \"n - t\" arbitrary: t dly)\n case 0\n then show ?case using 1 using le_eq_less_or_eq by auto\n next\n case (Suc m)\n hence h0: \"m = n - Suc t\"\n by linarith\n have h1: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n using Suc(4) by simp\n have h2: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (Suc t + (dly - 1)) = Bv (bs ! b)\"\n by (metis (no_types, lifting) Suc.prems(2) Suc.prems(3) Suc_pred add_Suc_shift diff_Suc_1 le_add1 le_eq_less_or_eq lessI less_add_same_cancel1)\n then show ?case \n using Suc.hyps(2) Suc.hyps(1) Suc.prems(1) Suc_lessI h0 h1 by blast\n qed }\n thus False\n using 1 \\t \\ t'\\ \\t' < t + dly\\ by auto\n qed\n hence exist': \"\\n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b) \"\n by auto\n have \"?time \\ t + dly\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time - 1) \\ Bv (bs ! b)\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time = Bv (bs ! b)\"\n using GreatestI_ex_nat[OF exist'] by auto\n have \"t < ?time\"\n proof (rule ccontr)\n assume \"\\ t < ?time\" hence \"?time \\ t\" by auto\n obtain n where \"t < n\" and \"n \\ t + dly\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b)\"\n and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)\" using exist by auto\n hence \"n \\ ?time\"\n using Greatest_le_nat[where k=\"n\" and b=\"t + dly\"] by auto\n with `t < n` and `?time \\ t` show False\n by auto\n qed\n have \"t' < ?time \\ ?time \\ t'\" by auto\n moreover \n { assume \"?time \\ t'\"\n hence \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = (bs ! b)\"\n unfolding * using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b) \\ ((snd \\)(sig :=\n to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\\ by auto\n also have \"... = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n proof (cases \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t'\")\n case None\n hence \"Ball (dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)) ((<) t')\"\n unfolding inf_time_none_iff[THEN sym] by auto\n have \"to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) \\ Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time - 1) \\ Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time = Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n ultimately have \"(to_trans_raw_bit (\\ sig) \\ b sig) ?time sig \\ None\"\n by (metis (no_types, lifting) signal_of_less_sig to_bit_signal_of' zero_option_def)\n have h0: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n have h1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n have exist_mapping: \"\\n>t. n \\ t + dly \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = Some (Bv (bs ! b))\"\n using switch_signal_ex_mapping_gen[OF h0 h1]\n by (simp add: \\\\n. n \\ t \\ \\ n = 0\\ to_trans_raw_bit_def zero_fun_def zero_option_def)\n have *: \"length (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. sig) \\ b sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?time sig \\ None \n \\ purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?time sig = None\"\n by auto\n moreover\n { assume purge_neq_none: \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?time sig \\ None\"\n hence time_in: \"?time \\ fold (\\) (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. t dly sig (\\ sig) (Lv sign bs) ?time sig = \n combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig\n (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n)))\n [0.. None\"\n unfolding combine_trans_bit_def \n using time_in \\?time \\ t + dly\\ \\t < ?time\\ by auto\n finally have False\n proof -\n assume a1: \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\"\n have \"\\ t' < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) \\ t'\\ leD by blast\n then show ?thesis\n using a1 by (simp add: \\Ball (dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)) ((<) t')\\ domIff to_trans_raw_sig_def)\n qed\n hence \" bs ! b = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n moreover\n { assume \"purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b)) ?time sig = None\"\n hence \"?time < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \n \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) < ?time\"\n using `t < ?time` `?time \\ t'` `t' < t + dly` h0 h1\n unfolding purge_raw_def Let_def \n by (smt Un_iff \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig \\ None\\ greaterThanAtMost_iff\n greaterThanLessThan_iff override_on_apply_notin)\n moreover have \"the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) < ?time \\ False\"\n proof -\n assume \"the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) < ?time\"\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) \\ None\"\n proof -\n have \"None \\ to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\\ to_trans_raw_sig_def)\n then show ?thesis\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) \\ t + dly\\ inf_time_noneE2 zero_option_def by fastforce\n qed\n then obtain time' where \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some time'\"\n by auto\n hence \"to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time = None\"\n using \\?time \\ t + dly\\ \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t +\n dly)) < ?time\\ inf_time_someE by fastforce\n with `(to_trans_raw_bit (\\ sig) \\ b sig) ?time sig \\ None` show False\n by (simp add: to_trans_raw_sig_def)\n qed\n ultimately have \"?time < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\" (is \"_ < ?time'\")\n by auto\n obtain val where \"to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val\" \n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig \\ None\\ by auto\n hence \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time = val\"\n using trans_some_signal_of'[where \\=\"to_trans_raw_bit (\\ sig) \\ b sig\" and n=\"?time\" and \\=\"(\\x. _)(sig:= val)\"]\n by auto\n hence \"val = Bv (bs ! b)\"\n using to_bit_signal_of'[OF \\to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\\]\n by auto\n have \"\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\"\n by (metis (mono_tags, lifting) \\?time \\ t + dly\\ \\\\thesis. (\\val.\n to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val \\ thesis) \\ thesis\\ keys_def\n mem_Collect_eq option.simps(3) to_trans_raw_sig_def zero_option_def)\n hence time'_eq: \"?time' = (GREATEST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ k \\ t + dly)\"\n unfolding inf_time_def by auto\n hence \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\" and \"?time' \\ t + dly\"\n using GreatestI_ex_nat \n by (metis (mono_tags, lifting) \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ inf_time_def inf_time_ex1 inf_time_some_exists)+\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = to_trans_raw_bit (\\ sig) \\ b sig ?time sig\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = to_trans_raw_bit (\\ sig) \\ b sig ?time sig\"\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time = val\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\" \"?time\" \"sig\" \"(\\x. _)(sig := val)\"]\n using \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig :=\n to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\\n snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val\\ by auto\n then obtain val' where \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some val'\"\n proof -\n assume \"\\val'. to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig = Some val' \\ thesis\"\n then show ?thesis\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ domIff dom_def keys_def not_None_eq to_trans_raw_sig_def zero_option_def)\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\" \"?time\" \"sig\" \"(\\x. _)(sig := val')\"] time'_eq\n by (meson trans_some_signal_of')\n also have \"... \\ val\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val\\ \\to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig = Some val'\\ \\to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig \\ to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig\\ by auto\n finally have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time' \\ \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time \"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) = val\\ by blast\n have \"t < ?time'\"\n using \\?time < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\ by linarith\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time') = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time'\"\n using `t < ?time'` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n moreover have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time\"\n using `t < ?time` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n ultimately have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time') \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time)\"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) \\ signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\ by auto\n \n have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\" \"?time'\" \"sig\" \"(\\x. _)(sig := val')\"] \\to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some val'\\\n by auto\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = \n inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)\"\n using time'_eq \n proof -\n obtain nn :: nat where\n f1: \"nn \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ nn \\ t + dly\"\n using \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ by blast\n have f2: \"to_signal (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! b)) (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Bv (bs ! b)\"\n using h1 by auto\n have f3: \"\\v n a f. to_signal v f (a::'a) n = the (f a (the (inf_time f a n))) \\ inf_time f a n = None\"\n by (simp add: option.case_eq_if to_signal_def)\n have f4: \"\\f. f (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)))) = f (Some val')\"\n by (metis (no_types) \\to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig = Some val'\\ to_trans_raw_sig_def)\n have \"Bv (bs ! b) \\ val'\"\n by (metis (no_types) \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) = Bv (bs ! b)\\ \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)))\\ \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\ \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = val'\\)\n then have f5: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = None\"\n using f4 f3 f2 option.sel \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig = Some val'\\ to_trans_raw_sig_def)\n have \"\\n. Some (GREATEST na. na \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ na \\ n) = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig n \\ \\ nn \\ n\"\n using f1 by (simp add: inf_time_def)\n then show ?thesis\n using f5 f1 by force\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time'\"\n unfolding to_signal_def comp_def by auto\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time' = Bv (bs ! b)\"\n using h1 by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time) = Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time) = Bv (bs ! b)\\ by blast\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time') = Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time') = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time'\\\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = Bv (bs ! b)\\ by auto\n show False\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) = Bv (bs ! b)\\ \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = Bv (bs ! b)\\ \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\ by auto\n qed\n have \"?time = ?time'\"\n proof (rule Greatest_equality)\n have \"t \\ ?time' - 1\" using \\?time < ?time'\\ \\t < ?time\\ by linarith\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (cases \"\\n. t < n \\ n < ?time' \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time' - 1 \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig = 0\"\n by (auto simp add: zero_option_def)\n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t\"\n using signal_of_less_ind'[of \"t\" \"?time' - 1\" \"to_trans_raw_bit (\\ sig) \\ b sig\" \"sig\", OF none] `t \\ ?time' - 1`\n by auto \n also have \"... \\ (Bv (bs ! b))\"\n using h0 to_bit_signal_of'_eq by force\n finally show \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time'\" and \" to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig x sig \\ None\" and b=\"?time'\"]\n by (smt \\t < (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (?time' - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time' - 1\"\n using `?key1 < ?time'` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n assume \"ta \\ ?time' - 1\"\n assume \"?key1 < ta\"\n hence \"to_trans_raw_bit (\\ sig) \\ b sig ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time' - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). ta \\ ?time' - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have non_stut: \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) (to_bit b o \\) sig\"\n using assms(5) non_stuttering_to_trans_raw_bit by force\n hence \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ to_trans_raw_bit (\\ sig) \\ b sig ?time' sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ by blast\n moreover have \"\\k. ?key1 < k \\ k < ?time' \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis \n using `?key1 < ?time'` non_stut unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n moreover have \"(to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Some (Bv (bs ! b))\"\n proof -\n have \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = the (to_trans_raw_bit (\\ sig) \\ b sig ?time sig)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = to_trans_raw_bit (\\ sig) \\ b sig ?time sig\\ by auto\n also have \"... = Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val\\ \\val = Bv (bs ! b)\\ by auto\n finally show ?thesis\n using \\to_trans_raw_bit (\\ sig) \\ b sig (?time) sig = Some val\\\n \\to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig = to_trans_raw_bit\n (\\ sig) \\ b sig (?time) sig\\ by auto\n qed\n ultimately have neq: \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ Some (Bv (bs ! b))\"\n by auto\n then obtain valu where \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) = Some valu\" and \"valu \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?key1)\"\n using inf_some unfolding to_signal_def comp_def\n by auto\n also have \"... \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ neq \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. t < n \\ n < the\n (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\n \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None) sig = Some valu\\ option.sel\n to_trans_raw_sig_def)\n finally show \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by blast\n qed\n ultimately have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) = to_bit b (signal_of (\\ sig) \\ sig (?time' - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence *: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b)\"\n using \\to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n using \\t \\ ?time' - 1\\ exist_mapping\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = Some (Bv (bs ! b))\" and b=\"t + dly\"]\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val\\ \n \\to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = to_trans_raw_bit (\\ sig) \\ b sig ?time sig\\ \\val = Bv (bs ! b)\\ by auto\n have \"to_bit b (signal_of (\\ sig) \\ sig ?time') = (Bv (bs ! b))\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\", OF `to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))`]\n using to_bit_signal_of'_eq by fastforce\n hence \" ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = Bv (bs ! b)\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def \n using \\t \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) - 1\\ by auto\n thus \"?time' \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b) \\\n ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time' = Bv (bs ! b)\" \n using * `?time' \\ t + dly` by auto \n next\n have \"t \\ ?time' - 1\" using \\?time < ?time'\\ \\t < ?time\\ by linarith\n fix y\n assume \"y \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\"\n hence \"y \\ t + dly\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y) = Bv (bs ! b)\"\n by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n using \\t \\ ?time' - 1\\ exist_mapping\n using GreatestI_ex_nat[where P=\"\\n. n \\ t + dly \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = Some (Bv (bs ! b))\" and b=\"t + dly\"]\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val\\ \n \\to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = to_trans_raw_bit (\\ sig) \\ b sig ?time sig\\ \\val = Bv (bs ! b)\\ by auto\n hence \"t < ?time'\"\n by (meson \\t < ?time\\ \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) \\ False\\ le_less_trans not_le)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time'\" using `t < ?time'` by linarith }\n moreover\n { assume \"t < y\"\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) = to_bit b (signal_of (\\ sig) \\ sig (y - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 0: \"... \\ (Bv (bs ! b))\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\\ by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = to_bit b (signal_of (\\ sig) \\ sig y)\"\n using `t < y` unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 1: \"... = Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n then obtain x' where \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None \\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n using domIff by fastforce\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None\"\n hence \"signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = \n signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig y sig = None\\ signal_of_less_sig to_bit_signal_of' zero_option_def) }\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n hence \"signal_of ((Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = x'\" and \"x' \\ (Bv (bs ! b))\"\n using trans_some_signal_of' by fastforce+\n with 1 have False \n unfolding to_bit_signal_of'_eq by auto }\n ultimately show False\n by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time'\"\n unfolding time'_eq \n apply (intro Greatest_le_nat)\n unfolding keys_def to_trans_raw_sig_def zero_option_def by auto }\n ultimately show \"y \\ ?time'\"\n by auto\n qed\n hence False\n using `?time < ?time'` by auto\n hence \" bs ! b = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n ultimately show \" bs ! b = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto\n next\n case (Some a)\n hence \"signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = the (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig)\"\n by (simp add: to_signal_def to_trans_raw_sig_def)\n have \"\\t\\dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig). t \\ t' \\ t \\ a\"\n using inf_time_someE[OF Some] by auto\n have \"to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) \\ Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time - 1) \\ Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time = Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n ultimately have \"(to_trans_raw_bit (\\ sig) \\ b sig) ?time sig \\ None\"\n by (metis (no_types, lifting) signal_of_less_sig to_bit_signal_of' zero_option_def)\n have h0: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n have h1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n let ?time' = \"the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\"\n obtain val where \"to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val\" \n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig \\ None\\ by auto\n have \"\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\"\n by (metis (mono_tags, lifting) \\?time \\ t + dly\\ \\\\thesis. (\\val.\n to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val \\ thesis) \\ thesis\\ keys_def\n mem_Collect_eq option.simps(3) to_trans_raw_sig_def zero_option_def)\n hence time'_eq: \"?time' = (GREATEST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ k \\ t + dly)\"\n unfolding inf_time_def by auto\n hence \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\" and \"?time' \\ t + dly\"\n using GreatestI_ex_nat \n by (metis (mono_tags, lifting) \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ inf_time_def inf_time_ex1 inf_time_some_exists)+\n have \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\"\n proof -\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some ?time'\"\n by (simp add: \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ inf_time_def)\n thus \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\"\n using h1 unfolding to_signal_def comp_def \n by (metis option.simps(5) to_trans_raw_sig_def)\n qed\n have \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time sig) = Bv (bs ! b)\"\n proof- \n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time = Bv (bs ! b)\"\n using \\to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\\\n unfolding to_bit_signal_of'_eq[THEN sym] by auto\n moreover have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig ?time = Some ?time\"\n proof (intro inf_time_someI)\n show \"?time \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n proof -\n have \"to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\"\n by (metis (full_types) \\\\thesis. (\\val. to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val \\ thesis) \\ thesis\\ option.simps(3))\n then show ?thesis\n by (simp add: domIff to_trans_raw_sig_def)\n qed\n qed (auto)\n ultimately show ?thesis\n unfolding to_signal_def comp_def \n by (simp add: to_trans_raw_sig_def)\n qed\n have \"?time = ?time'\"\n proof (rule Greatest_equality)\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (cases \"\\n. t < n \\ n < ?time' \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time' - 1 \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig = 0\"\n by (auto simp add: zero_option_def)\n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t\"\n using signal_of_less_ind'[of \"t\" \"?time' - 1\" \"to_trans_raw_bit (\\ sig) \\ b sig\" \"sig\", OF none] `t \\ ?time' - 1`\n by auto \n also have \"... \\ (Bv (bs ! b))\"\n using h0 to_bit_signal_of'_eq by force\n finally show \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time'\" and \" to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig x sig \\ None\" and b=\"?time'\"]\n by (smt \\t < (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (?time' - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time' - 1\"\n using `?key1 < ?time'` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n assume \"ta \\ ?time' - 1\"\n assume \"?key1 < ta\"\n hence \"to_trans_raw_bit (\\ sig) \\ b sig ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time' - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). ta \\ ?time' - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have non_stut: \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) (to_bit b o \\) sig\"\n using assms(5) non_stuttering_to_trans_raw_bit by force\n hence \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ to_trans_raw_bit (\\ sig) \\ b sig ?time' sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ by blast\n moreover have \"\\k. ?key1 < k \\ k < ?time' \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis \n using `?key1 < ?time'` non_stut unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n moreover have \"(to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n ultimately have neq: \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ Some (Bv (bs ! b))\"\n by auto\n then obtain valu where \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) = Some valu\" and \"valu \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?key1)\"\n using inf_some unfolding to_signal_def comp_def\n by auto\n also have \"... \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ neq \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. t < n \\ n < the\n (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\n \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None) sig = Some valu\\ option.sel\n to_trans_raw_sig_def)\n finally show \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by blast\n qed\n ultimately have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) = to_bit b (signal_of (\\ sig) \\ sig (?time' - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence *: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b)\"\n using \\to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n have \"to_bit b (signal_of (\\ sig) \\ sig ?time') = (Bv (bs ! b))\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\", OF `to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))`]\n using to_bit_signal_of'_eq by fastforce\n hence \" ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = Bv (bs ! b)\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def \n using \\t \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) - 1\\ by auto\n thus \"?time' \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b) \\\n ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time' = Bv (bs ! b)\" \n using * `?time' \\ t + dly` by auto \n next\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n fix y\n assume \"y \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\"\n hence \"y \\ t + dly\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y) = Bv (bs ! b)\"\n by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n hence \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig) = Bv (bs ! b)\\ \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val\\ \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\\ leI option.sel option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time'\" using `t < ?time'` by linarith }\n moreover\n { assume \"t < y\"\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) = to_bit b (signal_of (\\ sig) \\ sig (y - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 0: \"... \\ (Bv (bs ! b))\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\\ by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = to_bit b (signal_of (\\ sig) \\ sig y)\"\n using `t < y` unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 1: \"... = Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n then obtain x' where \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None \\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n using domIff by fastforce\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None\"\n hence \"signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = \n signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig y sig = None\\ signal_of_less_sig to_bit_signal_of' zero_option_def) }\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n hence \"signal_of ((Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = x'\" and \"x' \\ (Bv (bs ! b))\"\n using trans_some_signal_of' by fastforce+\n with 1 have False \n unfolding to_bit_signal_of'_eq by auto }\n ultimately show False\n by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time'\"\n unfolding time'_eq \n apply (intro Greatest_le_nat)\n unfolding keys_def to_trans_raw_sig_def zero_option_def by auto }\n ultimately show \"y \\ ?time'\"\n by auto\n qed\n have \"?time' \\ a\"\n proof (rule ccontr)\n have len_map: \"length (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. length bs - 0\"\n by auto\n assume \"\\ ?time' \\ a\" hence \"a \\ ?time'\" by auto\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) ?time' sig = None\"\n using Some \\\\t\\dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig). t \\ t' \\ t \\ a\\\n by (metis `?time = ?time'` \\?time \\ t'\\ \\\\ ?time' \\ a\\ domIff to_trans_raw_sig_def)\n hence \"?time' \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..?time = ?time'\\ \\t < ?time\\ \\?time \\ t + dly\\ by auto\n hence \"?time' \\ keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n using \\b < length bs\\ unfolding map_map[THEN sym] map_snd_zip_take length_map min.idem length_upt take_all[OF len_map] member_fold_union2 by auto\n moreover have \"to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (\\siga n. to_trans_raw_bit (\\ sig) \\ b sig n siga) sig (t + dly))) sig \\ 0\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ unfolding keys_def to_trans_raw_sig_def by auto\n ultimately show \"False\"\n using h0 h1\n unfolding to_trans_raw_sig_def keys_def purge_raw_def Let_def by auto\n qed\n have \"t < a\"\n proof (rule ccontr)\n assume \"\\ t < a\" hence \"a \\ t\" by auto\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = None\"\n unfolding purge_raw'_def combine_trans_bit_def Let_def \n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n with Some show False\n by (metis (mono_tags, lifting) inf_time_some_exists keys_def mem_Collect_eq to_trans_raw_sig_def zero_option_def)\n qed\n have \"a \\ t + dly\"\n using Some by (meson \\t' < t + dly\\ inf_time_some_exists le_trans less_imp_le_nat)\n have ainset: \"a \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. t dly sig (\\ sig) (Lv sign bs) a sig = None\"\n using `t < a` `a \\ t + dly` unfolding purge_raw'_def combine_trans_bit_def Let_def by auto\n with Some show False\n by (metis (mono_tags, lifting) inf_time_some_exists keys_def mem_Collect_eq to_trans_raw_sig_def zero_option_def)\n qed\n have \" purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = \n combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..p. bval_of (signal_of (get_time p) (snd p) sig a))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. t + dly` unfolding combine_trans_bit_def by auto\n finally have \"to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t') = Bv (?list ! b)\"\n using \\signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = the (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig)\\ by auto\n also have \"... = Bv (bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a))\"\n using `b < length bs` by (simp add: val.case_eq_if)\n finally have imp: \"bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t')) = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a)\"\n by auto\n have \"a \\ keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig) \\\n a \\ keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n by auto\n moreover\n { assume ainkeys2: \"a \\ keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n hence cond0: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b)\"\n using \\t < a\\ \\a \\ t + dly\\ unfolding purge_raw_def to_trans_raw_sig_def keys_def Let_def override_on_def \n using zero_option_def by auto\n moreover have cond1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n using ainkeys2 \\t < a\\ \\a \\ t + dly\\ unfolding purge_raw_def to_trans_raw_sig_def keys_def Let_def override_on_def \n using zero_option_def fun_upd_eqD by fastforce\n ultimately have somea: \"Some a = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)\"\n using ainkeys2 unfolding purge_raw_def\n by (metis Some \\a \\ t + dly\\ \\t < a\\ \\t' < t + dly\\ ainkeys2 domIff dom_def inf_time_some_exists keys_def le_antisym not_le purge_raw_neq_0_imp to_trans_raw_sig_def zero_option_def)\n hence \"inf_time (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)))) sig a = Some a\"\n apply (intro inf_time_someI)\n by(metis ainkeys2 dom_def keys_def zero_option_def)auto\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a = \n the (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a)\"\n unfolding to_signal_def comp_def by auto\n also have \"... = the (to_trans_raw_bit (\\ sig) \\ b sig a sig)\"\n using cond0 cond1 somea unfolding to_trans_raw_sig_def purge_raw_def Let_def override_on_def \n by (smt UnE \\inf_time (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b\n sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs !\n b)))) sig a = Some a\\ greaterThanAtMost_iff greaterThanLessThan_iff\n inf_time_at_most leD option.sel)\n also have \"... = Bv (bs ! b)\"\n using cond1 somea unfolding to_signal_def comp_def by (metis option.simps(5) to_trans_raw_sig_def)\n finally have \" bs ! b = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n using imp by auto }\n moreover\n { assume anotinkeys2: \"a \\ keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n have \"inf_time (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)))) sig a = Some ?time'\"\n proof (rule inf_time_someI)\n have \"\\y. to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (\\siga n. to_trans_raw_bit (\\ sig) \\ b sig n siga) sig (t + dly))) sig = Some y\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ unfolding keys_def to_trans_raw_sig_def \n by (simp add: zero_option_def)\n thus \"?time' \\ dom (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n using h0 h1\n unfolding to_trans_raw_sig_def dom_def purge_raw_def Let_def by auto\n next\n show \"?time' \\ a\" using \\?time' \\ a\\ by auto\n next\n show \"\\ta\\dom (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig).\n ta \\ a \\ ta \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\"\n using h0 h1 \\?time' \\ a\\\n unfolding purge_raw_def Let_def to_trans_raw_sig_def dom_def using \\a \\ t + dly\\ leI by fastforce\n qed\n hence \"(signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a) = \n the (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig ?time')\"\n using \\the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\\ unfolding to_signal_def comp_def by auto\n also have \"... = the (to_trans_raw_bit (\\ sig) \\ b sig (?time') sig)\"\n using h0 h1 unfolding to_trans_raw_sig_def purge_raw_def Let_def by auto\n also have \"... = (Bv (bs ! b))\"\n using \\the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\\ by auto\n finally have \"bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a) = bs ! b\"\n by auto\n hence \" bs ! b = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n using imp by auto }\n ultimately show ?thesis \n by auto\n qed\n finally have \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n moreover\n { assume \"t' < ?time\"\n hence \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = bval_of ( ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t)\"\n unfolding * using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b) \\ ((snd \\)(sig :=\n to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\\ by auto\n also have \"... = bval_of (to_bit b (snd \\ sig t))\"\n unfolding fun_upd_def by auto\n also have \"... = bval_of (to_bit b (signal_of (\\ sig) \\ sig t))\"\n unfolding assms(1) worldline_raw_def by auto\n also have \"... = bval_of (to_bit b (\\ sig))\"\n by (metis (full_types, hide_lams) assms(2) context_invariant_def signal_of_def zero_fun_def)\n finally have \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (\\ sig))\"\n by auto\n also have \"... = bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n proof (cases \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t'\")\n case None\n then show ?thesis \n unfolding to_signal_def comp_def by auto\n next\n case (Some a)\n hence \"signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = the (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig)\"\n by (simp add: to_signal_def to_trans_raw_sig_def)\n have \"\\t\\dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig). t \\ t' \\ t \\ a\"\n using inf_time_someE[OF Some] by auto\n have \"to_bit b (signal_of (\\ sig) \\ sig (?time - 1)) \\ Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time - 1) \\ Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\"\n using `((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time = Bv (bs ! b)` `?time \\ t + dly` `t < ?time`\n unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by presburger\n ultimately have \"(to_trans_raw_bit (\\ sig) \\ b sig) ?time sig \\ None\"\n by (metis (no_types, lifting) signal_of_less_sig to_bit_signal_of' zero_option_def)\n have h0: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n have h1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n using 1 unfolding to_bit_signal_of'_eq assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n using to_bit_signal_of'_eq by fastforce\n let ?time' = \"the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\"\n obtain val where \"to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val\" \n using \\to_trans_raw_bit (\\ sig) \\ b sig ?time sig \\ None\\ by auto\n have \"\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\"\n by (metis (mono_tags, lifting) \\?time \\ t + dly\\ \\\\thesis. (\\val.\n to_trans_raw_bit (\\ sig) \\ b sig ?time sig = Some val \\ thesis) \\ thesis\\ keys_def\n mem_Collect_eq option.simps(3) to_trans_raw_sig_def zero_option_def)\n hence time'_eq: \"?time' = (GREATEST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig) \\ k \\ t + dly)\"\n unfolding inf_time_def by auto\n hence \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\" and \"?time' \\ t + dly\"\n using GreatestI_ex_nat \n by (metis (mono_tags, lifting) \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ inf_time_def inf_time_ex1 inf_time_some_exists)+\n have \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\"\n proof -\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some ?time'\"\n by (simp add: \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). k \\ t + dly\\ inf_time_def)\n thus \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Bv (bs ! b)\"\n using h1 unfolding to_signal_def comp_def \n by (metis option.simps(5) to_trans_raw_sig_def)\n qed\n have \"the (to_trans_raw_bit (\\ sig) \\ b sig ?time sig) = Bv (bs ! b)\"\n proof - \n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig ?time = Bv (bs ! b)\"\n using \\to_bit b (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! b)\\ unfolding to_bit_signal_of'_eq[THEN sym] by auto\n moreover have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig ?time = Some ?time\"\n proof (intro inf_time_someI)\n show \"?time \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n proof -\n have \"to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\"\n by (metis (full_types) \\\\thesis. (\\val. to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val \\ thesis) \\ thesis\\ option.simps(3))\n then show ?thesis\n by (simp add: domIff to_trans_raw_sig_def)\n qed\n qed (auto)\n ultimately show ?thesis\n unfolding to_signal_def comp_def by (simp add: to_trans_raw_sig_def)\n qed\n have \"?time = ?time'\"\n proof (rule Greatest_equality)\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n moreover have \"to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (cases \"\\n. t < n \\ n < ?time' \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time' - 1 \\ (to_trans_raw_bit (\\ sig) \\ b sig) n sig = 0\"\n by (auto simp add: zero_option_def)\n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t\"\n using signal_of_less_ind'[of \"t\" \"?time' - 1\" \"to_trans_raw_bit (\\ sig) \\ b sig\" \"sig\", OF none] `t \\ ?time' - 1`\n by auto \n also have \"... \\ (Bv (bs ! b))\"\n using h0 to_bit_signal_of'_eq by force\n finally show \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time'\" and \" to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time' \\ to_trans_raw_bit (\\ sig) \\ b sig x sig \\ None\" and b=\"?time'\"]\n by (smt \\t < (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (?time' - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time' - 1\"\n using `?key1 < ?time'` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n assume \"ta \\ ?time' - 1\"\n assume \"?key1 < ta\"\n hence \"to_trans_raw_bit (\\ sig) \\ b sig ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time' - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig). ta \\ ?time' - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have non_stut: \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) (to_bit b o \\) sig\"\n using assms(5) non_stuttering_to_trans_raw_bit by force\n hence \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ to_trans_raw_bit (\\ sig) \\ b sig ?time' sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ by blast\n moreover have \"\\k. ?key1 < k \\ k < ?time' \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis \n using `?key1 < ?time'` non_stut unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n moreover have \"(to_trans_raw_bit (\\ sig) \\ b sig ?time' sig) = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n ultimately have neq: \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) \\ Some (Bv (bs ! b))\"\n by auto\n then obtain valu where \"(to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig) = Some valu\" and \"valu \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig ?key1)\"\n using inf_some unfolding to_signal_def comp_def\n by auto\n also have \"... \\ Bv (bs ! b)\"\n using \\to_trans_raw_bit (\\ sig) \\ b sig ?key1 sig \\ None\\ neq \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ b sig n sig \\ None) sig = Some valu\\ option.sel to_trans_raw_sig_def)\n finally show \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (?time' - 1) \\ (Bv (bs ! b))\"\n by blast\n qed\n ultimately have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) = to_bit b (signal_of (\\ sig) \\ sig (?time' - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence *: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b)\"\n using \\to_bit b (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n have \"to_bit b (signal_of (\\ sig) \\ sig ?time') = (Bv (bs ! b))\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ b sig\", OF `to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))`]\n using to_bit_signal_of'_eq by fastforce\n hence \" ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) = Bv (bs ! b)\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def \n using \\t \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) - 1\\ by auto\n thus \"?time' \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time' = Bv (bs ! b)\" \n using * `?time' \\ t + dly` by auto \n next\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n fix y\n assume \"y \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\"\n hence \"y \\ t + dly\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\" and \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y) = Bv (bs ! b)\"\n by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig ?time' sig = Some (Bv (bs ! b))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))) sig) = Bv (bs ! b)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n hence \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\the (to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig) = Bv (bs ! b)\\ \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig = Some val\\ \\to_trans_raw_bit (\\ sig) \\ b sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) sig \\ None\\ leI option.sel option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time'\" using `t < ?time'` by linarith }\n moreover\n { assume \"t < y\"\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) = to_bit b (signal_of (\\ sig) \\ sig (y - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 0: \"... \\ (Bv (bs ! b))\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! b)\\ by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = to_bit b (signal_of (\\ sig) \\ sig y)\"\n using `t < y` unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 1: \"... = Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig y = Bv (bs ! b)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some (Bv (bs ! b))\"\n then obtain x' where \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None \\ to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n using domIff by fastforce\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = None\"\n hence \"signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = \n signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ b sig) sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False \n by (metis \\to_trans_raw_bit (\\ sig) \\ b sig y sig = None\\ signal_of_less_sig to_bit_signal_of' zero_option_def) }\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ b sig y sig = Some x' \\ x' \\ (Bv (bs ! b))\"\n hence \"signal_of ((Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))) (to_trans_raw_bit (\\ sig) \\ b sig) sig y = x'\" and \"x' \\ (Bv (bs ! b))\"\n using trans_some_signal_of' by fastforce+\n with 1 have False \n unfolding to_bit_signal_of'_eq by auto }\n ultimately show False\n by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time'\"\n unfolding time'_eq \n apply (intro Greatest_le_nat)\n unfolding keys_def to_trans_raw_sig_def zero_option_def by auto }\n ultimately show \"y \\ ?time'\"\n by auto\n qed\n have \"a < ?time'\"\n using Some \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n\n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) =\n the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\\\n \\t' < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1)\n \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\\n inf_time_some_exists by fastforce\n have \"t < a\"\n proof (rule ccontr)\n assume \"\\ t < a\" hence \"a \\ t\" by auto\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = None\"\n unfolding purge_raw'_def combine_trans_bit_def Let_def \n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n with Some show False\n by (metis (mono_tags, lifting) inf_time_some_exists keys_def mem_Collect_eq to_trans_raw_sig_def zero_option_def)\n qed\n have \"a \\ t + dly\"\n using Some by (meson \\t' < t + dly\\ inf_time_some_exists le_trans less_imp_le_nat)\n have ainset: \"a \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. t dly sig (\\ sig) (Lv sign bs) a sig = None\"\n using `t < a` `a \\ t + dly` unfolding purge_raw'_def combine_trans_bit_def Let_def by auto\n with Some show False\n by (metis (mono_tags, lifting) inf_time_some_exists keys_def mem_Collect_eq to_trans_raw_sig_def zero_option_def)\n qed\n have \" purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = \n combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..p. bval_of (signal_of (get_time p) (snd p) sig a))\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. t + dly` unfolding combine_trans_bit_def by auto\n finally have \"to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t') = Bv (?list ! b)\"\n using \\signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = the (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig)\\ by auto\n also have \"... = Bv (bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a))\"\n using `b < length bs` by (simp add: val.case_eq_if)\n finally have imp: \"bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t')) = \n bval_of (signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) \n (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a)\"\n by auto\n have \"inf_time (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b)))) sig a = None\"\n proof (unfold inf_time_none_iff[THEN sym], rule)\n fix x\n assume \"x \\ dom (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig)\"\n thus \"a < x\"\n using h0 h1 `a < ?time'` assms(2) \n unfolding context_invariant_def dom_def to_trans_raw_sig_def purge_raw_def Let_def \n by (smt Un_iff fun_upd_eqD fun_upd_triv greaterThanLessThan_iff leI le_less_trans mem_Collect_eq option.case_eq_if override_on_apply_in override_on_apply_notin to_trans_raw_bit_def zero_fun_def zero_option_def)\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) sig a = \n (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))\" \n unfolding to_signal_def comp_def by auto\n moreover have \"to_bit b (\\ sig) = (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! b))\"\n by (auto split: val.splits)\n ultimately show ?thesis\n unfolding imp by auto \n qed\n finally have \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n ultimately have \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto }\n ultimately show \"bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t') = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto \n qed\n have \"?zeit \\ t' \\ t' < ?zeit\"\n by auto\n moreover\n { assume \"?zeit \\ t'\"\n have \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = \n Lv sign (map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0..t \\ t'\\ \\?zeit \\ t'\\ thereis by auto\n hence midway: \"\\b. b < length bs \\ lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t') ! b = \n bval_of (snd (to_worldline_init_bit \\ sig b)[sig, t, dly := Bv (bs ! b)] sig t')\"\n by auto\n hence midway2: \"\\b. b < length bs \\ lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t') ! b = \n bval_of (to_bit b (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n using \\\\ba. ba < length bs \\ bval_of (snd to_worldline_init_bit \\ sig ba[sig, t, dly :=\n Bv (bs ! ba)] sig t') = bval_of (to_bit ba (signal_of (\\ sig) (purge_raw' \\ t dly sig\n (\\ sig) (Lv sign bs)) sig t'))\\ by blast\n have \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' \\ None\"\n unfolding inf_time_none_iff[THEN sym]\n proof (rule)\n assume \"Ball (dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)) ((<) t')\"\n hence \"\\x\\dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig). t' < x\"\n by auto\n have helper: \"length (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n))\n (Bv (bs ! n)))\n [0.. length bs - 0\"\n by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index) \\ \n ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n by auto\n moreover\n { assume \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index)\"\n hence \"zeit = t + dly\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index) \\ zeit = t + dly\\ by blast\n hence \"?zeit = t + dly\"\n unfolding zeit_def by auto\n with \\t' < t + dly\\ \\?zeit \\ t'\\ have \"False\"\n by linarith }\n moreover\n { assume \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\"\n hence zeit_def': \"zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig t \\ Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t) \\ Bv (bs ! index)\\\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def to_bit_signal_of'_eq by auto\n moreover have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def to_bit_signal_of'_eq by auto\n let ?time' = \" the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))\"\n let ?time = \"(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\"\n have \"?time \\ t + dly\"\n using \\(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) \\ t'\\ \\t' < t + dly\\ \\zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ zeit_def by linarith\n have \"t < ?time\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ zeit_def by linarith\n have \"to_bit index (signal_of (\\ sig) \\ sig (?time - 1)) \\ Bv (bs ! index)\"\n using `?w' index sig (zeit - 1) \\ Bv (bs ! index)` unfolding \\?w' index sig (zeit - 1) = ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig t\\\n using `?time \\ t + dly` `t < ?time` zeit_def zeit_def' unfolding assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by (smt \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index) \\ False\\ \\\\ zeit - 1 < t\\ assms(1) fun_upd_same o_apply prod.sel(2) worldline_raw_def) \n moreover have \"to_bit index (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! index)\"\n using `?time \\ t + dly` `t < ?time`\n assms(1) comp_def fun_upd_def worldline_raw_def snd_conv \n by (smt \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ leD less_or_eq_imp_le)\n ultimately have \"(to_trans_raw_bit (\\ sig) \\ index sig) ?time sig \\ None\"\n by (metis (no_types, lifting) signal_of_less_sig to_bit_signal_of' zero_option_def)\n obtain val where \"to_trans_raw_bit (\\ sig) \\ index sig ?time sig = Some val\" \n using \\to_trans_raw_bit (\\ sig) \\ index sig ?time sig \\ None\\ by auto\n have \"\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig). k \\ t + dly\"\n proof -\n have \"to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) = Some val\"\n by (metis \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig = Some val\\ to_trans_raw_sig_def)\n then have \"\\n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig n \\ None \\ n \\ t + dly\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) \\ t + dly\\ by blast\n then show ?thesis\n by (simp add: keys_def zero_option_def)\n qed\n hence time'_eq: \"?time' = (GREATEST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig) \\ k \\ t + dly)\"\n unfolding inf_time_def by auto\n hence \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\" and \"?time' \\ t + dly\"\n using GreatestI_ex_nat \n by (metis (mono_tags, lifting) \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig). k \\ t + dly\\ inf_time_def inf_time_ex1 inf_time_some_exists)+\n have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = to_trans_raw_bit (\\ sig) \\ index sig ?time sig\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = to_trans_raw_bit (\\ sig) \\ index sig ?time sig\"\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time = val\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ index sig\" \"?time\" \"sig\" \"(\\x. _)(sig := val)\"]\n using \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig :=\n to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\\n snd \\ sig)) sig n = Bv (bs ! index)) sig = Some val\\ by auto\n then obtain val' where \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = Some val'\"\n proof -\n assume \"\\val'. to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = Some val' \\ thesis\"\n then show ?thesis\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\\ domIff dom_def keys_def not_None_eq to_trans_raw_sig_def zero_option_def)\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ index sig\" \"?time\" \"sig\" \"(\\x. _)(sig := val')\"] time'_eq\n by (meson trans_some_signal_of')\n also have \"... \\ val\"\n using \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd\n \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig\n := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig = Some val\\\n \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = Some val'\\\n using \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig \\ to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig\\ by auto\n finally have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time' \\ \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time \"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index))\n (to_trans_raw_bit (\\ sig) \\ index sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig\n := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig :=\n to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) = val\\ by blast\n have \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = Some val'\\ leI option.simps(3) option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time') = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time'\"\n using `t < ?time'` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n moreover have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time\"\n using `t < ?time` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n ultimately have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time') \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time)\"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) \\ signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by auto \n have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ index sig\" \"?time'\" \"sig\" \"(\\x. _)(sig := val')\"] \\to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = Some val'\\\n by auto\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) = \n inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)\"\n using time'_eq \n proof -\n obtain nn :: nat where\n f1: \"nn \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig) \\ nn \\ t + dly\"\n using \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig). k \\ t + dly\\ by blast\n have f2: \"to_signal (Bv (case \\ sig of Bv b \\ b | Lv s bs \\ bs ! index)) (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly) = Bv (bs ! index)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\\ by auto\n have f3: \"\\v n a f. to_signal v f (a::'a) n = the (f a (the (inf_time f a n))) \\ inf_time f a n = None\"\n by (simp add: option.case_eq_if to_signal_def)\n have f4: \"\\f. f (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)))) = f (Some val')\"\n by (metis \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = Some val'\\ to_trans_raw_sig_def)\n have \"Bv (bs ! index) \\ val'\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) = val\\ \\val' \\ val\\ by auto\n then have f5: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly) = None\"\n using f4 f3 f2 option.sel \n by (metis \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = Some val'\\ to_trans_raw_sig_def)\n have \"\\n. Some (GREATEST na. na \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig) \\ na \\ n) = inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig n \\ \\ nn \\ n\"\n using f1 by (simp add: inf_time_def)\n then show ?thesis\n using f5 f1 by force\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time'\"\n unfolding to_signal_def comp_def by auto\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time' = Bv (bs ! index)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\\ by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time) = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (zeit - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig zeit = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index)\\ by blast\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time') = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)))\\ \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) = Bv (bs ! index)\\ by auto\n show False\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) = Bv (bs ! index)\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ by auto\n qed\n have h1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\\ by blast\n have \"the (to_trans_raw_bit (\\ sig) \\ index sig ?time' sig) = Bv (bs ! index)\"\n proof -\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly) = Some ?time'\"\n by (simp add: \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig). k \\ t + dly\\ inf_time_def)\n thus \"the (to_trans_raw_bit (\\ sig) \\ index sig ?time' sig) = Bv (bs ! index)\"\n using h1 unfolding to_signal_def comp_def by (metis option.simps(5) to_trans_raw_sig_def)\n qed\n have \"the (to_trans_raw_bit (\\ sig) \\ index sig ?time sig) = Bv (bs ! index)\"\n proof- \n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig ?time = Bv (bs ! index)\"\n using \\to_bit index (signal_of (\\ sig) \\ sig (?time)) = Bv (bs ! index)\\\n unfolding to_bit_signal_of'_eq[THEN sym] by auto\n moreover have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig ?time = Some ?time\"\n proof (intro inf_time_someI)\n show \"?time \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n proof -\n have \"\\v. to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig = Some v\"\n by (metis \\\\thesis. (\\val. to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig = Some val \\ thesis) \\ thesis\\)\n then show ?thesis\n by (simp add: domIff to_trans_raw_sig_def)\n qed\n qed (auto)\n ultimately show ?thesis\n unfolding to_signal_def comp_def \n by (simp add: to_trans_raw_sig_def)\n qed\n have \"?time = ?time'\"\n proof (rule Greatest_equality)\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n moreover have \"to_bit index (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! index)\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (cases \"\\n. t < n \\ n < ?time' \\ (to_trans_raw_bit (\\ sig) \\ index sig) n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time' - 1 \\ (to_trans_raw_bit (\\ sig) \\ index sig) n sig = 0\"\n by (auto simp add: zero_option_def)\n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (?time' - 1) = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig t\"\n using signal_of_less_ind'[of \"t\" \"?time' - 1\" \"to_trans_raw_bit (\\ sig) \\ index sig\" \"sig\", OF none] `t \\ ?time' - 1`\n by auto \n also have \"... \\ (Bv (bs ! index))\"\n using to_bit_signal_of'_eq \n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig t \\ Bv (bs ! index)\\ by blast\n finally show \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (?time' - 1) \\ (Bv (bs ! index))\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ index sig n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time'\" and \" to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ index sig n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time' \\ to_trans_raw_bit (\\ sig) \\ index sig x sig \\ None\" and b=\"?time'\"]\n by (smt \\t < (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ index sig n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (?time' - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time' - 1\"\n using `?key1 < ?time'` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n assume \"ta \\ ?time' - 1\"\n assume \"?key1 < ta\"\n hence \"to_trans_raw_bit (\\ sig) \\ index sig ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time' - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig). ta \\ ?time' - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have non_stut: \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) (to_bit index o \\) sig\"\n using assms(5) non_stuttering_to_trans_raw_bit by force\n hence \"(to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig) \\ to_trans_raw_bit (\\ sig) \\ index sig ?time' sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n using \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\\ by blast\n moreover have \"\\k. ?key1 < k \\ k < ?time' \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis \n using `?key1 < ?time'` non_stut unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n moreover have \"(to_trans_raw_bit (\\ sig) \\ index sig ?time' sig) = Some (Bv (bs ! index))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index\n sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\\n index sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig) = Bv (bs ! index)\\\n domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n ultimately have neq: \"(to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig) \\ Some (Bv (bs ! index))\"\n by auto\n then obtain valu where \"(to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig) = Some valu\" and \"valu \\ Bv (bs ! index)\"\n using \\to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig \\ None\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (?time' - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig ?key1)\"\n using inf_some unfolding to_signal_def comp_def\n by auto\n also have \"... \\ Bv (bs ! index)\"\n using \\to_trans_raw_bit (\\ sig) \\ index sig ?key1 sig \\ None\\ neq \n by (metis \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ index sig n sig \\ None) sig = Some valu\\ option.sel to_trans_raw_sig_def)\n finally show \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (?time' - 1) \\ (Bv (bs ! index))\"\n by blast\n qed\n ultimately have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time' - 1) = to_bit index (signal_of (\\ sig) \\ sig (?time' - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence *: \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! index)\"\n using \\to_bit index (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! index)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = Some (Bv (bs ! index))\"\n using \\the (to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig) = Bv (bs ! index)\\\n \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig :=\n to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit\n index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig \\ None\\ \\to_trans_raw_bit (\\ sig)\n \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index\n sig)) sig (t + dly))) sig = to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\\n t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index)\n \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig\\ by\n force\n have \"to_bit index (signal_of (\\ sig) \\ sig ?time') = (Bv (bs ! index))\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ index sig\", OF `to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = Some (Bv (bs ! index))`]\n using to_bit_signal_of'_eq by fastforce\n hence \" ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) = Bv (bs ! index)\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def \n using \\t \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) - 1\\ by auto\n thus \"?time' \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig ?time' = Bv (bs ! index)\" \n using * `?time' \\ t + dly` by auto \n next\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n fix y\n assume \"y \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig y = Bv (bs ! index)\"\n hence \"y \\ t + dly\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! index)\" and \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (y) = Bv (bs ! index)\"\n by auto\n have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig = Some (Bv (bs ! index))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig) = Bv (bs ! index)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n hence \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig \\ None\\ \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig\\ leI option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time'\" using `t < ?time'` by linarith }\n moreover\n { assume \"t < y\"\n hence \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (y - 1) = to_bit index (signal_of (\\ sig) \\ sig (y - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 0: \"... \\ (Bv (bs ! index))\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! index)\\ by auto\n have \"((snd \\)(sig := to_bit index \\ snd \\ sig)) sig y = to_bit index (signal_of (\\ sig) \\ sig y)\"\n using `t < y` unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 1: \"... = Bv (bs ! index)\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig y = Bv (bs ! index)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ index sig y sig = Some (Bv (bs ! index))\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ index sig y sig = Some (Bv (bs ! index))\"\n then obtain x' where \"to_trans_raw_bit (\\ sig) \\ index sig y sig = None \\ to_trans_raw_bit (\\ sig) \\ index sig y sig = Some x' \\ x' \\ (Bv (bs ! index))\"\n using domIff by fastforce\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ index sig y sig = None\"\n hence \"signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ index sig) sig y = \n signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ index sig) sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False \n by (metis \\to_trans_raw_bit (\\ sig) \\ index sig y sig = None\\ signal_of_less_sig to_bit_signal_of' zero_option_def) }\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ index sig y sig = Some x' \\ x' \\ (Bv (bs ! index))\"\n hence \"signal_of ((Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! index))) (to_trans_raw_bit (\\ sig) \\ index sig) sig y = x'\" and \"x' \\ (Bv (bs ! index))\"\n using trans_some_signal_of' by fastforce+\n with 1 have False \n unfolding to_bit_signal_of'_eq by auto }\n ultimately show False\n by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time'\"\n unfolding time'_eq \n apply (intro Greatest_le_nat)\n unfolding keys_def to_trans_raw_sig_def zero_option_def by auto }\n ultimately show \"y \\ ?time'\"\n by auto \n qed\n have \"purge_raw (to_trans_raw_bit (\\ sig) \\ index sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (Bv (bs ! index)) zeit sig \\ 0\"\n proof -\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig t \\ Bv (bs ! index)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig t \\ Bv (bs ! index)\\ by blast\n moreover have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! index)) (to_trans_raw_bit (\\ sig) \\ index sig) sig (t + dly) = Bv (bs ! index)\"\n using h1 by blast\n moreover have \"to_trans_raw_bit (\\ sig) \\ index sig ?time' sig \\ None\"\n using \\to_trans_raw_bit (\\ sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd\n \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig\n := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index)) sig \\ None\\\n \\to_trans_raw_bit (\\ sig) \\ index sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ index sig)) sig (t + dly))) sig = to_trans_raw_bit (\\\n sig) \\ index sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\\n sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig))\n sig n = Bv (bs ! index)) sig\\ by auto\n ultimately show ?thesis\n using \\?time = ?time'\\ unfolding purge_raw_def Let_def \n by (smt UnE \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs !\n index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\\n sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig))\n sig n = Bv (bs ! index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t +\n dly) \\ Bv (bs ! index) \\ False\\ greaterThanAtMost_iff greaterThanLessThan_iff\n order_less_irrefl override_on_apply_notin zero_option_def)\n qed\n hence \"\\x\\{0.. keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ x sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! x)) (Bv (bs ! x))) sig)\"\n apply (intro bexI[where x=\"index\"])\n unfolding to_trans_raw_sig_def keys_def apply blast\n using \\index \\ set [0.. set_upt by blast\n hence \"zeit \\ fold (\\) (map keys (map (\\\\. to_trans_raw_sig \\ sig) (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. fold (\\) (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. None\"\n unfolding combine_trans_bit_def \n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\\n zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n\n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs !\n index))\\ \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) \\ Bv (bs ! index)\n \\ False\\ \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig\n (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv\n (bs ! index)) \\ t + dly\\ \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd\n to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ zeit_def by\n fastforce\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) zeit sig \\ None\"\n unfolding purge_raw'_def by auto\n hence False\n by (metis (full_types) \\(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) \\ t'\\ \\\\x\\dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig). t' < x\\ domIff not_le to_trans_raw_sig_def zeit_def) }\n ultimately show False\n by auto\n qed\n have \"(\\list. signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = Lv sign list \\ length list = length bs)\"\n proof (cases \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t'\")\n case None \n then show ?thesis \n using \\inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' \\ None\\ by auto\n next\n case (Some a)\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\"\n by (metis domIff dom_def inf_time_some_exists keys_def to_trans_raw_sig_def zero_option_def)\n have \"a \\ t + dly\"\n by (meson Some \\t' < t + dly\\ inf_time_at_most le_less_trans less_imp_le_nat)\n have \"t < a\"\n using assms(2) \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ \n unfolding context_invariant_def purge_raw'_def \n by (metis \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ leI purge_raw_before_now_unchanged' zero_fun_def zero_option_def)\n then obtain list where \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = Some (Lv sign list) \\ length list = length bs\"\n using \\a \\ t + dly\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ unfolding purge_raw'_def \n combine_trans_bit_def by (smt leD length_map length_zip map_nth min.idem val.simps(6))\n then show ?thesis \n using Some unfolding to_signal_def comp_def to_trans_raw_sig_def by auto\n qed\n then obtain list where \"(signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = Lv sign list \\ length list = length bs)\"\n by auto\n have \" \n lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t') = \n lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t')\" \n proof (intro nth_equalityI)\n have \"length (lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t')) = length bs\"\n using \\snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = Lv sign (map (\\b.\n bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t'))\n [0.. by auto \n also have \"... = length (lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n proof (cases \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t'\")\n case None\n hence \"signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = (\\ sig)\"\n unfolding to_signal_def comp_def by auto\n then show ?thesis \n using None \\inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' \\ None\\ by blast\n next\n case (Some a)\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\"\n by (metis domIff dom_def inf_time_some_exists keys_def to_trans_raw_sig_def zero_option_def)\n have \"a \\ t + dly\"\n by (meson Some \\t' < t + dly\\ inf_time_at_most le_less_trans less_imp_le_nat)\n have \"t < a\"\n using assms(2) \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ \n unfolding context_invariant_def purge_raw'_def \n by (metis \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ leI purge_raw_before_now_unchanged' zero_fun_def zero_option_def)\n then obtain list where \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig = Some (Lv sign list) \\ length list = length bs\"\n using \\a \\ t + dly\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) a sig \\ None\\ unfolding purge_raw'_def \n combine_trans_bit_def by (smt leD length_map length_zip map_nth min.idem val.simps(6))\n then show ?thesis \n using Some by (simp add: to_signal_def to_trans_raw_sig_def)\n qed\n finally show \"length (lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t')) = length (lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto\n next\n fix i\n assume \" i < length (lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t'))\"\n hence \"i < length bs\"\n using \\snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = Lv sign (map (\\b.\n bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t'))\n [0.. by auto \n have \"lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t') ! i = list ! i\"\n using \\inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' \\ None\\ \\signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = Lv sign list \\ length list = length bs \\ by auto\n also have \"... = bval_of (to_bit i (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n using \\i < length bs\\ \n using \\inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' \\ None\\ \\signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = Lv sign list \\ length list = length bs \\ by auto\n finally have \"lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t') ! i = \n bval_of (to_bit i (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'))\"\n by auto\n thus \"lval_of (snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t') ! i = lval_of (signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t') ! i\"\n using midway2 \\i < length bs\\ by blast\n qed\n hence \" snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n using \\signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = Lv sign list \\ length list = length bs\\ \\snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = Lv sign (map (\\b. bval_of (snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig t')) [0.. \n by auto }\n moreover\n { assume \"t' < ?zeit\"\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = snd \\ sig t\"\n unfolding worldline_inert_upd2.simps snd_conv \\s' = sig\\ Let_def fun_upd_def\n using thereis by (simp add: \\t \\ t'\\ leD)\n also have \"... = signal_of (\\ sig) \\ sig t\"\n unfolding assms(1) worldline_raw_def snd_conv by auto\n also have \"... = \\ sig\"\n by (metis \\\\n. n \\ t \\ \\ n = 0\\ signal_of_def zero_fun_def)\n finally have \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = \\ sig\"\n by auto\n have \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' = None\"\n unfolding inf_time_none_iff[THEN sym]\n proof \n { fix x \n assume \"x \\ t'\"\n assume \"x \\ dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)\"\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\"\n unfolding to_trans_raw_sig_def dom_def by auto\n hence comb: \"combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. None\"\n unfolding purge_raw'_def by auto\n have help_len: \"length (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. length bs - 0\"\n by auto\n have \"\\xa\\{0.. keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa))) sig)\"\n unfolding keys_def to_trans_raw_sig_def\n proof \n fix xa\n assume \"xa \\ {0.. sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t = Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) \\ Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\"\n by auto\n moreover\n { assume \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t = Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) \\ Bv (bs ! xa)\"\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa)) x sig = 0\"\n unfolding purge_raw_def Let_def zero_option_def \n apply (cases \"x \\ t\")\n apply (metis \\\\n. n \\ t \\ \\ n = 0\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\\ purge_raw_before_now_unchanged' zero_fun_def zero_option_def)\n using \\t' < t + dly\\ \\x \\ t'\\ by auto }\n moreover\n { assume \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\"\n hence \"purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa)) x sig = \n override_on (to_trans_raw_bit (\\ sig) \\ xa sig) (\\n. (to_trans_raw_bit (\\ sig) \\ xa sig n)(sig := None))\n ({t<.. sig) \\ xa sig)) sig (t + dly))} \n \\ {the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))<..t + dly}) x sig\"\n unfolding purge_raw_def Let_def zero_option_def by auto\n also have \"... = None\"\n proof (cases \"x \\ t\")\n case True\n thus ?thesis\n by (metis \\\\n. n \\ t \\ \\ n = 0\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\\ purge_raw_before_now_unchanged' zero_fun_def zero_option_def)\n next\n case False\n have \"x < ?zeit\"\n using \\t' < ?zeit\\ \\x \\ t'\\ dual_order.strict_trans2 by blast\n also have \"... \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))\"\n proof -\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig t \\ Bv (bs ! xa)\" and \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (t + dly) = Bv (bs ! xa)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\\\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def to_bit_signal_of'_eq by auto\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n \\ Bv (bs ! xa)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n \\ Bv (bs ! xa)\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig t \\ Bv (bs ! xa)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! xa)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n \\ Bv (bs ! xa)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n \\ Bv (bs ! xa)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n \\ Bv (bs ! xa)\"\n by auto\n thus False\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (t + dly) = Bv (bs ! xa)\\ le_add1 by blast\n qed\n let ?time_again =\"GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)\" \n have \"t < ?time_again\"\n using * \n proof -\n have f1: \"\\p n na. (n::nat) \\ Greatest p \\ (\\n. \\ n \\ na \\ p n) \\ \\ p n\"\n by (metis (lifting) Greatest_le_nat)\n obtain nn :: nat where\n f2: \"Bv (bs ! xa) = ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig nn \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (nn - 1) \\ nn \\ t + dly \\ t < nn\"\n by (metis (no_types) \"*\")\n then have \"nn \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\"\n using f1 by force\n then show ?thesis\n using f2 by (meson less_le_trans)\n qed\n hence \"?time_again - 1 < ?time_again\"\n by auto\n have \"?time_again \\ t + dly\" and \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time_again - 1) \\ Bv (bs ! xa)\" and \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig ?time_again = Bv (bs ! xa)\"\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * apply (metis (mono_tags, lifting))\n using GreatestI_ex_nat * by smt\n have \"?w' xa sig (?time_again - 1) = ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig t\"\n using \\t < ?time_again\\ \\?time_again - 1 < ?time_again\\ \n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n by (smt One_nat_def Suc_leI \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (t + dly) = Bv (bs ! xa)\\ gr_implies_not0 le_add_diff_inverse not_less_iff_gr_or_eq plus_1_eq_Suc zero_less_diff)\n moreover have \"?w' xa sig (?time_again) = Bv (bs ! xa)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n using False \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ \n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (t + dly) = Bv (bs ! xa)\\ by auto\n ultimately have \"?w' xa sig (?time_again - 1) \\ ?w' xa sig ?time_again\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig t \\ Bv (bs ! xa)\\ by auto\n hence \"?zeit \\ ?time_again\"\n proof -\n have \"t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) \\ t + dly \\ (\\n. n \\ set [0.. snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) - 1) \\ snd to_worldline_init_bit \\ sig n[sig, t, dly := Bv (bs ! n)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)))\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) \\ t + dly\\ \\xa \\ {0.. \\snd to_worldline_init_bit \\ sig xa[sig, t, dly := Bv (bs ! xa)] sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) - 1) \\ snd to_worldline_init_bit \\ sig xa[sig, t, dly := Bv (bs ! xa)] sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ \n using set_upt by blast\n then show ?thesis\n by (simp add: Bex_def_raw Least_le)\n qed\n let ?time' = \" the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))\"\n have \"?time_again \\ t + dly\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) \\ t + dly\\ by blast\n have \"t < ?time_again\"\n using \\((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (t + dly) = Bv (bs ! index) \\ zeit = (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! index) \\ ((snd \\)(sig := to_bit index \\ snd \\ sig)) sig n = Bv (bs ! index))\\ \n \\t < (LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n))\\ zeit_def \n using \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ by linarith\n have \"to_bit xa (signal_of (\\ sig) \\ sig (?time_again - 1)) \\ Bv (bs ! xa)\"\n by (smt One_nat_def Suc_leI Suc_pred \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig ((GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) - 1) \\ Bv (bs ! xa)\\ \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) - 1 < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ assms(1) fun_upd_same leD leI le_zero_eq o_apply prod.sel(2) worldline_raw_def)\n moreover have \"to_bit xa (signal_of (\\ sig) \\ sig (?time_again)) = Bv (bs ! xa)\"\n using `?time_again \\ t + dly` `t < ?time_again`\n assms(1) comp_def fun_upd_def worldline_raw_def snd_conv\n by (smt \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) = Bv (bs ! xa)\\ order.asym)\n ultimately have \"(to_trans_raw_bit (\\ sig) \\ xa sig) ?time_again sig \\ None\"\n by (metis (no_types, lifting) signal_of_less_sig to_bit_signal_of' zero_option_def)\n obtain val where \"to_trans_raw_bit (\\ sig) \\ xa sig ?time_again sig = Some val\" \n using \\to_trans_raw_bit (\\ sig) \\ xa sig ?time_again sig \\ None\\ by auto\n have \"\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig). k \\ t + dly\"\n proof -\n have \"to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) = Some val\"\n by (metis \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig = Some val\\ to_trans_raw_sig_def)\n then have \"\\n. to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig n \\ None \\ n \\ t + dly\"\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) \\ t + dly\\ by blast\n then show ?thesis\n by (simp add: keys_def zero_option_def)\n qed\n hence time'_eq: \"?time' = (GREATEST k. k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig) \\ k \\ t + dly)\"\n unfolding inf_time_def by auto\n hence \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\" and \"?time' \\ t + dly\"\n using GreatestI_ex_nat \n by (metis (mono_tags, lifting) \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig). k \\ t + dly\\ inf_time_def inf_time_ex1 inf_time_some_exists)+\n have \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = to_trans_raw_bit (\\ sig) \\ xa sig ?time_again sig\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = to_trans_raw_bit (\\ sig) \\ xa sig ?time_again sig\"\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time_again = val\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ xa sig\" \"?time_again\" \"sig\" \"(\\x. _)(sig := val)\"]\n using \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig :=\n to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\\n snd \\ sig)) sig n = Bv (bs ! xa)) sig = Some val\\ by auto\n then obtain val' where \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = Some val'\"\n proof -\n assume \"\\val'. to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig = Some val' \\ thesis\"\n then show ?thesis\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ domIff dom_def keys_def not_None_eq to_trans_raw_sig_def zero_option_def)\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ xa sig\" \"?time_again\" \"sig\" \"(\\x. _)(sig := val')\"] time'_eq\n by (meson trans_some_signal_of')\n also have \"... \\ val\"\n using \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd\n \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig\n := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig = Some val\\\n \\to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig = Some val'\\\n using \\to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig \\ to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig\\ by auto\n finally have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time' \\ \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time_again \"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa))\n (to_trans_raw_bit (\\ sig) \\ xa sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig\n := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig :=\n to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) = val\\ by blast\n have \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig = Some val'\\ leI option.simps(3) option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time') = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time'\"\n using `t < ?time'` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n moreover have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time_again) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time_again\"\n using `t < ?time_again` to_bit_signal_of'_eq unfolding assms(1) time'_eq worldline_raw_def snd_conv fun_upd_def by fastforce\n ultimately have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time') \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time_again)\"\n using \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) \\ signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ by auto \n have \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time' = val'\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ xa sig\" \"?time'\" \"sig\" \"(\\x. _)(sig := val')\"] \\to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = Some val'\\\n by auto\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) = \n inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)\"\n using time'_eq \n proof -\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly) \\ None\"\n by (metis (no_types) \\\\thesis. (\\val'. to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig = Some val' \\ thesis) \\ thesis\\ \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ t + dly\\ inf_time_noneE2 option.simps(3) to_trans_raw_sig_def zero_option_def)\n then show ?thesis\n by (metis (no_types) \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ dom_def inf_time_someI keys_def option.exhaust_sel order_refl zero_option_def)\n qed\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = \n signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time'\"\n unfolding to_signal_def comp_def by auto\n hence \"signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time' = Bv (bs ! xa)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\\ by auto\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time_again) = Bv (bs ! xa)\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) = Bv (bs ! xa)\\ by blast\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time') = Bv (bs ! xa)\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) = signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)))\\ \\signal_of (Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) = Bv (bs ! xa)\\ by auto\n show False\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) = Bv (bs ! xa)\\ \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) = Bv (bs ! xa)\\ \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ by auto\n qed\n have h1: \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\\ by blast\n have \"the (to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig) = Bv (bs ! xa)\"\n proof -\n have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly) = Some ?time'\"\n by (simp add: \\\\k\\keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig). k \\ t + dly\\ inf_time_def)\n thus \"the (to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig) = Bv (bs ! xa)\"\n using h1 unfolding to_signal_def comp_def by (metis option.simps(5) to_trans_raw_sig_def)\n qed\n have \"the (to_trans_raw_bit (\\ sig) \\ xa sig ?time_again sig) = Bv (bs ! xa)\"\n proof- \n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?time_again = Bv (bs ! xa)\"\n using \\to_bit xa (signal_of (\\ sig) \\ sig (?time_again)) = Bv (bs ! xa)\\\n unfolding to_bit_signal_of'_eq[THEN sym] by auto\n moreover have \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig ?time_again = Some ?time_again\"\n proof (intro inf_time_someI)\n show \"?time_again \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n proof -\n have \"\\v. to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig = Some v\"\n by (metis \\\\thesis. (\\val. to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig = Some val \\ thesis) \\ thesis\\)\n then show ?thesis\n by (simp add: domIff to_trans_raw_sig_def)\n qed\n qed (auto)\n ultimately show ?thesis\n unfolding to_signal_def comp_def \n by (simp add: to_trans_raw_sig_def)\n qed\n have \"?time_again = ?time'\"\n proof (rule Greatest_equality)\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n moreover have \"to_bit xa (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! xa)\"\n unfolding to_bit_signal_of'_eq[THEN sym]\n proof (cases \"\\n. t < n \\ n < ?time' \\ (to_trans_raw_bit (\\ sig) \\ xa sig) n sig \\ None\")\n case False\n hence none: \"\\n. t < n \\ n \\ ?time' - 1 \\ (to_trans_raw_bit (\\ sig) \\ xa sig) n sig = 0\"\n by (auto simp add: zero_option_def)\n have \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (?time' - 1) = \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t\"\n using signal_of_less_ind'[of \"t\" \"?time' - 1\" \"to_trans_raw_bit (\\ sig) \\ xa sig\" \"sig\", OF none] `t \\ ?time' - 1`\n by auto \n also have \"... \\ (Bv (bs ! xa))\"\n using to_bit_signal_of'_eq \n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig t \\ Bv (bs ! xa) \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (t + dly) = Bv (bs ! xa)\\ by blast\n finally show \" signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (?time' - 1) \\ (Bv (bs ! xa))\"\n by auto\n next\n case True\n let ?key1 = \"(GREATEST n. t < n \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ xa sig n sig \\ None)\"\n from True have \"t < ?key1\" and \"?key1 < ?time'\" and \" to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig \\ None\"\n using GreatestI_ex_nat[OF True] using less_imp_le_nat by blast+\n have *: \"\\n. n > ?key1 \\ n < ?time' \\ to_trans_raw_bit (\\ sig) \\ xa sig n sig = None\"\n using Greatest_le_nat[where P=\"\\x. t < x \\ x < ?time' \\ to_trans_raw_bit (\\ sig) \\ xa sig x sig \\ None\" and b=\"?time'\"]\n by (smt \\t < (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ xa sig n sig \\ None)\\ leD less_imp_le_nat less_trans)\n have inf_some: \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (?time' - 1) = Some ?key1\"\n proof (rule inf_time_someI)\n show \"?key1 \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig \\ None` by (simp add: domIff to_trans_raw_sig_def)\n next\n show \"?key1 \\ ?time' - 1\"\n using `?key1 < ?time'` by linarith\n next\n { fix ta\n assume \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n assume \"ta \\ ?time' - 1\"\n assume \"?key1 < ta\"\n hence \"to_trans_raw_bit (\\ sig) \\ xa sig ta sig = None\"\n using *[OF `?key1 < ta`] `ta \\ ?time' - 1` by simp\n hence \"ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n by (simp add: domIff to_trans_raw_sig_def)\n with `ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)` have False by auto }\n thus \"\\ta \\ dom (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig). ta \\ ?time' - 1 \\ ta \\ ?key1\"\n using not_le_imp_less by blast\n qed\n have non_stut: \" non_stuttering (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) (to_bit xa o \\) sig\"\n using assms(5) non_stuttering_to_trans_raw_bit by force\n hence \"(to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig) \\ to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig\"\n proof -\n have \"?key1 \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n using `to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig \\ None` by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n moreover have \"?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n using \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ by blast\n moreover have \"\\k. ?key1 < k \\ k < ?time' \\ k \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\"\n using * by (metis (mono_tags, lifting) domIff keys_def mem_Collect_eq to_trans_raw_sig_def\n zero_option_def)\n ultimately show ?thesis \n using `?key1 < ?time'` non_stut unfolding non_stuttering_def\n by (simp add: to_trans_raw_sig_def)\n qed\n moreover have \"(to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig) = Some (Bv (bs ! xa))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa\n sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\\n xa sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig) = Bv (bs ! xa)\\\n domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n ultimately have neq: \"(to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig) \\ Some (Bv (bs ! xa))\"\n by auto\n then obtain valu where \"(to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig) = Some valu\" and \"valu \\ Bv (bs ! xa)\"\n using \\to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig \\ None\\ by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (?time' - 1) = \n the (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig ?key1)\"\n using inf_some unfolding to_signal_def comp_def\n by auto\n also have \"... \\ Bv (bs ! xa)\"\n using \\to_trans_raw_bit (\\ sig) \\ xa sig ?key1 sig \\ None\\ neq \n by (metis \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. t < n \\ n < the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ to_trans_raw_bit (\\ sig) \\ xa sig n sig \\ None) sig = Some valu\\ option.sel to_trans_raw_sig_def)\n finally show \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (?time' - 1) \\ (Bv (bs ! xa))\"\n by blast\n qed\n ultimately have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time' - 1) = to_bit xa (signal_of (\\ sig) \\ sig (?time' - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence *: \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! xa)\"\n using \\to_bit xa (signal_of (\\ sig) \\ sig (?time' - 1)) \\ Bv (bs ! xa)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = Some (Bv (bs ! xa))\"\n using \\the (to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig\n (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig) = Bv (bs ! xa)\\\n \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig :=\n to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit\n xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig \\ None\\ \\to_trans_raw_bit (\\ sig)\n \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa\n sig)) sig (t + dly))) sig = to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\\n t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa)\n \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig\\ by\n force\n have \"to_bit xa (signal_of (\\ sig) \\ sig ?time') = (Bv (bs ! xa))\"\n using trans_some_signal_of'[of \"to_trans_raw_bit (\\ sig) \\ xa sig\", OF `to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = Some (Bv (bs ! xa))`]\n using to_bit_signal_of'_eq by fastforce\n hence \" ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) = Bv (bs ! xa)\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def \n using \\t \\ the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) - 1\\ by auto\n thus \"?time' \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (?time' - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig ?time' = Bv (bs ! xa)\" \n using * `?time' \\ t + dly` by auto \n next\n have \"t \\ ?time' - 1\" \n proof (rule ccontr)\n assume \"\\ t \\ ?time' - 1\" hence \"?time' - 1 < t\"\n by auto\n hence \"?time' \\ t\" by auto\n hence \"\\ ?time' sig = None\"\n using assms(2) unfolding context_invariant_def by (auto simp add: zero_fun_def zero_option_def)\n have \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig \\ None\"\n using \\?time' \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ \n by (metis domIff dom_is_keys to_trans_raw_sig_def)\n thus \"False\"\n using \\\\ ?time' sig = None\\ unfolding to_trans_raw_bit_def by auto\n qed\n fix y\n assume \"y \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig y = Bv (bs ! xa)\"\n hence \"y \\ t + dly\" and \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! xa)\" and \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (y) = Bv (bs ! xa)\"\n by auto\n have \"to_trans_raw_bit (\\ sig) \\ xa sig ?time' sig = Some (Bv (bs ! xa))\"\n by (metis \\the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly)) \\ keys (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig) sig)\\ \\the (to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig) = Bv (bs ! xa)\\ domIff dom_def keys_def option.exhaust_sel to_trans_raw_sig_def zero_option_def)\n hence \"t < ?time'\"\n by (smt \\\\n. n \\ t \\ \\ n = 0\\ \\to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig \\ None\\ \\to_trans_raw_bit (\\ sig) \\ xa sig (the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ xa sig)) sig (t + dly))) sig = to_trans_raw_bit (\\ sig) \\ xa sig (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa)) sig\\ leI option.simps(4) to_trans_raw_bit_def zero_fun_def zero_option_def)\n have \"y \\ t \\ t < y\"\n by auto\n moreover\n { assume \"y \\ t\"\n hence \"y < ?time'\" using `t < ?time'` by linarith }\n moreover\n { assume \"t < y\"\n hence \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (y - 1) = to_bit xa (signal_of (\\ sig) \\ sig (y - 1))\"\n unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 0: \"... \\ (Bv (bs ! xa))\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (y - 1) \\ Bv (bs ! xa)\\ by auto\n have \"((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig y = to_bit xa (signal_of (\\ sig) \\ sig y)\"\n using `t < y` unfolding assms(1) worldline_raw_def snd_conv fun_upd_def comp_def by auto\n hence 1: \"... = Bv (bs ! xa)\"\n using \\((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig y = Bv (bs ! xa)\\ by auto\n have \"to_trans_raw_bit (\\ sig) \\ xa sig y sig = Some (Bv (bs ! xa))\"\n proof (rule ccontr)\n assume \"\\ to_trans_raw_bit (\\ sig) \\ xa sig y sig = Some (Bv (bs ! xa))\"\n then obtain x' where \"to_trans_raw_bit (\\ sig) \\ xa sig y sig = None \\ to_trans_raw_bit (\\ sig) \\ xa sig y sig = Some x' \\ x' \\ (Bv (bs ! xa))\"\n using domIff by fastforce\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ xa sig y sig = None\"\n hence \"signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ xa sig) sig y = \n signal_of (\\ sig) (to_trans_raw_bit (\\ sig) \\ xa sig) sig (y - 1)\"\n by (intro signal_of_less_sig)(simp add: zero_option_def)\n with 0 1 have False \n by (metis \\to_trans_raw_bit (\\ sig) \\ xa sig y sig = None\\ signal_of_less_sig to_bit_signal_of' zero_option_def) }\n moreover\n { assume \"to_trans_raw_bit (\\ sig) \\ xa sig y sig = Some x' \\ x' \\ (Bv (bs ! xa))\"\n hence \"signal_of ((Bv (case \\ sig of Bv b' \\ b' | Lv sign bs \\ bs ! xa))) (to_trans_raw_bit (\\ sig) \\ xa sig) sig y = x'\" and \"x' \\ (Bv (bs ! xa))\"\n using trans_some_signal_of' by fastforce+\n with 1 have False \n unfolding to_bit_signal_of'_eq by auto }\n ultimately show False\n by auto\n qed\n with `y \\ t + dly` have \"y \\ ?time'\"\n unfolding time'_eq \n apply (intro Greatest_le_nat)\n unfolding keys_def to_trans_raw_sig_def zero_option_def by auto }\n ultimately show \"y \\ ?time'\"\n by auto \n qed\n thus ?thesis \n using \\(LEAST n. t < n \\ n \\ t + dly \\ (\\b\\set [0.. sig b[sig, t, dly := Bv (bs ! b)] sig (n - 1) \\ snd to_worldline_init_bit \\ sig b[sig, t, dly := Bv (bs ! b)] sig n)) \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! xa) \\ ((snd \\)(sig := to_bit xa \\ snd \\ sig)) sig n = Bv (bs ! xa))\\ by linarith\n qed\n finally show ?thesis\n by (simp add: False not_le_imp_less)\n qed\n finally have \"purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa)) x sig = 0\"\n by (auto simp add: zero_option_def) }\n ultimately have \"purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa)) x sig = 0\"\n by auto\n thus \"x \\ {k. purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa)) k sig \\ 0}\"\n by auto\n qed\n hence \"x \\ fold (\\) (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd) (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..\\n. n \\ t \\ \\ n = 0\\ \\t' < t + dly\\ \\x \\ t'\\ diff_diff_cancel less_imp_diff_less less_not_refl nat_diff_split zero_fun_def zero_less_diff zero_option_def) }\n thus \" \\x. x \\ dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig) \\ t' < x\"\n using leI by blast\n qed\n hence \"signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = \\ sig\"\n unfolding to_signal_def comp_def by auto\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n using \\snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = \\ sig\\ by auto }\n ultimately have \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n by blast }\n moreover\n { assume thereisnt: \"\\ (\\n>t. n \\ t + dly \\ (\\b\\set [0.. ?w' b sig n))\"\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = snd \\ sig t\"\n unfolding worldline_inert_upd2.simps snd_conv using \\t' < t + dly\\ \n using \\s' = sig\\ \\t \\ t'\\ by auto\n also have \"... = signal_of (\\ sig) \\ sig t\"\n unfolding assms(1) worldline_raw_def snd_conv by auto\n also have \"... = \\ sig\"\n by (metis \\\\n. n \\ t \\ \\ n = 0\\ signal_of_def zero_fun_def)\n finally have \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = \\ sig\"\n by auto\n have \"inf_time (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs))) sig t' = None\"\n unfolding inf_time_none_iff[THEN sym]\n proof \n { fix x \n assume \"\\ t' < x\" hence \"x \\ t'\" by auto\n hence \"x < t + dly\"\n using \\t' < t + dly\\ le_less_trans by blast\n assume \"x \\ dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig)\"\n hence \"purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\"\n unfolding dom_def to_trans_raw_sig_def by auto\n hence *: \"combine_trans_bit \\\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. None\"\n unfolding purge_raw'_def by auto\n have **: \"length (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0.. length bs - 0\"\n by auto\n \n have \"x < t \\ t \\ x\"\n by auto\n moreover\n { assume \"x < t\"\n hence \"False\"\n using * unfolding combine_trans_bit_def \n by (simp add: \\\\n. n \\ t \\ \\ n = 0\\ zero_fun_def zero_option_def) }\n moreover\n { assume \"t \\ x\"\n hence \"x \\ fold (\\)\n (map (keys \\ (\\\\. to_trans_raw_sig \\ sig) \\ snd)\n (zip (map (\\n. Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) [0..n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..\\n. n \\ t \\ \\ n = 0\\ \\x < t + dly\\ dual_order.asym zero_fun_def zero_option_def)\n also have \"... = fold (\\) (map keys (map (\\\\. to_trans_raw_sig \\ sig) (map (\\n. purge_raw (to_trans_raw_bit (\\ sig) \\ n sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! n)) (Bv (bs ! n))) [0..xa\\{0.. keys (to_trans_raw_sig (purge_raw (to_trans_raw_bit (\\ sig) \\ xa sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! xa)) (Bv (bs ! xa))) sig)\"\n unfolding member_fold_union2 by auto\n then obtain b where pnone: \"(purge_raw (to_trans_raw_bit (\\ sig) \\ b sig) t dly sig (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (Bv (bs ! b))) x sig \\ None\" and \"b < length bs\"\n unfolding to_trans_raw_sig_def keys_def zero_option_def using atLeastLessThan_iff by blast\n have \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t = Bv (bs ! b) \n \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) \\ Bv (bs ! b)\n \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n by auto\n moreover\n { assume \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t = Bv (bs ! b) \n \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) \\ Bv (bs ! b)\"\n hence \"False\"\n using pnone unfolding purge_raw_def Let_def\n by (metis (no_types, lifting) \\\\n. n \\ t \\ \\ n = 0\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\\ \\x < t + dly\\ less_or_eq_imp_le linorder_neqE_nat pnone purge_raw_before_now_unchanged' purge_raw_neq_0_imp zero_fun_def zero_option_def) }\n moreover\n { assume \"signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \\ \n signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\"\n hence \"inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly) = Some x\"\n using pnone unfolding purge_raw_def Let_def \n by (metis \\\\n. n \\ t \\ \\ n = 0\\ \\purge_raw' \\ t dly sig (\\ sig) (Lv sign bs) x sig \\ None\\ \\x < t + dly\\ not_le_imp_less pnone purge_raw_before_now_unchanged' purge_raw_neq_0_imp zero_fun_def zero_option_def)\n let ?time' = \" the (inf_time (to_trans_raw_sig (to_trans_raw_bit (\\ sig) \\ b sig)) sig (t + dly))\"\n let ?time = \"(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\\ \\snd \\ sig t = signal_of (\\ sig) \\ sig t\\ to_bit_signal_of'_eq by fastforce\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\"\n using \\signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig t \\ Bv (bs ! b) \\ signal_of (Bv (case \\ sig of Bv b \\ b | Lv sign bs \\ bs ! b)) (to_trans_raw_bit (\\ sig) \\ b sig) sig (t + dly) = Bv (bs ! b)\\ \n unfolding to_bit_signal_of'_eq fun_upd_def assms(1) worldline_raw_def snd_conv by auto\n have *: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)\"\n proof (rule ccontr)\n assume \"\\ (\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n hence imp: \"\\n. t < n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n by auto\n { fix n \n assume \"t \\ n\" and \"n \\ t + dly\"\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b)\\ imp\n proof (induction \"n - t\" arbitrary: t dly)\n case 0 hence \"n = t\" by auto\n then show ?case \n using 0 by auto\n next\n case (Suc x)\n hence 0: \"x = n - Suc t\"\n by auto\n have 2: \"n \\ Suc t + (dly - 1) \"\n using Suc by auto\n hence 1: \"Suc t \\ n \"\n using Suc by linarith\n hence \"Suc t \\ t + dly\"\n using Suc by linarith\n hence 3: \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (Suc t) \\ Bv (bs ! b)\"\n using Suc(5-6) by auto\n have 4: \"\\n. Suc t < n \\ n \\ Suc t + (dly - 1) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n using Suc(6) by auto\n have \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n using Suc(1)[OF 0 1 2 3 4] by auto\n thus ?case\n by auto\n qed }\n hence \"\\n. t \\ n \\ n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n \\ Bv (bs ! b)\"\n by auto\n thus False\n using \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\\ le_add1 by blast\n qed\n have \"t < ?time\"\n proof -\n have f1: \"\\p n na. (n::nat) \\ Greatest p \\ (\\n. \\ n \\ na \\ p n) \\ \\ p n\"\n by (metis (lifting) Greatest_le_nat)\n obtain nn :: nat where\n f2: \"Bv (bs ! b) = ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig nn \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (nn - 1) \\ nn \\ t + dly \\ t < nn\"\n by (metis (lifting) \"*\")\n then have \"nn \\ (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\"\n using f1 by fastforce\n then show ?thesis\n using f2 order.strict_trans2 by blast\n qed\n have \"?time \\ t + dly\"\n by (metis (mono_tags, lifting) \"*\" GreatestI_ex_nat fun_upd_same)\n hence \"((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (?time - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig ?time = Bv (bs ! b)\"\n by (smt \"*\" GreatestI_nat)\n hence \"?w' b sig (?time - 1) \\ ?w' b sig (?time)\"\n unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv\n by (smt \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (t + dly) = Bv (bs ! b)\\ \\((snd \\)(sig := to_bit b \\ snd \\ sig)) sig t \\ Bv (bs ! b)\\ diff_le_self order.strict_iff_order)\n with thereisnt have False\n using \\(GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b)) \\ t + dly\\ \\b < length bs\\ \\t < (GREATEST n. n \\ t + dly \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig (n - 1) \\ Bv (bs ! b) \\ ((snd \\)(sig := to_bit b \\ snd \\ sig)) sig n = Bv (bs ! b))\\ by auto }\n ultimately have False\n by auto }\n ultimately have False\n by auto }\n thus \"\\x. x \\ dom (to_trans_raw_sig (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig) \\ t' < x\"\n by auto\n qed\n hence \"signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t' = \\ sig\"\n unfolding to_signal_def comp_def by auto\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n using \\snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = \\ sig\\ by auto }\n ultimately have \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = signal_of (\\ sig) (purge_raw' \\ t dly sig (\\ sig) (Lv sign bs)) sig t'\"\n by blast }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t'\"\n by (smt \\'_def inr_post_raw'_def not_le signal_of_trans_post2 snd_conv worldline_raw_def) }\n moreover\n { assume \"s' \\ sig \\ t' < t\"\n moreover\n { assume \"t' < t\"\n hence 0: \" snd (worldline_raw t \\ \\ def \\') s' t' = signal_of (def s') \\ s' t'\"\n unfolding worldline_raw_def by auto\n have \"t' < t + dly\"\n using `t' < t` by auto\n have \"snd (worldline_raw t \\ \\ def \\) s' t' = snd (worldline_raw t \\ \\ def \\') s' t'\"\n using `t' < t` by (simp add: worldline_raw_def)\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = snd (worldline_raw t \\ \\ def \\') s' t'\"\n using `t' < t` unfolding assms(1) worldline_inert_upd2.simps snd_conv worldline_inert_upd_def fun_upd_def\n by auto }\n moreover\n { assume \"s' \\ sig\"\n hence \"snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' = snd (worldline_raw t \\ \\ def \\) s' t'\"\n unfolding worldline_inert_upd2.simps snd_conv fun_upd_def assms(1) by auto\n also have \"... = snd (worldline_raw t \\ \\ def \\') s' t'\"\n proof -\n have \"\\n. (to_trans_raw_sig \\ s') n = (to_trans_raw_sig \\' s') n\"\n using `s' \\ sig` unfolding \\'_def inr_post_raw'_def\n by (metis purge_raw_does_not_affect_other_sig' to_trans_raw_sig_def trans_post_raw_diff_sig)\n hence \"signal_of (\\ s') \\ s' t' = signal_of (\\ s') \\' s' t'\"\n by (meson signal_of_equal_when_trans_sig_equal_upto)\n thus ?thesis\n unfolding worldline_raw_def by auto\n qed\n finally have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' \"\n by auto }\n ultimately have \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t'\"\n by auto }\n ultimately show \"snd (worldline_raw t \\ \\ def \\') s' t' = snd (worldline_inert_upd2 \\ sig t dly (Lv sign bs)) s' t' \"\n by blast\nqed (simp add: assms(1) worldline_inert_upd_def worldline_raw_def)\n\nlemma lift_inr_post_worldline_upd_comb:\n assumes \"\\ = worldline_raw t \\ \\ def \\\"\n assumes \"context_invariant t \\ \\ \\ def \\\"\n assumes \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n assumes \"0 < dly\"\n assumes \"non_stuttering (to_trans_raw_sig \\) \\ sig\"\n assumes \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assumes \"beval_world_raw \\ t exp v\"\n shows \"worldline_raw t \\ \\ def \\' = worldline_inert_upd2 \\ sig t dly v\"\n using lift_inr_post_worldline_upd2 lift_inr_post_worldline_upd\n by (metis assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) assms(7) val.exhaust)\n\nlemma Bassign_inert_sound:\n assumes \"0 < dly\"\n shows \"\\\\<^sub>t {P} Bassign_inert sig exp dly {Q} \\ \\\\<^sub>t {P} Bassign_inert sig exp dly {Q}\"\nproof -\n assume \"\\\\<^sub>t {P} Bassign_inert sig exp dly {Q}\"\n hence imp: \"\\w. P w \\ (\\x. beval_world_raw w t exp x \\ Q (worldline_inert_upd2 w sig t dly x))\"\n by (auto dest!: Bassign_inertE)\n { fix \\ :: \"'a state\"\n fix \\ \\' \\ :: \"'a trans_raw\"\n fix w w' :: \"'a worldline_init\"\n fix \\ def\n assume c: \"context_invariant t \\ \\ \\ def \\\"\n assume \"All (non_stuttering (to_trans_raw_sig \\) \\)\"\n assume \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assume \"w = worldline_raw t \\ \\ def \\\"\n assume \"P w\"\n assume ex: \"t, \\, \\, \\, def \\ > \\\\<^sub>s \\'\"\n obtain x where \"beval_world_raw w t exp x\"\n using \\P w\\ imp by metis\n have \"snd (worldline_raw t \\ \\ def \\') = snd (worldline_inert_upd2 w sig t dly x)\"\n using lift_inr_post_worldline_upd_comb[OF `w = worldline_raw t \\ \\ def \\` c ex assms] \\All (non_stuttering (to_trans_raw_sig \\) \\)\\\n \\beval_world_raw w t exp x\\ \\All (non_stuttering (to_trans_raw_sig \\) def)\\ by auto\n with imp and `P w` have \"Q(worldline_inert_upd2 w sig t dly x)\"\n using \\beval_world_raw w t exp x\\ beval_world_raw_deterministic by metis\n assume \"w' = worldline_raw t \\ \\ def \\'\"\n hence \"Q w'\"\n using `Q(worldline_inert_upd2 w sig t dly x)` `snd (worldline_raw t \\ \\ def \\') = snd (worldline_inert_upd2 w sig t dly x)`\n by (metis (full_types) \\All (non_stuttering (to_trans_raw_sig \\) \\)\\ \\All (non_stuttering\n (to_trans_raw_sig \\) def)\\ \\beval_world_raw w t exp x\\ \\w = worldline_raw t \\ \\ def \\\\ assms c\n ex lift_inr_post_worldline_upd_comb) }\n thus \" \\\\<^sub>t {P} Bassign_inert sig exp dly {Q}\"\n unfolding seq_hoare_valid_def by meson\nqed\n\nlemma Bcase_empty_valid:\n \"\\\\<^sub>t {P} Bcase exp [] {P}\"\nproof -\n { fix \\ :: \"'a state\"\n fix \\ :: \"'a trans_raw\"\n fix \\ \\ \\' w w' def\n assume w_def: \"w = worldline_raw t \\ \\ def \\\"\n assume \" P w\"\n assume \" t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\' \"\n hence \"\\' = \\\"\n using b_seq_exec.intros(10) b_seq_exec_deterministic by blast\n assume \" w' = worldline_raw t \\ \\ def \\'\"\n hence \"w' = w\"\n unfolding \\\\' = \\\\ w_def by auto\n hence \"P w'\"\n using \\P w\\ by auto }\n thus ?thesis\n unfolding seq_hoare_valid_def by metis\nqed\n\nlemma Bcase_other_valid:\n assumes \" \\\\<^sub>t {P} ss {Q}\"\n shows \"\\\\<^sub>t {P} Bcase exp ((Others, ss) # choices) {Q}\"\nproof -\n { fix \\ :: \"'a state\"\n fix \\ :: \"'a trans_raw\"\n fix \\ \\ \\' w w' def\n assume \"t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\'\"\n hence \"t, \\, \\, \\, def \\ < ss, \\> \\\\<^sub>s \\'\"\n using Femto_VHDL_raw.seq_cases_bcase by fastforce\n assume \"w = worldline_raw t \\ \\ def \\\"\n assume \"P w\"\n assume \"context_invariant t \\ \\ \\ def \\ \"\n assume \"All (non_stuttering (to_trans_raw_sig \\) \\)\"\n assume \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n assume \"w' = worldline_raw t \\ \\ def \\' \"\n hence \"Q w'\"\n using assms unfolding seq_hoare_valid_def\n by (metis \\All (non_stuttering (to_trans_raw_sig \\) \\)\\ \\All (non_stuttering (to_trans_raw_sig\n \\) def)\\ \\P w\\ \\context_invariant t \\ \\ \\ def \\\\ \\t , \\ , \\ , \\, def \\ < ss , \\> \\\\<^sub>s \\'\\ \\w =\n worldline_raw t \\ \\ def \\\\) }\n thus ?thesis\n unfolding seq_hoare_valid_def by metis\nqed\n\nlemma Bcase_if_valid:\n assumes \"\\\\<^sub>t {\\a. P a \\ (\\x. beval_world_raw a t exp x \\ beval_world_raw a t exp' x)} ss {Q}\"\n assumes \"\\\\<^sub>t {\\a. P a \\ (\\x x'. beval_world_raw a t exp x \\ beval_world_raw a t exp' x' \\ x \\ x')} Bcase exp choices {Q}\"\n shows \"\\\\<^sub>t {P} Bcase exp ((Explicit exp', ss) # choices) {Q}\"\nproof -\n { fix \\ :: \"'a state\"\n fix \\ :: \"'a trans_raw\"\n fix \\ \\ \\' w w' def\n assume *: \" t , \\ , \\ , \\, def \\ > \\\\<^sub>s \\'\"\n have \"\\x x'. t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x \\ t , \\ , \\ , \\, def \\ exp' \\\\<^sub>b x'\"\n apply (rule Femto_VHDL_raw.seq_cases_bcase[OF *, rotated])\n by (metis Pair_inject choices.inject list.inject) blast+\n then obtain x x' where \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\" and \"t , \\ , \\ , \\, def \\ exp' \\\\<^sub>b x'\"\n by blast\n assume \"P w\"\n assume \"context_invariant t \\ \\ \\ def \\\"\n hence \"\\n. n \\ t \\ \\ n = 0\"\n unfolding context_invariant_def by auto\n assume w_def: \"w = worldline_raw t \\ \\ def \\\"\n hence \"state_of_world w t = \\\"\n using state_of_world[OF _ `\\n. n \\ t \\ \\ n = 0`] by auto\n have \"event_of_world w t = \\\"\n proof (cases \"0 < t\")\n case True\n fix s\n have \"snd w s t = \\ s\"\n using `state_of_world w t = \\` unfolding state_of_world_def by auto\n moreover have \"snd w s (t - 1) = signal_of (def s) \\ s (t - 1)\"\n using True by (simp add: w_def worldline_raw_def)\n ultimately show ?thesis\n using True \\context_invariant t \\ \\ \\ def \\\\\n unfolding event_of_world_def context_invariant_def\n by (smt Collect_cong \\state_of_world w t = \\\\ diff_less less_numeral_extra(1)\n less_numeral_extra(3) snd_conv state_of_world_def w_def worldline_raw_def)\n next\n case False\n hence \"t = 0\" by auto\n hence ev: \"event_of_world w t = {s. snd w s 0 \\ def s}\"\n unfolding event_of_world_def by (simp add: w_def worldline_raw_def)\n have \\_def': \"\\ = {s. \\ s \\ signal_of (def s) \\ s 0}\"\n using `t = 0` \\context_invariant t \\ \\ \\ def \\\\ unfolding context_invariant_def\n by auto\n have \"\\ = 0\"\n using \\context_invariant t \\ \\ \\ def \\\\ unfolding `t = 0`\n by (auto simp add: context_invariant_def zero_fun_def)\n hence \"\\s. signal_of (def s) \\ s 0 = def s\"\n using signal_of_empty by metis\n hence \"\\ = {s. \\ s \\ def s}\"\n using \\_def' by auto\n moreover have \"\\s. snd w s 0 = \\ s\"\n using `state_of_world w t = \\` `t = 0` unfolding state_of_world_def by auto\n ultimately have \"\\ = {s. snd w s 0 \\ def s}\"\n by auto\n thus ?thesis using ev by auto\n qed\n assume \"All (non_stuttering (to_trans_raw_sig \\) \\)\"\n assume \"All (non_stuttering (to_trans_raw_sig \\) def)\"\n hence \"derivative_hist_raw w t = \\\"\n using derivative_is_history unfolding w_def\n by (metis \\context_invariant t \\ \\ \\ def \\\\ context_invariant_def)\n hence \"beval_world_raw w t exp x\"\n proof -\n have \"get_time w = def\"\n by (simp add: w_def worldline_raw_def)\n then show ?thesis\n by (simp add: \\derivative_hist_raw w t = \\\\ \\event_of_world w t = \\\\ \\state_of_world w t = \\\\ \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ beval_world_raw.intros)\n qed\n have \"beval_world_raw w t exp' x'\"\n using \\All (non_stuttering (to_trans_raw_sig \\) def)\\ \\context_invariant t \\ \\ \\ def \\\\ \\t , \\\n , \\ , \\, def \\ exp' \\\\<^sub>b x'\\ beval_beval_world_raw_ci w_def by fastforce\n assume \"w' = worldline_raw t \\ \\ def \\'\"\n have \"x = x' \\ x \\ x'\"\n by auto\n moreover\n { assume \"x = x'\"\n have \"t , \\ , \\ , \\, def \\ < ss , \\> \\\\<^sub>s \\'\"\n apply (rule seq_cases_bcase[OF *, rotated])\n by (metis Pair_inject \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ \\t , \\ , \\ , \\, def \\ exp' \\\\<^sub>b x'\\ \\x\n = x'\\ beval_raw_deterministic choices.inject list.inject)blast+\n with `P w` have \"Q w'\"\n using assms unfolding seq_hoare_valid_def\n by (metis \\All (non_stuttering (to_trans_raw_sig \\) \\)\\ \\All (non_stuttering\n (to_trans_raw_sig \\) def)\\ \\beval_world_raw w t exp x\\ \\beval_world_raw w t exp' x'\\\n \\context_invariant t \\ \\ \\ def \\\\ \\w' = worldline_raw t \\ \\ def \\'\\ \\x = x'\\ w_def) }\n moreover\n { assume \"x \\ x'\"\n have \"t, \\, \\, \\, def \\ < Bcase exp choices, \\> \\\\<^sub>s \\'\"\n apply (rule seq_cases_bcase[OF *])\n by (metis Pair_inject \\t , \\ , \\ , \\, def \\ exp \\\\<^sub>b x\\ \\t , \\ , \\ , \\, def \\ exp' \\\\<^sub>b x'\\\n \\x \\ x'\\ beval_raw_deterministic choices.inject list.inject) auto\n with `P w` have \"Q w'\"\n using assms(2) unfolding seq_hoare_valid_def\n by (metis \\All (non_stuttering (to_trans_raw_sig \\) \\)\\ \\All (non_stuttering\n (to_trans_raw_sig \\) def)\\ \\beval_world_raw w t exp x\\ \\beval_world_raw w t exp' x'\\\n \\context_invariant t \\ \\ \\ def \\\\ \\w' = worldline_raw t \\ \\ def \\'\\ \\x \\ x'\\ w_def) }\n ultimately have \"Q w'\"\n by auto }\n thus ?thesis\n unfolding seq_hoare_valid_def by metis\nqed\n\n\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/VHDL_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.27396886168062323}} {"text": "(* Title: Lifting to Non-Ground Calculi of the Saturation Framework\n * Author: Sophie Tourret , 2018-2020 *)\n\nsection \\Lifting to Non-ground Calculi\\\n\ntext \\The section 3.1 to 3.3 of the report are covered by the current section.\n Various forms of lifting are proven correct. These allow to obtain the dynamic\n refutational completeness of a non-ground calculus from the static refutational\n completeness of its ground counterpart.\\\n\ntheory Lifting_to_Non_Ground_Calculi\n imports\n Calculi\n Well_Quasi_Orders.Minimal_Elements\nbegin\n\nsubsection \\Standard Lifting\\\n\nlocale standard_lifting = Non_ground: inference_system Inf_F +\n Ground: calculus_with_red_crit Bot_G Inf_G entails_G Red_Inf_G Red_F_G\n for\n Bot_F :: \\'f set\\ and\n Inf_F :: \\'f inference set\\ and\n Bot_G :: \\'g set\\ and\n Inf_G :: \\'g inference set\\ and\n entails_G :: \\'g set \\ 'g set \\ bool\\ (infix \"\\G\" 50) and\n Red_Inf_G :: \\'g set \\ 'g inference set\\ and\n Red_F_G :: \\'g set \\ 'g set\\\n + fixes\n \\_F :: \\'f \\ 'g set\\ and\n \\_Inf :: \\'f inference \\ 'g inference set option\\\n assumes\n Bot_F_not_empty: \"Bot_F \\ {}\" and\n Bot_map_not_empty: \\B \\ Bot_F \\ \\_F B \\ {}\\ and\n Bot_map: \\B \\ Bot_F \\ \\_F B \\ Bot_G\\ and\n Bot_cond: \\\\_F C \\ Bot_G \\ {} \\ C \\ Bot_F\\ and\n inf_map: \\\\ \\ Inf_F \\ \\_Inf \\ \\ None \\ the (\\_Inf \\) \\ Red_Inf_G (\\_F (concl_of \\))\\\nbegin\n\nabbreviation \\_set :: \\'f set \\ 'g set\\ where\n \\\\_set N \\ \\ (\\_F ` N)\\\n\n\n\ndefinition entails_\\ :: \\'f set \\ 'f set \\ bool\\ (infix \"\\\\\" 50) where\n \\N1 \\\\ N2 \\ \\_set N1 \\G \\_set N2\\\n\nlemma subs_Bot_G_entails:\n assumes\n not_empty: \\sB \\ {}\\ and\n in_bot: \\sB \\ Bot_G\\\n shows \\sB \\G N\\\nproof -\n have \\\\B. B \\ sB\\ using not_empty by auto\n then obtain B where B_in: \\B \\ sB\\ by auto\n then have r_trans: \\{B} \\G N\\ using Ground.bot_implies_all in_bot by auto\n have l_trans: \\sB \\G {B}\\ using B_in Ground.subset_entailed by auto\n then show ?thesis using r_trans Ground.entails_trans[of sB \"{B}\"] by auto\nqed\n\n(* lem:derived-consequence-relation *)\nsublocale lifted_consequence_relation: consequence_relation\n where Bot=Bot_F and entails=entails_\\\nproof\n show \"Bot_F \\ {}\" using Bot_F_not_empty .\nnext\n show \\B\\Bot_F \\ {B} \\\\ N\\ for B N\n proof -\n assume \\B \\ Bot_F\\\n then show \\{B} \\\\ N\\\n using Bot_map Ground.bot_implies_all[of _ \"\\_set N\"] subs_Bot_G_entails Bot_map_not_empty\n unfolding entails_\\_def\n by auto\n qed\nnext\n fix N1 N2 :: \\'f set\\\n assume\n \\N2 \\ N1\\\n then show \\N1 \\\\ N2\\ using entails_\\_def \\_subset Ground.subset_entailed by auto\nnext\n fix N1 N2\n assume\n N1_entails_C: \\\\C \\ N2. N1 \\\\ {C}\\\n show \\N1 \\\\ N2\\ using Ground.all_formulas_entailed N1_entails_C entails_\\_def\n by (smt UN_E UN_I Ground.entail_set_all_formulas singletonI)\nnext\n fix N1 N2 N3\n assume\n \\N1 \\\\ N2\\ and \\N2 \\\\ N3\\\n then show \\N1 \\\\ N3\\ using entails_\\_def Ground.entails_trans by blast\nqed\n\nend\n\nsubsection \\Strong Standard Lifting\\\n\n(* rmk:strong-standard-lifting *)\nlocale strong_standard_lifting = Non_ground: inference_system Inf_F +\n Ground: calculus_with_red_crit Bot_G Inf_G entails_G Red_Inf_G Red_F_G\n for\n Bot_F :: \\'f set\\ and\n Inf_F :: \\'f inference set\\ and\n Bot_G :: \\'g set\\ and\n Inf_G :: \\'g inference set\\ and\n entails_G :: \\'g set \\ 'g set \\ bool\\ (infix \"\\G\" 50) and\n Red_Inf_G :: \\'g set \\ 'g inference set\\ and\n Red_F_G :: \\'g set \\ 'g set\\\n + fixes\n \\_F :: \\'f \\ 'g set\\ and\n \\_Inf :: \\'f inference \\ 'g inference set option\\\n assumes\n Bot_F_not_empty: \"Bot_F \\ {}\" and\n Bot_map_not_empty: \\B \\ Bot_F \\ \\_F B \\ {}\\ and\n Bot_map: \\B \\ Bot_F \\ \\_F B \\ Bot_G\\ and\n Bot_cond: \\\\_F C \\ Bot_G \\ {} \\ C \\ Bot_F\\ and\n strong_inf_map: \\\\ \\ Inf_F \\ \\_Inf \\ \\ None \\ concl_of ` (the (\\_Inf \\)) \\ (\\_F (concl_of \\))\\ and\n inf_map_in_Inf: \\\\ \\ Inf_F \\ \\_Inf \\ \\ None \\ the (\\_Inf \\) \\ Inf_G\\\nbegin\n\nsublocale standard_lifting\nproof\n show \"Bot_F \\ {}\" using Bot_F_not_empty .\nnext\n fix B\n assume b_in: \"B \\ Bot_F\"\n show \"\\_F B \\ {}\" using Bot_map_not_empty[OF b_in] .\nnext\n fix B\n assume b_in: \"B \\ Bot_F\"\n show \"\\_F B \\ Bot_G\" using Bot_map[OF b_in] .\nnext\n show \"\\C. \\_F C \\ Bot_G \\ {} \\ C \\ Bot_F\" using Bot_cond .\nnext\n fix \\\n assume i_in: \"\\ \\ Inf_F\" and\n some_g: \"\\_Inf \\ \\ None\"\n show \"the (\\_Inf \\) \\ Red_Inf_G (\\_F (concl_of \\))\"\n proof\n fix \\G\n assume ig_in1: \"\\G \\ the (\\_Inf \\)\"\n then have ig_in2: \"\\G \\ Inf_G\" using inf_map_in_Inf[OF i_in some_g] by blast\n show \"\\G \\ Red_Inf_G (\\_F (concl_of \\))\"\n using strong_inf_map[OF i_in some_g] Ground.Red_Inf_of_Inf_to_N[OF ig_in2]\n ig_in1 by blast\n qed\nqed\n\nend\n\nsubsection \\Lifting with a Family of Well-founded Orderings\\\n\nlocale lifting_with_wf_ordering_family =\n standard_lifting Bot_F Inf_F Bot_G Inf_G entails_G Red_Inf_G Red_F_G \\_F \\_Inf\n for\n Bot_F :: \\'f set\\ and\n Inf_F :: \\'f inference set\\ and\n Bot_G :: \\'g set\\ and\n entails_G :: \\'g set \\ 'g set \\ bool\\ (infix \"\\G\" 50) and\n Inf_G :: \\'g inference set\\ and\n Red_Inf_G :: \\'g set \\ 'g inference set\\ and\n Red_F_G :: \\'g set \\ 'g set\\ and\n \\_F :: \"'f \\ 'g set\" and\n \\_Inf :: \"'f inference \\ 'g inference set option\"\n + fixes\n Prec_F_g :: \\'g \\ 'f \\ 'f \\ bool\\\n assumes\n all_wf: \"minimal_element (Prec_F_g g) UNIV\"\nbegin\n\ndefinition Red_Inf_\\ :: \"'f set \\ 'f inference set\" where\n \\Red_Inf_\\ N = {\\ \\ Inf_F. (\\_Inf \\ \\ None \\ the (\\_Inf \\) \\ Red_Inf_G (\\_set N))\n \\ (\\_Inf \\ = None \\ \\_F (concl_of \\) \\ (\\_set N \\ Red_F_G (\\_set N)))}\\\n\ndefinition Red_F_\\ :: \"'f set \\ 'f set\" where\n \\Red_F_\\ N = {C. \\D \\ \\_F C. D \\ Red_F_G (\\_set N) \\ (\\E \\ N. Prec_F_g D E C \\ D \\ \\_F E)}\\\n\nlemma Prec_trans:\n assumes\n \\Prec_F_g D A B\\ and\n \\Prec_F_g D B C\\\n shows\n \\Prec_F_g D A C\\\n using minimal_element.po assms unfolding po_on_def transp_on_def by (smt UNIV_I all_wf)\n\nlemma prop_nested_in_set: \"D \\ P C \\ C \\ {C. \\D \\ P C. A D \\ B C D} \\ A D \\ B C D\"\n by blast\n\n(* lem:wolog-C'-nonredundant *)\nlemma Red_F_\\_equiv_def:\n \\Red_F_\\ N = {C. \\Di \\ \\_F C. Di \\ Red_F_G (\\_set N) \\\n (\\E \\ (N - Red_F_\\ N). Prec_F_g Di E C \\ Di \\ \\_F E)}\\\nproof (rule;clarsimp)\n fix C D\n assume\n C_in: \\C \\ Red_F_\\ N\\ and\n D_in: \\D \\ \\_F C\\ and\n not_sec_case: \\\\E \\ N - Red_F_\\ N. Prec_F_g D E C \\ D \\ \\_F E\\\n have C_in_unfolded: \"C \\ {C. \\Di \\ \\_F C. Di \\ Red_F_G (\\_set N) \\\n (\\E\\N. Prec_F_g Di E C \\ Di \\ \\_F E)}\"\n using C_in unfolding Red_F_\\_def .\n have neg_not_sec_case: \\\\ (\\E\\N - Red_F_\\ N. Prec_F_g D E C \\ D \\ \\_F E)\\\n using not_sec_case by clarsimp\n have unfol_C_D: \\D \\ Red_F_G (\\_set N) \\ (\\E\\N. Prec_F_g D E C \\ D \\ \\_F E)\\\n using prop_nested_in_set[of D \\_F C \"\\x. x \\ Red_F_G (\\ (\\_F ` N))\"\n \"\\x y. \\E \\ N. Prec_F_g y E x \\ y \\ \\_F E\", OF D_in C_in_unfolded] by blast\n show \\D \\ Red_F_G (\\_set N)\\\n proof (rule ccontr)\n assume contrad: \\D \\ Red_F_G (\\_set N)\\\n have non_empty: \\\\E\\N. Prec_F_g D E C \\ D \\ \\_F E\\ using contrad unfol_C_D by auto\n define B where \\B = {E \\ N. Prec_F_g D E C \\ D \\ \\_F E}\\\n then have B_non_empty: \\B \\ {}\\ using non_empty by auto\n interpret minimal_element \"Prec_F_g D\" UNIV using all_wf[of D] .\n obtain F :: 'f where F: \\F = min_elt B\\ by auto\n then have D_in_F: \\D \\ \\_F F\\ unfolding B_def using non_empty\n by (smt Sup_UNIV Sup_upper UNIV_I contra_subsetD empty_iff empty_subsetI mem_Collect_eq\n min_elt_mem unfol_C_D)\n have F_prec: \\Prec_F_g D F C\\ using F min_elt_mem[of B, OF _ B_non_empty] unfolding B_def by auto\n have F_not_in: \\F \\ Red_F_\\ N\\\n proof\n assume F_in: \\F \\ Red_F_\\ N\\\n have unfol_F_D: \\D \\ Red_F_G (\\_set N) \\ (\\G\\N. Prec_F_g D G F \\ D \\ \\_F G)\\\n using F_in D_in_F unfolding Red_F_\\_def by auto\n then have \\\\G\\N. Prec_F_g D G F \\ D \\ \\_F G\\ using contrad D_in unfolding Red_F_\\_def by auto\n then obtain G where G_in: \\G \\ N\\ and G_prec: \\Prec_F_g D G F\\ and G_map: \\D \\ \\_F G\\ by auto\n have \\Prec_F_g D G C\\ using G_prec F_prec Prec_trans by blast\n then have \\G \\ B\\ unfolding B_def using G_in G_map by auto\n then show \\False\\ using F G_prec min_elt_minimal[of B G, OF _ B_non_empty] by auto\n qed\n have \\F \\ N\\ using F by (metis B_def B_non_empty mem_Collect_eq min_elt_mem top_greatest)\n then have \\F \\ N - Red_F_\\ N\\ using F_not_in by auto\n then show \\False\\\n using D_in_F neg_not_sec_case F_prec by blast\n qed\nnext\n fix C\n assume only_if: \\\\D\\\\_F C. D \\ Red_F_G (\\_set N) \\ (\\E\\N - Red_F_\\ N. Prec_F_g D E C \\ D \\ \\_F E)\\\n show \\C \\ Red_F_\\ N\\ unfolding Red_F_\\_def using only_if by auto\nqed\n\n(* lem:lifting-main-technical *)\nlemma not_red_map_in_map_not_red: \\\\_set N - Red_F_G (\\_set N) \\ \\_set (N - Red_F_\\ N)\\\nproof\n fix D\n assume\n D_hyp: \\D \\ \\_set N - Red_F_G (\\_set N)\\\n interpret minimal_element \"Prec_F_g D\" UNIV using all_wf[of D] .\n have D_in: \\D \\ \\_set N\\ using D_hyp by blast\n have D_not_in: \\D \\ Red_F_G (\\_set N)\\ using D_hyp by blast\n have exist_C: \\\\C. C \\ N \\ D \\ \\_F C\\ using D_in by auto\n define B where \\B = {C \\ N. D \\ \\_F C}\\\n obtain C where C: \\C = min_elt B\\ by auto\n have C_in_N: \\C \\ N\\\n using exist_C by (metis B_def C empty_iff mem_Collect_eq min_elt_mem top_greatest)\n have D_in_C: \\D \\ \\_F C\\\n using exist_C by (metis B_def C empty_iff mem_Collect_eq min_elt_mem top_greatest)\n have C_not_in: \\C \\ Red_F_\\ N\\\n proof\n assume C_in: \\C \\ Red_F_\\ N\\\n have \\D \\ Red_F_G (\\_set N) \\ (\\E\\N. Prec_F_g D E C \\ D \\ \\_F E)\\\n using C_in D_in_C unfolding Red_F_\\_def by auto\n then show \\False\\\n proof\n assume \\D \\ Red_F_G (\\_set N)\\\n then show \\False\\ using D_not_in by simp\n next\n assume \\\\E\\N. Prec_F_g D E C \\ D \\ \\_F E\\\n then show \\False\\\n using C by (metis (no_types, lifting) B_def UNIV_I empty_iff mem_Collect_eq\n min_elt_minimal top_greatest)\n qed\n qed\n show \\D \\ \\_set (N - Red_F_\\ N)\\ using D_in_C C_not_in C_in_N by blast\nqed\n\n(* lem:nonredundant-entails-redundant *)\nlemma Red_F_Bot_F: \\B \\ Bot_F \\ N \\\\ {B} \\ N - Red_F_\\ N \\\\ {B}\\\nproof -\n fix B N\n assume\n B_in: \\B \\ Bot_F\\ and\n N_entails: \\N \\\\ {B}\\\n then have to_bot: \\\\_set N - Red_F_G (\\_set N) \\G \\_F B\\\n using Ground.Red_F_Bot Bot_map unfolding entails_\\_def\n by (smt cSup_singleton Ground.entail_set_all_formulas image_insert image_is_empty subsetCE)\n have from_f: \\\\_set (N - Red_F_\\ N) \\G \\_set N - Red_F_G (\\_set N)\\\n using Ground.subset_entailed[OF not_red_map_in_map_not_red] by blast\n then have \\\\_set (N - Red_F_\\ N) \\G \\_F B\\ using to_bot Ground.entails_trans by blast\n then show \\N - Red_F_\\ N \\\\ {B}\\ using Bot_map unfolding entails_\\_def by simp\nqed\n\n(* lem:redundancy-monotonic-addition 1/2 *)\nlemma Red_F_of_subset_F: \\N \\ N' \\ Red_F_\\ N \\ Red_F_\\ N'\\\n using Ground.Red_F_of_subset unfolding Red_F_\\_def by (smt Collect_mono \\_subset subset_iff)\n\n(* lem:redundancy-monotonic-addition 2/2 *)\nlemma Red_Inf_of_subset_F: \\N \\ N' \\ Red_Inf_\\ N \\ Red_Inf_\\ N'\\\n using Collect_mono \\_subset subset_iff Ground.Red_Inf_of_subset unfolding Red_Inf_\\_def\n by (smt Ground.Red_F_of_subset Un_iff)\n\n(* lem:redundancy-monotonic-deletion-forms *)\nlemma Red_F_of_Red_F_subset_F: \\N' \\ Red_F_\\ N \\ Red_F_\\ N \\ Red_F_\\ (N - N')\\\nproof\n fix N N' C\n assume\n N'_in_Red_F_N: \\N' \\ Red_F_\\ N\\ and\n C_in_red_F_N: \\C \\ Red_F_\\ N\\\n have lem8: \\\\D \\ \\_F C. D \\ Red_F_G (\\_set N) \\ (\\E \\ (N - Red_F_\\ N). Prec_F_g D E C \\ D \\ \\_F E)\\\n using Red_F_\\_equiv_def C_in_red_F_N by blast\n show \\C \\ Red_F_\\ (N - N')\\ unfolding Red_F_\\_def\n proof (rule,rule)\n fix D\n assume \\D \\ \\_F C\\\n then have \\D \\ Red_F_G (\\_set N) \\ (\\E \\ (N - Red_F_\\ N). Prec_F_g D E C \\ D \\ \\_F E)\\\n using lem8 by auto\n then show \\D \\ Red_F_G (\\_set (N - N')) \\ (\\E\\N - N'. Prec_F_g D E C \\ D \\ \\_F E)\\\n proof\n assume \\D \\ Red_F_G (\\_set N)\\\n then have \\D \\ Red_F_G (\\_set N - Red_F_G (\\_set N))\\\n using Ground.Red_F_of_Red_F_subset[of \"Red_F_G (\\_set N)\" \"\\_set N\"] by auto\n then have \\D \\ Red_F_G (\\_set (N - Red_F_\\ N))\\\n using Ground.Red_F_of_subset[OF not_red_map_in_map_not_red[of N]] by auto\n then have \\D \\ Red_F_G (\\_set (N - N'))\\\n using N'_in_Red_F_N \\_subset[of \"N - Red_F_\\ N\" \"N - N'\"]\n by (smt DiffE DiffI Ground.Red_F_of_subset subsetCE subsetI)\n then show ?thesis by blast\n next\n assume \\\\E\\N - Red_F_\\ N. Prec_F_g D E C \\ D \\ \\_F E\\\n then obtain E where\n E_in: \\E\\N - Red_F_\\ N\\ and\n E_prec_C: \\Prec_F_g D E C\\ and\n D_in: \\D \\ \\_F E\\\n by auto\n have \\E \\ N - N'\\ using E_in N'_in_Red_F_N by blast\n then show ?thesis using E_prec_C D_in by blast\n qed\n qed\nqed\n\n(* lem:redundancy-monotonic-deletion-infs *)\nlemma Red_Inf_of_Red_F_subset_F: \\N' \\ Red_F_\\ N \\ Red_Inf_\\ N \\ Red_Inf_\\ (N - N') \\\nproof\n fix N N' \\\n assume\n N'_in_Red_F_N: \\N' \\ Red_F_\\ N\\ and\n i_in_Red_Inf_N: \\\\ \\ Red_Inf_\\ N\\\n have i_in: \\\\ \\ Inf_F\\ using i_in_Red_Inf_N unfolding Red_Inf_\\_def by blast\n {\n assume not_none: \"\\_Inf \\ \\ None\"\n have \\\\\\' \\ the (\\_Inf \\). \\' \\ Red_Inf_G (\\_set N)\\\n using not_none i_in_Red_Inf_N unfolding Red_Inf_\\_def by auto\n then have \\\\\\' \\ the (\\_Inf \\). \\' \\ Red_Inf_G (\\_set N - Red_F_G (\\_set N))\\\n using not_none Ground.Red_Inf_of_Red_F_subset by blast\n then have ip_in_Red_Inf_G: \\\\\\' \\ the (\\_Inf \\). \\' \\ Red_Inf_G (\\_set (N - Red_F_\\ N))\\\n using not_none Ground.Red_Inf_of_subset[OF not_red_map_in_map_not_red[of N]] by auto\n then have not_none_in: \\\\\\' \\ the (\\_Inf \\). \\' \\ Red_Inf_G (\\_set (N - N'))\\\n using not_none N'_in_Red_F_N\n by (meson Diff_mono Ground.Red_Inf_of_subset \\_subset subset_iff subset_refl)\n then have \"the (\\_Inf \\) \\ Red_Inf_G (\\_set (N - N'))\" by blast\n }\n moreover {\n assume none: \"\\_Inf \\ = None\"\n have ground_concl_subs: \"\\_F (concl_of \\) \\ (\\_set N \\ Red_F_G (\\_set N))\"\n using none i_in_Red_Inf_N unfolding Red_Inf_\\_def by blast\n then have d_in_imp12: \"D \\ \\_F (concl_of \\) \\ D \\ \\_set N - Red_F_G (\\_set N) \\ D \\ Red_F_G (\\_set N)\"\n by blast\n have d_in_imp1: \"D \\ \\_set N - Red_F_G (\\_set N) \\ D \\ \\_set (N - N')\"\n using not_red_map_in_map_not_red N'_in_Red_F_N by blast\n have d_in_imp_d_in: \"D \\ Red_F_G (\\_set N) \\ D \\ Red_F_G (\\_set N - Red_F_G (\\_set N))\"\n using Ground.Red_F_of_Red_F_subset[of \"Red_F_G (\\_set N)\" \"\\_set N\"] by blast\n have g_subs1: \"\\_set N - Red_F_G (\\_set N) \\ \\_set (N - Red_F_\\ N)\"\n using not_red_map_in_map_not_red unfolding Red_F_\\_def by auto\n have g_subs2: \"\\_set (N - Red_F_\\ N) \\ \\_set (N - N')\"\n using N'_in_Red_F_N by blast\n have d_in_imp2: \"D \\ Red_F_G (\\_set N) \\ D \\ Red_F_G (\\_set (N - N'))\"\n using Ground.Red_F_of_subset Ground.Red_F_of_subset[OF g_subs1]\n Ground.Red_F_of_subset[OF g_subs2] d_in_imp_d_in by blast\n have \"\\_F (concl_of \\) \\ (\\_set (N - N') \\ Red_F_G (\\_set (N - N')))\"\n using d_in_imp12 d_in_imp1 d_in_imp2\n by (smt Ground.Red_F_of_Red_F_subset Ground.Red_F_of_subset UnCI UnE Un_Diff_cancel2\n ground_concl_subs g_subs1 g_subs2 subset_iff)\n }\n ultimately show \\\\ \\ Red_Inf_\\ (N - N')\\ using i_in unfolding Red_Inf_\\_def by auto\nqed\n\n(* lem:concl-contained-implies-red-inf *)\nlemma Red_Inf_of_Inf_to_N_F:\n assumes\n i_in: \\\\ \\ Inf_F\\ and\n concl_i_in: \\concl_of \\ \\ N\\\n shows\n \\\\ \\ Red_Inf_\\ N \\\nproof -\n have \\\\ \\ Inf_F \\ \\_Inf \\ \\ None \\ the (\\_Inf \\) \\ Red_Inf_G (\\_F (concl_of \\))\\ using inf_map by simp\n moreover have \\Red_Inf_G (\\_F (concl_of \\)) \\ Red_Inf_G (\\_set N)\\\n using concl_i_in Ground.Red_Inf_of_subset by blast\n moreover have \"\\ \\ Inf_F \\ \\_Inf \\ = None \\ concl_of \\ \\ N \\ \\_F (concl_of \\) \\ \\_set N\"\n by blast\n ultimately show ?thesis using i_in concl_i_in unfolding Red_Inf_\\_def by auto\nqed\n\n(* thm:FRedsqsubset-is-red-crit and also thm:lifted-red-crit if ordering empty *)\nsublocale lifted_calculus_with_red_crit: calculus_with_red_crit\n where\n Bot = Bot_F and Inf = Inf_F and entails = entails_\\ and\n Red_Inf = Red_Inf_\\ and Red_F = Red_F_\\\nproof\n fix B N N' \\\n show \\Red_Inf_\\ N \\ Inf_F\\ unfolding Red_Inf_\\_def by blast\n show \\B \\ Bot_F \\ N \\\\ {B} \\ N - Red_F_\\ N \\\\ {B}\\ using Red_F_Bot_F by simp\n show \\N \\ N' \\ Red_F_\\ N \\ Red_F_\\ N'\\ using Red_F_of_subset_F by simp\n show \\N \\ N' \\ Red_Inf_\\ N \\ Red_Inf_\\ N'\\ using Red_Inf_of_subset_F by simp\n show \\N' \\ Red_F_\\ N \\ Red_F_\\ N \\ Red_F_\\ (N - N')\\ using Red_F_of_Red_F_subset_F by simp\n show \\N' \\ Red_F_\\ N \\ Red_Inf_\\ N \\ Red_Inf_\\ (N - N')\\ using Red_Inf_of_Red_F_subset_F by simp\n show \\\\ \\ Inf_F \\ concl_of \\ \\ N \\ \\ \\ Red_Inf_\\ N\\ using Red_Inf_of_Inf_to_N_F by simp\nqed\n\nlemma lifted_calc_is_calc: \"calculus_with_red_crit Bot_F Inf_F entails_\\ Red_Inf_\\ Red_F_\\\"\n using lifted_calculus_with_red_crit.calculus_with_red_crit_axioms .\n\nlemma grounded_inf_in_ground_inf: \"\\ \\ Inf_F \\ \\_Inf \\ \\ None \\ the (\\_Inf \\) \\ Inf_G\"\n using inf_map Ground.Red_Inf_to_Inf by blast\n\n(* lem:sat-wrt-finf *)\nlemma sat_imp_ground_sat: \"lifted_calculus_with_red_crit.saturated N \\ Ground.Inf_from (\\_set N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf \\' \\ None \\ \\ \\ the (\\_Inf \\')} \\ Red_Inf_G (\\_set N)) \\\n Ground.saturated (\\_set N)\"\nproof -\n fix N\n assume\n sat_n: \"lifted_calculus_with_red_crit.saturated N\" and\n inf_grounded_in: \"Ground.Inf_from (\\_set N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf \\' \\ None \\ \\ \\ the (\\_Inf \\')} \\ Red_Inf_G (\\_set N))\"\n show \"Ground.saturated (\\_set N)\" unfolding Ground.saturated_def\n proof\n fix \\\n assume i_in: \"\\ \\ Ground.Inf_from (\\_set N)\"\n {\n assume \"\\ \\ {\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf \\' \\ None \\ \\ \\ the (\\_Inf \\')}\"\n then obtain \\' where \"\\'\\ Non_ground.Inf_from N\" \"\\_Inf \\' \\ None\" \"\\ \\ the (\\_Inf \\')\" by blast\n then have \"\\ \\ Red_Inf_G (\\_set N)\"\n using Red_Inf_\\_def sat_n unfolding lifted_calculus_with_red_crit.saturated_def by auto\n }\n then show \"\\ \\ Red_Inf_G (\\_set N)\" using inf_grounded_in i_in by blast\n qed\nqed\n\n(* thm:finf-complete *)\ntheorem stat_ref_comp_to_non_ground:\n assumes\n stat_ref_G: \"static_refutational_complete_calculus Bot_G Inf_G entails_G Red_Inf_G Red_F_G\" and\n sat_n_imp: \"\\N. (lifted_calculus_with_red_crit.saturated N \\ Ground.Inf_from (\\_set N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf \\' \\ None \\ \\ \\ the (\\_Inf \\')} \\ Red_Inf_G (\\_set N)))\"\n shows\n \"static_refutational_complete_calculus Bot_F Inf_F entails_\\ Red_Inf_\\ Red_F_\\\"\nproof\n fix B N\n assume\n b_in: \"B \\ Bot_F\" and\n sat_n: \"lifted_calculus_with_red_crit.saturated N\" and\n n_entails_bot: \"N \\\\ {B}\"\n have ground_n_entails: \"\\_set N \\G \\_F B\"\n using n_entails_bot unfolding entails_\\_def by simp\n then obtain BG where bg_in1: \"BG \\ \\_F B\"\n using Bot_map_not_empty[OF b_in] by blast\n then have bg_in: \"BG \\ Bot_G\"\n using Bot_map[OF b_in] by blast\n have ground_n_entails_bot: \"\\_set N \\G {BG}\"\n using ground_n_entails bg_in1 Ground.entail_set_all_formulas by blast\n have \"Ground.Inf_from (\\_set N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf \\' \\ None \\ \\ \\ the (\\_Inf \\')} \\ Red_Inf_G (\\_set N))\"\n using sat_n_imp[OF sat_n] .\n have \"Ground.saturated (\\_set N)\"\n using sat_imp_ground_sat[OF sat_n sat_n_imp[OF sat_n]] .\n then have \"\\BG'\\Bot_G. BG' \\ (\\_set N)\"\n using stat_ref_G Ground.calculus_with_red_crit_axioms bg_in ground_n_entails_bot\n unfolding static_refutational_complete_calculus_def static_refutational_complete_calculus_axioms_def\n by blast\n then show \"\\B'\\ Bot_F. B' \\ N\"\n using bg_in Bot_cond Bot_map_not_empty Bot_cond by blast\nqed\n\nend\n\nabbreviation Empty_Order where\n \"Empty_Order C1 C2 \\ False\"\n\nlemma any_to_empty_order_lifting:\n \"lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G Red_F_G \\_F\n \\_Inf Prec_F_g \\ lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G\n Red_F_G \\_F \\_Inf (\\g. Empty_Order)\"\nproof -\n fix Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G Red_F_G \\_F \\_Inf Prec_F_g\n assume lift: \"lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G\n Red_F_G \\_F \\_Inf Prec_F_g\"\n then interpret lift_g:\n lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G Red_F_G \\_F\n \\_Inf Prec_F_g\n by auto\n have empty_wf: \"minimal_element ((\\g. Empty_Order) g) UNIV\"\n by (simp add: lift_g.all_wf minimal_element.intro po_on_def transp_on_def wfp_on_def\n wfp_on_imp_irreflp_on)\n then show \"lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G Red_F_G\n \\_F \\_Inf (\\g. Empty_Order)\"\n by (simp add: empty_wf lift_g.standard_lifting_axioms\n lifting_with_wf_ordering_family_axioms.intro lifting_with_wf_ordering_family_def)\nqed\n\nlocale lifting_equivalence_with_empty_order =\n any_order_lifting: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G\n Red_F_G \\_F \\_Inf Prec_F_g +\n empty_order_lifting: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G entails_G Inf_G Red_Inf_G\n Red_F_G \\_F \\_Inf \"\\g. Empty_Order\"\n for\n \\_F :: \\'f \\ 'g set\\ and\n \\_Inf :: \\'f inference \\ 'g inference set option\\ and\n Bot_F :: \\'f set\\ and\n Inf_F :: \\'f inference set\\ and\n Bot_G :: \\'g set\\ and\n Inf_G :: \\'g inference set\\ and\n entails_G :: \\'g set \\ 'g set \\ bool\\ (infix \"\\G\" 50) and\n Red_Inf_G :: \\'g set \\ 'g inference set\\ and\n Red_F_G :: \\'g set \\ 'g set\\ and\n Prec_F_g :: \\'g \\ 'f \\ 'f \\ bool\\\n\nsublocale lifting_with_wf_ordering_family \\ lifting_equivalence_with_empty_order\nproof\n show \"po_on Empty_Order UNIV\"\n unfolding po_on_def by (simp add: transp_onI wfp_on_imp_irreflp_on)\n show \"wfp_on Empty_Order UNIV\"\n unfolding wfp_on_def by simp\nqed\n\ncontext lifting_equivalence_with_empty_order\nbegin\n\n(* lem:saturation-indep-of-sqsubset *)\nlemma saturated_empty_order_equiv_saturated:\n \"any_order_lifting.lifted_calculus_with_red_crit.saturated N =\n empty_order_lifting.lifted_calculus_with_red_crit.saturated N\" by standard\n\n(* lem:static-ref-compl-indep-of-sqsubset *)\nlemma static_empty_order_equiv_static:\n \"static_refutational_complete_calculus Bot_F Inf_F\n any_order_lifting.entails_\\ empty_order_lifting.Red_Inf_\\ empty_order_lifting.Red_F_\\ =\n static_refutational_complete_calculus Bot_F Inf_F any_order_lifting.entails_\\\n any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\\"\n unfolding static_refutational_complete_calculus_def\n by (rule iffI) (standard,(standard)[],simp)+\n\n(* thm:FRedsqsubset-is-dyn-ref-compl *)\ntheorem static_to_dynamic:\n \"static_refutational_complete_calculus Bot_F Inf_F\n any_order_lifting.entails_\\ empty_order_lifting.Red_Inf_\\ empty_order_lifting.Red_F_\\ =\n dynamic_refutational_complete_calculus Bot_F Inf_F\n any_order_lifting.entails_\\ any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\ \"\n (is \"?static=?dynamic\")\nproof\n assume ?static\n then have static_general:\n \"static_refutational_complete_calculus Bot_F Inf_F any_order_lifting.entails_\\\n any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\\" (is \"?static_gen\")\n using static_empty_order_equiv_static by simp\n interpret static_refutational_complete_calculus Bot_F Inf_F any_order_lifting.entails_\\\n any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\\n using static_general .\n show \"?dynamic\" by standard\nnext\n assume dynamic_gen: ?dynamic\n interpret dynamic_refutational_complete_calculus Bot_F Inf_F any_order_lifting.entails_\\\n any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\\n using dynamic_gen .\n have \"static_refutational_complete_calculus Bot_F Inf_F any_order_lifting.entails_\\\n any_order_lifting.Red_Inf_\\ any_order_lifting.Red_F_\\\"\n by standard\n then show \"?static\" using static_empty_order_equiv_static by simp\nqed\n\nend\n\nsubsection \\Lifting with a Family of Redundancy Criteria\\\n\nlocale standard_lifting_with_red_crit_family = Non_ground: inference_system Inf_F\n + Ground_family: calculus_with_red_crit_family Bot_G Inf_G Q entails_q Red_Inf_q Red_F_q\n for\n Inf_F :: \"'f inference set\" and\n Bot_G :: \"'g set\" and\n Inf_G :: \\'g inference set\\ and\n Q :: \"'q itself\" and\n entails_q :: \"'q \\ ('g set \\ 'g set \\ bool)\" and\n Red_Inf_q :: \"'q \\ ('g set \\ 'g inference set)\" and\n Red_F_q :: \"'q \\ ('g set \\ 'g set)\"\n + fixes\n Bot_F :: \"'f set\" and\n \\_F_q :: \"'q \\ 'f \\ 'g set\" and\n \\_Inf_q :: \"'q \\ 'f inference \\ 'g inference set option\" and\n Prec_F_g :: \"'g \\ 'f \\ 'f \\ bool\"\n assumes\n standard_lifting_family: \"lifting_with_wf_ordering_family Bot_F Inf_F Bot_G (entails_q q)\n Inf_G (Red_Inf_q q) (Red_F_q q) (\\_F_q q) (\\_Inf_q q) Prec_F_g\"\nbegin\n\ndefinition \\_set_q :: \"'q \\ 'f set \\ 'g set\" where\n \"\\_set_q q N \\ \\ (\\_F_q q ` N)\"\n\ndefinition Red_Inf_\\_q :: \"'q \\ 'f set \\ 'f inference set\" where\n \"Red_Inf_\\_q q N = {\\ \\ Inf_F. (\\_Inf_q q \\ \\ None \\ the (\\_Inf_q q \\) \\ Red_Inf_q q (\\_set_q q N))\n \\ (\\_Inf_q q \\ = None \\ \\_F_q q (concl_of \\) \\ (\\_set_q q N \\ Red_F_q q (\\_set_q q N)))}\"\n\ndefinition Red_Inf_\\_Q :: \"'f set \\ 'f inference set\" where\n \"Red_Inf_\\_Q N = \\ {X N |X. X \\ (Red_Inf_\\_q ` UNIV)}\"\n\ndefinition Red_F_\\_empty_q :: \"'q \\ 'f set \\ 'f set\" where\n \"Red_F_\\_empty_q q N = {C. \\D \\ \\_F_q q C. D \\ Red_F_q q (\\_set_q q N) \\\n (\\E \\ N. Empty_Order E C \\ D \\ \\_F_q q E)}\"\n\ndefinition Red_F_\\_empty :: \"'f set \\ 'f set\" where\n \"Red_F_\\_empty N = \\ {X N |X. X \\ (Red_F_\\_empty_q ` UNIV)}\"\n\ndefinition Red_F_\\_q_g :: \"'q \\ 'f set \\ 'f set\" where\n \"Red_F_\\_q_g q N = {C. \\D \\ \\_F_q q C. D \\ Red_F_q q (\\_set_q q N) \\ (\\E \\ N. Prec_F_g D E C \\ D \\ \\_F_q q E)}\"\n\ndefinition Red_F_\\_g :: \"'f set \\ 'f set\" where\n \"Red_F_\\_g N = \\ {X N |X. X \\ (Red_F_\\_q_g ` UNIV)}\"\n\ndefinition entails_\\_q :: \"'q \\ 'f set \\ 'f set \\ bool\" where\n \"entails_\\_q q N1 N2 \\ entails_q q (\\_set_q q N1) (\\_set_q q N2)\"\n\ndefinition entails_\\_Q :: \"'f set \\ 'f set \\ bool\" (infix \"\\\\\" 50) where\n \"entails_\\_Q N1 N2 \\ \\q. entails_\\_q q N1 N2\"\n\nlemma red_crit_lifting_family:\n \"calculus_with_red_crit Bot_F Inf_F (entails_\\_q q) (Red_Inf_\\_q q) (Red_F_\\_q_g q)\"\nproof -\n fix q\n interpret wf_lift:\n lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q q\" Inf_G \"Red_Inf_q q\" \"Red_F_q q\"\n \"\\_F_q q\" \"\\_Inf_q q\" Prec_F_g\n using standard_lifting_family .\n have \"entails_\\_q q = wf_lift.entails_\\\"\n unfolding entails_\\_q_def wf_lift.entails_\\_def \\_set_q_def by blast\n moreover have \"Red_Inf_\\_q q = wf_lift.Red_Inf_\\\"\n unfolding Red_Inf_\\_q_def \\_set_q_def wf_lift.Red_Inf_\\_def by blast\n moreover have \"Red_F_\\_q_g q = wf_lift.Red_F_\\\"\n unfolding Red_F_\\_q_g_def \\_set_q_def wf_lift.Red_F_\\_def by blast\n ultimately show \"calculus_with_red_crit Bot_F Inf_F (entails_\\_q q) (Red_Inf_\\_q q) (Red_F_\\_q_g q)\"\n using wf_lift.lifted_calculus_with_red_crit.calculus_with_red_crit_axioms by simp\nqed\n\nlemma red_crit_lifting_family_empty_ord:\n \"calculus_with_red_crit Bot_F Inf_F (entails_\\_q q) (Red_Inf_\\_q q) (Red_F_\\_empty_q q)\"\nproof -\n fix q\n interpret wf_lift:\n lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q q\" Inf_G \"Red_Inf_q q\" \"Red_F_q q\"\n \"\\_F_q q\" \"\\_Inf_q q\" Prec_F_g\n using standard_lifting_family .\n have \"entails_\\_q q = wf_lift.entails_\\\"\n unfolding entails_\\_q_def wf_lift.entails_\\_def \\_set_q_def by blast\n moreover have \"Red_Inf_\\_q q = wf_lift.Red_Inf_\\\"\n unfolding Red_Inf_\\_q_def \\_set_q_def wf_lift.Red_Inf_\\_def by blast\n moreover have \"Red_F_\\_empty_q q = wf_lift.empty_order_lifting.Red_F_\\\"\n unfolding Red_F_\\_empty_q_def \\_set_q_def wf_lift.empty_order_lifting.Red_F_\\_def by blast\n ultimately show \"calculus_with_red_crit Bot_F Inf_F (entails_\\_q q) (Red_Inf_\\_q q) (Red_F_\\_empty_q q)\"\n using wf_lift.empty_order_lifting.lifted_calculus_with_red_crit.calculus_with_red_crit_axioms\n by simp\nqed\n\nlemma cons_rel_fam_Q_lem: \\consequence_relation_family Bot_F entails_\\_q\\\nproof\n show \"Bot_F \\ {}\"\n using standard_lifting_family\n by (meson ex_in_conv lifting_with_wf_ordering_family.axioms(1) standard_lifting.Bot_F_not_empty)\nnext\n fix qi\n show \"Bot_F \\ {}\"\n using standard_lifting_family\n by (meson ex_in_conv lifting_with_wf_ordering_family.axioms(1) standard_lifting.Bot_F_not_empty)\nnext\n fix qi B N1\n assume\n B_in: \"B \\ Bot_F\"\n interpret lift: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q qi\" Inf_G \"Red_Inf_q qi\"\n \"Red_F_q qi\" \"\\_F_q qi\" \"\\_Inf_q qi\" Prec_F_g\n by (rule standard_lifting_family)\n have \"(entails_\\_q qi) = lift.entails_\\\"\n unfolding entails_\\_q_def lift.entails_\\_def \\_set_q_def by simp\n then show \"entails_\\_q qi {B} N1\"\n using B_in lift.lifted_consequence_relation.bot_implies_all by auto\nnext\n fix qi and N2 N1::\"'f set\"\n assume\n N_incl: \"N2 \\ N1\"\n interpret lift: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q qi\" Inf_G \"Red_Inf_q qi\"\n \"Red_F_q qi\" \"\\_F_q qi\" \"\\_Inf_q qi\" Prec_F_g\n by (rule standard_lifting_family)\n have \"(entails_\\_q qi) = lift.entails_\\\"\n unfolding entails_\\_q_def lift.entails_\\_def \\_set_q_def by simp\n then show \"entails_\\_q qi N1 N2\"\n using N_incl by (simp add: lift.lifted_consequence_relation.subset_entailed)\nnext\n fix qi N1 N2\n assume\n all_C: \"\\C\\ N2. entails_\\_q qi N1 {C}\"\n interpret lift: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q qi\" Inf_G \"Red_Inf_q qi\"\n \"Red_F_q qi\" \"\\_F_q qi\" \"\\_Inf_q qi\" Prec_F_g\n by (rule standard_lifting_family)\n have \"(entails_\\_q qi) = lift.entails_\\\"\n unfolding entails_\\_q_def lift.entails_\\_def \\_set_q_def by simp\n then show \"entails_\\_q qi N1 N2\"\n using all_C lift.lifted_consequence_relation.all_formulas_entailed by presburger\nnext\n fix qi N1 N2 N3\n assume\n entails12: \"entails_\\_q qi N1 N2\" and\n entails23: \"entails_\\_q qi N2 N3\"\n interpret lift: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q qi\" Inf_G \"Red_Inf_q qi\"\n \"Red_F_q qi\" \"\\_F_q qi\" \"\\_Inf_q qi\" Prec_F_g\n by (rule standard_lifting_family)\n have \"(entails_\\_q qi) = lift.entails_\\\"\n unfolding entails_\\_q_def lift.entails_\\_def \\_set_q_def by simp\n then show \"entails_\\_q qi N1 N3\"\n using entails12 entails23 lift.lifted_consequence_relation.entails_trans by presburger\nqed\n\ninterpretation cons_rel_Q: consequence_relation Bot_F entails_\\_Q\nproof -\n interpret cons_rel_fam: consequence_relation_family Bot_F Q entails_\\_q\n by (rule cons_rel_fam_Q_lem)\n have \"consequence_relation_family.entails_Q entails_\\_q = entails_\\_Q\"\n unfolding entails_\\_Q_def cons_rel_fam.entails_Q_def by (simp add: entails_\\_q_def)\n then show \"consequence_relation Bot_F entails_\\_Q\"\n using consequence_relation_family.intersect_cons_rel_family[OF cons_rel_fam_Q_lem] by simp\nqed\n\nsublocale lifted_calc_w_red_crit_family:\n calculus_with_red_crit_family Bot_F Inf_F Q entails_\\_q Red_Inf_\\_q Red_F_\\_q_g\n using cons_rel_fam_Q_lem red_crit_lifting_family\n by (simp add: calculus_with_red_crit_family.intro calculus_with_red_crit_family_axioms_def)\n\nlemma lifted_calc_family_is_calc: \"calculus_with_red_crit Bot_F Inf_F entails_\\_Q Red_Inf_\\_Q Red_F_\\_g\"\nproof -\n have \"lifted_calc_w_red_crit_family.entails_Q = entails_\\_Q\"\n unfolding entails_\\_Q_def lifted_calc_w_red_crit_family.entails_Q_def by simp\n moreover have \"lifted_calc_w_red_crit_family.Red_Inf_Q = Red_Inf_\\_Q\"\n unfolding Red_Inf_\\_Q_def lifted_calc_w_red_crit_family.Red_Inf_Q_def by simp\n moreover have \"lifted_calc_w_red_crit_family.Red_F_Q = Red_F_\\_g\"\n unfolding Red_F_\\_g_def lifted_calc_w_red_crit_family.Red_F_Q_def by simp\n ultimately show \"calculus_with_red_crit Bot_F Inf_F entails_\\_Q Red_Inf_\\_Q Red_F_\\_g\"\n using lifted_calc_w_red_crit_family.inter_red_crit by simp\nqed\n\nsublocale empty_ord_lifted_calc_w_red_crit_family:\n calculus_with_red_crit_family Bot_F Inf_F Q entails_\\_q Red_Inf_\\_q Red_F_\\_empty_q\n using cons_rel_fam_Q_lem red_crit_lifting_family_empty_ord\n by (simp add: calculus_with_red_crit_family.intro calculus_with_red_crit_family_axioms_def)\n\n\n\n(* thm:intersect-finf-complete *)\ntheorem stat_ref_comp_to_non_ground_fam_inter:\n assumes\n stat_ref_G: \"\\q. static_refutational_complete_calculus Bot_G Inf_G (entails_q q) (Red_Inf_q q) (Red_F_q q)\" and\n sat_n_imp: \"\\N. (empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.saturated N \\\n \\q. Ground_family.Inf_from (\\_set_q q N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf_q q \\' \\ None \\ \\ \\ the (\\_Inf_q q \\')} \\ Red_Inf_q q (\\_set_q q N)))\"\n shows\n \"static_refutational_complete_calculus Bot_F Inf_F entails_\\_Q Red_Inf_\\_Q Red_F_\\_empty\"\n using inter_calc\n unfolding static_refutational_complete_calculus_def static_refutational_complete_calculus_axioms_def\nproof (standard, clarify)\n fix B N\n assume\n b_in: \"B \\ Bot_F\" and\n sat_n: \"calculus_with_red_crit.saturated Inf_F Red_Inf_\\_Q N\" and\n entails_bot: \"N \\\\ {B}\"\n interpret calculus_with_red_crit Bot_F Inf_F entails_\\_Q Red_Inf_\\_Q Red_F_\\_empty\n using inter_calc by blast\n have \"empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q = Red_Inf_\\_Q\"\n unfolding Red_Inf_\\_Q_def lifted_calc_w_red_crit_family.Red_Inf_Q_def by simp\n then have empty_ord_sat_n: \"empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.saturated N\"\n using sat_n\n unfolding saturated_def empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.saturated_def\n by simp\n then obtain q where inf_subs: \"Ground_family.Inf_from (\\_set_q q N) \\\n ({\\. \\\\'\\ Non_ground.Inf_from N. \\_Inf_q q \\' \\ None \\ \\ \\ the (\\_Inf_q q \\')} \\ Red_Inf_q q (\\_set_q q N))\"\n using sat_n_imp[of N] by blast\n interpret q_calc: calculus_with_red_crit Bot_F Inf_F \"entails_\\_q q\" \"Red_Inf_\\_q q\" \"Red_F_\\_q_g q\"\n using lifted_calc_w_red_crit_family.all_red_crit[of q] .\n have n_q_sat: \"q_calc.saturated N\" using lifted_calc_w_red_crit_family.sat_int_to_sat_q empty_ord_sat_n by simp\n interpret lifted_q_calc: lifting_with_wf_ordering_family Bot_F Inf_F Bot_G \"entails_q q\" Inf_G \"Red_Inf_q q\" \"Red_F_q q\" \"\\_F_q q\" \"\\_Inf_q q\"\n by (simp add: standard_lifting_family)\n have \"lifted_q_calc.empty_order_lifting.lifted_calculus_with_red_crit.saturated N\"\n using n_q_sat unfolding Red_Inf_\\_q_def \\_set_q_def lifted_q_calc.empty_order_lifting.Red_Inf_\\_def\n lifted_q_calc.lifted_calculus_with_red_crit.saturated_def q_calc.saturated_def by auto\n then have ground_sat_n: \"lifted_q_calc.Ground.saturated (\\_set_q q N)\"\n using lifted_q_calc.sat_imp_ground_sat[of N] inf_subs unfolding \\_set_q_def by blast\n have \"entails_\\_q q N {B}\" using entails_bot unfolding entails_\\_Q_def by simp\n then have ground_n_entails_bot: \"entails_q q (\\_set_q q N) (\\_set_q q {B})\" unfolding entails_\\_q_def .\n interpret static_refutational_complete_calculus Bot_G Inf_G \"entails_q q\" \"Red_Inf_q q\" \"Red_F_q q\"\n using stat_ref_G[of q] .\n obtain BG where bg_in: \"BG \\ \\_F_q q B\"\n using lifted_q_calc.Bot_map_not_empty[OF b_in] by blast\n then have \"BG \\ Bot_G\" using lifted_q_calc.Bot_map[OF b_in] by blast\n then have \"\\BG'\\Bot_G. BG' \\ \\_set_q q N\"\n using ground_sat_n ground_n_entails_bot static_refutational_complete[of BG, OF _ ground_sat_n]\n bg_in lifted_q_calc.Ground.entail_set_all_formulas[of \"\\_set_q q N\" \"\\_set_q q {B}\"] unfolding \\_set_q_def\n by simp\n then show \"\\B'\\ Bot_F. B' \\ N\" using lifted_q_calc.Bot_cond unfolding \\_set_q_def by blast\nqed\n\n(* lem:intersect-saturation-indep-of-sqsubset *)\nlemma sat_eq_sat_empty_order: \"lifted_calc_w_red_crit_family.inter_red_crit_calculus.saturated N =\n empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.saturated N \"\n by simp\n\n(* lem:intersect-static-ref-compl-indep-of-sqsubset *)\nlemma static_empty_ord_inter_equiv_static_inter:\n \"static_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n lifted_calc_w_red_crit_family.Red_Inf_Q lifted_calc_w_red_crit_family.Red_F_Q =\n static_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q empty_ord_lifted_calc_w_red_crit_family.Red_F_Q\"\n unfolding static_refutational_complete_calculus_def\n by (simp add: empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.calculus_with_red_crit_axioms\n lifted_calc_w_red_crit_family.inter_red_crit_calculus.calculus_with_red_crit_axioms)\n\n(* thm:intersect-static-ref-compl-is-dyn-ref-compl-with-order *)\ntheorem stat_eq_dyn_ref_comp_fam_inter: \"static_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q empty_ord_lifted_calc_w_red_crit_family.Red_F_Q =\n dynamic_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n lifted_calc_w_red_crit_family.Red_Inf_Q lifted_calc_w_red_crit_family.Red_F_Q\" (is \"?static=?dynamic\")\nproof\n assume ?static\n then have static_general: \"static_refutational_complete_calculus Bot_F Inf_F\n lifted_calc_w_red_crit_family.entails_Q lifted_calc_w_red_crit_family.Red_Inf_Q\n lifted_calc_w_red_crit_family.Red_F_Q\" (is \"?static_gen\")\n using static_empty_ord_inter_equiv_static_inter\n by simp\n interpret static_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n lifted_calc_w_red_crit_family.Red_Inf_Q lifted_calc_w_red_crit_family.Red_F_Q\n using static_general .\n show \"?dynamic\" by standard\nnext\n assume dynamic_gen: ?dynamic\n interpret dynamic_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n lifted_calc_w_red_crit_family.Red_Inf_Q lifted_calc_w_red_crit_family.Red_F_Q\n using dynamic_gen .\n have \"static_refutational_complete_calculus Bot_F Inf_F lifted_calc_w_red_crit_family.entails_Q\n lifted_calc_w_red_crit_family.Red_Inf_Q lifted_calc_w_red_crit_family.Red_F_Q\"\n by standard\n then show \"?static\" using static_empty_ord_inter_equiv_static_inter by simp\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Saturation_Framework/Lifting_to_Non_Ground_Calculi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2739521773133345}} {"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CIMP_unbounded_buffer\nimports\n \"../CIMP\"\n \"HOL-Library.Prefix_Order\"\nbegin\n\nabbreviation (input)\n Receive :: \"'location \\ 'channel \\ ('val \\ 'state \\ 'state)\n \\ (unit, 'location, 'channel \\ 'val, 'state) com\" (\"\\_\\/ _\\_\" [0,0,81] 81)\nwhere\n \"\\l\\ ch\\f \\ \\l\\ Response (\\q s. if fst q = ch then {(f (snd q) s, ())} else {})\"\n\nabbreviation (input)\n Send :: \"'location \\ 'channel \\ ('state \\ 'val) \\ ('state \\ 'state)\n \\ (unit, 'location, 'channel \\ 'val, 'state) com\" (\"\\_\\/ _\\_\" [0,0,81] 81)\nwhere\n \"\\l\\ ch\\f \\ \\l\\ Request (\\s. (ch, fst f s)) (\\ans s. {snd f s})\"\n\n(*>*)\nsection\\Example: an unbounded buffer \\label{sec:unbounded_buffer}\\\n\ntext\\\n\nThis is more literally Kai Engelhardt's example from his notes titled\n\\emph{Proving an Asynchronous Message Passing Program Correct}, 2011.\n\n\\\n\ndatatype ex_chname = \\12 | \\23\ntype_synonym ex_val = nat\ntype_synonym ex_ls = \"ex_val list\"\ntype_synonym ex_ch = \"ex_chname \\ ex_val\"\ndatatype ex_loc = c1 | r12 | r23 | s23 | s12\ndatatype ex_proc = p1 | p2 | p3\n\ntype_synonym ex_pgm = \"(unit, ex_loc, ex_ch, ex_ls) com\"\ntype_synonym ex_pred = \"(unit, ex_loc, ex_proc, ex_ch, ex_ls) state_pred\"\ntype_synonym ex_state = \"(unit, ex_loc, ex_proc, ex_ch, ex_ls) system_state\"\ntype_synonym ex_sys = \"(unit, ex_loc, ex_proc, ex_ch, ex_ls) system\"\ntype_synonym ex_history = \"(ex_ch \\ unit) list\"\n\ntext\\\n\nThe local state for the producer process contains all values produced; consider that ghost state.\n\n\\\n\nabbreviation (input) snoc :: \"'a \\ 'a list \\ 'a list\" where \"snoc x xs \\ xs @ [x]\"\n\nprimrec ex_coms :: \"ex_proc \\ ex_pgm\" where\n \"ex_coms p1 = LOOP DO \\c1\\ LocalOp (\\xs. {snoc x xs |x. True}) ;; \\s12\\ \\12\\(last, id) OD\"\n| \"ex_coms p2 = LOOP DO \\r12\\ \\12\\snoc\n \\ \\c1\\ IF (\\s. length s > 0) THEN \\s23\\ \\12\\(hd, tl) FI\n OD\"\n| \"ex_coms p3 = LOOP DO \\r23\\ \\23\\snoc OD\"\n\nabbreviation ex_init :: \"(ex_proc \\ ex_ls) \\ bool\" where\n \"ex_init s \\ \\p. s p = []\"\n\nabbreviation sys :: ex_sys where\n \"sys \\ \\PGMs = ex_coms, INIT = ex_init, FAIR = \\True\\\\\" (* FIXME add fairness hypotheses *)\n\nabbreviation\n filter_on_channel :: \"ex_chname \\ ex_state \\ ex_val list\" (\"\\_\" [100] 101)\nwhere\n \"\\ch \\ map (snd \\ fst) \\ filter ((=) ch \\ fst \\ fst) \\ HST\"\n\ndefinition I_pred :: ex_pred where\n \"I_pred = pred_conjoin [\n at p1 c1 \\<^bold>\\ \\\\12 \\<^bold>= (\\s. s\\ p1)\n , at p1 s12 \\<^bold>\\ (\\s. length (s\\ p1) > 0 \\ butlast (s\\ p1) = (\\\\12) s)\n , \\\\12 \\<^bold>\\ (\\s. s\\ p1)\n , \\\\12 \\<^bold>= \\\\23 \\<^bold>@ (\\s. s\\ p2)\n , at p2 s23 \\<^bold>\\ (\\s. length (s\\ p2) > 0)\n , (\\s. s\\ p3) \\<^bold>= \\\\23\n ]\"\n\ntext\\\n\nThe local state of @{const \"p3\"} is some prefix of the local state of\n@{const \"p1\"}.\n\n\\\n\ndefinition Etern_pred :: ex_pred where\n \"Etern_pred \\ \\s. s\\ p3 \\ s\\ p1\"\n\nlemma correct_system:\n assumes \"I_pred s\"\n shows \"Etern_pred s\"\nusing assms unfolding Etern_pred_def I_pred_def less_eq_list_def prefix_def by clarsimp\n\nlemma p1_c1[simplified, intro]:\n \"ex_coms, p1, lconst {s12} \\ \\I_pred\\ \\c1\\ LocalOp (\\xs. { snoc x xs |x. True })\"\napply (rule vcg.intros)\napply (clarsimp simp: I_pred_def atS_def)\ndone\n\nlemma p1_s12[simplified, intro]:\n \"ex_coms, p1, lconst {c1} \\ \\I_pred\\ \\s12\\ \\12\\(last, id)\"\napply (rule vcg.intros)\napply (rename_tac p')\napply (case_tac p'; clarsimp)\napply (clarsimp simp: I_pred_def atS_def)\napply (metis Prefix_Order.prefix_snoc append.assoc append_butlast_last_id)\ndone\n\nlemma p2_s23[simplified, intro]:\n \"ex_coms, p2, lconst {c1, r12} \\ \\I_pred\\ \\s23\\ \\12\\(hd, tl)\"\napply (rule vcg.intros)\napply (rename_tac p')\napply (case_tac p'; clarsimp)\ndone\n\nlemma p2_pi4[intro]:\n \"ex_coms, p2, lcond {s23} {c1, r12} (\\s. s \\ []) \\ \\I_pred\\ \\c1\\ IF (\\s. s \\ []) THEN c' FI\"\napply (rule vcg.intros)\napply (clarsimp simp: I_pred_def atS_def split: lcond_splits)\ndone\n\nlemma I: \"sys \\\\<^bsub>pre\\<^esub> I_pred\"\napply (rule VCG)\n apply (clarsimp dest!: initial_stateD simp: I_pred_def atS_def)\napply (rename_tac p)\napply (case_tac p; auto)\ndone\n\nlemma I_valid: \"sys \\ \\\\I_pred\\\"\nby (rule valid_prerun_lift[OF I])\n\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/ConcurrentIMP/ex/CIMP_unbounded_buffer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2739021323302521}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Sim\n imports Tau Sum\nbegin\n\nnominal_datatype 'a prefix =\n pInput \"'a::fs_name\" \"name list\" 'a\n| pOutput 'a 'a \n| pTau \n\ncontext tau\nbegin\n\nnominal_primrec bindPrefix :: \"'a prefix \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi\" (\"_\\_\" [100, 100] 100)\nwhere\n \"bindPrefix (pInput M xvec N) P = M\\\\*xvec N\\.P\"\n| \"bindPrefix (pOutput M N) P = M\\N\\.P\"\n| \"bindPrefix (pTau) P = \\.(P)\"\nby(rule TrueI)+\n\nlemma bindPrefixEqvt[eqvt]:\n fixes p :: \"name prm\"\n and \\ :: \"'a prefix\"\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"(p \\ (\\\\P)) = (p \\ \\)\\(p \\ P)\"\nby(nominal_induct \\ rule: prefix.strong_inducts) (auto simp add: eqvts)\n\nlemma prefixCases[consumes 1, case_names cInput cOutput cTau]:\n fixes \\ :: 'b\n and \\ :: \"'a prefix\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ \\\\P \\\\ \\ P'\"\n and rInput: \"\\M xvec N K Tvec. \\\\ \\ M \\ K; set xvec \\ supp N; length xvec = length Tvec; distinct xvec\\ \\ \n Prop (pInput M xvec N) (K\\N[xvec::=Tvec]\\) (P[xvec::=Tvec])\"\n and rOutput: \"\\M N K. \\ \\ M \\ K \\ Prop (pOutput M N) (K\\N\\) P\"\n and rTau: \"\\ \\ P \\ P' \\ Prop (pTau) (\\) P'\"\n\n shows \"Prop \\ \\ P'\"\nusing \\\\ \\ \\\\P \\\\ \\ P'\\\nproof(nominal_induct rule: prefix.strong_induct)\n case(pInput M xvec N)\n from \\\\ \\ (pInput M xvec N)\\P \\\\ \\ P'\\ have \"\\ \\ M\\\\*xvec N\\.P \\\\ \\ P'\" by simp\n thus ?case by(auto elim: inputCases intro: rInput)\nnext\n case(pOutput M N)\n from \\\\ \\ (pOutput M N)\\P \\\\ \\ P'\\ have \"\\ \\ M\\N\\.P \\\\ \\ P'\" by simp\n thus ?case by(auto elim: outputCases intro: rOutput)\nnext\n case pTau\n from \\\\ \\ (pTau)\\P \\\\ \\ P'\\ have \"\\ \\ \\.(P) \\\\ \\ P'\" by simp\n thus ?case\n by(nominal_induct rule: action.strong_induct) (auto dest: tauActionE intro: rTau)\nqed \n \nlemma prefixTauCases[consumes 1, case_names cTau]:\n fixes \\ :: \"'a prefix\"\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ \\\\P \\\\ \\ P'\"\n and rTau: \"\\ \\ P \\ P' \\ Prop (pTau) P'\"\n\n shows \"Prop \\ P'\"\nproof -\n from \\\\ \\ \\\\P \\\\ \\ P'\\ obtain \\ where \"\\ \\ \\\\P \\\\ \\ P'\" and \"\\ = \\\" \n by auto\n thus ?thesis\n by(induct rule: prefixCases) (auto intro: rTau)\nqed\n\nlemma hennessySim1:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n and C1: \"\\\\ P Q R. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel\\ \\ (\\, P, R) \\ Rel\"\n\n shows \"\\ \\ \\.(P) \\\\Rel\\ Q\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ P \\ Q\\ \\\\ \\ Q \\\\ \\ Q'\\\n obtain P' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: weakSimE)\n\n from PChain obtain P'' where \"\\ \\ \\.(P) \\\\<^sub>\\ P''\" and \"\\ \\ P' \\ P''\"\n by(rule tauChainStepCons)\n thus ?case using P'RelQ' by(metis bisimE C1)\nqed\n\n\n\n assumes PTrans: \"\\ \\ P \\\\ \\ P'\"\n and P'RelQ: \"(\\, P', Q) \\ Rel\"\n and C1: \"\\\\ P Q R. \\(\\, P, Q) \\ Rel; \\ \\ Q \\ R\\ \\ (\\, P, R) \\ Rel\"\n\n shows \"\\ \\ P \\\\Rel\\ \\.(Q)\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ \\.(Q) \\\\ \\ Q'\\ have \"\\ \\ Q \\ Q'\" by(blast dest: tauActionE)\n with PTrans P'RelQ show ?case by(metis C1 tauActTauStepChain)\nqed\n\nlemma hennessySim3:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n and C1: \"\\Q'. \\ \\ Q \\\\ \\ Q' \\ (\\, P, Q') \\ Rel\"\n\n shows \"\\ \\ P \\\\Rel\\ Q\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ P \\ Q\\ \\\\ \\ Q \\\\ \\ Q'\\\n obtain P' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: weakSimE)\n with C1 \\\\ \\ Q \\\\ \\ Q'\\ show ?case \n by(force simp add: rtrancl_eq_or_trancl)\nqed\n\nlemma tauLaw1SimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n and \"eqvt Rel\"\n and C1: \"\\\\ P Q R. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel\\ \\ (\\, P, R) \\ Rel\"\n\n shows \"\\ \\ \\.(P) \\ Q\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ Q')\n from \\bn \\ \\* (\\.(P))\\ have \"bn \\ \\* P\" by simp\n with \\\\ \\ P \\ Q\\ \\\\ \\ Q \\\\ \\ Q'\\ \\bn \\ \\* \\\\ \\\\ \\ \\\\\n obtain P'' P' where PTrans: \"\\ : Q \\ P \\\\ \\ P''\" and P''Chain: \"\\ \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\"\n and P'RelQ': \"(\\ \\ \\', P', Q') \\ Rel\"\n by(blast dest: weakSimE)\n\n from PTrans \\bn \\ \\* \\\\ \\bn \\ \\* P\\ obtain P''' where \"\\ : Q \\ \\.(P) \\\\ \\ P'''\" and \"\\ \\ P'' \\ P'''\"\n by(rule weakTransitionTau)\n moreover from \\\\ \\ P'' \\ P'''\\ have \"\\ \\ \\' \\ P'' \\ P'''\" by(rule bisimE)\n with P''Chain obtain P'''' where \"\\ \\ \\' \\ P''' \\\\<^sup>^\\<^sub>\\ P''''\" and \"\\ \\ \\' \\ P' \\ P''''\"\n by(rule tauChainBisim)\n ultimately show ?case using \\(\\ \\ \\', P', Q') \\ Rel\\ by(metis bisimE C1)\nnext\n case(cTau Q')\n from \\\\ \\ P \\ Q\\ \\\\ \\ Q \\\\ \\ Q'\\\n obtain P' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: weakSimE)\n\n from PChain obtain P'' where \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P''\" and \"\\ \\ P' \\ P''\"\n by(rule tauChainCons)\n thus ?case using P'RelQ' by(metis bisimE C1) \nqed\n\nlemma tauLaw1SimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"eqvt Rel\"\n and \"(\\, P, Q) \\ Rel\"\n and C1: \"\\\\ P Q R. \\(\\, P, Q) \\ Rel; \\ \\ Q \\ R\\ \\ (\\, P, R) \\ Rel\"\n\n shows \"\\ \\ P \\ \\.(Q)\"\nusing \\eqvt Rel\\\nproof(induct rule: weakSimI[where C=Q])\n case(cAct \\' \\ Q')\n hence False by(cases rule: actionCases[where \\=\\]) auto\n thus ?case by simp\nnext\n case(cTau Q')\n have \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q\" by simp\n moreover from \\\\ \\ \\.(Q) \\\\ \\ Q'\\ have \"\\ \\ Q \\ Q'\" by(rule tauActionE)\n with \\(\\, P, Q) \\ Rel\\ have \"(\\, P, Q') \\ Rel\" by(rule C1)\n ultimately show ?case by blast\nqed\n\nlemma tauLaw3SimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a prefix\"\n\n assumes \"eqvt Rel\"\n and \"(\\, P, Q) \\ Rel\"\n and Subst: \"\\xvec Tvec. length xvec = length Tvec \\ (\\, P[xvec::=Tvec], Q[xvec::=Tvec]) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ Rel \\ (\\ \\ \\', P, Q) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P)) \\ \\\\Q\"\nusing \\eqvt Rel\\\nproof(induct rule: weakSimI[where C=Q])\n case(cAct \\' \\ Q')\n from \\\\ \\ \\\\Q \\\\ \\ Q'\\ \\\\ \\ \\\\ show ?case\n proof(induct rule: prefixCases)\n case(cInput M xvec N K Tvec)\n note \\\\ \\ M \\ K\\ \\distinct xvec\\ \\set xvec \\ supp N\\ \\length xvec = length Tvec\\\n moreover have \"insertAssertion (extractFrame(M\\\\*xvec N\\.Q)) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\" by auto\n ultimately have \"\\ : (M\\\\*xvec N\\.Q) \\ (M\\\\*xvec N\\.(\\.(P))) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P))[xvec::=Tvec]\" \n by(rule weakInput)\n hence \"\\ : (M\\\\*xvec N\\.Q) \\ (M\\\\*xvec N\\.(\\.(P))) \\K\\(N[xvec::=Tvec])\\ \\ \\.(P[xvec::=Tvec])\"\n using \\length xvec = length Tvec\\ \\distinct xvec\\\n by simp\n \n moreover obtain P' where PTrans: \"\\ \\ \\' \\ \\.(P[xvec::=Tvec]) \\\\ \\ P'\" and \"\\ \\ \\' \\ (P[xvec::=Tvec]) \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\' \\ \\.(P[xvec::=Tvec]) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\length xvec = length Tvec\\ have \"(\\, P[xvec::=Tvec], Q[xvec::=Tvec]) \\ Rel\" by(rule Subst)\n hence \"(\\ \\ \\', P[xvec::=Tvec], Q[xvec::=Tvec]) \\ Rel\" by(rule rExt)\n with \\\\ \\ \\' \\ P[xvec::=Tvec] \\ P'\\ have \"(\\ \\ \\', P', Q[xvec::=Tvec]) \\ Rel\" by(blast intro: bisimE C1 bisimReflexive)\n ultimately show ?case by fastforce\n next\n case(cOutput M N K)\n note \\\\ \\ M \\ K\\\n moreover have \"insertAssertion (extractFrame (M\\N\\.Q)) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\" by auto\n ultimately have \"\\ : M\\N\\.Q \\ M\\N\\.(\\.(P)) \\K\\N\\ \\ \\.(P)\" by(rule weakOutput)\n moreover obtain P' where PTrans: \"\\ \\ \\' \\ \\.(P) \\\\ \\ P'\" and \"\\ \\ \\' \\ P \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\' \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\(\\, P, Q) \\ Rel\\ have \"(\\ \\ \\', P, Q) \\ Rel\" by(rule rExt)\n with \\\\ \\ \\' \\ P \\ P'\\ have \"(\\ \\ \\', P', Q) \\ Rel\" by(blast intro: bisimE C1 bisimReflexive)\n ultimately show ?case by fastforce\n next\n case cTau\n with \\\\ \\ \\\\ show ?case\n by simp\n qed\nnext\n case(cTau Q')\n from \\\\ \\ \\\\Q \\\\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where tPTrans: \"\\ \\ \\.(\\.(P)) \\\\ \\ P'\" and \"\\ \\ \\.(P) \\ P'\" using tauActionI\n by auto\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n from PTrans \\\\ \\ \\.(P) \\ P'\\ obtain P''' where P'Trans: \"\\ \\ P' \\\\ \\ P'''\" and \"\\ \\ P'' \\ P'''\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n apply(drule_tac simE, auto)\n by(metis bisimE)\n from tPTrans P'Trans have \"\\ \\ \\.(\\.(P)) \\\\<^sup>^\\<^sub>\\ P'''\" by(fastforce dest: tauActTauChain)\n moreover from \\(\\, P, Q) \\ Rel\\ \\\\ \\ P \\ P''\\ \\\\ \\ P'' \\ P'''\\ \\\\ \\ Q \\ Q'\\ have \"(\\, P''', Q') \\ Rel\"\n by(metis bisimTransitive C1 bisimSymmetric)\n ultimately show ?case by fastforce\n qed\nqed\n\nlemma tauLaw3SimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"eqvt Rel\"\n and Subst: \"\\\\ xvec Tvec. length xvec = length Tvec \\ (\\, P[xvec::=Tvec], \\.(Q[xvec::=Tvec])) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n and \"\\\\. (\\, P, \\.(Q)) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\ \\\\(\\.(Q))\"\nusing \\eqvt Rel\\\nproof(induct rule: weakSimI[where C=Q])\n case(cAct \\' \\ Q')\n from \\\\ \\ \\\\(\\.(Q)) \\\\ \\ Q'\\ \\\\ \\ \\\\\n show ?case\n proof(induct rule: prefixCases)\n case(cInput M xvec N K Tvec)\n note \\\\ \\ M \\ K\\ \\distinct xvec\\ \\set xvec \\ supp N\\ \\length xvec=length Tvec\\\n moreover have \"insertAssertion (extractFrame (M\\\\*xvec N\\.(\\.(Q)))) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\" by auto\n ultimately have \"\\ : (M\\\\*xvec N\\.(\\.(Q))) \\ M\\\\*xvec N\\.P \\K\\(N[xvec::=Tvec])\\ \\ P[xvec::=Tvec]\"\n by(rule weakInput)\n moreover have \"\\ \\ \\' \\ P[xvec::=Tvec] \\\\<^sup>^\\<^sub>\\ P[xvec::=Tvec]\" by auto\n ultimately show ?case using Subst \\length xvec=length Tvec\\ \\distinct xvec\\\n by fastforce\n next\n case(cOutput M N K)\n note \\\\ \\ M \\ K\\\n moreover have \"insertAssertion (extractFrame (M\\N\\.(\\.(Q)))) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\" by auto\n ultimately have \"\\ : M\\N\\.(\\.(Q)) \\ M\\N\\.P \\K\\N\\ \\ P\" by(rule weakOutput)\n moreover have \"\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P\" by auto\n ultimately show ?case using \\(\\ \\ \\', P, \\.(Q)) \\ Rel\\ by fastforce\n next\n case cTau\n with \\\\ \\ \\\\ show ?case by simp\n qed\nnext\n case(cTau Q')\n from \\\\ \\ \\\\(\\.(Q)) \\\\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P'\" and \"\\ \\ P \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\\\ \\ P \\ P'\\ \\\\ \\ \\.(Q) \\ Q'\\ \\(\\, P, \\.(Q)) \\ Rel\\\n have \"(\\, P', Q') \\ Rel\" by(metis bisimTransitive bisimSymmetric C1)\n ultimately show ?case by fastforce\n qed\nqed\n\nlemma tauLaw3CongSimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"(\\, P, Q) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ Rel \\ (\\ \\ \\', P, Q) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P)) \\\\Rel\\ \\\\Q\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ \\\\Q \\\\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where tPTrans: \"\\ \\ \\.(\\.(P)) \\\\ \\ P'\" and \"\\ \\ \\.(P) \\ P'\" using tauActionI\n by auto\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n from PTrans \\\\ \\ \\.(P) \\ P'\\ obtain P''' where P'Trans: \"\\ \\ P' \\\\ \\ P'''\" and \"\\ \\ P'' \\ P'''\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n apply(drule_tac simE, auto)\n by(metis bisimE)\n from tPTrans P'Trans have \"\\ \\ \\.(\\.(P)) \\\\<^sub>\\ P'''\" by(fastforce dest: tauActTauStepChain)\n moreover from \\(\\, P, Q) \\ Rel\\ \\\\ \\ P \\ P''\\ \\\\ \\ P'' \\ P'''\\ \\\\ \\ Q \\ Q'\\ have \"(\\, P''', Q') \\ Rel\"\n by(metis bisimTransitive C1 bisimSymmetric)\n ultimately show ?case by fastforce\n qed\nqed\n\nlemma tauLaw3CongSimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"(\\, P, Q) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n and \"\\\\. (\\, P, \\.(Q)) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\\\Rel\\ \\\\(\\.(Q))\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ \\\\(\\.(Q)) \\\\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P'\" and \"\\ \\ P \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\.(P) \\\\<^sub>\\ P'\" by(rule tauActTauStepChain)\n moreover from \\\\ \\ P \\ P'\\ \\\\ \\ \\.(Q) \\ Q'\\ \\(\\, P, \\.(Q)) \\ Rel\\\n have \"(\\, P', Q') \\ Rel\" by(metis bisimTransitive bisimSymmetric C1)\n ultimately show ?case by fastforce\n qed\nqed\n\nend\n\nlocale tauSum = tau + sum\nbegin\n\nlemma tauLaw2SimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes Id: \"\\\\ P. (\\, P, P) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n\n shows \"\\ \\ P \\ \\.(P) \\ \\.(P)\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ P')\n thus ?case by(nominal_induct \\ rule: action.strong_inducts) auto\nnext\n case(cTau P')\n from \\\\ \\ \\.(P) \\\\ \\ P'\\ have \"\\ \\ P \\ P'\" by(rule tauActionE)\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n have \"guarded(\\.(P))\" by(rule guardedTau)\n with PTrans have \"\\ \\ P \\ \\.(P) \\\\ \\ P''\" by(rule Sum2)\n hence \"\\ \\ P \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P''\" by(rule tauActTauChain)\n moreover from \\\\ \\ P \\ P''\\ \\(\\, P, P) \\ Rel\\ \\\\ \\ P \\ P'\\ have \"(\\, P'', P') \\ Rel\"\n by(metis C1 bisimE)\n ultimately show ?case by blast\nqed \n\nlemma tauLaw2CongSimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes Id: \"\\\\ P. (\\, P, P) \\ Rel\"\n and C1: \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ Rel; \\ \\ R \\ S\\ \\ (\\, P, S) \\ Rel\"\n\n shows \"\\ \\ P \\ \\.(P) \\\\Rel\\ \\.(P)\"\nproof(induct rule: weakCongSimI)\n case(cTau P')\n from \\\\ \\ \\.(P) \\\\ \\ P'\\ have \"\\ \\ P \\ P'\" by(rule tauActionE)\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n have \"guarded(\\.(P))\" by(rule guardedTau)\n with PTrans have \"\\ \\ P \\ \\.(P) \\\\ \\ P''\" by(rule Sum2)\n hence \"\\ \\ P \\ \\.(P) \\\\<^sub>\\ P''\" by(rule tauActTauStepChain)\n moreover from \\\\ \\ P \\ P''\\ \\(\\, P, P) \\ Rel\\ \\\\ \\ P \\ P'\\ have \"(\\, P'', P') \\ Rel\"\n by(metis C1 bisimE)\n ultimately show ?case by blast\nqed \n\nlemma tauLaw2SimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n\n shows \"\\ \\ \\.(P) \\ P \\ \\.(P)\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ P')\n from \\\\ \\ P \\ \\.(P) \\\\ \\ P'\\\n show ?case\n proof(induct rule: sumCases)\n case cSum1 \n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P''\" by(rule tauActTauChain)\n moreover from \\guarded P\\ have \"insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n by(rule insertGuardedAssertion)\n with \\\\ \\ P \\ P''\\ have \"insertAssertion (extractFrame P'') \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n by(metis bisimE FrameStatEqTrans FrameStatEqSym)\n hence \"insertAssertion (extractFrame(P \\ \\.(P))) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n by(simp add: FrameStatEq_def)\n moreover from PTrans \\bn \\ \\* (\\.(P))\\ have \"bn \\ \\* P''\" by(rule tauFreshChainDerivative)\n with \\\\ \\ P \\ P''\\ \\\\ \\ P \\\\ \\ P'\\ \\bn \\ \\* \\\\\n obtain P''' where P''Trans: \"\\ \\ P'' \\\\ \\ P'''\" and \"\\ \\ P''' \\ P'\"\n by(metis bisimE simE)\n ultimately have \"\\ : (P \\ \\.(P)) \\ \\.(P) \\\\ \\ P'''\"\n by(rule_tac weakTransitionI)\n moreover have \"\\ \\ \\' \\ P''' \\\\<^sup>^\\<^sub>\\ P'''\" by auto\n moreover from \\\\ \\ P''' \\ P'\\ have \"\\ \\ \\' \\ P''' \\ P'\" by(rule bisimE)\n hence \"(\\ \\ \\', P''', P') \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case cSum2\n thus ?case using \\\\ \\ \\\\\n by(nominal_induct \\ rule: action.strong_inducts) auto\n qed\nnext\n case(cTau P')\n from \\\\ \\ P \\ \\.(P) \\\\ \\ P'\\\n show ?case\n proof(induct rule: sumCases)\n case cSum1 \n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n moreover from \\\\ \\ P \\ P''\\ \\\\ \\ P \\\\ \\ P'\\ \n obtain P''' where P''Trans: \"\\ \\ P'' \\\\ \\ P'''\" and \"\\ \\ P''' \\ P'\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n by(drule_tac simE, auto)\n ultimately have \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P'''\" by(auto dest: tauActTauChain rtrancl_into_rtrancl)\n moreover from \\\\ \\ P''' \\ P'\\ have \"(\\, P''', P') \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case cSum2\n from \\\\ \\ \\.(P) \\\\ \\ P'\\ have \"\\ \\ P \\ P'\" by(rule tauActionE)\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n hence \"\\ \\ \\.(P) \\\\<^sup>^\\<^sub>\\ P''\" by(rule_tac tauActTauChain)\n moreover from \\\\ \\ P \\ P''\\ \\\\ \\ P \\ P'\\ have \"(\\, P'', P') \\ Rel\"\n by(metis C1 bisimTransitive bisimE)\n ultimately show ?case by blast\n qed\nqed\n\nlemma tauLaw2CongSimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n\n shows \"\\ \\ \\.(P) \\\\Rel\\ P \\ \\.(P)\"\nproof(induct rule: weakCongSimI)\n case(cTau P')\n from \\\\ \\ P \\ \\.(P) \\\\ \\ P'\\\n show ?case\n proof(induct rule: sumCases)\n case cSum1 \n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n moreover from \\\\ \\ P \\ P''\\ \\\\ \\ P \\\\ \\ P'\\ \n obtain P''' where P''Trans: \"\\ \\ P'' \\\\ \\ P'''\" and \"\\ \\ P''' \\ P'\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n by(drule_tac simE) auto\n ultimately have \"\\ \\ \\.(P) \\\\<^sub>\\ P'''\" by(auto dest: tauActTauStepChain trancl_into_trancl)\n moreover from \\\\ \\ P''' \\ P'\\ have \"(\\, P''', P') \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case cSum2\n from \\\\ \\ \\.(P) \\\\ \\ P'\\ have \"\\ \\ P \\ P'\" by(rule tauActionE)\n obtain P'' where PTrans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n hence \"\\ \\ \\.(P) \\\\<^sub>\\ P''\" by(rule_tac tauActTauStepChain)\n moreover from \\\\ \\ P \\ P''\\ \\\\ \\ P \\ P'\\ have \"(\\, P'', P') \\ Rel\"\n by(metis C1 bisimTransitive bisimE)\n ultimately show ?case by blast\n qed\nqed\n\nlemma tauLaw4SimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes \"\\\\ P. (\\, P, P) \\ Rel\"\n and C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ PQ)\n from \\\\ \\ \\\\(\\.(P) \\ Q) \\\\ \\ PQ\\ \\\\ \\ \\\\\n show ?case\n proof(induct rule: prefixCases)\n case(cInput M xvec N K Tvec)\n have \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\P \\ \\\\(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame(\\\\(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\P \\ \\\\(\\.(P) \\ Q))) \\\"\n using insertTauAssertion Identity\n by(nominal_induct \\ rule: prefix.strong_inducts, auto) \n (rule FrameStatImpTrans[where G=\"\\\\, \\\\\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n moreover from \\\\ \\ M \\ K\\ \\distinct xvec\\ \\set xvec \\ supp N\\ \\length xvec=length Tvec\\\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P) \\ Q)[xvec::=Tvec]\"\n by(rule Input)\n hence \"\\ \\ (M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P) \\ Q)[xvec::=Tvec]\" \n by(rule_tac Sum2) auto\n ultimately have \"\\ : (M\\\\*xvec N\\.(\\.(P) \\ Q)) \\ (M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P) \\ Q)[xvec::=Tvec]\"\n by(rule_tac weakTransitionI) auto\n moreover have \"\\ \\ \\' \\ (\\.(P) \\ Q)[xvec::=Tvec] \\\\<^sup>^\\<^sub>\\ (\\.(P) \\ Q)[xvec::=Tvec]\" by auto\n ultimately show ?case using \\(\\ \\ \\', (\\.(P) \\ Q)[xvec::=Tvec], (\\.(P) \\ Q)[xvec::=Tvec]) \\ Rel\\ by fastforce\n next\n case(cOutput M N K)\n have \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ \\\\P \\ \\\\(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame(\\\\(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\P \\ \\\\(\\.(P) \\ Q))) \\\"\n using insertTauAssertion Identity\n by(nominal_induct \\ rule: prefix.strong_inducts, auto) \n (rule FrameStatImpTrans[where G=\"\\\\, \\\\\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n\n moreover from \\\\ \\ M \\ K\\ have \"\\ \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\"\n by(rule Output)\n hence \"\\ \\ M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\" by(rule_tac Sum2) auto\n ultimately have \"\\ : (M\\N\\.(\\.(P) \\ Q)) \\ M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\"\n by(rule_tac weakTransitionI) auto\n moreover have \"\\ \\ \\' \\ \\.(P) \\ Q \\\\<^sup>^\\<^sub>\\ \\.(P) \\ Q\" by auto\n ultimately show ?case using \\(\\ \\ \\', \\.(P) \\ Q, \\.(P) \\ Q) \\ Rel\\ by fastforce\n next\n case cTau\n from \\\\ \\ \\\\ show ?case\n by simp\n qed\nnext\n case(cTau Q')\n from \\\\ \\ \\\\(\\.(P)) \\\\<^sub>\\ Q \\ \\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.(\\.(P) \\ Q) \\\\ \\ P'\" and \"\\ \\ \\.(P) \\ Q \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ (\\.(P)) \\ \\.(\\.(P) \\ Q) \\\\ \\ P'\" by(rule_tac Sum2) (auto intro: guardedTau)\n hence \"\\ \\ (\\.(P)) \\ \\.(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\\\ \\ \\.(P) \\ Q \\ P'\\ \\\\ \\ (\\.(P)) \\ Q \\ Q'\\ have \"\\ \\ P' \\ Q'\" by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P', Q') \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\nqed\n\nlemma tauLaw4CongSimLeft:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes \"\\\\ P. (\\, P, P) \\ Rel\"\n and C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n\n shows \"\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\Rel\\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ \\\\(\\.(P)) \\\\<^sub>\\ Q \\ \\ \\ Q'\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.(\\.(P) \\ Q) \\\\ \\ P'\" and \"\\ \\ \\.(P) \\ Q \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ (\\.(P)) \\ \\.(\\.(P) \\ Q) \\\\ \\ P'\" by(rule_tac Sum2) (auto intro: guardedTau)\n hence \"\\ \\ (\\.(P)) \\ \\.(\\.(P) \\ Q) \\\\<^sub>\\ P'\" by(rule tauActTauStepChain)\n moreover from \\\\ \\ \\.(P) \\ Q \\ P'\\ \\\\ \\ (\\.(P)) \\ Q \\ Q'\\ have \"\\ \\ P' \\ Q'\" by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P', Q') \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\nqed\n\nlemma tauLaw4SimRight:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a prefix\"\n\n assumes C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n and \"\\\\ P. (\\, P, P) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P) \\ Q) \\ \\\\P \\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ PQ)\n from \\\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\ \\ PQ\\ show ?case\n proof(induct rule: sumCases)\n case cSum1\n from \\\\ \\ \\\\P \\\\ \\ PQ\\ \\\\ \\ \\\\ show ?case\n proof(induct rule: prefixCases)\n case(cInput M xvec N K Tvec)\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ M\\\\*xvec N\\.(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame((M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\\\*xvec N\\.(\\.(P) \\ Q))) \\\"\n by auto\n moreover from \\\\ \\ M \\ K\\ \\distinct xvec\\ \\set xvec \\ supp N\\ \\length xvec = length Tvec\\\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P) \\ Q)[xvec::=Tvec]\" by(rule Input)\n ultimately have \"\\ : ((M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q)) \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\\\ (\\.(P) \\ Q)[xvec::=Tvec]\"\n by(rule_tac weakTransitionI) auto\n with \\length xvec = length Tvec\\ \\distinct xvec\\\n have \"\\ : ((M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q)) \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P[xvec::=Tvec]) \\ Q[xvec::=Tvec])\"\n by auto\n moreover obtain P' where PTrans: \"\\ \\ \\' \\ \\.(P[xvec::=Tvec]) \\\\ \\ P'\" and \"\\ \\ \\' \\ P[xvec::=Tvec] \\ P'\" using tauActionI\n by auto\n have \"guarded(\\.(P[xvec::=Tvec]))\" by(rule guardedTau)\n with PTrans have \"\\ \\ \\' \\ (\\.(P[xvec::=Tvec])) \\ (Q[xvec::=Tvec]) \\\\ \\ P'\" by(rule Sum1)\n hence \"\\ \\ \\' \\ (\\.(P[xvec::=Tvec])) \\ (Q[xvec::=Tvec]) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\\\ \\ \\' \\ P[xvec::=Tvec] \\ P'\\ have \"(\\ \\ \\', P', P[xvec::=Tvec]) \\ Rel\" by(metis bisimE C1)\n ultimately show ?case by fastforce\n next\n case(cOutput M N K)\n have \"\\ \\ M\\N\\.(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ M\\N\\.(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame(M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\N\\.(\\.(P) \\ Q))) \\\"\n by auto\n moreover from \\\\ \\ M \\ K\\ have \"\\ \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\" by(rule Output)\n ultimately have \"\\ : (M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q)) \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\"\n by(rule_tac weakTransitionI) auto\n moreover obtain P' where PTrans: \"\\ \\ \\' \\ \\.(P) \\\\ \\ P'\" and \"\\ \\ \\' \\ P \\ P'\" using tauActionI\n by auto\n have \"guarded(\\.(P))\" by(rule guardedTau)\n with PTrans have \"\\ \\ \\' \\ (\\.(P)) \\ Q \\\\ \\ P'\" by(rule Sum1)\n hence \"\\ \\ \\' \\ (\\.(P)) \\ Q \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\\\ \\ \\' \\ P \\ P'\\ have \"(\\ \\ \\', P', P) \\ Rel\" by(metis bisimE C1)\n ultimately show ?case by fastforce \n next\n case cTau\n from \\\\ \\ \\\\ show ?case by simp\n qed\n next\n case cSum2\n from \\\\ \\ \\\\(\\.(P) \\ Q) \\\\ \\ PQ\\ \\\\ \\ \\\\ show ?case\n proof(induct rule: prefixCases)\n case(cInput M xvec N K Tvec)\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ M\\\\*xvec N\\.(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame((M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\\\*xvec N\\.(\\.(P) \\ Q))) \\\"\n by auto\n moreover from \\\\ \\ M \\ K\\ \\distinct xvec\\ \\set xvec \\ supp N\\ \\length xvec = length Tvec\\\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P) \\ Q)[xvec::=Tvec]\"\n by(rule Input)\n with \\length xvec = length Tvec\\ \\distinct xvec\\\n have \"\\ \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P[xvec::=Tvec]) \\ Q[xvec::=Tvec])\"\n by simp\n ultimately have \"\\ : ((M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.(\\.(P) \\ Q)) \\ M\\\\*xvec N\\.(\\.(P) \\ Q) \\K\\(N[xvec::=Tvec])\\ \\ (\\.(P[xvec::=Tvec]) \\ Q[xvec::=Tvec])\"\n by(rule_tac weakTransitionI) auto\n moreover have \"\\ \\ \\' \\ \\.(P[xvec::=Tvec]) \\ (Q[xvec::=Tvec]) \\\\<^sup>^\\<^sub>\\ \\.(P[xvec::=Tvec]) \\ (Q[xvec::=Tvec])\" by auto\n ultimately show ?case using \\(\\ \\ \\', \\.(P[xvec::=Tvec]) \\ (Q[xvec::=Tvec]), \\.(P[xvec::=Tvec]) \\ (Q[xvec::=Tvec])) \\ Rel\\ \\length xvec = length Tvec\\ \\distinct xvec\\\n by fastforce\n next\n case(cOutput M N K)\n have \"\\ \\ M\\N\\.(\\.(P) \\ Q) \\\\<^sup>^\\<^sub>\\ M\\N\\.(\\.(P) \\ Q)\" by auto\n moreover have \"insertAssertion (extractFrame(M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q))) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\N\\.(\\.(P) \\ Q))) \\\"\n by auto\n moreover from \\\\ \\ M \\ K\\ have \"\\ \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\"\n by(rule Output)\n ultimately have \"\\ : (M\\N\\.P \\ M\\N\\.(\\.(P) \\ Q)) \\ M\\N\\.(\\.(P) \\ Q) \\K\\N\\ \\ (\\.(P) \\ Q)\"\n by(rule_tac weakTransitionI) auto\n moreover have \"\\ \\ \\' \\ \\.(P) \\ Q \\\\<^sup>^\\<^sub>\\ \\.(P) \\ Q\" by auto\n ultimately show ?case using \\(\\ \\ \\', \\.(P) \\ Q, \\.(P) \\ Q) \\ Rel\\ by fastforce\n next\n case cTau\n from \\\\ \\ \\\\ show ?case by simp\n qed\n qed\nnext\n case(cTau PQ)\n from \\\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\ \\ PQ\\ show ?case\n proof(induct rule: sumCases)\n case cSum1\n from \\\\ \\ \\\\P \\ \\ \\ PQ\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.((\\.(P)) \\ Q) \\\\ \\ P'\" and \"\\ \\ (\\.(P)) \\ Q \\ P'\" using tauActionI\n by auto\n obtain P'' where P'Trans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n from P'Trans have \"\\ \\ \\.(P) \\ Q\\\\ \\ P''\" by(rule_tac Sum1) (auto intro: guardedTau)\n with \\\\ \\ (\\.(P)) \\ Q \\ P'\\ obtain P''' where P''Trans: \"\\ \\ P' \\\\ \\ P'''\" and \"\\ \\ P'' \\ P'''\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n apply(drule_tac simE)\n by(auto dest: bisimE)\n from PTrans P''Trans have \"\\ \\ \\.((\\.(P)) \\ Q) \\\\<^sup>^\\<^sub>\\ P'''\" by(fastforce dest: tauActTauChain)\n moreover from \\\\ \\ P \\ PQ\\ \\\\ \\ P'' \\ P'''\\ \\\\ \\ P \\ P''\\ have \"\\ \\ P''' \\ PQ\"\n by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P''', PQ) \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\n next\n case cSum2\n from \\\\ \\ \\\\((\\.(P)) \\ Q) \\\\ \\ PQ\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.((\\.(P)) \\ Q) \\\\ \\ P'\" and \"\\ \\ (\\.(P)) \\ Q \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\.((\\.(P)) \\ Q) \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauActTauChain)\n moreover from \\\\ \\ (\\.(P)) \\ Q \\ P'\\ \\\\ \\ \\.(P) \\ Q \\ PQ\\ have \"\\ \\ P' \\ PQ\"\n by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P', PQ) \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\n qed\nqed\n\n\n\n assumes C1: \"\\\\ P Q. \\ \\ P \\ Q \\ (\\, P, Q) \\ Rel\"\n\n shows \"\\ \\ \\\\(\\.(P) \\ Q) \\\\Rel\\ \\\\P \\ \\\\(\\.(P) \\ Q)\"\nproof(induct rule: weakCongSimI)\n case(cTau PQ)\n from \\\\ \\ \\\\P \\ \\\\(\\.(P) \\ Q) \\\\ \\ PQ\\ show ?case\n proof(induct rule: sumCases)\n case cSum1\n from \\\\ \\ \\\\P \\ \\ \\ PQ\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.((\\.(P)) \\ Q) \\\\ \\ P'\" and \"\\ \\ (\\.(P)) \\ Q \\ P'\" using tauActionI\n by auto\n obtain P'' where P'Trans: \"\\ \\ \\.(P) \\\\ \\ P''\" and \"\\ \\ P \\ P''\" using tauActionI\n by auto\n from P'Trans have \"\\ \\ \\.(P) \\ Q\\\\ \\ P''\" by(rule_tac Sum1) (auto intro: guardedTau)\n with \\\\ \\ (\\.(P)) \\ Q \\ P'\\ obtain P''' where P''Trans: \"\\ \\ P' \\\\ \\ P'''\" and \"\\ \\ P'' \\ P'''\"\n apply(drule_tac bisimE(4))\n apply(drule_tac bisimE(2))\n apply(drule_tac simE)\n by(auto dest: bisimE)\n from PTrans P''Trans have \"\\ \\ \\.((\\.(P)) \\ Q) \\\\<^sub>\\ P'''\" by(fastforce dest: tauActTauStepChain)\n moreover from \\\\ \\ P \\ PQ\\ \\\\ \\ P'' \\ P'''\\ \\\\ \\ P \\ P''\\ have \"\\ \\ P''' \\ PQ\"\n by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P''', PQ) \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\n next\n case cSum2\n from \\\\ \\ \\\\((\\.(P)) \\ Q) \\\\ \\ PQ\\ show ?case\n proof(induct rule: prefixTauCases)\n case cTau\n obtain P' where PTrans: \"\\ \\ \\.((\\.(P)) \\ Q) \\\\ \\ P'\" and \"\\ \\ (\\.(P)) \\ Q \\ P'\" using tauActionI\n by auto\n from PTrans have \"\\ \\ \\.((\\.(P)) \\ Q) \\\\<^sub>\\ P'\" by(rule tauActTauStepChain)\n moreover from \\\\ \\ (\\.(P)) \\ Q \\ P'\\ \\\\ \\ \\.(P) \\ Q \\ PQ\\ have \"\\ \\ P' \\ PQ\"\n by(metis bisimSymmetric bisimTransitive)\n hence \"(\\, P', PQ) \\ Rel\" by(rule C1)\n ultimately show ?case by fastforce\n qed\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Tau_Sim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199008363969, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.27390212442234074}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoareTotalDef.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Hoare Logic for Total Correctness *}\n\ntheory HoareTotalDef imports HoarePartialDef Termination begin \n\nsubsection {* Validity of Hoare Tuples: @{text \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n validt :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A \\ (\\s \\ Normal ` P. \\\\c\\s)\"\n\ndefinition\n cvalidt::\n \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_,_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60, 60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n\nnotation (ascii)\n validt (\"_|=t'/_/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60) and\n cvalidt (\"_,_|=t'/_ / _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\n\nsubsection {* Properties of Validity *}\n\nlemma validtI: \n \"\\\\s t. \\\\\\\\c,Normal s\\ \\ t;s \\ P;t \\ Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. s \\ P \\ \\\\ c\\(Normal s) \\\n \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: validt_def valid_def)\n\nlemma cvalidtI: \n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P; \n t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A; s\\P\\ \\ \\\\c\\(Normal s)\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_postD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s \\ \\ t;\n s \\ P;t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_termD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;s \\ P\\ \n \\ \\\\c\\(Normal s)\"\n by (simp add: cvalidt_def validt_def valid_def)\n\n\nlemma validt_augment_Faults:\n assumes valid:\"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n using valid F'\n by (auto intro: valid_augment_Faults simp add: validt_def)\n\nsubsection {* The Hoare Rules: @{text \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" } *}\n\ninductive \"hoaret\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \n => bool\"\n (\"(3_,_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,_))\" [61,60,60,1000,20,1000,1000]60) \n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ Q} (Basic f) Q,A\"\n\n| Spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} (Spec r) Q,A\"\n\n| Seq: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n \n| Cond: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c\\<^sub>1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c\\<^sub>2 Q,A\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\wf r; \\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t,\\)\\r} \\ P),A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n\n| Guard: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n\n| Guarantee: \"\\f \\ F; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec: \n \"\\(P,p,Q,A) \\ Specs;\n wf r; \n Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s,q),(\\,p)) \\ r},q,Q,A)) ` Specs);\n \\(P,p,Q,A)\\ Specs. \n p \\ dom \\ \\ (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\n \\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| DynCom: \"\\s \\ P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n\n| Throw: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"(P,p,Q,A) \\ \\ \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| ExFalso: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n -- {* This is a hack rule that enables us to derive completeness for\n an arbitrary context @{text \"\\\"}, from completeness for an empty context.*}\n\n \ntext {* Does not work, because of rule ExFalso, the context @{text \\} is to blame.\n A weaker version with empty context can be derived from soundness \n later on. *}\nlemma hoaret_to_hoarep:\n assumes hoaret: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing hoaret\nproof (induct)\n case Skip thus ?case by (rule hoarep.intros)\nnext\n case Basic thus ?case by (rule hoarep.intros)\nnext\n case Seq thus ?case by - (rule hoarep.intros)\nnext\n case Cond thus ?case by - (rule hoarep.intros)\nnext\n case (While r \\ F P b c A)\n hence \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\"\n by (rule HoarePartialDef.conseq) blast\n then show \"\\,\\\\\\<^bsub>/F\\<^esub> P While b c (P \\ - b),A\"\n by (rule hoarep.While)\nnext\n case Guard thus ?case by - (rule hoarep.intros)\n(*next\n case (CallRec A F P Procs Q Z \\ p r)\n hence hyp: \"\\p\\Procs. \\\\ Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\p\\Procs. \\Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n (P p Z) (the (\\ p)) (Q p Z),(A p Z)\" \n proof (intro ballI allI)\n fix p Z\n assume \"p \\ Procs\"\n with hyp\n have hyp': \"\\ \\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z, A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\\\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n (is \"\\\\. \\,?\\'\\\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\")\n proof (rule allI, rule WeakenContext [OF hyp'],clarify)\n fix \\ P' c Q' A'\n assume \"(P', c, Q', A') \\ \\ \\\n (\\q\\Procs.\n \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,\n A q Z)})\" (is \"(P', c, Q', A') \\ \\ \\ ?Spec\")\n then show \"\\,?\\'\\\\<^bsub>/F\\<^esub> P' c Q',A'\"\n proof (cases rule: UnE [consumes 1])\n assume \"(P',c,Q',A') \\ \\\" \n then show ?thesis\n by (blast intro: HoarePartialDef.Asm)\n next\n assume \"(P',c,Q',A') \\ ?Spec\" \n then show ?thesis\n proof (clarify)\n fix q Z\n assume q: \"q \\ Procs\"\n show \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z \\ {s. ((s, q), \\, p) \\ r}) \n Call q \n (Q q Z),(A q Z)\"\n proof -\n from q\n have \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z) Call q (Q q Z),(A q Z)\"\n by - (rule HoarePartialDef.Asm,blast)\n thus ?thesis\n by (rule HoarePartialDef.conseqPre) blast\n qed\n qed\n qed\n qed\n then show \"\\,\\ \\ (\\q\\Procs. \\Z. {(P q Z, Call q, Q q Z,A q Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by (rule HoarePartialDef.conseq) blast\n qed\n thus ?case\n by - (rule hoarep.CallRec)*)\nnext\n case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n case Throw thus ?case by - (rule hoarep.Throw)\nnext\n case Catch thus ?case by - (rule hoarep.Catch)\nnext\n case Conseq thus ?case by - (rule hoarep.Conseq,blast)\nnext\n case Asm thus ?case by (rule HoarePartialDef.Asm)\nnext\n case (ExFalso \\ F P c Q A)\n assume \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n oops\n\n\nlemma hoaret_augment_context: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\\\'. \\ \\ \\' \\ \\,\\'\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n case (CallRec P p Q A Specs r Specs_wf \\ F \\')\n have aug: \"\\ \\ \\'\" by fact\n then\n have h: \"\\\\ p. \\ \\ Specs_wf p \\\n \\ \\' \\ Specs_wf p \\\"\n by blast\n have \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A \\\n (\\x. \\ \\ Specs_wf p \\\n \\ x \\\n \\,x\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A))\" by fact\n hence \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\ \n (\\\\. \\,\\'\\ Specs_wf p \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\"\n apply (clarify)\n apply (rename_tac P p Q A)\n apply (drule (1) bspec)\n apply (clarsimp)\n apply (erule_tac x=\\ in allE)\n apply clarify\n apply (erule_tac x=\"\\' \\ Specs_wf p \\\" in allE)\n apply (insert aug)\n apply auto\n done\n with CallRec show ?case by - (rule hoaret.CallRec)\nnext\n case DynCom thus ?case by (blast intro: hoaret.DynCom)\nnext\n case (Conseq P \\ F c Q A \\')\n from Conseq\n have \"\\s \\ P. (\\P' Q' A'. (\\,\\' \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\"\n by blast\n with Conseq show ?case by - (rule hoaret.Conseq)\nnext\n case (ExFalso \\ F P c Q A \\')\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\ \\'\" by fact+\n then show ?case\n by (fastforce intro: hoaret.ExFalso simp add: cvalidt_def)\nqed (blast intro: hoaret.intros)+\n\nsubsection {* Some Derived Rules *}\n\n\nlemma Conseq': \"\\s. s \\ P \\ \n (\\P' Q' A'. \n (\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\\n (\\Z. s \\ P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)))\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q)\\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq) blast\n\ntheorem conseqPrePost: \n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where ?P'=\"\\Z. P'\" and ?Q'=\"\\Z. Q'\"]) auto\n\nlemma conseqPre: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A \\ P \\ P' \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq) auto\n\n\nlemma Spec_wf_conv: \n \"(\\(P, q, Q, A). (P \\ {s. ((s, q), \\, p) \\ r}, q, Q, A)) `\n (\\p\\Procs. \\Z. {(P p Z, p, Q p Z, A p Z)}) = \n (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r}, q, Q q Z, A q Z)})\"\napply (rule)\napply fastforce\napply (fastforce simp add: image_def)\ndone\n\nlemma CallRec': \n \"\\p\\Procs; Procs \\ dom \\;\n wf r; \n \\p\\Procs. \\\\ Z. \n \\,\\\\(\\q\\Procs. \\Z. \n {((P q Z) \\ {s. ((s,q),(\\,p)) \\ r},q,Q q Z,(A q Z))})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ (P p Z)) (the (\\ p)) (Q p Z),(A p Z)\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)}\" and\n r=r])\napply blast\napply assumption\napply (rule refl)\napply (clarsimp)\napply (rename_tac p')\napply (rule conjI)\napply blast\napply (intro allI)\napply (rename_tac Z \\)\napply (drule_tac x=p' in bspec, assumption)\napply (erule_tac x=\\ in allE)\napply (erule_tac x=Z in allE)\napply (fastforce simp add: Spec_wf_conv)\ndone\n\nend\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/HoareTotalDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.27381875107934384}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory Extra\nimports\n Main\n Equiv_Relations\n \"~~/src/HOL/Library/Option_ord\"\n \"~~/src/HOL/Library/Product_Lexorder\"\nbegin\n\n(* Extra lemmas that are not noteworthy. *)\n\nlemma relation_mono:\n \"\\ A \\ C; B \\ D \\ \\ A \\ B \\ C \\ D\"\n by bestsimp\n\nlemma quotientI2:\n \"\\ x \\ A; X = r `` {x} \\ \\ X \\ A // r\"\n by (simp add: quotientI)\n\n(*\n\nConcretely enumerate all the agent action functions. Can't be too\nabstract here as we want extensionality.\n\nIntroduced in the clock view.\n\n*)\n\ndefinition\n listToFun :: \"('a \\ 'b list) list \\ ('a \\ 'b) list\"\nwhere\n \"listToFun xs \\ foldr (\\(a, acts) M. [ m(a := act) . m \\ M, act \\ acts ])\n xs\n [(\\_. undefined)]\"\n\nlemma listToFun_futz:\n \"\\ M \\ set (listToFun xs); x \\ fst ` set xs \\\n \\ M x \\ { y |y ys. (x, ys) \\ set xs \\ y \\ set ys}\"\n unfolding listToFun_def\n apply (induct xs arbitrary: M)\n apply (simp_all add: split_def)\n apply (case_tac a)\n apply clarsimp\n apply auto\n done\n\nlemma distinct_map_fst:\n \"\\ x \\ fst ` set xs; distinct (map fst xs) \\ \\ (x, y) \\ set xs\"\n by (induct xs) auto\n\nlemma listToFun_futz_rev:\n \"\\ \\x. M x \\ (if x \\ fst ` set xs then { y |y ys. (x, ys) \\ set xs \\ y \\ set ys} else {undefined}); distinct (map fst xs) \\\n \\ M \\ set (listToFun xs)\"\nproof(induct xs arbitrary: M)\n case Nil thus ?case\n unfolding listToFun_def by simp\nnext\n case (Cons x xs)\n let ?M' = \"M(fst x := undefined)\"\n have M': \"?M' \\ set (listToFun xs)\"\n apply (rule Cons.hyps)\n prefer 2\n using Cons(3)\n apply simp\n apply (case_tac \"xa = fst x\")\n using Cons(3)\n apply simp\n apply (case_tac \"xa \\ fst ` set xs\")\n apply (cut_tac x=xa in Cons(2))\n apply (cases x)\n apply auto[1]\n apply (cut_tac x=xa in Cons(2))\n apply simp\n done\n then show ?case\n unfolding listToFun_def\n apply (cases x)\n apply simp\n apply (rule bexI[where x=\"?M'\"])\n apply simp_all\n apply (rule_tac x=\"M a\" in image_eqI)\n apply simp\n apply (cut_tac x=a in Cons(2))\n using Cons(3)\n apply clarsimp\n apply (erule disjE)\n apply simp\n apply (auto dest: distinct_map_fst)\n done\nqed\n\ndefinition\n listToFuns :: \"('a \\ 'b list) \\ 'a list \\ ('a \\ 'b) list\"\nwhere\n \"listToFuns f \\ listToFun \\ map (\\x. (x, f x))\"\n\nlemma map_id_clunky:\n \"set xs = UNIV \\ x \\ fst ` set (map (\\x. (x, f x)) xs)\"\n apply (simp only: set_map[symmetric] map_map)\n apply simp\n done\n\n(*\n\nThe main result is that we can freely move between representations.\n\n*)\n\nlemma listToFuns_ext:\n assumes xs: \"set xs = UNIV\"\n assumes d: \"distinct xs\"\n shows \"g \\ set (listToFuns f xs) \\ (\\x. g x \\ set (f x))\"\n unfolding listToFuns_def\n apply simp\n apply rule\n apply clarsimp\n apply (cut_tac x=x in listToFun_futz[where M=g, OF _ map_id_clunky[OF xs]])\n apply simp\n apply clarsimp\n apply (rule listToFun_futz_rev)\n using map_id_clunky[OF xs]\n apply auto[1]\n apply (rule_tac x=\"f xa\" in exI)\n apply simp\n apply simp\n using d\n apply (simp add: distinct_map)\n apply (auto intro: inj_onI)\n done\n\nlemma listToFun_splice:\n assumes xs: \"set xs = UNIV\"\n assumes d: \"distinct xs\"\n assumes g: \"g \\ set (listToFuns f xs)\"\n assumes h: \"h \\ set (listToFuns f xs)\"\n shows \"g(x := h x) \\ set (listToFuns f xs)\"\n using g h by (auto iff: listToFuns_ext[OF xs d])\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/KBPs/Extra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2738187510793438}} {"text": "(* Title: HOL/HOLCF/IOA/CompoExecs.thy\n Author: Olaf Müller\n*)\n\nsection \\Compositionality on Execution level\\\n\ntheory CompoExecs\nimports Traces\nbegin\n\ndefinition ProjA2 :: \"('a, 's \\ 't) pairs \\ ('a, 's) pairs\"\n where \"ProjA2 = Map (\\x. (fst x, fst (snd x)))\"\n\ndefinition ProjA :: \"('a, 's \\ 't) execution \\ ('a, 's) execution\"\n where \"ProjA ex = (fst (fst ex), ProjA2 \\ (snd ex))\"\n\ndefinition ProjB2 :: \"('a, 's \\ 't) pairs \\ ('a, 't) pairs\"\n where \"ProjB2 = Map (\\x. (fst x, snd (snd x)))\"\n\ndefinition ProjB :: \"('a, 's \\ 't) execution \\ ('a, 't) execution\"\n where \"ProjB ex = (snd (fst ex), ProjB2 \\ (snd ex))\"\n\ndefinition Filter_ex2 :: \"'a signature \\ ('a, 's) pairs \\ ('a, 's) pairs\"\n where \"Filter_ex2 sig = Filter (\\x. fst x \\ actions sig)\"\n\ndefinition Filter_ex :: \"'a signature \\ ('a, 's) execution \\ ('a, 's) execution\"\n where \"Filter_ex sig ex = (fst ex, Filter_ex2 sig \\ (snd ex))\"\n\ndefinition stutter2 :: \"'a signature \\ ('a, 's) pairs \\ ('s \\ tr)\"\n where \"stutter2 sig =\n (fix \\\n (LAM h ex.\n (\\s.\n case ex of\n nil \\ TT\n | x ## xs \\\n (flift1\n (\\p.\n (If Def (fst p \\ actions sig) then Def (s = snd p) else TT)\n andalso (h\\xs) (snd p)) \\ x))))\"\n\ndefinition stutter :: \"'a signature \\ ('a, 's) execution \\ bool\"\n where \"stutter sig ex \\ (stutter2 sig \\ (snd ex)) (fst ex) \\ FF\"\n\ndefinition par_execs ::\n \"('a, 's) execution_module \\ ('a, 't) execution_module \\ ('a, 's \\ 't) execution_module\"\n where \"par_execs ExecsA ExecsB =\n (let\n exA = fst ExecsA; sigA = snd ExecsA;\n exB = fst ExecsB; sigB = snd ExecsB\n in\n ({ex. Filter_ex sigA (ProjA ex) \\ exA} \\\n {ex. Filter_ex sigB (ProjB ex) \\ exB} \\\n {ex. stutter sigA (ProjA ex)} \\\n {ex. stutter sigB (ProjB ex)} \\\n {ex. Forall (\\x. fst x \\ actions sigA \\ actions sigB) (snd ex)},\n asig_comp sigA sigB))\"\n\n\nlemmas [simp del] = split_paired_All\n\n\nsection \\Recursive equations of operators\\\n\nsubsection \\\\ProjA2\\\\\n\nlemma ProjA2_UU: \"ProjA2 \\ UU = UU\"\n by (simp add: ProjA2_def)\n\nlemma ProjA2_nil: \"ProjA2 \\ nil = nil\"\n by (simp add: ProjA2_def)\n\nlemma ProjA2_cons: \"ProjA2 \\ ((a, t) \\ xs) = (a, fst t) \\ ProjA2 \\ xs\"\n by (simp add: ProjA2_def)\n\n\nsubsection \\\\ProjB2\\\\\n\nlemma ProjB2_UU: \"ProjB2 \\ UU = UU\"\n by (simp add: ProjB2_def)\n\nlemma ProjB2_nil: \"ProjB2 \\ nil = nil\"\n by (simp add: ProjB2_def)\n\nlemma ProjB2_cons: \"ProjB2 \\ ((a, t) \\ xs) = (a, snd t) \\ ProjB2 \\ xs\"\n by (simp add: ProjB2_def)\n\n\nsubsection \\\\Filter_ex2\\\\\n\nlemma Filter_ex2_UU: \"Filter_ex2 sig \\ UU = UU\"\n by (simp add: Filter_ex2_def)\n\nlemma Filter_ex2_nil: \"Filter_ex2 sig \\ nil = nil\"\n by (simp add: Filter_ex2_def)\n\nlemma Filter_ex2_cons:\n \"Filter_ex2 sig \\ (at \\ xs) =\n (if fst at \\ actions sig\n then at \\ (Filter_ex2 sig \\ xs)\n else Filter_ex2 sig \\ xs)\"\n by (simp add: Filter_ex2_def)\n\n\nsubsection \\\\stutter2\\\\\n\nlemma stutter2_unfold:\n \"stutter2 sig =\n (LAM ex.\n (\\s.\n case ex of\n nil \\ TT\n | x ## xs \\\n (flift1\n (\\p.\n (If Def (fst p \\ actions sig) then Def (s= snd p) else TT)\n andalso (stutter2 sig\\xs) (snd p)) \\ x)))\"\n apply (rule trans)\n apply (rule fix_eq2)\n apply (simp only: stutter2_def)\n apply (rule beta_cfun)\n apply (simp add: flift1_def)\n done\n\nlemma stutter2_UU: \"(stutter2 sig \\ UU) s = UU\"\n apply (subst stutter2_unfold)\n apply simp\n done\n\nlemma stutter2_nil: \"(stutter2 sig \\ nil) s = TT\"\n apply (subst stutter2_unfold)\n apply simp\n done\n\nlemma stutter2_cons:\n \"(stutter2 sig \\ (at \\ xs)) s =\n ((if fst at \\ actions sig then Def (s = snd at) else TT)\n andalso (stutter2 sig \\ xs) (snd at))\"\n apply (rule trans)\n apply (subst stutter2_unfold)\n apply (simp add: Consq_def flift1_def If_and_if)\n apply simp\n done\n\ndeclare stutter2_UU [simp] stutter2_nil [simp] stutter2_cons [simp]\n\n\nsubsection \\\\stutter\\\\\n\nlemma stutter_UU: \"stutter sig (s, UU)\"\n by (simp add: stutter_def)\n\nlemma stutter_nil: \"stutter sig (s, nil)\"\n by (simp add: stutter_def)\n\nlemma stutter_cons:\n \"stutter sig (s, (a, t) \\ ex) \\ (a \\ actions sig \\ (s = t)) \\ stutter sig (t, ex)\"\n by (simp add: stutter_def)\n\ndeclare stutter2_UU [simp del] stutter2_nil [simp del] stutter2_cons [simp del]\n\nlemmas compoex_simps = ProjA2_UU ProjA2_nil ProjA2_cons\n ProjB2_UU ProjB2_nil ProjB2_cons\n Filter_ex2_UU Filter_ex2_nil Filter_ex2_cons\n stutter_UU stutter_nil stutter_cons\n\ndeclare compoex_simps [simp]\n\n\nsection \\Compositionality on execution level\\\n\nlemma lemma_1_1a:\n \\ \\\\is_ex_fr\\ propagates from \\A \\ B\\ to projections \\A\\ and \\B\\\\\n \"\\s. is_exec_frag (A \\ B) (s, xs) \\\n is_exec_frag A (fst s, Filter_ex2 (asig_of A) \\ (ProjA2 \\ xs)) \\\n is_exec_frag B (snd s, Filter_ex2 (asig_of B) \\ (ProjB2 \\ xs))\"\n apply (pair_induct xs simp: is_exec_frag_def)\n text \\main case\\\n apply (auto simp add: trans_of_defs2)\n done\n\nlemma lemma_1_1b:\n \\ \\\\is_ex_fr (A \\ B)\\ implies stuttering on projections\\\n \"\\s. is_exec_frag (A \\ B) (s, xs) \\\n stutter (asig_of A) (fst s, ProjA2 \\ xs) \\\n stutter (asig_of B) (snd s, ProjB2 \\ xs)\"\n apply (pair_induct xs simp: stutter_def is_exec_frag_def)\n text \\main case\\\n apply (auto simp add: trans_of_defs2)\n done\n\nlemma lemma_1_1c:\n \\ \\Executions of \\A \\ B\\ have only \\A\\- or \\B\\-actions\\\n \"\\s. is_exec_frag (A \\ B) (s, xs) \\ Forall (\\x. fst x \\ act (A \\ B)) xs\"\n apply (pair_induct xs simp: Forall_def sforall_def is_exec_frag_def)\n text \\main case\\\n apply auto\n apply (simp add: trans_of_defs2 actions_asig_comp asig_of_par)\n done\n\nlemma lemma_1_2:\n \\ \\\\ex A\\, \\exB\\, stuttering and forall \\a \\ A \\ B\\ implies \\ex (A \\ B)\\\\\n \"\\s.\n is_exec_frag A (fst s, Filter_ex2 (asig_of A) \\ (ProjA2 \\ xs)) \\\n is_exec_frag B (snd s, Filter_ex2 (asig_of B) \\ (ProjB2 \\ xs)) \\\n stutter (asig_of A) (fst s, ProjA2 \\ xs) \\\n stutter (asig_of B) (snd s, ProjB2 \\ xs) \\\n Forall (\\x. fst x \\ act (A \\ B)) xs \\\n is_exec_frag (A \\ B) (s, xs)\"\n apply (pair_induct xs simp: Forall_def sforall_def is_exec_frag_def stutter_def)\n apply (auto simp add: trans_of_defs1 actions_asig_comp asig_of_par)\n done\n\ntheorem compositionality_ex:\n \"ex \\ executions (A \\ B) \\\n Filter_ex (asig_of A) (ProjA ex) \\ executions A \\\n Filter_ex (asig_of B) (ProjB ex) \\ executions B \\\n stutter (asig_of A) (ProjA ex) \\\n stutter (asig_of B) (ProjB ex) \\\n Forall (\\x. fst x \\ act (A \\ B)) (snd ex)\"\n apply (simp add: executions_def ProjB_def Filter_ex_def ProjA_def starts_of_par)\n apply (pair ex)\n apply (rule iffI)\n text \\\\\\\\\\\n apply (erule conjE)+\n apply (simp add: lemma_1_1a lemma_1_1b lemma_1_1c)\n text \\\\\\\\\\\n apply (erule conjE)+\n apply (simp add: lemma_1_2)\n done\n\ntheorem compositionality_ex_modules: \"Execs (A \\ B) = par_execs (Execs A) (Execs B)\"\n apply (unfold Execs_def par_execs_def)\n apply (simp add: asig_of_par)\n apply (rule set_eqI)\n apply (simp add: compositionality_ex actions_of_par)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/CompoExecs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.273802048633569}} {"text": "(* Title: HOL/TLA/Memory/Memory.thy\n Author: Stephan Merz, University of Munich\n*)\n\nsection \\RPC-Memory example: Memory specification\\\n\ntheory Memory\nimports MemoryParameters ProcedureInterface\nbegin\n\ntype_synonym memChType = \"(memOp, Vals) channel\"\ntype_synonym memType = \"(Locs \\ Vals) stfun\" (* intention: MemLocs \\ MemVals *)\ntype_synonym resType = \"(PrIds \\ Vals) stfun\"\n\n\n(* state predicates *)\n\ndefinition MInit :: \"memType \\ Locs \\ stpred\"\n where \"MInit mm l == PRED mm!l = #InitVal\"\n\ndefinition PInit :: \"resType \\ PrIds \\ stpred\"\n where \"PInit rs p == PRED rs!p = #NotAResult\"\n\n\n(* auxiliary predicates: is there a pending read/write request for\n some process id and location/value? *)\n\ndefinition RdRequest :: \"memChType \\ PrIds \\ Locs \\ stpred\"\n where \"RdRequest ch p l == PRED Calling ch p \\ (arg = #(read l))\"\n\ndefinition WrRequest :: \"memChType \\ PrIds \\ Locs \\ Vals \\ stpred\"\n where \"WrRequest ch p l v == PRED Calling ch p \\ (arg = #(write l v))\"\n\n\n(* actions *)\n\n(* a read that doesn't raise BadArg *)\ndefinition GoodRead :: \"memType \\ resType \\ PrIds \\ Locs \\ action\"\n where \"GoodRead mm rs p l == ACT #l \\ #MemLoc \\ ((rs!p)$ = $(mm!l))\"\n\n(* a read that raises BadArg *)\ndefinition BadRead :: \"memType \\ resType \\ PrIds \\ Locs \\ action\"\n where \"BadRead mm rs p l == ACT #l \\ #MemLoc \\ ((rs!p)$ = #BadArg)\"\n\n(* the read action with l visible *)\ndefinition ReadInner :: \"memChType \\ memType \\ resType \\ PrIds \\ Locs \\ action\"\n where \"ReadInner ch mm rs p l == ACT\n $(RdRequest ch p l)\n \\ (GoodRead mm rs p l \\ BadRead mm rs p l)\n \\ unchanged (rtrner ch ! p)\"\n\n(* the read action with l quantified *)\ndefinition Read :: \"memChType \\ memType \\ resType \\ PrIds \\ action\"\n where \"Read ch mm rs p == ACT (\\l. ReadInner ch mm rs p l)\"\n\n(* similar definitions for the write action *)\ndefinition GoodWrite :: \"memType \\ resType \\ PrIds \\ Locs \\ Vals \\ action\"\n where \"GoodWrite mm rs p l v ==\n ACT #l \\ #MemLoc \\ #v \\ #MemVal\n \\ ((mm!l)$ = #v) \\ ((rs!p)$ = #OK)\"\n\ndefinition BadWrite :: \"memType \\ resType \\ PrIds \\ Locs \\ Vals \\ action\"\n where \"BadWrite mm rs p l v == ACT\n \\ (#l \\ #MemLoc \\ #v \\ #MemVal)\n \\ ((rs!p)$ = #BadArg) \\ unchanged (mm!l)\"\n\ndefinition WriteInner :: \"memChType \\ memType \\ resType \\ PrIds \\ Locs \\ Vals \\ action\"\n where \"WriteInner ch mm rs p l v == ACT\n $(WrRequest ch p l v)\n \\ (GoodWrite mm rs p l v \\ BadWrite mm rs p l v)\n \\ unchanged (rtrner ch ! p)\"\n\ndefinition Write :: \"memChType \\ memType \\ resType \\ PrIds \\ Locs \\ action\"\n where \"Write ch mm rs p l == ACT (\\v. WriteInner ch mm rs p l v)\"\n\n\n(* the return action *)\ndefinition MemReturn :: \"memChType \\ resType \\ PrIds \\ action\"\n where \"MemReturn ch rs p == ACT\n ( ($(rs!p) \\ #NotAResult)\n \\ ((rs!p)$ = #NotAResult)\n \\ Return ch p (rs!p))\"\n\n(* the failure action of the unreliable memory *)\ndefinition MemFail :: \"memChType \\ resType \\ PrIds \\ action\"\n where \"MemFail ch rs p == ACT\n $(Calling ch p)\n \\ ((rs!p)$ = #MemFailure)\n \\ unchanged (rtrner ch ! p)\"\n\n(* next-state relations for reliable / unreliable memory *)\ndefinition RNext :: \"memChType \\ memType \\ resType \\ PrIds \\ action\"\n where \"RNext ch mm rs p == ACT\n ( Read ch mm rs p\n \\ (\\l. Write ch mm rs p l)\n \\ MemReturn ch rs p)\"\n\ndefinition UNext :: \"memChType \\ memType \\ resType \\ PrIds \\ action\"\n where \"UNext ch mm rs p == ACT (RNext ch mm rs p \\ MemFail ch rs p)\"\n\n\n(* temporal formulas *)\n\ndefinition RPSpec :: \"memChType \\ memType \\ resType \\ PrIds \\ temporal\"\n where \"RPSpec ch mm rs p == TEMP\n Init(PInit rs p)\n \\ \\[ RNext ch mm rs p ]_(rtrner ch ! p, rs!p)\n \\ WF(RNext ch mm rs p)_(rtrner ch ! p, rs!p)\n \\ WF(MemReturn ch rs p)_(rtrner ch ! p, rs!p)\"\n\ndefinition UPSpec :: \"memChType \\ memType \\ resType \\ PrIds \\ temporal\"\n where \"UPSpec ch mm rs p == TEMP\n Init(PInit rs p)\n \\ \\[ UNext ch mm rs p ]_(rtrner ch ! p, rs!p)\n \\ WF(RNext ch mm rs p)_(rtrner ch ! p, rs!p)\n \\ WF(MemReturn ch rs p)_(rtrner ch ! p, rs!p)\"\n\ndefinition MSpec :: \"memChType \\ memType \\ resType \\ Locs \\ temporal\"\n where \"MSpec ch mm rs l == TEMP\n Init(MInit mm l)\n \\ \\[ \\p. Write ch mm rs p l ]_(mm!l)\"\n\ndefinition IRSpec :: \"memChType \\ memType \\ resType \\ temporal\"\n where \"IRSpec ch mm rs == TEMP\n (\\p. RPSpec ch mm rs p)\n \\ (\\l. #l \\ #MemLoc \\ MSpec ch mm rs l)\"\n\ndefinition IUSpec :: \"memChType \\ memType \\ resType \\ temporal\"\n where \"IUSpec ch mm rs == TEMP\n (\\p. UPSpec ch mm rs p)\n \\ (\\l. #l \\ #MemLoc \\ MSpec ch mm rs l)\"\n\ndefinition RSpec :: \"memChType \\ resType \\ temporal\"\n where \"RSpec ch rs == TEMP (\\\\mm. IRSpec ch mm rs)\"\n\ndefinition USpec :: \"memChType \\ temporal\"\n where \"USpec ch == TEMP (\\\\mm rs. IUSpec ch mm rs)\"\n\n(* memory invariant: in the paper, the invariant is hidden in the definition of\n the predicate S used in the implementation proof, but it is easier to verify\n at this level. *)\ndefinition MemInv :: \"memType \\ Locs \\ stpred\"\n where \"MemInv mm l == PRED #l \\ #MemLoc \\ mm!l \\ #MemVal\"\n\nlemmas RM_action_defs =\n MInit_def PInit_def RdRequest_def WrRequest_def MemInv_def\n GoodRead_def BadRead_def ReadInner_def Read_def\n GoodWrite_def BadWrite_def WriteInner_def Write_def\n MemReturn_def RNext_def\n\nlemmas UM_action_defs = RM_action_defs MemFail_def UNext_def\n\nlemmas RM_temp_defs = RPSpec_def MSpec_def IRSpec_def\nlemmas UM_temp_defs = UPSpec_def MSpec_def IUSpec_def\n\n\n(* The reliable memory is an implementation of the unreliable one *)\nlemma ReliableImplementsUnReliable: \"\\ IRSpec ch mm rs \\ IUSpec ch mm rs\"\n by (force simp: UNext_def UPSpec_def IUSpec_def RM_temp_defs elim!: STL4E [temp_use] squareE)\n\n(* The memory spec implies the memory invariant *)\nlemma MemoryInvariant: \"\\ MSpec ch mm rs l \\ \\(MemInv mm l)\"\n by (auto_invariant simp: RM_temp_defs RM_action_defs)\n\n(* The invariant is trivial for non-locations *)\nlemma NonMemLocInvariant: \"\\ #l \\ #MemLoc \\ \\(MemInv mm l)\"\n by (auto simp: MemInv_def intro!: necT [temp_use])\n\nlemma MemoryInvariantAll:\n \"\\ (\\l. #l \\ #MemLoc \\ MSpec ch mm rs l) \\ (\\l. \\(MemInv mm l))\"\n apply clarify\n apply (auto elim!: MemoryInvariant [temp_use] NonMemLocInvariant [temp_use])\n done\n\n(* The memory engages in an action for process p only if there is an\n unanswered call from p.\n We need this only for the reliable memory.\n*)\n\nlemma Memoryidle: \"\\ \\$(Calling ch p) \\ \\ RNext ch mm rs p\"\n by (auto simp: AReturn_def RM_action_defs)\n\n(* Enabledness conditions *)\n\nlemma MemReturn_change: \"\\ MemReturn ch rs p \\ _(rtrner ch ! p, rs!p)\"\n by (force simp: MemReturn_def angle_def)\n\nlemma MemReturn_enabled: \"\\p. basevars (rtrner ch ! p, rs!p) \\\n \\ Calling ch p \\ (rs!p \\ #NotAResult)\n \\ Enabled (_(rtrner ch ! p, rs!p))\"\n apply (tactic\n \\action_simp_tac \\<^context> [@{thm MemReturn_change} RSN (2, @{thm enabled_mono}) ] [] 1\\)\n apply (tactic\n \\action_simp_tac (\\<^context> addsimps [@{thm MemReturn_def}, @{thm AReturn_def},\n @{thm rtrner_def}]) [exI] [@{thm base_enabled}, @{thm Pair_inject}] 1\\)\n done\n\nlemma ReadInner_enabled: \"\\p. basevars (rtrner ch ! p, rs!p) \\\n \\ Calling ch p \\ (arg = #(read l)) \\ Enabled (ReadInner ch mm rs p l)\"\n apply (case_tac \"l \\ MemLoc\")\n apply (force simp: ReadInner_def GoodRead_def BadRead_def RdRequest_def\n intro!: exI elim!: base_enabled [temp_use])+\n done\n\nlemma WriteInner_enabled: \"\\p. basevars (mm!l, rtrner ch ! p, rs!p) \\\n \\ Calling ch p \\ (arg = #(write l v))\n \\ Enabled (WriteInner ch mm rs p l v)\"\n apply (case_tac \"l \\ MemLoc \\ v \\ MemVal\")\n apply (force simp: WriteInner_def GoodWrite_def BadWrite_def WrRequest_def\n intro!: exI elim!: base_enabled [temp_use])+\n done\n\nlemma ReadResult: \"\\ Read ch mm rs p \\ (\\l. $(MemInv mm l)) \\ (rs!p)` \\ #NotAResult\"\n by (force simp: Read_def ReadInner_def GoodRead_def BadRead_def MemInv_def)\n\nlemma WriteResult: \"\\ Write ch mm rs p l \\ (rs!p)` \\ #NotAResult\"\n by (auto simp: Write_def WriteInner_def GoodWrite_def BadWrite_def)\n\nlemma ReturnNotReadWrite: \"\\ (\\l. $MemInv mm l) \\ MemReturn ch rs p\n \\ \\ Read ch mm rs p \\ (\\l. \\ Write ch mm rs p l)\"\n by (auto simp: MemReturn_def dest!: WriteResult [temp_use] ReadResult [temp_use])\n\nlemma RWRNext_enabled: \"\\ (rs!p = #NotAResult) \\ (\\l. MemInv mm l)\n \\ Enabled (Read ch mm rs p \\ (\\l. Write ch mm rs p l))\n \\ Enabled (_(rtrner ch ! p, rs!p))\"\n by (force simp: RNext_def angle_def elim!: enabled_mono2\n dest: ReadResult [temp_use] WriteResult [temp_use])\n\n\n(* Combine previous lemmas: the memory can make a visible step if there is an\n outstanding call for which no result has been produced.\n*)\nlemma RNext_enabled: \"\\p. \\l. basevars (mm!l, rtrner ch!p, rs!p) \\\n \\ (rs!p = #NotAResult) \\ Calling ch p \\ (\\l. MemInv mm l)\n \\ Enabled (_(rtrner ch ! p, rs!p))\"\n apply (auto simp: enabled_disj [try_rewrite] intro!: RWRNext_enabled [temp_use])\n apply (case_tac \"arg (ch w p)\")\n apply (tactic \\action_simp_tac (\\<^context> addsimps [@{thm Read_def},\n temp_rewrite \\<^context> @{thm enabled_ex}]) [@{thm ReadInner_enabled}, exI] [] 1\\)\n apply (force dest: base_pair [temp_use])\n apply (erule contrapos_np)\n apply (tactic \\action_simp_tac (\\<^context> addsimps [@{thm Write_def},\n temp_rewrite \\<^context> @{thm enabled_ex}])\n [@{thm WriteInner_enabled}, exI] [] 1\\)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/TLA/Memory/Memory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980404, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2737754889673005}} {"text": "header {* \\isaheader{Dynamic Standard Control Dependence} *}\n\ntheory DynStandardControlDependence imports Postdomination begin\n\ncontext Postdomination begin\n\ndefinition\n dyn_standard_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\"\n (\"_ controls\\<^sub>s _ via _\" [51,0,0])\nwhere dyn_standard_control_dependence_def:\"n controls\\<^sub>s n' via as \\ \n (\\a a' as'. (as = a#as') \\ (n' \\ set(sourcenodes as)) \\ (n -as\\* n') \\\n (n' postdominates (targetnode a)) \\\n (valid_edge a') \\ (sourcenode a' = n) \\ \n (\\ n' postdominates (targetnode a')))\"\n\n\nlemma Exit_not_dyn_standard_control_dependent:\n assumes control:\"n controls\\<^sub>s (_Exit_) via as\" shows \"False\"\nproof -\n from control obtain a as' where path:\"n -as\\* (_Exit_)\" and as:\"as = a#as'\"\n and pd:\"(_Exit_) postdominates (targetnode a)\" \n by(auto simp:dyn_standard_control_dependence_def)\n from path as have \"n -[]@a#as'\\* (_Exit_)\" by simp\n hence \"valid_edge a\" by(fastforce dest:path_split)\n with pd show False by -(rule Exit_no_postdominator,auto)\nqed\n\n\nlemma dyn_standard_control_dependence_def_variant:\n \"n controls\\<^sub>s n' via as = ((n -as\\* n') \\ (n \\ n') \\\n (\\ n' postdominates n) \\ (n' \\ set(sourcenodes as)) \\\n (\\n'' \\ set(targetnodes as). n' postdominates n''))\"\nproof\n assume \"(n -as\\* n') \\ (n \\ n') \\ (\\ n' postdominates n) \\ \n (n' \\ set(sourcenodes as)) \\\n (\\n''\\set (targetnodes as). n' postdominates n'')\"\n hence path:\"n -as\\* n'\" and noteq:\"n \\ n'\"\n and not_pd:\"\\ n' postdominates n\"\n and notin:\"n' \\ set(sourcenodes as)\"\n and all:\"\\n''\\set (targetnodes as). n' postdominates n''\"\n by auto\n have notExit:\"n \\ (_Exit_)\"\n proof\n assume \"n = (_Exit_)\"\n with path have \"n = n'\" by(fastforce dest:path_Exit_source)\n with noteq show False by simp\n qed\n from path have valid:\"valid_node n\" and valid':\"valid_node n'\"\n by(auto dest:path_valid_node)\n show \"n controls\\<^sub>s n' via as\"\n proof(cases as)\n case Nil \n with path valid not_pd notExit have False \n by(fastforce elim:path.cases dest:postdominate_refl)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with all have pd:\"n' postdominates targetnode ax\"\n by(auto simp:targetnodes_def)\n from path Cons have source:\"n = sourcenode ax\" \n and path2:\"targetnode ax -asx\\* n'\"\n by(auto intro:path_split_Cons)\n show ?thesis\n proof(cases \"\\as'. n -as'\\* (_Exit_)\")\n case True\n with not_pd valid valid' obtain as' where path':\"n -as'\\* (_Exit_)\"\n and not_isin:\"n' \\ set (sourcenodes as')\"\n by(auto simp:postdominate_def)\n have \"as' \\ []\"\n proof\n assume \"as' = []\"\n with path' have \"n = (_Exit_)\" by(auto elim:path.cases)\n with notExit show False by simp\n qed\n then obtain a' as'' where as':\"as' = a'#as''\"\n by(cases as',auto elim:path.cases)\n with path' have \"n -[]@a'#as''\\* (_Exit_)\" by simp\n hence source':\"n = sourcenode a'\" \n and valid_edge:\"valid_edge a'\"\n and path2':\"targetnode a' -as''\\* (_Exit_)\"\n by(fastforce dest:path_split)+\n from path2' not_isin as' valid'\n have \"\\ n' postdominates (targetnode a')\"\n by(auto simp:postdominate_def sourcenodes_def)\n with pd path Cons source source' notin valid_edge show ?thesis\n by(auto simp:dyn_standard_control_dependence_def)\n next\n case False\n with valid valid' have \"n' postdominates n\"\n by(auto simp:postdominate_def)\n with not_pd have False by simp\n thus ?thesis by simp\n qed\n qed\nnext\n assume \"n controls\\<^sub>s n' via as\"\n then obtain a nx a' nx' as' where notin:\"n' \\ set(sourcenodes as)\"\n and path:\"n -as\\* n'\" and as:\"as = a#as'\" and valid_edge:\"valid_edge a'\"\n and pd:\"n' postdominates (targetnode a)\"\n and source':\"sourcenode a' = n\"\n and not_pd:\"\\ n' postdominates (targetnode a')\"\n by(auto simp:dyn_standard_control_dependence_def)\n from path as have source:\"sourcenode a = n\" by(auto elim:path.cases)\n from path as have notExit:\"n \\ (_Exit_)\" by(auto elim:path.cases)\n from path have valid:\"valid_node n\" and valid':\"valid_node n'\"\n by(auto dest:path_valid_node)\n from notin as source have noteq:\"n \\ n'\"\n by(fastforce simp:sourcenodes_def)\n from valid_edge have valid_target':\"valid_node (targetnode a')\"\n by(fastforce simp:valid_node_def)\n { assume pd':\"n' postdominates n\"\n hence all:\"\\as. n -as\\* (_Exit_) \\ n' \\ set (sourcenodes as)\"\n by(auto simp:postdominate_def)\n from not_pd valid' valid_target' obtain as' \n where \"targetnode a' -as'\\* (_Exit_)\"\n by(auto simp:postdominate_def)\n with source' valid_edge have path':\"n -a'#as'\\* (_Exit_)\"\n by(fastforce intro:Cons_path)\n with all have \"n' \\ set (sourcenodes (a'#as'))\" by blast\n with source' have \"n' = n \\ n' \\ set (sourcenodes as')\"\n by(fastforce simp:sourcenodes_def)\n hence False\n proof\n assume \"n' = n\"\n with noteq show ?thesis by simp\n next\n assume isin:\"n' \\ set (sourcenodes as')\"\n from path' have path2:\"targetnode a' -as'\\* (_Exit_)\"\n by(fastforce elim:path_split_Cons)\n thus ?thesis\n proof(cases \"as' = []\")\n case True\n with path2 have \"targetnode a' = (_Exit_)\" by(auto elim:path.cases)\n with valid_edge all source' have \"n' = n\"\n by(fastforce dest:path_edge simp:sourcenodes_def)\n with noteq show ?thesis by simp\n next\n case False\n from path2 not_pd valid' valid_edge obtain as''\n where path'':\"targetnode a' -as''\\* (_Exit_)\"\n and notin:\"n' \\ set (sourcenodes as'')\"\n by(auto simp:postdominate_def)\n from valid_edge path'' have \"sourcenode a' -a'#as''\\* (_Exit_)\"\n by(fastforce intro:Cons_path)\n with all source' have \"n' \\ set (sourcenodes ([a']@as''))\" by simp\n with source' have \"n' = n \\ n' \\ set (sourcenodes as'')\"\n by(auto simp:sourcenodes_def)\n thus ?thesis\n proof\n assume \"n' = n\"\n with noteq show ?thesis by simp\n next\n assume \"n' \\ set (sourcenodes as'')\"\n with notin show ?thesis by simp\n qed\n qed\n qed }\n hence not_pd':\"\\ n' postdominates n\" by blast\n { fix n'' assume \"n'' \\ set (targetnodes as)\"\n with as source have \"n'' = targetnode a \\ n'' \\ set (targetnodes as')\" \n by(auto simp:targetnodes_def)\n hence \"n' postdominates n''\"\n proof\n assume \"n'' = targetnode a\"\n with pd show ?thesis by simp\n next\n assume isin:\"n'' \\ set (targetnodes as')\"\n hence \"\\ni \\ set (targetnodes as'). ni = n''\" by simp\n then obtain ns ns' where targets:\"targetnodes as' = ns@n''#ns'\"\n and all_noteq:\"\\ni \\ set ns'. ni \\ n''\"\n by(fastforce elim!:rightmost_element_property)\n from targets obtain xs ax ys where ys:\"ns' = targetnodes ys\"\n and as':\"as' = xs@ax#ys\" and target'':\"targetnode ax = n''\"\n by(fastforce elim:map_append_append_maps simp:targetnodes_def)\n from all_noteq ys have notin_target:\"n'' \\ set(targetnodes ys)\"\n by auto\n from path as have \"n -[]@a#as'\\* n'\" by simp\n hence \"targetnode a -as'\\* n'\" \n by(fastforce dest:path_split)\n with isin have path':\"targetnode a -as'\\* n'\"\n by(fastforce split:split_if_asm simp:targetnodes_def)\n with as' target'' have path1:\"targetnode a -xs\\* sourcenode ax\"\n and valid_edge':\"valid_edge ax\"\n and path2:\"n'' -ys\\* n'\"\n by(auto intro:path_split)\n from valid_edge' have \"sourcenode ax -[ax]\\* targetnode ax\" by(rule path_edge)\n with path1 target'' have path_n'':\"targetnode a -xs@[ax]\\* n''\"\n by(fastforce intro:path_Append)\n from notin as as' have notin':\"n'\\ set (sourcenodes (xs@[ax]))\"\n by(simp add:sourcenodes_def)\n show ?thesis\n proof(rule ccontr)\n assume \"\\ n' postdominates n''\"\n with valid' target'' valid_edge' obtain asx' \n where Exit_path:\"n'' -asx'\\* (_Exit_)\"\n and notin'':\"n' \\ set(sourcenodes asx')\" by(auto simp:postdominate_def)\n from path_n'' Exit_path\n have Exit_path':\"targetnode a -(xs@[ax])@asx'\\* (_Exit_)\"\n by(fastforce intro:path_Append)\n from notin' notin'' have \"n' \\ set(sourcenodes (xs@ax#asx'))\"\n by(simp add:sourcenodes_def)\n with pd Exit_path' show False by(simp add:postdominate_def)\n qed\n qed }\n with path not_pd' notin noteq show \"(n -as\\* n') \\ (n \\ n') \\\n (\\ n' postdominates n) \\ (n' \\ set(sourcenodes as)) \\\n (\\n'' \\ set(targetnodes as). n' postdominates n'')\" by blast\nqed\n\n\nlemma which_node_dyn_standard_control_dependence_source:\n assumes path:\"(_Entry_) -as@a#as'\\* n\"\n and Exit_path:\"n -as''\\* (_Exit_)\" and source:\"sourcenode a = n'\" \n and source':\"sourcenode a' = n'\"\n and no_source:\"n \\ set(sourcenodes (a#as'))\" and valid_edge':\"valid_edge a'\"\n and inner_node:\"inner_node n\" and not_pd:\"\\ n postdominates (targetnode a')\"\n and last:\"\\ax ax'. ax \\ set as' \\ sourcenode ax = sourcenode ax' \\\n valid_edge ax' \\ n postdominates targetnode ax'\"\n shows \"n' controls\\<^sub>s n via a#as'\"\nproof -\n from path source have path_n'n:\"n' -a#as'\\* n\" by(fastforce dest:path_split_second)\n from path have valid_edge:\"valid_edge a\" by(fastforce intro:path_split)\n show ?thesis\n proof(cases \"n postdominates (targetnode a)\")\n case True\n with path_n'n not_pd no_source source source' valid_edge' show ?thesis\n by(auto simp:dyn_standard_control_dependence_def)\n next\n case False\n hence not_pd':\"\\ n postdominates (targetnode a)\" .\n show ?thesis\n proof(cases \"as' = []\")\n case True\n with path_n'n have \"targetnode a = n\" by(fastforce elim:path.cases)\n with inner_node have \"n postdominates (targetnode a)\"\n by(cases \"n = (_Exit_)\",auto intro:postdominate_refl simp:inner_node_def)\n with not_pd path_n'n no_source source source' valid_edge' show ?thesis\n by(fastforce simp:dyn_standard_control_dependence_def)\n next\n case False\n hence notempty':\"as' \\ []\" .\n with path have path_nxn:\"targetnode a -as'\\* n\"\n by(fastforce dest:path_split)\n from Exit_path path_nxn have \"\\as. targetnode a -as\\* (_Exit_)\"\n by(fastforce dest:path_Append)\n with not_pd' inner_node valid_edge obtain asx \n where path_Exit:\"targetnode a -asx\\* (_Exit_)\" \n and notin:\"n \\ set (sourcenodes asx)\"\n by(auto simp:postdominate_def inner_is_valid)\n show ?thesis\n proof(cases \"\\asx'. asx = as'@asx'\")\n case True\n then obtain asx' where asx:\"asx = as'@asx'\" by blast\n from path notempty' have \"targetnode a -as'\\* n\"\n by(fastforce dest:path_split)\n with path_Exit inner_node asx notempty'\n obtain a'' as'' where \"asx' = a''#as'' \\ sourcenode a'' = n\"\n apply(cases asx')\n apply(fastforce dest:path_det)\n by(fastforce dest:path_split path_det)\n with asx have \"n \\ set(sourcenodes asx)\" by(simp add:sourcenodes_def)\n with notin have False by simp\n thus ?thesis by simp\n next\n case False\n hence all:\"\\asx'. asx \\ as'@asx'\" by simp\n then obtain j asx' where asx:\"asx = (take j as')@asx'\"\n and length:\"j < length as'\"\n and not_more:\"\\k > j. \\asx''. asx \\ (take k as')@asx''\"\n by(auto elim:path_split_general)\n from asx length have \"\\as'1 as'2. asx = as'1@asx' \\ \n as' = as'1@as'2 \\ as'2 \\ [] \\ as'1 = take j as'\"\n by simp(rule_tac x= \"drop j as'\" in exI,simp)\n then obtain as'1 as'' where asx:\"asx = as'1@asx'\"\n and take:\"as'1 = take j as'\"\n and x:\"as' = as'1@as''\" and x':\"as'' \\ []\" by blast\n from x x' obtain a1 as'2 where as':\"as' = as'1@a1#as'2\" and \"as'' = a1#as'2\"\n by(cases as'') auto\n have notempty_x':\"asx' \\ []\"\n proof(cases \"asx' = []\")\n case True\n with asx as' have \"as' = asx@a1#as'2\" by simp\n with path_n'n have \"n' -(a#asx)@a1#as'2\\* n\"\n by simp\n hence \"n' -a#asx\\* sourcenode a1\"\n and valid_edge1:\"valid_edge a1\" by(fastforce elim:path_split)+\n hence \"targetnode a -asx\\* sourcenode a1\"\n by(fastforce intro:path_split_Cons)\n with path_Exit have \"(_Exit_) = sourcenode a1\" by(rule path_det)\n from this[THEN sym] valid_edge1 have False by -(rule Exit_source,simp_all)\n thus ?thesis by simp\n qed simp\n with asx obtain a2 asx'1 \n where asx:\"asx = as'1@a2#asx'1\"\n and asx':\"asx' = a2#asx'1\" by(cases asx') auto\n from path_n'n as' have \"n' -(a#as'1)@a1#as'2\\* n\" by simp\n hence \"n' -a#as'1\\* sourcenode a1\" and valid_edge1:\"valid_edge a1\"\n by(fastforce elim:path_split)+\n hence path1:\"targetnode a -as'1\\* sourcenode a1\"\n by(fastforce intro:path_split_Cons)\n from path_Exit asx\n have \"targetnode a -as'1\\* sourcenode a2\"\n and valid_edge2:\"valid_edge a2\"\n and path2:\"targetnode a2 -asx'1\\* (_Exit_)\"\n by(auto intro:path_split)\n with path1 have eq12:\"sourcenode a1 = sourcenode a2\"\n by(cases as'1,auto dest:path_det)\n from asx notin have \"n \\ set (sourcenodes asx'1)\"\n by(simp add:sourcenodes_def)\n with path2 have not_pd'2:\"\\ n postdominates targetnode a2\"\n by(cases \"asx'1 = []\",auto simp:postdominate_def)\n from as' have \"a1 \\ set as'\" by simp\n with eq12 last valid_edge2 have \"n postdominates targetnode a2\" by blast\n with not_pd'2 have False by simp\n thus ?thesis by simp\n qed\n qed\n qed\nqed\n\n\nlemma inner_node_dyn_standard_control_dependence_predecessor:\n assumes inner_node:\"inner_node n\"\n obtains n' as where \"n' controls\\<^sub>s n via as\"\nproof(atomize_elim)\n from inner_node obtain as' where pathExit:\"n -as'\\* (_Exit_)\"\n by(fastforce dest:inner_is_valid Exit_path)\n from inner_node obtain as where pathEntry:\"(_Entry_) -as\\* n\"\n by(fastforce dest:inner_is_valid Entry_path)\n with inner_node have notEmpty:\"as \\ []\" \n by(auto elim:path.cases simp:inner_node_def)\n have \"\\a asx. (_Entry_) -a#asx\\* n \\ n \\ set (sourcenodes (a#asx))\"\n proof(cases \"n \\ set (sourcenodes as)\")\n case True\n hence \"\\n'' \\ set(sourcenodes as). n = n''\" by simp\n then obtain ns' ns'' where nodes:\"sourcenodes as = ns'@n#ns''\"\n and notin:\"\\n'' \\ set ns'. n \\ n''\"\n by(fastforce elim!:split_list_first_propE)\n from nodes obtain xs ys a'\n where xs:\"sourcenodes xs = ns'\" and as:\"as = xs@a'#ys\"\n and source:\"sourcenode a' = n\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from pathEntry as have \"(_Entry_) -xs@a'#ys\\* n\" by simp\n hence path2:\"(_Entry_) -xs\\* sourcenode a'\"\n by(fastforce dest:path_split)\n show ?thesis\n proof(cases \"xs = []\")\n case True\n with path2 have \"(_Entry_) = sourcenode a'\" by(auto elim:path.cases)\n with pathEntry source notEmpty have \"(_Entry_) -as\\* (_Entry_) \\ as \\ []\"\n by(auto elim:path.cases)\n hence False by(fastforce dest:path_Entry_target)\n thus ?thesis by simp\n next\n case False\n then obtain n a'' xs' where \"xs = a''#xs'\" by(cases xs) auto\n with False path2 notin xs source show ?thesis by simp blast\n qed\n next\n case False\n from notEmpty obtain a as' where \"as = a#as'\" by (cases as) auto\n with False pathEntry show ?thesis by auto\n qed\n then obtain a asx where pathEntry':\"(_Entry_) -a#asx\\* n\"\n and notin:\"n \\ set (sourcenodes (a#asx))\" by blast\n show \"\\n' as. n' controls\\<^sub>s n via as\"\n proof(cases \"\\a' a''. a' \\ set asx \\ sourcenode a' = sourcenode a'' \\ \n valid_edge a'' \\ n postdominates targetnode a''\")\n case True\n from inner_node have not_pd:\"\\ n postdominates (_Exit_)\" \n by(fastforce intro:empty_path simp:postdominate_def sourcenodes_def)\n from pathEntry' have path':\"(_Entry_) -[]@a#asx\\* n\" by simp\n hence eq:\"sourcenode a = (_Entry_)\"\n by(fastforce dest:path_split elim:path.cases)\n from Entry_Exit_edge obtain a' where \"sourcenode a' = (_Entry_)\"\n and \"targetnode a' = (_Exit_)\" and \"valid_edge a'\" by auto\n with path' inner_node not_pd True eq notin pathExit\n have \"sourcenode a controls\\<^sub>s n via a#asx\"\n by -(erule which_node_dyn_standard_control_dependence_source,auto)\n thus ?thesis by blast\n next\n case False\n hence \"\\a' \\ set asx. \\a''. sourcenode a' = sourcenode a'' \\ valid_edge a'' \\\n \\ n postdominates targetnode a''\"\n by fastforce\n then obtain ax asx' asx'' where \"asx = asx'@ax#asx'' \\\n (\\a''. sourcenode ax = sourcenode a'' \\ valid_edge a'' \\\n \\ n postdominates targetnode a'') \\\n (\\z \\ set asx''. \\ (\\a''. sourcenode z = sourcenode a'' \\ valid_edge a'' \\\n \\ n postdominates targetnode a''))\"\n by(blast elim!:rightmost_element_property)\n then obtain a'' where as':\"asx = asx'@ax#asx''\"\n and eq:\"sourcenode ax = sourcenode a''\"\n and valid_edge:\"valid_edge a''\"\n and not_pd:\"\\ n postdominates targetnode a''\"\n and last:\"\\z \\ set asx''. \\ (\\a''. sourcenode z = sourcenode a'' \\ \n valid_edge a'' \\ \\ n postdominates targetnode a'')\"\n by blast\n from notin as' have notin':\"n \\ set (sourcenodes (ax#asx''))\"\n by(auto simp:sourcenodes_def)\n from as' pathEntry' have \"(_Entry_) -(a#asx')@ax#asx''\\* n\" by simp\n with inner_node not_pd notin' eq last pathExit valid_edge\n have \"sourcenode ax controls\\<^sub>s n via ax#asx''\"\n by(fastforce elim!:which_node_dyn_standard_control_dependence_source)\n thus ?thesis by blast\n qed\nqed\n\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/Basic/DynStandardControlDependence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.273775482258674}} {"text": " (*-------------------------------------------*\n | |\n | ParaAlgo on LW-CSP-Prover |\n | |\n *-------------------------------------------*)\n\ntheory MBP_algo\nimports MBP_base CSP_semantics\nbegin\n\n(*************************************************************\n\n 1. Spec\n 2. \n 3. \n 4. \n\n *************************************************************)\n\n(* ----- loop test (process name) ------ *)\n\n\ndatatype ParaName = Bfr nodes edges \"nat => nodes\" nat nodes\n | Aft nodes edges \"nat => nodes\" nat nodes nat\n\n\n(*ParaAlgo*)\ndefinition\nco :: \"nat => nat\"\nwhere\nco_def : \"co c = 3 - c\"\n\ndefinition\nCom :: \"Event set\"\nwhere\nCom_def : \"Com == {com c c' n| c c' n. True}\"\n(*Com_def : \"Com == {e. EX c c' n. e = com c c' n}\"*)\n\ndefinition\nComFin :: \"Event set\"\nwhere\nComFin_def : \"ComFin == Com Un {finish}\"\n\nprimrec\n ParaDef :: \"ParaName => (ParaName, Event) proc\"\n where\n \"ParaDef (Bfr Blks Deps Asn c S) \n = ((S = Blks) &> finish -> STOP)\n [+] (~(S=Blks)) &> \n ( ( [Nat] n : (enable Blks Deps S Int Asn(c)) .. blk n -> $Aft Blks Deps Asn c S n)\n [+] (com (co(c)) c ? m -> $Bfr Blks Deps Asn c (S Un {m})))\"\n |\"ParaDef(Aft Blks Deps Asn c S n)\n = (com c (co(c)) ! n -> $Bfr Blks Deps Asn c (S Un {n}))\n [+] (com (co(c)) c ? m -> $Aft Blks Deps Asn c (S Un {m}) n)\"\n\noverloading ParaPNfun ==\n \"PNfun :: ParaName => (ParaName, Event) proc\"\n begin\ndefinition \"PNfun == ParaDef\"\nend\n\ndeclare ParaPNfun_def [simp]\n\n\ndefinition\n ParaCtrl :: \"nodes => edges => (nat => nodes) => (ParaName,Event) proc\"\n where\n ParaCtrl_def : \"ParaCtrl Blks Deps Asn\n == ($Bfr Blks Deps Asn 1 {} |[ComFin]| $Bfr Blks Deps Asn 2 {}) ~~ Com\"\n\n(* ------------------------------------ *\n | lemmas |\n * ------------------------------------ *)\n\n(*before com1*)\nlemma ParaAlgo_Bfr_blk:\n \"ALL e c S P'. e ~: Ev`Com & e ~: Ev ` ComFin & $Bfr Blks Deps Asn c S ---e---> P' \n--> (EX n. n : (enable Blks Deps S Int Asn(c)) & e = Ev (blk n) & P'= $Aft Blks Deps Asn c S n \n & S ~= Blks)\"\n apply (auto)\n apply (erule trn.cases, auto simp add: ComFin_def Com_def)+\n done\n\n(*before finish*)\nlemma ParaAlgo_Bfr_blk_finish:\n \"ALL e c S P'. e ~: Ev ` Com & e : Ev ` ComFin & $Bfr Blks Deps Asn c S ---e---> P' \n--> ( e = Ev (finish) & P'= STOP & S = Blks)\"\n apply (auto)\n apply (erule trn.cases, auto simp add: ComFin_def Com_def)+\n done\n\n(*before com2*)\nlemma ParaAlgo_Bfr_blk_com:\n \"ALL e c S P'. e : Ev ` Com & $Bfr Blks Deps Asn c S ---e---> P' \n--> (EX m. e = Ev (com(co(c))c m) & P'= $Bfr Blks Deps Asn c (S Un {m})\n & S ~= Blks)\"\n apply (auto)\n apply (erule trn.cases, auto simp add: ComFin_def Com_def)+\n done\n\n(*After*)\nlemma ParaAlgo_Aft_blk:\n \"ALL e c S n P'. $Aft Blks Deps Asn c S n ---e---> P' \n--> e = Ev(com c (co(c)) n) & P'= $Bfr Blks Deps Asn c (S Un {n}) |\n (EX m. e = Ev(com (co(c)) c m) & P'= $Aft Blks Deps Asn c (S Un {m}) n) \"\n apply (auto)\n apply (erule trn.cases, auto simp add: ComFin_def Com_def)+\n done\n\n(*STOP[]STOP*)\nlemma ParaAlgo_ws_STST:\n \"ALL P e P'. P ---e---> P' -->\n P = (STOP |[ComFin]| STOP) ~~ Com -->\n False\"\n apply (auto)\n apply (erule trn.cases, auto)+\n done\n\n(* existence of transitions *)\n\nlemma Bfr_Bfr_trn_1:\n \"n : Asn (Suc 0) ==> n : enable Blks Deps S \n ==>\n ($Bfr Blks Deps Asn (Suc 0) S \n |[ComFin]| $Bfr Blks Deps Asn 2 S) ~~ Com \n ---(Ev (blk n))--->\n ($Aft Blks Deps Asn (Suc 0) S n \n |[ComFin]| $Bfr Blks Deps Asn 2 S) ~~ Com\"\n apply (rule Hide1)\n apply (rule conjI)\n apply (rule Para1)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule If1)\n apply (rule conjI)\n apply (rule ExtCh1)\n apply (rule NatExtCh1) (* ?90 = n <— S b x n *)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (simp add: enable_def)\n apply(force)\n apply (simp add: ComFin_def)\n apply (simp add:Com_def)\n apply(force)(* Ev ` chutoriaru set sanshou*)\n apply (simp add:Com_def)\n apply(force) \n done \n\nlemma Bfr_Bfr_trn_2:\n \"n : Asn 2 ==> n : enable Blks Deps S \n ==>\n ($Bfr Blks Deps Asn (Suc 0) S \n |[ComFin]| $Bfr Blks Deps Asn 2 S) ~~ Com \n ---(Ev (blk n))--->\n ($Bfr Blks Deps Asn (Suc 0) S \n |[ComFin]| $Aft Blks Deps Asn 2 S n) ~~ Com\"\n\n apply (rule Hide1)\n apply (rule conjI)\n apply (rule Para2)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule If1)\n apply (rule conjI)\n apply (rule ExtCh1)\n apply (rule NatExtCh1) (* ?90 = n <— S b x n *)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (simp add: enable_def)\n apply(force)\n apply (simp add: ComFin_def)\n apply (simp add:Com_def)\n apply(force)(* Ev ` chutoriaru set sanshou*)\n apply (simp add:Com_def)\n apply(force) \n done \n\nlemma Bfr_Bfr_trn_finish:\n \"($Bfr Blks Deps Asn (Suc 0) Blks \n |[ComFin]| $Bfr Blks Deps Asn 2 Blks) \n ~~ Com \n ---(Ev finish)---> (STOP |[ComFin]| STOP) ~~ Com\"\n apply (rule Hide1)\n apply (rule conjI)\n apply (rule Para3)\n apply (simp add: ComFin_def)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (rule If1)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (rule If1)\n apply (rule conjI)\n apply (rule Prefix)\n apply (simp)\n\n apply (simp add: Com_def)\n apply (force)\n done\n\nlemma Aft_Bfr_trn_tau:\n \"S \\ Blks\n ==> ($Aft Blks Deps Asn (Suc 0) S n\n |[ComFin]| $Bfr Blks Deps Asn 2 S) ~~ Com \n ---Tau--->\n ($Bfr Blks Deps Asn (Suc 0) (insert n S) \n |[ComFin]| $Bfr Blks Deps Asn 2 (insert n S)) ~~ Com\"\n apply (rule Hide2)\n apply (rule conjI)\n apply (rule Para3)\n\n(* Aft --com--> Bfr*)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (rule Prefix)\n\n(* Bfr --com--> Bfr*)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule If1)\n apply (rule conjI)\n apply (rule ExtCh2)\n apply (rule NatExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n apply (force)\n apply (simp add: ComFin_def)\n apply (simp add: Com_def)\n apply (simp add: Com_def)\n done\n\nlemma Bfr_Aft_trn_tau:\n \"S \\ Blks\n ==> ($Bfr Blks Deps Asn (Suc 0) S\n |[ComFin]| $Aft Blks Deps Asn 2 S n) ~~ Com \n ---Tau--->\n ($Bfr Blks Deps Asn (Suc 0) (insert n S) \n |[ComFin]| $Bfr Blks Deps Asn 2 (insert n S)) ~~ Com\"\n apply (rule Hide2)\n apply (rule conjI)\n apply (rule Para3)\n\n(* Bfr --com--> Bfr*)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule If1)\n apply (rule conjI)\n apply (rule ExtCh2)\n apply (rule NatExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n apply (force)\n\n\n(* Aft --com--> Bfr*)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n apply (simp add: ComFin_def)\n apply (simp add: Com_def)\n apply (simp add: Com_def)\n done\n\nlemma Aft_Aft_trn_tau_1:\n \"($Aft Blks Deps Asn (Suc 0) S n\n |[ComFin]| $Aft Blks Deps Asn 2 S m) ~~ Com \n ---Tau--->\n ($Bfr Blks Deps Asn (Suc 0) (insert n S) \n |[ComFin]| $Aft Blks Deps Asn 2 (insert n S) m) ~~ Com\"\n apply (rule Hide2)\n apply (rule conjI)\n apply (rule Para3)\n apply (rule conjI)\n\n(*Aft --com--> Bfr*)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (rule Prefix)\n\n(*Aft --com--> Aft*)\n apply (rule conjI)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule NatExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n apply (simp add: ComFin_def)\n apply (simp add: Com_def)\n apply (simp add: Com_def)\n done\n\n\nlemma Aft_Aft_trn_tau_2:\n \"($Aft Blks Deps Asn (Suc 0) S n\n |[ComFin]| $Aft Blks Deps Asn 2 S m) ~~ Com \n ---Tau--->\n ($Aft Blks Deps Asn (Suc 0) (insert m S) n\n |[ComFin]| $Bfr Blks Deps Asn 2 (insert m S)) ~~ Com\"\n apply (rule Hide2)\n apply (rule conjI)\n apply (rule Para3)\n apply (rule conjI)\n\n (*Aft --com--> Aft*)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh2)\n apply (rule NatExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n apply (simp add: ComFin_def)\n apply (simp add: Com_def)\n\n(*Aft --com--> Bfr*)\n apply (rule PName)\n apply (simp)\n apply (rule ExtCh1)\n apply (simp add: co_def)\n apply (rule Prefix)\n\n apply (simp add: Com_def)\n done\n\nend\n", "meta": {"author": "nu-manycore", "repo": "public", "sha": "94b6a68b8183e6b756f6ece0fa483b93ad8cc833", "save_path": "github-repos/isabelle/nu-manycore-public", "path": "github-repos/isabelle/nu-manycore-public/public-94b6a68b8183e6b756f6ece0fa483b93ad8cc833/MBP-Prover/MBP_algo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.27377548225867393}} {"text": "theory Concrete_Reachability_Analysis\nimports\n Concrete_Rigorous_Numerics\n Abstract_Reachability_Analysis\nbegin\n\nabbreviation \"num_optns_rel \\ (Id::'b numeric_options rel)\"\n\nconsts i_flow1::interface\nconsts i_appr1::interface\n\nabbreviation \"float10_rel \\ Id::(float10 \\ float10) set\"\n\nlemma inj_on_nat_add_square: \"inj_on (\\a::nat. a + a * a) S\"\n by (rule strict_mono_imp_inj_on) (auto intro!: strict_monoI add_strict_mono mult_strict_mono)\n\nlemma add_sq_eq[simp]: \"a + a * a = b + b * b \\ a = b\" for a b::nat\n using inj_on_nat_add_square[of UNIV, unfolded inj_on_def, rule_format, of a b]\n by auto\n\ncontext includes autoref_syntax begin\nlemma [autoref_rules]:\n \"(precision, precision)\\num_optns_rel \\ nat_rel\"\n \"(start_stepsize, start_stepsize)\\num_optns_rel \\ rnv_rel\"\n \"(iterations, iterations)\\ num_optns_rel\\ nat_rel\"\n \"(halve_stepsizes, halve_stepsizes)\\ (num_optns_rel) \\ nat_rel\"\n \"(widening_mod, widening_mod)\\ (num_optns_rel) \\nat_rel\"\n \"(rk2_param, rk2_param)\\ (num_optns_rel) \\ rnv_rel\"\n \"(method_id, method_id)\\ (num_optns_rel) \\ nat_rel\"\n \"(adaptive_atol, adaptive_atol)\\ (num_optns_rel) \\ rnv_rel\"\n \"(adaptive_rtol, adaptive_rtol)\\ (num_optns_rel) \\ rnv_rel\"\n \"(printing_fun, printing_fun)\\ (num_optns_rel) \\ bool_rel \\ I \\ unit_rel\"\n \"(tracing_fun, tracing_fun)\\ (num_optns_rel) \\ string_rel \\ \\I\\option_rel \\ unit_rel\"\n by auto\n\nend\n\nlemma [autoref_op_pat_def]:\n includes autoref_syntax\n shows\n \"(\\xs. xs @ replicate D 0) ` X \\ OP (pad_zeroes D) $ X\"\n \"pad_zeroes D X \\ OP (pad_zeroes D) $ X\"\n by simp_all\n\nsubsection \\Relation Implementing \\ode_ops\\: Caching \\slp_of\\-Programs.\\\n\ndefinition \"ode_slps_of ode_ops =\n (approximate_sets_ode.ode_slp ode_ops,\n approximate_sets_ode.euler_incr_slp ode_ops,\n approximate_sets_ode.euler_slp ode_ops,\n approximate_sets_ode.rk2_slp ode_ops,\n approximate_sets_ode.D ode_ops)\"\n\ndefinition \"init_ode_ops poincare c1 ode_ops =\n (ode_ops, ode_slps_of ode_ops,\n (if poincare then Some(approximate_sets_ode.solve_poincare_slp ode_ops) else None),\n (if c1 then Some(ode_slps_of (approximate_sets_ode'.var_ode_ops ode_ops)) else None))\"\n\ndefinition \"ode_ops_rel =\n {(init, ode_ops). init = init_ode_ops True True ode_ops\n \\ init = init_ode_ops True False ode_ops\n \\ init = init_ode_ops False False ode_ops }\"\n\nconsts i_ode_ops::interface\nlemmas [autoref_rel_intf] = REL_INTFI[of ode_ops_rel i_ode_ops]\nlemmas [autoref_tyrel] = TYRELI[of ode_ops_rel]\n\n\ncontext approximate_sets begin\n\nunbundle autoref_syntax\n\nlemma print_set_impl[autoref_rules]:\n shows \"(printing_fun optns, print_set) \\ bool_rel \\ A \\ Id\"\n by auto\n\nlemma trace_set_impl[autoref_rules]:\n shows \"(tracing_fun optns, trace_set) \\ string_rel \\ \\A\\option_rel \\ Id\"\n by auto\n\ndefinition \"print_msg_impl s = tracing_fun optns s None\"\n\nlemma print_msg_impl[autoref_rules]:\n shows \"(print_msg_impl, print_msg) \\ string_rel \\ unit_rel\"\n unfolding print_msg_def\n by auto\n\ndefinition \"start_stepsize_impl = (if start_stepsize optns > 0 then start_stepsize optns else 1)\"\ndefinition \"rk2_param_impl = (let rk = rk2_param optns in if rk > 0 \\ rk \\ 1 then rk else 1)\"\n\nlemma options_impl[autoref_rules]:\n \"(RETURN (precision optns), precision_spec) \\ \\nat_rel\\nres_rel\"\n \"(RETURN (adaptive_atol optns), adaptive_atol_spec) \\ \\rnv_rel\\nres_rel\"\n \"(RETURN (adaptive_rtol optns), adaptive_rtol_spec) \\ \\rnv_rel\\nres_rel\"\n \"(RETURN (method_id optns), method_spec) \\ \\nat_rel\\nres_rel\"\n \"(RETURN start_stepsize_impl, start_stepsize_spec) \\ \\rnv_rel\\nres_rel\"\n \"(RETURN (iterations optns), iterations_spec) \\ \\nat_rel\\nres_rel\"\n \"(RETURN (widening_mod optns), widening_mod_spec) \\ \\nat_rel\\nres_rel\"\n \"(RETURN (halve_stepsizes optns), halve_stepsizes_spec) \\ \\nat_rel\\nres_rel\"\n \"(RETURN (rk2_param_impl), rk2_param_spec) \\ \\rnv_rel\\nres_rel\"\n by (auto simp: nres_rel_def\n precision_spec_def\n adaptive_atol_spec_def\n adaptive_rtol_spec_def\n method_spec_def\n start_stepsize_spec_def start_stepsize_impl_def\n iterations_spec_def\n widening_mod_spec_def\n halve_stepsizes_spec_def\n rk2_param_spec_def rk2_param_impl_def Let_def)\n\nsublocale approximate_sets_ode where ode_ops = ode_ops for ode_ops :: ode_ops ..\n\nschematic_goal trace_sets_impl:\n assumes [autoref_rules]: \"(si, s) \\ string_rel\" \"(Xi, X) \\ clw_rel appr_rel\"\n shows \"(RETURN ?f, trace_sets s X) \\ \\unit_rel\\nres_rel\"\n unfolding trace_sets_def\n by (subst rel_ANNOT_eq[of X \"clw_rel appr_rel\"]) (autoref_monadic (plain))\nconcrete_definition trace_sets_impl for si Xi uses trace_sets_impl\nlemmas [autoref_rules] = trace_sets_impl.refine[autoref_higher_order_rule]\n\nschematic_goal print_sets_impl:\n assumes [autoref_rules]: \"(si, s) \\ bool_rel\" \"(Xi, X) \\ clw_rel appr_rel\"\n shows \"(RETURN ?f, print_sets s X) \\ \\unit_rel\\nres_rel\"\n unfolding print_sets_def\n by (subst rel_ANNOT_eq[of X \"clw_rel appr_rel\"]) (autoref_monadic (plain))\nconcrete_definition print_sets_impl for si Xi uses print_sets_impl\nlemmas [autoref_rules] = print_sets_impl.refine[autoref_higher_order_rule]\n\ndefinition \"ode_slp_impl ode_ops = (case ode_ops of (_, (x, _, _, _, _), _, _) \\ x)\"\ndefinition \"euler_incr_slp_impl ode_ops = (case ode_ops of (_, (_, x, _, _, _), _, _) \\ x)\"\ndefinition \"euler_slp_impl ode_ops = (case ode_ops of (_, (_, _, x, _, _), _, _) \\ x)\"\ndefinition \"rk2_slp_impl ode_ops = (case ode_ops of (_, (_, _, _, x, _), _, _) \\ x)\"\ndefinition \"D_impl ode_ops = (case ode_ops of (_, (_, _, _, _, x), _, _) \\ x)\"\ndefinition \"poincare_slp_impl ode_ops = (case ode_ops of (ode_ops, (_, _, _, _, _), x, _) \\\n (case x of\n None \\ let _ = print_msg_impl (''ODE solver not initialized: pslp missing'') in solve_poincare_slp ode_ops\n | Some pslp \\ pslp))\"\n\nlemma autoref_parameters[autoref_rules]:\n \"(ode_slp_impl, ode_slp) \\ ode_ops_rel \\ slp_rel\"\n \"(euler_incr_slp_impl, euler_incr_slp) \\ ode_ops_rel \\ slp_rel\"\n \"(euler_slp_impl, euler_slp) \\ ode_ops_rel \\ slp_rel\"\n \"(rk2_slp_impl, rk2_slp) \\ ode_ops_rel \\ slp_rel\"\n \"(poincare_slp_impl, solve_poincare_slp) \\ ode_ops_rel \\ \\slp_rel\\list_rel\"\n \"(D_impl, D) \\ ode_ops_rel \\ nat_rel\"\n by (auto simp: ode_ops_rel_def ode_slp_impl_def euler_incr_slp_def D_impl_def init_ode_ops_def\n euler_incr_slp_impl_def euler_slp_impl_def rk2_slp_impl_def poincare_slp_impl_def\n ode_slps_of_def\n split: option.splits prod.splits)\n\ndefinition \"ode_e_impl = (\\(ode_ops, _). ode_expression ode_ops)\"\nlemma ode_e_impl[autoref_rules]: \"(ode_e_impl, ode_e) \\ ode_ops_rel \\ fas_rel\"\n by (auto simp: ode_e_impl_def ode_e_def ode_ops_rel_def init_ode_ops_def)\n\ndefinition \"safe_form_impl = (\\(ode_ops, _). safe_form ode_ops)\"\nlemma safe_form_impl[autoref_rules]: \"(safe_form_impl, safe_form) \\ ode_ops_rel \\ Id\"\n by (auto simp: safe_form_impl_def ode_ops_rel_def init_ode_ops_def)\n\nschematic_goal safe_set_appr:\n assumes [autoref_rules]: \"(Xi, X::'a::executable_euclidean_space set) \\ appr_rel\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n notes [autoref_rules] = autoref_parameters\n shows \"(nres_of ?f, safe_set odo X) \\ \\bool_rel\\nres_rel\"\n unfolding safe_set_def\n including art\n by autoref_monadic\nconcrete_definition safe_set_appr for odoi Xi uses safe_set_appr\nlemmas safe_set_appr_refine[autoref_rules] = safe_set_appr.refine[autoref_higher_order_rule]\n\nschematic_goal mk_safe_impl:\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n assumes [autoref_rules]: \"(Ri, R) \\ appr_rel\"\n shows \"(nres_of ?f, mk_safe odo (R::'a::executable_euclidean_space set)) \\ \\appr_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding mk_safe_def\n including art\n by autoref_monadic\nconcrete_definition mk_safe_impl for odoi Ri uses mk_safe_impl\nlemmas mk_safe_impl_refine[autoref_rules] = mk_safe_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def mk_safe .\n\nschematic_goal mk_safe_coll_impl:\n assumes [autoref_rules]: \"(ISi, IS) \\ clw_rel appr_rel\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n shows \"(nres_of (?f), mk_safe_coll odo (IS::'a::executable_euclidean_space set)) \\ \\clw_rel appr_rel\\nres_rel\"\n unfolding mk_safe_coll_def\n by autoref_monadic\nconcrete_definition mk_safe_coll_impl for ISi uses mk_safe_coll_impl\nlemmas mk_safe_coll_impl_refine[autoref_rules] = mk_safe_coll_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def mk_safe_coll .\n\nschematic_goal ode_set_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules]: \"(Xi, X) \\ appr_rel\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n notes [autoref_rules] = autoref_parameters\n shows \"(nres_of ?f, ode_set odo X::'a set nres) \\ \\appr_rel\\nres_rel\"\n unfolding ode_set_def[abs_def]\n including art\n by autoref_monadic\nconcrete_definition ode_set_impl for E odoi Xi uses ode_set_impl\nlemmas ode_set_impl_refine[autoref_rules] = ode_set_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def ode_set .\n\nschematic_goal Picard_step_ivl_impl:\n fixes h::real\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n assumes [autoref_rules]: \"(X0i,X0)\\appr_rel\" \"(hi, h) \\ rnv_rel\" \"(t0i, t0) \\ rnv_rel\" \"(PHIi,PHI)\\appr_rel\"\n notes [autoref_rules] = autoref_parameters\n shows \"(nres_of ?f, Picard_step_ivl odo X0 t0 h PHI::'a set option nres) \\ \\\\appr_rel\\option_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding Picard_step_ivl_def\n including art\n by autoref_monadic\nconcrete_definition Picard_step_ivl_impl for X0i t0i hi PHIi uses Picard_step_ivl_impl\nlemmas Picard_step_ivl_impl_refine[autoref_rules] =\n Picard_step_ivl_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def Picard_step_ivl .\n\nlemma [autoref_rules]:\n \"(abs, abs:: 'a \\ 'a::executable_euclidean_space) \\ rnv_rel \\ rnv_rel\"\n by simp_all\n\nlemma widening_spec[autoref_rules]:\n \"(\\i. RETURN (widening_mod optns mod i = 0), do_widening_spec) \\ nat_rel \\ \\bool_rel\\nres_rel\"\n by (auto simp: do_widening_spec_def nres_rel_def)\n\nschematic_goal P_iter_impl:\n fixes h::real and i::nat\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n assumes [autoref_rules]: \"(X0i,X0)\\appr_rel\" \"(PHIi,PHI)\\appr_rel\"\n \"(hi, h) \\ Id\" \"(i_i, i) \\ Id\"\n notes [autoref_rules] = autoref_parameters\n shows \"(nres_of (?f::?'r dres), P_iter odo X0 h i PHI::'a set option nres) \\ ?R\"\n unfolding P_iter_def uncurry_rec_nat APP_def\n including art\n by autoref_monadic\n\nconcrete_definition P_iter_impl for E odoi X0i hi i_i PHIi uses P_iter_impl\nlemmas [autoref_rules] = P_iter_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def P_iter .\n\nschematic_goal cert_stepsize_impl_nres:\n fixes h::real and i n::nat\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules]:\n \"(mi, m)\\(appr_rel \\ rnv_rel \\ rnv_rel \\ appr_rel \\ \\\\appr_rel \\\\<^sub>r R\\ option_rel\\nres_rel)\"\n \"(X0i,X0)\\appr_rel\" \"(hi, h) \\ rnv_rel\" \"(ni, n) \\ nat_rel\" \"(i_i, i) \\ nat_rel\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n shows \"(?f::?'r nres, cert_stepsize odo m (X0::'a set) h n i) \\ ?R\"\n unfolding cert_stepsize_def uncurry_rec_nat autoref_tag_defs\n by autoref\nconcrete_definition cert_stepsize_impl_nres for mi X0i hi ni i_i uses cert_stepsize_impl_nres\nlemmas [autoref_rules] = cert_stepsize_impl_nres.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def cert_stepsize .\n\nschematic_goal cert_stepsize_impl_dres[refine_transfer]:\n assumes [refine_transfer]: \"\\a b c d. nres_of (m a b c d) \\ m' a b c d\"\n shows \"nres_of ?f \\ cert_stepsize_impl_nres E odo m' x h n i\"\n unfolding cert_stepsize_impl_nres_def\n by (refine_transfer)\n\nconcrete_definition cert_stepsize_impl_dres for E m x h n i uses cert_stepsize_impl_dres\nlemmas [refine_transfer] = cert_stepsize_impl_dres.refine\n\nlemma DIM_obvious[autoref_rules_raw]: \"DIM_precond TYPE('a) DIM('a::executable_euclidean_space)\"\n by (auto simp: )\n\nlemma default_reduce_argument_spec_impl[autoref_rules]:\n \"(RETURN (default_reduce optns), default_reduce_argument_spec) \\ \\reduce_argument_rel TYPE('b)\\nres_rel\"\n by (auto simp: nres_rel_def default_reduce_argument_spec_def reduce_argument_rel_def\n intro!: RETURN_RES_refine)\n\nschematic_goal euler_step_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes ncc: \"ncc_precond TYPE('a::executable_euclidean_space)\"\n notes [simp] = ncc_precondD[OF ncc]\n assumes [autoref_rules]: \"(Xi, X) \\ appr_rel\" \"(hi, h) \\ Id\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n shows \"(nres_of (?f::?'r dres), euler_step odo (X::'a set) h) \\ ?R\"\n unfolding one_step_def euler_step_def[abs_def]\n including art\n by autoref_monadic\nconcrete_definition euler_step_impl for odoi Xi hi uses euler_step_impl\nlemmas [autoref_rules] = euler_step_impl.refine[autoref_higher_order_rule(1 2)]\nsublocale autoref_op_pat_def euler_step .\n\nschematic_goal rk2_step_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes ncc: \"ncc_precond TYPE('a::executable_euclidean_space)\"\n assumes [autoref_rules]: \"(Xi, X) \\ appr_rel\" \"(hi, h) \\ Id\"\n notes [simp] = ncc_precondD[OF ncc]\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n shows \"(nres_of (?f::?'r dres), rk2_step odo (X::'a set) h) \\ ?R\"\n unfolding one_step_def rk2_step_def[abs_def]\n by autoref_monadic\n\nconcrete_definition rk2_step_impl for odoi Xi hi uses rk2_step_impl\nlemmas [autoref_rules] = rk2_step_impl.refine[autoref_higher_order_rule (1 2)]\nsublocale autoref_op_pat_def rk2_step .\n\nschematic_goal choose_step_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules_raw]: \"ncc_precond TYPE('a)\"\n assumes [autoref_rules]: \"(Xi, X) \\ appr_rel\" \"(hi, h) \\ rnv_rel\"\n assumes [autoref_rules]: \"(odoi, odo) \\ ode_ops_rel\"\n shows \"(nres_of (?f), choose_step odo (X::'a set) h) \\ \\rnv_rel \\\\<^sub>r appr_rel \\\\<^sub>r appr_rel \\\\<^sub>r appr_rel\\nres_rel\"\n unfolding choose_step_def autoref_tag_defs if_distribR ncc_precond_def\n including art\n by autoref_monadic\n\nconcrete_definition choose_step_impl for Xi hi uses choose_step_impl\nlemmas [autoref_rules] = choose_step_impl.refine[autoref_higher_order_rule (1 2)]\nsublocale autoref_op_pat_def choose_step .\n\nlemma [autoref_rules]: \"(sgn, sgn) \\ rnv_rel \\ rnv_rel\"\n by auto\n\nschematic_goal strongest_direction_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n assumes [autoref_rules]: \"(xs, x) \\ lv_rel\"\n shows \"(?f, strongest_direction (x::'a)) \\ lv_rel \\\\<^sub>r rnv_rel\"\n unfolding strongest_direction_def\n including art\n by autoref\nconcrete_definition strongest_direction_impl for xs uses strongest_direction_impl\nlemmas [autoref_rules] = strongest_direction_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def strongest_direction .\n\nlemma [autoref_rules]:\n \"(real_divl, real_divl) \\ nat_rel \\ rnv_rel \\ rnv_rel \\ rnv_rel\"\n \"(truncate_down, truncate_down) \\ nat_rel \\ rnv_rel \\ rnv_rel\"\n \"(eucl_truncate_down, eucl_truncate_down) \\ nat_rel \\ rnv_rel \\ rnv_rel\"\n \"(truncate_up, truncate_up) \\ nat_rel \\ rnv_rel \\ rnv_rel\"\n \"(eucl_truncate_up, eucl_truncate_up) \\ nat_rel \\ rnv_rel \\ rnv_rel\"\n \"(max, max) \\ rnv_rel \\ rnv_rel \\ rnv_rel\"\n \"(min, min) \\ rnv_rel \\ rnv_rel \\ rnv_rel\"\n \"((/), (/)) \\ rnv_rel \\ rnv_rel \\ rnv_rel\"\n \"(lfloat10, lfloat10) \\ rnv_rel \\ float10_rel\"\n \"(ufloat10, ufloat10) \\ rnv_rel \\ float10_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ nat_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ int_rel \\ string_rel \\ string_rel\"\n \"(shows_prec, shows_prec) \\ nat_rel \\ float10_rel \\ string_rel \\ string_rel\"\n \"(int, int) \\ nat_rel \\ int_rel\"\n by (auto simp: string_rel_def)\n\nschematic_goal intersects_sctns_spec_impl:\n assumes [autoref_rules]: \"(ai, a) \\ appr_rel\"\n assumes sctns[autoref_rules]: \"(sctnsi, sctns) \\ sctns_rel\"\n notes [simp] = list_set_rel_finiteD[OF sctns]\n shows \"(nres_of (?x::_ dres), intersects_sctns (a::'a::executable_euclidean_space set) sctns) \\ \\bool_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding intersects_sctns_def\n by autoref_monadic\nconcrete_definition intersects_sctns_spec_impl for ai sctnsi uses intersects_sctns_spec_impl\nlemmas intersects_sctns_refine[autoref_rules] = intersects_sctns_spec_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def intersects_sctns .\n\nlemma\n assumes \"GEN_OP ws width_spec (A \\ \\rnv_rel\\nres_rel)\"\n assumes \"\\x. TRANSFER (RETURN (wsd x) \\ ws x)\"\n shows width_spec_invar_rel[autoref_rules]:\n \"(\\(a, b). RETURN (wsd a), width_spec) \\ \\S, A\\invar_rel b \\ \\rnv_rel\\nres_rel\"\n and width_spec_inter_rel[autoref_rules]:\n \"(\\(a, b). RETURN (wsd a), width_spec) \\ \\S, A\\inter_rel \\ \\rnv_rel\\nres_rel\"\n using assms\n by (auto simp: nres_rel_def width_spec_def invar_rel_def dest!: fun_relD)\n\nlemma width_spec_coll[autoref_rules]:\n assumes \"GEN_OP ws width_spec (A \\ \\rnv_rel\\nres_rel)\"\n assumes \"\\x. TRANSFER (RETURN (wsd x) \\ ws x)\"\n shows \"(\\xs. RETURN (sum_list (map wsd xs)), width_spec) \\ clw_rel A \\ \\rnv_rel\\nres_rel\"\n by (auto simp: nres_rel_def width_spec_def)\n\nschematic_goal intersects_sections_spec_clw[autoref_rules]:\n assumes [autoref_rules]: \"(Ri, R) \\ clw_rel appr_rel\" \"(sctnsi, sctns) \\ sctns_rel\"\n shows \"(nres_of (?r::_ dres), intersects_sctns_spec_clw $ R $ sctns) \\ \\bool_rel\\nres_rel\"\n unfolding intersects_sctns_spec_clw_def\n including art\n by autoref_monadic\n\nschematic_goal nonzero_component_impl:\n assumes [autoref_rules]: \"(Xi, X) \\ appr_rel\" \"(ni, n) \\ lv_rel\" \"(si, s) \\ string_rel\"\n shows \"(nres_of ?f, nonzero_component s X n) \\ \\unit_rel\\nres_rel\"\n unfolding nonzero_component_def autoref_tag_defs\n by autoref_monadic\nconcrete_definition nonzero_component_impl for si Xi ni uses nonzero_component_impl\nlemmas nonzero_component_impl_refine[autoref_rules] = nonzero_component_impl.refine[autoref_higher_order_rule]\nlemma\n take_set_of_apprI:\n assumes \"xs \\ set_of_appr XS\" \"tXS = take d XS\" \"d < length xs\"\n shows \"take d xs \\ set_of_appr tXS\"\n using set_of_appr_project[OF assms(1), of \"[0.. single_valued Y \\ Domain X \\ Domain Y = {} \\ single_valued (X \\ Y)\"\n by (auto simp: single_valued_def)\n\nlemma is_empty_ivl_rel[autoref_rules]:\n assumes le[THEN GEN_OP_D, param_fo]: \"GEN_OP le (\\) (A \\ A \\ bool_rel)\"\n shows \"(\\(x, y). \\ le x y, is_empty) \\ \\A\\ivl_rel \\ bool_rel\"\n apply (auto simp: ivl_rel_def br_def set_of_ivl_def)\n subgoal premises prems for a b c d\n using le[OF prems(2, 3)] prems(1,4-) order_trans\n by auto\n subgoal premises prems for a b c d\n using le[OF prems(3,4)] prems(1,2) order_trans\n by auto\n done\n\nlemma real_autoref[autoref_rules]:\n \"(real, real) \\ nat_rel \\ rnv_rel\"\n by auto\n\nlemma map_option_autoref[autoref_rules]: \"(map_option, map_option) \\ (A \\ B) \\ \\A\\option_rel \\ \\B\\option_rel\"\n by (rule map_option_param)\n\nlemma sv_plane_rel[relator_props]: \"single_valued A \\ single_valued (\\A\\plane_rel)\"\n by (auto simp: plane_rel_def intro!: relator_props)\nlemma sv_below_rel[relator_props]: \"single_valued A \\ single_valued (\\A\\below_rel)\"\n by (auto simp: below_rel_def intro!: relator_props)\nlemma sv_sbelow_rel[relator_props]: \"single_valued A \\ single_valued (\\A\\sbelow_rel)\"\n by (auto simp: sbelow_rel_def intro!: relator_props)\nlemma sv_sbelows_rel[relator_props]: \"single_valued A \\ single_valued (\\A\\sbelows_rel)\"\n by (auto simp: sbelows_rel_def intro!: relator_props)\n\nlemma closed_ivl_rel[intro, simp]: \"(a, b) \\ lvivl_rel \\ closed b\"\n by (auto simp: ivl_rel_def br_def set_of_ivl_def)\n\nlemma [autoref_rules]:\n \"(float_of, float_of) \\ rnv_rel \\ Id\"\n \"(approx, approx) \\ nat_rel \\ Id \\ \\\\Id\\option_rel\\list_rel \\ \\Id\\option_rel\"\n by auto\n\nlemma uninfo_autoref[autoref_rules]:\n assumes \"PREFER single_valued X\"\n assumes \"PREFER single_valued R\"\n shows \"(map snd, uninfo) \\ clw_rel (\\R, X\\info_rel) \\ clw_rel X\"\n using assms\n apply (auto simp: lw_rel_def Union_rel_br info_rel_def br_chain br_rel_prod elim!: single_valued_as_brE\n dest!: brD\n intro!: brI)\n apply force\n apply force\n apply force\n done\n\n\n\nlemma op_subset_ivl:\n assumes le[THEN GEN_OP_D, autoref_rules, param_fo]: \"GEN_OP le (\\) (A \\ A \\ bool_rel)\"\n shows \"(\\(a, b) (c, d). le a b \\ le c a \\ le b d, op_subset_ivl) \\ \\A\\ivl_rel \\ \\A\\ivl_rel \\ bool_rel\"\n apply (clarsimp dest!: brD simp: ivl_rel_def)\n subgoal for a b c d e f g h\n using le[of a c b d]\n using le[of e g a c]\n using le[of b d f h]\n by (auto simp: set_of_ivl_def)\n done\nconcrete_definition op_subset_ivl_impl uses op_subset_ivl\nlemmas [autoref_rules] = op_subset_ivl_impl.refine\n\nlemma [autoref_op_pat]: \"(=) \\ OP op_eq_ivl\"\n by (force intro!: eq_reflection)\nlemma eq_ivl_impl:\n assumes le[THEN GEN_OP_D, autoref_rules, param_fo]: \"GEN_OP le (\\) (A \\ A \\ bool_rel)\"\n shows \"(\\(a, b) (c, d). (le a b \\ le c a \\ le b d) \\ (le c d \\ le a c \\ le d b), op_eq_ivl) \\ \\A\\ivl_rel \\ \\A\\ivl_rel \\ bool_rel\"\n apply (clarsimp dest!: brD simp: )\n subgoal premises prems for a b c d e f\n using op_subset_ivl[param_fo, OF assms prems(1,2)]\n op_subset_ivl[param_fo, OF assms prems(2,1)]\n by (auto simp: )\n done\nconcrete_definition eq_ivl_impl uses eq_ivl_impl\nlemmas [autoref_rules] = eq_ivl_impl.refine\n\nlemma [autoref_rules]: \"(RETURN, get_plane) \\ \\A\\plane_rel \\ \\\\A\\sctn_rel\\nres_rel\"\n by (auto simp: plane_rel_def get_plane_def nres_rel_def dest!: brD intro!: RETURN_SPEC_refine)\n\nlemma [autoref_op_pat_def del]: \"get_inter p \\ OP (get_inter p)\" by auto\n\nlemma inform_autoref[autoref_rules]:\n \"(\\x. Max (abs ` set x), (infnorm::'a::executable_euclidean_space\\real)) \\ lv_rel \\ rnv_rel\"\n apply (auto simp: lv_rel_def br_def infnorm_def eucl_of_list_inner\n intro!: Max_eqI le_cSup_finite)\n subgoal for a y\n apply (rule exI[where x=\"Basis_list ! index a y\"])\n by (auto simp: eucl_of_list_inner)\n subgoal\n apply (rule rev_subsetD)\n apply (rule closed_contains_Sup)\n apply (auto intro!: finite_imp_closed)\n apply (rule imageI)\n apply (auto simp: eucl_of_list_inner)\n done\n done\n\nschematic_goal tolerate_error_impl:\n assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) dd\"\n assumes [autoref_rules]: \"(Yi, Y::'a::executable_euclidean_space set) \\ appr_rel\"\n assumes [autoref_rules]: \"(Ei, E) \\ appr_rel\"\n shows \"(nres_of ?r, tolerate_error Y E) \\ \\bool_rel \\\\<^sub>r rnv_rel\\nres_rel\"\n unfolding tolerate_error_def\n including art\n by autoref_monadic\nconcrete_definition tolerate_error_impl for dd Yi Ei uses tolerate_error_impl\nlemmas tolerate_error_refine[autoref_rules] = tolerate_error_impl.refine[autoref_higher_order_rule (1)]\n\nlemma adapt_stepsize_fa_autoref[autoref_rules]:\n \"(adapt_stepsize_fa, adapt_stepsize_fa) \\ rnv_rel \\ nat_rel \\ rnv_rel \\ rnv_rel \\ Id\"\n by auto\n\nlemma\n list_wset_rel_finite:\n assumes \"single_valued A\"\n shows \"(xs, X) \\ \\A\\list_wset_rel \\ finite X\"\n using assms\n by (auto simp: list_wset_rel_def set_rel_br dest!: brD elim!: single_valued_as_brE)\n\nlemma [autoref_rules_raw del]: \"(norm2_slp, norm2_slp) \\ nat_rel \\ Id\"\n and [autoref_itype del]: \"norm2_slp ::\\<^sub>i i_nat \\\\<^sub>i i_of_rel (Id::(floatarith list \\ floatarith list) set)\"\n by auto\n\nlemma [autoref_rules]: \"(norm2_slp, norm2_slp) \\ nat_rel \\ slp_rel\"\n by auto\n\nlemma [autoref_rules_raw]: \"DIM_precond TYPE(real) (Suc 0)\"\n by auto\nlemma [autoref_rules]:\n \"(real_divr, real_divr) \\ nat_rel \\ rnv_rel \\ rnv_rel \\ rnv_rel\"\n by auto\n\nlemma length_norm2_slp_ge: \"length (norm2_slp E) \\ 1\"\n unfolding norm2_slp_def\n by (auto simp: slp_of_fas_def split: prod.splits)\n\nlemma blinfun_of_vmatrix_scaleR: \"blinfun_of_vmatrix (c *\\<^sub>R e) = c *\\<^sub>R blinfun_of_vmatrix e\"\n including blinfun.lifting\n by transfer (vector sum_distrib_left algebra_simps matrix_vector_mult_def fun_eq_iff)\n\nlemma closed_clw_rel_iplane_rel:\n \"(xi, x) \\ clw_rel (iplane_rel lvivl_rel) \\ closed x\"\n unfolding lvivl_rel_br\n by (force simp: lv_rel_def plane_rel_br inter_rel_br clw_rel_br set_of_ivl_def\n dest!: brD)\n\nlemma closed_ivl_prod3_list_rel:\n assumes \"(y, x') \\ clw_rel (iplane_rel lvivl_rel) \\\\<^sub>r A\"\n assumes \"(xa, x'a) \\ \\clw_rel (iplane_rel lvivl_rel) \\\\<^sub>r B\\list_rel\"\n shows \"\\(guard, ro)\\set (x' # x'a). closed guard\"\n using assms closed_clw_rel_iplane_rel\n apply (auto simp: list_rel_def prod_rel_def in_set_conv_nth list_all2_conv_all_nth)\n apply (drule spec)\n by auto\n\nlemma\n rec_list_fun_eq1:\n assumes \"\\x xs a. snd (h x xs a) = snd a\"\n shows \"rec_list z (\\x xs r xa. f x xs xa (r (h x xs xa))) xs ab =\n rec_list (\\a. z (a, snd ab)) (\\x xs r a. f x xs (a, snd ab) (r (fst (h x xs (a, snd ab))))) xs (fst ab)\"\n using assms\n unfolding split_beta'\n by (induction xs arbitrary: ab) (auto simp: split_beta')\n\nlemma\n rec_list_fun_eq2:\n assumes \"\\x xs a. fst (h x xs a) = fst a\"\n shows \"rec_list z (\\x xs r xa. f x xs xa (r (h x xs xa))) xs ab =\n rec_list (\\b. z (fst ab, b)) (\\x xs r b. f x xs (fst ab, b) (r (snd (h x xs (fst ab, b))))) xs (snd ab)\"\n using assms\n unfolding split_beta'\n by (induction xs arbitrary: ab) (auto simp: split_beta')\n\nlemma [autoref_itype]: \"compact ::\\<^sub>i A \\\\<^sub>i i_bool\"\n by auto\n\nlemma lvivl_rel_compact[autoref_rules]:\n \"(\\_::_\\_. True, compact) \\ lvivl_rel \\ bool_rel\"\n \"(\\_::(_\\_)list. True, compact) \\ clw_rel lvivl_rel \\ bool_rel\"\n by (auto simp: lvivl_rel_br set_of_ivl_def lw_rel_def Union_rel_br dest!: brD)\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Concrete_Reachability_Analysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4649015713733884, "lm_q1q2_score": 0.2737754822586739}} {"text": "theory flash48Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv2) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv2) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Put2VsInv48: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv48: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv48: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv48 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash48Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27370207411262276}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: Hoare.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Auxiliary Definitions/Lemmas to Facilitate Hoare Logic *}\ntheory Hoare imports SmallStepCon LocalRG_HoareDef begin\n\n(*\nsyntax \n\n\"_hoarep_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\ (_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoarep_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoarep_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\ (_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\n\n\"_hoaret_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\\\<^sub>t (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^sub>t (_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoaret_noAbr\"::\n\"[('s,'p,'f) body,'f set, ('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoaret_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^sub>t (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^sub>t (_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\nsyntax (ascii)\n\n\"_hoarep_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] \\ bool\"\n (\"(3_,_/|- (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-'/_ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-(_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoarep_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-'/_ (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoarep_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-(_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-'/_ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-(_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\"_hoaret_emptyFault\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/|-t (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-t'/_ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-t(_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoaret_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-t'/_ (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoaret_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-t(_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-t'/_ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-t(_/ (_)/ _))\" [61,1000,20,1000]60)\n*)\n(*\ntranslations\n \n\n \"\\\\ P c Q,A\" == \"\\\\\\<^bsub>/{}\\<^esub> P c Q,A\" \n \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" == \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n \"\\,\\\\ P c Q\" == \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q\" == \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\,\\\\ P c Q,A\" == \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\" \n\n \"\\\\ P c Q\" == \"\\\\\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\\\\\<^bsub>/F\\<^esub> P c Q\" == \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q\"\n \"\\\\\\<^bsub>/F\\<^esub> P c Q\" <= \"\\\\\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\\\ P c Q\" <= \"\\\\ P c Q,{}\"\n\n\n\n\n \"\\\\\\<^sub>t P c Q,A\" == \"\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" == \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n \"\\,\\\\\\<^sub>t P c Q\" == \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" == \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\,\\\\\\<^sub>t P c Q,A\" == \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n \n \"\\\\\\<^sub>t P c Q\" == \"\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" == \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" <= \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\\\\\<^sub>t P c Q\" <= \"\\\\\\<^sub>t P c Q,{}\"\n\n\nterm \"\\\\ P c Q\"\nterm \"\\\\ P c Q,A\"\n\nterm \"\\\\\\<^bsub>/F\\<^esub> P c Q\"\nterm \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\nterm \"\\,\\\\ P c Q\"\nterm \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q\"\n\nterm \"\\,\\\\ P c Q,A\"\nterm \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nterm \"\\\\\\<^sub>t P c Q\"\nterm \"\\\\\\<^sub>t P c Q,A\"\n\nterm \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\nterm \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\nterm \"\\,\\\\ P c Q\"\nterm \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\n\nterm \"\\,\\\\ P c Q,A\"\nterm \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n*)\n\nlocale hoare =\n fixes \\::\"('s,'p,'f) body\" \n\n\nprimrec assoc:: \"('a \\'b) list \\ 'a \\ 'b \"\nwhere\n\"assoc [] x = undefined\" |\n\"assoc (p#ps) x = (if fst p = x then (snd p) else assoc ps x)\"\n\nlemma conjE_simp: \"(P \\ Q \\ PROP R) \\ (P \\ Q \\ PROP R)\"\n by rule simp_all\n\nlemma CollectInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma Compl_Collect:\"-(Collect b) = {x. \\(b x)}\"\n by fastforce\n\nlemma Collect_False: \"{s. False} = {}\"\n by simp\n\nlemma Collect_True: \"{s. True} = UNIV\"\n by simp\n\nlemma triv_All_eq: \"\\x. P \\ P\"\n by simp\n\nlemma triv_Ex_eq: \"\\x. P \\ P\"\n by simp\n\nlemma Ex_True: \"\\b. b\"\n by blast\n\nlemma Ex_False: \"\\b. \\b\"\n by blast\n\ndefinition mex::\"('a \\ bool) \\ bool\"\n where \"mex P = Ex P\"\n\ndefinition meq::\"'a \\ 'a \\ bool\"\n where \"meq s Z = (s = Z)\"\n\nlemma subset_unI1: \"A \\ B \\ A \\ B \\ C\" \n by blast\n\nlemma subset_unI2: \"A \\ C \\ A \\ B \\ C\" \n by blast\n\nlemma split_paired_UN: \"(\\p. (P p)) = (\\a b. (P (a,b)))\" \n by auto\n\nlemma in_insert_hd: \"f \\ insert f X\"\n by simp\n \nlemma lookup_Some_in_dom: \"\\ p = Some bdy \\ p \\ dom \\\"\n by auto\n\nlemma unit_object: \"(\\u::unit. P u) = P ()\"\n by auto\n\nlemma unit_ex: \"(\\u::unit. P u) = P ()\"\n by auto\n\nlemma unit_meta: \"(\\(u::unit). PROP P u) \\ PROP P ()\"\n by auto\n\nlemma unit_UN: \"(\\z::unit. P z) = P ()\"\n by auto\n\nlemma subset_singleton_insert1: \"y = x \\ {y} \\ insert x A\"\n by auto\n\nlemma subset_singleton_insert2: \"{y} \\ A \\ {y} \\ insert x A\"\n by auto\n\nlemma in_Specs_simp: \"(\\x\\\\Z. {(P Z, p, Q Z, A Z)}. Prop x) =\n (\\Z. Prop (P Z,p,Q Z,A Z))\"\n by auto\n\nlemma in_set_Un_simp: \"(\\x\\A \\ B. P x) = ((\\x \\ A. P x) \\ (\\x \\ B. P x))\"\n by auto\n\nlemma split_all_conj: \"(\\x. P x \\ Q x) = ((\\x. P x) \\ (\\x. Q x))\"\n by blast\n\nlemma image_Un_single_simp: \"f ` (\\Z. {P Z}) = (\\Z. {f (P Z)}) \"\n by auto\n\n\n\nlemma measure_lex_prod_def': \n \"f <*mlex*> r \\ ({(x,y). (x,y) \\ measure f \\ f x=f y \\ (x,y) \\ r})\"\n by (auto simp add: mlex_prod_def inv_image_def)\n\nlemma in_measure_iff: \"(x,y) \\ measure f = (f x < f y)\"\n by (simp add: measure_def inv_image_def)\n\nlemma in_lex_iff: \n \"((a,b),(x,y)) \\ r <*lex*> s = ((a,x) \\ r \\ (a=x \\ (b,y)\\s))\"\n by (simp add: lex_prod_def)\n\nlemma in_mlex_iff:\n \"(x,y) \\ f <*mlex*> r = (f x < f y \\ (f x=f y \\ (x,y) \\ r))\"\n by (simp add: measure_lex_prod_def' in_measure_iff)\n\nlemma in_inv_image_iff: \"(x,y) \\ inv_image r f = ((f x, f y) \\ r)\" \n by (simp add: inv_image_def)\n\ntext {* This is actually the same as @{thm [source] wf_mlex}. However, this basic\nproof took me so long that I'm not willing to delete it.\n*}\nlemma wf_measure_lex_prod [simp,intro]:\n assumes wf_r: \"wf r\"\n shows \"wf (f <*mlex*> r)\"\nproof (rule ccontr)\n assume \" \\ wf (f <*mlex*> r)\"\n then\n obtain g where \"\\i. (g (Suc i), g i) \\ f <*mlex*> r\"\n by (auto simp add: wf_iff_no_infinite_down_chain)\n hence g: \"\\i. (g (Suc i), g i) \\ measure f \\\n f (g (Suc i)) = f (g i) \\ (g (Suc i), g i) \\ r\"\n by (simp add: measure_lex_prod_def')\n hence le_g: \"\\i. f (g (Suc i)) \\ f (g i)\"\n by (auto simp add: in_measure_iff order_le_less)\n have \"wf (measure f)\"\n by simp\n hence \" \\Q. (\\x. x \\ Q) \\ (\\z\\Q. \\y. (y, z) \\ measure f \\ y \\ Q)\"\n by (simp add: wf_eq_minimal)\n from this [rule_format, of \"g ` UNIV\"]\n have \"\\z. z \\ range g \\ (\\y. (y, z) \\ measure f \\ y \\ range g)\"\n by auto\n then obtain z where \n z: \"z \\ range g\" and\n min_z: \"\\y. f y < f z \\ y \\ range g\"\n by (auto simp add: in_measure_iff)\n from z obtain k where \n k: \"z = g k\"\n by auto\n have \"\\i. k \\ i \\ f (g i) = f (g k)\" \n proof (intro allI impI) \n fix i\n assume \"k \\ i\" then show \"f (g i) = f (g k)\"\n proof (induct i)\n case 0\n have \"k \\ 0\" by fact hence \"k = 0\" by simp\n thus \"f (g 0) = f (g k)\"\n by simp\n next\n case (Suc n)\n have k_Suc_n: \"k \\ Suc n\" by fact\n then show \"f (g (Suc n)) = f (g k)\"\n proof (cases \"k = Suc n\")\n case True\n thus ?thesis by simp\n next\n case False\n with k_Suc_n\n have \"k \\ n\"\n by simp\n with Suc.hyps\n have n_k: \"f (g n) = f (g k)\" by simp\n from le_g have le: \"f (g (Suc n)) \\ f (g n)\"\n by simp\n show ?thesis\n proof (cases \"f (g (Suc n)) = f (g n)\")\n case True with n_k show ?thesis by simp\n next\n case False\n with le have \"f (g (Suc n)) < f (g n)\"\n by simp\n with n_k k have \"f (g (Suc n)) < f z\"\n by simp\n with min_z have \"g (Suc n) \\ range g\"\n by blast\n hence False by simp\n thus ?thesis\n by simp\n qed\n qed\n qed\n qed\n with k [symmetric] have \"\\i. k \\ i \\ f (g i) = f z\" \n by simp\n hence \"\\i. k \\ i \\ f (g (Suc i)) = f (g i)\"\n by simp\n with g have \"\\i. k \\ i \\ (g (Suc i),(g i)) \\ r\"\n by (auto simp add: in_measure_iff order_less_le )\n hence \"\\i. (g (Suc (i+k)),(g (i+k))) \\ r\"\n by simp\n then\n have \"\\f. \\i. (f (Suc i), f i) \\ r\"\n by - (rule exI [where x=\"\\i. g (i+k)\"],simp) \n with wf_r show False\n by (simp add: wf_iff_no_infinite_down_chain)\nqed\n\nlemmas all_imp_to_ex = all_simps (5) \n(*\"!!P Q. (ALL x. P x --> Q) = ((EX x. P x) --> Q)\"\n\n Avoid introduction of existential quantification of states on negative\n position.\n*)\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSimpl/Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.27370207411262276}} {"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n * Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n * 2016-2018 Technische Universität München, Germany\n * 2016-2018 University of York, UK\n * 2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\nsection \\Algebraic laws of programming\\\n\ntext \\In this section we introduce the semantic rules related to the different\n statements of IMP. In the literature this also known as the algebraic laws of programming.\n In our framework we will use these rules in order to optimize a given program written in our\n language, and this before any deductive proof verification activity or formal testing.\\\n\ntheory Algebraic_laws_design\n imports Algebraic_laws_design_aux\nbegin\n\nsection {*Algebraic laws for designs constructs*}\n\nsubsection Skip\n\ntext \\In this section we introduce the algebraic laws of programming related to the SKIP\n statement.\\\n\nlemma skip_left_unit_design:\n fixes P :: \"'a hrel_des\"\n assumes \"P is \\<^bold>H\"\n shows\"(SKIP\\<^sub>D ;; P) = P\"\n by (simp add: H1_H2_impl_H1 H1_left_unit assms) \n\nlemmas skip_left_unit_ndesign = skip_left_unit_design[OF H1_H3_impl_H2]\n\nlemma true_left_zero_skip_cpaD[udes_comp]:\n \"(SKIP\\<^sub>D;; true) = (true)\"\n by rel_auto\n\nlemma true_liftD_left_zero_skipD[udes_comp]:\n \"(SKIP\\<^sub>D;; \\true\\\\<^sub>D) = (\\true\\\\<^sub>D)\"\n by rel_auto\n\nlemma false_liftD_left_zero_skipD[udes_comp]:\n \"(SKIP\\<^sub>D;; \\false\\\\<^sub>D) = (\\false\\\\<^sub>D)\"\n by rel_auto\n\nlemma skipD_left_unit_assignsD[udes_comp]:\n \"(SKIP\\<^sub>D;; \\\\\\\\<^sub>D) = (\\\\\\\\<^sub>D)\"\n by rel_auto\n\nlemma skipD_topD_right_zero[udes_comp]:\n \"(SKIP\\<^sub>D;; \\\\<^sub>D) = (\\\\<^sub>D)\"\n by rel_auto\n\nlemma skipD_uvar_left_zero[udes_comp]:\n \"($x;; SKIP\\<^sub>D) = $x\"\n by rel_auto\n\nlemma skipD_bot_left_zero[udes_comp]:\n \"(\\\\<^sub>D;; SKIP\\<^sub>D) = (\\\\<^sub>D)\"\n by rel_auto\n\nlemma skip_d_alpha_eq:\n \"SKIP\\<^sub>D = ($ok \\ ($ok\\ \\ ($\\\\<^sub>D\\ =\\<^sub>u $\\\\<^sub>D)))\"\n by rel_simp\n\nlemma simpl_pre_skip_d_post:\n \"(\\b\\\\<^sub>D\\<^sub>< \\ SKIP\\<^sub>D =\\<^sub>u $ok) = (SKIP\\<^sub>D =\\<^sub>u $ok \\ \\b\\\\<^sub>D\\<^sub>>)\"\n by rel_auto\n\nlemma simpl_pre_skip_d_var:\n fixes x :: \"(bool \\ 'b des)\"\n shows \"($x \\ SKIP\\<^sub>D =\\<^sub>u $ok) = (SKIP\\<^sub>D =\\<^sub>u $ok \\ $x\\)\"\n by rel_auto\n\nlemma skip_d_is_H1_H2:\n \"SKIP\\<^sub>D is \\<^bold>H\" \n by rel_auto\n\nlemma skip_d_post_left_unit[udes_comp]:\n \"(S \\ (SKIP\\<^sub>D;; Q)) = (S \\ Q)\"\n apply pred_simp\n apply rel_simp\n apply fastforce\n done\n \nlemma skip_refine_des:\n assumes \"`(SKIP\\<^sub>D \\ (p \\ q))`\"\n shows \" (p \\ q) \\ SKIP\\<^sub>D\"\nproof (rule refine_reverse_impl, goal_cases)\n case 1\n then show ?case using assms by pred_simp \nqed\n\nlemma skip_d_left_unit:\n \"P is H1 \\ SKIP\\<^sub>D ;; P = P\"\n by rel_blast\n \nsubsection \\Assignment Laws\\\ntext \\In this section we introduce the algebraic laws of programming related to the assignment\n statement.\\\n\nlemma usubst_d_cancel [usubst]:\n assumes 1:\"weak_lens v\"\n shows \"($v)\\\\expr\\\\<^sub>D\\<^sub> = \\expr\\\\<^sub>D\\<^sub><\"\n using 1\n by rel_auto\n\nlemma usubst_d_lift_cancel[usubst]:\n assumes 1:\"weak_lens v\"\n shows \"\\($v)\\\\expr\\\\<^sub>\\\\<^sub>D = \\expr\\\\<^sub>D\\<^sub><\"\n using 1\n by rel_auto\n\nlemma assigns_d_id: \n \"SKIP\\<^sub>D = \\id\\\\<^sub>D\"\n unfolding skip_d_def assigns_d_def\n by (rel_auto)\n \nlemma assign_design_test[udes_comp]:\n assumes 1:\"mwb_lens x\"\n shows \"(x :=\\<^sub>D \\u\\;; x :=\\<^sub>D \\v\\) = (x :=\\<^sub>D \\v\\)\"\n using 1\n by (simp add: usubst udes_comp)\n\nlemma assigns_d_left_comp_subst[udes_comp]:\n \"(x :=\\<^sub>D u;; (\\P\\\\<^sub>D \\ \\Q\\\\<^sub>D)) = (\\P\\\\u\\\\<^sub>\\\\<^sub>D \\ \\Q\\\\u\\\\<^sub>\\\\<^sub>D)\"\n by rel_blast\n\nlemma assigns_d_left_comp_subst_hdesigns[udes_comp]:\n assumes \"P is \\<^bold>H\"\n shows \"(x :=\\<^sub>D u;; (P)) = (\\[x \\\\<^sub>s u]\\\\<^sub>s\\<^sub>D \\ P)\" (*fix the syntax sugar for substitution lifting*)\n using assms \n by rel_blast\n \nlemmas assigns_d_left_comp_subst_ndesigns[udes_comp] = \n assigns_d_left_comp_subst_hdesigns[OF H1_H3_impl_H2] \n\nlemma assign_d_twice[udes_comp]:\n assumes \"mwb_lens x\" and \"x \\ f\"\n shows \"(x :=\\<^sub>D e;; x :=\\<^sub>D f) = (x :=\\<^sub>D f)\"\n using assms\n by (simp add: udes_comp usubst)\n\nlemma assigns_d_commute:\n assumes \"x \\ y\" \"x \\ f\" \"y \\ e\"\n shows \"(x :=\\<^sub>D e ;; y :=\\<^sub>D f) = (y :=\\<^sub>D f ;; x :=\\<^sub>D e)\"\n using assms\n by (simp add: udes_comp usubst usubst_upd_comm)\n\nlemma assigns_d_left_cond_d_H1[udes_comp]: (*needs more laws to be automatic*)\n fixes x :: \"('a \\ '\\)\"\n assumes \"P is H1\" and \"Q is H1\" \n shows \"(x :=\\<^sub>D e ;; (bif\\<^sub>D b then P else Q eif)) =\n (bif\\<^sub>D (b\\e/x\\) then (x :=\\<^sub>D e;; P) else (x :=\\<^sub>D e ;; Q) eif)\"\n using assms \n apply (simp add: usubst udes_comp)\n apply rel_simp\n apply smt\n done \nlemmas assigns_d_left_cond_d_hdesigns[udes_comp] = \n assigns_d_left_cond_d_H1[OF H1_H2_impl_H1 H1_H2_impl_H1]\n\nlemmas assigns_d_left_cond_d_ndesigns[udes_comp] = \n assigns_d_left_cond_d_hdesigns[OF H1_H3_impl_H2 H1_H3_impl_H2] \n \nlemma assigns_d_uop1[udes_comp]:\n assumes 1: \"mwb_lens v\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (uop F (&v))) = (v :=\\<^sub>D (uop F e1))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_bop1[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (bop bp (&v) e2)) = (v :=\\<^sub>D (bop bp e1 e2))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_bop2[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (bop bp e2 (&v))) = (v :=\\<^sub>D (bop bp e2 e1))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_trop1[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (trop tp (&v) e2 e3)) =\n (v :=\\<^sub>D (trop tp e1 e2 e3))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_trop2[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (trop tp e2 (&v) e3)) =\n (v :=\\<^sub>D (trop tp e2 e1 e3))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_trop3[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (trop tp e2 e3 (&v))) =\n (v :=\\<^sub>D (trop tp e2 e3 e1))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_qtop1[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (qtop tp (&v) e2 e3 e4)) =\n (v :=\\<^sub>D (qtop tp e1 e2 e3 e4))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_qtop2[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (qtop tp e2 (&v) e3 e4)) =\n (v :=\\<^sub>D (qtop tp e2 e1 e3 e4))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_qtop3[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (qtop tp e2 e3 (&v) e4)) =\n (v :=\\<^sub>D (qtop tp e2 e3 e1 e4))\"\n by (simp add: usubst udes_comp assms)\n\nlemma assign_d_qtop4[udes_comp]:\n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v :=\\<^sub>D e1;; v :=\\<^sub>D (qtop tp e2 e3 e4 (&v))) =\n (v :=\\<^sub>D (qtop tp e2 e3 e4 e1))\"\n by (simp add: usubst udes_comp assms)\n\ntext \\In the sequel we define assignment laws proposed by Hoare\\\n\nlemma assign_d_vwb_skip_d[udes_comp]:\n assumes 1: \"vwb_lens v\"\n shows \"(v :=\\<^sub>D &v) = SKIP\\<^sub>D\"\n by (simp add: assms usubst)\n\nlemma assign_d_simultaneous:\n assumes 1: \"vwb_lens var2\"\n and 2: \"var1 \\ var2\"\n shows \"var1, var2 :=\\<^sub>D expr, &var2 = var1 :=\\<^sub>D expr\"\n by (simp add: assms usubst_upd_comm usubst)\n\nlemma assign_d_seq[udes_comp]:\n assumes 1: \"vwb_lens var2\"\n shows\"(var1 :=\\<^sub>D expr);; (var2 :=\\<^sub>D &var2) = (var1 :=\\<^sub>D expr)\"\n using assms by rel_blast\n \nlemma assign_d_cond_d_uop_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" \n shows \"bif\\<^sub>D uop F expr then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr ;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D uop F (&v) then P else Q eif\"\n using assms\n by (simp add: assigns_d_left_cond_d_H1 subst_uop usubst_cancel)\n \nlemmas assign_d_cond_d_uop_hdesigns[udes_comp] = \n assign_d_cond_d_uop_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_uop_ndesigns [udes_comp] = \n assign_d_cond_d_uop_hdesigns[OF H1_H3_impl_H2 H1_H3_impl_H2] \n \nlemma assign_d_cond_d_bop1_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" \n shows \"bif\\<^sub>D bop bp expr exp2 then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D bop bp (&v) exp2 then P else Q eif\"\n using assms\n by (simp add: assigns_d_left_cond_d_H1 subst_bop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_bop1_hdesigns[udes_comp] =\n assign_d_cond_d_bop1_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1] \n \nlemmas assign_d_cond_d_bop1_ndesigns[udes_comp] = \n assign_d_cond_d_bop1_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2] \n \nlemma assign_d_cond_d_bop2_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\"\n shows \"bif\\<^sub>D bop bp exp2 expr then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D bop bp exp2 (&v) then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_bop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_bop2_hdesigns[udes_comp] =\n assign_d_cond_d_bop2_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1] \n \nlemmas assign_d_cond_d_bop2_ndesigns[udes_comp] = \n assign_d_cond_d_bop2_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2] \n\nlemma assign_d_cond_d_trop1_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif\\<^sub>D trop bp expr exp2 exp3 then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D trop bp (&v) exp2 exp3 then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_trop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_trop1_hdesigns[udes_comp] = \n assign_d_cond_d_trop1_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_trop1_ndesigns[udes_comp] = \n assign_d_cond_d_trop1_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2]\n \nlemma assign_d_cond_d_trop2_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif\\<^sub>D trop bp exp2 expr exp3 then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D trop bp exp2 (&v) exp3 then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_trop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_trop2_hdesigns[udes_comp] = \n assign_d_cond_d_trop2_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_trop2_ndesigns[udes_comp] = \n assign_d_cond_d_trop2_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2] \n\nlemma assign_d_cond_d_trop3_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif\\<^sub>D trop bp exp2 exp3 expr then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D trop bp exp2 exp3 (&v) then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_trop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_trop3_hdesigns[udes_comp] = \n assign_d_cond_d_trop3_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_trop3_ndesigns[udes_comp] = \n assign_d_cond_d_trop3_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2]\n \nlemma assign_d_cond_d_qtop1_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif\\<^sub>D qtop bp expr exp2 exp3 exp4 then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D qtop bp (&v) exp2 exp3 exp4 then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_qtop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_qtop1_hdesigns[udes_comp] = \n assign_d_cond_d_qtop1_H1 [OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_qtop1_ndesigns[udes_comp] = \n assign_d_cond_d_qtop1_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2]\n \nlemma assign_d_cond_d_qtop2_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4:\"v \\ exp4\"\n shows \"bif\\<^sub>D qtop bp exp2 expr exp3 exp4 then (v :=\\<^sub>D expr;;P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D qtop bp exp2 (&v) exp3 exp4 then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_qtop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_qtop2_hdesigns[udes_comp] = \n assign_d_cond_d_qtop2_H1[OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_qtop2_ndesigns[udes_comp] = \n assign_d_cond_d_qtop2_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2]\n \nlemma assign_d_cond_d_qtop3_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif\\<^sub>D qtop bp exp2 exp3 expr exp4 then (v :=\\<^sub>D expr;;P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D qtop bp exp2 exp3 (&v) exp4 then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_qtop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_qtop3_hdesigns[udes_comp] = \n assign_d_cond_d_qtop3_H1[OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_qtop3_ndesigns[udes_comp] = \n assign_d_cond_d_qtop3_hdesigns [OF H1_H3_impl_H2 H1_H3_impl_H2]\n\nlemma assign_d_cond_d_qtop4_H1[udes_comp]: (*needs more laws to be automatic*)\n assumes \"P is H1\" and \"Q is H1\" and 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif\\<^sub>D qtop bp exp2 exp3 exp4 expr then (v :=\\<^sub>D expr;; P) else (v :=\\<^sub>D expr;; Q) eif =\n v :=\\<^sub>D expr;; bif\\<^sub>D qtop bp exp2 exp3 exp4 (&v) then P else Q eif\"\n using assms \n by (simp add: assigns_d_left_cond_d_H1 subst_qtop subst_to_singleton(2) subst_unrest usubst_cancel)\n\nlemmas assign_d_cond_d_qtop4_hdesigns[udes_comp] = \n assign_d_cond_d_qtop4_H1[OF H1_H2_impl_H1 H1_H2_impl_H1]\n \nlemmas assign_d_cond_d_qtop4_ndesigns[udes_comp] = \n assign_d_cond_d_qtop4_hdesigns[OF H1_H3_impl_H2 H1_H3_impl_H2]\n \nlemma assign_d_cond_d_If [udes_cond]:\n \"(bif\\<^sub>D bexp then (v :=\\<^sub>D exp1) else (v :=\\<^sub>D exp2) eif) =\n (v :=\\<^sub>D (exp1 \\ bexp \\ exp2))\"\n by rel_auto\n\nsubsection \\Sequential composition laws for designs\\\n\nlemma weaker_seq_r_H1_H2_closed[closure]:\n assumes \"P is H1\" \"Q is \\<^bold>H\"\n shows \"(P ;; Q) is \\<^bold>H\"\nproof -\n obtain Q\\<^sub>1 Q\\<^sub>2 where Q_def:\"Q = Q\\<^sub>1 \\\\<^sub>r Q\\<^sub>2\" and Q\\<^sub>1_Q\\<^sub>2_is_H1_H2:\"Q\\<^sub>1 \\\\<^sub>r Q\\<^sub>2 is \\<^bold>H\"\n using assms(2) unfolding Healthy_def\n by (metis H1_H2_eq_rdesign )\n moreover have \"(P ;; (Q\\<^sub>1 \\\\<^sub>r Q\\<^sub>2)) is \\<^bold>H\"\n proof -\n have *:\"H1 P = P\" \n using assms(1)[unfolded Healthy_def] .\n then show ?thesis using Q\\<^sub>1_Q\\<^sub>2_is_H1_H2 unfolding Healthy_def H2_def \n by (simp add: H1_rdesign H1_distrib_left_J H1_distrib_left_rdesign seqr_assoc')\n qed \n ultimately show ?thesis by simp\nqed \n \nlemma weaker_seq_r_H1_H3_closed:\n assumes 1: \"P is H1\"\n assumes 2: \"Q is \\<^bold>N\"\n shows \"(P;; Q) is \\<^bold>N\" \nproof -\n from 1 2 have 11:\"\\pre\\<^sub>D Q\\\\<^sub>< \\\\<^sub>n post\\<^sub>D Q = Q\"\n by (metis ndesign_form)\n then show ?thesis\n using 1 2 \n proof -\n have seq_r_H1_H2_closed_def: \"\\P Q. \\ (P is H1) \\ \\ (Q is \\<^bold>H) \\ P ;; Q is (\\P. \\<^bold>H P)\"\n using weaker_seq_r_H1_H2_closed by fastforce\n have \"\\P. (P is \\<^bold>N \\ P is \\<^bold>H) = (\\ (P is \\<^bold>N) \\ P is \\<^bold>H)\"\n by auto\n then have \"\\P. \\ (P is \\<^bold>N) \\ P is \\<^bold>H\" \n using H1_H3_impl_H2 by blast\n then have \"Q is \\<^bold>H\" using 2\n by blast\n then have \"P ;; Q is (\\P. \\<^bold>H P)\"\n using seq_r_H1_H2_closed_def 1 by blast \n from this[THEN H1_H2_impl_H1] show ?thesis \n using 11[simplified HOL.eq_commute] H3_ndesign[of \"\\pre\\<^sub>D Q\\\\<^sub><\" \"post\\<^sub>D Q\"]\n unfolding Healthy_def H3_def \n by (metis seqr_assoc)\n qed\nqed\n\ntheorem H1_H3_eq_ndesign:\n assumes 1:\"out\\ \\ pre\\<^sub>D(P)\"\n shows \"(\\<^bold>N(P)) = (\\pre\\<^sub>D(P)\\\\<^sub>< \\\\<^sub>n post\\<^sub>D(P))\"\nproof -\n from 1 have f2: \"H3 P = H3 (H2 P)\"\n by (metis H2_H3_absorb H2_H3_commute)\n have \"\\<^bold>H P = \\pre\\<^sub>D P\\\\<^sub>< \\\\<^sub>n post\\<^sub>D P\"\n using 1 by (simp add: H1_H2_eq_rdesign ndesign_def)\n then show ?thesis\n using f2 by (simp add: H1_H3_commute H3_ndesign)\nqed \n \nsubsection \\Conditional laws for designs\\ \n \nlemma if_d_true:\n \"bif\\<^sub>D true then P else Q eif = P\" \n by rel_simp\n \nlemma if_d_false:\n \"bif\\<^sub>D false then P else Q eif = Q\" \n by rel_simp\n \nlemma ifd_rdesign_pre_post:\n assumes P_is_H:\"P is \\<^bold>H\"\n assumes Q_is_H:\"Q is \\<^bold>H\" \n shows \n \"bif\\<^sub>D b then P else Q eif = \n bif\\<^sub>D b then (pre\\<^sub>D P) \\\\<^sub>r post\\<^sub>D P else (pre\\<^sub>D Q) \\\\<^sub>r post\\<^sub>D Q eif\" \nproof -\n show ?thesis \n using rdesign_split P_is_H Q_is_H \n by metis \nqed\n\ntheorem rdesign_dcond:\n \"bif\\<^sub>D b then (P\\<^sub>1 \\\\<^sub>r P\\<^sub>2) else (Q\\<^sub>1 \\\\<^sub>r Q\\<^sub>2) eif = (P\\<^sub>1 \\ b \\\\<^sub>r Q\\<^sub>1) \\\\<^sub>r (P\\<^sub>2 \\ b \\\\<^sub>r Q\\<^sub>2)\"\n by (rel_auto) \n \nlemma if_d_H1_H2_intro: \n assumes P_is_H: \"P is \\<^bold>H\" \n assumes Q_is_H:\"Q is \\<^bold>H\" \n shows \"bif\\<^sub>D b then P else Q eif is \\<^bold>H\"\n apply (subst rdesign_form [OF P_is_H, THEN HOL.sym]) \n apply (subst rdesign_form [OF Q_is_H, THEN HOL.sym]) \n apply (simp add: rdesign_dcond rdesign_is_H1_H2)\n done\n \nlemma if_d_H1_H3_intro: \n assumes unrest_1: \" out\\ \\ pre\\<^sub>D P\"\n assumes unrest_2: \"out\\ \\ pre\\<^sub>D Q\" \n assumes P_is_H: \"P is \\<^bold>H\" \n assumes Q_is_H:\"Q is \\<^bold>H\" \n shows \"bif\\<^sub>D b then P else Q eif is \\<^bold>N\" \n apply (subst H1_H3_intro[OF P_is_H unrest_1, THEN ndesign_form, THEN HOL.sym]) \n apply (subst H1_H3_intro[OF Q_is_H unrest_2, THEN ndesign_form, THEN HOL.sym]) \n apply (simp add: ndesign_H1_H3 ndesign_dcond)\n done \n\nlemma stronger_if_d_seq_r_H1_H2_closed:\n assumes 1: \"P is H1\"\n and 2: \"Q is \\<^bold>H\"\n shows \"(\\X. bif\\<^sub>D b then P ;; X else Q eif) \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\" \nproof (rule FuncSet.Pi_I)\n fix x :: \"('b, 'a) rel_des\"\n assume 11: \"x \\ \\\\<^bold>H\\\\<^sub>H\" \n have H2_seq_idemp: \"(P ;; x::'a hrel_des) = H2 (P ;; x)\"\n using weaker_seq_r_H1_H2_closed[OF 1 11[THEN Set.CollectD]] rdesign_split \n by (metis (no_types) H2_rdesign) \n have \"Q = H2 Q\"\n using rdesign_split 2 by (metis (no_types) H2_rdesign)\n then show \"bif\\<^sub>D b then P ;; x else Q eif \\ \\\\<^bold>H\\\\<^sub>H\"\n using weaker_seq_r_H1_H2_closed[OF 1 11[THEN Set.CollectD]] 2\n by (simp add: if_d_H1_H2_intro rdesign_is_H1_H2) \nqed \n \nlemma stronger_if_d_seq_r_H1_H3_closed:\n assumes 1: \"P is H1\"\n and 2: \"Q is \\<^bold>N\"\n shows \"(\\X. bif\\<^sub>D b then P ;; X else Q eif) \\ \\\\<^bold>N\\\\<^sub>H \\ \\\\<^bold>N\\\\<^sub>H\" \nproof (rule FuncSet.Pi_I)\n fix x :: \"('b, 'a) rel_des\"\n assume 11: \"x \\ \\\\<^bold>N\\\\<^sub>H\"\n have H3_seq_idemp: \"(P ;; x::'a hrel_des) = H3 (P ;; x)\"\n using weaker_seq_r_H1_H3_closed[OF 1 11[THEN Set.CollectD]] ndesign_split \n by (metis (no_types) H3_ndesign) \n have \"Q = H3 Q\"\n using ndesign_split 2 by (metis (no_types) H3_ndesign)\n then show \"bif\\<^sub>D b then P ;; x else Q eif \\ \\\\<^bold>N\\\\<^sub>H\"\n apply (subst weaker_seq_r_H1_H3_closed[OF 1 11[THEN Set.CollectD], THEN ndesign_form, THEN HOL.sym])\n apply (subst 2[THEN ndesign_form, THEN HOL.sym]) \n apply (simp add: ndesign_H1_H3 ndesign_dcond)\n done \nqed \n\nlemma if_d_skip_d_not_ok:\n \"bif\\<^sub>D true then SKIP\\<^sub>D ;; (\\ $ok) else SKIP\\<^sub>D eif = (\\ $ok)\"\n by (simp add: aext_true des_top_ndes_def ndesign_def)\n \nlemma if_d_skip_d_true:\n \"bif\\<^sub>D true then SKIP\\<^sub>D ;; true else SKIP\\<^sub>D eif = true\"\n by rel_simp\n\nlemma if_d_H4_true:\n assumes \"body is H4\"\n shows \"bif\\<^sub>D true then body ;; true else SKIP\\<^sub>D eif = true\"\n using assms by rel_auto\n \nlemma if_d_mono:\n \"mono (\\X. bif\\<^sub>D b then P ;; X else Q eif)\"\n by (auto intro: monoI seqr_mono cond_mono) \n \nsubsection \\Recursion laws for designs\\ \n\nlemma H1_H3_mu_refine_intro:\n assumes 1:\"P is \\<^bold>N\"\n assumes 2:\"P \\ F P\"\n assumes 3:\"out\\ \\ pre\\<^sub>D(P)\" \n assumes 4:\"`\\\\pre\\<^sub>D(P:: 'a hrel_des)\\\\<^sub><\\\\<^sub>D\\<^sub>< \\ (\\\\<^sub>N F \\ \\\\<^sub>N F)`\" \n shows \"P \\ \\\\<^sub>N F\"\nproof -\n from 3 H1_H3_eq_ndesign[of P]\n have is_H1_H3_eq_ndesign:\n \"\\<^bold>N P = \\pre\\<^sub>D P\\\\<^sub>< \\\\<^sub>n post\\<^sub>D P\" \n by simp \n also have pre_post_ndesign_mu_refine:\"\\ \\ \\\\<^sub>N F\" \n proof - \n have 1:\"\\pre\\<^sub>D P\\\\<^sub>< \\\\<^sub>n post\\<^sub>D P \\ F (\\pre\\<^sub>D P\\\\<^sub>< \\\\<^sub>n post\\<^sub>D P)\"\n using 1 2 ndesign_form[of P]\n by simp\n also have \"`\\\\pre\\<^sub>D P\\\\<^sub><\\\\<^sub>D\\<^sub>< \\ \\\\<^sub>N F \\ \\\\<^sub>N F`\"\n using 4 by simp\n from assms have \"(\\pre\\<^sub>D P\\\\<^sub>< \\\\<^sub>n post\\<^sub>D P) \\ \\\\<^sub>N F\"\n by (simp add: 1 ndesign_H1_H3 normal_design_theory_continuous.GFP_upperbound) \n with assms show ?thesis\n by (rel_auto, metis (no_types, lifting))\n qed \n ultimately show ?thesis \n by (simp add: \"1\" ndes_elim) \nqed\n \nlemma ndesign_mu_refine_intro:\n assumes \"(C \\\\<^sub>n S) \\ F(C \\\\<^sub>n S)\" \"`\\C\\\\<^sub>D\\<^sub>< \\ (\\\\<^sub>N F \\ \\\\<^sub>N F)`\"\n shows \"(C \\\\<^sub>n S) \\ \\\\<^sub>N F\"\nproof (rule H1_H3_mu_refine_intro, goal_cases)\n case 1\n then show ?case by (simp add: ndesign_H1_H3)\nnext\n case 2\n then show ?case by (simp add: assms(1))\nnext\n case 3\n then show ?case by (simp add: unrest_pre_out\\)\nnext\n case 4\n then show ?case by (simp add: assms(2))\nqed \n \nsubsection \\While laws for designs\\\n \ntext \\In this section we introduce the algebraic laws of programming related to the while\n statement.\\\n \nlemma while_gfp_des_def_alt:\n\"(while\\<^sup>\\\\<^sup>D b do body od) = (\\\\<^sub>D X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n unfolding from_until_gfp_des_def while_gfp_des_def \n by (simp add: skip_left_unit_design)\n \nlemma while_lfp_des_def_alt:\n\"(while\\<^sub>\\\\<^sub>D b do body od) = (\\\\<^sub>D X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n unfolding from_until_lfp_des_def while_lfp_des_def \n by (simp add: skip_left_unit_design)\n \ntheorem while_gfp_des_unfold:\n assumes HB: \"body is H1\"\n shows\n \"while\\<^sup>\\\\<^sup>D b do body od = (bif\\<^sub>D b then (body ;; while\\<^sup>\\\\<^sup>D b do body od) else SKIP\\<^sub>D eif)\"\nproof -\n have m:\"mono (\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n by (auto intro: monoI seqr_mono cond_mono)\n have H: \"(\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif) \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\" \n by (rule stronger_if_d_seq_r_H1_H2_closed[OF HB skip_d_is_H1_H2]) \n have \"(while\\<^sup>\\\\<^sup>D b do body od) = (\\\\<^sub>D X \\ bif\\<^sub>D b then (body;; X) else SKIP\\<^sub>D eif)\"\n by (simp add: while_gfp_des_def_alt)\n also have \"... = (bif\\<^sub>D b then (body ;; (\\\\<^sub>D X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)) else SKIP\\<^sub>D eif)\"\n using mono_Monotone_utp_order [OF m, of \"\\\\<^bsub>DES\\<^esub>\"] H\n design_theory_continuous.GFP_weak_unfold \n by auto\n also have \"... = (bif\\<^sub>D b then (body ;; while\\<^sup>\\\\<^sup>D b do body od) else SKIP\\<^sub>D eif)\"\n by (simp add:while_gfp_des_def_alt)\n finally show ?thesis .\nqed \n\ntheorem while_lfp_des_unfold:\n assumes HB: \"body is H1\"\n shows \"while\\<^sub>\\\\<^sub>D b do body od = (bif\\<^sub>D b then (body;; while\\<^sub>\\\\<^sub>D b do body od) else SKIP\\<^sub>D eif)\"\nproof -\n have m:\"mono (\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n by (auto intro: monoI seqr_mono cond_mono)\n have H: \"(\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif) \\ \\\\<^bold>H\\\\<^sub>H \\ \\\\<^bold>H\\\\<^sub>H\"\n by (rule stronger_if_d_seq_r_H1_H2_closed[OF HB skip_d_is_H1_H2]) \n have \"(while\\<^sub>\\\\<^sub>D b do body od) = (\\\\<^sub>D X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n unfolding from_until_lfp_des_def \n by (simp add: while_lfp_des_def_alt skip_left_unit_design)\n also have \"... = (bif\\<^sub>D b then (body;; (\\\\<^sub>D X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)) else SKIP\\<^sub>D eif)\"\n using mono_Monotone_utp_order [OF m, of \"\\\\<^bsub>DES\\<^esub>\"] H\n design_theory_continuous.LFP_weak_unfold \n by auto\n also have \"... = (bif\\<^sub>D b then (body;; while\\<^sub>\\\\<^sub>D b do body od) else SKIP\\<^sub>D eif)\"\n by (simp add: while_lfp_des_def_alt)\n finally show ?thesis .\nqed\n \ntheorem while_lfp_des_true: \n \"while\\<^sub>\\\\<^sub>D true do body od = (\\\\<^sub>D X \\ (body ;; X))\"\n by (simp add: while_lfp_des_def_alt alpha) \n\nlemma while_lfp_des_false:\n shows \"(while\\<^sub>\\\\<^sub>D false do body od) = SKIP\\<^sub>D\"\n by (simp add: while_lfp_des_def_alt alpha skip_d_def \n design_theory_continuous.LFP_const rdesign_is_H1_H2)\n \ntheorem while_gfp_des_false: \n \"while\\<^sup>\\\\<^sup>D false do body od = SKIP\\<^sub>D\"\n by (simp add: while_gfp_des_def_alt alpha skip_d_def \n design_theory_continuous.GFP_const rdesign_is_H1_H2)\n\ntheorem while_gfp_des_non_termination: (*because of this lemma and the lemma utp_designs.design_top we do not use gfp for capturing termination *)\n \"while\\<^sup>\\\\<^sup>D true do SKIP\\<^sub>D od = \\\\<^sub>D\"\n unfolding while_gfp_des_def_alt\nproof (rule design_theory_continuous.weak.GFP_idem [of \"(\\X. bif\\<^sub>D true then SKIP\\<^sub>D ;; X else SKIP\\<^sub>D eif)\",\n unfolded utp_theory_des_top_is_not_ok if_d_skip_d_not_ok] , goal_cases)\n case 1\n then show ?case by (simp add: H1_H2_impl_H1 if_d_H1_H2_intro skip_d_is_H1_H2 weaker_seq_r_H1_H2_closed)\nnext\n case 2\n then show ?case by (simp add: aext_true seqr_mono utp_theory.Mono_utp_orderI)\nnext\n case 3\n then show ?case unfolding idempotent_def by (simp add: aext_true seqr_assoc) \nqed\n\ntheorem while_lfp_des_non_termination: \n \"while\\<^sub>\\\\<^sub>D true do SKIP\\<^sub>D od = \\\\<^sub>D\"\n unfolding while_lfp_des_def_alt\nproof (rule design_theory_continuous.weak.LFP_idem [of \"(\\X. bif\\<^sub>D true then SKIP\\<^sub>D ;; X else SKIP\\<^sub>D eif)\",\n unfolded utp_theory_des_bot_is_true if_d_skip_d_true] , goal_cases)\n case 1\n then show ?case by (simp add: H1_H2_impl_H1 if_d_H1_H2_intro skip_d_is_H1_H2 weaker_seq_r_H1_H2_closed)\nnext\n case 2\n then show ?case by (simp add: aext_true seqr_mono utp_theory.Mono_utp_orderI)\nnext\n case 3\n then show ?case unfolding idempotent_def by (simp add: aext_true seqr_assoc) \nqed \n\n \nsubsection \\While laws for normal designs\\\n\ntext \\In this section we introduce the algebraic laws of programming related to the while\n statement.\\\n \nlemma while_gfp_ndes_def_alt:\n\"(while\\<^sup>\\\\<^sup>N b do body od) = (\\\\<^sub>N X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n unfolding from_until_gfp_ndes_def while_gfp_ndes_def \n by (simp add: skip_left_unit_ndesign)\n \nlemma while_lfp_ndes_def_alt:\n\"(while\\<^sub>\\\\<^sub>N b do body od) = (\\\\<^sub>N X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n unfolding from_until_lfp_ndes_def while_lfp_ndes_def \n by (simp add: skip_left_unit_ndesign)\n \nlemma while_gfp_ndes_is_H1_H3: \n \"while\\<^sup>\\\\<^sup>N b do body od is \\<^bold>N\" \n unfolding while_gfp_ndes_def_alt\n by simp \n \nlemma while_lfp_ndes_is_H1_H3: \n \"while\\<^sub>\\\\<^sub>N b do body od is \\<^bold>N\" \n unfolding while_lfp_ndes_def_alt\n by simp \n \nlemma while_gfp_ndes_is_H1_H2: \n \"while\\<^sup>\\\\<^sup>D b do body od is \\<^bold>H\" \n unfolding while_gfp_des_def_alt\n by simp \n \nlemma while_lfp_ndes_is_H1_H2: \n \"while\\<^sub>\\\\<^sub>D b do body od is \\<^bold>H\" \n unfolding while_lfp_des_def_alt\n by simp \n \ntheorem while_gfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows\n \"while\\<^sup>\\\\<^sup>N b do body od = (bif\\<^sub>D b then (body ;; while\\<^sup>\\\\<^sup>N b do body od) else SKIP\\<^sub>D eif)\"\nproof -\n have m:\"mono (\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n by (auto intro: monoI seqr_mono cond_mono)\n have H: \"(\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif) \\ \\\\<^bold>N\\\\<^sub>H \\ \\\\<^bold>N\\\\<^sub>H\" \n by (rule stronger_if_d_seq_r_H1_H3_closed[OF HB skip_d_is_H1_H3]) \n have \"(while\\<^sup>\\\\<^sup>N b do body od) = (\\\\<^sub>N X \\ bif\\<^sub>D b then (body;; X) else SKIP\\<^sub>D eif)\"\n by (simp add: while_gfp_ndes_def_alt)\n also have \"... = (bif\\<^sub>D b then (body ;; (\\\\<^sub>N X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)) else SKIP\\<^sub>D eif)\"\n using mono_Monotone_utp_order [OF m, of \"\\\\<^bsub>NDES\\<^esub>\"] H\n normal_design_theory_continuous.GFP_weak_unfold \n by auto\n also have \"... = (bif\\<^sub>D b then (body ;; while\\<^sup>\\\\<^sup>N b do body od) else SKIP\\<^sub>D eif)\"\n by (simp add: while_gfp_ndes_def_alt)\n finally show ?thesis .\nqed\n \ntheorem while_lfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows\n \"while\\<^sub>\\\\<^sub>N b do body od = (bif\\<^sub>D b then (body;; while\\<^sub>\\\\<^sub>N b do body od) else SKIP\\<^sub>D eif)\"\nproof -\n have m:\"mono (\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n by (auto intro: monoI seqr_mono cond_mono)\n have H: \"(\\X. bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif) \\ \\\\<^bold>N\\\\<^sub>H \\ \\\\<^bold>N\\\\<^sub>H\"\n by (rule stronger_if_d_seq_r_H1_H3_closed[OF HB skip_d_is_H1_H3]) \n have \"(while\\<^sub>\\\\<^sub>N b do body od) = (\\\\<^sub>N X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)\"\n by (simp add: while_lfp_ndes_def_alt)\n also have \"... = (bif\\<^sub>D b then (body ;; (\\\\<^sub>N X \\ bif\\<^sub>D b then (body ;; X) else SKIP\\<^sub>D eif)) else SKIP\\<^sub>D eif)\"\n using mono_Monotone_utp_order [OF m, of \"\\\\<^bsub>NDES\\<^esub>\"] H\n normal_design_theory_continuous.LFP_weak_unfold \n by auto\n also have \"... = (bif\\<^sub>D b then (body ;; while\\<^sub>\\\\<^sub>N b do body od) else SKIP\\<^sub>D eif)\"\n by (simp add: while_lfp_ndes_def_alt)\n finally show ?thesis .\nqed\n \ntheorem while_lfp_ndes_true: \n \"while\\<^sub>\\\\<^sub>N true do body od = (\\\\<^sub>N X \\ (body;; X))\"\n by (simp add: while_lfp_ndes_def_alt alpha)\n \nlemma while_lfp_ndes_false:\n \"(while\\<^sub>\\\\<^sub>N false do body od) = SKIP\\<^sub>D\"\n by (simp add: while_lfp_ndes_def_alt alpha skip_d_is_H1_H3 \n normal_design_theory_continuous.LFP_const)\n\ntheorem while_gfp_ndes_false: \"while\\<^sup>\\\\<^sup>N false do body od = SKIP\\<^sub>D\"\n by (simp add: while_gfp_ndes_def_alt alpha skip_d_is_H1_H3 \n normal_design_theory_continuous.GFP_const)\n \ntheorem while_gfp_ndes_non_termination: (*because of this lemma and the lemma utp_designs.design_top we do not use gfp for capturing termination *)\n \"while\\<^sup>\\\\<^sup>N true do SKIP\\<^sub>D od = \\\\<^sub>D\"\n unfolding while_gfp_ndes_def_alt\nproof (rule normal_design_theory_continuous.weak.GFP_idem [of \"(\\X. bif\\<^sub>D true then SKIP\\<^sub>D ;; X else SKIP\\<^sub>D eif)\",\n unfolded utp_theory_ndes_top_is_not_ok if_d_skip_d_not_ok] , goal_cases)\n case 1\n then show ?case by (simp add: aext_true skip_left_unit_ndesign) \nnext\n case 2\n then show ?case by (simp add: aext_true seqr_mono utp_theory.Mono_utp_orderI)\nnext\n case 3\n then show ?case unfolding idempotent_def by (simp add: aext_true seqr_assoc) \nqed\n\ntheorem while_lfp_ndes_non_termination: \n \"while\\<^sub>\\\\<^sub>N true do SKIP\\<^sub>D od = \\\\<^sub>D\"\n unfolding while_lfp_ndes_def_alt\nproof (rule normal_design_theory_continuous.weak.LFP_idem [of \"(\\X. bif\\<^sub>D true then SKIP\\<^sub>D ;; X else SKIP\\<^sub>D eif)\",\n unfolded utp_theory_ndes_bot_is_true if_d_skip_d_true] , goal_cases)\n case 1\n then show ?case by (simp add: aext_true skip_left_unit_ndesign)\nnext\n case 2\n then show ?case by (simp add: aext_true seqr_mono utp_theory.Mono_utp_orderI)\nnext\n case 3\n then show ?case unfolding idempotent_def by (simp add: aext_true seqr_assoc) \nqed \n \nlemma abort_situation_left_zero:\n \"Q is \\<^bold>N \\ \n ((\\pre\\<^sub>D P\\\\<^sub>< \\ post\\<^sub>D P wp false) \\\\<^sub>n false) ;; Q = ((\\pre\\<^sub>D P\\\\<^sub>< \\ post\\<^sub>D P wp false) \\\\<^sub>n false)\" \n by rel_blast\n \nlemma nested_abort_situation:\n \"\\\\<^sub>N (\\ X . ((\\pre\\<^sub>D P\\\\<^sub>< \\ post\\<^sub>D P wp false) \\\\<^sub>n false) ;; X) = ((\\pre\\<^sub>D P\\\\<^sub>< \\ post\\<^sub>D P wp false) \\\\<^sub>n false)\"\n apply (subst (1) normal_design_theory_continuous.LFP_healthy_comp)\n apply (simp add: comp_def)\n apply (subst abort_situation_left_zero) \n using Healthy_Idempotent is_Ncarrier_is_ndesigns apply auto[1]\n apply (simp add: ndesign_H1_H3 normal_design_theory_continuous.LFP_unfold utp_theory.Mono_utp_orderI)\n done \n\nsubsection \\Iteration laws for designs\\\n \ntheorem from_until_gfp_des_alt_def:\n \"from\\<^sup>\\\\<^sup>D init until exit do body od = init ;; while\\<^sup>\\\\<^sup>D \\ exit do body od\"\n unfolding while_gfp_des_def_alt from_until_gfp_des_def \n by simp \n\nlemma from_until_while_gfp_des:\n \"from\\<^sup>\\\\<^sup>D SKIP\\<^sub>D until exit do body od = while\\<^sup>\\\\<^sup>D \\ exit do body od\"\n unfolding from_until_gfp_des_alt_def\n by (simp add: skip_left_unit_design while_gfp_des_def_alt)\n \nlemma from_until_lfp_ndes_is_H1_H3:\n \"init is H1 \\from\\<^sub>\\\\<^sub>N init until exit do body od is \\<^bold>N\"\n unfolding from_until_lfp_ndes_def\n by (simp add: weaker_seq_r_H1_H3_closed)\n\nlemma from_until_gfp_des_is_H1_H3:\n \"init is H1 \\from\\<^sup>\\\\<^sup>N init until exit do body od is \\<^bold>N\"\n unfolding from_until_gfp_ndes_def\n by (simp add: weaker_seq_r_H1_H3_closed)\n \nlemma from_until_lfp_des_is_H1_H2:\n \"init is H1 \\ from\\<^sub>\\\\<^sub>D init until exit do body od is \\<^bold>H\"\n unfolding from_until_lfp_des_def\n by (simp add: weaker_seq_r_H1_H2_closed)\n\nlemma from_until_gfp_ndes_is_H1_H2:\n \"init is H1 \\ from\\<^sup>\\\\<^sup>D init until exit do body od is \\<^bold>H\"\n unfolding from_until_gfp_des_def\n by (simp add: weaker_seq_r_H1_H2_closed)\n \ntheorem from_until_gfp_des_unfold:\n assumes HB: \"body is H1\"\n shows \"from\\<^sup>\\\\<^sup>D init until exit do body od = \n init ;; (bif\\<^sub>D \\ exit then (body;; while\\<^sup>\\\\<^sup>D \\ exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding from_until_gfp_des_alt_def using while_gfp_des_unfold[OF HB]\n by simp\n \ntheorem from_until_lfp_des_alt_def:\n \"from\\<^sub>\\\\<^sub>D init until exit do body od = init ;; while\\<^sub>\\\\<^sub>D \\ exit do body od\"\n unfolding while_lfp_des_def_alt from_until_lfp_des_def \n by simp \n\nlemma from_until_while_lfp_des:\n \"from\\<^sub>\\\\<^sub>D SKIP\\<^sub>D until exit do body od = while\\<^sub>\\\\<^sub>D \\ exit do body od\"\n unfolding from_until_lfp_des_alt_def\n by (simp add: skip_left_unit_design while_lfp_des_def_alt)\n \ntheorem from_until_lfp_des_unfold:\n assumes HB: \"body is H1\"\n shows \"from\\<^sub>\\\\<^sub>D init until exit do body od = \n init ;; (bif\\<^sub>D \\ exit then (body;; while\\<^sub>\\\\<^sub>D \\ exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding from_until_lfp_des_alt_def using while_lfp_des_unfold[OF HB]\n by simp\n\ntheorem do_while_gfp_des_alt_def:\n \"do body while\\<^sup>\\\\<^sup>D exit od = body ;; while\\<^sup>\\\\<^sup>D exit do body od\"\n unfolding do_while_gfp_des_def from_until_gfp_des_alt_def\n by simp \n\ntheorem do_while_lfp_des_alt_def:\n \"do body while\\<^sub>\\\\<^sub>D exit od = body ;; while\\<^sub>\\\\<^sub>D exit do body od\"\n unfolding do_while_lfp_des_def from_until_lfp_des_alt_def\n by simp \n \nlemma do_while_gfp_des_is_H1_H2: \n \"body is H1 \\ do body while\\<^sup>\\\\<^sup>D b od is \\<^bold>H\"\n unfolding do_while_gfp_des_def from_until_gfp_des_def\n by (simp add: weaker_seq_r_H1_H2_closed)\n \nlemma do_while_lfp_des_is_H1_H2: \n \"body is H1 \\ do body while\\<^sub>\\\\<^sub>D b od is \\<^bold>H\"\n unfolding do_while_lfp_des_def from_until_lfp_des_def\n by (simp add: weaker_seq_r_H1_H2_closed) \n\nlemma do_while_gfp_ndes_is_H1_H3:\n \"body is H1 \\ do body while\\<^sup>\\\\<^sup>N b od is \\<^bold>N\"\n unfolding do_while_gfp_ndes_def from_until_gfp_ndes_def\n by (simp add: weaker_seq_r_H1_H3_closed)\n \nlemma do_while_lfp_ndes_is_H1_H3:\n \"body is H1 \\ do body while\\<^sub>\\\\<^sub>N b od is \\<^bold>N\"\n unfolding do_while_lfp_ndes_def from_until_lfp_ndes_def\n by (simp add: weaker_seq_r_H1_H3_closed)\n \ntheorem do_while_gfp_des_unfold:\n assumes HB: \"body is H1\"\n shows \"do body while\\<^sup>\\\\<^sup>D exit od = \n body ;; (bif\\<^sub>D exit then (body;; while\\<^sup>\\\\<^sup>D exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding do_while_gfp_des_alt_def using while_gfp_des_unfold[OF HB]\n by simp\n\ntheorem do_while_lfp_des_unfold:\n assumes HB: \"body is H1\"\n shows \"do body while\\<^sub>\\\\<^sub>D exit od = \n body ;; (bif\\<^sub>D exit then (body;; while\\<^sub>\\\\<^sub>D exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding do_while_lfp_des_alt_def using while_lfp_des_unfold[OF HB]\n by simp \n\ntheorem for_gfp_des_alt_def:\n \"for\\<^sup>\\\\<^sup>D (init, exit, incr) do body od = init ;; while\\<^sup>\\\\<^sup>D exit do body;;incr od\"\n unfolding for_gfp_des_def from_until_gfp_des_alt_def\n by simp \n \ntheorem for_lfp_des_alt_def:\n \"for\\<^sub>\\\\<^sub>D (init, exit, incr) do body od = init ;; while\\<^sub>\\\\<^sub>D exit do body;;incr od\"\n unfolding for_lfp_des_def from_until_lfp_des_alt_def\n by simp \n\nlemma for_gfp_ndes_is_H1_H2:\n \"init is H1 \\for\\<^sup>\\\\<^sup>D (init,b,incr) do body od is \\<^bold>H\"\n unfolding for_gfp_des_def from_until_gfp_des_def \n by (simp add: weaker_seq_r_H1_H2_closed) \n\nlemma for_lfp_des_is_H1_H2:\n \"init is H1 \\for\\<^sub>\\\\<^sub>D (init,b,incr) do body od is \\<^bold>H\"\n unfolding for_lfp_des_def from_until_lfp_des_def \n by (simp add: weaker_seq_r_H1_H2_closed) \n\nlemma for_gfp_ndes_is_H1_H3: \n \"init is H1 \\for\\<^sup>\\\\<^sup>N (init,b,incr) do body od is \\<^bold>N\"\n unfolding for_gfp_ndes_def from_until_gfp_ndes_def \n by (simp add: weaker_seq_r_H1_H3_closed) \n\nlemma for_lfp_ndes_is_H1_H3:\n \"init is H1 \\for\\<^sub>\\\\<^sub>N (init,b,incr) do body od is \\<^bold>N\"\n unfolding for_lfp_ndes_def from_until_lfp_ndes_def \n by (simp add: weaker_seq_r_H1_H3_closed)\n \ntheorem for_gfp_des_unfold:\n assumes HB: \"body is H1\"\n assumes Hinit: \"incr is H1\" \n shows \"for\\<^sup>\\\\<^sup>D (init, exit, incr) do body od = \n init ;; (bif\\<^sub>D exit then (body;;incr;;while\\<^sup>\\\\<^sup>D exit do body ;; incr od) else SKIP\\<^sub>D eif)\"\n unfolding for_gfp_des_alt_def using while_gfp_des_unfold[of \"body ;; incr\" \"exit\", OF seq_is_H1[OF HB Hinit]] \n by (metis seqr_assoc)\n \ntheorem for_lfp_des_unfold:\n assumes HB: \"body is H1\"\n assumes Hinit: \"incr is H1\" \n shows\n \"for\\<^sub>\\\\<^sub>D (init, exit, incr) do body od = \n init ;; (bif\\<^sub>D exit then (body;;incr;;while\\<^sub>\\\\<^sub>D exit do body ;; incr od) else SKIP\\<^sub>D eif)\"\n unfolding for_lfp_des_alt_def using while_lfp_des_unfold[of \"body ;; incr\" \"exit\", OF seq_is_H1[OF HB Hinit]] \n by (metis seqr_assoc) \n\nsubsection \\Iteration laws for normal designs\\\n \ntheorem from_until_gfp_ndes_alt_def:\n \"from\\<^sup>\\\\<^sup>N init until exit do body od = init ;; while\\<^sup>\\\\<^sup>N \\ exit do body od\"\n unfolding while_gfp_ndes_def_alt from_until_gfp_ndes_def \n by simp \n\nlemma from_until_while_gfp_ndes:\n \"from\\<^sup>\\\\<^sup>N SKIP\\<^sub>D until exit do body od = while\\<^sup>\\\\<^sup>N \\ exit do body od\"\n unfolding from_until_gfp_ndes_alt_def\n by (simp add: skip_left_unit_ndesign while_gfp_ndes_def_alt)\n \ntheorem from_until_gfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows \"from\\<^sup>\\\\<^sup>N init until exit do body od = \n init ;; (bif\\<^sub>D \\ exit then (body;; while\\<^sup>\\\\<^sup>N \\ exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding from_until_gfp_ndes_alt_def using while_gfp_ndes_unfold[OF HB]\n by simp\n \ntheorem from_until_lfp_ndes_alt_def:\n \"from\\<^sub>\\\\<^sub>N init until exit do body od = init ;; while\\<^sub>\\\\<^sub>N \\ exit do body od\"\n unfolding while_lfp_ndes_def_alt from_until_lfp_ndes_def \n by simp \n\nlemma from_until_while_lfp_ndes:\n \"from\\<^sub>\\\\<^sub>N SKIP\\<^sub>D until exit do body od = while\\<^sub>\\\\<^sub>N \\ exit do body od\"\n unfolding from_until_lfp_ndes_alt_def\n by (simp add: skip_left_unit_ndesign while_lfp_ndes_def_alt)\n \ntheorem from_until_lfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows \"from\\<^sub>\\\\<^sub>N init until exit do body od = \n init ;; (bif\\<^sub>D \\ exit then (body;; while\\<^sub>\\\\<^sub>N \\ exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding from_until_lfp_ndes_alt_def using while_lfp_ndes_unfold[OF HB]\n by simp\n\ntheorem do_while_gfp_ndes_alt_def:\n \"do body while\\<^sup>\\\\<^sup>N exit od = body ;; while\\<^sup>\\\\<^sup>N exit do body od\"\n unfolding do_while_gfp_ndes_def from_until_gfp_ndes_alt_def\n by simp \n \ntheorem do_while_gfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows \"do body while\\<^sup>\\\\<^sup>N exit od = \n body ;; (bif\\<^sub>D exit then (body;; while\\<^sup>\\\\<^sup>N exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding do_while_gfp_ndes_alt_def using while_gfp_ndes_unfold[OF HB]\n by simp\n\ntheorem do_while_lfp_ndes_alt_def:\n \"do body while\\<^sub>\\\\<^sub>N exit od = body ;; while\\<^sub>\\\\<^sub>N exit do body od\"\n unfolding do_while_lfp_ndes_def from_until_lfp_ndes_alt_def\n by simp \n \ntheorem do_while_lfp_ndes_unfold:\n assumes HB: \"body is H1\"\n shows \"do body while\\<^sub>\\\\<^sub>N exit od = \n body ;; (bif\\<^sub>D exit then (body;; while\\<^sub>\\\\<^sub>N exit do body od) else SKIP\\<^sub>D eif)\"\n unfolding do_while_lfp_ndes_alt_def using while_lfp_ndes_unfold[OF HB]\n by simp \n\ntheorem for_gfp_ndes_alt_def:\n \"for\\<^sup>\\\\<^sup>N (init, exit, incr) do body od = init ;; while\\<^sup>\\\\<^sup>N exit do body;;incr od\"\n unfolding for_gfp_ndes_def from_until_gfp_ndes_alt_def\n by simp \n \ntheorem for_gfp_ndes_unfold:\n assumes HB: \"body is H1\"\n assumes Hinit: \"incr is H1\" \n shows \"for\\<^sup>\\\\<^sup>N (init, exit, incr) do body od = \n init ;; (bif\\<^sub>D exit then (body;;incr;;while\\<^sup>\\\\<^sup>N exit do body ;; incr od) else SKIP\\<^sub>D eif)\"\n unfolding for_gfp_ndes_alt_def using while_gfp_ndes_unfold[of \"body ;; incr\" \"exit\", OF seq_is_H1[OF HB Hinit]] \n by (metis seqr_assoc)\n\ntheorem for_lfp_ndes_alt_def:\n \"for\\<^sub>\\\\<^sub>N (init, exit, incr) do body od = init ;; while\\<^sub>\\\\<^sub>N exit do body;;incr od\"\n unfolding for_lfp_ndes_def from_until_lfp_ndes_alt_def\n by simp \n \ntheorem for_lfp_ndes_unfold:\n assumes HB: \"body is H1\"\n assumes Hinit: \"incr is H1\" \n shows\n \"for\\<^sub>\\\\<^sub>N (init, exit, incr) do body od = \n init ;; (bif\\<^sub>D exit then (body;;incr;;while\\<^sub>\\\\<^sub>N exit do body ;; incr od) else SKIP\\<^sub>D eif)\"\n unfolding for_lfp_ndes_alt_def using while_lfp_ndes_unfold[of \"body ;; incr\" \"exit\", OF seq_is_H1[OF HB Hinit]] \n by (metis seqr_assoc) \n \nsubsection \\assume laws\\\n\nlemma assume_d_twice[udes_comp]: \"(b\\<^sup>\\\\<^sup>D;; c\\<^sup>\\\\<^sup>D) = (b \\ c)\\<^sup>\\\\<^sup>D\"\n apply pred_simp\n apply auto\n apply (rel_simp)\n apply blast\n apply (rel_simp)\n apply blast\ndone\n\nlemma assert_d_twice[udes_comp]: \"(b\\<^sub>\\\\<^sub>D;; c\\<^sub>\\\\<^sub>D) = (b \\ c)\\<^sub>\\\\<^sub>D\"\n apply pred_simp\n apply auto\n apply (rel_simp)+\n apply blast\n done\n \nsubsection \\Frame and antiframe\\\n \nlemma frame_d_is_H1_H3:\n assumes \"P is \\<^bold>N\" \n shows \"frame\\<^sub>D a P is \\<^bold>N\"\n using assms unfolding frame\\<^sub>D_def\n by rel_auto \n\nlemma antiframe_d_is_H1_H3:\n assumes \"P is \\<^bold>N\" \n shows \"antiframe\\<^sub>D a P is \\<^bold>N\"\n using assms unfolding frame\\<^sub>D_def\n by rel_auto \n \nlemma frame_d_assign_d_is_H4:\n \"frame\\<^sub>D a \\\\\\\\<^sub>D is H4\"\n unfolding frame\\<^sub>D_def \n by rel_auto\nend\n\n \n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/AlgebraicLaws/Algebraic_laws_design.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.5428632831725051, "lm_q1q2_score": 0.27355215814430095}} {"text": "section {* \\isaheader{Generic Map Algorithms} *}\ntheory Gen_Map\nimports \"../Intf/Intf_Map\" \"../../Iterator/Iterator\"\nbegin\n lemma map_to_set_distinct_conv:\n assumes \"distinct tsl'\" and \"map_to_set m' = set tsl'\"\n shows \"distinct (map fst tsl')\"\n apply (rule ccontr)\n apply (drule not_distinct_decomp)\n using assms\n apply (clarsimp elim!: map_eq_concE)\n by (metis (hide_lams, no_types) insert_iff map_to_set_inj)\n\n\n (* TODO: Make foldli explicit, such that it is seen by \n iterator-optimizations! cf Gen_Set for how to do this! *)\n lemma foldli_add: \"det_fold_map X \n (\\_. True) (\\(k,v) m. op_map_update k v m) m (op ++ m)\"\n proof (rule, goal_cases)\n case (1 l) thus ?case\n apply (induct l arbitrary: m) \n apply (auto simp: map_of_distinct_upd[symmetric])\n done\n qed\n\n definition gen_add\n :: \"('s2 \\ _) \\ ('k \\ 'v \\ 's1 \\ 's1) \\ 's1 \\ 's2 \\ 's1\"\n where \n \"gen_add it upd A B \\ it B (\\_. True) (\\(k,v) m. upd k v m) A\"\n\n lemma gen_add[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes UPD: \"GEN_OP ins op_map_update (Rk\\Rv\\\\Rk,Rv\\Rs1\\\\Rk,Rv\\Rs1)\"\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rs2 tsl)\"\n shows \"(gen_add (foldli o tsl) ins,op ++) \n \\ (\\Rk,Rv\\Rs1) \\ (\\Rk,Rv\\Rs2) \\ (\\Rk,Rv\\Rs1)\"\n apply (intro fun_relI)\n unfolding gen_add_def comp_def\n apply (rule det_fold_map[OF foldli_add IT[unfolded autoref_tag_defs]])\n apply (parametricity add: UPD[unfolded autoref_tag_defs])+\n done\n\n lemma foldli_restrict: \"det_fold_map X (\\_. True) \n (\\(k,v) m. if P (k,v) then op_map_update k v m else m) Map.empty\n (op_map_restrict P )\" (is \"det_fold_map _ _ ?f _ _\")\n proof -\n {\n fix l m\n have \"distinct (map fst l) \\\n foldli l (\\_. True) ?f m = m ++ op_map_restrict P (map_of l)\"\n proof (induction l arbitrary: m) \n case Nil thus ?case by simp\n next\n case (Cons kv l)\n obtain k v where [simp]: \"kv = (k,v)\" by fastforce\n from Cons.prems have \n DL: \"distinct (map fst l)\" and KNI: \"k \\ set (map fst l)\" \n by auto\n\n show ?case proof (cases \"P (k,v)\")\n case [simp]: True \n have \"foldli (kv#l) (\\_. True) ?f m = foldli l (\\_. True) ?f (m(k\\v))\"\n by simp\n also from Cons.IH[OF DL] have \n \"\\ = m(k\\v) ++ op_map_restrict P (map_of l)\" .\n also have \"\\ = m ++ op_map_restrict P (map_of (kv#l))\"\n using KNI\n by (auto\n split: option.splits\n intro!: ext \n simp: Map.restrict_map_def Map.map_add_def\n simp: map_of_eq_None_iff[symmetric])\n finally show ?thesis .\n next\n case [simp]: False \n have \"foldli (kv#l) (\\_. True) ?f m = foldli l (\\_. True) ?f m\"\n by simp\n also from Cons.IH[OF DL] have \n \"\\ = m ++ op_map_restrict P (map_of l)\" .\n also have \"\\ = m ++ op_map_restrict P (map_of (kv#l))\"\n using KNI\n by (auto \n intro!: ext\n simp: Map.restrict_map_def Map.map_add_def\n simp: map_of_eq_None_iff[symmetric]\n )\n finally show ?thesis .\n qed\n qed\n } \n from this[of _ Map.empty] show ?thesis\n by (auto intro!: det_fold_mapI)\n qed\n\n definition gen_restrict :: \"('s1 \\ _) \\ _\"\n where \"gen_restrict it upd emp P m \n \\ it m (\\_. True) (\\(k,v) m. if P (k,v) then upd k v m else m) emp\"\n\n lemma gen_restrict[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rs1 tsl)\"\n assumes INS: \n \"GEN_OP upd op_map_update (Rk\\Rv\\\\Rk,Rv\\Rs2\\\\Rk,Rv\\Rs2)\"\n assumes EMPTY: \n \"GEN_OP emp Map.empty (\\Rk,Rv\\Rs2)\"\n shows \"(gen_restrict (foldli o tsl) upd emp,op_map_restrict) \n \\ (\\Rk,Rv\\prod_rel \\ Id) \\ (\\Rk,Rv\\Rs1) \\ (\\Rk,Rv\\Rs2)\"\n apply (intro fun_relI)\n unfolding gen_restrict_def comp_def\n apply (rule det_fold_map[OF foldli_restrict IT[unfolded autoref_tag_defs]])\n using INS EMPTY unfolding autoref_tag_defs\n apply (parametricity)+\n done\n\n lemma fold_map_of: \n \"fold (\\(k,v) s. op_map_update k v s) (rev l) Map.empty = map_of l\"\n proof -\n {\n fix m\n have \"fold (\\(k,v) s. s(k\\v)) (rev l) m = m ++ map_of l\"\n apply (induct l arbitrary: m)\n apply auto\n done\n } thus ?thesis by simp\n qed\n\n definition gen_map_of :: \"'m \\ ('k\\'v\\'m\\'m) \\ _\" where \n \"gen_map_of emp upd l \\ fold (\\(k,v) s. upd k v s) (rev l) emp\"\n\n\n lemma gen_map_of[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes UPD: \"GEN_OP upd op_map_update (Rk\\Rv\\\\Rk,Rv\\Rm\\\\Rk,Rv\\Rm)\"\n assumes EMPTY: \"GEN_OP emp Map.empty (\\Rk,Rv\\Rm)\"\n shows \"(gen_map_of emp upd,map_of) \\ \\\\Rk,Rv\\prod_rel\\list_rel \\ \\Rk,Rv\\Rm\"\n using assms\n apply (intro fun_relI)\n unfolding gen_map_of_def[abs_def]\n unfolding autoref_tag_defs\n apply (subst fold_map_of[symmetric])\n apply parametricity\n done\n\n lemma foldli_ball_aux: \n \"distinct (map fst l) \\ foldli l (\\x. x) (\\x _. P x) b \n \\ b \\ op_map_ball (map_of l) P\"\n apply (induct l arbitrary: b)\n apply simp\n apply (force simp: map_to_set_map_of image_def)\n done\n \n lemma foldli_ball: \n \"det_fold_map X (\\x. x) (\\x _. P x) True (\\m. op_map_ball m P)\"\n apply rule\n using foldli_ball_aux[where b=True] by auto\n \n definition gen_ball :: \"('m \\ _) \\ _\" where\n \"gen_ball it m P \\ it m (\\x. x) (\\x _. P x) True\"\n\n lemma gen_ball[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_ball (foldli o tsl),op_map_ball) \n \\ \\Rk,Rv\\Rm \\ (\\Rk,Rv\\prod_rel \\ Id) \\ Id\"\n apply (intro fun_relI)\n unfolding gen_ball_def comp_def\n apply (rule det_fold_map[OF foldli_ball IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n\n lemma foldli_bex_aux: \n \"distinct (map fst l) \\ foldli l (\\x. \\x) (\\x _. P x) b \n \\ b \\ op_map_bex (map_of l) P\"\n apply (induct l arbitrary: b)\n apply simp\n apply (force simp: map_to_set_map_of image_def)\n done\n \n lemma foldli_bex: \n \"det_fold_map X (\\x. \\x) (\\x _. P x) False (\\m. op_map_bex m P)\"\n apply rule\n using foldli_bex_aux[where b=False] by auto\n\n definition gen_bex :: \"('m \\ _) \\ _\" where\n \"gen_bex it m P \\ it m (\\x. \\x) (\\x _. P x) False\"\n\n lemma gen_bex[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_bex (foldli o tsl),op_map_bex) \n \\ \\Rk,Rv\\Rm \\ (\\Rk,Rv\\prod_rel \\ Id) \\ Id\"\n apply (intro fun_relI)\n unfolding gen_bex_def comp_def\n apply (rule det_fold_map[OF foldli_bex IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n\n lemma ball_isEmpty: \"op_map_isEmpty m = op_map_ball m (\\_. False)\"\n apply (auto intro!: ext)\n by (metis map_to_set_simps(7) option.exhaust)\n\n definition \"gen_isEmpty ball m \\ ball m (\\_. False)\"\n\n lemma gen_isEmpty[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes BALL: \n \"GEN_OP ball op_map_ball (\\Rk,Rv\\Rm\\(\\Rk,Rv\\prod_rel\\Id) \\ Id)\"\n shows \"(gen_isEmpty ball,op_map_isEmpty) \n \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_isEmpty_def using assms\n unfolding autoref_tag_defs\n apply -\n apply (subst ball_isEmpty)\n apply parametricity+\n done\n \n lemma foldli_size_aux: \"distinct (map fst l) \n \\ foldli l (\\_. True) (\\_ n. Suc n) n = n + op_map_size (map_of l)\"\n apply (induct l arbitrary: n)\n apply (auto simp: dom_map_of_conv_image_fst)\n done\n\n lemma foldli_size: \"det_fold_map X (\\_. True) (\\_ n. Suc n) 0 op_map_size\"\n apply rule\n using foldli_size_aux[where n=0] by simp\n\n definition gen_size :: \"('m \\ _) \\ _\"\n where \"gen_size it m \\ it m (\\_. True) (\\_ n. Suc n) 0\"\n\n lemma gen_size[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_size (foldli o tsl),op_map_size) \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_size_def comp_def\n apply (rule det_fold_map[OF foldli_size IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n \n lemma foldli_size_abort_aux:\n \"\\n0\\m; distinct (map fst l)\\ \\ \n foldli l (\\n. n_ n. Suc n) n0 = min m (n0 + card (dom (map_of l)))\"\n apply (induct l arbitrary: n0)\n apply (auto simp: dom_map_of_conv_image_fst)\n done\n\n lemma foldli_size_abort: \n \"det_fold_map X (\\n. n_ n. Suc n) 0 (op_map_size_abort m)\"\n apply rule\n using foldli_size_abort_aux[where ?n0.0=0]\n by simp\n\n definition gen_size_abort :: \"('s \\ _) \\ _\" where\n \"gen_size_abort it m s \\ it s (\\n. n_ n. Suc n) 0\"\n\n lemma gen_size_abort[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm tsl)\"\n shows \"(gen_size_abort (foldli o tsl),op_map_size_abort) \n \\ Id \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_size_abort_def comp_def\n apply (rule det_fold_map[OF foldli_size_abort \n IT[unfolded autoref_tag_defs]])\n apply (parametricity)+\n done\n \n lemma size_abort_isSng: \"op_map_isSng s \\ op_map_size_abort 2 s = 1\"\n by (auto simp: dom_eq_singleton_conv min_def dest!: card_eq_SucD)\n\n definition gen_isSng :: \"(nat \\ 's \\ nat) \\ _\" where\n \"gen_isSng sizea s \\ sizea 2 s = 1\"\n\n lemma gen_isSng[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes \"GEN_OP sizea op_map_size_abort (Id \\ (\\Rk,Rv\\Rm) \\ Id)\"\n shows \"(gen_isSng sizea,op_map_isSng) \n \\ \\Rk,Rv\\Rm \\ Id\"\n apply (intro fun_relI)\n unfolding gen_isSng_def using assms\n unfolding autoref_tag_defs\n apply -\n apply (subst size_abort_isSng)\n apply parametricity\n done\n\n\n (* TODO: Also do sel! *)\n\n lemma foldli_pick:\n assumes \"l\\[]\" \n obtains k v where \"(k,v)\\set l\" \n and \"(foldli l (case_option True (\\_. False)) (\\x _. Some x) None) \n = Some (k,v)\"\n using assms by (cases l) auto\n\n definition gen_pick where\n \"gen_pick it s \\ \n (the (it s (case_option True (\\_. False)) (\\x _. Some x) None))\"\n\n\n\ncontext begin interpretation autoref_syn .\n\n lemma gen_pick[autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes IT: \"SIDE_GEN_ALGO (is_map_to_list Rk Rv Rm it)\"\n assumes NE: \"SIDE_PRECOND (m'\\Map.empty)\"\n assumes SREF: \"(m,m')\\\\Rk,Rv\\Rm\"\n shows \"(RETURN (gen_pick (\\x. foldli (it x)) m), \n (OP op_map_pick ::: \\Rk,Rv\\Rm\\\\Rk\\\\<^sub>rRv\\nres_rel)$m')\\\\Rk\\\\<^sub>rRv\\nres_rel\"\n proof -\n thm is_map_to_list_def is_map_to_sorted_listE\n\n obtain tsl' where\n [param]: \"(it m,tsl') \\ \\Rk\\\\<^sub>rRv\\list_rel\" \n and IT': \"RETURN tsl' \\ it_to_sorted_list (\\_ _. True) (map_to_set m')\"\n using IT[unfolded autoref_tag_defs is_map_to_list_def] SREF\n by (auto intro: is_map_to_sorted_listE)\n\n from IT' NE have \"tsl'\\[]\" and [simp]: \"m'=map_of tsl'\" \n and DIS': \"distinct (map fst tsl')\"\n unfolding it_to_sorted_list_def \n apply simp_all\n apply (metis empty_set map_to_set_empty_iff(1))\n apply (metis map_of_map_to_set map_to_set_distinct_conv)\n apply (metis map_to_set_distinct_conv)\n done\n\n then obtain k v where \"m' k = Some v\" and\n \"(foldli tsl' (case_option True (\\_. False)) (\\x _. Some x) None) \n = Some (k,v)\"\n (is \"?fld = _\")\n by (cases rule: foldli_pick) auto\n moreover \n have \"(RETURN (gen_pick (\\x. foldli (it x)) m), RETURN (the ?fld)) \n \\ \\Rk\\\\<^sub>rRv\\nres_rel\"\n unfolding gen_pick_def\n apply (parametricity add: the_paramR)\n using `?fld = Some (k,v)`\n by simp\n ultimately show ?thesis\n unfolding autoref_tag_defs\n apply -\n apply (drule nres_relD)\n apply (rule nres_relI)\n apply (erule ref_two_step)\n by simp\n qed\nend\n\n\n definition \"gen_map_pick_remove pick del m \\ do {\n (k,v)\\pick m;\n let m = del k m;\n RETURN ((k,v),m)\n }\"\n \ncontext begin interpretation autoref_syn .\n lemma gen_map_pick_remove\n [unfolded gen_map_pick_remove_def, autoref_rules_raw]:\n assumes PRIO_TAG_GEN_ALGO\n assumes PICK: \"SIDE_GEN_OP (\n (pick m, \n (OP op_map_pick ::: \\Rk,Rv\\Rm \\ \\Rk\\\\<^sub>rRv\\nres_rel)$m') \\\n \\Rk\\\\<^sub>rRv\\nres_rel)\"\n assumes DEL: \"GEN_OP del op_map_delete (Rk \\ \\Rk,Rv\\Rm \\ \\Rk,Rv\\Rm)\"\n assumes [param]: \"(m,m')\\\\Rk,Rv\\Rm\"\n shows \"(gen_map_pick_remove pick del m, \n (OP op_map_pick_remove \n ::: \\Rk,Rv\\Rm \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel)$m')\n \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel\"\n proof -\n note [param] = \n PICK[unfolded autoref_tag_defs] \n DEL[unfolded autoref_tag_defs]\n\n have \"(gen_map_pick_remove pick del m, \n do { \n (k,v)\\op_map_pick m';\n let m' = op_map_delete k m';\n RETURN ((k,v),m')\n }) \\ \\(Rk\\\\<^sub>rRv) \\\\<^sub>r \\Rk,Rv\\Rm\\nres_rel\" (is \"(_,?h):_\")\n unfolding gen_map_pick_remove_def[abs_def]\n apply parametricity\n done\n also have \"?h = op_map_pick_remove m'\"\n by (auto simp add: pw_eq_iff refine_pw_simps)\n finally show ?thesis by simp\n qed\nend\n\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/GenCF/Gen/Gen_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2735521581443009}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: AlternativeSmallStep.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Alternative Small Step Semantics *}\n\ntheory AlternativeSmallStep imports HoareTotalDef\nbegin\n\n\ntext {* \nThis is the small-step semantics, which is described and used in my PhD-thesis \\cite{Schirmer-PhD}. \nIt decomposes the statement into a list of statements and finally executes the head.\nSo the redex is always the head of the list. The equivalence between termination\n(based on the big-step semantics) and the absence of infinite computations in\nthis small-step semantics follows the same lines of reasoning as for\nthe new small-step semantics. However, it is technically more involved since\nthe configurations are more complicated. Thats why I switched to the new small-step\nsemantics in the \"main trunk\". I keep this alternative version and the important\nproofs in this theory, so that one can compare both approaches.\n*}\n\n\nsubsection {*Small-Step Computation: @{text \"\\\\(cs, css, s) \\ (cs', css', s')\"}*}\n\ntype_synonym ('s,'p,'f) continuation = \"('s,'p,'f) com list \\ ('s,'p,'f) com list\"\n \ntype_synonym ('s,'p,'f) config =\n \"('s,'p,'f)com list \\ ('s,'p,'f)continuation list \\ ('s,'f) xstate\"\n\n\n\ninductive \"step\"::\"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\/ _)\" [81,81,81] 100)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\\\(Skip#cs,css,Normal s) \\ (cs,css,Normal s)\"\n| Guard: \"s\\g \\ \\\\(Guard f g c#cs,css,Normal s) \\ (c#cs,css,Normal s)\"\n \n| GuardFault: \"s\\g \\ \\\\(Guard f g c#cs,css,Normal s) \\ (cs,css,Fault f)\"\n\n| FaultProp: \"\\\\(c#cs,css,Fault f) \\ (cs,css,Fault f)\" \n| FaultPropBlock: \"\\\\([],(nrms,abrs)#css,Fault f) \\ (nrms,css,Fault f)\"\n (* FaultPropBlock: \"\\\\([],cs#css,Fault) \\ ([],css,Fault)\"*)\n \n| AbruptProp: \"\\\\(c#cs,css,Abrupt s) \\ (cs,css,Abrupt s)\"\n \n| ExitBlockNormal: \n \"\\\\([],(nrms,abrs)#css,Normal s) \\ (nrms,css,Normal s)\"\n| ExitBlockAbrupt: \n \"\\\\([],(nrms,abrs)#css,Abrupt s) \\ (abrs,css,Normal s)\"\n\n| Basic: \"\\\\(Basic f#cs,css,Normal s) \\ (cs,css,Normal (f s))\"\n\n| Spec: \"(s,t) \\ r \\ \\\\(Spec r#cs,css,Normal s) \\ (cs,css,Normal t)\"\n| SpecStuck: \"\\t. (s,t) \\ r \\ \\\\(Spec r#cs,css,Normal s) \\ (cs,css,Stuck)\"\n\n| Seq: \"\\\\(Seq c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>1#c\\<^sub>2#cs,css,Normal s)\"\n\n| CondTrue: \"s\\b \\ \\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>1#cs,css,Normal s)\"\n| CondFalse: \"s\\b \\ \\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>2#cs,css,Normal s)\"\n\n| WhileTrue: \"\\s\\b\\ \n \\ \n \\\\(While b c#cs,css,Normal s) \\ (c#While b c#cs,css,Normal s)\"\n| WhileFalse: \"\\s\\b\\ \n \\ \n \\\\(While b c#cs,css,Normal s) \\ (cs,css,Normal s)\"\n\n| Call: \"\\ p=Some bdy \\\n \\\\(Call p#cs,css,Normal s) \\ ([bdy],(cs,Throw#cs)#css,Normal s)\"\n\n| CallUndefined: \"\\ p=None \\\n \\\\(Call p#cs,css,Normal s) \\ (cs,css,Stuck)\"\n\n| StuckProp: \"\\\\(c#cs,css,Stuck) \\ (cs,css,Stuck)\" \n| StuckPropBlock: \"\\\\([],(nrms,abrs)#css,Stuck) \\ (nrms,css,Stuck)\"\n\n| DynCom: \"\\\\(DynCom c#cs,css,Normal s) \\ (c s#cs,css,Normal s)\"\n\n| Throw: \"\\\\(Throw#cs,css,Normal s) \\ (cs,css,Abrupt s)\"\n| Catch: \"\\\\(Catch c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ ([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s)\"\n\nlemmas step_induct = step.induct [of _ \"(c,css,s)\" \"(c',css',s')\", split_format (complete), \ncase_names\nSkip Guard GuardFault FaultProp FaultPropBlock AbruptProp ExitBlockNormal ExitBlockAbrupt\nBasic Spec SpecStuck Seq CondTrue CondFalse WhileTrue WhileFalse Call CallUndefined\nStuckProp StuckPropBlock DynCom Throw Catch, induct set]\n\ninductive_cases step_elim_cases [cases set]:\n \"\\\\(c#cs,css,Fault f) \\ u\"\n \"\\\\([],css,Fault f) \\ u\"\n \"\\\\(c#cs,css,Stuck) \\ u\"\n \"\\\\([],css,Stuck) \\ u\"\n \"\\\\(c#cs,css,Abrupt s) \\ u\"\n \"\\\\([],css,Abrupt s) \\ u\"\n \"\\\\([],css,Normal s) \\ u\"\n \"\\\\(Skip#cs,css,s) \\ u\"\n \"\\\\(Guard f g c#cs,css,s) \\ u\"\n \"\\\\(Basic f#cs,css,s) \\ u\"\n \"\\\\(Spec r#cs,css,s) \\ u\"\n \"\\\\(Seq c1 c2#cs,css,s) \\ u\"\n \"\\\\(Cond b c1 c2#cs,css,s) \\ u\"\n \"\\\\(While b c#cs,css,s) \\ u\"\n \"\\\\(Call p#cs,css,s) \\ u\"\n \"\\\\(DynCom c#cs,css,s) \\ u\"\n \"\\\\(Throw#cs,css,s) \\ u\"\n \"\\\\(Catch c1 c2#cs,css,s) \\ u\"\n\ninductive_cases step_Normal_elim_cases [cases set]:\n \"\\\\(c#cs,css,Fault f) \\ u\"\n \"\\\\([],css,Fault f) \\ u\"\n \"\\\\(c#cs,css,Stuck) \\ u\"\n \"\\\\([],css,Stuck) \\ u\"\n \"\\\\([],(nrms,abrs)#css,Normal s) \\ u\"\n \"\\\\([],(nrms,abrs)#css,Abrupt s) \\ u\"\n \"\\\\(Skip#cs,css,Normal s) \\ u\"\n \"\\\\(Guard f g c#cs,css,Normal s) \\ u\"\n \"\\\\(Basic f#cs,css,Normal s) \\ u\"\n \"\\\\(Spec r#cs,css,Normal s) \\ u\"\n \"\\\\(Seq c1 c2#cs,css,Normal s) \\ u\"\n \"\\\\(Cond b c1 c2#cs,css,Normal s) \\ u\"\n \"\\\\(While b c#cs,css,Normal s) \\ u\"\n \"\\\\(Call p#cs,css,Normal s) \\ u\"\n \"\\\\(DynCom c#cs,css,Normal s) \\ u\"\n \"\\\\(Throw#cs,css,Normal s) \\ u\"\n \"\\\\(Catch c1 c2#cs,css,Normal s) \\ u\"\n\nabbreviation\n \"step_rtrancl\" :: \"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where\n \"\\\\cs0 \\\\<^sup>* cs1 == (step \\)\\<^sup>*\\<^sup>* cs0 cs1\"\n\nabbreviation\n\n \"step_trancl\" :: \"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\cs0 \\\\<^sup>+ cs1 == (step \\)\\<^sup>+\\<^sup>+ cs0 cs1\"\n\n\nsubsubsection {* Structural Properties of Small Step Computations *}\n\nlemma Fault_app_steps: \"\\\\(cs@xs,css,Fault f) \\\\<^sup>* (xs,css,Fault f)\"\nproof (induct cs)\n case Nil thus ?case by simp\nnext\n case (Cons c cs)\n have \"\\\\(c#cs@xs, css, Fault f) \\\\<^sup>* (xs, css, Fault f)\"\n proof -\n have \"\\\\(c#cs@xs, css, Fault f) \\ (cs@xs, css, Fault f)\"\n by (rule step.FaultProp)\n also \n have \"\\\\(cs@xs, css, Fault f) \\\\<^sup>* (xs, css, Fault f)\"\n by (rule Cons.hyps)\n finally show ?thesis .\n qed\n thus ?case\n by simp\nqed\n\nlemma Stuck_app_steps: \"\\\\(cs@xs,css,Stuck) \\\\<^sup>* (xs,css,Stuck)\"\nproof (induct cs)\n case Nil thus ?case by simp\nnext\n case (Cons c cs)\n have \"\\\\(c#cs@xs, css, Stuck) \\\\<^sup>* (xs, css, Stuck)\"\n proof -\n have \"\\\\(c#cs@xs, css, Stuck) \\ (cs@xs, css, Stuck)\"\n by (rule step.StuckProp)\n also \n have \"\\\\(cs@xs, css, Stuck) \\\\<^sup>* (xs, css, Stuck)\"\n by (rule Cons.hyps)\n finally show ?thesis .\n qed\n thus ?case\n by simp\nqed\n\ntext {* We can only append commands inside a block, if execution does not\n enter or exit a block.\n *}\nlemma app_step: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\"\n shows \"css=css' \\ \\\\(cs@xs,css,s) \\ (cs'@xs,css',t)\"\nusing step\napply induct\napply (simp_all del: fun_upd_apply,(blast intro: step.intros)+)\ndone\n\ntext {* We can append whole blocks, without interfering with the actual\n block. Outer blocks do not influence execution of\n inner blocks. *}\nlemma app_css_step: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\"\n shows \"\\\\(cs,css@xs,s) \\ (cs',css'@xs,t)\"\nusing step\napply induct\napply (simp_all del: fun_upd_apply,(blast intro: step.intros)+)\ndone\n\nML {*\n ML_Thms.bind_thm (\"trancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context} [((\"a\", 0), \"(ax,ay,az)\"), ((\"b\", 0), \"(bx,by,bz)\")] []\n @{thm tranclp_induct}));\n*}\n\nlemma app_css_steps: \n assumes step: \"\\\\(cs,css,s) \\\\<^sup>+ (cs',css',t)\"\n shows \"\\\\(cs,css@xs,s) \\\\<^sup>+ (cs',css'@xs,t)\"\napply(rule trancl_induct3 [OF step])\n apply (rule app_css_step [THEN tranclp.r_into_trancl [of \"step \\\"]],assumption)\napply(blast intro:app_css_step tranclp_trans)\ndone\n\nlemma step_Cons': \n assumes step: \"\\\\(ccs,css,s) \\ (cs',css',t)\"\n shows\n \"\\c cs. ccs=c#cs \\ \\css''. css'=css''@css \\\n (if css''=[] then \\p. cs'=p@cs\n else (\\pnorm pabr. css''=[(pnorm@cs,pabr@cs)]))\"\nusing step\nby induct force+\n\nlemma step_Cons: \n assumes step: \"\\\\(c#cs,css,s) \\ (cs',css',t)\"\n shows \"\\pcss. css'=pcss@css \\\n (if pcss=[] then \\ps. cs'=ps@cs\n else (\\pcs_normal pcs_abrupt. pcss=[(pcs_normal@cs,pcs_abrupt@cs)]))\"\nusing step_Cons' [OF step]\nby blast \n\n\nlemma step_Nil': \n assumes step: \"\\\\(cs,asscss,s) \\ (cs',css',t)\"\n shows\n \"\\ass. \\cs=[]; asscss=ass@css; ass\\Nil\\ \\ \n css'=tl ass@css \\\n (case s of \n Abrupt s' \\ cs'=snd (hd ass) \\ t=Normal s'\n | _ \\ cs'=fst (hd ass) \\ t=s)\"\nusing step\nby (induct) (fastforce simp add: neq_Nil_conv)+\n\nlemma step_Nil: \n assumes step: \"\\\\([],ass@css,s) \\ (cs',css',t)\"\n assumes ass_not_Nil: \"ass\\[]\"\n shows \"css'=tl ass@css \\\n (case s of \n Abrupt s' \\ cs'=snd (hd ass) \\ t=Normal s'\n | _ \\ cs'=fst (hd ass) \\ t=s)\"\n using step_Nil' [OF step _ _ ass_not_Nil]\n by simp\n\nlemma step_Nil'': \n assumes step: \"\\\\([],(pcs_normal,pcs_abrupt)#pcss@css,s) \\ (cs',pcss@css,t)\"\n shows \"(case s of \n Abrupt s' \\ cs'=pcs_abrupt \\ t=Normal s'\n | _ \\ cs'=pcs_normal \\ t=s)\"\n using step_Nil' [OF step, where ass =\"(pcs_normal,pcs_abrupt)#pcss\" and css=\"css\"]\n by (auto split: xstate.splits)\n\nlemma drop_suffix_css_step':\nassumes step: \"\\\\(cs,cssxs,s) \\ (cs',css'xs,t)\"\nshows \"\\css css' xs. \\cssxs = css@xs; css'xs=css'@xs\\ \n \\ \\\\(cs,css,s) \\ (cs',css',t)\"\nusing step\napply induct\napply (fastforce intro: step.intros)+\ndone\n\nlemma drop_suffix_css_step:\nassumes step: \"\\\\(cs,pcss@css,s) \\ (cs',pcss'@css,t)\"\nshows \"\\\\(cs,pcss,s) \\ (cs',pcss',t)\"\nusing step by (blast intro: drop_suffix_css_step')\n\nlemma drop_suffix_hd_css_step': \n assumes step: \"\\\\ (pcs,css,s) \\ (cs',css'css,t)\"\n shows \"\\p ps cs pnorm pabr. \\pcs=p#ps@cs; css'css=(pnorm@cs,pabr@cs)#css\\ \n \\ \\\\ (p#ps,css,s) \\ (cs',(pnorm,pabr)#css,t)\"\nusing step\nby induct (force intro: step.intros)+\n\nlemma drop_suffix_hd_css_step'': \n assumes step: \"\\\\ (p#ps@cs,css,s) \\ (cs',(pnorm@cs,pabr@cs)#css,t)\"\n shows \"\\\\ (p#ps,css,s) \\ (cs',(pnorm,pabr)#css,t)\"\nusing drop_suffix_hd_css_step' [OF step]\nby auto\n\nlemma drop_suffix_hd_css_step: \n assumes step: \"\\\\ (p#ps@cs,css,s) \\ (cs',[(pnorm@ps@cs,pabr@ps@cs)]@css,t)\"\n shows \"\\\\ (p#ps,css,s) \\ (cs',[(pnorm@ps,pabr@ps)]@css,t)\"\nproof -\n from step drop_suffix_hd_css_step'' [of _ p ps cs css s cs' \"pnorm@ps\" \"pabr@ps\" t]\n show ?thesis\n by auto\nqed\n\nlemma drop_suffix': \n assumes step: \"\\\\(csxs,css,s) \\ (cs'xs,css',t)\"\n shows \"\\xs cs cs'. \\css=css'; csxs=cs@xs; cs'xs = cs'@xs; cs\\[] \\ \n \\ \\\\(cs,css,s) \\ (cs',css,t)\"\nusing step\napply induct\napply (fastforce intro: step.intros simp add: neq_Nil_conv)+\ndone\n\nlemma drop_suffix: \n assumes step: \"\\\\(c#cs@xs,css,s) \\ (cs'@xs,css,t)\" \n shows \"\\\\(c#cs,css,s) \\ (cs',css,t)\"\n by(rule drop_suffix' [OF step _ _ _]) auto\n\nlemma drop_suffix_same_css_step: \n assumes step: \"\\\\(cs@xs,css,s) \\ (cs'@xs,css,t)\" \n assumes not_Nil: \"cs\\[]\"\n shows \"\\\\(cs,xss,s) \\ (cs',xss,t)\"\nproof-\n from drop_suffix' [OF step _ _ _ not_Nil]\n have \"\\\\(cs,css,s) \\ (cs',css,t)\"\n by auto\n with drop_suffix_css_step [of _ cs \"[]\" css s cs' \"[]\" t]\n have \"\\\\ (cs, [], s) \\ (cs', [], t)\"\n by auto\n from app_css_step [OF this]\n show ?thesis\n by auto\nqed\n \nlemma Cons_change_css_step:\n assumes step: \"\\\\ (cs,css,s) \\ (cs',css'@css,t)\"\n shows \"\\\\ (cs,xss,s) \\ (cs',css'@xss,t)\"\nproof -\n from step\n drop_suffix_css_step [where cs=cs and pcss=\"[]\" and css=css and s=s\n and cs'=cs' and pcss'=css' and t=t]\n have \"\\\\ (cs, [], s) \\ (cs', css', t)\"\n by auto\n from app_css_step [where xs=xss, OF this]\n show ?thesis\n by auto\nqed\n\nlemma Nil_change_css_step:\n assumes step: \"\\\\([],ass@css,s) \\ (cs',ass'@css,t)\"\n assumes ass_not_Nil: \"ass\\[]\"\n shows \"\\\\([],ass@xss,s) \\ (cs',ass'@xss,t)\"\nproof -\n from step drop_suffix_css_step [of _ \"[]\" ass css s cs' ass' t]\n have \"\\\\ ([], ass, s) \\ (cs', ass', t)\"\n by auto\n from app_css_step [where xs=xss, OF this]\n show ?thesis\n by auto\nqed\n\nsubsubsection {* Equivalence between Big and Small-Step Semantics *}\n \nlemma exec_impl_steps:\n assumes exec: \"\\\\\\c,s\\ \\ t\"\n shows \"\\cs css. \\\\(c#cs,css,s) \\\\<^sup>* (cs,css,t)\"\nusing exec\nproof (induct)\n case Skip thus ?case by (blast intro: step.Skip)\nnext\n case Guard thus ?case by (blast intro: step.Guard rtranclp_trans)\nnext\n case GuardFault thus ?case by (blast intro: step.GuardFault)\nnext\n case FaultProp thus ?case by (blast intro: step.FaultProp)\nnext\n case Basic thus ?case by (blast intro: step.Basic)\nnext\n case Spec thus ?case by (blast intro: step.Spec)\nnext\n case SpecStuck thus ?case by (blast intro: step.SpecStuck)\nnext\n case Seq thus ?case by (blast intro: step.Seq rtranclp_trans)\nnext\n case CondTrue thus ?case by (blast intro: step.CondTrue rtranclp_trans)\nnext\n case CondFalse thus ?case by (blast intro: step.CondFalse rtranclp_trans)\nnext\n case WhileTrue thus ?case by (blast intro: step.WhileTrue rtranclp_trans)\nnext\n case WhileFalse thus ?case by (blast intro: step.WhileFalse)\nnext\n case (Call p bdy s s' cs css)\n have bdy: \"\\ p = Some bdy\" by fact\n have steps_body: \"\\\\([bdy],(cs,Throw#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,Throw#cs)#css, s')\" by fact\n show ?case\n proof (cases s')\n case (Normal s'')\n note steps_body\n also from Normal have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n next\n case (Abrupt s'')\n with steps_body \n have \"\\\\([bdy],(cs,Throw#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,Throw#cs)#css, Abrupt s'')\" by simp\n also have \"\\\\([],(cs,Throw#cs)#css, Abrupt s'') \\ (Throw#cs,css,Normal s'')\"\n by (rule ExitBlockAbrupt)\n also have \"\\\\(Throw#cs,css,Normal s'') \\ (cs,css,Abrupt s'')\"\n by (rule Throw)\n finally show ?thesis\n using bdy Abrupt\n by (auto intro: step.Call rtranclp_trans)\n next\n case Fault\n note steps_body\n also from Fault have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n next\n case Stuck\n note steps_body\n also from Stuck have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n qed\nnext\n case (CallUndefined p s cs css)\n have undef: \"\\ p = None\" by fact\n hence \"\\\\(Call p # cs, css, Normal s) \\ (cs, css, Stuck)\"\n by (rule step.CallUndefined)\n thus ?case ..\nnext\n case StuckProp thus ?case by (blast intro: step.StuckProp rtrancl_trans)\nnext\n case DynCom thus ?case by (blast intro: step.DynCom rtranclp_trans)\nnext\n case Throw thus ?case by (blast intro: step.Throw)\nnext\n case AbruptProp thus ?case by (blast intro: step.AbruptProp)\nnext\n case (CatchMatch c\\<^sub>1 s s' c\\<^sub>2 s'' cs css) \n have steps_c1: \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,c\\<^sub>2#cs)#css,Abrupt s')\" by fact\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Abrupt s') \\ (c\\<^sub>2#cs,css,Normal s')\"\n by (rule ExitBlockAbrupt)\n also \n have steps_c2: \"\\\\(c\\<^sub>2#cs,css,Normal s') \\\\<^sup>* (cs,css,s'')\" by fact\n finally\n show \"\\\\(Catch c\\<^sub>1 c\\<^sub>2 # cs, css, Normal s) \\\\<^sup>* (cs, css, s'')\"\n by (blast intro: step.Catch rtranclp_trans)\nnext\n case (CatchMiss c\\<^sub>1 s s' c\\<^sub>2 cs css) \n assume notAbr: \"\\ isAbr s'\"\n have steps_c1: \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,s')\" by fact\n show \"\\\\(Catch c\\<^sub>1 c\\<^sub>2 # cs, css, Normal s) \\\\<^sup>* (cs, css, s')\"\n proof (cases s')\n case (Normal w)\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Normal w)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Normal w) \\ (cs,css,Normal w)\"\n by (rule ExitBlockNormal)\n finally show ?thesis using Normal\n by (auto intro: step.Catch rtranclp_trans)\n next\n case Abrupt with notAbr show ?thesis by simp\n next\n case (Fault f)\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Fault f)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Fault f) \\ (cs,css,Fault f)\"\n by (rule FaultPropBlock)\n finally show ?thesis using Fault\n by (auto intro: step.Catch rtranclp_trans)\n next\n case Stuck\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Stuck)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Stuck) \\ (cs,css,Stuck)\"\n by (rule StuckPropBlock)\n finally show ?thesis using Stuck\n by (auto intro: step.Catch rtranclp_trans)\n qed\nqed\n\n\ninductive \"execs\"::\"[('s,'p,'f) body,('s,'p,'f) com list,\n ('s,'p,'f) continuation list,\n ('s,'f) xstate,('s,'f) xstate] \\ bool\"\n (\"_\\ \\_,_,_\\ \\ _\" [50,50,50,50,50] 50)\n for \\:: \"('s,'p,'f) body\"\nwhere\n Nil: \"\\\\\\[],[],s\\ \\ s\"\n\n| ExitBlockNormal: \"\\\\\\nrms,css,Normal s\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Normal s\\ \\ t\"\n\n| ExitBlockAbrupt: \"\\\\\\abrs,css,Normal s\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Abrupt s\\ \\ t\"\n\n| ExitBlockFault: \"\\\\\\nrms,css,Fault f\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Fault f\\ \\ t\"\n\n| ExitBlockStuck: \"\\\\\\nrms,css,Stuck\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Stuck\\ \\ t\"\n\n| Cons: \"\\\\\\\\c,s\\ \\ t; \\\\\\cs,css,t\\ \\ u\\ \n \\ \n \\\\\\c#cs,css,s\\ \\ u\"\n\n\ninductive_cases execs_elim_cases [cases set]:\n \"\\\\\\[],css,s\\ \\ t\"\n \"\\\\\\c#cs,css,s\\ \\ t\"\n\nML {*\n ML_Thms.bind_thm (\"converse_rtrancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context} [((\"a\", 0), \"(cs,css,s)\"), ((\"b\", 0), \"(cs',css',t)\")] []\n @{thm converse_rtranclp_induct}));\n*}\n\nlemma execs_Fault_end: \n assumes execs: \"\\\\\\cs,css,s\\ \\ t\" shows \"s=Fault f\\ t=Fault f\"\n using execs\n by (induct) (auto dest: Fault_end)\n\nlemma execs_Stuck_end: \n assumes execs: \"\\\\\\cs,css,s\\ \\ t\" shows \"s=Stuck \\ t=Stuck\"\n using execs\n by (induct) (auto dest: Stuck_end)\n\n\ntheorem steps_impl_execs: \n assumes steps: \"\\\\(cs,css,s) \\\\<^sup>* ([],[],t)\" \n shows \"\\\\\\cs,css,s\\ \\ t\"\nusing steps\nproof (induct rule: converse_rtrancl_induct3 [consumes 1])\n show \"\\\\\\[],[],t\\ \\ t\" by (rule execs.Nil)\nnext\n fix cs css s cs' css' w\n assume step: \"\\\\(cs,css, s) \\ (cs',css', w)\" \n assume execs: \"\\\\\\cs',css',w\\ \\ t\"\n from step \n show \"\\\\\\cs,css,s\\ \\ t\"\n proof (cases)\n case (Catch c1 c2 cs s)\n with execs obtain t' where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ t'\" and\n execs_rest: \"\\\\\\[],(cs, c2 # cs) # css,t'\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n have \"\\\\\\Catch c1 c2 # cs,css,Normal s\\ \\ t\"\n proof (cases t')\n case (Normal t'')\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ t'\"\n by (auto intro: exec.CatchMiss)\n moreover\n from execs_rest Normal have \"\\\\\\cs,css,t'\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n next\n case (Abrupt t'')\n from execs_rest Abrupt have \"\\\\\\c2#cs,css,Normal t''\\ \\ t\"\n by (cases) auto\n then obtain v where\n exec_c2: \"\\\\\\c2,Normal t''\\ \\ v\" and\n rest: \"\\\\\\cs,css,v\\ \\ t\"\n by cases\n from exec_c1 Abrupt exec_c2\n have \"\\\\\\Catch c1 c2,Normal s\\ \\ v\"\n by - (rule exec.CatchMatch, auto)\n from this rest\n show ?thesis\n by (rule execs.Cons)\n next\n case (Fault f)\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ Fault f\"\n by (auto intro: exec.intros)\n moreover from execs_rest Fault have \"\\\\\\cs,css,Fault f\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n next\n case Stuck\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ Stuck\"\n by (auto intro: exec.intros)\n moreover from execs_rest Stuck have \"\\\\\\cs,css,Stuck\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n qed\n with Catch show ?thesis by simp\n next\n case (Call p bdy cs s)\n have bdy: \"\\ p = Some bdy\" by fact\n from Call execs obtain t' where\n exec_body: \"\\\\\\bdy,Normal s\\ \\ t'\" and\n execs_rest: \n \"\\\\\\[],(cs,Throw#cs)#css ,t'\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n have \"\\\\\\Call p # cs,css,Normal s\\ \\ t\"\n proof (cases t')\n case (Normal t'')\n with exec_body bdy\n have \"\\\\\\Call p ,Normal s\\ \\ Normal t''\" \n by (auto intro: exec.intros)\n moreover\n from execs_rest Normal\n have \"\\\\\\cs,css ,Normal t''\\ \\ t\" \n by cases auto\n ultimately show ?thesis by (rule execs.Cons)\n next\n case (Abrupt t'')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Abrupt t''\"\n by (auto intro: exec.intros)\n moreover\n from execs_rest Abrupt have \n \"\\\\\\Throw # cs,css,Normal t''\\ \\ t\"\n by (cases) auto\n then obtain v where \n \"\\\\\\Throw,Normal t''\\ \\ v\" and \n rest: \"\\\\\\cs,css,v\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n moreover from this have \"v=Abrupt t''\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately \n show ?thesis by (auto intro: execs.Cons)\n next\n case (Fault f)\n with exec_body bdy have \"\\\\\\Call p,Normal s\\ \\ Fault f\"\n by (auto intro: exec.intros)\n moreover from execs_rest Fault have \"\\\\\\cs,css,Fault f\\ \\ t\"\n by (cases) (auto elim: execs_elim_cases dest: Fault_end)\n ultimately \n show ?thesis by (rule execs.Cons)\n next\n case Stuck\n with exec_body bdy have \"\\\\\\Call p,Normal s\\ \\ Stuck\"\n by (auto intro: exec.intros)\n moreover from execs_rest Stuck have \"\\\\\\cs,css,Stuck\\ \\ t\"\n by (cases) (auto elim: execs_elim_cases dest: Stuck_end)\n ultimately \n show ?thesis by (rule execs.Cons)\n qed \n with Call show ?thesis by simp\n qed (insert execs,\n (blast intro:execs.intros exec.intros elim!: execs_elim_cases)+)\nqed\n\ntheorem steps_impl_exec: \n assumes steps: \"\\\\([c],[],s) \\\\<^sup>* ([],[],t)\" \n shows \"\\\\\\c,s\\ \\ t\"\nusing steps_impl_execs [OF steps]\nby (blast elim: execs_elim_cases)\n\ncorollary steps_eq_exec: \"\\\\([c],[],s) \\\\<^sup>* ([],[],t) = \\\\\\c,s\\ \\ t\"\n by (blast intro: steps_impl_exec exec_impl_steps)\n\n\nsubsection {* Infinite Computations: @{text \"inf \\ cs css s\"}*}\n\ndefinition inf :: \n \"[('s,'p,'f) body,('s,'p,'f) com list,('s,'p,'f) continuation list,('s,'f) xstate]\n \\ bool\"\nwhere \"inf \\ cs css s = (\\f. f 0 = (cs,css,s) \\ (\\i. \\\\f i \\ f(Suc i)))\"\n\nlemma not_infI: \"\\\\f. \\f 0 = (cs,css,s); \\i. \\\\f i \\ f (Suc i)\\ \\ False\\ \n \\ \\inf \\ cs css s\"\n by (auto simp add: inf_def)\n\nsubsection {* Equivalence of Termination and Absence of Infinite Computations *}\n\n\ninductive \"terminatess\":: \"[('s,'p,'f) body,('s,'p,'f) com list,\n ('s,'p,'f) continuation list,('s,'f) xstate] \\ bool\" \n (\"_\\_,_ \\ _\" [60,20,60] 89)\n for \\::\"('s,'p,'f) body\"\nwhere\n Nil: \"\\\\[],[]\\s\"\n\n| ExitBlockNormal: \"\\\\nrms,css\\Normal s\n \\ \n \\\\[],(nrms,abrs)#css\\Normal s\"\n\n| ExitBlockAbrupt: \"\\\\abrs,css\\Normal s\n \\ \n \\\\[],(nrms,abrs)#css\\Abrupt s\"\n\n| ExitBlockFault: \"\\\\nrms,css\\Fault f\n \\ \n \\\\[],(nrms,abrs)#css\\Fault f\"\n\n| ExitBlockStuck: \"\\\\nrms,css\\Stuck\n \\ \n \\\\[],(nrms,abrs)#css\\Stuck\"\n\n\n| Cons: \"\\\\\\c\\s; (\\t. \\\\\\c,s\\ \\ t \\ \\\\cs,css\\t)\\\n \\ \n \\\\c#cs,css\\s\"\n \ninductive_cases terminatess_elim_cases [cases set]:\n \"\\\\[],css\\t\"\n \"\\\\c#cs,css\\t\"\n\nlemma terminatess_Fault: \"\\cs. \\\\cs,css\\Fault f\"\nproof (induct css)\n case Nil\n show \"\\\\cs,[]\\Fault f\"\n proof (induct cs)\n case Nil show \"\\\\[],[]\\Fault f\" by (rule terminatess.Nil)\n next\n case (Cons c cs)\n thus ?case\n by (auto intro: terminatess.intros terminates.intros dest: Fault_end)\n qed\nnext\n case (Cons d css)\n have hyp: \"\\cs. \\\\cs,css\\Fault f\" by fact\n obtain nrms abrs where d: \"d=(nrms,abrs)\" by (cases d) auto\n have \"\\\\cs,(nrms,abrs)#css\\Fault f\"\n proof (induct cs)\n case Nil\n show \"\\\\[],(nrms, abrs) # css\\Fault f\"\n by (rule terminatess.ExitBlockFault) (rule hyp)\n next\n case (Cons c cs)\n have hyp1: \"\\\\cs,(nrms, abrs) # css\\Fault f\" by fact\n show \"\\\\c#cs,(nrms, abrs)#css\\Fault f\"\n by (auto intro: hyp1 terminatess.Cons terminates.intros dest: Fault_end)\n qed\n with d show ?case by simp\nqed\n\nlemma terminatess_Stuck: \"\\cs. \\\\cs,css\\Stuck\"\nproof (induct css)\n case Nil\n show \"\\\\cs,[]\\Stuck\"\n proof (induct cs)\n case Nil show \"\\\\[],[]\\Stuck\" by (rule terminatess.Nil)\n next\n case (Cons c cs)\n thus ?case\n by (auto intro: terminatess.intros terminates.intros dest: Stuck_end)\n qed\nnext\n case (Cons d css)\n have hyp: \"\\cs. \\\\cs,css\\Stuck\" by fact\n obtain nrms abrs where d: \"d=(nrms,abrs)\" by (cases d) auto\n have \"\\\\cs,(nrms,abrs)#css\\Stuck\"\n proof (induct cs)\n case Nil\n show \"\\\\[],(nrms, abrs) # css\\Stuck\"\n by (rule terminatess.ExitBlockStuck) (rule hyp)\n next\n case (Cons c cs)\n have hyp1: \"\\\\cs,(nrms, abrs) # css\\Stuck\" by fact\n show \"\\\\c#cs,(nrms, abrs)#css\\Stuck\"\n by (auto intro: hyp1 terminatess.Cons terminates.intros dest: Stuck_end)\n qed\n with d show ?case by simp\nqed\n\n\nlemma Basic_terminates: \"\\\\Basic f \\ t\"\n by (cases t) (auto intro: terminates.intros)\n\nlemma step_preserves_terminations: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\" \n shows \"\\\\cs,css\\s \\ \\\\cs',css'\\t\"\nusing step\nproof (induct)\n case Skip thus ?case\n by (auto elim: terminates_Normal_elim_cases terminatess_elim_cases\n intro: exec.intros)\nnext\n case Guard thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case GuardFault thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case FaultProp show ?case by (rule terminatess_Fault)\nnext\n case FaultPropBlock show ?case by (rule terminatess_Fault)\nnext\n case AbruptProp thus ?case\n by (blast elim: terminatess_elim_cases \n intro: terminatess.intros)\nnext\n case ExitBlockNormal thus ?case\n by (blast elim: terminatess_elim_cases\n intro: terminatess.intros )\nnext\n case ExitBlockAbrupt thus ?case\n by (blast elim: terminatess_elim_cases\n intro: terminatess.intros )\nnext\n case Basic thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Spec thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case SpecStuck thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Seq thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case CondTrue thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case CondFalse thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case WhileTrue thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case WhileFalse thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case (Call p bdy cs css s)\n have bdy: \"\\ p = Some bdy\" by fact\n from Call obtain \n term_body: \"\\\\bdy \\ Normal s\" and\n term_rest: \"\\t. \\\\\\Call p,Normal s\\ \\ t \\ \\\\cs,css\\t\"\n by (fastforce elim!: terminatess_elim_cases terminates_Normal_elim_cases)\n show \"\\\\[bdy],(cs,Throw # cs)#css\\Normal s\"\n proof (rule terminatess.Cons [OF term_body],clarsimp)\n fix t\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n show \"\\\\[],(cs,Throw # cs) # css\\t\"\n proof (cases t)\n case (Normal t')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Normal t'\"\n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\Normal t'\"\n by iprover\n with Normal show ?thesis\n by (auto intro: terminatess.intros terminates.intros\n elim: exec_Normal_elim_cases)\n next\n case (Abrupt t')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Abrupt t'\"\n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\Abrupt t'\"\n by iprover\n with Abrupt show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: exec_Normal_elim_cases)\n next\n case Fault\n thus ?thesis\n by (iprover intro: terminatess_Fault)\n next\n case Stuck\n thus ?thesis\n by (iprover intro: terminatess_Stuck)\n qed\n qed\nnext\n case CallUndefined thus ?case\n by (iprover intro: terminatess_Stuck)\nnext\n case StuckProp show ?case by (rule terminatess_Stuck)\nnext\n case StuckPropBlock show ?case by (rule terminatess_Stuck)\nnext\n case DynCom thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Throw thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case (Catch c1 c2 cs css s) \n then obtain \n term_c1: \"\\\\c1 \\ Normal s\" and\n term_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ Abrupt s' \\ \\\\c2 \\ Normal s'\"and\n term_rest: \"\\t. \\\\\\Catch c1 c2,Normal s\\ \\ t \\ \\\\cs,css\\t\"\n by (clarsimp elim!: terminatess_elim_cases terminates_Normal_elim_cases)\n show \"\\\\[c1],(cs, c2 # cs) # css\\Normal s\"\n proof (rule terminatess.Cons [OF term_c1],clarsimp)\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s\\ \\ t\" \n show \"\\\\[],(cs, c2 # cs) # css\\t\"\n proof (cases t)\n case (Normal t')\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ t\" \n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\t\"\n by iprover\n with Normal show ?thesis\n by (iprover intro: terminatess.intros)\n next\n case (Abrupt t')\n with exec_c1 term_c2 have \"\\\\c2 \\ Normal t'\"\n by auto\n moreover\n {\n fix w\n assume exec_c2: \"\\\\\\c2,Normal t'\\ \\ w\" \n have \"\\\\cs,css\\w\" \n proof -\n from exec_c1 Abrupt exec_c2\n have \"\\\\\\Catch c1 c2,Normal s\\ \\ w\"\n by (auto intro: exec.intros)\n with term_rest show ?thesis by simp\n qed\n }\n ultimately\n show ?thesis using Abrupt\n by (auto intro: terminatess.intros)\n next\n case Fault thus ?thesis\n by (iprover intro: terminatess_Fault)\n next\n case Stuck thus ?thesis\n by (iprover intro: terminatess_Stuck)\n qed\n qed\nqed\n\n\nML {*\n ML_Thms.bind_thm (\"rtrancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context} [((\"a\", 0), \"(ax,ay,az)\"), ((\"b\", 0), \"(bx,by,bz)\")] []\n @{thm rtranclp_induct}));\n*}\n\nlemma steps_preserves_terminations: \n assumes steps: \"\\\\(cs,css,s) \\\\<^sup>* (cs',css',t)\" \n shows \"\\\\cs,css\\s \\ \\\\cs',css'\\t\"\nusing steps\nproof (induct rule: rtrancl_induct3 [consumes 1])\n assume \"\\\\cs,css\\s\" then show \"\\\\cs,css\\s\". \nnext\n fix cs'' css'' w cs' css' t\n assume \"\\\\(cs'',css'', w) \\ (cs',css', t)\" \"\\\\cs,css\\s \\ \\\\cs'',css''\\w\"\n \"\\\\cs,css\\s\"\n then show \"\\\\cs',css'\\t\"\n by (blast dest: step_preserves_terminations)\nqed\n\ntheorem steps_preserves_termination: \n assumes steps: \"\\\\([c],[],s) \\\\<^sup>* (c'#cs',css',t)\" \n assumes term_c: \"\\\\c\\s\" \n shows \"\\\\c'\\t\"\nproof -\n from term_c have \"\\\\[c],[]\\s\"\n by (auto intro: terminatess.intros)\n from steps this\n have \"\\\\c'#cs',css'\\t\"\n by (rule steps_preserves_terminations)\n thus \"\\\\c'\\t\"\n by (auto elim: terminatess_elim_cases)\nqed\n\n\n\n\n\nlemma renumber':\n assumes f: \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r\" \n assumes a_b: \"(a,b) \\ r\\<^sup>*\" \n shows \"b = f 0 \\ (\\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r))\"\nusing a_b\nproof (induct rule: converse_rtrancl_induct [consumes 1])\n assume \"b = f 0\"\n with f show \"\\f. f 0 = b \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by blast\nnext\n fix a z\n assume a_z: \"(a, z) \\ r\" and \"(z, b) \\ r\\<^sup>*\" \n assume \"b = f 0 \\ \\f. f 0 = z \\ (\\i. (f i, f (Suc i)) \\ r)\"\n \"b = f 0\"\n then obtain f where f0: \"f 0 = z\" and seq: \"\\i. (f i, f (Suc i)) \\ r\"\n by iprover\n {\n fix i have \"((\\i. case i of 0 \\ a | Suc i \\ f i) i, f i) \\ r\"\n using seq a_z f0\n by (cases i) auto\n }\n then\n show \"\\f. f 0 = a \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by - (rule exI [where x=\"\\i. case i of 0 \\ a | Suc i \\ f i\"],simp)\nqed\n\nlemma renumber:\n \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r \n \\ \\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r)\"\n by(blast dest:renumber')\n\nlemma not_inf_Fault': \n assumes enum_step: \"\\i. \\\\f i \\ f (Suc i)\"\n shows \"\\k cs. f k = (cs,css,Fault m) \\ False\"\nproof (induct css)\n case Nil\n have f_k: \"f k = (cs,[],Fault m)\" by fact\n have \"\\k. f k = (cs,[],Fault m) \\ False\"\n proof (induct cs)\n case Nil \n have \"f k = ([], [], Fault m)\" by fact\n moreover\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n ultimately show \"False\"\n by (fastforce elim: step_elim_cases)\n next\n case (Cons c cs)\n have fk: \"f k = (c # cs, [], Fault m)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,[],Fault m)\"\n by (fastforce elim: step_elim_cases)\n with enum_step Cons.hyps\n show False\n by blast\n qed\n from this f_k show False by blast\nnext\n case (Cons ds css)\n then obtain nrms abrs where ds: \"ds=(nrms,abrs)\" by (cases ds) auto\n have hyp: \"\\k cs. f k = (cs,css,Fault m) \\ False\" by fact\n have \"\\k. f k = (cs,(nrms,abrs)#css,Fault m) \\ False\"\n proof (induct cs)\n case Nil\n have fk: \"f k = ([], (nrms, abrs) # css, Fault m)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (nrms,css,Fault m)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp)\n next\n case (Cons c cs)\n have fk: \"f k = (c#cs, (nrms, abrs) # css, Fault m)\" by fact\n have hyp1: \"\\k. f k = (cs, (nrms, abrs) # css, Fault m) \\ False\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,(nrms,abrs)#css,Fault m)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp1)\n qed\n with ds Cons.prems show False by auto\nqed\n\nlemma not_inf_Fault:\n \"\\ inf \\ cs css (Fault m)\"\napply (rule not_infI)\napply (rule_tac f=f in not_inf_Fault' )\nby auto\n\nlemma not_inf_Stuck': \n assumes enum_step: \"\\i. \\\\f i \\ f (Suc i)\"\n shows \"\\k cs. f k = (cs,css,Stuck) \\ False\"\nproof (induct css)\n case Nil\n have f_k: \"f k = (cs,[],Stuck)\" by fact\n have \"\\k. f k = (cs,[],Stuck) \\ False\"\n proof (induct cs)\n case Nil \n have \"f k = ([], [], Stuck)\" by fact\n moreover\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n ultimately show \"False\"\n by (fastforce elim: step_elim_cases)\n next\n case (Cons c cs)\n have fk: \"f k = (c # cs, [], Stuck)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,[],Stuck)\"\n by (fastforce elim: step_elim_cases)\n with enum_step Cons.hyps\n show False\n by blast\n qed\n from this f_k show False .\nnext\n case (Cons ds css)\n then obtain nrms abrs where ds: \"ds=(nrms,abrs)\" by (cases ds) auto\n have hyp: \"\\k cs. f k = (cs,css,Stuck) \\ False\" by fact\n have \"\\k. f k = (cs,(nrms,abrs)#css,Stuck) \\ False\"\n proof (induct cs)\n case Nil\n have fk: \"f k = ([], (nrms, abrs) # css, Stuck)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (nrms,css,Stuck)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp)\n next\n case (Cons c cs)\n have fk: \"f k = (c#cs, (nrms, abrs) # css, Stuck)\" by fact\n have hyp1: \"\\k. f k = (cs, (nrms, abrs) # css, Stuck) \\ False\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,(nrms,abrs)#css,Stuck)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp1)\n qed\n with ds Cons.prems show False by auto\nqed\n\nlemma not_inf_Stuck:\n \"\\ inf \\ cs css Stuck\"\napply (rule not_infI)\napply (rule_tac f=f in not_inf_Stuck')\nby auto\n\nlemma last_butlast_app: \nassumes butlast: \"butlast as = xs @ butlast bs\"\nassumes not_Nil: \"bs \\ []\" \"as \\ []\"\nassumes last: \"fst (last as) = fst (last bs)\" \"snd (last as) = snd (last bs)\"\nshows \"as = xs @ bs\"\nproof -\n from last have \"last as = last bs\"\n by (cases \"last as\",cases \"last bs\") simp\n moreover\n from not_Nil have \"as = butlast as @ [last as]\" \"bs = butlast bs @ [last bs]\"\n by auto\n ultimately show ?thesis\n using butlast\n by simp\nqed\n\n\nlemma last_butlast_tl:\nassumes butlast: \"butlast bs = x # butlast as\" \nassumes not_Nil: \"bs \\ []\" \"as \\ []\" \nassumes last: \"fst (last as) = fst (last bs)\" \"snd (last as) = snd (last bs)\"\nshows \"as = tl bs\"\nproof -\n from last have \"last as = last bs\"\n by (cases \"last as\",cases \"last bs\") simp\n moreover\n from not_Nil have \"as = butlast as @ [last as]\" \"bs = butlast bs @ [last bs]\"\n by auto\n ultimately show ?thesis\n using butlast\n by simp\nqed\n\nlocale inf =\nfixes CS:: \"('s,'p,'f) config \\ ('s, 'p,'f) com list\"\n and CSS:: \"('s,'p,'f) config \\ ('s, 'p,'f) continuation list\" \n and S:: \"('s,'p,'f) config \\ ('s,'f) xstate\" \n defines CS_def : \"CS \\ fst\"\n defines CSS_def : \"CSS \\ \\c. fst (snd c)\"\n defines S_def: \"S \\ \\c. snd (snd c)\"\n\nlemma (in inf) steps_hd_drop_suffix:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nassumes simul: \"\\i\\k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\ndefines \"p\\\\i. (pcs i, pcss i, S (f i))\"\nshows \"\\i\\ p i \\ p (Suc i)\"\nusing not_finished simul\nproof (induct k)\n case 0\n thus ?case by simp\nnext\n case (Suc k)\n have simul: \"\\i\\Suc k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\" by fact\n have not_finished': \"\\i < Suc k. \\ (CS (f i) = cs \\ CSS (f i) = css)\" by fact\n with simul \n have not_finished: \"\\i (pcs i = [] \\ pcss i = [])\"\n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n show ?case\n proof (clarify)\n fix i\n assume i_le_Suc_k: \"i < Suc k\"\n show \"\\\\ p i \\ p (Suc i)\"\n proof (cases \"i < k\")\n case True\n with not_finished' simul Suc.hyps\n show ?thesis\n by auto\n next\n case False\n with i_le_Suc_k\n have eq_i_k: \"i=k\"\n by simp\n show \"\\\\p i \\ p (Suc i)\"\n proof -\n obtain cs' css' t' where \n f_Suc_i: \"f (Suc i) = (cs', css', t')\"\n by (cases \"f (Suc i)\")\n obtain cs'' css'' t'' where \n f_i: \"f i = (cs'',css'',t'')\"\n by (cases \"f i\")\n from not_finished eq_i_k \n have pcs_pcss_not_Nil: \"\\ (pcs i = [] \\ pcss i = [])\"\n by auto\n from simul [rule_format, of i] i_le_Suc_k f_i\n have pcs_pcss_i:\n \"if pcss i = [] then css''=css \\ cs''=pcs i@cs \n else cs''=pcs i \\ \n css''= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css\"\n by (simp add: CS_def CSS_def S_def cong: if_cong)\n from simul [rule_format, of \"Suc i\"] i_le_Suc_k f_Suc_i \n have pcs_pcss_Suc_i: \n \"if pcss (Suc i) = [] then css' = css \\ cs' = pcs (Suc i) @ cs\n else cs' = pcs (Suc i) \\\n css' = butlast (pcss (Suc i)) @\n [(fst (last (pcss (Suc i))) @ cs, snd (last (pcss (Suc i))) @ cs)] @ \n css\"\n by (simp add: CS_def CSS_def S_def cong: if_cong)\n show ?thesis\n proof (cases \"pcss i = []\")\n case True\n note pcss_Nil = this\n with pcs_pcss_i pcs_pcss_not_Nil obtain p ps where\n pcs_i: \"pcs i = p#ps\" and\n css'': \"css''=css\" and \n cs'': \"cs''=(p#ps)@cs\"\n by (auto simp add: neq_Nil_conv)\n with f_i have \"f i = (p#(ps@cs),css,t'')\"\n by simp\n with f_Suc_i f_step [rule_format, of i]\n have step_css: \"\\\\ (p#(ps@cs),css,t'') \\ (cs',css',t')\"\n by simp\n from step_Cons' [OF this, of p \"ps@cs\"]\n obtain css''' where\n css''': \"css' = css''' @ css\" \n \"if css''' = [] then \\p. cs' = p @ ps @ cs\n else (\\pnorm pabr. css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)])\"\n by auto\n show ?thesis\n proof (cases \"css''' = []\")\n case True\n with css'''\n obtain p' where \n css': \"css' = css\" and\n cs': \"cs' = p' @ ps @ cs\"\n by auto\n (*from cs' css' f_Suc_i f_i [rule_format, of \"Suc k\"]\n have p_ps_not_Nil: \"p'@ps \\ Nil\"\n by auto*)\n from css' cs' step_css \n have step: \"\\\\ (p#(ps@cs),css,t'') \\ (p'@ps@cs,css,t')\"\n by simp\n hence \"\\\\ ((p#ps)@cs,css,t'') \\ ((p'@ps)@cs,css,t')\"\n by simp\n from drop_suffix_css_step' [OF drop_suffix_same_css_step [OF this], \n where xs=\"css\" and css=\"[]\" and css'=\"[]\"]\n have \"\\\\ (p#ps,[],t'') \\ (p'@ps,[],t')\"\n by simp \n moreover \n from css' cs' pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = p'@ps\" and \"pcss (Suc i) = []\"\n by (simp split: split_if_asm)\n ultimately show ?thesis\n using pcs_i pcss_Nil f_i f_Suc_i\n by (simp add: CS_def CSS_def S_def p_def)\n next\n case False\n with css'''\n obtain pnorm pabr where \n css': \"css'=css'''@css\"\n \"css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)]\"\n by auto\n with css''' step_css \n have \"\\\\ (p#ps@cs,css,t'') \\ (cs',[(pnorm@ps@cs,pabr@ps@cs)]@css,t')\"\n by simp\n then \n have \"\\\\(p#ps, css, t'') \\ (cs', [(pnorm@ps, pabr@ps)] @ css, t')\" \n by (rule drop_suffix_hd_css_step)\n from drop_suffix_css_step' [OF this,\n where css=\"[]\" and xs=\"css\" and css'=\"[(pnorm@ps, pabr@ps)]\"]\n have \"\\\\ (p#ps,[],t'') \\ (cs',[(pnorm@ps, pabr@ps)],t')\"\n by simp\n moreover\n from css' pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = [(pnorm@ps, pabr@ps)]\"\n apply (cases \"pcss (Suc i)\")\n apply (auto split: split_if_asm)\n done\n ultimately show ?thesis\n using pcs_i pcss_Nil f_i f_Suc_i \n by (simp add: p_def CS_def CSS_def S_def)\n qed\n next\n case False\n note pcss_i_not_Nil = this\n with pcs_pcss_i obtain\n cs'': \"cs''=pcs i\" and \n css'': \"css''= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css\"\n by auto\n from f_Suc_i f_i f_step [rule_format, of i]\n have step_i_full: \"\\\\ (cs'',css'',t'') \\ (cs',css',t')\"\n by simp\n show ?thesis\n proof (cases cs'')\n case (Cons c' cs)\n with step_Cons' [OF step_i_full]\n obtain css''' where css': \"css' = css'''@css''\"\n by auto\n with step_i_full \n have \"\\\\ (cs'',css'',t'') \\ (cs',css'''@css'',t')\"\n by simp\n from Cons_change_css_step [OF this, where xss=\"pcss i\"] Cons cs''\n have \"\\\\ (pcs i, pcss i,t'') \\ (cs',css'''@pcss i,t')\"\n by simp\n moreover\n from cs'' css'' css' False pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = css'''@pcss i\"\n apply (auto split: split_if_asm)\n apply (drule (4) last_butlast_app)\n by simp\n ultimately show ?thesis\n using f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n next\n case Nil\n note cs''_Nil = this\n show ?thesis\n proof (cases \"butlast (pcss i)\")\n case (Cons bpcs bpcss)\n with cs''_Nil step_i_full css''\n have \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',css',t')\"\n by simp\n moreover\n from step_Nil [OF this]\n have css': \"css'=tl css''\"\n by simp\n ultimately have \n step_i_full: \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',tl css'',t')\"\n by simp\n from css'' Cons pcss_i_not_Nil\n have \"hd css'' = hd (pcss i)\"\n by (auto simp add: neq_Nil_conv split: split_if_asm)\n with cs'' cs''_Nil\n Nil_change_css_step [where ass=\"[hd css'']\" and\n css=\"tl css''\" and ass'=\"[]\" and \n xss=\"tl (pcss i)\", simplified, OF step_i_full [simplified]]\n have \"\\\\ (pcs i,[hd (pcss i)]@tl (pcss i),t'') \\ (cs',tl (pcss i),t')\"\n by simp\n with pcss_i_not_Nil \n have \"\\\\ (pcs i,pcss i,t'') \\ (cs',tl (pcss i),t')\"\n by simp\n moreover\n from css' css'' cs''_Nil Cons pcss_i_not_Nil pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = tl (pcss i)\" \n apply (clarsimp split: split_if_asm)\n apply (drule (4) last_butlast_tl)\n by simp\n ultimately show ?thesis\n using f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n next\n case Nil\n with css'' pcss_i_not_Nil\n obtain pnorm pabr\n where css'': \"css''= [(pnorm@cs,pabr@cs)]@css\" and\n pcss_i: \"pcss i = [(pnorm,pabr)]\"\n by (force simp add: neq_Nil_conv split: split_if_asm)\n with cs''_Nil step_i_full\n have \"\\\\([],[(pnorm@cs,pabr@cs)]@css,t'') \\ (cs',css',t')\"\n by simp\n from step_Nil [OF this]\n obtain \n css': \"css'=css\" and\n cs': \"(case t'' of\n Abrupt s' \\ cs' = pabr @ cs \\ t' = Normal s'\n | _ \\ cs' = pnorm @ cs \\ t' = t'')\"\n by (simp cong: xstate.case_cong)\n let \"?pcs_Suc_i \" = \"(case t'' of Abrupt s' \\ pabr | _ \\ pnorm)\"\n from cs'\n have \"\\\\([],[(pnorm,pabr)],t'') \\ (?pcs_Suc_i,[],t')\"\n by (auto intro: step.intros split: xstate.splits)\n moreover\n from css'' css' cs' pcss_i pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = ?pcs_Suc_i\" \"pcss (Suc i) = []\"\n by (simp split: split_if_asm xstate.splits)\n ultimately\n show ?thesis\n using pcss_i cs'' cs''_Nil f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n qed\n qed\n qed\n qed\n qed\n qed\nqed\n\nlemma k_steps_to_rtrancl: \n assumes steps: \"\\i\\ p i \\ p (Suc i)\"\n shows \"\\\\p 0\\\\<^sup>* p k\"\nusing steps\nproof (induct k)\n case 0 thus ?case by auto\nnext\n case (Suc k)\n have \"\\i\\ p i \\ p (Suc i)\" by fact\n then obtain\n step_le_k: \"\\i\\ p i \\ p (Suc i)\" and step_k: \"\\\\ p k \\ p (Suc k)\"\n by auto\n from Suc.hyps [OF step_le_k]\n have \"\\\\ p 0 \\\\<^sup>* p k\".\n also note step_k\n finally show ?case .\nqed\n\n \n\nlemma (in inf) steps_hd_drop_suffix_finite:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nassumes simul: \"\\i\\k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\nshows \"\\\\([c],[],s) \\\\<^sup>* (pcs k, pcss k, S (f k))\"\nproof -\n from steps_hd_drop_suffix [OF f_0 f_step not_finished simul]\n have \"\\i\\ (pcs i, pcss i, S (f i)) \\ \n (pcs (Suc i), pcss (Suc i), S (f (Suc i)))\".\n from k_steps_to_rtrancl [OF this]\n have \"\\\\ (pcs 0, pcss 0, S (f 0)) \\\\<^sup>* (pcs k, pcss k, S (f k))\".\n moreover from f_0 simul [rule_format, of 0]\n have \"(pcs 0, pcss 0, S (f 0)) = ([c],[],s)\"\n by (auto split: split_if_asm simp add: CS_def CSS_def S_def)\n ultimately show ?thesis by simp\nqed\n\nlemma (in inf) steps_hd_drop_suffix_infinite:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\n(*assumes not_finished: \"\\i. \\ (pcs i = [] \\ pcss i = [])\"*)\nassumes simul: \"\\i.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\ndefines \"p\\\\i. (pcs i, pcss i, S (f i))\"\nshows \"\\\\ p i \\ p (Suc i)\"\nproof -\n from steps_hd_drop_suffix [OF f_0 f_step, of \"Suc i\" pcss pcs] not_finished simul\n show ?thesis\n by (auto simp add: p_def)\nqed\n\nlemma (in inf) steps_hd_progress:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\"\nassumes c_unfinished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nshows \"\\i \\ k. (\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css))\"\nusing c_unfinished \nproof (induct k)\n case 0\n with f_0 show ?case\n by (simp add: CSS_def CS_def)\nnext\n case (Suc k)\n have c_unfinished: \"\\i (CS (f i) = cs \\ CSS (f i) = css)\" by fact\n hence c_unfinished': \"\\i< k. \\ (CS (f i) = cs \\ CSS (f i) = css)\" by simp\n show ?case\n proof (clarify)\n fix i\n assume i_le_Suc_k: \"i \\ Suc k\"\n show \"\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n proof (cases \"i < Suc k\")\n case True\n with Suc.hyps [OF c_unfinished', rule_format, of i] c_unfinished\n show ?thesis\n by auto\n next\n case False\n with i_le_Suc_k have eq_i_Suc_k: \"i=Suc k\"\n by auto\n obtain cs' css' t' where \n f_Suc_k: \"f (Suc k) = (cs', css', t')\"\n by (cases \"f (Suc k)\")\n obtain cs'' css'' t'' where \n f_k: \"f k = (cs'',css'',t'')\"\n by (cases \"f k\")\n with Suc.hyps [OF c_unfinished',rule_format, of k] \n obtain pcs pcss where \n pcs_pcss_k: \n \"if pcss = [] then css'' = css \\ cs'' = pcs @ cs\n else cs'' = pcs \\\n css'' = butlast pcss @ \n [(fst (last pcss) @ cs, snd (last pcss) @ cs)] @ \n css\"\n by (auto simp add: CSS_def CS_def cong: if_cong)\n from c_unfinished [rule_format, of k] f_k pcs_pcss_k\n have pcs_pcss_empty: \"\\ (pcs = [] \\ pcss = [])\" \n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n show ?thesis\n proof (cases \"pcss = []\")\n case True\n note pcss_Nil = this\n with pcs_pcss_k pcs_pcss_empty obtain p ps where\n pcs_i: \"pcs = p#ps\" and\n css'': \"css''=css\" and \n cs'': \"cs''=(p#ps)@cs\"\n by (cases \"pcs\") auto\n with f_k have \"f k = (p#(ps@cs),css,t'')\"\n by simp \n with f_Suc_k f_step [rule_format, of k]\n have step_css: \"\\\\ (p#(ps@cs),css,t'') \\ (cs',css',t')\"\n by simp\n from step_Cons' [OF this, of p \"ps@cs\"]\n obtain css''' where\n css''': \"css' = css''' @ css\" \n \"if css''' = [] then \\p. cs' = p @ ps @ cs\n else (\\pnorm pabr. css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)])\"\n by auto\n show ?thesis\n proof (cases \"css''' = []\")\n case True\n with css'''\n obtain p' where \n css': \"css' = css\" and\n cs': \"cs' = p' @ ps @ cs\"\n by auto\n from css' cs' f_Suc_k\n show ?thesis\n apply (rule_tac x=\"p'@ps\" in exI) \n apply (rule_tac x=\"[]\" in exI)\n apply (simp add: CSS_def CS_def eq_i_Suc_k)\n done\n next\n case False\n with css'''\n obtain pnorm pabr where \n css': \"css'=css'''@css\"\n \"css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)]\"\n by auto\n with f_Suc_k eq_i_Suc_k\n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"[(pnorm@ps, pabr@ps)]\" in exI) \n by (simp add: CSS_def CS_def)\n qed\n next\n case False\n note pcss_k_not_Nil = this\n with pcs_pcss_k obtain\n cs'': \"cs''=pcs\" and \n css'': \"css''= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css\"\n by auto\n from f_Suc_k f_k f_step [rule_format, of k]\n have step_i_full: \"\\\\ (cs'',css'',t'') \\ (cs',css',t')\"\n by simp \n show ?thesis\n proof (cases cs'')\n case (Cons c' cs)\n with step_Cons' [OF step_i_full]\n obtain css''' where css': \"css' = css'''@css''\"\n by auto\n with cs'' css'' f_Suc_k eq_i_Suc_k pcss_k_not_Nil\n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"css'''@pcss\" in exI)\n by (clarsimp simp add: CSS_def CS_def butlast_append)\n next\n case Nil\n note cs''_Nil = this\n show ?thesis\n proof (cases \"butlast pcss\")\n case (Cons bpcs bpcss)\n with cs''_Nil step_i_full css''\n have \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',css',t')\"\n by simp\n moreover\n from step_Nil [OF this]\n obtain css': \"css'=tl css''\" and\n cs': \"cs' = (case t'' of Abrupt s' \\ snd (hd css'') \n | _ \\ fst (hd css''))\"\n by (auto split: xstate.splits)\n from css'' Cons pcss_k_not_Nil\n have \"hd css'' = hd pcss\"\n by (auto simp add: neq_Nil_conv split: split_if_asm)\n with css' cs' css'' cs''_Nil Cons pcss_k_not_Nil f_Suc_k eq_i_Suc_k \n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"tl pcss\" in exI)\n apply (clarsimp split: xstate.splits \n simp add: CS_def CSS_def neq_Nil_conv split: split_if_asm)\n done\n next\n case Nil\n with css'' pcss_k_not_Nil\n obtain pnorm pabr\n where css'': \"css''= [(pnorm@cs,pabr@cs)]@css\" and\n pcss_k: \"pcss = [(pnorm,pabr)]\"\n by (force simp add: neq_Nil_conv split: split_if_asm)\n with cs''_Nil step_i_full\n have \"\\\\([],[(pnorm@cs,pabr@cs)]@css,t'') \\ (cs',css',t')\"\n by simp\n from step_Nil [OF this]\n obtain \n css': \"css'=css\" and\n cs': \"(case t'' of\n Abrupt s' \\ cs' = pabr @ cs \\ t' = Normal s'\n | _ \\ cs' = pnorm @ cs \\ t' = t'')\"\n by (simp cong: xstate.case_cong)\n let \"?pcs_Suc_k \" = \"(case t'' of Abrupt s' \\ pabr | _ \\ pnorm)\"\n from css'' css' cs' pcss_k f_Suc_k eq_i_Suc_k\n show ?thesis\n apply (rule_tac x=\"?pcs_Suc_k\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (simp split: xstate.splits add: CS_def CSS_def)\n done\n qed\n qed\n qed\n qed\n qed\nqed\n \nlemma (in inf) inf_progress:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\"\nassumes unfinished: \"\\i. \\ ((CS (f i) = cs) \\ (CSS (f i) = css))\"\nshows \"\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\nproof -\n from steps_hd_progress [OF f_0 f_step, of \"i\"] unfinished\n show ?thesis\n by auto\nqed\n\nlemma skolemize1: \"\\x. P x \\ (\\y. Q x y) \\ \\f.\\x. P x \\ Q x (f x)\"\n by (rule choice) blast\n\nlemma skolemize2: \"\\x. P x \\ (\\y z. Q x y z) \\ \\f g.\\x. P x \\ Q x (f x) (g x)\"\napply (drule skolemize1)\napply (erule exE)\napply (drule skolemize1)\napply fast\ndone\n\nlemma skolemize2': \"\\x.\\y z. P x y z \\ \\f g.\\x. P x (f x) (g x)\"\napply (drule choice)\napply (erule exE)\napply (drule choice)\napply fast\ndone\n\ntheorem (in inf) inf_cases:\n fixes c::\"('s,'p,'f) com\"\n assumes inf: \"inf \\ (c#cs) css s\" \n shows \"inf \\ [c] [] s \\ (\\t. \\\\\\c,s\\ \\ t \\ inf \\ cs css t)\"\nproof -\n from inf obtain f where\n f_0: \"f 0 = (c#cs,css,s)\" and\n f_step: \"(\\i. \\\\f i \\ f (Suc i))\"\n by (auto simp add: inf_def)\n show ?thesis\n proof (cases \"\\i. CS (f i) = cs \\ CSS (f i) = css\")\n case True\n def k\\\"(LEAST i. CS (f i) = cs \\ CSS (f i) = css)\"\n from True\n obtain CS_f_k: \"CS (f k) = cs\" and CSS_f_k: \"CSS (f k) = css\" \n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n have less_k_prop: \"\\i (CS (f i) = cs \\ CSS (f i) = css)\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply simp\n done\n have \"\\\\([c], [], s) \\\\<^sup>* ([],[],S (f k))\"\n proof -\n have \"\\i\\k. \\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n by (rule steps_hd_progress \n [OF f_0 f_step, where k=k, OF less_k_prop])\n from skolemize2 [OF this] obtain pcs pcss where\n pcs_pcss: \n \"\\i\\k. \n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by iprover\n from pcs_pcss [rule_format, of k] CS_f_k CSS_f_k \n have finished: \"pcs k = []\" \"pcss k = []\"\n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n from pcs_pcss\n have simul: \"\\i\\k. (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by auto\n from steps_hd_drop_suffix_finite [OF f_0 f_step less_k_prop simul] finished\n show ?thesis\n by simp\n qed\n hence \"\\\\\\c,s\\ \\ S (f k)\"\n by (rule steps_impl_exec)\n moreover\n from CS_f_k CSS_f_k f_step\n have \"inf \\ cs css (S (f k))\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (i + k)\" in exI)\n apply simp\n apply (auto simp add: CS_def CSS_def S_def)\n done\n ultimately\n have \"(\\t. \\\\\\c,s\\ \\ t \\ inf \\ cs css t)\"\n by blast\n thus ?thesis\n by simp\n next\n case False\n hence unfinished: \"\\i. \\ ((CS (f i) = cs) \\ (CSS (f i) = css))\"\n by simp\n from inf_progress [OF f_0 f_step this]\n have \"\\i. \\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n by auto\n from skolemize2' [OF this] obtain pcs pcss where \n pcs_pcss: \"\\i. \n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by iprover\n def \"g\" \\ \"\\i. (pcs i, pcss i, S (f i))\"\n from pcs_pcss [rule_format, of 0] f_0\n have \"g 0 = ([c],[],s)\"\n by (auto split: split_if_asm simp add: CS_def CSS_def S_def g_def)\n moreover\n from steps_hd_drop_suffix_infinite [OF f_0 f_step unfinished pcs_pcss]\n have \"\\i. \\\\g i \\ g (Suc i)\"\n by (simp add: g_def)\n ultimately\n have \"inf \\ [c] [] s\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma infE [consumes 1]:\n assumes inf: \"inf \\ (c#cs) css s\" \n assumes cases: \"inf \\ [c] [] s \\ P\"\n \"\\t. \\\\\\\\c,s\\ \\ t; inf \\ cs css t\\ \\ P\"\n shows P\nusing inf cases\napply -\napply (drule inf.inf_cases)\napply auto\ndone\n\nlemma inf_Seq: \n \"inf \\ (Seq c1 c2#cs) css (Normal s) = inf \\ (c1#c2#cs) css (Normal s)\" \nproof \n assume \"inf \\ (Seq c1 c2 # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (Seq c1 c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from f_step [rule_format, of 0] f_0\n have \"f 1 = (c1#c2#cs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ (c1#c2#cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ (c1 # c2 # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (c1# c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def g\\\"\\i. case i of 0 \\ (Seq c1 c2#cs,css,Normal s) | Suc j \\ f j\" \n with f_0 have\n \"\\\\g 0 \\ g (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\g i \\ g (Suc i)\"\n by (auto simp add: g_def split: nat.splits)\n ultimately\n show \"inf \\ (Seq c1 c2 # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=g in exI)\n apply (simp add: g_def split: nat.splits)\n done\nqed\n \nlemma inf_WhileTrue: \n assumes b: \"s \\ b\"\n shows \"inf \\ (While b c#cs) css (Normal s) = \n inf \\ (c#While b c#cs) css (Normal s)\" \nproof\n assume \"inf \\ (While b c # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (While b c#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from b f_step [rule_format, of 0] f_0\n have \"f 1 = (c#While b c#cs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ (c # While b c # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ (c # While b c # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (c # While b c #cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def h\\\"\\i. case i of 0 \\ (While b c#cs,css,Normal s) | Suc j \\ f j\" \n with b f_0 have\n \"\\\\h 0 \\ h (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\h i \\ h (Suc i)\"\n by (auto simp add: h_def split: nat.splits)\n ultimately\n show \"inf \\ (While b c # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=h in exI)\n apply (simp add: h_def split: nat.splits)\n done\nqed\n\nlemma inf_Catch:\n\"inf \\ (Catch c1 c2#cs) css (Normal s) = inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\nproof\n assume \"inf \\ (Catch c1 c2#cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (Catch c1 c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from f_step [rule_format, of 0] f_0\n have \"f 1 = ([c1],(cs,c2#cs)#css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\n then obtain f where \n f_0: \"f 0 = ([c1],(cs,c2#cs)#css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def h\\\"\\i. case i of 0 \\ (Catch c1 c2#cs,css,Normal s) | Suc j \\ f j\" \n with f_0 have\n \"\\\\h 0 \\ h (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\h i \\ h (Suc i)\"\n by (auto simp add: h_def split: nat.splits)\n ultimately\n show \"inf \\ (Catch c1 c2 # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=h in exI)\n apply (simp add: h_def split: nat.splits)\n done\nqed\n\ntheorem terminates_impl_not_inf: \n assumes termi: \"\\\\c \\ s\"\n shows \"\\inf \\ [c] [] s\"\nusing termi\nproof induct\n case (Skip s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Skip], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Basic g s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Basic g], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal (g s))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Spec r s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Spec r], [], Normal s)\" \n with f_step [of 0]\n have \"\\\\([Spec r], [], Normal s) \\ f (Suc 0)\"\n by simp\n then show False\n proof (cases)\n fix t\n assume \"(s, t) \\ r\" \"f (Suc 0) = ([], [], Normal t)\"\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n assume \"\\t. (s, t) \\ r\" \"f (Suc 0) = ([], [], Stuck)\"\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\n qed\nnext\n case (Guard s g c m)\n have g: \"s \\ g\" by fact\n have hyp: \"\\ inf \\ [c] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Guard m g c], [], Normal s)\" \n from g f_step [of 0] f_0\n have \"f (Suc 0) = ([c],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False ..\n qed\nnext\n case (GuardFault s g m c)\n have g: \"s \\ g\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Guard m g c], [], Normal s)\" \n from g f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Fault c m)\n thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Fault m)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Seq c1 s c2)\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n have hyp_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ s' \\ \\\\c2 \\ s' \\ \\ inf \\ [c2] [] s'\" by fact\n have \"\\ inf \\ ([c1,c2]) [] (Normal s)\"\n proof \n assume \"inf \\ [c1, c2] [] (Normal s)\"\n then show False\n proof (cases rule: infE)\n assume \"inf \\ [c1] [] (Normal s)\"\n with hyp_c1 show ?thesis by simp\n next\n fix t\n assume \"\\\\\\c1,Normal s\\ \\ t\" \"inf \\ [c2] [] t\"\n with hyp_c2 show ?thesis by simp\n qed\n qed\n thus ?case\n by (simp add: inf_Seq)\nnext\n case (CondTrue s b c1 c2)\n have b: \"s \\ b\" by fact\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Cond b c1 c2], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = ([c1],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c1] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c1 show False by simp\n qed\nnext\n case (CondFalse s b c2 c1)\n have b: \"s \\ b\" by fact\n have hyp_c2: \"\\ inf \\ [c2] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Cond b c1 c2], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = ([c2],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c2] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c2 show False by simp\n qed\nnext\n case (WhileTrue s b c)\n have b: \"s \\ b\" by fact\n have hyp_c: \"\\ inf \\ [c] [] (Normal s)\" by fact\n have hyp_w: \"\\s'. \\\\\\c,Normal s\\ \\ s' \\ \n \\\\While b c \\ s' \\ \\ inf \\ [While b c] [] s'\" by fact\n have \"\\ inf \\ [c,While b c] [] (Normal s)\"\n proof \n assume \"inf \\ [c,While b c] [] (Normal s)\"\n from this hyp_c hyp_w show False\n by (cases rule: infE) auto\n qed\n with b show ?case\n by (simp add: inf_WhileTrue)\nnext\n case (WhileFalse s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([While b c], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Call p bdy s)\n have bdy: \"\\ p = Some bdy\" by fact\n have hyp: \"\\ inf \\ [bdy] [] (Normal s)\" by fact\n have not_inf_bdy:\n \"\\ inf \\ [bdy] [([],[Throw])] (Normal s)\"\n proof \n assume \"inf \\ [bdy] [([],[Throw])] (Normal s)\"\n then show False\n proof (rule infE)\n assume \"inf \\ [bdy] [] (Normal s)\"\n with hyp show False by simp\n next\n fix t\n assume \"\\\\\\bdy,Normal s\\ \\ t\"\n assume inf: \"inf \\ [] [([], [Throw])] t\"\n then obtain f where\n f_0: \"f 0 = ([],[([], [Throw])],t)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n show False\n proof (cases t)\n case (Normal t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],(Normal t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step.cases)\n next \n case (Abrupt t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([Throw],[],(Normal t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n have \"f (Suc (Suc 0)) = ([],[],(Abrupt t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc(Suc 0)\"]\n show False\n by (auto elim: step.cases)\n next\n case (Fault m)\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n have \"f (Suc (Suc 0)) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc (Suc 0)\"]\n show False\n by (auto elim: step.cases)\n next\n case Stuck\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n have \"f (Suc (Suc 0)) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc (Suc 0)\"]\n show False\n by (auto elim: step.cases)\n qed\n qed\n qed \n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Call p], [], Normal s)\" \n from bdy f_step [of 0] f_0\n have \"f (Suc 0) = \n ([bdy],[([],[Throw])],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [bdy] [([],[Throw])] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with not_inf_bdy\n show False by simp\n qed\nnext\n case (CallUndefined p s)\n have undef: \"\\ p = None\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Call p], [], Normal s)\" \n from undef f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Stuck c)\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Stuck)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (DynCom c s)\n have hyp: \"\\ inf \\ [(c s)] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([DynCom c], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([(c s)], [], Normal s)\"\n by (auto elim: step_elim_cases)\n with f_step have \"inf \\ [(c s)] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp\n show False by simp\n qed\nnext\n case (Throw s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Throw], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Abrupt s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Abrupt c s)\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Abrupt s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Abrupt s)\"\n by (auto elim: step_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Catch c1 s c2)\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n have hyp_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ Abrupt s' \\\n \\\\c2 \\ Normal s' \\ \\ inf \\ [c2] [] (Normal s')\" by fact\n have \"\\ inf \\ [c1] [([],[c2])] (Normal s)\"\n proof \n assume \"inf \\ [c1] [([],[c2])] (Normal s)\"\n then show False\n proof (rule infE) \n assume \"inf \\ [c1] [] (Normal s)\"\n with hyp_c1 show False by simp\n next\n fix t\n assume eval: \"\\\\\\c1,Normal s\\ \\ t\" \n assume inf: \"inf \\ [] [([], [c2])] t\"\n then obtain f where\n f_0: \"f 0 = ([],[([], [c2] )],t)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n show False\n proof (cases t)\n case (Normal t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Normal t')\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n case (Abrupt t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([c2],[],Normal t')\"\n by (auto elim: step_Normal_elim_cases)\n with f_step eval Abrupt\n have \"inf \\ [c2] [] (Normal t')\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with eval hyp_c2 Abrupt show False by simp\n next\n case (Fault m)\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n case Stuck\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\n qed\n qed\n thus ?case\n by (simp add: inf_Catch)\nqed\n\nlemma terminatess_impl_not_inf:\n assumes termi: \"\\\\cs,css\\s\" \n shows \"\\inf \\ cs css s\"\nusing termi\nproof (induct)\n case (Nil s)\n show ?case\n proof (rule not_infI)\n fix f\n assume \"\\i. \\\\f i \\ f (Suc i)\"\n hence \"\\\\f 0 \\ f (Suc 0)\" \n by simp\n moreover\n assume \"f 0 = ([], [], s)\"\n ultimately show False\n by (fastforce elim: step.cases)\n qed\nnext\n case (ExitBlockNormal nrms css s abrs)\n have hyp: \"\\ inf \\ nrms css (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f0: \"f 0 = ([], (nrms, abrs) # css, Normal s)\"\n with f_step [of 0] have \"f (Suc 0) = (nrms,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step have \"inf \\ nrms css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp \n with hyp show False ..\n qed\nnext\n case (ExitBlockAbrupt abrs css s nrms)\n have hyp: \"\\ inf \\ abrs css (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f0: \"f 0 = ([], (nrms, abrs) # css, Abrupt s)\"\n with f_step [of 0] have \"f (Suc 0) = (abrs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step have \"inf \\ abrs css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp \n with hyp show False ..\n qed\nnext\n case (ExitBlockFault nrms css f abrs)\n show ?case\n by (rule not_inf_Fault)\nnext\n case (ExitBlockStuck nrms css abrs)\n show ?case\n by (rule not_inf_Stuck)\nnext\n case (Cons c s cs css)\n have termi_c: \"\\\\c \\ s\" by fact\n have hyp: \"\\t. \\\\\\c,s\\ \\ t \\ \\\\cs,css\\t \\ \\ inf \\ cs css t\" by fact\n show \"\\ inf \\ (c # cs) css s\"\n proof \n assume \"inf \\ (c # cs) css s\"\n thus False\n proof (rule infE)\n assume \"inf \\ [c] [] s\"\n with terminates_impl_not_inf [OF termi_c]\n show False ..\n next\n fix t\n assume \"\\\\\\c,s\\ \\ t\" \"inf \\ cs css t\"\n with hyp show False by simp\n qed\n qed\nqed\n\nlemma lem:\n \"\\y. r\\<^sup>+\\<^sup>+ a y \\ P a \\ P y \n \\ ((b,a) \\ {(y,x). P x \\ r x y}\\<^sup>+) = ((b,a) \\ {(y,x). P x \\ r\\<^sup>+\\<^sup>+ x y})\"\napply(rule iffI)\n apply clarify\n apply(erule trancl_induct)\n apply blast\n apply(blast intro:tranclp_trans)\napply clarify\napply(erule tranclp_induct)\n apply blast\napply(blast intro:trancl_trans)\ndone\n\ncorollary terminatess_impl_no_inf_chain:\n assumes terminatess: \"\\\\cs,css\\s\"\n shows \"\\(\\f. f 0 = (cs,css,s) \\ (\\i::nat. \\\\f i \\\\<^sup>+ f(Suc i)))\"\nproof -\n have \"wf({(y,x). \\\\(cs,css,s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n proof (rule wf_trancl)\n show \"wf {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\"\n proof (simp only: wf_iff_no_infinite_down_chain,clarify,simp)\n fix f\n assume \"\\i. \\\\(cs, css, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from terminatess\n have \"\\ (\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (rule terminatess_impl_not_inf [unfolded inf_def])\n ultimately show False\n by simp\n qed\n qed\n hence \"\\ (\\f. \\i. (f (Suc i), f i)\n \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n by (simp add: wf_iff_no_infinite_down_chain)\n thus ?thesis\n proof (rule contrapos_nn)\n assume \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\\\<^sup>+ f (Suc i))\"\n then obtain f where\n f0: \"f 0 = (cs, css, s)\" and\n seq: \"\\i. \\\\f i \\\\<^sup>+ f (Suc i)\"\n by iprover\n show \n \"\\f. \\i. (f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof (rule exI [where x=f],rule allI)\n fix i\n show \"(f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof - \n {\n fix i have \"\\\\(cs,css,s) \\\\<^sup>* f i\"\n proof (induct i)\n case 0 show \"\\\\(cs, css, s) \\\\<^sup>* f 0\"\n by (simp add: f0)\n next\n case (Suc n)\n have \"\\\\(cs, css, s) \\\\<^sup>* f n\" by fact\n with seq show \"\\\\(cs, css, s) \\\\<^sup>* f (Suc n)\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n qed\n }\n hence \"\\\\(cs,css,s) \\\\<^sup>* f i\"\n by iprover\n with seq have\n \"(f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\\\<^sup>+ y}\"\n by clarsimp\n moreover \n have \"\\y. \\\\f i \\\\<^sup>+ y\\\\\\(cs, css, s) \\\\<^sup>* f i\\\\\\(cs, css, s) \\\\<^sup>* y\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n ultimately \n show ?thesis \n by (subst lem)\n qed\n qed\n qed\nqed\n\ncorollary terminates_impl_no_inf_chain:\n \"\\\\c\\s \\ \\(\\f. f 0 = ([c],[],s) \\ (\\i::nat. \\\\f i \\\\<^sup>+ f(Suc i)))\"\n by (rule terminatess_impl_no_inf_chain) (iprover intro: terminatess.intros)\n\n\ndefinition\n termi_call_steps :: \"('s,'p,'f) body \\ (('s \\ 'p) \\ ('s \\ 'p))set\"\nwhere\n\"termi_call_steps \\ =\n {((t,q),(s,p)). \\\\the (\\ p)\\Normal s \\ \n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t))}\"\n\ntext {* Sequencing computations, or more exactly continuation stacks *}\nprimrec seq:: \"(nat \\ 'a list) \\ nat \\ 'a list\"\nwhere\n\"seq css 0 = []\" |\n\"seq css (Suc i) = css i@seq css i\"\n\n\ntheorem wf_termi_call_steps: \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix S\n assume inf:\n \"\\i. (\\(t,q) (s,p). \\\\(the (\\ p)) \\ Normal s \\\n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t)))\n (S (Suc i)) (S i)\"\n obtain s p where \"s = (\\i. fst (S i))\" and \"p = (\\i. snd (S i))\" \n by auto\n with inf\n have inf':\n \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n (\\css. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css,Normal (s (Suc i))))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply auto\n done\n show False\n proof -\n from inf' -- {* Skolemization of css with axiom of choice *}\n have \"\\css. \\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css i,Normal (s (Suc i)))\"\n apply -\n apply (rule choice)\n by blast\n then obtain css where\n termi_css: \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i)\" and\n step_css: \"\\i. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css i,Normal (s (Suc i)))\"\n by blast\n def f == \"\\i. ([the (\\ (p i))], seq css i,Normal (s i)::('a,'c) xstate)\"\n have \"f 0 = ([the (\\ (p 0))],[],Normal (s 0))\"\n by (simp add: f_def)\n moreover\n have \"\\i. \\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n proof \n fix i\n from step_css [rule_format, of i]\n have \"\\\\([the (\\ (p i))], [], Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))], css i, Normal (s (Suc i)))\".\n from app_css_steps [OF this,simplified]\n have \"\\\\([the (\\ (p i))], seq css i, Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))], css i@seq css i, Normal (s (Suc i)))\".\n thus \"\\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n by (simp add: f_def)\n qed\n moreover from termi_css [rule_format, of 0]\n have \"\\ (\\f. (f 0 = ([the (\\ (p 0))],[],Normal (s 0)) \\ \n (\\i. \\\\(f i) \\\\<^sup>+ f(Suc i))))\"\n by (rule terminates_impl_no_inf_chain)\n ultimately show False\n by auto\n qed\nqed\n\ntext {* An alternative proof using Hilbert-choice instead of axiom of choice.*}\ntheorem \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix S\n assume inf:\n \"\\i. (\\(t,q) (s,p). \\\\(the (\\ p)) \\ Normal s \\\n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t)))\n (S (Suc i)) (S i)\"\n obtain s p where \"s = (\\i. fst (S i))\" and \"p = (\\i. snd (S i))\" \n by auto\n with inf\n have inf':\n \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n (\\css. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css,Normal (s (Suc i))))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply auto\n done\n show \"False\"\n proof -\n def CSS \\ \"\\i. (SOME css. \n \\\\([the (\\ (p i))],[], Normal (s i)) \\\\<^sup>+\n ([the (\\ (p (i+1)))],css,Normal (s (i+1))))\"\n def f == \"\\i. ([the (\\ (p i))], seq CSS i,Normal (s i)::('a,'c) xstate)\"\n have \"f 0 = ([the (\\ (p 0))],[],Normal (s 0))\"\n by (simp add: f_def)\n moreover\n have \"\\i. \\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n proof \n fix i\n from inf' [rule_format, of i] obtain css where\n css: \"\\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (i+1)))],css,Normal (s (i+1)))\"\n by fastforce\n hence \"\\\\([the (\\ (p i))], seq CSS i, Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (i+1)))], CSS i @ seq CSS i, Normal (s (i+1)))\"\n apply -\n apply (unfold CSS_def)\n apply (rule someI2 \n [where P=\"\\css. \n \\\\([the (\\ (p i))],[],Normal (s i))\\\\<^sup>+\n ([the (\\ (p (i+1)))],css, Normal (s (i+1)))\"])\n apply (rule css)\n apply (fastforce dest: app_css_steps)\n done\n thus \"\\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n by (simp add: f_def)\n qed\n moreover from inf' [rule_format, of 0]\n have \"\\\\the (\\ (p 0)) \\ Normal (s 0)\" \n by iprover\n then have \"\\ (\\f. (f 0 = ([the (\\ (p 0))],[],Normal (s 0)) \\ \n (\\i. \\\\(f i) \\\\<^sup>+ f(Suc i))))\"\n by (rule terminates_impl_no_inf_chain)\n ultimately show False\n by auto\n qed\nqed\n\nlemma not_inf_implies_wf: assumes not_inf: \"\\ inf \\ cs css s\"\n shows \"wf {(c2,c1). \\ \\ (cs,css,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nproof (simp only: wf_iff_no_infinite_down_chain,clarify, simp)\n fix f\n assume \"\\i. \\\\(cs, css, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from not_inf\n have \"\\ (\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (unfold inf_def)\n ultimately show False\n by simp\nqed\n\nlemma wf_implies_termi_reach:\nassumes wf: \"wf {(c2,c1). \\ \\ (cs,css,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nshows \"\\cs1 css1 s1. \\\\ \\ (cs,css,s) \\\\<^sup>* c1; c1=(cs1,css1,s1)\\\\ \\\\cs1,css1\\s1\"\nusing wf \nproof (induct c1, simp)\n fix cs1 css1 s1\n assume reach: \"\\\\(cs, css, s) \\\\<^sup>* (cs1, css1, s1)\"\n assume hyp_raw: \"\\y cs2 css2 s2. \\\\ \\ (cs1,css1,s1) \\ (cs2,css2,s2);\n \\ \\ (cs,css,s) \\\\<^sup>* (cs2,css2,s2); y=(cs2,css2,s2)\\ \\ \n \\\\cs2,css2\\s2\"\n have hyp: \"\\cs2 css2 s2. \\\\ \\ (cs1,css1,s1) \\ (cs2,css2,s2)\\ \\ \n \\\\cs2,css2\\s2\"\n apply -\n apply (rule hyp_raw)\n apply assumption\n using reach \n apply simp\n apply (rule refl)\n done\n show \"\\\\cs1,css1\\s1\"\n proof (cases s1)\n case (Normal s1')\n show ?thesis\n proof (cases cs1)\n case Nil\n note cs1_Nil = this\n show ?thesis\n proof (cases css1)\n case Nil\n with cs1_Nil show ?thesis\n by (auto intro: terminatess.intros)\n next\n case (Cons nrms_abrs css1')\n then obtain nrms abrs where nrms_abrs: \"nrms_abrs=(nrms,abrs)\"\n by (cases \"nrms_abrs\")\n have \"\\ \\ ([],(nrms,abrs)#css1',Normal s1') \\ (nrms,css1',Normal s1')\"\n by (rule step.intros)\n from hyp [simplified cs1_Nil Cons nrms_abrs Normal, OF this]\n have \"\\\\nrms,css1'\\Normal s1'\".\n from ExitBlockNormal [OF this] cs1_Nil Cons nrms_abrs Normal\n show ?thesis\n by auto\n qed\n next\n case (Cons c1 cs1')\n have \"\\\\c1#cs1',css1\\Normal s1'\"\n proof (cases c1)\n case Skip\n have \"\\ \\ (Skip#cs1',css1,Normal s1') \\ (cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Skip Normal, OF this]\n have \"\\\\cs1',css1\\Normal s1'\".\n with Normal Skip show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Basic f)\n have \"\\ \\ (Basic f#cs1',css1,Normal s1') \\ (cs1',css1,Normal (f s1'))\"\n by (rule step.intros)\n from hyp [simplified Cons Basic Normal, OF this]\n have \"\\\\cs1',css1\\Normal (f s1')\".\n with Normal Basic show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Spec r)\n with Normal show ?thesis\n apply simp\n apply (rule terminatess.Cons)\n apply (fastforce intro: terminates.intros)\n apply (clarify)\n apply (erule exec_Normal_elim_cases)\n apply clarsimp\n apply (rule hyp)\n apply (fastforce intro: step.intros simp add: Cons Spec Normal )\n apply (fastforce intro: terminatess_Stuck)\n done\n next\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have \"\\ \\ (Seq c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>1#c\\<^sub>2#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Seq Normal, OF this]\n have \"\\\\c\\<^sub>1 # c\\<^sub>2 # cs1',css1\\Normal s1'\".\n with Normal Seq show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n show ?thesis\n proof (cases \"s1' \\ b\")\n case True\n hence \"\\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>1#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Cond Normal, OF this]\n have \"\\\\c\\<^sub>1 # cs1',css1\\Normal s1'\".\n with Normal Cond True show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n hence \"\\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>2#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Cond Normal, OF this]\n have \"\\\\c\\<^sub>2 # cs1',css1\\Normal s1'\".\n with Normal Cond False show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n next\n case (While b c')\n show ?thesis\n proof (cases \"s1' \\ b\")\n case True\n then have \"\\\\(While b c' # cs1', css1, Normal s1') \\ \n (c' # While b c' # cs1', css1, Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons While Normal, OF this]\n have \"\\\\c' # While b c' # cs1',css1\\Normal s1'\".\n with Cons While True Normal\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n then \n have \"\\\\(While b c' # cs1', css1, Normal s1') \\ (cs1', css1, Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons While Normal, OF this]\n have \"\\\\cs1',css1\\Normal s1'\".\n with Cons While False Normal\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n next\n case (Call p)\n show ?thesis\n proof (cases \"\\ p\")\n case None\n with Call Normal show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros terminatess_Stuck\n elim: exec_Normal_elim_cases)\n next\n case (Some bdy)\n then\n have \"\\ \\ (Call p#cs1',css1,Normal s1') \\ \n ([bdy],(cs1',Throw#cs1')#css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Call Normal Some, OF this]\n have \"\\\\[bdy],(cs1', Throw # cs1') # css1\\Normal s1'\".\n with Some Call Normal show ?thesis\n apply simp\n apply (rule terminatess.intros)\n apply (blast elim: terminatess_elim_cases intro: terminates.intros)\n apply clarify\n apply (erule terminatess_elim_cases)\n apply (erule exec_Normal_elim_cases)\n prefer 2\n apply simp\n apply (erule_tac x=t in allE)\n apply (case_tac t)\n apply (auto intro: terminatess_Stuck terminatess_Fault exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n done\n qed\n next\n case (DynCom c')\n have \"\\ \\ (DynCom c'#cs1',css1,Normal s1') \\ (c' s1'#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons DynCom Normal, OF this]\n have \"\\\\c' s1'#cs1',css1\\Normal s1'\".\n with Normal DynCom show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case (Guard f g c')\n show ?thesis\n proof (cases \"s1' \\ g\")\n case True\n then have \"\\ \\ (Guard f g c'#cs1',css1,Normal s1') \\ (c'#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Guard Normal, OF this]\n have \"\\\\c'#cs1',css1\\Normal s1'\".\n with Normal Guard True show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n with Guard Normal show ?thesis\n by (fastforce intro: terminatess.intros terminatess_Fault \n terminates.intros \n elim: exec_Normal_elim_cases)\n qed\n next\n case Throw\n have \"\\ \\ (Throw#cs1',css1,Normal s1') \\ (cs1',css1,Abrupt s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Throw Normal, OF this]\n have \"\\\\cs1',css1\\Abrupt s1'\".\n with Normal Throw show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\ \\ (Catch c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ \n ([c\\<^sub>1], (cs1',c\\<^sub>2#cs1')# css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Catch Normal, OF this]\n have \"\\\\[c\\<^sub>1],(cs1', c\\<^sub>2 # cs1') # css1\\Normal s1'\".\n with Normal Catch show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed \n with Cons Normal show ?thesis\n by simp\n qed\n next\n case (Abrupt s1')\n show ?thesis\n proof (cases cs1)\n case Nil\n note cs1_Nil = this\n show ?thesis\n proof (cases css1)\n case Nil\n with cs1_Nil show ?thesis by (auto intro: terminatess.intros)\n next\n case (Cons nrms_abrs css1')\n then obtain nrms abrs where nrms_abrs: \"nrms_abrs=(nrms,abrs)\"\n by (cases \"nrms_abrs\")\n have \"\\ \\ ([],(nrms,abrs)#css1',Abrupt s1') \\ (abrs,css1',Normal s1')\"\n by (rule step.intros)\n from hyp [simplified cs1_Nil Cons nrms_abrs Abrupt, OF this]\n have \"\\\\abrs,css1'\\Normal s1'\".\n from ExitBlockAbrupt [OF this] cs1_Nil Cons nrms_abrs Abrupt\n show ?thesis\n by auto\n qed\n next\n case (Cons c1 cs1')\n have \"\\\\c1#cs1',css1\\Abrupt s1'\"\n proof -\n have \"\\ \\ (c1#cs1',css1,Abrupt s1') \\ (cs1',css1,Abrupt s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Abrupt, OF this]\n have \"\\\\cs1',css1\\Abrupt s1'\".\n with Cons Abrupt\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n with Cons Abrupt show ?thesis by simp\n qed\n next\n case (Fault f)\n thus ?thesis by (auto intro: terminatess_Fault)\n next\n case Stuck\n thus ?thesis by (auto intro: terminatess_Stuck)\n qed\nqed\n\nlemma not_inf_impl_terminatess:\n assumes not_inf: \"\\ inf \\ cs css s\"\n shows \"\\\\cs,css\\s\"\nproof -\n from not_inf_implies_wf [OF not_inf]\n have wf: \"wf {(c2, c1). \\\\(cs, css, s) \\\\<^sup>* c1 \\ \\\\c1 \\ c2}\".\n show ?thesis\n by (rule wf_implies_termi_reach [OF wf]) auto\nqed\n\nlemma not_inf_impl_terminates:\n assumes not_inf: \"\\ inf \\ [c] [] s\"\n shows \"\\\\c\\s\"\nproof -\n from not_inf_impl_terminatess [OF not_inf]\n have \"\\\\[c],[]\\s\".\n thus ?thesis\n by (auto elim: terminatess_elim_cases)\nqed\n\ntheorem terminatess_iff_not_inf: \n \"\\\\cs,css\\s = (\\ inf \\ cs css s)\"\n apply rule\n apply (erule terminatess_impl_not_inf)\n apply (erule not_inf_impl_terminatess)\n done\n\ncorollary terminates_iff_not_inf: \n \"\\\\c\\s = (\\ inf \\ [c] [] s)\"\n apply (rule)\n apply (erule terminates_impl_not_inf)\n apply (erule not_inf_impl_terminates)\n done\n\nsubsection {* Completeness of Total Correctness Hoare Logic*}\n\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\n\n\n\ntext {* To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n *}\nlemma Call_lemma:\n assumes \n Call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule Call)\napply blast\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\napply blast\ndone\n\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext {* Another proof of @{text MGT_Call}, maybe a little more readable *}\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n def Specs == \"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n def Specs_wf == \"(\\p \\. (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs)\"\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/AlternativeSmallStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2734034621938684}} {"text": "theory MainTheorems\nimports PathLemmas\nbegin\n\ncontext LocalLexing begin\n\ntheorem \\_is_generated_by_\\: \"\\ = Gen \\\"\nproof -\n have \"wellformed_items (\\ (length Doc))\"\n using wellformed_items_\\ by auto\n then have \"\\ x. x \\ \\ (length Doc) \\ item_end x \\ length Doc\"\n using wellformed_item_def wellformed_items_def by blast\n then have \"\\ (length Doc) \\ items_le (length Doc) (\\ (length Doc))\"\n by (auto simp only: items_le_def) \n then have \"\\ (length Doc) = items_le (length Doc) (\\ (length Doc))\"\n using items_le_is_filter by blast\n then have \\_altdef: \"\\ = items_le (length Doc) (\\ (length Doc))\" using \\_def by auto\n have \"\\ p. p \\ (\\ (length Doc)) \\ charslength p \\ length Doc\"\n using \\_are_doc_tokens \\_def doc_tokens_length by auto\n then have \"\\ (length Doc) \\ paths_le (length Doc) (\\ (length Doc))\"\n by (auto simp only: paths_le_def)\n then have \"\\ (length Doc) = paths_le (length Doc) (\\ (length Doc))\"\n using paths_le_is_filter by blast\n then have \\_altdef: \"\\ = paths_le (length Doc) (\\ (length Doc))\" using \\_def by auto\n show ?thesis using \\_altdef \\_altdef thmD14 by auto\nqed\n\ndefinition finished_item :: \"symbol list \\ item\"\nwhere\n \"finished_item \\ = Item (\\, \\) (length \\) 0 (length Doc)\"\n\nlemma item_rule_finished_item[simp]: \"item_rule (finished_item \\) = (\\, \\)\"\n by (simp add: finished_item_def)\n\nlemma item_origin_finished_item[simp]: \"item_origin (finished_item \\) = 0\"\n by (simp add: finished_item_def)\n\nlemma item_end_finished_item[simp]: \"item_end (finished_item \\) = length Doc\"\n by (simp add: finished_item_def)\n\nlemma item_dot_finished_item[simp]: \"item_dot (finished_item \\) = length \\\"\n by (simp add: finished_item_def)\n\nlemma item_rhs_finished_item[simp]: \"item_rhs (finished_item \\) = \\\"\n by (simp add: finished_item_def)\n\nlemma item_\\_finished_item[simp]: \"item_\\ (finished_item \\) = \\\"\n by (simp add: finished_item_def item_\\_def)\n\nlemma item_nonterminal_finished_item[simp]: \"item_nonterminal (finished_item \\) = \\\"\n by (simp add: finished_item_def item_nonterminal_def)\n \nlemma Derives1_of_singleton:\n assumes \"Derives1 [N] i r \\\"\n shows \"i = 0 \\ r = (N, \\)\"\nproof -\n from assms have \"i = 0\" using Derives1_bound\n using length_Cons less_Suc0 list.size(3) by fastforce \n then show ?thesis using assms\n using Derives1_def append_Cons append_self_conv append_self_conv2 length_0_conv \n list.inject by auto\nqed \n\ndefinition pvalid_with :: \"tokens \\ item \\ nat \\ symbol list \\ bool\"\nwhere\n \"pvalid_with p x u \\ = \n (wellformed_tokens p \\\n wellformed_item x \\\n u \\ length p \\\n charslength p = item_end x \\\n charslength (take u p) = item_origin x \\\n is_derivation (terminals (take u p) @ [item_nonterminal x] @ \\) \\\n derives (item_\\ x) (terminals (drop u p)))\"\n\nlemma pvalid_with: \"pvalid p x = (\\ u \\. pvalid_with p x u \\)\"\n using pvalid_def pvalid_with_def by blast\n\ntheorem Completeness:\n assumes p_in_ll: \"p \\ ll\"\n shows \"\\ \\. pvalid_with p (finished_item \\) 0 [] \\ finished_item \\ \\ \\\"\nproof -\n have p: \"p \\ \\ \\ charslength p = length Doc \\ terminals p \\ \\\"\n using p_in_ll ll_def by auto\n then have derives_p: \"derives [\\] (terminals p)\"\n using \\_def is_derivation_def mem_Collect_eq by blast\n then have \"\\ D. Derivation [\\] D (terminals p)\"\n by (simp add: derives_implies_Derivation) \n then obtain D where D: \"Derivation [\\] D (terminals p)\" by blast\n have is_word_p: \"is_word (terminals p)\" using leftlang p by blast\n have not_is_word_\\: \"\\ (is_word [\\])\" using is_nonterminal_startsymbol is_terminal_nonterminal \n is_word_cons by blast \n have \"D \\ []\" using D is_word_p not_is_word_\\ using Derivation.simps(1) by force\n then have \"\\ d D'. D = d#D'\" using D Derivation.elims(2) by blast \n then obtain d D' where d: \"D = d#D'\" by blast\n have \"\\ \\. Derives1 [\\] (fst d) (snd d) \\ \\ derives \\ (terminals p)\"\n using d D Derivation.simps(2) Derivation_implies_derives by blast \n then obtain \\ where \\: \"Derives1 [\\] (fst d) (snd d) \\ \\ derives \\ (terminals p)\" by blast\n then have snd_d_in_\\: \"snd d \\ \\\" using Derives1_rule by blast \n with \\ have snd_d: \"snd d = (\\, \\)\" using Derives1_of_singleton by blast\n have wellformed_p: \"wellformed_tokens p\" by (simp add: \\_wellformed p)\n have wellformed_finished_item: \"wellformed_item (finished_item \\)\" \n apply (auto simp add: wellformed_item_def)\n using snd_d snd_d_in_\\ by metis \n have pvalid_with: \"pvalid_with p (finished_item \\) 0 []\" \n apply (auto simp add: pvalid_with_def)\n using wellformed_p apply blast\n using wellformed_finished_item apply blast\n using p apply (simp add: finished_item_def)\n apply (simp add: is_derivation_def)\n by (simp add: \\)\n then have \"pvalid p (finished_item \\)\" using pvalid_def pvalid_with_def by blast \n then have \"finished_item \\ \\ Gen \\\" using Gen_def mem_Collect_eq p by blast\n then have \"finished_item \\ \\ \\\" using \\_is_generated_by_\\ by blast \n with pvalid_with show ?thesis by blast\nqed\n \ntheorem Soundness:\n assumes finished_item_\\: \"finished_item \\ \\ \\\"\n shows \"\\ p. pvalid_with p (finished_item \\) 0 [] \\ p \\ ll\"\nproof -\n have \"finished_item \\ \\ Gen \\\"\n using \\_is_generated_by_\\ finished_item_\\ by auto \n then obtain p where p: \"p \\ \\ \\ pvalid p (finished_item \\)\"\n using Gen_implies_pvalid by blast \n have pvalid_p_finished_item: \"pvalid p (finished_item \\)\" using p by blast\n from iffD1[OF pvalid_def this, simplified] obtain r \\ where pvalid:\n \"wellformed_tokens p \\\n wellformed_item (finished_item \\) \\\n r \\ length p \\\n length (chars p) = length Doc \\\n chars (take r p) = [] \\\n is_derivation (take r (terminals p) @ \\ # \\) \\ derives \\ (drop r (terminals p))\"\n by blast\n have \"item_rule (finished_item \\) \\ \\\" using pvalid\n using wellformed_item_def by blast\n then have \"(\\, \\) \\ \\\" by simp \n then have is_derivation_\\: \"is_derivation \\\" by (simp add: is_derivation_def leftderives_rule)\n have drop_r_p_in_\\: \"drop r p \\ \\\"\n apply (rule drop_empty_tokens)\n using p apply blast\n using pvalid apply blast\n using pvalid apply simp\n by (metis append_Nil2 derives_trans is_derivation_\\ is_derivation_def \n is_derivation_implies_admissible is_word_terminals_drop pvalid terminals_drop)\n then have in_ll: \"drop r p \\ ll\"\n apply (auto simp add: ll_def) \n apply (metis append_Nil append_take_drop_id chars_append pvalid) \n using is_derivation_\\ pvalid\n by (metis (no_types, lifting) \\_def derives_trans is_derivation_def \n is_word_terminals_drop mem_Collect_eq terminals_drop)\n have \"pvalid_with (drop r p) (finished_item \\) 0 []\"\n apply (auto simp add: pvalid_with_def)\n using \\_wellformed drop_r_p_in_\\ apply blast \n using pvalid apply blast\n apply (metis append_Nil append_take_drop_id chars_append pvalid)\n apply (simp add: is_derivation_def)\n using pvalid by blast\n with in_ll show ?thesis by auto\nqed\n\nlemma is_finished_and_finished_item:\n assumes wellformed_x: \"wellformed_item x\"\n shows \"is_finished x = (\\ \\. x = finished_item \\)\"\nproof -\n {\n assume is_finished_x: \"is_finished x\"\n obtain \\ where \\: \"\\ = item_rhs x\" by blast\n have \"x = finished_item \\\"\n apply (rule item.expand)\n apply auto\n using \\ is_finished_def is_finished_x item_nonterminal_def item_rhs_def apply auto[1]\n using \\ assms is_complete_def is_finished_def is_finished_x wellformed_item_def apply auto[1]\n using is_finished_def is_finished_x apply blast\n using is_finished_def is_finished_x by auto\n then have \"\\ \\. x = finished_item \\\" by blast\n }\n note left_implies_right = this\n {\n assume \"\\ \\. x = finished_item \\\"\n then obtain \\ where \\: \"x = finished_item \\\" by blast\n have \"is_finished x\" by (simp add: \\ is_finished_def is_complete_def)\n }\n note right_implies_left = this\n show ?thesis using left_implies_right right_implies_left by blast\nqed \n\ntheorem Correctness:\n shows \"(ll \\ {}) = earley_recognised\"\nproof -\n have 1: \"(ll \\ {}) = (\\ \\. finished_item \\ \\ \\)\"\n using Soundness Completeness ex_in_conv by fastforce\n have 2: \"(\\ \\. finished_item \\ \\ \\) = (\\ x \\ \\. is_finished x)\"\n using \\_def is_finished_and_finished_item wellformed_items_\\ wellformed_items_def by auto\n show ?thesis using earley_recognised_def 1 2 by blast\nqed \n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LocalLexing/MainTheorems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.27340345524648235}} {"text": "(*** This file is part of Lem. eth-isabelle project just uses it. See lem-license. ***)\n\nchapter {* Generated by Lem from list.lem. *}\n\ntheory \"Lem_list\" \n\nimports \n \t Main\n\t \"Lem_bool\" \n\t \"Lem_maybe\" \n\t \"Lem_basic_classes\" \n\t \"Lem_function\" \n\t \"Lem_tuple\" \n\t \"Lem_num\" \n\t \"Lem\"\n\nbegin \n\n \n\n(*open import Bool Maybe Basic_classes Function Tuple Num*)\n\n(*open import {coq} `Coq.Lists.List`*)\n(*open import {isabelle} `$LIB_DIR/Lem`*)\n(*open import {hol} `lemTheory` `listTheory` `rich_listTheory` `sortingTheory`*)\n\n(* ========================================================================== *)\n(* Basic list functions *)\n(* ========================================================================== *)\n\n(* The type of lists as well as list literals like [], [1;2], ... are hardcoded. \n Thus, we can directly dive into derived definitions. *)\n\n\n(* ----------------------- *)\n(* cons *)\n(* ----------------------- *)\n\n(*val :: : forall 'a. 'a -> list 'a -> list 'a*)\n\n\n(* ----------------------- *)\n(* Emptyness check *)\n(* ----------------------- *)\n\n(*val null : forall 'a. list 'a -> bool*)\n(*let null l= match l with [] -> true | _ -> false end*)\n\n(* ----------------------- *)\n(* Length *)\n(* ----------------------- *)\n\n(*val length : forall 'a. list 'a -> nat*)\n(*let rec length l= \n match l with\n | [] -> 0\n | x :: xs -> (Instance_Num_NumAdd_nat.+) (length xs) 1\n end*)\n\n(* ----------------------- *)\n(* Equality *)\n(* ----------------------- *)\n\n(*val listEqual : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\n(*val listEqualBy : forall 'a. ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\n\nfun listEqualBy :: \"('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" listEqualBy eq ([]) ([]) = ( True )\"\n|\" listEqualBy eq ([]) (_ # _) = ( False )\"\n|\" listEqualBy eq (_ # _) ([]) = ( False )\"\n|\" listEqualBy eq (x # xs) (y # ys) = ( (eq x y \\ listEqualBy eq xs ys))\" \ndeclare listEqualBy.simps [simp del]\n\n\n\n(* ----------------------- *)\n(* compare *)\n(* ----------------------- *)\n\n(*val lexicographicCompare : forall 'a. Ord 'a => list 'a -> list 'a -> ordering*)\n(*val lexicographicCompareBy : forall 'a. ('a -> 'a -> ordering) -> list 'a -> list 'a -> ordering*)\n\nfun lexicographicCompareBy :: \"('a \\ 'a \\ ordering)\\ 'a list \\ 'a list \\ ordering \" where \n \" lexicographicCompareBy cmp ([]) ([]) = ( EQ )\"\n|\" lexicographicCompareBy cmp ([]) (_ # _) = ( LT )\"\n|\" lexicographicCompareBy cmp (_ # _) ([]) = ( GT )\"\n|\" lexicographicCompareBy cmp (x # xs) (y # ys) = ( (\n (case cmp x y of \n LT => LT\n | GT => GT\n | EQ => lexicographicCompareBy cmp xs ys\n )\n ))\" \ndeclare lexicographicCompareBy.simps [simp del]\n\n\n(*val lexicographicLess : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessBy less1 less_eq1 ([]) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessBy less1 less_eq1 (x # xs) (y # ys) = ( ((less1 x y) \\ ((less_eq1 x y) \\ (lexicographicLessBy less1 less_eq1 xs ys))))\" \ndeclare lexicographicLessBy.simps [simp del]\n\n\n(*val lexicographicLessEq : forall 'a. Ord 'a => list 'a -> list 'a -> bool*)\n(*val lexicographicLessEqBy : forall 'a. ('a -> 'a -> bool) -> ('a -> 'a -> bool) -> list 'a -> list 'a -> bool*)\nfun lexicographicLessEqBy :: \"('a \\ 'a \\ bool)\\('a \\ 'a \\ bool)\\ 'a list \\ 'a list \\ bool \" where \n \" lexicographicLessEqBy less1 less_eq1 ([]) ([]) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 ([]) (_ # _) = ( True )\"\n|\" lexicographicLessEqBy less1 less_eq1 (_ # _) ([]) = ( False )\"\n|\" lexicographicLessEqBy less1 less_eq1 (x # xs) (y # ys) = ( (less1 x y \\ (less_eq1 x y \\ lexicographicLessEqBy less1 less_eq1 xs ys)))\" \ndeclare lexicographicLessEqBy.simps [simp del]\n\n\n\ndefinition instance_Basic_classes_Ord_list_dict :: \" 'a Ord_class \\('a list)Ord_class \" where \n \" instance_Basic_classes_Ord_list_dict dict_Basic_classes_Ord_a = ((|\n\n compare_method = (lexicographicCompareBy \n (compare_method dict_Basic_classes_Ord_a)),\n\n isLess_method = (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isLessEqual_method = (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a)),\n\n isGreater_method = (\\ x y. (lexicographicLessBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x)),\n\n isGreaterEqual_method = (\\ x y. (lexicographicLessEqBy \n (isLess_method dict_Basic_classes_Ord_a) (isLessEqual_method dict_Basic_classes_Ord_a) y x))|) )\"\n\n\n\n(* ----------------------- *)\n(* Append *)\n(* ----------------------- *)\n\n(*val ++ : forall 'a. list 'a -> list 'a -> list 'a*) (* originally append *)\n(*let rec ++ xs ys= match xs with\n | [] -> ys\n | x :: xs' -> x :: (xs' ++ ys)\n end*)\n\n(* ----------------------- *)\n(* snoc *)\n(* ----------------------- *)\n\n(*val snoc : forall 'a. 'a -> list 'a -> list 'a*)\n(*let snoc e l= l ++ [e]*)\n\n\n(* ----------------------- *)\n(* Reverse *)\n(* ----------------------- *)\n\n(* First lets define the function [reverse_append], which is\n closely related to reverse. [reverse_append l1 l2] appends the list [l2] to the reverse of [l1].\n This can be implemented more efficienctly than appending and is\n used to implement reverse. *)\n\n(*val reverseAppend : forall 'a. list 'a -> list 'a -> list 'a*) (* originally named rev_append *)\n(*let rec reverseAppend l1 l2= match l1 with \n | [] -> l2\n | x :: xs -> reverseAppend xs (x :: l2)\n end*)\n\n(* Reversing a list *)\n(*val reverse : forall 'a. list 'a -> list 'a*) (* originally named rev *)\n(*let reverse l= reverseAppend l []*)\n\n(* ----------------------- *)\n(* Map *)\n(* ----------------------- *)\n\n(*val map_tr : forall 'a 'b. list 'b -> ('a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) map_tr :: \" 'b list \\('a \\ 'b)\\ 'a list \\ 'b list \" where \n \" map_tr rev_acc f ([]) = ( List.rev rev_acc )\"\n|\" map_tr rev_acc f (x # xs) = ( map_tr ((f x) # rev_acc) f xs )\" \nby pat_completeness auto\n\n\n(* taken from: https://blogs.janestreet.com/optimizing-list-map/ *)\n(*val count_map : forall 'a 'b. ('a -> 'b) -> list 'a -> nat -> list 'b*)\nfunction (sequential,domintros) count_map :: \"('a \\ 'b)\\ 'a list \\ nat \\ 'b list \" where \n \" count_map f ([]) ctr = ( [])\"\n|\" count_map f (hd1 # tl1) ctr = ( f hd1 # \n (if ctr <( 5000 :: nat) then count_map f tl1 (ctr +( 1 :: nat)) \n else map_tr [] f tl1))\" \nby pat_completeness auto\n\n \n(*val map : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n(*let map f l= count_map f l 0*)\n\n(* ----------------------- *)\n(* Reverse Map *)\n(* ----------------------- *)\n\n(*val reverseMap : forall 'a 'b. ('a -> 'b) -> list 'a -> list 'b*)\n\n\n(* ========================================================================== *)\n(* Folding *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* fold left *)\n(* ----------------------- *)\n\n(*val foldl : forall 'a 'b. ('a -> 'b -> 'a) -> 'a -> list 'b -> 'a*) (* originally foldl *)\n\n(*let rec foldl f b l= match l with\n | [] -> b\n | x :: xs -> foldl f (f b x) xs\nend*)\n\n\n(* ----------------------- *)\n(* fold right *)\n(* ----------------------- *)\n\n(*val foldr : forall 'a 'b. ('a -> 'b -> 'b) -> 'b -> list 'a -> 'b*) (* originally foldr with different argument order *)\n(*let rec foldr f b l= match l with\n | [] -> b\n | x :: xs -> f x (foldr f b xs)\nend*)\n\n\n(* ----------------------- *)\n(* concatenating lists *)\n(* ----------------------- *)\n\n(*val concat : forall 'a. list (list 'a) -> list 'a*) (* before also called flatten *)\n(*let concat= foldr (++) []*)\n\n\n(* -------------------------- *)\n(* concatenating with mapping *)\n(* -------------------------- *)\n\n(*val concatMap : forall 'a 'b. ('a -> list 'b) -> list 'a -> list 'b*)\n\n\n(* ------------------------- *)\n(* universal qualification *)\n(* ------------------------- *)\n\n(*val all : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally for_all *)\n(*let all P l= foldl (fun r e -> P e && r) true l*)\n\n\n\n(* ------------------------- *)\n(* existential qualification *)\n(* ------------------------- *)\n\n(*val any : forall 'a. ('a -> bool) -> list 'a -> bool*) (* originally exist *)\n(*let any P l= foldl (fun r e -> P e || r) false l*)\n\n\n(* ------------------------- *)\n(* dest_init *)\n(* ------------------------- *)\n\n(* get the initial part and the last element of the list in a safe way *)\n\n(*val dest_init : forall 'a. list 'a -> maybe (list 'a * 'a)*) \n\nfun dest_init_aux :: \" 'a list \\ 'a \\ 'a list \\ 'a list*'a \" where \n \" dest_init_aux rev_init last_elem_seen ([]) = ( (List.rev rev_init, last_elem_seen))\"\n|\" dest_init_aux rev_init last_elem_seen (x # xs) = ( dest_init_aux (last_elem_seen # rev_init) x xs )\" \ndeclare dest_init_aux.simps [simp del]\n\n\nfun dest_init :: \" 'a list \\('a list*'a)option \" where \n \" dest_init ([]) = ( None )\"\n|\" dest_init (x # xs) = ( Some (dest_init_aux [] x xs))\" \ndeclare dest_init.simps [simp del]\n\n\n\n(* ========================================================================== *)\n(* Indexing lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* index / nth with maybe *)\n(* ------------------------- *)\n\n(*val index : forall 'a. list 'a -> nat -> maybe 'a*)\n\n(*let rec index l n= match l with \n | [] -> Nothing\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then Just x else index xs ((Instance_Num_NumMinus_nat.-)n 1)\nend*)\n\n(* ------------------------- *)\n(* findIndices *)\n(* ------------------------- *)\n\n(* [findIndices P l] returns the indices of all elements of list [l] that satisfy predicate [P]. \n Counting starts with 0, the result list is sorted ascendingly *)\n(*val findIndices : forall 'a. ('a -> bool) -> list 'a -> list nat*)\n\nfun findIndices_aux :: \" nat \\('a \\ bool)\\ 'a list \\(nat)list \" where \n \" findIndices_aux (i::nat) P ([]) = ( [])\"\n|\" findIndices_aux (i::nat) P (x # xs) = ( if P x then i # findIndices_aux (i +( 1 :: nat)) P xs else findIndices_aux (i +( 1 :: nat)) P xs )\" \ndeclare findIndices_aux.simps [simp del]\n\n(*let findIndices P l= findIndices_aux 0 P l*)\n\n\n\n(* ------------------------- *)\n(* findIndex *)\n(* ------------------------- *)\n\n(* findIndex returns the first index of a list that satisfies a given predicate. *)\n(*val findIndex : forall 'a. ('a -> bool) -> list 'a -> maybe nat*)\n(*let findIndex P l= match findIndices P l with\n | [] -> Nothing\n | x :: _ -> Just x\nend*)\n\n(* ------------------------- *)\n(* elemIndices *)\n(* ------------------------- *)\n\n(*val elemIndices : forall 'a. Eq 'a => 'a -> list 'a -> list nat*)\n\n(* ------------------------- *)\n(* elemIndex *)\n(* ------------------------- *)\n\n(*val elemIndex : forall 'a. Eq 'a => 'a -> list 'a -> maybe nat*)\n\n\n(* ========================================================================== *)\n(* Creating lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* genlist *)\n(* ------------------------- *)\n\n(* [genlist f n] generates the list [f 0; f 1; ... (f (n-1))] *)\n(*val genlist : forall 'a. (nat -> 'a) -> nat -> list 'a*)\n\n\n(*let rec genlist f n= \n match n with\n | 0 -> []\n | n' + 1 -> snoc (f n') (genlist f n')\n end*)\n\n\n(* ------------------------- *)\n(* replicate *)\n(* ------------------------- *)\n\n(*val replicate : forall 'a. nat -> 'a -> list 'a*)\n(*let rec replicate n x= \n match n with\n | 0 -> []\n | n' + 1 -> x :: replicate n' x\n end*)\n\n\n(* ========================================================================== *)\n(* Sublists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* splitAt *)\n(* ------------------------- *)\n\n(* [splitAt n xs] returns a tuple (xs1, xs2), with append xs1 xs2 = xs and \n length xs1 = n. If there are not enough elements \n in [xs], the original list and the empty one are returned. *)\n(*val splitAtAcc : forall 'a. list 'a -> nat -> list 'a -> (list 'a * list 'a)*)\nfunction (sequential,domintros) splitAtAcc :: \" 'a list \\ nat \\ 'a list \\ 'a list*'a list \" where \n \" splitAtAcc revAcc n l = ( \n (case l of\n [] => (List.rev revAcc, [])\n | x # xs => if n \\( 0 :: nat) then (List.rev revAcc, l) else splitAtAcc (x # revAcc) (n-( 1 :: nat)) xs\n ))\" \nby pat_completeness auto\n\n\n(*val splitAt : forall 'a. nat -> list 'a -> (list 'a * list 'a)*)\n(*let rec splitAt n l= \n splitAtAcc [] n l*)\n\n\n(* ------------------------- *)\n(* take *)\n(* ------------------------- *)\n\n(* take n xs returns the prefix of xs of length n, or xs itself if n > length xs *)\n(*val take : forall 'a. nat -> list 'a -> list 'a*)\n(*let take n l= fst (splitAt n l)*)\n\n\n\n(* ------------------------- *)\n(* drop *)\n(* ------------------------- *)\n\n(* [drop n xs] drops the first [n] elements of [xs]. It returns the empty list, if [n] > [length xs]. *)\n(*val drop : forall 'a. nat -> list 'a -> list 'a*)\n(*let drop n l= snd (splitAt n l)*)\n\n(* ------------------------- *)\n(* dropWhile *)\n(* ------------------------- *)\n\n(* [dropWhile p xs] drops the first elements of [xs] that satisfy [p]. *)\n(*val dropWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\nfun dropWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" dropWhile p l = ( (case l of \n [] => []\n | x # xs => if p x then dropWhile p xs else l\n))\" \ndeclare dropWhile.simps [simp del]\n\n\n\n(* ------------------------- *)\n(* takeWhile *)\n(* ------------------------- *)\n\n(* [takeWhile p xs] takes the first elements of [xs] that satisfy [p]. *)\n(*val takeWhile : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\nfun takeWhile :: \"('a \\ bool)\\ 'a list \\ 'a list \" where \n \" takeWhile p ([]) = ( [])\"\n|\" takeWhile p (x # xs) = ( if p x then x # takeWhile p xs else [])\" \ndeclare takeWhile.simps [simp del]\n\n\n(* ------------------------- *)\n(* splitWhile *)\n(* ------------------------- *)\n\n(*val splitWhile : forall 'a. ('a -> bool) -> list 'a -> (list 'a * list 'a)*)\ndefinition splitWhile :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" splitWhile p xs = ( (takeWhile p xs, dropWhile p xs))\"\n\n\n\n(* ------------------------- *)\n(* isPrefixOf *)\n(* ------------------------- *)\n\n(*val isPrefixOf : forall 'a. Eq 'a => list 'a -> list 'a -> bool*)\nfun isPrefixOf :: \" 'a list \\ 'a list \\ bool \" where \n \" isPrefixOf ([]) _ = ( True )\"\n|\" isPrefixOf (_ # _) ([]) = ( False )\"\n|\" isPrefixOf (x # xs) (y # ys) = ( (x = y) \\ isPrefixOf xs ys )\" \ndeclare isPrefixOf.simps [simp del]\n\n\n(* ------------------------- *)\n(* update *)\n(* ------------------------- *)\n(*val update : forall 'a. list 'a -> nat -> 'a -> list 'a*)\n(*let rec update l n e= \n match l with\n | [] -> []\n | x :: xs -> if (Instance_Basic_classes_Eq_nat.=) n 0 then e :: xs else x :: (update xs ((Instance_Num_NumMinus_nat.-) n 1) e)\nend*)\n\n\n\n(* ========================================================================== *)\n(* Searching lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* Membership test *)\n(* ------------------------- *)\n\n(* The membership test, one of the basic list functions, is actually tricky for\n Lem, because it is tricky, which equality to use. From Lem`s point of \n perspective, we want to use the equality provided by the equality type - class.\n This allows for example to check whether a set is in a list of sets.\n\n However, in order to use the equality type class, elem essentially becomes\n existential quantification over lists. For types, which implement semantic\n equality (=) with syntactic equality, this is overly complicated. In\n our theorem prover backend, we would end up with overly complicated, harder\n to read definitions and some of the automation would be harder to apply.\n Moreover, nearly all the old Lem generated code would change and require \n (hopefully minor) adaptions of proofs.\n\n For now, we ignore this problem and just demand, that all instances of\n the equality type class do the right thing for the theorem prover backends. \n*)\n\n(*val elem : forall 'a. Eq 'a => 'a -> list 'a -> bool*)\n(*val elemBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> bool*)\n\ndefinition elemBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ bool \" where \n \" elemBy eq e l = ( ((\\ x \\ (set l). (eq e) x)))\"\n\n(*let elem= elemBy (=)*)\n\n(* ------------------------- *)\n(* Find *)\n(* ------------------------- *)\n(*val find : forall 'a. ('a -> bool) -> list 'a -> maybe 'a*) (* previously not of maybe type *)\n(*let rec find P l= match l with \n | [] -> Nothing\n | x :: xs -> if P x then Just x else find P xs\nend*)\n\n\n(* ----------------------------- *)\n(* Lookup in an associative list *)\n(* ----------------------------- *)\n(*val lookup : forall 'a 'b. Eq 'a => 'a -> list ('a * 'b) -> maybe 'b*)\n(*val lookupBy : forall 'a 'b. ('a -> 'a -> bool) -> 'a -> list ('a * 'b) -> maybe 'b*)\n\n(* DPM: eta-expansion for Coq backend type-inference. *)\ndefinition lookupBy :: \"('a \\ 'a \\ bool)\\ 'a \\('a*'b)list \\ 'b option \" where \n \" lookupBy eq k m = ( map_option (\\ x . snd x) (List.find (\\ (k', _) . eq k k') m))\"\n\n\n(* ------------------------- *)\n(* filter *)\n(* ------------------------- *)\n(*val filter : forall 'a. ('a -> bool) -> list 'a -> list 'a*)\n(*let rec filter P l= match l with\n | [] -> []\n | x :: xs -> if (P x) then x :: (filter P xs) else filter P xs\n end*)\n\n\n(* ------------------------- *)\n(* partition *)\n(* ------------------------- *)\n(*val partition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\n(*let partition P l= (filter P l, filter (fun x -> not (P x)) l)*)\n\n(*val reversePartition : forall 'a. ('a -> bool) -> list 'a -> list 'a * list 'a*)\ndefinition reversePartition :: \"('a \\ bool)\\ 'a list \\ 'a list*'a list \" where \n \" reversePartition P l = ( List.partition P (List.rev l))\"\n\n\n\n(* ------------------------- *)\n(* delete first element *)\n(* with certain property *)\n(* ------------------------- *)\n\n(*val deleteFirst : forall 'a. ('a -> bool) -> list 'a -> maybe (list 'a)*) \n(*let rec deleteFirst P l= match l with\n | [] -> Nothing\n | x :: xs -> if (P x) then Just xs else Maybe.map (fun xs' -> x :: xs') (deleteFirst P xs)\n end*)\n\n\n(*val delete : forall 'a. Eq 'a => 'a -> list 'a -> list 'a*)\n(*val deleteBy : forall 'a. ('a -> 'a -> bool) -> 'a -> list 'a -> list 'a*)\n\ndefinition deleteBy :: \"('a \\ 'a \\ bool)\\ 'a \\ 'a list \\ 'a list \" where \n \" deleteBy eq x l = ( case_option l id (delete_first (eq x) l))\"\n\n\n\n(* ========================================================================== *)\n(* Zipping and unzipping lists *)\n(* ========================================================================== *)\n\n(* ------------------------- *)\n(* zip *)\n(* ------------------------- *)\n\n(* zip takes two lists and returns a list of corresponding pairs. If one input list is short, excess elements of the longer list are discarded. *)\n(*val zip : forall 'a 'b. list 'a -> list 'b -> list ('a * 'b)*) (* before combine *)\n(*let rec zip l1 l2= match (l1, l2) with\n | (x :: xs, y :: ys) -> (x, y) :: zip xs ys\n | _ -> []\nend*)\n\n(* ------------------------- *)\n(* unzip *)\n(* ------------------------- *)\n\n(*val unzip: forall 'a 'b. list ('a * 'b) -> (list 'a * list 'b)*)\n(*let rec unzip l= match l with\n | [] -> ([], [])\n | (x, y) :: xys -> let (xs, ys) = unzip xys in (x :: xs, y :: ys)\nend*)\n\n(* ------------------------- *)\n(* distinct elements *)\n(* ------------------------- *)\n\n(*val allDistinct : forall 'a. Eq 'a => list 'a -> bool*)\nfun allDistinct :: \" 'a list \\ bool \" where \n \" allDistinct ([]) = ( True )\"\n|\" allDistinct (x # l') = ( \\ (Set.member x (set l')) \\ allDistinct l' )\" \ndeclare allDistinct.simps [simp del]\n\n\n(* some more useful functions *)\n(*val mapMaybe : forall 'a 'b. ('a -> maybe 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapMaybe :: \"('a \\ 'b option)\\ 'a list \\ 'b list \" where \n \" mapMaybe f ([]) = ( [])\"\n|\" mapMaybe f (x # xs) = (\n (case f x of\n None => mapMaybe f xs\n | Some y => y # (mapMaybe f xs)\n ))\" \nby pat_completeness auto\n\n\n(*val mapi : forall 'a 'b. (nat -> 'a -> 'b) -> list 'a -> list 'b*)\nfunction (sequential,domintros) mapiAux :: \"(nat \\ 'b \\ 'a)\\ nat \\ 'b list \\ 'a list \" where \n \" mapiAux f (n :: nat) ([]) = ( [])\"\n|\" mapiAux f (n :: nat) (x # xs) = ( (f n x) # mapiAux f (n +( 1 :: nat)) xs )\" \nby pat_completeness auto\n\ndefinition mapi :: \"(nat \\ 'a \\ 'b)\\ 'a list \\ 'b list \" where \n \" mapi f l = ( mapiAux f(( 0 :: nat)) l )\"\n\n\n(*val deletes: forall 'a. Eq 'a => list 'a -> list 'a -> list 'a*)\ndefinition deletes :: \" 'a list \\ 'a list \\ 'a list \" where \n \" deletes xs ys = (\n List.foldl ((\\ x y. remove1 y x)) xs ys )\"\n\n\n(* ========================================================================== *)\n(* Comments (not clean yet, please ignore the rest of the file) *)\n(* ========================================================================== *)\n\n(* ----------------------- *)\n(* skipped from Haskell Lib*)\n(* ----------------------- \n\nintersperse :: a -> [a] -> [a]\nintercalate :: [a] -> [[a]] -> [a]\ntranspose :: [[a]] -> [[a]]\nsubsequences :: [a] -> [[a]]\npermutations :: [a] -> [[a]]\nfoldl` :: (a -> b -> a) -> a -> [b] -> aSource\nfoldl1` :: (a -> a -> a) -> [a] -> aSource\n\nand\nor\nsum\nproduct\nmaximum\nminimum\nscanl\nscanr\nscanl1\nscanr1\nAccumulating maps\n\nmapAccumL :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\nmapAccumR :: (acc -> x -> (acc, y)) -> acc -> [x] -> (acc, [y])Source\n\niterate :: (a -> a) -> a -> [a]\nrepeat :: a -> [a]\ncycle :: [a] -> [a]\nunfoldr\n\n\ntakeWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhile :: (a -> Bool) -> [a] -> [a]Source\ndropWhileEnd :: (a -> Bool) -> [a] -> [a]Source\nspan :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak :: (a -> Bool) -> [a] -> ([a], [a])Source\nbreak p is equivalent to span (not . p).\nstripPrefix :: Eq a => [a] -> [a] -> Maybe [a]Source\ngroup :: Eq a => [a] -> [[a]]Source\ninits :: [a] -> [[a]]Source\ntails :: [a] -> [[a]]Source\n\n\nisPrefixOf :: Eq a => [a] -> [a] -> BoolSource\nisSuffixOf :: Eq a => [a] -> [a] -> BoolSource\nisInfixOf :: Eq a => [a] -> [a] -> BoolSource\n\n\n\nnotElem :: Eq a => a -> [a] -> BoolSource\n\nzip3 :: [a] -> [b] -> [c] -> [(a, b, c)]Source\nzip4 :: [a] -> [b] -> [c] -> [d] -> [(a, b, c, d)]Source\nzip5 :: [a] -> [b] -> [c] -> [d] -> [e] -> [(a, b, c, d, e)]Source\nzip6 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [(a, b, c, d, e, f)]Source\nzip7 :: [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [(a, b, c, d, e, f, g)]Source\n\nzipWith :: (a -> b -> c) -> [a] -> [b] -> [c]Source\nzipWith3 :: (a -> b -> c -> d) -> [a] -> [b] -> [c] -> [d]Source\nzipWith4 :: (a -> b -> c -> d -> e) -> [a] -> [b] -> [c] -> [d] -> [e]Source\nzipWith5 :: (a -> b -> c -> d -> e -> f) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f]Source\nzipWith6 :: (a -> b -> c -> d -> e -> f -> g) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g]Source\nzipWith7 :: (a -> b -> c -> d -> e -> f -> g -> h) -> [a] -> [b] -> [c] -> [d] -> [e] -> [f] -> [g] -> [h]Source\n\n\nunzip3 :: [(a, b, c)] -> ([a], [b], [c])Source\nunzip4 :: [(a, b, c, d)] -> ([a], [b], [c], [d])Source\nunzip5 :: [(a, b, c, d, e)] -> ([a], [b], [c], [d], [e])Source\nunzip6 :: [(a, b, c, d, e, f)] -> ([a], [b], [c], [d], [e], [f])Source\nunzip7 :: [(a, b, c, d, e, f, g)] -> ([a], [b], [c], [d], [e], [f], [g])Source\n\n\nlines :: String -> [String]Source\nwords :: String -> [String]Source\nunlines :: [String] -> StringSource\nunwords :: [String] -> StringSource\nnub :: Eq a => [a] -> [a]Source\ndelete :: Eq a => a -> [a] -> [a]Source\n\n() :: Eq a => [a] -> [a] -> [a]Source\nunion :: Eq a => [a] -> [a] -> [a]Source\nintersect :: Eq a => [a] -> [a] -> [a]Source\nsort :: Ord a => [a] -> [a]Source\ninsert :: Ord a => a -> [a] -> [a]Source\n\n\nnubBy :: (a -> a -> Bool) -> [a] -> [a]Source\ndeleteBy :: (a -> a -> Bool) -> a -> [a] -> [a]Source\ndeleteFirstsBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nunionBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\nintersectBy :: (a -> a -> Bool) -> [a] -> [a] -> [a]Source\ngroupBy :: (a -> a -> Bool) -> [a] -> [[a]]Source\nsortBy :: (a -> a -> Ordering) -> [a] -> [a]Source\ninsertBy :: (a -> a -> Ordering) -> a -> [a] -> [a]Source\nmaximumBy :: (a -> a -> Ordering) -> [a] -> aSource\nminimumBy :: (a -> a -> Ordering) -> [a] -> aSource\ngenericLength :: Num i => [b] -> iSource\ngenericTake :: Integral i => i -> [a] -> [a]Source\ngenericDrop :: Integral i => i -> [a] -> [a]Source\ngenericSplitAt :: Integral i => i -> [b] -> ([b], [b])Source\ngenericIndex :: Integral a => [b] -> a -> bSource\ngenericReplicate :: Integral i => i -> a -> [a]Source\n\n\n*)\n\n\n(* ----------------------- *)\n(* skipped from Lem Lib *)\n(* ----------------------- \n\n\nval for_all2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval exists2 : forall 'a 'b. ('a -> 'b -> bool) -> list 'a -> list 'b -> bool\nval map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c \nval rev_map2 : forall 'a 'b 'c. ('a -> 'b -> 'c) -> list 'a -> list 'b -> list 'c\nval fold_left2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'a) -> 'a -> list 'b -> list 'c -> 'a\nval fold_right2 : forall 'a 'b 'c. ('a -> 'b -> 'c -> 'c) -> list 'a -> list 'b -> 'c -> 'c\n\n\n(* now maybe result and called lookup *)\nval assoc : forall 'a 'b. 'a -> list ('a * 'b) -> 'b\nlet inline {ocaml} assoc = Ocaml.List.assoc\n\n\nval mem_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> bool\nval remove_assoc : forall 'a 'b. 'a -> list ('a * 'b) -> list ('a * 'b)\n\n\n\nval stable_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\nval fast_sort : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a\n\nval merge : forall 'a. ('a -> 'a -> num) -> list 'a -> list 'a -> list 'a\nval intersect : forall 'a. list 'a -> list 'a -> list 'a\n\n\n*)\n\n(*val catMaybes : forall 'a. list (maybe 'a) -> list 'a*)\nfunction (sequential,domintros) catMaybes :: \"('a option)list \\ 'a list \" where \n \" catMaybes ([]) = (\n [])\"\n|\" catMaybes (None # xs') = (\n catMaybes xs' )\"\n|\" catMaybes (Some x # xs') = (\n x # catMaybes xs' )\" \nby pat_completeness auto\n\nend\n", "meta": {"author": "lixm", "repo": "yul-smallstep", "sha": "f71786f5158e335f7caa3311a4928c3ac97912ee", "save_path": "github-repos/isabelle/lixm-yul-smallstep", "path": "github-repos/isabelle/lixm-yul-smallstep/yul-smallstep-f71786f5158e335f7caa3311a4928c3ac97912ee/utils/Lem_list.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2733690759923069}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory CompartmentAuthority\n\nimports \n \"CHERI-core.CheriLemmas\"\nbegin\n\n(*>*)\nsection \\Generalised permissions\\\n\nrecord CompartmentAuthority = \n SystemRegisterAccess :: bool\n ExecutableAddresses :: \"VirtualAddress set\"\n LoadableAddresses :: \"VirtualAddress set\"\n CapLoadableAddresses :: \"VirtualAddress set\"\n StorableAddresses :: \"VirtualAddress set\"\n CapStorableAddresses :: \"VirtualAddress set\"\n LocalCapStorableAddresses :: \"VirtualAddress set\"\n SealableTypes :: \"ObjectType set\"\n UnsealableTypes :: \"ObjectType set\"\n\nsubsection \\Order over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (order) order\nbegin\n\n definition less_eq_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme \\ bool\"\n where \n \"less_eq_CompartmentAuthority_ext perm\\<^sub>1 perm\\<^sub>2 \\\n (SystemRegisterAccess perm\\<^sub>1 \\ SystemRegisterAccess perm\\<^sub>2) \\\n (ExecutableAddresses perm\\<^sub>1 \\ ExecutableAddresses perm\\<^sub>2) \\\n (LoadableAddresses perm\\<^sub>1 \\ LoadableAddresses perm\\<^sub>2) \\\n (CapLoadableAddresses perm\\<^sub>1 \\ CapLoadableAddresses perm\\<^sub>2) \\\n (StorableAddresses perm\\<^sub>1 \\ StorableAddresses perm\\<^sub>2) \\\n (CapStorableAddresses perm\\<^sub>1 \\ CapStorableAddresses perm\\<^sub>2) \\\n (LocalCapStorableAddresses perm\\<^sub>1 \\ LocalCapStorableAddresses perm\\<^sub>2) \\\n (SealableTypes perm\\<^sub>1 \\ SealableTypes perm\\<^sub>2) \\\n (UnsealableTypes perm\\<^sub>1 \\ UnsealableTypes perm\\<^sub>2) \\\n (CompartmentAuthority.more perm\\<^sub>1 \\ CompartmentAuthority.more perm\\<^sub>2)\"\n \n definition less_CompartmentAuthority_ext :: \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme \\ bool\" where\n \"less_CompartmentAuthority_ext perm\\<^sub>1 perm\\<^sub>2 \\ perm\\<^sub>1 \\ perm\\<^sub>2 \\ \\ (perm\\<^sub>2 \\ perm\\<^sub>1)\"\n \n instance\n by standard (auto simp: less_CompartmentAuthority_ext_def less_eq_CompartmentAuthority_ext_def)\n\nend\n\nsubsubsection \\Eliminations\\\n\nlemma SystemRegisterAccess_le [elim]:\n assumes \"p \\ q\"\n and \"SystemRegisterAccess p\"\n shows \"SystemRegisterAccess q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemma ExecutableAddresses_le:\n assumes \"p \\ q\"\n shows \"ExecutableAddresses p \\ ExecutableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas ExecutableAddresses_le_subsetD [elim] =\n subsetD[OF ExecutableAddresses_le]\n\nlemma LoadableAddresses_le:\n assumes \"p \\ q\"\n shows \"LoadableAddresses p \\ LoadableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas LoadableAddresses_le_subsetD [elim] =\n subsetD[OF LoadableAddresses_le]\n\nlemma CapLoadableAddresses_le:\n assumes \"p \\ q\"\n shows \"CapLoadableAddresses p \\ CapLoadableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas CapLoadableAddresses_le_subsetD [elim] =\n subsetD[OF CapLoadableAddresses_le]\n\nlemma StorableAddresses_le:\n assumes \"p \\ q\"\n shows \"StorableAddresses p \\ StorableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas StorableAddresses_le_subsetD [elim] =\n subsetD[OF StorableAddresses_le]\n\nlemma CapStorableAddresses_le:\n assumes \"p \\ q\"\n shows \"CapStorableAddresses p \\ CapStorableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas CapStorableAddresses_le_subsetD [elim] =\n subsetD[OF CapStorableAddresses_le]\n\nlemma LocalCapStorableAddresses_le:\n assumes \"p \\ q\"\n shows \"LocalCapStorableAddresses p \\ LocalCapStorableAddresses q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas LocalCapStorableAddresses_le_subsetD [elim] =\n subsetD[OF LocalCapStorableAddresses_le]\n\nlemma SealableTypes_le:\n assumes \"p \\ q\"\n shows \"SealableTypes p \\ SealableTypes q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas SealableTypes_le_subsetD [elim] =\n subsetD[OF SealableTypes_le]\n\nlemma UnsealableTypes_le:\n assumes \"p \\ q\"\n shows \"UnsealableTypes p \\ UnsealableTypes q\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nby auto\n\nlemmas UnsealableTypes_le_subsetD [elim] =\n subsetD[OF UnsealableTypes_le]\n\nsubsection \\Complete lattice over generalised permissions\\\n\nsubsubsection \\Bottom of generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (order_bot) order_bot\nbegin\n\n definition bot_CompartmentAuthority_ext :: \"'a CompartmentAuthority_scheme\" where\n \"bot_CompartmentAuthority_ext = \n \\SystemRegisterAccess = bot,\n ExecutableAddresses = bot,\n LoadableAddresses = bot,\n CapLoadableAddresses = bot,\n StorableAddresses = bot,\n CapStorableAddresses = bot,\n LocalCapStorableAddresses = bot,\n SealableTypes = bot,\n UnsealableTypes = bot, \n \\ = bot\\\"\n \n instance\n by standard (auto simp: bot_CompartmentAuthority_ext_def less_eq_CompartmentAuthority_ext_def)\n\nend\n\nlemma bot_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess bot = bot\"\n and \"ExecutableAddresses bot = bot\"\n and \"LoadableAddresses bot = bot\"\n and \"CapLoadableAddresses bot = bot\"\n and \"StorableAddresses bot = bot\"\n and \"CapStorableAddresses bot = bot\"\n and \"LocalCapStorableAddresses bot = bot\"\n and \"SealableTypes bot = bot\"\n and \"UnsealableTypes bot = bot\"\n and \"more bot = bot\"\nunfolding bot_CompartmentAuthority_ext_def\nby simp_all\n\nsubsubsection \\Top of generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (order_top) order_top\nbegin\n\n definition top_CompartmentAuthority_ext :: \"'a CompartmentAuthority_scheme\" where\n \"top_CompartmentAuthority_ext = \n \\SystemRegisterAccess = top,\n ExecutableAddresses = top,\n LoadableAddresses = top,\n CapLoadableAddresses = top,\n StorableAddresses = top,\n CapStorableAddresses = top,\n LocalCapStorableAddresses = top,\n SealableTypes = top,\n UnsealableTypes = top, \n \\ = top\\\"\n \n instance\n by standard (auto simp: top_CompartmentAuthority_ext_def less_eq_CompartmentAuthority_ext_def)\n\nend\n\nlemma top_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess top = top\"\n and \"ExecutableAddresses top = top\"\n and \"LoadableAddresses top = top\"\n and \"CapLoadableAddresses top = top\"\n and \"StorableAddresses top = top\"\n and \"CapStorableAddresses top = top\"\n and \"LocalCapStorableAddresses top = top\"\n and \"SealableTypes top = top\"\n and \"UnsealableTypes top = top\"\n and \"more top = top\"\nunfolding top_CompartmentAuthority_ext_def\nby simp_all\n\nsubsubsection \\Infimum of generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (semilattice_inf) semilattice_inf\nbegin\n\n definition inf_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme\"\n where\n \"inf_CompartmentAuthority_ext left right = \n \\SystemRegisterAccess = inf (SystemRegisterAccess left) (SystemRegisterAccess right),\n ExecutableAddresses = inf (ExecutableAddresses left) (ExecutableAddresses right),\n LoadableAddresses = inf (LoadableAddresses left) (LoadableAddresses right),\n CapLoadableAddresses = inf (CapLoadableAddresses left) (CapLoadableAddresses right),\n StorableAddresses = inf (StorableAddresses left) (StorableAddresses right),\n CapStorableAddresses = inf (CapStorableAddresses left) (CapStorableAddresses right),\n LocalCapStorableAddresses = inf (LocalCapStorableAddresses left) (LocalCapStorableAddresses right),\n SealableTypes = inf (SealableTypes left) (SealableTypes right),\n UnsealableTypes = inf (UnsealableTypes left) (UnsealableTypes right), \n \\ = inf (more left) (more right)\\\"\n \n instance\n by standard (auto simp: inf_CompartmentAuthority_ext_def less_eq_CompartmentAuthority_ext_def)\n\nend\n\nlemma inf_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (inf left right) = inf (SystemRegisterAccess left) (SystemRegisterAccess right)\"\n and \"ExecutableAddresses (inf left right) = inf (ExecutableAddresses left) (ExecutableAddresses right)\"\n and \"LoadableAddresses (inf left right) = inf (LoadableAddresses left) (LoadableAddresses right)\"\n and \"CapLoadableAddresses (inf left right) = inf (CapLoadableAddresses left) (CapLoadableAddresses right)\"\n and \"StorableAddresses (inf left right) = inf (StorableAddresses left) (StorableAddresses right)\"\n and \"CapStorableAddresses (inf left right) = inf (CapStorableAddresses left) (CapStorableAddresses right)\"\n and \"LocalCapStorableAddresses (inf left right) = inf (LocalCapStorableAddresses left) (LocalCapStorableAddresses right)\"\n and \"SealableTypes (inf left right) = inf (SealableTypes left) (SealableTypes right)\"\n and \"UnsealableTypes (inf left right) = inf (UnsealableTypes left) (UnsealableTypes right)\"\n and \"more (inf left right) = inf (more left) (more right)\"\nunfolding inf_CompartmentAuthority_ext_def\nby simp_all\n\ninstantiation \"CompartmentAuthority_ext\" :: (Inf) Inf\nbegin\n\n definition Inf_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme set \\ 'a CompartmentAuthority_scheme\"\n where\n \"Inf_CompartmentAuthority_ext permSet = \n \\SystemRegisterAccess = Inf (SystemRegisterAccess ` permSet),\n ExecutableAddresses = Inf (ExecutableAddresses ` permSet),\n LoadableAddresses = Inf (LoadableAddresses ` permSet),\n CapLoadableAddresses = Inf (CapLoadableAddresses ` permSet),\n StorableAddresses = Inf (StorableAddresses ` permSet),\n CapStorableAddresses = Inf (CapStorableAddresses ` permSet),\n LocalCapStorableAddresses = Inf (LocalCapStorableAddresses ` permSet),\n SealableTypes = Inf (SealableTypes ` permSet),\n UnsealableTypes = Inf (UnsealableTypes ` permSet), \n \\ = Inf (more ` permSet)\\\"\n \n instance by standard\n\nend\n\nlemma Inf_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (Inf permSet) = Inf (SystemRegisterAccess ` permSet)\"\n and \"ExecutableAddresses (Inf permSet) = Inf (ExecutableAddresses ` permSet)\"\n and \"LoadableAddresses (Inf permSet) = Inf (LoadableAddresses ` permSet)\"\n and \"CapLoadableAddresses (Inf permSet) = Inf (CapLoadableAddresses ` permSet)\"\n and \"StorableAddresses (Inf permSet) = Inf (StorableAddresses ` permSet)\"\n and \"CapStorableAddresses (Inf permSet) = Inf (CapStorableAddresses ` permSet)\"\n and \"LocalCapStorableAddresses (Inf permSet) = Inf (LocalCapStorableAddresses ` permSet)\"\n and \"SealableTypes (Inf permSet) = Inf (SealableTypes ` permSet)\"\n and \"UnsealableTypes (Inf permSet) = Inf (UnsealableTypes ` permSet)\"\n and \"more (Inf permSet) = Inf (more ` permSet)\"\nunfolding Inf_CompartmentAuthority_ext_def\nby simp_all\n\nsubsubsection \\Supremum of generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (semilattice_sup) semilattice_sup\nbegin\n\n definition sup_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme\"\n where\n \"sup_CompartmentAuthority_ext left right = \n \\SystemRegisterAccess = sup (SystemRegisterAccess left) (SystemRegisterAccess right),\n ExecutableAddresses = sup (ExecutableAddresses left) (ExecutableAddresses right),\n LoadableAddresses = sup (LoadableAddresses left) (LoadableAddresses right),\n CapLoadableAddresses = sup (CapLoadableAddresses left) (CapLoadableAddresses right),\n StorableAddresses = sup (StorableAddresses left) (StorableAddresses right),\n CapStorableAddresses = sup (CapStorableAddresses left) (CapStorableAddresses right),\n LocalCapStorableAddresses = sup (LocalCapStorableAddresses left) (LocalCapStorableAddresses right),\n SealableTypes = sup (SealableTypes left) (SealableTypes right),\n UnsealableTypes = sup (UnsealableTypes left) (UnsealableTypes right), \n \\ = sup (more left) (more right)\\\"\n \n instance\n by standard (auto simp: sup_CompartmentAuthority_ext_def less_eq_CompartmentAuthority_ext_def)\n\nend\n\nlemma sup_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (sup left right) = sup (SystemRegisterAccess left) (SystemRegisterAccess right)\"\n and \"ExecutableAddresses (sup left right) = sup (ExecutableAddresses left) (ExecutableAddresses right)\"\n and \"LoadableAddresses (sup left right) = sup (LoadableAddresses left) (LoadableAddresses right)\"\n and \"CapLoadableAddresses (sup left right) = sup (CapLoadableAddresses left) (CapLoadableAddresses right)\"\n and \"StorableAddresses (sup left right) = sup (StorableAddresses left) (StorableAddresses right)\"\n and \"CapStorableAddresses (sup left right) = sup (CapStorableAddresses left) (CapStorableAddresses right)\"\n and \"LocalCapStorableAddresses (sup left right) = sup (LocalCapStorableAddresses left) (LocalCapStorableAddresses right)\"\n and \"SealableTypes (sup left right) = sup (SealableTypes left) (SealableTypes right)\"\n and \"UnsealableTypes (sup left right) = sup (UnsealableTypes left) (UnsealableTypes right)\"\n and \"more (sup left right) = sup (more left) (more right)\"\nunfolding sup_CompartmentAuthority_ext_def\nby simp_all\n\ninstantiation \"CompartmentAuthority_ext\" :: (Sup) Sup\nbegin\n\n definition Sup_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme set \\ 'a CompartmentAuthority_scheme\"\n where\n \"Sup_CompartmentAuthority_ext permSet = \n \\SystemRegisterAccess = Sup (SystemRegisterAccess ` permSet),\n ExecutableAddresses = Sup (ExecutableAddresses ` permSet),\n LoadableAddresses = Sup (LoadableAddresses ` permSet),\n CapLoadableAddresses = Sup (CapLoadableAddresses ` permSet),\n StorableAddresses = Sup (StorableAddresses ` permSet),\n CapStorableAddresses = Sup (CapStorableAddresses ` permSet),\n LocalCapStorableAddresses = Sup (LocalCapStorableAddresses ` permSet),\n SealableTypes = Sup (SealableTypes ` permSet),\n UnsealableTypes = Sup (UnsealableTypes ` permSet), \n \\ = Sup (more ` permSet)\\\"\n \n instance by standard\n\nend\n\nlemma Sup_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (Sup permSet) = Sup (SystemRegisterAccess ` permSet)\"\n and \"ExecutableAddresses (Sup permSet) = Sup (ExecutableAddresses ` permSet)\"\n and \"LoadableAddresses (Sup permSet) = Sup (LoadableAddresses ` permSet)\"\n and \"CapLoadableAddresses (Sup permSet) = Sup (CapLoadableAddresses ` permSet)\"\n and \"StorableAddresses (Sup permSet) = Sup (StorableAddresses ` permSet)\"\n and \"CapStorableAddresses (Sup permSet) = Sup (CapStorableAddresses ` permSet)\"\n and \"LocalCapStorableAddresses (Sup permSet) = Sup (LocalCapStorableAddresses ` permSet)\"\n and \"SealableTypes (Sup permSet) = Sup (SealableTypes ` permSet)\"\n and \"UnsealableTypes (Sup permSet) = Sup (UnsealableTypes ` permSet)\"\n and \"more (Sup permSet) = Sup (more ` permSet)\"\nunfolding Sup_CompartmentAuthority_ext_def\nby simp_all\n\nsubsubsection \\Bounded, distributive lattice over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (Lattices.lattice) Lattices.lattice\nbegin \n\n instance by standard\n\nend\n\ninstantiation \"CompartmentAuthority_ext\" :: (bounded_lattice) bounded_lattice\nbegin \n\n instance by standard\n\nend\n\ninstantiation \"CompartmentAuthority_ext\" :: (distrib_lattice) distrib_lattice\nbegin\n \n instance\n by standard\n (auto simp: sup_inf_distrib1 \n inf_CompartmentAuthority_ext_def\n sup_CompartmentAuthority_ext_def)\n\nend\n\nsubsubsection \\Boolean algebra over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (boolean_algebra) boolean_algebra\nbegin\n\n definition minus_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme\"\n where\n \"minus_CompartmentAuthority_ext left right = \n \\SystemRegisterAccess = minus (SystemRegisterAccess left) (SystemRegisterAccess right),\n ExecutableAddresses = minus (ExecutableAddresses left) (ExecutableAddresses right),\n LoadableAddresses = minus (LoadableAddresses left) (LoadableAddresses right),\n CapLoadableAddresses = minus (CapLoadableAddresses left) (CapLoadableAddresses right),\n StorableAddresses = minus (StorableAddresses left) (StorableAddresses right),\n CapStorableAddresses = minus (CapStorableAddresses left) (CapStorableAddresses right),\n LocalCapStorableAddresses = minus (LocalCapStorableAddresses left) (LocalCapStorableAddresses right),\n SealableTypes = minus (SealableTypes left) (SealableTypes right),\n UnsealableTypes = minus (UnsealableTypes left) (UnsealableTypes right), \n \\ = minus (more left) (more right)\\\"\n\n definition uminus_CompartmentAuthority_ext :: \n \"'a CompartmentAuthority_scheme \\ 'a CompartmentAuthority_scheme\"\n where\n \"uminus_CompartmentAuthority_ext perm = \n \\SystemRegisterAccess = uminus (SystemRegisterAccess perm),\n ExecutableAddresses = uminus (ExecutableAddresses perm),\n LoadableAddresses = uminus (LoadableAddresses perm),\n CapLoadableAddresses = uminus (CapLoadableAddresses perm),\n StorableAddresses = uminus (StorableAddresses perm),\n CapStorableAddresses = uminus (CapStorableAddresses perm),\n LocalCapStorableAddresses = uminus (LocalCapStorableAddresses perm),\n SealableTypes = uminus (SealableTypes perm),\n UnsealableTypes = uminus (UnsealableTypes perm), \n \\ = uminus (more perm)\\\"\n \n instance\n by standard\n (auto simp: diff_eq\n bot_CompartmentAuthority_ext_def\n top_CompartmentAuthority_ext_def\n inf_CompartmentAuthority_ext_def \n sup_CompartmentAuthority_ext_def\n minus_CompartmentAuthority_ext_def\n uminus_CompartmentAuthority_ext_def)\n\nend\n\nlemma minus_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (minus left right) = minus (SystemRegisterAccess left) (SystemRegisterAccess right)\"\n and \"ExecutableAddresses (minus left right) = minus (ExecutableAddresses left) (ExecutableAddresses right)\"\n and \"LoadableAddresses (minus left right) = minus (LoadableAddresses left) (LoadableAddresses right)\"\n and \"CapLoadableAddresses (minus left right) = minus (CapLoadableAddresses left) (CapLoadableAddresses right)\"\n and \"StorableAddresses (minus left right) = minus (StorableAddresses left) (StorableAddresses right)\"\n and \"CapStorableAddresses (minus left right) = minus (CapStorableAddresses left) (CapStorableAddresses right)\"\n and \"LocalCapStorableAddresses (minus left right) = minus (LocalCapStorableAddresses left) (LocalCapStorableAddresses right)\"\n and \"SealableTypes (minus left right) = minus (SealableTypes left) (SealableTypes right)\"\n and \"UnsealableTypes (minus left right) = minus (UnsealableTypes left) (UnsealableTypes right)\"\n and \"more (minus left right) = minus (more left) (more right)\"\nunfolding minus_CompartmentAuthority_ext_def\nby simp_all\n\nlemma uminus_CompartmentAuthority_ext_simp [simp]:\n shows \"SystemRegisterAccess (uminus perm) = uminus (SystemRegisterAccess perm)\"\n and \"ExecutableAddresses (uminus perm) = uminus (ExecutableAddresses perm)\"\n and \"LoadableAddresses (uminus perm) = uminus (LoadableAddresses perm)\"\n and \"CapLoadableAddresses (uminus perm) = uminus (CapLoadableAddresses perm)\"\n and \"StorableAddresses (uminus perm) = uminus (StorableAddresses perm)\"\n and \"CapStorableAddresses (uminus perm) = uminus (CapStorableAddresses perm)\"\n and \"LocalCapStorableAddresses (uminus perm) = uminus (LocalCapStorableAddresses perm)\"\n and \"SealableTypes (uminus perm) = uminus (SealableTypes perm)\"\n and \"UnsealableTypes (uminus perm) = uminus (UnsealableTypes perm)\"\n and \"more (uminus perm) = uminus (more perm)\"\nunfolding uminus_CompartmentAuthority_ext_def\nby simp_all\n\nsubsubsection \\Complete lattice over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (complete_lattice) complete_lattice\nbegin\n \n instance\n proof standard\n fix x :: \"'a CompartmentAuthority_ext\" and A \n assume \"x \\ A\"\n thus \"less_eq (Inf A) x\"\n unfolding Inf_CompartmentAuthority_ext_def\n unfolding less_eq_CompartmentAuthority_ext_def\n by (simp add: INF_lower)\n next\n fix z :: \"'a CompartmentAuthority_ext\" and A \n assume \"\\x. x \\ A \\ less_eq z x\"\n thus \"less_eq z (Inf A)\"\n unfolding Inf_CompartmentAuthority_ext_def\n unfolding less_eq_CompartmentAuthority_ext_def\n by (auto simp: INF_greatest)\n next\n fix x :: \"'a CompartmentAuthority_ext\" and A \n assume \"x \\ A\"\n thus \"less_eq x (Sup A)\"\n unfolding Sup_CompartmentAuthority_ext_def\n unfolding less_eq_CompartmentAuthority_ext_def\n by (auto simp: SUP_upper)\n next\n fix z :: \"'a CompartmentAuthority_ext\" and A \n assume \"\\x. x \\ A \\ less_eq x z\"\n thus \"less_eq (Sup A) z\"\n unfolding Sup_CompartmentAuthority_ext_def\n unfolding less_eq_CompartmentAuthority_ext_def\n by (auto simp: SUP_least)\n next\n show \"(Inf {}::'a CompartmentAuthority_ext) = top\"\n unfolding Inf_CompartmentAuthority_ext_def\n unfolding top_CompartmentAuthority_ext_def\n by simp\n next\n show \"(Sup {}::'a CompartmentAuthority_ext) = bot\"\n unfolding Sup_CompartmentAuthority_ext_def\n unfolding bot_CompartmentAuthority_ext_def\n by simp\n qed\n\nend\n\nsubsubsection \\Complete distributive lattice over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (complete_distrib_lattice) complete_distrib_lattice\nbegin\n \n instance\n proof standard\n fix x :: \"'a CompartmentAuthority_ext\" and A \n show \"sup x (Inf A) = (INF a:A. sup x a)\"\n unfolding Inf_CompartmentAuthority_ext_def\n unfolding sup_CompartmentAuthority_ext_def\n using sup_Inf[where a=\"CompartmentAuthority.more x\"]\n by simp\n next\n fix x :: \"'a CompartmentAuthority_ext\" and A \n show \"inf x (Sup A) = (SUP a:A. inf x a)\"\n unfolding Sup_CompartmentAuthority_ext_def\n unfolding inf_CompartmentAuthority_ext_def\n using inf_Sup[where a=\"CompartmentAuthority.more x\"]\n by simp\n qed\n\nend\n\nsubsubsection \\Complete boolean algebra over generalised permissions\\\n\ninstantiation \"CompartmentAuthority_ext\" :: (complete_boolean_algebra) complete_boolean_algebra\nbegin\n \n instance by standard\n\nend\n\nsubsection \\Physical capability addresses\\\n\ndefinition getTranslateCapAddresses :: \n \"VirtualAddress set \\ AccessType \\ state \\ PhysicalCapAddress set\" \nwhere\n \"getTranslateCapAddresses addrs t s \\ \n GetCapAddress ` getTranslateAddresses addrs t s\"\n\nlemma Commute_getTranslateCapAddresses [Commute_compositeI]: \n assumes \"Commute (read_state (getTranslateAddresses addrs t)) m\"\n shows \"Commute (read_state (getTranslateCapAddresses addrs t)) m\"\nusing assms\nunfolding getTranslateCapAddresses_def Commute_def\nby auto\n\nlemma getTranslateCapAddressesI [intro?]:\n assumes \"getTranslateAddr (virtualAddress, t) s = Some physicalAddress\"\n and \"a = GetCapAddress physicalAddress\"\n and \"virtualAddress \\ addrs\"\n shows \"a \\ getTranslateCapAddresses addrs t s\"\nusing assms\nunfolding getTranslateCapAddresses_def\nunfolding getTranslateAddresses_def\nby auto\n\nlemma getTranslateCapAddressesI_word_cat [elim]:\n assumes \"getTranslateAddr (virtualAddress, t) s = Some (ExtendCapAddress a)\"\n and \"virtualAddress \\ addrs\"\n shows \"a \\ getTranslateCapAddresses addrs t s\"\nusing assms\nusing slice_cat1[where a=a and b=\"0::5 word\" and 'a=40]\nby (intro getTranslateCapAddressesI) (auto simp: word_size)\n\nlemma getTranslateCapAddressesE [elim]:\n assumes \"a \\ getTranslateCapAddresses addrs t s\"\n obtains virtualAddress physicalAddress\n where \"getTranslateAddr (virtualAddress, t) s = Some physicalAddress\"\n and \"virtualAddress \\ addrs\" \n and \"a = GetCapAddress physicalAddress\"\nusing assms\nunfolding getTranslateCapAddresses_def\nby auto\n\nlemma getTranslateCapAddresses_le:\n assumes \"addrs \\ addrs'\"\n shows \"getTranslateCapAddresses addrs t s \\ getTranslateCapAddresses addrs' t s\"\nusing assms\nunfolding getTranslateCapAddresses_def\nby auto\n\nlemmas getTranslateCapAddresses_le_subsetD [elim] =\n subsetD[OF getTranslateCapAddresses_le]\n\nlemma getTranslateCapAddresses_eqI_getTranslateAddr:\n assumes \"\\a. getTranslateAddr a s' = getTranslateAddr a s\"\n shows \"getTranslateCapAddresses addrs t s' = getTranslateCapAddresses addrs t s\"\nusing getTranslateAddresses_eqI_getTranslateAddr[OF assms]\nunfolding getTranslateCapAddresses_def\nby simp\n\nlemma getTranslateCapAddresses_distrib_union:\n shows \"getTranslateCapAddresses (addrs \\ addrs') t s =\n (getTranslateCapAddresses addrs t s \\ getTranslateCapAddresses addrs' t s)\"\nunfolding getTranslateCapAddresses_def\nunfolding getTranslateAddresses_distrib_union\nby auto\n\nlemma getTranslateCapAddresses_distrib_Union:\n shows \"getTranslateCapAddresses (\\addrsSet) t s =\n (\\addrs\\addrsSet. getTranslateCapAddresses addrs t s)\"\nunfolding getTranslateCapAddresses_def\nunfolding getTranslateAddresses_distrib_Union\nby auto\n\nsubsection \\Data writable addresses\\\n\ndefinition StorablePhysAddresses where\n \"StorablePhysAddresses gperm s \\\n getTranslateAddresses (StorableAddresses gperm) STORE s\"\n\nlemma StorablePhysAddresses_le:\n assumes \"p \\ q\"\n shows \"StorablePhysAddresses p s \\ StorablePhysAddresses q s\"\nusing getTranslateAddresses_le[OF StorableAddresses_le[OF assms]]\nunfolding StorablePhysAddresses_def\nby auto\n\nsubsection \\Capability writable addresses\\\n\ndefinition StorablePhysCapAddresses where\n \"StorablePhysCapAddresses gperm s \\\n getTranslateCapAddresses (StorableAddresses gperm) STORE s\"\n\nlemma StorablePhysCapAddresses_le:\n assumes \"p \\ q\"\n shows \"StorablePhysCapAddresses p s \\ StorablePhysCapAddresses q s\"\nusing StorableAddresses_le[OF assms]\nusing getTranslateCapAddresses_le\nunfolding StorablePhysCapAddresses_def\nby auto\n\nsubsection \\Always accessible registers\\\n\ndefinition RegisterIsAlwaysAccessible :: \"CapRegister \\ bool\" where\n \"RegisterIsAlwaysAccessible r \\ \n case r of RegSpecial cd \\ cd = 0 \\ cd = 1\n | _ \\ True\"\n\nlemma RegisterIsAlwaysAccessible_simps [simp]:\n shows \"RegisterIsAlwaysAccessible RegPCC\"\n and \"RegisterIsAlwaysAccessible RegBranchDelayPCC\"\n and \"RegisterIsAlwaysAccessible RegBranchToPCC\"\n and \"RegisterIsAlwaysAccessible (RegGeneral cd)\"\n and \"RegisterIsAlwaysAccessible (RegSpecial 0)\"\n and \"RegisterIsAlwaysAccessible (RegSpecial 1)\"\nunfolding RegisterIsAlwaysAccessible_def\nby simp_all\n\nsubsection \\Readable locations\\\n\ndefinition ReadableLocations :: \"CompartmentAuthority \\ state \\ CapLocation set\" where\n \"ReadableLocations f s \\ \n {loc. case loc of \n LocReg r \\ RegisterIsAlwaysAccessible r\n | LocMem addr \\ addr \\ getTranslateCapAddresses (CapLoadableAddresses f) LOAD s}\"\n\nlemma Commute_ReadableLocations [Commute_compositeI]: \n assumes \"\\addrs. Commute (read_state (getTranslateCapAddresses addrs LOAD)) m\"\n shows \"Commute (read_state (ReadableLocations perm)) m\"\nusing assms\nunfolding ReadableLocations_def Commute_def\nby auto\n\nlemma ReadableLocations_simps [simp]:\n shows \"(LocReg r) \\ ReadableLocations f s = \n (RegisterIsAlwaysAccessible r)\"\n and \"(LocMem addr) \\ ReadableLocations f s = \n (addr \\ getTranslateCapAddresses (CapLoadableAddresses f) LOAD s)\"\nunfolding ReadableLocations_def\nby simp_all\n\nlemma ReadableLocations_le_subsetD [elim]:\n assumes \"p \\ q\"\n and \"loc \\ ReadableLocations p s\"\n shows \"loc \\ ReadableLocations q s\"\nproof (cases loc)\n case LocReg\n thus?thesis \n using assms by auto\nnext\n case (LocMem a)\n have \"CapLoadableAddresses p \\ CapLoadableAddresses q\"\n using assms by auto\n from getTranslateCapAddresses_le[OF this]\n show ?thesis\n using LocMem assms(2)\n by auto\nqed\n\nlemma ReadableLocations_le:\n assumes \"p \\ q\"\n shows \"ReadableLocations p s \\ ReadableLocations q s\"\nusing ReadableLocations_le_subsetD[OF assms]\nby auto\n\nsubsection \\Readable capabilities\\\n\ndefinition ReadableCaps where\n \"ReadableCaps perm s \\\n {getCap loc s \n |loc. loc \\ ReadableLocations perm s \\ getTag (getCap loc s)}\"\n\nlemma ReadableCapsI [intro?]:\n assumes \"cap = getCap loc s\"\n and \"loc \\ ReadableLocations perm s\"\n and \"getTag cap\"\n shows \"cap \\ ReadableCaps perm s\"\nusing assms\nunfolding ReadableCaps_def\nby auto\n\nlemma ReadableCapsI_loc [elim!]:\n assumes \"loc \\ ReadableLocations perm s\"\n and \"getTag (getCap loc s)\"\n shows \"getCap loc s \\ ReadableCaps perm s\"\nusing assms\nunfolding ReadableCaps_def\nby auto\n\nlemma ReadableCapsE_tag [elim!]:\n assumes \"cap \\ ReadableCaps perm s\"\n shows \"getTag cap\"\nusing assms\nunfolding ReadableCaps_def\nby auto\n\nlemma ReadableCapsE_loc [elim]:\n assumes \"cap \\ ReadableCaps perm s\"\n obtains loc where \"cap = getCap loc s\"\n \"loc \\ ReadableLocations perm s\"\nusing assms\nunfolding ReadableCaps_def\nby auto\n\nlemma ReadableCaps_le_subsetD [elim]:\n assumes \"p \\ q\"\n and \"cap \\ ReadableCaps p s\"\n shows \"cap \\ ReadableCaps q s\"\nusing assms\nunfolding ReadableCaps_def\nby auto\n\nlemma ReadableCaps_le:\n assumes \"p \\ q\"\n shows \"ReadableCaps p s \\ ReadableCaps q s\"\nusing assms\nby auto\n\nsubsection \\Generalised permissions of capabilities\\\n\ndefinition GetAuthority :: \"Capability \\ CompartmentAuthority\" where\n \"GetAuthority cap \\ \n if getTag cap\n then let perms = getPerms cap in\n \\SystemRegisterAccess = Access_System_Registers perms,\n ExecutableAddresses = if Permit_Execute perms then RegionOfCap cap else {},\n LoadableAddresses = if Permit_Load perms then RegionOfCap cap else {},\n CapLoadableAddresses = if Permit_Load_Capability perms then RegionOfCap cap else {},\n StorableAddresses = if Permit_Store perms then RegionOfCap cap else {},\n CapStorableAddresses = if Permit_Store_Capability perms then RegionOfCap cap else {},\n LocalCapStorableAddresses = if Permit_Store_Local_Capability perms then RegionOfCap cap else {},\n SealableTypes = if Permit_Seal perms then {t. ucast t \\ RegionOfCap cap} else {},\n UnsealableTypes = if Permit_Unseal perms then {t. ucast t \\ RegionOfCap cap} else {}\\\n else bot\"\n\nlemma GetAuthority_accessors:\n shows \"SystemRegisterAccess (GetAuthority cap) = \n (getTag cap \\ Access_System_Registers (getPerms cap))\"\n and \"ExecutableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Execute (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"LoadableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Load (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"CapLoadableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Load_Capability (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"StorableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Store (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"CapStorableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Store_Capability (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"LocalCapStorableAddresses (GetAuthority cap) = \n (if getTag cap \\ Permit_Store_Local_Capability (getPerms cap) \n then RegionOfCap cap else {})\"\n and \"SealableTypes (GetAuthority cap) = \n (if getTag cap \\ Permit_Seal (getPerms cap) \n then {t. ucast t \\ RegionOfCap cap} else {})\"\n and \"UnsealableTypes (GetAuthority cap) = \n (if getTag cap \\ Permit_Unseal (getPerms cap) \n then {t. ucast t \\ RegionOfCap cap} else {})\"\nunfolding GetAuthority_def Let_def\nby simp_all\n\nlemma GetAuthority_setMember_simp [simp]:\n shows \"GetAuthority (setSealed (cap, v1)) = GetAuthority cap\"\n and \"GetAuthority (setType (cap, v2)) = GetAuthority cap\"\n and \"GetAuthority (setOffset (cap, v3)) = GetAuthority cap\"\n and \"GetAuthority (setUPerms (cap, v5)) = GetAuthority cap\"\n and \"GetAuthority (setTag (cap, False)) = bot\"\nunfolding GetAuthority_def\nby (simp_all cong: cong)\n\nlemma GetAuthority_le [intro]:\n assumes \"cap' \\ cap\"\n shows \"GetAuthority cap' \\ GetAuthority cap\"\nproof (cases \"getTag cap'\")\n case False\n hence \"GetAuthority cap' = bot\"\n unfolding GetAuthority_def\n by simp\n thus ?thesis by auto\nnext\n case True\n have tag: \"getTag cap\" \n and segment: \"RegionOfCap cap' \\ RegionOfCap cap\" \n and perms: \"getPerms cap' \\ getPerms cap\"\n using True assms\n by auto\n have *: \"(if b then RegionOfCap cap' else {}) \\ \n (if b' then RegionOfCap cap else {})\"\n if \"RegionOfCap cap' \\ {} \\ b \\ b'\" for b b'\n using segment that by auto\n have \"(if b then ({t. ucast t \\ RegionOfCap cap'}::ObjectType set) else {}) \\ \n (if b' then {t. ucast t \\ RegionOfCap cap} else {})\"\n if \"RegionOfCap cap' \\ {} \\ b \\ b'\" for b b'\n using segment that by auto\n thus ?thesis \n using True tag perms *\n unfolding less_eq_CompartmentAuthority_ext_def\n unfolding less_eq_Perms_ext_alt\n by (strong_cong_simp add: GetAuthority_accessors)\nqed\n\ndefinition GetAuthorityOfCaps where\n \"GetAuthorityOfCaps caps \\ Sup {GetAuthority cap |cap. cap \\ caps}\"\n\nlemma GetAuthorityOfCaps_empty [simp]:\n shows \"GetAuthorityOfCaps {} = bot\"\nunfolding GetAuthorityOfCaps_def\nby simp\n\nlemma GetAuthorityOfCaps_singleton [simp]:\n shows \"GetAuthorityOfCaps {cap} = GetAuthority cap\"\nunfolding GetAuthorityOfCaps_def\nby simp\n\nlemma GetAuthorityOfCaps_accessors [simp]:\n shows \"SystemRegisterAccess (GetAuthorityOfCaps caps) = (\\cap\\caps. SystemRegisterAccess (GetAuthority cap))\"\n and \"ExecutableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. ExecutableAddresses (GetAuthority cap))\"\n and \"LoadableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. LoadableAddresses (GetAuthority cap))\"\n and \"CapLoadableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. CapLoadableAddresses (GetAuthority cap))\"\n and \"StorableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. StorableAddresses (GetAuthority cap))\"\n and \"CapStorableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. CapStorableAddresses (GetAuthority cap))\"\n and \"LocalCapStorableAddresses (GetAuthorityOfCaps caps) = (\\cap\\caps. LocalCapStorableAddresses (GetAuthority cap))\"\n and \"SealableTypes (GetAuthorityOfCaps caps) = (\\cap\\caps. SealableTypes (GetAuthority cap))\"\n and \"UnsealableTypes (GetAuthorityOfCaps caps) = (\\cap\\caps. UnsealableTypes (GetAuthority cap))\"\n and \"more (GetAuthorityOfCaps caps) = Sup (more ` GetAuthority ` caps)\"\nunfolding GetAuthorityOfCaps_def\nby auto\n\nlemma GetAuthorityOfCaps_subset [elim!]:\n assumes \"caps \\ caps'\"\n shows \"GetAuthorityOfCaps caps \\ GetAuthorityOfCaps caps'\"\nusing assms\nunfolding less_eq_CompartmentAuthority_ext_def\nunfolding GetAuthorityOfCaps_def\nunfolding Sup_CompartmentAuthority_ext_def\nby auto\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/properties/CompartmentAuthority.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27329861401810696}} {"text": "(* Title: HOL/Auth/n_mutualExFsm_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_inv__2_on_rules imports n_mutualExFsm_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0. p__Inv0\\N\\f=inv__2 p__Inv0)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_fsm i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_fsm i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_fsmVsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358685621719, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.27311690372846986}} {"text": "theory System_scheduler\n imports ext_Complementlemma AssumeGuarantee\nbegin\n\ntype_synonym tid = real\n\ndatatype status =\n WAIT | READY | RUNNING\n\n\ndatatype estate =\n Sch (pool:\"(real \\ tid) list\") (run_now:tid) (run_prior:real)\n| Task (status:status) (entered:nat) (task_prior:real)\n| None\n\nfun sched_push :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_push t (Sch p rn rp) s = Sch (p @ [(s (CHR ''p''), t)]) rn rp\"\n| \"sched_push t (Task st ent tp) s = undefined\"\n| \"sched_push t None s = undefined\"\n\nfun sched_assign :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_assign t (Sch p rn rp) s = Sch p t (s (CHR ''p''))\"\n| \"sched_assign t (Task st ent tp) s = undefined\"\n| \"sched_assign t None s = undefined\"\n\nfun get_max_default :: \"real \\ tid \\ (real \\ tid) list \\ real \\ tid\" where\n \"get_max_default (prior, t) [] = (prior, t)\"\n| \"get_max_default (prior, t) ((prior2, t2) # rest) =\n (if prior \\ prior2 then\n get_max_default (prior, t) rest\n else\n get_max_default (prior2, t2) rest)\"\n\nfun get_max :: \"(real \\ tid) list \\ real \\ tid\" where\n \"get_max [] = (-1, -1)\"\n| \"get_max ((prior, t) # rest) = get_max_default (prior, t) rest\"\n\nfun del_proc :: \"(real \\ tid) list \\ tid \\ (real \\ tid) list\" where\n \"del_proc [] t = []\"\n| \"del_proc ((prior, t) # rest) t2 =\n (if t = t2 then rest\n else (prior, t) # del_proc rest t2)\"\n\nfun sched_get_max :: \"estate \\ state \\ estate\" where\n \"sched_get_max (Sch p rn rp) s =\n (let (prior, t) = get_max p in Sch (del_proc p t) t prior)\"\n| \"sched_get_max (Task st ent tp) s = undefined\"\n| \"sched_get_max None s = undefined\"\n\nfun sched_clear :: \"estate \\ state \\ estate\" where\n \"sched_clear (Sch p rn rp) s = Sch [] (-1) (-1)\"\n| \"sched_clear (Task st ent tp) s = undefined\"\n| \"sched_clear None s = undefined\"\n\nfun sched_del_proc :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_del_proc t (Sch p rn rp) s = Sch (del_proc p t) rn rp\"\n| \"sched_del_proc t (Task st ent tp) s = undefined\"\n| \"sched_del_proc t None s = undefined\"\n\ndefinition req_ch :: \"tid \\ string\" where\n \"req_ch tid = (\n if tid = 1 then ''reqProcessor1''\n else if tid = 2 then ''reqProcessor2''\n else if tid = 3 then ''reqProcessor3''\n else undefined)\"\n\ndefinition preempt_ch :: \"tid \\ string\" where\n \"preempt_ch tid = (\n if tid = 1 then ''preempt1''\n else if tid = 2 then ''preempt2''\n else if tid = 3 then ''preempt3''\n else undefined)\"\n\ndefinition run_ch :: \"tid \\ string\" where\n \"run_ch tid = (\n if tid = 1 then ''run1''\n else if tid = 2 then ''run2''\n else if tid = 3 then ''run3''\n else undefined)\"\n\ndefinition free_ch :: \"tid \\ string\" where\n \"free_ch tid = (\n if tid = 1 then ''free1''\n else if tid = 2 then ''free2''\n else if tid = 3 then ''free3''\n else undefined)\"\n\n\ndefinition exit_ch :: \"tid \\ string\" where\n \"exit_ch tid = (\n if tid = 1 then ''exit1''\n else if tid = 2 then ''exit2''\n else if tid = 3 then ''exit3''\n else undefined)\"\n\ninductive sched_assn :: \"estate \\ state \\ estate tassn\" where\n \"sched_assn (Sch p rn rp) start_s []\"\n| \"start_es = Sch p rn rp \\\n rp \\ prior \\\n t \\ {1, 2, 3} \\\n In\\<^sub>t (EState (start_es, start_s)) (req_ch t) prior blk1 \\\n sched_assn (sched_push t start_es start_s) start_s rest \\\n sched_assn start_es start_s (blk1 @ rest)\"\n| \"start_es = Sch p rn rp \\\n rp < prior \\\n t \\ {1, 2, 3} \\\n In\\<^sub>t (EState (start_es, start_s)) (req_ch t) prior blk1 \\\n if run_now start_es \\ -1 then\n Out\\<^sub>t (EState (start_es, start_s)) (preempt_ch (run_now start_es)) 0 blk2\n else\n emp\\<^sub>t blk2 \\\n Out\\<^sub>t (EState (sched_assign t start_es (start_s(CHR ''p'' := prior)), start_s(CHR ''p'' := prior)))\n (run_ch t) 0 blk3 \\\n sched_assn (sched_assign t start_es (start_s(CHR ''p'' := prior)))\n (start_s(CHR ''p'' := prior)) rest \\\n sched_assn start_es start_s (blk1 @ blk2 @ blk3 @ rest)\"\n| \"start_es = Sch p rn rp \\\n length p > 0 \\\n In\\<^sub>t (EState (start_es, start_s)) (free_ch t) 0 blk1 \\\n Out\\<^sub>t (EState (sched_get_max start_es start_s, start_s)) \n (run_ch (run_now (sched_get_max start_es start_s))) 0 blk2 \\\n sched_assn (sched_get_max start_es start_s) start_s rest \\\n sched_assn start_es start_s (blk1 @ blk2 @ rest)\"\n| \"start_es = Sch p rn rp \\\n length p = 0 \\\n In\\<^sub>t (EState (start_es, start_s)) (free_ch t) 0 blk1 \\\n sched_assn (sched_clear start_es start_s) start_s rest \\\n sched_assn start_es start_s (blk1 @ rest)\"\n| \"start_es = Sch p rn rp \\\n In\\<^sub>t (EState (start_es, start_s)) (exit_ch t) 0 blk1 \\ \n sched_assn (sched_del_proc t start_es start_s) start_s rest \\ \n sched_assn start_es start_s (blk1 @ rest)\"\n\n\ndefinition dispatch_ch :: \"tid \\ string\" where\n \"dispatch_ch tid = (\n if tid = 1 then ''dis1''\n else if tid = 2 then ''dis2''\n else if tid = 3 then ''dis3''\n else undefined)\"\n\ndefinition tid_set :: \"tid set\" where \"tid_set = {1,2,3}\"\n\nlemma ch_dist:\"dispatch_ch t \\ run_ch t\" \"dispatch_ch t \\ req_ch t\" \n \"dispatch_ch t \\ exit_ch t\" \"dispatch_ch t \\ preempt_ch t\"\n \"dispatch_ch t \\ free_ch t\"\n \"run_ch t \\ dispatch_ch t\" \"req_ch t \\ dispatch_ch t\" \n \"exit_ch t \\ dispatch_ch t\" \"preempt_ch t \\ dispatch_ch t\"\n \"free_ch t \\ dispatch_ch t\"\n if cond:\"t\\tid_set\"\n using cond\n unfolding dispatch_ch_def run_ch_def req_ch_def exit_ch_def preempt_ch_def free_ch_def tid_set_def \n by auto\n\ninductive task_assn :: \"tid \\ estate \\ state \\ estate tassn\" where\n \"task_assn t (Task st ent tp) start_s []\"\n| \"start_es = Task WAIT ent tp \\\n In\\<^sub>t (EState (start_es, start_s)) (dispatch_ch t) 0 blk1 \\\n task_assn t (Task READY 0 tp) (start_s(CHR ''t'' := 0)) rest \\\n task_assn t start_es start_s (blk1 @ rest)\"\n(*\n| \"start_es = Task WAIT ent tp \\\n (d::real) > 0 \\\n blk1 = WaitBlk (ereal d) (\\_. EState (start_es, start_s)) ({}, {dispatch_ch t}) \\\n task_assn t start_es start_s rest \\\n task_assn t start_es start_s (blk1 # rest)\"\n*)\n(*\n| \"start_es = Task READY ent tp \\\n init_t = start_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n Out\\<^sub>t (EState (start_es, start_s)) (req_ch t) tp blk1 \\\n WaitIn\\<^sub>t wt start_es (\\t. start_s(CHR ''t'' := init_t + t)) (run_ch t) 0 ({}, {run_ch t}) blk2 \\\n task_assn t (Task RUNNING ent tp) (start_s(CHR ''t'' := init_t + wt)) rest \\\n task_assn t start_es start_s (blk1 @ blk2 @ rest)\"\n*)\n| \"start_es = Task READY ent tp \\\n init_t = start_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n Waitout\\<^sub>t d (\\_ . EState (start_es, start_s)) (req_ch t) tp ({req_ch t}, {}) blk1 \\\n d = 0 \\ Waitin\\<^sub>t wt (\\_ . EState (start_es, start_s(CHR ''t'' := init_t + t))) (run_ch t) 0 ({}, {run_ch t}) blk2 \\\n d = 0 \\ task_assn t (Task RUNNING ent tp) (start_s(CHR ''t'' := init_t + wt)) rest \\\n task_assn t start_es start_s (blk1 @ blk2 @ rest)\"\n| \"start_es = Task READY ent tp \\\n init_t = start_s (CHR ''t'') \\\n wt = 0.045 - init_t \\\n Out\\<^sub>t (EState (start_es, start_s)) (req_ch t) tp blk1 \\\n Wait\\<^sub>t wt (\\t. EState (start_es, start_s(CHR ''t'' := init_t + t))) ({run_ch t}, {}) blk2 \\\n Out\\<^sub>t (EState (start_es, start_s(CHR ''t'' := 0.45))) (exit_ch t) 0 blk3 \\\n task_assn t (Task WAIT ent tp) (start_s(CHR ''t'' := 0.45)) rest \\\n task_assn t start_es start_s (blk1 @ blk2 @ blk3 @ rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = start_s (CHR ''t'') \\\n init_c = start_s (CHR ''c'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.01 - init_c \\\n WaitIn\\<^sub>t wt start_es (\\t. start_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t))\n (preempt_ch t) 0 ({preempt_ch t}, {}) blk1 \\\n task_assn t (Task READY 1 tp) (start_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt))\n rest \\\n task_assn t start_es start_s (blk1 @ rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = start_s (CHR ''t'') \\\n init_c = start_s (CHR ''c'') \\\n if 0.045 - init_t \\ 0.01 - init_c then\n wt = 0.01 - init_c\n else\n wt = 0.045 - init_t \\\n Wait\\<^sub>t wt (\\t. EState (start_es, start_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))\n ({preempt_ch t}, {}) blk1 \\\n Out\\<^sub>t (EState (start_es, start_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt)))\n (free_ch t) 0 blk2 \\\n task_assn t (Task WAIT 1 tp) (start_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt))\n rest \\\n task_assn t start_es start_s (blk1 @ blk2 @ rest)\"\n\ninductive_cases task_assnE: \"task_assn t task_es task_s tr\"\ninductive_cases task_assn_waitE: \"task_assn t (Task WAIT x2 x3) task_s tr1\"\n\n(*\nt := 0\n(\n ;\n t := 0;\n dis[tid]!\n)**\n*)\n\ninductive dispatch_assn :: \"tid \\ state \\ estate tassn\" where\n \"dispatch_assn t start_s []\"\n (* Case for finishing a period *)\n| \"init_t = start_s (CHR ''t'') \\\n init_t < 0.045 \\\n wt = 0.045 - init_t \\\n Wait\\<^sub>t wt (\\t. EState (None, start_s(CHR ''t'' := init_t + t))) ({}, {}) blk1 \\\n Out\\<^sub>t (EState (None, start_s(CHR ''t'' := 0))) (dispatch_ch t) 0 blk2 \\\n dispatch_assn t (start_s(CHR ''t'' := 0)) rest \\\n dispatch_assn t start_s (blk1 @ blk2 @ rest)\"\n (* Case for running part of a period \n| \"init_t = start_s (CHR ''t'') \\\n init_t < 0.045 \\\n wt < 0.045 - init_t \\\n wt \\ 0 \\\n Wait\\<^sub>t wt (\\t. EState (None, start_s(CHR ''t'' := init_t + t))) ({}, {}) blk1 \\\n dispatch_assn t (start_s(CHR ''t'' := init_t + wt)) rest \\\n dispatch_assn t start_s (blk1 @ rest)\"*)\n\ninductive task_dis_assn :: \"tid \\ state \\ estate \\ state \\ estate tassn\" where\n \"task_dis_assn t dis_s task_es task_s []\"\n| \"task_es = Task WAIT ent tp \\\n dis_t = dis_s (CHR ''t'') \\\n wt = 0.045 - dis_t \\\n Wait\\<^sub>t wt (\\t. ParState (EState (task_es, task_s))\n (EState (None, dis_s(CHR ''t'' := dis_t + t))))\n ({}, {dispatch_ch t}) blk1 \\\n IO\\<^sub>t (dispatch_ch t) 0 blk2 \\\n task_dis_assn t (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0))\n rest \\\n task_dis_assn t dis_s task_es task_s (blk1 @ blk2 @ rest)\"\n| \"task_es = Task READY ent tp \\\n init_task_t = task_s (CHR ''t'') \\\n dis_t = dis_s (CHR ''t'') \\\n wt \\ 0.045 - init_task_t \\\n Waitout\\<^sub>t d (\\_. ParState (EState (task_es, task_s))(EState (None,dis_s(CHR ''t'' := dis_t + t)))) (req_ch t) tp ({req_ch t}, {}) blk1 \\\n d=0 \\ Waitin\\<^sub>t wt (\\t. ParState (EState (task_es,task_s(CHR ''t'' := init_t + t))) (EState (None, dis_s(CHR ''t'' := dis_t + t)))) (run_ch t) 0 ({}, {run_ch t}) blk2 \\\n d=0 \\ task_dis_assn t (dis_s(CHR ''t'' := dis_t + wt)) (Task RUNNING ent tp) (task_s(CHR ''t'' := init_t + wt)) rest \\\n task_dis_assn t dis_s task_es task_s (blk1 @ blk2 @ rest)\"\n| \"task_es = Task READY ent tp \\\n init_task_t = task_s (CHR ''t'') \\\n init_dis_t = dis_s (CHR ''t'') \\\n wt = 0.045 - init_task_t \\\n Out\\<^sub>t (EState (task_es, task_s)) (req_ch t) tp blk1 \\\n Wait\\<^sub>t wt (\\t. ParState (EState (task_es,task_s(CHR ''t'' := init_t + t))) (EState (None, dis_s(CHR ''t'' := dis_t + t)))) ({run_ch t}, {}) blk2 \\\n Out\\<^sub>t (EState (task_es, task_s(CHR ''t'' := 0.45))) (exit_ch t) 0 blk3 \\\n task_dis_assn t (dis_s(CHR ''t'' := dis_t + wt)) (Task WAIT ent tp) (task_s(CHR ''t'' := init_t + wt)) rest \\\n task_dis_assn t dis_s task_es task_s (blk1 @ blk2 @ blk3 @ rest)\"\n| \"task_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.01 - init_c \\\n init_dis_t = dis_s (CHR ''t'') \\\n Waitin\\<^sub>t wt (\\t. EState (task_es,task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))\n (preempt_ch t) 0 ({preempt_ch t}, {}) blk1 \\\n task_dis_assn t (dis_s(CHR ''t'' := dis_t + wt)) (Task READY 1 tp) (task_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt))\n rest \\\n task_dis_assn t dis task_es task_s (blk1 @ rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n if 0.045 - init_t \\ 0.01 - init_c then\n wt = 0.01 - init_c\n else\n wt = 0.045 - init_t \\\n init_dis_t = dis_s (CHR ''t'') \\\n Wait\\<^sub>t wt (\\t. EState (task_es, task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))\n ({preempt_ch t}, {}) blk1 \\\n Out\\<^sub>t (EState (task_es, task_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt)))\n (free_ch t) 0 blk2 \\\n task_dis_assn t (dis_s(CHR ''t'' := dis_t + wt)) (Task WAIT 1 tp) (task_s(CHR ''t'' := init_t + wt, CHR ''c'' := init_c + wt))\n rest \\\n task_dis_assn t dis_s task_es task_s (blk1 @ blk2 @ rest)\"\n\n(*\nlemma combine_task_dis:\n \"task_assn t task_es task_s tr1 \\\n dispatch_assn t' dis_s tr2 \\\n t \\ tid_set \\\n t = t' \\ \n combine_blocks {dispatch_ch t} tr1 tr2 tr \\\n task_dis_assn t dis_s task_es task_s tr\"\nproof (induction arbitrary: tr tr2 dis_s rule: task_assn.induct)\n case (1 t st ent tp task_s)\n note a1 = 1\n then show ?case\n proof (induction arbitrary: tr rule: dispatch_assn.induct)\n case (1 t' start_s)\n have c1: \"tr = []\"\n using 1 by (auto elim: sync_elims)\n show ?case\n apply (subst c1)\n by (auto intro: task_dis_assn.intros)\n next\n case (2 init_t start_s wt blk1 t blk2 rest)\n then show ?case\n apply(auto simp add:wait_assn.simps out_assn.simps)\n by (auto elim: sync_elims)\n qed\nnext\n case (2 task_es ent tp task_s t blk1 rest)\n note a2 = 2\n from a2(5,6,7,8) show ?case\n proof (induction arbitrary: tr rule: dispatch_assn.induct)\n case (1 t' start_s)\n then show ?case \n using a2\n apply(auto elim!: in_assn.cases)\n by(auto elim!: sync_elims)\n next\n case (2 init_t start_s wt blk1' t' blk2' rest')\n note b2 = 2\n show ?case \n thm b2\n thm a2\n using a2(2)\n using b2(2,3,4,5) using b2(8,9,10)\n apply (auto elim!:in_assn.cases wait_assn.cases out_assn.cases)\n subgoal apply (auto elim!: sync_elims) done\n subgoal premises pre for d\n proof(cases \"(9 / 200 - init_t) > d\")\n case True\n then have \"ereal (9 / 200 - init_t) > ereal d\"\n by auto\n thm pre\n then obtain tr' where \"tr = WaitBlk (ereal d)\n (\\t. ParState (EState (task_es, task_s))\n (EState (estate.None, start_s(CHR ''t'' := init_t + t))))\n ({}, {dispatch_ch t'}) # tr' \"\n \"combine_blocks {dispatch_ch t'} (InBlock (dispatch_ch t') 0 # rest)\n (WaitBlk (ereal (9 / 200 - init_t - d))\n (\\t. EState (estate.None, start_s(CHR ''t'' := init_t + (t + d)))) ({}, {}) #\n OutBlock (dispatch_ch t') 0 # rest')\n tr'\"\n using pre\n apply(elim combine_blocks_waitE3) by auto\n then show ?thesis by (auto elim!: sync_elims)\n next\n case False\n note false1 = False\n show ?thesis \n proof (cases \"d = 9 / 200 - init_t\")\n case True\n then obtain tr' where tr':\"tr = WaitBlk (ereal d)\n (\\t. ParState (EState (task_es, task_s))\n (EState (estate.None, start_s(CHR ''t'' := init_t + t))))\n ({}, {dispatch_ch t'}) # tr' \"\n \"combine_blocks {dispatch_ch t'} (InBlock (dispatch_ch t') 0 # rest)\n (OutBlock (dispatch_ch t') 0 # rest')\n tr'\"\n using pre\n by(auto elim!: combine_blocks_waitE2) \n then obtain tr'' where tr'':\"tr' = IOBlock (dispatch_ch t') 0 # tr'' \"\n \"combine_blocks {dispatch_ch t'} rest rest' tr''\"\n apply(elim combine_blocks_pairE) by auto\n have 1:\"Wait\\<^sub>t (9 / 200 - start_s CHR ''t'')\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, start_s(CHR ''t'' := start_s CHR ''t'' + t))))\n ({}, {dispatch_ch t'})\n [WaitBlk (ereal (9 / 200 - start_s CHR ''t''))\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, start_s(CHR ''t'' := start_s CHR ''t'' + t))))\n ({}, {dispatch_ch t'})]\"\n using b2 \n using True pre(9) wait_assn.intros(1) by blast\n have 2:\"IO\\<^sub>t (dispatch_ch t') 0 [IOBlock (dispatch_ch t') 0]\"\n by (simp add: io_assn.intros)\n have 3:\"task_dis_assn t' (start_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0))\n tr''\"\n using a2(4)[of \"(start_s(CHR ''t'' := 0))\" rest' tr'']\n using a2(6,7) b2(6,9) tr'' \n by fastforce\n show ?thesis \n using task_dis_assn.intros(2)[OF a2(1),of init_t start_s wt task_s t' \"[WaitBlk (ereal d)\n (\\t. ParState (EState (task_es, task_s))\n (EState (estate.None, start_s(CHR ''t'' := init_t + t)))) \n ({}, {dispatch_ch t'})]\" \"[IOBlock (dispatch_ch t') 0]\" tr'' ]\n apply(simp add:a2 b2 True 1 2 3)\n using tr' tr'' \n using True a2(1) b2(1) by force\n next\n case False\n then have \"(9 / 200 - init_t) < d\"\n using false1 by auto\n then obtain tr' where \"tr = WaitBlk (ereal (9 / 200 - init_t))\n (\\t. ParState (EState (task_es, task_s))\n (EState (estate.None, start_s(CHR ''t'' := init_t + t))))\n ({}, {dispatch_ch t'}) # tr' \"\n \"combine_blocks {dispatch_ch t'} (WaitBlk (ereal (9 / 200 - init_t - d))\n (\\t. EState (task_es, task_s)) ({}, {dispatch_ch t'}) # InBlock (dispatch_ch t') 0 # rest)\n (OutBlock (dispatch_ch t') 0 # rest')\n tr'\"\n using pre\n apply(elim combine_blocks_waitE4) apply auto \n by (meson combine_blocks_pairE2' insertI1)\n then show ?thesis \n by (auto elim!: sync_elims)\n qed\n qed\n subgoal\n by (auto elim!: sync_elims)\n subgoal premises pre for d db\n proof (cases \"db > 9 / 200 - init_t\")\n case True\n thm pre\n then obtain tr' where \"combine_blocks {dispatch_ch t'}\n (WaitBlk (ereal db-(9 / 200 - init_t)) (\\_. EState (task_es, task_s)) ({}, {dispatch_ch t'}) #\n InBlock (dispatch_ch t') 0 # rest)\n (WaitBlk (ereal d) (\\_. EState (estate.None, start_s(CHR ''t'' := 0)))\n ({dispatch_ch t'}, {}) #\n OutBlock (dispatch_ch t') 0 # rest') tr'\"\n using pre(4,6,8,10) by(auto elim: combine_blocks_waitE4)\n then show ?thesis \n by(auto elim!: sync_elims) \n next\n case False\n note false1 = False\n show ?thesis \n proof (cases \"9 / 200 - init_t = db\")\n case True\n then obtain tr' where \"combine_blocks {dispatch_ch t'}\n (InBlock (dispatch_ch t') 0 # rest)\n (WaitBlk (ereal d) (\\_. EState (estate.None, start_s(CHR ''t'' := 0)))\n ({dispatch_ch t'}, {}) #\n OutBlock (dispatch_ch t') 0 # rest') tr'\"\n using pre(4,6,8,10) by(auto elim: combine_blocks_waitE2)\n then show ?thesis \n by(auto elim!: sync_elims) \n next\n case False\n then have \"9 / 200 - init_t > db\" \n using false1 by auto\n then obtain tr' where \"combine_blocks {dispatch_ch t'}\n (InBlock (dispatch_ch t') 0 # rest)\n (WaitBlk (ereal (9 / 200 - init_t) - ereal db)\n (\\t. EState (estate.None, start_s(CHR ''t'' := init_t + (t + db)))) ({}, {}) #\n WaitBlk (ereal d) (\\_. EState (estate.None, start_s(CHR ''t'' := 0)))\n ({dispatch_ch t'}, {}) #\n OutBlock (dispatch_ch t') 0 # rest') tr'\"\n using pre(4,6,8,10) by(auto elim: combine_blocks_waitE3)\n then show ?thesis \n by(auto elim!: sync_elims)\n qed\n qed\n done\n qed\nnext\n case (3 task_es ent tp init_t task_s wt d t blk1 blk2 rest)\n note a3 = 3\n from a3(7,8,9,10) show ?case \n proof (induction arbitrary: tr rule: dispatch_assn.induct)\n case (1 t' start_s)\n note b1 = 1\n show ?case \n thm a3\n thm b1\n using b1(1,2,3)\n using a3(4,5)\n apply (auto elim!:in_assn.cases waitin_assn.cases waitout_assn.cases)\n apply (auto elim!: sync_elims)\n apply (auto simp add: ch_dist) \n subgoal premises pre for tra \n proof-\n thm pre\n have 1:\"task_dis_assn t' start_s (Task RUNNING ent tp) (task_s(CHR ''t'' := init_t + wt)) tra\"\n using a3(6,8,9) \n apply(simp add: pre)\n using dispatch_assn.intros(1)[of t' start_s]\n using pre(8)\n by (smt (verit, best) \"3.IH\" a3(9) b1(1) pre(4) pre(6))\n obtain start_t where startt:\"start_t = start_s CHR ''t''\"\n by auto\n have 2:\"wt \\ 9 / 200 - task_s CHR ''t''\"\n using a3 by auto\n have 3:\"task_dis_assn t' start_s task_es task_s (blk1 @ blk2 @ tra)\"\n apply(rule task_dis_assn.intros(3)[where d=0])\n apply(rule a3(1))\n apply(rule a3(2))\n apply(rule startt)\n apply(rule a3(3))\n apply auto\n prefer 3\n apply(simp add:pre(6) startt)\n apply(rule 1)\n sorry\n then show ?thesis using pre by auto\n qed\n done\n next\n case (2 init_t' start_s wt' blk1' t' blk2' rest')\n note b2 = 2\n show ?case \n thm b2\n thm a3\n thm task_dis_assn.intros(3)\n using b2(4,5,8,9,10) a3(4,5)\n apply auto\n subgoal premises pre \n thm pre\n using pre(6,7)\n apply(auto elim!:waitout_assn.cases)\n using task_dis_assn.intros(3)[of task_es ent tp init_t task_s init_t' start_s wt d t]\n apply(auto simp add: a3(1,2,3) b2(1))\n sorry\n sorry\n \n qed\nnext\n case (4 start_es ent tp init_t start_s wt t blk1 blk2 blk3 rest)\n then show ?case sorry\nnext\n case (5 start_es tp init_t start_s init_c wt t blk1 rest)\n then show ?case sorry\nnext\n case (6 start_es tp init_t start_s init_c wt t blk1 blk2 rest)\n then show ?case sorry\nqed\n \n*)\n\n\n(*\n\ninductive sch_task_assn :: \"estate \\ state \\ tid \\ estate \\ state \\ state \\ estate tassn\" where\n \"sch_task_assn (Sch p rn rp) sch_s t (Task st ent tp) task_s dis_s []\"\n| \"sch_es = Sch p rn rp \\\n task_es = Task WAIT ent tp \\\n wt = 0.045 - dis_t \\\n Wait\\<^sub>t wt (\\t. ParState (EState (task_es, task_s))\n (EState (None, dis_s(CHR ''t'' := dis_t + t))))\n ({}, {}) blk1 \\\n IO\\<^sub>t (dis_ch t) 0 blk2 \\\n sch_task_assn sch_es sch_s t (Task READY 0 tp) (task_s(CHR ''t'' := 0)) (dis_s(CHR ''t'' := 0))\n rest \\\n sch_task_assn sch_es sch_s t task_es task_s dis_s (blk1 @ blk2 @ rest)\"\n| \"sch_es = Sch p rn rp \\\n task_es = Task READY ent tp \\\n init_task_t = task_s (CHR ''t'') \\\n init_dis_t = dis_s (CHR ''t'') \\\n rp \\ f(tid) \\\n wt \\ 0.045 - init_task_t \\\n IO\\<^sub>t (req_ch t) tp blk1 \\\n Waitin\\<^sub>t wt (\\t. ParState (EState (task_es,task_s(CHR ''t'' := init_t + t))) (EState (None, dis_s(CHR ''t'' := dis_t + t)))) (run_ch t) 0 ({run_ch t}, {}) blk2 \\\n sch_task_assn \n (sched_push t sch_es (sch_s(CHR ''p'' := f(tid)))) \n (sch_s(CHR ''p'' := f(tid))) t \n (Task RUNNING ent tp) (task_s(CHR ''t'' := init_t + wt)) \n (dis_s(CHR ''t'' := dis_t + wt)) rest \\\n sch_task_assn sch_es sch_s t task_es task_s dis_s (blk1 @ blk2 @ rest)\"\n| \"sch_es = Sch p rn rp \\\n task_es = Task READY ent tp \\\n init_task_t = task_s (CHR ''t'') \\\n init_dis_t = dis_s (CHR ''t'') \\\n rp < f(tid) \\\n wt \\ 0.045 - init_task_t \\\n IO\\<^sub>t (req_ch t) tp blk1 \\\n if run_now start_es \\ -1 then\n Out\\<^sub>t (EState (start_es, start_s)) (preempt_ch (run_now start_es)) 0 blk2\n else\n emp\\<^sub>t blk2 \\\n IO\\<^sub>t (run_ch t) 0 blk3 \\\n sch_task_assn sch_es (sch_s(CHR ''p'' := f(tid))) t \n (Task RUNNING ent tp) (task_s(CHR ''t'' := init_t + wt)) \n (dis_s(CHR ''t'' := dis_t + wt)) rest \\\n sch_task_assn sch_es sch_s t task_es task_s dis_s (blk1 @ blk2 @blk3 @ rest)\"\n\n\n\n*)\n\nfun dispatch_assn' :: \"tid \\ nat \\ real \\ state \\ estate tassn\" where\n \"dispatch_assn' t 0 pd start_s tr \\ (emp\\<^sub>t tr)\"\n (* Case for finishing a period *)\n| \"dispatch_assn' t (Suc k) pd start_s tr \\ \n wait_orig_assn (pd-start_s (CHR ''t''))\n (\\t. EState (None, start_s(CHR ''t'' := start_s (CHR ''t'') + t))) ({}, {})\n (out_orig_assn (dispatch_ch t) 0 (EState (None, start_s(CHR ''t'' := 0))) \n (dispatch_assn' t k pd (start_s(CHR ''t'' := 0)))) tr\"\n\ndefinition up_ent_c :: \"nat \\ real \\ real\" where\n \"up_ent_c ent c = (if ent = 0 then 0 else c)\"\n\nfun task_assn' :: \"tid \\ nat \\ real \\ real \\ estate \\ state \\ estate tassn\" where\n \"task_assn' t 0 pd pc (Task st ent tp) start_s tr \\ (emp\\<^sub>t tr) \"\n| \"task_assn' t (Suc k) pd pc (Task WAIT ent tp) start_s tr \\\n in_vassm_assn (dispatch_ch t) {0} (EState (Task WAIT ent tp, start_s))\n (\\_ . task_assn' t k pd pc (Task READY 0 tp) (start_s(CHR ''t'' := 0))) tr\"\n| \"task_assn' t (Suc k) pd pc (Task READY ent tp) start_s tr \\\n out_0assm_assn (req_ch t) tp \n (waitin_tguar'_vassm'_assn {0..t . EState (Task READY ent tp, start_s(CHR ''t'' := start_s (CHR ''t'') + t)))\n ({}, {run_ch t}) (run_ch t) {0}\n (\\ v d'. task_assn' t k pd pc (Task RUNNING 1 tp)\n (start_s(CHR ''t'' := start_s (CHR ''t'') + d',\n CHR ''c'' := (up_ent_c ent (start_s (CHR ''c''))))))) tr \\ \n out_0assm_assn (req_ch t) tp \n (wait_orig_assn (pd - start_s (CHR ''t''))\n (\\t. EState (Task READY ent tp, start_s(CHR ''t'' := start_s (CHR ''t'') + t)))\n ({}, {run_ch t}) \n (out_0assm_rdy_assn (exit_ch t) 0 ({exit_ch t},{run_ch t})\n (task_assn' t k pd pc (Task WAIT ent tp) (start_s(CHR ''t'' := pd))))) tr \\\n out_0assm_assn (req_ch t) tp \n (wait_orig_assn (pd - start_s (CHR ''t''))\n (\\t. EState (Task READY ent tp, start_s(CHR ''t'' := start_s (CHR ''t'') + t)))\n ({}, {run_ch t}) \n (in_0assm_rdy_assn (run_ch t) {0} ({exit_ch t},{run_ch t})\n (task_assn' t k pd pc (Task RUNNING 1 tp) (start_s(CHR ''t'' := pd,CHR ''c'' := up_ent_c ent (start_s (CHR ''c''))))))) tr\"\n| \"task_assn' t (Suc k) pd pc (Task RUNNING ent tp) start_s tr \\\n (if ent = 1 then\n waitin_tguar'_vassm'_assn ({0..< pd - start_s (CHR ''t'')} \n \\ {0..< pc - start_s (CHR ''c'')})\n (\\t. EState (Task RUNNING 1 tp, start_s(CHR ''t'' := start_s (CHR ''t'') + t,\n CHR ''c'' := start_s (CHR ''c'') + t)))\n ({}, {preempt_ch t}) (preempt_ch t) {0} \n (\\ v d. task_assn' t k pd pc (Task READY 1 tp)\n (start_s(CHR ''t'' := start_s (CHR ''t'') + d,\n CHR ''c'' := start_s (CHR ''c'') + d))) tr\n \\ \n wait_orig_assn (min (pd-start_s (CHR ''t'')) (pc-start_s (CHR ''c'')))\n (\\t. EState (Task RUNNING 1 tp, start_s(CHR ''t'' := start_s (CHR ''t'') + t,\n CHR ''c'' := start_s (CHR ''c'') + t)))\n ({}, {preempt_ch t}) \n (out_0assm_srdy_assn (free_ch t) 0 ({free_ch t},{preempt_ch t})\n (task_assn' t k pd pc (Task WAIT 1 tp) \n (start_s(CHR ''t'' := start_s (CHR ''t'') + \n (min (pd-start_s (CHR ''t'')) (pc-start_s (CHR ''c''))),\n CHR ''c'' := start_s (CHR ''c'') + \n (min (pd-start_s (CHR ''t'')) (pc-start_s (CHR ''c''))))))) tr\n else False)\"\n| \"task_assn' t n pd pc (Sch v va vb) start_s tr \\ False\"\n| \"task_assn' t n pd pc None start_s tr \\ False\"\n\n\nfun task_dis_assn' :: \"tid \\ nat \\ real \\ real \\ state \\ estate \\ state \\ estate tassn\" where\n \"task_dis_assn' t 0 pd pc dis_s (Task st ent tp) task_s tr \\ (emp\\<^sub>t tr)\"\n| \"task_dis_assn' t (Suc k) pd pc dis_s (Task WAIT ent tp) task_s tr \\\n wait_orig_assn (pd - dis_s (CHR ''t'')) \n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t))))\n ({}, {dispatch_ch t})\n (task_dis_assn' t k pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0)))tr\"\n| \"task_dis_assn' t (Suc k) pd pc dis_s (Task READY ent tp) task_s tr \\\n out_0assm_assn (req_ch t) tp \n (waitin_tguar'_vassm'_assn {0..t. ParState (EState (Task READY ent tp, task_s(CHR ''t'' := task_s (CHR ''t'') + t))) \n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t)))) \n ({}, {run_ch t}) (run_ch t) {0}\n (\\ v d'. task_dis_assn' t k pd pc (dis_s(CHR ''t'' := dis_s (CHR ''t'') + d')) \n (Task RUNNING 1 tp) \n (task_s(CHR ''t'' := task_s (CHR ''t'') + d',\n CHR ''c'' := up_ent_c ent (task_s (CHR ''c'')))))) tr \\ \n out_0assm_assn (req_ch t) tp \n (wait_orig_assn (pd - task_s (CHR ''t'')) \n (\\t. ParState (EState (Task READY ent tp, task_s(CHR ''t'' := task_s (CHR ''t'') + t)))\n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t)))) \n ({}, {run_ch t}) \n (out_0assm_rdy_assn (exit_ch t) 0 ({dispatch_ch t, exit_ch t}, {run_ch t})\n (task_dis_assn' t k pd pc (dis_s(CHR ''t'' := dis_s (CHR ''t'') + pd-dis_s (CHR ''t''))) \n (Task WAIT ent tp) (task_s(CHR ''t'' := pd))))) tr \\\n out_0assm_assn (req_ch t) tp \n (wait_orig_assn (pd - task_s (CHR ''t'')) \n (\\t. ParState (EState (Task READY ent tp, task_s(CHR ''t'' := task_s (CHR ''t'') + t)))\n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t)))) \n ({}, {run_ch t}) \n (in_0assm_rdy_assn (run_ch t) {0} ({dispatch_ch t, exit_ch t}, {run_ch t})\n (task_dis_assn' t k pd pc (dis_s(CHR ''t'' := dis_s (CHR ''t'') + pd-task_s (CHR ''t''))) \n (Task RUNNING 1 tp) (task_s(CHR ''t'' := pd,CHR ''c'' := up_ent_c ent (task_s (CHR ''c''))))))) tr\"\n| \"task_dis_assn' t (Suc k) pd pc dis_s (Task RUNNING ent tp) task_s tr \\\n (if ent = 1 then\n waitin_tguar'_vassm'_assn ({0..< pd - task_s (CHR ''t'')} \\ {0..< pc - task_s (CHR ''c'')})\n (\\t. ParState (EState (Task RUNNING 1 tp, task_s(CHR ''t'' := task_s (CHR ''t'') + t,\n CHR ''c'' := task_s (CHR ''c'') + t)))\n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t))))\n ({}, {preempt_ch t}) (preempt_ch t) {0} \n (\\ v d. task_dis_assn' t k pd pc (dis_s(CHR ''t'' := dis_s (CHR ''t'') + d)) (Task READY 1 tp)\n (task_s(CHR ''t'' := task_s (CHR ''t'') + d, CHR ''c'' := task_s (CHR ''c'') + d))) tr\n \\\n wait_orig_assn (min (pd-task_s (CHR ''t'')) (pc-task_s (CHR ''c'')))\n (\\t. ParState (EState (Task RUNNING 1 tp, task_s(CHR ''t'' := task_s (CHR ''t'') + t,\n CHR ''c'' := task_s (CHR ''c'') + t)))\n (EState (None, dis_s(CHR ''t'' := dis_s (CHR ''t'') + t))))\n ({}, {preempt_ch t}) \n (out_0assm_srdy_assn (free_ch t) 0 ({free_ch t}, {preempt_ch t})\n (task_dis_assn' t k pd pc (dis_s(CHR ''t'' := dis_s (CHR ''t'') + \n (min (pd-task_s (CHR ''t'')) (pc-task_s (CHR ''c''))))) \n (Task WAIT 1 tp)\n (task_s(CHR ''t'' := task_s (CHR ''t'') + \n (min (pd-task_s (CHR ''t'')) (pc-task_s (CHR ''c''))), \n CHR ''c'' := task_s (CHR ''c'') + \n (min (pd-task_s (CHR ''t'')) (pc-task_s (CHR ''c''))))))) tr\n else False)\"\n| \"task_dis_assn' t n pd pc dis_s (Sch v va vb) task_s tr \\ False\"\n| \"task_dis_assn' t n pd pc dis_s None task_s tr \\ False\"\n\nthm task_assn'.induct\nthm task_assn'.simps\n\n\nlemma combine_out_0assm_wait_orig_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (out_0assm_assn dh v P) (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))\n \\\\<^sub>t (out_0assm_assn dh v \n (combine_assn chs P (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: out_0assm_assn.cases[of dh v P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n done\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n done\n subgoal for d1 a b p1 tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy (a,b) ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n done\n done\n subgoal for tr2'\n apply(cases \"\\compat_rdy (a,b) rdy\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply (cases rdy)\n by auto\n apply(cases \"d=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n done\n done\n done\n done\n\nlemma combine_out_0assm_srdy_wait_orig_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (out_0assm_srdy_assn dh v rdy' P) (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))\n \\\\<^sub>t (out_0assm_srdy_assn dh v rdy'\n (combine_assn chs P (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: out_0assm_srdy_assn.cases[of dh v rdy' P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(1))\n by auto\n done\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(1))\n by auto\n done\n subgoal for d1 a b p1 tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy (a, b) ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n by auto\n done\n done\n subgoal for tr2'\n apply(cases \"\\compat_rdy (a,b) rdy\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n apply auto\n apply (cases rdy)\n apply auto\n apply (cases rdy)\n by auto\n apply(cases \"d=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n apply auto\n apply(cases rdy)\n apply auto\n apply (cases rdy)\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n apply auto\n apply(cases rdy)\n apply auto\n apply (cases rdy)\n by auto\n done\n done\n done\n done\n\nlemma combine_in_0assm_wait_orig_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (in_0assm_assn dh v P) (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))\n \\\\<^sub>t (in_0assm_assn dh v \n (combine_assn chs P (wait_orig_assn d p rdy (out_orig_assn ch v' s Q))))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: in_0assm_assn.cases[of dh v P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(1))\n by auto\n done\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(1))\n by auto\n done\n subgoal for w tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_assn.intros(2))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(2))\n by auto\n done\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(2))\n by auto\n done\n subgoal for d1 a b p1 tr1'\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy (a,b) ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n done\n done\n subgoal for tr2'\n apply(cases \"\\compat_rdy (a,b) rdy\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n apply auto\n apply (cases rdy)\n by auto\n apply(cases \"d=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n apply auto\n apply(cases rdy)\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n apply auto\n apply(cases rdy)\n by auto\n done\n done\n done\n done\n\nlemma combine_out_0assm_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (out_0assm_assn dh v P) (out_orig_assn ch v' s Q)\n \\\\<^sub>t (out_0assm_assn dh v \n (combine_assn chs P (out_orig_assn ch v' s Q)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: out_0assm_assn.cases[of dh v P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n done\n subgoal for d1 a b p1 tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy (a,b) ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n by auto\n done\n done\n done\n done\n\nlemma combine_in_0assm_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (in_0assm_assn dh v P) (out_orig_assn ch v' s Q)\n \\\\<^sub>t (in_0assm_assn dh v \n (combine_assn chs P (out_orig_assn ch v' s Q)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: in_0assm_assn.cases[of dh v P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(1))\n by auto\n done\n subgoal for w tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_assn.intros(2))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_assn.intros(2))\n by auto\n done\n subgoal for d1 a b p1 tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy (a,b) ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule in_0assm_assn.intros(3))\n by auto\n done\n done\n done\n done\n\n\nlemma combine_out_0assm_rdy_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (out_0assm_rdy_assn dh v rdy P) (out_orig_assn ch v' s Q)\n \\\\<^sub>t (out_0assm_rdy_assn dh v (merge_rdy rdy ({ch}, {}))\n (combine_assn chs P (out_orig_assn ch v' s Q)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: out_0assm_rdy_assn.cases[of dh v rdy P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule out_0assm_rdy_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule out_0assm_rdy_assn.intros(1))\n by auto\n done\n subgoal for d1 p1 tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy rdy ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule out_0assm_rdy_assn.intros(2))\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_rdy_assn.intros(2))\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_rdy_assn.intros(2))\n by auto\n done\n done\n done\n done\n\nlemma combine_in_0assm_rdy_out_orig:\n assumes \"dh \\ chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (in_0assm_rdy_assn dh v rdy P) (out_orig_assn ch v' s Q)\n \\\\<^sub>t (in_0assm_rdy_assn dh v (merge_rdy rdy ({ch}, {}))\n (combine_assn chs P (out_orig_assn ch v' s Q)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def)\n subgoal for tr tr1 tr2\n apply(cases rule: in_0assm_rdy_assn.cases[of dh v rdy P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(1))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(1))\n by auto\n done\n subgoal for w tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(elim combine_blocks_unpairE1)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(2))\n by auto\n subgoal for tr2' d\n using assms\n apply(elim combine_blocks_unpairE3)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(2))\n by auto\n done\n subgoal for d1 p1 tr1'\n apply(cases rule: out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n using assms\n apply(auto elim:sync_elims)\n done\n subgoal for tr2' d2\n apply(cases \"\\compat_rdy rdy ({ch}, {})\")\n subgoal\n by(auto elim:sync_elims)\n subgoal\n apply(cases \"d1>d2\")\n subgoal \n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(3))\n apply auto\n apply(cases rdy)\n by auto\n apply(cases \"d2=d1\")\n subgoal \n apply simp\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(3))\n apply auto\n apply(cases rdy)\n by auto\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule in_0assm_rdy_assn.intros(3))\n apply auto\n apply(cases rdy)\n apply auto\n done\n done\n done\n done\n done\n\n\nlemma combine_wait_tguar'_vassm'_wait_orig2:\n assumes \"\\ s . s\\S \\ s chs\"\n and \"ch \\ chs\"\n shows \"combine_assn chs (waitin_tguar'_vassm'_assn S p1 rdy1 dh V P)\n (wait_orig_assn d p2 rdy2 (out_orig_assn ch v' s Q)) \\\\<^sub>t\n waitin_tguar'_vassm'_assn S (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) dh V\n (\\ v t. combine_assn chs (P v t) (wait_orig_assn (d-t) (\\ t'. p2(t'+t)) rdy2 (out_orig_assn ch v' s Q)))\"\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p1 rdy1 dh V P tr1])\n apply auto\n subgoal for v tr1'\n apply(cases rule:wait_orig_assn.cases[of d p2 rdy2 \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule:out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE1)\n using assms\n by auto\n subgoal for d tr2'\n apply(elim combine_blocks_unpairE3)\n using assms\n by auto\n done\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3)\n using assms\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by auto\n done\n done\n subgoal for d1 v tr1'\n apply(cases rule:wait_orig_assn.cases[of d p2 rdy2 \"(out_orig_assn ch v' s Q)\" tr2])\n using assms(1)[of d1]\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_waitE3)\n using assms\n apply auto\n subgoal for tr'\n apply(elim combine_blocks_unpairE3)\n apply auto\n subgoal for tr''\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule exI[where x=\"tr1'\"])\n apply auto\n apply(rule exI[where x=\"(WaitBlk (d - d1) (\\t. p2 (t + d1)) rdy2 # tr2')\"])\n apply auto\n apply(rule wait_orig_assn.intros(2))\n by auto\n done\n done\n done\n subgoal for w tr1'\n apply(cases rule:wait_orig_assn.cases[of d p2 rdy2 \"(out_orig_assn ch v' s Q)\" tr2])\n apply auto\n subgoal\n apply(cases rule:out_orig_assn.cases[of ch v' s Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE1)\n using assms\n by auto\n subgoal for d tr2'\n apply(elim combine_blocks_unpairE3)\n using assms\n by auto\n done\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3)\n using assms\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n done\n done\n subgoal for d1 w tr1'\n apply(cases rule:wait_orig_assn.cases[of d p2 rdy2 \"(out_orig_assn ch v' s Q)\" tr2])\n using assms(1)[of d1]\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_waitE3)\n using assms\n apply auto\n subgoal for tr'\n apply(elim combine_blocks_unpairE3)\n apply auto\n subgoal for tr''\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n done\n done\n done\n done\n\n\nlemma combine_task_dis':\n \"task_assn' t k pd pc task_es task_s tr1 \\\n dispatch_assn' t' kk pd dis_s tr2 \\\n t \\ tid_set \\\n t = t' \\\n task_s (CHR ''t'') = dis_s (CHR ''t'') \\\n combine_blocks {dispatch_ch t} tr1 tr2 tr \\\n task_dis_assn' t k pd pc dis_s task_es task_s tr\"\nproof(induction k arbitrary: kk task_es task_s dis_s tr1 tr2 tr)\n case 0\n note 0 = 0\n then show ?case \n apply(cases task_es)\n apply auto\n subgoal for st ent tp\n proof(induction kk)\n case 0\n then show ?case \n apply auto \n subgoal premises pre\n apply (rule combine_blocks_assn)\n apply (rule pre(1))\n apply(rule pre(2))\n apply(rule pre(6))\n by (auto elim!: sync_elims)\n done\n next\n case (Suc kk)\n then show ?case \n apply auto \n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre (2))\n apply(rule pre (3))\n apply(rule pre (7))\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_wait_orig5)\n apply(rule combine_emp_out_orig1)\n by auto\n done\n qed\n done\nnext\n case (Suc k)\n note suc1 = Suc\n then show ?case \n proof(induction kk)\n case 0\n then show ?case \n apply(cases task_es)\n apply auto\n subgoal for st ent tp\n apply(cases st) apply simp\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule combine_in_vassm_emp1)\n by auto\n apply simp\n subgoal apply(erule disjE)\n subgoal premises pre\n thm pre\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre(9))\n apply(rule pre(2))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule out_0assm_assn_tran)\n subgoal \n apply(rule entails_tassn_trans)\n apply(rule combine_waitin_tguar'_vassm'_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule waitin_tguar'_vassm'_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for v d tr tr1 tr2\n using pre(1)[of \"(Task RUNNING (Suc 0) tp)\"\n \"(task_s(CHR ''t'' := task_s CHR ''t'' + d, CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\"\n tr1 0 \n \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" tr2 tr]\n apply(subgoal_tac\"dispatch_assn' t' 0 pd (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) tr2\")\n subgoal using pre(5) \n by fastforce\n by auto\n done\n done\n apply(erule disjE)\n subgoal premises pre\n thm pre\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre(9))\n apply(rule pre(2))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule out_0assm_assn_tran)\n subgoal \n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_emp2)\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_rdy_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule out_0assm_rdy_assn_tran)\n subgoal \n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Task WAIT ent tp)\" \"(task_s(CHR ''t'' := pd))\" tr1 0\n \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + pd - task_s CHR ''t''))\"\n tr2 tr]\n apply(subgoal_tac \"dispatch_assn' t' 0 pd (dis_s(CHR ''t'' := dis_s CHR ''t'' + pd - task_s CHR ''t''))tr2\")\n subgoal using pre(5) by fastforce \n by auto\n done\n done\n done\n subgoal premises pre\n thm pre\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule combine_blocks_assn)\n apply(rule pre(9))\n apply(rule pre(2))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule out_0assm_assn_tran)\n subgoal \n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_emp2)\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_in_0assm_rdy_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule in_0assm_rdy_assn_tran)\n subgoal \n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Task RUNNING (Suc 0) tp)\" \"(task_s(CHR ''t'' := pd, CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\" tr1 0\n \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + pd - task_s CHR ''t''))\"\n tr2 tr]\n apply(subgoal_tac \"dispatch_assn' t' 0 pd (dis_s(CHR ''t'' := dis_s CHR ''t'' + pd - task_s CHR ''t''))tr2\")\n subgoal using pre(5) by fastforce \n by auto\n done\n done\n done\n done\n subgoal apply simp\n apply(cases \"ent = Suc 0\")\n subgoal \n apply simp\n apply(erule disjE)\n subgoal apply(rule disjI1)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(10))\n apply(rule pre(2))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_waitin_tguar'_vassm'_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule waitin_tguar'_vassm'_assn_tran)\n apply clarify\n subgoal for v d\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Task READY (Suc 0) tp)\" \n \"(task_s(CHR ''t'' := task_s CHR ''t'' + d, CHR ''c'' := task_s CHR ''c'' + d))\" \n tr1 0 \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\"\n tr2 tr]\n apply(subgoal_tac \"dispatch_assn' t' 0 pd (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) tr2\")\n subgoal using pre(5) by fastforce\n by auto\n done\n done\n done\n subgoal apply(rule disjI2)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(10))\n apply(rule pre(2))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_emp2)\n apply(rule wait_orig_assn_tran)\n subgoal \n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_srdy_emp2)\n subgoal using ch_dist pre(3) by auto\n apply(rule out_0assm_srdy_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Task WAIT (Suc 0) tp)\" \n \"(task_s(CHR ''t'' :=task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\"\n tr1 0 \"(dis_s (CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\"\n tr2 tr]\n apply(subgoal_tac \"dispatch_assn' t' 0 pd \n (dis_s (CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))) tr2\")\n subgoal using pre(5) by fastforce\n by auto\n done\n done\n done\n done\n subgoal by auto\n done\n done\n done\n next\n case (Suc kk)\n note suc2 = Suc\n then show ?case \n apply auto\n apply(cases task_es)\n apply auto\n subgoal for st ent tp\n apply(cases st) apply simp\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(3))\n apply(rule pre(4))\n apply(rule pre(8))\n apply(rule entails_tassn_trans)\n apply(rule combine_in_vassm_wait_orig1)\n apply simp\n apply simp\n apply auto\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_in_vassm_out_orig1)\n apply auto\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(2)[of \"(Task READY 0 tp)\" \"(\\a. if a = CHR ''t'' then 0 else task_s a)\" tr1\n kk \"(\\a. if a = CHR ''t'' then 0 else dis_s a)\" tr2 tr]\n by auto\n done\n subgoal apply simp\n apply(erule disjE)\n subgoal apply(rule disjI1)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(10))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_wait_orig_out_orig)\n subgoal using ch_dist pre by auto\n subgoal by auto\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_tguar'_vassm'_wait_orig2)\n subgoal by auto\n subgoal by auto\n subgoal using pre ch_dist by auto\n subgoal by auto\n apply auto\n apply(rule waitin_tguar'_vassm'_assn_tran)\n apply auto\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for d tr tr1 tr2\n thm pre(2)\n apply(subgoal_tac \"dispatch_assn' t' (Suc kk) pd (\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a) tr2\")\n prefer 2\n subgoal apply auto\n apply(subgoal_tac \"pd - dis_s CHR ''t'' - d = pd - (dis_s CHR ''t'' + d)\")\n apply auto\n apply(subgoal_tac \"(\\t'. EState (estate.None,\n \\a. if a = CHR ''t'' then dis_s CHR ''t'' + (t' + d) else dis_s a))\n = (\\t. EState (estate.None, \n (\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a)\n (CHR ''t'' := dis_s CHR ''t'' + d + t)))\")\n apply(subgoal_tac \"(\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a)\n (CHR ''t'' := 0) = (\\a. if a = CHR ''t'' then 0 else dis_s a)\")\n apply auto\n apply(rule ext)\n by auto\n subgoal premises pp\n thm pp\n apply(rule pre(2))\n apply(rule pp(3))\n apply(rule pp(6))\n apply auto\n apply(rule pp(5))\n done\n done\n done\n done\n apply(erule disjE)\n subgoal apply(rule disjI2) apply(rule disjI1)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(10))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_wait_orig_out_orig)\n subgoal using ch_dist pre by auto\n subgoal by auto\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_wait_orig2)\n subgoal by auto\n apply auto\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_rdy_out_orig)\n subgoal using pre ch_dist by auto\n subgoal by auto\n apply (auto del:fun_upd_apply)\n apply(rule out_0assm_rdy_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n thm pre(2)\n apply(subgoal_tac \"dispatch_assn' t' (Suc kk) pd (\\a. if a = CHR ''t'' then pd else dis_s a) tr2\")\n prefer 2 \n subgoal apply auto\n apply(subgoal_tac \" (\\a. if a = CHR ''t'' then pd else dis_s a)(CHR ''t'' := 0) = (\\a. if a = CHR ''t'' then 0 else dis_s a)\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n by auto\n subgoal premises pp\n thm pp\n apply(rule pre(2))\n apply(rule pp(1))\n apply(rule pp(4))\n apply auto\n apply(rule pp(3))\n done\n done\n done\n done\n subgoal apply(rule disjI2) apply(rule disjI2)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(10))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_wait_orig_out_orig)\n subgoal using ch_dist pre by auto\n subgoal by auto\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_wait_orig2)\n subgoal by auto\n apply auto\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_in_0assm_rdy_out_orig)\n subgoal using pre ch_dist by auto\n subgoal by auto\n apply(auto del:fun_upd_apply)\n apply(rule in_0assm_rdy_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n thm pre(2)\n apply(subgoal_tac \"dispatch_assn' t' (Suc kk) pd (\\a. if a = CHR ''t'' then pd else dis_s a) tr2\")\n prefer 2 \n subgoal apply auto\n apply(subgoal_tac \" (\\a. if a = CHR ''t'' then pd else dis_s a)(CHR ''t'' := 0) = (\\a. if a = CHR ''t'' then 0 else dis_s a)\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n by auto\n subgoal premises pp\n thm pp\n apply(rule pre(2))\n apply(rule pp(1))\n apply(rule pp(4))\n apply auto\n apply(rule pp(3))\n done\n done\n done\n done\n done\n subgoal apply simp\n apply(cases \"ent \\ Suc 0\")\n subgoal by auto\n apply simp\n apply(erule disjE)\n subgoal apply(rule disjI1)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(11))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_tguar'_vassm'_wait_orig2)\n subgoal by auto\n subgoal by auto\n subgoal using pre ch_dist by auto\n subgoal by auto\n apply auto\n apply(rule waitin_tguar'_vassm'_assn_tran)\n apply auto\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for d tr tr1 tr2\n apply(subgoal_tac \"dispatch_assn' t' (Suc kk) pd (\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a) tr2\")\n prefer 2\n subgoal apply auto\n apply(subgoal_tac \"(pd - dis_s CHR ''t'' - d) =( pd - (dis_s CHR ''t'' + d))\")\n apply auto\n apply(subgoal_tac \"(\\t'. EState (estate.None,\n \\a. if a = CHR ''t'' then dis_s CHR ''t'' + (t' + d) else dis_s a)) = \n (\\t. EState (estate.None, (\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a)\n (CHR ''t'' := dis_s CHR ''t'' + d + t)))\")\n apply auto\n apply(subgoal_tac \"(\\a. if a = CHR ''t'' then dis_s CHR ''t'' + d else dis_s a)\n (CHR ''t'' := 0) = (\\a. if a = CHR ''t'' then 0 else dis_s a)\")\n apply auto\n apply(rule ext)\n by auto\n subgoal premises pp\n thm pp\n apply(rule pre(2))\n apply(rule pp(4))\n apply(rule pp(7))\n apply auto\n apply(rule pp(6))\n done\n done\n done\n done\n subgoal apply(rule disjI2)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(11))\n apply(rule pre(3))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_wait_orig5)\n subgoal by auto\n subgoal by auto\n apply auto\n apply(rule wait_orig_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_srdy_wait_orig_out_orig)\n subgoal using pre ch_dist by auto\n subgoal by auto\n apply(rule out_0assm_srdy_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"dispatch_assn' t' (Suc kk) pd (\\a. if a = CHR ''t''\n then dis_s CHR ''t'' +\n min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'')\n else dis_s a) tr2\")\n prefer 2\n subgoal\n apply(subgoal_tac \"(pd - dis_s CHR ''t'' -\n min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'')) = (pd -\n (dis_s CHR ''t'' + min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'')))\")\n apply auto\n apply(subgoal_tac \"(\\t. EState\n (estate.None,\n \\a. if a = CHR ''t''\n then dis_s CHR ''t'' +\n (t + min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c''))\n else dis_s a)) = (\\t. EState\n (estate.None,\n (\\a. if a = CHR ''t''\n then dis_s CHR ''t'' +\n min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'')\n else dis_s a)\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'') +\n t)))\")\n apply auto\n apply(subgoal_tac \"(\\a. if a = CHR ''t'' then 0 else dis_s a) =\n (\\a. if a = CHR ''t''\n then dis_s CHR ''t'' +\n min (pd - dis_s CHR ''t'') (pc - task_s CHR ''c'')\n else dis_s a)\n (CHR ''t'' := 0)\")\n apply auto\n apply(rule ext)\n by auto\n subgoal premises pp\n thm pp\n apply(rule pre(2))\n apply(rule pp(1))\n apply(rule pp(4))\n apply auto\n apply(rule pp(3))\n done\n done\n done\n done\n done\n done\n done\n qed\nqed\n\n\ninductive waitin_assms'ch_assn :: \"real set \\ (real \\ 'a gstate) \\ rdy_info \\ cname \\ real set \\ (real \\ real \\ 'a tassn) \\ 'a tassn\" where\n \"v \\ V \\ 0 \\ S \\ (P v 0) tr \\ (waitin_assms'ch_assn S p rdy ch V P) (InBlock ch v # tr)\"\n| \"v \\ V \\ d \\ S \\ d > 0 \\ (P v d) tr \\ (waitin_assms'ch_assn S p rdy ch V P)\n (WaitBlk d (\\\\. p \\) rdy # InBlock ch v # tr)\"\n| \"0 \\ S \\ w \\ V \\ dh \\ ch\\ (waitin_assms'ch_assn S p rdy ch V P) (InBlock dh w # tr)\"\n| \"d \\ S \\ w \\ V \\ dh \\ ch\\ d > 0 \\ (waitin_assms'ch_assn S p rdy ch V P)\n (WaitBlk d (\\\\. p \\) rdy # InBlock ch w # tr)\"\n\n\nlemma waitin_assms'ch_assn_tran:\nassumes \"\\ v d. v \\ V \\ d \\ S \\ P v d \\\\<^sub>t Q v d\"\nshows \"waitin_assms'ch_assn S p rdy ch V P \\\\<^sub>t waitin_assms'ch_assn S p rdy ch V Q\"\nunfolding entails_tassn_def\n apply auto\n subgoal for tr\n apply(cases rule: waitin_assms'ch_assn.cases[of S p rdy ch V P tr])\n apply auto\n subgoal\n apply(rule waitin_assms'ch_assn.intros(1))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(2))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(3))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(3))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(3))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(4))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(4))\n using assms \n by(auto simp add:entails_tassn_def)\n subgoal\n apply(rule waitin_assms'ch_assn.intros(4))\n using assms \n by(auto simp add:entails_tassn_def)\n done\n done\n\n\n\nlemma combine_emp_waitin_assms'ch1:\n\"ch \\ chs \\ combine_assn chs emp\\<^sub>t (waitin_assms'ch_assn S p rdy ch V P) \\\\<^sub>t (waitin_assms'ch_assn S q rdy ch V (\\ v t . combine_assn chs emp\\<^sub>t (P v t)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n subgoal for tr tr1 \n apply(cases rule:waitin_assms'ch_assn.cases[of S p rdy ch V P tr1])\n apply (auto elim!: sync_elims)\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n done\n done\n\nlemma combine_emp_waitin_assms'ch2:\n\"ch \\ chs \\ combine_assn chs emp\\<^sub>t (waitin_assms'ch_assn S p rdy ch V P) \\\\<^sub>t (waitin_assms'ch_assn S q rdy ch V (\\ v t . combine_assn chs emp\\<^sub>t (P v t)))\"\n apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n subgoal for tr tr1 \n apply(cases rule:waitin_assms'ch_assn.cases[of S p rdy ch V P tr1])\n apply (auto elim!: sync_elims)\n subgoal for v tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(1))\n by auto\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n subgoal for w dh tr1' tr'\n apply(rule waitin_assms'ch_assn.intros(3))\n by auto\n done\n done\n\nlemma combine_emp_waitin_assms'ch3:\n\"combine_assn chs emp\\<^sub>t (waitin_assms'ch_assn S p rdy ch V P) \\\\<^sub>t (waitin_assms'ch_assn S q rdy ch V (\\ v t . combine_assn chs emp\\<^sub>t (P v t)))\"\n apply(cases \"ch \\ chs\")\n apply(rule combine_emp_waitin_assms'ch1) apply auto\n apply(rule combine_emp_waitin_assms'ch2) by auto\n\n\nfun sched_assn' :: \"nat \\ estate \\ state \\ estate tassn\" where\n \"sched_assn' n None s tr \\ False\"\n| \"sched_assn' n (Task st ent tp) s tr \\ False\"\n| \"sched_assn' 0 (Sch p rn rp) s tr \\ (emp\\<^sub>t tr)\"\n| \"sched_assn' (Suc k) (Sch p rn rp) s tr \\ \n waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (req_ch 1) {2} (\\ v d. if (v\\rp) then sched_assn' k (sched_push 1 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n else if rn \\ -1 then out_0assm_assn (preempt_ch rn) 0 (out_0assm_assn (run_ch 1) 0 \n (sched_assn' k (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 1) 0 \n (sched_assn' k (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) tr\n \\ waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (req_ch 2) {1} (\\ v d. if (v\\rp) then sched_assn' k (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n else if rn \\ -1 then out_0assm_assn (preempt_ch rn) 0 (out_0assm_assn (run_ch 2) 0 \n (sched_assn' k (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0 \n (sched_assn' k (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) tr\n \\ waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (free_ch 1) {0} (\\ v d. if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (sched_assn' k (sched_get_max (Sch p rn rp) s) s)\n else \n (sched_assn' k (sched_clear (Sch p rn rp) s) s)) tr\n \\ waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (free_ch 2) {0} (\\ v d. if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (sched_assn' k (sched_get_max (Sch p rn rp) s) s)\n else \n (sched_assn' k (sched_clear (Sch p rn rp) s) s)) tr\n \\ waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (exit_ch 1) {0} (\\ v d. sched_assn' k (sched_del_proc 1 (Sch p rn rp) s) s) tr\n \\ waitin_assms'_assn UNIV (\\ t. EState(Sch p rn rp, s)) ({},{req_ch 1,req_ch 2,free_ch 1,free_ch 2,exit_ch 1,exit_ch 2})\n (exit_ch 2) {0} (\\ v d. sched_assn' k (sched_del_proc 2 (Sch p rn rp) s) s) tr\"\n\ndefinition properp :: \"tid \\ real \\ bool\" where\n\"properp rn rp = ((rn = 1 \\ rp = 2) \\ (rn = 2 \\ rp = 1) \\ (rn = -1 \\ rp = -1) \\ rp \\ {-1,1,2} \\ rn \\ {-1,1,2})\"\n\nfun properl :: \"(real \\ tid) list \\ bool\" where\n \"properl [] = True\"\n| \"properl ((rp,rn) # v) = (properl v \\ properp rn rp \\ rn > 0 \\ rn \\ 1)\"\n\nlemma properl_p1:\n\"properl (p @ [(a, b)]) = (properl p \\ properp b a \\ b > 0 \\ b \\ 1)\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n show ?case\n apply(cases c)\n subgoal for ca cb\n apply simp\n using Cons[of a b]\n by auto\ndone\nqed\n\nlemma properl_p2:\n\"properl p \\ properp rn rp \\ properp (snd(get_max_default (rp,rn) p)) (fst(get_max_default (rp,rn) p))\"\nproof(induction p arbitrary: rn rp)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n by auto\n done\nqed\n\n\nlemma properl_p3:\n\"properl p \\ properp (snd (get_max p)) (fst (get_max p)) \"\nproof(induction p)\n case Nil\n then show ?case \n apply auto\n unfolding properp_def\n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n apply auto\n apply(rule properl_p2)\n by auto\n done\nqed\n\n\nlemma properl_p4:\n\"properl p \\ properl (del_proc p t)\"\nproof(induction p)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n by auto\n done\nqed\n\nlemma proper_getmax1':\n\"fst (get_max_default (a,b) p) < d \\ a' < d \\ fst (get_max_default (a,b) (p@[(a',b')])) < d\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons g p)\n then show ?case \n apply(cases g)\n subgoal for ga gb\n by auto\n done\nqed\n\nlemma proper_getmax1:\n\"fst (get_max p) < d \\ a' < d \\ fst (get_max(p@[(a',b')])) < d\"\nproof(induction p)\n case Nil\n then show ?case by auto\nnext\n case (Cons g p)\n then show ?case \n apply (cases g)\n subgoal for ga gb\n apply auto\n using proper_getmax1'\n by auto\n done\nqed\n\n\nlemma proper_getmax2:\n\"properl p \\ snd (get_max p) \\ 1 \\ (gb \\ 1 \\ snd (get_max_default (ga, gb) p) \\ 1)\"\nproof(induction p arbitrary: ga gb)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons h p)\n then show ?case \n apply (cases h)\n subgoal for ha hb\n by auto\n done\nqed\n\nlemma properl_p5':\n \"properl ((a,b)#p) \\ snd(get_max_default (a,b) p) > 0\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons g p)\n then show ?case \n apply(cases g)\n by auto\nqed\n\nlemma properl_p5:\n\"length p > 0 \\ properl p \\ properp (snd (get_max p)) (fst (get_max p)) \\ (snd (get_max p)) > 0 \\ (snd (get_max p)) \\ 1\"\nproof(induction p)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n apply auto\n subgoal\n apply(rule properl_p2)\n apply auto\n done\n prefer 2\n subgoal\n using proper_getmax2 apply auto\n done\n using properl_p5'[of 1 2 p] \n apply auto\n unfolding properp_def\n by auto\n done\nqed\n\n\n\ndefinition proper :: \"estate \\ bool \" where\n\"proper schs = ((properp (run_now schs) (run_prior schs)) \\ properl (pool schs))\"\n\n\ninductive io_out0_out0 :: \"cname \\ real \\ cname \\ real \\ cname \\ real \\ 'a tassn \\ 'a tassn\" where\n \"io_orig_assn ch1 v1 (out_0assm_assn ch2 v2 (out_0assm_assn ch3 v3 P)) tr \\ io_out0_out0 ch1 v1 ch2 v2 ch3 v3 P tr\"\n| \"out_0orig_assn ch2 v2 (io_orig_assn ch1 v1 (out_0assm_assn ch3 v3 P)) tr \\ io_out0_out0 ch1 v1 ch2 v2 ch3 v3 P tr\"\n\n\n\nfun tdsch1' :: \"nat \\ nat \\ real \\ real \\ state \\ estate \\ state \\ estate \\ state \\ estate tassn\" where\n \"tdsch1' 0 0 pd pc dis_s (Task st ent tp) task_s (Sch p rn rp) s tr \\ (emp\\<^sub>t tr)\"\n| \"tdsch1' 0 (Suc kk) pd pc dis_s (Task st ent tp) task_s (Sch p rn rp) s tr \\ \n in_0orig_vassm'_assn \n (req_ch 2) {1} (\\ v . if (v\\rp) then tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n else if rn \\ -1 then \\(rn \\ 1) \\\\<^sub>t out_0assm_assn (preempt_ch rn) 0 (out_0assm_assn (run_ch 2) 0 \n (tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0 \n (tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) tr\n \\ in_0orig_vassm'_assn\n (free_ch 2) {0} (\\ v . if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_get_max (Sch p rn rp) s) s)\n else \n (tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_clear (Sch p rn rp) s) s)) tr\n \\ in_0orig_vassm'_assn\n (exit_ch 2) {0} (\\ v . tdsch1' 0 kk pd pc dis_s (Task st ent tp) task_s (sched_del_proc 2 (Sch p rn rp) s) s) tr\"\n| \"tdsch1' (Suc k) 0 pd pc dis_s (Task WAIT ent tp) task_s (Sch p rn rp) s tr \\ \n (tdsch1' k 0 pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0)) (Sch p rn rp) s) tr\"\n| \"tdsch1' (Suc k) 0 pd pc dis_s (Task READY ent tp) task_s (Sch p rn rp) s tr \\ False\"\n| \"tdsch1' (Suc k) 0 pd pc dis_s (Task RUNNING ent tp) task_s (Sch p rn rp) s tr \\ False\"\n| \"tdsch1' (Suc k) (Suc kk) pd pc dis_s (Task WAIT ent tp) task_s (Sch p rn rp) s tr \\ \n wait_orig_assn (pd - dis_s CHR ''t'')\n (\\t. ParState\n (ParState (EState (Task WAIT ent tp, task_s))\n (EState\n (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1})\n (tdsch1' (k) (Suc kk) pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0)) (Sch p rn rp) s) tr \\\n waitin_tguar'_vassm'_assn {..<(pd - dis_s CHR ''t'')}\n (\\t. ParState\n (ParState (EState (Task WAIT ent tp, task_s))\n \n (EState\n (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1}) (req_ch 2) {1}\n (\\ v d. if (v\\rp) then tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) (task_s) (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n else if rn \\ -1 then out_0assm_assn (preempt_ch rn) 0 (out_0assm_assn (run_ch 2) 0 \n (tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) (task_s) (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) \n else out_0assm_assn (run_ch 2) 0 \n (tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) (task_s) (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) tr \\\n waitin_tguar'_vassm'_assn {..<(pd - dis_s CHR ''t'')}\n (\\t. ParState\n (ParState (EState (Task WAIT ent tp, task_s))\n \n (EState\n (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1}) (free_ch 2) {0}\n (\\ v d. if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) (task_s) (sched_get_max (Sch p rn rp) s) s)\n else tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) (task_s) (sched_get_max (Sch p rn rp) s) s) tr \\\n waitin_tguar'_vassm'_assn {..<(pd - dis_s CHR ''t'')}\n (\\t. ParState\n (ParState (EState (Task WAIT ent tp, task_s))\n \n (EState\n (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1}) (exit_ch 2) {0}\n (\\ v d. tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp) task_s (Sch (del_proc p 2) rn rp) s) tr\"\n| \"tdsch1' (Suc k) (Suc kk) pd pc dis_s (Task READY ent tp) task_s (Sch p rn rp) s tr \\ \n (if rn \\ -1 then out_0assm_assn (preempt_ch rn) 0 \n (tdsch1' k kk pd pc dis_s (Task RUNNING (Suc 0) tp)\n (task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c''))) (Sch p 1 2) (s(CHR ''p'' := 2)))\n else tdsch1' k kk pd pc dis_s (Task RUNNING (Suc 0) tp)\n (task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c''))) (Sch p 1 2) (s(CHR ''p'' := 2))) tr \\\n in_0orig_vassm'_assn (req_ch 2) {1} (\\ v. if v \\ rp then (tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (Sch (p @ [(1, 2)]) rn rp)(s(CHR ''p'' := 1))) \n else if rn \\ -1 then (out_0assm_assn (preempt_ch rn) 0 (out_0assm_assn (run_ch 2) 0 (tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (Sch p 2 1) (s(CHR ''p'' := 1))))) \n else (out_0assm_assn (run_ch 2) 0 (tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (Sch p 2 1) (s(CHR ''p'' := 1))))) tr \\ \n in_0orig_vassm'_assn (free_ch 2) {0} (\\ v. if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (sched_get_max (Sch p rn rp) s) s)\n else \n (tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (sched_clear (Sch p rn rp) s) s)) tr \\\n in_0orig_vassm'_assn (exit_ch 2) {0} (\\ v. tdsch1' (Suc k) kk pd pc dis_s (Task READY ent tp) task_s (Sch (del_proc p 2) rn rp) s) tr\"\n|\"tdsch1' (Suc k) (Suc kk) pd pc dis_s (Task RUNNING ent tp) task_s (Sch p rn rp) s tr \\ \n waitin_tguar'_vassm'_assn {..min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')} \n (\\t. ParState\n (ParState (EState (Task RUNNING ent tp, task_s\n (CHR ''t'' := task_s CHR ''t'' + t,\n CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1})\n (req_ch 2) {1} \n (\\ v d. tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task RUNNING ent tp) \n (task_s(CHR ''t'' := task_s CHR ''t'' + d,\n CHR ''c'' := task_s CHR ''c'' + d)) \n (Sch (p @ [(1, 2)]) 1 2) (s(CHR ''p'' := 1))) tr \\\n waitin_tguar'_vassm'_assn {..min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')} \n (\\t. ParState\n (ParState (EState (Task RUNNING ent tp, task_s\n (CHR ''t'' := task_s CHR ''t'' + t,\n CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1})\n (free_ch 2) {0} \n (\\ v d. true\\<^sub>A ) tr \\\n waitin_tguar'_vassm'_assn {..min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')} \n (\\t. ParState\n (ParState (EState (Task RUNNING ent tp, task_s\n (CHR ''t'' := task_s CHR ''t'' + t,\n CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1})\n (exit_ch 2) {0} \n (\\ v d. tdsch1' (Suc k) kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task RUNNING ent tp) \n (task_s(CHR ''t'' := task_s CHR ''t'' + d,\n CHR ''c'' := task_s CHR ''c'' + d)) \n (Sch (del_proc p 2) rn rp) s) tr \\\n wait_orig_assn (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\n (\\t. ParState\n (ParState (EState (Task RUNNING ent tp, task_s(CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n (EState (Sch p rn rp, s)))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1})\n (if length p > 0 then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0 \n (tdsch1' k kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT ent tp)\n (task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))) \n (sched_get_max (Sch p rn rp) s) s)\n else \n (tdsch1' k kk pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT ent tp) \n (task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))) \n (sched_clear (Sch p rn rp) s) s)) tr\"\n| \"tdsch1' k kk pd pc dis_s (Sch p rn rp) task_s schs s tr \\ False\"\n| \"tdsch1' k kk pd pc dis_s None task_s schs s tr \\ False\"\n| \"tdsch1' k kk pd pc dis_s task_es task_s (Task st ent tp) s tr \\ False\"\n| \"tdsch1' k kk pd pc dis_s task_es task_s None s tr \\ False\"\n\nthm tdsch1'.simps\n\n\nlemma combine_wait_orig_waitin_assms'1:\n assumes\"ch \\ chs\"\n and \"compat_rdy rdy1 rdy2\"\n shows \"combine_assn chs (wait_orig_assn d p1 rdy1 P) (waitin_assms'_assn UNIV p2 rdy2 ch V Q)\n \\\\<^sub>t wait_orig_assn d (\\ t. ParState (p1 t)(p2 t)) (merge_rdy rdy1 rdy2) \n (combine_assn chs P (waitin_assms'_assn UNIV (\\ t. p2(t+d)) rdy2 ch V (\\ v t. Q v (t+d))))\"\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(cases rule: wait_orig_assn.cases[of d p1 rdy1 P tr1])\n apply auto\n subgoal\n apply(rule wait_orig_assn.intros(1))\n by auto\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV p2 rdy2 ch V Q tr2])\n apply simp\n subgoal for v tr2'\n using assms by (auto elim!: sync_elims)\n subgoal for v d' tr2'\n apply(cases \"d>d'\")\n subgoal\n apply auto\n apply(elim combine_blocks_waitE4)\n using assms by (auto elim!: sync_elims)\n apply(cases \"dt. p2 (t + d)) rdy2 # InBlock ch v # tr2')\"])\n apply auto\n apply(rule waitin_assms'_assn.intros(2))\n by auto\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n using assms apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule exI[where x=\"tr1'\"])\n apply auto\n apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n apply auto\n apply(rule waitin_assms'_assn.intros(1))\n by auto\n done\n subgoal for w tr2'\n using assms by (auto elim!: sync_elims)\n subgoal for d' v tr2'\n apply(cases \"d>d'\")\n subgoal\n apply auto\n apply(elim combine_blocks_waitE4)\n using assms apply auto\n by (auto elim!: sync_elims)\n apply(cases \"dt. p2 (t + d)) rdy2 # InBlock ch v # tr2')\"])\n apply auto\n apply(rule waitin_assms'_assn.intros(4))\n by auto\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n using assms apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule exI[where x=\"tr1'\"])\n apply auto\n apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n apply auto\n apply(rule waitin_assms'_assn.intros(3))\n by auto\n done\n done\n done\n done\n(*\nlemma combine_io_orig_waitin_assms'1:\n assumes\"ch \\ chs\"\n and \"dh \\ chs\"\n shows \"combine_assn chs (io_orig_assn dh v P) (waitin_assms'_assn UNIV p rdy ch V Q)\n \\\\<^sub>t io_orig_assn dh v \n (combine_assn chs P (waitin_assms'_assn UNIV p rdy ch V Q))\"\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(cases rule: io_orig_assn.cases[of dh v P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV p rdy ch V Q tr2])\n apply simp\n subgoal for w tr2'\n apply auto\n apply (elim combine_blocks_unpairE1)\n using assms apply auto\n apply(rule io_orig_assn.intros)\n by auto\n subgoal for w d tr2'\n apply auto\n apply(elim combine_blocks_unpairE3)\n using assms apply auto\n apply(rule io_orig_assn.intros)\n by auto\n subgoal for w tr2'\n apply auto\n apply (elim combine_blocks_unpairE1)\n using assms apply auto\n apply(rule io_orig_assn.intros)\n by auto\n subgoal for w d tr2'\n apply auto\n apply(elim combine_blocks_unpairE3)\n using assms apply auto\n apply(rule io_orig_assn.intros)\n by auto\n done\n done\n done\n*)\n\nlemma combine_wait_orig_out_0assm_rdy_out_0assm2:\n assumes \"dh \\ chs \\ ch \\ chs\"\n shows \"combine_assn chs (wait_orig_assn d p rdy (out_0assm_rdy_assn ch v rdy' P)) (out_0assm_assn dh w Q)\n \\\\<^sub>t out_0assm_assn dh w (combine_assn chs (wait_orig_assn d p rdy (out_0assm_rdy_assn ch v rdy' P)) Q)\"\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(out_0assm_rdy_assn ch v rdy' P)\" tr1])\n apply auto\n subgoal\n apply(cases rule: out_0assm_rdy_assn.cases[of ch v rdy' P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE1')\n using assms\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 p2 a2 b2 tr2'\n using assms\n by (auto elim!: sync_elims)\n done\n subgoal for d1 p1 tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3')\n using assms apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 a2 b2 p2 tr2'\n apply(cases \"\\ compat_rdy rdy' (a2,b2)\")\n subgoal\n by (auto elim!: sync_elims)\n apply(cases \"d2d1\")\n subgoal\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy')\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy')\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3')\n using assms apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 a2 b2 p2 tr2'\n apply(cases \"\\ compat_rdy rdy (a2,b2)\")\n subgoal\n by (auto elim!: sync_elims)\n apply(cases \"d2d\")\n subgoal\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n done\n done\n done\n\n\nlemma combine_wait_orig_in_0assm_rdy_out_0assm2:\n assumes \"dh \\ chs \\ ch \\ chs\"\n shows \"combine_assn chs (wait_orig_assn d p rdy (in_0assm_rdy_assn ch v rdy' P)) (out_0assm_assn dh w Q)\n \\\\<^sub>t out_0assm_assn dh w (combine_assn chs (wait_orig_assn d p rdy (in_0assm_rdy_assn ch v rdy' P)) Q)\"\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(cases rule: wait_orig_assn.cases[of d p rdy \"(in_0assm_rdy_assn ch v rdy' P)\" tr1])\n apply auto\n subgoal\n apply(cases rule: in_0assm_rdy_assn.cases[of ch v rdy' P tr1])\n apply auto\n subgoal for tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE1')\n using assms\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 p2 a2 b2 tr2'\n using assms\n by (auto elim!: sync_elims)\n done\n subgoal for vv tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE1')\n using assms\n apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 p2 a2 b2 tr2'\n using assms\n by (auto elim!: sync_elims)\n done\n subgoal for d1 p1 tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3')\n using assms apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 a2 b2 p2 tr2'\n apply(cases \"\\ compat_rdy rdy' (a2,b2)\")\n subgoal\n by (auto elim!: sync_elims)\n apply(cases \"d2d1\")\n subgoal\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy')\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy')\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_assn.cases[of dh w Q tr2])\n apply auto\n subgoal for tr2'\n apply(elim combine_blocks_unpairE3')\n using assms apply auto\n apply(rule out_0assm_assn.intros(1))\n by auto\n subgoal for d2 a2 b2 p2 tr2'\n apply(cases \"\\ compat_rdy rdy (a2,b2)\")\n subgoal\n by (auto elim!: sync_elims)\n apply(cases \"d2d\")\n subgoal\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule out_0assm_assn.intros(2))\n apply auto\n apply(cases rdy)\n by auto\n done\n done\n done\n\nlemma combine_waitin_tguar'_vassm'_waitin_assms'1:\n assumes \"ch1 \\ chs \\ ch2 \\ chs\"\n shows \"combine_assn chs (waitin_tguar'_vassm'_assn S1 p1 rdy1 ch1 V1 P1) (waitin_assms'_assn S2 p2 rdy2 ch2 V2 P2) \\\\<^sub>t P\"\n unfolding combine_assn_def entails_tassn_def apply auto\n subgoal for tr tr1 tr2\n apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S1 p1 rdy1 ch1 V1 P1 tr1])\n apply auto\n subgoal for v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_pairE)\n using assms by auto\n subgoal for v2 d2 tr2'\n using assms\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n using assms by auto\n subgoal\n apply(elim combine_blocks_pairE)\n using assms by auto\n done\n subgoal for d2 v2 tr2'\n using assms\n by (auto elim!: sync_elims)\n done\n subgoal for d1 v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n using assms\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"\\compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1compat_rdy rdy1 rdy2\")\n subgoal\n by(auto elim!: sync_elims)\n apply(cases \"d1>d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n using assms\n by(auto elim!: sync_elims)\n apply(cases \"d1\n ch2 \\ comms \\ \n (\\tr'. tr = CommBlock ch_type2 ch2 v2 # tr' \\\n combine_blocks comms [] tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n \ndefinition propc :: \"nat \\ estate \\ estate \\ bool\" where\n\"propc k task_es schs = (k>0 \\(status task_es = RUNNING \\ run_now schs = 1))\"\n\n\n\nlemma combine_taskdis_sch1':\n \"task_dis_assn' 1 k pd pc dis_s task_es task_s tr1 \\\n sched_assn' kk schs s tr2 \\\n task_prior task_es = 2 \\\n propc k task_es schs \\\n proper schs \\\n combine_blocks {req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1} tr1 tr2 tr \\\n tdsch1' k kk pd pc dis_s task_es task_s schs s tr\"\n thm nat_less_induct \n thm less_induct\n proof(induction \" k+kk\" arbitrary: k kk task_es task_s dis_s schs s tr1 tr2 tr rule: less_induct)\n case less\n then show ?case \n apply (cases k)\n subgoal \n apply (cases kk)\n subgoal apply simp\n apply (cases schs)\n apply auto\n apply (cases task_es)\n apply auto\n subgoal premises pre\n thm pre\n apply (rule combine_blocks_assn)\n apply(rule pre(1))\n apply(rule pre(2))\n apply(rule pre(5))\n by (auto elim!: sync_elims)\n done\n subgoal for kk'\n apply simp\n apply(cases schs)\n apply(cases task_es)\n subgoal by auto\n apply (simp del: tdsch1'.simps)\n subgoal for p rn rp st ent tp\n apply(erule disjE)\n subgoal premises pre\n thm pre\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule combine_emp_waitin_assms'1)\n by auto\n apply(erule disjE) \n subgoal premises pre\n thm pre\n apply (simp only:tdsch1'.simps)\n apply(rule disjI1)\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_waitin_assms'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply clarify\n apply simp\n apply(rule conjI)\n subgoal\n apply clarify\n apply(rule conjI)\n subgoal apply clarify\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s \"(Task st ent 2)\" task_s tr1 \"(Sch (p @ [(1, 2)]) rn rp)\"\" (s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6)[unfolded pre(10)] \n unfolding proper_def properp_def\n using properl_p1 propc_def\n by (auto simp add: properp_def)\n done\n subgoal apply clarify\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_out_0assm3)\n apply(rule entails_tassn_conj)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply auto\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_out_0assm2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s task_es task_s tr1 \"(Sch p 2 1)\"\"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6)[unfolded pre(10)] \n unfolding proper_def properp_def propc_def\n by auto\n done\n done\n subgoal\n apply clarify\n apply(rule conjI)\n subgoal apply clarify\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s task_es task_s tr1 \"(Sch (p @ [(1, 2)]) (- 1) rp)\" \"(s(CHR ''p'' := 1))\" tr2 tr ]\n using pre(4,5,6)[unfolded pre(10)] \n unfolding proper_def properp_def\n by auto\n done\n apply clarify\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_out_0assm2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s \"(Task st ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr ]\n using pre(4,5,6)[unfolded pre(10)] \n unfolding proper_def properp_def propc_def\n by auto\n done\n done\n apply(erule disjE)\n subgoal premises pre\n thm pre\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule combine_emp_waitin_assms'1)\n by auto\n apply(erule disjE)\n subgoal premises pre\n apply(simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_waitin_assms'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n subgoal for v \n apply clarify\n apply simp\n apply(rule conjI)\n subgoal apply clarify\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_out_0assm2)\n thm pre\n subgoal using pre(4,5) properl_p5[of p] unfolding proper_def properp_def\n apply(cases \"get_max p\")\n subgoal for a b\n apply(subgoal_tac \"b \\ 1\")\n subgoal\n by (auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n by auto\n done\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s \"(Task st ent 2)\" task_s tr1 \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2 tr ]\n using pre(4,5,6)[unfolded pre(10)] \n unfolding proper_def propc_def\n apply auto\n apply (cases \"get_max p\")\n subgoal for a b apply auto\n using properl_p3[of p] properl_p4[of p b]\n by auto\n done\n done\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s \"(Task st ent 2)\" task_s tr1 \"(Sch [] (- 1) (- 1))\" s tr2 tr]\n using pre(4,5,6) \n unfolding proper_def properp_def propc_def\n by auto\n done\n done\n apply(erule disjE)\n subgoal premises pre\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule combine_emp_waitin_assms'1)\n by auto\n subgoal premises pre\n apply(simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply (rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(11))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_emp_waitin_assms'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply auto\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of 0 kk' dis_s \"(Task st ent 2)\" task_s tr1 \"(Sch (del_proc p 2) rn rp)\" s tr2 tr]\n using pre(4,5,6)[unfolded pre(10)]\n unfolding proper_def propc_def\n using properl_p4[of p 2]\n by auto\n done\n done\n apply auto\n done\n done\n subgoal for k'\n apply(cases kk)\n subgoal\n apply auto\n apply (cases schs)\n apply (cases task_es)\n apply auto\n subgoal for p rn rp st ent\n apply (cases st)\n apply simp\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(2))\n apply(rule pre(3))\n apply(rule pre(6))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_emp5)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of k' 0 \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 2)\" \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre(4,5) unfolding propc_def by auto\n done\n subgoal \n apply simp\n apply(erule disjE)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(11))\n apply(rule pre(2))\n apply(rule pre(5))\n apply(rule combine_out_0assm_emp1)\n by auto\n apply(erule disjE)\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(11))\n apply(rule pre(2))\n apply(rule pre(5))\n apply(rule combine_out_0assm_emp1)\n by auto\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(11))\n apply(rule pre(2))\n apply(rule pre(5))\n apply(rule combine_out_0assm_emp1)\n by auto\n done\n apply(cases \"ent = 1\")\n apply auto\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(12))\n apply(rule pre(2))\n apply(rule pre(5))\n apply(rule combine_waitin_tguar'_vassm'_emp1)\n by auto\n subgoal premises pre\n thm pre\n apply(rule combine_blocks_assn)\n apply(rule pre(12))\n apply(rule pre(2))\n apply(rule pre(5))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_emp5)\n apply(rule combine_out_0assm_srdy_emp1)\n by auto\n done\n done\n subgoal for kk'\n apply auto\n apply (cases schs)\n subgoal for p rn rp\n apply(cases task_es)\n subgoal by auto\n subgoal for st ent tp\n apply (cases st)\n subgoal premises pre\n thm pre\n thm fun_upd_def\n using pre(2) pre(3)\n apply(simp only: pre(10,11,12))\n apply(simp only: task_dis_assn'.simps)\n apply(simp only: sched_assn'.simps)\n apply(erule disjE)\n subgoal premises pre'\n apply simp\n apply(rule disjI1)\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(2))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_waitin_assms'1)\n apply simp\n subgoal by auto\n apply (simp del: fun_upd_apply)\n apply(rule wait_orig_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"sched_assn' (Suc(kk')) (Sch p rn rp) s tr2\")\n prefer 2\n apply simp\n using pre(1)[of k' \"(Suc(kk'))\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\" \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre unfolding propc_def by auto\n done\n apply(erule disjE)\n subgoal \n apply(cases rule: wait_orig_assn.cases[of \"(pd - dis_s CHR ''t'')\"\n \"(\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {dispatch_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp)\n (task_s(CHR ''t'' := 0)))\"\n tr1])\n apply simp\n subgoal\n using pre(7)\n apply simp\n apply(rule disjI1)\n apply(rule wait_orig_assn.intros(1))\n using pre(1)[of k' \"Suc kk'\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\" \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n apply auto\n thm pre\n using pre(4,5,6,12)[unfolded pre(10,11)]\n unfolding propc_def\n by auto\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\" \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\"\" (req_ch 2)\n \"\"{1}\" \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n subgoal by auto\n subgoal by auto\n apply(cases \"1\\rp\")\n subgoal\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(Sch (p @ [(1, 2)]) rn rp)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n apply(subgoal_tac \"rn \\ 1\")\n prefer 2\n subgoal\n using pre\n unfolding propc_def proper_def properp_def by auto\n apply(cases \"rn \\ - 1\")\n subgoal\n apply auto\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(8))\n apply(rule pre'(10))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre' using pre(6)[unfolded pre(10,11)] unfolding proper_def properp_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre' by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n done\n subgoal apply auto\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(8))\n apply(rule pre'(10))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre' using pre(6)[unfolded pre(10,11)] unfolding proper_def properp_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n done\n done\n done\n subgoal for v d tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) (req_ch 2)\n {1}\n (\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n (WaitBlk (d - (pd - dis_s CHR ''t'')) (\\t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) # InBlock (req_ch 2) 1 # tr2')\")\n prefer 2\n subgoal \n apply(rule waitin_assms'_assn.intros(2))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal by auto\n done\n apply(rule wait_orig_assn.intros(2))\n prefer 2 subgoal by auto\n using pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(WaitBlk (d - (pd - dis_s CHR ''t'')) (\\t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (req_ch 2) 1 # tr2')\" tr']\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(cases \"d<(pd - dis_s CHR ''t'')\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr''\n apply simp\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d)) (Task WAIT ent tp)\n (task_s)\n (WaitBlk (pd - dis_s CHR ''t'' - d)\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\n ({}, {dispatch_ch 1}) #\n tr1')\")\n prefer 2\n subgoal premises pre'\n proof -\n have a1: \"(pd - (dis_s CHR ''t'' + d)) = (pd - dis_s CHR ''t'' - d)\"\n by auto\n have a2: \"\\t. dis_s CHR ''t'' + d + t = dis_s CHR ''t'' + (t + d)\"\n by auto\n show ?thesis\n apply (subst a1[symmetric])\n apply (subst a2[symmetric])\n apply simp\n apply (rule wait_orig_assn.intros(2))\n using pre' by auto\n qed\n apply(cases \"1\\rp\")\n subgoal\n apply auto\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\"\n \"(task_s)\" \n \"(WaitBlk (pd - dis_s CHR ''t'' - d)\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\n ({}, {dispatch_ch 1}) #\n tr1')\" \"(Sch (p @ [(1, 2)]) rn rp)\"\n \"(s(CHR ''p'' := 1))\" tr2' tr'']\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n apply simp\n apply(cases \"rn \\ - 1\")\n subgoal\n apply auto\n subgoal premises pre'\n thm pre'(13)\n apply(rule combine_blocks_assn)\n apply(rule pre'(13))\n apply(rule pre'(8))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre pre'\n unfolding proper_def properp_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre pre'\n unfolding proper_def properp_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\"\n task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n done\n apply auto\n subgoal premises pre'\n thm pre'(13)\n apply(rule combine_blocks_assn)\n apply(rule pre'(13))\n apply(rule pre'(8))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre pre'\n unfolding proper_def properp_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply auto\n subgoal for tr tr1 tr2\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\"\n task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n done\n done\n done\n apply(simp del:tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule disjI1)\n apply(rule wait_orig_assn.intros(2))\n apply auto\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (req_ch 2) 1 # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal apply(simp only: sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(1))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def\n by auto\n subgoal using pre unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n subgoal for v tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n done\n subgoal for d v tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) (req_ch 2)\n {1}\n (\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n (WaitBlk (d - (pd - dis_s CHR ''t'')) (\\t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) # InBlock (req_ch 2) v # tr2')\")\n prefer 2\n subgoal \n apply(rule waitin_assms'_assn.intros(4))\n by auto\n apply(rule wait_orig_assn.intros(2))\n prefer 2 subgoal by auto\n using pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(WaitBlk (d - (pd - dis_s CHR ''t'')) (\\t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (req_ch 2) v # tr2')\" tr']\n using pre(4,5,6,12)[unfolded pre(10,11)] \n using properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(cases \"d<(pd - dis_s CHR ''t'')\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr''\n apply simp\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n done\n apply(simp del:tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule disjI1)\n apply(rule wait_orig_assn.intros(2))\n apply auto\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (req_ch 2) v # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal apply(simp only: sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(3))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def\n by auto\n subgoal using pre unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n apply simp\n apply(rule disjI1)\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(2))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_waitin_assms'1)\n subgoal by auto\n subgoal by auto\n apply (simp only: merge_rdy.simps)\n subgoal\n proof-\n have a:\"({} \\ {},{dispatch_ch 1} \\\n {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) = ({},\n {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1})\"\n by auto\n have b:\"(pd - dis_s CHR ''t'') = (pd - dis_s CHR ''t'')\" by auto\n show ?thesis\n apply(subst a)\n apply(subst b)\n apply(rule wait_orig_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"sched_assn' (Suc(kk')) (Sch p rn rp) s tr2\")\n prefer 2\n apply simp\n using pre(1)[of k' \"(Suc(kk'))\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\" \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre unfolding propc_def by auto\n done\n qed\n done\n apply(erule disjE)\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(pd - dis_s CHR ''t'')\"\n \"(\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {dispatch_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp)\n (task_s(CHR ''t'' := 0)))\"\n tr1])\n apply simp\n subgoal\n apply simp\n apply(rule disjI1)\n apply(rule wait_orig_assn.intros(1))\n apply auto\n using pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre unfolding propc_def by auto\n subgoal for tr1'\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\"\n \"{0}\"\n \"(\\v d. if 0 < length p\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\" tr2])\n apply simp\n subgoal for v tr2'\n using pre(7)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply (rule waitin_tguar'_vassm'_assn.intros(1))\n subgoal by auto\n subgoal by auto\n subgoal for tr'\n apply(cases \"p \\ []\")\n subgoal\n apply simp\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(8))\n apply(rule pre'(10))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using properl_p5[of p]\n using pre'(11)\n using pre(6) pre(10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n apply simp\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2 tr])\n subgoal by auto\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def\n apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4 unfolding propc_def proper_def\n apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n done\n subgoal\n apply simp\n subgoal \n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(Sch [] (- 1) (- 1))\" s tr2' tr'])\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n done\n done\n subgoal for v d tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (free_ch 2) 0 # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply (simp only: sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(2))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def by auto\n subgoal by auto\n done\n done\n apply(cases \"(pd - dis_s CHR ''t'')>d\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\n (Task WAIT ent tp) task_s (WaitBlk (pd - dis_s CHR ''t'' - d)\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\n ({}, {dispatch_ch 1}) #\n tr1')\")\n prefer 2\n subgoal premises pre'\n proof-\n have a1:\"(pd - (dis_s CHR ''t'' + d)) = (pd - dis_s CHR ''t'' - d)\"\n by auto\n have a2:\"(\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d + t)))) = \n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\"\n apply(rule ext)\n by auto\n show ?thesis apply simp\n apply(subst a1)\n apply(subst a2)\n apply(rule wait_orig_assn.intros(2))\n using pre' by auto\n qed\n apply(cases \"p \\ []\")\n subgoal\n apply simp\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(12))\n apply(rule pre'(8))\n apply(rule pre'(11))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using properl_p5[of p]\n using pre'(13)\n using pre(6) pre(10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n apply simp\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for tr tr1 tr2\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\" task_s tr1 \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2 tr])\n subgoal by auto\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def\n apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4 unfolding propc_def proper_def\n apply(cases \"get_max p\") by auto\n subgoal by auto \n done\n done\n done\n subgoal\n apply simp\n subgoal \n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\" task_s \"(WaitBlk (pd - dis_s CHR ''t'' - d)\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\n ({}, {dispatch_ch 1}) #\n tr1')\" \"(Sch [] (- 1) (- 1))\" s tr2' tr'])\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n done\n done\n apply simp\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (free_ch 2) 0 # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply(simp only:sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(1))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def by auto\n subgoal by auto\n done\n done\n subgoal for v tr2'\n using pre(7)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply (rule waitin_tguar'_vassm'_assn.intros(3))\n subgoal by auto\n subgoal by auto\n done\n subgoal for d v tr2'\n using pre(7)\n apply(simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (free_ch 2) v # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply (simp only: sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(4))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def by auto\n subgoal by auto\n done\n done\n apply(cases \"(pd - dis_s CHR ''t'')>d\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n done\n done\n apply simp\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (free_ch 2) v # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply(simp only:sched_assn'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_assms'_assn.intros(3))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre unfolding proper_def by auto\n subgoal by auto\n done\n done\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n apply simp\n apply(rule disjI1)\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(1))\n apply(rule pre'(2))\n apply(rule pre(7))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_waitin_assms'1)\n subgoal by auto\n subgoal by auto\n apply (simp only: merge_rdy.simps)\n subgoal\n proof-\n have a:\"({} \\ {},{dispatch_ch 1} \\\n {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) = ({},\n {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1})\"\n by auto\n have b:\"(pd - dis_s CHR ''t'') = (pd - dis_s CHR ''t'')\" by auto\n show ?thesis\n apply(subst a)\n apply(subst b)\n apply(rule wait_orig_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"sched_assn' (Suc(kk')) (Sch p rn rp) s tr2\")\n prefer 2\n apply simp\n using pre(1)[of k' \"(Suc(kk'))\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\" \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre unfolding propc_def by auto\n done\n qed\n done\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(pd - dis_s CHR ''t'')\"\n \"(\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {dispatch_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 tp)\n (task_s(CHR ''t'' := 0)))\"\n tr1])\n apply simp\n subgoal\n apply simp\n apply(rule disjI1)\n apply(rule wait_orig_assn.intros(1))\n apply auto\n using pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1 \"(Sch p rn rp)\" s tr2 tr]\n using pre unfolding propc_def by auto\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\" \"(\\v d. sched_assn' kk' (sched_del_proc 2 (Sch p rn rp) s) s)\" tr2])\n apply simp\n subgoal for v tr2'\n using pre(7)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task WAIT ent tp)\" task_s tr1 \"(Sch (del_proc p 2) rn rp)\" s tr2' tr'])\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n subgoal for v d tr2'\n using pre(7)\n apply (simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (exit_ch 2) 0 # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply (simp only: sched_assn'.simps) \n apply(rule disjI2)+\n apply(rule waitin_assms'_assn.intros(2))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n apply(cases \"(pd - dis_s CHR ''t'')>d\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule disjI2)+\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\" \"(Task WAIT ent tp)\"\n task_s \"(WaitBlk (pd - dis_s CHR ''t'' - d)\n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\n ({}, {dispatch_ch 1}) #\n tr1')\" \"(Sch (del_proc p 2) rn rp)\" s tr2' tr'])\n subgoal by auto\n subgoal premises pre'\n proof-\n have a1:\"(pd - (dis_s CHR ''t'' + d)) = (pd - dis_s CHR ''t'' - d)\"\n by auto\n have a2:\"(\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d + t)))) = \n (\\t. ParState (EState (Task WAIT ent tp, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d)))))\"\n apply(rule ext)\n by auto\n show ?thesis\n apply simp\n apply(subst a1)\n apply(subst a2)\n apply(rule wait_orig_assn.intros(2))\n using pre' by auto\n qed\n subgoal by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n apply simp\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (exit_ch 2) 0 # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply(simp only: sched_assn'.simps)\n apply(rule disjI2)+\n apply(rule waitin_assms'_assn.intros(1))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n subgoal for v tr2'\n using pre(7)\n apply simp\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d v tr2'\n using pre(7)\n apply (simp del: tdsch1'.simps)\n apply(cases \"(pd - dis_s CHR ''t'')t. EState (Sch p rn rp, s))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) #\n InBlock (exit_ch 2) v # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply (simp only: sched_assn'.simps) \n apply(rule disjI2)+\n apply(rule waitin_assms'_assn.intros(4))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n apply(cases \"(pd - dis_s CHR ''t'')>d\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(rule disjI2)+\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n apply simp\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of k' \"(Suc kk')\" \"(dis_s(CHR ''t'' := 0))\" \"(Task READY 0 tp)\"\n \"(task_s(CHR ''t'' := 0))\" tr1' \"(Sch p rn rp)\" s \"(InBlock (exit_ch 2) v # tr2')\" tr'])\n subgoal by auto\n subgoal by auto\n subgoal \n apply(simp only: sched_assn'.simps)\n apply(rule disjI2)+\n apply(rule waitin_assms'_assn.intros(3))\n by auto\n subgoal using pre by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n done\n done\n done\n (* part 2*)\n subgoal premises pre\n thm pre\n using pre(2) pre(3) pre(4) pre(7)\n apply(simp add: pre(10,11,12,4) del:tdsch1'.simps sched_assn'.simps)\n apply(erule disjE)\n subgoal\n apply(simp del:tdsch1'.simps)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'1)\n subgoal by auto\n subgoal by auto\n subgoal by auto\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply (simp del: fun_upd_apply)\n apply(cases \"rn \\ -1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_waitin_tguar'_vassm'_out_0assm2)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n subgoal by auto\n apply (simp del: fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of k' kk' dis_s \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\" tr1\n \"(Sch p 1 ((s(CHR ''p'' := 2)) CHR ''p''))\" \"(s(CHR ''p'' := 2))\" tr2 tr]\n apply auto\n using pre(4,5,6,12)[unfolded pre(10,11)] \n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n subgoal by auto\n apply (simp del: fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n using pre(1)[of k' kk' dis_s \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\" tr1\n \"(Sch p 1 ((s(CHR ''p'' := 2)) CHR ''p''))\" \"(s(CHR ''p'' := 2))\" tr2 tr]\n apply auto\n using pre(4,5,6,12)[unfolded pre(10,11)] \n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply(cases \"1\\rp\")\n subgoal apply (simp del: fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (p @ [(1, 2)]) rn rp)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply (cases \"rn \\ - 1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(simp del:fun_upd_apply)\n apply(cases \"p \\ []\")\n subgoal\n apply(simp del:fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal apply(cases \"get_max p\")\n using properl_p5[of p] pre(6,10) unfolding properp_def proper_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(sched_get_max (Sch p rn rp) s)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def\n apply auto\n apply(cases \"get_max p\")\n using properl_p4 properl_p5[of p]\n by auto\n done\n apply auto\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch [] (- 1) (- 1))\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def properp_def\n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply (simp del:fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 properl_p4\n unfolding propc_def proper_def properp_def\n by auto\n done\n done\n apply(erule disjE)\n subgoal\n apply(simp del:tdsch1'.simps)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'1)\n subgoal by auto\n subgoal by auto\n subgoal by auto\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply (simp del: fun_upd_apply)\n apply(cases \"rn \\ -1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm_rdy_out_0assm2)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans) \n apply(rule combine_wait_orig_out_0assm1)\n subgoal \n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (auto del: fun_upd_apply)\n apply(rule combine_out_0assm_rdy_out_0assm)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans) \n apply(rule combine_wait_orig_out_0assm1)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (auto del: fun_upd_apply)\n apply(rule combine_out_0assm_rdy_out_0assm)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply(cases \"1\\rp\")\n subgoal apply (simp del: fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (p @ [(1, 2)]) rn rp)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply (cases \"rn \\ - 1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(simp del:fun_upd_apply)\n apply(cases \"p \\ []\")\n subgoal\n apply(simp del:fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal apply(cases \"get_max p\")\n using properl_p5[of p] pre(6,10) unfolding properp_def proper_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(sched_get_max (Sch p rn rp) s)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def\n apply auto\n apply(cases \"get_max p\")\n using properl_p4 properl_p5[of p]\n by auto\n done\n apply auto\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch [] (- 1) (- 1))\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def properp_def\n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply (simp del:fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 properl_p4\n unfolding propc_def proper_def properp_def\n by auto\n done\n done\n subgoal\n apply(simp del:tdsch1'.simps)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'1)\n subgoal by auto\n subgoal by auto\n subgoal by auto\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply (simp del: fun_upd_apply)\n apply(cases \"rn \\ -1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_in_0assm_rdy_out_0assm2)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans) \n apply(rule combine_wait_orig_out_0assm1)\n subgoal \n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (auto del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_in_0assm_rdy_out_0assm)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"pd = task_s CHR ''t''\")\n apply (auto del: fun_upd_apply)\n using pre(1)[of \"k'\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\" tr1 \"(Sch p 1 2)\" \"(s(CHR ''p'' := 2))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def properp_def\n by auto\n done\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans) \n apply(rule combine_wait_orig_out_0assm1)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (auto del: fun_upd_apply)\n apply(rule entails_tassn_trans) \n apply(rule combine_in_0assm_rdy_out_0assm)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"pd = task_s CHR ''t''\")\n apply (auto del: fun_upd_apply)\n using pre(1)[of \"k'\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''c'' := up_ent_c ent (task_s CHR ''c'')))\" tr1 \"(Sch p 1 2)\" \"(s(CHR ''p'' := 2))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def properp_def\n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(subgoal_tac \"rp<2 \\ rn\\1\")\n prefer 2\n subgoal using pre(4,5,6,8,9,10,11,12)\n unfolding proper_def properp_def propc_def\n by auto\n apply(cases \"1\\rp\")\n subgoal apply (simp del: fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (p @ [(1, 2)]) rn rp)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply (cases \"rn \\ - 1\")\n subgoal\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply (simp del: fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal using pre \n unfolding proper_def properp_def propc_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1\n unfolding propc_def proper_def properp_def \n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply(simp del:fun_upd_apply)\n apply(cases \"p \\ []\")\n subgoal\n apply(simp del:fun_upd_apply)\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal apply(cases \"get_max p\")\n using properl_p5[of p] pre(6,10) unfolding properp_def proper_def\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(sched_get_max (Sch p rn rp) s)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def\n apply auto\n apply(cases \"get_max p\")\n using properl_p4 properl_p5[of p]\n by auto\n done\n apply auto\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch [] (- 1) (- 1))\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 \n unfolding propc_def proper_def properp_def\n by auto\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule combine_out_0assm_waitin_assm'3)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal premises pre'\n thm pre'\n apply (simp only:tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule combine_blocks_assn)\n apply(rule pre'(3))\n apply(rule pre'(4))\n apply(rule pre'(2))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_waitin_assm'2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule in_0orig_vassm'_assn_tran)\n apply (simp del:fun_upd_apply)\n unfolding combine_assn_def entails_tassn_def\n apply clarify\n subgoal for tr tr1 tr2\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc dis_s ((Task READY ent 2)) task_s tr1\")\n prefer 2 \n subgoal using pre by auto\n apply auto\n using pre(1)[of \"(Suc k')\" kk' dis_s \"(Task READY ent 2)\" task_s tr1 \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2 tr]\n using pre(4,5,6,12)[unfolded pre(10,11)] properl_p1 properl_p4\n unfolding propc_def proper_def properp_def\n by auto\n done\n done\n done\n (* part 3 *)\n subgoal premises pre\n thm pre\n using pre(2) pre(3) pre(4) pre(7)\n apply(simp add: pre(10,11,12,4) del:tdsch1'.simps sched_assn'.simps)\n apply(cases \"ent \\ Suc 0\")\n subgoal\n apply(simp del:tdsch1'.simps sched_assn'.simps)\n done\n apply(simp del:tdsch1'.simps sched_assn'.simps)\n apply(erule disjE)\n subgoal\n apply(simp del:tdsch1'.simps)\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(4))\n apply(rule pre'(5))\n apply(rule pre'(2))\n apply(rule combine_waitin_tguar'_vassm'_waitin_assms'1)\n by auto\n apply(erule disjE)\n subgoal\n apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{0..t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\" \"(preempt_ch 1)\" \"{0}\"\n \"(\\v d. task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\n (Task READY (Suc 0) 2)\n (task_s\n (CHR ''t'' := task_s CHR ''t'' + d, CHR ''c'' := task_s CHR ''c'' + d)))\"\n tr1])\n apply simp\n subgoal for v1 tr1'\n apply(simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n using pre(1)[of \"Suc k'\" kk' dis_s task_es task_s tr1 \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n using properl_p1\n unfolding propc_def proper_def properp_def\n by auto\n done\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n using pre(1)[of \"Suc k'\" kk' dis_s task_es task_s tr1 \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n using properl_p1\n unfolding propc_def proper_def properp_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\"\n \"(Task RUNNING (Suc 0) 2)\"\"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) 0 # tr1')\" \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\n (Task RUNNING (Suc 0) 2)\n (task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\n (WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) 0 # tr1')\")\n prefer 2\n subgoal premises pre'\n proof-\n have 1:\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t)))) =\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\"\n apply(rule ext)\n by auto\n show ?thesis\n apply simp\n apply(rule disjI1)\n apply(subst 1) \n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal by auto\n using pre'(7)\n by auto\n qed\n subgoal premises pre'\n thm pre'\n apply(rule pre'(23))\n subgoal by auto\n subgoal using pre'(24) by auto\n subgoal using pre' by auto\n subgoal by auto\n subgoal unfolding propc_def\n by auto\n subgoal \n using properl_p1\n unfolding proper_def properp_def \n using pre' by auto\n subgoal using pre' by auto\n done\n done\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply (elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\"\n \"(Task RUNNING (Suc 0) 2)\"\"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(InBlock (preempt_ch 1) 0 # tr1')\" \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\n (Task RUNNING (Suc 0) 2)\n (task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\n (InBlock (preempt_ch 1) 0 # tr1') \")\n prefer 2\n subgoal premises pre'\n apply simp\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n using pre' by auto\n subgoal premises pre'\n thm pre'\n apply(rule pre'(23))\n subgoal by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal by auto\n subgoal unfolding propc_def\n by auto\n subgoal \n using properl_p1\n unfolding proper_def properp_def \n using pre' by auto\n subgoal using pre' by auto\n done\n done\n done\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply (elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n subgoal for v1 tr1'\n apply(simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n using pre(1)[of \"Suc k'\" kk' dis_s task_es task_s tr1 \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n using properl_p1\n unfolding propc_def proper_def properp_def\n by auto\n done\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n thm pre\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n using pre(1)[of \"Suc k'\" kk' dis_s task_es task_s tr1 \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n using properl_p1\n unfolding propc_def proper_def properp_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\"\n \"(Task RUNNING (Suc 0) 2)\"\"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) v1 # tr1')\" \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\n (Task RUNNING (Suc 0) 2)\n (task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\n (WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) v1 # tr1')\")\n prefer 2\n subgoal premises pre'\n proof-\n have 1:\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t)))) =\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\"\n apply(rule ext)\n by auto\n show ?thesis\n apply simp\n apply(rule disjI1)\n apply(subst 1) \n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal using pre'\n by auto\n done\n qed\n subgoal premises pre'\n thm pre'\n apply(rule pre'(22))\n subgoal by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal by auto\n subgoal unfolding propc_def\n by auto\n subgoal \n using properl_p1\n unfolding proper_def properp_def \n using pre' by auto\n subgoal using pre' by auto\n done\n done\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply (elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n subgoal by auto\n subgoal by auto\n subgoal by auto\n using pre(4,5,6,10,11,12)\n unfolding propc_def proper_def properp_def\n apply auto\n using pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\"\n \"(Task RUNNING (Suc 0) 2)\"\"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(InBlock (preempt_ch 1) v1 # tr1')\" \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr']\n apply(subgoal_tac \"task_dis_assn' 1 (Suc k') pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\n (Task RUNNING (Suc 0) 2)\n (task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\n (InBlock (preempt_ch 1) v1 # tr1') \")\n prefer 2\n subgoal premises pre'\n apply simp\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n using pre' by auto\n subgoal premises pre'\n thm pre'\n apply(rule pre'(22))\n subgoal by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal by auto\n subgoal unfolding propc_def\n by auto\n subgoal \n using properl_p1\n unfolding proper_def properp_def \n using pre' by auto\n subgoal using pre' by auto\n done\n done\n done\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply (elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(4))\n apply(rule pre'(5))\n apply(rule pre'(2))\n apply(rule combine_waitin_tguar'_vassm'_waitin_assms'1)\n by auto\n apply(erule disjE)\n subgoal\n apply(simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{0..t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\" \"(preempt_ch 1)\" \"{0}\"\n \"(\\v d. task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\n (Task READY (Suc 0) 2)\n (task_s\n (CHR ''t'' := task_s CHR ''t'' + d, CHR ''c'' := task_s CHR ''c'' + d)))\"\n tr1])\n apply simp\n subgoal for v1 tr1'\n apply simp\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\" \"{0}\" \n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\" tr2])\n subgoal by auto\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by(auto simp add: true_assn_def)\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\" \"{0}\" \n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\" tr2])\n subgoal by auto\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by(auto simp add: true_assn_def)\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n by(auto simp add: true_assn_def)\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n by(auto simp add: true_assn_def)\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by(auto simp add: true_assn_def)\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by(auto simp add: true_assn_def)\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by(auto simp add: true_assn_def)\n done\n subgoal for v1 tr1'\n apply simp\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\" \"{0}\" \n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\" tr2])\n subgoal by auto\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by(auto simp add: true_assn_def)\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\" \"{0}\" \n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\" tr2])\n subgoal by auto\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by(auto simp add: true_assn_def)\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n by(auto simp add: true_assn_def)\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n by(auto simp add: true_assn_def)\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by(auto simp add: true_assn_def)\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by(auto simp add: true_assn_def)\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by(auto simp add: true_assn_def)\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(4))\n apply(rule pre'(5))\n apply(rule pre'(2))\n apply(rule combine_waitin_tguar'_vassm'_waitin_assms'1)\n by auto\n subgoal\n apply(simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{0..t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\" \"(preempt_ch 1)\" \"{0}\"\n \"(\\v d. task_dis_assn' 1 k' pd pc (dis_s(CHR ''t'' := dis_s CHR ''t'' + d))\n (Task READY (Suc 0) 2)\n (task_s\n (CHR ''t'' := task_s CHR ''t'' + d, CHR ''c'' := task_s CHR ''c'' + d)))\"\n tr1])\n apply simp\n subgoal for v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\" \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(InBlock (preempt_ch 1) 0 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n using pre properl_p4 unfolding proper_def properp_def propc_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n apply auto\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\" \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \n \"(WaitBlk d1\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) 0 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n using pre properl_p4 unfolding proper_def properp_def propc_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\" \n \"(WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) 0 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n subgoal by auto\n subgoal \n apply simp\n apply(rule disjI1)\n apply(subgoal_tac\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t)))) = \n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule ext)\n by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def by auto\n subgoal by auto\n done\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\" \n \"(InBlock (preempt_ch 1) 0 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n subgoal by auto\n subgoal apply simp\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def by auto\n subgoal by auto\n done\n done\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n subgoal for v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\" \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(InBlock (preempt_ch 1) v1 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n using pre properl_p4 unfolding proper_def properp_def propc_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n by (auto elim!: sync_elims) \n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for v2 d2 tr2'\n apply auto\n by (auto elim!: sync_elims) \n done\n subgoal for d1 v1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\" \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \n \"(WaitBlk d1\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) v1 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n using pre properl_p4 unfolding proper_def properp_def propc_def\n by auto\n done\n subgoal for v2 d2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\" \n \"(WaitBlk (d1 - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n InBlock (preempt_ch 1) v1 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n subgoal by auto\n subgoal \n apply simp\n apply(rule disjI1)\n apply(subgoal_tac\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t)))) = \n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n apply auto\n apply(rule ext)\n by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def by auto\n subgoal by auto\n done\n done\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\" \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\" \n \"(InBlock (preempt_ch 1) v1 # tr1')\"\n \"(Sch (del_proc p 2) rn rp)\" \"s\" tr2' tr'])\n subgoal by auto\n subgoal apply simp\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def by auto\n subgoal by auto\n done\n done\n subgoal for v2 tr2'\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply auto\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n done\n done\n apply(simp del:tdsch1'.simps)\n apply(erule disjE)\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\"tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 1)\"\n \"{2}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\"tr2])\n apply simp\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_pairE)\n by auto\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_pairE)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d1 rdy1 p1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 1)\"\n \"{2}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\"tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 1)\"\n \"{2}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\"tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_pairE)\n by auto\n by auto\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_pairE)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by auto\n done\n subgoal for d1 rdy1 p1 tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 1)\"\n \"{2}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 1) 0\n (sched_assn' kk'\n (sched_assign 1 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\"tr2])\n apply simp\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n by auto\n subgoal for v2 tr2'\n apply auto\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n by auto\n done\n done\n done\n apply(erule disjE)\n subgoal\n apply(cases rule:wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(OutBlock (free_ch 1) 0 # tr1')\" \"(Sch (p @ [(1, 2)]) 1 2)\"\n \"(s(CHR ''p'' := 1))\" tr2' tr'])\n using pre properl_p1\n unfolding propc_def proper_def properp_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n done\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d1 rdy1 p1 tr1'\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(WaitBlk d1 p1 rdy1 # tr1')\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n using pre properl_p1 unfolding proper_def properp_def propc_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"tr1\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n using pre properl_p1 unfolding proper_def properp_def propc_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\"\n \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(WaitBlk (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n OutBlock (free_ch 1) 0 # tr1'')\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n subgoal by auto\n subgoal premises pre' \n apply simp\n apply(rule disjI2)\n apply(subgoal_tac \"(min (pd - (task_s CHR ''t'' + d2)) (pc - (task_s CHR ''c'' + d2))) = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\")\n apply(subgoal_tac \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t))))\n = (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply(rule out_0assm_srdy_assn.intros(1))\n subgoal using pre' by auto\n subgoal using pre' by auto\n apply(rule ext)\n by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p1 unfolding proper_def properp_def \n by auto\n subgoal by auto\n done\n done\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s\n (CHR ''t'' :=dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \n \"(Task RUNNING (Suc 0) 2)\"\n \"(task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\"\n \"OutBlock (free_ch 1) 0 # tr1''\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac\"(min (pd -\n (task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (pc -\n (task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))) = 0\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n apply auto\n apply(rule out_0assm_srdy_assn.intros(1))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p1 unfolding proper_def properp_def \n by auto\n subgoal by auto\n done\n done\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n apply(cases \"d2=(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto \n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n by auto\n done\n subgoal for d1 rdy1 p1 tr1''\n apply(cases rule:waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(req_ch 2)\"\n \"{1}\"\n \"(\\v d. if v \\ rp\n then sched_assn' kk' (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))\n else if rn \\ - 1\n then out_0assm_assn (preempt_ch rn) 0\n (out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\n else out_0assm_assn (run_ch 2) 0\n (sched_assn' kk'\n (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v)))\n (s(CHR ''p'' := v))))\" tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"tr1\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n using pre properl_p1 unfolding proper_def properp_def propc_def \n by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\"\n \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\"\n \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\" \"(Task RUNNING (Suc 0) 2)\"\n \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(WaitBlk (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n WaitBlk d1 p1 rdy1 # tr1'')\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n subgoal by auto\n subgoal premises pre' \n apply simp\n apply(rule disjI2)\n apply(subgoal_tac \"(min (pd - (task_s CHR ''t'' + d2)) (pc - (task_s CHR ''c'' + d2))) = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\")\n apply(subgoal_tac \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t))))\n = (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply(rule out_0assm_srdy_assn.intros(2))\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n apply(rule ext)\n by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p1 unfolding proper_def properp_def \n by auto\n subgoal by auto\n done\n done\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s\n (CHR ''t'' :=dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \n \"(Task RUNNING (Suc 0) 2)\"\n \"(task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\"\n \"(WaitBlk d1 p1 rdy1 # tr1'')\"\n \"(Sch (p @ [(1, 2)]) 1 2)\" \"(s(CHR ''p'' := 1))\" tr2' tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac\"(min (pd -\n (task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (pc -\n (task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))) = 0\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n apply auto\n apply(rule out_0assm_srdy_assn.intros(2))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p1 unfolding proper_def properp_def \n by auto\n subgoal by auto\n done\n done\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI1)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\"\n \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\"\n \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal apply auto\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n subgoal for tr'\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n done\n by auto\n done\n done\n done\n apply(erule disjE)\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 1)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)+\n apply(elim combine_blocks_pairE)\n apply auto\n subgoal\n apply(rule wait_orig_assn.intros(1))\n apply auto\n apply(cases k')\n subgoal\n apply simp\n apply(simp add: emp_assn_def)\n apply(cases rule: out_0assm_assn.cases[of \"(run_ch (run_now (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)))\" 0\n \"(sched_assn' kk' (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior) s)\" tr2'])\n apply auto\n subgoal for tr2''\n apply(elim combine_blocks_emptyE'3')\n subgoal\n using properl_p5[of p] pre(6,10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule out_0assm_assn.intros(1))\n apply(rule pre(1)[of 0 kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s \"[]\" \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2'' tr'])\n subgoal by auto\n subgoal by (auto simp add: emp_assn_def)\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p5[of p] properl_p4[of p] unfolding proper_def \n apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n subgoal\n by (auto elim: sync_elims)\n done\n subgoal for k''\n apply simp\n apply(cases rule: wait_orig_assn.cases[of \"(pd - dis_s CHR ''t'')\"\n \"(\\t. ParState (EState (Task WAIT (Suc 0) 2, task_s))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {dispatch_ch 1})\"\n \"(task_dis_assn' 1 k'' pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 2)\n (task_s(CHR ''t'' := 0)))\"\n tr1' ])\n apply simp\n subgoal\n apply(cases k'')\n subgoal\n apply simp\n apply(simp add: emp_assn_def)\n apply(cases rule: out_0assm_assn.cases[of \"(run_ch (run_now (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)))\" 0\n \"(sched_assn' kk' (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior) s)\" tr2'])\n apply auto\n subgoal for tr2''\n apply(elim combine_blocks_emptyE'3')\n subgoal\n using properl_p5[of p] pre(6,10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr'\n apply simp\n apply(rule out_0assm_assn.intros(1))\n subgoal premises pre'\n proof-\n have a:\"(dis_s CHR ''t'') = pd\" using pre' by auto\n then show ?thesis\n apply(subst a)\n apply(rule pre(1)[of \"(Suc 0)\" kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s \"[]\" \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2'' tr'])\n subgoal by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n by(auto simp add: emp_assn_def)\n subgoal using pre' by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def unfolding proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding proper_def \n apply(cases \"get_max p\") by auto\n subgoal using pre' by auto\n done\n qed\n done\n done\n subgoal\n by (auto elim: sync_elims)\n done\n subgoal for k'''\n apply simp\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(17))\n apply(rule pre'(10))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n thm pre'\n subgoal for Tr Tr1 Tr2\n subgoal premises pre''\n proof-\n have a:\"(dis_s CHR ''t'') = pd\" using pre' by auto\n then show ?thesis\n apply(subst a)\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n using pre' pre'' by auto\n subgoal using pre'' by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre'' by auto\n done\n qed\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(17))\n apply(rule pre'(10))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n subgoal premises pre''\n proof-\n have a:\"(dis_s CHR ''t'') = pd\" using pre' by auto\n then show ?thesis\n apply(subst a)\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto \n apply(rule wait_orig_assn.intros(1))\n using pre' pre'' by auto\n subgoal using pre'' by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre'' by auto\n done\n qed\n done\n done\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(17))\n apply(rule pre'(10))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n subgoal premises pre''\n proof-\n have a:\"(dis_s CHR ''t'') = pd\" using pre' by auto\n then show ?thesis\n apply(subst a)\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n using pre' pre'' by auto\n subgoal using pre'' by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre'' by auto\n done\n qed\n done\n done\n done\n done\n subgoal premises pre' for tr1''\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(8))\n apply(rule pre'(10))\n apply(rule pre'(12))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n apply(rule pre(1)[of \"(Suc k'')\" kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n done\n done\n subgoal \n apply(rule wait_orig_assn.intros(1))\n apply auto\n apply(rule pre(1)[of k' kk' dis_s \"(Task WAIT (Suc 0) 2)\" task_s tr1' \"(Sch [] (- 1) (- 1))\" s tr2' tr])\n using pre\n by (auto simp add:proper_def propc_def properp_def)\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_pairE) \n by auto \n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d rdy pp tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 1)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 1)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_pairE)\n subgoal by auto\n subgoal by auto\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)+\n apply auto\n subgoal for tr'\n apply(rule wait_orig_assn.intros(2))\n apply auto\n apply(cases k')\n subgoal\n apply simp\n apply(simp add: emp_assn_def)\n apply(cases rule: out_0assm_assn.cases[of \"(run_ch (run_now (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)))\" 0\n \"(sched_assn' kk' (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior) s)\" tr2'])\n apply auto\n subgoal for tr2''\n apply(elim combine_blocks_emptyE'3')\n subgoal\n using properl_p5[of p] pre(6,10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr''\n apply simp\n apply(rule out_0assm_assn.intros(1))\n apply(rule pre(1)[of 0 kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \n \"[]\" \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2'' tr''])\n subgoal by auto\n subgoal by (auto simp add: emp_assn_def)\n subgoal by auto\n subgoal by auto\n subgoal using pre unfolding propc_def by auto\n subgoal using pre properl_p5[of p] properl_p4[of p] unfolding proper_def \n apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n subgoal\n by (auto elim: sync_elims)\n done\n subgoal for k''\n apply simp\n apply(cases rule: wait_orig_assn.cases[of \"(pd - (dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\"\n \"(\\t. ParState\n (EState\n (Task WAIT (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') + t))))\"\n \"({}, {dispatch_ch 1})\"\n \"(task_dis_assn' 1 k'' pd pc (dis_s(CHR ''t'' := 0)) (Task READY 0 2)\n (task_s(CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''), CHR ''t'' := 0)))\"\n tr1'' ])\n apply simp\n subgoal\n apply(cases k'')\n subgoal\n apply simp\n apply(simp add: emp_assn_def)\n apply(cases rule: out_0assm_assn.cases[of \"(run_ch (run_now (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)))\" 0\n \"(sched_assn' kk' (case get_max p of (prior, t) \\ Sch (del_proc p t) t prior) s)\" tr2'])\n apply auto\n subgoal for tr2''\n apply(elim combine_blocks_emptyE'3')\n subgoal\n using properl_p5[of p] pre(6,10)\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n subgoal for tr''\n apply simp\n apply(rule out_0assm_assn.intros(1))\n apply(rule pre(1)[of \"(Suc 0)\" kk' \"(dis_s(CHR ''t'' := pd))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \n \"[]\" \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s tr2'' tr''])\n subgoal by auto\n subgoal by auto \n subgoal by auto\n subgoal by auto\n subgoal using pre properl_p5[of p] unfolding propc_def unfolding proper_def apply(cases \"get_max p\") by auto\n subgoal using pre properl_p5[of p] properl_p4[of p] unfolding proper_def \n apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n subgoal\n by (auto elim: sync_elims)\n done\n subgoal for k'''\n apply simp\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(21))\n apply(rule pre'(11))\n apply(rule pre'(13))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' \"(dis_s(CHR ''t'' := pd))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n apply(erule disjE)\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(21))\n apply(rule pre'(11))\n apply(rule pre'(13))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' \"(dis_s(CHR ''t'' := pd))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n subgoal premises pre'\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(21))\n apply(rule pre'(11))\n apply(rule pre'(13))\n apply(rule entails_tassn_trans)\n apply(rule combine_out_0assm_out_0assm2')\n subgoal by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n apply(rule pre(1)[of \"(Suc (Suc k'''))\" kk' \"(dis_s(CHR ''t'' := pd))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal apply auto\n apply(rule wait_orig_assn.intros(1))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n done\n done\n subgoal premises pre' for tr1'''\n thm pre'\n apply(rule combine_blocks_assn)\n apply(rule pre'(8))\n apply(rule pre'(11))\n apply(rule pre'(13))\n apply(rule entails_tassn_trans)\n apply(rule combine_wait_orig_out_0assm2)\n subgoal using pre' by auto\n subgoal using pre(6,10) pre' properl_p5[of p]\n unfolding proper_def properp_def\n apply(cases \"get_max p\")\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(rule out_0assm_assn_tran)\n unfolding entails_tassn_def combine_assn_def\n apply auto\n subgoal for Tr Tr1 Tr2\n apply(rule pre(1)[of \"(Suc k'')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" Tr1 \n \"(case get_max p of (prior, t) \\ Sch (del_proc p t) t prior)\" s Tr2 Tr])\n subgoal using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal by auto\n subgoal using pre pre' properl_p5[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal using pre pre' properl_p5[of p] properl_p4[of p] unfolding propc_def proper_def apply(cases \"get_max p\") by auto\n subgoal by auto\n done\n done\n done\n done\n subgoal for tr'\n apply(rule wait_orig_assn.intros(2))\n apply auto\n apply(rule pre(1)[of k' kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" \"(Task WAIT (Suc 0) 2)\" \n \"(task_s\n (CHR ''t'' := task_s CHR ''t'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' := task_s CHR ''c'' + min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\" tr1'' \"(Sch [] (- 1) (- 1))\" s tr2' tr'])\n using pre\n by (auto simp add:proper_def propc_def properp_def)\n done\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_pairE)\n by auto\n done\n subgoal for d1 rdy p1 tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 1)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply (simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n apply (simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n done\n done\n done\n apply(erule disjE)\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n by(auto simp add:true_assn_def)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d1 rdy1 p1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n by(auto simp add:true_assn_def)\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc \n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n by(auto simp add:true_assn_def)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n by(auto simp add: true_assn_def)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n by(auto simp add: true_assn_def)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n by auto\n done\n subgoal for d1 rdy1 p1 tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(free_ch 2)\"\n \"{0}\"\n \"(\\v d. if p \\ []\n then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n (sched_assn' kk' (sched_get_max (Sch p rn rp) s) s)\n else sched_assn' kk' (sched_clear (Sch p rn rp) s) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n by(auto simp add:true_assn_def)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n by (auto simp add:true_assn_def) \n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n by (auto simp add:true_assn_def)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n by auto\n done\n done\n done\n apply(erule disjE)\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 1)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 1) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_pairE)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_pairE)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d1 rdy1 p1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 1)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 1) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 1)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 1) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_pairE)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n done\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_pairE)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n done\n by auto\n done\n subgoal for d1 rdy1 p1 tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 1)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 1) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n by auto\n subgoal for v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2 > (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal \n apply(elim combine_blocks_waitE3[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2 < (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[of \"{req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1}\" \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n by (auto elim!: sync_elims)\n apply(cases \"d2 = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply simp\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n by auto\n done\n done\n done\n subgoal\n apply(cases rule: wait_orig_assn.cases[of \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"\n \"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + t, CHR ''c'' := task_s CHR ''c'' + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + t))))\"\n \"({}, {preempt_ch 1})\"\n \"(out_0assm_srdy_assn (free_ch 1) 0 ({free_ch 1}, {preempt_ch 1})\n (task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))))\" tr1])\n apply simp\n subgoal\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1])\n apply simp\n subgoal for tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(OutBlock (free_ch 1) 0 # tr1')\" \"(Sch (del_proc p 2) 1 2)\" s tr2' tr'])\n using pre properl_p4 unfolding propc_def proper_def properp_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n by (auto elim!: sync_elims)\n done\n subgoal for d1 rdy1 p1 tr1'\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s \"(WaitBlk d1 p1 rdy1 # tr1')\" \"(Sch (del_proc p 2) 1 2)\" s tr2' tr'])\n using pre properl_p4 unfolding propc_def proper_def properp_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n done\n done\n subgoal for tr1'\n apply(cases rule: out_0assm_srdy_assn.cases[of \"(free_ch 1)\" 0 \"({free_ch 1}, {preempt_ch 1})\"\n \"(task_dis_assn' 1 k' pd pc\n (dis_s\n (CHR ''t'' :=\n dis_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (Task WAIT (Suc 0) 2)\n (task_s\n (CHR ''t'' :=\n task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''),\n CHR ''c'' :=\n task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))))\" tr1'])\n apply simp\n subgoal for tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' dis_s \"(Task RUNNING (Suc 0) 2)\" task_s tr1 \"(Sch (del_proc p 2) 1 2)\" s tr2' tr'])\n using pre properl_p4 unfolding propc_def proper_def properp_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[of \"(Suc k')\" kk' \"(dis_s(CHR ''t'' := dis_s CHR ''t'' + d2))\"\n \"(Task RUNNING (Suc 0) 2)\"\n \"(task_s(CHR ''t'' := task_s CHR ''t'' + d2, CHR ''c'' := task_s CHR ''c'' + d2))\"\n \"(WaitBlk (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n OutBlock (free_ch 1) 0 # tr1'')\"\n \"(Sch (del_proc p 2) 1 2)\" s tr2' tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac\"(min (pd - (task_s CHR ''t'' + d2)) (pc - (task_s CHR ''c'' + d2))) \n = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\")\n apply(subgoal_tac\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t)))) = \n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply simp\n apply(rule wait_orig_assn.intros(2))\n apply(rule out_0assm_srdy_assn.intros(1))\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal apply(rule ext) by auto\n by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n apply(cases \"d2=(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[where ?tr1.0 = \"OutBlock (free_ch 1) 0 # tr1''\" and ?tr2.0 = tr2' and ?tr = tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac \"(min (pd -\n (task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (pc -\n (task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))) = 0\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n apply(rule out_0assm_srdy_assn.intros(1))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n by auto\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto \n subgoal for d2 v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n by (auto elim!: sync_elims)\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4)\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply(cases \"d2=(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE1')\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n by auto\n done\n subgoal for d1 rdy1 p1 tr1''\n apply(cases rule: waitin_assms'_assn.cases[of UNIV \"(\\t. EState (Sch p rn rp, s))\"\n \"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\" \"(exit_ch 2)\"\n \"{0}\"\n \"(\\v d. sched_assn' kk' (Sch (del_proc p 2) rn rp) s)\"\n tr2])\n apply simp\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(1))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2' and ?tr = tr'])\n using pre properl_p4\n unfolding propc_def proper_def properp_def by auto\n done\n subgoal for v2 d2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[where ?d1.0 = \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[where ?d1.0 = \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[where ?tr1.0 = \"(WaitBlk (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\n (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\n ({}, {preempt_ch 1}) #\n WaitBlk d1 p1 rdy1 # tr1'')\"\n and ?tr2.0 = tr2' and ?tr = tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac\"(min (pd - (task_s CHR ''t'' + d2)) (pc - (task_s CHR ''c'' + d2)))\n = (min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'') - d2)\")\n apply(subgoal_tac\"(\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + d2 + t,\n CHR ''c'' := task_s CHR ''c'' + d2 + t)))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + d2 + t))))\n = (\\t. ParState\n (EState\n (Task RUNNING (Suc 0) 2, task_s\n (CHR ''t'' := task_s CHR ''t'' + (t + d2),\n CHR ''c'' := task_s CHR ''c'' + (t + d2))))\n (EState (estate.None, dis_s(CHR ''t'' := dis_s CHR ''t'' + (t + d2)))))\")\n apply auto\n apply(rule wait_orig_assn.intros(2))\n apply(rule out_0assm_srdy_assn.intros(2))\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n subgoal using pre' by auto\n apply(rule ext) by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n apply(cases \"d2=(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(2))\n apply auto\n subgoal for tr'\n apply(rule pre(1)[where ?tr1.0 = \"(WaitBlk d1 p1 rdy1 # tr1'')\" and ?tr2.0 = tr2' and ?tr = tr'])\n subgoal by auto\n subgoal premises pre'\n apply simp\n apply(rule disjI2)\n apply(subgoal_tac\"(min (pd -\n (task_s CHR ''t'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))\n (pc -\n (task_s CHR ''c'' +\n min (pd - task_s CHR ''t'') (pc - task_s CHR ''c'')))) = 0\")\n apply auto\n apply(rule wait_orig_assn.intros(1))\n apply(rule out_0assm_srdy_assn.intros(2))\n using pre' by auto\n subgoal by auto\n subgoal by auto\n subgoal unfolding propc_def by auto\n subgoal using pre properl_p4 unfolding proper_def properp_def by auto\n subgoal by auto\n done\n done\n by auto\n subgoal for v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule waitin_tguar'_vassm'_assn.intros(3))\n by auto\n subgoal for d2 v2 tr2'\n apply(subgoal_tac\"rp = 2 \\ rn = 1\")\n prefer 2\n subgoal using pre unfolding proper_def propc_def properp_def by auto\n apply(simp del: tdsch1'.simps)\n apply(cases \"d2>(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE3[where ?d1.0 = \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply simp\n apply(elim combine_blocks_waitE1)\n apply(cases rdy1)\n by auto\n apply(cases \"d2<(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply(elim combine_blocks_waitE4[where ?d1.0 = \"(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\"])\n subgoal by auto\n subgoal by auto\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n apply(cases \"d2=(min (pd - task_s CHR ''t'') (pc - task_s CHR ''c''))\")\n subgoal\n apply (simp only: tdsch1'.simps)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(elim combine_blocks_waitE2)\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(elim combine_blocks_unpairE3')\n subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n apply auto\n apply(rule waitin_tguar'_vassm'_assn.intros(4))\n by auto\n by auto\n done\n done\n done\n done\n done\n by auto\n by auto\n done\n done\n qed\n \n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/ext1/System_scheduler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514777, "lm_q2_score": 0.38861802670584894, "lm_q1q2_score": 0.2730158494472035}} {"text": "theory GeneralKnowledge (*Benzmüller, Fuenmayor & Lomfeld, 2020*) \n imports ValueOntology \nbegin (*** General Legal and World Knowledge (LWK) ***)\n\n(*LWK: kinds of situations addressed*)\nconsts appObject::\"\\\" (*appropriation of objects in general*)\nconsts appAnimal::\"\\\" (*appropriation of animals in general*)\nconsts appWildAnimal::\"\\\" (*appropriation of wild animals*)\nconsts appDomAnimal::\"\\\" (*appropriation of domestic animals*)\n\n(*LWK: meaning postulates for kinds of situations*)\naxiomatization where \nW1: \"\\(appWildAnimal \\<^bold>\\ appDomAnimal) \\<^bold>\\ appAnimal\\\" and \nW2: \"\\appWildAnimal \\<^bold>\\ \\<^bold>\\appDomAnimal\\\" and \nW3: \"\\appWildAnimal \\<^bold>\\ appAnimal\\\" and\nW4: \"\\appDomAnimal \\<^bold>\\ appAnimal\\\" and\nW5: \"\\appAnimal \\<^bold>\\ appObject\\\" \n(*\\further situations regarding appropriation of objects\\*)\n\n(*LWK: value preferences for kinds of situations*)\n axiomatization where \n L2: \"\\appWildAnimal \\<^bold>\\ (x\\\\WILL \\<^bold>\\ x\\STAB)\\\" and \n L3: \"\\appDomAnimal \\<^bold>\\ (x\\\\STAB \\<^bold>\\ x\\[RELI\\RESP])\\\"\n(*\\further preferences\\*)\n\nlemma True nitpick[satisfy] oops (*consistency, model found*)\n\n(*LWK: general legal notions, with an existing clear definition*)\nconsts Own::\"c\\\\\" (*object is owned by party c*)\nconsts Poss::\"c\\\\\" (*party c has actual possession of object*)\nconsts Intent::\"c\\\\\" (*party c has intention to possess object*)\n\n(*LWK: other notions with some legal relevance (e.g. 'factors')*)\nconsts Liv::\"c\\\\\" (*party c is pursuing its livelihood*)\nconsts Mtn::\"c\\\\\" (*party c respons. for maintenance of object*)\n\n(*LWK: meaning postulates for general notions*)\naxiomatization where\nW6: \"\\Poss x \\<^bold>\\ (\\<^bold>\\Poss x\\)\\\" and \nW7: \"\\Own x \\<^bold>\\ (\\<^bold>\\Own x\\)\\\"\n(*\\others\\*)\n\n(*LWK: conditional legal value preferences*)\n axiomatization where \nL5: \"\\(Poss x \\<^bold>\\ \\<^bold>\\Mtn x\\) \\<^bold>\\ (x\\\\RELI \\<^bold>\\ (x\\STAB))\\\" and\nL6: \"\\(Own x \\<^bold>\\ Intent x \\<^bold>\\ Poss x\\) \\<^bold>\\ (x\\\\STAB \\<^bold>\\ x\\[RELI\\WILL])\\\"\n(*\\others\\*)\n\n(*LWK: value preferences given certain situational factors*)\naxiomatization where \nR1: \"\\For x \\<^bold>\\ (Intent x \\<^bold>\\ \\<^bold>\\\\<^sup>\\(x\\WILL))\\\" and \nR2: \"\\For x \\<^bold>\\ (Liv x \\<^bold>\\ \\<^bold>\\\\<^sup>\\(x\\GAIN))\\\" and \nR3: \"\\For x \\<^bold>\\ (Poss x \\<^bold>\\ \\<^bold>\\\\<^sup>\\(x\\STAB))\\\" and \nR4: \"\\For x \\<^bold>\\ (Mtn x \\<^bold>\\ \\<^bold>\\\\<^sup>\\(x\\RESP))\\\" and \nR5: \"\\For x \\<^bold>\\ (Own x \\<^bold>\\ \\<^bold>\\\\<^sup>\\(x\\RELI))\\\"\n(*\\others\\*)\n\nlemma True nitpick[satisfy] oops (*consistency, model found*)\nend\n\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/OLD/GeneralKnowledge.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.272972516948216}} {"text": "(* memory_model.thy *)\n(* William Mansky *)\n(* Memory model locales for PTRANS. *)\n\ntheory memory_model\nimports \"$AFP/List-Infinite/ListInfinite\" AxiomaticModel\nbegin\n\n(*\nprint_locale \"ord\"\n\ninstantiation option :: (ord) ord\nbegin\nfun less_eq_option where\n \"(None \\ None) = True\"\n | \"(None \\ (Some _ )) = True\"\n | \"((Some _) \\ None) = False\"\n | \"((Some x) \\ (Some y)) = (x \\ y)\"\n\nfun less_option where\n \"(None < None) = False\"\n | \"(None < (Some _)) = True\"\n | \"((Some _) < None) = False\"\n | \"((Some x) < (Some y)) = (x < y)\"\n\ninstance proof qed\nend\n\nlemma map_add_dom_upd [simp]: \"dom m' = {k} \\ (m ++ m')(k \\ v) = m(k \\ v)\"\nby (auto intro!: ext simp add: map_add_def split: option.splits)\n\nlemma dud_set [simp]: \"{(l, v). False} = {}\"\nby simp\n\n(* Extra utility function: enumerate the elements of a set in arbitrary order. \n Useful for memory models. Could conceivably be replaced by Eps over finite_distinct_list. *)\nthm finite_distinct_list\nfunction list_of_set where\n\"list_of_set S = (if infinite S \\ S = {} then [] else let a = SOME a. a \\ S in a # list_of_set (S - {a}))\"\nby pat_completeness auto\ntermination \napply (relation \"measure (\\S. card S)\", auto)\napply (frule card_Diff_singleton, rule someI, simp)\napply (case_tac \"card S\", simp_all)\ndone\nlemma list_of_set_empty [simp]: \"list_of_set {} = []\"\nby simp\nlemma list_of_set_inf [simp]: \"infinite S \\ list_of_set S = []\"\nby simp\nlemma list_of_set_card [simp]: \"(list_of_set S \\ []) = (card S \\ 0)\"\nby (auto simp add: Let_def)\ndeclare list_of_set.simps [simp del]\n\nlemma set_some [simp]: \"S \\ {} \\ insert (SOME a. a \\ S) S = S\"\nby (metis insert_absorb not_ex_in_conv someI)\n\nlemma set_some2 [simp]: \"S \\ {} \\ (SOME a. a \\ S) \\ S\"\nby (metis not_ex_in_conv someI)\n\nlemma list_of_set_set [simp]: \"finite S \\ set (list_of_set S) = S\"\napply (induct \"card S\" arbitrary: S, simp_all)\napply (rule trans, simp add: list_of_set.simps, simp add: Let_def)\ndone\n\ncorollary list_of_set_nth: \"\\list_of_set S ! i = x; i < length (list_of_set S)\\ \\ x \\ S\"\napply (subgoal_tac \"finite S\", subgoal_tac \"x \\ set (list_of_set S)\", simp, \n simp add: set_conv_nth, force)\napply (auto simp add: list_of_set.simps split: if_splits)\ndone\n\nlemma list_of_set_distinct [simp]: \"distinct (list_of_set S)\"\napply (induct \"card S\" arbitrary: S, clarsimp simp add: list_of_set.simps)\napply (rule_tac P=distinct in list_of_set.simps [THEN sym [THEN subst]], clarsimp simp add: Let_def)\ndone \n\ndatatype ('thread, 'loc, 'val) access = Read 'thread 'loc 'val | Write 'thread 'loc 'val \n | ARW 'thread 'loc 'val 'val | Alloc 'thread 'loc | Free 'thread 'loc\nprimrec get_thread where\n\"get_thread (Read t _ _) = t\" |\n\"get_thread (Write t _ _) = t\" |\n\"get_thread (ARW t _ _ _) = t\" |\n\"get_thread (Alloc t _) = t\" |\n\"get_thread (Free t _) = t\"\nprimrec get_loc where\n\"get_loc (Read _ l _) = l\" |\n\"get_loc (Write _ l _) = l\" |\n\"get_loc (ARW _ l _ _) = l\" |\n\"get_loc (Alloc _ l) = l\" |\n\"get_loc (Free _ l) = l\"\nprimrec set_thread where\n\"set_thread t' (Read t l v) = Read t' l v\" |\n\"set_thread t' (Write t l v) = Write t' l v\" |\n\"set_thread t' (ARW t l v v') = ARW t' l v v'\" |\n\"set_thread t' (Alloc t l) = Alloc t' l\" |\n\"set_thread t' (Free t l) = Free t' l\"\nlemma set_get_thread [simp]: \"set_thread (get_thread a) a = a\"\nby (case_tac a, auto)\nlemma get_set_thread [simp]: \"get_thread (set_thread t a) = t\"\nby (case_tac a, auto)\nlemma set_thread_frees [simp]: \"set_thread t' ` Free t ` S = Free t' ` S\"\nby (auto simp add: image_def)\n\nabbreviation \"get_ptrs ops \\ get_loc ` ops\"\n\n\ntype_synonym ('block, 'os) pointer = \"'block * 'os\"\ntype_synonym ('add, 'size) block_structure = \"'add * 'size\"\n\ndatatype ('add,'val,'size,'os) raw_block =\n RawBlk \"('add, 'size) block_structure\" \"('os \\ 'val)\"\n\ntype_synonym ('add, 'val, 'size) allocation = \"(('add, 'size) block_structure) set\"\n\ntype_synonym ('add,'val,'size,'os) block_allocation = \"('add,'val,'size,'os) raw_block set\"\n\nfun get_addr_s where\n \"get_addr_s ((addr,_)::(('add,'size) block_structure)) = addr\"\n\nfun get_size_s where\n \"get_size_s ((_,s)::(('add,'size) block_structure)) = s\"\n\nfun get_addr where \"get_addr ( RawBlk (addr,_) _) = addr\"\n\nfun get_size where \"get_size (RawBlk(_,s) _) = s\"\n\nfun block_to_struct where \"block_to_struct (RawBlk blk _) = blk\"\n\ndeclare[[show_types = true]]\ndeclare[[show_sorts = true]]\n \n(* locale for reasoning about blocks and the mapping of block offsets to memory locations *)\n(* FUNCTIONS *)\n(* block_s_start: partial function giving the first memory location of a \n block_structure (if it exists) \n block_exists: see assumptions for block existence conditions \n block_start_os: gives the offset of a block that can be passed into block_s_ptr\n such that the same memory location is returned as for block_s_start \n block_s_ptr: partial function mapping offsets into a block to memory locations \n size_to_offset: conversion between abstract types *)\n(* ASSUMPTIONS *)\n(* block_firstlast_offset: if a block exists, the start offset must be \\ the offset\n returned by calling size_to_offset on the block size (corresponds to the last memory\n location of the block.\n pointer_inbounds_exists: For any offset into a block that is between the start \n and end offsets (inclusive), there must be a valid mapping to a memory location for\n that offset.\n block_s_same_add_same_loc: Two blocks with the same starting address must also have\n the same starting memory location.\n block_s_ptr_monotonic: block_s_ptr is a monotonic function\n block_s_ptr_one_to_one: block_s_ptr is a one to one function\n block_s_start_offset: Assumes that block_start_os is a total function. There will\n exist an offset such that block_s_ptr and block_s_start will be equal (even if\n it is because they both return None) *)\nlocale block_structure =\n fixes block_s_start::\"('add, 'size::ord) block_structure \\ ('loc::ord)\"\n and block_exists::\"('add, 'size::ord) block_structure \\ bool\"\n and block_start_os :: \"('add, 'size::ord) block_structure \\ ('os::{ord,plus})\"\n and block_s_ptr::\"('add, 'size) block_structure * 'os \\ ('loc::ord)\"\n and size_to_offset::\"'size \\ 'os\"\n and struct_to_rb::\"('add,'size) block_structure \\ ('add,'val,'size,'os) raw_block\"\n assumes block_exists_defin: \"block_exists blk = (\\x. block_s_start(blk) = (Some x))\"\n and block_firstlast_offset:\n \"block_exists (addr,size1) \\\n (block_start_os (addr,size1)) \\ (size_to_offset size1)\"\n and pointer_inbounds_exists:\n \"\\block_exists (addr,size1); os \\ block_start_os(addr,size1); \n os \\ size_to_offset(size1)\\ \\\n \\ l. (block_s_ptr ((addr,size1),os) = (Some l))\"\n and block_s_same_add_same_loc:\n \"\\block_exists (add, size1); block_exists (add, size2)\\ \\\n block_s_start (add,size1) = block_s_start(add, size2)\"\n and block_s_ptr_monotonic: \"\\os1 < os2; block_s_ptr(blk,os1) = Some x;\n block_s_ptr(blk,os2) = Some y\\ \\ x < y\"\n and block_s_ptr_one_to_one: \"\\block_s_ptr(blk,os1) = Some x;\n block_s_ptr(blk,os2) = Some y;\n (x = y)\\ \\ (os1 = os2)\"\n and block_s_start_offset: \"\\os_1. block_s_ptr(blk,os_1) = block_s_start(blk)\"\n and block_s_start_defin: \"(block_s_start blk = block_s_ptr(blk,(block_start_os blk)))\"\ncontext block_structure\nbegin\n\nfun good_block_s_ptr where\n \"good_block_s_ptr ((start,len), os) = ((block_exists (start,len)) \\ \n ((block_start_os (start,len)) \\ os) \\ (os \\ (size_to_offset len)))\"\n\nfun good_rb_s_pair where\n \"good_rb_s_pair blk1 blk2 =\n ((\\ os_1. (\\ os_2. ((good_block_s_ptr(blk1,os_1)) \\\n (good_block_s_ptr(blk2,os_2)) \\\n ((good_block_s_ptr(blk1,os_1)) = (good_block_s_ptr(blk2,os_2)))))) \\\n (blk1 = blk2))\"\n \nfun good_allocation where\n \"good_allocation (alloc::('add,'val,'size) allocation) = \n (\\ rb1 \\ alloc. (\\ rb2 \\ alloc. (good_rb_s_pair rb1 rb2)))\"\n \nfun good_block_allocation where\n \"good_block_allocation (alloc::('add,'val,'size,'os) block_allocation) =\n good_allocation (block_to_struct ` alloc)\"\n\nlemma good_rb_s_pair_refl [simp]: \"good_rb_s_pair a a\"\napply auto\ndone\nlemma good_rb_s_pair_symm [simp]: \"good_rb_s_pair a b = good_rb_s_pair b a\"\napply auto\ndone\nlemma good_rb_s_pair_trans [simp]: \"((good_allocation alloc) \\ \n (a \\ alloc) \\ (b \\ alloc) \\ (c \\ alloc) \\ \n (good_rb_s_pair a b) \\ (good_rb_s_pair b c) \\ good_rb_s_pair a c)\"\napply auto\ndone\nend\n\ntype_synonym ('block,'size, 'os) access_region = \"('block * 'size * 'os)\"\n\ntype_synonym ('add,'val,'size,'os) block_access_region =\n \"(('add,'val,'size,'os) raw_block,'size,'os) access_region\"\n \ntype_synonym ('add,'val,'size,'os) block_s_access_region =\n \"(('add,'size) block_structure,'size,'os) access_region\"\n\nfun region_get_block where\n \"region_get_block ((b,s,os)::('block,'size, 'os) access_region) = b\"\n \ncontext block_structure\nbegin\n\n (* Define the set of ptr or os that are \"in\" a region *)\nfun os_in_region where\n \"os_in_region ((b,s,os1)::('add,'val,'size,'os) block_access_region) (os2::'os) = \n ((((block_start_os (block_to_struct b))+os1) \\ os2) \\ \n (((block_start_os (block_to_struct b))+os1+(size_to_offset s)) \\ os2))\"\n\nfun region_eq where\n \"region_eq ((b1, s1, os1)::('add,'val,'size,'os) block_access_region)\n ((b2, s2, os2)::('add,'val,'size,'os) block_access_region) = \n ((block_s_ptr((block_to_struct b1),os1) = block_s_ptr((block_to_struct b2),os2))\n \\ (block_s_ptr((block_to_struct b1),(os1+(size_to_offset s1))) = \n block_s_ptr((block_to_struct b2),(os2+(size_to_offset s2)))))\"\n\nlemma region_eq_all_ptr:\n \"region_eq (b1,s1,os1) (b2, s2, os2) \\ (\\ (os_a::'os). \\ (os_b::'os).\n (((os_in_region (b1,s1,os1) os_a) \\ (os_in_region (b2,s2,os2) os_b))\n \\ (block_s_ptr((block_to_struct b1),os_a)) = block_s_ptr((block_to_struct b2),os_b)))\"\n oops\n \nfun region_overlap where\n \"region_overlap ((b1, s1, os1)::('add,'val,'size,'os) block_access_region)\n ((b2, s2, os2)::(('add,'val,'size,'os) block_access_region)) = (\\ (os_a::'os). \n (\\ (os_b::'os). ((os_a \\ os1) \\ (os_b \\ os2) \\ (os_a \\ (os1+(size_to_offset s1))) \\\n (os_b \\ (os2+(size_to_offset s2))) \\ (block_s_ptr((block_to_struct b1),os_a)) = \n block_s_ptr((block_to_struct b2),os_b))))\"\n\nfun region_inbounds where\n \"region_inbounds ((b, s, os)::('add,'val,'size,'os) block_access_region)\n = (((os + (size_to_offset s)) \\ (size_to_offset (get_size b))) \\ \n (block_start_os((block_to_struct b)) \\ os))\"\n \n(* tells us if a region describes an entire block *)\nfun region_block_eq where\n \"region_block_eq ((b, s, os)::('add,'val,'size,'os) block_access_region)\n = ((block_start_os((block_to_struct b)) = os) \\ ((get_size_s(block_to_struct b)) = s))\"\nend\n\ndeclare[[show_types = true]] \ndeclare[[show_sorts = true]]\n*)\n\ncontext axiomaticModel begin\n\nterm observeMem\n\nend\n\nlocale memory_model = axiomaticModel\n where actions = \"actions :: (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action set\"\n and locations = \"locations :: loc_type set\"\n and actionIDs = \"actionIDs :: aid_type set\"\n and times = \"times :: time_type set\"\n and threads = \"threads :: 'tid set\"\n and locks = \"locks :: 'lock set\"\n and names = \"names :: 'name set\"\n and callIDs = \"callIDs :: 'callID set\" \n for actions locations actionIDs times threads locks names callIDs + \n fixes free_set::\"(('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ loc_type set\"\nand can_read::\"(('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\'tid \\ time_type \\ loc_type \\ 'val set\"\nand update_mem::\"(('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n \\ time_type \\ ('tid \\ aid_type \\\n (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set\n \\ (('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\ bool\"\nand start_mem:: \"(('tid \\ time_type \\ loc_type)\n \\ (aid_type \\ (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\"\nassumes alloc_not_free: \"\\update_mem mem time ops mem'; (tid,aid,Create l) \\ ops\\ \\ \n l \\ free_set mem' time\"\n and stays_not_free: \"\\update_mem mem time ops mem'; l \\ free_set mem time\\ \\\n l \\ free_set mem' time\"\n\n\n (*\ndatatype ('thread, 'add, 'size,'os) block_access =\n bRead 'thread \"('add,'size,'os) block_s_access_region\" 'val\n | bWrite 'thread \"('add,'size,'os) block_s_access_region\" 'val\n | bARW 'thread \"('add,'size,'os) block_s_access_region\" 'val 'val\n | bAlloc 'thread \"('add,'size) block_structure\"\n | bFree 'thread \"('add,'size) block_structure\"\n \ndatatype ('thread, 'block, 'region,'val) block_access =\n bRead 'thread 'region 'val\n | bWrite 'thread 'region 'val\n | bARW 'thread 'region 'val 'val\n | bAlloc 'thread 'block\n | bFree 'thread 'block\n*)\n\n(*\nlocale block_structur =\n fixes good_block ::\"'block \\ bool\"\n and good_region :: \"'region \\ bool\"\n and block_overlap::\"'block \\ 'block \\ bool\"\n and region_overlap::\"'region \\ 'region \\ bool\"\n and subblock::\"'block \\ 'block \\ bool\"\n and subregion :: \"'region \\ 'region \\ bool\"\n and region_get_block ::\"'region \\ 'block\"\n and block_as_region ::\"'block \\ 'region\"\n and value_fits_region :: \"'val \\ 'region \\ bool\"\n and region_fits_block ::\"'region \\ 'block \\ bool\"\n (* define does_not_modify later *)\n and does_not_modify :: \"('thread, 'block, 'region,'val) block_access \n \\ 'region \\ bool\" \n (* and get_access_region:: \"('thread, 'block, 'region,'val) block_access \\ 'region\"*)\n assumes value_fits_bigger_region :\n \"\\ subregion r1 r2; value_fits_region v r1 \\ \\ value_fits_region v r2\"\n and subblock_good: \"\\good_block b ; subblock b' b\\ \\ good_block b'\"\n and region_overlap_symm: \"region_overlap r r' \\ region_overlap r' r\"\n(* and dummy: \"\\ b. block_as_region b = block_as_region b\" *)\n\nfun (in block_structur) get_access_region::\"('thread, 'block, 'region,'val) block_access \\ 'region\" where\n \"get_access_region (bRead _ r _) = r\" |\n \"get_access_region (bWrite _ r _) = r\" |\n \"get_access_region (bARW _ r _ _) = r\" |\n \"get_access_region (bAlloc _ b) = (block_as_region b)\" |\n \"get_access_region (bFree _ b) = (block_as_region b)\"\nthm block_structur.get_access_region.simps\nthm block_structur_def\n\nlocale basic_can_do = block_structur\n where good_block = \"good_block :: 'block \\ bool\"\n and good_region = \"good_region :: 'region \\ bool\"\n for good_block \n and good_region +\n fixes can_do::\"('thread, 'block, 'region,'val) block_access list \\ \n ('thread, 'block, 'region,'val) block_access \\ bool\"\n assumes base_allows_alloc: \"good_block b \\ (can_do [] (bAlloc t b))\" \n and free_allows_alloc: \"\\good_block b; can_do m (bFree t b); subblock b' b\\\n \\ (can_do ((bFree t b)#m) (bAlloc t' b'))\"\n and alloc_allows_free: \"\\good_block b; can_do m (bAlloc t b)\\ \\ \n (can_do ((bAlloc t b)#m) (bFree t b))\"\n (* and alloc_allows_write: \"\\good_block b; can_do m (bAlloc t b); \n region_fits_block r b\\ \\ \n (can_do ((bAlloc t b)#m) (bWrite t' r v))\"*)\n and alloc_allows_write_same_thread: \"\\good_block b; can_do m (bAlloc t b); \n region_fits_block r b\\ \\ \n (can_do ((bAlloc t b)#m) (bWrite t r v))\"\n and write_any_value_same_thread: \"\\value_fits_region v' r; \n (can_do m (bWrite t r v))\\ \\ (can_do m (bWrite t r v'))\"\n and not_mod_write_drop: \"\\can_do m opr; does_not_modify opr r; \n can_do (opr#m) (bWrite t r v)\\ \n \\ can_do m (bWrite t r v)\"\n and not_mod_write_add: \"\\can_do m opr; does_not_modify opr r;\n can_do m (bWrite t r v)\\ \\ can_do (opr#m) (bWrite t r v)\"\n and write_not_read_drop: \"\\can_do m (bWrite t r v); \n \\r' v' .(region_overlap r r') \\ (opr \\ (bRead t' r' v'));\n can_do ((bWrite t r v)#m) opr\\ \\ can_do m opr\"\n and write_not_read_add: \"\\can_do m (bWrite t r v); \n \\r' v' .(region_overlap r r') \\ (opr \\ (bRead t' r' v'));\n can_do m opr\\ \\ can_do ((bWrite t r v)#m) opr\"\n and read_only_written: \"\\can_do m (bWrite t r v); \n can_do ((bWrite t r v)#m) (bRead t' r v')\\ \\ v = v'\"\n and read_written: \"can_do m (bWrite t r v) \\\n can_do ((bWrite t r v)#m) (bRead t' r v)\"\n and read_noop_drop: \"\\can_do m (bRead t r v); can_do ((bRead t r v)#m) opr\\\n \\ can_do m opr\"\n and read_noop_add: \"\\can_do m (bRead t r v); can_do m opr\\\n \\ can_do ((bRead t r v)#m) opr\"\n and reg_drop: \"\\\\(region_overlap (get_access_region opr) (get_access_region opr'));\n can_do m opr; can_do (opr#m) opr'\\ \\ can_do m opr'\"\n and reg_add: \"\\\\(region_overlap (get_access_region opr) (get_access_region opr'));\n can_do m opr; can_do m opr'\\ \\ can_do (opr#m) opr'\"\n (*and reg_comm: \"\\\\(region_overlap (get_access_region opr) (get_access_region opr'));\n can_do (opr#m) opr'\\ \\ can_do (opr'#m) opr\"*)\n and prefix_closed: \"\\can_do (opr#m) opr'\\ \\ can_do m opr\"\n\nlemma (in basic_can_do) reg_comm: \"\\\\(region_overlap (get_access_region opr) (get_access_region opr'));\n can_do (opr#m) opr'\\ \\ can_do (opr'#m) opr\"\napply (rule reg_add)\napply (erule contrapos_nn)\napply (erule_tac r = \"(get_access_region opr')\" and r' = \"(get_access_region opr)\"\n in region_overlap_symm)\nprefer 2\napply (erule prefix_closed)\napply (erule reg_drop)\napply (erule prefix_closed)\napply auto\ndone\n\n \n (* Commented out to the end\ncontext block_structure\nbegin\nprimrec block_get_thread where\n\"block_get_thread (bRead t _ _) = t\" |\n\"block_get_thread (bWrite t _ _) = t\" |\n\"block_get_thread (bARW t _ _ _) = t\" |\n\"block_get_thread (bAlloc t _) = t\" |\n\"block_get_thread (bFree t _) = t\"\nfun block_get_region where\n\"block_get_region (bRead _ r _) = r\" |\n\"block_get_region (bWrite _ r _) = r\" |\n\"block_get_region (bARW _ r _ _) = r\"|\n\"block_get_region (bAlloc _ b) = ((struct_to_rb b),(get_size_s b),(block_start_os(b)))\" |\n\"block_get_region (bFree _ b) = ((struct_to_rb b),(get_size_s b),(block_start_os(b)))\"\nprimrec block_get_block where\n\"block_get_block (bRead _ r _) = (region_get_block r)\" |\n\"block_get_block (bWrite _ r _) = (region_get_block r)\" |\n\"block_get_block (bARW _ r _ _) = (region_get_block r)\" |\n\"block_get_block (bAlloc _ b) = (struct_to_rb b)\" |\n\"block_get_block (bFree _ b) = (struct_to_rb b)\"\nprimrec block_set_thread where\n\"block_set_thread t' (bRead t r v) = bRead t' r v\" |\n\"block_set_thread t' (bWrite t r v) = bWrite t' r v\" |\n\"block_set_thread t' (bARW t r v v') = bARW t' r v v'\" |\n\"block_set_thread t' (bAlloc t l) = bAlloc t' l\" |\n\"block_set_thread t' (bFree t l) = bFree t' l\" \nend\n\n locale block_seq_can_do = fixes can_do::\"('thread,'add,'val,'size,'os) \n block_access list \\ ('thread,'add,'val,'size,'os) block_access \\ bool\"\nassumes base_allows_alloc: \"(can_do [] (bAlloc t b))\"\n and free_allows_alloc: \"\\can_do m (bFree t b); b=b'\\\n \\ (\\(can_do ((bFree t b)#m) (bFree t' b')))\"\n and alloc_allows_write: \"\\can_do m (bAlloc t b); \n region_inbounds ((struct_to_block b),s,os)\\ \\ \n (can_do ((bAlloc t b)#m) \n (bWrite t' ((struct_to_block b),s,os) v))\"\n and alloc_allows_alloc: \"\\can_do m (bAlloc t b); b=b'\\ \\ \n (\\(can_do ((bAlloc t b)#m) (bAlloc t' b')))\"\n and alloc_allows_free: \"\\can_do m (bAlloc t b); b=b'\\ \\ \n (can_do ((bAlloc t b)#m) (bFree t' b'))\"\n and write_any_value: \"(can_do m (bWrite t r v)) = (can_do m (bWrite t' r v'))\"(*\n and not_mod_write: \"\\can_do m (bRead t' r' v'); can_do m (bWrite t' r' v'); \n can_do m (bAlloc t' b); can_do m (bFree t' b); region_block_eq(b,s,os);\n \\(region_overlap r r'); \\(region_overlap r (b,s,os))\\ \\ \n ((can_do ((bRead t' r' v')#m) (bWrite t r v)) = \n (can_do (m) (bWrite t r v))) \\ \n ((can_do ((bWrite t' r' v')#m) (bWrite t r v)) = \n (can_do (m) (bWrite t r v))) \\ \n ((can_do ((bAlloc t' b)#m) (bWrite t r v)) = \n (can_do (m) (bWrite t r v))) \\ \n ((can_do ((bFree t' b)#m) (bWrite t r v)) = \n (can_do (m) (bWrite t r v)))\" \n and write_not_read: \"\\can_do m (bWrite t r v); opr \\ (bRead t' r v')\\ \\ \n (can_do ((bWrite t r v)#m) opr) = (can_do m opr)\"\n and read_written: \"\\can_do m (bWrite t r v)\\ \\ ((can_do ((bWrite t r v)#m) \n (bRead t' r v')) = (v = v'))\"\n and read_noop: \"\\can_do m (bRead t r v)\\ \\ (can_do ((bRead t r v)#m) opr = \n can_do m opr)\"*)(*\n and loc_drop: \"\\\\region_overlap((block_get_region opr) (block_get_region opr'));\n (can_do m opr)\\ \\ (can_do (opr#m) opr') = (can_do m opr')\" \n and loc_comm: \"\\\\region_overlap((block_get_region opr) (block_get_region opr'))\\ \n \\ (can_do (opr#m) opr') = (can_do (opr'#m) opr)\"*)\n \nlocale block_seq_can_do_extend = block_seq_can_do +\n assumes base_disallows_free:\"(\\(can_do [] (bFree t b)))\"\n and free_dissallows_free:\"\\can_do m (bFree t b); b=b'\\\n \\ (\\(can_do ((bFree t b)#m) (bFree t' b')))\"\n \n \nlocale seq_can_do = fixes can_do::\"('thread, 'loc, 'val) access list \\\n ('thread, 'loc, 'val) access \\ bool\"\nassumes base_allows: \"(\\(can_do [] (Read t l v))) \\ (can_do [] (Alloc t l))\n \\(\\(can_do [] (Free t l)))\"\n and free_allows: \"\\can_do m (Free t l)\\ \\ (\\(can_do ((Free t l)#m) (Read t' l v)))\n \\ (can_do ((Free t l)#m) (Alloc t' l)) \\ (\\(can_do ((Free t l)#m) (Free t' l)))\"\n and alloc_allows: \"\\can_do m (Alloc t l)\\ \\ (can_do ((Alloc t l)#m) (Write t l v))\n \\ (\\(can_do ((Alloc t l)#m) (Alloc t' l))) \\ (can_do ((Alloc t l)#m) (Free t l))\"\n and write_any_value: \"(can_do m (Write t l v)) = (can_do m (Write t l v'))\"\n and not_mod_write: \"\\can_do m (Read t l v); can_do m (Write t l' v); \n can_do m (Alloc t l'); can_do m (Free t l'); l \\ l'\\ \\ ((can_do ((Read t l v)#m) \n (Write t' l v)) = (can_do (m) (Write t' l v))) \\ ((can_do ((Write t l' v)#m) \n (Write t' l v)) = (can_do (m) (Write t' l v))) \\ ((can_do ((Alloc t l')#m) \n (Write t' l v)) = (can_do (m) (Write t' l v))) \\ ((can_do ((Free t l')#m) \n (Write t' l v)) = (can_do (m) (Write t' l v)))\" \n and write_not_read: \"\\can_do m (Write t l v); opr \\ (Read t' l v')\\ \\ \n (can_do ((Write t l v)#m) opr) = (can_do m opr)\"\n and read_written: \"\\can_do m (Write t l v)\\ \\ ((can_do ((Write t l v)#m) \n (Read t' l v')) = (v = v'))\"\n and read_noop: \"\\can_do m (Read t l v)\\ \\ (can_do ((Read t l v)#m) a = can_do m a)\"\n and loc_drop: \"\\get_loc (opr) \\ get_loc(opr'); (can_do m opr)\\ \\ (can_do (opr#m) opr')\n = (can_do m opr')\" \n and loc_comm: \"\\get_loc (opr) \\ get_loc(opr')\\ \\ (can_do (opr#m) opr') = \n (can_do (opr'#m) opr)\"\n \n \n(* how can we define a memory as only being a \"good\" allocation? *)\n locale block_memory_model = fixes free_set::\"'memory \\ 'a word set\"\nand can_read::\"'memory \\ 'thread \\ 'loc \\ 'block set\"\nand update_mem::\"'memory \\ ('thread, 'loc, 'val) block_access set \\ 'memory \\ bool\"\nand allocation::\"'loc allocation\"\nand start_mem::'memory\n(*and memory_max_word:: \"'loc::len word\" *) (*largest address *) (* note: we may want to condense these into one *)\nand memory_max_int:: int\nand memory_min:: int (* smallest address *) \n(*assumes good_allocations: \"\\update_mem mem ops mem'; good_allocation *)\n(*assumes good_allocation_word: \"good_allocation memory_max_word allocation\"*)\nassumes good_allocation_int: \"good_allocation (word_of_int memory_max_int) allocation\"\n\n\n\n(* TSO memory model *)\nlocale TSO = fixes undef::'val begin\n(* This isn't really a TSO-specific locale, but I might have other assumptions later.\n More to the point, it's convenient to have a separate locale for each memory model, even if\n they don't actually rely on separate assumptions. *)\n\nabbreviation \"free_set mem \\ UNIV - dom (fst mem)\"\ndefinition \"can_read mem t l \\ case List.find (\\(l', v). l' = l) ((snd mem) t) of \n Some (l, v) \\ {v} | None \\ {v. fst mem l = Some v}\"\ndefinition \"can_read2 mem t l \\ case mem of (mem_map, bufs) \\ (case List.find (\\(l', v). l' = l) (bufs t) of \n Some (l, v) \\ {v} | None \\ {v. mem_map l = Some v})\"\n(* Switch to the inductive approach... sometime. *)\ninductive update_mem where \nno_atomic [intro]: \"\\\\t l v v'. ARW t l v v' \\ ops; \\t. \\up. bufs' t = up @ bufs t \\ \n set up = {(l, v) | l v. Write t l v \\ ops} \\ distinct up\\ \\ \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs')\" |\nupdate [intro]: \"\\update_mem (mem, bufs) ops (mem', bufs'); bufs' t = buf @ [(l, v)]\\ \\\n update_mem (mem, bufs) ops (mem'(l \\ v), bufs'(t := buf))\" |\natomic [intro!]: \"bufs t = [] \\ update_mem (mem, bufs) {ARW t l v v'} (mem(l \\ v'), bufs)\"\nabbreviation \"start_mem \\ (empty, \\t. [])\"\n\nlemma alloc_not_free: \"\\update_mem mem ops mem'; Alloc t l \\ ops; \\t. Free t l \\ ops\\ \\ \n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma stays_not_free: \"\\update_mem mem ops mem'; l \\ free_set mem; \\t. Free t l \\ ops\\ \\\n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale TSO \\ memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext TSO begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cases C, cut_tac ops=\"{}\" and mem=a and bufs=b in no_atomic, auto simp add: restrict_map_def)\n\nlemma can_read_thread: \"\\v \\ can_read (mem, b) t l; b t = b' t\\ \\ \n v \\ can_read (mem, b') t l\"\nby (auto simp add: can_read_def split: option.splits)\n\nlemma first_entry: \"\\update_mem (mem, bufs) {Write t l v} (mem', bufs'); \n bufs' t = a # rest\\ \\ a = (l, v)\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). \\a rest. ops = {Write t l v} \\ \n bufs' t = a # rest \\ a = (l, v)\" in update_mem.induct, simp_all, clarsimp)\napply (subgoal_tac \"\\up. bufs'a t = up @ bufs t \\ set up = {ab. t = t \\ (case ab of (la, va) \\ \n la = l \\ va = v)} \\ distinct up\", clarify, simp+)\napply (case_tac up, simp, simp)\napply (thin_tac \"bufs'a t = ((aa, b) # resta)\", force)\napply auto\napply (cases a, auto)\ndone\n\nlemma update_map: \"update_mem (mem, bufs) {} (mem', bufs') \\\n \\map. \\mem2. update_mem (mem2, bufs) {} (mem2 ++ map, bufs')\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). ops = {} \\ \n (\\map. \\mem2. update_mem (mem2, bufs) {} (mem2 ++ map, bufs'))\" in update_mem.induct, auto)\napply (subgoal_tac \"bufs' = bufs\", rule_tac x=empty in exI, simp, rule ext)\napply (subgoal_tac \"\\up. bufs' x = (up @ bufs x) \\ set up = {(l, v). False} \\ distinct up\", clarify, auto)\napply (rule_tac x=\"map(l \\ v)\" in exI, auto)\ndone\n\nlemma update_trans_rev: \"\\update_mem (mem', bufs') {} (mem'', bufs'');\n update_mem (mem, bufs) ops (mem', bufs')\\ \\ update_mem (mem, bufs) ops (mem'', bufs'')\"\napply (drule_tac P=\"\\(mem', bufs') ops' (mem'', bufs''). ops' = {} \\ update_mem (mem, bufs) ops (mem', bufs') \\\n update_mem (mem, bufs) ops (mem'', bufs'')\" in update_mem.induct, auto simp add: restrict_map_def)\napply (subgoal_tac \"bufs'a = bufsa\", simp, rule ext)\napply (subgoal_tac \"\\up. bufs'a x = up @ bufsa x \\ set up = {(l, v). False} \\ distinct up\", \n clarify, auto)\ndone\n\nlemma update_trans [trans]: \"\\update_mem (mem, bufs) ops (mem', bufs');\n update_mem (mem', bufs') {} (mem'', bufs'')\\ \\ update_mem (mem, bufs) ops (mem'', bufs'')\"\nby (erule update_trans_rev, simp)\n\nlemma update_canonical: \"\\update_mem (mem, bufs) ops (mem', bufs'); \n \\t l v v'. ARW t l v v' \\ ops\\ \\\n \\writes bufs''. (\\t. bufs'' t = writes t @ bufs t \\ set (writes t) = {(l, v) | l v. Write t l v \\ ops} \\ distinct (writes t)) \\ \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs'') \\\n update_mem (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs'') {} (mem', bufs')\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). (\\t l v v'. ARW t l v v' \\ ops) \\\n (\\writes bufs''. (\\t. bufs'' t = writes t @ bufs t \\\n set (writes t) = {(l, v) | l v. Write t l v \\ ops} \\ distinct (writes t)) \\ update_mem (mem, bufs) ops \n (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs'') \\\n update_mem (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs'') {} (mem', bufs'))\" in update_mem.induct, auto)\napply (rule_tac x=\"\\t. SOME up. bufs' t = up @ bufs t \\ set up = {(l, v). Write t l v \\ opsa} \\ \n distinct up\" in exI)\napply (rule_tac x=bufs' in exI)\napply (rule conjI, clarsimp)\napply (rule someI_ex, auto)\ndone\n\ncorollary update_write: \"\\update_mem (mem, bufs) {Write t l v} (mem', bufs')\\ \\\n update_mem (mem, bufs(t := (l, v) # bufs t)) {} (mem', bufs')\"\napply (drule update_canonical, auto)\napply (subgoal_tac \"bufs'' = bufs(t := (l, v) # bufs t)\", simp add: restrict_map_def, rule ext, \n clarsimp)\napply (erule_tac x=x in allE, rule conjI, clarsimp)\napply (case_tac \"writes t\", simp+, case_tac list, simp+)\napply clarsimp\ndone\n\nlemma update_later: \"\\update_mem (mem, bufs) {} (mem', bufs')\\ \\\n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (l, v) # bufs' t))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). ops = {} \\ \n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (l, v) # bufs' t))\" in update_mem.induct, auto)\napply (cut_tac ops=\"{Write t l v}\" in no_atomic, auto)\napply (drule_tac ops=\"{Write t l v}\" in update, auto)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto)\nby (metis (hide_lams, no_types) fun_upd_twist)\n\nlemma update_later2: \"\\update_mem (mem, bufs) {} (mem', bufs'(t := buf)); bufs' t = (l, v) # buf\\ \\ \n update_mem (mem, bufs) {Write t l v} (mem', bufs')\"\nby (smt fun_upd_idem_iff fun_upd_upd list.inject update_later)\n\nlemma update_past: \"\\update_mem (mem, bufs) ops (mem', bufs'); t \\ get_thread ` ops\\ \\ \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). t \\ get_thread ` ops \\ \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\" \n in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (rule_tac x=\"[]\" in exI, simp)\napply (subgoal_tac \"\\a b. Write t a b \\ opsa\", subgoal_tac \"\\up. bufs' t = up @ bufs t \n \\ set up = {(l, v). Write t l v \\ opsa} \\ distinct up\", clarify, simp, metis, auto)\napply (metis get_thread.simps(2) imageI)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" in update, auto)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" and t=ta in update, auto)\napply (simp add: fun_upd_twist)\ndone\n\nlemma update_past2: \"\\update_mem (mem, bufs) ops (mem', bufs'); \n \\l v. Write t l v \\ ops; \\l v v'. ARW t l v v' \\ ops\\ \\ \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). (\\l v. Write t l v \\ ops) \\ \n (\\l v v'. ARW t l v v' \\ ops) \\ update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\" \n in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (subgoal_tac \"\\up. bufs' t = up @ bufs t \\ set up = {(l, v). Write t l v \\ opsa} \\ \n distinct up\", simp)\napply (metis (full_types))\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" in update, auto)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" and t=ta in update, auto simp add: fun_upd_twist)\ndone\n\nlemma process_buffer: \"\\update_mem (mem, bufs) ops (mem', bufs'); bufs' t = a @ b\\ \\\n update_mem (mem, bufs) ops (mem' ++ map_of b, bufs'(t := a))\"\napply (induct b arbitrary: mem' bufs' rule: rev_induct, auto simp add: map_upd_triv)\napply (drule_tac t=t in update, auto)\napply force\ndone\n\nend\n\n(* assorted useful list lemmas*)\nlemma map_upt_zip_Suc [simp]: \"l' = map (\\(x, n). (x, Suc n)) l \\ map (\\((l, v), n). (l, v) # map (Pair l) (f n)) l' =\n map (\\((l, v), n). (l, v) # map (Pair l) (f (Suc n))) l\"\nby auto\n\ndeclare map_Suc_upt [simp]\n\nlemma zip_Suc [simp]: \"zip l [Suc i..(x, n). (x, Suc n)) (zip l [i..((l, v), n). (l, v) # map (\\v. (l, v)) (f n)) (zip l [0..v. (fst x, v)) (f 0) @ add_red l (\\n. f (Suc n))\"\napply (auto simp add: add_red_def)\napply (case_tac \"map (\\((l, v), n). (l, v) # map (Pair l) (f n)) (zip (x # l) ([0..n. f (n + length l))\"\nby (induct l arbitrary: f, auto)\n\nlemma add_red_id [simp]: \"(\\n. n < length l \\ f n = []) \\ add_red l f = l\"\nby (induct l arbitrary: f, auto)\n\nlemma find_append: \"(\\x. x \\ set l \\ \\P x) \\ List.find P (l @ l') = List.find P l'\"\nby (induct l, auto)\n\nlemma find_append2 [simp]: \"List.find P l = None \\ List.find P (l @ l') = List.find P l'\"\nby (induct l, auto)\n\nlemma find_append3 [simp]: \"List.find P l = Some x \\ List.find P (l @ l') = Some x\"\nby (induct l, auto)\n\nlemma add_red_find [simp]: \"List.find (\\(l, v). l = x) (add_red buf f) = \n List.find (\\(l, v). l = x) buf\"\napply (induct buf arbitrary: f, auto)\napply (rule trans, rule find_append, auto)\ndone\n\ncontext TSO begin\n\nlemma update_red: \"\\update_mem (mem, bufs) ops (mem', bufs'); \\t. red t = add_red (bufs t) (f t)\\ \\\n \\red' f'. update_mem (mem, red) ops (mem', red') \\ (\\t. red' t = add_red (bufs' t) (f' t))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). (\\t. red t = add_red (bufs t) (f t)) \\ \n (\\red' f'. update_mem (mem, red) ops (mem', red') \\ (\\t. red' t = add_red (bufs' t) (f' t)))\" \n in update_mem.induct, auto)\napply (rule_tac x=\"\\t. (SOME up. bufs' t = up @ bufsa t \\ set up = {(l, v). Write t l v \\ ops} \\ \n distinct up) @ red t\" in exI, auto)\napply (rule no_atomic, simp_all)\napply (cut_tac P=\"\\up. bufs' t = up @ bufsa t \\ set up = {(l, v). Write t l v \\ ops} \\ \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\t n. if n < length (SOME up. bufs' t = up @ bufsa t \\ \n set up = {(l, v). Write t l v \\ ops} \\ distinct up) then [] else f t (n - length (SOME up. \n bufs' t = up @ bufsa t \\ set up = {(l, v). Write t l v \\ ops} \\ distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\up. bufs' t = up @ bufsa t \\ set up = {(l, v). Write t l v \\ ops} \\ distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\upa. up = upa \\ set upa = {(l, v). Write t l v \\ ops} \\ distinct upa\" in someI, \n force, clarsimp)\napply metis\napply (drule_tac bufs=red and t=t and a=\"add_red buf (f' t)\" in process_buffer, simp, clarsimp)\napply (subgoal_tac \"dom (map_of (map (Pair l) (f' t (length buf)))) = {l} \\ f' t (length buf) = []\", \n erule disjE, simp+)\napply (rule_tac x=\"red'(t := add_red buf (f' t))\" in exI, clarsimp)\napply (rule_tac x=f' in exI, simp)\napply (rule_tac x=\"red'(t := add_red buf (f' t))\" in exI, clarsimp)\napply (rule_tac x=f' in exI, simp)\napply (auto simp add: dom_map_of_conv_image_fst intro!: set_eqI)\napply (case_tac \"f' t (length buf)\", simp+)\napply (rule_tac x=red in exI, auto)+\ndone\n\nlemma update_red1: \"update_mem (mem, bufs) ops (mem', bufs') \\\n \\f'. update_mem (mem, bufs(t := add_red (bufs t) f)) ops (mem', bufs'(t := add_red (bufs' t) f'))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). \\f'. update_mem (mem, bufs(t := add_red (bufs t) f)) \n ops (mem', bufs'(t := add_red (bufs' t) f'))\" in update_mem.induct, auto)\napply (rule_tac x=\"\\n. if n < length (SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x) \n then [] else f (n - length (SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x))\" \n in exI, rule no_atomic, auto)\napply (cut_tac P=\"\\up. bufs' t = up @ bufs t \\ set up = {(l, v). Write t l v \\ ops} \\ \n distinct up\" in someI_ex, force, clarsimp)\napply (rule_tac x=\"SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x\"\n in exI, clarsimp)\napply (rule_tac s=\"add_red ((SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x) @ bufs t)\n (\\n. if n < length (SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x) then []\n else f (n - length (SOME x. bufs' t = x @ bufs t \\ set x = {(l, v). Write t l v \\ ops} \\ distinct x)))\" \n in trans, simp, simp (no_asm))\napply (drule_tac bufs=\"bufs(t := add_red (bufs t) f)\" and t=t and a=\"add_red buf f'\" in process_buffer,\n simp, clarsimp)\napply (subgoal_tac \"dom (map_of (map (Pair l) (f' (length buf)))) = {l} \\ f' (length buf) = []\", \n auto simp add: dom_map_of_conv_image_fst intro!: set_eqI)\napply (metis (full_types) append_Nil fst_conv imageI in_set_conv_decomp list.exhaust)\napply (drule_tac bufs=\"bufs(t := add_red (bufs t) f)\" in update, simp, force, \n force simp add: fun_upd_twist)\napply force\ndone\n\nlemma can_read_red: \"b' t = add_red (b t) f \\ can_read (mem, b') t = can_read (mem, b) t\"\nby (clarsimp intro!: ext simp add: can_read_def split: option.splits)\n\nlemma can_read_red_loc: \"\\b' t = (l', v) # add_red (b t) f; l' \\ l\\ \\ \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: option.splits)\n\nend\n\n(* Sequential consistency memory model *)\nlocale SC = fixes undef::'val begin\n\nabbreviation \"free_set mem \\ UNIV - dom mem\"\nabbreviation \"can_read mem t l \\ {v. mem l = Some v}\"\ninductive update_mem where \nno_atomic [intro]: \"\\\\t l v v'. ARW t l v v' \\ ops; \\l. (\\t v. Write t l v \\ ops) \\ writes l = None; \n \\t l v. Write t l v \\ ops \\ \\t v. Write t l v \\ ops \\ writes l = Some v; finite ops\\ \\ \n update_mem mem ops (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None) ++ writes)\" |\natomic [intro!]: \"update_mem mem {ARW t l v v'} (mem(l \\ v'))\"\nabbreviation \"start_mem \\ empty\"\n\nlemma update_threads: \"\\update_mem mem ops mem'; \\a'\\ops'. \\a\\ops. \\t. a' = set_thread (t::'t) \n (a::('t, 'l, 'val) access)\\ \\ update_mem mem ops' mem'\"\napply (drule_tac P=\"\\mem ops mem'. \\ops'. (\\a'\\ops'. \\a\\ops. \\t. a' = set_thread t a) \\\n update_mem mem ops' mem'\" in update_mem.induct, auto)\napply (subgoal_tac \"{l. \\t. Free t l \\ opsa} = {l. \\t. Free t l \\ ops'a} \\ (\\l. if \\t. Alloc t l \\ \n opsa then Some undef else None) = (\\l. if \\t. Alloc t l \\ ops'a then Some undef else None)\", simp)\napply (rule no_atomic, clarsimp)\napply (thin_tac \"\\a'\\ops'. \\a\\ops. \\t. a' = set_thread t a\")\napply (erule_tac x=\"ARW t l v v'\" in ballE, simp_all, clarsimp)\napply (case_tac a, simp_all)\napply (subgoal_tac \"\\t v. Write t l v \\ opsa\", simp, clarsimp)\noops\n\nlemma update_threads: \"update_mem mem ops mem' \\ update_mem mem (set_thread t ` ops) mem'\"\napply (drule_tac P=\"\\mem ops mem'. update_mem mem (set_thread t ` ops) mem'\" in update_mem.induct, auto)\napply (subgoal_tac \"{l. \\t. Free t l \\ ops} = {l. \\ta. Free ta l \\ set_thread t ` ops} \\ (\\l. if \n \\t. Alloc t l \\ ops then Some undef else None) = (\\l. if \\ta. Alloc ta l \\ set_thread t ` ops \n then Some undef else None)\", simp)\napply (rule no_atomic, clarsimp)\napply (case_tac x, simp_all)\napply (subgoal_tac \"\\t v. Write t l v \\ ops\", simp, clarsimp)\napply (erule_tac x=t in allE, erule_tac x=v in allE, force simp add: image_def)\napply (subgoal_tac \"\\t v. Write t l v \\ ops \\ writes l = Some v\", clarsimp simp add: image_def)\napply (rule_tac x=t in exI, rule_tac x=\"Write tb l va\" in bexI, simp+)\napply (clarsimp simp add: image_def)\napply (case_tac x, simp_all)\napply (auto simp add: image_def)\napply (rule_tac x=t in exI, rule bexI, simp_all)\napply (case_tac xa, simp_all, metis)\napply (rule ext, auto)\napply (rule_tac x=t in exI, rule bexI, simp_all)\napply (case_tac x, simp_all)\ndone\n\nlemma stays_not_free: \"\\update_mem mem ops mem'; l \\ free_set mem; \\t. Free t l \\ ops\\ \\\n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma alloc_not_free: \"\\update_mem mem ops mem'; Alloc t l \\ ops; Free t l \\ ops\\ \\ \n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale SC \\ memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext SC begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cut_tac no_atomic, auto simp add: restrict_map_def)\n\nlemma update_none_only [simp, dest!]: \"update_mem mem {} mem' \\ mem' = mem\"\nby (erule update_mem.cases, auto simp add: restrict_map_def map_add_def)\n\nlemma update_one_write [intro!, simp]: \"mem' = mem(l \\ v) \\\n update_mem mem {Write t l v} mem'\"\nby (cut_tac ops=\"{Write t l v}\" and writes=\"[l \\ v]\" in no_atomic, auto simp add: restrict_map_def)\n\nlemma update_one_writeD [dest!, simp]: \"update_mem mem {Write t l v} mem' \\ mem' = mem(l \\ v)\"\nby (erule update_mem.cases, auto intro!: ext simp add: map_add_def split: option.splits)\n\nlemma update_one_read [intro, simp]: \"update_mem mem {Read t l v} mem\"\nby (cut_tac ops=\"{Read t l v}\" in no_atomic, auto simp add: restrict_map_def)\n\nlemma update_one_readD [dest!, simp]: \"update_mem mem {Read t l v} mem' \\ mem' = mem\"\nby (erule update_mem.cases, auto intro!: ext simp add: restrict_map_def map_add_def)\n\nlemma update_one_alloc [intro!, simp]: \"mem' = mem(l \\ undef) \\\n update_mem mem {Alloc t l} mem'\"\napply (cut_tac ops=\"{Alloc t l}\" and mem=mem in no_atomic, auto simp add: restrict_map_def)\napply (subgoal_tac \"mem ++ (\\la. if la = l then Some undef else None) = mem(l \\ undef)\", simp,\n auto intro!: ext simp add: map_add_def)\ndone\n\nlemma update_one_allocD [dest!]: \"update_mem mem {Alloc t l} mem' \\ mem' = mem(l \\ undef)\"\nby (erule update_mem.cases, auto simp add: restrict_map_def map_add_def)\n\nlemma update_frees [intro!, simp]: \"\\mem' = mem |` (UNIV - S); finite S\\ \\ \n update_mem mem (Free t ` S) mem'\"\napply (cut_tac ops=\"Free t ` S\" and mem=mem in no_atomic, auto)\napply (rule subst, rule_tac f=\"update_mem mem (Free t ` S)\" in arg_cong, simp_all)\napply (auto intro!: ext simp add: map_add_def restrict_map_def, force)\ndone\n\nlemma update_freesD [dest!, simp]: \"update_mem mem (Free t ` S) mem' \\\n mem' = mem |` (UNIV - S)\"\napply (erule update_mem.cases, auto intro!: ext simp add: map_add_def restrict_map_def \n split: option.splits)\napply (metis image_eqI)\napply (metis access.distinct(13) image_iff option.distinct(1))\napply (metis image_eqI)\nby (metis access.distinct(13) image_iff option.distinct(1))\n\nlemma update_ARW [intro!]: \"mem' = mem(l \\ v') \\ update_mem mem {ARW t l v v'} mem'\"\nby clarsimp\n\nlemma update_ARWD [dest!]: \"update_mem mem {ARW t l v v'} mem' \\ mem' = mem(l \\ v')\"\nby (erule update_mem.cases, auto)\n\nlemma update_past: \"\\update_mem mem ops mem'; \\t v. Write t l v \\ ops; \n \\t v v'. ARW t l v v' \\ ops; \\t. Free t l \\ ops; \\t. Alloc t l \\ ops\\ \\\n update_mem (mem(l := v)) ops (mem'(l := v))\"\napply (induct rule: update_mem.induct, auto)\napply (cut_tac ops=ops and mem=\"mem(l := v)\" and writes=writes in no_atomic, auto)\napply (rule_tac f1=\"update_mem (mem(l := v))\" in arg_cong2 [THEN subst], \n auto intro!: ext simp add: map_add_def restrict_map_def split: option.splits)\nby (metis atomic fun_upd_twist)\n\nend\n\nlocale undef = fixes undef::'val\nsublocale undef \\ TSO: TSO .\nsublocale undef \\ SC: SC .\n\ncontext undef begin\n\n(* SC can be modeled by TSO. *)\n(*\n\nlemma process_all_buffers [rule_format]: \"\\update_mem (mem, bufs) ops (mem', bufs'); \n \\t. bufs' t = ma t @ mb t; finite {t. mb t \\ []}\\ \\\n \\m'. update_mem (mem, bufs) ops (mem' ++ m', (\\t. ma t)) \\\n (\\l v. ((m' l = Some v) \\ (\\t. map_of (mb t) l = Some v)) \\\n (m' l = None \\ (\\t. map_of (mb t) l = None)))\"\napply (drule_tac P=\"\\S. \\mem' bufs' ma mb. (update_mem (mem, bufs) ops (mem', bufs') \\\n (\\t. bufs' t = ma t @ mb t)) \\ S = {t. mb t \\ []} \\ \n (\\m'. update_mem (mem, bufs) ops (mem' ++ m', (\\t. ma t)) \\\n (\\l v. ((m' l = Some v) \\ (\\t. map_of (mb t) l = Some v)) \\\n (m' l = None \\ (\\t. map_of (mb t) l = None))))\" in finite_induct, auto)\napply (rule_tac x=empty in exI, simp)\napply (subgoal_tac \"bufs'a = maa\", simp)\napply (auto intro!: ext split: option.split)\napply (cut_tac a=x and B=F in insertI1, clarsimp)\napply (thin_tac \"\\t. bufs' t = ma t @ mb t\")\napply (drule_tac bufs'=bufs'a and t=x and a=\"ma x\" in process_buffer, auto)\napply (erule_tac x=\"mem'a ++ map_of (mb x)\" in allE, erule_tac x=\"bufs'a(x := ma x)\" in allE, \n erule_tac x=ma in allE, erule_tac x=\"mb(x := [])\" in allE, clarsimp, erule impE, force, clarsimp)\napply (rule_tac x=\"map_of (mb x) ++ m'\" in exI, auto split: if_splits, metis, metis)\napply (erule_tac x=mem' in allE, erule_tac x=bufs' in allE, simp)\ndone\n\nlemma SC_lt_update [simp, intro]: \"update_mem_SC mem ops mem' \\ \n update_mem (mem, \\t. []) ops (mem', \\t. [])\"\napply (erule update_mem_SC.cases, auto split: if_splits)\napply (cut_tac ops=ops and mem=mem and bufs=\"\\t. []\" and\n bufs'=\"\\t. list_of_set {(l, v) | l v. Write t l v \\ ops \\ writes l = Some v} @ \n list_of_set {(l, v) | l v. Write t l v \\ ops \\ writes l \\ Some v}\" in no_atomic, simp_all)\napply (subgoal_tac \"finite {(l, v). Write t l v \\ ops}\", auto)\napply (rule finite_vimageI, auto simp add: inj_on_def)\napply (drule_tac ma=\"\\t. list_of_set {(l, v) | l v. Write t l v \\ ops \\ writes l = Some v}\" and \n mb=\"\\t. list_of_set {(l, v) | l v. Write t l v \\ ops \\ writes l \\ Some v}\" in process_all_buffers)\napply (simp split: if_splits)\napply clarsimp\napply (rule_tac B=\"{t. \\a \\ ops. get_thread a = t}\" in finite_subset, clarsimp)\napply (clarsimp simp add: card_gt_0_iff, rule_tac x=\"Write x a b\" in bexI, simp+)\napply clarsimp\napply (drule_tac ma=\"\\t. []\" and \n mb=\"\\t. list_of_set {(l, v) | l v. Write t l v \\ ops \\ writes l = Some v}\" in process_all_buffers)\napply (simp split: if_splits)\napply clarsimp\napply (rule_tac B=\"{t. \\a \\ ops. get_thread a = t}\" in finite_subset, clarsimp)\napply (clarsimp simp add: card_gt_0_iff, rule_tac x=\"Write x a b\" in bexI, simp+)\napply clarsimp\napply (rule_tac x1=\"(mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None) ++ m' ++ m'a, \\t. case case if t \\ dom threads\n then Some (list_of_set {(l, v) |l v. Write t l v \\ ops \\ writes l = Some v} @\n list_of_set {(l, v) |l v. Write t l v \\ ops \\ writes l \\ Some v})\n else None of\n None \\ None | Some x \\ Some (list_of_set {(l, v) |l v. Write t l v \\ ops \\ writes l = Some v}) of\n None \\ None | Some x \\ Some [])\" in cong [THEN subst], simp, auto)\napply (subgoal_tac \"m' ++ m'a = writes\")\napply (metis map_add_assoc)\napply (rule ext, (erule_tac x=x in allE)+, clarsimp simp add: map_add_def split: option.split)\napply (case_tac \"writes x\", simp_all)\napply (subgoal_tac \"\\t v. Write t x v \\ ops\", rule ccontr, clarsimp, erule disjE, \n clarsimp split: if_splits)\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write t l v \\ ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply (clarsimp split: if_splits)\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write t l v \\ ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply (metis not_Some_eq)\napply (subgoal_tac \"\\t. Write t x a \\ ops\", clarsimp)\napply (rule conjI, clarsimp)\napply (erule_tac x=t in allE)\napply (clarsimp simp add: map_of_eq_None_iff)\napply (subgoal_tac \"finite {(l, v). Write t l v \\ ops}\", simp+)\napply (erule notE, rule_tac x=\"(x, a)\" in image_eqI, simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply clarsimp\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write ta l v \\ ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\nby (metis (hide_lams, full_types) not_Some_eq option.inject)\n\nlemma make_bufs_can_read [simp]: \"can_read (mem, \\t. []) t = can_read_SC mem t\"\nby (rule ext, simp add: can_read_def)\n(* Because can_read and update_mem are the only interfaces to the memory provided by memory_model,\n this implies that SC refines TSO for any language. Is there a way to make this explicit? *)\n*)\nend\n\nlocale PSO = fixes undef::'val begin\n\n(* PSO memory model *)\nabbreviation \"free_set mem \\ UNIV - dom (fst mem)\"\ndefinition \"can_read mem t l \\ case snd mem t l of v # buf \\ {v}\n | [] \\ {v. fst mem l = Some v}\"\ninductive update_mem where \nno_atomic [intro]: \"\\\\t l v v'. ARW t l v v' \\ ops; \\t l. \\up. bufs' t l = up @ bufs t l \\ \n set up = {v. Write t l v \\ ops} \\ distinct up\\ \\ \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\t. Free t l \\ ops}) ++ \n (\\l. if \\t. Alloc t l \\ ops then Some undef else None), bufs')\" |\nupdate [intro]: \"\\update_mem (mem, bufs) ops (mem', bufs'); bufs' t l = buf @ [v]\\ \\\n update_mem (mem, bufs) ops (mem'(l \\ v), bufs'(t := (bufs' t)(l := buf)))\" |\natomic [intro!]: \"bufs t l = [] \\\n update_mem (mem, bufs) {ARW t l v v'} (mem(l \\ v'), bufs)\"\nabbreviation \"start_mem \\ (empty, \\t l. [])\"\n\nlemma alloc_not_free: \"\\update_mem mem ops mem'; Alloc t l \\ ops; \\t. Free t l \\ ops\\ \\ \n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma stays_not_free: \"\\update_mem mem ops mem'; l \\ free_set mem; \\t. Free t l \\ ops\\ \\\n l \\ free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale PSO \\ memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext PSO begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cases C, cut_tac ops=\"{}\" and mem=a and bufs=b in no_atomic, auto simp add: restrict_map_def)\n\nlemma process_buffer: \"\\update_mem (mem, bufs) ops (mem', bufs'); bufs' t l = a @ v # b\\ \\\n update_mem (mem, bufs) ops (mem'(l \\ v), bufs'(t := (bufs' t)(l := a)))\"\napply (induct b arbitrary: mem' bufs' v rule: rev_induct, auto simp add: map_upd_triv)\napply (drule_tac t=t and l=l in update, simp, force)\ndone\n\nlemma update_later: \"\\update_mem (mem, bufs) {} (mem', bufs')\\ \\\n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (bufs' t)(l := v # bufs' t l)))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). ops = {} \\ \n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (bufs' t)(l := v # bufs' t l)))\" \n in update_mem.induct, auto)\napply (cut_tac ops=\"{Write t l v}\" in no_atomic, auto)\napply (drule_tac ops=\"{Write t l v}\" in update, auto)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto simp add: fun_upd_twist)\napply (drule_tac ops=\"{Write t l v}\" and l=la in update, auto simp add: fun_upd_twist)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto simp add: fun_upd_twist)\ndone\n\nlemma update_later2: \"\\update_mem (mem, bufs) {} (mem', bufs'(t := (bufs' t)(l := buf))); \n bufs' t l = v # buf\\ \\ update_mem (mem, bufs) {Write t l v} (mem', bufs')\"\nby (smt fun_upd_idem_iff fun_upd_upd list.inject update_later)\n\nlemma update_past2: \"\\update_mem (mem, bufs) ops (mem', bufs'); \n \\v. Write t l v \\ ops; \\l v v'. ARW t l v v' \\ ops\\ \\ \n update_mem (mem, bufs(t := (bufs t)(l := b @ bufs t l))) ops \n (mem', bufs'(t := (bufs' t)(l := b @ bufs' t l)))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). (\\v. Write t l v \\ ops) \\ \n (\\l v v'. ARW t l v v' \\ ops) \\ update_mem (mem, bufs(t := (bufs t)(l := b @ bufs t l))) ops \n (mem', bufs'(t := (bufs' t)(l := b @ bufs' t l)))\" in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (subgoal_tac \"\\up. bufs' t l = up @ bufs t l \\ set up = {v. Write t l v \\ opsa} \\ \n distinct up\", simp)\napply (metis (full_types))\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" in update, auto)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" and t=ta in update, \n auto simp add: fun_upd_twist)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" in update, \n auto simp add: fun_upd_twist)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" and t=ta in update, \n auto simp add: fun_upd_twist)\ndone\n\nlemma update_write: \"\\update_mem (mem, bufs) {Write t l v} (mem', bufs')\\ \\\n update_mem (mem, bufs(t := (bufs t)(l := v # bufs t l))) {} (mem', bufs')\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). ops = {Write t l v} \\\n update_mem (mem, bufs(t := (bufs t)(l := v # bufs t l))) {} (mem', bufs')\" \n in update_mem.induct, auto)\napply (cut_tac ops=\"{}\" and bufs=\"bufs(t := (bufs t)(l := v # bufs t l))\" and\n bufs'=bufs' in no_atomic, simp_all)\napply (subgoal_tac \"\\up. bufs' ta la = up @ bufs ta la \\ set up = {va. va = v \\ ta = t \\ la = l} \\ \n distinct up\", clarify, auto)\napply (case_tac up, auto, case_tac list, auto)\ndone\n\nlemma update_trans_rev: \"\\update_mem (mem', bufs') {} (mem'', bufs'');\n update_mem (mem, bufs) ops (mem', bufs')\\ \\ update_mem (mem, bufs) ops (mem'', bufs'')\"\napply (drule_tac P=\"\\(mem', bufs') ops' (mem'', bufs''). ops' = {} \\ update_mem (mem, bufs) ops (mem', bufs') \\\n update_mem (mem, bufs) ops (mem'', bufs'')\" in update_mem.induct, auto simp add: restrict_map_def)\napply (subgoal_tac \"bufs'a = bufsa\", auto)\ndone\n\nend\n*)\n(* In PSO, redundant elements are added to the buffers for individual locations. *)\ndefinition \"add_red2 l f = concat (map (\\(v, n). v # f n) (zip l [0.. i \\ [i..(x, n). (x, Suc n)) l \\ map (\\(v, n). v # f n) l' =\n map (\\(v, n). v # f (Suc n)) l\"\nby auto\n\nlemma add_red2_cons [simp]: \"add_red2 (x # l) f = x # f 0 @ add_red2 l (\\n. f (Suc n))\"\napply (auto simp add: add_red2_def)\napply (case_tac \"map (\\(v, n). v # f n) (zip (x # l) ([0..n. f (n + length l))\"\nby (induct l arbitrary: f, auto)\n\nlemma add_red2_id [simp]: \"(\\n. n < length l \\ f n = []) \\ add_red2 l f = l\"\nby (induct l arbitrary: f, auto)\n\ncontext PSO begin\n\nlemma update_red2: \"\\update_mem (mem, bufs) ops (mem', bufs');\n \\t l. red t l = add_red2 (bufs t l) (f t l)\\ \\\n \\red' f'. update_mem (mem, red) ops (mem', red') \\ \n (\\t l. red' t l = add_red2 (bufs' t l) (f' t l))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). (\\t l. red t l = add_red2 (bufs t l) (f t l)) \\ \n (\\red' f'. update_mem (mem, red) ops (mem', red') \\ (\\t l. red' t l = add_red2 (bufs' t l) (f' t l)))\" \n in update_mem.induct, auto)\napply (rule_tac x=\"\\t l. (SOME up. bufs' t l = up @ (bufsa t l) \\ set up = {v. Write t l v \\ ops} \\ \n distinct up) @ red t l\" in exI, auto)\napply (rule no_atomic, simp_all)\napply (cut_tac P=\"\\up. bufs' t l = up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\t l n. if n < length (SOME up. bufs' t l = up @ bufsa t l \\ set up = \n {v. Write t l v \\ ops} \\ distinct up) then [] else f t l (n - length (SOME up. bufs' t l = \n up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\up. bufs' t l = up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\upa. up = upa \\ set upa = {v. Write t l v \\ ops} \\ distinct upa\" in someI, \n force, clarsimp)\napply metis\napply (drule_tac bufs=red and t=t and l=l and a=\"add_red2 buf (f' t l)\" in process_buffer, force)\napply (rule_tac x=\"red'(t := (red' t)(l := add_red2 buf (f' t l)))\" in exI, clarsimp, metis)\napply (rule_tac x=red in exI, auto)\ndone\n\nlemma update_red2_one_buf: \"\\update_mem (mem, bufs) ops (mem', bufs'); \n \\t'. t' \\ t \\ red t' = bufs t'; \\l. red t l = add_red2 (bufs t l) (f l)\\ \\\n \\red' f'. update_mem (mem, red) ops (mem', red') \\ (\\t'. t' \\ t \\ red' t' = bufs' t') \\\n (\\l. red' t l = add_red2 (bufs' t l) (f' l))\"\napply (drule_tac P=\"\\(mem, bufs) ops (mem', bufs'). ((\\t'. t' \\ t \\ red t' = bufs t') \\\n (\\l. red t l = add_red2 (bufs t l) (f l))) \\ (\\red' f'. update_mem (mem, red) ops (mem', red') \\ \n (\\t'. t' \\ t \\ red' t' = bufs' t') \\ (\\l. red' t l = add_red2 (bufs' t l) (f' l)))\" \n in update_mem.induct, simp_all, clarsimp)\napply (rule_tac x=\"bufs'(t := \\l. (SOME up. bufs' t l = up @ (bufsa t l) \\ set up = {v. Write t l v \\ ops} \\ \n distinct up) @ red t l)\" in exI, clarsimp)\napply (rule conjI, rule no_atomic, simp_all)\napply (cut_tac P=\"\\up. bufs' t l = up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\l n. if n < length (SOME up. bufs' t l = up @ bufsa t l \\ set up = \n {v. Write t l v \\ ops} \\ distinct up) then [] else f l (n - length (SOME up. bufs' t l = \n up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\up. bufs' t l = up @ bufsa t l \\ set up = {v. Write t l v \\ ops} \\ distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\upa. up = upa \\ set upa = {v. Write t l v \\ ops} \\ distinct upa\" in someI, \n force, clarsimp)\napply metis\napply auto\napply (drule_tac bufs=red and t=t and l=l in process_buffer, force)\napply (rule_tac x=\"red'(t := (red' t)(l := add_red2 buf (f' l)))\" in exI, clarsimp, metis)\napply (drule_tac bufs=red and t=ta and l=l in process_buffer, force)\napply (rule_tac x=\"red'(ta := (red' ta)(l := buf))\" in exI, clarsimp, metis)\napply (rule_tac x=red in exI, auto)\napply (case_tac \"ta = t\", auto)\ndone\n\nlemma can_read_red [simp]: \"b' t l = add_red2 (b t l) f \\ \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: list.splits)\n\nlemma can_read_loc: \"b' t l = b t l \\ \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: list.splits)\n\nlemma two_part_buf [simp]: \"bufs t l = buf \\ bufs(t := (bufs t)(l := buf)) = bufs\"\nby (clarsimp intro!: ext)\n\nend\n*)\nend\n", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/memory_model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953506426082, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2729725100738839}} {"text": "section \\Soundness\\\n\ntheory Soundness imports \"Abstract_Soundness.Finite_Proof_Soundness\" Prover Semantics begin\n\nlemma eff_sound:\n assumes \\eff r (A, B) = Some ss\\ \\\\A B. (A, B) |\\| ss \\ (\\(E :: _ \\ 'a). sc (E, F, G) (A, B))\\\n shows \\sc (E, F, G) (A, B)\\\n using assms\nproof (induct r \\(A, B)\\ rule: eff.induct)\n case (5 p q)\n then have \\sc (E, F, G) (A [\\

] (p \\<^bold>\\ q), p # B)\\ \\sc (E, F, G) (q # A [\\
] (p \\<^bold>\\ q), B)\\\n by (metis eff.simps(5) finsertCI option.inject option.simps(3))+\n then show ?case\n using \"5.prems\"(1) by (force split: if_splits)\nnext\n case (7 t p)\n then have \\sc (E, F, G) (\\t\\p # A, B)\\\n by (metis eff.simps(7) finsert_iff option.inject option.simps(3))\n then show ?case\n using \"7.prems\"(1) by (fastforce split: if_splits)\nnext\n case (8 p)\n let ?n = \\fresh (A @ B)\\\n have A: \\\\p [\\] A. max_list (vars_fm p) < ?n\\ and B: \\\\p [\\] B. max_list (vars_fm p) < ?n\\\n unfolding fresh_def using max_list_vars_fms max_list_mono vars_fms_member\n by (metis Un_iff le_imp_less_Suc set_append)+\n from 8 have \\sc (E(?n := x), F, G) (A, \\\\<^bold>#?n\\p # B [\\
] \\<^bold>\\p)\\ for x\n by (metis eff.simps(8) finsert_iff option.inject option.simps(3))\n then have \\(\\p [\\] A. \\E, F, G\\ p) \\\n (\\x. \\(x \\ \\m. (E(?n := x)) m), F, G\\ p) \\ (\\q [\\] B [\\
] \\<^bold>\\p. \\E, F, G\\ q)\\\n using A B upd_vars_fm by fastforce\n then have \\(\\p [\\] A. \\E, F, G\\ p) \\\n (\\x. \\((x \\ E)(Suc ?n := x)), F, G\\ p) \\ (\\q [\\] B [\\
] \\<^bold>\\p. \\E, F, G\\ q)\\\n unfolding add_upd_commute by blast\n moreover have \\max_list (vars_fm p) < ?n\\\n using B \"8.prems\"(1) by (metis eff.simps(8) option.distinct(1) vars_fm.simps(4))\n ultimately have \\sc (E, F, G) (A, \\<^bold>\\p # (B [\\
] \\<^bold>\\p))\\\n by auto\n moreover have \\\\<^bold>\\p [\\] B\\\n using \"8.prems\"(1) by (simp split: if_splits)\n ultimately show ?case\n by (metis (full_types) Diff_iff sc.simps set_ConsD set_removeAll)\nqed (fastforce split: if_splits)+\n\ninterpretation Soundness \\\\r s ss. eff r s = Some ss\\ rules UNIV sc\n unfolding Soundness_def using eff_sound by fast\n\ntheorem prover_soundness:\n assumes \\tfinite t\\ and \\wf t\\\n shows \\sc (E, F, G) (fst (root t))\\\n using assms soundness by fast\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FOL_Seq_Calc3/Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2729037844611154}} {"text": "theory Proof_3_2\n imports Proofs_3\nbegin\n\n\ncontext\n fixes s2 s0:: state\nfixes user_value pressure_value:: bool\nassumes toEnvPs2: \"toEnvP s2 \\ toEnvP s0\" and extraInvs0: \"extraInv s0\" \nand vc: \" env (setVarAny s0 user_value pressure_value) \\\n getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'motionless \\\n getVarBool (setVarAny s0 user_value pressure_value) user\"\nbegin\n\nlemma VC2_R3_ind_step_aux1: \" toEnvP s2a \\\n substate s2 s2a \\\n substate s2a\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n s2 \\ s2a \\\n substate s1 s2 \\\n substate s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 s2a \\ s4 \\ s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)) \\\n substate s1 s2 \\\n substate s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 (predEnv s2a) \\ s4 \\ predEnv s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n \\ (getVarBool (predEnv s2a) rotation = False \\ getVarBool (predEnv s2a) user) \\\n toEnvP x \\\n substate s2a x \\\n substate x\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n toEnvNum s2 x \\ DELAY'TIMEOUT \\\n (getVarBool x rotation = False \\ getVarBool x user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 x \\ s3 \\ x \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user) \\\n \\s4. toEnvP s4 \\\n substate (predEnv s2a) s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate (predEnv s2a) s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)\"\n apply(rule exI[of _ x])\n by (smt (z3) predEnv_substate predEnv_substate_imp_eq_or_substate substate_trans)\n \nlemma VC2_R3_ind_step: \" toEnvP s2a \\\n substate s2 s2a \\\n substate s2a\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n s2 \\ s2a \\\n substate s1 s2 \\\n substate s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 s2a \\ s4 \\ s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)) \\\n substate s1 s2 \\\n substate s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 (predEnv s2a) \\ s4 \\ predEnv s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate (predEnv s2a) s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate (predEnv s2a) s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"\n apply(rule impI)\n apply(cases \"(getVarBool (predEnv s2a) rotation = False \\ getVarBool (predEnv s2a) user)\")\n apply(rule exI[of _ \"predEnv s2a\"])\n apply(rule conjI)\n apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n using toEnvPs2 substate_eq_or_predEnv apply fast\n apply(rule conjI)\n using substate_refl apply fast\n apply(rule conjI)\n using predEnv_substate substate_trans apply fast\n apply(rule conjI)\n apply(rule cut_rl[of \"substate s2 (predEnv s2a) \\\n substate (predEnv s2a)\n (toEnv (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\"])\n using toEnvNum3[of s2 \"predEnv s2a\" \n\"(toEnv (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\"]\n apply arith\n using substate_eq_or_predEnv predEnv_substate substate_trans apply fast\n apply(rule conjI)\n apply assumption\n using substate_asym apply fast\n apply(rule exE[of \"\\ s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)\"])\n using substate_eq_or_predEnv apply blast\n by ((rule VC2_R3_ind_step_aux1);blast)\n \nlemma VC2_R3_ind_proof: \"toEnvP s5 \\ substate s2 s5 \\\n substate s5 (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\n \\ pred3 s1 s2 (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\n s5\"\n apply(induction rule: state_down_ind)\n using toEnvPs2 apply simp\n apply(simp only: pred3_def)\n apply(rule impI)\n apply(rule cut_rl[of \"getVarBool s0 rotation = False\"])\n apply(rule cut_rl[of \"getVarBool s0 rotation = True \\ \\ getVarBool s0 user\"])\n apply fast\n apply(rule cut_rl[of \"substate s2 s0 \\\n substate s0\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n s0 \\\n toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended) \"])\n using toEnvPs2 apply fast\n using substate_refl toEnvNum_id apply((simp split: if_splits);auto)\n using extraInvs0 extraInv_def vc\n apply (smt (verit) getPstate.simps(9) predEnv.simps(9) predEnv_substate substate_eq_or_predEnv toEnvPs2)\n apply(simp only: pred3_def)\n by ((rule VC2_R3_ind_step);fast) \nend\n\n\nlemma VC2_R3: \" (((((toEnvP s0 \\\n (\\s1 s2.\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT \\ toEnvNum s2 s0 \\ getVarBool s1 rotation = True \\ \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)))) \\\n extraInv s0) \\\n env (setVarAny s0 user_value pressure_value)) \\\n getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'motionless) \\\n getVarBool (setVarAny s0 user_value pressure_value) user) \\\n getVarBool (setVarAny s0 user_value pressure_value) pressure \\\n substate s1 s2 \\\n substate s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT\n \\ toEnvNum s2\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended)) \\\n getVarBool s1 rotation = True \\ \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4\n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"\n apply(rule impI)\n apply(rule disjE[of \"DELAY'TIMEOUT < toEnvNum s2 (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\"\n\"DELAY'TIMEOUT = toEnvNum s2 (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\"])\n using le_imp_less_or_eq apply fast\n apply(rule cut_rl[of \"substate s2 s0 \\ toEnvNum s2 s0 \\ DELAY'TIMEOUT\"])\n apply(rule cut_rl[of \"(\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"])\n apply (metis substate.simps(10) substate.simps(2) substate.simps(3) substate.simps(9))\n apply blast\n apply(simp split: if_splits)\n apply(rule cut_rl[of \"pred3 s1 s2 \n (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR\n Controller'suspended))\ns2\"])\n apply(simp only: pred3_def)\n apply (smt (z3) substate_asym)\n apply(rule mp[of \"toEnvP s2 \\ substate s2 s2 \\\n substate s2 (toEnv\n (setPstate (setVarBool (setVarAny s0 user_value pressure_value) brake True) ERROR Controller'suspended))\"])\n apply((rule VC2_R3_ind_proof);blast)\n using substate_refl by fast\n \n \n\ntheorem proof_3_2: \"VC2 inv3 env s0 user_value pressure_value\"\n apply(simp only: VC2_def inv3_def R3_def)\n apply(rule impI)\n apply(rule conjI)\n apply(rule conjI)\n apply(simp)\n apply((rule allI);(rule allI))\n apply((rule VC2_R3);blast)", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/revolvingDoor/Proof_3_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.2727202687294685}} {"text": "section {*FUNCTION\\_\\_DPDA\\_OTS\\_\\_DPDA\\_OBSERVE\\_TOP\\_STACK*}\ntheory\n FUNCTION__DPDA_OTS__DPDA_OBSERVE_TOP_STACK\n\nimports\n PRJ_13_02__ENTRY\n\nbegin\n\ndefinition F_DPDA_OTS__get_state :: \"\n ('state, 'stack) DT_state_and_stack_or_state\n \\ 'state\"\n where\n \"F_DPDA_OTS__get_state x \\\n case x of\n cons_state_and_stack a b \\ a\n | cons_state a \\ a\"\n\ndefinition F_DPDA_OTS__get_stack :: \"\n ('state, 'stack) DT_state_and_stack_or_state\n \\ 'stack option\"\n where\n \"F_DPDA_OTS__get_stack x \\\n case x of\n cons_state_and_stack a b \\ Some b\n | cons_state a \\ None\"\n\ndefinition F_DPDA_OTS__is_auxiliary :: \"\n ('state, 'stack) DT_state_and_stack_or_state\n \\ bool\"\n where\n \"F_DPDA_OTS__is_auxiliary x \\\n case x of\n cons_state_and_stack a b \\ True\n | cons_state a \\ False\"\n\ndefinition F_DPDA_OTS__is_main :: \"\n ('state, 'stack) DT_state_and_stack_or_state\n \\ bool\"\n where\n \"F_DPDA_OTS__is_main x \\\n case x of\n cons_state_and_stack a b \\ False\n | cons_state a \\ True\"\n\nlemma F_DPDA_OTS__preserves__PDA: \"\n valid_pda M\n \\ F_DPDA_OTS M = N\n \\ valid_pda N\"\n apply(simp add: F_DPDA_OTS_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__states_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def)\n apply(simp add: F_DPDA_OTS__states_main_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__edges_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def)\n apply(force)\n apply(rule conjI)\n apply(simp add: F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def)\n apply(force)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac a b)(*strict*)\n apply(force)\n apply(rename_tac a b)(*strict*)\n apply(simp add: option_to_set_def)\n apply(simp add: may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(case_tac \"b = epda_box M\")\n apply(rename_tac a b)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rename_tac a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(erule_tac\n x=\"xa\"\n and P=\"\\xa. edge_src xa \\ epda_states M \\ edge_trg xa \\ epda_states M \\ option_to_set (edge_event xa) \\ epda_events M \\ edge_pop xa \\ may_terminated_by (epda_gamma M) (epda_box M) \\ edge_push xa \\ may_terminated_by (epda_gamma M) (epda_box M) \\ (edge_pop xa \\ must_terminated_by (epda_gamma M) (epda_box M)) = (edge_push xa \\ must_terminated_by (epda_gamma M) (epda_box M))\"\n in ballE)\n apply(rename_tac xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rule inMap)\n apply(rule_tac\n x=\"((edge_src xa),(hd (edge_pop xa)))\"\n in bexI)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(clarsimp)\n apply(rename_tac xa a aa)(*strict*)\n apply(erule_tac\n x=\"xa\"\n in ballE)\n apply(rename_tac xa a aa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(case_tac \"edge_pop xa\")\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab list)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac a b)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__TSstructure :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2 \\\n valid_dpda G1\n \\ G2 = F_DPDA_OTS G1\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__configuration1 :: \"\n ('state, 'event, 'stack) epdaH_conf\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__configuration1 c \\\n \\epdaH_conf_state = cons_state_and_stack (epdaH_conf_state c) (hd (epdaH_conf_stack c)),\n epdaH_conf_history = epdaH_conf_history c,\n epdaH_conf_stack = epdaH_conf_stack c\\\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__configurations :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__configurations G1 G2 c1 c2 \\\n F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2\n \\ c1 \\ epdaH.get_accessible_configurations G1\n \\ c2 = F_DPDA_OTS__epdaH_epdaH__LR__configuration1 c1\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration G1 G2 c1 c2 \\\n F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2\n \\ c1 \\ epdaH_initial_configurations G1\n \\ c2 = F_DPDA_OTS__epdaH_epdaH__LR__configuration1 c1\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__effect :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__effect G1 G2 w1 w2 \\\n F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2\n \\ w1 = w2\"\n\nlemma F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2 \\ valid_epda G2)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G1)(*strict*)\n prefer 2\n apply(rule F_DPDA_OTS__preserves__PDA)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(rename_tac G1)(*strict*)\n apply(force)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_pda_def)\n done\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__step_simulation :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ ('state, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ ((('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda_step_label, (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__step_simulation G1 G2 c1 e c1' c2 d \\\n let\n ci = F_DPDA_OTS__epdaH_epdaH__LR__configuration1 c1'\n in\n d = der3\n c2\n (F_DPDA_OTS__edges_auxiliary_main_1 e)\n (ci\\epdaH_conf_state := cons_state (edge_trg e)\\)\n (F_DPDA_OTS__edges_main_auxiliary_1 (edge_trg e) (hd (epdaH_conf_stack ci)))\n ci\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation :: \"\n ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ ((('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda_step_label, (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation G1 G2 c1 d \\\n d = der1 (F_DPDA_OTS__epdaH_epdaH__LR__configuration1 c1)\"\n\nlemma F_DPDA_OTS__epdaH_epdaH__LR__inst__relation_initial_simulation: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2 \\ (\\c1. c1 \\ epdaH_initial_configurations G1 \\ (\\d2. epdaH.derivation_initial G2 d2 \\ F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_OTS__epdaH_epdaH__LR__configurations G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation_def F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation_def F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(simp add: F_DPDA_OTS__states_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(rule_tac\n x=\"der1 c1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(simp add: F_DPDA_OTS__states_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__LR__inst__relation_step_simulation: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__LR__TSstructure G1 G2 \\ (\\c1 c2. F_DPDA_OTS__epdaH_epdaH__LR__configurations G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaH_step_relation G1 c1 e1 c1' \\ (\\d2. epdaH.derivation G2 d2 \\ epdaH.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_OTS__epdaH_epdaH__LR__step_simulation G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_OTS__epdaH_epdaH__LR__configurations G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def Let_def F_DPDA_OTS__epdaH_epdaH__LR__step_simulation_def F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation_def F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule epdaH.der3_is_derivation)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply (metis F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp (no_asm) only: epdaH_step_relation_def F_DPDA_OTS__edges_auxiliary_main_1_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rule inMap)\n apply(rule_tac\n x=\"e1\"\n in bexI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def epda_step_labels_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def epda_step_labels_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp (no_asm) only: epdaH_step_relation_def F_DPDA_OTS__edges_auxiliary_main_1_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rule inMap)\n apply(rule_tac\n x=\"(edge_trg e1,hd (epdaH_conf_stack c1'))\"\n in bexI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def epda_step_labels_def epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n prefer 2\n apply(rule_tac\n c=\"c1\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(case_tac \"edge_push e1\")\n apply(rename_tac G1 c1 e1 c1' w a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(case_tac \"epdaH_conf_stack c1'\")\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(rename_tac G1 c1 e1 c1' a aa list)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' a aa list ab)(*strict*)\n apply(case_tac ab)\n apply(rename_tac G1 c1 e1 c1' a aa list ab)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' a aa list ab ac lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' aa list ac lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac G1 c1 e1 c1' aa list ac lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' aa list ac lista a listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a aa list)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a aa list ab ac ad)(*strict*)\n apply(erule_tac\n P=\"[] = ac \\ (\\a. set a \\ epda_gamma G1 - {epda_box G1} \\ aa # list = a @ [epda_box G1])\"\n in disjE)\n apply(rename_tac G1 c1 e1 c1' w a aa list ab ac ad)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad ae)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad ae)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad)(*strict*)\n apply(case_tac ad)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ad ae)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ae)(*strict*)\n apply(case_tac e1)\n apply(rename_tac G1 c1 e1 c1' w aa list ab ae edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a aa list ab ac ad)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w a aa list ab ad)(*strict*)\n apply(case_tac e1)\n apply(rename_tac G1 c1 e1 c1' w a aa list ab ad edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: option_to_list_def F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS_def F_DPDA_OTS__edges_def epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(case_tac \"edge_push e1 @ w\")\n apply(rename_tac G1 c1 e1 c1' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(case_tac \"edge_pop e1\")\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n prefer 2\n apply(rule_tac\n c=\"c1\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(simp add: valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in ballE)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 c1 e1 c1' a)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def may_terminated_by_def append_language_def append_alphabet_def kleene_star_def)\n apply(rename_tac G1 c1 e1 c1' w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule epdaH.der3_belongs)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply (metis F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G1\"\n and c=\"c1\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(subgoal_tac \"c1 \\ epdaH_configurations G1\")\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n prefer 2\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac G1 c1 e1 c1' d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 c1 e1 c1' d i a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac G1 c1 e1 c1' d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c1 e1 c1' d i option)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac G1 c1 e1 c1' d i option)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac G1 c1 e1 c1' d i option)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G1 c1 e1 c1' d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1' d i option)(*strict*)\n apply(force)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 e1 c1' q s h)(*strict*)\n apply(case_tac s)\n apply(rename_tac G1 e1 c1' q s h)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 e1 c1' q h)(*strict*)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(rename_tac G1 e1 c1' q s h a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 e1 c1' q h a list)(*strict*)\n apply(simp add: F_DPDA_OTS__states_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def)\n apply(force)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: der3_def get_configuration_def)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc(Suc 0)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule_tac der3_maximum_of_domain)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply (metis F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure1_belongs F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def epdaH.der2_is_derivation epdaH.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 c1 e1 c1')(*strict*)\n apply(simp add: der3_def get_configuration_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__LR__inst__ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaH_initial_configurations epda_step_labels epdaH_step_relation valid_epda epdaH_configurations epdaH_initial_configurations epda_step_labels epdaH_step_relation F_DPDA_OTS__epdaH_epdaH__LR__configurations F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration F_DPDA_OTS__epdaH_epdaH__LR__TSstructure F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation F_DPDA_OTS__epdaH_epdaH__LR__step_simulation\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def F_DPDA_OTS__epdaH_epdaH__LR__inst__relation_initial_simulation F_DPDA_OTS__epdaH_epdaH__LR__inst__relation_step_simulation F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure1_belongs F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"F_DPDA_OTS__epdaH_epdaH__LR\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaH_configurations\"\n (* initial_configurations1 *)\n \"epdaH_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaH_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaH_marking_condition\"\n (* marked_effect1 *)\n \"epdaH_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaH_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaH_configurations\"\n (* initial_configurations2 *)\n \"epdaH_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaH_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaH_marking_condition\"\n (* marked_effect2 *)\n \"epdaH_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaH_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__configurations\"\n (* relation_initial_configuration *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_configuration\"\n (* relation_effect *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__effect\"\n (* relation_TSstructure *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__TSstructure\"\n (* relation_initial_simulation *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_simulation\"\n (* relation_step_simulation *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__step_simulation\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__inst__ATS_Simulation_Configuration_Weak_axioms)\n done\n\ndefinition F_DPDA_OTS__epdaH_epdaH__RL__TSstructure :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2 \\\n valid_dpda G2\n \\ G1 = F_DPDA_OTS G2\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__configuration1R :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ ('state, 'event, 'stack) epdaH_conf\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c \\\n \\epdaH_conf_state = F_DPDA_OTS__get_state (epdaH_conf_state c),\n epdaH_conf_history = epdaH_conf_history c,\n epdaH_conf_stack = epdaH_conf_stack c\\\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__RL__configurations :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__RL__configurations G1 G2 c1 c2 \\\n F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2\n \\ c1 \\ epdaH.get_accessible_configurations G1\n \\ c2 = F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration G1 G2 c1 c2 \\\n F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2\n \\ c1 \\ epdaH_initial_configurations G1\n \\ c2 = F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__RL__effect :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__RL__effect G1 G2 w1 w2 \\\n F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2\n \\ w1 = w2\"\n\nlemma F_DPDA_OTS__epdaH_epdaH__RL__inst__AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rename_tac G2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G2)(*strict*)\n prefer 2\n apply(rule F_DPDA_OTS__preserves__PDA)\n apply(rename_tac G2)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(rename_tac G2)(*strict*)\n apply(force)\n apply(rename_tac G2)(*strict*)\n apply(simp add: valid_pda_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__RL__inst__AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2 \\ valid_epda G2)\"\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply (metis valid_dpda_def valid_pda_def)\n done\n\ndefinition F_DPDA_OTS__epdaH_epdaH__RL__edge :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__RL__edge e \\\n \\edge_src = F_DPDA_OTS__get_state (edge_src e),\n edge_event = edge_event e,\n edge_pop = edge_pop e,\n edge_push = edge_push e,\n edge_trg = F_DPDA_OTS__get_state (edge_trg e)\\\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda_step_label\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ ('state, 'event, 'stack) epdaH_conf\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL G1 G2 c1 e c1' c2 d \\\n case epdaH_conf_state c1 of\n cons_state_and_stack q X \\\n d = der2\n (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1)\n (F_DPDA_OTS__epdaH_epdaH__RL__edge e)\n (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1')\n | cons_state q \\\n d = der1 (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1)\"\n\ndefinition F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL :: \"\n (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL G1 G2 c1 d \\\n d = der1 (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1)\"\n\nlemma F_DPDA_OTS__epdaH_epdaH__RL__inst__relation_initial_simulationRL: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2 \\ (\\c1. c1 \\ epdaH_initial_configurations G1 \\ (\\d2. epdaH.derivation_initial G2 d2 \\ F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_OTS__epdaH_epdaH__RL__configurations G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL_def F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL_def F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS__states_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(rule_tac\n x=\"der1 c1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(simp add: F_DPDA_OTS__states_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n apply(simp add: F_DPDA_OTS__states_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__RL__inst__relation_step_simulationRL: \"\n (\\G1 G2. F_DPDA_OTS__epdaH_epdaH__RL__TSstructure G1 G2 \\ (\\c1 c2. F_DPDA_OTS__epdaH_epdaH__RL__configurations G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaH_step_relation G1 c1 e1 c1' \\ (\\d2. epdaH.derivation G2 d2 \\ epdaH.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_OTS__epdaH_epdaH__RL__configurations G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def Let_def F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL_def F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL_def F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration_def F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def epda_step_labels_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1')(*strict*)\n apply(subgoal_tac \"valid_epda (F_DPDA_OTS G2)\")\n apply(rename_tac G2 c1 e1 c1')(*strict*)\n prefer 2\n apply (metis F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rename_tac G2 c1 e1 c1')(*strict*)\n apply(case_tac \"epdaH_conf_state c1\")\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule epdaH.der2_is_derivation)\n apply(simp (no_asm) only: epdaH_step_relation_def F_DPDA_OTS__edges_auxiliary_main_1_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__epdaH_epdaH__RL__edge_def epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a b w)(*strict*)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' a b w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a b w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' a b w x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(case_tac x)\n apply(rename_tac G2 c1 c1' a b w x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__epdaH_epdaH__RL__edge_def epdaH_step_relation_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__epdaH_epdaH__RL__edge_def epdaH_step_relation_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule epdaH.der2_belongs_prime)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"F_DPDA_OTS G2\"\n and c=\"c1\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply (metis)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(subgoal_tac \"c1 \\ epdaH_configurations (F_DPDA_OTS G2)\")\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n prefer 2\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a b d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac G2 c1 e1 c1' a b d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' a b d i aa)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac aa)\n apply(rename_tac G2 c1 e1 c1' a b d i aa option ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a b d i option)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac G2 c1 e1 c1' a b d i option)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac G2 c1 e1 c1' a b d i option)(*strict*)\n apply (metis)\n apply(rename_tac G2 c1 e1 c1' a b d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_main_def)\n apply(clarsimp)\n apply(rename_tac G2 e1 c1' a b s h)(*strict*)\n apply(erule disjE)\n apply(rename_tac G2 e1 c1' a b s h)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 e1 c1' a b s h)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule_tac der2_maximum_of_domain)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply (metis epdaH.der2_is_derivation epdaH.der2_preserves_get_accessible_configurations)\n apply(rename_tac G2 c1 e1 c1' a b)(*strict*)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule epdaH.der1_is_derivation)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule epdaH.der1_belongs)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"F_DPDA_OTS G2\"\n and c=\"c1\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply (metis)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(subgoal_tac \"c1 \\ epdaH_configurations (F_DPDA_OTS G2)\")\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n prefer 2\n apply(simp add: epdaH.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac G2 c1 e1 c1' a d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' a d i aa)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac aa)\n apply(rename_tac G2 c1 e1 c1' a d i aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a d i option)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac G2 c1 e1 c1' a d i option)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac G2 c1 e1 c1' a d i option)(*strict*)\n apply (metis)\n apply(rename_tac G2 c1 e1 c1' a d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a d i option)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_main_def)\n apply(clarsimp)\n apply(rename_tac G2 e1 c1' a s h)(*strict*)\n apply(erule disjE)\n apply(rename_tac G2 e1 c1' a s h)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 e1 c1' a s h)(*strict*)\n apply(force)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule_tac der1_maximum_of_domain)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply (metis epdaH.der2_is_derivation epdaH.der2_preserves_get_accessible_configurations)\n apply(rename_tac G2 c1 e1 c1' a)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def epdaH_step_relation_def F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' a w)(*strict*)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' a w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' w aa b)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def option_to_list_def)\n apply(rename_tac G2 c1 e1 c1' a w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' a w x)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def option_to_list_def)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\nlemma F_DPDA_OTS__epdaH_epdaH__RL__inst__ATS_Simulation_Configuration_WeakRL_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaH_initial_configurations epda_step_labels epdaH_step_relation valid_epda epdaH_configurations epdaH_initial_configurations epda_step_labels epdaH_step_relation F_DPDA_OTS__epdaH_epdaH__RL__configurations F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration F_DPDA_OTS__epdaH_epdaH__RL__TSstructure F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def F_DPDA_OTS__epdaH_epdaH__RL__inst__relation_initial_simulationRL F_DPDA_OTS__epdaH_epdaH__RL__inst__relation_step_simulationRL F_DPDA_OTS__epdaH_epdaH__RL__inst__AX_TSstructure_relation_TSstructure1_belongs F_DPDA_OTS__epdaH_epdaH__RL__inst__AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"F_DPDA_OTS__epdaH_epdaH__RL\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaH_configurations\"\n (* initial_configurations1 *)\n \"epdaH_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaH_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaH_marking_condition\"\n (* marked_effect1 *)\n \"epdaH_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaH_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaH_configurations\"\n (* initial_configurations2 *)\n \"epdaH_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaH_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaH_marking_condition\"\n (* marked_effect2 *)\n \"epdaH_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaH_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_OTS__epdaH_epdaH__RL__configurations\"\n (* relation_initial_configuration *)\n \"F_DPDA_OTS__epdaH_epdaH__RL__initial_configuration\"\n (* relation_effect *)\n \"F_DPDA_OTS__epdaH_epdaH__RL__effect\"\n (* relation_TSstructure *)\n \"F_DPDA_OTS__epdaH_epdaH__RL__TSstructure\"\n (* relation_initial_simulationRL *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__initial_simulationRL\"\n (* relation_step_simulationRL *)\n \"F_DPDA_OTS__epdaH_epdaH__LR__step_simulationRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__inst__ATS_Simulation_Configuration_WeakRL_axioms)\n done\n\nlemma F_DPDA_OTS__preserves__determinism: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ valid_pda R\n \\ epdaS.is_forward_edge_deterministic_accessible R\"\n apply(subgoal_tac \"epdaH.is_forward_edge_deterministicHist_DB_long M\")\n prefer 2\n apply(rule DPDA_to_epdaH_determinism)\n apply(force)\n apply(subgoal_tac \"epdaH.is_forward_edge_deterministicHist_DB_long R\")\n apply (metis epda_epdaS_is_forward_edge_deterministic_accessible_equal_to_epdaH_is_forward_edge_deterministicHist_DB_long valid_pda_to_valid_epda)\n apply(clarsimp)\n apply(simp add: epdaH.is_forward_edge_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 option)(*strict*)\n apply(rename_tac e)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(erule_tac\n x=\"F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"M\"\n and ?G1.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"n\"\n in F_DPDA_OTS__epdaH_epdaH__RL.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n2\"\n in epdaH.some_position_has_details_before_max_dom)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e d2 n2 ea ca)(*strict*)\n apply(simp add: get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e)(*strict*)\n apply(case_tac \"epdaH_conf_state c\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n prefer 2\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a)(*strict*)\n apply(thin_tac \"\\c1 c2 e1 e2. (\\w1. w1 \\ epda_effects M \\ (\\w2. w2 \\ epda_effects M \\ epdaH_step_relation M (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c) e1 c1 \\ epdaH_step_relation M (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c) e2 c2 \\ epdaH_conf_history c1 = epdaH_conf_history (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c) @ w1 \\ epdaH_conf_history c2 = epdaH_conf_history (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c) @ w2 \\ (ATS_History.history_fragment_prefixes epda_effects (@) M w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) M w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) M w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) M w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) M w2 = ATS_History.history_fragment_prefixes epda_effects (@) M w1))) \\ e1 = e2\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a)(*strict*)\n apply(thin_tac \"ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 = ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule_tac\n P=\"e1 \\ F_DPDA_OTS__edges_main_auxiliary M\"\n in disjE)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e2 n e a w wa x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e2 n e a w wa x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a w wa x edge_eventa edge_popa edge_pusha)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d c1 c2 n e a w wa x edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a w wa aa b x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa)(*strict*)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e1 e2 n e a w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 n e a w wa edge_eventa edge_popa edge_pusha)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d c1 c2 e1 n e a w wa edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d c1 c2 e1 n e a w wa edge_eventa edge_popa edge_pusha epdaH_conf_historya)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(erule_tac\n x=\"F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c1\"\n in allE)\n apply(erule_tac\n x=\"F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c2\"\n in allE)\n apply(erule_tac\n x=\"F_DPDA_OTS__epdaH_epdaH__RL__edge e1\"\n in allE)\n apply(erule_tac\n x=\"F_DPDA_OTS__epdaH_epdaH__RL__edge e2\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__edge_def)\n apply(clarsimp)\n apply(case_tac e1)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n w1 w2 e a b edge_src edge_trg edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule_tac\n P=\"\\edge_src = epdaH_conf_state c, edge_event = edge_eventa, edge_pop = edge_popa, edge_push = edge_pusha, edge_trg = epdaH_conf_state c1\\ \\ F_DPDA_OTS__edges_main_auxiliary M\"\n in disjE)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w)(*strict*)\n apply(erule disjE)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b edge_eventa edge_popa edge_pusha w x xa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e w x xa)(*strict*)\n apply(case_tac c1)\n apply(rename_tac c d c1 c2 n e w x xa epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c d c1 c2 n e w x xa epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n e w x xa)(*strict*)\n apply(case_tac x)\n apply(rename_tac c d n e w x xa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac xa)\n apply(rename_tac c d n e w x xa edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n e w edge_trg edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d n e w edge_trg edge_srca edge_eventa edge_popa edge_pusha edge_trga epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n e w edge_trg edge_srca edge_eventa edge_popa edge_pusha edge_trga epdaH_conf_history)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule_tac\n x=\"w1\"\n in exI)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: F_DPDA_OTS_def epda_effects_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule_tac\n x=\"w2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: F_DPDA_OTS_def epda_effects_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(thin_tac \"ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 = ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: epdaH_step_relation_def F_DPDA_OTS__epdaH_epdaH__RL__edge_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(erule_tac\n P=\"e1 \\ F_DPDA_OTS__edges_main_auxiliary M\"\n in disjE)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e2 n e a b w wa aa ba)(*strict*)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e2 n e a b w wa aa ba edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b w wa aa ba edge_event edge_pop edge_push)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(case_tac c1)\n apply(rename_tac c d c1 c2 n e a b w wa aa ba edge_event edge_pop edge_push epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c2 n e a b w wa aa ba edge_event edge_pop edge_push)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c d c2 n e a b w wa aa ba edge_event edge_pop edge_push epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n e a b w wa aa ba edge_event edge_pop edge_push epdaH_conf_statea)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d n e a b w wa aa ba edge_event edge_pop edge_push epdaH_conf_statea epdaH_conf_stateaa epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e2 n e a b w wa x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e2 n e a b w wa x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 n e a b w wa x edge_eventa edge_popa edge_pusha)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(case_tac c1)\n apply(rename_tac c d c1 c2 n e a b w wa x edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c2 n e a b w wa x edge_eventa edge_popa edge_pusha)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c d c2 n e a b w wa x edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n e a b w wa x edge_eventa edge_popa edge_pusha epdaH_conf_statea)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d n e a b w wa x edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_stateaa epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n e w wa x edge_eventa edge_popa edge_pusha epdaH_conf_state epdaH_conf_history)(*strict*)\n apply(case_tac x)\n apply(rename_tac d n e w wa x edge_eventa edge_popa edge_pusha epdaH_conf_state epdaH_conf_history edge_srca edge_eventaa edge_popaa edge_pushaa edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule conjI)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(thin_tac \"ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1 \\ ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2 = ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: epdaH_step_relation_def F_DPDA_OTS__epdaH_epdaH__RL__edge_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(erule_tac\n P=\"e2 \\ F_DPDA_OTS__edges_main_auxiliary M\"\n in disjE)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa)(*strict*)\n apply(case_tac e2)\n apply(rename_tac c d c1 c2 e1 e2 n e a b w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 n e a b w wa edge_eventa edge_popa edge_pusha)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def)\n apply(case_tac c1)\n apply(rename_tac c d c1 c2 e1 n e a b w wa edge_eventa edge_popa edge_pusha epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c2 e1 n e a b w wa edge_event edge_popa edge_push)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c d c2 e1 n e a b w wa edge_event edge_popa edge_push epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d e1 n e a b w wa edge_event edge_popa edge_push epdaH_conf_statea)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d e1 n e a b w wa edge_event edge_popa edge_push epdaH_conf_statea epdaH_conf_stateaa epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e1 n e a b w wa edge_event edge_popa edge_push epdaH_conf_state epdaH_conf_history)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac d e1 n e a b w wa edge_event edge_popa edge_push epdaH_conf_state epdaH_conf_history x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac d e1 n e a b w wa edge_eventa edge_popa edge_pusha epdaH_conf_state epdaH_conf_history x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e1 n e w wa epdaH_conf_history x)(*strict*)\n apply(case_tac x)\n apply(rename_tac d e1 n e w wa epdaH_conf_history x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(subgoal_tac \"epda_effects M = epda_effects (F_DPDA_OTS M)\")\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n prefer 2\n apply(rule antisym)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b x)(*strict*)\n apply(simp add: epda_effects_def F_DPDA_OTS_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp add: epda_effects_def F_DPDA_OTS_def)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule_tac\n t=\"ATS_History.history_fragment_prefixes epda_effects (@) M w1\"\n and s=\"ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w1\"\n in ssubst)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp (no_asm) add: epdaH.history_fragment_prefixes_def)\n apply(rule antisym)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(rule_tac\n t=\"ATS_History.history_fragment_prefixes epda_effects (@) M w2\"\n and s=\"ATS_History.history_fragment_prefixes epda_effects (@) (F_DPDA_OTS M) w2\"\n in ssubst)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(simp (no_asm) add: epdaH.history_fragment_prefixes_def)\n apply(rule antisym)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 n w1 w2 e a b)(*strict*)\n apply(force)\n done\n\ntheorem F_DPDA_OTS__preserves__DPDA: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ valid_dpda R\"\n apply(simp (no_asm) add: valid_dpda_def)\n apply(rule context_conjI)\n apply(rule F_DPDA_OTS__preserves__PDA)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(force)\n apply(rule F_DPDA_OTS__preserves__determinism)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_OTS__reflects__unmarked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.unmarked_language R \\ epdaH.unmarked_language M\"\n apply(rule subsetI)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(thin_tac \"epdaH.derivation (F_DPDA_OTS M) d\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(case_tac c)\n apply(rename_tac d i e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac d i e q h s)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"M\"\n and ?G1.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"i\"\n in F_DPDA_OTS__epdaH_epdaH__RL.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac d i e q h s)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n2\"\n in epdaH.some_position_has_details_before_max_dom)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n done\n\nlemma F_DPDA_OTS__preserves__unmarked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.unmarked_language M \\ epdaH.unmarked_language R\"\n apply(rule subsetI)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(thin_tac \"epdaH.derivation M d\")\n apply(simp add: epdaH_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(case_tac c)\n apply(rename_tac d i e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac d i e q h s)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s)(*strict*)\n prefer 2\n apply(rule_tac\n ?G1.0=\"M\"\n and ?G2.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"i\"\n in F_DPDA_OTS__epdaH_epdaH__LR.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac d i e q h s)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n2\"\n in epdaH.some_position_has_details_before_max_dom)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n done\n\ntheorem F_DPDA_OTS__equal__unmarked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.unmarked_language R = epdaH.unmarked_language M\"\n apply(rule order_antisym)\n apply(rule F_DPDA_OTS__reflects__unmarked_language)\n apply(force)\n apply(force)\n apply(rule F_DPDA_OTS__preserves__unmarked_language)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_OTS__reflects__marked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.marked_language R \\ epdaH.marked_language M\"\n apply(rule subsetI)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.marked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(thin_tac \"epdaH.derivation (F_DPDA_OTS M) d\")\n apply(subgoal_tac \"(\\d. epdaH.derivation_initial M d \\ x \\ epdaH_marked_effect M d)\")\n apply(rename_tac x d)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d da)(*strict*)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def)\n apply(simp add: epdaH_marking_condition_def epdaH_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac d da i ia ib e ea eb c ca cb)(*strict*)\n apply(rule_tac\n x=\"ib\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(thin_tac \"epdaH_marking_condition (F_DPDA_OTS M) d\")\n apply(simp add: epdaH_marked_effect_def epdaH_marking_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(thin_tac \"\\j e' c'. i < j \\ d j = Some (pair e' c') \\ epdaH_string_state c = epdaH_string_state c'\")\n apply(rename_tac d i e c)(*strict*)\n apply(thin_tac \"c \\ epdaH_configurations (F_DPDA_OTS M)\")\n apply(case_tac c)\n apply(rename_tac d i e c epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e epdaH_conf_statea epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac d i e q h s)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"M\"\n and ?G1.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"i\"\n in F_DPDA_OTS__epdaH_epdaH__RL.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac d i e q h s)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule_tac\n x=\"derivation_take d2 n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n2\"\n in epdaH.some_position_has_details_before_max_dom)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s d2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(rule_tac\n x=\"ea\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: derivation_take_def F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: derivation_take_def F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__get_state_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def F_DPDA_OTS_def F_DPDA_OTS__marking_states_def)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(force)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__get_state_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def F_DPDA_OTS_def F_DPDA_OTS__marking_states_def)\n apply(rename_tac d i e q h s d2 n2 ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q h s d2 n2 ea c j e' c')(*strict*)\n apply(simp add: derivation_take_def F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n done\n\nlemma F_DPDA_OTS__preserves__marked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.marked_language M \\ epdaH.marked_language R\"\n apply(rule subsetI)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.marked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(thin_tac \"epdaH.derivation M d\")\n apply(thin_tac \"epdaH_marking_condition M d\")\n apply(subgoal_tac \"\\d. epdaH.derivation_initial (F_DPDA_OTS M) d \\ x \\ epdaH_marked_effect (F_DPDA_OTS M) d\")\n apply(rename_tac x d)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d da)(*strict*)\n apply(rule_tac\n x=\"da\"\n in exI)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def)\n apply(simp add: epdaH_marked_effect_def epdaH_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac d da i ia e ea c ca)(*strict*)\n apply(rule_tac\n x=\"ia\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaH_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac d i e c)(*strict*)\n apply(case_tac c)\n apply(rename_tac d i e c epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e epdaH_conf_state epdaH_conf_historya epdaH_conf_stack)(*strict*)\n apply(rename_tac q s h)\n apply(rename_tac d i e q s h)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q s h)(*strict*)\n prefer 2\n apply(rule_tac\n ?G1.0=\"M\"\n and ?G2.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"i\"\n in F_DPDA_OTS__epdaH_epdaH__LR.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac d i e q s h)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__TSstructure_def)\n apply(rename_tac d i e q s h)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(rule_tac\n x=\"derivation_take d2 n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(rule epdaH.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"n2\"\n in epdaH.some_position_has_details_before_max_dom)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h d2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(rule_tac\n x=\"ea\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(rule conjI)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n prefer 2\n apply(rule conjI)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def F_DPDA_OTS__marking_states_def derivation_take_def epdaH_marking_configurations_def F_DPDA_OTS_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q s h d2 n2 ea c j e' c')(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def F_DPDA_OTS__marking_states_def derivation_take_def epdaH_marking_configurations_def F_DPDA_OTS_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(simp add: epdaH_marking_configurations_def)\n apply(rule conjI)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n prefer 2\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply (metis F_DPDA_OTS__epdaH_epdaH__LR__inst__AX_TSstructure_relation_TSstructure2_belongs F_DPDA_OTS__epdaH_epdaH__LR__configurations_def)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h d2 n2 ea c)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configurations_def F_DPDA_OTS__marking_states_def derivation_take_def epdaH_marking_configurations_def F_DPDA_OTS_def get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def)\n apply(clarsimp)\n apply(rename_tac d i e q s h d2 n2 ea)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d i e q s h d2 n2 ea)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"M\"\n in epdaH_epda_stack_is_must_terminated_by)\n apply(rename_tac d i e q s h d2 n2 ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d i e q s h d2 n2 ea)(*strict*)\n apply(force)\n apply(rename_tac d i e q s h d2 n2 ea)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac d i e q s d2 n2 ea a)(*strict*)\n apply(rule inMap)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i e q s d2 n2 ea a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i e q s d2 n2 ea)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d i e q s d2 n2 ea a aa list)(*strict*)\n apply(clarsimp)\n done\n\ntheorem F_DPDA_OTS__equal__marked_language: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.marked_language R = epdaH.marked_language M\"\n apply(rule order_antisym)\n apply(rule F_DPDA_OTS__reflects__marked_language)\n apply(force)\n apply(force)\n apply(rule F_DPDA_OTS__preserves__marked_language)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_OTS__topstack_equal_to_annotation: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ epdaH.derivation_initial R d\n \\ d n = Some (pair e c)\n \\ epdaH_conf_state c = cons_state_and_stack q X\n \\ \\w. epdaH_conf_stack c = X # w\"\n apply(case_tac n)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS_def)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"F_DPDA_OTS M\"\n and d=\"d\"\n and n=\"n\"\n and m=\"Suc n\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 e2 c1)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(clarsimp)\n apply(rename_tac n e1 e2 c1 w)(*strict*)\n apply(case_tac c1)\n apply(rename_tac n e1 e2 c1 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c)\n apply(rename_tac n e1 e2 c1 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 e2 w epdaH_conf_history)(*strict*)\n apply(case_tac e2)\n apply(rename_tac n e1 e2 w epdaH_conf_history edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 w epdaH_conf_history edge_src edge_event edge_pop edge_push)(*strict*)\n apply(rename_tac h src read pop push)\n apply(rename_tac n e1 w h src read pop push)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule disjE)\n apply(rename_tac n e1 w h src read pop push)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1 w h src read pop push)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1 w h src read pop push x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_def valid_epda_step_label_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\ndefinition corresponds_to_top_stack :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ ('state \\ 'stack option)\n \\ bool\"\n where\n \"corresponds_to_top_stack M valid f \\\n \\d n c X.\n epdaH.derivation_initial M d\n \\ get_configuration (d n) = Some c\n \\ valid (epdaH_conf_state c)\n \\ f (epdaH_conf_state c) = Some X\n \\ (\\w. epdaH_conf_stack c = X # w)\"\n\ntheorem F_DPDA_OTS__enforces__corresponds_to_top_stack: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ corresponds_to_top_stack R F_DPDA_OTS__is_auxiliary F_DPDA_OTS__get_stack\"\n apply(simp add: corresponds_to_top_stack_def)\n apply(clarsimp)\n apply(rename_tac d n c X)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac d n c X)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c X a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac a)\n apply(rename_tac d n c X a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c X option)(*strict*)\n apply(simp add: F_DPDA_OTS__is_auxiliary_def F_DPDA_OTS__get_stack_def)\n apply(case_tac c)\n apply(rename_tac d n c X option epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n X option epdaH_conf_state epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(rename_tac e q h s)\n apply(rename_tac d n X e q h s)(*strict*)\n apply(case_tac q)\n apply(rename_tac d n X e q h s a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d n X e h s a)(*strict*)\n prefer 2\n apply(rule F_DPDA_OTS__topstack_equal_to_annotation)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(force)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(force)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(force)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(force)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(force)\n apply(rename_tac d n X e h s a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n X e q h s a)(*strict*)\n apply(case_tac q)\n apply(rename_tac d n X e q h s a aa b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n X e q h s a aa)(*strict*)\n apply(clarsimp)\n done\n\ndefinition state_stack_unique :: \"\n ('state, 'event, 'stack) epda\n \\ 'state set\n \\ bool\"\n where\n \"state_stack_unique G Q \\\n \\d1 d2 e1 e2 c1 c2 n1 n2.\n epdaH.derivation_initial G d1\n \\ epdaH.derivation_initial G d2\n \\ d1 n1 = Some (pair e1 c1)\n \\ d2 n2 = Some (pair e2 c2)\n \\ epdaH_conf_state c1 = epdaH_conf_state c2\n \\ epdaH_conf_state c1 \\ Q\n \\ hd (epdaH_conf_stack c1) = hd (epdaH_conf_stack c2)\"\n\nlemma F_DPDA_OTS__state_stack_unique_for_annotated_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ state_stack_unique R (F_DPDA_OTS__states_auxiliary M)\"\n apply(simp add: state_stack_unique_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2)(*strict*)\n apply(case_tac c1)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2 epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(case_tac c2)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2 epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historya epdaH_conf_stackaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 d2 e1 e2 n1 n2 epdaH_conf_history epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(rename_tac h1 s1 q h2 s2)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 q h2 s2)(*strict*)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n in F_DPDA_OTS__topstack_equal_to_annotation)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"n2\"\n in F_DPDA_OTS__topstack_equal_to_annotation)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n apply(rename_tac d1 d2 e1 e2 n1 n2 h1 s1 h2 s2 a b)(*strict*)\n apply(force)\n done\n\ndefinition always_applicable :: \"\n ('state, 'event, 'stack) epda\n \\ 'state set\n \\ bool\"\n where\n \"always_applicable G Q \\\n \\d e c n.\n epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ epdaH_conf_state c \\ Q\n \\ (\\e \\ epda_delta G.\n edge_src e = epdaH_conf_state c\n \\ (\\c'. epdaH_step_relation G c e c'))\"\n\nlemma F_DPDA_OTS__always_applicable_for_annotated_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ always_applicable R (F_DPDA_OTS__states_auxiliary M)\"\n apply(simp add: always_applicable_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac d e c n a b ea)(*strict*)\n apply(erule disjE)\n apply(rename_tac d e c n a b ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e c n a b ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e c n a b x)(*strict*)\n apply(simp add: always_applicable_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac d e c n x)(*strict*)\n apply(case_tac c)\n apply(rename_tac d e c n x epdaH_conf_statea epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in F_DPDA_OTS__topstack_equal_to_annotation)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(force)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(force)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(simp add: always_applicable_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(force)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(force)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stacka)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d e n x epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n x epdaH_conf_history w)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac d e n x epdaH_conf_history w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d e n x epdaH_conf_history w)(*strict*)\n apply(case_tac \"x\")\n apply(rename_tac d e n x epdaH_conf_history w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(case_tac edge_pop)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_pop edge_push edge_trg a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_push edge_trg a)(*strict*)\n apply(rule_tac\n x=\"\\epdaH_conf_state = cons_state edge_trg, epdaH_conf_history = epdaH_conf_history@option_to_list edge_event, epdaH_conf_stack = edge_push@w\\\"\n in exI)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_push edge_trg a)(*strict*)\n apply(simp add: epdaH_step_relation_def)\n apply(rule disjI2)\n apply(rule inMap)\n apply(rule_tac\n x=\"\\edge_src = edge_src, edge_event = edge_event, edge_pop = [a], edge_push = edge_push, edge_trg = edge_trg\\\"\n in bexI)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_push edge_trg a)(*strict*)\n apply(simp add: always_applicable_def F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS_def F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac d e n epdaH_conf_history w edge_src edge_event edge_push edge_trg a)(*strict*)\n apply(clarsimp)\n done\n\ndefinition always_applicable_for_auxiliary_states :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ bool\"\n where\n \"always_applicable_for_auxiliary_states G F \\\n always_applicable G (Collect F)\"\n\ntheorem F_DPDA_OTS__enforces__always_applicable_for_auxiliary_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ always_applicable_for_auxiliary_states R F_DPDA_OTS__is_auxiliary\"\n apply(subgoal_tac \"valid_pda R\")\n apply(simp add: always_applicable_for_auxiliary_states_def)\n apply(subgoal_tac \"always_applicable R (F_DPDA_OTS__states_auxiliary M)\")\n prefer 2\n apply(rule F_DPDA_OTS__always_applicable_for_annotated_states)\n apply(force)\n apply(force)\n apply(simp add: always_applicable_def)\n apply(clarsimp)\n apply(rename_tac d e c n ea)(*strict*)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(erule impE)\n apply(rename_tac d e c n ea)(*strict*)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d e c n ea)(*strict*)\n apply(erule impE)\n apply(rename_tac d e c n ea)(*strict*)\n apply(case_tac c)\n apply(rename_tac d e c n ea epdaH_conf_statea epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n ea epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(simp add: F_DPDA_OTS__is_auxiliary_def)\n apply(case_tac ea)\n apply(rename_tac d e n ea epdaH_conf_history epdaH_conf_stack edge_srca edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(case_tac edge_srca)\n apply(rename_tac d e n ea epdaH_conf_history epdaH_conf_stack edge_srca edge_event edge_pop edge_push edge_trg a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n epdaH_conf_history epdaH_conf_stack edge_event edge_pop edge_push edge_trg a b)(*strict*)\n apply(simp add: valid_pda_def valid_epda_def)\n apply(rename_tac d e n epdaH_conf_history epdaH_conf_stack edge_event edge_popa edge_push edge_trg a b)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\edge_src = cons_state_and_stack a b, edge_event = edge_event, edge_pop = edge_popa, edge_push = edge_push, edge_trg = edge_trg\\\"\n and P=\"\\a. valid_epda_step_label (F_DPDA_OTS M) a\"\n in ballE)\n apply(rename_tac d e n epdaH_conf_history epdaH_conf_stack edge_event edge_popa edge_push edge_trg a b)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__states_def F_DPDA_OTS__states_main_def)\n apply(clarsimp)\n apply(rename_tac d e n epdaH_conf_history epdaH_conf_stack edge_event edge_popa edge_push edge_trg a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n ea epdaH_conf_history epdaH_conf_stack edge_srca edge_event edge_pop edge_push edge_trg a)(*strict*)\n apply(force)\n apply(rename_tac d e c n ea)(*strict*)\n apply(erule_tac\n x=\"ea\"\n in ballE)\n apply(rename_tac d e c n ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e c n ea)(*strict*)\n apply(force)\n apply (metis F_DPDA_OTS__preserves__DPDA valid_dpda_to_valid_pda)\n done\n\ndefinition some_edge_applicable :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"some_edge_applicable G \\\n \\d e e' c n.\n epdaH.derivation_initial G d\n \\ d n = Some (pair e c)\n \\ e' \\ epda_delta G\n \\ edge_src e' = epdaH_conf_state c\n \\ (\\e c'.\n epdaH_step_relation G c e c'\n \\ (edge_event e' = None \\ edge_event e = None))\"\n\ntheorem F_DPDA_OTS__enforces__some_edge_applicable: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ valid_dpda R\n \\ some_edge_applicable R\"\n apply(subgoal_tac \"always_applicable R (F_DPDA_OTS__states_auxiliary M)\")\n prefer 2\n apply(rule F_DPDA_OTS__always_applicable_for_annotated_states)\n apply(force)\n apply(force)\n apply(simp add: some_edge_applicable_def)\n apply(clarsimp)\n apply(rename_tac d e e' c n)(*strict*)\n apply(case_tac c)\n apply(rename_tac d e e' c n epdaH_conf_statea epdaH_conf_history epdaH_conf_stack)(*strict*)\n apply(rename_tac q h s)\n apply(rename_tac d e e' c n q h s)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d e e' c n q h s)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"F_DPDA_OTS M\"\n and d=\"d\"\n and n=\"n\"\n in epdaH_epda_box_stays_at_bottom)\n apply(rename_tac d e e' c n q h s)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d e e' c n q h s)(*strict*)\n apply(force)\n apply(rename_tac d e e' c n q h s)(*strict*)\n apply(force)\n apply(rename_tac d e e' c n q h s)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e e' n h s)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(subgoal_tac \"\\epdaH_conf_state = edge_src e', epdaH_conf_history = h, epdaH_conf_stack = c @ [epda_box (F_DPDA_OTS M)]\\ \\ epdaH_configurations (F_DPDA_OTS M)\")\n apply(rename_tac d e e' n h c)(*strict*)\n prefer 2\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(force)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(force)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(subgoal_tac \"e' \\ F_DPDA_OTS__edges_main_auxiliary M \\ e' \\ F_DPDA_OTS__edges_auxiliary_main M\")\n apply(rename_tac d e e' n h c)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(erule disjE)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac d e n h c a b)(*strict*)\n apply(rule_tac\n x=\"\\edge_src=cons_state a,edge_event=None,edge_pop=[hd(c @ [epda_box M])],edge_push=[hd(c @ [epda_box M])],edge_trg=cons_state_and_stack a (hd(c @ [epda_box M]))\\\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"\\epdaH_conf_state = cons_state_and_stack a (hd(c @ [epda_box M])), epdaH_conf_history = h, epdaH_conf_stack = c @ [epda_box M]\\\"\n in exI)\n apply(simp add: epdaH_step_relation_def)\n apply(rule conjI)\n apply(rename_tac d e n h c a b)(*strict*)\n apply(rule disjI1)\n apply(rule inMap)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac d e n h c a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h a b)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d e n h c a b aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h a b aa list)(*strict*)\n apply(simp add: epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac d e n h c a b)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac c)\n apply(rename_tac d e n h c a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h c a b aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e e' n h c)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def always_applicable_def)\n apply(clarsimp)\n apply(rename_tac d e n h c x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def always_applicable_def)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(erule_tac\n x=\"\\epdaH_conf_state = cons_state_and_stack (edge_src x) (hd (edge_pop x)), epdaH_conf_history = h, epdaH_conf_stack = c @ [epda_box (F_DPDA_OTS M)]\\\"\n in allE)\n apply(rename_tac d e n h c x)(*strict*)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac d e n h c x)(*strict*)\n apply(force)\n apply(rename_tac d e n h c x)(*strict*)\n apply(erule impE)\n apply(rename_tac d e n h c x)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(simp add: epdaH_configurations_def F_DPDA_OTS__states_auxiliary_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__states_def)\n apply(simp add: epdaH_configurations_def F_DPDA_OTS__states_auxiliary_def)\n apply(clarsimp)\n apply(rule inMap)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label M x\"\n in ballE)\n apply(rename_tac d e n h c x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d e n h c x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac d e n h c x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d e n h c x)(*strict*)\n apply(case_tac \"x\")\n apply(rename_tac d e n h c x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h c edge_src edge_event edge_popa edge_push edge_trg)(*strict*)\n apply(case_tac edge_popa)\n apply(rename_tac d e n h c edge_src edge_event edge_popa edge_push edge_trg)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h c edge_src edge_event edge_popa edge_push edge_trg a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h c edge_src edge_event edge_push edge_trg a)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a)(*strict*)\n apply(clarsimp)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(erule disjE)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(clarsimp)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(erule disjE)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(clarsimp)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(erule disjE)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(clarsimp)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(erule disjE)+\n apply(rename_tac d e n h c edge_srca edge_eventa edge_pusha edge_trga a aa ab)(*strict*)\n apply(clarsimp)+\n apply(rename_tac d e n h c x)(*strict*)\n apply(erule_tac\n x=\"\\edge_src = cons_state_and_stack (edge_src x) (hd (edge_pop x)), edge_event = edge_event x, edge_pop = edge_pop x, edge_push = edge_push x, edge_trg = cons_state (edge_trg x)\\\"\n in ballE)\n apply(rename_tac d e n h c x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d e n h c x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d e n h c x xa)(*strict*)\n apply(rule_tac\n x=\"\\edge_src = cons_state_and_stack (edge_src x) (hd (edge_pop x)), edge_event = edge_event x, edge_pop = edge_pop x, edge_push = edge_push x, edge_trg = cons_state (edge_trg x)\\\"\n in exI)\n apply(rename_tac d e n h c x xa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"xa\"\n in exI)\n apply(clarsimp)\n done\n\ndefinition always_applicable_for_stable_states :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"always_applicable_for_stable_states G \\\n always_applicable G (epda_states G - epda_nonstable_states (epda_delta G))\"\n\nlemma always_applicable__subseteq: \"\n valid_dpda M\n \\ Q' \\ Q\n \\ always_applicable R Q\n \\ always_applicable R Q'\"\n apply(simp add: always_applicable_def)\n apply(clarsimp)\n apply(rename_tac d e c n ea)(*strict*)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e\"\n in allE)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(erule impE)\n apply(rename_tac d e c n ea)(*strict*)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d e c n ea)(*strict*)\n apply(erule impE)\n apply(rename_tac d e c n ea)(*strict*)\n apply(force)\n apply(rename_tac d e c n ea)(*strict*)\n apply(clarsimp)\n done\n\ntheorem F_DPDA_OTS__enforces__always_applicable_for_stable_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ always_applicable_for_stable_states R\"\n apply(simp add: always_applicable_for_stable_states_def)\n apply(rule always_applicable__subseteq)\n apply(force)\n prefer 2\n apply(rule F_DPDA_OTS__always_applicable_for_annotated_states)\n apply(force)\n apply(force)\n apply(simp add: epda_nonstable_states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__states_def F_DPDA_OTS_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"cons_state xa \\ (\\(x, y). cons_state_and_stack x y) ` (epda_states M \\ epda_gamma M)\")\n apply(simp add: F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rule_tac\n x=\"\\edge_src=cons_state xa,edge_event=None,edge_pop=[epda_box M],edge_push=[epda_box M],edge_trg=cons_state_and_stack xa (epda_box M)\\\"\n in bexI)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rule inMap)\n apply(clarsimp)\n done\n\ndefinition state_stack_unique_for_marking_states :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"state_stack_unique_for_marking_states G \\\n state_stack_unique G (epda_marking G)\"\n\nlemma state_stack_unique__subseteq: \"\n valid_dpda M\n \\ Q' \\ Q\n \\ state_stack_unique R Q\n \\ state_stack_unique R Q'\"\n apply(simp add: state_stack_unique_def)\n apply(clarsimp)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2)(*strict*)\n apply(erule_tac\n x=\"d1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"d2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"e2\"\n in allE)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2)(*strict*)\n apply(rule_tac\n x=\"n1\"\n in exI)\n apply(clarsimp)\n apply(rename_tac d1 d2 e1 e2 c1 n1 c2 n2)(*strict*)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(clarsimp)\n apply(force)\n done\n\ntheorem F_DPDA_OTS__enforces__state_stack_unique_for_marking_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ state_stack_unique_for_marking_states R\"\n apply(simp add: state_stack_unique_for_marking_states_def)\n apply(rule state_stack_unique__subseteq)\n apply(force)\n prefer 2\n apply(rule F_DPDA_OTS__state_stack_unique_for_annotated_states)\n apply(force)\n apply(force)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac a b)(*strict*)\n apply(rule inMap)\n apply(force)\n done\n\ndefinition state_stack_unique_for_stable_states :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"state_stack_unique_for_stable_states G \\\n state_stack_unique G (epda_states G - epda_nonstable_states (epda_delta G))\"\n\ntheorem F_DPDA_OTS__enforces___state_stack_unique_for_stable_states: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ state_stack_unique_for_stable_states R\"\n apply(simp add: state_stack_unique_for_stable_states_def)\n apply(rule state_stack_unique__subseteq)\n apply(force)\n prefer 2\n apply(rule F_DPDA_OTS__state_stack_unique_for_annotated_states)\n apply(force)\n apply(force)\n apply(simp add: epda_nonstable_states_def F_DPDA_OTS__states_main_def F_DPDA_OTS__states_def F_DPDA_OTS_def F_DPDA_OTS__marking_states_def F_DPDA_OTS__states_auxiliary_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"cons_state xa \\ (\\(x, y). cons_state_and_stack x y) ` (epda_states M \\ epda_gamma M)\")\n apply(simp add: F_DPDA_OTS__edges_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rule_tac\n x=\"\\edge_src=cons_state xa,edge_event=None,edge_pop=[epda_box M],edge_push=[epda_box M],edge_trg=cons_state_and_stack xa (epda_box M)\\\"\n in bexI)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rule inMap)\n apply(clarsimp)\n done\n\nlemma F_DPDA_OTS__enforces__cons_state_and_stack_cons_state_alternation: \"\n valid_dpda G\n \\ epdaH.derivation_initial (F_DPDA_OTS G) d\n \\ d (n + n) = Some (pair e1 c1)\n \\ d (Suc (n + n)) = Some (pair e2 c2)\n \\ \\q1 A q2. epdaH_conf_state c1 = cons_state_and_stack q1 A \\ epdaH_conf_state c2 = cons_state q2\"\n apply(induct n arbitrary: e1 c1 e2 c2)\n apply(rename_tac e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def F_DPDA_OTS_def)\n apply(clarsimp)\n apply(rename_tac c1 e2 c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac c1 e2 c2)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"0\"\n and m=\"(Suc 0)\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c1 c2 e2a)(*strict*)\n apply(simp add: epdaH_step_relation_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(clarsimp)\n apply(rename_tac c2 e2a w)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(erule disjE)+\n apply(rename_tac c2 e2a w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c2 e2a w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac c2 w x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"(n+n)\"\n and m=\"(Suc (Suc (Suc (n + n))))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc(n+n)\"\n and m=\"(Suc (Suc (Suc (n + n))))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(force)\n apply(rename_tac n e1 c1 e2 c2 e1a e2a c1a c2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc(Suc(n+n))\"\n and m=\"(Suc (Suc (Suc (n + n))))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n apply(force)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n apply(force)\n apply(rename_tac n c1 e2 c2 e1a e2a c1a c2a e2b)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c)(*strict*)\n apply(erule_tac\n x=\"e1a\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"c1a\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Some e2a\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"c2a\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A)(*strict*)\n apply(simp add: epdaH_step_relation_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A w wa wb)(*strict*)\n apply(erule disjE)+\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a e2a c1a c2a e2b e2c q1 q2 A w wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(erule disjE)+\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a c1a c2a q1 A w wa wb x a b xa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(erule disjE)+\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a c1a c2a q1 q2 A w wa wb x xa a b)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac n c1 c2 e1a c1a c2a e2b e2c q1 q2 A w wa wb x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c1 c2 e1a c1a c2a q1 q2 A w wa wb x xa xb)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\ndefinition DPDA_OTS__translate_back :: \"\n ((('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epda_step_label, (('state, 'stack) DT_state_and_stack_or_state, 'event, 'stack) epdaH_conf) derivation\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\"\n where\n \"DPDA_OTS__translate_back d \\\n \\n.\n if n = 0\n then Some (pair\n None\n (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R\n (case d 0 of\n Some (pair e c) \\ c)))\n else\n case (d ((n + n) -Suc 0)) of\n None \\ None\n | Some (pair e c) \\\n Some (pair\n (if n = 0\n then None\n else\n (case e of\n None \\ None\n | Some e' \\ Some (F_DPDA_OTS__epdaH_epdaH__RL__edge e')))\n (F_DPDA_OTS__epdaH_epdaH__LR__configuration1R c))\"\n\nlemma F_DPDA_OTS__translateB__preserves__derivation: \"\n valid_dpda G\n \\ epdaH.derivation_initial (F_DPDA_OTS G) d\n \\ \\n. d n \\ None\n \\ epdaH.derivation G (DPDA_OTS__translate_back d)\"\n apply(simp (no_asm) add: epdaH.derivation_def DPDA_OTS__translate_back_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac i)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac nat)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n n=\"0\"\n and m=\"Suc 0\"\n in epdaH.step_detail_before_some_position)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"0\"\n in F_DPDA_OTS__enforces__cons_state_and_stack_cons_state_alternation)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 e2 c1 c2 q1 q2 A)(*strict*)\n apply(simp add: epdaH_step_relation_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(clarsimp)\n apply(rename_tac e1 e2 c1 c2 q1 q2 A w)(*strict*)\n apply(case_tac c1)\n apply(rename_tac e1 e2 c1 c2 q1 q2 A w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c2)\n apply(rename_tac e1 e2 c1 c2 q1 q2 A w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 e2 q1 q2 A w epdaH_conf_history)(*strict*)\n apply(case_tac e1)\n apply(rename_tac e1 e2 q1 q2 A w epdaH_conf_history)(*strict*)\n apply(case_tac e2)\n apply(rename_tac e1 e2 q1 q2 A w epdaH_conf_history edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_eventa edge_popa edge_pusha)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__edge_def)\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_event edge_pop edge_push)(*strict*)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(erule disjE)+\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_event edge_pop edge_push)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_event edge_pop edge_push)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_event edge_pop edge_push x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac q1 q2 A w epdaH_conf_history edge_eventa edge_popa edge_pusha x)(*strict*)\n apply(clarsimp)\n apply(rename_tac w epdaH_conf_history x)(*strict*)\n apply(case_tac x)\n apply(rename_tac w epdaH_conf_history x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac e1 e2 q1 q2 A w epdaH_conf_history a)(*strict*)\n apply(clarsimp)\n apply(rename_tac e2 q1 q2 A w epdaH_conf_history a)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__edge_def)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(erule disjE)+\n apply(rename_tac e2 q1 q2 A w epdaH_conf_history a)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac e2 q1 q2 A w epdaH_conf_history a)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac q1 q2 A w epdaH_conf_history a x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac w epdaH_conf_history a x)(*strict*)\n apply(case_tac x)\n apply(rename_tac w epdaH_conf_history a x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac nata)(*strict*)\n apply(rename_tac n)\n apply(rename_tac n)(*strict*)\n apply(case_tac \"(d (Suc (Suc (Suc (n + n)))))\")\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc (Suc (n + n))\"\n and m=\"(Suc (Suc (Suc (n + n))))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"(Suc (n + n))\"\n and m=\"(Suc (Suc (Suc (n + n))))\"\n in epdaH.step_detail_before_some_position)\n apply(rename_tac n a)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc n\"\n in F_DPDA_OTS__enforces__cons_state_and_stack_cons_state_alternation)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(force)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(force)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(force)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(force)\n apply(rename_tac n e1a e2 e2a c1 c1a c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A)(*strict*)\n apply(simp add: epdaH_step_relation_def der1_def get_configuration_def epdaH_initial_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(clarsimp)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A w wa)(*strict*)\n apply(case_tac e2a)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(case_tac c1)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n apply(case_tac c2)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n apply(case_tac c1a)\n apply(rename_tac n e1a e2 e2a c1 c1a c2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa epdaH_conf_stateb epdaH_conf_historyb epdaH_conf_stackb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a e2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha epdaH_conf_historyb)(*strict*)\n apply(case_tac e2)\n apply(rename_tac n e1a e2 q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha epdaH_conf_historyb edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a q1 q2 A w wa edge_srca edge_eventa edge_popa edge_pusha epdaH_conf_historyb edge_eventaa edge_popaa edge_pushaa)(*strict*)\n apply(rename_tac qs r po pu h qs2 r2 po2 pu2 qt2)\n apply(rename_tac n e1a q1 q2 A qs r po pu h qs2 r2 po2 pu2 qt2)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__edge_def)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(erule disjE)+\n apply(rename_tac n e1a q1 q2 A qs r po pu h qs2 r2 po2 pu2 qt2)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1a q1 q2 A qs r po pu h qs2 r2 po2 pu2 qt2)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1a q1 q2 A qs r po pu h qs2 r2 po2 pu2 qt2)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1a q1 q2 A qs r po pu h qs2 r2 po2 pu2 qt2 x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac n e1a qs r po pu h qs2 r2 x)(*strict*)\n apply(erule disjE)+\n apply(rename_tac n e1a qs r po pu h qs2 r2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a qs r r2 x)(*strict*)\n apply(case_tac x)\n apply(rename_tac n e1a qs r r2 x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a qs r r2 edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n apply(simp add: option_to_list_def F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(rename_tac n e1a qs r po pu h qs2 r2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n e1a qs r po pu h qs2 r2 x xa)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\nlemma F_DPDA_OTS__translateB__preserves__derivation_initial: \"\n valid_dpda G\n \\ epdaH.derivation_initial (F_DPDA_OTS G) d\n \\ \\n. d n \\ None\n \\ epdaH.derivation_initial G (DPDA_OTS__translate_back d)\"\n apply(simp (no_asm) add: epdaH.derivation_initial_def)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__translateB__preserves__derivation)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(simp add: DPDA_OTS__translate_back_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n n=\"0\"\n and m=\"Suc 0\"\n in epdaH.step_detail_before_some_position)\n apply(simp add: epdaH.derivation_initial_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"c2 \\ epdaH_configurations (F_DPDA_OTS G)\")\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(rule F_DPDA_OTS__preserves__PDA)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(simp add: valid_pda_def)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(force)\n apply(rename_tac e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac e2 c1 c2)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def epdaH_initial_configurations_def F_DPDA_OTS_def epdaH_configurations_def F_DPDA_OTS__states_def)\n apply(clarsimp)\n apply(rename_tac e2 q s h)(*strict*)\n apply(erule_tac\n P=\"cons_state_and_stack (epda_initial G) (epda_box G) \\ F_DPDA_OTS__states_auxiliary G\"\n in disjE)\n apply(rename_tac e2 q s h)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_OTS__states_auxiliary_def F_DPDA_OTS__states_main_def)\n apply(clarsimp)\n apply(rename_tac e2 q s h)(*strict*)\n apply(simp add: epdaH_step_relation_def F_DPDA_OTS__edges_def)\n apply(clarsimp)\n apply(rename_tac e2 w)(*strict*)\n apply(erule_tac\n P=\"e2 \\ F_DPDA_OTS__edges_main_auxiliary G\"\n in disjE)\n apply(rename_tac e2 w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac e2 w)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__get_state_def F_DPDA_OTS__edges_def)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\ntheorem F_DPDA_OTS__preserves__no_livelock: \"\n valid_dpda G\n \\ \\ epdaH_livelock G\n \\ \\ epdaH_livelock (F_DPDA_OTS G)\"\n apply(simp add: epdaH_livelock_def)\n apply(clarsimp)\n apply(rename_tac d N)(*strict*)\n apply(rule ccontr)\n apply(clarsimp)\n apply(erule_tac\n x=\"DPDA_OTS__translate_back d\"\n in allE)\n apply(erule impE)\n apply(rename_tac d N)(*strict*)\n apply(rule F_DPDA_OTS__translateB__preserves__derivation_initial)\n apply(rename_tac d N)(*strict*)\n apply(force)\n apply(rename_tac d N)(*strict*)\n apply(force)\n apply(rename_tac d N)(*strict*)\n apply(force)\n apply(rename_tac d N)(*strict*)\n apply(erule disjE)\n apply(rename_tac d N)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N n)(*strict*)\n apply(simp add: DPDA_OTS__translate_back_def)\n apply(case_tac n)\n apply(rename_tac d N n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N nat)(*strict*)\n apply(case_tac \"d(Suc(nat+nat))\")\n apply(rename_tac d N nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc(nat+nat)\"\n and P=\"\\x. \\y. d x = Some y\"\n in allE)\n apply(force)\n apply(rename_tac d N nat a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d N nat a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N)(*strict*)\n apply(erule_tac\n x=\"N\"\n and P=\"\\N. \\n\\N. epdaH_conf_history (the (get_configuration (DPDA_OTS__translate_back d n))) \\ epdaH_conf_history (the (get_configuration (DPDA_OTS__translate_back d N)))\"\n in allE)\n apply(rename_tac d N)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N n)(*strict*)\n apply(simp add: DPDA_OTS__translate_back_def)\n apply(case_tac n)\n apply(rename_tac d N n)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d N nat)(*strict*)\n apply(case_tac N)\n apply(rename_tac d N nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat)(*strict*)\n apply(case_tac \"d 0\")\n apply(rename_tac d nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"0\"\n and P=\"\\x. \\y. d x = Some y\"\n in allE)\n apply(force)\n apply(rename_tac d nat a)(*strict*)\n apply(case_tac \"d (Suc (nat + nat))\")\n apply(rename_tac d nat a)(*strict*)\n apply(clarsimp)\n apply(erule_tac x=\"Suc (nat + nat)\" and P=\"\\x. \\y. d x = Some y\"in allE)\n apply(force)\n apply(rename_tac d nat a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d nat a aa option b)(*strict*)\n apply(case_tac aa)\n apply(rename_tac d nat a aa option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat option b optiona ba)(*strict*)\n apply(case_tac optiona)\n apply(rename_tac d nat option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat option b ba)(*strict*)\n prefer 2\n apply(rule_tac\n g=\"d\"\n and n=\"Suc(nat+nat)\"\n and m=\"Suc(nat+nat)\"\n in epdaH.pre_some_position_is_some_position_prime)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat option b ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat option b optiona ba a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat option b ba a)(*strict*)\n apply(simp add: get_configuration_def)\n apply(erule_tac\n x=\"Suc (nat+nat)\"\n and P=\"\\x. epdaH_conf_history (the (case d x of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history b\"\n in allE)\n apply(rename_tac d nat option b ba a)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(rename_tac d N nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata)(*strict*)\n apply(case_tac \"d (Suc (nat + nat))\")\n apply(rename_tac d nat nata)(*strict*)\n apply(clarsimp)\n apply(erule_tac x=\"(Suc (nat + nat))\" and P=\"\\x. \\y. d x = Some y\"in allE)\n apply(force)\n apply(rename_tac d nat nata a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d nat nata a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b)(*strict*)\n apply(case_tac \"d (Suc (nata + nata))\")\n apply(rename_tac d nat nata option b)(*strict*)\n apply(clarsimp)\n apply(erule_tac x=\"(Suc (nata + nata))\" and P=\"\\x. \\y. d x = Some y\"in allE)\n apply(force)\n apply(rename_tac d nat nata option b a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d nat nata option b a optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b optiona ba)(*strict*)\n apply(case_tac optiona)\n apply(rename_tac d nat nata option b optiona ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata option b ba)(*strict*)\n prefer 2\n apply(rule_tac\n g=\"d\"\n and n=\"Suc(nata+nata)\"\n and m=\"Suc(nata+nata)\"\n in epdaH.pre_some_position_is_some_position_prime)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(force)\n apply(rename_tac d nat nata option b ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b optiona ba a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b ba a)(*strict*)\n apply(case_tac option)\n apply(rename_tac d nat nata option b ba a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata b ba a)(*strict*)\n prefer 2\n apply(rule_tac\n g=\"d\"\n and n=\"Suc(nat+nat)\"\n and m=\"Suc(nat+nat)\"\n in epdaH.pre_some_position_is_some_position_prime)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata option b ba a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(simp add: get_configuration_def)\n apply(erule_tac\n x=\"Suc (nat+nat)\"\n and P=\"\\x. Suc nata \\ x \\ epdaH_conf_history (the (case d x of None \\ None | Some (pair e c) \\ Some c)) = epdaH_conf_history (the (case d (Suc nata) of None \\ None | Some (pair e c) \\ Some c))\"\n in allE)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n prefer 2\n apply(rule_tac\n g=\"d\"\n and n=\"Suc nata\"\n and m=\"Suc(nat+nat)\"\n in epdaH.pre_some_position_is_some_position_prime)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(rule epdaH.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n apply(clarsimp)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n prefer 2\n apply(rule F_DPDA_OTS__preserves__PDA)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: valid_dpda_def)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: valid_pda_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"Suc nata\"\n and m=\"nata\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and n=\"Suc (nata + nata)\"\n and m=\"Suc (nat + nat)-Suc (nata + nata)\"\n in epdaH.steps_extend_history_derivation)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: epdaH.derivation_initial_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(rule epdaH.belongs_configurations)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(rule epdaH.derivation_initial_belongs)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d nat nata b ba a aa e c)(*strict*)\n apply(force)\n done\n\ndefinition main_states_have_only_empty_steps :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ bool\"\n where\n \"main_states_have_only_empty_steps R F \\\n \\q \\ epda_states R.\n F q\n \\\n (\\e.\n e \\ epda_delta R\n \\ edge_src e = q\n \\ edge_event e = None)\"\n\ntheorem F_DPDA_OTS__enforces__main_states_have_only_empty_steps: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ main_states_have_only_empty_steps R F_DPDA_OTS__is_main\"\n apply(simp add: main_states_have_only_empty_steps_def F_DPDA_OTS__is_main_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(case_tac \"edge_src e\")\n apply(rename_tac e a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac e a)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule disjE)\n apply(rename_tac e a)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac e a)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def)\n apply(clarsimp)\n apply(rename_tac a x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\ndefinition main_states_have_all_empty_steps :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ bool\"\n where\n \"main_states_have_all_empty_steps R F \\\n \\q \\ epda_states R.\n F q\n \\\n (\\X \\ epda_gamma R.\n \\e.\n e \\ epda_delta R\n \\ edge_src e = q\n \\ edge_pop e = [X]\n \\ edge_event e = None)\"\n\ntheorem F_DPDA_OTS__enforces__main_states_have_all_empty_steps: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ main_states_have_all_empty_steps R F_DPDA_OTS__is_main\"\n apply(simp add: main_states_have_all_empty_steps_def F_DPDA_OTS__is_main_def)\n apply(clarsimp)\n apply(rename_tac q X)(*strict*)\n apply(case_tac q)\n apply(rename_tac q X a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac q X a)(*strict*)\n apply(clarsimp)\n apply(rename_tac X a)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(rule_tac\n x=\"\\edge_src=cons_state a,edge_event=None,edge_pop=[X],edge_push=[X],edge_trg=cons_state_and_stack a X\\\"\n in exI)\n apply(rule conjI)\n apply(rename_tac X a)(*strict*)\n apply(rule disjI1)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(rule inMap)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__states_def)\n apply(erule disjE)\n apply(rename_tac X a)(*strict*)\n apply(simp add: F_DPDA_OTS__states_auxiliary_def)\n apply(clarsimp)\n apply(rename_tac X a)(*strict*)\n apply(simp add: F_DPDA_OTS__states_main_def)\n apply(clarsimp)\n apply(rename_tac X a)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\ndefinition executing_edge_from_auxiliary_to_main_state :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ ('state \\ bool)\n \\ bool\"\n where\n \"executing_edge_from_auxiliary_to_main_state R F1 F2 \\\n \\e.\n e \\ epda_delta R\n \\ edge_event e \\ None\n \\ (F1 (edge_src e) \\ F2 (edge_trg e))\"\n\ntheorem F_DPDA_OTS__enforces__executing_edge_from_auxiliary_to_main_state: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ executing_edge_from_auxiliary_to_main_state R F_DPDA_OTS__is_auxiliary F_DPDA_OTS__is_main\"\n apply(simp add: executing_edge_from_auxiliary_to_main_state_def)\n apply(clarsimp)\n apply(rename_tac e y)(*strict*)\n apply(simp add: F_DPDA_OTS__is_main_def F_DPDA_OTS__is_auxiliary_def)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule disjE)\n apply(rename_tac e y)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac e y)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def)\n apply(clarsimp)\n apply(rename_tac y x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_1_def)\n done\n\ndefinition main_to_auxiliary_or_auxiliary_to_main :: \"\n ('state, 'event, 'stack) epda\n \\ ('state \\ bool)\n \\ bool\"\n where\n \"main_to_auxiliary_or_auxiliary_to_main R Fmain \\\n \\e \\ epda_delta R. Fmain (edge_src e) \\ \\ Fmain (edge_trg e)\"\n\ntheorem F_DPDA_OTS__enforces__main_to_auxiliary_or_auxiliary_to_main: \"\n valid_dpda M\n \\ R = F_DPDA_OTS M\n \\ main_to_auxiliary_or_auxiliary_to_main R F_DPDA_OTS__is_main\"\n apply(simp add: main_to_auxiliary_or_auxiliary_to_main_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_OTS_def F_DPDA_OTS__edges_def)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_main_auxiliary_def F_DPDA_OTS__edges_main_auxiliary_1_def)\n apply(clarsimp)\n apply(rename_tac a b)(*strict*)\n apply(simp add: F_DPDA_OTS__is_main_def)\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_OTS__edges_auxiliary_main_def F_DPDA_OTS__edges_auxiliary_main_1_def)\n apply(simp add: F_DPDA_OTS__is_main_def)\n done\n\ntheorem F_DPDA_OTS__preserves__epdaH_reflection_to_DFA_exists: \"\n valid_dpda M\n \\ epdaH_reflection_to_DFA_exists M D F\n \\ R = F_DPDA_OTS M\n \\ epdaH_reflection_to_DFA_exists R D (F \\ F_DPDA_OTS__get_state)\"\n apply(simp add: epdaH_reflection_to_DFA_exists_def)\n apply(clarsimp)\n apply(rename_tac d n c)(*strict*)\n apply(case_tac \"d n\")\n apply(rename_tac d n c)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d n c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option b)(*strict*)\n apply(subgoal_tac \"b=c\")\n apply(rename_tac d n c option b)(*strict*)\n prefer 2\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option)(*strict*)\n apply(thin_tac \"get_configuration (Some (pair option c)) = Some c\")\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d n c option)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"M\"\n and ?G1.0=\"F_DPDA_OTS M\"\n and ?d1.0=\"d\"\n and x=\"n\"\n in F_DPDA_OTS__epdaH_epdaH__RL.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac d n c option)(*strict*)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__TSstructure_def)\n apply(rename_tac d n c option)(*strict*)\n apply(force)\n apply(rename_tac d n c option)(*strict*)\n apply(force)\n apply(rename_tac d n c option)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option d2 n2)(*strict*)\n apply(erule_tac\n x=\"d2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"n2\"\n in allE)\n apply(case_tac \"d2 n2\")\n apply(rename_tac d n c option d2 n2)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac d n c option d2 n2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d n c option d2 n2 a optiona b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option d2 n2 optiona b)(*strict*)\n apply(erule_tac\n x=\"b\"\n in allE)\n apply(erule impE)\n apply(rename_tac d n c option d2 n2 optiona b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac d n c option d2 n2 optiona b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d n c option d2 n2 optiona b d' m)(*strict*)\n apply(rule_tac\n x=\"d'\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"m\"\n in exI)\n apply(clarsimp)\n apply(simp add: F_DPDA_OTS__epdaH_epdaH__RL__configurations_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def F_DPDA_OTS__epdaH_epdaH__LR__configuration1R_def)\n done\n\ndefinition F_DPDA_OTS__SpecInput :: \"\n (('stateA, 'stateB) DT_tuple2, 'event, 'stackA) epda\n \\ ('stateB, 'event, 'stackB) epda\n \\ bool\"\n where\n \"F_DPDA_OTS__SpecInput G D \\\n valid_dpda G\n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G)\n \\ \\ epdaH_livelock G\n \\ epdaH_reflection_to_DFA_exists G D sel_tuple2_2\"\n\ndefinition F_DPDA_OTS__SpecOutput :: \"\n (('stateA, 'stateB) DT_tuple2, 'event, 'stackA) epda\n \\ (('stateB, 'event, 'stackB) epda \\ 'event set)\n \\ ((('stateA, 'stateB) DT_tuple2, 'stackA) DT_state_and_stack_or_state, 'event, 'stackA) epda\n \\ bool\"\n where\n \"F_DPDA_OTS__SpecOutput Gi X Go \\\n case X of \n (D, \\UC) \\\n valid_dpda Go\n \\ epdaH.marked_language Gi = epdaH.marked_language Go\n \\ epdaH.unmarked_language Gi = epdaH.unmarked_language Go\n \\ nonblockingness_language (epdaH.unmarked_language Go) (epdaH.marked_language Go)\n \\ state_stack_unique_for_marking_states Go\n \\ state_stack_unique_for_stable_states Go\n \\ always_applicable_for_stable_states Go\n \\ some_edge_applicable Go\n \\ \\ epdaH_livelock Go\n \\ epdaH_reflection_to_DFA_exists Go D (sel_tuple2_2 \\ F_DPDA_OTS__get_state)\n \\ corresponds_to_top_stack Go F_DPDA_OTS__is_auxiliary F_DPDA_OTS__get_stack\n \\ main_states_have_only_empty_steps Go F_DPDA_OTS__is_main\n \\ main_states_have_all_empty_steps Go F_DPDA_OTS__is_main\n \\ executing_edge_from_auxiliary_to_main_state Go F_DPDA_OTS__is_auxiliary F_DPDA_OTS__is_main\n \\ always_applicable_for_auxiliary_states Go F_DPDA_OTS__is_auxiliary\n \\ main_to_auxiliary_or_auxiliary_to_main Go F_DPDA_OTS__is_main\" \n\n\ntheorem F_DPDA_OTS__SOUND: \"\n F_DPDA_OTS__SpecInput G P\n \\ F_DPDA_OTS__SpecOutput G (P, \\UC) (F_DPDA_OTS G)\"\n apply(simp add: F_DPDA_OTS__SpecOutput_def F_DPDA_OTS__SpecInput_def)\n apply(rule context_conjI)\n apply (metis F_DPDA_OTS__preserves__DPDA)\n apply(rule context_conjI)\n apply (metis F_DPDA_OTS__equal__marked_language)\n apply(rule context_conjI)\n apply (metis F_DPDA_OTS__equal__unmarked_language)\n apply(rule conjI)\n apply(force)\n apply(rule conjI)\n apply (metis F_DPDA_OTS__enforces__state_stack_unique_for_marking_states)\n apply(rule conjI)\n apply (metis F_DPDA_OTS__enforces___state_stack_unique_for_stable_states)\n apply(rule conjI)\n apply(metis F_DPDA_OTS__enforces__always_applicable_for_stable_states)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__some_edge_applicable)\n apply(force)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__preserves__no_livelock)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__preserves__epdaH_reflection_to_DFA_exists)\n apply(force)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__corresponds_to_top_stack)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__main_states_have_only_empty_steps)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__main_states_have_all_empty_steps)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__executing_edge_from_auxiliary_to_main_state)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule F_DPDA_OTS__enforces__always_applicable_for_auxiliary_states)\n apply(force)\n apply(force)\n apply(rule F_DPDA_OTS__enforces__main_to_auxiliary_or_auxiliary_to_main)\n apply(force)\n apply(force)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_13_02/FUNCTION__DPDA_OTS__DPDA_OBSERVE_TOP_STACK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2726514902905039}} {"text": "section {*L\\_ATS\\_Simulation\\_Configuration\\_WeakBRA*}\ntheory\n L_ATS_Simulation_Configuration_WeakBRA\n\nimports\n L_ATS_Simulation_Configuration_WeakDET\n\nbegin\n\nlocale ATS_Simulation_Configuration_WeakBRA =\n ATS_Simulation_Configuration_WeakDET\n \"TSstructure1 :: 'TSstructure1 \\ bool\"\n \"configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"initial_configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"step_labels1 :: 'TSstructure1 \\ 'label1 set\"\n \"step_relation1 :: 'TSstructure1 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ bool\"\n \"effects1 :: 'TSstructure1 \\ 'event1 set\"\n \"marking_condition1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ bool\"\n \"marked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"unmarked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"TSstructure2 :: 'TSstructure2 \\ bool\"\n \"configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"initial_configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"step_labels2 :: 'TSstructure2 \\ 'label2 set\"\n \"step_relation2 :: 'TSstructure2 \\ 'conf2 \\ 'label2 \\ 'conf2 \\ bool\"\n \"effects2 :: 'TSstructure2 \\ 'event2 set\"\n \"marking_condition2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ bool\"\n \"marked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"unmarked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"relation_configurationLR :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_initial_configurationLR :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_effectLR :: 'TSstructure1 \\ 'TSstructure2 \\ 'event1 \\ 'event2 \\ bool\"\n \"relation_TSstructureLR :: 'TSstructure1 \\ 'TSstructure2 \\ bool\"\n \"relation_initial_simulationLR :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n \"relation_step_simulationLR :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ 'conf2 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n \"relation_configurationRL :: 'TSstructure2 \\ 'TSstructure1 \\ 'conf2 \\ 'conf1 \\ bool\"\n \"relation_initial_configurationRL :: 'TSstructure2 \\ 'TSstructure1 \\ 'conf2 \\ 'conf1 \\ bool\"\n \"relation_effectRL :: 'TSstructure2 \\ 'TSstructure1 \\ 'event2 \\ 'event1 \\ bool\"\n \"relation_TSstructureRL :: 'TSstructure2 \\ 'TSstructure1 \\ bool\"\n \"relation_initial_simulationRL :: 'TSstructure2 \\ 'TSstructure1 \\ 'conf2 \\ (nat \\ ('label1, 'conf1) derivation_configuration option) \\ bool\"\n \"relation_step_simulationRL :: 'TSstructure2 \\ 'TSstructure1 \\ 'conf2 \\ 'label2 \\ 'conf2 \\ 'conf1 \\ (nat \\ ('label1, 'conf1) derivation_configuration option) \\ bool\"\n \"label_relation :: 'TSstructure1 \\ 'TSstructure2 \\ 'label1 \\ 'label2 \\ bool\"\n for\n TSstructure1 configurations1 initial_configurations1 step_labels1 step_relation1 effects1 marking_condition1 marked_effect1 unmarked_effect1 TSstructure2 configurations2 initial_configurations2 step_labels2 step_relation2 effects2 marking_condition2 marked_effect2 unmarked_effect2 relation_configurationLR relation_initial_configurationLR relation_effectLR relation_TSstructureLR relation_initial_simulationLR relation_step_simulationLR relation_configurationRL relation_initial_configurationRL relation_effectRL relation_TSstructureRL relation_initial_simulationRL relation_step_simulationRL label_relation\n +\n\nassumes AX_relation_configuration_inverse: \"\n relation_TSstructureLR G1 G2\n \\ relation_configurationRL G2 G1 c2 c1\n \\ relation_configurationLR G1 G2 c1 c2\"\n\nassumes AX_marking_condition_translation: \"\n relation_TSstructureRL G2 G1\n \\ relation_TSstructureLR G1 G2\n \\ LR.GR.derivation_initial G2 dR\n \\ maximum_of_domain dR nR\n \\ dR nR = Some (pair enR cnR)\n \\ LR.GL.derivation_initial G1 dL\n \\ maximum_of_domain dL nL\n \\ relation_initial_configurationRL G2 G1 c0R c0L\n \\ relation_configurationRL G2 G1 cnR cnL\n \\ dR 0 = Some (pair None c0R)\n \\ dL 0 = Some (pair None c0L)\n \\ dL nL = Some (pair enL cnL)\n \\ LR.GL.derivation G1 dL2\n \\ LR.GL.belongs G1 dL2\n \\ maximum_of_domain dL2 nL2\n \\ marking_condition1 G1 (derivation_append dL dL2 nL)\n \\ dL2 0 = Some (pair None cnL)\n \\ relation_configurationLR G1 G2 cnL cnR\n \\ dL2 nL2 = Some (pair e2nL c2nL)\n \\ LR.GR.derivation G2 d2R\n \\ LR.GR.belongs G2 d2R\n \\ maximum_of_domain d2R n2R\n \\ relation_configurationLR G1 G2 c2nL cn2R\n \\ d2R 0 = Some (pair None cnR)\n \\ d2R n2R = Some (pair en2R cn2R)\n \\ marking_condition2 G2 (derivation_append dR d2R nR)\"\n\ncontext ATS_Simulation_Configuration_WeakBRA begin\n\ntheorem Nonblockingness_branching_is_preserved: \"\n relation_TSstructureRL G2 G1\n \\ relation_TSstructureLR G1 G2\n \\ LR.GL.Nonblockingness_branching G1\n \\ LR.GR.Nonblockingness_branching G2\"\n apply(simp add: LR.GR.Nonblockingness_branching_def)\n apply(clarsimp)\n apply(rename_tac dh n)(*strict*)\n apply(rename_tac dR nR)\n apply(rename_tac dR nR)(*strict*)\n apply(subgoal_tac \"\\enR cnR. dR nR = Some (pair enR cnR)\")\n apply(rename_tac dR nR)(*strict*)\n prefer 2\n apply(rule LR.GR.some_position_has_details_before_max_dom)\n apply(rename_tac dR nR)(*strict*)\n apply(rule LR.GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac dR nR)(*strict*)\n apply(force)\n apply(rename_tac dR nR)(*strict*)\n apply(force)\n apply(rename_tac dR nR)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR)(*strict*)\n apply(subgoal_tac \"\\d2 n2. LR.GL.derivation_initial G1 d2 \\ maximum_of_domain d2 n2 \\ relation_initial_configurationRL G2 G1 (the (get_configuration (dR 0))) (the (get_configuration (d2 0))) \\ relation_configurationRL G2 G1 cnR (the (get_configuration (d2 n2)))\")\n apply(rename_tac dR nR enR cnR)(*strict*)\n prefer 2\n apply(rule RL.ATS_Simulation_Configuration_Weak_simulation_derivation_exists)\n apply(rename_tac dR nR enR cnR)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR d2 n2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\c. dR 0 = Some (pair None c)\")\n apply(rename_tac dR nR enR cnR d2 n2)(*strict*)\n prefer 2\n apply (metis LR.GR.derivation_initial_is_derivation LR.GR.some_position_has_details_at_0)\n apply(rename_tac dR nR enR cnR d2 n2)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac dR nR enR cnR d2 n2)(*strict*)\n prefer 2\n apply (metis LR.GL.derivation_initial_is_derivation LR.GL.some_position_has_details_at_0)\n apply(rename_tac dR nR enR cnR d2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n apply(subgoal_tac \"\\e c. d2 n2 = Some (pair e c)\")\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n prefer 2\n apply(rule LR.GL.some_position_has_details_before_max_dom)\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n apply(rule LR.GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR d2 n2 c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR d2 n2 c ca e cb)(*strict*)\n apply(rename_tac dL nL c0R c0L enL cnL)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL)(*strict*)\n apply(simp add: LR.GL.Nonblockingness_branching_def)\n apply(erule_tac\n x=\"dL\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nL\"\n in allE)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dc x)(*strict*)\n apply(rename_tac dL2 nL2)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2)(*strict*)\n apply(subgoal_tac \"\\c. dL2 0 =Some (pair None c)\")\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2)(*strict*)\n prefer 2\n apply (metis LR.GL.some_position_has_details_at_0)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(subgoal_tac \"relation_configurationLR G1 G2 cnL cnR\")\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n prefer 2\n apply(rule AX_relation_configuration_inverse)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(subgoal_tac \"\\e c. dL2 nL2= Some (pair e c)\")\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n prefer 2\n apply(rule LR.GL.some_position_has_details_before_max_dom)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(subgoal_tac \"\\d2 n2. LR.GR.derivation G2 d2 \\ LR.GR.belongs G2 d2 \\ maximum_of_domain d2 n2 \\ the (get_configuration (d2 0)) = cnR \\ relation_configurationLR G1 G2 (the (get_configuration (dL2 0))) (the (get_configuration (d2 0))) \\ relation_configurationLR G1 G2 ca (the (get_configuration (d2 n2)))\")\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n prefer 2\n apply(rule LR.ATS_Simulation_Configuration_Weak_simulation_derivation_exists_witness2)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply (metis LR.GR.belongs_configurations LR.GR.derivation_initial_belongs LR.AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(rename_tac dR nR enR cnR dL nL c0R c0L enL cnL dL2 nL2 c e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n prefer 2\n apply (metis LR.GR.some_position_has_details_at_0)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(subgoal_tac \"\\e c. d2 n2 = Some (pair e c)\")\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n prefer 2\n apply(rule LR.GR.some_position_has_details_before_max_dom)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(force)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2)(*strict*)\n apply(clarsimp)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2 cb ea cc)(*strict*)\n apply(rule conjI)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2 cb ea cc)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(simp add: get_configuration_def)\n apply(rename_tac dR nR enR dL nL c0R c0L enL cnL dL2 nL2 c e ca d2 n2 cb ea cc)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(clarsimp)\n apply(rename_tac dR nR enR dL nL c0R c0L enL dL2 nL2 c e ca d2 n2 cb ea cc)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac cnL e2nL c2nL d2R n2R cnR en2R cn2R)\n apply(rename_tac dR nR enR dL nL c0R c0L enL dL2 nL2 cnL e2nL c2nL d2R n2R cnR en2R cn2R)(*strict*)\n apply(rule AX_marking_condition_translation)\n apply(rename_tac dR nR enR dL nL c0R c0L enL dL2 nL2 cnL e2nL c2nL d2R n2R cnR en2R cn2R)(*strict*)\n apply(force)+\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Simulation_Configuration_WeakBRA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.27265149029050384}} {"text": "(* Title: HOL/Auth/Guard/Guard_Public.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n\nLemmas on guarded messages for public protocols.\n*)\n\ntheory Guard_Public imports Guard \"../Public\" Extensions begin\n\nsubsection{*Extensions to Theory @{text Public}*}\n\ndeclare initState.simps [simp del]\n\nsubsubsection{*signature*}\n\ndefinition sign :: \"agent => msg => msg\" where\n\"sign A X == {|Agent A, X, Crypt (priK A) (Hash X)|}\"\n\nlemma sign_inj [iff]: \"(sign A X = sign A' X') = (A=A' & X=X')\"\nby (auto simp: sign_def)\n\nsubsubsection{*agent associated to a key*}\n\ndefinition agt :: \"key => agent\" where\n\"agt K == @A. K = priK A | K = pubK A\"\n\nlemma agt_priK [simp]: \"agt (priK A) = A\"\nby (simp add: agt_def)\n\nlemma agt_pubK [simp]: \"agt (pubK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection{*basic facts about @{term initState}*}\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X ~:parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X ~:analz (initState A)\"\nby auto\n\nlemma no_priK_in_analz_init [simp]: \"A ~:bad\n==> Key (priK A) ~:analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma priK_notin_initState_Friend [simp]: \"A ~= Friend C\n==> Key (priK A) ~: parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection{*sets of private keys*}\n\ndefinition priK_set :: \"key set => bool\" where\n\"priK_set Ks == ALL K. K:Ks --> (EX A. K = priK A)\"\n\nlemma in_priK_set: \"[| priK_set Ks; K:Ks |] ==> EX A. K = priK A\"\nby (simp add: priK_set_def)\n\nlemma priK_set1 [iff]: \"priK_set {priK A}\"\nby (simp add: priK_set_def)\n\nlemma priK_set2 [iff]: \"priK_set {priK A, priK B}\"\nby (simp add: priK_set_def)\n\nsubsubsection{*sets of good keys*}\n\ndefinition good :: \"key set => bool\" where\n\"good Ks == ALL K. K:Ks --> agt K ~:bad\"\n\nlemma in_good: \"[| good Ks; K:Ks |] ==> agt K ~:bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A ~:bad ==> good {priK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A ~:bad; B ~:bad |] ==> good {priK A, priK B}\"\nby (simp add: good_def)\n\nsubsubsection{*greatest nonce used in a trace, 0 if there is no nonce*}\n\nprimrec greatest :: \"event list => nat\"\nwhere\n \"greatest [] = 0\"\n| \"greatest (ev # evs) = max (greatest_msg (msg ev)) (greatest evs)\"\n\nlemma greatest_is_greatest: \"Nonce n:used evs ==> n <= greatest evs\"\napply (induct evs, auto simp: initState.simps)\napply (drule used_sub_parts_used, safe)\napply (drule greatest_msg_is_greatest, arith)\nby simp\n\nsubsubsection{*function giving a new nonce*}\n\ndefinition new :: \"event list => nat\" where\n\"new evs == Suc (greatest evs)\"\n\nlemma new_isnt_used [iff]: \"Nonce (new evs) ~:used evs\"\nby (clarify, drule greatest_is_greatest, auto simp: new_def)\n\nsubsection{*Proofs About Guarded Messages*}\n\nsubsubsection{*small hack necessary because priK is defined as the inverse of pubK*}\n\nlemma pubK_is_invKey_priK: \"pubK A = invKey (priK A)\"\nby simp\n\nlemmas pubK_is_invKey_priK_substI = pubK_is_invKey_priK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n:parts {X} ==> Crypt (pubK A) X:guard n {priK A}\"\napply (rule pubK_is_invKey_priK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection{*guardedness results*}\n\nlemma sign_guard [intro]: \"X:guard n Ks ==> sign A X:guard n Ks\"\nby (auto simp: sign_def)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n ~:used evs\n==> Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection{*regular protocols*}\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p == ALL evs A. evs:p --> (Key (priK A):parts (spies evs)) = (A:bad)\"\n\nlemma priK_parts_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (priK A):parts (spies evs)) = (A:bad)\"\nby (auto simp: regular_def)\n\nlemma priK_analz_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (priK A):analz (spies evs)) = (A:bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs:p;\npriK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_priK_set, simp+, clarify)\napply (frule_tac A=A in priK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Guard/Guard_Public.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.27265148373201975}} {"text": "\\<^marker>\\creator \"Maximilian P. L. Haslbeck\"\\\n\\<^marker>\\contributor \"Peter Lammich\"\\\nsection \\More theory on NREST\\\ntheory NREST_Main\n imports NREST NREST_Type_Classes Time_Refinement Data_Refinement\n NREST_Backwards_Reasoning NREST_Automation\nbegin\n \n\nparagraph \\Summary\\\ntext \\This theory introduces more convenience lemmas on NREST\\\n\n\nsubsection \\Convenience Lemmas\\\n\n\nlemma If_le_rule: \"(c \\ x \\ a) \\ (~c \\ x \\ b) \\ x \\ (if c then a else b)\"\n by auto\n\nlemma If_le_Some_rule2: \"(c \\ x \\ a) \\ c \\ Some x \\ (if c then Some a else None)\"\n by auto\n\nterm inres\nsubsection \\Interaction between Currency Refinement and Data Refinement\\\n \nlemma timerefine_R_cf_mono:\n fixes R :: \"_ \\ (_, enat) acost\"\n assumes \"wfR'' R'\"\n shows \"R\\R' \\ \\ S (\\\\<^sub>C R c) \\ \\ S (\\\\<^sub>C R' c)\"\n by (simp add: assms nrest_Rel_mono timerefine_R_mono_wfR'')\n\n\nlemma inresT_project_acost_timerefine: \"inresT (project_acost b (\\\\<^sub>C E m')) x' t \n \\ \\t b. inresT (project_acost b m') x' t\"\n unfolding inresT_def project_acost_def timerefine_def\n apply(cases m'; auto simp: le_fun_def split: if_splits option.splits)\n by (metis zero_enat_def zero_le) \n\n\nlemma bindT_refine_conc_time:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R'; \\t b. inresT (project_acost b m) x t; \\t b. inresT (project_acost b m') x' t;\n nofailT m; nofailT m'\\ \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n using assms\nproof -\n term \"(\\\\<^sub>C E m')\"\n term timerefine\n have \"bindT m (\\x. (f x)) \\ \\ R (bindT (\\\\<^sub>C E m') (\\x. \\\\<^sub>C E (f' x)))\"\n apply(rule bindT_conc_acost_refine') apply(rule assms(2)) \n apply(rule assms(3)) \n by (auto simp: refine_pw_simps dest: inresT_project_acost_timerefine) \n also have \"\\ \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule nrest_Rel_mono)\n apply(rule timerefine_bindT_ge) by(fact assms(1))\n finally show ?thesis .\nqed\nlemma bindT_refine_conc_time2:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR'' E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R'; \\t b. inresT (project_acost b m) x t; \\t b. inresT (project_acost b m') x' t;\n nofailT m; nofailT m'\\ \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n using assms\nproof -\n term \"(\\\\<^sub>C E m')\"\n term timerefine\n have \"bindT m (\\x. (f x)) \\ \\ R (bindT (\\\\<^sub>C E m') (\\x. \\\\<^sub>C E (f' x)))\"\n apply(rule bindT_conc_acost_refine') apply(rule assms(2)) \n apply(rule assms(3)) \n by (auto simp: refine_pw_simps dest: inresT_project_acost_timerefine) \n also have \"\\ \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule nrest_Rel_mono)\n apply(rule timerefine_bindT_ge2) by(fact assms(1))\n finally show ?thesis .\nqed\n\n\n\nlemma bindT_refine_conc_time_my:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR'' E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R'; \\t b. inresT (project_acost b m') x' t\\\n \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule bindT_refine_conc_time2) using assms by auto\n\n\n\nlemma timerefine_conc_fun_ge:\n fixes C :: \"('f, ('b, enat) acost) nrest\"\n assumes \"wfR E\"\n shows \"\\\\<^sub>C E (\\ R C) \\ \\R (\\\\<^sub>C E C)\"\n\n unfolding conc_fun_def timerefine_def\n apply(cases C) apply auto apply(rule le_funI)\n apply(rule Sup_least)\n apply (auto split: option.splits)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper less_eq_option_Some_None mem_Collect_eq)\n unfolding less_eq_acost_def apply auto\n apply(rule Sum_any_mono)\n apply(rule mult_right_mono)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper less_eq_option_Some mem_Collect_eq the_acost_mono)\n apply simp\n apply(rule wfR_finite_mult_left )\n using assms by simp\n\n\nlemma timerefine_conc_fun_ge2:\n fixes C :: \"('f, ('b, enat) acost) nrest\"\n assumes \"wfR'' E\"\n shows \"\\\\<^sub>C E (\\ R C) \\ \\R (\\\\<^sub>C E C)\"\n\n unfolding conc_fun_def timerefine_def\n apply(cases C) apply auto apply(rule le_funI)\n apply(rule Sup_least)\n apply (auto split: option.splits)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper less_eq_option_Some_None mem_Collect_eq)\n unfolding less_eq_acost_def apply auto\n apply(rule Sum_any_mono)\n apply(rule mult_right_mono)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper less_eq_option_Some mem_Collect_eq the_acost_mono)\n apply simp\n apply(rule wfR_finite_mult_left2 )\n using assms by simp\n\n\nlemma timerefine_conc_fun_le2:\n assumes \"continuous E\"\n shows \"timerefine' E (\\ R C) = \\R (timerefine' E C)\"\n unfolding timerefine'_def conc_fun_def \n apply(auto split: nrest.splits option.splits simp: fun_eq_iff)\n subgoal \n by (smt Sup_bot_conv(1) bot_option_def mem_Collect_eq) \n subgoal premises p for x2 x2a x2b x x2c\n proof -\n have \"Sup {x2b a |a. (x, a) \\ R} = Sup {map_option E (x2 a) |a. (x, a) \\ R}\"\n apply(rule arg_cong[where f=Sup])\n using p(3)[rule_format] p(4)\n apply auto\n subgoal by (smt map_option_eq_Some option.exhaust) \n subgoal by (metis not_None_eq option.simps(8) option.simps(9)) \n done\n also have \"\\ = map_option E (Sup {x2 a |a. (x, a) \\ R})\" \n apply(subst continuous_map_option[OF assms, THEN continuousD] )\n apply(rule arg_cong[where f=Sup])\n by auto\n also have \"\\ = map_option E (Some x2c)\"\n using p(2)[rule_format, of x, unfolded p(4)] by simp\n also have \"\\ = Some (E x2c)\" by simp\n finally show \"Some (E x2c) = Sup {x2b a |a. (x, a) \\ R}\" by simp\n qed\n done \n\n(* TODO: move*)\nlemma nrest_le_formatI:\n fixes a :: \"(_,(_,enat)acost) nrest\"\n shows \"a \\ \\Id (\\\\<^sub>C TId b) \\ a \\ b\"\n by (auto simp add: timerefine_id)\n\n\nsubsection \\nrest_trel\\\n\ndefinition nrest_trel where \n nrest_trel_def_internal: \"nrest_trel R E \\ {(c,a). c \\ \\R (\\\\<^sub>C E a)}\"\n\n\nlemma nrest_trelD: \"(c,a)\\nrest_trel R E \\ c \\ \\R (\\\\<^sub>C E a)\" by (simp add: nrest_trel_def_internal)\n\n \nlemma nrest_trelI: \"c \\ \\R (\\\\<^sub>C E a) \\ (c,a)\\nrest_trel R E\" by (simp add: nrest_trel_def_internal)\n\n\nsubsection \\Type Class nrest_cost\\\n\nclass nrest_cost = complete_lattice + needname_zero + nonneg + ordered_semiring + semiring_no_zero_divisors\n\n\nsubsection \\Setup for refinement condition generator\\\n\nlemma consume_refine:\n fixes M :: \"('e, ('b, enat) acost) nrest\"\n assumes \"wfR'' E\"\n shows \"\\t \\ timerefineA E t'; M \\ \\ R (\\\\<^sub>C E M')\\ \\ NREST.consume M t \\ \\R (\\\\<^sub>C E (NREST.consume M' t'))\"\n apply(subst timerefine_consume)\n subgoal using assms .\n apply(subst conc_fun_consume)\n apply(rule consume_mono) by auto\n\nlemma MIf_refine:\n fixes f :: \"(_,(string, enat) acost) nrest\"\n shows \"struct_preserving E \\ wfR'' E \\ (b,b')\\bool_rel \\ (b \\ f \\ \\R (\\\\<^sub>C E f'))\n \\ (\\b \\ g \\ \\R (\\\\<^sub>C E g')) \\ MIf b f g \\ \\R (\\\\<^sub>C E (MIf b' f' g' ))\"\n by(auto simp: MIf_def timerefineA_update_apply_same_cost dest: struct_preservingD intro!: consume_refine)\n\n\nlemma ASSERT_D_leI[refine,refine0]: \n fixes M :: \"(_,(_,enat)acost) nrest\"\n shows \"\\ \\ (\\ \\ M \\ \\R M') \\ ASSERT \\ \\ (\\_. M) \\ \\R M'\"\n by (auto)\n\nlemma ASSERT_D2_leI[refine0]: \n fixes S' :: \"(_,(_,enat)acost) nrest\"\n shows \"(\\ \\ S \\ \\ R S') \\ S \\ \\ R (do {\n _ \\ ASSERT \\;\n S'\n })\"\n by (auto simp: pw_acost_le_iff refine_pw_simps)\n\n\nlemma ASSERT_D3_leI[refine0]: \n fixes S' :: \"(_,(_,enat)acost) nrest\"\n shows \"(\\ \\ S \\ \\ R (\\\\<^sub>C E S')) \\ S \\ \\ R (\\\\<^sub>C E (do {\n _ \\ ASSERT \\;\n S'\n }))\"\n by (auto simp: pw_acost_le_iff refine_pw_simps)\n\n\nlemma ASSERT_D4_leI[refine0]: \n fixes S' :: \"(_,(_,enat)acost) nrest\"\n shows \"(\\ \\ S \\ \\ R (\\\\<^sub>C E S')) \\ do { _ \\ ASSERT \\; S } \\ \\ R (\\\\<^sub>C E (do {\n _ \\ ASSERT \\;\n S'\n }))\"\n by (auto simp: pw_acost_le_iff refine_pw_simps)\n\n\nlemma refine_Id[refine0]: \"S \\ \\ Id S\"\n by auto\n\n\nlemma refine_TId[refine0]:\n fixes S :: \"(_,(_,enat)acost) nrest\"\n shows \"S \\ \\ Id (\\\\<^sub>C TId S)\"\n unfolding timerefine_id\n by auto\n\n\n\n\n\nlemma SPEC_refine[refine]:\n fixes T :: \"_ \\ ((_,enat)acost)\"\n assumes *: \"\\x. \\ x \\ \\s'. \\' s' \\ (x, s') \\ R \\ T x \\ T' s'\"\n shows \"SPEC \\ T \\ \\R (SPEC \\' T')\"\n unfolding SPEC_def\n by (auto simp: pw_acost_le_iff refine_pw_simps dest!: * intro: order.trans[OF _ the_acost_mono])\n\n \nlemma SPEC_both_refine:\n fixes T :: \"_ \\ ((_,enat)acost)\"\n assumes \"\\x. \\ x \\ \\s'. \\' s' \\ (x, s') \\ R \\ T x \\ timerefineA TR (T' s')\"\n shows \"SPEC \\ T \\ \\ R (\\\\<^sub>C TR (SPEC \\' T'))\"\n apply(rule order.trans) \n defer\n apply(rule nrest_Rel_mono)\n apply(rule SPEC_timerefine[where A=\\'])\n prefer 3 apply(rule SPEC_refine[where T=T])\n defer apply simp apply(rule order_refl)\n by (fact assms)\n\nlemma ASSERT_D5_leI[refine0]: \n fixes S' :: \"(_,(_,enat)acost) nrest\"\n shows \"(\\ \\ \\ R (\\\\<^sub>C F S) \\ \\ R (\\\\<^sub>C E S')) \\ \\ R (\\\\<^sub>C F ( do { _ \\ ASSERT \\; S })) \\ \\ R (\\\\<^sub>C E (do {\n _ \\ ASSERT \\;\n S'\n }))\"\n by (auto simp: pw_acost_le_iff refine_pw_simps)\n\ndeclare consume_refine[refine0]\n\n\nlemma RETURNT_refine_t[refine]:\n assumes \"(x,x')\\R\"\n shows \"RETURNT x \\ \\R (\\\\<^sub>C E (RETURNT x'))\"\n apply(subst timerefine_RETURNT)\n apply(rule RETURNT_refine) by (fact assms)\n\n\ndeclare RETURNT_refine_t[refine0]\ndeclare timerefineA_TId[refine0]\n\n\nlemma SPECT_refine_t[refine]:\n fixes t :: \"(_,enat) acost\"\n assumes \"(x,x')\\R\"\n and \"t\\ timerefineA E t'\"\n shows \"SPECT [x\\t] \\ \\R (\\\\<^sub>C E (SPECT [x'\\t']))\"\n apply(subst timerefine_SPECT_map)\n using assms apply(auto simp: pw_acost_le_iff refine_pw_simps)\n apply(cases t) apply (auto simp: less_eq_acost_def)\n subgoal for b ta xa apply(rule order.trans[where b=\"xa b\"]) by auto\n done\n\nlemma RECT_refine_t:\n assumes M: \"mono2 body\"\n assumes R0: \"(x,x')\\R\"\n assumes RS: \"\\f f' x x'. \\ \\x x'. (x,x')\\R \\ f x \\\\S (\\\\<^sub>C E (f' x')); (x,x')\\R \\ \n \\ body f x \\\\S (\\\\<^sub>C E (body' f' x'))\"\n shows \"RECT (\\f x. body f x) x \\\\S (\\\\<^sub>C E (RECT (\\f' x'. body' f' x') x'))\"\n unfolding RECT_flat_gfp_def\n apply (clarsimp simp add: M) \n apply (rule flatf_fixp_transfer[where \n fp'=\"flatf_gfp body\" \n and B'=body \n and P=\"\\x x'. (x',x)\\R\", \n OF _ _ flatf_ord.fixp_unfold[OF M[THEN trimonoD_flatf_ge]] R0])\n apply simp\n apply (simp add: trimonoD_flatf_ge)\n by (rule RS)\n\nlemma RECT'_refine_t:\n fixes body :: \"('b \\ ('c, (char list, enat) acost) nrest)\n \\ 'b \\ ('c, (char list, enat) acost) nrest\"\n assumes M: \"mono2 body\"\n assumes wfRE: \"wfR'' E\"\n assumes spE: \"struct_preserving E\"\n assumes R0: \"(x,x')\\R\"\n assumes RS: \"\\f f' x x'. \\ \\x x'. (x,x')\\R \\ f x \\\\S (\\\\<^sub>C E (f' x')); (x,x')\\R \\ \n \\ body f x \\\\S (\\\\<^sub>C E (body' f' x'))\"\n shows \"RECT' (\\f x. body f x) x \\\\S (\\\\<^sub>C E (RECT' (\\f' x'. body' f' x') x'))\"\n unfolding RECT'_def\n apply(rule consume_refine[OF wfRE])\n subgoal using spE[THEN struct_preservingD(1)] by simp\n unfolding RECT_flat_gfp_def\n apply (clarsimp simp add: M[THEN RECT'_unfold_aux])\n apply (rule flatf_fixp_transfer[where \n fp'=\"flatf_gfp ((\\D. body (\\x. NREST.consume (D x) (cost ''call'' 1))))\" \n and B'=\"(\\D. body (\\x. NREST.consume (D x) (cost ''call'' 1)))\" \n and P=\"\\x x'. (x',x)\\R\", \n OF _ _ flatf_ord.fixp_unfold[OF M[THEN RECT'_unfold_aux, THEN trimonoD_flatf_ge]] R0])\n apply simp\n apply (simp add: trimonoD_flatf_ge)\n apply (rule RS)\n apply(rule consume_refine[OF wfRE])\n subgoal using spE[THEN struct_preservingD(1)] by simp\n apply simp apply simp\n done\n\nlemma monadic_WHILEIT_refine_t[refine]: \n fixes b :: \"'c \\ (bool, (char list, enat) acost) nrest\"\n assumes wfR[simp]: \"wfR'' E\"\n assumes sp_E: \"struct_preserving E\"\n assumes [refine]: \"(s',s) \\ R\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s \\ \\ I' s'\" \n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s' \\ \\ b' s' \\\\bool_rel (\\\\<^sub>C E (b s))\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s'; nofailT (b s);\n \\t e. inresT (project_acost e (b s)) True t \\ \\ f' s' \\\\R (\\\\<^sub>C E (f s))\"\n shows \"monadic_WHILEIT I' b' f' s' \\ \\R (\\\\<^sub>C E (monadic_WHILEIT I b f s))\"\n unfolding monadic_WHILEIT_def unfolding MIf_def \n apply (refine_rcg bindT_refine_conc_time2 RECT_refine_t IdI wfR struct_preservingD[OF sp_E]) \n apply simp \n subgoal by refine_mono\n apply (assumption?; auto)+\n apply (refine_rcg consume_refine_easy bindT_refine_conc_time2 wfR struct_preservingD[OF sp_E] RETURNT_refine_t )\n apply (assumption?; auto)+\n apply(rule RETURNT_refine_t) \n apply (assumption?; auto)+ \n done\n\nlemma monadic_WHILEIT_refine': \n fixes b :: \"'c \\ (bool, (char list, enat) acost) nrest\"\n assumes wfR[simp]: \"wfR'' E\"\n assumes sp_E: \"struct_preserving E\"\n assumes [refine]: \"(s',s) \\ R\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s \\ \\ I' s'\" \n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s' \\ \\ b' s' \\\\bool_rel (\\\\<^sub>C E (b s))\"\n assumes [refine]: \"\\s' s. \\ (s',s)\\R; I s; I' s'; inres (b s) True \\ \\ f' s' \\\\R (\\\\<^sub>C E (f s))\"\n shows \"monadic_WHILEIT I' b' f' s' \\ \\R (\\\\<^sub>C E (monadic_WHILEIT I b f s))\"\n apply(rule monadic_WHILEIT_refine_t[OF assms(1-5)])\n by(auto intro: assms(6) inres_if_inresT_acost)\n\nsubsection \\mop call\\\n\ndefinition mop_call where\n \"mop_call m = consume m (cost ''call'' 1)\"\n\nlemma gwp_call[vcg_rules']:\n fixes m :: \"(_,(_,enat) acost) nrest\"\n assumes \"Some (cost ''call'' 1 + t) \\ gwp m Q\"\n shows \"Some t \\ gwp (mop_call m) Q\"\n unfolding mop_call_def\n apply(rule gwp_consume) by(rule assms)\n\nlemma mop_call_refine:\n fixes M :: \"('e, (string, enat) acost) nrest\"\n assumes \"wfR'' E\"\n \"struct_preserving E\"\n shows \"\\ M \\ \\ R (\\\\<^sub>C E M')\\ \\ mop_call M \\ \\R (\\\\<^sub>C E (mop_call M'))\"\n unfolding mop_call_def\n apply(subst timerefine_consume)\n subgoal using assms(1) .\n apply(subst conc_fun_consume)\n apply(rule consume_mono) \n using assms(2)[THEN struct_preservingD(1)] \n by auto \n\nsubsection \\Shortcuts for specifications of operations\\\n\n definition \"SPECc1' c aop == (\\a. SPECT ( [(aop a)\\c]))\"\n definition \"SPECc1 name aop == (\\a. SPECT ( [(aop a)\\(cost name 1)]))\"\n definition \"SPECc2 name aop == ( (\\a b. SPECT ( [(aop a b)\\(cost name 1)])))\"\n\n\nlemma RETURNT_eq_SPECc2_iff[simp]: \"RETURNTecost v \\ SPECc2 n f a b\n \\ (f a b = v)\"\n unfolding SPECc2_def apply (auto simp: pw_acost_le_iff refine_pw_simps)\n using zero_enat_def by(auto simp: ) \n\nlemma inres_SPECc2: \"inres (SPECc2 n op a b) t \\ (op a b = t)\"\n by(auto simp: inres_def SPECc2_def)\n\nlemma SPECc2_alt: \"SPECc2 name aop = ( (\\a b. consume (RETURNT (aop a b)) (cost name 1)))\"\n unfolding SPECc2_def consume_def by(auto simp: RETURNT_def intro!: ext)\n\nlemma SPECc1_alt: \"SPECc1 name aop = ( (\\a. consume (RETURNT (aop a)) (cost name 1)))\"\n unfolding SPECc1_def consume_def by(auto simp: RETURNT_def intro!: ext)\n\nlemma gwp_SPECc2:\n assumes \"Some (t + cost c 1) \\ Q (op a b)\"\n shows \"Some t \\ gwp (SPECc2 c op a b) Q\"\n unfolding SPECc2_def \n apply(refine_vcg \\-\\)\n using assms by auto\n\nlemma SPECc2_refine':\n fixes TR :: \"'h \\ ('h, enat) acost\"\n shows \"(op x y, op' x' y')\\R \\ preserves_curr TR n \\ SPECc2 n op x y \\ \\ R (\\\\<^sub>C TR (SPECc2 n op' x' y'))\"\n unfolding SPECc2_def \n apply(subst SPECT_refine_t) by (auto simp: preserves_curr_def timerefineA_cost_apply) \n \nlemma SPECc2_refine:\n \"(op x y, op' x' y')\\R \\ cost n (1::enat) \\ TR n' \\ SPECc2 n op x y \\ \\ R (\\\\<^sub>C TR (SPECc2 n' op' x' y'))\"\n unfolding SPECc2_def \n apply(subst SPECT_refine_t) apply auto\n apply(rule order.trans) apply (simp add: )\n apply(subst timerefineA_cost) by simp\n\n\nsubsection \\normalize blocks\\\n\ntext \\The idea of the following tactic is to normalize all straight line blocks,\n such that they have the form (doN { [ASSUMEs]; consumea T; [RETURNs]; FURTHER }. \n To that end, it assumes that most operations are unfolded and only contain consumea, RETURN\n or consume (RETURN _) _. The RETURNs will be propagated with @{thm nres_bind_left_identity},\n ASSERTIONs will be pulled to the front, consumeas will be shrinked and assoc rule is applied.\n\n It then is assumed, that FURTHER statements in the concrete and abstract are in lock step.\n\n [ Then refine_block will split products, collect and discharge ASSUME statements, \n pay for the consumea; and then stop at a FURTHER statement.\n One can then give \"rules\" that process the FURTHER statements. ]\n This process is way better done by refine_rcg!\n \n This allows that not only lockstep refinement is possible, but that by unfolding certain\n operations, their effects get \n \\\n\nlemma consumea_refine:\n fixes t :: \"(_,enat) acost\"\n shows \"((), ()) \\ R \\ t \\ timerefineA F t' \\ consumea t \\ \\ R (\\\\<^sub>C F (consumea t'))\"\n unfolding consumea_def\n apply(rule SPECT_refine_t) by auto\n\nlemma consumea_Id_refine:\n fixes t :: \"(_,enat) acost\"\n shows \"t \\ timerefineA F t' \\ consumea t \\ \\ Id (\\\\<^sub>C F (consumea t'))\"\n unfolding consumea_def\n apply(rule SPECT_refine_t) by auto\n \n\nlemma swap_consumea_ASSERT: \"do { consumea t; ASSERT P; M:: ('c, ('d, enat) acost) nrest} = do {ASSERT P; consumea t; M}\"\n apply(auto simp: pw_acost_eq_iff refine_pw_simps consumea_def)\n apply (metis zero_enat_def zero_le)\n using le_Suc_ex zero_enat_def by force\n\n\nlemma consumea_0_noop:\n fixes m :: \"('b,'c::{complete_lattice,zero,monoid_add}) nrest\"\n shows \"do { consumea 0; m } = m\"\n apply(auto simp: consumea_def bindT_def split: nrest.splits intro!: ext) \n subgoal for x2 x apply(cases \"x2 x\") by auto\n done\n\nthm refine0 \n\nlemma forget_inresT_project_acos: \"\\t b. inresT (project_acost b (consumea tt)) x' t \\ True\"\n by simp\n\nlemma forget_nofailT_consumea: \"nofailT (consumea tt) \\ True\"\n by simp\n\nlemmas normalize_inres_precond = forget_nofailT_consumea forget_inresT_project_acos\n inresT_consumea_D EX_inresT_SPECTONE_D\n\nmethod normalize_blocks = (simp only: swap_consumea_ASSERT nres_acost_bind_assoc consume_alt consumea_shrink nres_bind_left_identity)\nmethod refine_block uses rules = (drule normalize_inres_precond |split prod.splits | intro allI impI\n | rule refine0 consumea_Id_refine SPECT_refine_t bindT_refine_conc_time_my rules)\nmethod refine_blocks uses rules = repeat_all_new \\refine_block rules: rules\\\n\n\nsubsection \\Simple bind rule with inres\\\n\n\nlemma bindT_refine_conc_time_my_inres:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR'' E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R'; inres m' x'\\\n \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule bindT_refine_conc_time2) using assms\n by (auto dest: inres_if_inresT_acost)\n\nlemma bindT_refine_conc_time_easy:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R' \\ \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule bindT_refine_conc_time)\n apply fact\n apply fact\n apply(rule assms(3)) apply simp\n done\n\nlemma bindT_refine_easy:\n fixes m :: \"('e1,('c1,enat)acost) nrest\"\n fixes m' :: \"('e2,('c2,enat)acost) nrest\"\n assumes \"wfR'' E\" \" m \\ \\R' (\\\\<^sub>C E m')\"\n \"(\\x x'. \\(x,x')\\R'\\\n \\ f x \\ \\ R (\\\\<^sub>C E (f' x') ))\"\nshows \"bindT m f \\ \\ R (\\\\<^sub>C E (bindT m' f'))\"\n apply(rule bindT_refine_conc_time2) using assms\n by (auto dest: inres_if_inresT_acost)\n\n\nend", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/nrest/NREST_Main.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.27262179330241804}} {"text": "(*****************************************************************************\n * Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.5\n * for the OMG Standard.\n * http://www.brucker.ch/projects/hol-testgen/\n *\n * UML_String.thy --- Library definitions.\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2012-2015 Université Paris-Saclay, Univ. Paris-Sud, France\n * 2013-2015 IRT SystemX, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\ntheory UML_String\nimports \"../UML_PropertyProfiles\"\nbegin\n\nsection\\Basic Type String: Operations\\\n\nsubsection\\Fundamental Properties on Strings: Strict Equality \\label{sec:string-strict-eq}\\\n\ntext\\The last basic operation belonging to the fundamental infrastructure\nof a value-type in OCL is the weak equality, which is defined similar\nto the @{typ \"('\\)Boolean\"}-case as strict extension of the strong equality:\\\noverloading StrictRefEq \\ \"StrictRefEq :: [('\\)String,('\\)String] \\ ('\\)Boolean\"\nbegin\n definition StrictRefEq\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g[code_unfold] :\n \"(x::('\\)String) \\ y \\ \\ \\. if (\\ x) \\ = true \\ \\ (\\ y) \\ = true \\\n then (x \\ y) \\\n else invalid \\\"\nend\n\ntext\\Property proof in terms of @{term \"profile_bin\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>o\\<^sub>n\\<^sub>g\\<^sub>E\\<^sub>q_\\<^sub>v_\\<^sub>v\"}\\\ninterpretation StrictRefEq\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g : profile_bin\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>o\\<^sub>n\\<^sub>g\\<^sub>E\\<^sub>q_\\<^sub>v_\\<^sub>v \"\\ x y. (x::('\\)String) \\ y\" \n by unfold_locales (auto simp: StrictRefEq\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g)\n \nsubsection\\Basic String Constants\\\n\ntext\\Although the remaining part of this library reasons about\nintegers abstractly, we provide here as example some convenient shortcuts.\\\n\ndefinition OclStringa ::\"('\\)String\" (\"\\\") where \"\\ = (\\ _ . \\\\''a''\\\\)\"\ndefinition OclStringb ::\"('\\)String\" (\"\\\") where \"\\ = (\\ _ . \\\\''b''\\\\)\"\ndefinition OclStringc ::\"('\\)String\" (\"\\\") where \"\\ = (\\ _ . \\\\''c''\\\\)\"\ntext\\Etc.\\\ntext_raw\\\\isatagafp\\\n\nsubsection\\Validity and Definedness Properties\\\n\nlemma \"\\(null::('\\)String) = false\" by simp\nlemma \"\\(null::('\\)String) = true\" by simp\n\n\n\nlemma [simp,code_unfold]: \"\\ (\\_. \\\\n\\\\) = true\"\nby(simp add:valid_def true_def\n bot_fun_def bot_option_def)\n\n(* ecclectic proofs to make examples executable *)\nlemma [simp,code_unfold]: \"\\ \\ = true\" by(simp add:OclStringa_def)\nlemma [simp,code_unfold]: \"\\ \\ = true\" by(simp add:OclStringa_def)\ntext_raw\\\\endisatagafp\\\n\nsubsection\\String Operations\\\n\nsubsubsection\\Definition\\\ntext\\Here is a common case of a built-in operation on built-in types.\nNote that the arguments must be both defined (non-null, non-bot).\\\ntext\\Note that we can not follow the lexis of the OCL Standard for Isabelle\ntechnical reasons; these operators are heavily overloaded in the HOL library\nthat a further overloading would lead to heavy technical buzz in this\ndocument.\n\\\ndefinition OclAdd\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g ::\"('\\)String \\ ('\\)String \\ ('\\)String\" (infix \"+\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g\" 40)\nwhere \"x +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g y \\ \\ \\. if (\\ x) \\ = true \\ \\ (\\ y) \\ = true \\\n then \\\\concat [\\\\x \\\\\\, \\\\y \\\\\\]\\\\\n else invalid \\ \"\ninterpretation OclAdd\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g : profile_bin\\<^sub>d_\\<^sub>d \"(+\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g)\" \"\\ x y. \\\\concat [\\\\x\\\\, \\\\y\\\\]\\\\\"\n by unfold_locales (auto simp:OclAdd\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g_def bot_option_def null_option_def)\n \n(* TODO : size(), concat, substring(s:string) toInteger, toReal, at(i:Integer), characters() etc. *)\n\n\nsubsubsection\\Basic Properties\\\n\nlemma OclAdd\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g_not_commute: \"\\X Y. (X +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g Y) \\ (Y +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g X)\"\n apply(rule_tac x = \"\\_. \\\\''b''\\\\\" in exI)\n apply(rule_tac x = \"\\_. \\\\''a''\\\\\" in exI)\n apply(simp_all add:OclAdd\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g_def)\n by(auto, drule fun_cong, auto)\n\n\nsubsection\\Test Statements\\\ntext\\Here follows a list of code-examples, that explain the meanings\nof the above definitions by compilation to code and execution to @{term \"True\"}.\\\n(*\nAssert \"\\ \\ ( \\ \\\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\\\ )\"\nAssert \"\\ \\ (( \\ +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\ ) \\\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\\\ )\"\nAssert \"\\ |\\ (( \\ +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g ( \\ +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\ )) <\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\\\ )\"\nAssert \"\\ \\ not (\\ (null +\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g \\)) \"\n*)\n\ntext\\Here follows a list of code-examples, that explain the meanings\nof the above definitions by compilation to code and execution to @{term \"True\"}.\\\n\n\ntext\\Elementary computations on String\\\n\nAssert \"\\ \\ \\ <> \\\"\nAssert \"\\ \\ \\ <> \\\"\nAssert \"\\ \\ \\ \\ \\\"\n\nAssert \"\\ \\ \\ \\\"\nAssert \"\\ \\ \\ \\\"\nAssert \"\\ \\ \\ (null::('\\)String)\"\nAssert \"\\ \\ (invalid \\ invalid)\"\nAssert \"\\ \\ (null \\ null)\"\nAssert \"\\ \\ (\\ \\ \\)\"\nAssert \"\\ |\\ (\\ \\ \\)\"\nAssert \"\\ |\\ (invalid \\ \\)\"\nAssert \"\\ |\\ (null \\ \\)\"\nAssert \"\\ |\\ (invalid \\ (invalid::('\\)String))\" (* Without typeconstraint not executable.*)\nAssert \"\\ |\\ \\ (invalid \\ (invalid::('\\)String))\" (* Without typeconstraint not executable.*)\nAssert \"\\ |\\ (invalid <> (invalid::('\\)String))\" (* Without typeconstraint not executable.*)\nAssert \"\\ |\\ \\ (invalid <> (invalid::('\\)String))\" (* Without typeconstraint not executable.*)\nAssert \"\\ \\ (null \\ (null::('\\)String) )\" (* Without typeconstraint not executable.*)\nAssert \"\\ \\ (null \\ (null::('\\)String) )\" (* Without typeconstraint not executable.*)\nAssert \"\\ \\ (\\ \\ \\)\"\nAssert \"\\ |\\ (\\ <> \\)\"\nAssert \"\\ |\\ (\\ \\ \\)\"\nAssert \"\\ \\ (\\ <> \\)\"\n(*Assert \"\\ |\\ (\\ <\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g null)\"\nAssert \"\\ |\\ (\\ (\\ <\\<^sub>s\\<^sub>t\\<^sub>r\\<^sub>i\\<^sub>n\\<^sub>g null))\"\n*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Featherweight_OCL/basic_types/UML_String.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2724597514414508}} {"text": "(* Title: HOL/NanoJava/TypeRel.thy\n Author: David von Oheimb, Technische Universitaet Muenchen\n*)\n\nsection \"Type relations\"\n\ntheory TypeRel\nimports Decl\nbegin\n\ntext\\Direct subclass relation\\\n\ndefinition subcls1 :: \"(cname \\ cname) set\"\nwhere\n \"subcls1 \\ {(C,D). C\\Object \\ (\\c. class C = Some c \\ super c=D)}\"\n\nabbreviation\n subcls1_syntax :: \"[cname, cname] => bool\" (\"_ \\C1 _\" [71,71] 70)\n where \"C \\C1 D == (C,D) \\ subcls1\"\nabbreviation\n subcls_syntax :: \"[cname, cname] => bool\" (\"_ \\C _\" [71,71] 70)\n where \"C \\C D == (C,D) \\ subcls1^*\"\n\n\nsubsection \"Declarations and properties not used in the meta theory\"\n\ntext\\Widening, viz. method invocation conversion\\\ninductive\n widen :: \"ty => ty => bool\" (\"_ \\ _\" [71,71] 70)\nwhere\n refl [intro!, simp]: \"T \\ T\"\n| subcls: \"C\\C D \\ Class C \\ Class D\"\n| null [intro!]: \"NT \\ R\"\n\nlemma subcls1D: \n \"C\\C1D \\ C \\ Object \\ (\\c. class C = Some c \\ super c=D)\"\napply (unfold subcls1_def)\napply auto\ndone\n\nlemma subcls1I: \"\\class C = Some m; super m = D; C \\ Object\\ \\ C\\C1D\"\napply (unfold subcls1_def)\napply auto\ndone\n\nlemma subcls1_def2: \n \"subcls1 = \n (SIGMA C: {C. is_class C} . {D. C\\Object \\ super (the (class C)) = D})\"\napply (unfold subcls1_def is_class_def)\napply (auto split:if_split_asm)\ndone\n\nlemma finite_subcls1: \"finite subcls1\"\napply(subst subcls1_def2)\napply(rule finite_SigmaI [OF finite_is_class])\napply(rule_tac B = \"{super (the (class C))}\" in finite_subset)\napply auto\ndone\n\ndefinition ws_prog :: \"bool\" where\n \"ws_prog \\ \\(C,c)\\set Prog. C\\Object \\ \n is_class (super c) \\ (super c,C)\\subcls1^+\"\n\nlemma ws_progD: \"\\class C = Some c; C\\Object; ws_prog\\ \\ \n is_class (super c) \\ (super c,C)\\subcls1^+\"\napply (unfold ws_prog_def class_def)\napply (drule_tac map_of_SomeD)\napply auto\ndone\n\nlemma subcls1_irrefl_lemma1: \"ws_prog \\ subcls1^-1 \\ subcls1^+ = {}\"\nby (fast dest: subcls1D ws_progD)\n\n(* irrefl_tranclI in Transitive_Closure.thy is more general *)\nlemma irrefl_tranclI': \"r^-1 Int r^+ = {} ==> !x. (x, x) ~: r^+\"\nby(blast elim: tranclE dest: trancl_into_rtrancl)\n\n\nlemmas subcls1_irrefl_lemma2 = subcls1_irrefl_lemma1 [THEN irrefl_tranclI']\n\nlemma subcls1_irrefl: \"\\(x, y) \\ subcls1; ws_prog\\ \\ x \\ y\"\napply (rule irrefl_trancl_rD)\napply (rule subcls1_irrefl_lemma2)\napply auto\ndone\n\nlemmas subcls1_acyclic = subcls1_irrefl_lemma2 [THEN acyclicI]\n\nlemma wf_subcls1: \"ws_prog \\ wf (subcls1\\)\"\nby (auto intro: finite_acyclic_wf_converse finite_subcls1 subcls1_acyclic)\n\ndefinition class_rec ::\"cname \\ (class \\ ('a \\ 'b) list) \\ ('a \\ 'b)\"\nwhere\n \"class_rec \\ wfrec (subcls1\\) (\\rec C f.\n case class C of None \\ undefined\n | Some m \\ (if C = Object then empty else rec (super m) f) ++ map_of (f m))\"\n\nlemma class_rec: \"\\class C = Some m; ws_prog\\ \\\n class_rec C f = (if C = Object then empty else class_rec (super m) f) ++ \n map_of (f m)\"\napply (drule wf_subcls1)\napply (subst def_wfrec[OF class_rec_def], auto)\napply (subst cut_apply, auto intro: subcls1I)\ndone\n\n\\\\Methods of a class, with inheritance and hiding\\\ndefinition \"method\" :: \"cname => (mname \\ methd)\" where\n \"method C \\ class_rec C methods\"\n\nlemma method_rec: \"\\class C = Some m; ws_prog\\ \\\nmethod C = (if C=Object then empty else method (super m)) ++ map_of (methods m)\"\napply (unfold method_def)\napply (erule (1) class_rec [THEN trans])\napply simp\ndone\n\n\n\\\\Fields of a class, with inheritance and hiding\\\ndefinition field :: \"cname => (fname \\ ty)\" where\n \"field C \\ class_rec C flds\"\n\nlemma flds_rec: \"\\class C = Some m; ws_prog\\ \\\nfield C = (if C=Object then empty else field (super m)) ++ map_of (flds m)\"\napply (unfold field_def)\napply (erule (1) class_rec [THEN trans])\napply simp\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/NanoJava/TypeRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2723887262933196}} {"text": "header {* \\isachapter{Dynamic Slicing} \n \\isaheader{Dynamic Program Dependence Graph} *}\n\ntheory DynPDG imports \n \"../Basic/DynDataDependence\" \n \"../Basic/CFGExit_wf\" \n \"../Basic/DynStandardControlDependence\"\n \"../Basic/DynWeakControlDependence\"\nbegin\n\nsubsection {* The dynamic PDG *}\n\nlocale DynPDG = \n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\") +\n fixes dyn_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\" \n(\"_ controls _ via _\" [51,0,0])\n assumes Exit_not_dyn_control_dependent:\"n controls n' via as \\ n' \\ (_Exit_)\"\n assumes dyn_control_dependence_path:\n \"n controls n' via as \\ n -as\\* n' \\ as \\ []\"\n\nbegin\n\ninductive cdep_edge :: \"'node \\ 'edge list \\ 'node \\ bool\" \n (\"_ -_\\\\<^bsub>cd\\<^esub> _\" [51,0,0] 80)\n and ddep_edge :: \"'node \\ 'var \\ 'edge list \\ 'node \\ bool\"\n (\"_ -'{_'}_\\\\<^bsub>dd\\<^esub> _\" [51,0,0,0] 80)\n and DynPDG_edge :: \"'node \\ 'var option \\ 'edge list \\ 'node \\ bool\"\n\nwhere\n -- \"Syntax\"\n \"n -as\\\\<^bsub>cd\\<^esub> n' == DynPDG_edge n None as n'\"\n | \"n -{V}as\\\\<^bsub>dd\\<^esub> n' == DynPDG_edge n (Some V) as n'\"\n\n -- \"Rules\"\n | DynPDG_cdep_edge:\n \"n controls n' via as \\ n -as\\\\<^bsub>cd\\<^esub> n'\"\n\n | DynPDG_ddep_edge:\n \"n influences V in n' via as \\ n -{V}as\\\\<^bsub>dd\\<^esub> n'\"\n\n\ninductive DynPDG_path :: \"'node \\ 'edge list \\ 'node \\ bool\"\n(\"_ -_\\\\<^sub>d* _\" [51,0,0] 80) \n\nwhere DynPDG_path_Nil:\n \"valid_node n \\ n -[]\\\\<^sub>d* n\"\n\n | DynPDG_path_Append_cdep:\n \"\\n -as\\\\<^sub>d* n''; n'' -as'\\\\<^bsub>cd\\<^esub> n'\\ \\ n -as@as'\\\\<^sub>d* n'\"\n\n | DynPDG_path_Append_ddep:\n \"\\n -as\\\\<^sub>d* n''; n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'\\ \\ n -as@as'\\\\<^sub>d* n'\"\n\n\nlemma DynPDG_empty_path_eq_nodes:\"n -[]\\\\<^sub>d* n' \\ n = n'\"\napply - apply(erule DynPDG_path.cases) \n apply simp\n apply(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\nby(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n\n\nlemma DynPDG_path_cdep:\"n -as\\\\<^bsub>cd\\<^esub> n' \\ n -as\\\\<^sub>d* n'\"\napply(subgoal_tac \"n -[]@as\\\\<^sub>d* n'\")\n apply simp\napply(rule DynPDG_path_Append_cdep, rule DynPDG_path_Nil)\nby(auto elim!:DynPDG_edge.cases dest:dyn_control_dependence_path path_valid_node)\n\nlemma DynPDG_path_ddep:\"n -{V}as\\\\<^bsub>dd\\<^esub> n' \\ n -as\\\\<^sub>d* n'\"\napply(subgoal_tac \"n -[]@as\\\\<^sub>d* n'\")\n apply simp\napply(rule DynPDG_path_Append_ddep, rule DynPDG_path_Nil)\nby(auto elim!:DynPDG_edge.cases dest:path_valid_node simp:dyn_data_dependence_def)\n\nlemma DynPDG_path_Append:\n \"\\n'' -as'\\\\<^sub>d* n'; n -as\\\\<^sub>d* n''\\ \\ n -as@as'\\\\<^sub>d* n'\"\napply(induct rule:DynPDG_path.induct)\n apply(auto intro:DynPDG_path.intros)\n apply(rotate_tac 1,drule DynPDG_path_Append_cdep,simp+)\napply(rotate_tac 1,drule DynPDG_path_Append_ddep,simp+)\ndone\n\n\nlemma DynPDG_path_Exit:\"\\n -as\\\\<^sub>d* n'; n' = (_Exit_)\\ \\ n = (_Exit_)\"\napply(induct rule:DynPDG_path.induct)\nby(auto elim:DynPDG_edge.cases dest:Exit_not_dyn_control_dependent \n simp:dyn_data_dependence_def)\n\n\nlemma DynPDG_path_not_inner:\n \"\\n -as\\\\<^sub>d* n'; \\ inner_node n'\\ \\ n = n'\"\nproof(induct rule:DynPDG_path.induct)\n case (DynPDG_path_Nil n)\n thus ?case by simp\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n from `n'' -as'\\\\<^bsub>cd\\<^esub> n'` `\\ inner_node n'` have False\n apply -\n apply(erule DynPDG_edge.cases) apply(auto simp:inner_node_def)\n apply(fastforce dest:dyn_control_dependence_path path_valid_node)\n apply(fastforce dest:dyn_control_dependence_path path_valid_node)\n by(fastforce dest:Exit_not_dyn_control_dependent)\n thus ?case by simp\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n from `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'` `\\ inner_node n'` have False\n apply -\n apply(erule DynPDG_edge.cases) \n by(auto dest:path_valid_node simp:inner_node_def dyn_data_dependence_def)\n thus ?case by simp\nqed\n\n\nlemma DynPDG_cdep_edge_CFG_path:\n assumes \"n -as\\\\<^bsub>cd\\<^esub> n'\" shows \"n -as\\* n'\" and \"as \\ []\"\n using `n -as\\\\<^bsub>cd\\<^esub> n'`\n by(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n\nlemma DynPDG_ddep_edge_CFG_path:\n assumes \"n -{V}as\\\\<^bsub>dd\\<^esub> n'\" shows \"n -as\\* n'\" and \"as \\ []\"\n using `n -{V}as\\\\<^bsub>dd\\<^esub> n'`\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n\nlemma DynPDG_path_CFG_path:\n \"n -as\\\\<^sub>d* n' \\ n -as\\* n'\"\nproof(induct rule:DynPDG_path.induct)\n case DynPDG_path_Nil thus ?case by(rule empty_path)\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n from `n'' -as'\\\\<^bsub>cd\\<^esub> n'` have \"n'' -as'\\* n'\"\n by(rule DynPDG_cdep_edge_CFG_path(1))\n with `n -as\\* n''` show ?case by(rule path_Append)\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n from `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'` have \"n'' -as'\\* n'\"\n by(rule DynPDG_ddep_edge_CFG_path(1))\n with `n -as\\* n''` show ?case by(rule path_Append)\nqed\n\n\nlemma DynPDG_path_split: \n \"n -as\\\\<^sub>d* n' \\\n (as = [] \\ n = n') \\ \n (\\n'' asx asx'. (n -asx\\\\<^bsub>cd\\<^esub> n'') \\ (n'' -asx'\\\\<^sub>d* n') \\ \n (as = asx@asx')) \\\n (\\n'' V asx asx'. (n -{V}asx\\\\<^bsub>dd\\<^esub> n'') \\ (n'' -asx'\\\\<^sub>d* n') \\ \n (as = asx@asx'))\"\nproof(induct rule:DynPDG_path.induct)\n case (DynPDG_path_Nil n) thus ?case by auto\nnext\n case (DynPDG_path_Append_cdep n as n'' as' n')\n note IH = `as = [] \\ n = n'' \\\n (\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')`\n from IH show ?case\n proof\n assume \"as = [] \\ n = n''\"\n with `n'' -as'\\\\<^bsub>cd\\<^esub> n'` have \"valid_node n'\"\n by(fastforce intro:path_valid_node(2) DynPDG_path_CFG_path \n DynPDG_path_cdep)\n with `as = [] \\ n = n''` `n'' -as'\\\\<^bsub>cd\\<^esub> n'`\n have \"\\n'' asx asx'. n -asx\\\\<^bsub>cd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by(auto intro:DynPDG_path_Nil)\n thus ?thesis by simp\n next\n assume \"(\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\"\n thus ?thesis\n proof\n assume \"\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx asx asx' where \"n -asx\\\\<^bsub>cd\\<^esub> nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from `n'' -as'\\\\<^bsub>cd\\<^esub> n'` have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_cdep)\n with `nx -asx'\\\\<^sub>d* n''` have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with `n -asx\\\\<^bsub>cd\\<^esub> nx` `as = asx@asx'`\n have \"\\n'' asx asx'. n -asx\\\\<^bsub>cd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n next\n assume \"\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx V asx asx' where \"n -{V}asx\\\\<^bsub>dd\\<^esub> nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from `n'' -as'\\\\<^bsub>cd\\<^esub> n'` have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_cdep)\n with `nx -asx'\\\\<^sub>d* n''` have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with `n -{V}asx\\\\<^bsub>dd\\<^esub> nx` `as = asx@asx'`\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n qed\n qed\nnext\n case (DynPDG_path_Append_ddep n as n'' V as' n')\n note IH = `as = [] \\ n = n'' \\\n (\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')`\n from IH show ?case\n proof\n assume \"as = [] \\ n = n''\"\n with `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'` have \"valid_node n'\"\n by(fastforce intro:path_valid_node(2) DynPDG_path_CFG_path \n DynPDG_path_ddep)\n with `as = [] \\ n = n''` `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'`\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by(fastforce intro:DynPDG_path_Nil)\n thus ?thesis by simp\n next\n assume \"(\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx') \\\n (\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx')\"\n thus ?thesis\n proof\n assume \"\\nx asx asx'. n -asx\\\\<^bsub>cd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx asx asx' where \"n -asx\\\\<^bsub>cd\\<^esub> nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'` have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_ddep)\n with `nx -asx'\\\\<^sub>d* n''` have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with `n -asx\\\\<^bsub>cd\\<^esub> nx` `as = asx@asx'`\n have \"\\n'' asx asx'. n -asx\\\\<^bsub>cd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n next\n assume \"\\nx V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> nx \\ nx -asx'\\\\<^sub>d* n'' \\ as = asx@asx'\"\n then obtain nx V' asx asx' where \"n -{V'}asx\\\\<^bsub>dd\\<^esub> nx\" and \"nx -asx'\\\\<^sub>d* n''\"\n and \"as = asx@asx'\" by auto\n from `n'' -{V}as'\\\\<^bsub>dd\\<^esub> n'` have \"n'' -as'\\\\<^sub>d* n'\" by(rule DynPDG_path_ddep)\n with `nx -asx'\\\\<^sub>d* n''` have \"nx -asx'@as'\\\\<^sub>d* n'\"\n by(fastforce intro:DynPDG_path_Append)\n with `n -{V'}asx\\\\<^bsub>dd\\<^esub> nx` `as = asx@asx'`\n have \"\\n'' V asx asx'. n -{V}asx\\\\<^bsub>dd\\<^esub> n'' \\ n'' -asx'\\\\<^sub>d* n' \\ as@as' = asx@asx'\"\n by auto\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma DynPDG_path_rev_cases [consumes 1,\n case_names DynPDG_path_Nil DynPDG_path_cdep_Append DynPDG_path_ddep_Append]:\n \"\\n -as\\\\<^sub>d* n'; \\as = []; n = n'\\ \\ Q;\n \\n'' asx asx'. \\n -asx\\\\<^bsub>cd\\<^esub> n''; n'' -asx'\\\\<^sub>d* n'; \n as = asx@asx'\\ \\ Q;\n \\V n'' asx asx'. \\n -{V}asx\\\\<^bsub>dd\\<^esub> n''; n'' -asx'\\\\<^sub>d* n'; \n as = asx@asx'\\ \\ Q\\\n \\ Q\"\nby(blast dest:DynPDG_path_split)\n\n\n\nlemma DynPDG_ddep_edge_no_shorter_ddep_edge:\n assumes ddep:\"n -{V}as\\\\<^bsub>dd\\<^esub> n'\"\n shows \"\\as' a as''. tl as = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\nproof -\n from ddep have influence:\"n influences V in n' via as\"\n by(auto elim!:DynPDG_edge.cases)\n then obtain a asx where as:\"as = a#asx\"\n and notin:\"n \\ set (sourcenodes asx)\"\n by(auto dest:dyn_influence_source_notin_tl_edges simp:dyn_data_dependence_def)\n from influence as\n have imp:\"\\nx \\ set (sourcenodes asx). V \\ Def nx\"\n by(auto simp:dyn_data_dependence_def)\n { fix as' a' as'' \n assume eq:\"tl as = as'@a'#as''\"\n and ddep':\"sourcenode a' -{V}a'#as''\\\\<^bsub>dd\\<^esub> n'\"\n from eq as notin have noteq:\"sourcenode a' \\ n\" by(auto simp:sourcenodes_def)\n from ddep' have \"V \\ Def (sourcenode a')\"\n by(auto elim!:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with eq as noteq imp have False by(auto simp:sourcenodes_def) }\n thus ?thesis by blast\nqed\n\n\n\nlemma no_ddep_same_state:\n assumes path:\"n -as\\* n'\" and Uses:\"V \\ Use n'\" and preds:\"preds (kinds as) s\"\n and no_dep:\"\\as' a as''. as = as'@a#as'' \\ \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n shows \"state_val (transfers (kinds as) s) V = state_val s V\"\nproof -\n { fix n''\n assume inset:\"n'' \\ set (sourcenodes as)\" and Defs:\"V \\ Def n''\"\n hence \"\\nx \\ set (sourcenodes as). V \\ Def nx\" by auto\n then obtain nx ns' ns'' where nodes:\"sourcenodes as = ns'@nx#ns''\"\n and Defs':\"V \\ Def nx\" and notDef:\"\\nx' \\ set ns''. V \\ Def nx'\"\n by(fastforce elim!:rightmost_element_property)\n from nodes obtain as' a as''\n where as'':\"sourcenodes as'' = ns''\" and as:\"as=as'@a#as''\"\n and source:\"sourcenode a = nx\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from as path have path':\"sourcenode a -a#as''\\* n'\"\n by(fastforce dest:path_split_second)\n from notDef as'' source\n have \"\\n'' \\ set (sourcenodes as''). V \\ Def n''\"\n by(auto simp:sourcenodes_def)\n with path' Defs' Uses source\n have influence:\"nx influences V in n' via (a#as'')\"\n by(simp add:dyn_data_dependence_def)\n hence \"nx \\ set (sourcenodes as'')\" by(rule dyn_influence_source_notin_tl_edges)\n with influence source\n have \"\\asx a'. sourcenode a' -{V}a'#asx\\\\<^bsub>dd\\<^esub> n' \\ sourcenode a' = nx \\\n (\\asx'. a#as'' = asx'@a'#asx)\"\n by(fastforce intro:DynPDG_ddep_edge)\n with nodes no_dep as have False by(auto simp:sourcenodes_def) }\n hence \"\\n \\ set (sourcenodes as). V \\ Def n\" by auto\n with wf path preds show ?thesis by(fastforce intro:CFG_path_no_Def_equal)\nqed\n\n\nlemma DynPDG_ddep_edge_only_first_edge:\n \"\\n -{V}a#as\\\\<^bsub>dd\\<^esub> n'; preds (kinds (a#as)) s\\ \\ \n state_val (transfers (kinds (a#as)) s) V = state_val (transfer (kind a) s) V\"\n apply -\n apply(erule DynPDG_edge.cases)\n apply auto\n apply(frule dyn_influence_Cons_source)\n apply(frule dyn_influence_source_notin_tl_edges)\n by(erule dyn_influence_only_first_edge)\n\n\nlemma Use_value_change_implies_DynPDG_ddep_edge:\n assumes \"n -as\\* n'\" and \"V \\ Use n'\" and \"preds (kinds as) s\" \n and \"preds (kinds as) s'\" and \"state_val s V = state_val s' V\"\n and \"state_val (transfers (kinds as) s) V \\ \n state_val (transfers (kinds as) s') V\"\n obtains as' a as'' where \"as = as'@a#as''\"\n and \"sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\"\n and \"state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V\"\n and \"state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\nproof(atomize_elim)\n show \"\\as' a as''. as = as'@a#as'' \\\n sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n' \\\n state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V \\\n state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\n proof(cases \"\\as' a as''. as = as'@a#as'' \\\n \\ sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\")\n case True\n with `n -as\\* n'` `V \\ Use n'` `preds (kinds as) s` `preds (kinds as) s'`\n have \"state_val (transfers (kinds as) s) V = state_val s V\"\n and \"state_val (transfers (kinds as) s') V = state_val s' V\"\n by(auto intro:no_ddep_same_state)\n with `state_val s V = state_val s' V` \n `state_val (transfers (kinds as) s) V \\ state_val (transfers (kinds as) s') V`\n show ?thesis by simp\n next\n case False\n then obtain as' a as'' where [simp]:\"as = as'@a#as''\"\n and \"sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'\" by auto\n from `preds (kinds as) s` have \"preds (kinds (a#as'')) (transfers (kinds as') s)\"\n by(simp add:kinds_def preds_split)\n with `sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'` have all:\n \"state_val (transfers (kinds (a#as'')) (transfers (kinds as') s)) V = \n state_val (transfer (kind a) (transfers (kinds as') s)) V\"\n by(auto dest!:DynPDG_ddep_edge_only_first_edge)\n from `preds (kinds as) s'` \n have \"preds (kinds (a#as'')) (transfers (kinds as') s')\"\n by(simp add:kinds_def preds_split)\n with `sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'` have all':\n \"state_val (transfers (kinds (a#as'')) (transfers (kinds as') s')) V = \n state_val (transfer (kind a) (transfers (kinds as') s')) V\"\n by(auto dest!:DynPDG_ddep_edge_only_first_edge)\n hence eq:\"\\s. transfers (kinds as) s =\n transfers (kinds (a#as'')) (transfers (kinds as') s)\"\n by(simp add:transfers_split[THEN sym] kinds_def)\n with all have \"state_val (transfers (kinds as) s) V = \n state_val (transfers (kinds (as'@[a])) s) V\"\n by(simp add:transfers_split kinds_def)\n moreover\n from eq all' have \"state_val (transfers (kinds as) s') V = \n state_val (transfers (kinds (as'@[a])) s') V\"\n by(simp add:transfers_split kinds_def)\n ultimately show ?thesis using `sourcenode a -{V}a#as''\\\\<^bsub>dd\\<^esub> n'` by simp blast\n qed\nqed\n\n\nend\n\n\nsubsection {* Instantiate dynamic PDG *}\n\nsubsubsection {* Standard control dependence *}\n\nlocale DynStandardControlDependencePDG =\n Postdomination sourcenode targetnode kind valid_edge Entry Exit +\n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\nlemma DynPDG_scd:\n \"DynPDG sourcenode targetnode kind valid_edge (_Entry_) \n Def Use state_val (_Exit_) dyn_standard_control_dependence\"\nproof(unfold_locales)\n fix n n' as assume \"n controls\\<^sub>s n' via as\"\n show \"n' \\ (_Exit_)\"\n proof\n assume \"n' = (_Exit_)\"\n with `n controls\\<^sub>s n' via as` show False\n by(fastforce intro:Exit_not_dyn_standard_control_dependent)\n qed\nnext\n fix n n' as assume \"n controls\\<^sub>s n' via as\"\n thus \"n -as\\* n' \\ as \\ []\"\n by(fastforce simp:dyn_standard_control_dependence_def)\nqed\n\n\nend\n\nsubsubsection {* Weak control dependence *}\n\nlocale DynWeakControlDependencePDG = \n StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit +\n CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\n\n\n\nend\n\n\nsubsection {* Data slice *}\n\ndefinition (in CFG) empty_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\"\nwhere \"empty_control_dependence n n' as \\ False\"\n\nlemma (in CFGExit_wf) DynPDG_scd:\n \"DynPDG sourcenode targetnode kind valid_edge (_Entry_)\n Def Use state_val (_Exit_) empty_control_dependence\"\nproof(unfold_locales)\n fix n n' as assume \"empty_control_dependence n n' as\"\n thus \"n' \\ (_Exit_)\" by(simp add:empty_control_dependence_def)\nnext\n fix n n' as assume \"empty_control_dependence n n' as\"\n thus \"n -as\\* n' \\ as \\ []\" by(simp add:empty_control_dependence_def)\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/Dynamic/DynPDG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2723887262933196}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n \"HOL-Word.WordBitwise\"\n WordBitwise_Signed\n Hex_Words\n Norm_Words\n Word_Type_Syntax\nbegin\n\ntext \\Additional bit and type syntax that forces word types.\\\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n wordNOT :: \"'a::len0 word \\ 'a word\" (\"~~ _\" [70] 71)\nwhere\n \"~~ x == NOT x\"\n\nabbreviation\n wordAND :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"&&\" 64)\nwhere\n \"a && b == a AND b\"\n\nabbreviation\n wordOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"||\" 59)\nwhere\n \"a || b == a OR b\"\n\nabbreviation\n wordXOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"xor\" 59)\nwhere\n \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.2723071079838147}} {"text": "subsection \\<^marker>\\tag aponly\\ \\Single Non-Empty World Structures\\\n\ntheory SingleWorldStructure\n imports ParticularStructureMorphisms\nbegin\n\nlocale single_world_particular_struct = \n particular_struct where Typ\\<^sub>p = Typ\\<^sub>p and Typ\\<^sub>q = Typ\\<^sub>q\n for Typ\\<^sub>p :: \\'p itself\\ and Typ\\<^sub>q :: \\'q itself\\ +\n assumes\n only_empty_and_another_world: \\\\w \\ \\. \\ = {\\,w}\\\nbegin\n\ndefinition \\\\ \\ THE w. w \\ \\ \\ w \\ \\\\\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_non_empty_world_unique: \\\\!w. w \\ \\ \\ w \\ \\\\\n using only_empty_and_another_world \n by (metis empty_iff insert_iff)\n\nlemma \\<^marker>\\tag (proof) aponly\\ single_world[simp,intro!]: \\\\ \\ \\\\ \\\\ \\ \\\\\n by (simp only: \\_def ; rule the1I2[OF sw_non_empty_world_unique] ; simp)+\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_worlds_case[cases set]:\n assumes \\w \\ \\\\\n obtains (empty) \\w = \\\\ | (single) \\w = \\\\\n using assms only_empty_and_another_world single_world\n by blast \n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_in_worlds[dest!]: \\\\ w \\ \\ ; x \\ w \\ \\ w = \\ \\ x \\ \\\\ \n using sw_worlds_case by auto\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_particulars_simp[simp]: \\endurants = \\\\\n apply (simp only: \\

_def)\n by blast\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_worlds_simp: \\\\ = {\\, \\}\\ \n using only_empty_and_another_world single_world(2) by blast\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_particulars_I[iff]: \\x \\ \\

\\\\\\ op_sel TY (\\V_pair rawc (\\V_pair rawb rawa)) \\\n a \\ \\\\\\[rawa] A\\ b \\ \\\\\\[rawb] B\\ c \\ \\\\\\[rawc] \\\n \\ (if c then a else b) \\ \\\\\\ (if c then A else B)\n \\\\\n unfolding op_sel_def\n by (cases rawc; cases rawb; cases rawa; cases c; simp add: \\SemType_def subset_iff,\n rule, rule, rule, simp add: \\expns WT_bool, blast, rule, simp add: \\expns WT_bool, rule,\n simp add: \\expns WT_bool, rule, simp add: \\expns WT_bool)\n\nlemma branch_\\app:\n \\ (\\

\\\\\\\\\\\\ C \\ \\

\\\\\\ br\\<^sub>T \\ X \\ Y\\<^sub>T \\ \\\\\\\\\\\\ E\\<^sub>T )\n\\ (\\

\\\\\\\\\\\\ \\ C \\ \\

\\\\\\ br\\<^sub>F \\ X \\ Y\\<^sub>F \\ \\\\\\\\\\\\ E\\<^sub>F )\n\\ (\\v. If C (Y\\<^sub>T v) (Y\\<^sub>F v) \\\\\\

\\\\\\\\ Y v @action invoke_branch_convergence)\n\\ \\

\\\\\\ op_if br\\<^sub>T br\\<^sub>F rawc \\ X\\ C \\ \\\\\\[rawc] \\ \\ Y \\ \\\\\\\\\\\\ (\\e. (E\\<^sub>T e \\\\\\\\ C) + (E\\<^sub>F e \\\\\\\\ \\ C)) \\\n unfolding op_if_def Premise_def Action_Tag_def\n apply (cases rawc; cases C; simp; rule; simp add: \\expns WT_bool)\n using \\CONSEQ view_shift_by_implication view_shift_refl by blast+\n\nproc \"if\":\n assumes C: \\\\

\\\\\\ cond \\ X \\ X1\\ \\\\\\ C \\ \\ \\ \\\\\\\\\\\\ E \\\n and brT: \\\\

\\\\\\\\\\\\ C \\ \\

\\\\\\ brT \\ X1 \\ Y\\<^sub>T \\ \\\\\\\\\\\\ E\\<^sub>T \\\n and brF: \\\\

\\\\\\\\\\\\ \\ C \\ \\

\\\\\\ brF \\ X1 \\ Y\\<^sub>F \\ \\\\\\\\\\\\ E\\<^sub>F \\\n and BC: \\(\\v. If C (Y\\<^sub>T v) (Y\\<^sub>F v) \\\\\\

\\\\\\\\ Y v @action invoke_branch_convergence)\\\n input \\X\\\n output \\Y\\\n throws \\E + E\\<^sub>T + E\\<^sub>F\\\n \\ C branch brT brF BC \\. .\n\n\nsubsection \\Loops\\\n\nlemma \"__DoWhile__rule_\\app\":\n \" \\

\\\\\\ body \\ X x \\\\\\\\ x. P x \\ (\\*x'. X x' \\ \\\\\\ P x' \\ \\) \\ \\\\\\\\\\\\ E\n\\ \\

\\\\\\ op_do_while body \\ X x \\\\\\\\ x. P x \\ X x' \\\\\\\\ x'. \\ P x' \\ \\\\\\\\\\\\ E \"\n unfolding op_do_while_def \\Procedure_def\n apply (simp add: subset_iff LooseStateSpec_expn')\n apply (rule allI impI conjI)+\n subgoal for comp R s\n apply (rotate_tac 2)\n apply (induct body comp s rule: SemDoWhile.induct; clarsimp simp add: \\expns times_list_def)\n apply fastforce\n subgoal premises prems for res f s s'' c u v proof -\n have t1: \\\\c. (\\fic. (\\u v. fic = u * v \\ u \\ R \\ v \\ X c \\ u ## v) \\ s \\ INTERP_RES fic) \\ P c\\\n using prems(5) prems(6) prems(7) prems(8) prems(9) by blast\n show ?thesis\n apply (insert \\\\_ _. (\\_. _) \\ _\\[THEN spec[where x=s], THEN spec[where x=R], THEN mp, OF t1])\n using prems(1) prems(3) by fastforce\n qed\n apply fastforce\n by blast .\n\nproc (nodef) do_while:\nassumes \\\\

\\\\\\\\ ( X' x \\\\\\\\ x. Inv: invariant x \\ Guard: cond x)\\\n and V: \\X \\\\\\

\\\\\\\\ ( X' x \\\\\\\\ x. invariant x \\ cond x) \\\\\\ Any @action ToSA\\\nassumes B: \\\\x. \\

\\\\\\\\\\\\ cond x \\ \\

\\\\\\\\\\\\ invariant x\n \\ \\

\\\\\\ body \\ X' x \\ (X' x'\\ \\\\\\ cond x' \\ \\ \\\\\\\\ x'. invariant x') \\ \\\\\\\\\\\\ E \\\ninput \\X\\\noutput \\X' x' \\\\\\\\ x'. invariant x' \\ \\ cond x'\\\nthrows E\n \\\n V[unfolded Action_Tag_def]\n \"__DoWhile__rule_\\app\"[where P=cond and X=\\\\x'. X' x' \\\\\\\\ invariant x'\\, simplified]\n \\ B \\.\n \\ by simp .\n\nproc while:\n assumes \\\\

\\\\\\\\ ( X x \\\\\\\\ x. Inv: invariant x \\ Guard: cond x)\\\n assumes V[unfolded Action_Tag_def]:\n \"X' \\\\\\

\\\\\\\\ ((X x \\\\\\\\\\\\\\ R) \\\\\\\\ x. invariant x) \\\\\\ Any @action ToSA\"\n and C: \"\\x. \\

\\\\\\\\\\\\ invariant x \\ \\

\\\\\\ Cond \\ R\\ X x \\ R\\ X x'\\ \\\\\\ cond x' \\ \\ \\\\\\\\ x'. invariant x' \\ \\\\\\\\\\\\ E1\"\n and B: \"\\x. \\

\\\\\\\\\\\\ invariant x \\ \\

\\\\\\\\\\\\ cond x \\ \\

\\\\\\ Body \\ R\\ X x \\ R\\ X x' \\\\\\\\ x'. invariant x' \\ \\\\\\\\\\\\ E2\"\n input \\X'\\\n output \\R\\ X x \\\\\\\\ x. invariant x \\ \\ cond x\\\n throws \\E1 + E2\\\n \\ V C\n branch \\\n do_while \\R\\ X vars \\\\\\\\ vars. Inv: invariant vars \\ Guard: cond vars\\\n \\ B C \\.\n \\.\n \\ \\ for \\R\\ X vars \\\\\\\\ vars. invariant vars \\ \\ cond vars\\ ..\n \\ .. .\n\n(*\nWe fail to infer the abstraction of the loop guard automatically but\nrequire users to give by an annotation.\nThe main difficulty is about the nondeterminancy in higher-order unification.\nIn \\<^term>\\cond x' \\ \\\\ in the above rule, both \\cond\\ and \\x'\\ are schematic variables,\nwhich means we cannot determine either of them via unification.\nEven though the abstract state \\x'\\ may be determined possibly in the unification of \\X x'\\,\nto infer \\cond x'\\ it is still a problem especially when \\x'\\ is not a variable but a compounded\nterm and its expression may be shattered in and mixed up with the expression of \\cond\\ after\nsimplifications like beta reduction,\ncausing it is very difficult to recover the actual abstract guard\n\\cond\\ from the reduced composition \\cond x'\\.\n*)\n\n\nsubsection \\Recursion\\\n\nlemma \"__op_recursion_simp__\":\n \"(\\g x' v'. (\\x'' v''. \\

\\\\\\ g v'' \\ X x'' v'' \\ \\ret. Y x'' ret \\ \\\\\\\\\\\\ E x'')\n \\ \\

\\\\\\ F g v' \\ X x' v' \\ \\ret. Y x' ret \\ \\\\\\\\\\\\ E x' )\n\\ \\x v. \\

\\\\\\ op_fix_point F v \\ X x v \\ \\ret. Y x ret \\ \\\\\\\\\\\\ E x\"\n unfolding op_fix_point_def \\Procedure_def atomize_all\n apply (clarsimp simp add: SemRec_deterministic2 del: subsetI)\n\n subgoal for x v comp a R\n apply (rotate_tac 1) apply (induct rule: SemRec.induct)\n\n subgoal premises prems for F v res y\n using prems(3)[of \\\\_ _. {AssumptionBroken}\\ x v, simplified, THEN spec[where x=res],\n THEN spec[where x=R], THEN mp, OF prems(2), unfolded prems(1)] .\n by simp .\n\ntext \\Instead, we use a variant of the above rule which in addition annotates the names\n of the values.\\\n\nlemma \"__op_recursion__\":\n \"(\\g x' (v':: 'a::VALs \\arg 'names).\n P x'\n \\ PROP Labelled label (HIDDEN_PREM\n (\\x'' (v''::'a \\arg 'names).\n P x'' \\\n \\

\\\\\\ g (case_named id v'') \\ case_named (X x'') v'' \\ \\ret. Y x'' ret \\ \\\\\\\\\\\\ E x''))\n \\ \\

\\\\\\ F g (case_named id v') \\ case_named (X x') v' \\ \\ret. Y x' ret \\ \\\\\\\\\\\\ E x' )\n\\ PROP Pure.prop (\n P x \\\n \\

\\\\\\ op_fix_point F v \\ X x v \\ \\ret. Y x ret \\ \\\\\\\\\\\\ E x\n)\"\n unfolding op_fix_point_def \\Procedure_def atomize_all \\arg_forall \\arg_All HIDDEN_PREM_def\n Pure.prop_def\n apply (clarsimp simp add: SemRec_deterministic2 del: subsetI)\n\n subgoal for comp a R\n apply (rotate_tac 2) apply (induct rule: SemRec.induct)\n\n subgoal premises prems for F v res y\n using prems(3)[OF prems(4),\n of \\\\_ _. {AssumptionBroken}\\ v, simplified, THEN spec[where x=res],\n THEN spec[where x=R], THEN mp, OF prems(2), unfolded prems(1)] .\n by simp .\n\n\nML_file \\library/basic_recursion.ML\\\n\nattribute_setup recursive = \\Scan.repeat (Scan.lift Parse.term) >> (fn vars =>\n Phi_Modifier.wrap_to_attribute (fn (ctxt,sequent) =>\n case Phi_Toplevel.name_of_the_building_procedure ctxt\n of NONE => error \"Name binding of the recursive procedure is mandatory.\"\n | SOME b => (\n if Binding.is_empty b\n then error \"Name binding of the recursive procedure is mandatory.\"\n else if null vars then tracing \"You may want to use syntax \\recursive vars\\ to indicate \\\n \\which variables are varied between the recursive callings.\" else ();\n PhiSem_Control_Flow.basic_recursive_mod Syntax.read_terms b vars (ctxt,sequent)\n )\n ))\\\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics/PhiSem_CF_Basic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.550607350786733, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2688524267169906}} {"text": "section \\Preparing Partial Order Reduction\\\ntheory SM_Visible\nimports \"../RefPoint/SM_LTL\" Rename_Cfg\nbegin\n\n section \\Visible Part of State\\\n\n locale visible_prog = well_typed_prog +\n fixes is_vis_var :: \"ident \\ bool\"\n begin\n abbreviation \"vis_vars \\ Collect is_vis_var\"\n\n definition interp_gs :: \"global_state \\ exp set\" where\n \"interp_gs gs \\ sm_props (global_state.variables gs |` vis_vars)\"\n \n definition interp_gc :: \"global_config \\ exp set\" where\n \"interp_gc gc \\ interp_gs (global_config.state gc)\"\n \n sublocale lv: Gen_Scheduler'_linit\n cfgc la_en' la_ex' \n \"{init_gc}\" interp_gc .\n\n lemma lv_accept_conv: \"lv.sa.accept w \n \\ (\\w'. w=interp_gs o w' \\ ref_accept prog w')\"\n unfolding lih'_accept_eq[symmetric]\n unfolding lih'.sa.accept_def lv.sa.accept_def\n unfolding lih'.sa.is_run_def\n unfolding lv.sa.is_run_def\n apply simp\n unfolding interp_gc_def[abs_def]\n by fastforce\n\n end\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/SM_Visible.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2686331583521772}} {"text": "\n\ntheory X86_Parse_Hoare_Triples\n imports X86_InstructionSemantics\n keywords \"htriple\" :: thy_decl\n\n and \"Separations\" \"Assertions\" \"Pre\" \"Post\" \"Instruction\" \"FunctionConstraints\" :: quasi_command\n\nbegin\n\ncontext semantics\nbegin \n\nlemma ucast_take_bits_8[simp]:\n fixes a :: \"'b::len word\" \n assumes \"LENGTH('b) > 8\"\n shows \"((ucast (\\0,8\\a)::'a ::len word) = ucast (ucast a :: 8 word))\"\n using assms\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\nlemma ucast_take_bits_16[simp]:\n fixes a :: \"'b::len word\" \n assumes \"LENGTH('b) > 16\"\n shows \"((ucast (\\0,16\\a)::'a::len word) = ucast (ucast a :: 16 word))\"\n using assms\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\nlemma ucast_take_bits_32[simp]:\n fixes a :: \"'b::len word\" \n assumes \"LENGTH('b) > 32\"\n shows \"((ucast (\\0,32\\a)::'a::len word) = ucast (ucast a :: 32 word))\"\n using assms\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\nlemma ucast_ucast_ucast[simp]:\n assumes \"LENGTH('c) < LENGTH('b)\"\n shows \"(ucast (ucast (ucast (w::'a::len word)::'b::len word)::'c::len word)::'d::len word) = ucast (ucast w::'c::len word)\"\n using assms\n by (auto simp add: word_eq_iff nth_ucast)\n\nlemma scast_ucast_ucast[simp]:\n assumes \"LENGTH('c) < LENGTH('b)\"\n shows \"(scast (ucast (ucast (w::'a::len word)::'b::len word)::'c::len word)::'d::len word) = scast (ucast w::'c::len word)\"\n using assms\n by (auto simp add: word_eq_iff nth_ucast nth_scast)\n\nlemma test_bit_mem_read:\n shows \"mem_read \\ a si !! n \\ n < si*8\"\n by (auto simp add: mem_read_def test_bit_rcat word_size rev_nth length_read_bytes)\n\nlemma ucast_ucast_mem_read_8[simp]:\nassumes \"LENGTH('a) > 8\"\n shows \"(ucast (ucast (mem_read \\ a 1)::'a::len word) :: 8 word) = ucast (mem_read \\ a 1)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 4] assms\n by (auto simp add: word_size nth_ucast)\n\nlemma ucast_ucast_mem_read_16[simp]:\nassumes \"LENGTH('a) > 16\"\n shows \"(ucast (ucast (mem_read \\ a 2)::'a::len word) :: 16 word) = ucast (mem_read \\ a 2)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 4] assms\n by (auto simp add: word_size nth_ucast)\n\nlemma ucast_ucast_mem_read_32[simp]:\n assumes \"LENGTH('a) > 32\"\n shows \"(ucast (ucast (mem_read \\ a 4)::'a::len word) :: 32 word) = ucast (mem_read \\ a 4)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 4] assms\n by (auto simp add: word_size nth_ucast)\n\nlemma ucast_ucast_mem_read_1byte[simp]:\nassumes \"LENGTH('a) > 8\" and \"LENGTH('b) > 8\"\n shows \"(ucast (ucast (mem_read \\ a 1)::'a::len word) :: 'b::len word) = ucast (mem_read \\ a 1)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 1] assms\n apply (auto simp add: word_size nth_ucast)\n by (meson le_eq_less_or_eq le_less_trans)\n\nlemma ucast_ucast_mem_read_2bytes[simp]:\nassumes \"LENGTH('a) > 16\" and \"LENGTH('b) > 16\"\n shows \"(ucast (ucast (mem_read \\ a 2)::'a::len word) :: 'b::len word) = ucast (mem_read \\ a 2)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 2] assms\n apply (auto simp add: word_size nth_ucast)\n by (meson le_eq_less_or_eq le_less_trans)\n\nlemma ucast_ucast_mem_read_4bytes[simp]:\nassumes \"LENGTH('a) > 32\" and \"LENGTH('b) > 32\"\n shows \"(ucast (ucast (mem_read \\ a 4)::'a::len word) :: 'b::len word) = ucast (mem_read \\ a 4)\"\n apply (subst word_eq_iff)+\n using test_bit_mem_read[of \\ a 4] assms\n apply (auto simp add: word_size nth_ucast)\n by (meson le_eq_less_or_eq le_less_trans)\n\nlemma ucast_mem_read_cmp_8[simp]:\nfixes \\ :: state and b :: \"'a::len word\"\nassumes \"LENGTH('a) > 8\"\n shows \"(ucast (mem_read \\ a 1)) = b \\ ucast (ucast (mem_read \\ a 1)::8 word) = b\"\n using test_bit_mem_read[of \\ a 1] test_bit_size[of b]\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\nlemma ucast_mem_read_cmp_16[simp]:\nfixes \\ :: state and b :: \"'a::len word\"\nassumes \"LENGTH('a) > 16\"\n shows \"(ucast (mem_read \\ a 2)) = b \\ ucast (ucast (mem_read \\ a 2)::16 word) = b\"\n using test_bit_mem_read[of \\ a 2] test_bit_size[of b]\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\nlemma ucast_mem_read_cmp_32[simp]:\nfixes \\ :: state and b :: \"'a::len word\"\nassumes \"LENGTH('a) > 32\"\n shows \"(ucast (mem_read \\ a 4)) = b \\ ucast (ucast (mem_read \\ a 4)::32 word) = b\"\n using test_bit_mem_read[of \\ a 4] test_bit_size[of b]\n by (auto simp add: word_eq_iff word_size nth_ucast nth_takebits)\n\n\n\n\n\n\nlemma ucast_overwrite[simp]:\n shows \"ucast (overwrite 0 n a b) = overwrite 0 n (ucast a) (ucast b)\"\n using test_bit_size[of a] test_bit_size[of b]\n by (auto simp add: word_eq_iff nth_ucast overwrite_def nth_shiftl nth_takebits word_size)\n\nlemma takebits_overwrite[simp]:\n shows \"(\\0,h\\ (overwrite 0 n a b)) = overwrite 0 n (\\0,h\\ a) (\\0,h\\ b)\"\n using test_bit_size[of a] test_bit_size[of b]\n by (auto simp add: word_eq_iff nth_ucast overwrite_def nth_shiftl nth_takebits word_size)\n\nlemma overwrite_overwrite_l[simp]:\n shows \"overwrite 0 h (overwrite 0 h a b) c = overwrite 0 h a c\"\n by (auto simp add: word_eq_iff nth_ucast overwrite_def nth_shiftl nth_takebits word_size)\n\nlemma overwrite_overwrite_r[simp]:\n shows \"overwrite 0 h a (overwrite 0 h b c) = overwrite 0 h a c\"\n by (auto simp add: word_eq_iff nth_ucast overwrite_def nth_shiftl nth_takebits word_size)\n\nlemma overwrite_all_8[simp]:\n fixes a :: \"8 word\"\n shows \"overwrite 0 8 a b = b\"\n by (auto simp add: word_eq_iff overwrite_def nth_shiftl nth_takebits)\n\nlemma overwrite_all_16[simp]:\n fixes a :: \"16 word\"\n shows \"overwrite 0 16 a b = b\"\n by (auto simp add: word_eq_iff overwrite_def nth_shiftl nth_takebits)\n\n\n\nlemma ucast_AND[simp]:\n shows \"ucast (a AND b) = ucast a AND ucast b\"\n by (auto simp add: word_eq_iff nth_ucast)\n\nlemma ucast_OR[simp]:\n shows \"ucast (a OR b) = ucast a OR ucast b\"\n by (auto simp add: word_eq_iff nth_ucast)\n\nlemma ucast_XOR[simp]:\n shows \"ucast (a XOR b) = ucast a XOR ucast b\"\n by (auto simp add: word_eq_iff nth_ucast)\n\nlemma take_bits_AND[simp]:\n shows \"(\\l,h\\ (a AND b)) = (\\l,h\\ a) AND (\\l,h\\ b)\"\n by (auto simp add: word_eq_iff nth_ucast nth_takebits)\n\nlemma take_bits_OR[simp]:\n shows \"(\\l,h\\ (a OR b)) = (\\l,h\\ a) OR (\\l,h\\ b)\"\n by (auto simp add: word_eq_iff nth_ucast nth_takebits)\n\nlemma take_bits_XOR[simp]:\n shows \"(\\l,h\\ (a XOR b)) = (\\l,h\\ a) XOR (\\l,h\\ b)\"\n by (auto simp add: word_eq_iff nth_ucast nth_takebits)\n\n\n\nlemma dummy:\n assumes \"LENGTH('a) < 0\" and \"LENGTH('b) < 0\"\n shows \"(ucast (a::'a::len word) ::'b::len word) = x\"\n using assms\n by auto\n\nlemma dummy':\n assumes \"LENGTH('a) < 0\" and \"LENGTH('b) < 0\"\n shows \"(scast (a::'a::len word) ::'b::len word) = x\"\n using assms\n by auto\n\n\n\n\n\n\n\n\nML_file \\X86_Parse_Hoare_Triple.ML\\\n\n\nML \\\n(*\n If thm is of the form (thm0 \\ thm1), return the conjuncts.\n*)\nfun split_conj thm =\n case (Thm.prop_of thm) of\n (Const (\"HOL.Trueprop\", _) $ (Const (\"HOL.conj\", _) $ _ $ _)) => SOME (thm RS @{thm conjunct1} ,thm RS @{thm conjunct2})\n | _ => NONE;\n\n(*\n conjs = thm0 \\ thm1 \\ ...\n Searches a conjunct equal to thm.\n If found, insert the found conjunct as assumption.\n*)\n\nfun insert_assumption_from_conjunct ctxt conjs thm =\n case split_conj conjs of\n NONE => \n if Envir.aeconv (Thm.prop_of conjs,Thm.major_prem_of thm) then\n SOME (Method.insert_tac ctxt [conjs])\n else if Envir.aeconv (Thm.prop_of conjs,Thm.major_prem_of thm) then\n SOME (Method.insert_tac ctxt [conjs])\n else\n NONE \n | SOME (conj0,conj1) =>\n case insert_assumption_from_conjunct ctxt conj0 thm of\n NONE => insert_assumption_from_conjunct ctxt conj1 thm\n | SOME thm' => SOME thm'\n\n\nfun from_conjunctive_assm_tactic assm ctxt i thm =\n if Thm.no_prems thm then\n Seq.single thm\n else case insert_assumption_from_conjunct ctxt assm thm of\n NONE => Seq.empty\n | SOME tac => Seq.maps (Seq.single o Thm.eq_assumption i) (tac i thm)\n\n\ninfix 1 DETERM_THEN AND_IF_NOT_SOLVED;\n\nfun tac1 DETERM_THEN tac2 = fn thm =>\n let val result = tac1 thm \n in\n case Seq.pull result of\n NONE => Seq.empty\n | SOME (thm',_) => tac2 thm'\n end\n\nfun tac1 AND_IF_NOT_SOLVED tac2 = fn thm =>\n let val result = tac1 thm \n in\n case Seq.pull result of\n NONE => tac2 thm\n | SOME (thm',_) => if Thm.nprems_of thm' < Thm.nprems_of thm then Seq.single thm' else tac2 thm'\n end\n\nfun add_simps simp_theorems = fold Simplifier.add_simp simp_theorems\n\n(*\n apply (subst mem_read_mem_write_separate)\n apply (from_conjunctive_assm conjI[OF seps asserts,simplified])\n apply (insert conjI[OF seps asserts,simplified])[1]\n apply (erule conjE)+\n apply (simp (no_asm_simp) add: state_simps BitByte_simps separate_simps)\n apply (simp only: algeba_simps_small)?\n apply (simp add: state_simps BitByte_simps separate_simps)\n apply (simp only: algeba_simps_small)?\n*)\nfun resolve_mem_read_tactic seps ctxt i =\n let val tac1 = CHANGED (EqSubst.eqsubst_tac ctxt [0] [@{thm mem_read_mem_write_separate}] i)\n val tac2 = HEADGOAL (from_conjunctive_assm_tactic seps ctxt)\n val tac3 = HEADGOAL (Method.insert_tac ctxt [seps])\n val tac4 = REPEAT_DETERM (HEADGOAL (eresolve_tac ctxt [@{thm conjE}]))\n val simp_theorems = @{thms state_simps BitByte_simps separate_simps}\n val ctxt' = add_simps simp_theorems ctxt\n val tac5 = HEADGOAL (asm_simp_tac ctxt')\n val ctxt_only_commutes = add_simps @{thms algebra_simps} (Raw_Simplifier.clear_simpset ctxt)\n val tac6 = HEADGOAL (full_simp_tac ctxt_only_commutes)\n val tac7 = HEADGOAL (asm_full_simp_tac ctxt')\n val tac8 = tac6\n in\n CHANGED (\n tac1 DETERM_THEN \n ( (DETERM tac2)\n ORELSE \n (tac3 DETERM_THEN tac4 DETERM_THEN (tac5 AND_IF_NOT_SOLVED tac6 AND_IF_NOT_SOLVED tac7 AND_IF_NOT_SOLVED tac8))\n )\n )\n end\n\\ \nmethod_setup from_conjunctive_assm = \\\n Attrib.thm >> (fn (assm) => fn ctxt =>\n SIMPLE_METHOD' (fn i => fn thm =>\n if Thm.no_prems thm then\n Seq.single thm\n else case insert_assumption_from_conjunct ctxt assm thm of\n NONE => Seq.empty\n | SOME tac => Seq.maps (Seq.single o Thm.eq_assumption i) (tac i thm)\n ))\n\\\n\nmethod_setup resolve_mem_read = \\\n Attrib.thm >> (fn (assm) => fn ctxt => \n SIMPLE_METHOD' (fn i => fn thm =>\n if Thm.no_prems thm then\n Seq.single thm\n else\n resolve_mem_read_tactic assm ctxt i thm\n ))\n\\\n\nmethod_setup eq_assumption = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (PRIMITIVE o Thm.eq_assumption))\\\n\nML \\\nfun REPEAT_WHILE_CHANGING tac = fn thm =>\n let val result = (CHANGED tac) thm \n in\n case Seq.pull result of\n NONE => Seq.single thm\n | SOME (thm',_) => REPEAT_WHILE_CHANGING tac thm'\n end\n\nfun REPEAT_WHILE_SOLVING tac = fn thm =>\n let val result = (CHANGED tac) thm \n in\n case Seq.pull result of\n NONE => Seq.single thm\n | SOME (thm',_) => if Thm.nprems_of thm' < Thm.nprems_of thm then REPEAT_WHILE_SOLVING tac thm' else Seq.single thm\n end\n\nfun FAIL_IF_GENERATES_NEW_GOALS tac = fn thm =>\n let val result = (CHANGED tac) thm \n in\n case Seq.pull result of\n NONE => Seq.empty\n | SOME (thm',_) => if Thm.nprems_of thm' > Thm.nprems_of thm then Seq.empty else Seq.single thm'\n end\n\\\n\nmethod_setup repeat_while_changing = \\\n Method.text_closure >> (fn m => fn ctxt => fn _ =>\n CONTEXT_TACTIC (REPEAT_WHILE_CHANGING (NO_CONTEXT_TACTIC ctxt (Method.evaluate m ctxt []))))\n\\\n\nmethod_setup fail_if_generates_new_goals = \\\n Method.text_closure >> (fn m => fn ctxt => fn _ =>\n CONTEXT_TACTIC (FAIL_IF_GENERATES_NEW_GOALS (NO_CONTEXT_TACTIC ctxt (Method.evaluate m ctxt []))))\n\\\n\nmethod_setup repeat_while_solving = \\\n Method.text_closure >> (fn m => fn ctxt => fn _ =>\n CONTEXT_TACTIC (REPEAT_WHILE_SOLVING (NO_CONTEXT_TACTIC ctxt (Method.evaluate m ctxt []))))\n\\\n\n\nmethod se_step uses assms seps = (\n (insert assms)[1],\n (erule conjE)+,\n ( (simp (no_asm_use) add: state_simps BitByte_simps separate_simps)? ;\n (repeat_while_changing\n \\(simp only: algebra_simps)?,\n (simp (no_asm_simp) add: state_simps BitByte_simps separate_simps)?,\n (fail_if_generates_new_goals \\resolve_mem_read seps\\)?\\\n )\n )\n )\n\nmethod htriple_solver uses seps assms = (\n (simp add: semantics_simps state_simps BitByte_simps separate_simps del: Let_def),\n (auto simp add: semantics_simps state_simps BitByte_simps separate_simps)?,\n (repeat_while_solving \\se_step assms: assms seps: seps\\)\n )\n\n(*\n apply (simp add: semantics_simps state_simps BitByte_simps separate_simps del: Let_def)\n apply (auto simp add: semantics_simps state_simps BitByte_simps separate_simps)?\n apply (repeat_while_changing \\se_step assms: assms seps: conjI[OF seps asserts,simplified]\\)\n apply (se_step assms: assms seps: conjI[OF seps asserts,simplified])\n\n apply (insert assms)[1]\n apply (erule conjE)+\n apply (simp (no_asm_use) add: state_simps BitByte_simps separate_simps)\n (* repeat *)\n apply (simp only: algebra_simps)\n apply (simp (no_asm_simp) add: state_simps BitByte_simps separate_simps)\n apply (simp only: algebra_simps)\n apply (fail_if_generates_new_goals \\resolve_mem_read conjI[OF seps asserts,simplified]\\)\n\n*)\n\nend\n\n\n\nabbreviation ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4 :: \"32 word \\ 64 word\"\n where \"ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4 \\ ucast\"\nabbreviation ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 :: \"64 word \\ 32 word\"\n where \"ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 \\ ucast\"\nabbreviation ucast\\<^sub>1\\<^sub>6\\<^sub>_\\<^sub>6\\<^sub>4 :: \"16 word \\ 64 word\"\n where \"ucast\\<^sub>1\\<^sub>6\\<^sub>_\\<^sub>6\\<^sub>4 \\ ucast\"\nabbreviation ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>1\\<^sub>6 :: \"64 word \\ 16 word\"\n where \"ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>1\\<^sub>6 \\ ucast\"\nabbreviation ucast\\<^sub>8\\<^sub>_\\<^sub>6\\<^sub>4 :: \"8 word \\ 64 word\"\n where \"ucast\\<^sub>8\\<^sub>_\\<^sub>6\\<^sub>4 \\ ucast\"\nabbreviation ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>8 :: \"64 word \\ 8 word\"\n where \"ucast\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>8 \\ ucast\"\nabbreviation ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>1\\<^sub>6 :: \"32 word \\ 16 word\"\n where \"ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>1\\<^sub>6 \\ ucast\"\nabbreviation ucast\\<^sub>8\\<^sub>_\\<^sub>3\\<^sub>2 :: \"8 word \\ 32 word\"\n where \"ucast\\<^sub>8\\<^sub>_\\<^sub>3\\<^sub>2 \\ ucast\"\nabbreviation ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>8 :: \"32 word \\ 8 word\"\n where \"ucast\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>8 \\ ucast\"\nabbreviation ucast\\<^sub>1\\<^sub>6\\<^sub>_\\<^sub>8 :: \"16 word \\ 8 word\"\n where \"ucast\\<^sub>1\\<^sub>6\\<^sub>_\\<^sub>8 \\ ucast\"\nabbreviation ucast\\<^sub>8\\<^sub>_\\<^sub>1\\<^sub>6 :: \"8 word \\ 16 word\"\n where \"ucast\\<^sub>8\\<^sub>_\\<^sub>1\\<^sub>6 \\ ucast\"\n\n\nend", "meta": {"author": "jabocken", "repo": "SSM-Construction", "sha": "6d4dc2782bb0dc4f18b638e62f7fa54f484359e5", "save_path": "github-repos/isabelle/jabocken-SSM-Construction", "path": "github-repos/isabelle/jabocken-SSM-Construction/SSM-Construction-6d4dc2782bb0dc4f18b638e62f7fa54f484359e5/isabelle/isabelle/X86_Semantics/X86_Parse_Hoare_Triples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.26863315183004277}} {"text": "chapter \\A Control Flow Graph for Jinja Byte Code\\\n\nsection \\Formalizing the CFG\\\n\ntheory JVMCFG imports \"../StaticInter/BasicDefs\" Jinja.BVExample begin\n\ndeclare lesub_list_impl_same_size [simp del]\ndeclare nlistsE_length [simp del]\n\nsubsection \\Type definitions\\\n\nsubsubsection \\Wellformed Programs\\\n\ndefinition \"wf_jvmprog = {(P, Phi). wf_jvm_prog\\<^bsub>Phi\\<^esub> P}\"\n\ntypedef wf_jvmprog = \"wf_jvmprog\"\nproof\n show \"(E, Phi) \\ wf_jvmprog\"\n unfolding wf_jvmprog_def by (auto intro: wf_prog)\nqed\n\nhide_const Phi E\n\nabbreviation PROG :: \"wf_jvmprog \\ jvm_prog\"\n where \"PROG P \\ fst(Rep_wf_jvmprog(P))\"\n\nabbreviation TYPING :: \"wf_jvmprog \\ ty\\<^sub>P\"\n where \"TYPING P \\ snd(Rep_wf_jvmprog(P))\"\n\nlemma wf_jvmprog_is_wf_typ: \"wf_jvm_prog\\<^bsub>TYPING P\\<^esub> (PROG P)\"\nusing Rep_wf_jvmprog [of P]\n by (auto simp: wf_jvmprog_def split_beta)\n\nlemma wf_jvmprog_is_wf: \"wf_jvm_prog (PROG P)\"\n using wf_jvmprog_is_wf_typ unfolding wf_jvm_prog_def\n by blast\n\nsubsubsection \\Interprocedural CFG\\\n\ntype_synonym jvm_method = \"wf_jvmprog \\ cname \\ mname\"\ndatatype var = Heap | Local \"nat\" | Stack \"nat\" | Exception\ndatatype val = Hp \"heap\" | Value \"Value.val\"\n\ntype_synonym state = \"var \\ val\"\n\ndefinition valid_state :: \"state \\ bool\"\n where \"valid_state s \\ (\\val. s Heap \\ Some (Value val))\n \\ (s Exception = None \\ (\\addr. s Exception = Some (Value (Addr addr))))\n \\ (\\var. var \\ Heap \\ var \\ Exception \\ (\\h. s var \\ Some (Hp h)))\"\n\nfun the_Heap :: \"val \\ heap\"\n where \"the_Heap (Hp h) = h\"\n\nfun the_Value :: \"val \\ Value.val\"\n where \"the_Value (Value v) = v\"\n\nabbreviation heap_of :: \"state \\ heap\"\n where \"heap_of s \\ the_Heap (the (s Heap))\"\n\nabbreviation exc_flag :: \"state \\ addr option\"\n where \"exc_flag s \\ case (s Exception) of None \\ None\n | Some v \\ Some (THE a. v = Value (Addr a))\"\n\nabbreviation stkAt :: \"state \\ nat \\ Value.val\"\n where \"stkAt s n \\ the_Value (the (s (Stack n)))\"\n\nabbreviation locAt :: \"state \\ nat \\ Value.val\"\n where \"locAt s n \\ the_Value (the (s (Local n)))\"\n\ndatatype nodeType = Enter | Normal | Return | Exceptional \"pc option\" \"nodeType\"\ntype_synonym cfg_node = \"cname \\ mname \\ pc option \\ nodeType\"\n\ntype_synonym\n cfg_edge = \"cfg_node \\ (var, val, cname \\ mname \\ pc, cname \\ mname) edge_kind \\ cfg_node\"\n\ndefinition ClassMain :: \"wf_jvmprog \\ cname\"\n where \"ClassMain P \\ SOME Name. \\ is_class (PROG P) Name\"\n\ndefinition MethodMain :: \"wf_jvmprog \\ mname\"\n where \"MethodMain P \\ SOME Name.\n \\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m \\ set ms. Name \\ fst m)\"\n\ndefinition stkLength :: \"jvm_method \\ pc \\ nat\"\n where\n \"stkLength m pc \\ let (P, C, M) = m in (\n if (C = ClassMain P) then 1 else (\n length (fst(the(((TYPING P) C M) ! pc)))\n ))\"\n\ndefinition locLength :: \"jvm_method \\ pc \\ nat\"\n where\n \"locLength m pc \\ let (P, C, M) = m in (\n if (C = ClassMain P) then 1 else (\n length (snd(the(((TYPING P) C M) ! pc)))\n ))\"\n\nlemma ex_new_class_name: \"\\C. \\ is_class P C\"\nproof -\n have \"\\ finite (UNIV :: cname set)\"\n by (rule infinite_UNIV_listI)\n hence \"\\C. C \\ set (map fst P)\"\n by -(rule ex_new_if_finite, auto)\n then obtain C where \"C \\ set (map fst P)\"\n by blast\n have \"\\ is_class P C\"\n proof\n assume \"is_class P C\"\n then obtain D fs ms where \"class P C = \\(D, fs, ms)\\\"\n by auto\n with \\C \\ set (map fst P)\\ show False\n by (auto dest: map_of_SomeD intro!: image_eqI simp: class_def)\n qed\n thus ?thesis\n by blast\nqed\n\nlemma ClassMain_unique_in_P:\n assumes \"is_class (PROG P) C\"\n shows \"ClassMain P \\ C\"\nproof -\n from ex_new_class_name [of \"PROG P\"] obtain D where \"\\ is_class (PROG P) D\"\n by blast\n with \\is_class (PROG P) C\\ show ?thesis\n unfolding ClassMain_def\n by -(rule someI2, fastforce+)\nqed\n\nlemma map_of_fstD: \"\\ map_of xs a = \\b\\; \\x \\ set xs. fst x \\ a \\ \\ False\"\n by (induct xs, auto)\n\nlemma map_of_fstE: \"\\ map_of xs a = \\b\\; \\x \\ set xs. fst x = a \\ thesis \\ \\ thesis\"\n by (induct xs) (auto split: if_split_asm)\n\nlemma ex_unique_method_name:\n \"\\Name. \\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m\\set ms. Name \\ fst m)\"\nproof -\n from wf_jvmprog_is_wf [of P]\n have \"distinct_fst (PROG P)\"\n by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def wf_prog_def)\n hence \"{C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\} = fst ` set (PROG P)\"\n by (fastforce elim: map_of_fstE simp: class_def intro: map_of_SomeI)\n hence \"finite {C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\}\"\n by auto\n moreover have \"{ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}\n = snd ` snd ` the ` (\\C. class (PROG P) C) ` {C. \\D fs ms. class (PROG P) C = \\(D, fs, ms)\\}\"\n by (fastforce intro: rev_image_eqI map_of_SomeI simp: class_def)\n ultimately have \"finite {ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}\"\n by auto\n moreover have \"\\ finite (UNIV :: mname set)\"\n by (rule infinite_UNIV_listI)\n ultimately\n have \"\\Name. Name \\ fst ` (\\ms \\ {ms. \\C D fs. class (PROG P) C = \\(D, fs, ms)\\}. set ms)\"\n by -(rule ex_new_if_finite, auto)\n thus ?thesis\n by fastforce\nqed\n\nlemma MethodMain_unique_in_P:\n assumes \"PROG P \\ D sees M:Ts\\T = mb in C\"\n shows \"MethodMain P \\ M\"\nproof -\n from ex_unique_method_name [of P] obtain M'\n where \"\\C D fs ms. class (PROG P) C = \\(D, fs, ms)\\ \\ (\\m \\ set ms. M' \\ fst m)\"\n by blast\n with \\PROG P \\ D sees M:Ts\\T = mb in C\\\n show ?thesis\n unfolding MethodMain_def\n by -(rule someI2_ex, fastforce, fastforce dest!: visible_method_exists elim: map_of_fstE)\nqed\n\nlemma ClassMain_is_no_class [dest!]: \"is_class (PROG P) (ClassMain P) \\ False\"\nproof (erule rev_notE)\n from ex_new_class_name [of \"PROG P\"] obtain C where \"\\ is_class (PROG P) C\"\n by blast\n thus \"\\ is_class (PROG P) (ClassMain P)\" unfolding ClassMain_def\n by (rule someI)\nqed\n\nlemma MethodMain_not_seen [dest!]: \"PROG P \\ C sees (MethodMain P):Ts\\T = mb in D \\ False\"\n by (fastforce dest: MethodMain_unique_in_P)\n\nlemma no_Call_from_ClassMain [dest!]: \"PROG P \\ ClassMain P sees M:Ts\\T = mb in C \\ False\"\n by (fastforce dest: sees_method_is_class)\n\nlemma no_Call_in_ClassMain [dest!]: \"PROG P \\ C sees M:Ts\\T = mb in ClassMain P \\ False\"\n by (fastforce dest: sees_method_idemp)\n\ninductive JVMCFG :: \"jvm_method \\ cfg_node \\ (var, val, cname \\ mname \\ pc, cname \\ mname) edge_kind \\ cfg_node \\ bool\" (\" _ \\ _ -_\\ _\")\n and reachable :: \"jvm_method \\ cfg_node \\ bool\" (\" _ \\ \\_\")\n where\n Entry_reachable: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, None, Enter)\"\n | reachable_step: \"\\ P \\ \\n; P \\ n -(e)\\ n' \\ \\ P \\ \\n'\"\n | Main_to_Call: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Enter)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Enter) -\\id\\ (ClassMain P, MethodMain P, \\0\\, Normal)\"\n | Main_Call_LFalse: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Normal)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Normal) -(\\s. False)\\<^sub>\\\\ (ClassMain P, MethodMain P, \\0\\, Return)\"\n | Main_Call: \"\\ (P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Normal);\n PROG P \\ C0 sees Main:[]\\T = (mxs, mxl\\<^sub>0, is, xt) in D;\n initParams = [(\\s. s Heap),(\\s. \\Value Null\\)];\n ek = (\\(s, ret). True):(ClassMain P, MethodMain P, 0)\\\\<^bsub>(D, Main)\\<^esub>initParams \\\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Normal) -(ek)\\ (D, Main, None, Enter)\"\n | Main_Return_to_Exit: \"(P, C0, Main) \\ \\(ClassMain P, MethodMain P, \\0\\, Return)\n \\ (P, C0, Main) \\ (ClassMain P, MethodMain P, \\0\\, Return) -(\\id)\\ (ClassMain P, MethodMain P, None, Return)\"\n | Method_LFalse: \"(P, C0, Main) \\ \\(C, M, None, Enter)\n \\ (P, C0, Main) \\ (C, M, None, Enter) -(\\s. False)\\<^sub>\\\\ (C, M, None, Return)\"\n | Method_LTrue: \"(P, C0, Main) \\ \\(C, M, None, Enter)\n \\ (P, C0, Main) \\ (C, M, None, Enter) -(\\s. True)\\<^sub>\\\\ (C, M, \\0\\, Enter)\"\n | CFG_Load: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Load n;\n ek = \\(\\s. s(Stack (stkLength (P, C, M) pc) := s (Local n))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Store: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Store n;\n ek = \\(\\s. s(Local n := s (Stack (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Push: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Push v;\n ek = \\(\\s. s(Stack (stkLength (P, C, M) pc) \\ Value v)) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Pop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Pop;\n ek = \\id \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_IAdd: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = IAdd;\n ek = \\(\\s. let i1 = the_Intg (stkAt s (stkLength (P, C, M) pc - 1));\n i2 = the_Intg (stkAt s (stkLength (P, C, M) pc - 2))\n in s(Stack (stkLength (P, C, M) pc - 2) \\ Value (Intg (i1 + i2)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Goto: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = Goto i \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -((\\s. True)\\<^sub>\\)\\ (C, M, \\nat (int pc + i)\\, Enter)\"\n | CFG_CmpEq: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter); instrs_of (PROG P) C M ! pc = CmpEq;\n ek = \\(\\s. let e1 = stkAt s (stkLength (P, C, M) pc - 1);\n e2 = stkAt s (stkLength (P, C, M) pc - 2)\n in s(Stack (stkLength (P, C, M) pc - 2) \\ Value (Bool (e1 = e2)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_IfFalse_False: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = IfFalse i;\n i \\ 1;\n ek = (\\s. stkAt s (stkLength(P, C, M) pc - 1) = Bool False)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\nat (int pc + i)\\, Enter)\"\n | CFG_IfFalse_True: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = IfFalse i;\n ek = (\\s. stkAt s (stkLength(P, C, M) pc - 1) \\ Bool False \\ i = 1)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_New_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = (\\s. new_Addr (heap_of s) \\ None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_New_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n pc' = (case (match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. new_Addr (heap_of s) = None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_New_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. let a = the (new_Addr (heap_of s))\n in s(Heap \\ Hp ((heap_of s)(a \\ blank (PROG P) Cl)),\n Stack (stkLength(P, C, M) pc) \\ Value (Addr a))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_New_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_New_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = New Cl;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Getfield_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 1) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Getfield_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 1) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Getfield_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. let (D, fs) = the (heap_of s (the_Addr (stkAt s (stkLength (P, C, M) pc - 1))))\n in s(Stack (stkLength(P, C, M) pc - 1) \\ Value (the (fs (F, Cl))))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Getfield_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Getfield_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Getfield F Cl;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Putfield_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 2) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Putfield_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - 2) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Putfield_Update: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n r = stkAt s (stkLength (P, C, M) pc - 2);\n a = the_Addr r;\n (D, fs) = the (heap_of s a);\n h' = (heap_of s)(a \\ (D, fs((F, Cl) \\ v)))\n in s(Heap \\ Hp h')) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Putfield_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Putfield_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Putfield F Cl;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Checkcast_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = (\\s. cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Checkcast_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n pc' = (case (match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. \\ cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Checkcast_Exceptional_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt ClassCast)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Checkcast_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Checkcast Cl;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt ClassCast)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Throw_Check: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Throw;\n pc' = None \\ match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(the pc', d)\\;\n ek = (\\s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n Cl = if (v = Null) then NullPointer else (cname_of (heap_of s) (the_Addr v))\n in case pc' of\n None \\ match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M) = None\n | Some pc'' \\ \\d. match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M)\n = \\(pc'', d)\\\n )\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n\n | CFG_Throw_prop: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Throw;\n ek = \\(\\s. s(Exception \\ Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Throw_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n pc' \\ length (instrs_of (PROG P) C M);\n instrs_of (PROG P) C M ! pc = Throw;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Check_NP_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - Suc n) \\ Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Normal)\"\n | CFG_Invoke_Check_NP_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n None \\ None\n | Some (pc'', d) \\ \\pc''\\);\n ek = (\\s. stkAt s (stkLength (P, C, M) pc - Suc n) = Null)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, \\pc\\, Exceptional pc' Enter)\"\n | CFG_Invoke_NP_prop: \"\\ C \\ ClassMain P;\n (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional None Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. s(Exception \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional None Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Invoke_NP_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. (s(Exception := None))\n (Stack (stkLength (P, C, M) pc' - 1) \\ Value (Addr (addr_of_sys_xcpt NullPointer)))) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Enter) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Call: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n TYPING P C M ! pc = \\(ST, LT)\\;\n ST ! n = Class D';\n PROG P \\ D' sees M':Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in D;\n Q = (\\(s, ret). let r = stkAt s (stkLength (P, C, M) pc - Suc n);\n C' = fst (the (heap_of s (the_Addr r)))\n in D = fst (method (PROG P) C' M'));\n paramDefs = (\\s. s Heap)\n # (\\s. s (Stack (stkLength (P, C, M) pc - Suc n)))\n # (rev (map (\\i. (\\s. s (Stack (stkLength (P, C, M) pc - Suc i)))) [0..\\<^bsub>(D,M')\\<^esub>paramDefs\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (D, M', None, Enter)\"\n | CFG_Invoke_False: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Normal);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. False)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Normal) -(ek)\\ (C, M, \\pc\\, Return)\"\n | CFG_Invoke_Return_Check_Normal: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n (TYPING P) C M ! pc = \\(ST, LT)\\;\n ST ! n \\ NT;\n ek = (\\s. s Exception = None)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, \\Suc pc\\, Enter)\"\n | CFG_Invoke_Return_Check_Exceptional: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', diff)\\;\n pc' \\ length (instrs_of (PROG P) C M);\n ek = (\\s. \\v d. s Exception = \\v\\ \\\n match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = \\(pc', d)\\)\\<^sub>\\\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, \\pc\\, Exceptional \\pc'\\ Return)\"\n | CFG_Invoke_Return_Exceptional_handle: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = \\(\\s. s(Exception := None,\n Stack (stkLength (P, C, M) pc' - 1) := s Exception)) \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Exceptional \\pc'\\ Return) -(ek)\\ (C, M, \\pc'\\, Enter)\"\n | CFG_Invoke_Return_Exceptional_prop: \"\\ C \\ ClassMain P;\n (P, C0, Main) \\ \\(C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n;\n ek = (\\s. \\v. s Exception = \\v\\ \\\n match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = None)\\<^sub>\\ \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Return) -(ek)\\ (C, M, None, Return)\"\n | CFG_Return: \"\\ C \\ ClassMain P; (P, C0, Main) \\ \\(C, M, \\pc\\, Enter);\n instrs_of (PROG P) C M ! pc = instr.Return;\n ek = \\(\\s. s(Stack 0 := s (Stack (stkLength (P, C, M) pc - 1))))\n \\\n \\ (P, C0, Main) \\ (C, M, \\pc\\, Enter) -(ek)\\ (C, M, None, Return)\"\n | CFG_Return_from_Method: \"\\ (P, C0, Main) \\ \\(C, M, None, Return);\n (P, C0, Main) \\ (C', M', \\pc'\\, Normal) -(Q':(C', M', pc')\\\\<^bsub>(C,M)\\<^esub>ps)\\ (C, M, None, Enter);\n Q = (\\(s, ret). ret = (C', M', pc'));\n stateUpdate = (\\s s'. s'(Heap := s Heap,\n Exception := s Exception,\n Stack (stkLength (P, C', M') (Suc pc') - 1) := s (Stack 0))\n );\n ek = Q\\\\<^bsub>(C, M)\\<^esub>stateUpdate\n \\\n \\ (P, C0, Main) \\ (C, M, None, Return) -(ek)\\ (C', M', \\pc'\\, Return)\"\n\n\n(* This takes veeeery long *)\nlemma JVMCFG_edge_det: \"\\ P \\ n -(et)\\ n'; P \\ n -(et')\\ n' \\ \\ et = et'\"\n by (erule JVMCFG.cases) (erule JVMCFG.cases, (fastforce dest: sees_method_fun)+)+\n\nlemma sourcenode_reachable: \"P \\ n -(ek)\\ n' \\ P \\ \\n\"\n by (erule JVMCFG.cases, auto)\n\nlemma targetnode_reachable:\n assumes edge: \"P \\ n -(ek)\\ n'\"\n shows \"P \\ \\n'\"\nproof -\n from edge have \"P \\ \\n\"\n by -(drule sourcenode_reachable)\n with edge show ?thesis\n by -(rule JVMCFG_reachable.intros)\nqed\n\nlemmas JVMCFG_reachable_inducts = JVMCFG_reachable.inducts[split_format (complete)]\n\nlemma ClassMain_imp_MethodMain:\n \"(P, C0, Main) \\ (C', M', pc', nt') -ek\\ (ClassMain P, M, pc, nt) \\ M = MethodMain P\"\n \"(P, C0, Main) \\ \\(ClassMain P, M, pc, nt) \\ M = MethodMain P\"\nproof (induct P==\"P\" C0\\\"C0\" Main\\Main C' M' pc' nt' ek C''==\"ClassMain P\" M pc nt and\n P==\"P\" C0\\\"C0\" Main\\Main C'==\"ClassMain P\" M pc nt\n rule: JVMCFG_reachable_inducts)\n case CFG_Return_from_Method\n thus ?case\n by (fastforce elim: JVMCFG.cases)\nqed auto\n\nlemma ClassMain_no_Call_target [dest!]:\n \"(P, C0, Main) \\ (C, M, pc, nt) -Q:(C', M', pc')\\\\<^bsub>(D,M'')\\<^esub>paramDefs\\ (ClassMain P, M''', pc'', nt')\n \\ False\"\n and\n \"(P, C0, Main) \\ \\(C, M, pc, nt) \\ True\"\n by (induct P C0 Main C M pc nt ek==\"Q:(C', M', pc')\\\\<^bsub>(D,M'')\\<^esub>paramDefs\"\n C''==\"ClassMain P\" M''' pc'' nt' and\n P C0 Main C M pc nt\n rule: JVMCFG_reachable_inducts) auto\n\nlemma method_of_src_and_trg_exists:\n \"\\ (P, C0, Main) \\ (C', M', pc', nt') -ek\\ (C, M, pc, nt); C \\ ClassMain P; C' \\ ClassMain P \\\n \\ (\\Ts T mb. (PROG P) \\ C sees M:Ts\\T = mb in C) \\\n (\\Ts T mb. (PROG P) \\ C' sees M':Ts\\T = mb in C')\"\n and method_of_reachable_node_exists:\n \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P \\\n \\ \\Ts T mb. (PROG P) \\ C sees M:Ts\\T = mb in C\"\nproof (induct rule: JVMCFG_reachable_inducts)\n case CFG_Invoke_Call\n thus ?case\n by (blast dest: sees_method_idemp)\nnext\n case (reachable_step P C0 Main C M pc nt ek C' M' pc' nt')\n show ?case\n proof (cases \"C = ClassMain P\")\n case True\n with \\(P, C0, Main) \\ (C, M, pc, nt) -ek\\ (C', M', pc', nt')\\ \\C' \\ ClassMain P\\\n show ?thesis\n proof cases\n case Main_Call\n thus ?thesis\n by (blast dest: sees_method_idemp)\n qed auto\n next\n case False\n with reachable_step show ?thesis\n by simp\n qed\nqed simp_all\n\nlemma \"\\ (P, C0, Main) \\ (C', M', pc', nt') -ek\\ (C, M, pc, nt); C \\ ClassMain P; C' \\ ClassMain P \\\n \\ (case pc of None \\ True |\n \\pc''\\ \\ (TYPING P) C M ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C M)) \\\n (case pc' of None \\ True |\n \\pc''\\ \\ (TYPING P) C' M' ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C' M'))\"\n and instr_of_reachable_node_typable: \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P \\\n \\ case pc of None \\ True |\n \\pc''\\ \\ (TYPING P) C M ! pc'' \\ None \\ pc'' < length (instrs_of (PROG P) C M)\"\nproof (induct rule: JVMCFG_reachable_inducts)\n case (CFG_Load C P C0 Main M pc n ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Load show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Store C P C0 Main M pc n ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Store show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Push C P C0 Main M pc v ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Push show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Pop C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Pop show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IAdd C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IAdd show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Goto C P C0 Main M pc i)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Goto show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_CmpEq C P C0 Main M pc ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_CmpEq show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IfFalse_False C P C0 Main M pc i ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IfFalse_False show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_IfFalse_True C P C0 Main M pc i ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_IfFalse_True show ?case\n using [[simproc del: list_to_set_comprehension]] by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_New_Update C P C0 Main M pc Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_New_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_New_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = New Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ New Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = New Cl\\ obtain d'\n where \"match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) OutOfMemory pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = New Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Getfield_Update C P C0 Main M pc F Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Getfield_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Getfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Getfield F Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Getfield F Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Putfield_Update C P C0 Main M pc F Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Putfield_Update show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Putfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Putfield F Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Putfield F Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Checkcast_Check_Normal C P C0 Main M pc Cl ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Checkcast_Check_Normal show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n case (CFG_Checkcast_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Checkcast Cl,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\ obtain d'\n where \"match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) ClassCast pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Checkcast Cl\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Throw_handle C P C0 Main M pc pc' ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Throw\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Throw,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Throw\\ obtain d' Exc\n where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Throw\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_NP_handle C P C0 Main M pc pc' M' n ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Invoke M' n,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Enter)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Invoke M' n\\ obtain d'\n where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_Return_Exceptional_handle C P C0 Main M pc pc' M' n ek)\n hence \"TYPING P C M ! pc \\ None\" and \"pc < length (instrs_of (PROG P) C M)\"\n by simp_all\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 where\n \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n by (fastforce dest: method_of_reachable_node_exists)\n with \\pc < length (instrs_of (PROG P) C M)\\ \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n \\ Invoke M' n,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n moreover from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Exceptional \\pc'\\ Return)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Invoke M' n\\ obtain d' Exc\n where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\(pc', d')\\\"\n by cases (fastforce elim: JVMCFG.cases)\n hence \"\\(f, t, D, h, d)\\set (ex_table_of (PROG P) C M).\n matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\ h = pc' \\ d = d'\"\n by -(drule match_ex_table_SomeD)\n ultimately show ?case using \\instrs_of (PROG P) C M ! pc = Invoke M' n\\\n by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n case (CFG_Invoke_Return_Check_Normal C P C0 Main M pc M' n ST LT ek)\n from \\(P, C0, Main) \\ \\(C, M, \\pc\\, Return)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with CFG_Invoke_Return_Check_Normal show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext \n case (Method_LTrue P C0 Main C M)\n from \\(P, C0, Main) \\ \\(C, M, None, Enter)\\ \\C \\ ClassMain P\\\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"instrs_of (PROG P) C M = is\"\n by -(drule method_of_reachable_node_exists, auto)\n with Method_LTrue show ?case\n by (fastforce dest!: wt_jvm_prog_impl_wt_start [OF wf_jvmprog_is_wf_typ] simp: wt_start_def)\nnext\n case (reachable_step P C0 Main C M opc nt ek C' M' opc' nt')\n thus ?case\n by (cases \"C = ClassMain P\") (fastforce elim: JVMCFG.cases, simp)\nqed simp_all\n\nlemma reachable_node_impl_wt_instr:\n assumes \"(P, C0, Main) \\ \\(C, M, \\pc\\, nt)\"\n and \"C \\ ClassMain P\"\n shows \"\\T mxs mpc xt. PROG P,T,mxs,mpc,xt \\ (instrs_of (PROG P) C M ! pc),pc :: TYPING P C M\"\nproof -\n from \\C \\ ClassMain P\\ \\(P, C0, Main) \\ \\(C, M, \\pc\\, nt)\\\n method_of_reachable_node_exists [of P C0 Main C M \"\\pc\\\" nt]\n instr_of_reachable_node_typable [of P C0 Main C M \"\\pc\\\" nt]\n obtain Ts T mxs mxl\\<^sub>0 \"is\" xt\n where \"PROG P \\ C sees M:Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n and \"TYPING P C M ! pc \\ None\"\n and \"pc < length (instrs_of (PROG P) C M)\"\n by fastforce+\n with wf_jvmprog_is_wf_typ [of P]\n have \"PROG P,T,mxs,length is,xt \\ instrs_of (PROG P) C M ! pc,pc :: TYPING P C M\"\n by (fastforce dest!: wt_jvm_prog_impl_wt_instr)\n thus ?thesis\n by blast\nqed\n\nlemma\n \"\\ (P, C0, Main) \\ (C, M, pc, nt) -ek\\ (C', M', pc', nt'); C \\ ClassMain P \\ C' \\ ClassMain P \\\n \\ \\T mb D. PROG P \\ C0 sees Main:[]\\T = mb in D\"\n and reachable_node_impl_Main_ex:\n \"\\ (P, C0, Main) \\ \\(C, M, pc, nt); C \\ ClassMain P\\\n \\ \\T mb D. PROG P \\ C0 sees Main:[]\\T = mb in D\"\n by (induct rule: JVMCFG_reachable_inducts) fastforce+\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/HRB-Slicing/JinjaVM_Inter/JVMCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.26853923902814775}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | Februaru 2006 |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_sf_rest\nimports FNF_F_sf_def\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n\ndeclare split_if [split del]\n\n(*****************************************************************\n\n 1. full sequentialization for Depth-restriction (P |. n)\n 2.\n 3.\n\n *****************************************************************)\n\n(*============================================================*\n | |\n | Depth_rest |\n | |\n *============================================================*)\n\n(*============================================================*\n | Pfun P1 P2 |\n *============================================================*)\n\n(*** relation ***)\n\ninductive_set\n fsfF_Depth_rest_rel ::\n \"(('p,'a) proc * nat * ('p,'a) proc) set\"\n\nwhere\nfsfF_Depth_rest_rel_zero:\n \"(P1, 0, SDIV) : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_etc:\n \"P1 ~: fsfF_proc\n ==> (P1, Suc n, P1 |. (Suc n)) : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_int:\n \"[| ALL c. if (c: sumset C1)\n then (Rf1 c, Suc m, SRf c) : fsfF_Depth_rest_rel\n else SRf c = DIV ;\n sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n ((!! :C1 .. Rf1), Suc m, !! c:C1 .. SRf c)\n : fsfF_Depth_rest_rel\"\n|\nfsfF_Depth_rest_rel_step:\n \"[| ALL a. if a:A1\n then (Pf1 a, n, SPf a) : fsfF_Depth_rest_rel\n else SPf a = DIV ;\n ALL a:A1. Pf1 a : fsfF_proc ;\n Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==> \n ((? :A1 -> Pf1) [+] Q1, Suc n, (? :A1 -> SPf) [+] Q1) : fsfF_Depth_rest_rel\"\n\n(*** function ***)\n\ndefinition\n fsfF_Depth_rest ::\n \"('p,'a) proc => nat => ('p,'a) proc\" (\"(1_ /|.seq _)\" [84,900] 84)\n where\n fsfF_Depth_rest_def:\n \"P1 |.seq n == THE SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\n\n(****************************************************************\n | uniquness |\n ****************************************************************)\n\nlemma fsfF_Depth_rest_rel_unique_in_lm:\n \"(P1, n, SP1) : fsfF_Depth_rest_rel\n ==> (ALL SP2. ((P1, n, SP2) : fsfF_Depth_rest_rel\n --> SP1 = SP2))\"\napply (rule fsfF_Depth_rest_rel.induct[of P1 n SP1])\napply (simp)\n\n(* zero *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases)\napply (simp_all)\n\n(* etc *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases)\napply (simp_all)\napply (simp add: fsfF_proc_int)\napply (simp add: fsfF_proc_ext)\n\n(* step_int *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset C1a\")\n apply (simp)\n apply (simp)\n\n(* step *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : A1a\")\n apply (simp_all)\ndone\n\n(*-----------------------*\n | unique |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_unique:\n \"[| (P1, n, SP1) : fsfF_Depth_rest_rel;\n (P1, n, SP2) : fsfF_Depth_rest_rel |]\n ==> SP1 = SP2\"\nby (simp add: fsfF_Depth_rest_rel_unique_in_lm)\n\nlemma fsfF_Depth_rest_rel_EX1:\n \"(EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\n = (EX! SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (rule iffI)\n\n apply (erule exE)\n apply (rule_tac a=\"SP\" in ex1I)\n apply (simp)\n apply (simp add: fsfF_Depth_rest_rel_unique)\n\n apply (elim ex1_implies_exE)\n apply (simp)\ndone\n\n(*------------------------------------------------------------*\n | fsfF_Depth_rest_rel (iff) |\n *------------------------------------------------------------*)\n\n(* zero *)\n\nlemma fsfF_Depth_rest_rel_zero_iff:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel\n = (SP = SDIV)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\napply (simp add: fsfF_Depth_rest_rel_zero)\ndone\n\n(* etc *)\n\nlemma fsfF_Depth_rest_rel_etc_iff:\n \"P1 ~: fsfF_proc\n ==> (P1, Suc n, SP) : fsfF_Depth_rest_rel\n = (SP = P1 |. Suc n)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n apply (simp add: fsfF_proc_int)\n apply (simp add: fsfF_proc_ext)\napply (simp add: fsfF_Depth_rest_rel_etc)\ndone\n\n(* int nat *)\n\nlemma fsfF_Depth_rest_rel_int_iff:\n \"[| ALL c. if (c: sumset C1)\n then (Rf1 c, Suc m, SRf c) : fsfF_Depth_rest_rel\n else SRf c = DIV ;\n sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n ((!! :C1 .. Rf1), Suc m, SP) : fsfF_Depth_rest_rel\n = (SP = !! :C1 .. SRf)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset C1a\")\n apply (simp add: fsfF_Depth_rest_rel_unique)\n\n apply (simp)\napply (simp add: fsfF_Depth_rest_rel_int)\ndone\n\n(* step *)\n\nlemma fsfF_Depth_rest_rel_step_iff:\n \"[| ALL a. if a:A1\n then (Pf1 a, n, SPf a) : fsfF_Depth_rest_rel\n else SPf a = DIV ;\n ALL a:A1. Pf1 a : fsfF_proc ;\n Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==> \n ((? :A1 -> Pf1) [+] Q1, Suc n, SP) : fsfF_Depth_rest_rel\n = (SP = (? :A1 -> SPf) [+] Q1)\"\napply (rule)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (simp add: fun_eq_iff)\n apply (intro allI conjI)\n apply (elim conjE)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : A1a\")\n apply (simp add: fsfF_Depth_rest_rel_unique)\n apply (simp)\napply (simp add: fsfF_Depth_rest_rel_step)\ndone\n\n(****************************************************************\n | existency |\n ****************************************************************)\n\n(*** exists ***)\n\nlemma fsfF_Depth_rest_rel_exists_zero:\n \"(EX SP. (P1, 0, SP) : fsfF_Depth_rest_rel)\"\napply (rule_tac x=\"SDIV\" in exI)\napply (simp add: fsfF_Depth_rest_rel.intros)\ndone\n\nlemma fsfF_Depth_rest_rel_exists_notin:\n \"P1 ~: fsfF_proc\n ==> (EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\napply (rule_tac x=\"P1 |. n\" in exI)\napply (simp add: fsfF_Depth_rest_rel.intros)\ndone\n\n(*** in fsfF_proc ***)\n\n(********* P1 and P2 *********)\n\nlemma fsfF_Depth_rest_rel_exists_in:\n \"P1 : fsfF_proc\n ==> ALL n. (EX SP. (P1, n, SP) : fsfF_Depth_rest_rel)\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int nat *)\napply (rule allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\n\napply (erule dist_BALL_conjE)\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"n\" in spec)\napply (elim exE)\napply (rule_tac x=\"!! c:C .. (if (c : sumset C) then f c else DIV)\" in exI)\napply (rule fsfF_Depth_rest_rel.intros)\napply (simp split: split_if)\napply (simp_all)\n\n(* ext *)\napply (rule allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fsfF_Depth_rest_rel_exists_zero)\n\napply (elim exE)\napply (erule dist_BALL_conjE)\n\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"m\" in spec)\napply (elim exE)\napply (rule_tac x=\"? a:A -> (if (a : A) then (f a) else DIV) [+] Q\" in exI)\napply (rule fsfF_Depth_rest_rel.intros)\napply (simp split: split_if)\napply (simp_all)\ndone\n\n(*-----------------------*\n | exists |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_exists:\n \"EX SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\napply (case_tac \"P1 ~: fsfF_proc\")\napply (simp add: fsfF_Depth_rest_rel_exists_notin)\napply (simp add: fsfF_Depth_rest_rel_exists_in)\ndone\n\n(*-----------------------*\n | uniquely exists |\n *-----------------------*)\n\nlemma fsfF_Depth_rest_rel_unique_exists:\n \"EX! SP. (P1, n, SP) : fsfF_Depth_rest_rel\"\napply (simp add: fsfF_Depth_rest_rel_EX1[THEN sym])\napply (simp add: fsfF_Depth_rest_rel_exists)\ndone\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Depth_rest_rel_zero_in:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel ==> SP : fsfF_proc\"\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\ndone\n\nlemma fsfF_Depth_rest_rel_in_lm:\n \"P1 : fsfF_proc ==> \n ALL n SP. (P1, n, SP) : fsfF_Depth_rest_rel --> SP : fsfF_proc\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int nat *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fsfF_Depth_rest_rel_zero_in)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fsfF_proc.intros)\napply (simp_all)\napply (rule ballI)\napply (drule_tac x=\"c\" in spec)\napply (drule_tac x=\"c\" in bspec, simp)\napply (force)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fsfF_Depth_rest_rel_zero_in)\n\napply (intro impI)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fsfF_proc.intros)\napply (simp_all)\napply (rule ballI)\napply (drule_tac x=\"a\" in spec)\napply (drule_tac x=\"a\" in bspec, simp)\napply (force)\ndone\n\n(*------------------------------------*\n | in |\n *------------------------------------*)\n\nlemma fsfF_Depth_rest_rel_in:\n \"[| P1 : fsfF_proc ; (P1, n, SP) : fsfF_Depth_rest_rel |]\n ==> SP : fsfF_proc\"\napply (insert fsfF_Depth_rest_rel_in_lm[of P1])\napply (blast)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\n(*** relation ***)\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_zero:\n \"(P1, 0, SP) : fsfF_Depth_rest_rel\n ==> P1 |. 0 =F SP\"\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_Zero)\napply (rule cspF_SDIV_eqF)\ndone\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_notin:\n \"[| P1 ~: fsfF_proc ; (P1, n, SP) : fsfF_Depth_rest_rel |]\n ==> P1 |. n =F SP\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\napply (simp add: fsfF_Depth_rest_rel_etc_iff)\ndone\n\nlemma cspF_fsfF_Depth_rest_rel_eqF_in:\n \"P1 : fsfF_proc ==>\n ALL n SP. (P1, n, SP) : fsfF_Depth_rest_rel\n --> P1 |. n =F SP\"\napply (rule fsfF_proc.induct[of P1])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\napply (elim conjE)\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (drule_tac x=\"c\" in bspec, simp)\napply (drule_tac x=\"c\" in spec)\napply (simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_zero)\n\napply (intro impI)\napply (erule fsfF_Depth_rest_rel.cases, simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_decompo)\n\n apply (rule cspF_rw_left)\n apply (rule cspF_step)\n apply (rule cspF_decompo)\n apply (simp)\n apply (simp)\n apply (case_tac \"Q = STOP\")\n apply (simp add: cspF_STOP_Depth_rest)\n apply (simp add: cspF_SKIP_or_DIV_Depth_rest)\ndone\n\n(*------------------------------------*\n | eqF |\n *------------------------------------*)\n\nlemma cspF_fsfF_Depth_rest_rel_eqF:\n \"(P1, n, SP) : fsfF_Depth_rest_rel ==> P1 |. n =F SP\"\napply (case_tac \"P1 ~: fsfF_proc\")\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_notin)\napply (simp add: cspF_fsfF_Depth_rest_rel_eqF_in)\ndone\n\n(*************************************************************\n relation --> function\n *************************************************************)\n\nlemma fsfF_Depth_rest_in_rel:\n \"(P1, n, P1 |.seq n) : fsfF_Depth_rest_rel\"\napply (simp add: fsfF_Depth_rest_def)\napply (rule theI'\n [of \"(%R. (P1, n, R) : fsfF_Depth_rest_rel)\"])\napply (simp add: fsfF_Depth_rest_rel_unique_exists)\ndone\n\nlemma fsfF_Depth_rest_from_rel:\n \"((P1, n, SP) : fsfF_Depth_rest_rel)\n = (P1 |.seq n = SP)\"\napply (rule iffI)\napply (simp add: fsfF_Depth_rest_def)\napply (simp add: fsfF_Depth_rest_rel_unique_exists the1_equality)\n\napply (drule sym)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemma fsfF_Depth_rest_to_rel:\n \"(P1 |.seq n = SP)\n = ((P1, n, SP) : fsfF_Depth_rest_rel)\"\nby (simp add: fsfF_Depth_rest_from_rel)\n\n(*************************************************************\n function\n *************************************************************)\n\nlemma fsfF_Depth_rest_zero:\n \"P1 |.seq 0 = SDIV\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (simp add: fsfF_Depth_rest_rel_zero_iff)\ndone\n\nlemma fsfF_Depth_rest_etc:\n \"P1 ~: fsfF_proc\n ==> P1 |.seq (Suc n) = P1 |. (Suc n)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (simp add: fsfF_Depth_rest_rel_etc_iff)\ndone\n\nlemma fsfF_Depth_rest_int:\n \"[| sumset C1 ~= {} ; ALL c: sumset C1. Rf1 c : fsfF_proc |]\n ==>\n (!! :C1 .. Rf1) |.seq (Suc m) = \n !! c:C1 .. (if c: sumset C1 then (Rf1 c |.seq (Suc m)) else DIV)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (rule fsfF_Depth_rest_rel_int)\napply (simp_all)\napply (simp split: split_if)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemma fsfF_Depth_rest_step:\n \"[| ALL a:A1. Pf1 a : fsfF_proc ; Q1 = SKIP | Q1 = DIV | Q1 = STOP |]\n ==>\n ((? :A1 -> Pf1) [+] Q1) |.seq (Suc n) = \n ((? a:A1 -> (if (a:A1) then (Pf1 a |.seq n) else DIV)) [+] Q1)\"\napply (simp add: fsfF_Depth_rest_to_rel)\napply (rule fsfF_Depth_rest_rel_step)\napply (simp_all)\napply (simp split: split_if)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\nlemmas fsfF_Depth_rest =\n fsfF_Depth_rest_etc\n fsfF_Depth_rest_int\n fsfF_Depth_rest_step\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Depth_rest_in:\n \"P1 : fsfF_proc\n ==> P1 |.seq n : fsfF_proc\"\napply (rule fsfF_Depth_rest_rel_in[of P1 n])\napply (simp_all add: fsfF_Depth_rest_in_rel)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Depth_rest_eqF:\n \"P1 |. n =F P1 |.seq n\"\napply (rule cspF_fsfF_Depth_rest_rel_eqF)\napply (simp add: fsfF_Depth_rest_in_rel)\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_sf_rest.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.2684865194993529}} {"text": "theory javacap_auxiliary\nimports\n Main\n javacap_syntax\nbegin \n\n(* Basic accessors for classes and interfaces *)\ndefinition \"class\" :: \"prog \\ (cname \\ class)\" where\n \"class p \\ map_of (pclasses p)\"\n\ndefinition is_class :: \"prog \\ cname \\ bool\" where\n \"is_class p c \\ (class p c) \\ None\"\n\ndefinition interface :: \"prog \\ (iname \\ interface)\" where\n \"interface p \\ map_of (pinterfaces p)\"\n\ndefinition is_interface :: \"prog \\ iname \\ bool\" where\n \"is_interface p i \\ (interface p i) \\ None\"\n\n(* Is this a capability interface? *)\ndefinition is_cap :: \"prog \\ iname \\ bool\" where\n \"is_cap p c \\ (\\iface. interface p c = Some iface \\ icap iface)\"\n\n(* Determines if the specified type exists (is defined) in the given program *)\nprimrec is_type :: \"prog \\ \\ \\ bool\" where\n \"is_type p (ValT t) = True\" |\n \"is_type p (ClassT c) = is_class p c\" |\n \"is_type p (IfaceT c) = is_interface p c\"\n\nprimrec is_cap_type :: \"prog \\ \\ \\ bool\" where\n \"is_cap_type p (ValT t) = False\" |\n \"is_cap_type p (ClassT c) = False\" |\n \"is_cap_type p (IfaceT i) = is_cap p i\"\n\ndefinition grant :: \"prog \\ (cname \\ label)\" where\n \"grant p \\ map_of (pgrants p)\"\n\n(* utility *)\nprimrec map_adds :: \"('a \\ 'b) list \\ ('a \\ 'b)\" where\n \"map_adds Nil = empty\" |\n \"map_adds (x # xs) = x ++ (map_adds xs)\"\n\n(* Auxilliary definitions *)\ndefinition direct_subclass :: \"prog \\ cname rel\"\n where \"direct_subclass p \\ {(c,s). c \\ Object \\ (\\cl. class p c = Some cl \\ cextends cl = s) }\"\n\ndefinition direct_subinterface :: \"prog \\ iname rel\"\n where \"direct_subinterface p \\ {(c,s). (\\i. interface p c = Some i \\ s \\ set (iextends i))}\"\n\n(* Reflective transitive closure. *)\nabbreviation \"subclass\" :: \"prog \\ cname rel\"\n where \"subclass p \\ (direct_subclass p)\\<^sup>*\"\n\nabbreviation subinterface :: \"prog \\ iname rel\"\n where \"subinterface p \\ (direct_subinterface p)\\<^sup>*\"\n\n\n\n(* Note: subtype overrides supertype. *)\n(* 'a = cname, 'b = (class \\ ('a \\ 'b) list) \\ ('a \\ 'b) *)\ndefinition class_recursion ::\"prog \\ cname \\ (cdecl \\ ('a \\ 'b)) \\ ('a \\ 'b)\"\n where\n \"class_recursion p \\ wfrec ((direct_subclass p)\\) (\\rec cname f.\n case class p cname of None \\ undefined\n | Some cl \\ (if cname = Object then empty else rec (cextends cl) f) ++ (f (cname,cl)))\"\n (* With the map ++ operator, the RHS overrides the LHS. Therefore, the subtype overrides the\n supertype. *)\n\ndefinition interface_recursion :: \"prog \\ iname \\ (interface \\ ('a \\ 'b) list) \\ ('a \\ 'b)\"\n where \"interface_recursion p \\ wfrec ((direct_subinterface p)\\) (\\rec (iname::iname) f. \n case interface p iname of None \\ undefined \n | Some cb \\ map_adds (map (\\super. rec super f) (iextends cb)) ++ map_of (f cb))\"\n\ndefinition cdeclmethods :: \"cdecl \\ (mname \\ (cname \\ method))\"\n where \"cdeclmethods \\ (\\(cn,cl). map_comp (\\m. Some (cn,m)) (map_of (cmethods cl)))\"\n(* equivalent to: where \"cdeclmethods \\ (\\(cn,cl). map_of (map (\\(mn,meth). (mn,(cn,meth))) (cmethods cl)))\"*)\n\n(* For a given class and program name, returns a mapping\n from method names to a (declaring class name, method declaration) pair.*)\ndefinition cmethod :: \"prog \\ cname \\ (mname \\ (cname \\ method))\"\n where \"cmethod p c \\ class_recursion p c cdeclmethods\" \n\ndefinition cmethoddecl :: \"prog \\ cname \\ (mname \\ mdecl)\"\n where \"cmethoddecl p c \\ map_comp (\\(cn,m). Some (mdecl m)) (cmethod p c)\"\n\ndefinition imethoddecl :: \"prog \\ iname \\ (mname \\ mdecl)\"\n where \"imethoddecl p c \\ interface_recursion p c imethods\"\n\ndefinition methoddecl :: \"prog \\ \\ \\ (mname \\ mdecl)\"\n where \"methoddecl p t \\ (case t of ValT t' \\ undefined | ClassT c \\ cmethoddecl p c | IfaceT cb \\ imethoddecl p cb)\"\n\ndefinition field :: \"prog \\ cname \\ (fname \\ fdecl)\"\n where \"field p c \\ class_recursion p c (\\(cn,cl). (map_of (cfields cl)))\"\n\n\n(* Gets the minimal label that acts as an identity when intersected with the method parameters\n and return values of this object. *)\ndefinition sum_method_labels :: \"mdecl \\ label\"\n where \"sum_method_labels md \\ (tlabel (mret md)) \\ (\\p\\(set (msig(mpar md))). (tlabel p))\"\n\n(* The set of all superinterfaces (including itself) of an interface *)\ndefinition superinterface_set :: \"prog \\ iname \\ iname set\" \n where \"superinterface_set p ifname \\ {ifname'. (ifname, ifname') \\ (subinterface p)}\"\n\n(* The set of capabilities that can be accessed via a capability interface. It is the minimal label that acts \n as an the identity when intersected with the label of any method return value or parameter\n of that interface. *)\ndefinition cap_label :: \"prog \\ iname \\ label\"\n where \"cap_label p ifname \\ (superinterface_set p ifname) \\ \n (let meths = imethoddecl p ifname in (\\m\\dom(meths). sum_method_labels (the (meths m))))\"\n \n(* if x is in the domain of a mapping, and the mapping is in the list,\n then x must be in the domain of the final mapping. *)\nlemma map_adds_domain:\n shows \"x \\ dom m \\ m \\ (set ms) \\ x \\ dom (map_adds ms)\"\nproof (induction ms)\n case Nil\n then show ?case by auto (* by contradiction; the premises are not possible *)\nnext\n case a1: (Cons a ms)\n then show ?case\n proof (cases \"m \\ set ms\")\n case b1: True\n then have \"x \\ dom (map_adds ms)\" using a1 by blast (* by induction *)\n then have \"x \\ dom (map_adds (a # ms))\" by auto\n then show ?thesis by simp\n next\n case b1: False\n then have \"m = a\" using a1 by simp\n then have \"x \\ dom (map_adds (a # ms))\" using a1 by auto\n then show ?thesis by simp\n qed\nqed\n\nlemma class_unfold:\n assumes wf_subclass: \"wf ((direct_subclass P)\\)\"\n assumes class_exist: \"class P c = Some cl\"\n(* prog \\ cname \\ (class \\ ('a \\ 'b) list) \\ ('a \\ 'b) *)\n(* (f::(class \\ ('a \\ 'b) list)) *)\n shows \"((class_recursion P c f)::('a \\ 'b)) = \n (if c = Object then empty else class_recursion P (cextends cl) f) ++ (f (c,cl))\"\nproof -\n define R where \"R = ((direct_subclass P)\\)\"\n define F where \"F = (\\rec cname (f::(cdecl \\ ('a \\ 'b))).\n case class P cname of None \\ undefined\n | Some cl \\ (if cname = Object then empty else rec (cextends cl) f) ++ (f (cname,cl)))\"\n have a1: \"class_recursion P = wfrec R F\" unfolding R_def F_def class_recursion_def by simp\n have \"wf R\" unfolding R_def using wf_subclass by simp\n then have \"class_recursion P c = F (cut (wfrec R F) R c) c\"\n unfolding class_recursion_def using R_def F_def wfrec by simp\n then have \"class_recursion P c f = (\n case class P c of None \\ undefined\n | Some cl \\ (if c = Object then empty else \n (if ((cextends cl), c) \\ (direct_subclass P)\\ then class_recursion P (cextends cl) else undefined) f) ++ (f (c,cl))\n )\" using a1 R_def unfolding F_def cut_def by metis \n also have \"... = (if c = Object then empty else class_recursion P (cextends cl) f) ++ (f (c,cl))\"\n using class_exist unfolding direct_subclass_def by simp\n finally show ?thesis .\nqed\n\nlemma interface_unfold:\n assumes wf_subinterface: \"wf ((direct_subinterface P)\\)\"\n assumes interface_exist: \"interface P c = Some cb\"\n shows \"((interface_recursion P c f)::('a \\ 'b)) = \n map_adds (map (\\super. interface_recursion P super f) (iextends cb)) ++ map_of (f cb)\"\nproof -\n define R where \"R = ((direct_subinterface P)\\)\"\n define F where \"F = (\\rec (iname::iname) (f::(interface \\ ('a \\ 'b) list)). \n case interface P iname of None \\ undefined \n | Some cb \\ map_adds (map (\\super. rec super f) (iextends cb)) ++ map_of (f cb))\"\n have a1: \"interface_recursion P = wfrec R F\" unfolding R_def F_def interface_recursion_def by simp\n have a2: \"\\cb'\\set (iextends cb). (if (cb', c) \\ (direct_subinterface P)\\ then (interface_recursion P) cb' else undefined) f = ((interface_recursion P) cb') f\"\n unfolding direct_subinterface_def using interface_exist by simp\n\n have \"wf R\" unfolding R_def using wf_subinterface by simp\n then have \"interface_recursion P c = F (cut (wfrec R F) R c) c\"\n unfolding interface_recursion_def using R_def F_def wfrec by simp\n then have \"interface_recursion P c f = (\n case interface P c of None \\ undefined \n | Some cb \\ map_adds (map (\\super. (if (super, c) \\ (direct_subinterface P)\\ then (interface_recursion P) super else undefined) f) (iextends cb)) ++ map_of (f cb)\n )\" using a1 F_def unfolding cut_def R_def by metis\n also have \"... = map_adds (map (\\super. (interface_recursion P) super f) (iextends cb)) ++ map_of (f cb)\"\n using interface_exist a2 map_eq_conv option.simps(5) by (metis (no_types, lifting)) \n finally show ?thesis .\nqed\n\nlemma cmethod_unfold:\n assumes wf_subclass: \"wf ((direct_subclass P)\\)\"\n assumes class_exist: \"class P c = Some cl\"\n shows \"cmethod P c = (if c = Object then empty else cmethod P (cextends cl)) ++ (cdeclmethods (c,cl))\"\n using assms class_unfold unfolding cmethod_def by metis\n\nlemma cmethod_cmethods:\n assumes wf_subclass: \"wf ((direct_subclass P)\\)\"\n assumes class_exist: \"class P c = Some cl\"\n assumes method_exist: \"(map_of (cmethods cl)) mname = Some m\"\n shows \"cmethod P c mname = Some (c,m)\"\nproof -\n have \"cdeclmethods (c,cl) mname = Some (c,m)\"\n unfolding cdeclmethods_def using method_exist by auto\n then show ?thesis using cmethod_unfold wf_subclass class_exist by auto\nqed\n\nlemma cmethoddecl_cmethods:\n assumes wf_subclass: \"wf ((direct_subclass P)\\)\"\n assumes class_exist: \"class P c = Some cl\"\n assumes method_exist: \"(map_of (cmethods cl)) mname = Some m\"\n shows \"cmethoddecl P c mname = Some (mdecl m)\"\n using cmethod_cmethods assms unfolding cmethoddecl_def by auto\n\nlemma field_unfold:\n assumes wf_subclass: \"wf ((direct_subclass P)\\)\"\n assumes class_exist: \"class P c = Some cl\"\n shows \"field P c = (if c = Object then empty else field P (cextends cl)) ++ (map_of (cfields cl))\"\nproof -\n have \"field P c = (if c = Object then empty else field P (cextends cl)) ++ ((\\(cn,cl). (map_of (cfields cl))) (c,cl))\"\n using assms class_unfold unfolding field_def by metis\n then show ?thesis by auto\nqed\n\nlemma imethoddecl_unfold:\n assumes wf_subinterface: \"wf ((direct_subinterface P)\\)\"\n assumes interface_exist: \"interface P c = Some cb\"\n shows \"imethoddecl P c = map_adds (map (\\super. imethoddecl P super) (iextends cb)) ++ map_of (imethods cb)\"\n using assms interface_unfold unfolding imethoddecl_def by metis\n\nend", "meta": {"author": "patrickmeiring", "repo": "JavaCap", "sha": "43ded44673c45d596b6a399ef24292416591520b", "save_path": "github-repos/isabelle/patrickmeiring-JavaCap", "path": "github-repos/isabelle/patrickmeiring-JavaCap/JavaCap-43ded44673c45d596b6a399ef24292416591520b/javacap_auxiliary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.26848651357462}} {"text": "(* Title: HOL/HOLCF/IOA/meta_theory/SimCorrectness.thy\n Author: Olaf Müller\n*)\n\nsection {* Correctness of Simulations in HOLCF/IOA *}\n\ntheory SimCorrectness\nimports Simulations\nbegin\n\ndefinition\n (* Note: s2 instead of s1 in last argument type !! *)\n corresp_ex_simC :: \"('a,'s2)ioa => (('s1 * 's2)set) => ('a,'s1)pairs\n -> ('s2 => ('a,'s2)pairs)\" where\n \"corresp_ex_simC A R = (fix$(LAM h ex. (%s. case ex of\n nil => nil\n | x##xs => (flift1 (%pr. let a = (fst pr); t = (snd pr);\n T' = @t'. ? ex1. (t,t'):R & move A ex1 s a t'\n in\n (@cex. move A cex s a T')\n @@ ((h$xs) T'))\n $x) )))\"\n\ndefinition\n corresp_ex_sim :: \"('a,'s2)ioa => (('s1 *'s2)set) =>\n ('a,'s1)execution => ('a,'s2)execution\" where\n \"corresp_ex_sim A R ex == let S'= (@s'.(fst ex,s'):R & s': starts_of A)\n in\n (S',(corresp_ex_simC A R$(snd ex)) S')\"\n\n\nsubsection \"corresp_ex_sim\"\n\nlemma corresp_ex_simC_unfold: \"corresp_ex_simC A R = (LAM ex. (%s. case ex of\n nil => nil\n | x##xs => (flift1 (%pr. let a = (fst pr); t = (snd pr);\n T' = @t'. ? ex1. (t,t'):R & move A ex1 s a t'\n in\n (@cex. move A cex s a T')\n @@ ((corresp_ex_simC A R $xs) T'))\n $x) ))\"\napply (rule trans)\napply (rule fix_eq2)\napply (simp only: corresp_ex_simC_def)\napply (rule beta_cfun)\napply (simp add: flift1_def)\ndone\n\nlemma corresp_ex_simC_UU: \"(corresp_ex_simC A R$UU) s=UU\"\napply (subst corresp_ex_simC_unfold)\napply simp\ndone\n\nlemma corresp_ex_simC_nil: \"(corresp_ex_simC A R$nil) s = nil\"\napply (subst corresp_ex_simC_unfold)\napply simp\ndone\n\nlemma corresp_ex_simC_cons: \"(corresp_ex_simC A R$((a,t)>>xs)) s =\n (let T' = @t'. ? ex1. (t,t'):R & move A ex1 s a t'\n in\n (@cex. move A cex s a T')\n @@ ((corresp_ex_simC A R$xs) T'))\"\napply (rule trans)\napply (subst corresp_ex_simC_unfold)\napply (simp add: Consq_def flift1_def)\napply simp\ndone\n\n\ndeclare corresp_ex_simC_UU [simp] corresp_ex_simC_nil [simp] corresp_ex_simC_cons [simp]\n\n\nsubsection \"properties of move\"\n\ndeclare Let_def [simp del]\n\nlemma move_is_move_sim:\n \"[|is_simulation R C A; reachable C s; s -a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n (t,T'): R & move A (@ex2. move A ex2 s' a T') s' a T'\"\napply (unfold is_simulation_def)\n\n(* Does not perform conditional rewriting on assumptions automatically as\n usual. Instantiate all variables per hand. Ask Tobias?? *)\napply (subgoal_tac \"? t' ex. (t,t') :R & move A ex s' a t'\")\nprefer 2\napply simp\napply (erule conjE)\napply (erule_tac x = \"s\" in allE)\napply (erule_tac x = \"s'\" in allE)\napply (erule_tac x = \"t\" in allE)\napply (erule_tac x = \"a\" in allE)\napply simp\n(* Go on as usual *)\napply (erule exE)\napply (drule_tac x = \"t'\" and P = \"%t'. ? ex. (t,t') :R & move A ex s' a t'\" in someI)\napply (erule exE)\napply (erule conjE)\napply (simp add: Let_def)\napply (rule_tac x = \"ex\" in someI)\napply assumption\ndone\n\ndeclare Let_def [simp]\n\nlemma move_subprop1_sim:\n \"[|is_simulation R C A; reachable C s; s-a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n is_exec_frag A (s',@x. move A x s' a T')\"\napply (cut_tac move_is_move_sim)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop2_sim:\n \"[|is_simulation R C A; reachable C s; s-a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n Finite (@x. move A x s' a T')\"\napply (cut_tac move_is_move_sim)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop3_sim:\n \"[|is_simulation R C A; reachable C s; s-a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n laststate (s',@x. move A x s' a T') = T'\"\napply (cut_tac move_is_move_sim)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop4_sim:\n \"[|is_simulation R C A; reachable C s; s-a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n mk_trace A$((@x. move A x s' a T')) =\n (if a:ext A then a>>nil else nil)\"\napply (cut_tac move_is_move_sim)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop5_sim:\n \"[|is_simulation R C A; reachable C s; s-a--C-> t; (s,s'):R|] ==>\n let T' = @t'. ? ex1. (t,t'):R & move A ex1 s' a t' in\n (t,T'):R\"\napply (cut_tac move_is_move_sim)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\n\nsubsection {* TRACE INCLUSION Part 1: Traces coincide *}\n\nsubsubsection \"Lemmata for <==\"\n\n(* ------------------------------------------------------\n Lemma 1 :Traces coincide\n ------------------------------------------------------- *)\n\ndeclare split_if [split del]\nlemma traces_coincide_sim [rule_format (no_asm)]:\n \"[|is_simulation R C A; ext C = ext A|] ==>\n !s s'. reachable C s & is_exec_frag C (s,ex) & (s,s'): R -->\n mk_trace C$ex = mk_trace A$((corresp_ex_simC A R$ex) s')\"\n\napply (tactic {* pair_induct_tac @{context} \"ex\" [@{thm is_exec_frag_def}] 1 *})\n(* cons case *)\napply auto\napply (rename_tac ex a t s s')\napply (simp add: mk_traceConc)\napply (frule reachable.reachable_n)\napply assumption\napply (erule_tac x = \"t\" in allE)\napply (erule_tac x = \"@t'. ? ex1. (t,t') :R & move A ex1 s' a t'\" in allE)\napply (simp add: move_subprop5_sim [unfolded Let_def]\n move_subprop4_sim [unfolded Let_def] split add: split_if)\ndone\ndeclare split_if [split]\n\n\n(* ----------------------------------------------------------- *)\n(* Lemma 2 : corresp_ex_sim is execution *)\n(* ----------------------------------------------------------- *)\n\n\nlemma correspsim_is_execution [rule_format (no_asm)]:\n \"[| is_simulation R C A |] ==>\n !s s'. reachable C s & is_exec_frag C (s,ex) & (s,s'):R\n --> is_exec_frag A (s',(corresp_ex_simC A R$ex) s')\"\n\napply (tactic {* pair_induct_tac @{context} \"ex\" [@{thm is_exec_frag_def}] 1 *})\n(* main case *)\napply auto\napply (rename_tac ex a t s s')\napply (rule_tac t = \"@t'. ? ex1. (t,t') :R & move A ex1 s' a t'\" in lemma_2_1)\n\n(* Finite *)\napply (erule move_subprop2_sim [unfolded Let_def])\napply assumption+\napply (rule conjI)\n\n(* is_exec_frag *)\napply (erule move_subprop1_sim [unfolded Let_def])\napply assumption+\napply (rule conjI)\n\n(* Induction hypothesis *)\n(* reachable_n looping, therefore apply it manually *)\napply (erule_tac x = \"t\" in allE)\napply (erule_tac x = \"@t'. ? ex1. (t,t') :R & move A ex1 s' a t'\" in allE)\napply simp\napply (frule reachable.reachable_n)\napply assumption\napply (simp add: move_subprop5_sim [unfolded Let_def])\n(* laststate *)\napply (erule move_subprop3_sim [unfolded Let_def, symmetric])\napply assumption+\ndone\n\n\nsubsection \"Main Theorem: TRACE - INCLUSION\"\n\n(* -------------------------------------------------------------------------------- *)\n\n (* generate condition (s,S'):R & S':starts_of A, the first being intereting\n for the induction cases concerning the two lemmas correpsim_is_execution and\n traces_coincide_sim, the second for the start state case.\n S':= @s'. (s,s'):R & s':starts_of A, where s:starts_of C *)\n\nlemma simulation_starts:\n\"[| is_simulation R C A; s:starts_of C |]\n ==> let S' = @s'. (s,s'):R & s':starts_of A in\n (s,S'):R & S':starts_of A\"\n apply (simp add: is_simulation_def corresp_ex_sim_def Int_non_empty Image_def)\n apply (erule conjE)+\n apply (erule ballE)\n prefer 2 apply (blast)\n apply (erule exE)\n apply (rule someI2)\n apply assumption\n apply blast\n done\n\nlemmas sim_starts1 = simulation_starts [unfolded Let_def, THEN conjunct1]\nlemmas sim_starts2 = simulation_starts [unfolded Let_def, THEN conjunct2]\n\n\nlemma trace_inclusion_for_simulations:\n \"[| ext C = ext A; is_simulation R C A |]\n ==> traces C <= traces A\"\n\n apply (unfold traces_def)\n\n apply (simp (no_asm) add: has_trace_def2)\n apply auto\n\n (* give execution of abstract automata *)\n apply (rule_tac x = \"corresp_ex_sim A R ex\" in bexI)\n\n (* Traces coincide, Lemma 1 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (rename_tac s ex)\n apply (simp (no_asm) add: corresp_ex_sim_def)\n apply (rule_tac s = \"s\" in traces_coincide_sim)\n apply assumption+\n apply (simp add: executions_def reachable.reachable_0 sim_starts1)\n\n (* corresp_ex_sim is execution, Lemma 2 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (simp add: executions_def)\n apply (rename_tac s ex)\n\n (* start state *)\n apply (rule conjI)\n apply (simp add: sim_starts2 corresp_ex_sim_def)\n\n (* is-execution-fragment *)\n apply (simp add: corresp_ex_sim_def)\n apply (rule_tac s = s in correspsim_is_execution)\n apply assumption\n apply (simp add: reachable.reachable_0 sim_starts1)\n done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/meta_theory/SimCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2684785094968909}} {"text": "theory Design_generated_generated imports \"../Toy_Library\" \"../Toy_Library_Static\" begin\n\n(* 1 ************************************ 0 + 1 *)\nsection \\Class Model: Introduction\\\n\n(* 2 ************************************ 1 + 1 *)\ntext \\\n For certain concepts like classes and class-types, only a generic\n definition for its resulting semantics can be given. Generic means,\n there is a function outside HOL that ``compiles'' a concrete,\n closed-world class diagram into a ``theory'' of this data model,\n consisting of a bunch of definitions for classes, accessors, method,\n casts, and tests for actual types, as well as proofs for the\n fundamental properties of these operations in this concrete data\n model. \\\n\n(* 3 ************************************ 2 + 1 *)\nsection \\Class Model: The Construction of the Object Universe\\\n\n(* 4 ************************************ 3 + 1 *)\ntext \\\n Our data universe consists in the concrete class diagram just of node's,\nand implicitly of the class object. Each class implies the existence of a class\ntype defined for the corresponding object representations as follows: \\\n\n(* 5 ************************************ 4 + 10 *)\ndatatype ty\\\\\\\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m = mk\\\\\\\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"oid\" \"oid list option\" \"int option\" \"bool option\" \"nat option\" \"unit option\"\ndatatype ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m = mk\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\\\\\\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\" \"int option\"\ndatatype ty\\\\\\\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e = mk\\\\\\\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e_\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\"\n | mk\\\\\\\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"oid\" \"oid list option\" \"int option\" \"bool option\" \"nat option\" \"unit option\"\ndatatype ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e = mk\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"ty\\\\\\\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\"\ndatatype ty\\\\\\\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n = mk\\\\\\\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\"\n | mk\\\\\\\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\"\n | mk\\\\\\\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n \"oid\" \"nat option\" \"unit option\"\ndatatype ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n = mk\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n \"ty\\\\\\\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"oid list option\" \"int option\" \"bool option\"\ndatatype ty\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y = mk\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y_\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\n | mk\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y_\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\"\n | mk\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y_\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\"\n | mk\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y \"oid\"\ndatatype ty\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y = mk\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y \"ty\\\\\\\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y\" \"nat option\" \"unit option\"\ndatatype ty\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y = mk\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y_\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y \"ty\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y\"\n | mk\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y_\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\n | mk\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y_\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\"\n | mk\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y_\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\"\n | mk\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y \"oid\"\ndatatype ty\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y = mk\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y \"ty\\\\\\\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y\"\n\n(* 6 ************************************ 14 + 1 *)\ntext \\\n Now, we construct a concrete ``universe of ToyAny types'' by injection into a\nsum type containing the class types. This type of ToyAny will be used as instance\nfor all respective type-variables. \\\n\n(* 7 ************************************ 15 + 1 *)\ndatatype \\ = in\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m \"ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\"\n | in\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e \"ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\"\n | in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\n | in\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y \"ty\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y\"\n | in\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y \"ty\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y\"\n\n(* 8 ************************************ 16 + 1 *)\ntext \\\n Having fixed the object universe, we can introduce type synonyms that exactly correspond\nto Toy types. Again, we exploit that our representation of Toy is a ``shallow embedding'' with a\none-to-one correspondance of Toy-types to types of the meta-language HOL. \\\n\n(* 9 ************************************ 17 + 5 *)\ntype_synonym Atom = \"\\\\ty\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m\\\\<^sub>\\\\\\<^sub>\\\"\ntype_synonym Molecule = \"\\\\ty\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e\\\\<^sub>\\\\\\<^sub>\\\"\ntype_synonym Person = \"\\\\ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\<^sub>\\\\\\<^sub>\\\"\ntype_synonym Galaxy = \"\\\\ty\\<^sub>G\\<^sub>a\\<^sub>l\\<^sub>a\\<^sub>x\\<^sub>y\\\\<^sub>\\\\\\<^sub>\\\"\ntype_synonym ToyAny = \"\\\\ty\\<^sub>T\\<^sub>o\\<^sub>y\\<^sub>A\\<^sub>n\\<^sub>y\\\\<^sub>\\\\\\<^sub>\\\"\n\n(* 10 ************************************ 22 + 1 *)\nsection \\Class Model: The Accessors\\\n\n(* 11 ************************************ 23 + 3 *)\ndefinition \"oid\\<^sub>A\\<^sub>t\\<^sub>o\\<^sub>m_0___boss = 0\"\ndefinition \"oid\\<^sub>M\\<^sub>o\\<^sub>l\\<^sub>e\\<^sub>c\\<^sub>u\\<^sub>l\\<^sub>e_0___boss = 0\"\ndefinition \"oid\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_0___boss = 0\"\n\n(* 12 ************************************ 26 + 2 *)\ndefinition \"switch\\<^sub>2_01 = (\\ [x0 , x1] \\ (x0 , x1))\"\ndefinition \"switch\\<^sub>2_10 = (\\ [x0 , x1] \\ (x1 , x0))\"\n\n(* 13 ************************************ 28 + 1 *)\nsection \\Instance\\\n\n(* 14 ************************************ 29 + 3 *)\ndefinition \"oid1 = 1\"\ndefinition \"oid2 = 2\"\ndefinition \"inst_assoc1 = (\\oid_class to_from oid. ((case (deref_assocs_list ((to_from::oid list list \\ oid list \\ oid list)) ((oid::oid)) ((the ((((map_of_list ([(oid\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_0___boss , (List.map ((\\(x , y). [x , y]) o switch\\<^sub>2_01) ([[[oid1] , [oid2]]])))]))) ((oid_class::oid))))))) of Nil \\ None\n | l \\ (Some (l)))::oid list option))\"\n\n(* 15 ************************************ 32 + 0 *)\n\n(* 16 ************************************ 32 + 1 *)\nsection \\Instance\\\n\n(* 17 ************************************ 33 + 2 *)\ndefinition \"oid3 = 3\"\ndefinition \"inst_assoc3 = (\\oid_class to_from oid. ((case (deref_assocs_list ((to_from::oid list list \\ oid list \\ oid list)) ((oid::oid)) ((the ((((map_of_list ([]))) ((oid_class::oid))))))) of Nil \\ None\n | l \\ (Some (l)))::oid list option))\"\n\n(* 18 ************************************ 35 + 0 *)\n\n(* 19 ************************************ 35 + 1 *)\nsection \\Instance\\\n\n(* 20 ************************************ 36 + 5 *)\ndefinition \"oid4 = 4\"\ndefinition \"oid5 = 5\"\ndefinition \"oid6 = 6\"\ndefinition \"oid7 = 7\"\ndefinition \"inst_assoc4 = (\\oid_class to_from oid. ((case (deref_assocs_list ((to_from::oid list list \\ oid list \\ oid list)) ((oid::oid)) ((the ((((map_of_list ([(oid\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_0___boss , (List.map ((\\(x , y). [x , y]) o switch\\<^sub>2_01) ([[[oid7] , [oid6]] , [[oid6] , [oid1]] , [[oid4] , [oid5]]])))]))) ((oid_class::oid))))))) of Nil \\ None\n | l \\ (Some (l)))::oid list option))\"\n\n(* 21 ************************************ 41 + 0 *)\n\n(* 22 ************************************ 41 + 1 *)\nsection \\State (Floor 2)\\\n\n(* 23 ************************************ 42 + 1 *)\nlocale state_\\\\<^sub>1 =\nfixes \"oid1\" :: \"nat\"\nfixes \"oid2\" :: \"nat\"\nfixes \"oid4\" :: \"nat\"\nfixes \"oid5\" :: \"nat\"\nfixes \"oid6\" :: \"nat\"\nfixes \"oid7\" :: \"nat\"\nassumes distinct_oid: \"(distinct ([oid1 , oid2 , oid4 , oid5 , oid6 , oid7]))\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object0\" :: \"\\Person\"\nassumes \\\\<^sub>1_object0_def: \"\\\\<^sub>1_object0 = (\\_. \\\\\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object1\" :: \"\\Person\"\nassumes \\\\<^sub>1_object1_def: \"\\\\<^sub>1_object1 = (\\_. \\\\\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object2\" :: \"\\Person\"\nassumes \\\\<^sub>1_object2_def: \"\\\\<^sub>1_object2 = (\\_. \\\\\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object4\" :: \"\\Person\"\nassumes \\\\<^sub>1_object4_def: \"\\\\<^sub>1_object4 = (\\_. \\\\\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nbegin\ndefinition \"\\\\<^sub>1 = (state.make ((Map.empty (oid4 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid5 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid6 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid1 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid7 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid2 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))))) ((map_of_list ([(oid\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_0___boss , (List.map ((\\(x , y). [x , y]) o switch\\<^sub>2_01) ([[[oid4] , [oid5]] , [[oid6] , [oid1]] , [[oid1] , [oid2]] , [[oid7] , [oid6]]])))]))))\"\n\nlemma perm_\\\\<^sub>1 : \"\\\\<^sub>1 = (state.make ((Map.empty (oid2 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid7 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid1 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid6 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid5 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid4 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))))) ((assocs (\\\\<^sub>1))))\"\n apply(simp add: \\\\<^sub>1_def)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (3) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (4) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (3) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (5) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (4) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (3) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\nby(simp)\nend\n\n(* 24 ************************************ 43 + 1 *)\nsection \\Instance\\\n\n(* 25 ************************************ 44 + 2 *)\ndefinition \"oid8 = 8\"\ndefinition \"inst_assoc8 = (\\oid_class to_from oid. ((case (deref_assocs_list ((to_from::oid list list \\ oid list \\ oid list)) ((oid::oid)) ((the ((((map_of_list ([]))) ((oid_class::oid))))))) of Nil \\ None\n | l \\ (Some (l)))::oid list option))\"\n\n(* 26 ************************************ 46 + 0 *)\n\n(* 27 ************************************ 46 + 1 *)\nsection \\State (Floor 2)\\\n\n(* 28 ************************************ 47 + 1 *)\nlocale state_\\\\<^sub>1' =\nfixes \"oid1\" :: \"nat\"\nfixes \"oid2\" :: \"nat\"\nfixes \"oid3\" :: \"nat\"\nfixes \"oid8\" :: \"nat\"\nassumes distinct_oid: \"(distinct ([oid1 , oid2 , oid3 , oid8]))\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nbegin\ndefinition \"\\\\<^sub>1' = (state.make ((Map.empty (oid1 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid2 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid3 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid8 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))))) ((map_of_list ([(oid\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n_0___boss , (List.map ((\\(x , y). [x , y]) o switch\\<^sub>2_01) ([[[oid1] , [oid2]]])))]))))\"\n\nlemma perm_\\\\<^sub>1' : \"\\\\<^sub>1' = (state.make ((Map.empty (oid8 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid3 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid2 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))) (oid1 \\ (in\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n))))) ((assocs (\\\\<^sub>1'))))\"\n apply(simp add: \\\\<^sub>1'_def)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (3) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (2) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\n apply(subst (1) fun_upd_twist, metis distinct_oid distinct_length_2_or_more)\nby(simp)\nend\n\n(* 29 ************************************ 48 + 1 *)\nsection \\Transition (Floor 2)\\\n\n(* 30 ************************************ 49 + 1 *)\nlocale transition_\\\\<^sub>1_\\\\<^sub>1' =\nfixes \"oid1\" :: \"nat\"\nfixes \"oid2\" :: \"nat\"\nfixes \"oid3\" :: \"nat\"\nfixes \"oid4\" :: \"nat\"\nfixes \"oid5\" :: \"nat\"\nfixes \"oid6\" :: \"nat\"\nfixes \"oid7\" :: \"nat\"\nfixes \"oid8\" :: \"nat\"\nassumes distinct_oid: \"(distinct ([oid1 , oid2 , oid3 , oid4 , oid5 , oid6 , oid7 , oid8]))\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object0\" :: \"\\Person\"\nassumes \\\\<^sub>1_object0_def: \"\\\\<^sub>1_object0 = (\\_. \\\\\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object1\" :: \"\\Person\"\nassumes \\\\<^sub>1_object1_def: \"\\\\<^sub>1_object1 = (\\_. \\\\\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object2\" :: \"\\Person\"\nassumes \\\\<^sub>1_object2_def: \"\\\\<^sub>1_object2 = (\\_. \\\\\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"\\\\<^sub>1_object4\" :: \"\\Person\"\nassumes \\\\<^sub>1_object4_def: \"\\\\<^sub>1_object4 = (\\_. \\\\\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" :: \"ty\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\"\nfixes \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\" :: \"\\Person\"\nassumes X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4_def: \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4 = (\\_. \\\\X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\\\\)\"\n\nassumes \\\\<^sub>1: \"(state_\\\\<^sub>1 (oid1) (oid2) (oid4) (oid5) (oid6) (oid7) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2) (\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (\\\\<^sub>1_object0) (\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (\\\\<^sub>1_object1) (\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (\\\\<^sub>1_object2) (\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (\\\\<^sub>1_object4))\"\n\nassumes \\\\<^sub>1': \"(state_\\\\<^sub>1' (oid1) (oid2) (oid3) (oid8) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n) (X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4))\"\nbegin\ninterpretation state_\\\\<^sub>1: state_\\\\<^sub>1 \"oid1\" \"oid2\" \"oid4\" \"oid5\" \"oid6\" \"oid7\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\" \"\\\\<^sub>1_object0\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"\\\\<^sub>1_object0\" \"\\\\<^sub>1_object1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"\\\\<^sub>1_object1\" \"\\\\<^sub>1_object2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"\\\\<^sub>1_object2\" \"\\\\<^sub>1_object4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"\\\\<^sub>1_object4\"\nby(rule \\\\<^sub>1)\n\ninterpretation state_\\\\<^sub>1': state_\\\\<^sub>1' \"oid1\" \"oid2\" \"oid3\" \"oid8\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n1\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n2\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n3\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n\" \"X\\<^sub>P\\<^sub>e\\<^sub>r\\<^sub>s\\<^sub>o\\<^sub>n4\"\nby(rule \\\\<^sub>1')\nend\n\nend\n", "meta": {"author": "object-logics", "repo": "citadelle-devel", "sha": "fd4d57977d1a8a7330ae7d8651d003789980c802", "save_path": "github-repos/isabelle/object-logics-citadelle-devel", "path": "github-repos/isabelle/object-logics-citadelle-devel/citadelle-devel-fd4d57977d1a8a7330ae7d8651d003789980c802/src/compiler_generic/toy_example/document_generated/Design_generated_generated.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2683884186517871}} {"text": "(* Title: HOL/HOLCF/IOA/NTP/Impl.thy\n Author: Tobias Nipkow & Konrad Slind\n*)\n\nsection \\The implementation\\\n\ntheory Impl\nimports Sender Receiver Abschannel\nbegin\n\ntype_synonym 'm impl_state\n = \"'m sender_state * 'm receiver_state * 'm packet multiset * bool multiset\"\n (* sender_state * receiver_state * srch_state * rsch_state *)\n\n\ndefinition\n impl_ioa :: \"('m action, 'm impl_state)ioa\" where\n impl_def: \"impl_ioa == (sender_ioa \\ receiver_ioa \\ srch_ioa \\ rsch_ioa)\"\n\ndefinition sen :: \"'m impl_state => 'm sender_state\" where \"sen = fst\"\ndefinition rec :: \"'m impl_state => 'm receiver_state\" where \"rec = fst \\ snd\"\ndefinition srch :: \"'m impl_state => 'm packet multiset\" where \"srch = fst \\ snd \\ snd\"\ndefinition rsch :: \"'m impl_state => bool multiset\" where \"rsch = snd \\ snd \\ snd\"\n\ndefinition\n hdr_sum :: \"'m packet multiset => bool => nat\" where\n \"hdr_sum M b == countm M (%pkt. hdr(pkt) = b)\"\n\n(* Lemma 5.1 *)\ndefinition\n \"inv1(s) ==\n (!b. count (rsent(rec s)) b = count (srcvd(sen s)) b + count (rsch s) b)\n & (!b. count (ssent(sen s)) b\n = hdr_sum (rrcvd(rec s)) b + hdr_sum (srch s) b)\"\n\n(* Lemma 5.2 *)\ndefinition\n \"inv2(s) ==\n (rbit(rec(s)) = sbit(sen(s)) &\n ssending(sen(s)) &\n count (rsent(rec s)) (~sbit(sen s)) <= count (ssent(sen s)) (~sbit(sen s)) &\n count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)))\n |\n (rbit(rec(s)) = (~sbit(sen(s))) &\n rsending(rec(s)) &\n count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)) &\n count (rsent(rec s)) (sbit(sen s)) <= count (ssent(sen s)) (sbit(sen s)))\"\n\n(* Lemma 5.3 *)\ndefinition\n \"inv3(s) ==\n rbit(rec(s)) = sbit(sen(s))\n --> (!m. sq(sen(s))=[] | m ~= hd(sq(sen(s)))\n --> count (rrcvd(rec s)) (sbit(sen(s)),m)\n + count (srch s) (sbit(sen(s)),m)\n <= count (rsent(rec s)) (~sbit(sen s)))\"\n\n(* Lemma 5.4 *)\ndefinition \"inv4(s) == rbit(rec(s)) = (~sbit(sen(s))) --> sq(sen(s)) ~= []\"\n\n\nsubsection \\Invariants\\\n\ndeclare le_SucI [simp]\n\nlemmas impl_ioas =\n impl_def sender_ioa_def receiver_ioa_def srch_ioa_thm [THEN eq_reflection]\n rsch_ioa_thm [THEN eq_reflection]\n\nlemmas \"transitions\" =\n sender_trans_def receiver_trans_def srch_trans_def rsch_trans_def\n\n\nlemmas [simp] =\n ioa_triple_proj starts_of_par trans_of_par4 in_sender_asig\n in_receiver_asig in_srch_asig in_rsch_asig\n\ndeclare let_weak_cong [cong]\n\n\n\nlemma [simp]:\n \"a:actions(sender_asig)\n | a:actions(receiver_asig)\n | a:actions(srch_asig)\n | a:actions(rsch_asig)\"\n by (induct a) simp_all\n\ndeclare split_paired_All [simp del]\n\n\n(* Three Simp_sets in different sizes\n----------------------------------------------\n\n1) simpset() does not unfold the transition relations\n2) ss unfolds transition relations\n3) renname_ss unfolds transitions and the abstract channel *)\n\nML \\\nval ss = simpset_of (@{context} addsimps @{thms \"transitions\"});\nval rename_ss = simpset_of (put_simpset ss @{context} addsimps @{thms unfold_renaming});\n\nfun tac ctxt =\n asm_simp_tac (put_simpset ss ctxt\n |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm if_split})\nfun tac_ren ctxt =\n asm_simp_tac (put_simpset rename_ss ctxt\n |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm if_split})\n\\\n\n\nsubsubsection \\Invariant 1\\\n\nlemma raw_inv1: \"invariant impl_ioa inv1\"\n\napply (unfold impl_ioas)\napply (rule invariantI)\napply (simp add: inv1_def hdr_sum_def srcvd_def ssent_def rsent_def rrcvd_def)\n\napply (simp (no_asm) del: trans_of_par4 add: imp_conjR inv1_def)\n\ntxt \\Split proof in two\\\napply (rule conjI)\n\n(* First half *)\napply (simp add: Impl.inv1_def split del: if_split)\napply (induct_tac a)\n\napply (tactic \"EVERY1[tac @{context}, tac @{context}, tac @{context}, tac @{context}]\")\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\n\ntxt \\5 + 1\\\n\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\n\ntxt \\4 + 1\\\napply (tactic \\EVERY1[tac @{context}, tac @{context}, tac @{context}, tac @{context}]\\)\n\n\ntxt \\Now the other half\\\napply (simp add: Impl.inv1_def split del: if_split)\napply (induct_tac a)\napply (tactic \"EVERY1 [tac @{context}, tac @{context}]\")\n\ntxt \\detour 1\\\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp (no_asm_simp) add: hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n split: if_split)\ntxt \\detour 2\\\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp add: Impl.hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n Multiset.delm_nonempty_def split: if_split)\napply (rule allI)\napply (rule conjI)\napply (rule impI)\napply hypsubst\napply (rule pred_suc [THEN iffD1])\napply (drule less_le_trans)\napply (cut_tac eq_packet_imp_eq_hdr [unfolded Packet.hdr_def, THEN countm_props])\napply assumption\napply assumption\n\napply (rule countm_done_delm [THEN mp, symmetric])\napply (rule refl)\napply (simp (no_asm_simp) add: Multiset.count_def)\n\napply (rule impI)\napply (simp add: neg_flip)\napply hypsubst\napply (rule countm_spurious_delm)\napply (simp (no_asm))\n\napply (tactic \"EVERY1 [tac @{context}, tac @{context}, tac @{context},\n tac @{context}, tac @{context}, tac @{context}]\")\n\ndone\n\n\n\nsubsubsection \\INVARIANT 2\\\n\nlemma raw_inv2: \"invariant impl_ioa inv2\"\n\n apply (rule invariantI1)\n txt \\Base case\\\n apply (simp add: inv2_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n txt \\10 cases. First 4 are simple, since state doesn't change\\\n\n ML_prf \\val tac2 = asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv2_def}])\\\n\n txt \\10 - 7\\\n apply (tactic \"EVERY1 [tac2,tac2,tac2,tac2]\")\n txt \\6\\\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n\n txt \\6 - 5\\\n apply (tactic \"EVERY1 [tac2,tac2]\")\n\n txt \\4\\\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n apply (tactic \"tac2 1\")\n\n txt \\3\\\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE})] 1\\)\n\n apply (tactic \"tac2 1\")\n apply (tactic \\fold_goals_tac @{context} [rewrite_rule @{context} [@{thm Packet.hdr_def}]\n (@{thm Impl.hdr_sum_def})]\\)\n apply arith\n\n txt \\2\\\n apply (tactic \"tac2 1\")\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1\\)\n apply (intro strip)\n apply (erule conjE)+\n apply simp\n\n txt \\1\\\n apply (tactic \"tac2 1\")\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1\\)\n apply (intro strip)\n apply (erule conjE)+\n apply (tactic \\fold_goals_tac @{context}\n [rewrite_rule @{context} [@{thm Packet.hdr_def}] (@{thm Impl.hdr_sum_def})]\\)\n apply simp\n\n done\n\n\nsubsubsection \\INVARIANT 3\\\n\nlemma raw_inv3: \"invariant impl_ioa inv3\"\n\n apply (rule invariantI)\n txt \\Base case\\\n apply (simp add: Impl.inv3_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n ML_prf \\val tac3 = asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv3_def}])\\\n\n txt \\10 - 8\\\n\n apply (tactic \"EVERY1[tac3,tac3,tac3]\")\n\n apply (tactic \"tac_ren @{context} 1\")\n apply (intro strip, (erule conjE)+)\n apply hypsubst\n apply (erule exE)\n apply simp\n\n txt \\7\\\n apply (tactic \"tac3 1\")\n apply (tactic \"tac_ren @{context} 1\")\n apply force\n\n txt \\6 - 3\\\n\n apply (tactic \"EVERY1[tac3,tac3,tac3,tac3]\")\n\n txt \\2\\\n apply (tactic \"asm_full_simp_tac (put_simpset ss @{context}) 1\")\n apply (simp (no_asm) add: inv3_def)\n apply (intro strip, (erule conjE)+)\n apply (rule imp_disjL [THEN iffD1])\n apply (rule impI)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n apply (erule conjE)+\n apply (rule_tac j = \"count (ssent (sen s)) (~sbit (sen s))\" and\n k = \"count (rsent (rec s)) (sbit (sen s))\" in le_trans)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm inv1_def}]\n (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1\\)\n apply (simp add: hdr_sum_def Multiset.count_def)\n apply (rule add_le_mono)\n apply (rule countm_props)\n apply (simp (no_asm))\n apply (rule countm_props)\n apply (simp (no_asm))\n apply assumption\n\n txt \\1\\\n apply (tactic \"tac3 1\")\n apply (intro strip, (erule conjE)+)\n apply (rule imp_disjL [THEN iffD1])\n apply (rule impI)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n done\n\n\nsubsubsection \\INVARIANT 4\\\n\nlemma raw_inv4: \"invariant impl_ioa inv4\"\n\n apply (rule invariantI)\n txt \\Base case\\\n apply (simp add: Impl.inv4_def receiver_projections sender_projections impl_ioas)\n\n apply (simp (no_asm_simp) add: impl_ioas split del: if_split)\n apply (induct_tac \"a\")\n\n ML_prf \\val tac4 = asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv4_def}])\\\n\n txt \\10 - 2\\\n\n apply (tactic \"EVERY1[tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4]\")\n\n txt \\2 b\\\n\n apply (intro strip, (erule conjE)+)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply simp\n\n txt \\1\\\n apply (tactic \"tac4 1\")\n apply (intro strip, (erule conjE)+)\n apply (rule ccontr)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n (@{thm raw_inv2} RS @{thm invariantE})] 1\\)\n apply (tactic \\forward_tac @{context} [rewrite_rule @{context} [@{thm Impl.inv3_def}]\n (@{thm raw_inv3} RS @{thm invariantE})] 1\\)\n apply simp\n apply (rename_tac m, erule_tac x = \"m\" in allE)\n apply simp\n done\n\n\ntext \\rebind them\\\n\nlemmas inv1 = raw_inv1 [THEN invariantE, unfolded inv1_def]\n and inv2 = raw_inv2 [THEN invariantE, unfolded inv2_def]\n and inv3 = raw_inv3 [THEN invariantE, unfolded inv3_def]\n and inv4 = raw_inv4 [THEN invariantE, unfolded inv4_def]\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/HOLCF/IOA/NTP/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.26826421615672197}} {"text": "(* Title: While_SPMF.thy\n Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory While_SPMF imports\n MFMC_Countable.Rel_PMF_Characterisation\n \"HOL-Types_To_Sets.Types_To_Sets\"\n \"HOL-Library.Complete_Partial_Order2\"\nbegin\n\ntext \\\n This theory defines a probabilistic while combinator for discrete (sub-)probabilities and\n formalises rules for probabilistic termination similar to those by Hurd \\cite{Hurd2002TPHOLs}\n and McIver and Morgan \\cite{McIverMorgan2005}.\n\\\n\nsection \\Miscellaneous library additions\\\n\nfun map_option_set :: \"('a \\ 'b option set) \\ 'a option \\ 'b option set\"\nwhere\n \"map_option_set f None = {None}\"\n| \"map_option_set f (Some x) = f x\"\n\nlemma None_in_map_option_set:\n \"None \\ map_option_set f x \\ None \\ Set.bind (set_option x) f \\ x = None\"\nby(cases x) simp_all\n\nlemma None_in_map_option_set_None [intro!]: \"None \\ map_option_set f None\"\nby simp\n\nlemma None_in_map_option_set_Some [intro!]: \"None \\ f x \\ None \\ map_option_set f (Some x)\"\nby simp\n\nlemma Some_in_map_option_set [intro!]: \"Some y \\ f x \\ Some y \\ map_option_set f (Some x)\"\nby simp\n\nlemma map_option_set_singleton [simp]: \"map_option_set (\\x. {f x}) y = {Option.bind y f}\"\nby(cases y) simp_all\n\nlemma Some_eq_bind_conv: \"Some y = Option.bind x f \\ (\\z. x = Some z \\ f z = Some y)\"\nby(cases x) auto\n\nlemma map_option_set_bind: \"map_option_set f (Option.bind x g) = map_option_set (map_option_set f \\ g) x\"\nby(cases x) simp_all\n\nlemma Some_in_map_option_set_conv: \"Some y \\ map_option_set f x \\ (\\z. x = Some z \\ Some y \\ f z)\"\nby(cases x) auto\n\n\ninterpretation rel_spmf_characterisation by unfold_locales(rule rel_pmf_measureI)\nhide_fact (open) rel_pmf_measureI\n\nlemma Sup_conv_fun_lub: \"Sup = fun_lub Sup\"\n by(auto simp add: Sup_fun_def fun_eq_iff fun_lub_def intro: arg_cong[where f=Sup])\n\nlemma le_conv_fun_ord: \"(\\) = fun_ord (\\)\"\n by(auto simp add: fun_eq_iff fun_ord_def le_fun_def)\n\nlemmas parallel_fixp_induct_2_1 = parallel_fixp_induct_uc[\n of _ _ _ _ \"case_prod\" _ \"curry\" \"\\x. x\" _ \"\\x. x\",\n where P=\"\\f g. P (curry f) g\",\n unfolded case_prod_curry curry_case_prod curry_K,\n OF _ _ _ _ _ _ refl refl]\n for P\n\nlemma monotone_Pair:\n \"\\ monotone ord orda f; monotone ord ordb g \\\n \\ monotone ord (rel_prod orda ordb) (\\x. (f x, g x))\"\nby(simp add: monotone_def)\n\nlemma cont_Pair:\n \"\\ cont lub ord luba orda f; cont lub ord lubb ordb g \\\n \\ cont lub ord (prod_lub luba lubb) (rel_prod orda ordb) (\\x. (f x, g x))\"\nby(rule contI)(auto simp add: prod_lub_def image_image dest!: contD)\n\nlemma mcont_Pair:\n \"\\ mcont lub ord luba orda f; mcont lub ord lubb ordb g \\\n \\ mcont lub ord (prod_lub luba lubb) (rel_prod orda ordb) (\\x. (f x, g x))\"\nby(rule mcontI)(simp_all add: monotone_Pair mcont_mono cont_Pair)\n\nlemma mono2mono_emeasure_spmf [THEN lfp.mono2mono]:\n shows monotone_emeasure_spmf:\n \"monotone (ord_spmf (=)) (\\) (\\p. emeasure (measure_spmf p))\"\n by(rule monotoneI le_funI ord_spmf_eqD_emeasure)+\n\nlemma cont_emeasure_spmf: \"cont lub_spmf (ord_spmf (=)) Sup (\\) (\\p. emeasure (measure_spmf p))\"\n by (rule contI) (simp add: emeasure_lub_spmf fun_eq_iff image_comp)\n\nlemma mcont2mcont_emeasure_spmf [THEN lfp.mcont2mcont, cont_intro]:\n shows mcont_emeasure_spmf: \"mcont lub_spmf (ord_spmf (=)) Sup (\\) (\\p. emeasure (measure_spmf p))\"\n by(simp add: mcont_def monotone_emeasure_spmf cont_emeasure_spmf)\n\nlemma mcont2mcont_emeasure_spmf' [THEN lfp.mcont2mcont, cont_intro]:\n shows mcont_emeasure_spmf': \"mcont lub_spmf (ord_spmf (=)) Sup (\\) (\\p. emeasure (measure_spmf p) A)\"\n using mcont_emeasure_spmf[unfolded Sup_conv_fun_lub le_conv_fun_ord]\n by(subst (asm) mcont_fun_lub_apply) blast\n\nlemma mcont_bind_pmf [cont_intro]:\n assumes g: \"\\y. mcont luba orda lub_spmf (ord_spmf (=)) (g y)\"\n shows \"mcont luba orda lub_spmf (ord_spmf (=)) (\\x. bind_pmf p (\\y. g y x))\"\nusing mcont_bind_spmf[where f=\"\\_. spmf_of_pmf p\" and g=g, OF _ assms] by(simp)\n\nlemma ennreal_less_top_iff: \"x < \\ \\ x \\ (\\ :: ennreal)\"\n by(cases x) simp_all\n\nlemma type_definition_Domainp: \n fixes Rep Abs A T\n assumes type: \"type_definition Rep Abs A\"\n assumes T_def: \"T \\ (\\(x::'a) (y::'b). x = Rep y)\"\n shows \"Domainp T = (\\x. x \\ A)\"\nproof -\n interpret type_definition Rep Abs A by(rule type)\n show ?thesis unfolding Domainp_iff[abs_def] T_def fun_eq_iff by(metis Abs_inverse Rep)\nqed\n\ncontext includes lifting_syntax begin\n\nlemma weight_spmf_parametric [transfer_rule]:\n \"(rel_spmf A ===> (=)) weight_spmf weight_spmf\"\nby(simp add: rel_fun_def rel_spmf_weightD)\n\nlemma lossless_spmf_parametric [transfer_rule]:\n \"(rel_spmf A ===> (=)) lossless_spmf lossless_spmf\"\nby(simp add: rel_fun_def lossless_spmf_def rel_spmf_weightD)\n\nlemma UNIV_parametric_pred: \"rel_pred R UNIV UNIV\"\n by(auto intro!: rel_predI)\nend\n\nlemma bind_spmf_spmf_of_set:\n \"\\A. \\ finite A; A \\ {} \\ \\ bind_spmf (spmf_of_set A) = bind_pmf (pmf_of_set A)\"\nby(simp add: spmf_of_set_def fun_eq_iff del: spmf_of_pmf_pmf_of_set)\n\nlemma set_pmf_bind_spmf: \"set_pmf (bind_spmf M f) = set_pmf M \\ map_option_set (set_pmf \\ f)\"\nby(auto 4 3 simp add: bind_spmf_def split: option.splits intro: rev_bexI)\n\nlemma set_pmf_spmf_of_set:\n \"set_pmf (spmf_of_set A) = (if finite A \\ A \\ {} then Some ` A else {None})\"\nby(simp add: spmf_of_set_def spmf_of_pmf_def del: spmf_of_pmf_pmf_of_set)\n\ndefinition measure_measure_spmf :: \"'a spmf \\ 'a set \\ real\"\nwhere [simp]: \"measure_measure_spmf p = measure (measure_spmf p)\"\n\nlemma measure_measure_spmf_parametric [transfer_rule]:\n includes lifting_syntax shows\n \"(rel_spmf A ===> rel_pred A ===> (=)) measure_measure_spmf measure_measure_spmf\"\nunfolding measure_measure_spmf_def[abs_def] by(rule measure_spmf_parametric)\n\nlemma of_nat_le_one_cancel_iff [simp]:\n fixes n :: nat shows \"real n \\ 1 \\ n \\ 1\"\nby linarith\n\nlemma of_int_ceiling_less_add_one [simp]: \"of_int \\r\\ < r + 1\"\n by linarith\n\nlemma lessThan_subset_Collect: \"{.. Collect P \\ (\\yx. spmf p x \\ f x\"\n and sum: \"(\\\\<^sup>+ x. f x \\count_space UNIV) = weight_spmf p\"\n shows \"spmf p x = f x\"\nproof -\n have [rule_format]: \"\\x. f x \\ spmf p x\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n then obtain x where x: \"spmf p x < f x\" by(auto simp add: not_le)\n have *: \"(\\\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\count_space UNIV) \\ \\\"\n by(rule neq_top_trans[where y=\"weight_spmf p\"], simp)(auto simp add: sum[symmetric] intro!: nn_integral_mono split: split_indicator)\n \n have \"weight_spmf p = \\\\<^sup>+ y. spmf p y \\count_space UNIV\"\n by(simp add: nn_integral_spmf space_measure_spmf measure_spmf.emeasure_eq_measure)\n also have \"\\ = (\\\\<^sup>+ y. ennreal (spmf p y) * indicator (- {x}) y \\count_space UNIV) +\n (\\\\<^sup>+ y. spmf p y * indicator {x} y \\count_space UNIV)\"\n by(subst nn_integral_add[symmetric])(auto intro!: nn_integral_cong split: split_indicator)\n also have \"\\ \\ (\\\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\count_space UNIV) + spmf p x\"\n using ub by(intro add_mono nn_integral_mono)(auto split: split_indicator intro: ennreal_leI)\n also have \"\\ < (\\\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\count_space UNIV) + (\\\\<^sup>+ y. f y * indicator {x} y \\count_space UNIV)\"\n using * x by(simp add: ennreal_less_iff)\n also have \"\\ = (\\\\<^sup>+ y. ennreal (f y) \\count_space UNIV)\"\n by(subst nn_integral_add[symmetric])(auto intro: nn_integral_cong split: split_indicator)\n also have \"\\ = weight_spmf p\" using sum by simp\n finally show False by simp\n qed\n from this[of x] ub[of x] show ?thesis by simp\nqed\n\nsection \\Probabilistic while loop\\\n\nlocale loop_spmf = \n fixes guard :: \"'a \\ bool\"\n and body :: \"'a \\ 'a spmf\"\nbegin\n\ncontext notes [[function_internals]] begin\n\npartial_function (spmf) while :: \"'a \\ 'a spmf\"\nwhere \"while s = (if guard s then bind_spmf (body s) while else return_spmf s)\"\n\nend\n\nlemma while_fixp_induct [case_names adm bottom step]:\n assumes \"spmf.admissible P\"\n and \"P (\\while. return_pmf None)\"\n and \"\\while'. P while' \\ P (\\s. if guard s then body s \\ while' else return_spmf s)\"\n shows \"P while\"\n using assms by(rule while.fixp_induct)\n\nlemma while_simps:\n \"guard s \\ while s = bind_spmf (body s) while\"\n \"\\ guard s \\ while s = return_spmf s\"\nby(rewrite while.simps; simp; fail)+\n\nend\n\nlemma while_spmf_parametric [transfer_rule]:\n includes lifting_syntax shows\n \"((S ===> (=)) ===> (S ===> rel_spmf S) ===> S ===> rel_spmf S) loop_spmf.while loop_spmf.while\"\nunfolding loop_spmf.while_def[abs_def]\napply(rule rel_funI)\napply(rule rel_funI)\napply(rule fixp_spmf_parametric[OF loop_spmf.while.mono loop_spmf.while.mono])\nsubgoal premises [transfer_rule] by transfer_prover\ndone\n\nlemma loop_spmf_while_cong:\n \"\\ guard = guard'; \\s. guard' s \\ body s = body' s \\\n \\ loop_spmf.while guard body = loop_spmf.while guard' body'\"\nunfolding loop_spmf.while_def[abs_def] by(simp cong: if_cong)\n\nsection \\Rules for probabilistic termination\\\n\ncontext loop_spmf begin\n\nsubsection \\0/1 termination laws\\\n\nlemma termination_0_1_immediate:\n assumes p: \"\\s. guard s \\ spmf (map_spmf guard (body s)) False \\ p\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. guard s \\ lossless_spmf (body s)\"\n shows \"lossless_spmf (while s)\"\nproof -\n have \"\\s. lossless_spmf (while s)\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n then obtain s where s: \"\\ lossless_spmf (while s)\" by blast\n hence True: \"guard s\" by(simp add: while.simps split: if_split_asm)\n\n from p[OF this] have p_le_1: \"p \\ 1\" using pmf_le_1 by(rule order_trans)\n have new_bound: \"p * (1 - k) + k \\ weight_spmf (while s)\" \n if k: \"0 \\ k\" \"k \\ 1\" and k_le: \"\\s. k \\ weight_spmf (while s)\" for k s\n proof(cases \"guard s\")\n case False\n have \"p * (1 - k) + k \\ 1 * (1 - k) + k\" using p_le_1 k by(intro mult_right_mono add_mono; simp)\n also have \"\\ \\ 1\" by simp\n finally show ?thesis using False by(simp add: while.simps)\n next\n case True\n let ?M = \"\\s. measure_spmf (body s)\"\n have bounded: \"\\\\ s''. weight_spmf (while s'') \\?M s'\\ \\ 1\" for s'\n using integral_nonneg_AE[of \"\\s''. weight_spmf (while s'')\" \"?M s'\"]\n by(auto simp add: weight_spmf_nonneg weight_spmf_le_1 intro!: measure_spmf.nn_integral_le_const integral_real_bounded)\n have \"p \\ measure (?M s) {s'. \\ guard s'}\" using p[OF True]\n by(simp add: spmf_conv_measure_spmf measure_map_spmf vimage_def)\n hence \"p * (1 - k) + k \\ measure (?M s) {s'. \\ guard s'} * (1 - k) + k\"\n using k by(intro add_mono mult_right_mono)(simp_all)\n also have \"\\ = \\ s'. indicator {s'. \\ guard s'} s' * (1 - k) + k \\?M s\"\n using True by(simp add: ennreal_less_top_iff lossless lossless_weight_spmfD)\n also have \"\\ = \\ s'. indicator {s'. \\ guard s'} s' + indicator {s'. guard s'} s' * k \\?M s\"\n by(rule Bochner_Integration.integral_cong)(simp_all split: split_indicator)\n also have \"\\ = \\ s'. indicator {s'. \\ guard s'} s' + indicator {s'. guard s'} s' * \\ s''. k \\?M s' \\?M s\"\n by(rule Bochner_Integration.integral_cong)(auto simp add: lossless lossless_weight_spmfD split: split_indicator)\n also have \"\\ \\ \\ s'. indicator {s'. \\ guard s'} s' + indicator {s'. guard s'} s' * \\ s''. weight_spmf (while s'') \\?M s' \\?M s\"\n using k bounded\n by(intro integral_mono integrable_add measure_spmf.integrable_const_bound[where B=1] add_mono mult_left_mono)\n (simp_all add: weight_spmf_nonneg weight_spmf_le_1 mult_le_one k_le split: split_indicator)\n also have \"\\ = \\s'. (if \\ guard s' then 1 else \\ s''. weight_spmf (while s'') \\?M s') \\?M s\"\n by(rule Bochner_Integration.integral_cong)(simp_all split: split_indicator)\n also have \"\\ = \\ s'. weight_spmf (while s') \\measure_spmf (body s)\"\n by(rule Bochner_Integration.integral_cong; simp add: while.simps weight_bind_spmf o_def)\n also have \"\\ = weight_spmf (while s)\" using True\n by(simp add: while.simps weight_bind_spmf o_def)\n finally show ?thesis .\n qed\n\n define k where \"k \\ INF s. weight_spmf (while s)\"\n define k' where \"k' \\ p * (1 - k) + k\"\n from s have \"weight_spmf (while s) < 1\"\n using weight_spmf_le_1[of \"while s\"] by(simp add: lossless_spmf_def)\n then have \"k < 1\"\n unfolding k_def by(rewrite cINF_less_iff)(auto intro!: bdd_belowI2 weight_spmf_nonneg)\n\n have \"0 \\ k\" unfolding k_def by(auto intro: cINF_greatest simp add: weight_spmf_nonneg)\n moreover from \\k < 1\\ have \"k \\ 1\" by simp\n moreover have \"k \\ weight_spmf (while s)\" for s unfolding k_def\n by(rule cINF_lower)(auto intro!: bdd_belowI2 weight_spmf_nonneg)\n ultimately have \"\\s. k' \\ weight_spmf (while s)\"\n unfolding k'_def by(rule new_bound)\n hence \"k' \\ k\" unfolding k_def by(auto intro: cINF_greatest)\n also have \"k < k'\" using p_pos \\k < 1\\ by(auto simp add: k'_def)\n finally show False by simp\n qed\n thus ?thesis by blast\nqed\n\nprimrec iter :: \"nat \\ 'a \\ 'a spmf\"\nwhere\n \"iter 0 s = return_spmf s\"\n| \"iter (Suc n) s = (if guard s then bind_spmf (body s) (iter n) else return_spmf s)\"\n\nlemma iter_unguarded [simp]: \"\\ guard s \\ iter n s = return_spmf s\"\n by(induction n) simp_all\n \nlemma iter_bind_iter: \"bind_spmf (iter m s) (iter n) = iter (m + n) s\"\n by(induction m arbitrary: s) simp_all\n\nlemma iter_Suc2: \"iter (Suc n) s = bind_spmf (iter n s) (\\s. if guard s then body s else return_spmf s)\"\n using iter_bind_iter[of n s 1, symmetric]\n by(simp del: iter.simps)(rule bind_spmf_cong; simp cong: bind_spmf_cong)\n\nlemma lossless_iter: \"(\\s. guard s \\ lossless_spmf (body s)) \\ lossless_spmf (iter n s)\"\n by(induction n arbitrary: s) simp_all\n\nlemma iter_mono_emeasure1:\n \"emeasure (measure_spmf (iter n s)) {s. \\ guard s} \\ emeasure (measure_spmf (iter (Suc n) s)) {s. \\ guard s}\"\n (is \"?lhs \\ ?rhs\")\nproof(cases \"guard s\")\n case True\n have \"?lhs = emeasure (measure_spmf (bind_spmf (iter n s) return_spmf)) {s. \\ guard s}\" by simp\n also have \"\\ = \\\\<^sup>+ s'. emeasure (measure_spmf (return_spmf s')) {s. \\ guard s} \\measure_spmf (iter n s)\"\n by(simp del: bind_return_spmf add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ \\ \\\\<^sup>+ s'. emeasure (measure_spmf (if guard s' then body s' else return_spmf s')) {s. \\ guard s} \\measure_spmf (iter n s)\"\n by(rule nn_integral_mono)(simp add: measure_spmf_return_spmf)\n also have \"\\ = ?rhs\"\n by(simp add: iter_Suc2 measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra del: iter.simps)\n finally show ?thesis .\nqed simp\n\nlemma weight_while_conv_iter:\n \"weight_spmf (while s) = (SUP n. measure (measure_spmf (iter n s)) {s. \\ guard s})\"\n (is \"?lhs = ?rhs\")\nproof(rule antisym)\n have \"emeasure (measure_spmf (while s)) UNIV \\ (SUP n. emeasure (measure_spmf (iter n s)) {s. \\ guard s})\"\n (is \"_ \\ (SUP n. ?f n s)\")\n proof(induction arbitrary: s rule: while_fixp_induct)\n case adm show ?case by simp\n case bottom show ?case by simp\n case (step while')\n show ?case (is \"?lhs' \\ ?rhs'\")\n proof(cases \"guard s\")\n case True\n have inc: \"incseq ?f\" by(rule incseq_SucI le_funI iter_mono_emeasure1)+\n\n from True have \"?lhs' = \\\\<^sup>+ s'. emeasure (measure_spmf (while' s')) UNIV \\measure_spmf (body s)\"\n by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ \\ \\\\<^sup>+ s'. (SUP n. ?f n s') \\measure_spmf (body s)\"\n by(rule nn_integral_mono)(rule step.IH)\n also have \"\\ = (SUP n. \\\\<^sup>+ s'. ?f n s' \\measure_spmf (body s))\" using inc\n by(subst nn_integral_monotone_convergence_SUP) simp_all\n also have \"\\ = (SUP n. ?f (Suc n) s)\" using True\n by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ \\ (SUP n. ?f n s)\"\n by(rule SUP_mono)(auto intro: exI[where x=\"Suc _\"])\n finally show ?thesis .\n next\n case False\n then have \"?lhs' = emeasure (measure_spmf (iter 0 s)) {s. \\ guard s}\" \n by(simp add: measure_spmf_return_spmf)\n also have \\\\ \\ ?rhs'\\ by(rule SUP_upper) simp\n finally show ?thesis .\n qed\n qed\n also have \"\\ = ennreal (SUP n. measure (measure_spmf (iter n s)) {s. \\ guard s})\"\n by(subst ennreal_SUP)(fold measure_spmf.emeasure_eq_measure, auto simp add: not_less measure_spmf.subprob_emeasure_le_1 intro!: exI[where x=\"1\"])\n also have \"0 \\ (SUP n. measure (measure_spmf (iter n s)) {s. \\ guard s})\"\n by(rule cSUP_upper2)(auto intro!: bdd_aboveI[where M=1] simp add: measure_spmf.subprob_measure_le_1)\n ultimately show \"?lhs \\ ?rhs\" by(simp add: measure_spmf.emeasure_eq_measure space_measure_spmf)\n \n show \"?rhs \\ ?lhs\"\n proof(rule cSUP_least)\n show \"measure (measure_spmf (iter n s)) {s. \\ guard s} \\ weight_spmf (while s)\" (is \"?f n s \\ _\") for n\n proof(induction n arbitrary: s)\n case 0 show ?case\n by(simp add: measure_spmf_return_spmf measure_return while_simps split: split_indicator)\n next\n case (Suc n)\n show ?case\n proof(cases \"guard s\")\n case True\n have \"?f (Suc n) s = \\\\<^sup>+ s'. ?f n s' \\measure_spmf (body s)\"\n using True unfolding measure_spmf.emeasure_eq_measure[symmetric]\n by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ \\ \\\\<^sup>+ s'. weight_spmf (while s') \\measure_spmf (body s)\"\n by(rule nn_integral_mono ennreal_leI Suc.IH)+\n also have \"\\ = weight_spmf (while s)\"\n using True unfolding measure_spmf.emeasure_eq_measure[symmetric] space_measure_spmf\n by(simp add: while_simps measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n finally show ?thesis by(simp)\n next\n case False then show ?thesis\n by(simp add: measure_spmf_return_spmf measure_return while_simps split: split_indicator)\n qed\n qed\n qed simp\nqed\n\nlemma termination_0_1:\n assumes p: \"\\s. guard s \\ p \\ weight_spmf (while s)\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. guard s \\ lossless_spmf (body s)\"\n shows \"lossless_spmf (while s)\"\n unfolding lossless_spmf_def\nproof(rule antisym)\n let ?X = \"{s. \\ guard s}\"\n show \"weight_spmf (while s) \\ 1\" by(rule weight_spmf_le_1)\n \n define p' where \"p' \\ p / 2\"\n have p'_pos: \"p' > 0\" and \"p' < p\" using p_pos by(simp_all add: p'_def)\n \n have \"\\n. p' < measure (measure_spmf (iter n s)) ?X\" if \"guard s\" for s using p[OF that] \\p' < p\\\n unfolding weight_while_conv_iter\n by(subst (asm) le_cSUP_iff)(auto intro!: measure_spmf.subprob_measure_le_1)\n then obtain N where p': \"p' \\ measure (measure_spmf (iter (N s) s)) ?X\" if \"guard s\" for s\n using p by atomize_elim(rule choice, force dest: order.strict_implies_order)\n\n interpret fuse: loop_spmf guard \"\\s. iter (N s) s\" .\n \n have \"1 = weight_spmf (fuse.while s)\"\n by(rule lossless_weight_spmfD[symmetric])\n (rule fuse.termination_0_1_immediate; auto simp add: spmf_map vimage_def intro: p' p'_pos lossless_iter lossless)\n also have \"\\ \\ (\\n. measure (measure_spmf (iter n s)) ?X)\"\n unfolding fuse.weight_while_conv_iter\n proof(rule cSUP_least)\n fix n\n have \"emeasure (measure_spmf (fuse.iter n s)) ?X \\ (SUP n. emeasure (measure_spmf (iter n s)) ?X)\"\n proof(induction n arbitrary: s)\n case 0 show ?case by(auto intro!: SUP_upper2[where i=0])\n next\n case (Suc n)\n have inc: \"incseq (\\n s'. emeasure (measure_spmf (iter n s')) ?X)\"\n by(rule incseq_SucI le_funI iter_mono_emeasure1)+\n\n have \"emeasure (measure_spmf (fuse.iter (Suc n) s)) ?X = emeasure (measure_spmf (iter (N s) s \\ fuse.iter n)) ?X\"\n by simp\n also have \"\\ = \\\\<^sup>+ s'. emeasure (measure_spmf (fuse.iter n s')) ?X \\measure_spmf (iter (N s) s)\"\n by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ \\ \\\\<^sup>+ s'. (SUP n. emeasure (measure_spmf (iter n s')) ?X) \\measure_spmf (iter (N s) s)\"\n by(rule nn_integral_mono Suc.IH)+\n also have \"\\ = (SUP n. \\\\<^sup>+ s'. emeasure (measure_spmf (iter n s')) ?X \\measure_spmf (iter (N s) s))\"\n by(rule nn_integral_monotone_convergence_SUP[OF inc]) simp\n also have \"\\ = (SUP n. emeasure (measure_spmf (bind_spmf (iter (N s) s) (iter n))) ?X)\"\n by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n also have \"\\ = (SUP n. emeasure (measure_spmf (iter (N s + n) s)) ?X)\" by(simp add: iter_bind_iter)\n also have \"\\ \\ (SUP n. emeasure (measure_spmf (iter n s)) ?X)\" by(rule SUP_mono) auto\n finally show ?case .\n qed\n also have \"\\ = ennreal (SUP n. measure (measure_spmf (iter n s)) ?X)\"\n by(subst ennreal_SUP)(fold measure_spmf.emeasure_eq_measure, auto simp add: not_less measure_spmf.subprob_emeasure_le_1 intro!: exI[where x=\"1\"])\n also have \"0 \\ (SUP n. measure (measure_spmf (iter n s)) ?X)\"\n by(rule cSUP_upper2)(auto intro!: bdd_aboveI[where M=1] simp add: measure_spmf.subprob_measure_le_1)\n ultimately show \"measure (measure_spmf (fuse.iter n s)) ?X \\ \\\"\n by(simp add: measure_spmf.emeasure_eq_measure)\n qed simp\n finally show \"1 \\ weight_spmf (while s)\" unfolding weight_while_conv_iter .\nqed\n\nend\n\nlemma termination_0_1_immediate_invar:\n fixes I :: \"'s \\ bool\"\n assumes p: \"\\s. \\ guard s; I s \\ \\ spmf (map_spmf guard (body s)) False \\ p\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. \\ guard s; I s \\ \\ lossless_spmf (body s)\"\n and invar: \"\\s s'. \\ s' \\ set_spmf (body s); I s; guard s \\ \\ I s'\"\n and I: \"I s\"\n shows \"lossless_spmf (loop_spmf.while guard body s)\"\n including lifting_syntax\nproof -\n { assume \"\\(Rep :: 's' \\ 's) Abs. type_definition Rep Abs {s. I s}\"\n then obtain Rep :: \"'s' \\ 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n then interpret td: type_definition Rep Abs \"{s. I s}\" .\n define cr where \"cr \\ \\x y. x = Rep y\"\n have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n define guard' where \"guard' \\ (Rep ---> id) guard\"\n have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n define body1 where \"body1 \\ \\s. if guard s then body s else return_pmf None\"\n define body1' where \"body1' \\ (Rep ---> map_spmf Abs) body1\"\n have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n define s' where \"s' \\ Abs s\"\n have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n\n have \"\\s. guard' s \\ p \\ spmf (map_spmf guard' (body1' s)) False\"\n by(transfer fixing: p)(simp add: body1_def p)\n moreover note p_pos\n moreover have \"\\s. guard' s \\ lossless_spmf (body1' s)\" by transfer(simp add: lossless body1_def)\n ultimately have \"lossless_spmf (loop_spmf.while guard' body1' s')\" by(rule loop_spmf.termination_0_1_immediate)\n hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nlemma termination_0_1_invar:\n fixes I :: \"'s \\ bool\"\n assumes p: \"\\s. \\ guard s; I s \\ \\ p \\ weight_spmf (loop_spmf.while guard body s)\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. \\ guard s; I s \\ \\ lossless_spmf (body s)\"\n and invar: \"\\s s'. \\ s' \\ set_spmf (body s); I s; guard s \\ \\ I s'\"\n and I: \"I s\"\n shows \"lossless_spmf (loop_spmf.while guard body s)\"\n including lifting_syntax\nproof-\n { assume \"\\(Rep :: 's' \\ 's) Abs. type_definition Rep Abs {s. I s}\"\n then obtain Rep :: \"'s' \\ 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n then interpret td: type_definition Rep Abs \"{s. I s}\" .\n define cr where \"cr \\ \\x y. x = Rep y\"\n have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n define guard' where \"guard' \\ (Rep ---> id) guard\"\n have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n define body1 where \"body1 \\ \\s. if guard s then body s else return_pmf None\"\n define body1' where \"body1' \\ (Rep ---> map_spmf Abs) body1\"\n have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n define s' where \"s' \\ Abs s\"\n have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n \n interpret loop_spmf guard' body1' .\n\n note UNIV_parametric_pred[transfer_rule]\n have \"\\s. guard' s \\ p \\ weight_spmf (while s)\"\n unfolding measure_measure_spmf_def[symmetric] space_measure_spmf\n by(transfer fixing: p)(simp add: body1_def p[simplified space_measure_spmf] cong: loop_spmf_while_cong)\n moreover note p_pos\n moreover have \"\\s. guard' s \\ lossless_spmf (body1' s)\" by transfer(simp add: lossless body1_def)\n ultimately have \"lossless_spmf (while s')\" by(rule termination_0_1)\n hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nsubsection \\Variant rule\\\n\ncontext loop_spmf begin\n\nlemma termination_variant:\n fixes bound :: nat\n assumes bound: \"\\s. guard s \\ f s \\ bound\"\n and step: \"\\s. guard s \\ p \\ spmf (map_spmf (\\s'. f s' < f s) (body s)) True\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. guard s \\ lossless_spmf (body s)\"\n shows \"lossless_spmf (while s)\"\nproof -\n define p' and n where \"p' \\ min p 1\" and \"n \\ bound + 1\"\n have p'_pos: \"0 < p'\" and p'_le_1: \"p' \\ 1\" \n and step': \"guard s \\ p' \\ measure (measure_spmf (body s)) {s'. f s' < f s}\" for s\n using p_pos step[of s] by(simp_all add: p'_def spmf_map vimage_def)\n have \"p' ^ n \\ weight_spmf (while s)\" if \"f s < n\" for s using that\n proof(induction n arbitrary: s)\n case 0 thus ?case by simp\n next\n case (Suc n)\n show ?case\n proof(cases \"guard s\")\n case False\n hence \"weight_spmf (while s) = 1\" by(simp add: while.simps)\n thus ?thesis using p'_le_1 p_pos \n by simp(meson less_eq_real_def mult_le_one p'_pos power_le_one zero_le_power)\n next\n case True\n let ?M = \"measure_spmf (body s)\"\n have \"p' ^ Suc n \\ (\\ s'. indicator {s'. f s' < f s} s' \\?M) * p' ^ n\"\n using step'[OF True] p'_pos by(simp add: mult_right_mono)\n also have \"\\ = (\\ s'. indicator {s'. f s' < f s} s' * p' ^ n \\?M)\" by simp\n also have \"\\ \\ (\\ s'. indicator {s'. f s' < f s} s' * weight_spmf (while s') \\?M)\"\n using Suc.prems p'_le_1 p'_pos\n by(intro integral_mono)(auto simp add: Suc.IH power_le_one weight_spmf_le_1 split: split_indicator intro!: measure_spmf.integrable_const_bound[where B=1])\n also have \"\\ \\ \\ + (\\ s'. indicator {s'. f s' \\ f s} s' * weight_spmf (while s') \\?M)\"\n by(simp add: integral_nonneg_AE weight_spmf_nonneg)\n also have \"\\ = \\ s'. weight_spmf (while s') \\?M\"\n by(subst Bochner_Integration.integral_add[symmetric])\n (auto intro!: Bochner_Integration.integral_cong measure_spmf.integrable_const_bound[where B=1] weight_spmf_le_1 split: split_indicator)\n also have \"\\ = weight_spmf (while s)\"\n using True by(subst (1 2) while.simps)(simp add: weight_bind_spmf o_def)\n finally show ?thesis .\n qed\n qed\n moreover have \"0 < p' ^ n\" using p'_pos by simp\n ultimately show ?thesis using lossless\n proof(rule termination_0_1_invar)\n show \"f s < n\" if \"guard s\" \"guard s \\ f s < n\" for s using that by simp\n show \"guard s \\ f s < n\" using bound[of s] by(auto simp add: n_def)\n show \"guard s' \\ f s' < n\" for s' using bound[of s'] by(clarsimp simp add: n_def)\n qed\nqed\n\nend\n\nlemma termination_variant_invar:\n fixes bound :: nat and I :: \"'s \\ bool\"\n assumes bound: \"\\s. \\ guard s; I s \\ \\ f s \\ bound\"\n and step: \"\\s. \\ guard s; I s \\ \\ p \\ spmf (map_spmf (\\s'. f s' < f s) (body s)) True\"\n and p_pos: \"0 < p\"\n and lossless: \"\\s. \\ guard s; I s \\ \\ lossless_spmf (body s)\"\n and invar: \"\\s s'. \\ s' \\ set_spmf (body s); I s; guard s \\ \\ I s'\"\n and I: \"I s\"\n shows \"lossless_spmf (loop_spmf.while guard body s)\"\n including lifting_syntax\nproof -\n { assume \"\\(Rep :: 's' \\ 's) Abs. type_definition Rep Abs {s. I s}\"\n then obtain Rep :: \"'s' \\ 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n then interpret td: type_definition Rep Abs \"{s. I s}\" .\n define cr where \"cr \\ \\x y. x = Rep y\"\n have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n define guard' where \"guard' \\ (Rep ---> id) guard\"\n have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n define body1 where \"body1 \\ \\s. if guard s then body s else return_pmf None\"\n define body1' where \"body1' \\ (Rep ---> map_spmf Abs) body1\"\n have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n define s' where \"s' \\ Abs s\"\n have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n define f' where \"f' \\ (Rep ---> id) f\"\n have [transfer_rule]: \"(cr ===> (=)) f f'\" by(simp add: rel_fun_def cr_def f'_def)\n\n have \"\\s. guard' s \\ f' s \\ bound\" by(transfer fixing: bound)(rule bound)\n moreover have \"\\s. guard' s \\ p \\ spmf (map_spmf (\\s'. f' s' < f' s) (body1' s)) True\"\n by(transfer fixing: p)(simp add: step body1_def)\n note this p_pos\n moreover have \"\\s. guard' s \\ lossless_spmf (body1' s)\"\n by transfer(simp add: body1_def lossless)\n ultimately have \"lossless_spmf (loop_spmf.while guard' body1' s')\" by(rule loop_spmf.termination_variant)\n hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Probabilistic_While/While_SPMF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2679904786531366}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2020\n(C) Copyright Sebastian A. Mödersheim, DTU, 2020\n(C) Copyright Achim D. Brucker, University of Exeter, 2020\n(C) Copyright Anders Schlichtkrull, DTU, 2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Term_Variants.thy\n Author: Andreas Viktor Hess, DTU\n Author: Sebastian A. Mödersheim, DTU\n Author: Achim D. Brucker, University of Exeter\n Author: Anders Schlichtkrull, DTU\n*)\n\nsection\\Term Variants\\\ntheory Term_Variants\n imports Stateful_Protocol_Composition_and_Typing.Intruder_Deduction\nbegin\n\nfun term_variants where\n \"term_variants P (Var x) = [Var x]\"\n| \"term_variants P (Fun f T) = (\n let S = product_lists (map (term_variants P) T)\n in map (Fun f) S@concat (map (\\g. map (Fun g) S) (P f)))\"\n\ninductive term_variants_pred where\n term_variants_Var:\n \"term_variants_pred P (Var x) (Var x)\"\n| term_variants_P:\n \"\\length T = length S; \\i. i < length T \\ term_variants_pred P (T ! i) (S ! i); g \\ set (P f)\\\n \\ term_variants_pred P (Fun f T) (Fun g S)\"\n| term_variants_Fun:\n \"\\length T = length S; \\i. i < length T \\ term_variants_pred P (T ! i) (S ! i)\\\n \\ term_variants_pred P (Fun f T) (Fun f S)\"\n\nlemma term_variants_pred_inv:\n assumes \"term_variants_pred P (Fun f T) (Fun h S)\"\n shows \"length T = length S\"\n and \"\\i. i < length T \\ term_variants_pred P (T ! i) (S ! i)\"\n and \"f \\ h \\ h \\ set (P f)\"\nusing assms by (auto elim: term_variants_pred.cases)\n\nlemma term_variants_pred_inv':\n assumes \"term_variants_pred P (Fun f T) t\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ term_variants_pred P (T ! i) (args t ! i)\"\n and \"f \\ the_Fun t \\ the_Fun t \\ set (P f)\"\n and \"P \\ (\\_. [])(g := [h]) \\ f \\ the_Fun t \\ f = g \\ the_Fun t = h\"\nusing assms by (auto elim: term_variants_pred.cases)\n\nlemma term_variants_pred_inv'':\n assumes \"term_variants_pred P t (Fun f T)\"\n shows \"is_Fun t\"\n and \"length T = length (args t)\"\n and \"\\i. i < length T \\ term_variants_pred P (args t ! i) (T ! i)\"\n and \"f \\ the_Fun t \\ f \\ set (P (the_Fun t))\"\n and \"P \\ (\\_. [])(g := [h]) \\ f \\ the_Fun t \\ f = h \\ the_Fun t = g\"\nusing assms by (auto elim: term_variants_pred.cases)\n\nlemma term_variants_pred_inv_Var:\n \"term_variants_pred P (Var x) t \\ t = Var x\"\n \"term_variants_pred P t (Var x) \\ t = Var x\"\nby (auto intro: term_variants_Var elim: term_variants_pred.cases)\n\nlemma term_variants_pred_inv_const:\n \"term_variants_pred P (Fun c []) t \\ ((\\g \\ set (P c). t = Fun g []) \\ (t = Fun c []))\"\nby (auto intro: term_variants_P term_variants_Fun elim: term_variants_pred.cases)\n\nlemma term_variants_pred_refl: \"term_variants_pred P t t\"\nby (induct t) (auto intro: term_variants_pred.intros)\n\nlemma term_variants_pred_refl_inv:\n assumes st: \"term_variants_pred P s t\"\n and P: \"\\f. \\g \\ set (P f). f = g\"\n shows \"s = t\"\n using st P\nproof (induction s t rule: term_variants_pred.induct)\ncase (term_variants_Var P x) thus ?case by blast\nnext\n case (term_variants_P T S P g f)\n hence \"T ! i = S ! i\" when i: \"i < length T\" for i using i by blast\n hence \"T = S\" using term_variants_P.hyps(1) by (simp add: nth_equalityI)\n thus ?case using term_variants_P.prems term_variants_P.hyps(3) by fast\nnext\n case (term_variants_Fun T S P f)\n hence \"T ! i = S ! i\" when i: \"i < length T\" for i using i by blast\n hence \"T = S\" using term_variants_Fun.hyps(1) by (simp add: nth_equalityI)\n thus ?case by fast\nqed\n\nlemma term_variants_pred_const:\n assumes \"b \\ set (P a)\"\n shows \"term_variants_pred P (Fun a []) (Fun b [])\"\nusing term_variants_P[of \"[]\" \"[]\"] assms by simp\n\nlemma term_variants_pred_const_cases:\n \"P a \\ [] \\ term_variants_pred P (Fun a []) t \\\n (t = Fun a [] \\ (\\b \\ set (P a). t = Fun b []))\"\n \"P a = [] \\ term_variants_pred P (Fun a []) t \\ t = Fun a []\"\nusing term_variants_pred_inv_const[of P] by auto\n\nlemma term_variants_pred_param:\n assumes \"term_variants_pred P t s\"\n and fg: \"f = g \\ g \\ set (P f)\"\n shows \"term_variants_pred P (Fun f (S@t#T)) (Fun g (S@s#T))\"\nproof -\n have 1: \"length (S@t#T) = length (S@s#T)\" by simp\n \n have \"term_variants_pred P (T ! i) (T ! i)\" \"term_variants_pred P (S ! i) (S ! i)\" for i\n by (metis term_variants_pred_refl)+\n hence 2: \"term_variants_pred P ((S@t#T) ! i) ((S@s#T) ! i)\" for i\n by (simp add: assms nth_Cons' nth_append)\n\n show ?thesis by (metis term_variants_Fun[OF 1 2] term_variants_P[OF 1 2] fg)\nqed\n\nlemma term_variants_pred_Cons:\n assumes t: \"term_variants_pred P t s\"\n and T: \"term_variants_pred P (Fun f T) (Fun f S)\"\n and fg: \"f = g \\ g \\ set (P f)\"\n shows \"term_variants_pred P (Fun f (t#T)) (Fun g (s#S))\"\nproof -\n have 1: \"length (t#T) = length (s#S)\"\n and \"\\i. i < length T \\ term_variants_pred P (T ! i) (S ! i)\"\n using term_variants_pred_inv[OF T] by simp_all\n hence 2: \"\\i. i < length (t#T) \\ term_variants_pred P ((t#T) ! i) ((s#S) ! i)\"\n by (metis t One_nat_def diff_less length_Cons less_Suc_eq less_imp_diff_less nth_Cons'\n zero_less_Suc) \n\n show ?thesis using 1 2 fg by (auto intro: term_variants_pred.intros)\nqed\n\nlemma term_variants_pred_dense:\n fixes P Q::\"'a set\" and fs gs::\"'a list\"\n defines \"P_fs x \\ if x \\ P then fs else []\"\n and \"P_gs x \\ if x \\ P then gs else []\"\n and \"Q_fs x \\ if x \\ Q then fs else []\"\n assumes ut: \"term_variants_pred P_fs u t\"\n and g: \"g \\ Q\" \"g \\ set gs\"\n shows \"\\s. term_variants_pred P_gs u s \\ term_variants_pred Q_fs s t\"\nproof -\n define F where \"F \\ \\(P::'a set) (fs::'a list) x. if x \\ P then fs else []\"\n\n show ?thesis using ut g P_fs_def unfolding P_gs_def Q_fs_def\n proof (induction P_fs u t arbitrary: g gs rule: term_variants_pred.induct)\n case (term_variants_Var P h x) thus ?case\n by (auto intro: term_variants_pred.term_variants_Var)\n next\n case (term_variants_P T S P' h' h g gs)\n note hyps = term_variants_P.hyps(1,2,4,5,6,7)\n note IH = term_variants_P.hyps(3)\n\n have \"\\s. term_variants_pred (F P gs) (T ! i) s \\ term_variants_pred (F Q fs) s (S ! i)\"\n when i: \"i < length T\" for i\n using IH[OF i hyps(4,5,6)] unfolding F_def by presburger\n then obtain U where U:\n \"length T = length U\" \"\\i. i < length T \\ term_variants_pred (F P gs) (T ! i) (U ! i)\"\n \"length U = length S\" \"\\i. i < length U \\ term_variants_pred (F Q fs) (U ! i) (S ! i)\"\n using hyps(1) Skolem_list_nth[of _ \"\\i s. term_variants_pred (F P gs) (T ! i) s \\\n term_variants_pred (F Q fs) s (S ! i)\"]\n by moura\n\n show ?case\n using term_variants_pred.term_variants_P[OF U(1,2), of g h]\n term_variants_pred.term_variants_P[OF U(3,4), of h' g]\n hyps(3)[unfolded hyps(6)] hyps(4,5)\n unfolding F_def by force\n next\n case (term_variants_Fun T S P' h' g gs)\n note hyps = term_variants_Fun.hyps(1,2,4,5,6)\n note IH = term_variants_Fun.hyps(3)\n\n have \"\\s. term_variants_pred (F P gs) (T ! i) s \\ term_variants_pred (F Q fs) s (S ! i)\"\n when i: \"i < length T\" for i\n using IH[OF i hyps(3,4,5)] unfolding F_def by presburger\n then obtain U where U:\n \"length T = length U\" \"\\i. i < length T \\ term_variants_pred (F P gs) (T ! i) (U ! i)\"\n \"length U = length S\" \"\\i. i < length U \\ term_variants_pred (F Q fs) (U ! i) (S ! i)\"\n using hyps(1) Skolem_list_nth[of _ \"\\i s. term_variants_pred (F P gs) (T ! i) s \\\n term_variants_pred (F Q fs) s (S ! i)\"]\n by moura\n \n thus ?case\n using term_variants_pred.term_variants_Fun[OF U(1,2)]\n term_variants_pred.term_variants_Fun[OF U(3,4)]\n unfolding F_def by meson\n qed\nqed\n\nlemma term_variants_pred_dense':\n assumes ut: \"term_variants_pred ((\\_. [])(a := [b])) u t\"\n shows \"\\s. term_variants_pred ((\\_. [])(a := [c])) u s \\\n term_variants_pred ((\\_. [])(c := [b])) s t\"\nusing ut term_variants_pred_dense[of \"{a}\" \"[b]\" u t c \"{c}\" \"[c]\"]\nunfolding fun_upd_def by simp\n\nlemma term_variants_pred_eq_case:\n fixes t s::\"('a,'b) term\"\n assumes \"term_variants_pred P t s\" \"\\f \\ funs_term t. P f = []\"\n shows \"t = s\"\nusing assms\nproof (induction P t s rule: term_variants_pred.induct)\n case (term_variants_Fun T S P f) thus ?case\n using subtermeq_imp_funs_term_subset[OF Fun_param_in_subterms[OF nth_mem], of _ T f]\n nth_equalityI[of T S]\n by blast\nqed (simp_all add: term_variants_pred_refl)\n\nlemma term_variants_pred_subst:\n assumes \"term_variants_pred P t s\"\n shows \"term_variants_pred P (t \\ \\) (s \\ \\)\"\nusing assms\nproof (induction P t s rule: term_variants_pred.induct)\n case (term_variants_P T S P f g)\n have 1: \"length (map (\\t. t \\ \\) T) = length (map (\\t. t \\ \\) S)\"\n using term_variants_P.hyps\n by simp\n\n have 2: \"term_variants_pred P ((map (\\t. t \\ \\) T) ! i) ((map (\\t. t \\ \\) S) ! i)\"\n when \"i < length (map (\\t. t \\ \\) T)\" for i\n using term_variants_P that\n by fastforce\n\n show ?case\n using term_variants_pred.term_variants_P[OF 1 2 term_variants_P.hyps(3)]\n by fastforce\nnext\n case (term_variants_Fun T S P f)\n have 1: \"length (map (\\t. t \\ \\) T) = length (map (\\t. t \\ \\) S)\"\n using term_variants_Fun.hyps\n by simp\n\n have 2: \"term_variants_pred P ((map (\\t. t \\ \\) T) ! i) ((map (\\t. t \\ \\) S) ! i)\"\n when \"i < length (map (\\t. t \\ \\) T)\" for i\n using term_variants_Fun that\n by fastforce\n\n show ?case\n using term_variants_pred.term_variants_Fun[OF 1 2]\n by fastforce\nqed (simp add: term_variants_pred_refl)\n\nlemma term_variants_pred_subst':\n fixes t s::\"('a,'b) term\" and \\::\"('a,'b) subst\"\n assumes \"term_variants_pred P (t \\ \\) s\"\n and \"\\x \\ fv t \\ fv s. (\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ P f = [])\"\n shows \"\\u. term_variants_pred P t u \\ s = u \\ \\\"\nusing assms\nproof (induction P \"t \\ \\\" s arbitrary: t rule: term_variants_pred.induct)\n case (term_variants_Var P x g) thus ?case using term_variants_pred_refl by fast\nnext\n case (term_variants_P T S P g f) show ?case\n proof (cases t)\n case (Var x) thus ?thesis\n using term_variants_P.hyps(4,5) term_variants_P.prems\n by fastforce\n next\n case (Fun h U)\n hence 1: \"h = f\" \"T = map (\\s. s \\ \\) U\" \"length U = length T\"\n using term_variants_P.hyps(5) by simp_all\n hence 2: \"T ! i = U ! i \\ \\\" when \"i < length T\" for i\n using that by simp\n\n have \"\\x \\ fv (U ! i) \\ fv (S ! i). (\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ P f = [])\"\n when \"i < length U\" for i\n using that Fun term_variants_P.prems term_variants_P.hyps(1) 1(3)\n by force\n hence IH: \"\\i < length U. \\u. term_variants_pred P (U ! i) u \\ S ! i = u \\ \\\"\n by (metis 1(3) term_variants_P.hyps(3)[OF _ 2])\n\n have \"\\V. length U = length V \\ S = map (\\v. v \\ \\) V \\\n (\\i < length U. term_variants_pred P (U ! i) (V ! i))\"\n using term_variants_P.hyps(1) 1(3) subst_term_list_obtain[OF IH] by metis\n then obtain V where V: \"length U = length V\" \"S = map (\\v. v \\ \\) V\"\n \"\\i. i < length U \\ term_variants_pred P (U ! i) (V ! i)\"\n by moura\n\n have \"term_variants_pred P (Fun f U) (Fun g V)\"\n by (metis term_variants_pred.term_variants_P[OF V(1,3) term_variants_P.hyps(4)])\n moreover have \"Fun g S = Fun g V \\ \\\" using V(2) by simp\n ultimately show ?thesis using term_variants_P.hyps(1,4) Fun 1 by blast\n qed\nnext\n case (term_variants_Fun T S P f t) show ?case\n proof (cases t)\n case (Var x)\n hence \"T = []\" \"P f = []\" using term_variants_Fun.hyps(4) term_variants_Fun.prems by fastforce+\n thus ?thesis using term_variants_pred_refl Var term_variants_Fun.hyps(1,4) by fastforce\n next\n case (Fun h U)\n hence 1: \"h = f\" \"T = map (\\s. s \\ \\) U\" \"length U = length T\"\n using term_variants_Fun.hyps(4) by simp_all\n hence 2: \"T ! i = U ! i \\ \\\" when \"i < length T\" for i\n using that by simp\n\n have \"\\x \\ fv (U ! i) \\ fv (S ! i). (\\y. \\ x = Var y) \\ (\\f. \\ x = Fun f [] \\ P f = [])\"\n when \"i < length U\" for i\n using that Fun term_variants_Fun.prems term_variants_Fun.hyps(1) 1(3)\n by force\n hence IH: \"\\i < length U. \\u. term_variants_pred P (U ! i) u \\ S ! i = u \\ \\\"\n by (metis 1(3) term_variants_Fun.hyps(3)[OF _ 2 ])\n\n have \"\\V. length U = length V \\ S = map (\\v. v \\ \\) V \\\n (\\i < length U. term_variants_pred P (U ! i) (V ! i))\"\n using term_variants_Fun.hyps(1) 1(3) subst_term_list_obtain[OF IH] by metis\n then obtain V where V: \"length U = length V\" \"S = map (\\v. v \\ \\) V\"\n \"\\i. i < length U \\ term_variants_pred P (U ! i) (V ! i)\"\n by moura\n\n have \"term_variants_pred P (Fun f U) (Fun f V)\"\n by (metis term_variants_pred.term_variants_Fun[OF V(1,3)])\n moreover have \"Fun f S = Fun f V \\ \\\" using V(2) by simp\n ultimately show ?thesis using term_variants_Fun.hyps(1) Fun 1 by blast\n qed\nqed\n\nlemma term_variants_pred_iff_in_term_variants:\n fixes t::\"('a,'b) term\"\n shows \"term_variants_pred P t s \\ s \\ set (term_variants P t)\"\n (is \"?A t s \\ ?B t s\")\nproof\n define U where \"U \\ \\P (T::('a,'b) term list). product_lists (map (term_variants P) T)\"\n\n have a:\n \"g \\ set (P f) \\ set (map (Fun g) (U P T)) \\ set (term_variants P (Fun f T))\"\n \"set (map (Fun f) (U P T)) \\ set (term_variants P (Fun f T))\"\n for f P g and T::\"('a,'b) term list\"\n using term_variants.simps(2)[of P f T]\n unfolding U_def Let_def by auto\n\n have b: \"\\S \\ set (U P T). s = Fun f S \\ (\\g \\ set (P f). s = Fun g S)\"\n when \"s \\ set (term_variants P (Fun f T))\" for P T f s\n using that by (cases \"P f\") (auto simp add: U_def Let_def)\n\n have c: \"length T = length S\" when \"S \\ set (U P T)\" for S P T\n using that unfolding U_def\n by (simp add: in_set_product_lists_length)\n\n show \"?A t s \\ ?B t s\"\n proof (induction P t s rule: term_variants_pred.induct)\n case (term_variants_P T S P g f)\n note hyps = term_variants_P.hyps\n note IH = term_variants_P.IH\n\n have \"S \\ set (U P T)\"\n using IH hyps(1) product_lists_in_set_nth'[of _ S]\n unfolding U_def by simp\n thus ?case using a(1)[of _ P, OF hyps(3)] by auto\n next\n case (term_variants_Fun T S P f)\n note hyps = term_variants_Fun.hyps\n note IH = term_variants_Fun.IH\n\n have \"S \\ set (U P T)\"\n using IH hyps(1) product_lists_in_set_nth'[of _ S]\n unfolding U_def by simp\n thus ?case using a(2)[of f P T] by (cases \"P f\") auto\n qed (simp add: term_variants_Var)\n\n show \"?B t s \\ ?A t s\"\n proof (induction P t arbitrary: s rule: term_variants.induct)\n case (2 P f T)\n obtain S where S:\n \"s = Fun f S \\ (\\g \\ set (P f). s = Fun g S)\"\n \"S \\ set (U P T)\" \"length T = length S\"\n using c b[OF \"2.prems\"] by moura\n\n have \"\\i < length T. term_variants_pred P (T ! i) (S ! i)\"\n using \"2.IH\" S product_lists_in_set_nth by (fastforce simp add: U_def)\n thus ?case using S by (auto intro: term_variants_pred.intros)\n qed (simp add: term_variants_Var)\nqed\n\nlemma term_variants_pred_finite:\n \"finite {s. term_variants_pred P t s}\"\nusing term_variants_pred_iff_in_term_variants[of P t]\nby simp\n\nlemma term_variants_pred_fv_eq:\n assumes \"term_variants_pred P s t\"\n shows \"fv s = fv t\"\nusing assms\nby (induct rule: term_variants_pred.induct)\n (metis, metis fv_eq_FunI, metis fv_eq_FunI)\n\nlemma (in intruder_model) term_variants_pred_wf_trms:\n assumes \"term_variants_pred P s t\"\n and \"\\f g. g \\ set (P f) \\ arity f = arity g\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing assms\napply (induction rule: term_variants_pred.induct, simp)\nby (metis (no_types) wf_trmI wf_trm_arity in_set_conv_nth wf_trm_param_idx)+\n\nlemma term_variants_pred_funs_term:\n assumes \"term_variants_pred P s t\"\n and \"f \\ funs_term t\"\n shows \"f \\ funs_term s \\ (\\g \\ funs_term s. f \\ set (P g))\"\n using assms\nproof (induction rule: term_variants_pred.induct)\n case (term_variants_P T S P g h) thus ?case\n proof (cases \"f = g\")\n case False\n then obtain s where \"s \\ set S\" \"f \\ funs_term s\"\n using funs_term_subterms_eq(1)[of \"Fun g S\"] term_variants_P.prems by auto\n thus ?thesis\n using term_variants_P.IH term_variants_P.hyps(1) in_set_conv_nth[of s S] by force\n qed simp\nnext\n case (term_variants_Fun T S P h) thus ?case\n proof (cases \"f = h\")\n case False\n then obtain s where \"s \\ set S\" \"f \\ funs_term s\"\n using funs_term_subterms_eq(1)[of \"Fun h S\"] term_variants_Fun.prems by auto\n thus ?thesis\n using term_variants_Fun.IH term_variants_Fun.hyps(1) in_set_conv_nth[of s S] by force\n qed simp\nqed fast\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Automated_Stateful_Protocol_Verification", "sha": "e24b8241b56d24240e1227caff737d4af82e12ec", "save_path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification", "path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification/Automated_Stateful_Protocol_Verification-e24b8241b56d24240e1227caff737d4af82e12ec/Automated_Stateful_Protocol_Verification/Term_Variants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2679904786531365}} {"text": "chapter {* camr project *}\n\ntheory Execute imports Main Unification Term Deduction begin\n\n\n(* helper function that applies ANALYSIS RULES one step *)\nfun through_m :: \"msg list \\ msg list \\ msg list \\ msg \\ (subst_msg \\ system) list\" where\n\"through_m head [] a t = []\" |\n\"through_m head (u#tail) a t = (\n case u of\n Concat u1 u2 \\\n [(Variable, [(((u1#u2#head@tail) | (u#a) } t))])]\n | Sym_encrypt m k \\\n [(Variable, [(((m#head@tail) | (u#a) } t)), (((head@tail) | (u#a) } k))])]\n | Pub_encrypt m (Variable agent) \\ \n let s = Variable(agent:=(Const ''intruder'')) in\n [(s, [sapplyc s ((head@u#tail)|a}t)])]\n | Pub_encrypt m (Const x) \\ ( \n if x = ''intruder'' then \n [(Variable, [(((m#head@tail) | (u#a) } t))])]\n else\n []\n )\n | _ \\ []\n) @ through_m (head@[u]) tail a t\"\n\nlemma through_m_ribosom: \"set (through_m head tail a t) \\ set (through_m [] (head@tail) a t)\"\nproof(induction \"rev head\" arbitrary:head tail)\ncase Nil\n then show ?case by simp\nnext\n case (Cons u rhead head)\n then have \"head = rev (u#rhead)\" by simp\n then have headdef:\"head = (rev rhead) @ [u]\" by simp\n have \"rhead = rev (rev rhead)\" by simp\n then have \"set (through_m (rev rhead) (u # tail) a t)\n\\ set (through_m [] (rev rhead @ u # tail) a t)\" by(rule Cons(1))\n moreover have \"rev rhead @ u # tail = head @ tail\" by(simp add: headdef)\n ultimately have \"set (through_m (rev rhead) (u # tail) a t) \\ set (through_m [] (head @ tail) a t)\" by simp\n moreover have \"set (through_m ((rev rhead) @ [u]) tail a t) \\ set (through_m (rev rhead) (u # tail) a t)\" by auto\n then have \"set (through_m head tail a t) \\ set (through_m (rev rhead) (u # tail) a t)\" by(simp add:headdef)\n ultimately show ?case by blast\nqed\n\nlemma through_m_sound: \n assumes \"(s', cs') \\ set (through_m head tail a t)\"\n shows \"((head@tail) | a } t) \\1[s'] cs'\"\n using assms\nproof(induction head tail a t rule: through_m.induct)\n case (1 head a t)\n then show ?case by auto\nnext\n case (2 head u tail a t)\n let ?snd = \"through_m (head @ [u]) tail a t\"\n let ?fst = \"through_m head (u # tail) a t\"\n let ?prefix = \"case u of\n Concat u1 u2 \\\n [(Variable, [(((u1#u2#head@tail) | (u#a) } t))])]\n | Sym_encrypt m k \\\n [(Variable, [(((m#head@tail) | (u#a) } t)), (((head@tail) | (u#a) } k))])]\n | Pub_encrypt m (Variable agent) \\ \n let s = Variable(agent:=(Const ''intruder'')) in\n [(s, [sapplyc s ((head@u#tail)|a}t)])]\n | Pub_encrypt m (Const x) \\ ( \n if x = ''intruder'' then \n [(Variable, [(((m#head@tail) | (u#a) } t))])]\n else\n []\n )\n | _ \\ []\"\n have decomp:\"set ?fst = set ?prefix \\ set ?snd\" by auto\n then show ?case \n proof (cases \"(s', cs') \\ set ?snd\")\n case True\n then show ?thesis using 2 by auto\n next\n case False\n then have \"(s', cs') \\ set ?prefix\" using assms decomp 2 by blast\n then show ?thesis by(cases u)(auto intro!: rer1.intros split: msg.split_asm simp add: Let_def simp del: fun_upd_apply)\n qed\nqed\n\n\n(* helper function that applies UNIFY RULE one step*)\nfun through_all :: \"msg list \\ msg \\ (subst_msg \\ system) list\" where\n \"through_all _ (Variable _) = []\" |\n \"through_all l t = \n concat (map (%u. (case unify_msg [(t, u)] of\n None \\ []\n | Some s \\ [(s, [])]\n )) l)\"\n\nlemma through_all_sound:\n assumes \"(s, cs) \\ set (through_all (m@a) t)\"\n \"c = m|a}t\"\n shows \"c \\1[s] cs\"\n using assms\nproof(cases t)\nqed(auto intro:rer1.intros)\n\n\n(* helper function that applies COMPOSITION RULES one step *)\nfun through_t :: \"constraint \\ (subst_msg \\ system) option\" where\n \"through_t (m|a}Concat x y) = Some (Variable, [(m|a}x), (m|a}y)])\"\n| \"through_t (m|a}Sym_encrypt x y) = Some (Variable, [(m|a}x), (m|a}y)])\"\n| \"through_t (m|a}Pub_encrypt x y) = Some (Variable, [(m|a}x), (m|a}y)])\"\n| \"through_t (m|a}Sign x y) = (if y = Const ''intruder'' then Some (Variable, [(m|a}x)]) else None)\"\n| \"through_t (m|a}Hash x) = Some (Variable, [(m|a}x)])\"\n| \"through_t _ = None\"\n\nlemma through_t_sound:\"Some (s, cs) = (through_t c) \\ c \\1[s] cs\"\nproof(cases c)\n case (Constraint a m t)\n show \"Some (s, cs) = (through_t c) \\ c \\1[s] cs\" \n apply(cases t)\n apply(auto simp add:Constraint intro!:rer1.intros split:if_split_asm)\n done\nqed\n\n\n(* apply all constraint reduction rules to the input constraint *)\nfun rer1_succ:: \"constraint \\ (subst_msg \\ system) list\" where\n \"rer1_succ (m|a}t) = \n(through_all (m@a) t) @ (\n(through_m [] m a t) @ ( \n(case through_t (m|a}t) of None \\ [] | Some x \\ [x])))\"\n\nlemma rer1_succ_sound: \"(s, cs) \\ set (rer1_succ c) \\ c \\1[s] cs\"\nproof (cases c)\n case (Constraint m a t)\n assume in_set: \"(s, cs) \\ set (rer1_succ c)\" \n have in_union: \"(set (rer1_succ (m|a}t))) = (set (through_all (m@a) t)) \\ (set (through_m [] m a t)) \\ (set (case through_t (m|a}t) of None \\ [] | Some x \\ [x]))\" \n (is \"_ = ?Setall \\ ?Setm \\ ?Sett\") by auto\n then show ?thesis \n proof (cases \"(s, cs) \\ ?Setall\")\n case True\n then show ?thesis using Constraint by (rule through_all_sound)\n next\n case ex: False\n then show ?thesis\n proof(cases \"(s, cs) \\ ?Setm\")\n case True\n thm through_m_sound through_m_sound[of s cs \"[]\" m a t]\n then have \"([] @ m)|a} t \\1[s] cs\" by (rule through_m_sound)\n then show ?thesis using Constraint by simp\n next\n case False\n then have \"(s, cs) \\ ?Sett\" using ex in_union in_set Constraint by simp\n then show ?thesis using Constraint by (auto simp add: through_t_sound)\n qed\n qed\nqed\n\nlemma rer1_succ_complete: \"c \\1[s] cs \\ (s, cs) \\ set (rer1_succ c)\"\nproof(induction c s cs rule:rer1.induct)\n case (rer1_unify t u a m s)\n then have \"(s, []) \\ set (through_all (m@a) t)\"\n apply(cases t; cases \"u\\set a\")\n apply(auto simp add:sym[of \"Some s\" _] intro:bexI[of _ \"u\" \"set a\"])\n apply(auto simp add:sym[of \"Some s\" _] intro:bexI[of _ \"u\" \"set m\"])\n done \n then show ?case by simp\nnext\n case (rer1_proj x u v head tail a t)\n then have \"(Variable, [(u # v # head @ tail)|(x # a)} t ]) \\ set (through_m head (x # tail) a t)\" (is \"?x \\ ?s\")\n by(auto)\n moreover have \"?s \\ set (through_m [] (head@x#tail) a t)\" by(rule through_m_ribosom)\n ultimately have \"?x \\ set (through_m [] (head @ x # tail) a t)\"\n by blast\n then show ?case by simp\nnext\n case (rer1_sdec x u k head tail a t)\n then have \"(Variable,\n [(u # head @ tail)|(x # a)} t , (head @ tail)|(x # a)} k ]) \\ set (through_m head (x # tail) a t)\" (is \"?x \\ ?s\")\n by(auto)\n moreover have \"?s \\ set (through_m [] (head@x#tail) a t)\" by(rule through_m_ribosom)\n ultimately have \"?x \\ set (through_m [] (head @ x # tail) a t)\"\n by blast\n then show ?case by simp\nnext\n case (rer1_adec x u head tail a t)\n then have \"(Variable, [(u # head @ tail)|(x # a)} t ]) \\ set (through_m head (x # tail) a t)\" (is \"?x \\ ?s\")\n by(auto)\n moreover have \"?s \\ set (through_m [] (head@x#tail) a t)\" by(rule through_m_ribosom)\n ultimately have \"?x \\ set (through_m [] (head @ x # tail) a t)\"\n by blast\n then show ?case by simp\nnext\n case (rer1_ksub u agent m s a t)\n let ?x=\"Pub_encrypt u (Variable agent)\"\n from rer1_ksub(1) and split_list[of \"?x\" \"m\"] obtain head tail where mdef:\"m = head @ ?x#tail\" by blast\n then have \" (s, [sapplyc s (m|a} t )]) \\ set (through_m head (?x # tail) a t)\" (is \"?elt \\ ?s\")\n by(auto simp add:rer1_ksub Let_def sapplyc_def)\n moreover have \"?s \\ set (through_m [] (head@?x#tail) a t)\" by(rule through_m_ribosom)\n ultimately have \"?elt \\ set (through_m [] (head @ ?x # tail) a t)\"\n by blast\n then show ?case by (simp add:mdef)\nqed auto\n\n\n(* apply the substitutions collected by applying the constraint reduction rules*)\nfun rer_succ_aux:: \"system \\ system \\ (subst_msg \\ system) list\" where\n \"rer_succ_aux head [] = []\" |\n \"rer_succ_aux head (c#tail) = \nrer_succ_aux (head@[c]) tail @ (map\n (%(s, cs). \n (s,\n cs@(sapplys s (head@tail))\n )\n )\n (rer1_succ c)\n)\"\n\nlemma rer_succ_aux_sound: \"(s, cs') \\ set (rer_succ_aux head tail) \\ (head@tail) \\[s] cs'\"\nproof(induction head tail arbitrary:s cs' rule:rer_succ_aux.induct)\n case (1 head)\n then show ?case by simp\nnext\n case (2 head c tail)\n then show ?case\n proof(cases \"(s, cs') \\ set (rer_succ_aux (head@[c]) tail)\")\n case True\n then have \"((head @ [c]) @ tail)\\[s] cs'\" by(rule 2)\n then show ?thesis by(simp)\nnext\n case False\n from this and \"2\"(2) have \"(s, cs') \\ set (map\n (%(s, cs). \n (s,\n cs@(sapplys s (head@tail))\n )\n )\n (rer1_succ c)\n)\" by simp\n then obtain cs where csdef:\"cs' = cs@(sapplys s (head@tail))\" and in_rer1_succ:\"(s, cs) \\ set (rer1_succ c)\" by auto\n moreover from in_rer1_succ have \"c \\1[s] cs\" by(rule rer1_succ_sound)\n ultimately show ?thesis by(auto intro!:rer.intros)\nqed\nqed\n\n(* ok, this is exactly the same proof that for through_m_ribosom; I could have done a proper\ngeneral theorem *)\nlemma rer_succ_aux_ribosom: \"set (rer_succ_aux head tail) \\ set (rer_succ_aux [] (head@tail))\"\nproof(induction \"rev head\" arbitrary:head tail)\ncase Nil\n then show ?case by simp\nnext\n case (Cons u rhead head)\n then have \"head = rev (u#rhead)\" by simp\n then have headdef:\"head = (rev rhead) @ [u]\" by simp\n have \"rhead = rev (rev rhead)\" by simp\n then have \"set (rer_succ_aux (rev rhead) (u # tail))\n\\ set (rer_succ_aux [] (rev rhead @ u # tail))\" by(rule Cons(1))\n moreover have \"rev rhead @ u # tail = head @ tail\" by(simp add: headdef)\n ultimately have \"set (rer_succ_aux (rev rhead) (u # tail)) \\ set (rer_succ_aux [] (head @ tail))\" by simp\n moreover have \"set (rer_succ_aux ((rev rhead) @ [u]) tail) \\ set (rer_succ_aux (rev rhead) (u # tail))\" by auto\n then have \"set (rer_succ_aux head tail) \\ set (rer_succ_aux (rev rhead) (u # tail))\" by(simp add:headdef)\n ultimately show ?case by blast\nqed\n\nfun rer_succ:: \"system \\ (subst_msg \\ system) list\" where\n\"rer_succ cs = rer_succ_aux [] cs\"\n\nlemma rer_succ_complete: \"cs \\[s] cs' \\ (s, cs') \\ set (rer_succ cs)\"\nproof(induction cs s cs' rule:rer.induct)\n case (1 c s cs head tail)\n then have \"(s, cs)\\ set (rer1_succ c)\" by(rule rer1_succ_complete)\n then have \"(s, cs @ sapplys s (head @ tail))\\ set (rer_succ_aux head (c#tail))\" (is \"?elt \\ ?set\") by auto\n moreover have \"?set \\ set (rer_succ_aux [] (head@c#tail))\" by(rule rer_succ_aux_ribosom)\n then have \"?set \\ set (rer_succ (head@c#tail))\" by simp\n ultimately show ?case by blast\nqed\n\nlemma rer_succ_sound: \"(s, cs') \\ set (rer_succ cs) \\ cs \\[s] cs'\"\nproof -\n assume \"(s, cs') \\ set (rer_succ cs)\"\n then have \"(s, cs') \\ set (rer_succ_aux [] cs)\" by simp\n then have \"([]@cs) \\[s] cs'\" by(rule rer_succ_aux_sound)\n then show \"cs \\[s] cs'\" by simp\nqed\n\n\n(* get the set of all constraints reachable from the current set *)\nfun next_step:: \"(subst_msg \\ system) list \\ (subst_msg \\ system) list\" where\n\"next_step l = (concat (map \n(%(s, cs).\n map (%(s', cs'). (scomp_msg s' s, cs')) (rer_succ cs)\n) l\n))\"\n\n\nlemma set_next_step: \"set (next_step l) = (\\ (s, cs) \\ set l. {(scomp_msg s' s, cs') |cs' s'. cs\\[s'] cs'})\" (is \"_ = ?UN\")\nproof(rule equalityI; rule subsetI)\n fix x\n assume xin:\"x\\ set(next_step l)\"\n then obtain s cs s' cs' where xdef:\"x= (scomp_msg s' s, cs')\" and rel:\"(s', cs')\\set (rer_succ cs)\" and csdef:\"(s, cs)\\set l\" by auto\n moreover from rel have \"cs \\[s'] cs'\" by(rule rer_succ_sound)\n ultimately show \"x\\ ?UN\" by auto\nnext\n fix x\n assume xin:\"x\\?UN\"\n then obtain s cs s' cs' where\n xdef:\"x= (scomp_msg s' s, cs')\" and rel:\"cs\\[s'] cs'\" and csdef:\"(s, cs)\\set l\" \n by auto\n moreover from rel have \"(s', cs')\\set (rer_succ cs)\" by(rule rer_succ_complete)\n ultimately have \"x\\ set (map (%(s', cs'). (scomp_msg s' s, cs')) (rer_succ cs))\" (is \"x\\ set ?L\") by auto\n moreover from csdef have \"?L \\ set (map \n(%(s, cs).\n map (%(s', cs'). (scomp_msg s' s, cs')) (rer_succ cs)\n) l)\" by auto\n ultimately show \"x\\ set (next_step l)\" by(auto simp only:set_concat next_step.simps)\nqed\n\nlemma wf_empty: \"wf {}\" by(auto simp add: wf_eq_minimal)\n\ndefinition steps_set:: \"(((subst_msg \\ system) list) \\ ((subst_msg \\ system) list)) set\"\n where \"steps_set = {((next_step l), l)|l. l\\[]}\"\n\nlemma wf_steps_set:\"wf steps_set\"\nproof -\n let ?orig = \"{(y, x). reducesto x y}\"\n let ?pairs = \"?orig <*lex*> ({}::subst_msg rel)\"\n let ?revpairs = \"inv_image ?pairs (%(x, y). (y, x))\"\n let ?sets = \"max_ext ?revpairs\"\n have \"steps_set \\ inv_image ?sets set\" (is \"_ \\ ?lists\")\n proof(rule subsetI)\n fix x\n assume assms:\"x \\ steps_set\"\n then obtain l where xdef:\"x = (next_step l, l)\" and lnonempty:\"l\\[]\" by(auto simp del:next_step.simps simp add:steps_set_def)\n have \"(set (next_step l), set l) \\ ?sets\"\n proof(rule max_extI)\n fix y\n assume \"y \\ set (next_step l)\"\n then obtain s cs s' cs'\n where ydef:\"y = (scomp_msg s' s, cs')\"\n and cs'def:\"(s', cs')\\ set (rer_succ cs)\"\n and csdef: \"(s, cs) \\ set l\"\n by auto\n show \"\\z\\set l. (y, z) \\ ?revpairs\"\n proof(rule bexI[of _ \"(s, cs)\"])\n from cs'def have \"cs \\[s'] cs'\" by(rule rer_succ_sound)\n then have \"reducesto cs cs'\" by(auto intro:reducesto.intros)\n then have \"(cs', cs) \\ ?orig\" by simp\n then have \"((cs', s'), (cs, s)) \\ ?pairs\" by(auto)\n then show \"(y, (s, cs)) \\ ?revpairs\" by(auto simp add:inv_image_def ydef)\n qed(simp add:csdef)\n qed(auto simp add:lnonempty)\n from this assms xdef show \"x\\ ?lists\" by(auto simp del:next_step.simps simp add:steps_set_def)\n qed\n moreover from termination_red and wf_empty have \"wf ?pairs\" by(rule wf_lex_prod)\n then have \"wf ?revpairs\" by auto\n then have \"wf ?sets\" by(auto intro:max_ext_wf)\n then have \"wf ?lists\" by auto\n ultimately show ?thesis by(auto intro:wf_subset)\nqed\n\n(* search for a simple constraint system which can be reached from the original constraint system *)\nfunction search_aux :: \"(subst_msg \\ system) list \\ (subst_msg \\ system) option\" where\n\"search_aux l = (if l=[] then None else (case find (%(s, cs). simples cs) l of Some x \\ Some x | None \\ search_aux (next_step l)))\"\n by pat_completeness auto\ntermination\n apply(relation \"steps_set\")\n using wf_steps_set apply(auto simp add:steps_set_def simp del:next_step.simps)\n done\n\n\nlemma search_aux_none: \"search_aux l = None \\ (s, cs)\\ set l \\ cs \\*[s'] cs' \\ simples cs' \\ False\"\nproof(induction l arbitrary:s cs s' rule:search_aux.induct)\n case (1 l)\n then show ?case\n proof(cases \"l=[]\")\n case True\n from this and \"1\" show ?thesis by(simp)\n next\n case False\n from `l\\[]` and `search_aux l = None` have a:\"find (\\a. case a of (s, a) \\ simples a) l = None\"\n by(cases)(auto simp del:next_step.simps split:if_split_asm option.split)\n from `l\\[]` and `search_aux l = None` and this have b:\"search_aux (next_step l) = None\"\n by(auto simp del:next_step.simps split:if_split_asm option.split)\n from a b \"1\" False have \"\\s s' cs. (s, cs) \\ set (next_step l) \\ cs\\*[s'] cs' \\ False\" \n by blast\n from `cs\\*[s'] cs'` and `simples cs'` and `(s, cs) \\ set l` and `search_aux l = None` and this show ?thesis\n proof(induction cs s' cs' arbitrary:s l rule:rer_star.induct)\n case (rer_star_id cs)\n from `(s, cs) \\ set l` have \"l \\ []\" by auto\n from `simples cs` and `l\\[]` and `(s, cs)\\ set l`\n have \"find (\\(s, y). simples y) l \\ None\"\n by(auto simp add:find_None_iff)\n from this and `search_aux l = None` show False\n by(auto simp del:next_step.simps split:if_split_asm option.split_asm)\n next\n case (rer_star_step cs t' cs'' t cs')\n from `cs\\[t'] cs''` and `(s, cs)\\set l` have c:\"(scomp_msg t' s, cs'')\\ set (next_step l)\" (is \"(?s, _)\\_\")\n by (auto simp add:set_next_step simp del:next_step.simps)\n have d:\"search_aux (next_step l) = None\"\n proof(rule ccontr)\n assume \"search_aux (next_step l) \\ None\"\n then obtain x where \"search_aux (next_step l) =Some x\" by auto\n moreover from `(s, cs) \\ set l` have \"l\\[]\" by auto\n ultimately have \"search_aux (l) \\ None\"\n by(auto simp del:next_step.simps split:if_split_asm option.split)\n from this and `search_aux l = None` show False by blast\n qed\n have \"\\S CS S'. (S, CS) \\ set (next_step (next_step l)) \\ CS\\*[S'] cs' \\ False\"\n proof -\n fix S CS S'\n assume \"(S, CS) \\ set (next_step (next_step l))\" \"CS\\*[S'] cs'\"\n from `(?s, cs'')\\set (next_step l)` and this and set_next_step[of \"next_step l\"]\n obtain k T U where \"k \\[T] CS\" and \"(U, k)\\ set (next_step l)\"\n by(auto simp del:next_step.simps)\n from this and `CS\\*[S'] cs'` have \"k \\*[scomp_msg S' T] cs'\" by(auto intro:rer_star.intros)\n from `(U, k)\\set (next_step l)` and this show False by(rule rer_star_step)\n qed\n from `simples cs'` and c and d and this and rer_star_step show False by blast\n qed\n qed\nqed\n\nlemma find_invent: \"find P l = Some x \\ x\\ set l\"\nproof(induction l)\n case Nil\n then show ?case by simp\nnext\n case (Cons a l)\n then show ?case\n proof(cases \"P a\")\n case True\n from True and Cons show ?thesis by auto\n next\n case False\n from False and Cons show ?thesis by auto\n qed\nqed\n\nlemma search_finds_descendent:\"search_aux l = Some (s', cs') \\ (\\S. (\\ (s, cs)\\ set l. cs \\*[S] cs'))\"\nproof(induction l rule:search_aux.induct)\n case (1 l)\n then have \"l\\[]\" by auto\n show ?case\n proof(cases \"find (\\(s, y). simples y) l\")\n case None\n from \"1\" and None and `l \\ []` \n obtain S cs s where \"(s, cs)\\set (next_step l)\" \"cs\\*[S] cs'\"\n by(auto simp del:next_step.simps split:if_split_asm)\n then obtain s0 cs0 W where \"(s0, cs0)\\ set l\" \"cs0 \\[W] cs\"\n by(auto simp add:set_next_step simp del:next_step.simps)\n from `cs0 \\[W] cs` and `cs\\*[S] cs'` have \"cs0 \\*[scomp_msg S W] cs'\" by(rule rer_star_step)\n from this and `(s0, cs0)\\ set l` show ?thesis by(auto simp del:next_step.simps)\n next\n case (Some a)\n from this and \"1\" and `l\\[]` have \"a = (s', cs')\" by simp\n from this and Some have \"(s', cs')\\ set l\" by(auto simp add:find_invent)\n moreover have \"cs' \\*[Variable] cs'\" by(rule rer_star_id)\n ultimately show ?thesis by auto\n qed\nqed\n\nlemma search_aux_complete: \"(\\ s cs'. cs \\*[s] cs' \\ simples cs') \\ (\\ s' cs''. search_aux [(Variable, cs)] = Some (s', cs''))\"\nproof (rule ccontr)\n assume \"\\s cs'. cs\\*[s] cs' \\ simples cs'\"\n then show \"\\s' cs''. search_aux [(Variable, cs)] = Some (s', cs'') \\ False\"\n proof -\n assume asm: \"\\s' cs''. search_aux [(Variable, cs)] = Some (s', cs'')\"\n have \"\\x. search_aux [(Variable, cs)] = x\" by simp\n then have \"search_aux [(Variable, cs)] = None \\ (\\ x xs. search_aux [(Variable, cs)] = Some (x, xs))\" by (simp add: split_option_ex)\n then have \"search_aux [(Variable, cs)] = None\" using asm by blast\n then have \"(s1, cs) \\ set [(Variable, cs)] \\ cs \\*[s] cs' \\ simples cs' \\ False\" using search_aux_none by blast\n then show ?thesis by (meson \\\\s cs'. cs\\*[s] cs' \\ simples cs'\\ \\search_aux [(Variable, cs)] = None\\ list.set_intros(1) search_aux_none)\n qed\nqed\n\n(*\nMISSING PROOFS:\nsearch_aux_sound\nsearch_sound\n*)\n\nfun search:: \"system \\ (subst_msg \\ system) option\" where\n\"search cs = search_aux [(Variable, cs)]\"\n\nlemma search_complete: \"(\\ s cs'. cs \\*[s] cs' \\ simples cs') \\ (\\ s' cs''. search cs = Some (s', cs''))\"\n by (auto simp del: search_aux.simps simp add: search_aux_complete)\n\n(* test examples *)\n\ndefinition KTP:: \"msg \\ msg \\ msg \\ msg \\ system\"\n where\n\"KTP A0 B0 A1 B1 =\n(let\n IK0 = [Const ''A'', Const ''B'', Const ''intruder''];\n IK1 = (Pub_encrypt (Sign (Const ''k0'') A0) B0) # IK0;\n IK2 = (Sym_encrypt (Const ''m1'') (Variable ''K1''))#IK1\nin [\n (IK0|[]}A0), \n (IK0|[]}A1),\n (IK1|[]} (Pub_encrypt (Sign (Variable ''K1'') A1) B1)),\n (IK2|[]} (Sym_encrypt (Variable ''Z0'') (Variable ''K1''))),\n (IK2|[]} (Concat (Variable ''K1'') (Variable ''Z0'')))\n ]\n)\"\n\n\ndefinition \"A0 = Variable ''A0''\"\ndefinition \"A1 = Const ''A''\"\ndefinition \"B0 = Variable ''B0''\"\ndefinition \"B1 = Const ''B''\"\n\nvalue \"find (%(s, cs). simples cs) (rer_succ (KTP A0 B0 A1 B1))\"\nvalue \"rer_succ (KTP A0 B0 A1 B1)\"\nvalue \"(next_step ([(Variable, (KTP A0 B0 A1 B1))]))\"\n\n(* value \"map_option (%(s, cs). (cs, map (%v. (v, s v)) [''A0'', ''B0'', ''K1'', ''Z0''])) (search (KTP A0 B0 A1 B1))\" *)\n\nend ", "meta": {"author": "symphorien", "repo": "camr-project", "sha": "303a4f66f91c5ad36f5907b684f8969799a3e2e5", "save_path": "github-repos/isabelle/symphorien-camr-project", "path": "github-repos/isabelle/symphorien-camr-project/camr-project-303a4f66f91c5ad36f5907b684f8969799a3e2e5/Execute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2679218876201255}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Derived Hoare Rules for Partial Correctness\\\n\ntheory HoarePartial imports HoarePartialProps begin\n\nlemma conseq_no_aux:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A';\n \\s. s \\ P \\ (s\\P' \\ (Q' \\ Q) \\ (A' \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where P'=\"\\Z. P'\" and Q'=\"\\Z. Q'\" and A'=\"\\Z. A'\"]) auto\n\n\nlemma conseq_exploit_pre:\n \"\\\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> ({s} \\ P) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply clarify\n apply (rule_tac x=\"{s} \\ P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n by simp\n\n\nlemma conseq:\"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq') blast\n\nlemma Lem: \"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n P \\ {s. \\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)}\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (unfold lem_def)\n apply (erule conseq)\n apply blast\n done\n\nlemma LemAnno:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ (\\t. t \\ Q' Z \\ t \\ Q)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma TrivPost: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma conseq_under_new_pre:\"\\\\,\\\\\\<^bsub>/F \\<^esub>P' c Q',A';\n \\s \\ P. s \\ P' \\ Q' \\ Q \\ A' \\ A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P c Q,A\"\napply (rule conseq)\napply (rule allI)\napply assumption\napply auto\ndone\n\n\n\nlemma DynComConseq:\n assumes \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A}\"\n shows \"\\,\\\\\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n using assms\n apply -\n apply (rule DynCom)\n apply clarsimp\n apply (rule Conseq)\n apply clarsimp\n apply blast\n done\n\nlemma SpecAnno:\n assumes consequence: \"P \\ {s. (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))}\"\n assumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant: \"\\Z. c Z = c undefined\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n from spec bdy_constant\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> ((P' Z)) (c undefined) (Q' Z),(A' Z)\"\n apply -\n apply (rule allI)\n apply (erule_tac x=Z in allE)\n apply (erule_tac x=Z in allE)\n apply simp\n done\n with consequence show ?thesis\n apply (simp add: specAnno_def)\n apply (erule conseq)\n apply blast\n done\nqed\n\nlemma SpecAnno':\n \"\\P \\ {s. \\ Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\n\nlemma SpecAnnoNoAbrupt:\n \"\\P \\ {s. \\ Z. s\\P' Z \\\n (\\t. t \\ Q' Z \\ t \\ Q)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\ Q \\ \\,\\\\\\<^bsub>/F\\<^esub> P Skip Q,A\"\n by (rule hoarep.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\ {s. (f s) \\ Q} \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n by (rule hoarep.Basic [THEN conseqPre])\n\nlemma BasicCond:\n \"\\P \\ {s. (b s \\ f s\\Q) \\ (\\ b s \\ g s\\Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Basic (\\s. if b s then f s else g s) Q,A\"\n apply (rule Basic)\n apply auto\n done\n\nlemma Spec: \"P \\ {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)}\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoarep.Spec [THEN conseqPre])\n\nlemma SpecIf:\n \"\\P \\ {s. (b s \\ f s \\ Q) \\ (\\ b s \\ g s \\ Q \\ h s \\ Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n apply (rule Spec)\n apply (auto simp add: if_rel_def)\n done\n\n\nlemma Seq [trans, intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (rule hoarep.Seq)\n\nlemma SeqSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c1 R,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c1 c2) Q,A\"\n by (rule Seq)\n\nlemma BSeq:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (unfold bseq_def) (rule Seq)\n\n\nlemma Cond:\n assumes wp: \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoarep.Cond [THEN conseqPre])\n from deriv_c1\n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ b) c\\<^sub>1 Q,A\"\n by (rule conseqPre) blast\nnext\n from deriv_c2\n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ - b) c\\<^sub>2 Q,A\"\n by (rule conseqPre) blast\nnext\n show \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" by (rule wp)\nqed\n\n\nlemma CondSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A; P \\ {s. (s\\b \\ s\\P1) \\ (s\\b \\ s\\P2)}\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond)\n\nlemma Cond':\n \"\\P \\ {s. (b \\ P1) \\ (- b \\ P2)};\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule CondSwap) blast+\n\nlemma CondInv:\n assumes wp: \"P \\ Q\"\n assumes inv: \"Q \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from wp inv\n have \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n by blast\n from Cond [OF this deriv_c1 deriv_c2]\n show ?thesis .\nqed\n\nlemma CondInv':\n assumes wp: \"P \\ I\"\n assumes inv: \"I \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n assumes wp': \"I \\ Q\"\n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\"\n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from CondInv [OF wp inv deriv_c1 deriv_c2]\n have \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\".\n from conseqPost [OF this wp' subset_refl]\n show ?thesis .\nqed\n\n\nlemma switchNil:\n \"P \\ Q \\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n by (simp add: Skip)\n\nlemma switchCons:\n \"\\P \\ {s. (v s \\ V \\ s \\ P\\<^sub>1) \\ (v s \\ V \\ s \\ P\\<^sub>2)};\n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n by (simp add: Cond)\n\nlemma Guard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guard)\n\nlemma Guarantee:\n \"\\P \\ {s. s \\ g \\ s \\ R}; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\ g \\ s \\ R}\"])\napply assumption\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ {s. s \\ g \\ s \\ R}; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guarantee)\n\nlemma GuardStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule Guard)\n\n\nlemma GuaranteeAsGuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While:\n assumes P_I: \"P \\ I\"\n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> (I \\ b) c I,A\"\n assumes I_Q: \"I \\ -b \\ Q\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n from deriv_body P_I I_Q\n show ?thesis\n apply (simp add: whileAnno_def)\n apply (erule conseqPrePost [OF HoarePartialDef.While])\n apply simp_all\n done\nqed\n\ntext \\@{term \"J\"} will be instantiated by tactic with @{term \"gs' \\ I\"} for\n those guards that are not stripped.\\\nlemma WhileAnnoG:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs\n (whileAnno b J V (Seq c (guards gs Skip)))) Q,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n by (simp add: whileAnnoG_def whileAnno_def while_def)\n\n\ntext \\This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"}\\\n\n\n\n\n\nlemma WhileAnnoFix':\nassumes consequence: \"P \\ {s. (\\ Z. s\\I Z \\\n (\\t. t \\ I Z \\ -b \\ t \\ Q)) }\"\nassumes bdy: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (I Z \\ b) (c Z) (I Z),A\"\nassumes bdy_constant: \"\\Z. c Z = c undefined\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoFix b I V c) Q,A\"\n apply (rule WhileAnnoFix [OF _ bdy bdy_constant])\n using consequence by blast\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs\n (whileAnnoFix b J V (\\Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n using whileAnnoFix\n by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n assumes adapt: \"P \\ {s. s \\ P' s}\"\n assumes c: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (bind e c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P' Z}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\napply (rule allI)\napply (unfold bind_def)\napply (rule DynCom)\napply (rule ballI)\napply simp\napply (rule conseqPre)\napply (rule c [rule_format])\napply blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ init s \\ P' Z}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ R Z t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return Z t \\ R Z t}\" and\n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule bdy [rule_format])\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma BlockSwap:\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\nusing adapt bdy c\n by (rule Block)\n\n\nlemma BlockSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes bdy: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\" and Q'=\"\\Z. Q\" and\nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ R s t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return s t \\ R s t}\" and\n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule conseq [OF bdy])\napply clarsimp\napply blast\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma Throw: \"P \\ A \\ \\,\\\\\\<^bsub>/F\\<^esub> P Throw Q,A\"\n by (rule hoarep.Throw [THEN conseqPre])\n\nlemmas Catch = hoarep.Catch\nlemma CatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoarep.Catch)\n\nlemma raise: \"P \\ {s. f s \\ A} \\ \\,\\\\\\<^bsub>/F\\<^esub> P raise f Q,A\"\n apply (simp add: raise_def)\n apply (rule Seq)\n apply (rule Basic)\n apply (assumption)\n apply (rule Throw)\n apply (rule subset_refl)\n done\n\nlemma condCatch: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A));\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n apply (simp add: condCatch_def)\n apply (rule Catch)\n apply assumption\n apply (rule CondSwap)\n apply (assumption)\n apply (rule hoarep.Throw)\n apply blast\n done\n\nlemma condCatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A;\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A))\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n by (rule condCatch)\n\n\nlemma ProcSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def)\nby (rule BlockSpec)\n\nlemma ProcSpec':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\nlemma ProcSpecNoAbrupt:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall:\n\"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return (\\s t. c (result t))) Q,A\n\\ \\,\\\\\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n by (simp add: fcall_def)\n\n\nlemma ProcRec:\n assumes deriv_bodies:\n \"\\p\\Procs.\n \\Z. \\,\\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n by (intro strip)\n (rule CallRec'\n [OF _ Procs_defined deriv_bodies],\n simp_all)\n\nlemma ProcRec':\n assumes ctxt: \"\\' = \\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\"\n assumes deriv_bodies:\n \"\\p\\Procs. \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using ctxt deriv_bodies\n apply simp\n apply (erule ProcRec [OF _ Procs_defined])\n done\n\n\nlemma ProcRecList:\n assumes deriv_bodies:\n \"\\p\\set Procs.\n \\Z. \\,\\\\(\\p\\set Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes dist: \"distinct Procs\"\n assumes Procs_defined: \"set Procs \\ dom \\\"\n shows \"\\p\\set Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using deriv_bodies Procs_defined\n by (rule ProcRec)\n\nlemma ProcRecSpecs:\n \"\\\\(P,p,Q,A) \\ Specs. \\,\\\\Specs\\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\\\\n \\ \\(P,p,Q,A) \\ Specs. \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (auto intro: CallRec)\ndone\n\n\nlemma ProcRec1:\n assumes deriv_body:\n \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n from deriv_body p_defined\n have \"\\p\\{p}. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n by - (rule ProcRec [where A=\"\\p. A\" and P=\"\\p. P\" and Q=\"\\p. Q\"],\n simp_all)\n thus ?thesis\n by simp\nqed\n\nlemma ProcNoRec1:\n assumes deriv_body:\n \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_def: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\nfrom deriv_body\n have \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\n \\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: hoare_augment_context)\n from this p_def\n show ?thesis\n by (rule ProcRec1)\nqed\n\nlemma ProcBody:\n assumes WP: \"P \\ P'\"\n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> P' body Q,A\"\n assumes body: \"\\ p = Some body\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\Z. P'\" and Q=\"\\Z. Q\" and A=\"\\Z. A\"])\napply (insert body)\napply simp\napply (rule hoare_augment_context [OF deriv_body])\napply blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\ p = Some body\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\=\\, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoarePartialProps.ProcModifyReturn\nlemmas ProcModifyReturnSameFaults = HoarePartialProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\nlemma ProcModifyReturnNoAbrSameFaults:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P}\"\n and Q'=\"\\Z. Q\" and A'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule DynCom)\napply clarsimp\napply (rule DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply (rule CatchSwap)\napply (rule SeqSwap)\napply (rule Throw)\napply (rule subset_refl)\napply (rule Basic)\napply (rule subset_refl)\napply (rule_tac R=\"{i. i \\ P' Z Z'}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply clarsimp\napply simp\napply clarsimp\napply (rule_tac P'=\"\\Z''. {t. t=Z'' \\ return Z t \\ R Z t}\" and\n Q'=\"\\Z''. Q\" and A'=\"\\Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply clarsimp\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t \\ Q' s Z. return s t \\ R s t) \\\n (\\t \\ A' s Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n from adapt have \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n by blast\n from this c p show ?thesis\n by (rule DynProc)\nqed\n\n\nlemma DynProcStaticSpec:\nassumes adapt: \"P \\ {s. s \\ S \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\s\\S. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from adapt have P_S: \"P \\ S\"\n by blast\n have \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ S) (dynCall init p return c) Q,A\"\n apply (rule DynProc [where P'=\"\\s Z. P' Z\" and Q'=\"\\s Z. Q' Z\"\n and A'=\"\\s Z. A' Z\", OF _ c])\n apply clarsimp\n apply (frule in_mono [rule_format, OF adapt])\n apply clarsimp\n using spec\n apply clarsimp\n done\n thus ?thesis\n by (rule conseqPre) (insert P_S,blast)\nqed\n\n\nlemma DynProcProcPar:\nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n using spec\n apply simp\n done\n\n\nlemma DynProcProcParNoAbrupt:\nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\\n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n have \"P \\ {s. p s = q \\ (\\ Z. init s \\ P' Z \\\n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ {} \\ return s t \\ A))}\"\n (is \"P \\ ?P'\")\n proof\n fix s\n assume P: \"s\\P\"\n with adapt obtain Z where\n Pre: \"p s = q \\ init s \\ P' Z\" and\n adapt_Norm: \"\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\\"\n by blast\n from adapt_Norm\n have \"\\t. t \\ Q' Z \\ return s t \\ R s t\"\n by auto\n then\n show \"s\\?P'\"\n using Pre by blast\n qed\n note P = this\n show ?thesis\n apply -\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n apply (insert spec)\n apply auto\n done\nqed\n\n\nlemma DynProcModifyReturnNoAbr:\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {}\n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturn)\nqed\n\n\nlemma ProcDynModifyReturnNoAbrSameFaults:\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {}\n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturnSameFaults)\nqed\n\n\nlemma ProcProcParModifyReturn:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in\n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n ret_abr_modif\n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturn) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\n\nlemma ProcProcParModifyReturnSameFaults:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in\n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call q (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove\n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n ret_abr_modif\n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\n\nlemma ProcProcParModifyReturnNoAbr:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as\n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\nlemma ProcProcParModifyReturnNoAbrSameFaults:\n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\ \\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as\n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s))\n \\ return' s t = return s t\"\n assumes modif_clause:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have\n \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif\n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre)\nqed\n\nlemma MergeGuards_iff: \"\\,\\\\\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip':\n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n from deriv_strip_triv have deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n by (auto intro: hoare_augment_context)\n from deriv_strip [simplified c'']\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n by (rule MarkGuardsD)\n with deriv\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P c' Q,A\"\n by (rule CombineStrip)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n by (rule MarkGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n by (rule MergeGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n by (simp add: c)\n thus ?thesis\n by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'':\n assumes deriv: \"\\,\\\\\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\n apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c])\n apply (insert c'')\n apply (subgoal_tac \"- {True} = {False}\")\n apply auto\n done\n\nlemma AsmUN:\n \"(\\Z. {(P Z, p, Q Z,A Z)}) \\ \\\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n by (blast intro: hoarep.Asm)\n\nlemma augment_context':\n \"\\\\ \\ \\'; \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\\n \\ \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_augment_context)\n\n\nlemma hoarep_strip:\n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z); F' \\ -F\\ \\\n \\Z. strip F' \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_strip_\\)\n\nlemma augment_emptyFaults:\n \"\\\\Z. \\,{}\\\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\ \\\n \\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \\\n \\Z. \\,{}\\\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI)\n\nlemma PostConjI' :\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\\n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]:\n assumes conj: \"\\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n assumes E: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ S\"\n shows \"S\"\nproof -\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n moreover\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n ultimately show \"S\"\n by (rule E)\nqed\n\n\nsubsection \\Rules for Single-Step Proof \\label{sec:hoare-isar}\\\n\ntext \\\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar.\n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates. Reversed order is supported as well.\n\\\n\nlemma annotateI [trans]:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A; c = anno\\ \\ \\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\"\n by simp\n\nlemma annotate_normI:\n assumes deriv_anno: \"\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A\"\n assumes norm_eq: \"normalize c = normalize anno\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n from NormalizeI [OF deriv_anno] norm_eq\n have \"\\,\\\\\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n by simp\n from NormalizeD [OF this]\n show ?thesis .\nqed\n\nlemma annotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\ P \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P' c Q,A\"\n by (rule conseqPre)\n\nlemma [trans]: \"Q \\ Q' \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q',A\"\n by (rule conseqPost) blast+\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ (\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"(\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ (\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [trans]:\n \"(\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [intro?]: \"\\,\\\\\\<^bsub>/F\\<^esub> P Skip P,A\"\n by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond) auto\n\nlemma CondConj [trans, intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ \\ b s} c2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n by (rule Cond) auto\n\nlemma WhileInvInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b P V c) (P \\ -b),A\"\n by (rule While) auto\n\nlemma WhileInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b {s. undefined} V c) (P \\ -b),A\"\n by (unfold whileAnno_def)\n (rule HoarePartialDef.While [THEN conseqPrePost],auto)\n\nlemma WhileInvConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. P s} V c) {s. P s \\ \\ b s},A\"\n by (simp add: While Collect_conj_eq Collect_neg_eq)\n\nlemma WhileConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\\n\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. undefined} V c) {s. P s \\ \\ b s},A\"\n by (unfold whileAnno_def)\n (simp add: HoarePartialDef.While [THEN conseqPrePost]\n Collect_conj_eq Collect_neg_eq)\n\n(* FIXME: Add rules for guarded while *)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/HoarePartial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.267921880628352}} {"text": "(* Title: Examples/Vector_Spaces/VS_Prerequisites.thy\n Author: Mihails Milehins\n Copyright 2021 (C) Mihails Milehins\n*)\nchapter\\TTS Vector Spaces\\\ntheory VS_Prerequisites\n imports Types_To_Sets_Extension.ETTS_Auxiliary\nbegin\n\n\n\n\nsection\\Introduction\\\n\n\n\nsubsection\\Background\\\n\n\ntext\\\nThe content of this chapter is an adoption of the applied relativization\nstudy presented in \\<^cite>\\\"immler_smooth_2019\"\\ to the ETTS. \nThe content of this chapter incorporates \nmany elements of the content of the aforementioned relativization study without \nan explicit reference. Nonetheless, no attempt was made to ensure that\nthe theorems obtained as a result of this work are identical to the theorems \nobtained in \\<^cite>\\\"immler_smooth_2019\"\\. \n\\\n\n\n\nsubsection\\Prerequisites\\\n\nctr parametricity\n in bij_betw_ow: bij_betw_def\n\nlemma bij_betw_parametric'[transfer_rule]:\n includes lifting_syntax\n assumes \"bi_unique A\"\n shows \"((A ===> A) ===> rel_set A ===> rel_set A ===> (=)) \n bij_betw bij_betw\"\n by (rule bij_betw_ow.transfer[OF assms assms])\n\nlemma vimage_transfer[transfer_rule]: \n includes lifting_syntax\n assumes [transfer_rule]: \"bi_unique B\" \"right_total A\" \n shows \n \"((A ===> B) ===> (rel_set B) ===> rel_set A) \n (\\f s. (vimage f s) \\ (Collect (Domainp A))) (-`)\"\n by transfer_prover\n\nlemma Eps_unique_transfer_lemma:\n includes lifting_syntax\n assumes [transfer_rule]: \n \"right_total A\" \"(A ===> (=)) f g\" \"(A ===> (=)) f' g'\"\n and holds: \"\\x. Domainp A x \\ f x\"\n and unique_g: \"\\x y. \\ g x; g y \\ \\ g' x = g' y\"\n shows \"f' (Eps (\\x. Domainp A x \\ f x)) = g' (Eps g)\"\nproof -\n define Epsg where \"Epsg = Eps g\"\n have \"\\x. g x\" by transfer (simp add: holds)\n then have \"g Epsg\" unfolding Epsg_def by (rule someI_ex)\n obtain x where x[transfer_rule]: \"A x Epsg\" \n by (meson \\right_total A\\ right_totalE)\n then have \"Domainp A x\" by auto\n from \\g Epsg\\[untransferred] have \"f x\" .\n from unique_g have unique:\n \"\\x y. \\ Domainp A x; Domainp A y; f x; f y \\ \\ f' x = f' y\"\n by transfer\n have \"f' (Eps (\\x. Domainp A x \\ f x)) = f' x\"\n by (rule unique[OF _ \\Domainp A x\\ _ \\f x\\]) \n (metis (mono_tags, lifting) local.holds someI_ex)+\n show \"f' (SOME x. Domainp A x \\ f x) = g' (Eps g)\"\n using x \\f' (Eps _) = f' x\\ Epsg_def rel_funE assms(3) by fastforce\nqed\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Types_To_Sets_Extension/Examples/Vector_Spaces/VS_Prerequisites.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2678755402412479}} {"text": "section Parser\ntheory IpRoute_Parser\nimports Routing_Table \n IP_Addresses.IP_Address_Parser\nkeywords \"parse_ip_route\" \"parse_ip_6_route\" :: thy_decl\nbegin\ntext\\This helps to read the output of the \\texttt{ip route} command into a @{typ \"32 routing_rule list\"}.\\\n\ndefinition empty_rr_hlp :: \"('a::len) prefix_match \\ 'a routing_rule\" where\n \"empty_rr_hlp pm = routing_rule.make pm default_metric (routing_action.make '''' None)\"\n\nlemma empty_rr_hlp_alt:\n \"empty_rr_hlp pm = \\ routing_match = pm, metric = 0, routing_action = \\output_iface = [], next_hop = None\\\\\"\n unfolding empty_rr_hlp_def routing_rule.defs default_metric_def routing_action.defs ..\n\ndefinition routing_action_next_hop_update :: \"'a word \\ 'a routing_rule \\ ('a::len) routing_rule\"\n where\n \"routing_action_next_hop_update h pk = pk\\ routing_action := (routing_action pk)\\ next_hop := Some h\\ \\\"\nlemma \"routing_action_next_hop_update h pk = routing_action_update (next_hop_update (\\_. (Some h))) (pk::32 routing_rule)\"\n by(simp add: routing_action_next_hop_update_def)\n\ndefinition routing_action_oiface_update :: \"string \\ 'a routing_rule \\ ('a::len) routing_rule\"\n where\n \"routing_action_oiface_update h pk = routing_action_update (output_iface_update (\\_. h)) (pk::'a routing_rule)\"\nlemma \"routing_action_oiface_update h pk = pk\\ routing_action := (routing_action pk)\\ output_iface := h\\ \\\"\n by(simp add: routing_action_oiface_update_def)\n\n(* Could be moved to Bitmagic *)\ndefinition \"default_prefix = PrefixMatch 0 0\"\nlemma default_prefix_matchall: \"prefix_match_semantics default_prefix ip\"\n unfolding default_prefix_def by (simp add: valid_prefix_00 zero_prefix_match_all)\n\ndefinition \"sanity_ip_route (r::('a::len) prefix_routing) \\ correct_routing r \\ unambiguous_routing r \\ list_all ((\\) '''' \\ routing_oiface) r\"\ntext\\The parser ensures that @{const sanity_ip_route} holds for any ruleset that is imported.\\\n\n(* Hide all the ugly ml in a file with the right extension *)\n(*Depends on the function parser_ipv4 from IP_Address_Parser*)\nML_file \\IpRoute_Parser.ml\\\n \nML\\\n Outer_Syntax.local_theory @{command_keyword parse_ip_route}\n \"Load a file generated by ip route and make the routing table definition available as isabelle term\"\n (Parse.binding --| @{keyword \"=\"} -- Parse.string >> register_ip_route 32)\n\\\n\nML\\\n Outer_Syntax.local_theory @{command_keyword parse_ip_6_route}\n \"Load a file generated by ip -6 route and make the routing table definition available as isabelle term\"\n (Parse.binding --| @{keyword \"=\"} -- Parse.string >> register_ip_route 128)\n\\\n\nparse_ip_route \"rtbl_parser_test1\" = \"ip-route-ex\"\nlemma \"sanity_ip_route rtbl_parser_test1\" by eval (* checked by parse_ip_route alread *)\n\nlemma \"rtbl_parser_test1 =\n [\\routing_match = PrefixMatch 0xFFFFFF00 32, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = None\\\\,\n \\routing_match = PrefixMatch 0xA0D2AA0 28, metric = 303, routing_action = \\output_iface = ''ewlan'', next_hop = None\\\\,\n \\routing_match = PrefixMatch 0xA0D2500 24, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = Some 0xFFFFFF00\\\\,\n \\routing_match = PrefixMatch 0xA0D2C00 24, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = Some 0xFFFFFF00\\\\,\n \\routing_match = PrefixMatch 0 0, metric = 303, routing_action = \\output_iface = ''ewlan'', next_hop = Some 0xA0D2AA1\\\\]\"\nby eval\n\nparse_ip_6_route \"rtbl_parser_test2\" = \"ip-6-route-ex\"\nvalue[code] rtbl_parser_test2\nlemma \"sanity_ip_route rtbl_parser_test2\" by eval\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Routing/IpRoute_Parser.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2678428837907652}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_lemma_inv__2_on_rules imports n_mutualExOnI_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514777, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.26781820851068305}} {"text": "section \\Introduction\\\n(*<*) \ntheory Lam_ml\nimports \"HOL-Nominal.Nominal\" \"HOL-Library.LaTeXsugar\"\nbegin (*>*)\ntext_raw \\\\label{chap:formal}\\\n\ntext \\This article contains a formalization of the strong normalization\ntheorem for the $\\lambda_{ml}$-calculus. The formalization is based on a proof\nby Lindley and Stark \\cite{TT-lifting}. An informal description of the\nformalization can be found in \\cite{Doczkal:09}.\n\nThis formalization extends the example proof of strong normalization for the\nsimply-typed $\\lambda$-calculus, which is included in the Isabelle distribution\n\\cite{SN.thy}. The parts of the original proof which have been left unchanged\nare not displayed in this document.\n\nThe next section deals with the formalization of syntax, typing, and\nsubstitution. Section~\\ref{sec:reduction} contains the formalization of the\nreduction relation. Section~\\ref{sec:stacks} defines stacks which are used to\ndefine the reducibility relation in Section~\\ref{sec:reducibility-formal}. The\nfollowing sections contain proofs about the reducibility relation, ending with\nthe normalization theorem in Section~\\ref{sec:FTLR}.\\\n\nsection \\The Calculus\\\ntext_raw \\\\label{sec:calc}\\\n\natom_decl name\n\nnominal_datatype trm = \n Var \"name\" \n | App \"trm\" \"trm\"\n | Lam \"\\name\\trm\" (\"\\ _ . _\" [0,120] 120)\n | To \"trm\" \"\\name\\trm\" (\"_ to _ in _\" [141,0,140] 140) \n | Ret \"trm\" (\"[_]\")\n\n\ndeclare trm.inject[simp]\nlemmas name_swap_bij = pt_swap_bij''[OF pt_name_inst at_name_inst]\nlemmas ex_fresh = exists_fresh'[OF fin_supp]\n\nlemma alpha'' :\n fixes x y :: name and t::trm\n assumes a: \"x \\ t\"\n shows \"[y].t = [x].([(y,x)] \\ t)\"\nproof -\n from a have aux: \"y \\ [(y, x)] \\ t\"\n by (subst fresh_bij[THEN sym, of _ _ \"[(x,y)]\"]) \n (auto simp add: perm_swap calc_atm)\n thus ?thesis \n by(auto simp add: alpha perm_swap name_swap_bij fresh_bij)\nqed\n\ntext \\Even though our types do not involve binders, we still need to formalize\nthem as nominal datatypes to obtain a permutation action. This is required to\nestablish equivariance of the typing relation.\\\n\nnominal_datatype ty =\n TBase\n | TFun \"ty\" \"ty\" (infix \"\\\" 200)\n | T \"ty\" \n\ntext\\Since we cannot use typed variables, we have to formalize typing\ncontexts. Typing contexts are formalized as lists. A context is \\textit{valid}\nif no name occurs twice.\\\n\ninductive \n valid :: \"(name\\ty) list \\ bool\"\nwhere\n v1[intro]: \"valid []\"\n| v2[intro]: \"\\valid \\;x\\\\\\\\ valid ((x,\\)#\\)\"\nequivariance valid \n\nlemma fresh_ty: \n fixes x :: name and \\::ty\n shows \"x \\ \\\"\nby (induct \\ rule: ty.induct) (auto)\n\nlemma fresh_context: \n fixes \\ :: \"(name\\ty)list\"\n assumes a: \"x \\ \\\"\n shows \"\\(\\ \\ . (x,\\)\\set \\)\"\nusing a\nby (induct \\) (auto simp add: fresh_prod fresh_list_cons fresh_atm)\n\ninductive \n typing :: \"(name\\ty) list\\trm\\ty\\bool\" (\"_ \\ _ : _\" [60,60,60] 60)\nwhere\n t1[intro]: \"\\valid \\; (x,\\)\\set \\\\ \\ \\ \\ Var x : \\\"\n| t2[intro]: \"\\\\ \\ s : \\\\\\; \\ \\ t : \\\\ \\ \\ \\ App s t : \\\"\n| t3[intro]: \"\\x \\ \\; ((x,\\)#\\) \\ t : \\\\ \\ \\ \\ \\ x . t : \\\\\\\" \n| t4[intro]: \"\\ \\ \\ s : \\ \\ \\ \\ \\ [s] : T \\\" \n| t5[intro]: \"\\x \\ (\\,s); \\ \\ s : T \\ ; ((x,\\)#\\) \\ t : T \\ \\ \n \\ \\ \\ s to x in t : T \\\" \nequivariance typing\nnominal_inductive typing \n by(simp_all add: abs_fresh fresh_ty)\n\ntext \\Except for the explicit requirement that contexts be valid in the\nvariable case and the freshness requirements in \\isa{t3} and \\isa{t5}, this\ntyping\nrelation is a direct translation of the original typing relation in\n\\cite{TT-lifting} to Curry-style typing.\\\n\nfun\n lookup :: \"(name\\trm) list \\ name \\ trm\" \nwhere\n \"lookup [] x = Var x\"\n| \"lookup ((y,e)#\\) x = (if x=y then e else lookup \\ x)\"\n\nlemma lookup_eqvt[eqvt]:\n fixes pi::\"name prm\"\n and \\::\"(name\\trm) list\"\n and x::\"name\"\n shows \"pi \\ (lookup \\ x) = lookup (pi \\ \\) (pi \\ x)\"\nby (induct \\) (auto simp add: eqvts)\n\nnominal_primrec\n psubst :: \"(name\\trm) list \\ trm \\ trm\" (\"_<_>\" [95,95] 205)\nwhere \n \"\\ = lookup \\ x\"\n | \"\\ = App (\\) (\\)\"\n | \"x \\ \\ \\ \\<\\ x .s> = \\ x . (\\)\"\n | \"\\<[t]> = [\\]\"\n | \"\\ x \\ \\ ; x \\ t \\ \\ \\ = (\\) to x in (\\)\"\nby(finite_guess+ , (simp add: abs_fresh)+ , fresh_guess+)\n\nlemma psubst_eqvt[eqvt]:\n fixes pi::\"name prm\"\n shows \"pi \\ (\\) = (pi \\ \\)<(pi \\ t)>\"\nby(nominal_induct t avoiding: \\ rule:trm.strong_induct)\n (auto simp add: eqvts fresh_bij)\n\nabbreviation \n subst :: \"trm \\ name \\ trm \\ trm\" (\"_[_::=_]\" [200,100,100] 200)\nwhere \n \"t[x::=t'] \\ ([(x,t')])\"\n\nlemma subst[simp]:\nshows \"(Var x)[y::=v] = (if x = y then v else Var x)\"\n and \"(App s t)[y::=v] = App (s[y::=v]) (t[y::=v])\"\n and \"x \\ (y,v) \\ (\\ x . t)[y::=v] = \\ x .t[y::=v]\"\n and \"x \\ (s,y,v) \\ (s to x in t)[y::=v] = s[y::=v] to x in t[y::=v]\"\n and \"([s])[y::=v] = [s[y::=v]]\"\nby(simp_all add: fresh_list_cons fresh_list_nil)\n\nlemma subst_rename: \n assumes a: \"y \\ t\"\n shows \"([(y,x)]\\t)[y::=v] = t[x::=v]\"\nusing a\nby(nominal_induct t avoiding: x y v rule: trm.strong_induct)\n (auto simp add: calc_atm fresh_atm abs_fresh fresh_prod fresh_aux)\nlemmas subst_rename' = subst_rename[THEN sym]\n\nlemma forget: \"x \\ t \\ t[x::=v] = t\"\nby(nominal_induct t avoiding: x v rule: trm.strong_induct)\n (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact: \n fixes x::\"name\"\n assumes x: \"x \\ v\" \"x \\ t\"\n shows \"x \\ t[y::=v]\"\nusing x\nby(nominal_induct t avoiding: x y v rule: trm.strong_induct)\n (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact': \n fixes x::\"name\"\n assumes x: \"x \\ v\"\n shows \"x \\ t[x::=v]\"\nusing x\nby(nominal_induct t avoiding: x v rule: trm.strong_induct)\n (auto simp add: abs_fresh fresh_atm)\n\nlemma subst_lemma: \n assumes a: \"x\\y\"\n and b: \"x \\ u\"\n shows \"s[x::=v][y::=u] = s[y::=u][x::=v[y::=u]]\"\nusing a b\nby(nominal_induct s avoiding: x y u v rule: trm.strong_induct)\n (auto simp add: fresh_fact forget)\n\nlemma id_subs: \n shows \"t[x::=Var x] = t\"\nby(nominal_induct t avoiding: x rule:trm.strong_induct) auto\n\ntext \\In addition to the facts on simple substitution we also need some facts\non parallel substitution. In particular we want to be able to extend a parallel\nsubstitution with a simple one.\\\n\nlemma lookup_fresh:\n fixes z::\"name\"\n assumes \"z\\\\\" \"z\\x\"\n shows \"z\\ lookup \\ x\"\nusing assms \nby(induct rule: lookup.induct) \n (auto simp add: fresh_list_cons)\n\nlemma lookup_fresh':\n assumes a: \"z\\\\\"\n shows \"lookup \\ z = Var z\"\nusing a\nby (induct rule: lookup.induct)\n (auto simp add: fresh_list_cons fresh_prod fresh_atm)\n\nlemma psubst_fresh_fact:\n fixes x :: name\n assumes a: \"x \\ t\" and b: \"x \\ \\\" \n shows \"x \\ \\\"\nusing a b\nby(nominal_induct t avoiding: \\ x rule:trm.strong_induct) \n (auto simp add: lookup_fresh abs_fresh)\n\nlemma psubst_subst:\n assumes a: \"x \\ \\\"\n shows \"\\[x::=s] = ((x,s)#\\)\"\n using a\nby(nominal_induct t avoiding: \\ x s rule: trm.strong_induct)\n (auto simp add: fresh_list_cons fresh_atm forget \n lookup_fresh lookup_fresh' fresh_prod psubst_fresh_fact)\n\nsection \\The Reduction Relation\\\ntext_raw \\\\label{sec:reduction}\\\n\ntext \\With substitution in place, we can now define the reduction relation on\n$\\lambda_{ml}$-terms. To derive strong induction and case rules, all the rules\nmust be vc-compatible (cf. \\cite{nominal-techniques}). This requires some\nadditional freshness conditions. Note that in this particular case the\nadditional freshness conditions only serve the technical purpose of\nautomatically deriving strong reasoning principles. To show that the version\nwith freshness conditions defines the same relation as the one without the\nfreshness conditions, we also state this version and prove equality of the two\nrelations. \n\nThis requires quite some effort and is something that is certainly undesirable\nin nominal reasoning. Unfortunately, handling the reduction rule \\isa{r10} which\nrearranges the binding structure, appeared to be impossible without going\nthrough this.\\\n\n\ninductive std_reduction :: \"trm \\ trm \\ bool\" (\"_ \\ _\" [80,80] 80)\nwhere\n std_r1[intro!]:\"s \\ s' \\ App s t \\ App s' t\"\n| std_r2[intro!]:\"t \\ t' \\ App s t \\ App s t'\"\n| std_r3[intro!]:\"App (\\ x . t) s \\ t[x::=s]\"\n\n| std_r4[intro!]:\"t \\ t' \\ \\ x . t \\ \\ x . t'\"\n| std_r5[intro!]:\"x \\ t \\ \\ x . App t (Var x) \\ t\"\n\n| std_r6[intro!]:\"\\ s \\ s' \\ \\ s to x in t \\ s' to x in t\"\n| std_r7[intro!]:\"\\ t \\ t' \\ \\ s to x in t \\ s to x in t'\"\n| std_r8[intro!]:\"[s] to x in t \\ t[x::=s]\"\n| std_r9[intro!]:\"x \\ s \\ s to x in [Var x] \\ s\"\n| std_r10[intro!]: \"\\ x \\ y; x \\ u\\ \n \\ (s to x in t) to y in u \\ s to x in (t to y in u)\"\n| std_r11[intro!]: \"s \\ s' \\ [s] \\ [s']\"\n\ninductive \n reduction :: \"trm \\ trm \\ bool\" (\"_ \\ _\" [80,80] 80)\nwhere\n r1[intro!]:\"s \\ s' \\ App s t \\ App s' t\"\n| r2[intro!]:\"t \\ t' \\ App s t \\ App s t'\"\n| r3[intro!]:\"x \\ s \\ App (\\ x . t) s \\ t[x::=s]\"\n\n| r4[intro!]:\"t \\ t' \\ \\ x . t \\ \\ x . t'\"\n| r5[intro!]:\"x \\ t \\ \\ x . App t (Var x) \\ t\"\n\n| r6[intro!]:\"\\ x \\ (s,s') ; s \\ s' \\ \\ s to x in t \\ s' to x in t\"\n| r7[intro!]:\"\\ x \\ s ; t \\ t' \\ \\ s to x in t \\ s to x in t'\"\n| r8[intro!]:\"x \\ s \\ [s] to x in t \\ t[x::=s]\"\n| r9[intro!]:\"x \\ s \\ s to x in [Var x] \\ s\"\n| r10[intro!]: \"\\ x \\ (y,s,u) ; y \\ (s,t) \\ \n \\ (s to x in t) to y in u \\ s to x in (t to y in u)\"\n| r11[intro!]: \"s \\ s' \\ [s] \\ [s']\" \nequivariance reduction\nnominal_inductive reduction\n by(auto simp add: abs_fresh fresh_fact' fresh_prod fresh_atm)\n\n\ntext \\In order to show adequacy, the extra freshness conditions in the rules\n\\isa{r3}, \\isa{r6}, \\isa{r7}, \\isa{r8}, \\isa{r9}, and \\isa{r10} need to be\ndischarged.\\\n\ntext_raw \\\\label{pg:alpha-begin}\\\n\nlemma r3'[intro!]: \"App (\\ x . t) s \\ t[x::=s]\"\nproof -\n obtain x'::name where s: \"x' \\ s\" and t: \"x' \\ t\"\n using ex_fresh[of \"(s,t)\"] by (auto simp add: fresh_prod)\n from t have \"App (\\ x . t) s = App (\\ x' . ([(x,x')] \\ t)) s\" \n by (simp add: alpha'')\n also from s have \"\\ \\ ([(x, x')] \\ t)[x'::=s]\" ..\n also have \"\\ = t[x::=s]\" using t \n by (auto simp add: subst_rename') (metis perm_swap)\n finally show ?thesis .\nqed \ndeclare r3[rule del]\n\n\nlemma r6'[intro]:\n fixes s :: trm \n assumes r: \"s \\ s'\"\n shows \"s to x in t \\ s' to x in t\"\nusing assms\nproof -\n obtain x'::name where s: \"x' \\ (s, s')\" and t: \"x' \\ t\"\n using ex_fresh[of \"(s,s',t)\"] by (auto simp add: fresh_prod)\n from t have \"s to x in t = s to x' in ([(x,x')] \\ t)\"\n by (simp add: alpha'')\n also from s r have \"\\ \\ s' to x' in ([(x, x')] \\ t)\" ..\n also from t have \"\\ = s' to x in t\"\n by (simp add: alpha'')\n finally show ?thesis .\nqed\ndeclare r6[rule del]\n\nlemma r7'[intro]: \n fixes t :: trm\n assumes \"t \\ t'\"\n shows \"s to x in t \\ s to x in t'\"\nusing assms\nproof -\n obtain x'::name where f: \"x' \\ t\" \"x' \\ t'\" \"x' \\ s\" \"x' \\ x\" \n using ex_fresh[of \"(t,t',s,x)\"] by(auto simp add:fresh_prod)\n hence a: \"s to x in t = s to x' in ([(x,x')] \\ t)\" \n by (auto simp add: alpha'')\n from assms have \"([(x,x')] \\ t) \\ [(x,x')] \\ t'\" \n by (simp add: eqvts)\n hence r: \"s to x' in ([(x,x')] \\ t) \\ s to x' in ([(x,x')] \\ t')\" \n using f by auto \n from f have \"s to x in t' = s to x' in ([(x,x')] \\ t')\" \n by (auto simp add: alpha'')\n with a r show ?thesis by (simp del: trm.inject)\nqed\ndeclare r7[rule del]\n\nlemma r8'[intro!]: \"[s] to x in t \\ t[x::=s]\"\nproof - \n obtain x'::name where s: \"x' \\ s\" and t: \"x' \\ t\"\n using ex_fresh[of \"(s,t)\"] by (auto simp add: fresh_prod)\n from t have \"[s] to x in t = [s] to x' in ([(x,x')] \\ t)\" \n by (simp add: alpha'')\n also from s have \"\\ \\ ([(x, x')] \\ t)[x'::=s]\" ..\n also have \"\\ = t[x::=s]\" using t \n by (auto simp add: subst_rename') (metis perm_swap)\n finally show ?thesis .\nqed\ndeclare r8[rule del]\n\n\n\ntext \\While discharging these freshness conditions is easy for rules involving\nonly one binder it unfortunately becomes quite tedious for the assoc rule\n\\isa{r10}. This is due to the complex binding structure of this rule which\nincludes \\textit{four} binding occurrences of two different names. Furthermore,\nthe binding structure changes from the left to the right: On the left hand\nside, $x$ is only bound in $t$, whereas on the right hand side the scope of $x$\nextends over the whole term @{term \"(t to y in u)\"}.\\\n\nlemma r10'[intro!]: \n assumes xf: \"x \\ y\" \"x \\ u\"\n shows \"(s to x in t) to y in u \\ s to x in (t to y in u)\"\nproof -\n obtain y'::name \\ \\suitably fresh\\\n where y: \"y' \\ s\" \"y' \\ x\" \"y' \\ t\" \"y' \\ u\" \n using ex_fresh[of \"(s,x,t,u,[(x, x')] \\ t)\"] \n by (auto simp add: fresh_prod)\n obtain x'::name \n where x: \"x' \\ s\" \"x' \\ y'\" \"x' \\ y\" \"x' \\ t\" \"x' \\ u\" \n \"x' \\ ([(y,y')] \\ u)\"\n using ex_fresh[of \"(s,y',y,t,u,([(y,y')] \\ u))\"] \n by (auto simp add: fresh_prod)\n from x y have yaux: \"y' \\ [(x, x')] \\ t\"\n by(simp add: fresh_left perm_fresh_fresh fresh_atm)\n have \"(s to x in t) to y in u = (s to x in t) to y' in ([(y,y')] \\ u)\"\n using \\y' \\ u\\ by (simp add: alpha'')\n also have \"\\ = (s to x' in ([(x,x')] \\ t)) to y' in ([(y,y')] \\ u)\"\n using \\x' \\ t\\ by (simp add: alpha'')\n also have \"\\ \\ s to x' in (([(x,x')] \\ t) to y' in ([(y,y')] \\ u))\"\n using x y yaux by (auto simp add: fresh_prod) \n also have \" \\ = s to x' in (([(x,x')] \\ t) to y in u)\"\n using \\y' \\ u\\ by (simp add: abs_fun_eq1 alpha'')\n also have \"\\ = s to x in (t to y in u)\"\n proof (subst trm.inject)\n from xf x have swap: \"[(x,x')] \\ y = y\" \"[(x,x')] \\ u = u \" \n by(auto simp add: fresh_atm perm_fresh_fresh )\n with x show \"s = s \\ [x'].([(x, x')] \\ t) to y in u = [x].t to y in u\"\n by (auto simp add: alpha''[of x' _ x] abs_fresh abs_fun_eq1 swap)\n qed\n finally show ?thesis .\nqed\ndeclare r10[rule del]\n\ntext_raw \\\\label{pg:alpha-end}\\\n\ntext \\Since now all the introduction rules of the vc-compatible reduction\nrelation exactly match their standard counterparts, both directions of the\nadequacy proof are trivial inductions.\\\n\ntheorem adequacy: \"s \\ t = s \\ t\"\nby (auto elim:reduction.induct std_reduction.induct)\n\ntext \\Next we show that the reduction relation preserves freshness and is in\nturn preserved under substitution.\\\n\nlemma reduction_fresh: \n fixes x::\"name\"\n assumes r: \"t \\ t'\"\n shows \"x \\ t \\ x \\ t'\"\nusing r\nby(nominal_induct t t' avoiding: x rule: reduction.strong_induct)\n (auto simp add: abs_fresh fresh_fact fresh_atm)\n\nlemma reduction_subst:\n assumes a: \" t \\ t' \"\n shows \"t[x::=v] \\ t'[x::=v]\"\nusing a\nby(nominal_induct t t' avoiding: x v rule: reduction.strong_induct)\n (auto simp add: fresh_atm fresh_fact subst_lemma fresh_prod abs_fresh)\n\n\n(*section {* Strong Normalization *}\ntext_raw {* \\label{sec:SN-formal} *} *)\n\ntext \\Following \\cite{SN.thy}, we use an inductive variant of strong\nnormalization, as it allows for inductive proofs on terms being strongly\nnormalizing, without establishing that\nthe reduction relation is finitely branching.\\ \n\n\ninductive \n SN :: \"trm \\ bool\"\nwhere\n SN_intro: \"(\\ t' . t \\ t' \\ SN t') \\ SN t\" \n\n(*\ntext {* It remains to be shown that this definition actually excludes infinite\nsequences of reductions. We define a term $t$ to be diverging, written @{term\n\"DIV t\"}, if there is some infinite sequence $S$ of reductions beginning at\n$t$. *}\n\ndefinition DIV :: \"trm \\ bool\"\nwhere\n \"DIV t \\ \\ (S::nat \\ trm) . t = S 0 \\ (\\ n . S n \\ S (n + 1))\"\n\ntheorem \"SN t \\ \\ DIV t\"\nproof (induct rule:SN.induct)\n case (SN_intro t)\n have ih: \"\\t'. t \\ t' \\ \\ DIV t'\" by fact\n moreover have \"DIV t \\ \\ t' . t \\ t' \\ DIV t'\"\n proof -\n assume \"DIV t\" from this obtain S::\"nat\\trm\" \n where S: \"t = S 0 \\ (\\ n . S n \\ S (n + 1))\"\n unfolding DIV_def .. \n let ?t = \"S 1\" let ?S = \"\\ n . S (n + 1)\"\n from S have \" t \\ ?t\" by auto\n moreover { \n from S have \"?t = ?S 0 \\ (\\ n . ?S n \\ ?S (n + 1))\" by auto\n hence \"DIV ?t\" unfolding DIV_def by auto}\n ultimately show ?thesis by blast\n qed\n ultimately show \"\\ DIV t\" using ih by blast\nqed\n\n\ntheorem \"\\ SN t \\ DIV t\"\nproof -\n fix t assume t: \"\\ SN t\"\n let ?NSN = \"{ t . \\ SN t }\"\n have \"\\ t \\ ?NSN . \\ t' . t \\ t' \\ \\ SN t'\"\n by (auto intro: SN_intro)\n hence \" \\ f . \\ t \\ ?NSN . t \\ f t \\ \\ SN (f t)\"\n by (rule bchoice)\n from this obtain f where f: \"\\ t \\ ?NSN . t \\ f t \\ \\ SN (f t)\" ..\n let ?S = \"\\ n . (f^^n) t\"\n { fix n from t f have \"?S n \\ ?S (n + 1) \\ \\ SN (?S (n + 1))\"\n by (induct n) auto }\n hence \"t = ?S 0 \\ (\\ n . ?S n \\ ?S (n + 1))\" by auto\n thus \"DIV t\" unfolding DIV_def by(rule exI[where x=\"?S\"])\nqed\n\ntext{* For the normalization theorem, we merely need that strong normalization\nis preserved under reduction and some lemmas on normal terms. *}\n*)\n\nlemma SN_preserved[intro]: \n assumes a: \"SN t\" \"t \\ t'\"\n shows \"SN t'\"\nusing a by (cases) (auto)\n\ndefinition \"NORMAL\" :: \"trm \\ bool\"\nwhere\n \"NORMAL t \\ \\(\\t'. t \\ t')\"\n\nlemma normal_var: \"NORMAL (Var x)\"\nunfolding NORMAL_def by (auto elim: reduction.cases)\n\nlemma normal_implies_sn : \"NORMAL s \\ SN s\"\nunfolding NORMAL_def by(auto intro: SN_intro)\n\nsection \\Stacks\\\ntext_raw \\\\label{sec:stacks}\\\n\ntext\\As explained in \\cite{TT-lifting}, the monadic type structure of\nthe $\\lambda_{ml}$-calculus does not lend itself to an easy definition of a\nlogical relation along the type structure of the calculus. Therefore, we need to\nintroduce stacks as an auxiliary notion to handle the monadic type constructor\n$T$. Stacks can be thought of as lists of term abstractions @{term \"[x].t\"}. The\nnotation for stacks is chosen with this resemblance in mind.\\\n\nnominal_datatype stack = Id | St \"\\name\\trm\" \"stack\" (\"[_]_\\_\")\n\nlemma stack_exhaust :\n fixes c :: \"'a::fs_name\"\n shows \"k = Id \\ (\\ y n l . y \\ l \\ y \\ c \\ k = [y]n\\l)\"\nby(nominal_induct k avoiding: c rule: stack.strong_induct) (auto)\n\nnominal_primrec \n length :: \"stack \\ nat\" ( \"|_|\")\nwhere\n \"|Id| = 0\" \n| \"y \\ L \\ length ([y]n\\L) = 1 + |L|\"\nby(finite_guess+,auto simp add: fresh_nat,fresh_guess)\n\n\ntext\\Together with the stack datatype, we introduce the notion of dismantling\na term onto a stack. Unfortunately, the dismantling operation has no easy\nprimitive recursive formulation. The Nominal package, however, only provides a\nrecursion combinator for primitive recursion. This means that for dismantling\none has to prove pattern completeness, right uniqueness, and termination\nexplicitly.\\\n\nfunction\n dismantle :: \"trm \\ stack \\ trm\" (\"_ \\ _\" [160,160] 160)\nwhere\n \"t \\ Id = t\" |\n \"x \\ (K,t) \\ t \\ ([x]s\\K) = (t to x in s) \\ K\"\nproof - \\ \\pattern completeness\\\n fix P :: bool and arg::\"trm \\ stack\"\n assume id: \"\\t. arg = (t, stack.Id) \\ P\"\n and st: \"\\x K t s. \\x \\ (K, t); arg = (t, [x]s\\K)\\ \\ P\"\n { assume \"snd arg = Id\"\n hence P by (metis id[where t=\"fst arg\"] surjective_pairing) }\n moreover \n { fix y n L assume \"snd arg = [y]n\\L\" \"y \\ (L, fst arg)\"\n hence P by (metis st[where t=\"fst arg\"] surjective_pairing) }\n ultimately show P using stack_exhaust[of \"snd arg\" \"fst arg\"] by auto\nnext\n \\ \\right uniqueness\\\n \\ \\only the case of the second equation matching both args needs to be\nshown.\\\n fix t t' :: trm and x x' :: name and s s' :: trm and K K' :: stack\n let ?g = dismantle_sumC \\ \\graph of dismantle\\\n assume \"x \\ (K, t)\" \"x' \\ (K', t')\" \n and \"(t, [x]s\\K) = (t', [x']s'\\K')\"\n thus \"?g (t to x in s, K) = ?g (t' to x' in s', K')\" \n by (auto intro!: arg_cong[where f=\"?g\"] simp add: stack.inject)\nqed (simp_all add: stack.inject) \\ \\all other cases are trivial\\\n\ntermination dismantle\nby(relation \"measure (\\(t,K). |K| )\")(auto)\n\ntext\\Like all our constructions, dismantling is equivariant. Also, freshness\ncan be pushed over dismantling, and the freshness requirement in the second\ndefining equation is not needed\\\n\nlemma dismantle_eqvt[eqvt]:\n fixes pi :: \"(name \\ name) list\"\n shows \"pi \\ (t \\ K) = (pi \\ t) \\ (pi \\ K)\"\nby(nominal_induct K avoiding: pi t rule:stack.strong_induct)\n (auto simp add: eqvts fresh_bij)\n\nlemma dismantle_fresh[iff]:\n fixes x :: name\n shows \"(x \\ (t \\ k)) = (x \\ t \\ x \\ k)\"\nby(nominal_induct k avoiding: t x rule: stack.strong_induct) \n (simp_all)\n\nlemma dismantle_simp[simp]: \"s \\ [y]n\\L = (s to y in n) \\ L\"\nproof - \n obtain x::name where f: \"x \\ s\" \"x \\ L\" \"x \\ n\" \n using ex_fresh[of \"(s,L,n)\"] by(auto simp add:fresh_prod)\n hence t: \"s to y in n = s to x in ([(y,x)] \\ n)\" \n by(auto simp add: alpha'')\n from f have \"[y]n\\L = [x]([(y,x)] \\ n)\\L\" \n by (auto simp add: stack.inject alpha'')\n hence \"s \\ [y]n\\L = s \\ [x]([(y,x)] \\ n)\\L\" by simp\n also have \" \\ = (s to y in n) \\ L\" using f t by(simp del:trm.inject)\n finally show ?thesis .\nqed\n\n\ntext \\We also need a notion of reduction on stacks. This reduction relation\nallows us to define strong normalization not only for terms but also for stacks\nand is needed to prove the properties of the logical relation later on.\\\n\ndefinition stack_reduction :: \"stack \\ stack \\ bool\" (\" _ \\ _ \")\nwhere\n \"k \\ k' \\ \\ (t::trm) . (t \\ k) \\ (t \\ k')\" \n\n\nlemma stack_reduction_fresh:\n fixes k :: stack and x :: name\n assumes r : \"k \\ k'\" and f :\"x \\ k\"\n shows \"x \\ k'\"\nproof -\n from ex_fresh[of x] obtain z::name where f': \"z \\ x\" ..\n from r have \"Var z \\ k \\ Var z \\ k'\" unfolding stack_reduction_def ..\n moreover from f f' have \"x \\ Var z \\ k\" by(auto simp add: fresh_atm)\n ultimately have \"x \\ Var z \\ k'\" by(rule reduction_fresh)\n thus \"x \\ k'\" by simp\nqed\n\nlemma dismantle_red[intro]:\n fixes m :: trm\n assumes r: \" m \\ m'\"\n shows \"m \\ k \\ m' \\ k\"\nusing r\nby (nominal_induct k avoiding: m m' rule:stack.strong_induct) auto\n\n\ntext \\Next we define a substitution operation for stacks. The main purpose of\nthis is to distribute substitution over dismantling.\\\n\nnominal_primrec\n ssubst :: \"name \\ trm \\ stack \\ stack\" \nwhere\n \"ssubst x v Id = Id\"\n | \" y \\ (k,x,v) \\ ssubst x v ([y]n\\k) = [y](n[x::=v])\\(ssubst x v k)\"\nby(finite_guess+ , (simp add: abs_fresh)+ , fresh_guess+)\n\nlemma ssubst_fresh:\n fixes y :: name\n assumes \" y \\ (x,v,k) \"\n shows \"y \\ ssubst x v k\"\nusing assms\nby(nominal_induct k avoiding: y x v rule: stack.strong_induct)\n (auto simp add: fresh_prod fresh_atm abs_fresh fresh_fact)\n\nlemma ssubst_forget: \n fixes x :: name\n assumes \"x \\ k\"\n shows \"ssubst x v k = k\"\nusing assms\nby(nominal_induct k avoiding: x v rule: stack.strong_induct)\n (auto simp add: abs_fresh fresh_atm forget)\n\nlemma subst_dismantle[simp]: \"(t \\ k)[x ::= v] = (t[x::=v]) \\ ssubst x v k\"\nby(nominal_induct k avoiding: t x v rule: stack.strong_induct)\n (auto simp add: ssubst_fresh fresh_prod fresh_fact)\n\nsection \\Reducibility for Terms and Stacks\\\ntext_raw \\\\label{sec:reducibility-formal}\\\n\ntext \\Following \\cite{SN.thy}, we formalize the logical relation as a function\n@{term \"RED\"} of type @{typ \"ty \\ trm set\"} for the term part and accordingly\n@{term SRED} of type @{typ \"ty \\ stack set\"} for the stack part of the logical\nrelation.\\\n\nlemma ty_exhaust: \"ty = TBase \\ (\\ \\ \\ . ty = \\ \\ \\) \\ (\\ \\ . ty = T \\)\"\nby(induct ty rule:ty.induct) (auto)\n\nfunction RED :: \"ty \\ trm set\"\nand SRED :: \"ty \\ stack set\"\nwhere\n \"RED (TBase) = {t. SN(t)}\"\n| \"RED (\\\\\\) = {t. \\ u \\ RED \\ . (App t u) \\ RED \\ }\"\n| \"RED (T \\) = {t. \\ k \\ SRED \\ . SN(t \\ k) }\" \n| \"SRED \\ = {k. \\ t \\ RED \\ . SN ([t] \\ k) }\"\nby(auto simp add: ty.inject, case_tac x rule: sum.exhaust,insert ty_exhaust)\n (blast)+\n\ntext \\This is the second non-primitive function in the formalization. Since\ntypes do not involve binders, pattern completeness and right uniqueness are\nmostly trivial. The termination argument is not as simple as for the dismantling\nfunction, because the definiton of @{term \"SRED \\\"} involves a recursive call to\n@{term \"RED \\\"} without reducing the size of @{term \"\\\"}.\\\n\nnominal_primrec\n tsize :: \"ty \\ nat\"\nwhere\n \"tsize TBase = 1\"\n | \"tsize (\\\\\\) = 1 + tsize \\ + tsize \\\"\n | \"tsize (T \\) = 1 + tsize \\\"\nby (rule TrueI)+\n\ntext \\In the termination argument below, @{term \"Inl \\\"} corresponds to the\ncall @{term \"RED \\\"}, whereas @{term \"Inr \\\"} corresponds to @{term \"SRED \\\"}\n\\\n\ntermination RED\nby(relation \"measure \n (\\ x . case x of Inl \\ \\ 2 * tsize \\ \n | Inr \\ \\ 2 * tsize \\ + 1)\") (auto)\n\nsection \\Properties of the Reducibility Relation\\\n\ntext \\After defining the logical relations we need to prove that the relation\nimplies strong normalization, is preserved under reduction, and satisfies the\nhead expansion property.\\\n\ndefinition NEUT :: \"trm \\ bool\"\nwhere\n \"NEUT t \\ (\\a. t = Var a) \\ (\\t1 t2. t = App t1 t2)\" \n\ndefinition \"CR1\" :: \"ty \\ bool\"\nwhere\n \"CR1 \\ \\ \\t. (t\\RED \\ \\ SN t)\"\n\ndefinition \"CR2\" :: \"ty \\ bool\"\nwhere\n \"CR2 \\ \\ \\t t'. (t\\RED \\ \\ t \\ t') \\ t'\\RED \\\"\n\ndefinition \"CR3_RED\" :: \"trm \\ ty \\ bool\"\nwhere\n \"CR3_RED t \\ \\ \\t'. t \\ t' \\ t'\\RED \\\" \n\ndefinition \"CR3\" :: \"ty \\ bool\"\nwhere\n \"CR3 \\ \\ \\t. (NEUT t \\ CR3_RED t \\) \\ t\\RED \\\"\n \ndefinition \"CR4\" :: \"ty \\ bool\"\nwhere\n \"CR4 \\ \\ \\t. (NEUT t \\ NORMAL t) \\t\\RED \\\"\n\nlemma CR3_implies_CR4[intro]: \"CR3 \\ \\ CR4 \\\"\nby (auto simp add: CR3_def CR3_RED_def CR4_def NORMAL_def)\n\nlemma%invisible sub_induction: \n assumes a: \"SN(u)\"\n and b: \"u\\RED \\\"\n and c1: \"NEUT t\"\n and c2: \"CR2 \\\"\n and c3: \"CR3 \\\"\n and c4: \"CR3_RED t (\\\\\\)\"\n shows \"(App t u)\\RED \\\"\nusing a b\nproof(induct)\n fix u\n assume as: \"u\\RED \\\"\n assume ih: \" \\u'. \\u \\ u'; u' \\ RED \\\\ \\ App t u' \\ RED \\\"\n have \"NEUT (App t u)\" using c1 by (auto simp add: NEUT_def)\n moreover\n have \"CR3_RED (App t u) \\\" unfolding CR3_RED_def\n proof (intro strip)\n fix r\n assume red: \"App t u \\ r\"\n moreover\n { assume \"\\t'. t \\ t' \\ r = App t' u\"\n then obtain t' where a1: \"t \\ t'\" and a2: \"r = App t' u\" by blast\n have \"t'\\RED (\\\\\\)\" using c4 a1 by (simp add: CR3_RED_def)\n then have \"App t' u\\RED \\\" using as by simp\n then have \"r\\RED \\\" using a2 by simp\n }\n moreover\n { assume \"\\u'. u \\ u' \\ r = App t u'\"\n then obtain u' where b1: \"u \\ u'\" and b2: \"r = App t u'\" by blast\n have \"u'\\RED \\\" using as b1 c2 by (auto simp add: CR2_def)\n with ih have \"App t u' \\ RED \\\" using b1 by simp\n then have \"r\\RED \\\" using b2 by simp\n }\n moreover\n { assume \"\\x t'. t = \\ x .t'\"\n then obtain x t' where \"t = \\ x .t'\" by blast\n then have \"NEUT (\\ x .t')\" using c1 by simp\n then have \"False\" by (simp add: NEUT_def)\n then have \"r\\RED \\\" by simp\n }\n ultimately show \"r \\ RED \\\" by (cases) (auto)\n qed\n ultimately show \"App t u \\ RED \\\" using c3 by (simp add: CR3_def)\nqed\n\n\ninductive \n FST :: \"trm\\trm\\bool\" (\" _ \\ _\" [80,80] 80)\nwhere\n fst[intro!]: \"(App t s) \\ t\"\n\nlemma SN_of_FST_of_App: \n assumes a: \"SN (App t s)\"\n shows \"SN t\"\nproof - \n from a have \"\\z. (App t s \\ z) \\ SN z\"\n by (induct rule: SN.induct)\n (blast elim: FST.cases intro: SN_intro)\n then show \"SN t\" by blast\nqed\n\ntext \\The lemma above is a simplified version of the one used in\n\\cite{SN.thy}. Since we have generalized our notion of reduction from terms to\nstacks, we can also generalize the notion of strong normalization. The new\ninduction principle will be used to prove the @{term \"T\"} case of the\nproperties of the reducibility relation.\\\n\ninductive \n SSN :: \"stack \\ bool\"\nwhere\n SSN_intro: \"(\\ k' . k \\ k' \\ SSN k') \\ SSN k\"\n\ntext \\Furthermore, the approach for deriving strong normalization of\nsubterms from above can be generalized to terms of the form @{term \"t \\ k\"}. In\ncontrast to the case of applications, @{term \"t \\ k\"} does \\textit{not} uniquely\ndetermine @{term t} and @{term k}. Thus, the extraction is a proper relation in\nthis case.\\\n\ninductive\n SND_DIS :: \"trm \\ stack \\ bool\" (\"_ \\ _\")\nwhere\n snd_dis[intro!]: \"t \\ k \\ k\"\n\nlemma SN_SSN:\n assumes a: \"SN (t \\ k)\"\n shows \" SSN k\"\nproof - \n from a have \"\\z. (t \\ k \\ z) \\ SSN z\" by (induct rule: SN.induct)\n (metis SND_DIS.cases SSN_intro snd_dis stack_reduction_def)\n thus \"SSN k\" by blast\nqed\n\ntext \\To prove CR1-3, the authors of\n\\cite{TT-lifting} use a case distinction on the reducts of @{term \"t \\ k\"},\nwhere $t$ is a neutral term and therefore no interaction occurs between $t$ and\n$k$.\n\n%auto generated stuff\n\\begin{isamarkuptext}%\n\\renewcommand\\isacharquery{}\n$$\\inferrule{\n \\isa{{\\isacharquery}t\\ {\\isasymstar}\\ {\\isacharquery}k\\ {\\isasymmapsto}\\\n{\\isacharquery}r}\\\\\n \\isa{{\\isasymAnd}t{\\isacharprime}{\\isachardot}\\\n{\\isasymlbrakk}{\\isacharquery}t\\ {\\isasymmapsto}\\\nt{\\isacharprime}{\\isacharsemicolon}\\ {\\isacharquery}r\\ {\\isacharequal}\\\nt{\\isacharprime}\\ {\\isasymstar}\\ {\\isacharquery}k{\\isasymrbrakk}\\\n{\\isasymLongrightarrow}\\ {\\isacharquery}P}\\\\\n \\isa{NEUT\\ {\\isacharquery}t}\\\\\n \\isa{{\\isasymAnd}k{\\isacharprime}{\\isachardot}\\ {\\isasymlbrakk}\\\n{\\isacharquery}k\\ {\\isasymmapsto}\\ k{\\isacharprime}\\ {\\isacharsemicolon}\\\n{\\isacharquery}r\\ {\\isacharequal}\\ {\\isacharquery}t\\ {\\isasymstar}\\\nk{\\isacharprime}{\\isasymrbrakk}\\ {\\isasymLongrightarrow}\\ {\\isacharquery}P}\\\\\n }{\n \\isa{{\\isacharquery}P}}$$%\n\\end{isamarkuptext}%\\\n\ntext \\We strive for a proof of this rule by structural induction on $k$. The\ngeneral idea of the case where @{term \"k = [y]n\\l\"} is to move the first stack\nframe into the term $t$ and then apply the induction hypothesis as a case\nrule. Unfortunately, this term is no longer neutral, so, for the induction to go\nthrough, we need to generalize the claim to also include the possible\ninteractions of non-neutral terms and stacks.\\\n\n\nlemma dismantle_cases:\n fixes t :: trm\n assumes r: \"t \\ k \\ r\"\n and T: \"\\ t' . \\ t \\ t' ; r = t' \\ k \\ \\ P\"\n and K: \"\\ k' . \\ k \\ k' ; r = t \\ k' \\ \\ P\" \n and B: \"\\ s y n l .\\ t = [s] ; k = [y]n\\l ; r = (n[y::=s]) \\ l \\ \\ P\"\n and A: \"\\ u x v y n l.\\ x \\ y; x \\ n ; t = u to x in v ; \n k = [y]n\\l ; r = (u to x in (v to y in n)) \\ l \\ \\ P \"\n shows \"P\"\nusing assms\nproof (nominal_induct k avoiding: t r rule:stack.strong_induct)\n case (St y n L) note yfresh = \\y \\ t\\ \\y \\ r\\ \\y \\ L\\ \n note IH = St(4) \n and T = St(6) and K = St(7) and B = St(8) and A = St(9) \n thus \"P\" proof (cases rule:IH[where b=\"t to y in n\" and ba=\"r\"])\n case (2 r') have red: \"t to y in n \\ r'\" and r: \" r = r' \\ L\" by fact+\ntxt \\If @{term \"m to y in n\"} makes a step we reason by case distinction \non the successors of @{term \"m to y in n\"}. We want to use the strong inversion\nprinciple for the reduction relation. For this we need that $y$ is fresh for\n@{term \"t to y in n\"} and $r'$.\\\n from yfresh r have y: \"y \\ t to y in n\" \"y \\ r'\" \n by (auto simp add: abs_fresh)\n obtain z where z: \"z \\ y\" \"z \\ r'\" \"z \\ t to y in n\" \n using ex_fresh[of \"(y,r',t to y in n)\"] \n by(auto simp add:fresh_prod fresh_atm)\n from red r show \"P\" \n proof (cases rule:reduction.strong_cases\n [ where x=\"y\"and xa=\"y\" and xb=\"y\" and xc=\"y\" and xd=\"y\" \n and xe=\"y\" and xf=\"y\" and xg=\"z\" and y=\"y\"])\n case (r6 s t' u) \\ \\if $t$ makes a step we use assumption T\\\n with y have m: \"t \\ t'\" \"r' = t' to y in n\" by auto\n thus \"P\" using T[of t'] r by auto\n next\n case (r7 _ _ n') with y have n: \"n \\ n'\" and r': \"r' = t to y in n'\"\n by (auto simp add: alpha)\n txt \\Since @{term \"k = [y]n\\L\"}, the reduction @{thm n} occurs within\n the stack $k$. Hence, we need to establish this stack reduction.\\\n have \"[y]n\\L \\ [y]n'\\L\" unfolding stack_reduction_def\n proof \n fix u have \"u to y in n \\ u to y in n'\" using n .. \n hence \"(u to y in n) \\ L \\ (u to y in n') \\ L\" ..\n thus \" u \\ [y]n\\L \\ u \\ [y]n'\\L\" \n by simp\n qed\n moreover have \"r = t \\ [y]n'\\L\" using r r' by simp\n ultimately show \"P\" by (rule K)\n next \n case (r8 s _) \\ \\the case of a $\\beta$-reduction is exactly B\\\n with y have \"t = [s]\" \"r' = n[y::=s]\" by(auto simp add: alpha) \n thus \"P\" using B[of \"s\" \"y\" \"n\" \"L\"] r by auto \n next \n case (r9 _) \\ \\The case of an $\\eta$-reduction is a stack\nreduction as well.\\\n with y have n: \"n = [Var y]\" and r': \"r' = t\" \n by(auto simp add: alpha)\n { fix u have \"u to y in n \\ u\" unfolding n ..\n hence \"(u to y in n) \\ L \\ u \\ L \" ..\n hence \"u \\ [y]n\\L \\ u \\ L\" by simp\n } hence \"[y]n\\L \\ L\" unfolding stack_reduction_def ..\n moreover have \"r = t \\ L\" using r r' by simp\n ultimately show \"P\" by (rule K)\n next\n case (r10 u _ v) \\ \\The assoc case holds by A.\\\n with y z have \n \"t = (u to z in v)\" \n \"r' = u to z in (v to y in n)\" \n \"z \\ (y,n)\" by (auto simp add: fresh_prod alpha)\n thus \"P\" using A[of z y n] r by auto\n qed (insert y, auto) \\ \\No other reductions are possible.\\\n next \n txt \\Next we have to solve the case where a reduction occurs deep within\n$L$. We get a reduction of the stack $k$ by moving the first stack frame\n``[y]n'' back to the right hand side of the dismantling operator.\\\n case (3 L')\n hence L: \"L \\ L'\" and r: \"r = (t to y in n) \\ L'\" by auto\n { fix s from L have \"(s to y in n) \\ L \\ (s to y in n) \\ L'\" \n unfolding stack_reduction_def ..\n hence \"s \\ [y]n\\L \\ s \\ [y]n\\L'\" by simp\n } hence \"[y]n\\L \\ [y]n\\L'\" unfolding stack_reduction_def by auto\n moreover from r have \"r = t \\ [y]n\\L'\" by simp\n ultimately show \"P\" by (rule K) \n next\n case (5 x z n' s v K) \\ \\The ``assoc'' case is again a stack reduction\\\n have xf: \"x \\ z\" \"x \\ n'\" \n \\ \\We get the following equalities\\\n and red: \"t to y in n = s to x in v\"\n \"L = [z]n'\\K\"\n \"r = (s to x in v to z in n') \\ K\" by fact+\n { fix u from red have \"u \\ [y]n\\L = ((u to x in v) to z in n') \\ K \"\n by(auto intro: arg_cong[where f=\"\\ x . x \\ K\"])\n moreover \n { from xf have \"(u to x in v) to z in n' \\ u to x in (v to z in n')\" ..\n hence \"((u to x in v) to z in n') \\ K \\ (u to x in (v to z in n')) \\ K\"\n by rule \n } ultimately have \"u \\ [y]n\\L \\ (u to x in (v to z in n')) \\ K\" \n by (simp (no_asm_simp) del:dismantle_simp)\n hence \"u \\ [y]n\\L \\ u \\ [x](v to z in n')\\K\" by simp\n } hence \"[y]n\\L \\ [x](v to z in n')\\ K\" \n unfolding stack_reduction_def by simp\n moreover have \"r = t \\ ([x](v to z in n')\\K)\" using red \n by (auto)\n ultimately show \"P\" by (rule K)\n qed (insert St, auto )\nqed auto\n\ntext \\Now that we have established the general claim, we can restrict $t$ to\nneutral terms only and drop the cases dealing with possible interactions.\\\n\nlemma dismantle_cases'[consumes 2, case_names T K]:\n fixes m :: trm\n assumes r: \"t \\ k \\ r\"\n and \"NEUT t\"\n and \"\\ t' . \\ t \\ t' ; r = t' \\ k \\ \\ P\"\n and \"\\ k' . \\ k \\ k' ; r = t \\ k' \\ \\ P\" \n shows \"P\" \nusing assms unfolding NEUT_def\nby (cases rule: dismantle_cases[of t k r]) (auto) \n\nlemma red_Ret:\n fixes t :: trm\n assumes \"[s] \\ t\"\n shows \" \\ s' . t = [s'] \\ s \\ s'\"\nusing assms by cases (auto)\n\nlemma SN_Ret: \"SN u \\ SN [u]\"\nby(induct rule:SN.induct) (metis SN.intros red_Ret)\n\ntext \\All the properties of reducibility are shown simultaneously by induction\non the type. Lindley and Stark \\cite{TT-lifting} only spell out the cases\ndealing with the monadic type constructor $T$. We do the same by reusing the\nproofs from \\cite{SN.thy} for the other cases. To shorten the presentation,\nthese proofs are omitted\\\n \nlemma RED_props: \n shows \"CR1 \\\" and \"CR2 \\\" and \"CR3 \\\"\nproof (nominal_induct \\ rule: ty.strong_induct)\n case TBase {%invisible case 1 show \"CR1 TBase\" \n by (simp add: CR1_def)\n next\n case 2 show \"CR2 TBase\" \n by (auto intro: SN_preserved simp add: CR2_def)\n next\n case 3 show \"CR3 TBase\" \n by (auto intro: SN_intro simp add: CR3_def CR3_RED_def)\n }\nnext\n case (TFun \\1 \\2) {%invisible case 1\n have ih_CR3_\\1: \"CR3 \\1\" by fact\n have ih_CR1_\\2: \"CR1 \\2\" by fact\n have \"\\t. t \\ RED (\\1 \\ \\2) \\ SN t\" \n proof - \n fix t\n assume \"t \\ RED (\\1 \\ \\2)\"\n then have a: \"\\u. u \\ RED \\1 \\ App t u \\ RED \\2\" by simp\n from ih_CR3_\\1 have \"CR4 \\1\" by (simp add: CR3_implies_CR4) \n moreover\n fix a have \"NEUT (Var a)\" by (force simp add: NEUT_def)\n moreover\n have \"NORMAL (Var a)\" by (rule normal_var)\n ultimately have \"(Var a)\\ RED \\1\" by (simp add: CR4_def)\n with a have \"App t (Var a) \\ RED \\2\" by simp\n hence \"SN (App t (Var a))\" using ih_CR1_\\2 by (simp add: CR1_def)\n thus \"SN t\" by (auto dest: SN_of_FST_of_App)\n qed\n then show \"CR1 (\\1 \\ \\2)\" unfolding CR1_def by simp\n next\n case 2\n have ih_CR2_\\2: \"CR2 \\2\" by fact\n then show \"CR2 (\\1 \\ \\2)\" unfolding CR2_def by auto \n next\n case 3\n have ih_CR1_\\1: \"CR1 \\1\" by fact\n have ih_CR2_\\1: \"CR2 \\1\" by fact\n have ih_CR3_\\2: \"CR3 \\2\" by fact\n show \"CR3 (\\1 \\ \\2)\" unfolding CR3_def\n proof (simp, intro strip)\n fix t u\n assume a1: \"u \\ RED \\1\"\n assume a2: \"NEUT t \\ CR3_RED t (\\1 \\ \\2)\"\n have \"SN(u)\" using a1 ih_CR1_\\1 by (simp add: CR1_def)\n then show \"(App t u)\\RED \\2\" \n using ih_CR2_\\1 ih_CR3_\\2 a1 a2 by (blast intro: sub_induction)\n qed\n }\nnext\n case (T \\)\n { case 1 \\ \\follows from the fact that @{term \"Id \\ SRED \\\"}\\\n have ih_CR1_\\: \"CR1 \\\" by fact\n { fix t assume t_red: \"t \\ RED (T \\)\"\n { fix s assume \"s \\ RED \\\" \n hence \"SN s\" using ih_CR1_\\ by (auto simp add: CR1_def)\n hence \"SN ([s])\" by (rule SN_Ret)\n hence \"SN ([s] \\ Id)\" by simp\n } hence \"Id \\ SRED \\\" by simp\n with t_red have \"SN (t)\" by (auto simp del: SRED.simps)\n } thus \"CR1 (T \\)\" unfolding CR1_def by blast\n next\n case 2 \\ \\follows since \\isa{SN} is preserved under redcution\\\n { fix t t'::trm assume t_red: \"t \\ RED (T \\)\" and t_t': \"t \\ t'\" \n { fix k assume k: \"k \\ SRED \\\"\n with t_red have \"SN(t \\ k)\" by simp\n moreover from t_t' have \"t \\ k \\ t' \\ k\" ..\n ultimately have \"SN(t' \\ k)\" by (rule SN_preserved) \n } hence \"t' \\ RED (T \\)\" by (simp del: SRED.simps)\n } thus \"CR2 (T \\)\"unfolding CR2_def by blast\n next\n case 3 from \\CR3 \\\\ have ih_CR4_\\ : \"CR4 \\\" ..\n { fix t assume t'_red: \"\\ t' . t \\ t' \\ t' \\ RED (T \\)\" \n and neut_t: \"NEUT t\"\n { fix k assume k_red: \"k \\ SRED \\\" \n fix x have \"NEUT (Var x)\" unfolding NEUT_def by simp \n hence \"Var x \\ RED \\\" using normal_var ih_CR4_\\ \n by (simp add: CR4_def)\n hence \"SN ([Var x] \\ k)\" using k_red by simp\n hence \"SSN k\" by (rule SN_SSN)\n then have \"SN (t \\ k)\" using k_red\n proof (induct k rule:SSN.induct)\n case (SSN_intro k)\n have ih : \"\\k'. \\ k \\ k' ; k' \\ SRED \\ \\ \\ SN (t \\ k')\"\n and k_red: \"k \\ SRED \\\" by fact+\n { fix r assume r: \"t \\ k \\ r\"\n hence \"SN r\" using neut_t\n proof (cases rule:dismantle_cases')\n case (T t') hence t_t': \"t \\ t'\" and r_def: \"r = t' \\ k\" . \n from t_t' have \"t' \\ RED (T \\)\" by (rule t'_red)\n thus \"SN r\" using k_red r_def by simp\n next\n case (K k') hence k_k': \"k \\ k'\" and r_def: \"r = t \\ k'\" .\n { fix s assume \"s \\ RED \\\" \n hence \"SN ([s] \\ k)\" using k_red\n by simp\n moreover have \"[s] \\ k \\ [s] \\ k'\"\n using k_k' unfolding stack_reduction_def .. \n ultimately have \"SN ([s] \\ k')\" ..\n } hence \"k' \\ SRED \\\" by simp\n with k_k' show \"SN r\" unfolding r_def by (rule ih)\n qed } thus \"SN (t \\ k)\" .. \n qed } hence \"t \\ RED (T \\)\" by simp\n } thus \"CR3 (T \\)\" unfolding CR3_def CR3_RED_def by blast\n }\nqed\n\ntext \\The last case above shows that, once all the reasoning principles have\nbeen established, some proofs have a formalization which is amazingly close to\nthe informal version. For a direct comparison, the informal proof is presented\nin Figure~\\ref{fig:cr3}.\\\n\ntext_raw \\\\input{figureCR3}\\\n\ntext \\Now that we have established the properties of the reducibility\nrelation, we need to show that reducibility is preserved by the various term\nconstructors. The only nontrivial cases are abstraction and sequencing.\\\n\nsection \\Abstraction Preserves Reducibility\\ \n\ntext \\Once again we could reuse the proofs from \\cite{SN.thy}. The proof uses\nthe \\isa{double-SN} rule and the lemma \\isa{red-Lam} below. Unfortunately, this\ntime the proofs are not fully identical to the proofs in \\cite{SN.thy} because\nwe consider $\\beta\\eta$-reduction rather than $\\beta$-reduction only. However,\nthe differences are only minor.\\\n \nlemma%invisible double_SN_aux:\n assumes a: \"SN a\"\n and b: \"SN b\"\n and hyp: \"\\x z.\n \\\\y. x \\ y \\ SN y; \\y. x \\ y \\ P y z;\n \\u. z \\ u \\ SN u; \\u. z \\ u \\ P x u\\ \\ P x z\"\n shows \"P a b\"\nproof -\n from a\n have r: \"\\b. SN b \\ P a b\"\n proof (induct a rule: SN.induct)\n case (SN_intro x)\n note SNI' = SN_intro\n have \"SN b\" by fact\n thus ?case\n proof (induct b rule: SN.induct)\n case (SN_intro y)\n show ?case\n apply (rule hyp)\n apply (erule SNI')\n apply (erule SNI')\n apply (rule SN.SN_intro)\n apply (erule SN_intro)+\n done\n qed\n qed\n from b show ?thesis by (rule r)\nqed\n\nlemma double_SN[consumes 2]:\n assumes a: \"SN a\"\n and b: \"SN b\" \n and c: \"\\(x::trm) (z::trm). \n \\\\y. x \\ y \\ P y z; \\u. z \\ u \\ P x u\\ \\ P x z\"\n shows \"P a b\"\nusing a b c\nby%invisible (blast intro: double_SN_aux)\n\nlemma red_Lam:\n assumes a: \"\\ x . t \\ r\" \n shows \" (\\t'. r = \\ x . t' \\ t \\ t') \\ (t = App r (Var x) \\ x \\ r ) \"\nproof -\n obtain z::name where z: \"z \\ x\" \"z \\ t\" \"z \\ r\" \n using ex_fresh[of \"(x,t,r)\"] by (auto simp add: fresh_prod)\n have \"x \\ \\ x . t\" by (simp add: abs_fresh)\n with a have \"x \\ r\" by (simp add: reduction_fresh)\n with a show ?thesis using z\n by(cases rule: reduction.strong_cases\n [where x =\"x\" and xa=\"x\" and xb=\"x\" and xc=\"x\" and \n xd=\"x\" and xe=\"x\" and xf=\"x\" and xg=\"x\" and y=\"z\"])\n (auto simp add: abs_fresh alpha fresh_atm)\nqed\n\nlemma abs_RED: \n assumes asm: \"\\s\\RED \\. t[x::=s]\\RED \\\"\n shows \"\\ x . t \\RED (\\\\\\)\"\nproof %invisible -\n have b1: \"SN t\" \n proof -\n have \"Var x\\RED \\\"\n proof -\n have \"CR4 \\\" by (simp add: RED_props CR3_implies_CR4)\n moreover\n have \"NEUT (Var x)\" by (auto simp add: NEUT_def)\n moreover\n have \"NORMAL (Var x)\" by (rule normal_var) \n ultimately show \"Var x\\RED \\\" by (simp add: CR4_def)\n qed\n then have \"t[x::=Var x]\\RED \\\" using asm by simp\n then have \"t\\RED \\\" by (simp add: id_subs)\n moreover \n have \"CR1 \\\" by (simp add: RED_props)\n ultimately show \"SN t\" by (simp add: CR1_def)\n qed\n show \"\\ x .t\\RED (\\\\\\)\"\n proof (simp, intro strip)\n fix u\n assume b2: \"u\\RED \\\"\n then have b3: \"SN u\" using RED_props by (auto simp add: CR1_def)\n show \"App (\\ x .t) u \\ RED \\\" using b1 b3 b2 asm\n proof(induct t u rule: double_SN)\n fix t u\n assume ih1: \"\\t'. \\t \\ t'; u\\RED \\; \\s\\RED \\. t'[x::=s]\\RED \\\\ \\ App (\\ x\n.t') u \\\nRED \\\" \n assume ih2: \"\\u'. \\u \\ u'; u'\\RED \\; \\s\\RED \\. t[x::=s]\\RED \\\\ \\ App (\\ x\n.t) u' \\\nRED \\\"\n assume as1: \"u \\ RED \\\"\n assume as2: \"\\s\\RED \\. t[x::=s]\\RED \\\"\n have \"CR3_RED (App (\\ x. t) u) \\\" unfolding CR3_RED_def\n proof(intro strip)\n fix r\n assume red: \"App (\\ x .t) u \\ r\"\n moreover\n { assume \"\\t'. t \\ t' \\ r = App (\\ x . t') u\"\n then obtain t' where a1: \"t \\ t'\" and a2: \"r = App (\\ x .t') u\" by\nblast\n have \"App (\\ x .t') u\\RED \\\" using ih1 a1 as1 as2\n apply(auto)\n apply(drule_tac x=\"t'\" in meta_spec)\n apply(simp)\n apply(drule meta_mp)\n prefer 2\n apply(auto)[1]\n apply(rule ballI)\n apply(drule_tac x=\"s\" in bspec)\n apply(simp)\n apply(subgoal_tac \"CR2 \\\")(*A*)\n apply(unfold CR2_def)[1]\n apply(drule_tac x=\"t[x::=s]\" in spec)\n apply(drule_tac x=\"t'[x::=s]\" in spec)\n apply(simp add: reduction_subst)\n (*A*)\n apply(simp add: RED_props)\n done\n then have \"r\\RED \\\" using a2 by simp\n } note rt = this\n moreover\n { assume \"\\u'. u \\ u' \\ r = App (\\ x . t) u'\"\n then obtain u' where b1: \"u \\ u'\" and b2: \"r = App (\\ x .t) u'\" by\nblast\n have \"App (\\ x .t) u'\\RED \\\" using ih2 b1 as1 as2\n apply(auto)\n apply(drule_tac x=\"u'\" in meta_spec)\n apply(simp)\n apply(drule meta_mp)\n apply(subgoal_tac \"CR2 \\\")\n apply(unfold CR2_def)[1]\n apply(drule_tac x=\"u\" in spec)\n apply(drule_tac x=\"u'\" in spec)\n apply(simp)\n apply(simp add: RED_props)\n apply(simp)\n done\n then have \"r\\RED \\\" using b2 by simp\n } note ru= this\n moreover\n { assume \"r = t[x::=u]\"\n then have \"r\\RED \\\" using as1 as2 by auto\n } note r = this\n \n ultimately show \"r \\ RED \\\" \n (* one wants to use the strong elimination principle; for this one \n has to know that x\\u *)\n apply(cases) \n apply(auto)\n apply(drule red_Lam)\n apply(drule disjE)prefer 3 apply simp\n apply(auto)[1]\n prefer 2\n apply(auto simp add: alpha subst_rename')[1]\n apply(subgoal_tac \"App s' u = t[x::=u]\")\n apply(auto)\n apply(auto simp add: forget)\n done\n qed\n moreover \n have \"NEUT (App (\\ x . t) u)\" unfolding NEUT_def by (auto)\n ultimately show \"App (\\ x . t) u \\ RED \\\" using RED_props by (simp add:\nCR3_def)\n qed\nqed\nqed\n\n\nsection \\Sequencing Preserves Reducibility\\\n\ntext \\This section corresponds to the main part of the paper being formalized\nand as such deserves special attention. In the lambda case one has to formalize\ndoing induction on $\\max(s) + max(t)$ for two strongly normalizing terms $s$ and\n$t$ (cf. \\cite[Section 6.3]{proofs+types}). Above, this was done through a\n\\isa{double-SN}\nrule. The central Lemma 7 of Lindley and Stark's paper uses an even more\ncomplicated induction scheme. They assume terms $p$ and $n$ as well as a stack\n$K$ such that @{term \"SN(p)\"} and @{term \"SN(n[x::=p] \\ K)\"}. The induction is\nthen done on $|K| + max(n \\star K) + max(p)$. See Figure~\\ref{fig:lemma7} in\nfor details.\\\n\ntext_raw \\\\input{figureLemma7}\\\n\n\ntext \\Since we have settled for a different characterization of strong\nnormalization, we have to derive an induction principle similar in spirit to the\n\\isa{double-SN} rule. \n\nFurthermore, it turns out that it is not necessary to formalize the fact that\nstack reductions do not increase the length of the stack.\\footnote{This\npossibility was only discovered \\textit{after} having formalized $ K \\mapsto K'\n\\Rightarrow |K| \\geq |K'|$. The proof of this seemingly simple fact\nwas about 90 lines of Isar code.} Doing induction on the sum above, this is\nnecessary to handle the case of a reduction occurring in $K$. We differ\nfrom \\cite{TT-lifting} and establish an induction principle which to some extent\nresembles the lexicographic order on $$(\\SN,\\mapsto) \\times (\\SN,\\mapsto) \\times\n(\\N,>)\\,.$$\\\n\nlemma triple_induct[consumes 2]: \n assumes a: \"SN (p)\"\n and b: \"SN (q)\"\n and hyp: \"\\ (p::trm) (q::trm) (k::stack) . \n \\ \\ p' . p \\ p' \\ P p' q k ; \n \\ q' k . q \\ q' \\ P p q' k; \n \\ k' . |k'| < |k| \\ P p q k' \\ \\ P p q k \"\n shows \"P p q k\"\nproof -\n from a have \"\\q K . SN q \\ P p q K\"\n proof (induct p)\n case (SN_intro p) \n have sn1: \"\\ p' q K . \\p \\ p'; SN q\\ \\ P p' q K\" by fact\n have sn_q: \"SN q\" \"SN q\" by fact+\n thus \"P p q K\"\n proof (induct q arbitrary: K) \n case (SN_intro q K)\n have sn2: \"\\ q' K . \\q \\ q'; SN q'\\ \\ P p q' K\" by fact\n show \"P p q K\"\n proof (induct K rule: measure_induct_rule[where f=\"length\"])\n case (less k)\n have le: \"\\ k' . |k'| < |k| \\ P p q k'\" by fact\n { fix p' assume \"p \\ p'\"\n moreover have \"SN q\" by fact\n ultimately have \"P p' q k\" using sn1 by auto }\n moreover\n { fix q' K assume r: \"q \\ q'\" \n have \"SN q\" by fact\n hence \"SN q'\" using r by (rule SN_preserved)\n with r have \"P p q' K\" using sn2 by auto }\n ultimately show ?case using le\n by (auto intro:hyp)\n qed\n qed\n qed \n with b show ?thesis by blast\nqed\n\n\ntext \\Here we strengthen the case rule for terms of the form @{term \"t \\ k \\\nr\"}. The freshness requirements on $x$,$y$, and $z$\ncorrespond to those for the rule \\isa{reduction.strong-cases}, the strong\ninversion principle for the reduction relation.\\\n\n\nlemma dismantle_strong_cases:\n fixes t :: trm\n assumes r: \"t \\ k \\ r\"\n and f: \"y \\ (t,k,r)\" \"x \\ (z,t,k,r)\" \"z \\ (t,k,r)\"\n and T: \"\\ t' . \\ t \\ t' ; r = t' \\ k \\ \\ P\"\n and K: \"\\ k' . \\ k \\ k' ; r = t \\ k' \\ \\ P\" \n and B: \"\\ s n l . \\ t = [s] ; \n k = [y]n\\l ; r = (n[y::=s]) \\ l \\ \\ P \"\n and A: \"\\ u v n l . \n \\ x \\ (z,n); t = u to x in v ; k = [z]n\\l ; \n r = (u to x in (v to z in n)) \\ l \\ \\ P \"\n shows \"P\"\nproof (cases rule:dismantle_cases[of t k r P])\n case (4 s y' n L) have ch:\n \"t = [s]\"\n \"k = [y']n\\L\"\n \"r = n[y'::=s] \\ L\" by fact+\n txt \\The equations we get look almost like those we need to instantiate the\nhypothesis \\isa{B}. The only difference is that \\isa{B} only applies to $y$, and\nsince we want $y$ to become an instantiation variable of the strengthened rule,\nwe only know that $y$ satisfies \\isa{f} and nothing else. But the condition\n\\isa{f} is just strong enough to rename $y'$ to $y$ and apply \\isa{B}.\\\n with f have \"y = y' \\ y \\ n\" \n by (auto simp add: fresh_prod abs_fresh)\n hence \"n[y'::=s] = ([(y,y')] \\ n)[y::=s]\" \n and \"[y']n\\L = [y]([(y,y')] \\ n)\\L\"\n by(auto simp add: name_swap_bij subst_rename' stack.inject alpha' )\n with ch have \"t = [s]\" \n \"k = [y]([(y,y')] \\ n)\\L\" \n \"r = ([(y,y')] \\ n)[y::=s] \\ L\"\n by (auto)\n thus \"P\" by (rule B) \nnext \n case (5 u x' v z' n L) have ch:\n \"x' \\ z'\" \"x' \\ n\"\n \"t = u to x' in v\"\n \"k = [z']n\\L\"\n \"r = (u to x' in v to z' in n) \\ L\" by fact+ \n txt \\We want to do the same trick as above but at this point we have to take\ncare of the possibility that $x$ might coincide with $x'$ or $z'$. Similarly,\n$z$\nmight coincide with $z'$.\\\n with f have x: \"x = x' \\ x \\ v to z' in n\" \n and z: \"z = z' \\ z \\ n\"\n by (auto simp add: fresh_prod abs_fresh)\n from f ch have x': \"x' \\ n\" \" x' \\ z'\" \n and xz': \"x = z' \\ x \\ n\" \n by (auto simp add:name_swap_bij alpha fresh_prod fresh_atm abs_fresh)\n from f ch have \"x \\ z\" \"x \\ [z'].n\" by (auto simp add: fresh_prod)\n with xz' z have \" x \\ (z , ([(z, z')] \\ n))\" \n by (auto simp add: fresh_atm fresh_bij name_swap_bij \n fresh_prod abs_fresh calc_atm fresh_aux fresh_left)\n moreover from x ch have \"t = u to x in ([(x,x')] \\ v)\" \n by (auto simp add:name_swap_bij alpha')\n moreover from z ch have \"k = [z]([(z,z')] \\ n)\\L\"\n by (auto simp add:name_swap_bij stack.inject alpha')\n txt \\The first two $\\alpha$-renamings are simple, but here we have to handle\nthe nested binding structure of the assoc rule. Since $x$ scopes over the whole\nterm @{term \"(v to z' in n)\" }, we have to push the swapping over $z'$\\\n moreover { from x have \n \"u to x' in (v to z' in n) = u to x in ([(x,x')] \\ (v to z' in n))\"\n by (auto simp add:name_swap_bij alpha' simp del: trm.perm)\n also from xz' x' have \"\\ = u to x in (([(x,x')] \\ v) to z' in n)\"\n by (auto simp add: abs_fun_eq1 swap_simps alpha'') \n (metis alpha'' fresh_atm perm_fresh_fresh swap_simps(1) x')\n also from z have \" \\ = u to x in (([(x,x')] \\ v) to z in ([(z,z')] \\ n))\"\n by (auto simp add: abs_fun_eq1 alpha' name_swap_bij )\n finally \n have \"r = (u to x in (([(x, x')] \\ v) to z in ([(z, z')] \\ n))) \\ L\" \n using ch by (simp del: trm.inject) }\n ultimately show \"P\" \n by (rule A[where n=\"[(z, z')] \\ n\" and v=\"([(x, x')] \\ v)\"]) \nqed (insert r T K, auto)\n\n\ntext \\The lemma in Figure~\\ref{fig:lemma7} assumes @{term \"SN(n[x::=p] \\ K)\"}\nbut the actual induction in done on @{term \"SN(n \\ K)\"}. The stronger\nassumption @{term \"SN (n[x::=p] \\ K)\"} is needed to handle the $\\beta$ and\n$\\eta$ cases.\\\n\nlemma sn_forget:\n assumes a: \"SN(t[x::=v])\"\n shows \"SN t\"\nproof -\n define q where \"q = t[x::=v]\"\n from a have \"SN q\" unfolding q_def .\n thus \"SN t\" using q_def\n proof (induct q arbitrary: t)\n case (SN_intro t)\n hence ih: \"\\ t'. \\t[x::=v] \\ t'[x::=v]\\ \\ SN t'\" by auto\n { fix t' assume \"t \\ t'\"\n hence \"t[x::=v] \\ t'[x::=v]\" by (rule reduction_subst)\n hence \"SN t'\" by (rule ih) }\n thus \"SN t\" ..\n qed\nqed\n\n \nlemma sn_forget': \n assumes sn: \"SN (t[x::=p] \\ k)\" \n and x: \"x \\ k\"\n shows \"SN (t \\ k)\"\nproof -\n from x have \"t[x::=p] \\ k = (t \\ k)[x::=p]\" by (simp add: ssubst_forget)\n with sn have \"SN( (t \\ k)[x::=p] )\" by simp\n thus ?thesis by (rule sn_forget)\nqed\n\nabbreviation\nredrtrans :: \"trm \\ trm \\ bool\" (\" _ \\\\<^sup>* _ \" )\nwhere \"redrtrans \\ reduction^**\" \n\ntext \\To be able to handle the case where $p$ makes a step, we need to\nestablish @{term \"p \\ p' \\ (m[x::=p]) \\\\<^sup>* (m[x::=p'])\"} as well as the\nfact that strong normalization is preserved for an arbitrary number of reduction\nsteps. The first claim involves a number of simple transitivity lemmas. Here we\ncan benefit from having removed the freshness conditions from the reduction\nrelation as this allows all the cases to be proven automatically. Similarly, in\nthe \\isa{red-subst} lemma, only those cases where substitution is pushed to two\nsubterms needs to be proven explicitly.\\\n\nlemma red_trans:\n shows r1_trans: \" s \\\\<^sup>* s' \\ App s t \\\\<^sup>* App s' t\"\n and r2_trans: \" t \\\\<^sup>* t' \\ App s t \\\\<^sup>* App s t'\"\n and r4_trans: \"t \\\\<^sup>* t' \\ \\ x . t \\\\<^sup>* \\ x . t' \"\n and r6_trans: \" s \\\\<^sup>* s' \\ s to x in t \\\\<^sup>* s' to x in t\"\n and r7_trans: \"\\ t \\\\<^sup>* t' \\ \\ s to x in t \\\\<^sup>* s to x in t'\"\n and r11_trans: \"s \\\\<^sup>* s' \\ [s] \\\\<^sup>* ([s'])\"\nby - (induct rule: rtranclp_induct , (auto intro:\ntransitive_closurep_trans')[2])+\n\nlemma red_subst: \"p \\ p' \\ (m[x::=p]) \\\\<^sup>* (m[x::=p'])\"\nproof(nominal_induct m avoiding: x p p' rule:trm.strong_induct)\n case (App s t) \n hence \"App (s[x::=p]) (t[x::=p]) \\\\<^sup>* App (s[x::=p']) (t[x::=p])\" \n by (auto intro: r1_trans)\n also from App have \"\\ \\\\<^sup>* App (s[x::=p']) ( t[x::=p'])\"\n by (auto intro: r2_trans)\n finally show ?case by auto\nnext\n case (To s y n) hence \n \"(s[x::=p]) to y in (n[x::=p]) \\\\<^sup>* (s[x::=p']) to y in (n[x::=p])\" \n by (auto intro: r6_trans)\n also from To have \" \\ \\\\<^sup>* (s[x::=p']) to y in (n[x::=p']) \"\n by (auto intro: r7_trans)\n finally show ?case using To by auto\nqed (auto intro:red_trans)\n\nlemma SN_trans : \"\\ p \\\\<^sup>* p' ; SN p \\ \\ SN p' \"\nby (induct rule: rtranclp_induct) (auto intro: SN_preserved)\n\nsubsection \\Central lemma\\\ntext_raw \\\\label{sec:central}\\\n\ntext \\Now we have everything in place we need to tackle the central ``Lemma\n7'' of \\cite{TT-lifting} (cf. Figure~\\ref{fig:lemma7}). The proof is quite long,\nbut for the most part, the reasoning is that of \\cite{TT-lifting}.\\\n\nlemma to_RED_aux: \n assumes p: \"SN p\"\n and x: \"x \\ p\" \"x \\ k\"\n and npk: \" SN (n[x::=p] \\ k)\"\n shows \"SN (([p] to x in n) \\ k)\"\nproof -\n { fix q assume \"SN q\" with p \n have \"\\ m . \\ q = m \\ k ; SN(m[x::=p] \\ k) \\ \n \\ SN (([p] to x in m) \\ k)\"\n using x\n proof (induct p q rule:triple_induct[where k=\"k\"]) \n case (1 p q k) \\ \\We obtain an induction hypothesis for $p$, $q$, and\n$k$.\\\n have ih_p: \n \"\\ p' m . \\p \\ p'; q = m \\ k; SN (m[x::=p'] \\ k); x \\ p'; x \\ k\\\n \\ SN (([p'] to x in m) \\ k)\" by fact\n have ih_q: \n \"\\ q' m k . \\q \\ q'; q' = m \\ k; SN (m[x::=p] \\ k); x \\ p; x \\ k\\\n \\ SN (([p] to x in m) \\ k)\" by fact\n have ih_k: \n \"\\ k' m . \\ |k'| < |k|; q = m \\ k'; SN (m[x::=p] \\ k'); x \\ p; x \\ k'\\\n \\ SN (([p] to x in m) \\ k')\" by fact\n have q: \"q = m \\ k\" and sn: \"SN (m[x::=p] \\ k)\" by fact+\n have xp: \"x \\ p\" and xk: \"x \\ k\" by fact+\n\ntxt \\Once again we want to reason via case distinction on the successors of a\nterm including a dismantling operator. Since this time we also need to handle\nthe cases where interactions occur, we want to use the strengthened case\nrule. We already require $x$ to be suitably fresh. To instantiate the rule, we\nneed another fresh name.\\\n\n { fix r assume red: \"([p] to x in m) \\ k \\ r\"\n from xp xk have x1 : \"x \\ ([p] to x in m) \\ k \" \n by (simp add: abs_fresh)\n with red have x2: \"x \\ r\" by (rule reduction_fresh)\n obtain z::name where z: \"z \\ (x,p,m,k,r)\" \n using ex_fresh[of \"(x,p,m,k,r)\"] by (auto simp add: fresh_prod)\n have \"SN r\"\n proof (cases rule:dismantle_strong_cases\n [of \"[p] to x in m\" k r x x z ])\n case (5 r') have r: \"r = r' \\ k\" and r': \"[p] to x in m \\ r'\" by fact+\n txt \\To handle the case of a reduction occurring somewhere in @{term\n\"[p] to x in m\" }, we need to contract the freshness conditions to this subterm.\nThis allows the use of the strong inversion rule for the reduction relation.\\\n from x1 x2 r \n have xl:\"(x \\ [p] to x in m)\" and xr:\"x \\ r'\" by auto\n from z have zl: \"z \\ ([p] to x in m)\" \"x \\ z\" \n by (auto simp add: abs_fresh fresh_prod fresh_atm)\n with r' have zr: \"z \\ r'\" by (blast intro:reduction_fresh)\n \\ \\handle all reductions of @{term \"[p] to x in m\"}\\\n from r' show \"SN r\" proof (cases rule:reduction.strong_cases\n [where x=\"x\" and xa=\"x\" and xb=\"x\" and xc=\"x\" and xd=\"x\" \n and xe=\"x\" and xf=\"x\"and xg=\"x\" and y=\"z\"])\ntxt \\The case where @{term \"p \\ p'\"} is interesting, because it requires\nreasioning about the reflexive transitive closure of the reduction relation.\\\n case (r6 s s' t) hence ch: \"[p] \\ s'\" \"r' = s' to x in m\" \n using xl xr by (auto)\n from this obtain p' where s: \"s' = [p']\" and p : \"p \\ p'\" \n by (blast dest:red_Ret)\n from p have \"((m\\k)[x::=p]) \\\\<^sup>* ((m\\k)[x::=p'])\" \n by (rule red_subst)\n with xk have \"((m[x::=p]) \\ k) \\\\<^sup>* ((m[x::=p']) \\ k)\" \n by (simp add: ssubst_forget)\n hence sn: \"SN ((m[x::=p']) \\ k)\" using sn by (rule SN_trans)\n from p xp have xp' : \"x \\ p'\" by (rule reduction_fresh)\n from ch s have rr: \"r' = [p'] to x in m\" by simp\n from p q sn xp' xk\n show \"SN r\" unfolding r rr by (rule ih_p)\n next\n\n case(r7 s t m') hence \"r' = [p] to x in m'\" and \"m \\ m'\" \n using xl xr by (auto simp add: alpha)\n hence rr: \"r' = [p] to x in m'\" by simp\n from q \\m \\ m'\\ have \"q \\ m' \\ k\" by(simp add: dismantle_red)\n moreover have \"m' \\ k = m' \\ k\" .. \\ \\a triviality\\\n moreover { from \\m \\ m'\\ have \"(m[x::=p]) \\ k \\ (m'[x::=p]) \\ k\"\n by (simp add: dismantle_red reduction_subst)\n with sn have \"SN(m'[x::=p] \\ k)\" .. }\n ultimately show \"SN r\" using xp xk unfolding r rr by (rule ih_q)\n next \n \n case (r8 s t) \\ \\the $\\beta$-case is handled by assumption\\\n hence \"r' = m[x::=p]\" using xl xr by(auto simp add: alpha)\n thus \"SN r\" unfolding r using sn by simp\n next \n\n case (r9 s) \\ \\the $\\eta$-case is handled by assumption as well\\ \n hence \"m = [Var x]\" and \"r' = [p]\" using xl xr \n by(auto simp add: alpha)\n hence \"r' = m[x::=p]\" by simp\n thus \"SN r\" unfolding r using sn by simp\n qed (simp_all only: xr xl zl zr abs_fresh , auto)\n \\ \\There are no other possible reductions of @{term \"[p] to x in\nm\"}.\\\n next\n\n case (6 k') \n have k: \"k \\ k'\" and r: \"r = ([p] to x in m) \\ k'\" by fact+\n from q k have \"q \\ m \\ k'\" unfolding stack_reduction_def by blast\n moreover have \"m \\ k' = m \\ k'\" ..\n moreover { have \"SN (m[x::=p] \\ k)\" by fact\n moreover have \"(m[x::=p]) \\ k \\ (m[x::=p]) \\ k'\" \n using k unfolding stack_reduction_def .. \n ultimately have \"SN (m[x::=p] \\ k')\" .. }\n moreover note xp \n moreover from k xk have \"x \\ k'\"\n by (rule stack_reduction_fresh)\n ultimately show \"SN r\" unfolding r by (rule ih_q)\n next\ntxt \\The case of an assoc interaction between @{term \"[p] to x in m\" } and\n@{term \"k\"} is easily handled by the induction hypothesis, since @{term\n\"(m[x::=p]) \\ k\"} remains fixed under assoc.\\\n case (8 s t u L)\n hence k: \"k = [z]u\\L\"\n and r: \"r = ([p] to x in (m to z in u)) \\ L\" \n and u: \"x \\ u\" \n by(auto simp add: alpha fresh_prod)\n let ?k = L and ?m = \"m to z in u\"\n from k z have \"|?k| < |k|\" by (simp add: fresh_prod)\n moreover have \"q = ?m \\ ?k\" using k q by simp\n moreover { from k u z xp have \"(?m[x::=p] \\ ?k) = (m[x::=p]) \\ k\" \n by(simp add: fresh_prod forget)\n hence \"SN (?m[x::=p] \\ ?k)\" using sn by simp }\n moreover from xp xk k have \"x \\ p\" and \"x \\ ?k\" by auto\n ultimately show \"SN r\" unfolding r by (rule ih_k)\n qed (insert red z x1 x2 xp xk ,\n auto simp add: fresh_prod fresh_atm abs_fresh)\n } thus \"SN (([p] to x in m) \\ k)\" ..\n qed } \n moreover have \"SN ((n[x::=p]) \\ k)\" by fact\n moreover hence \"SN (n \\ k)\" using \\x \\ k\\ by (rule sn_forget') \n ultimately show ?thesis by blast\nqed\n\ntext \\Having established the claim above, we use it show that\n\\textsf{to}-bindings preserve reducibility.\\\n\nlemma to_RED:\n assumes s: \"s \\ RED (T \\)\"\n and t : \" \\ p \\ RED \\ . t[x::=p] \\ RED (T \\)\"\n shows \"s to x in t \\ RED (T \\)\"\nproof -\n { fix K assume k: \"K \\ SRED \\\" \n { fix p assume p: \"p \\ RED \\\"\n hence snp: \"SN p\" using RED_props by(simp add: CR1_def)\n obtain x'::name where x: \"x' \\ (t, p, K)\" \n using ex_fresh[of \"(t,p,K)\"] by (auto)\n from p t k have \"SN((t[x::=p]) \\ K)\" by auto\n with x have \"SN ((([(x',x)] \\ t )[x'::=p]) \\ K)\" \n by (simp add: fresh_prod subst_rename)\n with snp x have snx': \"SN (([p] to x' in ([(x',x)] \\ t )) \\ K)\" \n by (auto intro: to_RED_aux)\n from x have \"[p] to x' in ([(x',x)] \\ t ) = [p] to x in t\" \n by simp (metis alpha' fresh_prod name_swap_bij x)\n moreover have \"([p] to x in t) \\ K = [p] \\ [x]t\\K\" by simp\n ultimately have snx: \"SN([p] \\ [x]t\\K)\" using snx' \n by (simp del: trm.inject)\n } hence \"[x]t\\K \\ SRED \\\" by simp\n with s have \"SN((s to x in t) \\ K)\" by(auto simp del: SRED.simps) \n } thus \"s to x in t \\ RED (T \\)\" by simp\nqed\n\n\nsection \\Fundamental Theorem\\\ntext_raw \\\\label{sec:FTLR}\\\n\ntext \\The remainder of this section follows \\cite{SN.thy} very closely. We\nfirst establish that all well typed terms are reducible if we substitute\nreducible terms for the free variables.\\\n\nabbreviation \n mapsto :: \"(name\\trm) list \\ name \\ trm \\ bool\" (\"_ maps _ to _\" [55,55,55] 55)\nwhere\n \"\\ maps x to e \\ (lookup \\ x) = e\"\n\nabbreviation \n closes :: \"(name\\trm) list \\ (name\\ty) list \\ bool\" (\"_ closes _\" [55,55] 55) \nwhere\n \"\\ closes \\ \\ \\x \\. ((x,\\) \\ set \\ \\ (\\t. \\ maps x to t \\ t \\ RED \\))\"\n\ntheorem fundamental_theorem: \n assumes a: \"\\ \\ t : \\\" and b: \"\\ closes \\\"\n shows \"\\ \\ RED \\\"\nusing a b\nproof(nominal_induct avoiding: \\ rule: typing.strong_induct)\n case (t3 a \\ \\ t \\ \\) \\ \\lambda case\\ \n {%invisible \n have ih: \"\\\\. \\ closes ((a,\\)#\\) \\ \\ \\ RED \\\" by fact\n have \\_cond: \"\\ closes \\\" by fact\n have fresh: \"a\\\\\" \"a\\\\\" by fact+\n from ih have \"\\s\\RED \\. ((a,s)#\\) \\ RED \\\" \n using fresh \\_cond fresh_context by simp\n then have \"\\s\\RED \\. \\[a::=s] \\ RED \\\" \n using fresh by (simp add: psubst_subst)\n then have \"\\ a . (\\) \\ RED (\\ \\ \\)\" by (simp only: abs_RED)\n then show \"\\<(\\ a . t)> \\ RED (\\ \\ \\)\" using fresh by simp }\nnext\n case (t5 x \\ s \\ t \\ \\) \\ \\to case\\\n have ihs : \"\\ \\ . \\ closes \\ \\ \\ \\ RED (T \\)\" by fact\n have iht : \"\\ \\ . \\ closes ((x, \\) # \\) \\ \\ \\ RED (T \\)\" by fact\n have \\_cond: \"\\ closes \\\" by fact\n have fresh: \"x \\ \\\" \"x \\ \\\" \"x \\ s\" by fact+\n from ihs have \"\\ \\ RED (T \\)\" using \\_cond by simp\n moreover \n { from iht have \"\\s\\RED \\. ((x,s)#\\) \\ RED (T \\)\" \n using fresh \\_cond fresh_context by simp\n hence \"\\s\\RED \\. \\[x::=s] \\ RED (T \\)\" \n using fresh by (simp add: psubst_subst) }\n ultimately have \"(\\) to x in (\\) \\ RED (T \\)\" by (simp only: to_RED)\n thus \"\\ \\ RED (T \\)\" using fresh by simp\nqed auto \\ \\all other cases are trivial\\\n\ntext \\The final result then follows using the identity substitution, which is\n$\\Gamma$-closing since all variables are reducible at any type.\\\n\nfun\n \"id\" :: \"(name\\ty) list \\ (name\\trm) list\"\nwhere\n \"id [] = []\"\n| \"id ((x,\\)#\\) = (x,Var x)#(id \\)\"\n\nlemma id_maps: \n shows \"(id \\) maps a to (Var a)\"\nby (induct \\) (auto)\n\nlemma id_fresh:\n fixes x::\"name\"\n assumes x: \"x \\ \\\"\n shows \"x \\ (id \\)\"\nusing x\nby (induct \\) (auto simp add: fresh_list_nil fresh_list_cons)\n\nlemma id_apply: \n shows \"(id \\) = t\"\nby (nominal_induct t avoiding: \\ rule: trm.strong_induct)\n (auto simp add: id_maps id_fresh)\n\nlemma id_closes:\n shows \"(id \\) closes \\\"\nproof - \n { fix x \\ assume \"(x,\\) \\ set \\\"\n have \"CR4 \\\" by(simp add: RED_props CR3_implies_CR4)\n hence \"Var x \\ RED \\\" \n by(auto simp add: NEUT_def normal_var CR4_def)\n hence \"(id \\) maps x to Var x \\ Var x \\ RED \\\"\n by (simp add: id_maps) \n } thus ?thesis by blast\nqed\n\nsubsection \\Strong normalization theorem\\\n\nlemma typing_implies_RED: \n assumes a: \"\\ \\ t : \\\"\n shows \"t \\ RED \\\"\nproof -\n have \"(id \\)\\RED \\\" \n proof -\n have \"(id \\) closes \\\" by (rule id_closes)\n with a show ?thesis by (rule fundamental_theorem)\n qed\n thus\"t \\ RED \\\" by (simp add: id_apply)\nqed\n\ntheorem strong_normalization: \n assumes a: \"\\ \\ t : \\\"\n shows \"SN(t)\"\nproof -\n from a have \"t \\ RED \\\" by (rule typing_implies_RED)\n moreover have \"CR1 \\\" by (rule RED_props)\n ultimately show \"SN(t)\" by (simp add: CR1_def)\nqed\n\ntext \\This finishes our formalization effort. This article is generated\nfrom the Isabelle theory file, which consists of roughly 1500 lines of proof\ncode. The reader is invited to replay some of the more technical proofs using\nthe theory file provided.\\\n\n(*<*)end(*>*)\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Lam-ml-Normalization/Lam_ml.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.2677775868026067}} {"text": "theory Calls\n imports \"artifact_setup.Artifact_Setup\"\n \"Det_Step\"\nbegin\n\ncontext execution_context\nbegin\ntext \"To call a concrete function on a concrete state.\"\ndefinition call\\<^sub>c :: \"(state \\ state) \\ state \\ state \\ bool\"\n where \"call\\<^sub>c f s s' \\ s' = (let s'' = f s in s''\\regs := (regs s'')(rip := get_rip s + 5)\\)\"\n\ntext \"To call an abstract function on an abstract state\"\ndefinition abstract\\<^sub>0 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>0 S f \\ \\' \\ \\ s s' . call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>0:\n shows \"call\\<^sub>c f s s' \\ abstract\\<^sub>0 S f ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>0_def)\n\ndefinition abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ 32 word \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 \\ \\' \\ \\ s s' . EDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"EDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2_def)\n\ndefinition abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ 64 word \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 S f p\\<^sub>0 \\ \\' \\ \\ s s' . RDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4:\n shows \"RDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 S f p\\<^sub>0 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4_def)\n\ndefinition abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ _ \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 \\ \\' \\ \\ s s' . RDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"RDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2_def)\n\ndefinition abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ _ \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 \\ \\' \\ \\ s s' . EDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"EDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2_def)\n\nend\nend", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Calls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.26774923694420316}} {"text": "theory ReduceProper\n imports SafeSubRename ResMapValid\nbegin\n\nfun own_pairs where\n \"own_pairs (ConstExp c) = {}\"\n| \"own_pairs (OpExp xop) = {}\"\n| \"own_pairs (VarExp v) = (case v of\n VarType x \\ {}\n | LocType x y \\ {(y, x)}\n )\" \n| \"own_pairs (PairExp e1 e2) = (own_pairs e1 \\ own_pairs e2)\"\n| \"own_pairs (IfExp e1 e2 e3) = (own_pairs e1 \\ own_pairs e2 \\ own_pairs e3)\"\n| \"own_pairs (LamExp x e) = own_pairs e\" \n| \"own_pairs (AppExp e1 e2) = (own_pairs e1 \\ own_pairs e2)\" \n \n (* ##### given a perm set, we derive its \"resource completion\" by taking all of the resources that are reachable from it.\n in other words, for each permission z in s, we lookup its resource map, and take all of the resources in it, as well\n as recursing on each resource. #####\n *) \n \nfun path_lookup :: \"nres_map \\ string \\ string list \\ string \\ bool\" where\n \"path_lookup rs_map z Nil x = (z = x)\"\n| \"path_lookup rs_map z (y # t) x = (case rs_map z of\n None \\ False\n | Some r_s \\ r_s (Loc y) \\ NoPerm \\ path_lookup rs_map y t x\n )\" \n\nlemma path_lookup_parent: \"\\ l \\ Nil; path_lookup rs_map z l x; valid_nres_map s rs_map \\ \\\n (\\ l' y r_s. path_lookup rs_map z l' y \\ rs_map y = Some r_s \\ r_s (Loc x) \\ NoPerm )\"\n apply (induct l arbitrary: z)\n apply (auto)\n apply (case_tac \"rs_map z\")\n apply (auto)\n (* case where we have reached x *)\n apply (case_tac \"a = x\")\n apply (rule_tac x=\"Nil\" in exI)\n apply (auto)\n (* otherwise, induct *)\n apply (case_tac \"l = []\")\n apply (auto)\n apply (case_tac \"\\l' y. path_lookup rs_map a l' y \\ (\\r_s. rs_map y = Some r_s \\ r_s (Loc x) \\ NoPerm)\")\n apply (erule_tac exE)\n apply (auto)\n apply (rule_tac x=\"a # l'\" in exI)\n apply (auto)\n done\n \nlemma path_lookup_append: \"\\ path_lookup rs_map x l y; path_lookup rs_map y m z \\ \\ path_lookup rs_map x (l @ m) z\" \n apply (induct l arbitrary: x)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n done \n \n (* ##### proper expressions ##### *)\n \ndefinition proper_exp :: \"nres_map \\ p_exp \\ bool\" where\n \"proper_exp rs_map e = (\\ x y. (x, y) \\ own_pairs e \\ (\\ l. path_lookup rs_map x l y))\"\n\nlemma proper_pair: \"\\ proper_exp rs_map (PairExp e1 e2) \\ \\ proper_exp rs_map e1 \\ proper_exp rs_map e2\" \n apply (simp add: proper_exp_def)\n done\n\nlemma proper_if: \"\\ proper_exp rs_map (IfExp e1 e2 e3) \\ \\ proper_exp rs_map e1 \\ proper_exp rs_map e2 \\ proper_exp rs_map e3\" \n apply (simp add: proper_exp_def)\n done \n\nlemma proper_app: \"\\ proper_exp rs_map (AppExp e1 e2) \\ \\ proper_exp rs_map e1 \\ proper_exp rs_map e2\" \n apply (simp add: proper_exp_def)\n done\n \nlemma proper_subst_exp: \"\\ proper_exp rs_map e; proper_exp rs_map e' \\ \\ proper_exp rs_map (subst_exp e x e')\"\n apply (induct e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n apply (auto)\n apply (simp add: proper_exp_def)\n done\n \nlemma proper_alpha_rename: \"\\ proper_exp rs_map e \\ \\ proper_exp rs_map (deep_alpha_rename e a b)\" \n apply (induct e)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (case_tac \"a = x1\")\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n apply (auto)\n apply (simp add: proper_exp_def)\n done\n \nlemma proper_lam_var_remove_ex: \"\\ proper_exp rs_map e; well_typed env r_s1 e tau r_s2 rx \\ \\ proper_exp rs_map (lam_var_remove e a b)\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_alpha_rename)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n apply (auto)\n apply (simp add: proper_exp_def)\n done\n \nlemma proper_lam_var_remove: \"\\ proper_exp rs_map e \\ \\ proper_exp rs_map (lam_var_remove e a b)\" \n apply (induct e)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_alpha_rename)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n apply (auto)\n apply (simp add: proper_exp_def)\n done\n \nlemma lam_var_remove_eq: \"\\ a \\ lam_vars e \\ \\ lam_var_remove e a b = e\" \n apply (induct e)\n apply (auto)\n done\n \nlemma proper_lvlr_ex: \"\\ well_typed env r_s1 e tau r_s2 rx; proper_exp rs_map e; unique_post_vars vl;\n post_vars vl \\ (free_vars e \\ lam_vars e) = {} \\ \\ proper_exp rs_map (lam_var_list_remove e vl)\" \n apply (induct vl arbitrary: e)\n apply (auto)\n (*apply (case_tac \"a \\ lam_vars e\")\n apply (simp add: lam_var_remove_eq)*)\n apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_lam_var_remove_ex)\n apply (auto)\n (* we have to prove that the post vars are still disjoint from the lam_vars / ref_vars, which is true since\n the only new lam_var is b, which must be disjoint from the rest of the post_var list *)\n apply (case_tac \"post_vars vl \\ (free_vars (lam_var_remove e a b) \\ lam_vars (lam_var_remove e a b)) \\ {}\")\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_free_var_none)\n apply (auto)\n apply (case_tac \"x = b\")\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n apply (auto)\n (* the last part of the induction is to prove that e is still well-typed *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and x=\"a\" and y=\"b\" in lam_var_remove_type_preserve)\n apply (auto)\n done\n \nlemma proper_safe_subst_exp: \"\\ proper_exp rs_map e; well_typed env r_s1 e tau r_s2 rx;\n proper_exp rs_map e'; safe_subst_exp e x e' e_f \\ \\ proper_exp rs_map e_f\" \n apply (simp add: safe_subst_exp_def)\n apply (auto)\n apply (rule_tac proper_subst_exp)\n apply (rule_tac proper_lvlr_ex)\n apply (auto)\n done\n\nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ReduceProper.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2677492309189948}} {"text": "theory ContextDeterminism\nimports ContextEvaluate\nbegin\n\n(*\n\nlemma [elim]: \"head_var e = Some x \\ is_value e \\ False\"\n by (induction e arbitrary: x) (auto split: option.splits nat.splits)\n\nlemma [elim]: \"e \\ e' \\ is_value e \\ False\"\n by (induction e e' rule: evaluate.induct) auto\n\nlemma [elim]: \"e \\ e' \\ head_var e = Some x \\ False\"\n by (induction e e' arbitrary: x rule: evaluate.induct) (auto split: option.splits nat.splits)\n\ntheorem determinism [elim]: \"e \\ e' \\ e \\ e'' \\ e' = e''\"\n proof (induction e e' arbitrary: e'' rule: evaluate.induct)\n case (ev_app1 e\\<^sub>1 e\\<^sub>1' e\\<^sub>2)\n with ev_app1(3) show ?case\n proof (induction \"App e\\<^sub>1 e\\<^sub>2\" e'' rule: evaluate.induct)\n case ev_app2\n hence False by auto\n thus ?case by simp\n next case ev_app_let\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_app2 t e\\<^sub>1 e\\<^sub>2)\n thus ?case by (induction \"App (Abs t e\\<^sub>1) e\\<^sub>2\" e'' rule: evaluate.induct) auto\n next case (ev_app_let e\\<^sub>1\\<^sub>2 e\\<^sub>1\\<^sub>1 e\\<^sub>2)\n with ev_app_let(2) show ?case\n proof (induction \"App (Let e\\<^sub>1\\<^sub>1 e\\<^sub>1\\<^sub>2) e\\<^sub>2\" e'' rule: evaluate.induct)\n case ev_app1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_let1 e\\<^sub>2 e\\<^sub>2' e\\<^sub>1)\n with ev_let1(3) show ?case\n proof (induction \"Let e\\<^sub>1 e\\<^sub>2\" e'' rule: evaluate.induct) \n case ev_let2\n hence False by fast\n thus ?case by simp\n next case ev_let3\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_let2 e\\<^sub>1 e\\<^sub>1' e\\<^sub>2)\n with ev_let2(4) show ?case\n proof (induction \"Let e\\<^sub>1 e\\<^sub>2\" e'' rule: evaluate.induct) \n case ev_let1\n hence False by fast\n thus ?case by simp\n next case ev_let3\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_let3 e\\<^sub>1 e\\<^sub>2)\n with ev_let3(3) show ?case\n proof (induction \"Let e\\<^sub>1 e\\<^sub>2\" e'' rule: evaluate.induct) \n case ev_let1\n hence False by auto\n thus ?case by simp\n next case ev_let2\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_proj1 e e' l)\n with ev_proj1(3) show ?case\n proof (induction \"Proj e l\" e'' rule: evaluate.induct)\n case ev_proj2\n hence False by auto\n thus ?case by simp\n next case ev_proj_let\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_proj2 fs l e)\n with ev_proj2(2) show ?case\n proof (induction \"Proj (Rec fs) l\" e'' rule: evaluate.induct)\n case ev_proj1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_proj_let e\\<^sub>2 e\\<^sub>1 l)\n with ev_proj_let(2) show ?case\n proof (induction \"Proj (expr.Let e\\<^sub>1 e\\<^sub>2) l\" e'' rule: evaluate.induct)\n case ev_proj1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_case1 e e' t cs)\n with ev_case1(3) show ?case\n proof (induction \"Case e t cs\" e'' rule: evaluate.induct)\n case ev_case2\n hence False by auto\n thus ?case by simp\n next case ev_case_let\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_case2 cs l e' ts e t)\n with ev_case2(2) show ?case\n proof (induction \"Case (Inj l ts e) t cs\" e'' rule: evaluate.induct)\n case ev_case1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_case_let e\\<^sub>2 e\\<^sub>1 t cs)\n with ev_case_let(2) show ?case\n proof (induction \"Case (Let e\\<^sub>1 e\\<^sub>2) t cs\" e'' rule: evaluate.induct)\n case ev_case1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_unfold1 e e' t)\n with ev_unfold1(3) show ?case\n proof (induction \"Unfold t e\" e'' rule: evaluate.induct)\n case ev_unfold2\n hence False by auto\n thus ?case by simp\n next case ev_unfold_let\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_unfold2 t e)\n thus ?case\n proof (induction \"Unfold t (Fold t e)\" e'' rule: evaluate.induct)\n case ev_unfold1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_unfold_let e\\<^sub>2 e\\<^sub>1 t)\n with ev_unfold_let(2) show ?case\n proof (induction \"Unfold e\\<^sub>1 (Let t e\\<^sub>2)\" e'' rule: evaluate.induct)\n case ev_unfold1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_tyapp1 e e' t)\n with ev_tyapp1(3) show ?case\n proof (induction \"TyApp e t\" e'' rule: evaluate.induct)\n case ev_tyapp2\n hence False by auto\n thus ?case by simp\n next case ev_tyapp_let\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_tyapp2 k e t)\n thus ?case\n proof (induction \"TyApp (TyAbs k e) t\" e'' rule: evaluate.induct)\n case ev_tyapp1\n hence False by auto\n thus ?case by simp\n qed simp_all\n next case (ev_tyapp_let e\\<^sub>2 e\\<^sub>1 t)\n with ev_tyapp_let(2) show ?case \n by (induction \"TyApp (Let e\\<^sub>1 e\\<^sub>2) t\" e'' rule: evaluate.induct) auto\n next case (ev_tylet t e)\n thus ?case by (induction \"TyLet t e\" e'' rule: evaluate.induct) simp_all\n qed\n\n*)\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "LazyCompiler", "sha": "3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa", "save_path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler", "path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler/LazyCompiler-3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa/01Expression/03EvaluationContext/ContextDeterminism.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2677492309189947}} {"text": "theory PhiSem_Machine_Integer\n imports PhiSem_Common_Int PhiSem_Generic_Boolean\n \"Word_Lib.More_Word\" (*We use the word lib from seL4*)\n \"Word_Lib.Signed_Division_Word\"\n \"Word_Lib.Word_Lemmas\"\nbegin\n\nchapter \\Semantics for Machine Integers\\\n\nsection \\Models\\\n\nsubsubsection \\Type\\\n\nvirtual_datatype \\machine_int_ty =\n T_int :: nat \\ \\in unit of bits\\\n\ndebt_axiomatization T_int :: \\nat type_entry\\\n where \\machine_int_ty_ax: \\\\machine_int_ty TY_CONS_OF T_int\\\n\ninterpretation \\machine_int_ty TY_CONS_OF \\TYPE(TY_N)\\ \\TYPE(TY)\\ T_int using \\machine_int_ty_ax .\n\nhide_fact \\machine_int_ty_ax \\machine_int_ty_axioms \\machine_int_ty_names_def \\machine_int_ty_def\n \\machine_int_ty_prjs_axioms \\machine_int_ty_prjs_def \\machine_int_ty.axioms \\machine_int_ty.intro\n \\machine_int_ty__names.\\machine_int_ty_names_axioms \\machine_int_ty_prjs.axioms\n\nsyntax \"_int_semty_\" :: \\type \\ TY\\ (\"int'(_')\")\n\ntranslations \"int('b)\" <= \"CONST T_int.mk LENGTH('b)\"\n\nML \\local open Ast in\n fun need_add_sort (Appl [Constant \\<^syntax_const>\\_ofsort\\, Variable _, _]) = true\n | need_add_sort (Variable _) = true\n | need_add_sort _ = false\n fun add_sort X =\n if need_add_sort X\n then Appl [Constant \\<^syntax_const>\\_ofsort\\, X, Constant \\<^class_syntax>\\len\\]\n else X\nend\\\n\nparse_ast_translation \\\n let open Ast\n in [(\\<^syntax_const>\\_int_semty_\\, (fn _ => fn [V] =>\n Appl [Constant \\<^const_syntax>\\T_int.mk\\, Appl [Constant \\<^syntax_const>\\_type_length\\, add_sort V]]))] end\\\n\n\nsubsubsection \\Value\\\n\nvirtual_datatype \\machine_int_val =\n V_int :: \\nat \\ nat\\ \\ \\bits \\ value\\\n\ndebt_axiomatization V_int :: \\(nat \\ nat) value_entry\\\n where \\machine_int_val_ax: \\\\machine_int_val VAL_CONS_OF V_int\\\n\ninterpretation \\machine_int_val VAL_CONS_OF \\TYPE(VAL_N)\\ \\TYPE(VAL)\\ V_int using \\machine_int_val_ax .\n\nhide_fact \\machine_int_val_ax \\machine_int_val_axioms\n\nsubsubsection \\Semantics\\\n\ndebt_axiomatization\n WT_int[simp]: \\Well_Type (T_int.mk b) = { V_int.mk (b,x) |x. x < 2 ^ b } \\\nand can_eqcmp_int[simp]: \"Can_EqCompare res (V_int.mk (b1,x1)) (V_int.mk (b2,x2)) \\ b1 = b2\"\nand eqcmp_int[simp]: \"EqCompare (V_int.mk i1) (V_int.mk i2) \\ i1 = i2\"\nand zero_int[simp]: \\Zero (T_int.mk b) = Some (V_int.mk (b,0))\\\n\n(*lemma Valid_Types[simp]:\n \\Valid_Type (T_int.mk n)\\\n unfolding Inhabited_def\n apply simp\n using less_exp by blast *)\n\n\nsection \\\\-Types\\\n\ntext \\Thresholds between \\-Types\n\\<^item> 9 \\Word \\ \\\\<^sup>r\\\n\\<^item> 9 \\Word \\ \\\\\n\\<^item> 9 \\Word \\ \\\\\n\\<^item> 7 \\\\\\<^sup>r \\ Word\\\n\\<^item> 7 \\\\ \\ Word\\\n\\<^item> 7 \\\\ \\ Word\\\n\\<^item> 6 \\\\ \\ \\\\\n\\<^item> 5 \\\\ \\ \\\\\n\\<^item> 4 \\\\\\<^sup>r \\ \\\\\n\\<^item> 2 \\\\ \\ \\\\<^sup>r\\\n\nThere is no direct transformation between \\\\\\<^sup>r\\ and \\\\\\ because of complexity in the expression.\n\n\\\n\nsubsection \\Words\\\n\ndefinition Word :: \\'b itself \\ (VAL, 'b::len word) \\\\\n where \\Word _ x = { V_int.mk (LENGTH('b), unat x) }\\\n\nsyntax Word_syntax :: \"type \\ (VAL, 'b::len word) \\\" (\"Word'(_')\")\n\ntranslations \"Word('x)\" <= \"CONST Word TYPE('x)\"\n\nparse_ast_translation \\\n let open Ast\n in [(\\<^syntax_const>\\Word_syntax\\, (fn _ => fn [V] =>\n Appl [Constant \\<^const_syntax>\\Word\\, Appl [Constant \\<^syntax_const>\\_TYPE\\, add_sort V]]))] end\\\n\n\n\nlemma Word_expn[\\expns]:\n \\p \\ (x \\ Word('b)) \\ p = V_int.mk (LENGTH('b), unat x)\\\n unfolding \\Type_def Word_def by simp\n\nlemma [elim!,\\inhabitance_rule]:\n \\Inhabited (x \\ Word('b)) \\ C \\ C\\ .\n\nlemma [\\reason 1000]:\n \\\\SemType (x \\ Word('b)) int('b)\\\n unfolding \\SemType_def subset_iff by (simp add: Word_expn)\n\nlemma [\\reason 1000]:\n \"\\Equal Word('b) (\\x y. True) (=)\"\n unfolding \\Equal_def by (simp add: word_unat_eq_iff Word_expn)\n\nlemma [\\reason 1000]:\n \"\\Zero int('b) Word('b) (0::'b::len word)\"\n unfolding \\Zero_def by (simp add: Word_expn image_iff)\n\n\n\nsubsection \\Natural Numbers\\\n\nsubsubsection \\Rounded Natural Number\\\n\ndefinition \\RoundedNat :: \"'b::len itself \\ (VAL, nat) \\\"\n where [\\defs]: \"\\RoundedNat _ x = ((of_nat x :: 'b word) \\ Word('b))\"\n\nsyntax \\RoundedNat_syntax :: \"type \\ (VAL, nat) \\\" (\"\\\\<^sup>r'(_')\")\n\ntranslations \"\\\\<^sup>r('x)\" <= \"CONST \\RoundedNat TYPE('x)\"\n\nparse_ast_translation \\\n let open Ast\n in [(\\<^syntax_const>\\\\RoundedNat_syntax\\, (fn _ => fn [V] =>\n Appl [Constant \\<^const_syntax>\\\\RoundedNat\\,\n Appl [Constant \\<^syntax_const>\\_TYPE\\, add_sort V]]))] end\\\n\nlemma [\n \\reason 1000 for \\?x \\ \\\\<^sup>r(?'b1) \\\\\\

\\\\\\\\ ?y \\ _ \\\\\\ _\\\n]:\n \\ \\

\\\\\\\\\\\\ x mod 2^LENGTH('b) = y mod 2^LENGTH('b)\n\\ x \\ \\\\<^sup>r('b) \\\\\\

\\\\\\\\ y \\ \\\\<^sup>r('b)\\\n \\ destruct\\ _\n construct\\ \\y \\ \\\\<^sup>r('b)\\ \n affirm by (simp add: the_\\ unat_of_nat word_unat_eq_iff) \\. .\n\nlemma [\\reason 800 for \\_ \\ \\\\<^sup>r(_) \\\\\\

\\\\\\\\ _ \\ Word(_) \\\\\\ _\\]:\n \\ Threshold_Cost 7\n\\ \\

\\\\\\\\\\\\ y = of_nat x\n\\ x \\ \\\\<^sup>r('b) \\\\\\

\\\\\\\\ y \\ Word('b)\\\n for y :: \\'b::len word\\\n \\ destruct\\ _ \\. .\n\nlemma [\n \\reason 800 for \\_ \\ \\RoundedNat _ \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (Word _)\\,\n \\inhabitance_rule\n]:\n \\x \\ \\\\<^sup>r('b) \\\\\\

\\\\\\\\ (of_nat x :: 'b::len word) \\ Word('b) @action to Word('b)\\\n \\ \\. .\n\nlemma [\\reason 1200 for \\_ \\ Word(_) \\\\\\

\\\\\\\\ _ \\ \\\\<^sup>r(_) \\\\\\ _\\]:\n \\ Threshold_Cost 9\n\\ \\

\\\\\\\\\\\\ y mod 2^LENGTH('b) = unat x\n\\ x \\ Word('b) \\\\\\

\\\\\\\\ y \\ \\\\<^sup>r('b)\\\n for x :: \\'b::len word\\\n \\ construct\\ \\unat x \\ \\\\<^sup>r('b)\\ \\. .\n\nlemma [\\reason 1200 for \\_ \\ Word _ \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (\\RoundedNat _)\\]:\n \\ x \\ Word('b) \\\\\\

\\\\\\\\ unat x \\ \\\\<^sup>r('b) @action to \\\\<^sup>r('b)\\\n for x :: \\'b::len word\\ \\ \\. .\n\nlemma [\\reason 1000]:\n \\\\SemType (x \\ \\\\<^sup>r('b)) int('b)\\\n \\ to \\Word _\\ \\. .\n\nlemma [\\reason 1000]:\n \\\\Zero int('b) \\\\<^sup>r('b) 0\\\n \\ \\0 \\ Word('b)\\ \\. .\n\nlemma [\\reason 1000]:\n \"\\Equal (\\\\<^sup>r('b::len)) (\\x y. True) (\\x y. x mod 2^LENGTH('b) = y mod 2^LENGTH('b))\"\n \\ to \\Word('b)\\ \\\n by (simp add: unat_of_nat word_unat_eq_iff) .\n\n\nsubsubsection \\Natural Number\\\n\ndefinition \\Nat :: \"'b::len itself \\ (VAL, nat) \\\"\n where [\\defs]: \"\\Nat _ x = (x \\ \\\\<^sup>r('b) \\\\\\\\ x \\ {0..< 2 ^ LENGTH('b)})\"\n\nsyntax \\Nat_syntax :: \"type \\ (VAL, nat) \\\" (\"\\'(_')\")\n\ntranslations \"\\('x)\" <= \"CONST \\Nat TYPE('x)\"\n\nparse_ast_translation \\\n let open Ast\n in [(\\<^syntax_const>\\\\Nat_syntax\\, (fn _ => fn [V] =>\n Appl [Constant \\<^const_syntax>\\\\Nat\\, Appl [Constant \\<^syntax_const>\\_TYPE\\, add_sort V]]))] end\\\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\ \\\\<^sup>r(_) \\\\\\ _\\]:\n \\ Threshold_Cost 2\n\\ \\

\\\\\\\\\\\\ y = x\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ y \\ \\\\<^sup>r('b) \\\\\\ x < 2 ^ LENGTH('b)\\\n \\ destruct\\ _ \\. .\n\nlemma [\n \\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (\\RoundedNat _)\\,\n \\inhabitance_rule\n]:\n \\x \\ \\('b) \\\\\\

\\\\\\\\ x \\ \\\\<^sup>r('b) \\\\\\ x < 2 ^ LENGTH('b) @action to \\\\<^sup>r('b)\\\n \\ \\. .\n\n\nlemma [\\reason 800 for \\_ \\ \\\\<^sup>r(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (\\Nat _)\\]:\n \\ x \\ \\\\<^sup>r('b) \\\\\\

\\\\\\\\ x mod 2 ^ LENGTH('b) \\ \\('b) @action to \\('b)\\\n \\ construct\\ \\x mod 2 ^ LENGTH('b) \\ \\('b)\\ \\. .\n\nlemma [\\reason 800 for \\_ \\ \\\\<^sup>r(_) \\\\\\

\\\\\\\\ _ \\ \\(_) \\\\\\ _ \\]:\n \\ Threshold_Cost 4\n\\ \\

\\\\\\\\\\\\ x mod 2 ^ LENGTH('b) = y\n\\ x \\ \\\\<^sup>r('b) \\\\\\

\\\\\\\\ y \\ \\('b) \\\n \\ to \\\\(_)\\ \\. .\n\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\ Word(_) \\\\\\ _\\]:\n \\ Threshold_Cost 7\n\\ \\

\\\\\\\\\\\\ y = of_nat x\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ y \\ Word('b) \\\\\\ x < 2 ^ LENGTH('b)\\\n for y :: \\'b::len word\\\n \\ to \\\\\\<^sup>r(_)\\ \\. .\n\nlemma [\n \\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (Word _)\\,\n \\inhabitance_rule\n]:\n \\x \\ \\('b) \\\\\\

\\\\\\\\ (of_nat x :: 'b::len word) \\ Word('b) \\\\\\ x < 2 ^ LENGTH('b)\n @action to Word('b)\\\n \\ \\. .\n\n\nlemma [\\reason 1200 for \\_ \\ Word(_) \\\\\\

\\\\\\\\ _ \\ \\(_) \\\\\\ _\\]:\n \\ Threshold_Cost 9\n\\ \\

\\\\\\\\\\\\ y = unat x\n\\ x \\ Word('b) \\\\\\

\\\\\\\\ y \\ \\('b)\\\n for x :: \\'b::len word\\\n \\ to \\\\\\<^sup>r('b)\\ \\. .\n\nlemma [\\reason 1200 for \\_ \\ Word _ \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (\\Nat _)\\]:\n \\ x \\ Word('b) \\\\\\

\\\\\\\\ unat x \\ \\('b) @action to \\('b)\\\n for x :: \\'b::len word\\ \\ \\. .\n\n\n\nlemma [\\reason 1000]:\n \\\\SemType (x \\ \\('b)) int('b)\\\n \\ to \\Word _\\ \\. .\n\nlemma [\\reason 1000]:\n \\\\Zero int('b) \\('b) 0\\\n \\ \\0 \\ Word('b)\\ \\. .\n\nlemma [\\reason 1000]:\n \"\\Equal (\\('b::len)) (\\x y. True) (=)\"\n \\ to \\Word('b)\\ \\ using \\lemmata of_nat_inverse by blast .\n\n\nsubsection \\Integer\\\n\ndefinition \\Int :: \"'b::len itself \\ (VAL, int) \\\"\n where [\\defs]: \"\\Int _ x = ((of_int x :: 'b word) \\ Word('b)\n \\\\\\\\ x \\ { -(2^(LENGTH('b)-1)) ..< 2^(LENGTH('b)-1)})\"\n\nsyntax \\Int_syntax :: \"type \\ (VAL, nat) \\\" (\"\\'(_')\")\n\ntranslations \"\\('x)\" == \"CONST \\Int TYPE('x)\"\n\nparse_ast_translation \\\n let open Ast\n in [(\\<^syntax_const>\\\\Int_syntax\\, (fn _ => fn [V] =>\n Appl [Constant \\<^const_syntax>\\\\Int\\, Appl [Constant \\<^syntax_const>\\_TYPE\\, add_sort V]]))] end\\\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\ Word(_) \\\\\\ _\\]:\n \" Threshold_Cost 7\n\\ \\

\\\\\\\\\\\\ y = of_int x\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ y \\ Word('b) \\\\\\ x \\ { -(2^(LENGTH('b)-1)) ..< 2^(LENGTH('b)-1)}\"\n \\ destruct\\ _ \\. .\n\nlemma [\n \\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to Word(_)\\,\n \\inhabitance_rule\n]:\n \\x \\ \\('b) \\\\\\

\\\\\\\\ (of_int x :: 'b::len word) \\ Word('b) \\\\\\ x \\ { -(2^(LENGTH('b)-1)) ..< 2^(LENGTH('b)-1)}\n @action to Word('b)\\\n \\ \\. .\n\nlemma [\\reason 800 for \\?x \\ Word(_) \\\\\\

\\\\\\\\ _ \\ \\(_) \\\\\\ _\\]:\n \" Threshold_Cost 9\n\\ \\

\\\\\\\\\\\\ y = sint x\n\\ x \\ Word('b) \\\\\\

\\\\\\\\ y \\ \\('b)\"\n for x :: \\'b::len word\\\n \\ construct\\ \\y \\ \\('b)\\\n affirm apply (simp add: \\y = sint x\\) using sint_greater_eq sint_less by blast\n \\. .\n\nlemma [\\reason 800 for \\_ \\ Word(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (Word _)\\]:\n \\ x \\ Word('b) \\\\\\

\\\\\\\\ sint x \\ \\('b) @action to Word('b) \\\n \\ \\. .\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to (\\Nat _)\\]:\n \\ \\

\\\\\\\\\\\\ 0 \\ x \\ x < 2 ^ (LENGTH('b)-1)\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ nat x \\ \\('b) @action to \\('b)\\\n \\ to \\Word('b)\\ \\\n by (smt (verit, del_insts) diff_le_self power_increasing_iff the_\\(1) unat_eq_nat_uint word_of_int_inverse) .\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\ \\(_) \\\\\\ _\\]:\n \\ Threshold_Cost 6\n\\ \\

\\\\\\\\\\\\ 0 \\ x \\ x < 2 ^ (LENGTH('b)-1) \\ y = nat x\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ y \\ \\('b)\\\n \\ to \\\\('b)\\ \\. .\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\\\\\ _ @action to \\(_)\\]:\n \\ \\

\\\\\\\\\\\\ x < 2 ^ (LENGTH('b)-1)\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ of_nat x \\ \\('b) @action to \\(_) \\\n \\ to \\Word('b)\\ \\\n by (metis One_nat_def id_apply the_\\(1) negative_zle of_int_eq_id of_nat_less_numeral_power_cancel_iff real_of_nat_eq_numeral_power_cancel_iff signed_of_nat signed_take_bit_int_eq_self_iff) .\n\nlemma [\\reason 800 for \\_ \\ \\(_) \\\\\\

\\\\\\\\ _ \\ \\(_) \\\\\\ _ \\]:\n \\ Threshold_Cost 5\n\\ \\

\\\\\\\\\\\\ x < 2 ^ (LENGTH('b)-1) \\ y = of_nat x\n\\ x \\ \\('b) \\\\\\

\\\\\\\\ y \\ \\('b) \\\n \\ to \\\\(_)\\ \\. .\n\nlemma [\\reason 1000]:\n \\\\SemType (x \\ \\('b)) int('b)\\ \\ to \\Word(_)\\ \\. .\n\nlemma [\\reason 1000]:\n \"\\Zero int('b) \\('b) 0\" \\ \\0 \\ Word('b)\\ \\. .\n\n\nlemma [\\reason 1000]:\n \"\\Equal \\('b) (\\x y. True) (=)\"\n \\ to \\Word(_)\\ \\\n by (metis One_nat_def atLeastLessThan_iff the_\\lemmata signed_take_bit_int_eq_self_iff sint_sbintrunc') .\n\n\n\nsection \\Instructions\\\n\ndefinition op_const_int :: \"nat \\ nat \\ VAL proc\"\n where \"op_const_int bits const = Return (\\arg (V_int.mk (bits,const)))\"\n\n(* definition op_const_size_t :: \"nat \\ (VAL,VAL,'RES_N,'RES) proc\"\n where \"op_const_size_t c = \\M_assume (c < 2 ^ addrspace_bits)\n \\ Return (\\arg (V_int.mk (addrspace_bits,c)))\"\n \\ \\ `op_const_size_t` checks the overflow during the compilation towards certain decided platform. \\\n*)\n\ndefinition op_add :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_add bits =\n \\M_caseV (\\vb va.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n Return (\\arg (V_int.mk (bits, ((val_a + val_b) mod 2^bits))))\n )))\"\n\ndefinition op_sub :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_sub bits =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_int.mk (bits, ((2^bits + val_b - val_a) mod 2^bits))))\n )))\"\n\ndefinition op_umul :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_umul bits =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_int.mk (bits, ((val_b * val_a) mod 2^bits))))\n )))\"\n\ndefinition op_udiv :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_udiv bits =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n \\M_assert (val_a \\ 0) \\\n Return (\\arg (V_int.mk (bits, (val_b div val_a))))\n )))\"\n\ndefinition op_sdiv :: \"'b::len itself \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_sdiv _ =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) va (\\val_a::'b word.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) vb (\\val_b::'b word.\n \\M_assert (val_a \\ 0) \\\n Return (\\arg (V_int.mk (LENGTH('b), unat (val_b sdiv val_a))))\n )))\"\n\ndefinition op_umod :: \"'b::len itself \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_umod _ =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) va (\\val_a::'b word.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) vb (\\val_b::'b word.\n \\M_assert (val_a \\ 0) \\\n Return (\\arg (V_int.mk (LENGTH('b), unat (val_b mod val_a))))\n )))\"\n\ndefinition op_smod :: \"'b::len itself \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_smod _ =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) va (\\val_a::'b word.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) vb (\\val_b::'b word.\n \\M_assert (val_a \\ 0) \\\n Return (\\arg (V_int.mk (LENGTH('b), unat (val_b smod val_a))))\n )))\"\n\ndefinition op_lshr :: \"nat \\ nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_lshr b_b b_a =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk b_a) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk b_b) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_int.mk (b_b, (val_b div 2 ^ val_a))))\n )))\"\n\ndefinition op_lshl :: \"nat \\ nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_lshl b_b b_a =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk b_a) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk b_b) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_int.mk (b_b, (val_b * 2 ^ val_a mod 2^b_b))))\n )))\"\n\ndefinition op_ult :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_ult bits =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_bool.mk (val_b < val_a)))\n )))\"\n\ndefinition op_ule :: \"nat \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_ule bits =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) va (\\val_a.\n \\M_getV (T_int.mk bits) (snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_bool.mk (val_b \\ val_a)))\n )))\"\n\ndefinition op_slt :: \"'b::len itself \\ (VAL \\ VAL, VAL) proc'\"\n where \"op_slt _ =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) va (\\val_a::'b word.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_bool.mk (val_b (VAL \\ VAL, VAL) proc'\"\n where \"op_sle _ =\n \\M_caseV (\\va vb.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) va (\\val_a::'b word.\n \\M_getV (T_int.mk LENGTH('b)) (of_nat o snd o V_int.dest) vb (\\val_b.\n Return (\\arg (V_bool.mk (val_b \\s val_a)))\n )))\"\n\n\ndefinition op_cast_uint :: \\'b1::len itself \\ 'b2::len itself \\ (VAL, VAL) proc'\\\n where \\op_cast_uint _ _ va =\n \\M_getV (T_int.mk LENGTH('b1)) (of_nat o snd o V_int.dest) va (\\val::'b1 word.\n Return (\\arg (V_int.mk (LENGTH('b2), unat (Word.cast val :: 'b2 word)))))\\\n\ndefinition op_cast_int :: \\'b1::len itself \\ 'b2::len itself \\ (VAL, VAL) proc'\\\n where \\op_cast_int _ _ va =\n \\M_getV (T_int.mk LENGTH('b1)) (of_nat o snd o V_int.dest) va (\\val::'b1 word.\n Return (\\arg (V_int.mk (LENGTH('b2), unat (Word.scast val :: 'b2 word)))))\\\n\n\nsection \\Abstraction of Instructions\\\n\nsubsection \\Arithmetic Operations\\\n\nsubsubsection \\Constant Integer\\\n\nlemma op_const_word_\\app[\\synthesis 300]:\n \\ Simplify literal n (unat n')\n\\ \\

\\\\\\ op_const_int LENGTH('b) n \\ Void \\ \\\\\\ n' \\ Word('b) \\ \\\n unfolding op_const_int_def Premise_def Simplify_def\n by (rule, simp add: \\expns)\n\nlemma op_const_nat_\\app[\\synthesis 200]:\n \\ \\

\\\\\\\\\\\\ n < 2 ^ LENGTH('b)\n\\ Simplify literal n' n\n\\ \\

\\\\\\ op_const_int LENGTH('b::len) n' \\ Void \\ \\\\\\ n \\ \\('b) \\ \\\n \\ have [simp]: \\unat (word_of_nat n :: 'b word) = n\\ using \\ of_nat_inverse by blast\n ;; op_const_word_\\app[where 'b='b and n'=\\of_nat n\\ and n=n']\n affirm by (simp add: \\n' = n\\)\n \\ by simp .\n\nlemma op_const_natR_\\app[\\synthesis 120]:\n \\ Simplify literal n' (n mod 2 ^ LENGTH('b))\n\\ \\

\\\\\\ op_const_int LENGTH('b::len) n' \\ Void \\ \\\\\\ n \\ \\\\<^sup>r('b) \\ \\\n \\ op_const_word[where 'b='b and n=n' and n' = \\of_nat n\\, simplified]\n affirm by (simp add: the_\\(1) unat_of_nat)\n \\ by (simp add: unat_of_nat) .\n\nlemma [\\reason 50\n for \\Synthesis_Parse (numeral ?n::nat) (?X :: ?'ret \\ assn)\\\n \\Synthesis_Parse (1::nat) (?X :: ?'ret \\ assn)\\\n \\Synthesis_Parse (0::nat) (?X :: ?'ret \\ assn)\\\n]:\n \\ Synthesis_Parse (n \\ \\(32)) X\n\\ Synthesis_Parse n X\\\n for X :: \\'ret \\ assn\\\n unfolding Synthesis_Parse_def ..\n\n\n(* lemma op_const_size_t:\n \\\\

\\\\\\ op_const_size_t n \\ Void \\ \\\\\\ n \\ Size \\\\\n unfolding op_const_size_t_def Premise_def\n by (\\reason, simp add: \\expns Big_def) *)\n\n\n(* lemma [\\reason 1200\n for \\\\

\\\\\\ ?f \\ ?X' \\ ?X\\ SYNTHESIS \\\\\\ (numeral ?n) \\ Size \\ \\\\\\\\\\\\ ?E @action synthesis ?G\\\n \\\\

\\\\\\ ?f \\ ?X' \\ ?X\\ SYNTHESIS \\\\\\ 0 \\ Size \\ \\\\\\\\\\\\ ?E @action synthesis ?G\\\n \\\\

\\\\\\ ?f \\ ?X' \\ ?X\\ SYNTHESIS \\\\\\ 1 \\ Size \\ \\\\\\\\\\\\ ?E @action synthesis ?G\\\n]:\n \\\\

\\\\\\ op_const_size_t n \\ R \\ R\\ SYNTHESIS \\\\\\ n \\ Size \\ @action synthesis G\\\n unfolding Synthesis_def Action_Tag_def\n using op_const_size_t[THEN \\frame, simplified] . *)\n\n\nsubsubsection \\Addition\\\n\nlemma op_add_word_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x + y \\ _\\ (1200)]:\n \\ \\

\\\\\\ op_add LENGTH('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x + y \\ Word('b) \\\\\n unfolding op_add_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule,\n simp add: \\expns, rule, simp add: \\expns unat_word_ariths)\n\nlemma op_add_nat_\\app[\\overload add,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x + y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x + y < 2 ^ LENGTH('b)\n\\ \\

\\\\\\ op_add LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x + y \\ \\('b) \\ \\\n \\ op_add_word[where 'b='b] \\ using \\ by (metis of_nat_add of_nat_inverse) .\n\nlemma op_add_natR_\\app[\\overload add,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\\\<^sup>r('b)\\ y \\ \\\\\\ \\\\<^sup>r('b)\\ \\ \\\\v. x + y \\ _\\ (1200)]:\n \\ \\

\\\\\\ op_add LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\\\<^sup>r('b)\\ y \\ \\\\\\[vy] \\\\<^sup>r('b) \\ \\\\\\ x + y \\ \\\\<^sup>r('b) \\ \\\n \\ op_add_word[where 'b='b] \\\n by (metis of_nat_add unat_of_nat) .\n\nlemma op_add_int_\\app[\\overload add,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x + y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x + y \\ {- (2 ^ (LENGTH('b)-1)) ..< 2 ^ (LENGTH('b)-1) }\n\\ \\

\\\\\\ op_add LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x + y \\ \\('b) \\ \\\n \\ op_add_word[where 'b='b] \\\n by (metis atLeastLessThan_iff the_\\(1) of_int_add signed_take_bit_int_eq_self_iff sint_sbintrunc') .\n\ndeclare op_add_word_\\app[\\overload add]\n\n\nsubsubsection \\Subtraction\\\n\nlemma op_sub_word_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x - y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_sub LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x - y \\ Word('b) \\\\\n unfolding op_sub_def Premise_def\n apply (cases vx; cases vy; simp, rule, rule, simp add: \\expns,\n rule, simp add: \\expns, rule, simp add: \\expns)\n by (metis (no_types, opaque_lifting) Nat.add_diff_assoc2 add.commute add_0 mod_add_self2 unat_of_nat unat_sub_if' unsigned_0 word_arith_nat_add)\n\nlemma op_sub_nat_\\app[\\overload sub,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x - y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ x\n\\ \\

\\\\\\ op_sub LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x - y \\ \\('b) \\\\\n \\ op_sub_word[where 'b='b] \\\n by (metis diff_le_self le_unat_uoi the_\\(1) the_\\lemmata(2) of_nat_diff of_nat_inverse) .\n\nlemma op_sub_natR_\\app[\\overload sub,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\\\<^sup>r('b)\\ y \\ \\\\\\ \\\\<^sup>r('b)\\ \\ \\\\v. x - y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ x\n\\ \\

\\\\\\ op_sub LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\\\<^sup>r('b)\\ y \\ \\\\\\[vy] \\\\<^sup>r('b) \\ \\\\\\ x - y \\ \\\\<^sup>r('b) \\\\\n \\ op_sub_word[where 'b='b] \\\n by (metis of_nat_diff the_\\(1) unat_of_nat) .\n\nlemma op_sub_int_\\app[\\overload sub,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x - y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x - y \\ {- (2 ^ (LENGTH('b)-1)) ..< 2 ^ (LENGTH('b)-1) }\n\\ \\

\\\\\\ op_sub LENGTH('b::len) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x - y \\ \\('b) \\\\\n \\ op_sub_word[where 'b='b] \\\n by (metis atLeastLessThan_iff the_\\(1) signed_take_bit_int_eq_self_iff sint_sbintrunc' wi_hom_sub) .\n\ndeclare op_sub_word_\\app[\\overload sub]\n\n\nsubsubsection \\Multiplication\\\n\n\nlemma op_mul_word_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x * y \\ _\\ (1200)]:\n \\ \\

\\\\\\ op_umul LENGTH('b::len) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x * y \\ Word('b) \\\\\n unfolding op_umul_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns,\n rule, simp add: \\expns, rule, simp add: \\expns unat_word_ariths(2))\n\nlemma op_mul_nat_\\app[\\overload mul,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x * y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x * y < 2^LENGTH('b)\n\\ \\

\\\\\\ op_umul LENGTH('b::len) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x * y \\ \\('b) \\\\\n \\ op_mul_word[where 'b='b] \\\n using the_\\(1) of_nat_inverse by fastforce .\n\nlemma op_mul_natR_\\app[\\overload mul,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\\\<^sup>r('b)\\ y \\ \\\\\\ \\\\<^sup>r('b)\\ \\ \\\\v. x * y \\ _\\ (1200)]:\n \\ \\

\\\\\\ op_umul LENGTH('b::len) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\\\<^sup>r('b)\\ y \\ \\\\\\[vy] \\\\<^sup>r('b) \\ \\\\\\ x * y \\ \\\\<^sup>r('b) \\\\\n \\ op_mul_word[where 'b='b] \\\n by (metis of_nat_mult unat_of_nat) .\n\nlemma op_mul_int_\\app[\\overload mul,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x * y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x * y \\ {- (2 ^ (LENGTH('b)-1)) ..< 2 ^ (LENGTH('b)-1) }\n\\ \\

\\\\\\ op_umul LENGTH('b::len) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x * y \\ \\('b) \\\\\n \\ op_mul_word[where 'b='b] \\\n by (metis atLeastLessThan_iff the_\\(1) nle_le of_int_mult signed_take_bit_int_greater_eq_self_iff signed_take_bit_int_less_eq_self_iff sint_sbintrunc') .\n\ndeclare op_mul_word_\\app[\\overload mul]\n\n\nsubsubsection \\Division\\\n\nlemma op_udiv_word_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x div y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_udiv LENGTH('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x div y \\ Word('b) \\\\\n unfolding op_udiv_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule, simp add: \\expns, rule,\n rule \\M_assert, simp add: \\expns unat_gt_0, rule, simp add: \\expns unat_div)\n\nlemma op_div_nat_\\app[\\overload div,\n \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x div y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_udiv LENGTH('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x div y \\ \\('b) \\\\\n \\ op_udiv_word_\\app[where 'b='b]\n affirm using More_Word.of_nat_0 the_\\(2) the_\\(3) by blast\n \\ by (simp add: the_\\lemmata(1) the_\\lemmata(2) of_nat_inverse unat_div) .\n\ndeclare op_udiv_word_\\app[\\overload div]\n\n\nlemma op_sdiv_word_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x sdiv y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_sdiv TYPE('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x sdiv y \\ Word('b) \\\\\n unfolding op_sdiv_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule, simp add: \\expns, rule,\n rule \\M_assert, simp add: \\expns unat_gt_0, rule, simp add: \\expns)\n\nlemma op_div_int_\\app[\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x sdiv y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x \\ - (2 ^ (LENGTH('b) - 1)) \\ y \\ 0\n\\ \\

\\\\\\ op_sdiv TYPE('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x sdiv y \\ \\('b) \\\\\n \\ op_sdiv_word\n affirm by (metis atLeastLessThan_iff signed_0 sint_of_int_eq the_\\(2) the_\\(3)) \\\n unfolding sdiv_word_def\n proof simp\n have [simp]: \\sint (word_of_int x::'b word) = x\\\n by (meson atLeastLessThan_iff sint_of_int_eq the_\\lemmata(2))\n have [simp]: \\sint (word_of_int y::'b word) = y\\\n by (meson atLeastLessThan_iff sint_of_int_eq the_\\lemmata(1))\n\n have t1: \\x < 2 ^ (LENGTH('b)-1)\\\n using atLeastLessThan_iff the_\\lemmata(2) by blast\n have t2: \\- (2 ^ (LENGTH('b)-1)) < x\\\n by (meson Orderings.order_eq_iff atLeastLessThan_iff leI the_\\(3) the_\\lemmata(2))\n have t3: \\\\x\\ < 2 ^ (LENGTH('b)-1)\\\n using t1 t2 by linarith\n have t4: \\\\x sdiv y\\ < 2 ^ (LENGTH('b)-1)\\\n unfolding signed_divide_int_def\n apply (cases \\x = 0\\) apply simp\n apply (cases \\y = 0\\) apply simp\n apply (simp add: abs_mult)\n by (smt (verit, best) One_nat_def int_div_less_self int_div_same_is_1 pos_imp_zdiv_neg_iff t3)\n show \\x sdiv y = sint (word_of_int (sint (word_of_int x::'b word) sdiv sint (word_of_int y::'b word))::'b word)\\\n apply simp\n by (smt (verit, del_insts) t4 sint_of_int_eq)\n qed .\n\nlemma op_div_int_fail[\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x div y \\ _\\ (1200)]:\n \\ FAIL TEXT(\\About integers, there is no rule available for unsigned division\\ (div)\n \\Please use the signed\\ (sdiv)\n \\Note the C semantics is\\ (sdiv) \\instead of\\ (div)\n \\and they are different in negative numbers\\)\n\\ \\

\\\\\\ fail \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x div y \\ \\('b) \\\\\n by blast\n\nsubsubsection \\Modulo\\\n\nlemma op_umod_word_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x mod y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_umod TYPE('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x mod y \\ Word('b) \\\\\n unfolding op_umod_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule, simp add: \\expns, rule,\n rule \\M_assert, simp add: \\expns unat_gt_0, rule, simp add: \\expns unat_div)\n\nlemma op_mod_nat_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x mod y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_umod TYPE('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x mod y \\ \\('b) \\\\\n \\ op_umod_word\n affirm using More_Word.of_nat_0 the_\\(2) the_\\(3) by blast \\\n by (simp add: of_nat_inverse the_\\lemmata(1) the_\\lemmata(2) unat_mod_distrib) .\n\nlemma op_smod_word_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\ v. x smod y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_smod TYPE('b) (\\V_pair vy vx) \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x smod y \\ Word('b) \\\\\n unfolding op_smod_def Premise_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule, simp add: \\expns, rule,\n rule \\M_assert, simp add: \\expns unat_gt_0, rule, simp add: \\expns unat_div)\n\nlemma op_mod_int_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x smod y \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ y \\ 0\n\\ \\

\\\\\\ op_smod TYPE('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x smod y \\ \\('b) \\\\\n \\ op_smod_word\n affirm by (metis atLeastLessThan_iff signed_0 sint_of_int_eq the_\\(2) the_\\(3)) \\\n by (metis One_nat_def atLeastLessThan_iff signed_take_bit_int_eq_self_iff sint_sbintrunc' smod_word_def smod_word_max smod_word_min the_\\lemmata(1) the_\\lemmata(2)) .\n\nlemma op_mod_int_fail[\\synthesis 100]:\n \\ FAIL TEXT(\\About integers, there is no rule available for unsigned modulo\\ (mod)\n \\Please use the signed\\ (smod)\n \\Note the C semantics is\\ (smod) \\instead of\\ (mod)\n \\and they are different in negative numbers\\)\n\\ \\

\\\\\\ fail \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x mod y \\ \\('b) \\\\\n by blast\n\n\nsubsubsection \\Shift\\\n\nparagraph \\Right Shift\\\n\nlemma op_lshr_word_pre_\\app:\n \\\\

\\\\\\ op_lshr LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] Word('ba) \\ y \\ \\\\\\[v2] Word('bb) \\ \\\\\\ drop_bit (unat y) x \\ Word('ba) \\\\\n unfolding op_lshr_def\n apply (cases v1; cases v2; simp; rule, rule, simp add: \\expns, rule, simp add: \\expns,\n rule, simp add: \\expns)\n by (metis drop_bit_eq_div unat_drop_bit_eq)\n\nlemma op_lshr_word_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. drop_bit y x \\ _\\ (1200)]:\n \\\\

\\\\\\ op_lshr LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] Word('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ drop_bit y x \\ Word('ba) \\\\\n \\ op_lshr_word_pre_\\app[where 'ba='ba and 'bb='bb] \\\n by (simp add: the_\\(1) unat_of_nat) .\n\nlemma op_lshr_nat_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. drop_bit y x \\ _\\ (1200)]:\n \\\\

\\\\\\ op_lshr LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] \\('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ drop_bit y x \\ \\('ba) \\\\\n \\ op_lshr_word_\\app[where 'ba='ba and 'bb='bb] \\\n by (simp add: the_\\(1) of_nat_inverse unat_drop_bit_eq) .\n\n\nlemma drop_bit_nat_le:\n \\drop_bit n x \\ x\\ for x :: nat\n using div_le_dividend drop_bit_nat_def by presburger\n\nlemma op_lshr_int_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. drop_bit y x \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ 0 \\ x\n\\ \\

\\\\\\ op_lshr LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] \\('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ drop_bit y x \\ \\('ba) \\\\\n \\\n ;; $v1\n have t1: \\x < 2 ^ (LENGTH('ba) - 1)\\\n using atLeastLessThan_iff the_\\(1) by blast\n have t2: \\nat x < 2 ^ (LENGTH('ba) - 1)\\\n using t1 by fastforce\n\n ;; $v1 $v2 op_lshr_nat_\\app[where 'ba='ba and 'bb='bb]\n \\\n apply rule+ using t2 drop_bit_nat_le order.strict_trans1 apply blast\n apply (simp add: of_nat_drop_bit the_\\(2)) .. .\n\nparagraph \\Left Shift\\\n\nlemma op_lshl_word_pre_\\app:\n \\\\

\\\\\\ op_lshl LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] Word('ba) \\ y \\ \\\\\\[v2] Word('bb) \\ \\\\\\ push_bit (unat y) x \\ Word('ba) \\\\\n unfolding op_lshl_def\n apply (cases v1; cases v2; simp; rule, rule, simp add: \\expns, rule, simp add: \\expns,\n rule, simp add: \\expns)\n by (simp add: push_bit_nat_def take_bit_nat_def unsigned_push_bit_eq)\n\nlemma op_lshl_word_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. push_bit y x \\ _\\ (1200)]:\n \\\\

\\\\\\ op_lshl LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] Word('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ push_bit y x \\ Word('ba) \\\\\n \\ op_lshl_word_pre_\\app[where 'ba='ba and 'bb='bb] \\\n by (simp add: of_nat_inverse the_\\(1)) .\n\nlemma op_lshl_nat_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. push_bit y x \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x * 2 ^ y < LENGTH('ba)\n\\ \\

\\\\\\ op_lshl LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] \\('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ push_bit y x \\ \\('ba) \\\\\n \\ op_lshl_word_\\app[where 'ba='ba and 'bb='bb] \\\n unfolding push_bit_nat_def\n by (metis dual_order.strict_trans less_exp of_nat_inverse of_nat_push_bit push_bit_eq_mult the_\\(1)) .\n\nlemma op_lshl_natR_\\app\n [\\synthesis for _ (100)\n and \\x \\ \\\\\\ \\\\<^sup>r('ba) \\ y \\ \\\\\\ \\('bb)\\ \\ \\\\v. push_bit y x \\ _\\ (1200)]:\n \\ \\

\\\\\\\\\\\\ x * 2 ^ y < LENGTH('ba)\n\\ \\

\\\\\\ op_lshl LENGTH('ba) LENGTH('bb) (\\V_pair v2 v1)\n \\ x \\ \\\\\\[v1] \\\\<^sup>r('ba) \\ y \\ \\\\\\[v2] \\('bb) \\ \\\\\\ push_bit y x \\ \\\\<^sup>r('ba) \\\\\n \\ op_lshl_word_\\app[where 'ba='ba and 'bb='bb] \\\n unfolding push_bit_nat_def\n by (metis push_bit_nat_def push_bit_of_nat unat_of_nat) .\n\n\nsubsubsection \\Comparison\\\n\nparagraph \\Unsigned Less Than\\\n\nlemma op_lt_word_\\app\n [\\overload less, \\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x < y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_ult LENGTH('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x < y \\ \\ \\\\\n unfolding op_ult_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule,\n simp add: \\expns, rule, simp add: \\expns word_less_nat_alt)\n\nlemma op_lt_nat_\\app\n [\\overload less, \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x < y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_ult LENGTH('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x < y \\ \\ \\\\\n \\ op_lt_word[where 'b='b] \\\n by (simp add: of_nat_inverse the_\\lemmata(1) the_\\lemmata(2) word_less_nat_alt) .\n\nparagraph \\Signed Less Than\\\n\nlemma op_slt_word_\\app\n [\\overload less, \\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x _\\ (1200)]:\n \\\\

\\\\\\ op_slt TYPE('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] Word('b)\\ y \\ \\\\\\[vy] Word('b) \\ \\\\\\ x \\ \\\\\n unfolding op_slt_def\n by (cases vx; cases vy; simp, rule, rule, simp add: \\expns, rule,\n simp add: \\expns, rule, simp add: \\expns)\n\nlemma op_slt_int_\\app\n [\\overload less, \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x < y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_slt TYPE('b) (\\V_pair vy vx)\n \\ x \\ \\\\\\[vx] \\('b)\\ y \\ \\\\\\[vy] \\('b) \\ \\\\\\ x < y \\ \\ \\\\\n \\ op_slt_word[where 'b='b] \\\n by (metis antisym_conv1 atLeastLessThan_iff linorder_not_le signed_take_bit_int_greater_eq_self_iff signed_take_bit_int_less_eq_self_iff sint_sbintrunc' the_\\lemmata(1) the_\\lemmata(2) word_sless_alt) .\n\n\nparagraph \\Unsigned Less Equal\\\n\nlemma op_le_word_\\app\n [\\overload less_equal, \\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x \\ y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_ule LENGTH('b) (\\V_pair rawy rawx)\n \\ x \\ \\\\\\[rawx] Word('b)\\ y \\ \\\\\\[rawy] Word('b) \\ \\\\\\ x \\ y \\ \\ \\\\\n unfolding op_ule_def\n by (cases rawx; cases rawy; simp, rule, rule, simp add: \\expns,\n rule, simp add: \\expns, rule, simp add: \\expns word_le_nat_alt)\n\nlemma op_le_nat_\\app\n [\\overload less_equal, \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x \\ y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_ule LENGTH('b) (\\V_pair rawy rawx)\n \\ x \\ \\\\\\[rawx] \\('b)\\ y \\ \\\\\\[rawy] \\('b) \\ \\\\\\ x \\ y \\ \\ \\\\\n \\ op_le_word \\\n by (simp add: the_\\lemmata(1) the_\\lemmata(2) unat_of_nat word_le_nat_alt) .\n\nparagraph \\Signed Less Equal\\\n\nlemma op_sle_word_\\app\n [\\overload less_equal, \\synthesis for _ (100)\n and \\x \\ \\\\\\ Word('b)\\ y \\ \\\\\\ Word('b)\\ \\ \\\\v. x \\s y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_sle TYPE('b) (\\V_pair rawy rawx)\n \\ x \\ \\\\\\[rawx] Word('b)\\ y \\ \\\\\\[rawy] Word('b) \\ \\\\\\ x \\s y \\ \\ \\\\\n unfolding op_sle_def\n by (cases rawx; cases rawy; simp, rule, rule, simp add: \\expns,\n rule, simp add: \\expns, rule, simp add: \\expns word_le_nat_alt)\n\nlemma op_le_int_\\app\n [\\overload less_equal, \\synthesis for _ (100)\n and \\x \\ \\\\\\ \\('b)\\ y \\ \\\\\\ \\('b)\\ \\ \\\\v. x \\ y \\ _\\ (1200)]:\n \\\\

\\\\\\ op_sle TYPE('b) (\\V_pair rawy rawx)\n \\ x \\ \\\\\\[rawx] \\('b)\\ y \\ \\\\\\[rawy] \\('b) \\ \\\\\\ x \\ y \\ \\ \\\\\n \\ op_sle_word \\\n by (metis atLeastLessThan_iff signed_take_bit_int_eq_self_iff sint_sbintrunc' the_\\lemmata(1) the_\\lemmata(2) word_sle_eq) .\n\nsubsubsection \\Cast\\\n\nlemma op_cast_uint_word_\\app:\n \\\\

\\\\\\ op_cast_uint TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] Word('ba) \\ Word.cast x \\ \\\\\\ Word('bb) \\\\\n unfolding op_cast_uint_def\n by (cases v, simp, rule, simp add: \\expns, rule, simp add: \\expns)\n\nlemma op_cast_nat_\\app:\n \\\\

\\\\\\ op_cast_uint TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] \\('ba) \\ take_bit LENGTH('bb) x \\ \\\\\\ \\('bb) \\\\\n \\ op_cast_uint_word[where 'bb='bb] \\\n by (simp add: of_nat_inverse the_\\lemmata unsigned_ucast_eq) .\n\nlemma op_cast_int_word_\\app:\n \\\\

\\\\\\ op_cast_int TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] Word('ba) \\ Word.scast x \\ \\\\\\ Word('bb) \\\\\n unfolding op_cast_int_def\n by (cases v, simp, rule, simp add: \\expns, rule, simp add: \\expns)\n\nlemma op_cast_int_\\app:\n \\\\

\\\\\\ op_cast_int TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] \\('ba) \\ signed_take_bit (LENGTH('bb)-1) x \\ \\\\\\ \\('bb) \\\\\n \\ op_cast_int_word[where 'bb='bb] \\\n by (metis One_nat_def atLeastLessThan_iff signed_scast_eq signed_take_bit_int_eq_self sint_sbintrunc' the_\\lemmata) .\n\nlemma op_upcast_nat_\\app:\n \\ \\\\\\\\

\\\\\\ LENGTH('ba) \\ LENGTH('bb)\n\\ \\

\\\\\\ op_cast_uint TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] \\('ba) \\ x \\ \\\\\\ \\('bb) \\\\\n \\ have [useful]: \\x < 2 ^ LENGTH('ba)\\ using \\ by blast\n ;; $v op_cast_nat[where 'bb='bb] \\\n by (metis le_antisym take_bit_nat_eq_self take_bit_nat_less_eq_self take_bit_tightened_less_eq_nat the_\\(2) the_\\(3)) .\n\nlemma op_upcast_int_\\app:\n \\ \\\\\\\\

\\\\\\ LENGTH('ba) \\ LENGTH('bb)\n\\ \\

\\\\\\ op_cast_int TYPE('ba) TYPE('bb) v\n \\ x \\ \\\\\\[v] \\('ba) \\ x \\ \\\\\\ \\('bb) \\\\\n \\ op_cast_int_word[where 'bb='bb] \\\n proof simp\n have t1: \\is_up (Word.scast :: 'ba word \\ 'bb word)\\\n using is_up that(1) by blast\n show \\x = sint (Word.scast (word_of_int x :: 'ba word) :: 'bb word)\\\n by (metis atLeastLessThan_iff sint_of_int_eq sint_up_scast t1 the_\\lemmata)\n qed .\n\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics/PhiSem_Machine_Integer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.2676774010433199}} {"text": "(* Title: Safe OCL\n Author: Denis Nikiforov, March 2019\n Maintainer: Denis Nikiforov \n License: LGPL\n*)\nsection \\Object Model\\\ntheory Object_Model\n imports \"HOL-Library.Extended_Nat\" Finite_Map_Ext\nbegin\n\ntext \\\n The section defines a generic object model.\\\n\n(*** Type Synonyms **********************************************************)\n\nsubsection \\Type Synonyms\\\n\ntype_synonym attr = String.literal\ntype_synonym assoc = String.literal\ntype_synonym role = String.literal\ntype_synonym oper = String.literal\ntype_synonym param = String.literal\ntype_synonym elit = String.literal\n\ndatatype param_dir = In | Out | InOut\n\ntype_synonym 'c assoc_end = \"'c \\ nat \\ enat \\ bool \\ bool\"\ntype_synonym 't param_spec = \"param \\ 't \\ param_dir\"\ntype_synonym ('t, 'e) oper_spec =\n \"oper \\ 't \\ 't param_spec list \\ 't \\ bool \\ 'e option\"\n\ndefinition \"assoc_end_class :: 'c assoc_end \\ 'c \\ fst\"\ndefinition \"assoc_end_min :: 'c assoc_end \\ nat \\ fst \\ snd\"\ndefinition \"assoc_end_max :: 'c assoc_end \\ enat \\ fst \\ snd \\ snd\"\ndefinition \"assoc_end_ordered :: 'c assoc_end \\ bool \\ fst \\ snd \\ snd \\ snd\"\ndefinition \"assoc_end_unique :: 'c assoc_end \\ bool \\ snd \\ snd \\ snd \\ snd\"\n\ndefinition \"oper_name :: ('t, 'e) oper_spec \\ oper \\ fst\"\ndefinition \"oper_context :: ('t, 'e) oper_spec \\ 't \\ fst \\ snd\"\ndefinition \"oper_params :: ('t, 'e) oper_spec \\ 't param_spec list \\ fst \\ snd \\ snd\"\ndefinition \"oper_result :: ('t, 'e) oper_spec \\ 't \\ fst \\ snd \\ snd \\ snd\"\ndefinition \"oper_static :: ('t, 'e) oper_spec \\ bool \\ fst \\ snd \\ snd \\ snd \\ snd\"\ndefinition \"oper_body :: ('t, 'e) oper_spec \\ 'e option \\ snd \\ snd \\ snd \\ snd \\ snd\"\n\ndefinition \"param_name ::'t param_spec \\ param \\ fst\"\ndefinition \"param_type ::'t param_spec \\ 't \\ fst \\ snd\"\ndefinition \"param_dir ::'t param_spec \\ param_dir \\ snd \\ snd\"\n\ndefinition \"oper_in_params op \\\n filter (\\p. param_dir p = In \\ param_dir p = InOut) (oper_params op)\"\n\ndefinition \"oper_out_params op \\\n filter (\\p. param_dir p = Out \\ param_dir p = InOut) (oper_params op)\"\n\nsubsection \\Attributes\\\n\ninductive owned_attribute' where\n \"\\ |\\| fmdom attributes \\\n fmlookup attributes \\ = Some attrs\\<^sub>\\ \\\n fmlookup attrs\\<^sub>\\ attr = Some \\ \\\n owned_attribute' attributes \\ attr \\\"\n\ninductive attribute_not_closest where\n \"owned_attribute' attributes \\' attr \\' \\\n \\ \\ \\' \\\n \\' < \\ \\\n attribute_not_closest attributes \\ attr \\ \\\"\n\ninductive closest_attribute where\n \"owned_attribute' attributes \\ attr \\ \\\n \\ \\ \\ \\\n \\ attribute_not_closest attributes \\ attr \\ \\ \\\n closest_attribute attributes \\ attr \\ \\\"\n\ninductive closest_attribute_not_unique where\n \"closest_attribute attributes \\ attr \\' \\' \\\n \\ \\ \\' \\ \\ \\ \\' \\\n closest_attribute_not_unique attributes \\ attr \\ \\\"\n\ninductive unique_closest_attribute where\n \"closest_attribute attributes \\ attr \\ \\ \\\n \\ closest_attribute_not_unique attributes \\ attr \\ \\ \\\n unique_closest_attribute attributes \\ attr \\ \\\"\n\nsubsection \\Association Ends\\\n\ninductive role_refer_class where\n \"role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n assoc_end_class end = \\ \\\n role_refer_class ends \\ role\"\n\ninductive association_ends' where\n \"\\ |\\| classes \\\n assoc |\\| fmdom associations \\\n fmlookup associations assoc = Some ends \\\n role_refer_class ends \\ from \\\n role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n role \\ from \\\n association_ends' classes associations \\ from role end\"\n\ninductive association_ends_not_unique' where\n \"association_ends' classes associations \\ from role end\\<^sub>1 \\\n association_ends' classes associations \\ from role end\\<^sub>2 \\\n end\\<^sub>1 \\ end\\<^sub>2 \\\n association_ends_not_unique' classes associations\"\n\ninductive owned_association_end' where\n \"association_ends' classes associations \\ from role end \\\n owned_association_end' classes associations \\ None role end\"\n| \"association_ends' classes associations \\ from role end \\\n owned_association_end' classes associations \\ (Some from) role end\"\n\ninductive association_end_not_closest where\n \"owned_association_end' classes associations \\' from role end' \\\n \\ \\ \\' \\\n \\' < \\ \\\n association_end_not_closest classes associations \\ from role \\ end\"\n\ninductive closest_association_end where\n \"owned_association_end' classes associations \\ from role end \\\n \\ \\ \\ \\\n \\ association_end_not_closest classes associations \\ from role \\ end \\\n closest_association_end classes associations \\ from role \\ end\"\n\ninductive closest_association_end_not_unique where\n \"closest_association_end classes associations \\ from role \\' end' \\\n \\ \\ \\' \\ end \\ end' \\\n closest_association_end_not_unique classes associations \\ from role \\ end\"\n\ninductive unique_closest_association_end where\n \"closest_association_end classes associations \\ from role \\ end \\\n \\ closest_association_end_not_unique classes associations \\ from role \\ end \\\n unique_closest_association_end classes associations \\ from role \\ end\"\n\nsubsection \\Association Classes\\\n\ninductive referred_by_association_class'' where\n \"fmlookup association_classes \\ = Some assoc \\\n fmlookup associations assoc = Some ends \\\n role_refer_class ends \\ from \\\n referred_by_association_class'' association_classes associations \\ from \\\"\n\ninductive referred_by_association_class' where\n \"referred_by_association_class'' association_classes associations \\ from \\ \\\n referred_by_association_class' association_classes associations \\ None \\\"\n| \"referred_by_association_class'' association_classes associations \\ from \\ \\\n referred_by_association_class' association_classes associations \\ (Some from) \\\"\n\ninductive association_class_not_closest where\n \"referred_by_association_class' association_classes associations \\' from \\ \\\n \\ \\ \\' \\\n \\' < \\ \\\n association_class_not_closest association_classes associations \\ from \\ \\\"\n\ninductive closest_association_class where\n \"referred_by_association_class' association_classes associations \\ from \\ \\\n \\ \\ \\ \\\n \\ association_class_not_closest association_classes associations \\ from \\ \\ \\\n closest_association_class association_classes associations \\ from \\ \\\"\n\ninductive closest_association_class_not_unique where\n \"closest_association_class association_classes associations \\ from \\ \\' \\\n \\ \\ \\' \\\n closest_association_class_not_unique\n association_classes associations \\ from \\ \\\"\n\ninductive unique_closest_association_class where\n \"closest_association_class association_classes associations \\ from \\ \\ \\\n \\ closest_association_class_not_unique\n association_classes associations \\ from \\ \\ \\\n unique_closest_association_class association_classes associations \\ from \\ \\\"\n\nsubsection \\Association Class Ends\\\n\ninductive association_class_end' where\n \"fmlookup association_classes \\ = Some assoc \\\n fmlookup associations assoc = Some ends \\\n fmlookup ends role = Some end \\\n association_class_end' association_classes associations \\ role end\"\n\ninductive association_class_end_not_unique where\n \"association_class_end' association_classes associations \\ role end' \\\n end \\ end' \\\n association_class_end_not_unique association_classes associations \\ role end\"\n\ninductive unique_association_class_end where\n \"association_class_end' association_classes associations \\ role end \\\n \\ association_class_end_not_unique\n association_classes associations \\ role end \\\n unique_association_class_end association_classes associations \\ role end\"\n\nsubsection \\Operations\\\n\ninductive any_operation' where\n \"op |\\| fset_of_list operations \\\n oper_name op = name \\\n \\ \\ oper_context op \\\n list_all2 (\\\\ param. \\ \\ param_type param) \\ (oper_in_params op) \\\n any_operation' operations \\ name \\ op\"\n\ninductive operation' where\n \"any_operation' operations \\ name \\ op \\\n \\ oper_static op \\\n operation' operations \\ name \\ op\"\n\ninductive operation_not_unique where\n \"operation' operations \\ name \\ oper' \\\n oper \\ oper' \\\n operation_not_unique operations \\ name \\ oper\"\n\ninductive unique_operation where\n \"operation' operations \\ name \\ oper \\\n \\ operation_not_unique operations \\ name \\ oper \\\n unique_operation operations \\ name \\ oper\"\n\ninductive operation_defined' where\n \"unique_operation operations \\ name \\ oper \\\n operation_defined' operations \\ name \\\"\n\ninductive static_operation' where\n \"any_operation' operations \\ name \\ op \\\n oper_static op \\\n static_operation' operations \\ name \\ op\"\n\ninductive static_operation_not_unique where\n \"static_operation' operations \\ name \\ oper' \\\n oper \\ oper' \\\n static_operation_not_unique operations \\ name \\ oper\"\n\ninductive unique_static_operation where\n \"static_operation' operations \\ name \\ oper \\\n \\ static_operation_not_unique operations \\ name \\ oper \\\n unique_static_operation operations \\ name \\ oper\"\n\ninductive static_operation_defined' where\n \"unique_static_operation operations \\ name \\ oper \\\n static_operation_defined' operations \\ name \\\"\n\nsubsection \\Literals\\\n\ninductive has_literal' where\n \"fmlookup literals e = Some lits \\\n lit |\\| lits \\\n has_literal' literals e lit\"\n\n(*** Definition *************************************************************)\n\nsubsection \\Definition\\\n\nlocale object_model =\n fixes classes :: \"'a :: semilattice_sup fset\"\n and attributes :: \"'a \\\\<^sub>f attr \\\\<^sub>f 't :: order\"\n and associations :: \"assoc \\\\<^sub>f role \\\\<^sub>f 'a assoc_end\"\n and association_classes :: \"'a \\\\<^sub>f assoc\"\n and operations :: \"('t, 'e) oper_spec list\"\n and literals :: \"'n \\\\<^sub>f elit fset\"\n assumes assoc_end_min_less_eq_max:\n \"assoc |\\| fmdom associations \\\n fmlookup associations assoc = Some ends \\\n role |\\| fmdom ends \\\n fmlookup ends role = Some end \\\n assoc_end_min end \\ assoc_end_max end\"\n assumes association_ends_unique:\n \"association_ends' classes associations \\ from role end\\<^sub>1 \\\n association_ends' classes associations \\ from role end\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\nbegin\n\nabbreviation \"owned_attribute \\\n owned_attribute' attributes\"\n\nabbreviation \"attribute \\\n unique_closest_attribute attributes\"\n\nabbreviation \"association_ends \\\n association_ends' classes associations\"\n\nabbreviation \"owned_association_end \\\n owned_association_end' classes associations\"\n\nabbreviation \"association_end \\\n unique_closest_association_end classes associations\"\n\nabbreviation \"referred_by_association_class \\\n unique_closest_association_class association_classes associations\"\n\nabbreviation \"association_class_end \\\n unique_association_class_end association_classes associations\"\n\nabbreviation \"operation \\\n unique_operation operations\"\n\nabbreviation \"operation_defined \\\n operation_defined' operations\"\n\nabbreviation \"static_operation \\\n unique_static_operation operations\"\n\nabbreviation \"static_operation_defined \\\n static_operation_defined' operations\"\n\nabbreviation \"has_literal \\\n has_literal' literals\"\n\nend\n\ndeclare operation_defined'.simps [simp]\ndeclare static_operation_defined'.simps [simp]\n\ndeclare has_literal'.simps [simp]\n\n(*** Properties *************************************************************)\n\nsubsection \\Properties\\\n\nlemma (in object_model) attribute_det:\n \"attribute \\ attr \\\\<^sub>1 \\\\<^sub>1 \\\n attribute \\ attr \\\\<^sub>2 \\\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2\"\n by (meson closest_attribute_not_unique.intros unique_closest_attribute.cases)\n\nlemma (in object_model) attribute_self_or_inherited:\n \"attribute \\ attr \\ \\ \\ \\ \\ \\\"\n by (meson closest_attribute.cases unique_closest_attribute.cases)\n\nlemma (in object_model) attribute_closest:\n \"attribute \\ attr \\ \\ \\\n owned_attribute \\' attr \\ \\\n \\ \\ \\' \\ \\ \\' < \\\"\n by (meson attribute_not_closest.intros closest_attribute.cases\n unique_closest_attribute.cases)\n\n\nlemma (in object_model) association_end_det:\n \"association_end \\ from role \\\\<^sub>1 end\\<^sub>1 \\\n association_end \\ from role \\\\<^sub>2 end\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\n by (meson closest_association_end_not_unique.intros\n unique_closest_association_end.cases)\n\nlemma (in object_model) association_end_self_or_inherited:\n \"association_end \\ from role \\ end \\ \\ \\ \\\"\n by (meson closest_association_end.cases unique_closest_association_end.cases)\n\nlemma (in object_model) association_end_closest:\n \"association_end \\ from role \\ end \\\n owned_association_end \\' from role end \\\n \\ \\ \\' \\ \\ \\' < \\\"\n by (meson association_end_not_closest.intros closest_association_end.cases\n unique_closest_association_end.cases)\n\n\nlemma (in object_model) association_class_end_det:\n \"association_class_end \\ role end\\<^sub>1 \\\n association_class_end \\ role end\\<^sub>2 \\ end\\<^sub>1 = end\\<^sub>2\"\n by (meson association_class_end_not_unique.intros unique_association_class_end.cases)\n\n\nlemma (in object_model) operation_det:\n \"operation \\ name \\ oper\\<^sub>1 \\\n operation \\ name \\ oper\\<^sub>2 \\ oper\\<^sub>1 = oper\\<^sub>2\"\n by (meson operation_not_unique.intros unique_operation.cases)\n\nlemma (in object_model) static_operation_det:\n \"static_operation \\ name \\ oper\\<^sub>1 \\\n static_operation \\ name \\ oper\\<^sub>2 \\ oper\\<^sub>1 = oper\\<^sub>2\"\n by (meson static_operation_not_unique.intros unique_static_operation.cases)\n\n(*** Code Setup *************************************************************)\n\nsubsection \\Code Setup\\\n\nlemma fmember_code_predI [code_pred_intro]:\n \"x |\\| xs\" if \"Predicate_Compile.contains (fset xs) x\"\n using that by (simp add: Predicate_Compile.contains_def fmember.rep_eq)\n\ncode_pred fmember\n by (simp add: Predicate_Compile.contains_def fmember.rep_eq)\n\ncode_pred unique_closest_attribute .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ o \\ o \\ o \\ o \\ bool) association_ends' .\n\ncode_pred association_ends_not_unique' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ o \\ o \\ o \\ o \\ bool) owned_association_end' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ o \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ o \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ o \\ o \\ bool) closest_association_end .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ o \\ o \\ i \\ i \\ bool ) closest_association_end_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ i \\ o \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ i \\ bool,\n i \\ i \\ i \\ i \\ i \\ o \\ o \\ bool) unique_closest_association_end .\n\ncode_pred unique_closest_association_class .\n\ncode_pred association_class_end' .\n\ncode_pred association_class_end_not_unique .\n\ncode_pred unique_association_class_end .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) any_operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool) operation_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) unique_operation .\n\ncode_pred operation_defined' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) static_operation' .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool) static_operation_not_unique .\n\ncode_pred (modes:\n i \\ i \\ i \\ i \\ i \\ bool,\n i \\ i \\ i \\ i \\ o \\ bool) unique_static_operation .\n\ncode_pred static_operation_defined' .\n\ncode_pred has_literal' .\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Safe_OCL/Object_Model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558603, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.26767740104331983}} {"text": "(* Title: HOL/Auth/n_mesi_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_lemma_invs_on_rules imports n_mesi_lemma_inv__1_on_rules n_mesi_lemma_inv__2_on_rules n_mesi_lemma_inv__3_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.2676773948429908}} {"text": "(* Title: ZF/UNITY/Mutex.thy\n Author: Sidi O Ehmety, Computer Laboratory\n Copyright 2001 University of Cambridge\n\nBased on \"A Family of 2-Process Mutual Exclusion Algorithms\" by J Misra.\n\nVariables' types are introduced globally so that type verification\nreduces to the usual ZF typechecking \\ an ill-tyed expression will\nreduce to the empty set.\n*)\n\nsection\\Mutual Exclusion\\\n\ntheory Mutex\nimports SubstAx\nbegin\n\ntext\\Based on \"A Family of 2-Process Mutual Exclusion Algorithms\" by J Misra\n\nVariables' types are introduced globally so that type verification reduces to\nthe usual ZF typechecking: an ill-tyed expressions reduce to the empty set.\n\\\n\nabbreviation \"p \\ Var([0])\"\nabbreviation \"m \\ Var([1])\"\nabbreviation \"n \\ Var([0,0])\"\nabbreviation \"u \\ Var([0,1])\"\nabbreviation \"v \\ Var([1,0])\"\n\naxiomatization where \\ \\Type declarations\\\n p_type: \"type_of(p)=bool \\ default_val(p)=0\" and\n m_type: \"type_of(m)=int \\ default_val(m)=#0\" and\n n_type: \"type_of(n)=int \\ default_val(n)=#0\" and\n u_type: \"type_of(u)=bool \\ default_val(u)=0\" and\n v_type: \"type_of(v)=bool \\ default_val(v)=0\"\n\ndefinition\n (** The program for process U **)\n \"U0 \\ {\\s,t\\:state*state. t = s(u:=1, m:=#1) \\ s`m = #0}\"\n\ndefinition\n \"U1 \\ {\\s,t\\:state*state. t = s(p:= s`v, m:=#2) \\ s`m = #1}\"\n\ndefinition\n \"U2 \\ {\\s,t\\:state*state. t = s(m:=#3) \\ s`p=0 \\ s`m = #2}\"\n\ndefinition\n \"U3 \\ {\\s,t\\:state*state. t=s(u:=0, m:=#4) \\ s`m = #3}\"\n\ndefinition\n \"U4 \\ {\\s,t\\:state*state. t = s(p:=1, m:=#0) \\ s`m = #4}\"\n\n\n (** The program for process V **)\n\ndefinition\n \"V0 \\ {\\s,t\\:state*state. t = s (v:=1, n:=#1) \\ s`n = #0}\"\n\ndefinition\n \"V1 \\ {\\s,t\\:state*state. t = s(p:=not(s`u), n:=#2) \\ s`n = #1}\"\n\ndefinition\n \"V2 \\ {\\s,t\\:state*state. t = s(n:=#3) \\ s`p=1 \\ s`n = #2}\"\n\ndefinition\n \"V3 \\ {\\s,t\\:state*state. t = s (v:=0, n:=#4) \\ s`n = #3}\"\n\ndefinition\n \"V4 \\ {\\s,t\\:state*state. t = s (p:=0, n:=#0) \\ s`n = #4}\"\n\ndefinition\n \"Mutex \\ mk_program({s:state. s`u=0 \\ s`v=0 \\ s`m = #0 \\ s`n = #0},\n {U0, U1, U2, U3, U4, V0, V1, V2, V3, V4}, Pow(state*state))\"\n\n (** The correct invariants **)\n\ndefinition\n \"IU \\ {s:state. (s`u = 1\\(#1 $\\ s`m \\ s`m $\\ #3))\n \\ (s`m = #3 \\ s`p=0)}\"\n\ndefinition\n \"IV \\ {s:state. (s`v = 1 \\ (#1 $\\ s`n \\ s`n $\\ #3))\n \\ (s`n = #3 \\ s`p=1)}\"\n\n (** The faulty invariant (for U alone) **)\n\ndefinition\n \"bad_IU \\ {s:state. (s`u = 1 \\ (#1 $\\ s`m \\ s`m $\\ #3))\\\n (#3 $\\ s`m \\ s`m $\\ #4 \\ s`p=0)}\"\n\n\n(** Variables' types **)\n\ndeclare p_type [simp] u_type [simp] v_type [simp] m_type [simp] n_type [simp]\n\nlemma u_value_type: \"s \\ state \\s`u \\ bool\"\n unfolding state_def\napply (drule_tac a = u in apply_type, auto)\ndone\n\nlemma v_value_type: \"s \\ state \\ s`v \\ bool\"\n unfolding state_def\napply (drule_tac a = v in apply_type, auto)\ndone\n\nlemma p_value_type: \"s \\ state \\ s`p \\ bool\"\n unfolding state_def\napply (drule_tac a = p in apply_type, auto)\ndone\n\nlemma m_value_type: \"s \\ state \\ s`m \\ int\"\n unfolding state_def\napply (drule_tac a = m in apply_type, auto)\ndone\n\nlemma n_value_type: \"s \\ state \\s`n \\ int\"\n unfolding state_def\napply (drule_tac a = n in apply_type, auto)\ndone\n\ndeclare p_value_type [simp] u_value_type [simp] v_value_type [simp]\n m_value_type [simp] n_value_type [simp]\n\ndeclare p_value_type [TC] u_value_type [TC] v_value_type [TC]\n m_value_type [TC] n_value_type [TC]\n\n\n\ntext\\Mutex is a program\\\n\nlemma Mutex_in_program [simp,TC]: \"Mutex \\ program\"\nby (simp add: Mutex_def)\n\n\ndeclare Mutex_def [THEN def_prg_Init, simp]\ndeclare Mutex_def [program]\n\ndeclare U0_def [THEN def_act_simp, simp]\ndeclare U1_def [THEN def_act_simp, simp]\ndeclare U2_def [THEN def_act_simp, simp]\ndeclare U3_def [THEN def_act_simp, simp]\ndeclare U4_def [THEN def_act_simp, simp]\n\ndeclare V0_def [THEN def_act_simp, simp]\ndeclare V1_def [THEN def_act_simp, simp]\ndeclare V2_def [THEN def_act_simp, simp]\ndeclare V3_def [THEN def_act_simp, simp]\ndeclare V4_def [THEN def_act_simp, simp]\n\ndeclare U0_def [THEN def_set_simp, simp]\ndeclare U1_def [THEN def_set_simp, simp]\ndeclare U2_def [THEN def_set_simp, simp]\ndeclare U3_def [THEN def_set_simp, simp]\ndeclare U4_def [THEN def_set_simp, simp]\n\ndeclare V0_def [THEN def_set_simp, simp]\ndeclare V1_def [THEN def_set_simp, simp]\ndeclare V2_def [THEN def_set_simp, simp]\ndeclare V3_def [THEN def_set_simp, simp]\ndeclare V4_def [THEN def_set_simp, simp]\n\ndeclare IU_def [THEN def_set_simp, simp]\ndeclare IV_def [THEN def_set_simp, simp]\ndeclare bad_IU_def [THEN def_set_simp, simp]\n\nlemma IU: \"Mutex \\ Always(IU)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety, auto)\ndone\n\nlemma IV: \"Mutex \\ Always(IV)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety)\ndone\n\n(*The safety property: mutual exclusion*)\nlemma mutual_exclusion: \"Mutex \\ Always({s \\ state. \\(s`m = #3 \\ s`n = #3)})\"\napply (rule Always_weaken)\napply (rule Always_Int_I [OF IU IV], auto)\ndone\n\n(*The bad invariant FAILS in V1*)\n\nlemma less_lemma: \"\\x$<#1; #3 $\\ x\\ \\ P\"\napply (drule_tac j = \"#1\" and k = \"#3\" in zless_zle_trans)\napply (drule_tac [2] j = x in zle_zless_trans, auto)\ndone\n\nlemma \"Mutex \\ Always(bad_IU)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety, auto)\napply (subgoal_tac \"#1 $\\ #3\")\napply (drule_tac x = \"#1\" and y = \"#3\" in zle_trans, auto)\napply (simp (no_asm) add: not_zless_iff_zle [THEN iff_sym])\napply auto\n(*Resulting state: n=1, p=false, m=4, u=false.\n Execution of V1 (the command of process v guarded by n=1) sets p:=true,\n violating the invariant!*)\noops\n\n\n\n(*** Progress for U ***)\n\nlemma U_F0: \"Mutex \\ {s \\ state. s`m=#2} Unless {s \\ state. s`m=#3}\"\nby (unfold op_Unless_def Mutex_def, safety)\n\nlemma U_F1:\n \"Mutex \\ {s \\ state. s`m=#1} \\w {s \\ state. s`p = s`v \\ s`m = #2}\"\nby (unfold Mutex_def, ensures U1)\n\nlemma U_F2: \"Mutex \\ {s \\ state. s`p =0 \\ s`m = #2} \\w {s \\ state. s`m = #3}\"\napply (cut_tac IU)\napply (unfold Mutex_def, ensures U2)\ndone\n\nlemma U_F3: \"Mutex \\ {s \\ state. s`m = #3} \\w {s \\ state. s`p=1}\"\napply (rule_tac B = \"{s \\ state. s`m = #4}\" in LeadsTo_Trans)\n unfolding Mutex_def\n apply (ensures U3)\napply (ensures U4)\ndone\n\n\nlemma U_lemma2: \"Mutex \\ {s \\ state. s`m = #2} \\w {s \\ state. s`p=1}\"\napply (rule LeadsTo_Diff [OF LeadsTo_weaken_L\n Int_lower2 [THEN subset_imp_LeadsTo]])\napply (rule LeadsTo_Trans [OF U_F2 U_F3], auto)\napply (auto dest!: p_value_type simp add: bool_def)\ndone\n\nlemma U_lemma1: \"Mutex \\ {s \\ state. s`m = #1} \\w {s \\ state. s`p =1}\"\nby (rule LeadsTo_Trans [OF U_F1 [THEN LeadsTo_weaken_R] U_lemma2], blast)\n\nlemma eq_123: \"i \\ int \\ (#1 $\\ i \\ i $\\ #3) \\ (i=#1 | i=#2 | i=#3)\"\napply auto\napply (auto simp add: neq_iff_zless)\napply (drule_tac [4] j = \"#3\" and i = i in zle_zless_trans)\napply (drule_tac [2] j = i and i = \"#1\" in zle_zless_trans)\napply (drule_tac j = i and i = \"#1\" in zle_zless_trans, auto)\napply (rule zle_anti_sym)\napply (simp_all (no_asm_simp) add: zless_add1_iff_zle [THEN iff_sym])\ndone\n\n\nlemma U_lemma123: \"Mutex \\ {s \\ state. #1 $\\ s`m \\ s`m $\\ #3} \\w {s \\ state. s`p=1}\"\nby (simp add: eq_123 Collect_disj_eq LeadsTo_Un_distrib U_lemma1 U_lemma2 U_F3)\n\n\n(*Misra's F4*)\nlemma u_Leadsto_p: \"Mutex \\ {s \\ state. s`u = 1} \\w {s \\ state. s`p=1}\"\nby (rule Always_LeadsTo_weaken [OF IU U_lemma123], auto)\n\n\n(*** Progress for V ***)\n\nlemma V_F0: \"Mutex \\ {s \\ state. s`n=#2} Unless {s \\ state. s`n=#3}\"\nby (unfold op_Unless_def Mutex_def, safety)\n\nlemma V_F1: \"Mutex \\ {s \\ state. s`n=#1} \\w {s \\ state. s`p = not(s`u) \\ s`n = #2}\"\nby (unfold Mutex_def, ensures \"V1\")\n\nlemma V_F2: \"Mutex \\ {s \\ state. s`p=1 \\ s`n = #2} \\w {s \\ state. s`n = #3}\"\napply (cut_tac IV)\napply (unfold Mutex_def, ensures \"V2\")\ndone\n\nlemma V_F3: \"Mutex \\ {s \\ state. s`n = #3} \\w {s \\ state. s`p=0}\"\napply (rule_tac B = \"{s \\ state. s`n = #4}\" in LeadsTo_Trans)\n unfolding Mutex_def\n apply (ensures V3)\napply (ensures V4)\ndone\n\nlemma V_lemma2: \"Mutex \\ {s \\ state. s`n = #2} \\w {s \\ state. s`p=0}\"\napply (rule LeadsTo_Diff [OF LeadsTo_weaken_L\n Int_lower2 [THEN subset_imp_LeadsTo]])\napply (rule LeadsTo_Trans [OF V_F2 V_F3], auto)\napply (auto dest!: p_value_type simp add: bool_def)\ndone\n\nlemma V_lemma1: \"Mutex \\ {s \\ state. s`n = #1} \\w {s \\ state. s`p = 0}\"\nby (rule LeadsTo_Trans [OF V_F1 [THEN LeadsTo_weaken_R] V_lemma2], blast)\n\nlemma V_lemma123: \"Mutex \\ {s \\ state. #1 $\\ s`n \\ s`n $\\ #3} \\w {s \\ state. s`p = 0}\"\nby (simp add: eq_123 Collect_disj_eq LeadsTo_Un_distrib V_lemma1 V_lemma2 V_F3)\n\n(*Misra's F4*)\nlemma v_Leadsto_not_p: \"Mutex \\ {s \\ state. s`v = 1} \\w {s \\ state. s`p = 0}\"\nby (rule Always_LeadsTo_weaken [OF IV V_lemma123], auto)\n\n\n(** Absence of starvation **)\n\n(*Misra's F6*)\nlemma m1_Leadsto_3: \"Mutex \\ {s \\ state. s`m = #1} \\w {s \\ state. s`m = #3}\"\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\napply (rule_tac [2] U_F2)\napply (simp add: Collect_conj_eq)\napply (subst Un_commute)\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\n apply (rule_tac [2] PSP_Unless [OF v_Leadsto_not_p U_F0])\napply (rule U_F1 [THEN LeadsTo_weaken_R], auto)\napply (auto dest!: v_value_type simp add: bool_def)\ndone\n\n\n(*The same for V*)\nlemma n1_Leadsto_3: \"Mutex \\ {s \\ state. s`n = #1} \\w {s \\ state. s`n = #3}\"\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\napply (rule_tac [2] V_F2)\napply (simp add: Collect_conj_eq)\napply (subst Un_commute)\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\n apply (rule_tac [2] PSP_Unless [OF u_Leadsto_p V_F0])\napply (rule V_F1 [THEN LeadsTo_weaken_R], auto)\napply (auto dest!: u_value_type simp add: bool_def)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/UNITY/Mutex.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984434543457, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2675492217271728}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ProcParEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2007-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Procedures as Parameters using Statespaces\"\ntheory ProcParExSP imports \"../Vcg\" begin\n\n\n\n\n\n\n\nlemma conseq_exploit_pre':\n \"\\\\s \\ S. \\,\\ \\ ({s} \\ P) c Q,A\\\n \\\n \\,\\\\ (P \\ S)c Q,A\"\n apply (rule HoarePartialDef.Conseq)\n apply clarify\n by (metis IntI insertI1 subset_refl)\n\nlemma conseq_exploit_pre'':\n \"\\\\Z. \\s \\ S Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S Z)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\nlemma conseq_exploit_pre''':\n \"\\\\s \\ S. \\Z. \\,\\ \\ ({s} \\ P Z) c (Q Z),(A Z)\\\n \\\n \\Z. \\,\\\\ (P Z \\ S)c (Q Z),(A Z)\"\n apply (rule allI)\n apply (rule conseq_exploit_pre')\n apply blast\n done\n\n\nprocedures compare(i::nat,j::nat|r::bool) \"NoBody\"\n \n\nprint_locale! compare_signature\n\n\ncontext compare_impl\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\r :== CALL compare(\\i,\\j)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n(* FIXME: typing issue with modifies locale*)\nprocedures\n LEQ (i::nat,j::nat | r::bool) \"\\r :== \\i \\ \\j\"\n LEQ_spec: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) \\\\r = (\\<^bsup>\\\\<^esup>i \\ \\<^bsup>\\\\<^esup>j)\\\"\n\n LEQ_modifies: \"\\\\. \\\\ {\\} PROC LEQ(\\i,\\j,\\r) {t. t may_only_modify_globals \\ in []}\"\n\n\n\ndefinition mx:: \"('a \\ 'a \\ bool) \\ 'a \\ 'a \\ 'a\"\n where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures (imports compare_signature)\n Max (compare::string, n::nat, m::nat | k::nat) \n where b::bool\n in\n \"\\b :== DYNCALL \\compare(\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\"\n\n Max_spec: \"\\leq. \\\\. \\\\ \n ({\\} \\ {s. (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})})\n PROC Max(\\compare,\\n,\\m,\\k)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n\ncontext Max_spec\nbegin\nthm Max_spec\nend\ncontext Max_impl\nbegin\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\b :== DYNCALL \\compare(\\n,\\m)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\ (\\\\. \\\\{\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n fix \\:: \"('a, 'b, 'c, 'd) stateSP_scheme\" and s::\"('a, 'b, 'c, 'd) stateSP_scheme\" and leq\n assume compare_spec: \n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \\\\r = leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j\\\"\n \n assume compare_modifies:\n \"\\\\. \\\\{\\} \\r :== PROC \\<^bsup>s\\<^esup>compare(\\i,\\j) \n {t. t may_only_modify_globals \\ in []}\"\n\n show \"\\\\({s} \\ {\\})\n \\b :== DYNCALL \\compare (\\n,\\m);;\n IF \\b THEN \\k :== \\n ELSE \\k :== \\m FI\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\n apply vcg\n apply (clarsimp simp add: mx_def)\n done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\\\ leq. \\\\ \n ({\\} \\ \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \n \\(\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq \\<^bsup>\\\\<^esup>i \\<^bsup>\\\\<^esup>j)\\) \\ \n (\\\\. \\\\ {\\} \\r :== PROC \\compare(\\i,\\j) {t. t may_only_modify_globals \\ in []})\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nprint_locale Max_spec\n\n(* We have to rename the parameters of the compare procedure to match the LEQ procedure *)\nlocale Max_test = Max_spec where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_spec + LEQ_modifies\n\nlemma (in Max_test) \n shows\n \"\\\\ {\\} \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) \\<^bsup>\\\\<^esup>n \\<^bsup>\\\\<^esup>m\\\"\nproof -\n note Max_spec = Max_spec [where leq=\"(op \\)\"]\n show ?thesis\n apply vcg\n apply (clarsimp)\n apply (rule conjI)\n apply (rule LEQ_spec)\n apply (rule LEQ_modifies)\n done\nqed\n\n\n\n\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\n m leq. \\\\ \n (\\\\n=n \\ \\m=m\\ \\ \\\\n' m'. \\\\ \\\\i=n' \\ \\j=m'\\ \\r :== PROC \\compare(\\i,\\j) \\\\r = (leq n' m')\\\\)\n \\k :== PROC Max(\\compare,\\n,\\m)\n \\\\k = mx leq n m\\\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\n m. \\\\ \\\\i=n \\ \\j=m\\ PROC LEQ(\\i,\\j,\\r) \\\\r = (n \\ m)\\\"\n apply vcg\n apply simp\n done\n\n\nprint_locale Max_impl\nlocale Max_test' = Max_impl where\n i_'compare_' = i_'LEQ_' and\n j_'compare_' = j_'LEQ_' and\n r_'compare_' = r_'LEQ_'\n + LEQ_impl\nlemma (in Max_test') \n shows\n \"\\n m. \\\\ \\\\n=n \\ \\m=m\\ \\k :== CALL Max(LEQ_'proc,\\n,\\m) \\\\k = mx (op \\) n m\\\"\nproof -\n note Max_spec = Max_spec5\n show ?thesis\n apply vcg\n apply (rule_tac x=\"op \\\" in exI)\n apply clarsimp\n apply (rule LEQ_spec [rule_format])\n done\nqed\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/ex/ProcParExSP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5, "lm_q1q2_score": 0.26754921431330575}} {"text": "theory outEvenData\n\nimports bundle.SB\n begin\n\ntypedef outEven = \"{cout}\"\n by auto\n\ninstantiation outEven::\"{somechan,finite}\"\nbegin\ndefinition \"Rep = Rep_outEven\"\ninstance\n apply(standard)\n apply(auto simp add: Rep_outEven_def cEmpty_def)\n apply(auto simp add: ctype_empty_iff)\n using ctype_empty_iff\n apply (metis Rep_outEven cMsg.simps ex_in_conv insertE insert_iff)\n apply (meson Rep_outEven_inject injI) using cMsg.elims Rep_outEven apply simp\n using type_definition.Abs_image type_definition_outEven typedef_finite_UNIV by fastforce\nend\n\ndefinition \"Evenout \\ Abs_outEven cout\"\n\nfree_constructors outEven for \"Evenout\"\n by (metis(full_types) Abs_outEven_cases singletonD)\n\nlemma Andin1_rep [simp]: \"Rep (Evenout) = cout\"\n by (simp add: Abs_outEven_inverse Evenout_def Rep_outEven_def)\n\nfun outEvenChan::\"('bool::type \\ 'a::type) \\ 'bool \\ outEven \\ 'a\" where\n\"outEvenChan Cc1 bool Evenout = Cc1 bool\"\n\nabbreviation \"buildEvenoutSBE \\ outEvenChan (Untimed o \\)\" \n\nlemma buildevenout_ctype: \"buildEvenoutSBE a c \\ ctype (Rep c)\"\n sorry\n\nlemma buildevenout_inj: \"inj buildEvenoutSBE\"\n sorry\n\nlemma buildevenout_range: \"range (\\a. buildEvenoutSBE a c) = ctype (Rep c)\"\n sorry\n\nlemma buildevenout_surj: assumes \"sbElem_well (Some sbe)\"\n shows \"sbe \\ range buildEvenoutSBE\"\nproof -\n have ctypewell:\"\\ c. sbe c\\ ctype (Rep c)\"\n using assms by auto\n hence \"\\c. sbe c \\ range (\\a. buildEvenoutSBE a c)\"\n by (simp add: buildevenout_range)\n hence \"\\prod. sbe = buildEvenoutSBE prod\"\n apply(subst fun_eq_iff,auto)\n sorry\n thus ?thesis\n by auto\nqed\n\nabbreviation \"buildEvenoutSB \\ outEvenChan (Rep_cfun (smap (Untimed o \\)))\" \n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/evenA/outEvenData.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.26754761596883525}} {"text": "section \\Accessed Variables\\\ntheory SM_Variables\nimports \"../Refine/SM_Pid\"\nbegin\n\n subsection \"Expressions\"\n\n primrec udvars_of_exp :: \"exp \\ ident set\" where\n \"udvars_of_exp (e_var x) = {x}\"\n | \"udvars_of_exp (e_localvar x) = {}\"\n | \"udvars_of_exp (e_globalvar x) = {}\"\n | \"udvars_of_exp (e_const c) = {}\"\n | \"udvars_of_exp (e_bin bop e1 e2) = (udvars_of_exp e1) \\ (udvars_of_exp e2)\"\n | \"udvars_of_exp (e_un uop e) = (udvars_of_exp e)\"\n\n primrec lvars_of_exp :: \"exp \\ ident set\" where\n \"lvars_of_exp (e_var x) = {}\"\n | \"lvars_of_exp (e_localvar x) = {x}\"\n | \"lvars_of_exp (e_globalvar x) = {}\"\n | \"lvars_of_exp (e_const c) = {}\"\n | \"lvars_of_exp (e_bin bop e1 e2) = (lvars_of_exp e1) \\ (lvars_of_exp e2)\"\n | \"lvars_of_exp (e_un uop e) = (lvars_of_exp e)\"\n \n primrec gvars_of_exp :: \"exp \\ ident set\" where\n \"gvars_of_exp (e_var x) = {}\"\n | \"gvars_of_exp (e_localvar x) = {}\"\n | \"gvars_of_exp (e_globalvar x) = {x}\"\n | \"gvars_of_exp (e_const c) = {}\"\n | \"gvars_of_exp (e_bin bop e1 e2) = (gvars_of_exp e1) \\ (gvars_of_exp e2)\"\n | \"gvars_of_exp (e_un uop e) = (gvars_of_exp e)\"\n\n subsection \"Commands\"\n primrec join_cmd_exp :: \"'a \\ ('a \\ 'a \\ 'a) \\ (exp \\ 'a) \\ cmd \\ 'a\" where \n \"join_cmd_exp z join f (Assign c x e) = join (f c) (f e)\"\n | \"join_cmd_exp z join f (Assign_local c x e) = join (f c) (f e)\"\n | \"join_cmd_exp z join f (Assign_global c x e) = join (f c) (f e)\"\n | \"join_cmd_exp z join f (Test e) = f e\"\n | \"join_cmd_exp z join f (Skip) = z\"\n | \"join_cmd_exp z join f (Seq c1 c2) \n = join (join_cmd_exp z join f c1) (join_cmd_exp z join f c2)\"\n | \"join_cmd_exp z join f (Or c1 c2) \n = join (join_cmd_exp z join f c1) (join_cmd_exp z join f c2)\"\n | \"join_cmd_exp z join f (Break) = z\"\n | \"join_cmd_exp z join f (Continue) = z\"\n | \"join_cmd_exp z join f (Iterate c1 c2) \n = join (join_cmd_exp z join f c1) (join_cmd_exp z join f c2)\"\n | \"join_cmd_exp z join f (Invalid) = z\"\n\n abbreviation \"union_cmd_exp \\ join_cmd_exp {} (\\)\"\n abbreviation \"all_cmd_exp \\ join_cmd_exp True (\\)\"\n abbreviation \"ex_cmd_exp \\ join_cmd_exp False (\\)\"\n\n abbreviation \"ud_rvars_of_cmd == union_cmd_exp udvars_of_exp\"\n abbreviation \"g_rvars_of_cmd == union_cmd_exp gvars_of_exp\"\n abbreviation \"l_rvars_of_cmd == union_cmd_exp lvars_of_exp\"\n\n primrec ud_wvars_of_cmd :: \"cmd \\ ident set\" where \n \"ud_wvars_of_cmd (Assign c x e) = {x}\"\n | \"ud_wvars_of_cmd (Assign_local c x e) = {}\"\n | \"ud_wvars_of_cmd (Assign_global c x e) = {}\"\n | \"ud_wvars_of_cmd (Test e) = {}\"\n | \"ud_wvars_of_cmd (Skip) = {}\"\n | \"ud_wvars_of_cmd (Seq c1 c2) = (ud_wvars_of_cmd c1 \\ ud_wvars_of_cmd c2)\"\n | \"ud_wvars_of_cmd (Or c1 c2) = (ud_wvars_of_cmd c1 \\ ud_wvars_of_cmd c2)\"\n | \"ud_wvars_of_cmd (Break) = {}\"\n | \"ud_wvars_of_cmd (Continue) = {}\"\n | \"ud_wvars_of_cmd (Iterate c1 c2) = (ud_wvars_of_cmd c1 \\ ud_wvars_of_cmd c2)\"\n | \"ud_wvars_of_cmd (Invalid) = {}\"\n\n primrec l_wvars_of_cmd :: \"cmd \\ ident set\" where \n \"l_wvars_of_cmd (Assign c x e) = {}\"\n | \"l_wvars_of_cmd (Assign_local c x e) = {x}\"\n | \"l_wvars_of_cmd (Assign_global c x e) = {}\"\n | \"l_wvars_of_cmd (Test e) = {}\"\n | \"l_wvars_of_cmd (Skip) = {}\"\n | \"l_wvars_of_cmd (Seq c1 c2) = (l_wvars_of_cmd c1 \\ l_wvars_of_cmd c2)\"\n | \"l_wvars_of_cmd (Or c1 c2) = (l_wvars_of_cmd c1 \\ l_wvars_of_cmd c2)\"\n | \"l_wvars_of_cmd (Break) = {}\"\n | \"l_wvars_of_cmd (Continue) = {}\"\n | \"l_wvars_of_cmd (Iterate c1 c2) = (l_wvars_of_cmd c1 \\ l_wvars_of_cmd c2)\"\n | \"l_wvars_of_cmd (Invalid) = {}\"\n\n primrec g_wvars_of_cmd :: \"cmd \\ ident set\" where \n \"g_wvars_of_cmd (Assign c x e) = {}\"\n | \"g_wvars_of_cmd (Assign_local c x e) = {}\"\n | \"g_wvars_of_cmd (Assign_global c x e) = {x}\"\n | \"g_wvars_of_cmd (Test e) = {}\"\n | \"g_wvars_of_cmd (Skip) = {}\"\n | \"g_wvars_of_cmd (Seq c1 c2) = (g_wvars_of_cmd c1 \\ g_wvars_of_cmd c2)\"\n | \"g_wvars_of_cmd (Or c1 c2) = (g_wvars_of_cmd c1 \\ g_wvars_of_cmd c2)\"\n | \"g_wvars_of_cmd (Break) = {}\"\n | \"g_wvars_of_cmd (Continue) = {}\"\n | \"g_wvars_of_cmd (Iterate c1 c2) = (g_wvars_of_cmd c1 \\ g_wvars_of_cmd c2)\"\n | \"g_wvars_of_cmd (Invalid) = {}\"\n\n\n definition \"udvars_of_cmd c \\ ud_rvars_of_cmd c \\ ud_wvars_of_cmd c\"\n definition \"lvars_of_cmd c \\ l_rvars_of_cmd c \\ l_wvars_of_cmd c\"\n definition \"gvars_of_cmd c \\ g_rvars_of_cmd c \\ g_wvars_of_cmd c\"\n\n fun read_globals :: \"action \\ ident set\" where\n \"read_globals (AAssign c _ e) = gvars_of_exp c \\ udvars_of_exp c \\\n gvars_of_exp e \\ udvars_of_exp e\"\n | \"read_globals (AAssign_local c _ e) = gvars_of_exp c \\ udvars_of_exp c \\\n gvars_of_exp e \\ udvars_of_exp e\"\n | \"read_globals (AAssign_global c _ e) = gvars_of_exp c \\ udvars_of_exp c \\\n gvars_of_exp e \\ udvars_of_exp e\"\n | \"read_globals (ATest e) = gvars_of_exp e \\ udvars_of_exp e\"\n | \"read_globals (ASkip) = {}\"\n\n fun write_globals :: \"action \\ ident set\" where\n \"write_globals (AAssign _ x _) = {x}\"\n | \"write_globals (AAssign_local _ _ _) = {}\"\n | \"write_globals (AAssign_global _ x _) = {x}\"\n | \"write_globals (ATest e) = {}\"\n | \"write_globals (ASkip) = {}\"\n\n abbreviation \"rw_globals a \\ read_globals a \\ write_globals a\"\n\n definition eq_on :: \"ident set \\ valuation \\ valuation \\ bool\"\n where \"eq_on X s1 s2 \\ \\x\\X. s1 x = s2 x\"\n\n lemma eq_onD: \"\\eq_on X s1 s2; x\\X\\ \\ s1 x = s2 x\"\n unfolding eq_on_def by auto \n \n lemma \n eq_on_refl[simp]: \"eq_on X s s\" and\n eq_on_sym: \"eq_on X s1 s2 \\ eq_on X s2 s1\" and\n eq_on_sym_eq: \"eq_on X s1 s2 \\ eq_on X s2 s1\" and\n eq_on_trans[trans]: \"\\eq_on Xa s1 s2; eq_on Xb s2 s3\\ \n \\ eq_on (Xa\\Xb) s1 s3\" and\n eq_on_UNIV_eq[simp]: \"eq_on UNIV s1 s2 \\ s1=s2\" \n unfolding eq_on_def by auto\n\n lemma eq_on_join: \"\\eq_on X s s'; eq_on Y s s'\\ \\ eq_on (X\\Y) s s'\"\n unfolding eq_on_def by auto\n\n abbreviation ls_eq_on :: \"ident set \\ local_state \\ local_state \\ bool\"\n where \"ls_eq_on X ls1 ls2 \\ \n eq_on X (local_state.variables ls1) (local_state.variables ls2)\" \n\n abbreviation gs_eq_on :: \"ident set \\ global_state \\ global_state \\ bool\"\n where \"gs_eq_on X ls1 ls2 \\ \n eq_on X (global_state.variables ls1) (global_state.variables ls2)\" \n\n lemma eval_dep_vars:\n assumes \"gs_eq_on X gs gs'\" \n assumes \"udvars_of_exp e \\ X\" \"gvars_of_exp e \\ X\"\n shows \"eval_exp e (ls,gs) = eval_exp e (ls,gs')\"\n using assms\n apply (induction e)\n apply (auto split: option.splits simp: eq_on_def)\n done \n\n lemma en_dep_read:\n assumes \"gs_eq_on X gs gs'\"\n assumes \"read_globals a \\ X\"\n shows \"la_en' (ls,gs) a = la_en' (ls,gs') a\"\n using assms\n apply (cases a)\n apply (auto \n simp: la_en'_def eval_dep_vars \n split: Option.bind_splits)\n done\n\n lemma ex_mod_limit: \n assumes \"la_ex' (ls,gs) a = (ls',gs')\"\n shows \"gs_eq_on (-write_globals a) gs gs'\"\n using assms\n apply (cases a)\n apply (auto \n simp: la_ex'_def eval_dep_vars eq_on_def \n split: option.splits Option.bind_splits if_split_asm)\n done \n\n lemma ex_dep_pres:\n assumes \"gs_eq_on X gs1 gs2\"\n assumes \"read_globals a \\ X\"\n assumes \"la_ex' (ls,gs1) a = (ls1',gs1')\"\n assumes \"la_ex' (ls,gs2) a = (ls2',gs2')\"\n shows \"ls1'=ls2' \\ gs_eq_on X gs1' gs2'\"\n using assms\n apply (cases a)\n apply (auto \n simp: la_ex'_def eval_dep_vars eq_on_def\n split: Option.bind_splits option.splits bool.splits if_split_asm)\n done\n\n\n lemma ex_swap_global:\n assumes DJ:\n \"write_globals a1 \\ read_globals a2 = {}\"\n \"write_globals a2 \\ read_globals a1 = {}\"\n \"write_globals a1 \\ write_globals a2 = {}\"\n assumes EXA: \n \"la_ex' (ls1,gs) a1 = (ls1a, gsa)\"\n \"la_ex' (ls2, gsa) a2 = (ls2a, gsa')\"\n assumes EXB:\n \"la_ex' (ls2,gs) a2 = (ls2b, gsb)\"\n \"la_ex' (ls1, gsb) a1 = (ls1b, gsb')\"\n shows \"ls1a=ls1b\" \"ls2a=ls2b\" \"gsa'=gsb'\"\n proof -\n from ex_dep_pres[OF ex_mod_limit[OF EXB(1)] _ EXA(1) EXB(2)] DJ\n have \"ls1a = ls1b\" and E1: \"gs_eq_on (- write_globals a2) gsa gsb'\"\n by auto\n thus [simp]: \"ls1a=ls1b\" by simp\n \n from \n ex_dep_pres[OF \n ex_mod_limit[OF EXA(1), THEN eq_on_sym] _ EXA(2) EXB(1)\n ] DJ\n have \"ls2a = ls2b\" and E2: \"gs_eq_on (- write_globals a1) gsa' gsb\"\n by auto\n thus [simp]: \"ls2a=ls2b\" by simp\n\n from DJ have [simp]: \"- write_globals a1 \\ - write_globals a2 = UNIV\" \n by auto\n\n from eq_on_trans[OF E2 ex_mod_limit[OF EXB(2)]]\n have \"gs_eq_on (- write_globals a1) gsa' gsb'\" by simp\n also from eq_on_trans[OF ex_mod_limit[OF EXA(2), THEN eq_on_sym] E1]\n have \"gs_eq_on (- write_globals a2) gsa' gsb'\" by simp\n finally (eq_on_join) have \"gs_eq_on UNIV gsa' gsb'\" by simp\n thus \"gsa' = gsb'\" \n apply (cases gsa', cases gsb')\n apply simp\n done\n qed\n\n lemma ex_pres_en:\n assumes EX: \"la_ex' (ls1,gs) a1 = (ls1',gs')\"\n assumes DJ: \"write_globals a1 \\ read_globals a2 = {}\"\n shows \"la_en' (ls2,gs') a2 = la_en' (ls2,gs) a2\"\n using en_dep_read[OF ex_mod_limit[OF EX], of a2] DJ by auto\n\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Analysis/SM_Variables.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.26754760904809805}} {"text": "theory Post_ISSUER\n imports\n \"Bounded_Deducibility_Security.Compositional_Reasoning\"\n \"Post_Observation_Setup_ISSUER\"\n \"Post_Value_Setup_ISSUER\"\nbegin\n\nsubsubsection \\Issuer declassification bound\\\n\ntext \\We verify that a group of users of some node \\i\\,\nallowed to take normal actions to the system and observe their outputs\n\\emph{and additionally allowed to observe communication},\ncan learn nothing about the updates to a post located at node \\i\\\nand the sends of that post to other nodes beyond\n\n(1) the presence of the sends (i.e., the number of the sending actions)\n\n(2) the public knowledge that what is being sent is always the last version (modeled as\nthe correlation predicate)\n\nunless:\n\\begin{itemize}\n\\item either a user in the group is the post's owner or the administrator\n\\item or a user in the group becomes a friend of the owner\n\\item or the group has at least one registered user and the post is being marked as \"public\"\n\\end{itemize}\n\nSee \\<^cite>\\\"cosmedis-SandP2017\"\\ for more details.\n\\\n\ncontext Post_ISSUER\nbegin\n\nfun T :: \"(state,act,out) trans \\ bool\" where\n\"T (Trans s a ou s') \\\n (\\ uid \\ UIDs.\n uid \\\\ userIDs s' \\ PID \\\\ postIDs s' \\\n (uid = admin s' \\\n uid = owner s' PID \\\n uid \\\\ friendIDs s' (owner s' PID) \\\n vis s' PID = PublicV))\"\n\n(* Correlation is defined to mean: always send what was last uploaded, or emptyPost\nif nothing had been uploaded. This needs the auxiliary notion of \"correlated from\" *)\nfun corrFrom :: \"post \\ value list \\ bool\" where\n \"corrFrom pst [] = True\"\n|\"corrFrom pst (PVal pstt # vl) = corrFrom pstt vl\"\n|\"corrFrom pst (PValS aid pstt # vl) = (pst = pstt \\ corrFrom pst vl)\"\n\nabbreviation corr :: \"value list \\ bool\" where \"corr \\ corrFrom emptyPost\"\n\n(* Beyond correlation (which is public knowledge), one can only learn\nthe absence of any secret produced (if that is the case), the number of\ntimes the notice has been sent, and to which nodes they have been sent:\n(since network traffic is assumed to be observable) *)\ndefinition B :: \"value list \\ value list \\ bool\" where\n\"B vl vl1 \\\n corr vl1 \\\n (vl = [] \\ vl1 = []) \\\n map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)\"\n\n\nsublocale BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nsubsubsection \\Unwinding proof\\\n\nlemma reach_PublicV_imples_FriendV[simp]:\nassumes \"reach s\"\nand \"vis s pID \\ PublicV\"\nshows \"vis s pID = FriendV\"\nusing assms reach_vis by auto\n\nlemma reachNT_state:\nassumes \"reachNT s\"\nshows \"\\ (\\ uid \\ UIDs.\n uid \\\\ userIDs s \\ PID \\\\ postIDs s \\\n (uid = admin s \\ uid = owner s PID \\ uid \\\\ friendIDs s (owner s PID) \\\n vis s PID = PublicV))\"\nusing assms proof induct\n case (Step trn) thus ?case\n by (cases trn) auto\nqed (simp add: istate_def)\n\n(* major *) lemma T_\\_\\:\nassumes 1: \"reachNT s\" and 2: \"step s a = (ou,s')\"\nand 3: \"\\ (Trans s a ou s')\" and\n(* note that now we have some overlap between \\ and \\, even for reachNT: *)\n4: \"\\ ca. a \\ COMact ca\"\nshows \"\\ \\ (Trans s a ou s')\"\nusing reachNT_state[OF 1] 2 3 4 using \\_def2(* [OF 2] *)\nby (auto simp add: u_defs com_defs)\n\n(* major *) lemma eqButPID_step_\\_out:\nassumes ss1: \"eqButPID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sT: \"reachNT s\" and T: \"\\ T (Trans s a ou s')\"\nand s1: \"reach s1\"\nand \\: \"\\ (Trans s a ou s')\"\nshows \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\ ou = ou1\"\nproof-\n have s'T: \"reachNT s'\" using step sT T using reachNT_PairI by blast\n note op = reachNT_state[OF s'T]\n note [simp] = all_defs\n note s = reachNT_reach[OF sT]\n note willUse =\n step step1 \\\n op\n reach_vis[OF s]\n eqButPID_stateSelectors[OF ss1] (* eqButPID_postSelectors[OF ss1] *)\n eqButPID_actions[OF ss1]\n eqButPID_update[OF ss1] (* eqButPID_setTextPost[OF ss1] *) eqButPID_not_PID[OF ss1]\n (* added to cope with extra leak towards the admin, when moving from API to CAPI: *)\n (* eqButPID_eqButT[OF ss1] *) eqButPID_eqButF[OF ss1]\n eqButPID_setShared[OF ss1] eqButPID_updateShared[OF ss1]\n eeqButPID_F_not_PID eqButPID_not_PID_sharedWith\n eqButPID_insert2[OF ss1]\n show ?thesis\n proof (cases a)\n case (Sact x1)\n with willUse show ?thesis by (cases x1) auto\n next\n case (Cact x2)\n with willUse show ?thesis by (cases x2) auto\n next\n case (Dact x3)\n with willUse show ?thesis by (cases x3) auto\n next\n case (Uact x4)\n with willUse show ?thesis by (cases x4) auto\n next\n case (Ract x5)\n with willUse show ?thesis\n proof (cases x5)\n case (rPost uid p pid)\n with Ract willUse show ?thesis by (cases \"pid = PID\") auto\n qed auto\n next\n case (Lact x6)\n with willUse show ?thesis\n proof (cases x6)\n case (lClientsPost uid p pid)\n with Lact willUse show ?thesis by (cases \"pid = PID\") auto\n qed auto\n next\n case (COMact x7)\n with willUse show ?thesis by (cases x7) auto\n qed\nqed\n\n(* major *) lemma eqButPID_step_eq:\nassumes ss1: \"eqButPID s s1\"\nand a: \"a = Uact (uPost uid p PID pst)\" \"ou = outOK\"\nand step: \"step s a = (ou, s')\" and step1: \"step s1 a = (ou', s1')\"\nshows \"s' = s1'\"\nusing ss1 step step1\nusing eqButPID_stateSelectors[OF ss1]\neqButPID_update[OF ss1] (* eqButPID_setTextPost[OF ss1] *) eqButPID_setShared[OF ss1]\nunfolding a by (auto simp: u_defs)\n\ndefinition \\0 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\0 s vl s1 vl1 \\\n \\ PID \\\\ postIDs s \\ post s PID = emptyPost \\\n s = s1 \\\n corrFrom (post s1 PID) vl1 \\\n (vl = [] \\ vl1 = []) \\\n map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)\"\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n eqButPID s s1 \\\n corrFrom (post s1 PID) vl1 \\\n (vl = [] \\ vl1 = []) \\\n map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)\"\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\\n PID \\\\ postIDs s \\\n eqButPID s s1 \\\n vl = [] \\ list_all isPVal vl1\"\n\nlemma istate_\\0:\nassumes B: \"B vl vl1\"\nshows \"\\0 istate vl istate vl1\"\nusing assms unfolding \\0_def B_def istate_def by auto\n\nlemma unwind_cont_\\0: \"unwind_cont \\0 {\\0,\\1}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\0 s vl s1 vl1 \\ \\1 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\0 s vl s1 vl1\"\n hence rs: \"reach s\" and ss1: \"s1 = s\" and pPID: \"post s PID = emptyPost\"\n and ch: \"corrFrom (post s1 PID) vl1\"\n and l: \"map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)\"\n and PID: \"\\ PID \\\\ postIDs s\" and vlvl1: \"vl = [] \\ vl1 = []\"\n using reachNT_reach unfolding \\0_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have \\: \"\\ \\ ?trn\" using PID step unfolding \\_def2(* [OF step] *) by (auto simp: u_defs com_defs)\n hence vl': \"vl' = vl\" using c \\ unfolding consume_def by simp\n have pPID': \"post s' PID = emptyPost\"\n using pPID PID step\n apply(cases a)\n subgoal for x1 apply(cases x1, auto simp: all_defs) .\n subgoal for x2 apply(cases x2, auto simp: all_defs) .\n subgoal for x3 apply(cases x3, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal by auto\n subgoal by auto\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n done\n have ?match proof(cases \"\\ uid p. a = Cact (cPost uid p PID) \\ ou = outOK\")\n case True\n then obtain uid p where a: \"a = Cact (cPost uid p PID)\" and ou: \"ou = outOK\" by auto\n have PID': \"PID \\\\ postIDs s'\"\n using step PID unfolding a ou by (auto simp: c_defs)\n note uid = reachNT_state[OF rsT]\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\ unfolding consume_def ss1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\1 s' vl' s' vl1\" using l PID' c ch vlvl1 pPID' pPID\n unfolding ss1 \\1_def vl' by auto\n thus \"?\\ s' vl' s' vl1\" by simp\n qed\n next\n case False note a = False\n have PID': \"\\ PID \\\\ postIDs s'\"\n using step PID a\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: s_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: c_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: d_defs)+ .\n subgoal for x4 apply(cases x4) apply(fastforce simp: u_defs)+ .\n subgoal by auto\n subgoal by auto\n subgoal for x7 apply(cases x7) apply(fastforce simp: com_defs)+ .\n done\n show ?thesis proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" using \\ unfolding consume_def ss1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n have \"\\0 s' vl' s' vl1\" using a PID' pPID pPID' ch vlvl1 l unfolding \\0_def vl' ss1 by simp\n thus \"?\\ s' vl' s' vl1\" by simp\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1,\\2}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\2 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\1 s vl s1 vl1\"\n hence vlvl1: \"vl = [] \\ vl1 = []\" and ch1: \"corrFrom (post s1 PID) vl1\"\n and rs: \"reach s\" and ss1: \"eqButPID s s1\" and PID: \"PID \\\\ postIDs s\"\n and l: \"map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)\"\n using reachNT_reach unfolding \\1_def by auto\n have PID1: \"PID \\\\ postIDs s1\" using eqButPID_stateSelectors[OF ss1] PID by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n hence own1: \"owner s1 PID \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vll1) note vl1 = Cons\n obtain v vll where vl: \"vl = v # vll\" using vl1 vlvl1 by (cases vl) auto\n show ?thesis\n proof(cases v1)\n case (PVal pst1) note v1 = PVal\n let ?uid1 = \"owner s1 PID\" let ?p1 = \"pass s1 ?uid1\"\n have uid1: \"?uid1 \\\\ userIDs s1\" using reach_owner_userIDs[OF rs1 PID1] .\n define a1 where \"a1 \\ Uact (uPost ?uid1 ?p1 PID pst1)\"\n obtain s1' ou1 where step1: \"step s1 a1 = (ou1,s1')\" by force\n hence ou1: \"ou1 = outOK\" using PID1 uid1 unfolding a1_def by (auto simp: u_defs)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have \\1: \"\\ ?trn1\" unfolding a1_def PID1 ou1 by simp\n have 2[simp]: \"post s1' PID = pst1\"\n using step1 unfolding a1_def ou1 by (auto simp: u_defs)\n have \"?uid1 = owner s PID\" using eqButPID_stateSelectors[OF ss1] by simp\n hence uid1: \"?uid1 \\ UIDs\" using reachNT_state own rsT PID by auto\n have \"eqButPID s1 s1'\" using step1 a1_def Uact_uPaperC_step_eqButPID by auto\n hence ss1': \"eqButPID s s1'\" using ss1 using eqButPID_trans by blast\n have \"?iact\" proof\n show \"step s1 a1 = (ou1, s1')\" \"\\ ?trn1\" by fact+\n show \"consume (Trans s1 a1 ou1 s1') vl1 vll1\"\n using \\1 unfolding consume_def vl1 a1_def v1 by simp\n show \"\\ \\ ?trn1\" using uid1 unfolding a1_def by auto\n show \"?\\ s vl s1' vll1\"\n proof(cases vll1)\n case Nil\n have \"\\1 s vl s1' vll1\" using PID ss1' l unfolding \\1_def B_def vl1 v1 Nil by auto\n thus ?thesis by simp\n next\n case (Cons w1 vlll1) note vll1 = Cons\n have \"\\1 s vl s1' vll1\" using PID ss1' l ch1\n unfolding \\1_def B_def vl1 v1 vl by auto\n thus ?thesis by simp\n qed\n qed\n thus ?thesis by simp\n next\n case (PValS aid1 pst1) note v1 = PValS\n have pst1: \"pst1 = post s1 PID\" using ch1 unfolding vl1 v1 by simp\n show ?thesis\n proof(cases v)\n case (PVal \"pst\") note v = PVal\n hence vll: \"vll \\ []\" using vlvl1 l unfolding vl vl1 v v1 by auto\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have vl': \"vl' = vl \\ vl' = vll\" using c unfolding vl consume_def by (cases \"\\ ?trn\") auto\n hence vl'NE: \"vl' \\ []\" using vll vl by auto\n have fvl': \"filter isPValS vl' = filter isPValS vll\" using vl' unfolding vl v by auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by fastforce\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqButPID s' s1'\" using eqButPID_step ss1 step step1 by blast\n have \\\\1: \"\\ ?trn \\ \\ ?trn1\" by simp\n have PID': \"PID \\\\ postIDs s'\" using step rs PID using reach_postIDs_persist by blast\n have 2[simp]: \"\\ \\ ?trn1 \\ post s1' PID = post s1 PID\"\n using step1 PID1 unfolding \\_def2(* [OF step1] *)\n apply(cases a, auto)\n subgoal for x1 apply(cases x1, auto simp: all_defs) .\n subgoal for x2 apply(cases x2, auto simp: all_defs) .\n subgoal for x3 apply(cases x3, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n done\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n have ou: \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 rsT T rs1 \\] .\n {assume \\: \"\\ ?trn\"\n hence \"f ?trn = v\" using c unfolding consume_def vl by simp\n hence \"\\ca. a \\ COMact ca\" using \\ unfolding \\_def3[OF step] v by auto\n hence False using T_\\_\\[OF rsT step \\] \\ by auto\n }\n hence \\: \"\\ \\ ?trn\" by auto\n have vl': \"vl' = vl\" using \\ c unfolding consume_def by simp\n have \\1: \"\\ \\ ?trn1\" using step step1 ss1 \\ eqButPID_step_\\ by blast\n have ?match proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n show \"g ?trn = g ?trn1\" using ou by (cases a) auto\n have \"\\1 s' vl' s1' vl1\"\n using PID' s's1' vlvl1 l ch1 \\1 unfolding \\1_def vl' by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n next\n case False note \\ = False\n show ?thesis\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n hence \"f ?trn = v\" using c unfolding consume_def vl by simp\n hence \"\\ca. a \\ COMact ca\" using \\ unfolding \\_def3[OF step] v by auto\n then obtain uid p \"pstt\" where a: \"a = Uact (uPost uid p PID pstt)\"\n using \\ unfolding \\_def2(* [OF step] *) by auto\n hence ss': \"eqButPID s s'\" using step Uact_uPaperC_step_eqButPID by auto\n hence s's1: \"eqButPID s' s1\" using ss1 eqButPID_sym eqButPID_trans by blast\n have ?ignore proof\n show \"\\ \\ ?trn\" by fact\n have \"\\1 s' vl' s1 vl1\"\n using PID' s's1' ch1 l vl'NE s's1 unfolding \\1_def fvl' vl v by auto\n thus \"?\\ s' vl' s1 vl1\" by simp\n qed\n thus ?thesis by simp\n next\n case False note \\ = False\n have vl': \"vl' = vl\" using \\ c unfolding consume_def by simp\n have \\1: \"\\ \\ ?trn1\" using step step1 ss1 \\ eqButPID_step_\\ by blast\n have ?match proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" using \\ by simp\n next\n have \"\\1 s' vl' s1' vl1\"\n using PID' s's1' vlvl1 l ch1 \\1 unfolding \\1_def vl' by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n qed\n thus ?thesis using vlvl1 by simp\n next\n case (PValS aid \"pst\") note v = PValS\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have vl': \"vl' = vl \\ vl' = vll\" using c unfolding vl consume_def by (cases \"\\ ?trn\") auto\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by fastforce\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqButPID s' s1'\" using eqButPID_step ss1 step step1 by blast\n have \\\\1: \"\\ ?trn \\ \\ ?trn1\" by simp\n have PID': \"PID \\\\ postIDs s'\" using step rs PID using reach_postIDs_persist by blast\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof(cases \"\\ ?trn\")\n case True note \\ = True\n have \\1: \"\\ ?trn1\" using step step1 ss1 \\ eqButPID_step_\\ by blast\n let ?ad = \"admin s\" let ?p = \"pass s ?ad\" let ?pst = \"post s PID\"\n let ?uid = \"owner s PID\" let ?vs = \"vis s PID\"\n obtain vl': \"vl' = vll\"\n and ou: \"ou = O_sendPost (aid, clientPass s aid, PID, pst, ?uid, ?vs)\"\n and a: \"a = COMact (comSendPost ?ad ?p aid PID)\" and \"pst\": \"pst = ?pst\"\n using \\ c unfolding \\_def3[OF step] consume_def vl v by auto\n let ?pst1 = \"post s1 PID\"\n have \"clientPass s aid = clientPass s1 aid\" and \"?uid = owner s1 PID\"\n and \"?vs = vis s1 PID\"\n using eqButPID_stateSelectors[OF ss1] by auto\n hence ou1: \"ou1 = O_sendPost (aid, clientPass s aid, PID, ?pst1, ?uid, ?vs)\"\n using step1 \\1 unfolding \\_def3[OF step1] vl1 v1 a\n by (auto simp: com_defs)\n have 2[simp]: \"post s1' PID = pst1\"\n using step1 unfolding a ou1 pst1 by (auto simp: com_defs)\n have ch_vll1: \"corrFrom pst1 vll1\" using ch1 unfolding pst1[symmetric] vl1 v1 by auto\n show ?thesis proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume (Trans s1 a ou1 s1') vl1 vll1\"\n using l \\1 pst1 unfolding consume_def vl vl1 v v1 a ou1 by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n show \"g ?trn = g ?trn1\" unfolding a ou ou1 by (simp add: ss1)\n show \"?\\ s' vl' s1' vll1\"\n proof(cases \"vll = []\")\n case False\n hence \"\\1 s' vl' s1' vll1\" using PID' s's1' vlvl1 l ch1 ch_vll1\n unfolding \\1_def vl' vl vl1 v v1 by auto\n thus ?thesis by simp\n next\n case True\n hence \"list_all isPVal vll1\" using l unfolding vl vl1 v v1 by (simp add: filter_isPValS_Nil)\n hence \"\\2 s' vl' s1' vll1\" using True PID' s's1' vlvl1 l ch1 ch_vll1\n unfolding \\2_def vl' vl vl1 v v1 by simp\n thus ?thesis by simp\n qed\n qed\n next\n case False note \\ = False\n have vl': \"vl' = vl\" using \\ c unfolding consume_def by simp\n have \\1: \"\\ \\ ?trn1\" using step step1 ss1 \\ eqButPID_step_\\ by blast\n have ?match proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 rsT T rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have 2[simp]: \"post s1' PID = post s1 PID\"\n using step1 PID1 \\1 unfolding \\_def2(* [OF step1] *)\n apply(cases a)\n subgoal for x1 apply(cases x1, auto simp: all_defs) .\n subgoal for x2 apply(cases x2, auto simp: all_defs) .\n subgoal for x3 apply(cases x3, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal by auto\n subgoal by auto\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n done\n have \"\\1 s' vl' s1' vl1\" using PID' s's1' vlvl1 l ch1\n unfolding \\1_def vl' vl vl1 v v1 by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vlvl1 by simp\n qed\n qed\n next\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by fastforce\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqButPID s' s1'\" using eqButPID_step ss1 step step1 by blast\n have \\\\1: \"\\ ?trn \\ \\ ?trn1\" by simp\n have PID': \"PID \\\\ postIDs s'\" using step rs PID using reach_postIDs_persist by blast\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case True note \\ = True\n then obtain v vll where vl: \"vl = v # vll\"\n and f: \"f ?trn = v\" using c unfolding consume_def by (cases vl) auto\n obtain \"pst\" where v: \"v = PVal pst\" using l unfolding vl1 vl by (cases v) auto\n have fvll: \"filter isPValS vll = []\"using l unfolding vl1 vl by auto\n have vl': \"vl' = vll\" using c \\ unfolding vl consume_def by auto\n hence 0: \"\\ca. a \\ COMact ca\" using \\ v f unfolding \\_def3[OF step] by auto\n then obtain uid p \"pstt\" where a: \"a = Uact (uPost uid p PID pstt)\"\n using \\ unfolding \\_def2(* [OF step] *) by auto\n hence ss': \"eqButPID s s'\" using step Uact_uPaperC_step_eqButPID by auto\n hence s's1: \"eqButPID s' s1\" using ss1 eqButPID_sym eqButPID_trans by blast\n have ?ignore proof\n show \"\\ \\ ?trn\" using T_\\_\\[OF rsT step \\ 0] .\n have \"\\1 s' vl' s1 vl1\"\n using PID' s's1' ch1 l s's1 vl1 fvll unfolding \\1_def vl v vl' by auto\n thus \"?\\ s' vl' s1 vl1\" by simp\n qed\n thus ?thesis by simp\n next\n case False note \\ = False\n have vl': \"vl' = vl\" using \\ c unfolding consume_def by simp\n have \\1: \"\\ \\ ?trn1\" using step step1 ss1 \\ eqButPID_step_\\ by blast\n have ?match proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 rsT T rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have 2[simp]: \"post s1' PID = post s1 PID\"\n using step1 PID1 \\1 unfolding \\_def2(* [OF step1] *)\n apply(cases a)\n subgoal for x1 apply(cases x1, auto simp: all_defs) .\n subgoal for x2 apply(cases x2, auto simp: all_defs) .\n subgoal for x3 apply(cases x3, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal by auto\n subgoal by auto\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n done\n have \"\\1 s' vl' s1' vl1\" using PID' s's1' vlvl1 l ch1\n unfolding \\1_def vl' vl1 by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\2 s vl s1 vl1\"\n hence PID: \"PID \\\\ postIDs s\" and ss1: \"eqButPID s s1\" and vl: \"vl = []\" and lvl1: \"list_all isPVal vl1\"\n and rs: \"reach s\" using reachNT_reach unfolding \\2_def by auto\n have PID1: \"PID \\\\ postIDs s1\" using eqButPID_stateSelectors[OF ss1] PID by auto\n have own: \"owner s PID \\ set (userIDs s)\" using reach_owner_userIDs[OF rs PID] .\n hence own1: \"owner s1 PID \\ set (userIDs s1)\" using eqButPID_stateSelectors[OF ss1] by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vll1) note vl1 = Cons\n obtain pst1 where v1: \"v1 = PVal pst1\" and lvll1: \"list_all isPVal vll1\"\n using lvl1 unfolding vl1 by (cases v1) auto\n define uid where \"uid \\ owner s PID\" define p where \"p \\ pass s uid\"\n define a1 where \"a1 \\ Uact (uPost uid p PID pst1)\"\n have uid1: \"uid = owner s1 PID\" and p1: \"p = pass s1 uid\" unfolding uid_def p_def\n using eqButPID_stateSelectors[OF ss1] by auto\n obtain ou1 s1' where step1: \"step s1 a1 = (ou1, s1')\" by(cases \"step s1 a1\") auto\n have ou1: \"ou1 = outOK\" using step1 PID1 own1 unfolding a1_def uid1 p1 by (auto simp: u_defs)\n have uid: \"uid \\ UIDs\" unfolding uid_def using rsT reachNT_state own PID by blast\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have ?iact proof\n show \"step s1 a1 = (ou1, s1')\" using step1 .\n next\n show \\1: \"\\ ?trn1\" unfolding \\_def2(* [OF step1] *) a1_def ou1 by simp\n show \"consume ?trn1 vl1 vll1\"\n using \\1 unfolding vl1 consume_def a1_def v1 by simp\n show \"\\ \\ ?trn1\" using uid unfolding a1_def by simp\n next\n have \"eqButPID s1 s1'\" using Uact_uPaperC_step_eqButPID[OF _ step1] a1_def by auto\n hence ss1': \"eqButPID s s1'\" using eqButPID_trans ss1 by blast\n show \"\\2 s vl s1' vll1\"\n using PID ss1' lvll1 unfolding \\2_def vl by auto\n qed\n thus ?thesis by simp\n next\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by fastforce\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqButPID s' s1'\" using eqButPID_step ss1 step step1 by blast\n have \\\\1: \"\\ ?trn \\ \\ ?trn1\" by simp\n have PID': \"PID \\\\ postIDs s'\" using step rs PID using reach_postIDs_persist by blast\n have \\: \"\\ \\ ?trn\" and vl': \"vl' = vl\" using c unfolding vl consume_def by auto\n hence \\1: \"\\ \\ ?trn1\" using eqButPID_step_\\ step ss1 step1 by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof\n show \"validTrans ?trn1\" using step1 by auto\n show \"consume ?trn1 vl1 vl1\" using \\1 unfolding consume_def by simp\n show \"\\ ?trn \\ \\ ?trn1\" by fact\n next\n assume \"\\ ?trn\" note \\ = this\n have ou: \"(\\ uid p aid pid. a = COMact (comSendPost uid p aid pid) \\ outPurge ou = outPurge ou1) \\\n ou = ou1\"\n using eqButPID_step_\\_out[OF ss1 step step1 rsT T rs1 \\] .\n thus \"g ?trn = g ?trn1\" by (cases a) auto\n next\n have 2[simp]: \"textPost (post s1' PID) = textPost (post s1 PID)\"\n using step1 PID1 \\1 unfolding \\_def2(* [OF step1] *)\n apply(cases a)\n subgoal for x1 apply(cases x1, auto simp: all_defs) .\n subgoal for x2 apply(cases x2, auto simp: all_defs) .\n subgoal for x3 apply(cases x3, auto simp: all_defs) .\n subgoal for x4 apply(cases x4, auto simp: all_defs) .\n subgoal by auto\n subgoal by auto\n subgoal for x7 apply(cases x7, auto simp: all_defs) .\n done\n show \"\\2 s' vl' s1' vl1\" using PID' s's1' vl\n unfolding \\2_def vl1 vl' by auto\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\ndefinition Gr where\n\"Gr =\n {\n (\\0, {\\0,\\1}),\n (\\1, {\\1,\\2}),\n (\\2, {\\2})\n }\"\n\n\ntheorem Post_secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing istate_\\0 unwind_cont_\\0 unwind_cont_\\1 unwind_cont_\\2\nunfolding Gr_def by auto\n\n\n\nend (* context Post_ISSUER *)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Post_Confidentiality/Post_ISSUER.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.26754760212736084}} {"text": "\nsection \"Auxiliary algebraic laws for abrupt designs\"\ntheory algebraic_laws_abrupt_aux\nimports \"../../../theories/Abrupt/utp_abrupt_designs\"\n \nbegin\n\nnamed_theorems uabr_simpl and uabr_cond and uabr_comp and uabr_lens\nsubsection {*THM setup*}\ndeclare design_condr[urel_cond] \n\nsubsection {*abrupt alphabet behavior*}\n\nlemma assigns_abr_alpha:\n \"(abrupt :== (\\ &abrupt)) = (\\II\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\ =\\<^sub>u (\\$abrupt) \\ $ok =\\<^sub>u $ok\\)\"\n \"(ok :== (\\ &ok)) = (\\II\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\ =\\<^sub>u $abrupt \\ $ok =\\<^sub>u (\\$ok\\))\"\n by rel_auto+\n\nlemma vwb_of_abrupt[simp]: \n \"vwb_lens ok\" \"vwb_lens abrupt\"\n by simp_all\n\nlemma unrest_pre_out\\_abr[unrest]: \"out\\ \\ \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub><\"\n by (transfer, auto simp add: out\\_def lens_prod_def)\n \nlemma unrest_post_in\\_abr[unrest]: \"in\\ \\ \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>>\"\n by (transfer, auto simp add: in\\_def lens_prod_def)\n\nlemma unrest_ok_abrupt_rel_uexpr_lift_cpa[unrest]:\n \"$ok \\ \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\" \"$ok\\ \\ \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n \"$abrupt \\ \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\" \"$abrupt\\ \\ \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (pred_auto)+\n\nlemma unrest_ok_abrupt_rel_usubst_lift_cpa[unrest]:\n \"$ok\\ \\ \\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R\" \"$ok \\ \\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R\"\n \"$abrupt\\ \\ \\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R\" \"$abrupt \\ \\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto+\n\nlemma unrest_in_out_rel_ok_abrupt_res_abr [unrest]:\n \"$ok \\ (P \\\\<^sub>\\ ok)\" \"$ok\\ \\ (P \\\\<^sub>\\ ok)\" \n \"$abrupt \\ (P \\\\<^sub>\\ abrupt)\" \"$abrupt\\ \\ (P \\\\<^sub>\\ abrupt)\"\n by (simp_all add: rel_var_res_def unrest)\n\nlemma uabr_alphabet_unrest[unrest]:(*FIXEME:These laws should be generated automatically by alphabet backend since all the fields of alphabet are independant*)\n \"$ok\\ \\ $abrupt\\\" \"$ok \\ $abrupt\"\n \"$ok\\ \\ $abrupt\" \"$ok \\ $abrupt\\\"\n \"$abrupt\\ \\ $ok\\\" \"$abrupt \\ $ok \"\n \"$abrupt \\ $ok\\\" \"$abrupt\\ \\ $ok\"\n by pred_simp+\n\nlemma cpa_ord [usubst]:\n \"$ok \\\\<^sub>v $ok\\\" \"$abrupt \\\\<^sub>v $abrupt\\\" \"$ok \\\\<^sub>v $abrupt\\\" \n \"$ok \\\\<^sub>v $abrupt\" \"$ok\\ \\\\<^sub>v $abrupt\\\" \"$ok\\ \\\\<^sub>v $abrupt\" \n by (simp_all add: var_name_ord_def)\n\nlemma rel_usubst_lift_cpa_in_out_abrupt_ok[usubst]:\n \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt = $abrupt\" \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$abrupt) = (\\$abrupt)\"\n \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ ($ok) = ($ok)\" \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$ok) = (\\$ok)\" \n \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ ($abrupt\\) = (($abrupt\\))\" \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$abrupt\\) = (\\$abrupt\\)\"\n \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ ($ok\\) = ($ok\\)\" \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$ok\\) = (\\$ok\\)\" \n by (simp_all add: usubst unrest)\n\nlemma abrupt_ok_simpl[uabr_comp]:\n \"($abrupt ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = $abrupt\" \"(\\$ok ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = (\\$ok)\" \n \"($abrupt ;; (P \\ Q)) = $abrupt\" \"(\\$ok ;; (P \\ Q)) = (\\$ok)\"\n \"(\\$abrupt ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = (\\$abrupt)\" \"(\\$ok ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = (\\$ok)\" \n \"(\\$abrupt ;; (P \\ Q)) = (\\$abrupt)\" \"(\\$ok ;; (P \\ Q)) = (\\$ok)\"\n \"($abrupt\\ ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = $abrupt\\\" \n \"(\\$abrupt\\ ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) = (\\$abrupt\\)\" \n by rel_auto+\n\nlemma simpl_abr_in_ok:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R ($ok) = ((\\$abrupt \\ ($ok \\$ok\\)) \\ (II))\" \n by rel_auto\n\nlemma simpl_abr_our_ok:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R ($ok\\) = \n ((\\$abrupt \\ ($ok \\$ok\\)) \\ (II))\" \n by rel_auto\n\nlemma simpl_abr_in_abrupt:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R ($abrupt) = \n ((\\$abrupt \\ ($ok \\($ok\\ \\ $abrupt))) \\ ($abrupt \\ II))\" \n by rel_auto\n\nlemma simpl_abr_alr_def:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R (P) = \n ((\\$abrupt \\ ($ok \\($ok\\ \\ P))) \\ ($abrupt \\ II))\" \n by rel_auto\n\nsubsection {*Healthiness condition behavior*}\n\nlemma rel_usubst_cpa_c3_abr[usubst]: \n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \"\\ \\ C3_abr(P) = (\\ \\ P \\ \\ \\ (\\$abrupt) \\ (\\ \\ II))\"\n using assms unfolding C3_abr_def \n by (simp add: usubst) \n\nlemma Simpl_abr_idem[simp]: \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P)) = Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P)\"\n by (rel_auto)\n\nlemma simpl_abr_Idempotent: \"Idempotent Simpl\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp add: Idempotent_def)\n\nlemma Simpl_abr_mono: \"P \\ Q \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(Q)\"\n by (rel_auto)\n\nlemma simpl_abr_Monotonic: \"Monotonic Simpl\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp add: Monotonic_def Simpl_abr_mono)\n\nlemma simpl_abr_def: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) = ((\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ P) \\ \\$abrupt \\ II)\"\n unfolding C3_abr_def ..\n\n\nlemma simpl_abr_condr[uabr_simpl]: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P \\ b \\ Q) = (Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) \\ b \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(Q))\"\n unfolding simpl_abr_def \n by (simp add: urel_cond)\n\nlemma simpl_abr_skip_abr[uabr_simpl]: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (SKIP\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by (simp add: urel_cond urel_defs) \n \nlemma simpl_abr_throw_abr: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(THROW\\<^sub>A\\<^sub>B\\<^sub>R) = ((\\$abrupt) \\ ($ok \\($ok\\ \\ $abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R)) \\ ($abrupt \\ II))\"\n by rel_auto\n\nlemma simpl_abr_assign_abr[uabr_simpl]: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by (simp add: urel_cond urel_defs)\n\nlemma simpl_abr_throw_abr_comp_abrupt[uabr_simpl]:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q) \\ $abrupt \\ II)) = Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q\" \n apply pred_simp\n apply rel_simp \n apply auto \ndone\n\nlemma simpl_abr_throw_abr_comp_abrupt_cond_throw_abr[uabr_simpl]:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = Simpl\\<^sub>A\\<^sub>B\\<^sub>R THROW\\<^sub>A\\<^sub>B\\<^sub>R\" \n apply pred_simp\n apply rel_simp \n apply auto \ndone\n\nlemma simpl_abr_throw_abr_comp_abrupt_cond_skip_abr[uabr_simpl]:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\" \n apply pred_simp\n apply rel_simp \n apply auto \ndone\n \nlemma simpl_abr_throw_abr_comp_abrupt_cond_assigns_abr[uabr_simpl]:\n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n apply pred_simp\n apply rel_simp \n apply auto \ndone\n\nlemma C3_abr_throw_abr_comp_abrupt[uabr_simpl]: \n \"C3_abr (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q) \\ $abrupt \\ II)) = \n Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q\"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto\ndone\n\nlemma C3_abr_throw_abr_comp_abrupt_cond_skip_abr[uabr_simpl]: \n \"C3_abr (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n SKIP\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto\ndone\n\nlemma C3_abr_throw_abr_comp_abrupt_cond_throw_abr[uabr_simpl]: \n \"C3_abr (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n C3_abr THROW\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto\ndone\n\nlemma C3_abr_throw_abr_comp_abrupt_cond_assigns_abr[uabr_simpl]: \n \"C3_abr (THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto \ndone\n\n(*lemma [uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ ($abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R)) \"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto\ndone\n\nlemma throw_abr_comp_abrupt_cond_skip_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R)) \"\n apply pred_simp\n apply rel_simp\n apply safe\n apply auto \ndone\n\n\nlemma [uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = \n (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\$abrupt\\ \\ \\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R)) \"\n apply pred_simp\n apply rel_simp \n apply safe\n apply auto \ndone*)\n\nlemma [uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; ((abrupt:== (\\ &abrupt) ;; \\true\\\\<^sub>A\\<^sub>B\\<^sub>R) \\ $abrupt \\ II)) = (true) \"\n apply pred_simp\n apply rel_simp \n apply auto \ndone\n\n\nlemma simpl_abr_form: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) = (((\\$abrupt) \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (P))) \\ ($abrupt \\ II))\"\n by rel_auto \n\nlemma abrupt_simpl_abr[uabr_simpl]:\n \"($abrupt \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P)) = ($abrupt \\II)\"\n by rel_auto\n\nlemma nabrupt_simpl_abr[uabr_simpl]:\n \"(\\$abrupt \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P)) = (\\$abrupt \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (P)))\"\n by (rel_auto)\n\ndefinition design_abr_sup :: \"('\\,'\\) rel_cpa set \\ ('\\,'\\) rel_cpa\" (\"\\\\<^sub>A\\<^sub>B\\<^sub>R_\" [900] 900) where\n\"\\\\<^sub>A\\<^sub>B\\<^sub>R A = (if (A = {}) then \\\\<^sub>A\\<^sub>B\\<^sub>R else \\ A)\"\n\nlemma simpl_abr_Continuous: \"Continuous Simpl\\<^sub>A\\<^sub>B\\<^sub>R\"\n unfolding Continuous_def SUP_def apply rel_simp\n unfolding SUP_def \n apply transfer apply auto \ndone\n\nlemma simpl_abr_R3_conj: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P \\ Q) = (Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(Q))\"\n by (rel_auto)\n\nlemma simpl_abr_disj: \n \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P \\ Q) = (Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(Q))\"\n by (rel_auto)\n\nlemma Simpl_abr_USUP:\n assumes \"A \\ {}\"\n shows \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P(i)))\"\n using assms by (rel_auto)\n\nlemma design_abr_sup_non_empty [simp]: \n \"A \\ {} \\ \\\\<^sub>A\\<^sub>B\\<^sub>R A = \\ A\"\n by (simp add: design_abr_sup_def)\n\nsubsection {*Signature behavior*}\n\nlemma design_top_abr:\n \"(P \\ Q) \\ \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (rel_auto)\n\nlemma design_abr_sup_empty [simp]: \n \"\\\\<^sub>A\\<^sub>B\\<^sub>R {} = \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp add: design_abr_sup_def)\n\n\nabbreviation design_inf :: \"('\\, '\\) rel_des set \\ ('\\, '\\) rel_des\" (\"\\\\<^sub>A\\<^sub>B\\<^sub>R_\" [900] 900) where\n\"\\\\<^sub>A\\<^sub>B\\<^sub>R A \\ \\ A\"\n\nlemma design_bottom_abr:\n \"\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (P \\ Q)\"\n by simp\n\nlemma Simpl_abr_bottom_abr:\n \"\\\\<^sub>A\\<^sub>B\\<^sub>R \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R (P)\"\n by simp\n\nlemma Simpl_abr_UINF:\n assumes \"A \\ {}\"\n shows \"Simpl\\<^sub>A\\<^sub>B\\<^sub>R(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P(i)))\"\n using assms by (rel_auto)\n\nlemma skip_cpa_def:\n \"II = (\\II\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt =\\<^sub>u $abrupt\\ \\ $ok =\\<^sub>u $ok\\)\" \n by rel_auto\n\nlemma skip_lift_cpa_def:\n \"\\II\\\\<^sub>A\\<^sub>B\\<^sub>R = ($\\\\<^sub>A\\<^sub>B\\<^sub>R\\ =\\<^sub>u $\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma seqr_abrupt_true [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>t = (P \\<^sub>a\\<^sub>t ;; Q)\"\n by (rel_auto)\n\nlemma seqr_abrupt_false [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>f = (P \\<^sub>a\\<^sub>f ;; Q)\"\n by (rel_auto)\n\nlemma rel_usubst_lift_cpa_uexpr_lift_cpa[usubst]:\n \"\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ \\P\\\\<^sub>A\\<^sub>B\\<^sub>R = \\\\ \\ P\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto\n\nlemma usubst_lift_cpa_assigns_lift_cpa [usubst]:\n \"\\\\\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ \\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R = \\\\\\ \\ \\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n by (simp add: usubst)\n\nlemma usubst_lift_cpa_pre_uexpr_lift_cpa[usubst]:\n \"\\\\\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>< = \\\\ \\ b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub><\" \n by (simp add: usubst)\n\nlemma rel_usubst_lift_cpa_design[usubst]: \n \"(\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ (Q \\ P)) = (\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ Q) \\ (\\\\\\\\<^sub>S\\<^sub>A\\<^sub>B\\<^sub>R \\ P)\"\n by (simp add: usubst unrest)\n\nlemma usubst_cpa_true[usubst]: \"\\ \\ \\true\\\\<^sub>A\\<^sub>B\\<^sub>R = \\true\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto\n\nlemma usubst_cpa_false[usubst]: \"\\ \\ \\false\\\\<^sub>A\\<^sub>B\\<^sub>R = \\false\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto\n\nlemma rel_usubst_cpa_skip_cpa[usubst]: \n \"(\\ \\ II) = ((\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R) \\ \\ \\ $abrupt =\\<^sub>u \\ \\ $abrupt\\ \\ \\ \\ $ok =\\<^sub>u \\ \\ $ok\\)\" \n by (simp add: usubst unrest skip_cpa_def)\n\nlemma usubst_lift_cpa_skip_lift_cpa[usubst]: \n \"(\\\\\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R) = \\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R\" \n unfolding skip_r_def\n by (simp add: usubst_lift_cpa_assigns_lift_cpa)\n\nlemma usubst_cpa_skip_cpa [usubst]:\n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \n \"(\\ \\ SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\ \\ ((\\$abrupt\\) \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R)) \\ \\ \\ (\\$abrupt) \\ (\\ \\ (II)))\"\n using assms unfolding skip_abr_def \n using [[simp_trace]]\n by (simp add: usubst) \n\nlemma usubst_cpa_throw_cpa [usubst]:\n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \n \"(\\ \\ THROW\\<^sub>A\\<^sub>B\\<^sub>R) = (\\ \\ (\\$abrupt) \\ (\\ \\ ($abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R)))\"\n using assms unfolding throw_abr_def \n by (simp add: usubst) \n\nlemma usubst_cpa_assigns_cpa [usubst]:\n assumes \"$ok \\ \\\" \"$ok\\ \\ \\ \"\n shows \n \"\\ \\ \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R = (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\ \\ ((\\$abrupt\\) \\ \\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R)) \\ \\ \\ (\\$abrupt) \\ (\\ \\ (II)))\" \n using assms unfolding assigns_abr_def\n by (simp add: usubst)\n\nlemma simpl_comp_left_distr:\n \"(C3_abr (P) ;; R) = ((P;;R) \\ \\$abrupt \\ (II ;; R))\"\n apply pred_simp\n apply rel_simp\n apply fastforce\ndone\n\nlemma c3_abr_comp_semir:\n \"(C3_abr(P) ;; C3_abr(R)) = C3_abr (P ;; C3_abr(R))\"\n by rel_auto\n\nlemma c3_abr_comp_simpl[uabr_comp]:\n \"(C3_abr(P) ;; C3_abr(R)) = ((P ;; C3_abr(R)) \\ \\$abrupt \\ (II))\"\n by rel_auto\n\nlemma simpl_abr_comp_semir:\n \"(Simpl\\<^sub>A\\<^sub>B\\<^sub>R(P) ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R)) = Simpl\\<^sub>A\\<^sub>B\\<^sub>R ((\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ P) ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R))\"\n by rel_auto\n\ntheorem design_top_abr_left_zero[uabr_comp]: \n \"(\\\\<^sub>A\\<^sub>B\\<^sub>R ;; (P \\ Q)) = \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (rel_auto)\n\ntheorem Simpl_abr_top_abr_left_zero[uabr_comp]: \n \"(\\\\<^sub>A\\<^sub>B\\<^sub>R ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R (P)) = \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (rel_auto)\n\nlemma assigns_lift_cpa_comp_rel_cpa[uabr_comp]:\n assumes \"$ok \\ P\" \"$abrupt \\ P\"\n shows \"(\\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R ;; P) = (\\\\\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ P)\"\n apply (insert assms)\n apply pred_simp \n apply rel_blast \ndone\n\nlemma lift_des_skip_dr_unit_abr [uabr_comp]:\n \"(\\P\\\\<^sub>A\\<^sub>B\\<^sub>R ;; \\II\\\\<^sub>A\\<^sub>B\\<^sub>R) = \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n \"(\\II\\\\<^sub>A\\<^sub>B\\<^sub>R ;; \\P\\\\<^sub>A\\<^sub>B\\<^sub>R) = \\P\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (rel_auto)+\n\nlemma skip_cpa_left_comp_simpl[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R)) = (Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R))\"\n by rel_auto\n\nlemma skip_cpa_right_comp_simpl[uabr_comp]:\n \"(Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R) ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R))\"\n by rel_auto\n\nlemma throw_cpa_left_comp_simpl[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R(R)) = (THROW\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma assign_abr_alt_def: \n \"\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R = Simpl\\<^sub>A\\<^sub>B\\<^sub>R (\\$abrupt\\ \\ \\\\\\\\\\<^sub>s \\ II\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma assign_abr_left_comp_c3[uabr_comp]:\n \"\\a\\\\<^sub>A\\<^sub>B\\<^sub>R ;; C3_abr (P \\ Q) = C3_abr (\\a\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ (P \\ Q))\"\n by rel_auto\n\n\nlemma assigns_abr_comp[uabr_comp]: \n \"(\\f\\\\<^sub>A\\<^sub>B\\<^sub>R ;; \\g\\\\<^sub>A\\<^sub>B\\<^sub>R) = \\g \\ f\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n by rel_auto\n\nlemma usubst_cpa_des_cond_abr [usubst]:\n \"\\$ok \\ \\; $ok\\ \\ \\ \\ \\ \n \\ \\ (R \\ bif b then P else Q eif) = \n (\\ \\ R \\ (\\ \\ P \\ \\ \\ \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>< \\ \\ \\ Q))\"\n by (simp add: usubst)\n\nlemma comp_cond_abr_left_distr[uabr_comp]:\n \"((bif b then Simpl\\<^sub>A\\<^sub>B\\<^sub>R P else Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q eif) ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R R) = \n (bif b then (Simpl\\<^sub>A\\<^sub>B\\<^sub>R P ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R R) else (Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R R) eif)\"\n apply (simp add: usubst uabr_comp)\n apply pred_simp \n apply rel_simp\n apply auto\ndone\n\n\nlemma if_mono:\n \"\\ P\\<^sub>1 \\ P\\<^sub>2; Q\\<^sub>1 \\ Q\\<^sub>2 \\ \\ (bif b then P\\<^sub>1 else Q\\<^sub>1 eif) \\ (bif b then P\\<^sub>2 else Q\\<^sub>2 eif)\"\n by rel_auto\n\n\n\nsubsection {*While abrupt usubst*}\n\nsubsection {*block abrupt usubst*}\n\nsubsection {*Catch abrupt usubst*}\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/AlgebraicLaws/Abrupt/algebraic_laws_abrupt_aux.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2675476021273608}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Christoph Sprenger, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze, Christoph Sprenger\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection\\Network Assumptions used for authorized segments.\\\ntheory Network_Assumptions\n imports\n \"Network_Model\"\nbegin\n\nlocale network_assums_generic = network_model _ auth_seg0 for\n auth_seg0 :: \"('ainfo \\ 'aahi ahi_scheme list) set\" +\n assumes\n\\ \\All authorized segments have valid interfaces\\\n ASM_if_valid: \"(info, l) \\ auth_seg0 \\ ifs_valid_None l\" and\n\\ \\All authorized segments are rooted, i.e., they start with None\\\n ASM_empty [simp, intro!]: \"(info, []) \\ auth_seg0\" and\n ASM_rooted: \"(info, l) \\ auth_seg0 \\ rooted l\" and\n ASM_terminated: \"(info, l) \\ auth_seg0 \\ terminated l\"\n\nlocale network_assums_undirect = network_assums_generic _ _ +\n assumes\n ASM_adversary: \"\\\\hf. hf \\ set hfs \\ ASID hf \\ bad\\ \\ (info, hfs) \\ auth_seg0\"\n\nlocale network_assums_direct = network_assums_generic _ _ +\n assumes\n ASM_singleton: \"\\ASID hf \\ bad\\ \\ (info, [hf]) \\ auth_seg0\" and\n ASM_extension: \"\\(info, hf2#ys) \\ auth_seg0; ASID hf2 \\ bad; ASID hf1 \\ bad\\\n \\ (info, hf1#hf2#ys) \\ auth_seg0\" and\n ASM_modify: \"\\(info, hf#ys) \\ auth_seg0; ASID hf = a; ASID hf' = a; UpIF hf' = UpIF hf; a \\ bad\\ \n \\ (info, hf'#ys) \\ auth_seg0\" and\n ASM_cutoff: \"\\(info, zs@hf#ys) \\ auth_seg0; ASID hf = a; a \\ bad\\ \\ (info, hf#ys) \\ auth_seg0\"\nbegin\n\nlemma auth_seg0_non_empty [simp, intro!]: \"auth_seg0 \\ {}\"\n by auto\n\nlemma auth_seg0_non_empty_frag [simp, intro!]: \"\\ info . pfragment info [] auth_seg0\"\n apply(auto simp add: pfragment_def)\n by (metis append_Nil2 ASM_empty)\n\ntext \\This lemma applies the extendability assumptions on @{text \"auth_seg0\"} to pfragments of \n@{text \"auth_seg0\"}.\\\nlemma extend_pfragment0:\n assumes \"pfragment ainfo (hf2#xs) auth_seg0\"\n assumes \"ASID hf1 \\ bad\"\n assumes \"ASID hf2 \\ bad\"\n shows \"pfragment ainfo (hf1#hf2#xs) auth_seg0\"\n using assms\n by(auto intro!: pfragmentI[of _ \"[]\" _ _] elim!: pfragmentE intro: ASM_cutoff intro!: ASM_extension)\n\ntext\\This lemma shows that the above assumptions imply that of the undirected setting\\\nlemma \"\\\\hf. hf \\ set hfs \\ ASID hf \\ bad\\ \\ (info, hfs) \\ auth_seg0\"\n apply(induction hfs)\n using ASM_empty apply blast\n subgoal for a hfs\n apply(cases hfs)\n by(auto intro!: ASM_singleton ASM_extension)\n done\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/Network_Assumptions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.26740164063736316}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Properties of Total Correctness Hoare Logic\\\n\ntheory HoareTotalProps imports SmallStep HoareTotalDef HoarePartialProps begin\n\nsubsection \\Soundness\\\n\nlemma hoaret_sound:\n assumes hoare: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ \\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Skip \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ \\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Basic f \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Spec r ,Normal s\\ \\ t\"\n \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n thus \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Spec r \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ r\" and exec_c2: \"\\\\\\c2,r\\ \\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: Fault_end)\n from valid_c1 ctxt exec_c1 P this\n have r: \"r \\ Normal ` R \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: exec_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s\\P\"\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c1,Normal s\\ \\ r\"\n have \"\\\\c2 \\ r\"\n proof (cases r)\n case (Normal r')\n with cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"r\\Normal ` R\"\n by auto\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n show \"\\\\c2 \\ r\"\n by auto\n qed auto\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ \\ t\"\n by cases auto\n with P True\n show ?thesis\n by - (rule cvalidt_postD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ \\ t\"\n by cases auto\n with P False\n show ?thesis\n by - (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n thus \"\\\\Cond b c1 c2 \\ Normal s\"\n using cvalidt_termD [OF valid_c1 ctxt] cvalidt_termD [OF valid_c2 ctxt]\n by (cases \"s \\ b\") (auto intro: terminates.intros)\n qed\nnext\n case (While r \\ F P b c A)\n assume wf: \"wf r\"\n have valid_c: \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n using While.hyps by iprover\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume wprems: \"\\\\\\While b c,Normal s\\ \\ t\" \"s \\ P\" \"t \\ Fault ` F\"\n from wf\n have \"\\t. \\\\\\\\While b c,Normal s\\ \\ t; s \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (induct)\n fix s t\n assume hyp:\n \"\\s' t. \\(s',s)\\r; \\\\\\While b c,Normal s'\\ \\ t; s' \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n assume exec: \"\\\\\\While b c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume b: \"s\\b\"\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n assume exec_w: \"\\\\\\While b c,s'\\ \\ t\"\n from exec_w t_notin_F have \"s' \\ Fault ` F\"\n by (auto dest: Fault_end)\n from exec_c P b valid_c ctxt this\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P) \\ Abrupt ` A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n show ?thesis\n proof (cases s')\n case Normal\n with exec_w s' t_notin_F\n show ?thesis\n by - (rule hyp,auto)\n next\n case Abrupt\n with exec_w have \"t=s'\"\n by (auto dest: Abrupt_end)\n with Abrupt s' show ?thesis\n by blast\n next\n case Fault\n with exec_w have \"t=s'\"\n by (auto dest: Fault_end)\n with Fault s' show ?thesis\n by blast\n next\n case Stuck\n with exec_w have \"t=s'\"\n by (auto dest: Stuck_end)\n with Stuck s' show ?thesis\n by blast\n qed\n next\n assume \"s\\b\" \"t=Normal s\" with P show ?thesis by simp\n qed\n qed\n with wprems show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\" by blast\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"s \\ P\"\n with wf\n show \"\\\\While b c \\ Normal s\"\n proof (induct)\n fix s\n assume hyp: \"\\s'. \\(s',s)\\r; s' \\ P\\\n \\ \\\\While b c \\ Normal s'\"\n assume P: \"s \\ P\"\n show \"\\\\While b c \\ Normal s\"\n proof (cases \"s \\ b\")\n case False with P show ?thesis\n by (blast intro: terminates.intros)\n next\n case True\n with valid_c P ctxt\n have \"\\\\c \\ Normal s\"\n by (simp add: cvalidt_def validt_def)\n moreover\n {\n fix s'\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases s')\n case (Normal s'')\n with exec_c P True valid_c ctxt\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P)\"\n by (fastforce simp add: cvalidt_def validt_def valid_def)\n then show ?thesis\n by (blast intro: hyp)\n qed auto\n }\n ultimately\n show ?thesis\n by (blast intro: terminates.intros)\n qed\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ (g \\ P)\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec g have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ P\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (CallRec P p Q A Specs r Specs_wf \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have wf: \"wf r\" by fact\n have Specs_wf:\n \"Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s, q),\\,p) \\ r},q,Q,A)) ` Specs)\" by fact\n from CallRec.hyps\n have valid_body:\n \"\\(P, p, Q, A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) the (\\ p) Q,A)\" by auto\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof -\n {\n fix \\p\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n from wf\n have \"\\\\ p P Q A. \\\\p = (\\,p); (P,p,Q,A) \\ Specs\\ \\\n \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ (p))) Q,A\"\n proof (induct \\p rule: wf_induct [rule_format, consumes 1, case_names WF])\n case (WF \\p \\ p P Q A)\n have \\p: \"\\p = (\\, p)\" by fact\n have p: \"(P, p, Q, A) \\ Specs\" by fact\n {\n fix q P' Q' A'\n assume q: \"(P',q,Q',A') \\ Specs\"\n have \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' \\ {s. ((s,q), \\,p) \\ r}) (Call q) Q',A'\"\n proof (rule validtI)\n fix s t\n assume exec_q:\n \"\\\\\\Call q,Normal s\\ \\ t\"\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from Pre q \\p\n have valid_bdy:\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') the (\\ q) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from exec_q show \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n proof (cases)\n fix bdy\n assume bdy: \"\\ q = Some bdy\"\n assume exec_bdy: \"\\\\\\bdy,Normal s\\ \\ t\"\n from valid_bdy [simplified bdy option.sel] t_notin_F exec_bdy Pre'\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (auto simp add: validt_def valid_def)\n with Pre q\n show ?thesis\n by auto\n next\n assume \"\\ q = None\"\n with q valid_body have False by auto\n thus ?thesis ..\n qed\n next\n fix s\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n from Pre q \\p\n have valid_bdy:\n \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') (the (\\ q)) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from valid_bdy ctxt Pre'\n have \"\\\\the (\\ q) \\ Normal s\"\n by (auto simp add: validt_def)\n with valid_body q\n show \"\\\\Call q\\ Normal s\"\n by (fastforce intro: terminates.Call)\n qed\n }\n hence \"\\(P, p, Q, A)\\Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by (auto simp add: cvalidt_def Specs_wf)\n with ctxt have \"\\(P, p, Q, A)\\\\ \\ Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by auto\n with p valid_body\n show \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (simp add: cvalidt_def) blast\n qed\n }\n note lem = this\n have valid_body':\n \"\\\\. \\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A \\\n \\(P,p,Q,A)\\Specs. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (auto intro: lem)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec_call: \"\\\\\\Call p,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n from exec_body bdy p P t_notin_F\n valid_body' [of \"s\", OF ctxt]\n ctxt\n have \"t \\ Normal ` Q \\ Abrupt ` A\"\n apply (simp only: cvalidt_def validt_def valid_def)\n apply (drule (1) bspec)\n apply auto\n done\n with p P\n show ?thesis\n by simp\n next\n assume \"\\ p = None\"\n with p valid_body have False by auto\n thus ?thesis by simp\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Call p \\ Normal s\"\n proof -\n from ctxt P p valid_body' [of \"s\",OF ctxt]\n have \"\\\\(the (\\ p)) \\ Normal s\"\n by (auto simp add: cvalidt_def validt_def)\n with valid_body p show ?thesis\n by (fastforce intro: terminates.Call)\n qed\n qed\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A\" by simp\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ \\ t\"\n from cvalidt_postD [OF valid_c [rule_format, OF P] ctxt this P t_notin_F]\n show ?thesis .\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\DynCom c \\ Normal s\"\n proof -\n from cvalidt_termD [OF valid_c [rule_format, OF P] ctxt P]\n have \"\\\\c s \\ Normal s\" .\n thus ?thesis\n by (rule terminates.intros)\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ \\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n next\n fix s\n show \"\\\\Throw \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt s'\"\n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ \\ t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cvalidt_postD [OF valid_c2 ctxt] exec_c2 t_notin_F\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\"\n assume notAbr: \"\\ isAbr t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P] t_notin_F\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt r\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"Abrupt r\\Normal ` Q \\ Abrupt ` R\"\n by auto\n hence \"Abrupt r\\Abrupt ` R\" by fast\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n have \"\\\\c\\<^sub>2 \\ Normal r\"\n by fast\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt:\n \"\\s \\ P. (\\P' Q' A'. (\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\" by blast\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from adapt [rule_format, OF P]\n obtain P' and Q' and A' where\n valid_P'_Q': \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n and weaken: \"s \\ P'\" \"Q' \\ Q\" \"A'\\ A\"\n by blast\n from exec valid_P'_Q' ctxt t_notin_F\n have P'_Q': \"Normal s \\ Normal ` P' \\\n t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (unfold cvalidt_def validt_def valid_def) blast\n hence \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by blast\n with weaken\n show ?thesis\n by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from P adapt\n obtain P' and Q' and A' where\n \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n \"s \\ P'\"\n by blast\n with ctxt\n show ?thesis\n by (simp add: cvalidt_def validt_def)\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n assume \"(P, p, Q, A) \\ \\\"\n then show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: cvalidt_def )\nnext\n case ExFalso thus ?case by iprover\nqed\n\nlemma hoaret_sound':\n\"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (drule hoaret_sound)\n apply (simp add: cvalidt_def)\n done\n\ntheorem total_to_partial:\n assumes total: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" shows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from total have \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_sound)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cvalidt_def validt_def cvalid_def)\n thus ?thesis\n by (rule hoare_complete)\nqed\n\nsubsection \\Completeness\\\n\nlemma MGT_valid:\n\"\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s} c\n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validtI)\n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\"\n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\\n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n apply (cases t)\n apply (auto simp add: final_notin_def)\n done\nnext\n fix s\n assume \"s \\ {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n thus \"\\\\c\\Normal s\"\n by blast\nqed\n\ntext \\The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of \\MGT_lemma\\.\\\nlemma ConseqMGT:\n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\\n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl\nby - (rule conseq [OF modif],blast)\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT)\n apply (insert valid)\n apply (auto simp add: validt_def valid_def intro!: final_notinI)\n done\n\nlemma conseq_extract_state_indep_prop:\n assumes state_indep_prop:\"\\s \\ P. R\"\n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\nlemma MGT_lemma:\n assumes MGT_Calls:\n \"\\p \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Skip \\ Normal s}\n Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def\n intro: exec.intros terminates.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Basic f \\ Normal s}\n Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Basic [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def\n intro: exec.intros terminates.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Spec r \\ Normal s}\n Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2)\n have hyp_c1: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c1\\Normal s}\n c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\"\n using Seq.hyps by iprover\n have hyp_c2: \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c2\\Normal s}\n c2\n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\"\n using Seq.hyps by iprover\n from hyp_c1\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s} c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\ \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c2\\Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n elim: terminates_Normal_elim_cases\n intro: exec.intros)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s}\n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoaret.Seq )\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c2 \\ Normal t}\n c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (rule exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (rule exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c1\\Normal s}\n c1\n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\"\n using Cond.hyps by iprover\n hence \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Cond b c1 c2)\\Normal s}\\b)\n c1\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondTrue\n elim: terminates_Normal_elim_cases)\n moreover\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c2\\Normal s}\n c2\n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\"\n using Cond.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Cond b c1 c2)\\Normal s}\\-b)\n c2\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondFalse\n elim: terminates_Normal_elim_cases)\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Cond b c1 c2)\\Normal s}\n (Cond b c1 c2)\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Cond)\nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\"\n let ?A = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n let ?r = \"{(t,s). \\\\(While b c)\\Normal s \\ s\\b \\\n \\\\\\c,Normal s\\ \\ Normal t}\"\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(While b c)\\Normal s}\n (While b c)\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"\\ Z. ?P' Z\"\n and ?Q'=\"\\ Z. ?P' Z \\ - b\"])\n have wf_r: \"wf ?r\" by (rule wf_terminates_while)\n show \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A Z)\"\n proof (rule allI, rule hoaret.While [OF wf_r])\n fix Z\n from While\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n show \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ ?P' Z \\ b) c\n ({t. (t, \\) \\ ?r} \\ ?P' Z),(?A Z)\"\n proof (rule allI, rule ConseqMGT [OF hyp_c])\n fix \\ s\n assume \"s\\ {\\} \\\n {t. (Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\n \\ b\"\n then obtain\n s_eq_\\: \"s=\\\" and\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n while_term: \"\\\\(While b c)\\Normal s\" and\n s_in_b: \"s\\b\"\n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal t} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (t,\\) \\ ?r} \\\n {t. (Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}) \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b while_term show ?C1\n by (blast elim: terminates_Normal_elim_cases)\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n with s_eq_\\ while_term s_in_b have \"(t,\\) \\ ?r\"\n by blast\n moreover\n from Z_s_unroll s_t s_in_b\n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover from while_term s_t s_in_b\n have \"\\\\(While b c)\\Normal t\"\n by (blast elim: terminates_Normal_elim_cases)\n moreover note noabort\n ultimately\n have \"(t,\\) \\ ?r \\ (Z, t) \\ ?unroll \\\n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\"\n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\While b c \\ Normal s}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\\n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A s \\ t\\?A Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\\n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\\n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\"\n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body:\n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call p)\n from noStuck_Call\n have \"\\s \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal s}.\n p \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume p_defined: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\\n \\\\\\Call p ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\\\Call p\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp:\n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c s'\\Normal s} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\DynCom c\\Normal s}\n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp])\n (fastforce simp add: final_notin_def intro: exec.intros\n elim: terminates_Normal_elim_cases)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\DynCom c\\Normal s}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Guard f g c\\ Normal s}\n Guard f g c\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s=Z \\\n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros\n elim: terminates_Normal_elim_cases)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s \\ g \\ s=Z \\\n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s} )\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros\n elim: terminates_Normal_elim_cases)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Throw \\ Normal s}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw])\n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\<^sub>1 \\ Normal s}\n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \\\\c\\<^sub>2 \\ Normal t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros\n elim: terminates_Normal_elim_cases\n simp add: final_notin_def)\n moreover\n have\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\<^sub>2 \\ Normal s} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\ \\\\c\\<^sub>2 \\ Normal s \\\n \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))}\n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros\n simp add: noFault_def')\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s}\n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Catch )\nqed\n\n\n\n\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\"\n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body:\n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t}\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call q)\n let ?P = \"{s. s=Z \\ \\\\\\Call q ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ Call q \\ redexes c')}\"\n from noStuck_Call\n have \"\\s \\ ?P. q \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume q_defined: \"q \\ dom \\\"\n from Call_hyp have\n \"\\q\\dom \\. \\Z.\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n by (simp add: exec_Call_body' noFaultStuck_Call_body' [simplified]\n terminates_Normal_Call_body)\n from Call_hyp q_defined have Call_hyp':\n \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n by auto\n show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ?P\n (Call q)\n {t. \\\\\\Call q ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q ,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF Call_hyp'],safe)\n fix c'\n assume termi: \"\\\\Call p \\ Normal \\\"\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume red_c': \"Call q \\ redexes c'\"\n show \"\\\\Call q \\ Normal Z\"\n proof -\n from steps_preserves_termination' [OF steps_c' termi]\n have \"\\\\c' \\ Normal Z\" .\n from redexes_preserves_termination [OF this red_c']\n show ?thesis .\n qed\n next\n fix c'\n assume termi: \"\\\\Call p \\ Normal \\\"\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume red_c': \"Call q \\ redexes c'\"\n from redex_redexes [OF this]\n have \"redex c' = Call q\"\n by auto\n with termi steps_c'\n show \"((Z, q), \\, p) \\ termi_call_steps \\\"\n by (auto simp add: termi_call_steps_def)\n qed\n qed\nnext\n case (DynCom c)\n have hyp:\n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>\n {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c s' \\ redexes c')}\n (c s')\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ DynCom c \\ redexes c')}\n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp],safe)\n assume \"\\\\\\DynCom c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n then show \"\\\\\\c Z,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume c': \"DynCom c \\ redexes c'\"\n have \"\\\\ (DynCom c, Normal Z) \\ (c Z,Normal Z)\"\n by (rule step.DynCom)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c Z \\ redexes c''\"\n by blast\n note steps also note step\n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c Z \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\c Z,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\DynCom c,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\c Z,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\DynCom c,Normal Z\\ \\ Abrupt t\"\n by (auto intro: exec.intros)\n qed\n show ?case\n apply (rule hoaret.DynCom)\n apply safe\n apply (rule hyp')\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c \\ redexes c')}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard.hyps by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Guard f g c ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ Guard f g c \\ redexes c')}\n Guard f g c\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ {s. s=Z \\\n \\\\\\Guard f g c ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\\n Guard f g c \\ redexes c')})\n c\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c], safe)\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \"Z\\g\"\n thus \"\\\\\\c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume c': \"Guard f g c \\ redexes c'\"\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step\n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n \"\\\\\\c,Normal Z\\ \\ Normal t\" \"Z \\ g\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n by (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n \"\\\\\\c,Normal Z\\ \\ Abrupt t\" \"Z \\ g\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n by (auto simp add: final_notin_def intro: exec.intros )\n qed\n from True this show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ {s. s=Z \\\n \\\\\\Guard f g c ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\\n Guard f g c \\ redexes c')})\n c\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c], safe)\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume c': \"Guard f g c \\ redexes c'\"\n\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step\n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n \"\\\\\\c,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n \"\\\\\\c,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n qed\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p, Normal \\) \\\\<^sup>+ (c',Normal s) \\ Throw \\ redexes c')}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw])\n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp_c1:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\\n c\\<^sub>1 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have hyp_c2:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\)\\\\<^sup>+(c',Normal s) \\\n Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault`(-F)) \\ \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\"\n proof (rule ConseqMGT [OF hyp_c1],clarify,safe)\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c\\<^sub>1,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume c': \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n from steps redexes_subset [OF this]\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c\\<^sub>1 \\ redexes c'\"\n by (auto iff: root_in_redexes)\n next\n fix t\n assume \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c' t\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\"\n assume red: \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal t) \\ c\\<^sub>2 \\ redexes c'\"\n proof -\n note steps_c'\n also\n from exec_impl_steps_Normal_Abrupt [OF exec_c\\<^sub>1]\n have \"\\\\ (c\\<^sub>1, Normal Z) \\\\<^sup>* (Throw, Normal t)\".\n from steps_redexes_Catch [OF this red]\n obtain c'' where\n steps_c'': \"\\\\ (c', Normal Z) \\\\<^sup>* (c'', Normal t)\" and\n Catch: \"Catch Throw c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps_c''\n also\n have step_Catch: \"\\\\ (Catch Throw c\\<^sub>2,Normal t) \\ (c\\<^sub>2,Normal t)\"\n by (rule step.CatchThrow)\n from step_redexes [OF step_Catch Catch]\n obtain c''' where\n step_c''': \"\\\\ (c'', Normal t) \\ (c''', Normal t)\" and\n c2: \"c\\<^sub>2 \\ redexes c'''\"\n by blast\n note step_c'''\n finally show ?thesis\n using c2\n by blast\n qed\n qed\n moreover\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp_c2]) (fastforce intro: exec.intros)\n ultimately show ?case\n by (rule hoaret.Catch)\nqed\n\n\ntext \\To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body.\n\\\n\nlemma Call_lemma:\n assumes A:\n \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes pdef: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub>\n ({\\} \\ {s. s=Z \\\\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\the (\\ p)\\Normal s})\n the (\\ p)\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma' [OF A])\nusing pdef\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] root_in_redexes)\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes\n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub>\n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub>\n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal s})\n the (\\ p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\nusing p_defined\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call]\nroot_in_redexes)\ndone\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z.\n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ])\napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext \\Another proof of \\MGT_Call\\, maybe a little more readable\\\nlemma\n\"\\p \\ dom \\. \\Z.\n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n define Specs where \"Specs = (\\p\\dom \\. \\Z.\n {({s. s=Z \\\n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n define Specs_wf where \"Specs_wf p \\ = (\\(P,q,Q,A).\n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs\" for p \\\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\the (\\ p)\\Normal s})\n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format, OF _ defined])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal s})\n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined]\n noFaultStuck_Call_body' [OF defined]\n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z.\n {({s. s=Z \\\n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\",\n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\n\ntheorem hoaret_complete: \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Call])\n\nlemma hoaret_complete':\n assumes cvalid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_complete)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\nsubsection \\And Now: Some Useful Rules\\\n\nsubsubsection \\Modify Return\\\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif:\n \"\\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr:\n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\"\n from exec_body bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\(Call p),Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where\n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and\n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\\n \\\\c s t \\ Normal (return' s t)\"\n by cases auto\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr:\n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule ProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif:\n \"\\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr:\n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\"\n from exec_body bdy\n have \"\\\\\\(Call p) ,Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\"\n assume t: \"t = Abrupt (return s t')\"\n also\n from exec_body bdy\n have \"\\\\\\Call p ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where\n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and\n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\\n \\\\c s t \\ Normal (return' s t)\"\n by cases auto\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr:\n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec:\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule ProcModifyReturnSameFaults_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\n\nsubsubsection \\DynCall\\\n\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif:\n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif\n have valid_modif':\n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\"\n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.Call)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') =\n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\"\n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where\n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and\n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\\n \\\\c s t \\ Normal (return' s t)\"\n by cases auto\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P\n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s)\n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s)\n \\ return' s t = return s t\"\nassumes modif:\n \"\\s \\ P. \\\\.\n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturn_sound\n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif:\n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif\n have valid_modif':\n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\"\n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\"\n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') =\n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\"\n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\"\n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\"\n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\"\n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where\n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and\n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\\n \\\\c s t \\ Normal (return' s t)\"\n by cases auto\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P\n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nassumes modif:\n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturnSameFaults_sound\n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nsubsubsection \\Conjunction of Postcondition\\\n\nlemma PostConjI_sound:\n assumes valid_Q: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_R: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n moreover\n from valid_R ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cvalidt_postD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from valid_Q ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_R: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoaret_complete')\napply (rule PostConjI_sound)\napply (rule hoaret_sound [OF deriv_Q])\napply (rule hoaret_sound [OF deriv_R])\ndone\n\n\nlemma Merge_PostConj_sound:\n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/G\\<^esub> P (Call p) Q,A\"\n by (auto intro: validt_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cvalidt_postD [OF validF [rule_format] ctxt exec P t_noFault]\n have t: \"t \\ Normal ` Q \\ Abrupt ` A\".\n then have \"t \\ Fault ` G\"\n by auto\n from cvalidt_postD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n with t show ?thesis by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from validF ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\n\n\nlemma Merge_PostConj:\n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoaret_complete')\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoaret_sound)\nusing validG apply (blast intro:hoaret_sound)\ndone\n\n\nsubsubsection \\Guards and Guarantees\\\n\nlemma SplitGuards_sound:\n assumes valid_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes valid_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case Abrupt\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case (Fault f)\n assume t: \"t=Fault f\"\n with exec inter_guards_exec_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f\"\n from cvalidt_postD [OF valid_c1 ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n from cvalidD [OF valid_c2 ctxt' this P] t t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1 \\ Normal s\"\n by (rule cvalidt_termD)\n with c show ?thesis\n by (rule inter_guards_terminates)\n qed\nqed\n\nlemma SplitGuards:\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SplitGuards_sound [OF _ _ c])\napply (rule hoaret_sound [OF deriv_c1])\napply (rule hoare_sound [OF deriv_c2])\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n from ctxt have ctxt'': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt'' exec P] Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt'' exec P] Abrupt\n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ \\ Fault f\"\n by (auto intro: exec_to_exec_strip_guards_Fault)\n from cvalidD [OF valid_strip ctxt' this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt'' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt'' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule CombineStrip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n from ctxt have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults simp add: validt_def)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/-F\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt' exec P] Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt' exec P] Abrupt\n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cvalidD [OF validFlip ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\n\nlemma GuardsFlip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule GuardsFlip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n from exec_mark_guards_to_exec [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\mark_guards f c \\ Normal s\"\n by (rule terminates_to_terminates_mark_guards)\nqed\n\nlemma MarkGuardsI:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\n\nlemma MarkGuardsD_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with exec_to_exec_mark_guards_Fault exec\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from exec_to_exec_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n by auto\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\mark_guards f c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_mark_guards_to_terminates)\nqed\n\nlemma MarkGuardsD:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsI_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\"\n from exec_merge_guards_to_exec [OF exec_merge]\n have exec: \"\\\\\\c,Normal s\\ \\ t\" .\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\merge_guards c \\ Normal s\"\n by (rule terminates_to_terminates_merge_guards)\nqed\n\nlemma MergeGuardsI:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoaret_complete')\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsD_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n from exec_to_exec_merge_guards [OF exec]\n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\".\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\merge_guards c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_merge_guards_to_terminates)\nqed\n\n\n\n\nlemma SubsetGuards_sound:\n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n from exec_to_exec_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\"\n assume t_noFault: \"t \\ Fault ` {}\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have termi_c': \"\\\\c' \\ Normal s\".\n from cvalidt_postD [OF valid ctxt _ P]\n have noFault_c': \"\\\\\\c',Normal s\\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def)\n from termi_c' c_c' noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule terminates_fewer_guards)\nqed\n\nlemma SubsetGuards:\n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeD_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\"\n hence exec_norm: \"\\\\\\normalize c,Normal s\\ \\ t\"\n by (rule exec_to_exec_normalize)\n assume P: \"s \\ P\"\n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\normalize c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_normalize_to_terminates)\nqed\n\nlemma NormalizeD:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeI_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"\\\\\\normalize c,Normal s\\ \\ t\"\n hence exec: \"\\\\\\c,Normal s\\ \\ t\"\n by (rule exec_normalize_to_exec)\n assume P: \"s \\ P\"\n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\ c \\ Normal s\".\n thus \"\\\\normalize c \\ Normal s\"\n by (rule terminates_to_terminates_normalize)\nqed\n\nlemma NormalizeI:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nsubsubsection \\Restricting the Procedure Environment\\\n\nlemma validt_restrict_to_validt:\nassumes validt_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from validt_c\n have valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\" by (simp add: validt_def)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule valid_restrict_to_valid)\n moreover\n {\n fix s\n assume P: \"s \\ P\"\n have \"\\\\c\\Normal s\"\n proof -\n from P validt_c have \"\\|\\<^bsub>M\\<^esub>\\c\\Normal s\"\n by (auto simp add: validt_def)\n moreover\n from P valid_c\n have \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\\\{Stuck}\"\n by (auto simp add: valid_def final_notin_def)\n ultimately show ?thesis\n by (rule terminates_restrict_to_terminates)\n qed\n }\n ultimately show ?thesis\n by (auto simp add: validt_def)\nqed\n\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_restrict_to_validt)\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nsubsubsection \\Miscellaneous\\\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_augment_Faults [OF _ F])\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nlemma TerminationPartial_sound:\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n assumes partial_corr: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing \"termination\" partial_corr\nby (auto simp add: cvalidt_def validt_def cvalid_def)\n\nlemma TerminationPartial:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete')\n apply (rule TerminationPartial_sound [OF \"termination\"])\n apply (rule hoare_sound [OF partial_deriv])\n done\n\nlemma TerminationPartialStrip:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. strip F' \\\\strip_guards F' c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from \"termination\" have \"\\s \\ P. \\\\c\\Normal s\"\n by (auto intro: terminates_strip_guards_to_terminates\n terminates_strip_to_terminates)\n with partial_deriv\n show ?thesis\n by (rule TerminationPartial)\nqed\n\nlemma SplitTotalPartial:\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n\nlemma SplitTotalPartial':\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/HoareTotalProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.26738624997152294}} {"text": "section \\Instantiate framework with control dependences\\\n\ntheory CDepInstantiations imports \n Slice \n PDG \n WeakOrderDependence \nbegin\n\nsubsection\\Standard control dependence\\\n\ncontext StandardControlDependencePDG begin\n\nlemma Exit_in_obs_slice_node:\"(_Exit_) \\ obs n' (PDG_BS S) \\ (_Exit_) \\ S\"\n by(auto elim:obsE PDG_path_CFG_path simp:PDG_BS_def split:if_split_asm)\n\n\nabbreviation PDG_path' :: \"'node \\ 'node \\ bool\" (\"_ \\\\<^sub>d* _\" [51,0] 80)\n where \"n \\\\<^sub>d* n' \\ PDG.PDG_path sourcenode targetnode valid_edge Def Use\n standard_control_dependence n n'\"\n\nlemma cd_closed:\n \"\\n' \\ PDG_BS S; n controls\\<^sub>s n'\\ \\ n \\ PDG_BS S\"\n by(simp add:PDG_BS_def)(blast dest:PDG_cdep_edge PDG_path_Append PDG_path_cdep)\n\n\nlemma obs_postdominate:\n assumes \"n \\ obs n' (PDG_BS S)\" and \"n \\ (_Exit_)\" shows \"n postdominates n'\"\nproof(rule ccontr)\n assume \"\\ n postdominates n'\"\n from \\n \\ obs n' (PDG_BS S)\\ have \"valid_node n\" by(fastforce dest:in_obs_valid)\n with \\n \\ obs n' (PDG_BS S)\\ \\n \\ (_Exit_)\\ have \"n postdominates n\"\n by(fastforce intro:postdominate_refl)\n from \\n \\ obs n' (PDG_BS S)\\ obtain as where \"n' -as\\* n\"\n and \"\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\"\n and \"n \\ (PDG_BS S)\" by(erule obsE)\n from \\n postdominates n\\ \\\\ n postdominates n'\\ \\n' -as\\* n\\\n obtain as' a as'' where [simp]:\"as = as'@a#as''\" and \"valid_edge a\"\n and \"\\ n postdominates (sourcenode a)\" and \"n postdominates (targetnode a)\"\n by -(erule postdominate_path_branch)\n from \\\\ n postdominates (sourcenode a)\\ \\valid_edge a\\ \\valid_node n\\\n obtain asx where \"sourcenode a -asx\\* (_Exit_)\"\n and \"n \\ set(sourcenodes asx)\" by(auto simp:postdominate_def)\n from \\sourcenode a -asx\\* (_Exit_)\\ \\valid_edge a\\\n obtain ax asx' where [simp]:\"asx = ax#asx'\"\n apply - apply(erule path.cases)\n apply(drule_tac s=\"(_Exit_)\" in sym)\n apply simp\n apply(drule Exit_source)\n by simp_all\n with \\sourcenode a -asx\\* (_Exit_)\\ have \"sourcenode a -[]@ax#asx'\\* (_Exit_)\" \n by simp\n hence \"valid_edge ax\" and [simp]:\"sourcenode a = sourcenode ax\"\n and \"targetnode ax -asx'\\* (_Exit_)\"\n by(fastforce dest:path_split)+\n with \\n \\ set(sourcenodes asx)\\ have \"\\ n postdominates targetnode ax\"\n by(fastforce simp:postdominate_def sourcenodes_def)\n from \\n \\ obs n' (PDG_BS S)\\ \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\\n have \"n \\ set (sourcenodes (a#as''))\"\n by(fastforce elim:obs.cases simp:sourcenodes_def)\n from \\n' -as\\* n\\ have \"sourcenode a -a#as''\\* n\"\n by(fastforce dest:path_split_second)\n with \\n postdominates (targetnode a)\\ \\\\ n postdominates targetnode ax\\\n \\valid_edge ax\\ \\n \\ set (sourcenodes (a#as''))\\\n have \"sourcenode a controls\\<^sub>s n\" by(fastforce simp:standard_control_dependence_def)\n with \\n \\ obs n' (PDG_BS S)\\ have \"sourcenode a \\ (PDG_BS S)\"\n by(fastforce intro:cd_closed PDG_cdep_edge elim:obs.cases)\n with \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\ \n show False by(simp add:sourcenodes_def)\nqed\n\n\nlemma obs_singleton:\"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\"\nproof(rule ccontr)\n assume \"\\ ((\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {})\"\n hence \"\\nx nx'. nx \\ obs n (PDG_BS S) \\ nx' \\ obs n (PDG_BS S) \\\n nx \\ nx'\" by auto\n then obtain nx nx' where \"nx \\ obs n (PDG_BS S)\" and \"nx' \\ obs n (PDG_BS S)\"\n and \"nx \\ nx'\" by auto\n from \\nx \\ obs n (PDG_BS S)\\ obtain as where \"n -as\\* nx\" \n and \"\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\" and \"nx \\ (PDG_BS S)\" \n by(erule obsE)\n from \\n -as\\* nx\\ have \"valid_node nx\" by(fastforce dest:path_valid_node)\n with \\nx \\ (PDG_BS S)\\ have \"obs nx (PDG_BS S) = {nx}\" by -(rule n_in_obs)\n with \\n -as\\* nx\\ \\nx \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \\nx \\ nx'\\\n have \"as \\ []\" by(fastforce elim:path.cases)\n with \\n -as\\* nx\\ \\nx \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \n \\nx \\ nx'\\ \\obs nx (PDG_BS S) = {nx}\\ \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\\n have \"\\a as' as''. n -as'\\* sourcenode a \\ targetnode a -as''\\* nx \\\n valid_edge a \\ as = as'@a#as'' \\ \n obs (targetnode a) (PDG_BS S) = {nx} \\ \n (\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {}))\"\n proof(induct arbitrary:nx' rule:path.induct)\n case (Cons_path n'' as n' a n)\n note [simp] = \\sourcenode a = n\\[THEN sym] \\targetnode a = n''\\[THEN sym]\n note more_than_one = \\n' \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \\n' \\ nx'\\\n note IH = \\\\nx'. \\n' \\ obs n'' (PDG_BS S); nx' \\ obs n'' (PDG_BS S); n' \\ nx'; \n obs n' (PDG_BS S) = {n'}; \\n'\\set (sourcenodes as). n' \\ (PDG_BS S); as \\ []\\\n \\ \\a as' as''. n'' -as'\\* sourcenode a \\ targetnode a -as''\\* n' \\\n valid_edge a \\ as = as'@a#as'' \\ obs (targetnode a) (PDG_BS S) = {n'} \\\n (\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {}))\\\n from \\\\n'\\set (sourcenodes (a#as)). n' \\ (PDG_BS S)\\\n have \"\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\" and \"sourcenode a \\ (PDG_BS S)\"\n by(simp_all add:sourcenodes_def)\n show ?case\n proof(cases \"as = []\")\n case True\n with \\n'' -as\\* n'\\ have [simp]:\"n' = n''\" by(fastforce elim:path.cases)\n from more_than_one\n have \"\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {})\"\n by auto\n with \\obs n' (PDG_BS S) = {n'}\\ True \\valid_edge a\\ show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n by(auto intro!:empty_path)\n next\n case False\n hence \"as \\ []\" .\n from \\n'' -as\\* n'\\ \\\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\\ \n have \"obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\" by(rule path_obs_subset)\n show ?thesis\n proof(cases \"obs n' (PDG_BS S) = obs n'' (PDG_BS S)\")\n case True\n with \\n'' -as\\* n'\\ \\valid_edge a\\ \\obs n' (PDG_BS S) = {n'}\\ more_than_one\n show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"as\" in exI)\n by(fastforce intro:empty_path)\n next\n case False\n with \\obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\\\n have \"obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\" by simp\n with \\obs n' (PDG_BS S) = {n'}\\ obtain ni where \"n' \\ obs n'' (PDG_BS S)\"\n and \"ni \\ obs n'' (PDG_BS S)\" and \"n' \\ ni\" by auto\n from IH[OF this \\obs n' (PDG_BS S) = {n'}\\ \n \\\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\\ \\as \\ []\\] obtain a' as' as''\n where \"n'' -as'\\* sourcenode a'\" and \"targetnode a' -as''\\* n'\"\n and \"valid_edge a'\" and [simp]:\"as = as'@a'#as''\" \n and \"obs (targetnode a') (PDG_BS S) = {n'}\"\n and more_than_one':\"\\ (\\m. obs (sourcenode a') (PDG_BS S) = {m} \\ \n obs (sourcenode a') (PDG_BS S) = {})\"\n by blast\n from \\n'' -as'\\* sourcenode a'\\ \\valid_edge a\\\n have \"n -a#as'\\* sourcenode a'\" by(fastforce intro:path.Cons_path)\n with \\targetnode a' -as''\\* n'\\ \\obs (targetnode a') (PDG_BS S) = {n'}\\\n more_than_one' \\valid_edge a'\\ show ?thesis\n apply(rule_tac x=\"a'\" in exI)\n apply(rule_tac x=\"a#as'\" in exI)\n apply(rule_tac x=\"as''\" in exI)\n by fastforce\n qed\n qed\n qed simp\n then obtain a as' as'' where \"valid_edge a\"\n and \"obs (targetnode a) (PDG_BS S) = {nx}\"\n and more_than_one:\"\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {})\"\n by blast\n have \"sourcenode a \\ (PDG_BS S)\"\n proof(rule ccontr)\n assume \"\\ sourcenode a \\ PDG_BS S\"\n hence \"sourcenode a \\ PDG_BS S\" by simp\n with \\valid_edge a\\ have \"obs (sourcenode a) (PDG_BS S) = {sourcenode a}\"\n by(fastforce intro!:n_in_obs)\n with more_than_one show False by simp\n qed\n with \\valid_edge a\\ \n have \"obs (targetnode a) (PDG_BS S) \\ obs (sourcenode a) (PDG_BS S)\"\n by(rule edge_obs_subset)\n with \\obs (targetnode a) (PDG_BS S) = {nx}\\ \n have \"nx \\ obs (sourcenode a) (PDG_BS S)\" by simp\n with more_than_one obtain m where \"m \\ obs (sourcenode a) (PDG_BS S)\"\n and \"nx \\ m\" by auto\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n have \"valid_node m\" by(fastforce dest:in_obs_valid)\n from \\obs (targetnode a) (PDG_BS S) = {nx}\\ have \"valid_node nx\" \n by(fastforce dest:in_obs_valid)\n show False\n proof(cases \"m postdominates (sourcenode a)\")\n case True\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\m \\ obs (sourcenode a) (PDG_BS S)\\\n have \"m postdominates nx\"\n by(fastforce intro:postdominate_path_targetnode elim:obs.cases)\n with \\nx \\ m\\ have \"\\ nx postdominates m\" by(fastforce dest:postdominate_antisym)\n have \"(_Exit_) -[]\\* (_Exit_)\" by(fastforce intro:empty_path)\n with \\m postdominates nx\\ have \"nx \\ (_Exit_)\"\n by(fastforce simp:postdominate_def sourcenodes_def)\n have \"\\ nx postdominates (sourcenode a)\"\n proof(rule ccontr)\n assume \"\\ \\ nx postdominates sourcenode a\"\n hence \"nx postdominates sourcenode a\" by simp\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n obtain asx' where \"sourcenode a -asx'\\* m\" and \"nx \\ set(sourcenodes asx')\"\n by(fastforce elim:obs.cases)\n with \\nx postdominates sourcenode a\\ have \"nx postdominates m\"\n by(rule postdominate_path_targetnode)\n with \\\\ nx postdominates m\\ show False by simp\n qed\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\valid_node nx\\ \\nx \\ (_Exit_)\\ \n show False by(fastforce dest:obs_postdominate)\n next\n case False\n show False\n proof(cases \"m = Exit\")\n case True\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n obtain xs where \"sourcenode a -xs\\* m\" and \"nx \\ set(sourcenodes xs)\"\n by(fastforce elim:obsE)\n obtain x' xs' where [simp]:\"xs = x'#xs'\"\n proof(cases xs)\n case Nil\n with \\sourcenode a -xs\\* m\\ have [simp]:\"sourcenode a = m\" by fastforce\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n have \"m \\ (PDG_BS S)\" by(metis obsE)\n with \\valid_node m\\ have \"obs m (PDG_BS S) = {m}\"\n by(rule n_in_obs)\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ m\\ have False\n by fastforce\n thus ?thesis by simp\n qed blast\n from \\sourcenode a -xs\\* m\\ have \"sourcenode a = sourcenode x'\" \n and \"valid_edge x'\" and \"targetnode x' -xs'\\* m\"\n by(auto elim:path_split_Cons)\n from \\targetnode x' -xs'\\* m\\ \\nx \\ set(sourcenodes xs)\\ \\valid_edge x'\\ \n \\valid_node m\\ True\n have \"\\ nx postdominates (targetnode x')\" \n by(fastforce simp:postdominate_def sourcenodes_def)\n from \\nx \\ m\\ True have \"nx \\ (_Exit_)\" by simp\n with \\obs (targetnode a) (PDG_BS S) = {nx}\\\n have \"nx postdominates (targetnode a)\"\n by(fastforce intro:obs_postdominate)\n from \\obs (targetnode a) (PDG_BS S) = {nx}\\\n obtain ys where \"targetnode a -ys\\* nx\" \n and \"\\nx' \\ set(sourcenodes ys). nx' \\ (PDG_BS S)\"\n and \"nx \\ (PDG_BS S)\" by(fastforce elim:obsE)\n hence \"nx \\ set(sourcenodes ys)\"by fastforce\n have \"sourcenode a \\ nx\"\n proof\n assume \"sourcenode a = nx\"\n from \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n have \"nx \\ (PDG_BS S)\" by -(erule obsE)\n with \\valid_node nx\\ have \"obs nx (PDG_BS S) = {nx}\" by -(erule n_in_obs)\n with \\sourcenode a = nx\\ \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n \\nx \\ m\\ show False by fastforce\n qed\n with \\nx \\ set(sourcenodes ys)\\ have \"nx \\ set(sourcenodes (a#ys))\"\n by(fastforce simp:sourcenodes_def)\n from \\valid_edge a\\ \\targetnode a -ys\\* nx\\\n have \"sourcenode a -a#ys\\* nx\" by(fastforce intro:Cons_path)\n from \\sourcenode a -a#ys\\* nx\\ \\nx \\ set(sourcenodes (a#ys))\\\n \\nx postdominates (targetnode a)\\ \\valid_edge x'\\\n \\\\ nx postdominates (targetnode x')\\ \\sourcenode a = sourcenode x'\\\n have \"(sourcenode a) controls\\<^sub>s nx\"\n by(fastforce simp:standard_control_dependence_def)\n with \\nx \\ (PDG_BS S)\\ have \"sourcenode a \\ (PDG_BS S)\"\n by(rule cd_closed)\n with \\valid_edge a\\ have \"obs (sourcenode a) (PDG_BS S) = {sourcenode a}\"\n by(fastforce intro!:n_in_obs)\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\\n \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ m\\\n show False by simp\n next\n case False\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\valid_node m\\\n \\\\ m postdominates sourcenode a\\ \n show False by(fastforce dest:obs_postdominate)\n qed\n qed\nqed\n\n\nlemma PDGBackwardSliceCorrect:\n \"BackwardSlice sourcenode targetnode kind valid_edge\n (_Entry_) Def Use state_val PDG_BS\"\nproof(unfold_locales)\n fix n S assume \"n \\ PDG_BS S\"\n thus \"valid_node n\" by(rule PDG_BS_valid_node)\nnext\n fix n S assume \"valid_node n\" and \"n \\ S\"\n thus \"n \\ PDG_BS S\" by(fastforce intro:PDG_path_Nil simp:PDG_BS_def)\nnext\n fix n' S n V\n assume \"n' \\ PDG_BS S\" and \"n influences V in n'\"\n thus \"n \\ PDG_BS S\"\n by(auto dest:PDG.PDG_path_ddep[OF PDG_scd,OF PDG.PDG_ddep_edge[OF PDG_scd]]\n dest:PDG_path_Append simp:PDG_BS_def split:if_split_asm)\nnext\n fix n S\n have \"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\" \n by(rule obs_singleton)\n thus \"finite (obs n (PDG_BS S))\" by fastforce\nnext\n fix n S\n have \"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\" \n by(rule obs_singleton)\n thus \"card (obs n (PDG_BS S)) \\ 1\" by fastforce\nqed\n\nend\n\n\nsubsection\\Weak control dependence\\\n\ncontext WeakControlDependencePDG begin\n\nlemma Exit_in_obs_slice_node:\"(_Exit_) \\ obs n' (PDG_BS S) \\ (_Exit_) \\ S\"\n by(auto elim:obsE PDG_path_CFG_path simp:PDG_BS_def split:if_split_asm)\n\n\nlemma cd_closed:\n \"\\n' \\ PDG_BS S; n weakly controls n'\\ \\ n \\ PDG_BS S\"\n by(simp add:PDG_BS_def)(blast dest:PDG_cdep_edge PDG_path_Append PDG_path_cdep)\n\n\nlemma obs_strong_postdominate:\n assumes \"n \\ obs n' (PDG_BS S)\" and \"n \\ (_Exit_)\" \n shows \"n strongly-postdominates n'\"\nproof(rule ccontr)\n assume \"\\ n strongly-postdominates n'\"\n from \\n \\ obs n' (PDG_BS S)\\ have \"valid_node n\" by(fastforce dest:in_obs_valid)\n with \\n \\ obs n' (PDG_BS S)\\ \\n \\ (_Exit_)\\ have \"n strongly-postdominates n\"\n by(fastforce intro:strong_postdominate_refl)\n from \\n \\ obs n' (PDG_BS S)\\ obtain as where \"n' -as\\* n\"\n and \"\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\"\n and \"n \\ (PDG_BS S)\" by(erule obsE)\n from \\n strongly-postdominates n\\ \\\\ n strongly-postdominates n'\\ \\n' -as\\* n\\\n obtain as' a as'' where [simp]:\"as = as'@a#as''\" and \"valid_edge a\"\n and \"\\ n strongly-postdominates (sourcenode a)\" and \n \"n strongly-postdominates (targetnode a)\"\n by -(erule strong_postdominate_path_branch)\n from \\n \\ obs n' (PDG_BS S)\\ \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\ \n have \"n \\ set (sourcenodes (a#as''))\"\n by(fastforce elim:obs.cases simp:sourcenodes_def)\n from \\n' -as\\* n\\ have \"sourcenode a -a#as''\\* n\"\n by(fastforce dest:path_split_second)\n from \\\\ n strongly-postdominates (sourcenode a)\\ \\valid_edge a\\ \\valid_node n\\\n obtain a' where \"sourcenode a' = sourcenode a\"\n and \"valid_edge a'\" and \"\\ n strongly-postdominates (targetnode a')\"\n by(fastforce elim:not_strong_postdominate_predecessor_successor)\n with \\n strongly-postdominates (targetnode a)\\ \\n \\ set (sourcenodes (a#as''))\\\n \\sourcenode a -a#as''\\* n\\\n have \"sourcenode a weakly controls n\"\n by(fastforce simp:weak_control_dependence_def)\n with \\n \\ obs n' (PDG_BS S)\\ have \"sourcenode a \\ (PDG_BS S)\"\n by(fastforce intro:cd_closed PDG_cdep_edge elim:obs.cases)\n with \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\\n show False by(simp add:sourcenodes_def)\nqed\n\n\nlemma obs_singleton:\"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\"\nproof(rule ccontr)\n assume \"\\ ((\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {})\"\n hence \"\\nx nx'. nx \\ obs n (PDG_BS S) \\ nx' \\ obs n (PDG_BS S) \\\n nx \\ nx'\" by auto\n then obtain nx nx' where \"nx \\ obs n (PDG_BS S)\" and \"nx' \\ obs n (PDG_BS S)\"\n and \"nx \\ nx'\" by auto\n from \\nx \\ obs n (PDG_BS S)\\ obtain as where \"n -as\\* nx\" \n and \"\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\" and \"nx \\ (PDG_BS S)\" \n by(erule obsE)\n from \\n -as\\* nx\\ have \"valid_node nx\" by(fastforce dest:path_valid_node)\n with \\nx \\ (PDG_BS S)\\ have \"obs nx (PDG_BS S) = {nx}\" by -(rule n_in_obs)\n with \\n -as\\* nx\\ \\nx \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \\nx \\ nx'\\\n have \"as \\ []\" by(fastforce elim:path.cases)\n with \\n -as\\* nx\\ \\nx \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \n \\nx \\ nx'\\ \\obs nx (PDG_BS S) = {nx}\\ \\\\n' \\ set(sourcenodes as). n' \\ (PDG_BS S)\\\n have \"\\a as' as''. n -as'\\* sourcenode a \\ targetnode a -as''\\* nx \\\n valid_edge a \\ as = as'@a#as'' \\ \n obs (targetnode a) (PDG_BS S) = {nx} \\ \n (\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {}))\"\n proof(induct arbitrary:nx' rule:path.induct)\n case (Cons_path n'' as n' a n)\n note [simp] = \\sourcenode a = n\\[THEN sym] \\targetnode a = n''\\[THEN sym]\n note more_than_one = \\n' \\ obs n (PDG_BS S)\\ \\nx' \\ obs n (PDG_BS S)\\ \\n' \\ nx'\\\n note IH = \\\\nx'. \\n' \\ obs n'' (PDG_BS S); nx' \\ obs n'' (PDG_BS S); n' \\ nx'; \n obs n' (PDG_BS S) = {n'}; \\n'\\set (sourcenodes as). n' \\ (PDG_BS S); as \\ []\\\n \\ \\a as' as''. n'' -as'\\* sourcenode a \\ targetnode a -as''\\* n' \\\n valid_edge a \\ as = as'@a#as'' \\ obs (targetnode a) (PDG_BS S) = {n'} \\\n (\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {}))\\\n from \\\\n'\\set (sourcenodes (a#as)). n' \\ (PDG_BS S)\\\n have \"\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\" and \"sourcenode a \\ (PDG_BS S)\"\n by(simp_all add:sourcenodes_def)\n show ?case\n proof(cases \"as = []\")\n case True\n with \\n'' -as\\* n'\\ have [simp]:\"n' = n''\" by(fastforce elim:path.cases)\n from more_than_one\n have \"\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {})\"\n by auto\n with \\obs n' (PDG_BS S) = {n'}\\ True \\valid_edge a\\ show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n by(auto intro!:empty_path)\n next\n case False\n hence \"as \\ []\" .\n from \\n'' -as\\* n'\\ \\\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\\ \n have \"obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\" by(rule path_obs_subset)\n show ?thesis\n proof(cases \"obs n' (PDG_BS S) = obs n'' (PDG_BS S)\")\n case True\n with \\n'' -as\\* n'\\ \\valid_edge a\\ \\obs n' (PDG_BS S) = {n'}\\ more_than_one\n show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"as\" in exI)\n by(fastforce intro:empty_path)\n next\n case False\n with \\obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\\\n have \"obs n' (PDG_BS S) \\ obs n'' (PDG_BS S)\" by simp\n with \\obs n' (PDG_BS S) = {n'}\\ obtain ni where \"n' \\ obs n'' (PDG_BS S)\"\n and \"ni \\ obs n'' (PDG_BS S)\" and \"n' \\ ni\" by auto\n from IH[OF this \\obs n' (PDG_BS S) = {n'}\\ \n \\\\n'\\set (sourcenodes as). n' \\ (PDG_BS S)\\ \\as \\ []\\] obtain a' as' as''\n where \"n'' -as'\\* sourcenode a'\" and \"targetnode a' -as''\\* n'\"\n and \"valid_edge a'\" and [simp]:\"as = as'@a'#as''\" \n and \"obs (targetnode a') (PDG_BS S) = {n'}\"\n and more_than_one':\"\\ (\\m. obs (sourcenode a') (PDG_BS S) = {m} \\ \n obs (sourcenode a') (PDG_BS S) = {})\"\n by blast\n from \\n'' -as'\\* sourcenode a'\\ \\valid_edge a\\\n have \"n -a#as'\\* sourcenode a'\" by(fastforce intro:path.Cons_path)\n with \\targetnode a' -as''\\* n'\\ \\obs (targetnode a') (PDG_BS S) = {n'}\\\n more_than_one' \\valid_edge a'\\ show ?thesis\n apply(rule_tac x=\"a'\" in exI)\n apply(rule_tac x=\"a#as'\" in exI)\n apply(rule_tac x=\"as''\" in exI)\n by fastforce\n qed\n qed\n qed simp\n then obtain a as' as'' where \"valid_edge a\"\n and \"obs (targetnode a) (PDG_BS S) = {nx}\"\n and more_than_one:\"\\ (\\m. obs (sourcenode a) (PDG_BS S) = {m} \\ \n obs (sourcenode a) (PDG_BS S) = {})\"\n by blast\n have \"sourcenode a \\ (PDG_BS S)\"\n proof(rule ccontr)\n assume \"\\ sourcenode a \\ PDG_BS S\"\n hence \"sourcenode a \\ PDG_BS S\" by simp\n with \\valid_edge a\\ have \"obs (sourcenode a) (PDG_BS S) = {sourcenode a}\"\n by(fastforce intro!:n_in_obs)\n with more_than_one show False by simp\n qed\n with \\valid_edge a\\ \n have \"obs (targetnode a) (PDG_BS S) \\ obs (sourcenode a) (PDG_BS S)\"\n by(rule edge_obs_subset)\n with \\obs (targetnode a) (PDG_BS S) = {nx}\\ \n have \"nx \\ obs (sourcenode a) (PDG_BS S)\" by simp\n with more_than_one obtain m where \"m \\ obs (sourcenode a) (PDG_BS S)\"\n and \"nx \\ m\" by auto\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n have \"valid_node m\" by(fastforce dest:in_obs_valid)\n from \\obs (targetnode a) (PDG_BS S) = {nx}\\ have \"valid_node nx\" \n by(fastforce dest:in_obs_valid)\n show False\n proof(cases \"m strongly-postdominates (sourcenode a)\")\n case True\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\m \\ obs (sourcenode a) (PDG_BS S)\\\n have \"m strongly-postdominates nx\"\n by(fastforce intro:strong_postdominate_path_targetnode elim:obs.cases)\n with \\nx \\ m\\ have \"\\ nx strongly-postdominates m\" \n by(fastforce dest:strong_postdominate_antisym)\n have \"(_Exit_) -[]\\* (_Exit_)\" by(fastforce intro:empty_path)\n with \\m strongly-postdominates nx\\ have \"nx \\ (_Exit_)\"\n by(fastforce simp:strong_postdominate_def sourcenodes_def postdominate_def)\n have \"\\ nx strongly-postdominates (sourcenode a)\"\n proof(rule ccontr)\n assume \"\\ \\ nx strongly-postdominates sourcenode a\"\n hence \"nx strongly-postdominates sourcenode a\" by simp\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n obtain asx' where \"sourcenode a -asx'\\* m\" and \"nx \\ set(sourcenodes asx')\"\n by(fastforce elim:obs.cases)\n with \\nx strongly-postdominates sourcenode a\\ have \"nx strongly-postdominates m\"\n by(rule strong_postdominate_path_targetnode)\n with \\\\ nx strongly-postdominates m\\ show False by simp\n qed\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\valid_node nx\\ \\nx \\ (_Exit_)\\ \n show False by(fastforce dest:obs_strong_postdominate)\n next\n case False\n show False\n proof(cases \"m = Exit\")\n case True\n from \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n obtain xs where \"sourcenode a -xs\\* m\" and \"nx \\ set(sourcenodes xs)\"\n by(fastforce elim:obsE)\n obtain x' xs' where [simp]:\"xs = x'#xs'\"\n proof(cases xs)\n case Nil\n with \\sourcenode a -xs\\* m\\ have [simp]:\"sourcenode a = m\" by fastforce\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n have \"m \\ (PDG_BS S)\" by (metis obsE)\n with \\valid_node m\\ have \"obs m (PDG_BS S) = {m}\"\n by(rule n_in_obs)\n with \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ m\\ have False\n by fastforce\n thus ?thesis by simp\n qed blast\n from \\sourcenode a -xs\\* m\\ have \"sourcenode a = sourcenode x'\" \n and \"valid_edge x'\" and \"targetnode x' -xs'\\* m\"\n by(auto elim:path_split_Cons)\n from \\targetnode x' -xs'\\* m\\ \\nx \\ set(sourcenodes xs)\\ \\valid_edge x'\\ \n \\valid_node m\\ True\n have \"\\ nx strongly-postdominates (targetnode x')\" \n by(fastforce simp:strong_postdominate_def postdominate_def sourcenodes_def)\n from \\nx \\ m\\ True have \"nx \\ (_Exit_)\" by simp\n with \\obs (targetnode a) (PDG_BS S) = {nx}\\\n have \"nx strongly-postdominates (targetnode a)\"\n by(fastforce intro:obs_strong_postdominate)\n from \\obs (targetnode a) (PDG_BS S) = {nx}\\\n obtain ys where \"targetnode a -ys\\* nx\" \n and \"\\nx' \\ set(sourcenodes ys). nx' \\ (PDG_BS S)\"\n and \"nx \\ (PDG_BS S)\" by(fastforce elim:obsE)\n hence \"nx \\ set(sourcenodes ys)\"by fastforce\n have \"sourcenode a \\ nx\"\n proof\n assume \"sourcenode a = nx\"\n from \\nx \\ obs (sourcenode a) (PDG_BS S)\\\n have \"nx \\ (PDG_BS S)\" by -(erule obsE)\n with \\valid_node nx\\ have \"obs nx (PDG_BS S) = {nx}\" by -(erule n_in_obs)\n with \\sourcenode a = nx\\ \\m \\ obs (sourcenode a) (PDG_BS S)\\ \n \\nx \\ m\\ show False by fastforce\n qed\n with \\nx \\ set(sourcenodes ys)\\ have \"nx \\ set(sourcenodes (a#ys))\"\n by(fastforce simp:sourcenodes_def)\n from \\valid_edge a\\ \\targetnode a -ys\\* nx\\\n have \"sourcenode a -a#ys\\* nx\" by(fastforce intro:Cons_path)\n from \\sourcenode a -a#ys\\* nx\\ \\nx \\ set(sourcenodes (a#ys))\\\n \\nx strongly-postdominates (targetnode a)\\ \\valid_edge x'\\\n \\\\ nx strongly-postdominates (targetnode x')\\ \\sourcenode a = sourcenode x'\\\n have \"(sourcenode a) weakly controls nx\"\n by(fastforce simp:weak_control_dependence_def)\n with \\nx \\ (PDG_BS S)\\ have \"sourcenode a \\ (PDG_BS S)\"\n by(rule cd_closed)\n with \\valid_edge a\\ have \"obs (sourcenode a) (PDG_BS S) = {sourcenode a}\"\n by(fastforce intro!:n_in_obs)\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\\n \\nx \\ obs (sourcenode a) (PDG_BS S)\\ \\nx \\ m\\\n show False by simp\n next\n case False\n with \\m \\ obs (sourcenode a) (PDG_BS S)\\ \\valid_node m\\\n \\\\ m strongly-postdominates sourcenode a\\ \n show False by(fastforce dest:obs_strong_postdominate)\n qed\n qed\nqed\n\n\nlemma WeakPDGBackwardSliceCorrect:\n \"BackwardSlice sourcenode targetnode kind valid_edge\n (_Entry_) Def Use state_val PDG_BS\"\nproof(unfold_locales)\n fix n S assume \"n \\ PDG_BS S\"\n thus \"valid_node n\" by(rule PDG_BS_valid_node)\nnext\n fix n S assume \"valid_node n\" and \"n \\ S\"\n thus \"n \\ PDG_BS S\" by(fastforce intro:PDG_path_Nil simp:PDG_BS_def)\nnext\n fix n' S n V assume \"n' \\ PDG_BS S\" and \"n influences V in n'\"\n thus \"n \\ PDG_BS S\"\n by(auto dest:PDG.PDG_path_ddep[OF PDG_wcd,OF PDG.PDG_ddep_edge[OF PDG_wcd]]\n dest:PDG_path_Append simp:PDG_BS_def split:if_split_asm)\nnext\n fix n S\n have \"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\" \n by(rule obs_singleton)\n thus \"finite (obs n (PDG_BS S))\" by fastforce\nnext\n fix n S\n have \"(\\m. obs n (PDG_BS S) = {m}) \\ obs n (PDG_BS S) = {}\" \n by(rule obs_singleton)\n thus \"card (obs n (PDG_BS S)) \\ 1\" by fastforce\nqed\n\nend\n\n\nsubsection\\Weak order dependence\\\n\ncontext CFG_wf begin\n\nlemma obs_singleton: \n (*assumes valid:\"valid_node n\"*)\n shows \"(\\m. obs n (wod_backward_slice S) = {m}) \\\n obs n (wod_backward_slice S) = {}\"\nproof(rule ccontr)\n let ?WOD_BS = \"wod_backward_slice S\"\n assume \"\\ ((\\m. obs n ?WOD_BS = {m}) \\ obs n ?WOD_BS = {})\"\n hence \"\\nx nx'. nx \\ obs n ?WOD_BS \\ nx' \\ obs n ?WOD_BS \\\n nx \\ nx'\" by auto\n then obtain nx nx' where \"nx \\ obs n ?WOD_BS\" and \"nx' \\ obs n ?WOD_BS\"\n and \"nx \\ nx'\" by auto\n from \\nx \\ obs n ?WOD_BS\\ obtain as where \"n -as\\* nx\" \n and \"\\n' \\ set(sourcenodes as). n' \\ ?WOD_BS\" and \"nx \\ ?WOD_BS\" \n by(erule obsE)\n from \\n -as\\* nx\\ have \"valid_node nx\" by(fastforce dest:path_valid_node)\n with \\nx \\ ?WOD_BS\\ have \"obs nx ?WOD_BS = {nx}\" by -(rule n_in_obs)\n with \\n -as\\* nx\\ \\nx \\ obs n ?WOD_BS\\ \\nx' \\ obs n ?WOD_BS\\ \\nx \\ nx'\\ \n have \"as \\ []\" by(fastforce elim:path.cases)\n with \\n -as\\* nx\\ \\nx \\ obs n ?WOD_BS\\ \\nx' \\ obs n ?WOD_BS\\ \\nx \\ nx'\\ \n \\obs nx ?WOD_BS = {nx}\\ \\\\n' \\ set(sourcenodes as). n' \\ ?WOD_BS\\\n have \"\\a as' as''. n -as'\\* sourcenode a \\ targetnode a -as''\\* nx \\\n valid_edge a \\ as = as'@a#as'' \\ \n obs (targetnode a) ?WOD_BS = {nx} \\ \n (\\ (\\m. obs (sourcenode a) ?WOD_BS = {m} \\ \n obs (sourcenode a) ?WOD_BS = {}))\"\n proof(induct arbitrary:nx' rule:path.induct)\n case (Cons_path n'' as n' a n)\n note [simp] = \\sourcenode a = n\\[THEN sym] \\targetnode a = n''\\[THEN sym]\n note more_than_one = \\n' \\ obs n (?WOD_BS)\\ \\nx' \\ obs n (?WOD_BS)\\ \\n' \\ nx'\\\n note IH = \\\\nx'. \\n' \\ obs n'' (?WOD_BS); nx' \\ obs n'' (?WOD_BS); n' \\ nx'; \n obs n' (?WOD_BS) = {n'}; \\n'\\set (sourcenodes as). n' \\ (?WOD_BS); as \\ []\\\n \\ \\a as' as''. n'' -as'\\* sourcenode a \\ targetnode a -as''\\* n' \\\n valid_edge a \\ as = as'@a#as'' \\ obs (targetnode a) (?WOD_BS) = {n'} \\\n (\\ (\\m. obs (sourcenode a) (?WOD_BS) = {m} \\ \n obs (sourcenode a) (?WOD_BS) = {}))\\\n from \\\\n'\\set (sourcenodes (a#as)). n' \\ (?WOD_BS)\\\n have \"\\n'\\set (sourcenodes as). n' \\ (?WOD_BS)\" and \"sourcenode a \\ (?WOD_BS)\"\n by(simp_all add:sourcenodes_def)\n show ?case\n proof(cases \"as = []\")\n case True\n with \\n'' -as\\* n'\\ have [simp]:\"n' = n''\" by(fastforce elim:path.cases)\n from more_than_one\n have \"\\ (\\m. obs (sourcenode a) (?WOD_BS) = {m} \\ \n obs (sourcenode a) (?WOD_BS) = {})\"\n by auto\n with \\obs n' (?WOD_BS) = {n'}\\ True \\valid_edge a\\ show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n by(auto intro!:empty_path)\n next\n case False\n hence \"as \\ []\" .\n from \\n'' -as\\* n'\\ \\\\n'\\set (sourcenodes as). n' \\ (?WOD_BS)\\ \n have \"obs n' (?WOD_BS) \\ obs n'' (?WOD_BS)\" by(rule path_obs_subset)\n show ?thesis\n proof(cases \"obs n' (?WOD_BS) = obs n'' (?WOD_BS)\")\n case True\n with \\n'' -as\\* n'\\ \\valid_edge a\\ \\obs n' (?WOD_BS) = {n'}\\ more_than_one\n show ?thesis\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"[]\" in exI)\n apply(rule_tac x=\"as\" in exI)\n by(fastforce intro:empty_path)\n next\n case False\n with \\obs n' (?WOD_BS) \\ obs n'' (?WOD_BS)\\\n have \"obs n' (?WOD_BS) \\ obs n'' (?WOD_BS)\" by simp\n with \\obs n' (?WOD_BS) = {n'}\\ obtain ni where \"n' \\ obs n'' (?WOD_BS)\"\n and \"ni \\ obs n'' (?WOD_BS)\" and \"n' \\ ni\" by auto\n from IH[OF this \\obs n' (?WOD_BS) = {n'}\\ \n \\\\n'\\set (sourcenodes as). n' \\ (?WOD_BS)\\ \\as \\ []\\] obtain a' as' as''\n where \"n'' -as'\\* sourcenode a'\" and \"targetnode a' -as''\\* n'\"\n and \"valid_edge a'\" and [simp]:\"as = as'@a'#as''\" \n and \"obs (targetnode a') (?WOD_BS) = {n'}\"\n and more_than_one':\"\\ (\\m. obs (sourcenode a') (?WOD_BS) = {m} \\ \n obs (sourcenode a') (?WOD_BS) = {})\"\n by blast\n from \\n'' -as'\\* sourcenode a'\\ \\valid_edge a\\\n have \"n -a#as'\\* sourcenode a'\" by(fastforce intro:path.Cons_path)\n with \\targetnode a' -as''\\* n'\\ \\obs (targetnode a') (?WOD_BS) = {n'}\\\n more_than_one' \\valid_edge a'\\ show ?thesis\n apply(rule_tac x=\"a'\" in exI)\n apply(rule_tac x=\"a#as'\" in exI)\n apply(rule_tac x=\"as''\" in exI)\n by fastforce\n qed\n qed\n qed simp\n then obtain a as' as'' where \"valid_edge a\"\n and \"obs (targetnode a) (?WOD_BS) = {nx}\"\n and more_than_one:\"\\ (\\m. obs (sourcenode a) (?WOD_BS) = {m} \\ \n obs (sourcenode a) (?WOD_BS) = {})\"\n by blast\n have \"sourcenode a \\ (?WOD_BS)\"\n proof(rule ccontr)\n assume \"\\ sourcenode a \\ ?WOD_BS\"\n hence \"sourcenode a \\ ?WOD_BS\" by simp\n with \\valid_edge a\\ have \"obs (sourcenode a) (?WOD_BS) = {sourcenode a}\"\n by(fastforce intro!:n_in_obs)\n with more_than_one show False by simp\n qed\n with \\valid_edge a\\ \n have \"obs (targetnode a) (?WOD_BS) \\ obs (sourcenode a) (?WOD_BS)\"\n by(rule edge_obs_subset)\n with \\obs (targetnode a) (?WOD_BS) = {nx}\\ \n have \"nx \\ obs (sourcenode a) (?WOD_BS)\" by simp\n with more_than_one obtain m where \"m \\ obs (sourcenode a) (?WOD_BS)\"\n and \"nx \\ m\" by auto\n with \\nx \\ obs (sourcenode a) (?WOD_BS)\\ obtain as2 \n where \"sourcenode a -as2\\* m\" and \"nx \\ set(sourcenodes as2)\" \n by(fastforce elim:obsE)\n from \\nx \\ obs (sourcenode a) (?WOD_BS)\\ \\m \\ obs (sourcenode a) (?WOD_BS)\\ \n obtain as1 where \"sourcenode a -as1\\* nx\" and \"m \\ set(sourcenodes as1)\"\n by(fastforce elim:obsE)\n from \\obs (targetnode a) (?WOD_BS) = {nx}\\ obtain asx \n where \"targetnode a -asx\\* nx\" by(fastforce elim:obsE)\n have \"\\asx'. targetnode a -asx'\\* m \\ nx \\ set(sourcenodes asx')\"\n proof(rule ccontr)\n assume \"\\ (\\asx'. targetnode a -asx'\\* m \\ nx \\ set (sourcenodes asx'))\"\n then obtain asx' where \"targetnode a -asx'\\* m\" and \"nx \\ set (sourcenodes asx')\"\n by blast\n show False\n proof(cases \"\\nx \\ set(sourcenodes asx'). nx \\ ?WOD_BS\")\n case True\n with \\targetnode a -asx'\\* m\\ \\m \\ obs (sourcenode a) (?WOD_BS)\\ \n have \"m \\ obs (targetnode a) ?WOD_BS\" by(fastforce intro:obs_elem elim:obsE)\n with \\nx \\ m\\ \\obs (targetnode a) (?WOD_BS) = {nx}\\ show False by simp\n next\n case False\n hence \"\\nx \\ set(sourcenodes asx'). nx \\ ?WOD_BS\" by blast\n then obtain nx' ns ns' where \"sourcenodes asx' = ns@nx'#ns'\" and \"nx' \\ ?WOD_BS\"\n and \"\\nx \\ set ns. nx \\ ?WOD_BS\" by(fastforce elim!:split_list_first_propE)\n from \\sourcenodes asx' = ns@nx'#ns'\\ obtain ax ai ai' \n where [simp]:\"asx' = ai@ax#ai'\" \"ns = sourcenodes ai\" \"nx' = sourcenode ax\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from \\targetnode a -asx'\\* m\\ have \"targetnode a -ai\\* sourcenode ax\"\n by(fastforce dest:path_split)\n with \\nx' \\ ?WOD_BS\\ \\\\nx \\ set ns. nx \\ ?WOD_BS\\ \n have \"nx' \\ obs (targetnode a) ?WOD_BS\" by(fastforce intro:obs_elem)\n with \\obs (targetnode a) (?WOD_BS) = {nx}\\ have \"nx' = nx\" by simp\n with \\nx \\ set (sourcenodes asx')\\ show False by(simp add:sourcenodes_def)\n qed\n qed\n with \\nx \\ m\\ \\sourcenode a -as1\\* nx\\ \\m \\ set(sourcenodes as1)\\ \n \\sourcenode a -as2\\* m\\ \\nx \\ set(sourcenodes as2)\\ \\valid_edge a\\ \n \\targetnode a -asx\\* nx\\\n have \"sourcenode a \\\\<^sub>w\\<^sub>o\\<^sub>d nx,m\" by(simp add:wod_def,blast)\n with \\nx \\ obs (sourcenode a) (?WOD_BS)\\ \\m \\ obs (sourcenode a) (?WOD_BS)\\ \n have \"sourcenode a \\ ?WOD_BS\" by(fastforce elim:cd_closed elim:obsE)\n with \\sourcenode a \\ ?WOD_BS\\ show False by simp\nqed\n\n\nlemma WODBackwardSliceCorrect:\n \"BackwardSlice sourcenode targetnode kind valid_edge\n (_Entry_) Def Use state_val wod_backward_slice\"\nproof(unfold_locales)\n fix n S assume \"n \\ wod_backward_slice S\"\n thus \"valid_node n\" by(rule wod_backward_slice_valid_node)\nnext\n fix n S assume \"valid_node n\" and \"n \\ S\"\n thus \"n \\ wod_backward_slice S\" by(rule refl)\nnext\n fix n' S n V assume \"n' \\ wod_backward_slice S\" \"n influences V in n'\"\n thus \"n \\ wod_backward_slice S\"\n by -(rule dd_closed)\nnext\n fix n S\n have \"(\\m. obs n (wod_backward_slice S) = {m}) \\ \n obs n (wod_backward_slice S) = {}\" \n by(rule obs_singleton)\n thus \"finite (obs n (wod_backward_slice S))\" by fastforce\nnext\n fix n S \n have \"(\\m. obs n (wod_backward_slice S) = {m}) \\ obs n (wod_backward_slice S) = {}\" \n by(rule obs_singleton)\n thus \"card (obs n (wod_backward_slice S)) \\ 1\" by fastforce\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/StaticIntra/CDepInstantiations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.26719087457622126}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory WhileLoopVarsPreserved imports\n \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"while_loop_vars_preserved.c\"\ninstall_C_file \"while_loop_vars_preserved.c\"\n\nautocorres [ts_force nondet = loop] \"while_loop_vars_preserved.c\"\n\ncontext while_loop_vars_preserved begin\n\nlemma \"\\ \\s. True \\ loop' var1 var2 var3 var4 \\ \\r s. r = var1 + var2 + var3 + var4 \\\"\n apply (unfold loop'_def)\n apply (subst whileLoop_add_inv [where I=\"\\(meow, woof, neigh, ii, squeek) s.\n ii = (var1 + var2 + var3 + var4 - (meow + woof + neigh + squeek))\"\n and M=\"\\((meow, woof, neigh, ii, squeek), s).\n unat meow + unat woof + unat neigh + unat squeek\"])\n apply wp\n apply (auto simp: word_gt_0)\n done\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/proof-tests/WhileLoopVarsPreserved.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.26719086729594566}} {"text": "section {*LR1\\_Property\\_Satisfaction\\_\\_convert\\_remaining\\_productions*}\ntheory\n LR1_Property_Satisfaction__convert_remaining_productions\n\nimports\n PRJ_12_04_06_06_10__ENTRY\n\nbegin\n\ndefinition restrictX :: \"\n ('q, 't, 's) epda\n \\ ('q, 's, 't) PSplit\n \\ ('q, 's, 't) PSplit\"\n where\n \"restrictX G' S \\\n map\n (\\I. I \\PSplitItem_prods :=\n map\n (\\X. case X of\n teB p \\ teA (prod_to_edge G' p)\n | teA p \\ teA p) (PSplitItem_prods I)\\)\n S\"\n\nlemma restrictX_length: \"\n length (restrictX G' S) = length S\"\n apply(simp add: restrictX_def)\n done\n\nlemma equal_split_prefix_hlp1_updated: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ cfgRM.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf=v@[teB b]@x1\\)\n \\ cfgRM.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf=v@[teB b]@x2\\)\n \\ EValidSplit G (S1@S1')\n \\ EValidSplit G (S2@S2')\n \\ length S1 = length (v@[teB b])\n \\ length S2 = length (v@[teB b])\n \\ v@[teB b] = Esplit_signature S1\n \\ v@[teB b] = Esplit_signature S2\n \\ x1 = Esplit_signature S1'\n \\ x2 = Esplit_signature S2'\n \\ S1R=restrict G' G (S1@S1') (length (v@[teB b]))\n \\ S2R=restrict G' G (S2@S2') (length (v@[teB b]))\n \\ S1RX=restrictX G' S1R\n \\ S2RX=restrictX G' S2R\n \\ ESplitItem_elem ((S1@S1') ! (length v)) = Some (teB b)\n \\ PValidSplit G' G S1R\n \\ ESplitItem_elem ((S2@S2') ! (length v)) = Some (teB b)\n \\ PValidSplit G' G S2R\n \\ i\\length (v@[teB b])\n \\ take i S1RX = take i S2RX\"\n apply(induct i rule: less_induct)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(case_tac x)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(erule_tac\n x=\"nat\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac n)\n apply(rename_tac n)(*strict*)\n apply(rule_tac\n t=\"take (Suc n) (restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1))))\"\n and s=\"take n (restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1))))@[(restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1))))!n]\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule take_Suc_conv_app_nth)\n apply(rule_tac\n t=\"length (restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1))))\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule restrictX_length)\n apply(rename_tac n)(*strict*)\n apply (metis Suc_le_lessD append_length_inc length_Suc length_of_restrict take_n_vs_take_Suc_n zero_less_Suc)\n apply(rename_tac n)(*strict*)\n apply(rule_tac\n t=\"take (Suc n) (restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S1))))\"\n and s=\"take n (restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S1))))@[(restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S1))))!n]\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule take_Suc_conv_app_nth)\n apply(rule_tac\n t=\"length (restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S1))))\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule restrictX_length)\n apply(rename_tac n)(*strict*)\n apply (metis Suc_le_lessD append_length_inc length_Suc length_of_restrict take_n_vs_take_Suc_n zero_less_Suc)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) )! n = restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S1))) ! n\")\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(simp (no_asm) add: restrictX_def restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(case_tac \"length (Esplit_signature S1)\")\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac k)\n apply(rename_tac n k)(*strict*)\n apply(subgoal_tac \"length(nat_seq 0 k) = SSx\" for SSx)\n apply(rename_tac n k)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac n k)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 k ! n = SSX\" for SSX)\n apply(rename_tac n k)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newelem_def)\n apply(subgoal_tac \"k = length v\")\n apply(rename_tac n k)(*strict*)\n prefer 2\n apply(subgoal_tac \"Suc k = length(v@[teB b])\")\n apply(rename_tac n k)(*strict*)\n apply(rule Suc_inject)\n apply(rule_tac\n t=\"Suc k\"\n and s=\"length(v@[teB b])\"\n in ssubst)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n k)(*strict*)\n apply(subgoal_tac \"length SSS = length (Esplit_signature S1) \\ length SSS = Suc (length (Esplit_signature SSS)) \\ S1' = []\" for SSS)\n apply(rename_tac n k)(*strict*)\n prefer 2\n apply(rule EValidSplit_Esplit_signature_length)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(erule disjE)\n apply(rename_tac n k)(*strict*)\n apply(rule_tac\n t=\"Suc k\"\n and s=\"length S1\"\n in ssubst)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(rule_tac\n t=\"v@[teB b]\"\n and s=\"Esplit_signature S1\"\n in ssubst)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(force)\n apply(rename_tac n k)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \" ESplitItem_elem (S1 ! n) = Some ((v@[teB b])!n) \\ ESplitItem_elem (S2 ! n) = Some ((v@[teB b])!n) \")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(rule conjI)\n apply(rename_tac n)(*strict*)\n apply(rule Esplit_signature_take_prefix_closureise)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(rule Esplit_signature_take_prefix_closureise)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \" let S1nr=restrict G' G (S1 @ S1') (Suc (length v)) ! n; S2nr=restrict G' G (S2 @ S2') (Suc (length v)) ! n in PSplitItem_elim S1nr @ [PSplitItem_from S1nr] @ PSplitItem_ignore S1nr = PSplitItem_elim S2nr @ [PSplitItem_from S2nr] @ PSplitItem_ignore S2nr \")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: Let_def)\n apply(case_tac n)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(simp add: PValidSplit_def PValidSplit_initial_def)\n apply(clarsimp)\n apply(case_tac \"restrict G' G (S1 @ S1') (Suc (length v))\")\n apply(force)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict G' G (S2 @ S2') (Suc (length v))\")\n apply(rename_tac a list)(*strict*)\n apply(force)\n apply(rename_tac a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(subgoal_tac \"restrictX G' (restrict G' G (S1 @ S1') (Suc (length v))) ! nat = restrictX G' (restrict G' G (S2 @ S2') (Suc (length v))) ! nat\")\n apply(rename_tac nat)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc nat\"\n and m=\"Suc nat\"\n in nth_equal_by_take_equal)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rename_tac nat)(*strict*)\n apply(thin_tac \"take (Suc nat) (restrictX G' (restrict G' G (S1 @ S1') (Suc (length v)))) = take (Suc nat) (restrictX G' (restrict G' G (S2 @ S2') (Suc (length v))))\")\n apply(rename_tac nat)(*strict*)\n apply(rename_tac n)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PValidSplit_interlineX (restrict G' G (S1 @ S1') (Suc (length v)) ! n) (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)\\ PValidSplit_interlineX (restrict G' G (S2 @ S2') (Suc (length v)) ! n) (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def PValidSplit_interline_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"n\"\n in allE)+\n apply(erule_tac\n P=\"Suc n < length (restrict G' G (S1 @ S1') (Suc (length v)))\"\n in impE)\n apply(rename_tac n)(*strict*)\n apply(simp add: restrict_def restrict_len_def restrict_map_def restrictX_def)\n apply(rename_tac n)(*strict*)\n apply(erule impE)\n apply(rename_tac n)(*strict*)\n apply(simp add: restrict_def restrict_len_def restrict_map_def restrictX_def)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(simp add: PValidSplit_interlineX_def)\n apply(simp add: restrict_def restrict_len_def restrict_map_def restrictX_def)\n apply(rename_tac n)(*strict*)\n apply(simp add: Let_def)\n apply(subgoal_tac \"ESplitItem_elim_prods (S2 ! n) = PSplitItem_elim_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(rule_tac\n t=\"map (\\i. \\PSplitItem_elim = ESplitItem_elim ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i), PSplitItem_from = hd (cropTol3l2 (the (ESplitItem_from ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i)) # restrict_newignore (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i)), PSplitItem_ignore = restrict_newignore (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_elim_prods = ESplitItem_elim_prods ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i), PSplitItem_prods = restrict_newprods G' G (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_elem = restrict_newelem (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_to = restrict_newto (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i\\) (nat_seq 0 (min (length S2) (Suc (length v)) + min (length S2') (Suc (length v) - length S2) - Suc 0)) ! n\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim_prods (S1 ! n) = PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(rule_tac\n t=\"map (\\i. \\PSplitItem_elim = ESplitItem_elim ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i), PSplitItem_from = hd (cropTol3l2 (the (ESplitItem_from ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i)) # restrict_newignore (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i)), PSplitItem_ignore = restrict_newignore (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_elim_prods = ESplitItem_elim_prods ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! i), PSplitItem_prods = restrict_newprods G' G (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_elem = restrict_newelem (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i, PSplitItem_to = restrict_newto (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') i\\) (nat_seq 0 (min (length S2) (Suc (length v)) + min (length S2') (Suc (length v) - length S2) - Suc 0)) ! n\"\n in ssubst)\n apply(rename_tac n)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S1 ! n) = ESplitItem_elim (S2 ! n) \\ ESplitItem_elim_prods (S1 ! n) = ESplitItem_elim_prods (S2 ! n)\")\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(subgoal_tac \"ESplitItem_elim (S1 ! n) = PSplitItem_elim (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S2 ! n) = PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"ESplitItem_elem (S1 ! n) = Some (PSplitItem_elem (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrict_newelem_def PValidSplit_def)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elem (S2 ! n) = Some (PSplitItem_elem (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrict_newelem_def PValidSplit_def)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(case_tac \"ESplitItem_elem (S1 ! n)\")\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n a)(*strict*)\n apply(case_tac a)\n apply(rename_tac n a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac n aa)(*strict*)\n apply(rename_tac A)\n apply(rename_tac n A)(*strict*)\n apply(subgoal_tac \"EValidSplitItem G (S1 ! n)\")\n apply(rename_tac n A)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def)\n apply(rename_tac n A)(*strict*)\n apply(subgoal_tac \"EValidSplitItem G (S2 ! n)\")\n apply(rename_tac n A)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def)\n apply(rename_tac n A)(*strict*)\n apply(simp add: EValidSplitItem_def EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac n A d da)(*strict*)\n apply(thin_tac \"(\\b. teB b = Esplit_signature S1 ! n) \\ (\\i Esplit_signature S1 ! n)\")\n apply(rename_tac n A d da)(*strict*)\n apply(thin_tac \"(\\b. teB b = Esplit_signature S1 ! n) \\ (\\i Esplit_signature S1 ! n)\")\n apply(rename_tac n A d da)(*strict*)\n apply(erule_tac\n P=\"\\A. teA A = Esplit_signature S1 ! n\"\n and Q=\"left_degen G d \\ PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n) = []\"\n in impE)\n apply(rename_tac n A d da)(*strict*)\n apply(rule_tac\n x=\"A\"\n in exI)\n apply(force)\n apply(rename_tac n A d da)(*strict*)\n apply(erule impE)\n apply(rename_tac n A d da)(*strict*)\n apply(rule_tac\n x=\"A\"\n in exI)\n apply(force)\n apply(rename_tac n A d da)(*strict*)\n apply(clarsimp)\n apply(simp add: EValidSplitItem_def EValidSplitItem_elim_def)\n apply(rename_tac n a ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ba)(*strict*)\n apply(rename_tac a)\n apply(rename_tac n a)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"PValidSplitItem G' G (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def PValidSplit_ValidItem_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"(restrict G' G (S2 @ S2') (Suc (length v))) ! n\"\n and A=\"set (restrict G' G (S2 @ S2') (Suc (length v)))\"\n in ballE)\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(subgoal_tac \" (restrict G' G (S2 @ S2') (Suc (length v))) ! n \\ set ((restrict G' G (S2 @ S2') (Suc (length v))))\")\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule nth_mem)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"PValidSplitItem G' G (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def PValidSplit_ValidItem_def)\n apply(clarsimp)\n apply(erule_tac\n A=\"set (restrict G' G (S2 @ S2') (Suc (length v)))\"\n and x=\"restrict G' G (S1 @ S1') (Suc (length v)) ! n\"\n in ballE)\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(subgoal_tac \"restrict G' G (S1 @ S1') (Suc (length v)) ! n \\ set (restrict G' G (S1 @ S1') (Suc (length v)))\")\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule nth_mem)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"PValidSplitItem_elim G (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(simp add: PValidSplitItem_def)\n apply(rename_tac n a)(*strict*)\n apply(subgoal_tac \"PValidSplitItem_elim G (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n a)(*strict*)\n prefer 2\n apply(simp add: PValidSplitItem_def)\n apply(rename_tac n a)(*strict*)\n apply(simp add: PValidSplitItem_elim_def)\n apply(rename_tac n a)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_elim_prods (S1 ! n)\"\n and s=\"PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_elim_prods (S2 ! n)\"\n and s=\"PSplitItem_elim_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule_tac\n ns=\"PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and v=\"PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in elim_map_equal_by_CFGlm_unambiguous)\n apply(rename_tac n a)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac n a)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(simp add: split_TSstructure_def)\n apply(rule cfgSTD_Nonblockingness_nonterminals_equal_cfgLM_accessible_nonterminals)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule_tac\n t=\"map (\\x. []) (PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\"\n and s=\"map (\\x. []) (PSplitItem_elim_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n a)(*strict*)\n apply(rule map_empty_eq)\n apply(rule_tac\n t=\"length (PSplitItem_elim_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\"\n and s=\"length (PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule_tac\n t=\"length (PSplitItem_elim_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\"\n and s=\"length (PSplitItem_elim (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule equal_by_strict_prefix_alt)\n apply(rename_tac n a)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac n a)(*strict*)\n apply(rule equal_split_prefix_hlp1_elim_eq_updated)\n apply(rename_tac n a)(*strict*)\n prefer 25\n apply(force)+\n apply(rename_tac n a)(*strict*)\n apply(rule equal_split_prefix_hlp1_elim_eq_updated)\n apply(rename_tac n a)(*strict*)\n prefer 25\n apply(force)+\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S1 ! n) = PSplitItem_elim (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S2 ! n) = PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PValidSplitItem G' G (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def PValidSplit_ValidItem_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"restrict G' G (S2 @ S2') (Suc (length v)) ! n\"\n and A=\"set (restrict G' G (S2 @ S2') (Suc (length v)))\"\n in ballE)\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(subgoal_tac \"restrict G' G (S2 @ S2') (Suc (length v)) ! n \\ set (restrict G' G (S2 @ S2') (Suc (length v)))\")\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(rule nth_mem)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PValidSplitItem G' G (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def PValidSplit_ValidItem_def)\n apply(clarsimp)\n apply(erule_tac\n A=\"set (restrict G' G (S1 @ S1') (Suc (length v)))\"\n and x=\"restrict G' G (S1 @ S1') (Suc (length v)) ! n\"\n in ballE)\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(subgoal_tac \"restrict G' G (S1 @ S1') (Suc (length v)) ! n \\ set (restrict G' G (S1 @ S1') (Suc (length v)))\")\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(rule nth_mem)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(rule conjI)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PSplitItem_from (restrict_map G' G (restrict_len (S1 @ S1') (Suc (length v))) ! n) = PSplitItem_from (restrict_map G' G (restrict_len (S2 @ S2') (Suc (length v))) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: restrict_def)\n apply(rename_tac n)(*strict*)\n apply(simp add: restrict_map_def restrict_len_def PValidSplit_def)\n apply(rename_tac n)(*strict*)\n apply(rule conjI)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PSplitItem_ignore (restrict_map G' G (restrict_len (S1 @ S1') (Suc (length v))) ! n) = PSplitItem_ignore (restrict_map G' G (restrict_len (S2 @ S2') (Suc (length v))) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: restrict_def)\n apply(rename_tac n)(*strict*)\n apply(simp add: restrict_map_def restrict_len_def PValidSplit_def)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"restrict_newprods G' G S1 n = PSplitItem_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"restrict_newprods G' G S2 n = PSplitItem_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"restrict_newto S1 n = PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"restrict_newto S2 n = PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def PValidSplit_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! n) = PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ S1') (Suc (length v)) ! n) = PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n)(*strict*)\n apply(subgoal_tac \"\\ds \\s fw. cfgLMTDL G ds (Esplit_signature S1) \\s fw\")\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(simp add: cfgLMTDL_def)\n apply(subgoal_tac \"\\ds f\\ fw. cfgLM.trans_der_list SSG ds (map (\\w. \\cfg_conf = [w]\\) (Esplit_signature S1)) f\\ (map (\\w. \\cfg_conf = w\\) fw) \\ setA (foldl (@) [] fw) = {}\" for SSG)\n apply(rename_tac n)(*strict*)\n prefer 2\n apply(rule construct_elimininating_trans_der_list)\n apply(rename_tac n)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac n)(*strict*)\n apply(rule Esplit_signature_belongs_setA)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(rule Esplit_signature_belongs_setB)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds f\\ fw)(*strict*)\n apply(rule_tac\n x=\"ds\"\n in exI)\n apply(rule_tac\n x=\"f\\\"\n in exI)\n apply(rule_tac\n x=\"map filterB fw\"\n in exI)\n apply(rule_tac\n t=\"(map (\\x. \\cfg_conf = liftB x\\) (map filterB fw))\"\n and s=\"(map (\\w. \\cfg_conf = w\\) fw)\"\n in ssubst)\n apply(rename_tac n ds f\\ fw)(*strict*)\n apply(rule listEqI)\n apply(rename_tac n ds f\\ fw)(*strict*)\n apply(force)\n apply(rename_tac n ds f\\ fw i)(*strict*)\n apply(clarsimp)\n apply (metis setA_empty_foldl liftBDeConv2)\n apply(rename_tac n ds f\\ fw)(*strict*)\n apply(force)\n apply(rename_tac n)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(case_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)=[]\")\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"n\"\n and ?S1.0=\"S1\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"n\"\n and ?S1.0=\"S2\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"Suc n\\length v\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(case_tac \"n=length v\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"length v\"\n and S=\"S2\"\n in restrict_newignore_last_empty)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule ESplitItem_to_not_empty_on_generating_line)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"restrict_newignore S2 (length v) = PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm_simp) add: restrict_def restrict_map_def restrict_len_def)\n apply(rule_tac\n t=\"nat_seq 0 (length v) ! length v\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! n) = ESplitItem_to ((S2 @ S2') ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"restrict_newto (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"(S2 @ S2') ! n\"\n and s=\"S2!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"length S2\"\n and s=\"Suc (length v)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"take (Suc (length v) - Suc (length v)) S2'\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"take (Suc (length v)) S2\"\n and s=\"S2\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule take_all)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm))\n apply(rule nonemtpy_newignore_implies_newto_unchanged)\n apply(rule_tac\n t=\"restrict_newignore S2 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! n) = ESplitItem_to ((S1 @ S1') ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"restrict_newto (take (Suc (length v)) S1 @ take (Suc (length v) - length S1) S1') n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"(S1 @ S1') ! n\"\n and s=\"S1!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"length S1\"\n and s=\"Suc (length v)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"take (Suc (length v) - Suc (length v)) S1'\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"take (Suc (length v)) S1\"\n and s=\"S1\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule take_all)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm))\n apply(rule nonemtpy_newignore_implies_newto_unchanged)\n apply(rule_tac\n t=\"restrict_newignore S1 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"restrict_newprods G' G S2 n = liftB (ESplitItem_prods (S2!n))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(case_tac \"ESplitItem_from (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S2!n\"\n and A=\"set (butlast (S2 @ S2'))\"\n and P=\"\\X. (\\y. ESplitItem_from X = Some y) \\ (\\y. ESplitItem_elem X = Some y)\"\n in ballE)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(erule conjE)+\n apply(rule_tac\n A=\"a\"\n in nonemtpy_newignore_implies_newprods_unchanged)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S2 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"the (ESplitItem_elem (S2 ! n)) # liftA (ESplitItem_to (S2 ! n))\"\n and s=\"option_to_list (ESplitItem_elem (S2 ! n)) @ liftA (ESplitItem_to (S2 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp (no_asm_simp))\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"[teA a]\"\n and s=\"liftA (option_to_list (ESplitItem_from (S2 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_from (S2 ! n)\"\n and s=\"Some a\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule generation_derivation_has_always_nonterminal_at_front)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(blast)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"restrict_newprods G' G S1 n = liftB (ESplitItem_prods (S1!n))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(case_tac \"ESplitItem_from (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n A=\"set (butlast (S1 @ S1'))\"\n and x=\"S1!n\"\n in ballE)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(erule conjE)+\n apply(rule_tac\n A=\"a\"\n in nonemtpy_newignore_implies_newprods_unchanged)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S1 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"the (ESplitItem_elem (S1 ! n)) # liftA (ESplitItem_to (S1 ! n))\"\n and s=\"option_to_list (ESplitItem_elem (S1 ! n)) @ liftA (ESplitItem_to (S1 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp (no_asm_simp))\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"[teA a]\"\n and s=\"liftA (option_to_list (ESplitItem_from (S1 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_from (S1 ! n)\"\n and s=\"Some a\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(rule generation_derivation_has_always_nonterminal_at_front)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(blast)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a d)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"liftB (ESplitItem_prods (S1 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"liftB (ESplitItem_prods (S1 ! n))\"\n and s=\"restrict_newprods G' G S1 n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"liftB (ESplitItem_prods (S2 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"liftB (ESplitItem_prods (S2 ! n))\"\n and s=\"restrict_newprods G' G S2 n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"ESplitItem_to ((S1 @ S1') ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"ESplitItem_to ((S2 @ S2') ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"(S1 @ S1') ! n\"\n and s=\"S1!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"(S2 @ S2') ! n\"\n and s=\"S2!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"liftB (ESplitItem_prods (S1 ! n)) = liftB (ESplitItem_prods (S2 ! n))\"\n and s=\"(ESplitItem_prods (S1 ! n)) = (ESplitItem_prods (S2 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm))\n apply(rule impI)\n apply(rule liftB_inj)\n apply(blast)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (liftB (ESplitItem_prods (S1 ! n)))\"\n and s=\"liftA(map (prod_to_edge G') (ESplitItem_prods (S1 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule prod_to_edge_liftA_liftB)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (liftB (ESplitItem_prods (S2 ! n)))\"\n and s=\"liftA(map (prod_to_edge G') (ESplitItem_prods (S2 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule prod_to_edge_liftA_liftB)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d2a \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S2 @ S2') ! n))))))]\\ e_\\2a \\cfg_conf = liftB \\2a @ teB b # vaa\\\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d2 \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S1 @ S1') ! n))))))]\\ e_\\2 \\cfg_conf = liftB \\2 @ teB b # va\\\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(case_tac \"ESplitItem_from (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"S1!n\"\n and A=\"set (butlast (S1 @ S1'))\"\n in ballE)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(case_tac \"ESplitItem_from (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"S2!n\"\n and A=\"set (butlast (S2 @ S2'))\"\n in ballE)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a a aa)(*strict*)\n apply(rename_tac F1 F2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule_tac\n t=\"liftA (map (prod_to_edge G') (ESplitItem_prods (S1 ! n))) = liftA (map (prod_to_edge G') (ESplitItem_prods (S2 ! n)))\"\n and s=\" (map (prod_to_edge G') (ESplitItem_prods (S1 ! n))) = (map (prod_to_edge G') (ESplitItem_prods (S2 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule impI)\n apply(rule liftA_inj)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(subgoal_tac \"ESplitItem_prods (S1 ! n) = ESplitItem_prods (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule conjI)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(subgoal_tac \"option_to_list (ESplitItem_elem (S2 ! n)) @ liftA (ESplitItem_to (S2 ! n)) = option_to_list (ESplitItem_elem (S1 ! n)) @ liftA (ESplitItem_to (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule liftA_inj)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule_tac\n w=\"option_to_list (ESplitItem_elem (S2 ! n))\"\n in append_linj)\n apply(rule_tac\n t=\"option_to_list (ESplitItem_elem (S2 ! n)) @ liftA (ESplitItem_to (S2 ! n))\"\n and s=\"option_to_list (ESplitItem_elem (S1 ! n)) @ liftA (ESplitItem_to (S1 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_elem (S1 ! n)\"\n and s=\"ESplitItem_elem (S2 ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(erule conjE)+\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(subgoal_tac \"da (length ((ESplitItem_prods (S1 ! n)))) = d (length((ESplitItem_prods (S1 ! n))))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n ?d2.0=\"da\"\n and ?d1.0=\"d\"\n and ?\\2.0=\"[]\"\n in cfgLM_trans_der_coincide)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"liftA (option_to_list (Some F1))\"\n and s=\"liftA (option_to_list (ESplitItem_from (S2 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n f=\"liftA\"\n in arg_cong)\n apply(rule_tac\n f=\"option_to_list\"\n in arg_cong)\n apply(rule_tac\n t=\"ESplitItem_from (S2 ! n)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(rule_tac\n t=\"restrict_newignore S2 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"Some F1\"\n and s=\"ESplitItem_from (S1 ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_from (S1 ! n)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(rule_tac\n t=\"restrict_newignore S1 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(case_tac \"F1\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q ba)(*strict*)\n apply(rename_tac qF1 AF1)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"ESplitItem_ignore (S1 ! n) = []\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(subgoal_tac \"proper_l3_l2_seq (PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n) @ option_to_list (Some (cons_l2 qF1 AF1)) @ ESplitItem_ignore (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_belongs G (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp add: EValidSplitItem_belongs_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp (no_asm_use) add: option_to_list_def)\n apply(rule l2_in_proper_l3_l2_seq_at_end)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n) = []\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemovedX S1 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2)(*strict*)\n apply(case_tac \"F2\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q baa)(*strict*)\n apply(rename_tac qF2 AF2)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"ESplitItem_ignore (S2 ! n) = []\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(subgoal_tac \"proper_l3_l2_seq (PSplitItem_elim (restrict G' G (S2 @ S2') (Suc (length v)) ! n) @ option_to_list (Some (cons_l2 qF2 AF2)) @ ESplitItem_ignore (S2 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_belongs G (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp add: EValidSplitItem_belongs_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp (no_asm_use) add: option_to_list_def)\n apply(rule l2_in_proper_l3_l2_seq_at_end)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n) = []\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemovedX S2 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rename_tac q11 A1 q12 q21 A2 q22)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"e_d1\"\n and A=\"(cons_l3 q11 A1 q12)\"\n and w=\"liftA(butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S1 @ S1') ! n))))))\"\n in from_derives_prefix)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"[teA (cons_l3 q11 A1 q12)] @ liftA (butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S1 @ S1') ! n))))))\"\n and s=\"liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S1 @ S1') ! n))))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm) add: liftA_commutes_over_concat)\n apply(rule_tac\n t=\"(S1 @ S1') ! n\"\n and s=\"S1!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm_simp) add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"e_d1a\"\n and A=\"(cons_l3 q21 A2 q22)\"\n and w=\"liftA(butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S2 @ S2') ! n))))))\"\n in from_derives_prefix)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"[teA (cons_l3 q21 A2 q22)] @ liftA (butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S2 @ S2') ! n))))))\"\n and s=\"liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S2 @ S2') ! n))))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm) add: liftA_commutes_over_concat)\n apply(rule_tac\n t=\"(S2 @ S2') ! n\"\n and s=\"S2!n\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_\\1 e_\\2 p_da e_d1a e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm_simp) add: option_to_list_def)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S1 @ S1') ! n))))))\\ e_\\1 \\cfg_conf = liftB \\1\\\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d1a \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n))) (ESplitItem_ignore ((S2 @ S2') ! n))))))\\ e_\\1a \\cfg_conf = liftB \\1a\\\")\n apply(rename_tac n ds \\s fw p_d e_d1 e_d2 va e_\\1 e_\\2 p_da e_d1a e_d2a vaa e_\\1a e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"ESplitItem_from (S1 ! n) = ESplitItem_from (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"ESplitItem_from (S1 ! n)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(rule_tac\n t=\"restrict_newignore S1 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_from (S2 ! n)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(rule_tac\n t=\"restrict_newignore S2 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and ?d1.0=\"d1a\"\n and ?d2.0=\"d1aa\"\n and ?x1.0=\"\\2b@\\2\"\n and ?x2.0=\"\\2c@\\2a\"\n in eliminating_derivations_are_equal_with_differing_future6)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! n)\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n v=\"\\1a\"\n in equal_by_length_and_prefix_of_greater)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S1 ! n)) \\ SSX\" for SSX)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2 @ e_\\2\"\n and d=\"\\s ! n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc n) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S1 ! n\"\n and s=\"(S1@S1') ! n\"\n in subst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1a\"\n and ?d2.0=\"d\"\n in unique_generation_length)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S2 ! n)) \\ SSX\" for SSX)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2a @ e_\\2a\"\n and d=\"\\s ! n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc n) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S2 ! n\"\n and s=\"(S2@S2') ! n\"\n in subst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1aa\"\n and ?d2.0=\"da\"\n in unique_generation_length)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"prefix (ESplitItem_prods (S1 ! n)) \\1a\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S1 ! n)) \\ SSX\" for SSX)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2 @ e_\\2\"\n and d=\"\\s ! n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc n) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S1 ! n\"\n and s=\"(S1@S1') ! n\"\n in subst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1a\"\n and ?d2.0=\"d\"\n in unique_generation_length)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"prefix (ESplitItem_prods (S2 ! n)) \\1a\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S2 ! n)) \\ SSX\" for SSX)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2a @ e_\\2a\"\n and d=\"\\s ! n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc n) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S2 ! n\"\n and s=\"(S2@S2') ! n\"\n in subst)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1aa\"\n and ?d2.0=\"da\"\n in unique_generation_length)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(case_tac \"Esplit_signature S1 ! n\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S1 ! n)) < length (ESplitItem_prods (S2 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S1 ! n)) (ESplitItem_prods (S2 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"d\"\n and ?d2.0=\"da\"\n in left_degen_repetitions_in_parallel_derivation)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S2 ! n)) < length (ESplitItem_prods (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S2 ! n)) (ESplitItem_prods (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"da\"\n and ?d2.0=\"d\"\n in left_degen_repetitions_in_parallel_derivation)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"length (ESplitItem_prods (S1 ! n)) < length (ESplitItem_prods (S2 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S1 ! n)) (ESplitItem_prods (S2 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"d\"\n and ?d2.0=\"da\"\n in terminal_production_repetitions_in_parallel_derivation)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S2 ! n)) < length (ESplitItem_prods (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S2 ! n)) (ESplitItem_prods (S1 ! n))\")\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"da\"\n and ?d2.0=\"d\"\n in terminal_production_repetitions_in_parallel_derivation)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw p_d e_\\2 p_da e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"fillOptL [] (last_back_state_if_l3_nonterminal []) = []\")\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(simp add: fillOptL_def last_back_state_if_l3_nonterminal_def)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_prods (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"restrict_newprods G' G (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') n\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) only: restrict_newprods_def)\n apply(rule_tac\n t=\"restrict_newignore (take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_prods (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"restrict_newprods G' G (take (Suc (length v)) S1 @ take (Suc (length v) - length S1) S1') n\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) only: restrict_newprods_def)\n apply(rule_tac\n t=\"restrict_newignore (take (Suc (length v)) S1 @ take (Suc (length v) - length S1) S1') n\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n and s=\"restrict_newto S1 n\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n and s=\"restrict_newto S2 n\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm) only: restrict_newto_def new_post_sig_def)\n apply(rule_tac\n t=\"ESplitItem_prods ((take (Suc (length v)) S1 @ take (Suc (length v) - length S1) S1') ! n)\"\n and s=\"ESplitItem_prods (S1 ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_prods ((take (Suc (length v)) S2 @ take (Suc (length v) - length S2) S2') ! n)\"\n and s=\"ESplitItem_prods (S2 ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! n)\")\n apply(rename_tac n ds \\s fw)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw d)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! n)\")\n apply(rename_tac n ds \\s fw d)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac n ds \\s fw d)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw d da)(*strict*)\n apply(erule conjE)+\n apply(rename_tac d2x d1x)\n apply(rename_tac n ds \\s fw d2x d1x)(*strict*)\n apply(case_tac \"ESplitItem_from (S1 ! n)\")\n apply(rename_tac n ds \\s fw d2x d1x)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"SSrenPI=[] \\ SSc2=\\cfg_conf=[]\\\" for SSrenPI SSc2)\n apply(rename_tac n ds \\s fw d2x d1x)(*strict*)\n prefer 2\n apply(rule_tac cfgLM_trans_der_from_empty)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x a)(*strict*)\n apply(case_tac \"ESplitItem_from (S2 ! n)\")\n apply(rename_tac n ds \\s fw d2x d1x a)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"SSrenPI=[] \\ SSc2=\\cfg_conf=[]\\\" for SSrenPI SSc2)\n apply(rename_tac n ds \\s fw d2x d1x a)(*strict*)\n prefer 2\n apply(rule_tac cfgLM_trans_der_from_empty)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x a aa)(*strict*)\n apply(rename_tac X1 X2)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"cropTol3l2_single X1 = cropTol3l2_single X2\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"X1\"\n and s=\"the(ESplitItem_from (S1 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"X2\"\n and s=\"the(ESplitItem_from (S2 ! n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n ?w1.0=\"restrict_newignore S1 n\"\n and ?w2.0=\"restrict_newignore S2 n\"\n in cropTol3l2_single_equal_from_cropTol3l2_equal)\n apply(rule_tac\n t=\"hd(cropTol3l2 (the (ESplitItem_from (S1 ! n)) # restrict_newignore S1 n))\"\n and s=\"PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"hd(cropTol3l2 (the (ESplitItem_from (S2 ! n)) # restrict_newignore S2 n))\"\n and s=\"PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(case_tac \"n=length v\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_toberemovedX_def)\n apply(rule_tac\n t=\"take (length (ESplitItem_to (S1 ! length v))) (drop_and_crop (ESplitItem_to (S1 ! length v) @ ESplitItem_ignore (S1 ! length v)) (length ((restrict_toberemoved S1 @ [tl (ESplitItem_to (last S1) @ ESplitItem_ignore (last S1))]) ! Suc (length v))))\"\n and s=\"[cropTol3l2_single (hd (ESplitItem_to (S1 ! length v)))]\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule_tac\n t=\"(restrict_toberemoved S1 @ [tl (ESplitItem_to (last S1) @ ESplitItem_ignore (last S1))]) ! Suc (length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule nth_append_beyond)\n apply(rule_tac\n t=\"length (restrict_toberemoved S1)\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule length_restrict_toberemoved)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"last S1\"\n and s=\"S1!length v\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule last_nth3)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"ESplitItem_to (S1 ! length v) \\ []\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule ESplitItem_to_not_empty_on_generating_line)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(case_tac \"ESplitItem_to (S1 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 a list)(*strict*)\n apply(clarsimp)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"take (length (ESplitItem_to (S2 ! length v))) (drop_and_crop (ESplitItem_to (S2 ! length v) @ ESplitItem_ignore (S2 ! length v)) (length ((restrict_toberemoved S2 @ [tl (ESplitItem_to (last S2) @ ESplitItem_ignore (last S2))]) ! Suc (length v))))\"\n and s=\"[cropTol3l2_single (hd (ESplitItem_to (S2 ! length v)))]\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule_tac\n t=\"(restrict_toberemoved S2 @ [tl (ESplitItem_to (last S2) @ ESplitItem_ignore (last S2))]) ! Suc (length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule nth_append_beyond)\n apply(rule_tac\n t=\"length (restrict_toberemoved S2)\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule length_restrict_toberemoved)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"last S2\"\n and s=\"S2!length v\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule last_nth3)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"ESplitItem_to (S2 ! length v) \\ []\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule ESplitItem_to_not_empty_on_generating_line)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(case_tac \"ESplitItem_to (S2 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 a list)(*strict*)\n apply(clarsimp)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Esplit_signature S1 ! length v = teB b\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac t=\"Esplit_signature S1\" and s=\"v@[teB b]\" in ssubst)\n apply(force)\n apply(rule nth_append_length)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"lastProduces d1x (ESplitItem_prods (S1 ! length v)) \\ lastProduces d2x (ESplitItem_prods (S2 ! length v))\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule conjI)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule lastProduces_intro)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule lastProduces_intro)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1x\"\n and ?d2.0=\"d2x\"\n in AX_equal_length_production_of_terminal_or_nonterminal)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1x\"\n and ?d2.0=\"d2x\"\n in prod_to_edge_equality_for_terminal_and_nonterminal_generation)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"only_l3_nonterminals (butlast (ESplitItem_to (S1 ! length v)))\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"length((ESplitItem_prods (S1 ! length v)))\"\n and d=\"d1x\"\n in cfgLM.trans_der_position_detail)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e ci)(*strict*)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e ci cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n prefer 2\n apply(rule_tac\n e=\"e\"\n and v=\"cfg_confa\"\n and \\=\"[]\"\n and w=\"[X1]\"\n and d=\"d1x\"\n and n=\"length((ESplitItem_prods (S1 ! length v)))\"\n in only_l3_nonterminals_butlast_preserved)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(simp (no_asm))\n apply(simp add: only_l3_nonterminals_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"v1=[b]\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n prefer 2\n apply(case_tac v1)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(case_tac v2)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list)(*strict*)\n apply(case_tac list)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista)(*strict*)\n apply(case_tac \"ESplitItem_to (S1 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(subgoal_tac \"v2=ESplitItem_to (S1 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(rule liftA_inj)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"only_l3_nonterminals (butlast (ESplitItem_to (S2 ! length v)))\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"length((ESplitItem_prods (S2 ! length v)))\"\n and d=\"d2x\"\n in cfgLM.trans_der_position_detail)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e ci)(*strict*)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e ci cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n prefer 2\n apply(rule_tac\n e=\"e\"\n and v=\"cfg_confa\"\n and \\=\"[]\"\n and w=\"[X2]\"\n and d=\"d2x\"\n and n=\"length((ESplitItem_prods (S2 ! length v)))\"\n in only_l3_nonterminals_butlast_preserved)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(simp (no_asm))\n apply(simp add: only_l3_nonterminals_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"v1=[b]\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n prefer 2\n apply(case_tac v1)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(case_tac v2)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list)(*strict*)\n apply(case_tac list)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista)(*strict*)\n apply(case_tac \"ESplitItem_to (S2 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea a lista aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v1 v2 ea)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(subgoal_tac \"v2=ESplitItem_to (S2 ! length v)\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2 e v2 ea)(*strict*)\n apply(rule liftA_inj)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"cropTol3l2_single (hd (ESplitItem_to (S1 ! length v))) = cropTol3l2_single (hd (ESplitItem_to (S2 ! length v)))\")\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n d1x=\"d1x\"\n and d2x=\"d2x\"\n in compatibel_derivation_compatible_first_nonterminal_at_end)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule conjI)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (restrict_newprodsX G' G (ESplitItem_prods (S1 ! length v)) (Some (Esplit_signature S1 ! length v)) [cropTol3l2_single (hd (ESplitItem_to (S1 ! length v)))])\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (restrict_newprodsX G' G (ESplitItem_prods (S2 ! length v)) (Some (Esplit_signature S1 ! length v)) [cropTol3l2_single (hd (ESplitItem_to (S2 ! length v)))])\"\n in ssubst)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"ns fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_toberemovedX_def)\n apply(rule_tac\n t=\"(restrict_toberemoved S1 @ [tl (ESplitItem_to (last S1) @ ESplitItem_ignore (last S1))]) ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule nth_append_1)\n apply(rule_tac\n t=\"length (restrict_toberemoved S1)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule length_restrict_toberemoved)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"(restrict_toberemoved S2 @ [tl (ESplitItem_to (last S2) @ ESplitItem_ignore (last S2))]) ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule nth_append_1)\n apply(rule_tac\n t=\"length (restrict_toberemoved S2)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule length_restrict_toberemoved)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_ignore (S1 ! n)) \\ length (restrict_toberemovedX S1 ! Suc n)\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"length (drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemovedX S1 ! Suc n))) \\ length (ESplitItem_to (S1 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"restrict_newignore S1 n = []\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newignore S1 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: restrict_newignore_def new_post_sig_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemovedX S1 ! Suc n))) \\ length (ESplitItem_to (S1 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) - length (restrict_toberemovedX S1 ! Suc n) \\ length (ESplitItem_to (S1 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"length (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) - length (restrict_toberemovedX S1 ! Suc n)\"\n in subst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(blast)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_ignore (S2 ! n)) \\ length (restrict_toberemovedX S2 ! Suc n)\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"length (drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemovedX S2 ! Suc n))) \\ length (ESplitItem_to (S2 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(subgoal_tac \"restrict_newignore S2 n = []\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newignore S2 n\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: restrict_newignore_def new_post_sig_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemovedX S2 ! Suc n))) \\ length (ESplitItem_to (S2 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) - length (restrict_toberemovedX S2 ! Suc n) \\ length (ESplitItem_to (S2 ! n))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"length (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) - length (restrict_toberemovedX S2 ! Suc n)\"\n in subst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(blast)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX S1 ! Suc n = restrict_toberemoved S1 ! Suc n\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX S2 ! Suc n = restrict_toberemoved S2 ! Suc n\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"take (length (ESplitItem_to (S2 ! n))) (drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule take_all)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm))\n apply(rule_tac\n t=\"restrict_toberemoved S2 ! Suc n\"\n and s=\"restrict_toberemovedX S2 ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"take (length (ESplitItem_to (S1 ! n))) (drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule take_all)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp (no_asm))\n apply(rule_tac\n t=\"restrict_toberemoved S1 ! Suc n\"\n and s=\"restrict_toberemovedX S1 ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"drop_and_crop (ESplitItem_to (S1 ! n) @ ESplitItem_ignore (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n))\"\n and s=\" drop_and_crop (butn (ESplitItem_to (S1 ! n)) ((length (restrict_toberemoved S1 ! Suc n))-length(ESplitItem_ignore (S1 ! n))) ) 0\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule_tac\n t=\"min (min (length (ESplitItem_to (S1 ! n))) (length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n))) (length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n))\"\n and s=\"length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"min (length (ESplitItem_to (S1 ! n))) (length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n))\"\n and s=\"length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"min (length (ESplitItem_to (S1 ! n))) (length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n))\"\n and s=\"(length (ESplitItem_to (S1 ! n)) + length (ESplitItem_ignore (S1 ! n)) - length (restrict_toberemoved S1 ! Suc n))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule Orderings.min_absorb2)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule Orderings.min_absorb1)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(rule_tac\n t=\"drop_and_crop (ESplitItem_to (S2 ! n) @ ESplitItem_ignore (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n))\"\n and s=\" drop_and_crop (butn (ESplitItem_to (S2 ! n)) ((length (restrict_toberemoved S2 ! Suc n))-length(ESplitItem_ignore (S2 ! n))) ) 0\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule_tac\n t=\"min (min (length (ESplitItem_to (S2 ! n))) (length (ESplitItem_to (S2 ! n)) + length (ESplitItem_ignore (S2 ! n)) - length (restrict_toberemoved S2 ! Suc n))) (length (ESplitItem_to (S2 ! n)) + length (ESplitItem_ignore (S2 ! n)) - length (restrict_toberemoved S2 ! Suc n))\"\n and s=\"length (ESplitItem_to (S2 ! n)) + length (ESplitItem_ignore (S2 ! n)) - length (restrict_toberemoved S2 ! Suc n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"min (length (ESplitItem_to (S2 ! n))) (length (ESplitItem_to (S2 ! n)) + length (ESplitItem_ignore (S2 ! n)) - length (restrict_toberemoved S2 ! Suc n))\"\n and s=\"length (ESplitItem_to (S2 ! n)) + length (ESplitItem_ignore (S2 ! n)) - length (restrict_toberemoved S2 ! Suc n)\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"Suc n\"\n and ?S1.0=\"S1\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"Suc n\"\n and ?S1.0=\"S2\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n) \\ [] \\ (\\e_d1 e_d2 va e_\\1 e_\\2. ESplitItem_prods ((S2 @ S2') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v))) = e_\\1 @ e_\\2 \\ (\\\\1 \\2. foldl (@) [] (drop (Suc n) (take (length v) fw)) = \\1 @ \\2 \\ cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S2 @ S2') ! Suc n))))))\\ e_\\1 \\cfg_conf = liftB \\1\\ \\ cfgLM.trans_der G e_d2 \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S2 @ S2') ! Suc n))))))]\\ e_\\2 \\cfg_conf = liftB \\2 @ teB b # va\\))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n) = [] \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc n)))\\ (ESplitItem_prods ((S2 @ S2') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop (Suc n) (take (length v) fw))) @ teB b # va\\)\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n) = [] \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc n)))\\ (ESplitItem_prods ((S1 @ S1') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop (Suc n) (take (length v) fw))) @ teB b # va\\)\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n) \\ [] \\ (\\e_d1 e_d2 va e_\\1 e_\\2. ESplitItem_prods ((S1 @ S1') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v))) = e_\\1 @ e_\\2 \\ (\\\\1 \\2. foldl (@) [] (drop (Suc n) (take (length v) fw)) = \\1 @ \\2 \\ cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc n)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S1 @ S1') ! Suc n))))))\\ e_\\1 \\cfg_conf = liftB \\1\\ \\ cfgLM.trans_der G e_d2 \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S1 @ S1') ! Suc n))))))]\\ e_\\2 \\cfg_conf = liftB \\2 @ teB b # va\\))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(simp add: fillWithPreContext_def)\n apply(subgoal_tac \"\\Y1. ESplitItem_from (S1 ! Suc n)= Some Y1\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n prefer 2\n apply(subgoal_tac \"(\\x\\ set (butlast (S1 @ S1')). (\\y. ESplitItem_from x = Some y) \\ (\\y. ESplitItem_elem x = Some y))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(erule_tac\n x=\"S1!Suc n\"\n in ballE)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n prefer 2\n apply(subgoal_tac \"S1 ! Suc n \\ set (butlast (S1 @ S1'))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(thin_tac \"S1 ! Suc n \\ set (butlast (S1 @ S1'))\")\n apply(rule nth_in_butlast_append)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n S=\"S1\"\n and S'=\"[]\"\n in EValidSplit_continuation_not_empty)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da)(*strict*)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and X=\"Y1\"\n and S=\"S1\"\n and S'=\"S1'\"\n and d=\"p_d\"\n and v=\"v\"\n and b=\"b\"\n and \\=\"ESplitItem_prods ((S1 @ S1') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))\"\n and tn=\"fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v)))) @ tl (ESplitItem_to ((S1 @ S1') ! length v)) @ butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc n))\"\n in equal_split_prefix_hlp5_construct_relevant_cfgLMMIP)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(thin_tac \"cfgLMMIP G p_da (teA (fillOpt (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc n))))) # liftA (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S2 @ S2') ! Suc n)))))) (ESplitItem_prods ((S2 @ S2') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))) (liftB (foldl (@) [] (drop (Suc n) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc n))))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(rule_tac\n t=\"teA Y1 # liftA (take (length (restrict_newignore S1 (Suc n))) (ESplitItem_ignore (S1 ! Suc n)))\"\n and s=\"(teA (fillOpt (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc n))))) # liftA (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S1 @ S1') ! Suc n))))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length v) ! Suc n = SSX\" for SSX)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ S1') ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rule conjI)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(rule fillOpt_single_with_last_back_state_if_l3_nonterminal)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(rule_tac\n f=\"liftA\"\n in arg_cong)\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S1 ! Suc n) @ ESplitItem_ignore (S1 ! Suc n)) (length (restrict_toberemovedX S1 ! Suc (Suc n))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"drop (length (ESplitItem_to (S1 ! Suc n))) (drop_and_crop (ESplitItem_to (S1 ! Suc n) @ ESplitItem_ignore (S1 ! Suc n)) (length (restrict_toberemovedX S1 ! Suc (Suc n))))\"\n and s=\" (drop_and_crop (ESplitItem_ignore (S1 ! Suc n)) (length (restrict_toberemovedX S1 ! Suc (Suc n))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(rule cropTol3l2_drop_butn_drop_and_crop)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d Y1)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule fillOptL_with_last_back_state_if_l3_nonterminal_X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(thin_tac \"cfgLMMIP G p_d (teA (fillOpt (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc n))))) # liftA (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S1 @ S1') ! Suc n)))))) (ESplitItem_prods ((S1 @ S1') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))) (liftB (foldl (@) [] (drop (Suc n) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v)))) @ tl (ESplitItem_to ((S1 @ S1') ! length v)) @ butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc n))))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(subgoal_tac \"\\Y2. ESplitItem_from (S2 ! Suc n)= Some Y2\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n prefer 2\n apply(subgoal_tac \"(\\x\\ set (butlast (S2 @ S2')). (\\y. ESplitItem_from x = Some y) \\ (\\y. ESplitItem_elem x = Some y))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(erule_tac\n x=\"S2!Suc n\"\n in ballE)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n prefer 2\n apply(subgoal_tac \"S2 ! Suc n \\ set (butlast (S2 @ S2'))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(thin_tac \"S2 ! Suc n \\ set (butlast (S2 @ S2'))\")\n apply(rule nth_in_butlast_append)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(rule_tac\n S=\"S2\"\n and S'=\"[]\"\n in EValidSplit_continuation_not_empty)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1)(*strict*)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (restrict_newprodsX G' G (ESplitItem_prods (S1 ! n)) (Some (Esplit_signature S1 ! n)) (drop_and_crop (butn (ESplitItem_to (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n) - length (ESplitItem_ignore (S1 ! n)))) 0))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(rule_tac\n t=\"map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (restrict_newprodsX G' G (ESplitItem_prods (S2 ! n)) (Some (Esplit_signature S1 ! n)) (drop_and_crop (butn (ESplitItem_to (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n) - length (ESplitItem_ignore (S2 ! n)))) 0))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and X=\"Y2\"\n and S=\"S2\"\n and S'=\"S2'\"\n and d=\"p_da\"\n and v=\"v\"\n and b=\"b\"\n and \\=\"ESplitItem_prods ((S2 @ S2') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))\"\n and tn=\"fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc n))\"\n in equal_split_prefix_hlp5_construct_relevant_cfgLMMIP)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(rule_tac\n t=\"teA Y2 # liftA (take (length (restrict_newignore S2 (Suc n))) (ESplitItem_ignore (S2 ! Suc n)))\"\n and s=\"(teA (fillOpt (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc n))))) # liftA (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S2 @ S2') ! Suc n))))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length v) ! Suc n = SSX\" for SSX)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S2 @ S2') ! Suc n\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rule conjI)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(rule fillOpt_single_with_last_back_state_if_l3_nonterminal)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(rule_tac\n f=\"liftA\"\n in arg_cong)\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S2 ! Suc n) @ ESplitItem_ignore (S2 ! Suc n)) (length (restrict_toberemovedX S2 ! Suc (Suc n))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"drop (length (ESplitItem_to (S2 ! Suc n))) (drop_and_crop (ESplitItem_to (S2 ! Suc n) @ ESplitItem_ignore (S2 ! Suc n)) (length (restrict_toberemovedX S2 ! Suc (Suc n))))\"\n and s=\" (drop_and_crop (ESplitItem_ignore (S2 ! Suc n)) (length (restrict_toberemovedX S2 ! Suc (Suc n))))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(rule cropTol3l2_drop_butn_drop_and_crop)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_da Y1 d Y2 \\)(*strict*)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule fillOptL_with_last_back_state_if_l3_nonterminal_X)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(thin_tac \"cfgLMMIP G p_da (teA (fillOpt (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc n))))) # liftA (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc n))) (ESplitItem_ignore ((S2 @ S2') ! Suc n)))))) (ESplitItem_prods ((S2 @ S2') ! Suc n) @ \\s ! Suc n @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc n)) (length v)))) (liftB (foldl (@) [] (drop (Suc n) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc n))))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\)(*strict*)\n apply(erule exE)+\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d Y2 \\ da \\')(*strict*)\n apply(rename_tac Y1 d1y Y2 \\1y d2y \\2y)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(rule_tac\n t=\"liftA (map (prod_to_edge G') (ESplitItem_prods (S1 ! n))) = liftA (map (prod_to_edge G') (ESplitItem_prods (S2 ! n)))\"\n in ssubst)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(rule liftA_inj_equality)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1x\"\n and ?d2.0=\"d2x\"\n and de=\"ds!n\"\n and \\e=\"fw!n\"\n in equal_split_prefix_hlp2_withMIP_simplified)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(simp add: cfgLMTDL_def cfgLM.trans_der_list_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"n\"\n in allE)\n apply(clarsimp)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(case_tac \"Esplit_signature S1 ! n\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y a)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(rule lastProduces_intro)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(rule lastProduces_intro)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y \\2y ba)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(case_tac \\1y)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n prefer 2\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y a list)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y)(*strict*)\n apply(simp add: cfgLMMIP_def cfgLM.trans_der_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec)(*strict*)\n apply(case_tac \"foldl (@) [] (drop (Suc n) (take (length v) fw))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec)(*strict*)\n apply(clarsimp)\n apply(case_tac \"butn (ESplitItem_to (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n) - length (ESplitItem_ignore (S1 ! n)))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"butn (ESplitItem_to (S1 ! n)) (length (restrict_toberemoved S1 ! Suc n) - length (ESplitItem_ignore (S1 ! n)))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 d2y \\2y e ea ec a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(case_tac \\2y)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n prefer 2\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y a list)(*strict*)\n apply(force)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 p_d p_da Y1 d1y Y2 \\1y d2y \\2y)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y)(*strict*)\n apply(simp add: cfgLMMIP_def cfgLM.trans_der_def)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb)(*strict*)\n apply(case_tac \"foldl (@) [] (drop (Suc n) (take (length v) fw))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"butn (ESplitItem_to (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n) - length (ESplitItem_ignore (S2 ! n)))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"butn (ESplitItem_to (S2 ! n)) (length (restrict_toberemoved S2 ! Suc n) - length (ESplitItem_ignore (S2 ! n)))\")\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac n ds \\s fw d2x d1x X1 X2 Y1 d1y Y2 \\1y d2y e ea eb a list aa lista)(*strict*)\n apply(clarsimp)\n done\n\ntheorem equal_split_prefix_updated: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ cfgRM.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf=v@[teB b]@x1\\)\n \\ cfgRM.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf=v@[teB b]@x2\\)\n \\ EValidSplit G (S1@S1')\n \\ EValidSplit G (S2@S2')\n \\ length S1 = length (v@[teB b])\n \\ length S2 = length (v@[teB b])\n \\ v@[teB b] = Esplit_signature S1\n \\ v@[teB b] = Esplit_signature S2\n \\ x1 = Esplit_signature S1'\n \\ x2 = Esplit_signature S2'\n \\ S1R=restrict G' G (S1@S1') (length (v@[teB b]))\n \\ S2R=restrict G' G (S2@S2') (length (v@[teB b]))\n \\ restrictX G' S1R = restrictX G' S2R\"\n apply(subgoal_tac \"ESplitItem_elem ((S1 @ S1') ! length v) = Some (teB b)\")\n prefer 2\n apply(rule equal_split_prefix_hlp2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"PValidSplit G' G S1R\")\n prefer 2\n apply(rule equal_split_prefix_hlp3)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"ESplitItem_elem ((S2 @ S2') ! length v) = Some (teB b)\")\n prefer 2\n apply(rule_tac\n ?d1.0=\"d2\"\n in equal_split_prefix_hlp2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"PValidSplit G' G S2R\")\n prefer 2\n apply(rule_tac\n ?S1.0=\"S2\"\n and ?d1.0=\"d2\"\n in equal_split_prefix_hlp3)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"take (length (v@[teB b])) (restrictX G' S1R) = take (length (v@[teB b])) (restrictX G' S2R)\")\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n and S1'=\"S1'\"\n and S2'=\"S2'\"\n and ?S1.0=\"S1\"\n and ?S2.0=\"S2\"\n in equal_split_prefix_hlp1_updated)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(rule_tac\n t=\"restrictX G' S1R\"\n and s=\"take (length (v @ [teB b])) (restrictX G' S1R)\"\n in ssubst)\n apply(simp add: restrict_def restrict_len_def restrict_map_def restrictX_def)\n apply(case_tac \"length (Esplit_signature S1)\")\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 nat) = SSx\" for SSx)\n apply(rename_tac nat)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(rule_tac\n t=\"restrictX G' S2R\"\n and s=\"take (length (v @ [teB b])) (restrictX G' S2R)\"\n in ssubst)\n apply(simp add: restrict_def restrict_len_def restrict_map_def restrictX_def)\n apply(case_tac \"length (Esplit_signature S1)\")\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 nat) = SSx\" for SSx)\n apply(rename_tac nat)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac nat)(*strict*)\n apply(force)\n apply(force)\n done\n\nlemma equal_split_prefix_hlp1: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ cfgRM.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf=v@[teB b]@x1\\)\n \\ cfgRM.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf=v@[teB b]@x2\\)\n \\ EValidSplit G (S1@S1')\n \\ EValidSplit G (S2@S2')\n \\ length S1 = length (v@[teB b])\n \\ length S2 = length (v@[teB b])\n \\ v@[teB b] = Esplit_signature S1\n \\ v@[teB b] = Esplit_signature S2\n \\ x1 = Esplit_signature S1'\n \\ x2 = Esplit_signature S2'\n \\ S1' \\ []\n \\ S2' \\ []\n \\ S1R=restrict G' G (S1@S1') (length (v@[teB b]))\n \\ S2R=restrict G' G (S2@S2') (length (v@[teB b]))\n \\ ESplitItem_elem ((S1@S1') ! (length v)) = Some (teB b)\n \\ PValidSplit G' G S1R\n \\ ESplitItem_elem ((S2@S2') ! (length v)) = Some (teB b)\n \\ PValidSplit G' G S2R\n \\ i S1R!i = S2R!i\"\n apply(subgoal_tac \"restrictX G' S1R = restrictX G' S2R\")\n prefer 2\n apply(rule_tac\n S1R=\"S1R\"\n and S2R=\"S2R\"\n and ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n in equal_split_prefix_updated)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n prefer 7\n apply(force)\n apply(force)\n prefer 6\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"restrictX G' [S1R!i] = restrictX G' [S2R!i]\")\n prefer 2\n apply(rule_tac\n t=\"restrictX G' [S1R!i]\"\n and s=\"[(restrictX G' S1R) !i]\"\n in subst)\n apply(simp (no_asm) add: restrictX_def)\n apply(rule_tac\n t=\"map (\\I. I\\PSplitItem_prods := map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (PSplitItem_prods I)\\) S1R ! i\"\n in ssubst)\n apply(rule nth_map)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature S1) - Suc 0)) = SSx\" for SSx)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(clarsimp)\n apply(case_tac \"Esplit_signature S1\")\n apply(clarsimp)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n apply(clarsimp)\n apply(rule_tac\n t=\"restrictX G' [S2R!i]\"\n and s=\"[(restrictX G' S2R) !i]\"\n in subst)\n apply(simp (no_asm) add: restrictX_def)\n apply(rule_tac\n t=\"map (\\I. I\\PSplitItem_prods := map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (PSplitItem_prods I)\\) S2R ! i\"\n in ssubst)\n apply(rule nth_map)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature S2) - Suc 0)) = SSx\" for SSx)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(clarsimp)\n apply(case_tac \"Esplit_signature S1\")\n apply(clarsimp)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n apply(clarsimp)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_prods (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_prods (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_from PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prodsa PSplitItem_elem PSplitItem_to)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_from PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prodsa PSplitItem_elem PSplitItem_to PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsaa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim PSplitItem_from PSplitItem_ignore PSplitItem_elim_prods PSplitItem_elem PSplitItem_to PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_to)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_to PSplitItem_elima PSplitItem_fromaa PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim PSplitItem_from PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_to PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa PSplitItem_elima PSplitItem_fromaa PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_to PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elim PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa PSplitItem_elima PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim PSplitItem_ignore PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_elim (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_elem (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_elem (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prods PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim_prods PSplitItem_prods PSplitItem_elem PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(subgoal_tac \"PSplitItem_elim_prods (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) = PSplitItem_elim_prods (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i\")\n apply(rename_tac PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac PSplitItem_elim_prods PSplitItem_prods PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prodsa PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(simp add: restrictX_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature S1) - Suc 0)) = SSx\" for SSx)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (length (Esplit_signature S1) - Suc 0) = length (Esplit_signature S1)\")\n prefer 2\n apply(case_tac \"Esplit_signature S1\")\n apply(clarsimp)\n apply(rename_tac a list)(*strict*)\n apply(clarsimp)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length (Esplit_signature S1) - Suc 0) ! i = SSX\" for SSX)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_newprods_def)\n apply(subgoal_tac \"\\ds \\s fw. cfgLMTDL G ds (Esplit_signature S1) \\s fw\")\n prefer 2\n apply(simp add: cfgLMTDL_def)\n apply(subgoal_tac \"\\ds f\\ fw. cfgLM.trans_der_list SSG ds (map (\\w. \\cfg_conf = [w]\\) (Esplit_signature S1)) f\\ (map (\\w. \\cfg_conf = w\\) fw) \\ setA (foldl (@) [] fw) = {}\" for SSG)\n prefer 2\n apply(rule construct_elimininating_trans_der_list)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(simp add: split_TSstructure_def)\n apply(rule Esplit_signature_belongs_setA)\n apply(force)\n apply(rule Esplit_signature_belongs_setB)\n apply(force)\n apply(clarsimp)\n apply(rename_tac ds f\\ fw)(*strict*)\n apply(rule_tac\n x=\"ds\"\n in exI)\n apply(rule_tac\n x=\"f\\\"\n in exI)\n apply(rule_tac\n x=\"map filterB fw\"\n in exI)\n apply(rule_tac\n t=\"(map (\\x. \\cfg_conf = liftB x\\) (map filterB fw))\"\n and s=\"(map (\\w. \\cfg_conf = w\\) fw)\"\n in ssubst)\n apply(rename_tac ds f\\ fw)(*strict*)\n apply(rule listEqI)\n apply(rename_tac ds f\\ fw)(*strict*)\n apply(force)\n apply(rename_tac ds f\\ fw ia)(*strict*)\n apply(clarsimp)\n apply (metis setA_empty_foldl liftBDeConv2)\n apply(rename_tac ds f\\ fw)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(case_tac \"restrict_newignore S1 i = []\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"restrict_newignore S2 i \\ []\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newignore S2 i\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n in subst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n and s=\"restrict_newignore S1 i\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"liftB (ESplitItem_prods (S1 ! i)) = liftB (ESplitItem_prods (S2 ! i))\"\n and s=\"(ESplitItem_prods (S1 ! i)) = (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm))\n apply(rule impI)\n apply(rule liftB_inj)\n apply(blast)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"i \\ length v\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply (metis Suc_length less_not_refl less_trans_Suc trivNat)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"i\"\n and ?S1.0=\"S1\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"i\"\n and ?S1.0=\"S2\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i) = [] \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! i)))\\ (ESplitItem_prods ((S1 @ S1') ! i) @ \\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop i (take (length v) fw))) @ teB b # va\\)\")\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i) = [] \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! i)))\\ (ESplitItem_prods ((S2 @ S2') ! i) @ \\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop i (take (length v) fw))) @ teB b # va\\)\")\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length v)) = SSx\" for SSx)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(subgoal_tac \"take (Suc (length v)) S1 = S1\")\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n prefer 2\n apply(rule take_all)\n apply (metis Esplit_signature_length_max Suc_length)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(subgoal_tac \"take (Suc (length v)) S2 = S2\")\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n prefer 2\n apply(rule take_all)\n apply (metis Esplit_signature_length_max Suc_length)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length v) ! i = SSX\" for SSX)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(erule_tac\n P=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i) \\ []\"\n in impE)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rule_tac\n t=\"length S1\"\n and s=\"Suc(length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(rule_tac\n t=\"min (length S1') (Suc (length v) - Suc (length v))\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(rule_tac\n t=\"min (Suc (length v)) (Suc (length v)) + 0 - Suc 0\"\n and s=\"length v\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(erule impE)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rule_tac\n t=\"length S2\"\n and s=\"Suc(length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(rule_tac\n t=\"min (length S2') (Suc (length v) - Suc (length v))\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(rule_tac\n t=\"min (Suc (length v)) (Suc (length v)) + 0 - Suc 0\"\n and s=\"length v\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"Suc i\\length v\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(case_tac \"i=length v\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"length v\"\n and S=\"S2\"\n in restrict_newignore_last_empty)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply (metis length_Suc)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule ESplitItem_to_not_empty_on_generating_line)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"PSplitItem_to (restrict G' G (S2 @ S2') (Suc (length v)) ! i) = ESplitItem_to ((S2 @ S2') ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (Esplit_signature S1)\"\n and s=\"Suc(length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S2 @ S2') ! i\"\n and s=\"S2!i\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nonemtpy_newignore_implies_newto_unchanged)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"PSplitItem_to (restrict G' G (S1 @ S1') (Suc (length v)) ! i) = ESplitItem_to ((S1 @ S1') ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (Esplit_signature S1)\"\n and s=\"Suc(length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ S1') ! i\"\n and s=\"S1!i\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule_tac\n t=\"take (Suc (length v)) S1\"\n and s=\"S1\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule take_all)\n apply (metis Suc_length nat_neq_iff trivNat)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(rule nonemtpy_newignore_implies_newto_unchanged)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"Suc i < length S1\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply (metis Suc_n_not_n drop_length_append le_antisym le_trans length_append_empty1 list.simps(2) nat.inject trivNat)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(subgoal_tac \"Suc i < length S2\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply (metis Suc_n_not_n drop_length_append le_antisym le_trans length_append_empty1 list.simps(2) nat.inject trivNat)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(case_tac \"ESplitItem_from (S1 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S1!i\"\n and A=\"set (butlast (S1 @ S1'))\"\n in ballE)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(case_tac \"ESplitItem_from (S2 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S2!i\"\n and A=\"set (butlast (S2 @ S2'))\"\n in ballE)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n prefer 2\n apply(rule in_set_butlast_append2)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a a aa)(*strict*)\n apply(rename_tac F1 F2)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2)(*strict*)\n apply(case_tac \"F1\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q ba)(*strict*)\n apply(rename_tac qF1 AF1)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 qF1 AF1)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"ESplitItem_ignore (S1 ! i) = []\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(subgoal_tac \"proper_l3_l2_seq (ESplitItem_elim (S1 ! i) @ option_to_list (Some (cons_l2 qF1 AF1)) @ ESplitItem_ignore (S1 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_belongs G (S1 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp add: EValidSplitItem_belongs_def)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp (no_asm_use) add: option_to_list_def)\n apply(rule l2_in_proper_l3_l2_seq_at_end)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(subgoal_tac \"restrict_newignore S1 i = []\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S1 ! i) @ ESplitItem_ignore (S1 ! i)) (length (restrict_toberemovedX S1 ! Suc i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F2 qF1 AF1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2)(*strict*)\n apply(case_tac \"F2\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q baa)(*strict*)\n apply(rename_tac qF2 AF2)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 qF2 AF2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"ESplitItem_ignore (S2 ! i) = []\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(subgoal_tac \"proper_l3_l2_seq (ESplitItem_elim (S2 ! i) @ option_to_list (Some (cons_l2 qF2 AF2)) @ ESplitItem_ignore (S2 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_belongs G (S2 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp add: EValidSplitItem_belongs_def)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp (no_asm_use) add: option_to_list_def)\n apply(rule l2_in_proper_l3_l2_seq_at_end)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(subgoal_tac \"restrict_newignore S2 i = []\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(simp (no_asm) add: restrict_newignore_def new_post_sig_def)\n apply(rule_tac\n t=\"length (drop_and_crop (ESplitItem_to (S2 ! i) @ ESplitItem_ignore (S2 ! i)) (length (restrict_toberemovedX S2 ! Suc i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(rule drop_and_crop_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a q1 ba q2 qF2 AF2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(subgoal_tac \"length (Esplit_signature S1) = Suc (length v)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(subgoal_tac \"length (Esplit_signature S2) = Suc (length v)\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply (metis Suc_length)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rename_tac q11 A1 q12 q21 A2 q22)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(rule_tac\n \\=\"\\1\"\n and \\=\"e_\\1\"\n and d=\"e_d1\"\n and A=\"(cons_l3 q11 A1 q12)\"\n and w=\"liftA(butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S1 @ S1') ! i))))))\"\n in from_derives_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"[teA (cons_l3 q11 A1 q12)] @ liftA (butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S1 @ S1') ! i))))))\"\n and s=\"liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i))) (ESplitItem_ignore ((S1 @ S1') ! i))))))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(simp (no_asm) add: liftA_commutes_over_concat)\n apply(rule_tac\n t=\"(S1 @ S1') ! i\"\n and s=\"S1!i\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm_simp) add: option_to_list_def)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"e_d1a\"\n and A=\"(cons_l3 q21 A2 q22)\"\n and w=\"liftA(butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S2 @ S2') ! i))))))\"\n in from_derives_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"[teA (cons_l3 q21 A2 q22)] @ liftA (butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S2 @ S2') ! i))))))\"\n and s=\"liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S2 @ S2') ! i))))))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(simp (no_asm) add: liftA_commutes_over_concat)\n apply(rule_tac\n t=\"(S2 @ S2') ! i\"\n and s=\"S2!i\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm_simp) add: option_to_list_def)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d1a \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! i))) (ESplitItem_ignore ((S2 @ S2') ! i))))))\\ e_\\1a \\cfg_conf = liftB \\1a\\\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! i))) (ESplitItem_ignore ((S1 @ S1') ! i))))))\\ e_\\1 \\cfg_conf = liftB \\1\\\")\n apply(rename_tac ds \\s fw p_d p_da e_d1 e_d1a e_d2 e_d2a va vaa e_\\1 e_\\1a e_\\2 e_\\2a \\1 \\2 \\1a \\2a F1 F2 q11 A1 q12 q21 A2 q22)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"ESplitItem_from (S1 ! i) = ESplitItem_from (S2 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"ESplitItem_from (S1 ! i)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_from (S2 ! i)\"\n and s=\"Some (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp (no_asm_simp))\n apply(rule cropTol3l2_ID)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 q21 A2 q22 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and ?d1.0=\"d1a\"\n and ?d2.0=\"d1aa\"\n and ?x1.0=\"\\2b@\\2\"\n and ?x2.0=\"\\2c@\\2a\"\n in eliminating_derivations_are_equal_with_differing_future6)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1 \\1a \\2 \\1b \\2a \\1c \\2b \\2c)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! i)\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n v=\"\\1a\"\n in equal_by_length_and_prefix_of_greater)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S1 ! i)) \\ SSX\" for SSX)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2 @ e_\\2\"\n and d=\"\\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S1 ! i\"\n and s=\"(S1@S1') ! i\"\n in subst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1a\"\n and ?d2.0=\"d\"\n in unique_generation_length)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S2 ! i)) \\ SSX\" for SSX)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2a @ e_\\2a\"\n and d=\"\\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S2 ! i\"\n and s=\"(S2@S2') ! i\"\n in subst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1aa\"\n and ?d2.0=\"da\"\n in unique_generation_length)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"prefix (ESplitItem_prods (S1 ! i)) \\1a\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S1 ! i)) \\ SSX\" for SSX)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2 @ e_\\2\"\n and d=\"\\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S1 ! i\"\n and s=\"(S1@S1') ! i\"\n in subst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1a\"\n and ?d2.0=\"d\"\n in unique_generation_length)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"prefix (ESplitItem_prods (S2 ! i)) \\1a\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix \\1a (ESplitItem_prods (S2 ! i)) \\ SSX\" for SSX)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule_tac\n b=\"\\2a @ e_\\2a\"\n and d=\"\\s ! i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc i) (length v)))\"\n in mutual_strict_prefix_prefix)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule sym)\n apply(rule_tac\n t=\"S2 ! i\"\n and s=\"(S2@S2') ! i\"\n in subst)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(subgoal_tac \"c=[]\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1aa\"\n and ?d2.0=\"da\"\n in unique_generation_length)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da c)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(subgoal_tac \" ESplitItem_elem (S1 ! i) = Some ((v@[teB b])!i) \\ ESplitItem_elem (S2 ! i) = Some ((v@[teB b])!i) \")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n prefer 2\n apply(rule conjI)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule Esplit_signature_take_prefix_closureise)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(rule Esplit_signature_take_prefix_closureise)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da)(*strict*)\n apply(clarsimp)\n apply(case_tac \"Esplit_signature S1 ! i\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S1 ! i)) < length (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S1 ! i)) (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"d\"\n and ?d2.0=\"da\"\n in left_degen_repetitions_in_parallel_derivation)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S2 ! i)) < length (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S2 ! i)) (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"da\"\n and ?d2.0=\"d\"\n in left_degen_repetitions_in_parallel_derivation)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da a c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"length (ESplitItem_prods (S1 ! i)) < length (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S1 ! i)) (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"d\"\n and ?d2.0=\"da\"\n in terminal_production_repetitions_in_parallel_derivation)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(case_tac \"length (ESplitItem_prods (S2 ! i)) < length (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(subgoal_tac \"strict_prefix (ESplitItem_prods (S2 ! i)) (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n prefer 2\n apply(rule_tac\n v=\"\\1a\"\n in strict_prefix_from_prefix_of_longer_and_shorter)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(simp add: strict_prefix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(rule_tac\n v=\"[]\"\n and ?d1.0=\"da\"\n and ?d2.0=\"d\"\n in terminal_production_repetitions_in_parallel_derivation)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\2 \\2a \\1c \\2b \\2c d da ba c ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw p_d p_da e_d2 e_d2a va vaa e_\\2 e_\\2a \\2 \\2a q11 A1 q12 d1a d1aa \\1a \\2 \\2a \\1c \\2b \\2c d da ba)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"restrict_newignore S2 i = []\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newignore S2 i\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n in subst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n and s=\"restrict_newignore S1 i\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"map (prod_to_edge G') (ESplitItem_prods (S1 ! i)) = map (prod_to_edge G') (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule liftA_inj)\n apply(rule_tac\n t=\"liftA (map (prod_to_edge G') (ESplitItem_prods (S1 ! i)))\"\n and s=\"PSplitItem_prods ((restrictX G' [restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i])!0)\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrictX_def)\n apply(clarsimp)\n apply(rule sym)\n apply(simp add: restrict_newprods_def)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"liftA (map (prod_to_edge G') (ESplitItem_prods (S2 ! i)))\"\n and s=\"PSplitItem_prods ((restrictX G' [restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i])!0)\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrictX_def)\n apply(clarsimp)\n apply(rule sym)\n apply(simp add: restrict_newprods_def)\n apply(rule equal_split_prefix_hlp1_triv_eq)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (ESplitItem_prods (S1 ! i)) - Suc 0)) = SSx\" for SSx)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0)) = SSx\" for SSx)\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_prods (S1 ! i)) = length (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply (rule map_eq_imp_length_eq)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(simp only: restrict_newprodsX_def)\n apply(subgoal_tac \" ESplitItem_prods (S1 ! i) = [] \\ ESplitItem_prods (S2 ! i) = [] \")\n apply(rename_tac ds \\s fw)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(case_tac \"ESplitItem_prods (S1 ! i) = []\")\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"(if ESplitItem_prods (S1 ! i) = [] then [] else map (\\ia. if restrict_newprodsXX G ia (ESplitItem_prods (S1 ! i)) (ESplitItem_elem (S1 ! i)) (restrict_newto S1 i) then teB (ESplitItem_prods (S1 ! i) ! ia) else teA (THE e. e \\ F_DPDA_DRE__revert_F_SDPDA_TO_CFG_STD_1 G' (ESplitItem_prods (S1 ! i) ! ia))) (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0)))\"\n and s=\"map (\\ia. if restrict_newprodsXX G ia (ESplitItem_prods (S1 ! i)) (ESplitItem_elem (S1 ! i)) (restrict_newto S1 i) then teB (ESplitItem_prods (S1 ! i) ! ia) else teA (THE e. e \\ F_DPDA_DRE__revert_F_SDPDA_TO_CFG_STD_1 G' (ESplitItem_prods (S1 ! i) ! ia))) (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0))\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule_tac\n t=\"(if ESplitItem_prods (S2 ! i) = [] then [] else map (\\ia. if restrict_newprodsXX G ia (ESplitItem_prods (S2 ! i)) (ESplitItem_elem (S2 ! i)) (restrict_newto S2 i) then teB (ESplitItem_prods (S2 ! i) ! ia) else teA (THE e. e \\ F_DPDA_DRE__revert_F_SDPDA_TO_CFG_STD_1 G' (ESplitItem_prods (S2 ! i) ! ia))) (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0)))\"\n and s=\"(map (\\ia. if restrict_newprodsXX G ia (ESplitItem_prods (S2 ! i)) (ESplitItem_elem (S2 ! i)) (restrict_newto S2 i) then teB (ESplitItem_prods (S2 ! i) ! ia) else teA (THE e. e \\ F_DPDA_DRE__revert_F_SDPDA_TO_CFG_STD_1 G' (ESplitItem_prods (S2 ! i) ! ia))) (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0)))\"\n in ssubst)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(rule listEqI)\n apply(rename_tac ds \\s fw)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(rule impI)\n apply(simp (no_asm_use))\n apply(rule_tac\n t=\"(map SSf SSw)!ia\" for SSf SSw\n in ssubst)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(rule_tac\n t=\"(map SSf SSw)!ia\" for SSf SSw\n in ssubst)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0) ! ia = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length (ESplitItem_prods (S1 ! i)) - Suc 0) ! ia = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(case_tac \"ESplitItem_elem (S1 ! i)\")\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S1!i\"\n and A=\"set (butlast (S1 @ S1'))\"\n in ballE)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(subgoal_tac \"S1 ! i \\ set (butlast (S1 @ S1'))\")\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(rule nth_in_butlast_append)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(case_tac \"ESplitItem_elem (S2 ! i)\")\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S2!i\"\n and A=\"set (butlast (S2 @ S2'))\"\n in ballE)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(subgoal_tac \"S2 ! i \\ set (butlast (S2 @ S2'))\")\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(rule nth_in_butlast_append)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia a aa)(*strict*)\n apply(rename_tac X1 X2)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(subgoal_tac \"X1=X2\")\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"X1\"\n and s=\"PSplitItem_elem (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrict_newelem_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(rule_tac\n t=\"X2\"\n and s=\"PSplitItem_elem (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def restrict_newelem_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X2)(*strict*)\n apply(rename_tac X)\n apply(rename_tac ds \\s fw ia X1 X)(*strict*)\n apply(case_tac \"ESplitItem_from (S1 ! i)\")\n apply(rename_tac ds \\s fw ia X1 X)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(erule_tac\n x=\"S1!i\"\n and A=\"set (butlast (S1 @ S1'))\"\n in ballE)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(rule nth_in_butlast_append2)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X a)(*strict*)\n apply(case_tac \"ESplitItem_from (S2 ! i)\")\n apply(rename_tac ds \\s fw ia X1 X a)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(erule_tac\n x=\"S2!i\"\n and A=\"set (butlast (S2 @ S2'))\"\n in ballE)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(rule nth_in_butlast_append2)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X a aa)(*strict*)\n apply(rename_tac F1 F2)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(subgoal_tac \"cropTol3l2_single F1 = cropTol3l2_single F2\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"cropTol3l2_single F1\"\n and s=\"PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2)(*strict*)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(rule_tac\n t=\"cropTol3l2_single F2\"\n and s=\"PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2)(*strict*)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S1 ! i)\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(subgoal_tac \"EValidSplitItem_gen G (S2 ! i)\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2)(*strict*)\n apply(simp (no_asm_use) only: EValidSplitItem_gen_def)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X1 X F1 F2 d da)(*strict*)\n apply(rename_tac dx1 dx2)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"restrict_newto S2 i = restrict_newto S1 i\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n t=\"restrict_newto S2 i\"\n and s=\"PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"notfinishingL (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_to (S1 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(rule_tac\n w=\"[]\"\n and B=\"a\"\n and d=\"dx1\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n w=\"teA a#liftA ys\"\n and B=\"y\"\n and d=\"dx1\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(simp add: liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_to (S1 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n xs=\"ESplitItem_prods (S1 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx1\"\n and i=\"length ys\"\n and kleene_starT=\"False\"\n and END=\"True\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(erule_tac\n x=\"dx1\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F1]\\\"\n in allE)\n apply(erule_tac\n x=\"ys\"\n in allE)\n apply(erule_tac\n x=\"ci\"\n in allE)\n apply(erule impE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rule conjI)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(rule_tac\n m=\"Suc 0\"\n and v=\"[Some y]\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(erule impE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r w1 w2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r w1 w2 cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n apply(thin_tac \"\\ia teB ba\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n apply(erule_tac\n x=\"length ys\"\n in allE)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"l=liftB w1\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n prefer 2\n apply (metis split_decide1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(case_tac \"prod_rhs y\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(case_tac list)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(subgoal_tac \"LR1ProdFormSimp G\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(simp add: LR1ProdFormSimp_def)\n apply(erule_tac\n x=\"y\"\n in ballE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(rule_tac\n w=\"teB ba#liftA ys\"\n and B=\"y\"\n and d=\"dx1\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"notfinishingL (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_to (S2 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(rule_tac\n w=\"[]\"\n and B=\"a\"\n and d=\"dx2\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n w=\"teA a#liftA ys\"\n and B=\"y\"\n and d=\"dx2\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 a ys y)(*strict*)\n apply(simp add: liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_to (S2 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n xs=\"ESplitItem_prods (S2 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx2\"\n and i=\"length ys\"\n and kleene_starT=\"False\"\n and END=\"True\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(erule_tac\n x=\"dx2\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F2]\\\"\n in allE)\n apply(erule_tac\n x=\"ys\"\n in allE)\n apply(erule_tac\n x=\"ci\"\n in allE)\n apply(erule impE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rule conjI)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(rule_tac\n m=\"Suc 0\"\n and v=\"[Some y]\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(erule impE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r w1 w2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e ci l r w1 w2 cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n apply(thin_tac \"\\i teB ba\")\n apply(erule_tac\n x=\"length ys\"\n in allE)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"l=liftB w1\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n prefer 2\n apply (metis split_decide1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e l r w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e r w1 w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e w1 list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(case_tac \"prod_rhs y\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(case_tac list)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(subgoal_tac \"LR1ProdFormSimp G\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(simp add: LR1ProdFormSimp_def)\n apply(erule_tac\n x=\"y\"\n in ballE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y e list baa A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(rule_tac\n w=\"teB ba#liftA ys\"\n and B=\"y\"\n and d=\"dx2\"\n in trans_der_notfinishingL)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba ys y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"\\p\\ set (butlast (ESplitItem_prods (S1 ! i))). \\b A. prod_rhs p \\ [teB b, teA A]\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_prods (S1 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\ks fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n prefer 2\n apply (metis in_set_conv_nth)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx1\"\n and i=\"k\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n apply(subgoal_tac \"(ys @ [y]) ! k = ys!k\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n apply(clarsimp)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r cfg_confa)(*strict*)\n apply(case_tac ci')\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r cfg_confa cfg_confaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(erule_tac\n x=\"dx1\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F1]\\\"\n in allE)\n apply(erule_tac\n x=\"take (Suc k) ys\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = l @ teB ba # teA A # r\\\"\n in allE)\n apply(erule_tac\n P=\"cfgLMTD G dx1 \\cfg_conf = [teA F1]\\ (take (Suc k) ys) \\cfg_conf = l @ teB ba # teA A # r\\\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(rule_tac\n t=\"min (length ys) (Suc k)\"\n and s=\"Suc k\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n t=\"min (length ys) (Suc k)\"\n and s=\"Suc k\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(rule_tac\n m=\"length (ys@[y])-Suc k\"\n and v=\"map Some (drop(Suc k)(ys@[y]))\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(clarsimp)\n apply (metis List.map_append append_take_drop_id_hlp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(erule_tac\n P=\"\\w1 w2. cfg_conf \\cfg_conf = [teA F1]\\ = liftB w1 @ liftA w2\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 a)(*strict*)\n apply(thin_tac \"left_degen G dx2\")\n apply(simp add: left_degen_def sat_refined_def)\n apply(erule_tac\n x=\"k\"\n in allE)+\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(erule_tac\n x=\"Suc k\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n prefer 2\n apply(unfold cfgLM.trans_der_def)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(fold cfgLM.trans_der_def)\n apply(rule_tac\n eij=\"ea\"\n and cij=\"\\cfg_conf = teB baa # liftA (ESplitItem_to (S1 ! i))\\\"\n and ci=\"\\cfg_conf = liftB w1 @ liftA w2\\\"\n and ei=\"Some (ys!k)\"\n and d=\"dx1\"\n and i=\"Suc k\"\n and j=\"length (ys@[y])-Suc k\"\n in cfgLM.derivation_monotonically_inc)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(simp add: cfg_get_history_def)\n apply(subgoal_tac \"maxTermPrefix (liftB w1 @ liftA w2) = w1\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_drop_liftA maxTermPrefix_term_string)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"maxTermPrefix (teB baa # liftA (ESplitItem_to (S1 ! i))) = [baa]\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_pull_out maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(case_tac l)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list)(*strict*)\n apply(case_tac a)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"\\p\\ set (butlast (ESplitItem_prods (S2 ! i))). \\b A. prod_rhs p \\ [teB b, teA A]\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_prods (S2 ! i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\ks fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n prefer 2\n apply (metis in_set_conv_nth)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 p ba A ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx2\"\n and i=\"k\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n apply(subgoal_tac \"(ys @ [y]) ! k = ys!k\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r)(*strict*)\n apply(clarsimp)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r cfg_confa)(*strict*)\n apply(case_tac ci')\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e ci ci' l r cfg_confa cfg_confaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(erule_tac\n x=\"dx2\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F2]\\\"\n in allE)\n apply(erule_tac\n x=\"take (Suc k) ys\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = l @ teB ba # teA A # r\\\"\n in allE)\n apply(erule_tac\n P=\"cfgLMTD G dx2 \\cfg_conf = [teA F2]\\ (take (Suc k) ys) \\cfg_conf = l @ teB ba # teA A # r\\\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(rule_tac\n t=\"min (length ys) (Suc k)\"\n and s=\"Suc k\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n t=\"min (length ys) (Suc k)\"\n and s=\"Suc k\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(rule_tac\n m=\"length (ys@[y])-Suc k\"\n and v=\"map Some (drop(Suc k)(ys@[y]))\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(clarsimp)\n apply (metis List.map_append append_take_drop_id_hlp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(erule_tac\n P=\"\\w1 w2. cfg_conf \\cfg_conf = [teA F2]\\ = liftB w1 @ liftA w2\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 a)(*strict*)\n apply(thin_tac \"left_degen G dx1\")\n apply(simp add: left_degen_def sat_refined_def)\n apply(erule_tac\n x=\"k\"\n in allE)+\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(erule_tac\n x=\"Suc k\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n prefer 2\n apply(unfold cfgLM.trans_der_def)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(fold cfgLM.trans_der_def)\n apply(rule_tac\n eij=\"eb\"\n and cij=\"\\cfg_conf = teB baa # liftA (ESplitItem_to (S2 ! i))\\\"\n and ci=\"\\cfg_conf = liftB w1 @ liftA w2\\\"\n and ei=\"Some (ys!k)\"\n and d=\"dx2\"\n and i=\"Suc k\"\n and j=\"length (ys@[y])-Suc k\"\n in cfgLM.derivation_monotonically_inc)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa ea eb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(simp add: cfg_get_history_def)\n apply(subgoal_tac \"maxTermPrefix (liftB w1 @ liftA w2) = w1\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_drop_liftA maxTermPrefix_term_string)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"maxTermPrefix (teB baa # liftA (ESplitItem_to (S2 ! i))) = [baa]\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_pull_out maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(case_tac l)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e l r w1 w2 baa w a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list)(*strict*)\n apply(case_tac a)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w a list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb)(*strict*)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb)(*strict*)\n apply(case_tac w2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w2 baa list bb a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ba A ys y k e r w1 w2 baa w list bb a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"restrict_newprodsXX G (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0) ! ia) (ESplitItem_prods (S1 ! i)) (ESplitItem_elem (S1 ! i)) (restrict_newto S1 i) \\ restrict_newprodsXX G (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0) ! ia) (ESplitItem_prods (S2 ! i)) (ESplitItem_elem (S2 ! i)) (restrict_newto S2 i)\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(rule antisym)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n ?dx1.0=\"dx1\"\n and ?dx2.0=\"dx2\"\n and ?F1.0=\"F1\"\n and ?F2.0=\"F2\"\n in restrict_newprodsXX_implication)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n prefer 19\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"restrict_newto S2 i\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp (no_asm) add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule newto_and_old_to_either_unmodified_or_cropTol3l2_of_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"restrict_newto S2 i\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule newto_and_old_to_either_unmodified_or_cropTol3l2_of_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n ?dx1.0=\"dx2\"\n and ?dx2.0=\"dx1\"\n and ?F1.0=\"F2\"\n and ?F2.0=\"F1\"\n in restrict_newprodsXX_implication)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n prefer 19\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"restrict_newto S2 i\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp (no_asm) add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"restrict_newto S2 i\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule newto_and_old_to_either_unmodified_or_cropTol3l2_of_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(rule newto_and_old_to_either_unmodified_or_cropTol3l2_of_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(case_tac \"restrict_newprodsXX G (nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0) ! ia) (ESplitItem_prods (S1 ! i)) (ESplitItem_elem (S1 ! i)) (restrict_newto S1 i)\")\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia X1 X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(subgoal_tac \"(map (prod_to_edge G') (ESplitItem_prods (S1 ! i)))!ia = (map (prod_to_edge G') (ESplitItem_prods (S2 ! i)))!ia\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(thin_tac \"map (prod_to_edge G') (ESplitItem_prods (S1 ! i)) = map (prod_to_edge G') (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(simp add: prod_to_edge_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: restrict_newprodsXX_def)\n apply(simp add: option_to_list_def)\n apply(thin_tac \"nat_seq 0 (length (ESplitItem_prods (S2 ! i)) - Suc 0) ! ia = ia\")\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"ia\"\n and d=\"dx1\"\n in cfgLM.trans_der_position_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n prefer 2\n apply(rule_tac\n ?e1.0=\"e\"\n and cI=\"ci\"\n and n=\"ia\"\n and d=\"dx1\"\n in cfgLM.trans_der_skip_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(subgoal_tac \"prefix (realizable G (drop ia SSX)) (drop ia (ESplitItem_prods (S1 ! i)))\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n prefer 2\n apply(rule realizable_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"ia\"\n and d=\"dx2\"\n in cfgLM.trans_der_position_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n prefer 2\n apply(rule_tac\n ?e1.0=\"ea\"\n and cI=\"cia\"\n and n=\"ia\"\n and d=\"dx2\"\n in cfgLM.trans_der_skip_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(subgoal_tac \"prefix (realizable G (drop ia SSX)) (drop ia (ESplitItem_prods (S2 ! i)))\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n prefer 2\n apply(rule realizable_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n prefer 2\n apply(rule_tac\n \\=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in unique_existence_of_realizable)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n prefer 2\n apply(thin_tac \"\\!\\'. \\c. \\' \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ \\' c) \\ (setA (cfg_conf c) = {} \\ \\' = drop ia (ESplitItem_prods (S1 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule_tac\n \\=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in unique_existence_of_realizable)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da)(*strict*)\n apply(clarify)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(subgoal_tac \"realizable G (drop ia (ESplitItem_prods (S1 ! i))) = \\'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n prefer 2\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S1 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S1 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S2 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S2 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule_tac\n d=\"d\"\n and da=\"db\"\n in realizable_eq_from_existence)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(subgoal_tac \"realizable G (drop ia (ESplitItem_prods (S2 ! i))) = \\'a\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n prefer 2\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S1 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S1 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S2 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S2 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule_tac\n d=\"da\"\n and da=\"dc\"\n in realizable_eq_from_existence)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(clarify)\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S1 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S1 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S1 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(thin_tac \"\\y y'. (\\c. y \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y c) \\ (setA (cfg_conf c) = {} \\ y = drop ia (ESplitItem_prods (S2 ! i)))) \\ (\\c. y' \\ drop ia (ESplitItem_prods (S2 ! i)) \\ (\\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ y' c) \\ (setA (cfg_conf c) = {} \\ y' = drop ia (ESplitItem_prods (S2 ! i)))) \\ y = y'\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(thin_tac \"(e = Some (ESplitItem_prods (S1 ! i) ! (ia - Suc 0))) = (ea = Some (ESplitItem_prods (S2 ! i) ! (ia - Suc 0)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da \\' \\'a c ca db dc)(*strict*)\n apply(thin_tac \"(0 < ia) = (ea = Some (ESplitItem_prods (S2 ! i) ! (ia - Suc 0)))\")\n apply(thin_tac \"(e = None) = (ea = None)\")\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da c ca db dc)(*strict*)\n apply(case_tac ci)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da c ca db dc cfg_confa)(*strict*)\n apply(case_tac cia)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da c ca db dc cfg_confa cfg_confaa)(*strict*)\n apply(rename_tac x1 x2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e ci d ea cia da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"\\l'. liftA l' = x1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"filterA x1\"\n in exI)\n apply (rule liftA_filterA)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(erule_tac\n x=\"dx1\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F1]\\\"\n in allE)\n apply(erule_tac\n x=\"(take ia (ESplitItem_prods (S1 ! i)))\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf=x1\\\"\n in allE)\n apply(erule_tac\n P=\"cfgLMTD G dx1 \\cfg_conf = [teA F1]\\ (take ia (ESplitItem_prods (S1 ! i))) \\cfg_conf = x1\\\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rule_tac\n t=\"min (length (ESplitItem_prods (S2 ! i))) ia\"\n and s=\"ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 eb ec ed ee ef eg)(*strict*)\n apply(rule_tac\n m=\"length (ESplitItem_prods (S1 ! i))-ia\"\n and v=\"map Some (drop ia (ESplitItem_prods (S1 ! i)))\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 eb ec ed ee ef eg)(*strict*)\n apply(clarsimp)\n apply (metis List.map_append append_take_drop_id)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(erule_tac\n P=\"\\w1 w2. cfg_conf \\cfg_conf = [teA F1]\\ = liftB w1 @ liftA w2\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w1 w2)(*strict*)\n apply(simp add: setAConcat setBConcat setA_liftB setA_liftA setB_liftA setB_liftB)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w1 w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list)(*strict*)\n apply(subgoal_tac \"\\w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list)(*strict*)\n prefer 2\n apply(unfold cfgLM.trans_der_def)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(fold cfgLM.trans_der_def)\n apply(rule_tac\n eij=\"eb\"\n and cij=\"\\cfg_conf = X # liftA (ESplitItem_to (S1 ! i))\\\"\n and ei=\"e\"\n and ci=\"\\cfg_conf = teB a # liftB list @ liftA w2\\\"\n and d=\"dx1\"\n and i=\"ia\"\n and j=\"length (ESplitItem_prods (S1 ! i))-ia\"\n in cfgLM.derivation_monotonically_inc)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w)(*strict*)\n apply(simp add: cfg_get_history_def)\n apply(subgoal_tac \"maxTermPrefix (teB a # liftB list @ liftA w2) = a#list\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_pull_out append_Nil2 maxTermPrefix_liftA maxTermPrefix_shift)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w)(*strict*)\n apply(clarsimp)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(subgoal_tac \"maxTermPrefix (teA aa # liftA (ESplitItem_to (S1 ! i))) = []\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(subgoal_tac \"a # list @ w = []\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(rule_tac\n t=\"a # list @ w\"\n and s=\"maxTermPrefix (teA aa # liftA (ESplitItem_to (S1 ! i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w aa)(*strict*)\n apply (metis liftA.simps(2) liftA_commutes_over_concat maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w ba)(*strict*)\n apply(subgoal_tac \"maxTermPrefix (teB ba # liftA (ESplitItem_to (S1 ! i))) = [ba]\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 ba)(*strict*)\n apply(erule_tac\n x=\"ia\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc x2 w2 a list w ba)(*strict*)\n apply (metis maxTermPrefix_pull_out liftA.simps(2) liftA_commutes_over_concat maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"\\l'. liftA l' = x2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"filterA x2\"\n in exI)\n apply (rule liftA_filterA)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(erule_tac\n x=\"dx2\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA F2]\\\"\n in allE)\n apply(erule_tac\n x=\"(take ia (ESplitItem_prods (S2 ! i)))\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf=x2\\\"\n in allE)\n apply(erule_tac\n P=\"cfgLMTD G dx2 \\cfg_conf = [teA F2]\\ (take ia (ESplitItem_prods (S2 ! i))) \\cfg_conf = x2\\\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rule_tac\n t=\"min (length (ESplitItem_prods (S2 ! i))) ia\"\n and s=\"ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 l' eb ec ed ee ef eg)(*strict*)\n apply(rule_tac\n m=\"length (ESplitItem_prods (S2 ! i))-ia\"\n and v=\"map Some (drop ia (ESplitItem_prods (S2 ! i)))\"\n in get_labels_drop_tail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 l' eb ec ed ee ef eg)(*strict*)\n apply(clarsimp)\n apply (metis List.map_append append_take_drop_id)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 l' eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(erule_tac\n P=\"\\w1 w2. cfg_conf \\cfg_conf = [teA F2]\\ = liftB w1 @ liftA w2\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x2 l')(*strict*)\n apply(rule_tac\n x=\"[X]\" for X\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w1 w2)(*strict*)\n apply(simp add: setAConcat setBConcat setA_liftB setA_liftA setB_liftA setB_liftB)\n apply(case_tac w1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w1 w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list)(*strict*)\n apply(subgoal_tac \"\\w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list)(*strict*)\n prefer 2\n apply(unfold cfgLM.trans_der_def)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(fold cfgLM.trans_der_def)\n apply(rule_tac\n eij=\"ec\"\n and cij=\"\\cfg_conf = X # liftA (ESplitItem_to (S2 ! i))\\\"\n and ei=\"ea\"\n and ci=\"\\cfg_conf = teB a # liftB list @ liftA w2\\\"\n and d=\"dx2\"\n and i=\"ia\"\n and j=\"length (ESplitItem_prods (S2 ! i))-ia\"\n in cfgLM.derivation_monotonically_inc)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list eb ec ed ee ef eg)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w)(*strict*)\n apply(simp add: cfg_get_history_def)\n apply(subgoal_tac \"maxTermPrefix (teB a # liftB list @ liftA w2) = a#list\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w)(*strict*)\n prefer 2\n apply (metis maxTermPrefix_pull_out append_Nil2 maxTermPrefix_liftA maxTermPrefix_shift)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w)(*strict*)\n apply(clarsimp)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(subgoal_tac \"maxTermPrefix (teA aa # liftA (ESplitItem_to (S2 ! i))) = []\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(subgoal_tac \"a # list @ w = []\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(rule_tac\n t=\"a # list @ w\"\n and s=\"maxTermPrefix (teA aa # liftA (ESplitItem_to (S2 ! i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w aa)(*strict*)\n apply (metis liftA.simps(2) liftA_commutes_over_concat maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w ba)(*strict*)\n apply(subgoal_tac \"maxTermPrefix (teB ba # liftA (ESplitItem_to (S2 ! i))) = [ba]\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 ba)(*strict*)\n apply(erule_tac\n x=\"ia\"\n in allE)+\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 e d ea da c ca db dc l' w2 a list w ba)(*strict*)\n apply (metis maxTermPrefix_pull_out liftA.simps(2) liftA_commutes_over_concat maxTermPrefix_liftA)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc l' l'a)(*strict*)\n apply(rename_tac x1 x2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"only_l3_nonterminals (butlast x1)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n e=\"e\"\n and v=\"liftA x1\"\n and \\=\"[]\"\n and w=\"[F1]\"\n and d=\"dx1\"\n and n=\"ia\"\n in only_l3_nonterminals_butlast_preserved)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(simp add: only_l3_nonterminals_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n apply(case_tac v1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list)(*strict*)\n apply(case_tac x1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(subgoal_tac \"x1=v2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(rule_tac liftA_inj)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"only_l3_nonterminals (butlast x2)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n e=\"ea\"\n and v=\"liftA x2\"\n and \\=\"[]\"\n and w=\"[F2]\"\n and d=\"dx2\"\n and n=\"ia\"\n in only_l3_nonterminals_butlast_preserved)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(simp add: only_l3_nonterminals_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n apply(case_tac v1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list)(*strict*)\n apply(case_tac x2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2 a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(subgoal_tac \"x2=v2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 v2)(*strict*)\n apply(rule_tac liftA_inj)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"length (realizable G (drop ia (ESplitItem_prods (S1 ! i)))) = length (realizable G (drop ia (ESplitItem_prods (S2 ! i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d\"\n in realizable_length_eq)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply (rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply (rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply (metis drop_map)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(erule_tac\n x=\"p\"\n and A=\"set (butlast (ESplitItem_prods (S1 ! i)))\"\n in ballE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(subgoal_tac \"p \\ set (butlast (ESplitItem_prods (S1 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(rule_tac\n A=\"set (butlast (drop ia (ESplitItem_prods (S1 ! i))))\"\n in set_mp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply (metis drop_butlast set_drop_subset)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(erule_tac\n x=\"p\"\n and A=\"set (butlast (ESplitItem_prods (S2 ! i)))\"\n in ballE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(subgoal_tac \"p \\ set (butlast (ESplitItem_prods (S2 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(rule_tac\n A=\"set (butlast (drop ia (ESplitItem_prods (S2 ! i))))\"\n in set_mp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply (metis drop_butlast set_drop_subset)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 p ba A)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"db\"\n and ?d2.0=\"dc\"\n in prod_to_edge_eq_implies_same_terminal_production2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp (no_asm))\n apply(rule same_source_edge_productions_have_similar_lhs)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n A=\"set (ESplitItem_prods (S1 ! i))\"\n in set_mp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule nth_mem)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n A=\"set (ESplitItem_prods (S2 ! i))\"\n in set_mp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule nth_mem)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: notfinishingL_def notfinishing_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(simp add: notfinishingL_def notfinishing_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"prod_to_edge G' ((ESplitItem_prods (S1 ! i)) ! ia)\"\n and s=\"(map (prod_to_edge G') (ESplitItem_prods (S1 ! i)))!ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(metis nth_map)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n t=\"prod_to_edge G' ((ESplitItem_prods (S2 ! i)) ! ia)\"\n and s=\"(map (prod_to_edge G') (ESplitItem_prods (S2 ! i)))!ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(metis nth_map)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(rule_tac\n ?x1.0=\"(ESplitItem_prods (S1 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S2 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 \\ v1 v2)(*strict*)\n apply(case_tac c)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 \\ v1 v2 cfg_confa)(*strict*)\n apply(case_tac ca)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da c ca db dc x1 x2 \\ v1 v2 cfg_confa cfg_confaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 e d ea da db dc x1 x2 \\ v1 v2)(*strict*)\n apply(simp add: setAConcat setBConcat setA_liftB setA_liftA setB_liftA setB_liftB)\n apply(thin_tac \"(ia = 0) = (ea = None)\")\n apply(rename_tac ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(subgoal_tac \"derives G (drop ia (ESplitItem_prods (S1 ! i))) = liftB \\ @ liftA v1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n prefer 2\n apply(simp add: derives_def)\n apply(rule_tac\n t=\"(THE c. \\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S1 ! i)))))]\\ (realizable G (drop ia (ESplitItem_prods (S1 ! i)))) c)\"\n and s=\"\\cfg_conf = liftB \\ @ liftA v1\\\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(rule_tac\n a=\"\\cfg_conf = liftB \\ @ liftA v1\\\"\n in the_equality)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(rule_tac\n x=\"dz1\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(rule_tac\n ?d1.0=\"d\"\n and ?d2.0=\"dz1\"\n in cfgLM_trans_der_unique_result)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(subgoal_tac \"derives G (drop ia (ESplitItem_prods (S2 ! i))) = liftB \\ @ liftA v2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n prefer 2\n apply(simp add: derives_def)\n apply(rule_tac\n t=\"(THE c. \\d. cfgLM.trans_der G d \\cfg_conf = [teA (prod_lhs (hd (drop ia (ESplitItem_prods (S2 ! i)))))]\\ (realizable G (drop ia (ESplitItem_prods (S2 ! i)))) c)\"\n and s=\"\\cfg_conf = liftB \\ @ liftA v2\\\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(rule_tac\n a=\"\\cfg_conf = liftB \\ @ liftA v2\\\"\n in the_equality)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(rule_tac\n x=\"dz2\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(rule_tac\n ?d1.0=\"d\"\n and ?d2.0=\"dz2\"\n in cfgLM_trans_der_unique_result)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 x d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(clarsimp)\n apply(case_tac x1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx1\"\n and i=\"ia\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x1 x2 \\ v1 v2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2 a list)(*strict*)\n apply(rename_tac X1 x1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2 X1 x1)(*strict*)\n apply(case_tac x2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2 X1 x1)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dx2\"\n and i=\"ia\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 x2 \\ v1 v2 X1 x1 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 a list)(*strict*)\n apply(rename_tac X2 x2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"drop ia (ESplitItem_prods (S1 ! i)) = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"drop ia (ESplitItem_prods (S2 ! i)) = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \" (realizable G (ESplitItem_prods (S1 ! i) ! ia # drop (Suc ia) (ESplitItem_prods (S1 ! i)))) \\ []\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule realizable_not_empty)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \" (realizable G (ESplitItem_prods (S2 ! i) ! ia # drop (Suc ia) (ESplitItem_prods (S2 ! i)))) \\ []\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule realizable_not_empty)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"X1 = prod_lhs(ESplitItem_prods (S1 ! i) ! ia)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dy1\"\n and i=\"0\"\n and kleene_starT=\"True\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dz1\"\n and i=\"0\"\n and kleene_starT=\"True\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2 e ea ci' ci'a)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n apply(case_tac l)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2 e ea ci' ci'a l r la ra a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"X2 = prod_lhs(ESplitItem_prods (S2 ! i) ! ia)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dy2\"\n and i=\"0\"\n and kleene_starT=\"True\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"dz2\"\n and i=\"0\"\n and kleene_starT=\"True\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 X2 x2 e ea ci' ci'a)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n apply(case_tac l)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 X2 x2 e ea ci' ci'a l r la ra a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 X2 x2 e ea ci' ci'a l r la ra)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 X1 x1 X2 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x2)(*strict*)\n apply(rule_tac\n xs=\"x1\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dy1\"\n and da=\"dy1\"\n and \\'=\"(ESplitItem_prods (S1 ! i) ! ia # drop (Suc ia) (ESplitItem_prods (S1 ! i)))\"\n in realizable_eq_from_existence)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\cfg_conf = X # liftA (ESplitItem_to (S1 ! i))\\ = \\cfg_conf = liftB \\ @ liftA v1\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dy1\"\n and ?d2.0=\"dz1\"\n in cfgLM_trans_der_unique_result)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"X # liftA (ESplitItem_to (S1 ! i))\"\n and v=\"X # liftA (restrict_newto S1 i)\"\n in strict_prefix_contra)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(rule sym)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(thin_tac \"X # liftA (ESplitItem_to (S1 ! i)) = liftB \\ @ liftA v1\")\n apply(clarsimp)\n apply(subgoal_tac \"length (restrict_newto S1 i) \\ length (ESplitItem_to (S1 ! i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply (metis liftA_preserves_length)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2)(*strict*)\n apply(simp (no_asm) add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x2 ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 ys y)(*strict*)\n apply(rename_tac x1 x1L)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 x1 x1L)(*strict*)\n apply(rule_tac\n xs=\"x2\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 x1 x1L)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 x1 x1L)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"dy2\"\n and da=\"dy2\"\n and \\'=\"(ESplitItem_prods (S2 ! i) ! ia # drop (Suc ia) (ESplitItem_prods (S2 ! i)))\"\n in realizable_eq_from_existence)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(rule_tac\n t=\"cfg_productions G\"\n and s=\"cfg_step_labels G\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp add: cfg_step_labels_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(rule cfgLM.trans_der_all_step_labels)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\cfg_conf = X # liftA (ESplitItem_to (S2 ! i))\\ = \\cfg_conf = liftB \\ @ liftA v2\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dy2\"\n and ?d2.0=\"dz2\"\n in cfgLM_trans_der_unique_result)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n w=\"liftB \\ @ liftA v2\"\n and x=\"X # liftA (ESplitItem_to (S2 ! i))\"\n and v=\"X # liftA (restrict_newto S2 i)\"\n in strict_prefix_contra)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(rule sym)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(thin_tac \"X # liftA (ESplitItem_to (S2 ! i)) = liftB \\ @ liftA v2\")\n apply(clarsimp)\n apply(rule_tac\n t=\"restrict_newto S1 i\"\n and s=\"restrict_newto S2 i\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(subgoal_tac \"length (restrict_newto S2 i) \\ length (ESplitItem_to (S2 ! i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply (metis liftA_preserves_length)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L)(*strict*)\n apply(simp (no_asm) add: restrict_newto_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x2 x1 x1L ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L ys y)(*strict*)\n apply(rename_tac x2 x2L)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L)(*strict*)\n apply(case_tac \"ESplitItem_prods (S1 ! i) ! ia\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L prod_lhsa prod_rhsa)(*strict*)\n apply(clarsimp)\n apply(rename_tac X1 r1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1)(*strict*)\n apply(case_tac \"ESplitItem_prods (S2 ! i) ! ia\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 prod_lhsa prod_rhsa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 prod_lhs prod_rhsa)(*strict*)\n apply(rename_tac X2 r2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2)(*strict*)\n apply(case_tac X1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 X2 r2 q ba)(*strict*)\n apply(rule only_l3_nonterminals_l2_at_front)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2)(*strict*)\n apply(case_tac X2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q1 ba q2 q baa)(*strict*)\n apply(rule only_l3_nonterminals_l2_at_front)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dz1\"\n and ?d2.0=\"dz2\"\n in cropTol3l2_single_equal_of_compatible_derivations)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n x=\"ia\"\n and ?x1.0=\"(ESplitItem_prods (S1 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S2 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = X1, prod_rhs = r1\\\"\n and s=\"ESplitItem_prods (S1 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = X2, prod_rhs = r2\\\"\n and s=\"ESplitItem_prods (S2 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(subgoal_tac \"q1a = q1 \\ ba = baa\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n prefer 2\n apply(simp add: cropTol3l2_single_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L X1 r1 X2 r2 q1 ba q2 q1a baa q2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q1 q2 ba q2a)(*strict*)\n apply(thin_tac \"cropTol3l2_single (cons_l3 q1 ba q2) = cropTol3l2_single (cons_l3 q1 ba q2a)\")\n apply(rename_tac q q1 c q2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(case_tac \"v1=[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"v2=[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dz1\"\n and ?d2.0=\"dz2\"\n in compatible_derivation_reach_empty_configuration_synchronously_ext)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n x=\"ia\"\n and ?x1.0=\"(ESplitItem_prods (S1 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S2 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\\"\n and s=\"ESplitItem_prods (S1 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\\"\n and s=\"ESplitItem_prods (S2 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(rule_tac\n ?\\1'.0=\"[]\"\n and ?\\2'.0=\"[]\"\n and ?d1.0=\"dz1\"\n and ?d2.0=\"dz2\"\n in compatible_derivations_coincide_heavily)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(simp (no_asm))\n apply(rule_tac\n x=\"ia\"\n and ?x1.0=\"(ESplitItem_prods (S1 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S2 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q c q2)(*strict*)\n apply(rename_tac q1 c q2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(subgoal_tac \"realizable G (\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) = realizable G (\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dz1\"\n and ?d2.0=\"dz2\"\n in same_l3_source_and_same_target_liftB_and_same_prod_to_edge_implies_equal_prods)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r1\\\"\n and s=\"ESplitItem_prods (S1 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r2\\\"\n and s=\"ESplitItem_prods (S2 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n x=\"ia\"\n and ?x1.0=\"(ESplitItem_prods (S1 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S2 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2 ca cb)(*strict*)\n apply(case_tac \"realizable G (\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2 ca cb)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2 ca cb a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"realizable G (\\prod_lhs = cons_l3 q1 c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2 ca cb a list)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ x1 x1L x2 x2L r1 r2 q1 c q2 ca cb a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(case_tac \"v2=[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"v1=[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"dz2\"\n and ?d2.0=\"dz1\"\n in compatible_derivation_reach_empty_configuration_synchronously_ext)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n x=\"ia\"\n and ?x1.0=\"(ESplitItem_prods (S2 ! i))\"\n and ?x2.0=\"(ESplitItem_prods (S1 ! i))\"\n in equal_by_same_length_and_equal_embedding)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S2 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"drop ia (ESplitItem_prods (S1 ! i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\\"\n and s=\"ESplitItem_prods (S2 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_prefix)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\\"\n and s=\"ESplitItem_prods (S1 ! i) ! ia\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule_tac\n t=\"SSX#SSY\" for SSX SSY\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule nth_drop2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(rule notfinishingL_drop)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(case_tac \"i=length v\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"ESplitItem_elem (S1 ! length v) = Some (teB b)\")\n apply(rename_tac ds \\s fw i X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply (metis nth_append)\n apply(rename_tac ds \\s fw i X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(case_tac \"ESplitItem_to (S1 ! length v)\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_to_empty_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S1!length v\"\n and A=\"set (butlast (S1 @ S1'))\"\n in ballE)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply (metis nth_in_butlast_append)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n apply(case_tac \"ESplitItem_to (S2 ! length v)\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_to_empty_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"S2!length v\"\n and A=\"set (butlast (S2 @ S2'))\"\n in ballE)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n prefer 2\n apply (metis nth_in_butlast_append)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 a list aa lista)(*strict*)\n apply(rename_tac t1 t1s t2 t2s)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(subgoal_tac \"restrict_newto S1 (length v) = [cropTol3l2_single (hd(ESplitItem_to (S1 ! length v)))]\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n prefer 2\n apply(simp add: restrict_newto_def new_post_sig_def restrict_toberemovedX_def)\n apply(rule_tac\n t=\"(restrict_toberemoved S1 @ [tl (ESplitItem_to (last S1) @ ESplitItem_ignore (last S1))]) ! Suc (length v)\"\n in ssubst)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(rule nth_append_2)\n apply (metis length_0_conv length_Suc length_restrict_toberemoved less_irrefl_nat less_zeroE trivNat)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(rule_tac\n t=\"Suc (length v) - length (restrict_toberemoved S1)\"\n and s=\"0\"\n in ssubst)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(simp add: length_restrict_toberemoved)\n apply (metis length_0_conv length_Suc length_restrict_toberemoved less_irrefl_nat less_zeroE trivNat)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(clarsimp)\n apply(simp add: drop_and_crop_def butn_def)\n apply(rule_tac\n t=\"last S1\"\n and s=\"S1!length v\"\n in ssubst)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply (metis length_Suc nth_last)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(simp (no_asm) add: cropTol3l2_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ca cb)(*strict*)\n apply(rule_tac\n xs=\"ca\"\n in rev_cases)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ca cb ys y)(*strict*)\n apply(rule_tac\n xs=\"cb\"\n in rev_cases)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ca cb ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ca cb ys y ysa ya)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa)(*strict*)\n apply(case_tac \"v1\")\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa)(*strict*)\n prefer 2\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa a list)(*strict*)\n apply(case_tac \\)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw i F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1 t1s t2 t2s ys ysa)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(subgoal_tac \"is fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n prefer 2\n apply (metis Suc_inject Suc_lessI Suc_less_eq length_Suc)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) \\ (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(thin_tac \"(\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) \\ (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(thin_tac \"derives G (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) = liftB \\ @ liftA v1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(thin_tac \"derives G (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) = liftB \\ @ liftA v2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 ca cb)(*strict*)\n apply(rename_tac t1' t2')\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2')(*strict*)\n apply(rule_tac\n xs=\"t1'\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2')(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2' ys y)(*strict*)\n apply(rule_tac\n xs=\"t2'\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2' ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2' ys y ysa ya)(*strict*)\n apply(rename_tac bx1 bx1L bx2 bx2L)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 t1' t2' bx1 bx1L bx2 bx2L)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(subgoal_tac \"case X of teA A \\ \\ = [] | teB b \\ \\=[b]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L a)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L a aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba)(*strict*)\n apply(case_tac v1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba list)(*strict*)\n apply(case_tac list)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba a lista)(*strict*)\n apply(case_tac \"restrict_newto S1 i\")\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L ba a lista aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(subgoal_tac \"PValidSplit_interlineX (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! i) (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(subgoal_tac \"PValidSplit_interline (restrict G' G (S1 @ S1') (length (Esplit_signature S1)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(simp add: PValidSplit_interline_def)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule_tac\n P=\"Suc i < length (restrict G' G (S1 @ S1') (length (Esplit_signature S1)))\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"Esplit_signature S1\"\n and s=\"v @ [teB b]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(thin_tac \"v @ [teB b] = Esplit_signature S1\")\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(subgoal_tac \"PValidSplit_interlineX (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! i) (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(subgoal_tac \"PValidSplit_interline (restrict G' G (S2 @ S2') (length (Esplit_signature S2)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(simp add: PValidSplit_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(simp add: PValidSplit_interline_def)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(erule_tac\n P=\"Suc i < length (restrict G' G (S2 @ S2') (length (Esplit_signature S1)))\"\n in impE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"Esplit_signature S1\"\n and s=\"v @ [teB b]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(thin_tac \"v @ [teB b] = Esplit_signature S1\")\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(simp add: PValidSplit_interlineX_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"Suc i\"\n and ?S1.0=\"S1\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(rule_tac\n i=\"Suc i\"\n and ?S1.0=\"S2\"\n and n=\"length v\"\n and v=\"v\"\n and b=\"b\"\n in e_derivation_can_be_embedded_minimally)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L p_d p_da)(*strict*)\n apply(rename_tac pd1 pd2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(erule conjE)+\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i) \\ [] \\ (\\e_d1 e_d2 va e_\\1 e_\\2 \\1 \\2. ESplitItem_prods ((S2 @ S2') ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v))) = e_\\1 @ e_\\2 \\ foldl (@) [] (drop (Suc i) (take (length v) fw)) = \\1 @ \\2 \\ cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S2 @ S2') ! Suc i))))))\\ e_\\1 \\cfg_conf = liftB \\1\\ \\ cfgLM.trans_der G e_d2 \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S2 @ S2') ! Suc i))))))]\\ e_\\2 \\cfg_conf = liftB \\2 @ [teB b] @ va\\)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i) = [] \\ drop (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S2 @ S2') ! Suc i)) = ESplitItem_ignore ((S2 @ S2') ! Suc i) \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc i)))\\ (ESplitItem_prods ((S2 @ S2') ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop (Suc i) (take (length v) fw))) @ [teB b] @ va\\)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i) \\ [] \\ (\\e_d1 e_d2 va e_\\1 e_\\2 \\1 \\2. ESplitItem_prods ((S1 @ S1') ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v))) = e_\\1 @ e_\\2 \\ foldl (@) [] (drop (Suc i) (take (length v) fw)) = \\1 @ \\2 \\ cfgLM.trans_der G e_d1 \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc i)) @ butlast (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S1 @ S1') ! Suc i))))))\\ e_\\1 \\cfg_conf = liftB \\1\\ \\ cfgLM.trans_der G e_d2 \\cfg_conf = [teA (last (fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S1 @ S1') ! Suc i))))))]\\ e_\\2 \\cfg_conf = liftB \\2 @ [teB b] @ va\\)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(thin_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i) = [] \\ drop (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i))) (ESplitItem_ignore ((S1 @ S1') ! Suc i)) = ESplitItem_ignore ((S1 @ S1') ! Suc i) \\ (\\e_d va. cfgLM.trans_der G e_d \\cfg_conf = liftA (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc i)))\\ (ESplitItem_prods ((S1 @ S1') ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) \\cfg_conf = liftB (foldl (@) [] (drop (Suc i) (take (length v) fw))) @ [teB b] @ va\\)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(clarsimp)\n apply(simp add: fillWithPreContext_def)\n apply(subgoal_tac \"\\Y1. ESplitItem_from (S1 ! Suc i)= Some Y1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n prefer 2\n apply(subgoal_tac \"(\\x\\ set (butlast (S1 @ S1')). (\\y. ESplitItem_from x = Some y) \\ (\\y. ESplitItem_elem x = Some y))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(erule_tac\n x=\"S1!Suc i\"\n in ballE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n prefer 2\n apply(subgoal_tac \"S1 ! Suc i \\ set (butlast (S1 @ S1'))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(thin_tac \"S1 ! Suc i \\ set (butlast (S1 @ S1'))\")\n apply(rule nth_in_butlast_append)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply (metis Suc_lessI append_Nil length_1_cons_nth length_Suc less_not_refl less_trans_Suc list.size(3) not_less_eq)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(subgoal_tac \"length S1 = Suc(length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply (metis Suc_lessI append_Nil length_1_cons_nth length_Suc less_not_refl less_trans_Suc list.size(3) not_less_eq)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(subgoal_tac \"(S1 @ S1') ! Suc i = S1!Suc i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length (Esplit_signature S1) - Suc 0) ! Suc i = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(subgoal_tac \"(fillOpt (PSplitItem_from (restrict G' G (S1 @ S1') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S1 @ S1') ! Suc i))))) = Y1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rule fillOpt_hd_and_last_back_state)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"fillOpt (PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)) (last_back_state_if_l3_nonterminal (option_to_list (Some Y1))) = Y1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(subgoal_tac \"\\Y2. ESplitItem_from (S2 ! Suc i)= Some Y2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(subgoal_tac \"(\\x\\ set (butlast (S2 @ S2')). (\\y. ESplitItem_from x = Some y) \\ (\\y. ESplitItem_elem x = Some y))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(erule_tac\n x=\"S2!Suc i\"\n in ballE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n prefer 2\n apply(subgoal_tac \"S2 ! Suc i \\ set (butlast (S2 @ S2'))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(thin_tac \"S2 ! Suc i \\ set (butlast (S2 @ S2'))\")\n apply(rule nth_in_butlast_append)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply (metis Suc_lessI append_Nil length_1_cons_nth length_Suc less_not_refl less_trans_Suc list.size(3) not_less_eq)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"length S2 = Suc(length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply (metis Suc_lessI append_Nil length_1_cons_nth length_Suc less_not_refl less_trans_Suc list.size(3) not_less_eq)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"(S2 @ S2') ! Suc i = S2!Suc i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length (Esplit_signature S2) - Suc 0) ! Suc i = SSX\" for SSX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"(fillOpt (PSplitItem_from (restrict G' G (S2 @ S2') (Suc (length v)) ! Suc i)) (last_back_state_if_l3_nonterminal (option_to_list (ESplitItem_from ((S2 @ S2') ! Suc i))))) = Y2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rule fillOpt_hd_and_last_back_state)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"fillOpt (PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i)) (last_back_state_if_l3_nonterminal (option_to_list (Some Y2))) = Y2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(thin_tac \"fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v)))) @ tl (ESplitItem_to ((S1 @ S1') ! length v)) @ butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc i)) @ drop (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)) = ESplitItem_to ((S1 @ S1') ! length v) @ ESplitItem_ignore ((S1 @ S1') ! length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(thin_tac \"fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc i)) @ drop (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)) = ESplitItem_to ((S2 @ S2') ! length v) @ ESplitItem_ignore ((S2 @ S2') ! length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule append_take_drop_id_C)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"fillOptL (PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)))) = take (length (PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule append_take_drop_id_C)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"fillOptL (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i)) (last_back_state_if_l3_nonterminal (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)))) = take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"length v1=length v2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(unfold cfgLM.trans_der_def)[1]\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(erule conjE)+\n apply(rule_tac\n ?x1.0=\"[]\"\n and ?x2.0=\"[]\"\n and n=\"length(\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i)))\"\n and ?v1.0=\"\\\"\n and ?v2.0=\"\\\"\n and ?w1.0=\"v1\"\n and ?w2.0=\"v2\"\n and q=\"q\"\n and A=\"c\"\n and ?q1.0=\"q1\"\n and ?q2.0=\"q2\"\n and G=\"G'\"\n and G'=\"G\"\n and ?d1.0=\"dz1\"\n and ?d2.0=\"dz2\"\n in cfgLM_positions_remain_compatible_l3l3)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(simp add: F2LR1inputx_def split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 e ea eb ec ed ee)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S1 ! Suc i) @ hd (cropTol3l2 (Y1 # restrict_newignore S1 (Suc i))) # restrict_newignore S1 (Suc i) = restrict_newto S1 i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule_tac\n P=\"\\X. X\"\n and s=\"PSplitItem_elim (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) @ PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) # PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) = PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i) @ PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(thin_tac \"PSplitItem_elim (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) @ PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) # PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i) = PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i) @ PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S2 ! Suc i) @ hd (cropTol3l2 (Y2 # restrict_newignore S2 (Suc i))) # restrict_newignore S2 (Suc i) = restrict_newto S2 i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule_tac\n P=\"\\X. X\"\n and s=\"PSplitItem_elim (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) @ PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) = PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i) @ PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(thin_tac \"PSplitItem_elim (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) @ PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) = PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i) @ PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"restrictX G' [(restrict G' G (S1 @ S1') (length (Esplit_signature S1)))!(Suc i)] = restrictX G' [(restrict G' G (S2 @ S2') (length (Esplit_signature S2)))!(Suc i)]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrictX G' [(restrict G' G (S1 @ S1') (length (Esplit_signature S1)))!(Suc i)]\"\n and s=\"[(restrictX G' (restrict G' G (S1 @ S1') (length (Esplit_signature S1)))) !(Suc i)]\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrictX_def)\n apply(rule_tac\n t=\"map (\\I. I\\PSplitItem_prods := map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (PSplitItem_prods I)\\) (restrict G' G (S1 @ S1') (length (Esplit_signature S1))) ! (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(rule nth_map)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature S1) - Suc 0)) = SSx\" for SSx)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(rule_tac\n t=\"restrictX G' [(restrict G' G (S2 @ S2') (length (Esplit_signature S2)))!(Suc i)]\"\n and s=\"[(restrictX G' (restrict G' G (S2 @ S2') (length (Esplit_signature S2)))) !(Suc i)]\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrictX_def)\n apply(rule_tac\n t=\"map (\\I. I\\PSplitItem_prods := map (case_DT_two_elements teA (\\p. teA (prod_to_edge G' p))) (PSplitItem_prods I)\\) (restrict G' G (S2 @ S2') (length (Esplit_signature S2))) ! (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(rule nth_map)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature S2) - Suc 0)) = SSx\" for SSx)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_from (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)) = PSplitItem_from (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(simp add: restrictX_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)) = PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_froma PSplitItem_ignoreaa PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(simp add: restrictX_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)) = PSplitItem_elim (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(case_tac \"restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa)(*strict*)\n apply(case_tac \"restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_fromaa PSplitItem_ignoreaa PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 PSplitItem_elima PSplitItem_elim_prodsa PSplitItem_prods PSplitItem_elema PSplitItem_toa PSplitItem_elimaa PSplitItem_froma PSplitItem_ignorea PSplitItem_elim_prodsaa PSplitItem_prodsa PSplitItem_elemaa PSplitItem_toaa)(*strict*)\n apply(simp add: restrictX_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(subgoal_tac \"ESplitItem_elim (S1 ! Suc i) = ESplitItem_elim (S2 ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"ESplitItem_elim (S1 ! Suc i)\"\n and s=\"PSplitItem_elim (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_elim (S2 ! Suc i)\"\n and s=\"PSplitItem_elim (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitItem_elim G (S1 ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem G (S1!Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplit_ValidItem G (S1 @ S1')\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp add: EValidSplit_ValidItem_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp add: EValidSplitItem_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp add: EValidSplitItem_elim_def)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 2\n apply(rule elim_map_to_trans_der)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n prefer 4\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(thin_tac \"elim_map G (ESplitItem_elim (S2 ! Suc i)) (ESplitItem_elim_prods (S1 ! Suc i)) (map (\\x. []) (ESplitItem_elim_prods (S1 ! Suc i)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2)(*strict*)\n apply(erule exE)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 d)(*strict*)\n apply(rename_tac delim)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"delim\"\n and ?d2.0=\"pd1\"\n in cfgLMMIP_and_cfgLM_trans_der_append)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"(S1 @ S1') ! length v = S1!length v\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"ESplitItem_prods (S1 ! length v)\\[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_gen G ((S1@S1') ! (length v))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d)(*strict*)\n prefer 2\n apply(rule cfgLM.trans_der_equal_conf_if_empty_prods)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_from (S1 ! length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(case_tac \"Suc(Suc i)\\length v\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v))) \\ []\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc (Suc i)\"\n and m=\"length v\"\n in nat_seq_drop_last2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim w)(*strict*)\n apply(rule_tac\n v=\"w\"\n and n=\"length v\"\n in foldl_map_not_empty_by_last)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(subgoal_tac \"length v= Suc i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(thin_tac \"cfgLMMIP G pd1 (teA Y1 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)))) (ESplitItem_prods (S1 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) (liftB (foldl (@) [] (drop (Suc i) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v)))) @ tl (ESplitItem_to ((S1 @ S1') ! length v)) @ butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd1 pd2 Y1 Y2 delim d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim d)(*strict*)\n apply(rename_tac pd1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"delim\"\n and ?d2.0=\"pd2\"\n in cfgLMMIP_and_cfgLM_trans_der_append)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"(S2 @ S2') ! length v = S2!length v\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"ESplitItem_prods (S2 ! length v)\\[]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(subgoal_tac \"EValidSplitItem_gen G ((S2@S2') ! (length v))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d)(*strict*)\n prefer 2\n apply(rule cfgLM.trans_der_equal_conf_if_empty_prods)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_from (S2 ! length v)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(case_tac \"Suc(Suc i)\\length v\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v))) \\ []\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"Suc (Suc i)\"\n and m=\"length v\"\n in nat_seq_drop_last2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 w)(*strict*)\n apply(rule_tac\n v=\"w\"\n and n=\"length v\"\n in foldl_map_not_empty_by_last)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(subgoal_tac \"length v= Suc i\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(thin_tac \"cfgLMMIP G pd2 (teA Y2 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)))) (ESplitItem_prods (S2 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) (liftB (foldl (@) [] (drop (Suc i) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L pd2 Y1 Y2 delim pd1 d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L Y1 Y2 delim pd1 d)(*strict*)\n apply(rename_tac pd2)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L Y1 Y2 delim pd1 pd2)(*strict*)\n apply(rule_tac\n xs=\"restrict_newto S1 i\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L Y1 Y2 delim pd1 pd2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L Y1 Y2 delim pd1 pd2 ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac nts ntL)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx1L bx2 bx2L Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply (simp add:liftA_commutes_over_concat)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(subgoal_tac \"restrict_newignore S1 (Suc i) = PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(subgoal_tac \"restrict_newignore S2 (Suc i) = PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(subgoal_tac \"restrict_newignore S1 (Suc i) = restrict_newignore S2 (Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"restrict_newignore S1 (Suc i)\"\n and s=\"PSplitItem_ignore (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S2 (Suc i)\"\n and s=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(rule_tac\n xs=\" (ESplitItem_elim (S2 ! Suc i)) @ Y1 # (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)))\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n prefer 2\n apply(rule_tac\n \\'=\"[]\"\n and w=\"ys\"\n and A=\"y\"\n and d=\"pd1\"\n and \\=\"foldl (@) [] (drop (Suc i) (take (length v) fw))\"\n and b=\"b\"\n and v=\" (fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v))))) @ (tl (ESplitItem_to ((S1 @ S1') ! length v))) @ (butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc i)))\"\n in cfgLMMIP_decompose_into_trans_der_and_cfgLMMIP)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(rule_tac\n t=\"liftB [] @ liftA (ys @ [y])\"\n and s=\"liftA (ESplitItem_elim (S2 ! Suc i)) @ teA Y1 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(rule_tac\n t=\"ys@[y]\"\n and s=\"ESplitItem_elim (S2 ! Suc i) @ Y1 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @Y1 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)) = ys @ [y]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply (simp add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply (simp add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys y \\1 \\2 \\1 \\2 d1a d2a)(*strict*)\n apply(rename_tac ys1 y1 \\11 \\12 \\11 \\12 d11a d12a)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a)(*strict*)\n apply(erule conjE)+\n apply(thin_tac \"cfgLMMIP G d12a [teA y1] \\12 (liftB (\\12 @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v)))) @ tl (ESplitItem_to ((S1 @ S1') ! length v)) @ butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a)(*strict*)\n apply(thin_tac \"cfgLMMIP G pd1 (liftA (ESplitItem_elim (S2 ! Suc i)) @ teA Y1 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)))) (foldl (@) [] (ESplitItem_elim_prods (S1 ! Suc i)) @ ESplitItem_prods (S1 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) (liftB (foldl (@) [] (drop (Suc i) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S1 @ S1') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S1 @ S1') ! length v))))) @ liftA (tl (ESplitItem_to ((S1 @ S1') ! length v))) @ liftA (butn (restrict_toberemoved S1 ! length v) (length (restrict_toberemoved S1 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a)(*strict*)\n apply(rule_tac\n xs=\" (ESplitItem_elim (S2 ! Suc i)) @ Y2 # (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)))\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n prefer 2\n apply(rule_tac\n \\'=\"[]\"\n and w=\"ys\"\n and A=\"y\"\n and d=\"pd2\"\n and \\=\"foldl (@) [] (drop (Suc i) (take (length v) fw))\"\n and b=\"b\"\n and v=\" (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v))))) @ (tl (ESplitItem_to ((S2 @ S2') ! length v))) @ (butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc i)))\"\n in cfgLMMIP_decompose_into_trans_der_and_cfgLMMIP)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(rule_tac\n t=\"liftB [] @ liftA (ys @ [y])\"\n and s=\"liftA (ESplitItem_elim (S2 ! Suc i)) @ teA Y2 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(rule_tac\n t=\"ys@[y]\"\n and s=\"ESplitItem_elim (S2 ! Suc i) @ Y2 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @ Y2 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)) = ys @ [y]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply (simp add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply (simp add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys y \\1 \\2 \\1 \\2 d1a d2a)(*strict*)\n apply(rename_tac ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(erule conjE)+\n apply(thin_tac \"cfgLMMIP G d22a [teA y2] \\22 (liftB (\\22 @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v)))) @ tl (ESplitItem_to ((S2 @ S2') ! length v)) @ butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(thin_tac \"cfgLMMIP G pd2 (liftA (ESplitItem_elim (S2 ! Suc i)) @ teA Y2 # liftA (take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)))) (foldl (@) [] (ESplitItem_elim_prods (S1 ! Suc i)) @ ESplitItem_prods (S2 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))) (liftB (foldl (@) [] (drop (Suc i) (take (length v) fw)) @ [b])) (liftA (fillOptL (PSplitItem_to (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! length v)) (last_back_state_if_l3_nonterminal (take (Suc 0) (ESplitItem_to ((S2 @ S2') ! length v))))) @ liftA (tl (ESplitItem_to ((S2 @ S2') ! length v))) @ liftA (butn (restrict_toberemoved S2 ! length v) (length (restrict_toberemoved S2 ! Suc i))))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(subgoal_tac \"prefix nts ys1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n prefer 2\n apply(rule_tac\n A=\"ntL\"\n and B=\"y1\"\n in butlast_preserves_prefix_1)\n apply(rule_tac\n t=\"nts @ [ntL]\"\n and s=\"ESplitItem_elim (S1 ! Suc i) @ hd (cropTol3l2 (Y1 # restrict_newignore S1 (Suc i))) # restrict_newignore S1 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n t=\"ys1@[y1]\"\n and s=\"ESplitItem_elim (S2 ! Suc i) @ Y1 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule prefix_butlast_drop)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i)\"\n and s=\"restrict_newignore S1 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n xs=\"restrict_newignore S1 (Suc i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 delim y1 \\11 \\12 \\11 \\12 d11a y2 \\21 \\22 \\21 \\22 d21a)(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"butlast (hd (cropTol3l2 (Y1 # restrict_newignore S1 (Suc i))) # restrict_newignore S1 (Suc i))\"\n and s=\"Y1#ys\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S1 (Suc i)\"\n and s=\"ys@[y]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(thin_tac \"restrict_newignore S1 (Suc i) = ys @ [y]\")\n apply(rule_tac\n t=\"butlast SSX\" for SSX\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n w=\"hd (cropTol3l2 (Y1 # ys @ [y])) # ys\"\n in butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S1 (Suc i)\"\n and s=\"ys@[y]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1\"\n and x=\"Suc i\"\n in restrict_newignore_prefix_of_ESplitItem_ignore_butlast)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1\"\n and i=\"Suc i\"\n in restrict_newignore_shorter_than_ESplitItem_ignore)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_ignore (S1 ! Suc i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(subgoal_tac \"prefix ys ysa\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"ys\"\n and s=\"butlast(ys@[y])\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ysa\"\n and s=\"butlast(ysa@[ya])\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ys@[y]\"\n and s=\"restrict_newignore S1 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ysa@[ya]\"\n and s=\"ESplitItem_ignore (S1 ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(subgoal_tac \"\\w. ys@w=ysa\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_ignore (S1 ! Suc i)\"\n and s=\"ys@w@[ya]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(case_tac w)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(rule_tac\n t=\"w\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a ys2 y2 \\21 \\22 \\21 \\22 d21a ys y ysa ya w)(*strict*)\n apply(simp (no_asm) add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(rule_tac\n t=\"w\"\n and s=\"a#list\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a ys2 y2 \\21 \\22 \\21 \\22 d21a ys y ysa ya w a list)(*strict*)\n apply(simp (no_asm) add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(subgoal_tac \"prefix nts ys2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n prefer 2\n apply(rule_tac\n A=\"ntL\"\n and B=\"y2\"\n in butlast_preserves_prefix_1)\n apply(rule_tac\n t=\"nts @ [ntL]\"\n and s=\"ESplitItem_elim (S2 ! Suc i) @ hd (cropTol3l2 (Y2 # restrict_newignore S2 (Suc i))) # restrict_newignore S2 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n t=\"ys2@[y2]\"\n and s=\"ESplitItem_elim (S2 ! Suc i) @ Y2 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i))\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule prefix_butlast_drop)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n t=\"PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S2)) ! Suc i)\"\n and s=\"restrict_newignore S2 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(rule_tac\n xs=\"restrict_newignore S2 (Suc i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 delim y1 \\11 \\12 \\11 \\12 d11a y2 \\21 \\22 \\21 \\22 d21a)(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"butlast (hd (cropTol3l2 (Y2 # restrict_newignore S2 (Suc i))) # restrict_newignore S2 (Suc i))\"\n and s=\"Y2#ys\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S2 (Suc i)\"\n and s=\"ys@[y]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(thin_tac \"restrict_newignore S2 (Suc i) = ys @ [y]\")\n apply(rule_tac\n t=\"butlast SSX\" for SSX\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n w=\"hd (cropTol3l2 (Y2 # ys @ [y])) # ys\"\n in butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(simp add: cropTol3l2_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n t=\"restrict_newignore S2 (Suc i)\"\n and s=\"ys@[y]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2\"\n and x=\"Suc i\"\n in restrict_newignore_prefix_of_ESplitItem_ignore_butlast)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2\"\n and i=\"Suc i\"\n in restrict_newignore_shorter_than_ESplitItem_ignore)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(rule_tac\n xs=\"ESplitItem_ignore (S2 ! Suc i)\"\n in rev_cases)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(subgoal_tac \"prefix ys ysa\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"ys\"\n and s=\"butlast(ys@[y])\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ysa\"\n and s=\"butlast(ysa@[ya])\"\n in subst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ys@[y]\"\n and s=\"restrict_newignore S2 (Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(rule_tac\n t=\"ysa@[ya]\"\n and s=\"ESplitItem_ignore (S2 ! Suc i)\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(subgoal_tac \"\\w. ys@w=ysa\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(rule_tac\n t=\"ESplitItem_ignore (S2 ! Suc i)\"\n and s=\"ys@w@[ya]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(case_tac w)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(rule_tac\n t=\"w\"\n and s=\"[]\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a ys2 y2 \\21 \\22 \\21 \\22 d21a ys y ysa ya w)(*strict*)\n apply(simp (no_asm) add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(rule_tac\n t=\"w\"\n and s=\"a#list\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys y ysa ya w a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a ys2 y2 \\21 \\22 \\21 \\22 d21a ys y ysa ya w a list)(*strict*)\n apply(simp (no_asm) add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(subgoal_tac \"\\ys1'. nts@ys1'=ys1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(subgoal_tac \"\\ys2'. nts@ys2'=ys2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n prefer 2\n apply(simp add: prefix_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d11a\"\n and ?w1.0=\"liftA nts\"\n and ?w2.0=\"liftA ys1'\"\n in cfgLM_trans_der_cfgLM_derivation_can_be_decomposed)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(rule_tac\n t=\"liftA nts @ liftA ys1'\"\n and s=\"liftA ys1\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(rule_tac\n t=\"ys1\"\n and s=\"nts@ys1'\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply (simp (no_asm) add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2')(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1a d2a \\1 \\2 \\1 \\2)(*strict*)\n apply(erule conjE)+\n apply(rename_tac d1c d1d \\1c \\1d \\1c \\1d)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d1d \\cfg_conf = liftA ys1'\\ \\1d \\cfg_conf = liftB \\1d\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d11a \\cfg_conf = liftA ys1\\ \\11 \\cfg_conf = liftB \\11\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d21a\"\n and ?w1.0=\"liftA nts\"\n and ?w2.0=\"liftA ys2'\"\n in cfgLM_trans_der_cfgLM_derivation_can_be_decomposed)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(rule_tac\n t=\"liftA nts @ liftA ys2'\"\n and s=\"liftA ys2\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(rule_tac\n t=\"ys2\"\n and s=\"nts@ys2'\"\n in ssubst)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply (simp (no_asm) add:liftA_commutes_over_concat)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d d1a d2a \\1 \\2 \\1 \\2)(*strict*)\n apply(erule conjE)+\n apply(rename_tac d2c d2d \\2c \\2d \\2c \\2d)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d d2c d2d \\2c \\2d \\2c \\2d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d2d \\cfg_conf = liftA ys2'\\ \\2d \\cfg_conf = liftB \\2d\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d d2c d2d \\2c \\2d \\2c \\2d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d21a \\cfg_conf = liftA ys2\\ \\21 \\cfg_conf = liftB \\21\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim pd1 pd2 nts ntL ys1 y1 \\11 \\12 \\11 \\12 d11a d12a ys2 y2 \\21 \\22 \\21 \\22 d21a d22a ys1' ys2' d1c d1d \\1c \\1d \\1c \\1d d2c d2d \\2c \\2d \\2c \\2d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n apply(thin_tac \"nts \\ (nts @ ys1')\")\n apply(thin_tac \"nts \\ (nts @ ys2')\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n apply(subgoal_tac \"suffix (liftA nts) bx1\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n prefer 2\n apply(simp add: suffix_def)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(case_tac v1)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a list)(*strict*)\n apply(rule_tac\n x=\"liftA list\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ba)(*strict*)\n apply(rule_tac\n x=\"liftA v1\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n apply(subgoal_tac \"suffix (liftA nts) bx2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n prefer 2\n apply(thin_tac \"suffix (liftA nts) bx1\")\n apply(simp add: suffix_def)\n apply(case_tac X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(case_tac v2)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d a list)(*strict*)\n apply(rule_tac\n x=\"liftA list\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ba)(*strict*)\n apply(rule_tac\n x=\"liftA v2\"\n in exI)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ca cb)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d2c \\cfg_conf = ca @ bx1\\ \\2c \\cfg_conf = liftB \\2c\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ca cb)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ca cb)(*strict*)\n prefer 2\n apply(rule liftA_append)\n apply(rule sym)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx1 bx2 Y1 Y2 delim nts ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d d2c \\2c \\2d \\2c \\2d ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n apply(thin_tac \"liftA (l1 @ l2) = liftA l1 @ liftA l2\")\n apply(subgoal_tac \"bx2=liftA l2\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n prefer 2\n apply (rule equal_split_prefix_hlp1_hlp1)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n apply (metis liftA_preserves_length)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 bx2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d cb l1 l2)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d1c\"\n and ?w1.0=\"liftA l1\"\n and ?w2.0=\"liftA l2\"\n in cfgLM_trans_der_cfgLM_derivation_can_be_decomposed)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d1a d2a \\1 \\2 \\1 \\2)(*strict*)\n apply(erule conjE)+\n apply(rename_tac d3c d3d \\3c \\3d \\3c \\3d)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d3d \\cfg_conf = liftA l2\\ \\3d \\cfg_conf = liftB \\3d\\ \")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d1c \\cfg_conf = liftA l1 @ liftA l2\\ \\1c \\cfg_conf = liftB \\1c\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n prefer 2\n apply(rule_tac\n w=\"[X]\"\n and G=\"G\"\n in trans_der_construct_elimininating_derivation_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(simp add: F2LR1inputx_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c \\3c \\3d \\3c \\3d)(*strict*)\n apply (metis reachable_and_eliminiable_implies_eliminable2 reachable_and_eliminiable_implies_reachable)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(subgoal_tac \"\\cfg_conf = X # liftA (ESplitItem_to (S1 ! i))\\ \\ cfg_configurations G\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n prefer 2\n apply(rule cfgLM.trans_der_belongs_configurations2)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(simp add: cfg_configurations_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d d \\ va)(*strict*)\n apply(rename_tac dX \\X vX)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and ?d1.0=\"dX\"\n and ?d2.0=\"d3c\"\n in cfgLM_trans_der_biextend_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX)(*strict*)\n apply(erule exE)+\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3d \\3c \\3d \\3c \\3d dX \\X vX d)(*strict*)\n apply(rename_tac d3d)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3da \\3c \\3d \\3c \\3d dX \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dX \\cfg_conf = [X]\\ \\X \\cfg_conf = liftB vX\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3da \\3c \\3d \\3c \\3d dX \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G d3c \\cfg_conf = liftA l1\\ \\3c \\cfg_conf = liftB \\3c\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' d1c \\1c \\1d \\1c \\1d \\2c \\2d \\2c \\2d l1 l2 d3c d3da \\3c \\3d \\3c \\3d dX \\X vX d3d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G delim \\cfg_conf = liftA (ESplitItem_elim (S2 ! Suc i))\\ (foldl (@) [] (ESplitItem_elim_prods (S1 ! Suc i))) \\cfg_conf = []\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"\\3c @ \\3d @ \\1d @ \\12 = foldl (@) [] (drop (Suc i) (take (length v) fw))\")\n apply(thin_tac \"\\2c @ \\2d @ \\22 = foldl (@) [] (drop (Suc i) (take (length v) fw))\")\n apply(thin_tac \"\\2c @ \\2d @ \\22 = foldl (@) [] (ESplitItem_elim_prods (S1 ! Suc i)) @ ESplitItem_prods (S2 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S2 @ S2') ! x)) @ ESplitItem_prods ((S2 @ S2') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @ Y2 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S2 ! Suc i)) = l1 @ l2 @ ys2' @ [y2]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"restrict_newignore S2 (Suc i) = PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"restrict_newignore S1 (Suc i) = PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @ Y1 # take (length (PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) (ESplitItem_ignore (S1 ! Suc i)) = l1 @ l2 @ ys1' @ [y1]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @ hd (cropTol3l2 (Y2 # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) = l1 @ l2 @ [ntL]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"ESplitItem_elim (S2 ! Suc i) @ hd (cropTol3l2 (Y1 # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i))) # PSplitItem_ignore (restrict G' G (S2 @ S2') (length (Esplit_signature S1)) ! Suc i) = l1 @ l2 @ [ntL]\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"\\3c @ \\3d @ \\1d @ \\12 = foldl (@) [] (ESplitItem_elim_prods (S1 ! Suc i)) @ ESplitItem_prods (S1 ! Suc i) @ \\s ! Suc i @ foldl (@) [] (map (\\x. foldl (@) [] (ESplitItem_elim_prods ((S1 @ S1') ! x)) @ ESplitItem_prods ((S1 @ S1') ! x) @ \\s ! x) (nat_seq (Suc (Suc i)) (length v)))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"only_l3_nonterminals (cons_l3 q c q1 # x1)\")\n apply(thin_tac \"only_l3_nonterminals (cons_l3 q c q2 # x2)\")\n apply(thin_tac \"ESplitItem_from (S1 ! Suc i) = Some Y1\")\n apply(thin_tac \"ESplitItem_from (S2 ! Suc i) = Some Y2\")\n apply(thin_tac \"realizable G (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) = \\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"realizable G (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) = \\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"(\\b. teB b = X) \\ (\\ia X)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"(\\A. teA A = X) \\ left_degen G dx1 \\ ESplitItem_elim_prods (S1 ! i) = []\")\n apply(thin_tac \"cfgLMTDL G ds (Esplit_signature S1) \\s fw\")\n apply(thin_tac \"(\\b. teB b = X) \\ (\\ia X)\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"(\\A. teA A = X) \\ left_degen G dx2 \\ ESplitItem_elim_prods (S2 ! i) = []\")\n apply(thin_tac \"cfgLM.trans_der G dy2 \\cfg_conf = teA (cons_l3 q c q2) # liftA x2 @ [teA x2L]\\ (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) \\cfg_conf = X # liftA (ESplitItem_to (S2 ! i))\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dy1 \\cfg_conf = teA (cons_l3 q c q1) # liftA x1 @ [teA x1L]\\ (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) \\cfg_conf = X # liftA (ESplitItem_to (S1 ! i))\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dx1 \\cfg_conf = [teA F1]\\ (ESplitItem_prods (S1 ! i)) \\cfg_conf = X # liftA (ESplitItem_to (S1 ! i))\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dx2 \\cfg_conf = [teA F2]\\ (ESplitItem_prods (S2 ! i)) \\cfg_conf = X # liftA (ESplitItem_to (S2 ! i))\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"dx1 ia = Some (pair ex1 \\cfg_conf = teA (cons_l3 q c q1) # liftA x1 @ [teA x1L]\\)\")\n apply(thin_tac \"dx2 ia = Some (pair ex2 \\cfg_conf = teA (cons_l3 q c q2) # liftA x2 @ [teA x2L]\\)\")\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n prefer 2\n apply(rule_tac\n ?v1.0=\"[]\"\n and ?v4.0=\"[]\"\n and G=\"G\"\n and ?d1.0=\"dz1\"\n and ?d2.0=\"d3d\"\n in cfgLM_trans_der_concat_extend_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n prefer 2\n apply(rule_tac\n ?v1.0=\"[]\"\n and ?v4.0=\"[]\"\n and G=\"G\"\n and ?d1.0=\"dz2\"\n and ?d2.0=\"d3d\"\n in cfgLM_trans_der_concat_extend_prime)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(force)\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dz1 \\cfg_conf = [teA (cons_l3 q c q1)]\\ (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i))) \\cfg_conf = X # liftA l1\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(thin_tac \"cfgLM.trans_der G dz2 \\cfg_conf = [teA (cons_l3 q c q2)]\\ (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) \\cfg_conf = X # liftA l1\\\")\n apply(rename_tac ds \\s fw ia X F1 F2 dx1 dx2 ex1 dy1 ex2 dy2 dz1 dz2 \\ v1 v2 x1 x1L x2 x2L r1 r2 q q1 c q2 Y1 Y2 delim ntL y1 \\12 \\12 y2 \\22 \\22 ys1' ys2' \\1d \\1d \\2c \\2d \\2c \\2d l1 l2 \\3c \\3d \\3c \\3d \\X vX d3d)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d da)(*strict*)\n apply(rename_tac d1x d2x)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n prefer 2\n apply(rule_tac\n \\1'=\"[]\"\n and \\2'=\"[]\"\n and ?\\1.0=\"vX@\\3c\"\n and ?\\2.0=\"vX@\\3c\"\n and G=\"G\"\n and G'=\"G'\"\n and ?d1.0=\"d1x\"\n and ?d2.0=\"d2x\"\n in compatible_derivations_coincide_heavily)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (simp add: liftB_commutes_over_concat)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (simp add: liftB_commutes_over_concat)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(subgoal_tac \"map (prod_to_edge G') (\\prod_lhs = cons_l3 q c q1, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i)))= map (prod_to_edge G') (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) \")\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (metis drop_map)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q q1 c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(clarsimp)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n prefer 2\n apply(rule_tac\n \\=\"vX@\\3c\"\n and G=\"G\"\n and G'=\"G'\"\n and ?d1.0=\"d1x\"\n and ?d2.0=\"d2x\"\n in same_l3_source_and_same_target_liftB_and_same_prod_to_edge_implies_equal_prods)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(assumption)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(assumption)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (simp add: liftB_commutes_over_concat)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (simp add: liftB_commutes_over_concat)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n prefer 3\n apply(subgoal_tac \"map (prod_to_edge G') (\\prod_lhs = cons_l3 q c q2, prod_rhs = r1\\ # drop (Suc ia) (ESplitItem_prods (S1 ! i)))= map (prod_to_edge G') (\\prod_lhs = cons_l3 q c q2, prod_rhs = r2\\ # drop (Suc ia) (ESplitItem_prods (S2 ! i))) \")\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply (metis drop_map)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(rule trans_der_notfinishingL_froml3_ext)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(force)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(rule trans_der_notfinishingL_froml3_ext)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(assumption)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(assumption)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(assumption)\n apply(rename_tac ia X F1 F2 \\ v1 v2 r1 r2 q c q2 ntL l1 l2 \\3c \\3c \\X vX d3d d1x d2x)(*strict*)\n apply(clarsimp)\n done\n\ntheorem equal_split_prefix: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ cfgRM.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf=v@[teB b]@x1\\)\n \\ cfgRM.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf=v@[teB b]@x2\\)\n \\ EValidSplit G (S1@S1')\n \\ EValidSplit G (S2@S2')\n \\ length S1 = length (v@[teB b])\n \\ length S2 = length (v@[teB b])\n \\ v@[teB b] = Esplit_signature S1\n \\ v@[teB b] = Esplit_signature S2\n \\ x1 = Esplit_signature S1'\n \\ x2 = Esplit_signature S2'\n \\ S1R=restrict G' G (S1@S1') (length (v@[teB b]))\n \\ S2R=restrict G' G (S2@S2') (length (v@[teB b]))\n \\ S1R = S2R\"\n apply(subgoal_tac \"ESplitItem_elem ((S1 @ S1') ! length v) = Some (teB b)\")\n prefer 2\n apply(rule equal_split_prefix_hlp2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"PValidSplit G' G S1R\")\n prefer 2\n apply(rule equal_split_prefix_hlp3)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"ESplitItem_elem ((S2 @ S2') ! length v) = Some (teB b)\")\n prefer 2\n apply(rule_tac\n ?d1.0=\"d2\"\n in equal_split_prefix_hlp2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(subgoal_tac \"PValidSplit G' G S2R\")\n prefer 2\n apply(rule_tac\n ?S1.0=\"S2\"\n and ?d1.0=\"d2\"\n in equal_split_prefix_hlp3)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(rule listEqI)\n apply(clarsimp)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(rule impI)\n apply(subgoal_tac \"length (Esplit_signature S1) = length S1\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis length_Suc)\n apply(rename_tac i)(*strict*)\n apply(subgoal_tac \"length (v@[teB b]) = length S1\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis length_Suc)\n apply(rename_tac i)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n and S1'=\"S1'\"\n and S2'=\"S2'\"\n and ?S1.0=\"S1\"\n and ?S2.0=\"S2\"\n in equal_split_prefix_hlp1)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n defer\n defer\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(rule_tac\n t=\"length (v @ [teB b])\"\n and s=\"length S1R\"\n in ssubst)\n apply(rename_tac i)(*strict*)\n apply(rule_tac\n t=\"S1R\"\n and s=\"restrict G' G (S1 @ S1') (length (v @ [teB b]))\"\n in ssubst)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length S1\"\n and s=\"Suc (length v)\"\n in ssubst)\n apply(rename_tac i)(*strict*)\n apply (metis length_Suc)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (length v)) =SSX\" for SSX)\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"S1'\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(rename_tac i a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"EValidSplit G (S2 @ S2')\")\n apply(simp add: EValidSplit_def EValidSplit_final_def)\n apply(clarsimp)\n apply(subgoal_tac \"last S1 = S1!length v\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis last_nth3 length_Suc)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: EValidSplit_ValidItem_def)\n apply(erule_tac\n x=\"S1!length v\"\n in ballE)\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis last_in_set)\n apply(rename_tac i)(*strict*)\n apply(simp add: EValidSplitItem_def)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_from (S1 ! length v)\")\n apply(rename_tac i)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac i d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"SSrenPI=[] \\ SSc2=\\cfg_conf=[]\\\" for SSrenPI SSc2)\n apply(rename_tac i d)(*strict*)\n prefer 2\n apply(rule_tac cfgLM_trans_der_from_empty)\n apply(force)\n apply(rename_tac i d)(*strict*)\n apply(clarsimp)\n apply(rename_tac i a)(*strict*)\n apply(rule_tac\n b=\"b\"\n and S=\"S1!length v\"\n and G=\"G\"\n and G'=\"G'\"\n in EValidSplit_DERIVED_terminal_produce_produces_to)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"S2'\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(rename_tac i a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"EValidSplit G (S1 @ S1')\")\n apply(simp add: EValidSplit_def EValidSplit_final_def)\n apply(clarsimp)\n apply(subgoal_tac \"last S2 = S2!length v\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis last_nth3 length_Suc)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: EValidSplit_ValidItem_def)\n apply(erule_tac\n x=\"S2!length v\"\n in ballE)\n apply(rename_tac i)(*strict*)\n prefer 2\n apply (metis last_in_set)\n apply(rename_tac i)(*strict*)\n apply(simp add: EValidSplitItem_def)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_from (S2 ! length v)\")\n apply(rename_tac i)(*strict*)\n apply(simp add: EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac i d)(*strict*)\n apply(simp add: option_to_list_def)\n apply(subgoal_tac \"SSrenPI=[] \\ SSc2=\\cfg_conf=[]\\\" for SSrenPI SSc2)\n apply(rename_tac i d)(*strict*)\n prefer 2\n apply(rule_tac cfgLM_trans_der_from_empty)\n apply(force)\n apply(rename_tac i d)(*strict*)\n apply(clarsimp)\n apply(rename_tac i a)(*strict*)\n apply(rule_tac\n b=\"b\"\n and S=\"S2!length v\"\n and G=\"G\"\n and G'=\"G'\"\n in EValidSplit_DERIVED_terminal_produce_produces_to)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n done\n\nhide_fact equal_split_prefix_hlp1\nhide_fact equal_split_prefix_hlp1_updated\nhide_fact equal_split_prefix_updated\nhide_fact restrictX_length\n (* important equal_split_prefix *)\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_06_10/LR1_Property_Satisfaction__convert_remaining_productions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.26714158154106915}} {"text": "theory flash69Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n have allCases:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s \\formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak2VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak3VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_PutX1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak2VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak3VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put2VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Nak_ClearVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Nak_HomeVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iRule2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iRule2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_GetX )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_GetX )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) \n ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) \n ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iRule2)) ) ) \" in exI,auto)\n \n \n done\n \n\n \n \n \n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iRule2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iRule2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_Get )) \n ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iRule2)) ) ) \" in exI,auto)\n \n \n \n done\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv69: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_GetXVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_PutXVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv69: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv69: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv69 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash69Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.26714158154106915}} {"text": "theory Proof_2_4\n imports Requirements VCTheoryLemmas\nbegin\n\ntheorem proof_2_4: \"VC4 inv2 s0 requestButtonValue\"\n apply(simp only: VC4_def inv2_def R2_def extraInv_def)\nproof\n print_state\n assume \" ((toEnvP s0 \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED)) \\\n toEnvP s0 \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ T2) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)) \\\n env (setVarAny s0 requestButtonValue) requestButtonValue \\\n getPstate (setVarAny s0 requestButtonValue) Ctrl = minimalRed \\\n \\ getVarBool (setVarAny s0 requestButtonValue) Ctrl \\\n MINIMAL_RED_TIME_LIMIT \\ ltimeEnv (setVarAny s0 requestButtonValue) Ctrl\"\n then obtain reqs0: \"(toEnvP s0 \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED))\" \nand ei0: \"toEnvP s0\"\nand ei1: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \" \nand ei2: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n ((\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\ s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed))) \"\nand ei3: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s1 Ctrl = minimalRed) \"\nand ei4: \"\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed ) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl\" \nand ei5: \"\\ s1 . toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\\n getVarBool s1 requestButtonPressed = False \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed \\ ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\ngetVarBool s2 requestButtonPressed = False \\ (\\ s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\ \ngetVarBool s3 requestButtonPressed = False \\ getVarBool s3 requestButton = NOT_PRESSED))\"\nand ei6: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n0< ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \"\nand ei7: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = redAfterMinimalRed \\ \n(getVarBool s2 requestButtonPressed = True \\ getVarBool s2 requestButton = PRESSED)))\"\nand ei8: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ getPstate s1 Ctrl = redToGreen) \"\nand ei9: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \"\nand ei10: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT)\"\nand ei11: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\ngetPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \"\nand ei12: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\\ntoEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s1 Ctrl = green)\"\nand ei13: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ \n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \"\nand ei14: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 trafficLight = GREEN) \"\nand ei15: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 trafficLight = RED) \"\nand ei16: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\ getPstate s1 Ctrl = redAfterMinimalRed \\\n getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green)\"\nand ei17: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - 1 \\ getPstate s2 Ctrl = minimalRed \\\n getVarBool s2 requestButtonPressed = False \\ getVarBool s1 requestButton = NOT_PRESSED)\"\nand ei18: \"(\\ s2. toEnvP s2 \\ substate s2 s0 \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 requestButtonPressed = True \\\n(\\ s1. toEnvP s1 \\ substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - 1 \\ getVarBool s1 requestButton = PRESSED))\"\nand ei19: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 requestButtonPressed \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = 1 \\ getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 requestButtonPressed \\ getVarBool s1 requestButton = PRESSED)))\"\nand ei20: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 requestButtonPressed = False)\"\nand vc: \" env (setVarAny s0 requestButtonValue) requestButtonValue \\\n getPstate (setVarAny s0 requestButtonValue) Ctrl = minimalRed \\\n \\ getVarBool (setVarAny s0 requestButtonValue) Ctrl \\\n MINIMAL_RED_TIME_LIMIT \\ ltimeEnv (setVarAny s0 requestButtonValue) Ctrl\"\n by fast\n show \" (toEnvP (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED)) \\\n toEnvP (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ T2) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl \\ green \\\n getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\\n substate s2 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)\"\n apply(rule conjI)\n apply(rule conjI)\n apply(simp)\n proof(rule allI; rule allI; rule allI)\n fix s1 s2 s3\n show \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 1: \"s3 = (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n from ei2 ei0 vc substate_refl have \" ((\\ s2. toEnvP s2 \\ substate s2 s0\n \\ toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\\n getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\ s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed))\"\n by auto\n thus ?thesis\n proof\n assume \"\\s2. toEnvP s2 \\\n substate s2 s0 \\ toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2\"\n then obtain g where 2: \"toEnvP g \\\n substate g s0 \\ toEnvNum g s0 = ltimeEnv s0 Ctrl \\ getPstate g Ctrl = green \\ ltimeEnv g Ctrl = T2\" ..\n show ?thesis\n proof cases\n assume 4: \"substate s2 g\" \n from ei11 2 have \"(\\ s2. toEnvP s2 \\ substate s2 g \\ toEnvNum s2 g = ltimeEnv g Ctrl \\\ngetPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)\" by blast\n then obtain rg where 3: \" toEnvP rg \\ substate rg g \\ toEnvNum rg g = ltimeEnv g Ctrl \\\ngetPstate rg Ctrl = redToGreen \\ ltimeEnv rg Ctrl = RED_TO_GREEN_TIME_LIMIT\" ..\n show ?thesis\n proof cases\n assume 5: \"substate s2 rg\"\n from ei0 have \"0 < ltimeEnv s0 Ctrl\" by ((cases s0); auto)\n with 2 3 toEnvNum3[of rg g s0] substate_trans[of rg g s0] have 6: \"toEnvNum rg s0 > T2\"\n by auto\n from 2 3 substate_trans have \"substate rg s0\" by blast\n with 5 6 toEnvNum3[of s2 rg s0] substate_trans[of s2 rg s0] have \"toEnvNum s2 s0 > T2\"\n by auto\n with 1 show ?thesis by auto\n next\n assume 5: \"\\ (substate s2 rg)\"\n with 3 4 substate_refl substate_total have 6: \"substate rg s2 \\ rg \\ s2\" by auto\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n show \"getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 8: \"substate s1 rg\"\n from ei0 have \"0 < ltimeEnv s0 Ctrl\" by ((cases s0); auto)\n with 2 3 toEnvNum3[of rg g s0] substate_trans[of rg g s0] have 6: \"toEnvNum rg s0 > T2\"\n by auto\n from 2 3 substate_trans have \"substate rg s0\" by blast\n with 8 6 toEnvNum3 have 9: \"toEnvNum s1 s0 > T2\" by auto\n from 1 7 9 have 10: \"substate s2 s0\" by ((simp split: if_splits); auto)\n with 7 9 toEnvNum3 have \"toEnvNum s2 s0 \\ T2\" by auto\n with 1 10 substate_refl toEnvNum3[of s2 s0 s3] have \"toEnvNum s2 s3 > T2\" by auto\n with 7 show ?thesis by auto\n next \n assume 8: \"\\ substate s1 rg\"\n from 4 7 substate_trans have 9: \"substate s1 g\" by blast\n from 2 4 substate_trans have 10: \"substate s2 s0\" by blast\n with 1 7 substate_refl substate_asym[of s0 s3] have \"toEnvNum s2 s0 + 1 < T2\" by ((simp split: if_splits); auto)\n with 7 10 toEnvNum3 have \"toEnvNum s1 s0 < T2\" by auto\n with 2 9 toEnvNum3 have \"toEnvNum s1 g < ltimeEnv g Ctrl\" by auto\n with 2 7 9 ei12 have \"getPstate s1 Ctrl = green\" by blast\n with ei14 7 show ?thesis using 2 9 substate_trans by blast\n qed\n qed\n qed\n next\n assume 4: \"\\ substate s2 g\"\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n have \"getVarBool s2 minimalRed =NOT_PRESSED\"\n proof cases\n assume 3: \"s2 = (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n from vc have \"getPstate s0 Ctrl \\ green\" by auto\n with ei0 substate_refl ei15 have \"getVarBool s0 trafficLight = RED\" by blast\n with 3 show ?thesis by auto\n next \n assume 3: \"s2 \\ (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n with 1 7 have 5: \"substate s2 s0\" by ((simp split: if_splits); auto)\n from 4 2 5 substate_total substate_refl have 6: \"substate g s2 \\ s2 \\ g\" by blast\n with 2 7 gtimeE_inj have 9: \"toEnvNum emptyState g \\ toEnvNum emptyState s2\" by blast\n from 5 6 toEnvNum3 have \"toEnvNum s2 s0 \\ toEnvNum g s0\" by auto\n from le_imp_less_or_eq[OF this]\n show ?thesis\n proof\n assume \"toEnvNum s2 s0 < toEnvNum g s0\"\n with 2 have 8: \"toEnvNum s2 s0 < ltimeEnv s0 Ctrl\" by auto\n from vc have \"getPstate s0 Ctrl = minimalRed\" by auto\n with ei3 7 ei0 5 substate_refl 8 have \"getPstate s2 Ctrl = minimalRed\" by blast\n with 5 7 ei15 show ?thesis by auto\n next \n assume \"toEnvNum s2 s0 = toEnvNum g s0\"\n with 9 have 10: \"toEnvNum emptyState g +toEnvNum g s0 \\ toEnvNum emptyState s2 +toEnvNum s2 s0\"\n by auto\n from emptyState_substate 5 toEnvNum3 have 11: \"toEnvNum emptyState s0 = toEnvNum emptyState s2 + toEnvNum s2 s0\"\n by auto \n from emptyState_substate 5 6 substate_trans[of g s2 s0] toEnvNum3 \n have \"toEnvNum emptyState s0 = toEnvNum emptyState g + toEnvNum g s0\"\n by auto\n with 10 11 show ?thesis by auto\n qed\n qed\n with 7 show \" getVarBool s3 minimalRed = PRESSED\" by auto\n qed\n qed\n next\n assume 2: \" \\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \"\n show \" \\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 3: \"s2 = (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n from vc have \"getPstate s0 Ctrl \\ green\" by auto\n with ei0 substate_refl ei15 have \"getVarBool s0 trafficLight = RED\" by blast\n with 3 show ?thesis by auto\n next \n assume 3: \"s2 \\ (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n with 1 3 have \"substate s2 s0\" by ((simp split: if_splits); auto)\n with 2 7 ei15 show \" getVarBool s3 minimalRed = PRESSED\" by auto\n qed\n qed\n qed\n next\n assume 1: \" s3 \\\n (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed))\"\n show ?thesis\n proof\n print_state\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setPstate (setVarAny s0 requestButtonValue) Ctrl redAfterMinimalRed)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n with 1 have \"substate s3 s0\" by ((simp split: if_splits); auto)\n with 7 reqs0 show \" getVarBool s3 minimalRed = PRESSED\" by blast\n qed\n qed\n next\n (*prove extraInv*)\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/Proof_2_4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.40356685373537454, "lm_q1q2_score": 0.2671301324222531}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory LemmaBucket_C\nimports\n \"Lib.Lib\"\n \"Word_Lib.WordSetup\"\n TypHeapLib\n \"CParser.ArrayAssertion\"\nbegin\n\ndeclare word_neq_0_conv [simp del]\n\nlemma Ptr_not_null_pointer_not_zero: \"(Ptr p \\ NULL)=(p\\0)\"\n by simp\n\nlemma hrs_mem_f: \"f (hrs_mem s) = hrs_mem (hrs_mem_update f s)\"\n apply (cases s)\n apply (clarsimp simp: hrs_mem_def hrs_mem_update_def)\n done\n\nlemma hrs_mem_heap_update:\n \"heap_update p v (hrs_mem s) = hrs_mem (hrs_mem_update (heap_update p v) s)\"\n apply (rule hrs_mem_f)\n done\n\nlemma addr_card_wb:\n \"addr_card = 2 ^ word_bits\"\n by (simp add: addr_card_def card_word word_bits_conv)\n\nlemma surj_Ptr [simp]:\n \"surj Ptr\"\n by (rule surjI [where f = ptr_val], simp)\n\nlemma inj_Ptr [simp]:\n \"inj Ptr\"\n apply (rule injI)\n apply simp\n done\n\nlemma bij_Ptr :\n \"bij Ptr\"\n by (simp add: bijI)\n\nlemma exec_Guard:\n \"(G \\ \\Guard Err S c, Normal s\\ \\ s')\n = (if s \\ S then G \\ \\c, Normal s\\ \\ s'\n else s' = Fault Err)\"\n by (auto split: if_split elim!: exec_elim_cases intro: exec.intros)\n\nlemma to_bytes_word8:\n \"to_bytes (v :: word8) xs = [v]\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma byte_ptr_guarded:\"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc)\n\nlemma heap_update_list_append:\n fixes v :: word8\n shows \"heap_update_list s (xs @ ys) hp =\n heap_update_list (s + of_nat (length xs)) ys (heap_update_list s xs hp)\"\nproof (induct xs arbitrary: ys rule: rev_induct)\n case Nil\n show ?case by simp\nnext\n case (snoc v' vs')\n show ?case\n apply (simp add: snoc.hyps field_simps)\n apply (rule arg_cong [where f = \"heap_update_list (1 + (s + of_nat (length vs'))) ys\"])\n apply (rule ext)\n apply simp\n done\nqed\n\nlemma intvl_aligned_bottom_eq:\n fixes p :: \"'a::len word\"\n assumes al1: \"is_aligned x n\"\n and al2: \"is_aligned p bits\"\n and nb: \"\\ n < bits\"\n and off: \"off \\ 2 ^ bits\" \"off \\ 0\"\n shows \"(x \\ {p ..+ off}) = (x = p)\"\nproof (rule iffI)\n assume \"x = p\"\n thus \"x \\ {p ..+ off}\" using off\n by (simp add: intvl_self)\nnext\n assume x_in_intvl: \"x \\ {p ..+ off}\"\n\n show \"x = p\"\n proof cases\n assume wb: \"bits < len_of TYPE('a)\"\n\n from x_in_intvl obtain kp where xp: \"x = p + of_nat kp\" and kp: \"kp < off\"\n by (clarsimp dest!: intvlD)\n\n hence \"is_aligned (p + of_nat kp) n\" using al1 by simp\n hence \"2 ^ n dvd unat (p + of_nat kp)\" unfolding is_aligned_def .\n hence \"2 ^ n dvd unat p + kp\" using kp off wb\n apply -\n apply (subst (asm) iffD1 [OF unat_plus_simple])\n apply (rule is_aligned_no_wrap' [OF al2])\n apply (rule of_nat_power)\n apply simp_all[2]\n apply (subst (asm) unat_of_nat)\n apply (subst (asm) mod_less)\n apply (erule order_less_le_trans)\n apply (erule order_trans)\n apply simp\n apply simp\n done\n\n moreover from al2 obtain q2 where pbits: \"p = 2 ^ bits * of_nat q2\"\n and q2: \"q2 < 2 ^ (len_of TYPE('a) - bits)\"\n by (rule is_alignedE)\n\n moreover from nb obtain kn where nbits: \"n = bits + kn\"\n by (clarsimp simp: linorder_not_less le_iff_add)\n\n ultimately have \"2 ^ bits dvd 2 ^ bits * q2 + kp\"\n apply (simp add: power_add)\n apply (simp add: unat_mult_power_lem [OF q2])\n apply (erule dvd_mult_left)\n done\n\n hence \"2 ^ bits dvd kp\" by (simp add: dvd_reduce_multiple)\n with kp have \"kp = 0\"\n apply -\n apply (erule contrapos_pp)\n apply (simp add: linorder_not_less)\n apply (drule (1) dvd_imp_le)\n apply (erule order_trans [OF off(1)])\n done\n\n thus ?thesis using xp by simp\n next\n assume wb: \"\\ bits < len_of TYPE('a)\"\n with assms\n show ?thesis by (simp add: is_aligned_mask mask_def power_overflow)\n qed\nqed\n\nlemma intvl_mem_weaken: \"x \\ {p..+a - n} \\ x \\ {p..+a}\"\n apply -\n apply (drule intvlD)\n apply clarsimp\n apply (rule intvlI)\n apply simp\n done\n\n\nlemma upto_intvl_eq:\n fixes x :: \"'a::len word\"\n assumes al: \"is_aligned x n\"\n shows \"{x..+2 ^ n} = {x .. x + 2 ^ n - 1}\"\nproof cases\n assume \"n < len_of TYPE('a)\"\n with assms show ?thesis\n unfolding intvl_def\n apply simp\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k < (2 :: 'a word) ^ n\")\n apply (intro conjI)\n apply (erule (1) is_aligned_no_wrap')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (simp add: word_less_sub_1)\n apply (simp add: field_simps is_aligned_no_overflow)\n apply (simp add: of_nat_power)\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply clarsimp\n apply (rule unat_less_power, assumption)\n apply (subst word_less_sub_le [symmetric])\n apply assumption\n apply (rule word_diff_ls'(4))\n apply (simp add: field_simps)\n apply assumption\n done\nnext\n assume \"\\ n < len_of TYPE('a)\"\n with assms show ?thesis\n apply (simp add: is_aligned_mask mask_def power_overflow intvl_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rename_tac w)\n apply (case_tac w)\n apply (rename_tac m)\n apply (rule_tac x=m in exI)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n done\nqed\n\nlemma upto_intvl_eq':\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ x + (of_nat b - 1); b \\ 0; b \\ 2 ^ len_of TYPE('a)\\ \\ {x..+b} = {x .. x + of_nat b - 1}\"\n unfolding intvl_def\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k \\ (of_nat (b - 1) :: 'a word)\")\n apply (intro conjI)\n apply (erule word_random)\n apply simp\n apply (subst field_simps [symmetric], rule word_plus_mono_right)\n apply simp\n apply assumption\n apply (subst Word_Lemmas.of_nat_mono_maybe_le [symmetric])\n apply simp\n apply simp\n apply simp\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply simp\n apply (simp add: unat_sub)\n apply (rule nat_diff_less)\n apply (subst (asm) word_le_nat_alt, erule order_le_less_trans)\n apply (subst add_diff_eq[symmetric], subst unat_plus_if')\n apply (simp add: no_olen_add_nat)\n apply (simp add: le_eq_less_or_eq)\n apply (erule disjE)\n apply (subst unat_minus_one)\n apply (erule (1) of_nat_neq_0)\n apply (simp add: unat_of_nat)\n apply (erule ssubst, rule unat_lt2p)\n apply (simp add: word_le_nat_alt)\n done\n\nlemma intvl_aligned_top:\n fixes x :: \"'a::len word\"\n assumes al1: \"is_aligned x n\"\n and al2: \"is_aligned p bits\"\n and nb: \"n \\ bits\"\n and offn: \"off < 2 ^ n\"\n and wb: \"bits < len_of TYPE('a)\"\n shows \"(x \\ {p ..+ 2 ^ bits - off}) = (x \\ {p ..+ 2 ^ bits})\"\nproof (rule iffI)\n assume \"x \\ {p..+2 ^ bits - off}\"\n thus \"x \\ {p..+2 ^ bits}\" by (rule intvl_mem_weaken)\nnext\n assume asm: \"x \\ {p..+2 ^ bits}\"\n\n show \"x \\ {p..+2 ^ bits - off}\"\n proof (cases \"n = 0\")\n case True\n with offn asm show ?thesis by simp\n next\n case False\n\n from asm have \"x \\ {p .. p + 2 ^ bits - 1}\"\n by (simp add: upto_intvl_eq [OF al2])\n then obtain q where xp: \"x = p + of_nat (q * 2 ^ n)\" and qb: \"q < 2 ^ (bits - n)\" using False nb\n by (fastforce dest!: is_aligned_diff[OF al1 al2 wb,simplified field_simps])\n\n have \"q * 2 ^ n < 2 ^ bits - off\"\n proof -\n show ?thesis using offn qb nb\n apply (simp add: less_diff_conv)\n apply (erule (1) nat_add_offset_less)\n apply arith\n done\n qed\n\n with xp show ?thesis\n apply -\n apply (erule ssubst)\n apply (erule intvlI)\n done\n qed\nqed\n\nlemma intvl_nowrap:\n fixes x :: \"'a::len word\"\n shows \"\\y \\ 0; unat y + z \\ 2 ^ len_of TYPE('a)\\ \\ x \\ {x + y ..+ z}\"\n apply clarsimp\n apply (drule intvlD)\n apply clarsimp\n apply (simp add: unat_arith_simps)\n apply (simp split: if_split_asm)\n apply (simp add: unat_of_nat)\n done\n\nlemma heap_update_list_update:\n fixes v :: word8\n shows \"x \\ y \\ heap_update_list s xs (hp(y := v)) x = heap_update_list s xs hp x\"\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp add: heap_update_list_append cong: if_cong)\n done\n\n(* FIXME: generalise *)\nlemma heap_update_list_append2:\n \"length xs + length ys < 2 ^ word_bits \\\n heap_update_list s (xs @ ys) hp\n = heap_update_list s xs (heap_update_list (s + of_nat (length xs)) ys hp)\"\nproof (induct xs arbitrary: hp s)\n case Nil\n show ?case by simp\nnext\n case (Cons v' vs')\n\n have \"(1 :: addr) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"\\ \\ 0\" using Cons.prems\n apply -\n apply (rule of_nat_neq_0)\n apply simp\n apply (simp add: word_bits_conv)\n done\n finally have neq0: \"(1 :: addr) + of_nat (length vs') \\ 0\" .\n\n have \"(1 :: addr) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"unat \\ + length ys < 2 ^ word_bits\" using Cons.prems\n apply (subst unat_of_nat)\n apply (simp add: word_bits_conv)\n done\n finally have lt: \"unat ((1 :: addr) + of_nat (length vs')) + length ys < 2 ^ word_bits\" .\n\n from Cons.prems have \"length vs' + length ys < 2 ^ word_bits\" by simp\n thus ?case\n apply simp\n apply (subst Cons.hyps, assumption)\n apply (rule arg_cong [where f = \"heap_update_list (s + 1) vs'\"])\n apply (rule ext)\n apply (case_tac \"x = s\")\n apply simp\n apply (subst heap_update_nmem_same)\n apply (subst add.assoc)\n apply (rule intvl_nowrap[OF neq0 order_less_imp_le\n [OF lt[unfolded word_bits_def]]])\n apply simp\n apply (clarsimp simp: heap_update_list_update field_simps)\n done\nqed\n\nlemma heap_update_word8:\n \"heap_update p (v :: word8) hp = hp(ptr_val p := v)\"\n unfolding heap_update_def by (simp add: to_bytes_word8)\n\nlemma index_foldr_update2:\n \"\\ n \\ i; i < CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. i < n; n \\ CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\"\n shows \"{a..+b} \\ {c..+d} = {}\"\nproof (rule disjointI, rule notI)\n fix x y\n assume x: \"x \\ {a..+b}\" and y: \"y \\ {c..+d}\" and xy: \"x = y\"\n\n from x obtain kx where \"x = a + of_nat kx\" and kx: \"kx < b\"\n by (clarsimp dest!: intvlD)\n\n moreover from y obtain ky where \"y = c + of_nat ky\" and ky: \"ky < d\"\n by (clarsimp dest!: intvlD)\n\n ultimately have ac: \"a + of_nat kx = c + of_nat ky\" using xy by simp\n\n have \"of_nat kx < (of_nat b :: 'a word)\" using blt kx\n by (rule of_nat_mono_maybe)\n hence \"a + of_nat kx < a + of_nat b\" using alb\n by (rule word_plus_strict_mono_right)\n\n also have \"\\ \\ c\" by (rule abc)\n also have \"\\ \\ c + of_nat ky\" using cld dlt ky\n by - (rule word_random [OF _ iffD1 [OF Word_Lemmas.of_nat_mono_maybe_le]], simp+ )\n finally show False using ac by simp\nqed\n\nlemma intvl_disjoint2:\n fixes a :: \"'a :: len word\"\n assumes abc: \"a + of_nat b \\ c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\"\n shows \"{c..+d} \\ {a..+b} = {}\"\n using abc alb cld blt dlt\n by (subst Int_commute, rule intvl_disjoint1)\n\n\nlemma intvl_off_disj:\n fixes x :: addr\n assumes ylt: \"y \\ off\"\n and zoff: \"z + off < 2 ^ word_bits\"\n shows \"{x ..+ y} \\ {x + of_nat off ..+ z} = {}\"\n using ylt zoff\n apply (cases \"off = 0\")\n apply simp\n apply (rule contrapos_pp [OF TrueI])\n apply (drule intvl_inter)\n apply (erule disjE)\n apply (cut_tac intvl_nowrap [where x = x and y = \"of_nat off :: addr\" and z = z])\n apply simp\n apply (rule of_nat_neq_0)\n apply simp\n apply (unfold word_bits_len_of)\n apply simp\n apply (simp add: unat_of_nat word_bits_conv)\n apply (drule intvlD)\n apply clarsimp\n apply (drule (1) order_less_le_trans)\n apply (drule unat_cong)\n apply (simp add: unat_of_nat word_bits_conv)\n done\n\n\nlemma list_map_comono:\n assumes s: \"list_map m \\\\<^sub>m list_map n\"\n shows \"m \\ n\"\n using s\nproof (induct m arbitrary: n rule: rev_induct)\n case Nil thus ?case unfolding list_map_def by simp\nnext\n case (snoc x xs)\n\n from snoc.prems have\n sm: \"[length xs \\ x] ++ list_map xs \\\\<^sub>m list_map n\"\n unfolding list_map_def by simp\n\n hence xsn: \"xs \\ n\"\n by (rule snoc.hyps [OF map_add_le_mapE])\n\n have \"list_map n (length xs) = Some x\" using sm\n by (simp add: map_le_def list_map_def merge_dom2 set_zip)\n\n hence \"length xs < length n\" and \"x = n ! length xs\"\n by (auto simp add: list_map_eq split: if_split_asm)\n\n thus \"xs @ [x] \\ n\" using xsn\n by (simp add: append_one_prefix less_eq_list_def)\nqed\n\nlemma typ_slice_t_self:\n \"td \\ fst ` set (typ_slice_t td m)\"\n apply (cases td)\n apply (simp split: if_split)\n done\n\nlemma drop_heap_list_le2:\n \"heap_list h n (x + of_nat k)\n = drop k (heap_list h (n + k) x)\"\n by (simp add: drop_heap_list_le)\n\nlemma index_fold_update:\n \"\\ distinct xs; set xs \\ {..< card (UNIV :: 'b set)}; n < card (UNIV :: 'b set) \\ \\\n index (foldr (\\n (arr :: 'a['b :: finite]). Arrays.update arr n (f n (index arr n))) xs v) n\n = (if n \\ set xs then f n (index v n) else index v n)\"\n apply (induct xs)\n apply simp\n apply (rename_tac x xs)\n apply (case_tac \"x = n\"; simp)\n done\n\nlemma heap_update_list_id:\n \"heap_list hp n ptr = xs \\ heap_update_list ptr xs hp = hp\"\n apply (induct xs arbitrary: ptr n)\n apply simp\n apply simp\n apply (case_tac n, simp_all)\n apply (clarsimp simp add: fun_upd_idem)\n done\n\nlemma size_td_list_map2: \"\\f adjs. \\ \\a. size_td_pair (f a) = size_td_pair a \\\n \\ size_td_list (map f adjs) = size_td_list adjs\"\n by (induct_tac adjs, simp_all)\n\nlemma hrs_mem_update_cong:\n \"\\ \\x. f x = f' x \\ \\ hrs_mem_update f = hrs_mem_update f'\"\n by (simp add: hrs_mem_update_def)\n\nlemma Guard_no_cong:\n \"\\ A=A'; c=c' \\ \\ Guard A P c = Guard A' P c'\"\n by simp\n\nlemma heap_update_list_concat_fold:\n assumes \"ptr' = ptr + of_nat (length ys)\"\n shows \"heap_update_list ptr' xs (heap_update_list ptr ys s)\n = heap_update_list ptr (ys @ xs) s\"\n unfolding assms\n apply (induct ys arbitrary: ptr s)\n apply simp\n apply simp\n apply (elim meta_allE)\n apply (erule trans[rotated])\n apply (simp add: field_simps)\n done\n\nlemma heap_update_list_concat_fold_hrs_mem:\n \"ptr' = ptr + of_nat (length ys) \\\n hrs_mem_update (heap_update_list ptr' xs)\n (hrs_mem_update (heap_update_list ptr ys) s)\n = hrs_mem_update (heap_update_list ptr (ys @ xs)) s\"\n by (simp add: hrs_mem_update_def split_def\n heap_update_list_concat_fold)\n\nlemmas heap_update_list_concat_unfold\n = heap_update_list_concat_fold[OF refl, symmetric]\n\nlemma coerce_heap_update_to_heap_updates:\n assumes n: \"n = chunk * m\" and len: \"length xs = n\"\n shows \"heap_update_list x xs\n = (\\s. foldl (\\s n. heap_update_list (x + (of_nat n * of_nat chunk))\n (take chunk (drop (n * chunk) xs)) s)\n s [0 ..< m])\"\n using len[simplified n]\n apply (induct m arbitrary: x xs)\n apply (rule ext, simp)\n apply (rule ext)\n apply (simp only: upt_conv_Cons map_Suc_upt[symmetric])\n apply (subgoal_tac \"\\ys zs. length ys = chunk \\ xs = ys @ zs\")\n apply (clarsimp simp: heap_update_list_concat_unfold foldl_map\n field_simps)\n apply (rule_tac x=\"take chunk xs\" in exI)\n apply (rule_tac x=\"drop chunk xs\" in exI)\n apply simp\n done\n\nlemma update_ti_list_array':\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = y;\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m)) \\\n \\ y = foldr (\\n arr. Arrays.update arr n (update_ti_t (g n) (take v3 (drop (v3 * n) xs)) (index arr n))) [0 ..< n] v\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs y v)\n apply simp\n apply (simp add: access_ti_append)\n apply (elim meta_allE, drule(1) meta_mp)\n apply simp\n apply (rule foldr_cong, (rule refl)+)\n apply (simp add: take_drop)\n apply (subst min.absorb1)\n apply (fold mult_Suc_right, rule mult_le_mono2)\n apply simp\n apply simp\n done\n\nlemma update_ti_list_array:\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = (y :: 'a['b :: finite]);\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m));\n n \\ card (UNIV :: 'b set) \\\n \\ \\m < n. update_ti_t (g m) (take v3 (drop (v3 * m) xs)) (index v m) = index y m\"\n apply (subst update_ti_list_array'[where y=y], assumption+)\n apply clarsimp\n apply (subst index_fold_update)\n apply clarsimp+\n done\n\nlemma access_in_array:\n fixes y :: \"('a :: c_type)['b :: finite]\"\n assumes assms: \"h_val hp x = y\"\n \"n < card (UNIV :: 'b set)\"\n and subst: \"\\xs v. length xs = size_of TYPE('a)\n \\ update_ti_t (typ_info_t TYPE('a)) xs v = f xs\"\n shows \"h_val hp\n (Ptr (ptr_val x + of_nat (n * size_of TYPE('a)))) = index y n\"\n using assms\n apply (simp add: h_val_def drop_heap_list_le2 del: of_nat_mult)\n apply (subst take_heap_list_le[symmetric, where n=\"card (UNIV :: 'b set) * size_of TYPE ('a)\"])\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n apply (simp add: from_bytes_def typ_info_array')\n apply (drule update_ti_list_array, simp+)\n apply (simp add: size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply simp\n apply (drule spec, drule(1) mp)\n apply (simp add: size_of_def ac_simps drop_take)\n apply (subgoal_tac \"length v = size_of TYPE('a)\" for v)\n apply (subst subst, assumption)\n apply (subst(asm) subst, assumption)\n apply simp\n apply (simp add: size_of_def)\n apply (subst le_diff_conv2)\n apply simp\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n done\n\nlemma access_ti_list_array:\n \"\\ \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m. m < n \\ v3 \\ length (drop (v3 * m) xs)\n \\ access_ti_pair (f m) (FCP g) (take v3 (drop (v3 * m) xs)) = (h m)\n \\ \\\n access_ti_list (map f [0 ..< n]) (FCP g) xs\n = foldl (@) [] (map h [0 ..< n])\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs)\n apply simp\n apply (simp add: access_ti_append)\n apply (erule_tac x=\"take (v3 * n) xs\" in meta_allE)\n apply simp\n apply (frule spec, drule mp, rule conjI, rule lessI)\n apply simp\n apply simp\n apply (erule meta_mp)\n apply (auto simp add: drop_take)\n done\n\nlemma take_drop_foldl_concat:\n \"\\ \\y. y < m \\ length (f y) = n; x < m \\\n \\ take n (drop (x * n) (foldl (@) [] (map f [0 ..< m]))) = f x\"\n apply (subst split_upt_on_n, assumption)\n apply (simp only: foldl_concat_concat map_append)\n apply (subst drop_append_miracle)\n apply (induct x, simp_all)[1]\n apply simp\n done\n\ndefinition\n array_ptr_index :: \"(('a :: c_type)['b :: finite]) ptr \\ bool \\ nat \\ 'a ptr\"\nwhere\n \"array_ptr_index p coerce n = CTypesDefs.ptr_add (ptr_coerce p)\n (if coerce \\ n \\ CARD ('b) then 0 else of_nat n)\"\n\nlemmas array_ptr_index_simps\n = array_ptr_index_def[where coerce=False, simplified]\n array_ptr_index_def[where coerce=True, simplified]\n\nlemma heap_update_Array:\n \"heap_update (p ::('a::packed_type['b::finite]) ptr) arr\n = (\\s. foldl (\\s n. heap_update (array_ptr_index p False n)\n (Arrays.index arr n) s) s [0 ..< card (UNIV :: 'b set)])\"\n apply (rule ext, simp add: heap_update_def)\n apply (subst coerce_heap_update_to_heap_updates\n [OF _ refl, where chunk=\"size_of TYPE('a)\" and m=\"card (UNIV :: 'b set)\"])\n apply simp\n apply (rule foldl_cong[OF refl refl])\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def)\n apply (rule_tac f=\"\\xs. heap_update_list p xs s\" for p s in arg_cong)\n apply (simp add: to_bytes_def size_of_def\n packed_type_access_ti)\n apply (simp add: typ_info_array')\n apply (subst fcp_eta[symmetric], subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: packed_type_access_ti size_of_def)\n apply fastforce\n apply (rule take_drop_foldl_concat)\n apply (simp add: size_of_def)\n apply simp\n done\n\nlemma from_bytes_Array_element:\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n assumes len: \"length bs = size_of TYPE('a) * CARD('b)\"\n shows\n \"index (from_bytes bs :: 'a['b]) n\n = from_bytes (take (size_of TYPE('a)) (drop (n * size_of TYPE('a)) bs))\"\n using less\n apply (simp add: from_bytes_def size_of_def typ_info_array')\n apply (subst update_ti_list_array'[OF refl])\n apply simp\n apply (simp add: len size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply (simp add: split_upt_on_n[OF less])\n apply (rule trans, rule foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp+\n apply (subst foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp\n apply (simp add: mult.commute)\n apply (frule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (rule upd_rf)\n apply (simp add: size_of_def len mult.commute)\n done\n\nlemma heap_access_Array_element':\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n shows\n \"index (h_val hp p) n\n = h_val hp (array_ptr_index p False n)\"\n using less\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def h_val_def)\n apply (simp add: from_bytes_Array_element)\n apply (simp add: drop_heap_list_le take_heap_list_le)\n apply (subst take_heap_list_le)\n apply (simp add: le_diff_conv2)\n apply (drule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (simp add: mult.commute)\n apply simp\n done\n\nlemmas heap_access_Array_element\n = heap_access_Array_element'[simplified array_ptr_index_simps]\n\nlemma heap_update_id:\n \"h_val hp ptr = (v :: 'a :: packed_type)\n \\ heap_update ptr v hp = hp\"\n apply (simp add: h_val_def heap_update_def)\n apply (rule heap_update_list_id[where n=\"size_of TYPE('a)\"])\n apply clarsimp\n apply (simp add: from_bytes_def to_bytes_def update_ti_t_def\n size_of_def field_access_update_same\n td_fafu_idem)\n done\n\nlemma fold_cong':\n \"a = b \\ xs = ys \\ (\\x. x \\ set xs =simp=> f x = g x)\n \\ fold f xs a = fold g ys b\"\n unfolding simp_implies_def\n by (metis fold_cong)\n\nlemma intvl_empty2:\n \"({p ..+ n} = {}) = (n = 0)\"\n by (auto simp add: intvl_def)\n\nlemma heap_update_list_commute:\n \"{p ..+ length xs} \\ {q ..+ length ys} = {}\n \\ heap_update_list p xs (heap_update_list q ys hp)\n = heap_update_list q ys (heap_update_list p xs hp)\"\n apply (cases \"length xs < addr_card\")\n apply (cases \"length ys < addr_card\")\n apply (rule ext, simp add: heap_update_list_value)\n apply blast\n apply (simp_all add: addr_card intvl_overflow intvl_empty2)\n done\n\nlemma heap_update_commute:\n \"\\ {ptr_val p ..+ size_of TYPE('a)} \\ {ptr_val q ..+ size_of TYPE('b)} = {};\n wf_fd (typ_info_t TYPE('a)); wf_fd (typ_info_t TYPE('b)) \\\n \\ heap_update p v (heap_update q (u :: 'b :: c_type) h)\n = heap_update q u (heap_update p (v :: 'a :: c_type) h)\"\n apply (simp add: heap_update_def)\n apply (simp add: heap_update_list_commute heap_list_update_disjoint_same\n to_bytes_def length_fa_ti size_of_def Int_commute)\n done\n\nlemma heap_update_Array_update:\n assumes n: \"n < CARD('b :: finite)\"\n assumes size: \"CARD('b) * size_of TYPE('a :: packed_type) < 2 ^ addr_bitsize\"\n shows \"heap_update p (Arrays.update (arr :: 'a['b]) n v) hp\n = heap_update (array_ptr_index p False n) v (heap_update p arr hp)\"\nproof -\n\n have P: \"\\x k. \\ x < CARD('b); k < size_of TYPE('a) \\\n \\ unat (of_nat x * of_nat (size_of TYPE('a)) + (of_nat k :: addr))\n = x * size_of TYPE('a) + k\"\n using size\n apply (case_tac \"size_of TYPE('a)\", simp_all)\n apply (case_tac \"CARD('b)\", simp_all)\n apply (subst unat_add_lem[THEN iffD1])\n apply (simp add: unat_word_ariths unat_of_nat less_Suc_eq_le)\n apply (subgoal_tac \"Suc x * size_of TYPE('a) < 2 ^ addr_bitsize\", simp_all)\n apply (erule order_le_less_trans[rotated], simp add: add_mono)\n apply (subst unat_mult_lem[THEN iffD1])\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n apply (rule order_less_le_trans, erule order_le_less_trans[rotated],\n rule add_mono, simp+)\n apply (simp add: less_Suc_eq_le trans_le_add2)\n apply simp\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n done\n\n let ?key_upd = \"heap_update (array_ptr_index p False n) v\"\n note commute = fold_commute_apply[where h=\"?key_upd\"\n and xs=\"[Suc n ..< CARD('b)]\", where g=f' and f=f' for f']\n\n show ?thesis using n\n apply (simp add: heap_update_Array split_upt_on_n[OF n]\n foldl_conv_fold)\n apply (subst commute)\n apply (simp_all add: packed_heap_update_collapse\n cong: fold_cong')\n apply (rule ext, simp)\n apply (rule heap_update_commute, simp_all add: ptr_add_def)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def intvl_def Suc_le_eq)\n apply (rule set_eqI, clarsimp)\n apply (drule word_unat.Rep_inject[THEN iffD2])\n apply (clarsimp simp: P nat_eq_add_iff1)\n apply (case_tac x, simp_all add: less_Suc_eq_le Suc_diff_le)\n done\nqed\n\nlemma heap_update_id_Array:\n fixes arr :: \"('a :: packed_type)['b :: finite]\"\n shows \"arr = h_val hp p\n \\ heap_update p arr hp = hp\"\n apply (simp add: heap_update_Array)\n apply (rule foldl_does_nothing[where s=hp])\n apply (simp add: heap_access_Array_element' heap_update_id)\n done\n\nlemma heap_update_Array_element'':\n fixes p' :: \"(('a :: packed_type)['b::finite]) ptr\"\n fixes p :: \"('a :: packed_type) ptr\"\n fixes hp w\n assumes p: \"p = array_ptr_index p' False n\"\n assumes n: \"n < CARD('b)\"\n assumes size: \"CARD('b) * size_of TYPE('a) < 2 ^ addr_bitsize\"\n shows \"heap_update p' (Arrays.update (h_val hp p') n w) hp\n = heap_update p w hp\"\n apply (subst heap_update_Array_update[OF n size])\n apply (simp add: heap_update_id_Array p)\n done\n\nlemmas heap_update_Array_element'\n = heap_update_Array_element''[simplified array_ptr_index_simps]\n\nlemma array_count_size:\n \"CARD('b :: array_max_count) * size_of TYPE('a :: array_outer_max_size) < 2 ^ addr_bitsize\"\n using array_outer_max_size_ax[where 'a='a] array_max_count_ax[where 'a='b]\n apply (clarsimp dest!: nat_le_Suc_less_imp)\n apply (drule(1) mult_mono, simp+)\n done\n\nlemmas heap_update_Array_element\n = heap_update_Array_element'[OF refl _ array_count_size]\n\nlemma typ_slice_list_cut:\n \"\\ (\\x \\ set xs. size_td (dt_fst x) = m); m \\ 0; n < (length xs * m) \\\n \\ typ_slice_list xs n =\n typ_slice_pair (xs ! (n div m)) (n mod m)\"\n apply (induct xs arbitrary: n, simp_all)\n apply (intro conjI impI)\n apply simp\n apply (subgoal_tac \"\\n'. n = n' + m\")\n apply clarsimp\n apply (rule_tac x=\"n - m\" in exI)\n apply simp\n done\n\nlemma typ_slice_t_array:\n \"\\ n < CARD('b); y < size_of TYPE('a) \\\n \\ typ_slice_t (export_uinfo (typ_info_t TYPE('a))) y \\\n typ_slice_t (export_uinfo (array_tag TYPE('a['b :: finite])))\n (y + size_of TYPE('a :: mem_type) * n)\"\n apply (simp add: array_tag_def array_tag_n_eq\n split del: if_split)\n apply (rule disjI2)\n apply (subgoal_tac \"y + (size_of TYPE('a) * n) < CARD('b) * size_of TYPE('a)\")\n apply (simp add: typ_slice_list_cut[where m=\"size_of TYPE('a)\"]\n map_td_list_map o_def size_of_def\n sz_nzero[unfolded size_of_def])\n apply (simp add: export_uinfo_def[symmetric])\n apply (rule_tac y=\"Suc n * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n done\n\nlemma h_t_valid_Array_element':\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); coerce \\ n < CARD('b) \\\n \\ htd \\\\<^sub>t array_ptr_index p coerce n\"\n apply (clarsimp simp only: h_t_valid_def valid_footprint_def Let_def\n c_guard_def c_null_guard_def)\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n apply (clarsimp simp: size_td_array size_of_def typ_uinfo_t_def\n typ_info_array array_tag_def)\n apply (intro conjI)\n apply (clarsimp simp: CTypesDefs.ptr_add_def\n field_simps)\n apply (drule_tac x=\"offs * size_of TYPE('a) + y\" in spec)\n apply (drule mp)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (clarsimp simp: field_simps)\n apply (erule map_le_trans[rotated])\n apply (rule list_map_mono)\n apply (subst mult.commute, rule typ_slice_t_array[unfolded array_tag_def])\n apply assumption\n apply (simp add: size_of_def)\n apply (simp add: ptr_aligned_def align_of_def align_td_array\n array_ptr_index_def\n CTypesDefs.ptr_add_def unat_word_ariths unat_of_nat)\n using align_size_of[where 'a='a] align[where 'a='a]\n apply (simp add: align_of_def size_of_def addr_card_def card_word)\n apply (simp add: dvd_mod)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"offs * size_of TYPE('a) + k\" in spec)\n apply (drule mp)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def field_simps)\n apply (erule notE)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (auto simp add: array_ptr_index_def intro: exI[where x=0])\n done\n\nlemma h_t_valid_Array_element:\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); 0 \\ n; n < int CARD('b) \\\n \\ htd \\\\<^sub>t ((ptr_coerce p :: 'a ptr) +\\<^sub>p n)\"\n apply (drule_tac n=\"nat n\" and coerce=False in h_t_valid_Array_element')\n apply simp\n apply (simp add: array_ptr_index_def)\n done\n\nlemma ptr_safe_Array_element:\n \"\\ ptr_safe (p :: (('a :: mem_type)['b :: finite]) ptr) htd; coerce \\ n < CARD('b) \\\n \\ ptr_safe (array_ptr_index p coerce n) htd\"\n apply (simp add: ptr_safe_def)\n apply (erule order_trans[rotated])\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n prefer 2\n apply (auto simp: array_ptr_index_def intro: exI[where x=0])[1]\n apply (clarsimp simp: s_footprint_def s_footprint_untyped_def\n CTypesDefs.ptr_add_def\n size_td_array size_of_def)\n apply (rule_tac x=\"offs * size_of TYPE('a) + x\" in exI)\n apply (simp add: size_of_def)\n apply (rule conjI)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def)\n apply (rule mult_le_mono1)\n apply simp\n apply (thin_tac \"coerce \\ P\" for P)\n apply (elim disjE exE conjE, simp_all add: typ_uinfo_t_def)\n apply (erule order_less_le_trans)\n apply (rule prefix_length_le)\n apply (rule order_trans, erule typ_slice_t_array)\n apply (simp add: size_of_def)\n apply (simp add: size_of_def field_simps typ_info_array)\n done\n\nlemma from_bytes_eq:\n \"from_bytes [x] = x\"\n apply (clarsimp simp:from_bytes_def update_ti_t_def typ_info_word)\n apply (simp add:word_rcat_def)\n apply (simp add:bin_rcat_def)\n by (metis len8 word_of_int_uint word_ubin.Abs_norm)\n\nlemma bytes_disjoint:\"(x::('a::c_type) ptr) \\ y \\ {ptr_val x + a ..+ 1} \\ {ptr_val y + a ..+ 1} = {}\"\n by (clarsimp simp:intvl_def)\n\nlemma byte_ptrs_disjoint:\"(x::('a::c_type) ptr) \\ y \\ \\i < of_nat (size_of TYPE('a)). ptr_val x + i \\ ptr_val y + i\"\n by force\n\nlemma le_step:\"\\(x::('a::len) word) < y + 1; x \\ y\\ \\ x < y\"\n by (metis less_x_plus_1 max_word_max order_less_le)\n\nlemma ptr_add_disjoint:\n \"\\ ptr_val y \\ {ptr_val x ..+ size_of TYPE('a)};\n ptr_val (x::('a::c_type) ptr) < ptr_val (y::('b::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val x + a < ptr_val y\"\n apply (erule swap)\n apply (rule intvl_inter_le [where k=0 and ka=\"unat (ptr_val y - ptr_val x)\"])\n apply clarsimp\n apply (metis (hide_lams, mono_tags) add_diff_cancel2 add_diff_inverse diff_add_cancel\n trans_less_add1 unat_less_helper word_le_less_eq word_less_add_right\n word_of_nat_less word_unat.Rep_inverse)\n apply simp\n done\n\nlemma ptr_add_disjoint2:\n \"\\ ptr_val x \\ {ptr_val y ..+ size_of TYPE('a)};\n ptr_val (y::('b::c_type) ptr) < ptr_val (x::('a::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val y + a < ptr_val x\"\n apply (erule swap)\n apply (rule intvl_inter_le[where k=0 and ka=\"unat (ptr_val x - ptr_val y)\"])\n apply clarsimp\n apply (metis (no_types, hide_lams) add.commute less_imp_le less_le_trans not_le unat_less_helper\n word_diff_ls'(4))\n apply simp\n done\n\nlemma ptr_aligned_is_aligned:\"\\ptr_aligned (x::('a::c_type) ptr); align_of TYPE('a) = 2 ^ n\\ \\ is_aligned (ptr_val x) n\"\n by (clarsimp simp: ptr_aligned_def is_aligned_def)\n\nlemma intvl_no_overflow:\n assumes no_overflow: \"unat a + b < 2 ^ len_of TYPE('a::len)\"\n shows \"(x \\ {(a :: 'a word) ..+ b}) = (a \\ x \\ x < (a + of_nat b))\"\nproof -\n obtain \"sk\" :: \"'a word \\ 'a word \\ nat \\ nat\"\n where f1: \"\\x y z. x \\ {y..+z} \\ x = y + of_nat (sk x y z) \\ sk x y z < z\"\n using [[metis_new_skolem]] by (metis intvlD)\n\n have f2: \"\\x. a + x < a + of_nat b \\ \\ x < of_nat b\"\n using no_overflow\n by (metis PackedTypes.of_nat_mono_maybe_le add_lessD1 le_add1\n add.commute olen_add_eqv unat_of_nat_eq word_arith_nat_add\n word_plus_strict_mono_right)\n\n have f3: \"\\x y. y \\ {x..+b} \\ of_nat (sk y x b) < (of_nat b :: 'a word)\"\n using no_overflow f1\n by (metis add_lessD1 add.commute of_nat_mono_maybe)\n\n have \"x < a + of_nat b \\ \\ of_nat (sk x a b) < (of_nat b :: 'a word) \\ ?thesis\"\n using f1 f2 by metis\n\n hence \"x < a + of_nat b \\ ?thesis\"\n using f3 by metis\n\n thus \"?thesis\"\n apply (rule disjE)\n apply (rule iffI)\n apply (clarsimp simp: intvl_def)\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (subgoal_tac \"k + (b + unat a) < 2 ^ len_of (TYPE('a)) + b\")\n apply (subgoal_tac \"k + unat a < 2 ^ len_of (TYPE('a))\")\n apply (metis add_lessD1 le_def less_not_refl2 add.commute unat_eq_of_nat word_arith_nat_add)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (rule exI [where x=\"unat (x - a)\"])\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (metis diff_le_self le_add_diff_inverse le_diff_conv le_eq_less_or_eq le_unat_uoi add.commute nat_neq_iff unat_of_nat_eq word_arith_nat_add)\n apply simp\n done\nqed\n\n(* arg_cong specified for FCP because it does not apply as is. *)\nlemma FCP_arg_cong:\"f = g \\ FCP f = FCP g\"\n by simp\n\nlemma h_val_id:\n \"h_val (hrs_mem (hrs_mem_update (heap_update x y) s)) x = (y::'a::mem_type)\"\n apply (subst hrs_mem_update)\n apply (rule h_val_heap_update)\n done\n\nlemma heap_update_id2:\n \"hrs_mem_update (heap_update p ((h_val (hrs_mem s) p)::'a::packed_type)) s = s\"\n apply (clarsimp simp:hrs_mem_update_def case_prod_beta)\n apply (subst heap_update_id)\n apply (simp add:hrs_mem_def)+\n done\n\nlemma intvlI_unat:\"unat b < unat c \\ a + b \\ {a ..+ unat c}\"\n by (metis intvlI word_unat.Rep_inverse)\n\nlemma neq_imp_bytes_disjoint:\n \"\\ c_guard (x::'a::c_type ptr); c_guard y; unat j < align_of TYPE('a);\n unat i < align_of TYPE('a); x \\ y; 2 ^ n = align_of TYPE('a); n < 32\\ \\\n ptr_val x + j \\ ptr_val y + i\"\n apply (rule ccontr)\n apply (subgoal_tac \"is_aligned (ptr_val x) n\")\n apply (subgoal_tac \"is_aligned (ptr_val y) n\")\n apply (subgoal_tac \"(ptr_val x + j && ~~ mask n) = (ptr_val y + i && ~~ mask n)\")\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply simp\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n done\n\nlemma heap_update_list_base':\"heap_update_list p [] = id\"\n by (rule ext, simp)\n\nlemma hrs_mem_update_id3: \"hrs_mem_update id = id\"\n unfolding hrs_mem_update_def by simp\n\nabbreviation\n ptr_span :: \"'a::mem_type ptr \\ addr set\" where\n \"ptr_span p \\ {ptr_val p ..+ size_of TYPE('a)}\"\n\nabbreviation (input)\n cptr_type :: \"('a :: c_type) ptr \\ 'a itself\"\nwhere\n \"cptr_type p \\ TYPE('a)\"\n\nlemma ptr_retyp_valid_footprint_disjoint2:\n \"\\valid_footprint (ptr_retyp (q::'b::mem_type ptr) d) p s; {p..+size_td s} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ valid_footprint d p s\"\n apply(clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule (1) mp)\n apply(subgoal_tac \"p + of_nat y \\ {p..+size_td s}\")\n apply (subst (asm) ptr_retyp_d)\n apply clarsimp\n apply fast\n apply (clarsimp simp add: ptr_retyp_d_eq_fst split: if_split_asm)\n apply fast\n apply (erule intvlI)\n done\n\nlemma ptr_retyp_disjoint2:\n \"\\ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q;\n {ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\napply(clarsimp simp: h_t_valid_def)\napply(erule ptr_retyp_valid_footprint_disjoint2)\napply(simp add: size_of_def)\napply fast\ndone\n\nlemma ptr_retyp_disjoint_iff:\n \"{ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {}\n \\ ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q = d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\n apply rule\n apply (erule (1) ptr_retyp_disjoint2)\n apply (erule (1) ptr_retyp_disjoint)\n done\n\nlemma h_t_valid_ptr_retyp_eq:\n \"\\ cptr_type p <\\<^sub>\\ cptr_type p' \\ h_t_valid (ptr_retyp p td) g p'\n = (if ptr_span p \\ ptr_span p' = {} then h_t_valid td g p'\n else field_of_t p' p \\ g p')\"\n apply (clarsimp simp: ptr_retyp_disjoint_iff split: if_split)\n apply (cases \"g p'\")\n apply (rule iffI)\n apply (rule ccontr, drule h_t_valid_neq_disjoint, rule ptr_retyp_h_t_valid, simp+)\n apply (simp add: Int_commute)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (drule sub_h_t_valid[where p=p, rotated], rule ptr_retyp_h_t_valid, simp, simp)\n apply (erule(1) h_t_valid_guard_subst)\n apply (simp add: h_t_valid_def)\n done\n\nlemma field_lookup_list_Some_again:\n \"dt_snd (xs ! i) = f\n \\ i < length xs\n \\ f \\ dt_snd ` set ((take i xs))\n \\ field_lookup_list xs [f] n\n = Some (dt_fst (xs ! i), n + sum_list (map (size_td o dt_fst) (take i xs)))\"\n apply (induct xs arbitrary: i n, simp_all)\n apply (case_tac x1, simp)\n apply (case_tac i, auto split: if_split)\n done\n\nlemma field_lookup_array:\n \"n < CARD('b) \\ field_lookup (typ_info_t TYPE(('a :: c_type)['b :: finite]))\n [replicate n (CHR ''1'')] i = Some (adjust_ti (typ_info_t TYPE('a))\n (\\x. x.[n]) (\\x f. Arrays.update f n x), i + n * size_of TYPE ('a))\"\n apply (simp add: typ_info_array array_tag_def array_tag_n_eq)\n apply (subst field_lookup_list_Some_again[where i=n],\n auto simp add: take_map o_def sum_list_triv size_of_def)\n done\n\nlemma field_of_t_refl:\n \"field_of_t p p' = (p = p')\"\n apply (safe, simp_all add: field_of_t_def)\n apply (simp add: field_of_def)\n apply (drule td_set_size_lte)\n apply (simp add: unat_eq_0)\n done\n\nlemma ptr_retyp_same_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p' \\ {ptr_val p..+ size_of TYPE('a)} \\ {ptr_val p' ..+ size_of TYPE('a)} = {}\"\n using ht\n by (simp add: h_t_valid_ptr_retyp_eq[where p=p and p'=p'] field_of_t_refl\n split: if_split_asm)\n\nlemma h_t_valid_ptr_retyp_inside_eq:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes inside: \"ptr_val p' \\ {ptr_val p ..+ size_of TYPE('a)}\"\n and ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p'\"\n using ptr_retyp_same_cleared_region[OF ht] inside mem_type_self[where p=p']\n by blast\n\nlemma typ_slice_t_self_nth:\n \"\\n < length (typ_slice_t td m). \\b. typ_slice_t td m ! n = (td, b)\"\n using typ_slice_t_self [where td = td and m = m]\n by (fastforce simp add: in_set_conv_nth)\n\nlemma ptr_retyp_other_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'b :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n and tdisj: \"typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b :: mem_type)\"\n and clear: \"\\x \\ {ptr_val p ..+ size_of TYPE('a)}. \\n b. snd (td x) n \\ Some (typ_uinfo_t TYPE('b), b)\"\n shows \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} = {}\"\nproof (rule classical)\n assume asm: \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} \\ {}\"\n then obtain mv where mvp: \"mv \\ {ptr_val p..+size_of TYPE('a)}\"\n and mvp': \"mv \\ {ptr_val p'..+size_of TYPE('b)}\"\n by blast\n\n then obtain k' where mv: \"mv = ptr_val p' + of_nat k'\" and klt: \"k' < size_td (typ_info_t TYPE('b))\"\n by (clarsimp dest!: intvlD simp: size_of_def typ_uinfo_size)\n\n let ?mv = \"ptr_val p' + of_nat k'\"\n\n obtain n b where nl: \"n < length (typ_slice_t (typ_uinfo_t TYPE('b)) k')\"\n and tseq: \"typ_slice_t (typ_uinfo_t TYPE('b)) k' ! n = (typ_uinfo_t TYPE('b), b)\"\n using typ_slice_t_self_nth [where td = \"typ_uinfo_t TYPE('b)\" and m = k']\n by clarsimp\n\n with ht have \"snd (ptr_retyp p td ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n unfolding h_t_valid_def\n apply -\n apply (clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule mp [OF _ klt])\n apply (clarsimp simp: map_le_def)\n apply (drule bspec)\n apply simp\n apply simp\n done\n\n moreover {\n assume \"snd (ptr_retyp p empty_htd ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n hence \"(typ_uinfo_t TYPE('b)) \\ fst ` set (typ_slice_t (typ_uinfo_t TYPE('a))\n (unat (ptr_val p' + of_nat k' - ptr_val p)))\"\n using asm mv mvp\n apply -\n apply (rule_tac x = \"(typ_uinfo_t TYPE('b), b)\" in image_eqI)\n apply simp\n apply (fastforce simp add: ptr_retyp_footprint list_map_eq in_set_conv_nth split: if_split_asm)\n done\n\n with typ_slice_set have \"(typ_uinfo_t TYPE('b)) \\ fst ` td_set (typ_uinfo_t TYPE('a)) 0\"\n by (rule subsetD)\n\n hence False using tdisj by (clarsimp simp: tag_disj_def typ_tag_le_def)\n } ultimately show ?thesis using mvp mvp' mv unfolding h_t_valid_def valid_footprint_def\n apply -\n apply (subst (asm) ptr_retyp_d_eq_snd)\n apply (auto simp add: map_add_Some_iff clear)\n done\nqed\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/clib/LemmaBucket_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.26693672851995126}} {"text": "(* Title: HOL/TLA/Memory/MemoryImplementation.thy\n Author: Stephan Merz, University of Munich\n*)\n\nsection {* RPC-Memory example: Memory implementation *}\n\ntheory MemoryImplementation\nimports Memory RPC MemClerk\nbegin\n\ndatatype histState = histA | histB\n\ntype_synonym histType = \"(PrIds => histState) stfun\" (* the type of the history variable *)\n\nconsts\n (* the specification *)\n (* channel (external) *)\n memCh :: \"memChType\"\n (* internal variables *)\n mm :: \"memType\"\n\n (* the state variables of the implementation *)\n (* channels *)\n (* same interface channel memCh *)\n crCh :: \"rpcSndChType\"\n rmCh :: \"rpcRcvChType\"\n (* internal variables *)\n (* identity refinement mapping for mm -- simply reused *)\n rst :: \"rpcStType\"\n cst :: \"mClkStType\"\n ires :: \"resType\"\n\ndefinition\n (* auxiliary predicates *)\n MVOKBARF :: \"Vals => bool\"\n where \"MVOKBARF v <-> (v : MemVal) | (v = OK) | (v = BadArg) | (v = RPCFailure)\"\n\ndefinition\n MVOKBA :: \"Vals => bool\"\n where \"MVOKBA v <-> (v : MemVal) | (v = OK) | (v = BadArg)\"\n\ndefinition\n MVNROKBA :: \"Vals => bool\"\n where \"MVNROKBA v <-> (v : MemVal) | (v = NotAResult) | (v = OK) | (v = BadArg)\"\n\ndefinition\n (* tuples of state functions changed by the various components *)\n e :: \"PrIds => (bit * memOp) stfun\"\n where \"e p = PRED (caller memCh!p)\"\n\ndefinition\n c :: \"PrIds => (mClkState * (bit * Vals) * (bit * rpcOp)) stfun\"\n where \"c p = PRED (cst!p, rtrner memCh!p, caller crCh!p)\"\n\ndefinition\n r :: \"PrIds => (rpcState * (bit * Vals) * (bit * memOp)) stfun\"\n where \"r p = PRED (rst!p, rtrner crCh!p, caller rmCh!p)\"\n\ndefinition\n m :: \"PrIds => ((bit * Vals) * Vals) stfun\"\n where \"m p = PRED (rtrner rmCh!p, ires!p)\"\n\ndefinition\n (* the environment action *)\n ENext :: \"PrIds => action\"\n where \"ENext p = ACT (? l. #l : #MemLoc & Call memCh p #(read l))\"\n\n\ndefinition\n (* specification of the history variable *)\n HInit :: \"histType => PrIds => stpred\"\n where \"HInit rmhist p = PRED rmhist!p = #histA\"\n\ndefinition\n HNext :: \"histType => PrIds => action\"\n where \"HNext rmhist p = ACT (rmhist!p)$ =\n (if (MemReturn rmCh ires p | RPCFail crCh rmCh rst p)\n then #histB\n else if (MClkReply memCh crCh cst p)\n then #histA\n else $(rmhist!p))\"\n\ndefinition\n HistP :: \"histType => PrIds => temporal\"\n where \"HistP rmhist p = (TEMP Init HInit rmhist p\n & [][HNext rmhist p]_(c p,r p,m p, rmhist!p))\"\n\ndefinition\n Hist :: \"histType => temporal\"\n where \"Hist rmhist = TEMP (ALL p. HistP rmhist p)\"\n\ndefinition\n (* the implementation *)\n IPImp :: \"PrIds => temporal\"\n where \"IPImp p = (TEMP ( Init ~Calling memCh p & [][ENext p]_(e p)\n & MClkIPSpec memCh crCh cst p\n & RPCIPSpec crCh rmCh rst p\n & RPSpec rmCh mm ires p\n & (ALL l. #l : #MemLoc --> MSpec rmCh mm ires l)))\"\n\ndefinition\n ImpInit :: \"PrIds => stpred\"\n where \"ImpInit p = PRED ( ~Calling memCh p\n & MClkInit crCh cst p\n & RPCInit rmCh rst p\n & PInit ires p)\"\n\ndefinition\n ImpNext :: \"PrIds => action\"\n where \"ImpNext p = (ACT [ENext p]_(e p)\n & [MClkNext memCh crCh cst p]_(c p)\n & [RPCNext crCh rmCh rst p]_(r p)\n & [RNext rmCh mm ires p]_(m p))\"\n\ndefinition\n ImpLive :: \"PrIds => temporal\"\n where \"ImpLive p = (TEMP WF(MClkFwd memCh crCh cst p)_(c p)\n & SF(MClkReply memCh crCh cst p)_(c p)\n & WF(RPCNext crCh rmCh rst p)_(r p)\n & WF(RNext rmCh mm ires p)_(m p)\n & WF(MemReturn rmCh ires p)_(m p))\"\n\ndefinition\n Implementation :: \"temporal\"\n where \"Implementation = (TEMP ( (ALL p. Init (~Calling memCh p) & [][ENext p]_(e p))\n & MClkISpec memCh crCh cst\n & RPCISpec crCh rmCh rst\n & IRSpec rmCh mm ires))\"\n\ndefinition\n (* the predicate S describes the states of the implementation.\n slight simplification: two \"histState\" parameters instead of a\n (one- or two-element) set.\n NB: The second conjunct of the definition in the paper is taken care of by\n the type definitions. The last conjunct is asserted separately as the memory\n invariant MemInv, proved in Memory.thy. *)\n S :: \"histType => bool => bool => bool => mClkState => rpcState => histState => histState => PrIds => stpred\"\n where \"S rmhist ecalling ccalling rcalling cs rs hs1 hs2 p = (PRED\n Calling memCh p = #ecalling\n & Calling crCh p = #ccalling\n & (#ccalling --> arg = MClkRelayArg>)\n & (~ #ccalling & cst!p = #clkB --> MVOKBARF>)\n & Calling rmCh p = #rcalling\n & (#rcalling --> arg = RPCRelayArg>)\n & (~ #rcalling --> ires!p = #NotAResult)\n & (~ #rcalling & rst!p = #rpcB --> MVOKBA>)\n & cst!p = #cs\n & rst!p = #rs\n & (rmhist!p = #hs1 | rmhist!p = #hs2)\n & MVNROKBA)\"\n\ndefinition\n (* predicates S1 -- S6 define special instances of S *)\n S1 :: \"histType => PrIds => stpred\"\n where \"S1 rmhist p = S rmhist False False False clkA rpcA histA histA p\"\n\ndefinition\n S2 :: \"histType => PrIds => stpred\"\n where \"S2 rmhist p = S rmhist True False False clkA rpcA histA histA p\"\n\ndefinition\n S3 :: \"histType => PrIds => stpred\"\n where \"S3 rmhist p = S rmhist True True False clkB rpcA histA histB p\"\n\ndefinition\n S4 :: \"histType => PrIds => stpred\"\n where \"S4 rmhist p = S rmhist True True True clkB rpcB histA histB p\"\n\ndefinition\n S5 :: \"histType => PrIds => stpred\"\n where \"S5 rmhist p = S rmhist True True False clkB rpcB histB histB p\"\n\ndefinition\n S6 :: \"histType => PrIds => stpred\"\n where \"S6 rmhist p = S rmhist True False False clkB rpcA histB histB p\"\n\ndefinition\n (* The invariant asserts that the system is always in one of S1 - S6, for every p *)\n ImpInv :: \"histType => PrIds => stpred\"\n where \"ImpInv rmhist p = (PRED (S1 rmhist p | S2 rmhist p | S3 rmhist p\n | S4 rmhist p | S5 rmhist p | S6 rmhist p))\"\n\ndefinition\n resbar :: \"histType => resType\" (* refinement mapping *)\n where\"resbar rmhist s p =\n (if (S1 rmhist p s | S2 rmhist p s)\n then ires s p\n else if S3 rmhist p s\n then if rmhist s p = histA\n then ires s p else MemFailure\n else if S4 rmhist p s\n then if (rmhist s p = histB & ires s p = NotAResult)\n then MemFailure else ires s p\n else if S5 rmhist p s\n then res (rmCh s p)\n else if S6 rmhist p s\n then if res (crCh s p) = RPCFailure\n then MemFailure else res (crCh s p)\n else NotAResult)\" (* dummy value *)\n\naxiomatization where\n (* the \"base\" variables: everything except resbar and hist (for any index) *)\n MI_base: \"basevars (caller memCh!p,\n (rtrner memCh!p, caller crCh!p, cst!p),\n (rtrner crCh!p, caller rmCh!p, rst!p),\n (mm!l, rtrner rmCh!p, ires!p))\"\n\n(*\n The main theorem is theorem \"Implementation\" at the end of this file,\n which shows that the composition of a reliable memory, an RPC component, and\n a memory clerk implements an unreliable memory. The files \"MIsafe.thy\" and\n \"MIlive.thy\" contain lower-level lemmas for the safety and liveness parts.\n\n Steps are (roughly) numbered as in the hand proof.\n*)\n\n(* --------------------------- automatic prover --------------------------- *)\n\ndeclare if_weak_cong [cong del]\n\n(* A more aggressive variant that tries to solve subgoals by assumption\n or contradiction during the simplification.\n THIS IS UNSAFE, BECAUSE IT DOESN'T RECORD THE CHOICES!!\n (but it can be a lot faster than the default setup)\n*)\nML {*\n val config_fast_solver = Attrib.setup_config_bool @{binding fast_solver} (K false);\n val fast_solver = mk_solver \"fast_solver\" (fn ctxt =>\n if Config.get ctxt config_fast_solver\n then assume_tac ctxt ORELSE' (etac notE)\n else K no_tac);\n*}\n\nsetup {* map_theory_simpset (fn ctxt => ctxt addSSolver fast_solver) *}\n\nML {* val temp_elim = make_elim oo temp_use *}\n\n\n\n(****************************** The history variable ******************************)\n\nsection \"History variable\"\n\nlemma HistoryLemma: \"|- Init(ALL p. ImpInit p) & [](ALL p. ImpNext p)\n --> (EEX rmhist. Init(ALL p. HInit rmhist p)\n & [](ALL p. [HNext rmhist p]_(c p, r p, m p, rmhist!p)))\"\n apply clarsimp\n apply (rule historyI)\n apply assumption+\n apply (rule MI_base)\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm HInit_def}]) [] [] 1 *})\n apply (erule fun_cong)\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm HNext_def}])\n [@{thm busy_squareI}] [] 1 *})\n apply (erule fun_cong)\n done\n\nlemma History: \"|- Implementation --> (EEX rmhist. Hist rmhist)\"\n apply clarsimp\n apply (rule HistoryLemma [temp_use, THEN eex_mono])\n prefer 3\n apply (force simp: Hist_def HistP_def Init_def all_box [try_rewrite]\n split_box_conj [try_rewrite])\n apply (auto simp: Implementation_def MClkISpec_def RPCISpec_def\n IRSpec_def MClkIPSpec_def RPCIPSpec_def RPSpec_def ImpInit_def\n Init_def ImpNext_def c_def r_def m_def all_box [temp_use] split_box_conj [temp_use])\n done\n\n(******************************** The safety part *********************************)\n\nsection \"The safety part\"\n\n(* ------------------------- Include lower-level lemmas ------------------------- *)\n\n(* RPCFailure notin MemVals U {OK,BadArg} *)\n\nlemma MVOKBAnotRF: \"MVOKBA x ==> x ~= RPCFailure\"\n apply (unfold MVOKBA_def)\n apply auto\n done\n\n(* NotAResult notin MemVals U {OK,BadArg,RPCFailure} *)\n\nlemma MVOKBARFnotNR: \"MVOKBARF x ==> x ~= NotAResult\"\n apply (unfold MVOKBARF_def)\n apply auto\n done\n\n(* ================ Si's are mutually exclusive ================================ *)\n(* Si and Sj are mutually exclusive for i # j. This helps to simplify the big\n conditional in the definition of resbar when doing the step-simulation proof.\n We prove a weaker result, which suffices for our purposes:\n Si implies (not Sj), for j S1 rmhist p & ~S2 rmhist p & ~S3 rmhist p &\n ~S4 rmhist p & ~S5 rmhist p & ~S6 rmhist p\"\n by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n*)\n\nlemma S2_excl: \"|- S2 rmhist p --> S2 rmhist p & ~S1 rmhist p\"\n by (auto simp: S_def S1_def S2_def)\n\nlemma S3_excl: \"|- S3 rmhist p --> S3 rmhist p & ~S1 rmhist p & ~S2 rmhist p\"\n by (auto simp: S_def S1_def S2_def S3_def)\n\nlemma S4_excl: \"|- S4 rmhist p --> S4 rmhist p & ~S1 rmhist p & ~S2 rmhist p & ~S3 rmhist p\"\n by (auto simp: S_def S1_def S2_def S3_def S4_def)\n\nlemma S5_excl: \"|- S5 rmhist p --> S5 rmhist p & ~S1 rmhist p & ~S2 rmhist p\n & ~S3 rmhist p & ~S4 rmhist p\"\n by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def)\n\nlemma S6_excl: \"|- S6 rmhist p --> S6 rmhist p & ~S1 rmhist p & ~S2 rmhist p\n & ~S3 rmhist p & ~S4 rmhist p & ~S5 rmhist p\"\n by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\n\n(* ==================== Lemmas about the environment ============================== *)\n\nlemma Envbusy: \"|- $(Calling memCh p) --> ~ENext p\"\n by (auto simp: ENext_def Call_def)\n\n(* ==================== Lemmas about the implementation's states ==================== *)\n\n(* The following series of lemmas are used in establishing the implementation's\n next-state relation (Step 1.2 of the proof in the paper). For each state Si, we\n determine which component actions are possible and what state they result in.\n*)\n\n(* ------------------------------ State S1 ---------------------------------------- *)\n\nlemma S1Env: \"|- ENext p & $(S1 rmhist p) & unchanged (c p, r p, m p, rmhist!p)\n --> (S2 rmhist p)$\"\n by (force simp: ENext_def Call_def c_def r_def m_def\n caller_def rtrner_def MVNROKBA_def S_def S1_def S2_def Calling_def)\n\nlemma S1ClerkUnch: \"|- [MClkNext memCh crCh cst p]_(c p) & $(S1 rmhist p) --> unchanged (c p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] dest!: MClkidle [temp_use] simp: S_def S1_def)\n\nlemma S1RPCUnch: \"|- [RPCNext crCh rmCh rst p]_(r p) & $(S1 rmhist p) --> unchanged (r p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] dest!: RPCidle [temp_use] simp: S_def S1_def)\n\nlemma S1MemUnch: \"|- [RNext rmCh mm ires p]_(m p) & $(S1 rmhist p) --> unchanged (m p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] dest!: Memoryidle [temp_use] simp: S_def S1_def)\n\nlemma S1Hist: \"|- [HNext rmhist p]_(c p,r p,m p,rmhist!p) & $(S1 rmhist p)\n --> unchanged (rmhist!p)\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm HNext_def}, @{thm S_def},\n @{thm S1_def}, @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm MClkReply_def},\n @{thm Return_def}]) [] [temp_use @{context} @{thm squareE}] 1 *})\n\n\n(* ------------------------------ State S2 ---------------------------------------- *)\n\nlemma S2EnvUnch: \"|- [ENext p]_(e p) & $(S2 rmhist p) --> unchanged (e p)\"\n by (auto dest!: Envbusy [temp_use] simp: S_def S2_def)\n\nlemma S2Clerk: \"|- MClkNext memCh crCh cst p & $(S2 rmhist p) --> MClkFwd memCh crCh cst p\"\n by (auto simp: MClkNext_def MClkRetry_def MClkReply_def S_def S2_def)\n\nlemma S2Forward: \"|- $(S2 rmhist p) & MClkFwd memCh crCh cst p\n & unchanged (e p, r p, m p, rmhist!p)\n --> (S3 rmhist p)$\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm MClkFwd_def},\n @{thm Call_def}, @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def},\n @{thm rtrner_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S2RPCUnch: \"|- [RPCNext crCh rmCh rst p]_(r p) & $(S2 rmhist p) --> unchanged (r p)\"\n by (auto simp: S_def S2_def dest!: RPCidle [temp_use])\n\nlemma S2MemUnch: \"|- [RNext rmCh mm ires p]_(m p) & $(S2 rmhist p) --> unchanged (m p)\"\n by (auto simp: S_def S2_def dest!: Memoryidle [temp_use])\n\nlemma S2Hist: \"|- [HNext rmhist p]_(c p,r p,m p,rmhist!p) & $(S2 rmhist p)\n --> unchanged (rmhist!p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n MClkReply_def Return_def S_def S2_def)\n\n(* ------------------------------ State S3 ---------------------------------------- *)\n\nlemma S3EnvUnch: \"|- [ENext p]_(e p) & $(S3 rmhist p) --> unchanged (e p)\"\n by (auto dest!: Envbusy [temp_use] simp: S_def S3_def)\n\nlemma S3ClerkUnch: \"|- [MClkNext memCh crCh cst p]_(c p) & $(S3 rmhist p) --> unchanged (c p)\"\n by (auto dest!: MClkbusy [temp_use] simp: square_def S_def S3_def)\n\nlemma S3LegalRcvArg: \"|- S3 rmhist p --> IsLegalRcvArg>\"\n by (auto simp: IsLegalRcvArg_def MClkRelayArg_def S_def S3_def)\n\nlemma S3RPC: \"|- RPCNext crCh rmCh rst p & $(S3 rmhist p)\n --> RPCFwd crCh rmCh rst p | RPCFail crCh rmCh rst p\"\n apply clarsimp\n apply (frule S3LegalRcvArg [action_use])\n apply (auto simp: RPCNext_def RPCReject_def RPCReply_def S_def S3_def)\n done\n\nlemma S3Forward: \"|- RPCFwd crCh rmCh rst p & HNext rmhist p & $(S3 rmhist p)\n & unchanged (e p, c p, m p)\n --> (S4 rmhist p)$ & unchanged (rmhist!p)\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm RPCFwd_def},\n @{thm HNext_def}, @{thm MemReturn_def}, @{thm RPCFail_def},\n @{thm MClkReply_def}, @{thm Return_def}, @{thm Call_def}, @{thm e_def},\n @{thm c_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n @{thm S3_def}, @{thm S4_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S3Fail: \"|- RPCFail crCh rmCh rst p & $(S3 rmhist p) & HNext rmhist p\n & unchanged (e p, c p, m p)\n --> (S6 rmhist p)$\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm HNext_def},\n @{thm RPCFail_def}, @{thm Return_def}, @{thm e_def}, @{thm c_def},\n @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm MVOKBARF_def},\n @{thm S_def}, @{thm S3_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S3MemUnch: \"|- [RNext rmCh mm ires p]_(m p) & $(S3 rmhist p) --> unchanged (m p)\"\n by (auto simp: S_def S3_def dest!: Memoryidle [temp_use])\n\nlemma S3Hist: \"|- HNext rmhist p & $(S3 rmhist p) & unchanged (r p) --> unchanged (rmhist!p)\"\n by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n Return_def r_def rtrner_def S_def S3_def Calling_def)\n\n(* ------------------------------ State S4 ---------------------------------------- *)\n\nlemma S4EnvUnch: \"|- [ENext p]_(e p) & $(S4 rmhist p) --> unchanged (e p)\"\n by (auto simp: S_def S4_def dest!: Envbusy [temp_use])\n\nlemma S4ClerkUnch: \"|- [MClkNext memCh crCh cst p]_(c p) & $(S4 rmhist p) --> unchanged (c p)\"\n by (auto simp: S_def S4_def dest!: MClkbusy [temp_use])\n\nlemma S4RPCUnch: \"|- [RPCNext crCh rmCh rst p]_(r p) & $(S4 rmhist p) --> unchanged (r p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] dest!: RPCbusy [temp_use] simp: S_def S4_def)\n\nlemma S4ReadInner: \"|- ReadInner rmCh mm ires p l & $(S4 rmhist p) & unchanged (e p, c p, r p)\n & HNext rmhist p & $(MemInv mm l)\n --> (S4 rmhist p)$ & unchanged (rmhist!p)\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm ReadInner_def},\n @{thm GoodRead_def}, @{thm BadRead_def}, @{thm HNext_def}, @{thm MemReturn_def},\n @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm Return_def}, @{thm e_def},\n @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def},\n @{thm MVNROKBA_def}, @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def},\n @{thm Calling_def}, @{thm MemInv_def}]) [] [] 1 *})\n\nlemma S4Read: \"|- Read rmCh mm ires p & $(S4 rmhist p) & unchanged (e p, c p, r p)\n & HNext rmhist p & (!l. $MemInv mm l)\n --> (S4 rmhist p)$ & unchanged (rmhist!p)\"\n by (auto simp: Read_def dest!: S4ReadInner [temp_use])\n\nlemma S4WriteInner: \"|- WriteInner rmCh mm ires p l v & $(S4 rmhist p) & unchanged (e p, c p, r p) & HNext rmhist p\n --> (S4 rmhist p)$ & unchanged (rmhist!p)\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm WriteInner_def},\n @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm HNext_def}, @{thm MemReturn_def},\n @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm Return_def}, @{thm e_def},\n @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def}, @{thm MVNROKBA_def},\n @{thm S_def}, @{thm S4_def}, @{thm WrRequest_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S4Write: \"|- Write rmCh mm ires p l & $(S4 rmhist p) & unchanged (e p, c p, r p)\n & (HNext rmhist p)\n --> (S4 rmhist p)$ & unchanged (rmhist!p)\"\n by (auto simp: Write_def dest!: S4WriteInner [temp_use])\n\nlemma WriteS4: \"|- $ImpInv rmhist p & Write rmCh mm ires p l --> $S4 rmhist p\"\n by (auto simp: Write_def WriteInner_def ImpInv_def\n WrRequest_def S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\nlemma S4Return: \"|- MemReturn rmCh ires p & $S4 rmhist p & unchanged (e p, c p, r p)\n & HNext rmhist p\n --> (S5 rmhist p)$\"\n by (auto simp: HNext_def MemReturn_def Return_def e_def c_def r_def\n rtrner_def caller_def MVNROKBA_def MVOKBA_def S_def S4_def S5_def Calling_def)\n\nlemma S4Hist: \"|- HNext rmhist p & $S4 rmhist p & (m p)$ = $(m p) --> (rmhist!p)$ = $(rmhist!p)\"\n by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n Return_def m_def rtrner_def S_def S4_def Calling_def)\n\n(* ------------------------------ State S5 ---------------------------------------- *)\n\nlemma S5EnvUnch: \"|- [ENext p]_(e p) & $(S5 rmhist p) --> unchanged (e p)\"\n by (auto simp: S_def S5_def dest!: Envbusy [temp_use])\n\nlemma S5ClerkUnch: \"|- [MClkNext memCh crCh cst p]_(c p) & $(S5 rmhist p) --> unchanged (c p)\"\n by (auto simp: S_def S5_def dest!: MClkbusy [temp_use])\n\nlemma S5RPC: \"|- RPCNext crCh rmCh rst p & $(S5 rmhist p)\n --> RPCReply crCh rmCh rst p | RPCFail crCh rmCh rst p\"\n by (auto simp: RPCNext_def RPCReject_def RPCFwd_def S_def S5_def)\n\nlemma S5Reply: \"|- RPCReply crCh rmCh rst p & $(S5 rmhist p) & unchanged (e p, c p, m p,rmhist!p)\n --> (S6 rmhist p)$\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm RPCReply_def},\n @{thm Return_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}, @{thm MVOKBA_def},\n @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S5Fail: \"|- RPCFail crCh rmCh rst p & $(S5 rmhist p) & unchanged (e p, c p, m p,rmhist!p)\n --> (S6 rmhist p)$\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm RPCFail_def},\n @{thm Return_def}, @{thm e_def}, @{thm c_def}, @{thm m_def},\n @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def},\n @{thm S_def}, @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S5MemUnch: \"|- [RNext rmCh mm ires p]_(m p) & $(S5 rmhist p) --> unchanged (m p)\"\n by (auto simp: S_def S5_def dest!: Memoryidle [temp_use])\n\nlemma S5Hist: \"|- [HNext rmhist p]_(c p, r p, m p, rmhist!p) & $(S5 rmhist p)\n --> (rmhist!p)$ = $(rmhist!p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n MClkReply_def Return_def S_def S5_def)\n\n(* ------------------------------ State S6 ---------------------------------------- *)\n\nlemma S6EnvUnch: \"|- [ENext p]_(e p) & $(S6 rmhist p) --> unchanged (e p)\"\n by (auto simp: S_def S6_def dest!: Envbusy [temp_use])\n\nlemma S6Clerk: \"|- MClkNext memCh crCh cst p & $(S6 rmhist p)\n --> MClkRetry memCh crCh cst p | MClkReply memCh crCh cst p\"\n by (auto simp: MClkNext_def MClkFwd_def S_def S6_def)\n\nlemma S6Retry: \"|- MClkRetry memCh crCh cst p & HNext rmhist p & $S6 rmhist p\n & unchanged (e p,r p,m p)\n --> (S3 rmhist p)$ & unchanged (rmhist!p)\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm HNext_def},\n @{thm MClkReply_def}, @{thm MClkRetry_def}, @{thm Call_def}, @{thm Return_def},\n @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n @{thm S_def}, @{thm S6_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S6Reply: \"|- MClkReply memCh crCh cst p & HNext rmhist p & $S6 rmhist p\n & unchanged (e p,r p,m p)\n --> (S1 rmhist p)$\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm HNext_def},\n @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm Return_def}, @{thm MClkReply_def},\n @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n @{thm S_def}, @{thm S6_def}, @{thm S1_def}, @{thm Calling_def}]) [] [] 1 *})\n\nlemma S6RPCUnch: \"|- [RPCNext crCh rmCh rst p]_(r p) & $S6 rmhist p --> unchanged (r p)\"\n by (auto simp: S_def S6_def dest!: RPCidle [temp_use])\n\nlemma S6MemUnch: \"|- [RNext rmCh mm ires p]_(m p) & $(S6 rmhist p) --> unchanged (m p)\"\n by (auto simp: S_def S6_def dest!: Memoryidle [temp_use])\n\nlemma S6Hist: \"|- HNext rmhist p & $S6 rmhist p & (c p)$ = $(c p) --> (rmhist!p)$ = $(rmhist!p)\"\n by (auto simp: HNext_def MClkReply_def Return_def c_def rtrner_def S_def S6_def Calling_def)\n\n\nsection \"Correctness of predicate-action diagram\"\n\n\n(* ========== Step 1.1 ================================================= *)\n(* The implementation's initial condition implies the state predicate S1 *)\n\nlemma Step1_1: \"|- ImpInit p & HInit rmhist p --> S1 rmhist p\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] simp: MVNROKBA_def\n MClkInit_def RPCInit_def PInit_def HInit_def ImpInit_def S_def S1_def)\n\n(* ========== Step 1.2 ================================================== *)\n(* Figure 16 is a predicate-action diagram for the implementation. *)\n\nlemma Step1_2_1: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p) & $S1 rmhist p\n --> (S2 rmhist p)$ & ENext p & unchanged (c p, r p, m p)\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context})\n [@{thm S1ClerkUnch}, @{thm S1RPCUnch}, @{thm S1MemUnch}, @{thm S1Hist}]) 1 *})\n using [[fast_solver]]\n apply (auto elim!: squareE [temp_use] intro!: S1Env [temp_use])\n done\n\nlemma Step1_2_2: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p) & $S2 rmhist p\n --> (S3 rmhist p)$ & MClkFwd memCh crCh cst p\n & unchanged (e p, r p, m p, rmhist!p)\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context})\n [@{thm S2EnvUnch}, @{thm S2RPCUnch}, @{thm S2MemUnch}, @{thm S2Hist}]) 1 *})\n using [[fast_solver]]\n apply (auto elim!: squareE [temp_use] intro!: S2Clerk [temp_use] S2Forward [temp_use])\n done\n\nlemma Step1_2_3: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p) & $S3 rmhist p\n --> ((S4 rmhist p)$ & RPCFwd crCh rmCh rst p & unchanged (e p, c p, m p, rmhist!p))\n | ((S6 rmhist p)$ & RPCFail crCh rmCh rst p & unchanged (e p, c p, m p))\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context}) [@{thm S3EnvUnch}, @{thm S3ClerkUnch}, @{thm S3MemUnch}]) 1 *})\n apply (tactic {* action_simp_tac @{context} []\n (@{thm squareE} ::\n map (temp_elim @{context}) [@{thm S3RPC}, @{thm S3Forward}, @{thm S3Fail}]) 1 *})\n apply (auto dest!: S3Hist [temp_use])\n done\n\nlemma Step1_2_4: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p)\n & $S4 rmhist p & (!l. $(MemInv mm l))\n --> ((S4 rmhist p)$ & Read rmCh mm ires p & unchanged (e p, c p, r p, rmhist!p))\n | ((S4 rmhist p)$ & (? l. Write rmCh mm ires p l) & unchanged (e p, c p, r p, rmhist!p))\n | ((S5 rmhist p)$ & MemReturn rmCh ires p & unchanged (e p, c p, r p))\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context}) [@{thm S4EnvUnch}, @{thm S4ClerkUnch}, @{thm S4RPCUnch}]) 1 *})\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm RNext_def}]) []\n (@{thm squareE} ::\n map (temp_elim @{context}) [@{thm S4Read}, @{thm S4Write}, @{thm S4Return}]) 1 *})\n apply (auto dest!: S4Hist [temp_use])\n done\n\nlemma Step1_2_5: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p) & $S5 rmhist p\n --> ((S6 rmhist p)$ & RPCReply crCh rmCh rst p & unchanged (e p, c p, m p))\n | ((S6 rmhist p)$ & RPCFail crCh rmCh rst p & unchanged (e p, c p, m p))\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context}) [@{thm S5EnvUnch}, @{thm S5ClerkUnch}, @{thm S5MemUnch}, @{thm S5Hist}]) 1 *})\n apply (tactic {* action_simp_tac @{context} [] [@{thm squareE}, temp_elim @{context} @{thm S5RPC}] 1 *})\n using [[fast_solver]]\n apply (auto elim!: squareE [temp_use] dest!: S5Reply [temp_use] S5Fail [temp_use])\n done\n\nlemma Step1_2_6: \"|- [HNext rmhist p]_(c p,r p,m p, rmhist!p) & ImpNext p\n & ~unchanged (e p, c p, r p, m p, rmhist!p) & $S6 rmhist p\n --> ((S1 rmhist p)$ & MClkReply memCh crCh cst p & unchanged (e p, r p, m p))\n | ((S3 rmhist p)$ & MClkRetry memCh crCh cst p & unchanged (e p,r p,m p,rmhist!p))\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n (map (temp_elim @{context}) [@{thm S6EnvUnch}, @{thm S6RPCUnch}, @{thm S6MemUnch}]) 1 *})\n apply (tactic {* action_simp_tac @{context} []\n (@{thm squareE} :: map (temp_elim @{context}) [@{thm S6Clerk}, @{thm S6Retry}, @{thm S6Reply}]) 1 *})\n apply (auto dest: S6Hist [temp_use])\n done\n\n(* --------------------------------------------------------------------------\n Step 1.3: S1 implies the barred initial condition.\n*)\n\nsection \"Initialization (Step 1.3)\"\n\nlemma Step1_3: \"|- S1 rmhist p --> PInit (resbar rmhist) p\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm resbar_def},\n @{thm PInit_def}, @{thm S_def}, @{thm S1_def}]) [] [] 1 *})\n\n(* ----------------------------------------------------------------------\n Step 1.4: Implementation's next-state relation simulates specification's\n next-state relation (with appropriate substitutions)\n*)\n\nsection \"Step simulation (Step 1.4)\"\n\nlemma Step1_4_1: \"|- ENext p & $S1 rmhist p & (S2 rmhist p)$ & unchanged (c p, r p, m p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n using [[fast_solver]]\n by (auto elim!: squareE [temp_use] simp: c_def r_def m_def resbar_def)\n\nlemma Step1_4_2: \"|- MClkFwd memCh crCh cst p & $S2 rmhist p & (S3 rmhist p)$\n & unchanged (e p, r p, m p, rmhist!p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n by (tactic {* action_simp_tac\n (@{context} addsimps [@{thm MClkFwd_def}, @{thm e_def}, @{thm r_def}, @{thm m_def},\n @{thm resbar_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}]) [] [] 1 *})\n\nlemma Step1_4_3a: \"|- RPCFwd crCh rmCh rst p & $S3 rmhist p & (S4 rmhist p)$\n & unchanged (e p, c p, m p, rmhist!p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (drule S3_excl [temp_use] S4_excl [temp_use])+\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm e_def},\n @{thm c_def}, @{thm m_def}, @{thm resbar_def}, @{thm S_def}, @{thm S3_def}]) [] [] 1 *})\n done\n\nlemma Step1_4_3b: \"|- RPCFail crCh rmCh rst p & $S3 rmhist p & (S6 rmhist p)$\n & unchanged (e p, c p, m p)\n --> MemFail memCh (resbar rmhist) p\"\n apply clarsimp\n apply (drule S6_excl [temp_use])\n apply (auto simp: RPCFail_def MemFail_def e_def c_def m_def resbar_def)\n apply (force simp: S3_def S_def)\n apply (auto simp: Return_def)\n done\n\nlemma Step1_4_4a1: \"|- $S4 rmhist p & (S4 rmhist p)$ & ReadInner rmCh mm ires p l\n & unchanged (e p, c p, r p, rmhist!p) & $MemInv mm l\n --> ReadInner memCh mm (resbar rmhist) p l\"\n apply clarsimp\n apply (drule S4_excl [temp_use])+\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm ReadInner_def},\n @{thm GoodRead_def}, @{thm BadRead_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}]) [] [] 1 *})\n apply (auto simp: resbar_def)\n apply (tactic {* ALLGOALS (action_simp_tac\n (@{context} addsimps [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def},\n @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def}, @{thm MemInv_def}])\n [] [@{thm impE}, @{thm MemValNotAResultE}]) *})\n done\n\nlemma Step1_4_4a: \"|- Read rmCh mm ires p & $S4 rmhist p & (S4 rmhist p)$\n & unchanged (e p, c p, r p, rmhist!p) & (!l. $(MemInv mm l))\n --> Read memCh mm (resbar rmhist) p\"\n by (force simp: Read_def elim!: Step1_4_4a1 [temp_use])\n\nlemma Step1_4_4b1: \"|- $S4 rmhist p & (S4 rmhist p)$ & WriteInner rmCh mm ires p l v\n & unchanged (e p, c p, r p, rmhist!p)\n --> WriteInner memCh mm (resbar rmhist) p l v\"\n apply clarsimp\n apply (drule S4_excl [temp_use])+\n apply (tactic {* action_simp_tac (@{context} addsimps\n [@{thm WriteInner_def}, @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm e_def},\n @{thm c_def}, @{thm m_def}]) [] [] 1 *})\n apply (auto simp: resbar_def)\n apply (tactic {* ALLGOALS (action_simp_tac (@{context} addsimps\n [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def}, @{thm S_def},\n @{thm S4_def}, @{thm WrRequest_def}]) [] []) *})\n done\n\nlemma Step1_4_4b: \"|- Write rmCh mm ires p l & $S4 rmhist p & (S4 rmhist p)$\n & unchanged (e p, c p, r p, rmhist!p)\n --> Write memCh mm (resbar rmhist) p l\"\n by (force simp: Write_def elim!: Step1_4_4b1 [temp_use])\n\nlemma Step1_4_4c: \"|- MemReturn rmCh ires p & $S4 rmhist p & (S5 rmhist p)$\n & unchanged (e p, c p, r p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm e_def},\n @{thm c_def}, @{thm r_def}, @{thm resbar_def}]) [] [] 1 *})\n apply (drule S4_excl [temp_use] S5_excl [temp_use])+\n using [[fast_solver]]\n apply (auto elim!: squareE [temp_use] simp: MemReturn_def Return_def)\n done\n\nlemma Step1_4_5a: \"|- RPCReply crCh rmCh rst p & $S5 rmhist p & (S6 rmhist p)$\n & unchanged (e p, c p, m p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (drule S5_excl [temp_use] S6_excl [temp_use])+\n apply (auto simp: e_def c_def m_def resbar_def)\n apply (auto simp: RPCReply_def Return_def S5_def S_def dest!: MVOKBAnotRF [temp_use])\n done\n\nlemma Step1_4_5b: \"|- RPCFail crCh rmCh rst p & $S5 rmhist p & (S6 rmhist p)$\n & unchanged (e p, c p, m p)\n --> MemFail memCh (resbar rmhist) p\"\n apply clarsimp\n apply (drule S6_excl [temp_use])\n apply (auto simp: e_def c_def m_def RPCFail_def Return_def MemFail_def resbar_def)\n apply (auto simp: S5_def S_def)\n done\n\nlemma Step1_4_6a: \"|- MClkReply memCh crCh cst p & $S6 rmhist p & (S1 rmhist p)$\n & unchanged (e p, r p, m p)\n --> MemReturn memCh (resbar rmhist) p\"\n apply clarsimp\n apply (drule S6_excl [temp_use])+\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm e_def},\n @{thm r_def}, @{thm m_def}, @{thm MClkReply_def}, @{thm MemReturn_def},\n @{thm Return_def}, @{thm resbar_def}]) [] [] 1 *})\n apply simp_all (* simplify if-then-else *)\n apply (tactic {* ALLGOALS (action_simp_tac (@{context} addsimps\n [@{thm MClkReplyVal_def}, @{thm S6_def}, @{thm S_def}]) [] [@{thm MVOKBARFnotNR}]) *})\n done\n\nlemma Step1_4_6b: \"|- MClkRetry memCh crCh cst p & $S6 rmhist p & (S3 rmhist p)$\n & unchanged (e p, r p, m p, rmhist!p)\n --> MemFail memCh (resbar rmhist) p\"\n apply clarsimp\n apply (drule S3_excl [temp_use])+\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm e_def}, @{thm r_def},\n @{thm m_def}, @{thm MClkRetry_def}, @{thm MemFail_def}, @{thm resbar_def}]) [] [] 1 *})\n apply (auto simp: S6_def S_def)\n done\n\nlemma S_lemma: \"|- unchanged (e p, c p, r p, m p, rmhist!p)\n --> unchanged (S rmhist ec cc rc cs rs hs1 hs2 p)\"\n by (auto simp: e_def c_def r_def m_def caller_def rtrner_def S_def Calling_def)\n\nlemma Step1_4_7H: \"|- unchanged (e p, c p, r p, m p, rmhist!p)\n --> unchanged (rtrner memCh!p, S1 rmhist p, S2 rmhist p, S3 rmhist p,\n S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n apply clarsimp\n apply (rule conjI)\n apply (force simp: c_def)\n apply (force simp: S1_def S2_def S3_def S4_def S5_def S6_def intro!: S_lemma [temp_use])\n done\n\nlemma Step1_4_7: \"|- unchanged (e p, c p, r p, m p, rmhist!p)\n --> unchanged (rtrner memCh!p, resbar rmhist!p, S1 rmhist p, S2 rmhist p,\n S3 rmhist p, S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n apply (rule actionI)\n apply (unfold action_rews)\n apply (rule impI)\n apply (frule Step1_4_7H [temp_use])\n apply (auto simp: e_def c_def r_def m_def rtrner_def resbar_def)\n done\n\n(* Frequently needed abbreviation: distinguish between idling and non-idling\n steps of the implementation, and try to solve the idling case by simplification\n*)\nML {*\nfun split_idle_tac ctxt =\n SELECT_GOAL\n (TRY (rtac @{thm actionI} 1) THEN\n Induct_Tacs.case_tac ctxt \"(s,t) |= unchanged (e p, c p, r p, m p, rmhist!p)\" 1 THEN\n rewrite_goals_tac ctxt @{thms action_rews} THEN\n forward_tac [temp_use ctxt @{thm Step1_4_7}] 1 THEN\n asm_full_simp_tac ctxt 1);\n*}\n\nmethod_setup split_idle = {*\n Method.sections (Simplifier.simp_modifiers @ Splitter.split_modifiers)\n >> (K (SIMPLE_METHOD' o split_idle_tac))\n*}\n\n(* ----------------------------------------------------------------------\n Combine steps 1.2 and 1.4 to prove that the implementation satisfies\n the specification's next-state relation.\n*)\n\n(* Steps that leave all variables unchanged are safe, so I may assume\n that some variable changes in the proof that a step is safe. *)\nlemma unchanged_safe: \"|- (~unchanged (e p, c p, r p, m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p))\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply (split_idle simp: square_def)\n apply force\n done\n(* turn into (unsafe, looping!) introduction rule *)\nlemmas unchanged_safeI = impI [THEN unchanged_safe [action_use]]\n\nlemma S1safe: \"|- $S1 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (rule idle_squareI)\n apply (auto dest!: Step1_2_1 [temp_use] Step1_4_1 [temp_use])\n done\n\nlemma S2safe: \"|- $S2 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (rule idle_squareI)\n apply (auto dest!: Step1_2_2 [temp_use] Step1_4_2 [temp_use])\n done\n\nlemma S3safe: \"|- $S3 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (auto dest!: Step1_2_3 [temp_use])\n apply (auto simp: square_def UNext_def dest!: Step1_4_3a [temp_use] Step1_4_3b [temp_use])\n done\n\nlemma S4safe: \"|- $S4 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n & (!l. $(MemInv mm l))\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (auto dest!: Step1_2_4 [temp_use])\n apply (auto simp: square_def UNext_def RNext_def\n dest!: Step1_4_4a [temp_use] Step1_4_4b [temp_use] Step1_4_4c [temp_use])\n done\n\nlemma S5safe: \"|- $S5 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (auto dest!: Step1_2_5 [temp_use])\n apply (auto simp: square_def UNext_def dest!: Step1_4_5a [temp_use] Step1_4_5b [temp_use])\n done\n\nlemma S6safe: \"|- $S6 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n apply clarsimp\n apply (rule unchanged_safeI)\n apply (auto dest!: Step1_2_6 [temp_use])\n apply (auto simp: square_def UNext_def RNext_def\n dest!: Step1_4_6a [temp_use] Step1_4_6b [temp_use])\n done\n\n(* ----------------------------------------------------------------------\n Step 1.5: Temporal refinement proof, based on previous steps.\n*)\n\nsection \"The liveness part\"\n\n(* Liveness assertions for the different implementation states, based on the\n fairness conditions. Prove subgoals of WF1 / SF1 rules as separate lemmas\n for readability. Reuse action proofs from safety part.\n*)\n\n(* ------------------------------ State S1 ------------------------------ *)\n\nlemma S1_successors: \"|- $S1 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> (S1 rmhist p)$ | (S2 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_1 [temp_use])\n done\n\n(* Show that the implementation can satisfy the high-level fairness requirements\n by entering the state S1 infinitely often.\n*)\n\nlemma S1_RNextdisabled: \"|- S1 rmhist p -->\n ~Enabled (_(rtrner memCh!p, resbar rmhist!p))\"\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm angle_def},\n @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}, temp_elim @{context} @{thm Memoryidle}] 1 *})\n apply force\n done\n\nlemma S1_Returndisabled: \"|- S1 rmhist p -->\n ~Enabled (_(rtrner memCh!p, resbar rmhist!p))\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm angle_def}, @{thm MemReturn_def},\n @{thm Return_def}, @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}] 1 *})\n\nlemma RNext_fair: \"|- []<>S1 rmhist p\n --> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n by (auto simp: WF_alt [try_rewrite] intro!: S1_RNextdisabled [temp_use]\n elim!: STL4E [temp_use] DmdImplE [temp_use])\n\nlemma Return_fair: \"|- []<>S1 rmhist p\n --> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n by (auto simp: WF_alt [try_rewrite]\n intro!: S1_Returndisabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n\n(* ------------------------------ State S2 ------------------------------ *)\n\nlemma S2_successors: \"|- $S2 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> (S2 rmhist p)$ | (S3 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_2 [temp_use])\n done\n\nlemma S2MClkFwd_successors: \"|- ($S2 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & _(c p)\n --> (S3 rmhist p)$\"\n by (auto simp: angle_def dest!: Step1_2_2 [temp_use])\n\nlemma S2MClkFwd_enabled: \"|- $S2 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> $Enabled (_(c p))\"\n apply (auto simp: c_def intro!: MClkFwd_ch_enabled [temp_use] MClkFwd_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (simp_all add: S_def S2_def)\n done\n\nlemma S2_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & WF(MClkFwd memCh crCh cst p)_(c p)\n --> (S2 rmhist p ~> S3 rmhist p)\"\n by (rule WF1 S2_successors S2MClkFwd_successors S2MClkFwd_enabled)+\n\n(* ------------------------------ State S3 ------------------------------ *)\n\nlemma S3_successors: \"|- $S3 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> (S3 rmhist p)$ | (S4 rmhist p | S6 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_3 [temp_use])\n done\n\nlemma S3RPC_successors: \"|- ($S3 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & _(r p)\n --> (S4 rmhist p | S6 rmhist p)$\"\n apply (auto simp: angle_def dest!: Step1_2_3 [temp_use])\n done\n\nlemma S3RPC_enabled: \"|- $S3 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> $Enabled (_(r p))\"\n apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (simp_all add: S_def S3_def)\n done\n\nlemma S3_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & WF(RPCNext crCh rmCh rst p)_(r p)\n --> (S3 rmhist p ~> S4 rmhist p | S6 rmhist p)\"\n by (rule WF1 S3_successors S3RPC_successors S3RPC_enabled)+\n\n(* ------------- State S4 -------------------------------------------------- *)\n\nlemma S4_successors: \"|- $S4 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n & (ALL l. $MemInv mm l)\n --> (S4 rmhist p)$ | (S5 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_4 [temp_use])\n done\n\n(* --------- State S4a: S4 /\\ (ires p = NotAResult) ------------------------ *)\n\nlemma S4a_successors: \"|- $(S4 rmhist p & ires!p = #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p,rmhist!p) & (ALL l. $MemInv mm l)\n --> (S4 rmhist p & ires!p = #NotAResult)$\n | ((S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_4 [temp_use])\n done\n\nlemma S4aRNext_successors: \"|- ($(S4 rmhist p & ires!p = #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p,rmhist!p) & (ALL l. $MemInv mm l))\n & _(m p)\n --> ((S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p)$\"\n by (auto simp: angle_def\n dest!: Step1_2_4 [temp_use] ReadResult [temp_use] WriteResult [temp_use])\n\nlemma S4aRNext_enabled: \"|- $(S4 rmhist p & ires!p = #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p) & (ALL l. $MemInv mm l)\n --> $Enabled (_(m p))\"\n apply (auto simp: m_def intro!: RNext_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (simp add: S_def S4_def)\n done\n\nlemma S4a_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n & (ALL l. $MemInv mm l)) & WF(RNext rmCh mm ires p)_(m p)\n --> (S4 rmhist p & ires!p = #NotAResult\n ~> (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p)\"\n by (rule WF1 S4a_successors S4aRNext_successors S4aRNext_enabled)+\n\n(* ---------- State S4b: S4 /\\ (ires p # NotAResult) --------------------------- *)\n\nlemma S4b_successors: \"|- $(S4 rmhist p & ires!p ~= #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p) & (ALL l. $MemInv mm l)\n --> (S4 rmhist p & ires!p ~= #NotAResult)$ | (S5 rmhist p)$\"\n apply (split_idle simp: m_def)\n apply (auto dest!: WriteResult [temp_use] Step1_2_4 [temp_use] ReadResult [temp_use])\n done\n\nlemma S4bReturn_successors: \"|- ($(S4 rmhist p & ires!p ~= #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n & (ALL l. $MemInv mm l)) & _(m p)\n --> (S5 rmhist p)$\"\n by (force simp: angle_def dest!: Step1_2_4 [temp_use] dest: ReturnNotReadWrite [temp_use])\n\nlemma S4bReturn_enabled: \"|- $(S4 rmhist p & ires!p ~= #NotAResult)\n & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n & (ALL l. $MemInv mm l)\n --> $Enabled (_(m p))\"\n apply (auto simp: m_def intro!: MemReturn_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (simp add: S_def S4_def)\n done\n\nlemma S4b_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p) & (!l. $MemInv mm l))\n & WF(MemReturn rmCh ires p)_(m p)\n --> (S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p)\"\n by (rule WF1 S4b_successors S4bReturn_successors S4bReturn_enabled)+\n\n(* ------------------------------ State S5 ------------------------------ *)\n\nlemma S5_successors: \"|- $S5 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> (S5 rmhist p)$ | (S6 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_5 [temp_use])\n done\n\nlemma S5RPC_successors: \"|- ($S5 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & _(r p)\n --> (S6 rmhist p)$\"\n by (auto simp: angle_def dest!: Step1_2_5 [temp_use])\n\nlemma S5RPC_enabled: \"|- $S5 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> $Enabled (_(r p))\"\n apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (simp_all add: S_def S5_def)\n done\n\nlemma S5_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & WF(RPCNext crCh rmCh rst p)_(r p)\n --> (S5 rmhist p ~> S6 rmhist p)\"\n by (rule WF1 S5_successors S5RPC_successors S5RPC_enabled)+\n\n(* ------------------------------ State S6 ------------------------------ *)\n\nlemma S6_successors: \"|- $S6 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n --> (S1 rmhist p)$ | (S3 rmhist p)$ | (S6 rmhist p)$\"\n apply split_idle\n apply (auto dest!: Step1_2_6 [temp_use])\n done\n\nlemma S6MClkReply_successors:\n \"|- ($S6 rmhist p & ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n & _(c p)\n --> (S1 rmhist p)$\"\n by (auto simp: angle_def dest!: Step1_2_6 [temp_use] MClkReplyNotRetry [temp_use])\n\nlemma MClkReplyS6:\n \"|- $ImpInv rmhist p & _(c p) --> $S6 rmhist p\"\n by (tactic {* action_simp_tac (@{context} addsimps [@{thm angle_def},\n @{thm MClkReply_def}, @{thm Return_def}, @{thm ImpInv_def}, @{thm S_def},\n @{thm S1_def}, @{thm S2_def}, @{thm S3_def}, @{thm S4_def}, @{thm S5_def}]) [] [] 1 *})\n\nlemma S6MClkReply_enabled: \"|- S6 rmhist p --> Enabled (_(c p))\"\n apply (auto simp: c_def intro!: MClkReply_enabled [temp_use])\n apply (cut_tac MI_base)\n apply (blast dest: base_pair)\n apply (tactic {* ALLGOALS (action_simp_tac (@{context}\n addsimps [@{thm S_def}, @{thm S6_def}]) [] []) *})\n done\n\nlemma S6_live: \"|- [](ImpNext p & [HNext rmhist p]_(c p,r p,m p, rmhist!p) & $(ImpInv rmhist p))\n & SF(MClkReply memCh crCh cst p)_(c p) & []<>(S6 rmhist p)\n --> []<>(S1 rmhist p)\"\n apply clarsimp\n apply (subgoal_tac \"sigma |= []<> (_ (c p))\")\n apply (erule InfiniteEnsures)\n apply assumption\n apply (tactic {* action_simp_tac @{context} []\n (map (temp_elim @{context}) [@{thm MClkReplyS6}, @{thm S6MClkReply_successors}]) 1 *})\n apply (auto simp: SF_def)\n apply (erule contrapos_np)\n apply (auto intro!: S6MClkReply_enabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n done\n\n(* --------------- aggregate leadsto properties----------------------------- *)\n\nlemma S5S6LeadstoS6: \"sigma |= S5 rmhist p ~> S6 rmhist p\n ==> sigma |= (S5 rmhist p | S6 rmhist p) ~> S6 rmhist p\"\n by (auto intro!: LatticeDisjunctionIntro [temp_use] LatticeReflexivity [temp_use])\n\nlemma S4bS5S6LeadstoS6: \"[| sigma |= S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p;\n sigma |= S5 rmhist p ~> S6 rmhist p |]\n ==> sigma |= (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p | S6 rmhist p\n ~> S6 rmhist p\"\n by (auto intro!: LatticeDisjunctionIntro [temp_use]\n S5S6LeadstoS6 [temp_use] intro: LatticeTransitivity [temp_use])\n\nlemma S4S5S6LeadstoS6: \"[| sigma |= S4 rmhist p & ires!p = #NotAResult\n ~> (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p;\n sigma |= S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p;\n sigma |= S5 rmhist p ~> S6 rmhist p |]\n ==> sigma |= S4 rmhist p | S5 rmhist p | S6 rmhist p ~> S6 rmhist p\"\n apply (subgoal_tac \"sigma |= (S4 rmhist p & ires!p = #NotAResult) |\n (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p | S6 rmhist p ~> S6 rmhist p\")\n apply (erule_tac G = \"PRED ((S4 rmhist p & ires!p = #NotAResult) |\n (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p | S6 rmhist p)\" in\n LatticeTransitivity [temp_use])\n apply (force simp: Init_defs intro!: ImplLeadsto_gen [temp_use] necT [temp_use])\n apply (rule LatticeDisjunctionIntro [temp_use])\n apply (erule LatticeTransitivity [temp_use])\n apply (erule LatticeTriangle2 [temp_use])\n apply assumption\n apply (auto intro!: S4bS5S6LeadstoS6 [temp_use])\n done\n\nlemma S3S4S5S6LeadstoS6: \"[| sigma |= S3 rmhist p ~> S4 rmhist p | S6 rmhist p;\n sigma |= S4 rmhist p & ires!p = #NotAResult\n ~> (S4 rmhist p & ires!p ~= #NotAResult) | S5 rmhist p;\n sigma |= S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p;\n sigma |= S5 rmhist p ~> S6 rmhist p |]\n ==> sigma |= S3 rmhist p | S4 rmhist p | S5 rmhist p | S6 rmhist p ~> S6 rmhist p\"\n apply (rule LatticeDisjunctionIntro [temp_use])\n apply (erule LatticeTriangle2 [temp_use])\n apply (rule S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n apply (auto intro!: S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n done\n\nlemma S2S3S4S5S6LeadstoS6: \"[| sigma |= S2 rmhist p ~> S3 rmhist p;\n sigma |= S3 rmhist p ~> S4 rmhist p | S6 rmhist p;\n sigma |= S4 rmhist p & ires!p = #NotAResult\n ~> S4 rmhist p & ires!p ~= #NotAResult | S5 rmhist p;\n sigma |= S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p;\n sigma |= S5 rmhist p ~> S6 rmhist p |]\n ==> sigma |= S2 rmhist p | S3 rmhist p | S4 rmhist p | S5 rmhist p | S6 rmhist p\n ~> S6 rmhist p\"\n apply (rule LatticeDisjunctionIntro [temp_use])\n apply (rule LatticeTransitivity [temp_use])\n prefer 2 apply assumption\n apply (rule S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n apply (auto intro!: S3S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n done\n\nlemma NotS1LeadstoS6: \"[| sigma |= []ImpInv rmhist p;\n sigma |= S2 rmhist p ~> S3 rmhist p;\n sigma |= S3 rmhist p ~> S4 rmhist p | S6 rmhist p;\n sigma |= S4 rmhist p & ires!p = #NotAResult\n ~> S4 rmhist p & ires!p ~= #NotAResult | S5 rmhist p;\n sigma |= S4 rmhist p & ires!p ~= #NotAResult ~> S5 rmhist p;\n sigma |= S5 rmhist p ~> S6 rmhist p |]\n ==> sigma |= ~S1 rmhist p ~> S6 rmhist p\"\n apply (rule S2S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n apply assumption+\n apply (erule INV_leadsto [temp_use])\n apply (rule ImplLeadsto_gen [temp_use])\n apply (rule necT [temp_use])\n apply (auto simp: ImpInv_def Init_defs intro!: necT [temp_use])\n done\n\nlemma S1Infinite: \"[| sigma |= ~S1 rmhist p ~> S6 rmhist p;\n sigma |= []<>S6 rmhist p --> []<>S1 rmhist p |]\n ==> sigma |= []<>S1 rmhist p\"\n apply (rule classical)\n apply (tactic {* asm_lr_simp_tac (@{context} addsimps\n [temp_use @{context} @{thm NotBox}, temp_rewrite @{context} @{thm NotDmd}]) 1 *})\n apply (auto elim!: leadsto_infinite [temp_use] mp dest!: DBImplBD [temp_use])\n done\n\nsection \"Refinement proof (step 1.5)\"\n\n(* Prove invariants of the implementation:\n a. memory invariant\n b. \"implementation invariant\": always in states S1,...,S6\n*)\nlemma Step1_5_1a: \"|- IPImp p --> (ALL l. []$MemInv mm l)\"\n by (auto simp: IPImp_def box_stp_act [temp_use] intro!: MemoryInvariantAll [temp_use])\n\nlemma Step1_5_1b: \"|- Init(ImpInit p & HInit rmhist p) & [](ImpNext p)\n & [][HNext rmhist p]_(c p, r p, m p, rmhist!p) & [](ALL l. $MemInv mm l)\n --> []ImpInv rmhist p\"\n apply invariant\n apply (auto simp: Init_def ImpInv_def box_stp_act [temp_use]\n dest!: Step1_1 [temp_use] dest: S1_successors [temp_use] S2_successors [temp_use]\n S3_successors [temp_use] S4_successors [temp_use] S5_successors [temp_use]\n S6_successors [temp_use])\n done\n\n(*** Initialization ***)\nlemma Step1_5_2a: \"|- Init(ImpInit p & HInit rmhist p) --> Init(PInit (resbar rmhist) p)\"\n by (auto simp: Init_def intro!: Step1_1 [temp_use] Step1_3 [temp_use])\n\n(*** step simulation ***)\nlemma Step1_5_2b: \"|- [](ImpNext p & [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n & $ImpInv rmhist p & (!l. $MemInv mm l))\n --> [][UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n by (auto simp: ImpInv_def elim!: STL4E [temp_use]\n dest!: S1safe [temp_use] S2safe [temp_use] S3safe [temp_use] S4safe [temp_use]\n S5safe [temp_use] S6safe [temp_use])\n\n(*** Liveness ***)\nlemma GoodImpl: \"|- IPImp p & HistP rmhist p\n --> Init(ImpInit p & HInit rmhist p)\n & [](ImpNext p & [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & [](ALL l. $MemInv mm l) & []($ImpInv rmhist p)\n & ImpLive p\"\n apply clarsimp\n apply (subgoal_tac \"sigma |= Init (ImpInit p & HInit rmhist p) & [] (ImpNext p) &\n [][HNext rmhist p]_ (c p, r p, m p, rmhist!p) & [] (ALL l. $MemInv mm l)\")\n apply (auto simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n dest!: Step1_5_1b [temp_use])\n apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n ImpLive_def c_def r_def m_def)\n apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n HistP_def Init_def ImpInit_def)\n apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n ImpNext_def c_def r_def m_def split_box_conj [temp_use])\n apply (force simp: HistP_def)\n apply (force simp: allT [temp_use] dest!: Step1_5_1a [temp_use])\n done\n\n(* The implementation is infinitely often in state S1... *)\nlemma Step1_5_3a: \"|- [](ImpNext p & [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & [](ALL l. $MemInv mm l)\n & []($ImpInv rmhist p) & ImpLive p\n --> []<>S1 rmhist p\"\n apply (clarsimp simp: ImpLive_def)\n apply (rule S1Infinite)\n apply (force simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n intro!: NotS1LeadstoS6 [temp_use] S2_live [temp_use] S3_live [temp_use]\n S4a_live [temp_use] S4b_live [temp_use] S5_live [temp_use])\n apply (auto simp: split_box_conj [temp_use] intro!: S6_live [temp_use])\n done\n\n(* ... and therefore satisfies the fairness requirements of the specification *)\nlemma Step1_5_3b: \"|- [](ImpNext p & [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & [](ALL l. $MemInv mm l) & []($ImpInv rmhist p) & ImpLive p\n --> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n by (auto intro!: RNext_fair [temp_use] Step1_5_3a [temp_use])\n\nlemma Step1_5_3c: \"|- [](ImpNext p & [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & [](ALL l. $MemInv mm l) & []($ImpInv rmhist p) & ImpLive p\n --> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n by (auto intro!: Return_fair [temp_use] Step1_5_3a [temp_use])\n\n(* QED step of step 1 *)\nlemma Step1: \"|- IPImp p & HistP rmhist p --> UPSpec memCh mm (resbar rmhist) p\"\n by (auto simp: UPSpec_def split_box_conj [temp_use]\n dest!: GoodImpl [temp_use] intro!: Step1_5_2a [temp_use] Step1_5_2b [temp_use]\n Step1_5_3b [temp_use] Step1_5_3c [temp_use])\n\n(* ------------------------------ Step 2 ------------------------------ *)\nsection \"Step 2\"\n\nlemma Step2_2a: \"|- Write rmCh mm ires p l & ImpNext p\n & [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n & $ImpInv rmhist p\n --> (S4 rmhist p)$ & unchanged (e p, c p, r p, rmhist!p)\"\n apply clarsimp\n apply (drule WriteS4 [action_use])\n apply assumption\n apply split_idle\n apply (auto simp: ImpNext_def dest!: S4EnvUnch [temp_use] S4ClerkUnch [temp_use]\n S4RPCUnch [temp_use])\n apply (auto simp: square_def dest: S4Write [temp_use])\n done\n\nlemma Step2_2: \"|- (ALL p. ImpNext p)\n & (ALL p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & (ALL p. $ImpInv rmhist p)\n & [EX q. Write rmCh mm ires q l]_(mm!l)\n --> [EX q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n apply (auto intro!: squareCI elim!: squareE)\n apply (assumption | rule exI Step1_4_4b [action_use])+\n apply (force intro!: WriteS4 [temp_use])\n apply (auto dest!: Step2_2a [temp_use])\n done\n\nlemma Step2_lemma: \"|- []( (ALL p. ImpNext p)\n & (ALL p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n & (ALL p. $ImpInv rmhist p)\n & [EX q. Write rmCh mm ires q l]_(mm!l))\n --> [][EX q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n by (force elim!: STL4E [temp_use] dest!: Step2_2 [temp_use])\n\nlemma Step2: \"|- #l : #MemLoc & (ALL p. IPImp p & HistP rmhist p)\n --> MSpec memCh mm (resbar rmhist) l\"\n apply (auto simp: MSpec_def)\n apply (force simp: IPImp_def MSpec_def)\n apply (auto intro!: Step2_lemma [temp_use] simp: split_box_conj [temp_use] all_box [temp_use])\n prefer 4\n apply (force simp: IPImp_def MSpec_def)\n apply (auto simp: split_box_conj [temp_use] elim!: allE dest!: GoodImpl [temp_use])\n done\n\n(* ----------------------------- Main theorem --------------------------------- *)\nsection \"Memory implementation\"\n\n(* The combination of a legal caller, the memory clerk, the RPC component,\n and a reliable memory implement the unreliable memory.\n*)\n\n(* Implementation of internal specification by combination of implementation\n and history variable with explicit refinement mapping\n*)\nlemma Impl_IUSpec: \"|- Implementation & Hist rmhist --> IUSpec memCh mm (resbar rmhist)\"\n by (auto simp: IUSpec_def Implementation_def IPImp_def MClkISpec_def\n RPCISpec_def IRSpec_def Hist_def intro!: Step1 [temp_use] Step2 [temp_use])\n\n(* The main theorem: introduce hiding and eliminate history variable. *)\nlemma Implementation: \"|- Implementation --> USpec memCh\"\n apply clarsimp\n apply (frule History [temp_use])\n apply (auto simp: USpec_def intro: eexI [temp_use] Impl_IUSpec [temp_use]\n MI_base [temp_use] elim!: eexE)\n done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/TLA/Memory/MemoryImplementation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.26693672851995126}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory MoreCorres\nimports \"../../lib/ExtraCorres\"\nbegin\n\n(* FIXME: move all of this into ExtraCorres *)\n\n(*\n * If both systems perform non-determinism where the splits are\n * equivalent, we can prove each pair separately.\n *)\nlemma corres_alternate_match:\n \"\\ corres_underlying sr nf nf' r P P' a c;\n corres_underlying sr nf nf' r P P' b d \\ \\\n corres_underlying sr nf nf' r P P' (a \\ b) (c \\ d)\"\n apply (simp add: corres_underlying_def alternative_def)\n apply (clarsimp)\n apply (drule (1) bspec, clarsimp)+\n apply fastforce\n done\n\n(*\n * If the concrete system performs non-determinism where the abstract\n * system does not, we must show that both branches of the concrete\n * system refine the abstract system.\n *)\nlemma corres_alternate_split:\n \"\\ corres_underlying sr nf nf' r P Q a x;\n corres_underlying sr nf nf' r P' Q' a y \\ \\\n corres_underlying sr nf nf' r (P and P') (Q and Q') a (x \\ y)\"\n apply (simp add: corres_underlying_def alternative_def)\n apply (clarsimp)\n apply (drule (1) bspec, clarsimp)+\n apply fastforce\n done\n\n(*\n * Two select statements are equivalent if the concrete's select set is\n * a subset of the abstract's select set.\n *)\nlemma corres_select_equiv:\n \"\\ \\a' \\ A'. \\a \\ A. r a a' \\ \\ corres_underlying sr nf nf' r \\ \\ (select A) (select A')\"\n apply (clarsimp simp: corres_underlying_def)\n apply (clarsimp simp: split_def)\n apply (clarsimp simp: select_def)\n done\n\n(*\n * Where there is an 'if' statement in the concrete system not present\n * in the abstract system, we must show that both branches are a valid\n * refinement. Happily, we get to assume the outcome of the 'if'\n * statement when proving the refinement.\n *\n * This will likely need to be used with 'stronger_corres_guard_imp'.\n *)\nlemma corres_if_rhs:\n \"\\ G \\ corres_underlying sr nf nf' rvr P Q a b;\n \\G \\ corres_underlying sr nf nf' rvr P' Q' a c \\ \\\n corres_underlying sr nf nf' rvr\n (\\s. (G \\ P s) \\ (\\G \\ P' s)) (\\s. (G \\ Q s) \\ (\\G \\ Q' s))\n a (if G then b else c)\"\n by (auto elim: corres_guard_imp)\n\n(* Bind distributes over non-deterministic choice. *)\nlemma alternative_bind_distrib: \"((f \\ g) >>= h) = ((f >>= h) \\ (g >>= h))\"\n apply (auto simp: alternative_def bind_def split_def intro!: prod_eqI)\n done\n\n(* Bind distributes over non-deterministic choice. *)\nlemma alternative_bind_distrib_2: \"(do f; (a \\ b) od) = ((do f; a od) \\ (do f; b od))\"\n apply (auto simp: alternative_def bind_def split_def intro!: prod_eqI)\n done\n\n(* \"bindE\" distributes over non-deterministic choice. *)\nlemma alternative_bindE_distrib: \"((f \\ g) >>=E h) = ((f >>=E h) \\ (g >>=E h))\"\n by (simp add: bindE_def alternative_bind_distrib)\n\n(*\n * Two arbitrary return statements correspond if our return relation\n * doesn't care about them.\n *)\nlemma corres_return_dc [simp]:\n \"corres_underlying sr nf nf' dc \\ \\ (return a) (return b)\"\n apply (clarsimp simp: corres_underlying_def dc_def return_def)\n done\n\n(* If our return relation doesn't matter, return statements are meaningless. *)\nlemma corres_return_dc_rhs:\n \"corres_underlying sr nf nf' dc G G' P P' \\ corres_underlying sr nf nf' dc G G' P (do P'; return a od)\"\n by (fastforce simp: corres_underlying_def dc_def return_def bind_def)\n\n(* If our return relation doesn't matter, return statements are meaningless. *)\nlemma corres_return_dc_lhs:\n \"corres_underlying sr nf nf' dc G G' P P' \\ corres_underlying sr nf nf' dc G G' (do P; return a od) P'\"\n apply (case_tac nf)\n apply (clarsimp simp: corres_underlying_def dc_def return_def bind_def, force)\n apply (clarsimp simp: corres_underlying_def dc_def return_def bind_def, force) (* slow 10s *)\n done\n\n(* liftE distributes inside bind. *)\nlemma liftE_distrib: \"(liftE (A >>= (\\_. B))) = ((liftE A) >>=E (\\x. (liftE B)))\"\n apply (clarsimp simp: liftE_def bindE_def)\n apply (subst bind_assoc)+\n apply (clarsimp simp: bind_def lift_def)\n done\n\n(* liftE distributes inside alternate. *)\nlemma liftE_alternative_distrib: \"(liftE (a \\ b)) = ((liftE a) \\ (liftE b))\"\n by (metis alternative_bind_distrib bindE_returnOk liftE_bindE)\n\nlemma corres_skip_catch:\n \"corres_underlying sr nf nf' dc P P' f g \\\n corres_underlying sr nf nf' dc P P' f (g (\\_. return x))\"\n by (clarsimp simp: corres_underlying_def catch_def return_def bind_def \n split_def \n split: sum.splits)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/drefine/MoreCorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.2669302623169275}} {"text": "(* Title: HOL/Auth/CertifiedEmail.thy\n Author: Giampaolo Bella, Christiano Longo and Lawrence C Paulson\n*)\n\nsection\\The Certified Electronic Mail Protocol by Abadi et al.\\\n\ntheory CertifiedEmail imports Public begin\n\nabbreviation\n TTP :: agent where\n \"TTP == Server\"\n\nabbreviation\n RPwd :: \"agent \\ key\" where\n \"RPwd == shrK\"\n\n \n(*FIXME: the four options should be represented by pairs of 0 or 1.\n Right now only BothAuth is modelled.*)\nconsts\n NoAuth :: nat\n TTPAuth :: nat\n SAuth :: nat\n BothAuth :: nat\n\ntext\\We formalize a fixed way of computing responses. Could be better.\\\ndefinition \"response\" :: \"agent \\ agent \\ nat \\ msg\" where\n \"response S R q == Hash \\Agent S, Key (shrK R), Nonce q\\\"\n\n\ninductive_set certified_mail :: \"event list set\"\n where\n\n Nil: \\ \\The empty trace\\\n \"[] \\ certified_mail\"\n\n| Fake: \\ \\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"\\evsf \\ certified_mail; X \\ synth(analz(spies evsf))\\ \n \\ Says Spy B X # evsf \\ certified_mail\"\n\n| FakeSSL: \\ \\The Spy may open SSL sessions with TTP, who is the only agent\n equipped with the necessary credentials to serve as an SSL server.\\\n \"\\evsfssl \\ certified_mail; X \\ synth(analz(spies evsfssl))\\\n \\ Notes TTP \\Agent Spy, Agent TTP, X\\ # evsfssl \\ certified_mail\"\n\n| CM1: \\ \\The sender approaches the recipient. The message is a number.\\\n \"\\evs1 \\ certified_mail;\n Key K \\ used evs1;\n K \\ symKeys;\n Nonce q \\ used evs1;\n hs = Hash\\Number cleartext, Nonce q, response S R q, Crypt K (Number m)\\;\n S2TTP = Crypt(pubEK TTP) \\Agent S, Number BothAuth, Key K, Agent R, hs\\\\\n \\ Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number BothAuth, \n Number cleartext, Nonce q, S2TTP\\ # evs1 \n \\ certified_mail\"\n\n| CM2: \\ \\The recipient records \\<^term>\\S2TTP\\ while transmitting it and her\n password to \\<^term>\\TTP\\ over an SSL channel.\\\n \"\\evs2 \\ certified_mail;\n Gets R \\Agent S, Agent TTP, em, Number BothAuth, Number cleartext, \n Nonce q, S2TTP\\ \\ set evs2;\n TTP \\ R; \n hr = Hash \\Number cleartext, Nonce q, response S R q, em\\\\\n \\ \n Notes TTP \\Agent R, Agent TTP, S2TTP, Key(RPwd R), hr\\ # evs2\n \\ certified_mail\"\n\n| CM3: \\ \\\\<^term>\\TTP\\ simultaneously reveals the key to the recipient and gives\n a receipt to the sender. The SSL channel does not authenticate \n the client (\\<^term>\\R\\), but \\<^term>\\TTP\\ accepts the message only \n if the given password is that of the claimed sender, \\<^term>\\R\\.\n He replies over the established SSL channel.\\\n \"\\evs3 \\ certified_mail;\n Notes TTP \\Agent R, Agent TTP, S2TTP, Key(RPwd R), hr\\ \\ set evs3;\n S2TTP = Crypt (pubEK TTP) \n \\Agent S, Number BothAuth, Key k, Agent R, hs\\;\n TTP \\ R; hs = hr; k \\ symKeys\\\n \\ \n Notes R \\Agent TTP, Agent R, Key k, hr\\ # \n Gets S (Crypt (priSK TTP) S2TTP) # \n Says TTP S (Crypt (priSK TTP) S2TTP) # evs3 \\ certified_mail\"\n\n| Reception:\n \"\\evsr \\ certified_mail; Says A B X \\ set evsr\\\n \\ Gets B X#evsr \\ certified_mail\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare analz_into_parts [dest]\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"\\Key K \\ used []; K \\ symKeys\\ \\ \n \\S2TTP. \\evs \\ certified_mail.\n Says TTP S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] certified_mail.Nil\n [THEN certified_mail.CM1, THEN certified_mail.Reception,\n THEN certified_mail.CM2, \n THEN certified_mail.CM3]) \napply (possibility, auto) \ndone\n\n\nlemma Gets_imp_Says:\n \"\\Gets B X \\ set evs; evs \\ certified_mail\\ \\ \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, auto)\ndone\n\n\nlemma Gets_imp_parts_knows_Spy:\n \"\\Gets A X \\ set evs; evs \\ certified_mail\\ \\ X \\ parts(spies evs)\"\napply (drule Gets_imp_Says, simp)\napply (blast dest: Says_imp_knows_Spy parts.Inj) \ndone\n\nlemma CM2_S2TTP_analz_knows_Spy:\n \"\\Gets R \\Agent A, Agent B, em, Number AO, Number cleartext, \n Nonce q, S2TTP\\ \\ set evs;\n evs \\ certified_mail\\ \n \\ S2TTP \\ analz(spies evs)\"\napply (drule Gets_imp_Says, simp) \napply (blast dest: Says_imp_knows_Spy analz.Inj) \ndone\n\nlemmas CM2_S2TTP_parts_knows_Spy = \n CM2_S2TTP_analz_knows_Spy [THEN analz_subset_parts [THEN subsetD]]\n\nlemma hr_form_lemma [rule_format]:\n \"evs \\ certified_mail\n \\ hr \\ synth (analz (spies evs)) \\\n (\\S2TTP. Notes TTP \\Agent R, Agent TTP, S2TTP, pwd, hr\\\n \\ set evs \\\n (\\clt q S em. hr = Hash \\Number clt, Nonce q, response S R q, em\\))\"\napply (erule certified_mail.induct)\napply (synth_analz_mono_contra, simp_all, blast+)\ndone \n\ntext\\Cannot strengthen the first disjunct to \\<^term>\\R\\Spy\\ because\nthe fakessl rule allows Spy to spoof the sender's name. Maybe can\nstrengthen the second disjunct with \\<^term>\\R\\Spy\\.\\\nlemma hr_form:\n \"\\Notes TTP \\Agent R, Agent TTP, S2TTP, pwd, hr\\ \\ set evs;\n evs \\ certified_mail\\\n \\ hr \\ synth (analz (spies evs)) | \n (\\clt q S em. hr = Hash \\Number clt, Nonce q, response S R q, em\\)\"\nby (blast intro: hr_form_lemma) \n\nlemma Spy_dont_know_private_keys [dest!]:\n \"\\Key (privateKey b A) \\ parts (spies evs); evs \\ certified_mail\\\n \\ A \\ bad\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\\napply (blast dest: Fake_parts_insert_in_Un) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \n apply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD] \n analz_subset_parts [THEN subsetD], blast) \ndone\n\nlemma Spy_know_private_keys_iff [simp]:\n \"evs \\ certified_mail\n \\ (Key (privateKey b A) \\ parts (spies evs)) = (A \\ bad)\"\nby blast \n\nlemma Spy_dont_know_TTPKey_parts [simp]:\n \"evs \\ certified_mail \\ Key (privateKey b TTP) \\ parts(spies evs)\" \nby simp\n\nlemma Spy_dont_know_TTPKey_analz [simp]:\n \"evs \\ certified_mail \\ Key (privateKey b TTP) \\ analz(spies evs)\"\nby auto\n\ntext\\Thus, prove any goal that assumes that \\<^term>\\Spy\\ knows a private key\nbelonging to \\<^term>\\TTP\\\\\ndeclare Spy_dont_know_TTPKey_parts [THEN [2] rev_notE, elim!]\n\n\nlemma CM3_k_parts_knows_Spy:\n \"\\evs \\ certified_mail;\n Notes TTP \\Agent A, Agent TTP,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, \n Agent R, hs\\, Key (RPwd R), hs\\ \\ set evs\\\n \\ Key K \\ parts(spies evs)\"\napply (rotate_tac 1)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\n apply (blast intro:parts_insertI)\ntxt\\Fake SSL\\\napply (blast dest: parts.Body) \ntxt\\Message 2\\\napply (blast dest!: Gets_imp_Says elim!: knows_Spy_partsEs)\ntxt\\Message 3\\\napply (metis parts_insertI)\ndone\n\nlemma Spy_dont_know_RPwd [rule_format]:\n \"evs \\ certified_mail \\ Key (RPwd A) \\ parts(spies evs) \\ A \\ bad\"\napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (blast dest: Fake_parts_insert_in_Un) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \napply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD]\n analz_subset_parts [THEN subsetD])\ndone\n\n\nlemma Spy_know_RPwd_iff [simp]:\n \"evs \\ certified_mail \\ (Key (RPwd A) \\ parts(spies evs)) = (A\\bad)\"\nby (auto simp add: Spy_dont_know_RPwd) \n\nlemma Spy_analz_RPwd_iff [simp]:\n \"evs \\ certified_mail \\ (Key (RPwd A) \\ analz(spies evs)) = (A\\bad)\"\nby (metis Spy_know_RPwd_iff Spy_spies_bad_shrK analz.Inj analz_into_parts)\n\ntext\\Unused, but a guarantee of sorts\\\ntheorem CertAutenticity:\n \"\\Crypt (priSK TTP) X \\ parts (spies evs); evs \\ certified_mail\\ \n \\ \\A. Says TTP A (Crypt (priSK TTP) X) \\ set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (blast dest: Spy_dont_know_private_keys Fake_parts_insert_in_Un)\ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2 parts_insert_knows_A) \n apply (blast dest!: Fake_parts_sing_imp_Un, blast)\ndone\n\n\nsubsection\\Proving Confidentiality Results\\\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\ certified_mail \\\n \\K KK. invKey (pubEK TTP) \\ KK \\\n (Key K \\ analz (Key`KK \\ (spies evs))) =\n (K \\ KK | Key K \\ analz (spies evs))\"\napply (erule certified_mail.induct)\napply (drule_tac [6] A=TTP in symKey_neq_priEK) \napply (erule_tac [6] disjE [OF hr_form]) \napply (drule_tac [5] CM2_S2TTP_analz_knows_Spy) \nprefer 9\napply (elim exE)\napply (simp_all add: synth_analz_insert_eq\n subset_trans [OF _ subset_insertI]\n subset_trans [OF _ Un_upper2] \n del: image_insert image_Un add: analz_image_freshK_simps)\ndone\n\n\nlemma analz_insert_freshK:\n \"\\evs \\ certified_mail; KAB \\ invKey (pubEK TTP)\\ \\\n (Key K \\ analz (insert (Key KAB) (spies evs))) =\n (K = KAB | Key K \\ analz (spies evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\ntext\\\\<^term>\\S2TTP\\ must have originated from a valid sender\n provided \\<^term>\\K\\ is secure. Proof is surprisingly hard.\\\n\nlemma Notes_SSL_imp_used:\n \"\\Notes B \\Agent A, Agent B, X\\ \\ set evs\\ \\ X \\ used evs\"\nby (blast dest!: Notes_imp_used)\n\n\n(*The weaker version, replacing \"used evs\" by \"parts (spies evs)\", \n isn't inductive: message 3 case can't be proved *)\nlemma S2TTP_sender_lemma [rule_format]:\n \"evs \\ certified_mail \\\n Key K \\ analz (spies evs) \\\n (\\AO. Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs\\ \\ used evs \\\n (\\m ctxt q. \n hs = Hash\\Number ctxt, Nonce q, response S R q, Crypt K (Number m)\\ \\\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number ctxt, Nonce q,\n Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs \\\\ \\ set evs))\" \napply (erule certified_mail.induct, analz_mono_contra)\napply (drule_tac [5] CM2_S2TTP_parts_knows_Spy, simp)\napply (simp add: used_Nil Crypt_notin_initState, simp_all)\ntxt\\Fake\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Fake SSL\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest: analz_subset_parts [THEN subsetD]) \ntxt\\Message 1\\\napply (clarsimp, blast)\ntxt\\Message 2\\\napply (simp add: parts_insert2, clarify) \napply (metis parts_cut Un_empty_left usedI)\ntxt\\Message 3\\ \napply (blast dest: Notes_SSL_imp_used used_parts_subset_parts) \ndone \n\nlemma S2TTP_sender:\n \"\\Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\ \\ used evs;\n Key K \\ analz (spies evs);\n evs \\ certified_mail\\\n \\ \\m ctxt q. \n hs = Hash\\Number ctxt, Nonce q, response S R q, Crypt K (Number m)\\ \\\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number ctxt, Nonce q,\n Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs\\\\ \\ set evs\" \nby (blast intro: S2TTP_sender_lemma) \n\n\ntext\\Nobody can have used non-existent keys!\\\nlemma new_keys_not_used [simp]:\n \"\\Key K \\ used evs; K \\ symKeys; evs \\ certified_mail\\\n \\ K \\ keysFor (parts (spies evs))\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (force dest!: keysFor_parts_insert) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption) \napply (force dest!: keysFor_parts_insert)\ndone\n\n\ntext\\Less easy to prove \\<^term>\\m'=m\\. Maybe needs a separate unicity\ntheorem for ciphertexts of the form \\<^term>\\Crypt K (Number m)\\, \nwhere \\<^term>\\K\\ is secure.\\\nlemma Key_unique_lemma [rule_format]:\n \"evs \\ certified_mail \\\n Key K \\ analz (spies evs) \\\n (\\m cleartext q hs.\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number cleartext, Nonce q,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\\\\n \\ set evs \\\n (\\m' cleartext' q' hs'.\n Says S' R'\n \\Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n Number cleartext', Nonce q',\n Crypt (pubEK TTP) \\Agent S', Number AO', Key K, Agent R', hs'\\\\\n \\ set evs \\ R' = R \\ S' = S \\ AO' = AO \\ hs' = hs))\" \napply (erule certified_mail.induct, analz_mono_contra, simp_all)\n prefer 2\n txt\\Message 1\\\n apply (blast dest!: Says_imp_knows_Spy [THEN parts.Inj] new_keys_not_used Crypt_imp_keysFor)\ntxt\\Fake\\\napply (auto dest!: usedI S2TTP_sender analz_subset_parts [THEN subsetD]) \ndone\n\ntext\\The key determines the sender, recipient and protocol options.\\\nlemma Key_unique:\n \"\\Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number cleartext, Nonce q,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\\\\n \\ set evs;\n Says S' R'\n \\Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n Number cleartext', Nonce q',\n Crypt (pubEK TTP) \\Agent S', Number AO', Key K, Agent R', hs'\\\\\n \\ set evs;\n Key K \\ analz (spies evs);\n evs \\ certified_mail\\\n \\ R' = R \\ S' = S \\ AO' = AO \\ hs' = hs\"\nby (rule Key_unique_lemma, assumption+)\n\n\nsubsection\\The Guarantees for Sender and Recipient\\\n\ntext\\A Sender's guarantee:\n If Spy gets the key then \\<^term>\\R\\ is bad and \\<^term>\\S\\ moreover\n gets his return receipt (and therefore has no grounds for complaint).\\\ntheorem S_fairness_bad_R:\n \"\\Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n Key K \\ analz (spies evs);\n evs \\ certified_mail;\n S\\Spy\\\n \\ R \\ bad \\ Gets S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\\napply spy_analz\ntxt\\Fake SSL\\\napply spy_analz\ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: synth_analz_insert_eq \n subset_trans [OF _ subset_insertI]\n subset_trans [OF _ Un_upper2] \n del: image_insert image_Un add: analz_image_freshK_simps) \napply (simp_all add: symKey_neq_priEK analz_insert_freshK)\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique)+\ndone\n\ntext\\Confidentially for the symmetric key\\\ntheorem Spy_not_see_encrypted_key:\n \"\\Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n evs \\ certified_mail;\n S\\Spy; R \\ bad\\\n \\ Key K \\ analz(spies evs)\"\nby (blast dest: S_fairness_bad_R) \n\n\ntext\\Agent \\<^term>\\R\\, who may be the Spy, doesn't receive the key\n until \\<^term>\\S\\ has access to the return receipt.\\ \ntheorem S_guarantee:\n \"\\Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n Notes R \\Agent TTP, Agent R, Key K, hs\\ \\ set evs;\n S\\Spy; evs \\ certified_mail\\\n \\ Gets S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt\\Message 1\\\napply (blast dest: Notes_imp_used) \ntxt\\Message 3\\\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique S_fairness_bad_R) \ndone\n\n\ntext\\If \\<^term>\\R\\ sends message 2, and a delivery certificate exists, \n then \\<^term>\\R\\ receives the necessary key. This result is also important\n to \\<^term>\\S\\, as it confirms the validity of the return receipt.\\\ntheorem RR_validity:\n \"\\Crypt (priSK TTP) S2TTP \\ used evs;\n S2TTP = Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, \n Hash \\Number cleartext, Nonce q, r, em\\\\;\n hr = Hash \\Number cleartext, Nonce q, r, em\\;\n R\\Spy; evs \\ certified_mail\\\n \\ Notes R \\Agent TTP, Agent R, Key K, hr\\ \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule ssubst)\napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\ \napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Fake SSL\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Message 2\\\napply (drule CM2_S2TTP_parts_knows_Spy, assumption)\napply (force dest: parts_cut)\ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE, simp_all) \napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/CertifiedEmail.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2669302623169275}} {"text": "(* Title: HOL/HOLCF/IOA/Storage/Impl.thy\n Author: Olaf Müller\n*)\n\nsection \\The implementation of a memory\\\n\ntheory Impl\nimports \"../IOA\" Action\nbegin\n\ndefinition\n impl_sig :: \"action signature\" where\n \"impl_sig = (UN l.{Free l} Un {New},\n UN l.{Loc l},\n {})\"\n\ndefinition\n impl_trans :: \"(action, nat * bool)transition set\" where\n \"impl_trans =\n {tr. let s = fst(tr); k = fst s; b = snd s;\n t = snd(snd(tr)); k' = fst t; b' = snd t\n in\n case fst(snd(tr))\n of\n New => k' = k & b' |\n Loc l => b & l= k & k'= (Suc k) & ~b' |\n Free l => k'=k & b'=b}\"\n\ndefinition\n impl_ioa :: \"(action, nat * bool)ioa\" where\n \"impl_ioa = (impl_sig, {(0,False)}, impl_trans,{},{})\"\n\nlemma in_impl_asig:\n \"New : actions(impl_sig) &\n Loc l : actions(impl_sig) &\n Free l : actions(impl_sig) \"\n by (simp add: impl_sig_def actions_def asig_projections)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/HOLCF/IOA/Storage/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2669209822286648}} {"text": "theory flash34Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_InvVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_1VsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_InvAck_1_HomeVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_2VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have allCases:\"formEval (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) s \\formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 c1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have allCases:\"formEval (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) s \\formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 c1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_GetXVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Put )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Nak_HomeVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Remote_GetX_NakVsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Nak1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Put2VsInv34: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ReplaceHomeVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceShrVldVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ShWbVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_WbVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_PutVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_PutXVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n have allCases:\"formEval ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const true )) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_GetVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma PI_Remote_ReplaceVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreVsInv34: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreHomeVsInv34: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv34 iInv1 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash34Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.26692097568800194}} {"text": "theory RG_Tran\nimports RG_Com\nbegin\n\nsubsection \\Semantics of Component Programs\\\n\nsubsubsection \\Environment transitions\\\n\ntype_synonym 'a conf = \"(('a com) option) \\ 'a\"\n\ninductive_set\n etran :: \"('a conf \\ 'a conf) set\" \n and etran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -e\\ _\" [81,81] 80)\nwhere\n \"P -e\\ Q \\ (P,Q) \\ etran\"\n| Env: \"(P, s) -e\\ (P, t)\"\n\nlemma etranE: \"c -e\\ c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule etran.cases, blast)\n\nsubsubsection \\Component transitions\\\n\ninductive_set\n ctran :: \"('a conf \\ 'a conf) set\"\n and ctran' :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c\\ _\" [81,81] 80)\n and ctrans :: \"'a conf \\ 'a conf \\ bool\" (\"_ -c*\\ _\" [81,81] 80)\nwhere\n \"P -c\\ Q \\ (P,Q) \\ ctran\"\n| \"P -c*\\ Q \\ (P,Q) \\ ctran\\<^sup>*\"\n\n| Basic: \"(Some(Basic f), s) -c\\ (None, f s)\"\n\n| Seq1: \"(Some P0, s) -c\\ (None, t) \\ (Some(Seq P0 P1), s) -c\\ (Some P1, t)\"\n\n| Seq2: \"(Some P0, s) -c\\ (Some P2, t) \\ (Some(Seq P0 P1), s) -c\\ (Some(Seq P2 P1), t)\"\n\n| CondT: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P1, s)\"\n| CondF: \"s\\b \\ (Some(Cond b P1 P2), s) -c\\ (Some P2, s)\"\n\n| WhileF: \"s\\b \\ (Some(While b P), s) -c\\ (None, s)\"\n| WhileT: \"s\\b \\ (Some(While b P), s) -c\\ (Some(Seq P (While b P)), s)\"\n\n| Await: \"\\s\\b; (Some P, s) -c*\\ (None, t)\\ \\ (Some(Await b P), s) -c\\ (None, t)\" \n\nmonos \"rtrancl_mono\"\n\nsubsection \\Semantics of Parallel Programs\\\n\ntype_synonym 'a par_conf = \"('a par_com) \\ 'a\"\n\ninductive_set\n par_etran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_etran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pe\\ _\" [81,81] 80)\nwhere\n \"P -pe\\ Q \\ (P,Q) \\ par_etran\"\n| ParEnv: \"(Ps, s) -pe\\ (Ps, t)\"\n\ninductive_set\n par_ctran :: \"('a par_conf \\ 'a par_conf) set\"\n and par_ctran' :: \"['a par_conf,'a par_conf] \\ bool\" (\"_ -pc\\ _\" [81,81] 80)\nwhere\n \"P -pc\\ Q \\ (P,Q) \\ par_ctran\"\n| ParComp: \"\\i (r, t)\\ \\ (Ps, s) -pc\\ (Ps[i:=r], t)\"\n\nlemma par_ctranE: \"c -pc\\ c' \\\n (\\i Ps s r t. c = (Ps, s) \\ c' = (Ps[i := r], t) \\ i < length Ps \\\n (Ps ! i, s) -c\\ (r, t) \\ P) \\ P\"\n by (induct c, induct c', erule par_ctran.cases, blast)\n\nsubsection \\Computations\\\n\nsubsubsection \\Sequential computations\\\n\ntype_synonym 'a confs = \"'a conf list\"\n\ninductive_set cptn :: \"'a confs set\"\nwhere\n CptnOne: \"[(P,s)] \\ cptn\"\n| CptnEnv: \"(P, t)#xs \\ cptn \\ (P,s)#(P,t)#xs \\ cptn\"\n| CptnComp: \"\\(P,s) -c\\ (Q,t); (Q, t)#xs \\ cptn \\ \\ (P,s)#(Q,t)#xs \\ cptn\"\n\ndefinition cp :: \"('a com) option \\ 'a \\ ('a confs) set\" where\n \"cp P s \\ {l. l!0=(P,s) \\ l \\ cptn}\" \n\nsubsubsection \\Parallel computations\\\n\ntype_synonym 'a par_confs = \"'a par_conf list\"\n\ninductive_set par_cptn :: \"'a par_confs set\"\nwhere\n ParCptnOne: \"[(P,s)] \\ par_cptn\"\n| ParCptnEnv: \"(P,t)#xs \\ par_cptn \\ (P,s)#(P,t)#xs \\ par_cptn\"\n| ParCptnComp: \"\\ (P,s) -pc\\ (Q,t); (Q,t)#xs \\ par_cptn \\ \\ (P,s)#(Q,t)#xs \\ par_cptn\"\n\ndefinition par_cp :: \"'a par_com \\ 'a \\ ('a par_confs) set\" where\n \"par_cp P s \\ {l. l!0=(P,s) \\ l \\ par_cptn}\" \n\nsubsection\\Modular Definition of Computation\\\n\ndefinition lift :: \"'a com \\ 'a conf \\ 'a conf\" where\n \"lift Q \\ \\(P, s). (if P=None then (Some Q,s) else (Some(Seq (the P) Q), s))\"\n\ninductive_set cptn_mod :: \"('a confs) set\"\nwhere\n CptnModOne: \"[(P, s)] \\ cptn_mod\"\n| CptnModEnv: \"(P, t)#xs \\ cptn_mod \\ (P, s)#(P, t)#xs \\ cptn_mod\"\n| CptnModNone: \"\\(Some P, s) -c\\ (None, t); (None, t)#xs \\ cptn_mod \\ \\ (Some P,s)#(None, t)#xs \\cptn_mod\"\n| CptnModCondT: \"\\(Some P0, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P0, s)#ys \\ cptn_mod\"\n| CptnModCondF: \"\\(Some P1, s)#ys \\ cptn_mod; s \\ b \\ \\ (Some(Cond b P0 P1), s)#(Some P1, s)#ys \\ cptn_mod\"\n| CptnModSeq1: \"\\(Some P0, s)#xs \\ cptn_mod; zs=map (lift P1) xs \\\n \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n| CptnModSeq2: \n \"\\(Some P0, s)#xs \\ cptn_mod; fst(last ((Some P0, s)#xs)) = None; \n (Some P1, snd(last ((Some P0, s)#xs)))#ys \\ cptn_mod; \n zs=(map (lift P1) xs)@ys \\ \\ (Some(Seq P0 P1), s)#zs \\ cptn_mod\"\n\n| CptnModWhile1: \n \"\\ (Some P, s)#xs \\ cptn_mod; s \\ b; zs=map (lift (While b P)) xs \\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n| CptnModWhile2: \n \"\\ (Some P, s)#xs \\ cptn_mod; fst(last ((Some P, s)#xs))=None; s \\ b; \n zs=(map (lift (While b P)) xs)@ys; \n (Some(While b P), snd(last ((Some P, s)#xs)))#ys \\ cptn_mod\\ \n \\ (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\ cptn_mod\"\n\nsubsection \\Equivalence of Both Definitions.\\\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n by (induct xs) auto\n\nlemma div_seq [rule_format]: \"list \\ cptn_mod \\\n (\\s P Q zs. list=(Some (Seq P Q), s)#zs \\\n (\\xs. (Some P, s)#xs \\ cptn_mod \\ (zs=(map (lift Q) xs) \\\n ( fst(((Some P, s)#xs)!length xs)=None \\ \n (\\ys. (Some Q, snd(((Some P, s)#xs)!length xs))#ys \\ cptn_mod \n \\ zs=(map (lift (Q)) xs)@ys)))))\"\napply(erule cptn_mod.induct)\napply simp_all\n apply clarify\n apply(force intro:CptnModOne)\n apply clarify\n apply(erule_tac x=Pa in allE)\n apply(erule_tac x=Q in allE)\n apply simp\n apply clarify\n apply(erule disjE)\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply clarify\n apply(erule CptnModEnv)\n apply(rule disjI1)\n apply(simp add:lift_def)\n apply clarify\n apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n apply(rule conjI)\n apply(erule CptnModEnv)\n apply(rule disjI2)\n apply(rule conjI)\n apply(case_tac xsa,simp,simp)\n apply(rule_tac x=\"ys\" in exI)\n apply(rule conjI)\n apply simp\n apply(simp add:lift_def)\n apply clarify\n apply(erule ctran.cases,simp_all)\n apply clarify\n apply(rule_tac x=\"xs\" in exI)\n apply simp\n apply clarify\napply(rule_tac x=\"xs\" in exI)\napply(simp add: last_length)\ndone\n\nlemma cptn_onlyif_cptn_mod_aux [rule_format]:\n \"\\s Q t xs.((Some a, s), Q, t) \\ ctran \\ (Q, t) # xs \\ cptn_mod \n \\ (Some a, s) # (Q, t) # xs \\ cptn_mod\"\napply(induct a)\napply simp_all\n\\ \\basic\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,rule Basic,simp)\napply clarify\napply(erule ctran.cases,simp_all)\n\\ \\Seq1\\\napply(rule_tac xs=\"[(None,ta)]\" in CptnModSeq2)\n apply(erule CptnModNone)\n apply(rule CptnModOne)\n apply simp\napply simp\napply(simp add:lift_def)\n\\ \\Seq2\\\napply(erule_tac x=sa in allE)\napply(erule_tac x=\"Some P2\" in allE)\napply(erule allE,erule impE, assumption)\napply(drule div_seq,simp)\napply clarify\napply(erule disjE)\n apply clarify\n apply(erule allE,erule impE, assumption)\n apply(erule_tac CptnModSeq1)\n apply(simp add:lift_def)\napply clarify \napply(erule allE,erule impE, assumption)\napply(erule_tac CptnModSeq2)\n apply (simp add:last_length)\n apply (simp add:last_length)\napply(simp add:lift_def)\n\\ \\Cond\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(force elim: CptnModCondT)\napply(force elim: CptnModCondF)\n\\ \\While\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule WhileF,simp)\napply(drule div_seq,force)\napply clarify\napply (erule disjE)\n apply(force elim:CptnModWhile1)\napply clarify\napply(force simp add:last_length elim:CptnModWhile2)\n\\ \\await\\\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule Await,simp+)\ndone\n\nlemma cptn_onlyif_cptn_mod [rule_format]: \"c \\ cptn \\ c \\ cptn_mod\"\napply(erule cptn.induct)\n apply(rule CptnModOne)\n apply(erule CptnModEnv)\napply(case_tac P)\n apply simp\n apply(erule ctran.cases,simp_all)\napply(force elim:cptn_onlyif_cptn_mod_aux)\ndone\n\nlemma lift_is_cptn: \"c\\cptn \\ map (lift P) c \\ cptn\"\napply(erule cptn.induct)\n apply(force simp add:lift_def CptnOne)\n apply(force intro:CptnEnv simp add:lift_def)\napply(force simp add:lift_def intro:CptnComp Seq2 Seq1 elim:ctran.cases)\ndone\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\b a. b#c1\\cptn \\ a#c2\\cptn \\ (b#c1)!length c1=a \\ b#c1@c2\\cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\n apply(force intro:CptnEnv)\napply(force elim:CptnComp)\ndone\n\nlemma last_lift: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=None\\ \n \\ fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=(Some P)\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\ \\P a \\ P (x!(length x - (Suc 0)))\" \n by (induct x) simp_all\n\nlemma last_fst_esp: \n \"fst(((Some a,s)#xs)!(length xs))=None \\ fst(xs!(length xs - (Suc 0)))=None\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\[] \\ \n snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma Cons_lift: \"(Some (Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((Some P, s) # xs)\"\n by (simp add:lift_def)\n\nlemma Cons_lift_append: \n \"(Some (Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((Some P, s) # xs)@ ys \"\n by (simp add:lift_def)\n\nlemma lift_nth: \"i map (lift Q) xs ! i = lift Q (xs! i)\"\n by (simp add:lift_def)\n\nlemma snd_lift: \"i< length xs \\ snd(lift Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_def)\n\nlemma cptn_if_cptn_mod: \"c \\ cptn_mod \\ c \\ cptn\"\napply(erule cptn_mod.induct)\n apply(rule CptnOne)\n apply(erule CptnEnv)\n apply(erule CptnComp,simp)\n apply(rule CptnComp)\n apply(erule CondT,simp)\n apply(rule CptnComp)\n apply(erule CondF,simp)\n\\ \\Seq1\\\napply(erule cptn.cases,simp_all)\n apply(rule CptnOne)\n apply clarify\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply(rule CptnEnv,simp)\napply clarify\napply(simp add:lift_def)\napply(rule conjI)\n apply clarify\n apply(rule CptnComp)\n apply(rule Seq1,simp)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\napply clarify\napply(rule CptnComp)\n apply(rule Seq2,simp)\napply(drule_tac P=P1 in lift_is_cptn)\napply(simp add:lift_def)\n\\ \\Seq2\\\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=P1 in last_lift)\n apply(rule last_fst_esp)\n apply (simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\n\\ \\While1\\\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(drule_tac P=\"While b P\" in lift_is_cptn)\napply(simp add:lift_def)\n\\ \\While2\\\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(rule cptn_append_is_cptn)\n apply(drule_tac P=\"While b P\" in lift_is_cptn)\n apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=\"While b P\" in last_lift)\n apply(rule last_fst_esp,simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\ndone\n\ntheorem cptn_iff_cptn_mod: \"(c \\ cptn) = (c \\ cptn_mod)\"\napply(rule iffI)\n apply(erule cptn_onlyif_cptn_mod)\napply(erule cptn_if_cptn_mod)\ndone\n\nsection \\Validity of Correctness Formulas\\\n\nsubsection \\Validity for Component Programs.\\\n\ntype_synonym 'a rgformula =\n \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set\"\n\ndefinition assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a confs) set\" where\n \"assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -e\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a confs) set\" where\n \"comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -c\\ c!(Suc i) \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (fst (last c) = None \\ snd (last c) \\ post)}\"\n\ndefinition com_validity :: \"'a com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \\ 'a set \\ bool\" \n (\"\\ _ sat [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ P sat [pre, rely, guar, post] \\ \n \\s. cp (Some P) s \\ assum(pre, rely) \\ comm(guar, post)\"\n\nsubsection \\Validity for Parallel Programs.\\\n\ndefinition All_None :: \"(('a com) option) list \\ bool\" where\n \"All_None xs \\ \\c\\set xs. c=None\"\n\ndefinition par_assum :: \"('a set \\ ('a \\ 'a) set) \\ ('a par_confs) set\" where\n \"par_assum \\ \\(pre, rely). {c. snd(c!0) \\ pre \\ (\\i. Suc i \n c!i -pe\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ rely)}\"\n\ndefinition par_comm :: \"(('a \\ 'a) set \\ 'a set) \\ ('a par_confs) set\" where\n \"par_comm \\ \\(guar, post). {c. (\\i. Suc i \n c!i -pc\\ c!Suc i \\ (snd(c!i), snd(c!Suc i)) \\ guar) \\ \n (All_None (fst (last c)) \\ snd( last c) \\ post)}\"\n\ndefinition par_com_validity :: \"'a par_com \\ 'a set \\ ('a \\ 'a) set \\ ('a \\ 'a) set \n\\ 'a set \\ bool\" (\"\\ _ SAT [_, _, _, _]\" [60,0,0,0,0] 45) where\n \"\\ Ps SAT [pre, rely, guar, post] \\ \n \\s. par_cp Ps s \\ par_assum(pre, rely) \\ par_comm(guar, post)\"\n\nsubsection \\Compositionality of the Semantics\\\n\nsubsubsection \\Definition of the conjoin operator\\\n\ndefinition same_length :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"same_length c clist \\ (\\i ('a confs) list \\ bool\" where\n \"same_state c clist \\ (\\i j ('a confs) list \\ bool\" where\n \"same_program c clist \\ (\\jx. fst(nth x j)) clist)\"\n\ndefinition compat_label :: \"'a par_confs \\ ('a confs) list \\ bool\" where\n \"compat_label c clist \\ (\\j. Suc j \n (c!j -pc\\ c!Suc j \\ (\\i (clist!i)! Suc j \\ \n (\\li \\ (clist!l)!j -e\\ (clist!l)! Suc j))) \\ \n (c!j -pe\\ c!Suc j \\ (\\i (clist!i)! Suc j)))\"\n\ndefinition conjoin :: \"'a par_confs \\ ('a confs) list \\ bool\" (\"_ \\ _\" [65,65] 64) where\n \"c \\ clist \\ (same_length c clist) \\ (same_state c clist) \\ (same_program c clist) \\ (compat_label c clist)\"\n\nsubsubsection \\Some previous lemmas\\\n\nlemma list_eq_if [rule_format]: \n \"\\ys. xs=ys \\ (length xs = length ys) \\ (\\i (\\i ys!0=a; ys\\[] \\ \\ ys=(a#(tl ys))\"\n by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\[] \\ ys!0=a \\ P ys \\ P (a#(tl ys))\"\n by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) \\ P ys\"\n by (induct ys) simp_all\n\nlemma seq_not_eq1: \"Seq c1 c2\\c1\"\n by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\c2\"\n by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\c1\"\n by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\c2\"\n by (induct c2) auto\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\n\nlemma prog_not_eq_in_ctran_aux:\n assumes c: \"(P,s) -c\\ (Q,t)\"\n shows \"P\\Q\" using c\n by (induct x1 \\ \"(P,s)\" x2 \\ \"(Q,t)\" arbitrary: P s Q t) auto\n\nlemma prog_not_eq_in_ctran [simp]: \"\\ (P,s) -c\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_ctran_aux)\napply simp\ndone\n\nlemma prog_not_eq_in_par_ctran_aux [rule_format]: \"(P,s) -pc\\ (Q,t) \\ (P\\Q)\"\napply(erule par_ctran.induct)\napply(drule prog_not_eq_in_ctran_aux)\napply clarify\napply(drule list_eq_if)\n apply simp_all\napply force\ndone\n\nlemma prog_not_eq_in_par_ctran [simp]: \"\\ (P,s) -pc\\ (P,t)\"\napply clarify\napply(drule prog_not_eq_in_par_ctran_aux)\napply simp\ndone\n\nlemma tl_in_cptn: \"\\ a#xs \\cptn; xs\\[] \\ \\ xs\\cptn\"\n by (force elim: cptn.cases)\n\nlemma tl_zero[rule_format]: \n \"P (ys!Suc j) \\ Suc j ys\\[] \\ P (tl(ys)!j)\"\n by (induct ys) simp_all\n\nsubsection \\The Semantics is Compositional\\\n\nlemma aux_if [rule_format]: \n \"\\xs s clist. (length clist = length xs \\ (\\i cptn) \n \\ ((xs, s)#ys \\ map (\\i. (fst i,s)#snd i) (zip xs clist)) \n \\ (xs, s)#ys \\ par_cptn)\"\napply(induct ys)\n apply(clarify)\n apply(rule ParCptnOne)\napply(clarify)\napply(simp add:conjoin_def compat_label_def)\napply clarify\napply(erule_tac x=\"0\" and P=\"\\j. H j \\ (P j \\ Q j)\" for H P Q in all_dupE, simp)\napply(erule disjE)\n\\ \\first step is a Component step\\\n apply clarify \n apply simp\n apply(subgoal_tac \"a=(xs[i:=(fst(clist!i!0))])\")\n apply(subgoal_tac \"b=snd(clist!i!0)\",simp)\n prefer 2\n apply(simp add: same_state_def)\n apply(erule_tac x=i in allE,erule impE,assumption, \n erule_tac x=1 and P=\"\\j. (H j) \\ (snd (d j))=(snd (e j))\" for H d e in allE, simp)\n prefer 2\n apply(simp add:same_program_def)\n apply(erule_tac x=1 and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(rule ParCptnComp)\n apply(erule ParComp,simp)\n\\ \\applying the induction hypothesis\\\n apply(erule_tac x=\"xs[i := fst (clist ! i ! 0)]\" in allE)\n apply(erule_tac x=\"snd (clist ! i ! 0)\" in allE)\n apply(erule mp)\n apply(rule_tac x=\"map tl clist\" in exI,simp)\n apply(rule conjI,clarify)\n apply(case_tac \"i=ia\",simp)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply simp\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule nth_tl_if)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_state_def)\n apply(erule_tac x=ia in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_length_def same_state_def)\n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(force simp add:same_length_def length_Suc_conv)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\n apply(rule allI,rule impI)\n apply(erule_tac x=\"Suc j\" and P=\"\\j. H j \\ (I j \\ J j)\" for H I J in allE,simp)\n apply(erule disjE) \n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(case_tac \"i=ia\",simp)\n apply(rule conjI)\n apply(force simp add: length_Suc_conv)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption)\n apply simp\n apply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=l in allE, erule impE, assumption, \n erule_tac x=1 and P=\"\\j. (H j) \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply force\n apply simp\n apply(rule tl_zero)\n apply(erule tl_zero)\n apply force\n apply force\n apply force\n apply force\n apply(rule conjI,simp)\n apply(rule nth_tl_if)\n apply force\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(drule_tac t=i in not_sym,simp)\n apply(erule etranE,simp)\n apply(erule tl_zero)\n apply force\n apply force\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(erule_tac P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE,assumption,erule impE,assumption)\n apply(erule tl_zero,force)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE, assumption,simp)\n apply(erule etranE,simp)\n apply(rule tl_zero)\n apply force\n apply force\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(rule disjI2)\n apply(case_tac j,simp)\n apply clarify\n apply(rule tl_zero)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j\\etran\" for H I in allE,erule impE, assumption)\n apply(case_tac \"i=ia\",simp,simp)\n apply(erule_tac x=ia in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=ia and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE,erule impE, assumption,simp)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply clarify\n apply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\n apply(erule_tac x=ia and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n\\ \\first step is an environmental step\\\napply clarify\napply(erule par_etran.cases)\napply simp\napply(rule ParCptnEnv)\napply(erule_tac x=\"Ps\" in allE)\napply(erule_tac x=\"t\" in allE)\napply(erule mp)\napply(rule_tac x=\"map tl clist\" in exI,simp)\napply(rule conjI)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ I j \\ cptn\" for H I in allE,simp)\n apply(erule cptn.cases)\n apply(simp add:same_length_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply(simp add:same_state_def)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ J j \\etran\" for H J in allE,simp)\n apply(erule etranE,simp)\napply(simp add:same_state_def same_length_def)\napply(rule conjI,clarify)\n apply(case_tac j,simp,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule tl_zero)\n apply(simp)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp)\n apply clarify\n apply simp\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\j. H j \\ (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\napply(rule allI,rule impI)\napply(erule_tac x=\"Suc j\" and P=\"\\j. H j \\ (I j \\ J j)\" for H I J in allE,simp)\napply(erule disjE) \n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(erule tl_zero,force) \n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply clarify\n apply(erule_tac x=l and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=l in allE, erule impE, assumption,\n erule_tac x=1 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule nth_tl_if)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply(rule disjI2)\napply simp\napply clarify\napply(case_tac j,simp)\n apply(rule tl_zero)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(erule_tac x=i and P=\"\\i. H i \\ J i \\etran\" for H J in allE, erule impE, assumption)\n apply(force elim:etranE intro:Env)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\napply simp\napply(rule tl_zero)\n apply(rule tl_zero,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\napply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\ndone\n\nlemma aux_onlyif [rule_format]: \"\\xs s. (xs, s)#ys \\ par_cptn \\ \n (\\clist. (length clist = length xs) \\ \n (xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist) \\ \n (\\i cptn))\"\napply(induct ys)\n apply(clarify)\n apply(rule_tac x=\"map (\\i. []) [0..j. (P!j, t)#(clist!j)) [0..j. (Ps!j, ta)#(clist!j)) [0..j. H j \\ (I j \\ cptn)\" for H I in allE,simp)\n apply simp\n apply(erule_tac x=ia in allE)\n apply(rule CptnEnv,simp)\napply(simp add:conjoin_def)\napply (rule conjI)\n apply(simp add:same_length_def)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(case_tac j, simp, simp (no_asm_simp))\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n apply(rule nth_equalityI,simp,simp)\n apply simp\n apply(rule nth_equalityI,simp,simp)\n apply(erule_tac x=nat and P=\"\\j. H j \\ (fst (a j))=((b j))\" for H a b in allE)\n apply(case_tac nat)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(simp add:compat_label_def)\napply clarify\napply(case_tac j)\n apply(rule conjI,simp)\n apply(erule ParComp,assumption)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply clarify\n apply(rule Env)\napply simp\napply(erule_tac x=nat and P=\"\\j. H j \\ (P j \\ Q j)\" for H P Q in allE,simp)\napply(erule disjE)\n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(rule conjI)\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(case_tac \"l=ia\",simp,simp)\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply simp\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\napply clarify\napply(erule_tac x=ia and P=\"\\j. H j \\ (P j)\\etran\" for H P in allE, erule impE, assumption)\napply(case_tac \"i=ia\",simp,simp)\ndone\n\nlemma one_iff_aux: \"xs\\[] \\ (\\ys. ((xs, s)#ys \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((xs, s)#ys \\ map (\\i. (fst i,s)#(snd i)) (zip xs clist)) \\ \n (\\i cptn))) = \n (par_cp (xs) s = {c. \\clist. (length clist)=(length xs) \\\n (\\i cp(xs!i) s) \\ c \\ clist})\" \napply (rule iffI)\n apply(rule subset_antisym)\n apply(rule subsetI) \n apply(clarify)\n apply(simp add:par_cp_def cp_def)\n apply(case_tac x)\n apply(force elim:par_cptn.cases)\n apply simp\n apply(rename_tac a list)\n apply(erule_tac x=\"list\" in allE)\n apply clarify\n apply simp\n apply(rule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in exI,simp)\n apply(rule subsetI) \n apply(clarify)\n apply(case_tac x)\n apply(erule_tac x=0 in allE)\n apply(simp add:cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule cptn.cases,force,force,force)\n apply(simp add:par_cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule_tac x=0 and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in all_dupE)\n apply(subgoal_tac \"a = xs\")\n apply(subgoal_tac \"b = s\",simp)\n prefer 3\n apply(erule_tac x=0 and P=\"\\j. H j \\ (fst (s j))=((t j))\" for H s t in allE)\n apply (simp add:cp_def)\n apply(rule nth_equalityI,simp,simp)\n prefer 2\n apply(erule_tac x=0 in allE)\n apply (simp add:cp_def)\n apply(erule_tac x=0 and P=\"\\j. H j \\ (\\i. T i \\ (snd (d j i))=(snd (e j i)))\" for H T d e in allE,simp)\n apply(erule_tac x=0 and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=list in allE)\n apply(rule_tac x=\"map tl clist\" in exI,simp) \n apply(rule conjI)\n apply clarify\n apply(case_tac j,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"0\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=\"Suc nat\" and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply clarify\n apply simp\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(thin_tac \"H = (\\i. J i)\" for H J)\n apply(rule conjI)\n apply clarify\n apply(erule_tac x=j in allE,erule impE, assumption,erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(case_tac j,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply clarify\n apply(simp add:cp_def)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply simp\n apply(rule conjI)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp)\n apply(rule nth_tl_if,simp,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (P j)\\etran\" for H P in allE, erule impE, assumption,simp)\n apply(simp add:cp_def)\n apply clarify\n apply(rule nth_tl_if)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply force\n apply force\napply clarify\napply(rule iffI)\n apply(simp add:par_cp_def)\n apply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply simp\n apply clarify\n apply(rule_tac x=\"map tl clist\" in exI)\n apply simp\n apply (rule conjI)\n apply(simp add:conjoin_def cp_def)\n apply(rule conjI)\n apply clarify\n apply(unfold same_length_def)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,simp)\n apply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(erule_tac x=i in allE, erule impE, assumption,\n erule_tac x=j and P=\"\\j. H j \\ (snd (d j))=(snd (e j))\" for H d e in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(rule nth_equalityI,simp,simp)\n apply(case_tac j,simp)\n apply clarify\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(simp add:compat_label_def)\n apply(rule allI,rule impI)\n apply(erule_tac x=j in allE,erule impE, assumption)\n apply(erule disjE)\n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n apply(erule_tac x=i in allE)\n apply(case_tac j,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!i\",simp,simp)\n apply clarify\n apply(erule_tac x=l and P=\"\\j. H j \\ I j \\ J j\" for H I J in allE)\n apply(erule_tac x=l and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE)\n apply(case_tac \"clist!l\",simp,simp)\n apply(erule_tac x=l in allE,simp)\n apply(rule disjI2)\n apply clarify\n apply(rule tl_zero)\n apply(case_tac j,simp,simp)\n apply(rule tl_zero,force) \n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply force\n apply(erule_tac x=i and P=\"\\j. H j \\ (length (s j) = t)\" for H s t in allE,force)\n apply clarify\n apply(erule_tac x=i in allE)\n apply(simp add:cp_def)\n apply(rule nth_tl_if)\n apply(simp add:conjoin_def)\n apply clarify\n apply(simp add:same_length_def)\n apply(erule_tac x=i in allE,simp)\n apply simp\n apply simp\n apply simp\napply clarify\napply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply(simp add:par_cp_def)\napply simp\napply(erule_tac x=\"map (\\i. (fst i, s) # snd i) (zip xs clist)\" in allE)\napply simp\napply clarify\napply(simp add:cp_def)\ndone\n\ntheorem one: \"xs\\[] \\ \n par_cp xs s = {c. \\clist. (length clist)=(length xs) \\ \n (\\i cp(xs!i) s) \\ c \\ clist}\"\napply(frule one_iff_aux)\napply(drule sym)\napply(erule iffD2)\napply clarify\napply(rule iffI)\n apply(erule aux_onlyif)\napply clarify\napply(force intro:aux_if)\ndone\n\nend", "meta": {"author": "SunHuan321", "repo": "uc-OS-verification", "sha": "760e159857c4015d6a9e3ccbe9f8247e4518862a", "save_path": "github-repos/isabelle/SunHuan321-uc-OS-verification", "path": "github-repos/isabelle/SunHuan321-uc-OS-verification/uc-OS-verification-760e159857c4015d6a9e3ccbe9f8247e4518862a/SIMP/RG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2669209756880019}} {"text": "theory Analyze_SQRL_Shorewall\nimports \n \"../../Primitive_Matchers/Parser\"\nbegin\n\n\nsection\\Example: SQRL Shorewall\\\n\n\nparse_iptables_save SQRL_fw=\"iptables-saveakachan\"\n\n\nthm SQRL_fw_def\nthm SQRL_fw_FORWARD_default_policy_def\n\nvalue[code] \"map (\\(c,rs). (c, map (quote_rewrite \\ common_primitive_rule_toString) rs)) SQRL_fw\"\n\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''smurflog''))\" by eval\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''logflags''))\" by eval\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''reject''))\" by eval\n\n(*12.942s*)\nvalue[code] \"Semantics_Goto.rewrite_Goto SQRL_fw\"\n\ndefinition \"unfolded = unfold_ruleset_FORWARD SQRL_fw_FORWARD_default_policy (map_of_string_ipv4 (Semantics_Goto.rewrite_Goto SQRL_fw))\"\n\n(*\n(*2174.839s elapsed time, 3308.410s cpu time, 161.539s GC time*)\nvalue[code] \"unfolded\"*)\n(*0.561s*)\nvalue[code] \"let x = unfolded in ()\" (*pretty printing is slow, not the unfolding! ML forces evaluation of unfolded!*)\n(*39.149s*)\nvalue[code] \"map (quote_rewrite \\ common_primitive_rule_toString) (unfolded)\"\n(*2.871s*)\nlemma \"length unfolded = 2649\" by eval\n\n\n(*17.554s*)\nvalue[code] \"map (quote_rewrite \\ common_primitive_rule_toString) (upper_closure unfolded)\"\nlemma \"length (upper_closure unfolded) = 1986\" by eval\n\n\nvalue[code] \"upper_closure (packet_assume_new unfolded)\"\n\n(*28.550s*)\nlemma \"length (lower_closure unfolded) = 5715\" by eval\n\nlemma \"check_simple_fw_preconditions (upper_closure unfolded) = False\" by eval\nlemma \"\\m \\ get_match`set (upper_closure (packet_assume_new unfolded)). normalized_nnf_match m\" by eval\n\nlemma \"\\m \\ get_match`set (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))). normalized_nnf_match m\" by eval\n\nlemma \"check_simple_fw_preconditions (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))\" by eval\nlemma \"length (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))) = 1389\" by eval\n(*22.240s*)\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded)))))\"\n\n(*25.480s*)\nvalue[code] \"map ipv4addr_wordinterval_toString (getParts (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))))\"\n\n(*43.702s*)\nlemma \"length (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))) = 5120\" by eval\n\n(*71.518s*)\nvalue[code] \"length (remdups_rev (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))))\" (*not smaller*)\n\nvalue[code] \"map ipv4addr_wordinterval_toString (getParts (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))))\"\n\nlemma \"simple_fw_valid (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded)))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded)))))\" by eval\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Examples/SQRL_Shorewall/Analyze_SQRL_Shorewall.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.26676049665288804}} {"text": "theory Proofs_4\n imports Requirements ExtraInv VCTheoryLemmas\nbegin\n\nthm extraInv_def\n\nlemma suspended_not_rotation_and_pressure:\n\"toEnvP s1 \\ substate s1 s \\ getPstate s1 Controller = Controller'suspended \\\n(\\s1 s2 s3.\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s \\\n toEnvNum s1 s2 = ERROR \\ toEnvNum s1 s3 < ltime s3 ERROR \\ getPstate s3 ERROR = Controller'suspended \\\n getPstate s1 ERROR = Controller'suspended \\ \\ getVarBool s2 pressure) \\\n(\\s1. toEnvP s1 \\ substate s1 s \\ getPstate s1 ERROR = Controller'suspended \\\n getVarBool s1 rotation = False \\ getVarBool s1 brake = True) \\\n(\\ s2 s3. toEnvP s2 \\ toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ toEnvNum s2 s3 = 1 \\\ntoEnvNum s2 s1 < ltime s1 Controller \\ \\(getVarBool s2 rotation = True \\ getVarBool s3 pressure))\"\n by blast\n\ndefinition inv4 where \"inv4 s \\ R4 s \\ extraInv s\"\n\ntheorem proof_4_1: \"VC1 inv4 s0\"\n apply(simp only: VC1_def inv4_def R4_def extraInv_def)\n by auto\n\ntheorem proof_4_2: \"VC2 R4 env s0 user_value pressure_value\"\n apply(simp only: VC2_def R4_def)\n by auto\n\ntheorem proof_4_3: \"VC3 R4 env s0 user_value pressure_value\"\n apply(simp only: VC3_def R4_def)\n apply auto\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 < DELAY'TIMEOUT\"])\n using substate_refl apply fast\n by simp\n done\n\ntheorem proof_4_5: \"VC5 inv4 env s0 user_value pressure_value\"\n apply(simp only: VC5_def)\n by auto\n\ntheorem proof_4_6: \"VC6 R4 env s0 user_value pressure_value\"\n apply(simp only: VC6_def R4_def)\n by auto\n\ntheorem proof_4_7: \"VC7 inv4 env s0 user_value pressure_value\"\n apply(simp only: VC7_def)\n by auto\n\ntheorem proof_4_8: \"VC8 R4 env s0 user_value pressure_value\"\n apply(simp only: VC8_def R4_def)\n apply auto\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 < DELAY'TIMEOUT\"])\n using substate_refl apply fast\n by simp\n done\n\ntheorem proof_4_9: \"VC9 R4 env s0 user_value pressure_value\"\n apply(simp only: VC9_def R4_def)\n apply auto\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 < DELAY'TIMEOUT\"])\n using substate_refl apply fast\n by simp\n done\n\ntheorem proof_4_10: \"VC10 R4 env s0 user_value pressure_value\"\n apply(simp only: VC10_def R4_def)\n apply auto\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 < DELAY'TIMEOUT\"])\n using substate_refl apply fast\n by simp\n done\n\ntheorem proof_4_11: \"VC11 inv4 env s0 user_value pressure_value\"\n apply(simp only: VC11_def)\n by auto\n\ntheorem proof_4_14: \"VC14 R4 env s0 user_value pressure_value\"\n apply(simp only: VC14_def R4_def)\n apply auto\n subgoal for s1 s2\n apply(rule cut_rl[of \"toEnvNum s2 s0 < DELAY'TIMEOUT\"])\n using substate_refl apply fast\n by simp\n done\n\nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/revolvingDoor/Proofs_4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.26674038821829293}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory BufferT\nimports\n \"../impl/BilbyFs_Shallow_Desugar_Tuples\"\n \"../impl/BilbyFs_ShallowConsts_Desugar_Tuples\"\n \"../adt/WordArrayT\"\nbegin\n\n\ndefinition\n buf_slice :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 list\"\nwhere\n \"buf_slice buf frm to \\ slice (unat frm) (unat to) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_sub_slice :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 list \\ U8 list\"\nwhere\n \"buf_sub_slice buf frm to xs \\\n take (length (\\wa $ data\\<^sub>f buf)) (take (unat frm) (\\wa $ data\\<^sub>f buf) @ \n (take (unat to - unat frm) (xs@replicate (unat to - unat frm) 0)) @\n drop (max (unat to) (unat frm)) (\\wa $ data\\<^sub>f buf))\"\n \n\nlemma buf_sub_slice_length:\n \"length (buf_sub_slice buf frm to xs) = length (\\wa (data\\<^sub>f buf))\"\n apply (simp add: buf_sub_slice_def)\n apply(subst min_def)+\nusing [[linarith_split_limit=20]]\napply clarsimp (* take a while *)\napply safe\napply unat_arith+\ndone\n\ndefinition\n buf_drop :: \"Buffer\\<^sub>T \\ U32 \\ U8 list\"\nwhere\n \"buf_drop buf offs \\ drop (unat offs) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_take :: \"Buffer\\<^sub>T \\ U32 \\ U8 list\"\nwhere\n \"buf_take buf offs \\ take (unat offs) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_update_bounded :: \"Buffer\\<^sub>T \\ U8 list \\ U8 list\"\nwhere\n \"buf_update_bounded buf buf_updated \\\n take (min (unat $ bound\\<^sub>f buf) (length $ \\wa $ data\\<^sub>f buf)) buf_updated @\n drop (min (unat $ bound\\<^sub>f buf) (length buf_updated)) (\\wa $ data\\<^sub>f buf) \"\n\ndefinition\n buf_memset' :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 \\ U8 list\"\nwhere\n \"buf_memset' buf offs len v \\\n buf_update_bounded buf $ buf_take buf offs @ replicate (min (unat len) (unat (bound\\<^sub>f buf) - unat offs)) v @ buf_drop buf (offs+len)\"\n\n\nlemma buf_update_bounded_length:\n \"length (buf_update_bounded buf upd) = length (\\wa $ data\\<^sub>f buf)\"\n by (simp add: buf_bound_def buf_update_bounded_def buf_length_def)\n\nlemmas buf_simps = buf_take_def buf_drop_def buf_slice_def \n buf_bound_def buf_update_bounded_def buf_length_def\n buf_memset'_def buf_update_bounded_length\n slice_def\n\nlemma drop_take_drop:\n \"n \\ m \\ drop n (take m xs) @ drop m xs = drop n xs\"\n by (metis Nat.le_iff_add add.commute take_drop take_drop_append)\n\nlemma buf_memset_bound_assm_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n unat offs \\ unat (bound\\<^sub>f buf) \\\n offs + len \\ bound\\<^sub>f buf \\\n wordarray_set (data\\<^sub>f buf, offs, len, v) = WordArrayT.make (buf_memset' buf offs len v)\"\n unfolding buf_memset_def[unfolded tuple_simps sanitizers]\n apply (simp add: Let_def wordarray_set_ret buf_simps min_absorb1)\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (subgoal_tac \"(unat (bound\\<^sub>f buf) - unat offs) \\ (unat len)\")\n prefer 2\n apply unat_arith\n apply (simp add: min_absorb1 )\n apply (subgoal_tac \"(unat (bound\\<^sub>f buf)) \\\n (unat offs + (unat len + (length (\\wa (data\\<^sub>f buf)) - unat (offs + len))))\")\n prefer 2\n apply (unat_arith)\n apply (simp add: min_absorb1 take_drop)\n apply (subgoal_tac \" (unat offs + unat len) = unat (offs + len)\")\n apply (simp add: drop_take_drop)\n apply unat_arith\n done\n\nlemma take_prefix_length:\n \"take n xs = take n ys \\\n n \\ length xs \\ n \\ length ys\"\nby (metis length_take min.absorb_iff2)\n\nlemma buf_bounded_update_bounded_prefix:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n take (unat (bound\\<^sub>f buf)) xs = take (unat (bound\\<^sub>f buf)) ys \\\n buf_update_bounded buf xs = buf_update_bounded buf ys\"\n apply (simp add: buf_simps)\n apply (case_tac \"(unat (bound\\<^sub>f buf)) \\ (length xs)\")\n apply (frule (1) take_prefix_length)\n apply (simp add: min_absorb1)\n apply simp\ndone\n\nlemma buf_memset_bound:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n offs < bound\\<^sub>f buf \\\n \\ offs + len < bound\\<^sub>f buf \\\n buf_memset' buf offs (bound\\<^sub>f buf - offs) v = buf_memset' buf offs len v\"\n apply (simp add: buf_memset'_def)\n apply (subgoal_tac \"unat (bound\\<^sub>f buf - offs) = unat (bound\\<^sub>f buf) - unat offs\")\n prefer 2\n apply unat_arith\n apply (simp add: min_absorb2)\n apply (subgoal_tac \"(unat len) \\ (unat (bound\\<^sub>f buf) - unat offs)\")\n prefer 2\n apply unat_arith\n apply simp\n apply (rule buf_bounded_update_bounded_prefix)\n apply (simp add: buf_simps)+\n done\n\nlemma take_n_m_double_append:\n \"n \\ m \\ n \\ length xs \\\n take n (take m xs @ ys ) = take n xs\"\n by simp\n\nlemma buf_memset_offs_bound:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n \\ offs < bound\\<^sub>f buf \\\n buf_memset' buf (bound\\<^sub>f buf) len' v =\n buf_memset' buf offs len v\"\n apply (simp add: buf_memset'_def)\n apply (rule buf_bounded_update_bounded_prefix)\n apply simp\n apply (simp only: buf_take_def )\n apply (subst take_n_m_double_append)\n apply simp\n apply unat_arith\n apply unat_arith\n apply simp\n done\n\n\nlemma buf_memset_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n buf_memset (buf, offs, len, v) = buf\\data\\<^sub>f:=WordArrayT.make (buf_memset' buf offs len v)\\\"\n unfolding buf_memset_def[unfolded tuple_simps sanitizers]\n apply (simp only: Let_def prod.case_eq_if prod.sel take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n apply (subst buf_memset_bound_assm_eq)\n apply simp\n apply ((case_tac \" offs < bound\\<^sub>f buf\", ((simp, unat_arith)+)[2])+)[3]\n apply (rule arg_cong[where f=\"\\v. data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (case_tac \"offs < bound\\<^sub>f buf\")\n apply (simp add: buf_memset_bound)\n apply (simp add: buf_memset_offs_bound)\n done\n\nlemma buf_memset_length_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\nbuf_length (buf_memset (buf, offs, len, v)) = buf_length buf\"\n by (simp add: buf_length_def wordarray_length_ofnat[OF wordarray_length_ret] \n buf_memset_eq wordarray_make buf_update_bounded_length buf_memset'_def)\n\nlemma buf_take_buf_slice_adjacent:\n \"st \\ end \\ buf_take b st @ buf_slice b st end = buf_take b end\"\nby (simp add: buf_simps word_le_nat_alt) \n (metis (no_types, lifting) append_take_drop_id min_def take_take)\n\nlemma length_buf_memset:\n \"unat (bound\\<^sub>f wbuf) \\ length (\\wa (data\\<^sub>f wbuf)) \\\n n < n + m \\\nlength (\\wa (data\\<^sub>f (buf_memset (wbuf, n, m, v)))) = length (\\wa (data\\<^sub>f wbuf))\"\n by (simp add: buf_memset_eq buf_memset'_def wordarray_make buf_update_bounded_length)\n\nlemma buf_slice_n_n:\n \"buf_slice buf n n = []\"\n by (simp add: buf_simps)\n\nlemma buf_slice_0_eq_buf_take:\n \"buf_slice buf 0 n = buf_take buf n\"\n by (simp add: buf_simps)\n\n\nlemma buf_slice_out_of_buf_memset:\n \"frm \\ to \\ to \\ st \\ st \\ st + len \\ st \\ bound\\<^sub>f b \\ unat (bound\\<^sub>f b) = length (\\wa (data\\<^sub>f b)) \\\n buf_slice (buf_memset (b, st, len, v)) frm to = buf_slice b frm to\"\n apply (subst buf_memset_eq)\n apply simp+\n apply (simp add: buf_simps wordarray_make min_absorb1 min_absorb2)\n apply (simp only: unat_arith_simps)\n apply (simp add: min_absorb1 min_absorb2)\n done\n\nlemma buf_update_boundedI:\n \"unat (buf_bound wbuf) \\ length (\\wa (data\\<^sub>f wbuf)) \\\n length xs = length (\\wa (data\\<^sub>f wbuf)) \\\n drop (unat (bound\\<^sub>f wbuf)) (\\wa (data\\<^sub>f wbuf)) = drop (unat (bound\\<^sub>f wbuf)) xs \\\n P xs \\\n P (buf_update_bounded wbuf xs)\"\nby (simp add: buf_bound_def buf_update_bounded_def min_absorb1)\n\nlemma take_n_buf_sub_slice_n:\n \"unat n \\ length (\\wa (data\\<^sub>f b)) \\ take (unat n) (buf_sub_slice b n t xs) = take (unat n) (\\wa (data\\<^sub>f b))\"\n by (simp add: buf_sub_slice_def min_absorb1)\n\n lemma take_n_buf_sub_slice_m:\n \"unat m \\ length (\\wa (data\\<^sub>f b)) \\ n \\ m \\ take (unat n) (buf_sub_slice b m t xs) = take (unat n) (\\wa (data\\<^sub>f b))\"\n by (simp add: buf_sub_slice_def min_absorb1 word_le_nat_alt) \n \n\nlemma slice_buf_sub_slice:\n \"frm \\ mid \\ mid \\ to \\ unat to \\ length (\\wa (data\\<^sub>f b)) \\\n unat (to - mid) = length xs \\\n slice (unat frm) (unat to) (buf_sub_slice b mid to xs) = buf_slice b frm mid @ take (unat to - unat mid) xs\"\n apply (simp add: buf_simps buf_sub_slice_def min_absorb1 min_absorb2)\n apply (subgoal_tac \"unat mid \\ length (\\wa (data\\<^sub>f b))\")\n apply (subgoal_tac \"unat frm \\ length (\\wa (data\\<^sub>f b))\")\n apply (subgoal_tac \"unat frm \\ unat mid\")\n apply (simp add: buf_simps buf_sub_slice_def min_absorb1 min_absorb2 word_le_nat_alt)\n apply unat_arith+\n done\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/impl/fs/bilby/proof/adt/BufferT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.26674038821829293}} {"text": "theory Proof_3_4\n imports Proofs_3\nbegin\n\nthm VC4_def\n\ncontext\n fixes s2 s0:: state\nfixes user_value pressure_value:: bool\nassumes toEnvPs2: \"toEnvP s2 \\ toEnvP s0\" and extraInvs0: \"extraInv s0\" \nand vc: \" env (setVarAny s0 user_value pressure_value) \\\n getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'motionless \\\n \\getVarBool (setVarAny s0 user_value pressure_value) user\"\nbegin\n\nlemma VC4_R3_ind_step_aux1: \" toEnvP s2a \\\n substate s2 s2a \\\n substate s2a\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n s2 \\ s2a \\\n substate s1 s2 \\\n substate s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 s2a \\ s4 \\ s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)) \\\n substate s1 s2 \\\n substate s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 (predEnv s2a) \\ s4 \\ predEnv s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n \\ (getVarBool (predEnv s2a) rotation = False \\ getVarBool (predEnv s2a) user) \\\n toEnvP x \\\n substate s2a x \\\n substate x\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 x \\ DELAY'TIMEOUT \\\n (getVarBool x rotation = False \\ getVarBool x user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 x \\ s3 \\ x \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user) \\\n \\s4. toEnvP s4 \\\n substate (predEnv s2a) s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate (predEnv s2a) s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)\"\n apply(rule exI[of _ x])\n by (smt (z3) predEnv_substate predEnv_substate_imp_eq_or_substate substate_trans)\n \nlemma VC4_R3_ind_step: \" toEnvP s2a \\\n substate s2 s2a \\\n substate s2a\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n s2 \\ s2a \\\n substate s1 s2 \\\n substate s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 s2a \\ s4 \\ s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)) \\\n substate s1 s2 \\\n substate s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT =\n toEnvNum s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n getVarBool s1 rotation = True \\\n \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\ substate s2 s4 \\ substate s4 (predEnv s2a) \\ s4 \\ predEnv s2a \\\n getVarBool s4 rotation = True \\ \\ getVarBool s4 user) \\\n (\\s4. toEnvP s4 \\\n substate (predEnv s2a) s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate (predEnv s2a) s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"\n apply(rule impI)\n apply(cases \"(getVarBool (predEnv s2a) rotation = False \\ getVarBool (predEnv s2a) user)\")\n apply(rule exI[of _ \"predEnv s2a\"])\n apply(rule conjI)\n apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n using toEnvPs2 substate_eq_or_predEnv apply fast\n apply(rule conjI)\n using substate_refl apply fast\n apply(rule conjI)\n using predEnv_substate substate_trans apply fast\n apply(rule conjI)\n apply(rule cut_rl[of \"substate s2 (predEnv s2a) \\\n substate (predEnv s2a)\n (toEnv (setVarAny s0 user'value pressure'value))\"])\n using toEnvNum3[of s2 \"predEnv s2a\" \n\"(toEnv (setVarAny s0 user'value pressure'value))\"]\n apply arith\n using substate_eq_or_predEnv predEnv_substate substate_trans apply fast\n apply(rule conjI)\n apply assumption\n using substate_asym apply fast\n apply(rule exE[of \"\\ s4. toEnvP s4 \\\n substate s2a s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2a s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)\"])\n using substate_eq_or_predEnv apply blast\n by ((rule VC4_R3_ind_step_aux1);blast)\n \nlemma VC4_R3_ind_proof: \"toEnvP s5 \\ substate s2 s5 \\\n substate s5 (toEnv (setVarAny s0 user'value pressure'value))\n \\ pred3 s1 s2 (toEnv (setVarAny s0 user'value pressure'value))\n s5\"\n apply(induction rule: state_down_ind)\n using toEnvPs2 apply simp\n apply(simp only: pred3_def)\n apply(rule impI)\n apply(rule cut_rl[of \"getVarBool s0 rotation = False\"])\n apply(rule cut_rl[of \"getVarBool s0 rotation = True \\ \\ getVarBool s0 user\"])\n apply fast\n apply(rule cut_rl[of \"substate s2 s0 \\\n substate s0\n (toEnv (setVarAny s0 user'value pressure'value))\\\n s0 \\\n (toEnv (setVarAny s0 user'value pressure'value)) \"])\n using toEnvPs2 apply fast\n using substate_refl toEnvNum_id apply((simp split: if_splits);auto)\n using extraInvs0 extraInv_def vc\n apply (smt (verit) getPstate.simps(9) predEnv.simps(9) predEnv_substate substate_eq_or_predEnv toEnvPs2)\n apply(simp only: pred3_def)\n by ((rule VC4_R3_ind_step);fast) \nend\n\n\nlemma VC4_R3: \" (((((toEnvP s0 \\\n (\\s1 s2.\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT \\ toEnvNum s2 s0 \\ getVarBool s1 rotation = True \\ \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user)))) \\\n extraInv s0) \\\n env (setVarAny s0 user_value pressure_value)) \\\n getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'motionless) \\\n \\getVarBool (setVarAny s0 user_value pressure_value) user) \\\n substate s1 s2 \\\n substate s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvNum s1 s2 = ERROR \\\n DELAY'TIMEOUT\n \\ toEnvNum s2\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n getVarBool s1 rotation = True \\ \\ getVarBool s2 user \\\n (\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4\n (toEnv (setVarAny s0 user'value pressure'value)) \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"\n apply(rule impI)\n apply(rule disjE[of \"DELAY'TIMEOUT < toEnvNum s2 (toEnv (setVarAny s0 user'value pressure'value))\"\n\"DELAY'TIMEOUT = toEnvNum s2 (toEnv (setVarAny s0 user'value pressure'value))\"])\n using le_imp_less_or_eq apply fast\n apply(rule cut_rl[of \"substate s2 s0 \\ toEnvNum s2 s0 \\ DELAY'TIMEOUT\"])\n apply(rule cut_rl[of \"(\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 rotation = False \\ getVarBool s4 user) \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n getVarBool s3 rotation = True \\ \\ getVarBool s3 user))\"])\n apply (metis substate.simps(10) substate.simps(2) substate.simps(3) substate.simps(9))\n apply blast\n apply(simp split: if_splits)\n apply(rule cut_rl[of \"pred3 s1 s2 \n (toEnv (setVarAny s0 user'value pressure'value))\ns2\"])\n apply(simp only: pred3_def)\n apply (smt (z3) substate_asym)\n apply(rule mp[of \"toEnvP s2 \\ substate s2 s2 \\\n substate s2 (toEnv (setVarAny s0 user'value pressure'value))\"])\n apply((rule VC4_R3_ind_proof);blast)\n using substate_refl by fast\n \n \n\ntheorem proof_3_4: \"VC4 inv3 env s0 user_value pressure_value\"\n apply(simp only: VC4_def inv3_def R3_def)\n apply(rule impI)\n apply(rule conjI)\n apply(rule conjI)\n apply(simp)\n apply((rule allI);(rule allI))\n apply((rule VC4_R3);blast)", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/revolvingDoor/Proof_3_4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2667403819212185}} {"text": "theory ProcLemma\n imports ProcSendCase\nbegin\n\n (* ##### 3. process reduction validity for thread case ##### *)\n\ndefinition dsub_env :: \"'a state_env \\ 'b state_env \\ bool\" where\n \"dsub_env s env = (\\ x. env x \\ None \\ s x \\ None)\" \n \nlemma id_dsub_env: \"dsub_env s s\"\n apply (simp add: dsub_env_def)\n done\n \nlemma add_dsub_env: \"\\ dsub_env s env \\ \\ dsub_env (add_env s x v) env\" \n apply (simp add: dsub_env_def)\n apply (simp add: add_env_def)\n done \n \nlemma super_sub_use_env: \"\\ dsub_env s' s; sub_use_env s r_s \\ \\ sub_use_env s' r_s\" \n apply (simp add: dsub_env_def)\n apply (simp add: sub_use_env_def)\n apply (auto)\n done \n \nlemma app_red_exp_dsub_env: \"\\ app_red_exp are (s1, e1) ax (s2, e2) \\ \\ dsub_env s2 s1\"\n apply (case_tac are)\n apply (auto)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac add_dsub_env)\n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac id_dsub_env) \n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n done\n \n \n (* MAIN PROCESS REDUCTION LEMMA *)\n \nlemma srps_thread_case: \"\\well_typed_system env delta p_map s1 ps1; valid_reduct app_red_exp; r_ax = ThreadAct; ps1 u = Some (app_hole h e1); wf_hole h;\n ps2 = add_env ps1 u (app_hole h e2); app_red_exp are (s1, e1) ax (s2, e2)\\\n \\ \\r_s g_ax. (\\p_map'. well_typed_system (red_env env g_ax) (red_delta delta g_ax) p_map' s2 (add_env ps1 u (app_hole h e2))) \\ safe_act s1 r_s g_ax\"\n (* prelim: well_formed_delta / mem_val_env *)\n apply (cut_tac delta=\"delta\" in wts_well_formed_delta)\n apply (simp add: well_typed_system_def)\n apply (auto)\n apply (cut_tac env=\"env\" in wts_mem_val_env)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* case where action is performed on single thread 'u'. *)\n apply (case_tac \"\\ (well_typed_state s1 env delta \\ well_typed_proc_set env delta p_map ps1 \\ sub_nres_map s1 p_map)\")\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* we start by obtaining the well-typedness and validity for thread 'u' *)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (case_tac \"p_map u\")\n apply (auto)\n (* using the gsre lemma, we know that the resulting expression will be well-typed. *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"a\" and ?e1.0=\"app_hole h e1\" and tau=\"UnitTy\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and ?s1.0=\"s1\" and\n delta=\"delta\" and ?e2.0=\"app_hole h e2\" and ax=\"ax\" and ?s2.0=\"s2\" and r_f=\"a\" in safe_full_red_exp)\n apply (auto)\n apply (simp add: sub_nres_map_def)\n apply (simp add: nres_lookup_def)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"g_ax\" in exI) \n apply (auto)\n apply (rule_tac x=\"add_env p_map u (exp_red_use_env a g_ax)\" in exI)\n (* prove that the resulting system is well-typed overall *)\n apply (simp add: well_typed_system_def)\n (* prove that the process set in particular remains well-typed *)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* prove that the new map still covers the state *)(*\n apply (rule_tac add_full_nres_map)\n apply (simp)*)\n (* prove that it is still disjoint *)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n apply (rule_tac ?s1.0=\"s1\" in red_sep_nres_map)\n apply (auto)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n (* prove that everything is still well-typed. we start with the original expressions from ps1 *)\n apply (case_tac \"u \\ ua\")\n apply (case_tac \"add_env ps1 u (app_hole h e2) ua\")\n apply (auto)\n apply (erule_tac x=\"ua\" in allE)\n apply (simp add: add_env_def)\n apply (case_tac \"p_map ua\")\n apply (auto)\n apply (rule_tac x=\"rxa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac env'=\"env\" in well_typed_contain_env)\n apply (rule_tac s=\"s1\" in red_contain_env)\n apply (simp_all)\n apply (simp add: well_typed_state_def)\n apply (rule_tac s=\"s1\" and r_f=\"a\" in well_typed_red_deltax)\n apply (auto)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"ua\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: well_typed_state_def)\n (* - proving that it's still proper as well *)(*\n apply (rule_tac s=\"s1\" in red_proper_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)*)\n (* - it's true for the modified res map by valid_reduct's def *)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n (* prove that each res map in p_map is still contained in s2. this is true for the original\n res maps since s1 <: s2 *)\n apply (simp add: sub_nres_map_def)\n apply (auto)\n apply (case_tac \"u \\ x\")\n apply (rule_tac s=\"s1\" in super_sub_use_env)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (rule_tac are=\"are\" in app_red_exp_dsub_env)\n apply (auto)\n (* - it's true for the modified res map by valid_exp *) \n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n (* prove that each res map in p_map is disjoint from the new rs_map. this is true for the original\n res maps by lemma *)(*\n apply (case_tac \"u \\ ua\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (erule_tac x=\"ua\" in allE)\n apply (erule_tac x=\"ua\" in allE)\n apply (case_tac \"p_map ua\")\n apply (auto)\n apply (simp add: valid_exp_use_env_def)\n apply (rule_tac p_map=\"p_map\" and u=\"u\" and v=\"ua\" and r_p=\"aa\" and r_s=\"a\" and ?s1.0=\"s1\" in red_sep_nres_map2)\n apply (auto)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* - it's true for the modified res map by valid_reduct's def *)\n apply (simp add: add_env_def)\n apply (simp add: valid_exp_use_env_def)*)\n (* - action safety *)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n done \n \n (* ##### 4a. fork lemma: proves well-typedness of new thread ##### *)\n \ndefinition unit_app_abbrev where\n \"unit_app_abbrev e = (AppExp e (ConstExp UnitConst))\"\n \n (* this lemma allows us to type the expression passed into a fork so that it can be moved into another thread. since it will be\n stored in another thread, the requirements must be contained by r_s1, yet completely removable from it.\n from the previous lemma, we know that this can be taken from just the non-prim vars in e *)\n\nlemma safe_fork_lam: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; well_formed_delta env delta; is_value e; is_own r \\ \\\n well_typed env delta (np_dom_use_env env delta e) (unit_app_abbrev e) UnitTy empty_use_env empty_use_env\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n apply (simp add: unit_app_abbrev_def)\n (* base case *)\n apply (cut_tac env=\"env\" and delta=\"delta\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"FunTy UnitTy UnitTy UsePerm a\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (simp_all)\n apply (rule_tac value_is_sexp)\n apply (auto)\n apply (rule_tac x=\"UsePerm\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"np_dom_use_env env delta e\" in exI)\n apply (rule_tac x=\"np_dom_use_env env delta e\" in exI)\n apply (auto)\n (* the idea is that the infl_sexp_wp requirements are strictly greater than np_dom, and since np_dom is strong, there is an exact way of\n subtracting to get to np_dom. (we do cheat a little by lifting rx2). *)\n apply (rule_tac t=\"np_dom_use_env env delta e\" and s=\"diff_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3))\n (diff_use_env (lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r) (np_dom_use_env env delta e))\" in subst)\n apply (rule_tac sfl_diff_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (simp add: leq_use_env_def)\n apply (auto)\n (* to prove that the infl_sexp_wp reqs are greater than np_dom, we use the fact that any npv must have a permission *)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (auto)\n apply (case_tac \"comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3) x \\ OwnPerm\")\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac x=\"x\" and env=\"env\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (cut_tac r_sa=\"lift_use_env rx2 ra\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_no_own_both)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (simp add: is_own_def)\n apply (case_tac \"rx2 x\")\n apply (auto)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* with that in mind, we manipulate until we match the infl sexp lemma *)\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_req)\n apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n (* next, we must show that the differential is actually subtractible, which is true since it removes all non-prim vars *)\n apply (auto)\n apply (case_tac \"np_dom_use_env env delta e x \\ OwnPerm\")\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (cut_tac r_s=\"lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r\" and\n r_ex=\"np_dom_use_env env delta e\" and x=\"x\" in diff_use_none_ex)\n apply (simp)\n apply (simp add: own_env_vars_def)\n (* lastly, we prove the various inequalities for application to a unit const *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"np_dom_use_env env delta e\" in exI)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)(*\n apply (simp add: empty_use_env_def)\n apply (simp add: unlim_def)*)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac disj_empty_use_env1)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (rule_tac leq_empty_use_env)\n done \n \n (* ##### 4b. fork lemma: if x is an npv in 'e', then we have ownership permissions for 'h (fork e)' ##### *)\n \nlemma safe_fork_own_npv_use: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; well_formed_delta env delta;\n is_value e; x \\ non_prim_vars env delta e \\ \\ r_s1 x = OwnPerm\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n (* base case *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (simp)\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (simp add: is_own_def)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* rhs pair *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done \n \n (* ##### 4c. fork lemma: proves well-typedness of original thread post-fork ##### *)\n\n (* this lemma proves that e should be removable from the fork. combined with the previous lemmas, we can also remove the\n permissions of e, and type the two resultant expressions disjointly. *)\n \nlemma safe_fork_exp_ih: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; well_formed_delta env delta; is_value e \\ \\\n well_typed env delta r_s1 (app_hole h (ConstExp UnitConst)) tau r_s2 rx\"\n apply (induct h arbitrary: env r_s1 e tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lhs induct *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n done\n \n (* uses:\n - safe_fork_hole_npv_use: to determine that if x is an np-var, it is not in h\n - 4b (safe_fork_own_npv_use) to determine that if x is an np-var, we own it\n *)\n \nlemma safe_fork_exp: \"\\ well_typed env delta r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n well_formed_delta env delta; sub_use_env s r_s1; wf_hole h; is_value e \\ \\\n well_typed env delta (diff_use_env r_s1 (np_dom_use_env env delta e)) (app_hole h (ConstExp UnitConst)) tau\n (diff_use_env r_s2 (np_dom_use_env env delta e)) (diff_use_env rx (np_dom_use_env env delta e))\"\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac safe_fork_exp_ih)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* we want to show that if x is in the dominator, it is not an np-var in h.\n > if x is an np-var itself, it cannot be in e by lemma *)\n apply (case_tac \"x \\ non_prim_vars env delta e\")\n apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" in safe_fork_hole_npv_use)\n apply (auto)\n apply (simp add: own_env_vars_def)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)(*\n (* otherwise, x is in the completion. we identify its ancestor z. *)\n apply (case_tac \"\\xa. x = Loc xa \\ (\\l z. Loc z \\ non_prim_vars env e \\ path_lookup rs_map z l xa)\")\n apply (auto)\n (* we note that z is a np-var of e therefore r_s1 z = Own *)\n apply (cut_tac x=\"Loc z\" and env=\"env\" in safe_fork_own_npv_use)\n apply (auto)\n (* x then is in the lookup map of some parent y. *)\n apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"xa\" in path_lookup_parent)\n apply (auto)\n (* with that in mind, by separation, x is disjoint from r_s1. *)\n apply (case_tac \"r_s1 (Loc xa) \\ NoPerm\")\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc xa\" in allE)\n apply (auto)\n (* by extension, x is not in 'h (fork e)' *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"Loc xa\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* the very last part is showing that x not in 'h (fork e)' implies x not in 'h ()'. *)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_res_vars2)\n apply (auto)*)\n done\n\n (* ##### 4d. fork lemma: structural lemma for thread-disjointness in fork case ###### *)\n \nlemma alift_strong_disj_use_env1: \"\\ strong_disj_use_env r_x r_s \\ \\ strong_disj_use_env (lift_use_env r_x r) r_s\" \n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \n (* a special lemma that makes it easier to comprehend our strategy for proving the disjointness of the fork *)\nlemma fork_disj_nres_map: \"\\ disj_nres_map p_map; p_map u = Some r_s; is_own r;\n leq_use_env r_xa (lift_use_env r_s r); leq_use_env r_xb (lift_use_env r_s r);\n strong_disj_use_env r_xa r_xb \\ \\ disj_nres_map (add_env (add_env p_map u r_xa) v r_xb)\"\n apply (rule_tac disj_add_nres_map)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n (* first we must prove the disjointness of the new assignment to u *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"u = x\")\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" in nres_rem_same)\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" in nres_rem_diff)\n apply (auto)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* next we prove the disjointness of v, starting with its disjointness to u *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = v\")\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" in nres_rem_same)\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (case_tac \"x = u\")\n apply (auto)\n apply (case_tac \"\\ nres_lookup (add_env p_map u r_xa) u = r_xa\")\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"u\" in nres_rem_diff)\n apply (auto)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp)\n (* next we prove its disjointess to the rest of the map *)\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"x\" in nres_rem_diff)\n apply (auto)\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" and r_s=\"r_xa\" in nres_add_diff)\n apply (auto)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (simp add: nres_lookup_def)\n apply (simp)\n done\n\n (* ##### 4_X. process reduction validity for fork case ##### *) \n \nlemma lift_sep_nres_map: \"\\ sep_nres_map r_s rs_map \\ \\ sep_nres_map (lift_use_env r_s r) rs_map\" \n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (auto)\n done\n \nlemma srps_fork_case: \"\\well_typed_system env delta p_map s2 ps1; r_ax = ForkAct; ps1 u = Some (app_hole h (AppExp (ConstExp ForkConst) e));\n wf_hole h; is_value e; ps2 = add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)); fresh_var ps1 v;\n s1 = s2\\\n \\ \\r_s g_ax. (\\p_map'. well_typed_system (red_env env g_ax) (red_delta delta g_ax) p_map' s2\n (add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)))) \\\n safe_act s2 r_s g_ax\"\n (* prelim: well_formed_delta / mem_val_env *)\n apply (cut_tac delta=\"delta\" in wts_well_formed_delta)\n apply (simp add: well_typed_system_def)\n apply (auto)\n apply (cut_tac env=\"env\" in wts_mem_val_env)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* fork case. no resources are generated in this step *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* before we can give the new process map types, we have to get the well-typedness statement for h (fork e) *)\n (*apply (case_tac \"\\ (case ps1 u of None \\ True\n | Some e \\ (case lookup_mem p_map u of None \\ False\n | Some (r_c, s') \\ \\rx r_s r_s2. well_typed env r_s e UnitTy r_s2 rx \\ valid_use_env s2 rs_map r_c r_s))\")*)\n apply (case_tac \"\\ (\n disj_nres_map p_map \\ (\\u. case ps1 u of None \\ True | Some e \\\n (case p_map u of None \\ False | Some r_s \\ \\rx r_s2. well_typed env delta r_s e UnitTy r_s2 rx)))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (case_tac \"\\ (case ps1 u of None \\ True | Some e \\ (case p_map u of None \\ False | Some r_s \\ \\rx r_s2. well_typed env delta r_s e UnitTy r_s2 rx))\")\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (case_tac \"p_map u\")\n apply (auto)\n (* using the fork lemmas, we can generate a type for e + a type for h () *)\n apply (cut_tac eq_own)\n apply (auto)\n apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and r=\"r\" in safe_fork_lam)\n apply (auto)\n apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and s=\"s2\" in safe_fork_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)\n (* - complete proof that a is still valid *)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n (* - prelim: prove that (full_dom_use_env env rs_map e) \\ a (old complete map) *)(*\n apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and r_c=\"a\" and h=\"h\" and env=\"env\" in valid_full_dom_leq_use_env)\n apply (auto)\n apply (simp add: well_typed_state_def)*)\n (* - prelim: np_dom_use_env env e \\ lift_use_env a r *)\n apply (cut_tac r_sc=\"np_dom_use_env env delta e\" and r_sb=\"np_dom_use_env env delta (app_hole h (AppExp (ConstExp ForkConst) e))\" \n and r_sa=\"lift_use_env a r\" in trans_leq_use_env)\n apply (rule_tac wt_np_leq_use_env)\n apply (auto)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac dist_dom_leq_use_env)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (cut_tac x=\"x\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_res_vars)\n apply (auto)\n (* we fill in the new process map, by taking perms from 'u' [[ h () ]] and giving them to 'v' [[ e () ]] *)\n apply (rule_tac x=\"add_env (add_env p_map u (diff_use_env a (np_dom_use_env env delta e))) v (np_dom_use_env env delta e)\" in exI)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* completeness of the new process map *)(*\n apply (rule_tac add_full_nres_map)\n apply (rule_tac add_full_nres_map)\n apply (simp)*)\n (* disjointness of the new process map *)\n apply (rule_tac r_s=\"a\" and r=\"r\" in fork_disj_nres_map)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"np_dom_use_env env delta e\" in strong_disj_leq_use_env2)\n apply (rule_tac reduce_strong_disj_use_env)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"a\" in mini_disj_strong_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac mini_disj_diff_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac id_leq_use_env)\n (* proving everything is still well-typed. we start with ua = v, ie the 'e ()' thread. *)\n apply (case_tac \"ua = v\")\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n Some (unit_app_abbrev e)\")\n apply (simp add: add_env_def)\n apply (simp add: unit_app_abbrev_def)\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (np_dom_use_env env delta e))) v (np_dom_use_env env delta e)) v =\n Some (np_dom_use_env env delta e)\")\n apply (simp add: add_env_def)\n apply (auto)\n (* - properness *)(*\n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in proper_app_hole_split2)\n apply (simp)\n apply (simp add: unit_app_abbrev_def)\n apply (simp add: proper_exp_def)*)\n (* - well-typedness for ua = u, the 'h ()' thread*)\n apply (case_tac \"ua = u\")\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n Some (app_hole h (ConstExp UnitConst))\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (np_dom_use_env env delta e))) v (np_dom_use_env env delta e)) u =\n Some (diff_use_env a (np_dom_use_env env delta e))\")\n apply (simp add: add_env_def)\n apply (auto)\n (* - properness *)(*\n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" in proper_app_hole_split1)\n apply (simp)\n apply (rule_tac proper_app_hole_recon)\n apply (simp)\n apply (simp add: proper_exp_def)*)\n (* - well-typedness for unaltered threads *)\n apply (erule_tac x=\"ua\" in allE)\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua = ps1 ua\")\n apply (simp add: add_env_def)\n apply (case_tac \"ps1 ua\")\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (np_dom_use_env env delta e))) v (np_dom_use_env env delta e)) ua =\n p_map ua\")\n apply (simp add: add_env_def)\n apply (auto)(*\n apply (erule_tac x=\"ua\" in allE)\n apply (auto)*)\n (* proving the new process map is contained in the state *)\n apply (rule_tac add_sub_nres_map1)\n apply (rule_tac add_sub_nres_map1)\n apply (simp)\n apply (rule_tac r_s=\"a\" in trans_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"lift_use_env a r\" in trans_sub_use_env)\n apply (rule_tac lift_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* proving that separation still holds. we again start with ua = v, the 'e ()' thread *)(*\n apply (case_tac \"ua = v\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"lift_use_env a r\" in leq_sep_nres_map)\n apply (simp)\n apply (rule_tac lift_sep_nres_map)\n apply (erule_tac x=\"u\" in allE)\n apply (simp)\n (* - same for ua = u, ie the 'h ()' thread *)\n apply (case_tac \"ua = u\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"a\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (erule_tac x=\"u\" in allE)\n apply (simp)\n (* - lastly prove separation for original threads *)\n apply (simp add: add_env_def)*)\n done\n \n (* ##### 5. final proof composition ##### *) \n \nlemma safe_red_proc_set: \"\\ well_typed_system env delta p_map s1 ps1; red_proc_set (s1, ps1) r_ax (s2, ps2); valid_reduct app_red_exp \\ \\\n (\\ r_s g_ax p_map'. well_typed_system (red_env env g_ax) (red_delta delta g_ax) p_map' s2 ps2 \\ safe_act s1 r_s g_ax)\"\n (* split over process reduction type. *)\n apply (case_tac \"r_ax\")\n apply (auto)\n (* single thread action case. *)\n apply (rule_tac srps_thread_case)\n apply (auto)\n (* fork case. *)\n apply (rule_tac srps_fork_case)\n apply (auto)\n (* send case. *)\n apply (rule_tac srps_send_case)\n apply (auto)\ndone\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/ProcLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.26672283058378915}} {"text": "theory Refine_C_AC\nimports\n \"../lib/ComCorres\"\n \"../AutoCorres/Impl\"\nbegin\n\nlemma refines: \"C_minimal \\ AC_minimal\"\nproof -\n let ?m\\<^sub>A = \"minimalAC\" and ?m\\<^sub>C = \"Call minimal_'proc\"\n and ?\\ = \"minimal_global_addresses.\\\" and ?P = \"(\\s. True)\"\n and ?st = \"minimal.lift_global_heap \\ globals\"\n and ?rx = \"sint \\ ret__int_'\"\n have \"Run AC_minimal = lift_nd ?m\\<^sub>A\" unfolding AC_minimal_def by simp\n moreover have \"Run C_minimal = lift_com ?m\\<^sub>C ?\\\" unfolding C_minimal_def by simp\n moreover have \"\\s s\\<^sub>C. s\\<^sub>C \\ Init C_minimal s \\\n ?P s\\<^sub>C \\ \\ snd (minimal.minimal' (?st s\\<^sub>C)) \\ ?st s\\<^sub>C \\ Init AC_minimal s\"\n unfolding C_minimal_def AC_minimal_def minimal.minimal'_def\n by (simp add: snd_return)\n moreover have \"ac_corres ?st ?\\ ?rx ?P ?m\\<^sub>A ?m\\<^sub>C\" using minimal.minimal'_ac_corres .\n moreover have \"\\s\\<^sub>C'. Fin AC_minimal (?st s\\<^sub>C') = Fin C_minimal s\\<^sub>C'\"\n unfolding AC_minimal_def C_minimal_def by simp\n ultimately show ?thesis by (metis corres_refines snd_liftE)\nqed\n\nend", "meta": {"author": "CriticalTechnologiesInc", "repo": "SableModel", "sha": "a452a2b5e3636b612a4d04cfb6e2ab1c1a132639", "save_path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel", "path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel/SableModel-a452a2b5e3636b612a4d04cfb6e2ab1c1a132639/Proofs/Refine_C_AC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.2667228248133341}} {"text": "(* Title: Aodv_Loop_Freedom.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke, Inria\n*)\n\nsection \"Lift and transfer invariants to show loop freedom\"\n\ntheory Aodv_Loop_Freedom\nimports AWN.OClosed_Transfer AWN.Qmsg_Lifting Global_Invariants Loop_Freedom\nbegin\n\nsubsection \\Lift to parallel processes with queues\\\n\nlemma par_step_no_change_on_send_or_receive:\n fixes \\ s a \\' s'\n assumes \"((\\, s), a, (\\', s')) \\ oparp_sos i (oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i) (seqp_sos \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G)\"\n and \"a \\ \\\"\n shows \"\\' i = \\ i\"\n using assms by (rule qmsg_no_change_on_send_or_receive)\n\nlemma par_nhop_quality_increases:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\ (otherwith ((=)) {i} (orecvmsg (\\\\ m.\n msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i} \\)\n global (\\\\. \\dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n proof (rule lift_into_qmsg [OF seq_nhop_quality_increases])\n show \"opaodv i \\\\<^sub>A (otherwith ((=)) {i}\n (orecvmsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n proof (rule ostep_invariant_weakenE [OF oquality_increases], simp_all)\n fix t :: \"(((nat \\ state) \\ (state, msg, pseqp, pseqp label) seqp), msg seq_action) transition\"\n assume \"onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\((\\, _), _, (\\', _)). \\j. quality_increases (\\ j) (\\' j)) t\"\n thus \"quality_increases (fst (fst t) i) (fst (snd (snd t)) i)\"\n by (cases t) (clarsimp dest!: onllD, metis aodv_ex_label)\n next\n fix \\ \\' a\n assume \"otherwith ((=)) {i}\n (orecvmsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)) \\ \\' a\"\n thus \"otherwith quality_increases {i} (orecvmsg (\\_. rreq_rrep_sn)) \\ \\' a\"\n by - (erule weaken_otherwith, auto)\n qed\n qed auto\n\nlemma par_rreq_rrep_sn_quality_increases:\n \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n proof -\n have \"opaodv i \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule ostep_invariant_weakenE [OF olocal_quality_increases])\n (auto dest!: onllD seqllD elim!: aodv_ex_labelE)\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nlemma par_rreq_rrep_nsqn_fresh_any_step:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n proof -\n have \"opaodv i \\\\<^sub>A (\\\\ _. (orecvmsg (\\_. rreq_rrep_sn)) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n proof (rule ostep_invariant_weakenE [OF rreq_rrep_nsqn_fresh_any_step_invariant])\n fix t\n assume \"onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\((\\, _), a, _). anycast (msg_fresh \\) a) t\"\n thus \"globala (\\(\\, a, \\'). anycast (msg_fresh \\) a) t\"\n by (cases t) (clarsimp dest!: onllD, metis aodv_ex_label)\n qed auto\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. (orecvmsg (\\_. rreq_rrep_sn)) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). anycast (msg_fresh \\) a)\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nlemma par_anycast_msg_zhops:\n shows \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n proof -\n from anycast_msg_zhops initiali_aodv oaodv_trans aodv_trans\n have \"opaodv i \\\\<^sub>A (act TT, other (\\_ _. True) {i} \\)\n seqll i (onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\(_, a, _). anycast msg_zhops a))\"\n by (rule open_seq_step_invariant)\n hence \"opaodv i \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n proof (rule ostep_invariant_weakenE)\n fix t :: \"(((nat \\ state) \\ (state, msg, pseqp, pseqp label) seqp), msg seq_action) transition\"\n assume \"seqll i (onll \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (\\(_, a, _). anycast msg_zhops a)) t\"\n thus \"globala (\\(_, a, _). anycast msg_zhops a) t\"\n by (cases t) (clarsimp dest!: seqllD onllD, metis aodv_ex_label)\n qed simp_all\n hence \"opaodv i \\\\\\<^bsub>i\\<^esub> qmsg \\\\<^sub>A (\\\\ _. orecvmsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). anycast msg_zhops a)\"\n by (rule lift_step_into_qmsg_statelessassm) simp_all\n thus ?thesis by rule auto\n qed\n\nsubsection \\Lift to nodes\\\n\nlemma node_step_no_change_on_send_or_receive:\n assumes \"((\\, NodeS i P R), a, (\\', NodeS i' P' R')) \\ onode_sos\n (oparp_sos i (oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i) (seqp_sos \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G))\"\n and \"a \\ \\\"\n shows \"\\' i = \\ i\"\n using assms\n by (cases a) (auto elim!: par_step_no_change_on_send_or_receive)\n\nlemma node_nhop_quality_increases:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\n (otherwith ((=)) {i}\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases {i}\n \\) global (\\\\. \\dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n by (rule node_lift [OF par_nhop_quality_increases]) auto\n\nlemma node_quality_increases:\n \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, _, \\'). quality_increases (\\ i) (\\' i))\"\n by (rule node_lift_step_statelessassm [OF par_rreq_rrep_sn_quality_increases]) simp\n\nlemma node_rreq_rrep_nsqn_fresh_any_step:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). castmsg (msg_fresh \\) a)\"\n by (rule node_lift_anycast_statelessassm [OF par_rreq_rrep_nsqn_fresh_any_step])\n\nlemma node_anycast_msg_zhops:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R \\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\, other (\\_ _. True) {i} \\)\n globala (\\(_, a, _). castmsg msg_zhops a)\"\n by (rule node_lift_anycast_statelessassm [OF par_anycast_msg_zhops])\n\nlemma node_silent_change_only:\n shows \"\\ i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i \\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_ _. True) \\,\n other (\\_ _. True) {i} \\)\n globala (\\(\\, a, \\'). a \\ \\ \\ \\' i = \\ i)\"\n proof (rule ostep_invariantI, simp (no_asm), rule impI)\n fix \\ \\ a \\' \\'\n assume or: \"(\\, \\) \\ oreachable (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i\\\\<^sub>o)\n (\\\\ _. oarrivemsg (\\_ _. True) \\)\n (other (\\_ _. True) {i})\"\n and tr: \"((\\, \\), a, (\\', \\')) \\ trans (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\<^sub>i\\\\<^sub>o)\"\n and \"a \\ \\\\<^sub>n\"\n from or obtain p R where \"\\ = NodeS i p R\"\n by - (drule node_net_state, metis)\n with tr have \"((\\, NodeS i p R), a, (\\', \\'))\n \\ onode_sos (oparp_sos i (trans (opaodv i)) (trans qmsg))\"\n by simp\n thus \"\\' i = \\ i\" using \\a \\ \\\\<^sub>n\\ \n by (cases rule: onode_sos.cases)\n (auto elim: qmsg_no_change_on_send_or_receive)\n qed\n\nsubsection \\Lift to partial networks\\\n\nlemma arrive_rreq_rrep_nsqn_fresh_inc_sn [simp]:\n assumes \"oarrivemsg (\\\\ m. msg_fresh \\ m \\ P \\ m) \\ m\"\n shows \"oarrivemsg (\\_. rreq_rrep_sn) \\ m\"\n using assms by (cases m) auto\n\nlemma opnet_nhop_quality_increases:\n shows \"opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p \\\n (otherwith ((=)) (net_tree_ips p)\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)),\n other quality_increases (net_tree_ips p) \\)\n global (\\\\. \\i\\net_tree_ips p. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n proof (rule pnet_lift [OF node_nhop_quality_increases])\n fix i R\n have \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\,\n other (\\_ _. True) {i} \\) globala (\\(\\, a, \\').\n castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a)\"\n proof (rule ostep_invariantI, simp (no_asm))\n fix \\ s a \\' s'\n assume or: \"(\\, s) \\ oreachable (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o)\n (\\\\ _. oarrivemsg (\\_. rreq_rrep_sn) \\)\n (other (\\_ _. True) {i})\"\n and tr: \"((\\, s), a, (\\', s')) \\ trans (\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o)\"\n and am: \"oarrivemsg (\\_. rreq_rrep_sn) \\ a\"\n from or tr am have \"castmsg (msg_fresh \\) a\"\n by (auto dest!: ostep_invariantD [OF node_rreq_rrep_nsqn_fresh_any_step])\n moreover from or tr am have \"castmsg (msg_zhops) a\"\n by (auto dest!: ostep_invariantD [OF node_anycast_msg_zhops])\n ultimately show \"castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a\"\n by (case_tac a) auto\n qed\n thus \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, _).\n castmsg (\\m. msg_fresh \\ m \\ msg_zhops m) a)\"\n by rule auto\n next\n fix i R\n show \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, \\').\n a \\ \\ \\ (\\d. a \\ i:deliver(d)) \\ \\ i = \\' i)\"\n by (rule ostep_invariant_weakenE [OF node_silent_change_only]) auto\n next\n fix i R\n show \"\\i : opaodv i \\\\\\<^bsub>i\\<^esub> qmsg : R\\\\<^sub>o \\\\<^sub>A\n (\\\\ _. oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\,\n other quality_increases {i} \\) globala (\\(\\, a, \\').\n a = \\ \\ (\\d. a = i:deliver(d)) \\ quality_increases (\\ i) (\\' i))\"\n by (rule ostep_invariant_weakenE [OF node_quality_increases]) auto\n qed simp_all\n\nsubsection \\Lift to closed networks\\\n\nlemma onet_nhop_quality_increases:\n shows \"oclosed (opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p)\n \\ (\\_ _ _. True, other quality_increases (net_tree_ips p) \\)\n global (\\\\. \\i\\net_tree_ips p. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n (is \"_ \\ (_, ?U \\) ?inv\")\n proof (rule inclosed_closed)\n from opnet_nhop_quality_increases\n show \"opnet (\\i. opaodv i \\\\\\<^bsub>i\\<^esub> qmsg) p\n \\ (otherwith ((=)) (net_tree_ips p) inoclosed, ?U \\) ?inv\"\n proof (rule oinvariant_weakenE)\n fix \\ \\' :: \"ip \\ state\" and a :: \"msg node_action\"\n assume \"otherwith ((=)) (net_tree_ips p) inoclosed \\ \\' a\"\n thus \"otherwith ((=)) (net_tree_ips p)\n (oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m)) \\ \\' a\"\n proof (rule otherwithEI)\n fix \\ :: \"ip \\ state\" and a :: \"msg node_action\"\n assume \"inoclosed \\ a\"\n thus \"oarrivemsg (\\\\ m. msg_fresh \\ m \\ msg_zhops m) \\ a\"\n proof (cases a)\n fix ii ni ms\n assume \"a = ii\\ni:arrive(ms)\"\n moreover with \\inoclosed \\ a\\ obtain d di where \"ms = newpkt(d, di)\"\n by (cases ms) auto\n ultimately show ?thesis by simp\n qed simp_all\n qed\n qed\n qed\n\nsubsection \\Transfer into the standard model\\\n\ninterpretation aodv_openproc: openproc paodv opaodv id\n rewrites \"aodv_openproc.initmissing = initmissing\"\n proof -\n show \"openproc paodv opaodv id\"\n proof unfold_locales\n fix i :: ip\n have \"{(\\, \\). (\\ i, \\) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i \\ (\\j. j \\ i \\ \\ j \\ fst ` \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V j)} \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def\n proof (rule equalityD1)\n show \"\\f p. {(\\, \\). (\\ i, \\) \\ {(f i, p)} \\ (\\j. j \\ i\n \\ \\ j \\ fst ` {(f j, p)})} = {(f, p)}\"\n by (rule set_eqI) auto\n qed\n thus \"{ (\\, \\) |\\ \\ s. s \\ init (paodv i)\n \\ (\\ i, \\) = id s\n \\ (\\j. j\\i \\ \\ j \\ (fst o id) ` init (paodv j)) } \\ init (opaodv i)\"\n by simp\n next\n show \"\\j. init (paodv j) \\ {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def by simp\n next\n fix i s a s' \\ \\'\n assume \"\\ i = fst (id s)\"\n and \"\\' i = fst (id s')\"\n and \"(s, a, s') \\ trans (paodv i)\"\n then obtain q q' where \"s = (\\ i, q)\"\n and \"s' = (\\' i, q')\"\n and \"((\\ i, q), a, (\\' i, q')) \\ trans (paodv i)\" \n by (cases s, cases s') auto\n from this(3) have \"((\\, q), a, (\\', q')) \\ trans (opaodv i)\"\n by simp (rule open_seqp_action [OF aodv_wf])\n\n with \\s = (\\ i, q)\\ and \\s' = (\\' i, q')\\\n show \"((\\, snd (id s)), a, (\\', snd (id s'))) \\ trans (opaodv i)\"\n by simp\n qed\n then interpret opn: openproc paodv opaodv id .\n have [simp]: \"\\i. (SOME x. x \\ (fst o id) ` init (paodv i)) = aodv_init i\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def by simp\n hence \"\\i. openproc.initmissing paodv id i = initmissing i\"\n unfolding opn.initmissing_def opn.someinit_def initmissing_def\n by (auto split: option.split)\n thus \"openproc.initmissing paodv id = initmissing\" ..\n qed\n\ninterpretation aodv_openproc_par_qmsg: openproc_parq paodv opaodv id qmsg\n rewrites \"aodv_openproc_par_qmsg.netglobal = netglobal\"\n and \"aodv_openproc_par_qmsg.initmissing = initmissing\"\n proof -\n show \"openproc_parq paodv opaodv id qmsg\"\n by (unfold_locales) simp\n then interpret opq: openproc_parq paodv opaodv id qmsg .\n\n have im: \"\\\\. openproc.initmissing (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) \\\n = initmissing \\\"\n unfolding opq.initmissing_def opq.someinit_def initmissing_def\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G_def by (clarsimp cong: option.case_cong)\n thus \"openproc.initmissing (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) = initmissing\"\n by (rule ext)\n have \"\\P \\. openproc.netglobal (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) P \\\n = netglobal P \\\"\n unfolding opq.netglobal_def netglobal_def opq.initmissing_def initmissing_def opq.someinit_def\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>Q\\<^sub>M\\<^sub>S\\<^sub>G_def\n by (clarsimp cong: option.case_cong\n simp del: One_nat_def\n simp add: fst_initmissing_netgmap_default_aodv_init_netlift\n [symmetric, unfolded initmissing_def])\n thus \"openproc.netglobal (\\i. paodv i \\\\ qmsg) (\\(p, q). (fst (id p), snd (id p), q)) = netglobal\"\n by auto\n qed\n\nlemma net_nhop_quality_increases:\n assumes \"wf_net_tree n\"\n shows \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal\n (\\\\. \\i dip. let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n (is \"_ \\ netglobal (\\\\. \\i. ?inv \\ i)\")\n proof -\n from \\wf_net_tree n\\\n have proto: \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal (\\\\. \\i\\net_tree_ips n. \\dip.\n let nhip = the (nhop (rt (\\ i)) dip)\n in dip \\ vD (rt (\\ i)) \\ vD (rt (\\ nhip)) \\ nhip \\ dip\n \\ (rt (\\ i)) \\\\<^bsub>dip\\<^esub> (rt (\\ nhip)))\"\n by (rule aodv_openproc_par_qmsg.close_opnet [OF _ onet_nhop_quality_increases])\n show ?thesis\n unfolding invariant_def opnet_sos.opnet_tau1\n proof (rule, simp only: aodv_openproc_par_qmsg.netglobalsimp\n fst_initmissing_netgmap_pair_fst, rule allI)\n fix \\ i\n assume sr: \"\\ \\ reachable (closed (pnet (\\i. paodv i \\\\ qmsg) n)) TT\"\n hence \"\\i\\net_tree_ips n. ?inv (fst (initmissing (netgmap fst \\))) i\"\n by - (drule invariantD [OF proto],\n simp only: aodv_openproc_par_qmsg.netglobalsimp\n fst_initmissing_netgmap_pair_fst)\n thus \"?inv (fst (initmissing (netgmap fst \\))) i\"\n proof (cases \"i\\net_tree_ips n\")\n assume \"i\\net_tree_ips n\"\n from sr have \"\\ \\ reachable (pnet (\\i. paodv i \\\\ qmsg) n) TT\" ..\n hence \"net_ips \\ = net_tree_ips n\" ..\n with \\i\\net_tree_ips n\\ have \"i\\net_ips \\\" by simp\n hence \"(fst (initmissing (netgmap fst \\))) i = aodv_init i\"\n by simp\n thus ?thesis by simp\n qed metis\n qed\n qed\n\nsubsection \\Loop freedom of AODV\\\n\ntheorem aodv_loop_freedom:\n assumes \"wf_net_tree n\"\n shows \"closed (pnet (\\i. paodv i \\\\ qmsg) n) \\ netglobal (\\\\. \\dip. irrefl ((rt_graph \\ dip)\\<^sup>+))\"\n using assms by (rule aodv_openproc_par_qmsg.netglobal_weakenE\n [OF net_nhop_quality_increases inv_to_loop_freedom])\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AODV/Aodv_Loop_Freedom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.26670399308765474}} {"text": "(*<*)\n(*\n Title: Theory DataDependenciesCaseStudy.thy\n Author: Maria Spichkova , 2014\n*)\n(*>*)\n\nsection \"Case Study: Verification of Properties\"\n \ntheory DataDependenciesCaseStudy\n imports DataDependencies\nbegin\n\n\nsubsection \\Correct composition of components\\\n\n\\ \\the lemmas AbstrLevels X Y with corresponding proofs can be composend\\\n\\ \\and proven automatically, their proofs are identical\\\nlemma AbstrLevels_A1_A11:\n assumes \"sA1 \\ AbstrLevel i\"\n shows \"sA11 \\ AbstrLevel i\"\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n\nlemma AbstrLevels_A1_A12:\n assumes \"sA1 \\ AbstrLevel i\"\n shows \"sA12 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A21:\n assumes \"sA2 \\ AbstrLevel i\"\n shows \"sA21 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A22:\n assumes \"sA2 \\ AbstrLevel i\"\n shows \"sA22 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A23:\n assumes \"sA2 \\ AbstrLevel i\"\n shows \"sA23 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A3_A31:\n assumes \"sA3 \\ AbstrLevel i\"\n shows \"sA31 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A3_A32:\n assumes \"sA3 \\ AbstrLevel i\"\n shows \"sA32 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A4_A41:\n assumes \"sA4 \\ AbstrLevel i\"\n shows \"sA41 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A4_A42:\n assumes \"sA4 \\ AbstrLevel i\"\n shows \"sA42 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A7_A71:\n assumes \"sA7 \\ AbstrLevel i\"\n shows \"sA71 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A7_A72:\n assumes \"sA7 \\ AbstrLevel i\"\n shows \"sA72 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\nlemma AbstrLevels_A8_A81:\n assumes \"sA8 \\ AbstrLevel i\"\n shows \"sA81 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\nlemma AbstrLevels_A8_A82:\n assumes \"sA8 \\ AbstrLevel i\"\n shows \"sA82 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A91:\n assumes \"sA9 \\ AbstrLevel i\"\n shows \"sA91 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A92:\n assumes \"sA9 \\ AbstrLevel i\"\n shows \"sA92 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A93:\n assumes \"sA9 \\ AbstrLevel i\"\n shows \"sA93 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1_A12:\n assumes \"sS1 \\ AbstrLevel i\"\n shows \"sA12 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S2_A11:\n assumes \"sS2 \\ AbstrLevel i\"\n shows \"sA11 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S3_A21:\n assumes \"sS3 \\ AbstrLevel i\"\n shows \"sA21 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4_A23:\n assumes \"sS4 \\ AbstrLevel i\"\n shows \"sA23 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S5_A32:\n assumes \"sS5 \\ AbstrLevel i\"\n shows \"sA32 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A22:\n assumes \"sS6 \\ AbstrLevel i\"\n shows \"sA22 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A31:\n assumes \"sS6 \\ AbstrLevel i\"\n shows \"sA31 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A41:\n assumes \"sS6 \\ AbstrLevel i\"\n shows \"sA41 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7_A42:\n assumes \"sS7 \\ AbstrLevel i\"\n shows \"sA42 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S8_A5:\n assumes \"sS8 \\ AbstrLevel i\"\n shows \"sA5 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S9_A6:\n assumes \"sS9 \\ AbstrLevel i\"\n shows \"sA6 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S10_A71:\n assumes \"sS10 \\ AbstrLevel i\"\n shows \"sA71 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11_A72:\n assumes \"sS11 \\ AbstrLevel i\"\n shows \"sA72 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S12_A81:\n assumes \"sS12 \\ AbstrLevel i\"\n shows \"sA81 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S12_A91:\n assumes \"sS12 \\ AbstrLevel i\"\n shows \"sA91 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S13_A92:\n assumes \"sS13 \\ AbstrLevel i\"\n shows \"sA92 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S14_A82:\n assumes \"sS14 \\ AbstrLevel i\"\n shows \"sA82 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S15_A93:\n assumes \"sS15 \\ AbstrLevel i\"\n shows \"sA93 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1opt_A11:\n assumes \"sS1opt \\ AbstrLevel i\"\n shows \"sA11 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1opt_A12:\n assumes \"sS1opt \\ AbstrLevel i\"\n shows \"sA12 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A23:\n assumes \"sS4opt \\ AbstrLevel i\"\n shows \"sA23 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A32:\n assumes \"sS4opt \\ AbstrLevel i\"\n shows \"sA32 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A22:\n assumes \"sS4opt \\ AbstrLevel i\"\n shows \"sA22 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A31:\n assumes \"sS4opt \\ AbstrLevel i\"\n shows \"sA31 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A41:\n assumes \"sS4opt \\ AbstrLevel i\"\n shows \"sA41 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7opt_A42:\n assumes \"sS7opt \\ AbstrLevel i\"\n shows \"sA42 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7opt_A5:\n assumes \"sS7opt \\ AbstrLevel i\"\n shows \"sA5 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A72:\n assumes \"sS11opt \\ AbstrLevel i\"\n shows \"sA72 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A82:\n assumes \"sS11opt \\ AbstrLevel i\"\n shows \"sA82 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A93:\n assumes \"sS11opt \\ AbstrLevel i\"\n shows \"sA93 \\ AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add: AbstrLevel1, simp add: AbstrLevel2, simp add: AbstrLevel3)\n(*>*)\n\n\nlemma correctCompositionDiffLevelsA1: \"correctCompositionDiffLevels sA1\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A1_A11 AbstrLevels_A1_A12)(*>*)\n\n\nlemma correctCompositionDiffLevelsA2: \"correctCompositionDiffLevels sA2\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A2_A21 AbstrLevels_A2_A22 AbstrLevels_A2_A23)(*>*)\n\n\nlemma correctCompositionDiffLevelsA3: \"correctCompositionDiffLevels sA3\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A3_A31 AbstrLevels_A3_A32)(*>*)\n\n\nlemma correctCompositionDiffLevelsA4: \"correctCompositionDiffLevels sA4\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A4_A41 AbstrLevels_A4_A42)(*>*)\n\n\n\\ \\lemmas correctCompositionDiffLevelsX and corresponding proofs\\\n\\ \\are identical for all elementary components, they can be constructed automatically\\ \nlemma correctCompositionDiffLevelsA5: \"correctCompositionDiffLevels sA5\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA6: \"correctCompositionDiffLevels sA6\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA7: \"correctCompositionDiffLevels sA7\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A7_A71 AbstrLevels_A7_A72)(*>*)\n\nlemma correctCompositionDiffLevelsA8: \"correctCompositionDiffLevels sA8\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A8_A81 AbstrLevels_A8_A82)(*>*)\n\nlemma correctCompositionDiffLevelsA9: \"correctCompositionDiffLevels sA9\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A9_A91 AbstrLevels_A9_A92 AbstrLevels_A9_A93)(*>*)\n\n\n\nlemma correctCompositionDiffLevelsA12: \"correctCompositionDiffLevels sA12\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA21: \"correctCompositionDiffLevels sA21\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA22: \"correctCompositionDiffLevels sA22\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA23: \"correctCompositionDiffLevels sA23\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA31: \"correctCompositionDiffLevels sA31\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA32: \"correctCompositionDiffLevels sA32\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA41: \"correctCompositionDiffLevels sA41\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA42: \"correctCompositionDiffLevels sA42\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA71: \"correctCompositionDiffLevels sA71\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA72: \"correctCompositionDiffLevels sA72\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA81: \"correctCompositionDiffLevels sA81\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA82: \"correctCompositionDiffLevels sA82\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA91: \"correctCompositionDiffLevels sA91\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA92: \"correctCompositionDiffLevels sA92\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\n\n\nlemma correctCompositionDiffLevelsS1: \"correctCompositionDiffLevels sS1\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S1_A12) (*>*)\n\nlemma correctCompositionDiffLevelsS2: \"correctCompositionDiffLevels sS2\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S2_A11) (*>*)\n\nlemma correctCompositionDiffLevelsS3: \"correctCompositionDiffLevels sS3\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S3_A21) (*>*)\n\nlemma correctCompositionDiffLevelsS4: \"correctCompositionDiffLevels sS4\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S4_A23) (*>*)\n\nlemma correctCompositionDiffLevelsS5: \"correctCompositionDiffLevels sS5\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S5_A32) (*>*)\n\nlemma correctCompositionDiffLevelsS6: \"correctCompositionDiffLevels sS6\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S6_A22 AbstrLevels_S6_A31 AbstrLevels_S6_A41) (*>*)\n\nlemma correctCompositionDiffLevelsS7: \"correctCompositionDiffLevels sS7\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S7_A42) (*>*)\n\nlemma correctCompositionDiffLevelsS8: \"correctCompositionDiffLevels sS8\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S8_A5) (*>*)\n\nlemma correctCompositionDiffLevelsS9: \"correctCompositionDiffLevels sS9\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S9_A6) (*>*)\n\nlemma correctCompositionDiffLevelsS10: \"correctCompositionDiffLevels sS10\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S10_A71) (*>*)\n\nlemma correctCompositionDiffLevelsS11: \"correctCompositionDiffLevels sS11\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S11_A72) (*>*)\n\nlemma correctCompositionDiffLevelsS12: \"correctCompositionDiffLevels sS12\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S12_A81 AbstrLevels_S12_A91) (*>*)\n\nlemma correctCompositionDiffLevelsS13: \"correctCompositionDiffLevels sS13\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S13_A92) (*>*)\n\nlemma correctCompositionDiffLevelsS14: \"correctCompositionDiffLevels sS14\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S14_A82) (*>*)\n\nlemma correctCompositionDiffLevelsS15: \"correctCompositionDiffLevels sS15\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S15_A93) (*>*)\n\nlemma correctCompositionDiffLevelsS1opt: \"correctCompositionDiffLevels sS1opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S1opt_A11 AbstrLevels_S1opt_A12) (*>*)\n\nlemma correctCompositionDiffLevelsS4opt: \"correctCompositionDiffLevels sS4opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S4opt_A22 \n AbstrLevels_S4opt_A23 AbstrLevels_S4opt_A31 \n AbstrLevels_S4opt_A32 AbstrLevels_S4opt_A41) (*>*)\n\n\n\nlemma correctCompositionDiffLevelsS11opt: \"correctCompositionDiffLevels sS11opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S11opt_A72 \n AbstrLevels_S11opt_A82 AbstrLevels_S11opt_A93) (*>*)\n\nlemma correctCompositionDiffLevelsSYSTEM_holds:\n\"correctCompositionDiffLevelsSYSTEM\"\n(*<*)by (simp add: correctCompositionDiffLevelsSYSTEM_def, clarify, case_tac S, \nsimp add: correctCompositionDiffLevelsA1, \nsimp add: correctCompositionDiffLevelsA2,\nsimp add: correctCompositionDiffLevelsA3,\nsimp add: correctCompositionDiffLevelsA4,\nsimp add: correctCompositionDiffLevelsA5,\nsimp add: correctCompositionDiffLevelsA6,\nsimp add: correctCompositionDiffLevelsA7,\nsimp add: correctCompositionDiffLevelsA8,\nsimp add: correctCompositionDiffLevelsA9,\nsimp add: correctCompositionDiffLevelsA11,\nsimp add: correctCompositionDiffLevelsA12,\nsimp add: correctCompositionDiffLevelsA21,\nsimp add: correctCompositionDiffLevelsA22,\nsimp add: correctCompositionDiffLevelsA23,\nsimp add: correctCompositionDiffLevelsA31,\nsimp add: correctCompositionDiffLevelsA32,\nsimp add: correctCompositionDiffLevelsA41,\nsimp add: correctCompositionDiffLevelsA42,\nsimp add: correctCompositionDiffLevelsA71,\nsimp add: correctCompositionDiffLevelsA72,\nsimp add: correctCompositionDiffLevelsA81,\nsimp add: correctCompositionDiffLevelsA82,\nsimp add: correctCompositionDiffLevelsA91,\nsimp add: correctCompositionDiffLevelsA92,\nsimp add: correctCompositionDiffLevelsA93,\nsimp add: correctCompositionDiffLevelsS1,\nsimp add: correctCompositionDiffLevelsS2,\nsimp add: correctCompositionDiffLevelsS3,\nsimp add: correctCompositionDiffLevelsS4,\nsimp add: correctCompositionDiffLevelsS5,\nsimp add: correctCompositionDiffLevelsS6,\nsimp add: correctCompositionDiffLevelsS7,\nsimp add: correctCompositionDiffLevelsS8,\nsimp add: correctCompositionDiffLevelsS9,\nsimp add: correctCompositionDiffLevelsS10,\nsimp add: correctCompositionDiffLevelsS11,\nsimp add: correctCompositionDiffLevelsS12,\nsimp add: correctCompositionDiffLevelsS13,\nsimp add: correctCompositionDiffLevelsS14,\nsimp add: correctCompositionDiffLevelsS15,\nsimp add: correctCompositionDiffLevelsS1opt,\nsimp add: correctCompositionDiffLevelsS4opt,\nsimp add: correctCompositionDiffLevelsS7opt, \nsimp add: correctCompositionDiffLevelsS11opt)(*>*)\n\nlemma correctCompositionVARSYSTEM_holds:\n\"correctCompositionVARSYSTEM\"\nby (simp add: correctCompositionVARSYSTEM_def, clarify, case_tac S, (simp add: correctCompositionVAR_def)+)\n\nlemma correctDeCompositionVARSYSTEM_holds:\n\"correctDeCompositionVARSYSTEM\"\nby (simp add: correctDeCompositionVARSYSTEM_def, clarify, case_tac S, (simp add: correctDeCompositionVAR_def)+)\n\n\nsubsection \\Correct specification of the relations between channels\\\n\nlemma OUTfromChCorrect_data1: \"OUTfromChCorrect data1\"\nby (simp add: OUTfromChCorrect_def)\n\n\n\nlemma OUTfromChCorrect_data3: \"OUTfromChCorrect data3\"\nby (metis OUTfromCh.simps(3) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data4: \"OUTfromChCorrect data4\"\nby (metis IN.simps(2) OUT.simps(2) OUTfromCh.simps(4) OUTfromChCorrect_def insertI1 singleton_iff)\n\nlemma OUTfromChCorrect_data5: \"OUTfromChCorrect data5\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(14) OUT.simps(14) insertI1)\n\nlemma OUTfromChCorrect_data6: \"OUTfromChCorrect data6\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(15) OUT.simps(15) insertI1)\n\nlemma OUTfromChCorrect_data7: \"OUTfromChCorrect data7\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(16) OUT.simps(16) insertI1)\n\nlemma OUTfromChCorrect_data8: \"OUTfromChCorrect data8\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(18) OUT.simps(18) insertI1) \n\n \nlemma OUTfromChCorrect_data9: \"OUTfromChCorrect data9\"\nby (simp add: OUTfromChCorrect_def , metis IN.simps(33) OUT.simps(33) singleton_iff)\n\nlemma OUTfromChCorrect_data10: \"OUTfromChCorrect data10\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data11: \"OUTfromChCorrect data11\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(2) \nOUT.simps(2) OUT.simps(31) Un_empty_right Un_insert_left Un_insert_right insertI1)\n\nlemma OUTfromChCorrect_data12: \"OUTfromChCorrect data12\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data13: \"OUTfromChCorrect data13\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data14: \"OUTfromChCorrect data14\"\nby (metis OUTfromCh.simps(14) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data15: \"OUTfromChCorrect data15\"\nby (metis OUTfromCh.simps(15) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data16: \"OUTfromChCorrect data16\"\nby (metis OUTfromCh.simps(16) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data17: \"OUTfromChCorrect data17\"\nproof - \n have \"data17 \\ OUT sA71 \\ data15 \\ IN sA71\"\n by (metis IN.simps(19) OUT.simps(19) insertI1) \n thus ?thesis by (metis IN.simps(19) OUTfromCh.simps(17) OUTfromChCorrect_def) \nqed\n\nlemma OUTfromChCorrect_data18: \"OUTfromChCorrect data18\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(20) OUT.simps(20) insertI1)\n\nlemma OUTfromChCorrect_data19: \"OUTfromChCorrect data19\"\nby (metis OUTfromCh.simps(19) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data20: \"OUTfromChCorrect data20\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(21) OUT.simps(21) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data21: \"OUTfromChCorrect data21\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) \nIN.simps(22) OUT.simps(22) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data22: \"OUTfromChCorrect data22\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(23) OUT.simps(23) insertI1)\n\nlemma OUTfromChCorrect_data23: \"OUTfromChCorrect data23\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(9) OUT.simps(9) insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data24: \"OUTfromChCorrect data24\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(9) OUT.simps(9) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrectSYSTEM_holds: \"OUTfromChCorrectSYSTEM\"\nby (simp add: OUTfromChCorrectSYSTEM_def, clarify, case_tac x,\nsimp add: OUTfromChCorrect_data1, simp add: OUTfromChCorrect_data2, \nsimp add: OUTfromChCorrect_data3, simp add: OUTfromChCorrect_data4, \nsimp add: OUTfromChCorrect_data5, simp add: OUTfromChCorrect_data6, \nsimp add: OUTfromChCorrect_data7, simp add: OUTfromChCorrect_data8,\nsimp add: OUTfromChCorrect_data9, simp add: OUTfromChCorrect_data10,\nsimp add: OUTfromChCorrect_data11, simp add: OUTfromChCorrect_data12,\nsimp add: OUTfromChCorrect_data13, simp add: OUTfromChCorrect_data14, \nsimp add: OUTfromChCorrect_data15, simp add: OUTfromChCorrect_data16,\nsimp add: OUTfromChCorrect_data17, simp add: OUTfromChCorrect_data18,\nsimp add: OUTfromChCorrect_data19, simp add: OUTfromChCorrect_data20,\nsimp add: OUTfromChCorrect_data21, simp add: OUTfromChCorrect_data22, \nsimp add: OUTfromChCorrect_data23, simp add: OUTfromChCorrect_data24)\n\nlemma OUTfromVCorrect1_data1: \"OUTfromVCorrect1 data1\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data2: \"OUTfromVCorrect1 data2\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data3: \"OUTfromVCorrect1 data3\"\nproof - \n have \"data3 \\ OUT sA41 \\ stA4 \\ VAR sA41\"\n by (metis OUT.simps(17) VAR.simps(17) insertI1) \n thus ?thesis by (metis OUTfromV.simps(3) OUTfromVCorrect1_def VAR.simps(17)) \nqed\n\nlemma OUTfromVCorrect1_data4: \"OUTfromVCorrect1 data4\"\nby (simp add: OUTfromVCorrect1_def, metis (full_types) OUT.simps(2) VAR.simps(2) insertI1) \n\nlemma OUTfromVCorrect1_data5: \"OUTfromVCorrect1 data5\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data6: \"OUTfromVCorrect1 data6\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data7: \"OUTfromVCorrect1 data7\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data8: \"OUTfromVCorrect1 data8\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data9: \"OUTfromVCorrect1 data9\"\nby (simp add: OUTfromVCorrect1_def)\n\n\n\nlemma OUTfromVCorrect1_data11: \"OUTfromVCorrect1 data11\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data12: \"OUTfromVCorrect1 data12\"\nproof - \n have \"data12 \\ OUT sA22 \\ stA2 \\ VAR sA22\"\n by (metis (full_types) OUT.simps(13) VAR.simps(13) insertCI) \n thus ?thesis by (metis OUTfromV.simps(12) OUTfromVCorrect1_def VAR.simps(13)) \nqed\n\nlemma OUTfromVCorrect1_data13: \"OUTfromVCorrect1 data13\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data14: \"OUTfromVCorrect1 data14\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data15: \"OUTfromVCorrect1 data15\"\nproof -\n have A6ch:\"data15 \\ OUT sA6 \\ stA6 \\ VAR sA6\"\n by (metis OUT.simps(6) VAR.simps(6) insertI1) \n thus ?thesis by (simp add: OUTfromVCorrect1_def, metis A6ch) \nqed\n\n\n\nlemma OUTfromVCorrect1_data17: \"OUTfromVCorrect1 data17\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data18: \"OUTfromVCorrect1 data18\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data19: \"OUTfromVCorrect1 data19\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data20: \"OUTfromVCorrect1 data20\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data21: \"OUTfromVCorrect1 data21\"\nby (simp add: OUTfromVCorrect1_def)\n\n\n\nlemma OUTfromVCorrect1_data23: \"OUTfromVCorrect1 data23\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data24: \"OUTfromVCorrect1 data24\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1SYSTEM_holds: \"OUTfromVCorrect1SYSTEM\"\nby (simp add: OUTfromVCorrect1SYSTEM_def, clarify, case_tac x, \nsimp add: OUTfromVCorrect1_data1, simp add: OUTfromVCorrect1_data2,\nsimp add: OUTfromVCorrect1_data3, simp add: OUTfromVCorrect1_data4, \nsimp add: OUTfromVCorrect1_data5, simp add: OUTfromVCorrect1_data6, \nsimp add: OUTfromVCorrect1_data7, simp add: OUTfromVCorrect1_data8, \nsimp add: OUTfromVCorrect1_data9, simp add: OUTfromVCorrect1_data10, \nsimp add: OUTfromVCorrect1_data11, simp add: OUTfromVCorrect1_data12, \nsimp add: OUTfromVCorrect1_data13, simp add: OUTfromVCorrect1_data14, \nsimp add: OUTfromVCorrect1_data15, simp add: OUTfromVCorrect1_data16, \nsimp add: OUTfromVCorrect1_data17, simp add: OUTfromVCorrect1_data18,\nsimp add: OUTfromVCorrect1_data19, simp add: OUTfromVCorrect1_data20,\nsimp add: OUTfromVCorrect1_data21, simp add: OUTfromVCorrect1_data22,\nsimp add: OUTfromVCorrect1_data23, simp add: OUTfromVCorrect1_data24)\n\nlemma OUTfromVCorrect2SYSTEM: \"OUTfromVCorrect2SYSTEM\"\nby (simp add: OUTfromVCorrect2SYSTEM_def, auto, case_tac x,\n ((simp add: OUTfromVCorrect2_def, auto, case_tac v, auto) | \n (simp add: OUTfromVCorrect2_def) )+)\n\nlemma OUTfromV_VARto_holds:\n\"OUTfromV_VARto\"\nby (simp add: OUTfromV_VARto_def, auto, (case_tac x, auto), (case_tac v, auto))\n\nlemma VARfromCorrectSYSTEM_holds:\n\"VARfromCorrectSYSTEM\"\nby (simp add: VARfromCorrectSYSTEM_def AbstrLevel0 AbstrLevel1)\n\nlemma VARtoCorrectSYSTEM_holds:\n\"VARtoCorrectSYSTEM\"\nby (simp add: VARtoCorrectSYSTEM_def AbstrLevel0 AbstrLevel1)\n\nlemma VARusefulSYSTEM_holds:\n\"VARusefulSYSTEM\"\nby (simp add: VARusefulSYSTEM_def, auto, case_tac v, auto)\n\n\nsubsection \\Elementary components\\\n\n\\ \\On the abstraction level 0 only the components sA5 and sA6 are elementary\\\n\nlemma NOT_elementaryCompDD_sA1: \"\\ elementaryCompDD sA1\" \nproof -\n have \"outSetCorelated data2 \\ outSetCorelated data10 = {}\"\n by (metis OUTfromV.simps(2) inf_bot_left outSetCorelatedEmpty1) \n thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA2: \"\\ elementaryCompDD sA2\" \nproof -\n have \"outSetCorelated data5 \\ outSetCorelated data11 = {}\"\n by (metis OUTfromV.simps(5) inf_bot_right inf_commute outSetCorelatedEmpty1)\n thus ?thesis by (simp add: elementaryCompDD_def)\nqed \n\nlemma NOT_elementaryCompDD_sA3: \"\\ elementaryCompDD sA3\" \nproof -\n have \"outSetCorelated data6 \\ outSetCorelated data7 = {}\"\n by (metis OUTfromV.simps(7) inf_bot_right outSetCorelatedEmpty1) \n thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA4: \"\\ elementaryCompDD sA4\" \nproof -\n have \"outSetCorelated data3 \\ outSetCorelated data8 = {}\"\n by (metis OUTfromV.simps(8) inf_bot_left inf_commute outSetCorelatedEmpty1)\n thus ?thesis by (simp add: elementaryCompDD_def) \nqed\n\nlemma elementaryCompDD_sA5: \"elementaryCompDD sA5\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA6: \"elementaryCompDD sA6\" \nproof -\n have oSet15:\"outSetCorelated data15 \\ {}\" \n by (simp add: outSetCorelated_def, auto)\n have oSet16:\"outSetCorelated data16 \\ {}\"\n by (simp add: outSetCorelated_def, auto)\n have \"outSetCorelated data15 \\ outSetCorelated data16 \\ {}\"\n by (simp add: outSetCorelated_def, auto)\n with oSet15 oSet16 show ?thesis by (simp add: elementaryCompDD_def, auto) \nqed\n\nlemma NOT_elementaryCompDD_sA7: \"\\ elementaryCompDD sA7\" \nproof - \n have \"outSetCorelated data17 \\ outSetCorelated data18 = {}\"\n by (metis (full_types) OUTfromV.simps(17) disjoint_iff_not_equal empty_iff outSetCorelatedEmpty1) \n thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA8: \"\\ elementaryCompDD sA8\" \nproof - \n have \"outSetCorelated data20 \\ outSetCorelated data21 = {}\"\n by (metis OUTfromV.simps(21) inf_bot_right outSetCorelatedEmpty1)\n thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA9: \"\\ elementaryCompDD sA9\" \nproof - \n have \"outSetCorelated data23 \\ outSetCorelated data24 = {}\"\n by (metis (full_types) OUTfromV.simps(23) disjoint_iff_not_equal empty_iff outSetCorelatedEmpty1)\n thus ?thesis by (simp add: elementaryCompDD_def) \nqed\n\n\\ \\On the abstraction level 1 all components are elementary\\\n\nlemma elementaryCompDD_sA11: \"elementaryCompDD sA11\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA12: \"elementaryCompDD sA12\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA21: \"elementaryCompDD sA21\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA22: \"elementaryCompDD sA22\" \nproof - \n have oSet4:\"outSetCorelated data4 \\ {}\" \n by (simp add: outSetCorelated_def, auto)\n have oSet12:\"outSetCorelated data12 \\ {}\" \n by (simp add: outSetCorelated_def, auto)\n have \"outSetCorelated data4 \\ outSetCorelated data12 \\ {}\"\n by (simp add: outSetCorelated_def, auto)\n with oSet4 oSet12 show ?thesis \n by (simp add: elementaryCompDD_def, auto)\nqed \n\nlemma elementaryCompDD_sA23: \"elementaryCompDD sA23\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA31: \"elementaryCompDD sA31\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA32: \"elementaryCompDD sA32\" \nby (simp add: elementaryCompDD_def)\n\n\nlemma elementaryCompDD_sA41: \"elementaryCompDD sA41\" \nby (simp add: elementaryCompDD_def) \n\nlemma elementaryCompDD_sA42: \"elementaryCompDD sA42\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA71: \"elementaryCompDD sA71\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA72: \"elementaryCompDD sA72\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA81: \"elementaryCompDD sA81\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA82: \"elementaryCompDD sA82\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA91: \"elementaryCompDD sA91\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA92: \"elementaryCompDD sA92\" \nby (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA93: \"elementaryCompDD sA93\" \nby (simp add: elementaryCompDD_def)\n\nsubsection \\Source components\\\n\n\\ \\Abstraction level 0\\\n\nlemma A5_NotDSource_level0: \"isNotDSource level0 sA5\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\nlemma DSourcesA1_L0: \"DSources level0 sA1 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA2_L0: \"DSources level0 sA2 = { sA1, sA4}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA3_L0: \"DSources level0 sA3 = { sA2 }\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA4_L0: \"DSources level0 sA4 = { sA3 }\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA5_L0: \"DSources level0 sA5 = { sA4 }\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA6_L0: \"DSources level0 sA6 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA7_L0: \"DSources level0 sA7 = {sA6}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA8_L0: \"DSources level0 sA8 = {sA7, sA9}\"\nby (simp add: DSources_def AbstrLevel0, force)\n\nlemma DSourcesA9_L0: \"DSources level0 sA9 = {sA8}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma A1_DAcc_level0: \"DAcc level0 sA1 = { sA2 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A2_DAcc_level0: \"DAcc level0 sA2 = { sA3 }\" \nby (simp add: DAcc_def AbstrLevel0, force)\n\nlemma A3_DAcc_level0: \"DAcc level0 sA3 = { sA4 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A4_DAcc_level0: \"DAcc level0 sA4 = { sA2, sA5 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A5_DAcc_level0: \"DAcc level0 sA5 = {}\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A6_DAcc_level0: \"DAcc level0 sA6 = { sA7 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A7_DAcc_level0: \"DAcc level0 sA7 = { sA8 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A8_DAcc_level0: \"DAcc level0 sA8 = { sA9 }\" \nby (simp add: DAcc_def AbstrLevel0, auto)\n\nlemma A9_DAcc_level0: \"DAcc level0 sA9 = { sA8 }\" \nby (simp add: DAcc_def AbstrLevel0, force)\n\nlemma A8_NSources:\n\"\\ C \\ (AbstrLevel level0). (C \\ sA9 \\ C \\ sA8 \\ sA8 \\ (Sources level0 C))\"\nby (metis A8_DAcc_level0 A9_DAcc_level0 singleDSourceLoop)\n\nlemma A9_NSources:\n\"\\ C \\ (AbstrLevel level0). (C \\ sA9 \\ C \\ sA8 \\ sA9 \\ (Sources level0 C))\"\nby (metis A8_DAcc_level0 A9_DAcc_level0 singleDSourceLoop)\n\nlemma A7_Acc:\n\"(Acc level0 sA7) = {sA8, sA9}\"\n by (metis A7_DAcc_level0 A8_DAcc_level0 A9_DAcc_level0 AccDef AccSigleLoop insert_commute) \n\nlemma A7_NSources:\n\"\\ C \\ (AbstrLevel level0). (C \\ sA9 \\ C \\ sA8 \\ sA7 \\ (Sources level0 C))\"\nby (metis A7_Acc Acc_Sources insert_iff singleton_iff)\n\nlemma A5_Acc: \"(Acc level0 sA5) = {}\"\nby (metis A5_NotDSource_level0 isNotDSource_EmptyAcc)\n\nlemma A6_Acc:\n\"(Acc level0 sA6) = {sA7, sA8, sA9}\"\nproof -\n have daA6: \"DAcc level0 sA6 = { sA7 }\" by (rule A6_DAcc_level0)\n hence \"(\\ S \\ (DAcc level0 sA6). (Acc level0 S)) = (Acc level0 sA7)\" by simp\n hence aA6:\"(\\ S \\ (DAcc level0 sA6). (Acc level0 S)) = { sA8, sA9 }\" by (simp add: A7_Acc)\n have \"(Acc level0 sA6) = (DAcc level0 sA6) \\ (\\ S \\ (DAcc level0 sA6). (Acc level0 S))\" \n by (rule AccDef)\n with daA6 aA6 show ?thesis by auto\nqed\n\nlemma A6_NSources:\n\"\\ C \\ (AbstrLevel level0). (C \\ sA9 \\ C \\ sA8 \\ C \\ sA7 \\ sA6 \\ (Sources level0 C))\"\nby (metis (full_types) A6_Acc A7_Acc Acc_SourcesNOT insert_iff singleton_iff)\n\nlemma SourcesA1_L0: \"Sources level0 sA1 = {}\" \nby (simp add: DSourcesA1_L0 DSourcesEmptySources) \n \nlemma SourcesA2_L0: \"Sources level0 sA2 = { sA1, sA2, sA3, sA4 }\"\nproof \n show \"Sources level0 sA2 \\ {sA1, sA2, sA3, sA4}\"\n proof -\n have A2level0:\"sA2 \\ (AbstrLevel level0)\" by (simp add: AbstrLevel0)\n have sgA5:\"sA5 \\ Sources level0 sA2\" \n by (metis A5_NotDSource_level0 DSource_level NoDSourceNoSource \n allNotDSource_NotSource isNotSource_Sources)\n from A2level0 have sgA6:\"sA6 \\ Sources level0 sA2\" by (simp add: A6_NSources)\n from A2level0 have sgA7:\"sA7 \\ Sources level0 sA2\" by (simp add: A7_NSources)\n from A2level0 have sgA8:\"sA8 \\ Sources level0 sA2\" by (simp add: A8_NSources)\n from A2level0 have sgA9:\"sA9 \\ Sources level0 sA2\" by (simp add: A9_NSources)\n have \"Sources level0 sA2 \\ {sA1, sA2, sA3, sA4, sA5, sA6, sA7, sA8, sA9}\"\n by (metis AbstrLevel0 SourcesLevelX) \n with sgA5 sgA6 sgA7 sgA8 sgA9 show \"Sources level0 sA2 \\ {sA1, sA2, sA3, sA4}\"\n by blast \n qed\nnext\n show \"{sA1, sA2, sA3, sA4} \\ Sources level0 sA2\"\n proof -\n have dsA4:\"{ sA3 } \\ Sources level0 sA2\"\n by (metis DSource_Sources DSourcesA2_L0 DSourcesA4_L0 \n Sources_DSources insertI1 insert_commute subset_trans)\n have \"{ sA2 } \\ Sources level0 sA2\"\n by (metis DSource_Sources DSourcesA2_L0 DSourcesA3_L0 \n DSourcesA4_L0 Sources_DSources insertI1 \n insert_commute subset_trans)\n with dsA4 show \"{sA1, sA2, sA3, sA4} \\ Sources level0 sA2\"\n by (metis DSourcesA2_L0 Sources_DSources insert_subset)\n qed\nqed\n \nlemma SourcesA3_L0: \"Sources level0 sA3 = { sA1, sA2, sA3, sA4 }\"\nproof \n show \"Sources level0 sA3 \\ {sA1, sA2, sA3, sA4}\"\n proof -\n have a2:\"Sources level0 sA2 = { sA1, sA2, sA3, sA4}\" by (simp add: SourcesA2_L0)\n have \"{ sA2 } \\ DSources level0 sA3\" by (simp add: DSourcesA3_L0)\n with a2 show \"Sources level0 sA3 \\ {sA1, sA2, sA3, sA4}\"\n by (metis DSource_Sources DSourcesA2_L0 DSourcesA4_L0 insertI1 insert_commute subset_trans)\n qed\nnext\n show \"{sA1, sA2, sA3, sA4} \\ Sources level0 sA3\"\n by (metis (full_types) DSource_Sources DSourcesA3_L0 SourcesA2_L0 insertI1)\nqed \n \nlemma SourcesA4_L0: \"Sources level0 sA4 = { sA1, sA2, sA3, sA4 }\"\nproof -\n have A3s:\"Sources level0 sA3 = { sA1, sA2, sA3, sA4 }\" by (rule SourcesA3_L0)\n have \"Sources level0 sA4 = {sA3} \\ Sources level0 sA3\"\n by (metis DSourcesA4_L0 Sources_singleDSource) \n with A3s show ?thesis by auto\nqed \n\nlemma SourcesA5_L0: \"Sources level0 sA5 = { sA1, sA2, sA3, sA4 }\"\nproof - \n have A4s:\"Sources level0 sA4 = { sA1, sA2, sA3, sA4 }\" by (rule SourcesA4_L0)\n have \"Sources level0 sA5 = {sA4} \\ Sources level0 sA4\"\n by (metis DSourcesA5_L0 Sources_singleDSource) \n with A4s show ?thesis by auto\nqed \n\nlemma SourcesA6_L0: \"Sources level0 sA6 = {}\" \nby (simp add: DSourcesA6_L0 DSourcesEmptySources) \n\nlemma SourcesA7_L0: \"Sources level0 sA7 = { sA6 }\" \nby (metis DSourcesA7_L0 SourcesA6_L0 SourcesEmptyDSources SourcesOnlyDSources singleton_iff)\n\n \n\n\nlemma SourcesA9_L0: \"Sources level0 sA9 = { sA6, sA7, sA8, sA9 }\" \nproof - \n have \"(Sources level0 sA9) = (DSources level0 sA9) \\ (\\ S \\ (DSources level0 sA9). (Sources level0 S))\" \n by (rule SourcesDef)\n hence sourcesA9:\"(Sources level0 sA9) = ({sA8} \\ (Sources level0 sA8))\" \n by (simp add: DSourcesA9_L0)\n thus ?thesis by (metis SourcesA8_L0 Un_insert_right insert_absorb2 insert_is_Un) \nqed\n \n\n\\ \\Abstraction level 1\\\n\nlemma A12_NotSource_level1: \"isNotDSource level1 sA12\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\nlemma A21_NotSource_level1: \"isNotDSource level1 sA21\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\nlemma A5_NotSource_level1: \"isNotDSource level1 sA5\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\nlemma A92_NotSource_level1: \"isNotDSource level1 sA92\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\nlemma A93_NotSource_level1: \"isNotDSource level1 sA93\"\nby (simp add: isNotDSource_def, auto, case_tac \"Z\", auto)\n\n\nlemma A11_DAcc_level1: \"DAcc level1 sA11 = { sA21, sA22, sA23 }\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A12_DAcc_level1: \"DAcc level1 sA12 = {}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A21_DAcc_level1: \"DAcc level1 sA21 = {}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A22_DAcc_level1: \"DAcc level1 sA22 = {sA31}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A23_DAcc_level1: \"DAcc level1 sA23 = {sA32}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A31_DAcc_level1: \"DAcc level1 sA31 = {sA41}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A32_DAcc_level1: \"DAcc level1 sA32 = {sA41}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A41_DAcc_level1: \"DAcc level1 sA41 = {sA22}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A42_DAcc_level1: \"DAcc level1 sA42 = {sA5}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A5_DAcc_level1: \"DAcc level1 sA5 = {}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A6_DAcc_level1: \"DAcc level1 sA6 = {sA71, sA72}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A71_DAcc_level1: \"DAcc level1 sA71 = {sA81}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A72_DAcc_level1: \"DAcc level1 sA72 = {sA82}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A81_DAcc_level1: \"DAcc level1 sA81 = {sA91, sA92}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A82_DAcc_level1: \"DAcc level1 sA82 = {sA93}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A91_DAcc_level1: \"DAcc level1 sA91 = {sA81}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A92_DAcc_level1: \"DAcc level1 sA92 = {}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A93_DAcc_level1: \"DAcc level1 sA93 = {}\" \nby (simp add: DAcc_def AbstrLevel1, auto)\n\nlemma A42_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). C \\ sA5 \\ sA42 \\ (Sources level1 C)\"\nby (metis A42_DAcc_level1 A5_NotSource_level1 singleDSourceEmpty4isNotSource)\n\nlemma A5_NotSourceSet_level1 :\n\"\\ C \\ (AbstrLevel level1). sA5 \\ (Sources level1 C)\"\nby (metis A5_NotSource_level1 isNotSource_Sources)\n\nlemma A92_NotSourceSet_level1 :\n\"\\ C \\ (AbstrLevel level1). sA92 \\ (Sources level1 C)\" \nby (metis A92_NotSource_level1 isNotSource_Sources)\n\nlemma A93_NotSourceSet_level1 :\n\"\\ C \\ (AbstrLevel level1). sA93 \\ (Sources level1 C)\" \nby (metis A93_NotSource_level1 isNotSource_Sources)\n\n\nlemma DSourcesA11_L1: \"DSources level1 sA11 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA12_L1: \"DSources level1 sA12 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA21_L1: \"DSources level1 sA21 = {sA11}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA22_L1: \"DSources level1 sA22 = {sA11, sA41}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA23_L1: \"DSources level1 sA23 = {sA11}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA31_L1: \"DSources level1 sA31 = { sA22 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA32_L1: \"DSources level1 sA32 = { sA23 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA41_L1: \"DSources level1 sA41 = { sA31, sA32 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA42_L1: \"DSources level1 sA42 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA5_L1: \"DSources level1 sA5 = { sA42 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA6_L1: \"DSources level1 sA6 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA71_L1: \"DSources level1 sA71 = { sA6 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA72_L1: \"DSources level1 sA72 = { sA6 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA81_L1: \"DSources level1 sA81 = { sA71, sA91 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA82_L1: \"DSources level1 sA82 = { sA72 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA91_L1: \"DSources level1 sA91 = { sA81 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA92_L1: \"DSources level1 sA92 = { sA81 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA93_L1: \"DSources level1 sA93 = { sA82 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma A82_Acc: \"(Acc level1 sA82) = {sA93}\"\nby (metis A82_DAcc_level1 A93_NotSource_level1 singleDSourceEmpty_Acc) \n\nlemma A82_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA93 \\ sA82 \\ (Sources level1 C))\"\nby (metis A82_Acc Acc_Sources singleton_iff) \n\nlemma A72_Acc: \"(Acc level1 sA72) = {sA82, sA93}\"\nproof -\n have daA72: \"DAcc level1 sA72 = { sA82 }\" by (rule A72_DAcc_level1)\n hence \"(\\ S \\ (DAcc level1 sA72). (Acc level1 S)) = (Acc level1 sA82)\" by simp\n hence aA72:\"(\\ S \\ (DAcc level1 sA72). (Acc level1 S)) = { sA93 }\" by (simp add: A82_Acc)\n have \"(Acc level1 sA72) = (DAcc level1 sA72) \\ (\\ S \\ (DAcc level1 sA72). (Acc level1 S))\" \n by (rule AccDef)\n with daA72 aA72 show ?thesis by auto\nqed\n\nlemma A72_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA93 \\ C \\ sA82 \\ sA72 \\ (Sources level1 C))\"\nby (metis A72_Acc Acc_Sources insert_iff singleton_iff) \n\nlemma A92_Acc: \"(Acc level1 sA92) = {}\"\nby (metis A92_NotSource_level1 isNotDSource_EmptyAcc)\n\nlemma A92_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (sA92 \\ (Sources level1 C))\"\nby (metis A92_NotSourceSet_level1)\n \nlemma A91_Acc: \"(Acc level1 sA91) = {sA81, sA91, sA92}\"\nproof -\n have da91: \"DAcc level1 sA91 = { sA81 }\" by (rule A91_DAcc_level1)\n hence a91:\"(\\ S \\ (DAcc level1 sA91). (Acc level1 S)) = (Acc level1 sA81)\" by simp\n have \"(Acc level1 sA91) = (DAcc level1 sA91) \\ (\\ S \\ (DAcc level1 sA91). (Acc level1 S))\" by (rule AccDef)\n with da91 a91 have acc91:\"(Acc level1 sA91) = { sA81 } \\ (Acc level1 sA81)\" by simp\n have da81: \"DAcc level1 sA81 = { sA91, sA92 }\" by (rule A81_DAcc_level1)\n hence a81:\"(\\ S \\ (DAcc level1 sA81). (Acc level1 S)) = (Acc level1 sA92) \\ (Acc level1 sA91)\" by auto\n have \"(Acc level1 sA81) = (DAcc level1 sA81) \\ (\\ S \\ (DAcc level1 sA81). (Acc level1 S))\" by (rule AccDef)\n with da81 a81 have acc81: \"(Acc level1 sA81) = { sA91, sA92 } \\ (Acc level1 sA91)\"\n by (metis A92_Acc sup_bot.left_neutral)\n from acc91 acc81 have \"(Acc level1 sA91) = { sA81 } \\ { sA91, sA92 } \\ {sA91, sA81}\"\n by (metis AccLoop)\n thus ?thesis by auto\nqed\n\nlemma A91_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ sA91 \\ (Sources level1 C))\"\nproof -\n have \"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ (C \\ (Acc level1 sA91)))\"\n by (metis A91_Acc insert_iff singleton_iff)\n thus ?thesis by (metis Acc_SourcesNOT) \nqed\n\nlemma A81_Acc: \"(Acc level1 sA81) = {sA81, sA91, sA92}\"\nproof -\n have da91: \"DAcc level1 sA91 = { sA81 }\" by (rule A91_DAcc_level1)\n hence a91:\"(\\ S \\ (DAcc level1 sA91). (Acc level1 S)) = (Acc level1 sA81)\" by simp\n have \"(Acc level1 sA91) = (DAcc level1 sA91) \\ (\\ S \\ (DAcc level1 sA91). (Acc level1 S))\" by (rule AccDef)\n with da91 a91 have acc91:\"(Acc level1 sA91) = { sA81 } \\ (Acc level1 sA81)\" by simp\n have da81: \"DAcc level1 sA81 = { sA91, sA92 }\" by (rule A81_DAcc_level1)\n hence a81:\"(\\ S \\ (DAcc level1 sA81). (Acc level1 S)) = (Acc level1 sA92) \\ (Acc level1 sA91)\" by auto\n have \"(Acc level1 sA81) = (DAcc level1 sA81) \\ (\\ S \\ (DAcc level1 sA81). (Acc level1 S))\" by (rule AccDef)\n with da81 a81 have acc81: \"(Acc level1 sA81) = { sA91, sA92 } \\ (Acc level1 sA91)\"\n by (metis A92_Acc sup_bot.left_neutral)\n from acc81 acc91 have \"(Acc level1 sA81) = { sA91, sA92 } \\ { sA81 } \\ {sA81, sA91}\"\n by (metis AccLoop)\n thus ?thesis by auto\nqed\n\nlemma A81_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ sA81 \\ (Sources level1 C))\"\nproof -\n have \"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ (C \\ (Acc level1 sA81)))\"\n by (metis A81_Acc insert_iff singleton_iff)\n thus ?thesis by (metis Acc_SourcesNOT) \nqed\n\nlemma A71_Acc: \"(Acc level1 sA71) = {sA81, sA91, sA92}\"\nproof -\n have da71: \"DAcc level1 sA71 = { sA81 }\" by (rule A71_DAcc_level1)\n hence a71:\"(\\ S \\ (DAcc level1 sA71). (Acc level1 S)) = (Acc level1 sA81)\" by simp\n have \"(Acc level1 sA71) = (DAcc level1 sA71) \\ (\\ S \\ (DAcc level1 sA71). (Acc level1 S))\" by (rule AccDef)\n with da71 a71 show ?thesis by (metis A91_Acc A91_DAcc_level1 AccDef) \nqed\n\nlemma A71_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ sA71 \\ (Sources level1 C))\"\nproof -\n have \"\\ C \\ (AbstrLevel level1). (C \\ sA92 \\ C \\ sA91 \\ C \\ sA81 \\ (C \\ (Acc level1 sA71)))\"\n by (metis A71_Acc insert_iff singleton_iff)\n thus ?thesis by (metis Acc_SourcesNOT) \nqed\n\nlemma A6_Acc_L1:\n\"(Acc level1 sA6) = {sA71, sA72, sA81, sA82, sA91, sA92, sA93}\"\nproof -\n have daA6: \"DAcc level1 sA6 = { sA71, sA72 }\" by (rule A6_DAcc_level1)\n hence \"(\\ S \\ (DAcc level1 sA6). (Acc level1 S)) = (Acc level1 sA71) \\ (Acc level1 sA72)\" by simp\n hence aA6:\"(\\ S \\ (DAcc level1 sA6). (Acc level1 S)) = {sA81, sA91, sA92} \\ {sA82, sA93}\" \n by (simp add: A71_Acc A72_Acc)\n have \"(Acc level1 sA6) = (DAcc level1 sA6) \\ (\\ S \\ (DAcc level1 sA6). (Acc level1 S))\" \n by (rule AccDef)\n with daA6 aA6 show ?thesis by auto\nqed\n\nlemma A6_NSources_L1Acc:\n\"\\ C \\ (AbstrLevel level1). (C \\ (Acc level1 sA6) \\ sA6 \\ (Sources level1 C))\"\nby (metis Acc_SourcesNOT)\n\n\nlemma A6_NSources_L1:\n\"\\ C \\ (AbstrLevel level1). (C \\ sA93 \\ C \\ sA92 \\ C \\ sA91 \\ C \\ sA82 \\ C \\ sA81 \\ C \\ sA72 \\ C \\ sA71 \n\\ sA6 \\ (Sources level1 C))\"\nproof -\n have \"\\ C \\ (AbstrLevel level1). \n (C \\ sA93 \\ C \\ sA92 \\ C \\ sA91 \\ C \\ sA82 \\ C \\ sA81 \\ C \\ sA72 \\ C \\ sA71 \n \\ (C \\ (Acc level1 sA6)))\"\n by (metis A6_Acc_L1 empty_iff insert_iff)\n thus ?thesis by (metis Acc_SourcesNOT) \nqed\n\nlemma A5_Acc_L1: \"(Acc level1 sA5) = {}\"\nby (metis A5_NotSource_level1 isNotDSource_EmptyAcc)\n\n\nlemma SourcesA11_L1: \"Sources level1 sA11 = {}\" \nby (simp add: DSourcesA11_L1 DSourcesEmptySources) \n\nlemma SourcesA12_L1: \"Sources level1 sA12 = {}\" \nby (simp add: DSourcesA12_L1 DSourcesEmptySources) \n\nlemma SourcesA21_L1: \"Sources level1 sA21 = {sA11}\"\nby (simp add: DSourcesA21_L1 SourcesA11_L1 Sources_singleDSource) \n\nlemma SourcesA22_L1: \"Sources level1 sA22 = {sA11, sA22, sA23, sA31, sA32, sA41}\"\nproof\n show \"Sources level1 sA22 \\ {sA11, sA22, sA23, sA31, sA32, sA41}\"\n proof -\n have A2level1:\"sA22 \\ (AbstrLevel level1)\" by (simp add: AbstrLevel1)\n from A2level1 have sgA42:\"sA42 \\ Sources level1 sA22\" by (metis A42_NSources_L1 CSet.distinct(347)) \n have sgA5:\"sA5 \\ Sources level1 sA22\"\n by (metis A5_NotSource_level1 Acc_Sources all_not_in_conv isNotDSource_EmptyAcc) \n have sgA12:\"sA12 \\ Sources level1 sA22\" by (metis A12_NotSource_level1 A2level1 isNotSource_Sources) \n have sgA21:\"sA21 \\ Sources level1 sA22\"\n by (metis A21_NotSource_level1 DAcc_DSourcesNOT NDSourceExistsDSource empty_iff isNotDSource_EmptyDAcc)\n from A2level1 have sgA6:\"sA6 \\ Sources level1 sA22\" by (simp add: A6_NSources_L1)\n from A2level1 have sgA71:\"sA71 \\ Sources level1 sA22\" by (simp add: A71_NSources_L1)\n from A2level1 have sgA72:\"sA72 \\ Sources level1 sA22\" by (simp add: A72_NSources_L1)\n from A2level1 have sgA81:\"sA81 \\ Sources level1 sA22\" by (simp add: A81_NSources_L1)\n from A2level1 have sgA82:\"sA82 \\ Sources level1 sA22\" by (simp add: A82_NSources_L1)\n from A2level1 have sgA91:\"sA91 \\ Sources level1 sA22\" by (simp add: A91_NSources_L1)\n from A2level1 have sgA92:\"sA92 \\ Sources level1 sA22\" by (simp add: A92_NSources_L1) \n from A2level1 have sgA93:\"sA93 \\ Sources level1 sA22\" by (metis A93_NotSourceSet_level1) \n have \"Sources level1 sA22 \\ {sA11, sA12, sA21, sA22, sA23, sA31, sA32, \n sA41, sA42, sA5, sA6, sA71, sA72, sA81, sA82, sA91, sA92, sA93}\"\n by (metis AbstrLevel1 SourcesLevelX) \n with sgA5 sgA12 sgA21 sgA42 sgA6 sgA71 sgA72 sgA81 sgA82 sgA91 sgA92 sgA93 show \n \"Sources level1 sA22 \\ {sA11, sA22, sA23, sA31, sA32, sA41}\"\n by auto \n qed\nnext \n show \"{sA11, sA22, sA23, sA31, sA32, sA41} \\ Sources level1 sA22\" \n proof - \n have sDef:\"(Sources level1 sA22) = (DSources level1 sA22) \\ (\\ S \\ (DSources level1 sA22). (Sources level1 S))\" \n by (rule SourcesDef) \n have A11s: \"sA11 \\ Sources level1 sA22\" by (metis DSourceIsSource DSourcesA22_L1 insertI1) \n have A41s: \"sA41 \\ Sources level1 sA22\" by (metis (full_types) DSourceIsSource DSourcesA22_L1 insertCI)\n have A31s: \"sA31 \\ Sources level1 sA22\" \n by (metis (full_types) A41s DSourceIsSource DSourcesA41_L1 SourcesTrans insertCI)\n have A32s: \"sA32 \\ Sources level1 sA22\"\n by (metis A32_DAcc_level1 A41s DAcc_DSourcesNOT DSourceOfSource insertI1)\n have A23s: \"sA23 \\ Sources level1 sA22\" by (metis A32s DSourceOfSource DSourcesA32_L1 insertI1)\n have A22s: \"sA22 \\ Sources level1 sA22\" by (metis A31s DSourceOfSource DSourcesA31_L1 insertI1)\n with A11s A22s A23s A31s A32s A41s show ?thesis by auto\n qed\nqed \n\nlemma SourcesA23_L1: \"Sources level1 sA23 = {sA11}\"\nby (simp add: DSourcesA23_L1 SourcesA11_L1 Sources_singleDSource) \n\nlemma SourcesA31_L1: \"Sources level1 sA31 = {sA11, sA22, sA23, sA31, sA32, sA41}\"\nby (metis DSourcesA31_L1 SourcesA22_L1 Sources_singleDSource Un_insert_right insert_absorb2 insert_is_Un)\n\nlemma SourcesA32_L1: \"Sources level1 sA32 = {sA11, sA23}\"\nby (metis DSourcesA32_L1 SourcesA23_L1 Sources_singleDSource Un_insert_right insert_is_Un)\n \nlemma SourcesA41_L1: \"Sources level1 sA41 = {sA11, sA22, sA23, sA31, sA32, sA41}\"\nby (metis DSourcesA41_L1 SourcesA31_L1 SourcesA32_L1 Sources_2DSources Un_absorb Un_commute Un_insert_left)\n\nlemma SourcesA42_L1: \"Sources level1 sA42 = {}\" \nby (simp add: DSourcesA42_L1 DSourcesEmptySources) \n\nlemma SourcesA5_L1: \"Sources level1 sA5 = {sA42}\"\nby (simp add: DSourcesA5_L1 SourcesA42_L1 Sources_singleDSource) \n\nlemma SourcesA6_L1: \"Sources level1 sA6 = {}\" \nby (simp add: DSourcesA6_L1 DSourcesEmptySources) \n\nlemma SourcesA71_L1: \"Sources level1 sA71 = {sA6}\"\nby (metis DSourcesA71_L1 SourcesA6_L1 SourcesEmptyDSources SourcesOnlyDSources singleton_iff) \n\nlemma SourcesA81_L1: \"Sources level1 sA81 = {sA6, sA71, sA81, sA91}\" \nproof - \n have dA81:\"DSources level1 sA81 = {sA71, sA91}\" by (rule DSourcesA81_L1)\n have dA91:\"DSources level1 sA91 = {sA81}\" by (rule DSourcesA91_L1)\n have \"(Sources level1 sA81) = (DSources level1 sA81) \\ (\\ S \\ (DSources level1 sA81). (Sources level1 S))\" \n by (rule SourcesDef)\n with dA81 have \"(Sources level1 sA81) = ({sA71, sA91} \\ (Sources level1 sA71) \\ (Sources level1 sA91))\"\n by (metis (hide_lams, no_types) SUP_empty UN_insert Un_insert_left sup_bot.left_neutral sup_commute)\n hence sourcesA81:\"(Sources level1 sA81) = ({sA71, sA91, sA6} \\ (Sources level1 sA91))\"\n by (metis SourcesA71_L1 insert_is_Un sup_assoc)\n have \"(Sources level1 sA91) = (DSources level1 sA91) \\ (\\ S \\ (DSources level1 sA91). (Sources level1 S))\" \n by (rule SourcesDef)\n with dA91 have \"(Sources level1 sA91) = ({sA81} \\ (Sources level1 sA81))\" by simp\n with sourcesA81 have \"(Sources level1 sA81) = {sA71, sA91, sA6} \\ {sA81} \\ {sA81, sA91}\"\n by (metis SourcesLoop) \n thus ?thesis by auto\nqed\n\n(*lemma Sources_singleDSource:\n assumes \"DSources i S = {C}\" \n shows \"Sources i S = {C} \\ Sources i C\" *)\nlemma SourcesA91_L1: \"Sources level1 sA91 = {sA6, sA71, sA81, sA91}\"\nproof -\n have \"DSources level1 sA91 = {sA81}\" by (rule DSourcesA91_L1)\n thus ?thesis by (metis SourcesA81_L1 Sources_singleDSource \n Un_empty_left Un_insert_left insert_absorb2 insert_commute) \nqed\n\nlemma SourcesA92_L1: \"Sources level1 sA92 = {sA6, sA71, sA81, sA91}\"\nby (metis DSourcesA91_L1 DSourcesA92_L1 SourcesA91_L1 Sources_singleDSource) \n\nlemma SourcesA72_L1: \"Sources level1 sA72 = {sA6}\"\nby (metis DSourcesA6_L1 DSourcesA72_L1 SourcesOnlyDSources singleton_iff) \n\nlemma SourcesA82_L1: \"Sources level1 sA82 = {sA6, sA72}\" \nproof - \n have dA82:\"DSources level1 sA82 = {sA72}\" by (rule DSourcesA82_L1)\n have \"(Sources level1 sA82) = (DSources level1 sA82) \\ (\\ S \\ (DSources level1 sA82). (Sources level1 S))\" \n by (rule SourcesDef)\n with dA82 have \"(Sources level1 sA82) = {sA72} \\ (Sources level1 sA72)\" by simp\n thus ?thesis by (metis SourcesA72_L1 Un_commute insert_is_Un) \nqed\n\nlemma SourcesA93_L1: \"Sources level1 sA93 = {sA6, sA72, sA82}\"\nby (metis DSourcesA93_L1 SourcesA82_L1 Sources_singleDSource Un_insert_right insert_is_Un) \n\n\n\\ \\Abstraction level 2\\\n\nlemma SourcesS1_L2: \"Sources level2 sS1 = {}\"\nproof -\n have \"DSources level2 sS1 = {}\" by (simp add: DSources_def AbstrLevel2, auto)\n thus ?thesis by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS2_L2: \"Sources level2 sS2 = {}\"\nproof -\n have \"DSources level2 sS2 = {}\" by (simp add: DSources_def AbstrLevel2, auto)\n thus ?thesis by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS3_L2: \"Sources level2 sS3 = {sS2}\"\nproof -\n have DSourcesS3:\"DSources level2 sS3 = {sS2}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS2 = {}\" by (rule SourcesS2_L2)\n with DSourcesS3 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS4_L2: \"Sources level2 sS4 = {sS2}\"\nproof -\n have DSourcesS4:\"DSources level2 sS4 = {sS2}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS2 = {}\" by (rule SourcesS2_L2)\n with DSourcesS4 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS5_L2: \"Sources level2 sS5 = {sS2, sS4}\"\nproof -\n have DSourcesS5:\"DSources level2 sS5 = {sS4}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS4 = {sS2}\" by (rule SourcesS4_L2)\n with DSourcesS5 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS6_L2: \"Sources level2 sS6 = {sS2, sS4, sS5}\"\nproof -\n have DSourcesS6:\"DSources level2 sS6 = {sS2, sS5}\" by (simp add: DSources_def AbstrLevel2, auto)\n have SourcesS2:\"Sources level2 sS2 = {}\" by (rule SourcesS2_L2)\n have \"Sources level2 sS5 = {sS2, sS4}\" by (rule SourcesS5_L2)\n with SourcesS2 DSourcesS6 show ?thesis by (simp add: Sources_2DSources, auto)\nqed\n\nlemma SourcesS7_L2: \"Sources level2 sS7 = {}\"\nproof -\n have \"DSources level2 sS7 = {}\" by (simp add: DSources_def AbstrLevel2, auto)\n thus ?thesis by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS8_L2:\n \"Sources level2 sS8 = {sS7}\"\nproof -\n have DSourcesS8:\"DSources level2 sS8 = {sS7}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS7 = {}\" by (rule SourcesS7_L2)\n with DSourcesS8 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS9_L2:\n \"Sources level2 sS9 = {}\"\nproof -\n have \"DSources level2 sS9 = {}\" by (simp add: DSources_def AbstrLevel2, auto)\n thus ?thesis by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS10_L2: \"Sources level2 sS10 = {sS9}\"\nproof -\n have DSourcesS10:\"DSources level2 sS10 = {sS9}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS9 = {}\" by (rule SourcesS9_L2)\n with DSourcesS10 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS11_L2: \"Sources level2 sS11 = {sS9}\"\nproof -\n have DSourcesS11:\"DSources level2 sS11 = {sS9}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS9 = {}\" by (rule SourcesS9_L2)\n with DSourcesS11 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS12_L2: \"Sources level2 sS12 = {sS9, sS10}\"\nproof -\n have DSourcesS12:\"DSources level2 sS12 = {sS10}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS10 = {sS9}\" by (rule SourcesS10_L2)\n with DSourcesS12 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS13_L2: \"Sources level2 sS13 = {sS9, sS10, sS12}\"\nproof -\n have DSourcesS13:\"DSources level2 sS13 = {sS12}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS12 = {sS9, sS10}\" by (rule SourcesS12_L2)\n with DSourcesS13 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS14_L2: \"Sources level2 sS14 = {sS9, sS11}\"\nproof -\n have DSourcesS14:\"DSources level2 sS14 = {sS11}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS11 = {sS9}\" by (rule SourcesS11_L2)\n with DSourcesS14 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS15_L2: \"Sources level2 sS15 = {sS9, sS11, sS14}\"\nproof -\n have DSourcesS15:\"DSources level2 sS15= {sS14}\" by (simp add: DSources_def AbstrLevel2, auto)\n have \"Sources level2 sS14 = {sS9, sS11}\" by (rule SourcesS14_L2)\n with DSourcesS15 show ?thesis by (simp add: Sources_singleDSource)\nqed\n\n\nsubsection \\Minimal sets of components to prove certain properties\\\n\nlemma minSetOfComponentsTestL2p1:\n\"minSetOfComponents level2 {data10, data13} = {sS1}\"\nproof - \n have outL2:\"outSetOfComponents level2 {data10, data13} = {sS1}\"\n by (simp add: outSetOfComponents_def AbstrLevel2, auto) \n have \"Sources level2 sS1 = {}\" by (simp add: SourcesS1_L2)\n with outL2 show ?thesis by (simp add: minSetOfComponents_def)\nqed\n\nlemma NOT_noIrrelevantChannelsTestL2p1:\n\" \\ noIrrelevantChannels level2 {data10, data13}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p1 AbstrLevel2)\n\nlemma NOT_allNeededINChannelsTestL2p1:\n\"\\ allNeededINChannels level2 {data10, data13}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p1 systemIN_def AbstrLevel2)\n\nlemma minSetOfComponentsTestL2p2:\n\"minSetOfComponents level2 {data1, data12} = {sS2, sS4, sS5, sS6}\"\nproof - \n have outL2:\"outSetOfComponents level2 {data1, data12} = {sS6}\"\n by (simp add: outSetOfComponents_def AbstrLevel2, auto) \n have \"Sources level2 sS6 = {sS2, sS4, sS5}\"\n by (simp add: SourcesS6_L2) \n with outL2 show ?thesis \n by (simp add: minSetOfComponents_def) \nqed\n \nlemma noIrrelevantChannelsTestL2p2:\n\"noIrrelevantChannels level2 {data1, data12}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p2 AbstrLevel2)\n\nlemma allNeededINChannelsTestL2p2:\n\"allNeededINChannels level2 {data1, data12}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p2 systemIN_def AbstrLevel2)\n\nlemma minSetOfComponentsTestL1p3:\n\"minSetOfComponents level1 {data1, data10, data11} = {sA12, sA11, sA21}\"\nproof - \n have sg1:\"outSetOfComponents level1 {data1, data10, data11} = {sA12, sA21}\"\n by (simp add: outSetOfComponents_def AbstrLevel1, auto) \n have \"DSources level1 sA12 = {}\"\n by (simp add: DSources_def AbstrLevel1, auto) \n hence sg2:\"Sources level1 sA12 = {}\"\n by (simp add: DSourcesEmptySources) \n have sg3:\"DSources level1 sA21 = {sA11}\"\n by (simp add: DSources_def AbstrLevel1, auto) \n have sg4:\"DSources level1 sA11 = {}\"\n by (simp add: DSources_def AbstrLevel1, auto) \n hence \"Sources level1 sA21 = {sA11}\"\n by (metis SourcesOnlyDSources sg3 singleton_iff)\n from this and sg1 and sg2 show ?thesis\n by (simp add: minSetOfComponents_def, blast) \nqed\n\nlemma noIrrelevantChannelsTestL1p3:\n\"noIrrelevantChannels level1 {data1, data10, data11}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL1p3 AbstrLevel1)\n\nlemma allNeededINChannelsTestL1p3:\n\"allNeededINChannels level1 {data1, data10, data11}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL1p3 systemIN_def AbstrLevel1)\n\nlemma minSetOfComponentsTestL2p3:\n\"minSetOfComponents level2 {data1, data10, data11} = {sS1, sS2, sS3}\"\nproof - \n have sg1:\"outSetOfComponents level2 {data1, data10, data11} = {sS1, sS3}\"\n by (simp add: outSetOfComponents_def AbstrLevel2, auto) \n have sS1:\"Sources level2 sS1 = {}\" by (simp add: SourcesS1_L2)\n have \"Sources level2 sS3 = {sS2}\" by (simp add: SourcesS3_L2)\n with sg1 sS1 show ?thesis\n by (simp add: minSetOfComponents_def, blast) \nqed\n \nlemma noIrrelevantChannelsTestL2p3:\n\"noIrrelevantChannels level2 {data1, data10, data11}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p3 AbstrLevel2)\n\nlemma allNeededINChannelsTestL2p3:\n\"allNeededINChannels level2 {data1, data10, data11}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p3 systemIN_def AbstrLevel2)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/ComponentDependencies/DataDependenciesCaseStudy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.26670399308765474}} {"text": "theory func_cor_OSMboxPost\n imports rg_cond\nbegin\n \nlemma OSMboxPost_stable_pevent: \"stable \\pevent \\ \\OSMailBoxs\\ (OSMboxPost_rely t)\"\n by(simp add:OSMboxPost_pre_def OSMboxPost_rely_def stable_def gvars_conf_stable_def gvars_conf_def) \n\nlemma OSMboxPost_satRG_cond1_inv_stb : \" \\inv V; cur V = Some t; pevent \\ OSMailBoxs V; \n wait_q (OSMailbox_info V pevent) \\ []\\ \\\n inv (V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))),\n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) := OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := tl (wait_q (OSMailbox_info V pevent))\\),\n need_resched := (need_resched V)(t := True),\n cur := Some (SOME ta. ta \\ hd (wait_q (OSMailbox_info V pevent)) \\ ta \\ t \\ thd_state V ta = READY),\n thd_state := (thd_state V)\n (hd (wait_q (OSMailbox_info V pevent)) := READY, t := READY,\n SOME ta. ta \\ hd (wait_q (OSMailbox_info V pevent)) \\ ta \\ t \\ thd_state V ta = READY := RUNNING),\n ret := (ret V)(t := OS_ERR_NONE)\\)\"\n apply (simp add: inv_def)\n apply (rule conjI, simp add: inv_cur_def)\n apply auto[1]\n apply (rule conjI, simp add: inv_OS_Mem_info_def inv_OS_Mem_info_mp_def)\n apply (simp add: inv_thd_waitq_def)\n apply auto\n apply (metis List.nth_tl Nitpick.size_list_simp(2) Suc_mono hd_conv_nth in_set_conv_nth \n length_pos_if_in_set lessI list.set_sel(1) not_less_zero)\n apply (metis Thread_State_Type.distinct(5) inv_cur_def list.set_sel(2))\n apply (smt Thread_State_Type.distinct(3) list.set_sel(2) set_conv_nth tfl_some tl_def)\n apply (simp add: list.set_sel(2))\n using list.set_sel(1) apply blast\n apply (metis Thread_State_Type.distinct(5) inv_cur_def)\n apply (smt Thread_State_Type.distinct(3) set_conv_nth tfl_some)\n apply (metis hd_Cons_tl set_ConsD)\n apply (simp add: List.nth_tl Nitpick.size_list_simp(2))\n apply (meson list.set_sel(2))\n by (meson list.set_sel(2))\n\n\nlemma OSMboxPost_satRG_cond1: \"msg = Some y \\\n \\\\<^sub>I (W\\th := \\th(t := hd (wait_q (\\OSMailbox_info pevent)));; \\tmout := \\tmout(\\th t := OS_ERR_NONE);;\n \\get_msg := \\get_msg(\\th t \\ y);;\n \\statPend := \\statPend(\\th t := OS_STAT_PEND_OK);;\n \\OSMailbox_info := \\OSMailbox_info(pevent := \\OSMailbox_info pevent\\wait_q := tl (wait_q (\\OSMailbox_info pevent))\\);;\n \\thd_state := \\thd_state(\\th t := READY);;\n \\need_resched := \\need_resched(t := True);;\n IF \\need_resched t THEN reschedule FI;;\n \\ret := \\ret (t := OS_ERR_NONE)) \n sat\\<^sub>p [OSMboxPost_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\cur = Some t\\ \\ \n {V} \\ {Va} \\ \\wait_q (\\OSMailbox_info pevent) \\ []\\, {(s, t). s = t}, UNIV, \n \\\\(Pair V) \\ OSMboxPost_guar t\\ \\ OSMboxPost_post t]\"\n apply (case_tac \"(wait_q (OSMailbox_info V pevent) = [])\")\n apply (smt CollectD Emptyprecond Int_insert_right_if1 disjoint_iff_not_equal inf_bot_right singletonD)\n apply (case_tac \"(pevent \\ OSMailBoxs V)\")\n apply (simp add: Emptyprecond)\n apply (case_tac \"V \\ OSMboxPost_pre t \\ cur V \\ Some t\")\n apply (simp add: Emptyprecond, clarsimp)\n apply(simp add:reschedule_def) \n \\ \\use this method to extract the assumption \"wait_q (\\OSMailbox_info pevent) \\ []\" \\\n apply(rule Seq[where mid = \"let V9 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent))\n := OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V \n pevent\\wait_q := tl (wait_q (OSMailbox_info V pevent))\\),\n need_resched := (need_resched V)(t := True),\n thd_state := (thd_state V)(hd (wait_q (OSMailbox_info V pevent)) \n := READY, t := READY),\n cur := Some (SOME ta. ta \\ hd (wait_q (OSMailbox_info V pevent)) \\\n ta \\ t \\ thd_state V ta = READY)\\ in\n {V9\\thd_state := (thd_state V9)(the (cur V9) := RUNNING)\\}\"]) \n apply(rule Seq[where mid = \"let V6 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) := \n OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V \n pevent\\wait_q := tl (wait_q (OSMailbox_info V pevent))\\),\n thd_state := (thd_state V) (hd (wait_q (OSMailbox_info V pevent))\n := READY)\\ in\n {V6\\need_resched := (need_resched V6)( t := True)\\}\"]) \n apply(rule Seq[where mid = \"let V5 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) := \n OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V) (pevent := OSMailbox_info V pevent\n \\wait_q := tl (wait_q (OSMailbox_info V pevent))\\)\\ in\n {V5\\thd_state := (thd_state V5)((th V5) t := READY)\\}\"]) \n apply(rule Seq[where mid = \"let V4 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))),\n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) := \n OS_STAT_PEND_OK)\\ in\n {V4\\OSMailbox_info := (OSMailbox_info V4)(pevent := OSMailbox_info \n V4 pevent \\wait_q := tl (wait_q (OSMailbox_info V4 pevent))\\)\\} \n (* \\ \\wait_q (\\OSMailbox_info pevent) \\ []\\*)\"]) \n apply(rule Seq[where mid = \"let V3 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y)\\ \n in {V3\\statPend := (statPend V3)((th V3) t := OS_STAT_PEND_OK)\\} \n \\ \\wait_q (\\OSMailbox_info pevent) \\ []\\\"]) \n apply(rule Seq[where mid = \"let V2 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE)\\ \n in {V2\\get_msg := (get_msg V2)((th V2) t := msg)\\} \\ \n \\wait_q (\\OSMailbox_info pevent) \\ []\\\"]) \n apply(rule Seq[where mid = \"let V1 = V\\th := (th V)(t := hd (wait_q((OSMailbox_info V) pevent)))\\ in\n {V1\\tmout := (tmout V1)((th V1) t := OS_ERR_NONE)\\} \\ \n \\wait_q (\\OSMailbox_info pevent) \\ []\\\"]) \n apply(rule Seq[where mid = \"{V\\th := (th V)(t := hd (wait_q((OSMailbox_info V) pevent)))\\} \n \\ \\wait_q (\\OSMailbox_info pevent) \\ []\\\"]) \n apply(rule Basic) \n apply auto \n apply(simp add:stable_id2) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2) \n apply(simp add:stable_id2)\n apply(rule Cond) \n apply(simp add:stable_id2)\n apply(rule Seq[where mid = \"let V8 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) \n := OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V \n pevent\\wait_q := tl (wait_q (OSMailbox_info V pevent))\\),\n need_resched := (need_resched V)(t := True),\n thd_state := (thd_state V)\n (hd (wait_q (OSMailbox_info V pevent)) := READY, t := READY)\\ in\n {V8 \\cur := Some (SOME t. (thd_state V8) t = READY)\\}\"]) \n apply(rule Seq[where mid = \"let V7 = V\\th := (th V)(t := hd (wait_q (OSMailbox_info V pevent))), \n tmout := (tmout V)(hd (wait_q (OSMailbox_info V pevent)) := OS_ERR_NONE),\n get_msg := get_msg V(hd (wait_q (OSMailbox_info V pevent)) \\ y),\n statPend := (statPend V)(hd (wait_q (OSMailbox_info V pevent)) \n := OS_STAT_PEND_OK),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V \n pevent\\wait_q := tl (wait_q (OSMailbox_info V pevent))\\),\n thd_state := (thd_state V)(hd (wait_q (OSMailbox_info V pevent)) \n := READY), need_resched := (need_resched V)(t := True)\\ in\n {V7 \\thd_state := (thd_state V7)((the (cur V7)) := READY)\\}\"]) \n apply(rule Basic) apply auto\n apply(simp add:stable_id2) apply(simp add:stable_id2)\n apply(rule Basic) apply auto\n apply(simp add:stable_id2) apply(simp add:stable_id2)\n apply(rule Basic) apply auto\n apply(simp add:stable_id2) apply(simp add:stable_id2)\n apply(simp add:Emptyprecond)\n apply(rule Basic)\n apply(simp add:OSMboxPost_pre_def OSMboxPost_post_def OSMboxPost_guar_def)\n apply (simp add: gvars_conf_stable_def gvars_conf_def)\n apply auto[1]\n using OSMboxPost_satRG_cond1_inv_stb apply blast\n apply (simp add: lvars_nochange_def)\n apply (simp add: OSMboxPost_satRG_cond1_inv_stb)\n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n done\n\nlemma OSMboxPost_satRG_cond2: \"\n msg = Some y \\ \\\\<^sub>I (W IF \\y. msgPtr (\\OSMailbox_info pevent) = Some y \n THEN \\ret := \\ret(t := OS_ERR_MBOX_FULL)\n ELSE \\OSMailbox_info := \\OSMailbox_info(pevent := \\OSMailbox_info \n pevent\\msgPtr := Some y\\);; \n \\ret := \\ret(t := OK) \n FI) sat\\<^sub>p [OSMboxPost_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\cur = Some t\\ \\ {V} \\ {Va} \\\n - \\wait_q (\\OSMailbox_info pevent) \\ []\\, {(s, t). s = t}, UNIV, \n \\\\(Pair V) \\ OSMboxPost_guar t\\ \\ OSMboxPost_post t]\"\n apply (case_tac \"cur V \\ Some t\")\n apply (simp add: Emptyprecond)\n apply (case_tac \"V \\ OSMboxPost_pre t\")\n apply (simp add: Emptyprecond)\n apply (rule Cond)\n apply (simp add: stable_id2)\n apply (rule Basic)\n apply (simp add: OSMboxPost_guar_def gvars_conf_stable_def inv_def OSMboxPost_post_def \n gvars_conf_def OSMboxPost_pre_def lvars_nochange_def)\n apply (simp add: inv_cur_def inv_OS_Mem_info_def inv_OS_Mem_info_mp_def inv_thd_waitq_def)\n apply auto[1]\n apply simp\n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n apply(rule Seq[where mid = \"{V\\ OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\msgPtr := Some y\\) \\}\"])\n apply (rule Basic)\n apply (simp add: OSMboxPost_guar_def gvars_conf_stable_def inv_def OSMboxPost_post_def \n gvars_conf_def OSMboxPost_pre_def lvars_nochange_def)\n apply (simp add: inv_cur_def inv_OS_Mem_info_def inv_OS_Mem_info_mp_def inv_thd_waitq_def)\n apply auto[1]\n apply simp\n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n apply (rule Basic)\n apply auto[1]\n apply (simp add: OSMboxPost_guar_def gvars_conf_stable_def inv_def OSMboxPost_post_def \n gvars_conf_def OSMboxPost_pre_def lvars_nochange_def)\n apply (simp add: inv_cur_def inv_OS_Mem_info_def inv_OS_Mem_info_mp_def inv_thd_waitq_def)\n apply auto[1]\n apply (simp add: OSMboxPost_post_def OSMboxPost_pre_def)\n apply (simp add: inv_def inv_cur_def inv_OS_Mem_info_def inv_OS_Mem_info_mp_def inv_thd_waitq_def)\n apply auto[1]\n apply simp\n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n apply simp\n done\n\nlemma OSMboxPost_satRG: \"\\ (OSMboxPost t pevent msg) \\ OSMboxPost_RGCond t\"\n apply (simp add:Evt_sat_RG_def)\n apply (simp add:OSMboxPost_def OSMboxPost_RGCond_def)\n apply(simp add:body_def Pre\\<^sub>f_def Post\\<^sub>f_def guard_def\n Rely\\<^sub>f_def Guar\\<^sub>f_def getrgformula_def)\n apply(unfold stm_def)\n apply auto \n apply (rule BasicEvt)\n apply(simp add:body_def guard_def)\n apply (rule Cond)\n apply (simp add: OSMboxPost_pre_stable OSMboxPost_stable_pevent stable_int2)\n apply (rule Await)\n apply (simp add: OSMboxPost_pre_stable OSMboxPost_stable_pevent stable_int2)\n apply (simp add: OSMboxPost_post_stable, clarsimp)\n apply (rule Basic)\n apply (simp add:guard_def OSMboxPost_guar_def gvars_conf_stable_def inv_def \n OSMboxPost_post_def gvars_conf_def OSMboxPost_pre_def lvars_nochange_def)\n apply (simp add: inv_cur_def inv_OS_Mem_info_def inv_OS_Mem_info_mp_def inv_thd_waitq_def)\n apply auto[1]\n apply simp \n apply (simp add: stable_id2)\n apply (simp add: stable_id2)\n apply (simp add: Emptyprecond)\n apply (simp add: OSMboxPost_guar_def)\n apply (simp add: OSMboxPost_pre_stable)\n apply (simp add: OSMboxPost_guar_def) \n apply (rule BasicEvt)\n apply(simp add:body_def guard_def)\n apply (rule Cond)\n apply (simp add: OSMboxPost_pre_stable OSMboxPost_stable_pevent stable_int2)\n apply (simp add: Emptyprecond)\n apply (rule Await)\n apply (simp add: OSMboxPost_pre_stable OSMboxPost_stable_pevent stable_int2)\n apply (simp add: OSMboxPost_post_stable, clarsimp)\n apply (rule Await)\n apply (simp add: stable_id2)\n apply (simp add: stable_id2, clarsimp)\n apply (rule Cond)\n using stable_id2 apply blast\n apply (simp add: OSMboxPost_satRG_cond1)\n apply (simp add: OSMboxPost_satRG_cond2)\n apply simp\n apply (simp add: OSMboxPost_guar_def)\n apply (simp add: OSMboxPost_pre_stable)\n apply (simp add: OSMboxPost_guar_def)\n done\n\nend", "meta": {"author": "SunHuan321", "repo": "uc-OS-verification", "sha": "760e159857c4015d6a9e3ccbe9f8247e4518862a", "save_path": "github-repos/isabelle/SunHuan321-uc-OS-verification", "path": "github-repos/isabelle/SunHuan321-uc-OS-verification/uc-OS-verification-760e159857c4015d6a9e3ccbe9f8247e4518862a/ucOS_mem_mailbox/func_cor_OSMboxPost.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791787121629466, "lm_q2_score": 0.39233683016710835, "lm_q1q2_score": 0.2664668230469893}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory CustomWordAbs\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"custom_word_abs.c\"\ninstall_C_file \"custom_word_abs.c\"\n\nlemma [word_abs]:\n \"\\ abstract_val P x sint x'; abstract_val Q y sint y' \\ \\\n abstract_val (P \\ Q) (max x y)\n sint (x' xor (x' xor y') && - (if x' abstract_val P x unat x'; abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q \\ y < 32) (x mod (2 ^ y)) unat (x' && 2 ^ unat y' - (1 :: word32))\"\n apply (clarsimp simp flip: shiftl_1 simp del: shiftl_Suc_0)\n apply (fold mask_def)\n apply (subst word_mod_2p_is_mask [symmetric])\n apply (subst p2_gt_0)\n by (auto simp: unat_mod)\n\nlemma [word_abs]:\n \"\\ abstract_val P x unat (x' :: word32);\n abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q) (x + y > UINT_MAX) id (x' + y' < x')\"\n apply (subst not_le [symmetric], subst no_plus_overflow_unat_size)\n apply (clarsimp simp: not_less UINT_MAX_def word_size)\n apply arith\n done\n\nautocorres [unsigned_word_abs = b c] \"custom_word_abs.c\"\n\ncontext custom_word_abs begin\n\nlemma \"a' x y = max x y\"\n by (unfold a'_def, rule refl)\n\nlemma \"b' x 4 s = Some (x mod 16)\"\n by (unfold b'_def, simp)\n\nlemma \"c' x y = (if UINT_MAX < x + y then 1 else 0)\"\n by (unfold c'_def, simp)\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/proof-tests/CustomWordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6187804337438502, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.266166762931715}} {"text": "(* Title: HOL/Auth/n_mutualExSimp_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExSimp Protocol Case Study*} \n\ntheory n_mutualExSimp_on_inis imports n_mutualExSimp_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.26616676293171493}} {"text": "(* Title: RTS/JVM_RTS/JVMSemantics.thy *)\n(* Author: Susannah Mansky, UIUC 2020 *)\n\nsection \"Instantiating @{term Semantics} with Jinja JVM\"\n\ntheory JVMSemantics\nimports \"../Common/Semantics\" \"../../JinjaDCI/JVM/JVMExec\"\nbegin\n\nfun JVMsmall :: \"jvm_prog \\ jvm_state \\ jvm_state set\" where\n\"JVMsmall P \\ = { \\'. exec (P, \\) = Some \\' }\"\n\nlemma JVMsmall_prealloc_pres:\nassumes pre: \"preallocated (fst(snd \\))\"\n and \"\\' \\ JVMsmall P \\\"\nshows \"preallocated (fst(snd \\'))\"\nusing exec_prealloc_pres[OF pre] assms by(cases \\, cases \\', auto)\n\nlemma JVMsmall_det: \"JVMsmall P \\ = {} \\ (\\\\'. JVMsmall P \\ = {\\'})\"\nby auto\n\ndefinition JVMendset :: \"jvm_state set\" where\n\"JVMendset \\ { (xp,h,frs,sh). frs = [] \\ (\\x. xp = Some x) }\"\n\nlemma JVMendset_final: \"\\ \\ JVMendset \\ \\P. JVMsmall P \\ = {}\"\n by(auto simp: JVMendset_def)\n\nlemma start_state_nend:\n \"start_state P \\ JVMendset\"\n by(simp add: start_state_def JVMendset_def)\n\ninterpretation JVMSemantics: Semantics JVMsmall JVMendset\n by unfold_locales (auto dest: JVMendset_final)\n\nend", "meta": {"author": "susannahej", "repo": "rts", "sha": "df1ae3f62d804fb5fad524096f653eecac6d0581", "save_path": "github-repos/isabelle/susannahej-rts", "path": "github-repos/isabelle/susannahej-rts/rts-df1ae3f62d804fb5fad524096f653eecac6d0581/JVM_RTS/JVMSemantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.26608269051665046}} {"text": "section {*FUNCTION\\_CONT\\_\\_Enforce\\_Controllability*}\ntheory\n FUNCTION_CONT__Enforce_Controllability\n\nimports\n PRJ_13_06__ENTRY\n\nbegin\n\ndefinition F_DPDA_EC__SpecInput :: \"\n ('stateA, 'event, 'stackA) epda \n \\ (('stateB, 'event, nat) epda \\ 'event set) \n \\ bool\"\n where\n \"F_DPDA_EC__SpecInput G X \\\n case X of \n (P, \\UC) \\ \n valid_dpda G \n \\ valid_dfa P \n \\ epdaS.marked_language G \\ epdaS.marked_language P \n \\ epdaS.unmarked_language G \\ epdaS.unmarked_language P \n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G) \n \\ \\ epdaH_livelock G \n \\ epdaH.accessible G\"\n\ndefinition F_DPDA_EC__SpecOutput :: \"\n ('stateA, 'event, 'stackA) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda \\ 'event set) \n \\ (('stateA, 'event, 'stackA) epda option \\ bool) \n \\ bool\"\n where\n \"F_DPDA_EC__SpecOutput Gi X R \\\n case X of \n (G0, P, \\UC) \\ \n (case R of \n (None, b) \\ \n des_langM \n (Enforce_Marked_Controllable_Subset \n \\UC \n (epdaH.unmarked_language P) \n (epda_to_des Gi)) \n = {} \n \\ \\ b \n | (Some Go, b) \\ \n valid_dpda Go \n \\ Enforce_Marked_Controllable_Subset \n \\UC \n (epdaH.unmarked_language P) \n (epda_to_des Gi) \n = epda_to_des Go \n \\ \\ epdaH_livelock Go \n \\ (b \\ Gi = Go) \n \\ b = epda_operational_controllable Gi P \\UC \n \\ (b \\ epda_to_des Gi = epda_to_des Go))\"\n\ndefinition F_DPDA_EC__F_DPDA_OTS__SpecInput :: \"\n (('stateA, 'stateB) DT_tuple2, 'event, 'stackA) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_OTS__SpecInput G X \\\n case X of \n (S, D) \\ \n valid_dpda G \n \\ valid_dfa D \n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G) \n \\ epdaH_reflection_to_DFA_exists G D sel_tuple2_2 \n \\ \\ epdaH_livelock G \n \\ epda_to_des G = epda_to_des S\"\n\ndefinition F_DPDA_EC__F_DPDA_OTS__SpecOutput :: \"\n ('stateC, 'event, 'stackC) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda \\ 'event set) \n \\ (('stateA, 'event, 'stackA) epda option \\ bool) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_OTS__SpecOutput Gi X R \\\n case X of \n (G0, P, \\UC) \\ \n (case R of \n (None, b) \\ \n des_langM \n (Enforce_Marked_Controllable_Subset \n \\UC \n (epdaH.unmarked_language P) \n (epda_to_des Gi)) \n = {} \n \\ b = False \n | (Some Go, b) \\ \n valid_dpda Go \n \\ Enforce_Marked_Controllable_Subset \n \\UC \n (epdaH.unmarked_language P)\n (epda_to_des Gi) \n = (epda_to_des Go) \n \\ \\ epdaH_livelock Go \n \\ (b \\ G0 = Go) \n \\ b = epda_operational_controllable Gi P \\UC\n \\ (b \\ epda_to_des Gi = epda_to_des Go))\"\n\ndefinition F_DPDA_EC__F_DPDA_EUML__SpecInput :: \"\n ((('stateA, 'stateB) DT_tuple2, 'stackA) DT_state_and_stack_or_state, 'event, 'stackA) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_EUML__SpecInput G X \\\n case X of \n (S, D) \\ \n valid_dpda G \n \\ valid_dfa D \n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G) \n \\ state_stack_unique_for_marking_states G \n \\ state_stack_unique_for_stable_states G \n \\ always_applicable_for_stable_states G \n \\ some_edge_applicable G \n \\ \\ epdaH_livelock G \n \\ epdaH_reflection_to_DFA_exists G D (sel_tuple2_2 \\ F_DPDA_OTS__get_state) \n \\ corresponds_to_top_stack G F_DPDA_OTS__is_auxiliary F_DPDA_OTS__get_stack \n \\ main_states_have_only_empty_steps G F_DPDA_OTS__is_main \n \\ main_states_have_all_empty_steps G F_DPDA_OTS__is_main \n \\ executing_edge_from_auxiliary_to_main_state G F_DPDA_OTS__is_auxiliary F_DPDA_OTS__is_main \n \\ always_applicable_for_auxiliary_states G F_DPDA_OTS__is_auxiliary \n \\ main_to_auxiliary_or_auxiliary_to_main G F_DPDA_OTS__is_main \n \\ epda_to_des G = epda_to_des S\"\n\ndefinition F_DPDA_EC__F_DPDA_EUML__SpecOutput :: \"\n ('stateC, 'event, 'stackC) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda \\ 'event set) \n \\ (('stateA, 'event, 'stackA) epda option \\ bool) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_EUML__SpecOutput \\\n F_DPDA_EC__F_DPDA_OTS__SpecOutput\"\n\ndefinition F_DPDA_EC__F_DPDA_EA_OPT__SpecInput :: \"\n (((('stateA, 'stateB) DT_tuple2, 'stackA) DT_state_and_stack_or_state) DT_state_or_state, 'event, 'stackA) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_EA_OPT__SpecInput G X \\\n case X of \n (S, D) \\ \n valid_dpda G \n \\ valid_dfa D \n \\ nonblockingness_language (epdaH.unmarked_language G) (epdaH.marked_language G) \n \\ state_stack_unique_for_marking_states G \n \\ only_executing_edges_from_marking_states G \n \\ \\ epdaH_livelock G \n \\ epdaH_reflection_to_DFA_exists G D (sel_tuple2_2 \\ F_DPDA_OTS__get_state \\ F_DPDA_EUML__get_state) \n \\ corresponds_to_top_stack G F_DPDA_EUML__is_auxiliary F_DPDA_EUML__get_stack \n \\ main_states_have_only_empty_steps G F_DPDA_EUML__is_main \n \\ main_states_have_all_empty_steps G F_DPDA_EUML__is_main \n \\ executing_edge_from_auxiliary_to_main_state G F_DPDA_EUML__is_auxiliary F_DPDA_EUML__is_main \n \\ always_applicable_for_auxiliary_states G F_DPDA_EUML__is_auxiliary \n \\ main_to_auxiliary_or_auxiliary_to_main G F_DPDA_EUML__is_main \n \\ epda_to_des G = epda_to_des S\"\n\ndefinition F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput :: \"\n ('stateC, 'event, 'stackC) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda \\ 'event set) \n \\ (('stateA, 'event, 'stackA) epda option \\ bool) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput \\\n F_DPDA_EC__F_DPDA_OTS__SpecOutput\"\n\ndefinition F_DPDA_EC__F_DPDA_RCS__SpecInput :: \"\n (((('stateA, 'stateB) DT_tuple2, 'stackA) DT_state_and_stack_or_state) DT_state_or_state, 'event, 'stackA) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_RCS__SpecInput G X \\\n case X of \n (S, D) \\ \n valid_dpda G \n \\ valid_dfa D \n \\ nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G) \n \\ state_stack_unique_for_marking_states G \n \\ only_executing_edges_from_marking_states G \n \\ \\ epdaH_livelock G \n \\ epdaH_reflection_to_DFA_exists G D (sel_tuple2_2 \\ F_DPDA_OTS__get_state \\ F_DPDA_EUML__get_state) \n \\ corresponds_to_top_stack G F_DPDA_EUML__is_auxiliary F_DPDA_EUML__get_stack \n \\ epdaH.accessible G \n \\ main_states_can_be_left_with_empty_step G F_DPDA_EUML__is_main \n \\ main_states_have_only_empty_steps G F_DPDA_EUML__is_main \n \\ executing_edge_from_auxiliary_to_main_state G F_DPDA_EUML__is_auxiliary F_DPDA_EUML__is_main \n \\ always_applicable_for_auxiliary_states G F_DPDA_EUML__is_auxiliary \n \\ main_to_auxiliary_or_auxiliary_to_main G F_DPDA_EUML__is_main \n \\ epda_to_des G = epda_to_des S\"\n\ndefinition F_DPDA_EC__F_DPDA_RCS__SpecOutput :: \"\n ('stateC, 'event, 'stackC) epda \n \\ (('stateA, 'event, 'stackA) epda \\ ('stateB, 'event, nat) epda \\ 'event set) \n \\ (('stateA, 'event, 'stackA) epda option \\ bool) \n \\ bool\"\n where\n \"F_DPDA_EC__F_DPDA_RCS__SpecOutput \\\n F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput\"\n\ntheorem F_DPDA_EC__SOUND: \"\n F_DPDA_EC__SpecInput S (P, \\UC) \n \\ R = F_DPDA_EC S P \\UC \n \\ F_DPDA_EC__SpecOutput S (S, P, \\UC) R\"\n apply(simp add: F_DPDA_EC_def)\n apply(clarsimp)\n apply(rule_tac\n SPo_F=\"F_DPDA_EC__SpecOutput\"\n and SPi_F=\"F_DPDA_EC__SpecInput\"\n and X=\"S\"\n and Y=\"(S, P, \\UC)\"\n and SEL_iF=\"\\(S, P, \\UC). (P, \\UC)\"\n and SEL_iH=\"\\(S, P, \\UC). P\"\n and SEL_iFH=\"\\(S, P, \\UC). (S, P)\"\n and SEL_oF=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SEL_oH=\"\\(S, P, \\UC). (P, \\UC)\"\n and SEL_oFH=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SPi_H=\"FUN_DPDA_DFA_PRODUCT__SpecInput2\"\n and SPo_H=\"FUN_DPDA_DFA_PRODUCT__SpecOutput2\"\n and SPi_FH=\"F_DPDA_EC__F_DPDA_OTS__SpecInput\"\n and SPo_FH=\"F_DPDA_EC__F_DPDA_OTS__SpecOutput\"\n and H=\"F_DPDA_DFA_PRODUCT\"\n in decompose_sequential_execution_input_output_specification_args)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(simp add: FUN_DPDA_DFA_PRODUCT__SpecInput2_def F_DPDA_EC__SpecInput_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"epdaH.unmarked_language S\"\n and s=\"epdaS.unmarked_language S\"\n in ssubst)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda epdaS_to_epdaH_unmarked_language)\n apply(rule_tac\n t=\"epdaH.marked_language S\"\n and s=\"epdaS.marked_language S\"\n in ssubst)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda epdaS_to_epdaH_mlang)\n apply(rule_tac\n t=\"epdaH.marked_language P\"\n and s=\"epdaS.marked_language P\"\n in ssubst)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda epdaS_to_epdaH_mlang)\n apply(rule_tac\n t=\"epdaH.unmarked_language P\"\n and s=\"epdaS.unmarked_language P\"\n in ssubst)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda epdaS_to_epdaH_unmarked_language)\n apply(force)\n apply(rule_tac\n ?Gi=\"S\"\n and P=\"P\"\n in F_DPDA_DFA_PRODUCT__SOUND2)\n apply(force)\n apply(simp add: FUN_DPDA_DFA_PRODUCT__SpecInput2_def F_DPDA_EC__SpecInput_def F_DPDA_EC__F_DPDA_OTS__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def epda_to_des_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"epdaH.unmarked_language S\"\n and s=\"epdaS.unmarked_language S\"\n in subst)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rule_tac\n t=\"epdaH.marked_language S\"\n and s=\"epdaS.marked_language S\"\n in subst)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rule_tac\n t=\"epdaH.marked_language P\"\n and s=\"epdaS.marked_language P\"\n in subst)\n apply(rule epdaS_to_epdaH_mlang)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rule_tac\n t=\"epdaH.unmarked_language P\"\n and s=\"epdaS.unmarked_language P\"\n in subst)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(force)\n apply(rename_tac Pa)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_OTS__SpecOutput_def F_DPDA_EC__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.unmarked_language (F_DPDA_DFA_PRODUCT S P) = epdaH.unmarked_language S\")\n apply(rename_tac Pa x y)(*strict*)\n prefer 2\n apply(simp add: FUN_DPDA_DFA_PRODUCT__SpecOutput2_def F_DPDA_EC__SpecInput_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"epdaH.unmarked_language S\"\n and s=\"epdaS.unmarked_language S\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language S\"\n and s=\"epdaS.marked_language S\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language P\"\n and s=\"epdaS.marked_language P\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language P\"\n and s=\"epdaS.unmarked_language P\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(force)\n apply(rename_tac Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.marked_language (F_DPDA_DFA_PRODUCT S P) = epdaH.marked_language S\")\n apply(rename_tac Pa x y)(*strict*)\n prefer 2\n apply(thin_tac \"epdaH.unmarked_language (F_DPDA_DFA_PRODUCT S P) = epdaH.unmarked_language S\")\n apply(unfold FUN_DPDA_DFA_PRODUCT__SpecOutput2_def F_DPDA_EC__SpecInput_def)[1]\n apply(clarsimp)\n apply(rule_tac\n t=\"epdaH.unmarked_language S\"\n and s=\"epdaS.unmarked_language S\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language S\"\n and s=\"epdaS.marked_language S\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language P\"\n and s=\"epdaS.marked_language P\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language P\"\n and s=\"epdaS.unmarked_language P\"\n in subst)\n apply(rename_tac Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply(simp add: valid_dfa_def)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac Pa x y)(*strict*)\n apply(force)\n apply(rename_tac Pa x y)(*strict*)\n apply(subgoal_tac \"epda_to_des (F_DPDA_DFA_PRODUCT S P) = epda_to_des S\")\n apply(rename_tac Pa x y)(*strict*)\n prefer 2\n apply(simp add: epda_to_des_def)\n apply(rename_tac Pa x y)(*strict*)\n apply(case_tac x)\n apply(rename_tac Pa x y)(*strict*)\n apply(clarsimp)\n apply(rename_tac Pa x y a)(*strict*)\n apply(clarsimp)\n apply(rename_tac Pa a)(*strict*)\n apply(rule_tac\n t=\"epda_operational_controllable S P \\UC\"\n and s=\"epda_operational_controllable (F_DPDA_DFA_PRODUCT S P) P \\UC\"\n in ssubst)\n apply(rename_tac Pa a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac Pa a)(*strict*)\n apply(rule epda_Cont_eq_to_epda_operational_controllable_eq2)\n apply(rename_tac Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac X)(*strict*)\n apply(rename_tac S')\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n SPo_F=\"F_DPDA_EC__F_DPDA_OTS__SpecOutput\"\n and SPi_F=\"F_DPDA_EC__F_DPDA_OTS__SpecInput\"\n and H=\"F_DPDA_OTS\"\n and X=\"S'\"\n and Y=\"(S, P, \\UC)\"\n and SEL_iF=\"\\(S, P, \\UC). (S, P)\"\n and SEL_iH=\"\\(S, P, \\UC). P\"\n and SEL_iFH=\"\\(S, P, \\UC). (S, P)\"\n and SEL_oF=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SEL_oH=\"\\(S, P, \\UC). (P, \\UC)\"\n and SEL_oFH=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SPi_H=\"F_DPDA_OTS__SpecInput\"\n and SPo_H=\"F_DPDA_OTS__SpecOutput\"\n and SPi_FH=\"F_DPDA_EC__F_DPDA_EUML__SpecInput\"\n and SPo_FH=\"F_DPDA_EC__F_DPDA_EUML__SpecOutput\"\n in decompose_sequential_execution_input_output_specification_args2_noHargs)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_OTS__SpecInput_def F_DPDA_OTS__SpecInput_def)\n apply(rename_tac S')(*strict*)\n apply(rule F_DPDA_OTS__SOUND)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EUML__SpecInput_def F_DPDA_OTS__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecInput_def epda_to_des_def)\n apply(rename_tac S' Pa)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_EUML__SpecInput_def F_DPDA_OTS__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecInput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.unmarked_language (F_DPDA_OTS S') = epdaH.unmarked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.marked_language (F_DPDA_OTS S') = epdaH.marked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epda_to_des (F_DPDA_OTS S') = epda_to_des S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(simp add: epda_to_des_def)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(case_tac x)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(clarify)\n apply(simp (no_asm))\n apply(rename_tac S' Pa y)(*strict*)\n apply(simp (no_asm_use))\n apply(rule conjI)\n apply(rename_tac S' Pa y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(rule_tac\n t=\"epda_to_des S'\"\n and s=\"epda_to_des (F_DPDA_OTS S')\"\n in ssubst)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language S'\"\n and s=\"epdaH.unmarked_language (F_DPDA_OTS S')\"\n in ssubst)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa x y a)(*strict*)\n apply(clarify)\n apply(simp (no_asm))\n apply(rename_tac S' Pa y a)(*strict*)\n apply(simp (no_asm_use))\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule_tac\n t=\"epda_operational_controllable S' P \\UC\"\n and s=\"epda_operational_controllable (F_DPDA_OTS S') P \\UC\"\n in ssubst)\n apply(rename_tac S' Pa y a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule epda_Cont_eq_to_epda_operational_controllable_eq2)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' X)(*strict*)\n apply(thin_tac \"F_DPDA_EC__F_DPDA_OTS__SpecInput S' (S, P)\")\n apply(clarsimp)\n apply(rename_tac X)(*strict*)\n apply(rename_tac S')\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n SPo_F=\"F_DPDA_EC__F_DPDA_EUML__SpecOutput\"\n and SPi_F=\"F_DPDA_EC__F_DPDA_EUML__SpecInput\"\n and H=\"F_DPDA_EUML\"\n and X=\"S'\"\n and Y=\"(S, P, \\UC)\"\n and SEL_iF=\"\\(S, P, \\UC). (S, P)\"\n and SEL_iH=\"\\(S, P, \\UC). P\"\n and SEL_iFH=\"\\(S, P, \\UC). (S, P)\"\n and SEL_oF=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SEL_oH=\"\\(S, P, \\UC). (P, \\UC)\"\n and SEL_oFH=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SPi_H=\"F_DPDA_EUML__SpecInput\"\n and SPo_H=\"F_DPDA_EUML__SpecOutput\"\n and SPi_FH=\"F_DPDA_EC__F_DPDA_EA_OPT__SpecInput\"\n and SPo_FH=\"F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput\"\n in decompose_sequential_execution_input_output_specification_args2_noHargs)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EUML__SpecInput_def F_DPDA_EC__F_DPDA_EUML__SpecInput_def)\n apply(rename_tac S')(*strict*)\n apply(rule F_DPDA_EUML__SOUND)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EA_OPT__SpecInput_def F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_EUML__SpecInput_def epda_to_des_def)\n apply(rename_tac S' Pa)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EC__F_DPDA_EUML__SpecInput_def F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.unmarked_language (F_DPDA_EUML S') = epdaH.unmarked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.marked_language (F_DPDA_EUML S') = epdaH.marked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epda_to_des (F_DPDA_EUML S') = epda_to_des S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(simp add: epda_to_des_def)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(case_tac x)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(clarify)\n apply(simp (no_asm))\n apply(rename_tac S' Pa y)(*strict*)\n apply(simp (no_asm_use))\n apply(rule conjI)\n apply(rename_tac S' Pa y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(rule_tac\n t=\"epda_to_des S'\"\n and s=\"epda_to_des (F_DPDA_EUML S')\"\n in ssubst)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language S'\"\n and s=\"epdaH.unmarked_language (F_DPDA_EUML S')\"\n in ssubst)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa x y a)(*strict*)\n apply(clarify)\n apply(simp (no_asm))\n apply(rename_tac S' Pa y a)(*strict*)\n apply(simp (no_asm_use))\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule conjI)\n apply(rename_tac S' Pa y a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule_tac\n t=\"epda_operational_controllable S' P \\UC\"\n and s=\"epda_operational_controllable (F_DPDA_EUML S') P \\UC\"\n in ssubst)\n apply(rename_tac S' Pa y a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(rule epda_Cont_eq_to_epda_operational_controllable_eq2)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' Pa y a)(*strict*)\n apply(force)\n apply(rename_tac S' X)(*strict*)\n apply(thin_tac \"F_DPDA_EC__F_DPDA_EUML__SpecInput S' (S, P)\")\n apply(clarsimp)\n apply(rename_tac X)(*strict*)\n apply(rename_tac S')\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n SPo_F=\"F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput\"\n and SPi_F=\"F_DPDA_EC__F_DPDA_EA_OPT__SpecInput\"\n and H=\"F_DPDA_EA_OPT\"\n and X=\"S'\"\n and Y=\"(S, P, \\UC)\"\n and SEL_iF=\"\\(S, P, \\UC). (S, P)\"\n and SEL_iH=\"\\(S, P, \\UC). P\"\n and SEL_iFH=\"\\(S, P, \\UC). (S, P)\"\n and SEL_oF=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SEL_oH=\"\\(S, P, \\UC). (P, \\UC)\"\n and SEL_oFH=\"\\(S, P, \\UC). (S, P, \\UC)\"\n and SPi_H=\"F_DPDA_EA_OPT__SpecInput2\"\n and SPo_H=\"F_DPDA_EA_OPT__SpecOutput2\"\n and SPi_FH=\"F_DPDA_EC__F_DPDA_RCS__SpecInput\"\n and SPo_FH=\"F_DPDA_EC__F_DPDA_RCS__SpecOutput\"\n in decompose_sequential_execution_input_output_specification_args2_noHargs)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EA_OPT__SpecInput2_def F_DPDA_EC__F_DPDA_EA_OPT__SpecInput_def)\n apply(clarsimp)\n apply(rule_tac\n s=\"epdaH.unmarked_language S'\"\n and t=\"epdaS.unmarked_language S'\"\n in ssubst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n s=\"epdaH.marked_language S'\"\n and t=\"epdaS.marked_language S'\"\n in ssubst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_mlang) \n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(rule F_DPDA_EA_OPT__SOUND2)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_RCS__SpecInput_def F_DPDA_EA_OPT__SpecOutput2_def F_DPDA_EC__F_DPDA_EA_OPT__SpecInput_def epda_to_des_def F_DPDA_EC__SpecInput_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"epdaH.unmarked_language S\"\n and s=\"epdaH.unmarked_language S'\"\n in ssubst)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language S\"\n and s=\"epdaH.marked_language S'\"\n in ssubst)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language S'\"\n and s=\"epdaS.unmarked_language S'\"\n in subst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language (F_DPDA_EA_OPT S')\"\n and s=\"epdaS.unmarked_language (F_DPDA_EA_OPT S')\"\n in subst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language S'\"\n and s=\"epdaS.marked_language S'\"\n in subst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language (F_DPDA_EA_OPT S')\"\n and s=\"epdaS.marked_language (F_DPDA_EA_OPT S')\"\n in subst)\n apply(rename_tac S')(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S')(*strict*)\n apply(force)\n apply(rename_tac S' Pa)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EC__F_DPDA_EA_OPT__SpecInput_def F_DPDA_EA_OPT__SpecOutput2_def F_DPDA_EC__SpecInput_def F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.unmarked_language (F_DPDA_EA_OPT S') = epdaH.unmarked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"epdaH.unmarked_language S'\"\n and s=\"epdaS.unmarked_language S'\"\n in subst)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language (F_DPDA_EA_OPT S')\"\n and s=\"epdaS.unmarked_language (F_DPDA_EA_OPT S')\"\n in subst)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epdaH.marked_language (F_DPDA_EA_OPT S') = epdaH.marked_language S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"epdaH.marked_language S'\"\n and s=\"epdaS.marked_language S'\"\n in subst)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language (F_DPDA_EA_OPT S')\"\n and s=\"epdaS.marked_language (F_DPDA_EA_OPT S')\"\n in subst)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(force)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(subgoal_tac \"epda_to_des (F_DPDA_EA_OPT S') = epda_to_des S'\")\n apply(rename_tac S' Pa x y)(*strict*)\n prefer 2\n apply(simp add: epda_to_des_def)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(case_tac x)\n apply(rename_tac S' Pa x y)(*strict*)\n apply(clarsimp)\n apply(rename_tac S' Pa x y a)(*strict*)\n apply(clarsimp)\n apply(rename_tac S' Pa a)(*strict*)\n apply(rule_tac\n t=\"epda_operational_controllable S' P \\UC\"\n and s=\"epda_operational_controllable (F_DPDA_EA_OPT S') P \\UC\"\n in ssubst)\n apply(rename_tac S' Pa a)(*strict*)\n apply(rule epda_Cont_eq_to_epda_operational_controllable_eq2)\n apply(rename_tac S' Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac S' Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac S' Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac S' Pa a)(*strict*)\n apply(simp add: F_DPDA_EC__SpecInput_def FUN_DPDA_DFA_PRODUCT__SpecOutput2_def)\n apply(rename_tac S' Pa a)(*strict*)\n apply(force)\n apply(rename_tac S' X)(*strict*)\n apply(thin_tac \"F_DPDA_EC__F_DPDA_EA_OPT__SpecInput S' (S, P)\")\n apply(clarsimp)\n apply(rename_tac X)(*strict*)\n apply(rename_tac S')\n apply(rename_tac S')(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac S')(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S'\"\n and P=\"P\"\n and \\UC=\"\\UC\"\n in F_DPDA_RCS__SOUND)\n apply(simp add: F_DPDA_EC__F_DPDA_RCS__SpecInput_def F_DPDA_RCS__SpecInput_def)\n apply(rename_tac S')(*strict*)\n apply(case_tac \"F_DPDA_RCS S' P \\UC\")\n apply(rename_tac S' a b)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac S' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac S' b)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EC__F_DPDA_RCS__SpecOutput_def F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_RCS__SpecInput_def F_DPDA_EC__SpecInput_def F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(rename_tac S' a b aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac S' b aa)(*strict*)\n apply(thin_tac \"F_DPDA_RCS S' P \\UC = (Some aa, b)\")\n apply(rename_tac S' b aa)(*strict*)\n apply(simp add: F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EC__F_DPDA_RCS__SpecOutput_def)\n apply(case_tac b)\n apply(rename_tac S' b aa)(*strict*)\n apply(clarsimp)\n apply(simp only: F_DPDA_EC__SpecInput_def F_DPDA_EC__F_DPDA_RCS__SpecInput_def F_DPDA_EC__F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac S' b aa)(*strict*)\n apply(clarsimp)\n apply(simp only: F_DPDA_EC__SpecInput_def F_DPDA_EC__F_DPDA_RCS__SpecInput_def F_DPDA_EC__F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_EA_OPT__SpecOutput_def F_DPDA_RCS__SpecOutput_def F_DPDA_EC__F_DPDA_EUML__SpecOutput_def F_DPDA_EC__F_DPDA_OTS__SpecOutput_def)\n apply(clarsimp)\n apply(rename_tac S'')\n apply(rename_tac S' b S'')(*strict*)\n apply(rule context_conjI)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule F_EPDA_TC__preserves_DPDA)\n apply(force)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule context_conjI)\n apply(rename_tac S' b S'')(*strict*)\n apply(simp add: epda_to_des_def)\n apply(rule conjI)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language S''\"\n and s=\"epdaS.unmarked_language S''\"\n in subst)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule_tac\n t=\"epdaH.unmarked_language (F_EPDA_TC S'')\"\n and s=\"epdaS.unmarked_language (F_EPDA_TC S'')\"\n in subst)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule epdaS_to_epdaH_unmarked_language)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule F_EPDA_TC__preserves_unmarked_language)\n apply (metis valid_dpda_to_valid_pda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language S''\"\n and s=\"epdaS.marked_language S''\"\n in subst)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule_tac\n t=\"epdaH.marked_language (F_EPDA_TC S'')\"\n and s=\"epdaS.marked_language (F_EPDA_TC S'')\"\n in subst)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule epdaS_to_epdaH_mlang)\n apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule F_EPDA_TC__preserves_lang)\n apply (metis valid_dpda_to_valid_pda)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule conjI)\n apply(rename_tac S' b S'')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S' b S'')(*strict*)\n apply(rule F_EPDA_TC__preserves_no_livelock)\n apply(rename_tac S' b S'')(*strict*)\n apply (metis valid_dpda_to_valid_pda)\n apply(rename_tac S' b S'')(*strict*)\n apply(force)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_13_06/FUNCTION_CONT__Enforce_Controllability.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.26608268464496293}} {"text": "theory Compiler imports Compiler1 Compiler2 begin\n\ndefinition J2JVM :: \"'addr J_prog \\ 'addr jvm_prog\"\nwhere [code del]: \"J2JVM \\ compP2 \\ compP1\"\n\nlemma J2JVM_code [code]:\n \"J2JVM = compP (\\C M Ts T (pns, body). compMb2 (compE1 (this#pns) body))\"\nby(simp add: J2JVM_def compP2_def o_def compP_compP split_def)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Compiler/Compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.26604922152065086}} {"text": "theory LocalChurchRosser\n imports DirectDerivation\nbegin\n(* Fund. Alg. GT, PDF. P. 117\nhttps://link.springer.com/content/pdf/10.1007/3-540-31188-2.pdf?pdf=button\n *)\n(* declare [[show_sorts]]\n *) \nlocale parallel_independence =\n p\\<^sub>1: direct_derivation r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 +\n p\\<^sub>2: direct_derivation r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' G g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2\n for r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2 +\n assumes\n i: \\\\i. morphism (lhs r\\<^sub>1) D\\<^sub>2 i \\ (\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v) \\ (\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e)\\ and\n j: \\\\j. morphism (lhs r\\<^sub>2) D\\<^sub>1 j \\ (\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v) \\ (\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e)\\\n\n\nlocale sequential_independence =\n p\\<^sub>1: direct_derivation r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 +\n p\\<^sub>2: direct_derivation r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' H\\<^sub>1 g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2\n for r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2 +\n assumes\n i: \\\\i. morphism (rhs r\\<^sub>1) D\\<^sub>2 i \\ (\\v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v) \\ (\\e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e)\\ and\n j: \\\\j. morphism (lhs r\\<^sub>2) D\\<^sub>1 j \\ (\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v) \\ (\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e)\\ \n\n\n\ntheorem (in parallel_independence) church_rosser_1:\n shows \\\\(g' ::('o, 'm, 'p, 'n) pre_morph)\n (D' :: ('k \\ 'u + 'e, 'l \\ 'v + 'f, 'g, 'h) pre_graph) \n (m':: ('q, 'k \\ 'u + 'e, 'r, 'l \\ 'v + 'f) pre_morph)\n (c':: ('k \\ 'u + 'e, 'm, 'l \\ 'v + 'f, 'n) pre_morph)\n (H :: (('k \\ 'u + 's) + 'k \\ 'u + 'e, ('l \\ 'v + 't) + 'l \\ 'v + 'f, 'g, 'h) pre_graph)\n (f':: ('s, ('k \\ 'u + 's) + 'k \\ 'u + 'e, 't, ('l \\ 'v + 't) + 'l \\ 'v + 'f) pre_morph)\n h' \n (g'')\n (D'' ::('k \\ 'u + 's, 'l \\ 'v + 't, 'g, 'h) pre_graph)\n m'' c'' \n (H :: (('k \\ 'u + 's) + 'k \\ 'u + 'e, ('l \\ 'v + 't) + 'l \\ 'v + 'f, 'g, 'h) pre_graph)\n f'' h''. \n sequential_independence r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' g' D' m' c' H f' h'\n \\ sequential_independence r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' G g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2 r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' g'' D'' m'' c'' H f'' h''\\\nproof -\n\n interpret c\\<^sub>1: injective_morphism D\\<^sub>1 G c\\<^sub>1\n using p\\<^sub>1.po1.b_inj_imp_g_inj p\\<^sub>1.r.k.injective_morphism_axioms by blast\n interpret c\\<^sub>2: injective_morphism D\\<^sub>2 G c\\<^sub>2\n using p\\<^sub>2.po1.b_inj_imp_g_inj p\\<^sub>2.r.k.injective_morphism_axioms by blast\n\n interpret h\\<^sub>1: injective_morphism D\\<^sub>1 H\\<^sub>1 h\\<^sub>1\n using p\\<^sub>1.po2.b_inj_imp_g_inj p\\<^sub>1.r.r.injective_morphism_axioms by blast\n interpret h\\<^sub>2: injective_morphism D\\<^sub>2 H\\<^sub>2 h\\<^sub>2\n using p\\<^sub>2.po2.b_inj_imp_g_inj p\\<^sub>2.r.r.injective_morphism_axioms by blast\n\n obtain i\\<^sub>1 i\\<^sub>2 where \\morphism (lhs r\\<^sub>1) D\\<^sub>2 i\\<^sub>1\\ \n \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\ and\n \\morphism (lhs r\\<^sub>2) D\\<^sub>1 i\\<^sub>2\\ \n \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n using i j by auto\n\n interpret i\\<^sub>1: morphism \"lhs r\\<^sub>1\" D\\<^sub>2 i\\<^sub>1 \n using \\morphism (lhs r\\<^sub>1) D\\<^sub>2 i\\<^sub>1\\ by assumption\n\n interpret i\\<^sub>1: injective_morphism \"lhs r\\<^sub>1\" D\\<^sub>2 i\\<^sub>1 \n proof\n show \\inj_on \\<^bsub>i\\<^sub>1\\<^esub>\\<^sub>V V\\<^bsub>lhs r\\<^sub>1\\<^esub>\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\\n c\\<^sub>2.inj_nodes p\\<^sub>1.gi.inj_nodes\n by (simp add: inj_on_def morph_comp_def) metis\n next\n show \\inj_on \\<^bsub>i\\<^sub>1\\<^esub>\\<^sub>E E\\<^bsub>lhs r\\<^sub>1\\<^esub>\\\n using \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\\n c\\<^sub>2.inj_edges p\\<^sub>1.gi.inj_edges\n by (simp add: inj_on_def morph_comp_def) metis\n qed\n\n interpret i\\<^sub>2: morphism \"lhs r\\<^sub>2\" D\\<^sub>1 i\\<^sub>2\n using \\morphism (lhs r\\<^sub>2) D\\<^sub>1 i\\<^sub>2\\\n by assumption\n\n interpret i\\<^sub>2: injective_morphism \"lhs r\\<^sub>2\" D\\<^sub>1 i\\<^sub>2\n proof\n show \\inj_on \\<^bsub>i\\<^sub>2\\<^esub>\\<^sub>V V\\<^bsub>lhs r\\<^sub>2\\<^esub>\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\\n c\\<^sub>1.inj_nodes p\\<^sub>2.gi.inj_nodes\n by (simp add: inj_on_def morph_comp_def) metis\n next\n show \\inj_on \\<^bsub>i\\<^sub>2\\<^esub>\\<^sub>E E\\<^bsub>lhs r\\<^sub>2\\<^esub>\\\n using \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n c\\<^sub>1.inj_edges p\\<^sub>2.gi.inj_edges\n by (simp add: inj_on_def morph_comp_def) metis\n qed\n\n interpret pb: pullback_construction D\\<^sub>1 G D\\<^sub>2 c\\<^sub>1 c\\<^sub>2 ..\n\n interpret wf_b\\<^sub>1i\\<^sub>1: morphism \"interf r\\<^sub>1\" D\\<^sub>2 \"i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\"\n using wf_morph_comp[OF p\\<^sub>1.r.k.morphism_axioms i\\<^sub>1.morphism_axioms]\n by assumption\n\n(* j1 start *)\n have a: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ m\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ (i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1)\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for v\n using that pb.pb.node_commutativity \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\\n p\\<^sub>1.po1.node_commutativity p\\<^sub>1.r.k.morph_node_range\n by (simp add: morph_comp_def pb.b_def pb.c_def pb.A_def)\n have b: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ m\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ (i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1)\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for e\n using that pb.pb.edge_commutativity \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\\n p\\<^sub>1.po1.edge_commutativity p\\<^sub>1.r.k.morph_edge_range\n by (simp add: morph_comp_def pb.b_def pb.c_def pb.A_def)\n\n\n obtain j\\<^sub>1 where \\morphism (interf r\\<^sub>1) pb.A j\\<^sub>1\\\n and \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\ \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\\n and \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\ \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\\n using pb.pb.universal_property_exist_gen[OF p\\<^sub>1.r.k.G.graph_axioms wf_b\\<^sub>1i\\<^sub>1.morphism_axioms p\\<^sub>1.po1.c.morphism_axioms a b]\n by fast\n\n interpret j\\<^sub>1: morphism \"interf r\\<^sub>1\" pb.A j\\<^sub>1\n using \\morphism (interf r\\<^sub>1) pb.A j\\<^sub>1\\ \n by assumption\n interpret j\\<^sub>1: injective_morphism \"interf r\\<^sub>1\" pb.A j\\<^sub>1\n proof\n show \\inj_on \\<^bsub>j\\<^sub>1\\<^esub>\\<^sub>V V\\<^bsub>interf r\\<^sub>1\\<^esub>\\\n using \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\ p\\<^sub>1.d_inj.inj_nodes\n by (simp add: morph_comp_def inj_on_def) metis\n next\n show \\inj_on \\<^bsub>j\\<^sub>1\\<^esub>\\<^sub>E E\\<^bsub>interf r\\<^sub>1\\<^esub>\\\n using \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\ p\\<^sub>1.d_inj.inj_edges\n by (simp add: morph_comp_def inj_on_def) metis\n qed\n \n(* j2 start *)\n\n interpret b\\<^sub>2i\\<^sub>2: morphism \"interf r\\<^sub>2\" D\\<^sub>1 \"i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\"\n using wf_morph_comp[OF p\\<^sub>2.r.k.morphism_axioms i\\<^sub>2.morphism_axioms]\n by assumption\n\n\n have a: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ (i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ m\\<^sub>2\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for v\n using pb.pb.node_commutativity \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\\n p\\<^sub>2.po1.node_commutativity p\\<^sub>2.r.k.morph_node_range that\n by (simp add: morph_comp_def pb.b_def pb.c_def pb.A_def)\n\n have b: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ (i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ m\\<^sub>2\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for e\n using pb.pb.edge_commutativity \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n p\\<^sub>2.po1.edge_commutativity p\\<^sub>2.r.k.morph_edge_range that\n by (simp add: morph_comp_def pb.b_def pb.c_def pb.A_def)\n\n obtain j\\<^sub>2 where \\morphism (interf r\\<^sub>2) pb.A j\\<^sub>2\\\n and \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\\n and j2c: \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>V v\\ \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>E e\\\n using pb.pb.universal_property_exist_gen[OF p\\<^sub>2.r.k.G.graph_axioms p\\<^sub>2.po1.c.morphism_axioms b\\<^sub>2i\\<^sub>2.morphism_axioms a b]\n by fast\n interpret j\\<^sub>2: morphism \"interf r\\<^sub>2\" pb.A j\\<^sub>2\n using \\morphism (interf r\\<^sub>2) pb.A j\\<^sub>2\\ \n by assumption\n\n interpret j\\<^sub>2: injective_morphism \"interf r\\<^sub>2\" pb.A j\\<^sub>2\n proof\n show \\inj_on \\<^bsub>j\\<^sub>2\\<^esub>\\<^sub>V V\\<^bsub>interf r\\<^sub>2\\<^esub>\\\n using \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ p\\<^sub>2.d_inj.inj_nodes\n by (simp add: morph_comp_def inj_on_def) metis\n next\n show \\inj_on \\<^bsub>j\\<^sub>2\\<^esub>\\<^sub>E E\\<^bsub>interf r\\<^sub>2\\<^esub>\\\n using \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\ p\\<^sub>2.d_inj.inj_edges\n by (simp add: morph_comp_def inj_on_def) metis\n qed\n\n(* commutativity *)\n\n interpret morphism \"interf r\\<^sub>1\" D\\<^sub>1 \"pb.b \\\\<^sub>\\ j\\<^sub>1\"\n using wf_morph_comp[OF j\\<^sub>1.morphism_axioms pb.b.morphism_axioms]\n by assumption\n interpret morphism \"lhs r\\<^sub>1\" G \"c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\"\n using wf_morph_comp[OF i\\<^sub>1.morphism_axioms p\\<^sub>2.po1.g.morphism_axioms]\n by assumption\n\n\n interpret \"6+5\": pushout_diagram \"interf r\\<^sub>1\" D\\<^sub>1 \"lhs r\\<^sub>1\" G \"pb.b \\\\<^sub>\\ j\\<^sub>1\" b\\<^sub>1 c\\<^sub>1 \"c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\"\n proof \n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for v\n using that p\\<^sub>1.po1.node_commutativity \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ p\\<^sub>1.r.k.morph_node_range\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for e\n using that p\\<^sub>1.po1.edge_commutativity \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\ p\\<^sub>1.r.k.morph_edge_range\n by (simp add: morph_comp_def)\n next\n show \\Ex1M\n (\\xa. morphism (to_ngraph G) D' xa \\\n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e))\n (to_ngraph G)\\ if \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>1)) D' y\\ \\morphism (to_ngraph D\\<^sub>1) D' x\\\n \n \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>1\\<^esub>\\<^sub>E e\\\n for D' :: \"('g,'h) ngraph\" and x y\n proof -\n\n have \\\\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for v\n using that \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\ \n \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def)\n\n have \\\\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>\\ for v\n using that \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ \n by (simp add: morph_comp_def)\n\n(* from here: *)\n\n have a: \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x \\\\<^sub>\\ to_nmorph m\\<^sub>1\\<^esub>\\<^sub>V v\\\n using \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def) \n have b: \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x \\\\<^sub>\\ to_nmorph m\\<^sub>1\\<^esub>\\<^sub>E e\\\n using \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\ \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\\n that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def) \n\n obtain u where \\morphism (to_ngraph G) D' u\\\n and aa1: \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n and aa2: \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using p\\<^sub>1.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>1)) D' y\\ \\morphism (to_ngraph D\\<^sub>1) D' x\\ a b]\n by fast\n\n\n(* used for technical reasons within the upcoming proof *)\n have n: \\morphism (to_ngraph G) D' u \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using \\morphism (to_ngraph G) D' u\\ aa1(1) aa1(2) aa2(1) aa2(2) by force\n\n\n show ?thesis\n proof (rule_tac x = u in exI, safe)\n show \\morphism (to_ngraph G) D' u\\\n using \\morphism (to_ngraph G) D' u\\ by assumption\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ if \\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>\\ for e\n using \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ that \n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ if \\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>\\ for v\n using aa1(1) \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ that\n by (auto simp add: to_nmorph_def morph_comp_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\ if \\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>\\ for e\n using aa1(2) \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\ that\n by (auto simp add: to_nmorph_def morph_comp_def to_ngraph_def)\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>E e = \\<^bsub>u\\<^esub>\\<^sub>E e\\\n if \\morphism (to_ngraph G) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\ e \\ E\\<^bsub>to_ngraph G\\<^esub>\\\n for ya e\n proof -\n have m:\\morphism (to_ngraph G) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using that\n proof (intro conjI)\n show \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n qed assumption\n\n show ?thesis\n using ex_eq[OF p\\<^sub>1.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>1)) D' y\\ \\morphism (to_ngraph D\\<^sub>1) D' x\\ a b], OF n m] that\n by simp\n qed\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>V v = \\<^bsub>u\\<^esub>\\<^sub>V v\\\n if \\morphism (to_ngraph G) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\v \\ V\\<^bsub>to_ngraph G\\<^esub>\\\n for ya v\n proof -\n have m:\\morphism (to_ngraph G) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using that\n proof (intro conjI)\n show \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that \\\\e \\ E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n qed assumption\n\n show ?thesis\n using ex_eq[OF p\\<^sub>1.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>1)) D' y\\ \\morphism (to_ngraph D\\<^sub>1) D' x\\ a b], OF n m] that\n by simp\n qed\n qed\n qed\n qed\n \n\n(* show pb is also a pushout *)\n interpret inj_k: injective_morphism pb.A D\\<^sub>1 pb.b\n using pb.pb.g_inj_imp_b_inj[OF c\\<^sub>2.injective_morphism_axioms]\n by assumption\n\n interpret ink_l: injective_morphism pb.A D\\<^sub>2 pb.c\n using pullback_diagram.g_inj_imp_b_inj[OF pb.pb.flip_diagram c\\<^sub>1.injective_morphism_axioms]\n by assumption\n\n have a: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for v\n using that \"6+5.node_commutativity\"\n by(simp add: morph_comp_def)\n have b: \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for e\n using that \"6+5.edge_commutativity\"\n by(simp add: morph_comp_def)\n\n\n(* experiment *)\n(* have jointly_surj_nodes: \\(\\v\\V\\<^bsub>D\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>2\\<^esub>\\<^sub>V v = x) \\ (\\v\\V\\<^bsub>D\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>1\\<^esub>\\<^sub>V v = x)\\\n if \\x \\ V\\<^bsub>G\\<^esub>\\ for x\n using that \"6+5.joint_surjectivity_nodes\" p\\<^sub>1.po1.joint_surjectivity_nodes i\\<^sub>1.morph_node_range\n by (fastforce simp add: morph_comp_def)\n \n have jointly_surj_edges: \\(\\e\\E\\<^bsub>D\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>2\\<^esub>\\<^sub>E e = x) \\ (\\e\\E\\<^bsub>D\\<^sub>1\\<^esub>. \\<^bsub>c\\<^sub>1\\<^esub>\\<^sub>E e = x)\\\n if \\x \\ E\\<^bsub>G\\<^esub>\\ for x\n using that \"6+5.joint_surjectivity_edges\" p\\<^sub>1.po1.joint_surjectivity_edges i\\<^sub>1.morph_edge_range\n by (fastforce simp add: morph_comp_def)\n *)\n(* interpret pb_is_po: pushout_diagram pb.A D\\<^sub>1 D\\<^sub>2 G pb.b pb.c c\\<^sub>1 c\\<^sub>2\n using po_characterization[OF inj_k.injective_morphism_axioms ink_l.injective_morphism_axioms\n c\\<^sub>1.injective_morphism_axioms c\\<^sub>2.injective_morphism_axioms\n pb.pb.node_commutativity pb.pb.edge_commutativity \n pb.reduced_chain_condition_nodes pb.reduced_chain_condition_edges\n jointly_surj_nodes jointly_surj_edges]\n by fast\n *)\n\n(* till here (experiment) *)\n interpret pbj1: injective_morphism \"interf r\\<^sub>1\" D\\<^sub>1 \"pb.b \\\\<^sub>\\ j\\<^sub>1\"\n using inj_comp_inj\n using \"6+5.flip_diagram\" c\\<^sub>2.injective_morphism_axioms i\\<^sub>1.injective_morphism_axioms p\\<^sub>1.r.k.injective_morphism_axioms pushout_diagram.b_f_inj_imp_c_inj by blast\n\n interpret \"6+5pb\": pullback_diagram \"interf r\\<^sub>1\" D\\<^sub>1 \"lhs r\\<^sub>1\" G \"pb.b \\\\<^sub>\\ j\\<^sub>1\" b\\<^sub>1 c\\<^sub>1 \"c\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\"\n using \"6+5.pushout_pullback_inj_b\"[OF pbj1.injective_morphism_axioms]\n using p\\<^sub>1.r.k.injective_morphism_axioms by fastforce\n\n\n interpret sixpb: pullback_diagram \"interf r\\<^sub>1\" pb.A \"lhs r\\<^sub>1\" D\\<^sub>2 j\\<^sub>1 b\\<^sub>1 pb.c i\\<^sub>1\n using pullback_decomposition[OF j\\<^sub>1.morphism_axioms _ pb.pb.pullback_diagram_axioms]\n using \"6+5pb.pullback_diagram_axioms\" \\\\e. e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\ \\\\v. v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\ i\\<^sub>1.morphism_axioms by blast\n\n\n(* CLEANUP HERE *)\n\n have jointly_surj_nodes: \\(\\v\\V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>i\\<^sub>1\\<^esub>\\<^sub>V v = x) \\ (\\v\\V\\<^bsub>pb.A\\<^esub>. \\<^bsub>pb.c\\<^esub>\\<^sub>V v = x)\\\n if \\x \\ V\\<^bsub>D\\<^sub>2\\<^esub>\\ for x\n using that c\\<^sub>2.inj_nodes p\\<^sub>2.po1.g.morph_node_range pb.reduced_chain_condition_nodes\n \"6+5.joint_surjectivity_nodes\" p\\<^sub>1.po1.joint_surjectivity_nodes i\\<^sub>1.morph_node_range\n by (auto simp add: morph_comp_def inj_on_def) metis\n\n have jointly_surj_edges: \\(\\e\\E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>i\\<^sub>1\\<^esub>\\<^sub>E e = x) \\ (\\e\\E\\<^bsub>pb.A\\<^esub>. \\<^bsub>pb.c\\<^esub>\\<^sub>E e = x)\\\n if \\x \\ E\\<^bsub>D\\<^sub>2\\<^esub>\\ for x\n using that c\\<^sub>2.inj_edges p\\<^sub>2.po1.g.morph_edge_range pb.reduced_chain_condition_edges\n \"6+5.joint_surjectivity_edges\" p\\<^sub>1.po1.joint_surjectivity_edges i\\<^sub>1.morph_edge_range\n by (auto simp add: morph_comp_def inj_on_def) metis\n\n interpret six: pushout_diagram \"interf r\\<^sub>1\" pb.A \"lhs r\\<^sub>1\" D\\<^sub>2 j\\<^sub>1 b\\<^sub>1 pb.c i\\<^sub>1\n using po_characterization[OF j\\<^sub>1.injective_morphism_axioms p\\<^sub>1.r.k.injective_morphism_axioms\n ink_l.injective_morphism_axioms i\\<^sub>1.injective_morphism_axioms\n \\\\v. v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\\n sixpb.reduced_chain_condition_nodes sixpb.reduced_chain_condition_edges\n jointly_surj_nodes jointly_surj_edges]\n by blast\n\n interpret morphism \"interf r\\<^sub>2\" D\\<^sub>2 \"pb.c \\\\<^sub>\\ j\\<^sub>2\"\n using wf_morph_comp[OF j\\<^sub>2.morphism_axioms pb.c.morphism_axioms]\n by assumption\n\n interpret morphism \"lhs r\\<^sub>2\" G \"c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\"\n proof\n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e \\ E\\<^bsub>G\\<^esub>\\ if \\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for e\n using that i\\<^sub>2.morph_edge_range p\\<^sub>1.po1.g.morph_edge_range\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v \\ V\\<^bsub>G\\<^esub>\\ if \\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for v\n using that i\\<^sub>2.morph_node_range p\\<^sub>1.po1.g.morph_node_range\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V (s\\<^bsub>lhs r\\<^sub>2\\<^esub> e) = s\\<^bsub>G\\<^esub> (\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for e\n using that i\\<^sub>2.morph_edge_range i\\<^sub>2.source_preserve p\\<^sub>1.po1.g.source_preserve\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V (t\\<^bsub>lhs r\\<^sub>2\\<^esub> e) = t\\<^bsub>G\\<^esub> (\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for e\n using that i\\<^sub>2.morph_edge_range i\\<^sub>2.target_preserve p\\<^sub>1.po1.g.target_preserve\n by (simp add: morph_comp_def)\n next\n show \\l\\<^bsub>lhs r\\<^sub>2\\<^esub> v = l\\<^bsub>G\\<^esub> (\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v)\\ if \\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for v\n using that i\\<^sub>2.label_preserve i\\<^sub>2.morph_node_range p\\<^sub>1.po1.g.label_preserve\n by (simp add: morph_comp_def)\n next\n show \\m\\<^bsub>lhs r\\<^sub>2\\<^esub> e = m\\<^bsub>G\\<^esub> (\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for e\n using that i\\<^sub>2.mark_preserve i\\<^sub>2.morph_edge_range p\\<^sub>1.po1.g.mark_preserve\n by (simp add: morph_comp_def)\n qed\n\n \n\n \n \n interpret \"7+5\": pushout_diagram \"interf r\\<^sub>2\" D\\<^sub>2 \"lhs r\\<^sub>2\" G \"pb.c \\\\<^sub>\\ j\\<^sub>2\" b\\<^sub>2 c\\<^sub>2 \"c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\"\n proof\n show \\\\<^bsub>c\\<^sub>2 \\\\<^sub>\\ (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for v\n using that p\\<^sub>2.po1.node_commutativity p\\<^sub>2.r.k.morph_node_range\n \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ \n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>c\\<^sub>2 \\\\<^sub>\\ (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for e\n using that p\\<^sub>2.po1.edge_commutativity p\\<^sub>2.r.k.morph_edge_range\n \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\ \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e= \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\ \n by (simp add: morph_comp_def)\n next\n show \\Ex1M\n (\\xa. morphism (to_ngraph G) D' xa \\\n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e))\n (to_ngraph G)\\\n if \\graph D'\\\n \\morphism (to_ngraph D\\<^sub>2) D' x\\\n \\morphism (to_ngraph (lhs r\\<^sub>2)) D' y\\\n \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>2\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>2\\<^esub>\\<^sub>E e\\\n for D' :: \"('g,'h) ngraph\" and x y\n proof -\n\n have \\\\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for v\n using that \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ \n by (simp add: morph_comp_def)\n\n have \\\\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>\\ for v\n using that \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ \n by (simp add: morph_comp_def)\n\n have a: \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x \\\\<^sub>\\ to_nmorph m\\<^sub>2\\<^esub>\\<^sub>V v\\\n using \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\\n \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def) \n\n have b: \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>y \\\\<^sub>\\ to_nmorph b\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x \\\\<^sub>\\ to_nmorph m\\<^sub>2\\<^esub>\\<^sub>E e\\\n using \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\ \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def) \n\n obtain u where \\morphism (to_ngraph G) D' u\\\n and aa1: \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n and aa2: \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using p\\<^sub>2.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>2)) D' y\\ \\morphism (to_ngraph D\\<^sub>2) D' x\\ a b]\n by fast\n\n(* used for technical reasons within the upcoming proof *)\n have n: \\morphism (to_ngraph G) D' u \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ \n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using \\morphism (to_ngraph G) D' u\\ aa1(1) aa1(2) aa2(1) aa2(2) by force\n\n show ?thesis\n proof (rule_tac x = u in exI, safe)\n show \\morphism (to_ngraph G) D' u\\\n using \\morphism (to_ngraph G) D' u\\ by assumption\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ if \\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>\\ for e\n using \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ that \n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ if \\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>\\ for v\n using aa1(1) \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ that\n by (auto simp add: to_nmorph_def morph_comp_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\ if \\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>\\ for e\n using aa1(2) \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\ that\n by (auto simp add: to_nmorph_def morph_comp_def to_ngraph_def)\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>E e = \\<^bsub>u\\<^esub>\\<^sub>E e\\\n if \\morphism (to_ngraph G) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\ e \\ E\\<^bsub>to_ngraph G\\<^esub>\\\n for ya e\n proof -\n have m:\\morphism (to_ngraph G) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using that\n proof (intro conjI)\n show \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n qed assumption\n\n show ?thesis\n using ex_eq[OF p\\<^sub>2.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>2)) D' y\\ \\morphism (to_ngraph D\\<^sub>2) D' x\\ a b], OF n m] that\n by simp\n qed\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>V v = \\<^bsub>u\\<^esub>\\<^sub>V v\\\n if \\morphism (to_ngraph G) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2)\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\v \\ V\\<^bsub>to_ngraph G\\<^esub>\\\n for ya v\n proof -\n have m:\\morphism (to_ngraph G) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph c\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e)\\\n using that\n proof (intro conjI)\n show \\\\v\\V\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v \\ V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>V v\\ that\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (lhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph g\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that \\\\e \\ E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>g\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n qed assumption\n\n show ?thesis\n using ex_eq[OF p\\<^sub>2.po1.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (lhs r\\<^sub>2)) D' y\\ \\morphism (to_ngraph D\\<^sub>2) D' x\\ a b], OF n m] that\n by simp\n qed\n qed\n qed\n qed\n\n\n have a: \\\\<^bsub>c\\<^sub>2 \\\\<^sub>\\ pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for v\n using \"7+5.node_commutativity\" that\n by (simp add: morph_comp_def)\n\n have b: \\\\<^bsub>c\\<^sub>2 \\\\<^sub>\\ pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for e\n using \"7+5.edge_commutativity\" that\n by (simp add: morph_comp_def)\n\n\n(* Experimental *)\n\n(* TODO: proof *)\n interpret \"7+5pb\": pullback_diagram \"interf r\\<^sub>2\" D\\<^sub>2 \"lhs r\\<^sub>2\" G \"pb.c \\\\<^sub>\\ j\\<^sub>2\" b\\<^sub>2 c\\<^sub>2 \"c\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\"\n using \"7+5.flip_diagram\" \"7+5.pushout_pullback_inj_b\" c\\<^sub>1.injective_morphism_axioms i\\<^sub>2.injective_morphism_axioms inj_comp_inj p\\<^sub>2.r.k.injective_morphism_axioms pushout_diagram.b_f_inj_imp_c_inj by blast\n\n(* TODO Proof *)\n interpret sevenpb: pullback_diagram \"interf r\\<^sub>2\" pb.A \"lhs r\\<^sub>2\" D\\<^sub>1 j\\<^sub>2 b\\<^sub>2 pb.b i\\<^sub>2\n using pullback_decomposition[OF _ _ pb.pb.flip_diagram \"7+5pb.pullback_diagram_axioms\"]\n using i\\<^sub>2.morphism_axioms j2c(1) j2c(2) j\\<^sub>2.morphism_axioms by blast\n\n have jointly_surj_nodes: \\(\\v\\V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>i\\<^sub>2\\<^esub>\\<^sub>V v = x) \\ (\\v\\V\\<^bsub>pb.A\\<^esub>. \\<^bsub>pb.b\\<^esub>\\<^sub>V v = x)\\\n if \\x \\ V\\<^bsub>D\\<^sub>1\\<^esub>\\ for x\n using that pb.reduced_chain_condition_nodes i\\<^sub>2.inj_nodes inj_k.inj_nodes \n p\\<^sub>2.po1.joint_surjectivity_nodes \"7+5.joint_surjectivity_nodes\"\n c\\<^sub>1.inj_nodes i\\<^sub>2.morph_node_range inj_on_def p\\<^sub>1.po1.g.morph_node_range\n apply (auto simp add: morph_comp_def inj_on_def)\n by metis\n\n\n have jointly_surj_edges: \\(\\e\\E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>i\\<^sub>2\\<^esub>\\<^sub>E e = x) \\ (\\e\\E\\<^bsub>pb.A\\<^esub>. \\<^bsub>pb.b\\<^esub>\\<^sub>E e = x)\\\n if \\x \\ E\\<^bsub>D\\<^sub>1\\<^esub>\\ for x\n using that pb.reduced_chain_condition_edges i\\<^sub>2.inj_edges inj_k.inj_edges\n p\\<^sub>2.po1.joint_surjectivity_edges \"7+5.joint_surjectivity_edges\"\n c\\<^sub>1.inj_edges i\\<^sub>2.morph_edge_range inj_on_def p\\<^sub>1.po1.g.morph_edge_range\n apply (auto simp add: morph_comp_def inj_on_def)\n by metis\n\n\n(* pushout_diagram (interf r\\<^sub>2) pb.A (lhs r\\<^sub>2) D\\<^sub>1 j\\<^sub>2 b\\<^sub>2 pb.b i\\<^sub>2 *)\n interpret seven: pushout_diagram \"interf r\\<^sub>2\" \"lhs r\\<^sub>2\" pb.A D\\<^sub>1 b\\<^sub>2 j\\<^sub>2 i\\<^sub>2 pb.b\n using po_characterization[OF j\\<^sub>2.injective_morphism_axioms p\\<^sub>2.r.k.injective_morphism_axioms\ninj_k.injective_morphism_axioms i\\<^sub>2.injective_morphism_axioms\nj2c\nsevenpb.reduced_chain_condition_nodes sevenpb.reduced_chain_condition_edges\njointly_surj_nodes jointly_surj_edges]\n using pushout_diagram.flip_diagram by blast\n\n\n interpret acht: gluing \"interf r\\<^sub>1\" pb.A \"rhs r\\<^sub>1\" j\\<^sub>1 b\\<^sub>1' ..\n\n interpret neun: gluing \"interf r\\<^sub>2\" pb.A \"rhs r\\<^sub>2\" j\\<^sub>2 b\\<^sub>2' ..\n\n interpret ten: gluing pb.A neun.H acht.H neun.c acht.c ..\n\n interpret h1b: morphism pb.A H\\<^sub>1 \"h\\<^sub>1 \\\\<^sub>\\ pb.b\"\n using wf_morph_comp[OF pb.b.morphism_axioms p\\<^sub>1.po2.g.morphism_axioms]\n by assumption\n\n\n(* aaa and bbb belong to s\\<^sub>1 *)\n have aaa: \\\\v\\V\\<^bsub>interf r\\<^sub>1\\<^esub>. \\<^bsub>f\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1'\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v\\\n using p\\<^sub>1.po2.node_commutativity a \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def) \n \n have bbb: \\\\e\\E\\<^bsub>interf r\\<^sub>1\\<^esub>. \\<^bsub>f\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1'\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e\\\n using p\\<^sub>1.po2.edge_commutativity b \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def) \n\n obtain s\\<^sub>1 where\n \\morphism acht.H H\\<^sub>1 s\\<^sub>1\\ and\n \\\\v. v \\ V\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.c\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.c\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b\\<^esub>\\<^sub>E e\\\n(* and (2) = (8) + (11) *)\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n using acht.po.universal_property_exist_gen[OF p\\<^sub>1.po2.f.H.graph_axioms\n p\\<^sub>1.po2.f.morphism_axioms\n wf_morph_comp[OF pb.b.morphism_axioms p\\<^sub>1.po2.g.morphism_axioms] aaa bbb]\n by auto\n\n interpret s\\<^sub>1: morphism acht.H H\\<^sub>1 s\\<^sub>1\n using \\morphism acht.H H\\<^sub>1 s\\<^sub>1\\ by assumption\n\n interpret morphism \"rhs r\\<^sub>1\" H\\<^sub>1 \"s\\<^sub>1 \\\\<^sub>\\ acht.h\"\n proof\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e \\ E\\<^bsub>H\\<^sub>1\\<^esub>\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for e\n using that \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n p\\<^sub>1.po2.f.morph_edge_range\n by simp\n next\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v \\ V\\<^bsub>H\\<^sub>1\\<^esub>\\ if \\v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for v\n using that \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n p\\<^sub>1.po2.f.morph_node_range\n by simp\n next\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V (s\\<^bsub>rhs r\\<^sub>1\\<^esub> e) = s\\<^bsub>H\\<^sub>1\\<^esub> (\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for e\n using that p\\<^sub>1.r.r.H.source_integrity p\\<^sub>1.po2.f.source_preserve\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\ p\\<^sub>1.r.r.H.source_integrity \n by simp\n next\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V (t\\<^bsub>rhs r\\<^sub>1\\<^esub> e) = t\\<^bsub>H\\<^sub>1\\<^esub> (\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for e\n using that p\\<^sub>1.r.r.H.target_integrity p\\<^sub>1.po2.f.target_preserve\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\ p\\<^sub>1.r.r.H.target_integrity \n by simp\n next\n show \\l\\<^bsub>rhs r\\<^sub>1\\<^esub> v = l\\<^bsub>H\\<^sub>1\\<^esub> (\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v)\\ if \\v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for v\n using that p\\<^sub>1.po2.f.label_preserve\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by simp\n next\n show \\ m\\<^bsub>rhs r\\<^sub>1\\<^esub> e = m\\<^bsub>H\\<^sub>1\\<^esub> (\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub>\\ for e\n using that p\\<^sub>1.po2.f.mark_preserve\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by simp\n qed\n\n\n\n interpret \"8+11\": pushout_diagram \"interf r\\<^sub>1\" \"rhs r\\<^sub>1\" D\\<^sub>1 H\\<^sub>1 b\\<^sub>1' \"pb.b \\\\<^sub>\\ j\\<^sub>1\" \\s\\<^sub>1 \\\\<^sub>\\ acht.h\\ h\\<^sub>1\n proof\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h \\\\<^sub>\\ b\\<^sub>1'\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for v\n using that aaa\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\ p\\<^sub>1.r.r.morph_node_range\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h \\\\<^sub>\\ b\\<^sub>1'\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>interf r\\<^sub>1\\<^esub>\\ for e\n using that bbb\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\ p\\<^sub>1.r.r.morph_edge_range\n by (simp add: morph_comp_def)\n next\n show \\Ex1M\n (\\xa. morphism (to_ngraph H\\<^sub>1) D' xa \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\\n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e))\n (to_ngraph H\\<^sub>1)\\ \n if \\graph D'\\\n \\morphism (to_ngraph (rhs r\\<^sub>1)) D' x\\\n \\morphism (to_ngraph D\\<^sub>1) D' y\\\n \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>E e\\\n for D' :: \"('g,'h) ngraph\" and x y\n proof -\n have a: \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph m\\<^sub>1\\<^esub>\\<^sub>V v\\\n using \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>V v\\ \n \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n\n have b:\\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph m\\<^sub>1\\<^esub>\\<^sub>E e\\\n using \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.b \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>1\\<^esub>\\<^sub>E e\\ \n \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>1)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>1'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.b \\\\<^sub>\\ j\\<^sub>1)\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n \n obtain u where \\morphism (to_ngraph H\\<^sub>1) D' u\\\n and u1: \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n and u2: \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using p\\<^sub>1.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>1)) D' x\\ \\morphism (to_ngraph D\\<^sub>1) D' y\\ a b]\n by fast\n\n have m: \\morphism (to_ngraph H\\<^sub>1) D' u \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ \n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ \n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n using u1 u2 \\morphism (to_ngraph H\\<^sub>1) D' u\\\n by fastforce\n\n show ?thesis\n proof (rule_tac x = u in exI, safe)\n show \\morphism (to_ngraph H\\<^sub>1) D' u\\\n using \\morphism (to_ngraph H\\<^sub>1) D' u\\ by assumption\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>\\ for e\n using that \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>\\ for e\n using that \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n by simp\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>E e = \\<^bsub>u\\<^esub>\\<^sub>E e\\\n if \\morphism (to_ngraph H\\<^sub>1) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\e \\ E\\<^bsub>to_ngraph H\\<^sub>1\\<^esub>\\ for ya e\n proof -\n have n: \\morphism (to_ngraph H\\<^sub>1) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n proof (intro conjI)\n show \\morphism (to_ngraph H\\<^sub>1) D' ya\\\n using \\ morphism (to_ngraph H\\<^sub>1) D' ya\\ by assumption\n next\n show \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n using that \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using that \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ by assumption\n next\n show \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that(5) by assumption\n qed\n\n show ?thesis\n using that ex_eq[OF p\\<^sub>1.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>1)) D' x\\ \\morphism (to_ngraph D\\<^sub>1) D' y\\ a b] n m]\n by blast\n qed\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>V v = \\<^bsub>u\\<^esub>\\<^sub>V v\\\n if \\morphism (to_ngraph H\\<^sub>1) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>1 \\\\<^sub>\\ acht.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\v \\ V\\<^bsub>to_ngraph H\\<^sub>1\\<^esub>\\ for ya v\n proof -\n have n: \\morphism (to_ngraph H\\<^sub>1) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n proof (intro conjI)\n show \\morphism (to_ngraph H\\<^sub>1) D' ya\\\n using \\ morphism (to_ngraph H\\<^sub>1) D' ya\\ by assumption\n next\n show \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n using that \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using that \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>1)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (fastforce simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ by assumption\n next\n show \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>1\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using that(5) by blast\n qed\n\n show ?thesis\n using that ex_eq[OF p\\<^sub>1.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>1)) D' x\\ \\morphism (to_ngraph D\\<^sub>1) D' y\\ a b] n m]\n by blast\n qed\n qed\n qed\n qed\n\n\n\n interpret eleven: pushout_diagram pb.A D\\<^sub>1 acht.H H\\<^sub>1 pb.b acht.c h\\<^sub>1 s\\<^sub>1\n using pushout_decomposition[OF pb.b.morphism_axioms s\\<^sub>1.morphism_axioms acht.po.flip_diagram \"8+11.flip_diagram\"]\n \\\\e. e \\ E\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.c\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b\\<^esub>\\<^sub>E e\\ \\\\v. v \\ V\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.c\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ pb.b\\<^esub>\\<^sub>V v\\\n by simp\n\n\n(* start of s\\<^sub>2 *)\n\n have aaa2: \\\\v\\V\\<^bsub>interf r\\<^sub>2\\<^esub>. \\<^bsub>f\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2'\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v\\\n using p\\<^sub>2.po2.node_commutativity \\\\v. v\\V\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>V v = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>V v\\\n \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\ \n by (simp add: morph_comp_def) \n\n have bbb2: \\\\e\\E\\<^bsub>interf r\\<^sub>2\\<^esub>. \\<^bsub>f\\<^sub>2 \\\\<^sub>\\ b\\<^sub>2'\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e\\\n using p\\<^sub>2.po2.edge_commutativity \\\\e. e\\E\\<^bsub>interf r\\<^sub>1\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>1\\<^esub>\\<^sub>E e = \\<^bsub>i\\<^sub>1 \\\\<^sub>\\ b\\<^sub>1\\<^esub>\\<^sub>E e\\\n \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\ \n by (simp add: morph_comp_def)\n\n\n obtain s\\<^sub>2 where\n \\morphism neun.H H\\<^sub>2 s\\<^sub>2\\ and\n \\\\v. v \\ V\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.c\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.c\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c\\<^esub>\\<^sub>E e\\\n(* (4) = (9)+(12) *)\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n using neun.po.universal_property_exist_gen[OF p\\<^sub>2.po2.f.H.graph_axioms\n p\\<^sub>2.po2.f.morphism_axioms\n wf_morph_comp[OF pb.c.morphism_axioms p\\<^sub>2.po2.g.morphism_axioms] aaa2 bbb2]\n by fast \n\n interpret s\\<^sub>2: morphism neun.H H\\<^sub>2 s\\<^sub>2\n using \\morphism neun.H H\\<^sub>2 s\\<^sub>2\\ by assumption\n\n interpret morphism \"rhs r\\<^sub>2\" H\\<^sub>2 \"s\\<^sub>2 \\\\<^sub>\\ neun.h\"\n proof\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e \\ E\\<^bsub>H\\<^sub>2\\<^esub>\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for e\n using that \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\ p\\<^sub>2.po2.f.morph_edge_range\n by simp\n next\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v \\ V\\<^bsub>H\\<^sub>2\\<^esub>\\ if \\v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for v\n using that \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\ p\\<^sub>2.po2.f.morph_node_range \n by simp\n next\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V (s\\<^bsub>rhs r\\<^sub>2\\<^esub> e) = s\\<^bsub>H\\<^sub>2\\<^esub> (\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for e\n using that\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n p\\<^sub>2.po2.f.source_preserve p\\<^sub>2.r.r.H.source_integrity\n by simp\n next\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V (t\\<^bsub>rhs r\\<^sub>2\\<^esub> e) = t\\<^bsub>H\\<^sub>2\\<^esub> (\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for e\n using that \n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n p\\<^sub>2.po2.f.target_preserve p\\<^sub>2.r.r.H.target_integrity\n by simp\n next\n show \\l\\<^bsub>rhs r\\<^sub>2\\<^esub> v = l\\<^bsub>H\\<^sub>2\\<^esub> (\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v)\\ if \\v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for v\n using that \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n p\\<^sub>2.po2.f.label_preserve\n by simp\n next\n show \\m\\<^bsub>rhs r\\<^sub>2\\<^esub> e = m\\<^bsub>H\\<^sub>2\\<^esub> (\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e)\\ if \\e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub>\\ for e\n using that \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n p\\<^sub>2.po2.f.mark_preserve\n by simp\n qed\n\n\n interpret \"9+12\": pushout_diagram \"interf r\\<^sub>2\" \"rhs r\\<^sub>2\" D\\<^sub>2 H\\<^sub>2 b\\<^sub>2' \"pb.c \\\\<^sub>\\ j\\<^sub>2\" \"s\\<^sub>2 \\\\<^sub>\\ neun.h\" h\\<^sub>2\n proof\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h \\\\<^sub>\\ b\\<^sub>2'\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>V v\\\n if \\v \\ V\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for v\n using that p\\<^sub>2.po2.node_commutativity aaa2 p\\<^sub>2.r.r.morph_node_range\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def)\n next\n show \\\\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h \\\\<^sub>\\ b\\<^sub>2'\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>E e\\ \n if \\e \\ E\\<^bsub>interf r\\<^sub>2\\<^esub>\\ for e\n using that p\\<^sub>2.po2.edge_commutativity bbb2 p\\<^sub>2.r.r.morph_edge_range\n \\\\e. e\\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def)\n next\n show \\Ex1M\n (\\xa. morphism (to_ngraph H\\<^sub>2) D' xa \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>xa \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e))\n (to_ngraph H\\<^sub>2)\\\n if \\graph D'\\\n \\morphism (to_ngraph (rhs r\\<^sub>2)) D' x\\\n \\morphism (to_ngraph D\\<^sub>2) D' y\\\n \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>E e\\\n for D' :: \"('g,'h) ngraph\" and x y\n proof -\n\n have a: \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph m\\<^sub>2\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>V v = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>V v\\\n \\\\v. v\\V\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n\n have b: \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph m\\<^sub>2\\<^esub>\\<^sub>E e\\\n using \\\\e\\E\\<^bsub>to_ngraph (interf r\\<^sub>2)\\<^esub>. \\<^bsub>x \\\\<^sub>\\ to_nmorph b\\<^sub>2'\\<^esub>\\<^sub>E e = \\<^bsub>y \\\\<^sub>\\ to_nmorph (pb.c \\\\<^sub>\\ j\\<^sub>2)\\<^esub>\\<^sub>E e\\\n \\\\e. e\\E\\<^bsub>interf r\\<^sub>2\\<^esub> \\ \\<^bsub>pb.c \\\\<^sub>\\ j\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>m\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n\n \n \n obtain u where \\morphism (to_ngraph H\\<^sub>2) D' u\\\n and u1: \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ \n and u2: \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using p\\<^sub>2.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>2)) D' x\\ \\morphism (to_ngraph D\\<^sub>2) D' y\\ a b]\n by fast\n\n(* technical reasons *)\n have m: \\morphism (to_ngraph H\\<^sub>2) D' u \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\ \n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ \n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ \n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n using u1 u2 \\morphism (to_ngraph H\\<^sub>2) D' u\\\n by fastforce\n\n show ?thesis\n proof (rule_tac x = u in exI, safe)\n show \\morphism (to_ngraph H\\<^sub>2) D' u\\\n using \\morphism (to_ngraph H\\<^sub>2) D' u\\ by assumption\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n by (auto simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>\\ for e\n using that \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (auto simp add: morph_comp_def to_nmorph_def to_ngraph_def)\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\ if \\v \\ V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>\\ for v\n using that \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n by simp\n next\n show \\\\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\ if \\e \\ E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>\\ for e\n using that \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n by simp\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>E e = \\<^bsub>u\\<^esub>\\<^sub>E e\\\n if \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\e \\ E\\<^bsub>to_ngraph H\\<^sub>2\\<^esub>\\\n for ya e\n proof -\n \n have n: \\morphism (to_ngraph H\\<^sub>2) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ \n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ \n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n proof (intro conjI)\n show \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n using \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n by assumption\n next\n show \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n by assumption\n next\n show \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n by assumption\n qed\n\n show ?thesis\n using that ex_eq[OF p\\<^sub>2.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>2)) D' x\\ \\morphism (to_ngraph D\\<^sub>2) D' y\\ a b] n m]\n by fast\n qed\n next\n show \\\\<^bsub>ya\\<^esub>\\<^sub>V v = \\<^bsub>u\\<^esub>\\<^sub>V v\\\n if \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n \\v \\ V\\<^bsub>to_ngraph H\\<^sub>2\\<^esub>\\\n for ya v\n proof -\n \n have n: \\morphism (to_ngraph H\\<^sub>2) D' ya \\\n (\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v) \\\n (\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e) \\ \n (\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v) \\ \n (\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e)\\\n proof (intro conjI)\n show \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n using \\morphism (to_ngraph H\\<^sub>2) D' ya\\\n by assumption\n next\n show \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v\\V\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>V v = \\<^bsub>x\\<^esub>\\<^sub>V v\\\n \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n using \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>u \\\\<^sub>\\ to_nmorph f\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e\\E\\<^bsub>to_ngraph (rhs r\\<^sub>2)\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph (s\\<^sub>2 \\\\<^sub>\\ neun.h)\\<^esub>\\<^sub>E e = \\<^bsub>x\\<^esub>\\<^sub>E e\\\n \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\\n by (simp add: morph_comp_def to_ngraph_def to_nmorph_def)\n next\n show \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n using \\\\v\\V\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>y\\<^esub>\\<^sub>V v\\\n by assumption\n next\n show \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n using \\\\e\\E\\<^bsub>to_ngraph D\\<^sub>2\\<^esub>. \\<^bsub>ya \\\\<^sub>\\ to_nmorph h\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>y\\<^esub>\\<^sub>E e\\\n by assumption\n qed\n\n show ?thesis\n using that ex_eq[OF p\\<^sub>2.po2.universal_property[OF \\graph D'\\ \\morphism (to_ngraph (rhs r\\<^sub>2)) D' x\\ \\morphism (to_ngraph D\\<^sub>2) D' y\\ a b] n m]\n by fast\n qed\n qed\n qed\n qed\n\n\n interpret twelve: pushout_diagram pb.A D\\<^sub>2 neun.H H\\<^sub>2 pb.c neun.c h\\<^sub>2 s\\<^sub>2\n using pushout_decomposition[OF pb.c.morphism_axioms s\\<^sub>2.morphism_axioms neun.po.flip_diagram \"9+12.flip_diagram\"]\n \\\\e. e \\ E\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.c\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c\\<^esub>\\<^sub>E e\\ \\\\v. v \\ V\\<^bsub>pb.A\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.c\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ pb.c\\<^esub>\\<^sub>V v\\\n by simp\n\n(* one side *)\n interpret \"7+11\": pushout_diagram \"interf r\\<^sub>2\" acht.H \"lhs r\\<^sub>2\" H\\<^sub>1 \"acht.c \\\\<^sub>\\ j\\<^sub>2\" b\\<^sub>2 s\\<^sub>1 \"h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\"\n using pushout_composition[OF seven.flip_diagram eleven.flip_diagram ] by assumption\n\n interpret \"9+10\": pushout_diagram \"interf r\\<^sub>2\" acht.H \"rhs r\\<^sub>2\" ten.H \"acht.c \\\\<^sub>\\ j\\<^sub>2\" b\\<^sub>2' ten.h \"ten.c \\\\<^sub>\\ neun.h\"\n using pushout_composition[OF neun.po.flip_diagram ten.po.pushout_diagram_axioms] by assumption\n\n(* flipped ones are needed for the sequential independence *)\n interpret pushout_diagram \"interf r\\<^sub>2\" \"lhs r\\<^sub>2\" acht.H H\\<^sub>1 b\\<^sub>2 \"acht.c \\\\<^sub>\\ j\\<^sub>2\" \"h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\" s\\<^sub>1\n using \"7+11.flip_diagram\" by assumption\n\n interpret pushout_diagram \"interf r\\<^sub>2\" \"rhs r\\<^sub>2\" acht.H ten.H b\\<^sub>2' \"acht.c \\\\<^sub>\\ j\\<^sub>2\" \"ten.c \\\\<^sub>\\ neun.h\" ten.h\n using \"9+10.flip_diagram\" by assumption\n\n(* show second direct derivation *)\n interpret injective_morphism \"lhs r\\<^sub>2\" H\\<^sub>1 \"h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\"\n using inj_comp_inj[OF i\\<^sub>2.injective_morphism_axioms h\\<^sub>1.injective_morphism_axioms]\n by assumption\n\n interpret direct_derivation r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' H\\<^sub>1 \"h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\" acht.H \"acht.c \\\\<^sub>\\ j\\<^sub>2\" s\\<^sub>1 ten.H \"ten.c \\\\<^sub>\\ neun.h\" ten.h\n ..\n\n(* first seq. indep. *)\n interpret p3: sequential_independence r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' G g\\<^sub>1 D\\<^sub>1 m\\<^sub>1 c\\<^sub>1 H\\<^sub>1 f\\<^sub>1 h\\<^sub>1 r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' \"h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\" acht.H \"acht.c \\\\<^sub>\\ j\\<^sub>2\" s\\<^sub>1 ten.H \"ten.c \\\\<^sub>\\ neun.h\" ten.h\n proof\n show \\\\i. morphism (rhs r\\<^sub>1) acht.H i \\\n (\\v\\V\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ i\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ i\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e)\\\n proof (rule_tac x = acht.h in exI, intro conjI)\n show \\morphism (rhs r\\<^sub>1) acht.H acht.h\\\n using acht.inc_h.morphism_axioms by assumption\n next\n show \\\\v\\V\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\\n by (simp add: \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>V v\\)\n next\n show \\\\e\\E\\<^bsub>rhs r\\<^sub>1\\<^esub>. \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\\n by (simp add: \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>1\\<^esub> \\ \\<^bsub>s\\<^sub>1 \\\\<^sub>\\ acht.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>1\\<^esub>\\<^sub>E e\\)\n qed\n next\n show \\\\j. morphism (lhs r\\<^sub>2) D\\<^sub>1 j \\\n (\\v\\V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ j\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e)\\\n proof (rule_tac x = i\\<^sub>2 in exI, intro conjI)\n show \\morphism (lhs r\\<^sub>2) D\\<^sub>1 i\\<^sub>2\\\n using i\\<^sub>2.morphism_axioms by assumption\n next\n show \\\\v\\V\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>V v\\\n by simp\n next\n show \\\\e\\E\\<^bsub>lhs r\\<^sub>2\\<^esub>. \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>1 \\\\<^sub>\\ i\\<^sub>2\\<^esub>\\<^sub>E e\\\n by simp\n qed\n qed\n\n\n\n\n interpret \"6+12\": pushout_diagram \"interf r\\<^sub>1\" neun.H \"lhs r\\<^sub>1\" H\\<^sub>2 \"neun.c \\\\<^sub>\\ j\\<^sub>1\" b\\<^sub>1 s\\<^sub>2 \"h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\"\n using pushout_composition[OF six.pushout_diagram_axioms twelve.flip_diagram ] by assumption\n \n interpret pushout_diagram \"interf r\\<^sub>1\" \"lhs r\\<^sub>1\" neun.H H\\<^sub>2 b\\<^sub>1 \"neun.c \\\\<^sub>\\ j\\<^sub>1\" \"h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\" s\\<^sub>2\n using \"6+12.flip_diagram\" by assumption\n\n interpret \"8+10\": pushout_diagram \"interf r\\<^sub>1\" neun.H \"rhs r\\<^sub>1\" ten.H \"neun.c \\\\<^sub>\\ j\\<^sub>1\" b\\<^sub>1' ten.c \"ten.h \\\\<^sub>\\ acht.h\"\n using pushout_composition[OF acht.po.flip_diagram ten.po.flip_diagram] by assumption\n\n thm \"8+10.flip_diagram\"\n interpret pushout_diagram \"interf r\\<^sub>1\" \"rhs r\\<^sub>1\" neun.H ten.H b\\<^sub>1' \"neun.c \\\\<^sub>\\ j\\<^sub>1\" \"ten.h \\\\<^sub>\\ acht.h\" ten.c\n using \"8+10.flip_diagram\" by assumption\n\n interpret injective_morphism \"lhs r\\<^sub>1\" H\\<^sub>2 \"h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\"\n using inj_comp_inj[OF i\\<^sub>1.injective_morphism_axioms h\\<^sub>2.injective_morphism_axioms]\n by assumption\n\n interpret direct_derivation r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' H\\<^sub>2 \"h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\" neun.H \"neun.c \\\\<^sub>\\ j\\<^sub>1\" s\\<^sub>2 ten.H \"ten.h \\\\<^sub>\\ acht.h\" ten.c\n ..\n\n interpret p4: sequential_independence r\\<^sub>2 b\\<^sub>2 b\\<^sub>2' G g\\<^sub>2 D\\<^sub>2 m\\<^sub>2 c\\<^sub>2 H\\<^sub>2 f\\<^sub>2 h\\<^sub>2 r\\<^sub>1 b\\<^sub>1 b\\<^sub>1' \"h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\" neun.H \"neun.c \\\\<^sub>\\ j\\<^sub>1\" s\\<^sub>2 ten.H \"ten.h \\\\<^sub>\\ acht.h\" ten.c \n proof\n show \\\\i. morphism (rhs r\\<^sub>2) neun.H i \\\n (\\v\\V\\<^bsub>rhs r\\<^sub>2\\<^esub>. \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>rhs r\\<^sub>2\\<^esub>. \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ i\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e)\\\n using \\\\e. e \\ E\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>E e = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>E e\\ \\\\v. v \\ V\\<^bsub>rhs r\\<^sub>2\\<^esub> \\ \\<^bsub>s\\<^sub>2 \\\\<^sub>\\ neun.h\\<^esub>\\<^sub>V v = \\<^bsub>f\\<^sub>2\\<^esub>\\<^sub>V v\\ neun.inc_h.morphism_axioms by blast\n next\n show \\\\j. morphism (lhs r\\<^sub>1) D\\<^sub>2 j \\\n (\\v\\V\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ j\\<^esub>\\<^sub>V v = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>V v) \\ (\\e\\E\\<^bsub>lhs r\\<^sub>1\\<^esub>. \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ j\\<^esub>\\<^sub>E e = \\<^bsub>h\\<^sub>2 \\\\<^sub>\\ i\\<^sub>1\\<^esub>\\<^sub>E e)\\\n using i\\<^sub>1.morphism_axioms by blast\n qed\n\n show ?thesis\n using p3.sequential_independence_axioms p4.sequential_independence_axioms\n by fast\nqed\n\nend", "meta": {"author": "UoYCS-plasma", "repo": "DPO-Formalisation", "sha": "0bc86b77a3f2d8ca85b4a7d0de877dc19aa05c46", "save_path": "github-repos/isabelle/UoYCS-plasma-DPO-Formalisation", "path": "github-repos/isabelle/UoYCS-plasma-DPO-Formalisation/DPO-Formalisation-0bc86b77a3f2d8ca85b4a7d0de877dc19aa05c46/LocalChurchRosser.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2660492152990641}} {"text": "(* KEEP IT SIMPLE AND STUPID *)\n\ntheory NuPrime \\ \\The Primary Theory of the \\-System\\\n imports Main \"HOL-Library.Adhoc_Overloading\" NuHelpMath\nbegin\n\ntext \\The fundamental theory for \\-system\\\n\nsection Preliminary\n\n\nnamed_theorems \\elim \"\\-type elimination rules\"\nnamed_theorems \\def \\primitive definitions used to unfold in proofs of primitive instructions.\\\n (* and \\address_def \\primitive definitions for unfolding in proofs for address\\ *)\n and \\post_construct and \\auto_destruct\nnamed_theorems typing_expn \"expansion theorems for abstractions\" and lrep_exps and nu_exps\n\nsection\\Low representation for semantics\\\n\nsubsection \\Memory Pointer\\\n\ndatatype msegment = Null (*address space*) nat | MSegment nat\ntype_synonym addr_space = nat\n \\ \\Address space is a notion of the LLVM. The space 0 is the main memory of the device.\n Space other than 0 is specified depending on platform, which may represent addresses on remote devices like display card\\\n\ndatatype 'offset memaddr = memaddr (segment_of: msegment) (offset_of: 'offset ) (infixl \"|+\" 60)\ndeclare memaddr.sel[iff]\n\nabbreviation shift_addr :: \" 'a::plus memaddr \\ 'a \\ 'a memaddr\" (infixl \"||+\" 60)\n where \"shift_addr addr delta \\ map_memaddr (\\x. x + delta) addr\"\nlemma memaddr_forall[lrep_exps]: \"All P \\ (\\base ofs. P (base |+ ofs))\" by (metis memaddr.exhaust)\nlemma memaddr_exists[lrep_exps]: \"Ex P \\ (\\base ofs. P (base |+ ofs))\" by (metis memaddr.exhaust)\n\n\n\n(* subsection \\Function table & Function pointer\\\n\ntypedef fun_addr = \"UNIV :: nat set\" .. *)\n\nsubsection \\Deep Value Model\\\n\ndatatype \"value\" = DM_int nat nat | DM_pointer \"nat memaddr\" | DM_fusion \"value\" \"value\"\n | DM_record \"value\" | DM_array \"value list\" | (* DM_fun_addr fun_addr | *) DM_void\n\nsubsection \\Memory & Heap\\\n\ndatatype resource_key = MemAddress \"nat memaddr\" | ChainDB_key nat\n\nlemma resource_key_forall: \"All P \\ (\\addr. P (MemAddress addr)) \\ (\\n. P (ChainDB_key n))\" by (metis resource_key.exhaust)\nlemma resource_key_exists: \"Ex P \\ (\\addr. P (MemAddress addr)) \\ (\\n. P (ChainDB_key n))\" by (metis resource_key.exhaust)\n\ntype_synonym heap = \"resource_key \\ value\"\n\nsubsection \\State Model\\\n\ndatatype 'a state = Success (dest_state: \"heap \\ 'a\") | Fail | PartialCorrect\ntext\\ The basic state of the \\-system virtual machine is represented by type \"('a::lrep) state\"}.\n The valid state `Success` essentially has two major form, one without registers and another one with them,\n \\<^item> \"StatOn (x1, x2, \\, xn, void)\",\n where \"(x1, x2, \\, xn, void)\" represents the stack in the state, with @{term x\\<^sub>i} as the i-th element on the stack.\n The @{term STrap} is trapped state due to invalid operations like zero division.\n The negative state @{term PartialCorrect} represents the admissible error situation that is not considered in partial correctness.\n For example, @{term PartialCorrect} may represents an admissible crash, and in that case the partial correctness certifies that\n ``if the program exits normally, the output would be correct''.\\\n\ndeclare state.split[split]\n\ntype_synonym ('a,'b) proc = \" (heap \\ 'a) \\ 'b state\" (infix \"\\\" 0)\n\n(* consts fun_table :: \" fun_addr \\ 'a \\ 'b \"\nconsts fun_addr_NULL :: fun_addr\n\nspecification (fun_table)\n fun_addr_NULL: \"fun_table fun_addr_NULL = None\" by auto *)\n\n\ndefinition AvailableSegments :: \"heap \\ msegment set\"\n where \"AvailableSegments heap = {seg. \\ofs. heap (MemAddress (seg |+ ofs)) = None}\"\n\ndefinition Heap :: \"heap \\ bool\" where \"Heap h \\ infinite (AvailableSegments h)\"\n\nlemma [intro]: \"Heap h \\ Heap (h(k := v))\" proof -\n have \"AvailableSegments h \\ {(case k of MemAddress (seg |+ ofs) \\ seg)} \\ (AvailableSegments (h(k := v)))\"\n unfolding AvailableSegments_def by auto \n then show \"Heap h \\ Heap (h(k := v))\" \n unfolding Heap_def using infinite_super by auto\nqed\n\nlemma Heap_subset: \"h' \\\\<^sub>m h \\ Heap h \\ Heap h' \"\n unfolding Heap_def subgoal premises prems proof -\n have \"AvailableSegments h \\ AvailableSegments h'\"\n unfolding AvailableSegments_def using prems(1)\n by (smt (verit, best) Collect_mono domIff map_le_def)\n then show ?thesis using prems(2) using finite_subset by blast\nqed done\n\nlemma Heap_map_add: \"Heap (h1 ++ h2) \\ Heap h2\"\n using Heap_subset map_le_map_add by blast\n\nlemma Heap_restrict[intro]: \"Heap h \\ Heap (h |` S)\"\n by (metis domIff map_le_def restrict_map_def Heap_subset)\n\n\ntext \\The semantic framework follows a style of shallow embedding, where semantics for different type (e.g. integers, floats)\n are modelled by different Isabelle type. Model types are constrained by the base type class {\\it lrep} and types representing\n objects that supports certain features are constrained by specific sub-classes which extend the base class {\\it lrep} finally. \\\n\ndatatype llty = llty_int nat \\ \\int bits\\ | llty_pointer | llty_tup llty | llty_array llty nat | llty_nil | llty_fusion llty llty | Lty_fun_addr\n\nclass lrep = \\\\The basic class for types modelling concrete objects\\\n fixes llty :: \" 'a itself \\ llty \"\n fixes deepize :: \" 'a \\ value \"\n fixes shallowize :: \" value \\ 'a \"\n assumes deepize_inj[simp]: \" shallowize (deepize x) = x \"\n\nlemma [simp]: \"shallowize o deepize = id\" by fastforce\n\nlemma deepize_inj2[simp]: \"deepize a = deepize b \\ a = b\"\n using deepize_inj by metis\n\nabbreviation \"map_deepmodel f x \\ deepize (f (shallowize x))\"\n\nsyntax \"_LLTY_\" :: \"type \\ logic\" (\"LLTY'(_')\")\ntranslations \"LLTY('x)\" == \"CONST llty TYPE('x)\"\n\nclass ceq = \\ \\equality comparison\\\n fixes ceqable :: \" heap \\ 'a \\ 'a \\ bool\"\n \\ \\Whether two values could be compared for equality. e.g. two INF cannot be compared; the dangling pointer also cannot\\\n fixes ceq :: \" 'a \\ 'a \\ bool\" \\ \\The equality of two values.\n It is only valid when the two values could be compared, i.e., the @{term ceqable} for them is true.\\\n assumes ceqable_sym[simp]: \"ceqable h x y = ceqable h y x\"\n assumes ceq_refl[intro]: \"ceqable h x x \\ ceq x x\"\n assumes ceq_sym[simp]: \"ceqable h x y \\ ceq x y \\ ceq y x\"\n assumes ceq_trans: \"ceqable h x y \\ ceqable h y z \\ ceqable h x z\n \\ ceq x y \\ ceq y z \\ ceq x z\"\n\n\nsubsection \\The \\-type\\\n\ntype_synonym ('a,'b) \\ = \" 'b \\ 'a set \"\n\nsubsubsection \\Definitions\\\n\ndatatype ('a,'b) typing = typing (typing_img: 'b ) (typing_nu: \"('a,'b) \\\") (\"_ \\ _\" [18,18] 17) \\\\shortcut keys \"\"\\\nprimrec nu_of :: \"('a,'b) typing \\ ('a,'b) \\\" where \"nu_of (x \\ N) = N\"\nprimrec image_of :: \"('a,'b) typing \\ 'b\" where \"image_of (x \\ N) = x\"\n\ndefinition RepSet :: \"('a,'b) typing \\ 'a set\" (\"\\ _ \\\" [10] ) where \"\\ ty \\ = (case ty of (x \\ N) \\ N x)\"\ndefinition Refining :: \"'a \\ ('a,'b) \\ \\ 'b \\ bool\" (\"(_/ \\ _ \\/ _)\" [27,15,27] 26) \\\\shortcut keys \"--<\" and \">--\"\\\n where \"(p \\ N \\ x) \\ p \\ N x\"\ndefinition Inhabited :: \" 'a set \\ bool\" where \"Inhabited S = (\\p. p \\ S)\"\nabbreviation InhabitNu :: \" 'b \\ ('a,'b) \\ \\ bool\" (\"_ \\ _\" [18,18] 17) \\\\shortcut keys \":TY:\"\\\n where \" (x \\ T) \\ Inhabited \\x \\ T\\\"\ntext \\The @{term \"x \\ N\"} is a predication specifying concrete values,\n e.g. @{prop \" a_concrete_int32 \\ \\(42::nat) \\ N 32\\\"} and also \"state \\ State (\\42 \\ N\\ \\ \\24 \\ N\\ \\ \\ )\".\n It constitutes basic elements in specification.\n The @{prop \"p \\ N \\ x\"} as the abbreviation of $p \\ (x \\ N)$ is an abstraction between concrete value @{term p} and\n abstracted {\\it image} @{term x} via the \\-{\\it abstractor} @{term N} which defines the abstraction relationship itself.\n The next @{prop \" x \\ N\"} is a proposition stating @{term x} is an image of abstractor @{term N} and therefore\n the \\-type @{term \"x \\ N\"} is inhabited. Basically it is used to derive implicated conditions of images,\n e.g. @{prop \"( 42 \\ N 32) \\ 42 < 2^32\"}\\\n\nlemma [simp]: \"p \\ \\x \\ T\\ \\ p \\ T \\ x\" unfolding RepSet_def Refining_def by simp\nlemma typing_inhabited: \"p \\ T \\ x \\ x \\ T\" unfolding Refining_def Inhabited_def RepSet_def by simp blast\n\n\nsubsubsection \\Properties\\\n\ndefinition \\Zero :: \"('a::{zero,lrep},'b) \\ \\ 'b \\ bool\"\n where [\\def]: \"\\Zero N x \\ (0 \\ N \\ x )\"\n\ndefinition \\Equal :: \"('a::{lrep,ceq}, 'b) \\ \\ ('b \\ 'b \\ bool) \\ ('b \\ 'b \\ bool) \\ bool\"\n where [\\def]: \"\\Equal N can_eq eq \\ (\\p1 p2 x1 x2 heap.\n can_eq x1 x2 \\ (p1 \\ N \\ x1) \\ (p2 \\ N \\ x2) \\ ceqable heap p1 p2 \\ (ceq p1 p2 = eq x1 x2))\"\n\n\nsection\\Structures for construction\\\n\nsubsection \\Stack structure\\\n\ninstantiation prod :: (lrep,lrep) lrep begin\ndefinition llty_prod :: \"('a \\ 'b) itself \\ llty\" where \"llty_prod _ = llty_fusion LLTY('a) LLTY('b)\"\ndefinition deepize_prod :: \" 'a \\ 'b \\ value \" where\n \"deepize_prod = (\\(a,b). DM_fusion (deepize a) (deepize b))\"\ndefinition shallowize_prod :: \"value \\ 'a \\ 'b\" where\n \"shallowize_prod x = (case x of DM_fusion a b \\ (shallowize a, shallowize b))\"\ninstance apply standard\n subgoal for x by (cases x) (auto simp add: shallowize_prod_def deepize_prod_def) done\nend\n\n\nprimrec is_stack :: \"value \\ bool\" where\n \"is_stack (DM_fusion a b) \\ is_stack b\"\n| \"is_stack DM_void \\ True\"\n| \"is_stack (DM_int _ _) \\ False\"\n| \"is_stack (DM_pointer _) \\ False\"\n| \"is_stack (DM_record _) \\ False\"\n| \"is_stack (DM_array _) \\ False\"\n(* | \"is_stack (DM_fun_addr _) \\ False\" *)\n\ntypedef stack = \"UNIV :: value list set\"\n morphisms values_of stack ..\n\nsetup_lifting type_definition_stack\n\ndeclare values_of_inverse[simp] values_of_inject[simp]\nlemmas stack_inverse[simp] = stack_inverse[simplified]\nlemmas stack_inject[simp] = stack_inject[simplified]\n\nhide_fact stack.stack_inject stack.stack_inverse\n\nabbreviation stack_cat (infixr \"@\\<^sub>s\\<^sub>k\" 65) where \"(a @\\<^sub>s\\<^sub>k b) \\ stack (values_of a @ values_of b)\"\nabbreviation stack_cons (infixr \"#\\<^sub>s\\<^sub>k\" 65) where \"(a #\\<^sub>s\\<^sub>k b) \\ stack (a # values_of b)\"\n\nlemma [simp]:\n \"values_of a = values_of b @ values_of c \\ a = b @\\<^sub>s\\<^sub>k c\"\n by (metis stack_inverse values_of_inverse)\n\n\nclass stack = lrep +\n fixes stack_deepize :: \" 'a \\ stack \"\n fixes stack_shallowize :: \" stack \\ 'a \"\n(* assumes stack_is_stack[simp]: \"is_stack (deepize x)\" *)\n assumes stack_deepize_inj[simp]: \"stack_shallowize (stack_deepize k) = k\"\n\ntext \\The \\<^class>\\stack\\ is an artificial constraint.\n Though \\<^class>\\stack\\ is identical to \\<^class>\\lrep\\ in logic, most of types e.g. word, are only\n instantiated to \\<^class>\\lrep\\ but no \\<^class>\\stack\\ deliberately, and only prod and void are\n instantiated to stack by the instantiation (lrep,stack) :: stack and void::stack.\n By this deliberate constraints, once a type of class stack, it must a recursive pair\n ending with void.\\\n\n\nlemma stack_deepize_inj[simp]:\n \"stack_deepize k1 = stack_deepize k2 \\ k1 = k2\"\n by (metis stack_deepize_inj)\n \ninstantiation prod :: (lrep,stack) stack begin\nprimrec stack_deepize_prod :: \" 'a \\ 'b \\ stack \"\n where \"stack_deepize_prod (a,b) = deepize a #\\<^sub>s\\<^sub>k stack_deepize b\"\ndefinition stack_shallowize_prod :: \" stack \\ 'a \\ 'b \"\n where [simp]: \"stack_shallowize_prod s = (case values_of s of (a#b) \\ (shallowize a, stack_shallowize (stack b)))\"\ninstance by standard (simp_all add: pair_All)\nend\n\ninstantiation \"stack\" :: stack begin\n\nprimrec value_to_list :: \"value \\ value list\" where\n \"value_to_list DM_void = []\" | \"value_to_list (DM_fusion x l) = x # (value_to_list l)\"\nprimrec list_to_value :: \"value list \\ value\" where\n \"list_to_value [] = DM_void\" | \"list_to_value (x # l) = DM_fusion x (list_to_value l)\"\nlemma stack_bij_list:\n \"value_to_list (list_to_value l) = l\"\n by (induct l) simp_all\n\ndefinition deepize_stack :: \" stack \\ value \" where [simp]: \"deepize_stack s = list_to_value (values_of s)\"\ndefinition shallowize_stack :: \" value \\ stack \" where [simp]: \"shallowize_stack v = stack (value_to_list v)\"\ndefinition stack_deepize_stack :: \" stack \\ stack \" where [simp]: \"stack_deepize_stack x = x\"\ndefinition stack_shallowize_stack :: \" stack \\ stack \" where [simp]: \"stack_shallowize_stack x = x\"\ninstance by standard (simp_all add: stack_bij_list)\nend\n\n\nsubsection \\The \\-System VM and Procedure construction structures\\\n\ntype_synonym assn = \"(heap \\ stack) set\" \\ \\assertion\\\n\nsubsubsection \\Types specifying states\\\n\ndefinition StrictStateTy :: \" (heap \\ 'a::lrep) set \\ 'a state set\" (\"!\\ _\" [56] 55)\n where \"!\\ T = {s. case s of Success x \\ x \\ T | Fail \\ False | PartialCorrect \\ False}\"\ndefinition LooseStateTy :: \" (heap \\ 'a::lrep) set \\ 'a state set\" (\"\\ _\" [56] 55)\n where \"\\ T = {s. case s of Success x \\ x \\ T | Fail \\ False | PartialCorrect \\ True}\"\n\nlemma StrictStateTy_expn[iff,\\def]: \"Success x \\ !\\ T \\ x \\ T\" \"\\ (Fail \\ !\\ T)\" \"\\ (PartialCorrect \\ !\\ T)\"\n and LooseStateTy_expn[iff,\\def]: \"Success x \\ \\ T \\ x \\ T\" \"\\ (Fail \\ \\ T)\" \"(PartialCorrect \\ \\ T)\"\n by (simp_all add: StrictStateTy_def LooseStateTy_def)\nlemma LooseStateTy_expn' : \"x \\ \\ T \\ x = PartialCorrect \\ (\\x'. x = Success x' \\ x' \\ T)\"\n by (cases x) simp_all\n\nlemma StrictStateTy_elim[elim]: \"s \\ !\\ T \\ (\\x. s = Success x \\ x \\ T \\ C) \\ C\" by (cases s) auto\nlemma StrictStateTy_intro[intro]: \" x \\ T \\ Success x \\ !\\ T\" by simp\nlemma LooseStateTy_E[elim]:\n \"s \\ \\ T \\ (\\x. s = Success x \\ x \\ T \\ C) \\ (s = PartialCorrect \\ C) \\ C\" by (cases s) auto\nlemma LooseStateTy_I[intro]:\n \" x \\ T \\ Success x \\ \\ T\" and [intro]: \"PartialCorrect \\ \\ T\" by simp_all\nlemma LooseStateTy_upgrade: \"s \\ \\ T \\ s \\ PartialCorrect \\ s \\ !\\ T\" by (cases s) auto\nlemma StrictStateTy_degrade: \"s \\ !\\ T \\ s \\ \\ T\" by (cases s) auto\nlemma LooseStateTy_introByStrict: \"(s \\ PartialCorrect \\ s \\ !\\ T) \\ s \\ \\ T\" by (cases s) auto\n\nsubsubsection \\Shallow model and Deep model\\\n\ndefinition Deepize :: \" 'a::lrep set \\ value set \" where \"Deepize S = deepize ` S\"\ndefinition Shallowize :: \" value set \\ 'a::lrep set \" where \"Shallowize S = { p. deepize p \\ S}\"\n\nlemma Shallowize_Deepize[simp]: \"Shallowize (Deepize S) = S \"\n unfolding Deepize_def Shallowize_def by (simp add: image_iff set_eq_iff)\n\ndefinition Deepize' :: \" (heap \\ 'a::stack) set \\ assn \" where \"Deepize' S = apsnd stack_deepize ` S\"\ndefinition Shallowize' :: \" assn \\ (heap \\ 'a::stack) set \" where \"Shallowize' S = {(h,s). (h,stack_deepize s) \\ S}\"\n\nlemma Deepize'_expn: \"(h, s) \\ Deepize' M \\ (\\s'. stack_deepize s' = s \\ (h, s') \\ M)\"\n unfolding Deepize'_def image_iff Bex_def by auto\n\nlemma Shallowize'_expn[nu_exps]:\n \"(h, s) \\ Shallowize' M \\ (h, stack_deepize s) \\ M\"\n unfolding Shallowize'_def by simp\n\nlemma Shallowize'_Deepize'[simp]: \"Shallowize' (Deepize' S) = S \"\n unfolding Deepize'_def Shallowize'_def by (simp add: image_iff pair_exists Bex_def set_eq_iff)\n\nlemma Deepize'_Deepize'[simp]: \"Deepize' S = S\" for S :: \"assn\"\n unfolding set_eq_iff pair_forall Deepize'_expn by simp\n\nlemma Deepize'_inj[simp]:\n \"Deepize' A = Deepize' B \\ A = B\"\n unfolding set_eq_iff Deepize'_expn pair_forall by force\n\nsubsubsection \\Stack Element and Heap Object\\\n\nconsts Ele :: \" 'a set \\ assn \" (\"ELE _\" [17] 16)\ntranslations \"ELE x \\ T\" \\ \"ELE \\x \\ T\\\"\n\ndefinition Val_Ele :: \" 'a::lrep set \\ assn \" (\"VAL _\" [17] 16) where\n \"(VAL T) = { (Map.empty, stack [v]) | v. v \\ deepize ` T } \"\n\nadhoc_overloading Ele Val_Ele\ntranslations \"VAL x \\ T\" => \"VAL \\x \\ T\\\"\n\nlemma [nu_exps]:\n \"(h,s) \\ (VAL V) \\ h = Map.empty \\ (\\v. s = stack [deepize v] \\ v \\ V)\"\n unfolding Val_Ele_def by simp blast\n\nlemma [elim!,\\elim]: \"Inhabited (VAL T) \\ (Inhabited T \\ C) \\ C\"\n unfolding Inhabited_def by (simp add: pair_exists nu_exps)\n\n\ndefinition Obj_Ele :: \" heap set \\ assn \" (\"OBJ _\" [17] 16) where\n \"(OBJ T) = { (h, stack []) | h. h \\ T } \"\n\nadhoc_overloading Ele Obj_Ele\ntranslations \"OBJ x \\ T\" => \"OBJ \\x \\ T\\\"\n\nlemma [nu_exps]: \"(h, s) \\ (OBJ T) \\ s = stack [] \\ h \\ T\"\n unfolding Obj_Ele_def by simp\n\nlemma [nu_exps]: \"(h, s) \\ Shallowize' (OBJ T) \\ s = stack [] \\ h \\ T\"\n unfolding Obj_Ele_def Shallowize'_expn by simp\n\nlemma [elim!,\\elim]: \"Inhabited (OBJ T) \\ (Inhabited T \\ C) \\ C\"\n unfolding Inhabited_def by (simp add: pair_exists nu_exps)\n\n\nsubsubsection \\Separation\\\n\ndefinition disjoint :: \" 'a set \\ 'a set \\ bool \" (infixl \"\\\" 60) where \"disjoint A B \\ (A \\ B = {})\"\nlemma disjoint_rewL: \"A \\ B \\ (\\x. x \\ A \\ x \\ B)\" unfolding disjoint_def by auto\nlemma disjoint_rewR: \"A \\ B \\ (\\x. x \\ B \\ x \\ A)\" unfolding disjoint_def by auto\nlemma [elim]: \"A \\ B \\ ((\\x. x \\ A \\ x \\ B \\ False) \\ C) \\ C\" unfolding disjoint_def by auto\n\nlemma disjoint_empty [iff]: \"{} \\ S\" \"S \\ {}\" unfolding disjoint_def by auto\n\ndefinition Separation :: \"assn \\ assn \\ assn\" ( \"_/ \\ _\" [13,14] 13)\n where \"(T \\ U) = {(h,s). (\\h1 h2 s1 s2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ s = s1 @\\<^sub>s\\<^sub>k s2 \\ (h2,s2) \\ T \\ (h1,s1) \\ U) }\"\n\ntranslations\n \"x \\ T \\ U\" \\ \"CONST Ele \\x \\ T\\ \\ U\"\n \"T \\ y \\ U\" \\ \"T \\ CONST Ele \\y \\ U\\\"\n\nlemma Separation_expn:\n \"(h,s) \\ (T \\ U) \\ (\\h1 h2 s1 s2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ s = s1 @\\<^sub>s\\<^sub>k s2 \\ (h2,s2) \\ T \\ (h1,s1) \\ U)\"\n unfolding Separation_def by simp\n\nlemma Separation_expn_R:\n \"(h,s) \\ (T \\ U) \\ (\\h1 h2 s1 s2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ s = s1 @\\<^sub>s\\<^sub>k s2 \\ (h1,s2) \\ T \\ (h2,s1) \\ U)\"\n unfolding Separation_def\n by simp (metis disjoint_def disjoint_rewR map_add_comm) \n\nlemma Separation_expn_V[nu_exps]:\n \"(h, stack (deepize v # r)) \\ (R \\ VAL V) \\ ((h, stack r) \\ R \\ v \\ V )\"\n unfolding Separation_def Shallowize'_expn\n by (simp add: nu_exps) force\n\nlemma Separation_expn_V':\n \"(h, s) \\ (R \\ VAL V) \\ (\\v r. s = stack (deepize v # r) \\ (h, stack r) \\ R \\ v \\ V )\"\n unfolding Separation_def Shallowize'_expn\n by (simp add: nu_exps) force\n\nlemma Separation_expn_O[nu_exps]:\n \"(h,s) \\ (R \\ OBJ H) \\\n (\\h1 h2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ (h2,s) \\ Shallowize' R \\ h1 \\ H )\"\n unfolding Separation_def Shallowize'_expn\n by (simp add: nu_exps)\n\nlemma Separation_expn_O_R:\n \"(h,s) \\ (R \\ OBJ H) \\\n (\\h1 h2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ (h1,s) \\ Shallowize' R \\ h2 \\ H )\"\n unfolding Separation_def Shallowize'_expn\n by (simp add: nu_exps) (metis disjoint_def disjoint_rewR map_add_comm)\n\nlemma [elim!,\\elim]: \"Inhabited (T \\ U) \\ (Inhabited T \\ Inhabited U \\ C) \\ C\"\n unfolding Inhabited_def by (simp add: pair_exists nu_exps Separation_expn) blast\n\n\nlemma Separation_assoc[simp]: \"(A \\ (B \\ C)) = (A \\ B \\ C)\"\n unfolding Separation_def set_eq_iff pair_forall\n apply auto subgoal for h2 s2 h1a h2a s1a s2a\n apply (rule exI [where x = \"h1a\"], rule exI [where x = \"h2a ++ h2\"],\n simp add: disjoint_def inf_sup_distrib1 inf_sup_distrib2)\n apply (rule exI [of _ s1a], rule exI [of _ \"s2a @\\<^sub>s\\<^sub>k s2\"], simp)\n apply blast done\n subgoal for h1 s1 h1a h2a s1a s2a\n apply (rule exI [where x = \"h1 ++ h1a\"], rule exI [where x = \"h2a\"],\n simp add: disjoint_def inf_sup_distrib1 inf_sup_distrib2)\n apply (rule exI [of _ \"s1 @\\<^sub>s\\<^sub>k s1a\"], simp, blast)\n done\n done\n\nlemma Separation_comm:\n \" (OBJ A \\ B) = (B \\ OBJ A) \"\n \" (A' \\ OBJ B') = (OBJ B' \\ A') \"\n unfolding Separation_def set_eq_iff pair_forall\n by (simp_all add: disjoint_def nu_exps) (blast dest: map_add_comm)+\n\nlemma shallowize_ex: \"(\\x::('c::lrep). P x) \\ (\\x. P (shallowize x))\"\n using deepize_inj by metis\nlemma shallowize_ex': \"TERM TYPE('c) \\ (\\x::('c::lrep). P x) \\ (\\x. P (shallowize x))\"\n using shallowize_ex .\n\nlemma shallowize_all: \"(\\x::('c::lrep). P x) \\ (\\x. P (shallowize x))\"\n using deepize_inj by metis\nlemma shallowize_all': \"TERM TYPE('c) \\ (\\x::('c::lrep). P x) \\ (\\x. P (shallowize x))\"\n using shallowize_all .\n\n\nlemma Separation_E[elim]:\n \"(h,s) \\ (T \\ U) \\ (\\h1 h2 s1 s2. h = h1 ++ h2 \\ dom h1 \\ dom h2 \\ s = s1 @\\<^sub>s\\<^sub>k s2\n \\ (h2,s2) \\ T \\ (h1,s1) \\ U \\ C) \\ C \"\n unfolding Separation_expn by simp blast\n\nlemma Separation_I[intro]:\n \"(h2,s2) \\ T \\ (h1,s1) \\ U \\ dom h1 \\ dom h2 \\ s = s1 @\\<^sub>s\\<^sub>k s2 \\ (h1 ++ h2, s) \\ (T \\ U)\"\n unfolding Separation_expn by simp blast\n\nsubsubsection \\Set style Heap predication\\\n\ndefinition Heap' :: \"(heap \\ 's::stack) set \\ (heap \\ 's::stack) set\"\n where \"Heap' T = {(h,s). Heap h \\ (h,s) \\ T}\"\n\nlemma Heap'_expn[simp,\\def]: \"(h,s) \\ Heap' T \\ Heap h \\ (h,s) \\ T\"\n unfolding Heap'_def by simp\n\nsubsubsection \\\\-Procedure\\\n\ntext \\An assertion identical to Hoare triple, in the language of \\-type. \n \\<^const>\\Heap'\\ and \\<^const>\\Shallowize'\\ are auxiliary usage.\\\n\ndefinition Procedure :: \"('c::stack \\ 'd::stack) \\ assn \\ assn \\ bool\" (\"(2\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c _/ \\(2 _/ \\ _ )\\)\" [101,2,2] 100)\n where [\\def]:\"Procedure f T U \\\n (\\a M::assn. a \\ Heap' (Shallowize' (M \\ T)) \\ f a \\ \\ Heap' (Shallowize' (M \\ U)))\"\n\n\ntranslations\n \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ a \\ A \\ B \\\" \\ \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ CONST Ele \\ a \\ A \\ \\ B \\\"\n \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ A \\ b \\ B \\\" \\ \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ A \\ CONST Ele \\ b \\ B \\ \\\"\n\ndefinition Map :: \" 'a set \\ 'b set \\ ('a \\ 'b) set \" where \"Map A B = {f. \\a. a \\ A \\ f a \\ B }\"\ndefinition Map' :: \"('a \\ 'b) \\ 'a set \\ 'b set \\ bool\" (\"(2\\<^bold>m\\<^bold>a\\<^bold>p _/ \\(2 _/ \\ _ )\\)\" [101,2,2] 100)\n where [\\def]: \"\\<^bold>m\\<^bold>a\\<^bold>p f \\ T \\ U \\ \\ \\a. a \\ T \\ f a \\ U\"\n\n\nsubsection \\Primitive operations and instructions required in the system\\\n\nsubsubsection \\Elementary instructions\\\n\ndefinition bind :: \" ('a::lrep) state \\ ( 'a \\ 'b) \\ ('b::lrep) state \" \\\\monadic bind\\\n where \"bind s f = (case s of Success x \\ f x | Fail \\ Fail | PartialCorrect \\ PartialCorrect)\"\ndefinition instr_comp :: \"(('a::lrep) \\ ('b::lrep)) \\ ( 'b \\ ('c::lrep)) \\ 'a \\ 'c\" (\"_ \\/ _\" [75,76] 75) \n where \"instr_comp f g s = bind (f s) g\"\ndefinition nop :: \" ('a::lrep) \\ 'a\" where \"nop = Success\" \\\\the instruction `no-operation`\\\n\nlemma nop_\\app: \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c nop \\ T \\ T \\\" unfolding nop_def Procedure_def by auto\nlemma instr_comp[intro]: \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ A \\ B \\ \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c g \\ B \\ C \\ \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c (f \\ g) \\ A \\ C \\\"\n unfolding instr_comp_def Procedure_def bind_def by (auto 0 4)\n\n\nsubsection \\Top-level Construction Structures\\\n\nsubsubsection \\Construction Context & Code block\\\n\ndefinition CurrentConstruction :: \" ('a::stack) state \\ assn \\ assn \\ bool \"\n (\"\\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t _ [_] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n/ _\" [1000,1000,11] 10)\n where \"CurrentConstruction s R S \\ s \\ !\\ Heap' (Shallowize' (R \\ S))\"\ndefinition PendingConstruction :: \" (('a::stack) \\ ('b::stack)) \\ 'a state \\ assn \\ assn \\ bool \"\n (\"\\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g _ \\<^bold>o\\<^bold>n _ [_] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n/ _\" [1000,1000,1000,5] 4)\n where \"PendingConstruction f s R S \\ bind s f \\ \\ Heap' (Shallowize' (R \\ S))\"\ntranslations\n \"\\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t blk [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n (x \\ T)\" \\ \"\\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t blk [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n CONST Ele \\ x \\ T \\\"\n \"CONST PendingConstruction f s H (x \\ T)\" \\ \"CONST PendingConstruction f s H (CONST Ele \\ x \\ T\\)\"\n\nlemma CurrentConstruction_D: \"CurrentConstruction s H T \\ Inhabited T\"\n unfolding CurrentConstruction_def Inhabited_def by (cases s) (auto 0 4 simp add: Shallowize'_expn)\n\n\ndefinition CodeBlock :: \" ('a::lrep) state \\ ('b::lrep) state => ('b \\ 'a) \\ bool\" where\n CodeBlock_def: \"CodeBlock stat arg prog \\ (bind arg prog = stat \\ stat \\ PartialCorrect)\"\nsyntax \"_codeblock_exp_\" :: \"idt \\ logic \\ logic \\ bool\" (\"(2\\<^bold>c\\<^bold>o\\<^bold>d\\<^bold>e\\<^bold>b\\<^bold>l\\<^bold>o\\<^bold>c\\<^bold>k _/ \\<^bold>a\\<^bold>s '\\_'\\/ \\<^bold>f\\<^bold>o\\<^bold>r \\<^bold>a\\<^bold>r\\<^bold>g\\<^bold>u\\<^bold>m\\<^bold>e\\<^bold>n\\<^bold>t\\<^bold>s '\\_'\\)\" [100,0,0] 3)\nsyntax \"_codeblock_\" :: \"idt \\ logic \\ bool\" (\"\\<^bold>c\\<^bold>o\\<^bold>d\\<^bold>e\\<^bold>b\\<^bold>l\\<^bold>o\\<^bold>c\\<^bold>k _ \\<^bold>f\\<^bold>o\\<^bold>r \\<^bold>a\\<^bold>r\\<^bold>g\\<^bold>u\\<^bold>m\\<^bold>e\\<^bold>n\\<^bold>t\\<^bold>s '\\_'\\\" [100,0] 3)\n\n\nsection \\Rules for the construction\\\n\nlemma frame: \"\\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ A \\ B \\ \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ M \\ A \\ M \\ B \\\"\n unfolding Procedure_def by simp\n\nlemma apply_proc: \"(\\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t blk [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n S) \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ S \\ T \\ \\ (\\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g f \\<^bold>o\\<^bold>n blk [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T)\"\n unfolding Procedure_def CurrentConstruction_def PendingConstruction_def bind_def by (auto 0 5)\n\nlemma accept_proc: \"\\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g f \\<^bold>o\\<^bold>n s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T \\ CodeBlock s' s f \\ \\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t s' [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T\"\n for s' :: \"('b::stack) state\"\n unfolding CurrentConstruction_def PendingConstruction_def CodeBlock_def\n by (simp add: LooseStateTy_upgrade)\n\nlemma reassemble_proc_0:\n \"\\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T \\ \\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g nop \\<^bold>o\\<^bold>n s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T\"\n unfolding CurrentConstruction_def PendingConstruction_def CodeBlock_def nop_def bind_def by (cases s) simp+\n\nlemma reassemble_proc:\n \"(\\s'. CodeBlock s' s f \\ \\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g g \\<^bold>o\\<^bold>n s' [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T) \\ \\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g (f \\ g) \\<^bold>o\\<^bold>n s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T\"\n unfolding CurrentConstruction_def PendingConstruction_def CodeBlock_def bind_def instr_comp_def\n by force\n\nlemma reassemble_proc_final:\n \"(\\s H. \\<^bold>c\\<^bold>u\\<^bold>r\\<^bold>r\\<^bold>e\\<^bold>n\\<^bold>t s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n S \\ \\<^bold>p\\<^bold>e\\<^bold>n\\<^bold>d\\<^bold>i\\<^bold>n\\<^bold>g g \\<^bold>o\\<^bold>n s [H] \\<^bold>r\\<^bold>e\\<^bold>s\\<^bold>u\\<^bold>l\\<^bold>t\\<^bold>s \\<^bold>i\\<^bold>n T) \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c g \\ S \\ T \\\"\n unfolding CurrentConstruction_def PendingConstruction_def Procedure_def bind_def pair_All\n by (metis StrictStateTy_intro state.simps(8))\n\nlemma rename_proc: \"f \\ f' \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f' \\ U \\ \\ \\ \\ \\<^bold>p\\<^bold>r\\<^bold>o\\<^bold>c f \\ U \\ \\ \\\" by fast\n\nend\n", "meta": {"author": "nusystem", "repo": "nu-system", "sha": "148c5a354ad8780cc4da9b91e1291414c91b2eda", "save_path": "github-repos/isabelle/nusystem-nu-system", "path": "github-repos/isabelle/nusystem-nu-system/nu-system-148c5a354ad8780cc4da9b91e1291414c91b2eda/NuPrime.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105587468141, "lm_q2_score": 0.3998116407397951, "lm_q1q2_score": 0.26603888725814756}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weaken_Bisimulation\n imports Weaken_Simulation Weaken_Stat_Imp\nbegin\n\ncontext weak\nbegin\n\nlemma weakenMonoCoinduct: \"\\x y xa xb xc P Q \\.\n x \\ y \\\n (\\ \\ Q \\\\<^sub>w<{(xc, xb, xa). x xc xb xa}> P) \\\n (\\ \\ Q \\\\<^sub>w<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakenSimMonotonic)\nby(auto dest: le_funE)\n\nlemma weakenMonoCoinduct2: \"\\x y xa xb xc P Q \\.\n x \\ y \\\n (\\ \\ Q \\\\<^sub>w<{(xc, xb, xa). x xc xb xa}> P) \\\n (\\ \\ Q \\\\<^sub>w<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakenStatImpMonotonic)\nby(auto dest: le_funE)\n\ncoinductive_set weakenBisim :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\" \nwhere\n step: \"\\\\ \\ P \\\\<^sub>w Q; \\ \\ P \\\\<^sub>w Q;\n \\\\'. (\\ \\ \\', P, Q) \\ weakenBisim; (\\, Q, P) \\ weakenBisim\\ \\ (\\, P, Q) \\ weakenBisim\"\nmonos weakenMonoCoinduct weakenMonoCoinduct2\n\nabbreviation\n weakenBisimJudge (\"_ \\ _ \\\\<^sub>w _\" [70, 70, 70] 65) where \"\\ \\ P \\\\<^sub>w Q \\ (\\, P, Q) \\ weakenBisim\"\nabbreviation\n weakenBisimNilJudge (\"_ \\\\<^sub>w _\" [70, 70] 65) where \"P \\\\<^sub>w Q \\ \\ \\ P \\\\<^sub>w Q\"\n\nlemma weakenBisimCoinductAux[consumes 1]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\ \\ P \\\\<^sub>w<(X \\ weakenBisim)> Q) \\\n (\\ \\ P \\\\<^sub>w<(X \\ weakenBisim)> Q) \\\n (\\\\'. (\\ \\ \\', P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ weakenBisim) \\\n ((\\, Q, P) \\ X \\ (\\, Q, P) \\ weakenBisim)\"\n\n shows \"(\\, P, Q) \\ weakenBisim\"\nproof -\n have \"X \\ weakenBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakenBisim}\" by auto\n with assms show ?thesis\n by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakenBisimCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ \\' \\ R \\\\<^sub>w<(X \\ weakenBisim)> S\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ \\' \\ R \\\\<^sub>w<(X \\ weakenBisim)> S\"\n and \"\\\\' R S \\''. (\\', R, S) \\ X \\ (\\' \\ \\'', R, S) \\ X \\ \\' \\ \\'' \\ R \\\\<^sub>w S\"\n and \"\\\\' R S. (\\', R, S) \\ X \\ (\\', S, R) \\ X \\ \\' \\ S \\\\<^sub>w R\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nproof -\n have \"X \\ weakenBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakenBisim}\" by auto\n with assms show ?thesis\n by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakenBisimWeakCoinductAux[consumes 1]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w Q \\\n \\ \\ P \\\\<^sub>w Q \\ (\\\\'. (\\ \\ \\', P, Q) \\ X) \\ \n (\\, Q, P) \\ X\" \n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nusing assms\nby(coinduct rule: weakenBisimCoinductAux) (blast intro: weakenSimMonotonic weakenStatImpMonotonic)\n\nlemma weakenBisimE:\n fixes P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\ :: 'b\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sub>w Q\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\n and \"\\ \\ P \\\\<^sub>w Q\"\n and \"\\ \\ \\' \\ P \\\\<^sub>w Q\"\n and \"\\ \\ Q \\\\<^sub>w P\"\nusing assms\nby(auto intro: weakenBisim.cases simp add: rtrancl_def)\n\nlemma weakenBisimWeakCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w Q\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w Q\"\n and \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X\"\n and \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X\"\n\n shows \"(\\, P, Q) \\ weakenBisim\"\nproof -\n have \"X \\ weakenBisim = {(\\, P, Q). (\\, P, Q) \\ X \\ (\\, P, Q) \\ weakenBisim}\" by auto\n with assms show ?thesis\n by(coinduct rule: weakenBisimWeakCoinductAux) blast\nqed\n\nlemma weakenBisimEqWeakBisim[simp]: \"weakenBisim = weakBisim\"\nproof auto\n fix \\ P Q\n assume \"\\ \\ P \\\\<^sub>w Q\" thus \"\\ \\ P \\ Q\"\n proof(coinduct rule: weakBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n from \\\\ \\ P \\\\<^sub>w Q\\ have \"\\ \\ P \\\\<^sub>w Q\" by(rule weakenBisimE)\n thus ?case using weakenBisimE(3) by(rule weakenStatImpWeakStatImp)\n next\n case(cSim \\ P Q)\n from \\\\ \\ P \\\\<^sub>w Q\\ weakenBisimE\n show ?case by(rule weakenSimWeakSim)\n next\n case(cExt \\ P Q \\')\n thus ?case by(rule weakenBisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(rule weakenBisimE)\n qed\nnext\n fix \\ P Q\n assume \"\\ \\ P \\ Q\" thus \"\\ \\ P \\\\<^sub>w Q\"\n proof(coinduct rule: weakenBisimWeakCoinduct)\n case(cStatImp \\ P Q)\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\ Q\" by(rule weakBisimE)\n thus ?case using statEqWeakBisim by(rule weakStatImpWeakenStatImp)\n next\n case(cSim \\ P Q)\n from \\\\ \\ P \\ Q\\ have \"\\ \\ P \\ Q\" by(rule weakBisimE)\n thus ?case using statEqWeakBisim by(rule weakSimWeakenSim)\n next\n case(cExt \\ P Q \\')\n thus ?case by(rule weakBisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(rule weakBisimE)\n qed\nqed\n\nlemma weakenTransitiveWeakCoinduct[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes p: \"(\\, P, Q) \\ X\"\n and Eqvt: \"eqvt X\"\n and rStatImp: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w Q\"\n and rSim: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w<({(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\\n (\\, P', Q') \\ X \\\n \\ \\ Q' \\ Q})> Q\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X\"\n and rSym: \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nproof -\n from p \\eqvt X\\ have \"\\ \\ P \\ Q\"\n proof(coinduct rule: weakTransitiveWeakCoinduct)\n case(cStatImp \\ P Q)\n from \\(\\, P, Q) \\ X\\ have \"\\ \\ P \\\\<^sub>w Q\" by(rule rStatImp)\n thus ?case using rExt by(rule weakenStatImpWeakStatImp)\n next\n case(cSim \\ P Q)\n let ?Y = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ X \\ \\ \\ Q' \\ Q}\"\n note \\(\\, P, Q) \\ X\\\n moreover note rStatImp rSim\n moreover have \"\\\\ P Q \\'. (\\, P, Q) \\ ?Y \\ (\\ \\ \\', P, Q) \\ ?Y\"\n by(blast dest: bisimE rExt)\n ultimately show ?case using rSym by(rule weakenSimWeakSim)\n next\n case(cExt \\ P Q \\')\n thus ?case by(rule rExt) \n next\n case(cSym \\ P Q)\n thus ?case by(rule rSym)\n qed\n thus ?thesis by(simp add: weakenBisimEqWeakBisim)\nqed\n\nlemma weakenTransitiveCoinduct[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and X :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes p: \"(\\, P, Q) \\ X\"\n and Eqvt: \"eqvt X\"\n and rStatImp: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w<(X \\ weakenBisim)> Q\"\n and rSim: \"\\\\ P Q. (\\, P, Q) \\ X \\ \\ \\ P \\\\<^sub>w<({(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\\n (\\, P', Q') \\ (X \\ weakenBisim) \\\n \\ \\ Q' \\ Q})> Q\"\n and rExt: \"\\\\ P Q \\'. (\\, P, Q) \\ X \\ (\\ \\ \\', P, Q) \\ X \\ weakenBisim\"\n and rSym: \"\\\\ P Q. (\\, P, Q) \\ X \\ (\\, Q, P) \\ X \\ weakenBisim\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nproof -\n from p have \"(\\, P, Q) \\ X \\ weakenBisim\" by auto\n moreover from \\eqvt X\\ have \"eqvt(X \\ weakenBisim)\" by auto\n ultimately show ?thesis\n proof(coinduct rule: weakenTransitiveWeakCoinduct)\n case(cStatImp \\ P Q)\n thus ?case by(fastforce intro: rStatImp weakenBisimE(1) weakenStatImpMonotonic)\n next\n case(cSim \\ P Q)\n thus ?case by(fastforce intro: rSim weakenBisimE(2) weakenSimMonotonic bisimReflexive)\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: weakenBisimE rExt) \n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: weakenBisimE rSym)\n qed\nqed\n\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weaken_Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2658476869407446}} {"text": "section \\Refinement to Efficient Code\\\n(*\n Author: Peter Lammich\n Inspired by previous version of Alexander Schimpf.\n*)\ntheory LTL_to_GBA_impl\nimports \n LTL_to_GBA\n Deriving.Compare_Instances\n CAVA_Automata.Automata_Impl\n CAVA_Base.CAVA_Code_Target\nbegin\n\nsubsection \\Parametricity Setup Boilerplate\\\n\nsubsubsection \\LTL Formulas\\\n\nderive linorder ltlr\n\ninductive_set ltlr_rel for R where\n \"(True_ltlr, True_ltlr) \\ ltlr_rel R\"\n| \"(False_ltlr, False_ltlr) \\ ltlr_rel R\"\n| \"(a,a')\\R \\ (Prop_ltlr a,Prop_ltlr a') \\ ltlr_rel R\"\n| \"(a,a')\\R \\ (Nprop_ltlr a,Nprop_ltlr a') \\ ltlr_rel R\"\n| \"\\(a,a')\\ltlr_rel R; (b,b')\\ltlr_rel R\\ \n \\ (And_ltlr a b,And_ltlr a' b') \\ ltlr_rel R\"\n| \"\\(a,a')\\ltlr_rel R; (b,b')\\ltlr_rel R\\ \n \\ (Or_ltlr a b,Or_ltlr a' b') \\ ltlr_rel R\"\n| \"\\(a,a')\\ltlr_rel R\\ \\ (Next_ltlr a,Next_ltlr a') \\ ltlr_rel R\"\n| \"\\(a,a')\\ltlr_rel R; (b,b')\\ltlr_rel R\\ \n \\ (Until_ltlr a b,Until_ltlr a' b') \\ ltlr_rel R\"\n| \"\\(a,a')\\ltlr_rel R; (b,b')\\ltlr_rel R\\ \n \\ (Release_ltlr a b,Release_ltlr a' b') \\ ltlr_rel R\"\n\nlemmas ltlr_rel_induct[induct set] \n = ltlr_rel.induct[simplified relAPP_def[of ltlr_rel, symmetric]]\nlemmas ltlr_rel_cases[cases set] \n = ltlr_rel.cases[simplified relAPP_def[of ltlr_rel, symmetric]]\nlemmas ltlr_rel_intros \n = ltlr_rel.intros[simplified relAPP_def[of ltlr_rel, symmetric]]\n\ninductive_simps ltlr_rel_left_simps[simplified relAPP_def[of ltlr_rel, symmetric]]: \n \"(True_ltlr,z) \\ ltlr_rel R\"\n \"(False_ltlr,z) \\ ltlr_rel R\"\n \"(Prop_ltlr p, z) \\ ltlr_rel R\"\n \"(Nprop_ltlr p, z) \\ ltlr_rel R\"\n \"(And_ltlr a b, z) \\ ltlr_rel R\"\n \"(Or_ltlr a b, z) \\ ltlr_rel R\"\n \"(Next_ltlr a, z) \\ ltlr_rel R\"\n \"(Until_ltlr a b, z) \\ ltlr_rel R\"\n \"(Release_ltlr a b, z) \\ ltlr_rel R\"\n\nlemma ltlr_rel_sv[relator_props]: \n assumes SV: \"single_valued R\" \n shows \"single_valued (\\R\\ltlr_rel)\"\nproof (intro single_valuedI allI impI)\n fix x y z\n assume \"(x, y) \\ \\R\\ltlr_rel\" \"(x, z) \\ \\R\\ltlr_rel\"\n then show \"y=z\"\n apply (induction arbitrary: z)\n apply (simp (no_asm_use) only: ltlr_rel_left_simps \n | blast intro: single_valuedD[OF SV])+\n done\nqed\n\nlemma ltlr_rel_id[relator_props]: \"\\ R = Id \\ \\ \\R\\ltlr_rel = Id\"\nproof (intro equalityI subsetI, clarsimp_all)\n fix a b\n assume \"(a,b)\\\\Id\\ltlr_rel\"\n then show \"a=b\"\n by induction auto\nnext\n fix a\n show \"(a,a)\\\\Id\\ltlr_rel\"\n by (induction a) (auto intro: ltlr_rel_intros)\nqed\n\nlemma ltlr_rel_id_simp[simp]: \"\\Id\\ltlr_rel = Id\" by (rule ltlr_rel_id) simp\n\nconsts i_ltlr :: \"interface \\ interface\"\nlemmas [autoref_rel_intf] = REL_INTFI[of ltlr_rel i_ltlr]\n\nthm ltlr_rel_intros[no_vars]\n\nlemma ltlr_con_param[param, autoref_rules]:\n \"(True_ltlr, True_ltlr) \\ \\R\\ltlr_rel\"\n \"(False_ltlr, False_ltlr) \\ \\R\\ltlr_rel\"\n \"(Prop_ltlr, Prop_ltlr) \\ R \\ \\R\\ltlr_rel\"\n \"(Nprop_ltlr, Nprop_ltlr) \\ R \\ \\R\\ltlr_rel\"\n \"(And_ltlr, And_ltlr) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel\"\n \"(Or_ltlr, Or_ltlr) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel\"\n \"(Next_ltlr, Next_ltlr) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel\"\n \"(Until_ltlr, Until_ltlr) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel\"\n \"(Release_ltlr, Release_ltlr) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel\"\n by (auto intro: ltlr_rel_intros)\n\nlemma case_ltlr_param[param, autoref_rules]: \n \"(case_ltlr,case_ltlr) \\ Rv \\ Rv \\ (R \\ Rv)\n \\ (R \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv)\n \\ (\\R\\ltlr_rel \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv) \\ \\R\\ltlr_rel \\ Rv\"\n apply (clarsimp)\n apply (case_tac ai, simp_all add: ltlr_rel_left_simps)\n apply (clarsimp_all)\n apply parametricity+\n done\n\nlemma rec_ltlr_param[param, autoref_rules]: \n \"(rec_ltlr,rec_ltlr) \\ Rv \\ Rv \\ (R \\ Rv)\n \\ (R \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv \\ Rv \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv \\ Rv \\ Rv)\n \\ (\\R\\ltlr_rel \\ Rv \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv \\ Rv \\ Rv)\n \\ (\\R\\ltlr_rel \\ \\R\\ltlr_rel \\ Rv \\ Rv \\ Rv)\n \\ \\R\\ltlr_rel \\ Rv\"\nproof (clarsimp, goal_cases)\n case prems: 1\n from prems(10)\n show ?case \n apply (induction)\n using prems(1-9)\n apply simp_all\n apply parametricity+\n done\nqed\n\nlemma case_ltlr_mono[refine_mono]: \n assumes \"\\ = True_ltlr \\ a\\a'\"\n assumes \"\\ = False_ltlr \\ b\\b'\"\n assumes \"\\p. \\ = Prop_ltlr p \\ c p\\c' p\"\n assumes \"\\p. \\ = Nprop_ltlr p \\ d p\\d' p\"\n assumes \"\\\\ \\. \\ = And_ltlr \\ \\ \\ e \\ \\\\e' \\ \\\"\n assumes \"\\\\ \\. \\ = Or_ltlr \\ \\ \\ f \\ \\\\f' \\ \\\"\n assumes \"\\\\. \\ = Next_ltlr \\ \\ g \\\\g' \\\"\n assumes \"\\\\ \\. \\ = Until_ltlr \\ \\ \\ h \\ \\\\h' \\ \\\"\n assumes \"\\\\ \\. \\ = Release_ltlr \\ \\ \\ i \\ \\\\i' \\ \\\"\n shows \"case_ltlr a b c d e f g h i \\ \\ case_ltlr a' b' c' d' e' f' g' h' i' \\\"\n using assms\n apply (cases \\)\n apply simp_all\n done\n\n\nprimrec ltlr_eq where\n \"ltlr_eq eq True_ltlr f \\ (case f of True_ltlr \\ True | _ \\ False)\"\n| \"ltlr_eq eq False_ltlr f \\ (case f of False_ltlr \\ True | _ \\ False)\"\n| \"ltlr_eq eq (Prop_ltlr p) f \\ (case f of Prop_ltlr p' \\ eq p p' | _ \\ False)\"\n| \"ltlr_eq eq (Nprop_ltlr p) f \\ (case f of Nprop_ltlr p' \\ eq p p' | _ \\ False)\"\n| \"ltlr_eq eq (And_ltlr \\ \\) f \n \\ (case f of And_ltlr \\' \\' \\ ltlr_eq eq \\ \\' \\ ltlr_eq eq \\ \\' | _ \\ False)\"\n| \"ltlr_eq eq (Or_ltlr \\ \\) f \n \\ (case f of Or_ltlr \\' \\' \\ ltlr_eq eq \\ \\' \\ ltlr_eq eq \\ \\' | _ \\ False)\"\n| \"ltlr_eq eq (Next_ltlr \\) f \n \\ (case f of Next_ltlr \\' \\ ltlr_eq eq \\ \\' | _ \\ False)\"\n| \"ltlr_eq eq (Until_ltlr \\ \\) f \n \\ (case f of Until_ltlr \\' \\' \\ ltlr_eq eq \\ \\' \\ ltlr_eq eq \\ \\' | _ \\ False)\"\n| \"ltlr_eq eq (Release_ltlr \\ \\) f \n \\ (case f of \n Release_ltlr \\' \\' \\ ltlr_eq eq \\ \\' \\ ltlr_eq eq \\ \\' \n | _ \\ False)\"\n\nlemma ltlr_eq_autoref[autoref_rules]:\n assumes EQP: \"(eq,(=)) \\ R \\ R \\ bool_rel\"\n shows \"(ltlr_eq eq, (=)) \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ bool_rel\"\nproof (intro fun_relI)\n fix \\' \\ \\' \\\n assume \"(\\',\\)\\\\R\\ltlr_rel\" and \"(\\',\\)\\\\R\\ltlr_rel\"\n then show \"(ltlr_eq eq \\' \\', \\=\\)\\bool_rel\"\n apply (induction arbitrary: \\' \\)\n apply (erule ltlr_rel_cases, simp_all) []\n apply (erule ltlr_rel_cases, simp_all) []\n apply (erule ltlr_rel_cases, \n simp_all add: EQP[THEN fun_relD, THEN fun_relD, THEN IdD]) []\n apply (erule ltlr_rel_cases, \n simp_all add: EQP[THEN fun_relD, THEN fun_relD, THEN IdD]) []\n apply (rotate_tac -1)\n apply (erule ltlr_rel_cases, simp_all) []\n apply (rotate_tac -1)\n apply (erule ltlr_rel_cases, simp_all) []\n apply (rotate_tac -1)\n apply (erule ltlr_rel_cases, simp_all) []\n apply (rotate_tac -1)\n apply (erule ltlr_rel_cases, simp_all) []\n apply (rotate_tac -1)\n apply (erule ltlr_rel_cases, simp_all) []\n done\nqed\n\nlemma ltlr_dflt_cmp[autoref_rules_raw]: \n assumes \"PREFER_id R\"\n shows\n \"(dflt_cmp (\\) (<), dflt_cmp (\\) (<)) \n \\ \\R\\ltlr_rel \\ \\R\\ltlr_rel \\ comp_res_rel\"\n using assms\n by simp\n\ntype_synonym\n node_name_impl = node_name \n\nabbreviation (input) \"node_name_rel \\ Id :: (node_name_impl\\node_name) set\"\n\nlemma case_ltlr_gtransfer:\n assumes\n \"\\ ai \\ a\"\n \"\\ bi \\ b\"\n \"\\a. \\ (ci a) \\ c a\"\n \"\\a. \\ (di a) \\ d a\"\n \"\\ltlr1 ltlr2. \\ (ei ltlr1 ltlr2) \\ e ltlr1 ltlr2\"\n \"\\ltlr1 ltlr2. \\ (fi ltlr1 ltlr2) \\ f ltlr1 ltlr2\"\n \"\\ltlr. \\ (gi ltlr) \\ g ltlr\"\n \"\\ltlr1 ltlr2. \\ (hi ltlr1 ltlr2) \\ h ltlr1 ltlr2\"\n \"\\ltlr1 ltlr2. \\ (iiv ltlr1 ltlr2) \\ i ltlr1 ltlr2\"\n shows \"\\ (case_ltlr ai bi ci di ei fi gi hi iiv \\) \n \\ (case_ltlr a b c d e f g h i \\)\"\n apply (cases \\)\n apply (auto intro: assms)\n done\n\nlemmas [refine_transfer] \n = case_ltlr_gtransfer[where \\=nres_of] case_ltlr_gtransfer[where \\=RETURN]\n\nlemma [refine_transfer]:\n assumes \n \"ai \\ dSUCCEED\"\n \"bi \\ dSUCCEED\"\n \"\\a. ci a \\ dSUCCEED\"\n \"\\a. di a \\ dSUCCEED\"\n \"\\ltlr1 ltlr2. ei ltlr1 ltlr2 \\ dSUCCEED\"\n \"\\ltlr1 ltlr2. fi ltlr1 ltlr2 \\ dSUCCEED\"\n \"\\ltlr. gi ltlr \\ dSUCCEED\"\n \"\\ltlr1 ltlr2. hi ltlr1 ltlr2 \\ dSUCCEED\"\n \"\\ltlr1 ltlr2. iiv ltlr1 ltlr2 \\ dSUCCEED\"\n shows \"case_ltlr ai bi ci di ei fi gi hi iiv \\ \\ dSUCCEED\"\n apply (cases \\)\n apply (simp_all add: assms)\n done\n\nsubsubsection \\Nodes\\\n\nrecord 'a node_impl =\n name_impl :: node_name_impl\n incoming_impl :: \"(node_name_impl,unit) RBT_Impl.rbt\"\n new_impl :: \"'a frml list\"\n old_impl :: \"'a frml list\"\n next_impl :: \"'a frml list\"\n\ndefinition node_rel where node_rel_def_internal: \"node_rel Re R \\ {( \n \\ name_impl = namei, \n incoming_impl = inci, \n new_impl = newi,\n old_impl = oldi,\n next_impl = nexti,\n \\ = morei\n \\, \n \\ name = name,\n incoming = inc,\n new=new,\n old=old,\n next = next,\n \\ = more\n \\ ) | namei name inci inc newi new oldi old nexti next morei more. \n (namei,name)\\node_name_rel \n \\ (inci,inc)\\\\node_name_rel\\dflt_rs_rel \n \\ (newi,new)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (oldi,old)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (nexti,next)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (morei,more)\\Re\n }\"\n\nlemma node_rel_def: \"\\Re,R\\node_rel = {( \n \\ name_impl = namei, \n incoming_impl = inci, \n new_impl = newi,\n old_impl = oldi,\n next_impl = nexti,\n \\ = morei\n \\, \n \\ name = name,\n incoming = inc,\n new=new,\n old=old,\n next = next,\n \\ = more\n \\ ) | namei name inci inc newi new oldi old nexti next morei more. \n (namei,name)\\node_name_rel \n \\ (inci,inc)\\\\node_name_rel\\dflt_rs_rel \n \\ (newi,new)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (oldi,old)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (nexti,next)\\\\\\R\\ltlr_rel\\lss.rel\n \\ (morei,more)\\Re\n }\" by (simp add: node_rel_def_internal relAPP_def)\n\n\nlemma node_rel_sv[relator_props]: \n \"single_valued Re \\ single_valued R \\ single_valued (\\Re,R\\node_rel)\"\n apply (rule single_valuedI)\n apply (simp add: node_rel_def)\n apply (auto \n dest: single_valuedD lss.rel_sv[OF ltlr_rel_sv] map2set_rel_sv[OF ahm_rel_sv] \n dest: single_valuedD[\n OF map2set_rel_sv[OF rbt_map_rel_sv[OF single_valued_Id single_valued_Id]]\n ])\n done\n\nconsts i_node :: \"interface \\ interface \\ interface\"\n\nlemmas [autoref_rel_intf] = REL_INTFI[of node_rel i_node]\n\nlemma [autoref_rules]: \"(node_impl_ext, node_ext) \\ \n node_name_rel \n \\ \\node_name_rel\\dflt_rs_rel \n \\ \\\\R\\ltlr_rel\\lss.rel \n \\ \\\\R\\ltlr_rel\\lss.rel \n \\ \\\\R\\ltlr_rel\\lss.rel \n \\ Re \n \\ \\Re,R\\node_rel\"\n unfolding node_rel_def\n by auto\n\nlemma [autoref_rules]: \n \"(node_impl.name_impl_update,node.name_update) \n \\ (node_name_rel \\ node_name_rel) \\ \\Re,R\\node_rel \\ \\Re,R\\node_rel\"\n \"(node_impl.incoming_impl_update,node.incoming_update) \n \\ (\\node_name_rel\\dflt_rs_rel \\ \\node_name_rel\\dflt_rs_rel) \n \\ \\Re,R\\node_rel \n \\ \\Re,R\\node_rel\"\n \"(node_impl.new_impl_update,node.new_update) \n \\ (\\\\R\\ltlr_rel\\lss.rel \\ \\\\R\\ltlr_rel\\lss.rel) \\ \\Re,R\\node_rel \\ \\Re,R\\node_rel\"\n \"(node_impl.old_impl_update,node.old_update) \n \\ (\\\\R\\ltlr_rel\\lss.rel \\ \\\\R\\ltlr_rel\\lss.rel) \\ \\Re,R\\node_rel \\ \\Re,R\\node_rel\"\n \"(node_impl.next_impl_update,node.next_update) \n \\ (\\\\R\\ltlr_rel\\lss.rel \\ \\\\R\\ltlr_rel\\lss.rel) \\ \\Re,R\\node_rel \\ \\Re,R\\node_rel\"\n \"(node_impl.more_update,node.more_update) \n \\ (Re \\ Re) \\ \\Re,R\\node_rel \\ \\Re,R\\node_rel\"\n unfolding node_rel_def\n by (auto dest: fun_relD)\n\nterm name\nlemma [autoref_rules]:\n \"(node_impl.name_impl,node.name)\\\\Re,R\\node_rel \\ node_name_rel\"\n \"(node_impl.incoming_impl,node.incoming)\n \\ \\Re,R\\node_rel \\ \\node_name_rel\\dflt_rs_rel\"\n \"(node_impl.new_impl,node.new)\\\\Re,R\\node_rel \\ \\\\R\\ltlr_rel\\lss.rel\"\n \"(node_impl.old_impl,node.old)\\\\Re,R\\node_rel \\ \\\\R\\ltlr_rel\\lss.rel\"\n \"(node_impl.next_impl,node.next)\\\\Re,R\\node_rel \\ \\\\R\\ltlr_rel\\lss.rel\"\n \"(node_impl.more, node.more)\\\\Re,R\\node_rel \\ Re\"\n unfolding node_rel_def by auto\n\n\nsubsection \\Massaging the Abstract Algorithm\\\ntext \\\n In a first step, we do some refinement steps on the abstract data structures,\n with the goal to make the algorithm more efficient.\n\\\n\nsubsubsection \\Creation of the Nodes\\\ntext \\\n In the expand-algorithm, we replace nested conditionals by case-distinctions,\n and slightly stratify the code.\n\\\n\n\n\nabbreviation (input) \"expand2 exp n ns \\ n1 nx1 n2 \\ do {\n (nm, nds) \\ exp (\n n\\ \n new := insert n1 (new n), \n old := insert \\ (old n), \n next := nx1 \\ next n \\, \n ns);\n exp (n\\ name := nm, new := n2 \\ new n, old := {\\} \\ old n \\, nds)\n }\"\n\n\n\ndefinition \"expand_aimpl \\ REC\\<^sub>T (\\expand (n,ns). \n if new n = {} then ( \n if (\\n'\\ns. old n' = old n \\ next n' = next n) then \n RETURN (name n, upd_incoming n ns)\n else do {\n ASSERT (n \\ ns);\n ASSERT (name n \\ name`ns);\n expand (\\ \n name=expand_new_name (name n), \n incoming={name n}, \n new=next n, \n old={}, \n next={} \\, \n insert n ns)\n }\n ) else do { \n \\ \\ SPEC (\\x. x\\(new n));\n let n = n\\ new := new n - {\\} \\;\n case \\ of\n prop\\<^sub>r(q) \\ \n if nprop\\<^sub>r(q)\\old n then RETURN (name n, ns)\n else expand (n\\ old := {\\} \\ old n \\, ns)\n | nprop\\<^sub>r(q) \\ \n if prop\\<^sub>r(q)\\old n then RETURN (name n, ns)\n else expand (n\\ old := {\\} \\ old n \\, ns)\n | true\\<^sub>r \\ expand (n\\ old := {\\} \\ old n \\, ns)\n | false\\<^sub>r \\ RETURN (name n, ns)\n | \\ and\\<^sub>r \\ \\ expand (n\\ \n new := insert \\ (insert \\ (new n)), \n old := {\\} \\ old n, \n next := next n \\, ns)\n | X\\<^sub>r \\ \\ expand \n (n\\ new := new n, old := {\\} \\ old n, next := insert \\ (next n) \\, ns)\n | \\ or\\<^sub>r \\ \\ expand2 expand n ns \\ \\ {} {\\}\n | \\ U\\<^sub>r \\ \\ expand2 expand n ns \\ \\ {\\} {\\}\n | \\ R\\<^sub>r \\ \\ expand2 expand n ns \\ \\ {\\} {\\,\\}\n \\<^cancel>\\| _ \\ do {\n (nm, nds) \\ expand (\n n\\ \n new := new1 \\ \\ new n, \n old := {\\} \\ old n, \n next := next1 \\ \\ next n \\,\n ns);\n expand (n\\ name := nm, new := new2 \\ \\ new n, old := {\\} \\ old n \\, nds)\n }\\\n }\n )\"\n\n\nlemma expand_aimpl_refine:\n fixes n_ns :: \"('a node \\ _)\"\n defines \"R \\ Id \\ {(_,(n,ns)). \\n'\\ns. n > name n'}\"\n defines \"R' \\ Id \\ {(_,(n,ns)). \\n'\\ns. name n > name n'}\"\n assumes [refine]: \"(n_ns',n_ns)\\R'\"\n shows \"expand_aimpl n_ns' \\ \\R (expand\\<^sub>T n_ns)\"\n using [[goals_limit = 1]]\nproof -\n have [relator_props]: \"single_valued R\" \n by (auto simp add: R_def intro: single_valuedI)\n have [relator_props]: \"single_valued R'\" \n by (auto simp add: R'_def intro: single_valuedI)\n\n {\n fix n :: \"'a node\" and ns and n' ns'\n assume \"((n', ns'), (n, ns)) \\ R'\"\n then have \"(RETURN (name n', ns') \\ \\ R (RETURN (name n, ns)))\"\n by (auto simp: R_def R'_def pw_le_iff refine_pw_simps)\n } note aux = this\n\n\n show ?thesis\n unfolding expand_aimpl_def expand\\<^sub>T_def\n apply refine_rcg\n apply (simp add: R_def R'_def)\n apply (simp add: R_def R'_def)\n apply (auto simp add: R_def R'_def upd_incoming_def) []\n apply (auto simp add: R_def R'_def upd_incoming_def) []\n apply (auto simp add: R_def R'_def upd_incoming_def) []\n apply rprems\n apply (auto simp: R'_def expand_new_name_def) []\n apply (simp add: R'_def)\n\n apply (auto split: ltlr.split) []\n apply (fastforce simp: R_def R'_def) []\n apply (fastforce simp: R_def R'_def) []\n\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (auto simp: R_def R'_def) []\n apply (refine_rcg, rprems, (fastforce simp: R_def R'_def)+) []\n apply (fastforce simp: R'_def) []\n apply (refine_rcg, rprems, (fastforce simp: R_def R'_def)+) []\n apply (refine_rcg, rprems, (fastforce simp: R_def R'_def)+) []\n done\nqed\n\n\nthm create_graph_def\ndefinition \"create_graph_aimpl \\ = do {\n (_, nds) \\\n expand_aimpl\n (\\name = expand_new_name expand_init, incoming = {expand_init},\n new = {\\}, old = {}, next = {}\\,\n {});\n RETURN nds\n}\"\n\nlemma create_graph_aimpl_refine: \"create_graph_aimpl \\ \\ \\Id (create_graph\\<^sub>T \\)\"\n unfolding create_graph_aimpl_def create_graph\\<^sub>T_def\n apply (refine_rcg expand_aimpl_refine)\n apply auto\n done\n\nsubsubsection \\Creation of GBA from Nodes\\\n\ntext \\\n We summarize creation of the GBA and renaming of the nodes into one step\n\\\nlemma create_name_gba_alt: \"create_name_gba \\ = do {\n nds \\ create_graph\\<^sub>T \\;\n ASSERT (nds_invars nds);\n RETURN (gba_rename_ext (\\_. ()) name (create_gba_from_nodes \\ nds))\n }\"\nproof -\n have [simp]: \"\\nds. g_V (create_gba_from_nodes \\ nds) = nds\"\n by (auto simp: create_gba_from_nodes_def)\n\n show ?thesis\n unfolding create_name_gba_def create_gba_def\n by simp\nqed\n\ntext \\In the following, we implement the componenents of the\n renamed GBA separately.\n\\\n\ntext \\\\paragraph{Successor Function}\\\n\ndefinition \"build_succ nds = \n FOREACH \n nds (\\q' s.\n FOREACH\n (incoming q') (\\qn s. \n if qn=expand_init then \n RETURN s \n else \n RETURN (s(qn \\ insert (name q') (the_default {} (s qn))))\n ) s\n ) Map.empty\"\n\nlemma build_succ_aux1:\n assumes [simp]: \"finite nds\"\n assumes [simp]: \"\\q. q\\nds \\ finite (incoming q)\"\n shows \"build_succ nds \\ SPEC (\\r. r = (\\qn. \n dflt_None_set {qn'. \\q'. \n q'\\nds \\ qn' = name q' \\ qn\\incoming q' \\ qn\\expand_init \n }))\"\n unfolding build_succ_def\n apply (refine_rcg refine_vcg \n FOREACH_rule[where\n I=\"\\it s. s = (\\qn. dflt_None_set {qn'. \\q'. q'\\nds-it \\ qn' = name q' \n \\ qn\\incoming q' \\ qn\\expand_init })\"])\n\n apply (simp_all add: dflt_None_set_def) [2]\n apply (rename_tac q' it s)\n apply (rule_tac I=\"\\it2 s. s = \n (\\qn. dflt_None_set (\n {qn'. \\q'. q'\\nds-it \\ qn' = name q' \\ qn\\incoming q' \\ qn\\expand_init } \\ \n {qn' . qn'=name q' \\ qn\\incoming q' - it2 \\ qn\\expand_init} ))\" \n in FOREACH_rule)\n\n apply auto []\n\n apply (simp_all add: dflt_None_set_def)\n\n apply (refine_rcg refine_vcg)\n apply (auto simp: dflt_None_set_def intro!: ext) []\n apply (rule ext, (auto) [])+\n done\n\nlemma build_succ_aux2:\n assumes NINIT: \"expand_init \\ name`nds\"\n assumes CL: \"\\nd. nd\\nds \\ incoming nd \\ insert expand_init (name`nds)\"\n shows\n \"(\\qn. dflt_None_set \n {qn'. \\q'. q'\\nds \\ qn' = name q' \\ qn\\incoming q' \\ qn\\expand_init }) \n = (\\qn. dflt_None_set (succ_of_E \n (rename_E name {(q, q'). q \\ nds \\ q' \\ nds \\ name q \\ incoming q'}) qn))\" \n (is \"(\\qn. dflt_None_set (?L qn)) = (\\qn. dflt_None_set (?R qn))\")\n apply (intro ext)\n apply (fo_rule arg_cong)\nproof (intro ext equalityI subsetI)\n fix qn x\n assume \"x\\?R qn\"\n then show \"x\\?L qn\" using NINIT\n by (force simp: succ_of_E_def)\nnext\n fix qn x\n assume XL: \"x\\?L qn\"\n show \"x\\?R qn\"\n proof (cases \"qn = expand_init\")\n case False\n from XL obtain q' where \n A: \"q'\\nds\" \"qn\\incoming q'\" \n and [simp]: \"x=name q'\" \n by auto\n from False obtain q where B: \"q\\nds\" and [simp]: \"qn = name q\"\n using CL A by auto\n\n from A B show \"x\\?R qn\"\n by (auto simp: succ_of_E_def image_def)\n next\n case [simp]: True\n from XL show \"x\\?R qn\" by simp\n qed\nqed\n\nlemma build_succ_correct:\n assumes NINIT: \"expand_init \\ name`nds\"\n assumes FIN: \"finite nds\"\n assumes CL: \"\\nd. nd\\nds \\ incoming nd \\ insert expand_init (name`nds)\"\n shows \"build_succ nds \\ SPEC (\\r. \n E_of_succ (\\qn. the_default {} (r qn)) \n = rename_E (\\u. name u) {(q, q'). q \\ nds \\ q' \\ nds \\ name q \\ incoming q'})\"\nproof -\n from FIN CL have FIN': \"\\q. q\\nds \\ finite (incoming q)\"\n by (metis finite_imageI finite_insert infinite_super)\n \n note build_succ_aux1[OF FIN FIN']\n also note build_succ_aux2[OF NINIT CL]\n finally show ?thesis\n by (rule order_trans) auto\nqed\n\ntext \\\\paragraph{ Accepting Sets}\\\n\nprimrec until_frmlsr :: \"'a frml \\ ('a frml \\ 'a frml) set\" where\n \"until_frmlsr (\\ and\\<^sub>r \\) = (until_frmlsr \\) \\ (until_frmlsr \\)\"\n| \"until_frmlsr (X\\<^sub>r \\) = until_frmlsr \\\"\n| \"until_frmlsr (\\ U\\<^sub>r \\) = insert (\\, \\) ((until_frmlsr \\) \\ (until_frmlsr \\))\"\n| \"until_frmlsr (\\ R\\<^sub>r \\) = (until_frmlsr \\) \\ (until_frmlsr \\)\"\n| \"until_frmlsr (\\ or\\<^sub>r \\) = (until_frmlsr \\) \\ (until_frmlsr \\)\"\n| \"until_frmlsr (true\\<^sub>r) = {}\"\n| \"until_frmlsr (false\\<^sub>r) = {}\"\n| \"until_frmlsr (prop\\<^sub>r(_)) = {}\"\n| \"until_frmlsr (nprop\\<^sub>r(_)) = {}\"\n\nlemma until_frmlsr_correct: \n \"until_frmlsr \\ = {(\\, \\). Until_ltlr \\ \\ \\ subfrmlsr \\}\"\n by (induct \\) auto\n\n\ndefinition \"build_F nds \\ \n \\ (\\(\\,\\). name ` {q \\ nds. (Until_ltlr \\ \\ \\ old q \\ \\ \\ old q)}) `\n until_frmlsr \\\"\n\nlemma build_F_correct: \"build_F nds \\ = \n {name ` A |A. \\\\ \\. A = {q \\ nds. Until_ltlr \\ \\ \\ old q \\ \\ \\ old q} \\\n Until_ltlr \\ \\ \\ subfrmlsr \\}\"\nproof -\n have \"{name ` A |A. \\\\ \\. A = {q \\ nds. Until_ltlr \\ \\ \\ old q \\ \\ \\ old q} \\\n Until_ltlr \\ \\ \\ subfrmlsr \\}\n = (\\(\\,\\). name`{q\\nds. Until_ltlr \\ \\ \\ old q \\ \\ \\ old q}) \n ` {(\\, \\). Until_ltlr \\ \\ \\ subfrmlsr \\}\"\n by auto\n also have \"\\ = (\\(\\,\\). name`{q\\nds. Until_ltlr \\ \\ \\ old q \\ \\ \\ old q}) \n ` until_frmlsr \\\"\n unfolding until_frmlsr_correct ..\n finally show ?thesis\n unfolding build_F_def by simp\nqed\n\ntext \\\\paragraph{ Labeling Function }\\\ndefinition \"pn_props ps \\ FOREACHi \n (\\it (P,N). P = {p. Prop_ltlr p \\ ps - it} \\ N = {p. Nprop_ltlr p \\ ps - it}) \n ps (\\p (P,N). \n case p of Prop_ltlr p \\ RETURN (insert p P,N)\n | Nprop_ltlr p \\ RETURN (P, insert p N)\n | _ \\ RETURN (P,N)\n ) ({},{})\"\n\nlemma pn_props_correct: \n assumes [simp]: \"finite ps\"\n shows \"pn_props ps \\ SPEC(\\r. r = \n ({p. Prop_ltlr p \\ ps}, {p. Nprop_ltlr p \\ ps}))\"\n unfolding pn_props_def\n apply (refine_rcg refine_vcg)\n apply (auto split: ltlr.split)\n done\n\ndefinition \"pn_map nds \\ FOREACH nds \n (\\nd m. do {\n PN \\ pn_props (old nd);\n RETURN (m(name nd \\ PN))\n }) Map.empty\"\n\nlemma pn_map_correct: \n assumes [simp]: \"finite nds\"\n assumes FIN': \"\\nd. nd\\nds \\ finite (old nd)\"\n assumes INJ: \"inj_on name nds\"\n shows \"pn_map nds \\ SPEC (\\r. \\qn. \n case r qn of \n None \\ qn \\ name`nds\n | Some (P,N) \\ qn \\ name`nds \n \\ P = {p. Prop_ltlr p \\ old (the_inv_into nds name qn)}\n \\ N = {p. Nprop_ltlr p \\ old (the_inv_into nds name qn)}\n )\"\n unfolding pn_map_def\n apply (refine_rcg refine_vcg\n FOREACH_rule[where I=\"\\it r. \\qn. \n case r qn of \n None \\ qn \\ name`(nds - it)\n | Some (P,N) \\ qn \\ name`(nds - it)\n \\ P = {p. Prop_ltlr p \\ old (the_inv_into nds name qn)}\n \\ N = {p. Nprop_ltlr p \\ old (the_inv_into nds name qn)}\"]\n order_trans[OF pn_props_correct]\n )\n apply simp_all\n apply (blast dest: subsetD[THEN FIN']) []\n apply (force \n split: option.splits \n simp: the_inv_into_f_f[OF INJ] it_step_insert_iff) []\n apply (fastforce split: option.splits) []\n done\n\n \ntext \\\\paragraph{ Assembling the Implementation }\\\n \ndefinition \"cr_rename_gba nds \\ \\ do {\n let V = name ` nds;\n let V0 = name ` {q \\ nds. expand_init \\ incoming q};\n succmap \\ build_succ nds;\n let E = E_of_succ (the_default {} o succmap);\n let F = build_F nds \\;\n pnm \\ pn_map nds;\n let L = (\\qn l. case pnm qn of \n None \\ False \n | Some (P,N) \\ (\\p\\P. p\\(l:::\\<^sub>r\\Id\\fun_set_rel)) \\ (\\p\\N. p\\l)\n );\n RETURN (\\ g_V = V, g_E=E, g_V0=V0, gbg_F = F, gba_L = L \\)\n}\"\n\nlemma cr_rename_gba_refine:\n assumes INV: \"nds_invars nds\"\n assumes REL[simplified]: \"(nds',nds)\\Id\" \"(\\',\\)\\Id\"\n shows \"cr_rename_gba nds' \\' \n \\ \\Id (RETURN (gba_rename_ext (\\_. ()) name (create_gba_from_nodes \\ nds)))\"\n unfolding RETURN_SPEC_conv\nproof (rule Id_SPEC_refine)\n from INV have\n NINIT: \"expand_init \\ name`nds\"\n and FIN: \"finite nds\"\n and FIN': \"\\nd. nd\\nds \\ finite (old nd)\"\n and CL: \"\\nd. nd\\nds \\ incoming nd \\ insert expand_init (name`nds)\"\n and INJ: \"inj_on name nds\"\n unfolding nds_invars_def by auto\n show \"cr_rename_gba nds' \\'\n \\ SPEC (\\x. x = gba_rename_ext (\\_. ()) name (create_gba_from_nodes \\ nds))\"\n unfolding REL\n unfolding cr_rename_gba_def\n apply (refine_rcg refine_vcg\n order_trans[OF build_succ_correct[OF NINIT FIN CL]]\n order_trans[OF pn_map_correct[OF FIN FIN' INJ]]\n )\n unfolding gba_rename_ecnv_def gb_rename_ecnv_def \n fr_rename_ext_def create_gba_from_nodes_def\n apply simp\n apply (intro conjI)\n apply (simp add: comp_def)\n apply (simp add: build_F_correct)\n apply (intro ext)\n apply (drule_tac x=qn in spec)\n apply (auto simp: the_inv_into_f_f[OF INJ] split: option.split prod.split)\n done\nqed\n\ndefinition \"create_name_gba_aimpl \\ \\ do {\n nds \\ create_graph_aimpl \\;\n ASSERT (nds_invars nds);\n cr_rename_gba nds \\\n}\"\n\n\nlemma create_name_gba_aimpl_refine: \n \"create_name_gba_aimpl \\ \\ \\Id (create_name_gba \\)\"\n unfolding create_name_gba_aimpl_def create_name_gba_alt\n apply (refine_rcg create_graph_aimpl_refine cr_rename_gba_refine)\n by auto\n\nsubsection \\Refinement to Efficient Data Structures\\\n\nsubsubsection \\Creation of GBA from Nodes\\\n\nschematic_goal until_frmlsr_impl_aux:\n assumes [relator_props, simp]: \"R=Id\"\n shows \"(?c,until_frmlsr) \n \\ \\(R::(_\\_::linorder) set)\\ltlr_rel \\ \\\\R\\ltlr_rel \\\\<^sub>r \\R\\ltlr_rel\\dflt_rs_rel\"\n unfolding until_frmlsr_def\n apply (autoref (keep_goal, trace))\n done\nconcrete_definition until_frmlsr_impl uses until_frmlsr_impl_aux\nlemmas [autoref_rules] = until_frmlsr_impl.refine[OF PREFER_id_D]\n\n\n\n\nschematic_goal build_succ_impl_aux:\n shows \"(?c,build_succ) \\ \n \\\\Rm,R\\node_rel\\list_set_rel \n \\ \\\\nat_rel,\\nat_rel\\list_set_rel\\iam_map_rel\\nres_rel\"\n unfolding build_succ_def[abs_def] expand_init_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal, trace))\n done\n\nconcrete_definition build_succ_impl uses build_succ_impl_aux\nlemmas [autoref_rules] = build_succ_impl.refine\n\n(* TODO: Post-processing should be on by default! *)\nschematic_goal build_succ_code_aux: \"RETURN ?c \\ build_succ_impl x\"\n unfolding build_succ_impl_def\n apply (refine_transfer (post))\n done\n\nconcrete_definition build_succ_code uses build_succ_code_aux\nlemmas [refine_transfer] = build_succ_code.refine\n\n\n\n\nschematic_goal build_F_impl_aux:\n assumes [relator_props]: \"R = Id\"\n shows \"(?c,build_F) \\ \n \\\\Rm,R\\node_rel\\list_set_rel \\ \\R\\ltlr_rel \\ \\\\nat_rel\\list_set_rel\\list_set_rel\"\n unfolding build_F_def[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal, trace))\n done\n\nconcrete_definition build_F_impl uses build_F_impl_aux\nlemmas [autoref_rules] = build_F_impl.refine[OF PREFER_id_D]\n\n\n\n\nschematic_goal pn_map_impl_aux:\n shows \"(?c,pn_map) \\ \n \\\\Rm,Id\\node_rel\\list_set_rel \n \\ \\\\nat_rel,\\Id\\list_set_rel \\\\<^sub>r \\Id\\list_set_rel\\iam_map_rel\\nres_rel\"\n unfolding pn_map_def[abs_def] pn_props_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal, trace))\n done\n\nconcrete_definition pn_map_impl uses pn_map_impl_aux\nlemma pn_map_impl_autoref[autoref_rules]: \n assumes \"PREFER_id R\"\n shows \"(pn_map_impl,pn_map) \\ \n \\\\Rm,R\\node_rel\\list_set_rel \n \\ \\\\nat_rel,\\R\\list_set_rel \\\\<^sub>r \\R\\list_set_rel\\iam_map_rel\\nres_rel\"\n using assms pn_map_impl.refine by simp\n\nschematic_goal pn_map_code_aux: \"RETURN ?c \\ pn_map_impl x\"\n unfolding pn_map_impl_def\n apply (refine_transfer (post))\n done\nconcrete_definition pn_map_code uses pn_map_code_aux\nlemmas [refine_transfer] = pn_map_code.refine \n\nschematic_goal cr_rename_gba_impl_aux:\n assumes ID[relator_props]: \"R=Id\"\n notes [autoref_tyrel del] = tyrel_dflt_linorder_set\n notes [autoref_tyrel] = ty_REL[of \"\\nat_rel\\list_set_rel\"]\n shows \"(?c,cr_rename_gba) \\ \n \\\\Rm,R\\node_rel\\list_set_rel \\ \\R\\ltlr_rel \\ (?R::(?'c \\ _) set)\"\n unfolding ID\n unfolding cr_rename_gba_def[abs_def] expand_init_def comp_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal, trace))\n done\nconcrete_definition cr_rename_gba_impl uses cr_rename_gba_impl_aux\n\nthm cr_rename_gba_impl.refine\n\nlemma cr_rename_gba_autoref[autoref_rules]:\n assumes \"PREFER_id R\"\n shows \"(cr_rename_gba_impl, cr_rename_gba) \\ \n \\\\Rm, R\\node_rel\\list_set_rel \\ \\R\\ltlr_rel \\\n \\gbav_impl_rel_ext unit_rel nat_rel (\\R\\fun_set_rel)\\nres_rel\"\n using assms cr_rename_gba_impl.refine[of R Rm] by simp\n\n\nschematic_goal cr_rename_gba_code_aux: \"RETURN ?c \\ cr_rename_gba_impl x y\"\n unfolding cr_rename_gba_impl_def\n apply (refine_transfer (post))\n done\nconcrete_definition cr_rename_gba_code uses cr_rename_gba_code_aux\nlemmas [refine_transfer] = cr_rename_gba_code.refine \n\n\nsubsubsection \\Creation of Graph\\\n\ntext \\\n The implementation of the node-set. The relation enforces that there are no\n different nodes with the same name. This effectively establishes an additional\n invariant, made explicit by an assertion in the refined program. This invariant\n allows for a more efficient implementation.\n\\\ndefinition ls_nds_rel_def_internal: \n \"ls_nds_rel R \\ \\R\\list_set_rel \\ {(_,s). inj_on name s}\"\nlemma ls_nds_rel_def: \"\\R\\ls_nds_rel = \\R\\list_set_rel \\ {(_,s). inj_on name s}\"\n by (simp add: relAPP_def ls_nds_rel_def_internal)\n\nlemmas [autoref_rel_intf] = REL_INTFI[of ls_nds_rel i_set]\n\nlemma ls_nds_rel_sv[relator_props]: \n assumes \"single_valued R\" \n shows \"single_valued (\\R\\ls_nds_rel)\"\n using list_set_rel_sv[OF assms]\n unfolding ls_nds_rel_def\n by (metis inf.cobounded1 single_valued_subset)\n\ncontext begin interpretation autoref_syn .\nlemma lsnds_empty_autoref[autoref_rules]:\n assumes \"PREFER_id R\"\n shows \"([],{})\\\\R\\ls_nds_rel\"\n using assms\n apply (simp add: ls_nds_rel_def)\n by autoref\n\nlemma lsnds_insert_autoref[autoref_rules]:\n assumes \"SIDE_PRECOND (name n \\ name`ns)\"\n assumes \"(n',n)\\R\"\n assumes \"(ns',ns)\\\\R\\ls_nds_rel\"\n shows \"(n'#ns',(OP insert ::: R \\ \\R\\ls_nds_rel \\ \\R\\ls_nds_rel)$n$ns)\n \\ \\R\\ls_nds_rel\"\n using assms\n unfolding ls_nds_rel_def\n apply simp\nproof (elim conjE, rule conjI)\n assume [autoref_rules]: \"(n', n) \\ R\" \"(ns', ns) \\ \\R\\list_set_rel\"\n assume \"name n \\ name ` ns\"\n and \"inj_on name ns\"\n then have \"n \\ ns\" by (auto)\n then show \"(n' # ns', insert n ns) \\ \\R\\list_set_rel\"\n by autoref\nqed auto\n\nlemma ls_nds_image_autoref_aux:\n assumes [autoref_rules]: \"(fi,f) \\ Ra \\ Rb\"\n assumes \"(l,s) \\ \\Ra\\ls_nds_rel\"\n assumes [simp]: \"\\x. name (f x) = name x\"\n shows \"(map fi l, f`s) \\ \\Rb\\ls_nds_rel\"\nproof -\n from assms have \n [autoref_rules]: \"(l,s)\\\\Ra\\list_set_rel\" \n and INJ: \"(inj_on name s)\"\n by (auto simp add: ls_nds_rel_def)\n \n have [simp]: \"inj_on f s\"\n by (rule inj_onI) (metis INJ assms(3) inj_on_eq_iff)\n\n have \"(map fi l, f`s) \\ \\Rb\\list_set_rel\"\n by (autoref (keep_goal))\n moreover have \"inj_on name (f`s)\"\n apply (rule inj_onI)\n apply (auto simp: image_iff dest: inj_onD[OF INJ])\n done\n ultimately show ?thesis\n by (auto simp: ls_nds_rel_def)\nqed \n\nlemma ls_nds_image_autoref[autoref_rules]:\n assumes \"(fi,f) \\ Ra \\ Rb\"\n assumes \"SIDE_PRECOND (\\x. name (f x) = name x)\"\n shows \"(map fi, (OP (`) ::: (Ra\\Rb) \\ \\Ra\\ls_nds_rel \\ \\Rb\\ls_nds_rel)$f) \n \\ \\Ra\\ls_nds_rel \\ \\Rb\\ls_nds_rel\"\n using assms\n unfolding autoref_tag_defs\n using ls_nds_image_autoref_aux\n by blast\n\nlemma list_set_autoref_to_list[autoref_ga_rules]: \n shows \"is_set_to_sorted_list (\\_ _. True) R ls_nds_rel id\"\n unfolding is_set_to_list_def is_set_to_sorted_list_def ls_nds_rel_def\n it_to_sorted_list_def list_set_rel_def br_def\n by auto\n\n\nend\n\ncontext begin interpretation autoref_syn .\nlemma [autoref_itype]:\n \"upd_incoming \n ::\\<^sub>i \\Im, I\\\\<^sub>ii_node \\\\<^sub>i \\\\Im', I\\\\<^sub>ii_node\\\\<^sub>ii_set \\\\<^sub>i \\\\Im', I\\\\<^sub>ii_node\\\\<^sub>ii_set\"\n by simp\nend\n\nterm upd_incoming\nschematic_goal upd_incoming_impl_aux:\n assumes \"REL_IS_ID R\"\n shows \"(?c, upd_incoming)\\\\Rm1,R\\node_rel \n \\ \\\\Rm2,R\\node_rel\\ls_nds_rel \n \\ \\\\Rm2,R\\node_rel\\ls_nds_rel\"\n using assms apply simp\n unfolding upd_incoming_def[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n\nconcrete_definition upd_incoming_impl uses upd_incoming_impl_aux\nlemmas [autoref_rules] = upd_incoming_impl.refine[OF PREFER_D[of REL_IS_ID]]\n\n\nschematic_goal expand_impl_aux: \"(?c, expand_aimpl) \\ \n \\unit_rel,Id\\node_rel \\\\<^sub>r \\\\unit_rel,Id\\node_rel\\ls_nds_rel \n \\ \\nat_rel \\\\<^sub>r \\\\unit_rel,Id\\node_rel\\ls_nds_rel\\nres_rel\"\n unfolding expand_aimpl_def[abs_def] expand_new_name_def\n using [[autoref_trace_failed_id, autoref_trace_intf_unif]]\n apply (autoref (trace,keep_goal))\n done\n\nconcrete_definition expand_impl uses expand_impl_aux\n\ncontext begin interpretation autoref_syn .\nlemma [autoref_itype]: \"expand\\<^sub>T \n ::\\<^sub>i \\\\i_unit, I\\\\<^sub>ii_node, \\\\i_unit, I\\\\<^sub>ii_node\\\\<^sub>ii_set\\\\<^sub>ii_prod \n \\\\<^sub>i \\\\i_nat,\\\\i_unit, I\\\\<^sub>ii_node\\\\<^sub>ii_set\\\\<^sub>ii_prod\\\\<^sub>ii_nres\" by simp\n\nlemma expand_autoref[autoref_rules]:\n assumes ID: \"PREFER_id R\"\n assumes A: \"(n_ns', n_ns) \n \\ \\unit_rel,R\\node_rel \\\\<^sub>r \\\\unit_rel,R\\node_rel\\list_set_rel\"\n assumes B: \"SIDE_PRECOND (\n let (n,ns)=n_ns in inj_on name ns \\ (\\n'\\ns. name n > name n')\n )\"\n shows \"(expand_impl n_ns', \n (OP expand_aimpl\n ::: \\unit_rel,R\\node_rel \\\\<^sub>r \\\\unit_rel,R\\node_rel\\list_set_rel \n \\ \\nat_rel \\\\<^sub>r \\\\unit_rel,R\\node_rel\\list_set_rel\\nres_rel)$n_ns) \n \\ \\nat_rel \\\\<^sub>r \\\\unit_rel,R\\node_rel\\list_set_rel\\nres_rel\"\nproof simp\n from ID A B have \n 1: \"(n_ns, n_ns) \\ Id \\ {(_,(n,ns)). \\n'\\ns. name n > name n'}\"\n and 2: \"(n_ns', n_ns) \n \\ \\unit_rel,Id\\node_rel \\\\<^sub>r \\\\unit_rel,Id\\node_rel\\ls_nds_rel\"\n unfolding ls_nds_rel_def\n apply -\n apply auto []\n apply (cases n_ns')\n apply auto []\n done\n\n have [simp]: \"single_valued (nat_rel \\\\<^sub>r \\\\unit_rel, Id\\node_rel\\list_set_rel)\"\n by tagged_solver\n\n\n have [relator_props]: \"\\R. single_valued (Id \\ R)\"\n by (metis IntE single_valuedD single_valuedI single_valued_Id)\n \n have [simp]: \"single_valued ((nat_rel \\\\<^sub>r \\\\unit_rel, Id\\node_rel\\ls_nds_rel) O\n (Id \\ {(_, n, ns). \\n'\\ns. name n' < n}))\"\n by (tagged_solver)\n \n from expand_impl.refine[THEN fun_relD, OF 2, THEN nres_relD]\n show \"(expand_impl n_ns', expand_aimpl n_ns)\n \\ \\nat_rel \\\\<^sub>r \\\\unit_rel, R\\node_rel\\list_set_rel\\nres_rel\"\n apply -\n apply (rule nres_relI)\n using ID\n apply (simp add: pw_le_iff refine_pw_simps)\n apply (fastforce simp: ls_nds_rel_def)\n done\nqed\n\nend\n\n\nschematic_goal expand_code_aux: \"RETURN ?c \\ expand_impl n_ns\"\n unfolding expand_impl_def\n by (refine_transfer the_resI)\nconcrete_definition expand_code uses expand_code_aux\nprepare_code_thms expand_code_def\nlemmas [refine_transfer] = expand_code.refine \n\n\nschematic_goal create_graph_impl_aux: \n assumes ID: \"R=Id\"\n shows \"(?c, create_graph_aimpl) \n \\ \\R\\ltlr_rel \\ \\\\\\unit_rel,R\\node_rel\\list_set_rel\\nres_rel\"\n unfolding ID\n unfolding create_graph_aimpl_def[abs_def] expand_init_def expand_new_name_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\nconcrete_definition create_graph_impl uses create_graph_impl_aux\n\nlemmas [autoref_rules] = create_graph_impl.refine[OF PREFER_id_D]\n\nschematic_goal create_graph_code_aux: \"RETURN ?c \\ create_graph_impl \\\" \n unfolding create_graph_impl_def\n by refine_transfer\nconcrete_definition create_graph_code uses create_graph_code_aux\nlemmas [refine_transfer] = create_graph_code.refine\n\n\nschematic_goal create_name_gba_impl_aux: \n \"(?c, (create_name_gba_aimpl:: 'a::linorder ltlr \\ _)) \n \\ \\Id\\ltlr_rel \\ (?R::(?'c\\_) set)\"\n unfolding create_name_gba_aimpl_def[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal, trace))\n done\nconcrete_definition create_name_gba_impl uses create_name_gba_impl_aux\n\nlemma create_name_gba_autoref[autoref_rules]:\n assumes \"PREFER_id R\"\n shows\n \"(create_name_gba_impl, create_name_gba)\n \\ \\R\\ltlr_rel \\ \\gbav_impl_rel_ext unit_rel nat_rel (\\R\\fun_set_rel)\\nres_rel\" \n (is \"_:_\\\\?R\\nres_rel\")\nproof (intro fun_relI nres_relI)\n fix \\ \\'\n assume A: \"(\\,\\')\\\\R\\ltlr_rel\"\n from assms have RID[simp]: \"R=Id\" by simp\n \n note create_name_gba_impl.refine[THEN fun_relD,THEN nres_relD, OF A[unfolded RID]]\n also note create_name_gba_aimpl_refine\n finally show \"create_name_gba_impl \\ \\ \\ ?R (create_name_gba \\')\" by simp\nqed\n \nschematic_goal create_name_gba_code_aux: \"RETURN ?c \\ create_name_gba_impl \\\" \n unfolding create_name_gba_impl_def\n by (refine_transfer (post))\nconcrete_definition create_name_gba_code uses create_name_gba_code_aux\nlemmas [refine_transfer] = create_name_gba_code.refine\n\nschematic_goal create_name_igba_impl_aux: \n assumes RID: \"R=Id\"\n shows \"(?c,create_name_igba)\\\n \\R\\ltlr_rel \\ \\igbav_impl_rel_ext unit_rel nat_rel (\\R\\fun_set_rel)\\nres_rel\"\n unfolding RID\n unfolding create_name_igba_def[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (trace, keep_goal))\n done\nconcrete_definition create_name_igba_impl uses create_name_igba_impl_aux\nlemmas [autoref_rules] = create_name_igba_impl.refine[OF PREFER_id_D]\n\nschematic_goal create_name_igba_code_aux: \"RETURN ?c \\ create_name_igba_impl \\\" \n unfolding create_name_igba_impl_def\n by (refine_transfer (post))\nconcrete_definition create_name_igba_code uses create_name_igba_code_aux\nlemmas [refine_transfer] = create_name_igba_code.refine\n\nexport_code create_name_igba_code checking SML\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LTL_to_GBA/LTL_to_GBA_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2658476869407446}} {"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System *)\n(* File: Architecture_D2_3c.thy *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK) *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk *)\n(******************************************************************************)\n\nsection {* Railways Architecture *}\n\ntheory Architecture_D2_3c\nimports fmi\nbegin recall_syntax\n\nsubsection {* Preliminaries *}\n\nsubsubsection {* Track Segments *}\n\ndefinition \"CDV1 = (1::fmi2Integer)\"\ndefinition \"CDV2 = (2::fmi2Integer)\"\ndefinition \"CDV3 = (3::fmi2Integer)\"\ndefinition \"CDV4 = (4::fmi2Integer)\"\ndefinition \"CDV5 = (5::fmi2Integer)\"\ndefinition \"CDV6 = (6::fmi2Integer)\"\ndefinition \"CDV7 = (7::fmi2Integer)\"\ndefinition \"CDV8 = (8::fmi2Integer)\"\ndefinition \"CDV9 = (9::fmi2Integer)\"\ndefinition \"CDV10 = (10::fmi2Integer)\"\ndefinition \"CDV11 = (11::fmi2Integer)\"\n\nsubsubsection {* Available Routes *}\n\ndefinition \"V1Q1 = (1::fmi2Integer)\"\ndefinition \"V1Q2 = (2::fmi2Integer)\"\ndefinition \"Q2V2 = (3::fmi2Integer)\"\ndefinition \"V1Q3 = (4::fmi2Integer)\"\ndefinition \"Q3V2 = (5::fmi2Integer)\"\n\nsubsubsection {* Signal Encoding *}\n\ndefinition \"RED == False\"\ndefinition \"GREEN == True\"\n\nfun signals :: \"(bool \\ bool \\ bool) \\ fmi2Integer\" where\n\"signals (s1, s2, s3) =\n (if s1 then 1 else 0) +\n (if s2 then 2 else 0) +\n (if s3 then 4 else 0)\"\n\nsubsubsection {* Switch Encoding *}\n\ndefinition \"STRAIGHT == False\"\ndefinition \"DIVERGING == True\"\n\nfun switches :: \"(bool \\ bool \\ bool \\ bool \\ bool) \\ fmi2Integer\" where\n\"switches (sw1, sw2, sw3, sw4, sw5) =\n (if sw1 then 1 else 0) +\n (if sw2 then 2 else 0) +\n (if sw3 then 4 else 0) +\n (if sw4 then 8 else 0) +\n (if sw5 then 16 else 0)\"\n\nsubsection {* Model Instantiation *}\n\nsubsubsection {* Railways FMUs *}\n\naxiomatization\n train1 :: \"FMI2COMP\" and\n train2 :: \"FMI2COMP\" and\n merger :: \"FMI2COMP\" and\n interlocking :: \"FMI2COMP\" where\n fmus_distinct: \"distinct [train1, train2, merger, interlocking]\" and\n FMI2COMP_def: \"FMI2COMP = {train1, train2, merger, interlocking}\"\n\noverloading\n railways_FMUs \\ \"FMUs :: FMI2COMP list\"\nbegin\n definition railways_FMUs :: \"FMI2COMP list\" where\n \"railways_FMUs = [train1, train2, merger, interlocking]\"\nend\n\nparagraph {* Proof Support *}\n\nlemma fmu_simps [simp]:\n\"train1 \\ train2\"\n\"train1 \\ merger\"\n\"train1 \\ interlocking\"\n\"train2 \\ train1\"\n\"train2 \\ merger\"\n\"train2 \\ interlocking\"\n\"merger \\ train1\"\n\"merger \\ train2\"\n\"merger \\ interlocking\"\n\"interlocking \\ train1\"\n\"interlocking \\ train2\"\n\"interlocking \\ merger\"\nusing fmus_distinct apply (auto)\ndone\n\nsubsubsection {* Parameters *}\n\noverloading\n railways_parameters \\ \"parameters :: (FMI2COMP \\ VAR \\ VAL) list\"\nbegin\n definition railways_parameters :: \"(FMI2COMP \\ VAR \\ VAL) list\" where\n \"railways_parameters = [\n (train1, $max_speed:{fmi2Real}\\<^sub>u, InjU (4.16::real)),\n (train2, $max_speed:{fmi2Real}\\<^sub>u, InjU (4.16::real)),\n (train1, $fixed_route:{fmi2Integer}\\<^sub>u, InjU V1Q2),\n (train2, $fixed_route:{fmi2Integer}\\<^sub>u, InjU Q3V2)]\"\nend\n\nsubsubsection {* Inputs and Outputs *}\n\noverloading\n railways_inputs \\ \"inputs :: PORT list\"\nbegin\n definition railways_inputs :: \"PORT list\" where\n \"railways_inputs = [\n (train1, $signals:{fmi2Integer}\\<^sub>u),\n (train1, $switches:{fmi2Integer}\\<^sub>u),\n (train2, $signals:{fmi2Integer}\\<^sub>u),\n (train2, $switches:{fmi2Integer}\\<^sub>u),\n (merger, $track_segment1:{fmi2Integer}\\<^sub>u),\n (merger, $track_segment2:{fmi2Integer}\\<^sub>u),\n (merger, $telecommand1:{fmi2Integer}\\<^sub>u),\n (merger, $telecommand2:{fmi2Integer}\\<^sub>u),\n (interlocking, $CDV:{fmi2Integer}\\<^sub>u),\n (interlocking, $TC:{fmi2Integer}\\<^sub>u)]\"\nend\n\noverloading\n railways_outputs \\ \"outputs :: PORT list\"\nbegin\n definition railways_outputs :: \"PORT list\" where\n \"railways_outputs = [\n (train1, $track_segment:{fmi2Integer}\\<^sub>u),\n (train1, $telecommand:{fmi2Integer}\\<^sub>u),\n (train2, $track_segment:{fmi2Integer}\\<^sub>u),\n (train2, $telecommand:{fmi2Integer}\\<^sub>u),\n (merger, $CDV:{fmi2Integer}\\<^sub>u),\n (merger, $TC:{fmi2Integer}\\<^sub>u),\n (merger, $collision:{fmi2Boolean}\\<^sub>u),\n (merger, $derailment:{fmi2Boolean}\\<^sub>u),\n (interlocking, $signals:{fmi2Integer}\\<^sub>u),\n (interlocking, $switches:{fmi2Integer}\\<^sub>u)]\"\nend\n\nsubsubsection {* Initial Values *}\n\ntext {* The following constants have to be defined as appropriate. *}\n\ndefinition \"initialSignals = InjU (signals (RED, RED, RED))\"\ndefinition \"initialSwitches =\n InjU (switches (STRAIGHT, STRAIGHT, STRAIGHT, STRAIGHT, STRAIGHT))\"\ndefinition \"initialTrack1 = InjU CDV3\"\ndefinition \"initialTrack2 = InjU CDV2\"\n\noverloading\n railways_initialValues \\ \"initialValues :: (PORT \\ VAL) list\"\nbegin\n definition railways_initialValues :: \"(PORT \\ VAL) list\" where\n \"railways_initialValues = [\n ((train1, $signals:{fmi2Integer}\\<^sub>u), initialSignals),\n ((train1, $switches:{fmi2Integer}\\<^sub>u), initialSwitches),\n ((train2, $signals:{fmi2Integer}\\<^sub>u), initialSignals),\n ((train2, $switches:{fmi2Integer}\\<^sub>u), initialSwitches),\n ((merger, $track_segment1:{fmi2Integer}\\<^sub>u), initialTrack1),\n ((merger, $track_segment2:{fmi2Integer}\\<^sub>u), initialTrack2),\n ((merger, $telecommand1:{fmi2Integer}\\<^sub>u), undefined),\n ((merger, $telecommand2:{fmi2Integer}\\<^sub>u), undefined),\n ((interlocking, $CDV:{fmi2Integer}\\<^sub>u), undefined),\n ((interlocking, $TC:{fmi2Integer}\\<^sub>u), undefined)]\"\nend\n\nsubsubsection {* Port Dependency Graph (\\pdg\\) *}\n\ndefinition pdg :: \"(PORT \\ PORT) list\" where\n\"pdg = [\n ((train1, $track_segment:{fmi2Integer}\\<^sub>u), (merger, $track_segment1:{fmi2Integer}\\<^sub>u)),\n ((train2, $track_segment:{fmi2Integer}\\<^sub>u), (merger, $track_segment2:{fmi2Integer}\\<^sub>u)),\n ((train1, $telecommand:{fmi2Integer}\\<^sub>u), (merger, $telecommand1:{fmi2Integer}\\<^sub>u)),\n ((train2, $telecommand:{fmi2Integer}\\<^sub>u), (merger, $telecommand2:{fmi2Integer}\\<^sub>u)),\n ((merger, $CDV:{fmi2Integer}\\<^sub>u), (interlocking, $CDV:{fmi2Integer}\\<^sub>u)),\n ((merger, $TC:{fmi2Integer}\\<^sub>u), (interlocking, $TC:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $signals:{fmi2Integer}\\<^sub>u), (train1, $signals:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $signals:{fmi2Integer}\\<^sub>u), (train2, $signals:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $switches:{fmi2Integer}\\<^sub>u), (train1, $switches:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $switches:{fmi2Integer}\\<^sub>u), (train2, $switches:{fmi2Integer}\\<^sub>u))\n]\"\n\nsubsubsection {* Internal Direct Dependencies (\\idd\\) *}\n\ndefinition idd :: \"(PORT \\ PORT) list\" where\n\"idd = [\n ((merger, $track_segment1:{fmi2Integer}\\<^sub>u), (merger, $CDV:{fmi2Integer}\\<^sub>u)),\n ((merger, $track_segment2:{fmi2Integer}\\<^sub>u), (merger, $CDV:{fmi2Integer}\\<^sub>u)),\n ((merger, $telecommand1:{fmi2Integer}\\<^sub>u), (merger, $TC:{fmi2Integer}\\<^sub>u)),\n ((merger, $telecommand2:{fmi2Integer}\\<^sub>u), (merger, $TC:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $CDV:{fmi2Integer}\\<^sub>u), (interlocking, $signals:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $CDV:{fmi2Integer}\\<^sub>u), (interlocking, $switches:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $TC:{fmi2Integer}\\<^sub>u), (interlocking, $signals:{fmi2Integer}\\<^sub>u)),\n ((interlocking, $TC:{fmi2Integer}\\<^sub>u), (interlocking, $switches:{fmi2Integer}\\<^sub>u))\n]\"\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/Architecture_D2_3c.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4148988457967689, "lm_q1q2_score": 0.2657990767491001}} {"text": "(* Title: HOL/Auth/n_germanish_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanish Protocol Case Study*} \n\ntheory n_germanish_lemma_inv__3_on_rules imports n_germanish_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_t1 i)\\\n (\\ i. i\\N\\r=n_t2 i)\\\n (\\ i. i\\N\\r=n_t3 i)\\\n (\\ i. i\\N\\r=n_t4 i)\\\n (\\ i. i\\N\\r=n_t5 i)\\\n (\\ i. i\\N\\r=n_t6 N i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t2 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t2Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t3 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t3Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t4 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t4Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t5 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t5Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_t6 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_t6Vsinv__3) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/germanish/n_germanish_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.2657990710557443}} {"text": "section \\Arrays with Dynamic Resizing\\\ntheory Dynamic_Array\nimports \"Refine_Imperative_HOL.IICF_List\" \"Separation_Logic_Imperative_HOL.Array_Blit\" \"Refine_Imperative_HOL.IICF_Array\" \"Refine_Imperative_HOL.IICF_Map\"\nbegin\n\n(* TODO: Move to Array_Blit *)\ndefinition \"array_grow' a n x \\ do {\n l\\Array.len a;\n a'\\Array.new (l+n) x;\n blit a 0 a' 0 l;\n return a'\n}\"\n\nlemma array_grow'_rule[sep_heap_rules]:\n shows \"\n < a\\\\<^sub>ala > \n array_grow' a n x \n <\\a'. a'\\\\<^sub>a (la @ replicate n x)>\\<^sub>t\"\n unfolding array_grow'_def\n by sep_auto\n\n(* TODO: Move to IICF_List *)\nsepref_decl_op list_grow: \n \"\\xs n x. xs@replicate n x\" :: \"\\A\\list_rel \\ nat_rel \\ A \\ \\A\\list_rel\" .\n\n\ndefinition \"nff_\\ dflt l i \\ if i \\\\<^sub>Al. a \\\\<^sub>a l * \\(f = nff_\\ dflt l)\"\n\ndefinition [code_unfold]: \"dyn_array_new_sz dflt n \\ Array.new n dflt\"\n\nlemma dyn_array_new_sz_rl[sep_heap_rules]: \n \" dyn_array_new_sz dflt n <\\r. is_nff dflt (\\_. dflt) r>\"\n unfolding dyn_array_new_sz_def is_nff_def nff_\\_def\n by sep_auto\n\ndefinition \"array_get_dyn dflt a i \\ do {\n \\<^cancel>\\\\nth_oo dflt a i\\\\\n l \\ Array.len a;\n if i \n array_get_dyn dflt a i \n < \\r. is_nff dflt f a * \\(r = f i) >\"\n unfolding array_get_dyn_def nth_oo_def\n by (sep_auto simp: nff_\\_def is_nff_def)\n\ndefinition \"array_set_dyn dflt a i v \\ do {\n l \\ Array.len a;\n if i array_grow a ns dflt;\n Array.upd i v a\n }\n}\"\n\nlemma nff_\\_upd: \"\\i < length l\\ \\ nff_\\ dflt (l[i := v]) = (nff_\\ dflt l)(i := v)\"\n by (auto simp: nff_\\_def)\n\n\n\nlemma array_set_dyn_rule[sep_heap_rules]: \"\n < is_nff dflt f a >\n array_set_dyn dflt a i v\n <\\r. is_nff dflt (f(i:=v)) r >\\<^sub>t \n \"\n unfolding array_set_dyn_def is_nff_def upd_oo_def\n by (sep_auto simp: nff_\\_upd nff_\\_append_default)\n\nend\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/VerifyThis2018/lib/Dynamic_Array.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.26579906319502644}} {"text": "section \\Lemmas concerning paths to instantiate locale Postdomination\\\n\ntheory ValidPaths imports WellFormed \"../StaticInter/Postdomination\" begin\n\nsubsection \\Intraprocedural paths from method entry and to method exit\\\n\n\nabbreviation path :: \"wf_prog \\ node \\ edge list \\ node \\ bool\" (\"_ \\ _ -_\\* _\")\n where \"wfp \\ n -as\\* n' \\ CFG.path sourcenode targetnode (valid_edge wfp) n as n'\"\n\ndefinition label_incrs :: \"edge list \\ nat \\ edge list\" (\"_ \\s _\" 60)\n where \"as \\s i \\ map (\\((p,n),et,(p',n')). ((p,n \\ i),et,(p',n' \\ i))) as\"\n\n\ndeclare One_nat_def [simp del]\n\n\n\nsubsubsection \\From \\prog\\ to \\prog;;c\\<^sub>2\\\\\n\n\nlemma Proc_CFG_edge_SeqFirst_nodes_Label:\n \"prog \\ Label l -et\\\\<^sub>p Label l' \\ prog;;c\\<^sub>2 \\ Label l -et\\\\<^sub>p Label l'\"\nproof(induct prog \"Label l\" et \"Label l'\" rule:Proc_CFG.induct)\n case (Proc_CFG_SeqSecond c\\<^sub>2' n et n' c\\<^sub>1)\n hence \"(c\\<^sub>1;; c\\<^sub>2');; c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p n' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_SeqSecond)\n with \\n \\ #:c\\<^sub>1 = Label l\\ \\n' \\ #:c\\<^sub>1 = Label l'\\ show ?case by fastforce\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2')\n hence \"if (b) c\\<^sub>1 else c\\<^sub>2';; c\\<^sub>2 \\ n \\ 1 -et\\\\<^sub>p n' \\ 1\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_CondThen)\n with \\n \\ 1 = Label l\\ \\n' \\ 1 = Label l'\\ show ?case by fastforce\nnext\n case (Proc_CFG_CondElse c\\<^sub>1 n et n' b c\\<^sub>2')\n hence \"if (b) c\\<^sub>2' else c\\<^sub>1 ;; c\\<^sub>2 \\ n \\ #:c\\<^sub>2' + 1 -et\\\\<^sub>p n' \\ (#:c\\<^sub>2' + 1)\" \n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_CondElse)\n with \\n \\ #:c\\<^sub>2' + 1 = Label l\\ \\n' \\ #:c\\<^sub>2' + 1 = Label l'\\ show ?case by fastforce\nnext\n case (Proc_CFG_WhileBody c' n et n' b)\n hence \"while (b) c';; c\\<^sub>2 \\ n \\ 2 -et\\\\<^sub>p n' \\ 2\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_WhileBody)\n with \\n \\ 2 = Label l\\ \\n' \\ 2 = Label l'\\ show ?case by fastforce\nnext\n case (Proc_CFG_WhileBodyExit c' n et b)\n hence \"while (b) c';; c\\<^sub>2 \\ n \\ 2 -et\\\\<^sub>p Label 0\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_WhileBodyExit)\n with \\n \\ 2 = Label l\\ \\0 = l'\\ show ?case by fastforce\nqed (auto intro:Proc_CFG.intros)\n\n\nlemma Proc_CFG_edge_SeqFirst_source_Label:\n assumes \"prog \\ Label l -et\\\\<^sub>p n'\"\n obtains nx where \"prog;;c\\<^sub>2 \\ Label l -et\\\\<^sub>p nx\"\nproof(atomize_elim)\n from \\prog \\ Label l -et\\\\<^sub>p n'\\ obtain n where \"prog \\ n -et\\\\<^sub>p n'\" and \"Label l = n\"\n by simp\n thus \"\\nx. prog;;c\\<^sub>2 \\ Label l -et\\\\<^sub>p nx\"\n proof(induct prog n et n' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqSecond c\\<^sub>2' n et n' c\\<^sub>1)\n show ?case\n proof(cases \"n' = Exit\")\n case True\n with \\c\\<^sub>2' \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\ have \"c\\<^sub>1;; c\\<^sub>2' \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p Exit \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG.Proc_CFG_SeqSecond)\n moreover from \\n \\ Entry\\ have \"n \\ #:c\\<^sub>1 \\ Entry\" by(cases n) auto\n ultimately\n have \"c\\<^sub>1;; c\\<^sub>2';; c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p Label (#:c\\<^sub>1;; c\\<^sub>2')\"\n by(fastforce intro:Proc_CFG_SeqConnect)\n with \\Label l = n \\ #:c\\<^sub>1\\ show ?thesis by fastforce\n next\n case False\n with Proc_CFG_SeqSecond\n have \"(c\\<^sub>1;; c\\<^sub>2');; c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p n' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_SeqSecond)\n with \\Label l = n \\ #:c\\<^sub>1\\ show ?thesis by fastforce\n qed\n next\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2')\n show ?case\n proof(cases \"n' = Exit\")\n case True\n with \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\\n have \"if (b) c\\<^sub>1 else c\\<^sub>2' \\ n \\ 1 -et\\\\<^sub>p Exit \\ 1\"\n by(fastforce intro:Proc_CFG.Proc_CFG_CondThen)\n moreover from \\n \\ Entry\\ have \"n \\ 1 \\ Entry\" by(cases n) auto\n ultimately\n have \"if (b) c\\<^sub>1 else c\\<^sub>2';; c\\<^sub>2 \\ n \\ 1 -et\\\\<^sub>p Label (#:if (b) c\\<^sub>1 else c\\<^sub>2')\"\n by(fastforce intro:Proc_CFG_SeqConnect)\n with \\Label l = n \\ 1\\ show ?thesis by fastforce\n next\n case False\n hence \"n' \\ 1 \\ Exit\" by(cases n') auto\n with Proc_CFG_CondThen\n have \"if (b) c\\<^sub>1 else c\\<^sub>2';; c\\<^sub>2 \\ Label l -et\\\\<^sub>p n' \\ 1\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_CondThen)\n with \\Label l = n \\ 1\\ show ?thesis by fastforce\n qed\n next\n case (Proc_CFG_CondElse c\\<^sub>1 n et n' b c\\<^sub>2')\n show ?case\n proof(cases \"n' = Exit\")\n case True\n with \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\\n have \"if (b) c\\<^sub>2' else c\\<^sub>1 \\ n \\ (#:c\\<^sub>2' + 1) -et\\\\<^sub>p Exit \\ (#:c\\<^sub>2' + 1)\"\n by(fastforce intro:Proc_CFG.Proc_CFG_CondElse)\n moreover from \\n \\ Entry\\ have \"n \\ (#:c\\<^sub>2' + 1) \\ Entry\" by(cases n) auto\n ultimately\n have \"if (b) c\\<^sub>2' else c\\<^sub>1;; c\\<^sub>2 \\ n \\ (#:c\\<^sub>2' + 1) -et\\\\<^sub>p \n Label (#:if (b) c\\<^sub>2' else c\\<^sub>1)\"\n by(fastforce intro:Proc_CFG_SeqConnect)\n with \\Label l = n \\ (#:c\\<^sub>2' + 1)\\ show ?thesis by fastforce\n next\n case False\n hence \"n' \\ (#:c\\<^sub>2' + 1) \\ Exit\" by(cases n') auto\n with Proc_CFG_CondElse\n have \"if (b) c\\<^sub>2' else c\\<^sub>1 ;; c\\<^sub>2 \\ Label l -et\\\\<^sub>p n' \\ (#:c\\<^sub>2' + 1)\"\n by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_CondElse)\n with \\Label l = n \\ (#:c\\<^sub>2' + 1)\\ show ?thesis by fastforce\n qed\n qed (auto intro:Proc_CFG.intros)\nqed\n\n\nlemma Proc_CFG_edge_SeqFirst_target_Label:\n \"\\prog \\ n -et\\\\<^sub>p n'; Label l' = n'\\ \\ prog;;c\\<^sub>2 \\ n -et\\\\<^sub>p Label l'\"\nproof(induct prog n et n' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqSecond c\\<^sub>2' n et n' c\\<^sub>1)\n from \\Label l' = n' \\ #:c\\<^sub>1\\ have \"n' \\ Exit\" by(cases n') auto\n with Proc_CFG_SeqSecond\n show ?case by(fastforce intro:Proc_CFG_SeqFirst intro:Proc_CFG.Proc_CFG_SeqSecond)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2')\n from \\Label l' = n' \\ 1\\ have \"n' \\ Exit\" by(cases n') auto\n with Proc_CFG_CondThen\n show ?case by(fastforce intro:Proc_CFG_SeqFirst Proc_CFG.Proc_CFG_CondThen)\nqed (auto intro:Proc_CFG.intros)\n\n\nlemma PCFG_edge_SeqFirst_source_Label:\n assumes \"prog,procs \\ (p,Label l) -et\\ (p',n')\"\n obtains nx where \"prog;;c\\<^sub>2,procs \\ (p,Label l) -et\\ (p',nx)\"\nproof(atomize_elim)\n from \\prog,procs \\ (p,Label l) -et\\ (p',n')\\\n show \"\\nx. prog;;c\\<^sub>2,procs \\ (p,Label l) -et\\ (p',nx)\"\n proof(induct \"(p,Label l)\" et \"(p',n')\" rule:PCFG.induct)\n case (Main et)\n from \\prog \\ Label l -IEdge et\\\\<^sub>p n'\\\n obtain nx' where \"prog;;c\\<^sub>2 \\ Label l -IEdge et\\\\<^sub>p nx'\"\n by(auto elim:Proc_CFG_edge_SeqFirst_source_Label)\n with \\Main = p\\ \\Main = p'\\ show ?case \n by(fastforce dest:PCFG.Main)\n next\n case (Proc ins outs c et ps)\n from \\containsCall procs prog ps p\\\n have \"containsCall procs (prog;;c\\<^sub>2) ps p\" by simp\n with Proc show ?case by(fastforce dest:PCFG.Proc)\n next\n case (MainCall es rets nx ins outs c)\n from \\prog \\ Label l -CEdge (p', es, rets)\\\\<^sub>p nx\\\n obtain lx where [simp]:\"nx = Label lx\" by(fastforce dest:Proc_CFG_Call_Labels)\n with \\prog \\ Label l -CEdge (p', es, rets)\\\\<^sub>p nx\\\n have \"prog;;c\\<^sub>2 \\ Label l -CEdge (p', es, rets)\\\\<^sub>p Label lx\"\n by(auto intro:Proc_CFG_edge_SeqFirst_nodes_Label)\n with MainCall show ?case by(fastforce dest:PCFG.MainCall)\n next\n case (ProcCall ins outs c es' rets' l' ins' outs' c' ps)\n from \\containsCall procs prog ps p\\ \n have \"containsCall procs (prog;;c\\<^sub>2) ps p\" by simp\n with ProcCall show ?case by(fastforce intro:PCFG.ProcCall)\n next\n case (MainCallReturn px es rets)\n from \\prog \\ Label l -CEdge (px, es, rets)\\\\<^sub>p n'\\ \\Main = p\\\n obtain nx'' where \"prog;;c\\<^sub>2 \\ Label l -CEdge (px, es, rets)\\\\<^sub>p nx''\"\n by(auto elim:Proc_CFG_edge_SeqFirst_source_Label)\n with MainCallReturn show ?case by(fastforce dest:PCFG.MainCallReturn)\n next\n case (ProcCallReturn ins outs c px' es' rets' ps)\n from \\containsCall procs prog ps p\\\n have \"containsCall procs (prog;;c\\<^sub>2) ps p\" by simp\n with ProcCallReturn show ?case by(fastforce dest!:PCFG.ProcCallReturn)\n qed\nqed\n\n\nlemma PCFG_edge_SeqFirst_target_Label:\n \"prog,procs \\ (p,n) -et\\ (p',Label l') \n \\ prog;;c\\<^sub>2,procs \\ (p,n) -et\\ (p',Label l')\"\nproof(induct \"(p,n)\" et \"(p',Label l')\" rule:PCFG.induct)\n case Main\n thus ?case by(fastforce dest:Proc_CFG_edge_SeqFirst_target_Label intro:PCFG.Main)\nnext\n case (Proc ins outs c et ps)\n from \\containsCall procs prog ps p\\ \n have \"containsCall procs (prog;;c\\<^sub>2) ps p\" by simp\n with Proc show ?case by(fastforce dest:PCFG.Proc)\nnext\n case MainReturn thus ?case\n by(fastforce dest:Proc_CFG_edge_SeqFirst_target_Label \n intro!:PCFG.MainReturn[simplified])\nnext\n case (ProcReturn ins outs c lx es' rets' ins' outs' c' ps)\n from \\containsCall procs prog ps p'\\ \n have \"containsCall procs (prog;;c\\<^sub>2) ps p'\" by simp\n with ProcReturn show ?case by(fastforce intro:PCFG.ProcReturn)\nnext\n case MainCallReturn thus ?case\n by(fastforce dest:Proc_CFG_edge_SeqFirst_target_Label intro:PCFG.MainCallReturn)\nnext\n case (ProcCallReturn ins outs c px' es' rets' ps)\n from \\containsCall procs prog ps p\\ \n have \"containsCall procs (prog;;c\\<^sub>2) ps p\" by simp\n with ProcCallReturn show ?case by(fastforce dest!:PCFG.ProcCallReturn)\nqed\n\n\nlemma path_SeqFirst:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" and \"Rep_wf_prog wfp' = (prog;;c\\<^sub>2,procs)\"\n shows \"\\wfp \\ (p,n) -as\\* (p,Label l); \\a \\ set as. intra_kind (kind a)\\\n \\ wfp' \\ (p,n) -as\\* (p,Label l)\"\nproof(induct \"(p,n)\" as \"(p,Label l)\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (p, Label l)\\ \n \\Rep_wf_prog wfp = (prog, procs)\\ \\Rep_wf_prog wfp' = (prog;; c\\<^sub>2, procs)\\\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (p, Label l)\"\n apply(auto simp:ProcCFG.valid_node_def valid_edge_def)\n apply(erule PCFG_edge_SeqFirst_source_Label,fastforce)\n by(drule PCFG_edge_SeqFirst_target_Label,fastforce)\n thus ?case by(fastforce intro:ProcCFG.empty_path)\nnext\n case (Cons_path n'' as a nx)\n note IH = \\\\n. \\n'' = (p, n); \\a\\set as. intra_kind (kind a)\\\n \\ wfp' \\ (p, n) -as\\* (p, Label l)\\\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \\Rep_wf_prog wfp' = (prog;;c\\<^sub>2,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp a\\ \\sourcenode a = (p, nx)\\ \\targetnode a = n''\\\n \\intra_kind (kind a)\\ wf \n obtain nx' where \"n'' = (p,nx')\"\n by(auto elim:PCFG.cases simp:valid_edge_def intra_kind_def)\n from IH[OF this \\\\a\\set as. intra_kind (kind a)\\]\n have path:\"wfp' \\ (p, nx') -as\\* (p, Label l)\" .\n have \"valid_edge wfp' a\"\n proof(cases nx')\n case (Label lx)\n with \\valid_edge wfp a\\ \\sourcenode a = (p, nx)\\ \\targetnode a = n''\\\n \\n'' = (p,nx')\\ show ?thesis\n by(fastforce intro:PCFG_edge_SeqFirst_target_Label \n simp:intra_kind_def valid_edge_def)\n next\n case Entry\n with \\valid_edge wfp a\\ \\targetnode a = n''\\ \\n'' = (p,nx')\\\n \\intra_kind (kind a)\\ have False \n by(auto elim:PCFG.cases simp:valid_edge_def intra_kind_def)\n thus ?thesis by simp\n next\n case Exit\n with path \\\\a\\set as. intra_kind (kind a)\\ have False \n by(induct \"(p,nx')\" as \"(p,Label l)\" rule:ProcCFG.path.induct)\n (auto elim!:PCFG.cases simp:valid_edge_def intra_kind_def)\n thus ?thesis by simp\n qed\n with \\sourcenode a = (p, nx)\\ \\targetnode a = n''\\ \\n'' = (p,nx')\\ path\n show ?case by(fastforce intro:ProcCFG.Cons_path)\nqed\n\n\nsubsubsection \\From \\prog\\ to \\c\\<^sub>1;;prog\\\\\n\nlemma Proc_CFG_edge_SeqSecond_source_not_Entry:\n \"\\prog \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \\ c\\<^sub>1;;prog \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p n' \\ #:c\\<^sub>1\"\nby(induct rule:Proc_CFG.induct)(fastforce intro:Proc_CFG_SeqSecond Proc_CFG.intros)+\n\n\nlemma PCFG_Main_edge_SeqSecond_source_not_Entry:\n \"\\prog,procs \\ (Main,n) -et\\ (p',n'); n \\ Entry; intra_kind et; well_formed procs\\\n \\ c\\<^sub>1;;prog,procs \\ (Main,n \\ #:c\\<^sub>1) -et\\ (p',n' \\ #:c\\<^sub>1)\"\nproof(induct \"(Main,n)\" et \"(p',n')\" rule:PCFG.induct)\n case Main\n thus ?case\n by(fastforce dest:Proc_CFG_edge_SeqSecond_source_not_Entry intro:PCFG.Main)\nnext\n case (MainCallReturn p es rets)\n from \\prog \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \\n \\ Entry\\\n have \"c\\<^sub>1;;prog \\ n \\ #:c\\<^sub>1 -CEdge (p, es, rets)\\\\<^sub>p n' \\ #:c\\<^sub>1\"\n by(rule Proc_CFG_edge_SeqSecond_source_not_Entry)\n with MainCallReturn show ?case by(fastforce intro:PCFG.MainCallReturn)\nqed (auto simp:intra_kind_def)\n\n\nlemma valid_node_Main_SeqSecond:\n assumes \"CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\"\n and \"n \\ Entry\" and \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (c\\<^sub>1;;prog,procs)\"\n shows \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n \\ #:c\\<^sub>1)\"\nproof -\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \\Rep_wf_prog wfp' = (c\\<^sub>1;;prog,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\\\n obtain a where \"prog,procs \\ sourcenode a -kind a\\ targetnode a\"\n and \"(Main,n) = sourcenode a \\ (Main,n) = targetnode a\"\n by(fastforce simp:ProcCFG.valid_node_def valid_edge_def)\n from this \\n \\ Entry\\ wf show ?thesis\n proof(induct \"sourcenode a\" \"kind a\" \"targetnode a\" rule:PCFG.induct)\n case (Main nx nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n from \\n \\ Entry\\ \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"c\\<^sub>1;;prog \\ n \\ #:c\\<^sub>1 -IEdge (kind a)\\\\<^sub>p nx' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_edge_SeqSecond_source_not_Entry)\n hence \"c\\<^sub>1;;prog,procs \\ (Main,n \\ #:c\\<^sub>1) -kind a\\ (Main,nx' \\ #:c\\<^sub>1)\"\n by(rule PCFG.Main)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n assume \"(Main, n) = targetnode a\"\n show ?thesis\n proof(cases \"nx = Entry\")\n case True\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\ \n have \"nx' = Exit \\ nx' = Label 0\" by(fastforce dest:Proc_CFG_EntryD)\n thus ?thesis\n proof\n assume \"nx' = Exit\"\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by simp\n next\n assume \"nx' = Label 0\"\n obtain l etx where \"c\\<^sub>1 \\ Label l -IEdge etx\\\\<^sub>p Exit\" and \"l \\ #:c\\<^sub>1\"\n by(erule Proc_CFG_Exit_edge)\n hence \"c\\<^sub>1;;prog \\ Label l -IEdge etx\\\\<^sub>p Label #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_SeqConnect)\n with \\nx' = Label 0\\ \n have \"c\\<^sub>1;;prog,procs \\ (Main,Label l) -etx\\ (Main,nx'\\#:c\\<^sub>1)\"\n by(fastforce intro:PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis\n by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case False\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"c\\<^sub>1;;prog \\ nx \\ #:c\\<^sub>1 -IEdge (kind a)\\\\<^sub>p nx' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_edge_SeqSecond_source_not_Entry)\n hence \"c\\<^sub>1;;prog,procs \\ (Main,nx \\ #:c\\<^sub>1) -kind a\\ (Main,nx' \\ #:c\\<^sub>1)\"\n by(rule PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n qed\n next\n case (Proc p ins outs c nx n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\ \n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\ have False by fastforce\n thus ?case by simp\n next\n case (MainCall l p es rets n' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ wf \\(p, Entry) = targetnode a\\[THEN sym]\n \\(Main, Label l) = sourcenode a\\[THEN sym]\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p n'\\\n have \"c\\<^sub>1;;prog \\ Label l \\ #:c\\<^sub>1 -CEdge (p, es, rets)\\\\<^sub>p n' \\ #:c\\<^sub>1\"\n by -(rule Proc_CFG_edge_SeqSecond_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"c\\<^sub>1;;prog,procs \\ (Main,Label (l + #:c\\<^sub>1)) \n -(\\s. True):(Main,n' \\ #:c\\<^sub>1)\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es\\ (p,Entry)\"\n by(fastforce intro:PCFG.MainCall)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcCall p ins outs c l p' es' rets' l' ins' outs' c')\n from \\(p, Label l) = sourcenode a\\[THEN sym]\n \\(p', Entry) = targetnode a\\[THEN sym] \\well_formed procs\\\n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainReturn l p es rets l' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ wf \\(p, Exit) = sourcenode a\\[THEN sym]\n \\(Main, Label l') = targetnode a\\[THEN sym]\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l'\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p Label l'\\\n have \"c\\<^sub>1;;prog \\ Label l \\ #:c\\<^sub>1 -CEdge (p, es, rets)\\\\<^sub>p Label l' \\ #:c\\<^sub>1\"\n by -(rule Proc_CFG_edge_SeqSecond_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"c\\<^sub>1;;prog,procs \\ (p,Exit) -(\\cf. snd cf = (Main,Label l' \\ #:c\\<^sub>1))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (Main,Label (l' + #:c\\<^sub>1))\"\n by(fastforce intro:PCFG.MainReturn)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcReturn p ins outs c l p' es' rets' l' ins' outs' c' ps)\n from \\(p', Exit) = sourcenode a\\[THEN sym] \n \\(p, Label l') = targetnode a\\[THEN sym] \\well_formed procs\\\n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainCallReturn nx p es rets nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n from \\n \\ Entry\\ \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"c\\<^sub>1;;prog \\ n \\ #:c\\<^sub>1 -CEdge (p, es, rets)\\\\<^sub>p nx' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_edge_SeqSecond_source_not_Entry)\n hence \"c\\<^sub>1;;prog,procs \\ (Main,n \\ #:c\\<^sub>1) -(\\s. False)\\<^sub>\\\\ (Main,nx' \\ #:c\\<^sub>1)\"\n by -(rule PCFG.MainCallReturn)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n assume \"(Main, n) = targetnode a\"\n from \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"nx \\ Entry\" by(fastforce dest:Proc_CFG_Call_Labels)\n with \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"c\\<^sub>1;;prog \\ nx \\ #:c\\<^sub>1 -CEdge (p, es, rets)\\\\<^sub>p nx' \\ #:c\\<^sub>1\"\n by(fastforce intro:Proc_CFG_edge_SeqSecond_source_not_Entry)\n hence \"c\\<^sub>1;;prog,procs \\ (Main,nx \\ #:c\\<^sub>1) -(\\s. False)\\<^sub>\\\\ (Main,nx' \\ #:c\\<^sub>1)\"\n by -(rule PCFG.MainCallReturn)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym] \n show ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case (ProcCallReturn p ins outs c nx p' es' rets' n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n qed\nqed\n\n\nlemma path_Main_SeqSecond:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" and \"Rep_wf_prog wfp' = (c\\<^sub>1;;prog,procs)\"\n shows \"\\wfp \\ (Main,n) -as\\* (p',n'); \\a \\ set as. intra_kind (kind a); n \\ Entry\\\n \\ wfp' \\ (Main,n \\ #:c\\<^sub>1) -as \\s #:c\\<^sub>1\\* (p',n' \\ #:c\\<^sub>1)\"\nproof(induct \"(Main,n)\" as \"(p',n')\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main, n')\\\n \\n' \\ Entry\\ \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (c\\<^sub>1;;prog,procs)\\\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n' \\ #:c\\<^sub>1)\"\n by(fastforce intro:valid_node_Main_SeqSecond)\n with \\Main = p'\\ show ?case\n by(fastforce intro:ProcCFG.empty_path simp:label_incrs_def)\nnext\n case (Cons_path n'' as a n)\n note IH = \\\\n. \\n'' = (Main, n); \\a\\set as. intra_kind (kind a); n \\ Entry\\ \n \\ wfp' \\ (Main, n \\ #:c\\<^sub>1) -as \\s #:c\\<^sub>1\\* (p', n' \\ #:c\\<^sub>1)\\\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \\Rep_wf_prog wfp' = (c\\<^sub>1;;prog,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\intra_kind (kind a)\\ wf \n obtain nx'' where \"n'' = (Main,nx'')\" and \"nx'' \\ Entry\"\n by(auto elim!:PCFG.cases simp:valid_edge_def intra_kind_def)\n from IH[OF \\n'' = (Main,nx'')\\ \\\\a\\set as. intra_kind (kind a)\\ \\nx'' \\ Entry\\]\n have path:\"wfp' \\ (Main, nx'' \\ #:c\\<^sub>1) -as \\s #:c\\<^sub>1\\* (p', n' \\ #:c\\<^sub>1)\" .\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\n'' = (Main,nx'')\\ \\n \\ Entry\\ \\intra_kind (kind a)\\ wf\n have \"c\\<^sub>1;; prog,procs \\ (Main, n \\ #:c\\<^sub>1) -kind a\\ (Main, nx'' \\ #:c\\<^sub>1)\"\n by(fastforce intro:PCFG_Main_edge_SeqSecond_source_not_Entry simp:valid_edge_def)\n with path \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\ \\n'' = (Main,nx'')\\\n show ?case apply(cases a) apply(clarsimp simp:label_incrs_def)\n by(auto intro:ProcCFG.Cons_path simp:valid_edge_def)\nqed\n\n\nsubsubsection \\From \\prog\\ to \\if (b) prog else c\\<^sub>2\\\\\n\nlemma Proc_CFG_edge_CondTrue_source_not_Entry:\n \"\\prog \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \\ if (b) prog else c\\<^sub>2 \\ n \\ 1 -et\\\\<^sub>p n' \\ 1\"\nby(induct rule:Proc_CFG.induct)(fastforce intro:Proc_CFG_CondThen Proc_CFG.intros)+\n\n\nlemma PCFG_Main_edge_CondTrue_source_not_Entry:\n \"\\prog,procs \\ (Main,n) -et\\ (p',n'); n \\ Entry; intra_kind et; well_formed procs\\\n \\ if (b) prog else c\\<^sub>2,procs \\ (Main,n \\ 1) -et\\ (p',n' \\ 1)\"\nproof(induct \"(Main,n)\" et \"(p',n')\" rule:PCFG.induct)\n case Main\n thus ?case by(fastforce dest:Proc_CFG_edge_CondTrue_source_not_Entry intro:PCFG.Main)\nnext\n case (MainCallReturn p es rets)\n from \\prog \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \\n \\ Entry\\\n have \"if (b) prog else c\\<^sub>2 \\ n \\ 1 -CEdge (p, es, rets)\\\\<^sub>p n' \\ 1\"\n by(rule Proc_CFG_edge_CondTrue_source_not_Entry)\n with MainCallReturn show ?case by(fastforce intro:PCFG.MainCallReturn)\nqed (auto simp:intra_kind_def)\n\n\nlemma valid_node_Main_CondTrue:\n assumes \"CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\"\n and \"n \\ Entry\" and \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (if (b) prog else c\\<^sub>2,procs)\"\n shows \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n \\ 1)\"\nproof -\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (if (b) prog else c\\<^sub>2,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\\\n obtain a where \"prog,procs \\ sourcenode a -kind a\\ targetnode a\"\n and \"(Main,n) = sourcenode a \\ (Main,n) = targetnode a\"\n by(fastforce simp:ProcCFG.valid_node_def valid_edge_def)\n from this \\n \\ Entry\\ wf show ?thesis\n proof(induct \"sourcenode a\" \"kind a\" \"targetnode a\" rule:PCFG.induct)\n case (Main nx nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n from \\n \\ Entry\\ \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"if (b) prog else c\\<^sub>2 \\ n \\ 1 -IEdge (kind a)\\\\<^sub>p nx' \\ 1\"\n by(fastforce intro:Proc_CFG_edge_CondTrue_source_not_Entry)\n hence \"if (b) prog else c\\<^sub>2,procs \\ (Main,n \\ 1) -kind a\\ (Main,nx' \\ 1)\"\n by(rule PCFG.Main)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n assume \"(Main, n) = targetnode a\"\n show ?thesis\n proof(cases \"nx = Entry\")\n case True\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"nx' = Exit \\ nx' = Label 0\" by(fastforce dest:Proc_CFG_EntryD)\n thus ?thesis\n proof\n assume \"nx' = Exit\"\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by simp\n next\n assume \"nx' = Label 0\"\n have \"if (b) prog else c\\<^sub>2 \\ Label 0 \n -IEdge (\\cf. state_check cf b (Some true))\\<^sub>\\\\\\<^sub>p Label 1\"\n by(rule Proc_CFG_CondTrue)\n with \\nx' = Label 0\\ \n have \"if (b) prog else c\\<^sub>2,procs \\ (Main,Label 0) \n -(\\cf. state_check cf b (Some true))\\<^sub>\\\\ (Main,nx' \\ 1)\" \n by(fastforce intro:PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis\n by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case False\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"if (b) prog else c\\<^sub>2 \\ nx \\ 1 -IEdge (kind a)\\\\<^sub>p nx' \\ 1\"\n by(fastforce intro:Proc_CFG_edge_CondTrue_source_not_Entry)\n hence \"if (b) prog else c\\<^sub>2,procs \\ (Main,nx \\ 1) -kind a\\ \n (Main,nx' \\ 1)\" by(rule PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n qed\n next\n case (Proc p ins outs c nx n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainCall l p es rets n' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ \\(p, Entry) = targetnode a\\[THEN sym] \n \\(Main, Label l) = sourcenode a\\[THEN sym] wf\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p n'\\\n have \"if (b) prog else c\\<^sub>2 \\ Label l \\ 1 -CEdge (p, es, rets)\\\\<^sub>p n' \\ 1\"\n by -(rule Proc_CFG_edge_CondTrue_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"if (b) prog else c\\<^sub>2,procs \\ (Main,Label (l + 1)) \n -(\\s. True):(Main,n' \\ 1)\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es\\ (p,Entry)\"\n by(fastforce intro:PCFG.MainCall)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcCall p ins outs c l p' es' rets' l' ins' outs' c' ps)\n from \\(p, Label l) = sourcenode a\\[THEN sym] \n \\(p', Entry) = targetnode a\\[THEN sym] \\well_formed procs\\ \n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainReturn l p es rets l' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ \\(p, Exit) = sourcenode a\\[THEN sym] \n \\(Main, Label l') = targetnode a\\[THEN sym] wf\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l'\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p Label l'\\\n have \"if (b) prog else c\\<^sub>2 \\ Label l \\ 1 -CEdge (p, es, rets)\\\\<^sub>p Label l' \\ 1\"\n by -(rule Proc_CFG_edge_CondTrue_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"if (b) prog else c\\<^sub>2,procs \\ (p,Exit) -(\\cf. snd cf = (Main,Label l' \\ 1))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (Main,Label (l' + 1))\"\n by(fastforce intro:PCFG.MainReturn)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcReturn p ins outs c l p' es' rets' l' ins' outs' c' ps)\n from \\(p', Exit) = sourcenode a\\[THEN sym] \n \\(p, Label l') = targetnode a\\[THEN sym] \\well_formed procs\\\n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainCallReturn nx p es rets nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n from \\n \\ Entry\\ \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"if (b) prog else c\\<^sub>2 \\ n \\ 1 -CEdge (p, es, rets)\\\\<^sub>p nx' \\ 1\"\n by(fastforce intro:Proc_CFG_edge_CondTrue_source_not_Entry)\n hence \"if (b) prog else c\\<^sub>2,procs \\ (Main,n \\ 1) -(\\s. False)\\<^sub>\\\\ \n (Main,nx' \\ 1)\" by -(rule PCFG.MainCallReturn)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n assume \"(Main, n) = targetnode a\"\n from \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"nx \\ Entry\" by(fastforce dest:Proc_CFG_Call_Labels)\n with \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"if (b) prog else c\\<^sub>2 \\ nx \\ 1 -CEdge (p, es, rets)\\\\<^sub>p nx' \\ 1\"\n by(fastforce intro:Proc_CFG_edge_CondTrue_source_not_Entry)\n hence \"if (b) prog else c\\<^sub>2,procs \\ (Main,nx \\ 1) -(\\s. False)\\<^sub>\\\\ (Main,nx' \\ 1)\"\n by -(rule PCFG.MainCallReturn)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case (ProcCallReturn p ins outs c nx p' es' rets' n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n qed\nqed\n\n\nlemma path_Main_CondTrue:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (if (b) prog else c\\<^sub>2,procs)\"\n shows \"\\wfp \\ (Main,n) -as\\* (p',n'); \\a \\ set as. intra_kind (kind a); n \\ Entry\\\n \\ wfp' \\ (Main,n \\ 1) -as \\s 1\\* (p',n' \\ 1)\"\nproof(induct \"(Main,n)\" as \"(p',n')\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main, n')\\\n \\n' \\ Entry\\ \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (if (b) prog else c\\<^sub>2,procs)\\\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n' \\ 1)\" \n by(fastforce intro:valid_node_Main_CondTrue)\n with \\Main = p'\\ show ?case\n by(fastforce intro:ProcCFG.empty_path simp:label_incrs_def)\nnext\n case (Cons_path n'' as a n)\n note IH = \\\\n. \\n'' = (Main, n); \\a\\set as. intra_kind (kind a); n \\ Entry\\ \n \\ wfp' \\ (Main, n \\ 1) -as \\s 1\\* (p', n' \\ 1)\\\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (if (b) prog else c\\<^sub>2,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\intra_kind (kind a)\\ wf \n obtain nx'' where \"n'' = (Main,nx'')\" and \"nx'' \\ Entry\"\n by(auto elim!:PCFG.cases simp:valid_edge_def intra_kind_def)\n from IH[OF \\n'' = (Main,nx'')\\ \\\\a\\set as. intra_kind (kind a)\\ \\nx'' \\ Entry\\]\n have path:\"wfp' \\ (Main, nx'' \\ 1) -as \\s 1\\* (p', n' \\ 1)\" .\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\n'' = (Main,nx'')\\ \\n \\ Entry\\ \\intra_kind (kind a)\\ wf\n have \"if (b) prog else c\\<^sub>2,procs \\ (Main, n \\ 1) -kind a\\ (Main, nx'' \\ 1)\"\n by(fastforce intro:PCFG_Main_edge_CondTrue_source_not_Entry simp:valid_edge_def)\n with path \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\ \\n'' = (Main,nx'')\\\n show ?case\n apply(cases a) apply(clarsimp simp:label_incrs_def)\n by(auto intro:ProcCFG.Cons_path simp:valid_edge_def)\nqed\n\n\nsubsubsection \\From \\prog\\ to \\if (b) c\\<^sub>1 else prog\\\\\n\nlemma Proc_CFG_edge_CondFalse_source_not_Entry:\n \"\\prog \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \n \\ if (b) c\\<^sub>1 else prog \\ n \\ (#:c\\<^sub>1 + 1) -et\\\\<^sub>p n' \\ (#:c\\<^sub>1 + 1)\"\nby(induct rule:Proc_CFG.induct)(fastforce intro:Proc_CFG_CondElse Proc_CFG.intros)+\n\n\nlemma PCFG_Main_edge_CondFalse_source_not_Entry:\n \"\\prog,procs \\ (Main,n) -et\\ (p',n'); n \\ Entry; intra_kind et; well_formed procs\\\n \\ if (b) c\\<^sub>1 else prog,procs \\ (Main,n \\ (#:c\\<^sub>1 + 1)) -et\\ (p',n' \\ (#:c\\<^sub>1 + 1))\"\nproof(induct \"(Main,n)\" et \"(p',n')\" rule:PCFG.induct)\n case Main\n thus ?case \n by(fastforce dest:Proc_CFG_edge_CondFalse_source_not_Entry intro:PCFG.Main)\nnext\n case (MainCallReturn p es rets)\n from \\prog \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \\n \\ Entry\\\n have \"if (b) c\\<^sub>1 else prog \\ n \\ (#:c\\<^sub>1 + 1) -CEdge (p, es, rets)\\\\<^sub>p n' \\ (#:c\\<^sub>1 + 1)\"\n by(rule Proc_CFG_edge_CondFalse_source_not_Entry)\n with MainCallReturn show ?case by(fastforce intro:PCFG.MainCallReturn)\nqed (auto simp:intra_kind_def)\n\n\n\n\n\nlemma path_Main_CondFalse:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (if (b) c\\<^sub>1 else prog,procs)\"\n shows \"\\wfp \\ (Main,n) -as\\* (p',n'); \\a \\ set as. intra_kind (kind a); n \\ Entry\\\n \\ wfp' \\ (Main,n \\ (#:c\\<^sub>1 + 1)) -as \\s (#:c\\<^sub>1 + 1)\\* (p',n' \\ (#:c\\<^sub>1 + 1))\"\nproof(induct \"(Main,n)\" as \"(p',n')\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main, n')\\\n \\n' \\ Entry\\ \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (if (b) c\\<^sub>1 else prog,procs)\\\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n' \\ (#:c\\<^sub>1 + 1))\"\n by(fastforce intro:valid_node_Main_CondFalse)\n with \\Main = p'\\ show ?case\n by(fastforce intro:ProcCFG.empty_path simp:label_incrs_def)\nnext\n case (Cons_path n'' as a n)\n note IH = \\\\n. \\n. \\n'' = (Main, n); \\a\\set as. intra_kind (kind a); n \\ Entry\\\n \\ wfp' \\ (Main, n \\ (#:c\\<^sub>1 + 1)) -as \\s (#:c\\<^sub>1 + 1)\\* (p', n' \\ (#:c\\<^sub>1 + 1))\\\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (if (b) c\\<^sub>1 else prog,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\intra_kind (kind a)\\ wf \n obtain nx'' where \"n'' = (Main,nx'')\" and \"nx'' \\ Entry\"\n by(auto elim!:PCFG.cases simp:valid_edge_def intra_kind_def)\n from IH[OF \\n'' = (Main,nx'')\\ \\\\a\\set as. intra_kind (kind a)\\ \\nx'' \\ Entry\\]\n have path:\"wfp' \\ (Main, nx'' \\ (#:c\\<^sub>1 + 1)) -as \\s (#:c\\<^sub>1 + 1)\\* \n (p', n' \\ (#:c\\<^sub>1 + 1))\" .\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\n'' = (Main,nx'')\\ \\n \\ Entry\\ \\intra_kind (kind a)\\ wf\n have \"if (b) c\\<^sub>1 else prog,procs \\ (Main, n \\ (#:c\\<^sub>1 + 1)) -kind a\\ \n (Main, nx'' \\ (#:c\\<^sub>1 + 1))\"\n by(fastforce intro:PCFG_Main_edge_CondFalse_source_not_Entry simp:valid_edge_def)\n with path \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\ \\n'' = (Main,nx'')\\\n show ?case\n apply(cases a) apply(clarsimp simp:label_incrs_def)\n by(auto intro:ProcCFG.Cons_path simp:valid_edge_def)\nqed\n\n\nsubsubsection \\From \\prog\\ to \\while (b) prog\\\\\n\nlemma Proc_CFG_edge_WhileBody_source_not_Entry:\n \"\\prog \\ n -et\\\\<^sub>p n'; n \\ Entry; n' \\ Exit\\ \n \\ while (b) prog \\ n \\ 2 -et\\\\<^sub>p n' \\ 2\"\nby(induct rule:Proc_CFG.induct)(fastforce intro:Proc_CFG_WhileBody Proc_CFG.intros)+\n\n\nlemma PCFG_Main_edge_WhileBody_source_not_Entry:\n \"\\prog,procs \\ (Main,n) -et\\ (p',n'); n \\ Entry; n' \\ Exit; intra_kind et; \n well_formed procs\\ \\ while (b) prog,procs \\ (Main,n \\ 2) -et\\ (p',n' \\ 2)\"\nproof(induct \"(Main,n)\" et \"(p',n')\" rule:PCFG.induct)\n case Main\n thus ?case \n by(fastforce dest:Proc_CFG_edge_WhileBody_source_not_Entry intro:PCFG.Main)\nnext\n case (MainCallReturn p es rets)\n from \\prog \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \\n \\ Entry\\ \\n' \\ Exit\\\n have \"while (b) prog \\ n \\ 2 -CEdge (p, es, rets)\\\\<^sub>p n' \\ 2\"\n by(rule Proc_CFG_edge_WhileBody_source_not_Entry)\n with MainCallReturn show ?case by(fastforce intro:PCFG.MainCallReturn)\nqed (auto simp:intra_kind_def)\n\n\nlemma valid_node_Main_WhileBody:\n assumes \"CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\"\n and \"n \\ Entry\" and \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (while (b) prog,procs)\"\n shows \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n \\ 2)\"\nproof -\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (while (b) prog,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main,n)\\\n obtain a where \"prog,procs \\ sourcenode a -kind a\\ targetnode a\"\n and \"(Main,n) = sourcenode a \\ (Main,n) = targetnode a\"\n by(fastforce simp:ProcCFG.valid_node_def valid_edge_def)\n from this \\n \\ Entry\\ wf show ?thesis\n proof(induct \"sourcenode a\" \"kind a\" \"targetnode a\" rule:PCFG.induct)\n case (Main nx nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n show ?thesis\n proof(cases \"nx' = Exit\")\n case True\n with \\n \\ Entry\\ \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"while (b) prog \\ n \\ 2 -IEdge (kind a)\\\\<^sub>p Label 0\"\n by(fastforce intro:Proc_CFG_WhileBodyExit)\n hence \"while (b) prog,procs \\ (Main,n \\ 2) -kind a\\ (Main,Label 0)\"\n by(rule PCFG.Main)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case False\n with \\n \\ Entry\\ \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\\n have \"while (b) prog \\ n \\ 2 -IEdge (kind a)\\\\<^sub>p nx' \\ 2\"\n by(fastforce intro:Proc_CFG_edge_WhileBody_source_not_Entry)\n hence \"while (b) prog,procs \\ (Main,n \\ 2) -kind a\\ (Main,nx' \\ 2)\"\n by(rule PCFG.Main)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n assume \"(Main, n) = targetnode a\"\n show ?thesis\n proof(cases \"nx = Entry\")\n case True\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\ \n have \"nx' = Exit \\ nx' = Label 0\" by(fastforce dest:Proc_CFG_EntryD)\n thus ?thesis\n proof\n assume \"nx' = Exit\"\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by simp\n next\n assume \"nx' = Label 0\"\n have \"while (b) prog \\ Label 0 \n -IEdge (\\cf. state_check cf b (Some true))\\<^sub>\\\\\\<^sub>p Label 2\"\n by(rule Proc_CFG_WhileTrue)\n hence \"while (b) prog,procs \\ (Main,Label 0) \n -(\\cf. state_check cf b (Some true))\\<^sub>\\\\ (Main,Label 2)\"\n by(fastforce intro:PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n \\nx' = Label 0\\ show ?thesis\n by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case False\n show ?thesis\n proof(cases \"nx' = Exit\")\n case True\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis by simp\n next\n case False\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\ \\nx \\ Entry\\\n have \"while (b) prog \\ nx \\ 2 -IEdge (kind a)\\\\<^sub>p nx' \\ 2\"\n by(fastforce intro:Proc_CFG_edge_WhileBody_source_not_Entry)\n hence \"while (b) prog,procs \\ (Main,nx \\ 2) -kind a\\ \n (Main,nx' \\ 2)\" by(rule PCFG.Main)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym]\n show ?thesis\n by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n qed\n qed\n next\n case (Proc p ins outs c nx n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\ \n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\ \n have False by fastforce\n thus ?case by simp\n next\n case (MainCall l p es rets n' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ \\(p, Entry) = targetnode a\\[THEN sym]\n \\(Main, Label l) = sourcenode a\\[THEN sym] wf\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p n'\\ have \"n' \\ Exit\"\n by(fastforce dest:Proc_CFG_Call_Labels)\n with \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p n'\\\n have \"while (b) prog \\ Label l \\ 2 -CEdge (p, es, rets)\\\\<^sub>p \n n' \\ 2\" by -(rule Proc_CFG_edge_WhileBody_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"while (b) prog,procs \\ (Main,Label l \\ 2) \n -(\\s. True):(Main,n' \\ 2)\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es\\ (p,Entry)\"\n by(fastforce intro:PCFG.MainCall)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcCall p ins outs c l p' es' rets' l' ins' outs' c')\n from \\(p, Label l) = sourcenode a\\[THEN sym]\n \\(p', Entry) = targetnode a\\[THEN sym] \\well_formed procs\\\n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainReturn l p es rets l' ins outs c)\n from \\(p, ins, outs, c) \\ set procs\\ \\(p, Exit) = sourcenode a\\[THEN sym]\n \\(Main, Label l') = targetnode a\\[THEN sym] wf\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have [simp]:\"n = Label l'\" by fastforce\n from \\prog \\ Label l -CEdge (p, es, rets)\\\\<^sub>p Label l'\\\n have \"while (b) prog \\ Label l \\ 2 -CEdge (p, es, rets)\\\\<^sub>p \n Label l' \\ 2\" by -(rule Proc_CFG_edge_WhileBody_source_not_Entry,auto)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"while (b) prog,procs \\ (p,Exit) -(\\cf. snd cf = (Main,Label l' \\ 2))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (Main,Label l' \\ 2)\"\n by(fastforce intro:PCFG.MainReturn)\n thus ?case by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n case (ProcReturn p ins outs c l p' es' rets' l' ins' outs' c' ps)\n from \\(p', Exit) = sourcenode a\\[THEN sym] \n \\(p, Label l') = targetnode a\\[THEN sym] \\well_formed procs\\\n \\(p, ins, outs, c) \\ set procs\\ \\(p', ins', outs', c') \\ set procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n next\n case (MainCallReturn nx p es rets nx')\n from \\(Main,n) = sourcenode a \\ (Main,n) = targetnode a\\ show ?case\n proof\n assume \"(Main,n) = sourcenode a\"\n with \\(Main, nx) = sourcenode a\\[THEN sym] have [simp]:\"nx = n\" by simp\n from \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\ have \"nx' \\ Exit\"\n by(fastforce dest:Proc_CFG_Call_Labels)\n with \\n \\ Entry\\ \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"while (b) prog \\ n \\ 2 -CEdge (p, es, rets)\\\\<^sub>p \n nx' \\ 2\" by(fastforce intro:Proc_CFG_edge_WhileBody_source_not_Entry)\n hence \"while (b) prog,procs \\ (Main,n \\ 2) -(\\s. False)\\<^sub>\\\\ (Main,nx' \\ 2)\"\n by -(rule PCFG.MainCallReturn)\n thus ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n next\n assume \"(Main, n) = targetnode a\"\n from \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"nx \\ Entry\" and \"nx' \\ Exit\" by(auto dest:Proc_CFG_Call_Labels)\n with \\prog \\ nx -CEdge (p, es, rets)\\\\<^sub>p nx'\\\n have \"while (b) prog \\ nx \\ 2 -CEdge (p, es, rets)\\\\<^sub>p \n nx' \\ 2\" by(fastforce intro:Proc_CFG_edge_WhileBody_source_not_Entry)\n hence \"while (b) prog,procs \\ (Main,nx \\ 2) -(\\s. False)\\<^sub>\\\\ (Main,nx' \\ 2)\"\n by -(rule PCFG.MainCallReturn)\n with \\(Main, n) = targetnode a\\ \\(Main, nx') = targetnode a\\[THEN sym] \n show ?thesis by(simp add:ProcCFG.valid_node_def)(fastforce simp:valid_edge_def)\n qed\n next\n case (ProcCallReturn p ins outs c nx p' es' rets' n' ps)\n from \\(p, nx) = sourcenode a\\[THEN sym] \\(p, n') = targetnode a\\[THEN sym]\n \\(p, ins, outs, c) \\ set procs\\ \\well_formed procs\\\n \\(Main, n) = sourcenode a \\ (Main, n) = targetnode a\\\n have False by fastforce\n thus ?case by simp\n qed\nqed\n\n\nlemma path_Main_WhileBody:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" \n and \"Rep_wf_prog wfp' = (while (b) prog,procs)\"\n shows \"\\wfp \\ (Main,n) -as\\* (p',n'); \\a \\ set as. intra_kind (kind a); \n n \\ Entry; n' \\ Exit\\ \\ wfp' \\ (Main,n \\ 2) -as \\s 2\\* (p',n' \\ 2)\"\nproof(induct \"(Main,n)\" as \"(p',n')\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp) (Main, n')\\\n \\n' \\ Entry\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\Rep_wf_prog wfp' = (while (b) prog,procs)\\\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n' \\ 2)\" \n by(fastforce intro:valid_node_Main_WhileBody)\n with \\Main = p'\\ show ?case\n by(fastforce intro:ProcCFG.empty_path simp:label_incrs_def)\nnext\n case (Cons_path n'' as a n)\n note IH = \\\\n. \\n'' = (Main, n); \\a\\set as. intra_kind (kind a); n \\ Entry; \n n' \\ Exit\\ \\ wfp' \\ (Main, n \\ 2) -as \\s 2\\* (p', n' \\ 2)\\\n note [simp] = \\Rep_wf_prog wfp = (prog,procs)\\ \n \\Rep_wf_prog wfp' = (while (b) prog,procs)\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\intra_kind (kind a)\\ wf \n obtain nx'' where \"n'' = (Main,nx'')\" and \"nx'' \\ Entry\"\n by(auto elim!:PCFG.cases simp:valid_edge_def intra_kind_def)\n from IH[OF \\n'' = (Main,nx'')\\ \\\\a\\set as. intra_kind (kind a)\\ \n \\nx'' \\ Entry\\ \\n' \\ Exit\\]\n have path:\"wfp' \\ (Main, nx'' \\ 2) -as \\s 2\\* (p', n' \\ 2)\" .\n with \\n' \\ Exit\\ have \"nx'' \\ Exit\" by(fastforce dest:ProcCFGExit.path_Exit_source)\n with \\valid_edge wfp a\\ \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\\n \\n'' = (Main,nx'')\\ \\n \\ Entry\\ \\intra_kind (kind a)\\ wf\n have \"while (b) prog,procs \\ (Main, n \\ 2) -kind a\\ (Main, nx'' \\ 2)\"\n by(fastforce intro:PCFG_Main_edge_WhileBody_source_not_Entry simp:valid_edge_def)\n with path \\sourcenode a = (Main, n)\\ \\targetnode a = n''\\ \\n'' = (Main,nx'')\\\n show ?case\n apply(cases a) apply(clarsimp simp:label_incrs_def)\n by(auto intro:ProcCFG.Cons_path simp:valid_edge_def)\nqed\n\n\nsubsubsection \\Existence of intraprodecural paths\\\n\nlemma Label_Proc_CFG_Entry_Exit_path_Main:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" and \"l < #:prog\"\n obtains as as' where \"wfp \\ (Main,Label l) -as\\* (Main,Exit)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (Main,Entry) -as'\\* (Main,Label l)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\nproof(atomize_elim)\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\l < #:prog\\ \\Rep_wf_prog wfp = (prog,procs)\\\n show \"\\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\\n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\"\n proof(induct prog arbitrary:l wfp)\n case Skip\n note [simp] = \\Rep_wf_prog wfp = (Skip, procs)\\\n from \\l < #:Skip\\ have [simp]:\"l = 0\" by simp\n have \"wfp \\ (Main,Entry) -[((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))]\\* \n (Main,Label 0)\" \n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry\n simp:valid_edge_def ProcCFG.valid_node_def)\n moreover\n have \"wfp \\ (Main,Label l) -[((Main,Label l),\\id,(Main,Exit))]\\* (Main,Exit)\" \n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Skip simp:valid_edge_def)\n ultimately show ?case by(fastforce simp:intra_kind_def)\n next\n case (LAss V e)\n note [simp] = \\Rep_wf_prog wfp = (V:=e, procs)\\\n from \\l < #:V:=e\\ have \"l = 0 \\ l = 1\" by auto\n thus ?case\n proof\n assume [simp]:\"l = 0\"\n have \"wfp \\ (Main,Entry) -[((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))]\\*\n (Main,Label 0)\" \n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry\n simp:valid_edge_def ProcCFG.valid_node_def)\n moreover\n have \"wfp \\ (Main,Label 0) \n -((Main,Label 0),\\(\\cf. update cf V e),(Main,Label 1))#\n [((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.Cons_path ProcCFG.path.intros Main Proc_CFG_LAss \n Proc_CFG_LAssSkip simp:valid_edge_def ProcCFG.valid_node_def)\n ultimately show ?thesis by(fastforce simp:intra_kind_def)\n next\n assume [simp]:\"l = 1\"\n have \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n [((Main,Label 0),\\(\\cf. update cf V e),(Main,Label 1))]\\* (Main,Label 1)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_LAss ProcCFG.Cons_path \n Main Proc_CFG_Entry simp:ProcCFG.valid_node_def valid_edge_def)\n moreover\n have \"wfp \\ (Main,Label 1) -[((Main,Label 1),\\id,(Main,Exit))]\\* \n (Main,Exit)\" by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_LAssSkip\n simp:valid_edge_def ProcCFG.valid_node_def)\n ultimately show ?thesis by(fastforce simp:intra_kind_def)\n qed\n next\n case (Seq c\\<^sub>1 c\\<^sub>2)\n note IH1 = \\\\l wfp. \\l < #:c\\<^sub>1; Rep_wf_prog wfp = (c\\<^sub>1, procs)\\ \\\n \\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\ \n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\\\n note IH2 = \\\\l wfp. \\l < #:c\\<^sub>2; Rep_wf_prog wfp = (c\\<^sub>2, procs)\\ \\\n \\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\ \n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\\\n note [simp] = \\Rep_wf_prog wfp = (c\\<^sub>1;; c\\<^sub>2, procs)\\\n show ?case\n proof(cases \"l < #:c\\<^sub>1\")\n case True\n from \\Rep_wf_prog wfp = (c\\<^sub>1;; c\\<^sub>2, procs)\\\n obtain wfp' where [simp]:\"Rep_wf_prog wfp' = (c\\<^sub>1, procs)\" by(erule wfp_Seq1)\n from IH1[OF True this] obtain as as' \n where path1:\"wfp' \\ (Main, Label l) -as\\* (Main, Exit)\"\n and intra1:\"\\a\\set as. intra_kind (kind a)\"\n and path2:\"wfp' \\ (Main, Entry) -as'\\* (Main, Label l)\"\n and intra2:\"\\a\\set as'. intra_kind (kind a)\" by blast\n from path1 have \"as \\ []\" by(fastforce elim:ProcCFG.path.cases)\n then obtain ax asx where [simp]:\"as = asx@[ax]\"\n by(cases as rule:rev_cases) fastforce+\n with path1 have \"wfp' \\ (Main, Label l) -asx\\* sourcenode ax\"\n and \"valid_edge wfp' ax\" and \"targetnode ax = (Main, Exit)\"\n by(auto elim:ProcCFG.path_split_snoc)\n from \\valid_edge wfp' ax\\ \\targetnode ax = (Main, Exit)\\\n obtain nx where \"sourcenode ax = (Main,nx)\" \n by(fastforce elim:PCFG.cases simp:valid_edge_def)\n with \\wfp' \\ (Main, Label l) -asx\\* sourcenode ax\\ have \"nx \\ Entry\"\n by fastforce\n moreover\n from \\valid_edge wfp' ax\\ \\sourcenode ax = (Main,nx)\\ have \"nx \\ Exit\"\n by(fastforce intro:ProcCFGExit.Exit_source)\n ultimately obtain lx where [simp]:\"nx = Label lx\" by(cases nx) auto\n with \\wfp' \\ (Main, Label l) -asx\\* sourcenode ax\\ \n \\sourcenode ax = (Main,nx)\\ intra1\n have path3:\"wfp \\ (Main, Label l) -asx\\* (Main, Label lx)\"\n by -(rule path_SeqFirst,auto)\n from \\valid_edge wfp' ax\\ \\targetnode ax = (Main, Exit)\\\n \\sourcenode ax = (Main,nx)\\ wf\n obtain etx where \"c\\<^sub>1 \\ Label lx -etx\\\\<^sub>p Exit\" \n by(fastforce elim!:PCFG.cases simp:valid_edge_def)\n then obtain et where [simp]:\"etx = IEdge et\" \n by(cases etx)(auto dest:Proc_CFG_Call_Labels)\n with \\c\\<^sub>1 \\ Label lx -etx\\\\<^sub>p Exit\\ have \"intra_kind et\"\n by(fastforce intro:Proc_CFG_IEdge_intra_kind)\n from \\c\\<^sub>1 \\ Label lx -etx\\\\<^sub>p Exit\\ path3\n have path4:\"wfp \\ (Main, Label l) -asx@\n [((Main, Label lx),et,(Main,Label 0 \\ #:c\\<^sub>1))] \\* (Main,Label 0 \\ #:c\\<^sub>1)\"\n by(fastforce intro:ProcCFG.path_Append ProcCFG.path.intros Proc_CFG_SeqConnect\n Main simp:ProcCFG.valid_node_def valid_edge_def)\n from \\Rep_wf_prog wfp = (c\\<^sub>1;; c\\<^sub>2, procs)\\\n obtain wfp'' where [simp]:\"Rep_wf_prog wfp'' = (c\\<^sub>2, procs)\" by(erule wfp_Seq2)\n from IH2[OF _ this,of \"0\"] obtain asx' \n where \"wfp'' \\ (Main, Label 0) -asx'\\* (Main, Exit)\"\n and \"\\a\\set asx'. intra_kind (kind a)\" by blast\n with path4 intra1 \\intra_kind et\\ have \"wfp \\ (Main, Label l) \n -(asx@[((Main, Label lx),et,(Main,Label 0 \\ #:c\\<^sub>1))])@(asx' \\s #:c\\<^sub>1)\\*\n (Main, Exit \\ #:c\\<^sub>1)\"\n by -(erule ProcCFG.path_Append,rule path_Main_SeqSecond,auto)\n moreover\n from intra1 \\intra_kind et\\ \\\\a\\set asx'. intra_kind (kind a)\\\n have \"\\a \\ set ((asx@[((Main, Label lx),et,(Main,Label #:c\\<^sub>1))])@(asx' \\s #:c\\<^sub>1)).\n intra_kind (kind a)\" by(auto simp:label_incrs_def)\n moreover\n from path2 intra2 have \"wfp \\ (Main, Entry) -as'\\* (Main, Label l)\"\n by -(rule path_SeqFirst,auto)\n ultimately show ?thesis using \\\\a\\set as'. intra_kind (kind a)\\ by fastforce\n next\n case False\n hence \"#:c\\<^sub>1 \\ l\" by simp\n then obtain l' where [simp]:\"l = l' + #:c\\<^sub>1\" and \"l' = l - #:c\\<^sub>1\" by simp\n from \\l < #:c\\<^sub>1;; c\\<^sub>2\\ have \"l' < #:c\\<^sub>2\" by simp\n from \\Rep_wf_prog wfp = (c\\<^sub>1;; c\\<^sub>2, procs)\\\n obtain wfp' where [simp]:\"Rep_wf_prog wfp' = (c\\<^sub>2, procs)\" by(erule wfp_Seq2)\n from IH2[OF \\l' < #:c\\<^sub>2\\ this] obtain as as' \n where path1:\"wfp' \\ (Main, Label l') -as\\* (Main, Exit)\"\n and intra1:\"\\a\\set as. intra_kind (kind a)\"\n and path2:\"wfp' \\ (Main, Entry) -as'\\* (Main, Label l')\"\n and intra2:\"\\a\\set as'. intra_kind (kind a)\" by blast\n from path1 intra1\n have \"wfp \\ (Main, Label l' \\ #:c\\<^sub>1) -as \\s #:c\\<^sub>1\\* (Main, Exit \\ #:c\\<^sub>1)\"\n by -(rule path_Main_SeqSecond,auto)\n moreover\n from path2 have \"as' \\ []\" by(fastforce elim:ProcCFG.path.cases)\n with path2 obtain ax' asx' where [simp]:\"as' = ax'#asx'\"\n and \"sourcenode ax' = (Main, Entry)\" and \"valid_edge wfp' ax'\" \n and \"wfp' \\ targetnode ax' -asx'\\* (Main, Label l')\"\n by -(erule ProcCFG.path_split_Cons,fastforce+)\n from \\wfp' \\ targetnode ax' -asx'\\* (Main, Label l')\\\n have \"targetnode ax' \\ (Main,Exit)\" by fastforce\n with \\valid_edge wfp' ax'\\ \\sourcenode ax' = (Main, Entry)\\ wf\n have \"targetnode ax' = (Main,Label 0)\"\n by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD simp:valid_edge_def)\n with \\wfp' \\ targetnode ax' -asx'\\* (Main, Label l')\\ intra2\n have path3:\"wfp \\ (Main,Label 0 \\ #:c\\<^sub>1) -asx' \\s #:c\\<^sub>1\\* \n (Main, Label l' \\ #:c\\<^sub>1)\" by -(rule path_Main_SeqSecond,auto)\n from \\Rep_wf_prog wfp = (c\\<^sub>1;; c\\<^sub>2, procs)\\\n obtain wfp'' where [simp]:\"Rep_wf_prog wfp'' = (c\\<^sub>1, procs)\" by(erule wfp_Seq1)\n from IH1[OF _ this,of \"0\"] obtain xs \n where \"wfp'' \\ (Main, Label 0) -xs\\* (Main, Exit)\"\n and \"\\a\\set xs. intra_kind (kind a)\" by blast\n from \\wfp'' \\ (Main, Label 0) -xs\\* (Main, Exit)\\ have \"xs \\ []\"\n by(fastforce elim:ProcCFG.path.cases)\n then obtain x xs' where [simp]:\"xs = xs'@[x]\"\n by(cases xs rule:rev_cases) fastforce+\n with \\wfp'' \\ (Main, Label 0) -xs\\* (Main, Exit)\\\n have \"wfp'' \\ (Main, Label 0) -xs'\\* sourcenode x\"\n and \"valid_edge wfp'' x\" and \"targetnode x = (Main, Exit)\"\n by(auto elim:ProcCFG.path_split_snoc)\n from \\valid_edge wfp'' x\\ \\targetnode x = (Main, Exit)\\\n obtain nx where \"sourcenode x = (Main,nx)\" \n by(fastforce elim:PCFG.cases simp:valid_edge_def)\n with \\wfp'' \\ (Main, Label 0) -xs'\\* sourcenode x\\ have \"nx \\ Entry\"\n by fastforce\n from \\valid_edge wfp'' x\\ \\sourcenode x = (Main,nx)\\ have \"nx \\ Exit\"\n by(fastforce intro:ProcCFGExit.Exit_source)\n with \\nx \\ Entry\\ obtain lx where [simp]:\"nx = Label lx\" by(cases nx) auto\n from \\wfp'' \\ (Main, Label 0) -xs'\\* sourcenode x\\ \n \\sourcenode x = (Main,nx)\\ \\\\a\\set xs. intra_kind (kind a)\\\n have \"wfp \\ (Main, Entry) \n -((Main, Entry),(\\s. True)\\<^sub>\\,(Main, Label 0))#xs'\\* sourcenode x\"\n apply simp apply(rule path_SeqFirst[OF \\Rep_wf_prog wfp'' = (c\\<^sub>1, procs)\\])\n apply(auto intro!:ProcCFG.Cons_path)\n by(auto intro:Main Proc_CFG_Entry simp:valid_edge_def intra_kind_def)\n with \\valid_edge wfp'' x\\ \\targetnode x = (Main, Exit)\\ path3\n \\sourcenode x = (Main,nx)\\ \\nx \\ Entry\\ \\sourcenode x = (Main,nx)\\ wf\n have \"wfp \\ (Main, Entry) -((((Main, Entry),(\\s. True)\\<^sub>\\,(Main, Label 0))#xs')@\n [(sourcenode x,kind x,(Main,Label #:c\\<^sub>1))])@(asx' \\s #:c\\<^sub>1)\\* \n (Main, Label l' \\ #:c\\<^sub>1)\" \n by(fastforce intro:ProcCFG.path_Append ProcCFG.path.intros Main \n Proc_CFG_SeqConnect elim!:PCFG.cases dest:Proc_CFG_Call_Labels\n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis using intra1 intra2 \\\\a\\set xs. intra_kind (kind a)\\\n by(fastforce simp:label_incrs_def intra_kind_def)\n qed\n next\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n note IH1 = \\\\l wfp. \\l < #:c\\<^sub>1; Rep_wf_prog wfp = (c\\<^sub>1, procs)\\ \\\n \\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\ \n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\\\n note IH2 = \\\\l wfp. \\l < #:c\\<^sub>2; Rep_wf_prog wfp = (c\\<^sub>2, procs)\\ \\\n \\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\ \n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\\\n note [simp] = \\Rep_wf_prog wfp = (if (b) c\\<^sub>1 else c\\<^sub>2, procs)\\\n show ?case\n proof(cases \"l = 0\")\n case True\n from \\Rep_wf_prog wfp = (if (b) c\\<^sub>1 else c\\<^sub>2, procs)\\\n obtain wfp' where [simp]:\"Rep_wf_prog wfp' = (c\\<^sub>1, procs)\" by(erule wfp_CondTrue)\n from IH1[OF _ this,of 0] obtain as \n where path:\"wfp' \\ (Main, Label 0) -as\\* (Main, Exit)\"\n and intra:\"\\a\\set as. intra_kind (kind a)\" by blast\n have \"if (b) c\\<^sub>1 else c\\<^sub>2,procs \\ (Main,Label 0)\n -(\\cf. state_check cf b (Some true))\\<^sub>\\\\ (Main,Label 0 \\ 1)\"\n by(fastforce intro:Main Proc_CFG_CondTrue)\n with path intra have \"wfp \\ (Main,Label 0)\n -[((Main,Label 0),(\\cf. state_check cf b (Some true))\\<^sub>\\,(Main,Label 0 \\ 1))]@\n (as \\s 1)\\* (Main,Exit \\ 1)\"\n apply - apply(rule ProcCFG.path_Append) apply(rule ProcCFG.path.intros)+\n prefer 5 apply(rule path_Main_CondTrue)\n apply(auto intro:ProcCFG.path.intros simp:valid_edge_def)\n by(fastforce simp:ProcCFG.valid_node_def valid_edge_def)\n moreover\n have \"if (b) c\\<^sub>1 else c\\<^sub>2,procs \\ (Main,Entry) -(\\s. True)\\<^sub>\\\\ \n (Main,Label 0)\" by(fastforce intro:Main Proc_CFG_Entry)\n hence \"wfp \\ (Main,Entry) -[((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))]\\* \n (Main,Label 0)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis using \\l = 0\\ \\\\a\\set as. intra_kind (kind a)\\ \n by(fastforce simp:label_incrs_def intra_kind_def)\n next\n case False\n hence \"0 < l\" by simp\n then obtain l' where [simp]:\"l = l' + 1\" and \"l' = l - 1\" by simp\n show ?thesis\n proof(cases \"l' < #:c\\<^sub>1\")\n case True\n from \\Rep_wf_prog wfp = (if (b) c\\<^sub>1 else c\\<^sub>2, procs)\\\n obtain wfp' where [simp]:\"Rep_wf_prog wfp' = (c\\<^sub>1, procs)\" \n by(erule wfp_CondTrue)\n from IH1[OF True this] obtain as as' \n where path1:\"wfp' \\ (Main, Label l') -as\\* (Main, Exit)\"\n and intra1:\"\\a\\set as. intra_kind (kind a)\"\n and path2:\"wfp' \\ (Main, Entry) -as'\\* (Main, Label l')\"\n and intra2:\"\\a\\set as'. intra_kind (kind a)\" by blast\n from path1 intra1\n have \"wfp \\ (Main, Label l' \\ 1) -as \\s 1\\* (Main, Exit \\ 1)\"\n by -(rule path_Main_CondTrue,auto)\n moreover\n from path2 obtain ax' asx' where [simp]:\"as' = ax'#asx'\"\n and \"sourcenode ax' = (Main,Entry)\" and \"valid_edge wfp' ax'\"\n and \"wfp' \\ targetnode ax' -asx'\\* (Main, Label l')\"\n by -(erule ProcCFG.path.cases,fastforce+)\n with wf have \"targetnode ax' = (Main,Label 0)\"\n by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD Proc_CFG_Call_Labels \n simp:valid_edge_def)\n with \\wfp' \\ targetnode ax' -asx'\\* (Main, Label l')\\ intra2\n have \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n ((Main,Label 0),(\\cf. state_check cf b (Some true))\\<^sub>\\,(Main,Label 0 \\ 1))#\n (asx' \\s 1)\\* (Main,Label l' \\ 1)\"\n apply - apply(rule ProcCFG.path.intros)+ apply(rule path_Main_CondTrue) \n by(auto intro:Main Proc_CFG_Entry Proc_CFG_CondTrue simp:valid_edge_def)\n ultimately show ?thesis using intra1 intra2\n by(fastforce simp:label_incrs_def intra_kind_def)\n next\n case False\n hence \"#:c\\<^sub>1 \\ l'\" by simp\n then obtain l'' where [simp]:\"l' = l'' + #:c\\<^sub>1\" and \"l'' = l' - #:c\\<^sub>1\" by simp\n from \\l < #:(if (b) c\\<^sub>1 else c\\<^sub>2)\\ have \"l'' < #:c\\<^sub>2\" by simp\n from \\Rep_wf_prog wfp = (if (b) c\\<^sub>1 else c\\<^sub>2, procs)\\\n obtain wfp'' where [simp]:\"Rep_wf_prog wfp'' = (c\\<^sub>2, procs)\" \n by(erule wfp_CondFalse)\n from IH2[OF \\l'' < #:c\\<^sub>2\\ this] obtain as as' \n where path1:\"wfp'' \\ (Main, Label l'') -as\\* (Main, Exit)\"\n and intra1:\"\\a\\set as. intra_kind (kind a)\"\n and path2:\"wfp'' \\ (Main, Entry) -as'\\* (Main, Label l'')\"\n and intra2:\"\\a\\set as'. intra_kind (kind a)\" by blast\n from path1 intra1\n have \"wfp \\ (Main, Label l'' \\ (#:c\\<^sub>1 + 1)) -as \\s (#:c\\<^sub>1 + 1)\\* \n (Main, Exit \\ (#:c\\<^sub>1 + 1))\"\n by -(rule path_Main_CondFalse,auto simp:add.assoc)\n moreover\n from path2 obtain ax' asx' where [simp]:\"as' = ax'#asx'\"\n and \"sourcenode ax' = (Main,Entry)\" and \"valid_edge wfp'' ax'\"\n and \"wfp'' \\ targetnode ax' -asx'\\* (Main, Label l'')\"\n by -(erule ProcCFG.path.cases,fastforce+)\n with wf have \"targetnode ax' = (Main,Label 0)\"\n by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD Proc_CFG_Call_Labels \n simp:valid_edge_def)\n with \\wfp'' \\ targetnode ax' -asx'\\* (Main, Label l'')\\ intra2\n have \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n ((Main,Label 0),(\\cf. state_check cf b (Some false))\\<^sub>\\,\n (Main,Label (#:c\\<^sub>1 + 1)))#(asx' \\s (#:c\\<^sub>1 + 1))\\* \n (Main,Label l'' \\ (#:c\\<^sub>1 + 1))\"\n apply - apply(rule ProcCFG.path.intros)+ apply(rule path_Main_CondFalse)\n by(auto intro:Main Proc_CFG_Entry Proc_CFG_CondFalse simp:valid_edge_def)\n ultimately show ?thesis using intra1 intra2\n by(fastforce simp:label_incrs_def intra_kind_def add.assoc)\n qed\n qed\n next\n case (While b c')\n note IH = \\\\l wfp. \\l < #:c'; Rep_wf_prog wfp = (c', procs)\\ \\\n \\as as'. wfp \\ (Main, Label l) -as\\* (Main, Exit) \\\n (\\a\\set as. intra_kind (kind a)) \\\n wfp \\ (Main, Entry) -as'\\* (Main, Label l) \\ (\\a\\set as'. intra_kind (kind a))\\\n note [simp] = \\Rep_wf_prog wfp = (while (b) c', procs)\\\n show ?case\n proof(cases \"l = 0\")\n case True\n hence \"wfp \\ (Main,Label l) - \n ((Main,Label 0),(\\cf. state_check cf b (Some false))\\<^sub>\\,(Main,Label 1))#\n [((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalseSkip \n Proc_CFG_WhileFalse simp:valid_edge_def)\n moreover\n have \"while (b) c' \\ Entry -IEdge (\\s. True)\\<^sub>\\\\\\<^sub>p Label 0\" by(rule Proc_CFG_Entry)\n with \\l = 0\\ have \"wfp \\ (Main,Entry) \n -[((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))]\\* (Main,Label l)\"\n by(fastforce intro:ProcCFG.path.intros Main \n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis by(fastforce simp:intra_kind_def)\n next\n case False\n hence \"1 \\ l\" by simp\n thus ?thesis\n proof(cases \"l < 2\")\n case True\n with \\1 \\ l\\ have [simp]:\"l = 1\" by simp\n have \"wfp \\ (Main,Label l) -[((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalseSkip \n simp:valid_edge_def)\n moreover\n have \"while (b) c' \\ Label 0 -IEdge (\\cf. state_check cf b (Some false))\\<^sub>\\\\\\<^sub>p \n Label 1\" by(rule Proc_CFG_WhileFalse)\n hence \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n [((Main,Label 0),(\\cf. state_check cf b (Some false))\\<^sub>\\,(Main,Label 1))]\\*\n (Main,Label l)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry \n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis by(fastforce simp:intra_kind_def)\n next\n case False\n with \\1 \\ l\\ have \"2 \\ l\" by simp\n then obtain l' where [simp]:\"l = l' + 2\" and \"l' = l - 2\" \n by(simp del:add_2_eq_Suc')\n from \\l < #:while (b) c'\\ have \"l' < #:c'\" by simp\n from \\Rep_wf_prog wfp = (while (b) c', procs)\\\n obtain wfp' where [simp]:\"Rep_wf_prog wfp' = (c', procs)\" \n by(erule wfp_WhileBody)\n from IH[OF \\l' < #:c'\\ this] obtain as as' \n where path1:\"wfp' \\ (Main, Label l') -as\\* (Main, Exit)\"\n and intra1:\"\\a\\set as. intra_kind (kind a)\"\n and path2:\"wfp' \\ (Main, Entry) -as'\\* (Main, Label l')\"\n and intra2:\"\\a\\set as'. intra_kind (kind a)\" by blast\n from path1 have \"as \\ []\" by(fastforce elim:ProcCFG.path.cases)\n with path1 obtain ax asx where [simp]:\"as = asx@[ax]\"\n and \"wfp' \\ (Main, Label l') -asx\\* sourcenode ax\"\n and \"valid_edge wfp' ax\" and \"targetnode ax = (Main, Exit)\"\n by -(erule ProcCFG.path_split_snoc,fastforce+)\n with wf obtain lx etx where \"sourcenode ax = (Main,Label lx)\"\n and \"intra_kind (kind ax)\"\n apply(auto elim!:PCFG.cases dest:Proc_CFG_Call_Labels simp:valid_edge_def)\n by(case_tac n)(auto dest:Proc_CFG_IEdge_intra_kind)\n with \\wfp' \\ (Main, Label l') -asx\\* sourcenode ax\\ intra1\n have \"wfp \\ (Main, Label l' \\ 2) -asx \\s 2\\* (Main,Label lx \\ 2)\"\n by -(rule path_Main_WhileBody,auto)\n from \\valid_edge wfp' ax\\ \\sourcenode ax = (Main,Label lx)\\\n \\targetnode ax = (Main, Exit)\\ \\intra_kind (kind ax)\\ wf\n have \"while (b) c',procs \\ (Main,Label lx \\ 2) -kind ax\\ \n (Main,Label 0)\"\n by(fastforce intro!:Main Proc_CFG_WhileBodyExit elim!:PCFG.cases \n dest:Proc_CFG_Call_Labels simp:valid_edge_def)\n hence \"wfp \\ (Main,Label lx \\ 2) \n -((Main,Label lx \\ 2),kind ax,(Main,Label 0))#\n ((Main,Label 0),(\\cf. state_check cf b (Some false))\\<^sub>\\,(Main,Label 1))#\n [((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalse \n Proc_CFG_WhileFalseSkip simp:valid_edge_def)\n with \\wfp \\ (Main, Label l' \\ 2) -asx \\s 2\\* (Main,Label lx \\ 2)\\\n have \"wfp \\ (Main, Label l) -(asx \\s 2)@\n (((Main,Label lx \\ 2),kind ax,(Main,Label 0))#\n ((Main,Label 0),(\\cf. state_check cf b (Some false))\\<^sub>\\,(Main,Label 1))#\n [((Main,Label 1),\\id,(Main,Exit))])\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path_Append)\n moreover\n from path2 have \"as' \\ []\" by(fastforce elim:ProcCFG.path.cases)\n with path2 obtain ax' asx' where [simp]:\"as' = ax'#asx'\"\n and \"wfp' \\ targetnode ax' -asx'\\* (Main,Label l')\"\n and \"valid_edge wfp' ax'\" and \"sourcenode ax' = (Main, Entry)\"\n by -(erule ProcCFG.path_split_Cons,fastforce+)\n with wf have \"targetnode ax' = (Main,Label 0)\" and \"intra_kind (kind ax')\"\n by(fastforce elim!:PCFG.cases dest:Proc_CFG_Call_Labels \n Proc_CFG_EntryD simp:intra_kind_def valid_edge_def)+\n with \\wfp' \\ targetnode ax' -asx'\\* (Main,Label l')\\ intra2\n have \"wfp \\ (Main, Label 0 \\ 2) -asx' \\s 2\\* (Main,Label l' \\ 2)\"\n by -(rule path_Main_WhileBody,auto simp del:add_2_eq_Suc')\n hence \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n ((Main,Label 0),(\\cf. state_check cf b (Some true))\\<^sub>\\,(Main,Label 2))#\n (asx' \\s 2)\\* (Main,Label l)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileTrue \n Proc_CFG_Entry simp:valid_edge_def)\n ultimately show ?thesis using \\intra_kind (kind ax)\\ intra1 intra2\n by(fastforce simp:label_incrs_def intra_kind_def)\n qed\n qed\n next\n case (Call p es rets)\n note Rep [simp] = \\Rep_wf_prog wfp = (Call p es rets, procs)\\\n have cC:\"containsCall procs (Call p es rets) [] p\" by simp\n show ?case\n proof(cases \"l = 0\")\n case True\n have \"wfp \\ (Main,Label 0) -((Main,Label 0),(\\s. False)\\<^sub>\\,(Main,Label 1))#\n [((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_CallSkip MainCallReturn\n Proc_CFG_Call simp:valid_edge_def)\n moreover\n have \"Call p es rets,procs \\ (Main,Entry) -(\\s. True)\\<^sub>\\\\ (Main,Label 0)\"\n by(fastforce intro:Main Proc_CFG_Entry)\n hence \"wfp \\ (Main,Entry) -[((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))]\\*\n (Main,Label 0)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis using \\l = 0\\ by(fastforce simp:intra_kind_def)\n next\n case False\n with \\l < #:Call p es rets\\ have \"l = 1\" by simp\n have \"wfp \\ (Main,Label 1) -[((Main,Label 1),\\id,(Main,Exit))]\\* (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_CallSkip\n simp:valid_edge_def)\n moreover\n have \"Call p es rets,procs \\ (Main,Label 0) -(\\s. False)\\<^sub>\\\\ (Main,Label 1)\"\n by(fastforce intro:MainCallReturn Proc_CFG_Call)\n hence \"wfp \\ (Main,Entry) -((Main,Entry),(\\s. True)\\<^sub>\\,(Main,Label 0))#\n [((Main,Label 0),(\\s. False)\\<^sub>\\,(Main,Label 1))]\\* (Main,Label 1)\"\n by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry \n simp:ProcCFG.valid_node_def valid_edge_def)\n ultimately show ?thesis using \\l = 1\\ by(fastforce simp:intra_kind_def)\n qed\n qed\nqed\n\n\n\nsubsection \\Lifting from edges in procedure Main to arbitrary procedures\\\n\nlemma lift_edge_Main_Main:\n \"\\c,procs \\ (Main, n) -et\\ (Main, n'); (p,ins,outs,c) \\ set procs;\n containsCall procs prog ps p; well_formed procs\\ \n \\ prog,procs \\ (p, n) -et\\ (p, n')\"\nproof(induct \"(Main,n)\" et \"(Main,n')\" rule:PCFG.induct)\n case Main thus ?case by(fastforce intro:Proc)\nnext\n case MainCallReturn thus ?case by(fastforce intro:ProcCallReturn)\nqed auto\n\nlemma lift_edge_Main_Proc:\n \"\\c,procs \\ (Main, n) -et\\ (q, n'); q \\ Main; (p,ins,outs,c) \\ set procs;\n containsCall procs prog ps p; well_formed procs\\ \n \\ \\et'. prog,procs \\ (p, n) -et'\\ (q, n')\"\nproof(induct \"(Main,n)\" et \"(q,n')\" rule:PCFG.induct)\n case (MainCall l esx retsx n'x insx outsx cx)\n from \\c \\ Label l -CEdge (q, esx, retsx)\\\\<^sub>p n'x\\ \n obtain l' where [simp]:\"n'x = Label l'\" by(fastforce dest:Proc_CFG_Call_Labels)\n with MainCall have \"prog,procs \\ (p, n) \n -(\\s. True):(p,n'x)\\\\<^bsub>q\\<^esub>map (\\e cf. interpret e cf) esx\\ (q, n')\"\n by(fastforce intro:ProcCall)\n thus ?case by fastforce\nqed auto\n\nlemma lift_edge_Proc_Main:\n \"\\c,procs \\ (q, n) -et\\ (Main, n'); q \\ Main; (p,ins,outs,c) \\ set procs;\n containsCall procs prog ps p; well_formed procs\\ \n \\ \\et'. prog,procs \\ (q, n) -et'\\ (p, n')\"\nproof(induct \"(q,n)\" et \"(Main,n')\" rule:PCFG.induct)\n case (MainReturn l esx retsx l' insx outsx cx)\n note [simp] = \\Exit = n\\[THEN sym] \\Label l' = n'\\[THEN sym]\n from MainReturn have \"prog,procs \\ (q,Exit) -(\\cf. snd cf = (p,Label l'))\\\\<^bsub>q\\<^esub>\n (\\cf cf'. cf'(retsx [:=] map cf outsx))\\ (p,Label l')\"\n by(fastforce intro!:ProcReturn)\n thus ?case by fastforce\nqed auto\n\n\nfun lift_edge :: \"edge \\ pname \\ edge\"\nwhere \"lift_edge a p = ((p,snd(sourcenode a)),kind a,(p,snd(targetnode a)))\"\n\nfun lift_path :: \"edge list \\ pname \\ edge list\"\n where \"lift_path as p = map (\\a. lift_edge a p) as\"\n\n\nlemma lift_path_Proc: \n assumes \"Rep_wf_prog wfp' = (c,procs)\" and \"Rep_wf_prog wfp = (prog,procs)\"\n and \"(p,ins,outs,c) \\ set procs\" and \"containsCall procs prog ps p\"\n shows \"\\wfp' \\ (Main,n) -as\\* (Main,n'); \\a \\ set as. intra_kind (kind a)\\\n \\ wfp \\ (p,n) -lift_path as p\\* (p,n')\"\nproof(induct \"(Main,n)\" as \"(Main,n')\" arbitrary:n rule:ProcCFG.path.induct)\n case empty_path\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\CFG.valid_node sourcenode targetnode (valid_edge wfp') (Main, n')\\\n assms wf\n have \"CFG.valid_node sourcenode targetnode (valid_edge wfp) (p,n')\"\n apply(auto simp:ProcCFG.valid_node_def valid_edge_def)\n apply(case_tac \"ab = Main\")\n apply(fastforce dest:lift_edge_Main_Main)\n apply(fastforce dest!:lift_edge_Main_Proc)\n apply(case_tac \"a = Main\")\n apply(fastforce dest:lift_edge_Main_Main)\n by(fastforce dest!:lift_edge_Proc_Main)\n thus ?case by(fastforce dest:ProcCFG.empty_path)\nnext\n case (Cons_path m'' as a n)\n note IH = \\\\n. \\m'' = (Main, n); \\a\\set as. intra_kind (kind a)\\\n \\ wfp \\ (p, n) -lift_path as p\\* (p, n')\\\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\" \n by(fastforce intro:wf_wf_prog)\n from \\\\a\\set (a # as). intra_kind (kind a)\\ have \"intra_kind (kind a)\"\n and \"\\a\\set as. intra_kind (kind a)\" by simp_all\n from \\valid_edge wfp' a\\ \\intra_kind (kind a)\\ \\sourcenode a = (Main, n)\\ \n \\targetnode a = m''\\ \\Rep_wf_prog wfp' = (c,procs)\\\n obtain n'' where \"m'' = (Main, n'')\"\n by(fastforce elim:PCFG.cases simp:valid_edge_def intra_kind_def)\n with \\valid_edge wfp' a\\ \\Rep_wf_prog wfp' = (c,procs)\\\n \\sourcenode a = (Main, n)\\ \\targetnode a = m''\\\n \\(p,ins,outs,c) \\ set procs\\ \\containsCall procs prog ps p\\ \n \\Rep_wf_prog wfp = (prog,procs)\\ wf\n have \"prog,procs \\ (p, n) -kind a\\ (p, n'')\"\n by(auto intro:lift_edge_Main_Main simp:valid_edge_def) \n from IH[OF \\m'' = (Main, n'')\\ \\\\a\\set as. intra_kind (kind a)\\]\n have \"wfp \\ (p, n'') -lift_path as p\\* (p, n')\" .\n with \\prog,procs \\ (p, n) -kind a\\ (p, n'')\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\sourcenode a = (Main, n)\\ \\targetnode a = m''\\ \\m'' = (Main, n'')\\\n show ?case by simp (rule ProcCFG.Cons_path,auto simp:valid_edge_def)\nqed\n\n\nsubsection \\Existence of paths from Entry and to Exit\\\n\nlemma Label_Proc_CFG_Entry_Exit_path_Proc:\n assumes \"Rep_wf_prog wfp = (prog,procs)\" and \"l < #:c\"\n and \"(p,ins,outs,c) \\ set procs\" and \"containsCall procs prog ps p\"\n obtains as as' where \"wfp \\ (p,Label l) -as\\* (p,Exit)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (p,Entry) -as'\\* (p,Label l)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\nproof(atomize_elim)\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\(p,ins,outs,c) \\ set procs\\\n \\containsCall procs prog ps p\\\n obtain wfp' where \"Rep_wf_prog wfp' = (c,procs)\" by(erule wfp_Call)\n from this \\l < #:c\\ obtain as as' where \"wfp' \\ (Main,Label l) -as\\* (Main,Exit)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp' \\ (Main,Entry) -as'\\* (Main,Label l)\"\n and \"\\a \\ set as'. intra_kind (kind a)\" \n by(erule Label_Proc_CFG_Entry_Exit_path_Main)\n from \\Rep_wf_prog wfp' = (c,procs)\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\(p,ins,outs,c) \\ set procs\\ \\containsCall procs prog ps p\\\n \\wfp' \\ (Main,Label l) -as\\* (Main,Exit)\\ \\\\a \\ set as. intra_kind (kind a)\\\n have \"wfp \\ (p,Label l) -lift_path as p\\* (p,Exit)\"\n by(fastforce intro:lift_path_Proc)\n moreover\n from \\Rep_wf_prog wfp' = (c,procs)\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\(p,ins,outs,c) \\ set procs\\ \\containsCall procs prog ps p\\\n \\wfp' \\ (Main,Entry) -as'\\* (Main,Label l)\\ \\\\a \\ set as'. intra_kind (kind a)\\\n have \"wfp \\ (p,Entry) -lift_path as' p\\* (p,Label l)\"\n by(fastforce intro:lift_path_Proc)\n moreover\n from \\\\a \\ set as. intra_kind (kind a)\\ \\\\a \\ set as'. intra_kind (kind a)\\\n have \"\\a \\ set (lift_path as p). intra_kind (kind a)\"\n and \"\\a \\ set (lift_path as' p). intra_kind (kind a)\" by auto\n ultimately\n show \"\\as as'. wfp \\ (p, Label l) -as\\* (p, Exit) \\\n (\\a\\set as. intra_kind (kind a)) \\ wfp \\ (p, Entry) -as'\\* (p, Label l) \\\n (\\a\\set as'. intra_kind (kind a))\" by fastforce\nqed\n\n\nlemma Entry_to_Entry_and_Exit_to_Exit: \n assumes \"Rep_wf_prog wfp = (prog,procs)\"\n and \"containsCall procs prog ps p\" and \"(p,ins,outs,c) \\ set procs\"\n obtains as as' where \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) as (p,Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (p,Exit) as' (Main,Exit)\"\nproof(atomize_elim)\n from \\containsCall procs prog ps p\\ \\(p,ins,outs,c) \\ set procs\\\n show \"\\as as'. CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (Main, Entry) as (p, Entry) \\\n CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (p, Exit) as' (Main, Exit)\"\n proof(induct ps arbitrary:p ins outs c rule:rev_induct)\n case Nil\n from \\containsCall procs prog [] p\\\n obtain lx es rets lx' where \"prog \\ Label lx -CEdge (p,es,rets)\\\\<^sub>p Label lx'\"\n by(erule containsCall_empty_Proc_CFG_Call_edge)\n with \\(p, ins, outs, c) \\ set procs\\\n have \"prog,procs \\ (Main,Label lx) -(\\s. True):(Main,Label lx')\\\\<^bsub>p\\<^esub>\n map (\\e cf. interpret e cf) es\\ (p,Entry)\" \n and \"prog,procs \\ (p,Exit) -(\\cf. snd cf = (Main,Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (Main,Label lx')\"\n by -(rule MainCall,assumption+,rule MainReturn)\n with \\Rep_wf_prog wfp = (prog,procs)\\\n have \"wfp \\ (Main,Label lx) -[((Main,Label lx),\n (\\s. True):(Main,Label lx')\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es,(p,Entry))]\\* \n (p,Entry)\"\n and \"wfp \\ (p,Exit) -[((p,Exit),(\\cf. snd cf = (Main,Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs)),(Main,Label lx'))]\\* (Main,Label lx')\"\n by(fastforce intro:ProcCFG.path.intros \n simp:ProcCFG.valid_node_def valid_edge_def)+\n moreover\n from \\prog \\ Label lx -CEdge (p,es,rets)\\\\<^sub>p Label lx'\\\n have \"lx < #:prog\" and \"lx' < #:prog\"\n by(auto intro:Proc_CFG_sourcelabel_less_num_nodes \n Proc_CFG_targetlabel_less_num_nodes)\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\lx < #:prog\\ obtain as \n where \"wfp \\ (Main,Entry) -as\\* (Main,Label lx)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\lx' < #:prog\\ obtain as' \n where \"wfp \\ (Main,Label lx') -as'\\* (Main,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)\n moreover\n from \\\\a \\ set as. intra_kind (kind a)\\ \n have \"CFG.valid_path kind (get_return_edges wfp) \n (as@[((Main,Label lx),(\\s. True):(Main,Label lx')\\\\<^bsub>p\\<^esub>\n map (\\e cf. interpret e cf) es,(p,Entry))])\"\n by(fastforce intro:ProcCFG.same_level_path_valid_path_Append \n ProcCFG.intras_same_level_path simp:ProcCFG.valid_path_def)\n moreover\n from \\\\a \\ set as'. intra_kind (kind a)\\ \n have \"CFG.valid_path kind (get_return_edges wfp) \n ([((p,Exit),(\\cf. snd cf = (Main,Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs)),(Main,Label lx'))]@as')\"\n by(fastforce intro:ProcCFG.valid_path_same_level_path_Append \n ProcCFG.intras_same_level_path simp:ProcCFG.valid_path_def)\n ultimately show ?case by(fastforce intro:ProcCFG.path_Append simp:ProcCFG.vp_def)\n next\n case (snoc p' ps')\n note IH = \\\\p ins outs c. \n \\containsCall procs prog ps' p; (p,ins,outs,c) \\ set procs\\\n \\ \\as as'. CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (Main, Entry) as (p, Entry) \\\n CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (p, Exit) as' (Main, Exit)\\\n from \\containsCall procs prog (ps' @ [p']) p\\\n obtain ins' outs' c' where \"(p',ins',outs',c') \\ set procs\"\n and \"containsCall procs c' [] p\" \n and \"containsCall procs prog ps' p'\" by(auto elim:containsCallE)\n from IH[OF \\containsCall procs prog ps' p'\\ \\(p',ins',outs',c') \\ set procs\\] \n obtain as as' where pathE:\"CFG.valid_path' sourcenode targetnode kind \n (valid_edge wfp) (get_return_edges wfp) (Main, Entry) as (p', Entry)\"\n and pathX:\"CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (p', Exit) as' (Main, Exit)\" by blast\n from \\containsCall procs c' [] p\\\n obtain lx es rets lx' where edge:\"c' \\ Label lx -CEdge (p,es,rets)\\\\<^sub>p Label lx'\"\n by(erule containsCall_empty_Proc_CFG_Call_edge)\n hence \"lx < #:c'\" and \"lx' < #:c'\"\n by(auto intro:Proc_CFG_sourcelabel_less_num_nodes \n Proc_CFG_targetlabel_less_num_nodes)\n from \\lx < #:c'\\ \\Rep_wf_prog wfp = (prog,procs)\\ \\(p',ins',outs',c') \\ set procs\\\n \\containsCall procs prog ps' p'\\ obtain asx \n where \"wfp \\ (p',Entry) -asx\\* (p',Label lx)\"\n and \"\\a \\ set asx. intra_kind (kind a)\"\n by(fastforce elim:Label_Proc_CFG_Entry_Exit_path_Proc)\n with pathE have pathE2:\"CFG.valid_path' sourcenode targetnode kind \n (valid_edge wfp) (get_return_edges wfp) (Main, Entry) (as@asx) (p', Label lx)\"\n by(fastforce intro:ProcCFG.path_Append ProcCFG.valid_path_same_level_path_Append\n ProcCFG.intras_same_level_path simp:ProcCFG.vp_def)\n from \\lx' < #:c'\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\(p',ins',outs',c') \\ set procs\\ \\containsCall procs prog ps' p'\\ \n obtain asx' where \"wfp \\ (p',Label lx') -asx'\\* (p',Exit)\"\n and \"\\a \\ set asx'. intra_kind (kind a)\"\n by(fastforce elim:Label_Proc_CFG_Entry_Exit_path_Proc)\n with pathX have pathX2:\"CFG.valid_path' sourcenode targetnode kind \n (valid_edge wfp) (get_return_edges wfp) (p', Label lx') (asx'@as') (Main, Exit)\"\n by(fastforce intro:ProcCFG.path_Append ProcCFG.same_level_path_valid_path_Append\n ProcCFG.intras_same_level_path simp:ProcCFG.vp_def)\n from edge \\(p,ins,outs,c) \\ set procs\\ \\(p',ins',outs',c') \\ set procs\\\n \\containsCall procs prog ps' p'\\\n have \"prog,procs \\ (p',Label lx) -(\\s. True):(p',Label lx')\\\\<^bsub>p\\<^esub>\n map (\\e cf. interpret e cf) es\\ (p,Entry)\"\n and \"prog,procs \\ (p,Exit) -(\\cf. snd cf = (p',Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (p',Label lx')\"\n by(fastforce intro:ProcCall ProcReturn)+\n with \\Rep_wf_prog wfp = (prog,procs)\\\n have path:\"wfp \\ (p',Label lx) -[((p',Label lx),(\\s. True):(p',Label lx')\\\\<^bsub>p\\<^esub>\n map (\\e cf. interpret e cf) es,(p,Entry))]\\* (p,Entry)\"\n and path':\"wfp \\ (p,Exit) -[((p,Exit),(\\cf. snd cf = (p',Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs)),(p',Label lx'))]\\* \n (p',Label lx')\"\n by(fastforce intro:ProcCFG.path.intros \n simp:ProcCFG.valid_node_def valid_edge_def)+\n from path pathE2 have \"CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (Main, Entry) ((as@asx)@[((p',Label lx),\n (\\s. True):(p',Label lx')\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es,(p,Entry))])\n (p,Entry)\"\n apply(unfold ProcCFG.vp_def) apply(rule conjI)\n apply(fastforce intro:ProcCFG.path_Append)\n by(unfold ProcCFG.valid_path_def,fastforce intro:ProcCFG.vpa_snoc_Call)\n moreover\n from path' pathX2 have \"CFG.valid_path' sourcenode targetnode kind \n (valid_edge wfp) (get_return_edges wfp) (p,Exit)\n ([((p,Exit),(\\cf. snd cf = (p',Label lx'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs)),(p',Label lx'))]@(asx'@as')) (Main, Exit)\"\n apply(unfold ProcCFG.vp_def) apply(rule conjI)\n apply(fastforce intro:ProcCFG.path_Append)\n by(simp add:ProcCFG.valid_path_def ProcCFG.valid_path_def)\n ultimately show ?case by blast\n qed\nqed\n\n\nlemma edge_valid_paths:\n assumes \"prog,procs \\ sourcenode a -kind a\\ targetnode a\"\n and disj:\"(p,n) = sourcenode a \\ (p,n) = targetnode a\" \n and [simp]:\"Rep_wf_prog wfp = (prog,procs)\"\n shows \"\\as as'. CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (Main,Entry) as (p,n) \\\n CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (p,n) as' (Main,Exit)\"\nproof -\n from \\Rep_wf_prog wfp = (prog,procs)\\ have wf:\"well_formed procs\"\n by(fastforce intro:wf_wf_prog)\n from \\prog,procs \\ sourcenode a -kind a\\ targetnode a\\\n show ?thesis\n proof(induct \"sourcenode a\" \"kind a\" \"targetnode a\" rule:PCFG.induct)\n case (Main nx nx')\n from \\(Main, nx) = sourcenode a\\[THEN sym] \\(Main, nx') = targetnode a\\[THEN sym]\n disj have [simp]:\"p = Main\" by auto\n have \"prog,procs \\ (Main, Entry) -(\\s. False)\\<^sub>\\\\ (Main, Exit)\"\n by(fastforce intro:PCFG.Main Proc_CFG_Entry_Exit)\n hence EXpath:\"wfp \\ (Main,Entry) -[((Main,Entry),(\\s. False)\\<^sub>\\,(Main,Exit))]\\*\n (Main,Exit)\"\n by(fastforce intro:ProcCFG.path.intros\n simp:valid_edge_def ProcCFG.valid_node_def)\n show ?case\n proof(cases n)\n case (Label l)\n with \\prog \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\ \\(Main, nx) = sourcenode a\\[THEN sym]\n \\(Main, nx') = targetnode a\\[THEN sym] disj\n have \"l < #:prog\" by(auto intro:Proc_CFG_sourcelabel_less_num_nodes\n Proc_CFG_targetlabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \n obtain as as' where \"wfp \\ (Main,Entry) -as\\* (Main,Label l)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (Main,Label l) -as'\\* (Main,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)+\n with Label show ?thesis\n apply(rule_tac x=\"as\" in exI) apply(rule_tac x=\"as'\" in exI) apply simp\n by(fastforce intro:ProcCFG.intra_path_vp simp:ProcCFG.intra_path_def)\n next\n case Entry\n hence \"wfp \\ (Main,Entry) -[]\\* (Main,n)\" by(fastforce intro:ProcCFG.empty_path)\n with EXpath show ?thesis by(fastforce simp:ProcCFG.vp_def ProcCFG.valid_path_def)\n next\n case Exit\n hence \"wfp \\ (Main,n) -[]\\* (Main,Exit)\" by(fastforce intro:ProcCFG.empty_path)\n with Exit EXpath show ?thesis using Exit\n apply(rule_tac x=\"[((Main,Entry),(\\s. False)\\<^sub>\\,(Main,Exit))]\" in exI) \n apply simp\n by(fastforce intro:ProcCFG.intra_path_vp \n simp:ProcCFG.intra_path_def intra_kind_def)\n qed\n next\n case (Proc px ins outs c nx nx' ps)\n from \\(px, ins, outs, c) \\ set procs\\ wf have [simp]:\"px \\ Main\" by auto\n from disj \\(px, nx) = sourcenode a\\[THEN sym] \\(px, nx') = targetnode a\\[THEN sym]\n have [simp]:\"p = px\" by auto\n from \\Rep_wf_prog wfp = (prog,procs)\\ \n \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n obtain asx asx' where path:\"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) asx (px,Entry)\"\n and path':\"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) asx' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n from \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n have \"prog,procs \\ (px, Entry) -(\\s. False)\\<^sub>\\\\ (px, Exit)\"\n by(fastforce intro:PCFG.Proc Proc_CFG_Entry_Exit)\n hence EXpath:\"wfp \\ (px,Entry) -[((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]\\* \n (px,Exit)\" by(fastforce intro:ProcCFG.path.intros \n simp:valid_edge_def ProcCFG.valid_node_def)\n show ?case\n proof(cases n)\n case (Label l)\n with \\c \\ nx -IEdge (kind a)\\\\<^sub>p nx'\\ disj \\(px, nx) = sourcenode a\\[THEN sym]\n \\(px, nx') = targetnode a\\[THEN sym]\n have \"l < #:c\" by(auto intro:Proc_CFG_sourcelabel_less_num_nodes\n Proc_CFG_targetlabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \\(px, ins, outs, c) \\ set procs\\ \n \\containsCall procs prog ps px\\\n obtain as as' where \"wfp \\ (px,Entry) -as\\* (px,Label l)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (px,Label l) -as'\\* (px,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Proc)+\n with path path' show ?thesis using Label\n apply(rule_tac x=\"asx@as\" in exI) apply(rule_tac x=\"as'@asx'\" in exI)\n by(auto intro:ProcCFG.path_Append ProcCFG.valid_path_same_level_path_Append\n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:ProcCFG.vp_def)\n next\n case Entry\n from EXpath path' have \"CFG.valid_path' sourcenode targetnode kind \n (valid_edge wfp) (get_return_edges wfp) (px,Entry) \n ([((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]@asx') (Main, Exit)\"\n apply(unfold ProcCFG.vp_def) apply(erule conjE) apply(rule conjI)\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:intra_kind_def)+\n with path Entry show ?thesis by simp blast\n next\n case Exit\n with path EXpath path' show ?thesis\n apply(rule_tac x=\"asx@[((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]\" in exI)\n apply simp\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.valid_path_same_level_path_Append ProcCFG.intras_same_level_path\n simp:ProcCFG.vp_def ProcCFG.intra_path_def intra_kind_def)\n qed\n next\n case (MainCall l px es rets nx' ins outs c)\n from disj show ?case\n proof\n assume \"(p,n) = sourcenode a\"\n with \\(Main, Label l) = sourcenode a\\[THEN sym] \n have [simp]:\"n = Label l\" \"p = Main\" by simp_all\n with \\prog \\ Label l -CEdge (px, es, rets)\\\\<^sub>p nx'\\ have \"l < #:prog\"\n by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \n obtain as as' where \"wfp \\ (Main,Entry) -as\\* (Main,Label l)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (Main,Label l) -as'\\* (Main,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)+\n thus ?thesis \n by(fastforce intro:ProcCFG.intra_path_vp simp:ProcCFG.intra_path_def)\n next\n assume \"(p,n) = targetnode a\"\n with \\(px, Entry) = targetnode a\\[THEN sym] \n have [simp]:\"n = Entry\" \"p = px\" by simp_all\n from \\prog \\ Label l -CEdge (px, es, rets)\\\\<^sub>p nx'\\\n have \"containsCall procs prog [] px\" \n by(rule Proc_CFG_Call_containsCall)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \\(px, ins, outs, c) \\ set procs\\\n obtain as' where Xpath:\"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) as' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit) \n from \\containsCall procs prog [] px\\ \\(px, ins, outs, c) \\ set procs\\\n have \"prog,procs \\ (px, Entry) -(\\s. False)\\<^sub>\\\\ (px, Exit)\"\n by(fastforce intro:PCFG.Proc Proc_CFG_Entry_Exit)\n hence \"wfp \\ (px,Entry) -[((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]\\* (px,Exit)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:valid_edge_def ProcCFG.valid_node_def)\n with Xpath have \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Entry) \n ([((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]@as') (Main,Exit)\"\n apply(unfold ProcCFG.vp_def) apply(erule conjE) apply(rule conjI)\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:intra_kind_def)+\n with \\containsCall procs prog [] px\\ \\Rep_wf_prog wfp = (prog,procs)\\\n \\(px, ins, outs, c) \\ set procs\\\n show ?thesis by(fastforce elim:Entry_to_Entry_and_Exit_to_Exit)\n qed\n next\n case (ProcCall px ins outs c l p' es' rets' l' ins' outs' c' ps)\n from disj show ?case\n proof\n assume \"(p,n) = sourcenode a\"\n with \\(px, Label l) = sourcenode a\\[THEN sym] \n have [simp]:\"n = Label l\" \"p = px\" by simp_all\n with \\c \\ Label l -CEdge (p', es', rets')\\\\<^sub>p Label l'\\ have \"l < #:c\"\n by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\l < #:c\\ \n \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n obtain as as' where \"wfp \\ (px,Label l) -as\\* (px,Exit)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (px,Entry) -as'\\* (px,Label l)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Proc)+\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\containsCall procs prog ps px\\\n \\(px, ins, outs, c) \\ set procs\\ obtain asx asx' \n where\" CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) asx (px,Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) asx' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis \n apply(rule_tac x=\"asx@as'\" in exI) apply(rule_tac x=\"as@asx'\" in exI)\n by(auto intro:ProcCFG.path_Append ProcCFG.valid_path_same_level_path_Append\n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:ProcCFG.vp_def)\n next\n assume \"(p,n) = targetnode a\"\n with \\(p', Entry) = targetnode a\\[THEN sym] \n have [simp]:\"n = Entry\" \"p = p'\" by simp_all\n from \\c \\ Label l -CEdge (p', es', rets')\\\\<^sub>p Label l'\\\n have \"containsCall procs c [] p'\" by(rule Proc_CFG_Call_containsCall)\n with \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n have \"containsCall procs prog (ps@[px]) p'\"\n by(rule containsCall_in_proc)\n with \\(p', ins', outs', c') \\ set procs\\\n have \"prog,procs \\ (p', Entry) -(\\s. False)\\<^sub>\\\\ (p', Exit)\"\n by(fastforce intro:PCFG.Proc Proc_CFG_Entry_Exit)\n hence \"wfp \\ (p',Entry) -[((p',Entry),(\\s. False)\\<^sub>\\,(p',Exit))]\\* (p',Exit)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:valid_edge_def ProcCFG.valid_node_def)\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\(p', ins', outs', c') \\ set procs\\\n \\containsCall procs prog (ps@[px]) p'\\\n obtain as as' where \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) as (p',Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (p',Exit) as' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis\n apply(rule_tac x=\"as\" in exI)\n apply(rule_tac x=\"[((p',Entry),(\\s. False)\\<^sub>\\,(p',Exit))]@as'\" in exI)\n apply(unfold ProcCFG.vp_def)\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:intra_kind_def)+\n qed\n next\n case (MainReturn l px es rets l' ins outs c)\n from disj show ?case\n proof\n assume \"(p,n) = sourcenode a\"\n with \\(px, Exit) = sourcenode a\\[THEN sym] \n have [simp]:\"n = Exit\" \"p = px\" by simp_all\n from \\prog \\ Label l -CEdge (px, es, rets)\\\\<^sub>p Label l'\\\n have \"containsCall procs prog [] px\" by(rule Proc_CFG_Call_containsCall)\n with \\(px, ins, outs, c) \\ set procs\\\n have \"prog,procs \\ (px, Entry) -(\\s. False)\\<^sub>\\\\ (px, Exit)\"\n by(fastforce intro:PCFG.Proc Proc_CFG_Entry_Exit)\n hence \"wfp \\ (px,Entry) -[((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]\\* (px,Exit)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:valid_edge_def ProcCFG.valid_node_def)\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\(px, ins, outs, c) \\ set procs\\\n \\containsCall procs prog [] px\\\n obtain as as' where \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) as (px,Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) as' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis\n apply(rule_tac x=\"as@[((px,Entry),(\\s. False)\\<^sub>\\,(px,Exit))]\" in exI)\n apply(rule_tac x=\"as'\" in exI)\n apply(unfold ProcCFG.vp_def)\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.valid_path_same_level_path_Append ProcCFG.intras_same_level_path\n simp:intra_kind_def)+\n next\n assume \"(p, n) = targetnode a\"\n with \\(Main, Label l') = targetnode a\\[THEN sym] \n have [simp]:\"n = Label l'\" \"p = Main\" by simp_all\n with \\prog \\ Label l -CEdge (px, es, rets)\\\\<^sub>p Label l'\\ have \"l' < #:prog\"\n by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \n obtain as as' where \"wfp \\ (Main,Entry) -as\\* (Main,Label l')\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (Main,Label l') -as'\\* (Main,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)+\n thus ?thesis \n by(fastforce intro:ProcCFG.intra_path_vp simp:ProcCFG.intra_path_def)\n qed\n next\n case (ProcReturn px ins outs c l p' es' rets' l' ins' outs' c' ps)\n from disj show ?case\n proof\n assume \"(p,n) = sourcenode a\"\n with \\(p', Exit) = sourcenode a\\[THEN sym] \n have [simp]:\"n = Exit\" \"p = p'\" by simp_all\n from \\c \\ Label l -CEdge (p', es', rets')\\\\<^sub>p Label l'\\\n have \"containsCall procs c [] p'\" by(rule Proc_CFG_Call_containsCall)\n with \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n have \"containsCall procs prog (ps@[px]) p'\"\n by(rule containsCall_in_proc)\n with \\(p', ins', outs', c') \\ set procs\\\n have \"prog,procs \\ (p', Entry) -(\\s. False)\\<^sub>\\\\ (p', Exit)\"\n by(fastforce intro:PCFG.Proc Proc_CFG_Entry_Exit)\n hence \"wfp \\ (p',Entry) -[((p',Entry),(\\s. False)\\<^sub>\\,(p',Exit))]\\* (p',Exit)\"\n by(fastforce intro:ProcCFG.path.intros \n simp:valid_edge_def ProcCFG.valid_node_def)\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\(p', ins', outs', c') \\ set procs\\\n \\containsCall procs prog (ps@[px]) p'\\\n obtain as as' where \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) as (p',Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (p',Exit) as' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis\n apply(rule_tac x=\"as@[((p',Entry),(\\s. False)\\<^sub>\\,(p',Exit))]\" in exI)\n apply(rule_tac x=\"as'\" in exI)\n apply(unfold ProcCFG.vp_def)\n by(fastforce intro:ProcCFG.path_Append \n ProcCFG.valid_path_same_level_path_Append ProcCFG.intras_same_level_path\n simp:intra_kind_def)+\n next\n assume \"(p, n) = targetnode a\"\n with \\(px, Label l') = targetnode a\\[THEN sym] \n have [simp]:\"n = Label l'\" \"p = px\" by simp_all\n with \\c \\ Label l -CEdge (p', es', rets')\\\\<^sub>p Label l'\\ have \"l' < #:c\"\n by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\l' < #:c\\ \n \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n obtain as as' where \"wfp \\ (px,Label l') -as\\* (px,Exit)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (px,Entry) -as'\\* (px,Label l')\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Proc)+\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \\containsCall procs prog ps px\\\n \\(px, ins, outs, c) \\ set procs\\ obtain asx asx' \n where\" CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) asx (px,Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) asx' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis \n apply(rule_tac x=\"asx@as'\" in exI) apply(rule_tac x=\"as@asx'\" in exI)\n by(auto intro:ProcCFG.path_Append ProcCFG.valid_path_same_level_path_Append\n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:ProcCFG.vp_def)\n qed\n next\n case (MainCallReturn nx px es rets nx')\n from \\prog \\ nx -CEdge (px, es, rets)\\\\<^sub>p nx'\\ disj\n \\(Main, nx) = sourcenode a\\[THEN sym] \\(Main, nx') = targetnode a\\[THEN sym]\n obtain l where [simp]:\"n = Label l\" \"p = Main\"\n by(fastforce dest:Proc_CFG_Call_Labels)\n from \\prog \\ nx -CEdge (px, es, rets)\\\\<^sub>p nx'\\ disj\n \\(Main, nx) = sourcenode a\\[THEN sym] \\(Main, nx') = targetnode a\\[THEN sym]\n have \"l < #:prog\" by(auto intro:Proc_CFG_sourcelabel_less_num_nodes\n Proc_CFG_targetlabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \n obtain as as' where \"wfp \\ (Main,Entry) -as\\* (Main,Label l)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (Main,Label l) -as'\\* (Main,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Main)+\n thus ?thesis\n apply(rule_tac x=\"as\" in exI) apply(rule_tac x=\"as'\" in exI) apply simp\n by(fastforce intro:ProcCFG.intra_path_vp simp:ProcCFG.intra_path_def)\n next\n case (ProcCallReturn px ins outs c nx p' es' rets' nx' ps)\n from \\(px, ins, outs, c) \\ set procs\\ wf have [simp]:\"px \\ Main\" by auto\n from \\c \\ nx -CEdge (p', es', rets')\\\\<^sub>p nx'\\ disj \n \\(px, nx) = sourcenode a\\[THEN sym] \\(px, nx') = targetnode a\\[THEN sym]\n obtain l where [simp]:\"n = Label l\" \"p = px\"\n by(fastforce dest:Proc_CFG_Call_Labels)\n from \\c \\ nx -CEdge (p', es', rets')\\\\<^sub>p nx'\\ disj \n \\(px, nx) = sourcenode a\\[THEN sym] \\(px, nx') = targetnode a\\[THEN sym]\n have \"l < #:c\"\n by(auto intro:Proc_CFG_sourcelabel_less_num_nodes\n Proc_CFG_targetlabel_less_num_nodes)\n with \\Rep_wf_prog wfp = (prog,procs)\\ \\(px, ins, outs, c) \\ set procs\\ \n \\containsCall procs prog ps px\\\n obtain as as' where \"wfp \\ (px,Entry) -as\\* (px,Label l)\"\n and \"\\a \\ set as. intra_kind (kind a)\"\n and \"wfp \\ (px,Label l) -as'\\* (px,Exit)\"\n and \"\\a \\ set as'. intra_kind (kind a)\"\n by -(erule Label_Proc_CFG_Entry_Exit_path_Proc)+\n moreover\n from \\Rep_wf_prog wfp = (prog,procs)\\ \n \\containsCall procs prog ps px\\ \\(px, ins, outs, c) \\ set procs\\\n obtain asx asx' where \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (Main,Entry) asx (px,Entry)\"\n and \"CFG.valid_path' sourcenode targetnode kind\n (valid_edge wfp) (get_return_edges wfp) (px,Exit) asx' (Main,Exit)\"\n by -(erule Entry_to_Entry_and_Exit_to_Exit)+\n ultimately show ?thesis\n apply(rule_tac x=\"asx@as\" in exI) apply(rule_tac x=\"as'@asx'\" in exI)\n by(auto intro:ProcCFG.path_Append ProcCFG.valid_path_same_level_path_Append\n ProcCFG.same_level_path_valid_path_Append ProcCFG.intras_same_level_path\n simp:ProcCFG.vp_def)\n qed\nqed\n\n\n\nsubsection \\Instantiating the \\Postdomination\\ locale\\\n\ninterpretation ProcPostdomination:\n Postdomination sourcenode targetnode kind \"valid_edge wfp\" \"(Main,Entry)\"\n get_proc \"get_return_edges wfp\" \"lift_procs wfp\" Main \"(Main,Exit)\"\n for wfp\nproof -\n from Rep_wf_prog[of wfp]\n obtain prog procs where [simp]:\"Rep_wf_prog wfp = (prog,procs)\" \n by(fastforce simp:wf_prog_def)\n hence wf:\"well_formed procs\" by(fastforce intro:wf_wf_prog)\n show \"Postdomination sourcenode targetnode kind (valid_edge wfp)\n (Main, Entry) get_proc (get_return_edges wfp) (lift_procs wfp) Main (Main, Exit)\"\n proof\n fix m\n assume \"CFG.valid_node sourcenode targetnode (valid_edge wfp) m\"\n then obtain a where \"valid_edge wfp a\"\n and \"m = sourcenode a \\ m = targetnode a\"\n by(fastforce simp:ProcCFG.valid_node_def)\n obtain p n where [simp]:\"m = (p,n)\" by(cases m) auto\n from \\valid_edge wfp a\\ \\m = sourcenode a \\ m = targetnode a\\ \n \\Rep_wf_prog wfp = (prog,procs)\\\n show \"\\as. CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) (Main, Entry) as m\"\n by(auto dest!:edge_valid_paths simp:valid_edge_def)\n next\n fix m\n assume \"CFG.valid_node sourcenode targetnode (valid_edge wfp) m\"\n then obtain a where \"valid_edge wfp a\"\n and \"m = sourcenode a \\ m = targetnode a\"\n by(fastforce simp:ProcCFG.valid_node_def)\n obtain p n where [simp]:\"m = (p,n)\" by(cases m) auto\n from \\valid_edge wfp a\\ \\m = sourcenode a \\ m = targetnode a\\ \n \\Rep_wf_prog wfp = (prog,procs)\\\n show \"\\as. CFG.valid_path' sourcenode targetnode kind (valid_edge wfp)\n (get_return_edges wfp) m as (Main,Exit)\"\n by(auto dest!:edge_valid_paths simp:valid_edge_def)\n next\n fix n n'\n assume mex1:\"CFGExit.method_exit sourcenode kind (valid_edge wfp) (Main,Exit) n\"\n and mex2:\"CFGExit.method_exit sourcenode kind (valid_edge wfp) (Main,Exit) n'\"\n and \"get_proc n = get_proc n'\"\n from mex1 \n have \"n = (Main,Exit) \\ (\\a Q p f. n = sourcenode a \\ valid_edge wfp a \\ \n kind a = Q\\\\<^bsub>p\\<^esub>f)\" by(simp add:ProcCFGExit.method_exit_def)\n thus \"n = n'\"\n proof\n assume \"n = (Main,Exit)\"\n from mex2 have \"n' = (Main,Exit) \\ (\\a Q p f. n' = sourcenode a \\ \n valid_edge wfp a \\ kind a = Q\\\\<^bsub>p\\<^esub>f)\" \n by(simp add:ProcCFGExit.method_exit_def)\n thus ?thesis\n proof\n assume \"n' = (Main,Exit)\"\n with \\n = (Main,Exit)\\ show ?thesis by simp\n next\n assume \"\\a Q p f. n' = sourcenode a \\ \n valid_edge wfp a \\ kind a = Q\\\\<^bsub>p\\<^esub>f\"\n then obtain a Q p f where \"n' = sourcenode a\"\n and \"valid_edge wfp a\" and \"kind a = Q\\\\<^bsub>p\\<^esub>f\" by blast\n from \\valid_edge wfp a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have \"get_proc (sourcenode a) = p\" by(rule ProcCFG.get_proc_return)\n with \\get_proc n = get_proc n'\\ \\n = (Main,Exit)\\ \\n' = sourcenode a\\\n have \"get_proc (Main,Exit) = p\" by simp\n hence \"p = Main\" by simp\n with \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ have \"kind a = Q\\\\<^bsub>Main\\<^esub>f\" by simp\n with \\valid_edge wfp a\\ have False by(rule ProcCFG.Main_no_return_source)\n thus ?thesis by simp\n qed\n next\n assume \"\\a Q p f. n = sourcenode a \\ \n valid_edge wfp a \\ kind a = Q\\\\<^bsub>p\\<^esub>f\"\n then obtain a Q p f where \"n = sourcenode a\"\n and \"valid_edge wfp a\" and \"kind a = Q\\\\<^bsub>p\\<^esub>f\" by blast\n from \\valid_edge wfp a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have \"get_proc (sourcenode a) = p\" by(rule ProcCFG.get_proc_return)\n from mex2 have \"n' = (Main,Exit) \\ (\\a Q p f. n' = sourcenode a \\ \n valid_edge wfp a \\ kind a = Q\\\\<^bsub>p\\<^esub>f)\" \n by(simp add:ProcCFGExit.method_exit_def)\n thus ?thesis\n proof\n assume \"n' = (Main,Exit)\"\n from \\get_proc (sourcenode a) = p\\ \\get_proc n = get_proc n'\\\n \\n' = (Main,Exit)\\ \\n = sourcenode a\\\n have \"get_proc (Main,Exit) = p\" by simp\n hence \"p = Main\" by simp\n with \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ have \"kind a = Q\\\\<^bsub>Main\\<^esub>f\" by simp\n with \\valid_edge wfp a\\ have False by(rule ProcCFG.Main_no_return_source)\n thus ?thesis by simp\n next\n assume \"\\a Q p f. n' = sourcenode a \\ \n valid_edge wfp a \\ kind a = Q\\\\<^bsub>p\\<^esub>f\"\n then obtain a' Q' p' f' where \"n' = sourcenode a'\"\n and \"valid_edge wfp a'\" and \"kind a' = Q'\\\\<^bsub>p'\\<^esub>f'\" by blast\n from \\valid_edge wfp a'\\ \\kind a' = Q'\\\\<^bsub>p'\\<^esub>f'\\\n have \"get_proc (sourcenode a') = p'\" by(rule ProcCFG.get_proc_return)\n with \\get_proc n = get_proc n'\\ \\get_proc (sourcenode a) = p\\\n \\n = sourcenode a\\ \\n' = sourcenode a'\\\n have \"p' = p\" by simp\n from \\valid_edge wfp a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have \"sourcenode a = (p,Exit)\" by(auto elim:PCFG.cases simp:valid_edge_def)\n from \\valid_edge wfp a'\\ \\kind a' = Q'\\\\<^bsub>p'\\<^esub>f'\\\n have \"sourcenode a' = (p',Exit)\" by(auto elim:PCFG.cases simp:valid_edge_def)\n with \\n = sourcenode a\\ \\n' = sourcenode a'\\ \\p' = p\\\n \\sourcenode a = (p,Exit)\\ show ?thesis by simp\n qed\n qed\n qed\nqed\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/Proc/ValidPaths.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.26579906319502644}} {"text": "(* Title: SSA_Semantics.thy\n Author: Sebastian Ullrich\n*)\n\nsection \\Proof of Semantic Equivalence\\\n\ntheory SSA_Semantics imports Construct_SSA begin\n\ntype_synonym ('node, 'var) state = \"'var \\ 'node\"\n\ncontext CFG_SSA_Transformed\nbegin\n declare invar[intro!]\n\n definition step ::\n \"'g \\ 'node \\ ('node, 'var) state \\ ('node, 'var) state\"\n where\n \"step g m s v \\ if v \\ oldDefs g m then Some m else s v\"\n\n inductive bs :: \"'g \\ 'node list \\ ('node, 'var) state \\ bool\" (\"_ \\ _\\_\" [50, 50, 50] 50)\n where\n \"g \\ Entry g-ns\\last ns \\ g \\ ns\\(fold (step g) ns Map.empty)\"\n\n\n definition ssaStep ::\n \"'g \\ 'node \\ nat \\ ('node, 'val) state \\ ('node, 'val) state\"\n where\n \"ssaStep g m i s v \\\n if v \\ defs g m then\n Some m\n else\n case phis g (m,v) of\n Some phiParams \\ s (phiParams ! i)\n | None \\ s v\"\n\n inductive ssaBS :: \"'g \\ 'node list \\ ('node, 'val) state \\ bool\" (\"_ \\ _\\\\<^sub>s _\" [50, 50, 50] 50)\n for\n g :: 'g\n where\n empty: \"g \\ [Entry g]\\\\<^sub>s(ssaStep g (Entry g) 0 Map.empty)\"\n | snoc: \"\\g \\ ns\\\\<^sub>ss; last ns = old.predecessors g m ! i; m \\ set (\\n g); i < length (old.predecessors g m)\\ \\\n g \\ (ns@[m])\\\\<^sub>s(ssaStep g m i s)\"\n\n lemma ssaBS_I:\n assumes \"g \\ Entry g-ns\\n\"\n obtains s where \"g \\ ns\\\\<^sub>ss\"\n using assms\n proof (atomize_elim, induction rule:old.path2_rev_induct)\n case (snoc ns m' m)\n then obtain s where s: \"g \\ ns\\\\<^sub>ss\" by auto\n from snoc.hyps(2) obtain i where \"m' = old.predecessors g m ! i\" \"i < length (old.predecessors g m)\" by (auto simp:in_set_conv_nth)\n with snoc.hyps snoc.prems s show ?case by -(rule exI, erule ssaBS.snoc, auto dest:old.path2_last)\n qed (auto intro: ssaBS.empty)\n\n lemma ssaBS_nonempty[simp]: \"\\ (g \\ []\\\\<^sub>ss)\"\n by (rule notI, cases rule: ssaBS.cases, auto)\n\n lemma ssaBS_hd[simp]: \"g \\ ns\\\\<^sub>ss \\ hd ns = Entry g\"\n by (induction rule: ssaBS.induct, auto simp: hd_append)\n\n\n lemma equiv_aux:\n assumes \"g \\ ns\\s\" \"g \\ ns\\\\<^sub>ss'\" \"g \\ last ns-ms\\m\" \"v \\ allUses g m\" \"\\n \\ set (tl ms). var g v \\ var g ` allDefs g n\"\n shows \"s (var g v) = s' v\"\n using assms(2) assms(1,3-) proof (induction arbitrary: v s ms m)\n case empty\n have \"v \\ defs g (Entry g)\"\n proof-\n from empty.prems(2,3) have \"defAss g m v\" by - (rule allUses_def_ass, auto)\n with empty.prems(2) obtain n where n: \"n \\ set ms\" \"v \\ allDefs g n\" by - (drule defAssD, auto)\n with empty.prems(4) have \"n \\ set (tl ms)\" by auto\n with empty.prems(2) n have \"n = Entry g\" by (cases ms, auto dest: old.path2_hd)\n with n(2) show ?thesis by (auto simp: allDefs_def)\n qed\n with empty.prems(1) show ?case\n by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def split: option.split)\n next\n case (snoc ns s' n i)\n from snoc.prems(2) have[simp]: \"n \\ set (\\n g)\" \"m \\ set (\\n g)\" by auto\n from snoc.prems(2,3) have[simp]: \"v \\ allVars g\" by - (rule allUses_in_allVars, auto)\n from snoc.hyps(4) have[simp]: \"n \\ Entry g\" by (auto simp: Entry_no_predecessor)\n\n show ?case\n proof (cases \"var g v \\ var g ` allDefs g n\")\n case True\n\n have[simp]: \"defNode g v = n\" (is \"?n\\<^sub>v = _\")\n proof-\n from True obtain v' where v': \"v' \\ allDefs g n\" \"var g v' = var g v\" by auto\n from snoc.prems(3) have \"defAss g m v\" by - (rule allUses_def_ass, auto)\n moreover from snoc.prems(1) obtain ns' where ns': \"g \\ Entry g-ns'\\n\" \"set ns' \\ set (ns@[n])\" \"distinct ns'\"\n by (auto elim!: bs.cases intro: old.simple_path2)\n ultimately have \"?n\\<^sub>v \\ set (ns'@tl ms)\"\n using snoc.prems(2) by - (drule defAss_defNode, auto elim!: bs.cases dest: old.path2_app)\n moreover {\n let ?n'' = \"last (butlast ns')\"\n assume asm: \"?n\\<^sub>v \\ set (butlast ns')\"\n with ns'(1,3) have[simp]: \"?n\\<^sub>v \\ n\" by (cases ns' rule: rev_cases, auto dest!: old.path2_last)\n from ns'(1) have \"length ns' \\ 2\" by auto\n with ns' have bns': \"g \\ Entry g-butlast ns'\\?n''\" \"?n'' \\ set (old.predecessors g n)\"\n by (auto elim: old.path2_unsnoc)\n with asm obtain ns'' where ns'': \"g \\ ?n\\<^sub>v-ns''\\?n''\" \"suffix ns'' (butlast ns')\" \"?n\\<^sub>v \\ set (tl ns'')\"\n by - (rule old.path2_split_first_last, auto)\n with bns' snoc.prems(2) have \"g \\ ?n\\<^sub>v-(ns''@[n])@tl ms\\m\" by - (rule old.path2_app, auto)\n hence \"defNode g v' \\ set (tl (ns''@[n]@tl ms))\"\n using v' snoc.prems(3,4) bns'(2) ns''(1,3)\n by - (rule conventional''[of g v _ m], auto intro!: old.path2_app simp: old.path2_not_Nil)\n with ns' ns''(1) v'(1) have False by (auto simp: old.path2_not_Nil)\n } \n ultimately show ?thesis using snoc.prems(4) ns'(1) by (cases ns' rule: rev_cases, auto dest: old.path2_last)\n qed\n from \\v \\ allVars g\\ show ?thesis\n proof (cases rule: defNode_cases)\n case simpleDef\n thus ?thesis using snoc.prems(1) by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def)\n next\n case phi\n {\n fix v'\n assume asm: \"v' \\ defs g n\" \"var g v = var g v'\"\n with phi have \"v' = v\" using allDefs_var_disjoint[of n g v' v]\n by (cases, auto dest!: phi_phiDefs)\n with asm(1) phi have False using simpleDefs_phiDefs_disjoint[of n g]\n by (auto dest!: phi_phiDefs)\n }\n note 1 = this\n {\n fix vs\n assume asm: \"g \\ Entry g-ns @ [n]\\n\" \"phis g (n, v) = Some vs\" \"var g v \\ var g ` defs g n\"\n let ?n' = \"last ns\"\n from asm(1) have \"length ns \\ 1\" by (cases ns, auto simp: old.path2_def)\n hence \"g \\ Entry g-ns\\?n'\"\n by - (rule old.path2_unsnoc[OF asm(1)], auto)\n moreover have \"vs ! i \\ phiUses g ?n'\" using snoc.hyps(2,4) phis_wf[OF asm(2)]\n by - (rule phiUsesI[OF _ asm(2)], auto simp: set_zip)\n ultimately have \"fold (step g) ns Map.empty (var g (vs ! i)) = s' (vs ! i)\"\n by - (rule snoc.IH[where ms1=\"[?n']\" and m1=\"?n'\"], auto intro!: bs.intros)\n hence \"fold (step g) ns Map.empty (var g v) = s' (vs ! i)\" using phis_same_var[OF asm(2), of \"vs ! i\"] snoc.hyps(4) phis_wf[OF asm(2)]\n by auto\n }\n thus ?thesis using phi snoc.prems(1)\n by - (erule bs.cases, auto dest!: 1 simp: step_def ssaStep_def oldDefs_def phi_def)\n qed\n next\n case False\n hence \"phis g (n, v) = None\" by (auto simp: allDefs_def phiDefs_def)\n moreover have \"fold (step g) ns Map.empty (var g v) = s' v\"\n proof-\n from snoc.hyps(1) have \"length ns \\ 1\" by (cases ns, auto)\n moreover from snoc.prems(2,4) False have \"\\n \\ set ms. var g v \\ var g ` allDefs g n\"\n by (cases ms, auto simp: phiDefs_def dest: old.path2_hd)\n ultimately show ?thesis\n using snoc.prems(1,2,3) by - (rule snoc.IH[where ms1=\"last ns#ms\"], auto elim!: bs.cases intro!: bs.intros elim: old.path2_unsnoc intro!: old.Cons_path2)\n qed\n ultimately show ?thesis\n using snoc.prems(1) False by - (erule bs.cases, auto simp: step_def ssaStep_def oldDefs_def)\n qed\n qed\n\n theorem equiv:\n assumes \"g \\ ns\\s\" \"g \\ ns\\\\<^sub>ss'\" \"v \\ uses g (last ns)\"\n shows \"s (var g v) = s' v\"\n using assms by - (rule equiv_aux[where ms=\"[last ns]\"], auto elim!: bs.cases)\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Formal_SSA/SSA_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.26573154984762265}} {"text": "section {*I\\_kparser\\_FS*}\ntheory\n I_kparser_FS\n\nimports\n I_kparser_base\n\nbegin\n\nrecord ('stack, 'event) parserFS_conf =\n parserFS_conf_fixed :: \"'event list\"\n parserFS_conf_stack :: \"'stack list\"\n parserFS_conf_scheduler :: \"'event list\"\n\ndefinition parserFS_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf set\"\n where\n \"parserFS_configurations G \\\n {\\parserFS_conf_fixed = f,\n parserFS_conf_stack = l,\n parserFS_conf_scheduler = r\\\n | f l r.\n set l \\ parser_nonterms G\n \\ f \\ parser_fixed_schedulers G\n \\ r \\ parser_unfixed_schedulers G\n \\ f @ r \\ parser_schedulers G}\"\n\ndefinition parserFS_step_relation :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserFS_conf\n \\ bool\"\n where\n \"parserFS_step_relation G c1 p c2 \\\n p \\ parser_rules G\n \\ ((\\x. parserFS_conf_stack c1=x@(rule_lpop p) \\ parserFS_conf_stack c2=x@(rule_lpush p))\n \\ (\\v. rule_rpop p=v@rule_rpush p \\\n ((\\popnew. parserFS_conf_fixed c1 @ popnew = rule_rpop p\n \\ parserFS_conf_scheduler c1=popnew@parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush p)\n \\\n (\\remainder. rule_rpop p @ remainder = parserFS_conf_fixed c1\n \\ parserFS_conf_scheduler c1=parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush p@remainder)\n )))\"\n\ndefinition parserFS_step_relation_ALT :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserFS_conf\n \\ bool\"\n where\n \"parserFS_step_relation_ALT G c1 e c2 \\\n e \\ parser_rules G\n \\ (\\x. parserFS_conf_stack c1 = x @ rule_lpop e\n \\ parserFS_conf_stack c2 = x @ rule_lpush e)\n \\ (\\v. rule_rpop e = v @ rule_rpush e)\n \\ ((\\popnew.\n parserFS_conf_fixed c1 @ popnew = rule_rpop e\n \\ parserFS_conf_scheduler c1 = popnew @ parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush e)\n \\ (\\remainder.\n rule_rpop e @ remainder = parserFS_conf_fixed c1\n \\ parserFS_conf_scheduler c1=parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush e @ remainder)\n )\"\n\nlemma parserFS_step_relation_ALT_vs_parserFS_step_relation: \"\n parserFS_step_relation_ALT G c1 p c2 = parserFS_step_relation G c1 p c2\"\n apply(simp add: parserFS_step_relation_ALT_def parserFS_step_relation_def)\n done\n\ndefinition parserFS_step_relation_ALT2 :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserFS_conf\n \\ bool\"\n where\n \"parserFS_step_relation_ALT2 G c1 e c2 \\\n e \\ parser_rules G\n \\ (\\x. parserFS_conf_stack c1 = x @ rule_lpop e\n \\ parserFS_conf_stack c2 = x @ rule_lpush e)\n \\ ((\\popnew.\n parserFS_conf_fixed c1 @ popnew = rule_rpop e\n \\ parserFS_conf_scheduler c1 = popnew @ parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush e)\n \\ (\\remainder.\n parserFS_conf_fixed c1 = rule_rpop e @ remainder\n \\ parserFS_conf_scheduler c1 = parserFS_conf_scheduler c2\n \\ parserFS_conf_fixed c2 = rule_rpush e @ remainder)\n )\"\n\nlemma parserFS_step_relation_ALT2_vs_parserFS_step_relation_ALT: \"\n valid_parser G\n \\ parserFS_step_relation_ALT2 G c1 p c2 = parserFS_step_relation_ALT G c1 p c2\"\n apply(simp add: parserFS_step_relation_ALT_def parserFS_step_relation_ALT2_def)\n apply(rule order_antisym)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"p\"\n in ballE)+\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac x k xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac x k xa)(*strict*)\n apply(rule_tac\n x=\"xa\"\n in exI)\n apply(force)\n apply(rename_tac x k xa)(*strict*)\n apply(force)\n done\n\ndefinition parserFS_step_relation_HFS_STYLE :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf\n \\ ('stack, 'event) parser_step_label\n \\ ('stack, 'event) parserFS_conf\n \\ bool\"\n where\n \"parserFS_step_relation_HFS_STYLE G c1 e c2 \\\n e \\ parser_rules G\n \\ (\\x. parserFS_conf_stack c1 = x @ rule_lpop e\n \\ parserFS_conf_stack c2 = x @ rule_lpush e)\n \\ (\\x. parserFS_conf_scheduler c1 = rule_rpop e @ x\n \\ parserFS_conf_scheduler c2 = rule_rpush e @ x)\n \\ parserFS_conf_fixed c2\n = rule_rpush e\n @ drop\n (length (rule_rpop e))\n (parserFS_conf_fixed c1)\"\n\ndefinition parserFS_initial_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf set\"\n where\n \"parserFS_initial_configurations G \\\n {c. parserFS_conf_fixed c = []\n \\ parserFS_conf_stack c = [parser_initial G]}\n \\ parserFS_configurations G\"\n\ndefinition parserFS_marking_configurations :: \"\n ('stack, 'event, 'marker) parser\n \\ ('stack, 'event) parserFS_conf set\"\n where\n \"parserFS_marking_configurations G \\\n {c. \\f \\ parser_marking G. \\w.\n parserFS_conf_stack c = w @ [f]\n \\ parserFS_conf_fixed c @ parserFS_conf_scheduler c\n = [parser_bottom G]}\n \\ parserFS_configurations G\"\n\ndefinition parserFS_marking_condition :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf)derivation\n \\ bool\"\n where\n \"parserFS_marking_condition G d \\\n (\\c.\n d 0 =Some (pair None c)\n \\ c \\ parserFS_configurations G)\n \\ (\\i e c.\n d i = Some (pair e c)\n \\ c \\ parserFS_marking_configurations G)\"\n\ndefinition parserFS_marked_effect :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf)derivation\n \\ 'event list set\"\n where\n \"parserFS_marked_effect G d \\\n {w. \\c.\n d 0 = Some (pair None c)\n \\ w = butlast (parserFS_conf_scheduler c)}\"\n\ndefinition parserFS_unmarked_effect :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf)derivation\n \\ 'event list set\"\n where\n \"parserFS_unmarked_effect G d \\\n {w. \\c c' i e v.\n d 0 = Some (pair None c)\n \\ d i = Some (pair e c')\n \\ v @ parserFS_conf_fixed c' @ parserFS_conf_scheduler c'\n = parserFS_conf_scheduler c\n \\ w = butlast_if_match\n (v @ parserFS_conf_fixed c')\n (parser_bottom G)}\"\n\ndefinition parserFS_get_destinations :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf)derivation_configuration\n \\ ('stack, 'event) parser_destinations set\"\n where\n \"parserFS_get_destinations G e \\\n case e of pair e c \\\n state ` set (parserFS_conf_stack c)\n \\ (case e of None \\ {} | Some e' \\ {rule e'})\"\n\ndefinition parserFS_string_state :: \"\n ('stack, 'event) parserFS_conf\n \\ 'event list\"\n where\n \"parserFS_string_state c \\\n parserFS_conf_fixed c @ parserFS_conf_scheduler c\"\n\nlemma parserFS_inst_AX_initial_configuration_belongs: \"\n (\\G. valid_parser G \\ parserFS_initial_configurations G \\ parserFS_configurations G)\"\n apply(clarsimp)\n apply(rename_tac G x)(*strict*)\n apply(simp add: parserFS_initial_configurations_def)\n done\n\nlemma parserFS_inst_AX_step_relation_preserves_belongs: \"\n (\\G. valid_parser G \\ (\\c1 e c2. parserFS_step_relation G c1 e c2 \\ c1 \\ parserFS_configurations G \\ e \\ parser_step_labels G \\ c2 \\ parserFS_configurations G))\"\n apply(clarsimp)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: parser_step_labels_def parserFS_step_relation_def)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G e c2 f l r)(*strict*)\n apply(simp add: parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G e c2 f r x v)(*strict*)\n apply(simp add: parser_step_labels_def)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G e c2 f r x v)(*strict*)\n prefer 2\n apply(simp add: valid_parser_def)\n apply(rename_tac G e c2 f r x v)(*strict*)\n apply(erule disjE)\n apply(rename_tac G e c2 f r x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c2 f x v popnew)(*strict*)\n apply(case_tac c2)\n apply(rename_tac G e c2 f x v popnew parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(simp add: parser_fixed_schedulers_def)\n apply(simp add: prefix_closure_def prefix_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"rule_rpush e @ [parser_bottom G]\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w)(*strict*)\n apply (metis elem_set_app in_set_takeD)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply(rule_tac\n x=\"rule_rpush e\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"xa\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"set xa \\ set w\")\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply (metis butlast_snoc subset_trans trivButLast)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply (metis nset_diff subset_trans)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply(rule_tac\n t=\"w\"\n and s=\"v@xa\"\n in ssubst)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply(rule_tac\n v=\"[parser_bottom G]\"\n in append_injr)\n apply (metis concat_asso)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c k w nat xa)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(simp add: parser_unfixed_schedulers_def)\n apply(simp add: suffix_closure_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n apply(rule_tac\n x=\"vb @ [parser_bottom G]\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"f@popnew\"\n in exI)\n apply(rule sym)\n apply(rule_tac\n t=\"vb @ [parser_bottom G]\"\n and s=\"f @ popnew @ parserFS_conf_scheduler\"\n in ssubst)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler vb vc c)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler)(*strict*)\n apply(simp add: parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler va)(*strict*)\n apply(case_tac \"parserFS_conf_scheduler\")\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler va)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew va)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew va k w xb xc)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac G e f x v popnew va k w xb xc)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G e f x v popnew va k w xb xc)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew va k w xb xc)(*strict*)\n apply (metis kPrefix_def take_reflects_mem)\n apply(rename_tac G e f x v popnew va k w xb xc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew k w xb xc nat)(*strict*)\n apply(rule_tac\n x=\"xc\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"set xc \\ set w\")\n apply(rename_tac G e f x v popnew k w xb xc nat)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew k w xb xc nat)(*strict*)\n apply (metis butlast_snoc_2 set_append2 snoc_eq_iff_butlast)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler va a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. parserFS_conf_scheduler = w' @ [x']\")\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler va a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e f x v popnew parserFS_conf_scheduler va a list)(*strict*)\n apply(thin_tac \"parserFS_conf_scheduler = a # list\")\n apply(clarsimp)\n apply(rename_tac G e f x v popnew w')(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew w' k w)(*strict*)\n apply(simp add: kPrefix_def)\n apply(case_tac \"k-length w\")\n apply(rename_tac G e f x v popnew w' k w)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"parser_bottom G \\ set w\")\n apply(rename_tac G e f x v popnew w' k w)(*strict*)\n apply(force)\n apply(rename_tac G e f x v popnew w' k w)(*strict*)\n apply (metis nset_mp set_append2 set_take_subset)\n apply(rename_tac G e f x v popnew w' k w nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew w' k w nat xa)(*strict*)\n apply(case_tac \"popnew\")\n apply(rename_tac G e f x v popnew w' k w nat xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e f x v popnew w' k w nat xa a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. popnew = w' @ [x']\")\n apply(rename_tac G e f x v popnew w' k w nat xa a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e f x v popnew w' k w nat xa a list)(*strict*)\n apply(thin_tac \"popnew = a # list\")\n apply(clarsimp)\n apply(rename_tac G e c2 f r x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e c2 x v remainder)(*strict*)\n apply(case_tac c2)\n apply(rename_tac G e c2 x v remainder parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler)(*strict*)\n apply(rule conjI)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler)(*strict*)\n apply(simp add: parser_fixed_schedulers_def)\n apply(simp add: prefix_closure_def prefix_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc c)(*strict*)\n apply(case_tac c)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc)(*strict*)\n apply(case_tac \"remainder\")\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb vc)(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb vc)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x parserFS_conf_scheduler vb vc)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e x v parserFS_conf_scheduler vb vc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb vc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb vc a list)(*strict*)\n apply(thin_tac \"rule_rpush e = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(subgoal_tac \"parserFS_conf_scheduler=[]\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n prefer 2\n apply(case_tac parserFS_conf_scheduler)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. parserFS_conf_scheduler = w' @ [x']\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(thin_tac \"parserFS_conf_scheduler = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v w')(*strict*)\n apply(rule_tac\n x=\"w' @ [parser_bottom G]\"\n in exI)\n apply(force)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. remainder= w' @ [x']\")\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc a list)(*strict*)\n apply(thin_tac \"remainder = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(subgoal_tac \"parserFS_conf_scheduler=[]\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n prefer 2\n apply(case_tac parserFS_conf_scheduler)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. parserFS_conf_scheduler = w' @ [x']\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(thin_tac \"parserFS_conf_scheduler = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v w')(*strict*)\n apply(rule_tac\n x=\"rule_rpush e @ w' @ [parser_bottom G]\"\n in exI)\n apply(force)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. c= w' @ [x']\")\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb vc c a list)(*strict*)\n apply(thin_tac \"c = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb w')(*strict*)\n apply(case_tac \"remainder\")\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(rule conjI)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(rule_tac\n x=\"rule_rpush e@[parser_bottom G]\"\n in exI)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(case_tac \"parserFS_conf_scheduler\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v vb w')(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G e x v vb w' k w xb xc)(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set (rule_rpush e)\")\n apply(rename_tac G e x v vb w' k w xb xc)(*strict*)\n apply(force)\n apply(rename_tac G e x v vb w' k w xb xc)(*strict*)\n apply(rule_tac\n t=\"rule_rpush e\"\n and s=\"xc @ [parser_bottom G]\"\n in ssubst)\n apply(rename_tac G e x v vb w' k w xb xc)(*strict*)\n apply(force)\n apply(rename_tac G e x v vb w' k w xb xc)(*strict*)\n apply (metis Nil_is_append_conv last_in_set last_snoc not_Cons_self2)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. parserFS_conf_scheduler= w' @ [x']\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(thin_tac \"parserFS_conf_scheduler = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. remainder= w' @ [x']\")\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v remainder parserFS_conf_scheduler vb w' a list)(*strict*)\n apply(thin_tac \"remainder = a # list\")\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x')(*strict*)\n apply(rule conjI)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x')(*strict*)\n apply(rule_tac\n x=\"rule_rpush e @ w'a @ [x']@[parser_bottom G]\"\n in exI)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x')(*strict*)\n apply(case_tac \"parserFS_conf_scheduler\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x')(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. parserFS_conf_scheduler= w' @ [x']\")\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e x v parserFS_conf_scheduler vb w' w'a x' a list)(*strict*)\n apply(thin_tac \"parserFS_conf_scheduler = a # list\")\n apply(clarsimp)\n done\n\ninterpretation \"parserFS\" : loc_autFS_0\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n done\n\nlemma parserFS_input_decreases: \"\n valid_parser G\n \\ parserFS.derivation G d\n \\ parserFS.belongs G d\n \\ d i = Some (pair e c)\n \\ d j = Some (pair e' c')\n \\ i\\j\n \\ \\w. parserFS_conf_scheduler c = w @ parserFS_conf_scheduler c'\"\n apply(induct \"j-i\" arbitrary: i e c)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ parserFS_step_relation G c1 e2 c2\")\n apply(rename_tac x i e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"j\"\n in parserFS.step_detail_before_some_position)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule_tac\n x=\"Suc i\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Some e2\"\n in meta_allE)\n apply(erule_tac\n x=\"c2\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_conf_scheduler c = w @ parserFS_conf_scheduler c2\")\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(simp add: parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 w xa v)(*strict*)\n apply(erule disjE)\n apply(rename_tac x i e c e2 c2 w xa v)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 w xa v)(*strict*)\n apply(clarsimp)\n done\n\nlemma parserFS_input_with_fixed_decreases: \"\n valid_parser G\n \\ parserFS.derivation G d\n \\ parserFS.belongs G d\n \\ d i = Some (pair e c)\n \\ d j = Some (pair e' c')\n \\ i\\j\n \\ \\w. parserFS_conf_fixed c @ parserFS_conf_scheduler c = w @ parserFS_conf_fixed c' @ parserFS_conf_scheduler c'\"\n apply(induct \"j-i\" arbitrary: i e c)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ parserFS_step_relation G c1 e2 c2\")\n apply(rename_tac x i e c)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"j\"\n in parserFS.step_detail_before_some_position)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule_tac\n x=\"Suc i\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Some e2\"\n in meta_allE)\n apply(erule_tac\n x=\"c2\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_conf_fixed c @ parserFS_conf_scheduler c = w @ parserFS_conf_fixed c2 @ parserFS_conf_scheduler c2\")\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(thin_tac \"parserFS_conf_fixed c2 @ parserFS_conf_scheduler c2 = w @ parserFS_conf_fixed c' @ parserFS_conf_scheduler c'\")\n apply(rename_tac x i e c e2 c2 w)(*strict*)\n apply(simp add: parserFS_step_relation_def)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 xa v)(*strict*)\n apply(erule disjE)\n apply(rename_tac x i e c e2 c2 xa v)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 xa v)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2 xa v remainder)(*strict*)\n apply(rule_tac\n x=\"v\"\n in exI)\n apply(force)\n done\n\nlemma parserFS_inst_AX_effect_inclusion1: \"\n (\\M. valid_parser M \\\n (\\f. ATS.derivation_initial parserFS_initial_configurations\n parserFS_step_relation M f \\\n parserFS_marking_condition M f \\\n parserFS_marked_effect M f \\ parserFS_unmarked_effect M f))\"\n apply(clarsimp)\n apply(rename_tac M f x)(*strict*)\n apply(simp add: parserFS_unmarked_effect_def parserFS_marked_effect_def parserFS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac M f c i e cb)(*strict*)\n apply(rule_tac\n x=\"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac M f c i e cb)(*strict*)\n apply(force)\n apply(rename_tac M f c i e cb)(*strict*)\n apply(simp add: parserFS_marking_configurations_def parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac M f i e fa l r fb w fc ra)(*strict*)\n apply(subgoal_tac \"fa=[]\")\n apply(rename_tac M f i e fa l r fb w fc ra)(*strict*)\n prefer 2\n apply(simp add: parserFS.derivation_initial_def)\n apply(clarsimp)\n apply(simp add: parserFS_initial_configurations_def)\n apply(rename_tac M f i e fa l r fb w fc ra)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(subgoal_tac \"\\w. r=w @ ra\")\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n prefer 2\n apply(subgoal_tac \"\\x. parserFS_conf_scheduler \\parserFS_conf_fixed = [], parserFS_conf_stack = l, parserFS_conf_scheduler = r\\ = x @ parserFS_conf_scheduler \\parserFS_conf_fixed = fc, parserFS_conf_stack = w @ [fb], parserFS_conf_scheduler = ra\\\")\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n prefer 2\n apply(rule parserFS_input_decreases)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(rule parserFS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(rule parserFS.derivation_initial_belongs)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(force)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l r fb w fc ra)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(subgoal_tac \"\\w. w@fc@ra=wa@ra\")\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n prefer 2\n apply(subgoal_tac \"\\x. parserFS_conf_fixed \\parserFS_conf_fixed = [], parserFS_conf_stack = l, parserFS_conf_scheduler = wa @ ra\\ @ parserFS_conf_scheduler \\parserFS_conf_fixed = [], parserFS_conf_stack = l, parserFS_conf_scheduler = wa @ ra\\ = x @ parserFS_conf_fixed \\parserFS_conf_fixed = fc, parserFS_conf_stack = w @ [fb], parserFS_conf_scheduler = ra\\ @ parserFS_conf_scheduler \\parserFS_conf_fixed = fc, parserFS_conf_stack = w @ [fb], parserFS_conf_scheduler = ra\\\")\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n prefer 2\n apply(rule parserFS_input_with_fixed_decreases)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(rule parserFS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(rule parserFS.derivation_initial_belongs)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l fb w fc ra wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l fb w fc ra wa wb)(*strict*)\n apply(case_tac ra)\n apply(rename_tac M f i e l fb w fc ra wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac M f i e l fb w wb)(*strict*)\n apply (metis butlast_if_match_direct)\n apply(rename_tac M f i e l fb w fc ra wa wb a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ra = w' @ [x']\")\n apply(rename_tac M f i e l fb w fc ra wa wb a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac M f i e l fb w fc ra wa wb a list)(*strict*)\n apply(thin_tac \"ra = a # list\")\n apply(clarsimp)\n apply(rename_tac M f i e l fb w wa)(*strict*)\n apply(simp add: parser_unfixed_schedulers_def parser_schedulers_def)\n apply(clarsimp)\n apply (metis butlast_if_match_direct2_prime)\n done\n\nlemma parserFS_inst_lang_sound: \"\n (\\M. valid_parser M \\ parserFS.unmarked_language M \\ parser_markers M)\"\n apply(clarsimp)\n apply(rename_tac M x)(*strict*)\n apply(simp add: parserFS.unmarked_language_def parserFS_unmarked_effect_def parser_markers_def)\n apply(clarsimp)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(subgoal_tac \"c \\ parserFS_configurations M\")\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(subgoal_tac \"c' \\ parserFS_configurations M\")\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(simp add: parserFS_configurations_def parser_unfixed_schedulers_def parser_schedulers_def suffix_closure_def suffix_def parser_fixed_schedulers_def prefix_closure_def prefix_def)\n apply(clarsimp)\n apply(rename_tac M xa d i v e f fa l la ra ve ca vg vh cb cc vj \"cd\")(*strict*)\n apply(rule_tac\n A=\"set (v@fa)\"\n in set_mp)\n apply(rename_tac M xa d i v e f fa l la ra ve ca vg vh cb cc vj \"cd\")(*strict*)\n prefer 2\n apply (metis set_butlast_if_match_is_subset subsetD)\n apply(rename_tac M xa d i v e f fa l la ra ve ca vg vh cb cc vj \"cd\")(*strict*)\n apply(simp add: valid_parser_def)\n apply (metis append_Nil2 butlast_if_match_direct butlast_if_match_pull_out set_app_subset set_concat_subset set_subset_in2 subset_trans)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(rule parserFS.belongs_configurations)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(rule parserFS.derivation_initial_belongs)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(rule parserFS.belongs_configurations)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(rule parserFS.derivation_initial_belongs)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac M xa d c c' i v e)(*strict*)\n apply(force)\n done\n\nlemma parserFS_inst_AX_marking_condition_implies_existence_of_effect: \"\n (\\M. valid_parser M \\\n (\\f. ATS.derivation_initial parserFS_initial_configurations\n parserFS_step_relation M f \\\n parserFS_marking_condition M f \\\n parserFS_marked_effect M f \\ {}))\"\n apply(simp add: parserFS_marking_condition_def parserFS_marked_effect_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_unmarked_effect_persists: \"\n (\\G. valid_parser G \\\n (\\d. ATS.derivation_initial parserFS_initial_configurations\n parserFS_step_relation G d \\\n (\\n. parserFS_unmarked_effect G (derivation_take d n)\n \\ parserFS_unmarked_effect G d)))\"\n apply(clarsimp)\n apply(rename_tac G d n xa)(*strict*)\n apply(simp add: parserFS_unmarked_effect_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac G d n c c' i v e)(*strict*)\n apply(case_tac \"i\\n\")\n apply(rename_tac G d n c c' i v e)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G d n c c' i v e)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"c'\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G d n c c' i v e)(*strict*)\n apply(force)\n apply(rename_tac G d n c c' i v e)(*strict*)\n apply(rule_tac\n x=\"v\"\n in exI)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_axioms: \"\n ATS_Language_axioms valid_parser parserFS_initial_configurations\n parserFS_step_relation parser_markers parserFS_marking_condition\n parserFS_marked_effect parserFS_unmarked_effect \"\n apply(simp add: ATS_Language_axioms_def)\n apply(simp add: parserFS_inst_AX_effect_inclusion1 parserFS_inst_lang_sound parserFS_inst_AX_marking_condition_implies_existence_of_effect parserFS_inst_AX_unmarked_effect_persists )\n done\n\ninterpretation \"parserFS\" : loc_autFS_1\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs parserFS_inst_ATS_axioms )\n done\n\nlemma parserFS_inst_AX_marking_can_not_be_disabled: \"\n (\\G d. (\\n. parserFS_marking_condition G (derivation_take d n)) \\ parserFS_marking_condition G d)\"\n apply(clarsimp)\n apply(rename_tac G d n)(*strict*)\n apply(simp add: parserFS_marking_condition_def derivation_take_def)\n apply(clarsimp)\n apply(rename_tac G d n c i e ca)(*strict*)\n apply(case_tac \"i\\n\")\n apply(rename_tac G d n c i e ca)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G d n c i e ca)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"ca\"\n in exI)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_marked_effect_persists: \"\n (\\G d n. parserFS_marked_effect G (derivation_take d n) \\ parserFS_marked_effect G d)\"\n apply(clarsimp)\n apply(rename_tac G d n x)(*strict*)\n apply(simp add: parserFS_marked_effect_def derivation_take_def)\n done\n\nlemma parserFS_inst_accept: \"\n \\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ parserFS_marking_condition G d = (\\i e c. d i = Some (pair e c) \\ c \\ parserFS_marking_configurations G))\"\n apply(clarsimp)\n apply(rename_tac G d)(*strict*)\n apply(simp add: parserFS_marking_condition_def)\n apply(rule order_antisym)\n apply(rename_tac G d)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d i e c)(*strict*)\n apply(simp add: parserFS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(rename_tac G d i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d i e c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G d i e c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d i e c b)(*strict*)\n apply(simp add: parserFS_initial_configurations_def)\n done\n\nlemma parserFS_inst_AX_string_state_decreases: \"\n \\G. valid_parser G \\\n (\\c1. c1 \\ parserFS_configurations G \\\n (\\e c2. parserFS_step_relation G c1 e c2 \\\n (\\w. parserFS_string_state c1 =\n w @ parserFS_string_state c2)))\"\n apply(clarsimp)\n apply(rename_tac M c1 e c2)(*strict*)\n apply(simp add: parserFS_string_state_def parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac M c1 e c2 x v)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label M e\")\n apply(rename_tac M e c1 c2 x v)(*strict*)\n prefer 2\n apply(rename_tac M c1 e c2 x v)(*strict*)\n apply(simp add: valid_parser_def)\n apply(rename_tac M e c1 c2 x v)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac M e c1 c2 x v k w)(*strict*)\n apply(erule disjE)\n apply(rename_tac M e c1 c2 x v k w)(*strict*)\n apply(clarsimp)\n apply(rename_tac M e c1 c2 x v k w popnew)(*strict*)\n apply(rule_tac\n x=\"v\"\n in exI)\n apply(force)\n apply(rename_tac M e c1 c2 x v k w)(*strict*)\n apply(clarsimp)\n apply(rename_tac M e c1 c2 x v k w remainder)(*strict*)\n apply(rule_tac\n x=\"v\"\n in exI)\n apply(force)\n done\n\nlemma parserFS_inst_lang_finite: \"\n (\\G. valid_parser G \\ parserFS.finite_marked_language G = parserFS.marked_language G)\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(simp add: parserFS.finite_marked_language_def parserFS.marked_language_def)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d n)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: parserFS.derivation_initial_def)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d)(*strict*)\n apply(simp add: parserFS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G d c)(*strict*)\n apply(simp add: parserFS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule_tac\n x=\"derivation_take d i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule parserFS.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"ca\"\n in exI)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d c i e ca)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n done\n\nlemma parserFS_inst_AX_unmarked_language_finite: \"\n (\\G. valid_parser G \\ parserFS.finite_unmarked_language G = parserFS.unmarked_language G)\"\n apply(clarsimp)\n apply(rename_tac G)(*strict*)\n apply(simp add: parserFS.finite_unmarked_language_def parserFS.unmarked_language_def)\n apply(rule order_antisym)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d n)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(simp add: parserFS.derivation_initial_def)\n apply(rename_tac G)(*strict*)\n apply(clarsimp)\n apply(rename_tac G x d)(*strict*)\n apply(simp add: parserFS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule_tac\n x=\"derivation_take d i\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule parserFS.derivation_take_preserves_derivation_initial)\n apply(force)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule conjI)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(simp add: derivation_take_def)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule_tac\n x=\"c'\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(simp add: derivation_take_def)\n apply(force)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule_tac\n x=\"v\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G d c c' i v e)(*strict*)\n apply(rule_tac\n x=\"i\"\n in exI)\n apply(rule maximum_of_domain_derivation_take)\n apply(force)\n done\n\nlemma parserFS_inst_ATS_Language_by_Finite_Derivations_axioms: \"\n ATS_Language_by_Finite_Derivations_axioms valid_parser\n parserFS_initial_configurations parserFS_step_relation\n parserFS_marking_condition parserFS_marked_effect\n parserFS_unmarked_effect \"\n apply(simp add: ATS_Language_by_Finite_Derivations_axioms_def)\n apply(simp add: parserFS_inst_lang_finite parserFS_inst_AX_unmarked_language_finite )\n done\n\nlemma parserFS_inst_ATS_String_State_Modification_axioms: \"\n ATS_String_State_Modification_axioms valid_parser parserFS_configurations\n parserFS_step_relation True parserFS_string_state\"\n apply(simp add: ATS_String_State_Modification_axioms_def)\n apply(simp add: parserFS_inst_AX_string_state_decreases )\n done\n\ninterpretation \"parserFS\" : loc_autFS_2\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n (* decreasing *)\n \"True\"\n (* string_state *)\n \"parserFS_string_state\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserFS_inst_ATS_axioms parserFS_inst_ATS_String_State_Modification_axioms parserFS_inst_ATS_Language_by_Finite_Derivations_axioms )\n done\n\ndefinition parserFS_get_scheduler :: \"\n ('stack, 'event) parserFS_conf\n \\ 'event list\"\n where\n \"parserFS_get_scheduler c \\\n parserFS_conf_fixed c @ parserFS_conf_scheduler c\"\n\ndefinition parserFS_set_unfixed_scheduler :: \"\n ('stack, 'event) parserFS_conf\n \\ 'event list\n \\ ('stack, 'event) parserFS_conf\"\n where\n \"parserFS_set_unfixed_scheduler c sUF \\\n c \\parserFS_conf_scheduler := sUF\\\"\n\ndefinition parserFS_get_unfixed_scheduler :: \"\n ('stack, 'event) parserFS_conf\n \\ 'event list\"\n where\n \"parserFS_get_unfixed_scheduler c \\\n parserFS_conf_scheduler c\"\n\nlemma parserFS_inst_AX_get_scheduler_closed: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ parserFS_get_scheduler c \\ parser_schedulers G))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parserFS_get_scheduler_def parserFS_configurations_def parser_schedulers_def prefix_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_schedUF_closed: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ parserFS_get_unfixed_scheduler c \\ parser_unfixed_schedulers G))\"\n apply(simp add: parserFS_get_unfixed_scheduler_def parser_unfixed_schedulers_def parserFS_configurations_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_set_unfixed_scheduler_set: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ (\\sUF1. sUF1 \\ parser_unfixed_schedulers G \\ (\\sUF2. sUF2 \\ parser_unfixed_schedulers G \\ parserFS_set_unfixed_scheduler (parserFS_set_unfixed_scheduler c sUF1) sUF2 = parserFS_set_unfixed_scheduler c sUF2))))\"\n apply(simp add: parserFS_set_unfixed_scheduler_def)\n done\n\nlemma parserFS_inst_AX_get_set_unfixed_scheduler: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ parserFS_get_unfixed_scheduler (parserFS_set_unfixed_scheduler c sUF) = sUF)))\"\n apply(simp add: parserFS_get_unfixed_scheduler_def parserFS_set_unfixed_scheduler_def)\n done\n\nlemma parserFS_inst_AX_set_unfixed_scheduler_get: \"\n (\\G. valid_parser G \\ (\\c1. c1 \\ parserFS_configurations G \\ (\\c2. c2 \\ parserFS_configurations G \\ (\\sUF\\ parser_unfixed_schedulers G. parserFS_set_unfixed_scheduler c1 sUF = parserFS_set_unfixed_scheduler c2 sUF) \\ parserFS_set_unfixed_scheduler c1 (parserFS_get_unfixed_scheduler c2) = c2)))\"\n apply(clarsimp)\n apply(rename_tac G c1 c2 sUF)(*strict*)\n apply(simp add: parserFS_set_unfixed_scheduler_def parserFS_get_unfixed_scheduler_def parserFS_configurations_def prefix_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_unfixed_scheduler_extendable_quasi_preserved_by_set_unfixed_scheduler : \"\n (\\G. valid_parser G \\ (\\c1. c1 \\ parserFS_configurations G \\ (\\c2. c2 \\ parserFS_configurations G \\ parserFS_get_unfixed_scheduler c1 \\ [parser_bottom G] \\ parserFS_set_unfixed_scheduler c1 (parserFS_get_unfixed_scheduler c2) = c2 \\ parserFS_get_unfixed_scheduler c2 \\ [parser_bottom G])))\"\n apply(clarsimp)\n apply(rename_tac G c1 c2)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_def parserFS_set_unfixed_scheduler_def parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G fa la r ra)(*strict*)\n apply(simp add: parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G fa la r ra v va)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G fa la ra va c)(*strict*)\n apply(case_tac ra)\n apply(rename_tac G fa la ra va c)(*strict*)\n apply(force)\n apply(rename_tac G fa la ra va c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. ra = w' @ [x']\")\n apply(rename_tac G fa la ra va c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G fa la ra va c a list)(*strict*)\n apply(thin_tac \"ra = a # list\")\n apply(force)\n done\n\nlemma parserFS_unfixed_is_reduced_by_single_step: \"\n valid_parser G\n \\ c1 \\ parserFS_configurations G\n \\ valid_parser_step_label G e\n \\ c2 \\ parserFS_configurations G\n \\ parserFS_step_relation G c1 e c2\n \\ parserFS_get_unfixed_scheduler c1 \\ parserFS_get_unfixed_scheduler c2\"\n apply(simp add: parserFS_step_relation_def)\n apply(simp add: parserFS_get_unfixed_scheduler_def parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac f fa r ra x v)(*strict*)\n apply(erule disjE)\n apply(rename_tac f fa r ra x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac f ra x v popnew)(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac f fa r ra x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac ra x v remainder)(*strict*)\n apply(simp add: suffix_def)\n done\n\nlemma parserFS_unfixed_is_reduced_by_steps: \"\n valid_parser G\n \\ parserFS.derivation G d\n \\ parserFS.belongs G d\n \\ d n = Some (pair e c)\n \\ d m = Some (pair e' c')\n \\ n\\m\n \\ suffix (parserFS_get_unfixed_scheduler c) (parserFS_get_unfixed_scheduler c')\"\n apply(induct \"m-n\" arbitrary: n m e c e' c')\n apply(rename_tac n m e c e' c')(*strict*)\n apply(clarsimp)\n apply(rename_tac n e' c')(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac x n m e c e' c')(*strict*)\n apply(erule_tac\n x=\"Suc n\"\n in meta_allE)\n apply(erule_tac\n x=\"m\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ parserFS_step_relation G c1 e2 c2\")\n apply(rename_tac x n m e c e' c')(*strict*)\n prefer 2\n apply(rule_tac\n m=\"m\"\n in parserFS.step_detail_before_some_position)\n apply(rename_tac x n m e c e' c')(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c')(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c')(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c')(*strict*)\n apply(clarsimp)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(erule_tac\n x=\"Some e2\"\n in meta_allE)\n apply(erule_tac\n x=\"c2\"\n in meta_allE)\n apply(erule_tac\n x=\"e'\"\n in meta_allE)\n apply(erule_tac\n x=\"c'\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac meta_impE)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(erule_tac meta_impE)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(subgoal_tac \"parserFS_get_unfixed_scheduler c \\ parserFS_get_unfixed_scheduler c2\")\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(simp add: suffix_def)\n apply(force)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(rule parserFS_unfixed_is_reduced_by_single_step)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply (metis parserFS.belongs_configurations)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n prefer 2\n apply (metis parserFS.belongs_configurations)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x n m e c e' c' e2 c2)(*strict*)\n apply(simp add: parserFS_step_relation_def valid_parser_def)\n done\n\nlemma parserFS_inst_AX_unfixed_scheduler_right_quotient_split: \"\n \\G. valid_parser G \\ (\\d. parserFS.derivation G d \\ parserFS.belongs G d \\ (\\n e1 c1. d n = Some (pair e1 c1) \\ (\\m e2 c2. d m = Some (pair e2 c2) \\ (\\k e3 c3. d k = Some (pair e3 c3) \\ n \\ m \\ m \\ k \\ the (right_quotient_word (parserFS_get_unfixed_scheduler c1) (parserFS_get_unfixed_scheduler c3)) = the (right_quotient_word (parserFS_get_unfixed_scheduler c1) (parserFS_get_unfixed_scheduler c2)) @ the (right_quotient_word (parserFS_get_unfixed_scheduler c2) (parserFS_get_unfixed_scheduler c3))))))\"\n apply(clarsimp)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(subgoal_tac \"suffix (parserFS_get_unfixed_scheduler c1) (parserFS_get_unfixed_scheduler c2)\")\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n prefer 2\n apply(rule parserFS_unfixed_is_reduced_by_steps)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(subgoal_tac \"suffix (parserFS_get_unfixed_scheduler c2) (parserFS_get_unfixed_scheduler c3)\")\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n prefer 2\n apply(rule parserFS_unfixed_is_reduced_by_steps)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule_tac\n t=\"right_quotient_word (c @ ca @ parserFS_get_unfixed_scheduler c3) (parserFS_get_unfixed_scheduler c3)\"\n and s=\"Some(c@ca)\"\n in ssubst)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule_tac\n t=\"right_quotient_word (c @ ca @ parserFS_get_unfixed_scheduler c3) (ca@parserFS_get_unfixed_scheduler c3)\"\n and s=\"Some c\"\n in ssubst)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule_tac\n t=\"right_quotient_word (ca @ parserFS_get_unfixed_scheduler c3) (parserFS_get_unfixed_scheduler c3)\"\n and s=\"Some ca\"\n in ssubst)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac G d n e1 c1 m e2 c2 k e3 c3 c ca)(*strict*)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_SchedUF_SB_axioms: \"\n ATS_SchedUF_SB_axioms valid_parser parserFS_configurations\n parser_step_labels parserFS_step_relation (@)\n parser_unfixed_schedulers right_quotient_word\n parser_unfixed_scheduler_extendable parserFS_set_unfixed_scheduler\n parserFS_get_unfixed_scheduler\"\n apply(simp add: ATS_SchedUF_SB_axioms_def)\n apply(simp add: parserFS_inst_schedUF_closed parserFS_inst_AX_set_unfixed_scheduler_set parserFS_inst_AX_get_set_unfixed_scheduler parserFS_inst_AX_set_unfixed_scheduler_get )\n apply(rule conjI, rule parserFS_inst_AX_unfixed_scheduler_extendable_quasi_preserved_by_set_unfixed_scheduler)\n apply(rule parserFS_inst_AX_unfixed_scheduler_right_quotient_split)\n done\n\nlemma parserFS_inst_AX_fixed_scheduler_extendable_translates_backwards: \"\n \\G. valid_parser G \\ (\\c1. c1 \\ parserFS_configurations G \\ (\\e c2. parserFS_step_relation G c1 e c2 \\ \\ parserFS_conf_fixed c2 \\ [parser_bottom G] \\ \\ parserFS_conf_fixed c1 \\ [parser_bottom G]))\"\n apply(clarsimp)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_string_state c1 = w @ parserFS_string_state c2\")\n apply(rename_tac G c1 e c2)(*strict*)\n prefer 2\n apply(rule parserFS.AX_string_state_decreases)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(simp add: parser_step_labels_def parserFS_step_relation_def)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(subgoal_tac \"valid_parser_step_label G e\")\n apply(rename_tac G c1 e c2 w)(*strict*)\n prefer 2\n apply(simp add: parserFS_step_relation_def valid_parser_def)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(subgoal_tac \"c2 \\ parserFS_configurations G\")\n apply(rename_tac G c1 e c2 w)(*strict*)\n prefer 2\n apply(rule parserFS.AX_step_relation_preserves_belongsC)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2 w)(*strict*)\n apply(simp add: parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v)(*strict*)\n apply(erule disjE)\n apply(rename_tac G c1 e c2 w x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v popnew)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v popnew c)(*strict*)\n apply(case_tac popnew)\n apply(rename_tac G c1 e c2 w x v popnew c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v c)(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G c1 e c2 w x v c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x c)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G c1 e c2 w x v c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G c1 e c2 w x v c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G c1 e c2 w x v c a list)(*strict*)\n apply(thin_tac \"rule_rpush e = a # list\")\n apply(force)\n apply(rename_tac G c1 e c2 w x v popnew c a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. popnew = w' @ [x']\")\n apply(rename_tac G c1 e c2 w x v popnew c a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G c1 e c2 w x v popnew c a list)(*strict*)\n apply(thin_tac \"popnew = a # list\")\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v c w' x')(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply(simp add: kPrefix_def)\n apply(subgoal_tac \"parser_bottom G \\ set wa\")\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply(subgoal_tac \"parser_bottom G \\ set wa\")\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply(force)\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply (metis not_in_diff)\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply(case_tac \"k-length wa\")\n apply(rename_tac G c1 e c2 w x v c w' x' k wa)(*strict*)\n apply(clarsimp)\n apply (metis take_reflects_mem)\n apply(rename_tac G c1 e c2 w x v c w' x' k wa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v remainder)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x v remainder c)(*strict*)\n apply(simp add: parserFS_string_state_def)\n apply(clarsimp)\n apply(rename_tac G c1 e c2 w x remainder c)(*strict*)\n apply(case_tac c1)\n apply(rename_tac G c1 e c2 w x remainder c parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera)(*strict*)\n apply(case_tac c2)\n apply(rename_tac G c1 e c2 w x remainder c parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera parserFS_conf_fixedaa parserFS_conf_stackaa parserFS_conf_scheduleraa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e w x remainder c parserFS_conf_schedulera)(*strict*)\n apply(rename_tac r)\n apply(rename_tac G e w x remainder c r)(*strict*)\n apply(case_tac remainder)\n apply(rename_tac G e w x remainder c r)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e w x c r)(*strict*)\n apply(case_tac \"rule_rpush e\")\n apply(rename_tac G e w x c r)(*strict*)\n apply(clarsimp)\n apply(rename_tac G e x c r)(*strict*)\n apply(simp add: valid_parser_step_label_def)\n apply(rename_tac G e w x c r a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. rule_rpush e = w' @ [x']\")\n apply(rename_tac G e w x c r a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e w x c r a list)(*strict*)\n apply(thin_tac \"rule_rpush e = a # list\")\n apply(force)\n apply(rename_tac G e w x remainder c r a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. remainder = w' @ [x']\")\n apply(rename_tac G e w x remainder c r a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G e w x remainder c r a list)(*strict*)\n apply(thin_tac \"remainder = a # list\")\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_SchedF_SB_axioms: \"\n ATS_SchedF_SB_axioms valid_parser parserFS_configurations\n parserFS_step_relation parser_fixed_scheduler_extendable\n parserFS_conf_fixed\"\n apply(simp add: ATS_SchedF_SB_axioms_def)\n apply(simp add: parserFS_inst_AX_fixed_scheduler_extendable_translates_backwards )\n done\n\nlemma parserFS_inst_AX_not_extendable_fixed_scheduler_implies_empty_unfixed_scheduler: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ parserFS_conf_fixed c \\ [parser_bottom G] \\ parserFS_get_unfixed_scheduler c = []))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G f l r)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_def)\n apply(simp add: prefix_def suffix_def)\n apply(clarsimp)\n apply(rename_tac G l r c)(*strict*)\n apply(simp add: parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G l r c v)(*strict*)\n apply(case_tac r)\n apply(rename_tac G l r c v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G l r c v a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. r = w' @ [x']\")\n apply(rename_tac G l r c v a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G l r c v a list)(*strict*)\n apply(thin_tac \"r = a # list\")\n apply(clarsimp)\n done\n\nlemma parserFS_inst_extendable_implies_notempty_unfixed: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ \\ parserFS_conf_fixed c \\ [parser_bottom G] \\ parserFS_get_unfixed_scheduler c \\ []))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G f l r)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_def)\n apply(simp add: suffix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G f l)(*strict*)\n apply(simp add: parser_schedulers_def)\n done\n\nlemma parserFS_inst_AX_get_scheduler_vs_get_fixed_scheduler_and_get_unfixed_scheduler: \"\n (\\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ parserFS_get_scheduler c = parserFS_conf_fixed c @ parserFS_get_unfixed_scheduler c))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: parserFS_configurations_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G f l r)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_def)\n apply(simp add: parserFS_get_scheduler_def)\n done\n\nlemma parserFS_inst_AX_unfixed_scheduler_extendable_vs_fixed_scheduler_extendable: \"\n \\G. valid_parser G \\ (\\c. c \\ parserFS_configurations G \\ parserFS_get_unfixed_scheduler c \\ [parser_bottom G] = (\\ parserFS_conf_fixed c \\ [parser_bottom G]))\"\n apply(clarsimp)\n apply(rename_tac G c)(*strict*)\n apply(simp add: prefix_def suffix_def parserFS_configurations_def parserFS_get_unfixed_scheduler_def)\n apply(clarsimp)\n apply(rename_tac G f l r)(*strict*)\n apply(simp add: parser_schedulers_def parser_unfixed_schedulers_def parser_fixed_schedulers_def prefix_closure_def suffix_closure_def prefix_def suffix_def)\n apply(clarsimp)\n apply(rename_tac G f l r vb vc c vd ca)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac G f l r vb vc c vd ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G f l r vb vc c vd ca)(*strict*)\n apply(clarsimp)\n apply(case_tac r)\n apply(rename_tac G f l r vb vc c vd ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G f l r vb vc c vd ca a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. r = w' @ [x']\")\n apply(rename_tac G f l r vb vc c vd ca a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G f l r vb vc c vd ca a list)(*strict*)\n apply(thin_tac \"r = a # list\")\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_equal_up_to_unfixed_scheduler_implies_equal_fixed_scheduler: \"\n (\\G. valid_parser G \\ (\\c1. c1 \\ parserFS_configurations G \\ (\\c2. c2 \\ parserFS_configurations G \\ parserFS_set_unfixed_scheduler c1 (parserFS_get_unfixed_scheduler c2) = c2 \\ parserFS_conf_fixed c1 = parserFS_conf_fixed c2)))\"\n apply(simp add: parserFS_set_unfixed_scheduler_def parserFS_get_unfixed_scheduler_def)\n apply(clarsimp)\n apply(rename_tac G c1 c2)(*strict*)\n apply(case_tac c1)\n apply(rename_tac G c1 c2 parserFS_conf_fixeda parserFS_conf_stack parserFS_conf_schedulera)(*strict*)\n apply(case_tac c2)\n apply(rename_tac G c1 c2 parserFS_conf_fixeda parserFS_conf_stack parserFS_conf_schedulera parserFS_conf_fixedaa parserFS_conf_stacka parserFS_conf_scheduleraa)(*strict*)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_Sched_axioms: \"\n ATS_Sched_axioms valid_parser parserFS_configurations\n parser_scheduler_fragments parser_empty_scheduler_fragment (@)\n parser_schedulers parser_schedulers parser_empty_scheduler\n parserFS_get_scheduler (@)\"\n apply(simp add: ATS_Sched_axioms_def)\n apply(simp add: parser_inst_AX_join_fixed_scheduler_unfixed_scheduler_closed parser_inst_AX_extend_scheduler_closed parser_inst_AX_empty_scheduler_in_schedulers parserFS_inst_AX_get_scheduler_closed )\n done\n\nlemma parserFS_inst_ATS_Sched_SB_axioms: \"\n ATS_Sched_SB_axioms valid_parser parserFS_configurations\n parser_fixed_scheduler_extendable parser_empty_unfixed_scheduler\n parser_unfixed_scheduler_extendable parserFS_get_scheduler (@)\n parserFS_set_unfixed_scheduler parserFS_get_unfixed_scheduler\n parserFS_conf_fixed\"\n apply(simp add: ATS_Sched_SB_axioms_def)\n apply(simp add: parserFS_inst_AX_not_extendable_fixed_scheduler_implies_empty_unfixed_scheduler parserFS_inst_extendable_implies_notempty_unfixed parserFS_inst_AX_get_scheduler_vs_get_fixed_scheduler_and_get_unfixed_scheduler parserFS_inst_AX_unfixed_scheduler_extendable_vs_fixed_scheduler_extendable )\n apply(rule parserFS_inst_AX_equal_up_to_unfixed_scheduler_implies_equal_fixed_scheduler)\n done\n\nprint_locale loc_autFS_3\ninterpretation \"parserFS\" : loc_autFS_3\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n (* decreasing *)\n \"True\"\n (* string_state *)\n \"parserFS_string_state\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* scheduler_fragments *)\n \"parser_scheduler_fragments\"\n (* empty_scheduler_fragment *)\n \"parser_empty_scheduler_fragment\"\n (* join_scheduler_fragments *)\n \"append\"\n (* unfixed_schedulers *)\n \"parser_unfixed_schedulers\"\n (* empty_unfixed_scheduler *)\n \"parser_empty_unfixed_scheduler\"\n (* unfixed_scheduler_right_quotient_word *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler *)\n \"append\"\n (* unfixed_scheduler_extendable *)\n \"parser_unfixed_scheduler_extendable\"\n (* schedulers *)\n \"parser_schedulers\"\n (* initial_schedulers *)\n \"parser_schedulers\"\n (* empty_scheduler *)\n \"parser_empty_scheduler\"\n (* get_scheduler *)\n \"parserFS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler *)\n \"append\"\n (* extend_scheduler *)\n \"append\"\n (* set_unfixed_scheduler *)\n \"parserFS_set_unfixed_scheduler\"\n (* get_unfixed_scheduler *)\n \"parserFS_get_unfixed_scheduler\"\n (* get_fixed_scheduler *)\n \"parserFS_conf_fixed\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserFS_inst_ATS_axioms parserFS_inst_ATS_String_State_Modification_axioms parserFS_inst_ATS_Language_by_Finite_Derivations_axioms parserFS_inst_ATS_SchedUF_SB_axioms parserFS_inst_ATS_SchedF_SB_axioms parserFS_inst_ATS_Sched_axioms parserFS_inst_ATS_Sched_SB_axioms )\n done\n\ndefinition parserFS_get_fixed_scheduler_DB :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf) derivation\n \\ nat\n \\ 'event list\"\n where\n \"parserFS_get_fixed_scheduler_DB G d n \\\n parserFS_conf_fixed (the (get_configuration (d n)))\"\n\ndefinition parserFS_set_unfixed_scheduler_DB :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf) derivation\n \\ nat\n \\ 'event list\n \\ ('stack, 'event) parserFS_conf\"\n where\n \"parserFS_set_unfixed_scheduler_DB G d n sUF \\\n parserFS_set_unfixed_scheduler\n (the (get_configuration (d n))) sUF\"\n\ndefinition parserFS_get_unfixed_scheduler_DB :: \"\n ('stack, 'event, 'marker) parser\n \\ (('stack, 'event) parser_step_label, ('stack, 'event) parserFS_conf) derivation\n \\ nat\n \\ 'event list\"\n where\n \"parserFS_get_unfixed_scheduler_DB G d n \\\n parserFS_conf_scheduler (the (get_configuration (d n)))\"\n\nlemma parserFS_inst_AX_set_unfixed_scheduler_DB_preserves_initial_configurations: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation G d \\ (\\c. d 0 = Some (pair None c) \\ c \\ parserFS_initial_configurations G \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ parserFS_get_unfixed_scheduler_DB G d 0 \\ [parser_bottom G] \\ sUF \\ [parser_bottom G] \\ parserFS_set_unfixed_scheduler_DB G d 0 sUF \\ parserFS_initial_configurations G))))\"\n apply(clarsimp)\n apply(rename_tac G d c sUF)(*strict*)\n apply(simp add: get_configuration_def parserFS_set_unfixed_scheduler_DB_def parserFS_initial_configurations_def parserFS_configurations_def parserFS_get_fixed_scheduler_DB_def parser_unfixed_schedulers_def parser_schedulers_def suffix_closure_def suffix_def prefix_def)\n apply(clarsimp)\n apply(rename_tac G d ca cb cc vc \"cd\")(*strict*)\n apply(simp add: parserFS_set_unfixed_scheduler_def)\n apply(rule_tac\n x=\"cb @ [parser_bottom G]\"\n in exI)\n apply(force)\n done\n\nlemma parserFS_inst_AX_get_unfixed_scheduler_DB_extendable_on_initial_configuration: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ parserFS_get_unfixed_scheduler_DB G d 0 \\ [parser_bottom G]))\"\n apply(clarsimp)\n apply(rename_tac G d)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac G d)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d c)(*strict*)\n apply(simp add: parserFS_configurations_def parserFS_get_scheduler_def)\n apply(clarsimp)\n apply(rename_tac G d f l r)(*strict*)\n apply(simp add: suffix_def)\n apply(simp add: parser_unfixed_schedulers_def parser_fixed_schedulers_def parser_schedulers_def prefix_def suffix_def prefix_closure_def suffix_closure_def)\n apply(clarsimp)\n apply(rename_tac G d f l r vb vc c vd ca)(*strict*)\n apply(simp add: parserFS.derivation_initial_def)\n apply(simp add: parserFS_initial_configurations_def)\n apply(rename_tac G d c)(*strict*)\n apply (metis parserFS.belongs_configurations parserFS.derivation_initial_belongs)\n apply(rename_tac G d)(*strict*)\n apply (metis parserFS.derivation_initial_is_derivation parserFS.some_position_has_details_at_0)\n done\n\nlemma parserFS_inst_AX_get_unfixed_scheduler_DB_closed: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation G d \\ parserFS.belongs G d \\ (\\n. (\\e c. d n = Some (pair e c)) \\ parserFS_get_unfixed_scheduler_DB G d n \\ parser_unfixed_schedulers G)))\"\n apply(clarsimp)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parser_unfixed_schedulers_def parserFS_get_unfixed_scheduler_DB_def)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d n e c)(*strict*)\n prefer 2\n apply(rule parserFS.belongs_configurations)\n apply(rename_tac G d n e c)(*strict*)\n apply(force)\n apply(rename_tac G d n e c)(*strict*)\n apply(force)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: prefix_closure_def prefix_def parser_fixed_schedulers_def parser_unfixed_schedulers_def suffix_closure_def suffix_def parserFS_configurations_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G d n e f l r vb vc ca vd cb)(*strict*)\n apply(force)\n done\n\nlemma parserFS_inst_get_unfixed_scheduler_DB_constructs_right_quotient: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n. (\\y. d n = Some y) \\ (\\j. parserFS_get_unfixed_scheduler_DB G d j \\ [parser_bottom G] \\ (\\i\\j. j \\ n \\ the (right_quotient_word (parserFS_get_unfixed_scheduler_DB G d i) (parserFS_get_unfixed_scheduler_DB G d j)) \\ parser_scheduler_fragments G)))))\"\n apply(clarsimp)\n apply(rename_tac G d n y j i)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(subgoal_tac \"\\e c. d i = Some (pair e c)\")\n apply(rename_tac G d n y j i)(*strict*)\n apply(subgoal_tac \"\\e c. d j = Some (pair e c)\")\n apply(rename_tac G d n y j i)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\w. parserFS_conf_scheduler c = w @ parserFS_conf_scheduler ca\")\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"j\"\n in parserFS_input_decreases)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(rule parserFS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(rule parserFS.derivation_initial_belongs)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i e ea c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply(subgoal_tac \"the (right_quotient_word (w @ parserFS_conf_scheduler ca) (parserFS_conf_scheduler ca))=w\")\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply(clarsimp)\n apply(simp add: parser_scheduler_fragments_def)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply(subgoal_tac \"ca \\ parserFS_configurations G\")\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G d n y j i e ea w f fa l la ra)(*strict*)\n apply(simp add: prefix_closure_def prefix_def parser_schedulers_def parser_unfixed_schedulers_def parser_fixed_schedulers_def suffix_closure_def suffix_def)\n apply(clarsimp)\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply (metis parserFS.belongs_configurations parserFS.derivation_initial_belongs)\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply (metis parserFS.belongs_configurations parserFS.derivation_initial_belongs)\n apply(rename_tac G d n y j i e ea c ca w)(*strict*)\n apply (metis right_quotient_word_removes_right_addition option.sel)\n apply(rename_tac G d n y j i)(*strict*)\n apply(rule parserFS.pre_some_position_is_some_position)\n apply(rename_tac G d n y j i)(*strict*)\n apply(simp add: parserFS.derivation_initial_def)\n apply(force)\n apply(rename_tac G d n y j i)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i)(*strict*)\n apply(rule parserFS.pre_some_position_is_some_position)\n apply(rename_tac G d n y j i)(*strict*)\n apply(simp add: parserFS.derivation_initial_def)\n apply(force)\n apply(rename_tac G d n y j i)(*strict*)\n apply(force)\n apply(rename_tac G d n y j i)(*strict*)\n apply(force)\n done\n\nlemma parserFS_parser_fixed_input_length_recN_with_derivation_take: \"\n i\\n\n \\ parserFS.derivation M d\n \\ parser_fixed_input_length_recN (derivation_take d n) i = parser_fixed_input_length_recN d i\"\n apply(induct i)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d (Suc i)\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_take_def)\n apply(rename_tac i a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ parserFS_step_relation M c1 e2 c2\")\n apply(rename_tac i a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc i\"\n in parserFS.step_detail_before_some_position)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e1 e2 c1 c2)(*strict*)\n apply(simp add: derivation_take_def)\n done\n\nlemma parserFS_inst_AX_get_unfixed_scheduler_DB_invariant_under_derivation_take: \"\n \\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n m. n \\ m \\ parserFS_get_unfixed_scheduler_DB G d n = parserFS_get_unfixed_scheduler_DB G (derivation_take d m) n))\"\n apply(clarsimp)\n apply(rename_tac G d n m)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(rule_tac\n t=\"parser_fixed_input_length_recN (derivation_take d m) n\"\n and s=\"parser_fixed_input_length_recN d n\"\n in ssubst)\n apply(rename_tac G d n m)(*strict*)\n defer\n apply(simp add: derivation_take_def)\n apply(rename_tac G d n m)(*strict*)\n apply (metis parserFS.derivation_initial_is_derivation parserFS_parser_fixed_input_length_recN_with_derivation_take)\n done\n\nlemma parserFS_inst_ATS_SchedUF_DB_axioms: \"\n ATS_SchedUF_DB_axioms valid_parser parserFS_configurations\n parserFS_initial_configurations parser_step_labels\n parserFS_step_relation parser_scheduler_fragments\n parser_unfixed_schedulers right_quotient_word\n parser_unfixed_scheduler_extendable parserFS_set_unfixed_scheduler_DB\n parserFS_get_unfixed_scheduler_DB\"\n apply(simp add: ATS_SchedUF_DB_axioms_def)\n apply(simp add: parserFS_inst_AX_set_unfixed_scheduler_DB_preserves_initial_configurations parserFS_inst_AX_get_unfixed_scheduler_DB_extendable_on_initial_configuration parserFS_inst_AX_get_unfixed_scheduler_DB_closed parserFS_inst_get_unfixed_scheduler_DB_constructs_right_quotient )\n apply(rule parserFS_inst_AX_get_unfixed_scheduler_DB_invariant_under_derivation_take)\n done\n\nlemma parserFS_parser_fixed_input_length_recN_with_derivation_append: \"\n i\\n\n \\ parserFS.derivation M d1\n \\ parser_fixed_input_length_recN (derivation_append d1 d2 n) i = parser_fixed_input_length_recN d1 i\"\n apply(induct i)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def)\n apply(case_tac \"d1 (Suc i)\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def)\n apply(rename_tac i a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\ d1 (Suc i) = Some (pair (Some e2) c2) \\ parserFS_step_relation M c1 e2 c2\")\n apply(rename_tac i a)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc i\"\n in parserFS.step_detail_before_some_position)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(force)\n apply(rename_tac i a)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e1 e2 c1 c2)(*strict*)\n apply(simp add: derivation_append_def)\n done\n\nlemma parserFS_inst_AX_get_fixed_scheduler_DB_restrict: \"\n (\\G. valid_parser G \\ (\\x n. x \\ n \\ (\\d1. parserFS.derivation G d1 \\ (\\d2. parserFS_get_fixed_scheduler_DB G (derivation_append d1 d2 n) x = parserFS_get_fixed_scheduler_DB G d1 x))))\"\n apply(clarsimp)\n apply(rename_tac G x n d1 d2)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def parserFS_get_scheduler_def)\n apply(rule_tac\n t=\"derivation_append d1 d2 n x\"\n and s=\"d1 x\"\n in ssubst)\n apply(rename_tac G x n d1 d2)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G x n d1 d2)(*strict*)\n apply(rule_tac\n t=\"parser_fixed_input_length_recN (derivation_append d1 d2 n) x\"\n and s=\"parser_fixed_input_length_recN d1 x\"\n in ssubst)\n apply(rename_tac G x n d1 d2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G x n d1 d2)(*strict*)\n apply (metis parserFS_parser_fixed_input_length_recN_with_derivation_append)\n done\n\nlemmas dom_abbreviation =\n parser_fixed_schedulers_def\n parser_unfixed_schedulers_def\n parser_schedulers_def\n prefix_def\n prefix_closure_def\n suffix_closure_def\n suffix_def\n\nlemma parserFS_inst_AX_schedF_db_extendable_translates_backwards: \"\n \\G. valid_parser G \\ (\\d1. parserFS.derivation G d1 \\ parserFS.belongs G d1 \\ (\\n x. (\\y. d1 (n + x) = Some y) \\ \\ parserFS_get_fixed_scheduler_DB G d1 (n + x) \\ [parser_bottom G] \\ \\ parserFS_get_fixed_scheduler_DB G d1 n \\ [parser_bottom G]))\"\n apply(clarsimp)\n apply(rename_tac G d1 n x y)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def)\n apply(case_tac y)\n apply(rename_tac G d1 n x y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(subgoal_tac \"\\e c. d1 n = Some (pair e c)\")\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(subgoal_tac \"b \\ parserFS_configurations G\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(subgoal_tac \"parserFS_conf_scheduler c = []\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(subgoal_tac \"parserFS_conf_scheduler b = []\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(subgoal_tac \"parserFS_conf_fixed b \\ [parser_bottom G]\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G d1 n x option e f fa l la)(*strict*)\n apply(simp add: dom_abbreviation)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_conf_scheduler c = w @ parserFS_conf_scheduler b\")\n apply(rename_tac G d1 n x option b e c)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"n+x\"\n in parserFS_input_decreases)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G d1 n x option e f fa l la r ra)(*strict*)\n apply(simp add: dom_abbreviation)\n apply(clarsimp)\n apply(rename_tac G d1 n x option e fa l la r ra c vc ve vf ca vg cb vh cc vi \"cd\")(*strict*)\n apply(case_tac r)\n apply(rename_tac G d1 n x option e fa l la r ra c vc ve vf ca vg cb vh cc vi \"cd\")(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option e fa l la r ra c vc ve vf ca vg cb vh cc vi \"cd\" a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. r = w' @ [x']\")\n apply(rename_tac G d1 n x option e fa l la r ra c vc ve vf ca vg cb vh cc vi \"cd\" a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac G d1 n x option e fa l la r ra c vc ve vf ca vg cb vh cc vi \"cd\" a list)(*strict*)\n apply(thin_tac \"r = a # list\")\n apply(clarsimp)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply (metis parserFS.belongs_configurations)\n apply(rename_tac G d1 n x option b e c)(*strict*)\n apply (metis parserFS.belongs_configurations)\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(rule parserFS.pre_some_position_is_some_position)\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(simp add: parserFS.derivation_initial_def)\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(force)\n apply(rename_tac G d1 n x option b)(*strict*)\n apply(force)\n done\n\nlemma parserFS_inst_AX_get_fixed_scheduler_DB_in_fixed_schedulers: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation G d \\ parserFS.belongs G d \\ (\\n. (\\y. d n = Some y) \\ parserFS_get_fixed_scheduler_DB G d n \\ parser_fixed_schedulers G)))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def get_configuration_def)\n apply(case_tac y)\n apply(rename_tac G d n y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n option b)(*strict*)\n apply(subgoal_tac \"b \\ parserFS_configurations G\")\n apply(rename_tac G d n option b)(*strict*)\n prefer 2\n apply (metis parserFS.belongs_configurations)\n apply(rename_tac G d n option b)(*strict*)\n apply(simp add: parserFS_get_scheduler_def parserFS_configurations_def parser_fixed_schedulers_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_SchedF_DB_axioms: \"\n ATS_SchedF_DB_axioms valid_parser parserFS_configurations\n parser_step_labels parserFS_step_relation parser_fixed_schedulers\n parser_fixed_scheduler_extendable parserFS_get_fixed_scheduler_DB\"\n apply(simp add: ATS_SchedF_DB_axioms_def)\n apply(simp add: parserFS_inst_AX_get_fixed_scheduler_DB_in_fixed_schedulers parserFS_inst_AX_get_fixed_scheduler_DB_restrict parserFS_inst_AX_schedF_db_extendable_translates_backwards )\n done\n\nlemma parserFS_inst_AX_join_fixed_scheduler_unfixed_scheduler_closed_prime: \"\n \\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n. (\\y. d n = Some y) \\ parserFS_get_fixed_scheduler_DB G d n @ parserFS_get_unfixed_scheduler_DB G d n \\ parser_schedulers G))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def parserFS_get_scheduler_def)\n apply(case_tac y)\n apply(rename_tac G d n y option b)(*strict*)\n apply(simp add: get_configuration_def parserFS_get_unfixed_scheduler_DB_def parserFS_get_scheduler_def)\n apply(subgoal_tac \"b \\ parserFS_configurations G\")\n apply(rename_tac G d n y option b)(*strict*)\n prefer 2\n apply (metis parserFS.belongs_configurations parserFS.derivation_initial_belongs)\n apply(rename_tac G d n y option b)(*strict*)\n apply(simp add: parserFS_configurations_def)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_AX_get_fixed_scheduler_DB_and_get_unfixed_scheduler_DB_vs_get_scheduler_nth: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation G d \\ (\\n. (\\y. d n = Some y) \\ parserFS_get_fixed_scheduler_DB G d n @ parserFS_get_unfixed_scheduler_DB G d n = ATS_Sched.get_scheduler_nth parserFS_get_scheduler d n)))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: parserFS.get_scheduler_nth_def)\n apply(case_tac y)\n apply(rename_tac G d n y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n option b)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(simp add: get_configuration_def)\n apply(simp add: parserFS_get_scheduler_def)\n done\n\nlemma parserFS_inst_AX_sched_modification_preserves_steps: \"\n \\G. valid_parser G \\ (\\dh n. maximum_of_domain dh n \\ parserFS.derivation G dh \\ parserFS.belongs G dh \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ (\\sF. \\ sF \\ [parser_bottom G]) \\ sUF \\ [parser_bottom G] \\ (\\m e2 c2. dh (Suc m) = Some (pair (Some e2) c2) \\ (\\e1 c1. dh m = Some (pair e1 c1) \\ parserFS_step_relation G c1 e2 c2 \\ parserFS_step_relation G (parserFS_set_unfixed_scheduler_DB G dh m (the (right_quotient_word (parserFS_get_unfixed_scheduler_DB G dh m) (parserFS_get_unfixed_scheduler_DB G dh n)) @ sUF)) e2 (parserFS_set_unfixed_scheduler_DB G dh (Suc m) (the (right_quotient_word (parserFS_get_unfixed_scheduler_DB G dh (Suc m)) (parserFS_get_unfixed_scheduler_DB G dh n)) @ sUF))))))\"\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1)(*strict*)\n apply(simp add: get_configuration_def parserFS_set_unfixed_scheduler_DB_def parserFS_get_fixed_scheduler_DB_def parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n apply(simp add: parserFS_set_unfixed_scheduler_def)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\e c. dh n= Some (pair e c)\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n prefer 2\n apply(rule parserFS.some_position_has_details_before_max_dom)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v)(*strict*)\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_conf_scheduler c1 = w @ parserFS_conf_scheduler c2\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"Suc m\"\n in parserFS_input_decreases)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(subgoal_tac \"Suc m\\n\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(subgoal_tac \"\\w. parserFS_conf_scheduler c2 = w @ parserFS_conf_scheduler c\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n prefer 2\n apply(rule_tac\n j=\"n\"\n in parserFS_input_decreases)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply(subgoal_tac \"the (right_quotient_word (w @ wa @ parserFS_conf_scheduler c) (parserFS_conf_scheduler c))=w@wa\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"the (right_quotient_word (wa @ parserFS_conf_scheduler c) (parserFS_conf_scheduler c))=wa\")\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c wa remainder)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply (metis right_quotient_word_removes_right_addition option.sel)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply(rule_tac\n t=\"w @ wa @ parserFS_conf_scheduler c\"\n and s=\"(w @ wa) @ parserFS_conf_scheduler c\"\n in ssubst)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w wa)(*strict*)\n apply (metis right_quotient_word_removes_right_addition option.sel)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(rule parserFS.allPreMaxDomSome_prime)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n apply(rename_tac G dh n sUF sF m e2 c2 e1 c1 x v e c w)(*strict*)\n apply(force)\n done\n\nlemma parserFS_inst_AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB: \"\n \\G::('stack, 'event, 'marker) parser.\n valid_parser G \\\n (\\d::(('stack, 'event) parser_step_label,\n ('stack, 'event) parserFS_conf) derivation.\n ATS.derivation_initial parserFS_initial_configurations\n parserFS_step_relation G d \\\n (\\n::nat.\n (\\y::(('stack, 'event) parser_step_label,\n ('stack, 'event) parserFS_conf) derivation_configuration.\n d n = Some y) \\\n (\\ parserFS_get_fixed_scheduler_DB G d n \\ [parser_bottom G]) =\n parserFS_get_unfixed_scheduler_DB G d n \\ [parser_bottom G]))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def parserFS_get_unfixed_scheduler_DB_def get_configuration_def)\n apply(case_tac y)\n apply(rename_tac G d n y option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n option conf)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: suffix_def)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d n e c)(*strict*)\n prefer 2\n apply (metis parserFS.derivation_initial_configurations)\n apply(rename_tac G d n e c)(*strict*)\n apply(rule antisym)\n apply(rename_tac G d n e c)(*strict*)\n apply(clarsimp)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G d n e c ca cb)(*strict*)\n apply(subgoal_tac \"c \\ parserFS_configurations G\")\n apply(rename_tac G d n e c ca cb)(*strict*)\n prefer 2\n apply(simp add: parserFS_configurations_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G d n e c ca cb)(*strict*)\n apply(force)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parserFS_configurations_def parser_schedulers_def)\n apply(clarsimp)\n apply(rename_tac G d n e f l r v)(*strict*)\n apply(rule_tac\n xs=\"r\"\n in rev_cases)\n apply(rename_tac G d n e f l r v)(*strict*)\n prefer 2\n apply(rename_tac G d n e f l r v ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n e f l r v)(*strict*)\n apply(clarsimp)\n done\n\nlemma parserFS_inst_ATS_Sched_DB0_axioms: \"\n ATS_Sched_DB0_axioms valid_parser parserFS_configurations\n parserFS_initial_configurations parser_step_labels\n parserFS_step_relation parser_fixed_scheduler_extendable\n parser_unfixed_schedulers right_quotient_word (@)\n parser_unfixed_scheduler_extendable parser_schedulers\n parserFS_get_scheduler (@) parserFS_set_unfixed_scheduler_DB\n parserFS_get_unfixed_scheduler_DB parserFS_get_fixed_scheduler_DB\"\n apply(simp add: ATS_Sched_DB0_axioms_def)\n apply(simp add: parserFS_inst_AX_join_fixed_scheduler_unfixed_scheduler_closed_prime parserFS_inst_AX_get_fixed_scheduler_DB_and_get_unfixed_scheduler_DB_vs_get_scheduler_nth parserFS_inst_AX_sched_modification_preserves_steps parserFS_inst_AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB )\n done\n\nprint_locale loc_autFS_4\ninterpretation \"parserFS\" : loc_autFS_4\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n (* decreasing *)\n \"True\"\n (* string_state *)\n \"parserFS_string_state\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* scheduler_fragments *)\n \"parser_scheduler_fragments\"\n (* empty_scheduler_fragment *)\n \"parser_empty_scheduler_fragment\"\n (* join_scheduler_fragments *)\n \"append\"\n (* unfixed_schedulers *)\n \"parser_unfixed_schedulers\"\n (* empty_unfixed_scheduler *)\n \"parser_empty_unfixed_scheduler\"\n (* unfixed_scheduler_right_quotient_word *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler *)\n \"append\"\n (* unfixed_scheduler_extendable *)\n \"parser_unfixed_scheduler_extendable\"\n (* schedulers *)\n \"parser_schedulers\"\n (* initial_schedulers *)\n \"parser_schedulers\"\n (* empty_scheduler *)\n \"parser_empty_scheduler\"\n (* get_scheduler *)\n \"parserFS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler *)\n \"append\"\n (* extend_scheduler *)\n \"append\"\n (* set_unfixed_scheduler *)\n \"parserFS_set_unfixed_scheduler\"\n (* get_unfixed_scheduler *)\n \"parserFS_get_unfixed_scheduler\"\n (* get_fixed_scheduler *)\n \"parserFS_conf_fixed\"\n (* set_unfixed_scheduler_DB *)\n \"parserFS_set_unfixed_scheduler_DB\"\n (* get_unfixed_scheduler_DB *)\n \"parserFS_get_unfixed_scheduler_DB\"\n (* get_fixed_scheduler_DB *)\n \"parserFS_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserFS_inst_ATS_axioms parserFS_inst_ATS_String_State_Modification_axioms parserFS_inst_ATS_Language_by_Finite_Derivations_axioms parserFS_inst_ATS_SchedUF_SB_axioms parserFS_inst_ATS_SchedF_SB_axioms parserFS_inst_ATS_Sched_SB_axioms parserFS_inst_ATS_SchedUF_DB_axioms parserFS_inst_ATS_SchedF_DB_axioms parserFS_inst_ATS_Sched_DB0_axioms parserFS_inst_ATS_Sched_axioms )\n done\n\nlemma parserFS_inst_AX_replace_unfixed_scheduler_DB_sound: \"\n \\G. valid_parser G \\ (\\d n. maximum_of_domain d n \\ parserFS.derivation_initial G d \\ parserFS_get_unfixed_scheduler_DB G d n \\ [parser_bottom G] \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ sUF \\ [parser_bottom G] \\ parserFS_get_unfixed_scheduler_DB G (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) parserFS_set_unfixed_scheduler_DB parserFS_get_unfixed_scheduler_DB G d sUF n) n = sUF))\"\n apply(clarsimp)\n apply(rename_tac G d n sUF)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def)\n apply(simp add: parserFS.replace_unfixed_scheduler_DB_def)\n apply(simp add: parserFS.map_unfixed_scheduler_DB_def)\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac G d n sUF)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n sUF e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n t=\"right_quotient_word (parserFS_get_unfixed_scheduler_DB G d n) (parserFS_get_unfixed_scheduler_DB G d n)\"\n and s=\"Some []\"\n in ssubst)\n apply(rename_tac G d n sUF e c)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac G d n sUF e c)(*strict*)\n apply(clarsimp)\n apply(simp add: parserFS_set_unfixed_scheduler_DB_def parserFS_set_unfixed_scheduler_def)\n apply(rename_tac G d n sUF)(*strict*)\n apply(rule parserFS.some_position_has_details_before_max_dom)\n apply(rename_tac G d n sUF)(*strict*)\n apply(rule parserFS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G d n sUF)(*strict*)\n apply(force)\n apply(rename_tac G d n sUF)(*strict*)\n apply(force)\n done\n\nlemma parserFS_inst_ATS_Sched_DB_axioms: \"\n ATS_Sched_DB_axioms valid_parser parserFS_initial_configurations\n parserFS_step_relation parser_unfixed_schedulers right_quotient_word (@)\n parser_unfixed_scheduler_extendable parserFS_set_unfixed_scheduler_DB\n parserFS_get_unfixed_scheduler_DB \"\n apply(simp add: ATS_Sched_DB_axioms_def)\n apply(rule parserFS_inst_AX_replace_unfixed_scheduler_DB_sound)\n done\n\nprint_locale loc_autFS_5\ninterpretation \"parserFS\" : loc_autFS_5\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n (* decreasing *)\n \"True\"\n (* string_state *)\n \"parserFS_string_state\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* scheduler_fragments *)\n \"parser_scheduler_fragments\"\n (* empty_scheduler_fragment *)\n \"parser_empty_scheduler_fragment\"\n (* join_scheduler_fragments *)\n \"append\"\n (* unfixed_schedulers *)\n \"parser_unfixed_schedulers\"\n (* empty_unfixed_scheduler *)\n \"parser_empty_unfixed_scheduler\"\n (* unfixed_scheduler_right_quotient_word *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler *)\n \"append\"\n (* unfixed_scheduler_extendable *)\n \"parser_unfixed_scheduler_extendable\"\n (* schedulers *)\n \"parser_schedulers\"\n (* initial_schedulers *)\n \"parser_schedulers\"\n (* empty_scheduler *)\n \"parser_empty_scheduler\"\n (* get_scheduler *)\n \"parserFS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler *)\n \"append\"\n (* extend_scheduler *)\n \"append\"\n (* set_unfixed_scheduler *)\n \"parserFS_set_unfixed_scheduler\"\n (* get_unfixed_scheduler *)\n \"parserFS_get_unfixed_scheduler\"\n (* get_fixed_scheduler *)\n \"parserFS_conf_fixed\"\n (* set_unfixed_scheduler_DB *)\n \"parserFS_set_unfixed_scheduler_DB\"\n (* get_unfixed_scheduler_DB *)\n \"parserFS_get_unfixed_scheduler_DB\"\n (* get_fixed_scheduler_DB *)\n \"parserFS_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserFS_inst_ATS_axioms parserFS_inst_ATS_String_State_Modification_axioms parserFS_inst_ATS_Language_by_Finite_Derivations_axioms parserFS_inst_ATS_SchedUF_SB_axioms parserFS_inst_ATS_SchedF_SB_axioms parserFS_inst_ATS_Sched_SB_axioms parserFS_inst_ATS_SchedUF_DB_axioms parserFS_inst_ATS_SchedF_DB_axioms parserFS_inst_ATS_Sched_DB0_axioms parserFS_inst_ATS_Sched_DB_axioms parserFS_inst_ATS_Sched_axioms )\n done\n\nlemma parserFS_inst_AX_state_based_vs_derivation_based_get_fixed_scheduler: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n e c. d n = Some (pair e c) \\ parserFS_get_fixed_scheduler_DB G d n = parserFS_conf_fixed c)))\"\n apply(clarsimp)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parserFS_get_fixed_scheduler_DB_def get_configuration_def parserFS_get_scheduler_def)\n done\n\nlemma parserFS_inst_ATS_SchedF_SDB_axioms: \"\n ATS_SchedF_SDB_axioms valid_parser parserFS_initial_configurations parserFS_step_relation parserFS_conf_fixed parserFS_get_fixed_scheduler_DB \"\n apply(simp add: ATS_SchedF_SDB_axioms_def)\n apply(rule parserFS_inst_AX_state_based_vs_derivation_based_get_fixed_scheduler)\n done\n\nlemma parserFS_inst_AX_get_unfixed_scheduler_set_unfixed_scheduler_DB_sound: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n. (\\y. d n = Some y) \\ parserFS_get_unfixed_scheduler_DB G d n \\ [parser_bottom G] \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ parserFS_get_unfixed_scheduler (parserFS_set_unfixed_scheduler_DB G d n sUF) = sUF))))\"\n apply(clarsimp)\n apply(rename_tac G d n y sUF)(*strict*)\n apply(simp add: parserFS_set_unfixed_scheduler_def parserFS_get_unfixed_scheduler_def parserFS_set_unfixed_scheduler_DB_def get_configuration_def)\n done\n\nlemma parserFS_inst_AX_set_unfixed_scheduler_set_unfixed_scheduler_DB_sound: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n. (\\y. d n = Some y) \\ parserFS_get_unfixed_scheduler_DB G d n \\ [parser_bottom G] \\ (\\sUF. sUF \\ parser_unfixed_schedulers G \\ parserFS_set_unfixed_scheduler (the (get_configuration (d n))) sUF = parserFS_set_unfixed_scheduler_DB G d n sUF))))\"\n apply(clarsimp)\n apply(rename_tac G d n y sUF)(*strict*)\n apply(simp add: parserFS_get_scheduler_def parserFS_set_unfixed_scheduler_def parserFS_get_fixed_scheduler_DB_def parserFS_get_unfixed_scheduler_def parserFS_set_unfixed_scheduler_DB_def get_configuration_def)\n done\n\nlemma parserFS_inst_AX_state_based_vs_derivation_based_get_unfixed_scheduler: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n e c. d n = Some (pair e c) \\ parserFS_get_unfixed_scheduler_DB G d n = parserFS_get_unfixed_scheduler c)))\"\n apply(clarsimp)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_def parserFS_get_unfixed_scheduler_DB_def get_configuration_def)\n done\n\nlemma parserFS_inst_AX_state_based_vs_derivation_based_set_unfixed_scheduler: \"\n (\\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n e c. d n = Some (pair e c) \\ (\\sUF. parserFS_set_unfixed_scheduler_DB G d n sUF = parserFS_set_unfixed_scheduler c sUF))))\"\n apply(clarsimp)\n apply(rename_tac G d n e c sUF)(*strict*)\n apply(simp add: parserFS_set_unfixed_scheduler_DB_def get_configuration_def parserFS_set_unfixed_scheduler_def)\n done\n\nlemma parserFS_inst_ATS_SchedUF_SDB_axioms: \"\n ATS_SchedUF_SDB_axioms valid_parser parserFS_initial_configurations\n parserFS_step_relation parser_unfixed_schedulers\n parser_unfixed_scheduler_extendable parserFS_set_unfixed_scheduler\n parserFS_get_unfixed_scheduler parserFS_set_unfixed_scheduler_DB\n parserFS_get_unfixed_scheduler_DB \"\n apply(simp add: ATS_SchedUF_SDB_axioms_def)\n apply(simp add: parserFS_inst_AX_get_unfixed_scheduler_set_unfixed_scheduler_DB_sound parserFS_inst_AX_set_unfixed_scheduler_set_unfixed_scheduler_DB_sound parserFS_inst_AX_state_based_vs_derivation_based_get_unfixed_scheduler parserFS_inst_AX_state_based_vs_derivation_based_set_unfixed_scheduler )\n done\n\nlemma parserFS_inst_AX_unfixed_scheduler_extendable_get_unfixed_scheduler_equal_get_unfixed_scheduler_DB_on_initial_derivations: \"\n \\G. valid_parser G \\ (\\d. parserFS.derivation_initial G d \\ (\\n. (\\y. d n = Some y) \\ (parserFS_get_unfixed_scheduler_DB G d n \\ [parser_bottom G] = ATS_SchedUF_SB.get_unfixed_scheduler_nth parserFS_get_unfixed_scheduler d n \\ [parser_bottom G])))\"\n apply(clarsimp)\n apply(rename_tac G d n y)(*strict*)\n apply(simp add: suffix_def)\n apply(subgoal_tac \"\\e c. d n = Some (pair e c)\")\n apply(rename_tac G d n y)(*strict*)\n prefer 2\n apply(case_tac y)\n apply(rename_tac G d n y option b)(*strict*)\n apply(force)\n apply(rename_tac G d n y)(*strict*)\n apply(clarsimp)\n apply(rename_tac G d n e c)(*strict*)\n apply(simp add: parserFS_get_unfixed_scheduler_DB_def get_configuration_def parserFS.get_unfixed_scheduler_nth_def parserFS_get_unfixed_scheduler_def parserFS_get_scheduler_def)\n done\n\nlemma parserFS_inst_ATS_Sched_SDB_axioms: \"\n ATS_Sched_SDB_axioms valid_parser parserFS_initial_configurations\n parserFS_step_relation parser_unfixed_scheduler_extendable\n parserFS_get_unfixed_scheduler parserFS_get_unfixed_scheduler_DB \"\n apply(simp add: ATS_Sched_SDB_axioms_def)\n apply(simp add: parserFS_inst_AX_unfixed_scheduler_extendable_get_unfixed_scheduler_equal_get_unfixed_scheduler_DB_on_initial_derivations)\n done\n\ninterpretation \"parserFS\" : loc_autFS_6\n (* TSstructure *)\n \"valid_parser\"\n (* configurations *)\n \"parserFS_configurations\"\n (* initial_configurations *)\n \"parserFS_initial_configurations\"\n (* step_labels *)\n \"parser_step_labels\"\n (* step_relation *)\n \"parserFS_step_relation\"\n (* effects *)\n \"parser_markers\"\n (* marking_condition *)\n \"parserFS_marking_condition\"\n (* marked_effect *)\n \"parserFS_marked_effect\"\n (* unmarked_effect *)\n \"parserFS_unmarked_effect\"\n (* destinations *)\n \"parser_destinations\"\n (* get_destinations *)\n \"parserFS_get_destinations\"\n (* decreasing *)\n \"True\"\n (* string_state *)\n \"parserFS_string_state\"\n (* fixed_schedulers *)\n \"parser_fixed_schedulers\"\n (* empty_fixed_scheduler *)\n \"parser_empty_fixed_scheduler\"\n (* fixed_scheduler_extendable *)\n \"parser_fixed_scheduler_extendable\"\n (* scheduler_fragments *)\n \"parser_scheduler_fragments\"\n (* empty_scheduler_fragment *)\n \"parser_empty_scheduler_fragment\"\n (* join_scheduler_fragments *)\n \"append\"\n (* unfixed_schedulers *)\n \"parser_unfixed_schedulers\"\n (* empty_unfixed_scheduler *)\n \"parser_empty_unfixed_scheduler\"\n (* unfixed_scheduler_right_quotient_word *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler *)\n \"append\"\n (* unfixed_scheduler_extendable *)\n \"parser_unfixed_scheduler_extendable\"\n (* schedulers *)\n \"parser_schedulers\"\n (* initial_schedulers *)\n \"parser_schedulers\"\n (* empty_scheduler *)\n \"parser_empty_scheduler\"\n (* get_scheduler *)\n \"parserFS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler *)\n \"append\"\n (* extend_scheduler *)\n \"append\"\n (* set_unfixed_scheduler *)\n \"parserFS_set_unfixed_scheduler\"\n (* get_unfixed_scheduler *)\n \"parserFS_get_unfixed_scheduler\"\n (* get_fixed_scheduler *)\n \"parserFS_conf_fixed\"\n (* set_unfixed_scheduler_DB *)\n \"parserFS_set_unfixed_scheduler_DB\"\n (* get_unfixed_scheduler_DB *)\n \"parserFS_get_unfixed_scheduler_DB\"\n (* get_fixed_scheduler_DB *)\n \"parserFS_get_fixed_scheduler_DB\"\n apply(simp add: LOCALE_DEFS parser_interpretations)\n apply(simp add: parserFS_inst_AX_initial_configuration_belongs parserFS_inst_AX_step_relation_preserves_belongs )\n apply(simp add: parserFS_inst_ATS_axioms parserFS_inst_ATS_String_State_Modification_axioms parserFS_inst_ATS_Language_by_Finite_Derivations_axioms parserFS_inst_ATS_SchedUF_SB_axioms parserFS_inst_ATS_SchedF_SB_axioms parserFS_inst_ATS_Sched_SB_axioms parserFS_inst_ATS_SchedUF_DB_axioms parserFS_inst_ATS_SchedF_DB_axioms parserFS_inst_ATS_Sched_DB0_axioms parserFS_inst_ATS_Sched_DB_axioms parserFS_inst_ATS_SchedF_SDB_axioms parserFS_inst_ATS_SchedUF_SDB_axioms parserFS_inst_ATS_Sched_SDB_axioms parserFS_inst_ATS_Sched_axioms parserFS_inst_AX_get_scheduler_closed )\n done\n\ntheorem parserFS_dependency_between_determinism_properties_main: \"\n valid_parser G\n \\ parserFS.is_forward_target_deterministic_accessible G\"\n apply(simp add: parserFS.is_forward_target_deterministic_accessible_def parserFS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e x v)(*strict*)\n apply(case_tac c)\n apply(rename_tac c c1 c2 e x v parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera)(*strict*)\n apply(case_tac c1)\n apply(rename_tac c c1 c2 e x v parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera parserFS_conf_fixedaa parserFS_conf_stackaa parserFS_conf_scheduleraa)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c c1 c2 e x v parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera parserFS_conf_fixedaa parserFS_conf_stackaa parserFS_conf_scheduleraa parserFS_conf_fixedb parserFS_conf_stackb parserFS_conf_schedulerb)(*strict*)\n apply(case_tac e)\n apply(rename_tac c c1 c2 e x v parserFS_conf_fixeda parserFS_conf_stacka parserFS_conf_schedulera parserFS_conf_fixedaa parserFS_conf_stackaa parserFS_conf_scheduleraa parserFS_conf_fixedb parserFS_conf_stackb parserFS_conf_schedulerb rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(erule disjE)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(erule disjE)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(clarsimp)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_schedulera parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush popnew popnewa)(*strict*)\n apply(subgoal_tac \"popnew=popnewa\")\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_schedulera parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush popnew popnewa)(*strict*)\n prefer 2\n apply (metis same_append_eq)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_schedulera parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush popnew popnewa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(clarsimp)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(erule disjE)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(clarsimp)\n apply(rename_tac x v parserFS_conf_fixed parserFS_conf_scheduler parserFS_conf_fixeda parserFS_conf_schedulera parserFS_conf_fixedb parserFS_conf_schedulerb rule_lpop rule_lpush rule_rpush)(*strict*)\n apply(clarsimp)\n done\n\nlemmas parserFS_interpretations =\n parser_interpretations\n parserFS_inst_AX_initial_configuration_belongs\n parserFS_inst_AX_step_relation_preserves_belongs\n parserFS_inst_ATS_axioms\n parserFS_inst_ATS_String_State_Modification_axioms\n parserFS_inst_ATS_Language_by_Finite_Derivations_axioms\n parserFS_inst_ATS_SchedUF_SB_axioms\n parserFS_inst_ATS_SchedF_SB_axioms\n parserFS_inst_ATS_Sched_SB_axioms\n parserFS_inst_ATS_SchedUF_DB_axioms\n parserFS_inst_ATS_SchedF_DB_axioms\n parserFS_inst_ATS_Sched_DB0_axioms\n parserFS_inst_ATS_Sched_DB_axioms\n parserFS_inst_ATS_SchedF_SDB_axioms\n parserFS_inst_ATS_SchedUF_SDB_axioms\n parserFS_inst_ATS_Sched_SDB_axioms\n parserFS_inst_ATS_Sched_axioms\n parserFS_inst_AX_get_scheduler_closed\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_08/I_kparser_FS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.26571805743928106}} {"text": "section Parser\ntheory IpRoute_Parser\nimports Routing_Table \n \"../IP_Addresses/IP_Address_Parser\"\nkeywords \"parse_ip_route\" \"parse_ip_6_route\" :: thy_decl\nbegin\ntext\\This helps to read the output of the \\texttt{ip route} command into a @{typ \"32 routing_rule list\"}.\\\n\ndefinition empty_rr_hlp :: \"('a::len) prefix_match \\ 'a routing_rule\" where\n \"empty_rr_hlp pm = routing_rule.make pm default_metric (routing_action.make '''' None)\"\n\nlemma empty_rr_hlp_alt:\n \"empty_rr_hlp pm = \\ routing_match = pm, metric = 0, routing_action = \\output_iface = [], next_hop = None\\\\\"\n unfolding empty_rr_hlp_def routing_rule.defs default_metric_def routing_action.defs ..\n\ndefinition routing_action_next_hop_update :: \"'a word \\ 'a routing_rule \\ ('a::len) routing_rule\"\n where\n \"routing_action_next_hop_update h pk = pk\\ routing_action := (routing_action pk)\\ next_hop := Some h\\ \\\"\nlemma \"routing_action_next_hop_update h pk = routing_action_update (next_hop_update (\\_. (Some h))) (pk::32 routing_rule)\"\n by(simp add: routing_action_next_hop_update_def)\n\ndefinition routing_action_oiface_update :: \"string \\ 'a routing_rule \\ ('a::len) routing_rule\"\n where\n \"routing_action_oiface_update h pk = routing_action_update (output_iface_update (\\_. h)) (pk::'a routing_rule)\"\nlemma \"routing_action_oiface_update h pk = pk\\ routing_action := (routing_action pk)\\ output_iface := h\\ \\\"\n by(simp add: routing_action_oiface_update_def)\n\n(* Could be moved to Bitmagic *)\ndefinition \"default_prefix = PrefixMatch 0 0\"\nlemma default_prefix_matchall: \"prefix_match_semantics default_prefix ip\"\n unfolding default_prefix_def by (simp add: valid_prefix_00 zero_prefix_match_all)\n\ndefinition \"sanity_ip_route (r::('a::len) prefix_routing) \\ correct_routing r \\ unambiguous_routing r \\ list_all (op \\ '''' \\ routing_oiface) r\"\ntext\\The parser ensures that @{const sanity_ip_route} holds for any ruleset that is imported.\\\n\n(* Hide all the ugly ml in a file with the right extension *)\n(*Depends on the function parser_ipv4 from IP_Address_Parser*)\nML_file \"IpRoute_Parser.ml\"\n \nML\\\n Outer_Syntax.local_theory @{command_keyword parse_ip_route}\n \"Load a file generated by ip route and make the routing table definition available as isabelle term\"\n (Parse.binding --| @{keyword \"=\"} -- Parse.string >> register_ip_route 32)\n\\\n\nML\\\n Outer_Syntax.local_theory @{command_keyword parse_ip_6_route}\n \"Load a file generated by ip -6 route and make the routing table definition available as isabelle term\"\n (Parse.binding --| @{keyword \"=\"} -- Parse.string >> register_ip_route 128)\n\\\n\nparse_ip_route \"rtbl_parser_test1\" = \"ip-route-ex\"\nlemma \"sanity_ip_route rtbl_parser_test1\" by eval (* checked by parse_ip_route alread *)\n\nlemma \"rtbl_parser_test1 =\n [\\routing_match = PrefixMatch 0xFFFFFF00 32, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = None\\\\,\n \\routing_match = PrefixMatch 0xA0D2AA0 28, metric = 303, routing_action = \\output_iface = ''ewlan'', next_hop = None\\\\,\n \\routing_match = PrefixMatch 0xA0D2500 24, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = Some 0xFFFFFF00\\\\,\n \\routing_match = PrefixMatch 0xA0D2C00 24, metric = 0, routing_action = \\output_iface = ''tun0'', next_hop = Some 0xFFFFFF00\\\\,\n \\routing_match = PrefixMatch 0 0, metric = 303, routing_action = \\output_iface = ''ewlan'', next_hop = Some 0xA0D2AA1\\\\]\"\nby eval\n\nparse_ip_6_route \"rtbl_parser_test2\" = \"ip-6-route-ex\"\nvalue[code] rtbl_parser_test2\nlemma \"sanity_ip_route rtbl_parser_test2\" by eval\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Routing/IpRoute_Parser.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.26571805743928106}} {"text": "theory ReynoldsList\n imports Refinement\nbegin\n\nno_notation pmult (infixl \"*\" 80)\n and times (infixl \"*\" 70)\n and Set.image (infixr \"`\" 90)\n and sup (infixl \"+\" 65)\n and pmult_one (\"1\")\n and bot (\"\\\")\n and sep_impl (infix \"-*\" 55)\n\nno_notation Set.image (infixr \"`\" 90)\n and times (infixl \"*\" 70)\n\n(* List *)\nprimrec list' :: \"nat \\ nat list \\ 'a pred\" where\n \"list' i [] = \\i = 0\\ \\ emp\"\n| \"list' i (y#ys) = \\i \\ 0\\ \\ (EXS j. \\i [\\] [y,j]\\ * list' j ys)\"\n\nsyntax\n \"_list\" :: \"nat \\ nat list \\ bool\" (\"list _ _\")\n\ntranslations\n \"list x xs\" == \"|(`(CONST curry (CONST list' x xs)))|\"\n\nlemma list_cong: \"list' x xs (a, h) \\ x' = x \\ xs' = xs \\ h' = h \\ list' x' xs' (a, h')\"\n by force\n\nlemma list_cong_ex: \"list' x xs (a, h) \\ x' = x \\ h' = h \\ \\xs. list' x' xs (a, h')\"\n by force\n\nlemma empty_list: \"list' i a (s, h) \\ i = 0 \\ a = []\"\n by (metis (mono_tags, lifting) PairE inf1E list'.simps(2) list.exhaust old.prod.case)\n\nlemma list_i_null: \"list' 0 a (s, h) \\ a = [] \\ h = Map.empty\"\n by (induct a, simp_all add: emp_def)\n\nlemma list_i_not_null: \"list' i a (s, h) \\ i \\ 0 \\ a \\ []\"\n by (induct a, simp_all add: emp_def)\n\nlemma list_i_not_null_var: \"list' i x (s, h) \\ i \\ 0 \\ (\\y ys. x = y#ys)\"\n apply (auto dest!: list_i_not_null)\n by (metis list.exhaust)\n\nlemma sep_conj_s_preserving: \n assumes \"(\\h. P (s, h) \\ P (s', h))\" and \"(\\h. Q (s, h) \\ Q (s', h))\" \n shows \"((P * Q) (s, h) \\ (P * Q) (s', h))\"\n using assms by (auto simp add: sep_conj_def ortho_def split: option.splits) \n\nlemma list_s_preserving: \"list' n as (s :: 'a, h) \\ list' n as (s' :: 'a, h)\"\n apply (induct as arbitrary: n h)\n by (auto simp add: emp_def intro: sep_conj_s_preserving [of _ s])\n\nrecord list_state =\n i :: nat\n j :: nat\n k :: nat\n\n\n\nlemma [simp]: \"list' n as (j_update m s, h) = list' n as (s, h)\"\n by (auto intro: list_s_preserving)\n\nlemma [simp]: \"list' n as (k_update m s, h) = list' n as (s, h)\"\n by (auto intro: list_s_preserving)\n\nlemma heap_div: \"h1 \\ h2 \\ h1 a = Some b \\ (h1 ++ h2) a = Some b\"\n apply (auto simp: ortho_def)\n by (auto simp: map_add_def split: option.splits)\n\nlemma heap_div_var: \"h1 \\ h2 \\ h2 a = Some b \\ (h1 ++ h2) a = Some b\"\n by (auto simp: ortho_def)\n\nlemma heap_ortho_div2: \"[x \\ y, z \\ w] \\ h \\ [x \\ y] \\ [z \\ w] \\([x \\ y, z \\ w] ++ h)(x := None, z := None) = h\"\napply (simp add: fun_upd_def ortho_def map_add_def)\napply (rule ext)\napply (case_tac \"xa = z\")\napply auto\napply force\napply force\nby (metis option.exhaust option.simps(4) option.simps(5))\n \nlemma heap_div_the: \"h1 \\ h2 \\ h1 a = Some b \\ the ((h1 ++ h2) a) = b\"\n apply (auto simp: ortho_def)\n by (auto simp: map_add_def split: option.splits)\n \n\n\nlemma [iff]: \"x \\ emp = (\\(s, h). x (s, h) \\ emp (s, h))\"\n by auto\n\nlemma \"q s \\ (p \\ q) s = p s \\ q s\"\n by auto\n\nlemma pred_infI: \"p s \\ q s \\ (p \\ q) s\"\n by auto\n\nlemma pred_infD: \"(p \\ q) s \\ p s \\ q s\"\n by auto\n\nlemma listI: \"p \\ 0 \\ h1 \\ h2 \\ is_heap_list p [q, r] (s, h1) \\ list' r ns (s, h2) \\ list' p (q#ns) (s, h1 ++ h2)\"\n by (force simp: sep_conj_eq)\n\ndeclare sep_conj_eq [simp] emp_def[simp]\nnotation \n pred_ex (binder \"\\ \" 10)\n and inf (infixl \"\\\" 75)\n\nlemma \"\\\\list `i Ao\\ , \\ list `j (rev Ao)\\\\ \\\n `j := 0;\n while `i \\ 0\n do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n `j := `i;\n `i := `k\n od\" \nproof -\n have \"\\ \\list `i Ao\\, \\list `j (rev Ao)\\ \\ \\ \n `j := 0; \n \\\\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\, \n \\ list `j (rev Ao) \\ \\\" \n (is \"... \\ ?p\")\n by refinement force\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n \\(\\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement (auto dest!: list_i_null)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n \\(\\a A B k. (\\`i [\\] [a,k]\\ * \\ list k A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev (a#A)) @ B \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement (frule list_i_not_null_var, fastforce+)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n \\(\\ a A B. (\\`i [\\] [a,`k]\\ * \\ list `k A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev (a#A)) @ B \\) \\ \\`i \\ 0\\, \n \\ A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n apply refinement \n apply (rule_tac x=x in exI, rule_tac x=xa in exI, rule_tac x=xb in exI)\n apply (subgoal_tac \"the ((h1a ++ h2a ++ h2) (Suc (i a))) = xc\")\n by (auto simp add: is_singleton_def intro!: heap_div_the heap_divider)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n \\(\\ a A B. (\\`i [\\] [a,`j]\\ * \\ list `k A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev (a#A)) @ B \\) \\ \\`i \\ 0\\, \n \\ A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement (force simp: spec_def ht_def mono_def)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n \\(\\a A B. (\\ list `k A \\ * \\`i [\\] [a,`j]\\ * \\ list `j B \\) \\ \\(rev Ao) = (rev (a#A)) @ B \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement (subst mult_commute, force)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n \\(\\a A B. (\\ list `k A \\ * \\ list `i (a#B) \\) \\ \\(rev Ao) = (rev A) @ (a#B) \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n apply refinement\n apply (rule_tac x=x in exI, rule_tac x=xa in exI, rule_tac x=xb in exI)\n apply (auto simp only: sep_conj_eq)\n apply (rule_tac x=h1a in exI, rule_tac x=\"h2a ++ h2\" in exI)\n apply (auto simp del: list'.simps is_heap_list.simps intro!: listI)\n apply (force simp add: is_singleton_def ortho_def)\n by (force simp add: is_singleton_def ortho_def intro: listI)\n also have \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n \\(\\A B. (\\ list `k A \\ * \\ list `i B \\) \\ \\(rev Ao) = (rev A) @ B \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement (force simp only: sep_conj_eq)\n also have nine: \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n `j := `i;\n \\(\\A B. (\\ list `k A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\) \\ \\`i \\ 0\\, \n \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\\\n od\" (is \"... \\ ?p\")\n by refinement auto\n also have ten: \"?p \\ \n `j := 0;\n while `i \\ 0 do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n `j := `i;\n `i := `k\n od\"\n by refinement auto\n finally show ?thesis .\nqed\n\n\nlemma \"\\ \\list `i Ao\\\n `j := 0;\n while `i \\ 0\n inv \\A B. (\\ list `i A \\ * \\ list `j B \\) \\ \\(rev Ao) = (rev A) @ B \\\n do\n `k := @(`i + 1);\n @(`i + 1) := `j;\n `j := `i;\n `i := `k\n od\n \\ list `j (rev Ao)\\\" \napply hoare\napply force\napply (clarsimp dest!: list_i_null)\napply clarsimp\napply (frule list_i_not_null_var, simp)\napply (clarsimp simp add: is_singleton_def)\napply (rule_tac x=ys in exI, rule_tac x=\"y # xa\" in exI)\napply (subgoal_tac \"the (([i a \\ y, Suc (i a) \\ x] ++ h2a ++ h2) (Suc (i a))) = x\")\napply auto\nprefer 2\napply (force intro!: heap_div_the heap_divider)\napply (rule_tac x=h2a in exI, rule_tac x=\"[i a \\ y, Suc (i a) \\ j a] ++ h2\" in exI)\napply (auto simp add: is_singleton_def ortho_def intro!: listI)\nby (metis domIff empty_map_add fun_upd_upd map_add_upd_left)\n\nhide_const i j k\n\nrecord list_dealloc_state =\n x :: nat\n y :: nat\n\nlemma [simp]: \"list' n as (x_update m s, h) = list' n as (s, h)\"\n by (auto intro: list_s_preserving)\n\nlemma [simp]: \"list' n as (y_update m s, h) = list' n as (s, h)\"\n by (auto intro: list_s_preserving)\n\nlemma list_dealloc: \" \\ \\ list `x xs \\\n while `x \\ 0\n inv \\ \\xs. list `x xs \\\n do\n `y := `x;\n `x := @(`x + 1);\n dispose `y;\n dispose (`y + 1)\n od\n ( emp )\"\napply hoare\napply (auto simp: mono_def dispose_comm_def list_i_null, frule list_i_not_null_var)\nby (auto simp: is_singleton_def, auto intro!: list_cong_ex heap_div_the heap_ortho_div2)\n\nhide_const x y\n\nlemma \"\\ ( \\ x [\\] [b, j] \\ * \\ list i as \\ ) @x := a ( \\ x [\\] [a, j] \\ * \\ list i as \\ )\"\n by (simp only: is_heap_list.simps(2) curry_conv split_eta) hoare\n\n\nend\n", "meta": {"author": "victorgomes", "repo": "sep-logic", "sha": "32d8cf0c96ab651bb419ff8a0081ac70f34e188a", "save_path": "github-repos/isabelle/victorgomes-sep-logic", "path": "github-repos/isabelle/victorgomes-sep-logic/sep-logic-32d8cf0c96ab651bb419ff8a0081ac70f34e188a/Tool/ReynoldsList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.26571804995290604}} {"text": "section \\Transition Systems\\\n\ntheory Transition_System_Extensions\nimports\n \"Basics/Word_Prefixes\"\n \"Extensions/Set_Extensions\"\n \"Extensions/Relation_Extensions\"\n Transition_Systems_and_Automata.Transition_System\n Transition_Systems_and_Automata.Transition_System_Extra\n Transition_Systems_and_Automata.Transition_System_Construction\nbegin\n\n context transition_system_initial\n begin\n\n definition cycles :: \"'state \\ 'transition list set\"\n where \"cycles p \\ {w. path w p \\ target w p = p}\"\n\n lemma cyclesI[intro!]:\n assumes \"path w p\" \"target w p = p\"\n shows \"w \\ cycles p\"\n using assms unfolding cycles_def by auto\n lemma cyclesE[elim!]:\n assumes \"w \\ cycles p\"\n obtains \"path w p\" \"target w p = p\"\n using assms unfolding cycles_def by auto\n\n inductive_set executable :: \"'transition set\"\n where executable: \"p \\ nodes \\ enabled a p \\ a \\ executable\"\n\n lemma executableI_step[intro!]:\n assumes \"p \\ nodes\" \"enabled a p\"\n shows \"a \\ executable\"\n using executable assms by this\n lemma executableI_words_fin[intro!]:\n assumes \"p \\ nodes\" \"path w p\"\n shows \"set w \\ executable\"\n using assms by (induct w arbitrary: p, auto del: subsetI)\n lemma executableE[elim?]:\n assumes \"a \\ executable\"\n obtains p\n where \"p \\ nodes\" \"enabled a p\"\n using assms by induct auto\n\n end\n\n locale transition_system_interpreted =\n transition_system ex en\n for ex :: \"'action \\ 'state \\ 'state\"\n and en :: \"'action \\ 'state \\ bool\"\n and int :: \"'state \\ 'interpretation\"\n begin\n\n definition visible :: \"'action set\"\n where \"visible \\ {a. \\ q. en a q \\ int q \\ int (ex a q)}\"\n\n lemma visibleI[intro]:\n assumes \"en a q\" \"int q \\ int (ex a q)\"\n shows \"a \\ visible\"\n using assms unfolding visible_def by auto\n lemma visibleE[elim]:\n assumes \"a \\ visible\"\n obtains q\n where \"en a q\" \"int q \\ int (ex a q)\"\n using assms unfolding visible_def by auto\n\n abbreviation \"invisible \\ - visible\"\n\n lemma execute_fin_word_invisible:\n assumes \"path w p\" \"set w \\ invisible\"\n shows \"int (target w p) = int p\"\n using assms by (induct w arbitrary: p rule: list.induct, auto)\n lemma execute_inf_word_invisible:\n assumes \"run w p\" \"k \\ l\" \"\\ i. k \\ i \\ i < l \\ w !! i \\ visible\"\n shows \"int ((p ## trace w p) !! k) = int ((p ## trace w p) !! l)\"\n proof -\n have \"(p ## trace w p) !! l = target (stake l w) p\" by simp\n also have \"stake l w = stake k w @ stake (l - k) (sdrop k w)\" using assms(2) by simp\n also have \"target \\ p = target (stake (l - k) (sdrop k w)) (target (stake k w) p)\"\n unfolding fold_append comp_apply by rule\n also have \"int \\ = int (target (stake k w) p)\"\n proof (rule execute_fin_word_invisible)\n have \"w = stake l w @- sdrop l w\" by simp\n also have \"stake l w = stake k w @ stake (l - k) (sdrop k w)\" using assms(2) by simp\n finally have 1: \"run (stake k w @- stake (l - k) (sdrop k w) @- sdrop l w) p\"\n unfolding shift_append using assms(1) by simp\n show \"path (stake (l - k) (sdrop k w)) (target (stake k w) p)\" using 1 by auto\n show \"set (stake (l - k) (sdrop k w)) \\ invisible\" using assms(3) by (auto simp: set_stake_snth)\n qed\n also have \"\\ = int ((p ## trace w p) !! k)\" by simp\n finally show ?thesis by rule\n qed\n\n end\n\n locale transition_system_complete =\n transition_system_initial ex en init +\n transition_system_interpreted ex en int\n for ex :: \"'action \\ 'state \\ 'state\"\n and en :: \"'action \\ 'state \\ bool\"\n and init :: \"'state \\ bool\"\n and int :: \"'state \\ 'interpretation\"\n begin\n\n definition language :: \"'interpretation stream set\"\n where \"language \\ {smap int (p ## trace w p) |p w. init p \\ run w p}\"\n\n lemma languageI[intro!]:\n assumes \"w = smap int (p ## trace v p)\" \"init p\" \"run v p\"\n shows \"w \\ language\"\n using assms unfolding language_def by auto\n lemma languageE[elim!]:\n assumes \"w \\ language\"\n obtains p v\n where \"w = smap int (p ## trace v p)\" \"init p\" \"run v p\"\n using assms unfolding language_def by auto\n\n end\n\n locale transition_system_finite_nodes =\n transition_system_initial ex en init\n for ex :: \"'action \\ 'state \\ 'state\"\n and en :: \"'action \\ 'state \\ bool\"\n and init :: \"'state \\ bool\"\n +\n assumes reachable_finite: \"finite nodes\"\n\n locale transition_system_cut =\n transition_system_finite_nodes ex en init\n for ex :: \"'action \\ 'state \\ 'state\"\n and en :: \"'action \\ 'state \\ bool\"\n and init :: \"'state \\ bool\"\n +\n fixes cuts :: \"'action set\"\n assumes cycles_cut: \"p \\ nodes \\ w \\ cycles p \\ w \\ [] \\ set w \\ cuts \\ {}\"\n begin\n\n inductive scut :: \"'state \\ 'state \\ bool\"\n where scut: \"p \\ nodes \\ en a p \\ a \\ cuts \\ scut p (ex a p)\"\n\n declare scut.intros[intro!]\n declare scut.cases[elim!]\n\n lemma scut_reachable:\n assumes \"scut p q\"\n shows \"p \\ nodes\" \"q \\ nodes\"\n using assms by auto\n lemma scut_trancl:\n assumes \"scut\\<^sup>+\\<^sup>+ p q\"\n obtains w\n where \"path w p\" \"target w p = q\" \"set w \\ cuts = {}\" \"w \\ []\"\n using assms\n proof (induct arbitrary: thesis)\n case (base q)\n show ?case using base by force\n next\n case (step q r)\n obtain w where 1: \"path w p\" \"target w p = q\" \"set w \\ cuts = {}\" \"w \\ []\"\n using step(3) by this\n obtain a where 2: \"en a q\" \"a \\ cuts\" \"ex a q = r\" using step(2) by auto\n show ?case\n proof (rule step(4))\n show \"path (w @ [a]) p\" using 1 2 by auto\n show \"target (w @ [a]) p = r\" using 1 2 by auto\n show \"set (w @ [a]) \\ cuts = {}\" using 1 2 by auto\n show \"w @ [a] \\ []\" by auto\n qed\n qed\n\n sublocale wellfounded_relation \"scut\\\\\"\n proof (unfold_locales, intro finite_acyclic_wf_converse[to_pred] acyclicI[to_pred], safe)\n have 1: \"{(p, q). scut p q} \\ nodes \\ nodes\" using scut_reachable by blast\n have 2: \"finite (nodes \\ nodes)\"\n using finite_cartesian_product reachable_finite by blast\n show \"finite {(p, q). scut p q}\" using 1 2 by blast\n next\n fix p\n assume 1: \"scut\\<^sup>+\\<^sup>+ p p\"\n have 2: \"p \\ nodes\" using 1 tranclE[to_pred] scut_reachable by metis\n obtain w where 3: \"path w p\" \"target w p = p\" \"set w \\ cuts = {}\" \"w \\ []\"\n using scut_trancl 1 by this\n have 4: \"w \\ cycles p\" using 3(1, 2) by auto\n have 5: \"set w \\ cuts \\ {}\" using cycles_cut 2 4 3(4) by this\n show \"False\" using 3(3) 5 by simp\n qed\n\n lemma no_cut_scut:\n assumes \"p \\ nodes\" \"en a p\" \"a \\ cuts\"\n shows \"scut\\\\ (ex a p) p\"\n using assms by auto\n\n end\n\n locale transition_system_sticky =\n transition_system_complete ex en init int +\n transition_system_cut ex en init sticky\n for ex :: \"'action \\ 'state \\ 'state\"\n and en :: \"'action \\ 'state \\ bool\"\n and init :: \"'state \\ bool\"\n and int :: \"'state \\ 'interpretation\"\n and sticky :: \"'action set\"\n +\n assumes executable_visible_sticky: \"executable \\ visible \\ sticky\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Partial_Order_Reduction/Transition_System_Extensions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.26571804995290604}} {"text": "(* Title: BDD\n\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* \nRepointProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Proof of Procedure Repoint *}\ntheory RepointProof imports ProcedureSpecs begin\n\nhide_const (open) DistinctTreeProver.set_of tree.Node tree.Tip\n\nlemma (in Repoint_impl) Repoint_modifies:\n shows \"\\\\. \\\\{\\} \\p :== PROC Repoint (\\p)\n {t. t may_only_modify_globals \\ in [low,high]}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\nlemma low_high_exchange_dag: \nassumes pt_same: \"\\pt. pt \\ set_of lt \\ low pt = lowa pt \\ high pt = higha pt\"\nassumes pt_changed: \"\\pt \\ set_of lt. lowa pt = (rep \\ low) pt \\ \n higha pt = (rep \\ high) pt\"\nassumes rep_pt: \"\\pt \\ set_of rt. rep pt = pt\"\nshows \"\\q. Dag q (rep \\ low) (rep \\ high) rt \\ \n Dag q (rep \\ lowa) (rep \\ higha) rt\"\nusing rep_pt\nproof (induct rt)\n case Tip thus ?case by simp\nnext\n case (Node lrt q' rrt)\n have \"Dag q (rep \\ low) (rep \\ high) (Node lrt q' rrt)\" by fact\n then obtain \n q': \"q = q'\" and\n q_notNull: \"q \\ Null\" and \n lrt: \"Dag ((rep \\ low) q) (rep \\ low) (rep \\ high) lrt\" and\n rrt: \"Dag ((rep \\ high) q) (rep \\ low) (rep \\ high) rrt\" \n by auto\n have rlowa_rlow: \"((rep \\ lowa) q) = ((rep \\ low) q)\"\n proof (cases \"q \\ set_of lt\")\n case True\n note q_in_lt=this\n with pt_changed have lowa_q: \"lowa q = (rep \\ low) q\"\n by simp\n thus \"(rep \\ lowa) q = (rep \\ low) q\"\n proof (cases \"low q = Null\")\n case True\n with lowa_q have \"lowa q = Null\"\n by (simp add: null_comp_def)\n with True show ?thesis\n by (simp add: null_comp_def)\n next\n assume lq_nNull: \"low q \\ Null\"\n show ?thesis\n proof (cases \"(rep \\ low) q = Null\")\n case True \n with lowa_q have \"lowa q = Null\"\n by simp\n with True show ?thesis\n by (simp add: null_comp_def)\n next\n assume rlq_nNull: \"(rep \\ low) q \\ Null\"\n with lrt lowa_q have \"lowa q \\ set_of lrt\"\n by auto\n with Node.prems Node have \"lowa q \\ set_of (Node lrt q' rrt)\"\n by simp\n with Node.prems have \"rep (lowa q) = lowa q\"\n by auto\n with lowa_q rlq_nNull show ?thesis\n by (simp add: null_comp_def)\n qed\n qed\n next\n assume q_notin_lt: \" q \\ set_of lt\"\n with pt_same have \"low q = lowa q\"\n by auto\n thus ?thesis\n by (simp add: null_comp_def)\n qed\n have rhigha_rhigh: \"((rep \\ higha) q) = ((rep \\ high) q)\"\n proof (cases \"q \\ set_of lt\")\n case True\n note q_in_lt=this\n with pt_changed have higha_q: \"higha q = (rep \\ high) q\"\n by simp\n thus ?thesis\n proof (cases \"high q = Null\")\n case True\n with higha_q have \"higha q = Null\"\n by (simp add: null_comp_def)\n with True show ?thesis\n by (simp add: null_comp_def)\n next\n assume hq_nNull: \"high q \\ Null\"\n show ?thesis\n proof (cases \"(rep \\ high) q = Null\")\n case True \n with higha_q have \"higha q = Null\"\n by simp\n with True show ?thesis\n by (simp add: null_comp_def)\n next\n assume rhq_nNull: \"(rep \\ high) q \\ Null\"\n with rrt higha_q have \"higha q \\ set_of rrt\"\n by auto\n with Node.prems Node have \"higha q \\ set_of (Node lrt q' rrt)\"\n by simp\n with Node.prems have \"rep (higha q) = higha q\"\n by auto\n with higha_q rhq_nNull show ?thesis\n by (simp add: null_comp_def)\n qed\n qed\n next\n assume q_notin_lt: \" q \\ set_of lt\"\n with pt_same have \"high q = higha q\"\n by auto\n thus ?thesis\n by (simp add: null_comp_def)\n qed\n with rrt have rhigha_mixed_dag: \n \"Dag ((rep \\ higha) q) (rep \\ low) (rep \\ high) rrt\"\n by simp\n from lrt rlowa_rlow have rlowa_mixed_dag: \n \" Dag ((rep \\ lowa) q) (rep \\ low) (rep \\ high) lrt\"\n by simp\n from Node.prems have lrt_rep_eq: \" \\pt\\set_of lrt. rep pt = pt\"\n by simp\n from Node.prems have rrt_rep_eq: \"\\pt\\set_of rrt. rep pt = pt\"\n by simp\n from rlowa_mixed_dag lrt_rep_eq have lowa_lrt: \n \" Dag ((rep \\ lowa) q) (rep \\ lowa) (rep \\ higha) lrt\"\n apply -\n apply (rule Node.hyps)\n apply auto\n done\n from rhigha_mixed_dag rrt_rep_eq have higha_rrt: \n \" Dag ((rep \\ higha) q) (rep \\ lowa) (rep \\ higha) rrt\"\n apply -\n apply (rule Node.hyps)\n apply auto\n done\n with lowa_lrt q' q_notNull \n show \" Dag q (rep \\ lowa) (rep \\ higha) (Node lrt q' rrt)\"\n by simp\nqed\n\n(*lemma Repoint_spec :\nincludes Repoint_impl \nshows \n \"\\\\ rept. \\\\ \\\\. (Dag ((\\<^bsup>\\\\<^esup>rep \\ id) \\<^bsup>\\\\<^esup>p) (\\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>low) (\\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>high) rept) \n \\ (\\ no \\ set_of rept. \\<^bsup>\\\\<^esup>rep no = no) \\\n \\p :== CALL Repoint (\\p)\n \\Dag \\p \\low \\high rept \\\n (\\pt. pt \\ set_of rept \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt)\\\"\napply (hoare_rule CallRec1_SamePost)\napply (vcg)\napply (rule conjI)\napply clarify\nprefer 2\napply (intro impI allI )\napply (simp add: null_comp_def)\napply (rule conjI)\nprefer 2\napply (clarsimp)\napply clarify\n*)\n\n\n\nlemma (in Repoint_impl) Repoint_spec':\nshows \n \"\\\\. \\\\ {\\}\n \\p :== PROC Repoint (\\p)\n \\\\ rept. ((Dag ((\\<^bsup>\\\\<^esup>rep \\ id) \\<^bsup>\\\\<^esup>p) (\\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>low) (\\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>high) rept) \n \\ (\\ no \\ set_of rept. \\<^bsup>\\\\<^esup>rep no = no))\n \\ Dag \\p \\low \\high rept \\\n (\\pt. pt \\ set_of rept \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt)\\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (rule conjI)\napply clarify\nprefer 2\napply (intro impI allI )\napply (simp add: null_comp_def)\napply (rule conjI)\nprefer 2\napply (clarsimp)\napply clarify\nproof -\n fix low high p rep lowa higha pa lowb highb pb rept\n assume p_nNull: \"p \\ Null\"\n assume rp_nNull: \" rep p \\ Null\"\n assume rec_spec_lrept: \n \"\\rept. Dag ((rep \\ id) (low (rep p))) (rep \\ low) (rep \\ high) rept\n \\ (\\no\\set_of rept. rep no = no)\n \\ Dag pa lowa higha rept \\ \n (\\pt. pt \\ set_of rept \\ low pt = lowa pt \\ high pt = higha pt)\"\n assume rec_spec_rrept: \n \"\\rept. Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa(rep p := pa)) (rep \\ higha) rept\n \\ (\\no\\set_of rept. rep no = no)\n \\ Dag pb lowb highb rept \\ \n (\\pt. pt \\ set_of rept \\ (lowa(rep p := pa)) pt = lowb pt \\ higha pt = highb pt)\"\n assume rept_dag: \"Dag ((rep \\ id) p) (rep \\ low) (rep \\ high) rept\"\n assume rno_rept: \"\\no\\set_of rept. rep no = no\"\n show \" Dag (rep p) lowb (highb(rep p := pb)) rept \\ \n (\\pt. pt \\ set_of rept \\ low pt = lowb pt \\ high pt = (highb(rep p := pb)) pt)\"\n proof -\n from rp_nNull rept_dag p_nNull obtain lrept rrept where\n rept_def: \"rept = Node lrept (rep p) rrept\"\n by auto\n with rept_dag p_nNull have lrept_dag: \n \"Dag ((rep \\ low) (rep p)) (rep \\ low) (rep \\ high) lrept\"\n by simp\n from rept_def rept_dag p_nNull have rrept_dag: \n \"Dag ((rep \\ high) (rep p)) (rep \\ low) (rep \\ high) rrept\"\n by simp\n from rno_rept rept_def have rno_lrept: \"\\ no \\ set_of lrept. rep no = no\"\n by auto\n from rno_rept rept_def have rno_rrept: \"\\ no \\ set_of rrept. rep no = no\"\n by auto\n have repoint_post_low: \n \" Dag pa lowa higha lrept \\ \n (\\pt. pt \\ set_of lrept \\ low pt = lowa pt \\ high pt = higha pt)\"\n proof -\n from lrept_dag have \" Dag ((rep \\ id) (low (rep p))) (rep \\ low) (rep \\ high) lrept\"\n by (simp add: id_trans)\n with rec_spec_lrept rno_lrept show ?thesis\n apply -\n apply (erule_tac x=lrept in allE)\n apply (erule impE)\n apply simp\n apply assumption\n done\n qed\n hence low_lowa_nc: \"(\\pt. pt \\ set_of lrept \\ low pt = lowa pt \\ high pt = higha pt)\"\n by simp\n from lrept_dag repoint_post_low obtain \n pa_def: \"pa = (rep \\ low) (rep p)\" and\n lowa_higha_def: \"(\\ no \\ set_of lrept. lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no)\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n from rept_dag have rept_DAG: \"DAG rept\"\n by (rule Dag_is_DAG)\n with rept_def have rp_notin_lrept: \"rep p \\ set_of lrept\"\n by simp\n from rept_DAG rept_def have rp_notin_rrept: \"rep p \\ set_of rrept\"\n by simp\n have \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n from low_lowa_nc rp_notin_lrept have \"(rep \\ high) (rep p) = (rep \\ higha) (rep p)\"\n by (auto simp add: null_comp_def)\n with rrept_dag have higha_mixed_rrept: \n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ low) (rep \\ high) rrept\"\n by (simp add: id_trans)\n thm low_high_exchange_dag\n with low_lowa_nc lowa_higha_def rno_rrept have lowa_higha_rrept:\n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept\"\n apply -\n apply (rule low_high_exchange_dag)\n apply auto\n done\n have \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept = \n Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n have \"\\ no \\ set_of rrept. (rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\\n (rep \\ higha) no = (rep \\ higha) no\"\n proof \n fix no\n assume no_in_rrept: \"no \\ set_of rrept\"\n with rp_notin_rrept have \"no \\ rep p\" \n by blast\n thus \"(rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\ \n (rep \\ higha) no = (rep \\ higha) no\"\n by (simp add: null_comp_def)\n qed\n thus ?thesis\n by (rule heaps_eq_Dag_eq)\n qed\n with lowa_higha_rrept show ?thesis\n by simp\n qed\n with rec_spec_rrept rno_rrept have repoint_rrept: \"Dag pb lowb highb rrept \\ \n (\\pt. pt \\ set_of rrept \\ \n (lowa(rep p := pa)) pt = lowb pt \\ higha pt = highb pt)\"\n apply -\n apply (erule_tac x=rrept in allE)\n apply (erule impE)\n apply simp\n apply assumption\n done\n then have ab_nc: \"(\\pt. pt \\ set_of rrept \\ \n (lowa(rep p := pa)) pt = lowb pt \\ higha pt = highb pt)\"\n by simp\n from repoint_rrept rrept_dag obtain\n pb_def: \"pb = ((rep \\ high) (rep p))\" and\n lowb_highb_def: \"(\\ no \\ set_of rrept. lowb no = (rep \\ low) no \\ highb no = (rep \\ high) no)\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n proof -\n have \"\\ no \\ set_of rept. lowb no = (rep \\ low) no \\ (highb(rep p := pb)) no = (rep \\ high) no\"\n proof\n fix no\n assume no_in_rept: \" no \\ set_of rept\"\n show \"lowb no = (rep \\ low) no \\ (highb(rep p := pb)) no = (rep \\ high) no\"\n proof (cases \"no \\ set_of rrept\")\n case True\n with lowb_highb_def pb_def show ?thesis\n by simp\n next\n assume no_notin_rrept: \" no \\ set_of rrept\"\n show ?thesis\n proof (cases \"no \\ set_of lrept\")\n case True\n with no_notin_rrept rp_notin_lrept ab_nc\n have ab_nc_no: \"lowa no = lowb no \\ higha no = highb no\"\n apply -\n apply (erule_tac x=no in allE)\n apply (erule impE)\n apply simp\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n from lowa_higha_def True have \n \"lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no\"\n by auto\n with ab_nc_no have \"lowb no = (rep \\ low) no \\ highb no =(rep \\ high) no\" \n by simp\n with rp_notin_lrept True show ?thesis\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n next\n assume no_notin_lrept: \" no \\ set_of lrept\"\n with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n by simp\n with rp_notin_lrept low_lowa_nc have a_nc: \n \"low no = lowa no \\ high no = higha no\"\n by auto\n from rp_notin_rrept no_rp ab_nc have \n \"(lowa(rep p := pa)) no = lowb no \\ higha no = highb no\"\n by auto\n with a_nc pa_def no_rp have \"(rep \\ low) no = lowb no \\ high no = highb no\"\n by auto\n with pb_def no_rp show ?thesis\n by simp\n qed\n qed\n qed\n with rept_dag have \" Dag (rep p) lowb (highb(rep p := pb)) rept = \n Dag (rep p) (rep \\ low) (rep \\ high) rept\" \n apply -\n thm heaps_eq_Dag_eq\n apply (rule heaps_eq_Dag_eq)\n apply auto\n done\n with rept_dag p_nNull show ?thesis\n by simp\n qed\n have \"(\\pt. pt \\ set_of rept \\ low pt = lowb pt \\ high pt = (highb(rep p := pb)) pt)\"\n proof (intro allI impI)\n fix pt\n assume pt_notin_rept: \"pt \\ set_of rept\"\n with rept_def obtain\n pt_notin_lrept: \"pt \\ set_of lrept\" and\n pt_notin_rrept: \"pt \\ set_of rrept\" and\n pt_neq_rp: \"pt \\ rep p\"\n by simp\n with low_lowa_nc ab_nc show \"low pt = lowb pt \\ high pt = (highb(rep p := pb)) pt\"\n by auto\n qed\n with rept_end_dag show ?thesis\n by simp\n qed\nqed\n \nlemma (in Repoint_impl) Repoint_spec:\nshows \n \"\\\\ rept. \\\\ \\\\. Dag ((\\rep \\ id) \\p) (\\rep \\ \\low) (\\rep \\ \\high) rept \n \\ (\\ no \\ set_of rept. \\rep no = no) \\ \n \\p :== PROC Repoint (\\p)\n \\Dag \\p \\low \\high rept \\\n (\\pt. pt \\ set_of rept \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt)\\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (rule conjI)\nprefer 2\napply (clarsimp simp add: null_comp_def)\napply clarify\napply (rule conjI)\nprefer 2\napply clarsimp\napply clarify\nproof -\n fix rept low high rep p\n assume rept_dag: \"Dag ((rep \\ id) p) (rep \\ low) (rep \\ high) rept\"\n assume rno_rept: \"\\no\\set_of rept. rep no = no\"\n assume p_nNull: \"p \\ Null\"\n assume rp_nNull: \" rep p \\ Null\"\n show \"\\lrept.\n Dag ((rep \\ id) (low (rep p))) (rep \\ low) (rep \\ high) lrept \\\n (\\no\\set_of lrept. rep no = no) \\\n (\\lowa higha pa.\n Dag pa lowa higha lrept \\\n (\\pt. pt \\ set_of lrept \\\n low pt = lowa pt \\ high pt = higha pt) \\\n (\\rrept.\n Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa(rep p := pa))\n (rep \\ higha) rrept \\\n (\\no\\set_of rrept. rep no = no) \\\n (\\lowb highb pb.\n Dag pb lowb highb rrept \\\n (\\pt. pt \\ set_of rrept \\\n (lowa(rep p := pa)) pt = lowb pt \\\n higha pt = highb pt) \\\n Dag (rep p) lowb (highb(rep p := pb)) rept \\\n (\\pt. pt \\ set_of rept \\\n low pt = lowb pt \\\n high pt = (highb(rep p := pb)) pt))))\" \n proof -\n from rp_nNull rept_dag p_nNull obtain lrept rrept where\n rept_def: \"rept = Node lrept (rep p) rrept\"\n by auto\n with rept_dag p_nNull have lrept_dag: \n \"Dag ((rep \\ low) (rep p)) (rep \\ low) (rep \\ high) lrept\"\n by simp\n from rept_def rept_dag p_nNull have rrept_dag: \n \"Dag ((rep \\ high) (rep p)) (rep \\ low) (rep \\ high) rrept\"\n by simp\n from rno_rept rept_def have rno_lrept: \"\\ no \\ set_of lrept. rep no = no\"\n by auto\n from rno_rept rept_def have rno_rrept: \"\\ no \\ set_of rrept. rep no = no\"\n by auto\n show ?thesis\n apply (rule_tac x=lrept in exI)\n apply (rule conjI)\n apply (simp add: id_trans lrept_dag)\n apply (rule conjI)\n apply (rule rno_lrept)\n apply clarify\n proof -\n case (goal1 lowa higha pa)\n have lrepta: \"Dag pa lowa higha lrept\" by fact\n have low_lowa_nc: \n \"\\pt. pt \\ set_of lrept \\ low pt = lowa pt \\ high pt = higha pt\" by fact\n from lrept_dag lrepta obtain \n pa_def: \"pa = (rep \\ low) (rep p)\" and\n lowa_higha_def: \"\\no \\ set_of lrept. \n lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n from rept_dag have rept_DAG: \"DAG rept\"\n by (rule Dag_is_DAG)\n with rept_def have rp_notin_lrept: \"rep p \\ set_of lrept\"\n by simp\n from rept_DAG rept_def have rp_notin_rrept: \"rep p \\ set_of rrept\"\n by simp\n have rrepta: \"Dag ((rep \\ id) (higha (rep p))) \n (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n from low_lowa_nc rp_notin_lrept \n have \"(rep \\ high) (rep p) = (rep \\ higha) (rep p)\"\n by (auto simp add: null_comp_def)\n with rrept_dag have higha_mixed_rrept: \n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ low) (rep \\ high) rrept\"\n by (simp add: id_trans)\n thm low_high_exchange_dag\n with low_lowa_nc lowa_higha_def rno_rrept \n have lowa_higha_rrept:\n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept\"\n apply -\n apply (rule low_high_exchange_dag)\n apply auto\n done\n have \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept = \n Dag ((rep \\ id) (higha (rep p))) \n (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n have \"\\no \\ set_of rrept. \n (rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\\n (rep \\ higha) no = (rep \\ higha) no\"\n proof \n fix no\n assume no_in_rrept: \"no \\ set_of rrept\"\n with rp_notin_rrept have \"no \\ rep p\" \n by blast\n thus \"(rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\ \n (rep \\ higha) no = (rep \\ higha) no\"\n by (simp add: null_comp_def)\n qed\n thus ?thesis\n by (rule heaps_eq_Dag_eq)\n qed\n with lowa_higha_rrept show ?thesis\n by simp\n qed\n show ?case\n apply (rule_tac x=rrept in exI)\n apply (rule conjI)\n apply (rule rrepta)\n apply (rule conjI)\n apply (rule rno_rrept)\n apply clarify\n proof -\n case (goal1 lowb highb pb)\n have rreptb: \"Dag pb lowb highb rrept\" by fact\n have ab_nc: \"\\pt. pt \\ set_of rrept \\ \n (lowa(rep p := pa)) pt = lowb pt \\ higha pt = highb pt\" by fact\n from rreptb rrept_dag obtain\n pb_def: \"pb = ((rep \\ high) (rep p))\" and\n lowb_highb_def: \"\\no \\ set_of rrept. \n lowb no = (rep \\ low) no \\ highb no = (rep \\ high) no\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n proof -\n have \"\\no \\ set_of rept. \n lowb no = (rep \\ low) no \\ (highb(rep p := pb)) no = (rep \\ high) no\"\n proof\n fix no\n assume no_in_rept: \" no \\ set_of rept\"\n show \"lowb no = (rep \\ low) no \\ \n (highb(rep p := pb)) no = (rep \\ high) no\"\n proof (cases \"no \\ set_of rrept\")\n case True\n with lowb_highb_def pb_def show ?thesis\n by simp\n next\n assume no_notin_rrept: \" no \\ set_of rrept\"\n show ?thesis\n proof (cases \"no \\ set_of lrept\")\n case True\n with no_notin_rrept rp_notin_lrept ab_nc\n have ab_nc_no: \"lowa no = lowb no \\ higha no = highb no\"\n apply -\n apply (erule_tac x=no in allE)\n apply (erule impE)\n apply simp\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n from lowa_higha_def True have \n \"lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no\"\n by auto\n with ab_nc_no \n have \"lowb no = (rep \\ low) no \\ highb no =(rep \\ high) no\" \n by simp\n with rp_notin_lrept True show ?thesis\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n next\n assume no_notin_lrept: \" no \\ set_of lrept\"\n with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n by simp\n with rp_notin_lrept low_lowa_nc \n have a_nc: \"low no = lowa no \\ high no = higha no\"\n by auto\n from rp_notin_rrept no_rp ab_nc \n have \"(lowa(rep p := pa)) no = lowb no \\ higha no = highb no\"\n by auto\n with a_nc pa_def no_rp \n have \"(rep \\ low) no = lowb no \\ high no = highb no\"\n by auto\n with pb_def no_rp show ?thesis\n by simp\n qed\n qed\n qed\n with rept_dag \n have \"Dag (rep p) lowb (highb(rep p := pb)) rept = \n Dag (rep p) (rep \\ low) (rep \\ high) rept\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply auto\n done\n with rept_dag p_nNull show ?thesis\n by simp\n qed\n have \"(\\pt. pt \\ set_of rept \\ low pt = lowb pt \\ \n high pt = (highb(rep p := pb)) pt)\"\n proof (intro allI impI)\n fix pt\n assume pt_notin_rept: \"pt \\ set_of rept\"\n with rept_def obtain\n pt_notin_lrept: \"pt \\ set_of lrept\" and\n pt_notin_rrept: \"pt \\ set_of rrept\" and\n pt_neq_rp: \"pt \\ rep p\"\n by simp\n with low_lowa_nc ab_nc \n show \"low pt = lowb pt \\ high pt = (highb(rep p := pb)) pt\"\n by auto\n qed\n with rept_end_dag show ?case\n by simp\n qed\n qed\n qed\nqed\n\nlemma (in Repoint_impl) Repoint_spec_total:\nshows \n \"\\\\ rept. \\\\\\<^sub>t \\\\. Dag ((\\rep \\ id) \\p) (\\rep \\ \\low) (\\rep \\ \\high) rept \n \\ (\\ no \\ set_of rept. \\rep no = no) \\ \n \\p :== PROC Repoint (\\p)\n \\Dag \\p \\low \\high rept \\\n (\\pt. pt \\ set_of rept \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt)\\\"\n\napply (hoare_rule HoareTotal.ProcRec1\n [where r=\"measure (\\(s,p). size \n (dag ((\\<^bsup>s\\<^esup>rep \\ id) \\<^bsup>s\\<^esup>p) (\\<^bsup>s\\<^esup>rep \\ \\<^bsup>s\\<^esup>low) (\\<^bsup>s\\<^esup>rep \\ \\<^bsup>s\\<^esup>high)))\"])\napply vcg\napply (rule conjI)\nprefer 2\napply (clarsimp simp add: null_comp_def)\napply clarify\napply (rule conjI)\nprefer 2\napply clarsimp\napply clarify\nproof -\n fix rept low high rep p\n assume rept_dag: \"Dag ((rep \\ id) p) (rep \\ low) (rep \\ high) rept\"\n assume rno_rept: \"\\no\\set_of rept. rep no = no\"\n assume p_nNull: \"p \\ Null\"\n assume rp_nNull: \" rep p \\ Null\"\n show \"\\lrept.\n Dag ((rep \\ id) (low (rep p))) (rep \\ low) (rep \\ high) lrept \\\n (\\no\\set_of lrept. rep no = no) \\\n size (dag ((rep \\ id) (low (rep p))) (rep \\ low) (rep \\ high))\n < size (dag ((rep \\ id) p) (rep \\ low) (rep \\ high)) \\\n (\\lowa higha pa.\n Dag pa lowa higha lrept \\\n (\\pt. pt \\ set_of lrept \\\n low pt = lowa pt \\ high pt = higha pt) \\\n (\\rrept.\n Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa(rep p := pa))\n (rep \\ higha) rrept \\\n (\\no\\set_of rrept. rep no = no) \\\n size (dag ((rep \\ id) (higha (rep p)))\n (rep \\ lowa(rep p := pa)) (rep \\ higha))\n < size (dag ((rep \\ id) p) (rep \\ low) (rep \\ high)) \\\n (\\lowb highb pb.\n Dag pb lowb highb rrept \\\n (\\pt. pt \\ set_of rrept \\\n (lowa(rep p := pa)) pt = lowb pt \\\n higha pt = highb pt) \\\n Dag (rep p) lowb (highb(rep p := pb)) rept \\\n (\\pt. pt \\ set_of rept \\\n low pt = lowb pt \\\n high pt = (highb(rep p := pb)) pt))))\"\n proof -\n from rp_nNull rept_dag p_nNull obtain lrept rrept where\n rept_def: \"rept = Node lrept (rep p) rrept\"\n by auto\n with rept_dag p_nNull have lrept_dag: \n \"Dag ((rep \\ low) (rep p)) (rep \\ low) (rep \\ high) lrept\"\n by simp\n from rept_def rept_dag p_nNull have rrept_dag: \n \"Dag ((rep \\ high) (rep p)) (rep \\ low) (rep \\ high) rrept\"\n by simp\n from rno_rept rept_def have rno_lrept: \"\\ no \\ set_of lrept. rep no = no\"\n by auto\n from rno_rept rept_def have rno_rrept: \"\\ no \\ set_of rrept. rep no = no\"\n by auto\n show ?thesis\n apply (rule_tac x=lrept in exI)\n apply (rule conjI)\n apply (simp add: id_trans lrept_dag)\n apply (rule conjI)\n apply (rule rno_lrept)\n apply (rule conjI)\n using rept_dag rept_def\n apply (simp only: Dag_dag)\n apply (clarsimp simp add: id_trans Dag_dag)\n apply clarify\n proof -\n case (goal1 lowa higha pa)\n have lrepta: \"Dag pa lowa higha lrept\" by fact\n have low_lowa_nc: \n \"\\pt. pt \\ set_of lrept \\ low pt = lowa pt \\ high pt = higha pt\" by fact\n from lrept_dag lrepta obtain \n pa_def: \"pa = (rep \\ low) (rep p)\" and\n lowa_higha_def: \"\\no \\ set_of lrept. \n lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n from rept_dag have rept_DAG: \"DAG rept\"\n by (rule Dag_is_DAG)\n with rept_def have rp_notin_lrept: \"rep p \\ set_of lrept\"\n by simp\n from rept_DAG rept_def have rp_notin_rrept: \"rep p \\ set_of rrept\"\n by simp\n have rrepta: \"Dag ((rep \\ id) (higha (rep p))) \n (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n from low_lowa_nc rp_notin_lrept \n have \"(rep \\ high) (rep p) = (rep \\ higha) (rep p)\"\n by (auto simp add: null_comp_def)\n with rrept_dag have higha_mixed_rrept: \n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ low) (rep \\ high) rrept\"\n by (simp add: id_trans)\n thm low_high_exchange_dag\n with low_lowa_nc lowa_higha_def rno_rrept \n have lowa_higha_rrept:\n \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept\"\n apply -\n apply (rule low_high_exchange_dag)\n apply auto\n done\n have \"Dag ((rep \\ id) (higha (rep p))) (rep \\ lowa) (rep \\ higha) rrept = \n Dag ((rep \\ id) (higha (rep p))) \n (rep \\ lowa(rep p := pa)) (rep \\ higha) rrept\"\n proof -\n have \"\\no \\ set_of rrept. \n (rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\\n (rep \\ higha) no = (rep \\ higha) no\"\n proof \n fix no\n assume no_in_rrept: \"no \\ set_of rrept\"\n with rp_notin_rrept have \"no \\ rep p\" \n by blast\n thus \"(rep \\ lowa) no = (rep \\ lowa(rep p := pa)) no \\ \n (rep \\ higha) no = (rep \\ higha) no\"\n by (simp add: null_comp_def)\n qed\n thus ?thesis\n by (rule heaps_eq_Dag_eq)\n qed\n with lowa_higha_rrept show ?thesis\n by simp\n qed\n show ?case\n apply (rule_tac x=rrept in exI)\n apply (rule conjI)\n apply (rule rrepta)\n apply (rule conjI)\n apply (rule rno_rrept)\n apply (rule conjI)\n using rept_dag rept_def rrepta\n apply (simp only: Dag_dag)\n apply (clarsimp simp add: id_trans Dag_dag)\n apply clarify\n proof -\n case (goal1 lowb highb pb)\n have rreptb: \"Dag pb lowb highb rrept\" by fact\n have ab_nc: \"\\pt. pt \\ set_of rrept \\ \n (lowa(rep p := pa)) pt = lowb pt \\ higha pt = highb pt\" by fact\n from rreptb rrept_dag obtain\n pb_def: \"pb = ((rep \\ high) (rep p))\" and\n lowb_highb_def: \"\\no \\ set_of rrept. \n lowb no = (rep \\ low) no \\ highb no = (rep \\ high) no\"\n apply -\n apply (drule Dags_eq_hp_eq)\n apply auto\n done\n have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n proof -\n have \"\\no \\ set_of rept. \n lowb no = (rep \\ low) no \\ (highb(rep p := pb)) no = (rep \\ high) no\"\n proof\n fix no\n assume no_in_rept: \" no \\ set_of rept\"\n show \"lowb no = (rep \\ low) no \\ \n (highb(rep p := pb)) no = (rep \\ high) no\"\n proof (cases \"no \\ set_of rrept\")\n case True\n with lowb_highb_def pb_def show ?thesis\n by simp\n next\n assume no_notin_rrept: \" no \\ set_of rrept\"\n show ?thesis\n proof (cases \"no \\ set_of lrept\")\n case True\n with no_notin_rrept rp_notin_lrept ab_nc\n have ab_nc_no: \"lowa no = lowb no \\ higha no = highb no\"\n apply -\n apply (erule_tac x=no in allE)\n apply (erule impE)\n apply simp\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n from lowa_higha_def True have \n \"lowa no = (rep \\ low) no \\ higha no = (rep \\ high) no\"\n by auto\n with ab_nc_no \n have \"lowb no = (rep \\ low) no \\ highb no =(rep \\ high) no\" \n by simp\n with rp_notin_lrept True show ?thesis\n apply (subgoal_tac \"no \\ rep p\")\n apply simp\n apply blast\n done\n next\n assume no_notin_lrept: \" no \\ set_of lrept\"\n with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n by simp\n with rp_notin_lrept low_lowa_nc \n have a_nc: \"low no = lowa no \\ high no = higha no\"\n by auto\n from rp_notin_rrept no_rp ab_nc \n have \"(lowa(rep p := pa)) no = lowb no \\ higha no = highb no\"\n by auto\n with a_nc pa_def no_rp \n have \"(rep \\ low) no = lowb no \\ high no = highb no\"\n by auto\n with pb_def no_rp show ?thesis\n by simp\n qed\n qed\n qed\n with rept_dag \n have \"Dag (rep p) lowb (highb(rep p := pb)) rept = \n Dag (rep p) (rep \\ low) (rep \\ high) rept\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply auto\n done\n with rept_dag p_nNull show ?thesis\n by simp\n qed\n have \"(\\pt. pt \\ set_of rept \\ low pt = lowb pt \\ \n high pt = (highb(rep p := pb)) pt)\"\n proof (intro allI impI)\n fix pt\n assume pt_notin_rept: \"pt \\ set_of rept\"\n with rept_def obtain\n pt_notin_lrept: \"pt \\ set_of lrept\" and\n pt_notin_rrept: \"pt \\ set_of rrept\" and\n pt_neq_rp: \"pt \\ rep p\"\n by simp\n with low_lowa_nc ab_nc \n show \"low pt = lowb pt \\ high pt = (highb(rep p := pb)) pt\"\n by auto\n qed\n with rept_end_dag show ?case\n by simp\n qed\n qed\n qed\nqed\n \nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/BDD/RepointProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.26571804995290604}} {"text": "(* Title: HOL/Library/Conditional_Parametricity.thy\n Author: Jan Gilcher, Andreas Lochbihler, Dmitriy Traytel, ETH Zürich\n\nA conditional parametricity prover\n*)\n\ntheory Conditional_Parametricity\nimports \"MainRLT\"\nkeywords \"parametric_constant\" :: thy_decl\nbegin\n\ncontext includes lifting_syntax begin\n\nqualified definition Rel_match :: \"('a \\ 'b \\ bool) \\ 'a \\ 'b \\ bool\" where\n \"Rel_match R x y = R x y\"\n\nnamed_theorems parametricity_preprocess\n\nlemma bi_unique_Rel_match [parametricity_preprocess]:\n \"bi_unique A = Rel_match (A ===> A ===> (=)) (=) (=)\"\n unfolding bi_unique_alt_def2 Rel_match_def ..\n\nlemma bi_total_Rel_match [parametricity_preprocess]:\n \"bi_total A = Rel_match ((A ===> (=)) ===> (=)) All All\"\n unfolding bi_total_alt_def2 Rel_match_def ..\n\nlemma is_equality_Rel: \"is_equality A \\ Transfer.Rel A t t\"\n by (fact transfer_raw)\n\nlemma Rel_Rel_match: \"Transfer.Rel R x y \\ Rel_match R x y\"\n unfolding Rel_match_def Rel_def .\n\nlemma Rel_match_Rel: \"Rel_match R x y \\ Transfer.Rel R x y\"\n unfolding Rel_match_def Rel_def .\n\nlemma Rel_Rel_match_eq: \"Transfer.Rel R x y = Rel_match R x y\"\n using Rel_Rel_match Rel_match_Rel by fast\n\nlemma Rel_match_app:\n assumes \"Rel_match (A ===> B) f g\" and \"Transfer.Rel A x y\"\n shows \"Rel_match B (f x) (g y)\"\n using assms Rel_match_Rel Rel_app Rel_Rel_match by fast\n\nend\n\nML_file \\conditional_parametricity.ML\\\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/Library/Conditional_Parametricity.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.42632159254749025, "lm_q1q2_score": 0.26536785934564017}} {"text": "(* Title: JinjaDCI/Common/WellForm.thy\n\n Author: Tobias Nipkow, Susannah Mansky\n Copyright 2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory J/WellForm.thy by Tobias Nipkow\n*)\n\nsection \\ Generic Well-formedness of programs \\\n\ntheory WellForm imports TypeRel SystemClasses begin\n\ntext \\\\noindent This theory defines global well-formedness conditions\nfor programs but does not look inside method bodies. Hence it works\nfor both Jinja and JVM programs. Well-typing of expressions is defined\nelsewhere (in theory @{text WellType}).\n\nBecause Jinja does not have method overloading, its policy for method\noverriding is the classical one: \\emph{covariant in the result type\nbut contravariant in the argument types.} This means the result type\nof the overriding method becomes more specific, the argument types\nbecome more general.\n\\\n\ntype_synonym 'm wf_mdecl_test = \"'m prog \\ cname \\ 'm mdecl \\ bool\"\n\ndefinition wf_fdecl :: \"'m prog \\ fdecl \\ bool\"\nwhere\n \"wf_fdecl P \\ \\(F,b,T). is_type P T\"\n\ndefinition wf_mdecl :: \"'m wf_mdecl_test \\ 'm wf_mdecl_test\"\nwhere\n \"wf_mdecl wf_md P C \\ \\(M,b,Ts,T,m).\n (\\T\\set Ts. is_type P T) \\ is_type P T \\ wf_md P C (M,b,Ts,T,m)\"\n\ndefinition wf_clinit :: \"'m mdecl list \\ bool\" where\n\"wf_clinit ms = (\\m. (clinit,Static,[],Void,m)\\set ms)\"\n\ndefinition wf_cdecl :: \"'m wf_mdecl_test \\ 'm prog \\ 'm cdecl \\ bool\"\nwhere\n \"wf_cdecl wf_md P \\ \\(C,(D,fs,ms)).\n (\\f\\set fs. wf_fdecl P f) \\ distinct_fst fs \\\n (\\m\\set ms. wf_mdecl wf_md P C m) \\ distinct_fst ms \\\n (C \\ Object \\\n is_class P D \\ \\ P \\ D \\\\<^sup>* C \\\n (\\(M,b,Ts,T,m)\\set ms.\n \\D' b' Ts' T' m'. P \\ D sees M,b':Ts' \\ T' = m' in D' \\\n b = b' \\ P \\ Ts' [\\] Ts \\ P \\ T \\ T')) \\\n wf_clinit ms\"\n\ndefinition wf_syscls :: \"'m prog \\ bool\"\nwhere\n \"wf_syscls P \\ {Object} \\ sys_xcpts \\ set(map fst P)\"\n\ndefinition wf_prog :: \"'m wf_mdecl_test \\ 'm prog \\ bool\"\nwhere\n \"wf_prog wf_md P \\ wf_syscls P \\ (\\c \\ set P. wf_cdecl wf_md P c) \\ distinct_fst P\"\n\n\nsubsection\\ Well-formedness lemmas \\\n\nlemma class_wf: \n \"\\class P C = Some c; wf_prog wf_md P\\ \\ wf_cdecl wf_md P (C,c)\"\n(*<*)by (unfold wf_prog_def class_def) (fast dest: map_of_SomeD)(*>*)\n\n\nlemma class_Object [simp]: \n \"wf_prog wf_md P \\ \\C fs ms. class P Object = Some (C,fs,ms)\"\n(*<*)by (unfold wf_prog_def wf_syscls_def class_def)\n (auto simp: map_of_SomeI)\n(*>*)\n\n\nlemma is_class_Object [simp]:\n \"wf_prog wf_md P \\ is_class P Object\"\n(*<*)by (simp add: is_class_def)(*>*)\n\nlemma is_class_supclass:\nassumes wf: \"wf_prog wf_md P\" and sub: \"P \\ C \\\\<^sup>* D\"\nshows \"is_class P C \\ is_class P D\"\n(*<*)\nusing sub proof(induct)\n case step then show ?case\n by(auto simp:wf_cdecl_def is_class_def dest!:class_wf[OF _ wf] subcls1D)\nqed simp\n(*>*)\n\nlemma is_class_xcpt:\n \"\\ C \\ sys_xcpts; wf_prog wf_md P \\ \\ is_class P C\"\n(*<*)\nby (fastforce intro!: map_of_SomeI\n simp add: wf_prog_def wf_syscls_def is_class_def class_def)\n(*>*)\n\n\nlemma subcls1_wfD:\nassumes sub1: \"P \\ C \\\\<^sup>1 D\" and wf: \"wf_prog wf_md P\"\nshows \"D \\ C \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n(*<*)\nproof -\n obtain fs ms where \"C \\ Object\" and cls: \"class P C = \\(D, fs, ms)\\\"\n using subcls1D[OF sub1] by clarify\n then show ?thesis using wf class_wf[OF cls wf] r_into_trancl[OF sub1]\n by(force simp add: wf_cdecl_def reflcl_trancl [THEN sym]\n simp del: reflcl_trancl)\nqed\n(*>*)\n\n\nlemma wf_cdecl_supD: \n \"\\wf_cdecl wf_md P (C,D,r); C \\ Object\\ \\ is_class P D\"\n(*<*)by (auto simp: wf_cdecl_def)(*>*)\n\n\nlemma subcls_asym:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n(*<*)by(erule tranclE; fast dest!: subcls1_wfD intro: trancl_trans)(*>*)\n\n\nlemma subcls_irrefl:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ C \\ D\"\n(*<*)by (erule trancl_trans_induct) (auto dest: subcls1_wfD subcls_asym)(*>*)\n\n\nlemma acyclic_subcls1:\n \"wf_prog wf_md P \\ acyclic (subcls1 P)\"\n(*<*)by (unfold acyclic_def) (fast dest: subcls_irrefl)(*>*)\n\n\nlemma wf_subcls1:\n \"wf_prog wf_md P \\ wf ((subcls1 P)\\)\"\n(*<*)\nproof -\n assume wf: \"wf_prog wf_md P\"\n have \"finite (subcls1 P)\" by(rule finite_subcls1)\n then have fin': \"finite ((subcls1 P)\\)\" by(subst finite_converse)\n\n from wf have \"acyclic (subcls1 P)\" by(rule acyclic_subcls1)\n then have acyc': \"acyclic ((subcls1 P)\\)\" by (subst acyclic_converse)\n\n from fin' acyc' show ?thesis by (rule finite_acyclic_wf)\nqed\n(*>*)\n\n\nlemma single_valued_subcls1:\n \"wf_prog wf_md G \\ single_valued (subcls1 G)\"\n(*<*)\nby(auto simp:wf_prog_def distinct_fst_def single_valued_def dest!:subcls1D)\n(*>*)\n\n\nlemma subcls_induct: \n \"\\ wf_prog wf_md P; \\C. \\D. (C,D) \\ (subcls1 P)\\<^sup>+ \\ Q D \\ Q C \\ \\ Q C\"\n(*<*)\n (is \"?A \\ PROP ?P \\ _\")\nproof -\n assume p: \"PROP ?P\"\n assume ?A then have wf: \"wf_prog wf_md P\" by assumption\n have wf':\"wf (((subcls1 P)\\<^sup>+)\\)\" using wf_trancl[OF wf_subcls1[OF wf]]\n by(simp only: trancl_converse)\n show ?thesis using wf_induct[where a = C and P = Q, OF wf' p] by simp\nqed\n(*>*)\n\n\nlemma subcls1_induct_aux:\nassumes \"is_class P C\" and wf: \"wf_prog wf_md P\" and QObj: \"Q Object\"\nshows\n \"\\ \\C D fs ms.\n \\ C \\ Object; is_class P C; class P C = Some (D,fs,ms) \\\n wf_cdecl wf_md P (C,D,fs,ms) \\ P \\ C \\\\<^sup>1 D \\ is_class P D \\ Q D\\ \\ Q C \\\n \\ Q C\"\n(*<*)\n (is \"PROP ?P \\ _\")\nproof -\n assume p: \"PROP ?P\"\n have \"class P C \\ None \\ Q C\"\n proof(induct rule: subcls_induct[OF wf])\n case (1 C)\n have \"class P C \\ None \\ Q C\"\n proof(cases \"C = Object\")\n case True\n then show ?thesis using QObj by fast\n next\n case False\n assume nNone: \"class P C \\ None\"\n then have is_cls: \"is_class P C\" by(simp add: is_class_def)\n obtain D fs ms where cls: \"class P C = \\(D, fs, ms)\\\" using nNone by safe\n also have wfC: \"wf_cdecl wf_md P (C, D, fs, ms)\" by(rule class_wf[OF cls wf])\n moreover have D: \"is_class P D\" by(rule wf_cdecl_supD[OF wfC False])\n moreover have \"P \\ C \\\\<^sup>1 D\" by(rule subcls1I[OF cls False])\n moreover have \"class P D \\ None\" using D by(simp add: is_class_def)\n ultimately show ?thesis using 1 by (auto intro: p[OF False is_cls])\n qed\n then show \"class P C \\ None \\ Q C\" by simp\n qed\n thus ?thesis using assms by(unfold is_class_def) simp\nqed\n(*>*)\n\n(* FIXME can't we prove this one directly?? *)\nlemma subcls1_induct [consumes 2, case_names Object Subcls]:\n \"\\ wf_prog wf_md P; is_class P C; Q Object;\n \\C D. \\C \\ Object; P \\ C \\\\<^sup>1 D; is_class P D; Q D\\ \\ Q C \\\n \\ Q C\"\n(*<*)by (erule (2) subcls1_induct_aux) blast(*>*)\n\n\nlemma subcls_C_Object:\nassumes \"class\": \"is_class P C\" and wf: \"wf_prog wf_md P\"\nshows \"P \\ C \\\\<^sup>* Object\"\n(*<*)\nusing wf \"class\"\nproof(induct rule: subcls1_induct)\n case Subcls\n then show ?case by(simp add: converse_rtrancl_into_rtrancl)\nqed fast\n(*>*)\n\n\nlemma is_type_pTs:\nassumes \"wf_prog wf_md P\" and \"(C,S,fs,ms) \\ set P\" and \"(M,b,Ts,T,m) \\ set ms\"\nshows \"set Ts \\ types P\"\n(*<*)\nproof\n from assms have \"wf_mdecl wf_md P C (M,b,Ts,T,m)\" \n by (unfold wf_prog_def wf_cdecl_def) auto\n hence \"\\t \\ set Ts. is_type P t\" by (unfold wf_mdecl_def) auto\n moreover fix t assume \"t \\ set Ts\"\n ultimately have \"is_type P t\" by blast\n thus \"t \\ types P\" ..\nqed\n(*>*)\n\nlemma wf_supercls_distinct_app:\nassumes wf:\"wf_prog wf_md P\"\n and nObj: \"C \\ Object\" and cls: \"class P C = \\(D, fs, ms)\\\"\n and super: \"supercls_lst P (C#Cs)\" and dist: \"distinct (C#Cs)\"\nshows \"distinct (D#C#Cs)\"\nproof -\n have \"\\ P \\ D \\\\<^sup>* C\" using subcls1_wfD[OF subcls1I[OF cls nObj] wf]\n by (simp add: rtrancl_eq_or_trancl)\n then show ?thesis using assms by auto\nqed\n\n\nsubsection\\ Well-formedness and method lookup \\\n\nlemma sees_wf_mdecl:\nassumes wf: \"wf_prog wf_md P\" and sees: \"P \\ C sees M,b:Ts\\T = m in D\"\nshows \"wf_mdecl wf_md P D (M,b,Ts,T,m)\"\n(*<*)\nusing wf visible_method_exists[OF sees] proof(cases b)\nqed (fastforce simp:wf_cdecl_def dest!:class_wf dest:map_of_SomeD)+\n(*>*)\n\nlemma sees_method_mono [rule_format (no_asm)]: \nassumes sub: \"P \\ C' \\\\<^sup>* C\" and wf: \"wf_prog wf_md P\"\nshows \"\\D b Ts T m. P \\ C sees M,b:Ts\\T = m in D \\\n (\\D' Ts' T' m'. P \\ C' sees M,b:Ts'\\T' = m' in D' \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T)\"\n(*<*)\n (is \"\\D b Ts T m. ?P C D b Ts T m \\ ?Q C' D b Ts T m\")\nproof(rule disjE[OF rtranclD[OF sub]])\n assume \"C' = C\"\n then show ?thesis using assms by fastforce\nnext\n assume \"C' \\ C \\ (C', C) \\ (subcls1 P)\\<^sup>+\"\n then have neq: \"C' \\ C\" and subcls1: \"(C', C) \\ (subcls1 P)\\<^sup>+\" by simp+\n show ?thesis proof(induct rule: trancl_trans_induct[OF subcls1])\n case (2 x y z)\n then have zy: \"\\D b Ts T m. ?P z D b Ts T m \\ ?Q y D b Ts T m\" by blast\n have \"\\D b Ts T m. ?P z D b Ts T m \\ ?Q x D b Ts T m\"\n proof -\n fix D b Ts T m assume P: \"?P z D b Ts T m\"\n then show \"?Q x D b Ts T m\" using zy[OF P] 2(2)\n by(fast elim: widen_trans widens_trans)\n qed\n then show ?case by blast\n next\n case (1 x y)\n have \"\\D b Ts T m. ?P y D b Ts T m \\ ?Q x D b Ts T m\"\n proof -\n fix D b Ts T m assume P: \"?P y D b Ts T m\"\n then obtain Mm where sees: \"P \\ y sees_methods Mm\" and\n M: \"Mm M = \\((b, Ts, T, m), D)\\\"\n by(clarsimp simp:Method_def)\n obtain fs ms where nObj: \"x \\ Object\" and\n cls: \"class P x = \\(y, fs, ms)\\\"\n using subcls1D[OF 1] by clarsimp\n have x_meth: \"P \\ x sees_methods Mm ++ (map_option (\\m. (m, x)) \\ map_of ms)\"\n using sees_methods_rec[OF cls nObj sees] by simp\n show \"?Q x D b Ts T m\" proof(cases \"map_of ms M\")\n case None\n then have \"\\m'. P \\ x sees M, b : Ts\\T = m' in D\" using M x_meth\n by(fastforce simp add:Method_def map_add_def split:option.split)\n then show ?thesis by auto\n next\n case (Some a)\n then obtain b' Ts' T' m' where a: \"a = (b',Ts',T',m')\" by(cases a)\n then have \"(\\m' Mm. P \\ y sees_methods Mm \\ Mm M = \\((b, Ts, T, m'), D)\\)\n \\ b' = b \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T\"\n using nObj class_wf[OF cls wf] map_of_SomeD[OF Some]\n by(clarsimp simp: wf_cdecl_def Method_def) fast\n then show ?thesis using Some a sees M x_meth\n by(fastforce simp:Method_def map_add_def split:option.split)\n qed\n qed\n then show ?case by simp\n qed\nqed\n(*>*)\n\n\nlemma sees_method_mono2:\n \"\\ P \\ C' \\\\<^sup>* C; wf_prog wf_md P;\n P \\ C sees M,b:Ts\\T = m in D; P \\ C' sees M,b':Ts'\\T' = m' in D' \\\n \\ b = b' \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T\"\n(*<*)by(blast dest:sees_method_mono sees_method_fun)(*>*)\n\nlemma mdecls_visible:\nassumes wf: \"wf_prog wf_md P\" and \"class\": \"is_class P C\"\nshows \"\\D fs ms. class P C = Some(D,fs,ms)\n \\ \\Mm. P \\ C sees_methods Mm \\ (\\(M,b,Ts,T,m) \\ set ms. Mm M = Some((b,Ts,T,m),C))\"\n(*<*)\nusing wf \"class\"\nproof (induct rule:subcls1_induct)\n case Object\n with wf have dfst:\"distinct_fst ms\"\n by (unfold class_def wf_prog_def wf_cdecl_def) (fastforce dest:map_of_SomeD)\n with dfst have \"distinct_fst ms\"\n by(blast dest: distinct_fst_appendD)\n with Object show ?case by(fastforce intro!: sees_methods_Object map_of_SomeI)\nnext\n case Subcls\n with wf have dfst:\"distinct_fst ms\"\n by (unfold class_def wf_prog_def wf_cdecl_def) (fastforce dest:map_of_SomeD)\n with dfst have \"distinct_fst ms\"\n by(blast dest: distinct_fst_appendD)\n with Subcls show ?case\n by(fastforce elim:sees_methods_rec dest:subcls1D map_of_SomeI\n simp:is_class_def)\nqed\n(*>*)\n\nlemma mdecl_visible:\nassumes wf: \"wf_prog wf_md P\" and C: \"(C,S,fs,ms) \\ set P\" and m: \"(M,b,Ts,T,m) \\ set ms\"\nshows \"P \\ C sees M,b:Ts\\T = m in C\"\n(*<*)\nproof -\n from wf C have \"class\": \"class P C = Some (S,fs,ms)\"\n by (auto simp add: wf_prog_def class_def is_class_def intro: map_of_SomeI)\n from \"class\" have \"is_class P C\" by(auto simp:is_class_def) \n with assms \"class\" show ?thesis\n by(bestsimp simp:Method_def dest:mdecls_visible)\nqed\n(*>*)\n\n\nlemma Call_lemma:\nassumes sees: \"P \\ C sees M,b:Ts\\T = m in D\" and sub: \"P \\ C' \\\\<^sup>* C\" and wf: \"wf_prog wf_md P\"\nshows \"\\D' Ts' T' m'.\n P \\ C' sees M,b:Ts'\\T' = m' in D' \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T \\ P \\ C' \\\\<^sup>* D'\n \\ is_type P T' \\ (\\T\\set Ts'. is_type P T) \\ wf_md P D' (M,b,Ts',T',m')\"\n(*<*)\nusing assms sees_method_mono[OF sub wf sees]\nby(fastforce intro:sees_method_decl_above dest:sees_wf_mdecl\n simp: wf_mdecl_def)\n(*>*)\n\n\nlemma wf_prog_lift:\n assumes wf: \"wf_prog (\\P C bd. A P C bd) P\"\n and rule:\n \"\\wf_md C M b Ts C T m bd.\n wf_prog wf_md P \\\n P \\ C sees M,b:Ts\\T = m in C \\\n set Ts \\ types P \\\n bd = (M,b,Ts,T,m) \\\n A P C bd \\\n B P C bd\"\n shows \"wf_prog (\\P C bd. B P C bd) P\"\n(*<*)\nproof -\n have \"\\c. c\\set P \\ wf_cdecl A P c \\ wf_cdecl B P c\"\n proof -\n fix c assume \"c\\set P\" and \"wf_cdecl A P c\"\n then show \"wf_cdecl B P c\"\n using rule[OF wf mdecl_visible[OF wf] is_type_pTs[OF wf]]\n by (auto simp: wf_cdecl_def wf_mdecl_def)\n qed\n then show ?thesis using wf by (clarsimp simp: wf_prog_def)\nqed\n(*>*)\n\nlemma wf_sees_clinit:\nassumes wf:\"wf_prog wf_md P\" and ex: \"class P C = Some a\"\nshows \"\\m. P \\ C sees clinit,Static:[] \\ Void = m in C\"\nproof -\n from ex obtain D fs ms where \"a = (D,fs,ms)\" by(cases a)\n then have sP: \"(C, D, fs, ms) \\ set P\" using ex map_of_SomeD[of P C a] by(simp add: class_def)\n then have \"wf_clinit ms\" using assms by(unfold wf_prog_def wf_cdecl_def, auto)\n then obtain m where sm: \"(clinit, Static, [], Void, m) \\ set ms\" by (meson wf_clinit_def)\n then have \"P \\ C sees clinit,Static:[] \\ Void = m in C\"\n using mdecl_visible[OF wf sP sm] by simp\n then show ?thesis by(rule exI)\nqed\n(*>*)\n\nlemma wf_sees_clinit1:\nassumes wf:\"wf_prog wf_md P\" and ex: \"class P C = Some a\"\nand \"P \\ C sees clinit,b:Ts \\ T = m in D\"\nshows \"b = Static \\ Ts = [] \\ T = Void \\ D = C\"\nproof -\n obtain m' where sees: \"P \\ C sees clinit,Static:[] \\ Void = m' in C\"\n using wf_sees_clinit[OF wf ex] by clarify\n then show ?thesis using sees wf by (meson assms(3) sees_method_fun)\nqed\n\nlemma wf_NonStatic_nclinit:\nassumes wf: \"wf_prog wf_md P\" and meth: \"P \\ C sees M,NonStatic:Ts\\T=(mxs,mxl,ins,xt) in D\"\nshows \"M \\ clinit\"\nproof -\n from sees_method_is_class[OF meth] obtain a where cls: \"class P C = Some a\"\n by(clarsimp simp: is_class_def)\n with wf wf_sees_clinit[OF wf cls]\n obtain m where \"P \\ C sees clinit,Static:[]\\Void=m in C\" by clarsimp\n with meth show ?thesis by(auto dest: sees_method_fun)\nqed\n\nsubsection\\ Well-formedness and field lookup \\\n\nlemma wf_Fields_Ex:\nassumes wf: \"wf_prog wf_md P\" and \"is_class P C\"\nshows \"\\FDTs. P \\ C has_fields FDTs\"\n(*<*)\nusing assms proof(induct rule:subcls1_induct)\n case Object\n then show ?case using class_Object[OF wf]\n by(blast intro:has_fields_Object)\nnext\n case Subcls\n then show ?case by(blast intro:has_fields_rec dest:subcls1D)\nqed\n(*>*)\n\n\nlemma has_fields_types:\n \"\\ P \\ C has_fields FDTs; (FD,b,T) \\ set FDTs; wf_prog wf_md P \\ \\ is_type P T\"\n(*<*)\nproof(induct rule:Fields.induct)\nqed(fastforce dest!: class_wf simp: wf_cdecl_def wf_fdecl_def)+\n(*>*)\n\nlemma sees_field_is_type:\n \"\\ P \\ C sees F,b:T in D; wf_prog wf_md P \\ \\ is_type P T\"\n(*<*)\n by (meson has_field_def has_fields_types has_visible_field map_of_SomeD)\n(*>*)\n\n\nlemma wf_syscls:\n \"set SystemClasses \\ set P \\ wf_syscls P\"\n(*<*)\nby (force simp: image_def SystemClasses_def wf_syscls_def sys_xcpts_def\n ObjectC_def NullPointerC_def ClassCastC_def OutOfMemoryC_def\n NoClassDefFoundC_def\n IncompatibleClassChangeC_def NoSuchFieldC_def NoSuchMethodC_def)\n(*>*)\n\n\nsubsection\\ Well-formedness and subclassing \\\n\nlemma wf_subcls_nCls:\nassumes wf: \"wf_prog wf_md P\" and ns: \"\\ is_class P C\"\nshows \"\\ P \\ D \\\\<^sup>* D'; D \\ C \\ \\ D' \\ C\"\nproof(induct rule: rtrancl.induct)\n case (rtrancl_into_rtrancl a b c)\n with ns show ?case by(clarsimp dest!: subcls1D wf_cdecl_supD[OF class_wf[OF _ wf]])\nqed(simp)\n\nlemma wf_subcls_nCls':\nassumes wf: \"wf_prog wf_md P\" and ns: \"\\is_class P C\\<^sub>0\"\nshows \"\\cd D'. cd \\ set P \\ \\P \\ fst cd \\\\<^sup>* C\\<^sub>0\"\nproof -\n fix cd D' assume cd: \"cd \\ set P\"\n then have cls: \"is_class P (fst cd)\" using class_exists_equiv is_class_def by blast\n with wf_subcls_nCls[OF wf ns] ns show \"\\P \\ fst cd \\\\<^sup>* C\\<^sub>0\" by(cases \"fst cd = D'\", auto)\nqed\n\nlemma wf_nclass_nsub:\n \"\\ wf_prog wf_md P; is_class P C; \\is_class P C' \\ \\ \\P \\ C \\\\<^sup>* C'\"\n by(rule notI, auto dest: wf_subcls_nCls[where C=C' and D=C])\n\nlemma wf_sys_xcpt_nsub_Start:\nassumes wf: \"wf_prog wf_md P\" and ns: \"\\is_class P Start\" and sx: \"C \\ sys_xcpts\"\nshows \"\\P \\ C \\\\<^sup>* Start\"\nproof -\n have Cns: \"C \\ Start\" using Start_nsys_xcpts sx by clarsimp\n show ?thesis using wf_subcls_nCls[OF wf ns _ Cns] by auto\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Common/WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.265344183796649}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ClosureEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory ClosureEx\nimports \"../Vcg\" \"../Simpl_Heap\" Closure\nbegin\n\n\nrecord globals =\n cnt_' :: \"ref \\ nat\"\n alloc_' :: \"ref list\"\n free_' :: \"nat\"\nrecord 'g vars = \"'g state\" +\n p_':: ref\n r_':: nat\n n_':: nat\n m_':: nat\n c_':: \"(string \\ ref) list \\ string\"\n d_':: \"(string \\ ref) list \\ string\"\n e_':: \"(string \\ nat) list \\ string\"\n\n\ndefinition \"var\\<^sub>n = [''n''\\ (\\x. n_'_update (\\_. x)),\n ''m''\\ (\\x. m_'_update (\\_. x))]\"\ndefinition \"upd\\<^sub>n = gen_upd var\\<^sub>n\"\n\nlemma upd\\<^sub>n_ap: \"upd\\<^sub>n (fst (ap es (es',p))) = upd\\<^sub>n es' \\ upd\\<^sub>n es\"\n by (simp add: upd\\<^sub>n_def gen_upd_ap)\n\n\nlemma\n\"\\\\\\\\n=n\\<^sub>0 \\ (\\i j. \\\\ \\\\n=i \\ \\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=i + j\\)\\\n \\e :== (ap [(''n'',\\n)] \\e)\n \\\\j. \\\\ \\\\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=n\\<^sub>0 + j\\\\\"\napply vcg_step\napply clarify\napply (rule ap_closure [where var=var\\<^sub>n, folded upd\\<^sub>n_def])\napply clarsimp\napply (rename_tac s s')\napply (erule_tac x=\"n_' s\" in allE)\napply (erule_tac x=\"m_' s'\" in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply (simp add: upd\\<^sub>n_def gen_upd_def var\\<^sub>n_def)\ndone\n\n\ndefinition \"var = [''p''\\ (\\x. p_'_update (\\_. x))]\"\ndefinition \"upd = gen_upd var\"\n\nprocedures Inc(p|r) =\n \"\\p\\\\cnt :== \\p\\\\cnt + 1;;\n \\r :== \\p\\\\cnt\"\n\nlemma (in Inc_impl)\n \"\\i p. \\\\ \\\\p\\\\cnt = i\\ \\r :== PROC Inc(\\p) \\\\r=i+1 \\ \\p\\\\cnt = i+1\\\"\n apply vcg\n apply simp\n done\n\nprocedures (imports Inc_signature) NewCounter(|c) =\n\"\\p :== NEW 1 [\\cnt :== 0];;\n \\c :== ([(''p'',\\p)],Inc_'proc)\"\n\n\nlocale NewCounter_impl' = NewCounter_impl + Inc_impl\nlemma (in NewCounter_impl')\nshows\n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter()\n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\n\nshows\n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter()\n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\nshows NewCounter_spec:\n \"\\alloc. \\\\ \\1 \\ \\free \\ \\alloc=alloc\\ \\c :== PROC NewCounter()\n \\\\p. p \\ set alloc \\ p \\ set \\alloc \\ p \\ Null \\ p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply clarsimp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\n\n\nlemma \"\\\\\\\\p. p \\ Null \\ p\\\\cnt = i \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=i+1\\\"\napply (rule conseq_extract_pre)\napply clarify\napply (rule dynCallClosureFix)\napply (simp only: Ball_def)\nprefer 3\napply (assumption)\nprefer 2\napply vcg_step\napply vcg_step\napply (simp only: simp_thms)\napply clarsimp\ndone\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\\n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=1\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (erule_tac x=0 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply simp\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\\n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\r_' := r_' t\\));;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=2\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\n\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\\n \\c :== CALL NewCounter ();;\n \\d :== \\c;;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\n_' := r_' t\\));;\n dynCallClosure (\\s. s) upd d_' (\\s t. s\\globals := globals t\\)\n (\\s t. Basic (\\u. u\\m_' := r_' t\\));;\n \\r :== \\n + \\m\n \\\\r=3\\\"\n\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/ClosureEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.265344183796649}} {"text": "theory PhiSem_Mem_OO\n imports PhiSem_OO_Class_Algebra\nbegin\n\nchapter \\Object Oriented Programming Model\\\n\nsection \\Semantics & Fictions\\\n\nsubsection \\Models\\\n\n(*not ready to use*)\n\nsubsubsection \\Type\\\n\nvirtual_datatype \\OO_ty =\n T_ref :: unit\n\ndebt_axiomatization T_ref :: \\unit type_entry\\\n where \\OO_ty_ax: \\\\OO_ty TY_CONS_OF T_ref\\\n\ninterpretation \\OO_ty TY_CONS_OF \\TYPE(TY_N)\\ \\TYPE(TY)\\ T_ref using \\OO_ty_ax .\n\n(*does user really need to input the semantic type manually?*)\nabbreviation \\reference \\ T_ref.mk ()\\\n\n\nsubsubsection \\Value\\\n\ndeclare [[typedef_overloaded]]\n\ndatatype object_ref = object_ref (\"class\": \\class\\) (\"instance_id\": nat) | Nil\nhide_const (open) \"class\" instance_id\n\nlemma object_ref_all:\n \\All P \\ (\\cls i. P (object_ref cls i)) \\ P Nil\\\n by (metis object_ref.exhaust)\n\nlemma object_ref_ex:\n \\Ex P \\ (\\cls i. P (object_ref cls i)) \\ P Nil\\\n by (metis object_ref.exhaust)\n\n\ndeclare [[typedef_overloaded = false]]\n\n\nparagraph \\Properties\\\n\nprimrec of_class\n where \\of_class cls (object_ref cls' _) \\ cls = cls'\\\n | \\of_class _ Nil \\ True\\\n\ninstantiation object_ref :: zero begin\ndefinition \\zero_object_ref = Nil\\\ninstance ..\nend\n\n\nparagraph \\The Model\\\n\nvirtual_datatype \\OO_val =\n V_ref :: \\object_ref\\\n\ndebt_axiomatization V_ref :: \\object_ref value_entry\\\n where \\OO_val_ax: \\\\OO_val VAL_CONS_OF V_ref\\\n\ninterpretation \\OO_val VAL_CONS_OF \\TYPE(VAL_N)\\ \\TYPE(VAL)\\ V_ref using \\OO_val_ax .\n\ndebt_axiomatization\n WT_ref[simp]: \\Well_Type reference = UNIV\\\n and zero_ref[simp]: \\Zero reference = Some (V_ref.mk Nil)\\\n and Can_EqCompare_ref[simp]: \\Can_EqCompare res (V_ref.mk ref1) (V_ref.mk ref2)\\\n and EqCompare_ref[simp]: \\EqCompare (V_ref.mk ref1) (V_ref.mk ref2) \\ ref1 = ref2\\\n\n\n\nsubsubsection \\Resource\\\n\ntype_synonym object_heap = \\(object_ref \\ field_name \\ VAL nosep option)\\\n\ndefinition \\Valid_Objs = {h::object_heap. h Nil = 1} \\ {h. finite (dom1 h)}\n \\ {h. (\\cls id. dom (h (object_ref cls id)) = {} \\\n dom (h (object_ref cls id)) = dom (class.fields_of cls) ) }\\\n\nlemma In_Valid_Objs[simp]:\n \\h \\ Valid_Objs \\ h Nil = 1 \\ finite (dom1 h) \\\n ((\\cls id. dom (h (object_ref cls id)) = {} \\ dom (h (object_ref cls id)) = dom (class.fields_of cls) ))\\\n unfolding Valid_Objs_def by simp\n\nresource_space \\OO =\n Objs :: \\Valid_Objs\\ (partial_map_resource2)\n by (standard; simp)\n\nlemma objref_infinite_cls:\n \\infinite {a. a \\ Nil \\ object_ref.class a = cls}\\\n using inj_on_finite[where A = \\UNIV::nat set\\ and B = \\{a. a \\ Nil \\ object_ref.class a = cls}\\\n and f = \\\\n. object_ref cls n\\]\n using inj_def by fastforce\n\nlemma Sep_Closed_Valid_Objs[simp]:\n \\Sep_Closed Valid_Objs\\\n unfolding Valid_Objs_def\n apply (rule Sep_Closed_inter, rule Sep_Closed_inter)\n apply (simp add: Sep_Closed_def times_fun)\n apply simp\n apply simp\n apply (rule Sep_Closed_pointwise[where P=\\\\k v.\n case k of object_ref cls i \\ dom v = {} \\ dom v = dom (class.fields_of cls)\n | _ \\ True\\,\n simplified object_ref_all, simplified])\n apply (clarsimp simp add: dom_mult one_partial_map[symmetric])\n by (metis dom_1 sup.idem sup_bot.right_neutral sup_commute)\n\n\n(*\nlemma Valid_Objs_1[simp]: \\1 \\ Valid_Objs\\\n unfolding Valid_Objs_def one_fun_def by (simp add: dom1_def one_fun_def)\n*)\n\nlemma obj_map_freshness:\n \\finite (dom1 f) \\ \\k. f k = 1 \\ k \\ Nil \\ object_ref.class k = cls\\\n unfolding dom1_def\n by (metis (mono_tags, lifting) finite_subset mem_Collect_eq objref_infinite_cls subsetI)\n\n\n\nfiction_space \\OO_fic =\n OO_share :: RES.Objs.share_fiction (share_fiction_for_partial_mapping_resource2 RES.Objs) ..\n\nlemma \"__case_prod_ref_field__\":\n \\(\\(x, y). (1(ref := 1(field \\ n \\ v))) x y) = 1((ref,field) \\ n \\ v)\\\n unfolding fun_eq_iff by simp\n\n\nsection \\\\Types\\\n\nsubsection \\Reference\\\n\n(*Do we really need the class annotation here?*)\n\ndefinition Ref :: \\class \\ (VAL, object_ref) \\\\\n where \\Ref cls ref = ({ V_ref.mk ref } \\\\\\\\ of_class cls ref)\\\n\nlemma \\Ref_expns[\\expns]:\n \\v \\ (ref \\ Ref cls) \\ v = V_ref.mk ref \\ of_class cls ref\\\n unfolding Ref_def \\Type_def by (simp add: \\expns)\n\nlemma \\Ref_inhabited[\\inhabitance_rule, elim!]:\n \\Inhabited (ref \\ Ref cls) \\ (of_class cls ref \\ C) \\ C\\\n unfolding Inhabited_def by (simp add: \\expns)\n\nlemma \\Ref_zero[\\reason 1000]:\n \\\\Zero reference (Ref cls) Nil\\\n unfolding \\Zero_def by (simp add: \\expns)\n\nlemma \\Ref_eq[\\reason 1000]:\n \\\\Equal (Ref cls) (\\_ _. True) (=)\\\n unfolding \\Equal_def by (simp add: \\expns)\n\nlemma \\Ref_semty[\\reason 1000]:\n \\\\SemType (ref \\ Ref cls) reference\\\n unfolding \\SemType_def by (simp add: \\expns)\n\n\nsubsection \\Object\\\n\nparagraph \\Fields in A Object\\\n\nnotation FIC.OO_share.\\ (\"obj: _\" [52] 51)\n\nsection \\Instructions\\\n\nparagraph \\Reference Value\\\n\n(* definition \\\\M_getV_ref v F = \\M_getV reference V_ref.dest v F\\ *)\n\nparagraph \\Allocation\\\n\ndefinition initial_value_of_class\n where \\initial_value_of_class cls = map_option (map_nosep (the o Zero)) o class.fields_of cls\\\n\nlemma dom_initial_value_of_class:\n \\dom (initial_value_of_class cls) = dom (class.fields_of cls)\\\n unfolding initial_value_of_class_def dom_def set_eq_iff by simp\n\ndefinition op_obj_allocate :: \\class \\ VAL proc\\\n where \\op_obj_allocate cls =\n RES.Objs.\\R_allocate_res_entry (\\ref. ref \\ Nil \\ object_ref.class ref = cls)\n (initial_value_of_class cls) (\\ref. Return (\\arg (V_ref.mk ref)))\\\n\n\nparagraph \\Load Field\\\n\ndefinition op_obj_load_field :: \\field_name \\ TY \\ (VAL,VAL) proc'\\\n where \\op_obj_load_field field TY v =\n \\M_getV reference V_ref.dest v (\\ref.\n RES.Objs.\\R_get_res_entry ref field (\\v.\n \\M_assert (nosep.dest v \\ Well_Type TY) \\\n Return (\\arg (nosep.dest v))))\\\n\n\nparagraph \\Store Field\\\n\ndefinition op_obj_store_field :: \\field_name \\ TY \\ (VAL \\ VAL, unit) proc'\\\n where \\op_obj_store_field field TY =\n \\M_caseV (\\vstore vref.\n \\M_getV TY id vstore (\\store.\n \\M_getV reference V_ref.dest vref (\\ref.\n RES.Objs.\\R_get_res_entry ref field (\\v. \\M_assert (nosep.dest v \\ Well_Type TY))\n \\ RES.Objs.\\R_set_res (map_fun_at (map_fun_at (\\_. Some (nosep store)) field) ref)\n)))\\\n\nparagraph \\Dispose\\\n\ndefinition op_obj_dispose :: \\class \\ (VAL, unit) proc'\\\n where \\op_obj_dispose cls vref =\n \\M_getV reference V_ref.dest vref (\\ref.\n RES.Objs.\\R_get_res (\\m.\n \\M_assert ((ref \\ dom1 m \\ class.fields_of cls = 1) \\ object_ref.class ref = cls))\n \\ RES.Objs.\\R_set_res (\\f. f(ref := 1))\n)\\\n\n\nsection \\Specification of Instructions\\\n\nparagraph \\Reference Value\\\n\nlemma \\M_getV_ref:\n \\ (of_class cls ref \\ \\

\\\\\\ F ref \\ X \\ Y \\ \\\\\\\\\\\\ E)\n\\ \\

\\\\\\ \\M_getV reference V_ref.dest raw F \\ X\\ ref \\ Val raw (Ref cls) \\ Y \\ \\\\\\\\\\\\ E\\\n by (cases raw; simp; rule; simp add: \\expns)\n\n\nparagraph \\Allocation\\\n\nlemma op_obj_allocate:\n \\\\

\\\\\\ op_obj_allocate cls\n \\ Void \\ \\ret. \\*ref. to_share o initial_value_of_class cls \\ obj: ref \\<^bold>\\ Identity\\ ref \\ Val ret (Ref cls) \\\\\n unfolding \\Procedure_Hybrid_DL op_obj_allocate_def\n apply (clarsimp simp add: \\expns del: subsetI)\n apply (rule RES.Objs.\\R_allocate_res_entry)\n apply (clarsimp)\n using obj_map_freshness apply blast\n \n apply (clarsimp simp add: one_fun_def dom_initial_value_of_class)\n\n prefer 2 apply assumption\n\n apply (simp add: \\expns Return_def det_lift_def del: set_mult_expn)\n subgoal premises prems for r res k res' proof -\n have t: \\of_class cls k\\\n by (metis object_ref.collapse of_class.simps(1) prems(3))\n show ?thesis\n using t FIC.OO_share.expand[where x=\\1(k := initial_value_of_class cls)\\, simplified] prems\n using FIC.OO_share.sep_disj_fiction by fastforce\n qed .\n\nparagraph \\Load Field\\\n\nlemma op_obj_load_field_raw_\\app:\n \\ \\

\\\\\\\\\\\\ v \\ Well_Type TY\n\\ \\

\\\\\\ op_obj_load_field field TY raw \\\n nosep v \\ obj: ref \\<^bold>\\ field \\<^bold>\\ n \\ \\ Identity \\ ref \\ \\\\\\[raw] (Ref cls)\n \\ nosep v \\ obj: ref \\<^bold>\\ field \\<^bold>\\ n \\ \\ Identity \\ \\\\\\ v \\ Identity\n\\\\\n unfolding op_obj_load_field_def Premise_def\n by (rule \\M_getV_ref, rule, rule \\SEQ, rule \\M_assert, simp, rule, simp add: Identity_expn)\n\nproc (nodef) op_obj_load_field:\n assumes A: \\\\SemType (x \\ T) TY\\\n input \\x \\ obj: ref \\<^bold>\\ field \\<^bold>\\ n \\ \\ T \\ ref \\ Val raw (Ref cls)\\\n output \\x \\ obj: ref \\<^bold>\\ field \\<^bold>\\ n \\ \\ T \\ \\\\\\ x \\ T\\\n \\ \\obj: _\\ to Identity \\v\n have [simp]: \\v \\ Well_Type TY\\ using A[unfolded \\SemType_def subset_iff] \\ by blast \n ;; $ref op_obj_load_field_raw[where TY=TY]\n \\ by (simp add: Nosep_expns the_\\lemmata) .\n \n\nparagraph \\Store Field\\\n\nlemma op_obj_store_field_raw_\\app:\n \\ \\

\\\\\\\\\\\\ v \\ Well_Type TY\n\\ \\

\\\\\\\\\\\\ u \\ Well_Type TY\n\\ \\

\\\\\\ op_obj_store_field field TY (\\V_pair rawu rawref) \\\n nosep v \\ obj: ref \\<^bold>\\ field \\<^bold>\\ \\ Identity \\ ref \\ Val rawref (Ref cls)\\ u \\ Val rawu Identity\n \\ nosep u \\ obj: ref \\<^bold>\\ field \\<^bold>\\ \\ Identity\n\\\\\n unfolding op_obj_store_field_def Premise_def\n apply (cases rawref; cases rawu; simp, rule, rule, simp add: Identity_expn Premise_def,\n rule \\M_getV_ref, rule, rule, rule \\M_assert, simp, simp add: Identity_expn)\n apply (rule FIC.OO_share.\\R_set_res[where P=\"\\m. field \\ dom (m ref)\"])\n apply (cases ref; clarsimp simp add: map_fun_at_def dom1_def)\n apply (smt (verit, del_insts) Collect_cong dom_1 dom_eq_empty_conv insert_dom option.distinct(1))\n using RES.Objs.raw_unit_assertion_implies by blast\n\n\nproc (nodef) op_obj_store_field:\n assumes A: \\\\SemType (x \\ T) TY\\\n assumes B: \\\\SemType (y \\ U) TY\\\n input \\x \\ obj: ref \\<^bold>\\ field \\<^bold>\\ \\ T \\ \\\\\\ ref \\ Ref cls \\ \\\\\\ y \\ U\\\n output \\y \\ obj: ref \\<^bold>\\ field \\<^bold>\\ \\ U\\\n \\ to Identity \\u\n \\obj: _\\ to Identity \\v\n op_obj_store_field_raw[where TY=TY]\n affirm using A[unfolded \\SemType_def subset_iff] \\ by blast ;;\n affirm using B[unfolded \\SemType_def subset_iff] \\ by blast\n \\ by (simp add: Nosep_expns the_\\lemmata) .\n\n\nparagraph \\Dispose\\\n\nlemma op_obj_dispose:\n \\ \\

\\\\\\\\\\\\ ref \\ Nil\n\\ \\

\\\\\\\\\\\\ dom fields = dom (class.fields_of cls)\n\\ \\

\\\\\\ op_obj_dispose cls rawv\n \\ to_share o fields \\ obj: ref \\<^bold>\\ Identity \\ ref \\ Val rawv (Ref cls) \\ \\ret. Void \\\\\n unfolding op_obj_dispose_def Premise_def\n apply (rule \\M_getV_ref)\n apply (rule \\SEQ[where B=\\\\_. to_share \\ fields \\ obj: ref \\<^bold>\\ Identity\\])\n apply (clarsimp simp add: \\expns zero_set_def \\Procedure_Hybrid_DL del: subsetI)\n apply (rule RES.Objs.\\R_get_res, simp, simp add: dom1_def)\n subgoal premises prems for r res proof -\n have t1: \\object_ref.class ref = cls\\\n by (metis object_ref.collapse of_class.simps(1) prems(1) prems(3))\n have t3: \\fields = Map.empty \\ class.fields_of cls = Map.empty\\ \n subgoal premises prem proof -\n have \\dom fields = {}\\ by (simp add: prem)\n then have \\dom (class.fields_of cls) = {}\\ using prems(2) by simp\n then show ?thesis by fastforce\n qed .\n have t4: \\r ## FIC.OO_share.mk (1(ref := to_share \\ fields))\\\n using prems(6) by blast\n have t2: \\RES.Objs.get res ref = 1 \\ class.fields_of cls = 1\\\n unfolding one_fun_def one_option_def\n apply (cases \\fields = Map.empty\\)\n using t3 apply blast\n using FIC.OO_share.partial_implies[where x=\\1(ref := fields)\\ and n=1, simplified,\n OF \\r \\ FIC.SPACE\\, OF t4, OF \\\\\\\\\\\\ res \\\\ _\\]\n nonsepable_partial_map_subsumption_L2\n by (metis domIff map_le_def)\n show ?thesis by (simp add: t1 t2 prems Return_def det_lift_def)\n qed\n apply (rule FIC.OO_share.\\R_dispose_res[where P=\\\\_. True\\])\n apply (clarsimp simp add: one_fun_def)\n apply (cases ref; simp)\n using RES.Objs.get_res_Valid[simplified Valid_Objs_def, simplified]\n RES.Objs.raw_unit_assertion_implies'[where f=fields]\n by (smt (z3) domIff map_le_antisym map_le_def)\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics/PhiSem_Mem_OO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558603, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.26532845047081294}} {"text": "theory Old_Tau_Chain\n imports Old_Semantics \"NewPsi.Tau_Chain\"\nbegin\n\ncontext old_psi begin\n\nabbreviation old_tau_chain :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\<^sup>^\\<^sub>\\\\<^sub>O _\" [80, 80, 80] 80)\nwhere \"\\ \\ P \\\\<^sup>^\\<^sub>\\\\<^sub>O P' \\ (P, P') \\ {(P, P'). \\ \\ P \\\\<^sub>O \\ \\ P'}^*\"\n\nabbreviation old_tau_step_chain :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\<^sub>\\\\<^sub>O _\" [80, 80, 80] 80)\nwhere \"\\ \\ P \\\\<^sub>\\\\<^sub>O P' \\ (P, P') \\ {(P, P'). \\ \\ P \\\\<^sub>O \\ \\ P'}^+\"\n\nabbreviation old_tau_context_chain :: \"('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\\\<^sup>^\\<^sub>\\\\<^sub>O _\" [80, 80] 80)\nwhere \"P \\\\<^sup>^\\<^sub>\\\\<^sub>O P' \\ \\ \\ P \\\\<^sup>^\\<^sub>\\\\<^sub>O P'\"\nabbreviation old_tau_context_step_chain :: \"('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\\\<^sub>\\\\<^sub>O _\" [80, 80] 80)\nwhere \"P \\\\<^sub>\\\\<^sub>O P' \\ \\ \\ P \\\\<^sub>\\\\<^sub>O P'\"\n\nlemmas tau_chain_induct[consumes 1, case_names tau_base tau_step] = rtrancl.induct[of _ _ \"{(P, P'). \\ \\ P \\None @ \\ \\ P'}\", simplified] for \\\nlemmas tau_step_chain_induct[consumes 1, case_names tau_base tau_step] = trancl.induct[of _ _ \"{(P, P'). \\ \\ P \\None @ \\ \\ P'}\", simplified] for \\\n\ndefinition old_weak_transition :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ 'a action \\ ('a, 'b, 'c) psi \\ bool\" (\"_ : _ \\ _ \\\\<^sub>O _ \\ _\" [80, 80, 80, 80, 80] 80)\nwhere\n \"\\ : Q \\ P \\\\<^sub>O \\ \\ P' \\ \\P''. \\ \\ P \\\\<^sup>^\\<^sub>\\\\<^sub>O P'' \\ (insert_assertion (extract_frame Q) \\) \\\\<^sub>F (insert_assertion (extract_frame P'') \\) \\\n \\ \\ P'' \\\\<^sub>O \\ \\ P'\"\n\nlemma old_tau_chain_new:\n shows \"\\ \\ P \\\\<^sup>^\\<^sub>\\\\<^sub>O P' = \\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n by(rule Set.eqset_imp_iff)\n (metis old_semantics_tau_sound old_semantics_complete)\n\nlemma old_tau_step_chain_new:\n shows \"\\ \\ P \\\\<^sub>\\\\<^sub>O P' = \\ \\ P \\\\<^sub>\\ P'\"\n by(rule Set.eqset_imp_iff)\n (metis old_semantics_tau_sound old_semantics_complete)\n\nlemma old_weak_transition_sound:\n assumes \"\\ : Q \\ P \\\\<^sub>O \\ \\ P'\"\n shows \"\\\\. \\ : Q \\ P \\ \\ @ \\ \\ P'\"\n using assms\n by(force simp add: old_weak_transition_def weak_transition_def\n old_tau_chain_new old_tau_step_chain_new\n dest: old_semantics_sound)\n\nlemma old_weak_transition_tau_sound:\n assumes \"\\ : Q \\ P \\\\<^sub>O \\ \\ P'\"\n shows \"\\ : Q \\ P \\ None @ \\ \\ P'\"\n using assms\n by(force simp add: old_weak_transition_def weak_transition_def\n old_tau_chain_new old_tau_step_chain_new\n dest: old_semantics_tau_sound)\n\nlemma old_weak_transition_complete:\n assumes \"\\ : Q \\ P \\ \\ @ \\ \\ P'\"\n shows \"\\ : Q \\ P \\\\<^sub>O \\ \\ P'\"\n using assms\n by(force simp add: old_weak_transition_def weak_transition_def\n old_tau_chain_new old_tau_step_chain_new\n dest: old_semantics_complete)\n\nend\n\nend", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Old_Tau_Chain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2653284381789743}} {"text": "theory newParallel\n imports ContinuousInv BigStepParallel Complementlemma\n\nbegin\n\n\ninductive out_inv_assn :: \"(gstate \\ bool) \\ (gstate \\ real \\ bool) \\ cname \\ tassn\" (\"Outinv\\<^sub>t\") where\n \"r s \\ g s v \\ Outinv\\<^sub>t r g ch [OutBlock ch v]\"\n| \"(d::real) > 0 \\ r s \\ g s v \\ Outinv\\<^sub>t r g ch [WaitBlk (ereal d) (\\_. s) ({ch}, {}), OutBlock ch v]\"\n| \"r s \\Outinv\\<^sub>t r g ch [WaitBlk \\ (\\_. s) ({ch}, {})]\"\n\ninductive in_inv_assn :: \"(gstate \\ bool) \\ (gstate \\ real \\ bool) \\ cname \\ tassn\" (\"Ininv\\<^sub>t\") where\n \"r s \\ g s v\\ Ininv\\<^sub>t r g ch [InBlock ch v]\"\n| \"(d::real) > 0 \\ r s \\ g s v \\ Ininv\\<^sub>t r g ch [WaitBlk (ereal d) (\\_. s) ({}, {ch}), InBlock ch v]\"\n| \"r s \\ Ininv\\<^sub>t r g ch [WaitBlk \\ (\\_. s) ({}, {ch})]\"\n\ninductive io_inv_assn :: \"(gstate \\ bool) \\ (gstate \\ real \\ bool) \\ cname \\ tassn\" (\"IOinv\\<^sub>t\") where\n \"r s \\ g s v \\ IOinv\\<^sub>t r g ch [IOBlock ch v]\"\n\ninductive wait_inv_assn :: \"(gstate \\ real \\ bool) \\ (real \\ bool) \\ rdy_info \\ tassn\" (\"Waitinv\\<^sub>t\") where\n \"dp 0 \\ Waitinv\\<^sub>t r dp rdy []\"\n| \"d > 0 \\ dp d \\ (\\t\\{0..d}. r (p t) t) \\ Waitinv\\<^sub>t r dp rdy [WaitBlk (ereal d) p rdy]\" \n\ninductive wait_out_inv_assn ::\"(gstate \\ real \\ bool) \\ (real \\ bool) \\ (gstate \\ real \\ bool) \n \\ rdy_info \\ cname \\ tassn\" (\"WaitOutinv\\<^sub>t\") where\n \"dp 0 \\ \\ s. r s 0 \\ g s v \\ WaitOutinv\\<^sub>t r dp g rdy ch [OutBlock ch v]\"\n| \"d > 0 \\ dp d \\ (\\t\\{0..d}. r (p t) t) \\ g (p d) v \n \\ WaitOutinv\\<^sub>t r dp g rdy ch [WaitBlk (ereal d) p rdy, OutBlock ch v]\"\n\ninductive sb2gsb :: \"(state \\ bool) \\ (gstate \\ bool)\" where\n \"p s \\ sb2gsb p (State s)\"\n\ninductive srb2gsrb :: \"(state \\ real \\ bool) \\ (gstate \\ real \\ bool)\" where\n \"p s v \\ srb2gsrb p (State s) v\"\n\ninductive pgsb2gsb :: \"(gstate \\ bool) \\ (gstate \\ bool) \\ (gstate \\ bool)\" where\n \"r1 s \\ r2 s' \\ pgsb2gsb r1 r2 (ParState s s') \"\n\ninductive pgsrb2gsrb :: \"(gstate \\ real \\ bool) \\ (gstate \\ real \\ bool) \\ (gstate \\ real \\ bool)\" where\n \"r1 s v \\ r2 s' v \\ pgsrb2gsrb r1 r2 (ParState s s') v\"\n\ninductive gsb2gsrb :: \"(gstate \\ bool) \\ (gstate \\ real \\ bool)\" where\n \"r s \\ gsb2gsrb r s t\"\n\nlemma combine_assn_emp_ininv:\n \"ch \\ chs \\ combine_assn chs emp\\<^sub>t (Ininv\\<^sub>t r g ch @\\<^sub>t P) = false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: in_inv_assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_ininv_emp:\n \"ch \\ chs \\ combine_assn chs (Ininv\\<^sub>t r g ch @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: in_inv_assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_emp_outinv:\n \"ch \\ chs \\ combine_assn chs emp\\<^sub>t (Outinv\\<^sub>t r g ch @\\<^sub>t P) = false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: out_inv_assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_outinv_emp:\n \"ch \\ chs \\ combine_assn chs (Outinv\\<^sub>t r g ch @\\<^sub>t P) emp\\<^sub>t= false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: out_inv_assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_ininv_outinv:\n \"ch \\ chs \\\n combine_assn chs (Ininv\\<^sub>t r1 g1 ch @\\<^sub>t P) (Outinv\\<^sub>t r2 g2 ch @\\<^sub>t Q) \\\\<^sub>t\n (IOinv\\<^sub>t (pgsb2gsb r1 r2) (pgsrb2gsrb g1 g2) ch @\\<^sub>t combine_assn chs P Q)\"\n unfolding combine_assn_def\n apply (auto simp add: entails_tassn_def join_assn_def pure_assn_def conj_assn_def io_inv_assn.simps\n out_inv_assn.simps in_inv_assn.simps pgsb2gsb.simps pgsrb2gsrb.simps)\n apply (auto elim: sync_elims)\n subgoal for tr tr1 tr2 s1 v1 s2 v2\n apply(rule exI[where x= \"[IOBlock ch v1]\"])\n apply auto\n apply(rule exI[where x= \"ParState s1 s2\"])\n using combine_blocks_pairE apply blast\n by (meson combine_blocks_pairE)\n done\n\nlemma combine_assn_emp_waitinv:\n \"combine_assn chs emp\\<^sub>t (Waitinv\\<^sub>t p dp rdy @\\<^sub>t P) \\\\<^sub>t combine_assn chs emp\\<^sub>t P\"\n unfolding combine_assn_def\n apply (auto simp add: entails_tassn_def wait_inv_assn.simps emp_assn_def \njoin_assn_def false_assn_def)\n by (auto elim: sync_elims)\n\nlemma combine_assn_waitinv_emp:\n \"combine_assn chs (Waitinv\\<^sub>t p dp rdy @\\<^sub>t P) emp\\<^sub>t \\\\<^sub>t combine_assn chs P emp\\<^sub>t\"\n unfolding combine_assn_def\n apply (auto simp add: entails_tassn_def wait_inv_assn.simps emp_assn_def \njoin_assn_def false_assn_def)\n by (auto elim: sync_elims)\n\nlemma combine_assn_waitinv_ininv:\n assumes \"ch \\ chs\"\n and \"compat_rdy rdy1 ({}, {ch})\"\n shows \"combine_assn chs (Waitinv\\<^sub>t r1 dp rdy1 @\\<^sub>t P) (Ininv\\<^sub>t r2 g ch @\\<^sub>t Q) \\\\<^sub>t\n (Waitinv\\<^sub>t (pgsrb2gsrb r1 (gsb2gsrb r2)) dp (merge_rdy rdy1 ({}, {ch})) @\\<^sub>t\n combine_assn chs P (Ininv\\<^sub>t r2 g ch @\\<^sub>t Q))\"\nproof-\n have *:\"(Waitinv\\<^sub>t (pgsrb2gsrb r1 (gsb2gsrb r2)) dp (merge_rdy rdy1 ({}, {ch})) @\\<^sub>t\n combine_assn chs P (Ininv\\<^sub>t r2 g ch @\\<^sub>t Q)) tr\" if\n \"(Waitinv\\<^sub>t r1 dp rdy1 @\\<^sub>t P) tr1\" \"(Ininv\\<^sub>t r2 g ch @\\<^sub>t Q) tr2\" \n \"combine_blocks chs tr1 tr2 tr\" for tr tr1 tr2\n proof-\n from that(1)[unfolded join_assn_def]\n obtain tr11 tr12 where a: \"Waitinv\\<^sub>t r1 dp rdy1 tr11\" \"P tr12\" \"tr1 = tr11 @ tr12\"\n by auto\n from that(2)[unfolded join_assn_def]\n obtain tr21 tr22 where b: \"Ininv\\<^sub>t r2 g ch tr21\" \"Q tr22\" \"tr2 = tr21 @ tr22\"\n by auto\n have d:\"(Waitinv\\<^sub>t (pgsrb2gsrb r1 (gsb2gsrb r2)) dp (merge_rdy rdy1 ({}, {ch})) @\\<^sub>t\n combine_assn chs P (Ininv\\<^sub>t r2 g ch @\\<^sub>t Q)) tr\" if \n \"0 < d2\" \"0_. s) ({}, {ch}) # InBlock ch v # tr22) tr\" \n \"\\t\\{0..d}. r1 (p t) t\"\n \"r2 s \" \"g s v \"\n for d p s v d2\n proof -\n have \"d < d2 \\ d = d2 \\ d > d2\" by auto\n then show ?thesis\n proof (elim disjE)\n assume d1: \"d < d2\"\n have d1': \"ereal d < ereal d2\"\n using d1 by auto\n show ?thesis\n using that(4)\n apply (elim combine_blocks_waitE3)\n apply (rule that(2)) apply (rule d1') using assms(2) apply simp\n subgoal for blks'\n apply (subst join_assn_def)\n apply (rule exI[where x=\"[WaitBlk d (\\t. ParState (p t) s) (merge_rdy rdy1 ({}, {ch}))]\"])\n apply (rule exI[where x=blks'])\n apply (rule conjI)\n subgoal \n apply(auto simp add:wait_inv_assn.simps pgsrb2gsrb.simps gsb2gsrb.simps)\n apply(rule exI[where x=\"d\"])\n apply(rule exI[where x=\"(\\t. ParState (p t) s)\"])\n using that by auto\n apply (rule conjI)\n prefer 2 subgoal using d1 by auto\n unfolding combine_assn_def\n apply (rule exI[where x=tr12])\n apply (rule exI[where x=\"WaitBlk (d2 - d) (\\_. s) ({}, {ch}) # InBlock ch v # tr22\"])\n apply (rule conjI)\n subgoal by (rule a(2))\n apply (rule conjI)\n prefer 2 subgoal by auto\n apply (subst join_assn_def)\n apply (rule exI[where x=\"[WaitBlk (d2 - d) (\\_. s) ({}, {ch}), InBlock ch v]\"])\n apply (rule exI[where x=tr22])\n using b(2) d1 that by (auto intro: in_inv_assn.intros)\n done\n next\n assume d2: \"d = d2\"\n show ?thesis\n using that(4) unfolding d2[symmetric]\n apply (elim combine_blocks_waitE2)\n using assms(2) apply simp\n subgoal for blks'\n apply (subst join_assn_def)\n apply (rule exI[where x=\"[WaitBlk d (\\t. ParState (p t) s) (merge_rdy rdy1 ({}, {ch}))]\"])\n apply (rule exI[where x=blks'])\n apply (rule conjI)\n subgoal using that apply (auto simp add: wait_inv_assn.simps pgsrb2gsrb.simps gsb2gsrb.simps)\n by blast\n apply (rule conjI)\n prefer 2 subgoal by auto\n unfolding combine_assn_def\n apply (rule exI[where x=tr12])\n apply (rule exI[where x=\"InBlock ch v # tr22\"])\n apply (rule conjI)\n subgoal using a(2) by auto\n apply (rule conjI)\n subgoal apply (subst join_assn_def)\n apply (rule exI[where x=\"[InBlock ch v]\"])\n apply (rule exI[where x=tr22])\n by (auto intro: in_inv_assn.intros b(2) that)\n by auto\n done\n next\n assume d3: \"d > d2\"\n have d3': \"ereal d > ereal d2\"\n using d3 by auto\n show ?thesis\n using that(4)\n apply (elim combine_blocks_waitE4)\n apply (rule that(1)) apply (rule d3')\n using assms(2) apply simp\n apply (elim combine_blocks_pairE2')\n using assms by auto\n qed\n qed\n have e: \"(Waitinv\\<^sub>t (pgsrb2gsrb r1 (gsb2gsrb r2)) dp (merge_rdy rdy1 ({}, {ch})) @\\<^sub>t\n combine_assn chs P (Ininv\\<^sub>t r2 g ch @\\<^sub>t Q)) tr\" if \n \"combine_blocks chs (WaitBlk (ereal d) p rdy1 # tr12)\n (WaitBlk \\ (\\_. s) ({}, {ch}) # tr22) tr\" \"0 < d \" \"dp d\" \n \"\\t\\{0..d}. r1 (p t) t\" \"r2 s\" for d p s\n proof -\n have e1: \"\\ - ereal d = \\\"\n by auto\n show ?thesis\n using that\n apply (elim combine_blocks_waitE3)\n apply auto using assms(2) apply simp\n subgoal for blks'\n apply (subst join_assn_def)\n apply (rule exI[where x=\"[WaitBlk d (\\t. ParState (p t) s) (merge_rdy rdy1 ({}, {ch}))]\"])\n apply (rule exI[where x=blks'])\n apply (rule conjI)\n subgoal apply(simp add: wait_inv_assn.simps pgsrb2gsrb.simps gsb2gsrb.simps) by blast\n apply (rule conjI)\n prefer 2 apply simp\n unfolding combine_assn_def\n apply (rule exI[where x=tr12])\n apply (rule exI[where x=\"WaitBlk \\ (\\_. s) ({}, {ch}) # tr22\"])\n apply (rule conjI)\n subgoal by (rule a(2))\n apply (rule conjI)\n prefer 2 apply auto\n apply (subst join_assn_def)\n apply (rule exI[where x=\"[WaitBlk \\ (\\_. s) ({}, {ch})]\"])\n apply (rule exI[where x=tr22])\n using b(2) apply (auto intro: in_inv_assn.intros)\n done\n done\n qed\n show ?thesis\n using a(1) apply (cases rule: wait_inv_assn.cases)\n using b(1) apply (cases rule: in_inv_assn.cases)\n subgoal for s v\n apply(auto simp add: combine_assn_def join_assn_def)\n apply(rule exI[where x= \"[]\"])\n apply (auto simp add: wait_inv_assn.simps)\n apply(rule exI[where x= \"tr12\"])\n apply (auto simp add: a)\n apply(rule exI[where x= \"tr2\"])\n apply auto\n apply(rule exI[where x= \"tr21\"])\n apply auto\n using b apply auto\n using that a b by auto\n subgoal for d s v\n apply(auto simp add: combine_assn_def join_assn_def)\n apply(rule exI[where x= \"[]\"])\n apply (auto simp add: wait_inv_assn.simps)\n apply(rule exI[where x= \"tr12\"])\n apply (auto simp add: a)\n apply(rule exI[where x= \"tr2\"])\n apply auto\n apply(rule exI[where x= \"tr21\"])\n apply auto\n using b apply auto\n using that a b by auto\n subgoal for d \n apply(auto simp add: combine_assn_def join_assn_def)\n apply(rule exI[where x= \"[]\"])\n apply (auto simp add: wait_inv_assn.simps)\n apply(rule exI[where x= \"tr12\"])\n apply (auto simp add: a)\n apply(rule exI[where x= \"tr2\"])\n apply auto\n apply(rule exI[where x= \"tr21\"])\n apply auto\n using b apply auto\n using that a b by auto\n using b(1) apply (cases rule: in_inv_assn.cases)\n subgoal for s v d p\n apply(auto simp add: combine_assn_def join_assn_def)\n by (metis Cons_eq_appendI a(3) assms(1) b(3) combine_blocks_pairE2' that(3))\n subgoal for d p d2 s v\n apply(rule d[of d2 d p s v])\n using that a b by auto\n subgoal for d p s\n apply(rule e[of d p s])\n using that a b by auto\n done\n qed\nshow ?thesis\n apply (subst combine_assn_def)\n apply (auto simp add: entails_tassn_def)\n using * by auto\nqed\n\nlemma combine_assn_waitoutinv_emp:\n assumes \"ch \\ chs\"\n shows \"combine_assn chs (WaitOutinv\\<^sub>t r dp g rdy ch @\\<^sub>t P) emp\\<^sub>t \\\\<^sub>t false\\<^sub>A\"\n unfolding combine_assn_def\n apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def wait_out_inv_assn.simps)\n using assms by (auto elim: sync_elims)\n \nlemma combine_assn_waitoutinv_ininv:\n assumes \"ch \\ chs\"\n and \"ch \\ fst rdy\"\n shows \"combine_assn chs (WaitOutinv\\<^sub>t rr dp g1 rdy ch @\\<^sub>t P) (Ininv\\<^sub>t r g2 ch @\\<^sub>t Q) \\\\<^sub>t \n (IOinv\\<^sub>t (pgsb2gsb (\\ s. rr s 0) r) (pgsrb2gsrb g1 g2) ch @\\<^sub>t combine_assn chs P Q)\"\nproof-\n have *:\"(IOinv\\<^sub>t (pgsb2gsb (\\ s. rr s 0) r) (pgsrb2gsrb g1 g2) ch @\\<^sub>t combine_assn chs P Q) tr\"\n if \"(WaitOutinv\\<^sub>t rr dp g1 rdy ch @\\<^sub>t P) tr1\" \"(Ininv\\<^sub>t r g2 ch @\\<^sub>t Q) tr2\" \"combine_blocks chs tr1 tr2 tr\" for tr tr1 tr2\n proof -\n from that(1)[unfolded join_assn_def]\n obtain tr11 tr12 where a: \"WaitOutinv\\<^sub>t rr dp g1 rdy ch tr11\" \"P tr12\" \"tr1 = tr11 @ tr12\"\n by auto\n from that(2)[unfolded join_assn_def]\n obtain tr21 tr22 where b: \"Ininv\\<^sub>t r g2 ch tr21\" \"Q tr22\" \"tr2 = tr21 @ tr22\"\n by auto\n show ?thesis\n using a(1) apply (cases rule: wait_out_inv_assn.cases)\n subgoal for v\n using b(1) apply (cases rule: in_inv_assn.cases)\n subgoal for s' v'\n using that(3) unfolding a(3) b(3) apply auto\n apply (elim combine_blocks_pairE) using assms(1) apply auto\n apply (auto simp add: conj_assn_def pure_assn_def join_assn_def)\n apply (rule exI[where x=\"[IOBlock ch v']\"])\n apply (auto intro: io_assn.intros)\n unfolding combine_assn_def using a(2) b(2) apply auto\n subgoal for s tr'\n using io_inv_assn.intros[of \"(pgsb2gsb (\\s. rr s 0) r)\" \"ParState s s'\" \"(pgsrb2gsrb g1 g2)\" v ch]\n by(auto simp add:pgsb2gsb.simps pgsrb2gsrb.simps)\n done\n subgoal for d s' v'\n using that(3) unfolding a(3) b(3) apply auto\n apply (elim combine_blocks_pairE2) using assms by auto\n subgoal for s'\n using that(3) unfolding a(3) b(3) apply auto\n apply (elim combine_blocks_pairE2) by (rule assms)\n done\n using b(1) apply (cases rule: in_inv_assn.cases)\n using that(3) unfolding a(3) b(3) apply auto\n subgoal apply (elim combine_blocks_pairE2') by (rule assms)\n subgoal for d' apply (elim combine_blocks_waitE1)\n using assms(2) apply (cases rdy) by auto\n subgoal apply (elim combine_blocks_waitE1)\n using assms(2) apply (cases rdy) by auto\n done\n qed\nshow ?thesis\n apply (subst combine_assn_def)\n apply (auto simp add: entails_tassn_def)\n using * by auto\nqed\n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/newParallel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778403, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.26520691975608224}} {"text": "(* Title: HOL/Auth/n_mutualExFsm_lemma_inv__4_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_inv__4_on_rules imports n_mutualExFsm_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0. p__Inv0\\N\\f=inv__4 p__Inv0)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_fsm i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_fsm i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_fsmVsinv__4) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.26520691975608224}} {"text": "theory SolverP1\n imports InferRange\nbegin\n \n (* ## to move *)\n\ndefinition sub_list where\n \"sub_list l1 l2 = (\\ x. list_contain l1 x \\ list_contain l2 x)\" \n \nlemma append_sub_list1: \"\\ sub_list (l1 @ l2) lx \\ \\ sub_list l1 lx\" \n apply (induct l1)\n apply (auto)\n apply (simp add: sub_list_def)\n apply (simp add: sub_list_def)\n done\n\nlemma append_sub_list2: \"\\ sub_list (l1 @ l2) lx \\ \\ sub_list l2 lx\" \n apply (induct l1)\n apply (auto)\n apply (simp add: sub_list_def)\n done\n \nlemma id_sub_list: \"sub_list l l\" \n apply (simp add: sub_list_def)\n done \n \n (* phase 1: type unification *) \n \ndatatype perm_crn2 =\n LeqCrn2 x_perm s_perm\n | DisjCrn2 x_perm x_perm\n | MiniDisjCrn2 x_perm x_perm\n \nfun unify_subset where\n \"unify_subset [] = []\"\n| \"unify_subset (c # c_t) = (case c of\n UnifyCrn tau1 tau2 \\ (tau1, tau2) # (unify_subset c_t)\n | cx \\ unify_subset c_t\n )\"\n \nfun eval_perm where\n \"eval_perm p_sub (SPerm p) = p\"\n| \"eval_perm p_sub (SVar r) = p_sub r\" \n \nfun eval_permx where\n \"eval_permx p_sub (XPerm p) = eval_perm p_sub p\" \n| \"eval_permx p_sub (XType a) = NoPerm\"\n| \"eval_permx p_sub (XComp px qx) = union_perm (eval_permx p_sub px) (eval_permx p_sub qx)\" \n| \"eval_permx p_sub (XLift px q) = (if eval_perm p_sub q = OwnPerm \\ eval_permx p_sub px \\ NoPerm then OwnPerm else eval_permx p_sub px)\"\n| \"eval_permx p_sub (XIfZero px qx) = (if eval_permx p_sub px = NoPerm then NoPerm else eval_permx p_sub qx)\" \n \nfun sol_sat_crn2 where\n \"sol_sat_crn2 p_sub (LeqCrn2 px q) = (leq_perm (eval_permx p_sub px) (eval_perm p_sub q))\" \n| \"sol_sat_crn2 p_sub (DisjCrn2 px qx) = (mini_disj_perm (eval_permx p_sub px) (eval_permx p_sub qx) \\\n mini_disj_perm (eval_permx p_sub qx) (eval_permx p_sub px))\" \n| \"sol_sat_crn2 p_sub (MiniDisjCrn2 px qx) = (mini_disj_perm (eval_permx p_sub px) (eval_permx p_sub qx))\" \n \nfun sol_sat2 where\n \"sol_sat2 p_sub [] = True\" \n| \"sol_sat2 p_sub (c # c_t) = (sol_sat_crn2 p_sub c \\ sol_sat2 p_sub c_t)\" \n \n (* occurs *)\n \nfun occurs where\n \"occurs (VarScheme b) a = (a = b)\"\n| \"occurs (ArrayScheme tau) a = (occurs tau a)\"\n| \"occurs (PairScheme t1 t2 r) a = (occurs t1 a \\ occurs t2 a)\" \n| \"occurs (FunScheme t1 t2 r af) a = (occurs t1 a \\ occurs t2 a)\" \n| \"occurs (ChanScheme tau c_end) a = (occurs tau a)\"\n| \"occurs tau a = False\"\n \nfun sol_subst_type :: \"type_subst \\ s_type \\ s_type\" where\n \"sol_subst_type t_sub (VarScheme x) = (case t_sub x of\n None \\ VarScheme x\n | Some tau \\ tau\n )\"\n| \"sol_subst_type t_sub (ArrayScheme tau) = ArrayScheme (sol_subst_type t_sub tau)\" \n| \"sol_subst_type t_sub (PairScheme t1 t2 p) = PairScheme (sol_subst_type t_sub t1) (sol_subst_type t_sub t2) p\"\n| \"sol_subst_type t_sub (FunScheme t1 t2 p q) = FunScheme (sol_subst_type t_sub t1) (sol_subst_type t_sub t2) p q\" \n| \"sol_subst_type t_sub (ChanScheme tau c_end) = ChanScheme (sol_subst_type t_sub tau) c_end\"\n| \"sol_subst_type t_sub tau_v = tau_v\"\n \nfun sol_subst_eq_list where\n \"sol_subst_eq_list t_sub [] = []\" \n| \"sol_subst_eq_list t_sub ((t1, t2) # c_t) = ((sol_subst_type t_sub t1, sol_subst_type t_sub t2) # (sol_subst_eq_list t_sub c_t))\" \n \nfun as_perm_s where\n \"as_perm_s (AffConst a) = (SPerm (as_perm a))\"\n| \"as_perm_s (AffVar r) = (SVar r)\" \n \ndefinition add_list where\n \"add_list l x = (if list_contain l x then l else x # l)\" \n\nfun rem_list where\n \"rem_list [] x = []\" \n| \"rem_list (y # l) x = (if x = y then l else y # (rem_list l x))\" \n \nfun union_list where\n \"union_list [] l2 = l2\"\n| \"union_list (x # l1) l2 = add_list (union_list l1 l2) x\" \n \nfun tvar_type_l where\n \"tvar_type_l (VarScheme a) = [a]\"\n | \"tvar_type_l (ArrayScheme tau) = tvar_type_l tau\"\n | \"tvar_type_l (PairScheme t1 t2 p) = union_list (tvar_type_l t1) (tvar_type_l t2)\"\n | \"tvar_type_l (FunScheme t1 t2 p a) = union_list (tvar_type_l t1) (tvar_type_l t2)\"\n | \"tvar_type_l (ChanScheme tau c_end) = tvar_type_l tau\"\n | \"tvar_type_l tau = []\"\n\nfun tvar_eq_list where\n \"tvar_eq_list [] = []\"\n| \"tvar_eq_list ((t1, t2) # c_t) = union_list (union_list (tvar_type_l t1) (tvar_type_l t2)) (tvar_eq_list c_t)\"\n \ndefinition tvar_total where \n \"tvar_total c_list = length (tvar_eq_list c_list)\"\n\nfun type_cons :: \"s_type \\ nat\" where\n \"type_cons (ArrayScheme tau) = type_cons tau + 1\"\n| \"type_cons (PairScheme t1 t2 p) = (type_cons t1) + (type_cons t2) + 1\"\n| \"type_cons (FunScheme t1 t2 p q) = (type_cons t1) + (type_cons t2) + 1\" \n| \"type_cons (ChanScheme tau c_end) = type_cons tau + 1\"\n| \"type_cons (VarScheme a) = 0\"\n| \"type_cons tau = 1\"\n \nfun lcons_list where\n \"lcons_list [] = 0\"\n| \"lcons_list ((t1, t2) # c_t) = (type_cons t1) + (lcons_list c_t)\"\n \ndefinition unify_rel where\n \"unify_rel = measures [tvar_total, lcons_list, length]\" \n \nlemma contain_rem_list_length: \"\\ list_contain l x \\ \\ length (rem_list l x) + 1 = length l\" \n apply (induct l)\n apply (auto)\n done\n \nlemma rem_sub_list: \"\\ sub_list l1 l2; \\ list_contain l1 x \\ \\ sub_list l1 (rem_list l2 x)\" \n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (induct l2)\n apply (auto)\n done\n \nlemma add_sub_list: \"\\ sub_list l1 l2 \\ \\ sub_list l1 (add_list l2 x)\" \n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (induct l2)\n apply (auto)\n apply (simp add: add_list_def)\n apply (simp add: add_list_def)\n done\n \nlemma union_list_contain1: \"\\ list_contain l1 x \\ \\ list_contain (union_list l1 l2) x\" \n apply (induct l1 arbitrary: l2)\n apply (auto)\n apply (simp add: add_list_def)\n apply (simp add: add_list_def)\n done\n \nlemma union_list_contain2: \"\\ list_contain l2 x \\ \\ list_contain (union_list l1 l2) x\" \n apply (induct l1 arbitrary: l2)\n apply (auto)\n apply (simp add: add_list_def)\n done \n \nlemma dist_union_list_contain: \"\\ list_contain (union_list l1 l2) x \\ \\ list_contain l1 x \\ list_contain l2 x\" \n apply (induct l1 arbitrary: l2)\n apply (auto)\n apply (simp add: add_list_def)\n apply (case_tac \"list_contain (union_list l1 l2) a\")\n apply (auto)\n done \n \nlemma union_sub_list1: \"\\ sub_list la lb \\ \\ sub_list la (union_list lb lc)\"\n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac union_list_contain1)\n apply (simp)\n done\n \nlemma union_sub_list2: \"\\ sub_list la lc \\ \\ sub_list la (union_list lb lc)\"\n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac union_list_contain2)\n apply (simp)\n done \n \nlemma dist_union_sub_list: \"\\ sub_list la lc; sub_list lb lc \\ \\ sub_list (union_list la lb) lc\" \n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac ?l1.0=\"la\" and ?l2.0=\"lb\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n done\n \nlemma union_sub_list_rev: \"\\ sub_list (union_list la lb) lc \\ \\ sub_list la lc \\ sub_list lb lc\" \n apply (simp add: sub_list_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac ?l1.0=\"la\" in union_list_contain1)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac ?l2.0=\"lb\" in union_list_contain2)\n apply (auto)\n done\n \nlemma sub_list_less_length: \"\\ fresh_in_list l1; sub_list l1 l2 \\ \\ length l1 \\ length l2\" \n apply (induct l1 arbitrary: l2)\n apply (auto)\n (* because a # l1 is a sub_list of l2, l2 must contain a *)\n apply (case_tac \"\\ list_contain l2 a\")\n apply (simp add: sub_list_def)\n apply (auto)\n (* we can replace length l2 with length (l2 - a) + 1 *)\n apply (rule_tac t=\"length l2\" and s=\"length (rem_list l2 a) + 1\" in subst)\n apply (rule_tac contain_rem_list_length)\n apply (auto)\n (* lastly, it remains to show that l1 is a sub-list of (l2 - a) *)\n apply (cut_tac ?l1.0=\"l1\" and ?l2.0=\"l2\" and x=\"a\" in rem_sub_list)\n apply (simp add: sub_list_def)\n apply (auto)\n done\n \nlemma union_fresh_list: \"\\ fresh_in_list l1; fresh_in_list l2 \\ \\ fresh_in_list (union_list l1 l2)\" \n apply (induct l1)\n apply (auto)\n apply (simp add: add_list_def)\n done\n\nlemma tvar_type_fresh_list: \"fresh_in_list (tvar_type_l tau)\" \n apply (induct tau)\n apply (auto)\n apply (rule_tac union_fresh_list)\n apply (auto)\n apply (rule_tac union_fresh_list)\n apply (auto)\n done\n\nlemma tvar_eq_fresh_list: \"fresh_in_list (tvar_eq_list c_list)\" \n apply (induct c_list)\n apply (auto)\n apply (rule_tac union_fresh_list)\n apply (rule_tac union_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (simp)\n done\n \nlemma cons_less_tvar_total: \"tvar_total c_list \\ tvar_total (c # c_list)\" \n apply (simp add: tvar_total_def)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac sub_list_less_length)\n apply (rule_tac tvar_eq_fresh_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n done\n\nlemma orient_less_tvar_total: \"tvar_total ((c2, c1) # c_list) \\ tvar_total ((c1, c2) # c_list)\" \n apply (simp add: tvar_total_def)\n apply (rule_tac sub_list_less_length)\n apply (rule_tac union_fresh_list)\n apply (rule_tac union_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_eq_fresh_list)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac id_sub_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n done\n \nlemma simp_unify_rel: \"(c_list, (x, y) # c_list) \\ unify_rel\"\n apply (simp add: unify_rel_def)\n apply (auto)\n apply (cut_tac c_list=\"c_list\" and c=\"(x, y)\" in cons_less_tvar_total)\n apply (auto)\n done\n \nlemma orient_unify_rel: \"\\ \\ b. x \\ VarScheme b \\ \\ ((VarScheme a, x) # c_list, (x, VarScheme a) # c_list) \\ unify_rel\" \n apply (simp add: unify_rel_def)\n apply (auto)\n apply (cut_tac ?c2.0=\"VarScheme a\" and ?c1.0=\"x\" and c_list=\"c_list\" in orient_less_tvar_total)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n done\n\nlemma sol_subst_type_sub_list: \"\\ sub_list (tvar_type_l tau) l; sub_list (tvar_type_l tau_x) l \\ \\\n sub_list (tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau)) l\" \n apply (induct tau)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (simp add: empty_env_def)\n apply (cut_tac la=\"tvar_type_l tau1\" and lb=\"tvar_type_l tau2\" and lc=\"l\" in union_sub_list_rev)\n apply (auto)\n apply (rule_tac dist_union_sub_list)\n apply (simp_all)\n apply (cut_tac la=\"tvar_type_l tau1\" and lb=\"tvar_type_l tau2\" and lc=\"l\" in union_sub_list_rev)\n apply (auto)\n apply (rule_tac dist_union_sub_list)\n apply (simp_all)\n done\n\nlemma sol_subst_sub_list: \"\\ sub_list (tvar_type_l tau) l; sub_list (tvar_eq_list c_list) l \\ \\\n sub_list (tvar_eq_list (sol_subst_eq_list (add_env empty_env x tau) c_list)) l\" \n apply (induct c_list arbitrary: l)\n apply (auto)\n apply (cut_tac la=\"union_list (tvar_type_l a) (tvar_type_l b)\" and lb=\"tvar_eq_list c_list\" and lc=\"l\" in union_sub_list_rev)\n apply (auto)\n apply (cut_tac la=\"tvar_type_l a\" and lb=\"tvar_type_l b\" and lc=\"l\" in union_sub_list_rev)\n apply (auto)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac sol_subst_type_sub_list)\n apply (auto)\n apply (rule_tac sol_subst_type_sub_list)\n apply (auto)\n done\n \nlemma occurs_list_contain: \"\\ \\ occurs tau x \\ \\ \\ list_contain (tvar_type_l tau) x\" \n apply (induct tau)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l tau1\" and ?l2.0=\"tvar_type_l tau2\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l tau1\" and ?l2.0=\"tvar_type_l tau2\" in dist_union_list_contain)\n apply (auto)\n done\n \nlemma sol_subst_type_list_contain: \"\\ \\ occurs tau_x x \\ \\\n \\ list_contain (tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau)) x\"\n apply (induct tau)\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (simp add: occurs_list_contain)\n apply (simp add: empty_env_def)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau1)\" and\n ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau2)\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau1)\" and\n ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau_x) tau2)\" in dist_union_list_contain)\n apply (auto)\n done\n \nlemma sol_subst_list_contain: \"\\ \\ occurs tau x \\ \\\n \\ list_contain (tvar_eq_list (sol_subst_eq_list (add_env empty_env x tau) c_list)) x\" \n apply (induct c_list)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list (tvar_type_l (sol_subst_type (add_env empty_env x tau) a)) (tvar_type_l (sol_subst_type (add_env empty_env x tau) b))\"\n and ?l2.0=\"tvar_eq_list (sol_subst_eq_list (add_env empty_env x tau) c_list)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau) a)\"\n and ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env x tau) b)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac tau_x=\"tau\" and tau=\"a\" and x=\"x\" in sol_subst_type_list_contain)\n apply (auto)\n apply (cut_tac tau_x=\"tau\" and tau=\"b\" and x=\"x\" in sol_subst_type_list_contain)\n apply (auto)\n done\n \nlemma eur_less_tvar_total: \"\\ \\ occurs tau x \\ \\\n length (tvar_eq_list (sol_subst_eq_list (add_env empty_env x tau) c_list)) \\\n length (rem_list (union_list (add_list (tvar_type_l tau) x) (tvar_eq_list c_list)) x)\" \n apply (rule_tac sub_list_less_length)\n apply (rule_tac tvar_eq_fresh_list)\n apply (rule_tac rem_sub_list)\n apply (rule_tac sol_subst_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac add_sub_list)\n apply (rule_tac id_sub_list) \n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n apply (rule_tac sol_subst_list_contain)\n apply (simp)\n done\n \nlemma elim_unify_rel: \"\\ \\ occurs tau x \\ \\\n (sol_subst_eq_list (add_env empty_env x tau) c_list, (VarScheme x, tau) # c_list) \\ unify_rel\"\n apply (case_tac \"\\ length (tvar_eq_list (sol_subst_eq_list (add_env empty_env x tau) c_list))\n < length (union_list (add_list (tvar_type_l tau) x) (tvar_eq_list c_list))\")\n apply (cut_tac tau=\"tau\" and x=\"x\" and c_list=\"c_list\" in eur_less_tvar_total)\n apply (simp)\n apply (cut_tac l=\"union_list (add_list (tvar_type_l tau) x) (tvar_eq_list c_list)\" and x=\"x\" in contain_rem_list_length)\n apply (rule_tac union_list_contain1)\n apply (simp add: add_list_def)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (auto)\n apply (simp_all add: tvar_total_def)\n done\n \nlemma dist_ut_term_less_length: \"\n length (union_list (union_list (tvar_type_l t1) (tvar_type_l t2)) (union_list (union_list (tvar_type_l s1) (tvar_type_l s2)) (tvar_eq_list c_t))) \\\n length (union_list (union_list (union_list (tvar_type_l t1) (tvar_type_l s1)) (union_list (tvar_type_l t2) (tvar_type_l s2))) (tvar_eq_list c_t))\" \n apply (rule_tac sub_list_less_length)\n apply (rule_tac union_fresh_list)\n apply (rule_tac union_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac union_fresh_list)\n apply (rule_tac union_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_type_fresh_list)\n apply (rule_tac tvar_eq_fresh_list)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac union_sub_list1)\n apply (rule_tac id_sub_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac union_sub_list1)\n apply (rule_tac id_sub_list)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac dist_union_sub_list)\n apply (rule_tac union_sub_list1)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n apply (rule_tac union_sub_list2)\n apply (rule_tac id_sub_list)\n done\n \nfunction unify_type where\n \"unify_type [] = Some (empty_env, [])\"\n| \"unify_type ((tau1, tau2) # c_t) = (case (tau1, tau2) of\n (VarScheme a, tau_x) \\\n if tau_x = VarScheme a then unify_type c_t\n else if occurs tau_x a then None\n else (case unify_type (sol_subst_eq_list (add_env empty_env a tau_x) c_t) of\n None \\ None\n | Some (sigma, p_list) \\ Some (add_env sigma a (sol_subst_type sigma tau_x), p_list)\n )\n | (tau_x, VarScheme a) \\ unify_type ((VarScheme a, tau_x) # c_t)\n | (ArrayScheme t, ArrayScheme s) \\ unify_type ((t, s) # c_t)\n | (PairScheme t1 t2 p, PairScheme s1 s2 q) \\ (case unify_type ((t1, s1) # (t2, s2) # c_t) of\n None \\ None\n | Some (sigma, p_list) \\ Some (sigma, (p, q) # p_list)\n )\n | (FunScheme t1 t2 p a, FunScheme s1 s2 q b) \\ (case unify_type ((t1, s1) # (t2, s2) # c_t) of\n None \\ None\n | Some (sigma, p_list) \\ Some (sigma, (p, q) # (as_perm_s a, as_perm_s b) # p_list)\n )\n | (ChanScheme t c_end, ChanScheme s c_end') \\ if c_end = c_end' then unify_type ((t, s) # c_t) else None\n | (t1, t2) \\ if t1 = t2 then unify_type c_t else None\n )\"\n by pat_completeness auto\ntermination\n apply (relation \"unify_rel\")\n apply (auto)\n (* simple cases *)\n apply (simp add: unify_rel_def)\n apply (simp_all add: simp_unify_rel)\n apply (simp_all add: orient_unify_rel)\n (* elim case *)\n apply (simp add: elim_unify_rel)\n (* decomp cases *)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"c_t\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"c_t\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n done\n\nfun perm_subst_type where\n \"perm_subst_type p_sub (ArrayScheme tau) = ArrayScheme (perm_subst_type p_sub tau)\"\n| \"perm_subst_type p_sub (PairScheme t1 t2 r) = PairScheme (perm_subst_type p_sub t1) (perm_subst_type p_sub t2) (SPerm (sol_subst_perm p_sub r))\"\n| \"perm_subst_type p_sub (FunScheme t1 t2 r a) =\n FunScheme (perm_subst_type p_sub t1) (perm_subst_type p_sub t2) (SPerm (sol_subst_perm p_sub r)) (AffConst (sol_subst_aff p_sub a))\" \n| \"perm_subst_type p_sub (ChanScheme tau c_end) = ChanScheme (perm_subst_type p_sub tau) c_end\"\n| \"perm_subst_type p_sub tau_v = tau_v\" \n \nfun type_eq_sat_f where\n \"type_eq_sat_f t_sub p_sub [] = True\"\n| \"type_eq_sat_f t_sub p_sub ((a, b) # c_t) = (perm_subst_type p_sub (sol_subst_type t_sub a) =\n perm_subst_type p_sub (sol_subst_type t_sub b) \\ type_eq_sat_f t_sub p_sub c_t)\"\n \ndefinition type_eq_sat where\n \"type_eq_sat t_sub p_sub c_list = type_eq_sat_f t_sub p_sub c_list\" \n \nfun type_contains_f where\n \"type_contains_f tau tau' = (if tau = tau' then True else case tau' of\n ArrayScheme tau_x \\ type_contains_f tau tau_x\n | PairScheme t1 t2 r \\ type_contains_f tau t1 \\ type_contains_f tau t2\n | FunScheme t1 t2 p q \\ type_contains_f tau t1 \\ type_contains_f tau t2\n | ChanScheme tau_x c_end \\ type_contains_f tau tau_x\n | tau_x \\ False\n )\"\n \ndefinition type_contains where\n \"type_contains tau tau' = type_contains_f tau tau'\" \n \n (* if a is in tau, then t_sub(tau) will contain t_sub(a) *)(*\nlemma occurs_type_contains: \"\\ occurs tau a; t_sub a = Some tau_x \\ \\ type_contains tau_x (part_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (simp add: type_contains_def)\n done*)\n \nlemma array_no_self: \"ArrayScheme tau \\ tau\" \n apply (induct tau)\n apply (auto)\n done\n\nlemma pair_no_self1: \"PairScheme t1 t2 r \\ t1\" \n apply (induct t1)\n apply (auto)\n done\n\nlemma pair_no_self2: \"PairScheme t1 t2 r \\ t2\" \n apply (induct t2)\n apply (auto)\n done \n \nlemma fun_no_self1: \"FunScheme t1 t2 p q \\ t1\" \n apply (induct t1)\n apply (auto)\n done\n\nlemma fun_no_self2: \"FunScheme t1 t2 p q \\ t2\" \n apply (induct t2)\n apply (auto)\n done\n \nlemma chan_no_self: \"ChanScheme tau c_end \\ tau\" \n apply (induct tau)\n apply (auto)\n done\n \nlemma type_contains_less_cons: \"\\ type_contains tau tau'; tau \\ tau' \\ \\ type_cons tau < type_cons tau'\"\n apply (induct tau')\n apply (auto)\n apply (simp add: type_contains_def)\n apply (simp add: type_contains_def)\n apply (simp add: type_contains_def)\n apply (simp add: type_contains_def)\n apply (case_tac \"tau = tau'\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"tau = tau'1\")\n apply (auto)\n apply (case_tac \"tau = tau'2\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (auto)\n apply (case_tac \"tau = tau'1\")\n apply (auto)\n apply (case_tac \"tau = tau'2\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (auto)\n apply (case_tac \"tau = tau'\")\n apply (auto)\n apply (simp add: type_contains_def)\n done\n \nlemma trans_type_contains: \"\\ type_contains tau_a tau_b; type_contains tau_b tau_c \\ \\ type_contains tau_a tau_c\" \n apply (induct tau_c)\n apply (auto)\n (* int case *)\n apply (simp add: type_contains_def)\n apply (case_tac tau_b)\n apply (auto)\n apply (case_tac tau_a)\n apply (auto)\n (* unit case *)\n apply (simp add: type_contains_def)\n apply (case_tac tau_b)\n apply (auto)\n apply (case_tac tau_a)\n apply (auto)\n (* bool case *)\n apply (simp add: type_contains_def)\n apply (case_tac tau_b)\n apply (auto)\n apply (case_tac tau_a)\n apply (auto)\n (* var case *)\n apply (simp add: type_contains_def)\n apply (case_tac tau_b)\n apply (auto)\n apply (case_tac tau_a)\n apply (auto)\n apply (case_tac \"x4 = x\")\n apply (auto)\n apply (case_tac \"x4a = x\")\n apply (auto)\n (* array case *)\n apply (case_tac \"\\ type_contains tau_b tau_c\")\n apply (case_tac \"tau_b \\ tau_c\")\n apply (simp add: type_contains_def)\n apply (case_tac tau_b)\n apply (auto)\n apply (case_tac \"x5 = tau_c\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (simp add: type_contains_def)\n (* pair case *)\n apply (case_tac \"type_contains tau_b tau_c1\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"type_contains tau_b tau_c2\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"tau_b \\ PairScheme tau_c1 tau_c2 x3\")\n apply (simp add: type_contains_def)\n apply (auto)\n (* fun case *)\n apply (case_tac \"type_contains tau_b tau_c1\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"type_contains tau_b tau_c2\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"tau_b \\ FunScheme tau_c1 tau_c2 x3 x4a\")\n apply (simp add: type_contains_def)\n apply (auto)\n (* chan case *)\n apply (case_tac \"type_contains tau_b tau_c\")\n apply (auto)\n apply (simp add: type_contains_def)\n apply (case_tac \"tau_b \\ ChanScheme tau_c x2\")\n apply (simp add: type_contains_def)\n apply (auto)\n done\n\nlemma occurs_less_cons_ih: \"\\ occurs tau a; tau \\ VarScheme a; t_sub a = Some tau_x \\ \\ type_cons tau_x < type_cons (sol_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (case_tac \"tau = VarScheme a\")\n apply (auto)\n apply (case_tac \"tau1 = VarScheme a\")\n apply (auto)\n apply (case_tac \"tau2 = VarScheme a\")\n apply (auto)\n apply (case_tac \"tau1 = VarScheme a\")\n apply (auto)\n apply (case_tac \"tau2 = VarScheme a\")\n apply (auto)\n apply (case_tac \"tau = VarScheme a\")\n apply (auto)\n done\n \nlemma occurs_less_cons: \"\\ occurs tau a; tau \\ VarScheme a \\ \\ type_cons (sol_subst_type t_sub (VarScheme a)) < type_cons (sol_subst_type t_sub tau)\" \n apply (auto)\n apply (case_tac \"t_sub a\")\n apply (auto)\n apply (case_tac tau)\n apply (auto)\n apply (rule_tac occurs_less_cons_ih)\n apply (auto)\n done\n \n (*\n base case - in the base case, say that we have array(a). obviously array(t_sub(a)) \\ t_sub(a).\n inductive case - say that we have array(tau), where t_sub(tau) \\ t_sub(a).\n we want to show that array(t_sub(tau)) \\ t_sub(a) either. this would only be possible if t_sub(tau) was\n smaller than t_sub(a). so we want to know that t_sub(tau) is not contained in t_sub(a)\n *)\nlemma occurs_not_sub_contains: \"\\ occurs tau a; tau \\ VarScheme a; t_sub a = Some tau_x \\ \\ \\ type_contains (sol_subst_type t_sub tau) tau_x\"\n apply (induct tau)\n apply (auto)\n (* array case. say that tau = a. then we must show that array(t_sub(a)) \\ t_sub(a). *)\n apply (case_tac \"tau = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"ArrayScheme tau_x\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: array_no_self)\n (* - otherwise, we use containment transitivity *)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau\" and tau_b=\"ArrayScheme (sol_subst_type t_sub tau)\" and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n (* pair case 1. *)\n apply (case_tac \"tau1 = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"PairScheme tau_x (sol_subst_type t_sub tau2) x3\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: pair_no_self1)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau1\" and tau_b=\"PairScheme (sol_subst_type t_sub tau1) (sol_subst_type t_sub tau2) x3\"\n and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n (* pair case 2. *)\n apply (case_tac \"tau2 = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"PairScheme (sol_subst_type t_sub tau1) tau_x x3\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: pair_no_self2)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau2\" and tau_b=\"PairScheme (sol_subst_type t_sub tau1) (sol_subst_type t_sub tau2) x3\"\n and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n (* fun case 1. *)\n apply (case_tac \"tau1 = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"FunScheme (sol_subst_type t_sub tau1) (sol_subst_type t_sub tau2) x3 x4a\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: fun_no_self1)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau1\" and tau_b=\"FunScheme (sol_subst_type t_sub tau1) (sol_subst_type t_sub tau2) x3 x4a\"\n and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n (* fun case 2. *)\n apply (case_tac \"tau2 = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"FunScheme (sol_subst_type t_sub tau1) tau_x x3 x4a\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: fun_no_self2)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau2\" and tau_b=\"FunScheme (sol_subst_type t_sub tau1) (sol_subst_type t_sub tau2) x3 x4a\"\n and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n (* chan case. *)\n apply (case_tac \"tau = VarScheme a\")\n apply (simp)\n apply (cut_tac tau=\"ChanScheme tau_x x2\" and tau'=\"tau_x\" in type_contains_less_cons)\n apply (auto)\n apply (simp add: chan_no_self)\n apply (cut_tac tau_a=\"sol_subst_type t_sub tau\" and tau_b=\"ChanScheme (sol_subst_type t_sub tau) x2\" and tau_c=\"tau_x\" in trans_type_contains)\n apply (simp add: type_contains_def)\n apply (auto)\n done\n \n (* if a is in tau, and a \\ tau, then t_sub(a) \\ t_sub(tau) *)\nlemma occurs_not_sub_eq: \"\\ occurs tau a; tau \\ VarScheme a \\ \\ (sol_subst_type t_sub (VarScheme a)) \\ sol_subst_type t_sub tau\" \n apply (auto)\n apply (case_tac \"t_sub a\")\n apply (auto)\n apply (case_tac tau)\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and tau=\"tau\" and a=\"a\" and tau_x=\"sol_subst_type t_sub tau\" in occurs_not_sub_contains)\n apply (auto)\n apply (simp add: type_contains_def)\n done\n \nlemma sol_subst_type_eq: \"\\ perm_subst_type p_sub (sol_subst_type t_sub (VarScheme a)) = perm_subst_type p_sub (sol_subst_type t_sub t) \\ \\\n perm_subst_type p_sub (sol_subst_type t_sub (sol_subst_type (add_env empty_env a t) tau)) = perm_subst_type p_sub (sol_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: empty_env_def)\n apply (auto)\n done\n \nlemma intern_sol_subst_type_eq_sat: \"\\ type_eq_sat_f t_sub p_sub c_list;\n perm_subst_type p_sub (sol_subst_type t_sub (VarScheme a)) = perm_subst_type p_sub (sol_subst_type t_sub tau) \\ \\\n type_eq_sat_f t_sub p_sub (sol_subst_eq_list (add_env empty_env a tau) c_list)\"\n apply (induct c_list)\n apply (auto)\n apply (simp add: sol_subst_type_eq)\n done\n \nlemma perm_subst_same_cons: \"type_cons tau = type_cons (perm_subst_type p_sub tau)\" \n apply (induct tau)\n apply (auto)\n done\n \n (*\nlemma unify_type_unsat: \"\\ unify_type c_list = None \\ \\ \\ type_eq_sat t_sub p_sub c_list\"\n apply (simp add: type_eq_sat_def)\n apply (induct rule: unify_type.pelims)\n apply (auto)\n *)\n\nlemma unify_type_unsat: \"\\ unify_type c_list = None \\ \\ \\ type_eq_sat t_sub p_sub c_list\"\n apply (simp add: type_eq_sat_def)\n apply (induct rule: wf_induct [where r=unify_rel])\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (case_tac x)\n apply (auto)\n (* elim case *)\n apply (case_tac \"\\ a'. a = VarScheme a'\")\n apply (auto)\n apply (case_tac \"b = VarScheme a'\")\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (case_tac \"occurs b a'\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and tau=\"b\" and a=\"a'\" in occurs_less_cons)\n apply (auto)\n apply (cut_tac tau=\"sol_subst_type t_sub (VarScheme a')\" and p_sub=\"p_sub\" in perm_subst_same_cons)\n apply (cut_tac tau=\"sol_subst_type t_sub b\" and p_sub=\"p_sub\" in perm_subst_same_cons)\n apply (auto)\n apply (case_tac \"unify_type (sol_subst_eq_list (add_env empty_env a' b) list)\")\n apply (auto)\n (* - here we have to prove that if list[b / a'] is unsolvable, then list itself is unsatisfiable.\n we know that 'a \\ t_sub('b) in t_sub by the current equality, which we can use to relate the two.\n *)\n apply (erule_tac x=\"sol_subst_eq_list (add_env empty_env a' b) list\" in allE)\n apply (simp add: elim_unify_rel)\n apply (simp add: intern_sol_subst_type_eq_sat)\n (* orient case *)\n apply (case_tac \"\\ b'. b = VarScheme b'\")\n apply (auto)\n apply (erule_tac x=\" (VarScheme b', a) # list\" in allE)\n apply (simp add: orient_unify_rel)\n apply (case_tac a)\n apply (auto)\n (* decomp case. int *)\n apply (case_tac a)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (simp add: simp_unify_rel)\n (* - unit case *)\n apply (case_tac b)\n apply (auto)\n apply (simp add: simp_unify_rel)\n (* - bool case *)\n apply (case_tac b)\n apply (auto)\n apply (simp add: simp_unify_rel)\n (* - array case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x5, x5a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n (* - pair case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x61, x61a) # (x62, x62a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (auto)\n (* - fun case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x71, x71a) # (x72, x72a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (auto)\n (* - chan case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x81, x81a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n done\n\nlemma add_env_eq: \"\\ env x = Some tau \\ \\ env = add_env env x tau\" \n apply (case_tac \"\\ x'. env x' = add_env env x tau x'\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nfun perm_eq_sat_f where\n \"perm_eq_sat_f p_sub [] = True\"\n| \"perm_eq_sat_f p_sub ((p, q) # p_t) = (sol_subst_perm p_sub p = sol_subst_perm p_sub q \\ perm_eq_sat_f p_sub p_t)\" \n \ndefinition perm_eq_sat where\n \"perm_eq_sat p_sub c_list = perm_eq_sat_f p_sub c_list\" \n \nfun apply_type_subst where\n \"apply_type_subst t_sub a = (case t_sub a of\n None \\ VarScheme a\n | Some tau \\ tau\n )\"\n \ntype_synonym perm_var_subst = \"s_perm subst_env\" \n \nfun equiv_scheme where\n \"equiv_scheme (ArrayScheme tau) tau' = (\\ tau_x. tau' = ArrayScheme tau_x \\ equiv_scheme tau tau_x)\"\n| \"equiv_scheme (PairScheme t1 t2 r) tau' = (\\ t1x t2x q. tau' = PairScheme t1x t2x q \\ equiv_scheme t1 t1x \\ equiv_scheme t2 t2x)\"\n| \"equiv_scheme (FunScheme t1 t2 r a) tau' = (\\ t1x t2x q a'. tau' = FunScheme t1x t2x q a' \\ equiv_scheme t1 t1x \\ equiv_scheme t2 t2x)\"\n| \"equiv_scheme (ChanScheme tau c_end) tau' = (\\ tau_x. tau' = ChanScheme tau_x c_end \\ equiv_scheme tau tau_x)\"\n| \"equiv_scheme tau tau' = (tau = tau')\" \n \nlemma id_equiv_scheme: \"equiv_scheme tau tau\" \n apply (induct tau)\n apply (auto)\n done\n \ndefinition equiv_sub where\n \"equiv_sub t_sub t_sub' = (\\ x. apply_type_subst t_sub x = apply_type_subst t_sub' x)\"\n\ndefinition subst_compose where\n \"subst_compose t_sub t_sub' = (\\ x. case t_sub x of\n None \\ t_sub' x\n | Some tau \\ Some (sol_subst_type t_sub' tau)\n )\" \n (*\nfun perm_var_subst_perm where\n \"perm_var_subst_perm p_sub (SPerm p) = SPerm p\"\n| \"perm_var_subst_perm p_sub (SVar r) = (case p_sub r of\n None \\ SVar r\n | Some p \\ p\n )\" \n \nfun as_aff_s where\n \"as_aff_s (SPerm p) = AffConst (as_aff p)\" \n| \"as_aff_s (SVar r) = AffVar r\" \n \nfun perm_var_subst_aff where\n \"perm_var_subst_aff p_sub (AffConst a) = AffConst a\"\n| \"perm_var_subst_aff p_sub (AffVar r) = (case p_sub r of\n None \\ AffVar r\n | Some p \\ as_aff_s p\n )\"\n \nfun perm_var_subst_type where\n \"perm_var_subst_type p_sub (ArrayScheme tau) = ArrayScheme (perm_var_subst_type p_sub tau)\" \n| \"perm_var_subst_type p_sub (PairScheme t1 t2 r) =\n PairScheme (perm_var_subst_type p_sub t1) (perm_var_subst_type p_sub t2) (perm_var_subst_perm p_sub r)\" \n| \"perm_var_subst_type p_sub (FunScheme t1 t2 r a) =\n FunScheme (perm_var_subst_type p_sub t1) (perm_var_subst_type p_sub t2) (perm_var_subst_perm p_sub r) (perm_var_subst_aff p_sub a)\" \n| \"perm_var_subst_type p_sub (ChanScheme tau c_end) = ChanScheme (perm_var_subst_type p_sub tau) c_end\" \n| \"perm_var_subst_type p_sub tau = tau\" *)\n \ndefinition perm_compose where\n \"perm_compose p_sub t_sub = (\\ x. case t_sub x of\n None \\ None\n | Some tau \\ Some (perm_subst_type p_sub tau)\n )\" \n \nlemma empty_compose_equiv_sub: \"equiv_sub (subst_compose empty_env t_sub) t_sub\" \n apply (simp add: equiv_sub_def)\n apply (simp add: subst_compose_def)\n apply (simp add: empty_env_def)(*\n apply (auto)\n apply (rule_tac id_equiv_scheme)*)\n done\n \ndefinition wf_sub where\n \"wf_sub t_sub = (\\ x. case t_sub x of\n None \\ True\n | Some tau_x \\ (\\ y. case t_sub y of\n None \\ True\n | Some tau \\ x \\ tvar_type tau\n )\n )\"\n \ndefinition type_sub_range where\n \"type_sub_range t_sub = { x | x. \\ y. case t_sub y of None \\ False | Some tau \\ x \\ tvar_type tau }\" \n \nlemma tvar_type_occurs: \"\\ a \\ tvar_type tau \\ \\ occurs tau a\" \n apply (induct tau)\n apply (auto)\n done\n \nlemma sol_subst_tvar_type: \"\\ a \\ tvar_type tau; a \\ type_sub_range t_sub \\ \\ a \\ tvar_type (sol_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (case_tac \"t_sub x\")\n apply (auto)\n apply (simp add: type_sub_range_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n \nlemma wf_sol_subst_tvar_type: \"\\ wf_sub t_sub; t_sub x = Some tau' \\ \\ x \\ tvar_type (sol_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (case_tac \"t_sub xa\")\n apply (auto)\n apply (simp add: wf_sub_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n done\n \nlemma add_wf_sub: \"\\ \\ occurs tau a; a \\ type_sub_range t_sub; wf_sub t_sub \\ \\ wf_sub (add_env t_sub a (sol_subst_type t_sub tau))\"\n (* we must show that for all x in the new t_sub, x does not appear on the right-hand side of any assignment y *)\n apply (simp add: wf_sub_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n (* x = a, x = y (showing a does not appear in tau) *)\n apply (case_tac \"a \\ tvar_type tau\")\n apply (simp add: tvar_type_occurs)\n apply (cut_tac a=\"a\" and tau=\"tau\" in sol_subst_tvar_type)\n apply (auto)\n (* x = a, x \\ y (showing a does not appear on the right-hand side of anything else) *)\n apply (case_tac \"t_sub y\")\n apply (auto)\n apply (simp add: type_sub_range_def)\n apply (erule_tac x=\"y\" in allE)\n apply (auto)\n (* x \\ a *)\n apply (case_tac \"t_sub x\")\n apply (auto)\n apply (simp add: add_env_def)\n (* a = y (showing that none of the xs appear in the right-hand side of tau) *)\n apply (auto)\n apply (simp add: type_sub_range_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac x=\"x\" and t_sub=\"t_sub\" and tau=\"tau\" and tau'=\"aa\" in wf_sol_subst_tvar_type)\n apply (auto)\n apply (simp add: wf_sub_def)\n (* a \\ y (showing that none of the xs appear on the right-hand side of another) *)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n \nlemma dist_sol_subst_type_list_contain: \"\\ \\ occurs tau_x x; \\ occurs tau x \\ \\\n \\ list_contain (tvar_type_l (sol_subst_type (add_env empty_env a tau_x) tau)) x\" \n apply (induct tau)\n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"a = xa\")\n apply (auto)\n apply (cut_tac tau=\"tau_x\" and x=\"x\" in occurs_list_contain)\n apply (auto)\n apply (simp add: empty_env_def)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau_x) tau1)\"\n and ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau_x) tau2)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau_x) tau1)\"\n and ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau_x) tau2)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n done\n \nlemma occurs_list_contain_rev: \"\\ \\ list_contain (tvar_type_l tau) x\\ \\ \\ occurs tau x\" \n apply (induct tau)\n apply (auto)\n apply (case_tac \"list_contain (tvar_type_l tau1) x\")\n apply (cut_tac ?l1.0=\"tvar_type_l tau1\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (case_tac \"list_contain (tvar_type_l tau2) x\")\n apply (cut_tac ?l2.0=\"tvar_type_l tau2\" and x=\"x\" in union_list_contain2)\n apply (auto)\n apply (case_tac \"list_contain (tvar_type_l tau1) x\")\n apply (cut_tac ?l1.0=\"tvar_type_l tau1\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (case_tac \"list_contain (tvar_type_l tau2) x\")\n apply (cut_tac ?l2.0=\"tvar_type_l tau2\" and x=\"x\" in union_list_contain2)\n apply (auto)\n done\n \nlemma dist_sol_subst_list_contain: \"\\ \\ list_contain (tvar_eq_list c_list) x; \\ occurs tau x \\ \\\n \\ list_contain (tvar_eq_list (sol_subst_eq_list (add_env empty_env a tau) c_list)) x\" \n apply (induct c_list)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list (tvar_type_l (sol_subst_type (add_env empty_env a tau) aa)) (tvar_type_l (sol_subst_type (add_env empty_env a tau) b))\"\n and ?l2.0=\"tvar_eq_list (sol_subst_eq_list (add_env empty_env a tau) c_list)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau) aa) \"\n and ?l2.0=\"tvar_type_l (sol_subst_type (add_env empty_env a tau) b)\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n (* list containment for t1 *)\n apply (cut_tac a=\"a\" and tau_x=\"tau\" and tau=\"aa\" and x=\"x\" in dist_sol_subst_type_list_contain)\n apply (auto)\n apply (cut_tac tau=\"aa\" and x=\"x\" in occurs_list_contain_rev)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l aa\" and ?l2.0=\"tvar_type_l b\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list (tvar_type_l aa) (tvar_type_l b)\" and ?l2.0=\"tvar_eq_list c_list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n (* list containment for t2 *)\n apply (cut_tac a=\"a\" and tau_x=\"tau\" and tau=\"b\" and x=\"x\" in dist_sol_subst_type_list_contain)\n apply (auto)\n apply (cut_tac tau=\"b\" and x=\"x\" in occurs_list_contain_rev)\n apply (auto)\n apply (cut_tac ?l1.0=\"tvar_type_l aa\" and ?l2.0=\"tvar_type_l b\" and x=\"x\" in union_list_contain2)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list (tvar_type_l aa) (tvar_type_l b)\" and ?l2.0=\"tvar_eq_list c_list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n (* list containment for remainder *)\n apply (case_tac \"list_contain (tvar_eq_list c_list) x\")\n apply (cut_tac ?l1.0=\"union_list (tvar_type_l aa) (tvar_type_l b)\" and ?l2.0=\"tvar_eq_list c_list\" and x=\"x\" in union_list_contain2)\n apply (auto)\n done\n \nlemma tvar_type_l_rel: \"\\ x \\ tvar_type tau \\ \\ list_contain (tvar_type_l tau) x\" \n apply (cut_tac tau=\"tau\" and a=\"x\" in tvar_type_occurs)\n apply (auto)\n apply (case_tac \"\\ list_contain (tvar_type_l tau) x\")\n apply (cut_tac tau=\"tau\" and x=\"x\" in occurs_list_contain_rev)\n apply (auto)\n done\n\n(*\n \\ list_contain (add_list (tvar_eq_list list) b') x; x \\ type_sub_range t_sub; list_contain (union_list (add_list [] b') (tvar_eq_list list)) x\n\n\\ list_contain (union_list (union_list (tvar_type_l x5) [b']) (tvar_eq_list list)) x; x \\ type_sub_range t_sub;\n list_contain (union_list (add_list (tvar_type_l x5) b') (tvar_eq_list list)) \n\n*)\n \nlemma orient_list_contain1: \"\\ \\ list_contain (add_list (tvar_eq_list list) y) x \\ \\ \\ list_contain (union_list (add_list [] y) (tvar_eq_list list)) x\" \n apply (auto)\n apply (simp add: add_list_def)\n done\n \nlemma add_union_list_contain: \"\\ list_contain (add_list l a) x \\ \\ list_contain (union_list l [a]) x\" \n apply (induct l)\n apply (auto)\n apply (simp add: add_list_def)\n apply (simp add: add_list_def)\n apply (auto)\n apply (case_tac \"a = aa \\ list_contain l a\")\n apply (auto)\n apply (case_tac \"a = aa \\ list_contain l a\")\n apply (auto)\n apply (case_tac \"list_contain l a\")\n apply (auto)\n done\n \nlemma orient_list_contain2: \"\\ \\ list_contain (union_list (union_list l [a]) (tvar_eq_list list)) x \\ \\\n \\ list_contain (union_list (add_list l a) (tvar_eq_list list)) x\" \n apply (auto)\n apply (cut_tac ?l1.0=\"add_list l a\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in dist_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list l [a]\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (rule_tac add_union_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"union_list l [a]\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain2)\n apply (auto)\n done \n\nlemma dist_union_list_contain_split: \"\\ \\ list_contain la x; \\ list_contain lb x \\ \\ \\ list_contain (union_list la lb) x\" \n apply (auto)\n apply (cut_tac ?l1.0=\"la\" and ?l2.0=\"lb\" in dist_union_list_contain)\n apply (auto)\n done\n\nlemma dist_union_list_contain_split_ex: \"\\ list_contain (union_list la lb) x; list_contain la x \\ X; list_contain lb x \\ X \\ \\ X\" \n apply (auto)\n apply (cut_tac ?l1.0=\"la\" and ?l2.0=\"lb\" in dist_union_list_contain)\n apply (auto)\n done \n \nlemma dist_ut_list_contain: \"\\ list_contain (union_list (union_list (tvar_type_l x61) (tvar_type_l x61a))\n (union_list (union_list (tvar_type_l x62) (tvar_type_l x62a)) (tvar_eq_list list))) x \\ \\ list_contain (union_list (union_list\n (union_list (tvar_type_l x61) (tvar_type_l x62)) (union_list (tvar_type_l x61a) (tvar_type_l x62a))) (tvar_eq_list list)) x\" \n apply (rule_tac dist_union_list_contain_split_ex)\n apply (auto)\n apply (rule_tac union_list_contain1)\n apply (rule_tac la=\"tvar_type_l x61\" in dist_union_list_contain_split_ex)\n apply (auto)\n apply (rule_tac union_list_contain1)\n apply (rule_tac union_list_contain1)\n apply (simp)\n apply (rule_tac union_list_contain2)\n apply (rule_tac union_list_contain1)\n apply (simp)\n apply (rule_tac la=\"union_list (tvar_type_l x62) (tvar_type_l x62a)\" in dist_union_list_contain_split_ex)\n apply (auto)\n apply (rule_tac union_list_contain1)\n apply (rule_tac la=\"tvar_type_l x62\" in dist_union_list_contain_split_ex)\n apply (auto)\n apply (rule_tac union_list_contain1)\n apply (rule_tac union_list_contain2)\n apply (simp)\n apply (rule_tac union_list_contain2)\n apply (rule_tac union_list_contain2)\n apply (simp)\n apply (rule_tac union_list_contain2)\n apply (simp)\n done\n \nlemma dist_ut_list_contain_rev: \"\\ \\ list_contain (union_list (union_list\n (union_list (tvar_type_l x61) (tvar_type_l x62)) (union_list (tvar_type_l x61a) (tvar_type_l x62a))) (tvar_eq_list list)) x \\ \\\n \\ list_contain (union_list (union_list (tvar_type_l x61) (tvar_type_l x61a))\n (union_list (union_list (tvar_type_l x62) (tvar_type_l x62a)) (tvar_eq_list list))) x\"\n apply (auto)\n apply (simp add: dist_ut_list_contain)\n done\n \ndefinition utsr_res where\n \"utsr_res t_sub x = (x \\ type_sub_range t_sub \\ t_sub x = None)\"\n \nlemma unify_type_sub_range_ih: \"\\ unify_type c_list = Some (t_sub, p_eq); \\ list_contain (tvar_eq_list c_list) x \\ \\ utsr_res t_sub x\" \n apply (induct arbitrary: t_sub p_eq rule: wf_induct [where r=unify_rel])\n apply (simp add: unify_rel_def) \n apply (case_tac xa)\n apply (auto)\n apply (simp add: utsr_res_def)\n apply (simp add: type_sub_range_def)\n apply (simp add: empty_env_def)\n (* var case. delete *)\n apply (case_tac \"\\ a'. a = VarScheme a'\")\n apply (auto)\n apply (case_tac \"b = VarScheme a'\")\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (simp add: simp_unify_rel)\n apply (auto)\n apply (cut_tac ?l1.0=\"add_list [a'] a'\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain2)\n apply (auto)\n (* - occurs *)\n apply (case_tac \"occurs b a'\")\n apply (auto)\n (* - elim *)\n apply (case_tac \"unify_type (sol_subst_eq_list (add_env empty_env a' b) list)\")\n apply (auto)\n apply (erule_tac x=\"sol_subst_eq_list (add_env empty_env a' b) list\" in allE)\n apply (auto)\n apply (simp add: elim_unify_rel)\n apply (cut_tac a=\"a'\" and tau=\"b\" and c_list=\"list\" and x=\"x\" in dist_sol_subst_list_contain)\n apply (auto)\n apply (cut_tac ?l1.0=\"add_list (tvar_type_l b) a'\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain2)\n apply (auto)\n apply (cut_tac tau=\"b\" and x=\"x\" in occurs_list_contain_rev)\n apply (auto)\n apply (cut_tac ?l1.0=\"add_list (tvar_type_l b) a'\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (simp add: add_list_def)\n apply (simp add: utsr_res_def)\n apply (auto)\n apply (simp add: type_sub_range_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"a' = y\")\n apply (auto)\n apply (cut_tac a=\"x\" and t_sub=\"a\" and tau=\"b\" in sol_subst_tvar_type)\n apply (auto)\n apply (cut_tac tau=\"b\" and x=\"x\" in tvar_type_l_rel)\n apply (auto)\n apply (cut_tac ?l1.0=\"add_list (tvar_type_l b) y\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (simp add: add_list_def)\n apply (simp add: type_sub_range_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"list_contain (add_list (tvar_type_l b) x) x\")\n apply (cut_tac ?l1.0=\"add_list (tvar_type_l b) x\" and ?l2.0=\"tvar_eq_list list\" and x=\"x\" in union_list_contain1)\n apply (auto)\n apply (simp add: add_list_def)\n apply (case_tac \"list_contain (tvar_type_l b) x\")\n apply (auto)\n (* orient case *)\n apply (case_tac \"\\ b'. b = VarScheme b'\")\n apply (auto)\n apply (erule_tac x=\"(VarScheme b', a) # list\" in allE)\n apply (auto)\n apply (simp add: orient_unify_rel)\n apply (case_tac a)\n apply (auto)\n apply (simp add: orient_list_contain1)\n apply (simp add: orient_list_contain1)\n apply (simp add: orient_list_contain1)\n apply (simp add: orient_list_contain2)\n apply (simp add: orient_list_contain2)\n apply (simp add: orient_list_contain2)\n apply (simp add: orient_list_contain2)\n (* decomp case *)\n apply (case_tac a)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n (* - array case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x5, x5a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n (* - pair case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x61, x61a) # (x62, x62a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: dist_ut_list_contain_rev)\n apply (case_tac \"unify_type ((x61, x61a) # (x62, x62a) # list)\")\n apply (auto)\n (* - fun case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x71, x71a) # (x72, x72a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: dist_ut_list_contain_rev)\n apply (case_tac \"unify_type ((x71, x71a) # (x72, x72a) # list)\")\n apply (auto)\n (* - chan case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x81, x81a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (case_tac \"x82 = x82a\")\n apply (auto)\n done\n \nlemma unify_type_sub_range: \"\\ unify_type c_list = Some (t_sub, p_eq); \\ list_contain (tvar_eq_list c_list) x \\ \\ x \\ type_sub_range t_sub\" \n apply (cut_tac x=\"x\" and t_sub=\"t_sub\" in unify_type_sub_range_ih)\n apply (auto)\n apply (simp add: utsr_res_def)\n done\n\nlemma unify_type_sub_dom: \"\\ unify_type c_list = Some (t_sub, p_eq); \\ list_contain (tvar_eq_list c_list) x \\ \\ t_sub x = None\" \n apply (cut_tac x=\"x\" and t_sub=\"t_sub\" in unify_type_sub_range_ih)\n apply (auto)\n apply (simp add: utsr_res_def)\n done\n \nlemma unify_type_wf_sub: \"\\ unify_type c_list = Some (t_sub, p_eq) \\ \\ wf_sub t_sub\" \n apply (induct arbitrary: t_sub p_eq rule: wf_induct [where r=unify_rel])\n apply (simp add: unify_rel_def) \n apply (case_tac x)\n apply (auto)\n apply (simp add: wf_sub_def)\n apply (simp add: empty_env_def)\n (* var case. delete *)\n apply (case_tac \"\\ a'. a = VarScheme a'\")\n apply (auto)\n apply (case_tac \"b = VarScheme a'\")\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (simp add: simp_unify_rel)\n (* - occurs *)\n apply (case_tac \"occurs b a'\")\n apply (auto)\n (* - elim *)\n apply (case_tac \"unify_type (sol_subst_eq_list (add_env empty_env a' b) list)\")\n apply (auto)\n apply (erule_tac x=\"sol_subst_eq_list (add_env empty_env a' b) list\" in allE)\n apply (simp add: elim_unify_rel)\n apply (rule_tac add_wf_sub)\n apply (auto)\n apply (cut_tac t_sub=\"a\" and x=\"a'\" in unify_type_sub_range)\n apply (auto)\n apply (cut_tac x=\"a'\" and c_list=\"list\" in sol_subst_list_contain)\n apply (auto)\n (* orient case *)\n apply (case_tac \"\\ b'. b = VarScheme b'\")\n apply (auto)\n apply (erule_tac x=\"(VarScheme b', a) # list\" in allE)\n apply (simp add: orient_unify_rel)\n apply (case_tac a)\n apply (auto)\n (* decomp case *)\n apply (case_tac a)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n (* - array case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x5, x5a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n (* - pair case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x61, x61a) # (x62, x62a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (case_tac \"unify_type ((x61, x61a) # (x62, x62a) # list)\")\n apply (auto)\n (* - fun case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x71, x71a) # (x72, x72a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (case_tac \"unify_type ((x71, x71a) # (x72, x72a) # list)\")\n apply (auto)\n (* - chan case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x81, x81a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (case_tac \"x82 = x82a\")\n apply (auto)\n done\n \nlemma occurs_tvar_type: \"occurs tau x \\ x \\ tvar_type tau\" \n apply (induct tau)\n apply (auto)\n done\n \n (* \\x4a \\ x4; unify_type (sol_subst_eq_list (add_env empty_env x4a (VarScheme x4)) list) = Some (a, p_eq); perm_eq_sat p_sub p_eq;\n equiv_sub (subst_compose a t_sub') t_subx; t_subx x4a = None; type_eq_sat_f t_subx p_sub list; t_subx x4 = Some (VarScheme x4a)\\\n \\ equiv_sub (subst_compose (add_env a x4a (case a x4 of None \\ VarScheme x4 | Some tau \\ tau)) (add_env t_sub' x4 (VarScheme x4a))) t_subx *)\n \nlemma cancel_add_env: \"\\ env x = Some tau \\ \\ add_env env x tau = env\" \n apply (case_tac \"\\ y. add_env env x tau y = env y\") \n apply (auto)\n apply (simp add: add_env_def)\n apply (case_tac \"x = y\")\n apply (auto)\n done\n \nlemma add_sol_subst_type: \"\\ \\ occurs tau a \\ \\\n sol_subst_type (add_env t_sub a t) tau = sol_subst_type t_sub tau\" \n apply (induct tau)\n apply (auto)\n apply (simp add: add_env_def)\n done\n \nlemma comm_equiv_scheme: \"equiv_scheme tau tau' \\ equiv_scheme tau' tau\" \n apply (induct tau arbitrary: tau')\n apply (auto)\n done\n\nlemma trans_equiv_scheme: \"\\ equiv_scheme ta tb; equiv_scheme tb tc \\ \\ equiv_scheme ta tc\" \n apply (induct ta arbitrary: tb tc)\n apply (auto)\n done\n\nlemma perm_subst_equiv_scheme: \"\\ perm_subst_type p_sub tau = perm_subst_type p_sub tau' \\ \\ equiv_scheme tau tau'\" \n apply (induct tau arbitrary: tau') \n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n apply (case_tac tau')\n apply (auto)\n done\n \nlemma expand_subst_compose: \"sol_subst_type (subst_compose t_sub t_sub') tau = sol_subst_type t_sub' (sol_subst_type t_sub tau)\" \n apply (induct tau)\n apply (auto)\n apply (simp add: subst_compose_def)\n apply (case_tac \"t_sub x\")\n apply (auto)\n done\n \nlemma double_perm_subst_type: \"perm_subst_type p_sub tau = perm_subst_type p_sub (perm_subst_type p_sub tau)\" \n apply (induct tau)\n apply (auto)\n done\n \nlemma compose_perm_subst_type: \"perm_subst_type p_sub (sol_subst_type t_sub tau) = perm_subst_type p_sub (sol_subst_type (perm_compose p_sub t_sub) tau)\"\n apply (induct tau)\n apply (auto)\n apply (simp add: perm_compose_def)\n apply (case_tac \"t_sub x\")\n apply (auto)\n apply (rule_tac double_perm_subst_type)\n done \n \n (* say that we encounter constraint { a = b }. in our solution we want to select { a \\ b }, but the given solution selects { b \\ a }.\n we can translate one solution to the other by adding { b \\ a } to the composition. *)\nlemma add_compose_equiv_sub: \"\\ equiv_sub (perm_compose p_sub (subst_compose t_sub t_sub')) (perm_compose p_sub t_subx);\n apply_type_subst t_subx a = VarScheme a; t_subx b = Some (VarScheme a); a \\ b; wf_sub t_sub \\ \\\n equiv_sub (perm_compose p_sub (subst_compose (add_env t_sub a (VarScheme b)) (add_env t_sub' b (VarScheme a)))) (perm_compose p_sub t_subx)\" \n apply (simp add: equiv_sub_def)\n apply (auto)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (simp add: add_env_def)\n apply (auto)\n (* x = a *)\n apply (case_tac \"t_subx a\")\n apply (auto)\n (* x = b, there exists some c where t_sub: b \\ c, t_sub': c \\ x, where x is some var (meaning c is some var).\n whether b = c or not, the correct result follows\n *)\n apply (case_tac \"x = b\")\n apply (auto)\n apply (case_tac \"t_sub b\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"b\" in allE)\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n apply (simp add: add_env_def)\n (* otherwise, say t_sub: x \\ x. this case is unchanged by NEW t_sub' *)\n apply (case_tac \"t_sub x\")\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: add_env_def)\n (* say that b occurs in t_sub(x). for this to work, we want t_sub': b \\ a how can we show this? say that this was not the case.\n t_subx: b \\ a, which means that either t_sub: b \\ c and t_sub': c \\ a, OR t_sub: b \\ a.\n both are impossible since we can assume by construction of t_sub that it is \"well-formed\", namely that\n all variables with an assignment do not appear on the RHS of a substitution.\n *)\n apply (case_tac \"occurs aa b\")\n apply (case_tac \"t_sub' b \\ Some (VarScheme a)\")\n apply (case_tac \"t_sub b = None\")\n apply (erule_tac x=\"b\" in allE)\n apply (auto)\n apply (case_tac \"t_sub' b\")\n apply (auto)\n apply (case_tac aaa)\n apply (auto)\n apply (simp add: wf_sub_def)\n apply (erule_tac x=\"n\" in allE)\n apply (erule_tac x=\"b\" in allE)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac occurs_tvar_type)\n apply (auto)\n (* knowing that t_sub': b \\ a, t_sub' is unchanged *)\n apply (simp add: cancel_add_env)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n (* lastly, we can analyze the case where t_sub: x \\ anything else *)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"t_subx x\")\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: add_sol_subst_type)\n done\n \nlemma equiv_sub_type: \"\\ equiv_sub t_sub t_sub' \\ \\ sol_subst_type t_sub tau = sol_subst_type t_sub' tau\" \n apply (induct tau)\n apply (auto)\n apply (simp add: equiv_sub_def)\n done \n \nlemma as_perm_sol_subst_aff: \"sol_subst_perm p_sub (as_perm_s a) = as_perm (sol_subst_aff p_sub a)\" \n apply (case_tac a)\n apply (auto)\n apply (case_tac \"p_sub x2\")\n apply (auto)\n done \n \nlemma id_equiv_sub: \"equiv_sub t_sub t_sub\" \n apply (simp add: equiv_sub_def)\n done\n \nlemma comm_equiv_sub: \"equiv_sub t_sub t_sub' \\ equiv_sub t_sub' t_sub\" \n apply (simp add: equiv_sub_def)\n done \n \nlemma empty_subst_compose: \"subst_compose empty_env t_sub = t_sub\" \n apply (case_tac \"\\ x. subst_compose empty_env t_sub x = t_sub x\") \n apply (auto)\n apply (simp add: subst_compose_def)\n apply (simp add: empty_env_def)\n done\n \ndefinition uts_res where\n \"uts_res t_sub t_subx p_sub p_eq = ((\\ t_sub'. equiv_sub (perm_compose p_sub (subst_compose t_sub t_sub')) (perm_compose p_sub t_subx)) \\ perm_eq_sat p_sub p_eq)\" \n\n (* if unification returns successfully, and the constraint list is satisfiable, then the satisfying type substitution of the solution\n will be a specialization of the one returned by type substitution, and the permission substitution will satisfy p_eq *)\nlemma unify_type_sat: \"\\ unify_type c_list = Some (t_sub, p_eq); type_eq_sat t_subx p_sub c_list \\ \\ uts_res t_sub t_subx p_sub p_eq\"\n apply (induct arbitrary: t_sub p_eq rule: wf_induct [where r=unify_rel])\n apply (simp add: unify_rel_def)\n apply (case_tac x)\n apply (auto)\n apply (simp add: uts_res_def)\n apply (simp add: perm_eq_sat_def)\n apply (rule_tac x=\"t_subx\" in exI)\n apply (simp add: empty_subst_compose)\n apply (rule_tac id_equiv_sub)\n (* elim case *)\n apply (case_tac \"\\ a'. a = VarScheme a'\")\n apply (auto)\n (* - delete case *)\n apply (case_tac \"b = VarScheme a'\")\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n (* - occurs case *)\n apply (case_tac \"occurs b a'\")\n apply (auto)\n (* - standard case *)\n apply (case_tac \"unify_type (sol_subst_eq_list (add_env empty_env a' b) list)\")\n apply (auto)\n apply (erule_tac x=\"sol_subst_eq_list (add_env empty_env a' b) list\" in allE)\n apply (auto)\n apply (simp add: elim_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (auto)\n apply (simp add: intern_sol_subst_type_eq_sat)\n apply (simp add: uts_res_def)\n apply (auto)\n (* > say that t_subx a' = None (or to itself). since 'a = b, this would only be the case if b was another variable, and t_subx b = a' *)\n apply (case_tac \"apply_type_subst t_subx a' = VarScheme a'\")\n apply (simp add: type_eq_sat_def)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (case_tac \"t_subx x4\")\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n (* > say that t_sub doesn't map b. then t_sub(b) = b\n we know that [[ a o t_sub' = t_subx ]]. so then [[ a + { 'a: b } o t_sub' + { b: 'a } = t_subx ]] ('a = x4a, b = x4) *)\n apply (case_tac \"a x4\")\n apply (auto)\n apply (rule_tac x=\"add_env t_sub' x4 (VarScheme x4a)\" in exI)\n apply (cut_tac t_sub=\"a\" and t_sub'=\"t_sub'\" and t_subx=\"t_subx\" and a=\"x4a\" and b=\"x4\" and p_sub=\"p_sub\" in add_compose_equiv_sub)\n apply (auto)\n apply (rule_tac unify_type_wf_sub)\n apply (auto)\n (* > otherwise, we have t_sub mapping b to some variable c. *)\n apply (case_tac \"\\ (\\ c. a x4 = Some (VarScheme c))\")\n apply (simp add: equiv_sub_def)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (erule_tac x=\"x4\" in allE)\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n (* > say that c = a. this is impossible since then a would be in t_sub's range *)\n apply (case_tac \"c = x4a\")\n apply (cut_tac x=\"x4a\" and c_list=\"sol_subst_eq_list (add_env empty_env x4a (VarScheme x4)) list\" in unify_type_sub_range)\n apply (auto)\n apply (cut_tac x=\"x4a\" and c_list=\"list\" in sol_subst_list_contain)\n apply (auto)\n apply (simp add: type_sub_range_def)\n apply (erule_tac x=\"x4\" in allE)\n apply (auto)\n (* > we claim [[ a + { 'a: t_sub(b) = c } o t_sub' + { c: 'a } = t_subx ]] should work *)\n apply (rule_tac x=\"add_env t_sub' c (VarScheme x4a)\" in exI)\n apply (cut_tac t_sub=\"a\" and t_sub'=\"t_sub'\" and t_subx=\"t_subx\" and a=\"x4a\" and b=\"c\" in add_compose_equiv_sub)\n apply (auto)\n (* >> t_sub: c \\ c by well-formedness *)\n apply (case_tac \"a c \\ None\")\n apply (cut_tac c_list=\"sol_subst_eq_list (add_env empty_env x4a (VarScheme x4)) list\" and t_sub=\"a\" in unify_type_wf_sub)\n apply (auto)\n apply (simp add: wf_sub_def)\n apply (erule_tac x=\"c\" in allE)\n apply (auto)\n apply (erule_tac x=\"x4\" in allE)\n apply (auto)\n (* >> t_subx: c \\ a, since t_sub: b \\ c and t_subx: b \\ a, meaning t_sub': c \\ a *)\n apply (case_tac \"t_sub' c \\ Some (VarScheme x4a)\")\n apply (simp add: equiv_sub_def)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (erule_tac x=\"x4\" in allE)\n apply (auto)\n apply (case_tac \"t_sub' c\")\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n (* >> using equivalence to put these facts together *)\n apply (simp add: equiv_sub_def)\n apply (erule_tac x=\"c\" in allE)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (case_tac \"t_subx c\")\n apply (auto)\n apply (case_tac aa)\n apply (auto)\n apply (rule_tac unify_type_wf_sub)\n apply (auto)\n (* > otherwise, we know that t_subx(a') maps to something besides a'. we know that t_sub(a') = None,\n meaning that t_sub'(a') = t_subx(a'), meaning that we shouldn't have to change the mapping. *)\n apply (case_tac \"t_subx a'\")\n apply (auto)\n apply (rule_tac x=\"t_sub'\" in exI)\n apply (case_tac \"a a' \\ None\")\n apply (cut_tac t_sub=\"a\" and x=\"a'\" in unify_type_sub_dom)\n apply (auto)\n apply (cut_tac x=\"a'\" and tau=\"b\" and c_list=\"list\" in sol_subst_list_contain)\n apply (auto)\n apply (case_tac \"\\ perm_subst_type p_sub (apply_type_subst t_sub' a') = perm_subst_type p_sub aa\")\n apply (simp add: equiv_sub_def)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (erule_tac x=\"a'\" in allE)\n apply (auto)\n apply (case_tac \"t_sub' a'\")\n apply (auto)\n apply (simp add: equiv_sub_def)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (case_tac \"\\ equiv_sub (perm_compose p_sub (subst_compose a t_sub')) (perm_compose p_sub t_subx)\")\n apply (simp add: equiv_sub_def)\n apply (simp add: perm_compose_def)\n apply (simp add: subst_compose_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n (* >> we utilize the equations to show equality *)\n apply (simp add: type_eq_sat_def)\n apply (auto)\n apply (rule_tac t=\"sol_subst_type t_sub' (sol_subst_type a b)\" and s=\"sol_subst_type (subst_compose a t_sub') b\" in subst)\n apply (rule_tac expand_subst_compose)\n apply (cut_tac p_sub=\"p_sub\" and t_sub=\"subst_compose a t_sub'\" and tau=\"b\" in compose_perm_subst_type)\n apply (auto)\n apply (cut_tac p_sub=\"p_sub\" and t_sub=\"t_subx\" and tau=\"b\" in compose_perm_subst_type)\n apply (auto)\n (* >> we manipulate to activate this lemma concerning application of equivalent substitutions *)\n apply (rule_tac t=\"sol_subst_type (perm_compose p_sub (subst_compose a t_sub')) b\" and s=\"sol_subst_type (perm_compose p_sub t_subx) b\" in subst)\n apply (rule_tac equiv_sub_type)\n apply (rule_tac comm_equiv_sub)\n apply (auto)\n (* orient case *)\n apply (case_tac \"\\ b'. b = VarScheme b'\")\n apply (auto)\n apply (erule_tac x=\"(VarScheme b', a) # list\" in allE)\n apply (simp add: orient_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac a)\n apply (auto)\n (* decomp cases. primitives *) \n apply (case_tac a)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n (* - array case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x5, x5a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (simp add: type_eq_sat_def)\n (* - pair case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x61, x61a) # (x62, x62a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: type_eq_sat_def)\n apply (case_tac \"unify_type ((x61, x61a) # (x62, x62a) # list)\")\n apply (auto)\n apply (simp add: uts_res_def)\n apply (simp add: perm_eq_sat_def)\n (* - fun case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x71, x71a) # (x72, x72a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: type_eq_sat_def)\n apply (case_tac \"unify_type ((x71, x71a) # (x72, x72a) # list)\")\n apply (auto)\n apply (simp add: uts_res_def)\n apply (simp add: perm_eq_sat_def)\n apply (simp add: as_perm_sol_subst_aff)\n (* - chan case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x81, x81a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (simp add: type_eq_sat_def)\n done\n \n\nfun as_scheme where\n \"as_scheme IntTy = IntScheme\" \n| \"as_scheme UnitTy = UnitScheme\" \n| \"as_scheme BoolTy = BoolScheme\" \n| \"as_scheme (ArrayTy tau) = ArrayScheme (as_scheme tau)\" \n| \"as_scheme (PairTy t1 t2 r) = PairScheme (as_scheme t1) (as_scheme t2) (SPerm r)\" \n| \"as_scheme (FunTy t1 t2 r a) = FunScheme (as_scheme t1) (as_scheme t2) (SPerm r) (AffConst a)\" \n| \"as_scheme (ChanTy tau c_end) = ChanScheme (as_scheme tau) c_end\" \n \ndefinition indir_sub where\n \"indir_sub t_sub = (\\ x. case t_sub x of None \\ None | Some tau \\ Some (as_scheme tau))\" \n \nlemma cancel_perm_as_scheme: \"perm_subst_type p_sub (as_scheme tau) = as_scheme tau\" \n apply (induct tau)\n apply (auto)\n done\n \nlemma dir_perm_subst_type: \"\\ dir_subst_type t_sub p_sub tau tau' \\ \\\n perm_subst_type p_sub (sol_subst_type (indir_sub t_sub) tau) = as_scheme tau'\" \n apply (induct tau arbitrary: tau')\n apply (auto)\n apply (simp add: indir_sub_def)\n apply (rule_tac cancel_perm_as_scheme)\n done\n\nlemma dir_sol_type_eq_sat: \"\\ dir_sol_sat t_sub p_sub c_list \\ \\ type_eq_sat (indir_sub t_sub) p_sub (unify_subset c_list)\" \n apply (induct c_list)\n apply (auto)\n apply (simp add: type_eq_sat_def)\n apply (simp add: type_eq_sat_def)\n apply (case_tac a)\n apply (auto)\n apply (simp add: dir_perm_subst_type)\n done \n \nlemma dist_add_sol_subst_type: \"sol_subst_type t_sub (sol_subst_type (add_env empty_env a tau) tau') =\n sol_subst_type (add_env t_sub a (sol_subst_type t_sub tau)) tau'\"\n apply (induct tau')\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: empty_env_def)\n done\n \nlemma extern_sol_subst_type_eq_sat: \"\\ \\ occurs tau a; type_eq_sat t_sub p_sub (sol_subst_eq_list (add_env empty_env a tau) c_list) \\\n \\ type_eq_sat (add_env t_sub a (sol_subst_type t_sub tau)) p_sub ((VarScheme a, tau) # c_list)\" \n apply (simp add: type_eq_sat_def)\n apply (auto)\n apply (simp add: add_sol_subst_type)\n apply (simp add: add_env_def)\n apply (induct c_list)\n apply (auto)\n apply (simp add: dist_add_sol_subst_type)\n done\n (*\n sat 1: if type unification succeeds, and the constraint list is satisfiable, then our type substitution will be most general\n sat 2: if type unification succeeds, our type substitution will satisfy\n *)\n \nlemma unify_type_satx: \"\\ unify_type c_list = Some (t_sub, p_eq); perm_eq_sat p_sub p_eq \\ \\\n type_eq_sat t_sub p_sub c_list\"\n apply (induct arbitrary: t_sub p_eq rule: wf_induct [where r=unify_rel])\n apply (simp add: unify_rel_def)\n apply (case_tac x)\n apply (auto)\n apply (simp add: type_eq_sat_def)\n (* var case *)\n apply (case_tac \"\\ a'. a = VarScheme a'\")\n apply (auto)\n (* - delete case *)\n apply (case_tac \"b = VarScheme a'\")\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n (* - occurs case *)\n apply (case_tac \"occurs b a'\")\n apply (auto)\n (* - elim case *)\n apply (erule_tac x=\"sol_subst_eq_list (add_env empty_env a' b) list\" in allE)\n apply (simp add: elim_unify_rel)\n apply (case_tac \"unify_type (sol_subst_eq_list (add_env empty_env a' b) list)\")\n apply (auto)\n apply (rule_tac extern_sol_subst_type_eq_sat)\n apply (auto)\n (* orient case *)\n apply (case_tac \"\\ b'. b = VarScheme b'\")\n apply (auto)\n apply (erule_tac x=\"(VarScheme b', a) # list\" in allE)\n apply (simp add: orient_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac a)\n apply (auto)\n (* decomp case *)\n apply (case_tac a)\n apply (auto)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"list\" in allE)\n apply (auto)\n apply (simp add: simp_unify_rel)\n apply (simp add: type_eq_sat_def)\n (* - array case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x5, x5a) # list\" in allE)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (simp add: type_eq_sat_def)\n (* - pair case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x61, x61a) # (x62, x62a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x61\" and ?t2.0=\"x61a\" and ?s1.0=\"x62\" and ?s2.0=\"x62a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: perm_eq_sat_def)\n apply (case_tac \"unify_type ((x61, x61a) # (x62, x62a) # list)\")\n apply (auto)\n apply (simp add: type_eq_sat_def)\n (* - fun case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x71, x71a) # (x72, x72a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (cut_tac ?t1.0=\"x71\" and ?t2.0=\"x71a\" and ?s1.0=\"x72\" and ?s2.0=\"x72a\" and c_t=\"list\" in dist_ut_term_less_length)\n apply (simp add: tvar_total_def)\n apply (simp add: perm_eq_sat_def)\n apply (case_tac \"unify_type ((x71, x71a) # (x72, x72a) # list)\")\n apply (auto)\n apply (simp add: type_eq_sat_def)\n apply (auto)\n apply (simp add: as_perm_sol_subst_aff)\n apply (case_tac \"sol_subst_aff p_sub x74\")\n apply (auto)\n apply (case_tac \"sol_subst_aff p_sub x74a\")\n apply (auto)\n apply (case_tac \"sol_subst_aff p_sub x74a\")\n apply (auto)\n apply (case_tac \"sol_subst_aff p_sub x74a\")\n apply (auto)\n (* - chan case *)\n apply (case_tac b)\n apply (auto)\n apply (erule_tac x=\"(x81, x81a) # list\" in allE)\n apply (auto)\n apply (simp add: unify_rel_def)\n apply (simp add: tvar_total_def)\n apply (case_tac \"x82 = x82a\")\n apply (auto)\n apply (simp add: type_eq_sat_def)\n done\n\n\nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/SolverP1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.26520402387162323}} {"text": "(*<*)(*:maxLineLen=68:*)\nsection \\Lazy Streams\\\n\ntheory Stream\nimports inc.LNat inc.SetPcpo\nbegin\n\nsection \\The Datatype of Lazy Streams\\\n\ndefault_sort countable\n\n(* deletes the Rule \"1 = Suc 0\" *)\n declare One_nat_def[simp del]\n\n(* declare [[show_types]] *)\ntext \\\\discr u\\ lifts an arbitrary type \\'a\\ to the\n discrete \\pcpo\\ and the usual rest operator \\rt\\ on streams.\\\n(*>*)\nsection\\Streams\\ text\\\\label{sec:stream}\\\n\ntext\\The verification framework focus is based on the streams of \nmessages and stream processing functions. This section will shortly\nintroduce the implementation of streams in Isabelle and mention and\nexplain a few important functions and their properties. Some of \nthese will play a major role in the definition of \\glspl{sb} and \nothers will be used to ease the verification process of components.\nFor an in depth explanation I refer to \\cite{Stu16}.\\\n\ntext\\The stream domain in Isabelle is defined with the \\domain\\\ncommand provided by the \\HOLCF\\ package. This automatically\ninstantiates our type as a \\gls{pcpo}.\\\n\ndomain\n 'a stream = lscons (lshd::\"'a discr u\") (lazy srt::\"'a stream\") \n (infixr \"&&\" 65)\n\ntext\\The message type is lifted to a discrete \\gls{cpo} to generate\nthe same prefix order from FOCUS streams.\\\n\nsubsection\\Function over streams\\ text\\\\label{subsec:sfun}\\\n\ntext\\ The following table gives an overview about the main functions\ndefined for @{type stream}s. Some of them are introduced in detail \nfor their later usage in the Isabelle framework.\\\n\n(*<*)\n\n(* ----------------------------------------------------------------------- *)\nsection \\Signatures of Stream Processing Functions\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Continuous function from stream to stream and shortcut \nfor input and output of the same type:\\\ntype_synonym ('in, 'out) spf = \"('in stream \\ 'out stream)\"\ntype_synonym 'm spfo = \"('m, 'm) spf\"\n\ntext \\Same for general SPFs which are not continuous by definition:\\\ntype_synonym ('in, 'out) gspf = \"('in stream \\ 'out stream)\"\ntype_synonym 'm gspfo = \"('m, 'm) gspf\"\n\ntext \\Again for list processing functions:\\\ntype_synonym ('in, 'out) lpf = \"('in list \\ 'out list)\"\ntype_synonym 'm lpfo = \"('m, 'm) lpf\"\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Some abbreviations\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\The empty stream is denoted as \\\\\\.\\\nabbreviation\n sbot :: \"'a stream\" (\"\\\")\n where \"sbot \\ \\\"\n\ntext \\@{term stake}: This operator is generated by the \\domain\\\n command. It retrieves the first \\n\\ elements of a stream\n (or less, if the stream is shorter).\\\nabbreviation\n stake :: \"nat \\ 'a spfo\"\n where \"stake \\ stream_take\"\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\Common functions on streams\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Conversion of function with lifted values to a partial function:\\\ndefinition fup2map :: \"('a \\ 'b::cpo u) \\ ('a \\ 'b)\" where\n\"fup2map f a \\ if (f a = \\) then None else Some (SOME x. up\\x = f a)\" \n\ntext \\@{term sup'}: Construct a stream by a single element.\\\ndefinition sup' :: \"'a \\ 'a stream\" (\"\\_\" [1000] 999) where\n\"sup' a \\ updis a && \\\"\n\ntext \\@{term sconc}: Concatenate two streams over the same type.\n For infinite streams, arbitrary other streams can be appended\n without changing the stream.\\\ndefinition sconc :: \"'a stream \\ 'a spfo\" where\n\"sconc \\ fix\\(\\ h. (\\ s1. \\ s2. \n if s1 = \\ then s2 else (lshd\\s1) && (h (srt\\s1)\\s2)))\"\n\nabbreviation sconc_abbr :: \"'a stream \\ 'a stream \\ 'a stream\" (\"(_ \\ _)\" [66,65] 65)\nwhere \"s1 \\ s2 \\ sconc s1\\s2\"\n\ntext \\@{term shd}: Retrieve the first element of a stream.\n For \\\\\\, the result is not defined.\\\ndefinition shd :: \"'a stream \\ 'a\" where\n\"shd s \\ THE a. lshd\\s = updis a\"\n\ntext \\@{term slookahd}: Apply function to head of stream.\n If the stream is empty, \\\\\\ is returned.\n This function is especially useful for defining own stream-processing\n functions.\\\ndefinition slookahd :: \"'a stream \\ ('a \\ 'b) \\ ('b::pcpo)\" where\n\"slookahd \\ \\ s f. if s = \\ then \\ else f (shd s)\" \n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Conversion of lists to streams and induced order on lists\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Lists can be converted to streams by the function @{term list2s}:\\\n\nprimrec list2s :: \"'a list \\ 'a stream\"\nwhere\n list2s_0: \"list2s [] = \\\" |\n list2s_Suc: \"list2s (a#as) = updis a && (list2s as)\"\n\nabbreviation stream_abbrev :: \"'a list \\ 'a stream\" (\"<_>\" [1000] 999)\nwhere \" == list2s l\"\n\ntext \\The data type \\list\\ is a partial order with the operator \n \\\\\\ derived from streams:\\\ninstantiation list :: (countable) po\nbegin\n\n definition sq_le_list:\n \"s \\ t \\ (list2s s \\ list2s t)\"\n\n (* list2s is a bijection *)\n lemma list2s_inj[simp]: \"(list2s l = list2s l') = (l = l')\"\n apply (rule iffI)\n apply (simp add: atomize_imp)\n apply (rule_tac x=\"l'\" in spec)\n apply (induct l, simp)\n apply (rule allI)\n apply (induct_tac x, simp+)\n apply (rule allI)\n by (induct_tac x, simp+)\n\ninstance\napply (intro_classes)\napply (simp add: sq_le_list)+\napply (rule_tac y=\"list2s y\" in below_trans,assumption+)\napply (simp add: sq_le_list)\napply (rule list2s_inj [THEN iffD1])\nby (rule po_eq_conv [THEN iffD2],rule conjI,assumption+)\n\nend\n\n\n(* ----------------------------------------------------------------------- *)\ntext \\Typical functions known from lists:\\\n(* ----------------------------------------------------------------------- *)\n(*>*)\n\nsubsubsection\\Length of Streams\\\n\ntext \\@{term slen}: Retrieve the length of a stream. It is defined\nas the number of its elements or \\\\\\ for infinite streams.\\\n\ndefinition slen:: \"'a stream \\ lnat\" where\n\"slen \\ fix\\(\\ h. strictify\\(\\ s. lnsuc\\(h\\(srt\\s))))\"\n\ntext\\Resulting from the prefix order, a few key properties can be \nformulated using the length. One of these is an equality property:\nIf two streams are in an order and have the same length, there are \nequal. Abbreviation \\#\\ is used for obtaining the length of a \nstream.\\\n\nabbreviation slen_abbr :: \"'a stream \\ lnat\" (\"#_\" [1000] 999)\nwhere \"#s == slen\\s\"\n\n(*<*)\n\ntext \\@{term sdrop}: Remove the first \\n\\ elements\n of the stream.\\\ndefinition sdrop :: \"nat \\ 'a spfo\" where\n\"sdrop n \\ Fix.iterate n\\srt\"\n\n(*>*)\nsubsubsection\\Stream elements\\\n\ntext\\The element of a stream at position \\n\\ can be accessed by\ndropping the first \\n\\ elements of the stream. We start counting\npositions at 0.\\\n\ndefinition snth :: \"nat \\ 'a stream \\ 'a\" where\n\"snth k s \\ shd (sdrop k\\s)\" \n\ntext\\Obtaining the elements of a stream with @{const snth} is often\nused in the verification process of components behaviour.\\\n\n(*<*)\ntext\\@{term sfoot}: Get the last element of a not empty, finite stream\\\ndefinition sfoot :: \"'a stream \\ 'a\" where\n\"sfoot s = snth (THE a. lnsuc\\(Fin a) = #s) s\"\n(*>*)\n\nsubsubsection\\A Streams Values\\\n\ntext \\The values of a stream are a set of messages of type \\'a\\ that\noccur at any position in the stream.\\\n\ndefinition sValues :: \"'a stream \\ 'a set\" where\n\"sValues \\ \\ s. {snth n s | n. Fin n < #s}\" \n\ntext\\The definition of @{const sValues} is straight forward with the\nusage of @{const snth}.\\\n\n(*<*)\ntext \\@{term sntimes}: Repeat the given stream \\n\\ times.\\\ntext \\(Only listed as a constant below for reference;\n Use \\sntimes\\ with same signature instead).\\\n(* consts sntimes_ :: \"nat \\ 'a stream \\ 'a stream\" *)\n\ntext \\@{term sinftimes}: Concatenate a stream infinitely often to itself.\\\ndefinition sinftimes :: \"'a stream \\ 'a stream\" (\"_\\<^sup>\\\") where\n \"sinftimes \\ fix\\(\\ h. (\\s. \n if s = \\ then \\ else (s \\ (h s))))\" \n(*>*) \nsubsubsection\\Applying functions element wise\\\n\ntext \\Similar to @{const map} on lists we can define a mapping that\napplies a function to each element of a stream. The \\n\\th element of\nthe output stream is equal to applying the mapping function to the\n\\n\\th element of the input stream.\\\n\ndefinition smap:: \"('a \\ 'b) \\ 'a stream \\ 'b stream\" where\n\"smap f \\ fix\\(\\ h s. slookahd\\s\\(\\ a. \n \\(f a) \\ (h\\(srt\\s))))\"\n\ntext\\An automatons semantic can sometimes be represented by a \n@{const smap} mapping.\\\n\n(*<*)\ntext \\@{term sfilter}: Remove all elements from the stream which are\n not included in the given set.\\\ndefinition sfilter :: \"'a set \\ 'a spfo\" where\n\"sfilter M \\ fix\\(\\ h s. slookahd\\s\\(\\ a. \n (if (a \\ M) then \\a \\ (h\\(srt\\s)) else h\\(srt\\s))))\"\n\ntext \\@{term stakewhile}: Take the first elements of a stream as\n long as the given function evaluates to \\true\\.\\\ndefinition stakewhile :: \"('a \\ bool) \\ 'a spfo\" where\n\"stakewhile f \\ fix\\(\\ h s. slookahd\\s\\(\\ a. if (f a) then \\a \\ h\\(srt\\s) else \\))\"\n\ntext \\@{term sdropwhile}: Drop the first elements of a stream as\n long as the given function evaluates to \\true\\.\\\ndefinition sdropwhile :: \"('a \\ bool) \\ 'a spfo\" where\n\"sdropwhile f \\ fix\\(\\ h s. slookahd\\s\\(\\ a. \n if (f a) then h\\(srt\\s) else s))\"\n\ntext \\Two streams can be combined into one stream by using tuples as elements.\\\n\ntext \\@{term szip}: Zip two streams into one stream.\\\ndefinition szip :: \"'a stream \\ 'b stream \\ ('a \\ 'b) stream\" where\n \"szip \\ fix\\(\\ h s1 s2. slookahd\\s1\\(\\ a. slookahd\\s2\\(\\ b.\n \\(a,b) \\ (h\\(srt\\s1)\\(srt\\s2)))))\"\n\ntext\\Takes a function and 2 streams, merges the 2 streams according to the function\\\ndefinition merge:: \"('a \\ 'b \\ 'c) \\ 'a stream \\ 'b stream \\ 'c stream\" where\n\"merge f \\ \\ s1 s2 . smap (\\ s3. f (fst s3) (snd s3))\\(szip\\s1\\s2)\"\n\ntext \\@{term sprojfst}: Access the first stream of two zipped streams.\\\ndefinition sprojfst :: \"(('a \\ 'b),'a) spf\" where\n\"sprojfst \\ \\ x. smap fst\\x\"\n\ntext \\@{term sprojsnd}: Access the second stream of two zipped streams.\\\ndefinition sprojsnd :: \"(('a \\ 'b),'b) spf\" where\n\"sprojsnd \\ \\ x. smap snd\\x\"\n\ntext \\The following two functions are \"delayed\" variants\n of @{term stakewhile} and @{term sdropwhile}.\\\n\ntext \\@{term stwbl}: Take while predicate holds but also keep\n first element violating condition.\\\ndefinition stwbl :: \"('a \\ bool) \\ 'a spfo\" where\n\"stwbl f \\ fix\\(\\ h s. slookahd\\s\\(\\ a. \n if (f a) then \\a \\ h\\(srt\\s) else \\a))\"\n\ntext \\@{term srtdw}: Rest (\\srt\\) of stream after dropwhile.\\\ndefinition srtdw :: \"('a \\ bool) \\ 'a spfo\" where\n\"srtdw f \\ \\ x. srt\\(sdropwhile f\\x)\"\n\ntext \\@{term srcdups}: Remove successive duplicate values from stream.\\\ndefinition srcdups :: \"'a spfo\" where\n\"srcdups \\ fix\\(\\ h s. slookahd\\s\\(\\ a. \n \\a \\ h\\(sdropwhile (\\ z. z = a)\\(srt\\s))))\"\n\n(* Takes a nat indicating the number of elements to scan, a reducing\n function, an initial initial element, and an input stream. Returns\na stream consisting of the partial reductions of the input stream.*)\nprimrec SSCANL::\n\"nat \\ ('o \\ 'i \\ 'o) \\ 'o \\ 'i stream \\ 'o stream\" where\n SSCANL_zero_def: \"SSCANL 0 f q s = \\\" |\n \"SSCANL (Suc n) f q s = (if s=\\ then \\ \n else \\(f q (shd s)) \\ \n (SSCANL n f (f q (shd s)) (srt\\s)))\"\n\ntext \\@{term sscanl}: Apply a function elementwise to the input\nstream. Behaves like \\map\\, but also takes the previously generated\noutput element as additional input to the function. For the first \ncomputation, an initial value is provided.\\\ndefinition sscanl :: \"('o \\ 'i \\ 'o) \\ 'o \\ ('i, 'o) spf\" where\n\"sscanl f q \\ \\ s. \\i. SSCANL i f q s\"\n(*>*)\n\n(*<*)\n(* scanline Advanced :D *)\n(* or stateful ... *)\n(* The user has more control. Instead of the last output ('b) a \nstate ('s) is used as next input *)\ndefinition sscanlA ::\n \"('s \\'a \\ ('b \\'s)) \\ 's \\ 'a stream \\ 'b stream\" where\n\"sscanlA f s0 \\ \\ s. sprojfst\\(sscanl (\\(_,b). f b) (undefined, s0)\\s)\"\n(*>*)\nsubsubsection\\Applying state-based functions element wise\\\n\ntext\\One can also apply a state dependent function, like the \ntransition function of a deterministic automaton, to process the\nstreams elements. The \\n+1\\th output element then depends on the \n\\n\\th ouput state, because the state based function may act \ndifferently depending on its state. Hence, we also need an initial \nstate to start computing the output.\\\n\ndefinition sscanlAg ::\n\"('s \\'a \\ ('s \\'b)) \\ 's \\ 'a stream \\ ('s\\'b) stream\" where\n\"sscanlAg f s0 \\ \\ s. (sscanl (\\(b,_). f b) (s0, undefined)\\s)\"\n\ntext\\We first defined the general state-based @{const sscanlAg}.\nThe definition calls @{const sscanl} internally, @{const sscanl}\ncomputes the output of each element depending on the input and the \noutput of the last element. Likewise, it needs an initial output \nelement it starts with. The general state-based function however \nonly needs the previous output state, not the whole output.\\\n\ntext\\Since the semantic of an deterministic automaton does not \nreturn its states in each step but behaves similar in other cases,\nwe define another state-based function, that calls @{const sscanlAg}\nbut reduces its output to the message output stream. Hence, the \nstate stream is omitted.\\ \n\ndefinition %invisible sscanlAfst ::\n\"('s \\'a \\ ('s\\'b)) \\ 's \\ 'a stream \\ 's stream\" where\n\"sscanlAfst f s0 \\ \\ s. sprojfst\\(sscanlAg f s0\\s)\"\n\ndefinition sscanlAsnd ::\n\"('s \\'a \\ ('s \\'b)) \\ 's \\ 'a stream \\ 'b stream\" where\n\"sscanlAsnd f s0 \\ \\ s. sprojsnd\\(sscanlAg f s0\\s)\"\n\ntext\\A deterministic automatons semantic can then be represented by\na @{const sscanlAsnd} mapping.\\ \n(*<*)\n(*\ndefinition sscanlAg :: \"('s \\'a::countable \\ ('s::countable \\'b::countable)) \\'s \\ 'a stream \\ ('s\\'b) stream\" where\n\"sscanlAg f s0 \\ \\ s. (sscanl (\\(b,_). f b) (s0, undefined)\\s)\"\n\ndefinition sscanlAsnd :: \"('s \\'a::countable \\ ('s::countable \\'b::countable)) \\ 's \\ 'a stream \\ 'b stream\" where\n\"sscanlAsnd f s0 \\ \\ s. sprojsnd\\(sscanlAg f s0\\s)\"\n\ndefinition sscanlAfst :: \"('s \\'a::countable \\ ('s::countable \\'b::countable)) \\'s \\ 'a stream \\ 's stream\" where\n\"sscanlAfst f s0 \\ \\ s. sprojfst\\(sscanlAg f s0\\s)\"\n*)\ntext \\@{term siterate}: Create a stream by repeated application of\n a function to an element. The generated stream starts with \\a\\,\n \\f(a)\\, \\f(f(a))\\, and so on.\\\ndefinition siterate :: \"('a \\ 'a) \\ 'a \\ 'a stream\" where\n\"siterate f (a::'a) \\ \\a \\ sscanl (\\a (b::'a). f a) a\\(SOME x. #x = \\)\"\n\ntext \\Alternative definition similar to @{term siterate},\nit is more general than @{term siterate}\\\ndefinition siterateBlock:: \"('a stream \\ 'a stream) \\ 'a stream \\ 'a stream\" where\n\"siterateBlock f \\ fix \\ (\\ h. (\\s. s \\ (h (f s))))\"\n\n\n(* ----------------------------------------------------------------------- *)\ntext \\Conversion between lists and streams and the processing functions:\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\@{term list2s}: Convert a list to a (finite) stream.\\\ntext \\(Only listed as a constant below for reference;\n Use \\list2s\\ with same signature instead).\\\n(* consts list2s_ :: \"'a list \\ 'a stream\" *)\n\ntext \\@{term s2list}: Convert a stream to a list. Result for\n infinite streams is undefined.\\\ndefinition s2list :: \"'a stream \\ 'a list\" where\n\"s2list s \\ if #s \\ \\ then SOME l. list2s l = s else undefined\"\n\ntext \\@{term slpf2spf}: Convert a list-processing function to a\n stream-processing function.\\\ndefinition slpf2spf ::\"('in,'out) lpf \\ ('in,'out) spf\" where\n\"slpf2spf f \\ \n if monofun f \n then \\ s. (\\k. list2s (f (s2list (stake k\\s)))) \n else undefined\"\n\ntext \\@{term sislivespf}: Liveness predicate for SPFs. A SPF\n is considered live if all finite inputs are mapped to finite outputs.\\\ndefinition sislivespf ::\"('in,'out) spf \\ bool\" where\n\"sislivespf f \\ (\\x. #(f\\x) = \\ \\ #x = \\)\"\n\ntext \\@{term sspf2lpf}: Convert a stream-processing function\n to a list-processing function.\\\ndefinition sspf2lpf ::\"('in,'out) spf \\ ('in,'out) lpf\" where\n\"sspf2lpf f \\ if sislivespf f then (\\x. s2list (f\\(list2s x))) else undefined\"\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Syntactic sugar and helpers\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\The following abbreviations define infix and prefix operators\n for a more intuitive usage.\\\n\nabbreviation sfilter_abbr :: \"'a set \\ 'a stream \\ 'a stream\" (\"(_ \\ _)\" [66,65] 65)\nwhere \"F \\ s \\ sfilter F\\s\"\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Definition of stream manipulating functions\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\In this section, the definitions for the previously\n declared functions are given.\\\n\ntext \\A typical procedure is to define a primary recursive function\n first and then define the stream-processing via the least upper\n bound of the function values for the prefixes of a stream.\\\n\n(* concatenates a stream to itself n times *)\nprimrec sntimes :: \"nat \\ 'a stream \\ 'a stream\" where\n \"sntimes 0 s = \\\" |\n \"sntimes (Suc n) s = (sconc s)\\(sntimes n s)\"\n \n(* Abbreviation for sntimes *)\nabbreviation sntimes_abbr :: \"nat \\ 'a stream \\ 'a stream\" (\"_\\_\" [60,80] 90)\nwhere \"(n \\ s) == (sntimes n s)\"\n\ntext \\In most cases, stream-processing functions or operators\n on streams are defined using the continuous fixed point operator.\\\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\Stream - basics\\\n(* --------------------------------------\\--------------------------------- *)\n\ntext \\In the following, lemmas on streams and their operators\n are proven. In most cases, the stated lemma is shortly summarized\n in natural language. Where this is not the case, the lemma\n itself is mostly self-explanatory.\\\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Fundamental properties of @{term stake}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Some aliases of auto-generated lemmas are introduced:\\\nlemmas scases' = stream.exhaust\nlemmas sinjects' = stream.injects\nlemmas sinverts' = stream.inverts\n\ntext \\Each stream is the least upper bound of its prefixes.\n As we we are in a CPO, upper bounds of chains always exist.\\\nlemma reach_stream: \"(\\i. stake i\\s) = s\"\napply (rule stream.take_lemma [OF spec [where x=s]])\napply (induct_tac n, simp, rule allI)\napply (rule_tac y=x in scases', simp)\napply (subst lub_range_shift [where j=\"Suc 0\", THEN sym],simp+)\nby (subst contlub_cfun_arg [THEN sym], auto)\n\n(* if two streams xs and ys are identical for any prefix that is a multiple of y long, then the two\n streams are identical for any prefix *)\nlemma gstake2stake: assumes \"\\i. stake (i*y)\\xs = stake (i*y)\\ys\" and \"y\\0\"\n shows \"\\i. stake i\\xs = stake i\\ys\"\nproof \n fix i\n obtain k where \"\\l. k = y*l\" and \"k\\i\" by (metis One_nat_def Suc_le_eq assms(2) gr0I mult.commute mult_le_mono2 nat_mult_1_right)\n thus \"stake i\\xs = stake i\\ys\" by (metis assms(1) min_def mult.commute stream.take_take) \nqed\n\n(* stake is monotone *)\nlemma stake_mono: assumes \"i\\j\"\n shows \"stake i\\s \\ stake j\\s\"\nby (metis assms min_def stream.take_below stream.take_take)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Construction by concatenation and more\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Basic properties of \\\\_\\ constructor\\\n\n(* shd composed with \\ is the identity. *)\n\n\nlemma [simp]: \"<[a]> = \\a\"\n by(simp add: sup'_def)\n\n(* the singleton stream is never equal to the empty stream *)\nlemma [simp]: \"\\a \\ \\\"\nby (simp add: sup'_def)\n\n(* the rest of the singleton stream is empty *)\nlemma [simp]: \"srt\\(\\a) = \\\"\nby (simp add: sup'_def)\n\ntext \\ Basic properties of concatenation \\\nlemma reduce_seq: (*never simp*)\n assumes \"s1 = s2\"\n shows \"s \\ s1 = s \\ s2\"\n by (simp add: assms)\n\n(* the empty stream is the identity element with respect to concatenation *)\nlemma sconc_fst_empty[simp]:\"\\ \\ s = s\"\napply (subst sconc_def [THEN fix_eq2])\nby (simp add: cont2cont_LAM)\n\n(* the lazy stream constructor and concatenation are associative *) \nlemma sconc_scons': \"(updis a && as) \\ s = updis a && (as \\ s)\"\napply (subst sconc_def [THEN fix_eq2])\nby (simp add: cont2cont_LAM)\n\n(* the lazy stream constructor is equivalent to concatenation with a singleton stream *)\nlemma lscons_conv: \"updis a && s = \\a \\ s\"\napply (subst sconc_def [THEN fix_eq2])\napply (simp add: sup'_def)\nby (simp add: cont2cont_LAM)\n\n(* concatenation with respect to singleton streams is associative *)\nlemma sconc_scons[simp]: \"(\\a \\ as) \\ s = \\a \\ (as \\ s)\"\napply (subst sconc_def [THEN fix_eq2])\nby (simp add: sconc_scons' sup'_def cont2cont_LAM)\n\ntext \\If a predicate P holds for empty and non-empty streams, it holds for all streams\\\nlemma scases [case_names bottom scons]: \"\\x P. \\x = \\ \\ P; \\a s. x = \\a \\ s \\ P\\ \\ P\"\napply (rule_tac y=x in scases', simp+)\napply (rule_tac p=u in upE, simp+)\napply (case_tac \"xa\")\nby (auto simp add: sup'_def sconc_scons')\n\n(* Single element streams commute with the stake operation. *)\nlemma stake_Suc[simp]: \"stake (Suc n)\\(\\a \\ as) = \\a \\ stake n\\as\"\nby (simp add: sconc_scons' sup'_def)\n\n(* see also sconc_fst_empty *)\nlemma sconc_snd_empty[simp]: \"s \\ \\ = s\"\napply (rule stream.take_lemma [OF spec [where x = \"s\"]])\napply (induct_tac n, simp)\napply (rule allI, simp)\nby (rule_tac x=x in scases, simp+)\n\n(* shd is the inverse of prepending a singleton *)\nlemma shd1[simp]: \"shd (\\a \\ s) = a\"\nby (simp add: sconc_scons' shd_def sup'_def)\n\n(* prepending an element a to a stream and extracting it with lshd is equivalent to imposing the\n discrete order on a *)\nlemma lshd_updis [simp]: \"lshd\\(\\a \\ s) = updis a\"\nby (metis lscons_conv stream.sel_rews(4))\n\n(* srt is the inverse of appending to a singleton *)\nlemma [simp]: \"srt\\(\\a\\as) = as\"\nby (simp add: sconc_scons' sup'_def)\n\n(* appending to a singleton is monotone *)\nlemma [simp]: \"\\a \\ \\a \\ s\"\napply (subst sconc_snd_empty [of \"\\a\", THEN sym])\nby (rule monofun_cfun_arg, simp)\n\ntext \\Properties of discrete partial orders\\\n\n(* updis is a bijection *)\nlemma updis_eq: \"(updis a = updis b) = (a = b)\"\nby simp\n\n(* the discrete order only considers equal elements to be ordered *)\nlemma updis_eq2: \"(updis a \\ updis b) = (a = b)\"\nby simp\n\ntext \\Mapping a stream to head and rest is injective\\\nlemma inject_scons: \"\\a \\ s1 = \\b \\ s2 \\ a = b \\ s1 = s2\"\napply (subst updis_eq [THEN sym])\napply (rule sinjects' [THEN iffD1], simp)\nby (simp add: sconc_scons' sup'_def)\n\ntext \\\\\\\\ applied to head and rest\\\nlemma less_all_sconsD: \"\\a \\ as \\ \\b \\ bs \\ a = b \\ as \\ bs\"\napply (subst updis_eq2 [THEN sym])\napply (rule sinverts' [THEN iffD1], simp)\nby (simp add: sconc_scons' sup'_def)\n\n(* appending to a singleton stream can never yield the empty stream *)\nlemma [simp]: \"\\ \\ \\a \\ as\"\napply (rule ccontr, simp)\napply (drule po_eq_conv [THEN iffD1])\napply (erule conjE)\nby (simp add: sconc_scons' sup'_def)\n\n(* appending to a singleton stream can never yield the empty stream *)\nlemma [simp]: \"\\a \\ as \\ \\\"\nby (rule notI, drule sym, simp)\n\ntext \\Characterizations of equality with \\\\\\, head and rest\\\n\n(* singleton streams are only in an ordered relation if the two elements are equal *)\nlemma [simp]: \"(\\a \\ \\b) = (a = b)\"\napply (rule iffI)\nby (insert less_all_sconsD [of a \\ b \\], simp+)\n\n(* length of a stream is smaller than length of this stream concatenated with another stream *)\nlemma [simp]: \"#as \\ #(as \\ ys)\"\n by (metis minimal monofun_cfun_arg sconc_snd_empty)\n\n(* uparrow is a bijection *)\nlemma [simp]: \"(\\a = \\b) = (a = b)\"\napply (rule iffI)\nby (insert inject_scons [of a \\ b \\], simp+)\n\n(* appending a stream x to a singleton stream and producing another singleton stream implies that \n the two singleton streams are equal and x was empty *)\nlemma [simp]: \"(\\a \\ x = \\c) = (a = c \\ x = \\)\"\nby (rule iffI, insert inject_scons [of a x c \\], simp+)\n\n(* of course we can also swap the expressions to the left and right of the equality sign *)\nlemma [simp]: \"(\\c = \\a \\ x) = (a = c \\ x = \\)\"\nby (rule iffI, insert inject_scons [of c \\ a x], simp+)\n\n(* if an appended stream x to a singleton stream is in relation with another singleton stream, this implies that \n a and b are equal and x was empty *)\nlemma [simp]: \"(\\a \\ x \\ \\b) = (a = b \\ x = \\)\" \nby (rule iffI, insert less_all_sconsD [of a x b \\], simp+)\n\n(* if a singleton stream is the prefix of another stream then the heads of the two streams must match *)\nlemma [simp]: \"(\\a \\ \\b \\ x) = (a = b)\" \nby (rule iffI, insert less_all_sconsD [of a \\ b x], simp+)\n\n(* if x isn't empty then concatenating head and rest leaves the stream unchanged *)\nlemma surj_scons: \"x\\\\ \\ \\(shd x) \\ (srt\\x) = x\"\nby (rule_tac x=x in scases, simp+)\n\n(* the head of ordered streams are equal *)\nlemma below_shd: \"x \\ y \\ x \\ \\ \\ shd x = shd y\"\n by (metis below_bottom_iff less_all_sconsD surj_scons)\n\n(* the head of ordered streams are equal *)\nlemma below_shd_alt: \"x \\ y \\ x \\ \\ \\ shd y = shd x\"\n using below_shd by fastforce\n\ntext \\Characterizations of \\\\\\ with head and rest\\\n\n(* any nonempty prefix of a stream y is still a prefix when ignoring the first element *)\nlemma less_fst_sconsD: \"\\a \\ as \\ y \\ \\ry. y = \\a \\ ry \\ as \\ ry\"\napply (rule_tac x=y in scases, simp+) \napply (rule_tac x=\"s\" in exI)\nby (drule less_all_sconsD, simp)\n\n(* the prefix of any non-empty stream is either empty or shares the same first element *)\nlemma less_snd_sconsD: \n \"x \\ \\a\\as \\ (x = \\) \\ (\\rx. x = \\a\\rx \\ rx \\ as)\"\napply (rule_tac x=x in scases, simp+) \napply (rule_tac x=\"s\" in exI)\nby (drule less_all_sconsD, simp)\n\n(* semantically equivalent to less_fst_sconsD *)\nlemma lessD: \n \"x \\ y \\ (x = \\) \\ (\\a q w. x = \\a\\q \\ y = \\a\\w \\ q \\ w)\"\napply (rule_tac x=x in scases, simp+) \napply (rule_tac x=\"a\" in exI)\napply (rule_tac x=\"s\" in exI, simp)\nby (drule less_fst_sconsD, simp)\n\n(* if ts is a prefix of xs and ts is not bottom, then lshd\\ts is equal to lshd\\xs *)\nlemma lshd_eq: \"ts\\xs \\ ts\\\\ \\ lshd\\ts = lshd\\xs\"\n using lessD by fastforce\n \n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term slen}\\\n(* ----------------------------------------------------------------------- *)\n\n(* the length of the empty stream is zero *)\nlemma strict_slen[simp]:\"#\\ = 0\"\nby (subst slen_def [THEN fix_eq2], simp add: lnzero_def)\n\n(* prepending a singleton stream increases the length by 1 *)\nlemma slen_scons[simp]: \"#(\\a\\as) = lnsuc\\(#as)\" \nby (subst slen_def [THEN fix_eq2], simp add: lnle_def)\n\n(* the singleton stream has length 1 *)\nlemma [simp]: \"#(\\a) = Fin (Suc 0)\"\napply (subst sconc_snd_empty [of \"\\a\", THEN sym])\nby (subst slen_scons, simp+)\n\ntext \\The rest of infinite streams is infinite as well\\\nlemma inf_scase:\"#s = \\ \\ \\a as. s = \\a \\ as \\ #as = \\\"\nby (rule_tac x=s in scases, auto)\n \n(* only the empty stream has length 0 *)\nlemma slen_empty_eq[simp]: \"(#x = 0) = (x = \\)\"\nby (rule_tac x=x in scases, auto)\n\ntext \\Appending to an inifite stream does not change its \\n\\th element\\\nlemma sconc_fst_inf_lemma: \"\\x. #x=\\ \\ stake n\\(x\\y) = stake n\\x\"\napply (induct_tac n, auto)\nby (rule_tac x=x in scases, auto)\n\ntext \\Appending to an infinite stream does not change the stream\\\nlemma sconc_fst_inf[simp]: \"#x=\\ \\ x\\y = x\"\napply (rule stream.take_lemma)\nby (rule sconc_fst_inf_lemma [rule_format])\n\ntext \\For finite streams, their lengths are added on concatenation\\\nlemma slen_sconc_all_finite: \n \"\\x y n. #x = Fin k \\ #y = Fin n \\ #(x\\y) = Fin (k+n)\" \napply (induct_tac k, auto)\nby (rule_tac x=x in scases, auto)\n\ntext \\Streams with infinite prefixes are infinite\\\nlemma mono_fst_infD: \"\\#x = \\; x \\ y\\ \\ #y = \\ \"\napply (drule monofun_cfun_arg [of _ _ slen])\nby (rule lnat_po_eq_conv [THEN iffD1], simp)\n\ntext \\For @{term \"s \\ t\"} with @{term s} and @{term t} of\n equal length, all finite prefixes are identical\\\nlemma stake_eq_slen_eq_and_less: \n \"\\s t. #s = #t \\ s \\ t \\ stake n\\s = stake n\\t\"\napply (induct_tac n, auto)\napply (rule_tac x=s in scases, auto)\napply (rule_tac x=t in scases, auto)\nby (drule less_all_sconsD, auto)\n\ntext \\For @{term \"s \\ t\"} with @{term s} and @{term t} of\n equal length, @{term s} and @{term t} are identical\\\nlemma eq_slen_eq_and_less: \"\\#s = #t; s \\ t\\ \\ s = t\"\napply (rule stream.take_lemma)\nby (rule stake_eq_slen_eq_and_less [rule_format], rule conjI)\n\ntext \\Infinite prefixes are equal to the original stream\\\nlemma eq_less_and_fst_inf: \"\\s1 \\ s2; #s1 = \\\\ \\ s1 = s2\"\napply (rule eq_slen_eq_and_less, simp) \napply (rule sym)\nby (rule mono_fst_infD [of \"s1\" \"s2\"])\n\n(*\nlemma s1: \"chain S \\ \\ finite_chain S \\ \\i. \\j\\i. S i \\ S j\"\nby auto\n\nlemma \"chain S \\ \\ finite_chain S \\ \\k. #(S k) = \\\"\napply (simp add: finite_chain_def max_in_chain_def )\napply (subgoal_tac \"chain S \\ \\ finite_chain S \\ \\i. \\j\\i. S i \\ S j\")\nprefer 2\napply (simp add: s1, simp)\n*)\n\n(* if Fin n is smaller than the length of as, then Fin n is also smaller than lnsuc\\(#as) *)\nlemma [simp]: \"Fin n < #as \\ Fin n < lnsuc\\(#as)\"\n by (smt below_antisym below_trans less_lnsuc lnle_def lnless_def)\n\ntext \\For infinite streams, \\stake n\\ returns \\n\\ elements\\\nlemma slen_stake_fst_inf[rule_format]: \n \"\\x. #x = \\ \\ #(stake n\\x) = Fin n\"\napply (induct_tac n, auto)\nby (rule_tac x=x in scases, auto)\n\n(* mapping a stream to its length is a monotone function *)\nlemma mono_slen: \"x \\ y \\ #x \\ #y\"\nby (drule_tac x = x and y = y and f = slen \n in monofun_cfun_arg, simp)\n\ntext \\A stream is shorter than \\n+1\\ iff its rest is shorter than \\n\\\\\nlemma slen_rt_ile_eq: \"(#x \\ Fin (Suc n)) = (#(srt\\x) \\ Fin n)\" \nby (rule_tac x=x in scases, auto)\n\ntext \\If \\#x < #y\\, this also applies to the streams' rests (for nonempty, finite x)\\\nlemma smono_slen_rt_lemma: \n \"#x = Fin k \\ x \\ \\ \\ #x < #y \\ #(srt\\x) < #(srt\\y)\"\napply (induct_tac k, auto)\napply (rule_tac x=x in scases, auto)\nby (rule_tac x=y in scases, auto)\n\ntext \\If \\#x < #y\\, this also applies to the streams' rests (for finite x)\\\nlemma smono_slen_rt: \"\\x \\ \\; #x < #y\\ \\ #(srt\\x) < #(srt\\y)\"\napply (rule_tac x=\"#x\" in lncases, auto) \nby (rule smono_slen_rt_lemma [rule_format], simp)\n\ntext \\Infinite elements of a stream chain are equal to the LUB\\\nlemma inf2max: \"\\chain Y; #(Y k) = \\\\ \\ Y k = (\\i. Y i)\"\napply (subgoal_tac \"Y k \\ (\\i. Y i)\")\napply (drule eq_less_and_fst_inf, assumption+)\nby (rule is_ub_thelub)\n\ntext \\\\stake n\\ returns at most \\n\\ elements\\\nlemma ub_slen_stake[simp]: \"#(stake n\\x) \\ Fin n\"\napply (rule spec [where x = x])\napply (induct_tac n, auto)\nby (rule_tac x=x in scases, auto)\n\ntext \\\\stake\\ always returns finite streams\\\nlemma [simp]: \"#(stake n\\x) \\ \\\"\nproof (rule notI)\n assume inf: \"#(stake n\\x) = \\\"\n have \"#(stake n\\x) \\ Fin n\" by (rule ub_slen_stake)\n thus False using inf by simp\nqed\n\ntext \\\\stake\\ing at least \\#x\\ elements returns \\x\\ again\\\nlemma fin2stake_lemma: \"\\x k. #x = Fin k \\ k\\i \\ stake i\\x = x\"\napply (induct_tac i, auto)\napply (rule_tac x=x in scases, auto)\nby (case_tac \"k\", auto)\n\ntext \\\\stake\\ing \\#x\\ elements returns \\x\\ again\\\nlemma fin2stake:\"#x = Fin n \\ stake n\\x = x\"\n by (rule fin2stake_lemma [rule_format, of \"x\" \"n\" \"n\"], simp)\n\ntext \\\\stake\\ing only on element from an empty stream is the same as the stream consisting of \n \\shd\\ of the stream\\\nlemma stake2shd:\"s\\\\ \\ stake (Suc 0)\\s = \\(shd s)\"\n by(rule scases[of s],simp_all add: Nat.One_nat_def)\n\nlemma stake2shd2:\"s\\\\ \\ stake 1\\s = \\(shd s)\"\n by(simp add: Nat.One_nat_def stake2shd)\n\n(* if the stream is not empty, it holds that its length is lnsuc\\(#(srt\\s)) *)\nlemma srt_decrements_length : \"s \\ \\ \\ #s = lnsuc\\(#(srt\\s))\" by (metis slen_scons surj_scons)\n\n(* the empty stream is the shortest *)\nlemma empty_is_shortest : \"Fin n < #s \\ s \\ \\\" by (metis Fin_0 less_le lnle_Fin_0 strict_slen)\n\n(* if Fin (Suc n) is smaller than length of s, then also Fin n is smaller than length of s *)\nlemma convert_inductive_asm : \"Fin (Suc n) < #s \\ Fin n < #s\" by (metis Fin_leq_Suc_leq less_le not_le)\n\n(* only the empty stream has length zero *)\nlemma only_empty_has_length_0 : \"#s \\ 0 \\ s \\ \\\" by simp\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\Basic induction rules\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\induction for all prefixes\\\nlemma stakeind: \n \"\\x. (P \\ \\ (\\a s. P s \\ P (\\a \\ s))) \\ P (stake n\\x)\"\nby (induct_tac n, auto, rule_tac x=x in scases, auto)\n\ntext \\induction for finite streams\\\nlemma finind:\n \"\\#x = Fin n; P \\; \\a s. P s \\ P (\\a \\ s)\\ \\ P x\"\napply (drule fin2stake)\napply (drule sym, erule ssubst)\napply (rule stakeind [rule_format])\napply (rule conjI, assumption)\napply (rule allI)+\nby (rule impI, simp)\n\ntext \\induction for infinite streams and admissable predicates\\\nlemma ind: \n \"\\adm P; P \\; \\a s. P s \\ P (\\a \\ s)\\ \\ P x\"\napply (unfold adm_def)\napply (erule_tac x=\"\\i. stake i\\x\" in allE, auto)\napply (simp add: stakeind)\nby (simp add: reach_stream)\n\nlemma finind2: \"#s = Fin k \\ P \\ \\ (\\t a. #t < \\ \\ P t \\ P (\\a \\ t)) \\ P s\"\nproof -\n assume \"#s = Fin k\" and \"P \\\" and \"\\t a. #t < \\ \\ P t \\ P (\\a \\ t)\"\n then show \"P s\"\n proof (induction k arbitrary: s)\n case 0\n then show ?case\n by auto\n next\n case (Suc k)\n then obtain a t where \"s = \\a \\ t\" and \"#t = Fin k\"\n by (metis Fin_Suc bot_is_0 lnat.con_rews lnat.sel_rews(2) slen_empty_eq srt_decrements_length surj_scons)\n then show ?case\n by (simp add: Suc.IH Suc.prems(2) Suc.prems(3))\n qed\nqed\n\nlemma finind3: \"#s < \\ \\ P \\ \\ (\\t a. #t < \\ \\ P t \\ P (\\a \\ t)) \\ P s\"\n by (metis finind2 less_le ninf2Fin)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\Other properties of @{term stake}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\composition of \\stake\\\\\nlemma stakeostake[simp]: \"stake k\\(stake n\\x) = stake (min k n)\\x\"\napply (rule_tac x=\"n\" in spec)\napply (rule_tac x=\"k\" in spec)\napply (rule ind [of _ x], simp+)\napply (rule allI)+\napply (case_tac \"xa\", simp+)\nby (case_tac \"x\", simp+)\n\n(* stake always returns a prefix of the input stream *)\nlemma ub_stake[simp]: \"stake n\\x \\ x\"\nby (rule stream.take_below)\n\n(* definition of stake *)\nlemma stake_suc: \"stake (Suc n)\\s = (stake 1\\s) \\ stake n\\(srt\\s)\"\nby (metis (no_types, lifting) One_nat_def Rep_cfun_strict1 sconc_snd_empty stake_Suc stream.sel_rews(2) stream.take_0 stream.take_strict surj_scons)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sdrop}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term sdrop}\\\n\n(* dropping n\\\\ is the empty stream *)\nlemma strict_sdrop[simp]: \"sdrop n\\\\ = \\\"\nby (simp add: sdrop_def, induct_tac n, auto)\n\n(* dropping 0\\s returns s *)\nlemma sdrop_0[simp]: \"sdrop 0\\s = s\"\nby (simp add: sdrop_def)\n\n(* dropping an additional element is equivalent to calling srt *)\nlemma sdrop_back_rt: \"sdrop (Suc n)\\s = srt\\(sdrop n\\s)\"\nby (simp add: sdrop_def)\n\n(* dropping an additional element is equivalent to sdrop with srt as part of the stream *)\nlemma sdrop_forw_rt: \"sdrop (Suc n)\\s = sdrop n\\(srt\\s)\"\napply (simp add: sdrop_def)\nby (subst iterate_Suc2 [THEN sym], simp)\n\n(* dropping n + 1 elements from a non-empty stream is equivalent to dropping n items from the rest *)\nlemma sdrop_scons[simp]: \"sdrop (Suc n)\\(\\a \\ as) = sdrop n\\as\"\nby (simp add: sdrop_forw_rt)\n\n(* if dropping n items produces the empty stream then the stream contains n elements or less *)\nlemma sdrop_stakel1: \"\\s. sdrop n\\s = \\ \\ stake n\\s = s\"\napply (induct_tac n, auto)\nby (rule_tac x=s in scases, auto)\n\n(* dropping k+x elements is equivalent to dropping x elements first and then k elements *) \nlemma sdrop_plus: \"sdrop (k+x)\\xs = sdrop k\\(sdrop x\\xs)\"\nby (simp add: iterate_iterate sdrop_def)\n\ntext \\Dropping from infinite streams still returns infinite streams\\\nlemma fair_sdrop[rule_format]: \n \"\\x. #x = \\ \\ #(sdrop n\\x) = \\\"\napply (induct_tac n, simp, clarify)\nby (rule_tac x=x in scases, auto)\n\ntext \\streams can be split by @{term stake} and @{term sdrop}\\\nlemma split_streaml1[simp]: \n \"stake n\\s \\ sdrop n\\s = s\"\napply (rule spec [where x = s])\napply (induct_tac n, auto)\nby (rule_tac x=x in scases, auto)\n\ntext \\@{term sdrop} may only create infinite outputs for infinite inputs\\\nlemma fair_sdrop_rev:\n \"#(sdrop k\\x) = \\ \\ #x = \\\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, simp)\napply (rule allI, rule impI)\napply (rule_tac x=\"x\" in scases, simp)\nby (erule_tac x=\"s\" in allE, simp)\n\ntext \\construct @{term \"sdrop j\"} from @{term \"sdrop k\"} (with @{term \"j \\ k\"})\\\nlemma sdropl5:\n \"j \\ k \\ sdrop j\\(stake k\\x) \\ sdrop k\\x = sdrop j\\x\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"j\" in spec)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, auto)\napply (rule_tac x=\"x\" in scases, auto)\nby (case_tac \"xa\", auto)\n\ntext \\Dropping as inverse of prepending a finite stream\\\nlemma sdropl6:\n \"#x = Fin k \\ sdrop k\\(x \\ y) = y\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"x\" in spec)\napply (rule_tac x=\"y\" in spec)\napply (induct_tac k, auto)\nby (rule_tac x=\"xa\" in scases, auto)\n\n(* relation between srt and drop *)\nlemma srt_drop : \"srt\\(sdrop n\\s) = sdrop (Suc n)\\s\" by (simp add: sdrop_back_rt)\n\n(* sdrop n\\s should not result in the empty stream *)\nlemma drop_not_all : \"Fin n < #s \\ sdrop n\\s \\ \\\"\nproof (induct n)\n show \"Fin 0 < #s \\ sdrop 0\\s \\ \\\" by auto\n \n have \"\\ n. Fin n < #s \\ #(sdrop n\\s) = lnsuc\\(#(srt\\(sdrop n\\s)))\" by (metis not_le sdrop_stakel1 srt_decrements_length ub_slen_stake)\n hence \"\\ n. Fin n < #s \\ sdrop n\\s \\ \\\" using only_empty_has_length_0 by fastforce\n thus \"\\ n. (Fin n < #s \\ sdrop n\\s \\ \\) \\ Fin (Suc n) < #s \\ sdrop (Suc n)\\s \\ \\\" by simp\nqed\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term snth}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Basic properties of @{term snth}\\\n\n(* the element k + 1 of the stream s is identical to the element k of the rest of s *)\nlemma snth_rt: \"snth (Suc k) s = snth k (srt\\s)\"\napply (simp add: snth_def)\nby (subst sdrop_forw_rt,rule refl)\n\n(* semantically equivalent to snth_rt *)\nlemma snth_scons[simp]: \"snth (Suc k) (\\a \\ s) = snth k s\"\nby (simp add: snth_rt)\n\n(* indexing starts at 0, so the 0'th element is equal to the head *)\nlemma snth_shd[simp]: \"snth 0 s = shd s\"\nby (simp add: snth_def)\n\ntext \\If two streams of same length agree on every element,\n all their finite prefixes are equal\\\nlemma snths_eq_lemma [rule_format]: \n \"\\x y. #x = #y \\ (\\n. Fin n < #x \\ snth n x = snth n y) \n \\ stake k\\x = stake k\\y\"\napply (induct_tac k, auto)\napply (rule_tac x=x in scases, auto)\napply (rule_tac x=y in scases, auto)\napply (erule_tac x=\"s\" in allE)\napply (erule_tac x=\"sa\" in allE, auto)\napply (erule_tac x=\"Suc na\" in allE, simp)\nby (erule_tac x=\"0\" in allE, auto)\n\ntext \\If two streams of same length agree on every element, they are equal\\\nlemma snths_eq: \n \"\\#x = #y; \\n. Fin n < #x \\ snth n x = snth n y\\ \\ x = y\"\napply (rule stream.take_lemma)\nby (rule snths_eq_lemma, auto)\n\n(* easy to use rule to show equality on infinite streams *)\n(* if two finite streams x, s are identical at every position then x and s are identical *) \nlemma sinf_snt2eq: assumes \"#s=\\\" and \"#x=\\\" and \"\\i. (snth i s = snth i x)\"\n shows \"s=x\"\nby (simp add: assms snths_eq)\n\nlemma snthp_shd: assumes\"\\n. P(snth n s)\"\n shows\"P(shd s)\"\n by (metis assms snth_shd)\n\nlemma snthp_shd2: assumes\"\\n. P(snth n (\\m \\ s))\"\n shows\"P(m)\"\n by (metis assms shd1 snth_shd)\n\nlemma snthp_snth: assumes\"\\n. P(snth n (\\m \\ s))\"\n shows\"P(snth n(s))\"\n by (metis assms snth_scons)\n\nlemma snthp_srt: assumes\"\\n. P(snth n (s))\"\n shows\"P(snth n(srt\\s))\"\n by (metis assms snth_rt)\n(* ----------------------------------------------------------------------- *)\nsection \\Further lemmas\\\n(* ----------------------------------------------------------------------- *)\n\n(* concatenation is associative *)\nlemma assoc_sconc[simp]: \"(s1\\s2)\\s3 = s1\\s2\\s3\"\napply (rule_tac x=\"#s1\" in lncases, auto)\nby (rule finind [of \"s1\"], auto)\n\n(* 2 very specific lemmas, used in \\stake_add\\ *)\n lemma stake_conc: \"stake i\\s \\ x = stake (Suc i)\\s \\ x = stake 1\\(sdrop i\\s)\"\n apply (induction i arbitrary: s)\n apply (simp add: One_nat_def)\n by (smt assoc_sconc inject_scons sdrop_forw_rt stake_Suc stream.take_strict strict_sdrop surj_scons) \n \n lemma stake_concat:\"stake i\\s \\ stake (Suc j)\\(sdrop i\\s) = stake (Suc i)\\s \\ stake j\\(sdrop (Suc i)\\s)\"\n proof -\n obtain x where x_def: \"stake i\\s \\ x = stake (Suc i)\\s\" \n by (metis (no_types, hide_lams) Suc_n_not_le_n linear min_def split_streaml1 stream.take_take) \n thus ?thesis\n by (smt One_nat_def Rep_cfun_strict1 assoc_sconc sconc_snd_empty sdrop_back_rt stake_Suc stake_conc stream.take_0 stream.take_strict strict_sdrop surj_scons)\n qed\n\n(* for arbitrary natural numbers i, j and any streams s the following lemma holds: *)\nlemma stake_add: \"stake (i+j)\\s = (stake i\\s) \\ (stake j\\(sdrop i\\s))\"\napply (induction i arbitrary: j)\napply simp\nby (metis add_Suc_shift stake_concat)\n\ntext \\Finite, equal streams agree on all postfixes\\\nlemma inject_sconc: \"\\#x = Fin k; x \\ y = x \\ z\\ \\ y = z\"\napply (simp add: atomize_imp)\napply (rule_tac x=x in spec)\napply (induct_tac k, auto)\napply (rule_tac x=x in scases, auto)\nby (drule inject_scons, auto)\n\nlemma sconc_inj: assumes \"#s < \\\" \n shows \"inj (Rep_cfun (sconc s))\"\n by (meson assms injI inject_sconc lnat_well_h2)\n\n(* x is a prefix of x \\ y*) \nlemma sconc_prefix [simp]: \"x \\ x \\ y\"\napply (rule_tac x=\"#x\" in lncases, auto)\napply (rule finind [of x], auto)\nby (rule monofun_cfun_arg)\n\ntext \\Prepending to infinite streams produces infinite streams again\\\nlemma slen_sconc_snd_inf: \"#y=\\ \\ #(x \\ y) = \\\"\napply (rule_tac x=\"#x\" in lncases, auto)\nby (rule finind [of \"x\"], auto)\n\n(* stake n results in a stream of length n, so sdrop n then results in the empty stream *)\nlemma sdropostake: \"sdrop n\\(stake n\\s) = \\\"\napply (rule spec [where x = n])\napply (rule ind [of _ s], auto)\nby (case_tac x, auto)\n\n(* for all x it holds that if (P \\ \\ (\\a s. P s \\ P (s \\ \\a))) then it follows that P applied to stake n\\x is true *)\nlemma stakeind2: \n \"\\x. (P \\ \\ (\\a s. P s \\ P (s \\ \\a))) \\ P (stake n\\x)\"\n apply(induction n)\n apply simp\n apply auto\n apply (subst stake_suc)\n by (metis (no_types, lifting) sconc_snd_empty sdrop_back_rt sdropostake split_streaml1 stake_suc surj_scons)\n\n(* if P is admissible and P holds for the empty stream and \\a s. P s implies P (s \\ \\a) then P also holds for x *)\nlemma ind2: assumes \"adm P\" and \"P \\\" and \"\\a s. P s \\ P (s \\ \\a)\"\n shows \"P x\"\nby (metis assms(1) assms(2) assms(3) stakeind2 stream.take_induct)\n\n(* if P holds for bottom and it holds that lscons: \"(\\x xs. x\\\\\\P xs \\ P (x&&xs))\" and the length of xs is finite, then P holds also for xs *)\nlemma stream_fin_induct: assumes Bot: \"P \\\" and lscons: \"(\\x xs. x\\\\\\P xs \\ P (x&&xs))\" and fin: \"#xs<\\\"\n shows \"P xs\"\n by (metis finind infI lnless_def sconc_fst_empty sconc_scons' sup'_def up_defined assms)\n\n(* if length of s is finite => P holds for s => P is admissible => P holds for s *) \nlemma stream_infs: \"(\\s. #s<\\ \\ P s) \\ adm P \\ P s\"\n by (metis inf_less_eq leI notinfI3 slen_stake_fst_inf stream.take_induct)\n\nlemma slen_stake: \"#s \\ Fin n \\ #(stake n\\s) = Fin n\"\nproof (induction n)\n case 0\n then show ?case\n by simp\nnext\n case (Suc n)\n assume \"#s \\ Fin (Suc n)\"\n then have \"#s \\ Fin n\"\n by (simp add: Suc.prems Fin_leq_Suc_leq)\n obtain r where \"stake (Suc n)\\s = (stake n\\s) \\ r\"\n by (metis (no_types) Rep_cfun_strict1 sconc_snd_empty stake_concat stream.take_0)\n then have \"r \\ \\\"\n by (metis (mono_tags, lifting) Fin_02bot Fin_Suc One_nat_def Suc.prems \\Fin n \\ #s\\ bot_is_0 drop_not_all inject_Fin lnle_def lnless_def n_not_Suc_n only_empty_has_length_0 sdropostake slen_scons srt_drop stake_Suc stake_conc strictI surj_scons)\n have \"#((stake n\\s) \\ r) \\ Fin (Suc n)\"\n proof -\n have f1: \"#(stake n\\s) = Fin n\"\n using Suc.IH \\Fin n \\ #s\\ by fastforce\n have f2: \"\\s sa. (sa::'a stream) \\ sa \\ s\"\n by simp\n have \"\\n. stake n\\s \\ r \\ stake n\\s \\ Fin n = Fin n\"\n using f1 by (metis \\r \\ \\\\ inject_sconc sconc_snd_empty)\n then have \"#(stake n\\s \\ r) \\ Fin n\"\n by (metis Suc.IH \\Fin n \\ #s\\ \\r \\ \\\\ fin2stake sdropl6 sdropostake)\n then show ?thesis\n using f2 f1 by (metis (no_types) less2lnleD lnless_def monofun_cfun_arg)\n qed\n then show ?case\n by (metis \\stake (Suc n)\\s = stake n\\s \\ r\\ dual_order.antisym ub_slen_stake)\nqed\n\n(* ----------------------------------------------------------------------- *)\nsection \\Additional lemmas for approximation, chains and continuity\\ \n(* ----------------------------------------------------------------------- *)\n\ntext \\A finite prefix of length @{term \"k\"} is created by @{term \"stake k\"}\\\nlemma approxl1:\n \"\\s1 s2. s1 \\ s2 \\ #s1 = Fin k \\ stake k\\s2 = s1\"\napply (induct_tac k, auto)\napply (rule_tac x=s1 in scases, auto)\napply (rule_tac x=s2 in scases, auto)\napply (erule_tac x=\"s\" in allE)\napply (erule_tac x=\"sa\" in allE)\nby (drule less_all_sconsD, auto)\n\ntext \\A prefix of a stream is equal to the original one or a finite prefix\\\nlemma approxl2:\n \"s1 \\ s2 \\ (s1 = s2) \\ (\\n. stake n\\s2 = s1 \\ Fin n = #s1)\"\napply (rule_tac x=\"#s1\" in lncases, auto)\napply (rule eq_less_and_fst_inf, assumption+)\nby (insert approxl1 \n [rule_format, of \"s1\" \"s2\"], auto)\n\ntext \\In infinite chains, all streams are finite\\\nlemma inf_chainl1:\n \"\\chain Y; \\finite_chain Y\\ \\ \\k. #(Y i) = Fin k\"\napply (rule ccontr, simp, frule infI)\napply (frule_tac k=\"i\" in inf2max, assumption)\napply (frule_tac i=\"i\" in max_in_chainI3, simp+)\nby (simp add: finite_chain_def)\n\ntext \\Each prefix of a stream can be expanded to the original stream\\\nlemma approxl3: \"s1 \\ s2 \\ \\t. s1\\t = s2\"\napply (rule_tac x=\"#s1\" in lncases, simp)\napply (drule eq_less_and_fst_inf, simp+)\napply (subst approxl1 \n [rule_format, of \"s1\" \"s2\", THEN sym], simp+)\nby (rule_tac x=\"sdrop k\\s2\" in exI, simp)\n\ntext \\In infinite chains, there is an element which is a true prefix of another one\\\nlemma inf_chainl2:\n \"\\chain Y; \\ finite_chain Y\\ \\ \\j. Y k \\ Y j \\ #(Y k) < #(Y j)\"\napply (auto simp add: finite_chain_def max_in_chain_def)\napply (erule_tac x=\"k\" in allE, auto)\napply (frule_tac i=k and j=j in chain_mono, assumption)\napply (rule_tac x=\"j\" in exI, simp)\napply (auto simp add: lnless_def)\napply (rule mono_slen, assumption)\nby (frule eq_slen_eq_and_less, simp+)\n\ntext \\In infinite chains, the length of the streams is unbounded\\\nlemma inf_chainl3:\n \"chain Y \\ \\finite_chain Y \\ (\\k. Fin n \\ #(Y k))\"\napply (induct_tac n, auto)\napply (case_tac \"Fin n = #(Y k)\")\napply (frule_tac k=k in inf_chainl2, auto)\napply (rule_tac x=\"j\" in exI)\napply (drule sym)\napply (rule_tac x=\"#(Y j)\" in lncases, auto)\napply (rule_tac x=\"k\" in exI)\nby (rule_tac x=\"#(Y k)\" in lncases, auto)\n\ntext \\In infinite chains, the lub is infinite\\\nlemma inf_chainl4:\n \"\\chain Y; \\finite_chain Y\\ \\ #(lub(range Y)) = \\\"\napply (rule_tac x=\"#(Lub Y)\" in lncases, auto)\napply (frule_tac n = \"Suc k\" in inf_chainl3 \n [rule_format, OF conjI], assumption, erule exE)\napply (subgoal_tac \"Y ka \\ (Lub Y)\")\napply (drule monofun_cfun_arg [of _ _ slen], simp)\napply (frule_tac x = \"Fin (Suc k)\" and \n y = \"#(Y ka)\" and z = \"Fin k\" in trans_lnle, simp+)\nby (rule is_ub_thelub)\n\ntext \\Each chain becomes finite by mapping @{term \"stake n\"} to every element\\\nlemma finite_chain_stake: \n \"chain Y \\ finite_chain (\\i. stake n\\(Y i))\"\napply (frule ch2ch_Rep_cfunR [of _ \"stake n\"])\napply (rule ccontr)\napply (frule inf_chainl4 [of \"\\i. stake n\\(Y i)\"],assumption)\nby (simp add: contlub_cfun_arg [THEN sym])\n\ntext \\every finite prefix of the lub is also prefix of some element in the chain\\\nlemma lub_approx: \n \"chain Y \\ \\k. stake n\\(lub (range Y)) = stake n\\(Y k)\"\napply (subst contlub_cfun_arg, assumption)\napply (frule finite_chain_stake [of _ n])\napply (simp add: finite_chain_def, auto)\napply (rule_tac x=\"i\" in exI)\nby (rule lub_finch1 \n [THEN lub_eqI, of \"\\i. stake n\\(Y i)\"], auto)\n\ntext \\If @{term f} is monotone and for each @{term x} there is a finite prefix\n @{term y} such that @{term \"f x = f y\"}, @{term f} is continuous\\\nlemma pr_contI: \n \"\\monofun f; \\x.\\n. (f x) = f (stake n\\x)\\ \\ cont f\"\napply (rule contI2, assumption)\napply (rule allI, rule impI)\napply (erule_tac x=\"lub (range Y)\" in allE, erule exE)\napply (frule_tac n = n in lub_approx, erule exE)\napply (subgoal_tac \"f (stake n\\(Y k)) \\ f (Y k)\")\napply (subgoal_tac \"f (Y k) \\ (\\i. f (Y i))\")\napply (drule_tac x=\"f (stake n\\(Y k))\" and \n y=\"f (Y k)\" and z = \"\\i. f (Y i)\" in below_trans)\napply (rule is_ub_thelub)\napply (rule_tac f=f in ch2ch_monofun, assumption+)\napply (clarsimp)\napply (rule is_ub_thelub)\napply (rule_tac f=f in ch2ch_monofun, assumption+)\nby (rule_tac f = f in monofunE, simp+)\n\ntext \\For continuous functions, each finite prefix of @{term \"f\\x\"} only\n depends on a finite prefix of @{term \"x\"}\\\nlemma fun_approxl1: \n \"\\j. stake k\\(f\\x) = stake k\\(f\\(stake j\\x))\"\napply (subgoal_tac \"f\\x = (\\i. f\\(stake i\\x))\")\napply (erule ssubst)\napply (rule lub_approx)\napply (rule chain_monofun)\napply (rule ch2ch_Rep_cfunL)\napply (rule stream.chain_take)\napply (subst contlub_cfun_arg [THEN sym])\napply (rule ch2ch_Rep_cfunL)\napply (rule stream.chain_take)\napply (subst reach_stream)\nby (rule refl)\n\ntext \\For continuous functions, any finite output for stream @{term \"x\"} can also be\n obtained by some finite prefix of @{term \"x\"}\\\nlemma fun_approxl2: \"#(f\\x) = Fin k \\ \\j. f\\x = f\\(stake j\\x)\" \napply (insert fun_approxl1 [of k \"f\" x], auto)\napply (rule_tac x=\"j\" in exI)\napply (frule fin2stake [THEN sym], simp)\napply (rule stream.take_lemma, simp)\napply (case_tac \"n \\ k\")\napply (simp add: min_def)+\napply (rule po_eq_conv [THEN iffD2])\napply (rule conjI)\napply (rule monofun_cfun_fun)\napply (rule chain_mono)\napply (rule stream.chain_take, simp+)\napply (subgoal_tac \"f\\(stake j\\x) \\ f\\x\")\napply (rule below_trans, auto)\napply (drule sym, drule sym, simp)\nby (rule monofun_cfun_arg, simp)\n\n(* if two streams are unequal, it holds for a finite stream a that a \\ s1 is unequal to a \\ s2 *)\nlemma sconc_neq_h: assumes \"s1 \\ s2\"\n shows \"#a < \\ \\ a \\ s1 \\ a \\ s2\"\n apply(rule ind [of _a ])\n apply(rule admI)\n apply (rule impI)\n apply (metis inf_chainl4 l42 neq_iff)\n apply (simp add: assms)\n by (metis inf_ub inject_scons less_le sconc_scons slen_sconc_snd_inf)\n\n(* if two streams are unequal and a stream a has finite lenght, it holds that a \\ s1 is unequal to a \\ s2 *) \nlemma sconc_neq: assumes \"s1 \\ s2\" and \"#a < \\\"\n shows \"a \\ s1 \\ a \\ s2\"\nusing assms(1) assms(2) sconc_neq_h by blast\n\nlemma stake_prefix: \"#s < \\ \\ t \\ \\ \\ s = t \\ u \\ \\k. t = stake (Suc k)\\s\"\nproof -\n assume \"#s < \\\" and \"t \\ \\\" and \"s = t \\ u\"\n then obtain k where \"t = stake k\\s\"\n by (metis approxl2 fin2stake inf_less_eq minimal monofun_cfun_arg ninf2Fin not_le sconc_snd_empty)\n then obtain l where \"k = Suc l\"\n by (metis Rep_cfun_strict1 \\t \\ \\\\ not0_implies_Suc stream.take_0)\n thus ?thesis\n using \\t = stake k\\s\\ by blast\nqed\n\nlemma stake_prefix2: \"#s = Fin n \\ s = stake n\\(s \\ t)\"\n by (metis approxl1 minimal monofun_cfun_arg sconc_snd_empty)\n\nlemma slen_conc: \"#s < \\ \\ t \\ \\ \\ #s \\ Fin n \\ #(s \\ t) > Fin n\"\n by (metis (no_types, hide_lams) stake_prefix2 infI less_le less_le_trans mono_slen sconc_neq sconc_snd_empty stream.take_below)\n\nlemma stake_srt_conc [simp]: \"srt\\((stake 1\\s)\\(s)) = s\"\n apply (cases s)\n apply simp\n by (metis One_nat_def Rep_cfun_strict1 lscons_conv sconc_snd_empty stake_Suc stream.con_rews(2) stream.sel_rews(5) stream.take_0 surj_scons)\n\n(* ----------------------------------------------------------------------- *)\nsection \\Lemmas for the remaining definitions\\\n(* ----------------------------------------------------------------------- *)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term slookahd}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\@{term slookahd} is continuous\\\nlemma cont_slookahd[simp]: \"cont (\\ s. if s=\\ then \\ else eq (shd s))\"\napply (rule pr_contI)\napply (rule monofunI, auto)\napply (rule_tac x=x in scases, auto)\napply (rule_tac x=y in scases, auto)\napply (drule less_all_sconsD, simp)\napply (rule_tac x=x in scases, auto)\nby (rule_tac x=\"Suc 0\" in exI, auto)\n\n(* slookahd applied to the empty stream results in the bottom element for any function eq *)\nlemma strict_slookahd[simp]: \"slookahd\\\\\\eq = \\\"\nby (simp add: slookahd_def cont2cont_LAM)\n\n(* if s isn't the empty stream, the function eq will be applied to the head of s *)\nlemma slookahd_scons[simp]: \"s\\\\ \\ slookahd\\s\\eq = eq (shd s)\"\nby (simp add: slookahd_def cont2cont_LAM)\n\n(* the constant function that always returns the empty stream unifies the two cases of slookahd *)\nlemma strict2_slookahd[simp]: \"slookahd\\xs\\(\\y. \\) = \\\"\nby (cases xs, simp_all)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sinftimes}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term sntimes} and @{term sinftimes}\\\n\n(* repeating the empty stream produces the empty stream again for any n*)\nlemma sntimes_eps[simp]: \"sntimes n \\ = \\\"\nby (induct_tac n, simp+)\n\n(* after repeating the stream \\s n-times the head is s *)\n (* n>0 otherwise \\0 \\ \\s = \\\\ *)\nlemma shd_sntime [simp]: assumes \"n>0\" shows \"shd (n \\ \\s) = s\"\nby (metis assms gr0_implies_Suc shd1 sntimes.simps(2))\n\n(* infinitely cycling the empty stream produces the empty stream again *)\nlemma strict_icycle[simp]: \"sinftimes \\ = \\\"\nby (subst sinftimes_def [THEN fix_eq2], auto)\n\n(* repeating a stream infinitely often is equivalent to repeating it once and then infinitely often *)\nlemma sinftimes_unfold: \"sinftimes s = s \\ sinftimes s\"\nby (subst sinftimes_def [THEN fix_eq2], auto)\n\ntext \\For nonempty @{term s}, @{term \"sinftimes s\"} is infinite\\\nlemma slen_sinftimes: \"s \\ \\ \\ #(sinftimes s) = \\\"\napply (rule ccontr)\napply (rule_tac x=\"#(sinftimes s)\" in lncases, auto)\napply (rule_tac x=\"#s\" in lncases)\napply (insert sinftimes_unfold [of s], auto)\nby (insert slen_sconc_all_finite \n [rule_format, of \"s\" _ \"sinftimes s\"], force)\n\n(* lenght of sinftimes of (\\a) is infinity *)\nlemma [simp]: \"#(sinftimes (\\a)) = \\\" \nby (simp add: slen_sinftimes)\n\n(* converting the element x to a singleton stream, repeating the singleton and re-extracting x with\n lshd is equivalent to imposing the discrete order on x *)\nlemma lshd_sinf [simp]: \"lshd\\\\x\\<^sup>\\ = updis x\"\nby (metis lshd_updis sinftimes_unfold)\n\n(* the infinite repetition of the stream x has the same head as x *)\nlemma shd_sinf[simp]: \"shd (x\\<^sup>\\) = shd x\"\nby (metis assoc_sconc shd1 sinftimes_unfold strict_icycle surj_scons)\n\n(* srt has no effect on an infinite constant stream of x *)\nlemma srt_sinf [simp]: \"srt\\\\x\\<^sup>\\ = ((\\x)\\<^sup>\\)\"\nby (metis lscons_conv sinftimes_unfold stream.sel_rews(5) up_defined)\n\n(* if the stream x contains y elements then the first y elements of the infinite repetition of x will\n be x again *)\nlemma stake_y [simp]: assumes \"#x = Fin y\"\n shows \"stake y\\(sinftimes x) = x\"\nby (metis approxl1 assms minimal monofun_cfun_arg sconc_snd_empty sinftimes_unfold)\n\n(* the infinite repetitions of the singleton stream \\s consists only of the element s *)\nlemma snth_sinftimes[simp]: \"snth i ((\\s)\\<^sup>\\) = s\"\napply (induction i)\napply (simp) \nby (simp add: snth_rt)\n\n(* dropping any finite number of elements from an infinite constant stream doesn't affect the stream *)\nlemma sdrops_sinf[simp]: \"sdrop i\\((\\x)\\<^sup>\\) = ((\\x)\\<^sup>\\)\"\napply (induction i)\napply(simp)\nby (simp add: sdrop_forw_rt)\n\n(* for a finite natural number \"i\", following relation between sntimes and stake holds: *)\nlemma sntimes_stake: \"i \\ \\x = stake i\\((\\x)\\<^sup>\\)\"\napply(induction i)\napply simp\nby (metis sinftimes_unfold sntimes.simps(2) stake_Suc) \n\n(* for every finite number \"i\" is sntimes \\ sinftimes. *)\nlemma snNEqSinf [simp]: \"i \\ \\x \\ ((\\x)\\<^sup>\\)\"\nby (metis lshd_sinf sdropostake sdrops_sinf sntimes_stake stream.sel_rews(3) up_defined)\n\n(* for every natural number i, dropping the first (i*y) elements results in the same infinite stream *)\n (* the first i \"blocks\" of x are dropped *)\nlemma sdrop_sinf[simp]: assumes \"Fin y = #x\"\n shows \"sdrop (i * y)\\(sinftimes x) = sinftimes x\"\napply(induction i)\napply(simp)\nby (metis assms mult_Suc sdrop_plus sdropl6 sinftimes_unfold) \n\n(* repeating the empty stream again produces the empty stream *)\nlemma sinf_notEps[simp]: assumes \"xs \\ \\\" shows \"(sinftimes xs) \\ \\\"\nusing assms slen_sinftimes by fastforce\n\n(* sinftimes has no effect on streams that are already infinite *)\n(* removed simp because of lemma stakewhile_sinftimes_lemma*)\nlemma sinf_inf: assumes \"#s = \\\" \n shows \"s\\<^sup>\\ = s\"\nby (metis assms sconc_fst_inf sinftimes_unfold)\n\n(* sinftimes is idempotent *)\nlemma sinf_dupE [simp]: \"(sinftimes s)\\<^sup>\\ = (s\\<^sup>\\)\"\nusing sinf_inf slen_sinftimes by force\n\n(* alternative unfold rule for sntimes, new element is appended on the end *)\nlemma sntimes_Suc2: \"(Suc i) \\ s = (i\\s) \\ s\"\napply (induction i)\napply simp\nby (metis assoc_sconc sntimes.simps(2))\n\n(* Blockwise stake from sinftimes to sntimes. *)\nlemma sinf2sntimes: assumes \"Fin y = #x\"\n shows \"stake (i*y)\\(x\\<^sup>\\) = i\\x\"\napply(induction i)\napply simp\nby (metis assms mult_Suc sdrop_plus sdrop_sinf sntimes.simps(2) stake_add stake_y) \n\n(* for any natural number i, sntimes is a prefix of sinftimes *)\nlemma snT_le_sinfT [simp]: \"i\\s \\ (s\\<^sup>\\)\"\nby (metis minimal monofun_cfun_arg ninf2Fin sconc_fst_inf sconc_snd_empty sinf2sntimes sinf_inf sntimes.simps(2) sntimes_Suc2 ub_stake)\n\n(* repeating the stream s i times produces a prefix of repeating s i+1 times *)\nlemma sntimes_leq: \"i\\s \\ (Suc i)\\s\"\nby (metis minimal monofun_cfun_arg sconc_snd_empty sntimes_Suc2)\n\n(* the repetitions of a stream constitute a chain *)\nlemma sntimes_chain: \"chain (\\i. i\\s)\"\nby (meson po_class.chainI sntimes_leq)\n\n(* xs is an infinite repetition of the finite stream x. Then dropping any fixed number i of repetitions\n of x leaves xs unchanged. *)\nlemma sdrop_sinf2: assumes \"xs = x\\xs\" and \"#x = Fin y\"\n shows \"sdrop (y*i)\\xs = xs\"\napply (induction i)\napply simp \nby (metis assms mult_Suc_right sdrop_plus sdropl6) \n\n(* the recursive definition for a stream (xs = x\\xs) is identical to the infinite repetition of x at\n every multiple of the length of x *)\nlemma stake_eq_sinf: assumes \"xs = x\\xs\" and \"#x = Fin y\" \n shows \"stake (i*y)\\xs = stake (i*y)\\(sinftimes x)\"\nproof (induction i)\n case 0 thus ?case by simp\nnext\n case (Suc i) \n have drop_xs:\"sdrop (i*y)\\xs = xs\" by (metis assms mult.commute sdrop_sinf2) \n\n have \"stake (Suc i * y)\\xs = stake (i*y)\\xs \\ stake y\\(sdrop (i*y)\\xs)\" by (metis add.commute mult_Suc stake_add) \n hence eq1:\"stake (Suc i * y)\\xs = stake (i*y)\\xs \\ x\" by (metis approxl1 assms drop_xs minimal monofun_cfun_arg sconc_snd_empty)\n \n have \"stake (Suc i * y)\\(sinftimes x) = stake (i*y)\\(sinftimes x) \\ stake y\\(sdrop (i*y)\\(sinftimes x))\" \n by (metis add.commute mult_Suc stake_add)\n hence eq2:\"stake (Suc i * y)\\(sinftimes x) = stake (i*y)\\(sinftimes x) \\ x\" by (simp add: assms(2)) \n\n thus ?case using Suc.IH eq1 by auto \nqed\n\n(* when repeating a stream s a different number of times, one of the repetitions will be a prefix of\n the other *)\nlemma stake_sntimes2sntimes: assumes \"j\\k\" and \"#s = Fin y\"\n shows \"stake (j*y)\\(k\\s) = j\\s\"\nby (smt assms(1) assms(2) min_def mult_le_mono1 sinf2sntimes stakeostake)\n\n(* for a stream s, a natural y and an arbitrary natural j, apply blockwise stake sntimes. *)\nlemma lubStake2sn: assumes \"#s = Fin y\"\n shows \"(\\ i. stake (y*j)\\(i\\s)) = j\\s\" (is \"(\\i. ?c i) = _\")\nproof -\n have \"max_in_chain j (\\i. ?c i)\" by (simp add: assms max_in_chainI mult.commute stake_sntimes2sntimes) \n thus ?thesis by (simp add: assms maxinch_is_thelub mult.commute sntimes_chain stake_sntimes2sntimes) \nqed\n\n(* building block of the lemma sntimesLub_Fin *)\nlemma sntimesChain: assumes \"#s = Fin y\" and \"y \\ 0\"\n shows \"\\j. stake (y*j)\\(\\ i. i\\s) = stake (y*j)\\ (s\\<^sup>\\)\"\nby (metis assms(1) contlub_cfun_arg lubStake2sn mult.commute sinf2sntimes sntimes_chain)\n\n(* proof for lemma sntimesLub_Fin *)\nlemma sntimesLub_Fin: assumes \"#s = Fin y\" and \"y \\ 0\"\n shows \"(\\ i. i\\s) = (s\\<^sup>\\)\"\nproof - \n have \"\\j. stake (j*y)\\(\\ i. i\\s) = stake (j*y)\\ (s\\<^sup>\\)\" by (metis assms(1) assms(2) mult.commute sntimesChain) \n hence \"\\j. stake j\\(\\ i. i\\s) = stake j\\ (s\\<^sup>\\)\" using assms by (metis gstake2stake)\n thus ?thesis by (simp add: stream.take_lemma)\nqed\n\n(* for any stream s the LUB of sntimes is sinftimes *)\nlemma sntimesLub[simp]:\"(\\ i. i\\s) = (s\\<^sup>\\)\"\napply(cases \"#s = \\\")\napply (metis inf2max sconc_fst_inf sinf_inf sntimes.simps(2) sntimes_chain)\nby (metis Fin_0 lncases lub_eq_bottom_iff slen_empty_eq sntimesLub_Fin sntimes_chain sntimes_eps strict_icycle)\n\n(* shows that any recursive definition with the following form is equal to sinftimes *)\nlemma rek2sinftimes: assumes \"xs = x \\ xs\" and \"x\\\\\"\n shows \"xs = sinftimes x\"\nproof (cases \"#x = \\\")\n case True thus ?thesis by (metis assms(1) sconc_fst_inf sinftimes_unfold)\nnext\n case False \n obtain y where y_def: \"Fin y = #x \\ y\\0\" by (metis False Fin_02bot assms(2) infI lnzero_def slen_empty_eq)\n hence \"\\i. stake (i*y)\\xs = stake (i*y)\\(x\\<^sup>\\)\" using assms(1) stake_eq_sinf by fastforce \n hence \"\\i. stake i\\xs = stake i\\(x\\<^sup>\\)\" using gstake2stake y_def by blast \n thus ?thesis by (simp add: stream.take_lemma)\nqed\n\n(* specializes the result from rek2sinftimes to singleton streams *)\nlemma s2sinftimes: assumes \"xs = \\x \\ xs\"\n shows \"xs = ((\\x)\\<^sup>\\)\"\nusing assms rek2sinftimes by fastforce\n\n(* shows that the infinite repetition of a stream x is the least fixed point of iterating (\\ s. x \\ s),\n which maps streams to streams *)\nlemma fix2sinf[simp]: \"fix\\(\\ s. x \\ s) = (x\\<^sup>\\)\"\n by (metis eta_cfun fix_eq fix_strict rek2sinftimes sconc_snd_empty strict_icycle)\n\nlemma snth_bool_sinftimes: \"snth (Suc n) ((\\bool \\ \\(\\ bool))\\<^sup>\\) = (\\ snth n ((\\bool \\ \\(\\bool))\\<^sup>\\))\"\n apply (induction n)\n apply (metis assoc_sconc shd1 sinftimes_unfold snth_scons snth_shd)\n by (metis (no_types, hide_lams) sconc_fst_empty sconc_scons' sinftimes_unfold snth_scons sup'_def)\n\nlemma sinftimes_srt: \"srt\\((\\a \\ \\b)\\<^sup>\\) = ((\\b \\ \\a)\\<^sup>\\)\"\n apply (subst sinftimes_unfold, simp)\n by (metis (no_types, lifting) assoc_sconc rek2sinftimes sinftimes_unfold strictI)\n \nlemma sinftimes_snth:\"(n mod 2 = 0 \\ snth n ((\\a \\ \\b)\\<^sup>\\) = a) \\ (n mod 2 = 1 \\ snth n ((\\a \\ \\b)\\<^sup>\\) = b)\"\nproof(induction n arbitrary: a b)\n case 0\n then show ?case \n by simp\nnext\n case (Suc n)\n moreover obtain m where m_def:\"n\\0 \\ n = Suc m\"\n using not0_implies_Suc by auto\n ultimately show ?case\n apply(cases \"n = 0\")\n apply(subst sinftimes_unfold, simp)\n apply (metis sconc_scons shd1 sinftimes_unfold snth_scons snth_shd)\n apply auto\n apply(subst sinftimes_unfold, simp)\n apply (simp add: snth_rt)\n apply (metis One_nat_def even_Suc parity_cases sinftimes_srt)\n apply(subst sinftimes_unfold, simp)\n apply (simp add: snth_rt)\n by (metis One_nat_def even_Suc parity_cases sinftimes_srt)\nqed\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term smap}\\\n(* ----------------------------------------------------------------------- *)\n\n(* smapping a function to the empty stream gives us the empty stream *)\nlemma strict_smap[simp]: \"smap f\\\\ = \\\"\nby (subst smap_def [THEN fix_eq2], simp)\n\n(* smap distributes over concatenation *)\nlemma smap_scons[simp]: \"smap f\\(\\a \\ s) = \\(f a) \\ smap f\\s\"\nby (subst smap_def [THEN fix_eq2], simp)\n\n(* if \\a as. f\\(\\a \\ as) is equal to \\(g a) \\ f\\as and f applied to bottom returns the bottom element, then\n f applied to s is the same as applying smap to g\\s *)\nlemma rek2smap: assumes \"\\a as. f\\(\\a \\ as) = \\(g a) \\ f\\as\"\n and \"f\\\\ = \\\"\n shows \"f\\s = smap g\\s\"\napply(rule ind [of _s])\nby(simp_all add: assms)\n\n(* mapping f over a singleton stream is equivalent to applying f to the only element in the stream *) \nlemma [simp]: \"smap f\\(\\a) = \\(f a)\"\nby (subst smap_def [THEN fix_eq2], simp)\n\n(* smap leaves the length of a stream unchanged *)\nlemma slen_smap[simp]: \"#(smap f\\x) = #x\"\nby (rule ind [of _ x], auto)\n\ntext \\@{term smap} maps each element @{term x} to @{term \"f(x)\"}\\\nlemma smap_snth_lemma:\n \"Fin n < #s \\ snth n (smap f\\s) = f (snth n s)\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"s\" in spec)\napply (induct_tac n, simp+)\nby (rule allI, rule_tac x=\"x\" in scases, simp+)+\n\ntext\\Doing smap in two passes, applying h in the first pass and g in the second is\nequivalent to applying g \\ h in a single pass\\\nlemma smaps2smap: \"smap g\\(smap h\\xs) = smap (\\ x. g (h x))\\xs\"\nby (simp add: smap_snth_lemma snths_eq)\n\ntext \\@{term sdrop} after @{term smap} is like @{term smap} after @{term sdrop}\\\nlemma sdrop_smap[simp]: \"sdrop k\\(smap f\\s) = smap f\\(sdrop k\\s)\"\napply (rule_tac x=\"k\" in spec)\napply (rule ind [of _ s], simp+)\napply (rule allI)\nby (case_tac \"x\", simp+)\n\ntext \\@{term \"smap f\"} is a homomorphism on streams with respect to concatenation\\\nlemma smap_split: \"smap f\\(a \\ b) = (smap f\\a) \\ (smap f\\b)\"\nproof (rule lncases [of \"#a\"], simp)\n fix k assume \"#a = Fin k\"\n thus ?thesis by (rule finind [of \"a\"], simp_all)\nqed\n\n(* smap distributes over infinite repetition *)\nlemma smap2sinf[simp]: \"smap f\\(x\\<^sup>\\)= ((smap f\\x)\\<^sup>\\)\"\nby (metis (no_types) rek2sinftimes sinftimes_unfold slen_empty_eq slen_smap smap_split strict_icycle)\n\n(* smap and infinity *)\nlemma l5: \"smap g\\((\\x)\\<^sup>\\) = ((\\(g x))\\<^sup>\\)\"\n by simp\n\n(* for any nonempty stream it holds that smap f to stream s is \\(f (shd s)) \\ smap f\\(srt\\s) *) \nlemma smap_hd_rst : \"s \\ \\ \\ smap f\\s = \\(f (shd s)) \\ smap f\\(srt\\s)\" by (metis smap_scons surj_scons)\n\n\n\n\nlemma smap_inj:\"inj f \\ inj (Rep_cfun (smap f))\"\n apply(rule injI)\n apply(rule snths_eq,auto)\n apply (metis slen_smap)\n by (metis inj_eq slen_smap smap_snth_lemma)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sprojfst} and @{term sprojsnd}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term sprojfst}\\\n\n(* sprojfst extracts the first element of the first tuple in any non-empty stream of tuples *)\nlemma sprojfst_scons[simp]: \"sprojfst\\(\\(x, y) \\ s) = \\x \\ sprojfst\\s\"\nby (unfold sprojfst_def, simp)\n\n(* the empty stream is a fixed point of sprojfst *)\nlemma strict_sprojfst[simp]: \"sprojfst\\\\ = \\\"\nby (unfold sprojfst_def, simp)\n\n(* sprojfst extracts the first element of any singleton tuple-stream *)\nlemma [simp]: \"sprojfst\\(\\(a,b)) = \\a\"\nby (simp add: sprojfst_def)\n\ntext \\same properties for @{term sprojsnd}\\\n\n(* sprojsnd extracts the second element of the first tuple in any non-empty stream of tuples *)\nlemma sprojsnd_scons[simp]: \"sprojsnd\\(\\(x,y) \\ s) = \\y \\ sprojsnd\\s\"\nby (unfold sprojsnd_def, simp)\n\n(* the empty stream is a fixed point of sprojsnd *)\nlemma strict_sprojsnd[simp]: \"sprojsnd\\\\ = \\\"\nby (unfold sprojsnd_def, simp)\n\n(* sprojsnd extracts the second element of any singleton tuple-stream *)\nlemma [simp]: \"sprojsnd\\(\\(a,b)) = \\b\"\n by (simp add: sprojsnd_def)\n\nlemma sprojsnd_shd:\n assumes \"s \\ \\\"\n shows \"shd (sprojsnd\\s) = snd (shd s)\"\n by (metis assms prod.collapse shd1 sprojsnd_scons surj_scons)\n\nlemma sconc_sprojsnd_shd: \n shows \"shd (sprojsnd\\(\\a \\ s)) = snd a\"\n by (simp add: sprojsnd_shd)\n\ntext \\@{term sprojfst} / @{term sprojsnd} and @{term srt} commute\\\n\n(* commutativity of sprojsnd and srt *)\nlemma rt_Sproj_2_eq: \"sprojsnd\\(srt\\x) = srt\\(sprojsnd\\x)\"\nby (rule ind [of _ x], auto)\n\n(* commutativity of sprojsnd and srt *)\nlemma rt_Sproj_1_eq: \"sprojfst\\(srt\\x) = srt\\(sprojfst\\x)\"\nby (rule ind [of _ x], auto)\n\ntext \\length of projections and the empty stream\\\n\n(* relation between sprojsnd and sprojfst with respect to the length operator *)\nlemma slen_sprojs_eq: \"#(sprojsnd\\x) = #(sprojfst\\x)\"\nby (rule ind [of _ \"x\"], auto)\n\n(* if sprojfst\\x is the empty stream, then x was already empty *)\nlemma strict_rev_sprojfst: \"sprojfst\\x = \\ \\ x = \\\"\nby (rule ccontr, rule_tac x=x in scases, auto)\n\n(* if sprojsnd\\x is the empty stream, then x was already empty *)\nlemma strict_rev_sprojsnd: \"sprojsnd\\x = \\ \\ x = \\\"\nby (rule ccontr, rule_tac x=x in scases, auto)\n\n(* sprojfst does not change the length of x *)\nlemma slen_sprojfst: \"#(sprojfst\\x) = #x\"\nby (rule ind [of _ \"x\"], auto)\n\n(* sprojsnd does not change the length of x *)\nlemma slen_sprojsnd: \"#(sprojsnd\\x) = #x\"\nby (rule ind [of _ \"x\"], auto)\n\n(* updis does not change the length *)\nlemma slen_updis_eq: \"#s1 = #s2 \\ #(updis x1 && s1) = #(updis x2 && s2)\"\n by (simp add: lscons_conv)\n\n(* helper lemma for deconstruct_infstream *)\nlemma deconstruct_infstream_h:\n assumes \"#s = \\\" obtains x xs where \"(updis x) && xs = s \\ #xs = \\\"\n using assms inf_scase lscons_conv by blast\n\n(* deconstruction of infinite streams *)\nlemma deconstruct_infstream:\n assumes \"#s = \\\" obtains x xs where \"(updis x) && xs = s \\ #xs = \\ \\ xs \\ \\\"\n by (metis Inf'_neq_0 assms deconstruct_infstream_h slen_empty_eq)\n\ntext \\Behaviour of projections on the n-th element in a stream\\\n\nlemma sprojfst_shd[simp]: assumes \"s\\\\\" shows \"shd (sprojfst\\s) = fst (shd s)\"\n by (metis assms prod.collapse shd1 sprojfst_scons surj_scons)\n\nlemma sprojfst_snth[simp]: assumes \"Fin n < #s\" shows \"snth n (sprojfst\\s) = fst (snth n s)\"\n using assms\nproof(induction n arbitrary: s)\n case 0\n then show ?case\n apply simp\n apply(rule sprojfst_shd)\n by auto\nnext\n case (Suc n)\n then show ?case\n apply(simp add: snth_rt)\n by (metis not_less rt_Sproj_1_eq slen_rt_ile_eq)\nqed\n\nlemma sprojfst_shd2[simp]: \"shd (sprojfst\\(\\a \\ s)) = fst (a)\"\n by simp\n\nlemma sprojsnd_snth:\n assumes \"Fin n < #s\" \n shows \"snth n (sprojsnd\\s) = snd (snth n s)\"\n using assms\n apply (induction n arbitrary: s)\n using sprojsnd_shd apply force\n by (metis leD leI rt_Sproj_2_eq slen_rt_ile_eq snth_rt)\n\nlemma sprojsnd_shd2[simp]: \"shd (sprojsnd\\(\\a \\ s)) = snd (a)\"\n by (simp add: sconc_sprojsnd_shd)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sfilter}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term sfilter}\\\n\n(* note that M is a set, not a predicate *)\nlemma strict_sfilter[simp]: \"sfilter M\\\\ = \\\"\nby (subst sfilter_def [THEN fix_eq2], simp)\n\n(* if the head of a stream is in M, then sfilter will keep the head *)\nlemma sfilter_in[simp]: \n \"a \\ M \\ sfilter M\\(\\a \\ s) = \\a \\ sfilter M\\s\" \nby (subst sfilter_def [THEN fix_eq2], simp)\n\n(* if the head of a stream isn't in M, then sfilter will discard the head *)\nlemma sfilter_nin[simp]: \n \"a \\ M \\ sfilter M\\(\\a \\ s) = sfilter M\\s\" \nby (subst sfilter_def [THEN fix_eq2], simp)\n\n(* if the sole element in a singleton stream is in M then sfilter is a no-op *)\nlemma [simp]: \"a \\ M \\ sfilter M\\(\\a) = \\a\"\nby (subst sfilter_def [THEN fix_eq2], simp)\n\n(* if the sole element in a singleton stream is not in M then sfilter produces the empty stream *)\nlemma [simp]: \"a \\ M \\ sfilter M\\(\\a) = \\\"\nby (subst sfilter_def [THEN fix_eq2], simp)\n\ntext \\@{term sfilter} and @{term sinftimes}\\\n\n(* filtering all elements that aren't in {a} from a stream consisting only of the element a has no effect *)\nlemma sfilter_sinftimes_in[simp]: \n \"sfilter {a}\\(sinftimes (\\a)) = sinftimes (\\a)\"\napply (rule stream.take_lemma)\napply (induct_tac n, auto)\napply (subst sinftimes_unfold, simp)\napply (rule sym)\nby (subst sinftimes_unfold, simp)\n\n(* if the element a isn't in the set F then filtering a stream of infinitely many a's using F will\n produce the empty stream *)\nlemma sfilter_sinftimes_nin:\n \"a \\ F \\ (F \\ (sinftimes (\\a))) = \\\"\nproof -\n assume a_nin_F: \"a \\ F\"\n have \"\\i. (F \\ (stake i\\(sinftimes (\\a)))) = \\\"\n proof (induct_tac i, simp_all)\n fix n assume \"F \\ (stake n\\(sinftimes (\\a))) = \\\"\n hence \"F \\ (stake (Suc n)\\(\\a \\ sinftimes (\\a))) = \\\" using a_nin_F by simp\n thus \"F \\ stake (Suc n)\\(sinftimes (\\a)) = \\\" by (subst sinftimes_unfold)\n qed\n hence \"(F \\ (\\i. stake i\\(sinftimes (\\a)))) = \\\" by (simp add:contlub_cfun_arg)\n thus ?thesis by (simp add: reach_stream)\nqed\n\ntext \\Filtering a postfix is at most as long as filtering the whole stream\\\nlemma slen_sfilter_sdrop_ile: \n \"#(sfilter X\\(sdrop n\\p)) \\ #(sfilter X\\p)\"\napply (rule spec [where x = \"n\"])\napply (rule ind [of _ p], auto)\napply (subst lnle_def, simp del: lnle_conv)\napply (case_tac \"x\", auto)\napply (case_tac \"a \\ X\", auto)\napply (erule_tac x=\"nat\" in allE)\nby (rule trans_lnle, auto)\n\ntext \\If the filtered stream is infinite, each filtered postfix is infinite\\\nlemma slen_sfilter_sdrop: \n \"\\p X. #(sfilter X\\p) = \\ \\ #(sfilter X\\(sdrop n\\p)) = \\\" \napply (induct_tac n, auto)\napply (rule_tac x=p in scases, auto)\nby (case_tac \"a\\X\", auto)\n\ntext \\@{term sfilter} on @{term \"stake n\"} returns \\\\\\ if none of the first\n @{term n} elements is included in the filter\\\nlemma sfilter_empty_snths_nin_lemma: \n \"\\p. (\\n. Fin n < #p \\ snth n p \\ X) \\ sfilter X\\(stake k\\p) = \\\"\napply (induct_tac k, auto)\napply (rule_tac x=p in scases, auto)\napply (case_tac \"a\\X\", auto)\napply (erule_tac x=\"0\" in allE, simp)\napply (case_tac \"n\", auto)\napply (erule_tac x=\"s\" in allE, auto)\nby (erule_tac x=\"Suc n\" in allE, auto)\n\ntext \\@{term sfilter} returns \\\\\\ if no element is included in the filter\\\nlemma ex_snth_in_sfilter_nempty:\n \"(\\n. Fin n < #p \\ snth n p \\ X) \\ sfilter X\\p = \\\"\napply (subgoal_tac \"sfilter X\\p = (\\k. sfilter X\\(stake k\\p))\")\napply (erule ssubst)\napply (subst lub_eq_bottom_iff, simp)\napply (subst sfilter_empty_snths_nin_lemma, simp+)\napply (subst contlub_cfun_arg [THEN sym], simp)\nby (simp add: reach_stream)\n\ntext \\@{term sfilter} returns the original streams if every element is included in the filter\\\nlemma sfilter_snths_in_lemma: \n \"\\p. (\\n. Fin n < #p \\ snth n p \\ X) \\ sfilter X\\(stake k\\p) = stake k\\p\"\n apply (induct_tac k, auto)\n apply (rule_tac x=p in scases, auto)\n apply (case_tac \"a\\X\", auto)\n apply (case_tac \"n\", auto)\n apply (erule_tac x=\"s\" in allE, auto)\n apply (erule_tac x=\"Suc n\" in allE, auto)\n by (erule_tac x=\"0\" in allE, simp)\n\nlemma sfilter_snths_in_stream_lemma:assumes a1:\" \\ n . Fin n <#p \\ snth n p \\ X\" \n shows \" p = sfilter X\\(p)\"\n apply (subst reach_stream [THEN sym], rule sym)\n apply (subst reach_stream [THEN sym],case_tac \"#p=\\\")\n apply(smt Inf.INF_cong a1 approxl1 assms monofun_cfun_arg sfilter_snths_in_lemma slen_stake_fst_inf stream.take_below)\n by (metis (no_types, hide_lams) assms infI fin2stake sfilter_snths_in_lemma)\n\ntext \\The filtered stream is at most as long as the original one\\\nlemma slen_sfilterl1: \"#(sfilter S\\x) \\ #x\"\napply (rule ind [of _ x], auto)\napply (subst lnle_def, simp del: lnle_conv)\napply (case_tac \"a \\ S\", auto)\nby (rule trans_lnle, auto)\n\ntext \\If the filtered stream is infinite, the original one is infinite as well\\\nlemma sfilterl4:\n \"#(sfilter X\\x) = \\ \\ #x = \\\"\nby (insert slen_sfilterl1 [of X x], auto)\n\ntext \\Prepending to the original stream never shortens the filtered result\\\nlemma sfilterl2: \n \"\\z. #(sfilter X\\s) \\ #(sfilter X\\((stake n\\z) \\ s))\"\napply (induct_tac n, auto)\napply (rule_tac x=z in scases, auto)\napply (case_tac \"a\\X\", auto)\napply (erule_tac x=\"sa\" in allE)\nby (drule trans_lnle, auto) \n\ntext \\The filtered result is not changed by concatenating streams which are\n filtered to \\\\\\\\\nlemma sfilterl3:\n \"\\s. #s = Fin k \\ sfilter S\\s = \\ \\ \n sfilter S\\(s\\Z) = sfilter S\\Z\" \napply (induct_tac k, auto)\napply (rule_tac x=s in scases, auto)\nby (case_tac \"a \\ S\", auto)\n\ntext \\A stream can be split by @{term stake} and @{term sdrop} for filtering\\\nlemma split_sfilter: \"sfilter X\\x = sfilter X\\(stake n\\x) \\ sfilter X\\(sdrop n\\x)\"\napply (rule_tac x=x in spec)\napply (induct_tac n, simp)\napply (rule allI)\napply (rule_tac x=x in scases, simp)\napply (erule_tac x=\"s\" in allE, auto)\nby (case_tac \"a \\ X\", auto)\n\ntext \\double filtering\\\nlemma int_sfilterl1[simp]: \"sfilter S\\(sfilter M\\s) = sfilter (S \\ M)\\s\"\napply (rule ind [of _ s], auto)\napply (case_tac \"a \\ S \\ M\", auto)\nby (case_tac \"a \\ M\", auto)\n\ntext \\Streams can be split for filtering\\\nlemma add_sfilter:\n \"#x = Fin k \\ sfilter t\\(x \\ y) = sfilter t\\x \\ sfilter t\\y\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"y\" in spec)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, auto)\napply (rule_tac x=\"x\" in scases, auto)\nby (case_tac \"a \\ t\", auto)\n\ntext \\After applying @{term \"smap f\"}, all elements are in the range of @{term f}\\\nlemma sfilter_smap_nrange: \n \"m \\ range f \\ sfilter {m}\\(smap f\\x) = \\\"\napply (rule ex_snth_in_sfilter_nempty [rule_format], simp)\napply (subst smap_snth_lemma, simp+)\napply (rule notI)\napply (drule sym)\nby (drule_tac f=\"f\" in range_eqI, simp)\n\nlemma sfilter_lub_inf: assumes \"\\n. \\i. Fin n \\ #(A \\ (Y i))\" and \"chain Y\"\n shows \" #(A \\ (\\i. Y i)) = \\\"\nproof(rule ccontr)\n assume as: \"#(A \\ (\\i::nat. Y i)) \\ \\\"\n obtain n where n_def:\"#(A \\ (\\i. Y i)) = Fin n\"\n using as lncases by auto\n obtain i where i_def:\"Fin (Suc n) \\ #(A \\ (Y i))\"\n using assms(1) by blast\n have \"#(A \\ (Y i)) \\ #(A \\ (\\i::nat. Y i))\"\n using assms(2) cont_pref_eq1I is_ub_thelub mono_slen by blast\n thus False\n using dual_order.trans i_def n_def by fastforce\nqed\n\nlemma snth_filter: \"Fin n < #s \\ snth n s\\A \\ sfilter A\\s \\\\\"\n apply(induction n arbitrary: s)\n apply auto\n apply (metis lnsuc_neq_0_rev sfilter_in slen_scons strict_slen surj_scons)\n apply(simp add: snth_rt)\n by (metis Fin_02bot Fin_Suc inject_Fin lnzero_def n_not_Suc_n not_le only_empty_has_length_0 sfilter_in sfilter_nin slen_rt_ile_eq slen_scons stream.sel_rews(2) strictI surj_scons)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term stakewhile}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term stakewhile}\\\n\n(* stakewhile f to an empty stream returns the empty stream *)\nlemma strict_stakewhile[simp]: \"stakewhile f\\\\ = \\\"\nby (subst stakewhile_def [THEN fix_eq2], simp)\n\n(* if the head a passes the predicate f, then the result of stakewhile will start with \\a *)\nlemma stakewhile_t[simp]: \"f a \\ stakewhile f\\(\\a \\ s) = \\a \\ stakewhile f\\s\"\nby (subst stakewhile_def [THEN fix_eq2], simp)\n\n(* if the head a fails the predicate f, then stakewhile will produce the empty stream *)\nlemma stakewhile_f[simp]: \"\\f a \\ stakewhile f\\(\\a \\ s) = \\\"\nby (subst stakewhile_def [THEN fix_eq2], simp)\n\n(* if the element a passes the predicate f, then stakewhile applied to \\a is a no-op *)\nlemma [simp]: \"f a \\ stakewhile f\\(\\a) = \\a\"\nby (subst stakewhile_def [THEN fix_eq2], simp)\n\n(* if the element a fails the predicate f, then stakewhile applied to \\a will produce the empty stream *)\nlemma [simp]: \"\\f a \\ stakewhile f\\(\\a) = \\\"\nby (subst stakewhile_def [THEN fix_eq2], simp)\n\n(* stakewhile can't increase the length of a stream *)\nlemma stakewhile_less [simp]: \"#(stakewhile f\\s)\\#s\"\napply(rule ind [of _ s], auto)\napply (metis (mono_tags, lifting) admI inf_chainl4 inf_ub l42)\nby (metis bot_is_0 lnle_def lnsuc_lnle_emb minimal slen_empty_eq slen_scons stakewhile_f stakewhile_t)\n\n(* stakewhile doesn't take elements past an element that fails the predicate f *)\nlemma stakewhile_slen[simp]: \"\\f (snth n s) \\ #(stakewhile f\\s)\\Fin n\"\napply(induction n arbitrary: s)\napply (metis Fin_02bot lnat_po_eq_conv lnzero_def sdrop_0 slen_empty_eq snth_def stakewhile_f strict_stakewhile surj_scons)\nby (smt inject_scons slen_rt_ile_eq snth_rt stakewhile_f stakewhile_t stream.take_strict strict_stakewhile surj_scons ub_slen_stake)\n\n(* the prefix of the constant stream of x's whose elements aren't equal to x is empty *)\nlemma [simp]: \"stakewhile (\\a. a \\ x)\\\\x\\<^sup>\\ = \\\"\nby (metis (full_types)sinftimes_unfold stakewhile_f)\n\n(* stakewhile produces a prefix of the input *)\nlemma stakewhile_below[simp]: \"stakewhile f\\s \\ s\"\napply(induction s)\napply(simp+)\nby (smt minimal monofun_cfun_arg stakewhile_f stakewhile_t stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n(* if stakewhile leaves a stream s unchanged, then every element must pass the predicate f *) \nlemma stakewhile_id_snth: assumes \"stakewhile f\\s = s\" and \"Fin n < #s\"\nshows \"f (snth n s)\"\nby (metis Fin_leq_Suc_leq assms(1) assms(2) less2eq less2lnleD lnless_def stakewhile_slen)\n\n(* if stakewhile produces a result of length n or greater, then the nth element in s must pass f *)\nlemma stakewhile_snth[simp]: assumes \"Fin n < #(stakewhile f\\s)\"\nshows \"f (snth n s)\"\nby (meson assms not_less stakewhile_slen)\n\n(* if stakewhile changes the stream s, then there must be an element in s that fails the predicate f *)\nlemma stakewhile_notin [simp]: \n shows \"stakewhile f\\s \\ s \\ #(stakewhile f\\s) = Fin n \\ \\ f (snth n s)\"\n apply(induction n arbitrary:s)\n apply (metis Fin_02bot lnat.con_rews slen_scons snth_shd stakewhile_t surj_scons)\n by (smt Fin_02bot Fin_Suc approxl2 inject_scons lnat.con_rews lnat_po_eq_conv lnsuc_lnle_emb lnzero_def slen_empty_eq slen_rt_ile_eq snth_rt snth_shd stakewhile_below stakewhile_slen stakewhile_t stream.take_strict surj_scons ub_slen_stake)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term stwbl}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties for @{term stwbl}\\\n\n(* stwbl f to an empty stream returns the empty stream *) \nlemma strict_stwbl[simp]: \"stwbl f\\\\ = \\\"\nby (subst stwbl_def [THEN fix_eq2], simp)\n\n(* if the head a passes the predicate f, then the result of stwbl will start with \\a *)\nlemma stwbl_t[simp]: \"f a \\ stwbl f\\(\\a \\ s) = \\a \\ stwbl f\\s\"\nby (subst stwbl_def [THEN fix_eq2], simp)\n\n(* if the head a fails the predicate f, then stwbl will produce only \\a *)\nlemma stwbl_f[simp]: \"\\ f a \\ stwbl f\\(\\a \\ s) = \\a\"\nby (subst stwbl_def [THEN fix_eq2], simp)\n\n(* if s is not empty, then stwbl f also does not return the empty stream *)\nlemma stwbl_notEps: \"s\\\\ \\ (stwbl f\\s)\\\\\"\nby (smt lnat.con_rews lnzero_def sconc_snd_empty slen_scons strict_slen stwbl_f stwbl_t surj_scons)\n\n(* if stwbl f applied to s returns the empty stream, then s was empty *)\nlemma stwbl_eps: \"stwbl f\\s = \\ \\ s=\\\"\nusing strict_stwbl stwbl_notEps by blast\n\ntext \\@{term sfilter} after @{term stakewhile}: produce the empty stream\\\nlemma sfilter_twl1[simp]: \n \"sfilter X\\(stakewhile (\\x. x\\X)\\p) = \\\"\napply (rule ind [of _ p], auto)\nby (case_tac \"a\\X\", auto)\n\ntext \\@{term sfilter} after @{term stakewhile}: redundant filtering\\\nlemma sfilter_twl2[simp]: \n \"sfilter X\\(stakewhile (\\x. x\\X)\\p) = stakewhile (\\x. x\\X)\\p\"\napply (rule ind [of _ p], auto)\nby (case_tac \"a\\X\", auto)\n\ntext \\If @{term \"stakewhile (\\p. p = t)\"} returns an infinite stream, all prefixes\n of the original stream only consist of \"@{term t}\"s\\\nlemma stakewhile_sinftimes_lemma: \n \"\\z. #(stakewhile (\\p. p = t)\\z) = \\ \\ stake n\\z = stake n\\(sinftimes (\\t))\"\napply (induct_tac n, auto)\napply (subst sinftimes_unfold, simp)\napply (rule_tac x=z in scases, auto)\nby (case_tac \"a=t\", auto)\n\ntext \\If @{term \"stakewhile (\\p. p = t)\"} returns an infinite stream, the original stream\n is an infinite \"@{term t}\"-stream\\\nlemma stakewhile_sinftimesup: \n \"#(stakewhile (\\p. p = t)\\z) = \\ \\ z = sinftimes (\\t)\"\napply (rule stream.take_lemma)\nby (rule stakewhile_sinftimes_lemma [rule_format])\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sdropwhile}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties for @{term sdropwhile}\\\n\n(* sdropwhile f applied to the empty stream returns the empty stream *)\nlemma strict_sdropwhile[simp]: \"sdropwhile f\\\\ = \\\"\nby (subst sdropwhile_def [THEN fix_eq2], simp)\n\n(* if the head a passes the predicate f, then the result of sdropwhile will drop the head *)\nlemma sdropwhile_t[simp]: \"f a \\ sdropwhile f\\(\\a \\ s) = sdropwhile f\\s\"\nby (subst sdropwhile_def [THEN fix_eq2], simp)\n\n(* if the head a fails the predicate f, then the result of sdropwhile will start with \\a *)\nlemma sdropwhile_f[simp]: \"\\f a \\ sdropwhile f\\(\\a \\ s) = \\a \\ s\"\nby (subst sdropwhile_def [THEN fix_eq2], simp)\n\n(* if the only element in a singleton stream passes the predicate f, then sdropwhile will produce\n the empty stream *)\nlemma [simp]: \"f a \\ sdropwhile f\\(\\a) = \\\"\nby (subst sdropwhile_def [THEN fix_eq2], simp)\n\n(* if the only element in a singleton stream fails the predicate f, then sdropwhile will be a no-op *)\nlemma [simp]: \"\\f a \\ sdropwhile f\\(\\a) = \\a\"\nby (subst sdropwhile_def [THEN fix_eq2], simp)\n\ntext \\special cases of @{term sfilter} after @{term sdropwhile}\\\n\n(* the elements removed by sdropwhile are a subset of the elements removed by sfilter *)\nlemma sfilter_dwl1[simp]: \n \"sfilter X\\(sdropwhile (\\x. x\\X)\\p) = sfilter X\\p\"\napply (rule ind [of _ p], auto)\nby (case_tac \"a\\X\", auto)\n\n(* the elements kept by sfilter are a subset of the elements kept by sdropwhile *)\nlemma sfilter_dwl2:\n \"sfilter T\\s \\ \\ \\ sdropwhile (\\a. a \\ T)\\s \\ \\\"\napply (rule notI)\napply (erule notE)\napply (subst sfilter_dwl1 [THEN sym])\nby simp\n\ntext \\Construct @{term stwbl} from @{term stakewhile}, @{term stake} and @{term sdropwhile}\\\nlemma stwbl_stakewhile: \"stwbl f\\s = stakewhile f\\s \\ (stake (Suc 0)\\(sdropwhile f\\s))\"\napply (rule stream.take_lemma)\napply (rule_tac x=\"s\" in spec)\napply (induct_tac n, simp+)\napply (rule allI)\napply (rule_tac x=\"x\" in scases, simp+)\nby (case_tac \"f a\", simp+)\n\ntext \\Constructing @{term sdropwhile} from @{term stakewhile} and @{term sdrop}\\\nlemma stakewhile_sdropwhilel1:\n \"\\x. #(stakewhile f\\x) = Fin n \\ sdropwhile f\\x = sdrop n\\x\" \napply (induct_tac n, auto)\napply (rule_tac x=x in scases, auto)\napply (case_tac \"f a\", auto)\napply (rule_tac x=x in scases, auto)\nby (case_tac \"f a\", auto)\n\ntext \\@{term sdropwhile} is idempotent\\\nlemma sdropwhile_idem: \"sdropwhile f\\(sdropwhile f\\x) = sdropwhile f\\x\"\napply (rule ind [of _ x], auto)\nby (case_tac \"f a\", auto)\n\ntext \\@{term stakewhile} after @{term sdropwhile} gives the empty stream\\\nlemma tdw[simp]: \"stakewhile f\\(sdropwhile f\\s) = \\\"\napply (rule ind [of _ s], auto)\nby (case_tac \"f a\", auto)\n\n(* relation between stakewhile and sdropwhile *)\nlemma stakewhileDropwhile: \"stakewhile f\\s \\ (sdropwhile f\\s) = s \"\napply(rule ind [of _s])\napply (rule admI)\napply (metis (no_types, lifting) approxl2 inf_chainl4 lub_eqI lub_finch2 sconc_fst_inf split_streaml1 stakewhile_below stakewhile_sdropwhilel1)\napply simp\nby (metis assoc_sconc sconc_fst_empty sdropwhile_f sdropwhile_t stakewhile_t tdw)\n\ntext \\For the head of @{term \"sdropwhile f\\x\"}, @{term f} does not hold\\\nlemma sdropwhile_resup: \"sdropwhile f\\x = \\a \\ s \\ \\ f a\"\napply (subgoal_tac \"sdropwhile f\\(\\a \\ s) = \\a \\ s\")\napply (case_tac \"f a\", auto)\napply rotate_tac\napply (drule cfun_arg_cong [of _ _ \"stakewhile f\"], simp)\napply (drule sym, simp)\nby (rule sdropwhile_idem)\n\ntext \\elimination rule for @{term sfilter} after @{term sdropwhile}\\\nlemma sfilter_srtdwl3[simp]: \n \"sfilter X\\(srt\\(sdropwhile (\\x. x\\X)\\p)) = srt\\(sfilter X\\p)\"\napply (rule ind [of _ p], auto)\nby (case_tac \"a\\X\", auto)\n\ntext \\Further results concerning @{term sfilter}\\\n\ntext \\After filtering by filter @{term T}, the head of the result is in @{term T}\n (for non-empty results)\\\nlemma sfilter_ne_resup: \"sfilter T\\s \\ \\ \\ shd (sfilter T\\s) \\ T\"\napply (subst sfilter_dwl1 [THEN sym])\napply (rule_tac x=\"sdropwhile (\\x. x \\ T)\\s\" in scases, auto)\napply (drule sfilter_dwl2, simp)\napply (rule_tac x=\"s\" in scases, auto)\napply (case_tac \"aa \\ T\", auto)\napply (drule inject_scons, simp)\nby (drule sdropwhile_resup, simp)\n\ntext \\same result for @{term sconc} syntax\\\nlemma sfilter_resl2:\n \"sfilter T\\s = \\a \\ as \\ a \\ T\"\napply (case_tac \"sfilter T\\s = \\\", simp)\nby (drule sfilter_ne_resup, simp)\n\ntext \\After filtering with filter @{term T}, each element is in @{term T}\\\nlemma sfilterl7:\n \"\\Fin n < #x; sfilter T\\s = x\\ \\ snth n x \\ T\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"s\" in spec)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac n, auto)\napply (rule sfilter_ne_resup)\napply (rule_tac x=\"sfilter T\\xa\" in scases, auto)\napply (rule_tac x=\"xa\" in scases, auto)\napply (simp add: Fin_Suc [THEN sym] del: Fin_Suc)\napply (case_tac \"a \\ T\", auto)\napply (case_tac \"sfilter T\\s = \\\",simp+)\napply (simp add: Fin_Suc [THEN sym] del: Fin_Suc)\napply (rule_tac x=\"sfilter T\\s\" in scases, auto)\napply (erule_tac x=\"sa\" in allE,simp+)\napply (frule sfilter_resl2)\napply (drule mp)\nby (rule_tac x=\"srt\\(sdropwhile (\\x. x\\T)\\s)\" in exI,simp+)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term srtdw}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\basic properties of @{term srtdw}\\\n\n(* srtdw f applied to the empty stream always returns the empty stream *)\nlemma [simp]: \"srtdw f\\\\ = \\\"\nby (simp add: srtdw_def)\n\n(* the rest of any singleton stream is the empty stream, regardless of whether the only element in\n the stream was dropped *)\nlemma [simp]: \"srtdw f\\(\\a) = \\\"\napply (simp add: srtdw_def)\nby (case_tac \"f a\", auto)\n\n(* if the head a passes the predicate f, srtdw will drop the head *)\nlemma [simp]: \"f a \\ srtdw f\\(\\a\\as) = srtdw f\\as\"\nby (auto simp add: srtdw_def)\n\n(* if the head a fails the predicate f, srtdw will produce the rest of the stream *)\nlemma [simp]: \"\\ f a \\ srtdw f\\(\\a\\as) = as\"\nby (simp add: srtdw_def)\n\ntext \\@{term \"sfilter M\"} after @{term \"srtdw (\\x. x \\ M)\"} almost behaves\n like @{term \"sfilter M\"} alone\\\nlemma sfilterl8:\n \"sfilter M\\x \\ \\ \\\n #(sfilter M\\x) = lnsuc\\(#(sfilter M\\(srtdw (\\x. x \\ M)\\x)))\"\napply (simp add: atomize_imp)\napply (rule ind [of _ x], simp+)\napply (rule impI)\nby (case_tac \"a \\ M\", simp+)\n\ntext \\similar result for infinite streams\\\nlemma sfilter_srtdwl2:\n \"#(sfilter X\\s) = \\ \\ #(sfilter X\\(srtdw (\\a. a \\ X)\\s)) = \\\"\napply (case_tac \"sfilter X\\s = \\\", auto)\nby (drule sfilterl8, auto)\n\ntext \\streams can be split by @{term stwbl} and @{term srtdw}\\\nlemma stwbl_srtdw: \"stwbl f\\s \\ srtdw f\\s = s\"\napply (rule stream.take_lemma)\napply (rule_tac x=\"s\" in spec)\napply (induct_tac n, simp+)\napply (rule allI)\napply (rule_tac x=\"x\" in scases, simp+)\nby (case_tac \"f a\", simp+)\n\n(* the length of srtdw f\\x is always smaller than the length of x *)\nlemma slen_srtdw: \"#(srtdw f\\x) \\ #x\"\napply (rule ind [of _ x])\napply (subst lnle_conv [THEN sym], simp del: lnle_conv, simp)\napply (case_tac \"f a\", simp+)\nby (rule trans_lnle, simp+)\n\n(* stwbl produces a prefix of the input *)\nlemma stwbl_below [simp]: \"stwbl f\\s \\ s\"\nby (metis (no_types) minimal monofun_cfun_arg sconc_snd_empty stwbl_srtdw)\n\n(* relation between srtdw and stwbl *) \nlemma srtdw_stwbl [simp]: \"srtdw f\\ (stwbl f\\s) = \\\" (is \"?F s\")\nproof(rule ind [of _s ])\n show \"adm ?F\" by simp\n show \"?F \\\" by simp\n fix a\n fix s\n assume IH: \"?F s\"\n thus \"?F (\\a \\ s)\" \n proof (cases \"f a\")\n case True thus ?thesis by (simp add: IH)\n next\n case False thus ?thesis by simp\n qed\nqed\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term srcdups}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Basic simplification rules for @{term srcdups}\\\n\n(* srcdups applied to the empty stream returns the empty stream *)\nlemma strict_srcdups[simp]: \"srcdups\\\\ = \\\" \nby (subst srcdups_def [THEN fix_eq2], simp)\n\n(* a singleton stream can't possibly contain duplicates *)\nlemma [simp]: \"srcdups\\(\\a) = \\a\"\nby (subst srcdups_def [THEN fix_eq2], simp)\n\n(* if the head a of a stream is followed by a duplicate, only one of the two elements will be kept by srcdups *)\nlemma srcdups_eq[simp]: \"srcdups\\(\\a\\\\a\\s) = srcdups\\(\\a\\s)\" \napply (subst srcdups_def [THEN fix_eq2], simp)\nby (rule sym, subst srcdups_def [THEN fix_eq2], simp)\n\n(* if the head a of a stream is followed by a distinct element, both elements will be keypt by srcdups *)\nlemma srcdups_neq[simp]: \n \"a\\b \\ srcdups\\(\\a \\ \\b \\ s) = \\a \\ srcdups\\(\\b \\ s)\" \n by (subst srcdups_def [THEN fix_eq2], simp)\n \nlemma srcdups_slen [simp]: \"#(srcdups\\s) \\ #s\"\n apply (rule ind [of _ s])\n apply (simp_all)\n apply (metis (mono_tags, lifting) admI inf_chainl4 inf_ub l42)\n apply (rule_tac x=s in scases, simp_all)\n apply (case_tac \"a = aa\", simp_all)\n using less_lnsuc order.trans by blast\n \n(*Used for ABP-Composition of sender and receiver*)\nlemma srcdups_eq2:\"a=b \\ srcdups\\(\\a\\\\b\\s) = srcdups\\(\\b\\s)\"\n by simp\n \nlemma srcdups_ex:\"\\y. srcdups\\(\\a\\s) = \\a\\y\"\n by(subst srcdups_def [THEN fix_eq2], auto)\n \nlemma srcdups_shd[simp]:\"shd (srcdups\\(\\a\\s)) = a\"\n by(subst srcdups_def [THEN fix_eq2],auto)\n\nlemma srcdups_srt:\"srt\\(srcdups\\(\\a\\s)) = (srcdups\\(sdropwhile (\\z. z = a)\\s))\"\n by(subst srcdups_def [THEN fix_eq2], auto)\n \nlemma srcdups_shd2[simp]:\"s\\\\ \\ shd (srcdups\\s) = shd s\"\n by(subst srcdups_def [THEN fix_eq2],auto)\n\nlemma srcdups_srt2:\"s\\\\ \\ srt\\(srcdups\\s) = (srcdups\\(sdropwhile (\\z. z = shd s)\\(srt\\s)))\"\n by(subst srcdups_def [THEN fix_eq2],auto)\n\nlemma srcdups_imposs_h:\"Fin 1 < #(srcdups\\s) \\ shd(srcdups\\s)\\shd(srt\\(srcdups\\s))\"\n apply (cases \"s=\\\")\n using empty_is_shortest apply fastforce\n apply (subst srcdups_srt2,auto)\n apply (subgoal_tac \"srcdups\\(sdropwhile (\\z. z = shd s)\\(srt\\s))\\\\\")\n apply (metis (mono_tags, lifting) sdropwhile_resup srcdups_shd2 strict_srcdups surj_scons)\nproof -\n assume a1: \"s \\ \\\"\n assume a2: \"Fin 1 < #(srcdups\\s)\"\n have f1:\"Fin 0 = 0\"\n using Fin_02bot bot_is_0 by presburger\n then have \"lnsuc\\0 = Fin (Suc 0)\"\n by (metis Fin_Suc)\n then show \"srcdups\\ (sdropwhile (\\a. a = shd s)\\(srt\\s)) \\ \\\"\n using a2 a1 f1\n by (metis Suc_leI less2nat not_le not_one_le_zero srcdups_srt2 srt_decrements_length strict_slen zero_le_one)\nqed\n\nlemma srcdups_imposs:\"srcdups\\(\\a \\ s) \\ \\a \\ \\a \\ y\"\n apply(cases \"#(srcdups\\(\\a \\s)) < Fin 1 \") \n apply (metis One_nat_def bot_is_0 lnat.con_rews neq02Suclnle not_less slen_scons)\n apply(insert srcdups_imposs_h[of \"\\a\\ s\"])\n by (metis Fin_02bot Fin_Suc One_nat_def lnat.con_rews lnat.sel_rews(2) lscons_conv neq_iff shd1 \n slen_scons stream.sel_rews(5) up_defined) \n \nlemma srcdupsimposs: \"srcdups\\(\\a \\ s) \\ \\a \\ \\a \\ srcdups\\s\"\n by (simp add: srcdups_imposs)\n \nlemma srcdupsimposs2_h2:\"\\x. srcdups\\(\\a \\ s)\\ \\a \\ \\a \\ x\"\n by (simp add: srcdups_imposs)\n \nlemma srcdupsimposs2: \"srcdups\\(\\a \\ s) \\ \\a \\ \\a \\ s\"\n by(simp add: srcdups_imposs) \n \nlemma srcdups_anotb_h:\"srcdups\\(\\a\\\\b) = \\a \\ \\b \\ a \\ b\"\n by (metis sconc_snd_empty srcdups_imposs)\n \nlemma srcdups_anotb:\"srcdups\\(\\a \\ \\b \\ s) = \\a \\ \\b \\ s \\ a\\ b\"\n using srcdupsimposs2_h2 by auto\n\nlemma srcdups2srcdups: \"srcdups\\(srcdups\\s) = srcdups\\s\"\nproof(induction rule: ind [of _ s])\n case 1\n then show ?case \n by simp\nnext\n case 2\n then show ?case \n by simp\nnext\n case (3 a s)\n have f1:\"a = shd s \\ s\\\\\\ srcdups\\(\\a \\ s) = srcdups\\s\"\n using srcdups_eq[of \"shd s\" \"srt\\s\"] surj_scons[of s] by auto\n have f2:\"a=shd s \\ s\\\\ \\ srcdups\\(srcdups\\(\\a \\ s)) = srcdups\\(\\a \\ s)\"\n using f1 \"3.IH\" by auto\n moreover have\"a\\shd s \\ srcdups\\(\\a \\ s) = \\a\\srcdups\\s\"\n by (metis srcdups_neq srcdups_shd srcdups_srt strict_sdropwhile surj_scons)\n ultimately have f3:\"a\\ shd s \\srcdups\\(srcdups\\(\\a \\ s)) = srcdups\\(\\a \\ s)\"\n proof -\n assume a1: \"a \\ shd s\"\n then have f2: \"srcdups\\(\\a \\ s) = \\a \\ srcdups\\s\"\n by (metis \\a \\ shd s \\ srcdups\\(\\a \\ s) = \\a \\ srcdups\\s\\)\n obtain ss :: \"'a stream \\ 'a \\ 'a stream\" where\n f3: \"\\a s. srcdups\\(\\a \\ s) = \\a \\ ss s a\"\n by (meson srcdups_ex)\n then have f4: \"\\(shd s) \\ srt\\s = s \\ srcdups\\(\\a \\ s) = \\a \\ \\(shd s) \\ ss (srt\\s) (shd s)\"\n using f2 by metis\n have f5: \"\\(shd s) \\ srt\\s = s \\ srcdups\\(\\(shd s) \\ ss (srt\\s) (shd s)) = srcdups\\s\"\n using f3 by (metis \"3.IH\")\n { assume \"\\a \\ s \\ srcdups\\(\\a \\ s)\"\n then have \"s \\ \\\"\n by force\n then have ?thesis\n using f5 f4 f2 a1 by (simp add: surj_scons) }\n then show ?thesis\n by fastforce\n qed\n then show ?case\n using f2 by fastforce\nqed\n \nlemma srcdups_prefix_neq:\"x \\ y \\ srcdups\\x \\x \\ srcdups\\y \\ y\"\nproof(induction arbitrary: y rule: ind [of _ x])\n case 1\n then show ?case \n by simp\n next\n case 2\n then show ?case\n by simp\n next\n case (3 a s)\n have f1:\"a=shd s \\ srcdups\\(\\a \\ s) = srcdups\\s\"\n by (metis \"3.prems\"(2) srcdups_eq2 srcdups_shd srcdups_srt strict_sdropwhile strict_srcdups surj_scons)\n have f2:\"a\\shd s \\ srcdups\\(\\a \\ s) = \\a \\ srcdups\\s\"\n by (metis srcdups_neq srcdups_shd srcdups_srt strict_sdropwhile surj_scons)\n then have f3:\"a\\shd s\\ srcdups\\s \\ s\"\n using \"3.prems\" by auto\n show ?case\n by (smt \"3.IH\" \"3.prems\"(1) f1 f2 f3 less_fst_sconsD lscons_conv scases srcdups2srcdups \n srcdups_eq srcdups_ex srcdups_srt srcdupsimposs2 stream.con_rews(2) stream.sel_rews(5) \n sup'_def surj_scons)\nqed\n\nlemma srcdups_smap_adm [simp]: \n \"adm (\\a. srcdups\\(smap f\\(srcdups\\a)) = smap f\\(srcdups\\a) \n \\ srcdups\\(smap f\\a) = smap f\\(srcdups\\a))\"\n apply (rule adm_imp, auto)\n apply(rule adm_upward)\n apply rule+\n using srcdups_prefix_neq\n by (metis monofun_cfun_arg)\n \nlemma srcdups_smap_com_h:\"s\\\\ \\ a \\ shd s \\ srcdups\\(smap f\\(srcdups\\(\\a \\ s))) = smap f\\(srcdups\\(\\a \\ s)) \\f (shd s) \\ f a\"\n apply(cases \"shd(srt\\s) \\ shd s\")\n apply (insert srcdups_neq[of a \"shd s\" \"srt\\s\"] surj_scons[of s], simp)\n apply (metis smap_scons srcdups_ex srcdupsimposs2_h2)\n apply (insert srcdups_neq[of a \"shd s\" \"srt\\s\"] surj_scons[of s], simp)\n apply(insert srcdups_ex[of \"shd s\" \"srt\\s\"],auto)\n by (simp add: srcdupsimposs2_h2)\n\nlemma srcdups_smap_com:\n shows \"srcdups\\(smap f\\(srcdups\\s)) = smap f\\(srcdups\\s) \\ srcdups\\(smap f\\s)= smap f\\(srcdups\\s)\"\n proof(induction rule: ind [of _ s])\n case 1\n then show ?case \n by simp\n next\n case 2\n then show ?case \n by simp\n next\n case (3 a s)\n have s_eps: \"s = \\ \\ srcdups\\(\\(f a) \\ smap f\\s) = smap f\\(srcdups\\(\\a \\ s))\" by simp\n hence f1: \"shd s = a \\ ?case\" \n by (metis \"3.IH\" \"3.prems\" smap_scons srcdups_eq surj_scons)\n have h1: \"s\\\\ \\ s = (\\(shd s) \\ srt\\s)\" by (simp add: surj_scons)\n have h2: \"s\\\\ \\ shd s\\a \\f (shd s) \\ f a \\ srcdups\\(smap f\\(\\a \\ (\\(shd s) \\ srt\\s))) = smap f\\(srcdups\\(\\a \\ (\\(shd s) \\ srt\\s)))\"\n proof -\n assume a1: \"f (shd s) \\ f a\"\n assume a2: \"s \\ \\\"\n assume a3: \"shd s \\ a\"\n have f4: \"s = \\(shd s) \\ srt\\s\"\n using a2 by (metis h1)\n obtain ss :: \"'b stream \\ 'b \\ 'b stream\" where\n f5: \"\\b s. srcdups\\(\\b \\ s) = \\b \\ ss s b\"\n by (meson srcdups_ex)\n then have f6: \"\\(shd s) \\ ss (srt\\s) (shd s) = srcdups\\s\"\n using f4 by metis\n have f7: \"srcdups\\ (\\(f a) \\ \\(f (shd s)) \\ smap f\\ (ss (srt\\s) (shd s))) = \\(f a) \\ srcdups\\ (\\(f (shd s)) \\ smap f\\ (ss (srt\\s) (shd s)))\"\n using a1 by auto\n have f8: \"\\a \\ \\(shd s) \\ ss (srt\\s) (shd s) = srcdups\\(\\a \\ \\(shd s) \\ srt\\s)\"\n using f5 a3 by (metis (no_types) srcdups_neq)\n then have f9: \"\\(f a) \\ \\(f (shd s)) \\ smap f\\ (ss (srt\\s) (shd s)) = smap f\\(srcdups\\(\\a \\ s))\"\n using f4 by (metis (no_types) smap_scons)\n then obtain ssa :: \"'a stream \\ 'a \\ 'a stream\" where\n f10: \"\\(f a) \\ ssa (\\(f (shd s)) \\ ssa (smap f\\(ss (srt\\s) (shd s))) (f (shd s))) (f a) = srcdups\\(smap f\\(srcdups\\(\\a \\ s)))\"\n by (simp add: \"3.prems\")\n then have f11: \"\\(f a) \\ ssa (\\(f (shd s)) \\ ssa (smap f\\(ss (srt\\s) (shd s))) (f (shd s))) (f a) = srcdups\\ (\\(f a) \\ \\(f (shd s)) \\ smap f\\ (ss (srt\\s) (shd s)))\"\n using f9 by presburger\n have \"\\(f a) \\ ssa (\\(f (shd s)) \\ ssa (smap f\\(ss (srt\\s) (shd s))) (f (shd s))) (f a) = \\(f a) \\ smap f\\(srcdups\\s)\"\n using f10 f8 f6 f4 by (metis (no_types) \"3.prems\" smap_scons)\n then have \"srcdups\\(smap f\\s) = smap f\\(srcdups\\s)\"\n using f11 f7 f6 by (metis (no_types) \"3.IH\" inject_scons smap_scons)\n then have \"srcdups\\ (smap f\\(\\a \\ \\(shd s) \\ srt\\s)) = smap f\\ (\\a \\ \\(shd s) \\ ss (srt\\s) (shd s))\"\n using f6 f4 a1 by (metis (no_types) smap_scons srcdups_neq)\n then show ?thesis\n using f8 by presburger\n qed\n have f2: \"s\\\\ \\ shd s\\a \\f (shd s) \\ f a \\ ?case\"\n using h1 h2 by auto\n have f3: \"s\\\\ \\ shd s\\a \\f (shd s) = f a \\ ?case\"\n by (simp add: \"3.prems\" srcdups_smap_com_h)\n then show ?case using f1 f2 by fastforce\n qed\n\nlemma srcdups_nbot: \"s\\\\\\srcdups\\s \\ \\\"\n by (metis lscons_conv srcdups_ex stream.con_rews(2) surj_scons)\n \nlemma srcdups_fin: assumes \"#(srcdups\\s)<\\\" and \"#s=\\\"\n obtains x where \"srcdups\\x = srcdups\\s\" and \"x\\s\" and \"#x < \\\"\nproof -\n obtain n where \"srcdups\\(stake n\\s) = srcdups\\s\"\n by (metis assms(1) fun_approxl2 min.strict_order_iff ninf2Fin)\n thus ?thesis\n using lnless_def that by auto \nqed\n\nlemma srcdups_step: \"srcdups\\(\\a \\ s) = \\a \\ srcdups\\(sdropwhile (\\x. x=a)\\s)\"\n apply(rule ind [of _ s], simp_all)\n by (metis lscons_conv srcdups_ex srcdups_srt stream.sel_rews(5) up_defined) \n\nlemma snprefix: \"\\x\\y \\ lshd\\x=lshd\\y \\ \\(srt\\x)\\(srt\\y)\"\n apply auto\n by (metis lshd_updis monofun_cfun_arg stream.sel_rews(2) stream.sel_rews(3) sup'_def surj_scons)\n\nlemma srcdups_consec_noteq: \"Fin (Suc n) < #(srcdups\\xs) \\ snth n (srcdups\\xs) \\ snth (Suc n) (srcdups\\xs)\"\nproof\n fix n :: nat\n assume \"Fin (Suc n) < #(srcdups\\xs)\" and \"snth n (srcdups\\xs) = snth (Suc n) (srcdups\\xs)\"\n then obtain a s where \"sdrop n\\(srcdups\\xs) = \\a \\ \\a \\ s\"\n by (metis convert_inductive_asm drop_not_all sdrop_back_rt snth_def surj_scons)\n then have p: \"srcdups\\(sdrop n\\(srcdups\\xs)) \\ sdrop n\\(srcdups\\xs)\"\n by (simp add: srcdupsimposs2_h2)\n have not_p: \"srcdups\\(sdrop n\\(srcdups\\xs)) = sdrop n\\(srcdups\\xs)\"\n proof -\n have \"srcdups\\(sdrop n\\(srcdups\\xs)) = sdrop n\\(srcdups\\(srcdups\\xs))\"\n proof (induction n)\n case 0\n then show ?case\n by simp\n next\n case (Suc n)\n then show ?case\n by (metis sdrop_back_rt srcdups2srcdups srcdups_srt2 stream.sel_rews(2))\n qed\n thus \"srcdups\\(sdrop n\\(srcdups\\xs)) = sdrop n\\(srcdups\\xs)\"\n by (simp add: srcdups2srcdups)\n qed\n thus \"False\"\n using p by auto\nqed\n\nlemma bool_stream_snth:\n fixes s t :: \"bool stream\" and n :: nat and a :: bool\n shows \"s = \\a \\ t \\ Fin n < #(srcdups\\s) \\ snth n (srcdups\\s) = (even n = a)\"\nproof (induction n)\n case 0\n then show ?case\n by simp\nnext\n case (Suc n)\n then show ?case\n using convert_inductive_asm even_Suc srcdups_consec_noteq by blast\nqed\n\nlemma srcdups_snth_stake_fin: \"\\s n. #s = Fin k \\ k > (Suc n) \\ snth n s \\ snth (Suc n) s \\ srcdups\\(stake (Suc n)\\s) \\ srcdups\\s\"\nproof (induction k rule: less_induct)\n case (less k)\n then show ?case\n proof (cases \"k \\ Suc 0\")\n case True\n then show ?thesis\n using less.prems(2) by linarith\n next\n case False\n then obtain a b t where \"s = \\a \\ \\b \\ t\"\n by (metis drop_not_all leI le_SucI less.prems(1) less2nat_lemma sdrop_0 sdrop_back_rt surj_scons)\n obtain l where \"k = Suc l\"\n using Suc_less_eq2 less.prems(2) by blast\n then have \"l < k\"\n by simp\n moreover have \"#(\\b \\ t) = Fin l\"\n using \\k = Suc l\\ \\s = \\a \\ \\b \\ t\\ less.prems(1) by auto\n then show ?thesis\n proof (cases n)\n case 0\n then have \"srcdups\\(stake (Suc n)\\s) = \\a\"\n by (simp add: \\s = \\a \\ \\b \\ t\\)\n moreover have \"srcdups\\s \\ \\a\"\n proof -\n have \"snth 0 s \\ snth (Suc 0) s\"\n using \"0\" less.prems(3) by blast\n then have \"a \\ b\"\n by (simp add: \\s = \\a \\ \\b \\ t\\)\n then have \"srcdups\\s = \\a \\ srcdups\\(\\b \\ t)\"\n using \\s = \\a \\ \\b \\ t\\ srcdups_neq by blast\n then show ?thesis\n using srcdups_nbot by force\n qed\n ultimately show ?thesis\n by auto\n next\n case (Suc m)\n have \"Suc m < l\"\n using Suc \\k = Suc l\\ less.prems(2) by blast\n moreover have \"snth m (\\b \\ t) \\ snth (Suc m) (\\b \\ t)\"\n proof -\n have \"\\b \\ t = srt\\s\"\n by (simp add: \\s = \\a \\ \\b \\ t\\)\n then show ?thesis\n by (metis (no_types) Suc less.prems(3) sdrop_forw_rt snth_def)\n qed\n ultimately have \"srcdups\\(stake (Suc m)\\(\\b \\ t)) \\ srcdups\\(\\b \\ t)\"\n using \\#(\\b \\ t) = Fin l\\ \\l < k\\ less.IH by blast\n then have \"srcdups\\(\\b \\ (stake m\\t)) \\ srcdups\\(\\b \\ t)\"\n by simp\n then have \"srcdups\\s \\ \\a \\ (srcdups\\(\\b \\ (stake m\\t)))\"\n by (metis (no_types, lifting) \\s = \\a \\ \\b \\ t\\ inject_scons srcdups2srcdups srcdups_eq srcdups_neq srcdups_step)\n then show ?thesis\n proof -\n { assume \"a \\ b\"\n then have \"srcdups\\(\\a \\ \\b \\ stake m\\t) \\ srcdups\\s\"\n using \\srcdups\\s \\ \\a \\ srcdups\\(\\b \\ stake m\\t)\\ by auto\n then have ?thesis\n using Suc \\s = \\a \\ \\b \\ t\\ by force }\n then show ?thesis\n using Suc \\s = \\a \\ \\b \\ t\\ \\srcdups\\(\\b \\ stake m\\t) \\ srcdups\\(\\b \\ t)\\ by fastforce\n qed\n qed\n qed\nqed\n\nlemma srcdups_end_neq: \"#s < \\ \\ a \\ b \\ srcdups\\(s \\ \\a \\ \\b) = srcdups\\(s \\ \\a) \\ \\b\"\nproof (rule finind3 [of s], simp+)\n assume \"#s < \\\" and \"a \\ b\"\n then show \"srcdups\\(\\a \\ \\b) = \\a \\ \\b\"\n by (metis lscons_conv srcdups_neq srcdups_step strict_sdropwhile strict_srcdups sup'_def)\nnext\n fix t :: \"'a stream\" and c :: 'a\n assume \"#t < \\\" and \"srcdups\\(t \\ \\a \\ \\b) = srcdups\\(t \\ \\a) \\ \\b\"\n then have \"srcdups\\(\\c \\ (t \\ \\a)) \\ \\b = srcdups\\(\\c \\ (t \\ \\a \\ \\b))\"\n proof (cases \"t = \\\")\n case True\n then show ?thesis\n by (metis (no_types, lifting) \\srcdups\\(t \\ \\a \\ \\b) = srcdups\\(t \\ \\a) \\ \\b\\ assoc_sconc inject_scons sconc_snd_empty srcdups_eq srcdups_neq)\n next\n case False\n then have not_empty: \"t \\ \\\"\n by simp\n then show ?thesis\n proof (cases \"c = shd t\")\n case True\n then show ?thesis\n by (metis False \\srcdups\\(t \\ \\a \\ \\b) = srcdups\\(t \\ \\a) \\ \\b\\ sconc_scons srcdups_eq surj_scons)\n next\n case False\n then have \"srcdups\\(\\c \\ (t \\ \\a \\ \\b)) = \\c \\ srcdups\\(t \\ \\a \\ \\b)\"\n proof -\n have \"\\(shd t) \\ srt\\t = t\"\n using not_empty surj_scons by blast\n then show ?thesis\n by (metis (no_types) False assoc_sconc srcdups_neq)\n qed\n then show ?thesis\n proof -\n have \"\\(shd t) \\ srt\\t = t\"\n by (meson not_empty surj_scons)\n then show ?thesis\n by (metis (no_types) False \\srcdups\\(t \\ \\a \\ \\b) = srcdups\\(t \\ \\a) \\ \\b\\ assoc_sconc srcdups_neq)\n qed\n qed\n qed\n thus \"srcdups\\((\\c \\ t) \\ \\a \\ \\b) = srcdups\\((\\c \\ t) \\ \\a) \\ \\b\"\n by simp\nqed\n\nlemma srcdups_end_eq: \"srcdups\\(s \\ \\a \\ \\a) = srcdups\\(s \\ \\a)\"\nproof (cases \"#s < \\\")\n case True\n then show ?thesis\n proof (rule finind3, simp)\n show \"srcdups\\(\\a \\ \\a) = \\a\"\n by (simp add: srcdups_step)\n next\n fix t :: \"'a stream\" and b :: 'a\n assume \"#t < \\\" and \"srcdups\\(t \\ \\a \\ \\a) = srcdups\\(t \\ \\a)\"\n then show \"srcdups\\((\\b \\ t) \\ \\a \\ \\a) = srcdups\\((\\b \\ t) \\ \\a)\"\n proof (cases \"t = \\\")\n case True\n then show ?thesis\n by (metis sconc_snd_empty srcdups_eq srcdups_neq)\n next\n case False\n then have 1: \"t \\ \\\"\n by simp\n then show ?thesis\n proof(cases \"shd t = b\")\n case True\n then show ?thesis\n by (metis False \\srcdups\\(t \\ \\a \\ \\a) = srcdups\\(t \\ \\a)\\ assoc_sconc srcdups_eq surj_scons)\n next\n case False\n have \"t \\ \\\"\n by (simp add: \"1\")\n then have \"srcdups\\(\\b \\ t \\ \\a \\ \\a) = \\b \\ srcdups\\(t \\ \\a \\ \\a)\"\n by (metis (no_types, lifting) False assoc_sconc srcdups_neq surj_scons)\n then show ?thesis\n by (metis (no_types, lifting) \"1\" False \\srcdups\\(t \\ \\a \\ \\a) = srcdups\\(t \\ \\a)\\ sconc_scons srcdups_neq surj_scons)\n qed\n qed\n qed\nnext\n case False\n then show ?thesis\n by (simp add: less_le)\nqed\n\nlemma srcdups_sntimes: \"n > 0 \\ srcdups\\(sntimes n (\\a)) = \\a\"\nproof (induction n)\n case 0\n then show ?case\n by simp\nnext\n case (Suc n)\n then show ?case\n proof (cases \"n > 0\")\n case True\n then show ?thesis\n by (metis Suc.IH gr0_implies_Suc sntimes.simps(2) srcdups_eq)\n next\n case False\n then show ?thesis\n by auto\n qed\nqed\n\nlemma srcdups_sntimes_prefix: \"n > 0 \\ srcdups\\((sntimes n (\\a)) \\ s) = \\a \\ srcdups\\(sdropwhile (\\x. x=a)\\s)\"\nproof (induction n)\n case 0\n then show ?case\n by simp\nnext\n case (Suc n)\n then show ?case\n proof (cases \"n > 1\")\n case True\n then obtain m where \"n = Suc m\" and \"m > 0\"\n by (metis One_nat_def Suc_lessE)\n then have \"srcdups\\((sntimes (Suc n) (\\a)) \\ s) = srcdups\\((sntimes n (\\a)) \\ s)\"\n by (simp add: \\n = Suc m\\)\n then show ?thesis\n using Suc.IH \\n = Suc m\\ zero_less_Suc by auto \n next\n case False\n have \"srcdups\\(\\a \\ s) = \\a \\ srcdups\\(sdropwhile (\\x. x=a)\\s)\"\n using srcdups_step by blast\n moreover have \"sntimes 1 (\\a) = \\a\"\n by (simp add: One_nat_def)\n ultimately show ?thesis\n by (metis (no_types, lifting) False One_nat_def Suc_lessI assoc_sconc neq0_conv sntimes.simps(2) srcdups_eq)\n qed\nqed\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sscanl}\\\n(* ----------------------------------------------------------------------- *)\n\n(* SSCANL with the empty stream results in the empty stream *)\nlemma SSCANL_empty[simp]: \"SSCANL n f q \\ = \\\"\nby (induct_tac n, auto)\n\ntext \\monotonicity of SSCANL\\\nlemma mono_SSCANL: \n \"\\ x y q. x \\ y \\ SSCANL n f q x \\ SSCANL n f q y\"\napply (induct_tac n, auto)\napply (drule lessD, erule disjE, simp)\napply (erule exE)+\napply (erule conjE)+\nby (simp, rule monofun_cfun_arg, simp)\n\ntext \\result of @{term \"SSCANL n\"} only depends on first @{term n}\n elements of input stream\\\nlemma contlub_SSCANL:\n \"\\f q s. SSCANL n f q s = SSCANL n f q (stake n\\s)\"\napply (induct_tac n, auto)\napply (rule_tac x=s in scases)\napply auto\napply (rule_tac x=s in scases)\nby auto\n\ntext \\@{term SSCANL} is a chain. This means that, for all fixed inputs,\n @{term \"SSCANL i\"} returns a prefix of @{term \"SSCANL (Suc i)\"}\\\nlemma chain_SSCANL: \"chain SSCANL\"\napply (rule chainI)\napply (subst fun_below_iff)+\napply (induct_tac i, auto)\napply (rule monofun_cfun_arg)\napply (erule_tac x=\"x\" in allE)\napply (erule_tac x=\"x xa (shd xb)\" in allE)\nby (erule_tac x=\"srt\\xb\" in allE, auto)\n\ntext \\@{term sscanl} is a continuous function\\\nlemma cont_lub_SSCANL: \"cont (\\s. \\i. SSCANL i f q s)\" \napply (rule cont2cont_lub)\napply (rule ch2ch_fun)\napply (rule chainI)\napply (rule fun_belowD [of _ _ \"q\"])\napply (rule fun_belowD [of _ _ \"f\"])\napply (rule chainE)\napply (rule chain_SSCANL)\napply (rule pr_contI)\napply (rule monofunI)\napply (rule mono_SSCANL [rule_format], assumption)\napply (rule allI)\napply (rule_tac x=\"i\" in exI)\nby (rule contlub_SSCANL [rule_format])\n\ntext \\Basic simplification rules for @{term sscanl}\\\n(* sscanl applied to the empty stream returns the empty stream *)\nlemma sscanl_empty[simp]: \"sscanl f q\\\\ = \\\"\napply (simp add: sscanl_def)\napply (subst beta_cfun, rule cont_lub_SSCANL)\nby (subst is_lub_const \n [THEN lub_eqI, of \"\\\", THEN sym], simp)\n\n(* scanning \\a\\s using q as the initial element is equivalent to computing \\(f q a) and appending the\n result of scanning s with (f q a) as the initial element *)\nlemma sscanl_scons[simp]: \n \"sscanl f q\\(\\a\\s) = \\(f q a) \\ sscanl f (f q a)\\s\" \napply (simp add: sscanl_def)\napply (subst beta_cfun, rule cont_lub_SSCANL)+\napply (subst contlub_cfun_arg)\napply (rule ch2ch_fun, rule ch2ch_fun)\napply (rule chainI)\napply (rule fun_belowD [of _ _ \"f\"])\napply (rule chain_SSCANL [THEN chainE])\napply (subst lub_range_shift [where j=\"Suc 0\", THEN sym])\napply (rule ch2ch_fun, rule ch2ch_fun)\napply (rule chainI)\napply (rule fun_belowD [of _ _ \"f\"])\nby (rule chain_SSCANL [THEN chainE], simp)\n\n(* scanning a singleton stream is equivalent to computing \\(f a b) *)\nlemma sscanl_one[simp]: \"sscanl f a\\(\\b) = \\(f a b)\"\nby (insert sscanl_scons [of f a b \\], auto)\n\ntext \\applying @{term sscanl} never shortens the stream\\\nlemma fair2_sscanl: \"#x \\ #(sscanl f a\\x)\"\napply (rule spec [where x = a])\napply (rule ind [of _ x], auto)\nby (subst lnle_def, simp del: lnle_conv)\n\n(* The first element of the result of sscanl_h is (f q (shd s)) *)\nlemma sscanl_shd: \"s\\\\ \\ shd (sscanl f q\\s) = (f q (shd s))\"\nby (metis shd1 sscanl_scons surj_scons)\n\n(* dropping the first element of the result of sscanl is equivalent to beginning the scan with \n (f a (shd s)) as the initial element and proceeding with the rest of the input *)\nlemma sscanl_srt: \"srt\\(sscanl f a\\s) = sscanl f (f a (shd s)) \\(srt\\s) \"\nby (metis (no_types, lifting) sconc_fst_empty sconc_scons' sscanl_empty sscanl_scons stream.sel_rews(2) stream.sel_rews(5) sup'_def surj_scons up_defined)\n\n(* the n + 1'st element produced by sscanl is the result of mering the n + 1'st item of s with the n'th\n element produced by sscanl *)\nlemma sscanl_snth: \"Fin (Suc n) < #s \\ snth (Suc n) (sscanl f a\\s) = f (snth n (sscanl f a\\s)) (snth (Suc n) s)\"\napply(induction n arbitrary: a s)\napply (smt Fin_02bot Fin_leq_Suc_leq less2lnleD less_lnsuc lnat_po_eq_conv lnless_def lnzero_def shd1 slen_empty_eq slen_rt_ile_eq snth_scons snth_shd sscanl_scons surj_scons)\nby (smt Fin_Suc lnat_po_eq_conv lnle_def lnless_def lnsuc_lnle_emb lnzero_def minimal slen_scons snth_scons sscanl_scons strict_slen surj_scons)\n\n(* the result of sscanl has the same length as the input stream x *)\nlemma fair_sscanl[simp]: \"#(sscanl f a\\x) = #x\"\napply (rule spec [where x = a])\nby (rule ind [of _ x], auto)\n\n(* Verification of sscanl with sscanl_nth *)\n\nprimrec sscanl_nth :: \"nat \\ ('a \\ 'a \\ 'a) \\ 'a \\ 'a stream \\ 'a\" where\n\"sscanl_nth 0 f q s = f q (shd s)\" |\n\"sscanl_nth (Suc n) f q s = sscanl_nth n f (f q (shd s)) (srt\\s)\"\n\n(* Nth element of sscanl is equal to sscanl_nth *)\nlemma sscanl2sscanl_nth:\n \"Fin n<#s \\ snth n (sscanl f q\\s) = sscanl_nth n f q s\"\nproof (induction n arbitrary: q s, auto)\n fix q :: \"'a\" and s :: \"'a stream\" and k :: \"lnat\"\n assume a1: \"#s = lnsuc\\k\"\n hence h1: \"s \\ \\\"\n using lnsuc_neq_0_rev strict_slen by auto\n thus \"shd (sscanl f q\\s) = f q (shd s)\"\n by (simp add: sscanl_shd)\nnext\n fix n :: \"nat\" and q :: \"'a\" and s :: \"'a stream\"\n assume a2: \"\\q s. Fin n < #s \\ snth n (sscanl f q\\s) = sscanl_nth n f q s\"\n assume a3: \"Fin (Suc n) < #s\"\n thus \"snth (Suc n) (sscanl f q\\s) = sscanl_nth n f (f q (shd s)) (srt\\s)\"\n by (metis a2 a3 leI not_less slen_rt_ile_eq snth_rt sscanl_srt)\nqed\n\nlemma sscan_ntimes_loop:\n assumes \"\\r. sscanl f state\\(s \\ r) = out \\ (sscanl f state\\r)\" \n shows \"sscanl f state\\(sntimes n s) = sntimes n out\"\n using assms\n by (induction n, simp_all)\n\nlemma sscanl_inftimes_loop:\n assumes \"\\r. sscanl f state\\(s \\ r) = out \\ (sscanl f state\\r)\"\n shows \"sscanl f state\\(sinftimes s) = sinftimes out\"\n using assms\n by (metis rek2sinftimes sinftimes_unfold slen_empty_eq sscanl_empty fair_sscanl strict_icycle) \n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term szip}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Basic simplification rules of @{term szip}\\\n\n(* szip applied to \\\\s returns the empty stream *)\nlemma strict_szip_fst[simp]: \"szip\\\\\\s = \\\"\nby (subst szip_def [THEN fix_eq2],simp)\n\n(* szip applied to s\\\\ returns the empty stream *)\nlemma strict_szip_snd[simp]: \"szip\\s\\\\ = \\\"\nby (subst szip_def [THEN fix_eq2], simp)\n\n(* unfolding szip *)\nlemma szip_scons[simp]: \"szip\\(\\a\\s1)\\(\\b\\s2) = \\(a,b) \\ (szip\\s1\\s2)\"\nby (subst szip_def [THEN fix_eq2], simp)\n\n(* rules for szip *)\nlemma [simp]: \"szip\\(\\a)\\(\\b \\ y) = \\(a,b)\"\nby (subst szip_def [THEN fix_eq2], simp)\n\n(* rules for szip *)\nlemma [simp]: \"szip\\(\\a \\ x)\\(\\b) = \\(a,b)\"\nby (subst szip_def [THEN fix_eq2], simp)\n\n(* rules for szip *)\nlemma [simp]: \"szip\\(\\a)\\(\\b) = \\(a,b)\"\nby (subst szip_def [THEN fix_eq2], simp)\n\ntext \\If @{term szip} returns an empty stream, an input stream was empty\\\nlemma strict_rev_szip: \"szip\\x\\y = \\ \\ x = \\ \\ y = \\\"\napply (rule_tac x=x in scases, auto)\nby (rule_tac x=y in scases, auto)\n\ntext \\@{term sprojfst} and @{term sprojsnd} are \"inverse\" functions of\n @{term szip} - if the other zipped stream is infinite\\\nlemma sprojfst_szipl1[rule_format]: \n \"\\x. #x = \\ \\ sprojfst\\(szip\\i\\x) = i\"\napply (rule ind [of _ i], auto)\nby (rule_tac x=x in scases, auto)\n\n(* analogous for sprojsnd *)\nlemma sprojsnd_szipl1[rule_format]: \n \"\\x. #x = \\ \\ sprojsnd\\(szip\\x\\i) = i\"\napply (rule ind [of _ i], auto)\nby (rule_tac x=x in scases, auto)\n\n(* zipping the infinite constant streams \\x\\ and \\y\\ is equivalent to infinitely repeating the tuple\n \\(x, y) *)\nlemma szip2sinftimes[simp]: \"szip\\((\\x)\\<^sup>\\)\\((\\y)\\<^sup>\\) = ((\\(x, y))\\<^sup>\\) \"\nby (metis s2sinftimes sinftimes_unfold szip_scons)\n\n(* the length of szip\\as\\bs is the minimum of the lengths of as and bs *)\nlemma szip_len [simp]: \"#(szip\\as\\bs) = min (#as) (#bs)\"\napply(induction as arbitrary: bs)\napply(rule admI)\napply auto[1]\napply (metis inf_chainl4 inf_less_eq lub_eqI lub_finch2 min_def slen_sprojsnd sprojsnd_szipl1)\napply simp\napply(case_tac \"bs=\\\")\napply auto[1]\nproof -\n fix u :: \"'a discr u\"\n fix as:: \"'a stream\"\n fix bs:: \"'b stream\"\n assume as1: \"u \\ \\\" and \n as2: \"(\\bs::'b stream. #(szip\\as\\bs) = min (#as) (#bs))\" and as3: \"bs \\ \\\" \n obtain a where a_def: \"updis a = u\" by (metis (mono_tags)as1 lshd_updis stream.sel_rews(4) stream.sel_rews(5) surj_scons)\n obtain b bs2 where b_def: \"bs = \\b \\ bs2\" by (metis as3 surj_scons) \n hence \"#(szip\\(\\a \\ as)\\(\\b \\ bs2)) = min (#(\\a \\ as)) (#(\\b \\ bs2))\" by (simp add: as2 min_def) \n thus \"#(szip\\(u && as)\\bs) = min (#(u && as)) (#bs)\" by (metis a_def b_def lscons_conv) \nqed\n\nlemma szip_nth: \"Fin n < #s1 \\ Fin n < #s2 \\ snth n (szip\\s1\\s2) = (snth n s1, snth n s2)\"\n apply(induction n arbitrary: s1 s2)\n apply auto\n apply (metis lnsuc_neq_0 only_empty_has_length_0 shd1 surj_scons szip_scons)\n apply(simp add: snth_rt)\n by (smt empty_is_shortest leD not_le only_empty_has_length_0 only_empty_has_length_0 only_empty_has_length_0 slen_rt_ile_eq slen_rt_ile_eq snth_rt snth_scons stream.sel_rews(2) stream.sel_rews(2) strict_slen strict_slen strict_slen strict_szip_snd surj_scons surj_scons szip_scons)\n\nlemma szip_sdrop: \"sdrop n\\(szip\\s\\t) = szip\\(sdrop n\\s)\\(sdrop n\\t)\"\n apply(induction n arbitrary: s t, simp)\n by (metis (no_types, lifting) sdrop_forw_rt sdrop_scons stream.sel_rews(2) strict_szip_fst \n strict_szip_snd surj_scons szip_scons)\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sscanlA}\\\n(* ----------------------------------------------------------------------- *)\n\nlemma sscanla_cont: \"cont (\\s. sprojfst\\(sscanl (\\(_,b). f b) (undefined, s0)\\s))\"\n by simp\n\nlemma sscanla_len [simp]: \"#(sscanlA f s0\\s) = #s\"\n by (simp add: sscanlA_def slen_sprojfst)\n\nlemma sscanla_bot [simp]: \"sscanlA f s0\\\\ = \\\"\n by (simp add: sscanlA_def)\n\nlemma sscanla_step [simp]: \"sscanlA f s0\\(\\a \\ as) = \\(fst (f s0 a)) \\ sscanlA f (snd (f s0 a))\\as\"\n apply(simp add: sscanlA_def sprojfst_def)\nproof -\n have \"(case f s0 a of (a, x) \\ f x) = (case (undefined::'a, snd (f s0 a)) of (a, x) \\ f x)\"\nby (metis (no_types) old.prod.case prod.collapse)\n then have \"\\(shd as) \\ srt\\as = as \\ sscanl (\\(a, y). f y) (f s0 a)\\as = sscanl (\\(a, y). f y) (undefined, snd (f s0 a))\\ (\\(shd as) \\ srt\\as)\"\n by (metis (no_types) sscanl_scons)\n then show \"\\(fst (f s0 a)) \\ smap fst\\ (sscanl (\\(a, y). f y) (f s0 a)\\ as) = \\(fst (f s0 a)) \\ smap fst\\ (sscanl (\\(a, y). f y) (undefined, snd (f s0 a))\\ as)\"\n using surj_scons by force\nqed\n\nlemma sscanla_one [simp]: \"sscanlA f b\\(\\x) = \\(fst (f b x))\"\n apply(simp add: sscanlA_def)\n by (metis prod.collapse sconc_snd_empty sprojfst_scons strict_sprojfst)\n\nlemma sscanla_shd: \"s\\\\ \\ shd (sscanlA f q\\s) = fst (f q (shd s))\"\n by (metis shd1 sscanla_step surj_scons)\n\nlemma sscanla_srt: \"srt\\(sscanlA f a\\s) = sscanlA f (snd (f a (shd s)))\\(srt\\s)\"\n by (metis (no_types, lifting) sconc_fst_empty sconc_scons' sscanla_bot sscanla_step stream.sel_rews(2) stream.sel_rews(5) sup'_def surj_scons up_defined)\n\nlemma sscanla_ntimes_loop:\n assumes \"\\r. sscanlA f state\\(s \\ r) = out \\ (sscanlA f state\\r)\" \n shows \"sscanlA f state\\(sntimes n s) = sntimes n out\"\n using assms\n by (induction n, simp_all)\n\nlemma sscanla_inftimes_loop:\n assumes \"\\r. sscanlA f state\\(s \\ r) = out \\ (sscanlA f state\\r)\"\n shows \"sscanlA f state\\(sinftimes s) = sinftimes out\"\n using assms\n by (metis rek2sinftimes sinftimes_unfold slen_empty_eq sscanla_bot sscanla_len strict_icycle) \n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sscanlAg}\\\n(* ----------------------------------------------------------------------- *)\n\nlemma sscanlag_cont: \"cont (\\s. (sscanl (\\(b,_). f b) (s0, undefined)\\s))\"\n by simp\n\nlemma sscanlag_len [simp]: \"#(sscanlAg f s0\\s) = #s\"\n by(simp add: sscanlAg_def slen_sprojsnd)\n\nlemma sscanlag_bot [simp]: \"sscanlAg f s0\\\\ = \\\"\n by (simp add: sscanlAg_def)\n\n\nlemma sscanlag_one [simp]: \"sscanlAg f b\\(\\x) = \\(fst(f b x), snd (f b x))\"\n by(simp add: sscanlAg_def)\n\nlemma sscanlag_step [simp]: \"sscanlAg f s0\\(\\a \\ as) = \\((f s0 a)) \\ sscanlAg f (fst (f s0 a))\\as\"\n apply(simp add: sscanlAg_def sprojfst_def)\n by (smt case_prod_conv prod.collapse sscanl_empty sscanl_scons surj_scons)\n\nlemma sscanlag_shd: \"s\\\\ \\ shd (sscanlAg f q\\s) = (f q (shd s))\"\n by (metis shd1 sscanlag_step surj_scons)\n\nlemma sscanlag_srt: \"srt\\(sscanlAg f a\\s) = sscanlAg f (fst (f a (shd s)))\\(srt\\s)\"\n by (metis (no_types, lifting) sconc_fst_empty sconc_scons' sscanlag_bot sscanlag_step stream.sel_rews(2) stream.sel_rews(5) sup'_def surj_scons up_defined)\n\nlemma snth_sscanlAg:\n assumes \"Fin (Suc j)<#i\"\n shows \"snth (Suc j) (sscanlAg f s0\\i) = f (fst (snth j (sscanlAg f s0\\i))) (snth (Suc j) i)\"\n apply(simp add: sscanlAg_def)\n by (metis (mono_tags, lifting) assms case_prod_conv prod.exhaust_sel sscanl_snth)\n\nlemma sscanlag_ntimes_loop:\n assumes \"\\r. sscanlAg f state\\(s \\ r) = out \\ (sscanlAg f state\\r)\" \n shows \"sscanlAg f state\\(sntimes n s) = sntimes n out\"\n using assms\n by (induction n, simp_all)\n\nlemma sscanlag_inftimes_loop:\n assumes \"\\r. sscanlAg f state\\(s \\ r) = out \\ (sscanlAg f state\\r)\"\n shows \"sscanlAg f state\\(sinftimes s) = sinftimes out\"\n using assms\n by (metis rek2sinftimes sinftimes_unfold slen_empty_eq sscanlag_bot sscanlag_len strict_icycle) \n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sscanlAfst}\\\n(* ----------------------------------------------------------------------- *)\n\nlemma sscanlafst_cont: \"cont (\\s. sprojfst\\(sscanlAg (\\(_,b). f b) (undefined, s0)\\s))\"\n by simp\n\nlemma sscanlafst_len [simp]: \"#(sscanlAfst f s0\\s) = #s\"\n by (simp add: sscanlAfst_def slen_sprojfst)\n\nlemma sscanlafst_bot [simp]: \"sscanlAfst f s0\\\\ = \\\"\n by (simp add: sscanlAfst_def)\n\nlemma sscanlafst_step [simp]: \"sscanlAfst f s0\\(\\a \\ as) = \\(fst (f s0 a)) \\ sscanlAfst f (fst (f s0 a))\\as\"\n apply (simp add: sscanlAfst_def sprojfst_def sscanlAg_def) \n by (smt approxl2 case_prod_conv eta_cfun fair_sscanl fin2stake prod.collapse sconc_prefix sconc_snd_empty slen_scons slen_smap smap_hd_rst sprojfst_def sscanl_empty sscanl_shd sscanl_srt strict_sprojfst)\n\nlemma sscanlafst_one [simp]: \"sscanlAfst f b\\(\\x) = \\(fst (f b x))\"\n apply(simp add: sscanlAfst_def)\n by (metis prod.collapse sconc_snd_empty sprojfst_scons strict_sprojfst)\n\nlemma sscanlafst_shd: \"s\\\\ \\ shd (sscanlAfst f q\\s) = fst (f q (shd s))\"\n by (metis shd1 sscanlafst_step surj_scons)\n\nlemma sscanlafst_srt: \"srt\\(sscanlAfst f a\\s) = sscanlAfst f (fst (f a (shd s)))\\(srt\\s)\"\n by (metis (no_types, lifting) sconc_fst_empty sconc_scons' sscanlafst_bot sscanlafst_step stream.sel_rews(2) stream.sel_rews(5) sup'_def surj_scons up_defined)\n\nlemma sscanlafst_snth: assumes \"Fin (Suc n) < #s\" and \"s2 = fst (shd (sscanlAg f state\\s))\"\n shows \"snth (Suc n) (sscanlAfst f state\\s) = snth n (sscanlAfst f s2\\(srt\\s))\"\n apply(simp add: assms sscanlAfst_def)\n apply(subst sprojfst_snth)\n apply(simp add: assms)\n apply (meson assms(1) leD leI slen_rt_ile_eq)\n apply(subst snth_sscanlAg)\n apply(simp add: assms)\n by (metis (no_types, lifting) assms(1) empty_is_shortest shd1 snth_scons snth_sscanlAg sscanlag_step surj_scons)\n\nlemma sscanlafst_ntimes_loop:\n assumes \"\\r. sscanlAfst f state\\(s \\ r) = out \\ (sscanlAfst f state\\r)\" \n shows \"sscanlAfst f state\\(sntimes n s) = sntimes n out\"\n using assms\n by (induction n, simp_all)\n\nlemma sscanlafst_inftimes_loop:\n assumes \"\\r. sscanlAfst f state\\(s \\ r) = out \\ (sscanlAfst f state\\r)\"\n shows \"sscanlAfst f state\\(sinftimes s) = sinftimes out\"\n using assms\n by (metis rek2sinftimes sinftimes_unfold slen_empty_eq sscanlafst_bot sscanlafst_len strict_icycle) \n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sscanlAsnd}\\\n(* ----------------------------------------------------------------------- *)\n\nlemma sscanlasnd_cont: \"cont (\\s. sprojsnd\\(sscanl (\\(b,_). f b) (s0, undefined)\\s))\"\n by simp\n\nlemma sscanlasnd_len [simp]: \"#(sscanlAsnd f s0\\s) = #s\"\n by(simp add: sscanlAsnd_def slen_sprojsnd)\n\nlemma sscanlasnd_bot [simp]: \"sscanlAsnd f s0\\\\ = \\\"\n by (simp add: sscanlAsnd_def)\n\nlemma sscanlasnd_step [simp]: \"sscanlAsnd f s0\\(\\a \\ as) = \\(snd (f s0 a)) \\ sscanlAsnd f (fst (f s0 a))\\as\"\n apply(simp add: sscanlAsnd_def sprojsnd_def sscanlAg_def)\nproof -\n have \"(case f s0 a of (x, a) \\ f x) = (case (fst (f s0 a), undefined::'a) of (x, a) \\ f x)\"\n by (metis (no_types) old.prod.case prod.collapse)\n then have \"\\(shd as) \\ srt\\as = as \\(sscanl (\\(b, uu). f b) (f s0 a)\\as)= (sscanl (\\(b, uu). f b) (fst (f s0 a), undefined)\\as)\"\n by (metis (no_types) sscanl_scons)\n then show \"\\(snd (f s0 a)) \\ smap snd\\(sscanl (\\(b, uu). f b) (f s0 a)\\as) = \\(snd (f s0 a)) \\ smap snd\\(sscanl (\\(b, uu). f b) (fst (f s0 a), undefined)\\as)\"\n using surj_scons by force\nqed\n\nlemma sscanlasnd_one [simp]: \"sscanlAsnd f b\\(\\x) = \\(snd (f b x))\"\n apply(simp add: sscanlAsnd_def)\n by (metis eq_snd_iff sconc_snd_empty sprojsnd_scons strict_sprojsnd)\n\nlemma sscanlasnd_shd: \"s\\\\ \\ shd (sscanlAsnd f q\\s) = snd (f q (shd s))\"\n by (metis shd1 sscanlasnd_step surj_scons)\n\nlemma sscanlasnd_srt: \"srt\\(sscanlAsnd f a\\s) = sscanlAsnd f (fst (f a (shd s)))\\(srt\\s)\"\n by (metis (no_types, lifting) sconc_fst_empty sconc_scons' sscanlasnd_bot sscanlasnd_step stream.sel_rews(2) stream.sel_rews(5) sup'_def surj_scons up_defined)\n\nlemma sscanlasnd_snth: assumes \"Fin (Suc n)<#s\" and \"s2 = fst(shd(sscanlAg f state\\s))\"\n shows \"snth (Suc n) (sscanlAsnd f state\\s) = snth n (sscanlAsnd f s2\\(srt\\s))\"\n apply(simp add: assms sscanlAsnd_def)\n apply(subst sprojsnd_snth)\n apply(simp add: assms)\n by (metis assms(1) empty_is_shortest eta_cfun rt_Sproj_2_eq smap_snth_lemma snth_rt sprojsnd_def sscanlag_len sscanlag_shd sscanlag_srt)\n\nlemma sscanlasnd_snth2:\n assumes \"Fin (Suc n) < #(\\a \\ s)\"\n shows \"snth (Suc n) (sscanlAsnd f state\\(\\a \\ s)) = snth n (sscanlAsnd f (fst (f state a))\\s)\"\n using assms\n apply (induction s arbitrary: a rule: ind)\n by simp_all\n\nlemma sscanlasnd_ntimes_loop:\n assumes \"\\r. sscanlAsnd f state\\(s \\ r) = out \\ (sscanlAsnd f state\\r)\" \n shows \"sscanlAsnd f state\\(sntimes n s) = sntimes n out\"\n using assms\n by (induction n, simp_all)\n\nlemma sscanlasnd_inftimes_loop:\n assumes \"\\r. sscanlAsnd f state\\(s \\ r) = out \\ (sscanlAsnd f state\\r)\"\n shows \"sscanlAsnd f state\\(sinftimes s) = sinftimes out\"\n using assms\n by (metis rek2sinftimes sinftimes_unfold slen_empty_eq sscanlasnd_bot sscanlasnd_len strict_icycle) \n\nlemma sscanlasnd2sinftimes:\n assumes \"#s=\\\"\n and \"sscanlAsnd f state\\s = out \\ (sscanlAsnd f state\\s)\"\n and \"out \\ \\\"\n shows \"sscanlAsnd f state\\s = sinftimes out\"\n using assms rek2sinftimes by auto\n\nlemma sscanl2smap:\n assumes \"\\e. fst(f s e) = s\"\n and \"g = (\\a. snd(f s a))\"\nshows\"sscanlAsnd f s = smap g\"\n apply(rule cfun_eqI)\n by(induct_tac x rule: ind,simp_all add: assms)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term merge}\\\n(* ----------------------------------------------------------------------- *)\n\n(* unfolding of merge function *)\nlemma merge_unfold: \"merge f\\(\\x \\ xs)\\(\\y\\ ys) = \\(f x y) \\ merge f\\xs\\ys\"\n by(simp add: merge_def)\n\n(* relation between merge and snth *)\nlemma merge_snth[simp]: \"Fin n <#xs \\Fin n < #ys \\ snth n (merge f\\xs\\ys) = f (snth n xs) (snth n ys)\"\n apply(induction n arbitrary:xs ys)\n apply (metis Fin_02bot merge_unfold lnless_def lnzero_def shd1 slen_empty_eq snth_shd surj_scons)\n by (smt Fin_Suc Fin_leq_Suc_leq Suc_eq_plus1_left merge_unfold inject_lnsuc less2eq less2lnleD lnle_conv lnless_def lnsuc_lnle_emb sconc_snd_empty sdropostake shd1 slen_scons snth_rt snth_scons split_streaml1 stream.take_strict surj_scons ub_slen_stake)\n\n(* merge applied to f\\\\\\ys return the empty stream *)\nlemma merge_eps1[simp]: \"merge f\\\\\\ys = \\\"\n by(simp add: merge_def)\n\n(* merge applied to f\\xs\\\\ also returns the empty stream *)\nlemma merge_eps2[simp]: \"merge f\\xs\\\\ = \\\"\n by(simp add: merge_def)\n\n(* relation between srt and merge *)\nlemma [simp]: \"srt\\(merge f\\(\\a \\ as)\\(\\b \\ bs)) = merge f\\as\\bs\"\n by (simp add: merge_unfold)\n\n(* the length of merge f\\as\\bs is the minimum of the lengths of as and bs *)\nlemma merge_len [simp]: \"#(merge f\\as\\bs) = min (#as) (#bs)\"\nby(simp add: merge_def)\n\n(* the merge function is commutative *)\nlemma merge_commutative: assumes \"\\ a b. f a b = f b a\"\n shows \"merge f\\as\\bs = merge f\\bs\\as\"\n apply(rule snths_eq)\n apply (simp add: min.commute)\n by (simp add: assms)\n \n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term siterate}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\@{term siterate} is defined by running @{term sscanl} on an arbitrary\n infinite stream. Only the stream length is relevant for the result\\\nlemma siterate_inv_lemma:\n \"\\x z a. #z = #x \n \\ stake n\\(sscanl (\\a b. f a) a\\x) = \n stake n\\(sscanl (\\a b. f a) a\\z)\"\napply (induct_tac n, auto)\napply (rule_tac x=x in scases, auto)\nby (rule_tac x=z in scases, auto)\n\ntext \\@{term siterate} is well-defined (because it is independent of\n the infinite stream on which @{term sscanl} is applied)\\\nlemma siterate_def2:\n \"#x = \\ \\ siterate f a = \\a \\ sscanl (\\a b. f a) a\\x\"\napply (subst siterate_def)\napply (rule someI2_ex)\napply (rule_tac x=\"sinftimes (\\(SOME a. True))\" in exI, simp)\napply (rule cfun_arg_cong)\napply (rule stream.take_lemma)\nby (rule siterate_inv_lemma [rule_format], simp)\n\ntext \\unfolding of @{term siterate} definition\\\nlemma siterate_scons: \"siterate f a = \\a \\ siterate f (f a)\"\napply (rule stream.take_lemma [OF spec [where x=\"a\"]])\napply (induct_tac n, auto)\napply (insert siterate_def2 [of _ f], atomize)\napply (erule_tac x=\"sinftimes (\\x)\" in allE, auto)\nby (subst sinftimes_unfold, simp)\n\n(* to define the nth element of siterate we define a helper function \\niterate\\ *)\n(* \\iterate\\ cannot be used, because the function is only about CPO's, maybe some\nof those lemmata about niterate could be in Prelude, but not all of them *)\nprimrec niterate :: \"nat \\ ('a::type \\ 'a) \\ ('a \\ 'a)\" where\n \"niterate 0 = (\\ F x. x)\"\n | \"niterate (Suc n) = (\\ F x. F (niterate n F x))\"\n\n(* niterate applied to the successor of n is the same as applying niterate to n F *)\nlemma niterate_Suc2: \"niterate (Suc n) F x = niterate n F (F x)\"\napply(induction n)\nby(simp_all)\n\n(* relation between iterate and niterate *)\nlemma niter2iter: \"iterate g\\h\\x = niterate g (Rep_cfun h) x\"\napply (induction g)\nby(simp_all)\n \n(* iterate and the empty stream *)\nlemma iterate_eps [simp]: assumes \"g \\ = \\\"\n shows \"(iterate i\\(\\ h. (\\s. s \\ h (g s)))\\\\) \\ = \\\" \nusing assms by (induction i, auto)\n \n(* fix and the empty stream *)\nlemma fix_eps [simp]: assumes \"g \\ = \\\"\n shows \"(\\ h. (\\s. s \\ h (g s))) \\ = \\\"\nproof -\n have aI: \"max_in_chain 0 (\\i. (iterate i\\(\\ h. (\\s. s \\ h (g s)))\\\\) \\ )\" by (simp add: max_in_chainI assms)\n hence \"(\\i. (iterate i\\(\\ h. (\\s. s \\ h (g s)))\\\\) \\) = \\\" using assms by auto \n hence \" (\\ i. iterate i\\(\\ h. (\\s. s \\ h (g s)))\\\\) \\ = \\\" by (simp add: lub_fun) \n thus ?thesis using fix_def2 by (metis (no_types, lifting) lub_eq)\nqed\n\n(* beginning the iteration of the function h with the element (h x) is equivalent to beginning the\n iteration with x and dropping the head of the iteration *)\nlemma siterate_sdrop: \"siterate h (h x) = sdrop 1\\(siterate h x)\"\nby (metis One_nat_def sdrop_0 sdrop_scons siterate_scons)\n\n(* iterating the function h infinitely often after having already iterated i times is equivalent to\n beginning the iteration with x and then dropping i elements from the resulting stream *)\nlemma siterate_drop2iter: \"siterate h (niterate i h x) = sdrop i\\(siterate h x)\"\napply (induction i)\napply (simp add: One_nat_def)\nby (simp add: sdrop_back_rt siterate_sdrop One_nat_def)\n\n(* the head of iterating the function g on x doesn't have any applications of g *)\nlemma shd_siter[simp]: \"shd (siterate g x) = x\"\nby (simp add: siterate_def)\n\n(* dropping i elements from the infinite iteration of the function g on x and then extracting the head\n is equivalent to computing the i'th iteration via niterate *)\nlemma shd_siters: \"shd (sdrop i\\(siterate g x)) = niterate i g x\"\nby (metis shd_siter siterate_drop2iter) \n\ntext \\Addition of two numbers using @{term \"siterate Suc\"}\\\nlemma snth_siterate_Suc: \"snth k (siterate Suc j) = k + j\"\napply (rule_tac x=\"j\" in spec)\napply (induct_tac k, simp)\napply (rule allI)\nby (subst siterate_scons, simp)+\n\n(* applying snth to k and siterate Suc 0 returns k *)\nlemma snth_siterate_Suc_0[simp]: \"snth k (siterate Suc 0) = k\"\nby (simp add: snth_siterate_Suc)\n\n(* relation between sdrop and siterate *)\nlemma sdrop_siterate:\n \"sdrop k\\(siterate Suc j) = siterate Suc (j + k)\"\napply (rule_tac x=\"j\" in spec)\napply (induct_tac k, simp+)\napply (rule allI)\nby (subst siterate_scons, simp)\n\ntext \\@{term siterate} only creates infinite outputs\\\nlemma [simp]: \"#(siterate f k) = \\\"\napply (rule infI)\napply (rule allI)\napply (rule_tac x=\"k\" in spec)\napply (induct_tac k, simp+)\nby (subst siterate_scons, simp)+\n\n(* the i'th element of the infinite stream of iterating the function g on x can alternatively be found\n with (niterate i g x) *)\nlemma snth_siter: \"snth i (siterate g x) = niterate i g x\"\nby (simp add: shd_siters snth_def)\n\n(* dropping j elements from the stream x and then extracting the i'th element is equivalent to extracting\n the i+j'th element directly *)\nlemma snth_sdrop: \"snth i (sdrop j\\x) = snth (i+j) x\"\nby (simp add: sdrop_plus snth_def)\n\n(* extracting the i+1'st element from the stream of iterating the function g on x is equivalent to extracting\n the i'th element and then applying g one more time *)\nlemma snth_snth_siter: \"snth (Suc i) (siterate g x) = g (snth i (siterate g x))\"\nby (simp add: snth_siter)\n\n(* dropping the first element from the chain of iterates is equivalent to shifting the chain by applying g *)\nlemma sdrop_siter: \"sdrop 1\\(siterate g x) = smap g\\(siterate g x)\"\napply(rule sinf_snt2eq)\napply (simp add: fair_sdrop) \napply simp\nby (simp add: smap_snth_lemma snth_sdrop snth_snth_siter One_nat_def)\n\n(* if the functions g and h commute then g also commutes with any number of iterations of h *)\nlemma iterate_insert: assumes \"\\z. h (g z) = g (h z)\"\n shows \"niterate i h (g x) = g (niterate i h x)\"\nusing assms by (induction i, auto)\n\n(* lifts iterate_insert from particular iterations to streams of iterations *)\nlemma siterate_smap: assumes \"\\z. g (h z) = h (g z)\"\n shows \"smap g\\(siterate h x) = siterate h (g x)\"\napply (rule sinf_snt2eq, auto)\nby (simp add: assms smap_snth_lemma snth_siter iterate_insert)\n\n(* iterating the function g on x is equivalent to the stream produced by concatenating \\x and the \n iteration of g on x shifted by another application of g *)\nlemma siterate_unfold: \"siterate g x = \\x \\ smap g\\(siterate g x)\"\nby (metis siterate_scons siterate_smap)\n\n(* iterating the identity function produces an infinite constant stream of the element x *)\nlemma siter2sinf: \"siterate id x = sinftimes (\\x)\"\nby (metis id_apply s2sinftimes siterate_scons)\n\n(* dropping i and iterating the identity function returns siterate id x *)\nlemma \"sdrop i\\(siterate id x) = siterate id x\"\n by (smt sdrops_sinf siter2sinf)\n\n(* if g acts as the identity for the element x then iterating g on x produces an infinite constant\n stream of x *)\nlemma siter2sinf2: assumes \"g x = x\"\n shows \"siterate g x = sinftimes (\\x)\"\nby (smt assms s2sinftimes siterate_scons)\n\n(* shows the equivalence of an alternative recursive definition of iteration *)\nlemma rek2niter: assumes \"xs = \\x \\ (smap g\\xs)\"\n shows \"snth i xs = niterate i g x\"\nproof (induction i)\n case 0 thus ?case by (metis assms niterate.simps(1) shd1 snth_shd)\nnext\n case (Suc i) \n have \"#xs = \\\" by (metis Inf'_def assms below_refl fix_least_below inf_less_eq lnle_def slen_scons slen_smap)\n thus ?case by (metis Fin_neq_inf Suc assms inf_ub lnle_def lnless_def niterate.simps(2) smap_snth_lemma snth_scons)\nqed\n\n(* important *)\n(* recursively mapping the function g over the rest of xs is equivalent to the stream of iterations of g on x *)\nlemma rek2siter: assumes \"xs = \\x \\ (smap g\\xs)\"\n shows \"xs = siterate g x\" \napply (rule sinf_snt2eq, auto)\napply (metis Inf'_def assms fix_least inf_less_eq lnle_conv slen_scons slen_smap) \nby (metis assms rek2niter snth_siter)\n\n(* shows that siterate produces the least fixed point of the alternative recursive definition *)\nlemma fixrek2siter: \"fix\\(\\ s . (\\x \\ smap g\\s)) = siterate g x\"\nby (metis (no_types) cfcomp1 cfcomp2 fix_eq rek2siter)\n\n(* dropping elements from a stream of iterations is equivalent to adding iterations to every element *)\nlemma sdrop2smap: \"sdrop i\\(siterate g x) = smap (niterate i g)\\(siterate g x)\"\nby (simp add: iterate_insert siterate_drop2iter siterate_smap)\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\Adm simp rules\\\n(* ----------------------------------------------------------------------- *)\n\ntext\\For functions g and h producing sets the following predicate is admissible\\\nlemma adm_subsetEq [simp]: \"adm (\\s. g\\s \\ h\\s)\"\nby (metis (full_types) SetPcpo.less_set_def adm_below cont_Rep_cfun2)\n\ntext\\For a function g producing sets and a set cs the following predicate is admissible\\\nlemma adm_subsetEq_rc [simp]: \"adm (\\s. g\\s \\ cs)\"\nby (metis (no_types, lifting) adm_def chain_monofun contlub_cfun_arg lub_below set_cpo_simps(1))\n\ntext\\For a function h producing sets and a set cs the following predicate is admissible\\\nlemma adm_subsetEq_lc [simp]: \"adm (\\s. cs \\ h\\s)\"\nby (simp add: adm_subst adm_superset)\n\ntext\\For a set cs and a function g producing sets, the following predicate is admissible\\\nlemma adm_subsetNEq_rc [simp]: \"adm (\\s. \\ g\\s \\ cs)\"\n apply(rule admI)\n apply(rule+)\n by (metis SetPcpo.less_set_def is_ub_thelub monofun_cfun_arg subset_eq)\n\ntext\\For a function g over streams, the admissiblity of the following predicate over streams holds\\\nlemma sValues_adm2[simp]: \"adm (\\a. sValues\\(g\\a) \\ sValues\\a)\"\napply(rule admI)\nby (smt SetPcpo.less_set_def ch2ch_Rep_cfunR contlub_cfun_arg is_ub_thelub lub_below subset_iff)\n\n(* admissibility of finstream *)\nlemma adm_finstream [simp]: \"adm (\\s. #s<\\ \\ P s)\"\napply(rule admI)\napply auto\nusing inf_chainl4 lub_eqI lub_finch2 by fastforce\n\n(* admissibility of fin below *)\nlemma adm_fin_below: \"adm (\\x . \\ Fin n \\ # x)\"\n apply(rule admI)\n apply auto\n by (metis inf_chainl3 finite_chain_def maxinch_is_thelub)\n\n(* admissibility of fin below for special case of \\ *)\nlemma adm_fin_below2: \"adm (\\x . \\ Fin n \\ # x)\"\nby(simp only: lnle_def adm_fin_below)\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\New @{term sfilter} lemmata and @{term sfoot}\\\n(* ----------------------------------------------------------------------- *)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\New @{term sfilter} lemmata\\\n(* ----------------------------------------------------------------------- *)\n\ntext\\Appending the singleton stream \\a increases the length of the stream y by one\\\nlemma slen_lnsuc: \n shows \"#(y \\ \\a) = lnsuc\\(#y)\"\n apply(induction y)\n apply (smt admI fold_inf inf_chainl4 lub_eqI lub_finch2 sconc_fst_inf)\n apply (metis sconc_fst_empty sconc_snd_empty slen_scons)\n by (metis (no_types, lifting) assoc_sconc slen_scons stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n\n(* if filtering the stream s2 with the set A produces infinitely many elements then prepending any\n finite stream s1 to s2 will still produce infinitely many elements *)\nlemma sfilter_conc2[simp]: assumes \"#(sfilter A\\s2) = \\\" and \"#s1 < \\\"\n shows \"#(sfilter A\\(s1\\s2)) = \\\"\nproof -\n have \"(sfilter A\\(s1\\s2)) = ((sfilter A\\s1) \\ (sfilter A\\s2))\"\n using add_sfilter assms(2) lnless_def ninf2Fin by fastforce \n thus ?thesis by (simp add: assms(1) slen_sconc_snd_inf) \nqed\n\n(* if the stream z is a prefix of another non-empty stream (y\\\\a) but isn't equal to it, then z is\n also a prefix of y *)\nlemma below_conc: assumes \"z \\ (y\\\\a)\" and \"z\\(y\\\\a)\"\n shows \"z\\y\"\nproof(cases \"#y = \\\")\n case True thus ?thesis using assms(1) sconc_fst_inf by auto \nnext\n case False \n obtain n_y where \"Fin n_y= #y\" using False ninf2Fin by fastforce\n have \"#z \\ #(y\\\\a)\" using assms(1) mono_slen by blast\n have \"#z \\ #(y\\\\a)\" using assms(1) assms(2) eq_slen_eq_and_less by blast\n hence \"#z < #(y\\\\a)\" using \\#z \\ #(y \\ \\a)\\ lnle_def lnless_def by blast \n obtain n_z where nz_def: \"Fin n_z = #z\" using approxl2 assms(1) assms(2) by blast \n have \"#y < #(y \\ \\a)\"\n by (metis \\Fin n_y = #y\\ eq_slen_eq_and_less inject_sconc lnless_def minimal monofun_cfun_arg sconc_snd_empty stream.con_rews(2) sup'_def up_defined)\n have \"#y < \\\" by (simp add: False lnless_def) \n hence \"Fin n_z \\ #y\" by (metis Fin_Suc \\#z < #(y \\ \\a)\\ less2lnleD lnsuc_lnle_emb nz_def slen_lnsuc) \n have \"\\s. stake n_y\\(y \\ s) = y\" by (simp add: \\Fin n_y = #y\\ approxl1)\n hence \"stake n_z\\y = stake n_z\\(y\\\\a)\" by (metis \\Fin n_y = #y\\ \\Fin n_z \\ #y\\ less2nat min_def stakeostake)\n thus ?thesis by (metis \\Fin n_z = #z\\ approxl1 assms(1) stream.take_below) \nqed\n\n(* for any set A and singleton stream \\a the following predicate over streams is admissible *)\nlemma sfilter_conc_adm: \"adm (\\b. #b<\\ \\ #(A \\ b) < #(A \\ b \\ \\a))\" (is \"adm ?F\")\nby (metis (mono_tags, lifting) admI inf_chainl4 lnless_def lub_eqI lub_finch2)\n\n(* the element a is kept when filtering with A, so (x \\ \\a) produces a larger result than just x,\n provided that x is finite *)\nlemma sfilter_conc: assumes \"a\\A\" \n shows \"#x<\\ \\ #(A \\ x) < #(A \\ (x \\ \\a))\" (is \"_ \\ ?F x\")\n proof(induction x)\n show \"adm (\\b. #b < \\ \\ #(A \\ b) < #(A \\ b \\ \\a))\" using sfilter_conc_adm by blast\n show \"?F \\\" using assms(1) lnless_def by auto\n next\n fix u :: \"'a discr u\"\n fix s :: \"'a stream\"\n assume \"u\\\\\" and \"#s<\\ \\ ?F s\" and \"#(u && s) < \\\"\n obtain ua where \"(updis ua) = u\" by (metis \\u \\ \\\\ discr.exhaust upE)\n hence \"u && s = \\ua \\s\" using lscons_conv by blast\n thus \"?F (u&&s)\"\n by (smt \\#(u && s) < \\\\ \\#s < \\ \\ #(A \\ s) < #(A \\ s \\ \\a)\\ assoc_sconc fold_inf lnat.sel_rews(2) lnless_def monofun_cfun_arg sfilter_in sfilter_nin slen_scons)\nqed\n\n(* for any finite stream s and set A, if filtering s with A doesn't produce the empty stream, then\n filtering and infinite repetition are associative *)\nlemma sfilter_sinf [simp]: assumes \"#s<\\\" and \"(A \\ s) \\ \\\"\n shows \"A \\ (s\\<^sup>\\) = ((A \\ s)\\<^sup>\\)\"\nby (metis add_sfilter assms(1) assms(2) infI lnless_def rek2sinftimes sinftimes_unfold)\n\n(* if filtering the stream s with the set A produces infinitely many elements, then filtering the \n rest of s with A also produces infinitely many elements *)\nlemma sfilter_srt_sinf [simp]: assumes \"#(A \\ s) = \\\" \n shows \"#(A \\ (srt\\s)) = \\\"\nby (smt assms inf_scase inject_scons sfilter_in sfilter_nin stream.sel_rews(2) surj_scons) \n \n(* additional snth--lemma *)\nlemma sfilter_ntimes [simp]: \"#({True} \\ ((sntimes n (\\False))\\ora2)) = #({True} \\ ora2)\"\n apply(induction n)\n by auto\n\n(* snth to sntimes *)\nlemma snth2sntimes: \"(\\i. i snth i s = False) \\ Fin n < #s \\ (sntimes n (\\False)) \\ s\"\nproof(induction n arbitrary: s)\n case 0\n then show ?case by auto\nnext\n case (Suc n)\n have \"shd s = False\"\n using Suc.prems snth_shd by blast\n hence \"s = \\False \\ (srt\\s)\"\n using Suc.prems(2) empty_is_shortest surj_scons by force\n have \"(\\i. i < n \\ snth i (srt\\s) = False)\"\n using Suc.prems snth_rt by auto\n hence \"n\\\\False \\ (srt\\s)\"\n by (meson Suc.IH Suc.prems(2) linorder_not_le slen_rt_ile_eq)\n hence \"\\False \\ (n\\\\False) \\ \\False \\ (srt\\s)\"\n by (simp add: monofun_cfun_arg)\n then show ?case\n using \\s = \\False \\ srt\\s\\ by auto\nqed \n\n(* length of sntimes *)\nlemma sntimes_len [simp]: \"#(n\\\\a) = Fin n\"\n apply(induction n)\n by auto\n\n(* if length of a stream is Fin n, then snth (n+m) (xs\\ys) is equal to snth m ys *)\nlemma snth_scons2: assumes \"#xs = Fin n\"\n shows \"snth (n+m) (xs\\ys) = snth m ys\"\n apply(simp add: snth_def)\n by (simp add: add.commute assms sdrop_plus sdropl6)\n\n(* if ({True} \\ s) is unequal to bottom, then (sntimes n (\\False)) \\ \\True is a prefix of s *) \nlemma sbool_ntimes_f: assumes \"({True} \\ s) \\\\\"\n obtains n where \"(sntimes n (\\False)) \\ \\True \\ s\"\nproof -\n have h1: \"\\i. snth i s = True\"\n by (metis assms ex_snth_in_sfilter_nempty singletonD)\n obtain n where \"Fin n < #s\" and n_def: \"n = Least (\\i. snth i s = True)\"\n by (smt assms ex_snth_in_sfilter_nempty less2nat not_less not_less_Least not_less_iff_gr_or_eq singletonD trans_lnless)\n have \"snth n s = True\"\n using LeastI h1 n_def by force\n have \"\\i. i snth i s \\ True\" using not_less_Least n_def by fastforce\n hence\"\\i. i snth i s = False\" by auto \n hence \"(sntimes n (\\False)) \\ s\"\n using \\Fin n < #s\\ snth2sntimes by blast\n obtain xs where xs_def: \"s = (sntimes n (\\False)) \\ xs\"\n using \\n\\\\False \\ s\\ approxl3 by auto\n hence \"xs\\\\\"\n by (metis assms sfilter_ntimes slen_empty_eq strict_sfilter)\n have \"shd xs = snth n s\"\n by (simp add: sdropl6 snth_def xs_def)\n hence \"shd xs = True\"\n using \\snth n s = True\\ by auto \n thus ?thesis\n by (metis (full_types)\\xs \\ \\\\ lscons_conv minimal monofun_cfun_arg sup'_def surj_scons that xs_def)\n qed\n\n(* ----------------------------------------------------------------------- *)\nsection \\@{term sfoot}\\\n(* ----------------------------------------------------------------------- *)\n\n(* appending the singleton stream \\a to a finite stream s causes sfoot to extract a again *)\nlemma sfoot1[simp]: assumes \"xs = s\\(\\a)\" and \"#xs < \\\"\n shows \"sfoot xs = a\"\nproof -\n have \"xs \\ \\\" using assms(1) strictI by force\n obtain n where n_def: \"Fin n = #xs\" by (metis assms(2) lncases lnless_def) \n hence \"n>0\" using assms(2) gr0I using Fin_02bot \\xs \\ \\\\ lnzero_def slen_empty_eq by fastforce \n hence \"(THE n'. lnsuc\\(Fin n') = #xs) = n-1\" by (metis (mono_tags, lifting) Fin_Suc Suc_diff_1 n_def inject_Fin inject_lnsuc the_equality)\n have \"snth (n-1) xs = a\" by (metis Fin_0 Fin_Suc Suc_diff_1 assms(1) n_def bot_is_0 inject_lnsuc lnat.con_rews lscons_conv neq0_conv sdropl6 shd1 slen_lnsuc snth_def sup'_def)\n thus ?thesis by (metis \\(THE n'. lnsuc\\(Fin n') = #xs) = n - 1\\ sfoot_def)\nqed\n\n(* sfoot extracts the element a from any finite stream ending with \\a *)\nlemma sfoot12 [simp]: assumes \"#s<\\\"\n shows \"sfoot (s\\\\a) = a\"\nby (metis assms fold_inf inject_lnsuc lnless_def monofun_cfun_arg sfoot1 slen_lnsuc)\n\n(* sfoot extracts a from the singleton stream \\a *)\nlemma sfoot_one [simp]: \"sfoot (\\a) = a\"\nby (metis Inf'_neq_0 inf_ub lnle_def lnless_def sconc_fst_empty sfoot12 strict_slen)\n\n(* concatenating finite streams produces another finite stream *)\nlemma sconc_slen [simp]: assumes \"#s<\\\" and \"#xs<\\\"\n shows \"#(s\\xs) < \\\"\nby (metis Fin_neq_inf assms(1) assms(2) infI inf_ub lnle_def lnless_def slen_sconc_all_finite)\n\nlemma sconc_slen2: \"\\(s1::'a stream) s2::'a stream. #(s1 \\ s2) = #s1 + #s2\"\nproof - \n fix s1::\"'a stream\"\n fix s2::\"'a stream\"\n\n have \"#s1 = \\ \\ #(s1 \\ s2) = #s1 + #s2\"\n by (simp add: plus_lnatInf_r)\n moreover\n have \"#s2 = \\ \\ #(s1 \\ s2) = #s1 + #s2\"\n by (simp add: slen_sconc_snd_inf)\n moreover\n have \"#s1 \\ \\ \\ #s2 \\ \\ \\ #(s1 \\ s2) = #s1 + #s2\"\n proof-\n assume \"#s1 \\ \\\"\n then obtain l_s1 where l_s1_def: \"Fin l_s1 = #s1\"\n using infI by metis\n assume \" #s2 \\ \\\"\n then obtain l_s2 where l_s2_def: \"Fin l_s2 = #s2\"\n using infI by metis\n show ?thesis\n using l_s1_def l_s2_def by (metis lnat_plus_fin slen_sconc_all_finite)\n qed\n\n then show \"#(s1 \\ s2) = #s1 + #s2\"\n using calculation by linarith\nqed\n\n(* if the foot of a non-empty stream xs is a, then xs consists of another stream s (possibly empty)\n concatenated with \\a *)\nlemma sfoot2 [simp]: assumes \"sfoot xs = a\" and \"xs\\\\\"\n shows \"\\s. xs = s \\ \\a\"\nproof (cases \"#xs = \\\")\n case True thus ?thesis by (metis sconc_fst_inf) \nnext\n case False \n obtain n where \"#xs = Fin n\" using False lncases by auto\n hence \"(THE n'. lnsuc\\(Fin n') = #xs) = n-1\"\n by (smt Fin_02bot Fin_Suc Suc_diff_1 assms(2) bot_is_0 inject_Fin inject_lnsuc neq0_conv slen_empty_eq the_equality)\n have \"stake (n-1)\\xs \\ \\(snth (n-1) xs) = xs\"\n by (smt Fin_0 Fin_Suc Inf'_def Suc_diff_1 \\#xs = Fin n\\ assms(2) fin2stake fix_least_below lnle_def neq0_conv notinfI3 sconc_snd_empty sdrop_back_rt sdropostake slen_empty_eq snth_def split_streaml1 surj_scons ub_slen_stake)\n thus ?thesis by (metis \\(THE n'. lnsuc\\(Fin n') = #xs) = n - 1\\ assms(1) sfoot_def) \nqed\n\n(* when sfoot is applied to the concatenation of two finite streams s and xs, and xs is not empty,\n then sfoot will produce the foot of xs *)\nlemma sfoot_conc [simp]: assumes \"#s<\\\" and \"#xs<\\\" and \"xs\\\\\"\n shows \"sfoot (s\\xs) = sfoot xs\"\nby (metis (no_types, hide_lams) assms(1) assms(2) assms(3) assoc_sconc sconc_slen sfoot1 sfoot2)\n\n(* if the finite stream s contains more than one element then the foot of s will be the foot of the\n rest of s *)\nlemma sfoot_sdrop: assumes \"Fin 1<#s\" and \"#s<\\\"\n shows \"sfoot (srt\\s) = sfoot s\"\nproof -\n obtain s' where \"s = s' \\ \\(sfoot s)\" by (metis assms(1) below_antisym bot_is_0 lnless_def minimal sfoot2 strict_slen)\n hence \"s' \\ \\\"\n by (metis Fin_02bot Fin_Suc One_nat_def assms(1) lnless_def lnzero_def slen_lnsuc strict_slen)\n hence \"srt\\s = srt\\s' \\ \\(sfoot s)\"\n by (smt \\s = s' \\ \\(sfoot s)\\ assoc_sconc inject_scons sconc_snd_empty strictI surj_scons)\n thus ?thesis\n by (metis \\s = s' \\ \\(sfoot s)\\ \\s' \\ \\\\ assms(2) inf_ub lnle_conv lnless_def sconc_snd_empty sfoot1 slen_sconc_snd_inf strictI surj_scons) \nqed\n\n(* if length of xs is finite, then it holds that sfoot (\\a \\ \\b \\ xs) = sfoot (\\b \\ xs) *)\nlemma [simp]: assumes \"#xs < \\\"\n shows \"sfoot (\\a \\ \\b \\ xs) = sfoot (\\b \\ xs)\"\nusing assms lnless_def by auto \n\n(* the foot of any stream s is the nth element of s for some natural number n *)\nlemma sfoot_exists [simp]:\"\\n. snth n s = sfoot s\"\nby (metis sfoot_def)\n\n(* if the stream s contains n+1 elements then the foot of s will be found at index n *)\nlemma sfoot_exists2: \n shows \"Fin (Suc n) = #s \\ snth n s = sfoot s\"\n apply(induction n arbitrary: s)\n apply (metis (mono_tags, lifting) Fin_02bot Fin_Suc Zero_lnless_infty inject_lnsuc lnzero_def sconc_fst_empty sconc_snd_empty sfoot12 slen_empty_eq slen_scons snth_shd surj_scons)\n by (smt Fin_Suc Fin_neq_inf fold_inf inf_ub inject_lnsuc lnat.con_rews lnle_conv lnless_def lnzero_def sconc_snd_empty sfoot_conc slen_scons snth_rt strict_slen surj_scons)\n\ntext \\Streams can be split for filtering\\\nlemma add_sfilter2: assumes \"#x < \\\" \n shows \"sfilter A\\(x \\ y) = sfilter A\\x \\ sfilter A\\y\"\nby (metis (no_types) add_sfilter assms lncases lnless_def)\n\n(* if lenght of s is Fin (Suc n), then it holds that (stake n\\s) \\ \\(sfoot s) = s *)\nlemma sfood_id: assumes\"#s = Fin (Suc n)\"\n shows \"(stake n\\s) \\ \\(sfoot s) = s\"\n using assms apply(induction n arbitrary: s)\n apply simp\n apply (metis Fin_02bot Fin_Suc lnat.sel_rews(2) lnsuc_neq_0_rev lnzero_def lscons_conv sfoot_exists2 slen_scons snth_shd strict_slen sup'_def surj_scons)\n apply (subst stake_suc)\n apply simp\n by (smt Fin_02bot Fin_Suc One_nat_def Rep_cfun_strict1 Zero_not_Suc leI lnat.sel_rews(2) lnle_Fin_0 lnzero_def notinfI3 sconc_snd_empty sfoot_sdrop slen_rt_ile_eq slen_scons stake_Suc stream.take_0 strict_slen surj_scons)\n\nlemma footind: \"#s = Fin k \\ P \\ \\ (\\t a. #t < \\ \\ P t \\ P (t \\ \\a)) \\ P s\"\nproof -\n assume \"#s = Fin k\" and \"P \\\" and \"\\t a. #t < \\ \\ P t \\ P (t \\ \\a)\"\n then show \"P s\"\n proof (induction k arbitrary: s rule: less_induct)\n case (less k)\n then have IH: \"\\t. #t < Fin k \\ P \\ \\ (\\u b. #u < \\ \\ P u \\ P (u \\ \\b)) \\ P t\"\n by (meson lnat_well_h1)\n then show ?case\n proof (cases \"k = 0\")\n case True\n then show ?thesis\n using less.prems(1) less.prems(2) by force\n next\n case False\n then obtain u b where \"s = u \\ \\b\"\n using less.prems(1) sfoot2 by force\n then have \"#u < Fin k\"\n by (metis fold_inf leI less.prems(1) ln_less lnsuc_lnle_emb notinfI3 slen_lnsuc)\n then show ?thesis\n by (metis IH \\s = u \\ \\b\\ inf_ub less.prems(2) less.prems(3) less_le not_less)\n qed\n qed\nqed\n\nlemma footind2: \"#s < \\ \\ P \\ \\ (\\t a. #t < \\ \\ P t \\ P (t \\ \\a)) \\ P s\"\n by (metis footind infI less_le)\n\nlemma srcdups_sfoot:\n \"s \\ \\ \\ #s < \\ \\ sfoot (srcdups\\s) = sfoot s\"\nproof (rule footind2, simp+)\n fix t :: \"'a stream\" and a :: 'a\n assume \"#t < \\\" and \"sfoot (srcdups\\t) = sfoot t\"\n show \"sfoot (srcdups\\(t \\ \\a)) = a\"\n proof (rule footind2 [of t], auto, simp add: \\#t < \\\\)\n fix t :: \"'a stream\" and b :: 'a\n assume \"#t < \\\" and \"sfoot (srcdups\\(t \\ \\a)) = a\"\n then show \"sfoot (srcdups\\(t \\ \\b \\ \\a)) = a\"\n proof -\n have \"\\l. l < \\ \\ l = \\\"\n by (meson inf_less_eq le_less_linear)\n then show ?thesis\n by (metis (no_types) Fin_Suc \\#t < \\\\ \\sfoot (srcdups\\(t \\ \\a)) = a\\ lnat_well_h2 notinfI3 sfoot12 slen_lnsuc srcdups_end_eq srcdups_end_neq srcdups_slen)\n qed\n qed\nqed\n\nlemma sfoot_end:\n fixes s and a\n assumes \"#s < \\\" and \"s \\ \\\"\n shows \"\\t n. s = t \\ (sntimes n (\\(sfoot s))) \\ (t = \\ \\ sfoot s \\ sfoot t)\"\n apply (rule footind2)\n apply (simp add: assms(1))\n apply (metis sconc_fst_empty sntimes.simps(1))\nproof -\n fix t :: \"'a stream\" and a :: 'a\n assume \"#t < \\\" and \"\\ta n. t = ta \\ (sntimes n (\\(sfoot t))) \\ (ta = \\ \\ sfoot t \\ sfoot ta)\"\n then obtain u n where \"t = u \\ (sntimes n (\\(sfoot t)))\" and \"u = \\ \\ sfoot t \\ sfoot u\"\n by blast\n then have expr: \"t \\ \\a = u \\ (sntimes n (\\(sfoot t))) \\ \\a\"\n by (metis assoc_sconc)\n then show \"\\ta n. ((t \\ \\a) =(ta \\ (n\\(\\(sfoot (t \\ \\a)))))) \\ ((ta = \\) \\ (sfoot (t \\ \\a) \\ sfoot ta))\"\n proof (cases \"a = sfoot t\")\n case True\n then have \"t \\ \\a = u \\ (sntimes (Suc n) (\\(sfoot t)))\"\n by (metis expr sntimes_Suc2)\n then show ?thesis\n by (metis True \\#t < \\\\ \\u = \\ \\ sfoot t \\ sfoot u\\ sfoot12)\n next\n case False\n then have \"t \\ \\a = (u \\ (sntimes n (\\(sfoot t)))) \\ (sntimes (Suc 0) (\\(sfoot (t \\ \\a))))\"\n using \\#t < \\\\ \\t = u \\ (n\\\\(sfoot t))\\ by auto\n then show ?thesis\n by (metis False \\#t < \\\\ \\t = u \\ (n\\\\(sfoot t))\\ sfoot12)\n qed\nqed\n\nlemma srcdups_split_fin: \"#s = Fin k \\ Suc n < k \\ snth n s \\ snth (Suc n) s \\ srcdups\\s = srcdups\\(stake (Suc n)\\s) \\ (srcdups\\(sdrop (Suc n)\\s))\"\nproof (induction k arbitrary: n s)\n case 0\n then show ?case\n by auto\nnext\n case (Suc k)\n then obtain a t where \"s = \\a \\ t\"\n by (metis Fin_0 Suc_neq_Zero strict_slen surj_scons)\n assume \"snth n s \\ snth (Suc n) s\"\n then have \"Suc n < Suc k\"\n using Suc.prems(2) by blast\n then show ?case\n proof (cases \"k > 1\")\n case True\n then obtain a b t where \"s = \\a \\ \\b \\ t\"\n proof -\n assume a1: \"\\a b t. s = \\a \\ \\b \\ t \\ thesis\"\n have \"#(\\::'a stream) = \\\"\n using bot_is_0 by auto\n then show ?thesis\n using a1 by (metis Fin_Suc Suc.prems(1) True inject_lnsuc less2nat_lemma lnat.con_rews lnle_def minimal not_le srt_decrements_length surj_scons)\n qed\n then have \"t \\ \\\"\n using Suc.prems(1) True by force\n then show ?thesis\n proof (cases \"n = 0\")\n case True\n then have \"a \\ b\"\n using Suc.prems(3) \\s = \\a \\ \\b \\ t\\ by auto\n then show ?thesis\n using True \\s = \\a \\ \\b \\ t\\ by auto\n next\n case False\n then obtain m where \"n = Suc m\"\n using not0_implies_Suc by blast\n have \"#(\\b \\ t) = Fin k\"\n using Suc.prems(1) \\s = \\a \\ \\b \\ t\\ by auto\n moreover have \"snth n s = snth m (\\b \\ t)\"\n by (simp add: \\n = Suc m\\ \\s = \\a \\ \\b \\ t\\)\n ultimately have \"srcdups\\(\\b \\ t) = srcdups\\(stake n\\(\\b \\ t)) \\ (srcdups\\(sdrop n\\(\\b \\ t)))\"\n by (metis Suc.IH Suc.prems(2) Suc.prems(3) Suc_less_SucD \\n = Suc m\\ \\s = \\a \\ \\b \\ t\\ snth_scons)\n then show ?thesis\n proof (cases \"srcdups\\s = srcdups\\(\\b \\ t)\")\n case True\n then show ?thesis\n proof -\n have \"a = b\"\n by (metis (no_types) True \\s = \\a \\ \\b \\ t\\ srcdups_shd)\n then show ?thesis\n by (simp add: \\n = Suc m\\ \\s = \\a \\ \\b \\ t\\ \\srcdups\\(\\b \\ t) = srcdups\\ (stake n\\ (\\b \\ t)) \\ srcdups\\ (sdrop n\\(\\b \\ t))\\)\n qed\n next\n case False\n then show ?thesis\n proof -\n have \"a \\ b\"\n using False \\s = \\a \\ \\b \\ t\\ srcdups_eq2 by blast\n then show ?thesis\n by (simp add: \\n = Suc m\\ \\s = \\a \\ \\b \\ t\\ \\srcdups\\(\\b \\ t) = srcdups\\ (stake n\\ (\\b \\ t)) \\ srcdups\\ (sdrop n\\(\\b \\ t))\\)\n qed\n qed\n qed\n next\n case False\n then have \"k \\ 1\"\n by auto\n then show ?thesis\n proof (cases \"k = 0\")\n case True\n then show ?thesis\n using Suc.prems(2) by blast\n next\n case False\n then have \"k = 1\"\n using \\k \\ 1\\ by auto\n then obtain a b where \"s = \\a \\ \\b\"\n by (metis One_nat_def Rep_cfun_strict1 Suc.prems(1) \\\\thesis. (\\a t. s = \\a \\ t \\ thesis) \\ thesis\\ sconc_snd_empty sfood_id stake_Suc stream.take_0)\n then have \"a \\ b\"\n using Suc.prems(2) Suc.prems(3) \\k = 1\\ by auto\n then have \"srcdups\\s = \\a \\ \\b\"\n by (metis \\s = \\a \\ \\b\\ lscons_conv srcdups_neq srcdups_step strict_sdropwhile strict_srcdups sup'_def)\n then show ?thesis\n using Suc.prems(2) \\k = 1\\ \\s = \\a \\ \\b\\ by auto\n qed\n qed\nqed\n\nlemma srcdups_split_inf: \"#s = \\ \\ snth n s \\ snth (Suc n) s \\ srcdups\\s = srcdups\\(stake (Suc n)\\s) \\ (srcdups\\(sdrop (Suc n)\\s))\"\nproof (induction n arbitrary: s)\n case 0\n then obtain a b t where \"s = \\a \\ \\b \\ t\" and \"a \\ b\"\n by (metis inf_scase shd1 snth_scons snth_shd)\n then show ?case\n by auto\nnext\n case (Suc n)\n obtain a t where \"s = \\a \\ t\"\n using Suc.prems(1) inf_scase by blast\n then have \"#t = \\\"\n using Suc.prems(1) by auto\n moreover have \"snth n t \\ snth (Suc n) t\"\n using Suc.prems(2) \\s = \\a \\ t\\ by auto\n ultimately have \"srcdups\\t = srcdups\\(stake (Suc n)\\t) \\ (srcdups\\(sdrop (Suc n)\\t))\"\n using Suc.IH by blast\n then show ?case\n proof (cases \"a = shd t\")\n case True\n then have \"srcdups\\s = srcdups\\t\"\n by (metis Inf'_neq_0 \\#t = \\\\ \\s = \\a \\ t\\ slen_empty_eq srcdups_eq surj_scons)\n then show ?thesis\n using True \\#t = \\\\ \\s = \\a \\ t\\ \\srcdups\\t = srcdups\\ (stake (Suc n)\\t) \\ srcdups\\(sdrop (Suc n)\\t)\\ inf_scase by fastforce\n next\n case False\n then have \"srcdups\\s = \\a \\ srcdups\\t\"\n by (metis Inf'_neq_0 \\#t = \\\\ \\s = \\a \\ t\\ slen_empty_eq srcdups_neq surj_scons)\n then show ?thesis\n using False \\#t = \\\\ \\s = \\a \\ t\\ \\srcdups\\t = srcdups\\ (stake (Suc n)\\t) \\ srcdups\\(sdrop (Suc n)\\t)\\ inf_scase by fastforce\n qed\nqed\n\nlemma srcdups_split2: \"Fin (Suc n) < #s \\ snth n s \\ snth (Suc n) s \\ srcdups\\s = srcdups\\(stake (Suc n)\\s) \\ (srcdups\\(sdrop (Suc n)\\s))\"\n by (metis less2nat ninf2Fin not_le srcdups_split_fin srcdups_split_inf)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sValues}\\\n(* ----------------------------------------------------------------------- *)\n\n(* sValues equality rule *)\nlemma sValues_eq: \"{z. \\n. Fin n < #s \\ z = snth n s} = {snth n s |n. Fin n < #s}\"\nby auto\n\n(* another sValues equality rule *)\nlemma sValues_eq2: \"{snth n s |n. Fin n < #s} = {z. \\n. Fin n < #s \\ z = snth n s}\"\nby auto\n\ntext \\A stream and its prefix agree on their first elements\\\nlemma snth_less: \"\\Fin n < #x; x \\ y\\ \\ snth n x = snth n y\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"x\" in spec)\napply (rule_tac x=\"y\" in spec)\napply (induct_tac n, auto)\nby (drule lessD, auto)+\n\nlemma slen_snth_prefix: \"#s > Fin n \\ snth n s = snth n (s \\ t)\"\n by (simp add: monofun_cfun_arg snth_less)\n\nlemma srcdups_sconc: \n \"#xs < \\ \\ xs \\ \\ \\ \n srcdups\\(xs \\ ys) = (srcdups\\xs) \\ (srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys))\"\nproof -\n assume \"#xs < \\\" and \"xs \\ \\\"\n then obtain t n where \"xs = t \\ (sntimes n (\\(sfoot xs)))\" and \"t = \\ \\ sfoot t \\ sfoot xs\"\n using sfoot_end by fastforce\n then show ?thesis\n proof (cases \"t = \\\")\n case True\n then have \"xs \\ ys = (sntimes n (\\(sfoot xs))) \\ ys\"\n using \\xs = t \\ (n\\\\(sfoot xs))\\ by auto\n then have \"srcdups\\(xs \\ ys) = (\\(sfoot xs)) \\ srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys)\"\n by (metis Fin_02bot True \\xs = t \\( n\\\\(sfoot xs))\\ \\xs \\ \\\\ lnzero_def neq0_conv sconc_fst_empty slen_empty_eq sntimes_len srcdups_sntimes_prefix)\n then show ?thesis\n by (metis Fin_02bot True \\xs = t \\ (n\\\\(sfoot xs))\\ \\xs \\ \\\\ lnzero_def neq0_conv sconc_fst_empty slen_empty_eq sntimes_len srcdups_sntimes)\n next\n case False\n then obtain k where \"#t = Fin (Suc k)\"\n by (metis Fin_02bot \\t = \\ \\ sfoot t \\ sfoot xs\\ \\xs = t \\ (n\\\\(sfoot xs))\\ bot_is_0 ninf2Fin not0_implies_Suc sconc_fst_inf slen_empty_eq)\n then show ?thesis\n proof (cases \"ys = \\\")\n case True\n then show ?thesis\n by simp\n next\n case False\n have \"snth k (xs \\ ys) \\ snth (Suc k) (xs \\ ys)\"\n proof\n assume \"snth k (xs \\ ys) = snth (Suc k) (xs \\ ys)\"\n then have \"snth k xs = snth (Suc k) xs\"\n by (metis Fin_02bot Fin_Suc Suc_neq_Zero \\#t = Fin (Suc k)\\ \\#xs < \\\\ \\t = \\ \\ sfoot t \\ sfoot xs\\ \\xs = t \\ (n\\\\(sfoot xs))\\ stake_prefix slen_snth_prefix inject_Fin le2lnle leI less_le lnless_def lnzero_def monofun_cfun_arg notinfI3 sfoot_exists2 stream.take_below strict_slen)\n then show \"False\"\n by (metis Fin_02bot Fin_Suc Suc_neq_Zero \\#t = Fin (Suc k)\\ \\t = \\ \\ sfoot t \\ sfoot xs\\ \\xs = t \\ (n\\\\(sfoot xs))\\ slen_snth_prefix inject_Fin leI ln_less lnzero_def neq0_conv notinfI3 sconc_snd_empty sdropl6 sfoot_exists2 shd_sntime slen_empty_eq snth_def sntimes_len)\n qed\n moreover have \"Fin (Suc k) < #(xs \\ ys)\"\n by (metis False \\#t = Fin (Suc k)\\ \\#xs < \\\\ \\xs = t \\ (n\\\\(sfoot xs))\\ minimal mono_slen monofun_cfun_arg sconc_snd_empty slen_conc)\n ultimately have \"srcdups\\(xs \\ ys) = srcdups\\(stake (Suc k)\\(xs \\ ys)) \\ srcdups\\(sdrop (Suc k)\\(xs \\ ys))\"\n using srcdups_split2 by blast\n then have \"srcdups\\(xs \\ ys) = srcdups\\t \\ srcdups\\((sntimes n (\\(sfoot xs))) \\ ys)\"\n by (metis \\#t = Fin (Suc k)\\ \\xs = t \\ (n\\\\(sfoot xs))\\ assoc_sconc stake_prefix2 sdropl6)\n then have \"srcdups\\(xs \\ ys) = srcdups\\t \\ \\(sfoot xs) \\ srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys)\"\n by (metis \\t = \\ \\ sfoot t \\ sfoot xs\\ \\xs = t \\ (n\\\\(sfoot xs))\\ \\xs \\ \\\\ neq0_conv sconc_snd_empty sntimes.simps(1) srcdups_sntimes_prefix)\n moreover have \"srcdups\\xs = srcdups\\t \\ \\(sfoot xs)\"\n proof -\n have \"srcdups\\xs = srcdups\\t \\ srcdups\\(sntimes n (\\(sfoot xs)))\"\n by (metis \\#t = Fin (Suc k)\\ \\snth k (xs \\ ys) \\ snth (Suc k) (xs \\ ys)\\ \\xs = t \\ (n\\\\(sfoot xs))\\ convert_inductive_asm slen_snth_prefix stake_prefix2 not_less notinfI3 sconc_snd_empty sdropl6 slen_conc srcdups_split2 strict_srcdups ub_slen_stake)\n then show ?thesis\n by (metis \\t = \\ \\ sfoot t \\ sfoot xs\\ \\xs = t \\ (n\\\\(sfoot xs))\\ \\xs \\ \\\\ neq0_conv sconc_snd_empty sntimes.simps(1) srcdups_sntimes)\n qed\n ultimately show ?thesis\n by simp\n qed\n qed\nqed\n\ntext \\monotonicity of @{term sValues}\\\nlemma sValues_mono: \"monofun (\\s. {snth n s |n. Fin n < #s})\"\napply (simp add: sValues_eq2)\napply (rule monofunI)\napply (rule_tac x=\"#x\" in lncases)\napply (drule eq_less_and_fst_inf, simp+)\napply (simp add: atomize_imp)\napply (rule_tac x=\"y\" in spec)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, simp+)\napply (auto simp add: less_set_def)\napply (drule lessD, auto)\napply (erule_tac x=\"q\" in allE)\napply (erule_tac x=\"w\" in allE, auto)\napply (case_tac \"na\", auto)\napply (rule_tac x=\"0\" in exI, auto)\napply (frule_tac f=\"slen\" in monofun_cfun_arg, simp)\napply (rule_tac x=\"Suc nat\" in exI, auto)\napply (rule_tac x=\"#w\" in lncases, auto)\nby (rule snth_less, auto)\n\ntext \\In infinite chains, the length of the streams is unbounded\\\nlemma inf_chainl3rf:\n \"\\chain Y; \\finite_chain Y\\ \\ \\k. Fin n \\ #(Y k)\"\nby (rule inf_chainl3 [rule_format], auto)\n\ntext \\@{term sValues} is a continuous function\\\nlemma sValues_cont: \"cont (\\s. {snth n s | n. Fin n < #s})\"\napply (rule contI2)\napply (rule sValues_mono)\napply (simp add: sValues_eq2)\napply (rule allI, rule impI)\napply (simp add: less_set_def)\napply (auto simp add: lub_eq_Union) \napply (case_tac \"finite_chain Y\")\napply (subst lub_finch2 [THEN lub_eqI], simp)\napply (rule_tac x=\"LEAST i. max_in_chain i Y\" in exI)\napply (rule_tac x=\"n\" in exI, simp)\napply (subst lub_finch2 [THEN lub_eqI, THEN sym], simp+)\napply (frule_tac n=\"Suc n\" in inf_chainl3rf, simp+)\napply (erule exE)\napply (rule_tac x=\"k\" in exI)\napply (rule_tac x=\"n\" in exI)\napply (rule conjI)\napply (rule_tac x=\"#(Y k)\" in lncases, simp+)\napply (rule sym)\napply (rule snth_less)\napply (rule_tac x=\"#(Y k)\" in lncases, simp+)\nby (rule is_ub_thelub)\n\ntext \\@{term sValues} is a continuous function\\\nlemma sValues_def2: \"sValues\\s = {snth n s | n. Fin n < #s}\"\napply (subst sValues_def)\napply (subst beta_cfun)\nby (rule sValues_cont, simp)\n\n(* continuity of sValues *)\nlemma sValues_cont2: \"\\Y. chain Y \\ sValues\\(\\ i. Y i) = (\\ i. sValues\\(Y i))\"\nby (simp add: contlub_cfun_arg)\n\nlemma srcdups_bool_prefix:\n fixes xs :: \"bool stream\" and ys :: \"bool stream\"\n assumes \"lshd\\(srcdups\\xs) = lshd\\(srcdups\\ys)\" and \"#(srcdups\\xs) \\ #(srcdups\\ys)\"\n shows \"(srcdups\\xs) \\ (srcdups\\ys)\"\nproof (rule scases [of xs])\n assume \"xs = \\\"\n then have \"srcdups\\xs = \\\"\n by simp\n thus \"srcdups\\xs \\ srcdups\\ys\"\n by simp\nnext\n fix a :: bool and s :: \"bool stream\"\n assume \"xs = \\a \\ s\"\n have \"lshd\\(srcdups\\ys) = updis a\"\n by (metis \\xs = \\a \\ s\\ assms(1) lshd_updis srcdups_step)\n then have \"lshd\\ys = updis a\"\n by (metis lshd_updis srcdups_shd2 stream.sel_rews(3) strict_srcdups surj_scons up_defined)\n then have \"\\n. Fin n < #(srcdups\\ys) \\ snth n (srcdups\\ys) = (even n = a)\"\n by (metis (no_types, lifting) bool_stream_snth lshd_updis stream.sel_rews(3) sup'_def surj_scons)\n then have ys_expr: \"\\n. Fin n < #(srcdups\\xs) \\ snth n (srcdups\\ys) = (even n = a)\"\n using assms(2) less_le_trans by blast\n then have first_n_eq: \"\\n. Fin n < #(srcdups\\xs) \\ snth n (srcdups\\xs) = snth n (srcdups\\ys)\"\n using \\xs = \\a \\ s\\ bool_stream_snth by blast\n then show \"srcdups\\xs \\ srcdups\\ys\"\n proof (cases \"#(srcdups\\xs) < \\\")\n case False\n then have \"#(srcdups\\xs) = #(srcdups\\ys)\"\n using assms(2) less_le by fastforce\n then have \"\\k. snth k (srcdups\\xs) = snth k (srcdups\\ys)\"\n by (metis False Fin_neq_inf first_n_eq inf_ub order.not_eq_order_implies_strict)\n then have \"srcdups\\xs = srcdups\\ys\"\n by (simp add: \\\\k. snth k (srcdups\\xs) = snth k (srcdups\\ys)\\ \\#(srcdups\\xs) = #(srcdups\\ys)\\ snths_eq)\n thus \"srcdups\\xs \\ srcdups\\ys\"\n by simp\n next\n case True\n then obtain k where \"#(srcdups\\xs) = Fin k\"\n using lnat_well_h2 by blast\n then have eq_len: \"#(srcdups\\xs) = #(stake k\\(srcdups\\ys))\"\n using assms(2) slen_stake by force\n have \"\\n. Fin n < #(srcdups\\xs) \\ snth n (srcdups\\xs) = snth n (stake k\\(srcdups\\ys))\"\n by (metis eq_len first_n_eq snth_less stream.take_below)\n then have \"srcdups\\xs = stake k\\(srcdups\\ys)\"\n by (simp add: \\\\n. Fin n < #(srcdups\\xs) \\ snth n (srcdups\\xs) = snth n (stake k\\(srcdups\\ys))\\ eq_len snths_eq)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma srcdups_snth_stake_inf: \"#s = \\ \\ snth n s \\ snth (Suc n) s \\ srcdups\\(stake (Suc n)\\s) \\ srcdups\\s\"\nproof\n assume \"#s = \\\" and \"snth n s \\ snth (Suc n) s\" and \"srcdups\\(stake (Suc n)\\s) = srcdups\\s\"\n have \"#(stake (Suc (Suc n))\\s) = Fin (Suc (Suc n))\"\n by (simp add: \\#s = \\\\ slen_stake_fst_inf)\n moreover have \"Suc (Suc n) > Suc n\"\n by simp\n moreover have \"snth n (stake (Suc (Suc n))\\s) \\ snth (Suc n) (stake (Suc (Suc n))\\s)\"\n by (metis Fin_leq_Suc_leq Suc_n_not_le_n \\snth n s \\ snth (Suc n) s\\ calculation(1) less2nat_lemma not_le snth_less stream.take_below)\n ultimately have \"srcdups\\(stake (Suc n)\\(stake (Suc (Suc n))\\s)) \\ srcdups\\(stake (Suc (Suc n))\\s)\"\n using srcdups_snth_stake_fin by blast\n then have \"srcdups\\(stake (Suc n)\\s) \\ srcdups\\(stake (Suc (Suc n))\\s)\"\n by (simp add: min_def)\n moreover have \"srcdups\\(stake (Suc (Suc n))\\s) = srcdups\\s\"\n proof (rule ccontr)\n assume \"srcdups\\(stake (Suc (Suc n))\\s) \\ srcdups\\s\"\n moreover have \"srcdups\\(stake (Suc n)\\s) \\ srcdups\\(stake (Suc (Suc n))\\s)\"\n by (simp add: less_imp_le_nat monofun_cfun_arg stake_mono)\n ultimately have \"srcdups\\(stake (Suc n)\\s) \\ srcdups\\s\"\n by (metis below_antisym monofun_cfun_arg stream.take_below)\n then show \"False\"\n by (simp add: \\srcdups\\(stake (Suc n)\\s) = srcdups\\s\\)\n qed\n ultimately show \"False\"\n by (simp add: \\srcdups\\(stake (Suc n)\\s) = srcdups\\s\\)\nqed\n\n\ntext \\Basic properties of @{term sValues}\\\n\n(* sValues applied to the empty stream returns the empty set *)\nlemma [simp]: \"sValues\\\\ = {}\"\nby (auto simp add: sValues_def2 lnless_def)\n\n(* the head of any stream is always an element of the domain *)\nlemma sValues2un[simp]: \"sValues\\(\\z \\ s) = {z} \\ sValues\\s\"\napply (auto simp add: sValues_def2)\napply (case_tac \"n\", auto)\napply (rule_tac x=\"0\" in exI, auto)\nby (rule_tac x=\"Suc n\" in exI, auto)\n\nlemma srcdups_dom_h: assumes \"sValues\\(srcdups\\s) = sValues\\s\"\n shows \"sValues\\(srcdups\\(\\a \\ s)) = insert a (sValues\\s)\"\nproof (cases \"shd s = a\")\n case True\n have \"srcdups\\(\\a \\ \\a \\ srt\\s) = srcdups\\(\\a \\ srt\\s)\"\n using srcdups_eq by blast\n hence \"a \\ sValues\\(srcdups\\(\\a \\ srt\\s))\"\n by (simp add: srcdups_step) \n then show ?thesis\n by (metis True Un_insert_left assms insert_absorb2 sValues2un srcdups_eq srcdups_step strict_sdropwhile sup_bot.left_neutral surj_scons)\nnext\n case False\n then show ?thesis\n by (metis (no_types, lifting) assms insert_is_Un sValues2un srcdups_neq srcdups_step strict_sdropwhile surj_scons)\nqed\n \nlemma srcdups_dom [simp]: \"sValues\\(srcdups\\xs) = sValues\\xs\"\napply(rule ind, simp_all)\n by (simp add: srcdups_dom_h) \n\n(* only the empty stream has no elements in its domain *)\nlemma strict_sValues_rev: \"sValues\\s = {} \\ s = \\\"\napply (auto simp add: sValues_def2)\napply (rule_tac x=\"s\" in scases, auto)\nby (metis Fin_02bot gr_0 lnzero_def)\n\nlemma sValues_notempty:\"s\\\\ \\ sValues\\s\\{}\"\n using strict_sValues_rev by auto\n\n(* the infinite repetition of a only has a in its domain *)\n(*with new lemmata not necessary:\n apply (subst sinftimes_unfold, simp)*)\n(*apply (induct_tac n, auto)\napply (subst sinftimes_unfold, simp)\napply (rule_tac x=\"0\" in exI)\nby (subst sinftimes_unfold, simp)*)\nlemma [simp]: \"sValues\\(sinftimes (\\a)) = {a}\"\nby (auto simp add: sValues_def2)\n\n(* any singleton stream of z only has z in its domain *)\nlemma [simp]: \"sValues\\(\\z) = {z}\"\nby (auto simp add: sValues_def2)\n\n(* if an element z is in the domain of a stream s, then z is the n'th element of s for some n *)\nlemma sValues2snth: \"z \\ sValues\\s \\ \\n. snth n s = z\"\nby (auto simp add: sValues_def2)\n\n(* if the natural number n is less than the length of the stream s, then snth n s is in the domain of s *)\nlemma snth2sValues: \"Fin n < #s \\ snth n s \\ sValues\\s\"\n by (auto simp add: sValues_def2)\n\nlemma smap_well:\"sValues\\x\\range f \\ \\s. smap f\\s = x\"\n apply(rule_tac x = \"smap (inv f)\\x\" in exI)\n by (simp add: snths_eq smap_snth_lemma f_inv_into_f snth2sValues subset_eq)\n\nlemma smap_inv_id[simp]: \"sValues\\s \\ range F \\ smap (F \\ (inv F))\\s = s\"\n apply (induction s rule: ind )\n by(simp_all add: f_inv_into_f)\n\nlemma smap_inv_eq[simp]:\"inj F \\ smap (inv F \\ F)\\x = x\"\n by (metis inv_o_cancel smap_inv_id subset_UNIV surj_id surj_iff)\n\n(* checking if the domain of a stream x isn't a subset of another set M is an admissible predicate *)\nlemma [simp]: \"adm (\\x. \\ sValues\\x \\ M)\"\napply (rule admI)\napply (rule notI)\napply (frule_tac x=\"0\" in is_ub_thelub)\napply (frule_tac f=\"sValues\" in monofun_cfun_arg)\nby (erule_tac x=\"0\" in allE, auto simp add: less_set_def)\n\ntext \\filtering with a superset of the stream's domain does not change the stream\\\nlemma sfilter_sValuesl3:\n \"sValues\\s \\ X \\ sfilter X\\s = s\"\napply (rule impI)\napply (rule stream.take_lemma)\napply (simp add: atomize_imp)\napply (rule_tac x=\"s\" in spec)\napply (rule_tac x=\"X\" in spec)\napply (induct_tac n, simp+)\napply (rule allI)+\napply (rule impI)\nby (rule_tac x=\"xa\" in scases, simp+)\n\ntext \\filtering with the stream's domain does not change the stream\\\nlemma sfilter_sValuesl4 [simp]:\n \"sfilter (sValues\\s)\\s = s\"\nby (rule sfilter_sValuesl3 [rule_format, of \"s\" \"sValues\\s\"], simp)\n\nlemma sfilter_fin: assumes \"#(A \\ s) < \\\" \n shows \"\\n. (A \\ (sdrop n\\s)) = \\\"\n apply(rule ccontr)\n apply auto\n by (metis assms fun_approxl2 lnat_well_h2 sconc_neq_h sconc_snd_empty split_sfilter)\n\nlemma s_one_dom_inf: assumes \"sValues\\s = {x}\" and \"#s = \\\"\n shows \"s = ((\\x)\\<^sup>\\)\"\n by (metis Fin_02bot Fin_Suc Suc_n_not_le_n assms(1) assms(2) bot_is_0 inject_Fin less_or_eq_imp_le sinftimes_unfold singleton_iff slen_scons slen_sinftimes snth2sValues snth_sinftimes snths_eq strict_icycle strict_slen)\n\nlemma sfilter_bot_dom: \"(A \\ s) = \\ \\ sValues\\s \\ UNIV - A\"\n apply(induction s rule: ind)\n apply auto\n by (metis DiffD2 inject_scons rev_subsetD sfilter_in sfilter_nin strictI)\n\ntext \\The domain of a concatenated stream is the union of the single domains\\\nlemma sValues_sconc2un:\n \"#x = Fin k \\ sValues\\(x \\ y) = sValues\\x \\ sValues\\y\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, simp+)\napply (rule allI, rule impI)\nby (rule_tac x=\"x\" in scases, simp+)\n\n(* sValues applied to s1\\s2 is a subset of the union of sValues s1 and sValues s2 *)\nlemma sconc_sValues: \"sValues\\(s1\\s2) \\ sValues\\s1 \\ sValues\\s2\"\nby (metis SetPcpo.less_set_def below_refl lncases sconc_fst_inf sValues_sconc2un sup.coboundedI1)\n\n(* relation between sValues and sfoot *)\nlemma sfoot_dom: assumes \"#s = Fin (Suc n)\" and \"sValues\\s\\A\"\n shows \"sfoot s\\A\"\nby (metis Suc_n_not_le_n assms(1) assms(2) contra_subsetD leI less2nat_lemma sfoot_exists2 snth2sValues)\n\n(* stakewhile doesn't include the element a that failed the predicate f in the result *)\nlemma stakewhile_dom[simp]:assumes \"\\f a\"\n shows \"a\\sValues\\(stakewhile f\\s)\"\nby (smt assms below_antisym lnle_conv lnless_def mem_Collect_eq sValues_def2 snth_less stakewhile_below stakewhile_slen)\n\nlemma srcdups_sconc_duplicates:\n assumes \"#xs < \\\" and \"xs \\ \\\" and \"srcdups\\xs = srcdups\\(xs \\ ys)\"\n shows \"sValues\\ys \\ {sfoot xs}\"\nproof -\n have \"srcdups\\(xs \\ ys) = (srcdups\\xs) \\ (srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys))\"\n using assms(1) assms(2) srcdups_sconc by blast\n then have \"srcdups\\xs = srcdups\\xs \\ (srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys))\"\n using assms(3) by presburger\n moreover have \"#(srcdups\\xs) < \\\"\n by (meson assms(1) leD leI srcdups_slen trans_lnle)\n ultimately have \"srcdups\\(sdropwhile (\\x. x=sfoot xs)\\ys) = \\\"\n using sconc_neq_h by fastforce\n then have \"sdropwhile (\\x. x=sfoot xs)\\ys = \\\"\n using srcdups_nbot by blast\n then show ?thesis\n by (metis (full_types) insertI1 sconc_snd_empty stakewhileDropwhile stakewhile_dom subsetI)\nqed\n\n(* if stakewhile changes the stream s, which is a prefix of the stream s', then stakewhile of s and s'\n produce the same result *)\nlemma stakewhile_finite_below: \nshows \"stakewhile f\\s \\ s \\ s\\s' \\ stakewhile f\\s = stakewhile f\\s'\"\napply(induction s)\napply simp+\nby (smt approxl1 approxl2 lnless_def monofun_cfun_arg rev_below_trans snth_less stakewhile_below stakewhile_notin stakewhile_snth)\n\n(* if there is an element in the stream s that fails the predicate f, then stakewhile will change s *)\nlemma stakewhile_noteq[simp]: assumes \"\\f (snth n s)\" and \"Fin n < #s\"\n shows \"stakewhile f\\s \\ s\"\nproof (rule ccontr)\n assume \"\\ stakewhile f\\s \\ s\"\n hence \"sValues\\(stakewhile f\\s) = sValues\\s\" by simp\n hence \"(snth n s)\\sValues\\(stakewhile f\\s)\" by (simp add: assms(2) snth2sValues)\n thus False by (simp add: assms(1)) \nqed\n\n(* if there's an element a in the domain of s which fails the predicate f, then stwbl will produce a\n finite result *)\nlemma stwbl_fin [simp]: assumes \"a\\sValues\\s\" and \"\\ f a\"\n shows \"#(stwbl f\\s) < \\\"\nby (metis assms(1) assms(2) inf_ub lnle_conv lnless_def notinfI3 sconc_slen sValues2snth stakewhile_slen stwbl_stakewhile ub_slen_stake)\n\n(* stwbl keeps at least all the elements that stakewhile keeps *)\nlemma stakewhile_stwbl [simp]: \"stakewhile f\\(stwbl f\\s) = stakewhile f\\s\"\nproof -\n have \"\\s sa. (s::'a stream) \\ s \\ sa\"\n by simp\n then have \"stakewhile f\\(stwbl f\\s) = stwbl f\\s \\ stakewhile f\\(stwbl f\\s) = stakewhile f\\s\"\n by (metis (no_types) below_antisym monofun_cfun_arg stwbl_below stwbl_stakewhile)\n then show ?thesis\n using stakewhile_finite_below stwbl_below by blast\nqed\n\n(* sValues applied to sntimes n s is a subset of sValues applied to s *)\nlemma sntimes_sValues1[simp]: \"sValues\\(sntimes n s) \\ sValues\\s\"\nproof (induction n)\n case 0 thus ?case by simp\nnext\n case (Suc n) thus ?case using sconc_sValues sntimes.simps(2) sup.orderE by auto\nqed\n\n(* if filtering everything except z from the stream x doesn't produce the empty stream, then z must\n be an element of the domain of x *)\nlemma sfilter2dom:\n \"sfilter {z}\\x \\ \\ \\ z \\ sValues\\x\"\napply (subgoal_tac \"\\k. snth k x = z \\ Fin k < #x\", erule exE)\napply (erule conjE)\napply (drule sym, simp)\napply (rule snth2sValues, simp)\napply (rule ccontr, simp)\nby (insert ex_snth_in_sfilter_nempty [of x \"{z}\"], auto)\n\ntext \\For injective functions @{term f} with @{term \"f(y) = x\"}, @{term x} can only\n be contained in @{term \"smap f\\s\"} if the original stream contained @{term y}\\\nlemma sValues_smapl1: \"\\x \\ sValues\\(smap f\\s); inj f; f y = x\\ \\ y \\ sValues\\s\" \n by (smt mem_Collect_eq sValues_def2 slen_smap smap_snth_lemma the_inv_f_f)\n (*\napply (auto simp add: sValues_def2)\napply (rule_tac x=\"n\" in exI, simp)\napply (simp add: smap_snth_lemma)\nby (simp add: inj_on_def) *)\n\n(* appending another stream xs can't shrink the domain of a stream x *)\nlemma sValues_sconc[simp]: \"sValues\\x \\ sValues\\(x \\ xs)\"\nby (metis minimal monofun_cfun_arg sconc_snd_empty set_cpo_simps(1))\n\n(* repeating a stream doesn't add elements to the domain *)\nlemma sinftimes_sValues[simp]: \"sValues\\(sinftimes s) \\ sValues\\s\"\nby (smt chain_monofun contlub_cfun_arg lub_below set_cpo_simps(1) sntimesLub sntimes_chain sntimes_sValues1)\n\n(* repeating a stream doesn't remove elements from the domain either *)\nlemma sinf_sValues [simp]: \"sValues\\(s\\<^sup>\\) = sValues\\s\"\nby (metis antisym_conv sValues_sconc sinftimes_sValues sinftimes_unfold)\n\n(* sfilter doesn't add elements to the domain *)\nlemma sbfilter_sbdom[simp]: \"sValues\\(sfilter A\\s) \\ sValues\\s\"\napply(rule ind [of _s], auto)\nby (metis (mono_tags, lifting) UnE contra_subsetD sValues2un sfilter_in sfilter_nin singletonD)\n\n(* smap can only produce elements in the range of the mapped function f *)\nlemma smap_sValues_range [simp]: \"sValues\\(smap f\\s) \\ range f\"\nby (smt mem_Collect_eq range_eqI sValues_def2 slen_smap smap_snth_lemma subsetI)\n\n(* every element produced by (smap f) is in the image of the function f *)\nlemma smap_sValues: \"sValues\\(smap f\\s) = f ` sValues\\s\"\napply(rule)\napply (smt image_eqI mem_Collect_eq sValues_def2 slen_smap smap_snth_lemma subsetI)\nby (smt image_subset_iff mem_Collect_eq sValues_def2 slen_smap smap_snth_lemma)\n\n(* lemmas for SB *)\n(* if the stream a is a prefix of the stream b then a's domain is a subset of b's *)\nlemma sValues_prefix [simp]: \"a \\ b \\ sValues\\a \\ sValues\\b\"\nby (metis SetPcpo.less_set_def monofun_cfun_arg)\n\n(* the lub of a chain of streams contains any elements contained in any stream in the chain *)\nlemma sValues_chain2lub: \"chain S \\ sValues\\(S i) \\ sValues\\(\\ j. S j)\"\nusing sValues_prefix is_ub_thelub by auto\n\n(* if every element in a chain S is a prefix of s then also the least upper bound in the chain S if prefix of s *)\nlemma lubChainpre: \"chain S \\ S i \\ \\i. S i \\ s \\ (\\ j. S j) \\ s\"\nby (simp add: lub_below)\n\n(* if every element in a chain S is a prefix of s, then the domain of S i is a subset of the domain of s *)\nlemma sValues_chainprefix: \"chain S \\ \\i. S i \\ s \\ \\i. sValues\\(S i) \\ sValues\\s\"\nby simp\n\n(* if every element in a chain S is a prefix of s, then the domain of the lub is a subset of the domain of s *)\nlemma sValues_chainlub: \"chain S \\ \\i. S i \\ s \\ sValues\\(\\ j. S j) \\ sValues\\s\"\nusing sValues_prefix lub_below by blast\n\n(* streams appearing later in the chain S contain the elements of preceding streams *)\nlemma sValues_chain_below: \"chain S \\ i \\ j \\ sValues\\(S i) \\ sValues\\(S j)\"\nby (simp add: po_class.chain_mono)\n\n(* for two elements i, j with i \\ j in a chain S it holds that the domain of S i is a subset of the domain of S j *)\nlemma sValues_lub2union: \"chain S \\ finite_chain S \\ sValues\\(\\ j. S j) \\ (\\i. sValues\\(S i))\"\nusing l42 by fastforce\n\n(* important *)\n(* the lub doesn't have any elements that don't appear somewhere in the chain *)\nlemma sValues_lub: \"chain S \\ sValues\\(\\ j. S j) = (\\i. sValues\\(S i))\"\napply (simp add: contlub_cfun_arg)\nby (simp add: lub_eq_Union)\n\nlemma sscanlasnd_smap_state_loop:\n assumes\"\\e. e \\ sValues\\s \\ fst (f state e) = state\"\nshows \"sscanlAsnd f state\\(s) = smap (\\e. snd (f state e))\\s\"\n using assms\n apply (induction s rule: ind)\n apply (rule adm_imp)\n apply (rule admI)\n apply (meson sValues_chain2lub set_rev_mp)\n by simp_all\n\n(* core lemma for exchanging transition function (general lemma) *) \nlemma sscanla_exchange_f:\n assumes \"\\e state. P e \\ F1 state e = F2 state e\" \n and \"\\x \\ sValues\\s. P x\"\n shows \"sscanlAsnd F1 state\\s = sscanlAsnd F2 state\\s\"\n using assms\n apply (induction s arbitrary: state rule: ind)\n apply (rule adm_imp, simp)+\n apply (rule admI)\n apply (meson sValues_chain2lub subsetCE)\n by simp_all\n\ntext \\Let i in N be an index of the chain S of streams and B a set of messages.\\\nlemma l44: assumes \"chain S\" and \"\\i. sValues\\(S i) \\ B\"\n shows \"sValues\\(\\ j. S j) \\ B\"\nby (metis (mono_tags, lifting) UN_E assms sValues_lub subsetCE subsetI)\n\n(* helper lemma *)\nlemma l6: \"chain S \\ \\i. sValues\\(S i) \\ B \\ sValues\\(\\ j. S (j + (SOME k. A))) \\ B\"\nby (simp add: l44 lub_range_shift)\n\n(* dropping elements can't increase the domain *)\nlemma sdrop_sValues[simp]: \"sValues\\(sdrop n\\s)\\sValues\\s\"\nby (metis Un_upper2 approxl2 sValues_prefix sValues_sconc2un sdrop_0 sdropostake split_streaml1 stream.take_below)\n\n(* if none of the elements in the domain of the stream s are in the set A, then filtering s with A\n produces the empty stream *)\nlemma sfilter_sValues_eps: \"sValues\\s \\ A = {} \\ (A \\ s) = \\\"\nby (meson disjoint_iff_not_equal ex_snth_in_sfilter_nempty snth2sValues)\n\n(* if x in sValues\\(A\\s) then x is in A *)\nlemma sValues_sfilter1: assumes \"x\\sValues\\(A\\s)\" \nshows \"x\\A\"\nby (smt assms mem_Collect_eq sValues_def2 sfilterl7)\n\n(* if u is not bottom then sValues\\s\\sValues\\(u && s) *)\nlemma sValues_subset: assumes \"u\\\\\"\nshows \"sValues\\s\\sValues\\(u && s)\"\nby (metis Un_upper2 assms sValues2un stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n(* if u is not bottom then sValues\\(A\\s)\\sValues\\(A \\ (u && s)) *)\nlemma sValues_sfilter_subset: assumes \"u\\\\\"\nshows \"sValues\\(A\\s)\\sValues\\(A \\ (u && s))\"\nby (smt Un_upper2 assms eq_iff sValues2un sfilter_in sfilter_nin stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n(* if x in A then x\\sValues\\s implies x\\(sValues\\(A \\ s)) *)\nlemma sValues_sfilter2: assumes \"x\\A\"\nshows \"x\\sValues\\s \\ x\\(sValues\\(A \\ s))\"\napply(induction s)\napply(rule admI)\napply rule\n apply (metis (mono_tags, lifting) UN_iff ch2ch_Rep_cfunR contlub_cfun_arg sValues_lub)\napply simp\nby (smt UnE assms empty_iff insert_iff sconc_sValues sValues2un sValues_sconc sValues_sfilter_subset sfilter_in stream.con_rews(2) stream.sel_rews(5) subsetCE surj_scons)\n\n(* sValues applied to A\\s returns the intersection of sValues applied to s and A *)\nlemma sValues_sfilter[simp]: \"sValues\\(A\\s) = sValues\\s \\ A\"\napply rule\napply (meson IntI sbfilter_sbdom sValues_sfilter1 subset_iff)\napply rule\n by (simp add: sValues_sfilter2)\n\n(* if sfilter of A\\s is s then sValues\\s is a subset of A *)\nlemma sfilterEq2sValues_h: \"sfilter A\\s = s \\ sValues\\s \\ A\"\n apply(rule ind [of _s])\n apply (smt admI inf.orderI sValues_sfilter)\n apply(simp)\n apply(rule)\n by (metis inf.orderI sValues_sfilter)\n\n(* sfilter of A\\s is s implies that sValues\\s is a subset of A *)\nlemma sfilterEq2sValues: \"sfilter A\\s = s \\ sValues\\s \\ A\"\n by (simp add: sfilterEq2sValues_h)\n\n(* if \\a\\sValues\\s. f a then stwbl applied to f\\s returns s *)\nlemma stwbl_id_help:\n shows \"(\\a\\sValues\\s. f a) \\ stwbl f\\s = s\"\n apply (rule ind [of _s])\n apply(rule adm_imp)\n apply(rule admI, rule+)\n using sValues_chain2lub apply blast\n apply(rule admI)\n apply (metis cont2contlubE cont_Rep_cfun2 lub_eq)\n using strict_stwbl apply blast\n apply rule+\n by simp\n\n(* \\ a. a\\sValues\\s \\ f a implies that stwbl applied to f\\s is s *)\nlemma stwbl_id [simp]: \"(\\ a. a\\sValues\\s \\ f a) \\ stwbl f\\s = s\"\nby (simp add: stwbl_id_help)\n\n(* if a in sValues s and \\f a then it holds that \\x. (stwbl f\\s) = stakewhile f\\s \\ \\x *)\nlemma stwbl2stakewhile: assumes \"a\\sValues\\s\" and \"\\f a\"\n shows \"\\x. (stwbl f\\s) = stakewhile f\\s \\ \\x\" \nproof -\n have \"#(stwbl f\\s) < \\\" using assms(1) assms(2) snth2sValues stwbl_fin by blast\n hence \"stwbl f\\s \\ \\\" by (metis assms(1) assms(2) stakewhile_dom strict_stakewhile stwbl_notEps) \n thus ?thesis\n by (smt Fin_02bot approxl2 assms(1) assms(2) bottomI lnle_def lnzero_def mem_Collect_eq sconc_snd_empty sValues_def2 sdrop_0 slen_empty_eq slen_rt_ile_eq split_streaml1 stakewhile_below stakewhile_noteq stakewhile_sdropwhilel1 stwbl_notEps stwbl_stakewhile surj_scons tdw ub_slen_stake) \nqed\n\n(* if a in sValues s and \\f a it holds that \\ f (sfoot (stwbl f\\s)) *)\nlemma stwbl_sfoot: assumes \"a\\sValues\\s\" and \"\\f a\"\n shows \"\\ f (sfoot (stwbl f\\s))\" \nproof(rule ccontr)\n assume \"\\ \\ f (sfoot (stwbl f\\s))\"\n hence \"f (sfoot (stwbl f\\s))\" by blast\n obtain x where x_def:\"(stwbl f\\s) = stakewhile f\\s \\ \\x\"\n using assms(1) assms(2) stwbl2stakewhile by blast\n hence \"sfoot (stwbl f\\s) = x\"\n using assms(1) assms(2) sfoot1 stwbl_fin by blast\n have \"stakewhile f\\s \\ \\x \\ s\" by (metis stwbl_below x_def)\n have \"f x\"\n using \\f (sfoot (stwbl f\\s))\\ \\sfoot (stwbl f\\s) = x\\ by blast\n thus False\n by (metis approxl2 assms(1) assms(2) inject_sconc sconc_snd_empty sdropwhile_resup stakewhileDropwhile stakewhile_below stakewhile_dom stakewhile_stwbl x_def)\n(* by (smt Fin_02bot \\sfoot (stwbl f\\s) = x\\ approxl2 assms(1) assms(2) assoc_sconc bottomI lnle_def lnzero_def sconc_fst_empty sconc_snd_empty sdrop_0 sdropwhile_t sfoot1 slen_empty_eq slen_rt_ile_eq split_streaml1 stakewhile_below stakewhile_dom stakewhile_sdropwhilel1 stakewhile_stwbl stream.take_strict strict_stakewhile stwbl_fin stwbl_notEps stwbl_stakewhile surj_scons tdw ub_slen_stake) *)\nqed\n\n(* stwbl applied to f and stwbl f\\s returns stwbl f\\s *)\nlemma stwbl2stbl[simp]: \"stwbl f\\(stwbl f\\s) = stwbl f\\s\"\n apply(rule ind [of _s])\n apply simp_all\n by (metis sconc_snd_empty stwbl_f stwbl_t)\n\n(* (\\x. b \\ sValues\\x) is admissible *)\nlemma adm_nsValues [simp]: \"adm (\\x. b \\ sValues\\x)\"\nproof (rule admI)\n fix Y\n assume as1: \"chain Y\" and as2: \"\\i. b\\sValues\\(Y i)\"\n thus \"b\\sValues\\(\\i. Y i)\"\n proof (cases \"finite_chain Y\")\n case True thus ?thesis using as1 as2 l42 by fastforce \n next\n case False\n hence \"#(\\i. Y i) = \\\" using as1 inf_chainl4 by blast\n hence \"\\n. snth n (\\i. Y i) \\ b\"\n proof -\n fix n\n obtain j where \"Fin n < # (Y j)\" by (metis False inf_chainl2 as1 inf_chainl3rf less_le) \n hence \"snth n (Y j) \\b\" using as2 snth2sValues by blast\n thus \"snth n (\\i. Y i) \\ b\" using \\Fin n < #(Y j)\\ as1 is_ub_thelub snth_less by blast\n qed\n thus ?thesis using sValues2snth by blast \n qed\nqed\n\n(* strdw_filter helper lemma *)\nlemma strdw_filter_h: \"b\\sValues\\s \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\s)) = #({b} \\ s)\"\nproof(rule ind [of _s])\n have \"adm (\\a. lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\a)) = #({b} \\ a))\" by simp\n thus \"adm (\\a. b \\ sValues\\a \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\a)) = #({b} \\ a))\" by simp\n show \"b \\ sValues\\\\ \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\\\)) = #({b} \\ \\)\" by simp\n fix a \n fix s\n assume IH: \" b \\ sValues\\s \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\s)) = #({b} \\ s)\"\n show \" b \\ sValues\\(\\a \\ s) \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\(\\a \\ s))) = #({b} \\ \\a \\ s)\"\n proof (cases \"a=b\")\n case True thus ?thesis by simp \n next\n case False\n hence f1:\"#({b} \\ \\a \\ s) = #({b} \\ s)\" using sfilter_nin singletonD by auto\n hence f2:\"#({b} \\ srtdw (\\a. a \\ b)\\(\\a \\ s)) = #({b} \\ srtdw (\\a. a \\ b)\\(s))\" using False by auto\n hence \"b \\ sValues\\(\\a \\ s) \\ b\\sValues\\s\" using False by auto\n thus ?thesis using IH f2 local.f1 by auto \n qed\nqed\n\n(* strdw filter lemma *)\nlemma strdw_filter: \"b\\sValues\\s \\ lnsuc\\(#({b} \\ srtdw (\\a. a \\ b)\\s)) = #({b} \\ s)\"\nby(simp add: strdw_filter_h)\n\n(* length of stwbl filter *)\nlemma stwbl_filterlen[simp]: \"b\\sValues\\ts \\ #({b} \\ stwbl (\\a. a \\ b)\\ts) = Fin 1\"\n apply(rule ind [of _ ts])\n apply(rule adm_imp)\n apply simp\n apply simp\n apply simp\n apply auto\n by (metis (mono_tags, lifting) Fin_02bot Fin_Suc One_nat_def lnzero_def sconc_snd_empty sfilter_in sfilter_nin singletonD singletonI slen_scons strict_sfilter strict_slen stwbl_f stwbl_t)\n\n(* srtdw concatenation *)\nlemma srtdw_conc: \"b\\sValues\\ts \\ (srtdw (\\a. a \\ b)\\(ts \\ as)) = srtdw (\\a. a \\ b)\\(ts) \\ as\"\n apply(induction ts arbitrary: as)\n apply (rule adm_imp)\n apply auto\n apply(rule admI)\n apply rule+\n apply (metis (no_types, lifting) approxl3 assoc_sconc is_ub_thelub)\nproof -\n fix u ts as\n assume as1: \"u \\ \\\" and as2: \"(\\as. b \\ sValues\\ts \\ srtdw (\\a. a \\ b)\\(ts \\ as) = srtdw (\\a. a \\ b)\\ts \\ as)\"\n and as3: \"b \\ sValues\\(u && ts)\"\n obtain a where a_def: \"updis a = u\" by (metis Exh_Up as1 discr.exhaust) \n have \"a\\b \\ b\\sValues\\ts\" by (metis UnE a_def as3 lscons_conv sValues2un singletonD) \n hence \"a\\b \\ srtdw (\\a. a \\ b)\\(\\a\\ (ts \\ as)) = srtdw (\\a. a \\ b)\\(\\a\\ ts) \\ as \" using as2 a_def by auto\n thus \"srtdw (\\a. a \\ b)\\((u && ts) \\ as) = srtdw (\\a. a \\ b)\\(u && ts) \\ as \"\n by (smt a_def inject_scons lscons_conv sconc_scons stwbl_f stwbl_srtdw) \nqed\n\n(* stwbl concatenation *)\nlemma stwbl_conc[simp]: \"b\\sValues\\ts \\\n (stwbl (\\a. a \\ b)\\(stwbl (\\a. a \\ b)\\ts \\ xs)) =\n (stwbl (\\a. a \\ b)\\(ts))\"\n apply(induction ts)\n apply(rule adm_imp)\n apply simp\n apply(rule admI)\n apply (metis (no_types, lifting) ch2ch_Rep_cfunR contlub_cfun_arg inf_chainl4 lub_eqI lub_finch2 sconc_fst_inf stwbl2stbl)\n apply simp\n by (smt UnE assoc_sconc sValues2un singletonD stream.con_rews(2) stream.sel_rews(5) stwbl_f stwbl_t surj_scons)\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\@{term siterateBlock}\\\n(* ----------------------------------------------------------------------- *)\n\n(* block-iterating the function f on the stream x is equivalent to the stream produced by concatenating x\n and the iteration of f on x shifted by another application of f *)\nlemma siterateBlock_unfold: \"siterateBlock f x = x \\ siterateBlock f (f x)\"\nby(subst siterateBlock_def [THEN fix_eq2], auto)\n\n(* if g doesn't change the length of the input, then iterating g doesn't either *)\nlemma niterate_len[simp]: assumes \"\\z. #z = #(g z)\" \n shows \"#((niterate i g) x) = #x\"\nusing assms by(induction i, auto)\n\n(* dropping i blocks from siterateBlock g x is equivalent to beginning siterateBlock after i iterations\n of g have already been applied *)\nlemma siterateBlock_sdrop2: assumes \"#x = Fin y\" and \"\\z. #z = #(g z)\" \n shows \"sdrop (y*i)\\(siterateBlock g x) = siterateBlock g ((niterate i g) x)\"\napply (induction i, auto)\nby (metis assms(1) assms(2) niterate_len sdrop_plus sdropl6 siterateBlock_unfold)\n\n(* the y*i'th element of siterateBlock is the same as the head of the i'th iteration *)\nlemma siterateBlock_snth: assumes \"#x = Fin y\" and \"\\z. #z = #(g z)\" and \"#x > Fin 0\" \n shows \"snth (y*i) (siterateBlock g x) = shd ((niterate i g) x)\"\nproof -\n have eq1: \"sdrop (y*i)\\(siterateBlock g x) = siterateBlock g ((niterate i g) x)\" using assms(1) assms(2) siterateBlock_sdrop2 by blast \n\n have \"#((niterate i g) x) > 0\" by (metis Fin_02bot assms(2) assms(3) lnzero_def niterate_len) \n hence \"shd (siterateBlock g ((niterate i g) x)) = shd (((niterate i g) x))\" by (metis Fin_0 minimal monofun_cfun_arg sconc_snd_empty siterateBlock_unfold snth_less snth_shd)\n thus ?thesis by (simp add: eq1 snth_def) \nqed\n\n(* dropping a single block from siterateBlock is equivalent to beginning the iteration with (g x) *)\nlemma siterateBlock_sdrop: assumes \"#x = Fin y\"\n shows \"sdrop y\\(siterateBlock g x) = siterateBlock g (g x)\"\nby (metis assms sdropl6 siterateBlock_unfold)\n\n(* block-iterating the function g on the empty stream produces the empty stream again *)\nlemma siterateBlock_eps[simp]: assumes \"g \\ = \\\"\n shows \"siterateBlock g \\ = \\\" \nby(simp add: siterateBlock_def assms)\n\n(* block-iterating the identity on the element x is equivalent to infinitely repeating x *)\nlemma siterateBlock2sinf: \"siterateBlock id x = sinftimes x\"\nby (metis id_apply rek2sinftimes siterateBlock_eps siterateBlock_unfold strict_icycle)\n\n(* siterateBlock doesn't affect infinite streams *)\nlemma siterBlock_inf [simp]: assumes \"#s = \\\"\n shows \"siterateBlock f s = s\"\nby (metis assms sconc_fst_inf siterateBlock_unfold)\n\n(* the first element of siterateBlock doesn't have any applications of g *)\nlemma siterateBlock_shd [simp]: \"shd (siterateBlock g (\\x)) = x\"\nby (metis shd1 siterateBlock_unfold)\n\n(* helper lemma for siterateBlock2siter *)\nlemma siterateBlock2niter: \"snth i (siterateBlock (\\s. (smap g\\s)) (\\x)) = niterate i g x\" (is \"snth i (?B) = ?N i\")\nproof -\n have f1: \"#(\\x) = Fin 1\" by simp\n have \"\\z. #z = #((\\s. (smap g\\s)) z)\" by simp \n hence f2: \" snth (i) (siterateBlock (\\s. (smap g\\s)) (\\x)) = shd (niterate i (\\s. (smap g\\s)) (\\x))\"\n by (metis Fin_0 Fin_Suc One_nat_def f1 lnat.con_rews lnless_def lnzero_def minimal nat_mult_1 siterateBlock_snth) \n \n have \"shd (niterate i (\\s. (smap g\\s)) (\\x)) = niterate i g x\"\n proof (induction i)\n case 0 thus ?case by simp\n next\n case (Suc i) thus ?case\n by (smt Fin_0 f1 inject_scons neq0_conv niterate.simps(2) niterate_len slen_smap smap_scons strict_slen surj_scons zero_less_one) \n qed\n thus ?thesis by (simp add: f2) \nqed\n\n(* siterateBlock creates an infinitely long stream *)\nlemma siterateBlock_len [simp]: \"#(siterateBlock (\\s. (smap g\\s)) (\\x)) = \\\"\napply (rule infI)\napply (rule allI)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, simp+)\napply (metis bot_is_0 lnat.con_rews siterateBlock_unfold slen_scons strict_slen)\nby (metis Fin_Suc lnat.sel_rews(2) sconc_snd_empty siterateBlock_unfold slen_scons smap_scons strict_smap)\n\n(* iterating the identity function commutes with any function f *)\nlemma siterateBlock_smap: \"siterateBlock id (smap f\\x) = smap f\\(siterateBlock id x)\"\nby (simp add: siterateBlock2sinf)\n\n(* converting x to a singleton stream and applying siterateBlock using smap g is equivalent to\n iterating using g directly on x *)\nlemma siterateBlock2siter [simp]: \"siterateBlock (\\s. (smap g\\s)) (\\x) = siterate g x\" \napply (rule sinf_snt2eq, auto)\nby (simp add: siterateBlock2niter snth_siter) \n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term sislivespf}\\\n(* ----------------------------------------------------------------------- *)\n\ntext \\Some different formulations and implications of the @{term sislivespf} definition\\\n(* if length of f\\x is infinite then also length of x is infinite, and then sislivespf f holds *)\nlemma sislivespfI:\n \"(\\x. #(f\\x) = \\ \\ #x = \\) \\ sislivespf f\"\nby (simp add: sislivespf_def)\n\n(* if length of x is finite then also length of f\\x is finite, and then it holds that sislivespf f *)\nlemma sislivespfI2:\n \"(\\k. \\x. #x = Fin k \\ #(f\\x) \\ \\) \\ sislivespf f\"\napply (rule sislivespfI)\nby (rule_tac x=\"#x\" in lncases, simp+)\n\n(* if sislivespf f holds and length of x is finite, then also length of f\\x is finite *)\nlemma sislivespfD1:\n \"\\sislivespf f; #x = Fin k\\ \\ #(f\\x) \\ \\\"\napply (rule notI)\nby (simp add: sislivespf_def)\n\n(* if sislivespf f holds and f\\x has infinite length, then x has infinite length *)\nlemma sislivespfD2:\n \"\\sislivespf f; #(f\\x) = \\\\ \\ #x = \\\"\nby (simp add: sislivespf_def)\n\n\n(* ----------------------------------------------------------------------- *)\nsection \\Lemmas on lists and streams\\\n(* ----------------------------------------------------------------------- *)\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\@{term list2s}\\\n(* ----------------------------------------------------------------------- *)\n\n(* consing onto a list is equivalent to prepending an element to a stream *)\nlemma [simp]: \"list2s (a#as) = \\a \\ list2s as\"\nby (simp add: lscons_conv)\n\ndeclare list2s_Suc [simp del]\n\n(* infinite lists don't exist *)\nlemma [simp]: \"#(list2s x) \\ \\\"\nby (induct x, simp+)\n\ntext \\Every finite stream can be converted to a list\\\nlemma s2list_ex: \n \"#s = Fin k \\ \\l. list2s l = s\"\napply (simp add: atomize_imp)\napply (rule_tac x=\"s\" in spec)\napply (induct_tac k, simp+)\napply (rule_tac x=\"[]\" in exI, simp+)\napply (rule allI, rule impI)\napply (rule_tac x=\"x\" in scases, simp+)\napply (erule_tac x=\"s\" in allE)\napply (drule mp)\napply (simp add: Fin_Suc [THEN sym] del: Fin_Suc)\napply (erule exE)\nby (rule_tac x=\"a # l\" in exI, simp)\n\n(* the empty stream corresponds to the empty list *)\nlemma [simp]: \"s2list \\ = []\"\napply (simp add: s2list_def)\napply (rule someI2_ex)\napply (rule_tac x=\"[]\" in exI, simp)\napply (simp add: atomize_imp)\nby (induct_tac x, simp+)\n\n(* the singleton stream corresponds to the singleton list *)\nlemma [simp]: \"s2list (\\a) = [a]\"\napply (simp add: s2list_def)\napply (rule someI2_ex)\napply (rule_tac x=\"[a]\" in exI, simp)\napply (simp add: atomize_imp)\napply (induct_tac x, auto)\nby (case_tac \"list\", simp+)\n\n(* the empty list is the bottom element for lists *)\nlemma [simp]: \"[] \\ l\"\nby (simp add: sq_le_list)\n\ntext \\The prefix relation translates from lists to streams\\\nlemma list2s_emb: \"\\#s \\ \\; #s' \\ \\\\ \\ (s2list s \\ s2list s') = (s \\ s')\"\napply (simp add: s2list_def)\napply (rule someI2_ex)\napply (rule_tac x=\"#s'\" in lncases, simp) \napply (frule s2list_ex, simp)\napply (rule someI2_ex)\napply (rule_tac x=\"#s\" in lncases, simp) \napply (frule s2list_ex, simp)\napply (rule iffI)\napply (drule sym, drule sym, simp)\napply (simp add: sq_le_list)\nby (simp add: sq_le_list)\n\ntext \\@{term list2s} is monotone\\\nlemma list2s_mono: \"l \\ l' \\ list2s l \\ list2s l'\"\nby (simp add: sq_le_list)\n\ntext \\Prepending a fixed element to a list is a monotone function\\\nlemma monofun_lcons: \"monofun (\\l. a # l)\"\napply (rule monofunI)\napply (simp add: atomize_imp)\napply (rule_tac x=\"a\" in spec)\napply (induct_tac x, simp+)\napply (rule allI)\napply (simp add: sq_le_list)\napply (rule allI)\napply (rule impI)\napply (simp add: sq_le_list)\nby (rule monofun_cfun_arg, simp)\n\ntext \\Head and rest on streams translate to head and rest on lists\\\nlemma s2list2lcons: \"#s \\ \\ \\ s2list (\\a \\ s) = a # (s2list s)\"\napply (rule_tac x=\"#s\" in lncases, simp+)\napply (simp add: atomize_imp)\napply (rule_tac x=\"s\" in spec)\napply (rule_tac x=\"a\" in spec)\napply (induct_tac k, simp+)\napply (rule allI,rule allI, rule impI)\napply (rule_tac x=\"xa\" in scases, simp+)\napply (simp add: s2list_def)\napply (rule someI2_ex)\napply (frule s2list_ex, simp)\napply (rule someI2_ex)\napply (frule s2list_ex)\napply (erule exE)\napply (rule_tac x=\"x#a#l\" in exI, simp+)\nby (rule list2s_inj [THEN iffD1], simp)\n\ntext \\@{term s2list} is left-inverse to @{term list2s}\\\nlemma [simp]: \"s2list (list2s l) = l\"\napply (induct_tac l, simp+)\nby (subst s2list2lcons, simp+)\n\ntext \\Evaluation of @{term list2s} from right to left\\\nlemma slistl5[simp]: \"list2s (l @ [m]) = list2s l \\ \\m\"\nby (induct_tac l, simp+)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\List- and stream-processing functions\\\n(* ----------------------------------------------------------------------- *)\n\n(* concatenating streams corresponds to concatenating lists *)\nlemma listConcat: \" \\ = <(l1 @ l2)>\"\napply(induction l1)\nby auto\n\n(* smap for streams is equivalent to map for lists *)\nlemma smap2map: \"smap g\\() = <(map g ls)>\"\napply(induction ls)\nby auto\n\n(* the notion of length is the same for streams as for lists *)\nlemma list2streamFin: \"#() = Fin (length ls)\"\napply(induction ls)\nby auto\n\ntext \\Monotone list-processing functions induce monotone stream-processing functions\n by applying them to the stream's k-element prefix\\\nlemma mono_slpf2spf:\n \"monofun f \\ monofun (\\s. list2s (f (s2list (stake k\\s))))\"\napply (rule monofunI)\napply (simp add: atomize_imp)\napply (rule_tac x=\"y\" in spec)\napply (rule_tac x=\"x\" in spec)\napply (induct_tac k, simp+)\napply (rule impI)\napply (drule mp, assumption)\napply (rule allI)+\napply (rule impI)\napply (drule lessD, simp)\napply (erule disjE, simp)\napply (rule list2s_mono)\napply (rule_tac f=\"f\" in monofunE,simp+)\napply (erule exE)+\napply (erule conjE)\napply (erule exE,simp)\napply (erule conjE)\napply (rule list2s_mono)\napply (rule_tac f=\"f\" in monofunE,simp+)\napply (rule_tac x=\"xa\" in scases,simp)\napply (subst list2s_emb,simp+)\napply (rule monofun_cfun_arg)+\nby simp\n\ntext \\Applying a monotone list-processing function to the @{term k}-element prefix of a stream\n is monotone with respect to @{term k}\\\nlemma chain_slpf2spf:\n \"monofun f \\ list2s (f (s2list (stake i\\x))) \\ list2s (f (s2list (stake (Suc i)\\x)))\"\napply (rule list2s_mono)\napply (rule_tac f=\"f\" in monofunE,simp+)\napply (subst list2s_emb,simp+)\nby (rule chainE, simp)\n\ntext \\Now, a list-processing function is converted to a stream-processing one by building\n the LUB of applying the function to all prefixes of the stream\\\nlemma slpf2spfl_contl:\n \"monofun f \\ \n cont (\\s. (\\k. list2s (f (s2list (stake k\\s)))))\"\napply (rule cont2cont_lub)\napply (rule chainI)\napply (rule chain_slpf2spf, simp)\napply (rule pr_contI) \napply (rule mono_slpf2spf, assumption) \napply (rule allI)\nby (rule_tac x=\"k\" in exI, simp)\n\ntext \\The output function of @{term slpf2spf} is continuous\\\nlemma slpf2spf_cont:\n \"monofun f \\ \n (\\ s. (\\k. list2s (f (s2list (stake k\\s)))))\\s = (\\k. list2s (f (s2list (stake k\\s))))\"\napply (subst beta_cfun)\nby (rule slpf2spfl_contl, assumption, simp)\n\ntext \\Applying @{term \"slpf2spf f\"} to an element @{term x}\\\nlemma slpf2spf_def2:\n \"monofun f \\ slpf2spf f\\x = (\\k. list2s (f (s2list (stake k\\x))))\"\napply (simp add: slpf2spf_def)\nby (rule slpf2spf_cont)\n\ntext \\The output of @{term slpf2spf} is live\\\nlemma sislivespf_slpf2spf:\n \"monofun f \\ sislivespf (slpf2spf f)\"\napply (rule sislivespfI)\napply (rule_tac x=\"#x\" in lncases, assumption)\napply (simp add: slpf2spf_def2)\napply (subgoal_tac \n \"finite_chain (\\k. list2s (f (s2list (stake k\\x))))\")\napply (simp add: finite_chain_def)\napply (erule conjE, erule exE)\napply (frule lub_finch1, simp+)\napply (frule lub_eqI, simp)\napply (simp add: finite_chain_def, rule conjI)\napply (rule chainI)\napply (rule chain_slpf2spf, assumption)\napply (rule_tac x=\"k\" in exI)\napply (simp add: max_in_chain_def)\napply (rule allI, rule impI)\napply (subgoal_tac \"stake j\\x = stake k\\x\", simp)\napply (subst fin2stake [THEN sym], simp+)\nby (simp add: min_def)\n\ntext \\Any live stream-processing function can be converted to a monotone\n list-processing function\\\nlemma sspf2lpf_mono: \n \"sislivespf f \\ monofun (sspf2lpf f)\"\napply (rule monofunI)\napply (simp add: sspf2lpf_def)\napply (subst list2s_emb)\napply (rule notI, frule sislivespfD2, simp+)+\napply (rule monofun_cfun_arg)\nby (simp add: sq_le_list)\n\ntext \\The result of applying continuous functions to infinite inputs\n does not change on even longer inputs\\\nlemma monofun_spf_ubl[simp]:\n \"#(f\\x) = \\ \\ f\\(x \\ y) = f\\x\"\napply (rule sym)\napply (rule eq_less_and_fst_inf [of \"f\\x\"])\nby (rule monofun_cfun_arg, auto)\n\ntext \\Some special results about @{term smap} and injective functions\n on streams of natural successors\\\nlemma inj_sfilter_smap_siteratel1:\n \"inj f \\ sfilter {f j}\\(smap f\\(siterate Suc (Suc (k + j)))) = \\\"\napply (rule ex_snth_in_sfilter_nempty [rule_format])\napply (simp add: atomize_imp)\napply (rule impI)\napply (subst smap_snth_lemma, simp+)\napply (simp add: snth_siterate_Suc)\napply (rule notI)\nby (frule_tac x=\"Suc (n+(k+j))\" and y=\"j\" in injD, simp+)\n\n(* an element m can't appear infinitely often in a stream produced by mapping an injective function f\n over the natural numbers *)\nlemma inj_sfilter_smap_siteratel2[simp]:\n \"inj f \\ #(sfilter {m}\\(smap f\\(siterate Suc j))) \\ \\\"\napply (case_tac \"m\\range f\")\napply (rule_tac b=\"m\" and f=\"f\" in rangeE, simp+)\napply (rule notI)\napply (drule_tac n=\"Suc x\" in slen_sfilter_sdrop [rule_format], simp)\napply (simp add: sdrop_siterate)\napply (simp add: inj_sfilter_smap_siteratel1)\nby (simp add: sfilter_smap_nrange)\n\n\n(* ----------------------------------------------------------------------- *)\nsubsection \\compact lemmas\\\n(* ----------------------------------------------------------------------- *)\n\n(* finite chains have lub *)\nlemma finChainapprox: assumes \"chain Y\" and \"# (\\i. Y i) =Fin k\" \n shows \"\\i. Y i = (\\i. Y i)\"\n using assms(1) assms(2) inf_chainl4 lub_eqI lub_finch2 by fastforce\n\n(* finite streams are compact *)\nlemma finCompact: assumes \"#s = Fin k\"\n shows \"compact s\"\n proof (rule compactI2)\n fix Y assume as1: \"chain Y\" and as2: \"s \\ (\\i. Y i)\"\n show \"\\i. s \\ Y i\" by (metis approxl2 as1 as2 assms finChainapprox lub_approx stream.take_below)\nqed\n\n(* the empty stream is compact *)\nlemma \"compact \\\"\n by simp\n\n(* \\x is compact *)\nlemma \"compact (\\x)\"\n by (simp add: sup'_def)\n\n(* not so compact stuff *)\nlemma nCompact: assumes \"chain Y\" and \"\\i. (Y i \\ x)\" and \"\\i. (Y i \\ x)\" and \"x \\ (\\i. Y i)\"\n shows \"\\(compact x)\"\n by (meson assms below_antisym compactD2)\n\n(* infinite streams are not compact *)\nlemma infNCompact: assumes \"#s = \\\"\n shows\"\\ (compact s)\"\n proof (rule nCompact)\n show \"chain (\\i. stake i\\s)\" by simp\n show \"\\i. stake i\\s \\ s\" by simp\n show \"\\i. stake i\\s \\ s\" by (metis Inf'_neq_0 assms fair_sdrop sdropostake strict_slen)\n show \"s \\ (\\ i. stake i\\s)\" by (simp add: reach_stream)\nqed\n\n(* sinftimes (\\x) is not compact *)\nlemma \"\\ (compact (sinftimes (\\x)))\"\n by (simp add: infNCompact slen_sinftimes)\n\n(* add function *)\ndefinition add:: \"nat stream \\ nat stream \\ nat stream\" where\n\"add \\ \\ s1 s2 . smap (\\ s3. (fst s3) + (snd s3))\\(szip\\s1\\s2)\"\n\n(* add is continuous *)\nlemma \"cont (\\ s1 s2 . smap (\\ s3. (fst s3) + (snd s3))\\(szip\\s1\\s2))\"\nby simp\n\n(* add returns the same result as merge plus *)\nlemma \"add = merge plus\"\nby(simp add: add_def merge_def)\n\n(* unfolding rule for add *)\nlemma add_unfold: \"add\\(\\x \\ xs)\\(\\y\\ ys) = \\(x+y) \\ add\\xs\\ys\"\n by(simp add: add_def)\n\n(* relation between snth and add *)\nlemma add_snth: \"Fin n <#xs \\Fin n < #ys \\ snth n (add\\xs\\ys) = snth n xs + snth n ys\"\n apply(induction n arbitrary: xs ys)\n apply (metis Fin_02bot add_unfold lnless_def lnzero_def shd1 slen_empty_eq snth_shd surj_scons)\n by (smt Fin_Suc Fin_leq_Suc_leq Suc_eq_plus1_left add_unfold inject_lnsuc less2eq less2lnleD lnle_conv lnless_def lnsuc_lnle_emb sconc_snd_empty sdropostake shd1 slen_scons snth_rt snth_scons split_streaml1 stream.take_strict surj_scons ub_slen_stake)\n\n(* add applied to the empty stream always returns the empty stream *)\nlemma add_eps1[simp]: \"add\\\\\\ys = \\\"\n by(simp add: add_def)\n\n(* add applied to the empty stream always returns the empty stream *)\nlemma add_eps2[simp]: \"add\\xs\\\\ = \\\"\n by(simp add: add_def)\n\n(* relation between srt and add *)\nlemma [simp]: \"srt\\(add\\(\\a \\ as)\\(\\b \\ bs)) = add\\as\\bs\"\n by (simp add: add_unfold)\n\n(* helper lemma for commutativity of add *)\nlemma add_commu_helper: assumes \"\\y. add\\x\\y = add\\y\\x\"\n shows \"add\\(\\a \\ x)\\y = add\\y\\(\\a \\ x)\"\n apply(cases \"y = \\\")\n apply auto[1]\n by (metis (no_types, lifting) Groups.add_ac(2) assms add_unfold surj_scons)\n\n(* the add function is commutative *)\nlemma add_commutative: \"add\\x\\y = add\\y\\x\"\n apply(induction x arbitrary: y)\n apply(simp_all)\n by (metis add_commu_helper stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n(* relation between add, lnsuc and srt *)\nlemma add_len: assumes \"xs\\\\\" and \"u\\\\\"\n shows \"#(add\\xs\\(u && ys)) = lnsuc\\(#(add\\(srt\\xs)\\ys))\"\n by (metis (no_types, lifting) add_unfold assms(1) assms(2) slen_scons stream.con_rews(2) stream.sel_rews(5) surj_scons)\n\n(* helper lemma for add_slen *)\nlemma add_slen_help [simp]: \"#xs \\ #ys \\ #(add\\xs\\ys) = #xs\"\n apply(induction xs arbitrary: ys)\n apply(rule admI)\n apply rule+\n apply (smt ch2ch_Rep_cfunL ch2ch_Rep_cfunR contlub_cfun_arg contlub_cfun_fun lub_below_iff lub_eq)\n apply(simp)\n proof -\n fix u\n fix xs ys :: \"nat stream\"\n assume as1: \"u \\ \\\" and as2: \"(\\ys. #xs \\ #ys \\ #(add\\xs\\ys) = #xs)\" and as3: \" #(u && xs) \\ #ys\"\n obtain a where a_def: \"updis a = u\" by (metis as1 discr.exhaust upE)\n show \"#(add\\(u && xs)\\ys) = #(u && xs)\"\n proof (cases \"ys = \\\")\n case True thus ?thesis using add_eps2 as3 bot_is_0 bottomI strict_slen by auto\n next\n case False\n hence \"#(add\\xs\\(srt\\ys)) = #xs\" by (metis a_def as2 as3 lnat.inverts lscons_conv slen_scons surj_scons)\n thus ?thesis by (metis False \\updis a = u\\ add_unfold lscons_conv slen_scons surj_scons)\n qed\nqed\n\n(* the length of the stream returned by add is the minimum of the length of the two input streams of add *)\nlemma add_slen [simp]: \"#(add\\x\\y) = min (#x) (#y)\"\n apply(cases \"#x\\#y\")\n apply (metis add_slen_help lnle_def min.commute min_absorb2)\n by (metis add_commutative add_slen_help linear lnle_def min.absorb2)\n\n(* if the stream has infinite length, the length of the stream returned by add is the length of the second input stream of add *)\nlemma add_slen_sinf [simp]: \n shows \" #xs = \\ \\ #(add\\xs\\ys) =(#ys)\"\n by (simp add: min.absorb2)\n\n(* relation between snth and add *)\nlemma snth_add: \"Fin n < #ys \\ snth n (add\\\\x\\<^sup>\\\\ys) = snth n (smap (\\z. z + x)\\ys)\"\n apply(induction n arbitrary: ys)\n apply (smt Fin_02bot add.commute add_unfold lnless_def lnzero_def shd1 sinftimes_unfold slen_empty_eq smap_snth_lemma snth_shd surj_scons)\n by (smt Fin_Suc add_slen_sinf add_unfold lnle_conv lnless_def lnsuc_lnle_emb sinftimes_unfold slen_empty_eq slen_scons slen_sinftimes slen_smap smap_snth_lemma snth_scons strict_icycle surj_scons)\n\n(* relation between add and smap *)\nlemma add2smap: \"add\\((\\x)\\<^sup>\\)\\ys = smap (\\z. z+x)\\ys\"\n apply(rule snths_eq)\n apply auto[1]\n by (metis add_slen_sinf lnat.con_rews lnzero_def lscons_conv slen_empty_eq slen_scons slen_sinftimes snth_add sup'_def)\n\n(* helper lemma for add2smapsu *)\nlemma add2smapsuc_helper:\" Suc = (\\z. z+1)\"\nby auto\n\n(* relation between add and smap applied to (Suc)\\sc *)\nlemma inf_srcdups_stake_snth_sdrop:\n assumes \"#s = \\\" and \"srcdups\\s = srcdups\\(stake k\\s)\"\n shows \"snth n (sdrop k\\s) = snth k s\"\nproof (induction n)\n case 0\n then show ?case\n by (simp add: snth_def)\nnext\n case (Suc n)\n then have \"snth (Suc n) (sdrop k\\s) \\ snth k s \\ False\"\n proof -\n assume \"snth (Suc n) (sdrop k\\s) \\ snth k s\"\n have \"#s = \\\"\n by (simp add: assms(1))\n moreover have \"snth (n + k) s \\ snth (n + k + 1) s\"\n by (metis Suc.IH Suc.prems Suc_eq_plus1 \\snth (Suc n) (sdrop k\\s) \\ snth k s\\ semiring_normalization_rules(23) snth_sdrop)\n ultimately have \"srcdups\\(stake (n + k + 1)\\s) \\ srcdups\\s\"\n by (metis add2smapsuc_helper srcdups_snth_stake_inf)\n moreover have \"srcdups\\(stake (n + k + 1)\\s) = srcdups\\(stake k\\s)\"\n proof -\n have \"srcdups\\(stake k\\s) \\ srcdups\\(stake (n + k + 1)\\s)\"\n proof -\n have \"k + (1 + n) = n + k + 1\"\n by simp\n then show ?thesis\n by (metis (no_types) minimal monofun_cfun_arg sconc_snd_empty stake_add)\n qed\n then show ?thesis\n by (metis assms(2) below_antisym monofun_cfun_arg stream.take_below)\n qed\n ultimately show \"False\"\n by (simp add: assms(2))\n qed\n then show ?case\n by blast\nqed\n\nlemma srcdups_split:\n assumes \"#(srcdups\\s) < \\\" and \"#s = \\\"\n obtains n where \"s = (stake n\\s) \\ ((\\(snth n s))\\<^sup>\\)\"\nproof -\n obtain k where \"srcdups\\s = srcdups\\(stake k\\s)\"\n by (meson assms(1) fun_approxl2 lnat_well_h2)\n then have \"sdrop k\\s \\ srt\\(sdrop k\\s) \\ False\"\n proof -\n assume \"sdrop k\\s \\ srt\\(sdrop k\\s)\"\n moreover have \"#(sdrop k\\s) = #(srt\\(sdrop k\\s))\"\n by (metis assms(2) fair_sdrop sdrop_back_rt)\n ultimately obtain n where \"snth n (sdrop k\\s) \\ snth n (srt\\(sdrop k\\s))\"\n using snths_eq by blast\n moreover have \"snth n (srt\\(sdrop k\\s)) = snth k s\"\n by (metis \\srcdups\\s = srcdups\\(stake k\\s)\\ assms(2) inf_srcdups_stake_snth_sdrop snth_rt)\n then show \"False\"\n by (metis (no_types) \\snth n (srt\\(sdrop k\\s)) = snth k s\\ \\srcdups\\s = srcdups\\(stake k\\s)\\ assms(2) calculation inf_srcdups_stake_snth_sdrop)\n qed\n then have \"sdrop k\\s = \\(snth k s) \\ (sdrop k\\s)\"\n by (metis Inf'_neq_0 assms(2) fair_sdrop snth_def strict_slen surj_scons)\n then have \"sdrop k\\s = ((\\(snth k s))\\<^sup>\\)\"\n using s2sinftimes by blast\n then have \"s = (stake k\\s) \\ ((\\(snth k s))\\<^sup>\\)\"\n by (metis split_streaml1)\n thus ?thesis\n by (metis that)\nqed\n\nlemma add2smapsuc:\"add\\((\\1)\\<^sup>\\)\\s=smap (Suc)\\s\"\n by (metis add_eps2 add_unfold plus_1_eq_Suc rek2smap sinftimes_unfold)\n\n(* relation between add and smap *)\nlemma add2smap_f: \"add\\((\\x)\\<^sup>\\) = smap (\\z. z+x)\"\napply(rule cfun_eqI)\nby (metis (no_types, lifting) add_commutative add_eps2 add_unfold rek2smap sinftimes_unfold)\n\n(* relation between shd and updis *)\nlemma shd_updis:\"shd (u && s) = (THE a. updis a= u)\"\nby(simp add: shd_def the_equality, metis)\n\n(* smap applied to the identity + stream returns the stream *)\nlemma smap_id:\"smap (id)\\s = s\"\napply(induction s, auto)\napply(simp add: smap_hd_rst)\nusing stream.con_rews(2) surj_scons by fastforce\n\n(* smap applied to the identity + stream returns the identity + stream *)\nlemma smapid2ID_h:\"smap id\\ s = ID\\ s\"\napply(simp add: ID_def)\nby(rule snths_eq, auto, simp add: smap_id)\n\n(* smap applied to the identity returns the identity *)\nlemma smapid2ID:\"smap id= ID\"\nby(rule cfun_eqI, simp add: smapid2ID_h)\n\n(* add applied to \\0\\\\s returns the identity + stream *)\nlemma add2ID_h:\"add\\((\\0)\\<^sup>\\)\\s=ID\\s\"\nproof(induction s rule: ind)\n case 1\n then show ?case \n by simp\nnext\ncase 2\n then show ?case\n by simp\nnext\n case (3 a s)\n then show ?case\n by (metis ID1 add_unfold semiring_normalization_rules(5) sinftimes_unfold)\nqed\n\n(* add applied to \\0\\ returns the identity *)\nlemma add2ID:\"add\\\\0\\<^sup>\\ = ID\"\nby (simp add: add2ID_h cfun_eqI)\n\n(*\n(* Setup type relator for streams*)\n\n(* TODO: Remove Warning\n https://fa.isabelle.narkive.com/wKVBUrdK/isabelle-setup-lifting-no-relator-for-the-type-warning\n HOL/Library/Quotient_Set.thy \n *)\ndefinition \"rel_stream R x y \\ \\(e1::'e::countable) (e2::'f::countable). R e1 e2 \\ e1\\ sValues\\x \\ e2\\ sValues\\y\" (*Does not work*)\n\ndefinition vstream :: \"('a \\ 'b) \\ 'b stream \\ 'a stream\" (*Probably also does not work*)\n where \"vstream f s \\ smap (inv f)\\s\"\n\nlemma stream_quotient [quot_thm]:\n assumes \"Quotient3 R Abs Rep\"\n shows \"Quotient3 (rel_stream R) (vstream Rep) (vstream Abs)\"\nproof (rule Quotient3I)\n from assms have \"\\x. Abs (Rep x) = x\" by (rule Quotient3_abs_rep)\n then show \"\\xs. vstream Rep (vstream Abs xs) = xs\"\n unfolding vstream_def sorry\nnext\n show \"\\xs. rel_stream R (vstream Abs xs) (vstream Abs xs)\"\n unfolding rel_stream_def vstream_def\n apply auto sorry\nnext\n fix r s\n show \"rel_stream R r s = (rel_stream R r r \\ rel_stream R s s \\ vstream Rep r = vstream Rep s)\"\n unfolding rel_stream_def vstream_def set_eq_iff\n apply auto sorry\nqed\n\ndeclare [[mapQ3 stream = (rel_stream, stream_quotient)]]\n*)\n\nend\n(*>*)", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/stream/Stream.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.265071134311433}} {"text": "theory DiscreteSyntax\n imports Complex_Main\n Permutation\n Ordinary_Differential_Equations.Flow\nbegin\n(*Ordinary_Differential_Equations.Flow*)\n\nsubsection \\Syntax\\\n\ntype_synonym sample_time = int\ntype_synonym var = char \ntype_synonym offset = nat\ntype_synonym outupd = \"real list \\ real\"\n\n\\ \\input vars, output vars, input time offsets, sample time, output functions\\\ndatatype block = Block \"var list\" \"var list\" \"offset list\" \"sample_time\"\n \"outupd list\" \n(*offset is a para to get pre value, e.g. y(kn) = s((k-1)n).\n we assume each output corresponds to a same offset for all inputs*)\n\n\n\nfun get_inputs :: \"block \\ var list\" where\n \"get_inputs (Block a _ _ _ _) = a\"\n\nfun get_outputs :: \"block \\ var list\" where\n \"get_outputs (Block _ c _ _ _) = c\"\n\nfun get_sample_time :: \"block \\ sample_time\" where\n \"get_sample_time (Block _ _ _ c _) = c\"\n\nfun get_offsets :: \"block \\ offset list\" where \n \"get_offsets (Block _ _ c _ _) = c\"\n\nfun get_outupd :: \"block \\ outupd list\" where\n \"get_outupd (Block _ _ _ _ d) = d\"\n\n\ndefinition \"Available b = ((length (get_offsets b)) = (length (get_outputs b))\n \\ ((length (get_outputs b)) = (length (get_outupd b)))\n \\ (\\i j. i < j \\ j < (length (get_outputs b)) \\ j \\ 0 \n \\ (nth (get_outputs b) i) \\ (nth (get_outputs b) j)) \\ ((\\i. i \\ 0 \\ i < (length (get_offsets b))\n \\ ((nth (get_offsets b) i) \\ 0)) \\ \n (set (get_outputs b) \\ set (get_inputs b) = {}) \\ (get_sample_time b \\ 0)))\"\n\ndefinition \"Unique bl = (\\i j. i < j \\ j < (length bl) \\ i \\ 0 \\ (nth bl i) \\ (nth bl j))\"\n\ndefinition \"Unique' bl = distinct bl\"\n\nlemma Unique'_eq: \"Unique bl \\ Unique' bl\"\n unfolding Unique_def Unique'_def\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n then show ?case unfolding distinct.simps\n by (metis Suc_less_eq bot_nat_0.extremum in_set_conv_nth \n length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc)\nqed\n\nlemma Unique_eq: \"Unique' bl \\ Unique bl\"\n unfolding Unique_def Unique'_def\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n then show ?case unfolding distinct.simps\n by (metis Cons.prems index_first index_nth_id)\nqed\n\nlemma Unique_lemma: \"Unique (a#bl) \\ Unique bl\"\n unfolding Unique_def\n by (metis Suc_less_eq bot_nat_0.extremum length_Cons nth_Cons_Suc)\n\nlemma Unique_lemma2: \"Unique (bl@[a]) \\ Unique bl\"\n unfolding Unique_def\n by (smt (verit, del_insts) Suc_lessD length_append_singleton lessI less_trans_Suc nth_append)\n\nlemma Unique_remove: \"a \\ set bl \\ Unique bl \\ Unique (remove1 a bl)\"\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons b bl)\n then show ?case\n proof(cases \"a = b\")\n case True\n then show ?thesis using Cons(3) Unique_lemma by auto\n next\n case False\n have 1: \"Unique (remove1 a bl)\"\n using Cons False Unique_lemma by fastforce\n have 2: \"\\j. j < (length bl) \\ j \\ 0 \\ b \\ (nth bl j)\"\n using Cons(3) unfolding Unique_def\n by (metis Suc_less_eq bot_nat_0.extremum length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc)\n have 3: \"\\j. j < (length (remove1 a bl)) \\ j \\ 0 \\ b \\ (nth (remove1 a bl) j)\"\n using 2 \n by (metis in_set_conv_nth le0 notin_set_remove1)\n have 4: \"remove1 a (b # bl) = b#(remove1 a bl)\"\n using False by auto\n have 5: \"Unique (b#(remove1 a bl))\"\n using 1 3 by (smt (verit, best) Suc_leI Unique_def add_diff_cancel_left' \n bot_nat_0.extremum le_0_eq le_imp_less_Suc length_Cons less_Suc_eq \n less_Suc_eq_0_disj nth_Cons' plus_1_eq_Suc)\n then show ?thesis using 4 by auto\n qed\nqed\n\nlemma Unique_add: \"\\j. j < (length bl) \\ j \\ 0 \\ b \\ (nth bl j) \\\n Unique bl \\ Unique (b#bl)\"\n by (smt (verit, best) Suc_leI Unique_def add_diff_cancel_left' \n bot_nat_0.extremum le_0_eq le_imp_less_Suc length_Cons less_Suc_eq \n less_Suc_eq_0_disj nth_Cons' plus_1_eq_Suc)\n\nlemma Unique_add2: \"\\j. j < (length bl) \\ j \\ 0 \\ b \\ (nth bl j) \\\n Unique bl \\ Unique (bl@[b])\"\n by (smt (verit, ccfv_threshold) Suc_less_eq Unique_def length_append_singleton \n less_Suc_eq less_trans_Suc nth_append nth_append_length)\n\nlemma Unique_Cons: \"Unique (al@bl) \\ Unique bl\"\nproof(induction al)\n case Nil\n then show ?case by simp\nnext\n case (Cons a al)\n then show ?case using Unique_lemma by force\nqed\n\nlemma Unique_rev: \"Unique bl \\ Unique (rev bl)\"\n unfolding Unique_def using rev_nth apply simp\n by (smt (verit, ccfv_SIG) Suc_lessD diff_less_mono2 less_imp_diff_less \n less_trans_Suc not_less_eq rev_nth)\n\nlemma Unique_Cons2: \"Unique (al@bl) \\ Unique al\"\n subgoal premises pre\nproof -\n have 1: \"rev (al@bl) = rev bl @ rev al\"\n by auto\n have 2: \"Unique (rev al)\"\n using Unique_rev Unique_Cons 1 pre by fastforce\n then show ?thesis using Unique_rev by force\nqed\n done\n\nlemma Unique_k : \"b \\ set bl \\ Unique bl \\ \n\\j. j < (length (remove1 b bl)) \\ j \\ 0 \\ b \\ (nth (remove1 b bl) j)\"\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n then show ?case\n proof(cases \"b = a\")\n case True\n then show ?thesis apply simp using Cons(3) unfolding Unique_def\n by (metis Suc_less_eq bot_nat_0.extremum length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc)\n next\n case False\n have 1: \"\\j. j < length (remove1 b bl) \\ 0 \\ j \\ b \\ remove1 b bl ! j\"\n using Cons False Unique_lemma by (metis set_ConsD)\n then show ?thesis using False\n by (metis bot_nat_0.extremum in_set_conv_nth remove1.simps(2) set_ConsD)\n qed\nqed\n\nlemma Unique_perm: \"Unique bl \\ bl <~~> cl \\ Unique cl\"\nproof(induction cl arbitrary: bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons c cl)\n have 1: \"Unique cl\"\n proof -\n have tmp1: \"Unique (remove1 c bl)\"\n using Cons by (metis Unique_remove remove1_idem)\n show ?thesis using Cons tmp1 by (metis perm_remove_perm remove_hd)\n qed\n have 2: \"\\j. j < (length (remove1 c bl)) \\ j \\ 0 \\ c \\ (nth (remove1 c bl) j)\"\n using Unique_k Cons(2,3) by (metis notin_set_remove1 nth_mem)\n have 3: \"c \\ set cl\"\n using Cons(2,3) 1 by (meson Unique'_def Unique'_eq distinct.simps(2) distinct_perm)\n have 4: \"\\j. j < (length cl) \\ j \\ 0 \\ c \\ (nth cl j)\"\n using 3 by force\n then show ?case using 1 Unique_add by metis\nqed\n\n\ndefinition \"wf0 bl = (Unique bl \\ (\\b \\ set bl. Available b))\"\n\nlemma wf0_lemma: \"wf0 (a#bl) \\ wf0 bl\"\n unfolding wf0_def using Unique_lemma by auto\n\nlemma wf0_Permutation: \"bl <~~> bl' \\ wf0 bl \\ wf0 bl'\"\nproof(induction bl arbitrary:bl')\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n have 1: \"bl <~~> remove1 a bl'\"\n using Cons(2) perm_remove_perm by (metis remove_hd)\n have 2: \"wf0 (remove1 a bl')\"\n using 1 Cons wf0_lemma by presburger\n have 3: \"a \\ set (remove1 a bl')\"\n using Cons(2,3) unfolding wf0_def Unique_def apply simp\n by (metis \"1\" One_nat_def Suc_eq_plus1 Suc_less_eq add_diff_cancel_right' \n in_set_conv_nth nth_Cons_0 perm_sym prem_seteq zero_less_Suc)\n have 4: \"Available a\"\n using Cons(3) unfolding wf0_def by simp\n have 5: \"\\i. i < length (remove1 a bl') \\ 0 \\ i \\ remove1 a bl' ! i \\ a\"\n using 3 by (metis nth_mem)\n have 6: \"(\\i j. i < j \\ j < length bl' \\ 0 \\ i \\ bl' ! i \\ bl' ! j)\"\n using 5 2 apply simp\n proof(induction bl')\n case Nil\n then show ?case by simp\n next\n case (Cons b bl')\n then show ?case\n proof(cases \"a = b\")\n case True\n have tmp1: \"\\i j. i < j \\ j < length bl' \\ bl' ! i \\ bl' ! j\"\n using Cons True by (simp add: wf0_def Unique_def)\n then show ?thesis using Cons(2) True\n using length_Cons less_Suc_eq_0_disj less_nat_zero_code by fastforce\n next\n case False\n have tmp1: \"remove1 a (b # bl') = b#(remove1 a bl')\"\n using False by simp\n have tmp2: \"wf0 (remove1 a bl')\"\n using Cons(3) tmp1 by (metis wf0_lemma)\n have tmp3: \"\\i a\"\n using Cons(2) tmp1 by auto\n have tmp4: \"\\i j. i < j \\ j < length bl' \\ bl' ! i \\ bl' ! j\"\n using tmp2 tmp3 Cons(1) by simp\n have tmp5: \"\\i b\"\n using Cons(3) tmp1 \n by (metis wf0_def Suc_leI Unique_def add_diff_cancel_left' bot_nat_0.extremum_unique \n le_imp_less_Suc length_Cons nth_Cons_0 nth_Cons_pos plus_1_eq_Suc zero_less_Suc)\n have tmp6: \"\\i b\"\n using tmp5 False by (metis in_set_conv_nth in_set_remove1)\n then show ?thesis using tmp4 using less_Suc_eq_0_disj by fastforce\n qed\n qed\n then show ?case using Cons(3) 2 unfolding wf0_def Unique_def using 3 4 \n by (meson Cons.prems(1) perm_sym prem_seteq)\nqed\n\nlemma wf0_Cons: \"wf0 (bl@cl) \\ wf0 bl\"\n unfolding wf0_def using Unique_Cons Unique_Cons2 by auto\n\nlemma Unique_Permutation: \"bl <~~> bl' \\ Unique bl \\ Unique bl'\"\nproof(induction bl arbitrary:bl')\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n have 1: \"bl <~~> remove1 a bl'\"\n using Cons(2) perm_remove_perm by (metis remove_hd)\n have 2: \"Unique (remove1 a bl')\"\n using 1 Cons by (meson Unique_lemma)\n have 3: \"a \\ set (remove1 a bl')\"\n using Cons(2,3) unfolding wf0_def Unique_def apply simp\n by (metis \"1\" One_nat_def Suc_eq_plus1 Suc_less_eq add_diff_cancel_right' \n in_set_conv_nth nth_Cons_0 perm_sym prem_seteq zero_less_Suc)\n have 5: \"\\i. i < length (remove1 a bl') \\ 0 \\ i \\ remove1 a bl' ! i \\ a\"\n using 3 by (metis nth_mem)\n have 6: \"(\\i j. i < j \\ j < length bl' \\ 0 \\ i \\ bl' ! i \\ bl' ! j)\"\n using 5 2 apply simp\n proof(induction bl')\n case Nil\n then show ?case by simp\n next\n case (Cons b bl')\n then show ?case\n proof(cases \"a = b\")\n case True\n have tmp1: \"\\i j. i < j \\ j < length bl' \\ bl' ! i \\ bl' ! j\"\n using Cons True by (simp add: wf0_def Unique_def)\n then show ?thesis using Cons(2) True\n using length_Cons less_Suc_eq_0_disj less_nat_zero_code by fastforce\n next\n case False\n have tmp1: \"remove1 a (b # bl') = b#(remove1 a bl')\"\n using False by simp\n have tmp2: \"Unique (remove1 a bl')\"\n using Cons(3) tmp1 using Unique_lemma by force\n have tmp3: \"\\i a\"\n using Cons(2) tmp1 by auto\n have tmp4: \"\\i j. i < j \\ j < length bl' \\ bl' ! i \\ bl' ! j\"\n using tmp2 tmp3 Cons(1) by simp\n have tmp5: \"\\i b\"\n using Cons(3) tmp1 \n by (metis Suc_leI Unique_def add_diff_cancel_left' bot_nat_0.extremum_unique \n le_imp_less_Suc length_Cons nth_Cons_0 nth_Cons_pos plus_1_eq_Suc zero_less_Suc)\n have tmp6: \"\\i b\"\n using tmp5 False by (metis in_set_conv_nth in_set_remove1)\n then show ?thesis using tmp4 using less_Suc_eq_0_disj by fastforce\n qed\n qed\n then show ?case using Cons(3) 2 unfolding wf0_def Unique_def using 3 \n by (meson Cons.prems(1) perm_sym prem_seteq)\nqed\n\nprimrec pair_input_offset :: \"var list \\ offset \\ (var \\ offset) list\" where\n\"pair_input_offset [] os = []\" |\n\"pair_input_offset (v#vl) os = (v, os) # pair_input_offset vl os\"\n\nfun Inputs :: \"block list \\ var set\" where\n \"Inputs [] = {}\"\n| \"Inputs (b#bl) = set (get_inputs b) \\ Inputs bl\"\n\nlemma Inputs_base: \"Inputs (l@[a]) = Inputs l \\ set (get_inputs a)\"\nproof(induction l)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n by auto\nqed\n\nlemma Inputs_Cons: \"Inputs (a@b) = Inputs a \\ Inputs b\"\nproof(induction a)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n by auto\nqed\n\nlemma Inputs_base3: \"a \\ set bl \\\nInputs (removeAll a bl) \\ set (get_inputs a) = Inputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n proof(cases \"a \\ set l\")\n case True\n then show ?thesis using Cons by auto\n next\n case False\n have 1: \"Inputs (removeAll a l) \\ set (get_inputs a) = Inputs l\"\n using False Cons by auto\n then show ?thesis using Cons False by auto\n qed\nqed\n\nlemma Inputs_eq: \"set al = set bl \\ Inputs al = Inputs bl\"\nproof(induction al arbitrary:bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a al)\n then show ?case\n proof(cases \"a \\ set al\")\n case True\n then show ?thesis using Cons(1)[of bl]\n by (metis Cons.IH Cons.prems insert_absorb list.simps(15))\n next\n case False\n then show ?thesis using Cons(1)[of \"removeAll a bl\"] Cons(2) Inputs_base3\n by (metis removeAll.simps(2) removeAll_id remove_code(1))\n qed\nqed\n\nlemma Inputs_rev : \"Inputs (rev bl) = Inputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a bl)\n then show ?case unfolding Inputs.simps rev.simps using Inputs_base by auto\nqed\n\nfun Outputs :: \"block list \\ var set\" where\n \"Outputs [] = {}\"\n| \"Outputs (b#bl) = set (get_outputs b) \\ Outputs bl\"\n\nlemma Outputs_base: \"Outputs (l@[a]) = Outputs l \\ set (get_outputs a)\"\nproof(induction l)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n by auto\nqed\n\nlemma Outputs_Cons: \"Outputs (a@b) = Outputs a \\ Outputs b\"\nproof(induction a)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n by auto\nqed\n\nlemma Outputs_base2: \"a \\ set bl \\\nOutputs (remove1 a bl) \\ set (get_outputs a) = Outputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n proof(cases \"a = b\")\n case True\n then show ?thesis by (simp add: sup_commute)\n next\n case False\n have 1: \"Outputs (remove1 a l) \\ set (get_outputs a) = Outputs l\"\n using False Cons by auto\n then show ?thesis using Cons False by auto\n qed\nqed\n\nlemma Outputs_base3: \"a \\ set bl \\\nOutputs (removeAll a bl) \\ set (get_outputs a) = Outputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n proof(cases \"a \\ set l\")\n case True\n then show ?thesis using Cons by auto\n next\n case False\n have 1: \"Outputs (removeAll a l) \\ set (get_outputs a) = Outputs l\"\n using False Cons by auto\n then show ?thesis using Cons False by auto\n qed\nqed\n\nlemma Outputs_eq: \"set al = set bl \\ Outputs al = Outputs bl\"\nproof(induction al arbitrary:bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a al)\n then show ?case\n proof(cases \"a \\ set al\")\n case True\n then show ?thesis using Cons(1)[of bl]\n by (metis Cons.IH Cons.prems insert_absorb list.simps(15))\n next\n case False\n then show ?thesis using Cons(1)[of \"removeAll a bl\"] Cons(2) Outputs_base3\n by (metis removeAll.simps(2) removeAll_id remove_code(1))\n qed\nqed\n\nlemma Outputs_remove: \"a \\ set bl \\\nOutputs (a#(remove1 a bl)) = Outputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons b l)\n then show ?case\n proof(cases \"a = b\")\n case True\n then show ?thesis by (simp add: sup_commute)\n next\n case False\n have 1: \"Outputs (remove1 a l) \\ set (get_outputs a) = Outputs l\"\n using False Cons by auto\n then show ?thesis using Cons False by auto\n qed\nqed\n\nlemma Outputs_perm: \"al <~~> bl \\ Outputs al = Outputs bl\"\nproof(induction al arbitrary:bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a al)\n have 1: \"al <~~> remove1 a bl\"\n using Cons(2) by (metis perm_remove_perm remove_hd)\n have 2: \"a \\ set bl\"\n using Cons(2) by (simp add: prem_seteq)\n then show ?case using Cons(1)[of \"remove1 a bl\"] 1 Outputs_remove by simp\nqed\n\nlemma Outputs_rev : \"Outputs (rev bl) = Outputs bl\"\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a bl)\n then show ?case unfolding Outputs.simps rev.simps using Outputs_base by auto\nqed\n\nfun wf_block :: \"block \\ bool\" where\n \"wf_block (Block a b c d e) = (length b = length c & length c = length e & length b > 0)\"\ndefinition \"Graph As = (\\b \\ As. length (get_outputs b) > 0 \\\n(\\x\\As. (\\y\\As. (x \\ y \\ ((set (get_outputs x)) \\ (set (get_outputs y))= {})))))\"\n\ndefinition \"wf1 bl = (wf0 bl \\ Graph (set bl))\"\n\nlemma Graph_lemma: \"Graph (set (a # bl)) \\ Graph (set bl)\"\n by (meson Graph_def list.set_intros(2))\n\nlemma Graph_lemma2: \"Unique (a#bl) \\\nGraph (set (a # bl)) \\ \\x \\ (Outputs bl). x \\ set (get_outputs a)\"\n unfolding Graph_def Unique_def\nproof(induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons b bl)\n have 1: \"\\i j. i < j \\ j < length (a # bl) \\ 0 \\ i \\ (a # bl) ! i \\ (a # bl) ! j\"\n using Cons(2) \n by (smt (verit, best) Suc_leI diff_Suc_1 le_eq_less_or_eq le_imp_less_Suc \n length_Cons nth_Cons' order_le_less_trans)\n have 3: \"\\x\\set (a # bl). \\y\\set (a # bl). x \\ y \\ set (get_outputs x) \\ set (get_outputs y) = {}\"\n using Cons(3) by simp\n have 4: \"\\x\\Outputs bl. x \\ set (get_outputs a)\"\n using 1 3 Cons(1) Cons.prems(2) list.set_intros(1) by auto\n have 5: \"set (get_outputs a) \\ set (get_outputs b) = {}\"\n using Cons(3) \n by (metis Cons.prems(1) One_nat_def Suc_less_eq length_Cons length_pos_if_in_set \n list.set_intros(1) list.set_intros(2) nth_Cons_0 nth_Cons_Suc of_nat_0 \n of_nat_0_le_iff zero_less_one)\n then show ?case using 4 by auto\n \nqed\n\nlemma Graph_Permutation: \"bl <~~> bl' \\ Graph (set bl) \\ Graph (set bl')\"\n unfolding Graph_def using prem_seteq by (metis perm_sym)\n\ntype_synonym sorted_block_list = \"block list\" \n\n(*Two blocks A and B, give the outputs of B, the inputs of A and the offsets of A(inputs)*)\nfun check_offset :: \"var list \\ var list \\ offset list \\ bool\" where\n\"check_offset [] il ol = False\" |\n\"check_offset vl il [] = False\" |\n\"check_offset vl il ol = (if ((set vl) \\ (set il) \\ {}) \\ (\\d \\ set ol. d = 0) then True \n else False)\"\n\n(*can also defined as a definition*)\nfun besorted :: \"block list \\ bool\" where\n\"besorted [] = True\" |\n\"besorted (b # bl) = (besorted bl \\ (\\ a. a \\ set bl \\ \n (check_offset (get_outputs a) (get_inputs b) (get_offsets b) ) = False))\"\n\nlemma besorted_remove1: \"besorted (a#bl) \\ besorted bl\"\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons b bl)\n then show ?case unfolding besorted.simps by meson\nqed\n\nlemma besorted_remove2: \"besorted bl \\ besorted (remove1 b bl)\"\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n have 1: \"besorted (remove1 b bl)\"\n using besorted_remove1 Cons by simp\n show ?case\n proof(cases \"a = b\")\n case True\n then show ?thesis using Cons(2) besorted_remove1 by (metis remove_hd)\n next\n case False\n have 2: \"besorted (remove1 b (a # bl)) = besorted (a#remove1 b bl)\"\n using False by simp\n have 3: \"\\x. x \\ set (remove1 b bl) \\ x \\ set bl\"\n by (meson notin_set_remove1)\n then show ?thesis using Cons(2) 2 unfolding besorted.simps using 1 by blast\n qed\nqed\n\nlemma besorted_last: \"besorted (bl@[a]) \\ (\\ b. b \\ set bl \\ \n (check_offset (get_outputs a) (get_inputs b) (get_offsets b)) = False)\"\nproof(induction bl)\n case Nil\n then show ?case by simp\nnext\n case (Cons b bl)\n have 1: \"\\b. b \\ set bl \\ check_offset (get_outputs a) (get_inputs b) (get_offsets b) = False\"\n using Cons by simp\n have 2: \"check_offset (get_outputs a) (get_inputs b) (get_offsets b) = False\"\n using Cons(2) by simp\n then show ?case using 1 by simp\nqed\n\n(*offset < 0 means we have all the inputs in the beginning of the execution cycle, so we remove them\nout of the in-degree and only keep those inputs where offset = 0*)\n\ndefinition get_block_indegree :: \"block \\ block list \\ var set\" where\n \"get_block_indegree b bl = (if 0 \\ set (get_offsets b) \\ (get_sample_time b = 0) then \n(set (get_inputs b) - set (get_outputs b)) \\ Outputs bl else {})\"\n\nlemma get_block_indegree_perm: \"bl <~~> bl' \\ get_block_indegree b bl = get_block_indegree b bl'\"\n unfolding get_block_indegree_def using Outputs_perm by presburger\n\n\ntype_synonym indegreeMap = \"block \\ var set\"\n\nfun get_indegrees :: \"block list \\ block list \\ indegreeMap \\ indegreeMap\" where\n \"get_indegrees [] bl f = f\" |\n \"get_indegrees (b#bl) cl f = get_indegrees bl cl (f(b := (get_block_indegree b cl)))\"\n\n(*give a block \"b\" and the deleted block list \"bl\", we delete the inputs from block \"b\"*)\nfun delete_block_indegree :: \"block \\ block list \\ indegreeMap \\ var set\" where\n \"delete_block_indegree b cl f = f b - (Outputs cl)\"\n\n(*the first block list \"bl\" is the remaining blocks and the second block list \"cl\" is the sorted blocks*)\nfun delete_indegrees :: \"block list \\ block list \\ indegreeMap \\ indegreeMap\" where\n \"delete_indegrees [] cl f = f\" |\n \"delete_indegrees (b#bl) cl f = delete_indegrees bl cl (f(b := (delete_block_indegree b cl f)))\"\n\n\nfun find_0indegree_blocks :: \"block list \\ block list \\ sorted_block_list \n \\ (block option \\ block list)\" where\n \"find_0indegree_blocks al [] cl = (None,[])\" |\n \"find_0indegree_blocks al (b#bl) cl = (let x = find_0indegree_blocks al bl cl in \n (if (get_block_indegree b al - (Outputs cl) = {}) then \n (Some b, bl) else (fst x, b#(snd x))))\"\n\nlemma length_find_0indegree: \"(fst (find_0indegree_blocks al bl cl)) \\ None \\ length (snd (find_0indegree_blocks al bl cl))\n < length bl\"\nproof (induction bl arbitrary: cl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a bl)\n then show ?case \n proof (cases \"(get_block_indegree a al - (Outputs cl) = {}) \")\n case True\n then show ?thesis using Cons True by auto\n next\n case False\n have 1: \"length (snd (find_0indegree_blocks al bl cl)) < length bl\"\n using Cons(1,2) False unfolding find_0indegree_blocks.simps by force\n have 2: \"length (snd (find_0indegree_blocks al (a # bl) cl)) = length (snd (find_0indegree_blocks al bl cl)) + 1\"\n unfolding find_0indegree_blocks.simps using False\n by (smt (verit, best) add.commute length_Cons plus_1_eq_Suc snd_conv)\n then show ?thesis using 1 by simp\n qed\nqed\n\nlemma find_0indegree_block_lemma : \"find_0indegree_blocks al bl cl = (Some b, dl) \\\n get_block_indegree b al - (Outputs cl) = {}\"\nproof(induction bl arbitrary: dl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n then show ?case unfolding find_0indegree_blocks.simps\n proof(cases \"get_block_indegree a al - Outputs cl = {}\")\n case True\n then show ?thesis using Cons(2) unfolding find_0indegree_blocks.simps by simp\n next\n case False\n have 1: \"find_0indegree_blocks al bl cl = (Some b, (remove1 a dl))\"\n using Cons(2) unfolding find_0indegree_blocks.simps apply simp\n by (smt (verit) False diff_shunt_var fst_eqD prod.exhaust_sel remove_hd snd_eqD)\n then show ?thesis using Cons(1) by simp\n qed\nqed\n\nlemma find_0indegree_block_lemma2 : \"find_0indegree_blocks al bl cl = (Some b, dl) \\\n dl = (remove1 b bl)\"\nproof(induction bl arbitrary: dl)\n case Nil\n then show ?case by simp\nnext\n case (Cons a bl)\n then show ?case unfolding find_0indegree_blocks.simps\n proof(cases \"get_block_indegree a al - Outputs cl = {}\")\n case True\n then show ?thesis using Cons(2) unfolding find_0indegree_blocks.simps by simp\n next\n case False\n have 1: \"find_0indegree_blocks al bl cl = (Some b, (remove1 a dl))\"\n using Cons(2) unfolding find_0indegree_blocks.simps apply simp\n by (smt (verit) False diff_shunt_var fst_eqD prod.exhaust_sel remove_hd snd_eqD)\n have 2: \"hd dl = a\"\n using Cons(2) unfolding find_0indegree_blocks.simps apply simp\n by (smt (verit, best) False diff_shunt_var list.sel(1) snd_conv)\n have 3: \"dl = a # tl dl\"\n using 2 1 Cons.prems False list.exhaust_sel by auto\n have 4: \"(remove1 a dl) = remove1 b bl\"\n using Cons(1) 1 by simp\n then show ?thesis using Cons(1) 3 by (metis \"1\" False find_0indegree_block_lemma remove1.simps(2))\n qed\nqed\n\nlemma find_0indegree_lemma4: \"(fst (find_0indegree_blocks al bl cl)) \\ None \\ \nlength (snd (find_0indegree_blocks al bl cl))+1 = length bl\"\nproof (induction bl arbitrary: cl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a bl)\n then show ?case \n proof (cases \"(get_block_indegree a al - (Outputs cl) = {}) \")\n case True\n then show ?thesis using Cons True by auto\n next\n case False\n have 1: \"length (snd (find_0indegree_blocks al bl cl))+1 = length bl\"\n using Cons(1,2) False unfolding find_0indegree_blocks.simps by force\n have 2: \"length (snd (find_0indegree_blocks al (a # bl) cl)) = length (snd (find_0indegree_blocks al bl cl)) + 1\"\n unfolding find_0indegree_blocks.simps using False\n by (smt (verit, best) add.commute length_Cons plus_1_eq_Suc snd_conv)\n then show ?thesis using 1 by simp\n qed\nqed\n\nlemma find_0indegree_lemma3: \"(fst (find_0indegree_blocks al bl cl)) \\ None \n\\ set (the (fst (find_0indegree_blocks al bl cl))#(snd (find_0indegree_blocks al bl cl)))\n = set bl\"\nproof (induction bl)\n case Nil\n then show ?case by auto\nnext\n case (Cons a bl)\n then show ?case \n proof (cases \"(get_block_indegree a al - (Outputs cl) = {}) \")\n case True\n then show ?thesis using Cons True by auto\n next\n case False\n have 1: \"fst (find_0indegree_blocks al bl cl) \\ None\"\n using Cons(2) unfolding find_0indegree_blocks.simps using False by auto\n have 2: \"set (the (fst (find_0indegree_blocks al bl cl)) # \n snd (find_0indegree_blocks al bl cl)) = set bl\"\n using Cons(1) 1 by simp\n have 3: \"the (fst (let x = find_0indegree_blocks al bl cl\n in if get_block_indegree a al - Outputs cl = {} then (Some a, bl)\n else (fst x, a # snd x))) = the (fst (find_0indegree_blocks al bl cl))\"\n using False by (smt (verit, best) fst_conv)\n have 4: \"snd (let x = find_0indegree_blocks al bl cl\n in if get_block_indegree a al - Outputs cl = {} then (Some a, bl)\n else (fst x, a # snd x)) = a#(snd (find_0indegree_blocks al bl cl))\"\n using False by (smt (verit, best) snd_conv)\n have 5: \"set (the (fst (let x = find_0indegree_blocks al bl cl\n in if get_block_indegree a al - Outputs cl = {} then (Some a, bl)\n else (fst x, a # snd x))) #\n snd (let x = find_0indegree_blocks al bl cl\n in if get_block_indegree a al - Outputs cl = {} then (Some a, bl)\n else (fst x, a # snd x))) = set (the (fst (find_0indegree_blocks al bl cl))#\n (a#(snd (find_0indegree_blocks al bl cl))))\"\n using 3 4 by presburger\n have 6: \"set (the (fst (find_0indegree_blocks al bl cl)) # (a#(snd (find_0indegree_blocks al bl cl)))) \n = set (a#bl)\"\n using 2 by auto\n then show ?thesis unfolding find_0indegree_blocks.simps using 5 by auto\n qed\nqed\n\n\n\nfunction topological_sort :: \"block list \\ block list \\ sorted_block_list \\ sorted_block_list\" where\n\"topological_sort al bl cl = (let x = (find_0indegree_blocks al bl cl) in \n (if (fst x = None) then cl else\n (topological_sort al (snd x) (cl@[the (fst x)]))))\"\n by pat_completeness auto \n\ntermination \n apply (relation \"measures[(\\(a::block list, b::block list, c::block list). length b)]\", auto)\n subgoal for al bl cl\n using length_find_0indegree[of al bl cl] \n by auto\n done\n \nlemma \"topological_sort [] [] [] = []\"\n using topological_sort.psimps by auto\n\ndefinition besorted_change:: \"block list \\ bool\"\n where \"besorted_change dl = (\\ i j. (i j < (length dl) \\ j \\ 0) \\ \n (check_offset (get_outputs (dl ! j)) (get_inputs (dl ! i)) (get_offsets (dl ! i))) = False)\"\n\nlemma besorted_equiv: \"besorted dl \\ besorted_change dl\"\nproof(induction dl)\n case Nil\n then show ?case unfolding besorted_change_def by simp\nnext\n case (Cons d dl)\n have 1: \"besorted (d # dl) \\ besorted_change (d # dl)\"\n unfolding besorted_change_def besorted.simps apply clarify\n subgoal premises pre for i j\n proof(cases \"i = 0\")\n case True\n then show ?thesis apply simp using pre(2,3,4,5) by simp\n next\n case False\n have tmp1: \"i > 0 \\ i < length (d # dl)\"\n using pre False by simp\n then show ?thesis using Cons pre(1,3,4,5) unfolding besorted_change_def\n using less_Suc_eq_0_disj by force\n qed\n done\n have 2: \"besorted_change (d # dl) \\ besorted (d # dl)\"\n subgoal premises pre\n proof -\n have tmp1: \"besorted_change dl\" \n using pre unfolding besorted_change_def\n by (metis Suc_less_eq length_Cons nth_Cons_Suc zero_le)\n have tmp2: \"besorted dl\"\n using Cons tmp1 by simp\n have tmp3: \"\\a. a \\ set dl \\ check_offset (get_outputs a) (get_inputs d) (get_offsets d) = False\"\n using pre unfolding besorted_change_def by (metis Suc_leI bot_nat_0.extremum in_set_conv_nth \n le_imp_less_Suc length_Cons nth_Cons_0 nth_Cons_Suc)\n show ?thesis unfolding besorted.simps using tmp2 tmp3 by simp\n qed\n done\n then show ?case using 1 by blast\nqed\n\ndefinition after_0indegree :: \"block list \\ block list \\ bool\" where\n\"after_0indegree al bl = (\\ i. (i \\ 0 \\ i < length bl) \\ (get_block_indegree (bl ! i) al - (Outputs (take i bl)) = {}))\"\n\nlemma topo_besorted: \"topological_sort al bl cl = dl \\ after_0indegree al cl\n \\ besorted_change cl \\ Outputs al = Outputs bl \\ Outputs cl \\\n \\i j. i\\ set bl \\ j \\ set cl \\ \n check_offset (get_outputs i) (get_inputs j) (get_offsets j) = False \\ Unique (bl@cl)\n \\ Graph (set (bl@cl)) \\ besorted_change dl\"\nproof (induction bl arbitrary: cl dl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n case 1\n then show ?case unfolding wf_def\n by (metis case_prodD length_induct mem_Collect_eq) \nnext\n case (2 x)\n then show ?case\n proof (induction x arbitrary: cl dl)\n case Nil\n then show ?case using topological_sort.psimps by auto\n next\n case (Cons a bl)\n then show ?case using topological_sort.psimps[of al \"a#bl\" cl]\n proof (cases \"fst (find_0indegree_blocks al (a # bl) cl) = None\")\n case True\n then show ?thesis using Cons topological_sort.psimps[of al \"a#bl\" cl] by auto\n next\n case False\n note FF = False\n then show ?thesis using Cons\n proof (cases \" (get_block_indegree a al - (Outputs cl) = {})\")\n case True\n note FT = True\n have 1: \"(find_0indegree_blocks al (a # bl) cl) = (Some a, bl)\"\n using True unfolding find_0indegree_blocks.simps by simp\n have 2: \"topological_sort al (a # bl) cl = topological_sort al bl (cl@[a])\"\n using 1 topological_sort.psimps[of al \"a#bl\" cl] by simp\n have 3: \"topological_sort al bl (cl@[a]) = dl\"\n using 2 Cons(3) by simp\n have \"besorted_change (cl@[a])\" \n proof -\n have tmp1: \"\\b \\ set cl.\n check_offset (get_outputs a) (get_inputs b) (get_offsets b) = False\"\n using Cons(7) by auto\n show ?thesis using Cons(5) tmp1 unfolding after_0indegree_def besorted_change_def\n by (simp add: nth_append)\n qed\n moreover have \"after_0indegree al (cl@[a])\" using Cons(4,3) True unfolding after_0indegree_def\n by (simp add: nth_append)\n moreover have \"(bl, a # bl) \\ {a. case a of (x, y) \\ length x < length y}\"\n by auto\n moreover have \" Outputs al = Outputs bl \\ Outputs (cl @ [a])\" using Cons(6) \n using Outputs.simps(2) Outputs_base by blast\n moreover have \"\\i j. i \\ set bl \\ j \\ set (cl @ [a]) \\\n check_offset (get_outputs i) (get_inputs j) (get_offsets j) = False\" \n proof -\n have tmp1: \"0 \\ set (get_offsets a) \\ \\i. i \\ set bl \\\n check_offset (get_outputs i) (get_inputs a) (get_offsets a) = False\"\n by (metis (mono_tags, opaque_lifting) check_offset.elims(2))\n have tmp2: \"Outputs bl \\ Outputs cl = {}\"\n proof -\n have tmp1: \"Unique (bl @ cl)\"\n using Cons(8) Unique_lemma by simp\n have tmp2: \"Graph (set (bl@cl))\"\n using Cons(9) Graph_lemma by (metis Cons_eq_appendI)\n show ?thesis using tmp1 tmp2 apply simp\n proof(induction bl)\n case Nil\n then show ?case by simp\n next\n case (Cons b bl)\n have tmp1: \"set (get_outputs b) \\ Outputs cl = {}\"\n proof -\n have \"Graph (set (b#cl))\"\n using Cons(3) unfolding Graph_def by auto\n moreover have \"\\j. j < (length cl) \\ j \\ 0 \\ b \\ (nth cl j)\"\n proof -\n have tmp1: \"\\j. j < (length (bl@cl)) \\ j \\ 0 \\ b \\ (nth (bl@cl) j)\"\n using Cons(2) unfolding Unique_def by force\n then show ?thesis by (metis UnI2 in_set_conv_nth set_append zero_le)\n qed\n ultimately show ?thesis apply simp\n proof(induction cl)\n case Nil\n then show ?case by simp\n next\n case (Cons c cl)\n have tmp1: \"set (get_outputs b) \\ Outputs cl = {}\"\n using Cons unfolding Graph_def \n by (metis in_set_conv_nth insert_iff list.simps(15))\n have tmp2: \"b \\ c\"\n using Cons(3) by auto\n have tmp3: \"set (get_outputs b) \\ set (get_outputs c) = {}\"\n using Cons(2) tmp2 unfolding Graph_def \n by (meson insertI1 insertI2 list.set_intros(1))\n then show ?case using tmp1 by auto\n qed\n qed\n have tmp2: \"Graph (set bl \\ set cl)\"\n using Cons(3) unfolding Graph_def by simp\n have tmp3: \"Unique (bl @ cl)\"\n using Cons(2) Unique_lemma by simp\n have tmp4: \"Outputs bl \\ Outputs cl = {}\"\n using tmp2 tmp3 Cons(1) by simp\n then show ?case unfolding Outputs.simps using tmp1 by auto\n qed\n qed\n have tmp3_1: \"set (get_outputs a) \\ (Outputs bl) = {}\"\n using Cons(8,9) unfolding Unique_def Graph_def\n by (smt (verit) Cons.prems(7) Graph_def Graph_lemma2 UnI1 Unique_Cons2 \n disjoint_iff_not_equal set_append)\n have tmp3_2: \"set (get_outputs a) \\ (Outputs cl) = {}\"\n using Cons(8,9)\n proof(induction cl)\n case Nil\n then show ?case by simp\n next\n case (Cons c cl)\n have tmp1: \"remove1 c ((a # bl) @ c # cl) = (a#bl)@cl\"\n using Cons(2) unfolding Unique_def\n by (metis Cons.prems(1) Un_iff Unique_k bot_nat_0.extremum in_set_conv_nth \n list.set_intros(1) remove1_append remove_hd set_append)\n have tmp2: \"Unique ((a # bl) @ cl)\"\n using Cons(2) Unique_remove tmp1 by (metis remove1_idem)\n have tmp3: \"set (get_outputs a) \\ Outputs cl = {}\"\n using Cons(1,3) tmp2 unfolding Graph_def by auto\n have tmp4: \"set (get_outputs a) \\ set (get_outputs c) = {}\"\n using Cons(2,3) unfolding Unique_def Graph_def \n by (metis Cons.prems(1) Unique_k append_Cons bot_nat_0.extremum in_set_conv_decomp \n length_Cons list.set_intros(1) nth_Cons_0 tmp1 zero_less_Suc)\n then show ?case using tmp3 unfolding Outputs.simps by auto\n qed\n have tmp3: \"0 \\ set (get_offsets a) \\ set (get_inputs a) \\ (Outputs bl) = {}\"\n using Cons(6) tmp2 FT tmp3_1 tmp3_2 unfolding get_block_indegree_def Outputs.simps by auto\n have tmp4: \"0 \\ set (get_offsets a) \\ \\i. i \\ set bl \\\n check_offset (get_outputs i) (get_inputs a) (get_offsets a) = False\"\n apply clarify subgoal premises pre for i \n proof(cases \"(get_outputs i) = []\")\n case True\n then show ?thesis by simp\n next\n case False\n have 1: \"(get_outputs i) = hd (get_outputs i) # tl (get_outputs i)\"\n using False by simp\n then show ?thesis\n proof(cases \"(get_offsets a) = []\")\n case True\n then show ?thesis using 1 pre(1) by fastforce\n next\n case False\n have 2: \"(get_offsets a) = (hd (get_offsets a)) # (tl (get_offsets a))\"\n using False by simp\n then show ?thesis using check_offset.simps(3)[of \"hd (get_outputs i)\" \n \"tl (get_outputs i)\" \"(get_inputs a)\" \"hd (get_offsets a)\" \n \"tl (get_offsets a)\"] 1 tmp3 pre Outputs_base2 by auto\n qed\n qed\n done\n show ?thesis using FT Cons(7) tmp1 tmp4 unfolding get_block_indegree_def\n using insert_iff list.set(2) set_append by auto\n qed\n moreover have \"Unique (bl @ cl @ [a])\"\n proof -\n have tmp1: \"\\j. j < (length (bl@cl)) \\ j \\ 0 \\ a \\ (nth (bl@cl) j)\"\n using Cons(8) unfolding Unique_def by (metis Suc_leI append_Cons \n le_imp_less_Suc le_zero_eq length_Cons nth_Cons_0 nth_Cons_Suc)\n then show ?thesis using Unique_lemma Cons(8) Unique_add2\n by (metis append.assoc append_Cons)\n qed\n moreover have \"Graph (set (bl @ cl @ [a]))\" using Cons(9) by simp\n ultimately show ?thesis using Cons(1)[of \"cl@[a]\" dl] Cons(2) 3 by metis\n next\n case False\n have 1: \"\\c. fst (find_0indegree_blocks al (a # bl) cl) = Some c\"\n using FF by simp\n show ?thesis using 1 apply clarify\n subgoal premises pre for c\n proof -\n have 2: \"get_block_indegree c al - Outputs cl = {}\"\n using find_0indegree_block_lemma pre by (metis prod.collapse)\n have 3: \"snd (find_0indegree_blocks al (a # bl) cl) = remove1 c (a#bl)\"\n using pre find_0indegree_block_lemma2 by (metis prod.exhaust_sel)\n have 4: \"topological_sort al (a # bl) cl = topological_sort al (remove1 c (a#bl)) (cl@[c])\"\n using topological_sort.psimps[of al \"a#bl\" cl] pre 3 by simp\n have 5: \"topological_sort al (remove1 c (a#bl)) (cl@[c]) = dl\"\n using 4 Cons(3) by simp\n have 6: \"c \\ set (a#bl)\"\n by (metis \"3\" FF length_find_0indegree less_irrefl_nat remove1_idem)\n have 7: \"(remove1 c (a#bl), a # bl) \\ {a. case a of (x, y) \\ length x < length y}\"\n by (metis \"3\" FF case_prodI length_find_0indegree mem_Collect_eq)\n have 8: \"besorted_change (cl@[c])\" \n proof -\n have tmp1: \"\\b \\ set cl.\n check_offset (get_outputs c) (get_inputs b) (get_offsets b) = False\"\n using Cons(7) 6 by auto\n show ?thesis using Cons(5) tmp1 unfolding after_0indegree_def besorted_change_def\n by (simp add: nth_append)\n qed\n have 9: \"after_0indegree al (cl@[c])\" using Cons(4,3) 2 unfolding after_0indegree_def\n by (simp add: nth_append)\n have 10: \" Outputs al = Outputs (remove1 c (a#bl)) \\ Outputs (cl @ [c])\" using Cons(6) \n using Outputs.simps(2) Outputs_base2 6 Outputs_base by auto\n have 11: \"\\i j. i \\ set (remove1 c (a#bl)) \\ j \\ set (cl @ [c]) \\\n check_offset (get_outputs i) (get_inputs j) (get_offsets j) = False\"\n proof -\n have tmp1: \"0 \\ set (get_offsets c) \\ \\i. i \\ set (remove1 c (a#bl)) \\\n check_offset (get_outputs i) (get_inputs c) (get_offsets c) = False\"\n by (metis (mono_tags, opaque_lifting) check_offset.elims(2))\n have tmp2: \"Outputs bl \\ Outputs cl = {}\"\n proof -\n have tmp1: \"Unique (bl @ cl)\"\n using Cons(8) Unique_lemma by simp\n have tmp2: \"Graph (set (bl@cl))\"\n using Cons(9) Graph_lemma by (metis Cons_eq_appendI)\n show ?thesis using tmp1 tmp2 apply simp\n proof(induction bl)\n case Nil\n then show ?case by simp\n next\n case (Cons b bl)\n have tmp1: \"set (get_outputs b) \\ Outputs cl = {}\"\n proof -\n have \"Graph (set (b#cl))\"\n using Cons(3) unfolding Graph_def by auto\n moreover have \"\\j. j < (length cl) \\ j \\ 0 \\ b \\ (nth cl j)\"\n proof -\n have tmp1: \"\\j. j < (length (bl@cl)) \\ j \\ 0 \\ b \\ (nth (bl@cl) j)\"\n using Cons(2) unfolding Unique_def by force\n then show ?thesis by (metis UnI2 in_set_conv_nth set_append zero_le)\n qed\n ultimately show ?thesis apply simp\n proof(induction cl)\n case Nil\n then show ?case by simp\n next\n case (Cons c cl)\n have tmp1: \"set (get_outputs b) \\ Outputs cl = {}\"\n using Cons unfolding Graph_def \n by (metis in_set_conv_nth insert_iff list.simps(15))\n have tmp2: \"b \\ c\"\n using Cons(3) by auto\n have tmp3: \"set (get_outputs b) \\ set (get_outputs c) = {}\"\n using Cons(2) tmp2 unfolding Graph_def \n by (meson insertI1 insertI2 list.set_intros(1))\n then show ?case using tmp1 by auto\n qed\n qed\n have tmp2: \"Graph (set bl \\ set cl)\"\n using Cons(3) unfolding Graph_def by simp\n have tmp3: \"Unique (bl @ cl)\"\n using Cons(2) Unique_lemma by simp\n have tmp4: \"Outputs bl \\ Outputs cl = {}\"\n using tmp2 tmp3 Cons(1) by simp\n then show ?case unfolding Outputs.simps using tmp1 by auto\n qed\n qed\n have tmp3: \"set (get_outputs a) \\ Outputs cl = {}\"\n proof -\n have tmp1: \"\\j. j < (length cl) \\ j \\ 0 \\ a \\ (nth cl j)\"\n proof -\n have \"\\j. j < (length (bl@cl)) \\ j \\ 0 \\ a \\ (nth (bl@cl) j)\"\n using Cons(8) unfolding Unique_def by force\n then show ?thesis by (metis UnI2 in_set_conv_nth set_append zero_le)\n qed\n have \"Unique (a#cl)\"\n using Cons(8) Unique_Cons Unique_add tmp1 by metis\n moreover have \"Graph (set (a#cl))\"\n using Cons(9) unfolding Graph_def\n by (metis UnCI UnI1 list.set_intros(1) set_ConsD set_append)\n ultimately show ?thesis apply simp\n proof(induction cl)\n case Nil\n then show ?case by simp\n next\n case (Cons c cl)\n have tmp1: \"a \\ c\"\n using Cons(2) unfolding Unique_def by (metis Cons.prems(1) Unique_k \n length_greater_0_conv list.set_intros(1) neq_Nil_conv nth_Cons_0 remove_hd zero_le)\n have tmp2: \"Unique (a # cl)\"\n using tmp1 Unique_remove Cons(2) by force\n have tmp3: \"Graph (insert a (set cl))\"\n using Cons(3) unfolding Graph_def tmp1 by simp\n have tmp4: \"set (get_outputs a) \\ Outputs cl = {}\"\n using Cons(1) tmp2 tmp3 by simp\n have tmp5: \"set (get_outputs a) \\ set (get_outputs c) = {}\"\n using Cons(3) unfolding Graph_def\n by (metis insert_iff list.simps(15) tmp1)\n then show ?case using tmp4 unfolding Outputs.simps by auto\n qed\n qed\n have tmp4_1: \"set (get_outputs c) \\ Outputs cl = {}\"\n using Cons(8,9) unfolding Unique_def Graph_def \n by (metis \"6\" Outputs_base2 UnCI disjoint_iff_not_equal set_ConsD tmp2 tmp3)\n have tmp4_2: \"set (get_outputs c) \\ (Outputs (remove1 c (a#bl))) = {}\" \n using 6 Cons(8,9)\n proof(induction bl)\n case Nil\n then show ?case by auto\n next\n case (Cons b bl)\n then show ?case\n proof(cases \"c = b\")\n case True\n have tmp1: \"remove1 c (a # b # bl) = a#bl\"\n using Cons(3) unfolding Unique_def True by simp\n have tmp2: \"Unique (b # bl)\"\n using Cons(3) Unique_lemma by (metis Unique_Cons2)\n have tmp3: \"Graph (set (b # bl))\"\n using Cons(4) unfolding Graph_def \n by (metis UnI1 list.set_intros(2) set_append)\n have tmp4: \"set (get_outputs c) \\ Outputs bl = {}\"\n using tmp2 tmp3 True\n proof(induction bl)\n case Nil\n then show ?case by simp\n next\n case (Cons d bl)\n have tmp1: \"Unique (b#bl)\"\n using Cons(2) unfolding Unique_def\n by (metis (no_types, lifting) Unique_def Unique_remove list.set_intros(1) \n remove1.simps(2) set_subset_Cons subset_code(1))\n have tmp2: \"Graph (set (b # bl))\"\n using Cons(3) unfolding Graph_def by auto\n have tmp3: \"set (get_outputs c) \\ Outputs bl = {}\"\n using Cons(1,4) tmp1 tmp2 by simp\n then show ?case unfolding Outputs.simps using Cons(2,3) unfolding Unique_def Graph_def\n by (metis Cons.prems(1) Cons.prems(2) Graph_lemma2 Int_emptyI Outputs.simps(2) True)\n qed\n then show ?thesis using True tmp1 \n using \"2\" Cons.prems(3) False Graph_def list.set_intros(1) set_append by auto\n next\n case False\n note F1 = False\n have tmp1: \"c \\ set (a # bl)\"\n using Cons(2) False by auto\n have tmp2: \"Unique ((a # bl) @ cl)\"\n using Cons(3) unfolding Unique_def\n by (smt (z3) Suc_leI add_diff_cancel_left' append_Cons bot_nat_0.extremum \n le_imp_less_Suc length_Cons less_Suc_eq nth_Cons_0 nth_Cons_pos plus_1_eq_Suc)\n have tmp3: \"set (get_outputs c) \\ Outputs (remove1 c (a # bl)) = {}\"\n using Cons(1,4) tmp1 tmp2 unfolding Graph_def by auto\n have tmp4: \"set (get_outputs c) \\ set (get_outputs b) = {}\"\n using False Cons(4) unfolding Graph_def\n by (metis Cons.prems(1) Un_iff list.set_intros(1) notin_set_remove1 remove_hd set_append)\n then show ?thesis using False\n proof(cases \"c = a\")\n case True\n then show ?thesis using tmp3 tmp4 by auto\n next\n case False\n then show ?thesis using F1 tmp3 tmp4 by auto\n qed\n qed\n qed\n have tmp4: \"0 \\ set (get_offsets c) \\ \n set (get_inputs c) \\ (Outputs (remove1 c (a#bl))) = {}\"\n using Cons(6) 2 tmp2 tmp3 tmp4_1 tmp4_2 unfolding get_block_indegree_def\n by (smt (verit, ccfv_threshold) \"6\" Diff_Int_distrib2 Diff_iff Int_iff Outputs.simps(2)\n Outputs_base2 UnCI Un_iff disjoint_iff_not_equal empty_iff)\n have tmp5: \"0 \\ set (get_offsets c) \\ \\i. i \\ set (remove1 c (a#bl)) \\\n check_offset (get_outputs i) (get_inputs c) (get_offsets c) = False\"\n apply clarify subgoal premises pre for i \n proof(cases \"(get_outputs i) = []\")\n case True\n then show ?thesis by simp\n next\n case False\n have 1: \"(get_outputs i) = hd (get_outputs i) # tl (get_outputs i)\"\n using False by simp\n then show ?thesis\n proof(cases \"(get_offsets c) = []\")\n case True\n then show ?thesis using 1 pre(1) by fastforce\n next\n case False\n have 2: \"(get_offsets c) = (hd (get_offsets c)) # (tl (get_offsets c))\"\n using False by simp\n then show ?thesis using check_offset.simps(3)[of \"hd (get_outputs i)\" \n \"tl (get_outputs i)\" \"(get_inputs c)\" \"hd (get_offsets c)\" \n \"tl (get_offsets c)\"] 1 tmp4 pre Outputs_base2 by auto\n qed\n qed\n done\n show ?thesis using tmp1 tmp5 Cons(7)\n by (metis Un_iff empty_iff list.set(1) notin_set_remove1 set_ConsD set_append)\n qed\n have 12: \"Unique ((remove1 c (a#bl)) @ cl @ [c])\"\n proof -\n have tmp1: \"c \\ set ((a # bl) @ cl)\"\n using 6 by auto\n have tmp2: \"(remove1 c (a#bl)) @ cl = remove1 c ((a#bl)@ cl)\"\n using 6by (metis remove1_append)\n have tmp3: \"\\j. j < (length ((remove1 c (a#bl)) @ cl)) \\ j \\ 0 \\ c \\ (nth ((remove1 c (a#bl)) @ cl) j)\"\n using Cons(8) tmp1 Unique_k tmp2 by metis\n have tmp4: \"Unique ((remove1 c (a#bl)) @ cl)\"\n using Cons(8) Unique_remove tmp1 by (metis tmp2)\n then show ?thesis using tmp3 Unique_add2 by (metis append.assoc)\n qed\n have 13: \"Graph (set ((remove1 c (a#bl)) @ cl @ [c]))\"\n proof -\n have tmp1: \"set ((remove1 c (a#bl))@[c]) = set (a#bl)\"\n proof -\n have \"\\x \\ set ((remove1 c (a#bl))@[c]) . x \\ set (a#bl)\"\n apply clarify subgoal for x using 6\n by (metis Un_iff empty_iff in_set_remove1 list.set(1) remove_hd set_append)\n done\n moreover have \"\\x \\ set (a#bl). x \\ set ((remove1 c (a#bl))@[c])\"\n apply clarify subgoal for x using 6\n by (metis Un_iff in_set_remove1 list.set_intros(1) set_append)\n done\n ultimately show ?thesis by auto\n qed\n have tmp2: \"set ((remove1 c (a#bl)) @ cl @ [c]) = set ((a # bl) @ cl)\"\n using tmp1 using inf_sup_aci(7) by auto\n then show ?thesis using Cons(9) by simp\n qed\n show ?thesis using Cons(2) 7 5 8 9 10 11 12 13 by blast\n qed\n done\n qed\n qed\n qed\nqed\n\n definition sortDiag :: \"block list \\ sorted_block_list\" where\n\"sortDiag bl = topological_sort bl bl []\"\n\n\ndefinition \"loop_free bl = (length (sortDiag bl) = length bl)\"\n\ndeclare loop_free_def [simp]\n\nlemma sort_is_sorted : \"Unique bl \\ Graph (set bl) \\ besorted (sortDiag bl)\"\n subgoal premises pre\nproof -\n have 1: \"after_0indegree bl []\"\n unfolding after_0indegree_def get_block_indegree_def by simp\n have 2: \"besorted_change []\"\n unfolding besorted_change_def by simp\n have 3: \"Outputs bl = Outputs bl \\ Outputs []\"\n by simp\n have 4: \"\\i j. i \\ set bl \\ j \\ set [] \\\n check_offset (get_outputs i) (get_inputs j) (get_offsets j) = False\"\n by simp\n show ?thesis\n using topo_besorted[of bl bl \"[]\"] unfolding sortDiag_def using 1 2 3 4 pre(1,2)\n using besorted_equiv by simp\nqed\n done\n\nlemma sort_subset: \"length (topological_sort al bl cl) = length (bl@cl) \\\nset (bl@cl) = set (topological_sort al bl cl)\"\nproof(induction bl arbitrary: cl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n case 1\n then show ?case unfolding wf_def\n by (metis (no_types, lifting) case_prodD length_induct mem_Collect_eq)\nnext\n case (2 bl)\n then show ?case\n proof(cases \"bl = []\")\n case True\n then show ?thesis by simp\n next\n case False\n have 3: \"length (snd (find_0indegree_blocks al bl cl)) < length bl\"\n using 2(2) unfolding loop_free_def sortDiag_def using topological_sort.simps[of al bl cl]\n by (smt (verit) False append_Nil append_eq_append_conv length_find_0indegree)\n have 4: \"topological_sort al bl cl = (let x = find_0indegree_blocks al bl cl in \n topological_sort al (snd x) (cl @ [the (fst x)]))\"\n using topological_sort.simps[of al bl cl] 2(2) False\n by (smt (verit) append.left_neutral append_eq_append_conv)\n have 5: \"fst (find_0indegree_blocks al bl cl) \\ None\"\n using 4 topological_sort.simps[of al bl cl] \"2.prems\" False append_eq_append_conv2 by fastforce\n have 6: \"length (bl@cl) = length (let x = find_0indegree_blocks al bl cl in \n ((snd x)@(cl @ [the (fst x)])))\"\n using find_0indegree_lemma4 5 by force\n have 7: \"(let x = find_0indegree_blocks al bl cl in length \n (topological_sort al (snd x) (cl @ [the (fst x)])) = length ((snd x)@(cl @ [the (fst x)])))\"\n using 2(2) 4 6 by metis\n have 8: \"set (bl) = set (let x = find_0indegree_blocks al bl cl in \n ((snd x)@([the (fst x)])))\"\n using 5 find_0indegree_lemma3 by (metis append_Cons append_Nil inf_sup_aci(5) set_append)\n have 9: \"set (bl @ cl) = set (let x = find_0indegree_blocks al bl cl in \n ((snd x)@(cl@[the (fst x)])))\"\n using 8 by (metis append_assoc inf_sup_aci(5) set_append)\n then show ?thesis using 2(1) 3 6 4 7 by (metis case_prodI mem_Collect_eq)\n qed\nqed\n\nlemma toposort_perm: \"length (topological_sort al bl cl) = length (bl@cl) \\\n(bl@cl) <~~> (topological_sort al bl cl)\"\nproof(induction bl arbitrary: cl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n case 1\n then show ?case unfolding wf_def\n by (metis (no_types, lifting) case_prodD length_induct mem_Collect_eq)\nnext\n case (2 bl)\n then show ?case\n proof(cases \"bl = []\")\n case True\n then show ?thesis by simp\n next\n case False\n have 3: \"length (snd (find_0indegree_blocks al bl cl)) < length bl\"\n using 2(2) unfolding loop_free_def sortDiag_def using topological_sort.simps[of al bl cl]\n by (smt (verit) False append_Nil append_eq_append_conv length_find_0indegree)\n have 4: \"topological_sort al bl cl = (let x = find_0indegree_blocks al bl cl in \n topological_sort al (snd x) (cl @ [the (fst x)]))\"\n using topological_sort.simps[of al bl cl] 2(2) False\n by (smt (verit) append.left_neutral append_eq_append_conv)\n have 5: \"fst (find_0indegree_blocks al bl cl) \\ None\"\n using 4 topological_sort.simps[of al bl cl] \"2.prems\" False append_eq_append_conv2 by fastforce\n have 6: \"length (bl@cl) = length (let x = find_0indegree_blocks al bl cl in \n ((snd x)@(cl @ [the (fst x)])))\"\n using find_0indegree_lemma4 5 by force\n have 7: \"length (let x = find_0indegree_blocks al bl cl in snd x @ cl @ [the (fst x)]) = \n length (let x = find_0indegree_blocks al bl cl in topological_sort al (snd x) (cl @ [the (fst x)]))\"\n using 4 6 2(2) by presburger\n have 8: \"(let x = find_0indegree_blocks al bl cl in \n (topological_sort al (snd x) (cl @ [the (fst x)])) <~~> ((snd x)@(cl @ [the (fst x)])))\"\n using 2(1) 3 7 by (metis case_prodI mem_Collect_eq perm_sym)\n have 9: \"(bl@cl) <~~> (let x = find_0indegree_blocks al bl cl in \n ((snd x)@(cl @ [the (fst x)])))\"\n using find_0indegree_block_lemma2 find_0indegree_lemma4 5 perm_remove3 by (smt (verit, \n del_insts) find_0indegree_lemma3 list.set_intros(1) option.collapse prod.exhaust_sel)\n then show ?thesis using 4 8 by (metis perm.trans perm_sym)\n qed\nqed\n\nlemma sort_perm: \"loop_free bl \\ bl <~~> sortDiag bl\"\n using toposort_perm unfolding loop_free_def sortDiag_def\n by (metis append.right_neutral)\n\ntype_synonym timed_vars = \"var \\ real \\ real\"\n\ntype_synonym behav = \"timed_vars \\ bool\"\n\ndefinition \"internal bl = {x . (\\ A \\ set bl . \\ B \\ set bl . x \\ set (get_outputs A) \\ x \\ set (get_inputs B))}\"\n\n\\ \\remove those vars in s in order to find the inputs and outputs for a diagram\\\nprimrec remove_set :: \"var set \\ var list \\ var list\" where \n\"remove_set s [] = []\" |\n\"remove_set s (v#vl) = (if (v \\ s) then remove_set s vl else (v # remove_set s vl))\"\n\nprimrec in_blocklist :: \"var set \\ block list \\ var list\" where\n\"in_blocklist vs [] = []\" |\n\"in_blocklist vs (b#bl) = (remove_set vs (get_inputs b)) @ (in_blocklist vs bl)\"\n\n\\ \\The input vars of a diagram\\\ndefinition in_diag :: \"block list \\ var list\" where \n\"in_diag bl = in_blocklist (internal bl) bl\"\n\nprimrec out_blocklist :: \"var set \\ block list \\ var list\" where\n\"out_blocklist vs [] = []\" |\n\"out_blocklist vs (b#bl) = (remove_set vs (get_outputs b)) @ (out_blocklist vs bl)\"\n\n\\ \\The output vars of a digram\\\ndefinition out_diag :: \"block list \\ var list\" where \n\"out_diag bl = out_blocklist (internal bl) bl\"\n\ndefinition connected_blocks :: \"block \\ block \\ bool\" where\n\"connected_blocks a b = (if (set (get_outputs a) \\ set (get_inputs b) \\ {}) \\ (set (get_outputs b) \\ set (get_inputs a) \\ {})\n then True else False)\"\n\n\\ \\get those blocks whose sample_time = -1 \\\nprimrec get_inherited_blocks :: \"block list \\ block list\" where\n\"get_inherited_blocks [] = []\" |\n\"get_inherited_blocks (b#bl) = (if (get_sample_time b = -1) then (b#(get_inherited_blocks bl)) else (get_inherited_blocks bl))\"\n\n\\ \\get those blocks whose sample_time \\ -1 \\\nprimrec get_definite_blocks :: \"block list \\ block list\" where\n\"get_definite_blocks [] = []\" |\n\"get_definite_blocks (b#bl) = (if (get_sample_time b \\ -1) then (b#(get_definite_blocks bl)) else (get_definite_blocks bl))\"\n\n\\ \\The sample time of a variable is the same as the sample time of the corresponding block. \\\nprimrec sample_time_var :: \"var \\ block list \\ sample_time\" where\n\"sample_time_var x [] = -1\" |\n\"sample_time_var x (b#bl) = (if ((x \\ set (get_outputs b) \\ x \\ set (get_inputs b)) \\ get_sample_time b \\ -1)\n then get_sample_time b else sample_time_var x bl)\"\n\n\\ \\True => the sample time of all the vars are unknown\\\nprimrec unknown_st_vars :: \"var list \\ block list \\ bool\" where\n\"unknown_st_vars [] bl = True\" |\n\"unknown_st_vars (a#al) bl = (if sample_time_var a bl \\ -1 then False else unknown_st_vars al bl) \"\n\nfun gcd' :: \"int \\ int \\ int\" where\n \"gcd' x y = (if x = 0 \\ y = 0 then 0 else (if x = -1 then y else (if y = -1 then x\nelse gcd x y)))\"\n\n\\ \\This function is only used when the sample time of some var is known \\\nprimrec sample_time_vars :: \"var list \\ block list \\ sample_time\" where\n\"sample_time_vars [] bl = -1\" |\n\"sample_time_vars (v # vl) bl = (if sample_time_var v bl = -1 then sample_time_vars vl bl \n else gcd' (sample_time_var v bl) (sample_time_vars vl bl))\"\n\ndefinition update_sample_time :: \"block \\ sample_time \\ block\" where\n\"update_sample_time b s = Block (get_inputs b) (get_outputs b) (get_offsets b) s (get_outupd b)\"\n\n\\ \\compute the sample time of an inherited block from its inputs\\\nprimrec compute_st_forward :: \"block list \\ block list \\ block list\" where\n\"compute_st_forward [] bl = bl\" |\n\"compute_st_forward (a # al) bl = (if (get_sample_time a = -1 \\ \\ unknown_st_vars (get_inputs a) bl) \n then compute_st_forward al (bl@[update_sample_time a (sample_time_vars (get_inputs a) bl)]) \n else compute_st_forward al (bl@[a]))\"\n\n\\ \\compute the sample time of an inherited block from its outputs backward (reverse blocks at first)\\\nprimrec compute_st_backward :: \"block list \\ block list \\ block list\" where\n\"compute_st_backward [] bl = bl\" |\n\"compute_st_backward (a # al) bl = (if (get_sample_time a = -1 \\ \\ unknown_st_vars (get_outputs a) bl) \n then compute_st_backward al (bl@[update_sample_time a (sample_time_vars (get_outputs a) bl)]) \n else compute_st_backward al (bl@[a]))\"\n\nfun compSt :: \"block list \\ block list \\ block list\" where\n\"compSt al bl = compute_st_backward (get_inherited_blocks (compute_st_forward al bl)) \n (get_definite_blocks (compute_st_forward al bl))\"\n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/Semantics_Simulink/DiscreteSyntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.265071127088915}} {"text": "theory\n Refine_Info\n imports\n Refine_Unions\n Refine_Vector_List\nbegin\n\nconsts i_info::\"interface\\interface\\interface\"\n\ndefinition info_rel_internal: \"info_rel I S = (I \\\\<^sub>r S) O br snd top\"\nlemma info_rel_def: \"\\I, S\\info_rel = (I \\\\<^sub>r S) O br snd top\"\n by (auto simp: relAPP_def info_rel_internal)\nlemmas [autoref_rel_intf] = REL_INTFI[of \"info_rel\" i_info]\n\nlemma info_rel_br: \"\\br a I, (br b J)\\info_rel = br (\\y. b (snd y)) (\\x. I (fst x) \\ J (snd x))\"\n by (auto simp: info_rel_def br_def prod_rel_def)\n\nlemma sv_info_rel[relator_props]:\n \"single_valued S \\single_valued I \\ single_valued (\\I, S\\info_rel)\"\n by (auto simp: info_rel_def intro!: relator_props)\n\ndefinition [simp]: \"op_info_is_empty = is_empty\"\ncontext includes autoref_syntax begin\n\n\nlemma op_set_isEmpty_info_rel_set[autoref_rules]:\n \"GEN_OP empty_i (is_empty) (A \\ bool_rel) \\ (\\x. empty_i (snd x), op_info_is_empty) \\ \\I, A\\info_rel \\ bool_rel\"\n by (auto simp: info_rel_def br_def op_set_isEmpty_def[abs_def] dest: fun_relD)\n\ndefinition [refine_vcg_def]: \"get_info X = SPEC (\\(h, Y). Y = X)\"\nlemma get_info_autoref[autoref_rules]:\n shows \"(\\x. RETURN x, get_info) \\ \\I, A\\info_rel \\ \\I \\\\<^sub>r A\\nres_rel\"\n by (force simp: get_info_def info_rel_def nres_rel_def br_def intro!: RETURN_SPEC_refine)\n\ndefinition with_info::\"'b \\ 'a set \\ 'a set\"\n where [simp, refine_vcg_def]: \"with_info h x = x\"\n\nlemma with_stepsize_autoref[autoref_rules]:\n \"((\\h x. (h, x)), with_info) \\ R \\ A \\ \\R, A\\info_rel\"\n by (auto simp: info_rel_def br_def intro!: prod_relI)\n\ndefinition with_half_stepsizes::\"'a set \\ 'a set\"\n where [simp, refine_vcg_def]: \"with_half_stepsizes x = x\"\nlemma with_half_stepsize_autoref[autoref_rules]:\n \"((map (\\(h, x). (h/2, x))), with_half_stepsizes) \\\n clw_rel (\\rnv_rel, A\\info_rel) \\ clw_rel (\\rnv_rel, A\\info_rel)\"\n if [unfolded autoref_tag_defs, relator_props]: \"single_valued A\"\n unfolding with_half_stepsizes_def\n apply (rule lift_clw_rel_map)\n apply (rule relator_props)+\n by (auto simp: info_rel_def br_def prod_rel_def)\n\ndefinition with_infos::\"'b \\ 'a set \\ 'a set\"\n where [simp, refine_vcg_def]: \"with_infos h x = x\"\nlemma with_infos_autoref[autoref_rules]:\n \"(\\h. map (Pair h), with_infos) \\ R \\ clw_rel A \\ clw_rel (\\R, A\\info_rel)\"\n if [unfolded autoref_tag_defs, relator_props]: \"PREFER single_valued A\" \"PREFER single_valued R\"\n unfolding with_infos_def\n apply (rule fun_relI)\n apply (rule lift_clw_rel_map)\n apply (rule relator_props)+\n by (auto simp: info_rel_def br_def prod_rel_def)\n\nabbreviation \"with_stepsize \\ (with_info::real\\_)\"\n\ndefinition split_with_info::\"'a set \\ ('c \\ 'a set \\ 'a set) nres\"\n where [refine_vcg_def]: \"split_with_info X = SPEC (\\(S, Y, YS). X = Y \\ YS)\"\n\ncontext includes autoref_syntax begin\nlemma split_with_info_appr_plane_autoref[autoref_rules]:\n assumes \"PREFER single_valued A\"\n assumes \"PREFER single_valued S\"\n assumes \"(xs, X) \\ clw_rel (\\A,S\\info_rel)\"\n shows\n \"(if xs = [] then SUCCEED else let s = fst (hd xs); (a, b) = List.partition (\\(sctn, _). sctn = s) xs in RETURN (s, map snd a, b),\n split_with_info $ X) \\\n \\A \\\\<^sub>r clw_rel S \\\\<^sub>r clw_rel (\\A, S\\info_rel)\\nres_rel\"\n using assms\n by (fastforce simp: Let_def split_with_info_def split_beta'\n lw_rel_def Union_rel_br info_rel_br ex_br_conj_iff Id_br[where 'a=\"'a sctn\"]\n split: if_splits\n elim!: single_valued_as_brE\n intro!: nres_relI RETURN_SPEC_refine brI hd_in_set\n dest!: brD )\n\ndefinition\n \"explicit_info_set X0 =\n do {\n e \\ isEmpty_spec X0;\n (_, _, Xis) \\ WHILE\\<^bsup>\\(e, X, Y).\n (e \\ X = {}) \\\n X0 = X \\ (\\(sctn, IS)\\Y. IS)\\<^esup>\n (\\(e, X, Y). \\e)\n (\\(e, X, Y).\n do {\n (sctn, S, X') \\ split_with_info X;\n e \\ isEmpty_spec X';\n RETURN (e, X', insert (sctn, S) Y)\n }\n )\n (e, X0, {});\n RETURN Xis\n }\"\n\nschematic_goal explicit_info_setc:\n fixes po :: \"'d \\ 'a::executable_euclidean_space set\"\n assumes [THEN PREFER_sv_D, relator_props]: \"PREFER single_valued A\"\n assumes [THEN PREFER_sv_D, relator_props]: \"PREFER single_valued S\"\n assumes [autoref_rules]: \"(XSi, XS) \\ clw_rel (\\S, A\\info_rel)\"\n shows \"(nres_of ?f, explicit_info_set $ XS) \\ \\\\S \\\\<^sub>r clw_rel A\\list_wset_rel\\nres_rel\"\n unfolding autoref_tag_defs\n unfolding explicit_info_set_def\n including art\n by autoref_monadic\nconcrete_definition explicit_info_setc for XSi uses explicit_info_setc\nlemmas [autoref_rules] = explicit_info_setc.refine\n\nlemma explicit_info_set[THEN order_trans, refine_vcg]:\n \"explicit_info_set X \\ SPEC (\\R. X = (\\(sctn, IS) \\ R. IS))\"\n unfolding explicit_info_set_def\n by (refine_vcg) (auto simp: split_beta' subset_iff)\n\nlemmas [relator_props del] = sv_info_rel\nlemma sv_info_rel'[relator_props]:\n \"single_valued S \\ single_valued (\\I, S\\info_rel)\"\n by (auto simp: info_rel_def single_valued_def br_def)\n\nlemma\n is_empty_info_rel_autoref[autoref_rules]:\n \"GEN_OP ie is_empty (A \\ bool_rel) \\ (\\x. ie(snd x), is_empty) \\ \\R, A\\info_rel \\ bool_rel\"\n by (force simp: info_rel_def br_def dest: fun_relD)\n\ndefinition with_coll_infos::\"'c set \\ 'a set \\ 'a set nres\"\n where [simp, refine_vcg_def]: \"with_coll_infos h x = SPEC (\\r. r = x)\"\n\nlemma with_coll_infos_autoref[autoref_rules]:\n \"((\\ri ai. nres_of (if ri = [] then dSUCCEED else dRETURN (List.product ri ai))), with_coll_infos) \\\n clw_rel R \\ clw_rel A \\ \\clw_rel (\\R, A\\info_rel)\\nres_rel\"\n if \"PREFER single_valued R\" \"PREFER single_valued A\"\n using that\n by (force simp: relcomp_unfold nres_rel_def info_rel_br list_wset_rel_def Union_rel_br\n Id_arbitrary_interface_def RETURN_RES_refine_iff set_rel_br\n elim!: single_valued_as_brE\n intro!: brI dest!: brD\n split: if_splits)\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Refinement/Refine_Info.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.265071127088915}} {"text": "section {* Abstract syntax for Hybrid CSP. *}\n\ntheory HHL1\n imports HCSP_Com\nbegin\n\nconsts \nspec :: \"fform => proc => fform => fform => prop\" (\"{_}_{_;_}\" 80)\nspecP2 :: \"fform => fform => proc => fform => fform => fform => fform => prop\" (\"{_, _}_{_, _ ; _, _}\" 80)\nspecP3 :: \"fform => fform => fform => proc => fform => fform => fform => fform => fform => fform => prop\"(\"{_,_,_}_{_,_,_; _,_,_}\" 80)\nspecP4 :: \"fform => fform => fform => fform => proc => fform => fform => fform => fform => fform => fform => fform => fform => prop\" (\"{_,_,_,_}_{_,_,_,_ ; _,_,_,_}\" 80)\nspecP5 :: \"fform => fform => fform => fform => fform => proc => fform => fform => fform => fform => fform => fform => fform => fform => fform => fform => prop\" (\"{_,_,_,_,_}_{_,_,_,_,_ ; _,_,_,_,_}\" 80)\nspecP6 :: \"fform => fform => fform => fform => fform => fform => proc => fform => fform => fform => fform => fform => fform => fform => fform => fform => fform => fform => fform => prop\" (\"{_,_,_,_,_,_}_{_,_,_,_,_,_ ; _,_,_,_,_,_}\" 80)\n\n(*List rules, p do not have exp1. If p have exp1, it must be eliminated by consequence rule firstly.*)\naxiomatization where\nListEmpty : \"{p} empty(exp1) {exp1[=](List [])[&]p; (l [=] (Real 0))}\" and\nListAdd : \"{exp1[=](List ls)[&]p} (addL exp1 exp2) {(exp1[=](List (exp2#ls)))[&]p; (l [=] (Real 0))}\" and\nListDel : \"|- exp1[=](List (tl(ls)))[&]p [-->] post\n ==> {exp1[=](List ls)[&]p} (delL(exp1)) {post; (l [=] (Real 0))}\" and\nListEmptya : \"{p} empty(exp1) {p; (l [=] (Real 0))}\" and\nListAdda : \"{p} (addL exp1 exp2) {p; (l [=] (Real 0))}\" and\nListDela : \"{p} (delL(exp1)) {p; (l [=] (Real 0))}\"\naxiomatization where\nEmpty: \"EL [=] List [] |- isEmpty(EL)\"\n\n(*Skip rule*)\naxiomatization where\nSkip : \"|- ((l [=] (Real 0)) [-->] G) ==> {p} Skip {p; G}\" \n\n\n(*Assignment rule*)\naxiomatization where\nAssign :\" [| ~inPairForm ([(e, f)], q); |-(p [-->] (substF ([(e, f)]) (q)))\n [&] ((l [=] (Real 0)) [-->] G)|] ==>\n {p} (e := f) {q; G}\"\n\n\n(*Example*)\nlemma \"{WTrue} (RVar ''x'') := (Real 2) {((RVar ''x'') [=] (Real 2)); (l [=] (Real 0))}\"\napply (cut_tac p = \"WTrue\" and e = \"(RVar ''x'')\" and f = \"(Real 2)\" and \n q = \"((RVar ''x'') [=] (Real 2))\" and G = \"(l [=] (Real 0))\" in Assign, auto)\napply (rule Trans,auto)\ndone\n\n\n\n(*Continuous rule*)\naxiomatization where\nContinue : \"|- (Init [-->] FF)\n [&] ((p [&] close(FF) [&] close([~]b)) [-->] q)\n [&] ((((l [=] Real 0) [|] (high (close(FF) [&] p [&] close(b)))) [&] Rg) [-->] G)\n ==> {Init [&] p} : Rg {q; G}\" and\nContinueT : \"|- (Init[&]p [-->]FF[&]b)\n [&] ((p [&] close(FF) [&] close(b) [&] close([~]b)) [-->] q)\n [&] ((((l [=] Real 0) [|] (high (close(FF) [&] p [&] close(b)))) [&] Rg) [-->] G)\n ==> {Init [&] p} : Rg {q; G}\" and\nContinueF : \"|- (p[-->][~]b) [&] (p[-->]q) [&] ((l[=](Real 0))[-->]G)\n ==> {p} : Rg {q; G}\"\n\n(*Continuous rule 2*)\naxiomatization where\nContinue2 : \"|- (Init [-->] FF)\n [&] ((p [&] close(FF) [&] close([~]b)) [-->] q)\n [&] ((((l [=] Real 0) [|] (high (close(FF) [&] p [&] close(b)))) [&] Rg) [-->] G)\n[&] (exeFlow (D,b,F1) [-->]FF)\n ==> {Init [&] p} : Rg {q; G}\" and\nContinue2T : \"|- (Init[&]p [-->] FF[&]b)\n [&] ((p [&] close(FF) [&] close(b) [&] close([~]b)) [-->] q)\n [&] ((((l [=] Real 0) [|] (high (close(FF) [&] p [&] close(b)))) [&] Rg) [-->] G)\n[&](exeFlow (D,b,FF) [-->]FF)\n ==> {Init [&] p} : Rg {q; G}\" and\nContinue2F : \"|- (p[-->][~]b) [&] (p[-->]q) [&] ((l[=](Real 0))[-->]G)\n ==> {p} : Rg {q; G}\"\n\n(*Sequential rule*)\naxiomatization where\nSequence : \"[| {p} P {m; H}; {m} Q {q; G} |] ==>\n {p} P; (m, H); Q {q; H [^] G}\" \naxiomatization where\nSequence1 : \"[| {p} P {m; H}; {m} Q {q; G} |] ==>\n {p} P; M; Q {q; H [^] G}\" \n\n(*Case rule*)\naxiomatization where\nCase : \"[| {p [&] b} P {q; G}; {p [&] ([~]b)} P {q; G}|] \n ==> {p} P {q; G}\"\n \n\n(*Conditional rule*)\naxiomatization where\nConditionF : \" [| |-(p [-->] [~] b); |- (p [-->] q); |- ((l [=] Real 0) [-->] G) |]\n ==> {p} IF b P {q; G}\"\nand\nConditionT : \"[| |-(p [-->] b); {p} P {q; G} |]\n ==> {p} IF b P {q; G}\"\nand\nCondition : \"[| {p [&] b} IF b P {q; G}; {p [&] ([~]b)} IF b P {q; G}|] \n ==> {p} IF b P {q; G}\"\naxiomatization where\nConditionT2 : \"[| |-(pn [-->] b); {pm,pn} (Pm||Pn) {qm,qn; Gm,Gn} |]\n ==> {pm,pn} (Pm||(IF b Pn)) {qm,qn; Gm,Gn}\" and\nConditionT2a : \"[| |-(pm [-->] b); {pm,pn} (Pm||Pn) {qm,qn; Gm,Gn} |]\n ==> {pm,pn} ((IF b Pm)||Pn) {qm,qn; Gm,Gn}\"\n\n\n(*Nondeterministic rule*)\naxiomatization where\nNondeterministic :\n\"{p [&] b} P {q;G}\n ==> {p} NON i x : b P {q; G}\"\n\n(*Communication rule*)\n(*H in the rule denotes the common interval range.*)\naxiomatization where\nCommunication : \"[| ~inPairForm ([(x, e)], ry);\n {px, py} (Px || Py) {qx, qy; Hx, Hy}; \n |- (qx [-->] rx) [&] (qy [-->] (substF ([(x, e)]) (ry)));\n |- ((Hx [^] (high (qx))) [-->] Gx) [&] ((Hy [^] (high (qy))) [-->] Gy);\n |- ((((Hx [^] (high (qx))) [&] Hy) [|]((Hy [^] (high (qy))) [&] Hx)) [-->] H)\n |]\n ==> {px, py} ((Px; (qx, Hx); ch !! e) || (Py; (qy, Hy); ch ?? x)) {rx, ry; \n Gx [&] H, Gy [&] H}\"\naxiomatization where\nCommunication1 : \"[| ~inPairForm ([(x, e)], ry);\n {px, py} (Px || Py) {qx, qy; Hx, Hy}; \n |- (qx [-->] rx) [&] (qx[&]qy [-->] (substF ([(x, e)]) (ry)));\n |- ((Hx [^] (high (qx))) [-->] Gx) [&] ((Hy [^] (high (qy))) [-->] Gy);\n |- ((((Hx [^] (high (qx))) [&] Hy) [|]((Hy [^] (high (qy))) [&] Hx)) [-->] H)\n |]\n ==> {px, py} ((Px; (qx, Hx); ch !! e) || (Py; (qy, Hy); ch ?? x)) {rx, ry; \n Gx [&] H, Gy [&] H}\"\naxiomatization where\nCommunicationSim : \"[| ~inPairForm ([(x, e)], ry);\n |- (px [-->] rx) [&] (px[&]py [-->] (substF ([(x, e)]) (ry))) |]\n ==> {px, py} ((ch !! e) || (ch ?? x)) {rx, ry;(l[=](Real 0)), (l[=](Real 0))}\"\naxiomatization where\nCommunicationC : \"[| ~inPairForm ([(x, e)], ry);\n {qx} (Px) {rx; (l[=](Real 0))}; \n |- (px [&] py) [-->] (substF ([(x, e)]) (qx));\n |- py [-->] ry;\n |- (l[=](Real 0)) [-->] Hx;\n |- (l[=](Real 0)) [-->] My;\n |- (l[=](Real 0)) [-->] My;\n contain(Pm,(ch ?? x))|]\n ==> {px, py} (( Pm; (qx, Hx); Px) || (ch !! e))\n {rx, ry; Mx, My}\"\n\n(*Communication interrupt rule*)\nprimrec contain :: \"proc => proc => bool\" where\n\"contain (Skip,p) = False\" |\n\"contain (Stop,p) = False\" |\n\"contain (x:=e,p) = False\" |\n\"contain ((Ch!!e),p) = ((Ch!!e)=p)\" |\n\"contain ((Ch??x),p) = ((Ch??x)=p)\" |\n\"contain ((q;m;r),p) = False\" |\n\"contain ((IF b q),p) = False\" |\n\"contain ((NON i x : b q),p) = False\" |\n\"contain ((q [[ r),p) = (if contain(q,p) then True else contain(r,p))\" |\n\"contain ((q << r),p) = False\" |\n\"contain ((q || r),p) = False\" |\n\"contain ((q*),p) = False\" |\n\"contain ((q**n),p) = False\" |\n\"contain (( : g),p) = False\" |\n\"contain ((q |> b r),p) = False\" |\n\"contain ((q [[> r),p) = False\"\n\n(**)\naxiomatization where\nCommunicationI1 : \"[| ~inPairForm ([(x, e)], ry);\n |- Hy [-->] H;\n |- rg [-->] H[^]WTrue;\n {px, py} (Px || Py) {qx, qy; Hx, Hy}; \n |- Init [&] pre [<->] qx;\n |- pre [&] Init [&] b [-->] FF;\n |- (pre [&] close(FF) [&] close(b)) [-->] rx;\n |- (qy [&] pre [&] close(FF) [&] close(b)) [-->] (substF ([(x, e)]) (ry));\n |- (Hx [^] ((((l [=] Real 0) [|] (high (close(FF) [&] pre [&] close(b)))) [&] H)) [-->] Gx);\n |- Hy [-->] Gy;\n |- Hx [-->] Hxm;\n |- Hy [-->] Hym;\n contain(P,(ch !! e))\n |]\n ==> {px, py} (( Px; (qx, Hxm); ( :rg) [[> P) || (Py; (qy, Hym); ch ?? x))\n {rx, ry; Gx, Gy}\"\naxiomatization where\nCommunicationI2 : \"[| ~inPairForm ([(x, e)], ry);\n |- Hy [-->] H;\n |- rg [-->] H[^]WTrue;\n {px, py} (Px || Py) {qx, qy; Hx, Hy}; \n |- Init [&] pre [<->] qx;\n |- pre [&] Init [&] b [-->] FF;\n |- (qy [&] pre [&] close(FF) [&] close(b)) [-->] (substF ([(x, e)]) (rx));\n |- qy [-->] ry;\n |- Hx [^] ((((l [=] Real 0) [|] (high (close(FF) [&] pre [&] close(b)))) [&] H)) [-->] Gx;\n |- Hy [-->] Gy;\n |- Hx [-->] Hxm;\n |- Hy [-->] Hym;\n contain(P,(ch ?? x))\n |]\n ==> {px, py} (( Px; (qx, Hxm); ( :rg) [[> P) || (Py; (qy, Hym); ch !! e))\n {rx, ry; Gx, Gy}\"\n\n(*Parallel rule*)\n(*It is valid only when there are not communications occurring in P3 and P4.*)\naxiomatization where\nParallel1: \"[| {px, py} (Px || Py) {qx, qy; Hx, Hy}; {qx} Qx {rx; Gx}; {qy} Qy {ry; Gy} |]\n ==> {px, py} ((Px; (qx, Hx); Qx) || (Py; (qy, Hy); Qy)) {rx, ry; Hx [^] Gx, Hy [^] Gy}\"\n\n(*It is valid only when there are no communications occurring in P1 and P2.*)\naxiomatization where\nParallel2: \"[| {px} Px {qx; Hx}; {py} Py {qy; Hy}|]\n ==> {px, py} (Px || Py) {qx, qy; Hx, Hy}\"\n(*It is valid in any case*)\naxiomatization where\nParallel3: \"[| {px, py} (Px || Py) {qx, qy; Hx[&](l[=](Real m)), Hy[&](l[=](Real m))};\n {qx, qy} (Qx || Qy) {rx, ry; Mx, My};\n |- (Hx[&](l[=](Real m))) [-->] HL;\n |- (Hy[&](l[=](Real m))) [-->] HR;\n |- ((Hx[&](l[=](Real m))) [^] Mx) [-->] Gx;\n |- ((Hy[&](l[=](Real m))) [^] My) [-->] Gy\n |]\n ==> {px, py} (Px;(qx,HL);Qx) || (Py;(qy,HR);Qy) {rx, ry; Gx, Gy}\"\n\n(*Repetition rule*)\naxiomatization where\nRep : \"[| {px} (Px) {px; Hx}; |- Hx [^] Hx [-->] Hx|]\n ==> {px} (Px*) {px; Hx} \"\naxiomatization where\nRepetition : \"[| {px, py} (Px || Py) {px, py; Hx, Hy};\n |- Hx [^] Hx [-->] Hx; |- Hy [^] Hy [-->] Hy|]\n ==> {px, py} ((Px*) || (Py*)) {px, py; Hx, Hy} \"\n\naxiomatization where\nRepetition0 : \"(Pm**(0)) == Skip\" and\nRepetition1 : \"(Pm**(Suc(0))) == Pm\" and\nRepetitionN : \"(Pm**(am+1)) == (Pm; M; Pm**am)\"\n\naxiomatization where\nRepetitionA2 : \"{p1,p2} ((Pm**(am+1))||(Pn**(an+1))) {p1,p2; Ha,Hb}\n==> {p1,p2} ((Pm***)||(Pn***)) {p1,p2; Ha,Hb}\"\n\naxiomatization where\nRepetitionG2 : \"[| {p1,p2} ((Pm***)||(Pn***)) {p1,p2; Ha,Hb}; |- Ha [^] Ha [-->] Ha; |- Hb [^] Hb [-->] Hb|]\n==> {p1,p2} (Pm*||Pn*) {p1,p2; Ha,Hb}\"\n\naxiomatization where\nRepetitionA6 : \"{p1,p2,p3,p4,p5,p6} ((Pm**(am+1))||(Pn**(an+1))||(Po**(ao+1))||(Pp**(ap+1))||(Pq**(aq+1))||(Pr**(ar+1))) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}\n==> {p1,p2,p3,p4,p5,p6} ((Pm***)||(Pn***)||(Po***)||(Pp***)||(Pq***)||(Pr***)) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}\"\n\naxiomatization where\nRepetitionG6 : \"[| {p1,p2,p3,p4,p5,p6} ((Pm***)||(Pn***)||(Po***)||(Pp***)||(Pq***)||(Pr***)) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}; |- Ha [^] Ha [-->] Ha; |- Hb [^] Hb [-->] Hb; |- Hc [^] Hc [-->] Hc; |- Hd [^] Hd [-->] Hd; |- He [^] He [-->] He; |- Hf [^] Hf [-->] Hf|]\n==> {p1,p2,p3,p4,p5,p6} (Pm*||Pn*||Po*||Pp*||Pq*||Pr*) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}\"\n\n(*N times repetition request post and history holds for any middle state to ensure RepetitionG holds.*)\naxiomatization where\nRepetitionT1a : \"{px, py} ((Px;M;Pz) || Py) {qx, qy; Hx, Hy}\n ==> {px, py} (((Px**1);M;Pz) || Py) {qx, qy; Hx, Hy}\" and\nRepetitionTna : \"[| {px, py} (((Px**m);(qx,H);Px;M;P) || Py) {qx, qy; Hx, Hy};\n |- Hx [^] Hx [-->] Hx;\n |- H [-->] Hx|]\n ==> {px, py} (((Px**(m+1));M;P) || Py) {qx, qy; Hx, Hy}\" and\nRepetitionG : \"[| {px, py} (Px**(m+1) || Py**(n+1)) {px, py; Hx, Hy};\n |- Hx [^] Hx [-->] Hx; |- Hy [^] Hy [-->] Hy|]\n ==> {px, py} ((Px* ) || (Py* )) {px, py; Hx, Hy} \" and\nRepetitionE : \"[| {px, py} (((P;M;(Px**(n+1)));(qx,Hx);(Px* )) || Py) {qx, qy; Hx, Hy}|]\n ==> {px, py} ((P;M;(Px* )) || Py) {qx, qy; Hx, Hy} \"\n\n(*Structure rule*)\naxiomatization where\nStructure : \"{px, py} (Px || Py) {qx, qy; Hx, Hy}\n ==> {py, px} (Py || Px) {qy, qx; Hy, Hx}\" and\nstructR : \"{px, py} Q||((Px;Mx;Py);My;Pz) {qx, qy; Hx, Hy}\n ==> {px, py} Q||(Px;Mx;Py;My;Pz){qx, qy; Hx, Hy}\" and\nstructL : \"{px, py} ((Px;Mx;Py);My;Pz)||Q {qx, qy; Hx, Hy}\n ==> {px, py} (Px;Mx;Py;My;Pz)||Q{qx, qy; Hx, Hy}\" and\nstructSkipL : \"{px, py} (Skip;(px,l[=](Real 0));P)||Q {qx, qy; Hx, Hy}\n == {px, py} P||Q{qx, qy; Hx, Hy}\" and\nstructSkipR : \"{px, py} (P;(qx,Hx);Skip)||Q {qx, qy; Hx, Hy}\n == {px, py} P||Q{qx, qy; Hx, Hy}\" and\nEquality2: \"[| Pm==Qm; Pn==Qn; {p1,p2} (Qm||Qn) {p1,p2; Ha,Hb}|]\n==> {p1,p2} (Pm||Pn) {p1,p2; Ha,Hb}\" and\nEquality6: \"[| Pm==Qm; Pn==Qn; Po==Qo; Pp==Qp; Pq==Qq; Pr==Qr; {p1,p2,p3,p4,p5,p6} (Qm||Qn||Qo||Qp||Qq||Qr) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}|]\n==> {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {p1,p2,p3,p4,p5,p6; Ha,Hb,Hc,Hd,He,Hf}\"\n\n\n(*Consequence rule*)\naxiomatization where\nConsequenceS : \"[| {px} P {qx; Hx}; |- ((p [-->] px) [&] (qx [-->] q) [&] (Hx [-->] H))|]\n ==> {p} P {q; H}\"\nand\nConsequenceP : \"[| {px, py} (Px || Py) {qx, qy; Hx, Hy}; \n |- ((p [-->] px) [&] (r [-->] py) [&] (qx [-->] q) [&] (qy [-->] s) \n [&] (Hx [-->] H) [&] (Hy [-->] G))|]\n ==> {p, r} (Px || Py) {q, s; H, G}\"\nand\nConsequence6 : \"[|{qa,qb,qc,qd,qe,qf} (Pm||Pn||Po||Pp||Pq||Pr) {ra,rb,rc,rd,re,rf; Ha,Hb,Hc,Hd,He,Hf}; |- (q1[-->]qa) [&] (q2[-->]qb) [&] (q3[-->]qc) [&] (q4[-->]qd) [&] (q5[-->]qe) [&] (q6[-->]qf); |- (ra[-->]r1) [&] (rb[-->]r2) [&] (rc[-->]r3) [&] (rd[-->]r4) [&] (re[-->]r5) [&] (rf[-->]r6); |- (Ha[-->]H1) [&] (Hb[-->]H2) [&] (Hc[-->]H3) [&] (Hd[-->]H4) [&] (He[-->]H5) [&] (Hf[-->]H6)|]\n==> {q1,q2,q3,q4,q5,q6} (Pm||Pn||Po||Pp||Pq||Pr) {r1,r2,r3,r4,r5,r6; H1,H2,H3,H4,H5,H6}\"\n\n(*added rules for parallel with more entities*)\naxiomatization where\nParallel23: \"[| {p1,p2} (Pm||Pn) {q1,q2; H1,H2};\n {p3} Po {q3; H3}|]\n ==> {p1,p2,p3} (Pm||Pn||Po) {q1,q2,q3; H1,H2,H3}\" and\nParallel24: \"[| {p1,p2,p3} (Pm||Pn||Po) {q1,q2,q3; H1,H2,H3};\n {p4} Pp {q4; H4}|]\n ==> {p1,p2,p3,p4} (Pm||Pn||Po||Pp) {q1,q2,q3,q4; H1,H2,H3,H4}\" and\nParallel25: \"[| {p1,p2,p3,p4} (Pm||Pn||Po||Pp) {q1,q2,q3,q4; H1,H2,H3,H4};\n {p5} Pq {q5; H5}|]\n ==> {p1,p2,p3,p4,p5} (Pm||Pn||Po||Pp||Pq) {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5}\" and\nParallel26: \"[| {p1,p2,p3,p4,p5} (Pm||Pn||Po||Pp||Pq) {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5};\n {p6} Pr {q6; H6}|]\n ==> {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {q1,q2,q3,q4,q5,q6; H1,H2,H3,H4,H5,H6}\"\naxiomatization where\nParallelSeq6: \"[| {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {q1,q2,q3,q4,q5,q6; Ha,Hb,Hc,Hd,He,Hf}; {r1,r2,r3,r4,r5,r6} (Qm||Qn||Qo||Qp||Qq||Qr) {p1,p2,p3,p4,p5,p6; G1,G2,G3,G4,G5,G6}; |- (G1[^]Ha) [-->] M1; |- (G2[^]Hb) [-->] M2; |- (G3[^]Hc) [-->] M3; |- (G4[^]Hd) [-->] M4; |- (G5[^]He) [-->] M5; |- (G6[^]Hf) [-->] M6|]\n ==> {r1,r2,r3,r4,r5,r6} ((Qm;(p1,G1);Pm)||(Qn;(p2,G2);Pn)||(Qo;(p3,G3);Po)||(Qp;(p4,G4);Pp)||(Qq;(p5,G5);Pq)||(Qr;(p6,G6);Pr)) {q1,q2,q3,q4,q5,q6; M1,M2,M3,M4,M5,M6}\"\n\naxiomatization where\nParallelSeq6a: \"[|{p1}Pm{q1; Ha}; {p2}Pn{q2; Hb}; {p3}Po{q3; Hc}; {p4}Pp{q4; Hd}; {p5}Pq{q5; He}; {p6}Pr{q6; Hf}|]\n==> {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {q1,q2,q3,q4,q5,q6; Ha,Hb,Hc,Hd,He,Hf}\"\n\naxiomatization where\nParallelSeq12a: \"[| {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {q1,q2,q3,q4,q5,q6; Ha,Hb,Hc,Hd,He,Hf}; {r1,r2} (Qm||Qn) {p1,p2; G1,G2}; |- (G1[^]Ha) [-->] M1; |- (G2[^]Hb) [-->] M2|]\n ==> {r1,r2,p3,p4,p5,p6} ((Qm;(p1,G1);Pm)||(Qn;(p2,G2);Pn)||(Po)||(Pp)||(Pq)||(Pr)) {q1,q2,q3,q4,q5,q6; M1,M2,Hc,Hd,He,Hf}\" and\nParallelSeq25a: \"[| {p1,p2,p3,p4,p6} (Pm||Pn||Po||Pp||Pr) {q1,q2,q3,q4,q6; Ha,Hb,Hc,Hd,Hf}; {r2,r5} (Qn||Qq) {p2,p5; G2,G5}; |- (G2[^]Hb) [-->] M2|]\n ==> {p1,r2,p3,p4,r5,p6} ((Pm)||(Qn;(p2,G2);Pn)||(Po)||(Pp)||(Qq)||(Pr)) {q1,q2,q3,q4,p5,q6; Ha,M2,Hc,Hd,G5,Hf}\" and\nParallelSeq23a: \"[| {p1,p2,p4,p6} (Pm||Pn||Pp||Pr) {q1,q2,q4,q6; Ha,Hb,Hd,Hf}; {r2,r3} (Qn||Qo) {p2,p3; G2,G3}; |- (G2[^]Hb) [-->] M2|]\n ==> {p1,r2,r3,p4,p6} ((Pm)||(Qn;(p2,G2);Pn)||(Qo)||(Pp)||(Pr)) {q1,q2,p3,q4,q6; Ha,M2,G3,Hd,Hf}\" and\nParallelSeq23b: \"[| {p1,p2,p6} (Pm||Pn||Pr) {q1,q2,q6; Ha,Hb,Hf}; {r2,r4} (Qn||Qp) {p2,p4; G2,G4}; |- (G2[^]Hb) [-->] M2|]\n ==> {p1,r2,r4,p6} ((Pm)||(Qn;(p2,G2);Pn)||(Qp)||(Pr)) {q1,q2,p4,q6; Ha,M2,G4,Hf}\" and\nParallelSeq23c: \"[| {p1,p2} (Pm||Pn) {q1,q2; Ha,Hb}; {r2,r6} (Qn||Qr) {p2,p6; G2,G6}; |- (G2[^]Hb) [-->] M2|]\n ==> {p1,r2,r6} ((Pm)||(Qn;(p2,G2);Pn)||(Qr)) {q1,q2,p6; Ha,M2,G6}\"\n\naxiomatization where\nParallelSeq6b: \"[| {p1,p2,p3,p4,p5,p6} (Pm||Pn||Po||Pp||Pq||Pr) {q1,q2,q3,q4,q5,q6; Ha,Hb,Hc,Hd,He,Hf}; {q1,q2}Qn||Rn{r1,r2; Ga,Gb}; |- Ha[^]Ga [-->]Ma; |- Hb[^]Gb [-->]Mb|]\n ==> {p1,p2,p3,p4,p5,p6} ((Pm;(q1,Ha);Qn)||(Pn;(q2,Hb);Rn)||Po||Pp||Pq||Pr) {r1,r2,q3,q4,q5,q6; Ma,Mb,Hc,Hd,He,Hf}\"\naxiomatization where\nConsequenceP5 : \"[| {pa,pb,pc,pd,pe} P {qa,qb,qc,qd,qe; Ha,Hb,Hc,Hd,He}; \n |- (p1 [-->] pa) [&] (p2 [-->] pb) [&] (p3 [-->] pc) [&] (p4 [-->] pd) [&] (p5 [-->] pe);\n |- (qa [-->] q1) [&] (qb [-->] q2) [&] (qc [-->] q3) [&] (qd [-->] q4) [&] (qe [-->] q5);\n |- (Ha [-->] H1) [&] (Hb [-->] H2) [&] (Hc [-->] H3) [&] \n (Hd [-->] H4) [&] (He [-->] H5) |]\n ==> {p1,p2,p3,p4,p5} P {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5}\"\naxiomatization where\nRepetition5 : \"[| {p1,p2,p3,p4,p5} (((Pm||Pn)||Po)||Pp)||Pq {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5};\n |- H1 [^] H1 [-->] H1; |- H2 [^] H2 [-->] H2; |- H3 [^] H3 [-->] H3;\n |- H4 [^] H4 [-->] H4; |- H5 [^] H5 [-->] H5|]\n ==> {p1,p2,p3,p4,p5} (((Pm*||Pn*)||Po*)||Pp*)||Pq* {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5}\"\naxiomatization where\nParallel113: \"[| {p1,p2,p3} ((Pm||Pn)||Po) {q,q2,q3; H,H2,H3};\n {q} Q {qx; Hx}; |- (H[^]Hx) [-->] Hy|]\n ==> {p1,p2,p3} (((Pm;(q,H);Q)||Pn)||Po) {qx,q2,q3; Hy,H2,H3}\"\naxiomatization where\nParallel115: \"[| {p1,p2,p3,p4,p5} (((Pm||Pn)||Po)||Pp)||Pq {q,q2,q3,q4,q5; H,H2,H3,H4,H5};\n {q} Q {qx; Hx}; |- (H[^]Hx) [-->] Hy|]\n ==> {p1,p2,p3,p4,p5} ((((Pm;(q,H);Q)||Pn)||Po)||Pp)||Pq {qx,q2,q3,q4,q5; Hy,H2,H3,H4,H5}\"\naxiomatization where\nParallel13: \"[| {p1,p2,p3} (Pm||Pn)||Po {q1,q2,q3; H1,H2,H3};\n {q3} Q {qx; Hx}; |- (H3[^]Hx) [-->] Hy|]\n ==> {p1,p2,p3} (Pm||Pn)||(Po;(q3,H3);Q) {q1,q2,qx; H1,H2,Hy}\"\naxiomatization where\nParallel14: \"[| {p1,p2,p3,p4} ((Pm||Pn)||Po)||Pp {q1,q2,q3,q4; H1,H2,H3,H4};\n {q4} Q {qx; Hx}; |- (H4[^]Hx) [-->] Hy|]\n ==> {p1,p2,p3,p4} ((Pm||Pn)||Po)||(Pp;(q4,H4);Q) {q1,q2,q3,qx; H1,H2,H3,Hy}\"\naxiomatization where\nParallel15: \"[| {p1,p2,p3,p4,p5} (((Pm||Pn)||Po)||Pp)||Pq {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5};\n {q5} Q {qx; Hx}; |- (H5[^]Hx) [-->] Hy|]\n ==> {p1,p2,p3,p4,p5} (((Pm||Pn)||Po)||Pp)||(Pq;(q5,H5);Q) {q1,q2,q3,q4,qx; H1,H2,H3,H4,Hy}\"\naxiomatization where\nCommunication3 : \"[| ~inPairForm ([(x, e)], qy);\n {p1,p2,p3} (Pm||Pn)||Po {q1,q2,q3; H1,H2,H3};\n |- (q1 [-->] qx) [&] (q3 [-->] (substF ([(x, e)]) (qy)));\n |- ((H1 [^] (high (q1))) [-->] Hx) [&] ((H3 [^] (high (q3))) [-->] Hy);\n |- ((((H1 [^] (high (q1))) [&] H3) [|]((H3 [^] (high (q3))) [&] H1)) [-->] H);\n |- Hx [&] H [-->] Ha;\n |- Hy [&] H [-->] Hb\n |]\n ==> {p1,p2,p3} ((Pm;(q1, H1);ch!!e)||Pn)||(Po;(q3, H3);ch??x) \n {qx,q2,qy; Ha,H2,Hb}\"\naxiomatization where\nCommunication4 : \"[| ~inPairForm ([(x, e)], qy);\n {p1,p2,p3,p4} ((Pm||Pn)||Po)||Pp {q1,q2,q3,q4; H1,H2,H3,H4};\n |- (q1 [-->] qx) [&] (q4 [-->] (substF ([(x, e)]) (qy)));\n |- ((H1 [^] (high (q1))) [-->] Hx) [&] ((H4 [^] (high (q4))) [-->] Hy);\n |- ((((H1 [^] (high (q1))) [&] H4) [|]((H4 [^] (high (q4))) [&] H1)) [-->] H);\n |- Hx [&] H [-->] Ha;\n |- Hy [&] H [-->] Hb\n |]\n ==> {p1,p2,p3,p4} (((Pm;(q1, H1);ch!!e)||Pn)||Po)||(Pp;(q4, H4);ch??x) \n {qx,q2,q3,qy; Ha,H2,H3,Hb}\"\naxiomatization where\nCommunication5 : \"[| ~inPairForm ([(x, e)], qy);\n {p1,p2,p3,p4,p5} (((Pm||Pn)||Po)||Pp)||Pq {q1,q2,q3,q4,q5; H1,H2,H3,H4,H5};\n |- (q1 [-->] qx) [&] (q5 [-->] (substF ([(x, e)]) (qy)));\n |- ((H1 [^] (high (q1))) [-->] Hx) [&] ((H5 [^] (high (q5))) [-->] Hy);\n |- ((((H1 [^] (high (q1))) [&] H5) [|]((H5 [^] (high (q5))) [&] H1)) [-->] H);\n |- Hx [&] H [-->] Ha;\n |- Hy [&] H [-->] Hb\n |]\n ==> {p1,p2,p3,p4,p5} ((((Pm;(q1, H1);ch!!e)||Pn)||Po)||Pp)||(Pq;(q5, H5);ch??x) \n {qx,q2,q3,q4,qy; Ha,H2,H3,H4,Hb}\"\n\n(*important derived rules*)\nlemma structSkipEL : \"{px, py} (Skip;(px,l[=](Real 0));P)||Q {qx, qy; Hx, Hy}\n ==> {px, py} P||Q{qx, qy; Hx, Hy}\"\napply (cut_tac px=px and py=py and P=P and Q=Q and qx=qx and qy=qy and Hx=Hx and Hy=Hy in structSkipL,auto)\ndone\n\nlemma structSkipIL : \"{px, py} P||Q{qx, qy; Hx, Hy}\n ==> {px, py} (Skip;(px,l[=](Real 0));P)||Q {qx, qy; Hx, Hy}\"\napply (cut_tac px=px and py=py and P=P and Q=Q and qx=qx and qy=qy and Hx=Hx and Hy=Hy in structSkipL,auto)\ndone\n\nlemma structSkipER : \"{px, py} (P;(qx,Hx);Skip)||Q {qx, qy; Hx, Hy}\n ==> {px, py} P||Q{qx, qy; Hx, Hy}\"\napply (cut_tac px=px and py=py and P=P and Q=Q and qx=qx and qy=qy and Hx=Hx and Hy=Hy in structSkipR,auto)\ndone\n\nlemma structSkipIR : \"{px, py} P||Q{qx, qy; Hx, Hy}\n ==> {px, py} (P;(qx,Hx);Skip)||Q {qx, qy; Hx, Hy}\"\napply (cut_tac px=px and py=py and P=P and Q=Q and qx=qx and qy=qy and Hx=Hx and Hy=Hy in structSkipR,auto)\ndone\n\nlemma RepetitionT1 : \"{px, py} (Px || Py) {qx, qy; Hx, Hy}\n ==> {px, py} (Px**1 || Py) {qx, qy; Hx, Hy}\"\napply (rule structSkipER)\napply (rule RepetitionT1a)\napply (rule structSkipIR,auto)\ndone\n\nlemma RepetitionTn : \"[| {px, py} (((Px**m);(qx,H);Px) || Py) {qx, qy; Hx, Hy};\n |- Hx [^] Hx [-->] Hx;\n |- H [-->] Hx|]\n ==> {px, py} (Px**(m+1) || Py) {qx, qy; Hx, Hy}\"\napply (rule structSkipER)\napply (cut_tac H=\"H\" in RepetitionTna,auto)\napply (rule structL)\napply (rule structSkipIR,auto)\ndone\n\nlemma Parallel4: \"[| {py} Py {qy; Hy[&](l[=](Real 0))};\n {qx, qy} (Qx || Qy) {rx, ry; Mx, My};\n |- (Hy[&](l[=](Real 0))) [-->] HR;\n |- ((Hy[&](l[=](Real 0))) [^] My) [-->] Gy\n |]\n ==> {qx, py} (Qx) || (Py;(qy,HR);Qy) {rx, ry; Mx, Gy}\"\napply (rule structSkipEL)\napply (cut_tac m=0 and Hx=\"l [=] Real 0\" in Parallel3,auto)\napply (rule Parallel2,auto)\napply (rule Skip)\n(*1*)\napply (rule impR)\napply (rule conjR)\napply (rule basic)+\napply (rule impR)\napply (rule conjL)\napply (rule basic)\napply (rule impR)\napply (rule LC1)\napply (rule LL3a)\napply (rule basic)\ndone\n\nlemma Parallel1a: \"[| {px, py} (Px || Py) {qx, qy; Hx, Hy}; {qy} Qy {ry; Gy}; |- Hy [^] Gy [-->] G |]\n ==> {px, py} ((Px) || (Py; (qy, Hy); Qy)) {qx, ry; Hx, G}\"\napply (rule structSkipER)\napply (subgoal_tac \"{px, py}(Px;(qx, Hx);Skip)||(Py;(qy, Hy);Qy){qx,ry; (Hx [^] l [=] Real 0), Hy [^] Gy}\")\napply (cut_tac px=px and py=py and qx=qx and qy=ry and Hx=\"Hx [^] l [=] Real 0\" and Hy=\"Hy [^] Gy\" in ConsequenceP,auto)\napply (rule conjR)\napply (rule impR)\napply (rule basic)\napply (rule conjR)\napply (rule impR)\napply (rule basic)\napply (rule conjR)\napply (rule impR)\napply (rule basic)\napply (rule conjR)\napply (rule impR)\napply (rule basic)\napply (rule conjR)\napply (rule impR)\napply (rule LL4)\napply (rule basic)\napply assumption\n(*start*)\napply (cut_tac px=px and py=py and Px=Px and qx=qx and Hx=\"Hx\" and Qx=Skip and Py=Py and qy=qy and Hy=Hy and Qy=Qy and rx=qx and ry=ry and Gx=\"(l [=] Real 0)\" and Gy=Gy in Parallel1,auto)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\ndone\n\nlemma CommunicationI1b : \"[| ~inPairForm ([(x, e)], ry);\n |- Hy [-->] H;\n |- rg [-->] H[^]WTrue;\n {py} ( Py) {qy; Hy}; \n |- Init [&] pre [<->] qx;\n |- pre [&] Init [&] b [-->] FF;\n |- (pre [&] close(FF) [&] close(b)) [-->] rx;\n |- (qy [&] pre [&] close(FF) [&] close(b) [-->] (substF ([(x, e)]) (ry)));\n |- ((((l [=] Real 0) [|] (high (close(FF) [&] pre [&] close(b)))) [&] H) [-->] Gx);\n |- Hy [-->] Gy;\n |- Hy [-->] Hym;\n contain(P,(ch !! e))\n |]\n ==> {qx, py} ((( :rg) [[> P) || (Py; (qy, Hym); ch ?? x))\n {rx, ry; Gx, Gy}\"\napply (rule structSkipEL)\napply (cut_tac Hx=\"l [=] Real 0\" and Init=Init in CommunicationI1,auto)\napply (rule Parallel2,auto)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\napply (cut_tac P=\"((l [=] Real 0 [|] high (close(FF) [&] pre [&] close(b))) [&] H) [-->] Gx\" in cut,auto)\napply (rule thinR,auto)\napply (rule impR)\napply (rule LL3a)\napply (rule impL)\napply (rule basic)+\napply (rule impR)\napply (rule basic)\ndone\n\nlemma structSkipELR : \"{px, py} Q||(Skip;(py,l[=](Real 0));P) {qx, qy; Hx, Hy}\n ==> {px, py} Q||P{qx, qy; Hx, Hy}\"\napply (rule Structure)\napply (rule structSkipEL)\napply (rule Structure)\napply assumption\ndone\n\nlemma CommunicationI1a : \"[| ~inPairForm ([(x, e)], ry);\n |- Init [&] pre [<->] px;\n |- pre [&] Init [&] b [-->] FF;\n |- (pre [&] close(FF) [&] close(b)) [-->] rx;\n (*|- px [-->] rx;*)\n |- py [&] pre [&] close(FF) [&] close(b) [-->] (substF ([(x, e)]) (ry));\n |- (l[=]Real 0) [-->] Gx;\n |- (l[=]Real 0) [-->] Gy;\n contain(Px,(ch !! e))|]\n ==> {px, py} ((( :rg) [[> Px) || (ch ?? x)) {rx, ry; Gx, Gy}\"\napply (rule structSkipEL)\napply (rule structSkipELR)\napply (cut_tac H=\"l [=] Real 0\" and Hx=\"l [=] Real 0\" in CommunicationI1,auto)\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule RL3a)\napply (simp add: True_def)\napply (rule impR)\napply (rule basic)\napply (rule Parallel2)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule LL3a)\napply (rule conjL)\napply (rule thinL)\napply (cut_tac P=\"l [=] Real 0 [-->] Gx\" in cut,auto)\napply (rule thinL)\napply (rule thinR,auto)\napply (rule impL)\napply (rule basic)+\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule basic)\ndone\n\nlemma CommunicationI2a : \"[| ~inPairForm ([(x, e)], ry);\n |- Init [&] pre [<->] px;\n |- pre [&] Init [&] b [-->] FF;\n |- py [&] pre [&] close(FF) [&] close(b) [-->] (substF ([(x, e)]) (rx));\n |- py [-->] ry;\n |- (l[=]Real 0) [-->] Gx;\n |- (l[=]Real 0) [-->] Gy;\n contain(Px,(ch ?? x))|]\n ==> {px, py} (( ( :rg) [[> Px) || (ch !! e)) {rx, ry; Gx, Gy}\"\napply (rule structSkipEL)\napply (rule structSkipELR)\napply (cut_tac H=\"l [=] Real 0\" and Hx=\"l [=] Real 0\" in CommunicationI2,auto)\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule RL3a)\napply (simp add: True_def)\napply (rule impR)\napply (rule basic)\napply (rule Parallel2)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\napply (rule Skip)\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule LL3a)\napply (rule conjL)\napply (rule thinL)\napply (cut_tac P=\"l [=] Real 0 [-->] Gx\" in cut,auto)\napply (rule thinL)\napply (rule thinR,auto)\napply (rule impL)\napply (rule basic)+\napply (rule impR)\napply (rule basic)\napply (rule impR)\napply (rule basic)\ndone\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/HHLProver/HHL1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2650711198663969}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Title: Confinement_S\n * Description: confinement proof of the security model\n *)\n\ntheory Confine_S\nimports System_S\nbegin\n\n(* These translate Create into all_rights *)\ndefinition\n extra_rights :: \"cap \\ cap\" where\n \"extra_rights c \\\n if (Create \\ rights c)\n then c\\rights := all_rights\\\n else c\"\n\n\nlemma extra_rights_idem [simp]:\n \"(extra_rights (extra_rights c)) = (extra_rights c)\"\n apply (clarsimp simp add: extra_rights_def)\n done\n\nlemma extra_rights_image_idem [simp]:\n \"(extra_rights ` (extra_rights ` S)) = (extra_rights ` S)\"\n by (rule set_eqI) (simp add: image_iff)\n\nlemma extra_rights_empty_rights_ident [simp]:\n \"extra_rights \\ target = e, rights = {} \\ = \\ target = e, rights = {} \\\"\n by (simp add: extra_rights_def)\n\nlemma entity_extra_rights [simp]:\n \"target (extra_rights c) = target c\"\n by (simp add: extra_rights_def)\n\nlemma rights_extra_rights:\n \"rights (extra_rights c) =\n (if Create \\ (rights c)\n then all_rights\n else rights c)\"\n by (simp add: extra_rights_def)\n\n(* The following two definitions both translate Create into all_rights *)\n\n(* A cap is in a set, or a cap with more access is. *)\ndefinition\n cap_in_caps :: \"cap \\ cap set \\ bool\" (infix \"\\cap\" 50) where\n \"c \\cap C \\ \\c' \\ C. target c = target c' \\ rights (extra_rights c) \\ rights (extra_rights c')\"\n\nabbreviation not_cap_in_caps where\n \"not_cap_in_caps x A \\ ~ (x \\cap A)\" \\ \\non-membership\\\n\nnotation (input) cap_in_caps (infix \":cap\" 50)\nnotation (latex output) cap_in_caps (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\nnotation\n not_cap_in_caps (\"(\\cap)\") and\n not_cap_in_caps (\"(_/ \\cap _)\" [51, 51] 50)\n\nnotation (latex output)\n not_cap_in_caps (\"(\\\\<^sub>c\\<^sub>a\\<^sub>p)\") and\n not_cap_in_caps (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\n(* A set of caps \"caps\" have less (or equal) access to an entity as \"cap\" does. *)\ndefinition\n caps_dominated_by :: \"cap set \\ cap \\ bool\" (infix \"\\cap\" 50) where\n \"caps \\cap cap \\ \\cap' \\ caps. target cap' = target cap \\ rights (extra_rights cap') \\ rights (extra_rights cap)\"\n\nnotation (input) caps_dominated_by (infix \"<=cap\" 50)\nnotation (latex output) caps_dominated_by (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\ndefinition\n shares_caps :: \"state \\ entity_id \\ entity_id \\ bool\" where\n \"shares_caps s e\\<^sub>x e\\<^sub>y \\ \\e\\<^sub>i . (e\\<^sub>x, e\\<^sub>i) \\ store_connected s \\ (e\\<^sub>y, e\\<^sub>i) \\ store_connected s\"\n\ndefinition\n leak :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\ _\") where\n \"leak s e\\<^sub>x e\\<^sub>y \\ take_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\ grant_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\ shares_caps s e\\<^sub>x e\\<^sub>y\"\n\n\ndefinition\n directly_tgs_connected :: \"state \\ (entity_id \\ entity_id) set\" where\n \"directly_tgs_connected s \\ {(e\\<^sub>x, e\\<^sub>y). leak s e\\<^sub>x e\\<^sub>y \\ leak s e\\<^sub>y e\\<^sub>x}\"\n\nlemma directly_tgs_connected_def2:\n \"(e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s = (leak s e\\<^sub>x e\\<^sub>y \\ leak s e\\<^sub>y e\\<^sub>x)\"\n by (simp add: directly_tgs_connected_def)\n\nabbreviation\n in_directly_tgs_connected :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\ _\" [60,0,60] 61)\nwhere\n \"s \\ x \\ y \\ (x,y) \\ directly_tgs_connected s\"\n\ndefinition\n tgs_connected :: \"state \\ (entity_id \\ entity_id) set\" where\n \"tgs_connected s \\ (directly_tgs_connected s)\\<^sup>*\"\n\nabbreviation\n in_tgs_connected :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\* _\" [60,0,60] 61)\nwhere\n \"s \\ x \\* y == (x,y) \\ tgs_connected s\"\n\nnotation (latex output)\n in_tgs_connected (\"_ \\ _ \\\\<^sup>* _\" [60,0,60] 61)\n\ntranslations\n \"\\ (s \\ x \\ y)\" <= \"(x,y) \\ CONST directly_tgs_connected s\"\n \"\\ (s \\ x \\* y)\" <= \"(x,y) \\ CONST tgs_connected s\"\n\nlemma shares_caps_sym [simp]:\n \"shares_caps s y x = shares_caps s x y\"\n by (auto simp: shares_caps_def)\n\nlemma directly_tgs_connected_def4:\n \"s \\ e\\<^sub>x \\ e\\<^sub>y = (take_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\ take_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\\n grant_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\ grant_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\\n shares_caps s e\\<^sub>x e\\<^sub>y)\"\n by (auto simp: directly_tgs_connected_def leak_def)\n\n(* Note: e\\<^sub>0 is unused. *)\ndefinition\n generalOperation ::\n \"entity_id \\ entity_id \\ cap \\ right set \\ modify_state\" where\n \"generalOperation e\\<^sub>0 e\\<^sub>1 c r s \\\n s (e\\<^sub>1 \\ Entity ( insert (diminish r (extra_rights c)) (direct_caps_of s e\\<^sub>1) ))\"\n\nlemma is_entity_general [simp]:\n \"is_entity s e\\<^sub>1 \\ is_entity (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) e' = is_entity s e'\"\n by (simp add: is_entity_def generalOperation_def)\n\ndefinition\n make_entity :: \"entity_id \\ modify_state\" where\n \"make_entity n s \\\n s (n \\ null_entity)\"\n\nlemma direct_caps_of_store_connected_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e\n \\ store_connected s = store_connected s'\"\n by (simp add: store_connected_def store_connected_direct_def\n direct_caps_of_def)\n\nlemma direct_caps_of_caps_of_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e \\ caps_of s e = caps_of s' e\"\n by (simp add: caps_of_def store_connected_def store_connected_direct_def\n direct_caps_of_def)\n\nlemma direct_caps_of_caps_of_eq2:\n \"\\\\ e. direct_caps_of s e = direct_caps_of s' e; c \\cap caps_of s e\\ \\ c \\cap caps_of s' e\"\n apply (drule direct_caps_of_caps_of_eq)\n apply (simp add: cap_in_caps_def)\n by auto\n\nlemma direct_caps_of_directly_tgs_connected_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e \\ s \\ x \\ y = s' \\ x \\ y\"\n apply (simp add: directly_tgs_connected_def4 shares_caps_def)\n apply rule\n apply (erule disjE, drule (1) direct_caps_of_caps_of_eq2, clarsimp)+\n apply (drule direct_caps_of_store_connected_eq, clarsimp)\n apply (erule disjE, drule direct_caps_of_caps_of_eq2 [rotated, where s=s' and s'=s], simp+)+\n apply (drule direct_caps_of_store_connected_eq, simp)\n done\n\nlemma direct_caps_of_make_entity:\n \"\\ is_entity s n \\ direct_caps_of (make_entity n s) e = direct_caps_of s e\"\n by (simp add: direct_caps_of_def make_entity_def is_entity_def\n null_entity_def)\n\nlemma caps_of_make_entity:\n \"\\ is_entity s n \\ caps_of (make_entity n s) e = caps_of s e\"\n apply (rule direct_caps_of_caps_of_eq)\n apply clarsimp\n apply (erule direct_caps_of_make_entity)\n done\n\nlemma caps_of_make_entity2:\n \"\\\\ is_entity s n; c \\ caps_of (make_entity n s) e\\ \\ c \\ caps_of s e\"\n apply (drule caps_of_make_entity)\n apply fastforce\n done\n\nlemma directly_tgs_connected_make_entity:\n \"\\ is_entity s n \\ make_entity n s \\ x \\ y = s \\ x \\ y\"\n apply (rule direct_caps_of_directly_tgs_connected_eq)\n apply clarsimp\n apply (drule (1) direct_caps_of_make_entity)\n done\n\nlemma directly_tgs_connected_make_entity2:\n \"\\\\ is_entity s n; make_entity n s \\ x \\ y\\ \\ s \\ x \\ y\"\n apply (drule directly_tgs_connected_make_entity)\n apply fastforce\n done\n\nlemma diminish_extra_rights [simp]:\n \"diminish (rights c) (extra_rights c) = c\"\n by (simp add: diminish_def all_rights_def rights_extra_rights)\n\nlemma diminish_extra_rights2 [simp]:\n \"diminish (r \\ rights c) (extra_rights c) = diminish r c\"\n apply (simp add: diminish_def extra_rights_def all_rights_def)\n apply (simp add: Int_commute)\n apply (subgoal_tac \"rights c \\ (r \\ rights c) = r \\ rights c\")\n apply simp\n apply fastforce\n done\n\nlemma create_general_helper:\n \"Create \\ rights c\\<^sub>2 \\\n \\target = target c\\<^sub>2, rights = UNIV\\ = c\\<^sub>2\\rights := UNIV\\\"\n by auto\n\nlemma extra_rights_full_cap [simp]:\n \"extra_rights (full_cap e) = full_cap e\"\n by (simp add: extra_rights_def)\n\nlemma create_general_alt:\n \"createOperation e c\\<^sub>1 c\\<^sub>2 s =\n make_entity (target c\\<^sub>2)\n (generalOperation e (target c\\<^sub>1) (full_cap (target c\\<^sub>2)) (all_rights) s)\"\n by (simp add: createOperation_def generalOperation_def make_entity_def)\n\nlemma create_general:\n \"Create \\ rights c\\<^sub>2 \\ createOperation e c\\<^sub>1 c\\<^sub>2 s =\n make_entity (target c\\<^sub>2)\n (generalOperation e (target c\\<^sub>1) c\\<^sub>2 (all_rights) s)\"\n by (simp add: createOperation_def generalOperation_def make_entity_def\n full_cap_def all_rights_def diminish_def\n extra_rights_def create_general_helper null_entity_def)\n\nlemma take_general:\n \"takeOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation (target c\\<^sub>1) e c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: takeOperation_def generalOperation_def)\n\nlemma grant_general:\n \"grantOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation e (target c\\<^sub>1) c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: grantOperation_def generalOperation_def)\n\nlemma copy_general:\n \"copyOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation e (target c\\<^sub>1) c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: copyOperation_def generalOperation_def)\n\n(* Lemmas on the directly_tgs_connected predicate *)\nlemma directly_tgs_connected_comm:\n \"s \\ x \\ y \\ s \\ y \\ x\"\n by(auto simp: directly_tgs_connected_def)\n\nlemma tgs_connected_refl [simp]:\n \"s \\ x \\* x\"\n by (metis tgs_connected_def rtrancl.rtrancl_refl)\n\nlemma tgs_connected_comm:\n \"s \\ x \\* y \\ s \\ y \\* x\"\n apply(simp add: tgs_connected_def)\n apply(erule rtrancl_induct, simp)\n apply(case_tac \"s \\ z \\ y\")\n apply(simp add: directly_tgs_connected_comm)\n apply(simp add: directly_tgs_connected_comm)\n done\n\nlemma tgs_connected_comm_eq:\n \"s \\ x \\* y = s \\ y \\* x\"\n by (metis tgs_connected_comm)\n\nlemmas tgs_connected_trans =\n rtrancl_trans [where r=\"directly_tgs_connected s\" for s, simplified tgs_connected_def[symmetric]]\n\nlemmas directly_tgs_connected_rtrancl_into_rtrancl =\n rtrancl_into_rtrancl [where r=\"directly_tgs_connected s\" for s, simplified tgs_connected_def[symmetric]]\n\nlemma take_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Take \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def take_cap_def cap_in_caps_def extra_rights_def all_rights_def)\n\nlemma grant_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Grant \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def grant_cap_def cap_in_caps_def extra_rights_def all_rights_def)\n\nlemma create_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Create \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def cap_in_caps_def rights_extra_rights all_rights_def)\n\nlemma store_connected_directly_tgs_connected:\n \"(x, y) \\ store_connected s \\ s \\ x \\ y\"\n by (auto simp: directly_tgs_connected_def leak_def shares_caps_def store_connected_def)\n\n(* Lemmas on caps *)\n\nlemma cap_in_caps_insert [simp]:\n \"c \\cap insert c' S = (target c = target c' \\\n rights (extra_rights c) \\ rights (extra_rights c') \\ c \\cap S)\"\n by (simp add: cap_in_caps_def)\n\nlemma cap_in_caps_singleton [simp]:\n \"c \\cap {c'} = (target c = target c' \\ rights (extra_rights c) \\ rights (extra_rights c'))\"\n by (simp add: cap_in_caps_def)\n\nlemma not_in [simp]:\n \"{} \\cap c\"\n by(simp add: caps_dominated_by_def)\n\nlemma extra_rights_diminish:\n \"x \\ rights (extra_rights (diminish r c))\n \\ x \\ rights (extra_rights c)\"\n by (auto simp: rights_extra_rights all_rights_def split:if_split_asm)\n\n(* Lemmas on system operations *)\n\ndefinition\n in_store_connected :: \"state \\ entity_id \\ entity_id \\ bool\" where\n \"in_store_connected s x y \\ (x, y) \\ store_connected s\"\n\n(* Lemmas about the general operation *)\n\nlemma direct_caps_of_generalOp:\n \"direct_caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) e =\n (if e = e\\<^sub>1\n then insert (diminish r (extra_rights c)) (direct_caps_of s (e\\<^sub>1))\n else direct_caps_of s e)\"\n by (clarsimp simp: generalOperation_def direct_caps_of_def split:option.splits)\n\nlemma direct_caps_of_generalOp2:\n \"\\c' \\ direct_caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x\\ \\\n c' \\ direct_caps_of s x \\ (c' \\cap {c} \\ x = e\\<^sub>1)\"\n apply (clarsimp simp: direct_caps_of_generalOp extra_rights_diminish\n split:if_split_asm)\n apply (drule extra_rights_diminish)\n by simp\n\nlemma store_connected_direct_generalOp:\n \"\\(x, y) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s)\\ \\\n (x, y) \\ store_connected_direct s \\\n (x = e\\<^sub>1 \\ y = target c \\ Store \\ rights (extra_rights c))\"\n by (auto simp: store_connected_direct_def direct_caps_of_generalOp all_rights_def\n split: if_split_asm)\n\nlemma store_connected_generalOp:\n \"\\(x, y) \\ store_connected (generalOperation e\\<^sub>0 e\\<^sub>1 c r s)\\ \\\n (x, y) \\ store_connected s \\\n ((x, e\\<^sub>1) \\ store_connected s \\\n (e\\<^sub>1, target c) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) \\\n (target c, y) \\ store_connected s)\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply clarsimp\n apply (clarsimp)\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y, z) \\ store_connected_direct s\")\n apply (clarsimp simp: store_connected_def)\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (erule notE)\n apply fastforce\n apply (frule store_connected_direct_generalOp)\n apply (clarsimp simp: store_connected_def)\n done\n\n\nlemma store_connected_generalOp_not_new:\n \"\\(e\\<^sub>1, target c) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s);\n c \\ caps_of s e\\<^sub>0\\ \\\n (e\\<^sub>1, target c) \\ store_connected_direct s \\\n (e\\<^sub>0, target c) \\ store_connected s \\\n Create \\ rights c\"\n apply (drule store_connected_direct_generalOp)\n apply (clarsimp simp: rights_extra_rights split:if_split_asm)\n apply (drule (1) store_caps_store_connected, simp)\n done\n\nlemma store_connected_generalOp2:\n \"\\(x, y) \\ store_connected (generalOperation e\\<^sub>0 e\\<^sub>1 c r s);\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\ \\\n s \\ x \\* y\"\n apply (drule store_connected_generalOp)\n apply (erule disjE)\n apply (simp add: tgs_connected_def)\n apply (drule store_connected_directly_tgs_connected, simp)\n apply clarsimp\n apply (drule store_connected_directly_tgs_connected [where x=x and y=e\\<^sub>1])\n apply (drule store_connected_directly_tgs_connected [where x=\"target c\" and y=y])\n apply (drule (1) store_connected_generalOp_not_new)\n apply (erule disjE)\n apply (drule store_connected_direct_in_store_connected)\n apply (drule store_connected_directly_tgs_connected [where x=e\\<^sub>1 and y=\"target c\"])\n apply (simp add: tgs_connected_def)\n apply (drule directly_tgs_connected_comm [where x=\"e\\<^sub>0\" and y=\"e\\<^sub>1\"])\n apply (erule disjE)\n apply (drule store_connected_directly_tgs_connected [where x=e\\<^sub>0 and y=\"target c\"])\n apply (simp add: tgs_connected_def)\n apply (drule (1) create_caps_directly_tgs_connected)\n apply (simp add: tgs_connected_def)\n done\n\nlemma shares_caps_of_generalOp:\n \"\\shares_caps (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x y;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ s \\ x \\* y\"\n apply (clarsimp simp: shares_caps_def)\n apply (frule (2) store_connected_generalOp2 [where x=x])\n apply (drule (2) store_connected_generalOp2 [where x=y])\n apply (drule tgs_connected_comm [where x=y])\n apply (simp add: tgs_connected_def)\n done\n\nlemma caps_of_generalOp:\n \"\\c' \\ caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (simp add: caps_of_def[where e=x])\n apply clarsimp\n apply (frule (2) store_connected_generalOp2)\n apply (drule direct_caps_of_generalOp2)\n apply (erule disjE)\n apply (drule direct_cap_in_cap)\n apply (fastforce simp: cap_in_caps_def)\n apply (subgoal_tac \"s \\ x \\* e\\<^sub>0\")\n apply (subgoal_tac \"c' \\cap caps_of s e\\<^sub>0\")\n apply fastforce\n apply (fastforce simp: cap_in_caps_def)\n apply clarsimp\n apply (drule directly_tgs_connected_comm [where x=\"e\\<^sub>0\" and y=\"e\\<^sub>1\"])\n apply (simp add: tgs_connected_def)\n done\n\nlemma take_cap_generalOp:\n \"\\take_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. s \\ x \\* z \\ take_cap y \\cap caps_of s z\"\n apply (simp add: cap_in_caps_def)\n apply clarsimp\n apply (drule (2) caps_of_generalOp)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma grant_cap_generalOp:\n \"\\grant_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. s \\ x \\* z \\ grant_cap y \\cap caps_of s z\"\n apply (simp add: cap_in_caps_def)\n apply clarsimp\n apply (drule (2) caps_of_generalOp)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma take_cap_generalOp2:\n \"\\take_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ (x, y) \\ tgs_connected s\"\n apply (drule (2) take_cap_generalOp)\n apply clarsimp\n apply (subgoal_tac \"s \\ z \\ y\")\n apply (simp add: tgs_connected_def)\n apply (simp add: directly_tgs_connected_def leak_def)\n done\n\nlemma grant_cap_generalOp2:\n \"\\grant_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ (x, y) \\ tgs_connected s\"\n apply (drule (2) grant_cap_generalOp)\n apply clarsimp\n apply (subgoal_tac \"s \\ z \\ y\")\n apply (simp add: tgs_connected_def)\n apply (simp add: directly_tgs_connected_def leak_def)\n done\n\nlemma generalOp_directly_tgs_connected:\n \"\\generalOperation e\\<^sub>0 e\\<^sub>1 c r s \\ x \\ y;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ s \\ x \\* y\"\n apply (simp add: directly_tgs_connected_def [where s=\"generalOperation e\\<^sub>0 e\\<^sub>1 c r s\"] leak_def)\n apply safe\n apply (rule tgs_connected_comm)\n apply (drule (3) take_cap_generalOp2)\n apply (drule (3) grant_cap_generalOp2)\n apply (erule (2) shares_caps_of_generalOp)\n apply (drule (3) take_cap_generalOp2)\n apply (rule tgs_connected_comm)\n apply (drule (3) grant_cap_generalOp2)\n apply (erule (2) shares_caps_of_generalOp)\n done\n\n\n\n(* results from general operation *)\n\nlemma create_legal_directly_tgs_connected:\n \"legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s \\ s \\ target c\\<^sub>1 \\ e\"\n apply clarsimp\n apply (rule directly_tgs_connected_comm)\n apply (drule (1) create_caps_directly_tgs_connected)\n apply (drule (1) store_caps_store_connected)\n apply (drule (1) store_connected_directly_tgs_connected)\n done\n\nlemma take_legal_directly_tgs_connected:\n \"legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ target c\\<^sub>1 \\ e\"\n apply clarsimp\n apply (rule directly_tgs_connected_comm)\n apply (drule (2) take_caps_directly_tgs_connected)\n done\n\nlemma grant_legal_directly_tgs_connected:\n \"legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ e \\ target c\\<^sub>1\"\n apply clarsimp\n apply (drule (2) grant_caps_directly_tgs_connected)\n done\n\nlemma copy_legal_directly_tgs_connected:\n \"legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ e \\ target c\\<^sub>1\"\n apply clarsimp\n apply (drule (1) store_caps_store_connected)\n apply (drule (1) store_connected_directly_tgs_connected)\n done\n\nlemma caps_of_create:\n \"\\c' \\ caps_of (createOperation e c\\<^sub>1 c\\<^sub>2 s) x; legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule create_legal_directly_tgs_connected)\n apply (clarsimp simp: create_general)\n apply (drule caps_of_make_entity2 [rotated], clarsimp)\n apply (drule (1) caps_of_generalOp)\n apply (drule (2) directly_tgs_connected_comm)\n done\n\nlemma caps_of_take:\n \"\\c' \\ caps_of (takeOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule take_legal_directly_tgs_connected)\n apply (clarsimp simp: take_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma caps_of_grant:\n \"\\c' \\ caps_of (grantOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule grant_legal_directly_tgs_connected)\n apply (clarsimp simp: grant_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma caps_of_copy:\n \"\\c' \\ caps_of (copyOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule copy_legal_directly_tgs_connected)\n apply (clarsimp simp: copy_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma create_directly_tgs_connected:\n \"\\createOperation e c\\<^sub>1 c\\<^sub>2 s \\ x \\ y; legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s\\\n \\ s \\ x \\* y\"\n apply (frule create_legal_directly_tgs_connected)\n apply (clarsimp simp: create_general)\n apply (drule directly_tgs_connected_make_entity2 [rotated], clarsimp)\n apply (drule (1) generalOp_directly_tgs_connected)\n apply (drule (2) directly_tgs_connected_comm)\n done\n\nlemma take_directly_tgs_connected:\n \"\\takeOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule take_legal_directly_tgs_connected)\n apply (clarsimp simp: take_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\nlemma grant_directly_tgs_connected:\n \"\\grantOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule grant_legal_directly_tgs_connected)\n apply (clarsimp simp: grant_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\nlemma copy_directly_tgs_connected:\n \"\\copyOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule copy_legal_directly_tgs_connected)\n apply (clarsimp simp: copy_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\n\n\nlemma create_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysCreate e c\\<^sub>1 c\\<^sub>2)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule create_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma take_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysTake e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule take_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma grant_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysGrant e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule grant_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma copy_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysCopy e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule copy_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\n(* Lemmas about destroy *)\n\nlemma direct_caps_of_destroy:\n \"c \\ direct_caps_of (s(e := None)) x \\ c \\ direct_caps_of s x\"\n by (simp add: direct_caps_of_def split: option.splits split: if_split_asm)\n\nlemma store_connected_destroy:\n \"(x, y) \\ store_connected (s(e := None)) \\ (x, y) \\ store_connected s\"\n apply (simp add: store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (fastforce simp: store_connected_def)\n apply (simp add: store_connected_direct_def)\n apply clarsimp\n by (metis direct_caps_of_destroy)\n\nlemma shares_caps_destroy:\n \"shares_caps (destroyOperation e c s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def destroyOperation_def)\n apply (frule store_connected_destroy [where x=x])\n apply (drule store_connected_destroy [where x=y])\n by auto\n\nlemma caps_of_destroy:\n \"c \\ caps_of (destroyOperation e' c' s) e \\\n c \\ caps_of s e\"\n apply (clarsimp simp add: destroyOperation_def caps_of_def)\n apply (rule_tac x=x in exI)\n apply (drule direct_caps_of_destroy)\n apply simp\n apply (erule store_connected_destroy)\n done\n\nlemma destroy_directly_tgs_connected:\n \"\\s' \\ step (SysDestroy e c) s; (x, y) \\ directly_tgs_connected s'\\ \\\n (x, y) \\ directly_tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply (drule shares_caps_destroy, simp)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (drule shares_caps_destroy, simp)\n done\n\nlemma destroy_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysDestroy e c)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: destroy_directly_tgs_connected)\n\n\n(* lemmas about remove *)\n\nlemma direct_caps_of_remove:\n \"c \\ direct_caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\\n c \\ direct_caps_of s x\"\n by (clarsimp simp: removeOperation_simpler direct_caps_of_def\n split: option.splits if_split_asm)\n\nlemma direct_caps_of_remove_eq:\n \"direct_caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x =\n ( if is_entity s (target c\\<^sub>1) \\ x = target c\\<^sub>1\n then direct_caps_of s (target c\\<^sub>1) - {c\\<^sub>2}\n else direct_caps_of s x )\"\n by(simp add: direct_caps_of_def is_entity_def removeOperation_def)\n\nlemma store_connected_remove [rule_format]:\n \"(x, y) \\ store_connected (s(e \\ Entity C')) \\\n s e = Some (Entity C) \\ C' \\ C \\ (x, y) \\ store_connected s\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply clarsimp\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (erule rtrancl_trans)\n apply fastforce\n apply (fold store_connected_def)\n apply (clarsimp simp add: store_connected_direct_def)\n apply (fastforce simp: direct_caps_of_def\n split: option.splits if_split_asm)\n done\n\nlemma caps_of_remove:\n \"c \\ caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\\n c \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_remove)\n apply (simp add: removeOperation_simpler\n split: option.splits)\n apply (erule (1) store_connected_remove)\n apply blast\n done\n\n(* Might equal either \"caps s (target c\\<^sub>1) - {c\\<^sub>2}\" or \"caps s x\" depending if the caps are duplicated.*)\nlemma caps_of_remove2:\n \"caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\ caps_of s x\"\n apply(simp add: caps_of_def is_entity_def removeOperation_def direct_caps_of_def)\n apply (clarsimp split: if_split_asm)\n apply (auto dest!: store_connected_remove)\n done\n\nlemma shares_caps_remove:\n \"shares_caps (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def removeOperation_simpler\n split:option.splits)\n apply (frule (1) store_connected_remove [where x=x], clarsimp)\n apply (drule (1) store_connected_remove [where x=y], clarsimp)\n by auto\n\nlemma remove_directly_tgs_connected:\n \"\\s' \\ step (SysRemove e c\\<^sub>1 c\\<^sub>2) s; (x, y) \\ directly_tgs_connected s'\\ \\\n (x, y) \\ directly_tgs_connected s\"\n apply(simp add: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply(simp add: cap_in_caps_def)\n apply(clarsimp)\n apply safe\n prefer 3\n apply (drule shares_caps_remove, simp)\n prefer 5\n apply (drule shares_caps_remove, simp)\n apply(auto dest!: caps_of_remove)\n done\n\nlemma remove_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysRemove e c\\<^sub>1 c\\<^sub>2)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: remove_directly_tgs_connected)\n\nlemma direct_caps_of_removeSet:\n \"c' \\ direct_caps_of (removeSetOperation e c C s) x \\\n c' \\ direct_caps_of s x\"\n by (clarsimp simp: removeSetOperation_simpler direct_caps_of_def\n split: option.splits if_split_asm)\n\nlemma caps_of_removeSet:\n \"c' \\ caps_of (removeSetOperation e c C s) x \\\n c' \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_removeSet)\n apply (simp add: removeSetOperation_simpler split: option.splits)\n apply (erule (1) store_connected_remove)\n apply blast\n done\n\nlemma shares_caps_removeSet:\n \"shares_caps (removeSetOperation e c C s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def removeSetOperation_simpler split:option.splits)\n apply (frule (1) store_connected_remove [where x=x], clarsimp)\n apply (drule (1) store_connected_remove [where x=y], clarsimp)\n by auto\n\nlemma removeSet_connected:\n \" \\s' \\ step (SysRemoveSet e c C) s; s' \\ x \\ y\\ \\ s \\ x \\ y\"\n apply(simp add: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply(simp add: cap_in_caps_def)\n apply(clarsimp)\n apply safe\n prefer 3\n apply (drule shares_caps_removeSet, simp)\n prefer 5\n apply (drule shares_caps_removeSet, simp)\n apply (auto dest!: caps_of_removeSet)\n done\n\nlemma removeSet_conTrans:\n \"\\s' \\ step cmd s; s' \\ x \\ y; cmd = (SysRemoveSet n c C)\\\n \\ s \\ x \\ y\"\n by(auto dest!: removeSet_connected)\n\n(* lemmas about revoke *)\nlemma direct_caps_of_removeSetOfCaps:\n \"c' \\ direct_caps_of (removeSetOfCaps cap_map s) x \\\n c' \\ direct_caps_of s x\"\n by (clarsimp simp: removeSetOfCaps_def direct_caps_of_def\n split: option.splits if_split_asm)\nthm store_connected_remove\n\nlemma store_connected_removeSetOfCaps:\n \"(x, y) \\ store_connected (\\e. if is_entity s e\n then Some (Entity (direct_caps_of s e - cap_map e))\n else None) \\\n (x, y) \\ store_connected s\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (erule rtrancl_trans)\n apply fastforce\n apply (fold store_connected_def)\n apply (clarsimp simp add: store_connected_direct_def)\n apply (fastforce simp: direct_caps_of_def\n split: option.splits if_split_asm)\n done\n\nlemma caps_of_removeSetOfCaps:\n \"c' \\ caps_of (removeSetOfCaps cap_map s) x \\\n c' \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_removeSetOfCaps)\n apply (simp add: removeSetOfCaps_def split: option.splits)\n apply (erule store_connected_removeSetOfCaps)\n done\n\nlemma caps_of_revoke:\n \"\\s' \\ revokeOperation sub c\\<^sub>1 s ; c \\ caps_of s' e \\\n \\ c \\ caps_of s e\"\n apply (clarsimp simp: revokeOperation_def\n split: if_split_asm)\n apply (drule (1) caps_of_removeSetOfCaps)\n done\n\nlemma direct_caps_of_revoke:\n \"\\s' \\ revokeOperation e c s; c' \\ direct_caps_of s' x\\\n \\ c' \\ direct_caps_of s x\"\n apply (clarsimp simp: revokeOperation_def\n split: if_split_asm)\n apply (drule (1) direct_caps_of_removeSetOfCaps)\n done\n\nlemma store_connected_revoke:\n \"\\(x, y) \\ store_connected s'; s' \\ revokeOperation e c s\\\n \\ (x, y) \\ store_connected s\"\n apply (simp add: store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (fastforce simp: store_connected_def)\n apply (clarsimp simp: store_connected_direct_def)\n apply (metis direct_caps_of_revoke)\n done\n\nlemma shares_caps_revoke:\n \"\\shares_caps s' x y; s' \\ revokeOperation e c s\\\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def)\n apply (frule (1) store_connected_revoke [where x=x])\n apply (drule (1) store_connected_revoke [where x=y])\n by auto\n\nlemma removeOperation_entity_ids [simp]:\n \"is_entity (removeOperation e c c' s) e' = is_entity s e'\"\n by (simp add: is_entity_def removeOperation_def)\n\nlemma removeSetOfCaps_entity_ids [simp]:\n \"is_entity (removeSetOfCaps cap_map s) e' = is_entity s e'\"\n by (simp add: is_entity_def removeSetOfCaps_def)\n\nlemma revoke_entities:\n \"s' \\ revokeOperation sub c\\<^sub>1 s \\ is_entity s' e = is_entity s e\"\n by (clarsimp simp: revokeOperation_def split: if_split_asm)\n\nlemma revoke_directly_tgs_connected:\n \"\\s' \\ step (SysRevoke n c\\<^sub>1) s; (x, y) \\ directly_tgs_connected s'\\\n \\ (x, y) \\ directly_tgs_connected s\"\n apply (simp add: step_def split: if_split_asm)\n apply (erule disjE, simp)\n apply (simp add: directly_tgs_connected_def leak_def)\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply (drule (1) shares_caps_revoke, simp)\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (drule (1) shares_caps_revoke, simp)\n done\n\nlemma revoke_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysRevoke n c\\<^sub>1)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: revoke_directly_tgs_connected)\n\n\n\n(* lemmas about grant *)\n\nlemma is_entity_grant [simp]:\n \"is_entity s (target c\\<^sub>1) \\\n is_entity (grantOperation e c\\<^sub>1 c\\<^sub>2 r s) e' = is_entity s e'\"\n by (simp add: is_entity_def grantOperation_def)\n\nlemma is_entity_destroy:\n \"is_entity (destroyOperation e' c s) e \\ is_entity s e\"\n by (simp add: destroyOperation_def is_entity_def split: if_split_asm)\n\n\n(********************************************\n ********************************************\n ***** Connected transitively preserved *****\n ********************************************\n ********************************************)\n\nlemma connected_tgs_connected:\n \"\\s' \\ step cmd s; (e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s'\\ \\\n (e\\<^sub>x, e\\<^sub>y) \\ tgs_connected s\"\n apply(case_tac \"(e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s\")\n apply(simp add: tgs_connected_def)\n apply(case_tac cmd)\n apply(rule create_conTrans, fastforce+)\n apply(rule take_conTrans, fastforce+)\n apply(rule grant_conTrans, fastforce+)\n apply(frule copy_conTrans, fastforce+)\n apply(frule remove_conTrans, fastforce+)\n apply(frule removeSet_conTrans, fastforce+)\n apply(frule revoke_conTrans, fastforce+)\n apply(frule destroy_conTrans, fastforce+)\n done\n\nlemma tgs_connected_preserved_step:\n \"\\s' \\ step cmd s; s' \\ x \\* z\\ \\ s \\ x \\* z\"\n thm rtrancl_induct [where r=\"directly_tgs_connected s'\" and a=x and b=z and P=\"\\z. (x, z) \\ (directly_tgs_connected s)\\<^sup>*\", simplified,\n simplified tgs_connected_def [symmetric]]\n apply(erule rtrancl_induct [where r=\"directly_tgs_connected s'\",\n simplified tgs_connected_def [symmetric]], simp)\n apply(case_tac \"s \\ y \\* z\")\n apply (erule (1) tgs_connected_trans)\n apply (simp add: connected_tgs_connected)\n done\n\nlemma leakImplyConnected:\n \"leak s\\<^sub>i e\\<^sub>x e\\<^sub>i \\ (e\\<^sub>x, e\\<^sub>i) \\ directly_tgs_connected s\\<^sub>i\"\n by(simp add: directly_tgs_connected_def)\n\nlemma leakImplyConnectedTrans:\n \"leak s\\<^sub>i e\\<^sub>x e\\<^sub>i \\ (e\\<^sub>x, e\\<^sub>i) \\ tgs_connected s\\<^sub>i\"\n by(simp add: tgs_connected_def, frule leakImplyConnected, auto)\n\n\nlemma tgs_connected_preserved [rule_format]:\n \"\\s'. s' \\ execute cmds s \\\n s' \\ x \\* y \\\n s \\ x \\* y\"\n apply(induct_tac cmds, simp)\n apply clarsimp\n apply(rename_tac cmd cmds s'' s')\n apply(erule_tac x=s' in allE)\n apply(simp add: tgs_connected_preserved_step)\n done\n\nlemma leak_conTrans [rule_format]:\n \"\\s \\ execute cmds s\\<^sub>0; leak s x y\\\n \\ (x, y) \\ tgs_connected s\\<^sub>0\"\n by (auto intro: leakImplyConnectedTrans tgs_connected_preserved)\n\nlemma leakage_rule:\n \"\\s' \\ execute cmds s; \\ s \\ x \\* y\\ \\ \\ (s' \\ x \\ y)\"\n by(auto simp add: leak_conTrans)\n\n\n\n\n(*******************************************\n *******************************************\n ***** Authority confinement *****\n *******************************************\n *******************************************)\n\nlemma caps_of_op:\n \"\\s' \\ step cmd s; c' \\ caps_of s' x\\\n \\ \\z. s \\ x \\* z \\ c' \\cap caps_of s z\"\n apply (simp add: step_def split:if_split_asm)\n prefer 2\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (erule disjE)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (case_tac cmd)\n apply (simp add: caps_of_create)\n apply (simp add: caps_of_take)\n apply (simp add: caps_of_grant)\n apply (simp add: caps_of_copy)\n apply (clarsimp, drule caps_of_remove)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule caps_of_removeSet)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule (1) caps_of_revoke)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule caps_of_destroy)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n done\n\nlemma authority_confinement_induct_step:\n \"\\s' \\ step cmd s;\n \\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c\\\n \\ caps_of s' e\\<^sub>x \\cap c\"\n apply (clarsimp simp: caps_dominated_by_def)\n apply (drule (1) caps_of_op)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma authority_confinement_helper:\n \"s' \\ execute cmds s \\\n (\\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c) \\\n (\\e\\<^sub>i. s' \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s' e\\<^sub>i \\cap c)\"\nproof (induct cmds arbitrary: s')\ncase Nil\n show ?case by clarsimp\nnext\ncase (Cons cmd cmds s')\nshow ?case\n apply clarsimp\n apply (rule authority_confinement_induct_step, assumption)\n apply clarsimp\n apply (rule Cons.hyps[rule_format], simp_all)\n apply (drule(1) tgs_connected_preserved_step)\n apply (simp add: tgs_connected_def)\n done\nqed\n\nlemma authority_confinement:\n \"\\s' \\ execute cmds s;\n \\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c\\\n \\ caps_of s' e\\<^sub>x \\cap c\"\n by (erule authority_confinement_helper [rule_format, where e\\<^sub>x=e\\<^sub>x], simp_all)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/take-grant/Confine_S.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863695, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.26484794350879737}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ClosureEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory ClosureEx\nimports \"../Vcg\" \"../Simpl_Heap\" Closure\nbegin\n\n\nrecord globals = \n cnt_' :: \"ref \\ nat\"\n alloc_' :: \"ref list\"\n free_' :: \"nat\"\nrecord 'g vars = \"'g state\" +\n p_':: ref\n r_':: nat\n n_':: nat\n m_':: nat\n c_':: \"(string \\ ref) list \\ string\"\n d_':: \"(string \\ ref) list \\ string\"\n e_':: \"(string \\ nat) list \\ string\"\n\n\ndefinition \"var\\<^sub>n = [''n''\\ (\\x. n_'_update (\\_. x)),\n ''m''\\ (\\x. m_'_update (\\_. x))]\"\ndefinition \"upd\\<^sub>n = gen_upd var\\<^sub>n\"\n\nlemma upd\\<^sub>n_ap: \"upd\\<^sub>n (fst (ap es (es',p))) = upd\\<^sub>n es' \\ upd\\<^sub>n es\"\n by (simp add: upd\\<^sub>n_def gen_upd_ap)\n\n\nlemma\n\"\\\\\\\\n=n\\<^sub>0 \\ (\\i j. \\\\ \\\\n=i \\ \\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=i + j\\)\\ \n \\e :== (ap [(''n'',\\n)] \\e) \n \\\\j. \\\\ \\\\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=n\\<^sub>0 + j\\\\\"\napply vcg_step\napply clarify\napply (rule ap_closure [where var=var\\<^sub>n, folded upd\\<^sub>n_def])\napply clarsimp\napply (rename_tac s s')\napply (erule_tac x=\"n_' s\" in allE) \napply (erule_tac x=\"m_' s'\" in allE) \napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply (simp add: upd\\<^sub>n_def gen_upd_def var\\<^sub>n_def)\ndone\n\n\ndefinition \"var = [''p''\\ (\\x. p_'_update (\\_. x))]\"\ndefinition \"upd = gen_upd var\"\n\nprocedures Inc(p|r) =\n \"\\p\\\\cnt :== \\p\\\\cnt + 1;;\n \\r :== \\p\\\\cnt\"\n\nlemma (in Inc_impl)\n \"\\i p. \\\\ \\\\p\\\\cnt = i\\ \\r :== PROC Inc(\\p) \\\\r=i+1 \\ \\p\\\\cnt = i+1\\\"\n apply vcg\n apply simp\n done\n \nprocedures (imports Inc_signature) NewCounter(|c) =\n\"\\p :== NEW 1 [\\cnt :== 0];;\n \\c :== ([(''p'',\\p)],Inc_'proc)\" \n\n\nlocale NewCounter_impl' = NewCounter_impl + Inc_impl\nlemma (in NewCounter_impl')\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\n\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\nshows NewCounter_spec:\n \"\\alloc. \\\\ \\1 \\ \\free \\ \\alloc=alloc\\ \\c :== PROC NewCounter() \n \\\\p. p \\ set alloc \\ p \\ set \\alloc \\ p \\ Null \\ p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply clarsimp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\n\n\nlemma \"\\\\\\\\p. p \\ Null \\ p\\\\cnt = i \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=i+1\\\"\napply (rule conseq_extract_pre)\napply clarify\napply (rule dynCallClosureFix)\napply (simp only: Ball_def)\nprefer 3\napply (assumption)\nprefer 2\napply vcg_step\napply vcg_step\napply (simp only: simp_thms)\napply clarsimp\ndone\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=1\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (erule_tac x=0 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply simp\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\));;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=2\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\n\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n \\d :== \\c;;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\n_' := r_' t\\));;\n dynCallClosure (\\s. s) upd d_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\m_' := r_' t\\));;\n \\r :== \\n + \\m\n \\\\r=3\\\"\n\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\nend", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/ClosureEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2648290649809923}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory CustomWordAbs\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"custom_word_abs.c\"\ninstall_C_file \"custom_word_abs.c\"\n\nlemma [word_abs]:\n \"\\ abstract_val P x sint x'; abstract_val Q y sint y' \\ \\\n abstract_val (P \\ Q) (max x y)\n sint (x' xor (x' xor y') && - (if x' abstract_val P x unat x'; abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q \\ y < 32) (x mod (2 ^ y)) unat (x' && 2 ^ unat y' - (1 :: word32))\"\n apply (clarsimp simp del: shiftl_1 simp: shiftl_1 [symmetric])\n apply (fold mask_def)\n apply (subst word_mod_2p_is_mask [symmetric])\n apply (subst p2_gt_0)\n by (auto simp: unat_mod)\n\nlemma [word_abs]:\n \"\\ abstract_val P x unat (x' :: word32);\n abstract_val Q y unat y' \\ \\\n abstract_val (P \\ Q) (x + y > UINT_MAX) id (x' + y' < x')\"\n apply (subst not_le [symmetric], subst no_plus_overflow_unat_size)\n apply (clarsimp simp: not_less UINT_MAX_def word_size)\n apply arith\n done\n\nautocorres [unsigned_word_abs = b c] \"custom_word_abs.c\"\n\ncontext custom_word_abs begin\n\nlemma \"a' x y = max x y\"\n by (unfold a'_def, rule refl)\n\nlemma \"b' x 4 s = Some (x mod 16)\"\n by (unfold b'_def, simp)\n\nlemma \"c' x y = (if UINT_MAX < x + y then 1 else 0)\"\n by (unfold c'_def, simp)\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/autocorres/tests/proof-tests/CustomWordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.264578410197588}} {"text": "(* trans_semantics.thy *)\n(* William Mansky *)\n(* Semantics for the revised specification language PTRANS. *)\n\ntheory trans_semantics\nimports trans_flowgraph\nbegin\n\n(* matches a total valuation of metavariables with a partial one *)\ndefinition part_matches where \"part_matches \\ t \\ \\x y. t x = Some y \\ \\ x = y\"\n\n(* extends a partial valuation with another valuation over a given domain *)\ndefinition part_extend where \"part_extend t d \\ \\ \\x. if x\\d then Some (\\ x) else t x\"\n\n(* The pieces that must be provided by the target language to give semantics to transformations. *) \nlocale TRANS_basics = (* give SCEx a type annotation, parameterize by 'valuation? *)\n fixes subst::\"(('thread, ('node, 'edge_type, 'instr) flowgraph) map) \\ ('metavar \\ 'object) \\ 'pattern \\ 'instr\"\n and node_subst::\"(('thread, ('node, 'edge_type, 'instr) flowgraph) map) \\ ('metavar \\ 'object) \\ \n 'metavar node_lit \\ 'node\"\n and type_subst::\"('metavar \\ 'object) \\ 'edge_type_expr \\ 'edge_type\"\n and pred_fv::\"'pred \\ 'metavar set\"\n and eval_pred::\"(('thread, ('node, 'edge_type, 'instr) flowgraph) map) \\ ('thread, 'node) map \\ \n ('metavar \\ 'object) \\ 'pred \\ bool\"\n and instr_edges::\"'instr \\ ('edge_type \\ nat) set\" \n and Seq::'edge_type\n assumes infinite_nodes [simp]: \"\\finite (UNIV::'node set)\"\n and infinite_mvars [simp]: \"\\finite (UNIV::'metavar set)\"\n and pred_same_subst: \"\\\\x\\pred_fv p. \\ x = \\' x; pre_tCFG CFGs\\ \\ \n eval_pred CFGs q \\ p = eval_pred CFGs q \\' p\"\nbegin\n\nlemmas fresh_nodes = infinite_nodes [THEN fresh_new]\nlemmas fresh_mvars = infinite_mvars [THEN fresh_new]\n\nprimrec subst_list where\n\"subst_list G \\ [] = Some []\" | \n\"subst_list G \\ (p # rest) = (case (subst G \\ p, subst_list G \\ rest) of \n (Some i, Some irest) \\ Some (i # irest) | _ \\ None)\"\n\nprimrec models where\n\"models _ _ _ SCTrue = True\" |\n\"models CFGs \\ q (SCPred p) = eval_pred CFGs q \\ p\" |\n\"models CFGs \\ q (\\1 \\sc \\2) = (models CFGs \\ q \\1 \\ models CFGs \\ q \\2)\" |\n\"models CFGs \\ q (\\sc \\) = (\\models CFGs \\ q \\)\" |\n\"models CFGs \\ q (A \\1 \\ \\2) = (\\l \\ pre_tCFG.Paths CFGs q. \\i. models CFGs \\ (l i) \\2 \\\n (\\j (l j) \\1))\" |\n\"models CFGs \\ q (E \\1 \\ \\2) = (\\l \\ pre_tCFG.Paths CFGs q. \\i. models CFGs \\ (l i) \\2 \\\n (\\j (l j) \\1))\" |\n\"models CFGs \\ q (A \\1 \\ \\2) = (\\l \\ pre_tCFG.RPaths CFGs q. \\i. models CFGs \\ (l i) \\2 \\\n (\\j (l j) \\1))\" |\n\"models CFGs \\ q (E \\1 \\ \\2) = (\\l \\ pre_tCFG.RPaths CFGs q. \\i. models CFGs \\ (l i) \\2 \\\n (\\j (l j) \\1))\" |\n\"models CFGs \\ q (SCEx x \\) = (\\obj. models CFGs (\\(x := obj)) q \\)\"\n\nabbreviation \"side_cond_sf \\ \\ CFGs \\ models CFGs \\ (start_points CFGs) \\\"\n\nlemma cond_same_subst: \"\\\\x\\cond_fv pred_fv P. \\ x = \\' x; pre_tCFG CFGs\\ \\ \n models CFGs \\ q P = models CFGs \\' q P\"\napply (induct P arbitrary: \\ \\' q, simp+)\napply (erule pred_same_subst, simp)\napply (metis (lifting, mono_tags) UnI1 UnI2 cond_fv.simps(3) models.simps(3))\napply simp\napply (smt UnI1 UnI2 cond_fv.simps(5) models.simps(5))\napply (smt UnI1 UnI2 cond_fv.simps(6) models.simps(6))\napply (smt UnI1 UnI2 cond_fv.simps(7) models.simps(7))\napply (smt UnI1 UnI2 cond_fv.simps(8) models.simps(8))\napply auto\napply (rule_tac x=obj in exI, smt DiffI fun_upd_def singletonE)+\ndone\n\nlemma cond_gen: \"\\models CFGs \\ q P; \\x\\cond_fv pred_fv P. \\ x = \\' x; pre_tCFG CFGs\\ \\ \n models CFGs \\' q P\"\nby (drule cond_same_subst, simp, force)\n\nend\n\n(* Utility functions for actions. *)\nfun update_list where\n\"update_list f [] = f\" |\n\"update_list f ((x,y) # rest) = update_list (f(x := y)) rest\"\n\nlemma update_list_past [simp]: \"x \\ fst ` set l \\ update_list f l x = f x\"\nby (induct l arbitrary: f, auto)\n\nlemma update_list_i: \"\\distinct (map fst l); (x, y) \\ set l\\ \\ update_list f l x = y\"\nby (induct l arbitrary: f, auto)\n\ndefinition \"remap_succ x y e \\ let (n,s,t) = e in if x = n then (y,s,t) else e\"\n\ncontext TRANS_basics begin\n\ndefinition \"rep_edges es ll \\ if ll = [] then es else\n {remap_succ (hd ll) (last ll) e | e. e\\es} \\\n {(u,v,Seq) | u v. (\\a. ll!a = u \\ ll!(a+1) = v \\ (a+1) < length ll)}\"\n\nlemma rep_one_edge [simp]: \"rep_edges es [n] = es\"\nby (auto simp add: rep_edges_def remap_succ_def)\n\nlemma rep_edges_out [simp]: \"n \\ set ll \\ ((n, b, c) \\ rep_edges es ll) = ((n, b, c) \\ es)\"\nby (auto simp add: rep_edges_def remap_succ_def, force+)\n\nlemma rep_out_edges_out [simp]: \"n \\ set ll \\ out_edges (rep_edges es ll) n = out_edges es n\"\nby (simp add: out_edges_def)\n\nlemma rep_out_edges_in: \"\\n = ll ! i; i < length ll - 1; distinct ll; i = 0 \\ (\\n' e. (n, n', e) \\ es)\\ \\ \n out_edges (rep_edges es ll) n = {(ll ! (i + 1), Seq)}\"\napply (clarsimp simp add: rep_edges_def remap_succ_def out_edges_def)\napply (case_tac \"ll = []\", simp+)\napply (simp add: last_conv_nth, rule set_eqI, rule iffI, clarsimp)\napply (erule_tac Q=\n \"b = Seq \\ (\\aa. ll ! aa = ll ! i \\ ll ! Suc aa = a \\ Suc aa < length ll)\"\n in disjE, clarsimp)\n(* I think this works in 2015, while the above works in 2014, argh!\napply (erule_tac P=\"\\aa. _ aa\" in disjE, clarsimp)\n*)\napply (case_tac \"hd ll = aa\", simp add: nth_eq_iff_index_eq, force simp add: hd_conv_nth)\napply (clarsimp simp add: nth_eq_iff_index_eq)\napply auto\ndone\n\ncorollary rep_out_edge_in: \"\\(n, n', e) \\ rep_edges es ll; n = ll ! i; i < length ll - 1; distinct ll; \n i = 0 \\ (\\n' e. (n, n', e) \\ es)\\ \\ n' = ll ! (i + 1) \\ e = Seq\"\napply (frule rep_out_edges_in, simp+)\nby (metis out_edge prod.sel(1) prod.sel(2) singletonD)\n\nlemma rep_out_edges_last: \"\\n = last ll; ll \\ []; distinct ll; \\n' e. (n, n', e) \\ es\\ \\ \n out_edges (rep_edges es ll) n = out_edges es (hd ll)\"\napply (clarsimp simp add: rep_edges_def remap_succ_def out_edges_def)\napply (rule set_eqI, rule iffI, clarsimp)\napply (erule disjE, clarsimp)\napply (case_tac \"hd ll = aa\", clarsimp+)\napply (simp add: last_conv_nth nth_eq_iff_index_eq)\napply (clarsimp simp add: nth_eq_iff_index_eq)\napply auto\ndone\n\nlemma rep_out_by_t [simp]: \"n \\ set ll \\ out_by_t (rep_edges es ll) t n = out_by_t es t n\"\nby (simp add: out_edges_by_t)\n\n(* Actions are defined by their effects on one of the CFGs in a tCFG. *)\nfun action_sf where\n\"action_sf (AAddEdge n m e) \\ CFGs = (case (node_subst CFGs \\ n, node_subst CFGs \\ m, type_subst \\ e) of \n (Some u, Some v, Some ty) \\ if u \\ nodes CFGs \\ u \\ exits CFGs \\ v \\ starts CFGs\n then None else \n (case CFGs (thread_of u CFGs) of Some G \\ \n if v \\ Nodes G then Some (CFGs(thread_of u CFGs \\ G\\Edges := Edges G \\ {(u,v,ty)}\\)) else None \n | _ \\ None) | _ \\ None)\" |\n\"action_sf (ARemoveEdge n m e) \\ CFGs = (case (node_subst CFGs \\ n, node_subst CFGs \\ m, type_subst \\ e) of \n (Some u, Some v, Some ty) \\ if u \\ nodes CFGs then None else \n (case CFGs (thread_of u CFGs) of Some G \\ \n Some (CFGs(thread_of u CFGs \\ G\\Edges := Edges G - {(u,v,ty)}\\)) | _ \\ None)\n | _ \\ None)\" |\n\"action_sf (AReplace m pl) \\ CFGs = (if pl = [] then (\n case node_subst CFGs \\ m of Some l \\ if l \\ nodes CFGs \\ l \\ starts CFGs \\ l \\ exits CFGs then None \n else (case CFGs (thread_of l CFGs) of Some G \\ \n Some (CFGs(thread_of l CFGs \\ G\\Nodes := Nodes G - {l}, Edges := {(u,v,t). (u,v,t) \\ Edges G \\ u \\ l \\ v \\ l}\\)) | _ \\ None)\n | _ \\ None)\n else case (node_subst CFGs \\ m, subst_list CFGs \\ pl) of \n (Some l, Some il) \\ if l \\ nodes CFGs \\ l \\ exits CFGs then None else\n (case CFGs (thread_of l CFGs) of Some G \\\n let ll = new (nodes CFGs) (length il - 1)\n in Some (CFGs(thread_of l CFGs \\ G\\Nodes := Nodes G \\ set ll, Edges := rep_edges (Edges G) (l#ll), \n Label := update_list (Label G) (zip (l#ll) il)\\)) | _ \\ None)\n | _ \\ None)\" |\n\"action_sf (ASplitEdge n m e i) \\ CFGs = (case (node_subst CFGs \\ n,node_subst CFGs \\ m,type_subst \\ e,subst CFGs \\ i) of\n (Some u, Some v, Some ty, Some j) \\\n (if (u,v,ty) \\ edges CFGs then (case CFGs (thread_of u CFGs) of Some G \\\n (let q = hd (new (nodes CFGs) 1)\n in Some (CFGs(thread_of u CFGs \\ G\\Nodes := Nodes G \\ {q}, Edges := (Edges G - {(u,v,ty)}) \\ {(u,q,ty),(q,v,Seq)}, \n Label := (Label G)(q := j)\\))) | _ \\ None)\n else None) | _ \\ None)\"\n\n(* semantics for lists of actions *)\nprimrec part_comp :: \"('a \\ 'a) list \\ 'a \\ 'a\" where \n\"part_comp ([]::('a \\ 'a) list) x = Some x\" |\n\"part_comp (f#rest) x = (case f x of None \\ None | Some y \\ part_comp rest y)\"\n\ndefinition action_list_sf\nwhere \"action_list_sf Al \\ CFGs \\ part_comp (map (\\a G. action_sf a \\ G) Al) CFGs\"\n\n(* Recursive (fixpoint) application of a transformation *)\ninductive apply_some::\"(('metavar \\ 'object) \\ 'a \\ 'a set) \\\n ('metavar \\ 'object) \\ 'a \\ 'a \\ bool\" where\napply_none: \"apply_some T \\ G G\" |\napply_more: \"\\G' \\ T \\ G; apply_some T \\ G' G''\\ \\ apply_some T \\ G G''\"\n\n(* Transformations apply actions when their conditions are met. *)\nprimrec trans_sf where\n\"trans_sf (TIf al p) \\ CFGs = {CFGs' | CFGs' \\. Some CFGs' = action_list_sf al \\ CFGs \\\n side_cond_sf p \\ CFGs \\ part_matches \\ \\}\" |\n\"trans_sf (TMatch p T) \\ CFGs = {CFGs' | CFGs' \\. side_cond_sf p \\ CFGs \\ part_matches \\ \\ \\ \n CFGs' \\ trans_sf T (part_extend \\ (cond_fv pred_fv p) \\) CFGs}\" |\n\"trans_sf (TChoice T1 T2) \\ CFGs = (trans_sf T1 \\ CFGs) \\ (trans_sf T2 \\ CFGs)\" |\n\"trans_sf (TThen T1 T2) \\ CFGs = {CFGs'' | CFGs' CFGs''. CFGs' \\ trans_sf T1 \\ CFGs \\ CFGs'' \\ trans_sf T2 \\ CFGs'}\" |\n\"trans_sf (TApplyAll T) \\ CFGs = {CFGs'. apply_some (trans_sf T) \\ CFGs CFGs'} - \n {CFGs' | CFGs' CFGs''. CFGs' \\ CFGs'' \\ CFGs'' \\ trans_sf T \\ CFGs'}\"\n\nlemma fst_set_zip [simp]: \"length a = length b \\ fst ` set (zip a b) = set a\"\napply (induct a arbitrary: b, clarsimp+)\napply (case_tac b, simp+)\ndone\n\nlemma subst_last [simp]: \"\\subst_list CFGs \\ l = Some l'; l \\ []\\ \\ \n subst CFGs \\ (last l) = Some (last l')\"\napply (induct l arbitrary: l', simp, clarsimp split: option.splits)\napply (case_tac l, simp, clarsimp split: option.splits)\ndone\n\nlemma subst_nth [simp]: \"\\subst_list CFGs \\ l = Some l'; i < length l'\\ \\ \n subst CFGs \\ (l ! i) = Some (l' ! i)\"\napply (induct l arbitrary: l' i, simp, clarsimp split: option.splits)\napply (case_tac i, simp+)\ndone\n\nlemma subst_length [simp]: \"subst_list CFGs \\ l = Some l' \\ length l = length l'\"\nby (induct l arbitrary: l', auto split: option.splits)\n\nlemma replace_CFGs: \"\\action_sf (AReplace m pl) \\ CFGs = Some CFGs'; pl \\ []; \n \\p\\set (butlast pl). \\i. subst CFGs \\ p = Some i \\ instr_edges i = {no_edges(Seq := 1)};\n \\i n. subst CFGs \\ (last pl) = Some i \\ node_subst CFGs \\ m = Some n \\ \n instr_edges i = instr_edges (Label (the (CFGs (thread_of n CFGs))) n);\n tCFG CFGs instr_edges Seq\\ \\ tCFG CFGs' instr_edges Seq\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\action_sf (AReplace m pl) \\ CFGs = Some CFGs'; pl \\ []; \n \\p\\set (butlast pl). \\i. subst CFGs \\ p = Some i \\ instr_edges i = {no_edges(Seq := 1)};\n \\i n. subst CFGs \\ (last pl) = Some i \\ node_subst CFGs \\ m = Some n \\ \n instr_edges i = instr_edges (Label (the (CFGs (thread_of n CFGs))) n);\n tCFG CFGs instr_edges Seq\\ \\ tCFG CFGs' instr_edges Seq\"\napply (cut_tac nodes_finite)\napply (clarsimp simp add: Let_def split: option.splits if_splits)\napply (rename_tac l ll g)\napply (unfold_locales, auto)\napply (case_tac \"t \\ thread_of l CFGs\", simp, erule CFGs)\napply (clarsimp, frule CFGs, clarsimp simp add: is_flowgraph_def flowgraph_def)\napply (rule context_conjI, clarsimp simp add: pointed_graph_def)\napply (rule conjI, clarsimp simp add: rep_edges_def remap_succ_def)\napply (case_tac \"new (nodes CFGs) (length ll - Suc 0) = []\", clarsimp)\napply (case_tac \"length ll - Suc 0\", force)\napply (simp add: Let_def)\napply clarsimp\napply (erule disjE, force)\napply clarsimp\napply (case_tac a, simp+)\napply (frule node_of_graph, simp+)\napply (rule conjI, clarsimp simp add: in_edges_def rep_edges_def remap_succ_def)\napply (rule conjI, clarsimp, case_tac \"length ll - 1\")\napply (metis One_nat_def gr_implies_not0)\napply (simp add: Let_def)\napply (clarsimp, rule conjI, force, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"Start g\" in new_nodes_are_new, simp+)\napply (simp add: set_conv_nth)\napply (rule_tac x=aa in exI, rule conjI, erule sym, simp+)\napply (metis nodes_by_graph)\napply (clarsimp simp add: out_edges_def rep_edges_def remap_succ_def)\napply (rule conjI, clarsimp, case_tac \"length ll - 1\")\napply (metis One_nat_def gr_implies_not0)\napply (simp add: Let_def)\napply (clarsimp, rule conjI, clarsimp)\napply (rule conjI, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"Exit g\" in new_nodes_are_new, simp+)\napply (drule_tac as=\"new (nodes CFGs) (length ll - Suc 0)\" in last_in_set, simp+)\napply (metis nodes_by_graph)\napply metis\napply clarsimp\napply (case_tac aa, clarsimp)\napply (metis exits_by_graph)\napply clarsimp\napply (cut_tac S=\"nodes CFGs\" and m=\"Exit g\" in new_nodes_are_new, simp+)\napply (simp add: set_conv_nth, rule exI, rule conjI, erule sym, simp+)\napply (metis nodes_by_graph)\n(* now flowgraph_axioms *)\napply (case_tac \"ll = []\", clarsimp)\napply (clarsimp simp add: flowgraph_axioms_def)\napply (subgoal_tac \"distinct (l # new (nodes CFGs) (length ll - 1))\")\napply ((rule conjI, clarsimp)+)\napply (case_tac \"u = l\", clarsimp)\napply (case_tac \"length ll - 1 = 0\", simp)\napply (case_tac ll, simp+)\napply (case_tac pl, simp, clarsimp split: option.splits)\napply (case_tac list, simp_all split: option.splits, clarsimp)\napply (rename_tac lrest)\napply (simp add: rep_edges_def remap_succ_def out_edges_def)\napply (rule conjI, clarsimp simp add: Let_def, clarsimp intro!: ext simp add: edge_types_def)\napply (subgoal_tac \"l \\ last (let n' = SOME n. n \\ nodes CFGs in n' # \n new (insert n' (nodes CFGs)) (length lrest))\", clarsimp)\napply (rule_tac s=\"{SOME n. n \\ nodes CFGs}\" in subst, simp_all, rule set_eqI, rule iffI, \n clarsimp simp add: Let_def)\napply (rule_tac x=0 in exI, simp)\napply clarsimp\napply (case_tac ab, simp+)\napply (cut_tac m=l and S=\"nodes CFGs\" and n=\"Suc (length lrest)\" in new_nodes_are_new2, simp+)\napply (force simp add: Let_def set_conv_nth)\napply (clarsimp simp add: Let_def)\napply (cut_tac S=\"nodes CFGs\" and n=\"Suc (length lrest)\" in new_nodes_are_new, simp+, \n simp add: set_conv_nth Let_def, rule_tac x=nat in exI, simp+)\napply clarsimp+\napply (subgoal_tac \"u \\ set (l # new (nodes CFGs) (length ll - Suc 0))\", simp, clarsimp)\napply (cut_tac S=\"nodes CFGs\" in new_nodes_are_new, simp+)\napply (metis nodes_by_graph)\napply (clarsimp simp add: set_conv_nth)\napply (cut_tac l=\"zip (l # new (nodes CFGs) (length ll - Suc 0)) ll\" and f=\"Label g\" and\n x=\"new (nodes CFGs) (length ll - Suc 0) ! i\" in update_list_i, simp+)\napply (clarsimp, cut_tac S=\"nodes CFGs\" in new_nodes_are_new, simp+)\napply (simp add: set_zip, rule_tac x=\"Suc i\" in exI, force)\napply simp\napply (case_tac \"Suc i = length ll - 1\", clarsimp simp add: last_conv_nth)\napply (clarsimp simp add: rep_edges_def remap_succ_def out_edges_def, rule conjI, clarsimp)\napply (case_tac ll, simp+)\napply (case_tac list, simp, simp add: Let_def)\napply clarsimp\napply (erule_tac x=l in allE, simp add: node_of_graph, erule impE)\napply (metis exits_by_graph)\napply (rule_tac s=\"{(u, t). (l, u, t) \\ Edges g}\" in subst, simp_all)\napply (subgoal_tac \"new (nodes CFGs) (length ll - Suc 0) ! i = \n last (new (nodes CFGs) (length ll - Suc 0))\", simp)\napply (rule set_eqI, rule iffI, clarsimp simp add: last_conv_nth, metis)\napply clarsimp\napply (erule disjE, clarsimp)\napply (case_tac \"l = aa\", simp, clarsimp)\napply (drule pointed_graph.edges_ok, simp, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"new (nodes CFGs) (length ll - 1) ! i\" in new_nodes_are_new, \n simp+)\napply (force simp add: set_conv_nth)\napply (metis (hide_lams, no_types) One_nat_def nodes_by_graph)\napply clarsimp\napply (case_tac aa, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and n=\"length ll - Suc 0\" in new_nodes_are_new, simp+, \n rule last_in_set, clarsimp+)\napply (cut_tac S1=\"nodes CFGs\" and i=i and j=nat and n1=\"length ll - 1\" in \n nth_eq_iff_index_eq [OF new_nodes_diff], simp+)\napply (simp add: last_conv_nth, case_tac ll, simp+)\napply (case_tac list, simp+)\napply (erule_tac x=\"pl ! Suc i\" in allE, erule impE)\napply (rule_tac x=\"Suc i\" in exI, simp add: nth_butlast)\napply (clarsimp simp add: out_edges_def rep_edges_def remap_succ_def)\napply (rule conjI, clarsimp, case_tac \"length ll - 1\", simp, simp add: Let_def)\napply (subgoal_tac \"new (nodes CFGs) (length ll - Suc 0) ! i \\\n last (new (nodes CFGs) (length ll - Suc 0))\", simp)\napply (clarsimp intro!: ext simp add: edge_types_def, rule conjI, clarsimp)\napply (rule_tac s=\"{new (nodes CFGs) (length ll - Suc 0) ! Suc i}\" in subst, simp_all, rule set_eqI,\n rule iffI, clarsimp)\napply (erule_tac x=\"Suc i\" and P=\"\\ab. new (nodes CFGs) (length ll - Suc 0) ! ab = \n new (nodes CFGs) (length ll - Suc 0) ! Suc i \\ (l # new (nodes CFGs)\n (length ll - Suc 0)) ! ab = new (nodes CFGs) (length ll - Suc 0) ! i \n \\ \\ Suc ab < length ll\" in allE, clarsimp+)\napply (erule disjE, clarsimp)\napply (drule pointed_graph.edges_ok, simp, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"new (nodes CFGs) (length ll - 1) ! i\" in new_nodes_are_new, \n simp+)\napply (force simp add: set_conv_nth)\napply (metis (hide_lams, no_types) One_nat_def nodes_by_graph)\napply clarsimp\napply (case_tac a, simp+)\napply (cut_tac S1=\"nodes CFGs\" and i=nat and j=i and n1=\"length ll - 1\" in \n nth_eq_iff_index_eq [OF new_nodes_diff], simp+)\napply clarsimp\napply (rule_tac s=\"{}\" in subst, simp_all, clarsimp)\napply (drule pointed_graph.edges_ok, simp, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"new (nodes CFGs) (length ll - 1) ! i\" in new_nodes_are_new, \n simp+)\napply (force simp add: set_conv_nth)\napply (metis (hide_lams, no_types) One_nat_def nodes_by_graph)\napply (case_tac \"new (nodes CFGs) (length ll - Suc 0) = []\", case_tac \"length ll - 1\", simp, \n simp add: Let_def)\napply (clarsimp simp add: last_conv_nth)\napply (cut_tac S1=\"nodes CFGs\" and i=i and j=\"length ll - (Suc (Suc 0))\" and n1=\"length ll - 1\" in \n nth_eq_iff_index_eq [OF new_nodes_diff], simp+)\napply (clarsimp simp add: rep_edges_def remap_succ_def, rule conjI, clarsimp)\napply (case_tac \"length ll - 1\", simp, simp add: Let_def)\napply (clarsimp, (rule conjI, clarsimp)+)\napply (drule pointed_graph.edges_ok, simp, clarsimp)\napply (cut_tac S=\"nodes CFGs\" and m=\"last (new (nodes CFGs) (length ll - 1))\" in new_nodes_are_new, \n simp+, rule last_in_set, simp+, force)\napply clarsimp+\napply (case_tac a, clarsimp+)\napply (cut_tac S1=\"nodes CFGs\" and i=nat and j=\"Suc nat\" and n1=\"length ll - 1\" in \n nth_eq_iff_index_eq [OF new_nodes_diff], simp+)\napply (rule conjI, clarsimp)\napply (cut_tac S=\"nodes CFGs\" in new_nodes_are_new, simp+)\napply (rule new_nodes_diff, simp+)\n(* tCFG axioms *)\napply (clarsimp split: if_splits)\napply (erule disjE, cut_tac disjoint, simp_all, simp add: Int_def)\napply (cut_tac S=\"nodes CFGs\" in new_nodes_are_new, simp+, simp add: nodes_by_graph)\napply (erule disjE, cut_tac disjoint, simp_all, simp add: Int_def)\napply (cut_tac S=\"nodes CFGs\" in new_nodes_are_new, simp+, simp add: nodes_by_graph)\napply (cut_tac disjoint, simp_all, simp add: Int_def)\ndone\nqed\n\nlemma apply_some_transfer [rule_format]: \"\\P G; \\\\ G G'. G' \\ T \\ G \\ P G \\ P G'; apply_some T \\ G G'\\ \\\n P G'\"\nby (drule_tac P=\"\\T' \\ G G'. T' = T \\ P G \\ P G'\" in apply_some.induct, auto)\n\nlemma action_disjoint: \"\\action_sf a \\ G = Some G'; pre_tCFG G\\ \\ pre_tCFG G'\"\napply (frule pre_tCFG.nodes_finite)\napply (case_tac a, auto split: if_splits option.splits simp add: Let_def intro!: pre_tCFG.disjoint_change)\napply (frule pre_tCFG.graphs, simp, clarsimp simp add: pointed_graph_def)\napply (rule conjI, metis)\napply (rule conjI, metis starts_by_graph)\napply (rule conjI, metis exits_by_graph)\napply (simp add: in_edges_def out_edges_def)\napply (cut_tac S=\"nodes G\" in new_nodes_are_new, simp+)\napply (frule pre_tCFG.graphs, simp, clarsimp simp add: pointed_graph_def)\napply (rename_tac m pl l ll g)\napply (rule conjI, clarsimp simp add: rep_edges_def remap_succ_def)\napply (rule conjI, clarsimp)\napply (case_tac \"length ll - 1\", force, simp add: Let_def)\napply clarsimp\napply (erule disjE, force)\napply clarsimp\napply (case_tac aa, simp add: pre_tCFG.node_of_graph, simp)\napply (simp add: in_edges_def out_edges_def rep_edges_def remap_succ_def)\napply (rule conjI, clarsimp)\napply (case_tac \"length ll - 1\", force, simp add: Let_def)\napply (clarsimp, (rule conjI, clarsimp+)+)\napply (drule pre_tCFG.graphs, simp)\napply (simp, drule pointed_graph.has_start, cut_tac S=\"nodes G\" and n=\"length ll - Suc 0\" \n in new_nodes_are_new, simp+)\napply (simp add: set_conv_nth, rule_tac x=aa in exI, simp)\napply (simp add: nodes_by_graph)\napply (clarsimp, (rule conjI, clarsimp+)+)\napply (drule pre_tCFG.graphs, simp+)\napply (drule pointed_graph.has_exit, cut_tac S=\"nodes G\" and n=\"length ll - Suc 0\"\n in new_nodes_are_new, simp+)\napply (rule last_in_set, simp+)\napply (simp add: nodes_by_graph)\napply force\napply clarsimp\napply (case_tac aa, simp add: exits_by_graph)\napply (drule pre_tCFG.graphs, simp+)\napply (drule pointed_graph.has_exit, cut_tac S=\"nodes G\" and n=\"length ll - Suc 0\"\n in new_nodes_are_new, simp+)\napply (simp add: set_conv_nth, rule_tac x=nat in exI, simp)\napply (simp add: nodes_by_graph)\napply (frule pre_tCFG.graphs, simp, clarsimp simp add: pointed_graph_def)\napply (rule conjI, metis)\napply (simp add: in_edges_def out_edges_def)\napply (frule pre_tCFG.graphs, simp, clarsimp simp add: pointed_graph_def)\napply (rule conjI, clarsimp simp add: exits_by_graph)\napply (clarsimp simp add: in_edges_def out_edges_def)\napply (metis pre_tCFG.node_of_graph starts_by_graph)\napply (cut_tac A=\"nodes G\" in fresh_new, simp+)\napply (frule pre_tCFG.graphs, simp, clarsimp simp add: pointed_graph_def)\napply (cut_tac A=\"nodes G\" in fresh_new, simp+)\napply (rule conjI, clarsimp simp add: nodes_by_graph, clarsimp simp add: out_edges_def)\napply (rename_tac n m e i u v ty j g)\napply (rule conjI, clarsimp simp add: edges_def ran_def)\napply (frule_tac t=aa in pre_tCFG.graphs, simp+, drule pointed_graph.edges_ok, simp+)\napply (case_tac \"aa = thread_of (Exit g) G\", simp+)\napply (drule pre_tCFG.disjoint, simp_all, simp add: Int_def)\napply (clarsimp simp add: edges_def ran_def)\napply (frule_tac t=aa in pre_tCFG.graphs, simp+, drule pointed_graph.edges_ok, simp+)\napply (simp add: pre_tCFG.thread_of_correct)\napply (clarsimp, rule conjI, metis)\napply (clarsimp simp add: in_edges_def)\napply (rule conjI, clarsimp simp add: nodes_by_graph, clarsimp)\ndone\n\nlemma actions_disjoint: \"\\action_list_sf list \\ G = Some G'; pre_tCFG G\\ \\ pre_tCFG G'\"\napply (induct list arbitrary: G G', simp_all add: action_list_sf_def split: option.splits)\napply (drule action_disjoint, simp+)\ndone\n\nlemma trans_disjoint: \"\\G' \\ trans_sf T \\ G; pre_tCFG G\\ \\ pre_tCFG G'\"\napply (induct T arbitrary: \\ G G', simp_all, clarsimp)\napply (drule sym, drule actions_disjoint, simp+)\napply auto\napply (cut_tac P=pre_tCFG and T=\"trans_sf T\" in apply_some_transfer, force, simp+)+\ndone\n\nend\n\nlemma option_if1 [simp]: \"((if P then None else x) = Some y) = (\\P \\ x = Some y)\"\nby simp\n\nlemma option_if2: \"((if P then x else None) = Some y) = (P \\ x = Some y)\"\nby simp\n\nlemma part_extend_matches: \"\\part_matches \\' (part_extend \\ S \\); x \\ S\\ \\ \\' x = \\ x\"\nby (simp add: part_matches_def part_extend_def)\n\nlemma option_Some1: \"((case a of None \\ None | Some b \\ f b) = Some c) = \n (\\b. a = Some b \\ f b = Some c)\"\nby (auto split: option.splits)\n\nlemma option_Some2: \"(Some c = (case a of None \\ None | Some b \\ f b)) = \n (\\b. a = Some b \\ f b = Some c)\"\nby (auto split: option.splits)\n\nend", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/trans_semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.2645403668481784}} {"text": "theory Primitive_Abstract\nimports\n Common_Primitive_toString\n Transform\n Conntrack_State_Transform\nbegin\n\nsection\\Abstracting over Primitives\\\n\n\n\ntext\\Abstract over certain primitives. The first parameter is a function\n @{typ \"'i::len common_primitive negation_type \\ bool\"} to select the primitives to be abstracted over.\n The @{typ \"'i::len common_primitive\"} is wrapped in a @{typ \"'i::len common_primitive negation_type\"} to let the function\n selectively abstract only over negated, non-negated, or both kinds of primitives.\n This functions requires a @{const normalized_nnf_match}.\n\\\n(*requires toString function!*)\nfun abstract_primitive\n :: \"('i::len common_primitive negation_type \\ bool) \\ 'i common_primitive match_expr \\ 'i common_primitive match_expr\"\nwhere\n \"abstract_primitive _ MatchAny = MatchAny\" |\n \"abstract_primitive disc (Match a) =\n (if\n disc (Pos a)\n then\n Match (Extra (common_primitive_toString ipaddr_generic_toString a))\n else\n (Match a))\" |\n \"abstract_primitive disc (MatchNot (Match a)) =\n (if\n disc (Neg a)\n then\n Match (Extra (''! ''@common_primitive_toString ipaddr_generic_toString a))\n else\n (MatchNot (Match a)))\" |\n \"abstract_primitive disc (MatchNot m) = MatchNot (abstract_primitive disc m)\" |\n \"abstract_primitive disc (MatchAnd m1 m2) = MatchAnd (abstract_primitive disc m1) (abstract_primitive disc m2)\"\n\n\ntext\\For example, a simple firewall requires that no negated interfaces and protocols occur in the \n expression.\\\ndefinition abstract_for_simple_firewall :: \"'i::len common_primitive match_expr \\ 'i common_primitive match_expr\"\n where \"abstract_for_simple_firewall \\ abstract_primitive (\\r. case r\n of Pos a \\ is_CT_State a \\ is_L4_Flags a\n | Neg a \\ is_Iiface a \\ is_Oiface a \\ is_Prot a \\ is_CT_State a \\ is_L4_Flags a)\"\n\n\nlemma abstract_primitive_preserves_normalized:\n \"normalized_src_ports m \\ normalized_src_ports (abstract_primitive disc m)\"\n \"normalized_dst_ports m \\ normalized_dst_ports (abstract_primitive disc m)\"\n \"normalized_src_ips m \\ normalized_src_ips (abstract_primitive disc m)\"\n \"normalized_dst_ips m \\ normalized_dst_ips (abstract_primitive disc m)\"\n \"normalized_nnf_match m \\ normalized_nnf_match (abstract_primitive disc m)\"\n by(induction disc m rule: abstract_primitive.induct) (simp_all)\nlemma abstract_primitive_preserves_nodisc:\n \"\\ has_disc disc' m \\ (\\str. \\ disc' (Extra str)) \\ \\ has_disc disc' (abstract_primitive disc m)\"\n by(induction disc m rule: abstract_primitive.induct)(simp_all)\nlemma abstract_primitive_preserves_nodisc_nedgated:\n \"\\ has_disc_negated disc' neg m \\ (\\str. \\ disc' (Extra str)) \\ \\ has_disc_negated disc' neg (abstract_primitive disc m)\"\n by(induction disc m arbitrary: neg rule: abstract_primitive.induct) simp+\n\nlemma abstract_primitive_nodisc:\n \"\\x. disc' x \\ disc (Pos x) \\ disc (Neg x) \\ (\\str. \\ disc' (Extra str)) \\ \\ has_disc disc' (abstract_primitive disc m)\"\n by(induction disc m rule: abstract_primitive.induct) auto\n \nlemma abstract_primitive_preserves_not_has_disc_negated:\n \"\\a. \\ disc (Extra a)\\ \\ has_disc_negated disc neg m \\ \\ has_disc_negated disc neg (abstract_primitive sel_f m)\"\nby(induction sel_f m arbitrary: neg rule: abstract_primitive.induct) simp+\n\nlemma abstract_for_simple_firewall_preserves_nodisc_negated:\n \"\\a. \\ disc (Extra a)\\ \\ has_disc_negated disc False m \\ \\ has_disc_negated disc False (abstract_for_simple_firewall m)\"\nunfolding abstract_for_simple_firewall_def\nusing abstract_primitive_preserves_nodisc_nedgated by blast\n\ntext\\The function @{const ctstate_assume_state} can be used to fix a state and hence remove all state matches from the ruleset.\n It is therefore advisable to create a simple firewall for a fixed state, e.g. with @{const ctstate_assume_new} before\n calling to @{const abstract_for_simple_firewall}.\\\nlemma not_hasdisc_ctstate_assume_state: \"\\ has_disc is_CT_State (ctstate_assume_state s m)\"\n by(induction m rule: ctstate_assume_state.induct) (simp_all)\n\n\nlemma abstract_for_simple_firewall_hasdisc: fixes m :: \"'i::len common_primitive match_expr\"\n shows \"\\ has_disc is_CT_State (abstract_for_simple_firewall m)\"\n and \"\\ has_disc is_L4_Flags (abstract_for_simple_firewall m)\"\n unfolding abstract_for_simple_firewall_def\n apply(induction \"(\\r:: 'i common_primitive negation_type. case r of Pos a \\ is_CT_State a | Neg a \\ is_Iiface a \\ is_Oiface a \\ is_Prot a \\ is_CT_State a)\" m rule: abstract_primitive.induct)\n apply(simp_all)\n done\n\nlemma abstract_for_simple_firewall_negated_ifaces_prots: fixes m :: \"'i::len common_primitive match_expr\"\n shows \"normalized_nnf_match m \\ \\ has_disc_negated (\\a. is_Iiface a \\ is_Oiface a) False (abstract_for_simple_firewall m)\"\n and \"normalized_nnf_match m \\ \\ has_disc_negated is_Prot False (abstract_for_simple_firewall m)\"\n unfolding abstract_for_simple_firewall_def\n apply(induction \"(\\r:: 'i common_primitive negation_type. case r of Pos a \\ is_CT_State a | Neg a \\ is_Iiface a \\ is_Oiface a \\ is_Prot a \\ is_CT_State a)\" m rule: abstract_primitive.induct)\n apply(simp_all)\n done\n\n\ncontext\nbegin\n private lemma abstract_primitive_in_doubt_allow_Allow: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n matches (\\, in_doubt_allow) m action.Accept p \\\n matches (\\, in_doubt_allow) (abstract_primitive disc m) action.Accept p\"\n by(induction disc m rule: abstract_primitive.induct)\n (simp_all add: bunch_of_lemmata_about_matches(1) primitive_matcher_generic.Extra_single)\n \n private lemma abstract_primitive_in_doubt_allow_Allow2: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n \\ matches (\\, in_doubt_allow) m action.Drop p \\\n \\ matches (\\, in_doubt_allow) (abstract_primitive disc m) action.Drop p\"\n proof(induction disc m rule: abstract_primitive.induct)\n case(5 m1 m2) thus ?case by (auto simp add: bunch_of_lemmata_about_matches(1))\n qed(simp_all add: bunch_of_lemmata_about_matches(1) primitive_matcher_generic.Extra_single)\n\n private lemma abstract_primitive_in_doubt_allow_Deny: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\\n matches (\\, in_doubt_allow) (abstract_primitive disc m) action.Drop p \\\n matches (\\, in_doubt_allow) m action.Drop p\"\n apply(induction disc m rule: abstract_primitive.induct)\n apply (simp_all add: bunch_of_lemmata_about_matches(1))\n apply(auto simp add: primitive_matcher_generic.Extra_single primitive_matcher_generic.Extra_single_not split: if_split_asm)\n done\n \n private lemma abstract_primitive_in_doubt_allow_Deny2: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n \\ matches (\\, in_doubt_allow) (abstract_primitive disc m) action.Accept p \\\n \\ matches (\\, in_doubt_allow) m action.Accept p\"\n apply(induction disc m rule: abstract_primitive.induct)\n apply (simp_all add: bunch_of_lemmata_about_matches(1))\n apply(auto simp add: primitive_matcher_generic.Extra_single primitive_matcher_generic.Extra_single_not split: if_split_asm)\n done\n \n theorem abstract_primitive_in_doubt_allow_generic:\n fixes \\::\"('i::len common_primitive, ('i, 'a) tagged_packet_scheme) exact_match_tac\"\n assumes generic: \"primitive_matcher_generic \\\"\n and n: \"\\ r \\ set rs. normalized_nnf_match (get_match r)\"\n and simple: \"simple_ruleset rs\"\n defines \"\\ \\ (\\, in_doubt_allow)\" and \"abstract disc \\ optimize_matches (abstract_primitive disc)\"\n shows \"{p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny} \\ {p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny}\"\n (is ?deny)\n and \"{p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow} \\ {p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow}\"\n (is ?allow)\n proof -\n from simple have \"good_ruleset rs\" using simple_imp_good_ruleset by fast\n from optimize_matches_simple_ruleset simple simple_imp_good_ruleset have\n good: \"good_ruleset (optimize_matches (abstract_primitive disc) rs)\" by fast\n\n let ?\\=\"(\\, in_doubt_allow) :: ('i::len common_primitive, ('i, 'a) tagged_packet_scheme) match_tac\"\n --\\type signature is needed, otherwise @{const in_doubt_allow} would be for arbitrary packet\\\n\n have abstract_primitive_in_doubt_allow_help1:\n \"approximating_bigstep_fun \\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalAllow\"\n if prem: \"approximating_bigstep_fun \\ p rs Undecided = Decision FinalAllow\" for p\n proof -\n from simple have \"wf_ruleset \\ p rs\" using good_imp_wf_ruleset simple_imp_good_ruleset by fast\n from this simple prem n show ?thesis\n unfolding \\_def\n proof(induction ?\\ p rs Undecided rule: approximating_bigstep_fun_induct_wf)\n case (MatchAccept p m a rs)\n from MatchAccept.prems\n abstract_primitive_in_doubt_allow_Allow[OF generic] MatchAccept.hyps have\n \"matches ?\\ (abstract_primitive disc m) action.Accept p\" by simp\n thus ?case\n apply(simp add: MatchAccept.hyps(2))\n using optimize_matches_matches_fst by fastforce \n next\n case (Nomatch p m a rs) thus ?case\n proof(cases \"matches ?\\ (abstract_primitive disc m) a p\")\n case False with Nomatch show ?thesis\n apply(simp add: optimize_matches_def)\n using simple_ruleset_tail by blast\n next\n case True\n from Nomatch.prems(1) have \"a = action.Accept \\ a = action.Drop\" by(simp add: simple_ruleset_def)\n from Nomatch.hyps(1) Nomatch.prems(3) abstract_primitive_in_doubt_allow_Allow2[OF generic] have\n \"a = action.Drop \\ \\ matches ?\\ (abstract_primitive disc m) action.Drop p\" by simp\n with True \\a = action.Accept \\ a = action.Drop\\ have \"a = action.Accept\" by blast\n with True show ?thesis\n using optimize_matches_matches_fst by fastforce \n qed\n qed(simp_all add: simple_ruleset_def)\n qed\n\n have abstract_primitive_in_doubt_allow_help2:\n \"approximating_bigstep_fun \\ p rs Undecided = Decision FinalDeny\"\n if prem: \"approximating_bigstep_fun \\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalDeny\"\n for p\n proof -\n from simple have \"wf_ruleset \\ p rs\" using good_imp_wf_ruleset simple_imp_good_ruleset by fast\n from this simple prem n show ?thesis\n unfolding \\_def\n proof(induction ?\\ p rs Undecided rule: approximating_bigstep_fun_induct_wf)\n case Empty thus ?case by(simp add: optimize_matches_def)\n next\n case (MatchAccept p m a rs)\n from MatchAccept.prems abstract_primitive_in_doubt_allow_Allow[OF generic] MatchAccept.hyps have\n 1: \"matches ?\\ (abstract_primitive disc m) action.Accept p\" by simp\n with MatchAccept have \"approximating_bigstep_fun ?\\ p\n (Rule (abstract_primitive disc m) action.Accept # (optimize_matches (abstract_primitive disc) rs)) Undecided = Decision FinalDeny\"\n using optimize_matches_matches_fst by metis\n with 1 have False by(simp)\n thus ?case ..\n next\n case (Nomatch p m a rs) thus ?case\n proof(cases \"matches ?\\ (abstract_primitive disc m) a p\")\n case False\n with Nomatch.prems(2) have \"approximating_bigstep_fun ?\\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalDeny\"\n by(simp add: optimize_matches_def split: if_split_asm)\n with Nomatch have IH: \"approximating_bigstep_fun ?\\ p rs Undecided = Decision FinalDeny\"\n using simple_ruleset_tail by auto\n with Nomatch(1) show ?thesis by simp\n next\n case True\n from Nomatch.prems(2) True have 1: \"approximating_bigstep_fun ?\\ p\n (Rule (abstract_primitive disc m) a # (optimize_matches (abstract_primitive disc) rs)) Undecided = Decision FinalDeny\"\n using optimize_matches_matches_fst by metis\n \n from Nomatch.prems(1) have \"a = action.Accept \\ a = action.Drop\" by(simp add: simple_ruleset_def)\n from Nomatch.hyps(1) Nomatch.prems(3) abstract_primitive_in_doubt_allow_Allow2[OF generic] have\n \"a = action.Drop \\ \\ matches ?\\ (abstract_primitive disc m) action.Drop p\" by simp\n with True \\a = action.Accept \\ a = action.Drop\\ have \"a = action.Accept\" by blast\n with 1 True have False by simp\n thus ?thesis ..\n qed\n qed(simp_all add: simple_ruleset_def)\n qed\n \n from good approximating_semantics_iff_fun_good_ruleset abstract_primitive_in_doubt_allow_help1 \\good_ruleset rs\\ show ?allow\n unfolding abstract_def by fast\n from good approximating_semantics_iff_fun_good_ruleset abstract_primitive_in_doubt_allow_help2 \\good_ruleset rs\\ \\_def show ?deny \n unfolding abstract_def by fast\n qed\n corollary abstract_primitive_in_doubt_allow:\n assumes \"\\ r \\ set rs. normalized_nnf_match (get_match r)\" and \"simple_ruleset rs\"\n defines \"\\ \\ (common_matcher, in_doubt_allow)\" and \"abstract disc \\ optimize_matches (abstract_primitive disc)\"\n shows \"{p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny} \\ {p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny}\"\n and \"{p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow} \\ {p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow}\"\n unfolding \\_def abstract_def\n using assms abstract_primitive_in_doubt_allow_generic[OF primitive_matcher_generic_common_matcher] by blast+\nend\n\n\ncontext\nbegin\n private lemma abstract_primitive_in_doubt_deny_Deny:\n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n matches (\\, in_doubt_deny) m action.Drop p \\\n matches (\\, in_doubt_deny) (abstract_primitive disc m) action.Drop p\"\n by(induction disc m rule: abstract_primitive.induct)\n (simp_all add: bunch_of_lemmata_about_matches(1) primitive_matcher_generic.Extra_single)\n \n private lemma abstract_primitive_in_doubt_deny_Deny2:\n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n \\ matches (\\, in_doubt_deny) m action.Accept p \\\n \\ matches (\\, in_doubt_deny) (abstract_primitive disc m) action.Accept p\"\n proof(induction disc m rule: abstract_primitive.induct)\n case(5 m1 m2) thus ?case by (auto simp add: bunch_of_lemmata_about_matches(1))\n qed(simp_all add: bunch_of_lemmata_about_matches(1) primitive_matcher_generic.Extra_single)\n \n private lemma abstract_primitive_in_doubt_deny_Allow: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\\n matches (\\, in_doubt_deny) (abstract_primitive disc m) action.Accept p \\\n matches (\\, in_doubt_deny) m action.Accept p\"\n apply(induction disc m rule: abstract_primitive.induct)\n apply (simp_all add: bunch_of_lemmata_about_matches(1))\n apply(auto simp add: primitive_matcher_generic.Extra_single primitive_matcher_generic.Extra_single_not split: if_split_asm)\n done\n \n private lemma abstract_primitive_in_doubt_deny_Allow2: \n \"primitive_matcher_generic \\ \\ normalized_nnf_match m \\ \n \\ matches (\\, in_doubt_deny) (abstract_primitive disc m) action.Drop p \\\n \\ matches (\\, in_doubt_deny) m action.Drop p\"\n apply(induction disc m rule: abstract_primitive.induct)\n apply (simp_all add: bunch_of_lemmata_about_matches(1))\n apply(auto simp add: primitive_matcher_generic.Extra_single primitive_matcher_generic.Extra_single_not split: if_split_asm)\n done\n\n theorem abstract_primitive_in_doubt_deny_generic:\n fixes \\::\"('i::len common_primitive, ('i, 'a) tagged_packet_scheme) exact_match_tac\"\n assumes generic: \"primitive_matcher_generic \\\"\n and n: \"\\ r \\ set rs. normalized_nnf_match (get_match r)\"\n and simple: \"simple_ruleset rs\"\n defines \"\\ \\ (\\, in_doubt_deny)\" and \"abstract disc \\ optimize_matches (abstract_primitive disc)\"\n shows \"{p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow} \\ {p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalAllow}\"\n (is ?allow)\n and \"{p. \\,p\\ \\rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny} \\ {p. \\,p\\ \\abstract disc rs, Undecided\\ \\\\<^sub>\\ Decision FinalDeny}\"\n (is ?deny)\n proof -\n from simple have \"good_ruleset rs\" using simple_imp_good_ruleset by fast\n from optimize_matches_simple_ruleset simple simple_imp_good_ruleset have\n good: \"good_ruleset (optimize_matches (abstract_primitive disc) rs)\" by fast\n\n let ?\\=\"(\\, in_doubt_deny) :: ('i::len common_primitive, ('i, 'a) tagged_packet_scheme) match_tac\"\n --\\type signature is needed, otherwise @{const in_doubt_allow} would be for arbitrary packet\\\n \n have abstract_primitive_in_doubt_deny_help1:\n \"approximating_bigstep_fun \\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalDeny\"\n if prem: \"approximating_bigstep_fun \\ p rs Undecided = Decision FinalDeny\" for p\n proof -\n from simple have \"wf_ruleset \\ p rs\" using good_imp_wf_ruleset simple_imp_good_ruleset by fast\n from this simple prem n show ?thesis\n unfolding \\_def\n proof(induction ?\\ p rs Undecided rule: approximating_bigstep_fun_induct_wf)\n case (MatchDrop p m a rs)\n from MatchDrop.prems abstract_primitive_in_doubt_deny_Deny[OF generic] MatchDrop.hyps have\n \"matches ?\\ (abstract_primitive disc m) action.Drop p\" by simp\n thus ?case \n apply(simp add: MatchDrop.hyps(2))\n using optimize_matches_matches_fst by fastforce\n next\n case (Nomatch p m a rs) thus ?case\n proof(cases \"matches ?\\ (abstract_primitive disc m) a p\")\n case False with Nomatch show ?thesis\n apply(simp add: optimize_matches_def)\n using simple_ruleset_tail by blast\n next\n case True\n from Nomatch.prems(1) have \"a = action.Accept \\ a = action.Drop\" by(simp add: simple_ruleset_def)\n from Nomatch.hyps(1) Nomatch.prems(3) abstract_primitive_in_doubt_deny_Deny2[OF generic] have\n \"a = action.Accept \\ \\ matches ?\\ (abstract_primitive disc m) action.Accept p\" by(simp)\n with True \\a = action.Accept \\ a = action.Drop\\ have \"a = action.Drop\" by blast\n with True show ?thesis using optimize_matches_matches_fst by fastforce\n qed\n qed(simp_all add: simple_ruleset_def)\n qed\n\n have abstract_primitive_in_doubt_deny_help2:\n \"approximating_bigstep_fun \\ p rs Undecided = Decision FinalAllow\"\n if prem: \"approximating_bigstep_fun \\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalAllow\"\n for p\n proof -\n from simple have \"wf_ruleset ?\\ p rs\" using good_imp_wf_ruleset simple_imp_good_ruleset by fast\n from this simple prem n show ?thesis\n unfolding \\_def\n proof(induction ?\\ p rs Undecided rule: approximating_bigstep_fun_induct_wf)\n case Empty thus ?case by(simp add: optimize_matches_def)\n next\n case (MatchAccept p m a rs) thus ?case by auto\n next\n case (MatchDrop p m a rs)\n from MatchDrop.prems abstract_primitive_in_doubt_deny_Deny[OF generic] MatchDrop.hyps have\n 1: \"matches ?\\ (abstract_primitive disc m) action.Drop p\" by simp\n from MatchDrop have \"approximating_bigstep_fun ?\\ p\n (Rule (abstract_primitive disc m) action.Drop # (optimize_matches (abstract_primitive disc) rs)) Undecided = Decision FinalAllow\"\n using optimize_matches_matches_fst 1 by fastforce\n with 1 have False by(simp)\n thus ?case ..\n next\n case (Nomatch p m a rs) thus ?case\n proof(cases \"matches ?\\ (abstract_primitive disc m) a p\")\n case False \n with Nomatch.prems(2) have \"approximating_bigstep_fun ?\\ p (optimize_matches (abstract_primitive disc) rs) Undecided = Decision FinalAllow\"\n by(simp add: optimize_matches_def split: if_split_asm)\n with Nomatch have IH: \"approximating_bigstep_fun ?\\ p rs Undecided = Decision FinalAllow\"\n using simple_ruleset_tail by auto\n with Nomatch(1) show ?thesis by simp\n next\n case True\n from Nomatch.prems(2) True have 1: \"approximating_bigstep_fun ?\\ p\n (Rule (abstract_primitive disc m) a # (optimize_matches (abstract_primitive disc) rs)) Undecided = Decision FinalAllow\"\n using optimize_matches_matches_fst by metis\n from Nomatch.prems(1) have \"a = action.Accept \\ a = action.Drop\" by(simp add: simple_ruleset_def)\n from Nomatch.hyps(1) Nomatch.prems(3) abstract_primitive_in_doubt_deny_Deny2[OF generic] have\n \"a = action.Accept \\ \\ matches ?\\ (abstract_primitive disc m) action.Accept p\" by simp\n with True \\a = action.Accept \\ a = action.Drop\\ have \"a = action.Drop\" by blast\n with 1 True have False by force\n thus ?thesis ..\n qed\n qed(simp_all add: simple_ruleset_def)\n qed\n\n from good approximating_semantics_iff_fun_good_ruleset abstract_primitive_in_doubt_deny_help1 \\good_ruleset rs\\ show ?deny\n unfolding abstract_def by fast\n from good approximating_semantics_iff_fun_good_ruleset abstract_primitive_in_doubt_deny_help2 \\good_ruleset rs\\ show ?allow\n unfolding abstract_def by fast\n qed\nend\n\n\n\nend", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Primitive_Matchers/Primitive_Abstract.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283033, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.26454036684817833}} {"text": "theory Mockup_Test_Abs_Sys\n imports Abstract_System More_Eisbach_Tools\nbegin\n typedecl state\n typedecl program\n typedecl location\n\n consts step :: \"program \\ state \\ state\"\n consts halted :: \"program \\ state \\ bool\"\n consts location :: \"state \\ location\"\n\n\n\n\n definition \"stepse \\ \\ doE { s\\sget; sput (step \\ s) }\"\n\n\n global_interpretation det_system \"stepse \\\" \"halted \\\" for \\\n defines yields = yields'\n .\n\n declare yields_unfold[code]\n\n interpretation cfg_system \"stepse \\\" \"halted \\\" \"\\_. True\" location\n apply unfold_locales by (rule is_weak_invarI) simp\n\n\nmethod vcg_clarify = (intro impI conjI)?, (((rule exI, rule conjI, assumption)+ | (simp add: prep_precond_conv))+)?\nmethod vcg_step_aux = (rule wps_rls linvar_unfoldI, (assumption+)?); kbxfer?\nmethod vcg_step = vcg_clarify, vcg_step_aux\nmethod vcg = (vcg_step+, vcg_clarify)\n\n term htriple\n\n lemma \"htriple \\ (\\s. location s = foo) Q\"\n apply (rule floyd_htripleI[where \\=\"[\n foo \\ \\s. \\ halted \\ s \\ \\\\<^sub>1 s,\n bar \\ \\s. halted \\ s \\ \\\\<^sub>2 s,\n bar2 \\ \\s. halted \\ s \\ \\\\<^sub>3 s\n ]\"])\n\n subgoal\n apply (rule linvar_unfoldI)\n apply simp\n sorry\n\n subgoal\n apply (rule floyd_invarI)\n apply (intro floyd_vcsI; (clarsimp simp: )?)\n\n apply (subst stepse_def[abs_def])\n apply (simp add: wps_eqs)\n\n apply (rule linvar_unfoldI)\n apply clarsimp apply (intro impI conjI; simp?)\n\n prefer 16\n apply (subst stepse_def[abs_def])\n apply (simp add: wps_eqs)\n sorry\n\n subgoal for s\n apply (clarsimp split: if_splits)\n sorry\n\n oops\n\n\n\n term \"yields \\\"\n\n\n\n\n\nend\n\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Monads/Mockup_Test_Abs_Sys.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2644753717647745}} {"text": "(* Title: HOL/UNITY/Comp/AllocImpl.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1998 University of Cambridge\n*)\n\nsection{*Implementation of a multiple-client allocator from a single-client allocator*}\n\ntheory AllocImpl imports AllocBase \"../Follows\" \"../PPROD\" begin\n\n\n(** State definitions. OUTPUT variables are locals **)\n\n(*Type variable 'b is the type of items being merged*)\nrecord 'b merge =\n In :: \"nat => 'b list\" (*merge's INPUT histories: streams to merge*)\n Out :: \"'b list\" (*merge's OUTPUT history: merged items*)\n iOut :: \"nat list\" (*merge's OUTPUT history: origins of merged items*)\n\nrecord ('a,'b) merge_d =\n \"'b merge\" +\n dummy :: 'a (*dummy field for new variables*)\n\ndefinition non_dummy :: \"('a,'b) merge_d => 'b merge\" where\n \"non_dummy s = (|In = In s, Out = Out s, iOut = iOut s|)\"\n\nrecord 'b distr =\n In :: \"'b list\" (*items to distribute*)\n iIn :: \"nat list\" (*destinations of items to distribute*)\n Out :: \"nat => 'b list\" (*distributed items*)\n\nrecord ('a,'b) distr_d =\n \"'b distr\" +\n dummy :: 'a (*dummy field for new variables*)\n\nrecord allocState =\n giv :: \"nat list\" (*OUTPUT history: source of tokens*)\n ask :: \"nat list\" (*INPUT: tokens requested from allocator*)\n rel :: \"nat list\" (*INPUT: tokens released to allocator*)\n\nrecord 'a allocState_d =\n allocState +\n dummy :: 'a (*dummy field for new variables*)\n\nrecord 'a systemState =\n allocState +\n mergeRel :: \"nat merge\"\n mergeAsk :: \"nat merge\"\n distr :: \"nat distr\"\n dummy :: 'a (*dummy field for new variables*)\n\n\n(** Merge specification (the number of inputs is Nclients) ***)\n\ndefinition\n (*spec (10)*)\n merge_increasing :: \"('a,'b) merge_d program set\"\n where \"merge_increasing =\n UNIV guarantees (Increasing merge.Out) Int (Increasing merge.iOut)\"\n\ndefinition\n (*spec (11)*)\n merge_eqOut :: \"('a,'b) merge_d program set\"\n where \"merge_eqOut =\n UNIV guarantees\n Always {s. length (merge.Out s) = length (merge.iOut s)}\"\n\ndefinition\n (*spec (12)*)\n merge_bounded :: \"('a,'b) merge_d program set\"\n where \"merge_bounded =\n UNIV guarantees\n Always {s. \\elt \\ set (merge.iOut s). elt < Nclients}\"\n\ndefinition\n (*spec (13)*)\n merge_follows :: \"('a,'b) merge_d program set\"\n where \"merge_follows =\n (\\i \\ lessThan Nclients. Increasing (sub i o merge.In))\n guarantees\n (\\i \\ lessThan Nclients.\n (%s. sublist (merge.Out s)\n {k. k < size(merge.iOut s) & merge.iOut s! k = i})\n Fols (sub i o merge.In))\"\n\ndefinition\n (*spec: preserves part*)\n merge_preserves :: \"('a,'b) merge_d program set\"\n where \"merge_preserves = preserves merge.In Int preserves merge_d.dummy\"\n\ndefinition\n (*environmental constraints*)\n merge_allowed_acts :: \"('a,'b) merge_d program set\"\n where \"merge_allowed_acts =\n {F. AllowedActs F =\n insert Id (UNION (preserves (funPair merge.Out merge.iOut)) Acts)}\"\n\ndefinition\n merge_spec :: \"('a,'b) merge_d program set\"\n where \"merge_spec = merge_increasing Int merge_eqOut Int merge_bounded Int\n merge_follows Int merge_allowed_acts Int merge_preserves\"\n\n(** Distributor specification (the number of outputs is Nclients) ***)\n\ndefinition\n (*spec (14)*)\n distr_follows :: \"('a,'b) distr_d program set\"\n where \"distr_follows =\n Increasing distr.In Int Increasing distr.iIn Int\n Always {s. \\elt \\ set (distr.iIn s). elt < Nclients}\n guarantees\n (\\i \\ lessThan Nclients.\n (sub i o distr.Out) Fols\n (%s. sublist (distr.In s)\n {k. k < size(distr.iIn s) & distr.iIn s ! k = i}))\"\n\ndefinition\n distr_allowed_acts :: \"('a,'b) distr_d program set\"\n where \"distr_allowed_acts =\n {D. AllowedActs D = insert Id (UNION (preserves distr.Out) Acts)}\"\n\ndefinition\n distr_spec :: \"('a,'b) distr_d program set\"\n where \"distr_spec = distr_follows Int distr_allowed_acts\"\n\n(** Single-client allocator specification (required) ***)\n\ndefinition\n (*spec (18)*)\n alloc_increasing :: \"'a allocState_d program set\"\n where \"alloc_increasing = UNIV guarantees Increasing giv\"\n\ndefinition\n (*spec (19)*)\n alloc_safety :: \"'a allocState_d program set\"\n where \"alloc_safety =\n Increasing rel\n guarantees Always {s. tokens (giv s) \\ NbT + tokens (rel s)}\"\n\ndefinition\n (*spec (20)*)\n alloc_progress :: \"'a allocState_d program set\"\n where \"alloc_progress =\n Increasing ask Int Increasing rel Int\n Always {s. \\elt \\ set (ask s). elt \\ NbT}\n Int\n (\\h. {s. h \\ giv s & h pfixGe (ask s)}\n LeadsTo\n {s. tokens h \\ tokens (rel s)})\n guarantees (\\h. {s. h \\ ask s} LeadsTo {s. h pfixLe giv s})\"\n\ndefinition\n (*spec: preserves part*)\n alloc_preserves :: \"'a allocState_d program set\"\n where \"alloc_preserves = preserves rel Int\n preserves ask Int\n preserves allocState_d.dummy\"\n\n\ndefinition\n (*environmental constraints*)\n alloc_allowed_acts :: \"'a allocState_d program set\"\n where \"alloc_allowed_acts =\n {F. AllowedActs F = insert Id (UNION (preserves giv) Acts)}\"\n\ndefinition\n alloc_spec :: \"'a allocState_d program set\"\n where \"alloc_spec = alloc_increasing Int alloc_safety Int alloc_progress Int\n alloc_allowed_acts Int alloc_preserves\"\n\nlocale Merge =\n fixes M :: \"('a,'b::order) merge_d program\"\n assumes\n Merge_spec: \"M \\ merge_spec\"\n\nlocale Distrib =\n fixes D :: \"('a,'b::order) distr_d program\"\n assumes\n Distrib_spec: \"D \\ distr_spec\"\n\n\n(****\n# {** Network specification ***}\n\n# {*spec (9.1)*}\n# network_ask :: \"'a systemState program set\n# \"network_ask == \\i \\ lessThan Nclients.\n# Increasing (ask o sub i o client)\n# guarantees[ask]\n# (ask Fols (ask o sub i o client))\"\n\n# {*spec (9.2)*}\n# network_giv :: \"'a systemState program set\n# \"network_giv == \\i \\ lessThan Nclients.\n# Increasing giv\n# guarantees[giv o sub i o client]\n# ((giv o sub i o client) Fols giv)\"\n\n# {*spec (9.3)*}\n# network_rel :: \"'a systemState program set\n# \"network_rel == \\i \\ lessThan Nclients.\n# Increasing (rel o sub i o client)\n# guarantees[rel]\n# (rel Fols (rel o sub i o client))\"\n\n# {*spec: preserves part*}\n# network_preserves :: \"'a systemState program set\n# \"network_preserves == preserves giv Int\n# (\\i \\ lessThan Nclients.\n# preserves (funPair rel ask o sub i o client))\"\n\n# network_spec :: \"'a systemState program set\n# \"network_spec == network_ask Int network_giv Int\n# network_rel Int network_preserves\"\n\n\n# {** State mappings **}\n# sysOfAlloc :: \"((nat => merge) * 'a) allocState_d => 'a systemState\"\n# \"sysOfAlloc == %s. let (cl,xtr) = allocState_d.dummy s\n# in (| giv = giv s,\n# ask = ask s,\n# rel = rel s,\n# client = cl,\n# dummy = xtr|)\"\n\n\n# sysOfClient :: \"(nat => merge) * 'a allocState_d => 'a systemState\"\n# \"sysOfClient == %(cl,al). (| giv = giv al,\n# ask = ask al,\n# rel = rel al,\n# client = cl,\n# systemState.dummy = allocState_d.dummy al|)\"\n****)\n\n\ndeclare subset_preserves_o [THEN subsetD, intro]\ndeclare funPair_o_distrib [simp]\ndeclare Always_INT_distrib [simp]\ndeclare o_apply [simp del]\n\n\nsubsection{*Theorems for Merge*}\n\ncontext Merge\nbegin\n\nlemma Merge_Allowed:\n \"Allowed M = (preserves merge.Out) Int (preserves merge.iOut)\"\napply (cut_tac Merge_spec)\napply (auto simp add: merge_spec_def merge_allowed_acts_def Allowed_def\n safety_prop_Acts_iff)\ndone\n\nlemma M_ok_iff [iff]:\n \"M ok G = (G \\ preserves merge.Out & G \\ preserves merge.iOut &\n M \\ Allowed G)\"\nby (auto simp add: Merge_Allowed ok_iff_Allowed)\n\n\nlemma Merge_Always_Out_eq_iOut:\n \"[| G \\ preserves merge.Out; G \\ preserves merge.iOut; M \\ Allowed G |]\n ==> M Join G \\ Always {s. length (merge.Out s) = length (merge.iOut s)}\"\napply (cut_tac Merge_spec)\napply (force dest: guaranteesD simp add: merge_spec_def merge_eqOut_def)\ndone\n\nlemma Merge_Bounded:\n \"[| G \\ preserves merge.iOut; G \\ preserves merge.Out; M \\ Allowed G |]\n ==> M Join G \\ Always {s. \\elt \\ set (merge.iOut s). elt < Nclients}\"\napply (cut_tac Merge_spec)\napply (force dest: guaranteesD simp add: merge_spec_def merge_bounded_def)\ndone\n\nlemma Merge_Bag_Follows_lemma:\n \"[| G \\ preserves merge.iOut; G \\ preserves merge.Out; M \\ Allowed G |]\n ==> M Join G \\ Always\n {s. (\\i \\ lessThan Nclients. bag_of (sublist (merge.Out s)\n {k. k < length (iOut s) & iOut s ! k = i})) =\n (bag_of o merge.Out) s}\"\napply (rule Always_Compl_Un_eq [THEN iffD1])\napply (blast intro: Always_Int_I [OF Merge_Always_Out_eq_iOut Merge_Bounded])\napply (rule UNIV_AlwaysI, clarify)\napply (subst bag_of_sublist_UN_disjoint [symmetric])\n apply (simp)\n apply blast\napply (simp add: set_conv_nth)\napply (subgoal_tac\n \"(\\i \\ lessThan Nclients. {k. k < length (iOut x) & iOut x ! k = i}) =\n lessThan (length (iOut x))\")\n apply (simp (no_asm_simp) add: o_def)\napply blast\ndone\n\nlemma Merge_Bag_Follows:\n \"M \\ (\\i \\ lessThan Nclients. Increasing (sub i o merge.In))\n guarantees\n (bag_of o merge.Out) Fols\n (%s. \\i \\ lessThan Nclients. (bag_of o sub i o merge.In) s)\"\napply (rule Merge_Bag_Follows_lemma [THEN Always_Follows1, THEN guaranteesI], auto)\napply (rule Follows_setsum)\napply (cut_tac Merge_spec)\napply (auto simp add: merge_spec_def merge_follows_def o_def)\napply (drule guaranteesD)\n prefer 3\n apply (best intro: mono_bag_of [THEN mono_Follows_apply, THEN subsetD], auto)\ndone\n\nend\n\n\nsubsection{*Theorems for Distributor*}\n\ncontext Distrib\nbegin\n\nlemma Distr_Increasing_Out:\n \"D \\ Increasing distr.In Int Increasing distr.iIn Int\n Always {s. \\elt \\ set (distr.iIn s). elt < Nclients}\n guarantees\n (\\i \\ lessThan Nclients. Increasing (sub i o distr.Out))\"\napply (cut_tac Distrib_spec)\napply (simp add: distr_spec_def distr_follows_def)\napply clarify\napply (blast intro: guaranteesI Follows_Increasing1 dest: guaranteesD)\ndone\n\nlemma Distr_Bag_Follows_lemma:\n \"[| G \\ preserves distr.Out;\n D Join G \\ Always {s. \\elt \\ set (distr.iIn s). elt < Nclients} |]\n ==> D Join G \\ Always\n {s. (\\i \\ lessThan Nclients. bag_of (sublist (distr.In s)\n {k. k < length (iIn s) & iIn s ! k = i})) =\n bag_of (sublist (distr.In s) (lessThan (length (iIn s))))}\"\napply (erule Always_Compl_Un_eq [THEN iffD1])\napply (rule UNIV_AlwaysI, clarify)\napply (subst bag_of_sublist_UN_disjoint [symmetric])\n apply (simp (no_asm))\n apply blast\napply (simp add: set_conv_nth)\napply (subgoal_tac\n \"(\\i \\ lessThan Nclients. {k. k < length (iIn x) & iIn x ! k = i}) =\n lessThan (length (iIn x))\")\n apply (simp (no_asm_simp))\napply blast\ndone\n\nlemma D_ok_iff [iff]:\n \"D ok G = (G \\ preserves distr.Out & D \\ Allowed G)\"\napply (cut_tac Distrib_spec)\napply (auto simp add: distr_spec_def distr_allowed_acts_def Allowed_def\n safety_prop_Acts_iff ok_iff_Allowed)\ndone\n\nlemma Distr_Bag_Follows:\n \"D \\ Increasing distr.In Int Increasing distr.iIn Int\n Always {s. \\elt \\ set (distr.iIn s). elt < Nclients}\n guarantees\n (\\i \\ lessThan Nclients.\n (%s. \\i \\ lessThan Nclients. (bag_of o sub i o distr.Out) s)\n Fols\n (%s. bag_of (sublist (distr.In s) (lessThan (length(distr.iIn s))))))\"\napply (rule guaranteesI, clarify)\napply (rule Distr_Bag_Follows_lemma [THEN Always_Follows2], auto)\napply (rule Follows_setsum)\napply (cut_tac Distrib_spec)\napply (auto simp add: distr_spec_def distr_follows_def o_def)\napply (drule guaranteesD)\n prefer 3\n apply (best intro: mono_bag_of [THEN mono_Follows_apply, THEN subsetD], auto)\ndone\n\nend\n\n\nsubsection{*Theorems for Allocator*}\n\nlemma alloc_refinement_lemma:\n \"!!f::nat=>nat. (\\i \\ lessThan n. {s. f i \\ g i s})\n \\ {s. (SUM x: lessThan n. f x) \\ (SUM x: lessThan n. g x s)}\"\napply (induct_tac \"n\")\napply (auto simp add: lessThan_Suc)\ndone\n\nlemma alloc_refinement:\n\"(\\i \\ lessThan Nclients. Increasing (sub i o allocAsk) Int\n Increasing (sub i o allocRel))\n Int\n Always {s. \\i. i\n (\\elt \\ set ((sub i o allocAsk) s). elt \\ NbT)}\n Int\n (\\i \\ lessThan Nclients.\n \\h. {s. h \\ (sub i o allocGiv)s & h pfixGe (sub i o allocAsk)s}\n LeadsTo {s. tokens h \\ (tokens o sub i o allocRel)s})\n \\\n (\\i \\ lessThan Nclients. Increasing (sub i o allocAsk) Int\n Increasing (sub i o allocRel))\n Int\n Always {s. \\i. i\n (\\elt \\ set ((sub i o allocAsk) s). elt \\ NbT)}\n Int\n (\\hf. (\\i \\ lessThan Nclients.\n {s. hf i \\ (sub i o allocGiv)s & hf i pfixGe (sub i o allocAsk)s})\n LeadsTo {s. (\\i \\ lessThan Nclients. tokens (hf i)) \\\n (\\i \\ lessThan Nclients. (tokens o sub i o allocRel)s)})\"\napply (auto simp add: ball_conj_distrib)\napply (rename_tac F hf)\napply (rule LeadsTo_weaken_R [OF Finite_stable_completion alloc_refinement_lemma], blast, blast)\napply (subgoal_tac \"F \\ Increasing (tokens o (sub i o allocRel))\")\n apply (simp add: Increasing_def o_assoc)\napply (blast intro: mono_tokens [THEN mono_Increasing_o, THEN subsetD])\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/UNITY/Comp/AllocImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2644155486683554}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * This file contains theorems for dealing with a \"simply\" lifted\n * heap, where each byte of memory can be accessed as one (and only)\n * type.\n *\n * This is a simpler model of Tuch's \"lift_t\" model, where nested\n * struct fields cannot be directly accessed as pointers.\n *)\n\ntheory TypHeapSimple\nimports\n \"CLib.TypHeapLib\"\nbegin\n\n(*\n * Each address in the heap can contain one of three things:\n *\n * - A type tag, which inidicates that this address is the first\n * byte of an object;\n *\n * - A footprint, which indicates that this address is a latter byte\n * of an object;\n *\n * - Nothing, which indicates that this address does not fall inside\n * an object.\n *)\ndatatype heap_typ_contents =\n HeapType typ_uinfo\n | HeapFootprint\n | HeapEmpty\n\n(*\n * Given a Tuch-style heap representation (where each memory location\n * contains a set of different types, representing nested field types)\n * calculate a single top-level type of the heap.\n *\n * We just want to commit to a single type for this heap location,\n * and nothing more.\n *)\ndefinition\n heap_type_tag :: \"heap_typ_desc \\ addr \\ heap_typ_contents\"\nwhere\n \"heap_type_tag d a \\\n (if fst (d a) = False \\ (\\x. (snd (d a)) x = None) \\ (\\x. (snd (d a)) x \\ None) then\n HeapEmpty\n else\n case (snd (d a)) (GREATEST x. snd (d a) x \\ None) of\n Some (_, False) \\ HeapFootprint\n | Some (x, True) \\ HeapType x\n | None \\ HeapEmpty)\"\n\n(*\n * Determine if the heap has a valid footprint for the given type at\n * the given address.\n *\n * A valid footprint means that the user has committed that the given\n * memory location will only be used for the given type.\n *\n * A \"simple\" footprint differs from the Tuch-style because we only\n * commit to a single type, and have no support for accessing nested\n * structures.\n *)\ndefinition\n valid_simple_footprint :: \"heap_typ_desc \\ addr \\ typ_uinfo \\ bool\"\nwhere\n \"valid_simple_footprint d x t \\\n heap_type_tag d x = HeapType t \\\n (\\y. y \\ {x + 1..+ (size_td t)- Suc 0} \\ heap_type_tag d y = HeapFootprint)\"\n\nlemma valid_simple_footprintI:\n \"\\ heap_type_tag d x = HeapType t; \\y. y \\ {x + 1..+(size_td t) - Suc 0} \\ heap_type_tag d y = HeapFootprint \\\n \\ valid_simple_footprint d x t\"\n by (clarsimp simp: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD:\n \"valid_simple_footprint d x t \\ heap_type_tag d x = HeapType t\"\n by (simp add: valid_simple_footprint_def)\n\nlemma valid_simple_footprintD2:\n \"\\ valid_simple_footprint d x t; y \\ {x + 1..+(size_td t) - Suc 0} \\ \\ heap_type_tag d y = HeapFootprint\"\n by (simp add: valid_simple_footprint_def)\n\nlemma typ_slices_not_empty:\n \"typ_slices (x::('a::{mem_type} itself)) \\ []\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma last_typ_slice_t:\n \"(last (typ_slice_t t 0)) = (t, True)\"\n apply (case_tac t)\n apply clarsimp\n done\n\nlemma if_eqI:\n \"\\ a \\ x = z; \\ a \\ y = z \\ \\ (if a then x else y) = z\"\n by simp\n\nlemma heap_type_tag_ptr_retyp:\n \"snd (s (ptr_val t)) = Map.empty \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) = HeapType (typ_uinfo_t TYPE('a))\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, fastforce, fastforce)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply clarsimp\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) 0)\" in allE)\n apply (clarsimp simp: list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] last_typ_slice_t\n split: option.splits if_split_asm prod.splits)\n done\n\nlemma not_snd_last_typ_slice_t:\n \"k \\ 0 \\ \\ snd (last (typ_slice_t z k))\"\n by (case_tac z, clarsimp)\n\nlemma heap_type_tag_ptr_retyp_rest:\n \"\\ snd (s (ptr_val t + k)) = Map.empty; 0 < k; unat k < size_td (typ_uinfo_t TYPE('a)) \\ \\\n heap_type_tag (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t + k) = HeapFootprint\"\n apply (unfold ptr_retyp_def heap_type_tag_def)\n apply (subst htd_update_list_index, simp, clarsimp,\n metis intvlI size_of_def word_unat.Rep_inverse)+\n apply (rule if_eqI)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=0 in allE)\n apply (clarsimp simp: size_of_def)\n apply (erule_tac x=\"length (typ_slice_t (typ_uinfo_t TYPE('a)) (unat k))\" in allE)\n apply (clarsimp simp: size_of_def list_map_eq)\n apply (clarsimp simp: list_map_eq last_conv_nth [simplified, symmetric] size_of_def\n split: option.splits if_split_asm prod.splits bool.splits)\n apply (metis surj_pair)\n apply (subst (asm) (2) surjective_pairing)\n apply (subst (asm) not_snd_last_typ_slice_t)\n apply clarsimp\n apply unat_arith\n apply simp\n done\n\nlemma typ_slices_addr_card [simp]:\n \"length (typ_slices (x::('a::{mem_type} itself))) < addr_card\"\n apply (clarsimp simp: typ_slices_def)\n done\n\nlemma htd_update_list_same':\n \"\\0 < unat k; unat k \\ addr_card - length v\\ \\ htd_update_list (p + k) v h p = h p\"\n apply (insert htd_update_list_same [where v=v and p=p and h=h and k=\"unat k\"])\n apply clarsimp\n done\n\nlemma unat_less_impl_less:\n \"unat a < unat b \\ a < b\"\n by unat_arith\n\nlemma valid_simple_footprint_ptr_retyp:\n \"\\ \\k < size_td (typ_uinfo_t TYPE('a)). snd (s (ptr_val t + of_nat k)) = Map.empty;\n 1 \\ size_td (typ_uinfo_t TYPE('a));\n size_td (typ_uinfo_t TYPE('a)) < addr_card \\\n \\ valid_simple_footprint (ptr_retyp (t :: 'a::mem_type ptr) s) (ptr_val t) (typ_uinfo_t TYPE('a))\"\n apply (clarsimp simp: valid_simple_footprint_def)\n apply (rule conjI)\n apply (subst heap_type_tag_ptr_retyp)\n apply (erule allE [where x=\"0\"])\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (erule_tac x=\"k + 1\" in allE)\n apply (erule impE)\n apply (metis One_nat_def less_diff_conv)\n apply (subst add.assoc, subst heap_type_tag_ptr_retyp_rest)\n apply clarsimp\n apply (case_tac \"1 + of_nat k = (0 :: addr)\")\n apply (metis add.left_neutral intvlI intvl_Suc_nmem size_of_def)\n apply unat_arith\n apply clarsimp\n apply (metis lt_size_of_unat_simps size_of_def Suc_eq_plus1 One_nat_def less_diff_conv of_nat_Suc)\n apply simp\n done\n\n(* Determine if the given pointer is valid in the given heap. *)\ndefinition\n heap_ptr_valid :: \"heap_typ_desc \\ 'a::c_type ptr \\ bool\"\nwhere\n \"heap_ptr_valid d p \\\n valid_simple_footprint d (ptr_val (p::'a ptr)) (typ_uinfo_t TYPE('a))\n \\ c_guard p\"\n\n(*\n * Lift a heap from raw bytes and a heap description into\n * higher-level objects.\n *\n * This differs from Tuch's \"lift_t\" because we only support\n * simple lifting; that is, each byte in the heap may only\n * be accessed as a single type. Accessing struct fields by\n * their pointers is not supported.\n *)\ndefinition\n simple_lift :: \"heap_raw_state \\ ('a::c_type) ptr \\ 'a option\"\nwhere\n \"simple_lift s p = (\n if (heap_ptr_valid (hrs_htd s) p) then\n (Some (h_val (hrs_mem s) p))\n else\n None)\"\n\nlemma simple_lift_heap_ptr_valid:\n \"simple_lift s p = Some x \\ heap_ptr_valid (hrs_htd s) p\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma simple_lift_c_guard:\n \"simple_lift s p = Some x \\ c_guard p\"\n apply (clarsimp simp: simple_lift_def heap_ptr_valid_def split: if_split_asm)\n done\n\n(* Two valid footprints will either overlap completely or not at all. *)\nlemma valid_simple_footprint_neq:\n assumes valid_p: \"valid_simple_footprint d p s\"\n and valid_q: \"valid_simple_footprint d q t\"\n and neq: \"p \\ q\"\n shows \"p \\ {q..+ (size_td t)}\"\nproof -\n have heap_type_p: \"heap_type_tag d p = HeapType s\"\n apply (metis valid_p valid_simple_footprint_def)\n done\n\n have heap_type_q: \"heap_type_tag d q = HeapType t\"\n apply (metis valid_q valid_simple_footprint_def)\n done\n\n have heap_type_q_footprint:\n \"\\x. x \\ {(q + 1)..+(size_td t - Suc 0)} \\ heap_type_tag d x = HeapFootprint\"\n apply (insert valid_q)\n apply (simp add: valid_simple_footprint_def)\n done\n\n show ?thesis\n using heap_type_q_footprint heap_type_p neq\n intvl_neq_start heap_type_q\n by (metis heap_typ_contents.simps(2))\nqed\n\n(* Two valid footprints with different types will never overlap. *)\nlemma valid_simple_footprint_type_neq:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n p \\ {q..+ (size_td t)}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma valid_simple_footprint_neq_disjoint:\n \"\\ valid_simple_footprint d p s; valid_simple_footprint d q t; p \\ q \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (rule ccontr)\n apply (fastforce simp: valid_simple_footprint_neq dest!: intvl_inter)\n done\n\nlemma valid_simple_footprint_type_neq_disjoint:\n \"\\ valid_simple_footprint d p s;\n valid_simple_footprint d q t;\n s \\ t \\ \\\n {p..+(size_td s)} \\ {q..+ (size_td t)} = {}\"\n apply (subgoal_tac \"p \\ q\")\n apply (rule valid_simple_footprint_neq_disjoint, simp_all)[1]\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma heap_ptr_valid_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n ptr_val p \\ ptr_val q \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (clarsimp simp only: size_of_tag [symmetric])\n apply (rule valid_simple_footprint_neq_disjoint [where d=\"d\"])\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply simp\n done\n\nlemma heap_ptr_valid_type_neq_disjoint:\n \"\\ heap_ptr_valid d (p::'a::c_type ptr);\n heap_ptr_valid d (q::'b::c_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n apply (subgoal_tac \"ptr_val p \\ ptr_val q\")\n apply (rule heap_ptr_valid_neq_disjoint, auto)[1]\n apply (clarsimp simp: heap_ptr_valid_def valid_simple_footprint_def)\n done\n\n(* If we update one pointer in the heap, other valid pointers will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"ptr_val p \\ ptr_val q\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* If we update one type in the heap, other types will be unaffected. *)\nlemma heap_ptr_valid_heap_update_other_typ:\n assumes val_p: \"heap_ptr_valid d (p::'a::mem_type ptr)\"\n and val_q: \"heap_ptr_valid d (q::'b::c_type ptr)\"\n and neq: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule heap_ptr_valid_type_neq_disjoint [OF val_p val_q neq])\n apply simp\n done\n\n(* Updating the raw heap is equivalent to updating the lifted heap. *)\nlemma simple_lift_heap_update:\n \"\\ heap_ptr_valid (hrs_htd h) p \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h)\n = (simple_lift h)(p := Some (v::'a::mem_type))\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def hrs_mem_update h_val_heap_update)\n apply (fastforce simp: heap_ptr_valid_heap_update_other)\n done\n\n(* Updating the raw heap of one type doesn't affect the lifted heap of other types. *)\nlemma simple_lift_heap_update_other:\n \"\\ heap_ptr_valid (hrs_htd d) (p::'b::mem_type ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) d) = ((simple_lift d)::'a::c_type typ_heap)\"\n apply (rule ext)+\n apply (clarsimp simp: simple_lift_def h_val_heap_update hrs_mem_update)\n apply (auto intro: heap_ptr_valid_heap_update_other_typ)\n done\n\nlemma h_val_simple_lift:\n \"simple_lift h p = Some v \\ h_val (hrs_mem h) p = v\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n done\n\nlemma h_val_field_simple_lift:\n \"\\ simple_lift h (pa :: 'a ptr) = Some (v::'a::mem_type);\n \\t. field_ti TYPE('a) f = Some t;\n export_uinfo (the (field_ti TYPE('a) f)) = export_uinfo (typ_info_t TYPE('b :: mem_type)) \\ \\\n h_val (hrs_mem h) (Ptr &(pa\\f) :: 'b :: mem_type ptr) = from_bytes (access_ti\\<^sub>0 (the (field_ti TYPE('a) f)) v)\"\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: h_val_field_from_bytes)\n done\n\nlemma simple_lift_heap_update':\n \"simple_lift h p = Some v' \\\n simple_lift (hrs_mem_update (heap_update (p::('a::{mem_type}) ptr) v) h)\n = (simple_lift h)(p := Some v)\"\n apply (rule simple_lift_heap_update)\n apply (erule simple_lift_heap_ptr_valid)\n done\n\nlemma simple_lift_hrs_mem_update_None [simp]:\n \"(simple_lift (hrs_mem_update a hp) x = None) = (simple_lift hp x = None)\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma simple_lift_data_eq:\n \"\\ h_val (hrs_mem h) p = h_val (hrs_mem h') p';\n heap_ptr_valid (hrs_htd h) p = heap_ptr_valid (hrs_htd h') p' \\ \\\n simple_lift h p = simple_lift h' p'\"\n apply (clarsimp simp: simple_lift_def)\n done\n\nlemma h_val_heap_update_disjoint:\n \"\\ {ptr_val p ..+ size_of TYPE('a::c_type)}\n \\ {ptr_val q ..+ size_of TYPE('b::mem_type)} = {} \\ \\\n h_val (heap_update (q :: 'b ptr) r h) (p :: 'a ptr) = h_val h p\"\n apply (clarsimp simp: h_val_def)\n apply (clarsimp simp: heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply blast\n apply clarsimp\n done\n\nlemma update_ti_t_valid_size:\n \"size_of TYPE('b) = size_td t \\\n update_ti_t t (to_bytes_p (val::'b::mem_type)) obj = update_ti t (to_bytes_p val) obj\"\n apply (clarsimp simp: update_ti_t_def to_bytes_p_def)\n done\n\nlemma h_val_field_from_bytes':\n \"\\ field_ti TYPE('a::{mem_type}) f = Some t;\n export_uinfo t = export_uinfo (typ_info_t TYPE('b::{mem_type})) \\ \\\n h_val h (Ptr &(pa\\f) :: 'b ptr) = from_bytes (access_ti\\<^sub>0 t (h_val h pa))\"\n apply (insert h_val_field_from_bytes[where f=f and pa=pa and t=t and h=\"(h,x)\"\n and 'a='a and 'b='b for x])\n apply (clarsimp simp: hrs_mem_def)\n done\n\nlemma simple_lift_super_field_update_lookup:\n fixes dummy :: \"'b :: mem_type\"\n assumes \"field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (s,n)\"\n and \"typ_uinfo_t TYPE('a) = export_uinfo s\"\n and \"simple_lift h p = Some v'\"\n shows \"(super_field_update_t (Ptr (&(p\\f))) (v::'a::mem_type) ((simple_lift h)::'b ptr \\ 'b option)) =\n ((simple_lift h)(p \\ field_update (field_desc s) (to_bytes_p v) v'))\"\nproof -\n from assms have [simp]: \"unat (of_nat n :: addr) = n\"\n apply (subst unat_of_nat)\n apply (subst mod_less)\n apply (drule td_set_field_lookupD)+\n apply (drule td_set_offset_size)+\n apply (subst len_of_addr_card)\n apply (subst (asm) size_of_def [symmetric, where t=\"TYPE('b)\"])+\n apply (subgoal_tac \"size_of TYPE('b) < addr_card\")\n apply arith\n apply simp\n apply simp\n done\n from assms show ?thesis\n apply (clarsimp simp: super_field_update_t_def)\n apply (rule ext)\n apply (clarsimp simp: field_lvalue_def split: option.splits)\n apply (safe, simp_all)\n apply (frule_tac v=v and v'=v' in update_field_update)\n apply (clarsimp simp: field_of_t_def field_of_def typ_uinfo_t_def)\n apply (frule_tac m=0 in field_names_SomeD2)\n apply simp\n apply clarsimp\n apply (simp add: field_typ_def field_typ_untyped_def)\n apply (frule field_lookup_export_uinfo_Some)\n apply (frule_tac s=k in field_lookup_export_uinfo_Some)\n apply simp\n apply (drule (1) field_lookup_inject)\n apply (subst typ_uinfo_t_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\n apply simp\n apply (drule field_of_t_mem)+\n apply (case_tac h)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply fast\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply (frule field_lookup_export_uinfo_Some)\n apply (simp add: typ_uinfo_t_def)\n done\nqed\n\nlemma field_offset_addr_card:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x\n \\ field_offset TYPE('a) f < addr_card\"\n apply (clarsimp simp: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (frule td_set_field_lookupD)\n apply (drule td_set_offset_size)\n apply (insert max_size [where ?'a=\"'a\"])\n apply (clarsimp simp: size_of_def)\n done\n\nlemma unat_of_nat_field_offset:\n \"\\x. field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some x \\\n unat (of_nat (field_offset TYPE('a) f) :: addr) = field_offset TYPE('a) f\"\n apply (subst word_unat.Abs_inverse)\n apply (clarsimp simp: unats_def)\n apply (insert field_offset_addr_card [where f=f and ?'a=\"'a\"])[1]\n apply (fastforce simp: addr_card)\n apply simp\n done\n\nlemma field_of_t_field_lookup:\n assumes a: \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n)\"\n assumes b: \"export_uinfo s = typ_uinfo_t TYPE('b::mem_type)\"\n assumes n: \"n = field_offset TYPE('a) f\"\n shows \"field_of_t (Ptr &(ptr\\f) :: ('b ptr)) (ptr :: 'a ptr)\"\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_of_t_def field_of_def)\n apply (subst td_set_field_lookup)\n apply (rule wf_desc_typ_tag)\n apply (rule exI [where x=f])\n using a[simplified n] b\n apply (clarsimp simp: typ_uinfo_t_def)\n apply (subst field_lookup_export_uinfo_Some)\n apply assumption\n apply (clarsimp simp del: field_lookup_offset_eq\n simp: field_lvalue_def unat_of_nat_field_offset)\n done\n\nlemma simple_lift_field_update':\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('a)) f 0 =\n Some (adjust_ti (typ_info_t TYPE('b)) xf xfu, n)\"\n and xf_xfu: \"fg_cons xf xfu\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu val z)\"\n (is \"?LHS = ?RHS\")\nproof (rule ext)\n fix p\n\n have eui: \"typ_uinfo_t TYPE('b) =\n export_uinfo (adjust_ti (typ_info_t TYPE('b)) xf xfu)\"\n using xf_xfu\n apply (subst export_tag_adjust_ti2 [OF _ wf_lf wf_desc])\n apply (simp add: fg_cons_def )\n apply (rule meta_eq_to_obj_eq [OF typ_uinfo_t_def])\n done\n\n have n_is_field_offset: \"n = field_offset TYPE('a) f\"\n apply (insert field_lookup_offset_eq [OF fl])\n apply (clarsimp)\n done\n\n have equal_case: \"?LHS ptr = ?RHS ptr\"\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (clarsimp simp: hrs_mem_update)\n apply (subst h_val_super_update_bs)\n apply (rule field_of_t_field_lookup [OF fl])\n apply (clarsimp simp: eui)\n apply (clarsimp simp: n_is_field_offset)\n apply clarsimp\n apply (unfold from_bytes_def)\n apply (subst fi_fu_consistentD [where f=f and s=\"adjust_ti (typ_info_t TYPE('b)) xf xfu\"])\n apply (clarsimp simp: fl)\n apply (clarsimp simp: n_is_field_offset field_lvalue_def)\n apply (metis unat_of_nat_field_offset fl)\n apply clarsimp\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: size_of_def)\n apply clarsimp\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply (subst update_ti_adjust_ti)\n apply (rule xf_xfu)\n apply (subst update_ti_s_from_bytes)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: h_val_def)\n done\n\n show \"?LHS p = ?RHS p\"\n apply (case_tac \"p = ptr\")\n apply (erule ssubst)\n apply (rule equal_case)\n apply (insert cl)\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule h_val_heap_update_disjoint)\n apply (insert field_tag_sub [OF fl, where p=ptr])\n apply (clarsimp simp: size_of_def)\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (frule (1) valid_simple_footprint_neq_disjoint, fastforce)\n apply clarsimp\n apply blast\n done\nqed\n\nlemma simple_lift_field_update:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f =\n Some (adjust_ti (typ_info_t TYPE('b)) xf (xfu o (\\x _. x)))\"\n and xf_xfu: \"fg_cons xf (xfu o (\\x _. x))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"(simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) =\n simple_lift hp(ptr \\ xfu (\\_. val) z)\"\n (is \"?LHS = ?RHS\")\n apply (insert fl [unfolded field_ti_def])\n apply (clarsimp split: option.splits)\n apply (subst simple_lift_field_update' [where xf=xf and xfu=\"xfu o (\\x _. x)\" and z=z])\n apply (clarsimp simp: o_def split: option.splits)\n apply (rule refl)\n apply (rule xf_xfu)\n apply (rule cl)\n apply clarsimp\n done\n\nlemma simple_heap_diff_types_impl_diff_ptrs:\n \"\\ heap_ptr_valid h (p::('a::c_type) ptr);\n heap_ptr_valid h (q::('b::c_type) ptr);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n ptr_val p \\ ptr_val q\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (clarsimp simp: valid_simple_footprint_def)\n done\n\nlemma h_val_update_regions_disjoint:\n \"\\ { ptr_val p ..+ size_of TYPE('a) } \\ { ptr_val x ..+ size_of TYPE('b)} = {} \\ \\\n h_val (heap_update p (v::('a::mem_type)) h) x = h_val h (x::('b::c_type) ptr)\"\n apply (clarsimp simp: heap_update_def)\n apply (clarsimp simp: h_val_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply clarsimp\n done\n\nlemma simple_lift_field_update_t:\n fixes val :: \"'b :: mem_type\" and ptr :: \"'a :: mem_type ptr\"\n assumes fl: \"field_ti TYPE('a) f = Some t\"\n and diff: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('c :: c_type)\"\n and eu: \"export_uinfo t = export_uinfo (typ_info_t TYPE('b))\"\n and cl: \"simple_lift hp ptr = Some z\"\n shows \"((simple_lift (hrs_mem_update (heap_update (Ptr &(ptr\\f)) val) hp)) :: 'c ptr \\ 'c option) =\n simple_lift hp\"\n apply (rule ext)\n apply (case_tac \"simple_lift hp x\")\n apply clarsimp\n apply (case_tac \"ptr_val x = ptr_val ptr\")\n apply clarsimp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (1) simple_heap_diff_types_impl_diff_ptrs [OF _ _ diff])\n apply simp\n apply (clarsimp simp: simple_lift_def hrs_mem_update split: if_split_asm)\n apply (rule field_ti_field_lookupE [OF fl])\n apply (frule_tac p=ptr in field_tag_sub)\n apply (clarsimp simp: h_val_def heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply clarsimp\n apply (cut_tac simple_lift_heap_ptr_valid [OF cl])\n apply (drule (2) heap_ptr_valid_neq_disjoint)\n apply (clarsimp simp: export_size_of [unfolded typ_uinfo_t_def, OF eu])\n apply blast\n apply simp\n done\n\nlemma simple_lift_heap_update_other':\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b) \\ \\\n simple_lift (hrs_mem_update (heap_update p v) h) = ((simple_lift h)::'a::c_type typ_heap)\"\n apply (rule simple_lift_heap_update_other)\n apply (erule simple_lift_heap_ptr_valid)\n apply simp\n done\n\n(* If you update bytes inside an object of one type, it won't affect\n * heaps of other types. *)\nlemma simple_lift_heap_update_bytes_in_other:\n \"\\ simple_lift h (p::'b::mem_type ptr) = Some v';\n typ_uinfo_t TYPE('b) \\ typ_uinfo_t TYPE('c);\n { ptr_val q ..+ size_of TYPE('a)} \\ {ptr_val p ..+ size_of TYPE('b) } \\ \\\n simple_lift (hrs_mem_update (heap_update (q::'a::mem_type ptr) v) h) = ((simple_lift h)::'c::mem_type typ_heap)\"\n apply (rule ext)\n apply (clarsimp simp: simple_lift_def split: if_split_asm)\n apply (drule (1) heap_ptr_valid_type_neq_disjoint, simp)\n apply (clarsimp simp: hrs_mem_update)\n apply (rule h_val_heap_update_disjoint)\n apply blast\n done\n\nlemma typ_name_neq:\n \"typ_name (export_uinfo (typ_info_t TYPE('a::c_type)))\n \\ typ_name (export_uinfo (typ_info_t TYPE('b::c_type)))\n \\ typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n apply (metis typ_uinfo_t_def)\n done\n\nlemma of_nat_mod_div_decomp:\n \"of_nat k\n = of_nat (k div size_of TYPE('b)) * of_nat (size_of TYPE('b::mem_type)) +\n of_nat (k mod size_of TYPE('b))\"\n by (metis mod_div_decomp of_nat_add of_nat_mult)\n\nlemma c_guard_array_c_guard:\n \"\\ \\x. x < CARD('a) \\ c_guard (ptr_coerce p +\\<^sub>p int x :: 'b ptr) \\ \\ c_guard ( p :: ('b :: mem_type, 'a :: finite) array ptr)\"\n apply atomize\n apply (clarsimp simp: c_guard_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: ptr_aligned_def align_of_def align_td_array)\n apply (simp add: c_null_guard_def)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"k div size_of TYPE('b)\" in spec)\n apply (erule impE)\n apply (metis (full_types) less_nat_zero_code mult_is_0 neq0_conv td_gal_lt)\n apply clarsimp\n apply (drule_tac x=\"k mod size_of TYPE('b)\" in spec)\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n apply (subst (asm) add.assoc)\n apply (subst (asm) of_nat_mod_div_decomp [symmetric])\n apply clarsimp\n done\n\nlemma heap_list_update_list':\n \"\\ n + x \\ length v; length v < addr_card; q = (p + of_nat x) \\ \\\n heap_list (heap_update_list p v h) n q = take n (drop x v)\"\n by (metis heap_list_update_list)\n\nlemma outside_intvl_range:\n \"p \\ {a ..+ b} \\ p < a \\ p \\ a + of_nat b\"\n apply (clarsimp simp: intvl_def not_le not_less)\n apply (drule_tac x=\"unat (p-a)\" in spec)\n apply clarsimp\n apply (metis add_diff_cancel2 le_less_linear le_unat_uoi\n mpl_lem not_add_less2 unat_mono word_less_minus_mono_left)\n done\n\nlemma first_in_intvl:\n \"b \\ 0 \\ a \\ {a ..+ b}\"\n by (force simp: intvl_def)\n\nlemma zero_not_in_intvl_no_overflow:\n \"0 \\ {a :: 'a::len word ..+ b} \\ unat a + b \\ 2 ^ len_of TYPE('a)\"\n apply (rule ccontr)\n apply (simp add: intvl_def not_le)\n apply (drule_tac x=\"2 ^ len_of TYPE('a) - unat a\" in spec)\n apply (clarsimp simp: not_less)\n apply (erule disjE)\n apply (metis (erased, hide_lams) diff_add_inverse less_imp_add_positive of_nat_2p of_nat_add\n unat_lt2p word_neq_0_conv word_unat.Rep_inverse)\n apply (metis le_add_diff_inverse le_antisym le_diff_conv le_refl\n less_imp_le_nat add.commute not_add_less1 unat_lt2p)\n done\n\nlemma intvl_split:\n \"\\ n \\ a \\ \\ { p :: ('a :: len) word ..+ n } = { p ..+ a } \\ { p + of_nat a ..+ (n - a)}\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=k in exI)\n apply clarsimp\n apply (rule classical)\n apply (drule_tac x=\"k - a\" in spec)\n apply (clarsimp simp: not_less)\n apply (metis diff_less_mono not_less)\n apply (clarsimp simp: intvl_def not_less)\n apply (rule_tac x=\"unat (x - p)\" in exI)\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (metis le_unat_uoi less_or_eq_imp_le not_less order_trans)\n apply clarsimp\n apply (metis le_def le_eq_less_or_eq le_unat_uoi less_diff_conv\n add.commute of_nat_add)\n done\n\nlemma heap_ptr_valid_range_not_NULL:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ 0 \\ {ptr_val p ..+ size_of TYPE('a)}\"\n apply (clarsimp simp: heap_ptr_valid_def)\n apply (metis c_guard_def c_null_guard_def)\n done\n\nlemma heap_ptr_valid_last_byte_no_overflow:\n \"heap_ptr_valid htd (p :: ('a :: c_type) ptr)\n \\ unat (ptr_val p) + size_of TYPE('a) \\ 2 ^ len_of TYPE(addr_bitsize)\"\n by (metis c_guard_def c_null_guard_def heap_ptr_valid_def\n zero_not_in_intvl_no_overflow)\n\nlemma heap_ptr_valid_intersect_array:\n \"\\ \\j < n. heap_ptr_valid htd (p +\\<^sub>p int j);\n heap_ptr_valid htd (q :: ('a :: c_type) ptr) \\\n \\ (\\m < n. q = (p +\\<^sub>p int m))\n \\ ({ptr_val p ..+ size_of TYPE ('a) * n} \\ {ptr_val q ..+ size_of TYPE ('a :: c_type)} = {})\"\n apply (induct n)\n apply clarsimp\n apply atomize\n apply simp\n apply (case_tac \"n = 0\")\n apply clarsimp\n apply (metis heap_ptr_valid_neq_disjoint ptr_val_inj)\n apply (erule disjE)\n apply (metis less_Suc_eq)\n apply (case_tac \"q = p +\\<^sub>p int n\")\n apply force\n apply (frule_tac x=n in spec)\n apply (erule impE, simp)\n apply (drule (1) heap_ptr_valid_neq_disjoint)\n apply simp\n apply (simp add: CTypesDefs.ptr_add_def)\n apply (rule disjI2)\n apply (cut_tac a=\" of_nat n * of_nat (size_of TYPE('a))\"\n and p=\"ptr_val p\" and n=\"n * size_of TYPE('a) + size_of TYPE('a)\" in intvl_split)\n apply clarsimp\n apply (clarsimp simp: field_simps Int_Un_distrib2)\n apply (metis IntI emptyE intvl_empty intvl_inter intvl_self neq0_conv)\n done\n\n(* Simplification rules for dealing with \"lift_simple\". *)\n\nlemmas simple_lift_simps =\n typ_name_neq\n simple_lift_c_guard\n h_val_simple_lift\n simple_lift_heap_update'\n simple_lift_heap_update_other'\n c_guard_field\n h_val_field_simple_lift\n simple_lift_field_update\n simple_lift_field_update_t\n c_guard_array_field\n nat_to_bin_string_simps\n\n(* Old name for the above simpset. *)\nlemmas typ_simple_heap_simps = simple_lift_simps\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/TypHeapSimple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2644155486683554}} {"text": "theory TopoS_Composition_Theory\nimports TopoS_Interface TopoS_Helper\nbegin\n\nsection{*Composition Theory*}\n\ntext{*Several invariants may apply to one policy. *}\n\ntext{*The security invariants are all collected in a list. \nThe list corresponds to the security requirements. \nThe list should have the type @{typ \"('v graph \\ bool) list\"}, i.e.\\ a list of predicates over the policy. \nWe need in instantiated security invariant, i.e.\\ get rid of @{typ \"'a\"} and @{typ \"'b\"}*}\n\n --{*An instance (configured) a security invariant I.e.\\ a concrete security requirement, in different terminology. *}\n record ('v) SecurityInvariant_configured =\n c_sinvar::\"('v) graph \\ bool\"\n c_offending_flows::\"('v) graph \\ ('v \\ 'v) set set\"\n c_isIFS::\"bool\"\n\n --{* parameters 1-3 are the @{text \"SecurityInvariant\"}:\n @{text sinvar} @{text \"\\\"} @{text \"receiver_violation\"}\n\n Fourth parameter is the host attribute mapping @{text nP}\n\n \n TODO: probably check @{text \"wf_graph\"} here and optionally some host-attribute sanity checker as in DomainHierachy.\n *}\n fun new_configured_SecurityInvariant ::\n \"((('v::vertex) graph \\ ('v \\ 'a) \\ bool) \\ 'a \\ bool \\ ('v \\ 'a)) \\ ('v SecurityInvariant_configured) option\" where \n \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = \n ( \n if SecurityInvariant sinvar defbot receiver_violation then \n Some \\ \n c_sinvar = (\\G. sinvar G nP),\n c_offending_flows = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP),\n c_isIFS = receiver_violation\n \\\n else None\n )\"\n\n declare new_configured_SecurityInvariant.simps[simp del]\n\n lemma new_configured_TopoS_sinvar_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_sinvar (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = (\\G. sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n lemma new_configured_TopoS_offending_flows_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_offending_flows (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = \n (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n\ntext{* We now collect all the core properties of a security invariant, but without the @{typ \"'a\"} @{typ \"'b\"} \n types, so it is instantiated with a concrete configuration.*}\nlocale configured_SecurityInvariant =\n fixes m :: \"('v::vertex) SecurityInvariant_configured\"\n assumes\n --\"As in SecurityInvariant definition\"\n valid_c_offending_flows:\n \"c_offending_flows m G = {F. F \\ (edges G) \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\ (e1, e2) \\ F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\"\n and\n --\"A empty network can have no security violations\"\n defined_offending:\n \"\\ wf_graph \\ nodes = N, edges = {} \\ \\ \\ c_sinvar m \\ nodes = N, edges = {}\\\"\n and\n --\"prohibiting more does not decrease security\"\n mono_sinvar:\n \"\\ wf_graph \\ nodes = N, edges = E \\; E' \\ E; c_sinvar m \\ nodes = N, edges = E \\ \\ \\ \n c_sinvar m \\ nodes = N, edges = E' \\\"\n begin\n (*compatibility with other definitions*)\n lemma sinvar_monoI: \n \"SecurityInvariant_withOffendingFlows.sinvar_mono (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact mono_sinvar)\n\n text{* if the network where nobody communicates with anyone fulfilles its security requirement,\n the offending flows are always defined. *}\n lemma defined_offending': \n \"\\ wf_graph G; \\ c_sinvar m G \\ \\ c_offending_flows m G \\ {}\"\n proof -\n assume a1: \"wf_graph G\"\n and a2: \"\\ c_sinvar m G\"\n have subst_set_offending_flows: \n \"\\nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n by(simp add: valid_c_offending_flows fun_eq_iff \n SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n\n from a1 have wfG_empty: \"wf_graph \\nodes = nodes G, edges = {}\\\" by(simp add:wf_graph_def)\n\n from a1 have \"\\nP. \\ c_sinvar m G \\ SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP \\ {}\"\n apply(frule_tac finite_distinct_list[OF wf_graph.finiteE])\n apply(erule_tac exE)\n apply(rename_tac list_edges)\n apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_monoI])\n by(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def delete_edges_simp2 defined_offending[OF wfG_empty])\n \n thus ?thesis by(simp add: a2 subst_set_offending_flows)\n qed\n\n (* The offending flows definitions are equal, compatibility *)\n lemma subst_offending_flows: \"\\ nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n apply (unfold SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n by(simp add: valid_c_offending_flows)\n\n text{* all the @{term SecurityInvariant_preliminaries} stuff must hold, for an arbitrary @{term nP} *}\n lemma SecurityInvariant_preliminariesD:\n \"SecurityInvariant_preliminaries (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n proof(unfold_locales, goal_cases)\n case 1 thus ?case using defined_offending' by(simp add: subst_offending_flows)\n next case 2 thus ?case by(fact mono_sinvar)\n next case 3 thus ?case by(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_monoI])\n qed\n\n lemma negative_mono:\n \"\\ N E' E. wf_graph \\ nodes = N, edges = E \\ \\ \n E' \\ E \\ \\ c_sinvar m \\ nodes = N, edges = E' \\ \\ \\ c_sinvar m \\ nodes = N, edges = E \\\"\n by(blast dest: mono_sinvar)\n\n \n subsection{*Reusing Lemmata*}\n lemmas mono_extend_set_offending_flows =\n SecurityInvariant_preliminaries.mono_extend_set_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm mono_extend_set_offending_flows [no_vars]}*}\n\n lemmas offending_flows_union_mono =\n SecurityInvariant_preliminaries.offending_flows_union_mono[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm offending_flows_union_mono [no_vars]}*}\n\n lemmas sinvar_valid_remove_flattened_offending_flows =\n SecurityInvariant_preliminaries.sinvar_valid_remove_flattened_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm sinvar_valid_remove_flattened_offending_flows [no_vars]}*}\n\n lemmas sinvar_valid_remove_SOME_offending_flows =\n SecurityInvariant_preliminaries.sinvar_valid_remove_SOME_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm sinvar_valid_remove_SOME_offending_flows [no_vars]}*}\n\n\n lemmas sinvar_valid_remove_minimalize_offending_overapprox =\n SecurityInvariant_preliminaries.sinvar_valid_remove_minimalize_offending_overapprox[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm sinvar_valid_remove_minimalize_offending_overapprox [no_vars]}*}\n \n\n lemmas empty_offending_contra =\n SecurityInvariant_withOffendingFlows.empty_offending_contra[where sinvar=\"(\\G nP. c_sinvar m G)\", simplified subst_offending_flows]\n text{*@{thm empty_offending_contra [no_vars]}*}\n\n lemmas Un_set_offending_flows_bound_minus_subseteq = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm Un_set_offending_flows_bound_minus_subseteq [no_vars]}*}\n\n lemmas Un_set_offending_flows_bound_minus_subseteq' = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq'[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm Un_set_offending_flows_bound_minus_subseteq' [no_vars]}*}\nend\n\nthm configured_SecurityInvariant_def\ntext{*@{thm configured_SecurityInvariant_def [no_vars]}*}\n\nthm configured_SecurityInvariant.mono_sinvar\ntext{*@{thm configured_SecurityInvariant.mono_sinvar [no_vars]}*}\n\n\n\ntext{* \n Naming convention:\n m :: network security requirement\n M :: network security requirement list\n*}\n\n text{* The function @{term new_configured_SecurityInvariant} takes some tuple and if it returns a result,\n the locale assumptions are automatically fulfilled. *}\n theorem new_configured_SecurityInvariant_sound: \n \"\\ new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m \\ \\\n configured_SecurityInvariant m\"\n proof -\n assume a: \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m\"\n hence NetModel: \"SecurityInvariant sinvar defbot receiver_violation\"\n by(simp add: new_configured_SecurityInvariant.simps split: if_split_asm)\n hence NetModel_p: \"SecurityInvariant_preliminaries sinvar\" by(simp add: SecurityInvariant_def)\n\n from a have c_eval: \"c_sinvar m = (\\G. sinvar G nP)\"\n and c_offending: \"c_offending_flows m = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n and \"c_isIFS m = receiver_violation\"\n by(auto simp add: new_configured_SecurityInvariant.simps NetModel split: if_split_asm)\n\n have monoI: \"SecurityInvariant_withOffendingFlows.sinvar_mono sinvar\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n from SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows[OF monoI, symmetric]\n SecurityInvariant_preliminaries.defined_offending[OF NetModel_p]\n have eval_empty_graph: \"\\ N nP. wf_graph \\nodes = N, edges = {}\\ \\ sinvar \\nodes = N, edges = {}\\ nP\"\n by fastforce\n\n show ?thesis\n apply(unfold_locales)\n apply(simp add: c_eval c_offending SecurityInvariant_withOffendingFlows.set_offending_flows_def SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply(simp add: c_eval eval_empty_graph)\n apply(simp add: c_eval,drule(3) SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n done\n qed\n\ntext{* All security invariants are valid according to the definition *}\ndefinition valid_reqs :: \"('v::vertex) SecurityInvariant_configured list \\ bool\" where\n \"valid_reqs M \\ \\ m \\ set M. configured_SecurityInvariant m\"\n\n subsection {*Algorithms*}\n text{*A (generic) security invariant corresponds to a type of security requirements (type: @{typ \"'v graph \\ ('v \\ 'a) \\ bool\"}).\n A configured security invariant is a security requirement in a scenario specific setting (type: @{typ \"'v graph \\ bool\"}).\n I.e., it is a security requirement as listed in the requirements document.\n All security requirements are fulfilled for a fixed policy @{term G} if all security requirements are fulfilled for @{term G}. *}\n\n\n text{*Get all possible offending flows from all security requirements *}\n definition get_offending_flows :: \"'v SecurityInvariant_configured list \\ 'v graph \\ (('v \\ 'v) set set)\" where\n \"get_offending_flows M G = (\\m\\set M. c_offending_flows m G)\" \n\n (*Note: only checks sinvar, not eval!! No 'a 'b type variables here*)\n definition all_security_requirements_fulfilled :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"all_security_requirements_fulfilled M G \\ \\m \\ set M. (c_sinvar m) G\"\n \n text{* Generate a valid topology from the security requirements *}\n (*constant G, remove after algorithm*)\n fun generate_valid_topology :: \"'v SecurityInvariant_configured list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology [] G = G\" |\n \"generate_valid_topology (m#Ms) G = delete_edges (generate_valid_topology Ms G) (\\ (c_offending_flows m G))\"\n\n -- \"return all Access Control Strategy models from a list of models\"\n definition get_ACS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_ACS M \\ [m \\ M. \\ c_isIFS m]\"\n -- \"return all Information Flows Strategy models from a list of models\"\n definition get_IFS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_IFS M \\ [m \\ M. c_isIFS m]\"\n lemma get_ACS_union_get_IFS: \"set (get_ACS M) \\ set (get_IFS M) = set M\"\n by(auto simp add: get_ACS_def get_IFS_def)\n \n\n subsection{*Lemmata*}\n lemma valid_reqs1: \"valid_reqs (m # M) \\ configured_SecurityInvariant m\"\n by(simp add: valid_reqs_def)\n lemma valid_reqs2: \"valid_reqs (m # M) \\ valid_reqs M\"\n by(simp add: valid_reqs_def)\n lemma get_offending_flows_alt1: \"get_offending_flows M G = \\ {c_offending_flows m G | m. m \\ set M}\"\n apply(simp add: get_offending_flows_def)\n by fastforce\n lemma get_offending_flows_un: \"\\ get_offending_flows M G = (\\m\\set M. \\c_offending_flows m G)\"\n apply(simp add: get_offending_flows_def)\n by blast\n \n \n lemma all_security_requirements_fulfilled_mono:\n \"\\ valid_reqs M; E' \\ E; wf_graph \\ nodes = V, edges = E \\ \\ \\ \n all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ \\\n all_security_requirements_fulfilled M \\ nodes = V, edges = E' \\\"\n apply(induction M arbitrary: E' E)\n apply(simp_all add: all_security_requirements_fulfilled_def)\n apply(rename_tac m M E' E)\n apply(rule conjI)\n apply(erule(2) configured_SecurityInvariant.mono_sinvar[OF valid_reqs1])\n apply(simp_all)\n apply(drule valid_reqs2)\n apply blast\n done\n\n subsection{* generate valid topology *}\n (*\n lemma generate_valid_topology_def_delete_multiple: \n \"generate_valid_topology M G = delete_edges (generate_valid_topology M G) (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges (generate_valid_topology M G) - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n by blast\n qed*)\n lemma generate_valid_topology_nodes:\n \"nodes (generate_valid_topology M G) = (nodes G)\"\n apply(induction M arbitrary: G)\n by(simp_all add: graph_ops)\n\n lemma generate_valid_topology_def_alt:\n \"generate_valid_topology M G = delete_edges G (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges G - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n apply(rule)\n apply(simp add: generate_valid_topology_nodes)\n by blast\n qed\n \n lemma wf_graph_generate_valid_topology: \"wf_graph G \\ wf_graph (generate_valid_topology M G)\"\n proof(induction M arbitrary: G)\n qed(simp_all)\n \n lemma generate_valid_topology_mono_models:\n \"edges (generate_valid_topology (m#M) \\ nodes = V, edges = E \\) \\ edges (generate_valid_topology M \\ nodes = V, edges = E \\)\"\n proof(induction M arbitrary: E m)\n case Nil thus ?case by(simp add: delete_edges_simp2) fastforce\n case Cons thus ?case by(simp add: delete_edges_simp2) blast\n qed\n \n lemma generate_valid_topology_subseteq_edges:\n \"edges (generate_valid_topology M G) \\ (edges G)\"\n proof(induction M arbitrary: G)\n case Cons thus ?case by (simp add: delete_edges_simp2) blast\n qed(simp)\n\n text{* @{term generate_valid_topology} generates a valid topology (Policy)! *}\n theorem generate_valid_topology_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\ \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\"\n proof(induction M arbitrary: V E)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n\n from Cons(3) have valid_rmUnOff: \"wf_graph \\nodes = V, edges = E - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\"\n by(simp add: wf_graph_remove_edges)\n \n from configured_SecurityInvariant.sinvar_valid_remove_flattened_offending_flows[OF validReq Cons(3)]\n have valid_eval_rmUnOff: \"c_sinvar m \\nodes = V, edges = E - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n \n from generate_valid_topology_subseteq_edges have edges_gentopo_subseteq: \n \"(edges (generate_valid_topology M \\nodes = V, edges = E\\)) - (\\c_offending_flows m \\nodes = V, edges = E\\)\n \\\n E - (\\c_offending_flows m \\nodes = V, edges = E\\)\" by fastforce\n \n from configured_SecurityInvariant.mono_sinvar[OF validReq valid_rmUnOff edges_gentopo_subseteq valid_eval_rmUnOff]\n have \"c_sinvar m \\nodes = V, edges = (edges (generate_valid_topology M \\nodes = V, edges = E\\)) - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n from this have goal1: \n \"c_sinvar m (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\))\"\n by(simp add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF `valid_reqs M` Cons(3)] have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\" .\n\n have generate_valid_topology_EX_graph_record:\n \"\\ hypE. (generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\ \"\n apply(induction M arbitrary: V E)\n by(simp_all add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from generate_valid_topology_EX_graph_record obtain E_IH where E_IH_prop:\n \"(generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by metis\n \n -- \"@{thm IH[simplified E_IH_prop]}\"\n -- \"@{thm all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH IH[simplified E_IH_prop]]}\"\n \n from all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH IH[simplified E_IH_prop]] have mono_rule:\n \"\\ E'. E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" .\n \n have \"all_security_requirements_fulfilled M \n (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\))\"\n apply(subst E_IH_prop)\n apply(simp add: delete_edges_simp2)\n apply(rule mono_rule)\n by fast\n \n from this have goal2:\n \"(\\ma\\set M.\n c_sinvar ma (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\)))\"\n by(simp add: all_security_requirements_fulfilled_def)\n \n from goal1 goal2 \n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \\nodes = V, edges = E\\)\" \n by (simp add: all_security_requirements_fulfilled_def)\n qed\n\n\n lemma generate_valid_topology_as_set: \n \"generate_valid_topology M G = delete_edges G (\\m \\ set M. (\\ (c_offending_flows m G)))\"\n apply(induction M arbitrary: G)\n apply(simp_all add: delete_edges_simp2 generate_valid_topology_nodes) by fastforce\n\n lemma c_offending_flows_subseteq_edges: \"configured_SecurityInvariant m \\ \\c_offending_flows m G \\ edges G\"\n apply(clarify)\n apply(simp only: configured_SecurityInvariant.valid_c_offending_flows)\n apply(thin_tac \"configured_SecurityInvariant x\" for x)\n by auto\n\n\n text{*Does it also generate a maximum topology? It does, if the security invariants are in ENF-form. That means, if \n all security invariants can be expressed as a predicate over the edges, \n @{term \"\\P. \\G. c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1,v2))\"}*}\n definition max_topo :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"max_topo M G \\ all_security_requirements_fulfilled M G \\ (\n \\ (v1, v2) \\ (nodes G \\ nodes G) - (edges G). \\ all_security_requirements_fulfilled M (add_edge v1 v2 G))\"\n\n lemma unique_offending_obtain: \n assumes m: \"configured_SecurityInvariant m\" and unique: \"c_offending_flows m G = {F}\"\n obtains P where \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" and \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\" and \n \"(\\(v1,v2) \\ edges G - F. P (v1, v2))\"\n proof -\n assume EX: \"(\\P. F = {(v1, v2). (v1, v2) \\ edges G \\ \\ P (v1, v2)} \\ c_sinvar m G = (\\(v1, v2)\\edges G. P (v1, v2)) \\ \\(v1, v2)\\edges G - F. P (v1, v2) \\ thesis)\"\n\n from unique c_offending_flows_subseteq_edges[OF m] have \"F \\ edges G\" by force\n from this obtain P where \"F = {e \\ edges G. \\ P e}\" by (metis double_diff set_diff_eq subset_refl)\n hence 1: \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" by auto\n\n from configured_SecurityInvariant.valid_c_offending_flows[OF m] have \"c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\" .\n\n from this unique have \"\\ c_sinvar m G\" and 2: \"c_sinvar m (delete_edges G F)\" and \n 3: \"(\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))\" by auto\n\n from this `F = {e \\ edges G. \\ P e}` have x3: \"\\ e \\ edges G - F. P e\" by (metis (lifting) mem_Collect_eq set_diff_eq)\n hence 4: \"\\(v1,v2) \\ edges G - F. P (v1, v2)\" by blast\n\n have \"F \\ {}\" by (metis assms(1) assms(2) configured_SecurityInvariant.empty_offending_contra insertCI)\n from this `F = {e \\ edges G. \\ P e}` `\\ c_sinvar m G` have 5: \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\"\n apply(simp add: graph_ops)\n by(blast)\n\n from EX[of P] unique 1 x3 5 show ?thesis by fast\n qed\n\n lemma enf_offending_flows:\n assumes vm: \"configured_SecurityInvariant m\" and enf: \"\\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n shows \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n proof -\n { fix G\n from vm configured_SecurityInvariant.valid_c_offending_flows have offending_formaldef:\n \"c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\\n (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\" by auto\n have \"c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n proof(cases \"c_sinvar m G\")\n case True thus ?thesis --{*@{term \"{}\"}*}\n by(simp add: offending_formaldef)\n next\n case False thus ?thesis by(auto simp add: offending_formaldef graph_ops enf)\n qed\n } thus ?thesis by simp\n qed\n \n \nlemma enf_not_fulfilled_if_in_offending:\n assumes validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n shows \"\\x \\ (\\m\\set M. \\c_offending_flows m (fully_connected G)).\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = insert x E\\\"\n unfolding all_security_requirements_fulfilled_def\n proof(simp, clarify, rename_tac m F a b)\n let ?G=\"(fully_connected G)\"\n fix m F v1 v2\n assume \"m \\ set M\" and \"F \\ c_offending_flows m ?G\" and \"(v1, v2) \\ F\"\n \n from validRs have valid_mD:\"\\m. m \\ set M \\ configured_SecurityInvariant m \" \n by(simp add: valid_reqs_def)\n \n from `m \\ set M` valid_mD have \"configured_SecurityInvariant m\" by simp\n\n from enf `m \\ set M` obtain P where enf_m: \"\\G. c_sinvar m G = (\\e\\edges G. P e)\" by blast\n \n from `(v1, v2) \\ F` have \"F \\ {}\" by auto\n\n from enf_offending_flows[OF `configured_SecurityInvariant m` `\\G. c_sinvar m G = (\\e\\edges G. P e)`] have\n offending: \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\" by simp\n from `F \\ c_offending_flows m ?G` `F \\ {}` have \"F = {e \\ edges ?G. \\ P e}\"\n by(simp split: if_split_asm add: offending)\n from this `(v1, v2) \\ F` have \"\\ P (v1, v2)\" by simp\n\n from this enf_m have \"\\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" by(simp)\n thus \"\\m\\set M. \\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" using `m \\ set M`\n apply(rule_tac x=\"m\" in bexI)\n by simp_all\nqed\n \n\n theorem generate_valid_topology_max_topo: \"\\ valid_reqs M; wf_graph G;\n \\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\\ \\ \n max_topo M (generate_valid_topology M (fully_connected G))\"\n proof -\n let ?G=\"(fully_connected G)\"\n assume validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n\n obtain V E where VE_prop: \"\\ nodes = V, edges = E \\ = generate_valid_topology M ?G\" by (metis graph.cases)\n hence VE_prop_asset:\n \"\\ nodes = V, edges = E \\ = \\ nodes = V, edges = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\\\"\n by(simp add: fully_connected_def generate_valid_topology_as_set delete_edges_simp2)\n\n from VE_prop_asset have E_prop: \"E = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\" by fast\n from VE_prop have V_prop: \"nodes G = V\"\n by (simp add: fully_connected_def delete_edges_simp2 generate_valid_topology_def_alt)\n from VE_prop have V_full_prop: \"nodes (generate_valid_topology M ?G) = V\" by (metis graph.select_convs(1))\n from VE_prop have E_full_prop: \"edges (generate_valid_topology M ?G) = E\" by (metis graph.select_convs(2))\n\n from VE_prop wf_graph_generate_valid_topology[OF fully_connected_wf[OF wfG]]\n have wfG_VE: \"wf_graph \\ nodes = V, edges = E \\\" by force\n\n from generate_valid_topology_sound[OF validRs wfG_VE] fully_connected_wf[OF wfG] have VE_all_valid: \n \"all_security_requirements_fulfilled M \\ nodes = V, edges = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\\\"\n by (metis VE_prop VE_prop_asset fully_connected_def generate_valid_topology_sound validRs)\n hence goal1: \"all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))\" by (metis VE_prop VE_prop_asset)\n\n from validRs have valid_mD:\"\\m. m \\ set M \\ configured_SecurityInvariant m \" \n by(simp add: valid_reqs_def)\n\n from c_offending_flows_subseteq_edges[where G=\"?G\"] validRs have hlp1: \"(\\m\\set M. \\c_offending_flows m ?G) \\ V \\ V\"\n apply(simp add: fully_connected_def V_prop)\n using valid_reqs_def by blast\n have \"\\A B. A - (A - B) = B \\ A\" by fast \n from E_prop hlp1 have \"V \\ V - E = (\\m\\set M. \\c_offending_flows m ?G)\" by force\n\n\n from enf_not_fulfilled_if_in_offending[OF validRs wfG enf]\n have \"\\(v1, v2) \\ (\\m\\set M. \\c_offending_flows m ?G).\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\" by simp\n \n from this `V \\ V - E = (\\m\\set M. \\c_offending_flows m ?G)` have \"\\(v1, v2) \\ V \\ V - E.\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\" by simp\n hence goal2: \"(\\(v1, v2)\\nodes (generate_valid_topology M ?G) \\ nodes (generate_valid_topology M ?G) -\n edges (generate_valid_topology M ?G).\n \\ all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M ?G)))\"\n proof(unfold V_full_prop E_full_prop graph_ops)\n assume a: \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V, edges = E \\ {(v1, v2)}\\\"\n have \"\\(v1, v2)\\V \\ V - E. V \\ {v1, v2} = V\" by blast\n hence \"\\(v1, v2)\\V \\ V - E. \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\ = \\nodes = V, edges = E \\ {(v1, v2)}\\\" by blast\n from this a show \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\\"\n --\"TODO: this should be trivial ...\"\n apply(simp)\n apply(rule ballI)\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply(simp; fail)\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply(simp; fail)\n apply(clarify)\n by presburger\n qed\n \n from goal1 goal2 show ?thesis\n unfolding max_topo_def by presburger\n qed\n\n lemma enf_all_valid_policy_subset_of_max:\n assumes validRs: \"valid_reqs M\"\n and wfG: \"wf_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n and nodesG': \"nodes G = nodes G'\"\n shows \"\\ wf_graph G';\n all_security_requirements_fulfilled M G'\\ \\ \n edges G' \\ edges (generate_valid_topology M (fully_connected G))\"\n using nodesG' apply(cases \"generate_valid_topology M (fully_connected G)\", rename_tac V E, simp)\n apply(cases \"G'\", rename_tac V' E', simp)\n apply(subgoal_tac \"nodes G = V\")\n prefer 2\n apply (metis fully_connected_def generate_valid_topology_nodes graph.select_convs(1))\n apply(simp)\n proof(rule ccontr)\n fix V E V' E'\n assume a5: \"all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" and\n a6: \"generate_valid_topology M (fully_connected G) = \\nodes = V, edges = E\\\" and\n a10: \"wf_graph \\nodes = V, edges = E'\\\" and\n contr: \"\\ E' \\ E\"\n \n from wfG a6 have \"wf_graph \\nodes = V, edges = E\\\"\n by (metis fully_connected_wf wf_graph_generate_valid_topology)\n with a10 have EE'subsets: \"fst ` E \\ V \\ snd ` E \\ V \\ fst ` E' \\ V \\ snd ` E' \\ V\"\n by(simp add: wf_graph_def)\n hence EE'subsets': \"E \\ V \\ V \\ E' \\ V \\ V\" by auto\n \n from generate_valid_topology_max_topo[OF validRs wfG enf]\n have m1: \"all_security_requirements_fulfilled M \\nodes = V, edges = E\\\" and\n m2: \"(\\x\\V \\ V - E. case x of (v1, v2) \\ \\ all_security_requirements_fulfilled M (add_edge v1 v2 \\nodes = V, edges = E\\))\"\n by(simp add: max_topo_def a6)+\n \n from m2 have m2': \"\\x\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x E\\\"\n apply(simp add: add_edge_def)\n apply(rule ballI, rename_tac x)\n apply(erule_tac x=x in ballE, simp_all)\n apply(case_tac x, simp)\n by (simp add: insert_absorb)\n \n show False\n proof(cases \"V = {}\")\n case True\n with EE'subsets a10 have \"E = {}\" and \"E' = {}\"\n by(simp add: wf_graph_def)+\n with True contr show ?thesis by simp\n next\n case False\n with EE'subsets' contr obtain x where x: \"x \\ E' \\ x \\ E \\ x \\ V \\ V\"\n by blast\n from m2' x have \"\\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x E\\\"\n by (simp)\n \n from a6 x have x_offedning: \"x \\ (\\m\\set M. \\c_offending_flows m (fully_connected G))\"\n apply(simp add: generate_valid_topology_as_set delete_edges_simp2 fully_connected_def)\n by blast\n \n from enf_not_fulfilled_if_in_offending[OF validRs wfG enf] x_offedning have\n 1: \"\\ all_security_requirements_fulfilled M \\nodes = V, edges = insert x myE\\\" for myE by blast\n \n from x have insertxE': \"insert x E' = E'\" by blast\n with a5 have\n \"all_security_requirements_fulfilled M \\nodes = V, edges = insert x E'\\\" by simp\n with insertxE' all_security_requirements_fulfilled_mono[OF validRs _ a10 a5] have \n 2: \"all_security_requirements_fulfilled M \\nodes = V, edges = insert x {}\\\" by blast\n from 1 2 show ?thesis by blast\n qed\n qed\n \n\n\n subsection{* More Lemmata *}\n lemma (in configured_SecurityInvariant) c_sinvar_valid_imp_no_offending_flows: \n \"c_sinvar m G \\ c_offending_flows m G = {}\"\n by(simp add: valid_c_offending_flows)\n\n lemma all_security_requirements_fulfilled_imp_no_offending_flows:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ (\\m\\set M. \\c_offending_flows m G) = {}\"\n proof(induction M)\n case Cons thus ?case\n unfolding all_security_requirements_fulfilled_def\n apply(simp)\n by(blast dest: valid_reqs2 valid_reqs1 configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows)\n qed(simp)\n\n corollary all_security_requirements_fulfilled_imp_get_offending_empty:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ get_offending_flows M G = {}\"\n apply(frule(1) all_security_requirements_fulfilled_imp_no_offending_flows)\n apply(simp add: get_offending_flows_def)\n apply(thin_tac \"all_security_requirements_fulfilled M G\")\n apply(simp add: valid_reqs_def)\n apply(clarify)\n using configured_SecurityInvariant.empty_offending_contra by fastforce\n \n corollary generate_valid_topology_does_nothing_if_valid:\n \"\\ valid_reqs M; all_security_requirements_fulfilled M G\\ \\ \n generate_valid_topology M G = G\"\n by(simp add: generate_valid_topology_as_set graph_ops all_security_requirements_fulfilled_imp_no_offending_flows)\n\n\n lemma mono_extend_get_offending_flows: \"\\ valid_reqs M;\n wf_graph \\nodes = V, edges = E\\;\n E' \\ E;\n F' \\ get_offending_flows M \\nodes = V, edges = E'\\ \\ \\\n \\F\\get_offending_flows M \\nodes = V, edges = E\\. F' \\ F\"\n proof(induction M)\n case Nil thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons.prems have \"configured_SecurityInvariant m\"\n and \"valid_reqs M\" using valid_reqs2 valid_reqs1 by blast+\n from Cons.prems(4) have\n \"F' \\ c_offending_flows m \\nodes = V, edges = E'\\ \\\n (F' \\ get_offending_flows M \\nodes = V, edges = E'\\)\"\n by(simp add: get_offending_flows_def)\n from this show ?case\n proof(elim disjE, goal_cases)\n case 1\n with `configured_SecurityInvariant m` Cons.prems(2,3,4) obtain F where\n \"F\\c_offending_flows m \\nodes = V, edges = E\\\" and \"F' \\ F\"\n by(blast dest: configured_SecurityInvariant.mono_extend_set_offending_flows)\n hence \"F\\get_offending_flows (m # M) \\nodes = V, edges = E\\\"\n by (simp add: get_offending_flows_def)\n with `F' \\ F` show ?case by blast\n next\n case 2 with Cons `valid_reqs M` show ?case by(simp add: get_offending_flows_def) blast\n qed\n qed\n\n lemma get_offending_flows_subseteq_edges: \"valid_reqs M \\ F \\ get_offending_flows M \\nodes = V, edges = E\\ \\ F \\ E\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(simp add: configured_SecurityInvariant.valid_c_offending_flows)\n by blast\n\n thm configured_SecurityInvariant.offending_flows_union_mono\n lemma get_offending_flows_union_mono: \"\\valid_reqs M; \n wf_graph \\nodes = V, edges = E\\; E' \\ E \\ \\\n \\get_offending_flows M \\nodes = V, edges = E'\\ \\ \\get_offending_flows M \\nodes = V, edges = E\\\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(drule(2) configured_SecurityInvariant.offending_flows_union_mono)\n apply(simp add: get_offending_flows_def)\n by auto\n\n thm configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'\n lemma Un_set_offending_flows_bound_minus_subseteq':\"\\valid_reqs M; \n wf_graph \\nodes = V, edges = E\\; E' \\ E;\n \\get_offending_flows M \\nodes = V, edges = E\\ \\ X \\ \\ \\get_offending_flows M \\nodes = V, edges = E - E'\\ \\ X - E'\"\n proof(induction M)\n case Nil thus ?case by (simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons.prems(1) valid_reqs2 have \"valid_reqs M\" by force\n from Cons.prems(1) valid_reqs1 have \"configured_SecurityInvariant m\" by force\n from Cons.prems(4) have \"\\get_offending_flows M \\nodes = V, edges = E\\ \\ X\" by(simp add: get_offending_flows_def)\n from Cons.IH[OF `valid_reqs M` Cons.prems(2) Cons.prems(3) `\\get_offending_flows M \\nodes = V, edges = E\\ \\ X`] have IH: \"\\get_offending_flows M \\nodes = V, edges = E - E'\\ \\ X - E'\" .\n from Cons.prems(4) have \"\\c_offending_flows m \\nodes = V, edges = E\\ \\ X\" by(simp add: get_offending_flows_def)\n from configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'[OF `configured_SecurityInvariant m` Cons.prems(2) `\\c_offending_flows m \\nodes = V, edges = E\\ \\ X`] have \"\\c_offending_flows m \\nodes = V, edges = E - E'\\ \\ X - E'\" .\n from this IH show ?case by(simp add: get_offending_flows_def)\n qed\n\n \n\n\n (*ENF has uniquely defined offending flows*)\n lemma ENF_uniquely_defined_offedning: \"valid_reqs M \\ wf_graph G \\ \n \\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e) \\ \n \\m \\ set M. \\G. \\ c_sinvar m G \\ (\\OFF. c_offending_flows m G = {OFF})\"\n apply -\n apply(induction M)\n apply(simp; fail)\n apply(rename_tac m M)\n apply(frule valid_reqs1)\n apply(drule valid_reqs2)\n apply(simp)\n apply(elim conjE)\n apply(erule_tac x=m in ballE)\n apply(simp_all; fail)\n apply(erule exE, rename_tac P)\n apply(drule_tac P=P in enf_offending_flows)\n apply(simp; fail)\n apply(simp; fail)\n done\n\n lemma assumes \"configured_SecurityInvariant m\"\n and \"\\G. \\ c_sinvar m G \\ (\\OFF. c_offending_flows m G = {OFF})\"\n shows \"\\OFF_P. \\G. c_offending_flows m G = (if c_sinvar m G then {} else {OFF_P G})\"\n proof -\n from assms have \"\\OFF_P. \n c_offending_flows m G = (if c_sinvar m G then {} else {OFF_P G})\" for G\n apply(erule_tac x=G in allE)\n apply(cases \"c_sinvar m G\")\n apply(drule configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows, simp)\n apply(simp; fail)\n apply(simp)\n by meson\n with assms show ?thesis by metis\n qed\n (*TODO: generate_valid_topology_max_topo for sinvars with unique offending flows in general*)\n\n\n\n text{*Hilber's eps operator example*}\n lemma \"(SOME x. x : {1::nat, 2, 3}) = x \\ x = 1 \\ x = 2 \\ x = 3\"\n proof -\n have \"(SOME x. x \\ {1::nat, 2, 3}) \\ {1::nat, 2, 3}\" unfolding some_in_eq by simp\n thus \"(SOME x. x : {1::nat, 2, 3}) = x \\ x = 1 \\ x = 2 \\ x = 3\" by fast\n qed\n\n (*TODO: remove the offending flows from the graph for each iteration. requires proof arbitrary: G\n allows to put expensive invariants at back of list and hope that sinvar is true until the are evaluated*)\n text{*Only removing one offending flow should be enough*}\n fun generate_valid_topology_SOME :: \"'v SecurityInvariant_configured list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology_SOME [] G = G\" |\n \"generate_valid_topology_SOME (m#Ms) G = (if c_sinvar m G\n then generate_valid_topology_SOME Ms G\n else delete_edges (generate_valid_topology_SOME Ms G) (SOME F. F \\ c_offending_flows m G)\n )\"\n\n lemma generate_valid_topology_SOME_nodes: \"nodes (generate_valid_topology_SOME M \\nodes = V, edges = E\\) = V\"\n proof(induction M)\n qed(simp_all add: delete_edges_simp2)\n\n theorem generate_valid_topology_SOME_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\ \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"\n proof(induction M)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n \n from configured_SecurityInvariant.sinvar_valid_remove_SOME_offending_flows[OF validReq] have\n \"c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\\n c_sinvar m \\nodes = V, edges = E - (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\)\\\" .\n\n have generate_valid_topology_SOME_edges: \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) \\ E\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(auto simp add: delete_edges_simp2)\n\n from configured_SecurityInvariant.mono_sinvar[OF validReq Cons.prems(2),\n of \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"]\n generate_valid_topology_SOME_edges\n have \"c_sinvar m \\nodes = V, edges = E\\ \\\n c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\\\"\n by simp\n moreover from configured_SecurityInvariant.defined_offending'[OF validReq Cons.prems(2)] have not_sinvar_off:\n \"\\ c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ \\ {}\" by blast\n ultimately have goal_sinvar_m:\n \"c_offending_flows m \\nodes = V, edges = E\\ = {} \\ \n c_sinvar m (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\"\n using generate_valid_topology_SOME_nodes \n by (metis graph.select_convs(1) graph.select_convs(2) graph_eq_intro)\n\n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF `valid_reqs M` Cons(3)] have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\" .\n\n have goal_rm_SOME_m: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\\n c_sinvar m (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\n (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n proof - (*sledgehammered*)\n assume a1: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n have f2: \"(\\r ra p. \\ r \\ ra \\ (p::'a \\ 'a) \\ r \\ p \\ ra) = (\\r ra p. \\ r \\ ra \\ (p::'a \\ 'a) \\ r \\ p \\ ra)\"\n by meson\n have f3: \"wf_graph \\nodes = V, edges = E - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\\\"\n by (simp add: Cons.prems(2) wf_graph_remove_edges)\n have \"edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\) \\ E - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\"\n using f2 generate_valid_topology_SOME_edges[of M V E] by blast\n then have \"c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) - (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\)\\\"\n using f3 a1 \\c_offending_flows m \\nodes = V, edges = E\\ \\ {} \\ c_sinvar m \\nodes = V, edges = E - (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\)\\\\ configured_SecurityInvariant.negative_mono validReq by blast\n then show \"c_sinvar m (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\) (SOME r. r \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n by (simp add: generate_valid_topology_SOME_nodes graph_ops(5))\n qed\n\n have wf_graph_generate_valid_topology_SOME: \"wf_graph G \\ wf_graph (generate_valid_topology_SOME M G)\"\n for G (*TODO: tune*)\n apply(cases G)\n apply(simp add: wf_graph_def generate_valid_topology_SOME_nodes)\n using generate_valid_topology_SOME_edges by (meson dual_order.trans image_mono rev_finite_subset) \n\n { assume notempty: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n hence \"\\ hypE. (generate_valid_topology_SOME M \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\\"\n proof(induction M arbitrary: V E)\n qed(simp_all add: delete_edges_simp2 generate_valid_topology_SOME_nodes)\n from this obtain E_IH where E_IH_prop:\n \"(generate_valid_topology_SOME M \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology_SOME[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by simp\n \n from all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH ] IH E_IH_prop\n have mono_rule: \"E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" for E' by simp\n \n have \"all_security_requirements_fulfilled M\n (delete_edges (generate_valid_topology_SOME M \\nodes = V, edges = E\\)\n (SOME F. F \\ c_offending_flows m \\nodes = V, edges = E\\))\"\n unfolding E_IH_prop by(auto simp add: delete_edges_simp2 intro:mono_rule)\n } note goal_fulfilled_M=this\n\n have no_offending: \"c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ = {}\"\n by (simp add: configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows validReq)\n\n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology_SOME (m # M) \\nodes = V, edges = E\\)\"\n apply(simp add: all_security_requirements_fulfilled_def)\n apply(intro conjI impI)\n subgoal using goal_sinvar_m no_offending by blast\n subgoal using IH by(simp add: all_security_requirements_fulfilled_def; fail)\n subgoal using goal_rm_SOME_m not_sinvar_off by blast \n subgoal using goal_fulfilled_M not_sinvar_off by(simp add: all_security_requirements_fulfilled_def)\n done\n qed\n\n \n lemma generate_valid_topology_SOME_def_alt:\n \"generate_valid_topology_SOME M G = delete_edges G (\\m \\ set M. if c_sinvar m G then {} else (SOME F. F \\ c_offending_flows m G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have IH :\"edges (generate_valid_topology_SOME M G) =\n edges G - (\\m\\set M. if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G)\"\n by simp\n hence \"\\ c_sinvar m G \\ \n edges (generate_valid_topology_SOME (m # M) G) =\n (edges G) - (\\m\\set (m#M). if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G)\"\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n by blast\n with Cons.IH show ?case by(simp add: get_offending_flows_def delete_edges_simp2)\n qed\n\n lemma generate_valid_topology_SOME_superset:\n \"\\ valid_reqs M; wf_graph G \\ \\ \n edges (generate_valid_topology M G) \\ edges (generate_valid_topology_SOME M G)\"\n proof -\n have isabelle2016_1_helper:\n \"x \\ (\\m\\set M. if c_sinvar m G then {} else SOME F. F \\ c_offending_flows m G) \\\n (\\m\\set M. \\ c_sinvar m G \\ (c_sinvar m G \\ x \\ (SOME F. F \\ c_offending_flows m G)))\"\n for x by auto\n have 1: \"m\\set M \\ \\ c_sinvar m G \\ (c_sinvar m G \\ x \\ (SOME F. F \\ c_offending_flows m G)) \\\n c_offending_flows m G \\ {} \\\n x \\ \\(\\m\\set M. c_offending_flows m G)\"\n for x m\n apply(simp)\n apply(rule_tac x=m in bexI)\n apply(simp_all)\n using some_in_eq by blast\n \n show \"valid_reqs M \\ wf_graph G \\ ?thesis\"\n unfolding generate_valid_topology_SOME_def_alt generate_valid_topology_def_alt\n apply(rule delete_edges_edges_mono)\n apply(simp add: delete_edges_simp2 get_offending_flows_def)\n apply(rule)\n apply(subst(asm) isabelle2016_1_helper)\n apply(erule bexE, rename_tac m)\n apply(subgoal_tac \"c_offending_flows m G \\ {}\")\n using 1 apply blast\n by (simp add: configured_SecurityInvariant.defined_offending' valid_reqs_def)\n qed\n\n\n\n\n text{*Notation:\n @{const generate_valid_topology_SOME}: non-deterministic choice\n @{text generate_valid_topology_some}: executable which selects always the same\n *}\n fun generate_valid_topology_some :: \"'v SecurityInvariant_configured list \\ ('v\\'v) list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology_some [] _ G = G\" |\n \"generate_valid_topology_some (m#Ms) Es G = (if c_sinvar m G\n then generate_valid_topology_some Ms Es G\n else delete_edges (generate_valid_topology_some Ms Es G) (set (minimalize_offending_overapprox (c_sinvar m) Es [] G))\n )\"\n theorem generate_valid_topology_some_sound:\n \"\\ valid_reqs M; wf_graph \\nodes = V, edges = E\\; set Es = E; distinct Es \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"\n proof(induction M)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n \n from configured_SecurityInvariant.sinvar_valid_remove_minimalize_offending_overapprox[OF\n validReq Cons.prems(2) _ Cons.prems(3) Cons.prems(4)] have rm_off_valid:\n \"\\ c_sinvar m \\nodes = V, edges = E\\\\\n c_sinvar m \\nodes = V, edges = E - (set (minimalize_offending_overapprox (c_sinvar m) Es [] \\nodes = V, edges = E\\))\\\"\n apply(subst(asm) minimalize_offending_overapprox_boundnP[symmetric]) (*TODO: type for nP unspecified!*)\n by blast\n\n have generate_valid_topology_some_nodes: \"nodes (generate_valid_topology_some M Es \\nodes = V, edges = E\\) = V\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(simp_all add: delete_edges_simp2)\n\n\n have generate_valid_topology_some_edges: \"edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\) \\ E\"\n for M::\"'a SecurityInvariant_configured list\" and V E\n proof(induction M)\n qed(auto simp add: delete_edges_simp2)\n \n from configured_SecurityInvariant.mono_sinvar[OF validReq Cons.prems(2),\n of \"edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"]\n generate_valid_topology_some_edges\n have \"c_sinvar m \\nodes = V, edges = E\\ \\\n c_sinvar m \\nodes = V, edges = edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\\\"\n by simp\n moreover from configured_SecurityInvariant.defined_offending'[OF validReq Cons.prems(2)] have not_sinvar_off:\n \"\\ c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ \\ {}\" by blast\n ultimately have goal_sinvar_m:\n \"c_offending_flows m \\nodes = V, edges = E\\ = {} \\ \n c_sinvar m (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\"\n using generate_valid_topology_some_nodes \n by (metis graph.select_convs(1) graph.select_convs(2) graph_eq_intro)\n\n \n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF `valid_reqs M` Cons(3)] Cons.prems have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\" by simp\n\n \n\n\n have wf_graph_generate_valid_topology_some: \"wf_graph G \\ wf_graph (generate_valid_topology_some M Es G)\"\n for G (*TODO: tune*)\n apply(cases G)\n apply(simp add: wf_graph_def generate_valid_topology_some_nodes)\n using generate_valid_topology_some_edges by (meson dual_order.trans image_mono rev_finite_subset) \n\n \n { assume notempty: \"c_offending_flows m \\nodes = V, edges = E\\ \\ {}\"\n hence \"\\ hypE. (generate_valid_topology_some M Es \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\\"\n proof(induction M arbitrary: V E)\n qed(simp_all add: delete_edges_simp2 generate_valid_topology_some_nodes)\n from this obtain E_IH where E_IH_prop:\n \"(generate_valid_topology_some M Es \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from wf_graph_generate_valid_topology_some[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"wf_graph \\nodes = V, edges = E_IH\\\" by simp\n \n from all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH ] IH E_IH_prop\n have mono_rule: \"E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" for E' by simp\n \n have \"all_security_requirements_fulfilled M\n (delete_edges (generate_valid_topology_some M Es \\nodes = V, edges = E\\)\n (set (minimalize_offending_overapprox (c_sinvar m) Es [] \\nodes = V, edges = E\\)))\"\n unfolding E_IH_prop by(auto simp add: delete_edges_simp2 intro:mono_rule)\n } note goal_fulfilled_M=this\n\n have no_offending: \"c_sinvar m \\nodes = V, edges = E\\ \\ c_offending_flows m \\nodes = V, edges = E\\ = {}\"\n by (simp add: configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows validReq)\n\n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology_some (m # M) Es \\nodes = V, edges = E\\)\"\n apply(simp add: all_security_requirements_fulfilled_def)\n apply(intro conjI impI)\n subgoal using goal_sinvar_m no_offending by blast\n subgoal using IH by(simp add: all_security_requirements_fulfilled_def; fail)\n subgoal using rm_off_valid by (metis (no_types, lifting) Cons.prems(2) Diff_mono \n configured_SecurityInvariant.mono_sinvar delete_edges_simp2 generate_valid_topology_some_edges\n generate_valid_topology_some_nodes order_refl validReq wf_graph_remove_edges) (*TODO!*)\n subgoal using goal_fulfilled_M not_sinvar_off by(simp add: all_security_requirements_fulfilled_def)\n done\n qed\n\n\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/TopoS_Composition_Theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.26430334136690964}} {"text": "section {*I\\_epda\\_S\\_HS*}\ntheory\n I_epda_S_HS\n\nimports\n I_epda_S\n I_epda_HS\n\nbegin\n\ndefinition epdaS_vs_epdaHS_TSstructure_rel :: \"\n ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"epdaS_vs_epdaHS_TSstructure_rel G1 G2 \\\n valid_epda G1\n \\ G1 = G2\"\ndeclare epdaS_vs_epdaHS_TSstructure_rel_def [simp add]\n\ndefinition epdaS_vs_epdaHS_effect_rel :: \"\n ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"epdaS_vs_epdaHS_effect_rel G1 G2 o1 o2 \\\n G1 = G2\n \\ o1 = o2\"\ndeclare epdaS_vs_epdaHS_effect_rel_def [simp add]\n\ndefinition epdaS_vs_epdaHS_label_relation :: \"\n ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\n \\ bool\"\n where\n \"epdaS_vs_epdaHS_label_relation G1 G2 e1 e2 \\\n e1 = e2\n \\ e1 \\ epda_delta G1\"\ndeclare epdaS_vs_epdaHS_label_relation_def [simp add]\n\ndefinition epdaHS2epdaS_derivation :: \"\n (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaHS_conf) derivation\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaS_conf) derivation\"\n where\n \"epdaHS2epdaS_derivation d \\\n (\\n. case d n of\n None \\ None\n | Some (pair e c) \\\n Some (pair e\n \\epdaS_conf_state = epdaHS_conf_state c,\n epdaS_conf_scheduler = epdaHS_conf_scheduler c,\n epdaS_conf_stack = epdaHS_conf_stack c\\))\"\n\ndefinition epdaS_vs_epdaHS_derivation_bisimulation :: \"\n ('state, 'event, 'stack) epda\n \\ ('state, 'event, 'stack) epda\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaS_conf) derivation\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaHS_conf) derivation\n \\ bool\"\n where\n \"epdaS_vs_epdaHS_derivation_bisimulation G1 G2 d1 d2 \\\n valid_epda G1\n \\ G1 = G2\n \\ epdaHS.derivation_initial G2 d2\n \\ (\\n. maximum_of_domain d2 n)\n \\ epdaHS2epdaS_derivation d2 = d1\"\ndeclare epdaS_vs_epdaHS_derivation_bisimulation_def [simp add]\n\nlemma epdaHS2epdaS_derivation_preserves_derivation_initial: \"\n valid_epda P\n \\ epdaHS.derivation_initial P d\n \\ epdaS.derivation_initial P (epdaHS2epdaS_derivation d)\"\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rule conjI)\n prefer 2\n apply(simp add: epdaHS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac b)(*strict*)\n apply(simp add: epdaS_initial_configurations_def epdaHS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def epdaHS_configurations_def)\n apply(clarsimp)\n apply(simp add: epdaS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaHS_step_relation P c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def)\n done\n\nlemma epdaHS2epdaS_derivation_preserves_step_labels: \"\n valid_epda G\n \\ epdaHS.derivation G d\n \\ d n = Some (pair e c)\n \\ \\c. (epdaHS2epdaS_derivation d) n = Some (pair e c)\"\n apply(induct n arbitrary: e c)\n apply(rename_tac e c)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d n = Some (pair e1 c1) \\ d (Suc n) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G c1 e2 c2\")\n apply(rename_tac n e c)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc n\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(force)\n apply(rename_tac n e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1)(*strict*)\n apply(erule_tac\n x = \"e1\"\n in meta_allE)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac n c e1 e2 c1 ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n done\n\nlemma epdaHS2epdaS_derivation_preserves_maximum_of_domain: \"\n valid_epda G\n \\ maximum_of_domain d n\n \\ maximum_of_domain (epdaHS2epdaS_derivation d) n\"\n apply(simp add: maximum_of_domain_def epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(case_tac y)\n apply(rename_tac y option b)(*strict*)\n apply(clarsimp)\n done\n\ndefinition epdaS2epdaHS_derivation :: \"\n ('state, 'event, 'q) epda\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaS_conf) derivation\n \\ (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaHS_conf) derivation\"\n where\n \"epdaS2epdaHS_derivation G d \\\n (\\n. case d n of\n None \\ None\n | Some (pair e c) \\\n Some (pair e\n \\epdaHS_conf_state = epdaS_conf_state c,\n epdaHS_conf_history = the(right_quotient_word\n (epdaS_conf_scheduler(the(get_configuration(d 0))))\n (epdaS_conf_scheduler c)),\n epdaHS_conf_scheduler = epdaS_conf_scheduler c,\n epdaHS_conf_stack = epdaS_conf_stack c\\))\"\n\nlemma epdaS2epdaHS_derivation_preserves_derivation_initial: \"\n valid_epda P\n \\ epdaS.derivation_initial P d\n \\ epdaHS.derivation_initial P (epdaS2epdaHS_derivation P d)\"\n apply(simp add: epdaS2epdaHS_derivation_def)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rule conjI)\n prefer 2\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac b)(*strict*)\n apply(simp add: epdaS_initial_configurations_def epdaHS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def epdaHS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: right_quotient_word_def)\n apply(simp add: epdaHS.derivation_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac i nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat)(*strict*)\n apply(case_tac \"d (Suc nat)\")\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation P c1 e2 c2\")\n apply(rename_tac nat a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac nat a)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(force)\n apply(rename_tac nat a)(*strict*)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n prefer 2\n apply(rule epdaS.some_position_has_details_at_0)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label P e2\")\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ (epdaS_string_state c1)\")\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"nat\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(clarsimp)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c1 = w @ (epdaS_string_state c2)\")\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"Suc 0\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(subgoal_tac \"c \\ epdaS_configurations P\")\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n prefer 2\n apply(rule epdaS.belongs_configurations)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(simp add: epdaS_string_state_def)\n apply(rule_tac\n t = \"right_quotient_word (wa @ option_to_list (edge_event e2) @ epdaS_conf_scheduler c2) (epdaS_conf_scheduler c2)\"\n and s = \"Some(wa @ option_to_list (edge_event e2))\"\n in ssubst)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule_tac\n t = \"right_quotient_word (wa @ option_to_list (edge_event e2) @ epdaS_conf_scheduler c2) (option_to_list (edge_event e2) @ epdaS_conf_scheduler c2)\"\n and s = \"Some wa\"\n in ssubst)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac nat e1 e2 c1 c2 w c wa)(*strict*)\n apply(force)\n done\n\nlemma epdaS2epdaHS_derivation_preserves_maximum_of_domain: \"\n valid_epda G\n \\ maximum_of_domain d n\n \\ maximum_of_domain (epdaS2epdaHS_derivation G d) n\"\n apply(simp add: maximum_of_domain_def epdaS2epdaHS_derivation_def)\n apply(clarsimp)\n apply(rename_tac y)(*strict*)\n apply(case_tac y)\n apply(rename_tac y option b)(*strict*)\n apply(clarsimp)\n done\n\nlemma epda_S_HS_relation_coincide_hlp: \"\n valid_epda G2\n \\ epdaHS.derivation_initial G2 d2\n \\ maximum_of_domain d2 x\n \\ epdaS2epdaHS_derivation G2 (epdaHS2epdaS_derivation d2) xa = d2 xa\"\n apply(induct xa)\n apply(simp add: epdaHS2epdaS_derivation_def epdaS2epdaHS_derivation_def)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(case_tac c)\n apply(rename_tac c epdaHS_conf_statea epdaHS_conf_history epdaHS_conf_schedulera epdaHS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac epdaHS_conf_state epdaHS_conf_history epdaHS_conf_scheduler epdaHS_conf_stack)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(clarsimp)\n apply(simp add: epdaHS_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac epdaHS_conf_scheduler)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: butlast_if_match_def right_quotient_word_def)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d2 0\")\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac a option b)(*strict*)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(case_tac \"d2 (Suc xa)\")\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS2epdaS_derivation_def epdaS2epdaHS_derivation_def)\n apply(rename_tac xa a)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d2 xa = Some (pair e1 c1) \\ d2 (Suc xa) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G2 c1 e2 c2\")\n apply(rename_tac xa a)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc xa\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac xa a)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac xa a)(*strict*)\n apply(force)\n apply(rename_tac xa a)(*strict*)\n apply(force)\n apply(rename_tac xa a)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def)\n apply(simp add: epdaHS2epdaS_derivation_def epdaS2epdaHS_derivation_def)\n apply(subgoal_tac \"\\ c. d2 0 = Some (pair None c)\")\n apply(rename_tac xa e1 e2 c1 c2)(*strict*)\n prefer 2\n apply(simp add: epdaHS.derivation_initial_def)\n apply(clarsimp)\n apply(case_tac \"d2 0\")\n apply(rename_tac xa e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2 a)(*strict*)\n apply(case_tac a)\n apply(rename_tac xa e1 e2 c1 c2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(subgoal_tac \"\\w. epdaHS_string_state c = w @ epdaHS_string_state c1\")\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d2\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(subgoal_tac \"\\w. epdaHS_string_state c1 = w @ epdaHS_string_state c2\")\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"d2\"\n and i = \"xa\"\n and j = \"Suc 0\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(force)\n apply(rename_tac xa e1 e2 c1 c2 c w)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c1 c2 c w wa)(*strict*)\n apply(simp add: epdaHS_string_state_def)\n apply(simp add: epdaHS_step_relation_def)\n apply(subgoal_tac \"valid_epda_step_label G2 e2\")\n apply(rename_tac xa e1 e2 c1 c2 c w wa)(*strict*)\n prefer 2\n apply(simp add: valid_epda_def)\n apply(rename_tac xa e1 e2 c1 c2 c w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c2 c w wb)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(case_tac c2)\n apply(rename_tac xa e1 e2 c2 c w wb epdaHS_conf_statea epdaHS_conf_historya epdaHS_conf_schedulera epdaHS_conf_stacka)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e1 e2 c w wb epdaHS_conf_schedulera)(*strict*)\n apply(rule_tac\n t = \"right_quotient_word (w @ option_to_list (edge_event e2) @ epdaHS_conf_schedulera) epdaHS_conf_schedulera\"\n and s = \"Some(w @ option_to_list (edge_event e2))\"\n in ssubst)\n apply(rename_tac xa e1 e2 c w wb epdaHS_conf_schedulera)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac xa e1 e2 c w wb epdaHS_conf_schedulera)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"right_quotient_word (w @ option_to_list (edge_event e2) @ epdaHS_conf_schedulera) (option_to_list (edge_event e2) @ epdaHS_conf_schedulera)\"\n and s = \"Some w\"\n in ssubst)\n apply(rename_tac xa e1 e2 c w wb epdaHS_conf_schedulera)(*strict*)\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac xa e1 e2 c w wb epdaHS_conf_schedulera)(*strict*)\n apply(force)\n done\n\ncorollary epda_S_HS_relation_coincide: \"\n (\\G1 G2 d1 d2. (valid_epda G1) \\ (G1 = G2) \\ epdaHS.derivation_initial G2 d2 \\ (\\n. maximum_of_domain d2 n) \\ epdaHS2epdaS_derivation d2 = d1) = (\\G1 G2 d1 d2. (valid_epda G1) \\ (G1 = G2) \\ epdaS.derivation_initial G1 d1 \\ (\\n. maximum_of_domain d1 n) \\ epdaS2epdaHS_derivation G1 d1 = d2)\"\n apply(rule ext)+\n apply(rename_tac G1 G2 d1 d2)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac G1 G2 d1 d2)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G2 d1 x)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 d1 x)(*strict*)\n apply (metis epdaS2epdaHS_derivation_preserves_derivation_initial)\n apply(rename_tac G2 d1 x)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 d1 x)(*strict*)\n apply (metis epdaS2epdaHS_derivation_preserves_maximum_of_domain)\n apply(rename_tac G2 d1 x)(*strict*)\n apply(simp add: epdaS2epdaHS_derivation_def epdaHS2epdaS_derivation_def)\n apply(rule ext)\n apply(rename_tac G2 d1 x n)(*strict*)\n apply(case_tac \"d1 n\")\n apply(rename_tac G2 d1 x n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 d1 x n a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G2 d1 x n a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1 d2)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 d2 x)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 d2 x)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac G2 d2 x)(*strict*)\n apply(rule conjI)\n apply(rename_tac G2 d2 x)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_maximum_of_domain)\n apply(rename_tac G2 d2 x)(*strict*)\n apply(rule ext)\n apply(rename_tac G2 d2 x xa)(*strict*)\n apply(rule epda_S_HS_relation_coincide_hlp)\n apply(rename_tac G2 d2 x xa)(*strict*)\n apply(force)+\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_AX_initial_contained1: \"\n (\\G1. valid_epda G1 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\c2. epdaHS.derivation_initial G1 (der1 c2) \\ Ex (maximum_of_domain (der1 c2)) \\ epdaHS2epdaS_derivation (der1 c2) = der1 c1)))\"\n apply(clarsimp)\n apply(rename_tac G1 c1)(*strict*)\n apply(rule_tac\n x = \"\\epdaHS_conf_state = epdaS_conf_state c1, epdaHS_conf_history = [], epdaHS_conf_scheduler = epdaS_conf_scheduler c1, epdaHS_conf_stack = epdaS_conf_stack c1\\\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 c1)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 c1)(*strict*)\n apply(rule epdaHS.der1_is_derivation)\n apply(rename_tac G1 c1)(*strict*)\n apply(simp add: der1_def)\n apply(simp add: epdaHS_initial_configurations_def epdaHS_configurations_def epdaS_initial_configurations_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac G1 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c1)(*strict*)\n apply(rule_tac\n x = \"0\"\n in exI)\n apply (metis der1_maximum_of_domain)\n apply(rename_tac G1 c1)(*strict*)\n apply(rule ext)\n apply(rename_tac G1 c1 x)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def der1_def der1_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_AX_initial_contained2: \"\n (\\G1. valid_epda G1 \\ (\\c2. c2 \\ epdaHS_initial_configurations G1 \\ epdaHS.derivation_initial G1 (der1 c2) \\ Ex (maximum_of_domain (der1 c2)) \\ (\\c1. epdaHS2epdaS_derivation (der1 c2) = der1 c1)))\"\n apply(clarsimp)\n apply(rename_tac G1 c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c2)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 c2)(*strict*)\n apply(rule epdaHS.der1_is_derivation)\n apply(rename_tac G1 c2)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac G1 c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 c2)(*strict*)\n apply(rule_tac\n x = \"0\"\n in exI)\n apply (metis der1_maximum_of_domain)\n apply(rename_tac G1 c2)(*strict*)\n apply(rule_tac\n x = \"X\" for X\n in exI)\n apply(simp add: epdaHS2epdaS_derivation_def der1_def der1_def)\n apply(rule ext)\n apply(rename_tac G1 c2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 c2)(*strict*)\n apply(force)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_on_derivation_initial1: \"\n (\\G1 d1. valid_epda G1 \\ (\\d2. epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ epdaHS2epdaS_derivation d2 = d1) \\ epdaS.derivation_initial G1 d1)\"\n apply(clarsimp)\n apply(rename_tac G1 d2 x)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_on_finite1: \"\n (\\G1 d1. valid_epda G1 \\ (\\d2. epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ epdaHS2epdaS_derivation d2 = d1) \\ Ex (maximum_of_domain d1))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 x)(*strict*)\n apply(rule_tac\n x = \"x\"\n in exI)\n apply (metis epdaHS2epdaS_derivation_preserves_maximum_of_domain)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_equal_length: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\n1. maximum_of_domain (epdaHS2epdaS_derivation d2) n1 \\ (\\n2. maximum_of_domain d2 n2 \\ n1 = n2)))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 n1 x n2)(*strict*)\n apply (metis epdaS.derivation_initial_is_derivation epdaS.maximum_of_domainUnique epdaHS2epdaS_derivation_preserves_derivation_initial epdaHS2epdaS_derivation_preserves_maximum_of_domain)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_simulate12: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\n. maximum_of_domain (epdaHS2epdaS_derivation d2) n \\ maximum_of_domain d2 n \\ (\\e1 c1'. epdaS_step_relation G1 (the (get_configuration (epdaHS2epdaS_derivation d2 n))) e1 c1' \\ (\\c2'. epdaHS_step_relation G1 (the (get_configuration (d2 n))) e1 c2' \\ e1 \\ epda_delta G1 \\ (let d2' = derivation_append d2 (der2 (the (get_configuration (d2 n))) e1 c2') n in epdaHS.derivation_initial G1 d2' \\ Ex (maximum_of_domain d2') \\ epdaHS2epdaS_derivation d2' = derivation_append (epdaHS2epdaS_derivation d2) (der2 (the (get_configuration (epdaHS2epdaS_derivation d2 n))) e1 c1') n)))))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 n x e1 c1')(*strict*)\n apply(subgoal_tac \"n = x\")\n apply(rename_tac G1 d2 n x e1 c1')(*strict*)\n prefer 2\n apply (metis epdaS_vs_epdaHS_inst_AX_equal_length)\n apply(rename_tac G1 d2 n x e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n apply(subgoal_tac \"\\e c. d2 x = Some (pair e c)\")\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule_tac\n x = \"\\epdaHS_conf_state = epdaS_conf_state c1', epdaHS_conf_history = epdaHS_conf_history c@(option_to_list(edge_event e1)), epdaHS_conf_scheduler = epdaS_conf_scheduler c1', epdaHS_conf_stack = epdaS_conf_stack c1'\\\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: epdaHS_step_relation_def epdaS_step_relation_def get_configuration_def)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(simp add: Let_def)\n apply(rule context_conjI)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule epdaHS.derivation_append_preserves_derivation)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply (rule epdaHS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule_tac\n x = \"x+Suc 0\"\n in exI)\n apply (metis Nat.add_0_right add_Suc_right concat_has_max_dom der2_maximum_of_domain)\n apply(rename_tac G1 d2 x e1 c1' e c)(*strict*)\n apply(rule ext)\n apply(rename_tac G1 d2 x e1 c1' e c xa)(*strict*)\n apply(simp add: derivation_append_def epdaHS2epdaS_derivation_def derivation_append_def)\n apply(case_tac \"xa \\ x\")\n apply(rename_tac G1 d2 x e1 c1' e c xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e1 c1' e c xa)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def der2_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_simulate21: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\n. maximum_of_domain (epdaHS2epdaS_derivation d2) n \\ maximum_of_domain d2 n \\ (\\e2 c2'. epdaHS_step_relation G1 (the (get_configuration (d2 n))) e2 c2' \\ (\\c1'. epdaS_step_relation G1 (the (get_configuration (epdaHS2epdaS_derivation d2 n))) e2 c1' \\ e2 \\ epda_delta G1 \\ (let d2' = derivation_append d2 (der2 (the (get_configuration (d2 n))) e2 c2') n in epdaHS.derivation_initial G1 d2' \\ Ex (maximum_of_domain d2') \\ epdaHS2epdaS_derivation d2' = derivation_append (epdaHS2epdaS_derivation d2) (der2 (the (get_configuration (epdaHS2epdaS_derivation d2 n))) e2 c1') n)))))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 n x e2 c2')(*strict*)\n apply(subgoal_tac \"n = x\")\n apply(rename_tac G1 d2 n x e2 c2')(*strict*)\n prefer 2\n apply (metis epdaS_vs_epdaHS_inst_AX_equal_length)\n apply(rename_tac G1 d2 n x e2 c2')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n apply(subgoal_tac \"\\e c. d2 x = Some (pair e c)\")\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e2 c2')(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule_tac\n x = \"\\epdaS_conf_state = epdaHS_conf_state c2', epdaS_conf_scheduler = epdaHS_conf_scheduler c2', epdaS_conf_stack = epdaHS_conf_stack c2'\\\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def get_configuration_def epdaHS2epdaS_derivation_def get_configuration_def)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(simp add: epdaS_step_relation_def epdaHS_step_relation_def get_configuration_def epdaHS2epdaS_derivation_def get_configuration_def)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(simp add: Let_def)\n apply(rule context_conjI)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule epdaHS.derivation_append_preserves_derivation)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply (metis epdaHS.der2_is_derivation)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def get_configuration_def)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule_tac\n x = \"x+Suc 0\"\n in exI)\n apply (metis Nat.add_0_right add_Suc_right concat_has_max_dom der2_maximum_of_domain)\n apply(rename_tac G1 d2 x e2 c2' e c)(*strict*)\n apply(rule ext)\n apply(rename_tac G1 d2 x e2 c2' e c xa)(*strict*)\n apply(simp add: derivation_append_def epdaHS2epdaS_derivation_def derivation_append_def)\n apply(case_tac \"xa \\ x\")\n apply(rename_tac G1 d2 x e2 c2' e c xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x e2 c2' e c xa)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def der2_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_hlp_bisimulation_compatible_with_crop: \"\n valid_epda G1\n \\ epdaHS.derivation_initial G1 dh\n \\ maximum_of_domain dh x\n \\ maximum_of_domain (epdaHS2epdaS_derivation dh) n\n \\ derivation_append_fit (epdaHS2epdaS_derivation dh) dc n\n \\ epdaHS.derivation_initial G1 dc'\n \\ epdaHS2epdaS_derivation dc' = derivation_append (epdaHS2epdaS_derivation dh) dc n\n \\ maximum_of_domain dc' xb\n \\ xa \\ n\n \\ dh xa = dc' xa\"\n apply(subgoal_tac \"x = n\")\n apply(subgoal_tac \"x\\xb\")\n apply(clarsimp)\n apply(induct xa)\n apply(clarsimp)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' 0 = derivation_append (epdaHS2epdaS_derivation dh) dc n 0\")\n prefer 2\n apply(force)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (epdaHS2epdaS_derivation dh) dc n\")\n apply(simp add: epdaHS2epdaS_derivation_def derivation_append_def)\n apply(subgoal_tac \"\\c. dc' 0 = Some (pair None c)\")\n apply(subgoal_tac \"\\c. dh 0 = Some (pair None c)\")\n apply(clarsimp)\n apply(rename_tac c ca)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(simp add: epdaHS_initial_configurations_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(rule epdaHS.some_position_has_details_at_0)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rule epdaHS.some_position_has_details_at_0)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' xa = derivation_append (epdaHS2epdaS_derivation dh) dc n xa\")\n apply(rename_tac xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' (Suc xa) = derivation_append (epdaHS2epdaS_derivation dh) dc n (Suc xa)\")\n apply(rename_tac xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (epdaHS2epdaS_derivation dh) dc n\")\n apply(rename_tac xa)(*strict*)\n apply(subgoal_tac \"\\e c. dc' (Suc xa) = Some (pair e c)\")\n apply(rename_tac xa)(*strict*)\n apply(subgoal_tac \"\\e c. dh (Suc xa) = Some (pair e c)\")\n apply(rename_tac xa)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac xa ea c ca)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. dh xa = Some (pair e1 c1) \\ dh (Suc xa) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G1 c1 e2 c2\")\n apply(rename_tac xa ea c ca)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc xa\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac xa ea c ca)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac xa ea c ca)(*strict*)\n apply(force)\n apply(rename_tac xa ea c ca)(*strict*)\n apply(force)\n apply(rename_tac xa ea c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. dc' xa = Some (pair e1 c1) \\ dc' (Suc xa) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G1 c1 e2 c2\")\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc xa\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac xa c ca e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS_step_relation_def)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa e c)(*strict*)\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac xa e c)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac xa e c)(*strict*)\n apply(force)\n apply(rename_tac xa e c)(*strict*)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac xa)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(rule_tac\n j = \"n\"\n in le_trans)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rule_tac\n ?d1.0 = \"(epdaHS2epdaS_derivation dh)\"\n and ?d2.0 = \"dc\"\n in epdaS.derivation_append_minimal_maximum_of_domain)\n apply(force)+\n prefer 4\n apply(force)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(rule_tac\n t = \"derivation_append (epdaHS2epdaS_derivation dh) dc n\"\n and s = \"epdaHS2epdaS_derivation dc'\"\n in ssubst)\n apply(force)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rule_tac\n t = \"derivation_append (epdaHS2epdaS_derivation dh) dc n\"\n and s = \"epdaHS2epdaS_derivation dc'\"\n in ssubst)\n apply(force)\n apply (metis epdaHS2epdaS_derivation_preserves_maximum_of_domain)\n apply(force)\n apply (metis epdaS_vs_epdaHS_inst_AX_equal_length)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_crop1: \"\n (\\G1. valid_epda G1 \\ (\\dh. epdaHS.derivation_initial G1 dh \\ Ex (maximum_of_domain dh) \\ (\\n. maximum_of_domain (epdaHS2epdaS_derivation dh) n \\ (\\dc. derivation_append_fit (epdaHS2epdaS_derivation dh) dc n \\ (\\dc'. epdaHS.derivation_initial G1 dc' \\ Ex (maximum_of_domain dc') \\ epdaHS2epdaS_derivation dc' = derivation_append (epdaHS2epdaS_derivation dh) dc n \\ (\\x\\n. dh x = dc' x))))))\"\n apply(clarsimp)\n apply(rename_tac G1 dh n x dc dc' xa xb)(*strict*)\n apply(rule epdaS_vs_epdaHS_inst_hlp_bisimulation_compatible_with_crop)\n apply(rename_tac G1 dh n x dc dc' xa xb)(*strict*)\n apply(force)+\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_crop2: \"\n (\\G1. valid_epda G1 \\ (\\dh. epdaHS.derivation_initial G1 dh \\ Ex (maximum_of_domain dh) \\ (\\n. maximum_of_domain dh n \\ (\\dc'. derivation_append_fit dh dc' n \\ epdaHS.derivation_initial G1 (derivation_append dh dc' n) \\ Ex (maximum_of_domain (derivation_append dh dc' n)) \\ (\\x\\n. epdaHS2epdaS_derivation dh x = epdaHS2epdaS_derivation (derivation_append dh dc' n) x)))))\"\n apply(clarsimp)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(subgoal_tac \"\\e c. dh xa = Some (pair e c)\")\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh n x dc' xa xb e c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(subgoal_tac \"x = n\")\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh n dc' xa xb)(*strict*)\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh n dc' xa xb)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 dh n dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(rule epdaHS.maximum_of_domainUnique)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x dc' xa xb)(*strict*)\n apply(force)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_accept_id1: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ epdaS_marking_condition G1 (epdaHS2epdaS_derivation d2) \\ epdaHS_marking_condition G1 d2)\"\n apply(clarsimp)\n apply(rename_tac G1 d2 x)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c)(*strict*)\n apply(subgoal_tac \"\\e c. d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 x i e c)(*strict*)\n prefer 2\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(case_tac \"d2 i\")\n apply(rename_tac G1 d2 x i e c)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x i e c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 d2 x i e c a option b)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS_marking_condition_def)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(rule_tac\n x = \"ea\"\n in exI)\n apply(rule_tac\n x = \"ca\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS_marking_configurations_def epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(force)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule epdaHS.belongs_configurations)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(force)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_accept_id2: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ epdaHS_marking_condition G1 d2 \\ epdaS_marking_condition G1 (epdaHS2epdaS_derivation d2))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 x)(*strict*)\n apply(simp add: epdaHS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(subgoal_tac \"\\e c. epdaHS2epdaS_derivation d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 x i e c)(*strict*)\n prefer 2\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac G1 d2 x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS_marking_configurations_def epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule_tac\n d = \"epdaHS2epdaS_derivation d2\"\n in epdaS.belongs_configurations)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac G1 d2 x i e c ea ca)(*strict*)\n apply(force)\n done\n\nlemma epdaHS2epdaS_derivation_reflects_string_state_delta: \"\n valid_epda G\n \\ epdaHS.derivation_initial G d\n \\ d i = Some (pair ei ci)\n \\ d j = Some (pair ej cj)\n \\ i\\j\n \\ epdaS_string_state ci' = w @ epdaS_string_state cj'\n \\ (epdaHS2epdaS_derivation d) i = Some (pair ei ci')\n \\ (epdaHS2epdaS_derivation d) j = Some (pair ej cj')\n \\ epdaHS_string_state ci = w @ epdaHS_string_state cj\"\n apply(induct \"j-i\" arbitrary: j ej cj cj' w)\n apply(rename_tac j ej cj cj' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x j ej cj cj' w)(*strict*)\n apply(clarsimp)\n apply(case_tac j)\n apply(rename_tac x j ej cj cj' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x j ej cj cj' w nat)(*strict*)\n apply(erule_tac\n x = \"nat\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G c1 e2 c2\")\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\e c. d nat = Some (pair e c)\")\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\e c. (epdaHS2epdaS_derivation d) nat = Some (pair e c)\")\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(erule_tac\n x = \"e\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"c\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\w. epdaHS_string_state c1 = w @ epdaHS_string_state cj\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"Suc 0\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(subgoal_tac \"\\w. epdaHS_string_state ci = w @ epdaHS_string_state c1\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"nat-i\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state c = w @ epdaS_string_state cj'\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"epdaHS2epdaS_derivation d\"\n and j = \"Suc 0\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(subgoal_tac \"\\w. epdaS_string_state ci' = w @ epdaS_string_state c\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n prefer 2\n apply(rule_tac\n d = \"epdaHS2epdaS_derivation d\"\n and j = \"nat-i\"\n in epdaS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa wb wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(erule_tac\n x = \"wd\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb wc wd)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. epdaHS2epdaS_derivation d nat = Some (pair e1 c1) \\ epdaHS2epdaS_derivation d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wc wd)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_string_state_def epdaHS_string_state_def epdaS_step_relation_def epdaHS_step_relation_def)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n done\n\nlemma epdaHS2epdaS_derivation_preserves_string_state_delta: \"\n valid_epda G\n \\ epdaHS.derivation_initial G d\n \\ d i = Some (pair ei ci)\n \\ d j = Some (pair ej cj)\n \\ i\\j\n \\ epdaHS_string_state ci = w @ epdaHS_string_state cj\n \\ (epdaHS2epdaS_derivation d) i = Some (pair ei ci')\n \\ (epdaHS2epdaS_derivation d) j = Some (pair ej cj')\n \\ epdaS_string_state ci' = w @ epdaS_string_state cj'\"\n apply(induct \"j-i\" arbitrary: j ej cj cj' w)\n apply(rename_tac j ej cj cj' w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x j ej cj cj' w)(*strict*)\n apply(clarsimp)\n apply(case_tac j)\n apply(rename_tac x j ej cj cj' w)(*strict*)\n apply(force)\n apply(rename_tac x j ej cj cj' w nat)(*strict*)\n apply(erule_tac\n x = \"nat\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ d (Suc nat) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G c1 e2 c2\")\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(force)\n apply(rename_tac x ej cj cj' w nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\e c. d nat = Some (pair e c)\")\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(subgoal_tac \"\\e c. (epdaHS2epdaS_derivation d) nat = Some (pair e c)\")\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(erule_tac\n x = \"e\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"c1\"\n in meta_allE)\n apply(clarsimp)\n apply(erule_tac\n x = \"c\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\w. epdaHS_string_state c1 = w @ epdaHS_string_state cj\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"Suc 0\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(subgoal_tac \"\\w. epdaHS_string_state ci = w @ epdaHS_string_state c1\")\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n prefer 2\n apply(rule_tac\n j = \"nat-i\"\n in epdaHS.derivation_monotonically_dec)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(rule epdaHS.derivation_initial_belongs)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1 e c wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(erule_tac\n x = \"wb\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. epdaHS2epdaS_derivation d nat = Some (pair e1 c1) \\ epdaHS2epdaS_derivation d (Suc nat) = Some (pair (Some e2) c2) \\ epdaS_step_relation G c1 e2 c2\")\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"Suc nat\"\n in epdaS.step_detail_before_some_position)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply (metis epdaHS2epdaS_derivation_preserves_derivation_initial)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' nat e1 e2 c1 e c wa wb)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_string_state_def epdaHS_string_state_def epdaS_step_relation_def epdaHS_step_relation_def)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(rule_tac\n m = \"Suc nat\"\n in epdaHS.pre_some_position_is_some_position)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(force)\n apply(rename_tac x cj cj' w nat e1 e2 c1)(*strict*)\n apply(force)\n done\n\nlemma epdaHS_get_unfixed_scheduler_DB_with_derivation_take: \"\n valid_epda G\n \\ epdaHS.derivation G d\n \\ epdaHS_get_unfixed_scheduler_DB G d n = epdaHS_get_unfixed_scheduler_DB G (derivation_take d n) n\"\n apply(simp add: epdaHS_get_unfixed_scheduler_DB_def)\n apply(simp add: derivation_take_def)\n done\n\nlemma derivation_take_distributes_over_epdaS2epdaHS_derivation: \"\n derivation_take (epdaS2epdaHS_derivation G d) n = epdaS2epdaHS_derivation G (derivation_take d n)\"\n apply(rule ext)\n apply(rename_tac x)(*strict*)\n apply(simp add: derivation_take_def epdaS2epdaHS_derivation_def derivation_take_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_unAX_marked_effect_id1: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\o1. o1 \\ epdaS_unmarked_effect G1 (epdaHS2epdaS_derivation d2) \\ o1 \\ epdaHS_unmarked_effect G1 d2))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x)(*strict*)\n apply(simp add: epdaS_unmarked_effect_def epdaHS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(subgoal_tac \"\\e c. d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x c c' i e ea ca cb)(*strict*)\n apply(rule_tac\n x = \"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 d2 o1 x c c' i e ea ca cb)(*strict*)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(rule_tac\n x = \"ea\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x c c' i e ea ca cb)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x c i e ca)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac G1 d2 o1 x c i e ca)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 o1 x c i e ca a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 d2 o1 x c i e ca a option b)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(case_tac \"d2 i\")\n apply(rename_tac G1 d2 o1 x c c' i e)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 o1 x c c' i e a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 d2 o1 x c c' i e a option b)(*strict*)\n apply(force)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_unAX_marked_effect_id2: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\o2. o2 \\ epdaHS_unmarked_effect G1 d2 \\ o2 \\ epdaS_unmarked_effect G1 (epdaHS2epdaS_derivation d2)))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x)(*strict*)\n apply(simp add: epdaS_unmarked_effect_def epdaHS_unmarked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(subgoal_tac \"\\e c. epdaHS2epdaS_derivation d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(subgoal_tac \"\\c. epdaHS2epdaS_derivation d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca cb)(*strict*)\n apply(rule_tac\n x = \"cb\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca cb)(*strict*)\n apply(rule_tac\n x = \"i\"\n in exI)\n apply(rule_tac\n x = \"ea\"\n in exI)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca cb)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 o2 x c c' i e a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 d2 o2 x c c' i e a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 o2 x c c' i e ea ca)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac G1 d2 o2 x c c' i e ea ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 d2 o2 x c c' i e ea ca a option b)(*strict*)\n apply(force)\n apply(rename_tac G1 d2 o2 x c c' i e)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_marked_effect_id1: \"\n (\\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\o1. o1 \\ epdaS_marked_effect G1 (epdaHS2epdaS_derivation d2) \\ epdaS_marking_condition G1 (epdaHS2epdaS_derivation d2) \\ o1 \\ epdaHS_marked_effect G1 d2))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 o1 x)(*strict*)\n apply(simp add: epdaS_marked_effect_def epdaHS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(subgoal_tac \"\\e c. d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n prefer 2\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(case_tac \"d2 i\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 d2 x c i e ca a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_at_0)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca ea cb cc)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_marked_effect_id2: \"\n \\G1 d2. valid_epda G1 \\ epdaHS.derivation_initial G1 d2 \\ Ex (maximum_of_domain d2) \\ (\\o2. o2 \\ epdaHS_marked_effect G1 d2 \\ epdaHS_marking_condition G1 d2 \\ o2 \\ epdaS_marked_effect G1 (epdaHS2epdaS_derivation d2))\"\n apply(clarsimp)\n apply(rename_tac G1 d2 o2 x)(*strict*)\n apply(simp add: epdaS_marked_effect_def epdaHS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c)(*strict*)\n apply(simp add: epdaHS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(subgoal_tac \"\\e c. epdaHS2epdaS_derivation d2 i = Some (pair e c)\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n prefer 2\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(subgoal_tac \"\\c. d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_at_0)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(subgoal_tac \"\\c. epdaHS2epdaS_derivation d2 0 = Some (pair None c)\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n prefer 2\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac G1 d2 x c i e ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 d2 x c i e ca ea cb cc)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_step_labels_unique1: \"\n (\\G1 G2 e1 e21 e22. valid_epda G1 \\ G1 = G2 \\ e1 \\ epda_step_labels G1 \\ e21 \\ epda_step_labels G2 \\ e22 \\ epda_step_labels G2 \\ e1 = e21 \\ e1 \\ epda_delta G1 \\ e1 = e22 \\ e1 \\ epda_delta G1 \\ e21 = e22)\"\n apply(clarsimp)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_step_labels_unique2: \"\n (\\G1 G2 e11 e12 e2. valid_epda G1 \\ G1 = G2 \\ e11 \\ epda_step_labels G1 \\ e12 \\ epda_step_labels G1 \\ e2 \\ epda_step_labels G2 \\ e11 = e2 \\ e11 \\ epda_delta G1 \\ e12 = e2 \\ e12 \\ epda_delta G1 \\ e11 = e12)\"\n apply(clarsimp)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_step_labels_exists1: \"\n (\\G1 G2 e1. valid_epda G1 \\ G1 = G2 \\ e1 \\ epda_step_labels G1 \\ (\\e2\\ epda_step_labels G2. e1 = e2 \\ e1 \\ epda_delta G1))\"\n apply(clarsimp)\n apply(rename_tac G1 e1)(*strict*)\n apply(simp add: epda_step_labels_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_step_labels_exists2: \"\n (\\G1 G2 e2. valid_epda G1 \\ G1 = G2 \\ e2 \\ epda_step_labels G2 \\ (\\e1\\ epda_step_labels G1. e1 = e2 \\ e1 \\ epda_delta G1))\"\n apply(clarsimp)\n apply(rename_tac G1 e2)(*strict*)\n apply(simp add: epda_step_labels_def)\n done\n\nlemma drop_map_nat_seq: \"\n drop i (map f (nat_seq x j)) = map f (nat_seq (x+i) j)\"\n apply(case_tac \"x\\j\")\n apply(rule listEqI)\n apply(clarsimp)\n apply (metis diff_diff_left nat_seq_length_prime)\n apply(rename_tac ia)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"nat_seq x j ! (i + ia)\"\n and s = \"x+(i+ia)\"\n in ssubst)\n apply(rename_tac ia)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ia)(*strict*)\n apply(force)\n apply(rename_tac ia)(*strict*)\n apply (metis Suc_eq_plus1 diff_diff_left le_diff_conv2 less_diff_conv nat_seq_length_prime add.assoc add.commute not_less_eq trivNat)\n apply(rename_tac ia)(*strict*)\n apply(rule_tac\n t = \"map f (nat_seq (x + i) j) ! ia\"\n and s = \"f (nat_seq (x + i) j ! ia)\"\n in ssubst)\n apply(rename_tac ia)(*strict*)\n apply (metis Suc_eq_plus1 diff_diff_left nat_seq_length_prime nth_map)\n apply(rename_tac ia)(*strict*)\n apply(rule_tac\n t = \"nat_seq (x + i) j ! ia\"\n and s = \"(x+i)+ia\"\n in ssubst)\n apply(rename_tac ia)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac ia)(*strict*)\n apply (metis Suc_eq_plus1 diff_diff_left diff_is_0_eq' less_eq_Suc_le less_zeroE nat_seq_length_prime trivNat)\n apply(rename_tac ia)(*strict*)\n apply (metis Suc_eq_plus1 add_leE diff_diff_left le_diff_conv2 less_diff_conv nat_seq_length_prime not_less_eq trivNat)\n apply(rename_tac ia)(*strict*)\n apply (metis add.commute add.left_commute)\n apply(rule_tac\n t = \"nat_seq x j\"\n and s = \"[]\"\n in ssubst)\n apply (metis nat_seqEmpty trivNat)\n apply(clarsimp)\n apply(metis nat_seqEmpty trans_less_add1 trivNat)\n done\n\nlemma epdaHS_history_computation_by_folding_of_edges: \"\n valid_epda G\n \\ epdaHS.derivation G d\n \\ d i = Some (pair e c)\n \\ d j = Some (pair e' c')\n \\ i\\j\n \\ epdaHS_conf_history c' = epdaHS_conf_history c @ (foldl append [] (map (\\e. option_to_list(edge_event(the e))) (drop i (get_labels d j))))\"\n apply(induct \"j-i\" arbitrary: i e c)\n apply(rename_tac i e c)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"drop j (get_labels d j)\"\n and s = \"[]\"\n in ssubst)\n apply(clarsimp)\n apply (metis get_labels_length eq_imp_le)\n apply(clarsimp)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x = \"Suc i\"\n in meta_allE)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ d (Suc i) = Some (pair (Some e2) c2) \\ epdaHS_step_relation G c1 e2 c2\")\n apply(rename_tac x i e c)(*strict*)\n prefer 2\n apply(rule_tac\n m = \"j\"\n in epdaHS.step_detail_before_some_position)\n apply(rename_tac x i e c)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(force)\n apply(rename_tac x i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule_tac\n x = \"Some e2\"\n in meta_allE)\n apply(erule_tac\n x = \"c2\"\n in meta_allE)\n apply(clarsimp)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(erule meta_impE)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(simp add: get_labels_def)\n apply(rule_tac\n t = \"drop i (map (\\i. get_label (d i)) (nat_seq (Suc 0) j))\"\n and s = \"map (\\i. get_label (d i)) (nat_seq (Suc 0 + i) j)\"\n in ssubst)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(rule drop_map_nat_seq)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"drop (Suc i) (map (\\i. get_label (d i)) (nat_seq (Suc 0) j)) = map (\\i. get_label (d i)) (nat_seq (Suc 0 + Suc i) j)\")\n apply(rename_tac x i e c e2 c2)(*strict*)\n prefer 2\n apply(rule drop_map_nat_seq)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"drop (Suc i) (map (\\i. get_label (d i)) (nat_seq (Suc 0) j)) = map (\\i. get_label (d i)) (nat_seq (Suc (Suc i)) j)\")\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(thin_tac \"epdaHS_conf_history c' = epdaHS_conf_history c2 @ foldl (@) [] (map ((\\e. option_to_list (edge_event (the e))) \\ (\\i. get_label (d i))) (nat_seq (Suc (Suc i)) j))\")\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(rule_tac\n t = \"nat_seq (Suc i) j\"\n and s = \"[Suc i]@nat_seq (Suc (Suc i)) j\"\n in ssubst)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(rule_tac\n n = \"x\"\n in nat_seq_drop_first)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(rule_tac\n t = \"foldl (@) [] (map ((\\e. option_to_list (edge_event (the e))) \\ (\\i. get_label (d i))) ([Suc i] @ nat_seq (Suc (Suc i)) j))\"\n and s = \"((\\e. option_to_list (edge_event (the e))) \\ (\\i. get_label (d i))) (Suc i) @ foldl (@) [] (map ((\\e. option_to_list (edge_event (the e))) \\ (\\i. get_label (d i))) (nat_seq (Suc (Suc i)) j))\"\n in ssubst)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply (metis ConsApp concat_conv_foldl maps_def maps_simps(1))\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(rule_tac\n t = \"epdaHS_conf_history c2\"\n and s = \"epdaHS_conf_history c @ ((\\e. option_to_list (edge_event (the e))) \\ (\\i. get_label (d i))) (Suc i)\"\n in ssubst)\n apply(rename_tac x i e c e2 c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x i e c e2 c2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(simp add: epdaHS_step_relation_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_replace_and_schedF1: \"\n (\\G1. valid_epda G1 \\ (\\dh. epdaHS.derivation_initial G1 dh \\ Ex (maximum_of_domain dh) \\ (\\n. maximum_of_domain (epdaHS2epdaS_derivation dh) n \\ (\\sUF. sUF \\ epda_effects G1 \\ (\\dc dc'. epdaHS.derivation_initial G1 dc' \\ Ex (maximum_of_domain dc') \\ epdaHS2epdaS_derivation dc' = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF n) dc n \\ (\\x\\n. epdaHS_get_fixed_scheduler_DB G1 dh x = epdaHS_get_fixed_scheduler_DB G1 dc' x \\ ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaHS_set_unfixed_scheduler_DB epdaHS_get_unfixed_scheduler_DB G1 dh (epdaHS_get_unfixed_scheduler_DB G1 dc' n) n x = dc' x))))))\"\n apply(clarsimp)\n apply(rename_tac G1 dh n x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS_get_fixed_scheduler_DB_def)\n apply(simp add: epdaHS.replace_unfixed_scheduler_DB_def epdaHS.map_unfixed_scheduler_DB_def)\n apply(subgoal_tac \"n = x\")\n apply(rename_tac G1 dh n x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply (metis epdaS_vs_epdaHS_inst_AX_equal_length)\n apply(rename_tac G1 dh n x sUF dc dc' xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dh xa = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dh x = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"x\\xb\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca)(*strict*)\n apply(case_tac \"xby. epdaHS2epdaS_derivation dh x = Some y) \\ epdaHS2epdaS_derivation dh (Suc x) = None\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca)(*strict*)\n prefer 2\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca y)(*strict*)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' (Suc xb) = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x (Suc xb)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca y)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca y)(*strict*)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea c ca y)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca y)(*strict*)\n apply(simp add: epdaS_set_unfixed_scheduler_DB_def epdaHS2epdaS_derivation_def epdaS.replace_unfixed_scheduler_DB_def epdaS.map_unfixed_scheduler_DB_def get_configuration_def epdaS_get_unfixed_scheduler_DB_def epdaS_get_scheduler_def)\n apply(case_tac \"dh (Suc xb)\")\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca y)(*strict*)\n prefer 2\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca y a)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca option conf)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca y)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(case_tac \"Suc xb = x\")\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(rule_tac\n M = \"G1\"\n and d = \"dh\"\n and n = \"x\"\n and i = \"Suc xb\"\n in epdaHS.derivationNoFromNone2)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea c ca)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dc' xb = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dc' x = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dc' xa = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' xa = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x xa\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec c ca cb cc)(*strict*)\n apply(case_tac \"dc' xa\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec c ca cb cc)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea eb ec c ca cb cc)(*strict*)\n apply(simp add: epdaS_set_unfixed_scheduler_DB_def epdaHS2epdaS_derivation_def epdaS.replace_unfixed_scheduler_DB_def epdaS.map_unfixed_scheduler_DB_def get_configuration_def epdaS_get_unfixed_scheduler_DB_def epdaS_get_scheduler_def)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec c ca cb cc a)(*strict*)\n apply(case_tac a)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec c ca cb cc a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\")(*strict*)\n apply(subgoal_tac \"\\c. dc' 0 = Some (pair None c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\")(*strict*)\n prefer 2\n apply (metis epdaHS.derivation_initial_is_derivation epdaHS.some_position_has_details_at_0)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\")(*strict*)\n apply(subgoal_tac \"\\c. dh 0 = Some (pair None c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\")(*strict*)\n prefer 2\n apply (metis epdaHS.derivation_initial_is_derivation epdaHS.some_position_has_details_at_0)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\")(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(subgoal_tac \"epdaHS_conf_history c = epdaHS_conf_history cd\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' xa = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x xa\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' x = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x x\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: epdaS_set_unfixed_scheduler_DB_def epdaHS2epdaS_derivation_def epdaS.replace_unfixed_scheduler_DB_def epdaS.map_unfixed_scheduler_DB_def get_configuration_def epdaS_get_unfixed_scheduler_DB_def epdaS_get_scheduler_def)\n apply(subgoal_tac \"right_quotient_word (epdaHS_conf_scheduler ca) (epdaHS_conf_scheduler ca) = Some []\")\n apply(rename_tac G1 dh x sUF dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n prefer 2\n apply(rule right_quotient_word_Some_by_append)\n apply(force)\n apply(rename_tac G1 dh x sUF dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: epdaHS_get_scheduler_def epdaHS_set_unfixed_scheduler_DB_def epdaHS_get_unfixed_scheduler_DB_def get_configuration_def)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule_tac\n t = \"epdaHS_conf_history c\"\n and s = \"epdaHS_conf_history cf @ (foldl append [] (map (\\e. option_to_list(edge_event(the e))) (drop 0 (get_labels dh xa))))\"\n in ssubst)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule epdaHS_history_computation_by_folding_of_edges)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule_tac\n t = \"epdaHS_conf_history cd\"\n and s = \"epdaHS_conf_history ce @ (foldl append [] (map (\\e. option_to_list(edge_event(the e))) (drop 0 (get_labels dc' xa))))\"\n in ssubst)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule epdaHS_history_computation_by_folding_of_edges)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule epdaHS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule_tac\n t = \"epdaHS_conf_history cf\"\n and s = \"[]\"\n in ssubst)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def epdaHS_initial_configurations_def)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(rule_tac\n t = \"epdaHS_conf_history ce\"\n and s = \"[]\"\n in ssubst)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def epdaHS_initial_configurations_def)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t = \"get_labels dc' xa\"\n and s = \"get_labels dh xa\"\n in ssubst)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf)(*strict*)\n apply(simp add: get_labels_def)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(subgoal_tac \"Suc 0\\xc \\ xc\\xa\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n prefer 2\n apply (metis nat_seq_in_interval)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(subgoal_tac \"\\e c. dc' xc = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(subgoal_tac \"\\e c. dh xc = Some (pair e c)\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc ee ef cg ch)(*strict*)\n apply(subgoal_tac \"epdaHS2epdaS_derivation dc' xc = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x xc\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc ee ef cg ch)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc ee ef cg ch)(*strict*)\n apply(thin_tac \"epdaHS2epdaS_derivation dc' = derivation_append (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1 (epdaHS2epdaS_derivation dh) sUF x) dc x\")\n apply(rename_tac G1 dh x sUF dc dc' xa xb e ea eb ec ed c ca cb cc \"cd\" ce cf xc ee ef cg ch)(*strict*)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: derivation_append_def epdaS.replace_unfixed_scheduler_DB_def epdaS.map_unfixed_scheduler_DB_def)\n done\n\nlemma epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_replace_and_schedF2: \"\n \\G1. valid_epda G1 \\\n (\\dh. ATS.derivation_initial epdaHS_initial_configurations\n epdaHS_step_relation G1 dh \\\n Ex (maximum_of_domain dh) \\\n (\\n. maximum_of_domain dh n \\\n (\\sUF'.\n sUF' \\ epda_effects G1 \\\n (\\dc. (\\dc'. ATS.derivation_initial\n epdaHS_initial_configurations\n epdaHS_step_relation G1\n (derivation_append\n (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@)\n epdaHS_set_unfixed_scheduler_DB epdaHS_get_unfixed_scheduler_DB G1 dh sUF'\n n)\n dc' n) \\\n Ex (maximum_of_domain\n (derivation_append\n (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@)\n epdaHS_set_unfixed_scheduler_DB epdaHS_get_unfixed_scheduler_DB G1 dh\n sUF' n)\n dc' n)) \\\n epdaHS2epdaS_derivation\n (derivation_append\n (ATS_SchedUF_DB.replace_unfixed_scheduler_DB right_quotient_word (@)\n epdaHS_set_unfixed_scheduler_DB epdaHS_get_unfixed_scheduler_DB G1 dh sUF'\n n)\n dc' n) =\n dc) \\\n (\\x\\n. epdaS_get_fixed_scheduler_DB G1\n(epdaHS2epdaS_derivation dh) x =\n epdaS_get_fixed_scheduler_DB G1 dc x \\\n ATS_SchedUF_DB.replace_unfixed_scheduler_DB\nright_quotient_word (@) epdaS_set_unfixed_scheduler_DB epdaS_get_unfixed_scheduler_DB G1\n(epdaHS2epdaS_derivation dh) (epdaS_get_unfixed_scheduler_DB G1 dc n) n x =\n dc x)))))\"\n apply(clarsimp)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(simp add: epdaS_get_fixed_scheduler_DB_def)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dh xa = Some (pair e c)\")\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(subgoal_tac \"n = x\")\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply (metis epdaHS.derivation_initial_is_derivation epdaHS.maximum_of_domainUnique)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(subgoal_tac \"\\e c. dh n = Some (pair e c)\")\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n prefer 2\n apply(rule epdaHS.some_position_has_details_before_max_dom)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(simp add: epdaHS.derivation_initial_def)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(subgoal_tac \"n = x\")\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(force)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply (metis epdaHS.derivation_initial_is_derivation epdaHS.maximum_of_domainUnique)\n apply(rename_tac G1 dh n x sUF' dc' xa xb)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 dh n x sUF' dc' xa xb e ea c ca)(*strict*)\n apply(simp add: epdaS.replace_unfixed_scheduler_DB_def)\n apply(simp add: epdaS.map_unfixed_scheduler_DB_def)\n apply(simp add: epdaHS2epdaS_derivation_def)\n apply(simp add: epdaS_get_scheduler_def epdaS_get_unfixed_scheduler_DB_def epdaS_set_unfixed_scheduler_DB_def get_configuration_def derivation_append_def)\n apply(simp add: epdaHS.replace_unfixed_scheduler_DB_def)\n apply(simp add: epdaHS.map_unfixed_scheduler_DB_def epdaHS_set_unfixed_scheduler_DB_def get_configuration_def epdaHS_get_unfixed_scheduler_DB_def epdaHS_get_scheduler_def)\n apply (metis right_quotient_word_full option.sel)\n done\n\nlemma epdaS_vs_epdaHS_inst_ATS_Bisimulation_Derivation_Strong2_axioms: \"\n ATS_Bisimulation_Derivation_Strong2_axioms valid_epda epdaS_initial_configurations\n epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_marked_effect\n epdaS_unmarked_effect epda_effects right_quotient_word (@)\n epda_unfixed_scheduler_extendable epdaS_set_unfixed_scheduler_DB\n epdaS_get_unfixed_scheduler_DB epdaS_get_fixed_scheduler_DB valid_epda\n epdaHS_initial_configurations epda_step_labels epdaHS_step_relation\n epdaHS_marking_condition epdaHS_marked_effect epdaHS_unmarked_effect epda_effects\n right_quotient_word (@) epda_unfixed_scheduler_extendable\n epdaHS_set_unfixed_scheduler_DB epdaHS_get_unfixed_scheduler_DB\n epdaHS_get_fixed_scheduler_DB epdaS_vs_epdaHS_TSstructure_rel epdaS_vs_epdaHS_effect_rel\n epdaS_vs_epdaHS_label_relation epdaS_vs_epdaHS_derivation_bisimulation \"\n apply(unfold ATS_Bisimulation_Derivation_Strong2_def ATS_Bisimulation_Derivation_Strong1_axioms_def ATS_Bisimulation_Derivation_Strong2_axioms_def )\n apply(simp add: epdaS_vs_epdaHS_inst_AX_AX_initial_contained1 epdaS_vs_epdaHS_inst_AX_AX_initial_contained2 epdaS_vs_epdaHS_inst_AX_on_derivation_initial1 epdaS_vs_epdaHS_inst_AX_on_finite1 epdaS_vs_epdaHS_inst_AX_equal_length epdaS_vs_epdaHS_inst_AX_simulate12 epdaS_vs_epdaHS_inst_AX_simulate21 )\n apply(simp add: epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_crop1 epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_crop2 )\n apply(simp add: epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_replace_and_schedF1 epdaS_vs_epdaHS_inst_AX_bisimulation_compatible_with_replace_and_schedF2 )\n apply(simp add: epdaS_vs_epdaHS_inst_AX_accept_id1 epdaS_vs_epdaHS_inst_AX_accept_id2 epdaS_vs_epdaHS_inst_AX_unAX_marked_effect_id1 epdaS_vs_epdaHS_inst_AX_unAX_marked_effect_id2 epdaS_vs_epdaHS_inst_AX_marked_effect_id1 epdaS_vs_epdaHS_inst_AX_marked_effect_id2 )\n apply(simp add: epdaS_vs_epdaHS_inst_AX_step_labels_exists2 epda_step_labels_def )\n done\n\ninterpretation \"epdaS_vs_epdaHS\" : ATS_Bisimulation_Derivation_Strong2\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* fixed_schedulers1 *)\n epda_fixed_schedulers\n (* empty_fixed_scheduler1 *)\n epda_empty_fixed_scheduler\n (* fixed_scheduler_extendable1 *)\n epda_fixed_scheduler_extendable\n (* scheduler_fragments1 *)\n \"epda_effects\"\n (* empty_scheduler_fragment1 *)\n epda_empty_scheduler_fragment\n (* join_scheduler_fragments1 *)\n \"append\"\n (* unfixed_schedulers1 *)\n \"epda_effects\"\n (* empty_unfixed_scheduler1 *)\n epda_empty_unfixed_scheduler\n (* unfixed_scheduler_right_quotient1 *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler1 *)\n \"append\"\n (* unfixed_scheduler_extendable1 *)\n epda_unfixed_scheduler_extendable\n (* schedulers1 *)\n \"epda_effects\"\n (* initial_schedulers1 *)\n \"epda_effects\"\n (* empty_scheduler1 *)\n epda_empty_scheduler\n (* get_scheduler1 *)\n \"epdaS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler1 *)\n \"append\"\n (* join_scheduler_fragments1_sched *)\n \"append\"\n (* set_unfixed_scheduler_DB1 *)\n \"epdaS_set_unfixed_scheduler_DB\"\n (* get_unfixed_scheduler_DB1 *)\n \"epdaS_get_unfixed_scheduler_DB\"\n (* get_fixed_scheduler_DB1 *)\n \"epdaS_get_fixed_scheduler_DB\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaHS_configurations\"\n (* initial_configurations2 *)\n \"epdaHS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaHS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaHS_marking_condition\"\n (* marked_effect2 *)\n \"epdaHS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaHS_unmarked_effect\"\n (* fixed_schedulers2 *)\n epda_fixed_schedulers\n (* empty_fixed_scheduler2 *)\n epda_empty_fixed_scheduler\n (* fixed_scheduler_extendable2 *)\n epda_fixed_scheduler_extendable\n (* scheduler_fragments2 *)\n \"epda_effects\"\n (* empty_scheduler_fragment2 *)\n epda_empty_scheduler_fragment\n (* join_scheduler_fragments2 *)\n \"append\"\n (* unfixed_schedulers2 *)\n \"epda_effects\"\n (* empty_unfixed_scheduler2 *)\n epda_empty_unfixed_scheduler\n (* unfixed_scheduler_right_quotient2 *)\n \"right_quotient_word\"\n (* extend_unfixed_scheduler2 *)\n \"append\"\n (* unfixed_scheduler_extendable2 *)\n epda_unfixed_scheduler_extendable\n (* schedulers2 *)\n \"epda_effects\"\n (* initial_schedulers2 *)\n \"epda_effects\"\n (* empty_scheduler2 *)\n epda_empty_scheduler\n (* get_scheduler2 *)\n \"epdaHS_get_scheduler\"\n (* join_fixed_scheduler_unfixed_scheduler2 *)\n \"append\"\n (* extend_scheduler2 *)\n \"append\"\n (* set_unfixed_scheduler_DB2 *)\n \"epdaHS_set_unfixed_scheduler_DB\"\n (* get_unfixed_scheduler_DB2 *)\n \"epdaHS_get_unfixed_scheduler_DB\"\n (* get_fixed_scheduler_DB2 *)\n \"epdaHS_get_fixed_scheduler_DB\"\n (* TSstructure_rel *)\n epdaS_vs_epdaHS_TSstructure_rel\n (* effect_rel *)\n epdaS_vs_epdaHS_effect_rel\n (* label_relation *)\n epdaS_vs_epdaHS_label_relation\n (* derivation_bisimulation *)\n epdaS_vs_epdaHS_derivation_bisimulation\n apply(simp add: LOCALE_DEFS epdaS_interpretations epdaHS_interpretations0 LOCALE_DEFS)\n apply(simp add: epdaS_vs_epdaHS_inst_ATS_Bisimulation_Derivation_Strong2_axioms)\n done\n\ntheorem epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer: \"\n valid_epda G\n \\ (epdaHS.Nonblockingness_linear_DB G \\ epdaS.Nonblockingness_linear_DB G)\n \\ epdaHS.unmarked_language G = epdaS.unmarked_language G\n \\ epdaHS.marked_language G = epdaS.marked_language G\"\n apply(rule conjI)\n apply(rule antisym)\n apply(clarsimp)\n apply(rule epdaS_vs_epdaHS.Nonblockingness_translation2)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule epdaS_vs_epdaHS.Nonblockingness_translation1)\n apply(force)\n apply(force)\n apply(rule conjI)\n apply(rule order_antisym)\n apply(rule_tac\n t = \"epdaHS.unmarked_language G\"\n and s = \"epdaHS.finite_unmarked_language G\"\n in ssubst)\n apply (metis epdaHS.AX_unmarked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_unmarked_language_translation2)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rule_tac\n t = \"epdaS.unmarked_language G\"\n and s = \"epdaS.finite_unmarked_language G\"\n in ssubst)\n apply (metis epdaS.AX_unmarked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_unmarked_language_translation1)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rule order_antisym)\n apply(rule_tac\n t = \"epdaHS.marked_language G\"\n and s = \"epdaHS.finite_marked_language G\"\n in ssubst)\n apply (metis epdaHS.AX_marked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_marked_language_translation2)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rule_tac\n t = \"epdaS.marked_language G\"\n and s = \"epdaS.finite_marked_language G\"\n in ssubst)\n apply (metis epdaS.AX_marked_language_finite)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rule epdaS_vs_epdaHS.ATS_Bisimulation_Derivation_Strong1_marked_language_translation1)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(force)\n done\n\ntheorem epdaS_vs_epdaHS_is_forward_deterministic_accessible_preserved: \"\n valid_epda G\n \\ epdaS.is_forward_deterministic_accessible G\n \\ epdaHS.is_forward_deterministic_accessible G\"\n apply(simp add: epdaS.is_forward_deterministic_accessible_def epdaHS.is_forward_deterministic_accessible_def)\n apply(rule conjI)\n apply(rule epdaHS_is_forward_target_deterministic_accessible)\n apply(force)\n apply(clarsimp)\n apply(rule epdaS_vs_epdaHS.preserve_FEdetermR1)\n apply(force)\n apply(force)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_07/I_epda_S_HS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.26424934071595463}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Step_Semantics\n imports Late_Tau_Chain\nbegin\n\ndefinition inputTransition :: \"pi \\ name \\ pi \\ name \\ name \\ pi \\ bool\" (\"_ \\\\<^sub>l_ in _\\_<_> \\ _\" [80, 80, 80, 80, 80] 80)\nwhere \"P \\\\<^sub>lu in P'' \\a \\ P' \\ \\P'''. P \\\\<^sub>\\ P''' \\ P''' \\a \\ P'' \\ P''[x::=u] \\\\<^sub>\\ P'\"\n\ndefinition transition :: \"(pi \\ Late_Semantics.residual) set\" where\n \"transition \\ {x. \\P P' \\ P'' P'''. P \\\\<^sub>\\ P' \\ P' \\\\ \\ P'' \\ P'' \\\\<^sub>\\ P''' \\ x = (P, \\ \\ P''')} \\\n {x. \\P P' a y P'' P'''. P \\\\<^sub>\\ P' \\ (P' \\(a<\\y> \\ P'')) \\ P'' \\\\<^sub>\\ P''' \\ x = (P, (a<\\y> \\ P'''))}\"\n\nabbreviation weakTransition_judge :: \"pi \\ Late_Semantics.residual \\ bool\" (\"_ \\\\<^sub>l _\" [80, 80] 80)\n where \"P \\\\<^sub>l Rs \\ (P, Rs) \\ transition\"\n\nlemma weakNonInput[dest]:\n fixes P :: pi\n and a :: name\n and x :: name\n and P' :: pi\n\n assumes \"P \\\\<^sub>la \\ P'\"\n \n shows False\nusing assms\nby(auto simp add: transition_def residual.inject)\n\nlemma transitionI:\n fixes P :: pi\n and P''' :: pi\n and \\ :: freeRes\n and P'' :: pi\n and P' :: pi\n and a :: name\n and x :: name\n and u :: name\n\n shows \"\\P \\\\<^sub>\\ P'''; P''' \\\\ \\ P''; P'' \\\\<^sub>\\ P'\\ \\ P \\\\<^sub>l\\ \\ P'\"\n and \"\\P \\\\<^sub>\\ P'''; P''' \\a<\\x> \\ P''; P'' \\\\<^sub>\\ P'\\ \\ P \\\\<^sub>la<\\x> \\ P'\"\n and \"\\P \\\\<^sub>\\ P'''; P''' \\a \\ P''; P''[x::=u] \\\\<^sub>\\ P'\\ \\ P \\\\<^sub>lu in P''\\a \\ P'\"\nproof -\n assume \"P \\\\<^sub>\\ P'''\" and \"P''' \\ \\ \\ P''\" and \"P'' \\\\<^sub>\\ P'\"\n thus \"P \\\\<^sub>l \\ \\ P'\"\n by(force simp add: transition_def)\nnext\n assume \"P \\\\<^sub>\\ P'''\" and \"P''' \\a<\\x> \\ P''\" and \"P'' \\\\<^sub>\\ P'\"\n thus \"P \\\\<^sub>la<\\x> \\ P'\"\n by(force simp add: transition_def)\nnext\n assume \"P \\\\<^sub>\\ P'''\" and \"P''' \\a \\ P''\" and \"P''[x::=u] \\\\<^sub>\\ P'\"\n thus \"P \\\\<^sub>lu in P''\\a \\ P'\" \n by(force simp add: inputTransition_def)\nqed\n\nlemma transitionE:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n and P'' :: pi\n and a :: name\n and u :: name\n and x :: name\n\n shows \"P \\\\<^sub>l\\ \\ P' \\ \\P'' P'''. P \\\\<^sub>\\ P'' \\ P'' \\\\ \\ P''' \\ P''' \\\\<^sub>\\ P'\" (is \"_ \\ ?thesis1\")\n and \"\\P \\\\<^sub>la<\\x> \\ P'; x \\ P\\ \\ \\P'' P'''. P \\\\<^sub>\\ P''' \\ P''' \\a<\\x> \\ P'' \\ P'' \\\\<^sub>\\ P'\"\n and \"\\P \\\\<^sub>lu in P''\\a \\ P'\\ \\ \\P'''. P \\\\<^sub>\\ P''' \\ P''' \\a \\ P'' \\ P''[x::=u] \\\\<^sub>\\ P'\"\nproof -\n assume \"P \\\\<^sub>l\\ \\ P'\"\n thus ?thesis1 by(auto simp add: transition_def residual.inject)\nnext\n assume \"P \\\\<^sub>la<\\x> \\ P'\" and \"x \\ P\"\n thus \"\\P'' P'''. P \\\\<^sub>\\ P''' \\ P''' \\a<\\x> \\ P'' \\ P'' \\\\<^sub>\\ P'\"\n using [[hypsubst_thin = true]]\n apply(auto simp add: transition_def residualInject name_abs_eq)\n apply(rule_tac x=\"[(x, y)] \\ P''\" in exI)\n apply(rule_tac x=P' in exI)\n apply(clarsimp)\n apply(auto)\n apply(subgoal_tac \"x \\ P''\")\n apply(simp add: alphaBoundResidual name_swap)\n using freshChain\n apply(force dest: freshBoundDerivative)\n using eqvtChainI\n by simp\nnext\n assume PTrans: \"P \\\\<^sub>lu in P''\\a \\ P'\"\n thus \"\\P'''. P \\\\<^sub>\\ P''' \\ P''' \\ a \\ P'' \\ P''[x::=u] \\\\<^sub>\\ P'\"\n by(auto simp add: inputTransition_def)\nqed\n\nlemma alphaInput:\n fixes P :: pi\n and u :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and y :: name\n\n assumes PTrans: \"P \\\\<^sub>lu in P''\\a \\ P'\"\n and yFreshP: \"y \\ P\"\n\n shows \"P \\\\<^sub>lu in ([(x, y)] \\ P'')\\a \\ P'\"\nproof(cases \"x=y\")\n assume \"x=y\"\n with PTrans show ?thesis by simp\nnext\n assume xineqy: \"x\\y\"\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain yFreshP have \"y \\ P'''\" by(rule freshChain)\n with P'''Trans xineqy have yFreshP'': \"y \\ P''\" by(blast dest: freshBoundDerivative)\n\n with P'''Trans have \"P''' \\a \\ [(x, y)] \\ P''\" by(simp add: alphaBoundResidual)\n moreover from P''Chain yFreshP'' have \"([(x, y)] \\ P'')[y::=u] \\\\<^sub>\\ P'\"\n by(simp add: renaming name_swap)\n ultimately show ?thesis using PChain by(blast intro: transitionI)\nqed\n\nlemma tauActionChain:\n fixes P :: pi\n and P' :: pi\n \n shows \"P \\\\<^sub>l\\ \\ P' \\ P \\\\<^sub>\\ P'\"\n and \"P \\ P' \\ P \\\\<^sub>\\ P' \\ P \\\\<^sub>l\\ \\ P'\"\nproof -\n assume \"P \\\\<^sub>l\\ \\ P'\"\n then obtain P'' P''' where \"P \\\\<^sub>\\ P''\"\n and \"P'' \\\\ \\ P'''\"\n and \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n thus \"P \\\\<^sub>\\ P'\" by auto\nnext\n assume \"P \\\\<^sub>\\ P'\" and \"P \\ P'\" \n thus \"P \\\\<^sub>l\\ \\ P'\"\n proof(induct rule: tauChainInduct)\n case id\n thus ?case by simp\n next\n case(ih P'' P''')\n have \"P \\\\<^sub>\\ P''\" and \"P'' \\ \\ \\ P'''\" by fact+\n moreover have \"P''' \\\\<^sub>\\ P'''\" by simp\n ultimately show ?case by(rule transitionI)\n qed\nqed\n\nlemma singleActionChain:\n fixes P :: pi\n and a :: name\n and x :: name\n and \\ :: freeRes\n and u :: name\n \n shows \"P \\a<\\x> \\ P' \\ P \\\\<^sub>la<\\x> \\ P'\"\n and \"\\P \\a \\ P'\\ \\ P \\\\<^sub>lu in P'\\a \\ P'[x::=u]\"\n and \"P \\\\ \\ P' \\ P \\\\<^sub>l\\ \\ P'\"\nproof - \n assume \"P \\a<\\x> \\ P'\"\n moreover have \"P \\\\<^sub>\\ P\" by simp\n moreover have \"P' \\\\<^sub>\\ P'\" by simp\n ultimately show \"P \\\\<^sub>la<\\x> \\ P'\" by(blast intro: transitionI)\nnext\n assume \"P \\a \\ P'\"\n moreover have \"P \\\\<^sub>\\ P\" by simp\n moreover have \"P'[x::=u] \\\\<^sub>\\ P'[x::=u]\" by simp\n ultimately show \"P \\\\<^sub>lu in P'\\a \\ P'[x::=u]\" by(blast intro: transitionI)\nnext\n assume \"P \\\\ \\ P'\"\n moreover have \"P \\\\<^sub>\\ P\" by simp\n moreover have \"P' \\\\<^sub>\\ P'\" by simp\n ultimately show \"P \\\\<^sub>l\\ \\ P'\" by(blast intro: transitionI)\nqed\n\nlemma Tau:\n fixes P :: pi\n\n shows \"\\.(P) \\\\<^sub>l \\ \\ P\"\nproof -\n have \"\\.(P) \\\\<^sub>\\ \\.(P)\" by simp\n moreover have \"\\.(P) \\\\ \\ P\" by(rule transitions.Tau)\n moreover have \"P \\\\<^sub>\\ P\" by simp\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Input:\n fixes a :: name\n and x :: name\n and u :: name\n and P :: pi\n\n shows \"a.P \\\\<^sub>lu in P\\a \\ P[x::=u]\"\nproof -\n have \"a.P \\\\<^sub>\\ a.P\" by simp\n moreover have \"a.P \\ a \\ P\" by(rule Input)\n moreover have \"P[x::=u] \\\\<^sub>\\ P[x::=u]\" by simp\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Output:\n fixes a :: name\n and b :: name\n and P :: pi\n\n shows \"a{b}.P \\\\<^sub>la[b] \\ P\"\nproof -\n have \"a{b}.P \\\\<^sub>\\ a{b}.P\" by simp\n moreover have \"a{b}.P \\a[b] \\ P\" by(rule transitions.Output)\n moreover have \"P \\\\<^sub>\\ P\" by simp\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Match:\n fixes P :: pi\n and Rs :: residual\n and a :: name\n and u :: name\n and b :: name\n and x :: name\n and P' :: pi\n\n shows \"P \\\\<^sub>l Rs \\ [a\\a]P \\\\<^sub>l Rs\"\n and \"P \\\\<^sub>lu in P''\\b \\ P' \\ [a\\a]P \\\\<^sub>lu in P''\\b \\ P'\"\nproof -\n assume PTrans: \"P \\\\<^sub>l Rs\"\n thus \"[a\\a]P \\\\<^sub>l Rs\"\n proof(nominal_induct avoiding: P rule: residual.strong_inducts)\n case(BoundR b x P')\n have PTrans: \"P \\\\<^sub>l b\\x\\ \\ P'\" and xFreshP: \"x \\ P\" by fact+\n from PTrans obtain b' where beq: \"b = BoundOutputS b'\" by(cases b) auto\n with PTrans xFreshP obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\b'<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"[a\\a]P \\\\<^sub>\\ [a\\a]P\" by simp\n moreover from P''Trans have \"[a\\a]P'' \\ b'<\\x> \\ P'''\" by(rule Match)\n ultimately show ?thesis using beq P'''Trans by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans have \"[a\\a]P \\\\<^sub>\\ P''\" by(rule matchChain)\n thus ?thesis using beq P''Trans P'''Trans by(blast intro: transitionI)\n qed\n next\n case(FreeR \\ P')\n have \"P \\\\<^sub>l \\ \\ P'\" by fact\n\n then obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\ \\ \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"[a\\a]P \\\\<^sub>\\ [a\\a]P\" by simp\n moreover from P''Trans have \"[a\\a]P'' \\ \\ \\ P'''\" by(rule transitions.Match)\n ultimately show ?thesis using P'''Trans by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans have \"[a\\a]P \\\\<^sub>\\ P''\" by(rule matchChain)\n thus ?thesis using P''Trans P'''Trans by(rule transitionI)\n qed\n qed\nnext\n assume \"P \\\\<^sub>lu in P''\\b \\ P'\"\n then obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\b \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show \"[a\\a]P \\\\<^sub>lu in P''\\b \\ P'\"\n proof(cases \"P=P'''\")\n assume \"P=P'''\"\n moreover have \"[a\\a]P \\\\<^sub>\\ [a\\a]P\" by simp\n moreover from P'''Trans have \"[a\\a]P''' \\b \\ P''\" by(rule Late_Semantics.Match)\n ultimately show ?thesis using P''Chain by(blast intro: transitionI)\n next\n assume \"P \\ P'''\"\n with PChain have \"[a\\a]P \\\\<^sub>\\ P'''\" by(rule matchChain)\n thus ?thesis using P'''Trans P''Chain by(rule transitionI)\n qed\nqed\n\nlemma Mismatch:\n fixes P :: pi\n and Rs :: residual\n and a :: name\n and c :: name\n and u :: name\n and b :: name\n and x :: name\n and P' :: pi\n\n shows \"\\P \\\\<^sub>l Rs; a \\ c\\ \\ [a\\c]P \\\\<^sub>l Rs\"\n and \"\\P \\\\<^sub>lu in P''\\b \\ P'; a \\ c\\ \\ [a\\c]P \\\\<^sub>lu in P''\\b \\ P'\"\nproof -\n assume PTrans: \"P \\\\<^sub>l Rs\"\n and aineqc: \"a \\ c\"\n thus \"[a\\c]P \\\\<^sub>l Rs\"\n proof(nominal_induct avoiding: P rule: residual.strong_inducts)\n case(BoundR b x P')\n have PTrans: \"P \\\\<^sub>l b\\x\\ \\ P'\" and xFreshP: \"x \\ P\" by fact+\n from PTrans obtain b' where beq: \"b = BoundOutputS b'\" by(cases b, auto)\n with PTrans xFreshP obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\b'<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"[a\\c]P \\\\<^sub>\\ [a\\c]P\" by simp\n moreover from P''Trans aineqc have \"[a\\c]P'' \\b'<\\x> \\ P'''\" by(rule transitions.Mismatch)\n ultimately show ?thesis using beq P'''Trans by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans aineqc have \"[a\\c]P \\\\<^sub>\\ P''\" by(rule mismatchChain)\n thus ?thesis using beq P''Trans P'''Trans by(blast intro: transitionI)\n qed\n next\n case(FreeR \\ P')\n have \"P \\\\<^sub>l \\ \\ P'\" by fact\n\n then obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\ \\ \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"[a\\c]P \\\\<^sub>\\ [a\\c]P\" by simp\n moreover from P''Trans \\a \\ c\\ have \"[a\\c]P'' \\ \\ \\ P'''\" by(rule transitions.Mismatch)\n ultimately show ?thesis using P'''Trans by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans aineqc have \"[a\\c]P \\\\<^sub>\\ P''\" by(rule mismatchChain)\n thus ?thesis using P''Trans P'''Trans by(rule transitionI)\n qed\n qed\nnext\n assume aineqc: \"a \\ c\"\n assume \"P \\\\<^sub>lu in P''\\b \\ P'\"\n then obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\b \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show \"[a\\c]P \\\\<^sub>lu in P''\\b \\ P'\"\n proof(cases \"P=P'''\")\n assume \"P=P'''\"\n moreover have \"[a\\c]P \\\\<^sub>\\ [a\\c]P\" by simp\n moreover from P'''Trans aineqc have \"[a\\c]P''' \\b \\ P''\" by(rule Late_Semantics.Mismatch)\n ultimately show ?thesis using P''Chain by(blast intro: transitionI)\n next\n assume \"P \\ P'''\"\n with PChain aineqc have \"[a\\c]P \\\\<^sub>\\ P'''\" by(rule mismatchChain)\n thus ?thesis using P'''Trans P''Chain by(rule transitionI)\n qed\nqed\n\nlemma Open:\n fixes P :: pi\n and a :: name\n and b :: name\n and P' :: pi\n\n assumes Trans: \"P \\\\<^sub>la[b] \\ P'\"\n and aInEqb: \"a \\ b\"\n\n shows \"<\\b>P \\\\<^sub>la<\\b> \\ P'\"\nproof -\n from Trans obtain P'' P''' where A: \"P \\\\<^sub>\\ P''\"\n and B: \"P'' \\a[b] \\ P'''\"\n and C: \"P''' \\\\<^sub>\\ P'\"\n by(force dest: transitionE)\n from A have \"<\\b>P \\\\<^sub>\\ <\\b>P''\" by(rule ResChain)\n moreover from B aInEqb have \"<\\b>P'' \\a<\\b> \\ P'''\" by(rule Open)\n ultimately show ?thesis using C by(force simp add: transition_def)\nqed\n\nlemma Sum1:\n fixes P :: pi\n and Rs :: residual\n and Q :: pi\n and u :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n\n shows \"P \\\\<^sub>l Rs \\ P \\ Q \\\\<^sub>l Rs\"\n and \"P \\\\<^sub>lu in P''\\a \\ P' \\ P \\ Q \\\\<^sub>lu in P''\\a \\ P'\"\nproof -\n assume \"P \\\\<^sub>l Rs\"\n thus \"P \\ Q \\\\<^sub>l Rs\"\n proof(nominal_induct avoiding: P rule: residual.strong_inducts)\n case(BoundR a x P' P)\n have PTrans: \"P \\\\<^sub>la\\x\\ \\ P'\"\n and xFreshP: \"x \\ P\" by fact+\n from PTrans obtain a' where aeq: \"a = BoundOutputS a'\" by(cases a, auto)\n with PTrans xFreshP obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a'<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from P''Trans have \"P'' \\ Q \\a'<\\x> \\ P'''\" by(rule transitions.Sum1)\n ultimately show ?thesis using P'''Trans aeq by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans have \"P \\ Q \\\\<^sub>\\ P''\" by(rule sum1Chain)\n thus ?thesis using P''Trans P'''Trans aeq by(blast intro: transitionI)\n qed\n next\n case(FreeR \\ P')\n have \"P \\\\<^sub>l \\ \\ P'\" by fact\n\n then obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\ \\ \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"P = P''\")\n assume \"P = P''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from P''Trans have \"P'' \\ Q \\ \\ \\ P'''\" by(rule transitions.Sum1)\n ultimately show ?thesis using P'''Trans by(blast intro: transitionI)\n next\n assume \"P \\ P''\"\n with PTrans have \"P \\ Q \\\\<^sub>\\ P''\" by(rule sum1Chain)\n thus ?thesis using P''Trans P'''Trans by(rule transitionI)\n qed\n qed\nnext\n assume \"P \\\\<^sub>lu in P''\\a \\ P'\"\n then obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n show \"P \\ Q \\\\<^sub>lu in P''\\a \\ P'\"\n proof(cases \"P = P'''\")\n assume \"P = P'''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from P'''Trans have \"P''' \\ Q \\a \\ P''\" by(rule transitions.Sum1)\n ultimately show ?thesis using P''Chain by(blast intro: transitionI)\n next\n assume \"P \\ P'''\"\n with PChain have \"P \\ Q \\\\<^sub>\\ P'''\" by(rule sum1Chain)\n thus ?thesis using P'''Trans P''Chain by(blast intro: transitionI)\n qed\nqed\n\nlemma Sum2:\n fixes Q :: pi\n and Rs :: residual\n and P :: pi\n and u :: name\n and Q'' :: pi\n and a :: name\n and x :: name\n and Q' :: pi\n\n shows \"Q \\\\<^sub>l Rs \\ P \\ Q \\\\<^sub>l Rs\"\n and \"Q \\\\<^sub>lu in Q''\\a \\ Q' \\ P \\ Q \\\\<^sub>lu in Q''\\a \\ Q'\"\nproof -\n assume \"Q \\\\<^sub>l Rs\"\n thus \"P \\ Q \\\\<^sub>l Rs\"\n proof(nominal_induct avoiding: Q rule: residual.strong_inducts)\n case(BoundR a x Q' Q)\n have QTrans: \"Q \\\\<^sub>la\\x\\ \\ Q'\"\n and xFreshQ: \"x \\ Q\" by fact+\n from QTrans obtain a' where aeq: \"a = BoundOutputS a'\" by(cases a, auto)\n with QTrans xFreshQ obtain Q'' Q''' where QTrans: \"Q \\\\<^sub>\\ Q''\"\n and Q''Trans: \"Q'' \\a'<\\x> \\ Q'''\"\n and Q'''Trans: \"Q''' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"Q = Q''\")\n assume \"Q = Q''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from Q''Trans have \"P \\ Q'' \\a'<\\x> \\ Q'''\" by(rule transitions.Sum2)\n ultimately show ?thesis using Q'''Trans aeq by(blast intro: transitionI)\n next\n assume \"Q \\ Q''\"\n with QTrans have \"P \\ Q \\\\<^sub>\\ Q''\" by(rule sum2Chain)\n thus ?thesis using Q''Trans Q'''Trans aeq by(blast intro: transitionI)\n qed\n next\n case(FreeR \\ Q')\n have \"Q \\\\<^sub>l \\ \\ Q'\" by fact\n\n then obtain Q'' Q''' where QTrans: \"Q \\\\<^sub>\\ Q''\"\n and Q''Trans: \"Q'' \\ \\ \\ Q'''\"\n and Q'''Trans: \"Q''' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n show ?case\n proof(cases \"Q = Q''\")\n assume \"Q = Q''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from Q''Trans have \"P \\ Q'' \\ \\ \\ Q'''\" by(rule transitions.Sum2)\n ultimately show ?thesis using Q'''Trans by(blast intro: transitionI)\n next\n assume \"Q \\ Q''\"\n with QTrans have \"P \\ Q \\\\<^sub>\\ Q''\" by(rule sum2Chain)\n thus ?thesis using Q''Trans Q'''Trans by(rule transitionI)\n qed\n qed\nnext\n assume \"Q \\\\<^sub>lu in Q''\\a \\ Q'\"\n then obtain Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a \\ Q''\"\n and Q''Chain: \"Q''[x::=u] \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n show \"P \\ Q \\\\<^sub>lu in Q''\\a \\ Q'\"\n proof(cases \"Q = Q'''\")\n assume \"Q = Q'''\"\n moreover have \"P \\ Q \\\\<^sub>\\ P \\ Q\" by simp\n moreover from Q'''Trans have \"P \\ Q''' \\a \\ Q''\" by(rule transitions.Sum2)\n ultimately show ?thesis using Q''Chain by(blast intro: transitionI)\n next\n assume \"Q \\ Q'''\"\n with QChain have \"P \\ Q \\\\<^sub>\\ Q'''\" by(rule sum2Chain)\n thus ?thesis using Q'''Trans Q''Chain by(blast intro: transitionI)\n qed\nqed\n\nlemma Par1B:\n fixes P :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and u :: name\n and P'' :: pi\n\n shows \"\\P \\\\<^sub>la<\\x> \\ P'; x \\ Q\\ \\ P \\ Q \\\\<^sub>la<\\x> \\ (P' \\ Q)\"\n and \"\\P \\\\<^sub>lu in P''\\a \\ P'; x \\ Q\\ \\ P \\ Q \\\\<^sub>lu in (P'' \\ Q)\\a \\ P' \\ Q\"\nproof -\n assume PTrans: \"P \\\\<^sub>l a<\\x> \\ P'\"\n assume xFreshQ: \"x \\ Q\"\n\n have Goal: \"\\P a x P' Q. \\P \\\\<^sub>la<\\x> \\ P'; x \\ P; x \\ Q\\ \\ P \\ Q \\\\<^sub>la<\\x> \\ (P' \\ Q)\"\n proof -\n fix P a x P' Q\n assume PTrans: \"P \\\\<^sub>la<\\x> \\ P'\"\n assume xFreshP: \"x \\ P\"\n assume xFreshQ: \"x \\ (Q::pi)\"\n\n from PTrans xFreshP obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from PTrans have \"P \\ Q \\\\<^sub>\\ P'' \\ Q\" by(rule Par1Chain)\n moreover from P''Trans xFreshQ have \"P'' \\ Q \\a<\\x> \\ (P''' \\ Q)\" by(rule Par1B)\n moreover from P'''Trans have \"P''' \\ Q \\\\<^sub>\\ P' \\ Q\" by(rule Par1Chain)\n ultimately show \"P \\ Q \\\\<^sub>la<\\x> \\ (P' \\ Q)\" by(rule transitionI)\n qed\n \n have \"\\c::name. c \\ (P, P', Q)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshP: \"c \\ P\" and cFreshP': \"c \\ P'\" and cFreshQ: \"c \\ Q\"\n by(force simp add: fresh_prod)\n\n from cFreshP' have \"a<\\x> \\ P' = a<\\c> \\ ([(x, c)] \\ P')\" by(rule alphaBoundResidual)\n moreover have \"a<\\x> \\ (P' \\ Q) = a<\\c> \\ (([(x, c)] \\ P') \\ Q)\"\n proof -\n from cFreshP' cFreshQ have \"c \\ P' \\ Q\" by simp\n hence \"a<\\x> \\ (P' \\ Q) = a<\\c> \\ ([(x, c)] \\ (P' \\ Q))\" by(rule alphaBoundResidual)\n with cFreshQ xFreshQ show ?thesis by(simp add: name_fresh_fresh)\n qed\n ultimately show \"P \\ Q \\\\<^sub>l a<\\x> \\ P' \\ Q\" using PTrans cFreshP cFreshQ by(force intro: Goal)\nnext\n assume PTrans: \"P \\\\<^sub>lu in P''\\a \\ P'\"\n and xFreshQ: \"x \\ Q\"\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from PChain have \"P \\ Q \\\\<^sub>\\ P''' \\ Q\" by(rule Par1Chain)\n moreover from P'''Trans xFreshQ have \"P''' \\ Q \\a \\ (P'' \\ Q)\" by(rule Par1B)\n moreover have \"(P'' \\ Q)[x::=u] \\\\<^sub>\\ P' \\ Q\"\n proof - \n from P''Chain have \"P''[x::=u] \\ Q \\\\<^sub>\\ P' \\ Q\" by(rule Par1Chain)\n with xFreshQ show ?thesis by(simp add: forget)\n qed\n ultimately show \"P \\ Q \\\\<^sub>lu in (P'' \\ Q)\\a \\ (P' \\ Q)\" by(rule transitionI)\nqed\n\nlemma Par1F:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n\n assumes PTrans: \"P \\\\<^sub>l\\ \\ P'\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ (P' \\ Q)\"\nproof -\n from PTrans obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\\\ \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from PTrans have \"P \\ Q \\\\<^sub>\\ P'' \\ Q\" by(rule Par1Chain)\n moreover from P''Trans have \"P'' \\ Q \\\\ \\ (P''' \\ Q)\" by(rule transitions.Par1F)\n moreover from P'''Trans have \"P''' \\ Q \\\\<^sub>\\ P' \\ Q\" by(rule Par1Chain)\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Par2B:\n fixes Q :: pi\n and a :: name\n and x :: name\n and Q' :: pi\n and P :: pi\n and u :: name\n and Q'' :: pi\n\n shows \"Q \\\\<^sub>la<\\x> \\ Q' \\ x \\ P \\ P \\ Q \\\\<^sub>la<\\x> \\ (P \\ Q')\"\n and \"Q \\\\<^sub>lu in Q''\\a \\ Q' \\ x \\ P \\ P \\ Q \\\\<^sub>lu in (P \\ Q'')\\a \\ P \\ Q'\"\nproof -\n assume QTrans: \"Q \\\\<^sub>l a<\\x> \\ Q'\"\n assume xFreshP: \"x \\ P\"\n\n have Goal: \"\\Q a x Q' P. \\Q \\\\<^sub>la<\\x> \\ Q'; x \\ Q; x \\ P\\ \\ P \\ Q \\\\<^sub>la<\\x> \\ (P \\ Q')\"\n proof -\n fix Q a x Q' P\n assume QTrans: \"Q \\\\<^sub>la<\\x> \\ Q'\"\n assume xFreshQ: \"x \\ Q\"\n assume xFreshP: \"x \\ (P::pi)\"\n\n from QTrans xFreshQ obtain Q'' Q''' where QTrans: \"Q \\\\<^sub>\\ Q''\"\n and Q''Trans: \"Q'' \\a<\\x> \\ Q'''\"\n and Q'''Trans: \"Q''' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n from QTrans have \"P \\ Q \\\\<^sub>\\ P \\ Q''\" by(rule Par2Chain)\n moreover from Q''Trans xFreshP have \"P \\ Q'' \\a<\\x> \\ (P \\ Q''')\" by(rule Par2B)\n moreover from Q'''Trans have \"P \\ Q''' \\\\<^sub>\\ P \\ Q'\" by(rule Par2Chain)\n ultimately show \"P \\ Q \\\\<^sub>la<\\x> \\ (P \\ Q')\" by(rule transitionI)\n qed\n \n have \"\\c::name. c \\ (Q, Q', P)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshQ: \"c \\ Q\" and cFreshQ': \"c \\ Q'\" and cFreshP: \"c \\ P\"\n by(force simp add: fresh_prod)\n\n from cFreshQ' have \"a<\\x> \\ Q' = a<\\c> \\ ([(x, c)] \\ Q')\" by(rule alphaBoundResidual)\n moreover have \"a<\\x> \\ (P \\ Q') = a<\\c> \\ (P \\ ([(x, c)] \\ Q'))\"\n proof -\n from cFreshQ' cFreshP have \"c \\ P \\ Q'\" by simp\n hence \"a<\\x> \\ (P \\ Q') = a<\\c> \\ ([(x, c)] \\ (P \\ Q'))\" by(rule alphaBoundResidual)\n with cFreshP xFreshP show ?thesis by(simp add: name_fresh_fresh)\n qed\n ultimately show \"P \\ Q \\\\<^sub>l a<\\x> \\ P \\ Q'\" using QTrans cFreshQ cFreshP by(force intro: Goal)\nnext\n assume QTrans: \"Q \\\\<^sub>lu in Q''\\a \\ Q'\"\n and xFreshP: \"x \\ P\"\n from QTrans obtain Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a \\ Q''\"\n and Q''Chain: \"Q''[x::=u] \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n from QChain have \"P \\ Q \\\\<^sub>\\ P \\ Q'''\" by(rule Par2Chain)\n moreover from Q'''Trans xFreshP have \"P \\ Q''' \\a \\ (P \\ Q'')\" by(rule Par2B)\n moreover have \"(P \\ Q'')[x::=u] \\\\<^sub>\\ P \\ Q'\"\n proof - \n from Q''Chain have \"P \\ (Q''[x::=u]) \\\\<^sub>\\ P \\ Q'\" by(rule Par2Chain)\n with xFreshP show ?thesis by(simp add: forget)\n qed\n ultimately show \"P \\ Q \\\\<^sub>lu in (P \\ Q'')\\a \\ (P \\ Q')\" by(rule transitionI)\nqed\n\nlemma Par2F:\n fixes Q :: pi\n and \\ :: freeRes\n and Q' :: pi\n\n assumes QTrans: \"Q \\\\<^sub>l\\ \\ Q'\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ (P \\ Q')\"\nproof -\n from QTrans obtain Q'' Q''' where QTrans: \"Q \\\\<^sub>\\ Q''\"\n and Q''Trans: \"Q'' \\\\ \\ Q'''\"\n and Q'''Trans: \"Q''' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n from QTrans have \"P \\ Q \\\\<^sub>\\ P \\ Q''\" by(rule Par2Chain)\n moreover from Q''Trans have \"P \\ Q'' \\\\ \\ (P \\ Q''')\" by(rule transitions.Par2F)\n moreover from Q'''Trans have \"P \\ Q''' \\\\<^sub>\\ P \\ Q'\" by(rule Par2Chain)\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Comm1:\n fixes P :: pi\n and b :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and Q :: pi\n and Q' :: pi\n \n assumes PTrans: \"P \\\\<^sub>lb in P'' \\a \\ P'\"\n and QTrans: \"Q \\\\<^sub>la[b] \\ Q'\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ P' \\ Q'\"\nproof -\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=b] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from QTrans obtain Q'' Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a[b] \\ Q''\"\n and Q''Chain: \"Q'' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n\n from PChain QChain have \"P \\ Q \\\\<^sub>\\ P''' \\ Q'''\" by(rule chainPar)\n moreover from P'''Trans Q'''Trans have \"P''' \\ Q''' \\\\ \\ P''[x::=b] \\ Q''\"\n by(rule Comm1)\n moreover from P''Chain Q''Chain have \"P''[x::=b] \\ Q'' \\\\<^sub>\\ P' \\ Q'\" by(rule chainPar)\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Comm2:\n fixes P :: pi\n and a :: name\n and b :: name\n and P' :: pi\n and Q :: pi\n and x :: name\n and Q'' :: pi\n and Q' :: pi\n \n assumes PTrans: \"P \\\\<^sub>la[b] \\ P'\"\n and QTrans: \"Q \\\\<^sub>lb in Q''\\a \\ Q'\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ P' \\ Q'\"\nproof -\n from PTrans obtain P'' P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a[b] \\ P''\"\n and P''Chain: \"P'' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from QTrans obtain Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a \\ Q''\"\n and Q''Chain: \"Q''[x::=b] \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n\n from PChain QChain have \"P \\ Q \\\\<^sub>\\ P''' \\ Q'''\" by(rule chainPar)\n moreover from P'''Trans Q'''Trans have \"P''' \\ Q''' \\\\ \\ P'' \\ (Q''[x::=b])\"\n by(rule Comm2)\n moreover from P''Chain Q''Chain have \"P'' \\ (Q''[x::=b]) \\\\<^sub>\\ P' \\ Q'\" by(rule chainPar)\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma Close1:\n fixes P :: pi\n and y :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and Q :: pi\n and Q' :: pi\n \n assumes PTrans: \"P \\\\<^sub>ly in P''\\a \\ P'\"\n and QTrans: \"Q \\\\<^sub>la<\\y> \\ Q'\"\n and yFreshP: \"y \\ P\"\n and yFreshQ: \"y \\ Q\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ <\\y>(P' \\ Q')\"\nproof -\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=y] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n from QTrans yFreshQ obtain Q'' Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a<\\y> \\ Q''\"\n and Q''Chain: \"Q'' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n \n from PChain yFreshP have yFreshP''': \"y \\ P'''\" by(rule freshChain)\n \n from PChain QChain have \"P \\ Q \\\\<^sub>\\ P''' \\ Q'''\" by(rule chainPar)\n moreover from P'''Trans Q'''Trans yFreshP''' have \"P''' \\ Q''' \\\\ \\ <\\y>(P''[x::=y] \\ Q'')\"\n by(rule Close1)\n moreover have \"<\\y>(P''[x::=y] \\ Q'') \\\\<^sub>\\ <\\y>(P' \\ Q')\"\n proof -\n from P''Chain Q''Chain have \"P''[x::=y] \\ Q'' \\\\<^sub>\\ P' \\ Q'\" by(rule chainPar)\n thus ?thesis by(rule ResChain)\n qed\n ultimately show \"P \\ Q \\\\<^sub>l\\ \\ <\\y>(P' \\ Q')\" by(rule transitionI)\nqed\n\nlemma Close2:\n fixes P :: pi\n and y :: name\n and a :: name\n and x :: name\n and P' :: pi\n and Q :: pi\n and Q'' :: pi\n and Q' :: pi\n \n assumes PTrans: \"P \\\\<^sub>la<\\y> \\ P'\"\n and QTrans: \"Q \\\\<^sub>ly in Q''\\a \\ Q'\"\n and yFreshP: \"y \\ P\"\n and yFreshQ: \"y \\ Q\"\n\n shows \"P \\ Q \\\\<^sub>l\\ \\ <\\y>(P' \\ Q')\"\nproof -\n from PTrans yFreshP obtain P'' P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a<\\y> \\ P''\"\n and P''Chain: \"P'' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from QTrans obtain Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a \\ Q''\"\n and Q''Chain: \"Q''[x::=y] \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n \n from QChain yFreshQ have yFreshQ''': \"y \\ Q'''\" by(rule freshChain)\n \n from PChain QChain have \"P \\ Q \\\\<^sub>\\ P''' \\ Q'''\" by(rule chainPar)\n moreover from P'''Trans Q'''Trans yFreshQ''' have \"P''' \\ Q''' \\\\ \\ <\\y>(P'' \\ (Q''[x::=y]))\"\n by(rule Close2)\n moreover have \"<\\y>(P'' \\ (Q''[x::=y])) \\\\<^sub>\\ <\\y>(P' \\ Q')\"\n proof -\n from P''Chain Q''Chain have \"P'' \\ (Q''[x::=y]) \\\\<^sub>\\ P' \\ Q'\" by(rule chainPar)\n thus ?thesis by(rule ResChain)\n qed\n ultimately show \"P \\ Q \\\\<^sub>l\\ \\ <\\y>(P' \\ Q')\" by(rule transitionI)\nqed\n\nlemma ResF:\n fixes P :: pi\n and \\ :: freeRes\n and P' :: pi\n and x :: name\n\n assumes PTrans: \"P \\\\<^sub>l\\ \\ P'\"\n and xFreshAlpha: \"x \\ \\\"\n\n shows \"<\\x>P \\\\<^sub>l\\ \\ <\\x>P'\"\nproof -\n from PTrans obtain P'' P''' where PChain: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\\\ \\ P'''\"\n and P'''Chain: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain have \"<\\x>P \\\\<^sub>\\ <\\x>P''\" by(rule ResChain)\n moreover from P''Trans xFreshAlpha have \"<\\x>P'' \\\\ \\ <\\x>P'''\"\n by(rule transitions.ResF)\n moreover from P'''Chain have \"<\\x>P''' \\\\<^sub>\\ <\\x>P'\" by(rule ResChain)\n ultimately show ?thesis by(rule transitionI)\nqed\n\nlemma ResB:\n fixes P :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and y :: name\n and u :: name\n and P'' :: pi\n\n shows \"\\P \\\\<^sub>la<\\x> \\ P'; y \\ a; y \\ x; x \\ P\\ \\ <\\y>P \\\\<^sub>la<\\x> \\ (<\\y>P')\"\n and \"\\P \\\\<^sub>lu in P''\\a \\ P'; y \\ a; y \\ x; y \\ u\\ \\ <\\y>P \\\\<^sub>lu in (<\\y>P'')\\a \\ (<\\y>P')\"\nproof -\n assume PTrans: \"P \\\\<^sub>la<\\x> \\ P'\"\n and yineqa: \"y \\ a\"\n and yineqx: \"y \\ x\"\n and xFreshP: \"x \\ P\"\n\n from PTrans xFreshP obtain P'' P''' where PChain: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a<\\x> \\ P'''\"\n and P'''Chain: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain have \"<\\y>P \\\\<^sub>\\ <\\y>P''\" by(rule ResChain)\n moreover from P''Trans yineqa yineqx have \"<\\y>P'' \\a<\\x> \\ (<\\y>P''')\"\n by(force intro: ResB)\n moreover from P'''Chain have \"<\\y>P''' \\\\<^sub>\\ <\\y>P'\" by(rule ResChain)\n ultimately show \"<\\y>P \\\\<^sub>l a<\\x> \\ <\\y>P'\" by(rule transitionI)\nnext\n assume PTrans: \"P \\\\<^sub>lu in P''\\a \\ P'\"\n and yineqa: \"y \\ a\"\n and yineqx: \"y \\ x\"\n and yinequ: \"y \\ u\" \n\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain have \"<\\y>P \\\\<^sub>\\ <\\y>P'''\" by(rule ResChain)\n moreover from P'''Trans yineqa yineqx have \"<\\y>P''' \\a \\ (<\\y>P'')\"\n by(force intro: ResB)\n moreover have \"(<\\y>P'')[x::=u] \\\\<^sub>\\ <\\y>P'\"\n proof -\n from P''Chain have \"<\\y>(P''[x::=u]) \\\\<^sub>\\ <\\y>P'\" by(rule ResChain)\n with yineqx yinequ show ?thesis by(simp add: eqvt_subs[THEN sym])\n qed\n ultimately show \"<\\y>P \\\\<^sub>lu in (<\\y>P'')\\a \\ <\\y>P'\" by(rule transitionI)\nqed\n\nlemma Bang:\n fixes P :: pi\n and Rs :: residual\n and u :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n\n shows \"P \\ !P \\\\<^sub>l Rs \\ !P \\\\<^sub>l Rs\"\n and \"P \\ !P \\\\<^sub>lu in P''\\a \\ P' \\ !P \\\\<^sub>lu in P''\\a \\ P'\"\nproof -\n assume \"P \\ !P \\\\<^sub>l Rs\"\n thus \"!P \\\\<^sub>l Rs\"\n proof(nominal_induct avoiding: P rule: residual.strong_inducts)\n case(BoundR a x P' P)\n assume xFreshP: \"x \\ P\"\n assume PTrans: \"P \\ !P \\\\<^sub>la\\x\\ \\ P'\"\n from PTrans obtain a' where aeq: \"a = BoundOutputS a'\" by(cases a, auto)\n\n with PTrans xFreshP obtain P'' P''' where PChain: \"P \\ !P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a'<\\x> \\ P'''\"\n and P'''Chain: \"P''' \\\\<^sub>\\ P'\"\n by(force dest: transitionE)\n\n show \"!P \\\\<^sub>la\\x\\ \\ P'\"\n proof(cases \"P'' = P \\ !P\")\n assume \"P'' = P \\ !P\"\n moreover with P''Trans have \"!P \\a'<\\x> \\ P'''\" by(blast intro: transitions.Bang)\n ultimately show ?thesis using PChain P'''Chain aeq by(simp, rule_tac transitionI, auto)\n next\n assume \"P'' \\ P \\ !P\"\n with PChain have \"!P \\\\<^sub>\\ P''\" by(rule bangChain)\n with P''Trans P'''Chain aeq show ?thesis by(blast intro: transitionI)\n qed\n next\n fix \\ P' P\n assume \"P \\ !P \\\\<^sub>l\\ \\ P'\"\n \n then obtain P'' P''' where PChain: \"P \\ !P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\\\ \\ P'''\"\n and P'''Chain: \"P''' \\\\<^sub>\\ P'\"\n by(force dest: transitionE)\n\n\n show \"!P \\\\<^sub>l\\ \\ P'\"\n proof(cases \"P'' = P \\ !P\")\n assume \"P'' = P \\ !P\"\n moreover with P''Trans have \"!P \\\\ \\ P'''\" by(blast intro: transitions.Bang)\n ultimately show ?thesis using PChain P'''Chain by(rule_tac transitionI, auto)\n next\n assume \"P'' \\ P \\ !P\"\n with PChain have \"!P \\\\<^sub>\\ P''\" by(rule bangChain)\n with P''Trans P'''Chain show ?thesis by(blast intro: transitionI)\n qed\n qed\nnext\n assume \"P \\ !P \\\\<^sub>lu in P''\\a \\ P'\"\n\n then obtain P''' where PChain: \"P \\ !P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(force dest: transitionE)\n \n show \"!P \\\\<^sub>lu in P''\\a \\ P'\"\n proof(cases \"P''' = P \\ !P\")\n assume \"P''' = P \\ !P\"\n moreover with P'''Trans have \"!P \\a \\ P''\" by(blast intro: transitions.Bang)\n ultimately show ?thesis using PChain P''Chain by(rule_tac transitionI, auto)\n next\n assume \"P''' \\ P \\ !P\"\n with PChain have \"!P \\\\<^sub>\\ P'''\" by(rule bangChain)\n with P'''Trans P''Chain show ?thesis by(blast intro: transitionI)\n qed\nqed\n\nlemma tauTransitionChain:\n fixes P :: pi\n and P' :: pi\n\n assumes \"P \\\\<^sub>l\\ \\ P'\"\n\n shows \"P \\\\<^sub>\\ P'\"\nusing assms\nby(auto simp add: transition_def residualInject)\n\nlemma chainTransitionAppend:\n fixes P :: pi\n and P' :: pi\n and Rs :: residual\n and a :: name\n and x :: name\n and P'' :: pi\n and u :: name\n and P''' :: pi\n and \\ :: freeRes\n\n shows \"P \\\\<^sub>\\ P' \\ P' \\\\<^sub>l Rs \\ P \\\\<^sub>l Rs\"\n and \"P \\\\<^sub>\\ P'' \\ P'' \\\\<^sub>lu in P'''\\a \\ P' \\ P \\\\<^sub>lu in P'''\\a \\ P'\"\n and \"P \\\\<^sub>la<\\x> \\ P'' \\ P'' \\\\<^sub>\\ P' \\ x \\ P \\ P \\\\<^sub>la<\\x> \\ P'\"\n and \"P \\\\<^sub>lu in P'''\\a \\ P'' \\ P'' \\\\<^sub>\\ P' \\ P \\\\<^sub>lu in P'''\\a \\ P'\"\n and \"P \\\\<^sub>l\\ \\ P'' \\ P'' \\\\<^sub>\\ P' \\ P \\\\<^sub>l\\ \\ P'\"\nproof -\n assume \"P \\\\<^sub>\\ P'\" and \"P' \\\\<^sub>l Rs\"\n thus \"P \\\\<^sub>l Rs\"\n by(auto simp add: transition_def residualInject) (blast dest: rtrancl_trans)+\nnext\n assume \"P \\\\<^sub>\\ P''\" and \"P'' \\\\<^sub>lu in P'''\\a \\ P'\"\n thus \"P \\\\<^sub>lu in P'''\\a \\ P'\"\n apply(auto simp add: inputTransition_def residualInject)\n by(blast dest: rtrancl_trans)+\nnext\n assume PTrans: \"P \\\\<^sub>l a<\\x> \\ P''\" \n assume P''Chain: \"P'' \\\\<^sub>\\ P'\"\n assume xFreshP: \"x \\ P\"\n\n from PTrans xFreshP obtain P''' P'''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a<\\x> \\ P''''\"\n and P''''Chain: \"P'''' \\\\<^sub>\\ P''\"\n by(blast dest: transitionE)\n\n from P''''Chain P''Chain have \"P'''' \\\\<^sub>\\ P'\" by auto\n with PChain P'''Trans show \"P \\\\<^sub>la<\\x> \\ P'\" by(rule transitionI)\nnext\n assume PTrans: \"P \\\\<^sub>lu in P'''\\a \\ P''\" \n assume P''Chain: \"P'' \\\\<^sub>\\ P'\"\n\n from PTrans obtain P'''' where PChain: \"P \\\\<^sub>\\ P''''\"\n and P''''Trans: \"P'''' \\a \\ P'''\"\n and P'''Chain: \"P'''[x::=u] \\\\<^sub>\\ P''\"\n by(blast dest: transitionE)\n\n from P'''Chain P''Chain have \"P'''[x::=u] \\\\<^sub>\\ P'\" by auto\n with PChain P''''Trans show \"P \\\\<^sub>lu in P'''\\a \\ P'\" by(blast intro: transitionI)\nnext\n assume PTrans: \"P \\\\<^sub>l\\ \\ P''\" \n assume P''Chain: \"P'' \\\\<^sub>\\ P'\"\n\n from PTrans obtain P''' P'''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\\\ \\ P''''\"\n and P''''Chain: \"P'''' \\\\<^sub>\\ P''\"\n by(blast dest: transitionE)\n\n from P''''Chain P''Chain have \"P'''' \\\\<^sub>\\ P'\" by auto\n with PChain P'''Trans show \"P \\\\<^sub>l\\ \\ P'\" by(rule transitionI)\nqed\n\nlemma freshInputTransition:\n fixes P :: pi\n and a :: name\n and x :: name\n and u :: name\n and P'' :: pi\n and P' :: pi\n and c :: name\n\n assumes PTrans: \"P \\\\<^sub>lu in P''\\a \\ P'\"\n and cFreshP: \"c \\ P\"\n and cinequ: \"c \\ u\"\n\n shows \"c \\ P'\"\nproof -\n\n from PTrans obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain cFreshP have cFreshP''': \"c \\ P'''\" by(rule freshChain)\n show \"c \\ P'\"\n proof(cases \"x=c\")\n assume xeqc: \"x=c\"\n from cinequ have \"c \\ P''[c::=u]\" apply - by(rule fresh_fact2)\n with P''Chain xeqc show ?thesis by(force intro: freshChain)\n next\n assume xineqc: \"x\\c\"\n with P'''Trans cFreshP''' have \"c \\ P''\" by(blast dest: freshBoundDerivative)\n with cinequ have \"c \\ P''[x::=u]\"\n apply -\n apply(rule fresh_fact1)\n by simp\n with P''Chain show ?thesis by(rule freshChain)\n qed\nqed\n\nlemma freshBoundOutputTransition:\n fixes P :: pi\n and a :: name\n and x :: name\n and P' :: pi\n and c :: name\n\n assumes PTrans: \"P \\\\<^sub>la<\\x> \\ P'\"\n and cFreshP: \"c \\ P\"\n and cineqx: \"c \\ x\"\n\n shows \"c \\ P'\"\nproof -\n have Goal: \"\\P a x P' c. \\P \\\\<^sub>la<\\x> \\ P'; x \\ P; c \\ P; c \\ x\\ \\ c \\ P'\"\n proof -\n fix P a x P' c\n assume PTrans: \"P \\\\<^sub>la<\\x> \\ P'\"\n assume xFreshP: \"x \\ P\"\n assume cFreshP: \"(c::name) \\ P\"\n assume cineqx: \"c \\ x\"\n\n from PTrans xFreshP obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PTrans cFreshP have \"c \\ P''\" by(rule freshChain)\n with P''Trans cineqx have \"c \\ P'''\" by(blast dest: Late_Semantics.freshBoundDerivative)\n with P'''Trans show \"c \\ P'\" by(rule freshChain)\n qed\n\n have \"\\d::name. d \\ (P, P', c)\" by(blast intro: name_exists_fresh)\n then obtain d::name where dFreshP: \"d \\ P\" and dFreshP': \"d \\ P'\" and cineqd: \"c \\ d\"\n by(force simp add: fresh_prod)\n\n from PTrans dFreshP' have \"P \\\\<^sub>la<\\d> \\ ([(x, d)] \\ P')\" by(simp add: alphaBoundResidual)\n hence \"c \\ [(x, d)] \\ P'\" using dFreshP cFreshP cineqd by(rule Goal)\n with cineqd cineqx show ?thesis by(simp add: name_fresh_left name_calc)\nqed\n\nlemma freshTauTransition:\n fixes P :: pi\n and c :: name\n\n assumes PTrans: \"P \\\\<^sub>l\\ \\ P'\"\n and cFreshP: \"c \\ P\"\n\n shows \"c \\ P'\"\nproof -\n from PTrans have \"P \\\\<^sub>\\ P'\" by(rule tauTransitionChain)\n thus ?thesis using cFreshP by(rule freshChain)\nqed\n\nlemma freshOutputTransition:\n fixes P :: pi\n and a :: name\n and b :: name\n and P' :: pi\n and c :: name\n\n assumes PTrans: \"P \\\\<^sub>la[b] \\ P'\"\n and cFreshP: \"c \\ P\"\n\n shows \"c \\ P'\"\nproof -\n from PTrans obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\a[b] \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PTrans cFreshP have \"c \\ P''\" by(rule freshChain)\n with P''Trans have \"c \\ P'''\" by(blast dest: Late_Semantics.freshFreeDerivative)\n with P'''Trans show ?thesis by(rule freshChain)\nqed\n\nlemma eqvtI:\n fixes P :: pi\n and Rs :: residual\n and perm :: \"name prm\"\n and u :: name\n and P'' :: pi\n and a :: name\n and x :: name\n and P' :: pi\n\n shows \"P \\\\<^sub>l Rs \\ (perm \\ P) \\\\<^sub>l (perm \\ Rs)\"\n and \"P \\\\<^sub>lu in P''\\a \\ P' \\ (perm \\ P) \\\\<^sub>l(perm \\ u) in (perm \\ P'')\\(perm \\ a)<(perm \\ x)> \\ (perm \\ P')\"\nproof -\n assume \"P \\\\<^sub>l Rs\"\n thus \"(perm \\ P) \\\\<^sub>l (perm \\ Rs)\"\n proof(nominal_induct Rs avoiding: P rule: residual.strong_inducts)\n case(BoundR a x P' P)\n have PTrans: \"P \\\\<^sub>la\\x\\ \\ P'\" by fact\n moreover then obtain b where aeqb: \"a = BoundOutputS b\" by(cases a, auto)\n moreover have \"x \\ P\" by fact\n ultimately obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\b<\\x> \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PTrans have \"(perm \\ P) \\\\<^sub>\\ (perm \\ P'')\" by(rule eqvtChainI)\n moreover from P''Trans have \"(perm \\ P'') \\ (perm \\ (b<\\x> \\ P'''))\"\n by(rule eqvts)\n moreover from P'''Trans have \"(perm \\ P''') \\\\<^sub>\\ (perm \\ P')\" by(rule eqvtChainI)\n ultimately show ?case using aeqb by(force intro: transitionI)\n next\n case(FreeR \\ P' P)\n have \"P \\\\<^sub>l\\ \\ P'\" by fact\n then obtain P'' P''' where PTrans: \"P \\\\<^sub>\\ P''\"\n and P''Trans: \"P'' \\\\ \\ P'''\"\n and P'''Trans: \"P''' \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PTrans have \"(perm \\ P) \\\\<^sub>\\ (perm \\ P'')\" by(rule eqvtChainI)\n moreover from P''Trans have \"(perm \\ P'') \\ (perm \\ (\\ \\ P'''))\"\n by(rule eqvts)\n moreover from P'''Trans have \"(perm \\ P''') \\\\<^sub>\\ (perm \\ P')\" by(rule eqvtChainI)\n ultimately show ?case by(force intro: transitionI)\n qed\nnext\n assume \"P \\\\<^sub>lu in P''\\a \\ P'\"\n\n then obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\"\n and P'''Trans: \"P''' \\a \\ P''\"\n and P''Chain: \"P''[x::=u] \\\\<^sub>\\ P'\"\n by(blast dest: transitionE)\n\n from PChain have \"(perm \\ P) \\\\<^sub>\\ (perm \\ P''')\" by(rule eqvtChainI)\n moreover from P'''Trans have \"(perm \\ P''') \\ (perm \\ (a \\ P''))\"\n by(rule eqvts)\n moreover from P''Chain have \"(perm \\ P''[x::=u]) \\\\<^sub>\\ (perm \\ P')\" by(rule eqvtChainI)\n ultimately show \"(perm \\ P) \\\\<^sub>l(perm \\ u) in (perm \\ P'')\\(perm \\ a)<(perm \\ x)> \\ (perm \\ P')\"\n by(force intro: transitionI simp add: eqvt_subs[THEN sym] perm_bij)\nqed\n\nlemmas freshTransition = freshBoundOutputTransition freshOutputTransition\n freshInputTransition freshTauTransition\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Step_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2639119517211647}} {"text": "(*\n File: dAlpha.thy\n Time-stamp: <2016-01-12T14:47:32Z>\n Author: JRF\n Web: http://jrf.cocolog-nifty.com/software/2016/01/post.html\n Logic Image: Logics_ZF (of Isabelle2020)\n*)\n\ntheory dAlpha imports dLambda begin\n\ndefinition dSkeltonEq :: \"[i, i] => o\" where\n\"dSkeltonEq(M, N) == M: dTerm & N: dTerm &\n (ALL l. (EX x. : dOcc(M))\n <-> (EX x. : dOcc(N))) &\n (ALL l. (EX n. : dOcc(M))\n <-> (EX n. : dOcc(N))) &\n (ALL l. : dOcc(M) <-> : dOcc(N)) &\n (ALL l. : dOcc(M) <-> : dOcc(N))\"\n\ndefinition dAlpha :: \"[i, i]=>o\" where\n\"dAlpha(M, N) == dSkeltonEq(M, N) &\n (ALL l x. : dOcc(M) <-> : dOcc(N)) &\n (ALL l m. (EX T U. dBoundBy(, , M))\n <-> (EX T U. dBoundBy(, , N)))\"\n\n\n(** dSkeltonEq **)\nlemma dSkeltonEqD1:\n \"dSkeltonEq(M, N) ==> M: dTerm\"\napply (unfold dSkeltonEq_def)\napply (erule conjunct1)\ndone\n\nlemma dSkeltonEqD2:\n \"dSkeltonEq(M, N) ==> N: dTerm\"\napply (unfold dSkeltonEq_def)\napply (erule conjunct2 [THEN conjunct1])\ndone\n\nlemma dSkeltonEq_TdVarD:\n \"[| dSkeltonEq(M, N); : dOcc(M) |]\n ==> EX x. : dOcc(N)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_TdBoundD:\n \"[| dSkeltonEq(M, N); : dOcc(M) |]\n ==> EX n. : dOcc(N)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_TdLamD:\n \"[| dSkeltonEq(M, N); : dOcc(M) |]\n ==> : dOcc(N)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_TdAppD:\n \"[| dSkeltonEq(M, N); : dOcc(M) |]\n ==> : dOcc(N)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_refl:\n \"M: dTerm ==> dSkeltonEq(M, M)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_sym:\n \"dSkeltonEq(M, N) ==> dSkeltonEq(N, M)\"\napply (unfold dSkeltonEq_def)\napply blast\ndone\n\nlemma dSkeltonEq_trans:\n \"[| dSkeltonEq(M, N); dSkeltonEq(N, L) |] ==> dSkeltonEq(M, L)\"\napply (unfold dSkeltonEq_def)\napply (erule conjE)+\napply ((erule spec [THEN iff_trans], erule spec)\n | (assumption | rule conjI allI))+\ndone\n\nlemma dSkeltonEq_dVarI:\n \"[| x: LVariable; y: LVariable |] ==> dSkeltonEq(dVar(x), dVar(y))\"\napply (unfold dSkeltonEq_def)\napply (assumption | rule dTerm.intros conjI)+\napply (blast elim!: dTag.free_elims dOcc_dTermEs\n intro: dOcc_dTermIs)+\ndone\n\nlemma dSkeltonEq_dBoundI:\n \"[| n: nat; m: nat |] ==> dSkeltonEq(dBound(n), dBound(m))\"\napply (unfold dSkeltonEq_def)\napply (assumption | rule dTerm.intros conjI)+\napply (blast elim!: dTag.free_elims dOcc_dTermEs\n intro: dOcc_dTermIs)+\ndone\n\nlemma dSkeltonEq_dLamI:\n \"dSkeltonEq(M, N) ==> dSkeltonEq(dLam(M), dLam(N))\"\napply (unfold dSkeltonEq_def)\napply (erule conjE)+\napply (assumption | rule dTerm.intros conjI)\napply (safe elim!: dTag.free_elims dOcc_dTermEs)\napply (blast intro: dOcc_dTermIs)+\ndone\n\nlemma dSkeltonEq_dAppI:\n \"[| dSkeltonEq(A, C); dSkeltonEq(B, D)|]\n ==> dSkeltonEq(dApp(A, B), dApp(C, D))\"\napply (unfold dSkeltonEq_def)\napply (erule conjE)+\napply (assumption | rule dTerm.intros conjI)\napply (safe elim!: dTag.free_elims dOcc_dTermEs)\napply (blast intro!: dOcc_dTermIs)+\ndone\n\nlemmas dSkeltonEq_LTermIs = dSkeltonEq_dVarI dSkeltonEq_dBoundI\n dSkeltonEq_dLamI dSkeltonEq_dAppI\n\nlemma dSkeltonEq_dVarE:\n assumes major: \"dSkeltonEq(dVar(x), N)\"\n and prem:\n \"!! y B. [| N = dVar(y); x: LVariable; y: LVariable |] ==> R\"\n shows \"R\"\napply (insert major)\napply (unfold dSkeltonEq_def)\napply (elim dTerm_typeEs conjE)\napply (subgoal_tac \"EX y. <[], TdVar(y)>: dOcc(N)\"\n \"EX y: LVariable. N = dVar(y)\")\nprefer 3\napply (erule spec [THEN iffD1])\napply (assumption | rule exI dOcc_dTermIs)+\nprefer 2\napply (erule exE)\napply (erule_tac a=\"N\" in dTerm.cases)\nprefer 4\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 3\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 2\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\napply (assumption | rule bexI)+\napply (erule bexE)\napply (rule prem)\napply assumption+\ndone\n\nlemma dSkeltonEq_dBoundE:\n assumes major: \"dSkeltonEq(dBound(n), N)\"\n and prem: \"!! m B. [| N = dBound(m); n: nat; m: nat |] ==> R\"\n shows \"R\"\napply (insert major)\napply (unfold dSkeltonEq_def)\napply (elim dTerm_typeEs conjE)\napply (subgoal_tac \"EX m. <[], TdBound(m)>: dOcc(N)\"\n \"EX m: nat. N = dBound(m)\")\nprefer 3\napply (erule spec [THEN iffD1])\napply (assumption | rule exI dOcc_dTermIs)+\nprefer 2\napply (erule exE)\napply (erule_tac a=\"N\" in dTerm.cases)\nprefer 4\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 3\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 1\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\napply (assumption | rule bexI)+\napply (erule bexE)\napply (rule prem)\napply assumption+\ndone\n\nlemma dSkeltonEq_dLamE:\n assumes major: \"dSkeltonEq(dLam(A), N)\"\n and prem: \"!! y B. [| N = dLam(B); dSkeltonEq(A, B) |] ==> R\"\n shows \"R\"\napply (insert major)\napply (unfold dSkeltonEq_def)\napply (elim dTerm_typeEs conjE)\napply (subgoal_tac \"<[], TdLam>: dOcc(N)\"\n \"EX B: dTerm. N = dLam(B)\")\nprefer 3\napply (erule spec [THEN iffD1])\napply (assumption | rule exI dOcc_dTermIs)+\nprefer 2\napply (erule_tac a=\"N\" in dTerm.cases)\nprefer 4\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 3\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\nprefer 2\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\napply hypsubst\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\napply (elim bexE)\napply hypsubst\napply (rule prem)\napply assumption\napply (unfold dSkeltonEq_def)\napply (intro conjI)\napply assumption+\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\ndone\n\nlemma dSkeltonEq_dAppE:\n assumes major: \"dSkeltonEq(dApp(A, B), N)\"\n and prem:\n \"!! C D. [| N = dApp(C, D); dSkeltonEq(A, C); dSkeltonEq(B, D) |]\n ==> R\"\n shows \"R\"\napply (insert major)\napply (unfold dSkeltonEq_def)\napply (elim dTerm_typeEs conjE)\napply (subgoal_tac \"<[], TdApp>: dOcc(N)\"\n \"EX C: dTerm. EX D: dTerm. N = dApp(C, D)\")\nprefer 3\napply (erule spec [THEN iffD1])\napply (assumption | rule dOcc_dTermIs)+\nprefer 2\napply (erule_tac a=\"N\" in dTerm.cases)\napply hypsubst\napply (blast elim!: dTag.free_elims dOcc_dTermEs)\napply (blast elim!: dTag.free_elims dOcc_dTermEs)\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\napply (blast elim!: dTag.free_elims list.free_elims dOcc_dTermEs)\n\napply (elim bexE)\napply (rule prem)\napply assumption\napply (unfold dSkeltonEq_def)\n\napply hypsubst\napply (intro conjI)\napply assumption+\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply hypsubst\napply (intro conjI)\napply assumption+\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (erule exE)\napply (drule spec [THEN iffD1], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (erule exE)\napply (drule spec [THEN iffD2], rule exI, erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\napply (intro allI iffI)\napply (drule spec [THEN iffD1], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\napply (drule spec [THEN iffD2], erule dOcc_dTermIs)\napply (blast elim!: list.free_elims dTag.free_elims dOcc_dTermEs)\n\ndone\n\nlemmas dSkeltonEq_dTermEs = dSkeltonEq_dVarE dSkeltonEq_dBoundE\n dSkeltonEq_dLamE dSkeltonEq_dAppE\n\nlemma dSkeltonEq_skelton:\n assumes major: \"dSkeltonEq(M, N)\"\n and prem: \": dOcc(M)\"\n shows \"EX U. : dOcc(N)\"\napply (insert dOcc_typeD2 [OF prem major [THEN dSkeltonEqD1]] prem)\napply (erule dTag.cases)\napply hypsubst\napply (drule major [THEN dSkeltonEq_TdVarD])\napply (erule exE)\napply (erule exI)\napply hypsubst\napply (drule major [THEN dSkeltonEq_TdBoundD])\napply (erule exE)\napply (erule exI)\napply hypsubst\napply (drule major [THEN dSkeltonEq_TdLamD])\napply (erule exI)\napply hypsubst\napply (drule major [THEN dSkeltonEq_TdAppD])\napply (erule exI)\ndone\n\nlemmas dTerm_Occ_ind_cond_Occ_not_empty_lemma\n = Occ_ind_cond_Occ_not_empty_lemma [OF dTerm_Occ_ind_cond]\n\nlemma dSkeltonEq_dLamDeg_lemma:\n assumes major: \"dSkeltonEq(M, N)\"\n and prem1: \": dOcc(M)\"\n and prem2: \": dOcc(M)\"\n shows \"dLamDeg(x, dsubterm(M, l)) = dLamDeg(x, dsubterm(N, l))\"\napply (rule prem2 [THEN rev_mp])\napply (rule prem1 [THEN rev_mp])\napply (rule major [THEN rev_mp])\napply (rule_tac x=\"N\" in spec)\napply (rule_tac x=\"T\" in spec)\napply (rule_tac x=\"l\" and A=\"list(nat)\" in bspec)\napply (rule_tac x=\"x\" and A=\"list(nat)\" in bspec)\nprefer 3\nprefer 3\napply (rule dOcc_typeD1 [OF prem2 major [THEN dSkeltonEqD1], \n THEN app_typeD])\napply (rule dOcc_typeD1 [OF prem1 major [THEN dSkeltonEqD1]])+\napply (rule major [THEN dSkeltonEqD1, THEN dTerm.induct])\napply (safe elim!: dSkeltonEq_dTermEs ConsE dOcc_dTermEs\n dTag.free_elims)\napply (simp_all add: dTerm.intros dSkeltonEqD1 dSkeltonEqD2)\napply (safe elim!: list.free_elims ConsE)\n\napply (frule dSkeltonEqD1 [THEN dTerm_Occ_ind_cond_Occ_not_empty_lemma])\napply (erule bexE)\napply (drule_tac x6=\"l\" and x5=\"[]\" and x3=\"B\" in bspec [THEN bspec, THEN spec, THEN spec,\n THEN mp, THEN mp, THEN mp])\napply (assumption | rule list.intros)+\napply simp\napply (simp add: dSkeltonEqD1 dSkeltonEqD2)\n\napply (frule dSkeltonEqD1 [THEN dTerm_Occ_ind_cond_Occ_not_empty_lemma])\napply (erule bexE)\napply (drule_tac x6=\"l\" and x5=\"[]\" and x3=\"C\" in bspec [THEN bspec, THEN spec, THEN spec,\n THEN mp, THEN mp, THEN mp], erule_tac [4] asm_rl)\napply (assumption | rule list.intros)+\napply simp\napply (simp add: dSkeltonEqD1 dSkeltonEqD2)\n\napply (frule_tac M=\"N\" in dSkeltonEqD1 [THEN dTerm_Occ_ind_cond_Occ_not_empty_lemma])\napply (erule bexE)\napply (drule_tac x6=\"l\" and x5=\"[]\" and x3=\"D\" in bspec [THEN bspec, THEN spec, THEN spec,\n THEN mp, THEN mp, THEN mp], erule_tac [4] asm_rl)\napply (assumption | rule list.intros)+\napply simp\napply (simp add: dSkeltonEqD1 dSkeltonEqD2)\ndone\n\n\n(** dAlpha **)\nlemma dAlphaD1:\n \"dAlpha(M, N) ==> dSkeltonEq(M, N)\"\napply (unfold dAlpha_def)\napply (erule conjunct1)\ndone\n\nlemma dAlphaD2:\n \"[| dAlpha(M, N); : dOcc(M) |] ==> : dOcc(N)\"\napply (unfold dAlpha_def)\napply blast\ndone\n\nlemma dAlphaD3:\n \"[| dAlpha(M, N); dBoundBy(, , M) |]\n ==> EX n. dBoundBy(, , N)\"\napply (unfold dAlpha_def)\napply (drule conjunct2 [THEN conjunct2])\napply (drule spec [THEN spec, THEN iffD1])\napply (erule exI [THEN exI])\napply (elim exE)\napply (rule_tac M=\"N\" in dBoundByE)\napply assumption\napply safe\napply (erule exI)\ndone\n\nlemma dAlpha_dBoundByD:\n assumes major: \"dAlpha(M, N)\"\n and prem: \"dBoundBy(, , M)\"\n shows \"dBoundBy(, , N)\"\napply (rule prem [THEN dBoundByE])\napply (insert dAlphaD3 [OF major prem])\napply (safe elim!: dBoundByE dest!: app_right_inj\n elim!: dTag.free_elims)\napply (erule dOcc_typeD1)\napply assumption\napply (frule major [THEN dAlphaD1, THEN dSkeltonEq_dLamDeg_lemma], assumption)\napply (simp only: succ_inject_iff)\napply (assumption | rule refl dBoundByI)+\ndone\n\nlemma dAlphaI:\n assumes prem1: \"dSkeltonEq(M, N)\"\n and prem2: \"!! l x. : dOcc(M) <-> : dOcc(N)\"\n and prem3: \"!! l m. (EX x. dBoundBy(, , M))\n <-> (EX x. dBoundBy(, , N))\"\n shows \"dAlpha(M, N)\"\napply (unfold dAlpha_def)\napply (rule prem1 [THEN conjI])\napply (rule allI [THEN allI, THEN conjI])\napply (rule prem2)\napply safe\napply (rule_tac [2] dBoundByE, erule_tac [2] asm_rl)\napply (rule_tac [1] dBoundByE, erule_tac [1] asm_rl)\napply safe\napply (drule exI [THEN prem3 [THEN iffD1]])\napply (drule_tac [2] exI [THEN prem3 [THEN iffD2]])\napply blast+\ndone\n\nlemma dAlpha_dPropI:\n assumes prem1: \"M: dProp\"\n and prem2: \"N: dProp\"\n and prem3:\n \"!! l. : dOcc(M) <-> : dOcc(N)\"\n and prem4:\n \"!! l. : dOcc(M) <-> : dOcc(N)\"\n and prem5:\n \"!! l x. : dOcc(M) <-> : dOcc(N)\"\n and prem6:\n \"!! l m. (EX x. dBoundBy(, , M))\n <-> (EX x. dBoundBy(, , N))\"\n shows \"dAlpha(M, N)\"\napply (rule dAlphaI)\napply (erule_tac [2] asm_rl | rule_tac [2] prem5 prem6)+\napply (unfold dSkeltonEq_def)\napply (assumption | rule conjI prem1 prem2 dPropD1)+\napply (rule_tac [2] conjI)\napply (rule_tac [3] conjI)\napply (rule_tac [4] allI)\napply (rule_tac [3] allI)\napply (rule_tac [2] allI)\napply (rule_tac [1] allI)\napply (erule_tac [3] asm_rl | rule_tac [3] prem3 prem4)+\napply safe\napply (drule prem5 [THEN iffD1], erule exI)\napply (drule prem5 [THEN iffD2], erule exI)\napply (drule prem1 [THEN dProp_dBoundBy_lemma1])\napply (drule_tac [2] prem2 [THEN dProp_dBoundBy_lemma1])\napply safe\napply (drule exI [THEN prem6 [THEN iffD1]])\napply (drule_tac [2] exI [THEN prem6 [THEN iffD2]])\napply (blast elim!: dBoundByE)+\ndone\n\nlemma dAlpha_refl:\n \"M: dTerm ==> dAlpha(M, M)\"\napply (unfold dAlpha_def)\napply (blast intro: dSkeltonEq_refl)\ndone\n\nlemma dAlpha_sym:\n \"dAlpha(M, N) ==> dAlpha(N, M)\"\napply (unfold dAlpha_def)\napply (blast intro: dSkeltonEq_sym)\ndone\n\nlemma dAlpha_trans:\n \"[| dAlpha(M, N); dAlpha(N, L) |] ==> dAlpha(M, L)\"\napply (unfold dAlpha_def)\napply (blast intro: dSkeltonEq_trans)\ndone\n\nlemmas dTerm_Occ_ind_cond_Occ_inj = Occ_ind_cond_Occ_inj [OF\n dTerm_Occ_ind_cond]\n\nlemma dAlpha_imp_dProp_eq:\n assumes major: \"dAlpha(M, N)\"\n and prem1: \"M: dProp\"\n and prem2: \"N: dProp\"\n shows \"M = N\"\napply (insert prem1 [THEN dPropD1] prem2 [THEN dPropD1])\napply (rule dTerm_Occ_ind_cond_Occ_inj [THEN iffD1])\napply (assumption | rule equalityI)+\napply (rule_tac [2] subsetI)\napply (rule_tac [1] subsetI)\napply (rule_tac [2] dOcc_domain [THEN subsetD, THEN SigmaE],\n erule_tac [3] asm_rl)\napply (rule_tac [1] dOcc_domain [THEN subsetD, THEN SigmaE],\n erule_tac [2] asm_rl)\nprefer 3\napply assumption+\napply (erule_tac [2] dTag.cases)\napply (erule_tac [1] dTag.cases)\nprefer 6\napply hypsubst\napply (drule prem2 [THEN dProp_dBoundBy_lemma1])\napply (erule exE)\napply (drule major [THEN dAlpha_sym, THEN dAlpha_dBoundByD])\ndefer 1\ndefer 6\ndefer 6\nprefer 2\napply hypsubst\napply (drule prem1 [THEN dProp_dBoundBy_lemma1])\napply (erule exE)\napply (drule major [THEN dAlpha_dBoundByD])\nprefer 2\napply (safe elim!: dBoundByE dTag.free_elims)\n\napply (erule major [THEN dAlphaD2])\napply (erule major [THEN dAlphaD1, THEN dSkeltonEq_TdLamD])\napply (erule major [THEN dAlphaD1, THEN dSkeltonEq_TdAppD])\napply (erule major [THEN dAlpha_sym, THEN dAlphaD2])\napply (erule major [THEN dAlpha_sym, THEN dAlphaD1, THEN dSkeltonEq_TdLamD])\napply (erule major [THEN dAlpha_sym, THEN dAlphaD1, THEN dSkeltonEq_TdAppD])\ndone\n\nlemma dAlpha_dProp_iff:\n assumes prem1: \"M: dProp\"\n and prem2: \"N: dProp\"\n shows \"dAlpha(M, N) <-> M = N\"\napply (rule iffI)\nprefer 2\napply hypsubst\napply (rule prem2 [THEN dPropD1, THEN dAlpha_refl])\napply (erule dAlpha_imp_dProp_eq)\napply (rule prem1 prem2)+\ndone\n\n\n(** Rules for depth induction **)\nlemmas dTerm_Occ_Term_cons = Occ_Term_cons [OF\n dTerm_Occ_ind_cond dTerm_Term_cons_inj_cond]\n\nlemma depth_ind_dLam:\n \"[| dOcc(dLam(M)) <= Occ_fbs_op(dTag, Z); M: dTerm |]\n ==> dOcc(M) <= domain(Z) * dTag\"\napply (rule_tac P=\"%x. x <= domain(Z) * dTag\" in ssubst)\napply (erule_tac [2] b=\"0\" in Occ_subtree_Occ_fbs_op_lemma)\napply (simp add: dTerm_Occ_Term_cons Occ_subtree_Occ_cons\n dTerm_cons_eqns_sym)\ndone\n\nlemma depth_ind_dApp1:\n \"[| dOcc(dApp(M, N)) <= Occ_fbs_op(dTag, Z); M: dTerm; N: dTerm |]\n ==> dOcc(M) <= domain(Z) * dTag\"\napply (rule_tac P=\"%x. x <= domain(Z) * dTag\" in ssubst)\napply (erule_tac [2] b=\"0\" in Occ_subtree_Occ_fbs_op_lemma)\napply (simp add: dTerm_Occ_Term_cons Occ_subtree_Occ_cons\n dTerm_cons_eqns_sym)\ndone\n\nlemma depth_ind_dApp2:\n \"[| dOcc(dApp(M, N)) <= Occ_fbs_op(dTag, Z); M: dTerm; N: dTerm |]\n ==> dOcc(N) <= domain(Z) * dTag\"\napply (rule_tac P=\"%x. x <= domain(Z) * dTag\" in ssubst)\napply (erule_tac [2] b=\"1\" in Occ_subtree_Occ_fbs_op_lemma)\napply (simp add: dTerm_Occ_Term_cons Occ_subtree_Occ_cons\n dTerm_cons_eqns_sym)\ndone\n\nlemma depth_ind_dSubst_dVar_lemma:\n assumes major: \": dOcc(dSubst(M, n, dVar(x)))\"\n and prem1: \"M: dTerm\"\n and prem2: \"x: LVariable\"\n and prem3: \"n: nat\"\n shows \"EX T. : dOcc(M)\"\napply (insert prem2)\napply (rule major [THEN rev_mp])\napply (rule prem3 [THEN [2] bspec])\napply (rule_tac x=\"l\" in spec)\napply (rule prem1 [THEN dTerm.induct])\napply (rule_tac [2] ballI [THEN allI])\napply (case_tac [2] \"xaa = n\")\napply (case_tac [3] \"xaa < n\")\napply (simp_all del: all_simps ball_simps)\napply (safe elim!: dOcc_dTermEs)\napply (blast intro!: dOcc_dTermIs)+\ndone\n\nlemma depth_ind_dSubst_dVar:\n assumes major: \"dOcc(M) <= domain(Z) * dTag\"\n and prem1: \"M: dTerm\"\n and prem2: \"x: LVariable\"\n and prem3: \"n: nat\"\n shows \"dOcc(dSubst(M, n, dVar(x))) <= domain(Z) * dTag\"\napply (rule subsetI)\napply (rule dOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2 apply assumption\napply (assumption | rule dSubst_type prem1 prem2 prem3 dTerm.intros)+\napply hypsubst\napply (frule depth_ind_dSubst_dVar_lemma)\napply (erule_tac [4] exE)\napply (rule_tac [4] SigmaI)\napply (erule_tac [4] major [THEN subsetD, THEN SigmaD1])\napply (assumption | rule prem2 prem3 prem1)+\ndone\n\nend\n", "meta": {"author": "JRF-2018", "repo": "isabelle_TheLambda", "sha": "e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad", "save_path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda", "path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda/isabelle_TheLambda-e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad/dAlpha.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2639119447734815}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | December 2004 |\n | June 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_law_step\nimports CSP_F_domain CSP_T.CSP_T_law_step\nbegin\n\n(*****************************************************************\n\n 1. step laws\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n stop expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_STOP_step: \"STOP =F[M1,M2] ? :{} -> Pf\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_STOP_step)\napply (simp add: failures_iff)\ndone\n\n(* to avoide producing free variables in tactics *)\n\nlemma cspF_STOP_step_DIV: \"STOP =F[M1,M2] ? x:{} -> DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_STOP_step)\napply (simp add: failures_iff)\ndone\n\n\n(*********************************************************\n Act_prefix expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Act_prefix_step: \"a -> P =F[M,M] ? x:{a} -> P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Act_prefix_step)\napply (simp add: failures_iff)\ndone\n\n(*********************************************************\n Ext choice expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Ext_choice_step:\n \"(? :X -> Pf) [+] (? :Y -> Qf) =F[M,M]\n ? x:(X Un Y) -> \n (IF (x : X & x : Y) THEN (Pf x |~| Qf x)\n ELSE IF (x : X) THEN Pf x\n ELSE Qf x)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (force)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (simp add: in_traces)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (force)\n\n apply (case_tac \"a : Y\")\n apply (simp_all add: in_failures)\n\n apply (case_tac \"a : X\")\n apply (simp_all add: in_failures)\ndone\n\n(*********************************************************\n Parallel expansion\n *********************************************************)\n\n(* set 1 *)\n\nlemma cspF_Parallel_step_set1:\n \"[| Ya - insert Tick (Ev ` X) = Za - insert Tick (Ev ` X) ;\n Ev ` Y Int Ya = {}; Ev ` Z Int Za = {} |]\n ==> Ev ` (X Int Y Int Z) Int (Ya Un Za) = {}\"\nby (auto)\n\n(* set 2 *)\n\nlemma cspF_Parallel_step_set2:\n \"[| Ya - insert Tick (Ev ` X) = Za - insert Tick (Ev ` X) ;\n Ev ` Y Int Ya = {}; Ev ` Z Int Za = {} |]\n ==> Ev ` (Y - X) Int (Ya Un Za) = {}\"\napply (rule equalityI)\n apply (rule subsetI)\n apply (simp add: inj_image_diff_dist)\n apply (simp add: in_Ev_set)\n apply (elim conjE exE)\n\n apply (erule disjE)\n apply (fast)\n (* *)\n apply (simp)\n apply (case_tac \"Ev a : Ya\")\n apply (fast)\n apply (rotate_tac 1)\n apply (erule equalityE)\n apply (rotate_tac -1)\n apply (erule subsetE)\n apply (drule_tac x=\"Ev a\" in bspec, fast)\n apply (simp)\n apply (fast)\ndone\n\n(* set 3 *)\n\nlemma cspF_Parallel_step_set3:\n \"[| Ya - insert Tick (Ev ` X) = Za - insert Tick (Ev ` X) ;\n Ev ` Y Int Ya = {}; Ev ` Z Int Za = {} |]\n ==> Ev ` (Z - X) Int (Ya Un Za) = {}\"\napply (rule equalityI)\n apply (rule subsetI)\n apply (simp add: inj_image_diff_dist)\n apply (simp add: in_Ev_set)\n apply (elim conjE exE)\n apply (erule disjE)\n apply (simp)\n apply (case_tac \"Ev a : Za\")\n apply (fast)\n apply (rotate_tac 1)\n apply (erule equalityE)\n apply (erule subsetE)\n apply (drule_tac x=\"Ev a\" in bspec, fast)\n apply (simp)\n apply (fast)\n (* *)\n apply (simp)\ndone\n\n(* set 4 *)\n\nlemma cspF_Parallel_step_set4:\n \"Ev ` (X Int Y Int Z Un (Y - X) Un (Z - X)) Int Xa = {} \n ==> Xa =\n Xa - insert Tick (Ev ` X) Un (Xa Int insert Tick (Ev ` X) - Ev ` Y) Un\n (Xa - insert Tick (Ev ` X) Un (Xa Int insert Tick (Ev ` X) - Ev ` Z))\"\nby (auto)\n\n(* set 5 *)\n\nlemma cspF_Parallel_step_set5:\n \"Ev ` (X Int Y Int Z Un (Y - X) Un (Z - X)) Int Xa = {} \n ==> Ev ` Y Int\n (Xa - insert Tick (Ev ` X) Un (Xa Int insert Tick (Ev ` X) - Ev ` Y)) = {} &\n Ev ` Z Int\n (Xa - insert Tick (Ev ` X) Un (Xa Int insert Tick (Ev ` X) - Ev ` Z)) = {}\"\nby (auto)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Parallel_step: \n \"(? :Y -> Pf) |[X]| (? :Z -> Qf) =F[M,M]\n ? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ? x:Z -> Qf x)\n |~| (? x:Y -> Pf x |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ? x:Z -> Qf x)\n ELSE (? x:Y -> Pf x |[X]| Qf x)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_step)\napply (rule order_antisym)\n\n(* => *)\napply (rule)\napply (simp add: in_failures)\napply (elim disjE conjE exE)\n\n (* (nil,nil) *)\n apply (simp add: image_Un Int_Un_distrib2)\n apply (simp add: cspF_Parallel_step_set1\n cspF_Parallel_step_set2\n cspF_Parallel_step_set3)\n\n (* (nil,Ev) *)\n apply (simp)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"s\" in spec)\n\n apply (erule disjE, simp)\n apply (erule disjE, simp)\n apply (elim conjE exE, simp)\n apply (simp add: par_tr_head)\n \n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n apply (case_tac \"aa : Y\")\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n (* \"aa ~: Y\" *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n\n (* (Ev,nil) *)\n apply (simp)\n apply (drule_tac x=\"s\" in spec)\n\n apply (erule disjE, simp)\n apply (erule disjE, simp)\n apply (elim conjE exE, simp)\n apply (simp add: par_tr_head)\n \n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n (* \"a ~: Z\" *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n (* (Ev,Ev) *)\n apply (drule_tac x=\"s\" in spec)\n apply (erule disjE, simp)\n apply (erule disjE, simp)\n apply (elim conjE exE, simp)\n apply (simp add: par_tr_head)\n apply (elim disjE conjE exE, simp)\n\n (* sync *)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"sd\" in exI)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n (* left *)\n apply (simp)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sd\" in exI)\n apply (simp)\n\n apply (case_tac \"a : Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp)\n (* \"a ~: Z\" *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ sc\" in exI)\n apply (simp)\n\n (* right *)\n apply (simp)\n apply (rule_tac x=\"aa\" in exI)\n apply (rule_tac x=\"sd\" in exI)\n apply (simp)\n\n apply (case_tac \"aa : Y\")\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n (* \"aa ~: Y\" *)\n apply (simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"sc\" in exI)\n apply (simp)\n\n(* <= *)\n\napply (rule)\napply (simp add: in_failures)\napply (elim disjE conjE exE)\n\n (* nil *)\n apply (simp)\n apply (rule_tac x=\"(Xa - insert Tick (Ev ` X)) Un\n ((Xa Int insert Tick (Ev ` X)) - Ev ` Y)\" in exI)\n apply (rule_tac x=\"(Xa - insert Tick (Ev ` X)) Un\n ((Xa Int insert Tick (Ev ` X)) - Ev ` Z)\" in exI)\n apply (simp add: cspF_Parallel_step_set4)\n apply (rule conjI, force)\n apply (simp add: cspF_Parallel_step_set5)\n\n (* sync *)\n apply (simp add: in_failures)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n\n (* left *)\n apply (case_tac \"a : Z\")\n apply (simp add: in_failures)\n apply (erule disjE)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n (* *)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n (* \"a ~: Z\" *)\n apply (simp add: in_failures)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n\n (* right *)\n apply (case_tac \"a : Y\")\n apply (simp add: in_failures)\n apply (erule disjE)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: par_tr_head)\n (* *)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\n (* \"a ~: Y\" *)\n apply (simp add: in_failures)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"Ya\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp)\n apply (rule_tac x=\"sb\" in exI)\n apply (rule_tac x=\" ^^^ t\" in exI)\n apply (simp add: par_tr_head)\ndone\n\n(*********************************************************\n Hide expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Hiding_step: \n \"(? :Y -> Pf) -- X =F[M,M] \n IF (Y Int X = {}) THEN (? x:Y -> (Pf x -- X))\n ELSE ((? x:(Y-X) -> (Pf x -- X)) \n [> (! x:(Y Int X) .. (Pf x -- X)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Hiding_step)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE)\n apply (erule disjE)\n (* not hidden *)\n apply (simp)\n apply (case_tac \"Y Int X ~= {}\", fast)\n apply (simp)\n apply (fast)\n (* hidden *)\n apply (elim conjE exE)\n apply (simp)\n\n apply (case_tac \"a : X\")\n apply (case_tac \"Y Int X = {}\", fast)\n apply (simp)\n apply (case_tac \"sb --tr X = <>\")\n apply (rule disjI1)\n apply (simp)\n apply (rule_tac x=\"a\" in bexI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n apply (simp)\n\n apply (rule disjI2)\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"a\" in bexI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n apply (simp)\n\n (* a ~: X *)\n apply (case_tac \"Y Int X = {}\")\n apply (simp)\n apply (fast)\n (* Y Int X ~= {} *)\n apply (simp)\n apply (fast)\n\n (* <= *)\n apply (rule)\n apply (case_tac \"Y Int X = {}\")\n apply (simp add: in_failures)\n apply (erule disjE)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n apply (fast)\n (* *)\n apply (elim conjE exE)\n apply (case_tac \"a : X\", fast)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n\n (* Y Int X ~= {} *)\n apply (simp add: in_failures_IF)\n apply (simp add: in_failures_Timeout)\n apply (elim disjE)\n (* 1 *)\n apply (simp add: in_failures)\n apply (elim conjE exE bexE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (simp)\n\n (* 2 *)\n apply (simp add: in_failures)\n apply (elim conjE, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\n (* 3 *)\n apply (simp add: in_failures)\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n Renaming expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Renaming_step:\n \"(? :X -> Pf) [[r]] =F[M,M] \n ? y:(r `` X) -> (! x:{x. x:X & (x,y):r} .. (Pf x)[[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Renaming_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n (* 1 *)\n apply (simp add: ren_inv_def)\n apply (force)\n (* 2 *)\n apply (simp add: ren_tr_decompo)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\"b\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n (* 1 *)\n apply (simp add: ren_inv_def)\n apply (force)\n (* 2 *)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n Sequential composition expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Seq_compo_step: \n \"(? :X -> Pf) ;; Q =F[M,M] ? x:X -> (Pf x ;; Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n\n apply (simp_all)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE)\n apply (simp add: in_traces)\n apply (erule disjE)\n apply (simp)\n\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sb ^^^ t\" in exI)\n apply (simp add: appt_assoc)\n apply (simp add: in_traces)\n apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n (* 1 *)\n apply (rule disjI1)\n apply (simp)\n apply (fast)\n\n (* 2 *)\n apply (elim conjE exE disjE)\n\n (* 2-1 *)\n apply (simp)\n\n (* 2-2 *)\n apply (rule disjI2)\n apply (simp)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\"t\" in exI, simp)\n apply (simp add: appt_assoc)\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n Depth_rest expansion\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspF_Depth_rest_step:\n \"(? :X -> Pf) |. (Suc n) =F[M,M] ? x:X -> (Pf x |. n)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Depth_rest_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sb\" in exI)\n apply (simp)\n apply (rule disjI2)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"sa\" in spec)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp add: appt_assoc)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (simp add: appt_assoc)\ndone\n\n(*********************************************************)\n\nlemmas cspF_step = cspF_STOP_step cspF_Act_prefix_step \n cspF_Ext_choice_step cspF_Parallel_step\n cspF_Hiding_step cspF_Renaming_step\n cspF_Seq_compo_step cspF_Depth_rest_step\n\nlemmas cspF_light_step = cspF_STOP_step cspF_Act_prefix_step \n\n\nlemmas cspF_step_rw = cspF_STOP_step_DIV cspF_Act_prefix_step \n cspF_Ext_choice_step cspF_Parallel_step\n cspF_Hiding_step cspF_Renaming_step\n cspF_Seq_compo_step cspF_Depth_rest_step\n\nlemmas cspF_light_step_rw = cspF_STOP_step_DIV cspF_Act_prefix_step \n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_step.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.26391193782579825}} {"text": "theory Incredible_Predicate_Tasks\nimports\n Incredible_Completeness\n Incredible_Predicate\n \"~~/src/HOL/Eisbach/Eisbach\"\nbegin\n\ndeclare One_nat_def [simp del]\n\ncontext ND_Rules_Inst begin\nlemma eff_NatRuleI:\n \"nat_rule rule c ants\n \\ entail = (\\ \\ subst s (freshen a c))\n \\ hyps = ((\\ant. ((\\p. subst s (freshen a p)) |`| a_hyps ant |\\| \\ \\ subst s (freshen a (a_conc ant)))) |`| ants)\n \\ (\\ ant f. ant |\\| ants \\ f |\\| \\ \\ freshenLC a ` (a_fresh ant) \\ lconsts f = {})\n \\ (\\ ant. ant |\\| ants \\ freshenLC a ` (a_fresh ant) \\ subst_lconsts s = {})\n \\ eff (NatRule rule) entail hyps\"\n by (drule eff.intros(2)) simp_all\nend\n\ncontext Abstract_Task begin\nlemma natEff_InstI:\n \"rule = (r,c)\n \\ c \\ set (consequent r)\n \\ antec = f_antecedent r\n \\ natEff_Inst rule c antec\"\n by (metis natEff_Inst.intros)\nend\n\ncontext begin\n\ntext \\A typical task with local constants:: @{text \"\\x. Q x \\ Q x\"}\\\n\ntext \\First the task is defined as an @{term Abstract_Task}.\\\n\ninterpretation task: Abstract_Task\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n antecedent\n consequent\n prop_rules\n \"[]\"\n \"[ForallX (imp (Q x) (Q x))]\"\nby unfold_locales auto\n\ntext \\Then we show, that this task has a proof within our formalization of natural deduction\n by giving a concrete proof tree.\\\n\nabbreviation lx :: \"nat\" where \"lx \\ to_nat (1::nat,0::nat)\"\n\nabbreviation base_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"base_tree \\ Node ({|Q (LC lx)|} \\ Q (LC lx), Axiom) {||}\"\n\nabbreviation imp_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"imp_tree \\ Node ({||} \\ imp (Q (LC lx)) (Q (LC lx)), NatRule (impI, imp X Y)) {|base_tree|}\"\n\nabbreviation solution_tree :: \"((form fset \\ form) \\ (prop_rule \\ form) NatRule) tree\" where\n \"solution_tree \\ Node ({||} \\ ForallX (imp (Q x) (Q x)), NatRule (allI, ForallX (P x))) {|imp_tree|}\"\n\nabbreviation s1 where \"s1 \\ [(12, ([9], imp (Q x) (Q x)))] \"\nabbreviation s2 where \"s2 \\ [(10, ([], Q (LC lx))), (11, ([], Q (LC lx)))] \"\n\nlemma fv_subst_s1[simp]: \"fv_subst s1 = {}\"\n by (simp add: fv_subst_def)\n\nlemma subst1_simps[simp]:\n \"subst s1 (P (LC n)) = imp (Q (LC n)) (Q (LC n))\"\n \"subst s1 (ForallX (P x)) = ForallX (imp (Q x) (Q x))\"\n by simp_all\n\nlemma subst2_simps[simp]:\n \"subst s2 X = Q (LC lx)\" \n \"subst s2 Y = Q (LC lx)\"\n \"subst s2 (imp X Y) = imp (subst s2 X) (subst s2 Y)\"\n by simp_all\n\nlemma substI1: \"ForallX (imp (Q x) (Q x)) = subst s1 (predicate.freshen 1 (ForallX (P x)))\"\n by (auto simp add: predicate.freshen_def Let_def)\n\nlemma substI2: \"imp (Q (LC lx)) (Q (LC lx)) = subst s2 (predicate.freshen 2 (imp X Y))\"\n by (auto simp add: predicate.freshen_def Let_def)\n\ndeclare subst.simps[simp del]\n\nlemma \"task.solved\"\n unfolding task.solved_def\napply clarsimp\napply (rule_tac x=\"{||}\" in exI)\napply clarsimp\napply (rule_tac x=\"solution_tree\" in exI)\napply clarsimp\napply (rule conjI)\n\n apply (rule task.wf)\n apply (solves \\(auto simp add: stream.set_map task.n_rules_def)[1]\\)\n apply clarsimp\n apply (rule task.eff_NatRuleI)\n apply (solves \\rule task.natEff_Inst.intros;simp\\)\n apply clarsimp \n apply (rule conjI)\n apply (solves \\simp\\)\n apply (solves \\rule substI1\\)\n apply (simp add: predicate.f_antecedent_def predicate.freshen_def)\n apply (subst antecedent.sel(2))\n apply (solves \\simp\\)\n apply (solves \\simp\\)\n apply (solves \\simp\\)\n apply simp\n\n apply (rule task.wf)\n apply (solves \\(auto simp add: stream.set_map task.n_rules_def)[1]\\)\n apply clarsimp\n apply (rule task.eff_NatRuleI)\n apply (solves \\rule task.natEff_Inst.intros; simp\\)\n apply clarsimp \n apply (rule conjI)\n apply (solves \\simp\\)\n apply (solves \\rule substI2\\)\n apply (solves \\simp add: predicate.f_antecedent_def predicate.freshen_def\\)\n apply (solves \\simp\\)\n apply (solves \\simp add: predicate.f_antecedent_def\\)\n apply simp\n\n apply (solves \\(auto intro: task.wf intro!: task.eff.intros(1))[1]\\)\napply (solves \\(rule tfinite.intros, simp)+\\)\ndone\n\nabbreviation vertices where \"vertices \\ {|0::nat,1,2 |}\"\nfun nodeOf where \n \"nodeOf n = [Conclusion (ForallX (imp (Q x) (Q x))), \n Rule allI, \n Rule impI] ! n \"\n\nfun inst where \n \"inst n = [[],s1,s2] ! n\"\n\n\ninterpretation task: Vertex_Graph task.nodes task.inPorts task.outPorts vertices nodeOf.\n\nabbreviation e1 :: \"(nat, form, nat) edge'\"\n where \"e1 \\ ((1,Reg (ForallX (P x))), (0,plain_ant (ForallX (imp (Q x) (Q x)))))\"\nabbreviation e2 :: \"(nat, form, nat) edge'\"\n where \"e2 \\ ((2,Reg (imp X Y)), (1,allI_input))\"\nabbreviation e3 :: \"(nat, form, nat) edge'\"\n where \"e3 \\ ((2,Hyp X (impI_input)), (2,impI_input))\"\nabbreviation task_edges :: \"(nat, form, nat) edge' set\" where \"task_edges \\ {e1, e2, e3}\"\n\n\ninterpretation task: Scoped_Graph task.nodes task.inPorts task.outPorts vertices nodeOf task_edges task.hyps\n by standard (auto simp add: predicate.f_consequent_def predicate.f_antecedent_def)\n\ninterpretation task: Instantiation\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n task_edges\n vertices\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n \"id\"\n \"inst\"\nby unfold_locales simp\n\ntext \\Finally we can also show that there is a proof graph for this task.\\\n\ninterpretation Well_Scoped_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\nby standard (auto split: if_splits)\n\nlemma no_path_01[simp]: \"task.path 0 v pth \\ (pth = [] \\ v = 0)\"\n by (cases pth) (auto simp add: task.path_cons_simp)\nlemma no_path_12[simp]: \"\\ task.path 1 2 pth\"\n by (cases pth) (auto simp add: task.path_cons_simp)\n\ninterpretation Acyclic_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\nproof\n fix v pth \n assume \"task.path v v pth\" and \"task.hyps_free pth\"\n thus \"pth = []\"\n by (cases pth) (auto simp add: task.path_cons_simp predicate.f_antecedent_def)\nqed\n\ninterpretation Saturated_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\nby standard\n (auto simp add: predicate.f_consequent_def predicate.f_antecedent_def) \n\ninterpretation Pruned_Port_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\nproof\n fix v\n assume \"v |\\| vertices\"\n hence \"\\ pth. task.path v 0 pth\"\n apply auto\n apply (rule exI[where x = \"[e1]\"], auto simp add: task.path_cons_simp)\n apply (rule exI[where x = \"[e2,e1]\"], auto simp add: task.path_cons_simp)\n done\n moreover\n have \"task.terminal_vertex 0\" by auto\n ultimately\n show \"\\pth v'. task.path v v' pth \\ task.terminal_vertex v'\" by blast\nqed\n\ninterpretation Well_Shaped_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf task_edges\n task.hyps\n..\n\ninterpretation Solution\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n vertices\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n id\n inst\n task_edges\nby standard\n (auto simp add: task.labelAtOut_def task.labelAtIn_def predicate.freshen_def, subst antecedent.sel, simp)\n\ninterpretation Proof_Graph\n task.nodes\n task.inPorts\n task.outPorts\n vertices\n nodeOf\n task_edges\n task.hyps\n task.labelsIn\n task.labelsOut\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n id\n inst\n..\n\nlemma path_20:\n assumes \"task.path 2 0 pth\"\n shows \"(1, allI_input) \\ snd ` set pth\"\nproof-\n { fix v\n assume \"task.path v 0 pth\"\n hence \"v = 0 \\ v = 1 \\ (1, allI_input) \\ snd ` set pth\"\n by (induction v \"0::nat\" pth rule: task.path.induct) auto\n }\n from this[OF assms]\n show ?thesis by auto\nqed\n\nlemma scope_21: \"2 \\ task.scope (1, allI_input)\"\n by (auto intro!: task.scope.intros elim: path_20 simp add: task.outPortsRule_def predicate.f_antecedent_def predicate.f_consequent_def)\n\ninterpretation Scoped_Proof_Graph\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n task.inPorts\n task.outPorts\n nodeOf\n task.hyps\n task.nodes\n vertices\n task.labelsIn\n task.labelsOut\n id\n inst\n task_edges\n task.local_vars\nby standard (auto simp add: predicate.f_antecedent_def scope_21)\n\ninterpretation Tasked_Proof_Graph\n \"curry to_nat :: nat \\ var \\ var\"\n map_lc\n lc\n \"closed\"\n subst\n lc_subst\n map_lc_subst\n \"Var 0 []\"\n antecedent\n consequent\n prop_rules\n \"[]\"\n \"[ForallX (imp (Q x) (Q x))]\"\n vertices\n nodeOf\n task_edges\n id\n inst\nby unfold_locales auto\n\nend\n\nend", "meta": {"author": "nomeata", "repo": "isa-incredible", "sha": "10eb1d938879778196cc69bf86b1ed0d979512cc", "save_path": "github-repos/isabelle/nomeata-isa-incredible", "path": "github-repos/isabelle/nomeata-isa-incredible/isa-incredible-10eb1d938879778196cc69bf86b1ed0d979512cc/Incredible_Predicate_Tasks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2638512725916295}} {"text": "(* \n Title: Psi-calculi \n Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Sim_Pres\n imports Sim_Pres Weak_Simulation Weak_Stat_Imp\nbegin\n\ncontext env begin\n\nlemma weak_inputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes PRelQ: \"\\Tvec \\'. length xvec = length Tvec \\ (\\ \\ \\', P[xvec::=Tvec], Q[xvec::=Tvec]) \\ Rel\"\n\n shows \"\\ \\ M\\\\*xvec N\\.P \\ M\\\\*xvec N\\.Q\"\nproof(induct rule: weakSimI2)\n case(c_act \\' \\ \\ Q')\n from `\\ \\ M\\\\*xvec N\\.Q \\\\ @ \\ \\ Q'` show ?case\n proof(induct rule: input_cases)\n case(c_input K Tvec)\n from `\\ \\ K \\ M` `set xvec \\ supp N` `length xvec = length Tvec` `distinct xvec`\n have \"\\ : (M\\\\*xvec N\\.Q) \\ M\\\\*xvec N\\.P \\Some(\\\\; \\, M\\) @ K\\(N[xvec::=Tvec])\\ \\ (P[xvec::=Tvec])\"\n by(rule_tac weak_input) auto\n moreover have \"\\ \\ \\' \\ P[xvec::=Tvec] \\\\<^sup>^\\<^sub>\\ P[xvec::=Tvec]\" by simp\n moreover from `length xvec = length Tvec` have \"(\\ \\ \\', P[xvec::=Tvec], Q[xvec::=Tvec]) \\ Rel\"\n by(rule PRelQ)\n ultimately show ?case by blast\n qed\nnext\n case(c_tau Q')\n from `\\ \\ M\\\\*xvec N\\.Q \\None @ \\ \\ Q'` have False by auto\n thus ?case by simp\nqed\n\nlemma weak_outputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes PRelQ: \"\\\\'. (\\ \\ \\', P, Q) \\ Rel\"\n\n shows \"\\ \\ M\\N\\.P \\ M\\N\\.Q\"\nproof(induct rule: weakSimI2)\n case(c_act \\' \\ \\ Q')\n from `\\ \\ M\\N\\.Q \\\\ @ \\ \\ Q'` show ?case\n proof(induct rule: output_cases)\n case(c_output K)\n from `\\ \\ M \\ K` \n have \"\\ : (M\\N\\.Q) \\ M\\N\\.P \\Some(\\\\; \\, M\\) @ K\\N\\ \\ P\" by(rule weak_output) auto\n moreover have \"\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P\" by simp\n moreover have \"(\\ \\ \\', P, Q) \\ Rel\" by(rule PRelQ)\n ultimately show ?case by blast\n qed\nnext\n case(c_tau Q')\n from `\\ \\ M\\N\\.Q \\None @ \\ \\ Q'` have False by auto\n thus ?case by simp\nqed\n\nlemma res_tau_cases[consumes 3, case_names c_res]:\n fixes \\ :: 'b\n and x :: name\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assumes Trans: \"\\ \\ \\\\x\\P \\None @ \\ \\ P'\"\n and \"x \\ \\\"\n and \"x \\ P'\"\n and rScope: \"\\P'. \\\\ \\ P \\None @ \\ \\ P'\\ \\ Prop (\\\\x\\P')\"\n\n shows \"Prop P'\"\nproof -\n note Trans `x \\ \\`\n moreover have \"x \\ (\\)\" by simp\n moreover note `x \\ P'`\n moreover have \"bn(\\) \\* \\\" and \"bn(\\) \\* P\" and \"bn(\\) \\* subject(\\)\" and \"bn(\\) = []\" by simp+\n ultimately show ?thesis\n by(induct rule: res_cases) (auto intro: rScope dest: tau_no_provenance')\nqed\n\nthm output_provenance\n\nlemma weak_output_provenance_Some:\n assumes \"\\ : Q \\ P \\\\ @ M\\\\*xvec\\\\N\\ \\ P''\"\n shows \"\\\\'. \\ = Some \\'\"\n using assms\n by(auto elim!: weak_transitionE dest!: output_provenance\n simp add: residual_inject)\n\nlemma weakResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes PSimQ: \"\\ \\ P \\ Q\"\n and \"eqvt Rel'\"\n and \"x \\ \\\"\n and \"Rel \\ Rel'\"\n and C1: \"\\\\' R S y. \\(\\', R, S) \\ Rel; y \\ \\'\\ \\ (\\', \\\\y\\R, \\\\y\\S) \\ Rel'\"\n\n shows \"\\ \\ \\\\x\\P \\ \\\\x\\Q\"\nproof -\n note `eqvt Rel'` `x \\ \\`\n moreover have \"x \\ \\\\x\\P\" and \"x \\ \\\\x\\Q\" by(simp add: abs_fresh)+ \n ultimately show ?thesis\n proof(induct rule: weakSimIFresh[of _ _ _ _ _ \"()\"])\n case(c_act \\ \\ Q' \\')\n from `bn \\ \\* \\\\x\\P` `bn \\ \\* \\\\x\\Q` `x \\ \\` have \"bn \\ \\* P\" and \"bn \\ \\* Q\" by simp+\n from `\\ \\ \\\\x\\Q \\\\ @ \\ \\ Q'` `x \\ \\` `x \\ \\` `x \\ Q'` `bn \\ \\* \\` `bn \\ \\* Q` `bn \\ \\* subject \\` `bn \\ \\* P` `x \\ \\`\n show ?case\n proof(induct rule: res_cases)\n case(c_open M \\ xvec1 xvec2 y N Q')\n from `bn(M\\\\*(xvec1@y#xvec2)\\\\N\\) \\* P` have \"xvec1 \\* P\" and \"xvec2 \\* P\" and \"y \\ P\" by simp+\n from `x \\ (M\\\\*(xvec1@y#xvec2)\\\\N\\)` have \"x \\ xvec1\" and \"x \\ y\" and \"x \\ xvec2\" and \"x \\ M\" by simp+\n from PSimQ `\\ \\ Q \\Some \\ @ M\\\\*(xvec1@xvec2)\\\\([(x, y)] \\ N)\\ \\ ([(x, y)] \\ Q')` `xvec1 \\* \\` `xvec2 \\* \\` `xvec1 \\* P` `xvec2 \\* P` `\\ \\ \\`\n obtain P'' P' \\' where PTrans: \"\\ : Q \\ P \\\\' @ M\\\\*(xvec1@xvec2)\\\\([(x, y)] \\ N)\\ \\ P''\"\n and P''Chain: \"\\ \\ ([(x, y)] \\ \\') \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\ \\ ([(x, y)] \\ \\'), P', ([(x, y)] \\ Q')) \\ Rel\"\n by (fastforce dest: weakSimE)\n from PTrans obtain \\'' where \\': \"\\' = Some \\''\"\n by(blast dest: weak_output_provenance_Some)\n from PTrans have \"([(x, y)] \\ \\) : ([(x, y)] \\ Q) \\ ([(x, y)] \\ P) \\([(x, y)] \\ \\') @ ([(x, y)] \\ (M\\\\*(xvec1@xvec2)\\\\([(x, y)] \\ N)\\)) \\ ([(x, y)] \\ P'')\"\n by(rule eqvts)\n with `x \\ \\` `y \\ \\` `x \\ M` `y \\ M` `x \\ xvec1` `y \\ xvec1` `x \\ xvec2` `y \\ xvec2`\n have \"\\ : ([(x, y)] \\ Q) \\ ([(x, y)] \\ P) \\Some([(x, y)] \\ \\'') @ M\\\\*(xvec1@xvec2)\\\\N\\ \\ ([(x, y)] \\ P'')\"\n by(simp add: eqvts \\')\n hence \"\\ : \\\\y\\([(x, y)] \\ Q) \\ \\\\y\\([(x, y)] \\ P) \\Some(\\\\y\\([(x, y)] \\ \\'')) @ M\\\\*(xvec1@y#xvec2)\\\\N\\ \\ ([(x, y)] \\ P'')\"\n using `y \\ supp N` `y \\ \\` `y \\ M` `y \\ xvec1` `y \\ xvec2`\n by(rule weak_open)\n with `y \\ P` `y \\ Q` have \"\\ : \\\\x\\Q \\ \\\\x\\P \\Some(\\\\y\\([(x, y)] \\ \\'')) @ M\\\\*(xvec1@y#xvec2)\\\\N\\ \\ ([(x, y)] \\ P'')\"\n by(simp add: alpha_res)\n moreover from P''Chain have \"([(x, y)] \\ (\\ \\ ([(x, y)] \\ \\'))) \\ ([(x, y)] \\ P'') \\\\<^sup>^\\<^sub>\\ ([(x, y)] \\ P')\"\n by(rule eqvts)\n with `x \\ \\` `y \\ \\` have \"\\ \\ \\' \\ ([(x, y)] \\ P'') \\\\<^sup>^\\<^sub>\\ ([(x, y)] \\ P')\" by(simp add: eqvts)\n moreover from P'RelQ' `Rel \\ Rel'` have \"(\\ \\ ([(x, y)] \\ \\'), P', ([(x, y)] \\ Q')) \\ Rel'\" by auto\n with `eqvt Rel'` have \"([(x, y)] \\ (\\ \\ ([(x, y)] \\ \\'), P', ([(x, y)] \\ Q'))) \\ Rel'\" by(rule eqvtI)\n with `x \\ \\` `y \\ \\` have \" (\\ \\ \\', [(x, y)] \\ P', Q') \\ Rel'\" by(simp add: eqvts)\n ultimately show ?case by blast\n next\n case(c_res \\ Q')\n from PSimQ `\\ \\ Q \\\\ @ \\ \\ Q'` `bn \\ \\* \\` `bn \\ \\* P` `\\ \\ \\`\n obtain P'' P' \\' where PTrans: \"\\ : Q \\ P \\\\' @ \\ \\ P''\"\n and P''Chain: \"\\ \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\ \\ \\', P', Q') \\ Rel\"\n by(blast dest: weakSimE)\n from PTrans `x \\ \\` `x \\ \\` have \"\\ : \\\\x\\Q \\ \\\\x\\P \\map_option (F_res x) \\' @ \\ \\ \\\\x\\P''\"\n by(rule_tac weak_scope)\n moreover from P''Chain `x \\ \\` `x \\ \\'` have \"\\ \\ \\' \\ \\\\x\\P'' \\\\<^sup>^\\<^sub>\\ \\\\x\\P'\"\n by(rule_tac tau_chain_res_pres) auto\n moreover from P'RelQ' `x \\ \\` `x \\ \\'` have \"(\\ \\ \\', \\\\x\\P', \\\\x\\Q') \\ Rel'\" \n apply(rule_tac C1) by(auto simp add: fresh_left calc_atm)\n ultimately show ?case by blast\n qed\n next\n case(c_tau Q')\n from `\\ \\ \\\\x\\Q \\None @ \\ \\ Q'` `x \\ \\` `x \\ Q'`\n show ?case\n proof(induct rule: res_tau_cases)\n case(c_res Q')\n from PSimQ `\\ \\ Q \\None @ \\ \\ Q'` obtain P' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\" \n by(blast dest: weakSimE)\n from PChain `x \\ \\` have \"\\ \\ \\\\x\\P \\\\<^sup>^\\<^sub>\\ \\\\x\\P'\" by(rule tau_chain_res_pres)\n moreover from P'RelQ' `x \\ \\` have \"(\\, \\\\x\\P', \\\\x\\Q') \\ Rel'\" by(rule C1)\n ultimately show ?case by blast\n qed\n qed\nqed\n\nlemma weakResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes PSimQ: \"\\ \\ P \\ Q\"\n and \"eqvt Rel\"\n and \"xvec \\* \\\"\n and C1: \"\\\\' R S yvec. \\(\\', R, S) \\ Rel; yvec \\* \\'\\ \\ (\\', \\\\*yvec\\R, \\\\*yvec\\S) \\ Rel\"\n\n shows \"\\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q\"\nusing `xvec \\* \\`\nproof(induct xvec)\n case Nil\n from PSimQ show ?case by simp\nnext\n case(Cons x xvec)\n from `(x#xvec) \\* \\` have \"x \\ \\\" and \"xvec \\* \\\" by simp+\n from `xvec \\* \\ \\ \\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q` `xvec \\* \\`\n have \"\\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q\" by simp\n moreover note `eqvt Rel` `x \\ \\`\n moreover have \"Rel \\ Rel\" by simp\n moreover have \"\\\\ P Q x. \\(\\, P, Q) \\ Rel; x \\ \\\\ \\ (\\, \\\\*[x]\\P, \\\\*[x]\\Q) \\ Rel\"\n by(rule_tac yvec=\"[x]\" in C1) auto\n hence \"\\\\ P Q x. \\(\\, P, Q) \\ Rel; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ Rel\"\n by simp\n ultimately have \"\\ \\ \\\\x\\(\\\\*xvec\\P) \\ \\\\x\\(\\\\*xvec\\Q)\"\n by(rule weakResPres)\n thus ?case by simp\nqed\n\nlemma parTauCases[consumes 1, case_names c_par1 c_par2 c_comm1 c_comm2]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assumes Trans: \"\\ \\ P \\ Q \\None @ \\ \\ R\"\n and rPar1: \"\\P' A\\<^sub>Q \\\\<^sub>Q. \\\\ \\ \\\\<^sub>Q \\ P \\None @ \\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n A\\<^sub>Q \\* \\; A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* C\\ \\ Prop (P' \\ Q)\"\n and rPar2: \"\\Q' A\\<^sub>P \\\\<^sub>P. \\\\ \\ \\\\<^sub>P \\ Q \\None @ \\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* C\\ \\ Prop (P \\ Q')\"\n and rComm1: \"\\\\\\<^sub>Q M N P' A\\<^sub>P \\\\<^sub>P K xvec Q' A\\<^sub>Q yvec zvec.\n \\\\ \\ \\\\<^sub>Q \\ P \\Some(\\A\\<^sub>P; yvec, K\\) @ M\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\Some(\\A\\<^sub>Q; zvec, M\\) @ K\\\\*xvec\\\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n distinct xvec; distinct yvec; distinct zvec;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; A\\<^sub>P \\* Q; A\\<^sub>P \\* xvec; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* C; \n A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; A\\<^sub>Q \\* P; A\\<^sub>Q \\* K; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* xvec; A\\<^sub>Q \\* Q'; A\\<^sub>Q \\* C; \n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* P; xvec \\* M; xvec \\* K; xvec \\* Q; xvec \\* \\\\<^sub>Q; xvec \\* C; yvec \\* C; zvec \\* C;\n yvec \\* \\; yvec \\* \\\\<^sub>P; yvec \\* \\\\<^sub>Q; yvec \\* P; yvec \\* M; yvec \\* xvec;\n yvec \\* Q; yvec \\* A\\<^sub>P; yvec \\* A\\<^sub>Q; yvec \\* P'; yvec \\* Q'; yvec \\* zvec;\n zvec \\* \\; zvec \\* \\\\<^sub>P; zvec \\* \\\\<^sub>Q; zvec \\* P; zvec \\* K; zvec \\* xvec;\n zvec \\* Q; zvec \\* A\\<^sub>P; zvec \\* A\\<^sub>Q; zvec \\* P'; zvec \\* Q'\\ \\\n Prop (\\\\*xvec\\(P' \\ Q'))\"\n and rComm2: \"\\\\\\<^sub>Q M xvec N P' A\\<^sub>P \\\\<^sub>P K Q' A\\<^sub>Q yvec zvec.\n \\\\ \\ \\\\<^sub>Q \\ P \\Some(\\A\\<^sub>P; yvec, K\\) @ M\\\\*xvec\\\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\Some(\\A\\<^sub>Q; zvec, M\\) @ K\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n distinct xvec; distinct yvec; distinct zvec;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; A\\<^sub>P \\* Q; A\\<^sub>P \\* xvec; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* C; \n A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; A\\<^sub>Q \\* P; A\\<^sub>Q \\* K; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* xvec; A\\<^sub>Q \\* Q'; A\\<^sub>Q \\* C; \n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* P; xvec \\* M; xvec \\* K; xvec \\* Q; xvec \\* \\\\<^sub>Q; xvec \\* C; yvec \\* C; zvec \\* C;\n yvec \\* \\; yvec \\* \\\\<^sub>P; yvec \\* \\\\<^sub>Q; yvec \\* P; yvec \\* M; yvec \\* xvec;\n yvec \\* Q; yvec \\* A\\<^sub>P; yvec \\* A\\<^sub>Q; yvec \\* P'; yvec \\* Q'; yvec \\* zvec;\n zvec \\* \\; zvec \\* \\\\<^sub>P; zvec \\* \\\\<^sub>Q; zvec \\* P; zvec \\* K; zvec \\* xvec;\n zvec \\* Q; zvec \\* A\\<^sub>P; zvec \\* A\\<^sub>Q; zvec \\* P'; zvec \\* Q'\\ \\\n Prop (\\\\*xvec\\(P' \\ Q'))\"\n\n shows \"Prop R\"\nproof -\n from Trans obtain \\ where \"\\ \\ P \\ Q \\None @ \\ \\ R\" and \"bn \\ \\* \\\" and \"bn \\ \\* P\" and \"bn \\ \\* Q\" and \"bn \\ \\* subject \\\" and \"\\ = \\\" by auto\n thus ?thesis using rPar1 rPar2 rComm1 rComm2\n by(induct rule: par_cases[where C=C]) (auto simp add: residual_inject dest: tau_no_provenance'')\nqed\n\nlemma weakParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n \n assumes PRelQ: \"\\A\\<^sub>R \\\\<^sub>R. \\extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q\\ \\ (\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" \n and Eqvt: \"eqvt Rel\"\n and Eqvt': \"eqvt Rel'\"\n\n and Sim: \"\\\\' S T. (\\', S, T) \\ Rel \\ \\' \\ S \\ T\"\n and Sym: \"\\\\' S T. (\\', S, T) \\ Rel \\ (\\', T, S) \\ Rel\"\n and Ext: \"\\\\' S T \\'. \\(\\', S, T) \\ Rel\\ \\ (\\' \\ \\'', S, T) \\ Rel\"\n and StatImp: \"\\\\' S T. (\\', S, T) \\ Rel \\ \\' \\ S \\ T\"\n and C1: \"\\\\' S T A\\<^sub>U \\\\<^sub>U U. \\(\\' \\ \\\\<^sub>U, S, T) \\ Rel; extract_frame U = \\A\\<^sub>U, \\\\<^sub>U\\; A\\<^sub>U \\* \\'; A\\<^sub>U \\* S; A\\<^sub>U \\* T\\ \\ (\\', S \\ U, T \\ U) \\ Rel'\"\n and C2: \"\\\\' S T xvec. \\(\\', S, T) \\ Rel'; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel'\"\n and C3: \"\\\\' S T \\''. \\(\\', S, T) \\ Rel; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nproof -\n from Eqvt' show ?thesis\n proof(induct rule: weakSimI[where C=\"()\"])\n case(c_act \\' \\ \\ QR)\n from `bn \\ \\* (P \\ R)` `bn \\ \\* (Q \\ R)`\n have \"bn \\ \\* P\" and \"bn \\ \\* Q\" and \"bn \\ \\* R\"\n by simp+\n from `\\ \\ Q \\ R \\\\ @ \\ \\ QR` `bn \\ \\* \\` `bn \\ \\* Q` `bn \\ \\* R` `bn \\ \\* subject \\` `\\ \\ \\` show ?case\n proof(induct rule: par_cases[where C=\"(P, R, \\')\"])\n case(c_par1 Q' \\ A\\<^sub>R \\\\<^sub>R)\n from `A\\<^sub>R \\* (P, R, \\')` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* \\'\" by simp+\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from `A\\<^sub>R \\* \\` `bn \\ \\* R` FrR\n have \"bn \\ \\* \\\\<^sub>R\" by(drule_tac extract_frame_fresh_chain) auto\n have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\\\ @ \\ \\ Q'\" by fact\n from FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` have \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n by(blast intro: PRelQ Sim)\n then obtain P'' P' \\' where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\\\' @ \\ \\ P''\"\n and P''Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"((\\ \\ \\\\<^sub>R) \\ \\', P', Q') \\ Rel\"\n using QTrans `bn \\ \\* \\` `bn \\ \\* \\\\<^sub>R` `bn \\ \\* P` `bn \\ \\* R` `A\\<^sub>R \\* \\` `\\ \\ \\`\n by(drule_tac \\'=\\' in weakSimE(1)) auto\n\n from PTrans QTrans `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\` `bn \\ \\* subject \\` `distinct(bn \\)` \n have \"A\\<^sub>R \\* P''\" and \"A\\<^sub>R \\* Q'\"\n by(fastforce dest: weak_fresh_chain_derivative free_fresh_chain_derivative)+\n with P''Chain have \"A\\<^sub>R \\* P'\" by(force dest: tau_chain_fresh_chain)\n \n from PTrans FrR `bn \\ \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* Q` \n have \"\\ : Q \\ R \\ P \\ R \\append_at_end_prov_option \\' A\\<^sub>R @ \\ \\ (P'' \\ R)\"\n by(rule_tac weak_par1)\n moreover from P''Chain have \"(\\ \\ \\') \\ \\\\<^sub>R \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" \n by(metis tau_chain_stat_eq Associativity Commutativity Composition)\n with FrR have \"\\ \\ \\' \\ P'' \\ R \\\\<^sup>^\\<^sub>\\ P' \\ R\" using `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\'` `A\\<^sub>R \\* P''`\n by(rule_tac tau_chain_par1) auto\n \n moreover from P'RelQ' have \"((\\ \\ \\') \\ \\\\<^sub>R, P', Q') \\ Rel\" \n by(metis C3 composition_sym Associativity Commutativity)\n hence \"(\\ \\ \\', P' \\ R, Q' \\ R) \\ Rel'\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\'` `A\\<^sub>R \\* P'` `A\\<^sub>R \\* Q'`\n by(rule_tac C1) auto\n ultimately show ?case by blast\n next\n case(c_par2 R' \\ A\\<^sub>Q \\\\<^sub>Q)\n from `A\\<^sub>Q \\* (P, R, \\')` have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" and \"A\\<^sub>Q \\* \\'\" by simp+\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, \\, R)\"\n by(rule fresh_frame)\n hence \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>Q\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* R\"\n by simp+\n\n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from `A\\<^sub>Q \\* P` FrP `A\\<^sub>P \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>P\"\n by(drule_tac extract_frame_fresh_chain) auto\n\n from FrP FrQ `bn \\ \\* P` `bn \\ \\* Q` `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\`\n have \"bn \\ \\* \\\\<^sub>P\" and \"bn \\ \\* \\\\<^sub>Q\"\n by(force dest: extract_frame_fresh_chain)+\n \n obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* (\\, P, Q, A\\<^sub>Q, A\\<^sub>P, \\\\<^sub>Q, \\\\<^sub>P, \\, R, \\')\" \n and \"distinct A\\<^sub>R\"\n by(rule fresh_frame)\n then have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>R \\* \\\\<^sub>P\"\n and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* R\" and \"A\\<^sub>R \\* \\'\"\n by simp+\n\n from `A\\<^sub>Q \\* R` FrR `A\\<^sub>R \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>R\" by(drule_tac extract_frame_fresh_chain) auto\n from `A\\<^sub>P \\* R` `A\\<^sub>R \\* A\\<^sub>P` FrR have \"A\\<^sub>P \\* \\\\<^sub>R\" by(drule_tac extract_frame_fresh_chain) auto\n\n moreover from `\\ \\ \\\\<^sub>Q \\ R \\\\ @ \\ \\ R'` FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\'`\n `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* Q` `bn \\ \\* R` `bn \\ \\* subject \\` `distinct(bn \\)`\n obtain p \\'' A\\<^sub>R' \\\\<^sub>R' where S: \"set p \\ set(bn \\) \\ set(bn(p \\ \\))\" and \"(p \\ \\\\<^sub>R) \\ \\'' \\ \\\\<^sub>R'\"\n and FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"bn(p \\ \\) \\* \\\" and \"bn(p \\ \\) \\* P\" and \"bn(p \\ \\) \\* Q\"\n and \"A\\<^sub>R' \\* \\\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\'\" and \"distinct_perm p\"\n by(rule_tac C=\"(\\, \\', P, Q)\" and C'=\"(\\, P, Q)\" in expand_frame) (assumption | simp)+\n\n from FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q`\n have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule PRelQ)\n hence \"(\\ \\ \\\\<^sub>R, Q, P) \\ Rel\" by(rule Sym)\n hence \"\\ \\ \\\\<^sub>R \\ Q \\ P\" by(rule StatImp)\n then obtain P' P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and QimpP': \"insert_assertion(extract_frame Q) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insert_assertion(extract_frame P') (\\ \\ \\\\<^sub>R)\"\n and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ ((p \\ \\'') \\ (p \\ \\')) \\ P' \\\\<^sup>^\\<^sub>\\ P''\"\n and P'RelQ: \"((\\ \\ \\\\<^sub>R) \\ ((p \\ \\'') \\ (p \\ \\')), Q, P'') \\ Rel\"\n by(rule weak_stat_impE)\n obtain A\\<^sub>P' \\\\<^sub>P' where FrP': \"extract_frame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"A\\<^sub>P' \\* \\\" and \"A\\<^sub>P' \\* \\\\<^sub>R\" and \"A\\<^sub>P' \\* \\\\<^sub>Q\"\n and \"A\\<^sub>P' \\* A\\<^sub>Q\" and \"A\\<^sub>P' \\* R\" and \"A\\<^sub>P' \\* A\\<^sub>R\" and \"A\\<^sub>P' \\* \\\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, \\\\<^sub>Q, A\\<^sub>Q, R, A\\<^sub>R, \\)\" in fresh_frame) auto\n\n from PChain `A\\<^sub>R \\* P` `A\\<^sub>Q \\* P` `bn \\ \\* P` have \"A\\<^sub>Q \\* P'\" and \"A\\<^sub>R \\* P'\" and \"bn \\ \\* P'\"\n by(force intro: tau_chain_fresh_chain)+\n from `A\\<^sub>R \\* P'` `A\\<^sub>P' \\* A\\<^sub>R` `A\\<^sub>Q \\* P'` `A\\<^sub>P' \\* A\\<^sub>Q` FrP' have \"A\\<^sub>Q \\* \\\\<^sub>P'\" and \"A\\<^sub>R \\* \\\\<^sub>P'\"\n by(force dest: extract_frame_fresh_chain)+\n\n from PChain FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P' \\ R\" by(rule tau_chain_par1)\n moreover have \"insert_assertion (extract_frame(Q \\ R)) \\ \\\\<^sub>F insert_assertion(extract_frame(P' \\ R)) \\\"\n proof -\n have \"\\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by(metis Associativity Composition Commutativity Assertion_stat_eq_trans Assertion_stat_eq_sym frame_nil_stat_eq frame_res_chain_pres)\n moreover from QimpP' FrQ FrP' `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>P' \\* \\\\<^sub>R` `A\\<^sub>P' \\* \\` `A\\<^sub>Q \\* \\` \n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\\" using fresh_comp_chain by simp\n moreover have \"\\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\A\\<^sub>P', \\ \\ \\\\<^sub>P' \\ \\\\<^sub>R\\\"\n by(metis Associativity Composition Commutativity Assertion_stat_eq_trans Assertion_stat_eq_sym frame_nil_stat_eq frame_res_chain_pres)\n ultimately have \"\\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P', \\ \\ \\\\<^sub>P' \\ \\\\<^sub>R\\\"\n by(rule Frame_stat_eq_imp_compose)\n hence \"\\(A\\<^sub>R@A\\<^sub>Q), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>R@A\\<^sub>P'), \\ \\ \\\\<^sub>P' \\ \\\\<^sub>R\\\"\n by(force intro: frame_imp_res_chain_pres simp add: frame_chain_append)\n with FrQ FrR FrP' `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>P' \\* A\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>P'` `A\\<^sub>P' \\* \\\\<^sub>R` \n `A\\<^sub>P' \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>R \\* \\` \n show ?thesis\n by(simp add: frame_chain_append) (metis frame_imp_chain_comm Frame_stat_imp_trans)\n qed\n moreover have RTrans: \"\\ \\ \\\\<^sub>P' \\ R \\\\ @ \\ \\ R'\"\n proof -\n have \"\\ \\ \\\\<^sub>Q \\ R \\\\ @ \\ \\ R'\" by fact\n moreover have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by(metis frame_int_associativity Commutativity Frame_stat_eq_trans frame_int_composition_sym Frame_stat_eq_sym)\n moreover with FrP' FrQ QimpP' `A\\<^sub>P' \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>P' \\* \\\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R`\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\\" using fresh_comp_chain\n by simp\n moreover have \"\\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n by(metis frame_int_associativity Commutativity Frame_stat_eq_trans frame_int_composition_sym frame_int_associativity[THEN Frame_stat_eq_sym])\n ultimately show ?thesis\n by(rule Frame_stat_eq_imp_compose)\n qed\n ultimately show ?thesis\n using `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>P'` `A\\<^sub>P' \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>P' \\* \\` `A\\<^sub>Q \\* \\`\n `A\\<^sub>P' \\* A\\<^sub>R` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>P'` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P'` `A\\<^sub>Q \\* \\\\<^sub>P'` FrR `distinct A\\<^sub>R`\n by(force intro: transfer_frame)\n qed\n hence \"\\ \\ P' \\ R \\append_at_front_prov_option \\ A\\<^sub>P' @ \\ \\ (P' \\ R')\" using FrP' `bn \\ \\* P'` `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* R` `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* \\`\n by(rule_tac Par2)\n ultimately have \"\\ : (Q \\ R) \\ P \\ R \\append_at_front_prov_option \\ A\\<^sub>P' @ \\ \\ (P' \\ R')\"\n by(rule_tac weak_transitionI)\n moreover from PChain P'Chain `bn \\ \\* P'` `bn(p \\ \\) \\* P` `A\\<^sub>R' \\* P` \n have \"bn \\ \\* P''\" and \"bn(p \\ \\) \\* P'\" and \"bn(p \\ \\) \\* P''\" and \"A\\<^sub>R' \\* P'\" and \"A\\<^sub>R' \\* P''\" \n by(metis tau_chain_fresh_chain)+\n from P'Chain have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\'') \\ (p \\ \\'))) \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ P'')\"\n by(rule eqvts)\n with `bn \\ \\* \\` `bn(p \\ \\) \\* \\` `bn \\ \\* P'` `bn(p \\ \\) \\* P'` `bn \\ \\* P''` `bn(p \\ \\) \\* P''`\n S `distinct_perm p`\n have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\'' \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ P''\"\n by(simp add: eqvts)\n hence \"(\\ \\ \\') \\ (p \\ \\\\<^sub>R) \\ \\'' \\ P' \\\\<^sup>^\\<^sub>\\ P''\" \n by(rule tau_chain_stat_eq) (metis Associativity Commutativity Composition Assertion_stat_eq_trans)\n with `(p \\ \\\\<^sub>R) \\ \\'' \\ \\\\<^sub>R'` have \"(\\ \\ \\') \\ \\\\<^sub>R' \\ P' \\\\<^sup>^\\<^sub>\\ P''\" by(metis tau_chain_stat_eq composition_sym)\n hence \"\\ \\ \\' \\ P' \\ R' \\\\<^sup>^\\<^sub>\\ P'' \\ R'\" using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* \\'` `A\\<^sub>R' \\* P'` by(rule_tac tau_chain_par1) auto\n moreover from P'RelQ have \"((\\ \\ \\\\<^sub>R) \\ (p \\ \\'') \\ (p \\ \\'), P'', Q) \\ Rel\" by(rule Sym)\n with `eqvt Rel` have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\'') \\ (p \\ \\'), P'', Q)) \\ Rel\" by(rule eqvtI)\n with `bn \\ \\* \\` `bn(p \\ \\) \\* \\` `bn \\ \\* P''` `bn(p \\ \\) \\* P''` `bn \\ \\* Q` `bn(p \\ \\) \\* Q` S `distinct_perm p`\n have \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\'' \\ \\', P'', Q) \\ Rel\" by(simp add: eqvts)\n with `(p \\ \\\\<^sub>R) \\ \\'' \\ \\\\<^sub>R'` have \"((\\ \\ \\') \\ \\\\<^sub>R', P'', Q) \\ Rel\" \n by(rule_tac C3, auto) (metis Associativity Commutativity Composition Assertion_stat_eq_trans)\n with FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* \\'` `A\\<^sub>R' \\* P''` `A\\<^sub>R' \\* Q` \n have \"(\\ \\ \\', P'' \\ R', Q \\ R') \\ Rel'\" by(rule_tac C1) auto\n ultimately show ?case by blast\n next\n case c_comm1\n from `\\ \\ \\` have False by simp\n thus ?case by simp\n next\n case c_comm2\n from `\\ \\ \\` have False by simp\n thus ?case by simp\n qed\n next\n case(c_tau QR)\n from `\\ \\ Q \\ R \\None @ \\ \\ QR` show ?case\n proof(induct rule: parTauCases[where C=\"(P, R)\"])\n case(c_par1 Q' A\\<^sub>R \\\\<^sub>R)\n from `A\\<^sub>R \\* (P, R)` have \"A\\<^sub>R \\* P\"\n by simp+\n have FrR: \" extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` have \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n by(blast intro: PRelQ Sim)\n moreover have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\None @ \\ \\ Q'\" by fact\n ultimately obtain P' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\ \\ \\\\<^sub>R, P', Q') \\ Rel\"\n by(force dest: weakSimE)\n from PChain QTrans `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` have \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R \\* Q'\"\n by(force dest: free_fresh_chain_derivative tau_chain_fresh_chain)+\n from PChain FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ (P' \\ R)\"\n by(rule tau_chain_par1)\n moreover from P'RelQ' FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P'` `A\\<^sub>R \\* Q'` have \"(\\, P' \\ R, Q' \\ R) \\ Rel'\" by(rule C1)\n ultimately show ?case by blast\n next\n case(c_par2 R' A\\<^sub>Q \\\\<^sub>Q)\n from `A\\<^sub>Q \\* (P, R)` have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, R)\"\n by(rule fresh_frame)\n hence \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>Q\" and \"A\\<^sub>P \\* R\"\n by simp+\n \n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from `A\\<^sub>Q \\* P` FrP `A\\<^sub>P \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>P\"\n by(drule_tac extract_frame_fresh_chain) auto\n \n obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* (\\, P, Q, A\\<^sub>Q, A\\<^sub>P, \\\\<^sub>Q, \\\\<^sub>P, R)\" and \"distinct A\\<^sub>R\"\n by(rule fresh_frame)\n then have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>R \\* \\\\<^sub>P\"\n and \"A\\<^sub>R \\* R\"\n by simp+\n\n from `A\\<^sub>Q \\* R` FrR `A\\<^sub>R \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>R\" by(drule_tac extract_frame_fresh_chain) auto\n from `A\\<^sub>P \\* R` `A\\<^sub>R \\* A\\<^sub>P` FrR have \"A\\<^sub>P \\* \\\\<^sub>R\" by(drule_tac extract_frame_fresh_chain) auto\n\n moreover from `\\ \\ \\\\<^sub>Q \\ R \\None @ \\ \\ R'` FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R`\n obtain \\' A\\<^sub>R' \\\\<^sub>R' where \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\"\n by(rule_tac C=\"(\\, P, Q, R)\" in expand_tau_frame) (assumption | simp)+\n\n from FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q`\n obtain P' P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and QimpP': \"insert_assertion(extract_frame Q) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insert_assertion(extract_frame P') (\\ \\ \\\\<^sub>R)\"\n and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ P''\"\n and P'RelQ: \"((\\ \\ \\\\<^sub>R) \\ \\', Q, P'') \\ Rel\"\n by(metis StatImp PRelQ Sym weak_stat_impE)\n obtain A\\<^sub>P' \\\\<^sub>P' where FrP': \"extract_frame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"A\\<^sub>P' \\* \\\" and \"A\\<^sub>P' \\* \\\\<^sub>R\" and \"A\\<^sub>P' \\* \\\\<^sub>Q\"\n and \"A\\<^sub>P' \\* A\\<^sub>Q\" and \"A\\<^sub>P' \\* R\" and \"A\\<^sub>P' \\* A\\<^sub>R\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, \\\\<^sub>Q, A\\<^sub>Q, R, A\\<^sub>R)\" in fresh_frame) auto\n\n from PChain P'Chain `A\\<^sub>R \\* P` `A\\<^sub>Q \\* P` `A\\<^sub>R' \\* P` have \"A\\<^sub>Q \\* P'\" and \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R' \\* P'\" and \"A\\<^sub>R' \\* P''\"\n by(force intro: tau_chain_fresh_chain)+\n from `A\\<^sub>R \\* P'` `A\\<^sub>P' \\* A\\<^sub>R` `A\\<^sub>Q \\* P'` `A\\<^sub>P' \\* A\\<^sub>Q` FrP' have \"A\\<^sub>Q \\* \\\\<^sub>P'\" and \"A\\<^sub>R \\* \\\\<^sub>P'\"\n by(force dest: extract_frame_fresh_chain)+\n \n from PChain FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P' \\ R\" by(rule tau_chain_par1)\n moreover have RTrans: \"\\ \\ \\\\<^sub>P' \\ R \\None @ \\ \\ R'\"\n proof -\n have \"\\ \\ \\\\<^sub>Q \\ R \\None @ \\ \\ R'\" by fact\n moreover have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by(metis frame_int_associativity Commutativity Frame_stat_eq_trans frame_int_composition_sym Frame_stat_eq_sym)\n moreover with FrP' FrQ QimpP' `A\\<^sub>P' \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>P' \\* \\\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R`\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\\" using fresh_comp_chain\n by simp\n moreover have \"\\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n by(metis frame_int_associativity Commutativity Frame_stat_eq_trans frame_int_composition_sym frame_int_associativity[THEN Frame_stat_eq_sym])\n ultimately show ?thesis\n by(rule Frame_stat_eq_imp_compose)\n qed\n ultimately show ?thesis\n using `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>P'` `A\\<^sub>P' \\* R` `A\\<^sub>Q \\* R` \n `A\\<^sub>P' \\* A\\<^sub>R` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>P'` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P'` `A\\<^sub>Q \\* \\\\<^sub>P'` FrR `distinct A\\<^sub>R`\n by(force intro: transfer_tau_frame)\n qed\n hence \"\\ \\ P' \\ R \\None @ \\ \\ (P' \\ R')\" using FrP' `A\\<^sub>P' \\* \\` `A\\<^sub>P' \\* R`\n by(rule_tac Par2[where \\=None,simplified]) auto\n moreover from P'Chain have \"\\ \\ \\\\<^sub>R \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ P''\" \n by(rule tau_chain_stat_eq) (metis Associativity)\n with `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'` have \"\\ \\ \\\\<^sub>R' \\ P' \\\\<^sup>^\\<^sub>\\ P''\" by(metis tau_chain_stat_eq composition_sym)\n hence \"\\ \\ P' \\ R' \\\\<^sup>^\\<^sub>\\ P'' \\ R'\" using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P'` by(rule_tac tau_chain_par1)\n ultimately have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ (P'' \\ R')\"\n by(fastforce dest: rtrancl_into_rtrancl)\n\n moreover from P'RelQ `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'` have \"(\\ \\ \\\\<^sub>R', P'', Q) \\ Rel\" by(blast intro: C3 Associativity composition_sym Sym)\n with FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P''` `A\\<^sub>R' \\* Q` have \"(\\, P'' \\ R', Q \\ R') \\ Rel'\" by(rule_tac C1) \n ultimately show ?case by blast\n next\n case(c_comm1 \\\\<^sub>R M N Q' A\\<^sub>Q \\\\<^sub>Q K xvec R' A\\<^sub>R yvec zvec)\n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from `A\\<^sub>Q \\* (P, R)` have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from `A\\<^sub>R \\* (P, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* R\" by simp+\n from `xvec \\* (P, R)` have \"xvec \\* P\" and \"xvec \\* R\" by simp+\n\n from `zvec \\* (P, R)` have \"zvec \\* P\" and \"zvec \\* R\" by simp+\n\n have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\Some (\\A\\<^sub>Q; yvec, K\\) @ M\\N\\ \\ Q'\" and RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\Some (\\A\\<^sub>R; zvec, M\\) @ K\\\\*xvec\\\\N\\ \\ R'\"\n by fact+\n from RTrans FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* xvec` `A\\<^sub>R \\* N` `xvec \\* R` `xvec \\* Q` `xvec \\* \\` `xvec \\* \\\\<^sub>Q` `A\\<^sub>R \\* Q`\n `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>Q` `xvec \\* K` `A\\<^sub>R \\* K` `A\\<^sub>R \\* R` `xvec \\* R` `A\\<^sub>R \\* P` `xvec \\* P` `yvec \\* xvec`\n `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>Q \\* xvec` `xvec \\* K` `distinct xvec` `A\\<^sub>R \\* N` `zvec \\* xvec` `zvec \\* A\\<^sub>R` `yvec \\* A\\<^sub>R`\n obtain p \\' A\\<^sub>R' \\\\<^sub>R' where S: \"set p \\ set xvec \\ set(p \\ xvec)\" and FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\" and \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\\\<^sub>Q\" and \"(p \\ xvec) \\* K\" and \"(p \\ xvec) \\* R\" and \"(p \\ xvec) \\* zvec\" and \"(p \\ xvec) \\* yvec\" and \"(p \\ xvec) \\* N\"\n and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* A\\<^sub>Q\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* N\" and \"(p \\ xvec) \\* xvec\"\n and \"distinct_perm p\"\n by(rule_tac C=\"(\\, Q, \\\\<^sub>Q, K, R, P, A\\<^sub>Q)\" and C'=\"(\\, Q, \\\\<^sub>Q, K, R, P, A\\<^sub>Q,zvec,yvec)\" in expand_frame) (assumption | simp)+\n from `A\\<^sub>R \\* \\` have \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n from `A\\<^sub>R \\* P` have \"(p \\ A\\<^sub>R) \\* (p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* P` `(p \\ xvec) \\* P` S have \"(p \\ A\\<^sub>R) \\* P\" by simp\n from `A\\<^sub>R \\* Q` have \"(p \\ A\\<^sub>R) \\* (p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* Q` `(p \\ xvec) \\* Q` S have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n from `A\\<^sub>R \\* R` have \"(p \\ A\\<^sub>R) \\* (p \\ R)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* R` `(p \\ xvec) \\* R` S have \"(p \\ A\\<^sub>R) \\* R\" by simp\n from `A\\<^sub>R \\* K` have \"(p \\ A\\<^sub>R) \\* (p \\ K)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* K` `(p \\ xvec) \\* K` S have \"(p \\ A\\<^sub>R) \\* K\" by simp\n\n from `A\\<^sub>Q \\* xvec` `(p \\ xvec) \\* A\\<^sub>Q` `A\\<^sub>Q \\* M` S have \"A\\<^sub>Q \\* (p \\ M)\" by(simp add: fresh_chain_simps)\n from `A\\<^sub>Q \\* xvec` `(p \\ xvec) \\* A\\<^sub>Q` `A\\<^sub>Q \\* A\\<^sub>R` S have \"A\\<^sub>Q \\* (p \\ A\\<^sub>R)\" by(simp add: fresh_chain_simps)\n\n from QTrans S `xvec \\* Q` `(p \\ xvec) \\* Q` have \"(p \\ (\\ \\ \\\\<^sub>R)) \\ Q \\ Some (\\A\\<^sub>Q; yvec, K\\) @ (p \\ M)\\N\\ \\ Q'\"\n by(rule_tac input_perm_frame_subject) (assumption | auto simp add: fresh_star_def)+\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S have QTrans: \"(\\ \\ (p \\ \\\\<^sub>R)) \\ Q \\ Some (\\A\\<^sub>Q; yvec, K\\) @ (p \\ M)\\N\\ \\ Q'\"\n by(simp add: eqvts)\n from FrR have \"(p \\ extract_frame R) = p \\ \\A\\<^sub>R, \\\\<^sub>R\\\" by simp\n with `xvec \\* R` `(p \\ xvec) \\* R` S have FrR: \"extract_frame R = \\(p \\ A\\<^sub>R), (p \\ \\\\<^sub>R)\\\"\n by(simp add: eqvts)\n\n from FrR `(p \\ A\\<^sub>R) \\* \\` `(p \\ A\\<^sub>R) \\* P` `(p \\ A\\<^sub>R) \\* Q`\n have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" by(force intro: Sim PRelQ)\n\n with QTrans obtain \\ P' P'' where PTrans: \"\\ \\ (p \\ \\\\<^sub>R) : Q \\ P \\\\ @ (p \\ M)\\N\\ \\ P''\"\n and P''Chain: \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\"\n and P'RelQ': \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\', P', Q') \\ Rel\"\n by(drule_tac weakSimE) auto\n from PTrans QTrans `A\\<^sub>R' \\* P` `A\\<^sub>R' \\* Q` `A\\<^sub>R' \\* N` have \"A\\<^sub>R' \\* P''\" and \"A\\<^sub>R' \\* Q'\"\n by(auto dest: weak_input_fresh_chain_derivative input_fresh_chain_derivative)\n\n from RTrans have \"(p \\ xvec) \\* R'\" using `(p\\xvec) \\* R` `(p\\xvec) \\* N` `distinct xvec` `(p\\xvec) \\* xvec` `xvec \\* K`\n by(auto dest!: output_fresh_chain_derivative)\n\n from RTrans have RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\ Some (\\(p\\A\\<^sub>R); zvec, (p\\M)\\) @ K\\\\*xvec\\\\N\\ \\ R'\"\n using S `xvec \\* \\` `(p\\xvec) \\* \\` `xvec \\* \\\\<^sub>Q` `(p\\xvec) \\* \\\\<^sub>Q` `xvec \\* K` `(p\\xvec) \\* K`\n `distinct_perm p` `xvec \\* R` `(p\\xvec) \\* R` `(p\\xvec) \\* N` `(p\\xvec) \\* xvec` `(p \\ xvec) \\* R'` `(p \\ xvec) \\* zvec` `zvec \\* xvec`\n by(subst perm_bool[where pi=p,symmetric]) (simp add: eqvts residual_inject bound_output_chain_alpha''[symmetric])\n\n from `zvec \\* A\\<^sub>R` have \"(p\\A\\<^sub>R) \\* zvec\"\n using S `zvec \\* xvec` `(p\\xvec) \\* zvec`\n by(subst (asm) perm_bool[where pi=p,symmetric]) (simp add: eqvts)\n\n have \"zvec \\* (p\\\\\\<^sub>R)\" using `zvec \\* xvec` `zvec \\* \\\\<^sub>R` `(p\\xvec) \\* zvec` S\n by(simp add: fresh_chain_simps)\n from PTrans FrQ RTrans FrR `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* (p \\ M)` `A\\<^sub>Q \\* (p \\ A\\<^sub>R)`\n `(p \\ A\\<^sub>R) \\* \\` `(p \\ A\\<^sub>R) \\* P` `(p \\ A\\<^sub>R) \\* Q` `(p \\ A\\<^sub>R) \\* R` `(p \\ A\\<^sub>R) \\* K` `xvec \\* P` `distinct A\\<^sub>R`\n `(p \\ A\\<^sub>R) \\* zvec` `distinct zvec` `zvec \\* \\` `zvec \\* R` `zvec \\* P` `A\\<^sub>Q \\* xvec` `zvec \\* A\\<^sub>Q`\n `zvec \\* (p\\\\\\<^sub>R)`\n have \"\\ \\ P \\ R \\\\<^sub>\\ \\\\*xvec\\(P'' \\ R')\" by(rule_tac weak_comm1) (assumption|simp)+\n\n moreover from P''Chain `A\\<^sub>R' \\* P''` have \"A\\<^sub>R' \\* P'\" by(rule tau_chain_fresh_chain)\n from `(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'` have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ \\ \\ \\\\<^sub>R'\"\n by(metis Associativity Assertion_stat_eq_trans Assertion_stat_eq_sym composition_sym)\n with P''Chain have \"\\ \\ \\\\<^sub>R' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" by(rule tau_chain_stat_eq)\n hence \"\\ \\ P'' \\ R' \\\\<^sup>^\\<^sub>\\ P' \\ R'\" using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P''` by(rule tau_chain_par1)\n hence \"\\ \\ \\\\*xvec\\(P'' \\ R') \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" using `xvec \\* \\` by(rule tau_chain_res_chain_pres)\n ultimately have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\"\n by auto\n moreover from P'RelQ' `(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'` have \"(\\ \\ \\\\<^sub>R', P', Q') \\ Rel\" by(metis C3 Associativity composition_sym)\n with FrR' `A\\<^sub>R' \\* P'` `A\\<^sub>R' \\* Q'` `A\\<^sub>R' \\* \\` have \"(\\, P' \\ R', Q' \\ R') \\ Rel'\" by(rule_tac C1)\n with `xvec \\* \\` have \"(\\, \\\\*xvec\\(P' \\ R'), \\\\*xvec\\(Q' \\ R')) \\ Rel'\"\n by(rule_tac C2)\n ultimately show ?case by blast\n next\n case(c_comm2 \\\\<^sub>R M xvec N Q' A\\<^sub>Q \\\\<^sub>Q K R' A\\<^sub>R yvec zvec)\n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from `A\\<^sub>Q \\* (P, R)` have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from `A\\<^sub>R \\* (P, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* R\" by simp+\n from `xvec \\* (P, R)` have \"xvec \\* P\" and \"xvec \\* R\" by simp+\n from `yvec \\* (P, R)` have \"yvec \\* P\" and \"yvec \\* R\" by simp+\n from `zvec \\* (P, R)` have \"zvec \\* P\" and \"zvec \\* R\" by simp+\n\n have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\Some (\\A\\<^sub>Q; yvec, K\\) @ M\\\\*xvec\\\\N\\ \\ Q'\" and RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\Some (\\A\\<^sub>R; zvec, M\\) @ K\\N\\ \\ R'\"\n by fact+\n\n from RTrans FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* R` `A\\<^sub>R \\* Q'` `A\\<^sub>R \\* N` `A\\<^sub>R \\* P` `A\\<^sub>R \\* xvec` `A\\<^sub>R \\* K` `yvec \\* A\\<^sub>R` `zvec \\* A\\<^sub>R`\n obtain \\' A\\<^sub>R' \\\\<^sub>R' where ReqR': \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" \n and \"A\\<^sub>R' \\* \\\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q'\" and \"A\\<^sub>R' \\* N\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* yvec\" and \"A\\<^sub>R' \\* zvec\"\n by(rule_tac C=\"(\\, P, Q', N, xvec, yvec, zvec)\" and C'=\"(\\, P, Q', N, xvec)\" in expand_frame) (assumption | simp)+\n\n from FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` have \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(force intro: Sim PRelQ)\n\n with QTrans `xvec \\* \\` `xvec \\* \\\\<^sub>R` `xvec \\* P`\n obtain P'' P' \\ where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\\\ @ M\\\\*xvec\\\\N\\ \\ P''\"\n and P''Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\"\n and P'RelQ': \"((\\ \\ \\\\<^sub>R) \\ \\', P', Q') \\ Rel\"\n by(fastforce dest: weakSimE)\n from PTrans obtain P''' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'''\"\n and QimpP''': \"insert_assertion (extract_frame Q) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insert_assertion (extract_frame P''') (\\ \\ \\\\<^sub>R)\"\n and P'''Trans: \"\\ \\ \\\\<^sub>R \\ P''' \\\\ @ M\\\\*xvec\\\\N\\ \\ P''\"\n by(rule weak_transitionE)\n \n from PChain `A\\<^sub>R \\* P` have \"A\\<^sub>R \\* P'''\" by(rule tau_chain_fresh_chain)\n\n obtain A\\<^sub>P''' \\\\<^sub>P''' where FrP''': \"extract_frame P''' = \\A\\<^sub>P''', \\\\<^sub>P'''\\\" and \"A\\<^sub>P''' \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, A\\<^sub>R, \\\\<^sub>R, M, N, K, R, P''', Q, xvec,yvec,zvec,\\)\" and \"distinct A\\<^sub>P'''\"\n by(rule fresh_frame)\n hence \"A\\<^sub>P''' \\* \\\" and \"A\\<^sub>P''' \\* A\\<^sub>Q\" and \"A\\<^sub>P''' \\* \\\\<^sub>Q\" and \"A\\<^sub>P''' \\* M\" and \"A\\<^sub>P''' \\* R\"\n and \"A\\<^sub>P''' \\* N\" and \"A\\<^sub>P''' \\* K\" and \"A\\<^sub>P''' \\* A\\<^sub>R\" and \"A\\<^sub>P''' \\* P'''\" and \"A\\<^sub>P''' \\* xvec\" and \"A\\<^sub>P''' \\* \\\\<^sub>R\"\n and \"A\\<^sub>P''' \\* yvec\" and \"A\\<^sub>P''' \\* zvec\" and \"A\\<^sub>P''' \\* \\\" and \"A\\<^sub>P''' \\* Q\"\n by simp+\n from P'''Trans `extract_frame P''' = \\A\\<^sub>P''',\\\\<^sub>P'''\\` `distinct A\\<^sub>P'''`\n `A\\<^sub>P''' \\* \\` `A\\<^sub>P''' \\* A\\<^sub>Q` `A\\<^sub>P''' \\* \\\\<^sub>Q` `A\\<^sub>P''' \\* M` `A\\<^sub>P''' \\* R` `A\\<^sub>P''' \\* Q`\n `A\\<^sub>P''' \\* N` `A\\<^sub>P''' \\* K` `A\\<^sub>P''' \\* A\\<^sub>R` `A\\<^sub>P''' \\* P'''` `A\\<^sub>P''' \\* xvec` `A\\<^sub>P''' \\* \\\\<^sub>R` `A\\<^sub>P''' \\* \\` `A\\<^sub>P''' \\* zvec`\n obtain tvec K' where \\: \"\\ = Some(\\A\\<^sub>P'''; tvec, K'\\)\" and \"distinct tvec\" and \"tvec \\* A\\<^sub>P'''\"\n \"tvec \\* \\\" \"tvec \\* A\\<^sub>Q\" \"tvec \\* \\\\<^sub>Q\" \"tvec \\* M\" \"tvec \\* R\" \"tvec \\* Q\"\n \"tvec \\* N\" \"tvec \\* K\" \"tvec \\* A\\<^sub>R\" \"tvec \\* P'''\" \"tvec \\* xvec\" \"tvec \\* \\\\<^sub>R\" \"tvec \\* zvec\"\n and MeqK: \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''' \\ K' \\ M\"\n unfolding residual_inject\n by(frule_tac output_provenance'[where C=\"(\\,A\\<^sub>Q,\\\\<^sub>Q,M,R,Q,N,K,A\\<^sub>R,P''',xvec,\\\\<^sub>R,A\\<^sub>P''',zvec)\"]) auto\n from P'''Trans have P'''Trans: \"\\ \\ \\\\<^sub>R \\ P''' \\ Some(\\A\\<^sub>P'''; tvec, K'\\) @ M\\\\*xvec\\\\N\\ \\ P''\"\n unfolding \\.\n from MeqK have MeqK': \"\\ \\ \\\\<^sub>P''' \\ \\\\<^sub>R \\ K' \\ M\"\n by(metis stat_eq_ent Associativity associativity_sym)\n\n from `A\\<^sub>R \\* P'''` `A\\<^sub>P''' \\* A\\<^sub>R` `extract_frame P''' = \\A\\<^sub>P''',\\\\<^sub>P'''\\` \n have \"A\\<^sub>R \\* \\\\<^sub>P'''\"\n by(auto dest: extract_frame_fresh_chain)\n\n have \"zvec \\* P'''\" using `zvec \\* P` PChain\n by(rule_tac tau_chain_fresh_chain)\n\n from `zvec \\* P'''` `A\\<^sub>P''' \\* zvec` `extract_frame P''' = \\A\\<^sub>P''',\\\\<^sub>P'''\\` \n have \"zvec \\* \\\\<^sub>P'''\"\n by(auto dest: extract_frame_fresh_chain)\n\n have \"A\\<^sub>R \\* K'\" using P'''Trans\n `A\\<^sub>R \\* P'''` `A\\<^sub>P''' \\* A\\<^sub>R` `tvec \\* A\\<^sub>R`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"zvec \\* K'\" using P'''Trans\n `zvec \\* P'''` `A\\<^sub>P''' \\* zvec` `tvec \\* zvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n from `tvec \\* A\\<^sub>P'''` `extract_frame P''' = \\A\\<^sub>P''',\\\\<^sub>P'''\\` `tvec \\* P'''`\n have \"tvec \\* \\\\<^sub>P'''\"\n by(force dest: extract_frame_fresh_chain)\n\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\" \n by(metis frame_res_chain_pres frame_nil_stat_eq Commutativity Assertion_stat_eq_trans Composition Associativity)\n moreover with QimpP''' FrP''' FrQ `A\\<^sub>P''' \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>P''' \\* \\\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R`\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'''\\\" using fresh_comp_chain\n by simp\n moreover have \"\\A\\<^sub>P''', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'''\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ \\\\<^sub>R\\\"\n by(metis frame_res_chain_pres frame_nil_stat_eq Commutativity Assertion_stat_eq_trans Composition Associativity)\n ultimately have QImpP''': \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ \\\\<^sub>R\\\"\n by(rule Frame_stat_eq_imp_compose)\n from PChain FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P''' \\ R\" by(rule tau_chain_par1)\n moreover from RTrans FrR P'''Trans MeqK' QImpP''' FrP''' FrQ `distinct A\\<^sub>P'''` `distinct A\\<^sub>R` `A\\<^sub>P''' \\* A\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R`\n `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P'''` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* K` `A\\<^sub>P''' \\* \\` `A\\<^sub>P''' \\* R`\n `A\\<^sub>P''' \\* P'''` `A\\<^sub>P''' \\* M` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* M` `A\\<^sub>R \\* xvec` `xvec \\* M` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>P'''`\n `A\\<^sub>R \\* K'` `distinct zvec` `zvec \\* A\\<^sub>R` `zvec \\* \\` `zvec \\* \\\\<^sub>P'''` `zvec \\* K'` `zvec \\* R`\n `A\\<^sub>P''' \\* zvec` `zvec \\* A\\<^sub>Q`\n have \"\\ \\ \\\\<^sub>P''' \\ R \\Some (\\A\\<^sub>R; zvec, M\\) @ K'\\N\\ \\ R'\"\n by(rule_tac comm2_aux) (assumption | simp)+\n with P'''Trans FrP''' have \"\\ \\ P''' \\ R \\None @ \\ \\ \\\\*xvec\\(P'' \\ R')\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P'''` `A\\<^sub>R \\* R`\n `xvec \\* R` `A\\<^sub>P''' \\* \\` `A\\<^sub>P''' \\* P'''` `A\\<^sub>P''' \\* R` `A\\<^sub>P''' \\* M` `A\\<^sub>R \\* K'` `A\\<^sub>P''' \\* A\\<^sub>R`\n `tvec \\* \\` `tvec \\* \\\\<^sub>P'''` `tvec \\* R` `zvec \\* \\` `zvec \\* P'''` `zvec \\* \\\\<^sub>R`\n by(rule_tac Comm2) assumption+\n moreover from P'''Trans `A\\<^sub>R \\* P'''` `A\\<^sub>R \\* xvec` `xvec \\* M` `distinct xvec` have \"A\\<^sub>R \\* P''\"\n by(rule_tac output_fresh_chain_derivative) auto\n\n from PChain `A\\<^sub>R' \\* P` have \"A\\<^sub>R' \\* P'''\" by(rule tau_chain_fresh_chain)\n with P'''Trans have \"A\\<^sub>R' \\* P''\" using `A\\<^sub>R' \\* xvec` `xvec \\* M` `distinct xvec`\n by(rule_tac output_fresh_chain_derivative) auto\n\n with P''Chain have \"A\\<^sub>R' \\* P'\" by(rule tau_chain_fresh_chain)\n from `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'` have \"(\\ \\ \\\\<^sub>R) \\ \\' \\ \\ \\ \\\\<^sub>R'\"\n by(metis Associativity Assertion_stat_eq_trans Assertion_stat_eq_sym composition_sym)\n with P''Chain have \"\\ \\ \\\\<^sub>R' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" by(rule tau_chain_stat_eq)\n hence \"\\ \\ P'' \\ R' \\\\<^sup>^\\<^sub>\\ P' \\ R'\" using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P''` \n by(rule tau_chain_par1)\n hence \"\\ \\ \\\\*xvec\\(P'' \\ R') \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" \n using `xvec \\* \\` by(rule tau_chain_res_chain_pres)\n ultimately have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" by(drule_tac tau_act_tau_chain) auto\n moreover from P'RelQ' `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'` have \"(\\ \\ \\\\<^sub>R', P', Q') \\ Rel\" by(metis C3 Associativity composition_sym)\n with FrR' `A\\<^sub>R' \\* P'` `A\\<^sub>R' \\* Q'` `A\\<^sub>R' \\* \\` have \"(\\, P' \\ R', Q' \\ R') \\ Rel'\" by(rule_tac C1)\n with `xvec \\* \\` have \"(\\, \\\\*xvec\\(P' \\ R'), \\\\*xvec\\(Q' \\ R')) \\ Rel'\"\n by(rule_tac C2)\n ultimately show ?case by blast\n qed\n qed\nqed\nno_notation relcomp (infixr \"O\" 75)\nlemma weakSimBangPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Rel'' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"(\\, P, Q) \\ Rel\"\n and \"eqvt Rel''\"\n and \"guarded P\"\n and \"guarded Q\"\n and Rel'Rel: \"Rel' \\ Rel\"\n\n and FrameParPres: \"\\\\' \\\\<^sub>U S T U A\\<^sub>U. \\(\\' \\ \\\\<^sub>U, S, T) \\ Rel; extract_frame U = \\A\\<^sub>U, \\\\<^sub>U\\; A\\<^sub>U \\* \\'; A\\<^sub>U \\* S; A\\<^sub>U \\* T\\ \\\n (\\', U \\ S, U \\ T) \\ Rel\"\n and C1: \"\\\\' S T U. \\(\\', S, T) \\ Rel; guarded S; guarded T\\ \\ (\\', U \\ !S, U \\ !T) \\ Rel''\"\n and ResPres: \"\\\\' S T xvec. \\(\\', S, T) \\ Rel; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel\"\n and ResPres': \"\\\\' S T xvec. \\(\\', S, T) \\ Rel'; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel'\"\n\n and Closed: \"\\\\' S T p. (\\', S, T) \\ Rel \\ ((p::name prm) \\ \\', p \\ S, p \\ T) \\ Rel\"\n and Closed': \"\\\\' S T p. (\\', S, T) \\ Rel' \\ ((p::name prm) \\ \\', p \\ S, p \\ T) \\ Rel'\"\n and StatEq: \"\\\\' S T \\''. \\(\\', S, T) \\ Rel; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel\"\n and StatEq': \"\\\\' S T \\''. \\(\\', S, T) \\ Rel'; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel'\"\n and Trans: \"\\\\' S T U. \\(\\', S, T) \\ Rel; (\\', T, U) \\ Rel\\ \\ (\\', S, U) \\ Rel\"\n and Trans': \"\\\\' S T U. \\(\\', S, T) \\ Rel'; (\\', T, U) \\ Rel'\\ \\ (\\', S, U) \\ Rel'\"\n\n and cSim: \"\\\\' S T. (\\', S, T) \\ Rel \\ \\' \\ S \\ T\"\n and cExt: \"\\\\' S T \\''. (\\', S, T) \\ Rel \\ (\\' \\ \\'', S, T) \\ Rel\"\n and cExt': \"\\\\' S T \\''. (\\', S, T) \\ Rel' \\ (\\' \\ \\'', S, T) \\ Rel'\"\n and cSym: \"\\\\' S T. (\\', S, T) \\ Rel \\ (\\', T, S) \\ Rel\"\n and cSym': \"\\\\' S T. (\\', S, T) \\ Rel' \\ (\\', T, S) \\ Rel'\"\n\n and ParPres: \"\\\\' S T U. (\\', S, T) \\ Rel \\ (\\', S \\ U, T \\ U) \\ Rel\"\n and ParPres2: \"\\\\' S T. (\\', S, T) \\ Rel \\ (\\', S \\ S, T \\ T) \\ Rel\"\n and ParPres': \"\\\\' S T U. (\\', S, T) \\ Rel' \\ (\\', U \\ S, U \\ T) \\ Rel'\"\n\n and Assoc: \"\\\\' S T U. (\\', S \\ (T \\ U), (S \\ T) \\ U) \\ Rel\"\n and Assoc': \"\\\\' S T U. (\\', S \\ (T \\ U), (S \\ T) \\ U) \\ Rel'\"\n and ScopeExt: \"\\xvec \\' T S. \\xvec \\* \\'; xvec \\* T\\ \\ (\\', \\\\*xvec\\(S \\ T), (\\\\*xvec\\S) \\ T) \\ Rel\"\n and ScopeExt': \"\\xvec \\' T S. \\xvec \\* \\'; xvec \\* T\\ \\ (\\', \\\\*xvec\\(S \\ T), (\\\\*xvec\\S) \\ T) \\ Rel'\"\n\n and Compose: \"\\\\' S T U O. \\(\\', S, T) \\ Rel; (\\', T, U) \\ Rel''; (\\', U, O) \\ Rel'\\ \\ (\\', S, O) \\ Rel''\"\n\n and rBangActE: \"\\\\' S \\ \\ S'. \\\\' \\ !S \\\\ @ \\ \\ S'; guarded S; bn \\ \\* S; \\ \\ \\; bn \\ \\* subject \\\\ \\ \\T \\'. \\' \\ S \\\\' @ \\ \\ T \\ (\\, S', T \\ !S) \\ Rel'\"\n and rBangTauE: \"\\\\' S S'. \\\\' \\ !S \\None @ \\ \\ S'; guarded S\\ \\ \\T. \\' \\ S \\ S \\ None @ \\ \\ T \\ (\\, S', T \\ !S) \\ Rel'\"\n and rBangTauI: \"\\\\' S S'. \\\\' \\ S \\ S \\\\<^sup>^\\<^sub>\\ S'; guarded S\\ \\ \\T. \\' \\ !S \\\\<^sup>^\\<^sub>\\ T \\ (\\', T, S' \\ !S) \\ Rel'\"\n shows \"\\ \\ R \\ !P \\ R \\ !Q\"\nusing `eqvt Rel''`\nproof(induct rule: weakSimI[where C=\"()\"])\n case(c_act \\' \\ \\ RQ')\n from `bn \\ \\* (R \\ !P)` `bn \\ \\* (R \\ !Q)` have \"bn \\ \\* P\" and \"bn \\ \\* (!Q)\" and \"bn \\ \\* Q\" and \"bn \\ \\* R\"\n by simp+\n from `\\ \\ R \\ !Q \\\\ @ \\ \\ RQ'` `bn \\ \\* \\` `bn \\ \\* R` `bn \\ \\* !Q` `bn \\ \\* subject \\` `\\ \\ \\` show ?case\n proof(induct rule: par_cases[where C=\"(\\', P, Q, R)\"])\n case(c_par1 R' \\' A\\<^sub>Q \\\\<^sub>Q)\n from `extract_frame (!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\` have \"A\\<^sub>Q = []\" and \"\\\\<^sub>Q = \\\" by simp+\n with `\\ \\ \\\\<^sub>Q \\ R \\\\' @ \\ \\ R'` `\\\\<^sub>Q = \\` `bn \\ \\* \\` `bn \\ \\* P`\n have \"\\ \\ R \\ !P \\\\' @ \\ \\ (R' \\ !P)\"\n by(drule_tac Par1[where Q=\"!P\" and A\\<^sub>Q=\"[]\",simplified, unfolded map_option.id[unfolded id_def]])\n auto\n hence \"\\ : R \\ !Q \\ R \\ !P \\\\' @ \\ \\ R' \\ !P\" by(rule_tac transition_weak_transition) auto\n moreover have \"\\ \\ \\' \\ R' \\ !P \\\\<^sup>^\\<^sub>\\ R' \\ !P\" by auto\n moreover from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\', P, Q) \\ Rel\" by(rule cExt)\n hence \"(\\ \\ \\', R' \\ !P, R' \\ !Q) \\ Rel''\" using `guarded P` `guarded Q` \n by(rule C1)\n ultimately show ?case by blast\n next\n case(c_par2 Q' \\' A\\<^sub>R \\\\<^sub>R)\n from `A\\<^sub>R \\* (\\', P, Q, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* \\'\" and \"A\\<^sub>R \\* R\" by simp+\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with `bn \\ \\* R` `A\\<^sub>R \\* \\` have \"bn \\ \\* \\\\<^sub>R\" by(auto dest: extract_frame_fresh_chain)\n \n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* \\\\<^sub>R\" and \"A\\<^sub>Q \\* A\\<^sub>R\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R)\" in fresh_frame) auto\n from FrQ `guarded Q` have \"\\\\<^sub>Q \\ \\\" and \"supp \\\\<^sub>Q = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n hence \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>Q \\* \\\\<^sub>Q\" by(auto simp add: fresh_star_def fresh_def)\n\n from `\\ \\ \\\\<^sub>R \\ !Q \\\\' @ \\ \\ Q'` `guarded Q` `bn \\ \\* Q` `\\ \\ \\` `bn \\ \\* subject \\`\n obtain T \\'' where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\\\'' @ \\ \\ T\" and \"(\\, Q', T \\ !Q) \\ Rel'\" \n by(blast dest: rBangActE)\n \n from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n with QTrans `bn \\ \\* \\` `bn \\ \\* \\\\<^sub>R` `bn \\ \\* P` `\\ \\ \\`\n obtain P'' \\''' S where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\\\''' @ \\ \\ P''\" \n and P''Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ S\"\n and SRelT: \"((\\ \\ \\\\<^sub>R) \\ \\', S, T) \\ Rel\"\n by(blast dest: cSim weakSimE)\n from PTrans have \"(\\ \\ \\\\<^sub>R) \\ \\ : Q \\ P \\\\''' @ \\ \\ P''\"\n by(metis weak_transition_stat_eq Identity Assertion_stat_eq_sym)\n hence \"\\ \\ \\\\<^sub>R : Q \\ !P \\ P \\ !P \\\\''' @ \\ \\ P'' \\ !P\" using `bn \\ \\* P` \n by(force intro: weak_par1[where A\\<^sub>Q=\"[]\",simplified,unfolded map_option.id[unfolded id_def]])\n then obtain \\'''' where \"\\ \\ \\\\<^sub>R : Q \\ !P \\ !P \\\\'''' @ \\ \\ P'' \\ !P\" using `guarded P`\n by(rule weak_bang)\n hence \"\\ : R \\ (Q \\ !P) \\ R \\ !P \\append_at_front_prov_option \\'''' A\\<^sub>R @ \\ \\ R \\ (P'' \\ !P)\" \n using FrR `bn \\ \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* Q``A\\<^sub>R \\* P` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\`\n by(rule_tac weak_par2) auto\n moreover have \"insert_assertion (extract_frame(R \\ !Q)) \\ \\\\<^sub>F insert_assertion (extract_frame(R \\ (Q \\ !P))) \\\"\n proof -\n have \"insert_assertion (extract_frame(R \\ !P)) \\ = \\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\\" using FrR `A\\<^sub>R \\* \\`\n by auto\n moreover from `\\\\<^sub>Q \\ \\` have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\ \\\\<^sub>F \\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\\"\n by(rule_tac frame_res_chain_pres, auto) (metis Identity composition_sym Assertion_stat_eq_trans Assertion_stat_eq_sym)\n moreover have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\ \\\\<^sub>F \\\\*A\\<^sub>Q\\(\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\)\" using `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R` fresh_comp_chain\n by(subst frame_res_fresh_chain[where xvec=A\\<^sub>Q, THEN Frame_stat_eq_sym]) auto\n moreover have \"\\\\*A\\<^sub>Q\\(\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\) \\\\<^sub>F \\\\*A\\<^sub>R\\(\\A\\<^sub>Q, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\)\"\n by(rule frame_res_chain_comm)\n moreover have \"insert_assertion (extract_frame(R \\ (Q \\ !P))) \\ = \\(A\\<^sub>R@A\\<^sub>Q), \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ \\\\\" \n using FrR FrQ `A\\<^sub>R \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>R \\* \\\\<^sub>Q` fresh_comp_chain\n by auto\n ultimately have \"insert_assertion (extract_frame(R \\ !P)) \\ \\\\<^sub>F insert_assertion (extract_frame(R \\ (Q \\ !P))) \\\"\n by(auto simp add: frame_chain_append) (blast dest: Frame_stat_eq_trans)\n thus ?thesis by(simp add: Frame_stat_eq_def)\n qed\n ultimately have \"\\ : R \\ !Q \\ R \\ !P \\append_at_front_prov_option \\'''' A\\<^sub>R @ \\ \\ R \\ (P'' \\ !P)\" \n by(rule weak_transition_frame_imp)\n\n moreover from PTrans `A\\<^sub>R \\* P` `A\\<^sub>R \\* \\` `bn \\ \\* subject \\` `distinct(bn \\)`\n have \"A\\<^sub>R \\* P''\" by(force dest: weak_fresh_chain_derivative)\n with P''Chain have \"A\\<^sub>R \\* S\" by(force dest: tau_chain_fresh_chain)\n from `\\ \\ \\\\<^sub>R \\ Q \\_ @ \\ \\ T` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\` `bn \\ \\* subject \\` `distinct(bn \\)` have \"A\\<^sub>R \\* T\"\n by(force dest: free_fresh_chain_derivative)\n\n from P''Chain have \"((\\ \\ \\') \\ \\\\<^sub>R) \\ \\ \\ P'' \\\\<^sup>^\\<^sub>\\ S\" \n by(rule tau_chain_stat_eq) (metis Associativity Commutativity Composition Assertion_stat_eq_trans Assertion_stat_eq_sym Identity)\n hence \"(\\ \\ \\') \\ \\\\<^sub>R \\ P'' \\ !P \\\\<^sup>^\\<^sub>\\ S \\ !P\"\n by(rule_tac tau_chain_par1) auto\n hence \"\\ \\ \\' \\ R \\ (P'' \\ !P) \\\\<^sup>^\\<^sub>\\ R \\ (S \\ !P)\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\'` `A\\<^sub>R \\* P''` `A\\<^sub>R \\* P`\n by(rule_tac tau_chain_par2) auto\n moreover have \"(\\ \\ \\', R \\ (S \\ !P), R \\ Q') \\ Rel''\"\n proof -\n from `((\\ \\ \\\\<^sub>R) \\ \\', S, T) \\ Rel` have \"((\\ \\ \\') \\ \\\\<^sub>R, S, T) \\ Rel\"\n by(rule StatEq) (metis Associativity Commutativity Composition Assertion_stat_eq_trans Assertion_stat_eq_sym)\n with FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\'` `A\\<^sub>R \\* S` `A\\<^sub>R \\* T` have \"(\\ \\ \\', R \\ S, R \\ T) \\ Rel\"\n by(rule_tac FrameParPres) auto\n hence \"(\\ \\ \\', R \\ T, R \\ S) \\ Rel\" by(rule cSym)\n hence \"(\\ \\ \\', (R \\ T) \\ !P, (R \\ S) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\ \\ \\', (R \\ S) \\ !P, (R \\ T) \\ !P) \\ Rel\" by(rule cSym)\n hence \"(\\ \\ \\', R \\ (S \\ !P), (R \\ T) \\ !P) \\ Rel\" by(metis Trans Assoc)\n moreover from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\', P, Q) \\ Rel\" by(rule cExt)\n hence \"(\\ \\ \\', (R \\ T) \\ !P, (R \\ T) \\ !Q) \\ Rel''\" using `guarded P` `guarded Q` by(rule C1)\n moreover from `(\\, Q', T \\ !Q) \\ Rel'` have \"(\\ \\ \\ \\ \\', Q', T \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\ \\ \\', Q', T \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity Assertion_stat_eq_sym Commutativity Assertion_stat_eq_trans)\n hence \"(\\ \\ \\', R \\ Q', R \\ (T \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\ \\ \\', R \\ Q', (R \\ T) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\ \\ \\', (R \\ T) \\ !Q, R \\ Q') \\ Rel'\" by(rule cSym')\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n next\n case c_comm1\n from `\\ \\ \\` have False by simp\n thus ?case by simp\n next\n case c_comm2\n from `\\ \\ \\` have False by simp\n thus ?case by simp\n qed\nnext\n case(c_tau RQ')\n from `\\ \\ R \\ !Q \\None @ \\ \\ RQ'` show ?case\n proof(induct rule: parTauCases[where C=\"(P, Q, R)\"])\n case(c_par1 R' A\\<^sub>Q \\\\<^sub>Q)\n from `extract_frame (!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\` have \"A\\<^sub>Q = []\" and \"\\\\<^sub>Q = \\\" by simp+\n with `\\ \\ \\\\<^sub>Q \\ R \\None @ \\ \\ R'` `\\\\<^sub>Q = \\`\n have \"\\ \\ R \\ !P \\None @ \\ \\ (R' \\ !P)\" by(rule_tac Par1[where \\=None,simplified]) (assumption | simp)+\n hence \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ R' \\ !P\" by auto\n moreover from `(\\, P, Q) \\ Rel` `guarded P` `guarded Q` have \"(\\, R' \\ !P, R' \\ !Q) \\ Rel''\"\n by(rule C1)\n ultimately show ?case by blast\n next\n case(c_par2 Q' A\\<^sub>R \\\\<^sub>R)\n from `A\\<^sub>R \\* (P, Q, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n \n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* \\\\<^sub>R\" and \"A\\<^sub>Q \\* A\\<^sub>R\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R)\" in fresh_frame) auto\n from FrQ `guarded Q` have \"\\\\<^sub>Q \\ \\\" and \"supp \\\\<^sub>Q = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n hence \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>Q \\* \\\\<^sub>Q\" by(auto simp add: fresh_star_def fresh_def)\n\n from `\\ \\ \\\\<^sub>R \\ !Q \\None @ \\ \\ Q'` `guarded Q` \n obtain T where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\ Q \\None @ \\ \\ T\" and \"(\\, Q', T \\ !Q) \\ Rel'\" \n by(blast dest: rBangTauE)\n \n from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n hence \"(\\ \\ \\\\<^sub>R, P \\ P, Q \\ Q) \\ Rel\" by(rule ParPres2)\n with QTrans \n obtain S where PTrans: \"\\ \\ \\\\<^sub>R \\ P \\ P \\\\<^sup>^\\<^sub>\\ S\" and SRelT: \"(\\ \\ \\\\<^sub>R, S, T) \\ Rel\"\n by(blast dest: cSim weakSimE)\n from PTrans `guarded P` obtain U where PChain: \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sup>^\\<^sub>\\ U\" and \"(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel'\"\n by(blast dest: rBangTauI)\n from PChain `A\\<^sub>R \\* P` have \"A\\<^sub>R \\* U\" by(force dest: tau_chain_fresh_chain)\n from `\\ \\ \\\\<^sub>R \\ !P \\\\<^sup>^\\<^sub>\\ U` FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` have \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ R \\ U\"\n by(rule_tac tau_chain_par2) auto\n moreover from PTrans `A\\<^sub>R \\* P` have \"A\\<^sub>R \\* S\" by(force dest: tau_chain_fresh_chain)\n from QTrans `A\\<^sub>R \\* Q` have \"A\\<^sub>R \\* T\" by(force dest: tau_fresh_chain_derivative)\n have \"(\\, R \\ U, R \\ Q') \\ Rel''\"\n proof -\n from `(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel'` Rel'Rel have \"(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel\"\n by auto\n hence \"(\\, R \\ U, R \\ (S \\ !P)) \\ Rel\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* U` `A\\<^sub>R \\* S` `A\\<^sub>R \\* P`\n by(rule_tac FrameParPres) auto\n\n moreover from `(\\ \\ \\\\<^sub>R, S, T) \\ Rel` FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* S` `A\\<^sub>R \\* T` have \"(\\, R \\ S, R \\ T) \\ Rel\"\n by(rule_tac FrameParPres) auto\n hence \"(\\, R \\ T, R \\ S) \\ Rel\" by(rule cSym)\n hence \"(\\, (R \\ T) \\ !P, (R \\ S) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, (R \\ S) \\ !P, (R \\ T) \\ !P) \\ Rel\" by(rule cSym)\n hence \"(\\, R \\ (S \\ !P), (R \\ T) \\ !P) \\ Rel\" by(metis Trans Assoc)\n ultimately have \"(\\, R \\ U, (R \\ T) \\ !P) \\ Rel\" by(rule Trans)\n moreover from `(\\, P, Q) \\ Rel` have \"(\\, (R \\ T) \\ !P, (R \\ T) \\ !Q) \\ Rel''\" using `guarded P` `guarded Q` by(rule C1)\n moreover from `(\\, Q', T \\ !Q) \\ Rel'` have \"(\\ \\ \\, Q', T \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', T \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity Assertion_stat_eq_sym Commutativity Assertion_stat_eq_trans)\n hence \"(\\, R \\ Q', R \\ (T \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R \\ Q', (R \\ T) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R \\ T) \\ !Q, R \\ Q') \\ Rel'\" by(rule cSym')\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n next\n case(c_comm1 \\\\<^sub>Q M N R' A\\<^sub>R \\\\<^sub>R K xvec Q' A\\<^sub>Q yvec zvec)\n from `A\\<^sub>R \\* (P, Q, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n from `xvec \\* (P, Q, R)` have \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n from `yvec \\* (P, Q, R)` have \"yvec \\* P\" and \"yvec \\* Q\" and \"yvec \\* R\" by simp+\n have FrQ: \"extract_frame(!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from `\\ \\ \\\\<^sub>Q \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M\\N\\ \\ R'` FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* N` `A\\<^sub>R \\* xvec` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* M`\n obtain A\\<^sub>R' \\\\<^sub>R' \\' where FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" and \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\"\n by(rule_tac C=\"(\\, xvec, P, Q)\" and C'=\"(\\, xvec, P, Q)\" in expand_frame) auto\n from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n moreover from `\\ \\ \\\\<^sub>R \\ !Q \\Some (\\A\\<^sub>Q; zvec, M\\) @ K\\\\*xvec\\\\N\\ \\ Q'` `guarded Q` `xvec \\* Q` `xvec \\* K`\n obtain S \\ where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\\\ @ K\\\\*xvec\\\\N\\ \\ S\" and \"(\\, Q', S \\ !Q) \\ Rel'\"\n by(fastforce dest: rBangActE)\n\n ultimately obtain P' \\' T where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\\\' @ K\\\\*xvec\\\\N\\ \\ P'\" and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ T\" and \"((\\ \\ \\\\<^sub>R) \\ \\', T, S) \\ Rel\"\n using `xvec \\* \\` `xvec \\* \\\\<^sub>R` `xvec \\* P`\n by(drule_tac cSim) (fastforce dest!: weakSimE(1))\n\n from PTrans `A\\<^sub>R \\* P` `A\\<^sub>R \\* xvec` `A\\<^sub>R' \\* P` `A\\<^sub>R' \\* xvec` `xvec \\* K` `distinct xvec`\n have \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R' \\* P'\"\n by(force dest: weak_output_fresh_chain_derivative)+\n with P'Chain have \"A\\<^sub>R' \\* T\" by(force dest: tau_chain_fresh_chain)+\n from QTrans `A\\<^sub>R' \\* Q` `A\\<^sub>R' \\* xvec` `xvec \\* K` `distinct xvec` \n have \"A\\<^sub>R' \\* S\" by(force dest: output_fresh_chain_derivative)\n\n from QTrans obtain A\\<^sub>Q' \\\\<^sub>Q' tvec M'' where FrQ': \"extract_frame Q = \\A\\<^sub>Q', \\\\<^sub>Q'\\\"\n and \\: \"\\ = Some(\\A\\<^sub>Q'; tvec, M''\\)\" and \"distinct A\\<^sub>Q'\" and \"distinct tvec\"\n and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* tvec\" and M'eqK: \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q' \\ M'' \\ K\"\n and \"A\\<^sub>Q' \\* Q\" and \"A\\<^sub>Q' \\* \\\\<^sub>R\" and \"A\\<^sub>Q' \\* A\\<^sub>R\" and \"A\\<^sub>Q' \\* M\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* K\"\n and \"A\\<^sub>Q' \\* xvec\" and \"A\\<^sub>Q' \\* yvec\"\n unfolding residual_inject\n by(drule_tac output_provenance[where C=\"(\\,Q,\\\\<^sub>R, A\\<^sub>R, K, M, R, xvec, yvec)\"]) auto\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and NilImpP'': \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F insert_assertion (extract_frame P'') (\\ \\ \\\\<^sub>R)\"\n and P''Trans: \"\\ \\ \\\\<^sub>R \\ P'' \\\\' @ K\\\\*xvec\\\\N\\ \\ P'\"\n using FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* \\\\<^sub>R` fresh_comp_chain\n by(drule_tac weak_transitionE) auto\n\n from FrQ' `guarded Q` have \"\\\\<^sub>Q' \\ \\\" and \"supp \\\\<^sub>Q' = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n hence \"A\\<^sub>Q' \\* \\\\<^sub>Q'\" by(auto simp add: fresh_star_def fresh_def)\n\n from P''Trans obtain A\\<^sub>P'' \\\\<^sub>P'' uvec M' where FrP'': \"extract_frame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\"\n and \\': \"\\' = Some(\\A\\<^sub>P''; uvec, M'\\)\" and \"distinct A\\<^sub>P''\" and \"distinct uvec\"\n and \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* uvec\" and M'eqK: \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'' \\ M' \\ K\"\n and \"A\\<^sub>P'' \\* Q\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\" and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"A\\<^sub>P'' \\* M\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* K\"\n and \"A\\<^sub>P'' \\* xvec\" and \"A\\<^sub>P'' \\* yvec\" and \"A\\<^sub>P'' \\* P\" and \"A\\<^sub>P'' \\* P''\"\n and \"uvec \\* Q\" and \"uvec \\* \\\\<^sub>R\" and \"uvec \\* A\\<^sub>R\" and \"uvec \\* M\" and \"uvec \\* R\" and \"uvec \\* K\"\n and \"uvec \\* xvec\" and \"uvec \\* yvec\" and \"uvec \\* \\\" and \"uvec \\* P\" and \"uvec \\* P''\"\n unfolding residual_inject\n by(drule_tac output_provenance[where C=\"(\\,Q,\\\\<^sub>R, A\\<^sub>R, K, M, R, xvec, yvec,P)\"]) auto\n\n from FrP'' `uvec \\* P''` `A\\<^sub>P'' \\* uvec` have \"uvec \\* \\\\<^sub>P''\" by(force dest: extract_frame_fresh_chain)\n\n from M'eqK have M'eqK': \"\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>R \\ M' \\ K\"\n by (meson Assertion_stat_eq_def Assertion_stat_imp_def Associativity associativity_sym)\n\n from `A\\<^sub>R \\* P` PChain have \"A\\<^sub>R \\* P''\" by(rule_tac tau_chain_fresh_chain)\n from `yvec \\* P` PChain have \"yvec \\* P''\" by(rule_tac tau_chain_fresh_chain)\n\n from FrP'' `A\\<^sub>R \\* P''` `A\\<^sub>P'' \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>P''\" by(auto dest: extract_frame_fresh_chain)\n\n from FrP'' `yvec \\* P''` `A\\<^sub>P'' \\* yvec` have \"yvec \\* \\\\<^sub>P''\" by(auto dest: extract_frame_fresh_chain)\n \n from `A\\<^sub>R \\* P''` P''Trans have \"A\\<^sub>R \\* \\'\" by(rule_tac trans_fresh_provenance)\n hence \"A\\<^sub>R \\* M'\" unfolding \\'\n using `A\\<^sub>P'' \\* A\\<^sub>R` using `uvec \\* A\\<^sub>R`\n by (simp add: frame_chain_fresh_chain'')\n from `yvec \\* P''` P''Trans have \"yvec \\* \\'\" by(rule_tac trans_fresh_provenance)\n hence \"yvec \\* M'\" unfolding \\'\n using `A\\<^sub>P'' \\* yvec` using `uvec \\* yvec`\n by (simp add: frame_chain_fresh_chain'')\n\n from FrQ' `A\\<^sub>R \\* Q` `A\\<^sub>Q' \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>Q'\" by(auto dest: extract_frame_fresh_chain)\n\n from PChain have \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ (P' \\ !P))\"\n proof(induct rule: tau_chain_cases)\n case tau_base\n from FrP'' `guarded P` `P = P''` have \"\\\\<^sub>P'' \\ \\\" and \"supp \\\\<^sub>P'' = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n\n with `\\ \\ \\\\<^sub>Q \\ R \\_ @ M\\N\\ \\ R'` FrQ\n have \"\\ \\ \\\\<^sub>P'' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M\\N\\ \\ R'\"\n using Assertion_stat_eq_sym composition_sym\n by(force elim: stat_eq_transition)\n hence \"\\ \\ \\\\<^sub>P'' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\N\\ \\ R'\"\n using `extract_frame R = _` `\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>R \\ M' \\ K`\n Frame_stat_imp_refl `distinct A\\<^sub>R` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* \\`\n `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* R` `A\\<^sub>R \\* M'`\n `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K`\n `distinct yvec` iffD1[OF fresh_chain_sym, OF `yvec \\* A\\<^sub>R`]\n `A\\<^sub>R \\* M'` `yvec \\* \\` `yvec \\* \\\\<^sub>P''` `yvec \\* M'`\n `yvec \\* R` `yvec \\* A\\<^sub>Q` `yvec \\* A\\<^sub>Q`\n by(rule comm2_aux)\n hence \"\\ \\ \\ \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\N\\ \\ R'\"\n using Assertion_stat_eq_sym composition_sym `\\\\<^sub>P'' \\ \\`\n by(force elim: stat_eq_transition)\n moreover note FrR\n moreover from P''Trans `P = P''` have \"\\ \\ \\\\<^sub>R \\ P \\\\' @ K\\\\*xvec\\\\N\\ \\ P'\" by simp\n hence \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\' @ K\\\\*xvec\\\\N\\ \\ P'\" by(rule stat_eq_transition) (metis Identity Assertion_stat_eq_sym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\' @ K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using `xvec \\* \\` `xvec \\* \\\\<^sub>R` `xvec \\* P`\n by(rule_tac Par1[where Q=\"!P\" and A\\<^sub>Q=\"[]\",simplified,unfolded map_option.id[unfolded id_def]]) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\Some(\\\\, \\(A\\<^sub>P'' @ uvec), M'\\\\) @ K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using `guarded P`\n unfolding \\'\n by(rule Bang[where \\=\\', unfolded \\',simplified])\n ultimately have \"\\ \\ R \\ !P \\None @ \\ \\ \\\\*xvec\\(R' \\ (P' \\ !P))\" using `A\\<^sub>R \\* \\` `A\\<^sub>R \\* R` `A\\<^sub>R \\* P` `A\\<^sub>R \\* M` `xvec \\* R`\n `yvec \\* \\` `yvec \\* \\\\<^sub>R` `yvec \\* P` `A\\<^sub>P'' \\* \\` `uvec \\* \\` `A\\<^sub>P'' \\* R` `uvec \\* R`\n by(force intro: Comm1[where A\\<^sub>Q=\"[]\" and zvec = \"A\\<^sub>P'' @ uvec\",simplified])\n thus ?case by(rule tau_act_tau_chain)\n next\n case tau_step\n from `\\ \\ \\\\<^sub>R \\ P \\\\<^sub>\\ P''` have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\<^sub>\\ P''\" by(rule tau_step_chain_stat_eq) (metis Identity Assertion_stat_eq_sym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\<^sub>\\ P'' \\ !P\" by(rule_tac tau_step_chain_par1) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ P'' \\ !P\" using `guarded P` by(rule tau_step_chain_bang)\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ R \\ (P'' \\ !P)\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P`\n by(rule_tac tau_step_chain_par2) auto\n moreover have \"\\ \\ R \\ (P'' \\ !P) \\None @ \\ \\ \\\\*xvec\\(R' \\ (P' \\ !P))\"\n proof -\n from FrQ `\\\\<^sub>Q' \\ \\` `\\ \\ \\\\<^sub>Q \\ R \\_ @ M\\N\\ \\ R'` have \"\\ \\ \\\\<^sub>Q' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M\\N\\ \\ R'\"\n by simp (metis stat_eq_transition Assertion_stat_eq_sym composition_sym)\n moreover from P''Trans have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P'' \\\\' @ K\\\\*xvec\\\\N\\ \\ P'\"\n by(rule stat_eq_transition) (metis Identity Assertion_stat_eq_sym)\n hence P''PTrans: \"\\ \\ \\\\<^sub>R \\ P'' \\ !P \\\\' @ K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using `xvec \\* P`\n by(rule_tac Par1[where A\\<^sub>Q=\"[]\" and Q=\"!P\",simplified,unfolded map_option.id[unfolded id_def]]) auto\n moreover from FrP'' have FrP''P: \"extract_frame(P'' \\ !P) = \\A\\<^sub>P'', \\\\<^sub>P'' \\ \\\\\"\n by auto\n moreover from `_ \\ _ \\ _ \\ M' \\ K` have \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ M' \\ K\"\n using Assertion_stat_eq_sym Composition Identity composition_sym stat_eq_ent by blast\n moreover have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ (\\\\<^sub>P'' \\ \\)) \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\\"\n by(rule_tac frame_res_chain_pres, simp)\n (metis Associativity Commutativity Composition Assertion_stat_eq_trans Assertion_stat_eq_sym)\n moreover from NilImpP'' FrQ FrP'' `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* \\\\<^sub>R` fresh_comp_chain have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\\"\n by auto\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R\\\"\n by(rule frame_res_chain_pres, simp) \n (metis Identity Assertion_stat_eq_sym Associativity Commutativity Composition Assertion_stat_eq_trans)\n ultimately show ?thesis by(rule Frame_stat_eq_imp_compose)\n qed\n ultimately have RTrans: \"\\ \\ \\\\<^sub>P'' \\ \\ \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\N\\ \\ R'\"\n using FrR FrQ' `distinct A\\<^sub>R` `distinct A\\<^sub>P''` `A\\<^sub>P'' \\* A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P''` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* M` `A\\<^sub>Q' \\* R` `A\\<^sub>Q' \\* K` `A\\<^sub>Q' \\* A\\<^sub>R` `A\\<^sub>R \\* P` `A\\<^sub>P'' \\* P` `A\\<^sub>R \\* xvec`\n `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* K` `xvec \\* K` `distinct xvec` FrR\n `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* \\\\<^sub>Q'` `A\\<^sub>R \\* M'` `distinct yvec` `yvec \\* A\\<^sub>R`\n `yvec \\* \\` `yvec \\* \\\\<^sub>P''` `yvec \\* M'` `yvec \\* R` `A\\<^sub>P'' \\* yvec` `A\\<^sub>Q' \\* yvec`\n by(rule_tac A\\<^sub>Q=\"A\\<^sub>Q'\" in comm2_aux) (assumption | simp | force)+\n note RTrans FrR P''PTrans FrP''P\n thus ?thesis using `A\\<^sub>R \\* \\` `A\\<^sub>R \\* R` `A\\<^sub>R \\* P''` `A\\<^sub>R \\* P` `A\\<^sub>R \\* M'` `A\\<^sub>P'' \\* A\\<^sub>R` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* P` `A\\<^sub>P'' \\* K` `xvec \\* R` `yvec \\* \\` `yvec \\* \\\\<^sub>R` `yvec \\* P''` `yvec \\* P` `uvec \\* \\` `uvec \\* R` `uvec \\* \\\\<^sub>P''`\n unfolding \\'\n by(rule_tac Comm1) (assumption | simp | force)+\n qed\n ultimately show ?thesis\n by(drule_tac tau_act_tau_chain) auto\n qed\n\n moreover from P'Chain have \"((\\ \\ \\\\<^sub>R) \\ \\') \\ \\ \\ P' \\\\<^sup>^\\<^sub>\\ T\"\n by(rule tau_chain_stat_eq) (metis Identity Assertion_stat_eq_sym)\n hence \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\ !P \\\\<^sup>^\\<^sub>\\ T \\ !P\"\n by(rule_tac tau_chain_par1) auto\n hence \"\\ \\ \\\\<^sub>R \\ \\' \\ P' \\ !P \\\\<^sup>^\\<^sub>\\ T \\ !P\"\n by(rule tau_chain_stat_eq) (metis Associativity)\n hence \"\\ \\ \\\\<^sub>R' \\ P' \\ !P\\\\<^sup>^\\<^sub>\\ T \\ !P\" using `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'`\n by(rule_tac tau_chain_stat_eq) (auto intro: composition_sym)\n hence \"\\ \\ R' \\ (P' \\ !P) \\\\<^sup>^\\<^sub>\\ R' \\ (T \\ !P)\" using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P` `A\\<^sub>R' \\* P'`\n by(rule_tac tau_chain_par2) auto\n hence \"\\ \\ \\\\*xvec\\(R' \\ (P' \\ !P)) \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ (T \\ !P))\" using `xvec \\* \\`\n by(rule tau_chain_res_chain_pres)\n ultimately have \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ (T \\ !P))\"\n by auto\n moreover have \"(\\, \\\\*xvec\\(R' \\ (T \\ !P)), \\\\*xvec\\(R' \\ Q')) \\ Rel''\"\n proof -\n from `((\\ \\ \\\\<^sub>R) \\ \\', T, S) \\ Rel` have \"(\\ \\ \\\\<^sub>R \\ \\', T, S) \\ Rel\"\n by(rule StatEq) (metis Associativity)\n hence \"(\\ \\ \\\\<^sub>R', T, S) \\ Rel\" using `\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'`\n by(rule_tac StatEq) (auto dest: composition_sym)\n\n with FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* S` `A\\<^sub>R' \\* T` have \"(\\, R' \\ T, R' \\ S) \\ Rel\"\n by(rule_tac FrameParPres) auto\n hence \"(\\, (R' \\ T) \\ !P, (R' \\ S) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, \\\\*xvec\\((R' \\ T) \\ !P), \\\\*xvec\\((R' \\ S) \\ !P)) \\ Rel\" using `xvec \\* \\`\n by(rule ResPres)\n hence \"(\\, \\\\*xvec\\(R' \\ T) \\ !P, (\\\\*xvec\\(R' \\ S)) \\ !P) \\ Rel\" using `xvec \\* \\` `xvec \\* P`\n by(force intro: Trans ScopeExt)\n hence \"(\\, \\\\*xvec\\(R' \\ (T \\ !P)), (\\\\*xvec\\(R' \\ S)) \\ !P) \\ Rel\" using `xvec \\* \\`\n by(force intro: Trans ResPres Assoc)\n\n moreover from `(\\, P, Q) \\ Rel` `guarded P` `guarded Q` have \"(\\, (\\\\*xvec\\(R' \\ S)) \\ !P, (\\\\*xvec\\(R' \\ S)) \\ !Q) \\ Rel''\"\n by(rule C1)\n moreover from `(\\, Q', S \\ !Q) \\ Rel'` have \"(\\ \\ \\, Q', S \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', S \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity Assertion_stat_eq_sym Commutativity Assertion_stat_eq_trans)\n hence \"(\\, R' \\ Q', R' \\ (S \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R' \\ Q', (R' \\ S) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R' \\ S) \\ !Q, R' \\ Q') \\ Rel'\" by(rule cSym')\n hence \"(\\, \\\\*xvec\\((R' \\ S) \\ !Q), \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using `xvec \\* \\`\n by(rule ResPres')\n hence \"(\\, (\\\\*xvec\\(R' \\ S)) \\ !Q, \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using `xvec \\* \\` `xvec \\* Q`\n by(force intro: Trans' ScopeExt'[THEN cSym'])\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n next\n case(c_comm2 \\\\<^sub>Q M xvec N R' A\\<^sub>R \\\\<^sub>R K Q' A\\<^sub>Q yvec zvec)\n from `A\\<^sub>R \\* (P, Q, R)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n from `xvec \\* (P, Q, R)` have \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n from `yvec \\* (P, Q, R)` have \"yvec \\* P\" and \"yvec \\* Q\" and \"yvec \\* R\" by simp+\n from `zvec \\* (P, Q, R)` have \"zvec \\* P\" and \"zvec \\* Q\" and \"zvec \\* R\" by simp+\n have FrQ: \"extract_frame(!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from `\\ \\ \\\\<^sub>Q \\ R \\_ @ M\\\\*xvec\\\\N\\ \\ R'` FrR `distinct A\\<^sub>R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* N` `A\\<^sub>R \\* xvec` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\` `xvec \\* R` `xvec \\* \\` `xvec \\* P` `xvec \\* Q` `xvec \\* M` `distinct xvec` `A\\<^sub>R \\* M`\n obtain p A\\<^sub>R' \\\\<^sub>R' \\' where FrR': \"extract_frame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" and \"(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\" and S: \"set p \\ set xvec \\ set(p \\ xvec)\" and \"distinct_perm p\" and \"(p \\ xvec) \\* N\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* R'\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* \\\" and \"A\\<^sub>R' \\* N\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* (p \\ xvec)\"\n by(rule_tac C=\"(\\, P, Q)\" and C'=\"(\\, P, Q)\" in expand_frame) (assumption | simp)+\n\n from `\\ \\ \\\\<^sub>Q \\ R \\_ @ M\\\\*xvec\\\\N\\ \\ R'` S `(p \\ xvec) \\* N` `(p \\ xvec) \\* R'`\n have RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\ Some (\\A\\<^sub>R; yvec, K\\) @ M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n by(simp add: bound_output_chain_alpha'' residual_inject)\n from `(\\, P, Q) \\ Rel` have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n moreover from `\\ \\ \\\\<^sub>R \\ !Q \\_ @ K\\N\\ \\ Q'` S `(p \\ xvec) \\* Q` `xvec \\* Q` `distinct_perm p`\n have \"\\ \\ \\\\<^sub>R \\ !Q \\Some (\\A\\<^sub>Q; zvec, M\\) @ K\\(p \\ N)\\ \\ (p \\ Q')\" \n by(rule_tac input_alpha) auto\n then obtain \\ S where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\\\ @ K\\(p \\ N)\\ \\ S\" and \"(\\, (p \\ Q'), S \\ !Q) \\ Rel'\" \n using `guarded Q`\n by(fastforce dest: rBangActE)\n ultimately obtain P' \\' T where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\\\' @ K\\(p \\ N)\\ \\ P'\" \n and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ (p \\ \\') \\ P' \\\\<^sup>^\\<^sub>\\ T\" \n and \"((\\ \\ \\\\<^sub>R) \\ (p \\ \\'), T, S) \\ Rel\"\n by(fastforce dest: cSim dest!: weakSimE(1))\n\n from `A\\<^sub>R' \\* N` `A\\<^sub>R' \\* xvec` `A\\<^sub>R' \\* (p \\ xvec)` S have \"A\\<^sub>R' \\* (p \\ N)\"\n by(simp add: fresh_chain_simps)\n with PTrans `A\\<^sub>R' \\* P` have \"A\\<^sub>R' \\* P'\" by(force dest: weak_input_fresh_chain_derivative)\n with P'Chain have \"A\\<^sub>R' \\* T\" by(force dest: tau_chain_fresh_chain)+\n from QTrans `A\\<^sub>R' \\* Q` `A\\<^sub>R' \\* (p \\ N)` have \"A\\<^sub>R' \\* S\" by(force dest: input_fresh_chain_derivative)\n\n obtain A\\<^sub>Q' \\\\<^sub>Q' where FrQ': \"extract_frame Q = \\A\\<^sub>Q', \\\\<^sub>Q'\\\" and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* \\\\<^sub>R\" and \"A\\<^sub>Q' \\* A\\<^sub>R\" and \"A\\<^sub>Q' \\* M\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* xvec\" and \"A\\<^sub>Q' \\* yvec\" and \"A\\<^sub>Q' \\* K\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R, K, M, R, xvec, yvec)\" in fresh_frame) auto\n from FrQ' `guarded Q` have \"\\\\<^sub>Q' \\ \\\" and \"supp \\\\<^sub>Q' = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n hence \"A\\<^sub>Q' \\* \\\\<^sub>Q'\" by(auto simp add: fresh_star_def fresh_def)\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and NilImpP'': \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F insert_assertion (extract_frame P'') (\\ \\ \\\\<^sub>R)\"\n and P''Trans: \"\\ \\ \\\\<^sub>R \\ P'' \\\\' @ K\\(p \\ N)\\ \\ P'\"\n using FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* \\\\<^sub>R` fresh_comp_chain\n by(drule_tac weak_transitionE) auto\n\n from `(p \\ xvec) \\* P` `xvec \\* P` PChain have \"(p \\ xvec) \\* P''\" and \"xvec \\* P''\" \n by(force dest: tau_chain_fresh_chain)+\n from `(p \\ xvec) \\* N` `distinct_perm p` have \"xvec \\* (p \\ N)\"\n by(subst pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst, where pi=p, symmetric]) simp\n with P''Trans `xvec \\* P''` have \"xvec \\* P'\" by(force dest: input_fresh_chain_derivative)\n hence \"(p \\ xvec) \\* (p \\ P')\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n\n from P''Trans obtain A\\<^sub>P'' \\\\<^sub>P'' uvec M' where FrP'': \"extract_frame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\"\n and \\': \"\\' = Some(\\A\\<^sub>P''; uvec, M'\\)\" and \"distinct A\\<^sub>P''\" and \"distinct uvec\"\n and \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* uvec\" and M'eqK: \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'' \\ K \\ M'\"\n and \"A\\<^sub>P'' \\* Q\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\" and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"A\\<^sub>P'' \\* M\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* K\"\n and \"A\\<^sub>P'' \\* xvec\" and \"A\\<^sub>P'' \\* yvec\" and \"A\\<^sub>P'' \\* P\" and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* p\"\n and \"uvec \\* Q\" and \"uvec \\* \\\\<^sub>R\" and \"uvec \\* A\\<^sub>R\" and \"uvec \\* M\" and \"uvec \\* R\" and \"uvec \\* K\"\n and \"uvec \\* xvec\" and \"uvec \\* yvec\" and \"uvec \\* \\\" and \"uvec \\* P\" and \"uvec \\* P''\" and \"uvec \\* p\"\n by(drule_tac input_provenance[where C=\"(\\,Q,\\\\<^sub>R, A\\<^sub>R, K, M, R, xvec, yvec,P,p)\"]) auto\n\n from FrP'' `uvec \\* P''` `A\\<^sub>P'' \\* uvec` have \"uvec \\* \\\\<^sub>P''\" by(force dest: extract_frame_fresh_chain)\n\n from M'eqK have M'eqK': \"\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>R \\ K \\ M'\"\n by (meson Assertion_stat_eq_def Assertion_stat_imp_def Associativity associativity_sym)\n\n from `A\\<^sub>R \\* P` PChain have \"A\\<^sub>R \\* P''\" by(rule_tac tau_chain_fresh_chain)\n from `yvec \\* P` PChain have \"yvec \\* P''\" by(rule_tac tau_chain_fresh_chain)\n\n from FrP'' `A\\<^sub>R \\* P''` `A\\<^sub>P'' \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>P''\" by(auto dest: extract_frame_fresh_chain)\n\n from FrP'' `yvec \\* P''` `A\\<^sub>P'' \\* yvec` have \"yvec \\* \\\\<^sub>P''\" by(auto dest: extract_frame_fresh_chain)\n\n from `A\\<^sub>R \\* P''` P''Trans have \"A\\<^sub>R \\* \\'\" by(rule_tac trans_fresh_provenance)\n hence \"A\\<^sub>R \\* M'\" unfolding \\'\n using `A\\<^sub>P'' \\* A\\<^sub>R` using `uvec \\* A\\<^sub>R`\n by (simp add: frame_chain_fresh_chain'')\n from `yvec \\* P''` P''Trans have \"yvec \\* \\'\" by(rule_tac trans_fresh_provenance)\n hence \"yvec \\* M'\" unfolding \\'\n using `A\\<^sub>P'' \\* yvec` using `uvec \\* yvec`\n by (simp add: frame_chain_fresh_chain'')\n\n from FrQ' `A\\<^sub>R \\* Q` `A\\<^sub>Q' \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>Q'\" by(auto dest: extract_frame_fresh_chain)\n\n from PChain have \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\"\n proof(induct rule: tau_chain_cases)\n case tau_base\n from FrP'' `guarded P` `P = P''` have \"\\\\<^sub>P'' \\ \\\" and \"supp \\\\<^sub>P'' = ({}::name set)\" by(blast dest: guarded_stat_eq)+\n with RTrans FrQ have \"\\ \\ \\\\<^sub>P'' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n using Assertion_stat_eq_sym composition_sym\n by(force elim: stat_eq_transition)\n hence \"\\ \\ \\\\<^sub>P'' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n using `extract_frame R = _` `\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>R \\ K \\ M'`\n Frame_stat_imp_refl `distinct A\\<^sub>R` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* \\`\n `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* R` `A\\<^sub>R \\* M'`\n `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K`\n `distinct yvec` iffD1[OF fresh_chain_sym, OF `yvec \\* A\\<^sub>R`]\n `A\\<^sub>R \\* M'` `yvec \\* \\` `yvec \\* \\\\<^sub>P''` `yvec \\* M'`\n `yvec \\* R` `yvec \\* A\\<^sub>Q` `yvec \\* A\\<^sub>Q`\n by(rule comm1_aux)\n hence \"\\ \\ \\ \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n using Assertion_stat_eq_sym composition_sym `\\\\<^sub>P'' \\ \\`\n by(force elim: stat_eq_transition)\n moreover note FrR\n moreover from P''Trans `P = P''` have \"\\ \\ \\\\<^sub>R \\ P \\\\' @ K\\(p \\ N)\\\\ P'\" by simp\n hence \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\' @ K\\(p \\ N)\\ \\ P'\" \n by(rule stat_eq_transition) (metis Identity Assertion_stat_eq_sym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\' @ K\\(p \\ N)\\ \\ (P' \\ !P)\"\n by(rule_tac Par1[where Q=\"!P\" and A\\<^sub>Q=\"[]\",simplified,unfolded map_option.id[unfolded id_def]]) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\Some(\\\\, \\(A\\<^sub>P'' @ uvec), M'\\\\) @ K\\(p \\ N)\\ \\ (P' \\ !P)\" using `guarded P`\n unfolding \\'\n by(rule Bang[where \\=\\', unfolded \\',simplified])\n ultimately have \"\\ \\ R \\ !P \\None @ \\ \\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\" using `A\\<^sub>R \\* \\` `A\\<^sub>R \\* R` `A\\<^sub>R \\* P` `A\\<^sub>R \\* M` `(p \\ xvec) \\* P`\n `yvec \\* \\` `yvec \\* \\\\<^sub>R` `yvec \\* P` `A\\<^sub>P'' \\* \\` `uvec \\* \\` `A\\<^sub>P'' \\* R` `uvec \\* R`\n by(force intro: Comm2[where A\\<^sub>Q=\"[]\" and zvec = \"A\\<^sub>P'' @ uvec\",simplified])\n thus ?case by(rule tau_act_tau_chain)\n next\n case tau_step\n from `\\ \\ \\\\<^sub>R \\ P \\\\<^sub>\\ P''` have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\<^sub>\\ P''\" by(rule tau_step_chain_stat_eq) (metis Identity Assertion_stat_eq_sym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\<^sub>\\ P'' \\ !P\" by(rule_tac tau_step_chain_par1) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ P'' \\ !P\" using `guarded P` by(rule tau_step_chain_bang)\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ R \\ (P'' \\ !P)\" using FrR `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P`\n by(rule_tac tau_step_chain_par2) auto\n moreover have \"\\ \\ R \\ (P'' \\ !P) \\None @ \\ \\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\"\n proof -\n from FrQ `\\\\<^sub>Q' \\ \\` RTrans have \"\\ \\ \\\\<^sub>Q' \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n by simp (metis stat_eq_transition Assertion_stat_eq_sym composition_sym)\n moreover from P''Trans have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P'' \\\\' @ K\\(p \\ N)\\ \\ P'\"\n by(rule stat_eq_transition) (metis Identity Assertion_stat_eq_sym)\n hence P''PTrans: \"\\ \\ \\\\<^sub>R \\ P'' \\ !P \\\\' @ K\\(p \\ N)\\ \\ (P' \\ !P)\"\n by(rule_tac Par1[where Q=\"!P\" and A\\<^sub>Q=\"[]\",simplified,unfolded map_option.id[unfolded id_def]]) auto\n moreover from FrP'' have FrP''P: \"extract_frame(P'' \\ !P) = \\A\\<^sub>P'', \\\\<^sub>P'' \\ \\\\\"\n by auto\n moreover from `_ \\ _ \\ _ \\ K \\ M'` have \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ K \\ M'\"\n using Assertion_stat_eq_sym Composition Identity composition_sym stat_eq_ent by blast\n moreover have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ (\\\\<^sub>P'' \\ \\)) \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\\"\n by(rule_tac frame_res_chain_pres, simp)\n (metis Associativity Commutativity Composition Assertion_stat_eq_trans Assertion_stat_eq_sym)\n moreover from NilImpP'' FrQ FrP'' `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* \\\\<^sub>R` fresh_comp_chain have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\\"\n by auto\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R\\\"\n by(rule frame_res_chain_pres, simp) \n (metis Identity Assertion_stat_eq_sym Associativity Commutativity Composition Assertion_stat_eq_trans)\n ultimately show ?thesis by(rule Frame_stat_eq_imp_compose)\n qed\n ultimately have RTrans: \"\\ \\ \\\\<^sub>P'' \\ \\ \\ R \\Some (\\A\\<^sub>R; yvec, K\\) @ M'\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n using FrR FrQ' `distinct A\\<^sub>R` `distinct A\\<^sub>P''` `A\\<^sub>P'' \\* A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P''` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* M` `A\\<^sub>Q' \\* R` `A\\<^sub>Q' \\* K` `A\\<^sub>Q' \\* A\\<^sub>R` `A\\<^sub>R \\* P` `A\\<^sub>P'' \\* P`\n `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* K` FrR `A\\<^sub>R \\* \\\\<^sub>P''` `A\\<^sub>R \\* \\\\<^sub>Q'` `A\\<^sub>R \\* M'` `distinct yvec` `yvec \\* A\\<^sub>R`\n `yvec \\* \\` `yvec \\* \\\\<^sub>P''` `yvec \\* M'` `yvec \\* R` `A\\<^sub>P'' \\* yvec` `A\\<^sub>Q' \\* yvec`\n by(rule_tac A\\<^sub>Q=\"A\\<^sub>Q'\" in comm1_aux) (assumption | simp | force)+\n note RTrans FrR P''PTrans FrP''P\n thus ?thesis using `A\\<^sub>R \\* \\` `A\\<^sub>R \\* R` `A\\<^sub>R \\* P''` `A\\<^sub>R \\* P` `A\\<^sub>R \\* M'` `A\\<^sub>P'' \\* A\\<^sub>R` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* P` `A\\<^sub>P'' \\* K` `(p \\ xvec) \\* P''` `(p \\ xvec) \\* P`\n `yvec \\* \\` `yvec \\* \\\\<^sub>R` `yvec \\* P` `A\\<^sub>P'' \\* \\` `uvec \\* \\` `A\\<^sub>P'' \\* R` `uvec \\* R` `yvec \\* P''` `uvec \\* \\\\<^sub>P''`\n unfolding \\'\n by(rule_tac Comm2) (assumption | simp | force)+\n qed\n ultimately show ?thesis\n by(drule_tac tau_act_tau_chain) auto\n qed\n hence \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ P') \\ !P))\" \n using `xvec \\* P` `(p \\ xvec) \\* P` `(p \\ xvec) \\* (p \\ P')` `(p \\ xvec) \\* R'` S `distinct_perm p`\n by(subst res_chain_alpha[where p=p]) auto\n moreover from P'Chain have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\'))) \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\"\n by(rule tau_chain_eqvt)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S `distinct_perm p`\n have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\" by(simp add: eqvts)\n hence \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\') \\ \\ \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\"\n by(rule tau_chain_stat_eq) (metis Identity Assertion_stat_eq_sym)\n hence \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\"\n by(rule_tac tau_chain_par1) auto\n hence \"\\ \\ (p \\ \\\\<^sub>R) \\ \\' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\"\n by(rule tau_chain_stat_eq) (metis Associativity)\n hence \"\\ \\ \\\\<^sub>R' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\" using `(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'`\n by(rule_tac tau_chain_stat_eq) (auto intro: composition_sym)\n hence \"\\ \\ R' \\ ((p \\ P') \\ !P) \\\\<^sup>^\\<^sub>\\ R' \\ ((p \\ T) \\ !P)\" \n using FrR' `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P` `A\\<^sub>R' \\* P'` `A\\<^sub>R' \\* xvec` `A\\<^sub>R' \\* (p \\ xvec)` S\n by(rule_tac tau_chain_par2) (auto simp add: fresh_chain_simps)\n hence \"\\ \\ \\\\*xvec\\(R' \\ ((p \\ P') \\ !P)) \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ T) \\ !P))\" using `xvec \\* \\`\n by(rule tau_chain_res_chain_pres)\n ultimately have \"\\ \\ R \\ !P \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ T) \\ !P))\"\n by auto\n moreover have \"(\\, \\\\*xvec\\(R' \\ ((p \\ T) \\ !P)), \\\\*xvec\\(R' \\ Q')) \\ Rel''\"\n proof -\n from `((\\ \\ \\\\<^sub>R) \\ (p \\ \\'), T, S) \\ Rel` \n have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\')), (p \\ T), (p \\ S)) \\ Rel\"\n by(rule Closed)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` `distinct_perm p` S\n have \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\', p \\ T, p \\ S) \\ Rel\"\n by(simp add: eqvts)\n hence \"(\\ \\ (p \\ \\\\<^sub>R) \\ \\', p \\ T, p \\ S) \\ Rel\"\n by(rule StatEq) (metis Associativity)\n hence \"(\\ \\ \\\\<^sub>R', p \\ T, p \\ S) \\ Rel\" using `(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'`\n by(rule_tac StatEq) (auto dest: composition_sym)\n moreover from `A\\<^sub>R' \\* S` `A\\<^sub>R' \\* T` `A\\<^sub>R' \\* xvec` `A\\<^sub>R' \\* (p \\ xvec)` S\n have \"A\\<^sub>R' \\* (p \\ S)\" and \"A\\<^sub>R' \\* (p \\ T)\"\n by(simp add: fresh_chain_simps)+\n ultimately have \"(\\, R' \\ (p \\ T), R' \\ (p \\ S)) \\ Rel\" using FrR' `A\\<^sub>R' \\* \\`\n by(rule_tac FrameParPres) auto\n hence \"(\\, (R' \\ (p \\ T)) \\ !P, (R' \\ (p \\ S)) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, \\\\*xvec\\((R' \\ (p \\ T)) \\ !P), \\\\*xvec\\((R' \\ (p \\ S)) \\ !P)) \\ Rel\" \n using `xvec \\* \\`\n by(rule ResPres)\n hence \"(\\, \\\\*xvec\\(R' \\ (p \\ T)) \\ !P, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P) \\ Rel\" \n using `xvec \\* \\` `xvec \\* P`\n by(force intro: Trans ScopeExt)\n hence \"(\\, \\\\*xvec\\(R' \\ ((p \\ T) \\ !P)), (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P) \\ Rel\"\n using `xvec \\* \\`\n by(force intro: Trans ResPres Assoc)\n moreover from `(\\, P, Q) \\ Rel` `guarded P` `guarded Q` \n have \"(\\, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !Q) \\ Rel''\"\n by(rule C1)\n moreover from `(\\, (p \\ Q'), S \\ !Q) \\ Rel'` \n have \"(p \\ \\, p \\ p \\ Q', p \\ (S \\ !Q)) \\ Rel'\" by(rule Closed')\n with `xvec \\* Q` `(p \\ xvec) \\* Q` S `distinct_perm p` \n have \"(\\, Q', (p \\ S) \\ !Q) \\ Rel'\" by(simp add: eqvts)\n hence \"(\\ \\ \\, Q', (p \\ S) \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', (p \\ S) \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity Assertion_stat_eq_sym Commutativity Assertion_stat_eq_trans)\n hence \"(\\, R' \\ Q', R' \\ ((p \\ S) \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R' \\ Q', (R' \\ (p \\ S)) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R' \\ (p \\ S)) \\ !Q, R' \\ Q') \\ Rel'\" by(rule cSym')\n hence \"(\\, \\\\*xvec\\((R' \\ (p \\ S)) \\ !Q), \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using `xvec \\* \\`\n by(rule ResPres')\n hence \"(\\, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !Q, \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using `xvec \\* \\` `xvec \\* Q`\n by(force intro: Trans' ScopeExt'[THEN cSym'])\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n qed\nqed\nnotation relcomp (infixr \"O\" 75)\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2638190910332891}} {"text": "(*\n * Copyright (C) 2014, National ICT Australia Limited. All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above copyright\n * notice, this list of conditions and the following disclaimer in the\n * documentation and/or other materials provided with the distribution.\n *\n * * The name of National ICT Australia Limited nor the names of its\n * contributors may be used to endorse or promote products derived from\n * this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS\n * IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED\n * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\n * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n *)\n\ntheory WordLemmaBucket\nimports\n Lib\n MoreDivides\n Aligned\n HOLLemmaBucket\n DistinctPropLemmaBucket\n \"~~/src/HOL/Library/Sublist\"\n \"~~/src/HOL/Library/Prefix_Order\"\nbegin\n\n(* Setup \"quickcheck\" to support words. *)\n\nquickcheck_generator word\n constructors:\n \"zero_class.zero :: ('a::len) word\",\n \"numeral :: num \\ ('a::len) word\",\n \"uminus :: ('a::len) word \\ ('a::len) word\"\n\ninstantiation Enum.finite_1 :: len\nbegin\n definition \"len_of_finite_1 (x :: Enum.finite_1 itself) \\ (1 :: nat)\"\n instance\n by (default, auto simp: len_of_finite_1_def)\nend\n\ninstantiation Enum.finite_2 :: len\nbegin\n definition \"len_of_finite_2 (x :: Enum.finite_2 itself) \\ (2 :: nat)\"\n instance\n by (default, auto simp: len_of_finite_2_def)\nend\n\ninstantiation Enum.finite_3 :: len\nbegin\n definition \"len_of_finite_3 (x :: Enum.finite_3 itself) \\ (4 :: nat)\"\n instance\n by (default, auto simp: len_of_finite_3_def)\nend\n\n(* Provide wf and less_induct for word.\n wf may be more useful in loop proofs, less_induct in recursion proofs. *)\nlemma word_less_wf: \"wf {(a, b). a < (b :: ('a::len) word)}\"\n apply (rule wf_subset)\n apply (rule wf_measure)\n apply safe\n apply (subst in_measure)\n apply (erule unat_mono)\n done\n\nlemma word_less_induct:\n \"\\ \\x::('a::len) word. (\\y. y < x \\ P y) \\ P x \\ \\ P a\"\n using word_less_wf\n apply induct\n apply blast\n done\n\ninstantiation word :: (len) wellorder\nbegin\ninstance\n apply (intro_classes)\n apply (metis word_less_induct)\n done\nend\n\n\nlemma word_plus_mono_left:\n fixes x :: \"'a :: len word\"\n shows \"\\y \\ z; x \\ x + z\\ \\ y + x \\ z + x\"\n by unat_arith\n\nlemma word_2p_mult_inc:\n assumes x: \"2 * 2 ^ n < (2::'a::len word) * 2 ^ m\"\n assumes suc_n: \"Suc n < len_of TYPE('a::len)\"\n assumes suc_m: \"Suc m < len_of TYPE('a::len)\"\n assumes 2: \"unat (2::'a::len word) = 2\"\n shows \"2^n < (2::'a::len word)^m\"\nproof -\n from suc_n\n have \"(2::nat) * 2 ^ n mod 2 ^ len_of TYPE('a::len) = 2 * 2^n\"\n apply (subst mod_less)\n apply (subst power_Suc[symmetric])\n apply (rule power_strict_increasing)\n apply simp\n apply simp\n apply simp\n done\n moreover\n from suc_m\n have \"(2::nat) * 2 ^ m mod 2 ^ len_of TYPE('a::len) = 2 * 2^m\"\n apply (subst mod_less)\n apply (subst power_Suc[symmetric])\n apply (rule power_strict_increasing)\n apply simp\n apply simp\n apply simp\n done\n ultimately\n have \"2 * 2 ^ n < (2::nat) * 2 ^ m\" using x\n apply (unfold word_less_nat_alt)\n apply simp\n apply (subst (asm) unat_word_ariths(2))+\n apply (subst (asm) 2)+\n apply (subst (asm) word_unat_power, subst (asm) unat_of_nat)+\n apply (simp add: mod_mult_right_eq[symmetric])\n done\n with suc_n suc_m\n show ?thesis\n unfolding word_less_nat_alt\n apply (subst word_unat_power, subst unat_of_nat)+\n apply simp\n done\nqed\n\n\n\nlemma word_shiftl_add_distrib:\n fixes x :: \"'a :: len word\"\n shows \"(x + y) << n = (x << n) + (y << n)\"\n by (simp add: shiftl_t2n ring_distribs)\n\nlemma upper_bits_unset_is_l2p:\n \"n < word_bits \\ (\\n' \\ n. n' < word_bits \\ \\ p !! n') = ((p::word32) < 2 ^ n)\"\n apply (rule iffI)\n prefer 2\n apply (clarsimp simp: word_bits_def)\n apply (drule bang_is_le)\n apply (drule_tac y=p in order_le_less_trans, assumption)\n apply (drule word_power_increasing)\n apply simp\n apply simp\n apply simp\n apply simp\n apply (subst mask_eq_iff_w2p [symmetric])\n apply (clarsimp simp: word_size word_bits_def)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_bits_def)\n apply (case_tac \"na < n\", auto)\n done\n\nlemma up_ucast_inj:\n \"\\ ucast x = (ucast y::'b::len word); len_of TYPE('a) \\ len_of TYPE ('b) \\ \\ x = (y::'a::len word)\"\n apply (subst (asm) bang_eq)\n apply (fastforce simp: nth_ucast word_size intro: word_eqI)\n done\n\nlemma up_ucast_inj_eq:\n \"len_of TYPE('a) \\ len_of TYPE ('b) \\ (ucast x = (ucast y::'b::len word)) = (x = (y::'a::len word))\"\n by (fastforce dest: up_ucast_inj)\n\nlemma ucast_up_inj:\n \"\\ ucast x = (ucast y :: 'b::len word); len_of TYPE('a) \\ len_of TYPE('b) \\\n \\ x = (y :: 'a::len word)\"\n apply (subst (asm) bang_eq)\n apply (rule word_eqI)\n apply (simp add: word_size nth_ucast)\n apply (erule_tac x=n in allE)\n apply simp\n done\n\nlemma ucast_8_32_inj:\n \"inj (ucast :: 8 word \\ 32 word)\"\n apply (rule down_ucast_inj)\n apply (clarsimp simp: is_down_def target_size source_size)\n done\n\nlemma no_plus_overflow_neg:\n \"(x :: ('a :: len) word) < -y \\ x \\ x + y\"\n apply (simp add: no_plus_overflow_uint_size\n word_less_alt uint_word_ariths\n word_size)\n apply (subst(asm) zmod_zminus1_eq_if)\n apply (simp split: split_if_asm)\n done\n\nlemma ucast_ucast_eq:\n fixes x :: \"'a::len word\"\n fixes y :: \"'b::len word\"\n shows\n \"\\ ucast x = (ucast (ucast y::'a::len word)::'c::len word);\n len_of TYPE('a) \\ len_of TYPE('b);\n len_of TYPE('b) \\ len_of TYPE('c) \\ \\\n x = ucast y\"\n apply (rule word_eqI)\n apply (subst (asm) bang_eq)\n apply (erule_tac x=n in allE)\n apply (simp add: nth_ucast word_size)\n done\n\n(******** GeneralLib ****************)\n\n\nlemma neq_into_nprefixeq:\n \"\\ x \\ take (length x) y \\ \\ \\ x \\ y\"\n by (clarsimp simp: prefixeq_def less_eq_list_def)\n\nlemma distinct_suffixeq:\n assumes dx: \"distinct xs\"\n and pf: \"suffixeq ys xs\"\n shows \"distinct ys\"\n using dx pf by (clarsimp elim!: suffixeqE)\n\nlemma suffixeq_map:\n assumes pf: \"suffixeq ys xs\"\n shows \"suffixeq (map f ys) (map f xs)\"\n using pf by (auto elim!: suffixeqE intro: suffixeqI)\n\nlemma suffixeq_drop [simp]:\n \"suffixeq (drop n as) as\"\n unfolding suffixeq_def\n apply (rule exI [where x = \"take n as\"])\n apply simp\n done\n\nlemma suffixeq_take:\n \"suffixeq ys xs \\ xs = take (length xs - length ys) xs @ ys\"\n by (clarsimp elim!: suffixeqE)\n\nlemma suffixeq_eqI:\n \"\\ suffixeq xs as; suffixeq xs bs; length as = length bs;\n take (length as - length xs) as \\ take (length bs - length xs) bs\\ \\ as = bs\"\n by (clarsimp elim!: prefixE suffixeqE)\n\nlemma suffixeq_Cons_mem:\n \"suffixeq (x # xs) as \\ x \\ set as\"\n apply (drule suffixeq_set_subset)\n apply simp\n done\n\nlemma list_induct_suffixeq [case_names Nil Cons]:\n assumes nilr: \"P []\"\n and consr: \"\\x xs. \\P xs; suffixeq (x # xs) as \\ \\ P (x # xs)\"\n shows \"P as\"\nproof -\n def as' == as\n\n have \"suffixeq as as'\" unfolding as'_def by simp\n thus ?thesis\n proof (induct as)\n case Nil show ?case by fact\n next\n case (Cons x xs)\n\n show ?case\n proof (rule consr)\n from Cons.prems show \"suffixeq (x # xs) as\" unfolding as'_def .\n hence \"suffixeq xs as'\" by (auto dest: suffixeq_ConsD simp: as'_def)\n thus \"P xs\" using Cons.hyps by simp\n qed\n qed\nqed\n\ntext {* Parallel etc. and lemmas for list prefix *}\n\nlemma prefix_induct [consumes 1, case_names Nil Cons]:\n fixes prefix\n assumes np: \"prefix \\ lst\"\n and base: \"\\xs. P [] xs\"\n and rl: \"\\x xs y ys. \\ x = y; xs \\ ys; P xs ys \\ \\ P (x#xs) (y#ys)\"\n shows \"P prefix lst\"\n using np\nproof (induct prefix arbitrary: lst)\n case Nil show ?case by fact\nnext\n case (Cons x xs)\n\n have prem: \"(x # xs) \\ lst\" by fact\n then obtain y ys where lv: \"lst = y # ys\"\n by (rule prefixE, auto)\n\n have ih: \"\\lst. xs \\ lst \\ P xs lst\" by fact\n\n show ?case using prem\n by (auto simp: lv intro!: rl ih)\nqed\n\nlemma not_prefix_cases:\n fixes prefix\n assumes pfx: \"\\ prefix \\ lst\"\n and c1: \"\\ prefix \\ []; lst = [] \\ \\ R\"\n and c2: \"\\a as x xs. \\ prefix = a#as; lst = x#xs; x = a; \\ as \\ xs\\ \\ R\"\n and c3: \"\\a as x xs. \\ prefix = a#as; lst = x#xs; x \\ a\\ \\ R\"\n shows \"R\"\nproof (cases prefix)\n case Nil thus ?thesis using pfx by simp\nnext\n case (Cons a as)\n\n have c: \"prefix = a#as\" by fact\n\n show ?thesis\n proof (cases lst)\n case Nil thus ?thesis\n by (intro c1, simp add: Cons)\n next\n case (Cons x xs)\n show ?thesis\n proof (cases \"x = a\")\n case True\n show ?thesis\n proof (intro c2)\n \tshow \"\\ as \\ xs\" using pfx c Cons True\n\t by simp\n qed fact+\n next\n case False\n show ?thesis by (rule c3) fact+\n qed\n qed\nqed\n\nlemma not_prefix_induct [consumes 1, case_names Nil Neq Eq]:\n fixes prefix\n assumes np: \"\\ prefix \\ lst\"\n and base: \"\\x xs. P (x#xs) []\"\n and r1: \"\\x xs y ys. x \\ y \\ P (x#xs) (y#ys)\"\n and r2: \"\\x xs y ys. \\ x = y; \\ xs \\ ys; P xs ys \\ \\ P (x#xs) (y#ys)\"\n shows \"P prefix lst\"\n using np\nproof (induct lst arbitrary: prefix)\n case Nil thus ?case\n by (auto simp: neq_Nil_conv elim!: not_prefix_cases intro!: base)\nnext\n case (Cons y ys)\n\n have npfx: \"\\ prefix \\ (y # ys)\" by fact\n then obtain x xs where pv: \"prefix = x # xs\"\n by (rule not_prefix_cases) auto\n\n have ih: \"\\prefix. \\ prefix \\ ys \\ P prefix ys\" by fact\n\n show ?case using npfx\n by (simp only: pv) (erule not_prefix_cases, auto intro: r1 r2 ih)\nqed\n\ntext {* right-padding a word to a certain length *}\n\nlemma bl_pad_to_prefix:\n \"bl \\ bl_pad_to bl sz\"\n by (simp add: bl_pad_to_def)\n\nlemma same_length_is_parallel:\n assumes len: \"\\y \\ set as. length y = x\"\n shows \"\\x \\ set as. \\y \\ set as - {x}. x \\ y\"\nproof (rule, rule)\n fix x y\n assume xi: \"x \\ set as\" and yi: \"y \\ set as - {x}\"\n from len obtain q where len': \"\\y \\ set as. length y = q\" ..\n\n show \"x \\ y\"\n proof (rule not_equal_is_parallel)\n from xi yi show \"x \\ y\" by auto\n from xi yi len' show \"length x = length y\" by (auto dest: bspec)\n qed\nqed\n\ntext {* Lemmas about words *}\n\nlemma word_bits_len_of: \"len_of TYPE (32) = word_bits\"\n by (simp add: word_bits_conv)\n\nlemmas unat_power_lower32 [simp] = unat_power_lower[where 'a=32, unfolded word_bits_len_of]\n\nlemma eq_zero_set_bl: \"(w = 0) = (True \\ set (to_bl w))\"\n apply (subst word_bl.Rep_inject[symmetric])\n apply (subst to_bl_0)\n apply (rule iffI)\n apply clarsimp\n apply (drule list_of_false)\n apply simp\n done\n\nlemmas and_bang = word_and_nth\n\nlemma of_drop_to_bl:\n \"of_bl (drop n (to_bl x)) = (x && mask (size x - n))\"\n apply (clarsimp simp: bang_eq and_bang test_bit_of_bl\n rev_nth\n cong: rev_conj_cong)\n apply (safe, simp_all add: word_size to_bl_nth)\n done\n\nlemma less_is_drop_replicate:\n fixes x :: \"'a :: len word\"\n assumes lt: \"x < 2 ^ n\"\n shows \"to_bl x = replicate (len_of TYPE('a) - n) False @ drop (len_of TYPE('a) - n) (to_bl x)\"\nproof -\n show ?thesis\n apply (subst less_mask_eq [OF lt, symmetric])\n apply (subst bl_and_mask)\n apply simp\n done\nqed\n\nlemma word_add_offset_less:\n fixes x :: \"'a :: len word\"\n assumes yv: \"y < 2 ^ n\"\n and xv: \"x < 2 ^ m\"\n and mnv: \"sz < len_of TYPE('a :: len)\"\n and xv': \"x < 2 ^ (len_of TYPE('a :: len) - n)\"\n and mn: \"sz = m + n\"\n shows \"x * 2 ^ n + y < 2 ^ sz\"\nproof (subst mn)\n from mnv mn have nv: \"n < len_of TYPE('a)\" and mv: \"m < len_of TYPE('a)\" by auto\n\n have uy: \"unat y < 2 ^ n\"\n by (rule order_less_le_trans [OF unat_mono [OF yv] order_eq_refl],\n rule unat_power_lower[OF nv])\n\n have ux: \"unat x < 2 ^ m\"\n by (rule order_less_le_trans [OF unat_mono [OF xv] order_eq_refl],\n rule unat_power_lower[OF mv])\n\n thus \"x * 2 ^ n + y < 2 ^ (m + n)\" using ux uy nv mnv xv'\n apply (subst word_less_nat_alt)\n apply (subst unat_word_ariths word_bits_len_of)+\n apply (subst mod_less)\n apply (simp add: unat_power_lower)\n apply (subst mult.commute)\n apply (rule nat_less_power_trans [OF _ order_less_imp_le [OF nv]])\n apply (rule order_less_le_trans [OF unat_mono [OF xv']])\n apply (cases \"n = 0\")\n apply (simp add: unat_power_lower)\n apply (simp add: unat_power_lower)\n apply (subst unat_power_lower[OF nv])\n apply (subst mod_less)\n apply (erule order_less_le_trans [OF nat_add_offset_less], assumption)\n apply (rule mn)\n apply simp\n apply (simp add: mn mnv unat_power_lower)\n apply (erule nat_add_offset_less)\n apply simp+\n done\nqed\n\nlemma word_less_power_trans:\n fixes n :: \"'a :: len word\"\n assumes nv: \"n < 2 ^ (m - k)\"\n and kv: \"k \\ m\"\n and mv: \"m < len_of TYPE ('a)\"\n shows \"2 ^ k * n < 2 ^ m\"\n using nv kv mv\n apply -\n apply (subst word_less_nat_alt)\n apply (subst unat_word_ariths)\n apply (subst mod_less)\n apply (simp add: unat_power_lower)\n apply (rule nat_less_power_trans)\n apply (erule order_less_trans [OF unat_mono])\n apply (simp add: unat_power_lower)\n apply simp\n apply (simp add: unat_power_lower)\n apply (rule nat_less_power_trans)\n apply (subst unat_power_lower[where 'a = 'a, symmetric])\n apply simp\n apply (erule unat_mono)\n apply simp\n done\n\nlemma word_less_sub_le[simp]:\n fixes x :: \"'a :: len word\"\n assumes nv: \"n < len_of TYPE('a)\"\n shows \"(x \\ 2 ^ n - 1) = (x < 2 ^ n)\"\nproof -\n have \"Suc (unat ((2::'a word) ^ n - 1)) = unat ((2::'a word) ^ n)\" using nv\n by (metis Suc_pred' power_2_ge_iff unat_gt_0 unat_minus_one word_not_simps(1))\n\n thus ?thesis using nv\n apply -\n apply (subst word_le_nat_alt)\n apply (subst less_Suc_eq_le [symmetric])\n apply (erule ssubst)\n apply (subst word_less_nat_alt)\n apply (rule refl)\n done\nqed\n\nlemmas word32_less_sub_le[simp] =\n word_less_sub_le[where 'a = 32, folded word_bits_def]\n\nlemma Suc_unat_diff_1:\n fixes x :: \"'a :: len word\"\n assumes lt: \"1 \\ x\"\n shows \"Suc (unat (x - 1)) = unat x\"\nproof -\n have \"0 < unat x\"\n by (rule order_less_le_trans [where y = 1], simp, subst unat_1 [symmetric], rule iffD1 [OF word_le_nat_alt lt])\n\n thus ?thesis\n by ((subst unat_sub [OF lt])+, simp only: unat_1)\nqed\n\nlemma word_div_sub:\n fixes x :: \"'a :: len word\"\n assumes yx: \"y \\ x\"\n and y0: \"0 < y\"\n shows \"(x - y) div y = x div y - 1\"\n apply (rule word_unat.Rep_eqD)\n apply (subst unat_div)\n apply (subst unat_sub [OF yx])\n apply (subst unat_sub)\n apply (subst word_le_nat_alt)\n apply (subst unat_div)\n apply (subst le_div_geq)\n apply (rule order_le_less_trans [OF _ unat_mono [OF y0]])\n apply simp\n apply (subst word_le_nat_alt [symmetric], rule yx)\n apply simp\n apply (subst unat_div)\n apply (subst le_div_geq [OF _ iffD1 [OF word_le_nat_alt yx]])\n apply (rule order_le_less_trans [OF _ unat_mono [OF y0]])\n apply simp\n apply simp\n done\n\nlemma word_mult_less_mono1:\n fixes i :: \"'a :: len word\"\n assumes ij: \"i < j\"\n and knz: \"0 < k\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i * k < j * k\"\nproof -\n from ij ujk knz have jk: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n by (auto intro: order_less_subst2 simp: word_less_nat_alt elim: mult_less_mono1)\n\n thus ?thesis using ujk knz ij\n by (auto simp: word_less_nat_alt iffD1 [OF unat_mult_lem])\nqed\n\nlemma word_mult_less_dest:\n fixes i :: \"'a :: len word\"\n assumes ij: \"i * k < j * k\"\n and uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i < j\"\n using uik ujk ij\n by (auto simp: word_less_nat_alt iffD1 [OF unat_mult_lem] elim: mult_less_mono1)\n\nlemma word_mult_less_cancel:\n fixes k :: \"'a :: len word\"\n assumes knz: \"0 < k\"\n and uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"(i * k < j * k) = (i < j)\"\n by (rule iffI [OF word_mult_less_dest [OF _ uik ujk] word_mult_less_mono1 [OF _ knz ujk]])\n\nlemma Suc_div_unat_helper:\n assumes szv: \"sz < len_of TYPE('a :: len)\"\n and usszv: \"us \\ sz\"\n shows \"2 ^ (sz - us) = Suc (unat (((2::'a :: len word) ^ sz - 1) div 2 ^ us))\"\nproof -\n note usv = order_le_less_trans [OF usszv szv]\n\n from usszv obtain q where qv: \"sz = us + q\" by (auto simp: le_iff_add)\n\n have \"Suc (unat (((2:: 'a word) ^ sz - 1) div 2 ^ us)) =\n (2 ^ us + unat ((2:: 'a word) ^ sz - 1)) div 2 ^ us\"\n apply (subst unat_div unat_power_lower[OF usv])+\n apply (subst div_add_self1, simp+)\n done\n\n also have \"\\ = ((2 ^ us - 1) + 2 ^ sz) div 2 ^ us\" using szv\n apply (subst unat_minus_one)\n apply (simp add: p2_eq_0)\n apply (simp add: unat_power_lower)\n done\n\n also have \"\\ = 2 ^ q + ((2 ^ us - 1) div 2 ^ us)\"\n apply (subst qv)\n apply (subst power_add)\n apply (subst div_mult_self2)\n apply simp\n apply (rule refl)\n done\n\n also have \"\\ = 2 ^ (sz - us)\" using qv by simp\n\n finally show ?thesis ..\nqed\n\nlemma upto_enum_red':\n assumes lt: \"1 \\ X\"\n shows \"[(0::'a :: len word) .e. X - 1] = map of_nat [0 ..< unat X]\"\nproof -\n have lt': \"unat X < 2 ^ len_of TYPE('a)\"\n by (rule unat_lt2p)\n\n show ?thesis\n apply (subst upto_enum_red)\n apply (simp del: upt.simps)\n apply (subst Suc_unat_diff_1 [OF lt])\n apply (rule map_cong [OF refl])\n apply (rule toEnum_of_nat)\n apply simp\n apply (erule order_less_trans [OF _ lt'])\n done\nqed\n\nlemma upto_enum_red2:\n assumes szv: \"sz < len_of TYPE('a :: len)\"\n shows \"[(0:: 'a :: len word) .e. 2 ^ sz - 1] =\n map of_nat [0 ..< 2 ^ sz]\" using szv\n apply (subst unat_power_lower[OF szv, symmetric])\n apply (rule upto_enum_red')\n apply (subst word_le_nat_alt, simp add: unat_power_lower)\n done\n\n(* FIXME: WordEnum.upto_enum_step_def is fixed to word32. *)\nlemma upto_enum_step_red:\n assumes szv: \"sz < word_bits\"\n and usszv: \"us \\ sz\"\n shows \"[0 , 2 ^ us .e. 2 ^ sz - 1] =\n map (\\x. of_nat x * 2 ^ us) [0 ..< 2 ^ (sz - us)]\" using szv\n unfolding upto_enum_step_def\n apply (subst if_not_P)\n apply (rule leD)\n apply (subst word_le_nat_alt)\n apply (subst unat_minus_one)\n apply (simp add: p2_eq_0 word_bits_def)\n apply simp\n apply simp\n apply (subst upto_enum_red)\n apply (simp del: upt.simps)\n apply (subst Suc_div_unat_helper [where 'a = 32, folded word_bits_def, OF szv usszv, symmetric])\n apply clarsimp\n apply (subst toEnum_of_nat)\n apply (subst word_bits_len_of)\n apply (erule order_less_trans)\n using szv\n apply simp\n apply simp\n done\n\nlemma upto_enum_word:\n \"[x .e. y] = map of_nat [unat x ..< Suc (unat y)]\"\n apply (subst upto_enum_red)\n apply clarsimp\n apply (subst toEnum_of_nat)\n prefer 2\n apply (rule refl)\n apply (erule disjE, simp)\n apply clarsimp\n apply (erule order_less_trans)\n apply simp\n done\n\ntext {* Lemmas about upto and upto_enum *}\n\nlemma word_upto_Cons_eq:\n \"\\x = z; x < y; Suc (unat y) < 2 ^ len_of TYPE('a)\\\n \\ [x::'a::len word .e. y] = z # [x + 1 .e. y]\"\n apply (subst upto_enum_red)\n apply (subst upt_conv_Cons)\n apply (simp)\n apply (drule unat_mono)\n apply arith\n apply (simp only: list.map)\n apply (subst list.inject)\n apply rule\n apply (rule to_from_enum)\n apply (subst upto_enum_red)\n apply (rule map_cong [OF _ refl])\n apply (rule arg_cong2 [where f = \"\\x y. [x ..< y]\"])\n apply unat_arith\n apply simp\n done\n\nlemma distinct_enum_upto:\n \"distinct [(0 :: 'a::len word) .e. b]\"\nproof -\n have \"\\(b::'a word). [0 .e. b] = sublist enum {..< Suc (fromEnum b)}\"\n apply (subst upto_enum_red)\n apply (subst sublist_upt_eq_take)\n apply (subst enum_word_def)\n apply (subst take_map)\n apply (subst take_upt)\n apply (simp only: add_0 fromEnum_unat)\n apply (rule order_trans [OF _ order_eq_refl])\n apply (rule Suc_leI [OF unat_lt2p])\n apply simp\n apply clarsimp\n apply (rule toEnum_of_nat)\n apply (erule order_less_trans [OF _ unat_lt2p])\n done\n\n thus ?thesis\n by (rule ssubst) (rule distinct_sublistI, simp)\nqed\n\nlemma upto_enum_set_conv [simp]:\n fixes a :: \"'a :: len word\"\n shows \"set [a .e. b] = {x. a \\ x \\ x \\ b}\"\n apply (subst upto_enum_red)\n apply (subst set_map)\n apply safe\n apply simp\n apply clarsimp\n apply (erule disjE)\n apply simp\n apply (erule iffD2 [OF word_le_nat_alt])\n apply clarsimp\n apply (erule word_unat.Rep_cases [OF unat_le [OF order_less_imp_le]])\n apply simp\n apply (erule iffD2 [OF word_le_nat_alt])\n apply simp\n\n apply clarsimp\n apply (erule disjE)\n apply simp\n apply clarsimp\n apply (rule word_unat.Rep_cases [OF unat_le [OF order_less_imp_le]])\n apply assumption\n apply simp\n apply (erule order_less_imp_le [OF iffD2 [OF word_less_nat_alt]])\n apply clarsimp\n apply (rule_tac x=\"fromEnum x\" in image_eqI)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (subst word_le_nat_alt [symmetric])\n apply simp\n apply safe\n apply (simp add: word_le_nat_alt [symmetric])\n apply (simp add: word_less_nat_alt [symmetric])\n done\n\nlemma upto_enum_less:\n assumes xin: \"x \\ set [(a::'a::len word).e.2 ^ n - 1]\"\n and nv: \"n < len_of TYPE('a::len)\"\n shows \"x < 2 ^ n\"\nproof (cases n)\n case 0\n thus ?thesis using xin\n by (simp add: upto_enum_set_conv)\nnext\n case (Suc m)\n show ?thesis using xin nv by simp\nqed\n\nlemma upto_enum_len_less:\n \"\\ n \\ length [a, b .e. c]; n \\ 0 \\ \\ a \\ c\"\n unfolding upto_enum_step_def\n by (simp split: split_if_asm)\n\nlemma length_upto_enum_step:\n fixes x :: word32\n shows \"x \\ z \\ length [x , y .e. z] = (unat ((z - x) div (y - x))) + 1\"\n unfolding upto_enum_step_def\n by (simp add: upto_enum_red)\n\nlemma length_upto_enum_one:\n fixes x :: word32\n assumes lt1: \"x < y\" and lt2: \"z < y\" and lt3: \"x \\ z\"\n shows \"[x , y .e. z] = [x]\"\nunfolding upto_enum_step_def\nproof (subst upto_enum_red, subst if_not_P [OF leD [OF lt3]], clarsimp, rule)\n show \"unat ((z - x) div (y - x)) = 0\"\n proof (subst unat_div, rule div_less)\n have syx: \"unat (y - x) = unat y - unat x\"\n by (rule unat_sub [OF order_less_imp_le]) fact\n moreover have \"unat (z - x) = unat z - unat x\"\n by (rule unat_sub) fact\n\n ultimately show \"unat (z - x) < unat (y - x)\"\n using lt3\n apply simp\n apply (rule diff_less_mono[OF unat_mono, OF lt2])\n apply (simp add: word_le_nat_alt[symmetric])\n done\n qed\n\n thus \"toEnum (unat ((z - x) div (y - x))) * (y - x) = 0\" by simp\nqed\n\nlemma map_length_unfold_one:\n fixes x :: \"'a::len word\"\n assumes xv: \"Suc (unat x) < 2 ^ len_of TYPE('a)\"\n and ax: \"a < x\"\n shows \"map f [a .e. x] = f a # map f [a + 1 .e. x]\"\n by (subst word_upto_Cons_eq, auto, fact+)\n\nlemma upto_enum_triv [simp]:\n \"[x .e. x] = [x]\"\n unfolding upto_enum_def by simp\n\n\n\nlemma of_nat_unat [simp]:\n \"of_nat \\ unat = id\"\n by (rule ext, simp)\n\nlemma Suc_unat_minus_one [simp]:\n \"x \\ 0 \\ Suc (unat (x - 1)) = unat x\"\n by (metis Suc_diff_1 unat_gt_0 unat_minus_one)\n\ntext {* Lemmas about alignment *}\n\nlemma word_bits_size:\n \"size (w::word32) = word_bits\"\n by (simp add: word_bits_def word_size)\n\ntext {* Lemmas about defs in the specs *}\n\nlemma and_commute:\n \"(X and Y) = (Y and X)\"\n unfolding pred_conj_def by (auto simp: fun_eq_iff)\n\nlemma ptr_add_0 [simp]:\n \"ptr_add ref 0 = ref \"\n unfolding ptr_add_def by simp\n\n(* Other word lemmas *)\n\nlemma word_add_le_dest:\n fixes i :: \"'a :: len word\"\n assumes le: \"i + k \\ j + k\"\n and uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i \\ j\"\n using uik ujk le\n by (auto simp: word_le_nat_alt iffD1 [OF unat_add_lem] elim: add_le_mono1)\n\nlemma mask_shift:\n \"(x && ~~ mask y) >> y = x >> y\"\n apply (rule word_eqI)\n apply (simp add: nth_shiftr word_size)\n apply safe\n apply (drule test_bit.Rep[simplified, rule_format])\n apply (simp add: word_size word_ops_nth_size)\n done\n\nlemma word_add_le_mono1:\n fixes i :: \"'a :: len word\"\n assumes ij: \"i \\ j\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i + k \\ j + k\"\nproof -\n from ij ujk have jk: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n by (auto elim: order_le_less_subst2 simp: word_le_nat_alt elim: add_le_mono1)\n\n thus ?thesis using ujk ij\n by (auto simp: word_le_nat_alt iffD1 [OF unat_add_lem])\nqed\n\nlemma word_add_le_mono2:\n fixes i :: \"('a :: len) word\"\n shows \"\\i \\ j; unat j + unat k < 2 ^ len_of TYPE('a)\\ \\ k + i \\ k + j\"\n by (subst field_simps, subst field_simps, erule (1) word_add_le_mono1)\n\nlemma word_add_le_iff:\n fixes i :: \"'a :: len word\"\n assumes uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"(i + k \\ j + k) = (i \\ j)\"\nproof\n assume \"i \\ j\"\n show \"i + k \\ j + k\" by (rule word_add_le_mono1) fact+\nnext\n assume \"i + k \\ j + k\"\n show \"i \\ j\" by (rule word_add_le_dest) fact+\nqed\n\nlemma word_add_less_mono1:\n fixes i :: \"'a :: len word\"\n assumes ij: \"i < j\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i + k < j + k\"\nproof -\n from ij ujk have jk: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n by (auto elim: order_le_less_subst2 simp: word_less_nat_alt elim: add_less_mono1)\n\n thus ?thesis using ujk ij\n by (auto simp: word_less_nat_alt iffD1 [OF unat_add_lem])\nqed\n\nlemma word_add_less_dest:\n fixes i :: \"'a :: len word\"\n assumes le: \"i + k < j + k\"\n and uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i < j\"\n using uik ujk le\n by (auto simp: word_less_nat_alt iffD1 [OF unat_add_lem] elim: add_less_mono1)\n\nlemma word_add_less_iff:\n fixes i :: \"'a :: len word\"\n assumes uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n shows \"(i + k < j + k) = (i < j)\"\nproof\n assume \"i < j\"\n show \"i + k < j + k\" by (rule word_add_less_mono1) fact+\nnext\n assume \"i + k < j + k\"\n show \"i < j\" by (rule word_add_less_dest) fact+\nqed\n\nlemma shiftr_div_2n':\n \"unat (w >> n) = unat w div 2 ^ n\"\n apply (unfold unat_def)\n apply (subst shiftr_div_2n)\n apply (subst nat_div_distrib)\n apply simp\n apply (simp add: nat_power_eq)\n done\n\nlemma shiftl_shiftr_id:\n assumes nv: \"n < len_of TYPE('a :: len)\"\n and xv: \"x < 2 ^ (len_of TYPE('a :: len) - n)\"\n shows \"x << n >> n = (x::'a::len word)\"\n apply (simp add: shiftl_t2n)\n apply (rule word_unat.Rep_eqD)\n apply (subst shiftr_div_2n')\n apply (cases n)\n apply simp\n apply (subst iffD1 [OF unat_mult_lem])+\n apply (subst unat_power_lower[OF nv])\n apply (rule nat_less_power_trans [OF _ order_less_imp_le [OF nv]])\n apply (rule order_less_le_trans [OF unat_mono [OF xv] order_eq_refl])\n apply (rule unat_power_lower)\n apply simp\n apply (subst unat_power_lower[OF nv])\n apply simp\n done\n\nlemma word_mult_less_iff:\n fixes i :: \"'a :: len word\"\n assumes knz: \"0 < k\"\n and uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"(i * k < j * k) = (i < j)\"\nproof\n assume \"i < j\"\n show \"i * k < j * k\" by (rule word_mult_less_mono1) fact+\nnext\n assume p: \"i * k < j * k\"\n\n have \"0 < unat k\" using knz by (simp add: word_less_nat_alt)\n thus \"i < j\" using p\n by (clarsimp simp: word_less_nat_alt iffD1 [OF unat_mult_lem uik]\n iffD1 [OF unat_mult_lem ujk])\nqed\n\nlemma word_le_imp_diff_le:\n fixes n :: \"'a::len word\"\n shows \"\\k \\ n; n \\ m\\ \\ n - k \\ m\"\n by (clarsimp simp: unat_sub word_le_nat_alt intro!: le_imp_diff_le)\n\nlemma word_less_imp_diff_less:\n fixes n :: \"'a::len word\"\n shows \"\\k \\ n; n < m\\ \\ n - k < m\"\n by (clarsimp simp: unat_sub word_less_nat_alt\n intro!: less_imp_diff_less)\n\nlemma word_mult_le_mono1:\n fixes i :: \"'a :: len word\"\n assumes ij: \"i \\ j\"\n and knz: \"0 < k\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"i * k \\ j * k\"\nproof -\n from ij ujk knz have jk: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n by (auto elim: order_le_less_subst2 simp: word_le_nat_alt elim: mult_le_mono1)\n\n thus ?thesis using ujk knz ij\n by (auto simp: word_le_nat_alt iffD1 [OF unat_mult_lem])\nqed\n\nlemma word_mult_le_iff:\n fixes i :: \"'a :: len word\"\n assumes knz: \"0 < k\"\n and uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n and ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n shows \"(i * k \\ j * k) = (i \\ j)\"\nproof\n assume \"i \\ j\"\n show \"i * k \\ j * k\" by (rule word_mult_le_mono1) fact+\nnext\n assume p: \"i * k \\ j * k\"\n\n have \"0 < unat k\" using knz by (simp add: word_less_nat_alt)\n thus \"i \\ j\" using p\n by (clarsimp simp: word_le_nat_alt iffD1 [OF unat_mult_lem uik]\n iffD1 [OF unat_mult_lem ujk])\nqed\n\nlemma word_diff_less:\n fixes n :: \"'a :: len word\"\n shows \"\\0 < n; 0 < m; n \\ m\\ \\ m - n < m\"\n apply (subst word_less_nat_alt)\n apply (subst unat_sub)\n apply assumption\n apply (rule diff_less)\n apply (simp_all add: word_less_nat_alt)\n done\n\nlemma MinI:\n assumes fa: \"finite A\"\n and ne: \"A \\ {}\"\n and xv: \"m \\ A\"\n and min: \"\\y \\ A. m \\ y\"\n shows \"Min A = m\" using fa ne xv min\nproof (induct A arbitrary: m rule: finite_ne_induct)\n case singleton thus ?case by simp\nnext\n case (insert y F)\n\n from insert.prems have yx: \"m \\ y\" and fx: \"\\y \\ F. m \\ y\" by auto\n have \"m \\ insert y F\" by fact\n thus ?case\n proof\n assume mv: \"m = y\"\n\n have mlt: \"m \\ Min F\"\n by (rule iffD2 [OF Min_ge_iff [OF insert.hyps(1) insert.hyps(2)] fx])\n\n show ?case\n apply (subst Min_insert [OF insert.hyps(1) insert.hyps(2)])\n apply (subst mv [symmetric])\n apply (rule iffD2 [OF linorder_min_same1 mlt])\n done\n next\n assume \"m \\ F\"\n hence mf: \"Min F = m\"\n by (rule insert.hyps(4) [OF _ fx])\n\n show ?case\n apply (subst Min_insert [OF insert.hyps(1) insert.hyps(2)])\n apply (subst mf)\n apply (rule iffD2 [OF linorder_min_same2 yx])\n done\n qed\nqed\n\nlemma length_upto_enum [simp]:\n fixes a :: \"('a :: len) word\"\n shows \"length [a .e. b] = Suc (unat b) - unat a\"\n apply (simp add: word_le_nat_alt upto_enum_red)\n apply (clarsimp simp: Suc_diff_le)\n done\n\nlemma length_upto_enum_less_one:\n \"\\a \\ b; b \\ 0\\\n \\ length [a .e. b - 1] = unat (b - a)\"\n apply clarsimp\n apply (subst unat_sub[symmetric], assumption)\n apply clarsimp\n done\n\nlemma drop_upto_enum:\n \"drop (unat n) [0 .e. m] = [n .e. m]\"\n apply (clarsimp simp: upto_enum_def)\n apply (induct m, simp)\n by (metis drop_map drop_upt plus_nat.add_0)\n\nlemma distinct_enum_upto' [simp]:\n \"distinct [a::'a::len word .e. b]\"\n apply (subst drop_upto_enum [symmetric])\n apply (rule distinct_drop)\n apply (rule distinct_enum_upto)\n done\n\nlemma length_interval:\n \"\\set xs = {x. (a::'a::len word) \\ x \\ x \\ b}; distinct xs\\\n \\ length xs = Suc (unat b) - unat a\"\n apply (frule distinct_card)\n apply (subgoal_tac \"set xs = set [a .e. b]\")\n apply (cut_tac distinct_card [where xs=\"[a .e. b]\"])\n apply (subst (asm) length_upto_enum)\n apply clarsimp\n apply (rule distinct_enum_upto')\n apply simp\n done\n\nlemma not_empty_eq:\n \"(S \\ {}) = (\\x. x \\ S)\"\n by auto\n\nlemma range_subset_lower:\n fixes c :: \"'a ::linorder\"\n shows \"\\ {a..b} \\ {c..d}; x \\ {a..b} \\ \\ c \\ a\"\n apply (frule (1) subsetD)\n apply (rule classical)\n apply clarsimp\n done\n\nlemma range_subset_upper:\n fixes c :: \"'a ::linorder\"\n shows \"\\ {a..b} \\ {c..d}; x \\ {a..b} \\ \\ b \\ d\"\n apply (frule (1) subsetD)\n apply (rule classical)\n apply clarsimp\n done\n\nlemma range_subset_eq:\n fixes a::\"'a::linorder\"\n assumes non_empty: \"a \\ b\"\n shows \"({a..b} \\ {c..d}) = (c \\ a \\ b \\ d)\"\n apply (insert non_empty)\n apply (rule iffI)\n apply (frule range_subset_lower [where x=a], simp)\n apply (drule range_subset_upper [where x=a], simp)\n apply simp\n apply auto\n done\n\nlemma range_eq:\n fixes a::\"'a::linorder\"\n assumes non_empty: \"a \\ b\"\n shows \"({a..b} = {c..d}) = (a = c \\ b = d)\"\n by (metis atLeastatMost_subset_iff eq_iff non_empty)\n\nlemma range_strict_subset_eq:\n fixes a::\"'a::linorder\"\n assumes non_empty: \"a \\ b\"\n shows \"({a..b} \\ {c..d}) = (c \\ a \\ b \\ d \\ (a = c \\ b \\ d))\"\n apply (insert non_empty)\n apply (subst psubset_eq)\n apply (subst range_subset_eq, assumption+)\n apply (subst range_eq, assumption+)\n apply simp\n done\n\nlemma range_subsetI:\n fixes x :: \"'a :: order\"\n assumes xX: \"X \\ x\"\n and yY: \"y \\ Y\"\n shows \"{x .. y} \\ {X .. Y}\"\n using xX yY by auto\n\nlemma set_False [simp]:\n \"(set bs \\ {False}) = (True \\ set bs)\" by auto\n\ndeclare of_nat_power [simp del]\n\n(* TODO: move to word *)\nlemma unat_of_bl_length:\n \"unat (of_bl xs :: 'a::len word) < 2 ^ (length xs)\"\nproof (cases \"length xs < len_of TYPE('a)\")\n case True\n hence \"(of_bl xs::'a::len word) < 2 ^ length xs\"\n by (simp add: of_bl_length_less)\n with True\n show ?thesis\n by (simp add: word_less_nat_alt word_unat_power unat_of_nat)\nnext\n case False\n have \"unat (of_bl xs::'a::len word) < 2 ^ len_of TYPE('a)\"\n by (simp split: unat_split)\n also\n from False\n have \"len_of TYPE('a) \\ length xs\" by simp\n hence \"2 ^ len_of TYPE('a) \\ (2::nat) ^ length xs\"\n by (rule power_increasing) simp\n finally\n show ?thesis .\nqed\n\nlemma is_aligned_0'[simp]:\n \"is_aligned 0 n\"\n by (simp add: is_aligned_def)\n\nlemma p_assoc_help:\n fixes p :: \"'a::{ring,power,numeral,one}\"\n shows \"p + 2^sz - 1 = p + (2^sz - 1)\"\n by simp\n\nlemma word_add_increasing:\n fixes x :: \"'a :: len word\"\n shows \"\\ p + w \\ x; p \\ p + w \\ \\ p \\ x\"\n by unat_arith\n\nlemma word_random:\n fixes x :: \"'a :: len word\"\n shows \"\\ p \\ p + x'; x \\ x' \\ \\ p \\ p + x\"\n by unat_arith\n\nlemma word_sub_mono:\n \"\\ a \\ c; d \\ b; a - b \\ a; c - d \\ c \\\n \\ (a - b) \\ (c - d :: ('a :: len) word)\"\n by unat_arith\n\nlemma power_not_zero:\n \"n < len_of TYPE('a::len) \\ (2 :: 'a word) ^ n \\ 0\"\n by (metis p2_gt_0 word_neq_0_conv)\n\nlemma word_gt_a_gt_0:\n \"a < n \\ (0 :: 'a::len word) < n\"\n apply (case_tac \"n = 0\")\n apply clarsimp\n apply (clarsimp simp: word_neq_0_conv)\n done\n\nlemma word_shift_nonzero:\n \"\\ (x\\'a\\len word) \\ 2 ^ m; m + n < len_of TYPE('a\\len); x \\ 0\\\n \\ x << n \\ 0\"\n apply (simp only: word_neq_0_conv word_less_nat_alt\n shiftl_t2n mod_0 unat_word_ariths\n unat_power_lower word_le_nat_alt)\n apply (subst mod_less)\n apply (rule order_le_less_trans)\n apply (erule mult_le_mono2)\n apply (subst power_add[symmetric])\n apply (rule power_strict_increasing)\n apply simp\n apply simp\n apply simp\n done\n\nlemma word_power_less_1 [simp]:\n \"sz < len_of TYPE('a\\len) \\ (2::'a word) ^ sz - 1 < 2 ^ sz\"\n apply (simp add: word_less_nat_alt word_bits_def)\n apply (subst unat_minus_one)\n apply (simp add: word_unat.Rep_inject [symmetric])\n apply simp\n done\n\nlemmas word32_power_less_1[simp] =\n word_power_less_1[where 'a = 32, folded word_bits_def]\n\nlemma nasty_split_lt:\n \"\\ (x :: 'a:: len word) < 2 ^ (m - n); n \\ m; m < len_of TYPE('a\\len) \\\n \\ x * 2 ^ n + (2 ^ n - 1) \\ 2 ^ m - 1\"\n apply (simp only: add_diff_eq word_bits_def)\n apply (subst mult_1[symmetric], subst distrib_right[symmetric])\n apply (rule word_sub_mono)\n apply (rule order_trans)\n apply (rule word_mult_le_mono1)\n apply (rule inc_le)\n apply assumption\n apply (subst word_neq_0_conv[symmetric])\n apply (rule power_not_zero)\n apply (simp add: word_bits_def)\n apply (subst unat_power_lower, simp)+\n apply (subst power_add[symmetric])\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (subst power_add[symmetric])\n apply simp\n apply simp\n apply (rule word_sub_1_le)\n apply (subst mult.commute)\n apply (subst shiftl_t2n[symmetric])\n apply (rule word_shift_nonzero)\n apply (erule inc_le)\n apply (simp add: word_bits_def)\n apply (unat_arith)\n apply (drule word_power_less_1[unfolded word_bits_def])\n apply simp\n done\n\nlemma nasty_split_less:\n \"\\m \\ n; n \\ nm; nm < len_of TYPE('a\\len); x < 2 ^ (nm - n)\\\n \\ (x :: 'a word) * 2 ^ n + (2 ^ m - 1) < 2 ^ nm\"\n apply (simp only: word_less_sub_le[symmetric])\n apply (rule order_trans [OF _ nasty_split_lt])\n apply (rule word_plus_mono_right)\n apply (rule word_sub_mono)\n apply (simp add: word_le_nat_alt)\n apply simp\n apply (simp add: word_sub_1_le[OF power_not_zero])\n apply (simp add: word_sub_1_le[OF power_not_zero])\n apply (rule is_aligned_no_wrap')\n apply (rule is_aligned_mult_triv2)\n apply simp\n apply (erule order_le_less_trans, simp)\n apply simp+\n done\n\nlemma int_not_emptyD:\n \"A \\ B \\ {} \\ \\x. x \\ A \\ x \\ B\"\n by (erule contrapos_np, clarsimp simp: disjoint_iff_not_equal)\n\nlemma unat_less_power:\n fixes k :: \"'a::len word\"\n assumes szv: \"sz < len_of TYPE('a)\"\n and kv: \"k < 2 ^ sz\"\n shows \"unat k < 2 ^ sz\"\n using szv unat_mono [OF kv] by simp\n\n(* This should replace some crud \\ search for unat_of_nat *)\nlemma unat_mult_power_lem:\n assumes kv: \"k < 2 ^ (len_of TYPE('a::len) - sz)\"\n shows \"unat (2 ^ sz * of_nat k :: (('a::len) word)) = 2 ^ sz * k\"\nproof cases\n assume szv: \"sz < len_of TYPE('a::len)\"\n show ?thesis\n proof (cases \"sz = 0\")\n case True\n thus ?thesis using kv szv\n by (simp add: unat_of_nat)\n next\n case False\n hence sne: \"0 < sz\" ..\n\n have uk: \"unat (of_nat k :: 'a word) = k\"\n apply (subst unat_of_nat)\n apply (simp add: nat_mod_eq less_trans[OF kv] sne)\n done\n\n show ?thesis using szv\n apply (subst iffD1 [OF unat_mult_lem])\n apply (simp add: uk nat_less_power_trans[OF kv order_less_imp_le [OF szv]])+\n done\n qed\nnext\n assume \"\\ sz < len_of TYPE('a)\"\n with kv show ?thesis by (simp add: not_less power_overflow)\nqed\n\nlemma aligned_add_offset_no_wrap:\n fixes off :: \"('a::len) word\"\n and x :: \"'a word\"\n assumes al: \"is_aligned x sz\"\n and offv: \"off < 2 ^ sz\"\n shows \"unat x + unat off < 2 ^ len_of TYPE('a)\"\nproof cases\n assume szv: \"sz < len_of TYPE('a)\"\n from al obtain k where xv: \"x = 2 ^ sz * (of_nat k)\"\n and kl: \"k < 2 ^ (len_of TYPE('a) - sz)\"\n by (auto elim: is_alignedE)\n\n show ?thesis using szv\n apply (subst xv)\n apply (subst unat_mult_power_lem[OF kl])\n apply (subst mult.commute, rule nat_add_offset_less)\n apply (rule less_le_trans[OF unat_mono[OF offv, simplified]])\n apply (erule eq_imp_le[OF unat_power_lower])\n apply (rule kl)\n apply simp\n done\nnext\n assume \"\\ sz < len_of TYPE('a)\"\n with offv show ?thesis by (simp add: not_less power_overflow )\nqed\n\nlemma aligned_add_offset_mod:\n fixes x :: \"('a::len) word\"\n assumes al: \"is_aligned x sz\"\n and kv: \"k < 2 ^ sz\"\n shows \"(x + k) mod 2 ^ sz = k\"\nproof cases\n assume szv: \"sz < len_of TYPE('a)\"\n\n have ux: \"unat x + unat k < 2 ^ len_of TYPE('a)\"\n by (rule aligned_add_offset_no_wrap) fact+\n\n show ?thesis using al szv\n apply -\n apply (erule is_alignedE)\n apply (subst word_unat.Rep_inject [symmetric])\n apply (subst unat_mod)\n apply (subst iffD1 [OF unat_add_lem], rule ux)\n apply simp\n apply (subst unat_mult_power_lem, assumption+)\n apply (subst mod_add_left_eq)\n apply (simp)\n apply (rule mod_less[OF less_le_trans[OF unat_mono], OF kv])\n apply (erule eq_imp_le[OF unat_power_lower])\n done\nnext\n assume \"\\ sz < len_of TYPE('a)\"\n with al show ?thesis\n by (simp add: not_less power_overflow is_aligned_mask mask_def\n word_mod_by_0)\nqed\n\nlemma word_plus_mcs_4:\n \"\\v + x \\ w + x; x \\ v + x\\ \\ v \\ (w::'a::len word)\"\n by uint_arith\n\nlemma word_plus_mcs_3:\n \"\\v \\ w; x \\ w + x\\ \\ v + x \\ w + (x::'a::len word)\"\n by unat_arith\n\n\n\n have rl: \"\\(p::'a word) k w. \\uint p + uint k < 2 ^ len_of TYPE('a); w = p + k; w \\ p + (2 ^ sz - 1) \\\n \\ k < 2 ^ sz\"\n apply -\n apply simp\n apply (subst (asm) add.commute, subst (asm) add.commute, drule word_plus_mcs_4)\n apply (subst add.commute, subst no_plus_overflow_uint_size)\n apply (simp add: word_size_bl)\n apply (erule iffD1 [OF word_less_sub_le[OF szv]])\n done\n\n from xb obtain kx where\n kx: \"z = x + kx\" and\n kxl: \"uint x + uint kx < 2 ^ len_of TYPE('a)\"\n by (clarsimp dest!: word_le_exists')\n\n from yb obtain ky where\n ky: \"z = y + ky\" and\n kyl: \"uint y + uint ky < 2 ^ len_of TYPE('a)\"\n by (clarsimp dest!: word_le_exists')\n\n have \"x = y\"\n proof -\n have \"kx = z mod 2 ^ sz\"\n proof (subst kx, rule sym, rule aligned_add_offset_mod)\n show \"kx < 2 ^ sz\" by (rule rl) fact+\n qed fact+\n\n also have \"\\ = ky\"\n proof (subst ky, rule aligned_add_offset_mod)\n show \"ky < 2 ^ sz\"\n using kyl ky yt by (rule rl)\n qed fact+\n\n finally have kxky: \"kx = ky\" .\n moreover have \"x + kx = y + ky\" by (simp add: kx [symmetric] ky [symmetric])\n ultimately show ?thesis by simp\n qed\n\n thus False using neq by simp\n qed\nnext\n assume \"\\ sz < len_of TYPE('a)\"\n with neq alx aly\n have False by (simp add: is_aligned_mask mask_def power_overflow)\n thus ?thesis ..\nqed\n\nlemma less_two_pow_divD:\n \"\\ (x :: nat) < 2 ^ n div 2 ^ m \\\n \\ n \\ m \\ (x < 2 ^ (n - m))\"\n apply (rule context_conjI)\n apply (rule ccontr)\n apply (simp add: div_less power_strict_increasing)\n apply (simp add: power_sub)\n done\n\nlemma less_two_pow_divI:\n \"\\ (x :: nat) < 2 ^ (n - m); m \\ n \\ \\ x < 2 ^ n div 2 ^ m\"\n by (simp add: power_sub)\n\nlemma word_less_two_pow_divI:\n \"\\ (x :: 'a::len word) < 2 ^ (n - m); m \\ n; n < len_of TYPE('a) \\ \\ x < 2 ^ n div 2 ^ m\"\n apply (simp add: word_less_nat_alt)\n apply (subst unat_word_ariths)\n apply (subst mod_less)\n apply (rule order_le_less_trans [OF div_le_dividend])\n apply (rule unat_lt2p)\n apply (simp add: power_sub)\n done\n\nlemma word_less_two_pow_divD:\n \"\\ (x :: 'a::len word) < 2 ^ n div 2 ^ m \\\n \\ n \\ m \\ (x < 2 ^ (n - m))\"\n apply (cases \"n < len_of TYPE('a)\")\n apply (cases \"m < len_of TYPE('a)\")\n apply (simp add: word_less_nat_alt)\n apply (subst(asm) unat_word_ariths)\n apply (subst(asm) mod_less)\n apply (rule order_le_less_trans [OF div_le_dividend])\n apply (rule unat_lt2p)\n apply (clarsimp dest!: less_two_pow_divD)\n apply (simp add: power_overflow)\n apply (simp add: word_div_def)\n apply (simp add: power_overflow word_div_def)\n done\n\nlemma of_nat_less_two_pow_div_set:\n \"\\ n < len_of TYPE('a) \\ \\\n {x. x < (2 ^ n div 2 ^ m :: 'a::len word)}\n = of_nat ` {k. k < 2 ^ n div 2 ^ m}\"\n apply (simp add: image_def)\n apply (safe dest!: word_less_two_pow_divD less_two_pow_divD\n intro!: word_less_two_pow_divI)\n apply (rule_tac x=\"unat x\" in exI)\n apply (simp add: power_sub[symmetric])\n apply (subst unat_power_lower[symmetric, where 'a='a])\n apply simp\n apply (erule unat_mono)\n apply (subst word_unat_power)\n apply (rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply simp\n apply simp\n apply assumption\n done\n\n(* FIXME: generalise! *)\nlemma upto_2_helper:\n \"{0..<2 :: word32} = {0, 1}\"\n apply (safe, simp_all)\n apply unat_arith\n done\n\n(* TODO: MOVE to word *)\nlemma word_less_power_trans2:\n fixes n :: \"'a::len word\"\n shows \"\\n < 2 ^ (m - k); k \\ m; m < len_of TYPE('a)\\ \\ n * 2 ^ k < 2 ^ m\"\n by (subst field_simps, rule word_less_power_trans)\n\nlemma ucast_less:\n \"len_of TYPE('b) < len_of TYPE('a) \\\n (ucast (x :: ('b :: len) word) :: (('a :: len) word)) < 2 ^ len_of TYPE('b)\"\n apply (subst mask_eq_iff_w2p[symmetric])\n apply (simp add: word_size)\n apply (rule word_eqI)\n apply (simp add: word_size nth_ucast)\n apply safe\n apply (simp add: test_bit.Rep[simplified])\n done\n\nlemma ucast_less_shiftl_helper:\n \"\\ len_of TYPE('b) + 2 < word_bits;\n 2 ^ (len_of TYPE('b) + 2) \\ n\\\n \\ (ucast (x :: ('b :: len) word) << 2) < (n :: word32)\"\n apply (erule order_less_le_trans[rotated])\n apply (cut_tac ucast_less[where x=x and 'a=32])\n apply (simp only: shiftl_t2n field_simps)\n apply (rule word_less_power_trans2)\n apply (simp_all add: word_bits_def)\n done\n\nlemma ucast_range_less:\n \"len_of TYPE('a :: len) < len_of TYPE('b :: len) \\\n range (ucast :: 'a word \\ 'b word)\n = {x. x < 2 ^ len_of TYPE ('a)}\"\n apply safe\n apply (erule ucast_less)\n apply (simp add: image_def)\n apply (rule_tac x=\"ucast x\" in exI)\n apply (drule less_mask_eq)\n apply (rule word_eqI)\n apply (drule_tac x=n in word_eqD)\n apply (simp add: word_size nth_ucast)\n done\n\nlemma word_power_less_diff:\n \"\\2 ^ n * q < (2::'a::len word) ^ m; q < 2 ^ (len_of TYPE('a) - n)\\ \\ q < 2 ^ (m - n)\"\n apply (case_tac \"m \\ len_of TYPE('a)\")\n apply (simp add: power_overflow)\n apply (case_tac \"n \\ len_of TYPE('a)\")\n apply (simp add: power_overflow)\n apply (cases \"n = 0\")\n apply simp\n apply (subst word_less_nat_alt)\n apply (subst unat_power_lower)\n apply simp\n apply (rule nat_power_less_diff)\n apply (simp add: word_less_nat_alt)\n apply (subst (asm) iffD1 [OF unat_mult_lem])\n apply (simp add:nat_less_power_trans)\n apply simp\n done\n\nlemmas word_diff_ls' = word_diff_ls [where xa=x and x=x for x, simplified]\n\nlemmas word_l_diffs = word_l_diffs [where xa=x and x=x for x, simplified]\n\nlemma is_aligned_diff:\n fixes m :: \"'a::len word\"\n assumes alm: \"is_aligned m s1\"\n and aln: \"is_aligned n s2\"\n and s2wb: \"s2 < len_of TYPE('a)\"\n and nm: \"m \\ {n .. n + (2 ^ s2 - 1)}\"\n and s1s2: \"s1 \\ s2\"\n and s10: \"0 < s1\" (* Probably can be folded into the proof \\ *)\n shows \"\\q. m - n = of_nat q * 2 ^ s1 \\ q < 2 ^ (s2 - s1)\"\nproof -\n have rl: \"\\m s. \\ m < 2 ^ (len_of TYPE('a) - s); s < len_of TYPE('a) \\ \\ unat ((2::'a word) ^ s * of_nat m) = 2 ^ s * m\"\n proof -\n fix m :: nat and s\n assume m: \"m < 2 ^ (len_of TYPE('a) - s)\" and s: \"s < len_of TYPE('a)\"\n hence \"unat ((of_nat m) :: 'a word) = m\"\n apply (subst unat_of_nat)\n apply (subst mod_less)\n apply (erule order_less_le_trans)\n apply (rule power_increasing)\n apply simp_all\n done\n\n thus \"?thesis m s\" using s m\n apply (subst iffD1 [OF unat_mult_lem])\n apply (simp add: nat_less_power_trans)+\n done\n qed\n have s1wb: \"s1 < len_of TYPE('a)\" using s2wb s1s2 by simp\n from alm obtain mq where mmq: \"m = 2 ^ s1 * of_nat mq\" and mq: \"mq < 2 ^ (len_of TYPE('a) - s1)\"\n by (auto elim: is_alignedE simp: field_simps)\n from aln obtain nq where nnq: \"n = 2 ^ s2 * of_nat nq\" and nq: \"nq < 2 ^ (len_of TYPE('a) - s2)\"\n by (auto elim: is_alignedE simp: field_simps)\n from s1s2 obtain sq where sq: \"s2 = s1 + sq\" by (auto simp: le_iff_add)\n\n note us1 = rl [OF mq s1wb]\n note us2 = rl [OF nq s2wb]\n\n from nm have \"n \\ m\" by clarsimp\n hence \"(2::'a word) ^ s2 * of_nat nq \\ 2 ^ s1 * of_nat mq\" using nnq mmq by simp\n hence \"2 ^ s2 * nq \\ 2 ^ s1 * mq\" using s1wb s2wb\n by (simp add: word_le_nat_alt us1 us2)\n hence nqmq: \"2 ^ sq * nq \\ mq\" using sq by (simp add: power_add)\n\n have \"m - n = 2 ^ s1 * of_nat mq - 2 ^ s2 * of_nat nq\" using mmq nnq by simp\n also have \"\\ = 2 ^ s1 * of_nat mq - 2 ^ s1 * 2 ^ sq * of_nat nq\" using sq by (simp add: power_add)\n also have \"\\ = 2 ^ s1 * (of_nat mq - 2 ^ sq * of_nat nq)\" by (simp add: field_simps)\n also have \"\\ = 2 ^ s1 * of_nat (mq - 2 ^ sq * nq)\" using s1wb s2wb us1 us2 nqmq\n by (simp add: word_unat_power)\n finally have mn: \"m - n = of_nat (mq - 2 ^ sq * nq) * 2 ^ s1\" by simp\n moreover\n from nm have \"m - n \\ 2 ^ s2 - 1\"\n by - (rule word_diff_ls', (simp add: field_simps)+)\n hence \"(2::'a word) ^ s1 * of_nat (mq - 2 ^ sq * nq) < 2 ^ s2\" using mn s2wb by (simp add: field_simps word_less_sub_le)\n hence \"of_nat (mq - 2 ^ sq * nq) < (2::'a word) ^ (s2 - s1)\"\n proof (rule word_power_less_diff)\n have mm: \"mq - 2 ^ sq * nq < 2 ^ (len_of TYPE('a) - s1)\" using mq by simp\n moreover from s10 have \"len_of TYPE('a) - s1 < len_of TYPE('a)\"\n by (rule diff_less, simp)\n ultimately show \"of_nat (mq - 2 ^ sq * nq) < (2::'a word) ^ (len_of TYPE('a) - s1)\"\n apply (simp add: word_less_nat_alt)\n apply (subst unat_of_nat)\n apply (subst mod_less)\n apply (erule order_less_le_trans)\n apply simp+\n done\n qed\n hence \"mq - 2 ^ sq * nq < 2 ^ (s2 - s1)\" using mq s2wb\n apply (simp add: word_less_nat_alt)\n apply (subst (asm) unat_of_nat)\n apply (subst (asm) mod_less)\n apply (rule order_le_less_trans)\n apply (rule diff_le_self)\n apply (erule order_less_le_trans)\n apply simp\n apply assumption\n done\n ultimately show ?thesis by auto\nqed\n\nlemma word_less_sub_1:\n \"x < (y :: ('a :: len) word) \\ x \\ y - 1\"\n apply (erule udvd_minus_le')\n apply (simp add: udvd_def)+\n done\n\nlemma word_sub_mono2:\n \"\\ a + b \\ c + d; c \\ a; b \\ a + b; d \\ c + d \\\n \\ b \\ (d :: ('a :: len) word)\"\n apply (drule(1) word_sub_mono)\n apply simp\n apply simp\n apply simp\n done\n\n\n\nlemma word_subset_less:\n \"\\ {x .. x + r - 1} \\ {y .. y + s - 1};\n x \\ x + r - 1; y \\ y + (s :: ('a :: len) word) - 1;\n s \\ 0 \\\n \\ r \\ s\"\n apply (frule subsetD[where c=x])\n apply simp\n apply (drule subsetD[where c=\"x + r - 1\"])\n apply simp\n apply (clarsimp simp: add_diff_eq[symmetric])\n apply (drule(1) word_sub_mono2)\n apply (simp_all add: olen_add_eqv[symmetric])\n apply (erule word_le_minus_cancel)\n apply (rule ccontr)\n apply (simp add: word_not_le)\n done\n\nlemma two_power_strict_part_mono:\n \"strict_part_mono {..31} (\\x. (2 :: word32) ^ x)\"\n by (simp | subst strict_part_mono_by_steps)+\n\nlemma uint_power_lower:\n \"n < len_of TYPE('a) \\ uint (2 ^ n :: 'a :: len word) = (2 ^ n :: int)\"\n by (simp add: uint_nat int_power)\n\nlemma power_le_mono:\n \"\\2 ^ n \\ (2::'a::len word) ^ m; n < len_of TYPE('a); m < len_of TYPE('a)\\\n \\ n \\ m\"\n apply (clarsimp simp add: le_less)\n apply safe\n apply (simp add: word_less_nat_alt)\n apply (simp only: uint_arith_simps(3))\n apply (drule uint_power_lower)+\n apply simp\n done\n\nlemma sublist_equal_part:\n \"xs \\ ys \\ take (length xs) ys = xs\"\n by (clarsimp simp: prefixeq_def less_eq_list_def)\n\nlemma take_n_subset_le:\n \"\\ {x. take n (to_bl x) = take n xs} \\ {y :: word32. take m (to_bl y) = take m ys};\n n \\ 32; m \\ 32; length xs = 32; length ys = 32 \\\n \\ m \\ n\"\n apply (rule ccontr, simp add: le_def)\n apply (simp add: subset_iff)\n apply (drule spec[where x=\"of_bl (take n xs @ take (32 - n) (map Not (drop n ys)))\"])\n apply (simp add: word_bl.Abs_inverse)\n apply (subgoal_tac \"\\p. m = n + p\")\n apply clarsimp\n apply (simp add: take_add take_map_Not)\n apply (rule exI[where x=\"m - n\"])\n apply simp\n done\n\nlemma two_power_eq:\n \"\\n < len_of TYPE('a); m < len_of TYPE('a)\\\n \\ ((2::'a::len word) ^ n = 2 ^ m) = (n = m)\"\n apply safe\n apply (rule order_antisym)\n apply (simp add: power_le_mono[where 'a='a])+\n done\n\nlemma less_list_def': \"(xs < ys) = (prefix xs ys)\"\n apply (metis prefix_order.eq_iff prefix_def less_list_def less_eq_list_def)\n done\n\nlemma prefix_length_less:\n \"xs < ys \\ length xs < length ys\"\n apply (clarsimp simp: less_list_def' prefix_def)\n apply (frule prefixeq_length_le)\n apply (rule ccontr, simp)\n apply (clarsimp simp: prefixeq_def)\n done\n\nlemmas strict_prefix_simps [simp, code] = prefix_simps [folded less_list_def']\nlemmas take_strict_prefix = take_prefix [folded less_list_def']\n\nlemma not_prefix_longer:\n \"\\ length xs > length ys \\ \\ \\ xs \\ ys\"\n by (clarsimp dest!: prefix_length_le)\n\nlemma of_bl_length:\n \"length xs < len_of TYPE('a) \\ of_bl xs < (2 :: 'a::len word) ^ length xs\"\n by (simp add: of_bl_length_less)\n\n(* FIXME: do we need this? *)\nlemma power_overflow_simp [simp]:\n \"(2 ^ n = (0::'a :: len word)) = (len_of TYPE ('a) \\ n)\"\n by (rule WordLib.p2_eq_0)\n\nlemma unat_of_nat_eq:\n \"x < 2 ^ len_of TYPE('a) \\ unat (of_nat x ::'a::len word) = x\"\n by (simp add: unat_of_nat)\n\nlemmas unat_of_nat32 = unat_of_nat_eq[where 'a=32, unfolded word_bits_len_of]\n\nlemma unat_eq_of_nat:\n \"n < 2 ^ len_of TYPE('a) \\ (unat (x :: 'a::len word) = n) = (x = of_nat n)\"\n by (subst unat_of_nat_eq[where x=n, symmetric], simp+)\n\nlemma unat_less_helper:\n \"x < of_nat n \\ unat x < n\"\n apply (simp add: word_less_nat_alt)\n apply (erule order_less_le_trans)\n apply (simp add: unat_of_nat)\n done\n\nlemma of_nat_0:\n \"\\of_nat n = (0::('a::len) word); n < 2 ^ len_of (TYPE('a))\\ \\ n = 0\"\n by (drule unat_of_nat_eq, simp)\n\nlemma of_nat32_0:\n \"\\of_nat n = (0::word32); n < 2 ^ word_bits\\ \\ n = 0\"\n by (erule of_nat_0, simp add: word_bits_def)\n\nlemma unat_mask_2_less_4:\n \"unat (p && mask 2 :: word32) < 4\"\n apply (rule unat_less_helper)\n apply (rule order_le_less_trans, rule word_and_le1)\n apply (simp add: mask_def)\n done\n\nlemma minus_one_helper3:\n \"x < y \\ x \\ (y :: ('a :: len) word) - 1\"\n apply (simp add: word_less_nat_alt word_le_nat_alt)\n apply (subst unat_minus_one)\n apply clarsimp\n apply arith\n done\n\nlemma minus_one_helper:\n \"\\ x \\ y; x \\ 0 \\ \\ x - 1 < (y :: ('a :: len) word)\"\n apply (simp add: word_less_nat_alt word_le_nat_alt)\n apply (subst unat_minus_one)\n apply assumption\n apply (cases \"unat x\")\n apply (simp add: unat_eq_zero)\n apply arith\n done\n\nlemma minus_one_helper5:\n fixes x :: \"'a::len word\"\n shows \"\\y \\ 0; x \\ y - 1 \\ \\ x < y\"\n by (metis leD minus_one_helper not_leE)\n\nlemma plus_one_helper[elim!]:\n \"x < n + (1 :: ('a :: len) word) \\ x \\ n\"\n apply (simp add: word_less_nat_alt word_le_nat_alt field_simps)\n apply (case_tac \"1 + n = 0\")\n apply simp\n apply (subst(asm) unatSuc, assumption)\n apply arith\n done\n\n\n\nlemma not_greatest_aligned:\n \"\\ x < y; is_aligned x n; is_aligned y n \\\n \\ x + 2 ^ n \\ 0\"\n apply (rule notI)\n apply (erule is_aligned_get_word_bits[where p=y])\n apply (simp add: eq_diff_eq[symmetric])\n apply (frule minus_one_helper3)\n apply (drule le_minus'[where a=\"x\" and c=\"y - x\" and b=\"- 1\" for x y, simplified])\n apply (simp add: field_simps)\n apply (frule is_aligned_less_sz[where a=y])\n apply clarsimp\n apply (erule notE)\n apply (rule minus_one_helper5)\n apply simp\n apply (metis is_aligned_no_overflow minus_one_helper3 order_le_less_trans)\n apply simp\n done\n\nlemma of_nat_inj:\n \"\\x < 2 ^ len_of TYPE('a); y < 2 ^ len_of TYPE('a)\\ \\\n (of_nat x = (of_nat y :: 'a :: len word)) = (x = y)\"\n by (simp add: word_unat.norm_eq_iff [symmetric])\n\nlemma map_prefixI:\n \"xs \\ ys \\ map f xs \\ map f ys\"\n by (clarsimp simp: less_eq_list_def prefixeq_def)\n\nlemma if_Some_None_eq_None:\n \"((if P then Some v else None) = None) = (\\ P)\"\n by simp\n\nlemma CollectPairFalse [iff]:\n \"{(a,b). False} = {}\"\n by (simp add: split_def)\n\n\n\nlemma if_P_True1:\n \"Q \\ (if P then True else Q)\"\n by simp\n\nlemma if_P_True2:\n \"Q \\ (if P then Q else True)\"\n by simp\n\nlemma list_all2_induct [consumes 1, case_names Nil Cons]:\n assumes lall: \"list_all2 Q xs ys\"\n and nilr: \"P [] []\"\n and consr: \"\\x xs y ys. \\list_all2 Q xs ys; Q x y; P xs ys\\ \\ P (x # xs) (y # ys)\"\n shows \"P xs ys\"\n using lall\nproof (induct rule: list_induct2 [OF list_all2_lengthD [OF lall]])\n case 1 thus ?case by auto fact+\nnext\n case (2 x xs y ys)\n\n show ?case\n proof (rule consr)\n from \"2.prems\" show \"list_all2 Q xs ys\" and \"Q x y\" by simp_all\n thus \"P xs ys\" by (intro \"2.hyps\")\n qed\nqed\n\nlemma list_all2_induct_suffixeq [consumes 1, case_names Nil Cons]:\n assumes lall: \"list_all2 Q as bs\"\n and nilr: \"P [] []\"\n and consr: \"\\x xs y ys.\n \\list_all2 Q xs ys; Q x y; P xs ys; suffixeq (x # xs) as; suffixeq (y # ys) bs\\\n \\ P (x # xs) (y # ys)\"\n shows \"P as bs\"\nproof -\n def as' == as\n def bs' == bs\n\n have \"suffixeq as as' \\ suffixeq bs bs'\" unfolding as'_def bs'_def by simp\n thus ?thesis using lall\n proof (induct rule: list_induct2 [OF list_all2_lengthD [OF lall]])\n case 1 show ?case by fact\n next\n case (2 x xs y ys)\n\n show ?case\n proof (rule consr)\n from \"2.prems\" show \"list_all2 Q xs ys\" and \"Q x y\" by simp_all\n thus \"P xs ys\" using \"2.hyps\" \"2.prems\" by (auto dest: suffixeq_ConsD)\n from \"2.prems\" show \"suffixeq (x # xs) as\" and \"suffixeq (y # ys) bs\"\n\tby (auto simp: as'_def bs'_def)\n qed\n qed\nqed\n\nlemma distinct_prop_enum:\n \"\\ \\x y. \\ x \\ stop; y \\ stop; x \\ y \\\n \\ P x y \\\n \\ distinct_prop P [(0 :: word32) .e. stop]\"\n apply (simp add: upto_enum_def distinct_prop_map\n del: upt.simps)\n apply (rule distinct_prop_distinct)\n apply simp\n apply (simp add: less_Suc_eq_le del: upt.simps)\n apply (erule_tac x=\"of_nat x\" in meta_allE)\n apply (erule_tac x=\"of_nat y\" in meta_allE)\n apply (frule_tac y=x in unat_le)\n apply (frule_tac y=y in unat_le)\n apply (erule word_unat.Rep_cases)+\n apply (simp add: toEnum_of_nat[OF unat_lt2p]\n word_le_nat_alt)\n done\n\nlemma distinct_prop_enum_step:\n \"\\ \\x y. \\ x \\ stop div step; y \\ stop div step; x \\ y \\\n \\ P (x * step) (y * step) \\\n \\ distinct_prop P [0, step .e. stop]\"\n apply (simp add: upto_enum_step_def distinct_prop_map)\n apply (rule distinct_prop_enum)\n apply simp\n done\n\nlemma if_apply_def2:\n \"(if P then F else G) = (\\x. (P \\ F x) \\ (\\ P \\ G x))\"\n by simp\n\nlemma case_bool_If:\n \"case_bool P Q b = (if b then P else Q)\"\n by simp\n\nlemma option_case_If:\n \"case_option P (\\x. Q) v = (if v = None then P else Q)\"\n by clarsimp\n\nlemma option_case_If2:\n \"case_option P Q v = If (v \\ None) (Q (the v)) P\"\n by (simp split: option.split)\n\nlemma if3_fold:\n \"(if P then x else if Q then y else x)\n = (if P \\ \\ Q then x else y)\"\n by simp\n\nlemma word32_shift_by_2:\n \"x * 4 = (x::word32) << 2\"\n by (simp add: shiftl_t2n)\n\n(* TODO: move to Aligned *)\nlemma add_mask_lower_bits:\n \"\\is_aligned (x :: 'a :: len word) n;\n \\n' \\ n. n' < len_of TYPE('a) \\ \\ p !! n'\\ \\ x + p && ~~mask n = x\"\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size is_aligned_nth)\n apply (erule_tac x=na in allE)+\n apply simp\n apply (rule word_eqI)\n apply (clarsimp simp: word_size is_aligned_nth nth_mask word_ops_nth_size)\n apply (erule_tac x=na in allE)+\n apply (case_tac \"na < n\")\n apply simp\n apply simp\n done\n\nlemma findSomeD:\n \"find P xs = Some x \\ P x \\ x \\ set xs\"\n by (induct xs) (auto split: split_if_asm)\n\nlemma findNoneD:\n \"find P xs = None \\ \\x \\ set xs. \\P x\"\n by (induct xs) (auto split: split_if_asm)\n\nlemma dom_upd:\n \"dom (\\x. if x = y then None else f x) = dom f - {y}\"\n by (rule set_eqI) (auto split: split_if_asm)\n\nlemma ran_upd:\n \"\\ inj_on f (dom f); f y = Some z \\ \\ ran (\\x. if x = y then None else f x) = ran f - {z}\"\n apply (rule set_eqI)\n apply (unfold ran_def)\n apply simp\n apply (rule iffI)\n apply clarsimp\n apply (rule conjI, blast)\n apply clarsimp\n apply (drule_tac x=a and y=y in inj_onD, simp)\n apply blast\n apply blast\n apply simp\n apply clarsimp\n apply (rule_tac x=a in exI)\n apply clarsimp\n done\n\nlemma maxBound_word:\n \"(maxBound::'a::len word) = -1\"\n apply (simp add: maxBound_def enum_word_def)\n apply (subst last_map)\n apply clarsimp\n apply simp\n done\n\nlemma minBound_word:\n \"(minBound::'a::len word) = 0\"\n apply (simp add: minBound_def enum_word_def)\n apply (subst map_upt_unfold)\n apply simp\n apply simp\n done\n\nlemma maxBound_max_word:\n \"(maxBound::'a::len word) = max_word\"\n apply (subst maxBound_word)\n apply (subst max_word_minus [symmetric])\n apply (rule refl)\n done\n\n\n\nlemma is_aligned_andI1:\n \"is_aligned x n \\ is_aligned (x && y) n\"\n by (simp add: is_aligned_nth)\n\nlemma is_aligned_andI2:\n \"is_aligned y n \\ is_aligned (x && y) n\"\n by (simp add: is_aligned_nth)\n\nlemma is_aligned_shiftl:\n \"is_aligned w (n - m) \\ is_aligned (w << m) n\"\n by (simp add: is_aligned_nth nth_shiftl)\n\nlemma is_aligned_shiftr:\n \"is_aligned w (n + m) \\ is_aligned (w >> m) n\"\n by (simp add: is_aligned_nth nth_shiftr)\n\nlemma is_aligned_shiftl_self:\n \"is_aligned (p << n) n\"\n by (rule is_aligned_shiftl) simp\n\nlemma is_aligned_neg_mask_eq:\n \"is_aligned p n \\ p && ~~ mask n = p\"\n apply (simp add: is_aligned_nth)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_ops_nth_size)\n apply fastforce\n done\n\nlemma rtrancl_insert:\n assumes x_new: \"\\y. (x,y) \\ R\"\n shows \"R^* `` insert x S = insert x (R^* `` S)\"\nproof -\n have \"R^* `` insert x S = R^* `` ({x} \\ S)\" by simp\n also\n have \"R^* `` ({x} \\ S) = R^* `` {x} \\ R^* `` S\"\n by (subst Image_Un) simp\n also\n have \"R^* `` {x} = {x}\"\n apply (clarsimp simp: Image_singleton)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (drule rtranclD)\n apply (erule disjE, simp)\n apply clarsimp\n apply (drule tranclD)\n apply (clarsimp simp: x_new)\n apply fastforce\n done\n finally\n show ?thesis by simp\nqed\n\nlemma ran_del_subset:\n \"y \\ ran (f (x := None)) \\ y \\ ran f\"\n by (auto simp: ran_def split: split_if_asm)\n\nlemma trancl_sub_lift:\n assumes sub: \"\\p p'. (p,p') \\ r \\ (p,p') \\ r'\"\n shows \"(p,p') \\ r^+ \\ (p,p') \\ r'^+\"\n by (fastforce intro: trancl_mono sub)\n\nlemma trancl_step_lift:\n assumes x_step: \"\\p p'. (p,p') \\ r' \\ (p,p') \\ r \\ (p = x \\ p' = y)\"\n assumes y_new: \"\\p'. \\(y,p') \\ r\"\n shows \"(p,p') \\ r'^+ \\ (p,p') \\ r^+ \\ ((p,x) \\ r^+ \\ p' = y) \\ (p = x \\ p' = y)\"\n apply (erule trancl_induct)\n apply (drule x_step)\n apply fastforce\n apply (erule disjE)\n apply (drule x_step)\n apply (erule disjE)\n apply (drule trancl_trans, drule r_into_trancl, assumption)\n apply blast\n apply clarsimp\n apply (erule disjE)\n apply clarsimp\n apply (drule x_step)\n apply (erule disjE)\n apply (simp add: y_new)\n apply simp\n apply clarsimp\n apply (drule x_step)\n apply (simp add: y_new)\n done\n\nlemma upto_enum_step_shift:\n \"\\ is_aligned p n \\ \\\n ([p , p + 2 ^ m .e. p + 2 ^ n - 1])\n = map (op + p) [0, 2 ^ m .e. 2 ^ n - 1]\"\n apply (erule is_aligned_get_word_bits)\n prefer 2\n apply (simp add: map_idI)\n apply (clarsimp simp: upto_enum_step_def)\n apply (frule is_aligned_no_overflow)\n apply (simp add: linorder_not_le [symmetric])\n done\n\nlemma upto_enum_step_shift_red:\n \"\\ is_aligned p sz; sz < word_bits; us \\ sz \\\n \\ [p, p + 2 ^ us .e. p + 2 ^ sz - 1]\n = map (\\x. p + of_nat x * 2 ^ us) [0 ..< 2 ^ (sz - us)]\"\n apply (subst upto_enum_step_shift, assumption)\n apply (simp add: upto_enum_step_red)\n done\n\nlemma div_to_mult_word_lt:\n \"\\ (x :: ('a :: len) word) \\ y div z \\ \\ x * z \\ y\"\n apply (cases \"z = 0\")\n apply simp\n apply (simp add: word_neq_0_conv)\n apply (rule order_trans)\n apply (erule(1) word_mult_le_mono1)\n apply (simp add: unat_div)\n apply (rule order_le_less_trans [OF div_mult_le])\n apply simp\n apply (rule word_div_mult_le)\n done\n\nlemma upto_enum_step_subset:\n \"set [x, y .e. z] \\ {x .. z}\"\n apply (clarsimp simp: upto_enum_step_def linorder_not_less)\n apply (drule div_to_mult_word_lt)\n apply (rule conjI)\n apply (erule word_random[rotated])\n apply simp\n apply (rule order_trans)\n apply (erule word_plus_mono_right)\n apply simp\n apply simp\n done\n\nlemma shiftr_less_t2n':\n fixes x :: \"('a :: len) word\"\n shows \"\\ x && mask (n + m) = x; m < len_of TYPE('a) \\\n \\ (x >> n) < 2 ^ m\"\n apply (subst mask_eq_iff_w2p[symmetric])\n apply (simp add: word_size)\n apply (rule word_eqI)\n apply (drule_tac x=\"na + n\" in word_eqD)\n apply (simp add: nth_shiftr word_size)\n apply safe\n done\n\nlemma shiftr_less_t2n:\n fixes x :: \"('a :: len) word\"\n shows \"x < 2 ^ (n + m) \\ (x >> n) < 2 ^ m\"\n apply (rule shiftr_less_t2n')\n apply (erule less_mask_eq)\n apply (rule ccontr)\n apply (simp add: not_less)\n apply (subst (asm) p2_eq_0[symmetric])\n apply (simp add: power_add)\n done\n\nlemma shiftr_eq_0:\n \"n \\ len_of TYPE('a :: len) \\ ((w::('a::len word)) >> n) = 0\"\napply (cut_tac shiftr_less_t2n'[of w n 0], simp)\n apply (simp add: mask_eq_iff)\napply (simp add: lt2p_lem)\napply simp\ndone\n\nlemma shiftr_not_mask_0:\n \"n+m\\len_of TYPE('a :: len) \\ ((w::('a::len word)) >> n) && ~~ mask m = 0\"\n apply (simp add: and_not_mask shiftr_less_t2n shiftr_shiftr)\n apply (subgoal_tac \"w >> n + m = 0\", simp)\n apply (simp add: le_mask_iff[symmetric] mask_def le_def)\n apply (subst (asm) p2_gt_0[symmetric])\n apply (simp add: power_add not_less)\ndone\n\nlemma shiftl_less_t2n:\n fixes x :: \"('a :: len) word\"\n shows \"\\ x < (2 ^ (m - n)); m < len_of TYPE('a) \\ \\ (x << n) < 2 ^ m\"\n apply (subst mask_eq_iff_w2p[symmetric])\n apply (simp add: word_size)\n apply (drule less_mask_eq)\n apply (rule word_eqI)\n apply (drule_tac x=\"na - n\" in word_eqD)\n apply (simp add: nth_shiftl word_size)\n apply (cases \"n \\ m\")\n apply safe\n apply simp\n apply simp\n done\n\nlemma shiftl_less_t2n':\n \"(x::'a::len word) < 2 ^ m \\ m+n < len_of TYPE('a) \\ x << n < 2 ^ (m + n)\"\nby (rule shiftl_less_t2n) simp_all\n\nlemma ucast_ucast_mask:\n \"(ucast :: ('a :: len) word \\ ('b :: len) word) (ucast x) = x && mask (len_of TYPE ('a))\"\n apply (rule word_eqI)\n apply (simp add: nth_ucast word_size)\n done\n\nlemma ucast_ucast_len:\n \"\\ x < 2 ^ len_of TYPE('b) \\ \\\n ucast (ucast x::'b::len word) = (x::'a::len word)\"\n apply (subst ucast_ucast_mask)\n apply (erule less_mask_eq)\n done\n\nlemma unat_ucast: \"unat (ucast x :: ('a :: len0) word) = unat x mod 2 ^ (len_of TYPE('a))\"\n apply (simp add: unat_def ucast_def)\n apply (subst word_uint.eq_norm)\n apply (subst nat_mod_distrib)\n apply simp\n apply simp\n apply (subst nat_power_eq)\n apply simp\n apply simp\n done\n\nlemma sints_subset:\n \"m \\ n \\ sints m \\ sints n\"\n apply (simp add: sints_num)\n apply clarsimp\n apply (rule conjI)\n apply (erule order_trans[rotated])\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n done\n\nlemma up_scast_inj:\n \"\\ scast x = (scast y :: ('b :: len) word); size x \\ len_of TYPE('b) \\\n \\ x = y\"\n apply (simp add: scast_def)\n apply (subst(asm) word_sint.Abs_inject)\n apply (erule subsetD [OF sints_subset])\n apply (simp add: word_size)\n apply (erule subsetD [OF sints_subset])\n apply (simp add: word_size)\n apply simp\n done\n\nlemma up_scast_inj_eq:\n \"len_of TYPE('a) \\ len_of TYPE ('b) \\ (scast x = (scast y::'b::len word)) = (x = (y::'a::len word))\"\n by (fastforce dest: up_scast_inj simp: word_size)\n\nlemma nth_bounded:\n \"\\(x :: 'a :: len word) !! n; x < 2 ^ m; m \\ len_of TYPE ('a)\\ \\ n < m\"\n apply (frule test_bit_size)\n apply (clarsimp simp: test_bit_bl word_size)\n apply (simp add: nth_rev)\n apply (subst(asm) is_aligned_add_conv[OF is_aligned_0',\n simplified add_0_left, rotated])\n apply assumption+\n apply (simp only: to_bl_0 word_bits_len_of)\n apply (simp add: nth_append split: split_if_asm)\n done\n\nlemma is_aligned_add_or:\n \"\\is_aligned p n; d < 2 ^ n\\ \\ p + d = p || d\"\n apply (rule word_plus_and_or_coroll)\n apply (erule is_aligned_get_word_bits)\n apply (rule word_eqI)\n apply (clarsimp simp add: is_aligned_nth)\n apply (frule(1) nth_bounded)\n apply simp+\n done\n\nlemma two_power_increasing:\n \"\\ n \\ m; m < len_of TYPE('a) \\ \\ (2 :: 'a :: len word) ^ n \\ 2 ^ m\"\n by (simp add: word_le_nat_alt)\n\nlemma is_aligned_add_less_t2n:\n \"\\is_aligned (p\\'a\\len word) n; d < 2^n; n \\ m; p < 2^m\\ \\ p + d < 2^m\"\n apply (case_tac \"m < len_of TYPE('a)\")\n apply (subst mask_eq_iff_w2p[symmetric])\n apply (simp add: word_size)\n apply (simp add: is_aligned_add_or word_ao_dist less_mask_eq)\n apply (subst less_mask_eq)\n apply (erule order_less_le_trans)\n apply (erule(1) two_power_increasing)\n apply simp\n apply (simp add: power_overflow)\n done\n\n(* FIXME: generalise? *)\nlemma le_2p_upper_bits:\n \"\\ (p::word32) \\ 2^n - 1; n < word_bits \\ \\ \\n'\\n. n' < word_bits \\ \\ p !! n'\"\n apply (subst upper_bits_unset_is_l2p, assumption)\n apply simp\n done\n\nlemma ran_upd':\n \"\\inj_on f (dom f); f y = Some z\\\n \\ ran (f (y := None)) = ran f - {z}\"\n apply (drule (1) ran_upd)\n apply (simp add: ran_def)\n done\n\n(* FIXME: generalise? *)\nlemma le2p_bits_unset:\n \"p \\ 2 ^ n - 1 \\ \\n'\\n. n' < word_bits \\ \\ (p::word32) !! n'\"\n apply (case_tac \"n < word_bits\")\n apply (frule upper_bits_unset_is_l2p [where p=p])\n apply simp_all\n done\n\nlemma aligned_offset_non_zero:\n \"\\ is_aligned x n; y < 2 ^ n; x \\ 0 \\ \\ x + y \\ 0\"\n apply (cases \"y = 0\")\n apply simp\n apply (subst word_neq_0_conv)\n apply (subst gt0_iff_gem1)\n apply (erule is_aligned_get_word_bits)\n apply (subst field_simps[symmetric], subst plus_le_left_cancel_nowrap)\n apply (rule is_aligned_no_wrap')\n apply simp\n apply (rule minus_one_helper)\n apply simp\n apply assumption\n apply (erule (1) is_aligned_no_wrap')\n apply (simp add: gt0_iff_gem1 [symmetric] word_neq_0_conv)\n apply simp\n done\n\nlemma le_imp_power_dvd_int:\n \"n \\ m \\ (b ^ n :: int) dvd b ^ m\"\n apply (simp add: dvd_def)\n apply (rule exI[where x=\"b ^ (m - n)\"])\n apply (simp add: power_add[symmetric])\n done\n\n (* FIXME: this is identical to mask_eqs(1), unnecessary? *)\nlemma mask_inner_mask:\n \"((p && mask n) + q) && mask n\n = (p + q) && mask n\"\n apply (rule mask_eqs(1))\n done\n\nlemma mask_add_aligned:\n \"is_aligned p n\n \\ (p + q) && mask n = q && mask n\"\n apply (simp add: is_aligned_mask)\n apply (subst mask_inner_mask [symmetric])\n apply simp\n done\n\nlemma take_prefix:\n \"(take (length xs) ys = xs) = (xs \\ ys)\"\nproof (induct xs arbitrary: ys)\n case Nil thus ?case by simp\nnext\n case Cons thus ?case by (cases ys) auto\nqed\n\nlemma rel_comp_Image:\n \"(R O R') `` S = R' `` (R `` S)\"\n by blast\n\nlemma trancl_power:\n \"x \\ r^+ = (\\n > 0. x \\ r^^n)\"\n apply (cases x)\n apply simp\n apply (rule iffI)\n apply (drule tranclD2)\n apply (clarsimp simp: rtrancl_is_UN_relpow)\n apply (rule_tac x=\"Suc n\" in exI)\n apply fastforce\n apply clarsimp\n apply (case_tac n, simp)\n apply clarsimp\n apply (drule relpow_imp_rtrancl)\n apply fastforce\n done\n\nlemma take_is_prefix:\n \"take n xs \\ xs\"\n apply (simp add: less_eq_list_def prefixeq_def)\n apply (rule_tac x=\"drop n xs\" in exI)\n apply simp\n done\n\nlemma cart_singleton_empty:\n \"(S \\ {e} = {}) = (S = {})\"\n by blast\n\nlemma word_div_1:\n \"(n :: ('a :: len) word) div 1 = n\"\n by (simp add: word_div_def)\n\nlemma word_minus_one_le:\n \"-1 \\ (x :: ('a :: len) word) = (x = -1)\"\n apply (insert word_n1_ge[where y=x])\n apply safe\n apply (erule(1) order_antisym)\n done\n\nlemmas word32_minus_one_le =\n word_minus_one_le[where 'a=32, simplified]\n\nlemma mask_out_sub_mask:\n \"(x && ~~ mask n) = x - (x && mask n)\"\n by (simp add: field_simps word_plus_and_or_coroll2)\n\nlemma is_aligned_addD1:\n assumes al1: \"is_aligned (x + y) n\"\n and al2: \"is_aligned (x::'a::len word) n\"\n shows \"is_aligned y n\"\n using al2\nproof (rule is_aligned_get_word_bits)\n assume \"x = 0\" thus ?thesis using al1 by simp\nnext\n assume nv: \"n < len_of TYPE('a)\"\n from al1 obtain q1\n where xy: \"x + y = 2 ^ n * of_nat q1\" and \"q1 < 2 ^ (len_of TYPE('a) - n)\"\n by (rule is_alignedE)\n moreover from al2 obtain q2\n where x: \"x = 2 ^ n * of_nat q2\" and \"q2 < 2 ^ (len_of TYPE('a) - n)\"\n by (rule is_alignedE)\n ultimately have \"y = 2 ^ n * (of_nat q1 - of_nat q2)\"\n by (simp add: field_simps)\n thus ?thesis using nv by (simp add: is_aligned_mult_triv1)\nqed\n\nlemmas is_aligned_addD2 =\n is_aligned_addD1[OF subst[OF add.commute,\n of \"%x. is_aligned x n\" for n]]\n\nlemma is_aligned_add:\n \"\\is_aligned p n; is_aligned q n\\ \\ is_aligned (p + q) n\"\n by (simp add: is_aligned_mask mask_add_aligned)\n\nlemma my_BallE: \"\\ \\x \\ A. P x; y \\ A; P y \\ Q \\ \\ Q\"\n by (simp add: Ball_def)\n\nlemma word_le_add:\n fixes x :: \"'a :: len word\"\n shows \"x \\ y \\ \\n. y = x + of_nat n\"\n apply (rule exI [where x = \"unat (y - x)\"])\n apply simp\n done\n\n\n\nlemma zipWith_nth:\n \"\\ n < min (length xs) (length ys) \\ \\ zipWith f xs ys ! n = f (xs ! n) (ys ! n)\"\n unfolding zipWith_def by simp\n\nlemma length_zipWith:\n \"length (zipWith f xs ys) = min (length xs) (length ys)\"\n unfolding zipWith_def by simp\n\nlemma distinct_prop_nth:\n \"\\ distinct_prop P ls; n < n'; n' < length ls \\ \\ P (ls ! n) (ls ! n')\"\n apply (induct ls arbitrary: n n')\n apply simp\n apply simp\n apply (case_tac n')\n apply simp\n apply simp\n apply (case_tac n)\n apply simp\n apply simp\n done\n\nlemma shiftl_mask_is_0 :\n \"(x << n) && mask n = 0\"\n apply (rule iffD1 [OF is_aligned_mask])\n apply (rule is_aligned_shiftl_self)\n done\n\nlemma word_power_nonzero:\n \"\\ (x :: word32) < 2 ^ (word_bits - n); n < word_bits; x \\ 0 \\ \\ x * 2 ^ n \\ 0\"\n apply (cases \"n = 0\")\n apply simp\n apply (simp only: word_neq_0_conv word_less_nat_alt\n shiftl_t2n mod_0 unat_word_ariths\n unat_power_lower word_le_nat_alt word_bits_def)\n apply (unfold word_bits_len_of)\n apply (subst mod_less)\n apply (subst mult.commute, erule nat_less_power_trans)\n apply simp\n apply simp\n done\n\nlemmas unat_mult_simple = iffD1 [OF unat_mult_lem [where 'a = 32, unfolded word_bits_len_of]]\n\ndefinition\n sum_map :: \"('a \\ 'b) \\ ('c \\ 'd) \\ 'a + 'c \\ 'b + 'd\" where\n \"sum_map f g x \\ case x of Inl v \\ Inl (f v) | Inr v' \\ Inr (g v')\"\n\nlemma sum_map_simps[simp]:\n \"sum_map f g (Inl v) = Inl (f v)\"\n \"sum_map f g (Inr w) = Inr (g w)\"\n by (simp add: sum_map_def)+\n\nlemma if_and_helper:\n \"(If x v v') && v'' = If x (v && v'') (v' && v'')\"\n by (simp split: split_if)\n\nlemma unat_Suc2:\n fixes n :: \"('a :: len) word\"\n shows\n \"n \\ -1 \\ unat (n + 1) = Suc (unat n)\"\n apply (subst add.commute, rule unatSuc)\n apply (subst eq_diff_eq[symmetric], simp add: minus_equation_iff)\n done\n\nlemmas unat_eq_1\n = unat_eq_0 word_unat.Rep_inject[where y=1, simplified]\n\nlemma cart_singleton_image:\n \"S \\ {s} = (\\v. (v, s)) ` S\"\n by auto\n\nlemma singleton_eq_o2s:\n \"({x} = set_option v) = (v = Some x)\"\n by (cases v, auto)\n\nlemma ran_option_map_restrict_eq:\n \"\\ x \\ ran (option_map f o g); x \\ ran (option_map f o (g |` (- {y}))) \\\n \\ \\v. g y = Some v \\ f v = x\"\n apply (clarsimp simp: elim!: ranE)\n apply (rename_tac w z)\n apply (case_tac \"w = y\")\n apply clarsimp\n apply (erule notE, rule_tac a=w in ranI)\n apply (simp add: restrict_map_def)\n done\n\nlemma option_set_singleton_eq:\n \"(set_option opt = {v}) = (opt = Some v)\"\n by (cases opt, simp_all)\n\nlemmas option_set_singleton_eqs\n = option_set_singleton_eq\n trans[OF eq_commute option_set_singleton_eq]\n\nlemma option_map_comp2:\n \"option_map (f o g) = option_map f o option_map g\"\n by (simp add: option.map_comp fun_eq_iff)\n\nlemma rshift_sub_mask_eq:\n \"(a >> (size a - b)) && mask b = a >> (size a - b)\"\n using shiftl_shiftr2[where a=a and b=0 and c=\"size a - b\"]\n apply (cases \"b < size a\")\n apply simp\n apply (simp add: linorder_not_less mask_def word_size\n p2_eq_0[THEN iffD2])\n done\n\nlemma shiftl_shiftr3:\n \"b \\ c \\ a << b >> c = (a >> c - b) && mask (size a - c)\"\n apply (cases \"b = c\")\n apply (simp add: shiftl_shiftr1)\n apply (simp add: shiftl_shiftr2)\n done\n\nlemma and_mask_shiftr_comm:\n \"m\\size w \\ (w && mask m) >> n = (w >> n) && mask (m-n)\"\n by (simp add: and_mask shiftr_shiftr) (simp add: word_size shiftl_shiftr3)\n\n\n\nlemma and_not_mask_twice:\n \"(w && ~~ mask n) && ~~ mask m = w && ~~ mask (max m n)\"\napply (simp add: and_not_mask)\napply (case_tac \"n x = y - 1 \\ x < y - (1 ::'a::len word)\"\n apply (drule word_less_sub_1)\n apply (drule order_le_imp_less_or_eq)\n apply auto\n done\n\nlemma eq_eqI:\n \"a = b \\ (a = x) = (b = x)\"\n by simp\n\nlemma mask_and_mask:\n \"mask a && mask b = mask (min a b)\"\n apply (rule word_eqI)\n apply (simp add: word_size)\n done\n\nlemma mask_eq_0_eq_x:\n \"(x && w = 0) = (x && ~~ w = x)\"\n using word_plus_and_or_coroll2[where x=x and w=w]\n by auto\n\nlemma mask_eq_x_eq_0:\n \"(x && w = x) = (x && ~~ w = 0)\"\n using word_plus_and_or_coroll2[where x=x and w=w]\n by auto\n\ndefinition\n \"limited_and (x :: ('a :: len) word) y = (x && y = x)\"\n\nlemma limited_and_eq_0:\n \"\\ limited_and x z; y && ~~ z = y \\ \\ x && y = 0\"\n unfolding limited_and_def\n apply (subst arg_cong2[where f=\"op &&\"])\n apply (erule sym)+\n apply (simp(no_asm) add: word_bw_assocs word_bw_comms word_bw_lcs)\n done\n\nlemma limited_and_eq_id:\n \"\\ limited_and x z; y && z = z \\ \\ x && y = x\"\n unfolding limited_and_def\n by (erule subst, fastforce simp: word_bw_lcs word_bw_assocs word_bw_comms)\n\nlemma lshift_limited_and:\n \"limited_and x z \\ limited_and (x << n) (z << n)\"\n unfolding limited_and_def\n by (simp add: shiftl_over_and_dist[symmetric])\n\nlemma rshift_limited_and:\n \"limited_and x z \\ limited_and (x >> n) (z >> n)\"\n unfolding limited_and_def\n by (simp add: shiftr_over_and_dist[symmetric])\n\nlemmas limited_and_simps1 = limited_and_eq_0 limited_and_eq_id\n\nlemmas is_aligned_limited_and\n = is_aligned_neg_mask_eq[unfolded mask_def, folded limited_and_def]\n\nlemma compl_of_1: \"~~ 1 = (-2 :: ('a :: len) word)\"\n apply (rule word_bool_alg.compl_eq_compl_iff[THEN iffD1])\n apply simp\n done\n\nlemmas limited_and_simps = limited_and_simps1\n limited_and_simps1[OF is_aligned_limited_and]\n limited_and_simps1[OF lshift_limited_and]\n limited_and_simps1[OF rshift_limited_and]\n limited_and_simps1[OF rshift_limited_and, OF is_aligned_limited_and]\n compl_of_1 shiftl_shiftr1[unfolded word_size mask_def]\n shiftl_shiftr2[unfolded word_size mask_def]\n\nlemma isRight_sum_case: \"isRight x \\ case_sum f g x = g (theRight x)\"\n by (clarsimp simp add: isRight_def)\n\nlemma split_word_eq_on_mask:\n \"(x = y) = (x && m = y && m \\ x && ~~ m = y && ~~ m)\"\n apply safe\n apply (rule word_eqI)\n apply (drule_tac x=n in word_eqD)+\n apply (simp add: word_size word_ops_nth_size)\n apply auto\n done\n\nlemma inj_case_bool:\n \"inj (case_bool a b) = (a \\ b)\"\n by (auto dest: inj_onD[where x=True and y=False]\n intro: inj_onI split: bool.split_asm)\n\nlemma zip_map2:\n \"zip as (map f bs) = map (\\(a, b). (a, f b)) (zip as bs)\"\n apply (induct bs arbitrary: as)\n apply simp\n apply (case_tac as)\n apply simp\n apply simp\n done\n\nlemma zip_same: \"zip xs xs = map (\\v. (v, v)) xs\"\n by (induct xs, simp+)\n\nlemma foldl_fun_upd:\n \"foldl (\\s r. s (r := g r)) f rs\n = (\\x. if x \\ set rs then g x else f x)\"\n apply (induct rs arbitrary: f)\n apply simp\n apply (auto simp: fun_eq_iff split: split_if)\n done\n\nlemma all_rv_choice_fn_eq_pred:\n \"\\ \\rv. P rv \\ \\fn. f rv = g fn \\\n \\ \\fn. \\rv. P rv \\ f rv = g (fn rv)\"\n apply (rule_tac x=\"\\rv. SOME h. f rv = g h\" in exI)\n apply (clarsimp split: split_if)\n apply (erule meta_allE, drule(1) meta_mp, elim exE)\n apply (erule someI)\n done\n\nlemma ex_const_function:\n \"\\f. \\s. f (f' s) = v\"\n by force\n\nlemma sum_to_zero:\n \"(a :: 'a :: ring) + b = 0 \\ a = (- b)\"\n by (drule arg_cong[where f=\"\\ x. x - a\"], simp)\n\nlemma nat_le_Suc_less_imp:\n \"x < y \\ x \\ y - Suc 0\"\n by arith\n\nlemma list_case_If2:\n \"case_list f g xs = If (xs = []) f (g (hd xs) (tl xs))\"\n by (simp split: list.split)\n\nlemma length_ineq_not_Nil:\n \"length xs > n \\ xs \\ []\"\n \"length xs \\ n \\ n \\ 0 \\ xs \\ []\"\n \"\\ length xs < n \\ n \\ 0 \\ xs \\ []\"\n \"\\ length xs \\ n \\ xs \\ []\"\n by auto\n\nlemma numeral_eqs:\n \"2 = Suc (Suc 0)\"\n \"3 = Suc (Suc (Suc 0))\"\n \"4 = Suc (Suc (Suc (Suc 0)))\"\n \"5 = Suc (Suc (Suc (Suc (Suc 0))))\"\n \"6 = Suc (Suc (Suc (Suc (Suc (Suc 0)))))\"\n by simp+\n\nlemma psubset_singleton:\n \"(S \\ {x}) = (S = {})\"\n by blast\n\nlemma ucast_not_helper:\n fixes a::word8\n assumes a: \"a \\ 0xFF\"\n shows \"ucast a \\ (0xFF::word32)\"\nproof\n assume \"ucast a = (0xFF::word32)\"\n also\n have \"(0xFF::word32) = ucast (0xFF::word8)\" by simp\n finally\n show False using a\n apply -\n apply (drule up_ucast_inj, simp)\n apply simp\n done\nqed\n\nlemma length_takeWhile_ge:\n \"length (takeWhile f xs) = n\n \\ length xs = n \\ (length xs > n \\ \\ f (xs ! n))\"\n apply (induct xs arbitrary: n)\n apply simp\n apply (simp split: split_if_asm)\n apply (case_tac n, simp_all)\n done\n\nlemma length_takeWhile_le:\n \"\\ f (xs ! n) \\\n length (takeWhile f xs) \\ n\"\n apply (induct xs arbitrary: n)\n apply simp\n apply (clarsimp split: split_if)\n apply (case_tac n, simp_all)\n done\n\nlemma length_takeWhile_gt:\n \"n < length (takeWhile f xs)\n \\ (\\ys zs. length ys = Suc n \\ xs = ys @ zs \\ takeWhile f xs = ys @ takeWhile f zs)\"\n apply (induct xs arbitrary: n)\n apply simp\n apply (simp split: split_if_asm)\n apply (case_tac n, simp_all)\n apply (rule_tac x=\"[a]\" in exI)\n apply simp\n apply (erule meta_allE, drule(1) meta_mp)\n apply clarsimp\n apply (rule_tac x=\"a # ys\" in exI)\n apply simp\n done\n\nlemma hd_drop_conv_nth2:\n \"n < length xs \\ hd (drop n xs) = xs ! n\"\n by (rule hd_drop_conv_nth, clarsimp+)\n\nlemma map_upt_eq_vals_D:\n \"\\ map f [0 ..< n] = ys; m < length ys \\ \\ f m = ys ! m\"\n by clarsimp\n\nlemma length_le_helper:\n \"\\ n \\ length xs; n \\ 0 \\ \\ xs \\ [] \\ n - 1 \\ length (tl xs)\"\n by (cases xs, simp_all)\n\nlemma all_ex_eq_helper:\n \"(\\v. (\\v'. v = f v' \\ P v v') \\ Q v)\n = (\\v'. P (f v') v' \\ Q (f v'))\"\n by auto\n\nlemma less_4_cases:\n \"(x::word32) < 4 \\ x=0 \\ x=1 \\ x=2 \\ x=3\"\n apply clarsimp\n apply (drule word_less_cases, erule disjE, simp, simp)+\n done\n\nlemma if_n_0_0:\n \"((if P then n else 0) \\ 0) = (P \\ n \\ 0)\"\n by (simp split: split_if)\n\nlemma insert_dom:\n assumes fx: \"f x = Some y\"\n shows \"insert x (dom f) = dom f\"\n unfolding dom_def using fx by auto\n\nlemma map_comp_subset_dom:\n \"dom (prj \\\\<^sub>m f) \\ dom f\"\n unfolding dom_def\n by (auto simp: map_comp_Some_iff)\n\nlemmas map_comp_subset_domD = subsetD [OF map_comp_subset_dom]\n\nlemma dom_map_comp:\n \"x \\ dom (prj \\\\<^sub>m f) = (\\y z. f x = Some y \\ prj y = Some z)\"\n by (fastforce simp: dom_def map_comp_Some_iff)\n\nlemma option_map_Some_eq2:\n \"(Some y = option_map f x) = (\\z. x = Some z \\ f z = y)\"\n by (metis map_option_eq_Some)\n\nlemma option_map_eq_dom_eq:\n assumes ome: \"option_map f \\ g = option_map f \\ g'\"\n shows \"dom g = dom g'\"\nproof (rule set_eqI)\n fix x\n {\n assume \"x \\ dom g\"\n hence \"Some (f (the (g x))) = (option_map f \\ g) x\"\n by (auto simp: map_option_case split: option.splits)\n also have \"\\ = (option_map f \\ g') x\" by (simp add: ome)\n finally have \"x \\ dom g'\"\n by (auto simp: map_option_case split: option.splits)\n } moreover\n {\n assume \"x \\ dom g'\"\n hence \"Some (f (the (g' x))) = (option_map f \\ g') x\"\n by (auto simp: map_option_case split: option.splits)\n also have \"\\ = (option_map f \\ g) x\" by (simp add: ome)\n finally have \"x \\ dom g\"\n by (auto simp: map_option_case split: option.splits)\n } ultimately show \"(x \\ dom g) = (x \\ dom g')\" by auto\nqed\n\nlemma map_comp_eqI:\n assumes dm: \"dom g = dom g'\"\n and fg: \"\\x. x \\ dom g' \\ f (the (g' x)) = f (the (g x))\"\n shows \"f \\\\<^sub>m g = f \\\\<^sub>m g'\"\n apply (rule ext)\n apply (case_tac \"x \\ dom g\")\n apply (frule subst [OF dm])\n apply (clarsimp split: option.splits)\n apply (frule domI [where m = g'])\n apply (drule fg)\n apply simp\n apply (frule subst [OF dm])\n apply clarsimp\n apply (drule not_sym)\n apply (clarsimp simp: map_comp_Some_iff)\n done\n\nlemma is_aligned_0:\n \"is_aligned 0 n\"\n unfolding is_aligned_def\n by simp\n\nlemma compD:\n \"\\f \\ g = f \\ g'; g x = v \\ \\ f (g' x) = f v\"\n apply clarsimp\n apply (subgoal_tac \"(f (g x)) = (f \\ g) x\")\n apply simp\n apply (simp (no_asm))\n done\n\nlemma option_map_comp_eqE:\n assumes om: \"option_map f \\ mp = option_map f \\ mp'\"\n and p1: \"\\ mp x = None; mp' x = None \\ \\ P\"\n and p2: \"\\v v'. \\ mp x = Some v; mp' x = Some v'; f v = f v' \\ \\ P\"\n shows \"P\"\nproof (cases \"mp x\")\n case None\n hence \"x \\ dom mp\" by (simp add: domIff)\n hence \"mp' x = None\" by (simp add: option_map_eq_dom_eq [OF om] domIff)\n with None show ?thesis by (rule p1)\nnext\n case (Some v)\n hence \"x \\ dom mp\" by clarsimp\n then obtain v' where Some': \"mp' x = Some v'\" by (clarsimp simp add: option_map_eq_dom_eq [OF om])\n with Some show ?thesis\n proof (rule p2)\n show \"f v = f v'\" using Some' compD [OF om, OF Some] by simp\n qed\nqed\n\nlemma Some_the:\n \"x \\ dom f \\ f x = Some (the (f x))\"\n by clarsimp\n\nlemma map_comp_update:\n \"f \\\\<^sub>m (g(x \\ v)) = (f \\\\<^sub>m g)(x := f v)\"\n apply (rule ext)\n apply clarsimp\n apply (case_tac \"g xa\")\n apply simp\n apply simp\n done\n\nlemma restrict_map_eqI:\n assumes req: \"A |` S = B |` S\"\n and mem: \"x \\ S\"\n shows \"A x = B x\"\nproof -\n from mem have \"A x = (A |` S) x\" by simp\n also have \"\\ = (B |` S) x\" using req by simp\n also have \"\\ = B x\" using mem by simp\n finally show ?thesis .\nqed\n\nlemma word_or_zero:\n \"(a || b = 0) = (a = 0 \\ b = 0)\"\n apply (safe, simp_all)\n apply (rule word_eqI, drule_tac x=n in word_eqD, simp)+\n done\n\nlemma aligned_shiftr_mask_shiftl:\n \"is_aligned x n \\ ((x >> n) && mask v) << n = x && mask (v + n)\"\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftl nth_shiftr)\n apply (subgoal_tac \"\\m. x !! m \\ m \\ n\")\n apply auto[1]\n apply (clarsimp simp: is_aligned_mask)\n apply (drule_tac x=m in word_eqD)\n apply (frule test_bit_size)\n apply (simp add: word_size)\n done\n\nlemma word_and_1_shiftl:\n fixes x :: \"('a :: len) word\" shows\n \"x && (1 << n) = (if x !! n then (1 << n) else 0)\"\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftl word_nth_1 split: split_if\n del: shiftl_t2n shiftl_1)\n apply auto\n done\n\nlemmas word_and_1_shiftls\n = word_and_1_shiftl[where n=0, simplified]\n word_and_1_shiftl[where n=1, simplified]\n word_and_1_shiftl[where n=2, simplified]\n\nlemma word_and_mask_shiftl:\n \"x && (mask n << m) = ((x >> m) && mask n) << m\"\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftl nth_shiftr)\n apply auto\n done\n\nlemma toEnum_eq_to_fromEnum_eq:\n fixes v :: \"'a :: enum\" shows\n \"n \\ fromEnum (maxBound :: 'a) \\ (toEnum n = v) = (n = fromEnum v)\"\n apply (rule iffI)\n apply (drule arg_cong[where f=fromEnum])\n apply simp\n apply (drule arg_cong[where f=\"toEnum :: nat \\ 'a\"])\n apply simp\n done\n\nlemma if_Const_helper:\n \"If P (Con x) (Con y) = Con (If P x y)\"\n by (simp split: split_if)\n\nlemmas if_Some_helper = if_Const_helper[where Con=Some]\n\nlemma expand_restrict_map_eq:\n \"(m |` S = m' |` S) = (\\x. x \\ S \\ m x = m' x)\"\n by (simp add: fun_eq_iff restrict_map_def split: split_if)\n\nlemma unat_ucast_8_32:\n fixes x :: \"word8\"\n shows \"unat (ucast x :: word32) = unat x\"\n unfolding ucast_def unat_def\n apply (subst int_word_uint)\n apply (subst mod_pos_pos_trivial)\n apply simp\n apply (rule lt2p_lem)\n apply simp\n apply simp\n done\n\nlemma disj_imp_rhs:\n \"(P \\ Q) \\ (P \\ Q) = Q\"\n by blast\n\nlemma remove1_filter:\n \"distinct xs \\ remove1 x xs = filter (\\y. x \\ y) xs\"\n apply (induct xs)\n apply simp\n apply clarsimp\n apply (rule sym, rule filter_True)\n apply clarsimp\n done\n\nlemma if_then_1_else_0:\n \"((if P then 1 else 0) = (0 :: word32)) = (\\ P)\"\n by simp\n\nlemma if_then_0_else_1:\n \"((if P then 0 else 1) = (0 :: word32)) = (P)\"\n by simp\n\nlemmas if_then_simps = if_then_0_else_1 if_then_1_else_0\n\n\n\nlemma nat_less_cases':\n \"(x::nat) < y \\ x = y - 1 \\ x < y - 1\"\n by (fastforce intro: nat_less_cases)\n\nlemma word32_FF_is_mask:\n \"0xFF = mask 8 \"\n by (simp add: mask_def)\n\nlemma filter_to_shorter_upto:\n \"n \\ m \\ filter (\\x. x < n) [0 ..< m] = [0 ..< n]\"\n apply (induct m)\n apply simp\n apply clarsimp\n apply (erule le_SucE)\n apply simp\n apply simp\n done\n\nlemma in_emptyE: \"\\ A = {}; x \\ A \\ \\ P\" by blast\n\nlemma ucast_of_nat_small:\n \"x < 2 ^ len_of TYPE('a) \\\n ucast (of_nat x :: ('a :: len) word) = (of_nat x :: ('b :: len) word)\"\n apply (rule sym, subst word_unat.inverse_norm)\n apply (simp add: ucast_def word_of_int[symmetric]\n of_nat_nat[symmetric] unat_def[symmetric])\n apply (simp add: unat_of_nat)\n done\n\nlemma word_le_make_less:\n fixes x :: \"('a :: len) word\"\n shows \"y \\ -1 \\ (x \\ y) = (x < (y + 1))\"\n apply safe\n apply (erule plus_one_helper2)\n apply (simp add: eq_diff_eq[symmetric])\n done\n\nlemma Ball_emptyI:\n \"S = {} \\ (\\x \\ S. P x)\"\n by simp\n\nlemma allfEI:\n \"\\ \\x. P x; \\x. P (f x) \\ Q x \\ \\ \\x. Q x\"\n by fastforce\n\nlemma arith_is_1:\n \"\\ x \\ Suc 0; x > 0 \\ \\ x = 1\"\n by arith\n\n(* sjw: combining lemmas here :( *)\nlemma cart_singleton_empty2:\n \"({x} \\ S = {}) = (S = {})\"\n \"({} = S \\ {e}) = (S = {})\"\n by auto\n\nlemma cases_simp_conj:\n \"((P \\ Q) \\ (\\ P \\ Q) \\ R) = (Q \\ R)\"\n by fastforce\n\nlemma domE :\n \"\\ x \\ dom m; \\r. \\m x = Some r\\ \\ P \\ \\ P\"\n by clarsimp\n\nlemma dom_eqD:\n \"\\ f x = Some v; dom f = S \\ \\ x \\ S\"\n by clarsimp\n\nlemma exception_set_finite:\n \"finite {x. P x} \\ finite {x. (x = y \\ Q x) \\ P x}\"\n \"finite {x. P x} \\ finite {x. x \\ y \\ P x}\"\n apply (simp add: Collect_conj_eq)\n apply (subst imp_conv_disj, subst Collect_disj_eq)\n apply simp\n done\n\nlemma exfEI:\n \"\\ \\x. P x; \\x. P x \\ Q (f x) \\ \\ \\x. Q x\"\n by fastforce\n\nlemma finite_word: \"finite (S :: (('a :: len) word) set)\"\n by (rule finite)\n\nlemma if_f:\n \"(if a then f b else f c) = f (if a then b else c)\"\n by simp\n\nlemma in_16_range:\n \"0 \\ S \\ r \\ (\\x. r + x * (16 :: word32)) ` S\"\n \"n - 1 \\ S \\ (r + (16 * n - 16)) \\ (\\x :: word32. r + x * 16) ` S\"\n by (clarsimp simp: image_def\n elim!: bexI[rotated])+\n\ndefinition\n \"modify_map m p f \\ m (p := option_map f (m p))\"\n\nlemma modify_map_id:\n \"modify_map m p id = m\"\n by (auto simp add: modify_map_def map_option_case split: option.splits)\n\nlemma modify_map_addr_com:\n assumes com: \"x \\ y\"\n shows \"modify_map (modify_map m x g) y f = modify_map (modify_map m y f) x g\"\n by (rule ext)\n (simp add: modify_map_def option_map_def com split: option.splits)\n\nlemma modify_map_dom :\n \"dom (modify_map m p f) = dom m\"\n unfolding modify_map_def\n apply (cases \"m p\")\n apply simp\n apply (simp add: dom_def)\n apply simp\n apply (rule insert_absorb)\n apply (simp add: dom_def)\n done\n\nlemma modify_map_None:\n \"m x = None \\ modify_map m x f = m\"\n by (rule ext) (simp add: modify_map_def)\n\nlemma modify_map_ndom :\n \"x \\ dom m \\ modify_map m x f = m\"\n by (rule modify_map_None) clarsimp\n\nlemma modify_map_app:\n \"(modify_map m p f) q = (if p = q then option_map f (m p) else m q)\"\n unfolding modify_map_def by simp\n\nlemma modify_map_apply:\n \"m p = Some x \\ modify_map m p f = m (p \\ f x)\"\n by (simp add: modify_map_def)\n\nlemma modify_map_com:\n assumes com: \"\\x. f (g x) = g (f x)\"\n shows \"modify_map (modify_map m x g) y f = modify_map (modify_map m y f) x g\"\n using assms by (auto simp: modify_map_def map_option_case split: option.splits)\n\nlemma modify_map_comp:\n \"modify_map m x (f o g) = modify_map (modify_map m x g) x f\"\n by (rule ext) (simp add: modify_map_def option.map_comp)\n\nlemma modify_map_exists_eq:\n \"(\\cte. modify_map m p' f p= Some cte) = (\\cte. m p = Some cte)\"\n by (auto simp: modify_map_def split: if_splits)\n\nlemma modify_map_other:\n \"p \\ q \\ (modify_map m p f) q = (m q)\"\n by (simp add: modify_map_app)\n\nlemma modify_map_same:\n \"(modify_map m p f) p = (option_map f (m p))\"\n by (simp add: modify_map_app)\n\nlemma next_update_is_modify:\n \"\\ m p = Some cte'; cte = f cte' \\ \\ (m(p \\ cte)) = (modify_map m p f)\"\n unfolding modify_map_def by simp\n\nlemma nat_power_minus_less:\n \"a < 2 ^ (x - n) \\ (a :: nat) < 2 ^ x\"\n apply (erule order_less_le_trans)\n apply simp\n done\n\nlemma neg_rtranclI:\n \"\\ x \\ y; (x, y) \\ R\\<^sup>+ \\ \\ (x, y) \\ R\\<^sup>*\"\n apply (erule contrapos_nn)\n apply (drule rtranclD)\n apply simp\n done\n\nlemma neg_rtrancl_into_trancl:\n \"\\ (x, y) \\ R\\<^sup>* \\ \\ (x, y) \\ R\\<^sup>+\"\n by (erule contrapos_nn, erule trancl_into_rtrancl)\n\nlemma set_neqI:\n \"\\ x \\ S; x \\ S' \\ \\ S \\ S'\"\n by clarsimp\n\nlemma set_pair_UN:\n \"{x. P x} = UNION {xa. \\xb. P (xa, xb)} (\\xa. {xa} \\ {xb. P (xa, xb)})\"\n apply safe\n apply (rule_tac a=a in UN_I)\n apply blast+\n done\n\nlemma singleton_elemD:\n \"S = {x} \\ x \\ S\"\n by simp\n\nlemma word_to_1_set:\n \"{0 ..< (1 :: ('a :: len) word)} = {0}\"\n by fastforce\n\nlemma ball_ran_eq:\n \"(\\y \\ ran m. P y) = (\\x y. m x = Some y \\ P y)\"\n by (auto simp add: ran_def)\n\nlemma cart_helper:\n \"({} = {x} \\ S) = (S = {})\"\n by blast\n\nlemmas converse_trancl_induct' = converse_trancl_induct [consumes 1, case_names base step]\n\nlemma disjCI2: \"(\\ P \\ Q) \\ P \\ Q\" by blast\n\nlemma insert_UNIV :\n \"insert x UNIV = UNIV\"\n by blast\n\nlemma not_singletonE:\n \"\\ \\p. S \\ {p}; S \\ {}; \\p p'. \\ p \\ p'; p \\ S; p' \\ S \\ \\ R \\ \\ R\"\n by blast\n\nlemma not_singleton_oneE:\n \"\\ \\p. S \\ {p}; p \\ S; \\p'. \\ p \\ p'; p' \\ S \\ \\ R \\ \\ R\"\n apply (erule not_singletonE)\n apply clarsimp\n apply (case_tac \"p = p'\")\n apply fastforce\n apply fastforce\n done\n\nlemma interval_empty:\n \"({m..n} = {}) = (\\ m \\ (n::'a::order))\"\n apply (rule iffI)\n apply clarsimp\n apply auto\n done\n\nlemma range_subset_eq2:\n \"{a :: word32 .. b} \\ {} \\ ({a .. b} \\ {c .. d}) = (c \\ a \\ b \\ d)\"\n by (simp add: interval_empty)\n\nlemma singleton_eqD: \"A = {x} \\ x \\ A\" by blast\n\nlemma ball_ran_fun_updI:\n \"\\ \\v \\ ran m. P v; \\v. y = Some v \\ P v \\\n \\ \\v \\ ran (m (x := y)). P v\"\n by (auto simp add: ran_def)\n\nlemma ball_ran_modify_map_eq:\n \"\\ \\v. m x = Some v \\ P (f v) = P v \\\n \\ (\\v \\ ran (modify_map m x f). P v) = (\\v \\ ran m. P v)\"\n apply (simp add: ball_ran_eq)\n apply (rule iff_allI)\n apply (auto simp: modify_map_def)\n done\n\nlemma disj_imp: \"(P \\ Q) = (\\P \\ Q)\" by blast\n\nlemma eq_singleton_redux:\n \"\\ S = {x} \\ \\ x \\ S\"\n by simp\n\nlemma if_eq_elem_helperE:\n \"\\ x \\ (if P then S else S');\n \\ P; x \\ S \\ \\ a = b;\n \\ \\ P; x \\ S' \\ \\ a = c\n \\ \\ a = (if P then b else c)\"\n by fastforce\n\nlemma if_option_Some :\n \"((if P then None else Some x) = Some y) = (\\P \\ x = y)\"\n by simp\n\nlemma insert_minus_eq:\n \"x \\ A \\ A - S = (A - (S - {x}))\"\n by auto\n\nlemma map2_Cons_2_3:\n \"(map2 f xs (y # ys) = (z # zs)) = (\\x xs'. xs = x # xs' \\ f x y = z \\ map2 f xs' ys = zs)\"\n by (case_tac xs, simp_all)\n\nlemma map2_xor_replicate_False:\n \"map2 (\\(x\\bool) y\\bool. x = (\\ y)) xs (replicate n False) = take n xs\"\n apply (induct xs arbitrary: n)\n apply simp\n apply (case_tac n)\n apply (simp add: map2_def)\n apply simp\n done\n\nlemma modify_map_K_D:\n \"modify_map m p (\\x. y) p' = Some v \\ (m (p \\ y)) p' = Some v\"\n by (simp add: modify_map_def split: split_if_asm)\n\nlemmas tranclE2' = tranclE2 [consumes 1, case_names base trancl]\n\nlemma weak_imp_cong:\n \"\\ P = R; Q = S \\ \\ (P \\ Q) = (R \\ S)\"\n by simp\n\nlemma Collect_Diff_restrict_simp:\n \"T - {x \\ T. Q x} = T - {x. Q x}\"\n by (auto intro: Collect_cong)\n\nlemma Collect_Int_pred_eq:\n \"{x \\ S. P x} \\ {x \\ T. P x} = {x \\ (S \\ T). P x}\"\n by (simp add: Collect_conj_eq [symmetric] conj_ac)\n\nlemma Collect_restrict_predR:\n \"{x. P x} \\ T = {} \\ {x. P x} \\ {x \\ T. Q x} = {}\"\n apply (subst Collect_conj_eq [symmetric])\n apply (simp add: disjoint_iff_not_equal)\n apply rule\n apply (drule_tac x = x in spec)\n apply clarsimp\n apply (drule (1) bspec)\n apply simp\n done\n\nlemma Diff_Un2:\n assumes emptyad: \"A \\ D = {}\"\n and emptybc: \"B \\ C = {}\"\n shows \"(A \\ B) - (C \\ D) = (A - C) \\ (B - D)\"\nproof -\n have \"(A \\ B) - (C \\ D) = (A \\ B - C) \\ (A \\ B - D)\"\n by (rule Diff_Un)\n also have \"\\ = ((A - C) \\ B) \\ (A \\ (B - D))\" using emptyad emptybc\n by (simp add: Un_Diff Diff_triv)\n also have \"\\ = (A - C) \\ (B - D)\"\n proof -\n have \"(A - C) \\ (A \\ (B - D)) = A - C\" using emptyad emptybc\n by (metis Diff_Int2 Diff_Int_distrib2 inf_sup_absorb)\n moreover\n have \"B \\ (A \\ (B - D)) = B - D\" using emptyad emptybc\n by (metis Int_Diff Un_Diff Un_Diff_Int Un_commute Un_empty_left inf_sup_absorb)\n ultimately show ?thesis\n by (simp add: Int_Un_distrib2)\n qed\n finally show ?thesis .\nqed\n\nlemma ballEI:\n \"\\ \\x \\ S. Q x; \\x. \\ x \\ S; Q x \\ \\ P x \\ \\ \\x \\ S. P x\"\n by auto\n\nlemma dom_if_None:\n \"dom (\\x. if P x then None else f x)\n = dom f - {x. P x}\"\n by (simp add: dom_def, fastforce)\n\nlemma notemptyI:\n \"x \\ S \\ S \\ {}\"\n by clarsimp\n\nlemma plus_Collect_helper:\n \"op + x ` {xa. P (xa :: ('a :: len) word)} = {xa. P (xa - x)}\"\n by (fastforce simp add: image_def)\n\nlemma plus_Collect_helper2:\n \"op + (- x) ` {xa. P (xa :: ('a :: len) word)} = {xa. P (x + xa)}\"\n by (simp add: field_simps plus_Collect_helper)\n\nlemma restrict_map_Some_iff:\n \"((m |` S) x = Some y) = (m x = Some y \\ x \\ S)\"\n by (cases \"x \\ S\", simp_all)\n\nlemma context_case_bools:\n \"\\ \\v. P v \\ R v; \\ \\ P v; \\v. P v \\ R v \\ \\ R v \\ \\ R v\"\n by (cases \"P v\", simp_all)\n\nlemma inj_on_fun_upd_strongerI:\n \"\\inj_on f A; y \\ f ` (A - {x})\\ \\ inj_on (f(x := y)) A\"\n apply (simp add: inj_on_def)\n apply blast\n done\n\nlemma less_handy_casesE:\n \"\\ m < n; m = 0 \\ R;\n \\m' n'. \\ n = Suc n'; m = Suc m'; m < n \\ \\ R \\\n \\ R\"\n apply (case_tac n, simp_all)\n apply (case_tac m, simp_all)\n done\n\nlemma subset_drop_Diff_strg:\n \"(A \\ C) \\ (A - B \\ C)\"\n by blast\n\nlemma word32_count_from_top:\n \"n \\ 0 \\ {0 ..< n :: word32} = {0 ..< n - 1} \\ {n - 1}\"\n apply (rule set_eqI, rule iffI)\n apply simp\n apply (drule minus_one_helper3)\n apply (rule disjCI)\n apply simp\n apply simp\n apply (erule minus_one_helper5)\n apply fastforce\n done\n\nlemma Int_Union_empty:\n \"(\\x. x \\ S \\ A \\ P x = {}) \\ A \\ (\\x \\ S. P x) = {}\"\n by auto\n\nlemma UN_Int_empty:\n \"(\\x. x \\ S \\ P x \\ T = {}) \\ (\\x \\ S. P x) \\ T = {}\"\n by auto\n\nlemma disjointI:\n \"\\\\x y. \\ x \\ A; y \\ B \\ \\ x \\ y \\ \\ A \\ B = {}\"\n by auto\n\nlemma UN_disjointI:\n assumes rl: \"\\x y. \\ x \\ A; y \\ B \\ \\ P x \\ Q y = {}\"\n shows \"(\\x \\ A. P x) \\ (\\x \\ B. Q x) = {}\"\n apply (rule disjointI)\n apply clarsimp\n apply (drule (1) rl)\n apply auto\n done\n\nlemma UN_set_member:\n assumes sub: \"A \\ (\\x \\ S. P x)\"\n and nz: \"A \\ {}\"\n shows \"\\x \\ S. P x \\ A \\ {}\"\nproof -\n from nz obtain z where zA: \"z \\ A\" by fastforce\n with sub obtain x where \"x \\ S\" and \"z \\ P x\" by auto\n hence \"P x \\ A \\ {}\" using zA by auto\n thus ?thesis using sub nz by auto\nqed\n\nlemma append_Cons_cases [consumes 1, case_names pre mid post]:\n \"\\(x, y) \\ set (as @ b # bs);\n (x, y) \\ set as \\ R;\n \\(x, y) \\ set as; (x, y) \\ set bs; (x, y) = b\\ \\ R;\n (x, y) \\ set bs \\ R\\\n \\ R\" by auto\n\nlemma cart_singletons:\n \"{a} \\ {b} = {(a, b)}\"\n by blast\n\nlemma disjoint_subset_neg1:\n \"\\ B \\ C = {}; A \\ B; A \\ {} \\ \\ \\ A \\ C\"\n by auto\n\nlemma disjoint_subset_neg2:\n \"\\ B \\ C = {}; A \\ C; A \\ {} \\ \\ \\ A \\ B\"\n by auto\n\nlemma iffE2:\n \"\\ P = Q; \\ P; Q \\ \\ R; \\ \\ P; \\ Q \\ \\ R \\ \\ R\"\n by blast\n\nlemma minus_one_helper2:\n \"\\ x - 1 < y \\ \\ x \\ (y :: ('a :: len) word)\"\n apply (cases \"x = 0\")\n apply simp\n apply (simp add: word_less_nat_alt word_le_nat_alt)\n apply (subst(asm) unat_minus_one)\n apply (simp add: word_less_nat_alt)\n apply (cases \"unat x\")\n apply (simp add: unat_eq_zero)\n apply arith\n done\n\nlemma mod_mod_power:\n fixes k :: nat\n shows \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ (min m n)\"\nproof (cases \"m \\ n\")\n case True\n\n hence \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ m\"\n apply -\n apply (subst mod_less [where n = \"2 ^ n\"])\n apply (rule order_less_le_trans [OF mod_less_divisor])\n apply simp+\n done\n also have \"\\ = k mod 2 ^ (min m n)\" using True by simp\n finally show ?thesis .\nnext\n case False\n hence \"n < m\" by simp\n then obtain d where md: \"m = n + d\"\n by (auto dest: less_imp_add_positive)\n hence \"k mod 2 ^ m = 2 ^ n * (k div 2 ^ n mod 2 ^ d) + k mod 2 ^ n\"\n by (simp add: mod_mult2_eq power_add)\n hence \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ n\"\n by (simp add: mod_add_left_eq)\n thus ?thesis using False\n by simp\nqed\nlemma word_div_less:\n fixes m :: \"'a :: len word\"\n shows \"m < n \\ m div n = 0\"\n apply (rule word_unat.Rep_eqD)\n apply (simp add: word_less_nat_alt unat_div)\n done\n\nlemma word_must_wrap:\n \"\\ x \\ n - 1; n \\ x \\ \\ n = (0 :: ('a :: len) word)\"\n apply (rule ccontr)\n apply (drule(1) order_trans)\n apply (drule word_sub_1_le)\n apply (drule(1) order_antisym)\n apply simp\n done\n\nlemma upt_add_eq_append':\n assumes a1: \"i \\ j\" and a2: \"j \\ k\"\n shows \"[i.. {a :: ('a :: len) word .. b} \\ {c .. d}; b \\ a \\\n \\ d \\ c \\ d - c \\ b - a\"\n apply (subgoal_tac \"a \\ {a .. b}\")\n apply (frule(1) range_subset_lower)\n apply (frule(1) range_subset_upper)\n apply (rule context_conjI, simp)\n apply (rule word_sub_mono, assumption+)\n apply (erule word_sub_le)\n apply (erule word_sub_le)\n apply simp\n done\n\nlemma less_1_simp:\n \"n - 1 < m = (n \\ (m :: ('a :: len) word) \\ n \\ 0)\"\n by unat_arith\n\nlemma alignUp_div_helper:\n fixes a :: \"'a::len word\"\n assumes kv: \"k < 2 ^ (len_of TYPE('a) - n)\"\n and xk: \"x = 2 ^ n * of_nat k\"\n and le: \"a \\ x\"\n and sz: \"n < len_of TYPE('a)\"\n and anz: \"a mod 2 ^ n \\ 0\"\n shows \"a div 2 ^ n < of_nat k\"\nproof -\n have kn: \"unat (of_nat k :: 'a word) * unat ((2::'a word) ^ n)\n < 2 ^ len_of TYPE('a)\"\n using xk kv sz\n apply (subst unat_of_nat_eq)\n apply (erule order_less_le_trans)\n apply simp\n apply (subst unat_power_lower, simp add: word_bits_def)\n apply (subst mult.commute)\n apply (rule nat_less_power_trans)\n apply simp\n apply simp\n done\n\n have \"unat a div 2 ^ n * 2 ^ n \\ unat a\"\n proof -\n have \"unat a = unat a div 2 ^ n * 2 ^ n + unat a mod 2 ^ n\"\n by (simp add: mod_div_equality)\n also have \"\\ \\ unat a div 2 ^ n * 2 ^ n\" using sz anz\n by (simp add: unat_arith_simps word_bits_def)\n finally show ?thesis ..\n qed\n\n hence \"a div 2 ^ n * 2 ^ n < a\" using sz anz\n apply (subst word_less_nat_alt)\n apply (subst unat_word_ariths)\n apply (subst unat_div)\n apply simp\n apply (rule order_le_less_trans [OF mod_le_dividend])\n apply (erule order_le_neq_trans [OF div_mult_le])\n done\n\n also from xk le have \"\\ \\ of_nat k * 2 ^ n\" by (simp add: field_simps)\n finally show ?thesis using sz kv\n apply -\n apply (erule word_mult_less_dest [OF _ _ kn])\n apply (simp add: unat_div)\n apply (rule order_le_less_trans [OF div_mult_le])\n apply (rule unat_lt2p)\n done\nqed\n\nlemma nat_mod_power_lem:\n fixes a :: nat\n shows \"1 < a \\ a ^ n mod a ^ m = (if m \\ n then 0 else a ^ n)\"\n by (clarsimp, clarsimp simp add: le_iff_add power_add)\n\nlemma power_mod_div:\n fixes x :: \"nat\"\n shows \"x mod 2 ^ n div 2 ^ m = x div 2 ^ m mod 2 ^ (n - m)\" (is \"?LHS = ?RHS\")\nproof (cases \"n \\ m\")\n case True\n hence \"?LHS = 0\"\n apply -\n apply (rule div_less)\n apply (rule order_less_le_trans [OF mod_less_divisor])\n apply simp\n apply simp\n done\n also have \"\\ = ?RHS\" using True\n by simp\n finally show ?thesis .\nnext\n case False\n hence lt: \"m < n\" by simp\n then obtain q where nv: \"n = m + q\" and \"0 < q\"\n by (auto dest: less_imp_Suc_add)\n\n hence \"x mod 2 ^ n = 2 ^ m * (x div 2 ^ m mod 2 ^ q) + x mod 2 ^ m\"\n by (simp add: power_add mod_mult2_eq)\n\n hence \"?LHS = x div 2 ^ m mod 2 ^ q\"\n by (simp add: div_add1_eq)\n\n also have \"\\ = ?RHS\" using nv\n by simp\n\n finally show ?thesis .\nqed\n\nlemma word_power_mod_div:\n fixes x :: \"'a::len word\"\n shows \"\\ n < len_of TYPE('a); m < len_of TYPE('a)\\\n \\ x mod 2 ^ n div 2 ^ m = x div 2 ^ m mod 2 ^ (n - m)\"\n apply (simp add: word_arith_nat_div unat_mod power_mod_div)\n apply (subst unat_arith_simps(3))\n apply (subst unat_mod)\n apply (subst unat_of_nat)+\n apply (simp add: mod_mod_power min.commute)\n done\n\n(* FIXME: stronger version of GenericLib.p_assoc_help *)\nlemma x_power_minus_1:\n fixes x :: \"'a :: {ab_group_add, power, numeral, one}\"\n shows \"x + (2::'a) ^ n - (1::'a) = x + (2 ^ n - 1)\" by simp\n\nlemma nat_le_power_trans:\n fixes n :: nat\n shows \"\\n \\ 2 ^ (m - k); k \\ m\\ \\ 2 ^ k * n \\ 2 ^ m\"\n apply (drule order_le_imp_less_or_eq)\n apply (erule disjE)\n apply (drule (1) nat_less_power_trans)\n apply (erule order_less_imp_le)\n apply (simp add: power_add [symmetric])\n done\n\nlemma nat_diff_add:\n fixes i :: nat\n shows \"\\ i + j = k \\ \\ i = k - j\"\n by arith\n\nlemma word_range_minus_1':\n fixes a :: \"'a :: len word\"\n shows \"a \\ 0 \\ {a - 1<..b} = {a..b}\"\n by (simp add: greaterThanAtMost_def atLeastAtMost_def greaterThan_def atLeast_def less_1_simp)\n\nlemma word_range_minus_1:\n fixes a :: word32\n shows \"b \\ 0 \\ {a..b - 1} = {a..x. {a..} \\ x\"])\n apply rule\n apply clarsimp\n apply (erule contrapos_pp)\n apply (simp add: linorder_not_less linorder_not_le word_must_wrap)\n apply (clarsimp)\n apply (drule minus_one_helper3)\n apply (auto simp: word_less_sub_1)\n done\n\nlemma ucast_nat_def:\n \"of_nat (unat x) = (ucast :: ('a :: len) word \\ ('b :: len) word) x\"\n by (simp add: ucast_def word_of_int_nat unat_def)\n\nlemma delete_remove1 :\n \"delete x xs = remove1 x xs\"\n by (induct xs, auto)\n\nlemma list_case_If:\n \"(case xs of [] \\ P | _ \\ Q)\n = (if xs = [] then P else Q)\"\n by (clarsimp simp: neq_Nil_conv)\n\nlemma remove1_Nil_in_set:\n \"\\ remove1 x xs = []; xs \\ [] \\ \\ x \\ set xs\"\n by (induct xs) (auto split: split_if_asm)\n\nlemma remove1_empty:\n \"(remove1 v xs = []) = (xs = [v] \\ xs = [])\"\n by (cases xs, simp_all)\n\nlemma set_remove1:\n \"x \\ set (remove1 y xs) \\ x \\ set xs\"\n apply (induct xs)\n apply simp\n apply (case_tac \"y = a\")\n apply clarsimp+\n done\n\nlemma If_rearrage:\n \"(if P then if Q then x else y else z)\n = (if P \\ Q then x else if P then y else z)\"\n by simp\n\nlemma cases_simp_left:\n \"((P \\ Q) \\ (\\ P \\ Q) \\ R) = (Q \\ R)\"\n by fastforce\n\nlemma disjI2_strg:\n \"Q \\ (P \\ Q)\"\n by simp\n\nlemma eq_2_32_0:\n \"(2 ^ 32 :: word32) = 0\"\n by simp\n\nlemma eq_imp_strg:\n \"P t \\ (t = s \\ P s)\"\n by clarsimp\n\nlemma if_fun_split:\n \"(if P then \\s. Q s else (\\s. R s)) = (\\s. (P \\ Q s) \\ (\\P \\ R s))\"\n by simp\n\nlemma i_hate_words_helper:\n \"i \\ (j - k :: nat) \\ i \\ j\"\n by simp\n\nlemma i_hate_words:\n \"unat (a :: 'a word) \\ unat (b :: ('a :: len) word) - Suc 0\n \\ a \\ -1\"\n apply (frule i_hate_words_helper)\n apply (subst(asm) word_le_nat_alt[symmetric])\n apply (clarsimp simp only: word_minus_one_le)\n apply (simp only: linorder_not_less[symmetric])\n apply (erule notE)\n apply (rule diff_Suc_less)\n apply (subst neq0_conv[symmetric])\n apply (subst unat_eq_0)\n apply (rule notI, drule arg_cong[where f=\"op + 1\"])\n apply simp\n done\n\nlemma if_both_strengthen:\n \"P \\ Q \\ (if G then P else Q)\"\n by simp\n\nlemma if_both_strengthen2:\n \"P s \\ Q s \\ (if G then P else Q) s\"\n by simp\n\nlemma if_swap:\n \"(if P then Q else R) = (if \\P then R else Q)\" by simp\n\nlemma ignore_if:\n \"(y and z) s \\ (if x then y else z) s\"\n by (clarsimp simp: pred_conj_def)\n\nlemma imp_consequent:\n \"P \\ Q \\ P\" by simp\n\nlemma list_case_helper:\n \"xs \\ [] \\ case_list f g xs = g (hd xs) (tl xs)\"\n by (cases xs, simp_all)\n\nlemma list_cons_rewrite:\n \"(\\x xs. L = x # xs \\ P x xs) = (L \\ [] \\ P (hd L) (tl L))\"\n by (auto simp: neq_Nil_conv)\n\nlemma list_not_Nil_manip:\n \"\\ xs = y # ys; case xs of [] \\ False | (y # ys) \\ P y ys \\ \\ P y ys\"\n by simp\n\nlemma ran_ball_triv:\n \"\\P m S. \\ \\x \\ (ran S). P x ; m \\ (ran S) \\ \\ P m\"\n by blast\n\nlemma singleton_tuple_cartesian:\n \"({(a, b)} = S \\ T) = ({a} = S \\ {b} = T)\"\n \"(S \\ T = {(a, b)}) = ({a} = S \\ {b} = T)\"\n by blast+\n\nlemma strengthen_ignore_if:\n \"A s \\ B s \\ (if P then A else B) s\"\n by clarsimp\n\nlemma sum_case_True :\n \"(case r of Inl a \\ True | Inr b \\ f b)\n = (\\b. r = Inr b \\ f b)\"\n by (cases r) auto\n\nlemma sym_ex_elim:\n \"F x = y \\ \\x. y = F x\"\n by auto\n\nlemma tl_drop_1 :\n \"tl xs = drop 1 xs\"\n by (simp add: drop_Suc)\n\nlemma upt_lhs_sub_map:\n \"[x ..< y] = map (op + x) [0 ..< y - x]\"\n apply (induct y)\n apply simp\n apply (clarsimp simp: Suc_diff_le)\n done\n\nlemma upto_0_to_4:\n \"[0..<4] = 0 # [1..<4]\"\n apply (subst upt_rec)\n apply simp\n done\n\nlemma disjEI:\n \"\\ P \\ Q; P \\ R; Q \\ S \\\n \\ R \\ S\"\n by fastforce\n\nlemma dom_fun_upd2:\n \"s x = Some z \\ dom (s (x \\ y)) = dom s\"\n by (simp add: insert_absorb domI)\n\nlemma foldl_True :\n \"foldl op \\ True bs\"\n by (induct bs) auto\n\nlemma image_set_comp:\n \"f ` {g x | x. Q x} = (f \\ g) ` {x. Q x}\"\n by fastforce\n\nlemma mutual_exE:\n \"\\ \\x. P x; \\x. P x \\ Q x \\ \\ \\x. Q x\"\n apply clarsimp\n apply blast\n done\n\nlemma nat_diff_eq:\n fixes x :: nat\n shows \"\\ x - y = x - z; y < x\\ \\ y = z\"\n by arith\n\nlemma overflow_plus_one_self:\n \"(1 + p \\ p) = (p = (-1 :: word32))\"\n apply (safe, simp_all)\n apply (rule ccontr)\n apply (drule plus_one_helper2)\n apply (rule notI)\n apply (drule arg_cong[where f=\"\\x. x - 1\"])\n apply simp\n apply (simp add: field_simps)\n done\n\nlemma plus_1_less:\n \"(x + 1 \\ (x :: ('a :: len) word)) = (x = -1)\"\n apply (rule iffI)\n apply (rule ccontr)\n apply (cut_tac plus_one_helper2[where x=x, OF order_refl])\n apply simp\n apply clarsimp\n apply (drule arg_cong[where f=\"\\x. x - 1\"])\n apply simp\n apply simp\n done\n\nlemma pos_mult_pos_ge:\n \"[|x > (0::int); n>=0 |] ==> n * x >= n*1\"\n apply (simp only: mult_left_mono)\n done\n\nlemma If_eq_obvious:\n \"x \\ z \\ ((if P then x else y) = z) = (\\ P \\ y = z)\"\n by simp\n\nlemma Some_to_the:\n \"v = Some x \\ x = the v\"\n by simp\n\nlemma dom_if_Some:\n \"dom (\\x. if P x then Some (f x) else g x) = {x. P x} \\ dom g\"\n by fastforce\n\nlemma dom_insert_absorb:\n \"x \\ dom f \\ insert x (dom f) = dom f\" by auto\n\nlemma emptyE2:\n \"\\ S = {}; x \\ S \\ \\ P\"\n by simp\n\nlemma mod_div_equality_div_eq:\n \"a div b * b = (a - (a mod b) :: int)\"\n by (simp add: field_simps)\n\nlemma zmod_helper:\n \"n mod m = k \\ ((n :: int) + a) mod m = (k + a) mod m\"\n by (clarsimp simp: pull_mods)\n\nlemma int_div_sub_1:\n \"\\ m \\ 1 \\ \\ (n - (1 :: int)) div m = (if m dvd n then (n div m) - 1 else n div m)\"\n apply (subgoal_tac \"m = 0 \\ (n - (1 :: int)) div m = (if m dvd n then (n div m) - 1 else n div m)\")\n apply fastforce\n apply (subst mult_cancel_right[symmetric])\n apply (simp only: left_diff_distrib split: split_if)\n apply (simp only: mod_div_equality_div_eq)\n apply (clarsimp simp: field_simps dvd_mult_div_cancel)\n apply (clarsimp simp: dvd_eq_mod_eq_0)\n apply (cases \"m = 1\")\n apply simp\n apply (subst mod_diff_eq, simp add: zmod_minus1 mod_pos_pos_trivial)\n apply clarsimp\n apply (subst diff_add_cancel[where b=1, symmetric])\n apply (subst push_mods(1))\n apply (simp add: field_simps mod_pos_pos_trivial)\n apply (rule mod_pos_pos_trivial)\n apply (subst add_0_right[where a=0, symmetric])\n apply (rule add_mono)\n apply simp\n apply simp\n apply (cases \"(n - 1) mod m = m - 1\")\n apply (drule zmod_helper[where a=1])\n apply simp\n apply (subgoal_tac \"1 + (n - 1) mod m \\ m\")\n apply simp\n apply (subst field_simps, rule zless_imp_add1_zle)\n apply simp\n done\n\nlemmas nat_less_power_trans_16 =\n subst [OF mult.commute, where P=\"\\x. x < v\" for v,\n OF nat_less_power_trans[where k=4, simplified]]\n\nlemmas nat_less_power_trans_256 =\n subst [OF mult.commute, where P=\"\\x. x < v\" for v,\n OF nat_less_power_trans[where k=8, simplified]]\nlemmas nat_less_power_trans_4096 =\n subst [OF mult.commute, where P=\"\\x. x < v\" for v,\n OF nat_less_power_trans[where k=12, simplified]]\n\nlemma ptr_add_image_multI:\n \"\\ \\x y. (x * val = y * val') = (x * val'' = y); x * val'' \\ S \\ \\\n ptr_add ptr (x * val) \\ (\\p. ptr_add ptr (p * val')) ` S\"\n apply (simp add: image_def)\n apply (erule rev_bexI)\n apply (rule arg_cong[where f=\"ptr_add ptr\"])\n apply simp\n done\n\nlemma shift_times_fold:\n \"(x :: word32) * (2 ^ n) << m = x << (m + n)\"\n by (simp add: shiftl_t2n ac_simps power_add)\n\nlemma word_plus_strict_mono_right:\n fixes x :: \"'a :: len word\"\n shows \"\\y < z; x \\ x + z\\ \\ x + y < x + z\"\n by unat_arith\n\nlemma comp_upd_simp:\n \"(f \\ (g (x := y))) = ((f \\ g) (x := f y))\"\n by (rule ext, simp add: o_def)\n\nlemma dom_option_map:\n \"dom (option_map f o m) = dom m\"\n by (simp add: dom_def)\n\nlemma drop_imp:\n \"P \\ (A \\ P) \\ (B \\ P)\" by blast\n\nlemma inj_on_fun_updI2:\n \"\\ inj_on f A; y \\ f ` (A - {x}) \\\n \\ inj_on (f(x := y)) A\"\n apply (rule inj_onI)\n apply (simp split: split_if_asm)\n apply (erule notE, rule image_eqI, erule sym)\n apply simp\n apply (erule(3) inj_onD)\n done\n\nlemma inj_on_fun_upd_elsewhere:\n \"x \\ S \\ inj_on (f (x := y)) S = inj_on f S\"\n apply (simp add: inj_on_def)\n apply blast\n done\n\nlemma not_Some_eq_tuple:\n \"(\\y z. x \\ Some (y, z)) = (x = None)\"\n by (cases x, simp_all)\n\nlemma ran_option_map:\n \"ran (option_map f o m) = f ` ran m\"\n by (auto simp add: ran_def)\n\nlemma All_less_Ball:\n \"(\\x < n. P x) = (\\x\\{..< n}. P x)\"\n by fastforce\n\nlemma Int_image_empty:\n \"\\ \\x y. f x \\ g y \\\n \\ f ` S \\ g ` T = {}\"\n by auto\n\nlemma Max_prop:\n \"\\ Max S \\ S \\ P (Max S); (S :: ('a :: {finite, linorder}) set) \\ {} \\ \\ P (Max S)\"\n apply (erule meta_mp)\n apply (rule Max_in)\n apply simp\n apply assumption\n done\n\nlemma Min_prop:\n \"\\ Min S \\ S \\ P (Min S); (S :: ('a :: {finite, linorder}) set) \\ {} \\ \\ P (Min S)\"\n apply (erule meta_mp)\n apply (rule Min_in)\n apply simp\n apply assumption\n done\n\ndefinition\n is_inv :: \"('a \\ 'b) \\ ('b \\ 'a) \\ bool\" where\n \"is_inv f g \\ ran f = dom g \\ (\\x y. f x = Some y \\ g y = Some x)\"\n\nlemma is_inv_NoneD:\n assumes \"g x = None\"\n assumes \"is_inv f g\"\n shows \"x \\ ran f\"\nproof -\n from assms\n have \"x \\ dom g\" by (auto simp: ran_def)\n moreover\n from assms\n have \"ran f = dom g\"\n by (simp add: is_inv_def)\n ultimately\n show ?thesis by simp\nqed\n\nlemma is_inv_SomeD:\n \"\\ f x = Some y; is_inv f g \\ \\ g y = Some x\"\n by (simp add: is_inv_def)\n\nlemma is_inv_com:\n \"is_inv f g \\ is_inv g f\"\n apply (unfold is_inv_def)\n apply safe\n apply (clarsimp simp: ran_def dom_def set_eq_iff)\n apply (erule_tac x=a in allE)\n apply clarsimp\n apply (clarsimp simp: ran_def dom_def set_eq_iff)\n apply blast\n apply (clarsimp simp: ran_def dom_def set_eq_iff)\n apply (erule_tac x=x in allE)\n apply clarsimp\n done\n\nlemma is_inv_inj:\n \"is_inv f g \\ inj_on f (dom f)\"\n apply (frule is_inv_com)\n apply (clarsimp simp: inj_on_def)\n apply (drule (1) is_inv_SomeD)\n apply (drule_tac f=f in is_inv_SomeD, assumption)\n apply simp\n done\n\nlemma is_inv_None_upd:\n \"\\ is_inv f g; g x = Some y\\ \\ is_inv (f(y := None)) (g(x := None))\"\n apply (subst is_inv_def)\n apply (clarsimp simp add: dom_upd)\n apply (drule is_inv_SomeD, erule is_inv_com)\n apply (frule is_inv_inj)\n apply (simp add: ran_upd')\n apply (rule conjI)\n apply (simp add: is_inv_def)\n apply (drule (1) is_inv_SomeD)\n apply (clarsimp simp: is_inv_def)\n done\n\nlemma is_inv_inj2:\n \"is_inv f g \\ inj_on g (dom g)\"\n apply (drule is_inv_com)\n apply (erule is_inv_inj)\n done\n\nlemma range_convergence1:\n \"\\ \\z. x < z \\ z \\ y \\ P z; \\z > y. P (z :: 'a :: linorder) \\\n \\ \\z > x. P z\"\n apply clarsimp\n apply (case_tac \"z \\ y\")\n apply simp\n apply (simp add: linorder_not_le)\n done\n\nlemma range_convergence2:\n \"\\ \\z. x < z \\ z \\ y \\ P z; \\z. z > y \\ z < w \\ P (z :: 'a :: linorder) \\\n \\ \\z. z > x \\ z < w \\ P z\"\n apply (cut_tac range_convergence1[where P=\"\\z. z < w \\ P z\" and x=x and y=y])\n apply simp\n apply simp\n apply simp\n done\n\nlemma replicate_minus:\n \"k < n \\ replicate n False = replicate (n - k) False @ replicate k False\"\n by (subst replicate_add [symmetric]) simp\n\nlemmas map_pair_split_imageI\n = map_prod_imageI[where f=\"split f\" and g=\"split g\"\n and a=\"(a, b)\" and b=\"(c, d)\" for a b c d f g, simplified]\n\nlemma word_div_mult:\n fixes c :: word32\n shows \"\\0 < c; a < b * c \\ \\ a div c < b\"\n apply (simp add: word_less_nat_alt unat_div)\n apply (subst td_gal_lt [symmetric])\n apply assumption\n apply (erule order_less_le_trans)\n apply (subst unat_word_ariths)\n apply (unfold word_bits_len_of)\n apply (rule mod_le_dividend)\n done\n\nlemma word_less_power_trans_ofnat:\n \"\\n < 2 ^ (m - k); k \\ m; m < len_of TYPE('a)\\\n \\ of_nat n * 2 ^ k < (2::'a::len word) ^ m\"\n apply (subst mult.commute)\n apply (rule word_less_power_trans)\n apply (simp add: word_less_nat_alt)\n apply (subst unat_of_nat_eq)\n apply (erule order_less_trans)\n apply (simp add: unat_power_lower)+\n done\n\nlemma upto_enum_step_red':\n \"\\ c < word_bits; b \\ c; is_aligned a c \\ \\\n [a, a + 2 ^ b .e. a + 2 ^ c - 1] = map (op + a) [0, 2 ^ b .e. 2 ^ c - 1]\"\n unfolding upto_enum_step_def\n by (auto simp: upto_enum_word dest:is_aligned_no_overflow)\n\nlemma div_power_helper:\n \"\\ x \\ y; y < word_bits \\ \\ (2 ^ y - 1) div (2 ^ x :: word32) = 2 ^ (y - x) - 1\"\n apply (rule word_uint.Rep_eqD)\n apply (simp only: uint_word_ariths uint_div uint_power_lower word_bits_len_of)\n apply (subst mod_pos_pos_trivial, fastforce, fastforce)+\n apply (subst mod_pos_pos_trivial)\n apply (simp add: le_diff_eq uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n apply (rule less_1_helper)\n apply (rule power_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (subst mod_pos_pos_trivial)\n apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n apply (rule less_1_helper)\n apply (rule power_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (subst int_div_sub_1)\n apply simp\n apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n apply (subst power_0[symmetric, where a=2])\n apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of]\n le_imp_power_dvd_int power_sub_int)\n done\n\nlemma n_less_word_bits:\n \"(n < word_bits) = (n < 32)\"\n by (simp add: word_bits_def)\n\nlemma of_nat_less_pow:\n \"\\ x < 2 ^ n; n < word_bits \\ \\ of_nat x < (2 :: word32) ^ n\"\n apply (subst word_unat_power)\n apply (rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply assumption\n done\n\nlemma power_helper:\n \"\\ (x :: word32) < 2 ^ (m - n); n \\ m; m < word_bits \\ \\ x * (2 ^ n) < 2 ^ m\"\n apply (drule word_mult_less_mono1[where k=\"2 ^ n\"])\n apply (simp add: word_neq_0_conv[symmetric] word_bits_def)\n apply (simp only: unat_power_lower[where 'a=32, unfolded word_bits_len_of]\n power_add[symmetric])\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (simp add: power_add[symmetric] del: power_add)\n done\n\nlemma word_1_le_power:\n \"n < len_of TYPE('a) \\ (1 :: 'a :: len word) \\ 2 ^ n\"\n by (rule inc_le[where i=0, simplified], erule iffD2[OF p2_gt_0])\n\nlemma enum_word_div:\n fixes v :: \"('a :: len) word\" shows\n \"\\xs ys. enum = xs @ [v] @ ys\n \\ (\\x \\ set xs. x < v)\n \\ (\\y \\ set ys. v < y)\"\n apply (simp only: enum_word_def)\n apply (subst upt_add_eq_append'[where j=\"unat v\"])\n apply simp\n apply (rule order_less_imp_le, simp)\n apply (simp add: upt_conv_Cons)\n apply (intro exI conjI)\n apply fastforce\n apply clarsimp\n apply (drule of_nat_mono_maybe[rotated, where 'a='a])\n apply simp\n apply simp\n apply (clarsimp simp: Suc_le_eq)\n apply (drule of_nat_mono_maybe[rotated, where 'a='a])\n apply simp\n apply simp\n done\n\nlemma less_x_plus_1:\n fixes x :: \"('a :: len) word\" shows\n \"x \\ max_word \\ (y < (x + 1)) = (y < x \\ y = x)\"\n apply (rule iffI)\n apply (rule disjCI)\n apply (drule plus_one_helper)\n apply simp\n apply (subgoal_tac \"x < x + 1\")\n apply (erule disjE, simp_all)\n apply (rule plus_one_helper2 [OF order_refl])\n apply (rule notI, drule max_word_wrap)\n apply simp\n done\n\nlemma of_bool_nth:\n \"of_bool (x !! v) = (x >> v) && 1\"\n apply (rule word_eqI)\n apply (simp add: nth_shiftr cong: rev_conj_cong)\n done\n\nlemma unat_1_0:\n \"1 \\ (x::word32) = (0 < unat x)\"\n by (auto simp add: word_le_nat_alt)\n\nlemma x_less_2_0_1:\n fixes x :: word32 shows\n \"x < 2 \\ x = 0 \\ x = 1\"\n by unat_arith\n\nlemma Collect_int_vars:\n \"{s. P rv s} \\ {s. rv = xf s} = {s. P (xf s) s} \\ {s. rv = xf s}\"\n by auto\n\nlemma if_0_1_eq:\n \"((if P then 1 else 0) = (case Q of True \\ of_nat 1 | False \\ of_nat 0)) = (P = Q)\"\n by (simp add: case_bool_If split: split_if)\n\nlemma modify_map_exists_cte :\n \"(\\cte. modify_map m p f p' = Some cte) = (\\cte. m p' = Some cte)\"\n by (simp add: modify_map_def)\n\nlemmas word_add_le_iff2 = word_add_le_iff [folded no_olen_add_nat]\n\nlemma mask_32_max_word :\n shows \"mask 32 = (max_word :: word32)\"\n unfolding mask_def\n by (simp add: max_word_def)\n\nlemma dom_eqI:\n assumes c1: \"\\x y. P x = Some y \\ \\y. Q x = Some y\"\n and c2: \"\\x y. Q x = Some y \\ \\y. P x = Some y\"\n shows \"dom P = dom Q\"\n unfolding dom_def by (auto simp: c1 c2)\n\nlemma dvd_reduce_multiple:\n fixes k :: nat\n shows \"(k dvd k * m + n) = (k dvd n)\"\n apply (induct m)\n apply simp\n apply simp\n apply (subst add.assoc, subst add.commute)\n apply (subst dvd_reduce)\n apply assumption\n done\n\nlemma image_iff:\n \"inj f \\ f x \\ f ` S = (x \\ S)\"\n apply rule\n apply (erule imageE)\n apply (simp add: inj_eq)\n apply (erule imageI)\n done\n\n\n\nlemma of_nat_n_less_equal_power_2:\n \"n < len_of TYPE('a::len) \\ ((of_nat n)::'a word) < 2 ^ n\"\n apply (induct n)\n apply clarsimp\n apply clarsimp\n apply (metis WordLemmaBucket.of_nat_power\n n_less_equal_power_2 of_nat_Suc power_Suc)\n done\n\nlemma of_nat32_n_less_equal_power_2:\n \"n < 32 \\ ((of_nat n)::32 word) < 2 ^ n\"\n by (rule of_nat_n_less_equal_power_2, clarsimp simp: word_size)\n\nlemma map_comp_restrict_map_Some_iff:\n \"((g \\\\<^sub>m (m |` S)) x = Some y) = ((g \\\\<^sub>m m) x = Some y \\ x \\ S)\"\n by (auto simp add: map_comp_Some_iff restrict_map_Some_iff)\n\nlemma range_subsetD:\n fixes a :: \"'a :: order\"\n shows \"\\ {a..b} \\ {c..d}; a \\ b \\ \\ c \\ a \\ b \\ d\"\n apply (rule conjI)\n apply (drule subsetD [where c = a])\n apply simp\n apply simp\n apply (drule subsetD [where c = b])\n apply simp\n apply simp\n done\n\nlemma option_case_dom:\n \"(case f x of None \\ a | Some v \\ b v)\n = (if x \\ dom f then b (the (f x)) else a)\"\n by (auto split: split_if option.split)\n\nlemma contrapos_imp:\n \"P \\ Q \\ \\ Q \\ \\ P\"\n by clarsimp\n\nlemma eq_mask_less:\n fixes w :: \"('a::len) word\"\n assumes eqm: \"w = w && mask n\"\n and sz: \"n < len_of TYPE ('a)\"\n shows \"w < (2::'a word) ^ n\"\n by (subst eqm, rule and_mask_less' [OF sz])\n\nlemma of_nat_mono_maybe':\n fixes Y :: \"nat\"\n assumes xlt: \"X < 2 ^ len_of TYPE ('a :: len)\"\n assumes ylt: \"Y < 2 ^ len_of TYPE ('a :: len)\"\n shows \"(Y < X) = (of_nat Y < (of_nat X :: 'a :: len word))\"\n apply (subst word_less_nat_alt)\n apply (subst unat_of_nat)+\n apply (subst mod_less)\n apply (rule ylt)\n apply (subst mod_less)\n apply (rule xlt)\n apply simp\n done\n\n(* FIXME: MOVE *)\nlemma shiftr_mask_eq:\n fixes x :: \"'a :: len word\"\n shows \"(x >> n) && mask (size x - n) = x >> n\"\n apply (rule word_eqI)\n apply (simp add: word_size nth_shiftr)\n apply (rule iffI)\n apply clarsimp\n apply (clarsimp)\n apply (drule test_bit_size)\n apply (simp add: word_size)\n done\n\n(* FIXME: move *)\nlemma shiftr_mask_eq':\n fixes x :: \"'a :: len word\"\n shows \"m = (size x - n) \\ (x >> n) && mask m = x >> n\"\n by (simp add: shiftr_mask_eq)\n\nlemma zipWith_Nil2 :\n \"zipWith f xs [] = []\"\n unfolding zipWith_def by simp\n\nlemma zip_upt_Cons:\n \"a < b \\ zip [a ..< b] (x # xs)\n = (a, x) # zip [Suc a ..< b] xs\"\n by (simp add: upt_conv_Cons)\n\nlemma map_comp_eq:\n \"(f \\\\<^sub>m g) = (case_option None f \\ g)\"\n apply (rule ext)\n apply (case_tac \"g x\")\n apply simp\n apply simp\n done\n\nlemma dom_If_Some:\n \"dom (\\x. if x \\ S then Some v else f x) = (S \\ dom f)\"\n by (auto split: split_if)\n\nlemma foldl_fun_upd_const:\n \"foldl (\\s x. s(f x := v)) s xs\n = (\\x. if x \\ f ` set xs then v else s x)\"\n apply (induct xs arbitrary: s)\n apply simp\n apply (rule ext, simp)\n done\n\nlemma foldl_id:\n \"foldl (\\s x. s) s xs = s\"\n apply (induct xs)\n apply simp\n apply simp\n done\n\nlemma SucSucMinus: \"2 \\ n \\ Suc (Suc (n - 2)) = n\" by arith\n\nlemma ball_to_all:\n \"(\\x. (x \\ A) = (P x)) \\ (\\x \\ A. B x) = (\\x. P x \\ B x)\"\n by blast\n\nlemma bang_big: \"n \\ size (x::'a::len0 word) \\ (x !! n) = False\"\n by (simp add: test_bit_bl word_size)\n\nlemma bang_conj_lt:\n fixes x :: \"'a :: len word\"\n shows \"(x !! m \\ m < len_of TYPE('a)) = x !! m\"\n apply (cases \"m < len_of TYPE('a)\")\n apply simp\n apply (simp add: not_less bang_big word_size)\n done\n\nlemma dom_if:\n \"dom (\\a. if a \\ addrs then Some (f a) else g a) = addrs \\ dom g\"\n by (auto simp: dom_def split: split_if)\n\nlemma less_is_non_zero_p1:\n fixes a :: \"'a :: len word\"\n shows \"a < k \\ a + 1 \\ 0\"\n apply (erule contrapos_pn)\n apply (drule max_word_wrap)\n apply (simp add: not_less)\n done\n\nlemma lt_word_bits_lt_pow:\n \"sz < word_bits \\ sz < 2 ^ word_bits\"\n by (simp add: word_bits_conv)\n\n(* FIXME: shadows an existing thm *)\nlemma of_nat_mono_maybe_le:\n \"\\X < 2 ^ len_of TYPE('a); Y < 2 ^ len_of TYPE('a)\\ \\\n (Y \\ X) = ((of_nat Y :: 'a :: len word) \\ of_nat X)\"\n apply (clarsimp simp: le_less)\n apply (rule disj_cong)\n apply (rule of_nat_mono_maybe', assumption+)\n apply (simp add: word_unat.norm_eq_iff [symmetric])\n done\n\nlemma neg_mask_bang:\n \"(~~ mask n :: 'a :: len word) !! m = (n \\ m \\ m < len_of TYPE('a))\"\n apply (cases \"m < len_of TYPE('a)\")\n apply (simp add: word_ops_nth_size word_size not_less)\n apply (simp add: not_less bang_big word_size)\n done\n\nlemma mask_AND_NOT_mask:\n \"(w && ~~ mask n) && mask n = 0\"\nby (rule word_eqI) (clarsimp simp add: word_size neg_mask_bang)\n\nlemma AND_NOT_mask_plus_AND_mask_eq:\n \"(w && ~~ mask n) + (w && mask n) = w\"\napply (rule word_eqI)\napply (rename_tac m)\napply (simp add: word_size)\napply (cut_tac word_plus_and_or_coroll[of \"w && ~~ mask n\" \"w && mask n\"])\n apply (simp add: word_ao_dist2[symmetric] word_size neg_mask_bang)\napply (rule word_eqI)\napply (rename_tac m)\napply (simp add: word_size neg_mask_bang)\ndone\n\nlemma mask_eqI:\n fixes x :: \"'a :: len word\"\n assumes m1: \"x && mask n = y && mask n\"\n and m2: \"x && ~~ mask n = y && ~~ mask n\"\n shows \"x = y\"\nproof (subst bang_eq, rule allI)\n fix m\n\n show \"x !! m = y !! m\"\n proof (cases \"m < n\")\n case True\n hence \"x !! m = ((x && mask n) !! m)\"\n by (simp add: word_size bang_conj_lt)\n also have \"\\ = ((y && mask n) !! m)\" using m1 by simp\n also have \"\\ = y !! m\" using True\n by (simp add: word_size bang_conj_lt)\n finally show ?thesis .\n next\n case False\n hence \"x !! m = ((x && ~~ mask n) !! m)\"\n by (simp add: neg_mask_bang bang_conj_lt)\n also have \"\\ = ((y && ~~ mask n) !! m)\" using m2 by simp\n also have \"\\ = y !! m\" using False\n by (simp add: neg_mask_bang bang_conj_lt)\n finally show ?thesis .\n qed\nqed\n\nlemma nat_less_power_trans2:\n fixes n :: nat\n shows \"\\n < 2 ^ (m - k); k \\ m\\ \\ n * 2 ^ k < 2 ^ m\"\n by (subst mult.commute, erule (1) nat_less_power_trans)\n\nlemma nat_move_sub_le: \"(a::nat) + b \\ c \\ a \\ c - b\" by arith\n\nlemma neq_0_no_wrap:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ x + y; x \\ 0 \\ \\ x + y \\ 0\"\n by clarsimp\n\nlemma plus_minus_one_rewrite:\n \"v + (- 1 :: ('a :: {ring, one, uminus})) \\ v - 1\"\n by (simp add: field_simps)\n\nlemmas plus_minus_one_rewrite32 = plus_minus_one_rewrite[where 'a=word32, simplified]\n\nlemma power_minus_is_div:\n \"b \\ a \\ (2 :: nat) ^ (a - b) = 2 ^ a div 2 ^ b\"\n apply (induct a arbitrary: b)\n apply simp\n apply (erule le_SucE)\n apply (clarsimp simp:Suc_diff_le le_iff_add power_add)\n apply simp\n done\n\nlemma two_pow_div_gt_le:\n \"v < 2 ^ n div (2 ^ m :: nat) \\ m \\ n\"\n by (clarsimp dest!: less_two_pow_divD)\n\n\n\nlemma unat_less_word_bits:\n fixes y :: word32\n shows \"x < unat y \\ x < 2 ^ word_bits\"\n unfolding word_bits_def\n by (rule order_less_trans [OF _ unat_lt2p])\n\nlemma word_add_power_off:\n fixes a :: word32\n assumes ak: \"a < k\"\n and kw: \"k < 2 ^ (word_bits - m)\"\n and mw: \"m < word_bits\"\n and off: \"off < 2 ^ m\"\n shows \"(a * 2 ^ m) + off < k * 2 ^ m\"\nproof (cases \"m = 0\")\n case True\n thus ?thesis using off ak by simp\nnext\n case False\n\n from ak have ak1: \"a + 1 \\ k\" by (rule inc_le)\n hence \"(a + 1) * 2 ^ m \\ 0\"\n apply -\n apply (rule word_power_nonzero)\n apply (erule order_le_less_trans [OF _ kw])\n apply (rule mw)\n apply (rule less_is_non_zero_p1 [OF ak])\n done\n hence \"(a * 2 ^ m) + off < ((a + 1) * 2 ^ m)\" using kw mw\n apply -\n apply (simp add: distrib_right)\n apply (rule word_plus_strict_mono_right [OF off])\n apply (rule is_aligned_no_overflow'')\n apply (rule is_aligned_mult_triv2)\n apply assumption\n done\n also have \"\\ \\ k * 2 ^ m\" using ak1 mw kw False\n apply -\n apply (erule word_mult_le_mono1)\n apply (simp add: p2_gt_0 word_bits_def)\n apply (simp add: word_bits_len_of word_less_nat_alt word_bits_def)\n apply (rule nat_less_power_trans2[where m=32, simplified])\n apply (simp add: word_less_nat_alt)\n apply simp\n done\n finally show ?thesis .\nqed\n\nlemma word_of_nat_less:\n \"\\ n < unat x \\ \\ of_nat n < x\"\n apply (simp add: word_less_nat_alt)\n apply (erule order_le_less_trans[rotated])\n apply (simp add: unat_of_nat)\n done\n\nlemma word_rsplit_0:\n \"word_rsplit (0 :: word32) = [0, 0, 0, 0 :: word8]\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma word_of_nat_le:\n \"n \\ unat x \\ of_nat n \\ x\"\n apply (simp add: word_le_nat_alt unat_of_nat)\n apply (erule order_trans[rotated])\n apply simp\n done\n\nlemma word_unat_less_le:\n \"a \\ of_nat b \\ unat a \\ b\"\n by (metis eq_iff le_cases le_unat_uoi word_of_nat_le)\n\nlemma filter_eq_If:\n \"distinct xs \\ filter (\\v. v = x) xs = (if x \\ set xs then [x] else [])\"\n apply (induct xs)\n apply simp\n apply (clarsimp split: split_if)\n done\n\n(*FIXME: isabelle-2012 *)\nlemma (in semigroup_add) foldl_assoc:\nshows \"foldl op+ (x+y) zs = x + (foldl op+ y zs)\"\nby (induct zs arbitrary: y) (simp_all add:add.assoc)\n\nlemma (in monoid_add) foldl_absorb0:\nshows \"x + (foldl op+ 0 zs) = foldl op+ x zs\"\nby (induct zs) (simp_all add:foldl_assoc)\n\nlemma foldl_conv_concat:\n \"foldl (op @) xs xss = xs @ concat xss\"\nproof (induct xss arbitrary: xs)\n case Nil show ?case by simp\nnext\n interpret monoid_add \"op @\" \"[]\" proof qed simp_all\n case Cons then show ?case by (simp add: foldl_absorb0)\nqed\n\nlemma foldl_concat_concat:\n \"foldl op @ [] (xs @ ys) = foldl op @ [] xs @ foldl op @ [] ys\"\n by (simp add: foldl_conv_concat)\n\nlemma foldl_does_nothing:\n \"\\ \\x. x \\ set xs \\ f s x = s \\ \\ foldl f s xs = s\"\n by (induct xs, simp_all)\n\nlemma foldl_use_filter:\n \"\\ \\v x. \\ \\ g x; x \\ set xs \\ \\ f v x = v \\\n \\\n foldl f v xs = foldl f v (filter g xs)\"\n apply (induct xs arbitrary: v)\n apply simp\n apply (simp split: split_if)\n done\n\nlemma split_upt_on_n:\n \"n < m \\ [0 ..< m] = [0 ..< n] @ [n] @ [Suc n ..< m]\"\n apply (subst upt_add_eq_append', simp, erule order_less_imp_le)\n apply (simp add: upt_conv_Cons)\n done\n\nlemma unat_ucast_10_32 :\n fixes x :: \"10 word\"\n shows \"unat (ucast x :: word32) = unat x\"\n unfolding ucast_def unat_def\n apply (subst int_word_uint)\n apply (subst mod_pos_pos_trivial)\n apply simp\n apply (rule lt2p_lem)\n apply simp\n apply simp\n done\n\nlemma map_comp_update_lift:\n assumes fv: \"f v = Some v'\"\n shows \"(f \\\\<^sub>m (g(ptr \\ v))) = ((f \\\\<^sub>m g)(ptr \\ v'))\"\n unfolding map_comp_def\n apply (rule ext)\n apply (simp add: fv)\n done\n\nlemma restrict_map_cong:\n assumes sv: \"S = S'\"\n and rl: \"\\p. p \\ S' \\ mp p = mp' p\"\n shows \"mp |` S = mp' |` S'\"\n apply (simp add: sv)\n apply (rule ext)\n apply (case_tac \"x \\ S'\")\n apply (simp add: rl )\n apply simp\n done\n\nlemma and_eq_0_is_nth:\n fixes x :: \"('a :: len) word\"\n shows \"y = 1 << n \\ ((x && y) = 0) = (\\ (x !! n))\"\n apply safe\n apply (drule_tac u=\"(x && (1 << n))\" and x=n in word_eqD)\n apply (simp add: nth_w2p)\n apply (simp add: test_bit_bin)\n apply (rule word_eqI)\n apply (simp add: nth_w2p)\n done\n\nlemmas and_neq_0_is_nth = arg_cong [where f=Not, OF and_eq_0_is_nth, simplified]\n\nlemma ucast_le_ucast_8_32:\n \"(ucast x \\ (ucast y :: word32)) = (x \\ (y :: word8))\"\n by (simp add: word_le_nat_alt unat_ucast_8_32)\n\nlemma mask_Suc_0 : \"mask (Suc 0) = 1\"\n by (simp add: mask_def)\n\nlemma ucast_ucast_add:\n fixes x :: \"('a :: len) word\"\n fixes y :: \"('b :: len) word\"\n shows\n \"len_of TYPE('b) \\ len_of TYPE('a) \\\n ucast (ucast x + y) = x + ucast y\"\n apply (rule word_unat.Rep_eqD)\n apply (simp add: unat_ucast unat_word_ariths mod_mod_power\n min.absorb2 unat_of_nat)\n apply (subst mod_add_left_eq)\n apply (simp add: mod_mod_power min.absorb2)\n apply (subst mod_add_right_eq)\n apply simp\n done\n\nlemma word_shift_zero:\n \"\\ x << n = 0; x \\ 2^m; m + n < len_of TYPE('a)\\ \\ (x::'a::len word) = 0\"\n apply (rule ccontr)\n apply (drule (2) word_shift_nonzero)\n apply simp\n done\n\nlemma neg_mask_mono_le:\n \"(x :: 'a :: len word) \\ y \\ x && ~~ mask n \\ y && ~~ mask n\"\nproof (rule ccontr, simp add: linorder_not_le, cases \"n < len_of TYPE('a)\")\n case False\n show \"y && ~~ mask n < x && ~~ mask n \\ False\"\n using False\n by (simp add: mask_def linorder_not_less\n power_overflow)\nnext\n case True\n assume a: \"x \\ y\" and b: \"y && ~~ mask n < x && ~~ mask n\"\n have word_bits:\n \"n < len_of TYPE('a)\"\n using True by assumption\n have \"y \\ (y && ~~ mask n) + (y && mask n)\"\n by (simp add: word_plus_and_or_coroll2 add.commute)\n also have \"\\ \\ (y && ~~ mask n) + 2 ^ n\"\n apply (rule word_plus_mono_right)\n apply (rule order_less_imp_le, rule and_mask_less_size)\n apply (simp add: word_size word_bits)\n apply (rule is_aligned_no_overflow'',\n simp_all add: is_aligned_neg_mask word_bits)\n apply (rule not_greatest_aligned, rule b)\n apply (simp_all add: is_aligned_neg_mask)\n done\n also have \"\\ \\ x && ~~ mask n\"\n using b\n apply -\n apply (subst add.commute, rule le_plus)\n apply (rule aligned_at_least_t2n_diff,\n simp_all add: is_aligned_neg_mask)\n apply (rule ccontr, simp add: linorder_not_le)\n apply (drule aligned_small_is_0[rotated], simp_all add: is_aligned_neg_mask)\n done\n also have \"\\ \\ x\"\n by (rule word_and_le2)\n also have \"x \\ y\" by fact\nfinally\n show \"False\" using b\n by simp\nqed\n\nlemma isRight_right_map:\n \"isRight (case_sum Inl (Inr o f) v) = isRight v\"\n by (simp add: isRight_def split: sum.split)\n\nlemma bool_mask [simp]:\n fixes x :: word32\n shows \"(0 < x && 1) = (x && 1 = 1)\"\n apply (rule iffI)\n prefer 2\n apply simp\n apply (subgoal_tac \"x && mask 1 < 2^1\")\n prefer 2\n apply (rule and_mask_less_size)\n apply (simp add: word_size)\n apply (simp add: mask_def)\n apply (drule word_less_cases [where y=2])\n apply (erule disjE, simp)\n apply simp\n done\n\nlemma option_case_over_if:\n \"case_option P Q (if G then None else Some v)\n = (if G then P else Q v)\"\n \"case_option P Q (if G then Some v else None)\n = (if G then Q v else P)\"\n by (simp split: split_if)+\n\n\n\nlemma scast_eq_ucast:\n \"\\ msb x \\ scast x = ucast x\"\n by (simp add: scast_def ucast_def sint_eq_uint)\n\n(* MOVE *)\n\nlemma lt1_neq0:\n fixes x :: \"'a :: len word\"\n shows \"(1 \\ x) = (x \\ 0)\" by unat_arith\n\nlemma word_plus_one_nonzero:\n fixes x :: \"'a :: len word\"\n shows \"\\x \\ x + y; y \\ 0\\ \\ x + 1 \\ 0\"\n apply (subst lt1_neq0 [symmetric])\n apply (subst olen_add_eqv [symmetric])\n apply (erule word_random)\n apply (simp add: lt1_neq0)\n done\n\nlemma word_sub_plus_one_nonzero:\n fixes n :: \"'a :: len word\"\n shows \"\\n' \\ n; n' \\ 0\\ \\ (n - n') + 1 \\ 0\"\n apply (subst lt1_neq0 [symmetric])\n apply (subst olen_add_eqv [symmetric])\n apply (rule word_random [where x' = n'])\n apply simp\n apply (erule word_sub_le)\n apply (simp add: lt1_neq0)\n done\n\nlemma word_le_minus_mono_right:\n fixes x :: \"'a :: len word\"\n shows \"\\ z \\ y; y \\ x; z \\ x \\ \\ x - y \\ x - z\"\n apply (rule word_sub_mono)\n apply simp\n apply assumption\n apply (erule word_sub_le)\n apply (erule word_sub_le)\n done\n\nlemma drop_append_miracle:\n \"n = length xs \\ drop n (xs @ ys) = ys\"\n by simp\n\nlemma foldr_does_nothing_to_xf:\n \"\\ \\x s. x \\ set xs \\ xf (f x s) = xf s \\ \\ xf (foldr f xs s) = xf s\"\n by (induct xs, simp_all)\n\nlemma nat_less_mult_monoish: \"\\ a < b; c < (d :: nat) \\ \\ (a + 1) * (c + 1) <= b * d\"\n apply (drule Suc_leI)+\n apply (drule(1) mult_le_mono)\n apply simp\n done\n\nlemma word_0_sle_from_less[unfolded word_size]:\n \"\\ x < 2 ^ (size x - 1) \\ \\ 0 <=s x\"\n apply (clarsimp simp: word_sle_msb_le)\n apply (simp add: word_msb_nth)\n apply (subst (asm) word_test_bit_def [symmetric])\n apply (drule less_mask_eq)\n apply (drule_tac x=\"size x - 1\" in word_eqD)\n apply (simp add: word_size)\n done\n\nlemma not_msb_from_less:\n \"(v :: 'a word) < 2 ^ (len_of TYPE('a :: len) - 1) \\ \\ msb v\"\n apply (clarsimp simp add: msb_nth)\n apply (drule less_mask_eq)\n apply (drule word_eqD, drule(1) iffD2)\n apply simp\n done\n\nlemma distinct_lemma: \"f x \\ f y \\ x \\ y\" by auto\n\n\nlemma ucast_sub_ucast:\n fixes x :: \"'a::len word\"\n assumes \"y \\ x\"\n assumes T: \"len_of TYPE('a) \\ len_of TYPE('b)\"\n shows \"ucast (x - y) = (ucast x - ucast y :: 'b::len word)\"\nproof -\n from T\n have P: \"unat x < 2 ^ len_of TYPE('b)\" \"unat y < 2 ^ len_of TYPE('b)\"\n by (fastforce intro!: less_le_trans[OF unat_lt2p])+\n thus ?thesis\n by (simp add: unat_arith_simps unat_ucast split assms[simplified unat_arith_simps])\nqed\n\nlemma word_1_0:\n \"\\a + (1::('a::len) word) \\ b; a < of_nat ((2::nat) ^ len_of TYPE(32) - 1)\\ \\ a < b\"\n by unat_arith\n\nlemma unat_of_nat_less:\"\\ a < b; unat b = c \\ \\ a < of_nat c\"\n by fastforce\n\nlemma word_le_plus_1: \"\\ (y::('a::len) word) < y + n; a < n \\ \\ y + a \\ y + a + 1\"\n by unat_arith\n\nlemma word_le_plus:\"\\(a::('a::len) word) < a + b; c < b\\ \\ a \\ a + c\"\nby (metis order_less_imp_le word_random)\n\n(*\n * Basic signed arithemetic properties.\n *)\n\nlemma sint_minus1 [simp]: \"(sint x = -1) = (x = -1)\"\n by (metis sint_n1 word_sint.Rep_inverse')\n\nlemma sint_0 [simp]: \"(sint x = 0) = (x = 0)\"\n by (metis sint_0 word_sint.Rep_inverse')\n\n(* It is not always that case that \"sint 1 = 1\", because of 1-bit word sizes.\n * This lemma produces the different cases. *)\nlemma sint_1_cases:\n \"\\ \\ len_of TYPE ('a::len) = 1; (a::'a word) = 0; sint a = 0 \\ \\ P;\n \\ len_of TYPE ('a) = 1; a = 1; sint (1 :: 'a word) = -1 \\ \\ P;\n \\ len_of TYPE ('a) > 1; sint (1 :: 'a word) = 1 \\ \\ P \\\n \\ P\"\n apply atomize_elim\n apply (case_tac \"len_of TYPE ('a) = 1\")\n apply clarsimp\n apply (subgoal_tac \"(UNIV :: 'a word set) = {0, 1}\")\n apply (metis UNIV_I insert_iff singletonE)\n apply (subst word_unat.univ)\n apply (clarsimp simp: unats_def image_def)\n apply (rule set_eqI, rule iffI)\n apply clarsimp\n apply (metis One_nat_def less_2_cases of_nat_1 semiring_1_class.of_nat_0)\n apply clarsimp\n apply (metis Abs_fnat_hom_0 Suc_1 lessI of_nat_1 zero_less_Suc)\n apply clarsimp\n apply (metis One_nat_def arith_is_1 le_def len_gt_0 sint_eq_uint uint_1 word_msb_1)\n done\n\nlemma sint_int_min:\n \"sint (- (2 ^ (len_of TYPE('a) - Suc 0)) :: ('a::len) word) = - (2 ^ (len_of TYPE('a) - Suc 0))\"\n apply (subst word_sint.Abs_inverse' [where r=\"- (2 ^ (len_of TYPE('a) - Suc 0))\"])\n apply (clarsimp simp: sints_num)\n apply (clarsimp simp: wi_hom_syms word_of_int_2p)\n apply clarsimp\n done\n\nlemma sint_int_max_plus_1:\n \"sint (2 ^ (len_of TYPE('a) - Suc 0) :: ('a::len) word) = - (2 ^ (len_of TYPE('a) - Suc 0))\"\n apply (subst word_of_int_2p [symmetric])\n apply (subst int_word_sint)\n apply (clarsimp simp: comm_semiring_1_class.normalizing_semiring_rules(27))\n done\n\nlemma word32_bounds:\n \"- (2 ^ (size (x :: word32) - 1)) = (-2147483648 :: int)\"\n \"((2 ^ (size (x :: word32) - 1)) - 1) = (2147483647 :: int)\"\n \"- (2 ^ (size (y :: 32 signed word) - 1)) = (-2147483648 :: int)\"\n \"((2 ^ (size (y :: 32 signed word) - 1)) - 1) = (2147483647 :: int)\"\n by (simp_all add: word_size)\n\n\n\nlemma sbintrunc_If:\n \"- 3 * (2 ^ n) \\ x \\ x < 3 * (2 ^ n)\n \\ sbintrunc n x = (if x < - (2 ^ n) then x + 2 * (2 ^ n)\n else if x \\ 2 ^ n then x - 2 * (2 ^ n) else x)\"\n apply (simp add: no_sbintr_alt2, safe)\n apply (simp add: mod_pos_geq mod_pos_pos_trivial)\n apply (subst mod_add_self1[symmetric], simp)\n apply (simp add: mod_pos_pos_trivial)\n apply (simp add: mod_pos_pos_trivial)\n done\n\nlemma signed_arith_eq_checks_to_ord:\n \"(sint a + sint b = sint (a + b ))\n = ((a <=s a + b) = (0 <=s b))\"\n \"(sint a - sint b = sint (a - b ))\n = ((0 <=s a - b) = (b <=s a))\"\n \"(- sint a = sint (- a)) = (0 <=s (- a) = (a <=s 0))\"\n using sint_range'[where x=a] sint_range'[where x=b]\n apply (simp_all add: sint_word_ariths\n word_sle_def word_sless_alt sbintrunc_If)\n apply arith+\n done\n\n(* Basic proofs that signed word div/mod operations are\n * truncations of their integer counterparts. *)\n\nlemma signed_div_arith:\n \"sint ((a::('a::len) word) sdiv b) = sbintrunc (len_of TYPE('a) - 1) (sint a sdiv sint b)\"\n apply (subst word_sbin.norm_Rep [symmetric])\n apply (subst bin_sbin_eq_iff' [symmetric])\n apply simp\n apply (subst uint_sint [symmetric])\n apply (clarsimp simp: sdiv_int_def sdiv_word_def)\n apply (metis word_ubin.eq_norm)\n done\n\nlemma signed_mod_arith:\n \"sint ((a::('a::len) word) smod b) = sbintrunc (len_of TYPE('a) - 1) (sint a smod sint b)\"\n apply (subst word_sbin.norm_Rep [symmetric])\n apply (subst bin_sbin_eq_iff' [symmetric])\n apply simp\n apply (subst uint_sint [symmetric])\n apply (clarsimp simp: smod_int_def smod_word_def)\n apply (metis word_ubin.eq_norm)\n done\n\n(* Signed word arithmetic overflow constraints. *)\n\nlemma signed_arith_ineq_checks_to_eq:\n \"((- (2 ^ (size a - 1)) \\ (sint a + sint b)) \\ (sint a + sint b \\ (2 ^ (size a - 1) - 1)))\n = (sint a + sint b = sint (a + b ))\"\n \"((- (2 ^ (size a - 1)) \\ (sint a - sint b)) \\ (sint a - sint b \\ (2 ^ (size a - 1) - 1)))\n = (sint a - sint b = sint (a - b))\"\n \"((- (2 ^ (size a - 1)) \\ (- sint a)) \\ (- sint a) \\ (2 ^ (size a - 1) - 1))\n = ((- sint a) = sint (- a))\"\n \"((- (2 ^ (size a - 1)) \\ (sint a * sint b)) \\ (sint a * sint b \\ (2 ^ (size a - 1) - 1)))\n = (sint a * sint b = sint (a * b))\"\n \"((- (2 ^ (size a - 1)) \\ (sint a sdiv sint b)) \\ (sint a sdiv sint b \\ (2 ^ (size a - 1) - 1)))\n = (sint a sdiv sint b = sint (a sdiv b))\"\n \"((- (2 ^ (size a - 1)) \\ (sint a smod sint b)) \\ (sint a smod sint b \\ (2 ^ (size a - 1) - 1)))\n = (sint a smod sint b = sint (a smod b))\"\n by (auto simp: sint_word_ariths word_size signed_div_arith signed_mod_arith\n sbintrunc_eq_in_range range_sbintrunc)\n\nlemmas signed_arith_ineq_checks_to_eq_word32\n = signed_arith_ineq_checks_to_eq[where 'a=32, unfolded word32_bounds]\n signed_arith_ineq_checks_to_eq[where 'a=\"32 signed\", unfolded word32_bounds]\n\nlemma signed_arith_sint:\n \"((- (2 ^ (size a - 1)) \\ (sint a + sint b)) \\ (sint a + sint b \\ (2 ^ (size a - 1) - 1)))\n \\ sint (a + b) = (sint a + sint b)\"\n \"((- (2 ^ (size a - 1)) \\ (sint a - sint b)) \\ (sint a - sint b \\ (2 ^ (size a - 1) - 1)))\n \\ sint (a - b) = (sint a - sint b)\"\n \"((- (2 ^ (size a - 1)) \\ (- sint a)) \\ (- sint a) \\ (2 ^ (size a - 1) - 1))\n \\ sint (- a) = (- sint a)\"\n \"((- (2 ^ (size a - 1)) \\ (sint a * sint b)) \\ (sint a * sint b \\ (2 ^ (size a - 1) - 1)))\n \\ sint (a * b) = (sint a * sint b)\"\n \"((- (2 ^ (size a - 1)) \\ (sint a sdiv sint b)) \\ (sint a sdiv sint b \\ (2 ^ (size a - 1) - 1)))\n \\ sint (a sdiv b) = (sint a sdiv sint b)\"\n \"((- (2 ^ (size a - 1)) \\ (sint a smod sint b)) \\ (sint a smod sint b \\ (2 ^ (size a - 1) - 1)))\n \\ sint (a smod b) = (sint a smod sint b)\"\n by (metis signed_arith_ineq_checks_to_eq)+\n\nlemma signed_mult_eq_checks_double_size:\n assumes mult_le: \"(2 ^ (len_of TYPE ('a) - 1) + 1) ^ 2\n \\ (2 :: int) ^ (len_of TYPE ('b) - 1)\"\n and le: \"2 ^ (len_of TYPE('a) - 1) \\ (2 :: int) ^ (len_of TYPE ('b) - 1)\"\n shows\n \"(sint (a :: ('a :: len) word) * sint b = sint (a * b))\n = (scast a * scast b = (scast (a * b) :: ('b :: len) word))\"\nproof -\n have P: \"sbintrunc (size a - 1) (sint a * sint b) \\ range (sbintrunc (size a - 1))\"\n by simp\n\n have abs: \"!! x :: 'a word. abs (sint x) < 2 ^ (size a - 1) + 1\"\n apply (cut_tac x=x in sint_range')\n apply (simp add: abs_le_iff word_size)\n done\n have abs_ab: \"abs (sint a * sint b) < 2 ^ (len_of TYPE('b) - 1)\"\n using abs_mult_less[OF abs[where x=a] abs[where x=b]] mult_le\n by (simp add: abs_mult power2_eq_square word_size)\n show ?thesis\n using P[unfolded range_sbintrunc] abs_ab le\n apply (simp add: sint_word_ariths scast_def)\n apply (simp add: wi_hom_mult)\n apply (subst word_sint.Abs_inject, simp_all)\n apply (simp add: sints_def range_sbintrunc\n abs_less_iff)\n apply clarsimp\n apply (simp add: sints_def range_sbintrunc word_size)\n apply (auto elim: order_less_le_trans order_trans[rotated])\n done\nqed\n\nlemmas signed_mult_eq_checks32_to_64\n = signed_mult_eq_checks_double_size[where 'a=32 and 'b=64, simplified]\n signed_mult_eq_checks_double_size[where 'a=\"32 signed\" and 'b=64, simplified]\n\n(* Properties about signed division. *)\n\nlemma int_sdiv_simps [simp]:\n \"(a :: int) sdiv 1 = a\"\n \"(a :: int) sdiv 0 = 0\"\n \"(a :: int) sdiv -1 = -a\"\n apply (auto simp: sdiv_int_def sgn_if)\n done\n\nlemma sgn_div_eq_sgn_mult:\n \"a div b \\ 0 \\ sgn ((a :: int) div b) = sgn (a * b)\"\n apply (clarsimp simp: sgn_if zero_le_mult_iff neg_imp_zdiv_nonneg_iff not_less)\n apply (metis less_le mult_le_0_iff neg_imp_zdiv_neg_iff not_less pos_imp_zdiv_neg_iff zdiv_eq_0_iff)\n done\n\nlemma sgn_sdiv_eq_sgn_mult:\n \"a sdiv b \\ 0 \\ sgn ((a :: int) sdiv b) = sgn (a * b)\"\n apply (clarsimp simp: sdiv_int_def sgn_times)\n apply (subst sgn_div_eq_sgn_mult)\n apply simp\n apply (clarsimp simp: sgn_times)\n apply (metis abs_mult div_0 div_mult_self2_is_id sgn_0_0 sgn_1_pos sgn_times zero_less_abs_iff)\n done\n\nlemma int_sdiv_same_is_1 [simp]:\n \"a \\ 0 \\ ((a :: int) sdiv b = a) = (b = 1)\"\n apply (rule iffI)\n apply (clarsimp simp: sdiv_int_def)\n apply (subgoal_tac \"b > 0\")\n apply (case_tac \"a > 0\")\n apply (clarsimp simp: sgn_if sign_simps)\n apply (clarsimp simp: sign_simps not_less)\n apply (metis int_div_same_is_1 le_neq_trans minus_minus neg_0_le_iff_le neg_equal_0_iff_equal)\n apply (case_tac \"a > 0\")\n apply (case_tac \"b = 0\")\n apply (clarsimp simp: sign_simps)\n apply (rule classical)\n apply (clarsimp simp: sign_simps sgn_times not_less)\n apply (metis le_less neg_0_less_iff_less not_less_iff_gr_or_eq pos_imp_zdiv_neg_iff)\n apply (rule classical)\n apply (clarsimp simp: sign_simps sgn_times not_less sgn_if split: if_splits)\n apply (metis antisym less_le neg_imp_zdiv_nonneg_iff)\n apply (clarsimp simp: sdiv_int_def sgn_if)\n done\n\nlemma int_sdiv_negated_is_minus1 [simp]:\n \"a \\ 0 \\ ((a :: int) sdiv b = - a) = (b = -1)\"\n apply (clarsimp simp: sdiv_int_def)\n apply (rule iffI)\n apply (subgoal_tac \"b < 0\")\n apply (case_tac \"a > 0\")\n apply (clarsimp simp: sgn_if sign_simps not_less)\n apply (case_tac \"sgn (a * b) = -1\")\n apply (clarsimp simp: not_less sign_simps)\n apply (clarsimp simp: sign_simps not_less)\n apply (rule classical)\n apply (case_tac \"b = 0\")\n apply (clarsimp simp: sign_simps not_less sgn_times)\n apply (case_tac \"a > 0\")\n apply (clarsimp simp: sign_simps not_less sgn_times)\n apply (metis less_le neg_less_0_iff_less not_less_iff_gr_or_eq pos_imp_zdiv_neg_iff)\n apply (clarsimp simp: sign_simps not_less sgn_times)\n apply (metis div_minus_right eq_iff neg_0_le_iff_le neg_imp_zdiv_nonneg_iff not_leE)\n apply (clarsimp simp: sgn_if)\n done\n\nlemma sdiv_int_range:\n \"(a :: int) sdiv b \\ { - (abs a) .. (abs a) }\"\n apply (unfold sdiv_int_def)\n apply (subgoal_tac \"(abs a) div (abs b) \\ (abs a)\")\n apply (clarsimp simp: sgn_if)\n apply (metis Divides.transfer_nat_int_function_closures(1) abs_ge_zero\n abs_less_iff abs_of_nonneg less_asym less_minus_iff not_less)\n apply (metis abs_eq_0 abs_ge_zero div_by_0 zdiv_le_dividend zero_less_abs_iff)\n done\n\n\n\nlemma sdiv_int_div_0 [simp]:\n \"(x :: int) sdiv 0 = 0\"\n by (clarsimp simp: sdiv_int_def)\n\nlemma sdiv_int_0_div [simp]:\n \"0 sdiv (x :: int) = 0\"\n by (clarsimp simp: sdiv_int_def)\n\nlemma word_sdiv_div0 [simp]:\n \"(a :: ('a::len) word) sdiv 0 = 0\"\n apply (auto simp: sdiv_word_def sdiv_int_def sgn_if)\n done\n\nlemma word_sdiv_div_minus1 [simp]:\n \"(a :: ('a::len) word) sdiv -1 = -a\"\n apply (auto simp: sdiv_word_def sdiv_int_def sgn_if)\n apply (metis wi_hom_neg word_sint.Rep_inverse')\n done\n\nlemma word_sdiv_0 [simp]: \"(x :: ('a::len) word) sdiv 0 = 0\"\n by (clarsimp simp: sdiv_word_def)\n\nlemma sdiv_word_min:\n \"- (2 ^ (size a - 1)) \\ sint (a :: ('a::len) word) sdiv sint (b :: ('a::len) word)\"\n apply (clarsimp simp: word_size)\n apply (cut_tac sint_range' [where x=a])\n apply (cut_tac sint_range' [where x=b])\n apply clarsimp\n apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n apply (clarsimp simp: max_def abs_if split: split_if_asm)\n done\n\nlemma sdiv_word_max:\n \"(sint (a :: ('a::len) word) sdiv sint (b :: ('a::len) word) < (2 ^ (size a - 1))) =\n ((a \\ - (2 ^ (size a - 1)) \\ (b \\ -1)))\"\n (is \"?lhs = (\\ ?a_int_min \\ \\ ?b_minus1)\")\nproof (rule classical)\n assume not_thesis: \"\\ ?thesis\"\n\n have not_zero: \"b \\ 0\"\n using not_thesis\n by (clarsimp)\n\n have result_range: \"sint a sdiv sint b \\ (sints (size a)) \\ {2 ^ (size a - 1)}\"\n apply (cut_tac sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n apply (erule rev_subsetD)\n using sint_range' [where x=a] sint_range' [where x=b]\n apply (auto simp: max_def abs_if word_size sints_num)\n done\n\n have result_range_overflow: \"(sint a sdiv sint b = 2 ^ (size a - 1)) = (?a_int_min \\ ?b_minus1)\"\n apply (rule iffI [rotated])\n apply (clarsimp simp: sdiv_int_def sgn_if word_size sint_int_min)\n apply (rule classical)\n apply (case_tac \"?a_int_min\")\n apply (clarsimp simp: word_size sint_int_min)\n apply (metis diff_0_right\n int_sdiv_negated_is_minus1 minus_diff_eq minus_int_code(2)\n power_eq_0_iff sint_minus1 zero_neq_numeral)\n apply (subgoal_tac \"abs (sint a) < 2 ^ (size a - 1)\")\n apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])[1]\n apply (clarsimp simp: word_size)\n apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])[1]\n apply (insert word_sint.Rep [where x=\"a\"])[1]\n apply (clarsimp simp: minus_le_iff word_size abs_if sints_num split: split_if_asm)\n apply (metis minus_minus sint_int_min word_sint.Rep_inject)\n done\n\n have result_range_simple: \"(sint a sdiv sint b \\ (sints (size a))) \\ ?thesis\"\n apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n apply (clarsimp simp: word_size sints_num sint_int_min)\n done\n\n show ?thesis\n apply (rule UnE [OF result_range result_range_simple])\n apply simp\n apply (clarsimp simp: word_size)\n using result_range_overflow\n apply (clarsimp simp: word_size)\n done\nqed\n\nlemmas sdiv_word_min' = sdiv_word_min [simplified word_size, simplified]\nlemmas sdiv_word_max' = sdiv_word_max [simplified word_size, simplified]\nlemmas sdiv_word32_max = sdiv_word_max [where 'a=32, simplified word_size, simplified]\n sdiv_word_max [where 'a=\"32 signed\", simplified word_size, simplified]\nlemmas sdiv_word32_min = sdiv_word_min [where 'a=32, simplified word_size, simplified]\n sdiv_word_min [where 'a=\"32 signed\", simplified word_size, simplified]\n\n(*\n * Signed modulo properties.\n *)\n\nlemma smod_int_alt_def:\n \"(a::int) smod b = sgn (a) * (abs a mod abs b)\"\n apply (clarsimp simp: smod_int_def sdiv_int_def)\n apply (clarsimp simp: zmod_zdiv_equality' abs_sgn sgn_times sgn_if sign_simps)\n done\n\nlemma smod_int_range:\n \"b \\ 0 \\ (a::int) smod b \\ { - abs b + 1 .. abs b - 1 }\"\n apply (case_tac \"b > 0\")\n apply (insert pos_mod_conj [where a=a and b=b])[1]\n apply (insert pos_mod_conj [where a=\"-a\" and b=b])[1]\n apply (clarsimp simp: smod_int_alt_def sign_simps sgn_if\n abs_if not_less add1_zle_eq [simplified add.commute])\n apply (metis add_le_cancel_left comm_monoid_add_class.add.right_neutral\n int_one_le_iff_zero_less less_le_trans mod_minus_right neg_less_0_iff_less\n neg_mod_conj not_less pos_mod_conj)\n apply (insert neg_mod_conj [where a=a and b=\"b\"])[1]\n apply (insert neg_mod_conj [where a=\"-a\" and b=\"b\"])[1]\n apply (clarsimp simp: smod_int_alt_def sign_simps sgn_if\n abs_if not_less add1_zle_eq [simplified add.commute])\n apply (metis neg_0_less_iff_less neg_mod_conj not_le not_less_iff_gr_or_eq order_trans pos_mod_conj)\n done\n\nlemma smod_int_compares:\n \"\\ 0 \\ a; 0 < b \\ \\ (a :: int) smod b < b\"\n \"\\ 0 \\ a; 0 < b \\ \\ 0 \\ (a :: int) smod b\"\n \"\\ a \\ 0; 0 < b \\ \\ -b < (a :: int) smod b\"\n \"\\ a \\ 0; 0 < b \\ \\ (a :: int) smod b \\ 0\"\n \"\\ 0 \\ a; b < 0 \\ \\ (a :: int) smod b < - b\"\n \"\\ 0 \\ a; b < 0 \\ \\ 0 \\ (a :: int) smod b\"\n \"\\ a \\ 0; b < 0 \\ \\ (a :: int) smod b \\ 0\"\n \"\\ a \\ 0; b < 0 \\ \\ b \\ (a :: int) smod b\"\n apply (insert smod_int_range [where a=a and b=b])\n apply (auto simp: add1_zle_eq smod_int_alt_def sgn_if)\n done\n\nlemma smod_int_mod_0 [simp]:\n \"x smod (0 :: int) = x\"\n by (clarsimp simp: smod_int_def)\n\nlemma smod_int_0_mod [simp]:\n \"0 smod (x :: int) = 0\"\n by (clarsimp simp: smod_int_alt_def)\n\nlemma smod_word_mod_0 [simp]:\n \"x smod (0 :: ('a::len) word) = x\"\n by (clarsimp simp: smod_word_def)\n\nlemma smod_word_0_mod [simp]:\n \"0 smod (x :: ('a::len) word) = 0\"\n by (clarsimp simp: smod_word_def)\n\nlemma smod_word_max:\n \"sint (a::'a word) smod sint (b::'a word) < 2 ^ (len_of TYPE('a::len) - Suc 0)\"\n apply (case_tac \"b = 0\")\n apply (insert word_sint.Rep [where x=a, simplified sints_num])[1]\n apply (clarsimp)\n apply (insert word_sint.Rep [where x=\"b\", simplified sints_num])[1]\n apply (insert smod_int_range [where a=\"sint a\" and b=\"sint b\"])\n apply (clarsimp simp: abs_if split: split_if_asm)\n done\n\nlemma smod_word_min:\n \"- (2 ^ (len_of TYPE('a::len) - Suc 0)) \\ sint (a::'a word) smod sint (b::'a word)\"\n apply (case_tac \"b = 0\")\n apply (insert word_sint.Rep [where x=a, simplified sints_num])[1]\n apply clarsimp\n apply (insert word_sint.Rep [where x=b, simplified sints_num])[1]\n apply (insert smod_int_range [where a=\"sint a\" and b=\"sint b\"])\n apply (clarsimp simp: abs_if add1_zle_eq split: split_if_asm)\n done\n\nlemma smod_word_alt_def:\n \"(a :: ('a::len) word) smod b = a - (a sdiv b) * b\"\n apply (case_tac \"a \\ - (2 ^ (len_of TYPE('a) - 1)) \\ b \\ -1\")\n apply (clarsimp simp: smod_word_def sdiv_word_def smod_int_def\n minus_word.abs_eq [symmetric] times_word.abs_eq [symmetric])\n apply (clarsimp simp: smod_word_def smod_int_def)\n done\n\nlemma sint_of_int_eq:\n \"\\ - (2 ^ (len_of TYPE('a) - 1)) \\ x; x < 2 ^ (len_of TYPE('a) - 1) \\ \\ sint (of_int x :: ('a::len) word) = x\"\n apply (clarsimp simp: word_of_int int_word_sint)\n apply (subst int_mod_eq')\n apply simp\n apply (subst (2) power_minus_simp)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n done\n\nlemmas sint32_of_int_eq = sint_of_int_eq [where 'a=32, simplified]\n\nlemma of_int_sint [simp]:\n \"of_int (sint a) = a\"\n apply (insert word_sint.Rep [where x=a])\n apply (clarsimp simp: word_of_int)\n done\n\n\nlemma ucast_of_nats [simp]:\n \"(ucast (of_nat x :: word32) :: sword32) = (of_nat x)\"\n \"(ucast (of_nat x :: word32) :: sword16) = (of_nat x)\"\n \"(ucast (of_nat x :: word32) :: sword8) = (of_nat x)\"\n \"(ucast (of_nat x :: word16) :: sword16) = (of_nat x)\"\n \"(ucast (of_nat x :: word16) :: sword8) = (of_nat x)\"\n \"(ucast (of_nat x :: word8) :: sword8) = (of_nat x)\"\n apply (auto simp: ucast_of_nat is_down)\n done\n\nlemma nth_w2p_scast [simp]:\n \"((scast ((2::'a::len signed word) ^ n) :: 'a word) !! m)\n \\ ((((2::'a::len word) ^ n) :: 'a word) !! m)\"\n apply (subst nth_w2p)\n apply (case_tac \"n \\ len_of TYPE('a)\")\n apply (subst power_overflow, simp)\n apply clarsimp\n apply (metis nth_w2p scast_def bang_conj_lt\n len_signed nth_word_of_int word_sint.Rep_inverse)\n done\n\nlemma scast_2_power [simp]: \"scast ((2 :: 'a::len signed word) ^ x) = ((2 :: 'a word) ^ x)\"\n by (clarsimp simp: word_eq_iff)\n\nlemma scast_bit_test [simp]:\n \"scast ((1 :: 'a::len signed word) << n) = (1 :: 'a word) << n\"\n by (clarsimp simp: word_eq_iff)\n\nlemma ucast_nat_def':\n \"of_nat (unat x) = (ucast :: ('a :: len) word \\ ('b :: len) signed word) x\"\n by (simp add: ucast_def word_of_int_nat unat_def)\n\nlemma mod_mod_power_int:\n fixes k :: int\n shows \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ (min m n)\"\n by (metis bintrunc_bintrunc_min bintrunc_mod2p min.commute)\n\n(* Normalise combinations of scast and ucast. *)\n\nlemma ucast_distrib:\n fixes M :: \"'a::len word \\ 'a::len word \\ 'a::len word\"\n fixes M' :: \"'b::len word \\ 'b::len word \\ 'b::len word\"\n fixes L :: \"int \\ int \\ int\"\n assumes lift_M: \"\\x y. uint (M x y) = L (uint x) (uint y) mod 2 ^ len_of TYPE('a)\"\n assumes lift_M': \"\\x y. uint (M' x y) = L (uint x) (uint y) mod 2 ^ len_of TYPE('b)\"\n assumes distrib: \"\\x y. (L (x mod (2 ^ len_of TYPE('b))) (y mod (2 ^ len_of TYPE('b)))) mod (2 ^ len_of TYPE('b))\n = (L x y) mod (2 ^ len_of TYPE('b))\"\n assumes is_down: \"is_down (ucast :: 'a word \\ 'b word)\"\n shows \"ucast (M a b) = M' (ucast a) (ucast b)\"\n apply (clarsimp simp: word_of_int ucast_def)\n apply (subst lift_M)\n apply (subst of_int_uint [symmetric], subst lift_M')\n apply (subst (1 2) int_word_uint)\n apply (subst word_of_int)\n apply (subst word.abs_eq_iff)\n apply (subst (1 2) bintrunc_mod2p)\n apply (insert is_down)\n apply (unfold is_down_def)\n apply (clarsimp simp: target_size source_size)\n apply (clarsimp simp: mod_mod_power_int min_def)\n apply (rule distrib [symmetric])\n done\n\nlemma ucast_down_add:\n \"is_down (ucast:: 'a word \\ 'b word) \\ ucast ((a :: 'a::len word) + b) = (ucast a + ucast b :: 'b::len word)\"\n by (rule ucast_distrib [where L=\"op +\"], (clarsimp simp: uint_word_ariths)+, presburger, simp)\n\nlemma ucast_down_minus:\n \"is_down (ucast:: 'a word \\ 'b word) \\ ucast ((a :: 'a::len word) - b) = (ucast a - ucast b :: 'b::len word)\"\n apply (rule ucast_distrib [where L=\"op -\"], (clarsimp simp: uint_word_ariths)+)\n apply (metis zdiff_zmod_left zdiff_zmod_right)\n apply simp\n done\n\nlemma ucast_down_mult:\n \"is_down (ucast:: 'a word \\ 'b word) \\ ucast ((a :: 'a::len word) * b) = (ucast a * ucast b :: 'b::len word)\"\n apply (rule ucast_distrib [where L=\"op *\"], (clarsimp simp: uint_word_ariths)+)\n apply (metis mod_mult_eq)\n apply simp\n done\n\nlemma scast_distrib:\n fixes M :: \"'a::len word \\ 'a::len word \\ 'a::len word\"\n fixes M' :: \"'b::len word \\ 'b::len word \\ 'b::len word\"\n fixes L :: \"int \\ int \\ int\"\n assumes lift_M: \"\\x y. uint (M x y) = L (uint x) (uint y) mod 2 ^ len_of TYPE('a)\"\n assumes lift_M': \"\\x y. uint (M' x y) = L (uint x) (uint y) mod 2 ^ len_of TYPE('b)\"\n assumes distrib: \"\\x y. (L (x mod (2 ^ len_of TYPE('b))) (y mod (2 ^ len_of TYPE('b)))) mod (2 ^ len_of TYPE('b))\n = (L x y) mod (2 ^ len_of TYPE('b))\"\n assumes is_down: \"is_down (scast :: 'a word \\ 'b word)\"\n shows \"scast (M a b) = M' (scast a) (scast b)\"\n apply (subst (1 2 3) down_cast_same [symmetric])\n apply (insert is_down)\n apply (clarsimp simp: is_down_def target_size source_size is_down)\n apply (rule ucast_distrib [where L=L, OF lift_M lift_M' distrib])\n apply (insert is_down)\n apply (clarsimp simp: is_down_def target_size source_size is_down)\n done\n\nlemma scast_down_add:\n \"is_down (scast:: 'a word \\ 'b word) \\ scast ((a :: 'a::len word) + b) = (scast a + scast b :: 'b::len word)\"\n by (rule scast_distrib [where L=\"op +\"], (clarsimp simp: uint_word_ariths)+, presburger, simp)\n\nlemma scast_down_minus:\n \"is_down (scast:: 'a word \\ 'b word) \\ scast ((a :: 'a::len word) - b) = (scast a - scast b :: 'b::len word)\"\n apply (rule scast_distrib [where L=\"op -\"], (clarsimp simp: uint_word_ariths)+)\n apply (metis zdiff_zmod_left zdiff_zmod_right)\n apply simp\n done\n\nlemma scast_down_mult:\n \"is_down (scast:: 'a word \\ 'b word) \\ scast ((a :: 'a::len word) * b) = (scast a * scast b :: 'b::len word)\"\n apply (rule scast_distrib [where L=\"op *\"], (clarsimp simp: uint_word_ariths)+)\n apply (metis mod_mult_eq)\n apply simp\n done\n\n\n\nlemma scast_ucast_3:\n \"\\ is_down (ucast :: 'a word \\ 'c word); is_down (ucast :: 'b word \\ 'c word) \\ \\\n (scast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma scast_ucast_4:\n \"\\ is_up (ucast :: 'a word \\ 'b word); is_down (ucast :: 'b word \\ 'c word) \\ \\\n (scast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma scast_scast_b:\n \"\\ is_up (scast :: 'a word \\ 'b word) \\ \\\n (scast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n by (metis scast_def sint_up_scast)\n\nlemma ucast_scast_1:\n \"\\ is_down (scast :: 'a word \\ 'b word); is_down (ucast :: 'b word \\ 'c word) \\ \\\n (ucast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n by (metis scast_def ucast_down_wi)\n\n\n\nlemma ucast_scast_4:\n \"\\ is_up (scast :: 'a word \\ 'b word); is_down (ucast :: 'b word \\ 'c word) \\ \\\n (ucast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n by (metis down_cast_same scast_def sint_up_scast)\n\nlemma ucast_ucast_a:\n \"\\ is_down (ucast :: 'b word \\ 'c word) \\ \\\n (ucast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma ucast_ucast_b:\n \"\\ is_up (ucast :: 'a word \\ 'b word) \\ \\\n (ucast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n by (metis ucast_up_ucast)\n\nlemma scast_scast_a:\n \"\\ is_down (scast :: 'b word \\ 'c word) \\ \\\n (scast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n apply (clarsimp simp: scast_def)\n apply (metis down_cast_same is_up_down scast_def ucast_down_wi)\n done\n\nlemma scast_down_wi [OF refl]:\n \"uc = scast \\ is_down uc \\ uc (word_of_int x) = word_of_int x\"\n by (metis down_cast_same is_up_down ucast_down_wi)\n\nlemmas cast_simps =\n is_down is_up\n scast_down_add scast_down_minus scast_down_mult\n ucast_down_add ucast_down_minus ucast_down_mult\n scast_ucast_1 scast_ucast_3 scast_ucast_4\n ucast_scast_1 ucast_scast_3 ucast_scast_4\n ucast_ucast_a ucast_ucast_b\n scast_scast_a scast_scast_b\n ucast_down_bl\n ucast_down_wi scast_down_wi\n ucast_of_nat scast_of_nat\n uint_up_ucast sint_up_scast\n up_scast_surj up_ucast_surj\n\nlemma smod_mod_positive:\n \"\\ 0 \\ (a :: int); 0 \\ b \\ \\ a smod b = a mod b\"\n by (clarsimp simp: smod_int_alt_def zsgn_def)\n\nlemmas signed_shift_guard_simpler_32\n = power_strict_increasing_iff[where b=\"2 :: nat\" and y=31, simplified]\n\nlemma nat_mult_power_less_eq:\n \"b > 0 \\ (a * b ^ n < (b :: nat) ^ m) = (a < b ^ (m - n))\"\n using mult_less_cancel2[where m = a and k = \"b ^ n\" and n=\"b ^ (m - n)\"]\n mult_less_cancel2[where m=\"a * b ^ (n - m)\" and k=\"b ^ m\" and n=1]\n apply (simp only: power_add[symmetric] nat_minus_add_max)\n apply (simp only: power_add[symmetric] nat_minus_add_max ac_simps)\n apply (simp add: max_def split: split_if_asm)\n done\n\nlemma signed_shift_guard_to_word:\n \"\\ n < len_of TYPE ('a); n > 0 \\\n \\ (unat (x :: ('a :: len) word) * 2 ^ y < 2 ^ n)\n = (x = 0 \\ x < (1 << n >> y))\"\n apply (simp only: nat_mult_power_less_eq)\n apply (cases \"y \\ n\")\n apply (simp only: shiftl_shiftr1)\n apply (subst less_mask_eq)\n apply (simp add: word_less_nat_alt word_size)\n apply (rule order_less_le_trans[rotated], rule power_increasing[where n=1])\n apply simp\n apply simp\n apply simp\n apply (simp add: nat_mult_power_less_eq word_less_nat_alt word_size)\n apply auto[1]\n apply (simp only: shiftl_shiftr2, simp add: unat_eq_0)\n done\n\nlemma word32_31_less:\n \"31 < len_of TYPE (32 signed)\" \"31 > (0 :: nat)\"\n \"31 < len_of TYPE (32)\" \"31 > (0 :: nat)\"\n by auto\n\nlemmas signed_shift_guard_to_word_32\n = signed_shift_guard_to_word[OF word32_31_less(1-2)]\n signed_shift_guard_to_word[OF word32_31_less(3-4)]\n\nlemma sint_ucast_eq_uint:\n \"\\ \\ is_down (ucast :: ('a::len word \\ 'b::len word)) \\\n \\ sint ((ucast :: ('a::len word \\ 'b::len word)) x) = uint x\"\n apply (subst sint_eq_uint)\n apply (clarsimp simp: msb_nth nth_ucast is_down)\n apply (metis Suc_leI Suc_pred bang_conj_lt len_gt_0)\n apply (clarsimp simp: uint_up_ucast is_up is_down)\n done\n\nlemma word_less_nowrapI':\n \"(x :: 'a :: len0 word) \\ z - k \\ k \\ z \\ 0 < k \\ x < x + k\"\n by uint_arith\n\nlemma mask_plus_1:\n \"mask n + 1 = 2 ^ n\"\n by (clarsimp simp: mask_def)\n\nlemma unat_inj: \"inj unat\"\n by (metis eq_iff injI word_le_nat_alt)\n\nlemma unat_ucast_upcast:\n \"is_up (ucast :: 'b word \\ 'a word)\n \\ unat (ucast x :: ('a::len) word) = unat (x :: ('b::len) word)\"\n unfolding ucast_def unat_def\n apply (subst int_word_uint)\n apply (subst mod_pos_pos_trivial)\n apply simp\n apply (rule lt2p_lem)\n apply (clarsimp simp: is_up)\n apply simp\n done\n\nlemma ucast_mono:\n \"\\ (x :: 'b :: len word) < y; y < 2 ^ len_of TYPE('a) \\\n \\ ucast x < ((ucast y) :: ('a :: len) word)\"\n apply (simp add: ucast_nat_def [symmetric])\n apply (rule of_nat_mono_maybe)\n apply (rule unat_less_helper)\n apply (simp add: Power.of_nat_power)\n apply (simp add: word_less_nat_alt)\n done\n\nlemma ucast_mono_le:\n \"\\x \\ y; y < 2 ^ len_of TYPE('b)\\ \\ (ucast (x :: 'a :: len word) :: 'b :: len word) \\ ucast y\"\n apply (simp add: ucast_nat_def [symmetric])\n apply (subst of_nat_mono_maybe_le[symmetric])\n apply (rule unat_less_helper)\n apply (simp add: Power.of_nat_power)\n apply (rule unat_less_helper)\n apply (erule le_less_trans)\n apply (simp add: Power.of_nat_power)\n apply (simp add: word_le_nat_alt)\n done\n\nlemma zero_sle_ucast_up:\n \"\\ is_down (ucast :: 'a word \\ 'b signed word) \\\n (0 <=s ((ucast (b::('a::len) word)) :: ('b::len) signed word))\"\n apply (subgoal_tac \"\\ msb (ucast b :: 'b signed word)\")\n apply (clarsimp simp: word_sle_msb_le)\n apply (clarsimp simp: is_down not_le msb_nth nth_ucast)\n apply (subst (asm) bang_conj_lt [symmetric])\n apply clarsimp\n apply arith\n done\n\nlemma msb_ucast_eq:\n \"len_of TYPE('a) = len_of TYPE('b) \\\n msb (ucast x :: ('a::len) word) = msb (x :: ('b::len) word)\"\n apply (clarsimp simp: word_msb_alt)\n apply (subst ucast_down_drop [where n=0])\n apply (clarsimp simp: source_size_def target_size_def word_size)\n apply clarsimp\n done\n\nlemma msb_big:\n \"msb (a :: ('a::len) word) = (a \\ 2 ^ (len_of TYPE('a) - Suc 0))\"\n apply (rule iffI)\n apply (clarsimp simp: msb_nth)\n apply (drule bang_is_le)\n apply simp\n apply (rule ccontr)\n apply (subgoal_tac \"a = a && mask (len_of TYPE('a) - Suc 0)\")\n apply (cut_tac and_mask_less' [where w=a and n=\"len_of TYPE('a) - Suc 0\"])\n apply (clarsimp simp: word_not_le [symmetric])\n apply clarsimp\n apply (rule sym, subst and_mask_eq_iff_shiftr_0)\n apply (clarsimp simp: msb_shift)\n done\n\nlemma zero_sle_ucast:\n \"(0 <=s ((ucast (b::('a::len) word)) :: ('a::len) signed word))\n = (uint b < 2 ^ (len_of (TYPE('a)) - 1))\"\n apply (case_tac \"msb b\")\n apply (clarsimp simp: word_sle_msb_le not_less msb_ucast_eq del: notI)\n apply (clarsimp simp: msb_big word_le_def uint_2p_alt)\n apply (clarsimp simp: word_sle_msb_le not_less msb_ucast_eq del: notI)\n apply (clarsimp simp: msb_big word_le_def uint_2p_alt)\n done\n\n\n(* to_bool / from_bool. *)\n\ndefinition\n from_bool :: \"bool \\ 'a::len word\" where\n \"from_bool b \\ case b of True \\ of_nat 1\n | False \\ of_nat 0\"\n\nlemma from_bool_0:\n \"(from_bool x = 0) = (\\ x)\"\n by (simp add: from_bool_def split: bool.split)\n\ndefinition\n to_bool :: \"'a::len word \\ bool\" where\n \"to_bool \\ (op \\) 0\"\n\nlemma to_bool_and_1:\n \"to_bool (x && 1) = (x !! 0)\"\n apply (simp add: to_bool_def del: word_neq_0_conv)\n apply (rule iffI)\n apply (rule classical, erule notE, rule word_eqI)\n apply clarsimp\n apply (case_tac n, simp_all)[1]\n apply (rule notI, drule word_eqD[where x=0])\n apply simp\n done\n\nlemma to_bool_from_bool:\n \"to_bool (from_bool r) = r\"\n unfolding from_bool_def to_bool_def\n by (simp split: bool.splits)\n\nlemma from_bool_neq_0:\n \"(from_bool b \\ 0) = b\"\n by (simp add: from_bool_def split: bool.splits)\n\nlemma from_bool_mask_simp:\n \"((from_bool r) :: word32) && 1 = from_bool r\"\n unfolding from_bool_def\n apply (clarsimp split: bool.splits)\n done\n\nlemma scast_from_bool:\n \"scast (from_bool P::word32) = (from_bool P::word32)\"\n by (clarsimp simp: from_bool_def scast_id split: bool.splits)\n\nlemma from_bool_1:\n \"(from_bool P = 1) = P\"\n by (simp add: from_bool_def split: bool.splits)\n\nlemma ge_0_from_bool:\n \"(0 < from_bool P) = P\"\n by (simp add: from_bool_def split: bool.splits)\n\nlemma limited_and_from_bool:\n \"limited_and (from_bool b) 1\"\n by (simp add: from_bool_def limited_and_def split: bool.split)\n\nlemma to_bool_1 [simp]: \"to_bool 1\" by (simp add: to_bool_def)\nlemma to_bool_0 [simp]: \"\\to_bool 0\" by (simp add: to_bool_def)\n\nlemma from_bool_eq_if:\n \"(from_bool Q = (if P then 1 else 0)) = (P = Q)\"\n by (simp add: case_bool_If from_bool_def split: split_if)\n\nlemma to_bool_eq_0:\n \"(\\ to_bool x) = (x = 0)\"\n by (simp add: to_bool_def)\n\nlemma to_bool_neq_0:\n \"(to_bool x) = (x \\ 0)\"\n by (simp add: to_bool_def)\n\nlemma from_bool_all_helper:\n \"(\\bool. from_bool bool = val \\ P bool)\n = ((\\bool. from_bool bool = val) \\ P (val \\ 0))\"\n by (auto simp: from_bool_0)\n\nlemma word_rsplit_upt:\n \"\\ size x = len_of TYPE('a :: len) * n; n \\ 0 \\\n \\ word_rsplit x = map (\\i. ucast (x >> i * len_of TYPE ('a)) :: 'a word) (rev [0 ..< n])\"\n apply (subgoal_tac \"length (word_rsplit x :: 'a word list) = n\")\n apply (rule nth_equalityI, simp)\n apply (intro allI word_eqI impI)\n apply (simp add: test_bit_rsplit_alt word_size)\n apply (simp add: nth_ucast nth_shiftr nth_rev field_simps)\n apply (simp add: length_word_rsplit_exp_size)\n apply (metis mult.commute given_quot_alt word_size word_size_gt_0)\n done\n\nend\n", "meta": {"author": "jcaesar", "repo": "fixed-topos-header-space-analysis", "sha": "2da808ab41e5924d616ad1af15e8f50cb986c803", "save_path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis", "path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis/fixed-topos-header-space-analysis-2da808ab41e5924d616ad1af15e8f50cb986c803/thy/autocorres-0.98/lib/WordLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.26375474360949813}} {"text": "theory Typing_Lemmas\n imports Typing Lemmas\nbegin\n\nno_notation Set.member (\"(_/ : _)\" [51, 51] 50)\n\nlemma fun_ty_val: \"\\ \\ , \\ \\ e : \\1 \\ \\2 ; is_value e \\ \\ (\\x e'. e = (\\x:\\1. e')) \\ head_ctor e\"\n by (induction \\ \\ e \"\\1 \\ \\2\" rule: Tm.induct) auto\nlemma forall_ty_val: \"\\ \\ , \\ \\ e : \\a:k. \\ ; is_value e \\ \\ (\\x e'. e = (\\ x:k. e')) \\ head_ctor e\"\n by (induction \\ \\ e \"\\a:k. \\\" rule: Tm.induct) auto\n\nlemma context_cons_valid[elim]: \"(\\::\\) \\ bndr # \\ \\ (\\ \\ \\ \\ P) \\ P\"\n by (cases rule: Ctx.cases) (auto simp: context_valid(1))\n\n(* inversion rules for abstractions *)\nlemma T_Abs_Inv:\n assumes a: \"\\ , \\ \\ (\\x : \\1 . e) : \\\" and b: \"atom x \\ \\\"\n obtains \\2 where \"BVar x \\1 # \\ , \\ \\ e : \\2\" \"\\ = arrow_app \\1 \\2\"\nproof (cases rule: Tm.cases[OF a])\n case (2 x' \\1' \\' \\' e' \\2)\n then have swap: \"(x' \\ x) \\ e' = e\" using Abs_rename_body[of x' e' x e] by auto\n have valid: \"\\ \\\" using axioms_valid(3)[OF 2(5)] 2(2) by simp\n show ?thesis\n proof (cases \"atom x' = atom x\")\n case True\n then show ?thesis using 2 swap that by auto\n next\n case False\n then have 1: \"atom x \\ BVar x' \\1' # \\'\" using b by (simp add: 2 fresh_Cons)\n have 3: \"((x' \\ x) \\ (BVar x' \\1 # \\)) , \\ \\ (x' \\ x) \\ e' : \\2\" using 2 Tm.eqvt[OF 2(5), of \"(x' \\ x)\"] by fastforce\n have \"((x' \\ x) \\ (BVar x' \\1) # ((x' \\ x) \\ \\)) = BVar x \\1 # \\\"\n by (metis \"1\" \"2\"(1) \"2\"(5) CtxE(2) binder.perm_simps(1) context_valid_tm flip_at_simps(1) flip_fresh_fresh fresh_Cons perm_\\_vars)\n then show ?thesis using 1 2 3 swap that by auto\n qed\nqed simp_all\n\nlemma T_Abs_Inv_2:\n fixes \\::\\\n assumes a: \"\\ , \\ \\ (\\x:\\1. e) : \\\"\n obtains x' e' \\2 where \"BVar x' \\1 # \\ , \\ \\ e' : \\2\" \"(\\x:\\1. e) = (\\x':\\1. e')\" \"atom x' \\ (x, e)\" \"\\ = (\\1 \\ \\2)\"\nproof (cases rule: Tm.cases[OF a])\n case (2 x' _ _ _ e' \\2)\n then obtain c::var where \"atom c \\ (x, e, x', e', \\)\" using obtain_fresh by blast\n then have c: \"atom c \\ x\" \"atom c \\ e\" \"atom c \\ x'\" \"atom c \\ e'\" \"atom c \\ \\\" by auto\n obtain e2 where P: \"(x' \\ c) \\ (\\ x' : \\1 . e') = (\\ c : \\1 . e2)\" using flip_fresh_fresh by force\n then have 1: \"(x' \\ c) \\ e' = e2\" by (simp add: Abs1_eq_iff(3))\n have 3: \"(x' \\ c) \\ \\ = \\\" by (metis 2(1,5) CtxE(2) c(5) context_valid_tm flip_def swap_fresh_fresh)\n have 4: \"((x' \\ c) \\ BVar x' \\1) = BVar c \\1\" using P by auto\n have valid: \"\\ \\\" using axioms_valid(3)[OF 2(5)] 2(2) by simp\n have \"(x' \\ c) \\ (BVar x' \\1 # \\ , \\ \\ e' : \\2)\" using 2 by auto\n then have \"((x' \\ c) \\ (BVar x' \\1 # \\)) , \\ \\ (x' \\ c) \\ e' : \\2\" using valid by auto\n then have \"(((x' \\ c) \\ BVar x' \\1) # ((x' \\ c) \\ \\)) , \\ \\ e2 : \\2\" using 1 by auto\n then have x: \"BVar c \\1 # \\ , \\ \\ e2 : \\2\" using 3 4 by argo\n have y: \"(\\ x : \\1 . e) = (\\ c : \\1 . e2)\" by (metis 1 2(3) Abs1_eq_iff(3) c(3,4) flip_commute fresh_at_base(2) term.eq_iff(5))\n show ?thesis using that[OF x y] 2(3,4) c(1,2) by simp\nqed auto\n\nlemma T_Let_Inv:\n assumes a: \"\\ , \\ \\ Let x \\1 e1 e2 : \\\" and b: \"atom x \\ \\\"\n shows \"\\ , \\ \\ e1 : \\1 \\ BVar x \\1 # \\ , \\ \\ e2 : \\\"\nproof (cases rule: Tm.cases[OF a])\n case (7 \\' \\' e1' \\1' x' e2' \\2')\n have swap: \"(x' \\ x) \\ e2' = e2\" using Abs_rename_body[of x' e2' x e2] 7(3) by simp\n show ?thesis\n proof (cases \"atom x' = atom x\")\n case True\n then show ?thesis using 7 swap by auto\n next\n case False\n then have 1: \"atom x \\ BVar x' \\1 # \\'\" using b by (simp add: 7 fresh_Cons)\n have 2: \"((x' \\ x) \\ (BVar x' \\1#\\)) , \\ \\ (x' \\ x) \\ e2' : \\\" using Tm.eqvt[OF 7(6), of \"(x' \\ x)\"] 7 by auto\n have 3: \"((x' \\ x) \\ (BVar x' \\1) # ((x' \\ x) \\ \\)) = BVar x \\1#\\\"\n by (metis \"1\" 7(1,6) CtxE(2) binder.perm_simps(1) context_valid_tm flip_at_simps(1) flip_def fresh_Cons perm_\\_vars swap_fresh_fresh)\n from 2 3 7 swap show ?thesis by auto\n qed\nqed simp_all\n\nlemma T_AbsT_Inv:\n assumes a: \"\\ , \\ \\ (\\ a : k . e) : \\\" and b: \"atom a \\ \\\" \"atom a \\ \\\"\n obtains \\ where \"BTyVar a k # \\ , \\ \\ e : \\\" \"\\ = (\\ a:k. \\)\"\nproof (cases rule: Tm.cases[OF a])\n case (4 a' k' \\' \\' e' \\')\n then have fresh: \"atom a' \\ \\\" by (cases rule: Ctx.cases[OF context_valid(2)[OF 4(5)]]) auto\n have swap: \"(a' \\ a) \\ e' = e\" using Abs_rename_body[of a' e' a e] 4(3) by simp\n have valid: \"\\ \\\" using axioms_valid(3)[OF 4(5)] 4(2) by simp\n show ?thesis\n proof (cases \"atom a = atom a'\")\n case True\n then show ?thesis by (metis 4 Abs1_eq_iff(3) atom_eq_iff term.eq_iff(6) that)\n next\n case False\n then have 1: \"atom a \\ BTyVar a' k # \\\" using b by (simp add: 4 fresh_Cons)\n have 2: \"((a' \\ a) \\ (BTyVar a' k # \\)), \\ \\ (a' \\ a) \\ e' : (a' \\ a) \\ \\'\" using Tm.eqvt[OF 4(5), of \"(a' \\ a)\"] valid 4 by auto\n have \"((a' \\ a) \\ (BTyVar a' k # \\)) = ((a' \\ a) \\ BTyVar a' k) # \\\" using 1 fresh flip_fresh_fresh b(1) by simp\n then have \"((a' \\ a) \\ (BTyVar a' k # \\)) = BTyVar a k # \\\" by (simp add: flip_fresh_fresh)\n then have \"BTyVar a k # \\ , \\ \\ e : (a' \\ a) \\ \\'\" using 2 swap by argo\n then show ?thesis by (metis \"4\"(3,4) Abs1_eq_iff(3) False \\.eq_iff(5) \\.fresh(5) b(2) empty_iff flip_commute insert_iff list.set(1,2) term.eq_iff(6) that)\n qed\nqed simp_all\n\nlemma Ty_Forall_Inv:\n assumes a: \"\\ , \\ \\\\<^sub>t\\<^sub>y (\\a:k. \\) : \\\" and b: \"atom a \\ \\\"\n shows \"BTyVar a k # \\ , \\ \\\\<^sub>t\\<^sub>y \\ : \\ \\ \\ = \\\"\nproof (cases rule: Ty.cases[OF a])\n case (5 a' k' \\' \\' \\')\n then have 1: \"(BTyVar a' k # \\) , \\ \\\\<^sub>t\\<^sub>y \\' : \\\" by simp\n have valid: \"\\ \\\" by (rule axioms_valid(2)[OF 1])\n have \"(a' \\ a) \\ \\' = \\\" using Abs_rename_body[of a' \\' a \\] 5(3) by auto\n then have 2: \"((a' \\ a) \\ (BTyVar a' k # \\)) , \\ \\\\<^sub>t\\<^sub>y \\ : \\\" using Ty.eqvt[OF 1, of \"(a' \\ a)\"] valid by auto\n have 3: \"((a' \\ a) \\ (BTyVar a' k # \\)) = BTyVar a k # ((a' \\ a) \\ \\)\" using Cons_eqvt flip_fresh_fresh by force\n have 4: \"(a' \\ a) \\ \\ = \\\" by (metis 5(1,5) CtxE(1) b context_valid_ty flip_def swap_fresh_fresh)\n show ?thesis using 2 3 4 5(4) by argo\nqed simp_all\n\nlemma Ty_Forall_Inv_2:\n assumes a: \"\\ , \\ \\\\<^sub>t\\<^sub>y \\ a : k . \\ : k2\"\n obtains a' \\' where \"(\\ a:k. \\) = (\\ a':k. \\')\" \"BTyVar a' k # \\ , \\ \\\\<^sub>t\\<^sub>y \\' : \\\" \"atom a' \\ (a, \\)\" \"k2 = \\\"\nproof (cases rule: Ty.cases[OF a])\n case (5 a2 _ _ _ \\2)\n then obtain c::tyvar where \"atom c \\ (a, \\, a2, \\2, \\)\" using obtain_fresh by blast\n then have c: \"atom c \\ a\" \"atom c \\ \\\" \"atom c \\ a2\" \"atom c \\ \\2\" \"atom c \\ \\\" by auto\n obtain \\' where P: \"(a2 \\ c) \\ (\\ a2:k. \\2) = (\\ c:k. \\')\" using flip_fresh_fresh by force\n then have 1: \"(a2 \\ c) \\ \\2 = \\'\" by (simp add: Abs1_eq_iff(3))\n have 2: \"(a2 \\ c) \\ \\ = \\\" by (metis 5(1,5) CtxE(1) c(5) context_valid_ty flip_def swap_fresh_fresh)\n have 3: \"((a2 \\ c) \\ BTyVar a2 k) = BTyVar c k\" using P by auto\n have valid: \"\\ \\\" using axioms_valid(2)[OF 5(5)] 5(2) by simp\n have \"(a2 \\ c) \\ (BTyVar a2 k # \\ , \\ \\\\<^sub>t\\<^sub>y \\2 : \\)\" using 5 by auto\n then have \"((a2 \\ c) \\ (BTyVar a2 k # \\)) , \\ \\\\<^sub>t\\<^sub>y (a2 \\ c) \\ \\2 : \\\" using valid by auto\n then have \"(((a2 \\ c) \\ BTyVar a2 k) # ((a2 \\ c) \\ \\)) , \\ \\\\<^sub>t\\<^sub>y \\' : \\\" using 1 by auto\n then have x: \"BTyVar c k # \\ , \\ \\\\<^sub>t\\<^sub>y \\' : \\\" using 2 3 by argo\n have y: \"(a2 \\ c) \\ (\\ a2:k. \\2) = (\\ a2:k. \\2)\" by (metis \\.fresh(5) c(4) flip_def insert_iff list.set(2) no_tyvars_in_kinds swap_fresh_fresh)\n show ?thesis using that[OF _ x _ 5(4)] c(1,2) by (metis 5(3) P \\.eq_iff(5) fresh_Pair y)\nqed simp_all\n\nlemma axiom_isin_same_kind: \"\\ AxData T k1 \\ set (\\' @ AxData T k2 # \\) ; \\ (\\' @ AxData T k2 # \\) \\ \\ k1 = k2\"\nproof (induction \\')\n case Nil\n then have \"\\k. AxData T k \\ set \\\" by auto\n then show ?case using Nil.prems(1) by auto\nnext\n case (Cons a \\')\n then show ?case using axioms_valid(2)\n proof (cases a rule: axiom.exhaust)\n case (AxData T' k3)\n then have \"\\k. AxData T' k \\ set (\\' @ AxData T k2 # \\)\" using Cons(3) by fastforce\n then have \"T' \\ T\" by auto\n then show ?thesis using Cons AxData by auto\n qed fastforce\nqed\n\nlemma axiom_isin_same_type: \"\\ AxCtor D \\1 \\ set (\\' @ AxCtor D \\2 # \\) ; \\ (\\' @ AxCtor D \\2 # \\) \\ \\ \\1 = \\2\"\nproof (induction \\')\n case Nil\n then have \"\\t. AxCtor D t \\ set \\\" by auto\n then show ?case using Nil(1) by auto\nnext\n case (Cons a \\')\n then show ?case\n proof (cases a rule: axiom.exhaust)\n case (AxCtor D' \\')\n then have \"\\t. AxCtor D' t \\ set (\\' @ AxCtor D \\2 # \\)\" using Cons(3) by fastforce\n then have \"D' \\ D\" by auto\n then show ?thesis using AxCtor Cons axioms_valid_aux(2) set_ConsD by auto\n qed auto\nqed\nlemmas axiom_isin_same = axiom_isin_same_kind axiom_isin_same_type\n\nlemma axiom_isin_split: \"\\ b \\ set \\ ; \\ \\ \\ \\ \\\\1 \\2. \\ = \\1 @ b # \\2\"\nproof (induction \\)\n case (Cons a \\)\n then show ?case\n proof (cases \"a = b\")\n case True\n then show ?thesis by blast\n next\n case False\n then show ?thesis by (meson Cons.prems(1) split_list)\n qed\nqed simp\n\nlemma axioms_split_valid: \"\\ \\' @ \\ \\ \\ \\\"\nproof (induction \\')\n case (Cons a \\')\n then show ?case using axioms_valid(2) by (cases a rule: axiom.exhaust) auto\nqed simp\n\nlemma isin_subset:\n fixes \\::\"\\\"\n assumes \"\\ \\ \\' @ \\\"\n shows \"bndr \\ \\ \\ bndr \\ (\\' @ \\)\"\nproof\n assume \"bndr \\ \\\"\n then show \"bndr \\ (\\' @ \\)\"\n using assms proof (induction \\' arbitrary: \\)\n case (Cons b \\2)\n have 1: \"\\ \\ \\2 @ \\\" using Cons(3) by auto\n have 2: \"bndr \\ (\\2 @ \\)\" by (rule Cons(1)[OF Cons(2) 1])\n show ?case\n proof (cases b rule: binder.exhaust)\n case (BVar x \\)\n then have \"atom x \\ (\\2 @ \\)\" using Cons by auto\n then show ?thesis using 2 BVar fresh_not_isin_var by (cases bndr rule: binder.exhaust) auto\n next\n case (BTyVar a k)\n then have \"atom a \\ (\\2 @ \\)\" using Cons by auto\n then show ?thesis using 2 BTyVar fresh_not_isin_tyvar by (cases bndr rule: binder.exhaust) auto\n qed\n qed auto\nqed\n\nlemma isin_superset_tyvar: \"\\ BTyVar a k \\ (\\' @ BVar x \\ # \\) ; \\ \\ \\' @ BVar x \\ # \\ \\ \\ BTyVar a k \\ (\\' @ \\)\"\nproof (induction \\')\n case (Cons bndr \\')\n then show ?case by (cases bndr rule: binder.exhaust) auto\nqed auto\n\nlemma isin_superset_var: \"\\ BVar x \\ \\ (\\' @ BVar y \\2 # \\) ; \\ \\ \\' @ BVar y \\2 # \\ ; x \\ y \\ \\ BVar x \\ \\ (\\' @ \\)\"\nproof (induction \\')\n case (Cons bndr \\')\n then show ?case by (cases bndr rule: binder.exhaust) auto\nqed auto\nlemmas isin_superset = isin_superset_tyvar isin_superset_var\n\nlemma isin_same_kind: \"\\ BTyVar a k1 \\ (\\' @ BTyVar a k2 # \\) ; \\ \\ \\' @ BTyVar a k2 # \\ \\ \\ k1 = k2\"\nproof (induction \\')\n case (Cons bndr \\')\n then show ?case by (cases rule: Ctx.cases[OF Cons(3)]) (auto split: if_splits simp: fresh_Cons fresh_append fresh_at_base(2))\nqed auto\n\nlemma isin_same_type: \"\\ BVar x \\ \\ (\\' @ BVar x \\2 # \\) ; \\ \\ \\' @ BVar x \\2 # \\ \\ \\ \\ = \\2\"\nproof (induction \\')\n case (Cons a \\')\n then show ?case by (cases rule: Ctx.cases[OF Cons(3)]) (auto split: if_splits simp: fresh_Cons fresh_append fresh_at_base)\nqed auto\nlemmas isin_same = isin_same_kind isin_same_type\n\nlemma isin_subst_tyvar: \"\\ BTyVar a k \\ (\\' @ BTyVar b k2 # \\) ; \\ \\ \\' @ BTyVar b k2 # \\ ; a \\ b \\ \\ BTyVar a k \\ (\\'[\\/b] @ \\)\"\nproof (induction \\')\n case (Cons bndr \\')\n then show ?case\n proof (cases rule: Ctx.cases[OF Cons(3)])\n case (2 \\2 c k3)\n then have \"BTyVar a k = bndr \\ BTyVar a k \\ (\\' @ BTyVar b k2 # \\)\" by (metis Cons.prems(1) Cons_eq_append_conv isin.simps(5) list.inject)\n then show ?thesis\n proof\n assume a: \"BTyVar a k = bndr\"\n then show ?thesis using 2 Cons by auto\n next\n assume \"BTyVar a k \\ (\\' @ BTyVar b k2 # \\)\"\n then show ?thesis using 2 Cons fresh_not_isin_tyvar by auto\n qed\n next\n case (3 \\ \\ x)\n then show ?thesis using Cons by auto\n qed simp\nqed simp\n\nlemma context_split_valid: \"(\\::\\) \\ (\\' @ \\) \\ \\ \\ \\\"\n by (induction \\') (auto simp: Ctx_Empty)\n\nlemma isin_split: \"\\ b \\ \\ ; \\ \\ \\ \\ \\ \\\\1 \\2. \\ = \\1 @ b # \\2\"\nproof (induction \\)\n case (Cons bndr \\)\n then show ?case\n proof (cases \"bndr = b\")\n case False\n then have \"b \\ \\\"\n proof (cases bndr rule: binder.exhaust)\n case (BVar x \\)\n then show ?thesis using False Cons by (cases b rule: binder.exhaust) auto\n next\n case (BTyVar a k)\n then show ?thesis using False Cons by (cases b rule: binder.exhaust) auto\n qed\n then show ?thesis by (metis Cons.IH Cons.prems(2) Cons_eq_appendI context_cons_valid)\n qed blast\nqed auto\n\nlemma axioms_regularity: \"\\ \\' @ AxCtor D \\ # \\ \\ [] , \\ \\\\<^sub>t\\<^sub>y \\ : \\\"\n using Ax_Ctor axioms_split_valid by (induction \\) blast+\n\nlemma context_regularity: \"\\ \\ \\' @ BVar x \\ # \\ \\ \\ , \\ \\\\<^sub>t\\<^sub>y \\ : \\\"\n using Ctx_Var context_split_valid by (induction \\) blast+\n\nlemma Tm_eqvt_tyvar:\n assumes \"BTyVar a k # \\ , \\ \\ e : \\\" \"atom c \\ \\\"\n shows \"BTyVar c k # \\ , \\ \\ (a \\ c) \\ e : (a \\ c) \\ \\\"\nproof -\n have \"\\ \\\" by (rule axioms_valid(3)[OF assms(1)])\n then have 1: \"(a \\ c) \\ \\ = \\\" by auto\n have \"\\ \\ BTyVar a k # \\\" by (rule context_valid(2)[OF assms(1)])\n then have 2: \"(a \\ c) \\ \\ = \\\" using assms(2) flip_fresh_fresh by blast\n have 3: \"(a \\ c) \\ BTyVar a k = BTyVar c k\" using flip_fresh_fresh by force\n\n have \"(a \\ c) \\ (BTyVar a k # \\) , (a \\ c) \\ \\ \\ (a \\ c) \\ e : (a \\ c) \\ \\\" by (rule Tm.eqvt[OF assms(1), of \"(a \\ c)\"])\n then show ?thesis using 1 2 3 by auto\nqed\n\nend\n", "meta": {"author": "jvanbruegge", "repo": "isabelle-lambda-calculus", "sha": "41fba58ed18fcb494b6b7abb6c8641a63002a1d5", "save_path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus", "path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus/isabelle-lambda-calculus-41fba58ed18fcb494b6b7abb6c8641a63002a1d5/Typing_Lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.26375474360949813}} {"text": "theory CFGExit_wf imports CFGExit CFG_wf begin\n\nsubsection \\New well-formedness lemmas using \\(_Exit_)\\\\\n\nlocale CFGExit_wf = CFGExit sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit +\n CFG_wf sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Def Use ParamDefs ParamUses\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") \n and Def :: \"'node \\ 'var set\" and Use :: \"'node \\ 'var set\"\n and ParamDefs :: \"'node \\ 'var list\" \n and ParamUses :: \"'node \\ 'var set list\" +\n assumes Exit_empty:\"Def (_Exit_) = {} \\ Use (_Exit_) = {}\"\n\nbegin\n\nlemma Exit_Use_empty [dest!]: \"V \\ Use (_Exit_) \\ False\"\nby(simp add:Exit_empty)\n\nlemma Exit_Def_empty [dest!]: \"V \\ Def (_Exit_) \\ False\"\nby(simp add:Exit_empty)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/StaticInter/CFGExit_wf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.26371455255145854}} {"text": "(*\n * Copyright 2017, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ArchArraysMemInstance\nimports \"../ArraysMemInstance\"\nbegin\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass array_outer_max_size = mem_type +\n assumes array_outer_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 19\"\n\nclass array_max_count = finite +\n assumes array_max_count_ax: \"CARD ('a) <= 2 ^ 13\"\n\ninstance array :: (array_outer_max_size, array_max_count) mem_type\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ (addr_bitsize - 19) * 2 ^ 19\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 19\"])\n apply (rule mult_less_mono2)\n apply (rule array_outer_max_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule le_trans[where j = \"2 ^ 13\"])\n apply (rule array_max_count_ax)\n apply simp\n apply simp\napply (simp add: addr_card)\ndone\n\nclass array_inner_max_size = array_outer_max_size +\n assumes array_inner_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstance array :: (array_inner_max_size, array_max_count) array_outer_max_size\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule array_max_count_ax)\n apply (rule array_inner_max_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\ninstance word :: (len8) array_outer_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance word :: (len8) array_inner_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance ptr :: (c_type) array_outer_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\ninstance ptr :: (c_type) array_inner_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\nclass lt12 = finite +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 +\n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstance bit0 :: (lt12) array_max_count\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt12) array_max_count\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance num1 :: lt1\n by (intro_classes, simp_all)\n\n(* don't understand why this also seems to be necessary *)\ninstance num1 :: array_max_count\n by (intro_classes, simp)\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n array_max_count *)\ndatatype array_max_count_ty = array_max_count_ty \"8192\"\n\n(* ML c-parser code also needs to know at which array size to use this type *)\nML \\\n structure ArchArrayMaxCount = struct\n val array_max_count = 8192\n end\n\\\n\nlemma univ_array_max_count_ty:\n \"(UNIV::array_max_count_ty set) = image array_max_count_ty (UNIV::8192 set)\"\n apply (simp add: set_eq_iff image_iff)\n apply (rule_tac allI)\n apply (rule_tac array_max_count_ty.induct)\n apply simp\n done\n\ninstance \"array_max_count_ty\" :: finite\n apply intro_classes\n apply (simp add: univ_array_max_count_ty)\n done\n\nlemma card_array_max_count_ty[simp]: \"CARD(array_max_count_ty) = CARD(8192)\"\n apply (simp add: univ_array_max_count_ty card_image inj_on_def)\n done\n\ninstance \"array_max_count_ty\" :: array_max_count\n by intro_classes simp\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/ARM_HYP/ArchArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2637145525514585}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory CheriInstantiation\n\nimports \n \"ExecutionStep\"\n \"ValidState\"\n \"AddressTranslation\"\n \"Execute\"\n \"LoadData\"\n \"StoreData\"\n \"RestrictCap\"\n \"LoadCap\"\n \"StoreCap\"\n \"SealCap\"\n \"UnsealCap\"\n \"Exception\"\n \"InvokeCap\"\n \"MemoryInvariant\"\n \"CapabilityInvariant\"\n \"SystemRegisterAccess\"\nbegin\n\n(*>*)\n\ntheorem CheriInstantiation:\n shows \"CanBeSimulated SemanticsCheriMips\"\nunfolding CanBeSimulated_def\nproof clarify\n fix s lbl s'\n assume as: \"(lbl, s') \\ SemanticsCheriMips s\"\n show \"(lbl, s') \\ AbstractSemantics s\"\n unfolding AbstractSemantics_def\n using AddressTranslationInstantiation[OF as]\n using ExceptionInstantiation[OF as]\n using ExecuteInstantiation[OF as]\n using CapabilityInvariantInstantiation[OF as]\n using InvokeCapInstantiation[OF as]\n using LoadCapInstantiation[OF as]\n using LoadDataInstantiation[OF as]\n using MemoryInvariantInstantiation[OF as]\n using RestrictCapInstantiation[OF as]\n using SealCapInstantiation[OF as]\n using StoreCapInstantiation[OF as]\n using StoreLocalCapInstantiation[OF as]\n using StoreDataInstantiation[OF as]\n using UnsealCapInstantiation[OF as]\n using SystemRegisterInstantiation[OF as]\n using ValidStateInstantiation[OF as]\n by auto\nqed\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/instantiation/CheriInstantiation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.712232184238947, "lm_q2_score": 0.3702253856469203, "lm_q1q2_score": 0.26368643508001255}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * A theoretical framework for reasoning about non-interference\n * of monadic programs.\n *)\n\ntheory EquivValid\nimports Corres_UL\nbegin\n\nsection\\State equivalence validity\\\n\ntext\\\n\nA generalised information flow property.\n\nOften, we read in the entire state, but then only examine part of it.\nThe following property may be used to split up binds whose first part\ndoes this.\n\n@{term \"I\"} is the state relation that holds invariantly.\n\n@{term \"A\"} (also) holds between initial states.\n\n@{term \"B\"} (also) holds between final states.\n\n@{term \"P\"} holds in the initial state for @{term \"f\"}.\n\n@{term \"P'\"} holds in the initial state for @{term \"f'\"}.\n\n\\\n\ndefinition\n equiv_valid_2 :: \"('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('b \\ 'c \\ bool) \\ ('s \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ ('s,'c) nondet_monad \\ bool\"\nwhere\n \"equiv_valid_2 I A B R P P' f f' \\ \\s t.\n P s \\ P' t \\ I s t \\ A s t\n \\ (\\(rva, s') \\ fst (f s). \\(rvb, t') \\ fst (f' t).\n R rva rvb \\ I s' t' \\ B s' t')\"\n\nlemma equiv_valid_2_bind_general:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n shows \"equiv_valid_2 D A C R (\\ s. P s \\ S s) (\\ s. P' s \\ S' s) (f >>= g) (f' >>= g')\"\n using assms\n unfolding bind_def equiv_valid_2_def valid_def\n apply fastforce\n done\n\n(* almost all of the time, the second relation doesn't change *)\nlemma equiv_valid_2_bind:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n shows \"equiv_valid_2 D A A R (\\ s. P s \\ S s) (\\ s. P' s \\ S' s) (f >>= g) (f' >>= g')\"\n using assms by (blast intro: equiv_valid_2_bind_general)\n\nlemma equiv_valid_2_guard_imp:\n assumes reads_res: \"equiv_valid_2 D A B R Q Q' f f'\"\n assumes guard_imp: \"\\ s. P s \\ Q s\"\n assumes guard_imp': \"\\ s. P' s \\ Q' s\"\n shows \"equiv_valid_2 D A B R P P' f f'\"\n using assms\n by (fastforce simp: equiv_valid_2_def)\n\nlemma equiv_valid_2_bind_pre:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes guard_imp: \"\\ s. T s \\ P s \\ S s\"\n assumes guard_imp': \"\\ s. T' s \\ P' s \\ S' s\"\n shows \"equiv_valid_2 D A A R T T' (f >>= g) (f' >>= g')\"\n using assms by (blast intro: equiv_valid_2_bind[THEN equiv_valid_2_guard_imp])\n\nlemma return_ev2:\n assumes rel: \"\\ s t. \\P s; P' t; I s t; A s t\\ \\ R a b\"\n shows \"equiv_valid_2 I A A R P P' (return a) (return b)\"\n by(auto simp: equiv_valid_2_def return_def rel)\n\nlemma equiv_valid_2_liftE:\n \"equiv_valid_2 D A B R P P' f f' \\\n equiv_valid_2 D A B (E \\ R) P P' (liftE f) (liftE f')\"\n apply(unfold liftE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac Q=\"\\\\\" and Q'=\"\\\\\" and R'=R in equiv_valid_2_bind_general)\n apply(fastforce intro: return_ev2)\n apply assumption\n apply(rule wp_post_taut)+\n by(simp_all)\n\nlemma equiv_valid_2_liftE_bindE_general:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n shows \"equiv_valid_2 D A C R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" and Q'=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q' v s)\" in equiv_valid_2_bind_general)\n prefer 2\n apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n apply(rule r1)\n apply(clarsimp simp: lift_def split: sum.split)\n apply(insert r2, fastforce simp: equiv_valid_2_def)[1]\n apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare])\n apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare'])\n by(auto)\n\nlemma equiv_valid_2_liftE_bindE:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n shows \"equiv_valid_2 D A A R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n using assms by(blast intro: equiv_valid_2_liftE_bindE_general)\n\nlemma equiv_valid_2_rvrel_imp:\n \"\\equiv_valid_2 I A A R P P' f f'; \\ s t. R s t \\ R' s t\\ \\\n equiv_valid_2 I A A R' P P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nsubsection\\Specialised fixed-state state equivalence validity\\\n\ntext\\\n\nFor resolve_address_bits and rec_del: talk about a fixed initial\nstate. Note we only do this for one of the computations; the other\nstate can be constrained by how it is related to this one by @{term\n\"I\"} and so forth.\n\nAlso captures the typical case where the relation between the return\nvalues is equality and the required preconditions are identical.\n\nwp can cope with this.\n\n\\\n\ndefinition\n spec_equiv_valid :: \"'s \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ bool\"\nwhere\n \"spec_equiv_valid st I A B P f \\ equiv_valid_2 I A B (=) (P and ((=) st)) P f f\"\n\nabbreviation spec_equiv_valid_inv where\n \"spec_equiv_valid_inv st I A P f \\ spec_equiv_valid st I A A P f\"\n\nsubsection\\Specialised state equivalence validity\\\n\ntext\\\n\nMost of the time we deal with the streamlined version.\n\nwp can cope with this too.\n\n\\\n\ndefinition\n equiv_valid :: \"('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ bool\"\nwhere\n \"equiv_valid I A B P f \\ \\st. spec_equiv_valid st I A B P f\"\n\nlemma equiv_valid_def2:\n \"equiv_valid I A B P f = equiv_valid_2 I A B (=) P P f f\"\n by (simp add: equiv_valid_def spec_equiv_valid_def equiv_valid_2_def)\n\nabbreviation equiv_valid_rv where\n \"equiv_valid_rv I A B R P f \\ equiv_valid_2 I A B R P P f f\"\n\n(* this is probably way more general than we need for all but a few special cases *)\nlemma bind_ev_general:\n assumes reads_res_2: \"\\rv. equiv_valid I B C (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid I A B P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\\"\n shows \"equiv_valid I A C (\\s. P' s \\ P'' s) (f >>= g)\"\n unfolding equiv_valid_def2\n apply (rule equiv_valid_2_bind_general[where R'=\"(=)\"])\n apply (auto intro: reads_res_1[unfolded equiv_valid_def2] reads_res_2[unfolded equiv_valid_def2])[2]\n apply (rule hoare)\n apply (rule hoare)\n done\n\nlemma bind_ev:\n assumes reads_res_2: \"\\rv. equiv_valid I A A (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid I A A P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\\"\n shows \"equiv_valid I A A (\\s. P' s \\ P'' s) (f >>= g)\"\n using assms by (blast intro: bind_ev_general)\n\nlemma equiv_valid_weaken_pre:\n \"\\ equiv_valid I A' B P f; \\st t. I st t \\ A st t \\ A' st t \\\n \\ equiv_valid I A B P f\"\n by (fastforce simp: equiv_valid_def spec_equiv_valid_def equiv_valid_2_def)\n\nlemma equiv_valid_guard_imp:\n assumes reads_res: \"equiv_valid I A B Q f\"\n assumes guard_imp: \"\\ s. P s \\ Q s\"\n shows \"equiv_valid I A B P f\"\n using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\nlemmas bind_ev_pre = bind_ev[THEN equiv_valid_guard_imp]\n\nlemma gen_asm_ev':\n assumes \"Q \\ equiv_valid D A B P f\"\n shows \"equiv_valid D A B (P and K Q) f\"\n using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\ndeclare K_def [simp del]\n\nlemmas gen_asm_ev =\n gen_asm_ev'[where P=\"\\\", simplified]\n gen_asm_ev'\n gen_asm_ev'[simplified K_def, where P=\"\\\", simplified]\n gen_asm_ev'[simplified K_def]\n\ndeclare K_def [simp]\n\ntext \\\n This is a further streamlined version that we expect to get the most from\n automating, and for the most part, we shouldn't need to deal with the\n extra generality of the properties above.\n\\\nabbreviation equiv_valid_inv where\n \"equiv_valid_inv I A P f \\ equiv_valid I A A P f\"\n\nabbreviation equiv_valid_rv_inv where\n \"equiv_valid_rv_inv I A R P f \\ equiv_valid_rv I A A R P f\"\n\nlemma get_evrv:\n \"equiv_valid_rv_inv I A (I and A) \\ get\"\n by(auto simp: equiv_valid_2_def get_def)\n\nlemma equiv_valid_rv_bind_general:\n assumes ev1:\n \"equiv_valid_rv I A B W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I B C R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv I A C R P (f >>= g)\"\n apply(rule equiv_valid_2_guard_imp)\n apply(rule equiv_valid_2_bind_general[OF ev2])\n apply(assumption)\n apply(rule ev1)\n apply(rule hoare)\n apply(rule hoare)\n apply(simp_all)\n done\n\nlemma equiv_valid_rv_bind:\n assumes ev1:\n \"equiv_valid_rv_inv I A W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv_inv I A R P (f >>= g)\"\n using assms by(blast intro: equiv_valid_rv_bind_general)\n\nlemma modify_ev2:\n assumes \"\\ s t. \\I s t; A s t; P s; P' t\\ \\ R () () \\ I (f s) (f' t) \\ B (f s) (f' t)\"\n shows\n \"equiv_valid_2 I A B R P P' (modify f) (modify f')\"\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n using assms by auto\n\nlemma modify_ev:\n \"equiv_valid I A B\n (\\ s. \\ s t. I s t \\ A s t \\ I (f s) (f t) \\ B (f s) (f t))\n (modify f)\"\n apply(clarsimp simp:equiv_valid_def2)\n apply(rule modify_ev2)\n by auto\n\nlemma modify_ev':\n \"equiv_valid I A B\n (\\ s. \\ t. I s t \\ A s t \\ I (f s) (f t) \\ B (f s) (f t))\n (modify f)\"\n apply(clarsimp simp:equiv_valid_def2)\n apply(rule modify_ev2)\n by auto\n\nlemma modify_ev'':\n assumes \"\\ s t. \\I s t; A s t; P s; P t\\ \\ I (f s) (f t) \\ B (f s) (f t)\"\n shows \"equiv_valid I A B P (modify f)\"\n apply(clarsimp simp:equiv_valid_def2)\n apply(rule modify_ev2)\n using assms by auto\n\n\nlemma put_ev2:\n assumes \"\\ s t. \\I s t; A s t; P s; P' t\\ \\ R () () \\ I x x' \\ B x x'\"\n shows\n \"equiv_valid_2 I A B R P P' (put x) (put x')\"\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n using assms by auto\n\n\nlemma get_bind_ev2:\n assumes \"\\ rv rv'. \\I rv rv'; A rv rv'\\ \\ equiv_valid_2 I A B R (P and ((=) rv)) (P' and ((=) rv')) (f rv) (f' rv')\"\n shows \"equiv_valid_2 I A B R P P' (get >>= f) (get >>= f')\"\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"I and A\" in equiv_valid_2_bind_general)\n apply(rule assms, simp+)\n apply(rule get_evrv)\n apply(wp get_sp)+\n by(auto)\n\n\nlemma return_ev_pre:\n \"equiv_valid_inv I A P (return x)\"\n apply (simp add: equiv_valid_def2 return_ev2)\n done\n\nlemmas return_ev = return_ev_pre[where P=\\]\n\nlemma fail_ev2_l:\n \"equiv_valid_2 I A B R P P' fail f'\"\n by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev2_r:\n \"equiv_valid_2 I A B R P P' f fail\"\n by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev_pre:\n \"equiv_valid I A B P fail\"\n apply (simp add: equiv_valid_def2 fail_ev2_l)\n done\n\nlemmas fail_ev = fail_ev_pre[where P=\\]\n\nlemma assert_ev2:\n \"R () () \\ equiv_valid_2 I A A R P P' (assert a) (assert b)\"\n apply(simp add: assert_def fail_ev2_l fail_ev2_r)\n apply(blast intro: return_ev2)\n done\n\nlemma liftE_ev:\n \"equiv_valid I A B P f \\ equiv_valid I A B P (liftE f)\"\n unfolding liftE_def\n apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev _ wp_post_taut])\n apply fastforce+ (* schematic instantiation *)\n done\n\nlemma if_ev:\n assumes \"b \\ equiv_valid I A B P f\"\n assumes \"\\ b \\ equiv_valid I A B Q g\"\n shows \"equiv_valid I A B (\\s. (b \\ P s) \\ (\\b \\ Q s)) (if b then f else g)\"\n apply (clarsimp split: if_split)\n using assms by blast\n\nlemmas if_ev_pre = equiv_valid_guard_imp[OF if_ev]\n\nlemma assert_ev_pre:\n \"equiv_valid_inv I A P (assert b)\"\n apply(simp add: equiv_valid_def2 assert_ev2)\n done\n\nlemmas assert_ev = assert_ev_pre[where P=\\]\n\nlemma assert_opt_ev:\n \"equiv_valid_inv I A \\ (assert_opt v)\"\n apply (simp add: assert_opt_def return_ev fail_ev\n split: option.split)\n done\n\nlemma assert_opt_ev2:\n assumes \"\\ a a'. \\v = Some a; v' = Some a'\\ \\ R a a'\"\n shows \"equiv_valid_2 I A A R \\ \\ (assert_opt v) (assert_opt v')\"\n apply (simp add: assert_opt_def return_ev fail_ev2_l fail_ev2_r\n split: option.split)\n apply(intro allI impI)\n apply(rule return_ev2)\n apply(rule assms, assumption+)\n done\n\nlemma select_f_ev:\n \"equiv_valid_inv I A (K (det f)) (select_f (f x))\"\n apply (rule gen_asm_ev)\n apply (simp add: select_f_def equiv_valid_def2 equiv_valid_2_def det_set_iff)\n done\n\nlemma gets_evrv:\n \"equiv_valid_rv_inv I A R (K (\\s t. I s t \\ A s t \\ R (f s) (f t))) (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma gets_evrv':\n \"equiv_valid_rv_inv I A R (\\s. (\\t. I s t \\ A s t \\ R (f s) (f t))) (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma gets_evrv'':\n \"\\s t. I s t \\ A s t \\ P s \\ P t \\ R (f s) (f t) \\ equiv_valid_rv_inv I A R P (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma equiv_valid_rv_guard_imp:\n \"\\equiv_valid_rv I A B R P f; \\ s. Q s \\ P s\\ \\\n equiv_valid_rv I A B R Q f\"\n apply(simp add: equiv_valid_2_def)\n apply fast\n done\n\nlemma gets_ev:\n shows \"equiv_valid_inv I A (\\ s. \\ s t. I s t \\ A s t \\ f s = f t) (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv])\n done\n\nlemma gets_ev':\n shows \"equiv_valid_inv I A (\\ s. \\ t. I s t \\ A s t \\ f s = f t) (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv'])\n done\n\nlemma gets_ev'':\n \"\\s t. I s t \\ A s t \\ P s \\ P t \\ f s = f t \\ equiv_valid_inv I A P (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv''])\n done\n\nlemma gets_the_evrv:\n \"equiv_valid_rv_inv I A R (K (\\s t. I s t \\ A s t \\ R (the (f s)) (the (f t)))) (gets_the f)\"\n unfolding gets_the_def\n apply (rule equiv_valid_rv_bind)\n apply(rule equiv_valid_rv_guard_imp[OF gets_evrv])\n apply simp\n apply(rule assert_opt_ev2)\n apply simp\n apply wp\n done\n\nlemma gets_the_ev:\n \"equiv_valid_inv I A (K (\\s t. I s t \\ A s t \\ f s = f t)) (gets_the f)\"\n unfolding equiv_valid_def2\n apply(rule equiv_valid_rv_guard_imp[OF gets_the_evrv])\n by simp\n\nlemma throwError_ev_pre:\n \"equiv_valid_inv I A P (throwError e)\"\n by (auto simp: throwError_def return_ev_pre)\n\nlemmas throwError_ev = throwError_ev_pre[where P=\\]\n\nlemma returnOk_ev_pre:\n \"equiv_valid_inv I A P (returnOk v)\"\n by (auto simp: returnOk_def return_ev_pre)\n\nlemmas returnOk_ev = returnOk_ev_pre[where P=\\]\n\n(* this seems restrictive, to have the same beginning and ending state relation,\n however, one suspects that bindE is used usually only in code that doesn't\n modify the state, so is probably OK.. We'll see *)\nlemma bindE_ev:\n assumes reads_res_2: \"\\ rv. equiv_valid_inv I A (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid_inv I A P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\,-\"\n shows \"equiv_valid_inv I A (\\s. P' s \\ P'' s) (f >>=E g)\"\n unfolding bindE_def\n apply (rule bind_ev)\n prefer 3\n apply(rule hoare[unfolded validE_R_def validE_def])\n apply(simp split: sum.split add: lift_def throwError_ev)\n apply(blast intro!: reads_res_2)\n apply(rule reads_res_1)\n done\n\nlemmas bindE_ev_pre = bindE_ev[THEN equiv_valid_guard_imp]\n\n(* Of course, when we know that progress is always made, we can do better *)\nlemma liftE_bindE_ev_general:\n assumes r2: \"\\ val. equiv_valid I B C (Q val) (g val)\"\n assumes r1: \"equiv_valid I A B P f\"\n assumes hoare: \"\\ R \\ f \\ Q \\\"\n shows \"equiv_valid I A C (\\ s. P s \\ R s) (liftE f >>=E g)\"\n apply(simp add: bindE_def)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" in bind_ev_general)\n prefer 2\n apply(rule liftE_ev)\n apply(rule r1)\n apply(insert r2, fastforce simp: lift_def split: sum.split simp: equiv_valid_def2 equiv_valid_2_def)[1]\n apply(insert hoare, fastforce simp: valid_def liftE_def return_def bind_def)\n done\n\nlemma liftE_bindE_ev:\n assumes r2: \"\\ val. equiv_valid_inv I A (Q val) (g val)\"\n assumes r1: \"equiv_valid_inv I A P f\"\n assumes hoare: \"\\ R \\ f \\ Q \\\"\n shows \"equiv_valid_inv I A (\\ s. P s \\ R s) (liftE f >>=E g)\"\n using assms by (blast intro: liftE_bindE_ev_general)\n\nlemmas liftE_bindE_ev_pre = liftE_bindE_ev[THEN equiv_valid_guard_imp]\n\nlemma liftM_ev:\n assumes reads_res: \"equiv_valid I A B P g\"\n shows \"equiv_valid I A B P (liftM f g)\"\n apply (simp add: liftM_def)\n apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev reads_res wp_post_taut])\n apply simp\n done\n\nlemma liftME_ev:\n assumes reads_res: \"equiv_valid_inv I A P g\"\n shows \"equiv_valid_inv I A P (liftME f g)\"\n apply(simp add: liftME_def)\n apply (rule bindE_ev_pre[OF returnOk_ev reads_res])\n apply (rule hoare_True_E_R)\n apply fast\n done\n\nlemma whenE_ev:\n assumes a: \"b \\ equiv_valid_inv I A P m\"\n shows \"equiv_valid_inv I A (\\s. b \\ P s) (whenE b m)\"\n unfolding whenE_def by (auto intro: a returnOk_ev_pre)\n\nlemma whenE_throwError_bindE_ev:\n assumes \"\\ rv. \\ b \\ equiv_valid_inv I A P (g rv)\"\n shows \"equiv_valid_inv I A P (whenE b (throwError e) >>=E g)\"\n apply (rule_tac Q=\"\\ rv. P and (\\ s. \\ b)\" in bindE_ev_pre)\n apply (rule gen_asm_ev)\n apply (blast intro: assms)\n apply (rule whenE_ev)\n apply (rule throwError_ev)\n apply (wp whenE_throwError_wp)\n apply simp\n done\n\n(* FIXME: trivially generalised *)\nlemma K_bind_ev:\n \"equiv_valid I A B P f \\ equiv_valid I A B P (K_bind f x)\"\n by simp\n\nsubsection\\wp setup\\\n\nlemmas splits_ev[wp_split] =\n bind_ev_pre bindE_ev_pre\n bind_ev bindE_ev\n if_ev_pre\n if_ev\n\nlemmas wp_ev[wp] =\n return_ev_pre\n return_ev\n liftE_ev\n fail_ev_pre\n fail_ev\n assert_opt_ev\n assert_ev\n gets_ev\n gets_the_ev\n returnOk_ev_pre\n returnOk_ev\n throwError_ev_pre\n throwError_ev\n liftM_ev\n liftME_ev\n whenE_ev\n K_bind_ev\n\nsubsection\\crunch setup\\\n\nlemmas pre_ev =\n hoare_pre\n equiv_valid_guard_imp\n\nsubsection\\Tom instantiates wpc\\\n\nlemma wpc_helper_equiv_valid:\n \"equiv_valid D A B Q f \\ wpc_helper (P, P') (Q, Q') (equiv_valid D A B P f)\"\n using equiv_valid_guard_imp\n apply (simp add: wpc_helper_def)\n apply (blast)\n done\n\nwpc_setup \"\\m. equiv_valid D A B Q m\" wpc_helper_equiv_valid\n\nsubsection\\More hoare-like rules\\\n\nlemma mapM_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapM m lst)\"\n using assms\n apply(atomize)\n apply(rule_tac Q=I in equiv_valid_guard_imp)\n apply(induct lst)\n apply(simp add: mapM_Nil return_ev_pre)\n apply(subst mapM_Cons)\n apply(rule bind_ev_pre[where P''=\"I\"])\n apply(rule bind_ev[OF return_ev])\n apply fastforce\n apply (rule wp_post_taut)\n apply fastforce+\n done\n\nlemma mapM_x_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapM_x m lst)\"\n apply(subst mapM_x_mapM)\n apply(rule bind_ev_pre[OF return_ev mapM_ev_pre])\n apply (blast intro: reads_res invariant inv_established wp_post_taut)+\n done\n\nlemma mapM_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n shows \"equiv_valid_inv D A I (mapM m lst)\"\n using assms by (auto intro: mapM_ev_pre)\n\nlemma mapM_x_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n shows \"equiv_valid_inv D A I (mapM_x m lst)\"\n using assms by (auto intro: mapM_x_ev_pre)\n\n(* MOVE -- proof clagged from mapM_x_mapM *)\nlemma mapME_x_mapME:\n \"mapME_x f l = mapME f l >>=E (\\ y. returnOk ())\"\n apply (simp add: mapME_x_def sequenceE_x_def mapME_def sequenceE_def)\n apply (induct l, simp_all add: Let_def bindE_assoc)\n done\n\nlemma mapME_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\,-\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapME m lst)\"\n using assms\n apply(atomize)\n apply(rule_tac Q=I in equiv_valid_guard_imp)\n apply(induct lst)\n apply(simp add: mapME_Nil returnOk_ev_pre)\n apply(subst mapME_Cons)\n apply wp\n apply fastforce\n apply (rule hoare_True_E_R[where P=\"\\\"])\n apply fastforce+\n done\n\nlemma mapME_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv I A P (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ P \\ m x \\ \\_. P \\, -\"\n shows \"equiv_valid_inv I A P (mapME m lst)\"\n using assms by (auto intro: mapME_ev_pre)\n\nlemma mapME_x_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\,-\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapME_x m lst)\"\n unfolding mapME_x_mapME\n apply (wp assms mapME_ev_pre | simp)+\n done\n\nlemma mapME_x_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\, -\"\n shows \"equiv_valid_inv D A I (mapME_x m lst)\"\n using assms by (auto intro: mapME_x_ev_pre)\n\nlemma mapM_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapM m lst)\"\n apply(rule mapM_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapM_x_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapM_x m lst)\"\n apply(rule mapM_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapME_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapME m lst)\"\n apply(rule mapME_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapME_x_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapME_x m lst)\"\n apply(rule mapME_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nsubsection\\Rules for the specialised validity\\\n\nlemma use_spec_ev:\n \"(\\st. spec_equiv_valid st I A B P f) \\ equiv_valid I A B P f\"\n by (simp add: equiv_valid_def)\n\nlemma drop_spec_ev:\n \"equiv_valid I A B P f \\ spec_equiv_valid st I A B P f\"\n by (simp add: equiv_valid_def)\n\nlemma spec_equiv_valid_guard_imp:\n assumes reads_res: \"spec_equiv_valid_inv s' I A P' f\"\n assumes guard_imp: \"\\ s. P s \\ P' s\"\n shows \"spec_equiv_valid_inv s' I A P f\"\n using assms\n by (fastforce simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma bind_spec_ev:\n assumes reads_res_2: \"\\ rv s''. (rv, s'') \\ fst (f s') \\ spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n assumes hoare: \"\\P''\\ f \\Q\\\"\n shows \"spec_equiv_valid_inv s' I A (\\s. P' s \\ P'' s) (f >>= g)\"\n using reads_res_1\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def valid_def bind_def split_def)\n apply (rename_tac t a b aa ba ab bb ac bc)\n apply (erule_tac x=t in allE)\n apply clarsimp\n apply (erule_tac x=\"(a, b)\" in ballE)\n apply (erule_tac x=\"(ab, bb)\" in ballE)\n apply clarsimp\n apply (cut_tac reads_res_2)\n prefer 2\n apply assumption\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply(erule_tac x=bb in allE)\n using hoare\n apply (fastforce simp: valid_def)+\n done\n\nlemma bindE_spec_ev:\n assumes reads_res_2: \"\\ rv s''. (Inr rv, s'') \\ fst (f s') \\ spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n assumes hoare: \"\\P''\\ f \\Q\\,-\"\n shows \"spec_equiv_valid_inv s' I A (\\s. P' s \\ P'' s) (f >>=E g)\"\n unfolding bindE_def\n apply (rule bind_spec_ev)\n prefer 3\n apply(rule hoare[simplified validE_R_def validE_def])\n apply(simp split: sum.split add: lift_def)\n apply(rule conjI)\n apply(fastforce simp: spec_equiv_valid_def throwError_def return_ev2)\n apply(fastforce simp: reads_res_2)\n apply(rule reads_res_1)\n done\n\nlemma if_spec_ev:\n \"\\ G \\ spec_equiv_valid_inv s' I A P f;\n \\ G \\ spec_equiv_valid_inv s' I A P' f'\n \\ \\ spec_equiv_valid_inv s' I A (\\s. (G \\ P s) \\ (\\ G \\ P' s)) (if G then f else f')\"\n by (cases G, simp+)\n\nlemmas splits_spec_ev[wp_split] =\n drop_spec_ev\n spec_equiv_valid_guard_imp[OF bind_spec_ev] spec_equiv_valid_guard_imp[OF bindE_spec_ev]\n bind_spec_ev bindE_spec_ev\n spec_equiv_valid_guard_imp[OF if_spec_ev] if_spec_ev\n\n(* Miscellaneous rules. *)\n\nlemma assertE_ev[wp]:\n \"equiv_valid_inv I A \\ (assertE b)\"\n unfolding assertE_def\n apply wp\n by simp\n\nlemma equiv_valid_2_bindE:\n assumes g: \"\\rv rv'. R' rv rv' \\\n equiv_valid_2 D A A (E \\ R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes h1: \"\\S\\ f \\Q\\,-\"\n assumes h2: \"\\S'\\ f' \\Q'\\,-\"\n assumes f: \"equiv_valid_2 D A A (E \\ R') P P' f f'\"\n shows \"equiv_valid_2 D A A (E \\ R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"E \\ R'\" and Q=\"case_sum \\\\ Q\" and Q'=\"case_sum \\\\ Q'\" and S=S and S'=S' in equiv_valid_2_bind)\n apply(clarsimp simp: lift_def split: sum.splits)\n apply(intro impI conjI allI)\n apply(simp add: throwError_def)\n apply(rule return_ev2)\n apply simp\n apply(simp)\n apply(simp)\n apply(fastforce intro: g)\n apply(rule f)\n apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n by auto\n\nlemma rel_sum_comb_equals:\n \"((=) \\ (=)) = (=)\"\n apply(rule ext)\n apply(rule ext)\n apply(rename_tac a b)\n apply(case_tac a, auto)\n done\n\ndefinition spec_equiv_valid_2_inv where\n \"spec_equiv_valid_2_inv s I A R P P' f f' \\\n equiv_valid_2 I A A R (P and ((=) s)) P' f f'\"\n\nlemma spec_equiv_valid_def2:\n \"spec_equiv_valid s I A A P f =\n spec_equiv_valid_2_inv s I A (=) P P f f\"\n apply(simp add: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n done\n\nlemma drop_spec_ev2_inv:\n \"equiv_valid_2 I A A R P P' f f' \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n apply(simp add: spec_equiv_valid_2_inv_def)\n apply(erule equiv_valid_2_guard_imp, auto)\n done\n\nlemma spec_equiv_valid_2_inv_guard_imp:\n \"\\spec_equiv_valid_2_inv s I A R Q Q' f f'; \\ s. P s \\ Q s; \\ s. P' s \\ Q' s\\ \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n by(auto simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n\nlemma bind_spec_ev2:\n assumes reads_res_2: \"\\ rv s' rv'. \\(rv, s') \\ fst (f s); R' rv rv'\\ \\ spec_equiv_valid_2_inv s' I A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes reads_res_1: \"spec_equiv_valid_2_inv s I A R' P P' f f'\"\n assumes hoare: \"\\S\\ f \\Q\\\"\n assumes hoare': \"\\S'\\ f' \\Q'\\\"\n shows \"spec_equiv_valid_2_inv s I A R (P and S) (P' and S') (f >>= g) (f' >>= g')\"\n using reads_res_1\n apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def bind_def split_def)\n apply (erule_tac x=t in allE)\n apply clarsimp\n apply (drule_tac x=\"(a, b)\" in bspec, assumption)\n apply (drule_tac x=\"(ab, bb)\" in bspec, assumption)\n apply clarsimp\n apply (cut_tac rv=\"a\" and s'=\"b\" in reads_res_2)\n apply assumption\n apply assumption\n apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n apply(drule_tac x=bb in spec)\n apply clarsimp\n using hoare hoare'\n apply (fastforce simp: valid_def)+\n done\n\nlemma spec_equiv_valid_2_inv_bindE:\n assumes g: \"\\rv s' rv'. \\(Inr rv, s') \\ fst (f s); R' rv rv'\\ \\\n spec_equiv_valid_2_inv s' I A (E \\ R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes h1: \"\\S\\ f \\Q\\,-\"\n assumes h2: \"\\S'\\ f' \\Q'\\,-\"\n assumes f: \"spec_equiv_valid_2_inv s I A (E \\ R') P P' f f'\"\n shows \"spec_equiv_valid_2_inv s I A (E \\ R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule spec_equiv_valid_2_inv_guard_imp)\n apply(rule_tac R'=\"E \\ R'\" and Q=\"case_sum \\\\ Q\" and Q'=\"case_sum \\\\ Q'\" and S=S and S'=S' in bind_spec_ev2)\n apply(clarsimp simp: lift_def split: sum.splits)\n apply(intro impI conjI allI)\n apply(simp add: throwError_def)\n apply(rule drop_spec_ev2_inv[OF return_ev2])\n apply simp\n apply(simp)\n apply(simp)\n apply(fastforce intro: g)\n apply(rule f)\n apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n by auto\n\nlemma trancl_subset_equivalence:\n \"\\(a, b) \\ r'\\<^sup>+; \\x. (a, x)\\r'\\<^sup>+ \\ Q x; \\x y. Q x \\ ((y, x) \\ r) = ((y, x) \\ r')\\ \\ (a, b) \\ r\\<^sup>+\"\n apply(induct a b rule: trancl.induct)\n apply(blast)\n apply(simp)\n apply(rule_tac b=b in trancl_into_trancl)\n apply(simp)\n apply(erule_tac x=c in allE)\n apply(subgoal_tac \"(a, c) \\ r'\\<^sup>+\")\n apply(auto)\n done\n\nlemma equiv_valid_rv_gets_compD:\n \"equiv_valid_rv_inv I A R P (gets (f \\ g)) \\\n equiv_valid_rv_inv I A (\\ rv rv'. R (f rv) (f rv')) P (gets g)\"\n apply(clarsimp simp: equiv_valid_2_def gets_def bind_def return_def get_def)\n done\n\n\nlemma liftE_ev2:\n \"equiv_valid_2 I A B R P P' f f' \\\n equiv_valid_2 I A B (E \\ R) P P' (liftE f) (liftE f')\"\n apply(clarsimp simp: liftE_def equiv_valid_2_def bind_def return_def)\n apply fastforce\n done\n\nlemma whenE_spec_ev2_inv:\n assumes a: \"b \\ spec_equiv_valid_2_inv s I A R P P' m m'\"\n assumes r: \"\\ x. R x x\"\n shows \"spec_equiv_valid_2_inv s I A R P P' (whenE b m) (whenE b m')\"\n unfolding whenE_def\n apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev2_inv[OF return_ev2] intro: r)\n done\n\nlemma whenE_spec_ev:\n assumes a: \"b \\ spec_equiv_valid_inv s I A P m\"\n shows \"spec_equiv_valid_inv s I A P (whenE b m) \"\n unfolding whenE_def\n apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev[OF return_ev_pre])\n done\n\n\nlemma spec_equiv_valid_2_inv_by_spec_equiv_valid:\n \"\\spec_equiv_valid s I A A P f; P' = P; f' = f;\n (\\ a. R a a)\\ \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n apply(clarsimp simp: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma mapM_ev'':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (P x) (m x)\"\n assumes inv: \"\\ x. x \\ set lst \\ \\ \\s. \\x\\set lst. P x s \\ m x \\ \\_ s. \\x\\set lst. P x s \\\"\n shows \"equiv_valid_inv D A (\\ s. \\x\\set lst. P x s) (mapM m lst)\"\n apply(rule mapM_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n apply(wpsimp wp: inv)\n done\n\nlemma mapM_x_ev'':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (P x) (m x)\"\n assumes inv: \"\\ x. x \\ set lst \\ \\ \\s. \\x\\set lst. P x s \\ m x \\ \\_ s. \\x\\set lst. P x s \\\"\n shows \"equiv_valid_inv D A (\\ s. \\x\\set lst. P x s) (mapM_x m lst)\"\n apply(rule mapM_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n apply(wpsimp wp: inv)\n done\n\nlemma catch_ev[wp]:\n assumes ok:\n \"equiv_valid I A A P f\"\n assumes err:\n \"\\ e. equiv_valid I A A (E e) (handler e)\"\n assumes hoare:\n \"\\ Q \\ f -, \\ E \\\"\n shows\n \"equiv_valid I A A (P and Q) (f handler)\"\n apply (simp add: catch_def)\n apply (wp err ok | wpc | simp)+\n apply (insert hoare[simplified validE_E_def validE_def])[1]\n apply (simp split: sum.splits)\n by simp\n\nlemma equiv_valid_rv_trivial:\n assumes inv: \"\\ P. \\ P \\ f \\ \\_. P \\\"\n shows \"equiv_valid_rv_inv I A \\\\ \\ f\"\n by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv])\n\nlemma equiv_valid_2_trivial:\n assumes inv: \"\\ P. \\ P \\ f \\ \\_. P \\\"\n assumes inv': \"\\ P. \\ P \\ f' \\ \\_. P \\\"\n shows \"equiv_valid_2 I A A \\\\ \\ \\ f f'\"\n by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv] state_unchanged[OF inv'])\n\nlemma gen_asm_ev2_r:\n \"\\P' \\ equiv_valid_2 I A B R P Q f f'\\ \\\n equiv_valid_2 I A B R P (Q and (K P')) f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_l:\n \"\\P \\ equiv_valid_2 I A B R Q P' f f'\\ \\\n equiv_valid_2 I A B R (Q and (K P)) P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_r':\n \"\\P' \\ equiv_valid_2 I A B R P \\ f f'\\ \\\n equiv_valid_2 I A B R P (\\s. P') f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_l':\n \"\\P \\ equiv_valid_2 I A B R \\ P' f f'\\ \\\n equiv_valid_2 I A B R (\\s. P) P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma equiv_valid_rv_liftE_bindE:\n assumes ev1:\n \"equiv_valid_rv_inv I A W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv_inv I A R P ((liftE f) >>=E g)\"\n apply(unfold bindE_def)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" in equiv_valid_rv_bind)\n apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n apply(rule ev1)\n apply(clarsimp simp: lift_def split: sum.split)\n apply(insert ev2, fastforce simp: equiv_valid_2_def)[1]\n apply(insert hoare, clarsimp simp: valid_def liftE_def bind_def return_def split_def)\n done\n\nlemma if_evrv:\n assumes \"b \\ equiv_valid_rv_inv I A R P f\"\n assumes \"\\ b \\ equiv_valid_rv_inv I A R Q g\"\n shows \"equiv_valid_rv_inv I A R (\\s. (b \\ P s) \\ (\\b \\ Q s)) (if b then f else g)\"\n apply (clarsimp split: if_split)\n using assms by blast\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/EquivValid.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2636582616897836}} {"text": "theory SINVAR_TaintingTrusted_impl\nimports SINVAR_TaintingTrusted \"../TopoS_Interface_impl\"\nbegin\n\n\nsubsubsection \\SecurityInvariant Tainting with Trust List Implementation\\\n\ncode_identifier code_module SINVAR_Tainting_impl => (Scala) SINVAR_Tainting\n\n(*could we use those to make code more efficient?*)\nlemma \"A - B \\ C \\ (\\a\\A. a \\ C \\ a \\ B)\" by blast\nlemma \"\\(A - B \\ C) \\ (\\a \\ A. a \\ C \\ a \\ B)\" by blast\n\nfun sinvar :: \"'v list_graph \\ ('v \\ SINVAR_TaintingTrusted.taints) \\ bool\" where\n \"sinvar G nP = (\\ (v1,v2) \\ set (edgesL G). taints (nP v1) - untaints (nP v1) \\ taints (nP v2))\"\n\n\n(*Test that we have executable code, despite the abstractions*)\nexport_code sinvar checking SML\nvalue[code] \"sinvar \\ nodesL = [], edgesL =[] \\ (\\_. SINVAR_TaintingTrusted.default_node_properties)\"\nlemma \"sinvar \\ nodesL = [], edgesL =[] \\ (\\_. SINVAR_TaintingTrusted.default_node_properties)\" by eval\n\n\ndefinition TaintingTrusted_offending_list \n :: \"'v list_graph \\ ('v \\ SINVAR_TaintingTrusted.taints) \\ ('v \\ 'v) list list\" where\n \"TaintingTrusted_offending_list G nP = (if sinvar G nP then\n []\n else \n [ [e \\ edgesL G. case e of (v1,v2) \\ \\(taints (nP v1) - untaints (nP v1) \\ taints (nP v2))] ])\"\n\n(*TODO: is this code somewhat efficient?*)\nexport_code TaintingTrusted_offending_list checking SML\n\n\ndefinition \"NetModel_node_props P =\n (\\ i. (case (node_properties P) i of\n Some property \\ property\n | None \\ SINVAR_TaintingTrusted.default_node_properties))\"\n\n\n\ndefinition \"TaintingTrusted_eval G P = (wf_list_graph G \\ \n sinvar G (SecurityInvariant.node_props SINVAR_TaintingTrusted.default_node_properties P))\"\n\n\ninterpretation TaintingTrusted_impl:TopoS_List_Impl\n where default_node_properties=SINVAR_TaintingTrusted.default_node_properties\n and sinvar_spec=SINVAR_TaintingTrusted.sinvar\n and sinvar_impl=sinvar\n and receiver_violation=SINVAR_TaintingTrusted.receiver_violation\n and offending_flows_impl=TaintingTrusted_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=TaintingTrusted_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(simp add: TopoS_TaintingTrusted)\n apply(simp add: list_graph_to_graph_def SINVAR_TaintingTrusted.sinvar_def; fail)\n apply(rule conjI)\n apply(simp add: list_graph_to_graph_def)\n apply(simp add: list_graph_to_graph_def SINVAR_TaintingTrusted.sinvar_def Taints_offending_set\n SINVAR_TaintingTrusted.Taints_offending_set_def TaintingTrusted_offending_list_def; fail)\n apply(rule conjI)\n apply(simp only: NetModel_node_props_def)\n (*interpretation is in local context*)\n apply (metis SecurityInvariant.node_props.simps SecurityInvariant.node_props_eq_node_props_formaldef TopoS_TaintingTrusted)\n apply(simp only: TaintingTrusted_eval_def)\n apply(simp add: TopoS_eval_impl_proofrule[OF TopoS_TaintingTrusted])\n apply(simp add: list_graph_to_graph_def SINVAR_TaintingTrusted.sinvar_def; fail)\n done\n\n\n\nsubsubsection \\TaintingTrusted packing\\\n definition SINVAR_LIB_TaintingTrusted :: \"('v::vertex, SINVAR_TaintingTrusted.taints) TopoS_packed\" where\n \"SINVAR_LIB_TaintingTrusted \\ \n \\ nm_name = ''TaintingTrusted'', \n nm_receiver_violation = SINVAR_TaintingTrusted.receiver_violation,\n nm_default = SINVAR_TaintingTrusted.default_node_properties, \n nm_sinvar = sinvar,\n nm_offending_flows = TaintingTrusted_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = TaintingTrusted_eval\n \\\"\n interpretation SINVAR_LIB_BLPbasic_interpretation: TopoS_modelLibrary SINVAR_LIB_TaintingTrusted\n SINVAR_TaintingTrusted.sinvar\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_TaintingTrusted_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\nsubsubsection\\Example\\\ncontext\nbegin\n private definition tainting_example :: \"string list_graph\" where\n \"tainting_example \\ \\ nodesL = [''produce 1'',\n ''produce 2'',\n ''produce 3'',\n ''read 1 2'',\n ''read 3'',\n ''consume 1 2 3'',\n ''consume 3''], \n edgesL =[(''produce 1'', ''read 1 2''),\n (''produce 2'', ''read 1 2''),\n (''produce 3'', ''read 3''), \n (''read 3'', ''read 1 2''),\n (''read 1 2'', ''consume 1 2 3''),\n (''read 3'', ''consume 3'')] \\\"\n lemma \"wf_list_graph tainting_example\" by eval\n\n\n private definition tainting_example_props :: \"string \\ SINVAR_TaintingTrusted.taints\" where\n \"tainting_example_props \\ (\\ n. SINVAR_TaintingTrusted.default_node_properties)\n (''produce 1'' := TaintsUntaints {''1''} {},\n ''produce 2'' := TaintsUntaints {''2''} {},\n ''produce 3'' := TaintsUntaints {''3''} {},\n ''read 1 2'' := TaintsUntaints {''3'',''foo''} {''1'',''2''},\n ''read 3'' := TaintsUntaints {''3''} {},\n ''consume 1 2 3'' := TaintsUntaints {''foo'',''3''} {},\n ''consume 3'' := TaintsUntaints {''3''} {})\"\n\n value \"tainting_example_props (''consume 1 2 3'')\"\n value[code] \"TaintingTrusted_offending_list tainting_example tainting_example_props\"\n private lemma \"sinvar tainting_example tainting_example_props\" by eval\nend\n\n(*TODO: fails. why?*)\nexport_code SINVAR_LIB_TaintingTrusted checking Scala\nexport_code SINVAR_LIB_TaintingTrusted checking SML\n\nhide_const (open) NetModel_node_props TaintingTrusted_offending_list TaintingTrusted_eval\n\nhide_const (open) sinvar\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_TaintingTrusted_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.3960681662740417, "lm_q1q2_score": 0.2635479345662772}} {"text": "(* Title: Stateful_Protocol_Model.thy\n Author: Andreas Viktor Hess, DTU\n Author: Sebastian A. Mödersheim, DTU\n Author: Achim D. Brucker, University of Exeter\n Author: Anders Schlichtkrull, DTU\n SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection\\Stateful Protocol Model\\\ntheory Stateful_Protocol_Model\n imports Stateful_Protocol_Composition_and_Typing.Stateful_Compositionality\n Transactions Term_Abstraction\nbegin\n\nsubsection \\Locale Setup\\\nlocale stateful_protocol_model =\n fixes arity\\<^sub>f::\"'fun \\ nat\"\n and arity\\<^sub>s::\"'sets \\ nat\"\n and public\\<^sub>f::\"'fun \\ bool\"\n and Ana\\<^sub>f::\"'fun \\ ((('fun,'atom::finite,'sets,'lbl) prot_fun, nat) term list \\ nat list)\"\n and \\\\<^sub>f::\"'fun \\ 'atom option\"\n and label_witness1::\"'lbl\"\n and label_witness2::\"'lbl\"\n assumes Ana\\<^sub>f_assm1: \"\\f. let (K, M) = Ana\\<^sub>f f in (\\k \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K).\n is_Fun k \\ (is_Fu (the_Fun k)) \\ length (args k) = arity\\<^sub>f (the_Fu (the_Fun k)))\"\n and Ana\\<^sub>f_assm2: \"\\f. let (K, M) = Ana\\<^sub>f f in \\i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\ set M. i < arity\\<^sub>f f\"\n and public\\<^sub>f_assm: \"\\f. arity\\<^sub>f f > (0::nat) \\ public\\<^sub>f f\"\n and \\\\<^sub>f_assm: \"\\f. arity\\<^sub>f f = (0::nat) \\ \\\\<^sub>f f \\ None\"\n and label_witness_assm: \"label_witness1 \\ label_witness2\"\nbegin\n\nlemma Ana\\<^sub>f_assm1_alt: \n assumes \"Ana\\<^sub>f f = (K,M)\" \"k \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K)\"\n shows \"(\\x. k = Var x) \\ (\\h T. k = Fun (Fu h) T \\ length T = arity\\<^sub>f h)\"\nproof (cases k)\n case (Fun g T)\n let ?P = \"\\k. is_Fun k \\ is_Fu (the_Fun k) \\ length (args k) = arity\\<^sub>f (the_Fu (the_Fun k))\"\n let ?Q = \"\\K M. \\k \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K). ?P k\"\n\n have \"?Q (fst (Ana\\<^sub>f f)) (snd (Ana\\<^sub>f f))\" using Ana\\<^sub>f_assm1 split_beta[of ?Q \"Ana\\<^sub>f f\"] by meson\n hence \"?Q K M\" using assms(1) by simp\n hence \"?P k\" using assms(2) by blast\n thus ?thesis using Fun by (cases g) auto\nqed simp\n\nlemma Ana\\<^sub>f_assm2_alt:\n assumes \"Ana\\<^sub>f f = (K,M)\" \"i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\ set M\"\n shows \"i < arity\\<^sub>f f\"\nusing Ana\\<^sub>f_assm2 assms by fastforce\n\n\nsubsection \\Definitions\\\nfun arity where\n \"arity (Fu f) = arity\\<^sub>f f\"\n| \"arity (Set s) = arity\\<^sub>s s\"\n| \"arity (Val _) = 0\"\n| \"arity (Abs _) = 0\"\n| \"arity Pair = 2\"\n| \"arity (Attack _) = 0\"\n| \"arity OccursFact = 2\"\n| \"arity OccursSec = 0\"\n| \"arity (PubConst _ _) = 0\"\n\nfun public where\n \"public (Fu f) = public\\<^sub>f f\"\n| \"public (Set s) = (arity\\<^sub>s s > 0)\"\n| \"public (Val n) = False\"\n| \"public (Abs _) = False\"\n| \"public Pair = True\"\n| \"public (Attack _) = False\"\n| \"public OccursFact = True\"\n| \"public OccursSec = False\"\n| \"public (PubConst _ _) = True\"\n\nfun Ana where\n \"Ana (Fun (Fu f) T) = (\n if arity\\<^sub>f f = length T \\ arity\\<^sub>f f > 0\n then let (K,M) = Ana\\<^sub>f f in (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M)\n else ([], []))\"\n| \"Ana _ = ([], [])\"\n\ndefinition \\\\<^sub>v where\n \"\\\\<^sub>v v \\ (\n if (\\t \\ subterms (fst v).\n case t of (TComp f T) \\ arity f > 0 \\ arity f = length T | _ \\ True)\n then fst v\n else TAtom Bottom)\"\n\nfun \\ where\n \"\\ (Var v) = \\\\<^sub>v v\"\n| \"\\ (Fun f T) = (\n if arity f = 0\n then case f of\n (Fu g) \\ TAtom (case \\\\<^sub>f g of Some a \\ Atom a | None \\ Bottom)\n | (Val _) \\ TAtom Value\n | (Abs _) \\ TAtom AbsValue\n | (Set _) \\ TAtom SetType\n | (Attack _) \\ TAtom AttackType\n | OccursSec \\ TAtom OccursSecType\n | (PubConst a _) \\ TAtom a\n | _ \\ TAtom Bottom\n else TComp f (map \\ T))\"\n\nlemma \\_consts_simps[simp]:\n \"arity\\<^sub>f g = 0 \\ \\ (Fun (Fu g) []::('fun,'atom,'sets,'lbl) prot_term)\n = TAtom (case \\\\<^sub>f g of Some a \\ Atom a | None \\ Bottom)\"\n \"\\ (Fun (Val n) []::('fun,'atom,'sets,'lbl) prot_term) = TAtom Value\"\n \"\\ (Fun (Abs b) []::('fun,'atom,'sets,'lbl) prot_term) = TAtom AbsValue\"\n \"arity\\<^sub>s s = 0 \\ \\ (Fun (Set s) []::('fun,'atom,'sets,'lbl) prot_term) = TAtom SetType\"\n \"\\ (Fun (Attack x) []::('fun,'atom,'sets,'lbl) prot_term) = TAtom AttackType\"\n \"\\ (Fun OccursSec []::('fun,'atom,'sets,'lbl) prot_term) = TAtom OccursSecType\"\n \"\\ (Fun (PubConst a t) []::('fun,'atom,'sets,'lbl) prot_term) = TAtom a\"\nby simp+\n\nlemma \\_Fu_simps[simp]:\n \"arity\\<^sub>f f \\ 0 \\ \\ (Fun (Fu f) T) = TComp (Fu f) (map \\ T)\" (is \"?A1 \\ ?A2\")\n \"arity\\<^sub>f f = 0 \\ \\\\<^sub>f f = Some a \\ \\ (Fun (Fu f) T) = TAtom (Atom a)\" (is \"?B1 \\ ?B2 \\ ?B3\")\n \"arity\\<^sub>f f = 0 \\ \\\\<^sub>f f = None \\ \\ (Fun (Fu f) T) = TAtom Bottom\" (is \"?C1 \\ ?C2 \\ ?C3\")\n \"\\ (Fun (Fu f) T) \\ TAtom Value\" (is ?D)\n \"\\ (Fun (Fu f) T) \\ TAtom AttackType\" (is ?E)\n \"\\ (Fun (Fu f) T) \\ TAtom OccursSecType\" (is ?F)\nproof -\n show \"?A1 \\ ?A2\" by simp\n show \"?B1 \\ ?B2 \\ ?B3\" by simp\n show \"?C1 \\ ?C2 \\ ?C3\" by simp\n show ?D by (cases \"\\\\<^sub>f f\") simp_all\n show ?E by (cases \"\\\\<^sub>f f\") simp_all\n show ?F by (cases \"\\\\<^sub>f f\") simp_all\nqed\n\nlemma \\_Set_simps[simp]:\n \"arity\\<^sub>s s \\ 0 \\ \\ (Fun (Set s) T) = TComp (Set s) (map \\ T)\"\n \"\\ (Fun (Set s) T) = TAtom SetType \\ \\ (Fun (Set s) T) = TComp (Set s) (map \\ T)\"\n \"\\ (Fun (Set s) T) \\ TAtom Value\"\n \"\\ (Fun (Set s) T) \\ TAtom (Atom a)\"\n \"\\ (Fun (Set s) T) \\ TAtom AttackType\"\n \"\\ (Fun (Set s) T) \\ TAtom OccursSecType\"\n \"\\ (Fun (Set s) T) \\ TAtom Bottom\"\nby auto\n\n\nsubsection \\Locale Interpretations\\\nlemma Ana_Fu_cases:\n assumes \"Ana (Fun f T) = (K,M)\"\n and \"f = Fu g\"\n and \"Ana\\<^sub>f g = (K',M')\"\n shows \"(K,M) = (if arity\\<^sub>f g = length T \\ arity\\<^sub>f g > 0\n then (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M')\n else ([],[]))\" (is ?A)\n and \"(K,M) = (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M') \\ (K,M) = ([],[])\" (is ?B)\nproof -\n show ?A using assms by (cases \"arity\\<^sub>f g = length T \\ arity\\<^sub>f g > 0\") auto\n thus ?B by metis\nqed\n\nlemma Ana_Fu_intro:\n assumes \"arity\\<^sub>f f = length T\" \"arity\\<^sub>f f > 0\"\n and \"Ana\\<^sub>f f = (K',M')\"\n shows \"Ana (Fun (Fu f) T) = (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M')\"\nusing assms by simp\n\nlemma Ana_Fu_elim:\n assumes \"Ana (Fun f T) = (K,M)\"\n and \"f = Fu g\"\n and \"Ana\\<^sub>f g = (K',M')\"\n and \"(K,M) \\ ([],[])\"\n shows \"arity\\<^sub>f g = length T\" (is ?A)\n and \"(K,M) = (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M')\" (is ?B)\nproof -\n show ?A using assms by force\n moreover have \"arity\\<^sub>f g > 0\" using assms by force\n ultimately show ?B using assms by auto\nqed\n\nlemma Ana_nonempty_inv:\n assumes \"Ana t \\ ([],[])\"\n shows \"\\f T. t = Fun (Fu f) T \\ arity\\<^sub>f f = length T \\ arity\\<^sub>f f > 0 \\\n (\\K M. Ana\\<^sub>f f = (K, M) \\ Ana t = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M))\"\nusing assms\nproof (induction t rule: Ana.induct)\n case (1 f T)\n hence *: \"arity\\<^sub>f f = length T\" \"0 < arity\\<^sub>f f\"\n \"Ana (Fun (Fu f) T) = (case Ana\\<^sub>f f of (K, M) \\ (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M))\"\n using Ana.simps(1)[of f T] unfolding Let_def by metis+\n\n obtain K M where **: \"Ana\\<^sub>f f = (K, M)\" by (metis surj_pair)\n hence \"Ana (Fun (Fu f) T) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M)\" using *(3) by simp\n thus ?case using ** *(1,2) by blast\nqed simp_all\n\nlemma assm1:\n assumes \"Ana t = (K,M)\"\n shows \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\ fv t\"\nusing assms\nproof (induction t rule: term.induct)\n case (Fun f T)\n have aux: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set K \\\\<^sub>s\\<^sub>e\\<^sub>t (!) T) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set T)\"\n when K: \"\\i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K). i < length T\"\n for K::\"(('fun,'atom,'sets,'lbl) prot_fun, nat) term list\"\n proof\n fix x assume \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K \\\\<^sub>s\\<^sub>e\\<^sub>t (!) T)\"\n then obtain k where k: \"k \\ set K\" \"x \\ fv (k \\ (!) T)\" by moura\n have \"\\i \\ fv k. i < length T\" using K k(1) by simp\n thus \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set T)\"\n by (metis (no_types, lifting) k(2) contra_subsetD fv_set_mono image_subsetI nth_mem\n subst_apply_fv_unfold)\n qed\n\n { fix g assume f: \"f = Fu g\" and K: \"K \\ []\"\n obtain K' M' where *: \"Ana\\<^sub>f g = (K',M')\" by moura\n have \"(K, M) \\ ([], [])\" using K by simp\n hence \"(K, M) = (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M')\" \"arity\\<^sub>f g = length T\"\n using Ana_Fu_cases(1)[OF Fun.prems f *]\n by presburger+\n hence ?case using aux[of K'] Ana\\<^sub>f_assm2_alt[OF *] by auto\n } thus ?case using Fun by (cases f) fastforce+\nqed simp\n\nlemma assm2:\n assumes \"Ana t = (K,M)\"\n and \"\\g S'. Fun g S' \\ t \\ length S' = arity g\"\n and \"k \\ set K\"\n and \"Fun f T' \\ k\"\n shows \"length T' = arity f\"\nusing assms\nproof (induction t rule: term.induct)\n case (Fun g T)\n obtain h where 2: \"g = Fu h\"\n using Fun.prems(1,3) by (cases g) auto\n obtain K' M' where 1: \"Ana\\<^sub>f h = (K',M')\" by moura\n have \"(K,M) \\ ([],[])\" using Fun.prems(3) by auto\n hence \"(K,M) = (K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T, map ((!) T) M')\"\n \"\\i. i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K') \\ set M' \\ i < length T\"\n using Ana_Fu_cases(1)[OF Fun.prems(1) 2 1] Ana\\<^sub>f_assm2_alt[OF 1]\n by presburger+\n hence \"K = K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T\" and 3: \"\\i\\fv\\<^sub>s\\<^sub>e\\<^sub>t (set K'). i < length T\" by simp_all\n then obtain k' where k': \"k' \\ set K'\" \"k = k' \\ (!) T\" using Fun.prems(3) by moura\n hence 4: \"Fun f T' \\ subterms (k' \\ (!) T)\" \"fv k' \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K')\"\n using Fun.prems(4) by auto\n show ?case\n proof (cases \"\\i \\ fv k'. Fun f T' \\ subterms (T ! i)\")\n case True\n hence \"Fun f T' \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set T)\" using k' Fun.prems(4) 3 by auto\n thus ?thesis using Fun.prems(2) by auto\n next\n case False\n then obtain S where \"Fun f S \\ subterms k'\" \"Fun f T' = Fun f S \\ (!) T\"\n using k'(2) Fun.prems(4) subterm_subst_not_img_subterm by force\n thus ?thesis using Ana\\<^sub>f_assm1_alt[OF 1, of \"Fun f S\"] k'(1) by (cases f) auto\n qed\nqed simp\n\nlemma assm4:\n assumes \"Ana (Fun f T) = (K, M)\"\n shows \"set M \\ set T\"\nusing assms\nproof (cases f)\n case (Fu g)\n obtain K' M' where *: \"Ana\\<^sub>f g = (K',M')\" by moura\n have \"M = [] \\ (arity\\<^sub>f g = length T \\ M = map ((!) T) M')\"\n using Ana_Fu_cases(1)[OF assms Fu *]\n by (meson prod.inject)\n thus ?thesis using Ana\\<^sub>f_assm2_alt[OF *] by auto\nqed auto\n\nlemma assm5: \"Ana t = (K,M) \\ K \\ [] \\ M \\ [] \\ Ana (t \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\nproof (induction t rule: term.induct)\n case (Fun f T) thus ?case\n proof (cases f)\n case (Fu g)\n obtain K' M' where *: \"Ana\\<^sub>f g = (K',M')\" by moura\n have **: \"K = K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T\" \"M = map ((!) T) M'\"\n \"arity\\<^sub>f g = length T\" \"\\i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K') \\ set M'. i < arity\\<^sub>f g\" \"0 < arity\\<^sub>f g\"\n using Fun.prems(2) Ana_Fu_cases(1)[OF Fun.prems(1) Fu *] Ana\\<^sub>f_assm2_alt[OF *]\n by (meson prod.inject)+\n\n have ***: \"\\i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K'). i < length T\" \"\\i \\ set M'. i < length T\" using **(3,4) by auto\n \n have \"K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ = K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) (map (\\t. t \\ \\) T)\"\n \"M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ = map ((!) (map (\\t. t \\ \\) T)) M'\"\n using subst_idx_map[OF ***(2), of \\]\n subst_idx_map'[OF ***(1), of \\]\n **(1,2)\n by fast+\n thus ?thesis using Fu * **(3,5) by auto\n qed auto\nqed simp\n\nsublocale intruder_model arity public Ana\napply unfold_locales\nby (metis assm1, metis assm2, rule Ana.simps, metis assm4, metis assm5)\n\nadhoc_overloading INTRUDER_SYNTH intruder_synth\nadhoc_overloading INTRUDER_DEDUCT intruder_deduct\n\nlemma assm6: \"arity c = 0 \\ \\a. \\X. \\ (Fun c X) = TAtom a\" by (cases c) auto\n\nlemma assm7: \"0 < arity f \\ \\ (Fun f T) = TComp f (map \\ T)\" by auto\n\nlemma assm8: \"infinite {c. \\ (Fun c []::('fun,'atom,'sets,'lbl) prot_term) = TAtom a \\ public c}\"\n (is \"?P a\")\nproof -\n let ?T = \"\\f. (range f)::('fun,'atom,'sets,'lbl) prot_fun set\"\n let ?A = \"\\f. \\x::nat \\ UNIV. \\y::nat \\ UNIV. (f x = f y) = (x = y)\"\n let ?B = \"\\f. \\x::nat \\ UNIV. f x \\ ?T f\"\n let ?C = \"\\f. \\y::('fun,'atom,'sets,'lbl) prot_fun \\ ?T f. \\x \\ UNIV. y = f x\"\n let ?D = \"\\f b. ?T f \\ {c. \\ (Fun c []::('fun,'atom,'sets,'lbl) prot_term) = TAtom b \\ public c}\"\n\n have sub_lmm: \"?P b\" when \"?A f\" \"?C f\" \"?C f\" \"?D f b\" for b f\n proof -\n have \"\\g::nat \\ ('fun,'atom,'sets,'lbl) prot_fun. bij_betw g UNIV (?T f)\"\n using bij_betwI'[of UNIV f \"?T f\"] that(1,2,3) by blast\n hence \"infinite (?T f)\" by (metis nat_not_finite bij_betw_finite)\n thus ?thesis using infinite_super[OF that(4)] by blast\n qed\n\n show ?thesis\n proof (cases a)\n case (Atom b) thus ?thesis using sub_lmm[of \"PubConst (Atom b)\" a] by force\n next\n case Value thus ?thesis using sub_lmm[of \"PubConst Value\" a] by force\n next\n case SetType thus ?thesis using sub_lmm[of \"PubConst SetType\" a] by fastforce\n next\n case AttackType thus ?thesis using sub_lmm[of \"PubConst AttackType\" a] by fastforce\n next\n case Bottom thus ?thesis using sub_lmm[of \"PubConst Bottom\" a] by fastforce\n next\n case OccursSecType thus ?thesis using sub_lmm[of \"PubConst OccursSecType\" a] by fastforce\n next\n case AbsValue thus ?thesis using sub_lmm[of \"PubConst AbsValue\" a] by force\n qed\nqed\n\nlemma assm9: \"TComp f T \\ \\ t \\ arity f > 0\"\nproof (induction t rule: term.induct)\n case (Var x)\n hence \"\\ (Var x) \\ TAtom Bottom\" by force\n hence \"\\t \\ subterms (fst x). case t of\n TComp f T \\ arity f > 0 \\ arity f = length T\n | _ \\ True\"\n using Var \\.simps(1)[of x] unfolding \\\\<^sub>v_def by meson\n thus ?case using Var by (fastforce simp add: \\\\<^sub>v_def)\nnext\n case (Fun g S)\n have \"arity g \\ 0\" using Fun.prems Var_subtermeq assm6 by force\n thus ?case using Fun by (cases \"TComp f T = TComp g (map \\ S)\") auto\nqed\n\nlemma assm10: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ (Var x))\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by (auto simp add: \\\\<^sub>v_def)\n\nlemma assm11: \"arity f > 0 \\ public f\" using public\\<^sub>f_assm by (cases f) auto\n\nlemma assm12: \"\\ (Var (\\, n)) = \\ (Var (\\, m))\" by (simp add: \\\\<^sub>v_def)\n\nlemma assm13: \"arity c = 0 \\ Ana (Fun c T) = ([],[])\" by (cases c) simp_all\n\nlemma assm14:\n assumes \"Ana (Fun f T) = (K,M)\"\n shows \"Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\nproof -\n show ?thesis\n proof (cases \"(K, M) = ([],[])\")\n case True\n { fix g assume f: \"f = Fu g\"\n obtain K' M' where \"Ana\\<^sub>f g = (K',M')\" by moura\n hence ?thesis using assms f True by auto\n } thus ?thesis using True assms by (cases f) auto\n next\n case False\n then obtain g where **: \"f = Fu g\" using assms by (cases f) auto\n obtain K' M' where *: \"Ana\\<^sub>f g = (K',M')\" by moura\n have ***: \"K = K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) T\" \"M = map ((!) T) M'\" \"arity\\<^sub>f g = length T\"\n \"\\i \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set K') \\ set M'. i < arity\\<^sub>f g\"\n using Ana_Fu_cases(1)[OF assms ** *] False Ana\\<^sub>f_assm2_alt[OF *]\n by (meson prod.inject)+\n have ****: \"\\i\\fv\\<^sub>s\\<^sub>e\\<^sub>t (set K'). i < length T\" \"\\i\\set M'. i < length T\" using ***(3,4) by auto\n have \"K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ = K' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t (!) (map (\\t. t \\ \\) T)\"\n \"M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ = map ((!) (map (\\t. t \\ \\) T)) M'\"\n using subst_idx_map[OF ****(2), of \\]\n subst_idx_map'[OF ****(1), of \\]\n ***(1,2)\n by auto\n thus ?thesis using assms * ** ***(3) by auto\n qed\nqed\n\nsublocale labeled_stateful_typing' arity public Ana \\ Pair label_witness1 label_witness2\n apply unfold_locales\n subgoal by (metis assm6)\n subgoal by (metis assm7)\n subgoal by (metis assm9)\n subgoal by (rule assm10)\n subgoal by (metis assm12)\n subgoal by (metis assm13)\n subgoal by (metis assm14)\n subgoal by (rule label_witness_assm)\n subgoal by (rule arity.simps(5))\n subgoal by (metis assm14)\n subgoal by (metis assm8)\n subgoal by (metis assm11)\n done\n\n\nsubsection \\The Protocol Transition System, Defined in Terms of the Reachable Constraints\\\ndefinition transaction_decl_subst where\n \"transaction_decl_subst (\\::('fun,'atom,'sets,'lbl) prot_subst) T \\\n subst_domain \\ = fst ` set (transaction_decl T ()) \\\n (\\(x,cs) \\ set (transaction_decl T ()). \\c \\ cs.\n \\ x = Fun (Fu c) [] \\\n arity (Fu c::('fun,'atom,'sets,'lbl) prot_fun) = 0) \\\n wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n\ndefinition transaction_fresh_subst where\n \"transaction_fresh_subst \\ T \\ \\\n subst_domain \\ = set (transaction_fresh T) \\\n (\\t \\ subst_range \\. \\c. t = Fun c [] \\ \\public c \\ arity c = 0) \\\n (\\t \\ subst_range \\. t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) \\\n (\\t \\ subst_range \\. t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms_transaction T)) \\\n wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ inj_on \\ (subst_domain \\)\"\n\n(* NB: We need the protocol P as a parameter for this definition---even though we will only apply \\\n to a single transaction T of P---because we have to ensure that \\(fv(T)) is disjoint from\n the bound variables of P and \\. *)\ndefinition transaction_renaming_subst where\n \"transaction_renaming_subst \\ P \\ \\\n \\n \\ max_var_set (\\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\ = var_rename n\"\n\ndefinition (in intruder_model) constraint_model where\n \"constraint_model \\ \\ \\ \n constr_sem_stateful \\ (unlabel \\) \\\n interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\\n wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n\ndefinition (in typed_model) welltyped_constraint_model where\n \"welltyped_constraint_model \\ \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ constraint_model \\ \\\"\n\ntext \\\n The set of symbolic constraints reachable in any symbolic run of the protocol \\P\\.\n \n \\\\\\ instantiates the \"declared variables\" of transaction \\T\\ with ground terms.\n \\\\\\ instantiates the fresh variables of transaction \\T\\ with fresh terms.\n \\\\\\ is a variable-renaming whose range consists of fresh variables.\n\\\ninductive_set reachable_constraints::\n \"('fun,'atom,'sets,'lbl) prot \\ ('fun,'atom,'sets,'lbl) prot_constr set\"\n for P::\"('fun,'atom,'sets,'lbl) prot\"\nwhere\n init[simp]:\n \"[] \\ reachable_constraints P\"\n| step:\n \"\\\\ \\ reachable_constraints P;\n T \\ set P;\n transaction_decl_subst \\ T;\n transaction_fresh_subst \\ T \\;\n transaction_renaming_subst \\ P \\\n \\ \\ \\@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ reachable_constraints P\"\n\n\nsubsection \\Minor Lemmata\\\nlemma \\\\<^sub>v_TAtom[simp]: \"\\\\<^sub>v (TAtom a, n) = TAtom a\"\nunfolding \\\\<^sub>v_def by simp\n\nlemma \\\\<^sub>v_TAtom':\n assumes \"a \\ Bottom\"\n shows \"\\\\<^sub>v (\\, n) = TAtom a \\ \\ = TAtom a\"\nproof\n assume \"\\\\<^sub>v (\\, n) = TAtom a\"\n thus \"\\ = TAtom a\" by (metis (no_types, lifting) assms \\\\<^sub>v_def fst_conv term.inject(1)) \nqed simp\n\nlemma \\\\<^sub>v_TAtom_inv:\n \"\\\\<^sub>v x = TAtom (Atom a) \\ \\m. x = (TAtom (Atom a), m)\"\n \"\\\\<^sub>v x = TAtom Value \\ \\m. x = (TAtom Value, m)\"\n \"\\\\<^sub>v x = TAtom SetType \\ \\m. x = (TAtom SetType, m)\"\n \"\\\\<^sub>v x = TAtom AttackType \\ \\m. x = (TAtom AttackType, m)\"\n \"\\\\<^sub>v x = TAtom OccursSecType \\ \\m. x = (TAtom OccursSecType, m)\"\nby (metis \\\\<^sub>v_TAtom' surj_pair prot_atom.distinct(7),\n metis \\\\<^sub>v_TAtom' surj_pair prot_atom.distinct(18),\n metis \\\\<^sub>v_TAtom' surj_pair prot_atom.distinct(26),\n metis \\\\<^sub>v_TAtom' surj_pair prot_atom.distinct(32),\n metis \\\\<^sub>v_TAtom' surj_pair prot_atom.distinct(38))\n\nlemma \\\\<^sub>v_TAtom'':\n \"(fst x = TAtom (Atom a)) = (\\\\<^sub>v x = TAtom (Atom a))\" (is \"?A = ?A'\")\n \"(fst x = TAtom Value) = (\\\\<^sub>v x = TAtom Value)\" (is \"?B = ?B'\")\n \"(fst x = TAtom SetType) = (\\\\<^sub>v x = TAtom SetType)\" (is \"?C = ?C'\")\n \"(fst x = TAtom AttackType) = (\\\\<^sub>v x = TAtom AttackType)\" (is \"?D = ?D'\")\n \"(fst x = TAtom OccursSecType) = (\\\\<^sub>v x = TAtom OccursSecType)\" (is \"?E = ?E'\")\nproof -\n have 1: \"?A \\ ?A'\" \"?B \\ ?B'\" \"?C \\ ?C'\" \"?D \\ ?D'\" \"?E \\ ?E'\"\n by (metis \\\\<^sub>v_TAtom prod.collapse)+\n\n have 2: \"?A' \\ ?A\" \"?B' \\ ?B\" \"?C' \\ ?C\" \"?D' \\ ?D\" \"?E' \\ ?E\"\n using \\\\<^sub>v_TAtom \\\\<^sub>v_TAtom_inv(1) apply fastforce\n using \\\\<^sub>v_TAtom \\\\<^sub>v_TAtom_inv(2) apply fastforce\n using \\\\<^sub>v_TAtom \\\\<^sub>v_TAtom_inv(3) apply fastforce\n using \\\\<^sub>v_TAtom \\\\<^sub>v_TAtom_inv(4) apply fastforce\n using \\\\<^sub>v_TAtom \\\\<^sub>v_TAtom_inv(5) by fastforce\n\n show \"?A = ?A'\" \"?B = ?B'\" \"?C = ?C'\" \"?D = ?D'\" \"?E = ?E'\"\n using 1 2 by metis+\nqed\n\nlemma \\\\<^sub>v_Var_image:\n \"\\\\<^sub>v ` X = \\ ` Var ` X\"\nby force\n\nlemma \\_Fu_const:\n assumes \"arity\\<^sub>f g = 0\"\n shows \"\\a. \\ (Fun (Fu g) T) = TAtom (Atom a)\"\nproof -\n have \"\\\\<^sub>f g \\ None\" using assms \\\\<^sub>f_assm by blast\n thus ?thesis using assms by force\nqed\n\nlemma Fun_Value_type_inv:\n fixes T::\"('fun,'atom,'sets,'lbl) prot_term list\"\n assumes \"\\ (Fun f T) = TAtom Value\"\n shows \"(\\n. f = Val n) \\ (\\bs. f = Abs bs) \\ (\\n. f = PubConst Value n)\"\nproof -\n have *: \"arity f = 0\" by (metis const_type_inv assms) \n show ?thesis using assms\n proof (cases f)\n case (Fu g)\n hence \"arity\\<^sub>f g = 0\" using * by simp\n hence False using Fu \\_Fu_const[of g T] assms by auto\n thus ?thesis by metis\n next\n case (Set s)\n hence \"arity\\<^sub>s s = 0\" using * by simp\n hence False using Set assms by auto\n thus ?thesis by metis\n qed simp_all\nqed\n\nlemma Ana\\<^sub>f_keys_not_val_terms:\n assumes \"Ana\\<^sub>f f = (K, T)\"\n and \"k \\ set K\"\n and \"g \\ funs_term k\"\n shows \"\\is_Val g\"\n and \"\\is_PubConstValue g\"\n and \"\\is_Abs g\"\nproof -\n { assume \"is_Val g\"\n then obtain n S where *: \"Fun (Val n) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K)\"\n using assms(2) funs_term_Fun_subterm[OF assms(3)]\n by (cases g) auto\n hence False using Ana\\<^sub>f_assm1_alt[OF assms(1) *] by simp\n } moreover {\n assume \"is_PubConstValue g\"\n then obtain n S where *: \"Fun (PubConst Value n) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K)\"\n using assms(2) funs_term_Fun_subterm[OF assms(3)]\n unfolding is_PubConstValue_def by (cases g) auto\n hence False using Ana\\<^sub>f_assm1_alt[OF assms(1) *] by simp\n } moreover {\n assume \"is_Abs g\"\n then obtain a S where *: \"Fun (Abs a) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K)\"\n using assms(2) funs_term_Fun_subterm[OF assms(3)]\n by (cases g) auto\n hence False using Ana\\<^sub>f_assm1_alt[OF assms(1) *] by simp\n } ultimately show \"\\is_Val g\" \"\\is_PubConstValue g\" \"\\is_Abs g\" by metis+\nqed\n\nlemma Ana\\<^sub>f_keys_not_pairs:\n assumes \"Ana\\<^sub>f f = (K, T)\"\n and \"k \\ set K\"\n and \"g \\ funs_term k\"\n shows \"g \\ Pair\"\nproof\n assume \"g = Pair\"\n then obtain S where *: \"Fun Pair S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K)\"\n using assms(2) funs_term_Fun_subterm[OF assms(3)]\n by (cases g) auto\n show False using Ana\\<^sub>f_assm1_alt[OF assms(1) *] by simp\nqed\n\nlemma Ana_Fu_keys_funs_term_subset:\n fixes K::\"('fun,'atom,'sets,'lbl) prot_term list\"\n assumes \"Ana (Fun (Fu f) S) = (K, T)\"\n and \"Ana\\<^sub>f f = (K', T')\"\n shows \"\\(funs_term ` set K) \\ \\(funs_term ` set K') \\ funs_term (Fun (Fu f) S)\"\nproof -\n { fix k assume k: \"k \\ set K\"\n then obtain k' where k':\n \"k' \\ set K'\" \"k = k' \\ (!) S\" \"arity\\<^sub>f f = length S\"\n \"subterms k' \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set K')\"\n using assms Ana_Fu_elim[OF assms(1) _ assms(2)] by fastforce\n\n have 1: \"funs_term k' \\ \\(funs_term ` set K')\" using k'(1) by auto\n\n have \"i < length S\" when \"i \\ fv k'\" for i\n using that Ana\\<^sub>f_assm2_alt[OF assms(2), of i] k'(1,3)\n by auto\n hence 2: \"funs_term (S ! i) \\ funs_term (Fun (Fu f) S)\" when \"i \\ fv k'\" for i\n using that by force\n \n have \"funs_term k \\ \\(funs_term ` set K') \\ funs_term (Fun (Fu f) S)\"\n using funs_term_subst[of k' \"(!) S\"] k'(2) 1 2 by fast\n } thus ?thesis by blast\nqed\n\nlemma Ana_Fu_keys_not_pubval_terms:\n fixes k::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes \"Ana (Fun (Fu f) S) = (K, T)\"\n and \"Ana\\<^sub>f f = (K', T')\"\n and \"k \\ set K\"\n and \"\\g \\ funs_term (Fun (Fu f) S). \\is_PubConstValue g\"\n shows \"\\g \\ funs_term k. \\is_PubConstValue g\"\nusing assms(3,4) Ana\\<^sub>f_keys_not_val_terms(1,2)[OF assms(2)]\n Ana_Fu_keys_funs_term_subset[OF assms(1,2)]\nby blast\n\nlemma Ana_Fu_keys_not_abs_terms:\n fixes k::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes \"Ana (Fun (Fu f) S) = (K, T)\"\n and \"Ana\\<^sub>f f = (K', T')\"\n and \"k \\ set K\"\n and \"\\g \\ funs_term (Fun (Fu f) S). \\is_Abs g\"\n shows \"\\g \\ funs_term k. \\is_Abs g\"\nusing assms(3,4) Ana\\<^sub>f_keys_not_val_terms(3)[OF assms(2)]\n Ana_Fu_keys_funs_term_subset[OF assms(1,2)]\nby blast\n\nlemma Ana_Fu_keys_not_pairs:\n fixes k::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes \"Ana (Fun (Fu f) S) = (K, T)\"\n and \"Ana\\<^sub>f f = (K', T')\"\n and \"k \\ set K\"\n and \"\\g \\ funs_term (Fun (Fu f) S). g \\ Pair\"\n shows \"\\g \\ funs_term k. g \\ Pair\"\nusing assms(3,4) Ana\\<^sub>f_keys_not_pairs[OF assms(2)]\n Ana_Fu_keys_funs_term_subset[OF assms(1,2)]\nby blast\n\nlemma Ana_Fu_keys_length_eq:\n assumes \"length T = length S\"\n shows \"length (fst (Ana (Fun (Fu f) T))) = length (fst (Ana (Fun (Fu f) S)))\"\nproof (cases \"arity\\<^sub>f f = length T \\ arity\\<^sub>f f > 0\")\n case True thus ?thesis using assms by (cases \"Ana\\<^sub>f f\") auto\nnext\n case False thus ?thesis using assms by force\nqed\n\nlemma deduct_occurs_in_ik:\n fixes t::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes t: \"M \\ occurs t\"\n and M: \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M. OccursFact \\ \\(funs_term ` set (snd (Ana s)))\"\n \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M. OccursSec \\ \\(funs_term ` set (snd (Ana s)))\"\n \"Fun OccursSec [] \\ M\"\n shows \"occurs t \\ M\"\nusing private_fun_deduct_in_ik''[of M OccursFact \"[Fun OccursSec [], t]\" OccursSec] t M \nby fastforce\n\nlemma constraint_model_prefix:\n assumes \"constraint_model I (A@B)\"\n shows \"constraint_model I A\"\nby (metis assms strand_sem_append_stateful unlabel_append constraint_model_def)\n\nlemma welltyped_constraint_model_prefix:\n assumes \"welltyped_constraint_model I (A@B)\"\n shows \"welltyped_constraint_model I A\"\nby (metis assms constraint_model_prefix welltyped_constraint_model_def)\n\nlemma welltyped_constraint_model_deduct_append:\n assumes \"welltyped_constraint_model I A\"\n and \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ s \\ I\"\n shows \"welltyped_constraint_model I (A@[(l,send\\[s]\\)])\"\nusing assms strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel A\" _ I]\nunfolding welltyped_constraint_model_def constraint_model_def by simp\n\nlemma welltyped_constraint_model_deduct_split:\n assumes \"welltyped_constraint_model I (A@[(l,send\\[s]\\)])\"\n shows \"welltyped_constraint_model I A\"\n and \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ s \\ I\"\nusing assms strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel A\" _ I]\nunfolding welltyped_constraint_model_def constraint_model_def by simp_all\n\nlemma welltyped_constraint_model_deduct_iff:\n \"welltyped_constraint_model I (A@[(l,send\\[s]\\)]) \\\n welltyped_constraint_model I A \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ s \\ I\"\nby (metis welltyped_constraint_model_deduct_append welltyped_constraint_model_deduct_split) \n\nlemma constraint_model_Val_is_Value_term:\n assumes \"welltyped_constraint_model I A\"\n and \"t \\ I = Fun (Val n) []\"\n shows \"t = Fun (Val n) [] \\ (\\m. t = Var (TAtom Value, m))\"\nproof -\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\" using assms(1) unfolding welltyped_constraint_model_def by simp\n moreover have \"\\ (Fun (Val n) []) = TAtom Value\" by auto\n ultimately have *: \"\\ t = TAtom Value\" by (metis (no_types) assms(2) wt_subst_trm'')\n\n show ?thesis\n proof (cases t)\n case (Var x)\n obtain \\ m where x: \"x = (\\, m)\" by (metis surj_pair)\n have \"\\\\<^sub>v x = TAtom Value\" using * Var by auto\n hence \"\\ = TAtom Value\" using x \\\\<^sub>v_TAtom'[of Value \\ m] by simp\n thus ?thesis using x Var by metis\n next\n case (Fun f T) thus ?thesis using assms(2) by auto\n qed\nqed\n\nlemma wellformed_transaction_sem_receives:\n fixes T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n assumes T_valid: \"wellformed_transaction T\"\n and \\: \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\"\n and s: \"receive\\ts\\ \\ set (unlabel (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n shows \"\\t \\ set ts. IK \\ t \\ \\\"\nproof -\n let ?R = \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S = \"\\A. unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S' = \"?S (transaction_receive T)\"\n\n obtain l B s where B:\n \"(l,send\\ts\\) = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ((l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"prefix ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\]) (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using s dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(2)[of ts \"transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_in_set_prefix_obtain_subst[of \"send\\ts\\\" \"transaction_receive T\" \\]\n by blast\n\n have 1: \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\])) = unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[send\\ts\\]\"\n using B(1) unlabel_append dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst singleton_lst_proj(4)\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst_snoc subst_lsst_append subst_lsst_singleton\n by (metis (no_types, lifting) subst_apply_labeled_stateful_strand_step.simps)\n\n have \"strand_sem_stateful IK DB ?S' \\\"\n using \\ strand_sem_append_stateful[of IK DB _ _ \\] transaction_dual_subst_unfold[of T \\]\n by fastforce\n hence \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[send\\ts\\]) \\\"\n using B 1 unfolding prefix_def unlabel_def\n by (metis dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def map_append strand_sem_append_stateful) \n hence t_deduct: \"\\t \\ set ts. IK \\ (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ t \\ \\\"\n using strand_sem_append_stateful[of IK DB \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \"[send\\ts\\]\" \\]\n by simp\n\n have \"\\s \\ set (unlabel (transaction_receive T)). \\t. s = receive\\t\\\"\n using T_valid wellformed_transaction_unlabel_cases(1)[OF T_valid] by auto\n moreover { fix A::\"('fun,'atom,'sets,'lbl) prot_strand\" and \\\n assume \"\\s \\ set (unlabel A). \\t. s = receive\\t\\\"\n hence \"\\s \\ set (unlabel (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)). \\t. s = receive\\t\\\"\n proof (induction A)\n case (Cons a A) thus ?case using subst_lsst_cons[of a A \\] by (cases a) auto\n qed simp\n hence \"\\s \\ set (unlabel (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)). \\t. s = receive\\t\\\"\n by (simp add: list.pred_set is_Receive_def)\n hence \"\\s \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))). \\t. s = send\\t\\\"\n by (metis dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_memberD dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_inv(2) unlabel_in unlabel_mem_has_label)\n }\n ultimately have \"\\s \\ set ?R. \\ts. s = send\\ts\\\" by simp\n hence \"ik\\<^sub>s\\<^sub>s\\<^sub>t ?R = {}\" unfolding unlabel_def ik\\<^sub>s\\<^sub>s\\<^sub>t_def by fast\n hence \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) = {}\"\n using B(2) 1 ik\\<^sub>s\\<^sub>s\\<^sub>t_append dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append\n by (metis (no_types, lifting) Un_empty map_append prefix_def unlabel_def) \n thus ?thesis using t_deduct by simp\nqed\n\nlemma wellformed_transaction_sem_pos_checks:\n assumes T_valid: \"wellformed_transaction T\"\n and \\: \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\"\n and \"\\ac: t \\ u\\ \\ set (unlabel (transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n shows \"(t \\ \\, u \\ \\) \\ DB\"\nproof -\n let ?s = \"\\ac: t \\ u\\\"\n let ?R = \"transaction_receive T@transaction_checks T\"\n let ?R' = \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S = \"\\A. unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S' = \"?S (transaction_receive T)@?S (transaction_checks T)\"\n let ?P = \"\\a. is_Receive a \\ is_Check_or_Assignment a\"\n let ?Q = \"\\a. is_Send a \\ is_Check_or_Assignment a\"\n\n have s: \"?s \\ set (unlabel (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using assms(3) subst_lsst_append[of \"transaction_receive T\"]\n unlabel_append[of \"transaction_receive T\"]\n by auto\n\n obtain l B s where B:\n \"(l,?s) = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ((l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"prefix ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\]) (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using s dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(6)[of _ t u]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_in_set_prefix_obtain_subst[of ?s ?R \\] \n by blast\n\n have 1: \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\])) = unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[?s]\"\n using B(1) unlabel_append dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst singleton_lst_proj(4)\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst_snoc subst_lsst_append subst_lsst_singleton\n by (metis (no_types, lifting) subst_apply_labeled_stateful_strand_step.simps )\n\n have \"strand_sem_stateful IK DB ?S' \\\"\n using \\ strand_sem_append_stateful[of IK DB _ _ \\] transaction_dual_subst_unfold[of T \\]\n by fastforce\n hence \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[?s]) \\\"\n using B 1 strand_sem_append_stateful subst_lsst_append\n unfolding prefix_def unlabel_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n by (metis (no_types) map_append)\n hence in_db: \"(t \\ \\, u \\ \\) \\ dbupd\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\ DB\"\n using strand_sem_append_stateful[of IK DB \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \"[?s]\" \\]\n by simp\n \n have \"\\a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))). ?Q a\"\n proof\n fix a assume a: \"a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n\n have \"?P a\" when a: \"a \\ set (unlabel ?R)\" for a\n using a wellformed_transaction_unlabel_cases(1,2)[OF T_valid]\n unfolding unlabel_def by fastforce\n hence \"?P a\" when a: \"a \\ set (unlabel (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" for a\n using a stateful_strand_step_cases_subst(2,11)[of _ \\] subst_lsst_unlabel[of ?R \\]\n unfolding subst_apply_stateful_strand_def by auto\n hence B_P: \"\\a \\ set (unlabel (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)). ?P a\"\n using unlabel_mono[OF set_mono_prefix[OF append_prefixD[OF B(2)]]]\n by blast\n\n obtain l where \"(l,a) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using a by (meson unlabel_mem_has_label)\n then obtain b where b: \"(l,b) \\ set (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (l,b) = (l,a)\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_memberD by blast\n hence \"?P b\" using B_P unfolding unlabel_def by fastforce\n thus \"?Q a\" using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_inv[OF b(2)] by (cases b) auto\n qed\n hence \"\\a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))). \\is_Insert a \\ \\is_Delete a\" by fastforce\n thus ?thesis using dbupd\\<^sub>s\\<^sub>s\\<^sub>t_no_upd[of \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \\ DB] in_db by simp\nqed\n\nlemma wellformed_transaction_sem_neg_checks:\n assumes T_valid: \"wellformed_transaction T\"\n and \\: \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\"\n and \"NegChecks X [] [(t,u)] \\ set (unlabel (transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n shows \"\\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ (t \\ \\ \\ \\, u \\ \\ \\ \\) \\ DB\" (is ?A)\n and \"X = [] \\ (t \\ \\, u \\ \\) \\ DB\" (is \"?B \\ ?B'\")\nproof -\n let ?s = \"NegChecks X [] [(t,u)]\"\n let ?R = \"transaction_receive T@transaction_checks T\"\n let ?R' = \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S = \"\\A. unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n let ?S' = \"?S (transaction_receive T)@?S (transaction_checks T)\"\n let ?P = \"\\a. is_Receive a \\ is_Check_or_Assignment a\"\n let ?Q = \"\\a. is_Send a \\ is_Check_or_Assignment a\"\n let ?U = \"\\\\. subst_domain \\ = set X \\ ground (subst_range \\)\"\n\n have s: \"?s \\ set (unlabel (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using assms(3) subst_lsst_append[of \"transaction_receive T\"]\n unlabel_append[of \"transaction_receive T\"]\n by auto\n\n obtain l B s where B:\n \"(l,?s) = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ((l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"prefix ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\]) (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using s dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(7)[of X \"[]\" \"[(t,u)]\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_in_set_prefix_obtain_subst[of ?s ?R \\]\n by blast\n\n have 1: \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ((B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@[(l,s) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\])) = unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[?s]\"\n using B(1) unlabel_append dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst singleton_lst_proj(4)\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst_snoc subst_lsst_append subst_lsst_singleton\n by (metis (no_types, lifting) subst_apply_labeled_stateful_strand_step.simps)\n\n have \"strand_sem_stateful IK DB ?S' \\\"\n using \\ strand_sem_append_stateful[of IK DB _ _ \\] transaction_dual_subst_unfold[of T \\]\n by fastforce\n hence \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))@[?s]) \\\"\n using B 1 strand_sem_append_stateful subst_lsst_append\n unfolding prefix_def unlabel_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n by (metis (no_types) map_append)\n hence \"negchecks_model \\ (dbupd\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\ DB) X [] [(t,u)]\"\n using strand_sem_append_stateful[of IK DB \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \"[?s]\" \\]\n by fastforce\n hence in_db: \"\\\\. ?U \\ \\ (t \\ \\ \\ \\, u \\ \\ \\ \\) \\ dbupd\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\ DB\"\n unfolding negchecks_model_def\n by simp\n\n have \"\\a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))). ?Q a\"\n proof\n fix a assume a: \"a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n\n have \"?P a\" when a: \"a \\ set (unlabel ?R)\" for a\n using a wellformed_transaction_unlabel_cases(1,2,3)[OF T_valid]\n unfolding unlabel_def by fastforce\n hence \"?P a\" when a: \"a \\ set (unlabel (?R \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" for a\n using a stateful_strand_step_cases_subst(2,11)[of _ \\] subst_lsst_unlabel[of ?R \\]\n unfolding subst_apply_stateful_strand_def by auto\n hence B_P: \"\\a \\ set (unlabel (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)). ?P a\"\n using unlabel_mono[OF set_mono_prefix[OF append_prefixD[OF B(2)]]]\n by blast\n\n obtain l where \"(l,a) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using a by (meson unlabel_mem_has_label)\n then obtain b where b: \"(l,b) \\ set (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (l,b) = (l,a)\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_memberD by blast\n hence \"?P b\" using B_P unfolding unlabel_def by fastforce\n thus \"?Q a\" using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_inv[OF b(2)] by (cases b) auto\n qed\n hence \"\\a \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))). \\is_Insert a \\ \\is_Delete a\" by fastforce\n thus ?A using dbupd\\<^sub>s\\<^sub>s\\<^sub>t_no_upd[of \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (B \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \\ DB] in_db by simp\n moreover have \"\\ = Var\" \"t \\ \\ = t\"\n when \"subst_domain \\ = set []\" for t and \\::\"('fun, 'atom, 'sets, 'lbl) prot_subst\"\n using that by auto\n moreover have \"subst_domain Var = set []\" \"range_vars Var = {}\"\n by simp_all\n ultimately show \"?B \\ ?B'\" unfolding range_vars_alt_def by metis\nqed\n\nlemma dual_transaction_ik_is_transaction_send'':\n fixes \\ \\::\"('a,'b,'c,'d) prot_subst\"\n assumes \"wellformed_transaction T\"\n shows \"(ik\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a =\n (trms\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a\" (is \"?A = ?B\")\nusing dual_transaction_ik_is_transaction_send[OF assms]\n subst_lsst_unlabel[of \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)\" \\]\n ik\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T))\" \\]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"transaction_strand T\" \\]\nby (auto simp add: abs_apply_terms_def)\n\nlemma while_prot_terms_fun_mono:\n \"mono (\\M'. M \\ \\(subterms ` M') \\ \\((set \\ fst \\ Ana) ` M'))\"\nunfolding mono_def by fast\n\nlemma while_prot_terms_SMP_overapprox:\n fixes M::\"('fun,'atom,'sets,'lbl) prot_terms\"\n assumes N_supset: \"M \\ \\(subterms ` N) \\ \\((set \\ fst \\ Ana) ` N) \\ N\"\n and Value_vars_only: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t N. \\\\<^sub>v x = TAtom Value\"\n shows \"SMP M \\ {a \\ \\ | a \\. a \\ N \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)}\"\nproof -\n define f where \"f \\ \\M'. M \\ \\(subterms ` M') \\ \\((set \\ fst \\ Ana) ` M')\"\n define S where \"S \\ {a \\ \\ | a \\. a \\ N \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)}\"\n\n note 0 = Value_vars_only\n \n have \"t \\ S\" when \"t \\ SMP M\" for t\n using that\n proof (induction t rule: SMP.induct)\n case (MP t)\n hence \"t \\ N\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" using N_supset by auto\n hence \"t \\ Var \\ S\" unfolding S_def by blast\n thus ?case by simp\n next\n case (Subterm t t')\n then obtain \\ a where a: \"a \\ \\ = t\" \"a \\ N\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (auto simp add: S_def)\n hence \"\\x \\ fv a. \\\\. \\ (Var x) = TAtom \\\" using 0 by auto\n hence *: \"\\x \\ fv a. (\\f. \\ x = Fun f []) \\ (\\y. \\ x = Var y)\"\n using a(3) TAtom_term_cases[OF wf_trm_subst_rangeD[OF a(4)]]\n by (metis wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n obtain b where b: \"b \\ \\ = t'\" \"b \\ subterms a\"\n using subterms_subst_subterm[OF *, of t'] Subterm.hyps(2) a(1)\n by fast\n hence \"b \\ N\" using N_supset a(2) by blast\n thus ?case using a b(1) unfolding S_def by blast\n next\n case (Substitution t \\)\n then obtain \\ a where a: \"a \\ \\ = t\" \"a \\ N\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (auto simp add: S_def)\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\"\n by (fact wt_subst_compose[OF a(3) Substitution.hyps(2)],\n fact wf_trms_subst_compose[OF a(4) Substitution.hyps(3)])\n moreover have \"t \\ \\ = a \\ \\ \\\\<^sub>s \\\" using a(1) subst_subst_compose[of a \\ \\] by simp\n ultimately show ?case using a(2) unfolding S_def by blast\n next\n case (Ana t K T k)\n then obtain \\ a where a: \"a \\ \\ = t\" \"a \\ N\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (auto simp add: S_def)\n obtain Ka Ta where a': \"Ana a = (Ka,Ta)\" by moura\n have *: \"K = Ka \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\"\n proof (cases a)\n case (Var x)\n then obtain g U where gU: \"t = Fun g U\"\n using a(1) Ana.hyps(2,3) Ana_var\n by (cases t) simp_all\n have \"\\ (Var x) = TAtom Value\" using Var a(2) 0 by auto\n hence \"\\ (Fun g U) = TAtom Value\"\n using a(1,3) Var gU wt_subst_trm''[OF a(3), of a]\n by argo\n thus ?thesis using gU Fun_Value_type_inv Ana.hyps(2,3) by fastforce \n next\n case (Fun g U) thus ?thesis using a(1) a' Ana.hyps(2) Ana_subst'[of g U] by simp\n qed\n then obtain ka where ka: \"k = ka \\ \\\" \"ka \\ set Ka\" using Ana.hyps(3) by auto\n have \"ka \\ set ((fst \\ Ana) a)\" using ka(2) a' by simp\n hence \"ka \\ N\" using a(2) N_supset by auto\n thus ?case using ka a(3,4) unfolding S_def by blast\n qed\n thus ?thesis unfolding S_def by blast\nqed\n\n\nsubsection \\Admissible Transactions\\\ndefinition admissible_transaction_checks where\n \"admissible_transaction_checks T \\\n \\x \\ set (unlabel (transaction_checks T)).\n (is_InSet x \\\n is_Var (the_elem_term x) \\ is_Fun_Set (the_set_term x) \\\n fst (the_Var (the_elem_term x)) = TAtom Value) \\\n (is_NegChecks x \\\n bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = [] \\\n ((the_eqs x = [] \\ length (the_ins x) = 1) \\\n (the_ins x = [] \\ length (the_eqs x) = 1))) \\\n (is_NegChecks x \\ the_eqs x = [] \\ (let h = hd (the_ins x) in\n is_Var (fst h) \\ is_Fun_Set (snd h) \\\n fst (the_Var (fst h)) = TAtom Value))\"\n\ndefinition admissible_transaction_updates where\n \"admissible_transaction_updates T \\\n \\x \\ set (unlabel (transaction_updates T)).\n is_Update x \\ is_Var (the_elem_term x) \\ is_Fun_Set (the_set_term x) \\\n fst (the_Var (the_elem_term x)) = TAtom Value\"\n\ndefinition admissible_transaction_terms where\n \"admissible_transaction_terms T \\\n wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) \\\n (\\f \\ \\(funs_term ` trms_transaction T).\n \\is_Val f \\ \\is_Abs f \\ \\is_PubConst f \\ f \\ Pair) \\\n (\\r \\ set (unlabel (transaction_strand T)).\n (\\f \\ \\(funs_term ` (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r)). is_Attack f) \\\n is_Send r \\ length (the_msgs r) = 1 \\ is_Fun_Attack (hd (the_msgs r)))\"\n\ndefinition admissible_transaction_occurs_checks where\n \"admissible_transaction_occurs_checks T \\ (\n let occ_in = \\x S. occurs (Var x) \\ set (the_msgs (hd (unlabel S)));\n rcvs = transaction_receive T;\n snds = transaction_send T;\n frsh = transaction_fresh T;\n fvs = fv_transaction T\n in ((\\x \\ fvs - set frsh. fst x = TAtom Value) \\ (\n rcvs \\ [] \\ is_Receive (hd (unlabel rcvs)) \\\n (\\x \\ fvs - set frsh. fst x = TAtom Value \\ occ_in x rcvs))) \\\n (frsh \\ [] \\ (\n snds \\ [] \\ is_Send (hd (unlabel snds)) \\\n (\\x \\ set frsh. occ_in x snds))) \\\n (\\t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t snds.\n OccursFact \\ funs_term t \\ OccursSec \\ funs_term t \\\n (\\x \\ set (transaction_fresh T). t = occurs (Var x)))\n)\"\n\ndefinition admissible_transaction where\n \"admissible_transaction T \\ (\n wellformed_transaction T \\\n transaction_decl T () = [] \\\n list_all (\\x. fst x = TAtom Value) (transaction_fresh T) \\\n (\\x \\ vars_transaction T. is_Var (fst x) \\ (the_Var (fst x) = Value)) \\\n bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) = {} \\\n set (transaction_fresh T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (filter (is_Insert \\ snd) (transaction_updates T)) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\n (\\x \\ fv_transaction T - set (transaction_fresh T).\n \\y \\ fv_transaction T - set (transaction_fresh T).\n x \\ y \\ \\Var x != Var y\\ \\ set (unlabel (transaction_checks T)) \\\n \\Var y != Var x\\ \\ set (unlabel (transaction_checks T))) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) - set (transaction_fresh T)\n \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) \\\n (\\r \\ set (unlabel (transaction_checks T)).\n is_Equality r \\ fv (the_rhs r) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (filter (\\s. is_InSet (snd s) \\ the_check (snd s) = Assign) (transaction_checks T)) \\\n admissible_transaction_checks T \\\n admissible_transaction_updates T \\\n admissible_transaction_terms T \\\n admissible_transaction_occurs_checks T\n)\"\n\nlemma admissible_transactionE:\n assumes T: \"admissible_transaction T\"\n shows \"transaction_decl T () = []\" (is ?A)\n and \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\" (is ?B)\n and \"\\x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T). \\\\<^sub>v x = TAtom Value\" (is ?C)\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) = {}\" (is ?D1)\n and \"fv_transaction T \\ bvars_transaction T = {}\" (is ?D2)\n and \"set (transaction_fresh T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (filter (is_Insert \\ snd) (transaction_updates T)) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n (is ?E)\n and \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n (is ?F)\n and \"\\x \\ fv_transaction T - set (transaction_fresh T).\n \\y \\ fv_transaction T - set (transaction_fresh T).\n x \\ y \\ \\Var x != Var y\\ \\ set (unlabel (transaction_checks T)) \\\n \\Var y != Var x\\ \\ set (unlabel (transaction_checks T))\"\n (is ?G)\n and \"\\x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T).\n x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\\n (\\t s. select\\t,s\\ \\ set (unlabel (transaction_checks T)) \\ x \\ fv t \\ fv s)\"\n (is ?H)\n and \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) - set (transaction_fresh T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n (is ?I)\n and \"\\x \\ set (unlabel (transaction_checks T)).\n is_Equality x \\ fv (the_rhs x) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\"\n (is ?J)\n and \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) = {}\" (is ?K1)\n and \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) = {}\" (is ?K2)\n and \"list_all (\\x. fst x = Var Value) (transaction_fresh T)\" (is ?K3)\n and \"\\x \\ vars_transaction T. \\TAtom AttackType \\ \\\\<^sub>v x\" (is ?K4)\nproof -\n show ?A ?D1 ?D2 ?G ?I ?J ?K3\n using T unfolding admissible_transaction_def\n by (blast, blast, blast, blast, blast, blast, blast)\n\n have \"list_all (\\x. fst x = Var Value) (transaction_fresh T)\"\n \"\\x\\vars_transaction T. is_Var (fst x) \\ the_Var (fst x) = Value\"\n using T unfolding admissible_transaction_def by (blast, blast)\n thus ?B ?C ?K4 using \\\\<^sub>v_TAtom''(2) unfolding list_all_iff by (blast, force, force)\n\n show ?E using T unfolding admissible_transaction_def by argo\n thus ?F unfolding unlabel_def by auto\n\n show ?K1 ?K2\n using T unfolding admissible_transaction_def wellformed_transaction_def by (argo, argo)\n\n let ?selects = \"filter (\\s. is_InSet (snd s) \\ the_check (snd s) = Assign) (transaction_checks T)\"\n\n show ?H\n proof\n fix x assume \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n hence \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\ x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?selects\"\n using T unfolding admissible_transaction_def by blast\n thus \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\\n (\\t s. select\\t,s\\ \\ set (unlabel (transaction_checks T)) \\ x \\ fv t \\ fv s)\"\n proof\n assume \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?selects\"\n then obtain r where r: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r\" \"r \\ set (unlabel (transaction_checks T))\"\n \"is_InSet r\" \"the_check r = Assign\"\n unfolding unlabel_def by force\n thus ?thesis by (cases r) auto\n qed simp\n qed\nqed\n\nlemma admissible_transaction_is_wellformed_transaction:\n assumes \"admissible_transaction T\"\n shows \"wellformed_transaction T\"\n and \"admissible_transaction_checks T\"\n and \"admissible_transaction_updates T\"\n and \"admissible_transaction_terms T\"\n and \"admissible_transaction_occurs_checks T\"\nusing assms unfolding admissible_transaction_def by blast+\n\nlemma admissible_transaction_fresh_vars_notin:\n assumes T: \"admissible_transaction T\"\n and x: \"x \\ set (transaction_fresh T)\"\n shows \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\" (is ?A)\n and \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\" (is ?B)\n and \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\" (is ?C)\n and \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\" (is ?D)\n and \"x \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\" (is ?E)\n and \"x \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\" (is ?F)\nproof -\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T]\n\n have 0:\n \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) = {}\"\n \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) = {}\"\n \"fv_transaction T \\ bvars_transaction T = {}\"\n using admissible_transactionE[OF T] by argo+\n\n have 1: \"set (transaction_fresh T) \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) = {}\"\n using 0(1,4) fv_transaction_unfold[of T] bvars_transaction_unfold[of T] by blast\n\n have 2:\n \"vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) = fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\"\n \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) = {}\"\n using bvars_wellformed_transaction_unfold[OF T_wf]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel (transaction_receive T)\"]\n by blast+\n \n show ?A ?B ?C ?E ?F using 0 1 2 x by (fast, fast, fast, fast, fast)\n\n show ?D using 0(3) 1 x vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel (transaction_checks T)\"] by fast\nqed\n\nlemma admissible_transaction_fv_in_receives_or_selects:\n assumes T: \"admissible_transaction T\"\n and x: \"x \\ fv_transaction T\" \"x \\ set (transaction_fresh T)\"\n shows \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\\n (x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) \\\n (\\t s. select\\t,s\\ \\ set (unlabel (transaction_checks T)) \\ x \\ fv t \\ fv s))\"\nproof -\n have \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) \\\n fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n using x(1) fv\\<^sub>s\\<^sub>s\\<^sub>t_append unlabel_append \n by (metis transaction_strand_def append_assoc)\n thus ?thesis using x(2) admissible_transactionE(9,10)[OF T] by blast\nqed\n\nlemma admissible_transaction_decl_subst_empty':\n assumes T: \"transaction_decl T () = []\"\n and \\: \"transaction_decl_subst \\ T\"\n shows \"\\ = Var\"\nproof -\n have \"subst_domain \\ = {}\"\n using \\ T unfolding transaction_decl_subst_def by auto\n thus ?thesis by auto\nqed\n\nlemma admissible_transaction_decl_subst_empty:\n assumes T: \"admissible_transaction T\"\n and \\: \"transaction_decl_subst \\ T\"\n shows \"\\ = Var\"\nby (rule admissible_transaction_decl_subst_empty'[OF admissible_transactionE(1)[OF T] \\])\n\nlemma admissible_transaction_no_bvars:\n assumes \"admissible_transaction T\"\n shows \"fv_transaction T = vars_transaction T\"\n and \"bvars_transaction T = {}\"\nusing admissible_transactionE(4)[OF assms]\n bvars_wellformed_transaction_unfold vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t\nby (fast, fast)\n\nlemma admissible_transactions_fv_bvars_disj:\n assumes \"\\T \\ set P. admissible_transaction T\"\n shows \"(\\T \\ set P. fv_transaction T) \\ (\\T \\ set P. bvars_transaction T) = {}\"\nusing assms admissible_transaction_no_bvars(2) by fast\n\nlemma admissible_transaction_occurs_fv_types:\n assumes \"admissible_transaction T\"\n and \"x \\ vars_transaction T\"\n shows \"\\a. \\ (Var x) = TAtom a \\ \\ (Var x) \\ TAtom OccursSecType\"\nproof -\n have \"is_Var (fst x)\" \"the_Var (fst x) = Value\"\n using assms unfolding admissible_transaction_def by blast+\n thus ?thesis using \\\\<^sub>v_TAtom''(2)[of x] by force\nqed\n\nlemma admissible_transaction_Value_vars_are_fv:\n assumes \"admissible_transaction T\"\n and \"x \\ vars_transaction T\"\n and \"\\\\<^sub>v x = TAtom Value\"\n shows \"x \\ fv_transaction T\"\nusing assms(2,3) \\\\<^sub>v_TAtom''(2)[of x] vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel (transaction_strand T)\"]\n admissible_transactionE(4)[OF assms(1)]\nby fast\n\nlemma transaction_receive_deduct:\n assumes T_wf: \"wellformed_transaction T\"\n and \\: \"constraint_model \\ (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n and \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T A\"\n and \\: \"transaction_renaming_subst \\ P A\"\n and t: \"receive\\ts\\ \\ set (unlabel (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n shows \"\\t \\ set ts. ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\"\nproof -\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n have t': \"send\\ts\\ \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n using t dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(2) unfolding \\_def by blast\n then obtain T1 T2 where T: \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) = T1@send\\ts\\#T2\"\n using t' by (meson split_list)\n\n have \"constr_sem_stateful \\ (unlabel A@unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n using \\ unlabel_append[of A] unfolding constraint_model_def \\_def by simp\n hence \"constr_sem_stateful \\ (unlabel A@T1@[send\\ts\\])\"\n using strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel A@T1@[send\\ts\\]\" _ \\]\n transaction_dual_subst_unlabel_unfold[of T \\] T\n by (metis append.assoc append_Cons append_Nil)\n hence \"\\t \\ set ts. ik\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A@T1) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\\"\n using strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel A@T1\" \"[send\\ts\\]\" \\] T\n by force\n moreover have \"\\is_Receive x\"\n when x: \"x \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\" for x\n proof -\n have *: \"is_Receive a\" when \"a \\ set (unlabel (transaction_receive T))\" for a\n using T_wf Ball_set[of \"unlabel (transaction_receive T)\" is_Receive] that\n unfolding wellformed_transaction_def\n by blast\n\n obtain l where l: \"(l,x) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using x unfolding unlabel_def by fastforce\n then obtain ly where ly: \"ly \\ set (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"(l,x) = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ly\"\n unfolding dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\n obtain j y where j: \"ly = (j,y)\" by (metis surj_pair)\n hence \"j = l\" using ly(2) by (cases y) auto\n hence y: \"(l,y) \\ set (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"(l,x) = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (l,y)\"\n by (metis j ly(1), metis j ly(2))\n\n obtain z where z:\n \"z \\ set (unlabel (transaction_receive T))\"\n \"(l,z) \\ set (transaction_receive T)\"\n \"(l,y) = (l,z) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\"\n using y(1) unfolding subst_apply_labeled_stateful_strand_def unlabel_def by force\n\n have \"is_Receive y\" using *[OF z(1)] z(3) by (cases z) auto\n thus \"\\is_Receive x\" using l y by (cases y) auto\n qed\n hence \"\\is_Receive x\" when \"x \\ set T1\" for x using T that by simp\n hence \"ik\\<^sub>s\\<^sub>s\\<^sub>t T1 = {}\" unfolding ik\\<^sub>s\\<^sub>s\\<^sub>t_def is_Receive_def by fast\n hence \"ik\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A@T1) = ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\" using ik\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\" T1] by simp\n ultimately show ?thesis by (simp add: \\_def)\nqed\n\nlemma transaction_checks_db:\n assumes T: \"admissible_transaction T\"\n and \\: \"constraint_model \\ (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n and \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T A\"\n and \\: \"transaction_renaming_subst \\ P A\"\n shows \"\\Var (TAtom Value, n) in Fun (Set s) []\\ \\ set (unlabel (transaction_checks T))\n \\ (\\ (TAtom Value, n) \\ \\, Fun (Set s) []) \\ set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\)\"\n (is \"?A \\ ?B\")\n and \"\\Var (TAtom Value, n) not in Fun (Set s) []\\ \\ set (unlabel (transaction_checks T))\n \\ (\\ (TAtom Value, n) \\ \\, Fun (Set s) []) \\ set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\)\"\n (is \"?C \\ ?D\")\nproof -\n let ?x = \"\\n. (TAtom Value, n)\"\n let ?s = \"Fun (Set s) []\"\n let ?T = \"transaction_receive T@transaction_checks T\"\n let ?T' = \"?T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n let ?S = \"\\S. transaction_receive T@S\"\n let ?S' = \"\\S. ?S S \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T \\]\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T]\n\n have \"constr_sem_stateful \\ (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using \\ unfolding constraint_model_def by simp\n moreover have\n \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) =\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S (T1@[c]) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (T2@transaction_updates T@transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n when \"transaction_checks T = T1@c#T2\" for T1 T2 c \\\n using that dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append subst_lsst_append\n unfolding transaction_strand_def\n by (metis append.assoc append_Cons append_Nil)\n ultimately have T'_model: \"constr_sem_stateful \\ (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' (T1@[(l,c)]))))\"\n when \"transaction_checks T = T1@(l,c)#T2\" for T1 T2 l c\n using strand_sem_append_stateful[of _ _ _ _ \\]\n by (simp add: that transaction_strand_def)\n\n show \"?A \\ ?B\"\n proof -\n assume a: ?A\n hence *: \"\\Var (?x n) in ?s\\ \\ set (unlabel ?T)\"\n unfolding transaction_strand_def unlabel_def by simp\n then obtain l T1 T2 where T1: \"transaction_checks T = T1@(l,\\Var (?x n) in ?s\\)#T2\"\n by (metis a split_list unlabel_mem_has_label)\n\n have \"?x n \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using a by force\n hence \"?x n \\ set (transaction_fresh T)\"\n using a admissible_transaction_fresh_vars_notin[OF T] by fast\n hence \"unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' (T1@[(l,\\Var (?x n) in ?s\\)]))) =\n unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1))@[\\\\ (?x n) in ?s\\]\"\n using T a \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append subst_lsst_append unlabel_append \\_empty\n by (fastforce simp add: transaction_fresh_subst_def unlabel_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n subst_apply_labeled_stateful_strand_def)\n moreover have \"db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) = db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1)))\"\n by (simp add: T1 db\\<^sub>s\\<^sub>s\\<^sub>t_transaction_prefix_eq[OF T_wf] del: unlabel_append)\n ultimately have \"\\M. strand_sem_stateful M (set (db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) \\)) [\\\\ (?x n) in ?s\\] \\\"\n using T'_model[OF T1] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of _ \\] strand_sem_append_stateful[of _ _ _ _ \\]\n by (simp add: db\\<^sub>s\\<^sub>s\\<^sub>t_def del: unlabel_append)\n thus ?B by simp\n qed\n\n show \"?C \\ ?D\"\n proof -\n assume a: ?C\n hence *: \"\\Var (?x n) not in ?s\\ \\ set (unlabel ?T)\"\n unfolding transaction_strand_def unlabel_def by simp\n then obtain l T1 T2 where T1: \"transaction_checks T = T1@(l,\\Var (?x n) not in ?s\\)#T2\"\n by (metis a split_list unlabel_mem_has_label)\n\n have \"?x n \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\Var (?x n) not in ?s\\\"\n using vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_cases(9)[of \"[]\" \"Var (?x n)\" ?s] by auto\n hence \"?x n \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using a unfolding vars\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n hence \"?x n \\ set (transaction_fresh T)\"\n using a admissible_transaction_fresh_vars_notin[OF T] by fast\n hence \"unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' (T1@[(l,\\Var (?x n) not in ?s\\)]))) =\n unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1))@[\\\\ (?x n) not in ?s\\]\"\n using T a \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append subst_lsst_append unlabel_append \\_empty\n by (fastforce simp add: transaction_fresh_subst_def unlabel_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n subst_apply_labeled_stateful_strand_def)\n moreover have \"db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) = db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1)))\"\n by (simp add: T1 db\\<^sub>s\\<^sub>s\\<^sub>t_transaction_prefix_eq[OF T_wf] del: unlabel_append)\n ultimately have \"\\M. strand_sem_stateful M (set (db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) \\)) [\\\\ (?x n) not in ?s\\] \\\"\n using T'_model[OF T1] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of _ \\] strand_sem_append_stateful[of _ _ _ _ \\]\n by (simp add: db\\<^sub>s\\<^sub>s\\<^sub>t_def del: unlabel_append)\n thus ?D using stateful_strand_sem_NegChecks_no_bvars(1)[of _ _ _ ?s \\] by simp\n qed\nqed\n\nlemma transaction_selects_db:\n assumes T: \"admissible_transaction T\"\n and \\: \"constraint_model \\ (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n and \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T A\"\n and \\: \"transaction_renaming_subst \\ P A\"\n shows \"select\\Var (TAtom Value, n), Fun (Set s) []\\ \\ set (unlabel (transaction_checks T))\n \\ (\\ (TAtom Value, n) \\ \\, Fun (Set s) []) \\ set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\)\"\n (is \"?A \\ ?B\")\nproof -\n let ?x = \"\\n. (TAtom Value, n)\"\n let ?s = \"Fun (Set s) []\"\n let ?T = \"transaction_receive T@transaction_checks T\"\n let ?T' = \"?T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n let ?S = \"\\S. transaction_receive T@S\"\n let ?S' = \"\\S. ?S S \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T \\]\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T]\n\n have \"constr_sem_stateful \\ (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using \\ unfolding constraint_model_def by simp\n moreover have\n \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) =\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S (T1@[c]) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)@\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (T2@transaction_updates T@transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n when \"transaction_checks T = T1@c#T2\" for T1 T2 c \\\n using that dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append subst_lsst_append\n unfolding transaction_strand_def by (metis append.assoc append_Cons append_Nil)\n ultimately have T'_model: \"constr_sem_stateful \\ (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' (T1@[(l,c)]))))\"\n when \"transaction_checks T = T1@(l,c)#T2\" for T1 T2 l c\n using strand_sem_append_stateful[of _ _ _ _ \\]\n by (simp add: that transaction_strand_def)\n\n show \"?A \\ ?B\"\n proof -\n assume a: ?A\n hence *: \"select\\Var (?x n), ?s\\ \\ set (unlabel ?T)\"\n unfolding transaction_strand_def unlabel_def by simp\n then obtain l T1 T2 where T1: \"transaction_checks T = T1@(l,select\\Var (?x n), ?s\\)#T2\"\n by (metis a split_list unlabel_mem_has_label)\n\n have \"?x n \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using a by force\n hence \"?x n \\ set (transaction_fresh T)\"\n using a admissible_transaction_fresh_vars_notin[OF T] by fast\n hence \"unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' (T1@[(l,select\\Var (?x n), ?s\\)]))) =\n unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1))@[select\\\\ (?x n), ?s\\]\"\n using T a \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_append subst_lsst_append unlabel_append \\_empty\n by (fastforce simp add: transaction_fresh_subst_def unlabel_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n subst_apply_labeled_stateful_strand_def)\n moreover have \"db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) = db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (?S' T1)))\"\n by (simp add: T1 db\\<^sub>s\\<^sub>s\\<^sub>t_transaction_prefix_eq[OF T_wf] del: unlabel_append)\n ultimately have \"\\M. strand_sem_stateful M (set (db\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) \\)) [\\\\ (?x n) in ?s\\] \\\"\n using T'_model[OF T1] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of _ \\] strand_sem_append_stateful[of _ _ _ _ \\]\n by (simp add: db\\<^sub>s\\<^sub>s\\<^sub>t_def del: unlabel_append)\n thus ?B by simp\n qed\nqed\n\nlemma admissible_transaction_terms_no_Value_consts:\n assumes \"admissible_transaction_terms T\"\n and \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T))\"\n shows \"\\a T. t = Fun (Val a) T\" (is ?A)\n and \"\\a T. t = Fun (Abs a) T\" (is ?B)\n and \"\\a T. t = Fun (PubConst Value a) T\" (is ?C)\nproof -\n have \"\\is_Val f\" \"\\is_Abs f\" \"\\is_PubConstValue f\"\n when \"f \\ \\(funs_term ` (trms_transaction T))\" for f\n using that assms(1)[unfolded admissible_transaction_terms_def]\n unfolding is_PubConstValue_def by (blast,blast,blast)\n moreover have \"f \\ \\(funs_term ` (trms_transaction T))\"\n when \"f \\ funs_term t\" for f\n using that assms(2) funs_term_subterms_eq(2)[of \"trms_transaction T\"] by blast+\n ultimately have *: \"\\is_Val f\" \"\\is_Abs f\" \"\\is_PubConstValue f\"\n when \"f \\ funs_term t\" for f\n using that by presburger+\n\n show ?A using *(1) by force\n show ?B using *(2) by force\n show ?C using *(3) unfolding is_PubConstValue_def by force\nqed\n\nlemma admissible_transactions_no_Value_consts:\n assumes \"admissible_transaction T\"\n and \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T))\"\n shows \"\\a T. t = Fun (Val a) T\" (is ?A)\n and \"\\a T. t = Fun (Abs a) T\" (is ?B)\n and \"\\a T. t = Fun (PubConst Value a) T\" (is ?C)\nusing admissible_transaction_terms_no_Value_consts[OF\n admissible_transaction_is_wellformed_transaction(4)[OF assms(1)] assms(2)]\nby auto\n\nlemma admissible_transactions_no_Value_consts':\n assumes \"admissible_transaction T\"\n and \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)\"\n shows \"\\a T. Fun (Val a) T \\ subterms t\"\n and \"\\a T. Fun (Abs a) T \\ subterms t\"\nusing admissible_transactions_no_Value_consts[OF assms(1)] assms(2) by fast+\n\nlemma admissible_transactions_no_Value_consts'':\n assumes \"admissible_transaction T\"\n shows \"\\n. PubConst Value n \\ \\(funs_term ` trms_transaction T)\"\n and \"\\n. Abs n \\ \\(funs_term ` trms_transaction T)\"\nusing assms\nunfolding admissible_transaction_def admissible_transaction_terms_def\nby (meson prot_fun.discI(6), meson prot_fun.discI(4))\n\nlemma admissible_transactions_no_PubConsts:\n assumes \"admissible_transaction T\"\n and \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T))\"\n shows \"\\a n T. t = Fun (PubConst a n) T\"\nproof -\n have \"\\is_PubConst f\"\n when \"f \\ \\(funs_term ` (trms_transaction T))\" for f\n using that conjunct1[OF conjunct2[OF admissible_transaction_is_wellformed_transaction(4)[\n OF assms(1), unfolded admissible_transaction_terms_def]]]\n by blast\n moreover have \"f \\ \\(funs_term ` (trms_transaction T))\"\n when \"f \\ funs_term t\" for f\n using that assms(2) funs_term_subterms_eq(2)[of \"trms_transaction T\"] by blast+\n ultimately have *: \"\\is_PubConst f\"\n when \"f \\ funs_term t\" for f\n using that by presburger+\n\n show ?thesis using * by force\nqed\n\nlemma admissible_transactions_no_PubConsts':\n assumes \"admissible_transaction T\"\n and \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)\"\n shows \"\\a n T. Fun (PubConst a n) T \\ subterms t\"\nusing admissible_transactions_no_PubConsts[OF assms(1)] assms(2) by fast+\n\nlemma transaction_inserts_are_Value_vars:\n assumes T_valid: \"wellformed_transaction T\"\n and \"admissible_transaction_updates T\"\n and \"insert\\t,s\\ \\ set (unlabel (transaction_strand T))\"\n shows \"\\n. t = Var (TAtom Value, n)\"\n and \"\\u. s = Fun (Set u) []\"\nproof -\n let ?x = \"insert\\t,s\\\"\n\n have \"?x \\ set (unlabel (transaction_updates T))\"\n using assms(3) wellformed_transaction_unlabel_cases[OF T_valid, of ?x] \n by (auto simp add: transaction_strand_def unlabel_def)\n hence *: \"is_Var (the_elem_term ?x)\" \"fst (the_Var (the_elem_term ?x)) = TAtom Value\"\n \"is_Fun (the_set_term ?x)\" \"args (the_set_term ?x) = []\"\n \"is_Set (the_Fun (the_set_term ?x))\"\n using assms(2) unfolding admissible_transaction_updates_def is_Fun_Set_def by fastforce+\n \n show \"\\n. t = Var (TAtom Value, n)\" using *(1,2) by (cases t) auto\n show \"\\u. s = Fun (Set u) []\" using *(3,4,5) unfolding is_Set_def by (cases s) auto\nqed\n\nlemma transaction_deletes_are_Value_vars:\n assumes T_valid: \"wellformed_transaction T\"\n and \"admissible_transaction_updates T\"\n and \"delete\\t,s\\ \\ set (unlabel (transaction_strand T))\"\n shows \"\\n. t = Var (TAtom Value, n)\"\n and \"\\u. s = Fun (Set u) []\"\nproof -\n let ?x = \"delete\\t,s\\\"\n\n have \"?x \\ set (unlabel (transaction_updates T))\"\n using assms(3) wellformed_transaction_unlabel_cases[OF T_valid, of ?x] \n by (auto simp add: transaction_strand_def unlabel_def)\n hence *: \"is_Var (the_elem_term ?x)\" \"fst (the_Var (the_elem_term ?x)) = TAtom Value\"\n \"is_Fun (the_set_term ?x)\" \"args (the_set_term ?x) = []\"\n \"is_Set (the_Fun (the_set_term ?x))\"\n using assms(2) unfolding admissible_transaction_updates_def is_Fun_Set_def by fastforce+\n \n show \"\\n. t = Var (TAtom Value, n)\" using *(1,2) by (cases t) auto\n show \"\\u. s = Fun (Set u) []\" using *(3,4,5) unfolding is_Set_def by (cases s) auto\nqed\n\nlemma transaction_selects_are_Value_vars:\n assumes T_valid: \"wellformed_transaction T\"\n and \"admissible_transaction_checks T\"\n and \"select\\t,s\\ \\ set (unlabel (transaction_strand T))\"\n shows \"\\n. t = Var (TAtom Value, n) \\ (TAtom Value, n) \\ set (transaction_fresh T)\" (is ?A)\n and \"\\u. s = Fun (Set u) []\" (is ?B)\nproof -\n let ?x = \"select\\t,s\\\"\n\n have *: \"?x \\ set (unlabel (transaction_checks T))\"\n using assms(3) wellformed_transaction_unlabel_cases[OF T_valid, of ?x] \n by (auto simp add: transaction_strand_def unlabel_def)\n \n have **: \"is_Var (the_elem_term ?x)\" \"fst (the_Var (the_elem_term ?x)) = TAtom Value\"\n \"is_Fun (the_set_term ?x)\" \"args (the_set_term ?x) = []\"\n \"is_Set (the_Fun (the_set_term ?x))\"\n using * assms(2) unfolding admissible_transaction_checks_def is_Fun_Set_def by fastforce+\n\n have \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using * by force\n hence ***: \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ set (transaction_fresh T) = {}\"\n using T_valid unfolding wellformed_transaction_def by fast\n\n show ?A using **(1,2) *** by (cases t) auto\n show ?B using **(3,4,5) unfolding is_Set_def by (cases s) auto\nqed\n\nlemma transaction_inset_checks_are_Value_vars:\n assumes T_valid: \"admissible_transaction T\"\n and t: \"\\t in s\\ \\ set (unlabel (transaction_strand T))\"\n shows \"\\n. t = Var (TAtom Value, n) \\ (TAtom Value, n) \\ set (transaction_fresh T)\" (is ?A)\n and \"\\u. s = Fun (Set u) []\" (is ?B)\nproof -\n let ?x = \"\\t in s\\\"\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_valid]\n note T_adm_checks = admissible_transaction_is_wellformed_transaction(2)[OF T_valid]\n\n have *: \"?x \\ set (unlabel (transaction_checks T))\"\n using t wellformed_transaction_unlabel_cases[OF T_wf, of ?x]\n unfolding transaction_strand_def unlabel_def by fastforce\n \n have **: \"is_Var (the_elem_term ?x)\" \"fst (the_Var (the_elem_term ?x)) = TAtom Value\"\n \"is_Fun (the_set_term ?x)\" \"args (the_set_term ?x) = []\"\n \"is_Set (the_Fun (the_set_term ?x))\"\n using * T_adm_checks unfolding admissible_transaction_checks_def is_Fun_Set_def by fastforce+\n\n have \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using * by force\n hence ***: \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ set (transaction_fresh T) = {}\"\n using T_wf unfolding wellformed_transaction_def by fast\n\n show ?A using **(1,2) *** by (cases t) auto\n show ?B using **(3,4,5) unfolding is_Set_def by (cases s) auto\nqed\n\nlemma transaction_notinset_checks_are_Value_vars:\n assumes T_adm: \"admissible_transaction T\"\n and FG: \"\\X\\\\\\: F \\\\: G\\ \\ set (unlabel (transaction_strand T))\"\n and t: \"(t,s) \\ set G\"\n shows \"\\n. t = Var (TAtom Value, n) \\ (TAtom Value, n) \\ set (transaction_fresh T)\" (is ?A)\n and \"\\u. s = Fun (Set u) []\" (is ?B)\nproof -\n let ?x = \"\\X\\\\\\: F \\\\: G\\\"\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n note T_adm_checks = admissible_transaction_is_wellformed_transaction(2)[OF T_adm]\n\n have 0: \"?x \\ set (unlabel (transaction_checks T))\"\n using FG wellformed_transaction_unlabel_cases[OF T_wf, of ?x] \n by (auto simp add: transaction_strand_def unlabel_def)\n hence 1: \"F = [] \\ length G = 1\"\n using T_adm_checks t unfolding admissible_transaction_checks_def by fastforce\n hence \"hd G = (t,s)\" using t by (cases \"the_ins ?x\") auto\n hence **: \"is_Var t\" \"fst (the_Var t) = TAtom Value\" \"is_Fun s\" \"args s = []\" \"is_Set (the_Fun s)\"\n using 1 Set.bspec[OF T_adm_checks[unfolded admissible_transaction_checks_def] 0]\n unfolding is_Fun_Set_def by auto\n\n have \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x) \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T)\"\n using 0 by force+\n moreover have\n \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T) = {}\"\n \"set (transaction_fresh T) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) = {}\"\n using T_wf unfolding wellformed_transaction_def by fast+\n ultimately have\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x \\ set (transaction_fresh T) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ?x) \\ set (transaction_fresh T) = {}\"\n using admissible_transactionE(7)[OF T_adm]\n wellformed_transaction_wf\\<^sub>s\\<^sub>s\\<^sub>t(2)[OF T_wf]\n fv_transaction_unfold[of T] bvars_transaction_unfold[of T]\n by (blast, blast)\n hence ***: \"fv t \\ set (transaction_fresh T) = {}\"\n using t by auto\n\n show ?A using **(1,2) *** by (cases t) auto\n show ?B using **(3,4,5) unfolding is_Set_def by (cases s) auto\nqed\n\nlemma admissible_transaction_strand_step_cases:\n assumes T_adm: \"admissible_transaction T\"\n shows \"r \\ set (unlabel (transaction_receive T)) \\ \\t. r = receive\\t\\\"\n (is \"?A \\ ?A'\")\n and \"r \\ set (unlabel (transaction_checks T)) \\\n (\\x s. (r = \\Var x in Fun (Set s) []\\ \\ r = select\\Var x, Fun (Set s) []\\ \\\n r = \\Var x not in Fun (Set s) []\\) \\\n fst x = TAtom Value \\ x \\ fv_transaction T - set (transaction_fresh T)) \\\n (\\s t. r = \\s == t\\ \\ r = \\s := t\\ \\ r = \\s != t\\)\"\n (is \"?B \\ ?B'\")\n and \"r \\ set (unlabel (transaction_updates T)) \\\n \\x s. (r = insert\\Var x, Fun (Set s) []\\ \\ r = delete\\Var x, Fun (Set s) []\\) \\\n fst x = TAtom Value\"\n (is \"?C \\ ?C'\")\n and \"r \\ set (unlabel (transaction_send T)) \\ \\t. r = send\\t\\\"\n (is \"?D \\ ?D'\")\nproof -\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n\n show \"?A \\ ?A'\"\n using T_wf Ball_set[of \"unlabel (transaction_receive T)\" is_Receive]\n unfolding wellformed_transaction_def is_Receive_def\n by blast\n\n show \"?D \\ ?D'\"\n using T_wf Ball_set[of \"unlabel (transaction_send T)\" is_Send]\n unfolding wellformed_transaction_def is_Send_def\n by blast\n\n show \"?B \\ ?B'\"\n proof -\n assume r: ?B\n note adm_checks = admissible_transaction_is_wellformed_transaction(1,2)[OF T_adm]\n\n have fv_r1: \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r \\ fv_transaction T\"\n using r fv_transaction_unfold[of T] by auto\n \n have fv_r2: \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r \\ set (transaction_fresh T) = {}\"\n using r T_wf unfolding wellformed_transaction_def by fastforce\n\n have \"list_all is_Check_or_Assignment (unlabel (transaction_checks T))\"\n using adm_checks(1) unfolding wellformed_transaction_def by blast\n hence \"is_InSet r \\ is_Equality r \\ is_NegChecks r\"\n using r unfolding list_all_iff by blast\n thus ?B'\n proof (elim disjE conjE)\n assume *: \"is_InSet r\"\n hence **: \"is_Var (the_elem_term r)\" \"is_Fun (the_set_term r)\"\n \"is_Set (the_Fun (the_set_term r))\" \"args (the_set_term r) = []\"\n \"fst (the_Var (the_elem_term r)) = TAtom Value\"\n using r adm_checks unfolding admissible_transaction_checks_def is_Fun_Set_def\n by fast+\n \n obtain ac rt rs where r': \"r = \\ac: rt \\ rs\\\" using * by (cases r) auto\n obtain x where x: \"rt = Var x\" \"fst x = TAtom Value\" using **(1,5) r' by auto\n obtain f S where fS: \"rs = Fun f S\" using **(2) r' by auto\n obtain s where s: \"f = Set s\" using **(3) fS r' by (cases f) auto\n hence S: \"S = []\" using **(4) fS r' by auto\n \n show ?B' using r' x fS s S fv_r1 fv_r2 by (cases ac) simp_all\n next\n assume *: \"is_NegChecks r\"\n hence **: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r = []\"\n \"(the_eqs r = [] \\ length (the_ins r) = 1) \\\n (the_ins r = [] \\ length (the_eqs r) = 1)\"\n using r adm_checks unfolding admissible_transaction_checks_def by fast+\n show ?B' using **(2)\n proof (elim disjE conjE)\n assume ***: \"the_eqs r = []\" \"length (the_ins r) = 1\"\n then obtain t s where ts: \"the_ins r = [(t,s)]\" by (cases \"the_ins r\") auto\n hence \"hd (the_ins r) = (t,s)\" by simp\n hence ****: \"is_Var (fst (t,s))\" \"is_Fun (snd (t,s))\"\n \"is_Set (the_Fun (snd (t,s)))\" \"args (snd (t,s)) = []\"\n \"fst (the_Var (fst (t,s))) = TAtom Value\"\n using * ***(1) Set.bspec[OF adm_checks(2)[unfolded admissible_transaction_checks_def] r]\n unfolding is_Fun_Set_def by simp_all\n obtain x where x: \"t = Var x\" \"fst x = TAtom Value\" using ts ****(1,5) by (cases t) simp_all\n obtain f S where fS: \"s = Fun f S\" using ts ****(2) by (cases s) simp_all\n obtain ss where ss: \"f = Set ss\" using fS ****(3) by (cases f) simp_all\n have S: \"S = []\" using ts fS ss ****(4) by simp\n \n show ?B' using ts x fS ss S *** **(1) * fv_r1 fv_r2 by (cases r) auto\n next\n assume ***: \"the_ins r = []\" \"length (the_eqs r) = 1\"\n then obtain t s where \"the_eqs r = [(t,s)]\" by (cases \"the_eqs r\") auto\n thus ?B' using *** **(1) * by (cases r) auto\n qed\n qed (auto simp add: is_Equality_def the_check_def intro: poscheckvariant.exhaust)\n qed\n\n show \"?C \\ ?C'\"\n proof -\n assume r: ?C\n note adm_upds = admissible_transaction_is_wellformed_transaction(3)[OF T_adm]\n\n have *: \"is_Update r\" \"is_Var (the_elem_term r)\" \"is_Fun (the_set_term r)\"\n \"is_Set (the_Fun (the_set_term r))\" \"args (the_set_term r) = []\"\n \"fst (the_Var (the_elem_term r)) = TAtom Value\"\n using r adm_upds unfolding admissible_transaction_updates_def is_Fun_Set_def by fast+\n\n obtain t s where ts: \"r = insert\\t,s\\ \\ r = delete\\t,s\\\" using *(1) by (cases r) auto\n obtain x where x: \"t = Var x\" \"fst x = TAtom Value\" using ts *(2,6) by (cases t) auto\n obtain f T where fT: \"s = Fun f T\" using ts *(3) by (cases s) auto\n obtain ss where ss: \"f = Set ss\" using ts fT *(4) by (cases f) fastforce+\n have T: \"T = []\" using ts fT *(5) ss by (cases T) auto\n\n show ?C'\n using ts x fT ss T by blast\n qed\nqed\n\nlemma protocol_transaction_vars_TAtom_typed:\n assumes T_adm: \"admissible_transaction T\"\n shows \"\\x \\ vars_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n and \"\\x \\ fv_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n and \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\nproof -\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n\n show \"\\x \\ vars_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n using admissible_transactionE(3)[OF T_adm] by fast\n thus \"\\x \\ fv_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n using vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t by fast\n\n show \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n using admissible_transactionE(2)[OF T_adm] by argo\nqed\n\nlemma protocol_transactions_no_pubconsts:\n assumes \"admissible_transaction T\"\n shows \"Fun (Val n) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms_transaction T)\"\n and \"Fun (PubConst Value n) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms_transaction T)\"\nusing assms admissible_transactions_no_Value_consts(1,3) by (blast, blast)\n\nlemma protocol_transactions_no_abss:\n assumes \"admissible_transaction T\"\n shows \"Fun (Abs n) S \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms_transaction T)\"\nusing assms admissible_transactions_no_Value_consts(2)\nby fast\n\nlemma admissible_transaction_strand_sem_fv_ineq:\n assumes T_adm: \"admissible_transaction T\"\n and \\: \"strand_sem_stateful IK DB (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\"\n and x: \"x \\ fv_transaction T - set (transaction_fresh T)\"\n and y: \"y \\ fv_transaction T - set (transaction_fresh T)\"\n and x_not_y: \"x \\ y\"\n shows \"\\ x \\ \\ \\ \\ y \\ \\\"\nproof -\n have \"\\Var x != Var y\\ \\ set (unlabel (transaction_checks T)) \\\n \\Var y != Var x\\ \\ set (unlabel (transaction_checks T))\"\n using x y x_not_y admissible_transactionE(8)[OF T_adm] by auto\n hence \"\\Var x != Var y\\ \\ set (unlabel (transaction_strand T)) \\\n \\Var y != Var x\\ \\ set (unlabel (transaction_strand T))\"\n unfolding transaction_strand_def unlabel_def by auto\n hence \"\\\\ x != \\ y\\ \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\n \\\\ y != \\ x\\ \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n using stateful_strand_step_subst_inI(8)[of _ _ \"unlabel (transaction_strand T)\" \\]\n subst_lsst_unlabel[of \"transaction_strand T\" \\]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(7)[of \"[]\" _ \"[]\"]\n by force\n then obtain B where B:\n \"prefix (B@[\\\\ x != \\ y\\]) (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) \\\n prefix (B@[\\\\ y != \\ x\\]) (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n unfolding prefix_def\n by (metis (no_types, opaque_lifting) append.assoc append_Cons append_Nil split_list)\n thus ?thesis\n using \\ strand_sem_append_stateful[of IK DB _ _ \\]\n stateful_strand_sem_NegChecks_no_bvars(2)\n unfolding prefix_def\n by metis \nqed\n\nlemma admissible_transaction_terms_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s:\n assumes \"admissible_transaction_terms T\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T)\"\nby (rule conjunct1[OF assms[unfolded admissible_transaction_terms_def wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_code[symmetric]]])\n\nlemma admissible_transactions_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s:\n assumes \"admissible_transaction T\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T)\" \nproof -\n have \"admissible_transaction_terms T\" using assms[unfolded admissible_transaction_def] by fast\n thus ?thesis by (metis admissible_transaction_terms_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s)\nqed\n\nlemma admissible_transaction_no_Ana_Attack:\n assumes \"admissible_transaction_terms T\"\n and \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms_transaction T)\"\n shows \"attack\\n\\ \\ set (snd (Ana t))\"\nproof -\n obtain r where r: \"r \\ set (unlabel (transaction_strand T))\" \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r)\"\n using assms(2) by force\n\n obtain K M where t: \"Ana t = (K, M)\"\n by (metis surj_pair)\n\n show ?thesis\n proof\n assume n: \"attack\\n\\ \\ set (snd (Ana t))\"\n hence \"attack\\n\\ \\ set M\" using t by simp\n hence n': \"attack\\n\\ \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r)\"\n using Ana_subterm[OF t] r(2) subterms_subset by fast\n hence \"\\f \\ \\(funs_term ` trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p r). is_Attack f\"\n using funs_term_Fun_subterm' unfolding is_Attack_def by fast\n hence \"is_Send r\" \"length (the_msgs r) = 1\" \"is_Fun (hd (the_msgs r))\"\n \"is_Attack (the_Fun (hd (the_msgs r)))\" \"args (hd (the_msgs r)) = []\"\n using assms(1) r(1) unfolding admissible_transaction_terms_def is_Fun_Attack_def by metis+\n hence \"t = attack\\n\\\"\n using n' r(2) unfolding is_Send_def is_Attack_def by (cases \"the_msgs r\") auto\n thus False using n by fastforce\n qed\nqed\n\nlemma admissible_transaction_Value_vars:\n assumes T: \"admissible_transaction T\"\n and x: \"x \\ fv_transaction T\"\n shows \"\\\\<^sub>v x = TAtom Value\"\nproof -\n have \"x \\ vars_transaction T\"\n using x vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel (transaction_strand T)\"]\n by blast\n thus \"\\\\<^sub>v x = TAtom Value\"\n using admissible_transactionE(3)[OF T] by simp\nqed\n\nlemma admissible_transaction_occurs_checksE1:\n assumes T: \"admissible_transaction_occurs_checks T\"\n and x: \"x \\ fv_transaction T - set (transaction_fresh T)\" \"\\\\<^sub>v x = TAtom Value\"\n obtains l ts S where\n \"transaction_receive T = (l,receive\\ts\\)#S\" \"occurs (Var x) \\ set ts\"\nproof -\n let ?rcvs = \"transaction_receive T\"\n let ?frsh = \"transaction_fresh T\"\n let ?fvs = \"fv_transaction T\"\n\n have *: \"?rcvs \\ []\" \"is_Receive (hd (unlabel ?rcvs))\"\n \"\\x \\ ?fvs - set ?frsh. \\\\<^sub>v x = TAtom Value \\\n occurs (Var x) \\ set (the_msgs (hd (unlabel ?rcvs)))\"\n using T x unfolding admissible_transaction_occurs_checks_def \\\\<^sub>v_TAtom''(2) by meson+\n\n obtain r S where S: \"?rcvs = r#S\"\n using *(1) by (cases ?rcvs) auto\n\n obtain l ts where r: \"r = (l,receive\\ts\\)\"\n by (metis *(1,2) S list.map_sel(1) list.sel(1) prod.collapse is_Receive_def unlabel_def) \n\n have 0: \"occurs (Var x) \\ set ts\" using *(3) x S r by fastforce\n\n show ?thesis using that[unfolded S r, of l ts S] 0 by blast\nqed\n\nlemma admissible_transaction_occurs_checksE2:\n assumes T: \"admissible_transaction_occurs_checks T\"\n and x: \"x \\ set (transaction_fresh T)\"\n obtains l ts S where\n \"transaction_send T = (l,send\\ts\\)#S\" \"occurs (Var x) \\ set ts\"\nproof -\n let ?snds = \"transaction_send T\"\n let ?frsh = \"transaction_fresh T\"\n let ?fvs = \"fv_transaction T\"\n define ts where \"ts \\ the_msgs (hd (unlabel ?snds))\"\n\n let ?P = \"\\x \\ set ?frsh. occurs (Var x) \\ set ts\"\n\n have \"?frsh \\ []\" using x by auto\n hence *: \"?snds \\ []\" \"is_Send (hd (unlabel ?snds))\" \"?P\"\n using T x unfolding admissible_transaction_occurs_checks_def ts_def by meson+\n\n obtain r S where S: \"?snds = r#S\"\n using *(1) by (cases ?snds) auto\n\n obtain l where r: \"r = (l,send\\ts\\)\"\n by (metis *(1,2) S list.map_sel(1) list.sel(1) prod.collapse unlabel_def ts_def\n stateful_strand_step.collapse(1)) \n\n have ts: \"occurs (Var x) \\ set ts\"\n using x *(3) unfolding S by auto\n\n show ?thesis using that[unfolded S r, of l ts S] ts by blast\nqed\n\nlemma admissible_transaction_occurs_checksE3:\n assumes T: \"admissible_transaction_occurs_checks T\"\n and t: \"OccursFact \\ funs_term t \\ OccursSec \\ funs_term t\" \"t \\ set ts\"\n and ts: \"send\\ts\\ \\ set (unlabel (transaction_send T))\"\n obtains x where \"t = occurs (Var x)\" \"x \\ set (transaction_fresh T)\"\nproof -\n let ?P = \"\\t. \\x \\ set (transaction_fresh T). t = occurs (Var x)\"\n\n have \"?P t\"\n when \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"OccursFact \\ funs_term t \\ OccursSec \\ funs_term t\"\n for t\n using assms that unfolding admissible_transaction_occurs_checks_def by metis\n moreover have \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n using t(2) ts unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by fastforce\n ultimately have \"?P t\" using t(1) by blast\n thus thesis using that by blast\nqed\n\nlemma admissible_transaction_occurs_checksE4:\n assumes T: \"admissible_transaction_occurs_checks T\"\n and ts: \"send\\ts\\ \\ set (unlabel (transaction_send T))\"\n and t: \"occurs t \\ set ts\"\n obtains x where \"t = Var x\" \"x \\ set (transaction_fresh T)\"\nusing admissible_transaction_occurs_checksE3[OF T _ t ts] by auto\n\nlemma admissible_transaction_occurs_checksE5:\n assumes T: \"admissible_transaction_occurs_checks T\"\n shows \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\nproof -\n have \"\\x \\ set (transaction_fresh T). t = occurs (Var x)\"\n when \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"OccursFact \\ funs_term t \\ OccursSec \\ funs_term t\"\n for t\n using assms that unfolding admissible_transaction_occurs_checks_def by metis\n thus ?thesis by fastforce\nqed\n\nlemma admissible_transaction_occurs_checksE6:\n assumes T: \"admissible_transaction_occurs_checks T\"\n and t: \"t \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n shows \"Fun OccursSec [] \\ set (snd (Ana t))\" (is ?A)\n and \"occurs k \\ set (snd (Ana t))\" (is ?B)\nproof -\n obtain t' where t': \"t' \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"t \\ t'\" using t by blast\n have \"?A \\ ?B\"\n proof (rule ccontr)\n assume *: \"\\(?A \\ ?B)\"\n hence \"OccursSec \\ funs_term t' \\ OccursFact \\ funs_term t'\"\n by (meson t'(2) Ana_subterm' funs_term_Fun_subterm' term.order.trans) \n then obtain x where x: \"x \\ set (transaction_fresh T)\" \"t' = occurs (Var x)\"\n using t'(1) T unfolding admissible_transaction_occurs_checks_def by metis\n have \"t = occurs (Var x) \\ t = Var x \\ t = Fun OccursSec []\" using x(2) t'(2) by auto\n thus False using * by fastforce\n qed\n thus ?A ?B by simp_all\nqed\n\n\nsubsection \\Lemmata: Renaming, Declaration, and Fresh Substitutions\\\nlemma transaction_decl_subst_empty_inv:\n assumes \"transaction_decl_subst Var T\"\n shows \"transaction_decl T () = []\"\nusing assms unfolding transaction_decl_subst_def subst_domain_Var by blast\n\nlemma transaction_decl_subst_domain:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\"\n shows \"subst_domain \\ = fst ` set (transaction_decl T ())\"\nusing assms unfolding transaction_decl_subst_def by argo\n\nlemma transaction_decl_subst_grounds_domain:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\"\n and \"x \\ fst ` set (transaction_decl T ())\"\n shows \"fv (\\ x) = {}\"\nproof -\n obtain c where \"\\ x = Fun c []\"\n using assms unfolding transaction_decl_subst_def by moura\n thus ?thesis by simp\nqed\n\nlemma transaction_decl_subst_range_vars_empty:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\"\n shows \"range_vars \\ = {}\"\nusing assms unfolding transaction_decl_subst_def range_vars_def by auto\n\nlemma transaction_decl_subst_wt:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\nusing assms unfolding transaction_decl_subst_def by blast\n\nlemma transaction_decl_subst_is_wf_trm:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ P\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ v)\"\nproof (cases \"v \\ subst_domain \\\")\n case True thus ?thesis using assms unfolding transaction_decl_subst_def by fastforce\nqed auto\n\nlemma transaction_decl_subst_range_wf_trms:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ P\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nby (metis transaction_decl_subst_is_wf_trm[OF assms] wf_trm_subst_range_iff)\n\nlemma transaction_renaming_subst_is_renaming:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_renaming_subst \\ P A\"\n shows \"\\m. \\\\ n. \\ (\\,n) = Var (\\,n+Suc m)\" (is ?A)\n and \"\\y. \\ x = Var y\" (is ?B)\n and \"\\ x \\ Var x\" (is ?C)\n and \"subst_domain \\ = UNIV\" (is ?D)\n and \"subst_range \\ \\ range Var\" (is ?E)\n and \"fv (t \\ \\) \\ range_vars \\\" (is ?F)\nproof -\n show 0: ?A using \\ unfolding transaction_renaming_subst_def var_rename_def by force\n show ?B using \\ unfolding transaction_renaming_subst_def var_rename_def by blast\n show ?C using 0 by (cases x) auto\n show 1: ?D using 0 by fastforce\n show ?E using 0 by auto\n show ?F by (induct t) (auto simp add: 1 subst_dom_vars_in_subst subst_fv_imgI)\nqed\n\nlemma transaction_renaming_subst_is_injective:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"inj \\\"\nproof (intro injI)\n fix x y::\"('fun,'atom,'sets,'lbl) prot_var\"\n obtain \\x nx where x: \"x = (\\x,nx)\" by (metis surj_pair)\n obtain \\y ny where y: \"y = (\\y,ny)\" by (metis surj_pair)\n\n obtain m where m: \"\\\\. \\n. \\ (\\, n) = Var (\\, n + Suc m)\"\n using transaction_renaming_subst_is_renaming(1)[OF assms] by blast\n\n assume \"\\ x = \\ y\"\n hence \"\\x = \\y\" \"nx = ny\" using x y m by simp_all\n thus \"x = y\" using x y by argo\nqed\n\nlemma transaction_renaming_subst_vars_disj:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` (\\(vars_transaction ` set P))) \\ (\\(vars_transaction ` set P)) = {}\" (is ?A)\n and \"fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" (is ?B)\n and \"T \\ set P \\ vars_transaction T \\ range_vars \\ = {}\" (is \"T \\ set P \\ ?C1\")\n and \"T \\ set P \\ bvars_transaction T \\ range_vars \\ = {}\" (is \"T \\ set P \\ ?C2\")\n and \"T \\ set P \\ fv_transaction T \\ range_vars \\ = {}\" (is \"T \\ set P \\ ?C3\")\n and \"vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ range_vars \\ = {}\" (is ?D1)\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ range_vars \\ = {}\" (is ?D2)\n and \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ range_vars \\ = {}\" (is ?D3)\nproof -\n define X where \"X \\ \\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n\n have 1: \"finite X\" by (simp add: X_def)\n\n obtain n where n: \"n \\ max_var_set X\" \"\\ = var_rename n\"\n using assms unfolding transaction_renaming_subst_def X_def by moura\n hence 2: \"\\x \\ X. snd x < Suc n\"\n using less_Suc_max_var_set[OF _ 1] unfolding var_rename_def by fastforce\n \n have 3: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` X)\" \"fv (\\ x) \\ X = {}\" \"x \\ range_vars \\\" when x: \"x \\ X\" for x\n using 2 x n unfolding var_rename_def by force+\n\n show ?A ?B using 3(1,2) unfolding X_def by auto\n\n show ?C1 when T: \"T \\ set P\" using T 3(3) unfolding X_def by blast\n thus ?C2 ?C3 when T: \"T \\ set P\"\n using T by (simp_all add: disjoint_iff_not_equal vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t)\n\n show ?D1 using 3(3) unfolding X_def by auto\n thus ?D2 ?D3 by (simp_all add: disjoint_iff_not_equal vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t)\nqed\n\nlemma transaction_renaming_subst_wt:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\nproof -\n { fix x::\"('fun,'atom,'sets,'lbl) prot_var\"\n obtain \\ n where x: \"x = (\\,n)\" by moura\n then obtain m where m: \"\\ x = Var (\\,m)\"\n using assms transaction_renaming_subst_is_renaming(1) by moura\n hence \"\\ (\\ x) = \\\\<^sub>v x\" using x by (simp add: \\\\<^sub>v_def)\n } thus ?thesis by (simp add: wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\nqed\n\nlemma transaction_renaming_subst_is_wf_trm:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ v)\"\nproof -\n obtain \\ n where \"v = (\\, n)\" by moura\n then obtain m where \"\\ v = Var (\\, n + Suc m)\"\n using transaction_renaming_subst_is_renaming(1)[OF assms]\n by moura\n thus ?thesis by (metis wf_trm_Var)\nqed\n\nlemma transaction_renaming_subst_range_wf_trms:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nby (metis transaction_renaming_subst_is_wf_trm[OF assms] wf_trm_subst_range_iff)\n\nlemma transaction_renaming_subst_range_notin_vars:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_renaming_subst \\ P \\\"\n shows \"\\y. \\ x = Var y \\ y \\ \\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\nproof -\n obtain \\ n where x: \"x = (\\,n)\" by (metis surj_pair)\n\n define y where \"y \\ \\m. (\\,n+Suc m)\"\n\n have \"\\m \\ max_var_set (\\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\ x = Var (y m)\"\n using assms x by (auto simp add: y_def transaction_renaming_subst_def var_rename_def)\n moreover have \"finite (\\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" by auto\n ultimately show ?thesis using x unfolding y_def by force\nqed\n\nlemma transaction_renaming_subst_var_obtain:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_renaming_subst \\ P \\\"\n shows \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\y. \\ y = Var x\" (is \"?A1 \\ ?B1\")\n and \"x \\ fv (t \\ \\) \\ \\y \\ fv t. \\ y = Var x\" (is \"?A2 \\ ?B2\")\nproof -\n assume x: ?A1\n obtain y where y: \"y \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\" \"x \\ fv (\\ y)\" using fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var[OF x] by moura\n thus ?B1 using transaction_renaming_subst_is_renaming(2)[OF \\, of y] by fastforce\nnext\n assume x: ?A2\n obtain y where y: \"y \\ fv t\" \"x \\ fv (\\ y)\" using fv_subst_obtain_var[OF x] by moura\n thus ?B2 using transaction_renaming_subst_is_renaming(2)[OF \\, of y] by fastforce\nqed\n\nlemma transaction_renaming_subst_set_eq:\n assumes \"set P1 = set P2\"\n shows \"transaction_renaming_subst \\ P1 \\ = transaction_renaming_subst \\ P2 \\\" (is \"?A = ?B\")\nusing assms unfolding transaction_renaming_subst_def by presburger\n\nlemma transaction_fresh_subst_is_wf_trm:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T A\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ v)\"\nproof (cases \"v \\ subst_domain \\\")\n case True\n then obtain c where \"\\ v = Fun c []\" \"arity c = 0\"\n using assms unfolding transaction_fresh_subst_def\n by moura\n thus ?thesis by auto\nqed auto\n\nlemma transaction_fresh_subst_wt:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T A\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\nusing assms unfolding transaction_fresh_subst_def by blast\n\nlemma transaction_fresh_subst_domain:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n shows \"subst_domain \\ = set (transaction_fresh T)\"\nusing assms unfolding transaction_fresh_subst_def by fast\n\nlemma transaction_fresh_subst_range_wf_trms:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nby (metis transaction_fresh_subst_is_wf_trm[OF assms] wf_trm_subst_range_iff)\n\nlemma transaction_fresh_subst_range_fresh:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n shows \"\\t \\ subst_range \\. t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n and \"\\t \\ subst_range \\. t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T))\"\nusing assms unfolding transaction_fresh_subst_def by meson+\n\nlemma transaction_fresh_subst_sends_to_val:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_fresh_subst \\ T \\\"\n and y: \"y \\ set (transaction_fresh T)\" \"\\\\<^sub>v y = TAtom Value\"\n obtains n where \"\\ y = Fun (Val n) []\" \"Fun (Val n) [] \\ subst_range \\\"\nproof -\n have \"\\ y \\ subst_range \\\" using assms unfolding transaction_fresh_subst_def by simp\n\n obtain c where c: \"\\ y = Fun c []\" \"\\public c\" \"arity c = 0\"\n using \\ y(1) unfolding transaction_fresh_subst_def by fastforce\n\n have \"\\ (\\ y) = TAtom Value\"\n using \\ y(2) \\\\<^sub>v_TAtom''(2)[of y] wt_subst_trm''[of \\ \"Var y\"]\n unfolding transaction_fresh_subst_def by simp\n then obtain n where \"c = Val n\"\n using c by (cases c) (auto split: option.splits)\n thus ?thesis\n using c that unfolding transaction_fresh_subst_def\n by fastforce\nqed\n\nlemma transaction_fresh_subst_sends_to_val':\n fixes \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n and \"y \\ set (transaction_fresh T)\" \"\\\\<^sub>v y = TAtom Value\"\n obtains n where \"(\\ \\\\<^sub>s \\) y \\ \\ = Fun (Val n) []\" \"Fun (Val n) [] \\ subst_range \\\" \nproof -\n obtain n where \"\\ y = Fun (Val n) []\" \"Fun (Val n) [] \\ subst_range \\\"\n using transaction_fresh_subst_sends_to_val[OF assms] by moura\n thus ?thesis using that by (fastforce simp add: subst_compose_def)\nqed\n\nlemma transaction_fresh_subst_grounds_domain:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n and \"y \\ set (transaction_fresh T)\"\n shows \"fv (\\ y) = {}\"\nproof -\n obtain c where \"\\ y = Fun c []\"\n using assms unfolding transaction_fresh_subst_def by moura\n thus ?thesis by simp\nqed\n\nlemma transaction_fresh_subst_range_vars_empty:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_fresh_subst \\ T \\\"\n shows \"range_vars \\ = {}\"\nproof -\n have \"fv t = {}\" when \"t \\ subst_range \\\" for t\n using assms that unfolding transaction_fresh_subst_def by fastforce\n thus ?thesis unfolding range_vars_def by blast\nqed\n\nlemma transaction_decl_fresh_renaming_substs_range:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n shows \"x \\ fst ` set (transaction_decl T ()) \\\n \\c. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun c [] \\ arity c = 0\"\n and \"x \\ fst ` set (transaction_decl T ()) \\\n x \\ set (transaction_fresh T) \\\n \\c. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun c [] \\ \\public c \\ arity c = 0\"\n and \"x \\ fst ` set (transaction_decl T ()) \\\n x \\ set (transaction_fresh T) \\\n fst x = TAtom Value \\\n \\n. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun (Val n) []\"\n and \"x \\ fst ` set (transaction_decl T ()) \\\n x \\ set (transaction_fresh T) \\\n \\y. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Var y\"\nproof -\n assume \"x \\ fst ` set (transaction_decl T ())\"\n then obtain c where c: \"\\ x = Fun c []\" \"arity c = 0\"\n using \\ unfolding transaction_decl_subst_def by fastforce\n thus \"\\c. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun c [] \\ arity c = 0\"\n using subst_compose[of \"\\ \\\\<^sub>s \\\" \\ x] subst_compose[of \\ \\ x] by simp\nnext\n assume x: \"x \\ fst ` set (transaction_decl T ())\"\n \"x \\ set (transaction_fresh T)\"\n\n have *: \"(\\ \\\\<^sub>s \\) x = \\ x\"\n using x(1) \\ unfolding transaction_decl_subst_def\n by (metis (no_types, opaque_lifting) subst_comp_notin_dom_eq)\n then obtain c where c: \"(\\ \\\\<^sub>s \\) x = Fun c []\" \"\\public c\" \"arity c = 0\"\n using \\ x(2) unfolding transaction_fresh_subst_def by fastforce\n thus \"\\c. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun c [] \\ \\public c \\ arity c = 0\"\n using subst_compose[of \"\\ \\\\<^sub>s \\\" \\ x] subst_compose[of \\ \\ x] by simp\n\n assume \"fst x = TAtom Value\"\n hence \"\\ ((\\ \\\\<^sub>s \\) x) = TAtom Value\"\n using * \\ \\\\<^sub>v_TAtom''(2)[of x] wt_subst_trm''[of \\ \"Var x\"]\n unfolding transaction_fresh_subst_def by simp\n then obtain n where \"c = Val n\"\n using c by (cases c) (auto split: option.splits)\n thus \"\\n. (\\ \\\\<^sub>s\\ \\\\<^sub>s \\) x = Fun (Val n) []\"\n using c subst_compose[of \"\\ \\\\<^sub>s \\\" \\ x] subst_compose[of \\ \\ x] by simp\nnext\n assume \"x \\ fst ` set (transaction_decl T ())\"\n \"x \\ set (transaction_fresh T)\"\n hence \"(\\ \\\\<^sub>s \\) x = Var x\"\n using \\ \\\n unfolding transaction_decl_subst_def transaction_fresh_subst_def\n by (metis (no_types, opaque_lifting) subst_comp_notin_dom_eq subst_domI)\n thus \"\\y. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Var y\"\n using transaction_renaming_subst_is_renaming(1)[OF \\]\n subst_compose[of \"\\ \\\\<^sub>s \\\" \\ x] subst_compose[of \\ \\ x]\n by (cases x) force\nqed\n\nlemma transaction_decl_fresh_renaming_substs_range':\n fixes \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n and t: \"t \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n shows \"(\\c. t = Fun c [] \\ arity c = 0) \\ (\\x. t = Var x)\"\n and \"\\ = Var \\ (\\c. t = Fun c [] \\ \\public c \\ arity c = 0) \\ (\\x. t = Var x)\"\n and \"\\ = Var \\ \\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value \\\n (\\n. t = Fun (Val n) []) \\ (\\x. t = Var x)\"\n and \"\\ = Var \\ is_Fun t \\ t \\ subst_range \\\"\nproof -\n obtain x where x: \"x \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = t\"\n using t by auto\n\n note 0 = x transaction_decl_fresh_renaming_substs_range[OF \\ \\ \\, of x]\n\n show \"(\\c. t = Fun c [] \\ arity c = 0) \\ (\\x. t = Var x)\"\n using 0 unfolding \\\\<^sub>v_TAtom'' by auto\n\n assume 1: \"\\ = Var\"\n\n note 2 = transaction_decl_subst_empty_inv[OF \\[unfolded 1]]\n\n show 3: \"(\\c. t = Fun c [] \\ \\public c \\ arity c = 0) \\ (\\x. t = Var x)\"\n using 0 2 unfolding \\\\<^sub>v_TAtom'' by auto\n\n show \"(\\n. t = Fun (Val n) []) \\ (\\x. t = Var x)\"\n when \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n using 0 2 that unfolding \\\\<^sub>v_TAtom'' by auto\n\n show \"t \\ subst_range \\\" when t': \"is_Fun t\"\n proof -\n obtain x where x: \"(\\ \\\\<^sub>s \\) x = t\" using t 1 by auto\n \n show ?thesis\n proof (cases \"x \\ subst_domain \\\")\n case True thus ?thesis\n by (metis subst_dom_vars_in_subst subst_ground_ident_compose(1) subst_imgI x\n transaction_fresh_subst_grounds_domain[OF \\]\n transaction_fresh_subst_domain[OF \\]) \n next\n case False thus ?thesis\n by (metis (no_types, lifting) subst_compose_def subst_domI term.disc(1) that\n transaction_renaming_subst_is_renaming(5)[OF \\] var_renaming_is_Fun_iff x)\n qed\n qed\nqed\n\nlemma transaction_decl_fresh_renaming_substs_range'':\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n and y: \"y \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x)\"\n shows \"\\ x = Var x\"\n and \"\\ x = Var x\"\n and \"\\ x = Var y\"\n and \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Var y\"\nproof -\n have \"\\z. z \\ fv (\\ x)\" by (metis y subst_compose_fv')\n hence \"x \\ subst_domain \\\"\n using y transaction_decl_subst_domain[OF \\]\n transaction_decl_subst_grounds_domain[OF \\, of x]\n by blast\n thus 0: \"\\ x = Var x\" by blast\n hence \"y \\ fv ((\\ \\\\<^sub>s \\) x)\" using y by (simp add: subst_compose)\n hence \"\\z. z \\ fv (\\ x)\" by (metis subst_compose_fv')\n hence \"x \\ subst_domain \\\"\n using y transaction_fresh_subst_domain[OF \\]\n transaction_fresh_subst_grounds_domain[OF \\, of x]\n by blast\n thus 1: \"\\ x = Var x\" by blast\n \n show \"\\ x = Var y\" \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Var y\"\n using 0 1 y transaction_renaming_subst_is_renaming(2)[OF \\, of x]\n unfolding subst_compose_def by (fastforce,fastforce)\nqed\n\nlemma transaction_decl_fresh_renaming_substs_vars_subset:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n shows \"\\(fv_transaction ` set P) \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" (is ?A)\n and \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" (is ?B)\n and \"T' \\ set P \\ fv_transaction T' \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" (is \"T' \\ set P \\ ?C\")\n and \"T' \\ set P \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T' \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)) \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n (is \"T' \\ set P \\ ?D\")\nproof -\n have *: \"x \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" for x\n proof (cases \"x \\ subst_domain \\\")\n case True thus ?thesis\n using transaction_decl_subst_domain[OF \\] transaction_decl_subst_grounds_domain[OF \\]\n by (simp add: subst_domI subst_dom_vars_in_subst subst_ground_ident_compose(1))\n next\n case False\n hence \\_x_eq: \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = (\\ \\\\<^sub>s \\) x\" by (auto simp add: subst_compose)\n\n show ?thesis\n proof (cases \"x \\ subst_domain \\\")\n case True\n hence \"x \\ {x. \\y. \\ x = Var y \\ \\ y = Var x}\"\n using transaction_fresh_subst_domain[OF \\]\n transaction_fresh_subst_grounds_domain[OF \\, of x]\n by auto\n hence \"x \\ subst_domain (\\ \\\\<^sub>s \\)\" using subst_domain_subst_compose[of \\ \\] by blast\n thus ?thesis using \\_x_eq subst_dom_vars_in_subst by fastforce \n next\n case False\n hence \"(\\ \\\\<^sub>s \\) x = \\ x\" unfolding subst_compose_def by fastforce\n moreover have \"\\ x \\ Var x\"\n using transaction_renaming_subst_is_renaming(1)[OF \\] by (cases x) auto\n ultimately show ?thesis using \\_x_eq by fastforce\n qed\n qed\n \n show ?A ?B using * by blast+\n\n show ?C when T: \"T' \\ set P\" using T * by blast\n hence \"fv\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T') \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n when T: \"T' \\ set P\"\n using T fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_subset_range_vars_if_subset_domain by blast\n thus ?D when T: \"T' \\ set P\" by (metis T unlabel_subst)\nqed\n\nlemma transaction_decl_fresh_renaming_substs_vars_disj:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n shows \"fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` (\\(vars_transaction ` set P))) \\ (\\(vars_transaction ` set P)) = {}\"\n (is ?A)\n and \"x \\ \\(vars_transaction ` set P) \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x) \\ (\\(vars_transaction ` set P)) = {}\"\n (is \"?B' \\ ?B\")\n and \"T' \\ set P \\ vars_transaction T' \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is \"T' \\ set P \\ ?C1\")\n and \"T' \\ set P \\ bvars_transaction T' \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is \"T' \\ set P \\ ?C2\")\n and \"T' \\ set P \\ fv_transaction T' \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is \"T' \\ set P \\ ?C3\")\n and \"vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is ?D1)\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is ?D2)\n and \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\" (is ?D3)\nproof -\n note 0 = transaction_renaming_subst_vars_disj[OF \\]\n\n show ?A\n proof (cases \"fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` (\\(vars_transaction ` set P))) = {}\")\n case False\n hence \"\\x \\ (\\(vars_transaction ` set P)). (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = \\ x \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x) = {}\"\n using transaction_decl_fresh_renaming_substs_range''[OF \\ \\ \\] by auto\n thus ?thesis using 0(1) by force\n qed blast\n thus \"?B' \\ ?B\" by auto\n\n have \"range_vars \\ = {}\" \"range_vars \\ = {}\"\n using transaction_fresh_subst_grounds_domain[OF \\]\n transaction_decl_subst_grounds_domain[OF \\]\n unfolding transaction_fresh_subst_domain[OF \\, symmetric]\n transaction_decl_subst_domain[OF \\, symmetric]\n by (fastforce, fastforce)\n hence 1: \"range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ range_vars \\\"\n using range_vars_subst_compose_subset[of \\ \\]\n range_vars_subst_compose_subset[of \"\\ \\\\<^sub>s \\\" \\]\n by blast\n \n show ?C1 ?C2 ?C3 when T: \"T' \\ set P\" using T 1 0(3,4,5)[of T'] by blast+\n\n show ?D1 ?D2 ?D3 using 1 0(6,7,8) by blast+\nqed\n\nlemma transaction_decl_fresh_renaming_substs_trms:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\"\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\"\n and \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\"\n shows \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))) = subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S) \\\\<^sub>s\\<^sub>e\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\nproof -\n have 1: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S). (\\f. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Fun f []) \\ (\\y. (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = Var y)\"\n using transaction_decl_fresh_renaming_substs_range'[OF \\ \\ \\] by blast\n\n have 2: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\"\n using assms(4-6) subst_domain_compose[of \\ \\] subst_domain_compose[of \"\\ \\\\<^sub>s \\\" \\] by blast\n\n show ?thesis using subterms_subst_lsst[OF 1 2] by simp\nqed\n\nlemma transaction_decl_fresh_renaming_substs_wt:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T \\\"\n \"transaction_renaming_subst \\ P \\\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\nusing transaction_renaming_subst_wt[OF assms(3)]\n transaction_fresh_subst_wt[OF assms(2)]\n transaction_decl_subst_wt[OF assms(1)]\nby (metis wt_subst_compose)\n\nlemma transaction_decl_fresh_renaming_substs_range_wf_trms:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T \\\"\n \"transaction_renaming_subst \\ P \\\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\nusing transaction_renaming_subst_range_wf_trms[OF assms(3)]\n transaction_fresh_subst_range_wf_trms[OF assms(2)]\n transaction_decl_subst_range_wf_trms[OF assms(1)]\n wf_trms_subst_compose[of \\ \\]\n wf_trms_subst_compose[of \"\\ \\\\<^sub>s \\\" \\]\nby metis\n\nlemma transaction_decl_fresh_renaming_substs_fv:\n fixes \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T A\"\n and \\: \"transaction_renaming_subst \\ P A\"\n and x: \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n shows \"\\y \\ fv_transaction T - set (transaction_fresh T). (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y = Var x\"\nproof -\n have \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using x fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by argo\n then obtain y where \"y \\ fv_transaction T\" \"x \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y)\"\n by (metis fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var)\n thus ?thesis\n using transaction_decl_fresh_renaming_substs_range[OF \\ \\ \\, of y]\n by (cases \"y \\ set (transaction_fresh T)\") force+\nqed\n\nlemma transaction_decl_fresh_renaming_substs_range_no_attack_const:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T A\"\n and \\: \"transaction_renaming_subst \\ P A\"\n and T: \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n and t: \"t \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n shows \"\\n. t = attack\\n\\\"\nproof -\n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF \\ \\ \\]\n\n obtain x where x: \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x = t\" using t by auto\n\n have x_type: \"\\ (Var x) = \\ (Var x \\ \\)\" \"\\ (Var x) = \\ (Var x \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using \\ wt_subst_trm''[of \\ \"Var x\"] wt_subst_trm''[OF \\\\\\_wt, of \"Var x\"]\n unfolding transaction_decl_subst_def by (blast, blast)\n\n show ?thesis\n proof (cases t)\n case (Fun f S)\n hence \"x \\ set (transaction_fresh T) \\ x \\ fst ` set (transaction_decl T ())\"\n using transaction_decl_fresh_renaming_substs_range[OF \\ \\ \\, of x] x by force\n thus ?thesis\n proof\n assume \"x \\ set (transaction_fresh T)\"\n hence \"\\ t = TAtom Value \\ (\\a. \\ t = TAtom (Atom a))\"\n using T x_type(2) x by (metis \\.simps(1) subst_apply_term.simps(1))\n thus ?thesis by auto\n next\n assume \"x \\ fst ` set (transaction_decl T ())\"\n then obtain c where c: \"\\ x = Fun (Fu c) []\" \"arity\\<^sub>f c = 0\"\n using \\ unfolding transaction_decl_subst_def by auto\n\n have \"\\ t = TAtom Bottom \\ (\\a. \\ t = TAtom (Atom a))\"\n using c(1) \\_consts_simps(1)[OF c(2)] x x_type\n subst_apply_term.simps(1)[of x \\] subst_apply_term.simps(1)[of x \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by (cases \"\\\\<^sub>f c\") simp_all\n thus ?thesis by auto\n qed\n qed simp\nqed\n\nlemma transaction_decl_fresh_renaming_substs_occurs_fact_send_receive:\n fixes t::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n and T: \"admissible_transaction T\"\n and t: \"occurs t \\ set ts\"\n shows \"send\\ts\\ \\ set (unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\n \\ \\ts' s. send\\ts'\\ \\ set (unlabel (transaction_send T)) \\\n occurs s \\ set ts' \\ t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n (is \"?A \\ ?A'\")\n and \"receive\\ts\\ \\ set (unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\n \\ \\ts' s. receive\\ts'\\ \\ set (unlabel (transaction_receive T)) \\\n occurs s \\ set ts' \\ t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n (is \"?B \\ ?B'\")\nproof -\n assume ?A\n then obtain s ts' where s:\n \"s \\ set ts'\" \"send\\ts'\\ \\ set (unlabel (transaction_strand T))\" \"occurs t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using t stateful_strand_step_mem_substD(1)[\n of ts \"unlabel (transaction_strand T)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by auto\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T \\]\n\n have T_decl_notin: \"x \\ fst ` set (transaction_decl T ())\" for x\n using transaction_decl_subst_empty_inv[OF \\[unfolded \\_empty]] by simp\n\n note 0 = s(3) transaction_decl_fresh_renaming_substs_range[OF \\ \\ \\]\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T]\n note T_fresh = admissible_transactionE(14)[OF T]\n\n have \"\\u. s = occurs u\"\n proof (cases s)\n case (Var x) \n hence \"(\\c. s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Fun c []) \\ (\\y. s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Var y)\"\n using 0(2-5)[of x] \\_empty by (auto simp del: subst_subst_compose)\n thus ?thesis\n using 0(1) by simp\n next\n case (Fun f T)\n hence 1: \"f = OccursFact\" \"length T = 2\" \"T ! 0 \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Fun OccursSec []\"\n \"T ! 1 \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = t\"\n using 0(1) by auto\n have \"T ! 0 = Fun OccursSec []\"\n proof (cases \"T ! 0\")\n case (Var x) thus ?thesis\n using 0(2-5)[of x] 1(3) T_fresh T_decl_notin\n unfolding list_all_iff by (auto simp del: subst_subst_compose)\n qed (use 1(3) in simp)\n thus ?thesis using Fun 1 0(1) by (auto simp del: subst_subst_compose)\n qed\n then obtain u where u: \"s = occurs u\" by moura\n hence \"t = u \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" using s(3) by fastforce\n thus ?A' using s u wellformed_transaction_strand_unlabel_memberD(8)[OF T_wf] by metis\nnext\n assume ?B\n then obtain s ts' where s:\n \"s \\ set ts'\" \"receive\\ts'\\ \\ set (unlabel (transaction_strand T))\" \"occurs t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using t stateful_strand_step_mem_substD(2)[\n of ts \"unlabel (transaction_strand T)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by auto\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T \\]\n\n have T_decl_notin: \"x \\ fst ` set (transaction_decl T ())\" for x\n using transaction_decl_subst_empty_inv[OF \\[unfolded \\_empty]] by simp\n\n note 0 = s(3) transaction_decl_fresh_renaming_substs_range[OF \\ \\ \\]\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T]\n note T_fresh = admissible_transactionE(14)[OF T]\n\n have \"\\u. s = occurs u\"\n proof (cases s)\n case (Var x) \n hence \"(\\c. s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Fun c []) \\ (\\y. s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Var y)\"\n using 0(2-5)[of x] \\_empty by (auto simp del: subst_subst_compose)\n thus ?thesis\n using 0(1) by simp\n next\n case (Fun f T)\n hence 1: \"f = OccursFact\" \"length T = 2\" \"T ! 0 \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Fun OccursSec []\"\n \"T ! 1 \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = t\"\n using 0(1) by auto\n have \"T ! 0 = Fun OccursSec []\"\n proof (cases \"T ! 0\")\n case (Var x) thus ?thesis\n using 0(2-5)[of x] 1(3) T_fresh T_decl_notin\n unfolding list_all_iff by (auto simp del: subst_subst_compose)\n qed (use 1(3) in simp)\n thus ?thesis using Fun 1 0(1) by (auto simp del: subst_subst_compose)\n qed\n then obtain u where u: \"s = occurs u\" by moura\n hence \"t = u \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" using s(3) by fastforce\n thus ?B' using s u wellformed_transaction_strand_unlabel_memberD(1)[OF T_wf] by metis\nqed\n\nlemma transaction_decl_subst_proj:\n assumes \"transaction_decl_subst \\ T\"\n shows \"transaction_decl_subst \\ (transaction_proj n T)\"\nusing assms transaction_proj_decl_eq[of n T]\nunfolding transaction_decl_subst_def by presburger\n\nlemma transaction_fresh_subst_proj:\n assumes \"transaction_fresh_subst \\ T A\"\n shows \"transaction_fresh_subst \\ (transaction_proj n T) (proj n A)\"\nusing assms transaction_proj_fresh_eq[of n T]\n contra_subsetD[OF subterms\\<^sub>s\\<^sub>e\\<^sub>t_mono[OF transaction_proj_trms_subset[of n T]]]\n contra_subsetD[OF subterms\\<^sub>s\\<^sub>e\\<^sub>t_mono[OF trms\\<^sub>s\\<^sub>s\\<^sub>t_proj_subset(1)[of n A]]]\nunfolding transaction_fresh_subst_def by metis\n \nlemma transaction_renaming_subst_proj:\n assumes \"transaction_renaming_subst \\ P A\"\n shows \"transaction_renaming_subst \\ (map (transaction_proj n) P) (proj n A)\"\nproof -\n let ?X = \"\\P A. \\(vars_transaction ` set P) \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n define Y where \"Y \\ ?X (map (transaction_proj n) P) (proj n A)\"\n define Z where \"Z \\ ?X P A\"\n\n have \"Y \\ Z\"\n using sst_vars_proj_subset(3)[of n A] transaction_proj_vars_subset[of n]\n unfolding Y_def Z_def by fastforce\n hence \"insert 0 (snd ` Y) \\ insert 0 (snd ` Z)\" by blast\n moreover have \"finite (insert 0 (snd ` Z))\" \"finite (insert 0 (snd ` Y))\"\n unfolding Y_def Z_def by auto\n ultimately have 0: \"max_var_set Y \\ max_var_set Z\" using Max_mono by blast\n\n have \"\\n\\max_var_set Z. \\ = var_rename n\"\n using assms unfolding transaction_renaming_subst_def Z_def by blast\n hence \"\\n\\max_var_set Y. \\ = var_rename n\" using 0 le_trans by fast\n thus ?thesis unfolding transaction_renaming_subst_def Y_def by blast\nqed\n\nlemma transaction_decl_fresh_renaming_substs_wf_sst:\n fixes \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n assumes T: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fst ` set (transaction_decl T ()) \\ set (transaction_fresh T))\n (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)))\"\n and \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n shows \"wf'\\<^sub>s\\<^sub>s\\<^sub>t {} (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\nproof -\n have 0: \"range_vars \\ \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) = {}\"\n \"range_vars \\ \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) = {}\"\n \"ground (\\ ` (fst ` set (transaction_decl T ())))\"\n \"ground (\\ ` set (transaction_fresh T))\"\n \"ground (\\ ` {})\"\n using transaction_decl_subst_domain[OF \\]\n transaction_decl_subst_grounds_domain[OF \\]\n transaction_decl_subst_range_vars_empty[OF \\]\n transaction_fresh_subst_range_vars_empty[OF \\]\n transaction_fresh_subst_domain[OF \\]\n transaction_fresh_subst_grounds_domain[OF \\]\n by (simp, simp, simp, simp, simp)\n\n have 1: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` set (transaction_fresh T)) \\ set (transaction_fresh T)\" (is \"?A \\ ?B\")\n proof\n fix x assume x: \"x \\ ?A\"\n then obtain y where y: \"y \\ set (transaction_fresh T)\" \"x \\ fv (\\ y)\" by auto\n hence \"y \\ subst_domain \\\"\n using transaction_decl_subst_domain[OF \\]\n transaction_decl_subst_grounds_domain[OF \\]\n by fast\n thus \"x \\ ?B\" using x y by auto\n qed\n\n let ?X = \"fst ` set (transaction_decl T ()) \\ set (transaction_fresh T)\"\n\n have \"fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` ?X))) = {}\" using 0(3-5) 1 by auto\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t {} (((unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n by (metis wf\\<^sub>s\\<^sub>s\\<^sub>t_subst_apply[OF wf\\<^sub>s\\<^sub>s\\<^sub>t_subst_apply[OF wf\\<^sub>s\\<^sub>s\\<^sub>t_subst_apply[OF T]]])\n thus ?thesis\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst unlabel_subst\n labeled_stateful_strand_subst_comp[OF 0(1), of \"\\ \\\\<^sub>s \\\"]\n labeled_stateful_strand_subst_comp[OF 0(2), of \\]\n subst_compose_assoc[of \\ \\ \\]\n by metis\nqed\n\n\nsubsection \\Lemmata: Reachable Constraints\\\nlemma reachable_constraints_as_transaction_lists:\n fixes f\n defines \"f \\ \\(T,\\,\\,\\). dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n and \"g \\ concat \\ map f\"\n assumes A: \"A \\ reachable_constraints P\"\n obtains Ts where \"A = g Ts\"\n and \"\\B. prefix B Ts \\ g B \\ reachable_constraints P\"\n and \"\\B T \\ \\ \\. prefix (B@[(T,\\,\\,\\)]) Ts \\\n T \\ set P \\ transaction_decl_subst \\ T \\\n transaction_fresh_subst \\ T (g B) \\ transaction_renaming_subst \\ P (g B)\"\nproof -\n let ?P1 = \"\\A Ts. A = g Ts\"\n let ?P2 = \"\\Ts. \\B. prefix B Ts \\ g B \\ reachable_constraints P\"\n let ?P3 = \"\\A Ts. \\B T \\ \\ \\. prefix (B@[(T,\\,\\,\\)]) Ts \\\n T \\ set P \\ transaction_decl_subst \\ T \\\n transaction_fresh_subst \\ T (g B) \\ transaction_renaming_subst \\ P (g B)\"\n\n have \"\\Ts. ?P1 A Ts \\ ?P2 Ts \\ ?P3 A Ts\" using A\n proof (induction A rule: reachable_constraints.induct)\n case init\n have \"?P1 [] []\" \"?P2 []\" \"?P3 [] []\" unfolding g_def f_def by simp_all\n thus ?case by blast\n next\n case (step A T \\ \\ \\)\n let ?A' = \"A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n obtain Ts where Ts: \"?P1 A Ts\" \"?P2 Ts\" \"?P3 A Ts\" using step.IH by blast\n\n have 1: \"?P1 ?A' (Ts@[(T,\\,\\,\\)])\"\n using Ts(1) unfolding g_def f_def by simp\n \n have 2: \"?P2 (Ts@[(T,\\,\\,\\)])\"\n proof (intro allI impI)\n fix B assume \"prefix B (Ts@[(T,\\,\\,\\)])\"\n hence \"prefix B Ts \\ B = Ts@[(T,\\,\\,\\)]\" by fastforce\n thus \"g B \\ reachable_constraints P \"\n using Ts(1,2) reachable_constraints.step[OF step.hyps]\n unfolding g_def f_def by auto\n qed\n\n have 3: \"?P3 ?A' (Ts@[(T,\\,\\,\\)])\"\n using Ts(1,3) step.hyps(2-5) unfolding g_def f_def by auto \n\n show ?case using 1 2 3 by blast\n qed\n thus thesis using that by blast\nqed\n\nlemma reachable_constraints_transaction_action_obtain:\n assumes A: \"A \\ reachable_constraints P\"\n and a: \"a \\ set A\"\n obtains T b B \\ \\ \\\n where \"prefix (B@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) A\"\n and \"T \\ set P\" \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T B\"\n \"transaction_renaming_subst \\ P B\"\n and \"b \\ set (transaction_strand T)\" \"a = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"fst a = fst b\"\nproof -\n define f where \"f \\ \\(T,\\,\\::('fun,'atom,'sets,'lbl) prot_subst,\\).\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n define g where \"g \\ concat \\ map f\"\n\n obtain Ts where Ts:\n \"A = g Ts\" \"\\B. prefix B Ts \\ g B \\ reachable_constraints P\"\n \"\\B T \\ \\ \\. prefix (B@[(T,\\,\\,\\)]) Ts \\\n T \\ set P \\ transaction_decl_subst \\ T \\\n transaction_fresh_subst \\ T (g B) \\ transaction_renaming_subst \\ P (g B)\"\n using reachable_constraints_as_transaction_lists[OF A] unfolding g_def f_def by blast\n\n obtain T \\ \\ \\ where T: \"(T,\\,\\,\\) \\ set Ts\" \"a \\ set (f (T,\\,\\,\\))\"\n using Ts(1) a unfolding g_def by auto\n \n obtain B where B: \"prefix (B@[(T,\\,\\,\\)]) Ts\"\n using T(1) by (meson prefix_snoc_in_iff) \n\n obtain b where b:\n \"b \\ set (transaction_strand T)\" \"a = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"fst a = fst b\"\n using T(2) dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_memberD'[of a \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" thesis]\n unfolding f_def by simp\n\n have 0: \"prefix (g B@f (T, \\, \\, \\)) A\"\n using concat_map_mono_prefix[OF B, of f] unfolding g_def Ts(1) by simp\n\n have 1: \"T \\ set P\" \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T (g B)\"\n \"transaction_renaming_subst \\ P (g B)\"\n using B Ts(3) by (blast,blast,blast,blast)\n\n show thesis using 0[unfolded f_def] that[OF _ 1 b] by fast\nqed\n\nlemma reachable_constraints_unlabel_eq:\n defines \"transaction_unlabel_eq \\ \\T1 T2.\n transaction_decl T1 = transaction_decl T2 \\\n transaction_fresh T1 = transaction_fresh T2 \\\n unlabel (transaction_receive T1) = unlabel (transaction_receive T2) \\\n unlabel (transaction_checks T1) = unlabel (transaction_checks T2) \\\n unlabel (transaction_updates T1) = unlabel (transaction_updates T2) \\\n unlabel (transaction_send T1) = unlabel (transaction_send T2)\"\n assumes Peq: \"list_all2 transaction_unlabel_eq P1 P2\"\n shows \"unlabel ` reachable_constraints P1 = unlabel ` reachable_constraints P2\" (is \"?A = ?B\")\nproof (intro antisym subsetI)\n have \"transaction_unlabel_eq T2 T1 = transaction_unlabel_eq T1 T2\" for T1 T2\n unfolding transaction_unlabel_eq_def by argo\n hence Peq': \"list_all2 transaction_unlabel_eq P2 P1\"\n using Peq list_all2_sym by metis\n\n have 0: \"unlabel (transaction_strand T1) = unlabel (transaction_strand T2)\"\n when \"transaction_unlabel_eq T1 T2\" for T1 T2\n using that unfolding transaction_unlabel_eq_def transaction_strand_def by force\n\n have \"vars_transaction T1 = vars_transaction T2\" when \"transaction_unlabel_eq T1 T2\" for T1 T2\n using 0[OF that] by simp\n hence \"vars_transaction (P1 ! i) = vars_transaction (P2 ! i)\" when \"i < length P1\" for i\n using that Peq list_all2_conv_all_nth by blast\n moreover have \"length P1 = length P2\" using Peq unfolding list_all2_iff by argo\n ultimately have 1: \"\\(vars_transaction ` set P1) = \\(vars_transaction ` set P2)\"\n using in_set_conv_nth[of _ P1] in_set_conv_nth[of _ P2] by fastforce\n\n have 2:\n \"transaction_decl_subst \\ T1 \\ transaction_decl_subst \\ T2\" (is \"?A1 \\ ?A2\")\n \"transaction_fresh_subst \\ T1 \\ \\ transaction_fresh_subst \\ T2 \\\" (is \"?B1 \\ ?B2\")\n \"transaction_renaming_subst \\ P1 \\ \\ transaction_renaming_subst \\ P2 \\\" (is \"?C1 \\ ?C2\")\n \"transaction_renaming_subst \\ P2 \\ \\ transaction_renaming_subst \\ P1 \\\" (is \"?D1 \\ ?D2\")\n when \"transaction_unlabel_eq T1 T2\" \"unlabel \\ = unlabel \\\"\n for T1 T2::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and \\ \\::\"('fun,'atom,'sets,'lbl) prot_strand\"\n and \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n proof -\n have *: \"transaction_decl T1 = transaction_decl T2\"\n \"transaction_fresh T1 = transaction_fresh T2\"\n \"trms_transaction T1 = trms_transaction T2\"\n using that unfolding transaction_unlabel_eq_def transaction_strand_def by force+\n\n show \"?A1 \\ ?A2\" using *(1) unfolding transaction_decl_subst_def by argo\n show \"?B1 \\ ?B2\" using that(2) *(2,3) unfolding transaction_fresh_subst_def by force\n show \"?C1 \\ ?C2\" using that(2) 1 unfolding transaction_renaming_subst_def by metis\n show \"?D1 \\ ?D2\" using that(2) 1 unfolding transaction_renaming_subst_def by metis\n qed\n\n have 3: \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T1 \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) =\n unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T2 \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n when \"transaction_unlabel_eq T1 T2\" for T1 T2 \\\n using 0[OF that] unlabel_subst[of _ \\] dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_cong by metis\n\n have \"\\\\ \\ reachable_constraints P2. unlabel \\ = unlabel \\\"\n when \"\\ \\ reachable_constraints P1\" for \\ using that\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n obtain \\ where IH: \"\\ \\ reachable_constraints P2\" \"unlabel \\ = unlabel \\\"\n by (meson step.IH)\n \n obtain T' where T': \"T' \\ set P2\" \"transaction_unlabel_eq T T'\"\n using list_all2_in_set_ex[OF Peq step.hyps(2)] by auto\n\n show ?case\n using 3[OF T'(2), of \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] IH(2) reachable_constraints.step[OF IH(1) T'(1)]\n 2[OF T'(2) IH(2)] step.hyps(3-5)\n by (metis unlabel_append[of \\] unlabel_append[of \\])\n qed (simp add: unlabel_def)\n thus \"\\ \\ ?A \\ \\ \\ ?B\" for \\ by fast\n\n have \"\\\\ \\ reachable_constraints P1. unlabel \\ = unlabel \\\"\n when \"\\ \\ reachable_constraints P2\" for \\ using that\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n obtain \\ where IH: \"\\ \\ reachable_constraints P1\" \"unlabel \\ = unlabel \\\"\n by (meson step.IH)\n \n obtain T' where T': \"T' \\ set P1\" \"transaction_unlabel_eq T T'\"\n using list_all2_in_set_ex[OF Peq' step.hyps(2)] by auto\n\n show ?case\n using 3[OF T'(2), of \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] IH(2) reachable_constraints.step[OF IH(1) T'(1)]\n 2[OF T'(2) IH(2)] step.hyps(3-5)\n by (metis unlabel_append[of \\] unlabel_append[of \\])\n qed (simp add: unlabel_def)\n thus \"\\ \\ ?B \\ \\ \\ ?A\" for \\ by fast\nqed\n\nlemma reachable_constraints_set_eq:\n assumes \"set P1 = set P2\"\n shows \"reachable_constraints P1 = reachable_constraints P2\" (is \"?A = ?B\")\nproof (intro antisym subsetI)\n note 0 = assms transaction_renaming_subst_set_eq[OF assms]\n note 1 = reachable_constraints.intros\n\n show \"\\ \\ ?A \\ \\ \\ ?B\" for \\\n by (induct \\ rule: reachable_constraints.induct) (auto simp add: 0 intro: 1)\n\n show \"\\ \\ ?B \\ \\ \\ ?A\" for \\\n by (induct \\ rule: reachable_constraints.induct) (auto simp add: 0 intro: 1)\nqed\n\nlemma reachable_constraints_set_subst:\n assumes \"set P1 = set P2\"\n and \"Q (reachable_constraints P1)\"\n shows \"Q (reachable_constraints P2)\"\nby (rule subst[of _ _ Q, OF reachable_constraints_set_eq[OF assms(1)] assms(2)])\n\nlemma reachable_constraints_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s:\n assumes \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T)\"\n and \"\\ \\ reachable_constraints P\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing assms(2)\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T)\"\n using assms(1) step.hyps(2) by blast\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n by (metis wf_trms_subst)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_trms\\<^sub>s\\<^sub>s\\<^sub>t_subst unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] by metis\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq by blast\n thus ?case using step.IH unlabel_append[of \\] trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\"] by auto\nqed simp\n\nlemma reachable_constraints_var_types_in_transactions:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. \\x \\ set (transaction_fresh T).\n \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n shows \"\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\T \\ set P. \\\\<^sub>v ` fv_transaction T)\" (is \"?A \\\")\n and \"\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\T \\ set P. \\\\<^sub>v ` bvars_transaction T)\" (is \"?B \\\")\n and \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\T \\ set P. \\\\<^sub>v ` vars_transaction T)\" (is \"?C \\\")\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n note 2 = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n\n have 3: \"\\t \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\). fv t = {} \\ (\\x. t = Var x)\"\n using transaction_decl_fresh_renaming_substs_range'(1)[OF step.hyps(3-5)]\n by fastforce\n\n have \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n \"vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n unfolding T'_def\n by (metis fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq,\n metis bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq,\n metis vars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq)\n hence \"\\ ` Var ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ \\ ` Var ` fv_transaction T\"\n \"\\ ` Var ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = \\ ` Var ` bvars_transaction T\"\n \"\\ ` Var ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ \\ ` Var ` vars_transaction T\"\n using wt_subst_lsst_vars_type_subset[OF 2 3, of \"transaction_strand T\"]\n by argo+\n hence \"\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ \\\\<^sub>v ` fv_transaction T\"\n \"\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = \\\\<^sub>v ` bvars_transaction T\"\n \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ \\\\<^sub>v ` vars_transaction T\"\n by (metis \\\\<^sub>v_Var_image)+\n hence 4: \"\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ (\\T \\ set P. \\\\<^sub>v ` fv_transaction T)\"\n \"\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ (\\T \\ set P. \\\\<^sub>v ` bvars_transaction T)\"\n \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ (\\T \\ set P. \\\\<^sub>v ` vars_transaction T)\"\n using step.hyps(2) by fast+\n\n have 5: \"\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ @ T') = (\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ (\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n \"\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ @ T') = (\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ (\\\\<^sub>v ` bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ @ T') = (\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ (\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n using unlabel_append[of \\ T']\n fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"]\n bvars\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"]\n by auto\n\n { case 1 thus ?case\n using step.IH(1) 4(1) 5(1)\n unfolding T'_def by (simp del: subst_subst_compose fv\\<^sub>s\\<^sub>s\\<^sub>t_def)\n }\n\n { case 2 thus ?case\n using step.IH(2) 4(2) 5(2)\n unfolding T'_def by (simp del: subst_subst_compose bvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n }\n\n { case 3 thus ?case\n using step.IH(3) 4(3) 5(3)\n unfolding T'_def by (simp del: subst_subst_compose)\n }\nqed simp_all\n\nlemma reachable_constraints_no_bvars:\n assumes \\: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) = {}\"\n shows \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ = {}\"\nusing assms proof (induction)\n case init\n then show ?case \n unfolding unlabel_def by auto\nnext\n case (step \\ T \\ \\ \\)\n then have \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ = {}\"\n by metis\n moreover\n have \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) = {}\"\n using step by (metis bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq)\n ultimately \n show ?case\n using bvars\\<^sub>s\\<^sub>s\\<^sub>t_append unlabel_append by (metis sup_bot.left_neutral)\nqed\n\nlemma reachable_constraints_fv_bvars_disj:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\S \\ set P. admissible_transaction S\"\n shows \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ = {}\"\nproof -\n let ?X = \"\\T \\ set P. bvars_transaction T\"\n\n note 0 = admissible_transactions_fv_bvars_disj[OF P]\n\n have 1: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ ?X\" using \\_reach\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n have \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) = bvars_transaction T\"\n using bvars\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"unlabel (transaction_strand T)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by argo\n hence \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) \\ ?X\"\n using step.hyps(2)\n by blast\n thus ?case\n using step.IH bvars\\<^sub>s\\<^sub>s\\<^sub>t_append\n by auto\n qed (simp add: unlabel_def)\n\n have 2: \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ ?X = {}\" using \\_reach\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n have \"x \\ y\" when x: \"x \\ ?X\" and y: \"y \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" for x y\n proof -\n obtain y' where y': \"y' \\ fv_transaction T\" \"y \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y')\"\n using y unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by (metis fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var)\n\n have \"y \\ \\(vars_transaction ` set P)\"\n using transaction_decl_fresh_renaming_substs_range''[OF step.hyps(3-5) y'(2)]\n transaction_renaming_subst_range_notin_vars[OF step.hyps(5), of y']\n by auto\n thus ?thesis using x vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t by fast\n qed\n hence \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ ?X = {}\"\n by blast\n thus ?case\n using step.IH\n fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"]\n unlabel_append[of \\ \"transaction_strand T\"]\n by force\n qed (simp add: unlabel_def)\n\n show ?thesis using 0 1 2 by blast\nqed\n\nlemma reachable_constraints_vars_TAtom_typed:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n shows \"\\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\nproof -\n have \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n by (metis reachable_constraints_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s admissible_transactions_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s P \\_reach)\n\n have T_adm: \"admissible_transaction T\" when \"T \\ set P\" for T\n by (meson that Ball_set P)\n\n have \"\\T\\set P. \\x\\set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n using protocol_transaction_vars_TAtom_typed(3) P by blast\n hence *: \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\T\\set P. \\\\<^sub>v ` vars_transaction T)\"\n using reachable_constraints_var_types_in_transactions[of \\ P, OF \\_reach] by auto\n\n have \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ TAtom ` insert Value (range Atom)\"\n proof -\n have \"\\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n when \"T \\ set P\" \"x \\ vars_transaction T\" for T x\n using that protocol_transaction_vars_TAtom_typed(1)[of T] P\n admissible_transactionE(5)\n by blast\n hence \"(\\T\\set P. \\\\<^sub>v ` vars_transaction T) \\ TAtom ` insert Value (range Atom)\"\n using P by blast\n thus \"\\\\<^sub>v ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ TAtom ` insert Value (range Atom)\"\n using * by auto\n qed\n thus ?thesis using x by auto\nqed\n\nlemma reachable_constraints_vars_not_attack_typed:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. \\x \\ set (transaction_fresh T).\n \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n \"\\T \\ set P. \\x \\ vars_transaction T. \\TAtom AttackType \\ \\\\<^sub>v x\"\n and x: \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n shows \"\\TAtom AttackType \\ \\\\<^sub>v x\"\nusing reachable_constraints_var_types_in_transactions(3)[OF \\_reach P(1)] P(2) x by fastforce\n\nlemma reachable_constraints_Value_vars_are_fv:\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n and \"\\\\<^sub>v x = TAtom Value\"\n shows \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\nproof -\n have \"\\T\\set P. bvars_transaction T = {}\"\n using P admissible_transactionE(4) by metis\n hence \\_no_bvars: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ = {}\"\n using reachable_constraints_no_bvars[OF \\_reach] by metis\n thus ?thesis using x vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\"] by blast\nqed\n\nlemma reachable_constraints_subterms_subst:\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) = (subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof -\n have \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n by (metis reachable_constraints_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s admissible_transactions_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s P \\_reach)\n\n from \\ have \\': \"welltyped_constraint_model \\ \\\"\n using welltyped_constraint_model_prefix by auto\n\n have 1: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). (\\f. \\ x = Fun f []) \\ (\\y. \\ x = Var y)\"\n proof\n fix x\n assume xa: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n have \"\\f T. \\ x = Fun f T\"\n using \\ interpretation_grounds[of \\ \"Var x\"]\n unfolding welltyped_constraint_model_def constraint_model_def\n by (cases \"\\ x\") auto\n then obtain f T where fT_p: \"\\ x = Fun f T\"\n by auto\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n using \\\n unfolding welltyped_constraint_model_def constraint_model_def\n using wf_trm_subst_rangeD\n by metis\n moreover\n have \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n using xa var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t[of x \"unlabel \\\"] vars_iff_subtermeq[of x]\n by auto\n hence \"\\a. \\\\<^sub>v x = TAtom a\"\n using reachable_constraints_vars_TAtom_typed[OF \\_reach P] by blast\n hence \"\\a. \\ (Var x) = TAtom a\"\n by simp\n hence \"\\a. \\ (Fun f T) = TAtom a\"\n by (metis (no_types, opaque_lifting) \\' welltyped_constraint_model_def fT_p wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n ultimately show \"(\\f. \\ x = Fun f []) \\ (\\y. \\ x = Var y)\"\n using TAtom_term_cases fT_p by metis\n qed\n\n have \"\\T\\set P. bvars_transaction T = {}\"\n using assms admissible_transactionE(4) by metis\n then have \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ = {}\"\n using reachable_constraints_no_bvars assms by metis\n then have 2: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ subst_domain \\ = {}\"\n by auto\n\n show ?thesis\n using subterms_subst_lsst[OF _ 2] 1\n by simp\nqed\n\nlemma reachable_constraints_val_funs_private':\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. transaction_decl T () = []\"\n \"\\T \\ set P. \\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n and f: \"f \\ \\(funs_term ` trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\is_PubConstValue f\"\n and \"\\is_Abs f\"\nproof -\n have \"\\is_PubConstValue f \\ \\is_Abs f\" using \\_reach f\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n let ?T' = \"unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n let ?T'' = \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n note \\_empty =\n admissible_transaction_decl_subst_empty'[OF bspec[OF P(2) step.hyps(2)] step.hyps(3)]\n\n have T: \"admissible_transaction_terms T\"\n using P(1) step.hyps(2) by metis\n\n have T_fresh: \"\\x \\ set (transaction_fresh T). fst x = TAtom Value\" when \"T \\ set P\" for T\n using P that admissible_transactionE(14) unfolding list_all_iff \\\\<^sub>v_TAtom'' by fast\n\n show ?thesis using step\n proof (cases \"f \\ \\(funs_term ` trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\")\n case False\n then obtain t where t: \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t ?T'\" \"f \\ funs_term t\"\n using step.prems trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of ?T'']\n trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?T'')\"]\n unlabel_append[of \\ \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?T''\"] unlabel_subst[of \"transaction_strand T\"]\n by fastforce\n show ?thesis using trms\\<^sub>s\\<^sub>s\\<^sub>t_funs_term_cases[OF t]\n proof\n assume \"\\u \\ trms_transaction T. f \\ funs_term u\"\n thus ?thesis\n using conjunct1[OF conjunct2[OF T[unfolded admissible_transaction_terms_def]]]\n unfolding is_PubConstValue_def by blast\n next\n assume \"\\x \\ fv_transaction T. f \\ funs_term ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x)\"\n then obtain x where \"x \\ fv_transaction T\" \"f \\ funs_term ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x)\" by moura\n thus ?thesis\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF step.hyps(3-5) _ \\_empty T_fresh[OF step.hyps(2), unfolded \\\\<^sub>v_TAtom''(2)]]\n unfolding is_PubConstValue_def\n by (metis (no_types, lifting) funs_term_Fun_subterm prot_fun.disc(30,48) subst_imgI\n subtermeq_Var_const(2) term.distinct(1) term.inject(2) term.set_cases(1))\n qed\n qed simp\n qed simp\n thus \"\\is_PubConstValue f\" \"\\is_Abs f\" by simp_all\nqed\n\nlemma reachable_constraints_val_funs_private:\n fixes \\::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and f: \"f \\ \\(funs_term ` trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\is_PubConstValue f\"\n and \"\\is_Abs f\"\nusing P reachable_constraints_val_funs_private'[OF \\_reach _ _ _ f]\n admissible_transaction_is_wellformed_transaction(4)\n admissible_transactionE(1,14)\nunfolding list_all_iff \\\\<^sub>v_TAtom''\nby (blast,fast)\n\nlemma reachable_constraints_occurs_fact_ik_case:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and occ: \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"\\n. t = Fun (Val n) []\"\nusing \\_reach occ\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n have T_adm: \"admissible_transaction T\" using P step.hyps(2) by blast\n hence T: \"wellformed_transaction T\" \"admissible_transaction_occurs_checks T\"\n using admissible_transaction_is_wellformed_transaction(1,5) by (blast,blast)\n\n have T_fresh: \"\\x \\ set (transaction_fresh T). fst x = TAtom Value\"\n using admissible_transactionE(14)[OF T_adm] unfolding list_all_iff by fast\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T_adm step.hyps(3)]\n\n have \\_dom_empty: \"z \\ fst ` set (transaction_decl T ())\" for z\n using transaction_decl_subst_empty_inv[OF step.hyps(3)[unfolded \\_empty]] by simp\n\n show ?case\n proof (cases \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\")\n case False\n hence \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using step.prems unfolding \\_def by simp\n hence \"\\ts. occurs t \\ set ts \\\n receive\\ts\\ \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n unfolding ik\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n hence \"\\ts. occurs t \\ set ts \\\n send\\ts\\ \\ set (unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(1) by blast\n then obtain ts s where s:\n \"s \\ set ts\" \"send\\ts\\ \\ set (unlabel (transaction_strand T))\" \"s \\ \\ = occurs t\"\n using stateful_strand_step_mem_substD(1)[of _ \"unlabel (transaction_strand T)\" \\]\n unlabel_subst[of \"transaction_strand T\" \\]\n by force\n\n note 0 = transaction_decl_fresh_renaming_substs_range[OF step.hyps(3-5)]\n\n have 1: \"send\\ts\\ \\ set (unlabel (transaction_send T))\"\n using s(2) wellformed_transaction_strand_unlabel_memberD(8)[OF T(1)] by blast\n\n have 2: \"is_Send (send\\ts\\)\"\n unfolding is_Send_def by simp\n\n have 3: \"\\u. s = occurs u\"\n proof -\n { fix z\n have \"(\\n. \\ z = Fun (Val n) []) \\ (\\y. \\ z = Var y)\"\n using 0(3,4) T_fresh \\_dom_empty unfolding \\_def by blast\n hence \"\\u. \\ z = occurs u\" \"\\ z \\ Fun OccursSec []\" by auto\n } note * = this\n\n obtain u u' where T: \"s = Fun OccursFact [u,u']\"\n using *(1) s(3) by (cases s) auto\n thus ?thesis using *(2) s(3) by (cases u) auto\n qed\n\n obtain x where x: \"x \\ set (transaction_fresh T)\" \"s = occurs (Var x)\"\n using 3 s(1) admissible_transaction_occurs_checksE4[OF T(2) 1] by metis\n \n have \"t = \\ x\"\n using s(3) x(2) by auto\n thus ?thesis\n using 0(3)[OF \\_dom_empty x(1)] x(1) T_fresh unfolding \\_def by fast\n qed (simp add: step.IH)\nqed simp\n\nlemma reachable_constraints_occurs_fact_send_ex:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"\\\\<^sub>v x = TAtom Value\" \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"\\ts. occurs (Var x) \\ set ts \\ send\\ts\\ \\ set (unlabel A)\"\nusing \\_reach x(2)\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n note \\_empty = admissible_transaction_decl_subst_empty[OF bspec[OF P step.hyps(2)] step.hyps(3)]\n\n have T: \"admissible_transaction_occurs_checks T\"\n using P step.hyps(2) admissible_transaction_is_wellformed_transaction(5) by blast\n \n show ?case\n proof (cases \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\")\n case True\n show ?thesis\n using step.IH[OF True] unlabel_append[of A]\n by auto\n next\n case False\n then obtain y where y:\n \"y \\ fv_transaction T - set (transaction_fresh T)\" \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y = Var x\"\n using transaction_decl_fresh_renaming_substs_fv[OF step.hyps(3-5), of x]\n step.prems(1) fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\"] unlabel_append[of A]\n by auto\n \n have \"\\ y = Var y\" using y(1) step.hyps(4) unfolding transaction_fresh_subst_def by auto\n hence \"\\ y = Var x\" using y(2) unfolding subst_compose_def \\_empty by simp\n hence y_val: \"fst y = TAtom Value\" \"\\\\<^sub>v y = TAtom Value\"\n using x(1) \\\\<^sub>v_TAtom''[of x] \\\\<^sub>v_TAtom''[of y]\n wt_subst_trm''[OF transaction_renaming_subst_wt[OF step.hyps(5)], of \"Var y\"]\n by force+\n\n obtain ts where ts:\n \"occurs (Var y) \\ set ts\" \"receive\\ts\\ \\ set (unlabel (transaction_receive T))\"\n using admissible_transaction_occurs_checksE1[OF T y(1) y_val(2)]\n by (metis list.set_intros(1) unlabel_Cons(1)) \n hence \"receive\\ts\\ \\ set (unlabel (transaction_strand T))\" \n using transaction_strand_subsets(5) by blast\n hence *: \"receive\\ts \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\\ \\ set (unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n stateful_strand_step_subst_inI(2)[of _ _ \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] \n by force\n\n have \"occurs (Var y) \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = occurs (Var x)\"\n using y(2) by (auto simp del: subst_subst_compose)\n hence **: \"occurs (Var x) \\ set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" using ts(1) by force\n\n have \"send\\ts \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\\ \\ set (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using * dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(2) by blast\n thus ?thesis using ** unlabel_append[of A] by force\n qed\nqed simp\n\nlemma reachable_constraints_db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_set_args_empty:\n assumes \\: \"\\ \\ reachable_constraints P\"\n and PP: \"list_all wellformed_transaction P\"\n and admissible_transaction_updates:\n \"let f = (\\T. \\x \\ set (unlabel (transaction_updates T)).\n is_Update x \\ is_Var (the_elem_term x) \\ is_Fun_Set (the_set_term x) \\\n fst (the_Var (the_elem_term x)) = TAtom Value)\n in list_all f P\"\n and d: \"(t, s) \\ set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\)\"\n shows \"\\ss. s = Fun (Set ss) []\"\n using \\ d\nproof (induction)\n case (step \\ TT \\ \\ \\)\n let ?TT = \"transaction_strand TT \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n let ?TTu = \"unlabel ?TT\"\n let ?TTd = \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?TT\"\n let ?TTdu = \"unlabel ?TTd\"\n\n from step(6) have \"(t, s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t ?TTdu \\ (db'\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\) \\ []))\"\n by (metis db\\<^sub>s\\<^sub>s\\<^sub>t_append db\\<^sub>s\\<^sub>s\\<^sub>t_def step.prems unlabel_append)\n hence \"(t, s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\) \\ []) \\\n (\\t' s'. insert\\t',s'\\ \\ set ?TTdu \\ t = t' \\ \\ \\ s = s' \\ \\)\"\n using db\\<^sub>s\\<^sub>s\\<^sub>t_in_cases[of t \"s\" ?TTdu \\] by metis \n thus ?case\n proof\n assume \"\\t' s'. insert\\t',s'\\ \\ set ?TTdu \\ t = t' \\ \\ \\ s = s' \\ \\\"\n then obtain t' s' where t's'_p: \"insert\\t',s'\\ \\ set ?TTdu\" \"t = t' \\ \\\" \"s = s' \\ \\\" by metis\n then obtain lll where \"(lll, insert\\t',s'\\) \\ set ?TTd\" by (meson unlabel_mem_has_label)\n hence \"(lll, insert\\t',s'\\) \\ set (transaction_strand TT \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_steps_iff(4) by blast\n hence \"insert\\t',s'\\ \\ set ?TTu\" by (meson unlabel_in)\n hence \"insert\\t',s'\\ \\ set ((unlabel (transaction_strand TT)) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n by (simp add: subst_lsst_unlabel)\n hence \"insert\\t',s'\\ \\ (\\x. x \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` set (unlabel (transaction_strand TT))\"\n unfolding subst_apply_stateful_strand_def by auto\n then obtain u where\n \"u \\ set (unlabel (transaction_strand TT)) \\ u \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = insert\\t',s'\\\"\n by auto\n hence \"\\t'' s''. insert\\t'',s''\\ \\ set (unlabel (transaction_strand TT)) \\\n t' = t'' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\ s' = s'' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n by (cases u) auto\n then obtain t'' s'' where t''s''_p:\n \"insert\\t'',s''\\ \\ set (unlabel (transaction_strand TT)) \\\n t' = t'' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\ s' = s'' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n by auto\n hence \"insert\\t'',s''\\ \\ set (unlabel (transaction_updates TT))\"\n using is_Update_in_transaction_updates[of \"insert\\t'',s''\\\" TT]\n using PP step(2) unfolding list_all_iff by auto\n moreover have \"\\x\\set (unlabel (transaction_updates TT)). is_Fun_Set (the_set_term x)\"\n using step(2) admissible_transaction_updates unfolding is_Fun_Set_def list_all_iff by auto\n ultimately have \"is_Fun_Set (the_set_term (insert\\t'',s''\\))\" by auto\n moreover have \"s' = s'' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" using t''s''_p by blast\n ultimately have \"is_Fun_Set (the_set_term (insert\\t',s'\\))\" by (auto simp add: is_Fun_Set_subst)\n hence \"is_Fun_Set s\" by (simp add: t's'_p(3) is_Fun_Set_subst)\n thus ?case using is_Fun_Set_exi by auto\n qed (auto simp add: step db\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed auto\n\nlemma reachable_constraints_occurs_fact_ik_ground:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and t: \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"fv (occurs t) = {}\"\nproof -\n have 0: \"admissible_transaction T\"\n when \"T \\ set P\" for T\n using P that unfolding list_all_iff by simp\n\n note 1 = admissible_transaction_is_wellformed_transaction(1,5)[OF 0]\n\n have 2: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) =\n (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A) \\ (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n when \"T \\ set P\" for T \\ and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n using dual_transaction_ik_is_transaction_send'[OF 1(1)[OF that]] by fastforce\n\n show ?thesis using \\_reach t\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n note \\_empty = admissible_transaction_decl_subst_empty[OF 0[OF step.hyps(2)] step.hyps(3)]\n\n from step show ?case\n proof (cases \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\")\n case False\n hence \"occurs t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using 2[OF step.hyps(2)] step.prems \\_empty by blast\n then obtain ts where ts:\n \"occurs t \\ set ts\" \"send\\ts\\ \\ set (unlabel (transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using wellformed_transaction_send_receive_subst_trm_cases(2)[OF 1(1)[OF step.hyps(2)]]\n by blast\n then obtain ts' s where s:\n \"occurs s \\ set ts'\" \"send\\ts'\\ \\ set (unlabel (transaction_send T))\" \"t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using transaction_decl_fresh_renaming_substs_occurs_fact_send_receive(1)[\n OF step.hyps(3-5) 0[OF step.hyps(2)] ts(1)]\n transaction_strand_subst_subsets(8)[of T \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by blast\n\n obtain x where x: \"x \\ set (transaction_fresh T)\" \"s = Var x\"\n using admissible_transaction_occurs_checksE4[OF 1(2)[OF step.hyps(2)] s(2,1)] by metis\n\n have \"fv t = {}\"\n using transaction_decl_fresh_renaming_substs_range(2)[OF step.hyps(3-5) _ x(1)]\n s(3) x(2) transaction_decl_subst_empty_inv[OF step.hyps(3)[unfolded \\_empty]]\n by (auto simp del: subst_subst_compose)\n thus ?thesis by simp\n qed simp\n qed simp\nqed\n\nlemma reachable_constraints_occurs_fact_ik_funs_terms:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I). OccursFact \\ \\(funs_term ` set (snd (Ana s)))\" (is \"?A A\")\n and \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I). OccursSec \\ \\(funs_term ` set (snd (Ana s)))\" (is \"?B A\")\n and \"Fun OccursSec [] \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I\" (is \"?C A\")\n and \"\\x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A. I x \\ Fun OccursSec []\" (is \"?D A\")\nproof -\n have T_adm: \"admissible_transaction T\" when \"T \\ set P\" for T\n using P that unfolding list_all_iff by simp\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n\n note T_occ = admissible_transaction_is_wellformed_transaction(5)[OF T_adm]\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T_adm]\n\n have \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\" by (metis \\ welltyped_constraint_model_def)\n\n have \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range I)\"\n by (metis \\ welltyped_constraint_model_def constraint_model_def)\n\n have \\_grounds: \"fv (I x) = {}\" \"\\f T. I x = Fun f T\" for x\n using \\ interpretation_grounds[of I, of \"Var x\"] empty_fv_exists_fun[of \"I x\"]\n unfolding welltyped_constraint_model_def constraint_model_def by auto\n\n have 00: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\ vars_transaction T\"\n \"fv\\<^sub>s\\<^sub>e\\<^sub>t (subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))) = fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\"\n for T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n using fv_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset(1)[of \"unlabel (transaction_send T)\"] vars_transaction_unfold\n fv_subterms_set[of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"]\n by blast+\n\n have 0: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)). \\a. \\ (Var x) = TAtom a\"\n \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)). \\ (Var x) \\ TAtom OccursSecType\"\n \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))). \\a. \\ (Var x) = TAtom a\"\n \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))). \\ (Var x) \\ TAtom OccursSecType\"\n \"\\x \\ vars_transaction T. \\a. \\ (Var x) = TAtom a\"\n \"\\x \\ vars_transaction T. \\ (Var x) \\ TAtom OccursSecType\"\n when \"T \\ set P\" for T\n using admissible_transaction_occurs_fv_types[OF T_adm[OF that]] 00\n by blast+\n\n note T_fresh_type = admissible_transactionE(2)[OF T_adm]\n\n have 1: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)) \\\\<^sub>s\\<^sub>e\\<^sub>t I =\n (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\ (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I)\"\n when \"T \\ set P\" for T \\ and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n using dual_transaction_ik_is_transaction_send'[OF T_wf[OF that]]\n by fastforce\n\n have 2: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I) =\n subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n when \"T \\ set P\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" for T \\\n using wt_subst_TAtom_subterms_set_subst[OF wt_subst_compose[OF \\(1) \\_wt] 0(1)[OF that(1)]]\n wf_trm_subst_rangeD[OF wf_trms_subst_compose[OF \\(2) \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s]]\n by auto\n\n have 3: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n when \"T \\ set P\" \"transaction_decl_subst \\ T\"\n \"transaction_fresh_subst \\ T A\" \"transaction_renaming_subst \\ P A\"\n for \\ \\ \\ and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n using protocol_transaction_vars_TAtom_typed(3)[of T] P that(1)\n transaction_decl_fresh_renaming_substs_wt[OF that(2-4)]\n transaction_decl_fresh_renaming_substs_range_wf_trms[OF that(2-4)]\n wf_trms_subst_compose\n by simp_all\n\n have 4: \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)).\n OccursFact \\ \\(funs_term ` set (snd (Ana s))) \\\n OccursSec \\ \\(funs_term ` set (snd (Ana s)))\"\n when T: \"T \\ set P\" for T\n proof\n fix t assume t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\"\n then obtain ts s where s:\n \"send\\ts\\ \\ set (unlabel (transaction_send T))\" \"s \\ set ts\" \"t \\ subterms s\"\n using wellformed_transaction_unlabel_cases(4)[OF T_wf[OF T]]\n by fastforce\n\n have s_occ: \"\\x. s = occurs (Var x)\" when \"OccursFact \\ funs_term t \\ OccursSec \\ funs_term t\"\n using that s(1) subtermeq_imp_funs_term_subset[OF s(3)]\n admissible_transaction_occurs_checksE3[OF T_occ[OF T] _ s(2)]\n by blast\n\n obtain K T' where K: \"Ana t = (K,T')\" by moura\n\n show \"OccursFact \\ \\(funs_term ` set (snd (Ana t))) \\\n OccursSec \\ \\(funs_term ` set (snd (Ana t)))\"\n proof (rule ccontr)\n assume \"\\(OccursFact \\ \\(funs_term ` set (snd (Ana t))) \\\n OccursSec \\ \\(funs_term ` set (snd (Ana t))))\"\n hence a: \"OccursFact \\ \\(funs_term ` set (snd (Ana t))) \\\n OccursSec \\ \\(funs_term ` set (snd (Ana t)))\"\n by simp\n hence \"OccursFact \\ \\(funs_term ` set T') \\ OccursSec \\ \\(funs_term ` set T')\"\n using K by simp\n hence \"OccursFact \\ funs_term t \\ OccursSec \\ funs_term t\"\n using Ana_subterm[OF K] funs_term_subterms_eq(1)[of t] by blast\n then obtain x where x: \"t \\ subterms (occurs (Var x))\"\n using s(3) s_occ by blast\n thus False using a by fastforce\n qed\n qed\n\n have 5: \"OccursFact \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n \"OccursSec \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n when \\\\\\: \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T A\"\n \"transaction_renaming_subst \\ P A\"\n and T: \"T \\ set P\"\n for \\ \\ \\ and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n proof -\n have \"OccursFact \\ funs_term t\" \"OccursSec \\ funs_term t\"\n when \"t \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" for t \n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF \\\\\\ that \\_empty[OF T \\\\\\(1)] T_fresh_type[OF T]]\n by auto\n thus \"OccursFact \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n \"OccursSec \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n by blast+\n qed\n\n have 6: \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\" \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n when T: \"T \\ set P\"\n and \\\\\\: \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T A\"\n \"transaction_renaming_subst \\ P A\"\n and x: \"Var x \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n for x \\ \\ \\ and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n proof -\n obtain t where t: \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"t \\ (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = Var x\"\n using x by moura\n then obtain y where y: \"t = Var y\" by (cases t) auto\n\n have \"\\a. \\ t = TAtom a \\ a \\ OccursSecType\"\n using 0(1,2)[OF T] t(1) y\n by force\n thus \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n using wt_subst_trm''[OF 3(1)[OF T \\\\\\]] wt_subst_trm''[OF \\_wt] t(2) \n by (metis subst_apply_term.simps(1))\n thus \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\"\n by auto\n qed\n\n have 7: \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\" \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n when T: \"T \\ set P\"\n and \\\\\\: \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T A\"\n \"transaction_renaming_subst \\ P A\"\n and x: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n for x \\ \\ \\ and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n proof -\n obtain y where y: \"y \\ vars_transaction T\" \"x \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y)\"\n using x by auto\n hence y': \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y = Var x\"\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF \\\\\\ _ \\_empty[OF T \\\\\\(1)] T_fresh_type[OF T]]\n by (cases \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\") force+\n\n have \"\\a. \\ (Var y) = TAtom a \\ a \\ OccursSecType\"\n using 0(5,6)[OF T] y\n by force\n thus \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n using wt_subst_trm''[OF 3(1)[OF T \\\\\\]] wt_subst_trm''[OF \\_wt] y'\n by (metis subst_apply_term.simps(1))\n thus \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\"\n by auto\n qed\n\n have 8: \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\" \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n when T: \"T \\ set P\"\n and \\\\\\: \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T A\"\n \"transaction_renaming_subst \\ P A\"\n and x: \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n for x \\ \\ \\ and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n and A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n proof -\n obtain t where t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\" \"t \\ (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = Var x\"\n using x by moura\n then obtain y where y: \"t = Var y\" by (cases t) auto\n\n have \"\\a. \\ t = TAtom a \\ a \\ OccursSecType\"\n using 0(3,4)[OF T] t(1) y\n by force\n thus \"\\a. \\ (I x) = TAtom a \\ a \\ OccursSecType\"\n using wt_subst_trm''[OF 3(1)[OF T \\\\\\]] wt_subst_trm''[OF \\_wt] t(2) \n by (metis subst_apply_term.simps(1))\n thus \"I x \\ Fun OccursSec []\" \"\\t. I x = occurs t\"\n by auto\n qed\n\n have s_fv: \"fv s \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n when s: \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n and T: \"T \\ set P\"\n for s and \\ \\ \\::\"('fun,'atom,'sets,'lbl) prot_subst\"\n and T::\"('fun,'atom,'sets,'lbl) prot_transaction\"\n proof\n fix x assume \"x \\ fv s\"\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using s by auto\n hence *: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using fv_subterms_set_subst' by fast\n have **: \"list_all is_Send (unlabel (transaction_send T))\"\n using T_wf[OF T] unfolding wellformed_transaction_def by blast\n have \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\"\n proof -\n obtain t where t: \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"x \\ fv (t \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using * by fastforce\n hence \"fv t \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n using fv_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset(1)[of \"unlabel (transaction_send T)\"]\n by auto\n thus ?thesis using t(2) subst_apply_fv_subset by fast\n qed\n thus \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n using vars_transaction_unfold[of T] by fastforce\n qed\n\n show \"?A A\" using \\_reach\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n have *: \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)).\n OccursFact \\ \\(funs_term ` set (snd (Ana s)))\"\n using 4[OF step.hyps(2)] by blast\n\n have \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I.\n OccursFact \\ \\(funs_term ` set (snd (Ana s)))\"\n proof\n fix t assume t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n then obtain s u where su:\n \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"s \\ I = t\"\n \"u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\" \"u \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = s\"\n by force\n\n obtain Ku Tu where KTu: \"Ana u = (Ku,Tu)\" by moura\n \n have *: \"OccursFact \\ \\(funs_term ` set Tu)\"\n \"OccursFact \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n \"OccursFact \\ \\(funs_term ` \\(((set \\ snd \\ Ana) ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))))\"\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF step.hyps(3-5) _ \\_empty[OF step.hyps(2,3)] T_fresh_type[OF step.hyps(2)]]\n 4[OF step.hyps(2)] su(3) KTu\n by (fastforce,fastforce,fastforce)\n\n have \"OccursFact \\ \\(funs_term ` set (Tu \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n proof -\n { fix f assume f: \"f \\ \\(funs_term ` set (Tu \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n then obtain tf where tf: \"tf \\ set Tu\" \"f \\ funs_term (tf \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" by moura\n hence \"f \\ funs_term tf \\ f \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using funs_term_subst[of tf \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] by force\n hence \"f \\ OccursFact\" using *(1,2) tf(1) by blast\n } thus ?thesis by metis\n qed\n hence **: \"OccursFact \\ \\(funs_term ` set (snd (Ana s)))\"\n proof (cases u)\n case (Var xu)\n hence \"s = (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) xu\" using su(4) by (metis subst_apply_term.simps(1))\n thus ?thesis using *(3) by fastforce\n qed (use su(4) KTu Ana_subst'[of _ _ Ku Tu \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] in simp)\n \n show \"OccursFact \\ \\(funs_term ` set (snd (Ana t)))\"\n proof (cases s)\n case (Var sx)\n then obtain a where a: \"\\ (I sx) = Var a\"\n using su(1) 8(3)[OF step.hyps(2-5), of sx] by fast\n hence \"Ana (I sx) = ([],[])\" by (metis \\_grounds(2) const_type_inv[THEN Ana_const])\n thus ?thesis using Var su(2) by simp\n next\n case (Fun f S)\n hence snd_Ana_t: \"snd (Ana t) = snd (Ana s) \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t I\"\n using su(2) Ana_subst'[of f S _ \"snd (Ana s)\" I] by (cases \"Ana s\") simp_all\n\n { fix g assume \"g \\ \\(funs_term ` set (snd (Ana t)))\"\n hence \"g \\ \\(funs_term ` set (snd (Ana s))) \\\n (\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s))). g \\ funs_term (I x))\"\n using snd_Ana_t funs_term_subst[of _ I] by auto\n hence \"g \\ OccursFact\"\n proof\n assume \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s))). g \\ funs_term (I x)\"\n then obtain x where x: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s)))\" \"g \\ funs_term (I x)\" by moura\n have \"x \\ fv s\" using x(1) Ana_vars(2)[of s] by (cases \"Ana s\") auto\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n using s_fv[OF su(1) step.hyps(2)] by blast\n then obtain a h U where h:\n \"I x = Fun h U\" \"\\ (I x) = Var a\" \"a \\ OccursSecType\" \"arity h = 0\"\n using \\_grounds(2) 7(3)[OF step.hyps(2-5)] const_type_inv\n by metis\n hence \"h \\ OccursFact\" by auto\n moreover have \"U = []\" using h(1,2,4) const_type_inv_wf[of h U a] \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s by fastforce\n ultimately show ?thesis using h(1) x(2) by auto\n qed (use ** in blast)\n } thus ?thesis by blast\n qed\n qed\n thus ?case\n using step.IH step.prems 1[OF step.hyps(2), of A \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n 2[OF step.hyps(2) 3[OF step.hyps(2-5)]]\n by auto\n qed simp\n\n show \"?B A\" using \\_reach\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n have \"\\s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I.\n OccursSec \\ \\(funs_term ` set (snd (Ana s)))\"\n proof\n fix t assume t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n then obtain s u where su:\n \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"s \\ I = t\"\n \"u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\" \"u \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = s\"\n by force\n\n obtain Ku Tu where KTu: \"Ana u = (Ku,Tu)\" by moura\n \n have *: \"OccursSec \\ \\(funs_term ` set Tu)\"\n \"OccursSec \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n \"OccursSec \\ \\(funs_term ` \\(((set \\ snd \\ Ana) ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))))\"\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF step.hyps(3-5) _ \\_empty[OF step.hyps(2,3)] T_fresh_type[OF step.hyps(2)]] \n 4[OF step.hyps(2)] su(3) KTu\n by (fastforce,fastforce,fastforce)\n\n have \"OccursSec \\ \\(funs_term ` set (Tu \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n proof -\n { fix f assume f: \"f \\ \\(funs_term ` set (Tu \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n then obtain tf where tf: \"tf \\ set Tu\" \"f \\ funs_term (tf \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" by moura\n hence \"f \\ funs_term tf \\ f \\ \\(funs_term ` subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using funs_term_subst[of tf \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] by force\n hence \"f \\ OccursSec\" using *(1,2) tf(1) by blast\n } thus ?thesis by metis\n qed\n hence **: \"OccursSec \\ \\(funs_term ` set (snd (Ana s)))\"\n proof (cases u)\n case (Var xu)\n hence \"s = (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) xu\" using su(4) by (metis subst_apply_term.simps(1))\n thus ?thesis using *(3) by fastforce\n qed (use su(4) KTu Ana_subst'[of _ _ Ku Tu \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] in simp)\n \n show \"OccursSec \\ \\(funs_term ` set (snd (Ana t)))\"\n proof (cases s)\n case (Var sx)\n then obtain a where a: \"\\ (I sx) = Var a\"\n using su(1) 8(3)[OF step.hyps(2-5), of sx] by fast\n hence \"Ana (I sx) = ([],[])\" by (metis \\_grounds(2) const_type_inv[THEN Ana_const])\n thus ?thesis using Var su(2) by simp\n next\n case (Fun f S)\n hence snd_Ana_t: \"snd (Ana t) = snd (Ana s) \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t I\"\n using su(2) Ana_subst'[of f S _ \"snd (Ana s)\" I] by (cases \"Ana s\") simp_all\n\n { fix g assume \"g \\ \\(funs_term ` set (snd (Ana t)))\"\n hence \"g \\ \\(funs_term ` set (snd (Ana s))) \\\n (\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s))). g \\ funs_term (I x))\"\n using snd_Ana_t funs_term_subst[of _ I] by auto\n hence \"g \\ OccursSec\"\n proof\n assume \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s))). g \\ funs_term (I x)\"\n then obtain x where x: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set (snd (Ana s)))\" \"g \\ funs_term (I x)\" by moura\n have \"x \\ fv s\" using x(1) Ana_vars(2)[of s] by (cases \"Ana s\") auto\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n using s_fv[OF su(1) step.hyps(2)] by blast\n then obtain a h U where h:\n \"I x = Fun h U\" \"\\ (I x) = Var a\" \"a \\ OccursSecType\" \"arity h = 0\"\n using \\_grounds(2) 7(3)[OF step.hyps(2-5)] const_type_inv\n by metis\n hence \"h \\ OccursSec\" by auto\n moreover have \"U = []\" using h(1,2,4) const_type_inv_wf[of h U a] \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s by fastforce\n ultimately show ?thesis using h(1) x(2) by auto\n qed (use ** in blast)\n } thus ?thesis by blast\n qed\n qed\n thus ?case\n using step.IH step.prems 1[OF step.hyps(2), of A \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n 2[OF step.hyps(2) 3[OF step.hyps(2-5)]]\n by auto\n qed simp\n\n show \"?C A\" using \\_reach\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n have *: \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n using admissible_transaction_occurs_checksE5[OF T_occ[OF step.hyps(2)]] by blast\n\n have **: \"Fun OccursSec [] \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF step.hyps(3-5) _ \\_empty[OF step.hyps(2,3)] T_fresh_type[OF step.hyps(2)]]\n by auto\n\n have \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n proof\n assume \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n then obtain s where \"s \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"s \\ I = Fun OccursSec []\"\n by moura\n moreover have \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n proof\n assume \"Fun OccursSec [] \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n then obtain u where \"u \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\" \"u \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = Fun OccursSec []\"\n by moura\n thus False using * ** by (cases u) (force simp del: subst_subst_compose)+\n qed\n ultimately show False using 6[OF step.hyps(2-5)] by (cases s) auto\n qed\n thus ?case using step.IH step.prems 1[OF step.hyps(2), of A \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] by fast\n qed simp\n\n show \"?D A\" using \\_reach\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n { fix x assume x: \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n hence x': \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n by (metis vars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq unlabel_subst)\n hence \"x \\ vars_transaction T \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) ` vars_transaction T)\"\n using vars\\<^sub>s\\<^sub>s\\<^sub>t_subst_cases[OF x'] by metis\n moreover have \"I x \\ Fun OccursSec []\" when \"x \\ vars_transaction T\"\n using that 0(5,6)[OF step.hyps(2)] wt_subst_trm''[OF \\_wt, of \"Var x\"]\n by fastforce\n ultimately have \"I x \\ Fun OccursSec []\"\n using 7(1)[OF step.hyps(2-5), of x]\n by blast\n } thus ?case using step.IH by auto\n qed simp\nqed\n\nlemma reachable_constraints_occurs_fact_ik_subst_aux:\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and t: \"t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\" \"t \\ I = occurs s\"\n shows \"\\u. t = occurs u\"\nproof -\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\"\n using \\ unfolding welltyped_constraint_model_def constraint_model_def by metis\n hence 0: \"\\ t = \\ (occurs s)\"\n using t(2) wt_subst_trm'' by metis\n\n have 1: \"\\\\<^sub>v ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ (\\T \\ set P. \\\\<^sub>v ` fv_transaction T)\"\n \"\\T \\ set P. \\x \\ fv_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n using reachable_constraints_var_types_in_transactions(1)[OF \\_reach]\n protocol_transaction_vars_TAtom_typed(2,3) P\n by fast+\n\n show ?thesis\n proof (cases t)\n case (Var x)\n thus ?thesis\n using 0 1 t(1) var_subterm_ik\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t[of x \"unlabel A\"]\n by fastforce\n next\n case (Fun f T)\n hence 2: \"f = OccursFact\" \"length T = Suc (Suc 0)\" \"T ! 0 \\ I = Fun OccursSec []\"\n using t(2) by auto\n\n have \"T ! 0 = Fun OccursSec []\"\n proof (cases \"T ! 0\")\n case (Var y)\n hence \"I y = Fun OccursSec []\" using Fun 2(3) by simp\n moreover have \"Var y \\ set T\" using Var 2(2) length_Suc_conv[of T 1] by auto\n hence \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\" using Fun t(1) by force\n hence \"y \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n using fv_ik_subset_fv_sst'[of \"unlabel A\"] vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel A\"]\n by blast\n ultimately have False\n using reachable_constraints_occurs_fact_ik_funs_terms(4)[OF \\_reach \\ P]\n by blast\n thus ?thesis by simp\n qed (use 2(3) in simp)\n moreover have \"\\u u'. T = [u,u']\"\n using iffD1[OF length_Suc_conv 2(2)] iffD1[OF length_Suc_conv[of _ 0]] length_0_conv by fast\n ultimately show ?thesis using Fun 2(1,2) by force\n qed\nqed\n\nlemma reachable_constraints_occurs_fact_ik_subst:\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and t: \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n shows \"occurs t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\nproof -\n have \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t I\"\n using \\ unfolding welltyped_constraint_model_def constraint_model_def by metis\n\n obtain s where s: \"s \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\" \"s \\ I = occurs t\"\n using t by auto\n hence u: \"\\u. s = occurs u\"\n using \\_wt reachable_constraints_occurs_fact_ik_subst_aux[OF \\_reach \\ P]\n by blast\n hence \"fv s = {}\"\n using reachable_constraints_occurs_fact_ik_ground[OF \\_reach P] s\n by fast\n thus ?thesis\n using s u subst_ground_ident[of s I] \n by argo\nqed\n\nlemma reachable_constraints_occurs_fact_send_in_ik:\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"occurs (Var x) \\ set ts\" \"send\\ts\\ \\ set (unlabel A)\"\n shows \"occurs (I x) \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing \\_reach \\ x\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n\n have T_adm: \"admissible_transaction T\"\n using P step.hyps(2) unfolding list_all_iff by blast\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n note T_adm_occ = admissible_transaction_is_wellformed_transaction(5)[OF T_adm]\n\n have \\_is_T_model: \"strand_sem_stateful (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I) (set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A I)) (unlabel T') I\"\n using step.prems unlabel_append[of A T'] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel A\" I \"[]\"]\n strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel A\" \"unlabel T'\" I]\n by (simp add: T'_def \\_def welltyped_constraint_model_def constraint_model_def db\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n show ?case\n proof (cases \"send\\ts\\ \\ set (unlabel A)\")\n case False\n hence \"send\\ts\\ \\ set (unlabel T')\"\n using step.prems(3) unfolding T'_def \\_def by simp\n hence \"receive\\ts\\ \\ set (unlabel (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_steps_iff(2) unfolding T'_def by blast\n then obtain y ts' where y:\n \"receive\\ts'\\ \\ set (unlabel (transaction_receive T))\"\n \"\\ y = Var x\" \"occurs (Var y) \\ set ts'\"\n using transaction_decl_fresh_renaming_substs_occurs_fact_send_receive(2)[\n OF step.hyps(3-5) T_adm]\n subst_to_var_is_var[of _ \\ x] step.prems(2)\n unfolding \\_def by (force simp del: subst_subst_compose)\n hence \"occurs (Var y) \\ \\ \\ set ts' \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n \"receive\\ts' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\\ \\ set (unlabel (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using subst_lsst_unlabel_member[of \"receive\\ts'\\\" \"transaction_receive T\" \\]\n by fastforce+\n hence \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ occurs (Var y) \\ \\ \\ I\"\n using wellformed_transaction_sem_receives[\n OF T_wf, of \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I\" \"set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A I)\" \\ I \"ts' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\\"]\n \\_is_T_model\n unfolding T'_def list_all_iff by fastforce\n hence *: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ occurs (\\ y \\ I)\"\n by auto\n\n have \"occurs (\\ y \\ I) \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n using deduct_occurs_in_ik[OF *]\n reachable_constraints_occurs_fact_ik_subst[\n OF step.hyps(1) welltyped_constraint_model_prefix[OF step.prems(1)] P, of \"\\ y \\ I\"]\n reachable_constraints_occurs_fact_ik_funs_terms[\n OF step.hyps(1) welltyped_constraint_model_prefix[OF step.prems(1)] P]\n by blast\n thus ?thesis using y(2) by simp\n qed (simp add: step.IH[OF welltyped_constraint_model_prefix[OF step.prems(1)]] step.prems(2))\nqed simp\n\nlemma reachable_constraints_occurs_fact_deduct_in_ik:\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and k: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I \\ occurs k\"\n shows \"occurs k \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I\"\n and \"occurs k \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing reachable_constraints_occurs_fact_ik_funs_terms(1-3)[OF \\_reach \\ P]\n reachable_constraints_occurs_fact_ik_subst[OF \\_reach \\ P]\n deduct_occurs_in_ik[OF k]\nby (presburger, presburger)\n\nlemma reachable_contraints_fv_bvars_subset:\n assumes A: \"A \\ reachable_constraints P\"\n shows \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ (\\T \\ set P. bvars_transaction T)\"\nusing assms\nproof (induction A rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n let ?T' = \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n show ?case\n using step.IH step.hyps(2)\n bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of ?T']\n bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n bvars\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?T')\"]\n unlabel_append[of \\ \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?T'\"]\n by (metis (no_types, lifting) SUP_upper Un_subset_iff)\nqed simp\n\nlemma reachable_contraints_fv_disj:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes A: \"A \\ reachable_constraints P\"\n shows \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ (\\T \\ set P. bvars_transaction T) = {}\"\nusing A\nproof (induction A rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n define T' where \"T' \\ transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \n define X where \"X \\ \\T \\ set P. bvars_transaction T\"\n have \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ X = {}\"\n using transaction_decl_fresh_renaming_substs_vars_disj(4)[OF step.hyps(3-5)]\n transaction_decl_fresh_renaming_substs_vars_subset(4)[OF step.hyps(3-5,2)]\n unfolding T'_def X_def by blast\n hence \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T') \\ X = {}\"\n using step.IH[unfolded X_def[symmetric]] fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of T'] by auto\n thus ?case unfolding T'_def X_def by blast\nqed simp\n\nlemma reachable_contraints_fv_bvars_disj:\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes P: \"\\T \\ set P. wellformed_transaction T\"\n and A: \"A \\ reachable_constraints P\"\n shows \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\nusing A\nproof (induction A rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n note 0 = transaction_decl_fresh_renaming_substs_vars_disj[OF step.hyps(3-5)]\n note 1 = transaction_decl_fresh_renaming_substs_vars_subset[OF step.hyps(3-5)]\n\n have 2: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = {}\" \n using 0(7) 1(4)[OF step.hyps(2)] fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq\n unfolding T'_def by (metis (no_types) disjoint_iff_not_equal subset_iff)\n\n have \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ \\(bvars_transaction ` set P)\"\n \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ \\(bvars_transaction ` set P) = {}\"\n using reachable_contraints_fv_bvars_subset[OF reachable_constraints.step[OF step.hyps]]\n reachable_contraints_fv_disj[OF reachable_constraints.step[OF step.hyps]]\n unfolding T'_def by auto\n hence 3: \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = {}\" by blast\n \n have \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ bvars_transaction T = {}\"\n using 0(4)[OF step.hyps(2)] 1(4)[OF step.hyps(2)] by blast\n hence 4: \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' = {}\"\n by (metis (no_types) T'_def fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq\n unlabel_subst bvars\\<^sub>s\\<^sub>s\\<^sub>t_subst)\n\n have \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@T') \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@T') = {}\"\n using 2 3 4 step.IH\n unfolding unlabel_append[of \\ T']\n fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"]\n bvars\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"]\n by fast\n thus ?case unfolding T'_def by blast\nqed simp\n\nlemma reachable_constraints_wf:\n assumes P:\n \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n and A: \"A \\ reachable_constraints P\"\n shows \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\"\nproof -\n let ?X = \"\\T. fst ` set (transaction_decl T ()) \\ set (transaction_fresh T)\"\n\n have \"wellformed_transaction T\"\n when \"T \\ set P\" for T\n using P(1) that by fast+\n hence 0: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (?X T) (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)))\"\n \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) = {}\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms_transaction T)\"\n when T: \"T \\ set P\" for T\n unfolding admissible_transaction_terms_def\n by (metis T wellformed_transaction_wf\\<^sub>s\\<^sub>s\\<^sub>t(1),\n metis T wellformed_transaction_wf\\<^sub>s\\<^sub>s\\<^sub>t(2) fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq bvars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq,\n metis T wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_code P(2))\n\n from A have \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n proof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n let ?T' = \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n have IH: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t {} (unlabel A)\" \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A = {}\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n using step.IH by metis+\n\n have 1: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t {} (unlabel (A@?T'))\"\n using transaction_decl_fresh_renaming_substs_wf_sst[OF 0(1)[OF step.hyps(2)] step.hyps(3-5)]\n wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono[of \"{}\"] wf\\<^sub>s\\<^sub>s\\<^sub>t_append[OF IH(1)]\n by simp\n\n have 2: \"fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@?T') \\ bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@?T') = {}\"\n using reachable_contraints_fv_bvars_disj[OF P(1)]\n reachable_constraints.step[OF step.hyps]\n by blast\n\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?T')\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq unlabel_subst\n wf_trms_subst[\n OF transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)],\n THEN wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_trms\\<^sub>s\\<^sub>s\\<^sub>t_subst,\n OF 0(3)[OF step.hyps(2)]]\n by metis\n hence 3: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@?T'))\"\n using IH(3) by auto\n\n show ?case using 1 2 3 by force\n qed simp\n thus \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\" by metis+\nqed\n\nlemma reachable_constraints_no_Ana_attack:\n assumes \\: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. \\x \\ set (transaction_fresh T).\n \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n and t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"attack\\n\\ \\ set (snd (Ana t))\"\nproof -\n have T_adm_term: \"admissible_transaction_terms T\" when \"T \\ set P\" for T\n using P that by blast\n\n have T_wf: \"wellformed_transaction T\" when \"T \\ set P\" for T\n using P that by blast\n\n have T_fresh: \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n when \"T \\ set P\" for T\n using P(3) that by fast\n\n show ?thesis\n using \\ t\n proof (induction \\ rule: reachable_constraints.induct)\n case (step A T \\ \\ \\) thus ?case\n proof (cases \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\")\n case False\n hence \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using step.prems by simp\n hence \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using dual_transaction_ik_is_transaction_send'[OF T_wf[OF step.hyps(2)]]\n by metis\n hence \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using transaction_decl_fresh_renaming_substs_trms[\n OF step.hyps(3-5), of \"transaction_send T\"]\n wellformed_transaction_unlabel_cases(4)[OF T_wf[OF step.hyps(2)]]\n by fastforce\n then obtain s where s: \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T))\" \"t = s \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n by moura\n hence s': \"attack\\n\\ \\ set (snd (Ana s))\"\n using admissible_transaction_no_Ana_Attack[OF T_adm_term[OF step.hyps(2)]]\n trms_transaction_unfold[of T]\n by blast\n\n note * = transaction_decl_fresh_renaming_substs_range'(1-3)[OF step.hyps(3-5)]\n transaction_decl_fresh_renaming_substs_range_no_attack_const[\n OF step.hyps(3-5) T_fresh[OF step.hyps(2)]]\n\n show ?thesis\n proof\n assume n: \"attack\\n\\ \\ set (snd (Ana t))\"\n thus False\n proof (cases s)\n case (Var x)\n hence \"(\\c. t = Fun c []) \\ (\\y. t = Var y)\"\n using *(1)[of t] n s(2) by (force simp del: subst_subst_compose)\n thus ?thesis using n Ana_subterm' by fastforce\n next\n case (Fun f S)\n hence \"attack\\n\\ \\ set (snd (Ana s)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using Ana_subst'[of f S _ \"snd (Ana s)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] s(2) s' n\n by (cases \"Ana s\") auto\n hence \"attack\\n\\ \\ set (snd (Ana s)) \\ attack\\n\\ \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using const_mem_subst_cases' by fast\n thus ?thesis using *(4) s' by fast\n qed\n qed\n qed simp\n qed simp\nqed\n\nlemma reachable_constraints_receive_attack_if_attack:\n assumes \\: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. \\x \\ set (transaction_fresh T).\n \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n \"\\T \\ set P. \\x \\ vars_transaction T. \\TAtom AttackType \\ \\\\<^sub>v x\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and l: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ attack\\l\\\"\n shows \"attack\\l\\ \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n and \"receive\\[attack\\l\\]\\ \\ set (unlabel \\)\"\n and \"\\T \\ set P. \\s \\ set (transaction_strand T).\n is_Send (snd s) \\ length (the_msgs (snd s)) = 1 \\\n is_Fun_Attack (hd (the_msgs (snd s)))\n \\ the_Attack_label (the_Fun (hd (the_msgs (snd s)))) = fst s\n \\ (l,receive\\[attack\\l\\]\\) \\ set \\\" (is \"?Q \\ (l,receive\\[attack\\l\\]\\) \\ set \\\")\nproof -\n have \\': \"constr_sem_stateful \\ (unlabel \\)\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using \\ unfolding welltyped_constraint_model_def constraint_model_def by metis+\n\n have 0: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n when \\: \"\\ \\ reachable_constraints P\" for \\\n using reachable_constraints_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s[OF _ \\] admissible_transaction_terms_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s P(2)\n ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset[of \"unlabel \\\"] wf_trms_subst[OF \\'(3)]\n by fast\n\n have 1: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\TAtom AttackType \\ \\\\<^sub>v x\"\n when \\: \"\\ \\ reachable_constraints P\" for \\\n using reachable_constraints_vars_not_attack_typed[OF \\ P(3,4)]\n fv_ik_subset_vars_sst'[of \"unlabel \\\"]\n by fast\n\n have 2: \"attack\\l\\ \\ set (snd (Ana t)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" when t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" for t\n proof\n assume \"attack\\l\\ \\ set (snd (Ana t)) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n then obtain s where s: \"s \\ set (snd (Ana t))\" \"s \\ \\ = attack\\l\\\" by moura\n\n obtain x where x: \"s = Var x\"\n by (cases s) (use s reachable_constraints_no_Ana_attack[OF \\ P(1-3) t] in auto)\n\n have \"x \\ fv t\" using x Ana_subterm'[OF s(1)] vars_iff_subtermeq by force\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" using t fv_subterms by fastforce\n hence \"\\\\<^sub>v x \\ TAtom AttackType\" using 1[OF \\] by fastforce\n thus False using s(2) x wt_subst_trm''[OF \\'(4), of \"Var x\"] by fastforce\n qed\n\n have 3: \"attack\\l\\ \\ set (snd (Ana t))\" when t: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" for t\n proof\n assume \"attack\\l\\ \\ set (snd (Ana t))\"\n then obtain s where s:\n \"s \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\" \"attack\\l\\ \\ set (snd (Ana s))\"\n using Ana_subst_subterms_cases[OF t] 2 by fast\n then obtain x where x: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"s \\ \\ x\" by moura\n hence \"\\ x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using var_is_subterm[of x] subterms_subst_subset'[of \\ \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n by force\n hence *: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\n using wf_trms_subterms[OF 0[OF \\]] wf_trm_subtermeq[OF _ x(2)]\n by auto\n\n show False\n using term.order_trans[\n OF subtermeq_imp_subtermtypeeq[OF *(2) Ana_subterm'[OF s(2)]]\n subtermeq_imp_subtermtypeeq[OF *(1) x(2)]]\n 1[OF \\] x(1) wt_subst_trm''[OF \\'(4), of \"Var x\"]\n by force\n qed\n\n have 4: \"t = attack\\n\\\"\n when t: \"t \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = attack\\n\\\"\n and hyps: \"transaction_decl_subst \\ T\"\n \"transaction_fresh_subst \\ T \\\"\n \"transaction_renaming_subst \\ P \\\"\n and T: \"\\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = TAtom (Atom a))\"\n for t n\n and T::\"('fun, 'atom, 'sets, 'lbl) prot_transaction\"\n and \\ \\ \\::\"('fun, 'atom, 'sets, 'lbl) prot_subst\"\n and \\::\"('fun, 'atom, 'sets, 'lbl) prot_strand\"\n proof (cases t)\n case (Var x)\n hence \"attack\\n\\ \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n by (metis (no_types, lifting) t subst_apply_term.simps(1) subst_imgI term.distinct(1)) \n thus ?thesis\n using transaction_decl_fresh_renaming_substs_range_no_attack_const[OF hyps T]\n by blast\n qed (use t in simp)\n\n have 5: \"\\ts'. ts = ts' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\ (l,send\\ts'\\) \\ set (transaction_strand T)\"\n when ts: \"(l,receive\\ts\\) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n for l ts \\ and T::\"('fun, 'atom, 'sets, 'lbl) prot_transaction\"\n using subst_lsst_memD(2)[OF ts[unfolded dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_steps_iff(1)[symmetric]]]\n by auto\n\n have 6: \"l' = l\" when \"(l',receive\\[attack\\l\\]\\) \\ set \\\" and Q: \"?Q\" for l'\n using \\ that(1)\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\) show ?case\n proof (cases \"(l',receive\\[attack\\l\\]\\) \\ set \\\")\n case False\n hence *: \"(l',receive\\[attack\\l\\]\\) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using step.prems by simp\n have \"(l',send\\[attack\\l\\]\\) \\ set (transaction_strand T)\"\n using 4[OF _ step.hyps(3-5)] P(3) step.hyps(2) 5[OF *] by force\n thus ?thesis using Q step.hyps(2) unfolding is_Fun_Attack_def by fastforce\n qed (use step.IH in simp)\n qed simp\n\n have 7: \"\\t. ts = [t] \\ t = attack\\l\\\"\n when ts: \"receive\\ts\\ \\ set (unlabel \\)\" \"attack\\l\\ \\ set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" for ts\n using \\ ts(1)\n proof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n obtain t where t: \"t \\ set ts\" \"attack\\l\\ = t \\ \\\" using ts(2) by blast\n hence t_in_ik: \"t \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\ @ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using step.prems(1) in_ik\\<^sub>s\\<^sub>s\\<^sub>t_iff[of t] by blast\n\n have t_attack_eq: \"t = attack\\l\\\"\n proof (cases t)\n case (Var x) \n hence \"TAtom AttackType \\ subterms (\\ t)\"\n using t_in_ik 1[OF reachable_constraints.step[OF step.hyps]] by fastforce\n thus ?thesis using t(2) wt_subst_trm''[OF \\'(4), of t] by force\n qed (use t(2) in simp)\n\n show ?case\n proof (cases \"receive\\ts\\ \\ set (unlabel \\)\")\n case False\n then obtain l' where l':\n \"(l', receive\\ts\\) \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using step.prems(1) unfolding unlabel_def by force\n then obtain ts' where ts':\n \"ts = ts' \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"(l', send\\ts'\\) \\ set (transaction_strand T)\"\n using 5 by meson\n then obtain t' where t': \"t' \\ set ts'\" \"t' \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ = attack\\l\\\"\n using t(1) t_attack_eq by force\n\n note * = t'(1) 4[OF t'(2) step.hyps(3-5)]\n\n have \"send\\ts'\\ \\ set (unlabel (transaction_strand T))\"\n using ts'(2) step.hyps(2) P(2) unfolding unlabel_def by force\n hence \"length ts' = 1\"\n using step.hyps(2) P(2,3) * unfolding admissible_transaction_terms_def by fastforce\n hence \"ts' = [attack\\l\\]\" using * P(3) step.hyps(2) by (cases ts') auto\n thus ?thesis by (simp add: ts'(1))\n qed (use step.IH in simp)\n qed simp\n\n show \"attack\\l\\ \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using private_const_deduct[OF _ l] 3 by simp\n then obtain ts where ts: \"receive\\ts\\ \\ set (unlabel \\)\" \"attack\\l\\ \\ set ts \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using in_ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_iff[of _ \\] unfolding unlabel_def by force\n then obtain t where \"ts = [t]\" \"t = attack\\l\\\"\n using 7 by blast\n thus \"receive\\[attack\\l\\]\\ \\ set (unlabel \\)\"\n using ts(1) by blast\n hence \"\\l'. (l', receive\\[attack\\l\\]\\) \\ set \\\"\n unfolding unlabel_def by fastforce\n thus \"(l,receive\\[attack\\l\\]\\) \\ set \\\" when ?Q\n using that 6 by fast\nqed\n\nlemma reachable_constraints_receive_attack_if_attack':\n assumes \\: \"\\ \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and n: \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ attack\\n\\\"\n shows \"attack\\n\\ \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n and \"receive\\[attack\\n\\]\\ \\ set (unlabel \\)\"\nproof -\n have P': \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. \\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n \"\\T \\ set P. \\x \\ vars_transaction T. \\TAtom AttackType \\ \\\\<^sub>v x\"\n using admissible_transaction_is_wellformed_transaction(1,4)[OF bspec[OF P]]\n admissible_transactionE(2,15)[OF bspec[OF P]]\n by (blast, blast, blast, blast)\n\n show \"attack\\n\\ \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"receive\\[attack\\n\\]\\ \\ set (unlabel \\)\"\n using reachable_constraints_receive_attack_if_attack(1,2)[OF \\ P'(1,2) _ P'(4) \\ n] P'(3)\n by (metis, metis)\nqed\n\nlemma constraint_model_Value_term_is_Val:\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"\\\\<^sub>v x = TAtom Value\" \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"\\n. I x = Fun (Val n) []\"\nusing reachable_constraints_occurs_fact_send_ex[OF \\_reach P x]\n reachable_constraints_occurs_fact_send_in_ik[OF \\_reach \\ P]\n reachable_constraints_occurs_fact_ik_case[OF \\_reach P]\nby fast\n\nlemma constraint_model_Value_term_is_Val':\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model I A\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and x: \"(TAtom Value, m) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"\\n. I (TAtom Value, m) = Fun (Val n) []\"\nusing constraint_model_Value_term_is_Val[OF \\_reach \\ P _ x] by simp\n\n(* We use this lemma to show that fresh constants first occur in \\(\\) at the point where they were generated *)\nlemma constraint_model_Value_var_in_constr_prefix:\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"\\x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\. \\\\<^sub>v x = TAtom Value \\ (\\B. prefix B \\ \\ x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B \\ \\ x \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B)\"\n (is \"\\x \\ ?X \\. ?R x \\ ?Q x \\\")\nusing \\_reach \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n let ?P = \"\\\\. \\x \\ ?X \\. ?R x \\ ?Q x \\\"\n\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n have IH: \"?P \\\" using step welltyped_constraint_model_prefix by fast\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF bspec[OF P step.hyps(2)] step.hyps(3)]\n\n have T_adm: \"admissible_transaction T\" by (metis P step.hyps(2))\n\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n\n have \\_is_T_model: \"strand_sem_stateful (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\) (set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\)) (unlabel T') \\\"\n using step.prems unlabel_append[of \\ T'] db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\" \\ \"[]\"]\n strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel \\\" \"unlabel T'\" \\]\n by (simp add: T'_def welltyped_constraint_model_def constraint_model_def db\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n have \\_interp: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (metis \\ welltyped_constraint_model_def constraint_model_def,\n metis \\ welltyped_constraint_model_def,\n metis \\ welltyped_constraint_model_def constraint_model_def)\n\n have 1: \"?Q x \\\" when x: \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\" \"\\\\<^sub>v x = TAtom Value\" for x\n proof -\n obtain n where n: \"\\ x = Fun n []\" \"is_Val n\" \"\\public n\"\n using constraint_model_Value_term_is_Val[\n OF reachable_constraints.step[OF step.hyps] step.prems P x(2)]\n x(1) fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel T'\"] unlabel_append[of \\ T']\n unfolding T'_def by moura\n\n have \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using x(1) fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq unfolding T'_def by fastforce\n then obtain y where y: \"y \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)\" \"x \\ fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y)\"\n using fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var[of x \"unlabel (transaction_strand T)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by auto\n\n have y_x: \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y = Var x\" and y_not_fresh: \"y \\ set (transaction_fresh T)\"\n using y(2) transaction_decl_fresh_renaming_substs_range[OF step.hyps(3-5), of y]\n by (force, fastforce)\n\n have \"\\ ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y) = TAtom Value\" using x(2) y_x by simp\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n by (rule transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)])\n ultimately have y_val: \"\\\\<^sub>v y = TAtom Value\"\n by (metis wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def \\.simps(1))\n\n have \"Fun n [] = (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y \\ \\\" using n y_x by simp\n hence y_n: \"Fun n [] = (\\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s \\) y\"\n by (metis subst_subst_compose[of \"Var y\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \\] subst_apply_term.simps(1))\n\n have \\_ik_\\_vals: \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\f. \\ x = Fun f []\"\n proof -\n have \"\\a. \\ (\\ x) = Var a\" when \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\" for x\n using that reachable_constraints_vars_TAtom_typed[OF step.hyps(1) P, of x]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\"] wt_subst_trm''[OF \\_wt, of \"Var x\"]\n by force\n hence \"\\f. \\ x = Fun f []\" when \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\" for x\n using that wf_trm_subst[OF \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s, of \"Var x\"] wf_trm_Var[of x] const_type_inv_wf\n empty_fv_exists_fun[OF interpretation_grounds[OF \\_interp], of \"Var x\"] \n by (metis subst_apply_term.simps(1)[of x \\])\n thus ?thesis\n using fv_ik_subset_fv_sst'[of \"unlabel \\\"] vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\"]\n by blast\n qed\n hence \\_subterms_subst_cong: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\) = subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n by (metis ik\\<^sub>s\\<^sub>s\\<^sub>t_subst[of \"unlabel \\\" \\] unlabel_subst[of \\ \\] subterms_subst_lsst_ik[of \\ \\])\n\n have x_nin_\\: \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n proof -\n have \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using x(1) fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq unfolding T'_def by fast\n hence \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t ((unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using transaction_fresh_subst_grounds_domain[OF step.hyps(4)] step.hyps(4)\n labeled_stateful_strand_subst_comp[of \\ \"transaction_strand T\" \\]\n unlabel_subst[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\" \\]\n unlabel_subst[of \"transaction_strand T\" \\]\n by (simp add: \\_empty transaction_fresh_subst_def range_vars_alt_def)\n then obtain y where \"\\ y = Var x\"\n using transaction_renaming_subst_var_obtain(1)[OF step.hyps(5)] by blast\n thus ?thesis\n using transaction_renaming_subst_range_notin_vars[OF step.hyps(5), of y]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\"]\n by auto\n qed\n\n from admissible_transaction_fv_in_receives_or_selects[OF T_adm y(1) y_not_fresh]\n have n_cases: \"Fun n [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\z \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\. \\\\<^sub>v z = TAtom Value \\ \\ z = Fun n [])\"\n proof\n assume y_in: \"y \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T)\"\n then obtain ts where ts:\n \"receive\\ts\\ \\ set (unlabel (transaction_receive T))\" \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\"\n using admissible_transaction_strand_step_cases(1)[OF T_adm]\n by force\n hence ts_deduct: \"list_all (\\t. ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ t \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\ \\) ts\"\n using wellformed_transaction_sem_receives[\n OF T_wf, of \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \\ \"ts \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n \\_is_T_model\n subst_lsst_unlabel_member[of \"receive\\ts\\\" \"transaction_receive T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unfolding T'_def list_all_iff by force\n\n obtain ty where ty: \"ty \\ set ts\" \"y \\ fv ty\" using ts(2) by fastforce\n \n have \"Fun n [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\z \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\\\<^sub>v z = TAtom Value \\ \\ z = Fun n [])\"\n proof -\n have \"Fun n [] \\ ty \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\ \\\"\n using imageI[of \"Var y\" \"subterms ty\" \"\\x. x \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n var_is_subterm[OF ty(2)] subterms_subst_subset[of \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\ \\\\<^sub>s \\\" ty]\n subst_subst_compose[of ty \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \\] y_n\n by (auto simp del: subst_subst_compose)\n hence \"Fun n [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using ty(1) private_fun_deduct_in_ik[of _ _ n \"[]\"] n(2,3) ts_deduct\n unfolding is_Val_def is_Abs_def list_all_iff by fast\n hence \"Fun n [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ (\\z \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\). \\ z = Fun n [])\"\n using const_subterm_subst_cases[of n _ \\] \\_ik_\\_vals by fastforce\n thus ?thesis\n using \\_wt n(2) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def is_Val_def is_Abs_def by force\n qed\n thus ?thesis\n using fv_ik_subset_fv_sst' ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset[of \"unlabel \\\"] \\_subterms_subst_cong\n by fast\n next\n assume y_in: \"y \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T) \\\n (\\t s. select\\t,s\\ \\ set (unlabel (transaction_checks T)) \\ y \\ fv t \\ fv s)\"\n then obtain s where s: \"select\\Var y,Fun (Set s) []\\ \\ set (unlabel (transaction_checks T))\"\n using admissible_transaction_strand_step_cases(2)[OF T_adm] by force\n hence \"select\\(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y, Fun (Set s) []\\ \\\n set (unlabel (transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n using subst_lsst_unlabel_member\n by fastforce\n hence n_in_db: \"(Fun n [], Fun (Set s) []) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\) \\ [])\"\n using wellformed_transaction_sem_pos_checks[\n OF T_wf, of \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" \"set (db\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\)\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \\\n assign \"(\\ \\\\<^sub>s \\ \\\\<^sub>s \\) y\" \"Fun (Set s) []\"]\n \\_is_T_model n y_x\n unfolding T'_def db\\<^sub>s\\<^sub>s\\<^sub>t_def\n by fastforce\n\n obtain tn sn where tsn: \"insert\\tn,sn\\ \\ set (unlabel \\)\" \"Fun n [] = tn \\ \\\"\n using db\\<^sub>s\\<^sub>s\\<^sub>t_in_cases[OF n_in_db] by force\n\n have \"Fun n [] = tn \\ (\\z. \\\\<^sub>v z = TAtom Value \\ tn = Var z)\"\n using \\_wt tsn(2) n(2) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def is_Val_def is_Abs_def by (cases tn) auto\n moreover have \"tn \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"fv tn \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\n using tsn(1) in_subterms_Union by force+\n ultimately show ?thesis using tsn(2) by auto\n qed\n\n from n_cases show ?thesis\n proof\n assume \"\\z \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\. \\\\<^sub>v z = TAtom Value \\ \\ z = Fun n []\"\n then obtain B where B: \"prefix B \\\" \"Fun n [] \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B)\"\n by (metis IH n(1))\n thus ?thesis\n using n x_nin_\\ trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_prefix_subset(1)[of B]\n by (metis (no_types, opaque_lifting) self_append_conv subset_iff subterms\\<^sub>s\\<^sub>e\\<^sub>t_mono prefix_def)\n qed (use n x_nin_\\ in fastforce)\n qed\n\n have \"?P (\\@T')\"\n proof (intro ballI impI)\n fix x assume x: \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@T')\" \"\\\\<^sub>v x = TAtom Value\"\n show \"?Q x (\\@T')\"\n proof (cases \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\")\n case False\n hence \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\" using x(1) unlabel_append[of \\] fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\"] by simp\n then obtain B where B: \"prefix B \\\" \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B\" \"\\ x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B)\"\n using x(2) 1 by moura\n thus ?thesis using prefix_prefix by fast\n qed (use x(2) IH prefix_prefix in fast)\n qed\n thus ?case unfolding T'_def by blast\nqed simp\n\nlemma constraint_model_Val_const_in_constr_prefix:\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n and n: \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n shows \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\nproof -\n have *: \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\"\n \"constr_sem_stateful \\ (unlabel \\)\"\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using reachable_constraints_wf(1)[OF P(1) _ \\_reach]\n admissible_transaction_terms_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s \\ P(2) n\n unfolding welltyped_constraint_model_def constraint_model_def wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_code by fast+\n\n show ?thesis\n using constraint_model_priv_const_in_constr_prefix[OF * _ _ n]\n by simp\nqed\n\nlemma constraint_model_Val_const_in_constr_prefix':\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and n: \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n shows \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"\nusing constraint_model_Val_const_in_constr_prefix[OF \\_reach \\ _ _ n]\n P admissible_transaction_is_wellformed_transaction(1,4)\nby fast\n\nlemma constraint_model_Value_in_constr_prefix_fresh_action':\n fixes P::\"('fun, 'atom, 'sets, 'lbl) prot_transaction list\"\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. transaction_decl T () = []\"\n \"\\T \\ set P. bvars_transaction T = {}\"\n and n: \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n obtains B T \\ \\ \\ where \"prefix (B@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) A\"\n and \"B \\ reachable_constraints P\" \"T \\ set P\" \"transaction_decl_subst \\ T\"\n \"transaction_fresh_subst \\ T B\" \"transaction_renaming_subst \\ P B\"\n and \"Fun (Val n) [] \\ subst_range \\\"\nproof -\n define f where \"f \\\n \\(T::('fun, 'atom, 'sets, 'lbl) prot_transaction,\n \\::('fun, 'atom, 'sets, 'lbl) prot_subst,\n \\::('fun, 'atom, 'sets, 'lbl) prot_subst,\n \\::('fun, 'atom, 'sets, 'lbl) prot_subst).\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n define g where \"g \\ concat \\ map f\"\n\n obtain Ts where Ts:\n \"A = g Ts\" \"\\B. prefix B Ts \\ g B \\ reachable_constraints P\"\n \"\\B T \\ \\ \\. prefix (B@[(T,\\,\\,\\)]) Ts \\\n T \\ set P \\ transaction_decl_subst \\ T \\\n transaction_fresh_subst \\ T (g B) \\ transaction_renaming_subst \\ P (g B)\"\n using reachable_constraints_as_transaction_lists[OF A] unfolding g_def f_def by blast\n\n obtain T \\ \\ \\ where T:\n \"(T, \\, \\, \\) \\ set Ts\" \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using n trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq unlabel_subst\n unfolding Ts(1) g_def f_def unlabel_def trms\\<^sub>s\\<^sub>s\\<^sub>t_def\n by fastforce\n \n obtain B where B:\n \"prefix (B@[(T, \\, \\, \\)]) Ts\" \"g B \\ reachable_constraints P\" \"T \\ set P\"\n \"transaction_decl_subst \\ T\" \"transaction_fresh_subst \\ T (g B)\"\n \"transaction_renaming_subst \\ P (g B)\"\n proof -\n obtain B where \"\\C. B@(T, \\, \\, \\)#C = Ts\" by (metis T(1) split_list)\n thus ?thesis using Ts(2-) that[of B] by auto\n qed\n\n note T_adm_terms = bspec[OF P(1) B(3)]\n note T_decl_empty = bspec[OF P(2) B(3)]\n note T_no_bvars = bspec[OF P(3) B(3)]\n note \\_empty = admissible_transaction_decl_subst_empty'[OF T_decl_empty B(4)]\n\n have \"trms\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) = trms_transaction T \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_subst[of _ \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] T_no_bvars by blast\n hence \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms_transaction T \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n by (metis T(2) unlabel_subst)\n hence \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using admissible_transaction_terms_no_Value_consts(1)[OF T_adm_terms]\n const_subterms_subst_cases'[of \"Val n\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\" \"trms_transaction T\"]\n by blast\n then obtain tn where tn: \"tn \\ subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" \"Fun (Val n) [] \\ tn\" \"is_Fun tn\"\n by fastforce\n\n have \"Fun (Val n) [] \\ subst_range \\\"\n using tn(1-) transaction_decl_fresh_renaming_substs_range'(2,4)[OF B(4-6) tn(1) \\_empty]\n by fastforce\n moreover have \"prefix (g B@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) A\"\n using Ts(1) B(1) unfolding g_def f_def prefix_def by fastforce\n ultimately show thesis using that B(2-) by blast\nqed\n\nlemma constraint_model_Value_in_constr_prefix_fresh_action:\n fixes P::\"('fun, 'atom, 'sets, 'lbl) prot_transaction list\"\n assumes A: \"A \\ reachable_constraints P\"\n and P_adm: \"\\T \\ set P. admissible_transaction T\"\n and n: \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n obtains B T \\ \\ \\ where \"prefix (B@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) A\"\n and \"B \\ reachable_constraints P\" \"T \\ set P\" \"transaction_decl_subst \\ T\"\n \"transaction_fresh_subst \\ T B\" \"transaction_renaming_subst \\ P B\"\n and \"Fun (Val n) [] \\ subst_range \\\"\nproof -\n have P: \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. transaction_decl T () = []\"\n \"\\T \\ set P. bvars_transaction T = {}\"\n using P_adm admissible_transactionE(1) admissible_transaction_no_bvars(2)\n admissible_transaction_is_wellformed_transaction(4)\n by (blast,blast,blast)\n\n show ?thesis using that constraint_model_Value_in_constr_prefix_fresh_action'[OF A P n] by blast\nqed\n\nlemma reachable_constraints_occurs_fact_ik_case':\n fixes A::\"('fun,'atom,'sets,'lbl) prot_constr\"\n assumes \\_reach: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and val: \"Fun (Val n) [] \\\\<^sub>s\\<^sub>e\\<^sub>t trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n shows \"occurs (Fun (Val n) []) \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\nproof -\n obtain B T \\ \\ \\ where B:\n \"prefix (B@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)) A\"\n \"B \\ reachable_constraints P\"\n \"T \\ set P\"\n \"transaction_decl_subst \\ T\"\n \"transaction_fresh_subst \\ T B\"\n \"transaction_renaming_subst \\ P B\"\n \"Fun (Val n) [] \\ subst_range \\\"\n using constraint_model_Value_in_constr_prefix_fresh_action[OF \\_reach P val]\n by blast\n\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n have T_adm: \"admissible_transaction T\" using P B(3) by blast\n hence T_wf: \"wellformed_transaction T\" \"admissible_transaction_occurs_checks T\"\n using admissible_transaction_is_wellformed_transaction(1,5) by (blast,blast)\n\n obtain x where x: \"x \\ set (transaction_fresh T)\" \"\\ x = Fun (Val n) []\"\n using transaction_fresh_subst_domain[OF B(5)] B(7)\n admissible_transaction_decl_subst_empty[OF T_adm B(4)]\n by (force simp add: subst_compose \\_def)\n\n obtain ts where ts: \"send\\ts\\ \\ set (unlabel (transaction_send T))\" \"occurs (Var x) \\ set ts\"\n using admissible_transaction_occurs_checksE2[OF T_wf(2) x(1)]\n by (metis (mono_tags, lifting) list.set_intros(1) unlabel_Cons(1))\n\n have \"occurs (Var x) \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T)\"\n using ts by force\n hence \"occurs (Var x) \\ \\ \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using dual_transaction_ik_is_transaction_send'[OF T_wf(1), of \\] by fast\n hence \"occurs (Fun (Val n) []) \\ ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using x(2) by simp\n thus ?thesis\n using B(1)[unfolded \\_def[symmetric]]\n unlabel_append[of B \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"]\n ik\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel B\" \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"]\n unfolding prefix_def by force\nqed\n\nlemma admissible_transaction_occurs_checks_prop:\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and f: \"f \\ \\(funs_term ` (\\ ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n shows \"\\is_PubConstValue f\"\n and \"\\is_Abs f\"\nproof -\n obtain x where x: \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\" \"f \\ funs_term (\\ x)\" using f by moura\n obtain T where T: \"Fun f T \\ \\ x\" using funs_term_Fun_subterm[OF x(2)] by moura\n\n have \\_interp: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n by (metis \\ welltyped_constraint_model_def constraint_model_def,\n metis \\ welltyped_constraint_model_def,\n metis \\ welltyped_constraint_model_def constraint_model_def)\n\n note 0 = x(1) reachable_constraints_vars_TAtom_typed[OF \\_reach P, of x] \n vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel \\\"]\n\n have 1: \"\\ (Var x) = \\ (\\ x)\" using wt_subst_trm''[OF \\_wt, of \"Var x\"] by simp\n hence \"\\a. \\ (\\ x) = Var a\" using 0 by force\n hence \"\\f. \\ x = Fun f []\"\n using x(1) wf_trm_subst[OF \\_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s, of \"Var x\"] wf_trm_Var[of x] const_type_inv_wf\n empty_fv_exists_fun[OF interpretation_grounds[OF \\_interp], of \"Var x\"] \n by (metis subst_apply_term.simps(1)[of x \\])\n hence 2: \"\\ x = Fun f []\" using x(2) by force\n\n have 3: \"\\\\<^sub>v x \\ TAtom AbsValue\" using 0 by force\n\n have \"\\is_PubConstValue f \\ \\is_Abs f\"\n proof (cases \"\\\\<^sub>v x = TAtom Value\")\n case True\n then obtain B where B: \"prefix B \\\" \"x \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B\" \"\\ x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B)\"\n using constraint_model_Value_var_in_constr_prefix[OF \\_reach \\ P] x(1)\n by fast\n \n have \"\\ x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using B(1,3) trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel B\"] unlabel_append[of B]\n unfolding prefix_def by auto\n hence \"f \\ \\(funs_term ` trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using x(2) funs_term_subterms_eq(2)[of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"] by blast\n thus ?thesis\n using reachable_constraints_val_funs_private[OF \\_reach P]\n by blast+\n next\n case False thus ?thesis using x 1 2 3 unfolding is_PubConstValue_def by (cases f) auto\n qed\n thus \"\\is_PubConstValue f\" \"\\is_Abs f\" by metis+\nqed\n\nlemma admissible_transaction_occurs_checks_prop':\n assumes \\_reach: \"\\ \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and f: \"f \\ \\(funs_term ` (\\ ` fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n shows \"\\n. f = PubConst Value n\"\n and \"\\n. f = Abs n\"\nusing admissible_transaction_occurs_checks_prop[OF \\_reach \\ P f]\nunfolding is_PubConstValue_def by auto\n\nlemma transaction_var_becomes_Val:\n assumes \\_reach: \"\\@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\) \\ reachable_constraints P\"\n and \\: \"welltyped_constraint_model \\ (\\@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n and \\: \"transaction_decl_subst \\ T\"\n and \\: \"transaction_fresh_subst \\ T \\\"\n and \\: \"transaction_renaming_subst \\ P \\\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and T: \"T \\ set P\"\n and x: \"x \\ fv_transaction T\" \"fst x = TAtom Value\"\n shows \"\\n. Fun (Val n) [] = (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x \\ \\\"\nproof -\n obtain m where m: \"x = (TAtom Value, m)\" by (metis x(2) eq_fst_iff)\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF bspec[OF P T] \\]\n\n have x_not_bvar: \"x \\ bvars_transaction T\" \"fv ((\\ \\\\<^sub>s \\ \\\\<^sub>s \\) x) \\ bvars_transaction T = {}\"\n using x(1) admissible_transactions_fv_bvars_disj[OF P] T\n transaction_decl_fresh_renaming_substs_vars_disj(2)[OF \\ \\ \\, of x]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t[of \"unlabel (transaction_strand T)\"]\n by (blast, blast)\n\n have \\x_type: \"\\ (\\ x) = TAtom Value\"\n using \\ x \\\\<^sub>v_TAtom''(2)[of x] wt_subst_trm''[of \\ \"Var x\"]\n unfolding transaction_fresh_subst_def by simp\n\n show ?thesis\n proof (cases \"x \\ subst_domain \\\")\n case True\n then obtain c where c: \"\\ x = Fun c []\" \"\\public c\" \"arity c = 0\"\n using \\ unfolding transaction_fresh_subst_def by fastforce\n then obtain n where n: \"c = Val n\" using \\x_type by (cases c) (auto split: option.splits)\n show ?thesis using c n subst_compose[of \\ \\ x] \\_empty by simp\n next\n case False\n hence \"\\ x = Var x\" by auto\n then obtain n where n: \"(\\ \\\\<^sub>s \\) x = Var (TAtom Value, n)\"\n using m transaction_renaming_subst_is_renaming(1)[OF \\] subst_compose[of \\ \\ x]\n by force\n hence \"(TAtom Value, n) \\ fv\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using x_not_bvar fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_fv_subset[OF x(1), of \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] \\_empty\n by force\n hence \"\\n'. \\ (TAtom Value, n) = Fun (Val n') []\"\n using constraint_model_Value_term_is_Val'[OF \\_reach \\ P, of n] x\n fv\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n fv\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\"] unlabel_append[of \\]\n by fastforce\n thus ?thesis using n \\_empty by simp\n qed\nqed\n\nlemma reachable_constraints_SMP_subset:\n assumes \\: \"\\ \\ reachable_constraints P\"\n shows \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ SMP (\\T \\ set P. trms_transaction T)\" (is \"?A \\\")\n and \"SMP (pair`setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)) \\ SMP (\\T\\set P. pair`setops_transaction T)\" (is \"?B \\\")\nproof -\n have \"?A \\ \\ ?B \\\" using \\\n proof (induction \\ rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define T' where \"T' \\ transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n define M where \"M \\ \\T \\ set P. trms_transaction T\"\n define N where \"N \\ \\T \\ set P. pair ` setops_transaction T\"\n \n let ?P = \"\\t. \\s \\. s \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\n let ?Q = \"\\t. \\s \\. s \\ N \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\n \n have IH: \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A) \\ SMP M\" \"SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)) \\ SMP N\"\n using step.IH by (metis M_def, metis N_def)\n \n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n note \\\\\\_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n\n have 0: \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')) = SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A) \\ SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n \"SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'))) =\n SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)) \\ SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel T'))\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of T']\n setops\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of T']\n trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\" \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"]\n setops\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\" \"unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"]\n unlabel_append[of A \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\"]\n image_Un[of pair \"setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\" \"setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel T')\"]\n SMP_union[of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\" \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\"]\n SMP_union[of \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\" \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel T')\"]\n by argo+\n \n have 1: \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T') \\ SMP M\"\n proof (intro SMP_subset_I ballI)\n fix t show \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T' \\ ?P t\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t_wt_subst_ex[OF \\\\\\_wt \\\\\\_wf, of t \"unlabel (transaction_strand T)\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] step.hyps(2)\n unfolding T'_def M_def by auto\n qed\n \n have 2: \"SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel T')) \\ SMP N\"\n proof (intro SMP_subset_I ballI)\n fix t show \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel T') \\ ?Q t\"\n using setops\\<^sub>s\\<^sub>s\\<^sub>t_wt_subst_ex[OF \\\\\\_wt \\\\\\_wf, of t \"unlabel (transaction_strand T)\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"] step.hyps(2)\n unfolding T'_def N_def by auto\n qed\n \n have \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')) \\ SMP M\"\n \"SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'))) \\ SMP N\"\n using 0 1 2 IH by blast+\n thus ?case unfolding T'_def M_def N_def by blast\n qed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus \"?A \\\" \"?B \\\" by metis+\nqed\n\nlemma reachable_constraints_no_Pair_fun':\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. \\x \\ set (transaction_fresh T). \\\\<^sub>v x = TAtom Value\"\n \"\\T \\ set P. transaction_decl T () = []\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n \"\\T \\ set P. \\x \\ vars_transaction T. \\\\<^sub>v x = TAtom Value \\ (\\a. \\\\<^sub>v x = \\a\\\\<^sub>\\\\<^sub>a)\"\n shows \"Pair \\ \\(funs_term ` SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A))\"\nusing A\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n note T_fresh_type = bspec[OF P(1) step.hyps(2)]\n\n note \\_empty =\n admissible_transaction_decl_subst_empty'[OF bspec[OF P(2) step.hyps(2)] step.hyps(3)]\n\n note T_adm_terms = bspec[OF P(3) step.hyps(2)]\n\n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n note \\\\\\_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n\n have 0: \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T')) = SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A) \\ SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n using SMP_union[of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\" \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\"]\n unlabel_append[of A T'] trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\" \"unlabel T'\"]\n by simp\n\n have 1: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\"\n using reachable_constraints_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s[OF _ reachable_constraints.step[OF step.hyps]]\n admissible_transaction_terms_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s P(3)\n trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel A\"] unlabel_append[of A]\n unfolding T'_def by force\n\n have 2: \"Pair \\ \\(funs_term ` (subst_range (\\ \\\\<^sub>s \\ \\\\<^sub>s \\)))\"\n using transaction_decl_fresh_renaming_substs_range'(3)[\n OF step.hyps(3-5) _ \\_empty T_fresh_type]\n by force\n\n have \"Pair \\ \\(funs_term ` (trms_transaction T))\"\n using T_adm_terms unfolding admissible_transaction_terms_def by blast\n hence \"Pair \\ funs_term t\"\n when t: \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" for t\n using 2 trms\\<^sub>s\\<^sub>s\\<^sub>t_funs_term_cases[OF t]\n by force\n hence 3: \"Pair \\ funs_term t\" when t: \"t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\" for t\n using t unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n trms\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unfolding T'_def by metis\n\n have \"\\a. \\\\<^sub>v x = TAtom a\" when \"x \\ vars_transaction T\" for x\n using that protocol_transaction_vars_TAtom_typed(1) bspec[OF P(4) step.hyps(2)]\n by fast\n hence \"\\a. \\\\<^sub>v x = TAtom a\" when \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" for x\n using wt_subst_fv\\<^sub>s\\<^sub>e\\<^sub>t_termtype_subterm[OF _ \\\\\\_wt \\\\\\_wf, of x \"vars_transaction T\"]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_subst_cases[OF that]\n by fastforce\n hence \"\\a. \\\\<^sub>v x = TAtom a\" when \"x \\ vars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T'\" for x\n using that unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n vars\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unfolding T'_def\n by simp\n hence \"\\a. \\\\<^sub>v x = TAtom a\" when \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\" for x\n using that fv_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset(1) by fast\n hence \"Pair \\ funs_term (\\ (Var x))\" when \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\" for x\n using that by fastforce\n moreover have \"Pair \\ funs_term s\"\n when s: \"Ana s = (K, M)\" \"Pair \\ \\(funs_term ` set K)\"\n for s::\"('fun,'atom,'sets,'lbl) prot_term\" and K M\n proof (cases s)\n case (Fun f S) thus ?thesis using s Ana_Fu_keys_not_pairs[of _ S K M] by (cases f) force+\n qed (use s in simp)\n ultimately have \"Pair \\ funs_term t\" when t: \"t \\ SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t T')\" for t\n using t 3 SMP_funs_term[OF t _ _ 1, of Pair] funs_term_type_iff by fastforce\n thus ?case using 0 step.IH(1) unfolding T'_def by blast\nqed simp\n\nlemma reachable_constraints_no_Pair_fun:\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"Pair \\ \\(funs_term ` SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A))\"\nusing reachable_constraints_no_Pair_fun'[OF A]\n P admissible_transactionE(1,2,3)\n admissible_transaction_is_wellformed_transaction(4)\nby blast\n\nlemma reachable_constraints_setops_form:\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and t: \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\"\n shows \"\\c s. t = pair (c, Fun (Set s) []) \\ \\ c = TAtom Value\"\nusing A t\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\) \n\n have T_adm: \"admissible_transaction T\" when \"T \\ set P\" for T\n using P that unfolding list_all_iff by simp\n\n note T_adm' = admissible_transaction_is_wellformed_transaction(2,3)[OF T_adm]\n note T_wf = admissible_transaction_is_wellformed_transaction(1)[OF T_adm]\n\n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n note \\\\\\_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n \n show ?case using step.IH\n proof (cases \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\")\n case False\n hence \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T) \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n using step.prems setops\\<^sub>s\\<^sub>s\\<^sub>t_append unlabel_append\n setops\\<^sub>s\\<^sub>s\\<^sub>t_unlabel_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_eq[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n by fastforce\n then obtain t' \\ where t':\n \"t' \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (transaction_strand T))\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t = t' \\ \\\"\n using setops\\<^sub>s\\<^sub>s\\<^sub>t_wt_subst_ex[OF \\\\\\_wt \\\\\\_wf] by blast\n then obtain s s' where s: \"t' = pair (s,s')\"\n using setops\\<^sub>s\\<^sub>s\\<^sub>t_are_pairs by fastforce\n moreover have \"InSet ac s s' = InSet Assign s s' \\ InSet ac s s' = InSet Check s s'\" for ac\n by (cases ac) simp_all\n ultimately have \"\\n. s = Var (Var Value, n)\" \"\\u. s' = Fun (Set u) []\"\n using t'(1) setops\\<^sub>s\\<^sub>s\\<^sub>t_member_iff[of s s' \"unlabel (transaction_strand T)\"]\n pair_in_pair_image_iff[of s s']\n transaction_inserts_are_Value_vars[\n OF T_wf[OF step.hyps(2)] T_adm'(2)[OF step.hyps(2)], of s s']\n transaction_deletes_are_Value_vars[\n OF T_wf[OF step.hyps(2)] T_adm'(2)[OF step.hyps(2)], of s s']\n transaction_selects_are_Value_vars[\n OF T_wf[OF step.hyps(2)] T_adm'(1)[OF step.hyps(2)], of s s']\n transaction_inset_checks_are_Value_vars[\n OF T_adm[OF step.hyps(2)], of s s']\n transaction_notinset_checks_are_Value_vars[\n OF T_adm[OF step.hyps(2)], of _ _ _ s s']\n by metis+\n then obtain ss n where ss: \"t = pair (\\ (Var Value, n), Fun (Set ss) [])\"\n using t'(4) s unfolding pair_def by force\n\n have \"\\ (\\ (Var Value, n)) = TAtom Value\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ (Var Value, n))\"\n using t'(2) wt_subst_trm''[OF t'(2), of \"Var (Var Value, n)\"] apply simp\n using t'(3) by (cases \"(Var Value, n) \\ subst_domain \\\") auto\n thus ?thesis using ss by blast\n qed simp\nqed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma reachable_constraints_setops_type:\n fixes t::\"('fun,'atom,'sets,'lbl) prot_term\"\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n and t: \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\"\n shows \"\\ t = TComp Pair [TAtom Value, TAtom SetType]\"\nproof -\n obtain s c where s: \"t = pair (c, Fun (Set s) [])\" \"\\ c = TAtom Value\"\n using reachable_constraints_setops_form[OF A P t] by moura\n hence \"(Fun (Set s) []::('fun,'atom,'sets,'lbl) prot_term) \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\"\n using t setops\\<^sub>s\\<^sub>s\\<^sub>t_member_iff[of c \"Fun (Set s) []\" \"unlabel A\"]\n by force\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun (Set s) []::('fun,'atom,'sets,'lbl) prot_term)\"\n using reachable_constraints_wf(2) P A admissible_transaction_is_wellformed_transaction(1,4)\n unfolding admissible_transaction_terms_def by blast\n hence \"arity (Set s) = 0\" unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by simp\n thus ?thesis using s unfolding pair_def by fastforce\nqed\n\nlemma reachable_constraints_setops_same_type_if_unifiable:\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"\\s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A). \\t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A).\n (\\\\. Unifier \\ s t) \\ \\ s = \\ t\"\n (is \"?P A\")\nusing reachable_constraints_setops_type[OF A P] by simp\n\nlemma reachable_constraints_setops_unfiable_if_wt_instance_unifiable:\n assumes A: \"A \\ reachable_constraints P\"\n and P: \"\\T \\ set P. admissible_transaction T\"\n shows \"\\s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A). \\t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A).\n (\\\\ \\ \\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\\n Unifier \\ (s \\ \\) (t \\ \\))\n \\ (\\\\. Unifier \\ s t)\"\nproof (intro ballI impI)\n fix s t assume st: \"s \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\" \"t \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel A)\" and\n \"\\\\ \\ \\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\\n Unifier \\ (s \\ \\) (t \\ \\)\"\n then obtain \\ \\ \\ where \\:\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"Unifier \\ (s \\ \\) (t \\ \\)\"\n by moura\n\n obtain fs ft cs ct where c:\n \"s = pair (cs, Fun (Set fs) [])\" \"t = pair (ct, Fun (Set ft) [])\"\n \"\\ cs = TAtom Value\" \"\\ ct = TAtom Value\" \n using reachable_constraints_setops_form[OF A P st(1)]\n reachable_constraints_setops_form[OF A P st(2)]\n by moura\n\n have \"cs \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\" \"ct \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A)\"\n using c(1,2) setops_subterm_trms[OF st(1), of cs] setops_subterm_trms[OF st(2), of ct]\n Fun_param_is_subterm[of cs \"args s\"] Fun_param_is_subterm[of ct \"args t\"]\n unfolding pair_def by simp_all\n moreover have\n \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n using P admissible_transaction_is_wellformed_transaction(1,4)\n unfolding admissible_transaction_terms_def by fast+\n ultimately have *: \"wf\\<^sub>t\\<^sub>r\\<^sub>m cs\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m ct\"\n using reachable_constraints_wf(2)[OF _ _ A] wf_trms_subterms by blast+\n\n have \"(\\x. cs = Var x) \\ (\\c d. cs = Fun c [])\"\n using const_type_inv_wf c(3) *(1) by (cases cs) auto\n moreover have \"(\\x. ct = Var x) \\ (\\c d. ct = Fun c [])\"\n using const_type_inv_wf c(4) *(2) by (cases ct) auto\n ultimately show \"\\\\. Unifier \\ s t\"\n using reachable_constraints_setops_form[OF A P] reachable_constraints_setops_type[OF A P] st \\ c\n unfolding pair_def by auto\nqed\n\nlemma reachable_constraints_tfr:\n assumes M:\n \"M \\ \\T \\ set P. trms_transaction T\"\n \"has_all_wt_instances_of \\ M N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. admissible_transaction T\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n and \\: \"\\ \\ reachable_constraints P\"\n shows \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\"\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n have AT'_reach: \"A@T' \\ reachable_constraints P\"\n using reachable_constraints.step[OF step.hyps] unfolding T'_def by metis\n\n have T_adm: \"admissible_transaction T\" using step.hyps(2) P(1) by blast\n\n note \\_empty = admissible_transaction_decl_subst_empty[OF T_adm step.hyps(3)]\n\n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n note \\\\\\_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n\n have \\\\\\_bvars_disj: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\"\n using transaction_decl_fresh_renaming_substs_vars_disj(4)[OF step.hyps(3,4,5,2)]\n \\_empty\n by simp\n\n have wf_trms_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n using admissible_transactions_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s P(1)\n unfolding M(1) by blast\n\n have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T'))\"\n using reachable_constraints_SMP_subset(1)[OF AT'_reach]\n tfr_subset(3)[OF M(4), of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T')\"]\n SMP_SMP_subset[of M N] SMP_I'[OF wf_trms_M M(5,2)]\n unfolding M(1) by blast\n moreover have \"\\p. Ana (pair p) = ([],[])\" unfolding pair_def by auto\n ultimately have 1: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T') \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T')))\"\n using tfr_setops_if_tfr_trms[of \"unlabel (A@T')\"]\n reachable_constraints_no_Pair_fun[OF AT'_reach P(1)]\n reachable_constraints_setops_same_type_if_unifiable[OF AT'_reach P(1)]\n reachable_constraints_setops_unfiable_if_wt_instance_unifiable[OF AT'_reach P(1)]\n by blast\n\n have \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n using step.hyps(2) P(2) tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p\n unfolding comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t_def tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by fastforce\n hence \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel T')\"\n using tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_all_wt_subst_apply[OF _ \\\\\\_wt \\\\\\_wf \\\\\\_bvars_disj]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unfolding T'_def by argo\n hence 2: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (A@T'))\"\n using step.IH unlabel_append\n unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\n have \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T'))\" using 1 2 by (metis tfr\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?case by (metis T'_def)\nqed simp\n\nlemma reachable_constraints_tfr':\n assumes M:\n \"M \\ \\T \\ set P. trms_transaction T \\ pair' Pair ` setops_transaction T\"\n \"has_all_wt_instances_of \\ M N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n and \\: \"\\ \\ reachable_constraints P\"\n shows \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\"\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define T' where \"T' \\ dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n have AT'_reach: \"A@T' \\ reachable_constraints P\"\n using reachable_constraints.step[OF step.hyps] unfolding T'_def by metis\n\n note \\\\\\_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n note \\\\\\_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n\n have \\\\\\_bvars_disj: \"bvars\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T) \\ range_vars (\\ \\\\<^sub>s \\ \\\\<^sub>s \\) = {}\"\n by (rule transaction_decl_fresh_renaming_substs_vars_disj(4)[OF step.hyps(3,4,5,2)])\n\n have wf_trms_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n using P(1) setops\\<^sub>s\\<^sub>s\\<^sub>t_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s(2) unfolding M(1) pair_code wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_code[symmetric] by fast\n\n have \"SMP (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T')) \\ SMP M\" \"SMP (pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T'))) \\ SMP M\"\n using reachable_constraints_SMP_subset[OF AT'_reach]\n SMP_mono[of \"\\T \\ set P. trms_transaction T\" M]\n SMP_mono[of \"\\T \\ set P. pair ` setops_transaction T\" M]\n unfolding M(1) pair_code[symmetric] by blast+\n hence 1: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T') \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T')))\"\n using tfr_subset(3)[OF M(4), of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T') \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T'))\"]\n SMP_union[of \"trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@T')\" \"pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T'))\"]\n SMP_SMP_subset[of M N] SMP_I'[OF wf_trms_M M(5,2)]\n by blast\n\n have \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n using step.hyps(2) P(2) tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p\n unfolding comp_tfr\\<^sub>s\\<^sub>s\\<^sub>t_def tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by fastforce\n hence \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel T')\"\n using tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_all_wt_subst_apply[OF _ \\\\\\_wt \\\\\\_wf \\\\\\_bvars_disj]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p[of \"transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unlabel_subst[of \"transaction_strand T\" \"\\ \\\\<^sub>s \\ \\\\<^sub>s \\\"]\n unfolding T'_def by argo\n hence 2: \"list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (A@T'))\"\n using step.IH unlabel_append\n unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\n have \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (A@T'))\" using 1 2 by (metis tfr\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?case by (metis T'_def)\nqed simp\n\nlemma reachable_constraints_typing_cond\\<^sub>s\\<^sub>s\\<^sub>t:\n assumes M:\n \"M \\ \\T \\ set P. trms_transaction T \\ pair' Pair ` setops_transaction T\"\n \"has_all_wt_instances_of \\ M N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n and \\: \"\\ \\ reachable_constraints P\"\n shows \"typing_cond\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\"\nusing reachable_constraints_wf[OF P(1,2) \\] reachable_constraints_tfr'[OF M P(2,3) \\]\nunfolding typing_cond\\<^sub>s\\<^sub>s\\<^sub>t_def by blast\n\ncontext\nbegin\nprivate lemma reachable_constraints_typing_result_aux:\n assumes 0: \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (\\@[(l,send\\[attack\\n\\]\\)]))\" \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (\\@[(l,send\\[attack\\n\\]\\)]))\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@[(l,send\\[attack\\n\\]\\)]))\"\nproof -\n let ?n = \"[(l,send\\[attack\\n\\]\\)]\"\n let ?A = \"\\@?n\"\n\n show \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel ?A)\"\n using 0(1) wf\\<^sub>s\\<^sub>s\\<^sub>t_append_suffix'[of \"{}\" \"unlabel \\\" \"unlabel ?n\"] unlabel_append[of \\ ?n]\n by simp\n\n show \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?A)\"\n using 0(3) trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel ?n\"] unlabel_append[of \\ ?n]\n by fastforce\n\n have \"\\t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?n \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel ?n). \\c. t = Fun c []\"\n \"\\t \\ trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?n \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel ?n). Ana t = ([],[])\"\n by (simp_all add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\) \\\n (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t ?n \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel ?n)))\"\n using 0(2) tfr_consts_mono unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by blast\n hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (\\@?n) \\ pair ` setops\\<^sub>s\\<^sub>s\\<^sub>t (unlabel (\\@?n)))\"\n using unlabel_append[of \\ ?n] trms\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel ?n\"]\n setops\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"unlabel \\\" \"unlabel ?n\"]\n by (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel ?A)\"\n using 0(2) unlabel_append[of ?A ?n]\n unfolding tfr\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\nqed\n\nlemma reachable_constraints_typing_result:\n fixes P\n assumes M:\n \"has_all_wt_instances_of \\ (\\T \\ set P. trms_transaction T) N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. admissible_transaction T\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n and A: \"\\ \\ reachable_constraints P\"\n and \\: \"constraint_model \\ (\\@[(l, send\\[attack\\n\\]\\)])\"\n shows \"\\\\\\<^sub>\\. welltyped_constraint_model \\\\<^sub>\\ (\\@[(l, send\\[attack\\n\\]\\)])\"\nproof -\n have I:\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"constr_sem_stateful \\ (unlabel (\\@[(l, send\\[attack\\n\\]\\)]))\"\n using \\ unfolding constraint_model_def by metis+\n\n have \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. admissible_transaction_terms T\"\n using P(1,2) admissible_transaction_is_wellformed_transaction(1,4) by blast+\n moreover have \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n using P(1,2) admissible_transaction_is_wellformed_transaction(4)\n unfolding admissible_transaction_terms_def by blast\n ultimately have 0: \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using reachable_constraints_tfr[OF _ M P A] reachable_constraints_wf[OF _ _ A] by metis+\n\n show ?thesis\n using stateful_typing_result[OF reachable_constraints_typing_result_aux[OF 0] I(1,3)]\n by (metis welltyped_constraint_model_def constraint_model_def)\nqed\n\nlemma reachable_constraints_typing_result':\n fixes P\n assumes M:\n \"M \\ \\T \\ set P. trms_transaction T \\ pair' Pair ` setops_transaction T\"\n \"has_all_wt_instances_of \\ M N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n and A: \"\\ \\ reachable_constraints P\"\n and \\: \"constraint_model \\ (\\@[(l, send\\[attack\\n\\]\\)])\"\n shows \"\\\\\\<^sub>\\. welltyped_constraint_model \\\\<^sub>\\ (\\@[(l, send\\[attack\\n\\]\\)])\"\nproof -\n have I:\n \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"constr_sem_stateful \\ (unlabel (\\@[(l, send\\[attack\\n\\]\\)]))\"\n using \\ unfolding constraint_model_def by metis+\n\n have 0: \"wf\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"tfr\\<^sub>s\\<^sub>s\\<^sub>t (unlabel \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using reachable_constraints_tfr'[OF M P(2-3) A]\n reachable_constraints_wf[OF P(1,2) A]\n by metis+\n\n show ?thesis\n using stateful_typing_result[OF reachable_constraints_typing_result_aux[OF 0] I(1,3)]\n by (metis welltyped_constraint_model_def constraint_model_def)\nqed\nend\n\nlemma reachable_constraints_transaction_proj:\n assumes \"\\ \\ reachable_constraints P\"\n shows \"proj n \\ \\ reachable_constraints (map (transaction_proj n) P)\"\nusing assms\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\) show ?case\n using step.hyps(2) reachable_constraints.step[OF\n step.IH _ transaction_decl_subst_proj[OF step.hyps(3)]\n transaction_fresh_subst_proj[OF step.hyps(4)]\n transaction_renaming_subst_proj[OF step.hyps(5)]]\n by (simp add: proj_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t proj_subst transaction_strand_proj)\nqed (simp add: reachable_constraints.init)\n\ncontext\nbegin\nprivate lemma reachable_constraints_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_aux:\n fixes P\n defines \"Ts \\ concat (map transaction_strand P)\"\n assumes A: \"A \\ reachable_constraints P\"\n shows \"\\b \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A). \\a \\ set Ts. \\\\. b = a \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\n wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\\n (\\t \\ subst_range \\. (\\x. t = Var x) \\ (\\c. t = Fun c []))\"\n (is \"\\b \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A). \\a \\ set Ts. ?P b a\")\nusing A\nproof (induction A rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n define Q where \"Q \\ ?P\"\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n let ?R = \"\\A Ts. \\b \\ set A. \\a \\ set Ts. Q b a\"\n\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"\\t \\ subst_range \\. (\\x. t = Var x) \\ (\\c. t = Fun c [])\"\n using transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]\n transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]\n transaction_decl_fresh_renaming_substs_range'(1)[OF step.hyps(3-5)]\n unfolding \\_def by (metis,metis,fastforce)\n hence \"?R (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T)) \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\) (transaction_strand T)\"\n using dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_self_inverse[of \"transaction_strand T\"]\n by (auto simp add: Q_def subst_apply_labeled_stateful_strand_def)\n hence \"?R (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) (transaction_strand T)\"\n by (metis dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_subst)\n hence \"?R (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\))) Ts\"\n using step.hyps(2) unfolding Ts_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def by fastforce\n thus ?case using step.IH unfolding Q_def \\_def by auto\nqed simp\n\nlemma reachable_constraints_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t:\n fixes P\n defines \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and \"Ts \\ concat (map transaction_strand P)\"\n assumes P_pc: \"comp_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t public arity Ana \\ Pair Ts M S\"\n and A: \"A \\ reachable_constraints P\"\n shows \"par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A ((f S) - {m. intruder_synth {} m})\"\nusing par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_if_comp_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t'[OF P_pc, of \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t A\", THEN par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t]\n reachable_constraints_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_aux[OF A, unfolded Ts_def[symmetric]]\nunfolding f_def dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_self_inverse by fast\nend\n\nlemma reachable_constraints_par_comp_constr:\n fixes P f S\n defines \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and \"Ts \\ concat (map transaction_strand P)\"\n and \"Sec \\ f S - {m. intruder_synth {} m}\"\n and \"M \\ \\T \\ set P. trms_transaction T \\ pair' Pair ` setops_transaction T\"\n assumes M:\n \"has_all_wt_instances_of \\ M N\"\n \"finite N\"\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and P:\n \"\\T \\ set P. wellformed_transaction T\"\n \"\\T \\ set P. wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity (trms_transaction T)\"\n \"\\T \\ set P. list_all tfr\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (unlabel (transaction_strand T))\"\n \"comp_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t public arity Ana \\ Pair Ts M_fun S\" \n and \\: \"\\ \\ reachable_constraints P\"\n and \\: \"constraint_model \\ \\\"\n shows \"\\\\\\<^sub>\\. welltyped_constraint_model \\\\<^sub>\\ \\ \\\n ((\\n. welltyped_constraint_model \\\\<^sub>\\ (proj n \\)) \\\n (\\\\' l t. prefix \\' \\ \\ suffix [(l, receive\\t\\)] \\' \\ strand_leaks\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\' Sec \\\\<^sub>\\))\"\nproof -\n have \\': \"constr_sem_stateful \\ (unlabel \\)\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using \\ unfolding constraint_model_def by blast+\n\n show ?thesis\n using reachable_constraints_par_comp\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t[OF P(4)[unfolded Ts_def] \\]\n reachable_constraints_typing_cond\\<^sub>s\\<^sub>s\\<^sub>t[OF M_def M P(1-3) \\]\n par_comp_constr_stateful[OF _ _ \\', of Sec]\n unfolding f_def Sec_def welltyped_constraint_model_def constraint_model_def by blast\nqed\n\nlemma reachable_constraints_component_leaks_if_composed_leaks:\n fixes Sec Q\n defines \"leaks \\ \\\\. \\\\\\<^sub>\\ \\'.\n Q \\\\<^sub>\\ \\ prefix \\' \\ \\ (\\l' t. suffix [(l', receive\\t\\)] \\') \\ strand_leaks\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\' Sec \\\\<^sub>\\\"\n assumes Sec: \"\\s \\ Sec. \\{} \\\\<^sub>c s\" \"ground Sec\"\n and composed_leaks: \"\\\\ \\ reachable_constraints Ps. leaks \\\"\n shows \"\\l. \\\\ \\ reachable_constraints (map (transaction_proj l) Ps). leaks \\\"\nproof -\n from composed_leaks obtain \\ \\\\<^sub>\\ \\' s n where\n \\: \"\\ \\ reachable_constraints Ps\" and\n \\': \"prefix \\' \\\" \"constr_sem_stateful \\\\<^sub>\\ (proj_unl n \\'@[send\\[s]\\])\" and\n \\\\<^sub>\\: \"Q \\\\<^sub>\\\" and\n s: \"s \\ Sec - declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\' \\\\<^sub>\\\"\n unfolding leaks_def strand_leaks\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def by fast\n\n have \"\\{} \\\\<^sub>c s\" \"s \\ \\\\<^sub>\\ = s\" using s Sec by auto\n then obtain B k' u where\n \"constr_sem_stateful \\\\<^sub>\\ (proj_unl n B@[send\\[s]\\])\"\n \"prefix (proj n B) (proj n \\)\" \"suffix [(k', receive\\u\\)] (proj n B)\"\n \"s \\ Sec - declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (proj n B) \\\\<^sub>\\\"\n using constr_sem_stateful_proj_priv_term_prefix_obtain[OF \\' s]\n unfolding welltyped_constraint_model_def constraint_model_def by metis\n thus ?thesis\n using \\\\<^sub>\\ reachable_constraints_transaction_proj[OF \\, of n] proj_idem[of n B]\n unfolding leaks_def strand_leaks\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def\n by metis\nqed\n\nlemma reachable_constraints_preserves_labels:\n assumes \\: \"\\ \\ reachable_constraints P\"\n shows \"\\a \\ set \\. \\T \\ set P. \\b \\ set (transaction_strand T). fst b = fst a\"\n (is \"\\a \\ set \\. \\T \\ set P. ?P T a\")\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n have \"\\a \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)). ?P T a\"\n proof\n fix a assume a: \"a \\ set (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\))\"\n then obtain b where b: \"b \\ set (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\" \"a = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b\"\n unfolding dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n then obtain c where c: \"c \\ set (transaction_strand T)\" \"b = c \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n unfolding subst_apply_labeled_stateful_strand_def by auto\n\n have \"?P T c\" using c(1) by blast\n hence \"?P T b\" using c(2) by (simp add: subst_lsstp_fst_eq)\n thus \"?P T a\" using b(2) dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_fst_eq[of b] by presburger\n qed\n thus ?case using step.IH step.hyps(2) by (metis Un_iff set_append)\nqed simp\n\nlemma reachable_constraints_preserves_labels':\n assumes P: \"\\T \\ set P. \\a \\ set (transaction_strand T). has_LabelN l a \\ has_LabelS a\"\n and \\: \"\\ \\ reachable_constraints P\"\n shows \"\\a \\ set \\. has_LabelN l a \\ has_LabelS a\"\nusing reachable_constraints_preserves_labels[OF \\] P by fastforce\n\nlemma reachable_constraints_transaction_proj_proj_eq:\n assumes \\: \"\\ \\ reachable_constraints (map (transaction_proj l) P)\"\n shows \"proj l \\ = \\\"\n and \"prefix \\' \\ \\ proj l \\' = \\'\"\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n let ?T = \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n note A = reachable_constraints.step[OF step.hyps]\n\n have P: \"\\T \\ set (map (transaction_proj l) P).\n \\a \\ set (transaction_strand T). has_LabelN l a \\ has_LabelS a\"\n using transaction_proj_labels[of l] unfolding list_all_iff by auto\n\n note * = reachable_constraints_preserves_labels'[OF P A]\n\n have **: \"\\a \\ set \\'. has_LabelN l a \\ has_LabelS a\"\n when \"\\a \\ set B. has_LabelN l a \\ has_LabelS a\" \"prefix \\' B\" for B\n using that assms unfolding prefix_def by auto\n\n note *** = proj_ident[unfolded list_all_iff]\n\n { case 1 thus ?case using *[THEN ***] by blast }\n { case 2 thus ?case using *[THEN **, THEN ***] by blast }\nqed (simp_all add: reachable_constraints.init)\n\nlemma reachable_constraints_transaction_proj_star_proj:\n assumes \\: \"\\ \\ reachable_constraints (map (transaction_proj l) P)\"\n and k_neq_l: \"k \\ l\"\n shows \"proj k \\ \\ reachable_constraints (map transaction_star_proj P)\"\nusing \\\nproof (induction \\ rule: reachable_constraints.induct)\n case (step \\ T \\ \\ \\)\n have \"map (transaction_proj k) (map (transaction_proj l) P) = map transaction_star_proj P\"\n using transaction_star_proj_negates_transaction_proj(2)[OF k_neq_l]\n by fastforce\n thus ?case\n using reachable_constraints_transaction_proj[OF reachable_constraints.step[OF step.hyps], of k]\n by argo\nqed (simp add: reachable_constraints.init)\n\nlemma reachable_constraints_aligned_prefix_ex:\n fixes P\n defines \"f \\ \\T.\n list_all is_Receive (unlabel (transaction_receive T)) \\\n list_all is_Check_or_Assignment (unlabel (transaction_checks T)) \\\n list_all is_Update (unlabel (transaction_updates T)) \\\n list_all is_Send (unlabel (transaction_send T))\"\n assumes P: \"list_all f P\" \"list_all ((list_all (Not \\ has_LabelS)) \\ tl \\ transaction_send) P\"\n and s: \"\\{} \\\\<^sub>c s\" \"fv s = {}\"\n and A: \"A \\ reachable_constraints P\" \"prefix B A\"\n and B: \"\\l ts. suffix [(l, receive\\ts\\)] B\"\n \"constr_sem_stateful \\ (unlabel B@[send\\[s]\\])\"\n shows \"\\C \\ reachable_constraints P.\n prefix C A \\ (\\l ts. suffix [(l, receive\\ts\\)] C) \\\n declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B \\ = declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t C \\ \\\n constr_sem_stateful \\ (unlabel C@[send\\[s]\\])\"\nusing A\nproof (induction A rule: reachable_constraints.induct)\n case (step A T \\ \\ \\)\n define \\ where \"\\ \\ \\ \\\\<^sub>s \\ \\\\<^sub>s \\\"\n\n let ?T = \"dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_strand T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ \\\\<^sub>s \\)\"\n\n note AT_reach = reachable_constraints.step[OF step.hyps]\n\n obtain lb tsb B' where B': \"B = B'@[(lb, receive\\tsb\\)]\" using B(1) unfolding suffix_def by blast\n\n define decl_ik where \"decl_ik \\ \\S::('fun,'atom,'sets,'lbl) prot_strand.\n \\{set ts |ts. \\\\, receive\\ts\\\\ \\ set S} \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n\n have decl_ik_append: \"decl_ik (M@N) = decl_ik M \\ decl_ik N\" for M N\n unfolding decl_ik_def by fastforce\n\n have decl_ik_star: \"decl_ik M = decl_ik (M@N)\" when \"\\ \\ fst ` set N\" for M N\n using that unfolding decl_ik_def\n by (smt Collect_cong Setcompr_eq_image UnCI UnE fst_conv mem_Collect_eq set_append) \n\n have decl_decl_ik: \"declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t S \\ = {t. decl_ik S \\ t}\" for S\n unfolding declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_alt_def decl_ik_def by blast\n\n have \"f T\" using P(1) step.hyps(2) by (simp add: list_all_iff)\n hence \"list_all is_Send (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"list_all is_Check_or_Assignment (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"list_all is_Update (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"list_all is_Receive (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n using subst_sst_list_all(2)[of \"unlabel (transaction_receive T)\" \\]\n subst_sst_list_all(11)[of \"unlabel (transaction_checks T)\" \\]\n subst_sst_list_all(10)[of \"unlabel (transaction_updates T)\" \\]\n subst_sst_list_all(1)[of \"unlabel (transaction_send T)\" \\]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_list_all(1)[of \"transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_list_all(11)[of \"transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_list_all(10)[of \"transaction_updates T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_list_all(2)[of \"transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\\"]\n unfolding f_def by (metis unlabel_subst[of _ \\])+\n hence \"\\list_ex is_Receive (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_receive T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"\\list_ex is_Receive (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_checks T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"\\list_ex is_Receive (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_updates T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n \"list_all is_Receive (unlabel (dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)))\"\n unfolding list_ex_iff list_all_iff by blast+\n then obtain TA TB where T:\n \"?T = TA@TB\" \"\\list_ex is_Receive (unlabel TA)\" \"list_all is_Receive (unlabel TB)\"\n \"TB = dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using transaction_dual_subst_unfold[of T \\] unfolding \\_def by fastforce\n\n have 0: \"prefix B (A@TA@TB)\" using step.prems B' T by argo\n\n have 1: \"prefix B A\" when \"prefix B (A@TA)\"\n using that T(2) B' prefix_prefix_inv\n unfolding list_ex_iff unlabel_def by fastforce\n \n have 2: \"\\ \\ fst ` set TB2\" when \"TB = TB1@(l,x)#TB2\" for TB1 l x TB2\n proof -\n have \"k \\ \\\" when \"k \\ set (map fst (tl (transaction_send T)))\" for k\n using that P(2) step.hyps(2) unfolding list_all_iff by auto\n hence \"k \\ \\\" when \"k \\ set (map fst (tl TB))\" for k\n using that subst_lsst_map_fst_eq[of \"tl (transaction_send T)\" \\]\n dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_map_fst_eq[of \"tl (transaction_send T \\\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t \\)\"]\n unfolding T(4) dual\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t_tl subst_lsst_tl by simp\n moreover have \"set TB2 \\ set (tl TB)\"\n using that\n by (metis (no_types, lifting) append_eq_append_conv2 order.eq_iff list.sel(3) self_append_conv\n set_mono_suffix suffix_appendI suffix_tl tl_append2)\n ultimately show ?thesis by auto\n qed\n\n have 3: \"declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t TB \\ = declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (TB1@[(l,x)]) \\\"\n when \"TB = TB1@(l,x)#TB2\" for TB1 l x TB2\n using decl_ik_star[OF 2[OF that], of \"TB1@[(l,x)]\"] unfolding that decl_decl_ik by simp\n\n show ?case\n proof (cases \"prefix B A\")\n case False\n hence 4: \"\\prefix B (A@TA)\" using 1 by blast\n\n have 5: \"\\l ts. suffix [(l, receive\\ts\\)] (A@?T)\"\n proof -\n have \"(lb, receive\\tsb\\) \\ set TB\"\n using 0 4 prefix_prefix_inv[OF _ suffixI[OF B'], of \"A@TA\" TB] by (metis append_assoc)\n hence \"receive\\tsb\\ \\ set (unlabel TB)\"\n unfolding unlabel_def by force\n hence \"\\ts. suffix [receive\\ts\\] (unlabel TB)\"\n using T(3) unfolding list_all_iff is_Receive_def suffix_def\n by (metis in_set_conv_decomp list.distinct(1) list.set_cases rev_exhaust)\n then obtain TB' ts where \"unlabel TB = TB'@[receive\\ts\\]\" unfolding suffix_def by blast\n then obtain TB'' x where \"TB = TB''@[x]\" \"snd x = receive\\ts\\\"\n by (smt unlabel_def Nil_is_map_conv map_eq_Cons_D map_eq_append_conv)\n then obtain l where \"suffix [(l, receive\\ts\\)] TB\"\n by (metis surj_pair prod.sel(2) suffix_def)\n thus ?thesis\n using T(4) transaction_dual_subst_unfold[of T \\]\n suffix_append[of \"[(l, receive\\ts\\)]\"]\n unfolding \\_def by metis\n qed\n\n obtain TB1 where TB:\n \"B = A@TA@TB1@[(lb, receive\\tsb\\)]\" \"prefix (TB1@[(lb, receive\\tsb\\)]) TB\"\n using 0 4 B' prefix_snoc_obtain[of B' \"(lb, receive\\tsb\\)\" \"A@TA\" TB thesis]\n by (metis append_assoc)\n then obtain TB2 where TB2: \"TB = TB1@(lb, receive\\tsb\\)#TB2\"\n unfolding prefix_def by fastforce\n hence TB2': \"list_all is_Receive (unlabel TB2)\"\n using T(3) unfolding list_all_iff is_Receive_def proj_def unlabel_def by auto\n\n have 6: \"constr_sem_stateful \\ (unlabel B)\" \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ s \\ \\\"\n using B(2) strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel B\" \"[send\\[s]\\]\" \\]\n by auto\n\n have \"constr_sem_stateful \\ (unlabel (A@TA@TB1@[(lb, receive\\tsb\\)]))\"\n using 6(1) TB(1) by blast\n hence \"constr_sem_stateful \\ (unlabel (A@?T))\"\n using T(1) TB2 strand_sem_receive_prepend_stateful[\n of \"{}\" \"{}\" \"unlabel (A@TA@TB1@[(lb, receive\\tsb\\)])\" \\,\n OF _ TB2']\n by auto\n moreover have \"set (unlabel B) \\ set (unlabel (A@?T))\"\n using step.prems(1) unfolding prefix_def by force\n hence \"ik\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@?T) \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ s \\ \\\"\n using ideduct_mono[OF 6(2)] subst_all_mono[of _ _ \\]\n ik\\<^sub>s\\<^sub>s\\<^sub>t_set_subset[of \"unlabel B\" \"unlabel (A@?T)\"]\n by meson\n ultimately have 7: \"constr_sem_stateful \\ (unlabel (A@?T)@[send\\[s]\\])\"\n using strand_sem_append_stateful[of \"{}\" \"{}\" \"unlabel (A@?T)\" \"[send\\[s]\\]\" \\]\n by auto\n\n have \"declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t B \\ = declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (A@?T) \\\"\n proof -\n have \"declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t TB \\ = declassified\\<^sub>l\\<^sub>s\\<^sub>s\\<^sub>t (TB1@[(lb, receive\\tsb\\)]) \\\"\n using 3[of _ lb \"receive\\tsb\\\"] TB(2) unfolding prefix_def by auto\n hence \"(decl_ik TB \\ t) \\ decl_ik (TB1@[(lb,receive\\tsb\\)]) \\ t\" for t\n unfolding TB(1) T(1) decl_decl_ik by blast\n hence \"(decl_ik (A@TA@TB) \\ t) \\ decl_ik (A@TA@TB1@[(lb,receive\\tsb\\)]) \\ t\" for t\n using ideduct_mono_eq[of \"decl_ik TB\" \"decl_ik (TB1@[(lb,receive\\tsb\\)])\" \"decl_ik (A@TA)\"]\n by (metis decl_ik_append[of \"A@TA\"] Un_commute[of _ \"decl_ik (A@TA)\"] append_assoc)\n thus ?thesis unfolding TB(1) T(1) decl_decl_ik by blast\n qed\n thus ?thesis using step.prems AT_reach B(1) 5 7 by force\n qed (use step.IH prefix_append in blast)\nqed (use B(1) suffix_def in simp)\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Automated_Stateful_Protocol_Verification/Stateful_Protocol_Model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.26352969228783424}} {"text": "theory RB_Relaxed_mike_v2 imports RCU_Lems \nbegin\n\ndatatype F = B | W | Q | R \ndatatype Pointer = Head | Tail\n\nconsts n :: nat (*size of buffer, input*)\nconsts N :: nat (*number of Arr\\<^sub>W entries*)\n\n(*(Wr T u t b \\)*)\n(*\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"ts = getTS \\ w\"\nshows \"\\ [x \\\\<^sub>t u] (write_trans t b w v \\ ts) \"\n sorry\n*)\n\n\nlemma pval_val_same:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n using assms\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var apply blast\n defer \n apply (simp add: getVWNC_var)\n apply (simp add: getVWNC_var)\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\nfix a :: nat and ba :: rat\n assume a1: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := (thrView \\ t) (var w := (var w, getTS \\ (getVWNC \\ t (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ t (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ t (var w))) := True)\\) (var w)\"\n assume a2: \"x = var w\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"ba \\ getTS \\ (getVWNC \\ t (var w))\"\n have f5: \"\\s n p. var p = n \\ p \\ surrey_state.writes (s::surrey_state) \\ p \\ writes_on s n\"\n using writes_on_def by force\n have \"\\s n p. writes_on (write_available_update p (s::surrey_state)) n = writes_on s n\"\n by (metis (no_types) surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(5) writes_on_def)\n then have f6: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (t := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), modView := (modView \\) ((x, getTS \\ (getVWNC \\ t x)) := (thrView \\ t) (x := (x, getTS \\ (getVWNC \\ t x)))), mods := (mods \\) ((x, getTS \\ (getVWNC \\ t x)) := \\val = v, is_releasing = b\\), writes := insert (x, getTS \\ (getVWNC \\ t x)) (surrey_state.writes \\)\\) x\"\n using a2 a1 by blast\n have f7: \"\\s f. surrey_state.writes (writes_update f (s::surrey_state)) = f (surrey_state.writes s)\"\n by auto\n have f8: \"var (a, ba) = x\"\n using f6 f5 by meson\n have \"(a, ba) \\ surrey_state.writes \\\"\n using f7 f6 f5 a4 a2 by (metis insert_iff snd_conv)\n then show False\n using f8 a3 writes_on_def by force\nqed\n\n\n\nlemma pval_val_other:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\n and \"t\\s\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v s b \\)\"\n using assms apply simp\n apply (simp add: p_obs_def visible_writes_def value_def write_trans_def)\n apply(simp add: rev_app_def update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply safe \n using w_in_writes_on_var\n apply (simp add: w_in_writes_on_var getVWNC_var) \n apply (simp add: getVWNC_var)\n\n apply(case_tac \"(a, ba)\n \\ writes_on \\ x\")\n apply (smt dual_order.strict_trans getTS_w_greater_tst_w getVWNC_in_visible_writes le_neq_trans less_le_not_le mem_Collect_eq visible_writes_def)\nproof -\n fix a :: nat and ba :: rat\n assume a1: \"ba \\ getTS \\ (getVWNC \\ s (var w))\"\n assume a2: \"(a, ba) \\ writes_on (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\) (var w)\"\n assume a3: \"(a, ba) \\ writes_on \\ x\"\n assume a4: \"x = var w\"\n have \"(a, ba) \\ \\\\var = var w \\ \\(\\) (surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\))\\\"\n using a2 writes_on_def by blast\n then have f5: \"var (a, ba) = var w \\ (a, ba) \\ surrey_state.writes (\\ \\thrView := (thrView \\) (s := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), modView := (modView \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := (thrView \\ s) (var w := (var w, getTS \\ (getVWNC \\ s (var w))))), mods := (mods \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := \\val = v, is_releasing = b\\), writes := insert (var w, getTS \\ (getVWNC \\ s (var w))) (surrey_state.writes \\), write_available := (write_available \\) ((var w, getTS \\ (getVWNC \\ s (var w))) := True)\\)\"\n by blast\n then have \"(a, ba) \\ surrey_state.writes \\\"\n using a4 a3 writes_on_def by fastforce\n then show False\n using f5 a1 by simp\nqed\n\n\n\nlemma pval_val:\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t' b \\)\"\n using assms apply (cases \"t=t'\")\n using pval_val_same apply blast\n using pval_val_other by blast\n\n\n\n\nlemma pval_val_outside:\n assumes \"wfs \\\"\n and \"N\\ \\\"\n and \"\\j.[x \\\\<^sub>t j] \\ \\ jk. k [x \\\\<^sub>t k] \\\"\n and \"u\\\\ \\ uz.(z>N\\\\[x \\\\<^sub>t z] (Wr x u t' b \\))\"\n using assms apply (cases \"t=t'\")\n apply (metis fst_conv not_less_iff_gr_or_eq pval_val)\n by (metis fst_conv not_less_iff_gr_or_eq pval_val)\n\n\nlemma pval_val_outside_2:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"[x =\\<^sub>t 0] \\\"\n and \"u \\ 0\"\nshows \"\\i.(([x =\\<^sub>t i] (Wr x u t b \\))\\([x =\\<^sub>t i] (Wr x 0 t' b \\)))\" \n using assms apply (cases \"t=t'\")\n using OpSem_ProofRules.ext_d_obs_d_obs apply blast\n using OpSem_ProofRules.ext_d_obs_d_obs by blast\n\n\nlemma pval_val_outside_3:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"[x =\\<^sub>t 0] \\\"\n and \"u \\ 0\"\n shows \"\\i.(([x =\\<^sub>t i] (Wr x u t b \\)\\ i\\0)\\(([x =\\<^sub>t i] (Wr x 0 t b \\))))\" \n using OpSem_ProofRules.ext_d_obs_d_obs assms(1) assms(3) by blast\n\nlemma pval_val_outside_4:\n assumes \"wfs \\\"\n and \"N \\ \\\"\n and \"[x =\\<^sub>t 0] \\\"\n shows \"\\i.(([x =\\<^sub>t i] (Wr x 3 t b \\)\\ i\\0)\\(([x =\\<^sub>t i] (Wr x 0 t b \\))))\\(i+1=1 \\ i+1=4)\" \n using add_cancel_left_left by blast\n\n\n(*\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t u] \\\"\n and \"u \\ v\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t u] (Wr x v t b \\)\"\n\n\nlemma pval_val_all: \n assumes \"wfs \\\"\n and \"\\i. i > k \\ \\ [x \\\\<^sub>t i] \\\"\n and \"k < j\" \n and \"u \\ k\"\n and \"var w = x\"\nshows \"\\ [x \\\\<^sub>t j] (Wr x v t b \\) \"\n using assms\n \n using pval_val sledgehammer\n*)\n\nconsts \n H :: L\n T :: L\n\n\nrecord LB =\n hW :: V (*local copy of W*)\n tW :: V (*local copy of W*)\n q :: \"(nat \\ nat) list\" (*for now assume well synchronised, need to think about weak memory *)\n tempR :: \"(nat \\ nat)\" (*local copy of word by R*)\n\n tloc :: V\n Data:: \"nat \\ nat\" (*returns a word Data_i*)\n countW :: nat (* the index of the next element of Data to be written *)\n countR :: nat (* how many words from Data the read has read or reading (i.e., retrieved) *)\n\n ownD :: \"nat \\ F\" (* ownership of data indices *)\n ownB :: \"nat \\ F\" (* ownership of bytes in buffer *)\n (* tries :: nat *)\n oom :: bool (*signals W that it was OOM*)\n \\ :: surrey_state\n\ndefinition \"global s \\ wfs s \\ H \\ T\"\n\n\n\n\nlemmas opsemsyntax [simp] = global_def\nlemmas defs_del [simp del] = Rd_def Let_def Wr_def Upd_def st_rd_def val_rd_def\n\n(* thread 2 is the writer *)\n(* thread 3 is the reader *)\n\n(* Omit tries *)\n(* Finish queueu + reader *)\n\n(* We need this one to hold at minimum *)\ndefinition \"arrayInv s \\ \\i. (i ownD s i = R)\\ (countR s \\ i \\ i < countW s \\ ownD s i = B) \\ (countW s \\ i \\ i < n \\ ownD s i = W) \"\n\n\ndefinition \"q_entries_bounded s \\ (\\i. i < length(q s) \\ (fst(q s!i)+snd(q s!i)\\N)\\snd(q s!i)>0)\"\ndefinition \"tempR_bounded s \\ fst (tempR s) + snd (tempR s) \\ N\"\ndefinition \"counter_q_rel s \\ (countW s-countR s=length(q s))\"\ndefinition \"con_assms s \\ 0 < N \\ 0 (countR s\\countW s) \\ (countW s\\n)\n \\ (\\i.(iData s i\\N \\ Data s i>0)\"\n(*new\n(typically)\n\\forall x . P(x) \\ Q(x)\n\\exists x . P(x) \\ Q(x)\n\n[H =\\<^sub>2 i] means thread 2 sees the last write to H and this has value i.\n[H \\\\<^sub>2 i] means that thread 2 can see the value i.\n*)\ndefinition \"bounded_pointers s \\ ((\\i. i > N \\ \\[H \\\\<^sub>2 i] (\\ s)))\\\n ((\\j. j > N \\ \\[T \\\\<^sub>2 j] (\\ s)))\"\n\ndefinition \"basic_pointer_movement s \\ 0\\hW s\\ hW s\\N \\ 0\\tW s\\ tW s\\N\"\n\n\n \n\n\ndefinition \"collection s \\ arrayInv s \\ q_entries_bounded s\n \\tempR_bounded s \\counter_q_rel s \\ con_assms s\n \\ bounded_pointers s \\ basic_pointer_movement s\"\n\n\ndefinition \"init s \\\n [T =\\<^sub>2 0] (\\ s) \\ [H =\\<^sub>2 0] (\\ s) \\ [T =\\<^sub>3 0] (\\ s) \\ (q s = []) \\ (hW s = 0) \\ (tW s = 0)\n \\ (\\l. (l ((Data s l > 0)\\(Data s l \\ N)))\n \\ (\\i. (i ownD s i = W)\n \\ (\\i. (i\\N) \\ ownB s i = B)\n \\ (countW s = 0) \\ (countR s = 0)\n \\ (tempR s = (0,0)) \\ \\ oom s \"\n\ndefinition \"grd1 s \\ (tW s = hW s) \\ (Data s (countW s) \\ N) \"\ndefinition \"grd2 s \\ (tW s > hW s) \\ (Data s (countW s) < (tW s - hW s)) \"\ndefinition \"grd3 s \\ tW s < hW s \"\ndefinition \"grd4 s \\ Data s (countW s) \\ N - hW s \"\ndefinition \"grd5 s \\ Data s (countW s) < tW s \"\ndefinition \"no_space_for_word s \\ (grd1 s \\ \\(Data s (countW s) \\ N))\\\n (grd2 s \\ \\(Data s (countW s) < (tW s - hW s)))\\\n (grd3 s \\ \\(Data s (countW s) \\ N - hW s \\ Data s (countW s) < tW s))\"\n\n\n\nlemmas main_invariant_lemmas = collection_def arrayInv_def q_entries_bounded_def \n counter_q_rel_def tempR_bounded_def con_assms_def\n init_def bounded_pointers_def basic_pointer_movement_def\n pval_val_same pval_val_other pval_val\nlemmas guards = grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def\n\n\nlemma LoadBuffering:\n \"\\- \\ global \\\\ \\ \\collection \\ \\init \\\nCOBEGIN\n\\ global \\\\ \\ \\collection \\ \\ \\oom \\ \\init\\\n WHILE \\countW < n \n INV \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\)\\\n DO\n \\ global \\\\ \\ \\collection \\ (\\ i. [H =\\<^sub>2 i]\\\\) \\ \\countW < n\\ \\ \\A1\\\n <\\hW \\\\<^sub>2 H\\\\> ;; \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n <\\tW \\\\<^sub>2 T\\\\> ;;\n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n\\\n IF \\grd1 \\ \\A2\\\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\ \\ \\A3\\\n \\2 0 \\\\>,, 3 0 \\\\>\\ ;; \\ \\This might not need to be releasing\\ \n \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd1 \\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if 0\\ x \\ x < (\\Data \\countW) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \n IF \\grd2\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd2\\ \\ \\A4\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\\\grd1 \\ \\\\grd2\\\n IF \\grd3\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\ \\A5\\\n IF \\grd4\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd4 \\ \\ \\A6\\\n \\2 \\hW + (\\Data \\countW) \\\\> ,, \\oom := False ,,\n (\\ownB := ( \\ x. if \\hW \\ x \\ x < (\\hW + (\\Data \\countW)) then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\\\grd4 \\\n IF \\grd5\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\grd3 \\ \\grd5 \\ \\ \\A7\\\n \\2 (\\Data \\countW) \\\\> ,, \\hW := 0 ,, \\oom := False ,,\n (\\ownB := ( \\ x. if ((0 \\ x \\ x < (\\Data \\countW))\\ x\\T)\\x\\N then W else \\ownB x ))\\\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\ \\ \\A8\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n ELSE \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\countW < n \\ \\no_space_for_word\\\n \\\\oom := True\\\n \\ \\OOM\\\n FI\n FI\n FI;;\n \\ global \\\\ \\ \\collection \n \\ ((\\oom=False \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\ ) \\ \\\\ \\hW + \\Data (\\countW) \\ N\\ \n \\ (\\oom=True \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word)) \\ \\countW < n\\\n IF \\oom=True\n THEN \\ global \\\\ \\ \\collection \\ [H =\\<^sub>2 \\hW]\\\\ \\ \\no_space_for_word \\ \\countW < n\\ \\ \\OK\\\n SKIP\n ELSE \\ global \\\\ \\ \\collection \\ \\countW < n \\ [H =\\<^sub>2 (\\hW+(\\Data \\countW))]\\\\\\\n \\\\q := \\q @ [(\\hW, (\\Data \\countW))],, \n \\ownD := (\\ x. if x = \\countW then B else \\ownD x),, \n \\ownB := (\\ x. if (\\ownB x = W) then Q else \\ownB x),, \n \\countW := (\\countW+1)\\ \n FI\n OD \n \\ global \\\\ \\ \\collection \\ \\countW = n\\\n\n\\\n \\ global \\\\ \\ \\collection \\ \\tempR = (0, 0) \\\n WHILE \\countR < n\n INV \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\\n DO \\ global \\\\ \\ \\collection \\ \\countR < n \\ \\tempR=(0,0) \\\n IF \\countR < \\countW THEN\n \\ global \\\\ \\ \\collection \\ \\countR < \\countW \\ \\tempR=(0,0) \\ \\ \\retrieve from Q, dequeue\\\n \\ \\tempR := (fst(hd \\q),(snd(hd \\q))) ,, \n \\ownD := (\\ x. if x = \\countR then R else \\ownD x),, \n \\countR := \\countR+1,, \n ( IF \\i.(i<(fst(hd \\q)+snd(hd \\q)) \\ [T =\\<^sub>3 i] \\\\) THEN (\\ownB := ( \\ x. if i \\ x \\ x < (fst(hd \\q)+(snd(hd \\q))) then R else \\ownB x ))\n ELSE (\\ownB := ( \\ x. if i > x \\ x \\ (fst(hd \\q)+(snd(hd \\q)))\\(x=N) then \\ownB x else R ))FI),, \n \\q := (tl \\q) \\;;\n \\ global \\\\ \\\\collection \\ \\countR \\ \\countW \\ \\tempR\\(0,0)\\ \\ \\Push T\\\n \\3 (fst \\tempR + snd \\tempR) \\\\ > \n ,, \\ tempR := (0,0),, \n \\ownB := (\\ x. if \\ownB x = R then B else \\ownD x) \\\n ELSE\n \\ global \\\\ \\ \\collection \\ \\tempR=(0,0) \\ \\countR < n\\\n SKIP\n FI\n OD\n\\ global \\\\ \\ \\collection \\ \\countR = n\\\n\n\n\nCOEND\n \\ global \\\\ \\ \\collection \\ \\countW = n \\ \\countR = n\\\n \n\n\"\n apply (oghoare)\n apply ((simp add: main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff; force)+)[4]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply (metis OpSem_ProofRules.d_obs_read_value OpSem_ProofRules.ext_d_obs_rd_pres d_obs_implies_p_obs le_less_linear)\n apply auto[1]\n apply ((simp add: guards main_invariant_lemmas Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)[1]\n apply clarsimp\n apply (meson not_less not_pobs_contradiction)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n using pval_val apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply auto[3]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis)\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply auto[1]\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply (metis (no_types, lifting) Suc_diff_le d_obs_implies_p_obs fst_eqD le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply auto[1]\n apply ((simp add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)+)\n apply clarsimp\n apply (simp_all add: main_invariant_lemmas guards Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff)\n (*129*)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred hd_conv_nth length_0_conv length_tl less_numeral_extra(3) nat.inject nth_tl snd_conv zero_less_diff)\n apply clarify\n using pval_val apply auto[1]\n using OpSem_ProofRules.p_obs_contradiction apply blast\n apply clarify\n apply linarith\n apply (metis (no_types, lifting) less_numeral_extra(3) )\n using pval_val apply auto[1]\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply linarith\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply clarify\n apply blast\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (intro conjI impI)\n apply (metis getVWNC_var leD pval_val)\n apply (metis OpSem_ProofRules.ext_write_other_pres_d_obs)\n apply clarify\n apply blast\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply (metis getVWNC_var leD pval_val)\n apply (smt One_nat_def Suc_diff_Suc Suc_mono Suc_pred diff_is_0_eq hd_conv_nth leD length_0_conv length_tl nat_less_le nat.inject nth_tl zero_less_diff)\n apply clarify\n apply (meson not_less not_pobs_contradiction)\n apply (meson not_less not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (meson le_less_linear not_pobs_contradiction)\n apply (metis OpSem_ProofRules.write_pres_wfs dual_order.strict_trans fst_eqD leD pval_val_other pval_val_same)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply clarify\n apply (smt OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD le_less_trans less_diff_conv less_imp_le_nat)\n apply (metis Nat.le_diff_conv2 OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs add.commute leD)\n apply (metis OpSem_ProofRules.d_obs_not_p_obs OpSem_ProofRules.ext_d_obs_d_obs OpSem_ProofRules.write_pres_wfs leD)\n apply (metis Suc_diff_le d_obs_implies_p_obs fst_conv le_less_linear less_antisym nth_append nth_append_length snd_conv)\n apply (meson le_less_linear not_pobs_contradiction)\n by simp\n\n\n\n\n\n\n\n\n(*(simp add: Collect_conj_eq[symmetric] Collect_imp_eq[symmetric] Collect_disj_eq[symmetric] Collect_mono_iff )?)*)", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RB_Relaxed_mike_v2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.2633723631445235}} {"text": "theory TTreeImplCardinalitySafe\nimports TTreeImplCardinality TTreeAnalysisSpec CardinalityAnalysisSpec\nbegin\n\nlemma pathsCard_paths_nxt: \"pathsCard (paths (nxt f x)) \\ record_call x\\(pathsCard (paths f))\"\n apply transfer\n apply (rule pathsCard_below)\n apply auto\n apply (erule below_trans[OF _ monofun_cfun_arg[OF paths_Card_above], rotated]) back\n apply (auto intro: fun_belowI simp add: record_call_simp two_pred_two_add_once)\n done\n\nlemma pathsCards_none: \"pathsCard (paths t) x = none \\ x \\ carrier t\"\n by transfer (auto dest: pathCards_noneD)\n\nlemma const_on_edom_disj: \"const_on f S empty \\ edom f \\ S = {}\"\n by (auto simp add: empty_is_bottom edom_def)\n\ncontext TTreeAnalysisCarrier\nbegin\n lemma carrier_Fstack: \"carrier (Fstack as S) \\ fv S\"\n by (induction S rule: Fstack.induct)\n (auto simp add: empty_is_bottom[symmetric] carrier_Fexp dest!: subsetD[OF Aexp_edom])\n\n lemma carrier_FBinds: \"carrier ((FBinds \\\\ae) x) \\ fv \\\"\n apply (simp add: Texp.AnalBinds_lookup)\n apply (auto split: option.split simp add: empty_is_bottom[symmetric] )\n apply (case_tac \"ae x\")\n apply (auto simp add: empty_is_bottom[symmetric] carrier_Fexp dest!: subsetD[OF Aexp_edom])\n by (metis (poly_guards_query) contra_subsetD domA_from_set map_of_fv_subset map_of_SomeD option.sel)\nend\n\ncontext TTreeAnalysisSafe\nbegin\n\n sublocale CardinalityPrognosisShape prognosis\n proof\n fix \\ :: heap and ae ae' :: AEnv and u e S as\n assume \"ae f|` domA \\ = ae' f|` domA \\\"\n from Texp.AnalBinds_cong[OF this]\n show \"prognosis ae as u (\\, e, S) = prognosis ae' as u (\\, e, S)\" by simp\n next\n fix ae as a \\ e S\n show \"const_on (prognosis ae as a (\\, e, S)) (ap S) many\"\n proof\n fix x\n assume \"x \\ ap S\"\n hence \"[x,x] \\ paths (Fstack as S)\"\n by (induction S rule: Fstack.induct)\n (auto 4 4 intro: subsetD[OF both_contains_arg1] subsetD[OF both_contains_arg2] paths_Cons_nxt)\n hence \"[x,x] \\ paths (Texp e\\a \\\\ Fstack as S)\"\n by (rule subsetD[OF both_contains_arg2])\n hence \"[x,x] \\ paths (substitute (FBinds \\\\ae) (thunks \\) (Texp e\\a \\\\ Fstack as S))\" \n by (rule subsetD[OF substitute_contains_arg])\n hence \"pathCard [x,x] x \\ pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (Texp e\\a \\\\ Fstack as S))) x\"\n by (metis fun_belowD paths_Card_above)\n also have \"pathCard [x,x] x = many\" by (auto simp add: pathCard_def)\n finally\n show \"prognosis ae as a (\\, e, S) x = many\"\n by (auto intro: below_antisym)\n qed\n next\n fix \\ \\ :: heap and e :: exp and ae :: AEnv and as u S\n assume \"map_of \\ = map_of \\\"\n hence \"FBinds \\ = FBinds \\\" and \"thunks \\ = thunks \\\" by (auto intro!: cfun_eqI thunks_cong simp add: Texp.AnalBinds_lookup)\n thus \"prognosis ae as u (\\, e, S) = prognosis ae as u (\\, e, S)\" by simp\n next\n fix \\ :: heap and e :: exp and ae :: AEnv and as u S x\n show \"prognosis ae as u (\\, e, S) \\ prognosis ae as u (\\, e, Upd x # S)\" by simp\n next\n fix \\ :: heap and e :: exp and ae :: AEnv and as a S x\n assume \"ae x = \\\"\n\n hence \"FBinds (delete x \\)\\ae = FBinds \\\\ae\" by (rule Texp.AnalBinds_delete_bot)\n moreover\n hence \"((FBinds \\\\ae) x) = \\\" by (metis Texp.AnalBinds_delete_lookup)\n ultimately\n show \"prognosis ae as a (\\, e, S) \\ prognosis ae as a (delete x \\, e, S)\"\n by (simp add: substitute_T_delete empty_is_bottom)\n next\n fix ae as a \\ x S\n have \"once \\ (pathCard [x]) x\" by (simp add: two_add_simp)\n also have \"pathCard [x] \\ pathsCard ({[],[x]})\"\n by (rule paths_Card_above) simp\n also have \"\\ = pathsCard (paths (single x))\" by simp\n also have \"single x \\ (Texp (Var x)\\a)\" by (rule Texp_Var)\n also have \"\\ \\ Texp (Var x)\\a \\\\ Fstack as S\" by (rule both_above_arg1)\n also have \"\\ \\ substitute (FBinds \\\\ae) (thunks \\) (Texp (Var x)\\a \\\\ Fstack as S)\" by (rule substitute_above_arg)\n also have \"pathsCard (paths \\) x = prognosis ae as a (\\, Var x, S) x\" by simp\n finally\n show \"once \\ prognosis ae as a (\\, Var x, S) x\"\n by this (rule cont2cont_fun, intro cont2cont)+\n qed\n\n sublocale CardinalityPrognosisApp prognosis\n proof\n fix ae as a \\ e x S\n have \"Texp e\\(inc\\a) \\\\ many_calls x \\\\ Fstack as S = many_calls x \\\\ (Texp e)\\(inc\\a) \\\\ Fstack as S\"\n by (metis both_assoc both_comm)\n thus \"prognosis ae as (inc\\a) (\\, e, Arg x # S) \\ prognosis ae as a (\\, App e x, S)\"\n by simp (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_App)\n qed\n\n sublocale CardinalityPrognosisLam prognosis\n proof\n fix ae as a \\ e y x S\n have \"Texp e[y::=x]\\(pred\\a) \\ many_calls x \\\\ Texp (Lam [y]. e)\\a\"\n by (rule below_trans[OF Texp_subst both_mono2'[OF Texp_Lam]])\n moreover have \"Texp (Lam [y]. e)\\a \\\\ many_calls x \\\\ Fstack as S = many_calls x \\\\ Texp (Lam [y]. e)\\a \\\\ Fstack as S\"\n by (metis both_assoc both_comm)\n ultimately \n show \"prognosis ae as (pred\\a) (\\, e[y::=x], S) \\ prognosis ae as a (\\, Lam [y]. e, Arg x # S)\"\n by simp (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1')\n qed\n\n sublocale CardinalityPrognosisVar prognosis\n proof\n fix \\ :: heap and e :: exp and x :: var and ae :: AEnv and as u a S\n assume \"map_of \\ x = Some e\"\n assume \"ae x = up\\u\"\n\n assume \"isVal e\"\n hence \"x \\ thunks \\\" using \\map_of \\ x = Some e\\ by (metis thunksE)\n hence [simp]: \"f_nxt (FBinds \\\\ae) (thunks \\) x = FBinds \\\\ae\" by (auto simp add: f_nxt_def)\n\n have \"prognosis ae as u (\\, e, S) = pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (Texp e\\u \\\\ Fstack as S)))\"\n by simp\n also have \"\\ = pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (nxt (single x) x \\\\ Texp e\\u \\\\ Fstack as S)))\"\n by simp\n also have \"\\ = pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) ((nxt (single x) x \\\\ Fstack as S) \\\\ Texp e\\u )))\"\n by (metis both_assoc both_comm)\n also have \"\\ \\ pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (nxt (single x \\\\ Fstack as S) x \\\\ Texp e\\u)))\"\n by (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1' nxt_both_left) simp\n also have \"\\ = pathsCard (paths (nxt (substitute (FBinds \\\\ae) (thunks \\) (single x \\\\ Fstack as S)) x))\"\n using \\map_of \\ x = Some e\\ \\ae x = up\\u\\ by (simp add: Texp.AnalBinds_lookup)\n also have \"\\ \\ record_call x \\(pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (single x \\\\ Fstack as S))))\"\n by (rule pathsCard_paths_nxt)\n also have \"\\ \\ record_call x \\(pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) ((Texp (Var x)\\a) \\\\ Fstack as S))))\"\n by (intro monofun_cfun_arg pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_Var)\n also have \"\\ = record_call x \\(prognosis ae as a (\\, Var x, S))\"\n by simp\n finally\n show \"prognosis ae as u (\\, e, S) \\ record_call x\\(prognosis ae as a (\\, Var x, S))\" by this simp_all\n next\n fix \\ :: heap and e :: exp and x :: var and ae :: AEnv and as u a S\n assume \"map_of \\ x = Some e\"\n assume \"ae x = up\\u\"\n assume \"\\ isVal e\"\n hence \"x \\ thunks \\\" using \\map_of \\ x = Some e\\ by (metis thunksI)\n hence [simp]: \"f_nxt (FBinds \\\\ae) (thunks \\) x = FBinds (delete x \\)\\ae\" \n by (auto simp add: f_nxt_def Texp.AnalBinds_delete_to_fun_upd empty_is_bottom)\n\n have \"prognosis ae as u (delete x \\, e, Upd x # S) = pathsCard (paths (substitute (FBinds (delete x \\)\\ae) (thunks (delete x \\)) (Texp e\\u \\\\ Fstack as S)))\"\n by simp\n also have \"\\ = pathsCard (paths (substitute (FBinds (delete x \\)\\ae) (thunks \\) (Texp e\\u \\\\ Fstack as S)))\"\n by (rule arg_cong[OF substitute_cong_T]) (auto simp add: empty_is_bottom)\n also have \"\\ = pathsCard (paths (substitute (FBinds (delete x \\)\\ae) (thunks \\) (nxt (single x) x \\\\ Texp e\\u \\\\ Fstack as S)))\"\n by simp\n also have \"\\ = pathsCard (paths (substitute (FBinds (delete x \\)\\ae) (thunks \\) ((nxt (single x) x \\\\ Fstack as S) \\\\ Texp e\\u )))\"\n by (metis both_assoc both_comm)\n also have \"\\ \\ pathsCard (paths (substitute (FBinds (delete x \\)\\ae) (thunks \\) (nxt (single x \\\\ Fstack as S) x \\\\ Texp e\\u)))\"\n by (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1' nxt_both_left) simp\n also have \"\\ = pathsCard (paths (nxt (substitute (FBinds \\\\ae) (thunks \\) (single x \\\\ Fstack as S)) x))\"\n using \\map_of \\ x = Some e\\ \\ae x = up\\u\\ by (simp add: Texp.AnalBinds_lookup)\n also have \"\\ \\ record_call x \\(pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (single x \\\\ Fstack as S))))\"\n by (rule pathsCard_paths_nxt)\n also have \"\\ \\ record_call x \\(pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) ((Texp (Var x)\\a) \\\\ Fstack as S))))\"\n by (intro monofun_cfun_arg pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_Var)\n also have \"\\ = record_call x \\(prognosis ae as a (\\, Var x, S))\"\n by simp\n finally\n show \"prognosis ae as u (delete x \\, e, Upd x # S) \\ record_call x\\(prognosis ae as a (\\, Var x, S))\" by this simp_all\n next\n fix \\ :: heap and e :: exp and ae :: AEnv and x :: var and as S\n assume \"isVal e\"\n hence \"repeatable (Texp e\\0)\" by (rule Fun_repeatable)\n\n assume [simp]: \"x \\ domA \\\"\n\n have [simp]: \"thunks ((x, e) # \\) = thunks \\\" \n using \\isVal e\\\n by (auto simp add: thunks_Cons dest: subsetD[OF thunks_domA])\n\n have \"fup\\(Texp e)\\(ae x) \\ Texp e\\0\" by (metis fup2 monofun_cfun_arg up_zero_top)\n hence \"substitute ((FBinds \\\\ae)(x := fup\\(Texp e)\\(ae x))) (thunks \\) (Texp e\\0 \\\\ Fstack as S) \\ substitute ((FBinds \\\\ae)(x := Texp e\\0)) (thunks \\) (Texp e\\0 \\\\ Fstack as S)\"\n by (intro substitute_mono1' fun_upd_mono below_refl monofun_cfun_arg)\n also have \"\\ = substitute (((FBinds \\\\ae)(x := Texp e\\0))(x := empty)) (thunks \\) (Texp e\\0 \\\\ Fstack as S)\"\n using \\repeatable (Texp e\\0)\\ by (rule substitute_remove_anyways, simp)\n also have \"((FBinds \\\\ae)(x := Texp e\\0))(x := empty) = FBinds \\\\ae\"\n by (simp add: fun_upd_idem Texp.AnalBinds_not_there empty_is_bottom)\n finally\n show \"prognosis ae as 0 ((x, e) # \\, e, S) \\ prognosis ae as 0 (\\, e, Upd x # S)\"\n by (simp, intro pathsCard_mono' paths_mono)\n qed\n\n sublocale CardinalityPrognosisIfThenElse prognosis\n proof\n fix ae as \\ scrut e1 e2 S a\n have \"Texp scrut\\0 \\\\ (Texp e1\\a \\\\ Texp e2\\a) \\ Texp (scrut ? e1 : e2)\\a\"\n by (rule Texp_IfThenElse)\n hence \"substitute (FBinds \\\\ae) (thunks \\) (Texp scrut\\0 \\\\ (Texp e1\\a \\\\ Texp e2\\a) \\\\ Fstack as S) \\ substitute (FBinds \\\\ae) (thunks \\) (Texp (scrut ? e1 : e2)\\a \\\\ Fstack as S)\"\n by (rule substitute_mono2'[OF both_mono1'])\n thus \"prognosis ae (a#as) 0 (\\, scrut, Alts e1 e2 # S) \\ prognosis ae as a (\\, scrut ? e1 : e2, S)\"\n by (simp, intro pathsCard_mono' paths_mono)\n next\n fix ae as a \\ b e1 e2 S\n have \"Texp (if b then e1 else e2)\\a \\ Texp e1\\a \\\\ Texp e2\\a\"\n by (auto simp add: either_above_arg1 either_above_arg2)\n hence \"substitute (FBinds \\\\ae) (thunks \\) (Texp (if b then e1 else e2)\\a \\\\ Fstack as S) \\ substitute (FBinds \\\\ae) (thunks \\) (Texp (Bool b)\\0 \\\\ (Texp e1\\a \\\\ Texp e2\\a) \\\\ Fstack as S)\"\n by (rule substitute_mono2'[OF both_mono1'[OF below_trans[OF _ both_above_arg2]]])\n thus \"prognosis ae as a (\\, if b then e1 else e2, S) \\ prognosis ae (a#as) 0 (\\, Bool b, Alts e1 e2 # S)\"\n by (auto intro!: pathsCard_mono' paths_mono)\n qed\n\nend\n\ncontext TTreeAnalysisCardinalityHeap\nbegin\n\n definition cHeap where\n \"cHeap \\ e = (\\ a. pathsCard (paths (Theap \\ e\\a)))\"\n\n lemma cHeap_simp: \"(cHeap \\ e)\\a = pathsCard (paths (Theap \\ e\\a))\"\n unfolding cHeap_def by (rule beta_cfun) (intro cont2cont)\n \n sublocale CardinalityHeap cHeap.\n \n sublocale CardinalityHeapSafe cHeap Aheap\n proof\n fix x \\ e a\n assume \"x \\ thunks \\\"\n moreover\n assume \"many \\ (cHeap \\ e\\a) x\"\n hence \"many \\ pathsCard (paths (Theap \\ e \\a)) x\" unfolding cHeap_def by simp\n hence \"\\p\\ (paths (Theap \\ e\\a)). \\ (one_call_in_path x p)\" unfolding pathsCard_def\n by (auto split: if_splits)\n ultimately\n show \"(Aheap \\ e\\a) x = up\\0\"\n by (metis Theap_thunk)\n next\n fix \\ e a\n show \"edom (cHeap \\ e\\a) = edom (Aheap \\ e\\a)\"\n by (simp add: cHeap_def Union_paths_carrier carrier_Fheap)\n qed\n\n sublocale CardinalityPrognosisEdom prognosis \n proof\n fix ae as a \\ e S\n show \"edom (prognosis ae as a (\\, e, S)) \\ fv \\ \\ fv e \\ fv S\"\n apply (simp add: Union_paths_carrier)\n apply (rule carrier_substitute_below)\n apply (auto simp add: carrier_Fexp dest: subsetD[OF Aexp_edom] subsetD[OF carrier_Fstack] subsetD[OF ap_fv_subset] subsetD[OF carrier_FBinds])\n done\n qed\n \n sublocale CardinalityPrognosisLet prognosis cHeap\n proof\n fix \\ \\ :: heap and e :: exp and S :: stack and ae :: AEnv and a :: Arity and as\n assume \"atom ` domA \\ \\* \\\"\n assume \"atom ` domA \\ \\* S\"\n assume \"edom ae \\ domA \\ \\ upds S\"\n\n have \"domA \\ \\ edom ae = {}\"\n using fresh_distinct[OF \\atom ` domA \\ \\* \\\\] fresh_distinct_fv[OF \\atom ` domA \\ \\* S\\] \n \\edom ae \\ domA \\ \\ upds S\\ ups_fv_subset[of S]\n by auto\n\n have const_on1: \"\\ x. const_on (FBinds \\\\(Aheap \\ e\\a)) (carrier ((FBinds \\\\ae) x)) empty\"\n unfolding const_on_edom_disj using fresh_distinct_fv[OF \\atom ` domA \\ \\* \\\\]\n by (auto dest!: subsetD[OF carrier_FBinds] subsetD[OF Texp.edom_AnalBinds])\n have const_on2: \"const_on (FBinds \\\\(Aheap \\ e\\a)) (carrier (Fstack as S)) empty\"\n unfolding const_on_edom_disj using fresh_distinct_fv[OF \\atom ` domA \\ \\* S\\]\n by (auto dest!: subsetD[OF carrier_FBinds] subsetD[OF carrier_Fstack] subsetD[OF Texp.edom_AnalBinds] subsetD[OF ap_fv_subset ])\n have const_on3: \"const_on (FBinds \\\\ae) (- (- domA \\)) TTree.empty\"\n and const_on4: \"const_on (FBinds \\\\(Aheap \\ e\\a)) (domA \\) TTree.empty\"\n unfolding const_on_edom_disj using fresh_distinct[OF \\atom ` domA \\ \\* \\\\]\n by (auto dest!: subsetD[OF Texp.edom_AnalBinds])\n\n have disj1: \"\\ x. carrier ((FBinds \\\\ae) x) \\ domA \\ = {}\"\n using fresh_distinct_fv[OF \\atom ` domA \\ \\* \\\\]\n by (auto dest: subsetD[OF carrier_FBinds])\n hence disj1': \"\\ x. carrier ((FBinds \\\\ae) x) \\ - domA \\\" by auto\n have disj2: \"\\ x. carrier (Fstack as S) \\ domA \\ = {}\"\n using fresh_distinct_fv[OF \\atom ` domA \\ \\* S\\] by (auto dest!: subsetD[OF carrier_Fstack])\n hence disj2': \"carrier (Fstack as S) \\ - domA \\\" by auto\n \n\n {\n fix x\n have \"(FBinds (\\ @ \\)\\(ae \\ Aheap \\ e\\a)) x = (FBinds \\\\ae) x \\\\ (FBinds \\\\(Aheap \\ e\\a)) x\"\n proof (cases \"x \\ domA \\\")\n case True\n have \"map_of \\ x = None\" using True fresh_distinct[OF \\atom ` domA \\ \\* \\\\] by (metis disjoint_iff_not_equal domA_def map_of_eq_None_iff)\n moreover\n have \"ae x = \\\" using True \\domA \\ \\ edom ae = {}\\ by auto\n ultimately\n show ?thesis using True \n by (auto simp add: Texp.AnalBinds_lookup empty_is_bottom[symmetric] cong: option.case_cong)\n next\n case False\n have \"map_of \\ x = None\" using False by (metis domA_def map_of_eq_None_iff)\n moreover\n have \"(Aheap \\ e\\a) x = \\\" using False using edom_Aheap by (metis contra_subsetD edomIff)\n ultimately\n show ?thesis using False\n by (auto simp add: Texp.AnalBinds_lookup empty_is_bottom[symmetric] cong: option.case_cong)\n qed\n }\n note FBinds = ext[OF this]\n \n {\n have \"pathsCard (paths (substitute (FBinds (\\ @ \\)\\(Aheap \\ e\\a \\ ae)) (thunks (\\ @ \\)) (Texp e\\a \\\\ Fstack as S)))\n = pathsCard (paths (substitute (FBinds \\\\ae) (thunks (\\ @ \\)) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks (\\ @ \\)) (Texp e\\a \\\\ Fstack as S))))\"\n by (simp add: substitute_substitute[OF const_on1] FBinds)\n also have \"substitute (FBinds \\\\ae) (thunks (\\ @ \\)) = substitute (FBinds \\\\ae) (thunks \\)\"\n apply (rule substitute_cong_T)\n using const_on3\n by (auto dest: subsetD[OF thunks_domA])\n also have \"substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks (\\ @ \\)) = substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\)\"\n apply (rule substitute_cong_T)\n using const_on4\n by (auto dest: subsetD[OF thunks_domA])\n also have \"substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a \\\\ Fstack as S) = substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a) \\\\ Fstack as S\"\n by (rule substitute_only_empty_both[OF const_on2])\n also note calculation\n }\n note eq_imp_below[OF this]\n also\n note env_restr_split[where S = \"domA \\\"]\n also\n have \"pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a) \\\\ Fstack as S))) f|` domA \\ \n = pathsCard (paths (ttree_restr (domA \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a))))\"\n by (simp add: filter_paths_conv_free_restr ttree_restr_both ttree_rest_substitute[OF disj1] ttree_restr_is_empty[OF disj2])\n also\n have \"ttree_restr (domA \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ Theap \\ e\\a\" by (rule Theap_substitute)\n also\n have \"pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a) \\\\ Fstack as S))) f|` (- domA \\) =\n pathsCard (paths (substitute (FBinds \\\\ae) (thunks \\) (ttree_restr (- domA \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\\\ Fstack as S)))\"\n by (simp add: filter_paths_conv_free_restr2 ttree_rest_substitute2[OF disj1' const_on3] ttree_restr_both ttree_restr_noop[OF disj2'])\n also have \"ttree_restr (- domA \\) (substitute (FBinds \\\\(Aheap \\ e\\a)) (thunks \\) (Texp e\\a)) \\ Texp (Terms.Let \\ e)\\a\" by (rule Texp_Let)\n finally\n show \"prognosis (Aheap \\ e\\a \\ ae) as a (\\ @ \\, e, S) \\ cHeap \\ e\\a \\ prognosis ae as a (\\, Terms.Let \\ e, S)\"\n by (simp add: cHeap_def del: fun_meet_simp) \n qed\n\n sublocale CardinalityPrognosisSafe prognosis cHeap Aheap Aexp ..\nend\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/TTreeImplCardinalitySafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2632429811913614}} {"text": "header {* \\isaheader{Framework Graph Lifting for Noninterference} *}\n\ntheory LiftingIntra \n imports NonInterferenceIntra \"../Slicing/StaticIntra/CDepInstantiations\" \nbegin\n\ntext {* In this section, we show how a valid CFG from the slicing framework in\n\\cite{Wasserrab:08} can be lifted to fulfil all properties of the \n@{text \"NonInterferenceIntraGraph\"} locale. Basically, we redefine the\nhitherto existing @{text Entry} and @{text Exit} nodes as new\n@{text High} and @{text Low} nodes, and introduce two new nodes\n@{text NewEntry} and @{text NewExit}. Then, we have to lift all functions\nto operate on this new graph. *}\n\nsubsection {* Liftings *}\n\nsubsubsection {* The datatypes *}\n\ndatatype 'node LDCFG_node = Node 'node\n | NewEntry\n | NewExit\n\n\ntype_synonym ('edge,'node,'state) LDCFG_edge = \n \"'node LDCFG_node \\ ('state edge_kind) \\ 'node LDCFG_node\"\n\n\nsubsubsection {* Lifting @{term valid_edge} *}\n\ninductive lift_valid_edge :: \"('edge \\ bool) \\ ('edge \\ 'node) \\ ('edge \\ 'node) \\\n ('edge \\ 'state edge_kind) \\ 'node \\ 'node \\ ('edge,'node,'state) LDCFG_edge \\ \n bool\"\nfor valid_edge::\"'edge \\ bool\" and src::\"'edge \\ 'node\" and trg::\"'edge \\ 'node\" \n and knd::\"'edge \\ 'state edge_kind\" and E::'node and X::'node\n\nwhere lve_edge:\n \"\\valid_edge a; src a \\ E \\ trg a \\ X; \n e = (Node (src a),knd a,Node (trg a))\\\n \\ lift_valid_edge valid_edge src trg knd E X e\"\n\n | lve_Entry_edge:\n \"e = (NewEntry,(\\s. True)\\<^sub>\\,Node E) \n \\ lift_valid_edge valid_edge src trg knd E X e\"\n\n | lve_Exit_edge:\n \"e = (Node X,(\\s. True)\\<^sub>\\,NewExit) \n \\ lift_valid_edge valid_edge src trg knd E X e\"\n\n | lve_Entry_Exit_edge:\n \"e = (NewEntry,(\\s. False)\\<^sub>\\,NewExit) \n \\ lift_valid_edge valid_edge src trg knd E X e\"\n\n\n\n\n\nsubsubsection {* Lifting @{term Def} and @{term Use} sets *}\n\ninductive_set lift_Def_set :: \"('node \\ 'var set) \\ 'node \\ 'node \\ \n 'var set \\ 'var set \\ ('node LDCFG_node \\ 'var) set\"\nfor Def::\"('node \\ 'var set)\" and E::'node and X::'node \n and H::\"'var set\" and L::\"'var set\"\n\nwhere lift_Def_node: \n \"V \\ Def n \\ (Node n,V) \\ lift_Def_set Def E X H L\"\n\n | lift_Def_High:\n \"V \\ H \\ (Node E,V) \\ lift_Def_set Def E X H L\"\n\nabbreviation lift_Def :: \"('node \\ 'var set) \\ 'node \\ 'node \\ \n 'var set \\ 'var set \\ 'node LDCFG_node \\ 'var set\"\n where \"lift_Def Def E X H L n \\ {V. (n,V) \\ lift_Def_set Def E X H L}\"\n\n\ninductive_set lift_Use_set :: \"('node \\ 'var set) \\ 'node \\ 'node \\ \n 'var set \\ 'var set \\ ('node LDCFG_node \\ 'var) set\"\nfor Use::\"'node \\ 'var set\" and E::'node and X::'node \n and H::\"'var set\" and L::\"'var set\"\n\nwhere \n lift_Use_node: \n \"V \\ Use n \\ (Node n,V) \\ lift_Use_set Use E X H L\"\n\n | lift_Use_High:\n \"V \\ H \\ (Node E,V) \\ lift_Use_set Use E X H L\"\n\n | lift_Use_Low:\n \"V \\ L \\ (Node X,V) \\ lift_Use_set Use E X H L\"\n\n\nabbreviation lift_Use :: \"('node \\ 'var set) \\ 'node \\ 'node \\ \n 'var set \\ 'var set \\ 'node LDCFG_node \\ 'var set\"\n where \"lift_Use Use E X H L n \\ {V. (n,V) \\ lift_Use_set Use E X H L}\"\n\n\n\nsubsection {* The lifting lemmas *}\n\nsubsubsection {* Lifting the basic locales *}\n\n\nabbreviation src :: \"('edge,'node,'state) LDCFG_edge \\ 'node LDCFG_node\"\n where \"src a \\ fst a\"\n\nabbreviation trg :: \"('edge,'node,'state) LDCFG_edge \\ 'node LDCFG_node\"\n where \"trg a \\ snd(snd a)\"\n\ndefinition knd :: \"('edge,'node,'state) LDCFG_edge \\ 'state edge_kind\"\n where \"knd a \\ fst(snd a)\"\n\n\nlemma lift_CFG:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n shows \"CFG src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\"\nproof -\n interpret CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\n by(rule wf)\n show ?thesis \n proof\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"trg a = NewEntry\"\n thus False by(fastforce elim:lift_valid_edge.cases)\n next\n fix a a' \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a = trg a'\"\n thus \"a = a'\"\n proof(induct rule:lift_valid_edge.induct)\n case lve_edge thus ?case by -(erule lift_valid_edge.cases,auto dest:edge_det)\n qed(auto elim:lift_valid_edge.cases)\n qed\nqed\n\n\nlemma lift_CFG_wf:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n shows \"CFG_wf src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val\"\nproof -\n interpret CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\n by(rule wf)\n interpret CFG:CFG src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" NewEntry\n by(fastforce intro:lift_CFG wf)\n show ?thesis\n proof\n show \"lift_Def Def Entry Exit H L NewEntry = {} \\\n lift_Use Use Entry Exit H L NewEntry = {}\"\n by(fastforce elim:lift_Use_set.cases lift_Def_set.cases)\n next\n fix a V s \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"V \\ lift_Def Def Entry Exit H L (src a)\" and \"pred (knd a) s\"\n thus \"state_val (transfer (knd a) s) V = state_val s V\"\n proof(induct rule:lift_valid_edge.induct)\n case lve_edge\n thus ?case by(fastforce intro:CFG_edge_no_Def_equal dest:lift_Def_node[of _ Def]\n simp:knd_def)\n qed(auto simp:knd_def)\n next\n fix a s s'\n assume assms:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n \"pred (knd a) s\" \"pred (knd a) s'\"\n show \"\\V\\lift_Def Def Entry Exit H L (src a).\n state_val (transfer (knd a) s) V = state_val (transfer (knd a) s') V\"\n proof\n fix V assume \"V \\ lift_Def Def Entry Exit H L (src a)\"\n with assms\n show \"state_val (transfer (knd a) s) V = state_val (transfer (knd a) s') V\"\n proof(induct rule:lift_valid_edge.induct)\n case (lve_edge a e)\n show ?case\n proof (cases \"Node (sourcenode a) = Node Entry\")\n case True\n hence \"sourcenode a = Entry\" by simp\n from Entry_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = Entry\" and \"targetnode a' = Exit\"\n and \"kind a' = (\\s. False)\\<^sub>\\\" by blast\n have \"\\Q. kind a = (Q)\\<^sub>\\\"\n proof(cases \"targetnode a = Exit\")\n case True\n with `valid_edge a` `valid_edge a'` `sourcenode a = Entry`\n `sourcenode a' = Entry` `targetnode a' = Exit`\n have \"a = a'\" by(fastforce dest:edge_det)\n with `kind a' = (\\s. False)\\<^sub>\\` show ?thesis by simp\n next\n case False\n with `valid_edge a` `valid_edge a'` `sourcenode a = Entry`\n `sourcenode a' = Entry` `targetnode a' = Exit`\n show ?thesis by(auto dest:deterministic)\n qed\n from True `V \\ lift_Def Def Entry Exit H L (src e)` Entry_empty\n `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n have \"V \\ H\" by(fastforce elim:lift_Def_set.cases)\n from True `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n `sourcenode a \\ Entry \\ targetnode a \\ Exit`\n have \"\\V\\H. V \\ lift_Use Use Entry Exit H L (src e)\"\n by(fastforce intro:lift_Use_High)\n with `\\V\\lift_Use Use Entry Exit H L (src e). \n state_val s V = state_val s' V` `V \\ H`\n have \"state_val s V = state_val s' V\" by simp\n with `e = (Node (sourcenode a), kind a, Node (targetnode a))` \n `\\Q. kind a = (Q)\\<^sub>\\`\n show ?thesis by(fastforce simp:knd_def)\n next\n case False\n { fix V' assume \"V' \\ Use (sourcenode a)\"\n with `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n have \"V' \\ lift_Use Use Entry Exit H L (src e)\"\n by(fastforce intro:lift_Use_node)\n }\n with `\\V\\lift_Use Use Entry Exit H L (src e). \n state_val s V = state_val s' V`\n have \"\\V\\Use (sourcenode a). state_val s V = state_val s' V\"\n by fastforce\n from `valid_edge a` this `pred (knd e) s` `pred (knd e) s'`\n `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n have \"\\V \\ Def (sourcenode a). state_val (transfer (kind a) s) V =\n state_val (transfer (kind a) s') V\"\n by -(erule CFG_edge_transfer_uses_only_Use,auto simp:knd_def)\n from `V \\ lift_Def Def Entry Exit H L (src e)` False\n `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n have \"V \\ Def (sourcenode a)\" by(fastforce elim:lift_Def_set.cases)\n with `\\V \\ Def (sourcenode a). state_val (transfer (kind a) s) V =\n state_val (transfer (kind a) s') V`\n `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n show ?thesis by(simp add:knd_def)\n qed\n next\n case (lve_Entry_edge e)\n from `V \\ lift_Def Def Entry Exit H L (src e)` \n `e = (NewEntry, (\\s. True)\\<^sub>\\, Node Entry)`\n have False by(fastforce elim:lift_Def_set.cases)\n thus ?case by simp\n next\n case (lve_Exit_edge e)\n from `V \\ lift_Def Def Entry Exit H L (src e)` \n `e = (Node Exit, (\\s. True)\\<^sub>\\, NewExit)`\n have False\n by(fastforce elim:lift_Def_set.cases intro!:Entry_noteq_Exit simp:Exit_empty)\n thus ?case by simp\n qed(simp add:knd_def)\n qed\n next\n fix a s s'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"pred (knd a) s\" \n and \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n thus \"pred (knd a) s'\"\n by(induct rule:lift_valid_edge.induct,\n auto elim!:CFG_edge_Uses_pred_equal dest:lift_Use_node simp:knd_def)\n next\n fix a a'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a \\ trg a'\"\n thus \"\\Q Q'. knd a = (Q)\\<^sub>\\ \\ knd a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n proof(induct rule:lift_valid_edge.induct)\n case (lve_edge a e)\n from `lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'`\n `valid_edge a` `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n `src e = src a'` `trg e \\ trg a'`\n show ?case\n proof(induct rule:lift_valid_edge.induct)\n case lve_edge thus ?case by(auto dest:deterministic simp:knd_def)\n next\n case (lve_Exit_edge e')\n from `e = (Node (sourcenode a), kind a, Node (targetnode a))`\n `e' = (Node Exit, (\\s. True)\\<^sub>\\, NewExit)` `src e = src e'`\n have \"sourcenode a = Exit\" by simp\n with `valid_edge a` have False by(rule Exit_source)\n thus ?case by simp\n qed auto\n qed (fastforce elim:lift_valid_edge.cases simp:knd_def)+\n qed\nqed\n\n\nlemma lift_CFGExit:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n shows \"CFGExit src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\nproof -\n interpret CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\n by(rule wf)\n interpret CFG:CFG src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" NewEntry\n by(fastforce intro:lift_CFG wf)\n show ?thesis\n proof\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"src a = NewExit\"\n thus False by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Entry_Exit_edge\n show \"\\a. lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a \\\n src a = NewEntry \\ trg a = NewExit \\ knd a = (\\s. False)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n qed\nqed\n\n\nlemma lift_CFGExit_wf:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n shows \"CFGExit_wf src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val NewExit\"\nproof -\n interpret CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\n by(rule wf)\n interpret CFGExit:CFGExit src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" \n NewEntry NewExit\n by(fastforce intro:lift_CFGExit wf)\n interpret CFG_wf:CFG_wf src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" \n NewEntry \"lift_Def Def Entry Exit H L\" \"lift_Use Use Entry Exit H L\" state_val\n by(fastforce intro:lift_CFG_wf wf)\n show ?thesis\n proof\n show \"lift_Def Def Entry Exit H L NewExit = {} \\\n lift_Use Use Entry Exit H L NewExit = {}\"\n by(fastforce elim:lift_Use_set.cases lift_Def_set.cases)\n qed\nqed\n\n\n\nsubsubsection {* Lifting @{term wod_backward_slice} *}\n\nlemma lift_wod_backward_slice:\n fixes valid_edge and sourcenode and targetnode and kind and Entry and Exit\n and Def and Use and H and L\n defines lve:\"lve \\ lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\"\n and lDef:\"lDef \\ lift_Def Def Entry Exit H L\" \n and lUse:\"lUse \\ lift_Use Use Entry Exit H L\"\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n and \"H \\ L = {}\" and \"H \\ L = UNIV\"\n shows \"NonInterferenceIntraGraph src trg knd lve NewEntry lDef lUse state_val \n (CFG_wf.wod_backward_slice src trg lve lDef lUse)\n NewExit H L (Node Entry) (Node Exit)\"\nproof -\n interpret CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\n by(rule wf)\n interpret CFGExit_wf:\n CFGExit_wf src trg knd lve NewEntry lDef lUse state_val NewExit\n by(fastforce intro:lift_CFGExit_wf wf simp:lve lDef lUse)\n from wf lve have CFG:\"CFG src trg lve NewEntry\"\n by(fastforce intro:lift_CFG)\n from wf lve lDef lUse have CFG_wf:\"CFG_wf src trg knd lve NewEntry\n lDef lUse state_val\"\n by(fastforce intro:lift_CFG_wf)\n show ?thesis\n proof\n fix n S\n assume \"n \\ CFG_wf.wod_backward_slice src trg lve lDef lUse S\"\n with CFG_wf show \"CFG.valid_node src trg lve n\"\n by -(rule CFG_wf.wod_backward_slice_valid_node)\n next\n fix n S assume \"CFG.valid_node src trg lve n\" and \"n \\ S\"\n with CFG_wf show \"n \\ CFG_wf.wod_backward_slice src trg lve lDef lUse S\"\n by -(rule CFG_wf.refl)\n next\n fix n' S n V\n assume \"n' \\ CFG_wf.wod_backward_slice src trg lve lDef lUse S\"\n and \"CFG_wf.data_dependence src trg lve lDef lUse n V n'\"\n with CFG_wf show \"n \\ CFG_wf.wod_backward_slice src trg lve lDef lUse S\"\n by -(rule CFG_wf.dd_closed)\n next\n fix n S\n from CFG_wf \n have \"(\\m. (CFG.obs src trg lve n\n (CFG_wf.wod_backward_slice src trg lve lDef lUse S)) = {m}) \\\n CFG.obs src trg lve n (CFG_wf.wod_backward_slice src trg lve lDef lUse S) = {}\"\n by(rule CFG_wf.obs_singleton)\n thus \"finite \n (CFG.obs src trg lve n (CFG_wf.wod_backward_slice src trg lve lDef lUse S))\"\n by fastforce\n next\n fix n S\n from CFG_wf \n have \"(\\m. (CFG.obs src trg lve n\n (CFG_wf.wod_backward_slice src trg lve lDef lUse S)) = {m}) \\\n CFG.obs src trg lve n (CFG_wf.wod_backward_slice src trg lve lDef lUse S) = {}\"\n by(rule CFG_wf.obs_singleton)\n thus \"card (CFG.obs src trg lve n\n (CFG_wf.wod_backward_slice src trg lve lDef lUse S)) \\ 1\"\n by fastforce\n next\n fix a assume \"lve a\" and \"src a = NewEntry\"\n with lve show \"trg a = NewExit \\ trg a = Node Entry\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Entry_edge lve\n show \"\\a. lve a \\ src a = NewEntry \\ trg a = Node Entry \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"trg a = Node Entry\"\n with lve show \"src a = NewEntry\" by(fastforce elim:lift_valid_edge.cases)\n next\n fix a assume \"lve a\" and \"trg a = NewExit\"\n with lve show \"src a = NewEntry \\ src a = Node Exit\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Exit_edge lve\n show \"\\a. lve a \\ src a = Node Exit \\ trg a = NewExit \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"src a = Node Exit\"\n with lve show \"trg a = NewExit\" by(fastforce elim:lift_valid_edge.cases)\n next\n from lDef show \"lDef (Node Entry) = H\"\n by(fastforce elim:lift_Def_set.cases intro:lift_Def_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Entry) = H\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Exit) = L\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_Low)\n next\n from `H \\ L = {}` show \"H \\ L = {}\" .\n next\n from `H \\ L = UNIV` show \"H \\ L = UNIV\" .\n qed\nqed\n\n\nsubsubsection {* Lifting @{text PDG_BS} with @{text standard_control_dependence} *}\n\nlemma lift_Postdomination:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n and pd:\"Postdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n shows \"Postdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry NewExit\"\nproof -\n interpret Postdomination sourcenode targetnode kind valid_edge Entry Exit\n by(rule pd)\n interpret CFGExit_wf:CFGExit_wf src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" NewEntry\n \"lift_Def Def Entry Exit H L\" \"lift_Use Use Entry Exit H L\" state_val NewExit\n by(fastforce intro:lift_CFGExit_wf wf)\n from wf have CFG:\"CFG src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\"\n by(rule lift_CFG)\n show ?thesis\n proof\n fix n assume \"CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n\"\n show \"\\as. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry as n\"\n proof(cases n)\n case NewEntry\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. False)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Entry_Exit_edge)\n with NewEntry have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry [] n\"\n by(fastforce intro:CFG.empty_path[OF CFG] simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case NewExit\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. False)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Entry_Exit_edge)\n with NewExit have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry [(NewEntry,(\\s. False)\\<^sub>\\,NewExit)] n\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case (Node m)\n with Entry_Exit_edge `CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n`\n have \"valid_node m\" \n by(auto elim:lift_valid_edge.cases \n simp:CFG.valid_node_def[OF CFG] valid_node_def)\n thus ?thesis\n proof(cases m rule:valid_node_cases)\n case Entry\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. True)\\<^sub>\\,Node Entry)\" by(fastforce intro:lve_Entry_edge)\n with Entry Node have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry [(NewEntry,(\\s. True)\\<^sub>\\,Node Entry)] n\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case Exit\n from inner obtain ax where \"valid_edge ax\" and \"inner_node (sourcenode ax)\"\n and \"targetnode ax = Exit\" by(erule inner_node_Exit_edge)\n hence \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node (sourcenode ax),kind ax,Node Exit)\"\n by(auto intro:lift_valid_edge.lve_edge simp:inner_node_def)\n hence path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (sourcenode ax)) [(Node (sourcenode ax),kind ax,Node Exit)] \n (Node Exit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n have edge:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. True)\\<^sub>\\,Node Entry)\" by(fastforce intro:lve_Entry_edge)\n from `inner_node (sourcenode ax)` have \"valid_node (sourcenode ax)\"\n by(rule inner_is_valid)\n then obtain asx where \"Entry -asx\\* sourcenode ax\"\n by(fastforce dest:Entry_path)\n from this `valid_edge ax` have \"\\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node (sourcenode ax))\"\n proof(induct asx arbitrary:ax rule:rev_induct)\n case Nil\n from `Entry -[]\\* sourcenode ax` have \"sourcenode ax = Entry\" by fastforce\n hence \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) [] (Node (sourcenode ax))\"\n apply simp apply(rule CFG.empty_path[OF CFG])\n by(auto intro:lve_Entry_edge simp:CFG.valid_node_def[OF CFG])\n thus ?case by blast\n next\n case (snoc x xs)\n note IH = `\\ax. \\Entry -xs\\* sourcenode ax; valid_edge ax\\ \\\n \\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node (sourcenode ax))`\n from `Entry -xs@[x]\\* sourcenode ax`\n have \"Entry -xs\\* sourcenode x\" and \"valid_edge x\"\n and \"targetnode x = sourcenode ax\" by(auto elim:path_split_snoc)\n { assume \"targetnode x = Exit\"\n with `valid_edge ax` `targetnode x = sourcenode ax`\n have False by -(rule Exit_source,simp+) }\n hence \"targetnode x \\ Exit\" by clarsimp\n with `valid_edge x` `targetnode x = sourcenode ax`[THEN sym]\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node (sourcenode x),kind x,Node (sourcenode ax))\"\n by(fastforce intro:lift_valid_edge.lve_edge)\n hence path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (sourcenode x)) [(Node (sourcenode x),kind x,Node (sourcenode ax))] \n (Node (sourcenode ax))\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n from IH[OF `Entry -xs\\* sourcenode x` `valid_edge x`] obtain es\n where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node (sourcenode x))\" by blast\n with path have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) (es@[(Node (sourcenode x),kind x,Node (sourcenode ax))])\n (Node (sourcenode ax))\"\n by -(rule CFG.path_Append[OF CFG])\n thus ?case by blast\n qed\n then obtain es where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node (sourcenode ax))\" by blast\n with path have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) (es@ [(Node (sourcenode ax),kind ax,Node Exit)]) (Node Exit)\"\n by -(rule CFG.path_Append[OF CFG])\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry ((NewEntry,(\\s. True)\\<^sub>\\,Node Entry)#\n (es@ [(Node (sourcenode ax),kind ax,Node Exit)])) (Node Exit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG])\n with Node Exit show ?thesis by fastforce\n next\n case inner\n from `valid_node m` obtain as where \"Entry -as\\* m\"\n by(fastforce dest:Entry_path)\n with inner have \"\\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node m)\"\n proof(induct arbitrary:m rule:rev_induct)\n case Nil\n from `Entry -[]\\* m`\n have \"m = Entry\" by fastforce\n with lve_Entry_edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) [] (Node m)\"\n by(fastforce intro:CFG.empty_path[OF CFG] simp:CFG.valid_node_def[OF CFG])\n thus ?case by blast\n next\n case (snoc x xs)\n note IH = `\\m. \\inner_node m; Entry -xs\\* m\\\n \\ \\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node m)`\n from `Entry -xs@[x]\\* m` have \"Entry -xs\\* sourcenode x\"\n and \"valid_edge x\" and \"m = targetnode x\" by(auto elim:path_split_snoc)\n with `inner_node m`\n have edge:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node (sourcenode x),kind x,Node m)\"\n by(fastforce intro:lve_edge simp:inner_node_def)\n hence path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (sourcenode x)) [(Node (sourcenode x),kind x,Node m)] (Node m)\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n from `valid_edge x` have \"valid_node (sourcenode x)\" by simp\n thus ?case\n proof(cases \"sourcenode x\" rule:valid_node_cases)\n case Entry\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) [(Node Entry,kind x,Node m)] (Node m)\"\n apply - apply(rule CFG.Cons_path[OF CFG])\n apply(rule CFG.empty_path[OF CFG]) \n by(auto simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case Exit\n with `valid_edge x` have False by(rule Exit_source)\n thus ?thesis by simp\n next\n case inner\n from IH[OF this `Entry -xs\\* sourcenode x`] obtain es \n where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node (sourcenode x))\" by blast\n with path have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) (es@[(Node (sourcenode x),kind x,Node m)]) (Node m)\"\n by -(rule CFG.path_Append[OF CFG])\n thus ?thesis by blast\n qed\n qed\n then obtain es where path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) es (Node m)\" by blast\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. True)\\<^sub>\\,Node Entry)\" by(fastforce intro:lve_Entry_edge)\n from this path Node have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n NewEntry ((NewEntry,(\\s. True)\\<^sub>\\,Node Entry)#es) n\"\n by(fastforce intro:CFG.Cons_path[OF CFG])\n thus ?thesis by blast\n qed\n qed\n next\n fix n assume \"CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n\"\n show \"\\as. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n as NewExit\"\n proof(cases n)\n case NewEntry\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. False)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Entry_Exit_edge)\n with NewEntry have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n [(NewEntry,(\\s. False)\\<^sub>\\,NewExit)] NewExit\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case NewExit\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (NewEntry,(\\s. False)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Entry_Exit_edge)\n with NewExit have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n [] NewExit\"\n by(fastforce intro:CFG.empty_path[OF CFG] simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case (Node m)\n with Entry_Exit_edge `CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n`\n have \"valid_node m\" \n by(auto elim:lift_valid_edge.cases \n simp:CFG.valid_node_def[OF CFG] valid_node_def)\n thus ?thesis\n proof(cases m rule:valid_node_cases)\n case Entry\n from inner obtain ax where \"valid_edge ax\" and \"inner_node (targetnode ax)\"\n and \"sourcenode ax = Entry\" by(erule inner_node_Entry_edge)\n hence edge:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node Entry,kind ax,Node (targetnode ax))\"\n by(auto intro:lift_valid_edge.lve_edge simp:inner_node_def)\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node Exit,(\\s. True)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Exit_edge)\n hence path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Exit) [(Node Exit,(\\s. True)\\<^sub>\\,NewExit)] (NewExit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n from `inner_node (targetnode ax)` have \"valid_node (targetnode ax)\"\n by(rule inner_is_valid)\n then obtain asx where \"targetnode ax -asx\\* Exit\" by(fastforce dest:Exit_path)\n from this `valid_edge ax` have \"\\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode ax)) es (Node Exit)\"\n proof(induct asx arbitrary:ax)\n case Nil\n from `targetnode ax -[]\\* Exit` have \"targetnode ax = Exit\" by fastforce\n hence \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode ax)) [] (Node Exit)\"\n apply simp apply(rule CFG.empty_path[OF CFG])\n by(auto intro:lve_Exit_edge simp:CFG.valid_node_def[OF CFG])\n thus ?case by blast\n next\n case (Cons x xs)\n note IH = `\\ax. \\targetnode ax -xs\\* Exit; valid_edge ax\\ \\\n \\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode ax)) es (Node Exit)`\n from `targetnode ax -x#xs\\* Exit`\n have \"targetnode x -xs\\* Exit\" and \"valid_edge x\"\n and \"sourcenode x = targetnode ax\" by(auto elim:path_split_Cons)\n { assume \"sourcenode x = Entry\"\n with `valid_edge ax` `sourcenode x = targetnode ax`\n have False by -(rule Entry_target,simp+) }\n hence \"sourcenode x \\ Entry\" by clarsimp\n with `valid_edge x` `sourcenode x = targetnode ax`[THEN sym]\n have edge:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node (targetnode ax),kind x,Node (targetnode x))\"\n by(fastforce intro:lift_valid_edge.lve_edge)\n from IH[OF `targetnode x -xs\\* Exit` `valid_edge x`] obtain es\n where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode x)) es (Node Exit)\" by blast\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode ax)) \n ((Node (targetnode ax),kind x,Node (targetnode x))#es) (Node Exit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG])\n thus ?case by blast\n qed\n then obtain es where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode ax)) es (Node Exit)\" by blast\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) ((Node Entry, kind ax, Node (targetnode ax))#es) (Node Exit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG])\n with path have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Entry) (((Node Entry,kind ax,Node (targetnode ax))#es)@\n [(Node Exit, (\\s. True)\\<^sub>\\, NewExit)]) NewExit\"\n by -(rule CFG.path_Append[OF CFG])\n with Node Entry show ?thesis by fastforce\n next\n case Exit\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node Exit,(\\s. True)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Exit_edge)\n with Exit Node have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n [(Node Exit,(\\s. True)\\<^sub>\\,NewExit)] NewExit\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case inner\n from `valid_node m` obtain as where \"m -as\\* Exit\"\n by(fastforce dest:Exit_path)\n with inner have \"\\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) es (Node Exit)\"\n proof(induct as arbitrary:m)\n case Nil\n from `m -[]\\* Exit`\n have \"m = Exit\" by fastforce\n with lve_Exit_edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) [] (Node Exit)\"\n by(fastforce intro:CFG.empty_path[OF CFG] simp:CFG.valid_node_def[OF CFG])\n thus ?case by blast\n next\n case (Cons x xs)\n note IH = `\\m. \\inner_node m; m -xs\\* Exit\\\n \\ \\es. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) es (Node Exit)`\n from `m -x#xs\\* Exit` have \"targetnode x -xs\\* Exit\"\n and \"valid_edge x\" and \"m = sourcenode x\" by(auto elim:path_split_Cons)\n with `inner_node m`\n have edge:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node m,kind x,Node (targetnode x))\"\n by(fastforce intro:lve_edge simp:inner_node_def)\n from `valid_edge x` have \"valid_node (targetnode x)\" by simp\n thus ?case\n proof(cases \"targetnode x\" rule:valid_node_cases)\n case Entry\n with `valid_edge x` have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) [(Node m,kind x,Node Exit)] (Node Exit)\"\n apply - apply(rule CFG.Cons_path[OF CFG])\n apply(rule CFG.empty_path[OF CFG]) \n by(auto simp:CFG.valid_node_def[OF CFG])\n thus ?thesis by blast\n next\n case inner\n from IH[OF this `targetnode x -xs\\* Exit`] obtain es \n where \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node (targetnode x)) es (Node Exit)\" by blast\n with edge have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) ((Node m,kind x,Node (targetnode x))#es) (Node Exit)\"\n by(fastforce intro:CFG.Cons_path[OF CFG])\n thus ?thesis by blast\n qed\n qed\n then obtain es where path:\"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node m) es (Node Exit)\" by blast\n have \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\n (Node Exit,(\\s. True)\\<^sub>\\,NewExit)\" by(fastforce intro:lve_Exit_edge)\n hence \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n (Node Exit) [(Node Exit,(\\s. True)\\<^sub>\\,NewExit)] NewExit\"\n by(fastforce intro:CFG.Cons_path[OF CFG] CFG.empty_path[OF CFG]\n simp:CFG.valid_node_def[OF CFG])\n with path Node have \"CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n (es@[(Node Exit, (\\s. True)\\<^sub>\\, NewExit)]) NewExit\"\n by(fastforce intro:CFG.path_Append[OF CFG])\n thus ?thesis by blast\n qed\n qed\n qed\nqed\n\n\nlemma lift_PDG_scd:\n assumes PDG:\"PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n (Postdomination.standard_control_dependence sourcenode targetnode valid_edge Exit)\"\n and pd:\"Postdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n shows \"PDG src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val NewExit\n (Postdomination.standard_control_dependence src trg \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit)\"\nproof -\n interpret PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n \"Postdomination.standard_control_dependence sourcenode targetnode \n valid_edge Exit\"\n by(rule PDG)\n have wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\" by(unfold_locales)\n from wf pd inner have pd':\"Postdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_Postdomination)\n from wf have CFG:\"CFG src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\"\n by(rule lift_CFG)\n from wf have CFG_wf:\"CFG_wf src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val\"\n by(rule lift_CFG_wf)\n from wf have CFGExit:\"CFGExit src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_CFGExit)\n from wf have CFGExit_wf:\"CFGExit_wf src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val NewExit\"\n by(rule lift_CFGExit_wf)\n show ?thesis\n proof\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"trg a = NewEntry\"\n with CFG show False by(rule CFG.Entry_target)\n next\n fix a a' \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a = trg a'\"\n with CFG show \"a = a'\" by(rule CFG.edge_det)\n next\n from CFG_wf\n show \"lift_Def Def Entry Exit H L NewEntry = {} \\\n lift_Use Use Entry Exit H L NewEntry = {}\"\n by(rule CFG_wf.Entry_empty)\n next\n fix a V s \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"V \\ lift_Def Def Entry Exit H L (src a)\" and \"pred (knd a) s\"\n with CFG_wf show \"state_val (transfer (knd a) s) V = state_val s V\"\n by(rule CFG_wf.CFG_edge_no_Def_equal)\n next\n fix a s s'\n assume assms:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n \"pred (knd a) s\" \"pred (knd a) s'\"\n with CFG_wf show \"\\V\\lift_Def Def Entry Exit H L (src a).\n state_val (transfer (knd a) s) V = state_val (transfer (knd a) s') V\"\n by(rule CFG_wf.CFG_edge_transfer_uses_only_Use)\n next\n fix a s s'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"pred (knd a) s\" \n and \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n with CFG_wf show \"pred (knd a) s'\" by(rule CFG_wf.CFG_edge_Uses_pred_equal)\n next\n fix a a'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a \\ trg a'\"\n with CFG_wf show \"\\Q Q'. knd a = (Q)\\<^sub>\\ \\ knd a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n by(rule CFG_wf.deterministic)\n next\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"src a = NewExit\"\n with CFGExit show False by(rule CFGExit.Exit_source)\n next\n from CFGExit\n show \"\\a. lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a \\\n src a = NewEntry \\ trg a = NewExit \\ knd a = (\\s. False)\\<^sub>\\\"\n by(rule CFGExit.Entry_Exit_edge)\n next\n from CFGExit_wf\n show \"lift_Def Def Entry Exit H L NewExit = {} \\\n lift_Use Use Entry Exit H L NewExit = {}\"\n by(rule CFGExit_wf.Exit_empty)\n next\n fix n n'\n assume scd:\"Postdomination.standard_control_dependence src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit n n'\"\n show \"n' \\ NewExit\"\n proof(rule ccontr)\n assume \"\\ n' \\ NewExit\"\n hence \"n' = NewExit\" by simp\n with scd pd' show False \n by(fastforce intro:Postdomination.Exit_not_standard_control_dependent)\n qed\n next\n fix n n'\n assume \"Postdomination.standard_control_dependence src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit n n'\"\n thus \"\\as. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n as n' \\ as \\ []\"\n by(fastforce simp:Postdomination.standard_control_dependence_def[OF pd'])\n qed\nqed\n\n\n\n\nlemma lift_PDG_standard_backward_slice:\n fixes valid_edge and sourcenode and targetnode and kind and Entry and Exit\n and Def and Use and H and L\n defines lve:\"lve \\ lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\"\n and lDef:\"lDef \\ lift_Def Def Entry Exit H L\" \n and lUse:\"lUse \\ lift_Use Use Entry Exit H L\"\n assumes PDG:\"PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n (Postdomination.standard_control_dependence sourcenode targetnode valid_edge Exit)\"\n and pd:\"Postdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n and \"H \\ L = {}\" and \"H \\ L = UNIV\"\n shows \"NonInterferenceIntraGraph src trg knd lve NewEntry lDef lUse state_val \n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit))\n NewExit H L (Node Entry) (Node Exit)\"\nproof -\n interpret PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n \"Postdomination.standard_control_dependence sourcenode targetnode \n valid_edge Exit\"\n by(rule PDG)\n have wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\" by(unfold_locales)\n interpret wf':CFGExit_wf src trg knd lve NewEntry lDef lUse state_val NewExit\n by(fastforce intro:lift_CFGExit_wf wf simp:lve lDef lUse)\n from PDG pd inner lve lDef lUse have PDG':\"PDG src trg knd \n lve NewEntry lDef lUse state_val NewExit\n (Postdomination.standard_control_dependence src trg lve NewExit)\"\n by(fastforce intro:lift_PDG_scd)\n from wf pd inner have pd':\"Postdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_Postdomination)\n from wf lve have CFG:\"CFG src trg lve NewEntry\"\n by(fastforce intro:lift_CFG)\n from wf lve lDef lUse \n have CFG_wf:\"CFG_wf src trg knd lve NewEntry lDef lUse state_val\"\n by(fastforce intro:lift_CFG_wf)\n from wf lve have CFGExit:\"CFGExit src trg knd lve NewEntry NewExit\"\n by(fastforce intro:lift_CFGExit)\n from wf lve lDef lUse \n have CFGExit_wf:\"CFGExit_wf src trg knd lve NewEntry lDef lUse state_val NewExit\"\n by(fastforce intro:lift_CFGExit_wf)\n show ?thesis\n proof\n fix n S\n assume \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S\"\n with PDG' show \"CFG.valid_node src trg lve n\"\n by(rule PDG.PDG_BS_valid_node)\n next\n fix n S assume \"CFG.valid_node src trg lve n\" and \"n \\ S\"\n thus \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S\"\n by(fastforce intro:PDG.PDG_path_Nil[OF PDG'] simp:PDG.PDG_BS_def[OF PDG'])\n next\n fix n' S n V\n assume \"n' \\ PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S\"\n and \"CFG_wf.data_dependence src trg lve lDef lUse n V n'\"\n thus \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S\"\n by(fastforce intro:PDG.PDG_path_Append[OF PDG'] PDG.PDG_path_ddep[OF PDG']\n PDG.PDG_ddep_edge[OF PDG'] simp:PDG.PDG_BS_def[OF PDG']\n split:split_if_asm)\n next\n fix n S\n interpret PDGx:PDG src trg knd lve NewEntry lDef lUse state_val NewExit\n \"Postdomination.standard_control_dependence src trg lve NewExit\"\n by(rule PDG')\n interpret pdx:Postdomination src trg knd lve NewEntry NewExit\n by(fastforce intro:pd' simp:lve)\n have scd:\"StandardControlDependencePDG src trg knd lve NewEntry\n lDef lUse state_val NewExit\" by(unfold_locales)\n from StandardControlDependencePDG.obs_singleton[OF scd]\n have \"(\\m. CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S) = {m}) \\\n CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S) = {}\"\n by(fastforce simp:StandardControlDependencePDG.PDG_BS_s_def[OF scd])\n thus \"finite (CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S))\"\n by fastforce\n next\n fix n S\n interpret PDGx:PDG src trg knd lve NewEntry lDef lUse state_val NewExit\n \"Postdomination.standard_control_dependence src trg lve NewExit\"\n by(rule PDG')\n interpret pdx:Postdomination src trg knd lve NewEntry NewExit\n by(fastforce intro:pd' simp:lve)\n have scd:\"StandardControlDependencePDG src trg knd lve NewEntry\n lDef lUse state_val NewExit\" by(unfold_locales)\n from StandardControlDependencePDG.obs_singleton[OF scd]\n have \"(\\m. CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S) = {m}) \\\n CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S) = {}\"\n by(fastforce simp:StandardControlDependencePDG.PDG_BS_s_def[OF scd])\n thus \"card (CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (Postdomination.standard_control_dependence src trg lve NewExit) S)) \\ 1\"\n by fastforce\n next\n fix a assume \"lve a\" and \"src a = NewEntry\"\n with lve show \"trg a = NewExit \\ trg a = Node Entry\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Entry_edge lve\n show \"\\a. lve a \\ src a = NewEntry \\ trg a = Node Entry \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"trg a = Node Entry\"\n with lve show \"src a = NewEntry\" by(fastforce elim:lift_valid_edge.cases)\n next\n fix a assume \"lve a\" and \"trg a = NewExit\"\n with lve show \"src a = NewEntry \\ src a = Node Exit\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Exit_edge lve\n show \"\\a. lve a \\ src a = Node Exit \\ trg a = NewExit \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"src a = Node Exit\"\n with lve show \"trg a = NewExit\" by(fastforce elim:lift_valid_edge.cases)\n next\n from lDef show \"lDef (Node Entry) = H\"\n by(fastforce elim:lift_Def_set.cases intro:lift_Def_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Entry) = H\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Exit) = L\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_Low)\n next\n from `H \\ L = {}` show \"H \\ L = {}\" .\n next\n from `H \\ L = UNIV` show \"H \\ L = UNIV\" .\n qed\nqed\n\n\n\nsubsubsection {* Lifting @{text PDG_BS} with @{text weak_control_dependence} *}\n\nlemma lift_StrongPostdomination:\n assumes wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\"\n and spd:\"StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n shows \"StrongPostdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry NewExit\"\nproof -\n interpret StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit\n by(rule spd)\n have pd:\"Postdomination sourcenode targetnode kind valid_edge Entry Exit\"\n by(unfold_locales)\n interpret pd':Postdomination src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\"\n NewEntry NewExit\n by(fastforce intro:wf inner lift_Postdomination pd)\n interpret CFGExit_wf:CFGExit_wf src trg knd\n \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\" NewEntry\n \"lift_Def Def Entry Exit H L\" \"lift_Use Use Entry Exit H L\" state_val NewExit\n by(fastforce intro:lift_CFGExit_wf wf)\n from wf have CFG:\"CFG src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\"\n by(rule lift_CFG)\n show ?thesis\n proof\n fix n assume \"CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n\"\n show \"finite\n {n'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a' \\\n src a' = n \\ trg a' = n'}\"\n proof(cases n)\n case NewEntry\n hence \"{n'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind \n Entry Exit a' \\ src a' = n \\ trg a' = n'} = {NewExit,Node Entry}\"\n by(auto elim:lift_valid_edge.cases intro:lift_valid_edge.intros)\n thus ?thesis by simp\n next\n case NewExit\n hence \"{n'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind \n Entry Exit a' \\ src a' = n \\ trg a' = n'} = {}\"\n by fastforce\n thus ?thesis by simp\n next\n case (Node m)\n with Entry_Exit_edge `CFG.valid_node src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n`\n have \"valid_node m\" \n by(auto elim:lift_valid_edge.cases \n simp:CFG.valid_node_def[OF CFG] valid_node_def)\n hence \"finite {m'. \\a'. valid_edge a' \\ sourcenode a' = m \\ targetnode a' = m'}\"\n by(rule successor_set_finite)\n have \"{m'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind \n Entry Exit a' \\ src a' = Node m \\ trg a' = Node m'} \\ \n {m'. \\a'. valid_edge a' \\ sourcenode a' = m \\ targetnode a' = m'}\"\n by(fastforce elim:lift_valid_edge.cases)\n with `finite {m'. \\a'. valid_edge a' \\ sourcenode a' = m \\ targetnode a' = m'}`\n have \"finite {m'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind \n Entry Exit a' \\ src a' = Node m \\ trg a' = Node m'}\"\n by -(rule finite_subset)\n hence \"finite (Node ` {m'. \\a'. lift_valid_edge valid_edge sourcenode \n targetnode kind Entry Exit a' \\ src a' = Node m \\ trg a' = Node m'})\"\n by fastforce\n hence fin:\"finite ((Node ` {m'. \\a'. lift_valid_edge valid_edge sourcenode \n targetnode kind Entry Exit a' \\ src a' = Node m \\ trg a' = Node m'}) \\\n {NewEntry,NewExit})\" by fastforce\n with Node have \"{n'. \\a'. lift_valid_edge valid_edge sourcenode targetnode kind \n Entry Exit a' \\ src a' = n \\ trg a' = n'} \\\n (Node ` {m'. \\a'. lift_valid_edge valid_edge sourcenode \n targetnode kind Entry Exit a' \\ src a' = Node m \\ trg a' = Node m'}) \\\n {NewEntry,NewExit}\" by auto (case_tac x,auto)\n with fin show ?thesis by -(rule finite_subset)\n qed\n qed\nqed\n\n\n\n\n\nlemma lift_PDG_wcd:\n assumes PDG:\"PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n (StrongPostdomination.weak_control_dependence sourcenode targetnode \n valid_edge Exit)\"\n and spd:\"StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n shows \"PDG src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val NewExit\n (StrongPostdomination.weak_control_dependence src trg \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit)\"\nproof -\n interpret PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n \"StrongPostdomination.weak_control_dependence sourcenode targetnode \n valid_edge Exit\"\n by(rule PDG)\n have wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\" by(unfold_locales)\n from wf spd inner have spd':\"StrongPostdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_StrongPostdomination)\n from wf have CFG:\"CFG src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\"\n by(rule lift_CFG)\n from wf have CFG_wf:\"CFG_wf src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val\"\n by(rule lift_CFG_wf)\n from wf have CFGExit:\"CFGExit src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_CFGExit)\n from wf have CFGExit_wf:\"CFGExit_wf src trg knd \n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewEntry\n (lift_Def Def Entry Exit H L) (lift_Use Use Entry Exit H L) state_val NewExit\"\n by(rule lift_CFGExit_wf)\n show ?thesis\n proof\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"trg a = NewEntry\"\n with CFG show False by(rule CFG.Entry_target)\n next\n fix a a' \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a = trg a'\"\n with CFG show \"a = a'\" by(rule CFG.edge_det)\n next\n from CFG_wf\n show \"lift_Def Def Entry Exit H L NewEntry = {} \\\n lift_Use Use Entry Exit H L NewEntry = {}\"\n by(rule CFG_wf.Entry_empty)\n next\n fix a V s \n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"V \\ lift_Def Def Entry Exit H L (src a)\" and \"pred (knd a) s\"\n with CFG_wf show \"state_val (transfer (knd a) s) V = state_val s V\"\n by(rule CFG_wf.CFG_edge_no_Def_equal)\n next\n fix a s s'\n assume assms:\"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n \"pred (knd a) s\" \"pred (knd a) s'\"\n with CFG_wf show \"\\V\\lift_Def Def Entry Exit H L (src a).\n state_val (transfer (knd a) s) V = state_val (transfer (knd a) s') V\"\n by(rule CFG_wf.CFG_edge_transfer_uses_only_Use)\n next\n fix a s s'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"pred (knd a) s\" \n and \"\\V\\lift_Use Use Entry Exit H L (src a). state_val s V = state_val s' V\"\n with CFG_wf show \"pred (knd a) s'\" by(rule CFG_wf.CFG_edge_Uses_pred_equal)\n next\n fix a a'\n assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a'\"\n and \"src a = src a'\" and \"trg a \\ trg a'\"\n with CFG_wf show \"\\Q Q'. knd a = (Q)\\<^sub>\\ \\ knd a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n by(rule CFG_wf.deterministic)\n next\n fix a assume \"lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a\"\n and \"src a = NewExit\"\n with CFGExit show False by(rule CFGExit.Exit_source)\n next\n from CFGExit\n show \"\\a. lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a \\\n src a = NewEntry \\ trg a = NewExit \\ knd a = (\\s. False)\\<^sub>\\\"\n by(rule CFGExit.Entry_Exit_edge)\n next\n from CFGExit_wf\n show \"lift_Def Def Entry Exit H L NewExit = {} \\\n lift_Use Use Entry Exit H L NewExit = {}\"\n by(rule CFGExit_wf.Exit_empty)\n next\n fix n n'\n assume wcd:\"StrongPostdomination.weak_control_dependence src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit n n'\"\n show \"n' \\ NewExit\"\n proof(rule ccontr)\n assume \"\\ n' \\ NewExit\"\n hence \"n' = NewExit\" by simp\n with wcd spd' show False \n by(fastforce intro:StrongPostdomination.Exit_not_weak_control_dependent)\n qed\n next\n fix n n'\n assume \"StrongPostdomination.weak_control_dependence src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) NewExit n n'\"\n thus \"\\as. CFG.path src trg\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)\n n as n' \\ as \\ []\"\n by(fastforce simp:StrongPostdomination.weak_control_dependence_def[OF spd'])\n qed\nqed\n\n\n\n\nlemma lift_PDG_weak_backward_slice:\n fixes valid_edge and sourcenode and targetnode and kind and Entry and Exit\n and Def and Use and H and L\n defines lve:\"lve \\ lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit\"\n and lDef:\"lDef \\ lift_Def Def Entry Exit H L\" \n and lUse:\"lUse \\ lift_Use Use Entry Exit H L\"\n assumes PDG:\"PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n (StrongPostdomination.weak_control_dependence sourcenode targetnode \n valid_edge Exit)\"\n and spd:\"StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit\"\n and inner:\"CFGExit.inner_node sourcenode targetnode valid_edge Entry Exit nx\"\n and \"H \\ L = {}\" and \"H \\ L = UNIV\"\n shows \"NonInterferenceIntraGraph src trg knd lve NewEntry lDef lUse state_val \n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit))\n NewExit H L (Node Entry) (Node Exit)\"\nproof -\n interpret PDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n \"StrongPostdomination.weak_control_dependence sourcenode targetnode \n valid_edge Exit\"\n by(rule PDG)\n have wf:\"CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use\n state_val Exit\" by(unfold_locales)\n interpret wf':CFGExit_wf src trg knd lve NewEntry lDef lUse state_val NewExit\n by(fastforce intro:lift_CFGExit_wf wf simp:lve lDef lUse)\n from PDG spd inner lve lDef lUse have PDG':\"PDG src trg knd \n lve NewEntry lDef lUse state_val NewExit\n (StrongPostdomination.weak_control_dependence src trg lve NewExit)\"\n by(fastforce intro:lift_PDG_wcd)\n from wf spd inner have spd':\"StrongPostdomination src trg knd\n (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) \n NewEntry NewExit\"\n by(rule lift_StrongPostdomination)\n from wf lve have CFG:\"CFG src trg lve NewEntry\"\n by(fastforce intro:lift_CFG)\n from wf lve lDef lUse \n have CFG_wf:\"CFG_wf src trg knd lve NewEntry lDef lUse state_val\"\n by(fastforce intro:lift_CFG_wf)\n from wf lve have CFGExit:\"CFGExit src trg knd lve NewEntry NewExit\"\n by(fastforce intro:lift_CFGExit)\n from wf lve lDef lUse \n have CFGExit_wf:\"CFGExit_wf src trg knd lve NewEntry lDef lUse state_val NewExit\"\n by(fastforce intro:lift_CFGExit_wf)\n show ?thesis\n proof\n fix n S\n assume \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S\"\n with PDG' show \"CFG.valid_node src trg lve n\"\n by(rule PDG.PDG_BS_valid_node)\n next\n fix n S assume \"CFG.valid_node src trg lve n\" and \"n \\ S\"\n thus \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S\"\n by(fastforce intro:PDG.PDG_path_Nil[OF PDG'] simp:PDG.PDG_BS_def[OF PDG'])\n next\n fix n' S n V\n assume \"n' \\ PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S\"\n and \"CFG_wf.data_dependence src trg lve lDef lUse n V n'\"\n thus \"n \\ PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S\"\n by(fastforce intro:PDG.PDG_path_Append[OF PDG'] PDG.PDG_path_ddep[OF PDG']\n PDG.PDG_ddep_edge[OF PDG'] simp:PDG.PDG_BS_def[OF PDG']\n split:split_if_asm)\n next\n fix n S\n interpret PDGx:PDG src trg knd lve NewEntry lDef lUse state_val NewExit\n \"StrongPostdomination.weak_control_dependence src trg lve NewExit\"\n by(rule PDG')\n interpret spdx:StrongPostdomination src trg knd lve NewEntry NewExit\n by(fastforce intro:spd' simp:lve)\n have wcd:\"WeakControlDependencePDG src trg knd lve NewEntry\n lDef lUse state_val NewExit\" by(unfold_locales)\n from WeakControlDependencePDG.obs_singleton[OF wcd]\n have \"(\\m. CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S) = {m}) \\\n CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S) = {}\"\n by(fastforce simp:WeakControlDependencePDG.PDG_BS_w_def[OF wcd])\n thus \"finite (CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S))\"\n by fastforce\n next\n fix n S\n interpret PDGx:PDG src trg knd lve NewEntry lDef lUse state_val NewExit\n \"StrongPostdomination.weak_control_dependence src trg lve NewExit\"\n by(rule PDG')\n interpret spdx:StrongPostdomination src trg knd lve NewEntry NewExit\n by(fastforce intro:spd' simp:lve)\n have wcd:\"WeakControlDependencePDG src trg knd lve NewEntry\n lDef lUse state_val NewExit\" by(unfold_locales)\n from WeakControlDependencePDG.obs_singleton[OF wcd]\n have \"(\\m. CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S) = {m}) \\\n CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S) = {}\"\n by(fastforce simp:WeakControlDependencePDG.PDG_BS_w_def[OF wcd])\n thus \"card (CFG.obs src trg lve n\n (PDG.PDG_BS src trg lve lDef lUse\n (StrongPostdomination.weak_control_dependence src trg lve NewExit) S)) \\ 1\"\n by fastforce\n next\n fix a assume \"lve a\" and \"src a = NewEntry\"\n with lve show \"trg a = NewExit \\ trg a = Node Entry\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Entry_edge lve\n show \"\\a. lve a \\ src a = NewEntry \\ trg a = Node Entry \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"trg a = Node Entry\"\n with lve show \"src a = NewEntry\" by(fastforce elim:lift_valid_edge.cases)\n next\n fix a assume \"lve a\" and \"trg a = NewExit\"\n with lve show \"src a = NewEntry \\ src a = Node Exit\"\n by(fastforce elim:lift_valid_edge.cases)\n next\n from lve_Exit_edge lve\n show \"\\a. lve a \\ src a = Node Exit \\ trg a = NewExit \\ knd a = (\\s. True)\\<^sub>\\\"\n by(fastforce simp:knd_def)\n next\n fix a assume \"lve a\" and \"src a = Node Exit\"\n with lve show \"trg a = NewExit\" by(fastforce elim:lift_valid_edge.cases)\n next\n from lDef show \"lDef (Node Entry) = H\"\n by(fastforce elim:lift_Def_set.cases intro:lift_Def_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Entry) = H\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_High)\n next\n from Entry_noteq_Exit lUse show \"lUse (Node Exit) = L\"\n by(fastforce elim:lift_Use_set.cases intro:lift_Use_Low)\n next\n from `H \\ L = {}` show \"H \\ L = {}\" .\n next\n from `H \\ L = UNIV` show \"H \\ L = UNIV\" .\n qed\nqed\n\n\nend\n\n\n\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/InformationFlowSlicing/LiftingIntra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.2631765570048666}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory BCorres_UL\nimports\n \"Monad_WP/NonDetMonadVCG\"\n Crunch_Instances_NonDet\nbegin\n\ndefinition s_bcorres_underlying where\n \"s_bcorres_underlying t f g s \\ (\\(x,y). (x, t y)) ` (fst (f s)) \\ (fst (g (t s)))\"\n\ndefinition bcorres_underlying where\n \"bcorres_underlying t f g \\ \\s. s_bcorres_underlying t f g s\"\n\nlemma wpc_helper_bcorres:\n \"bcorres_underlying t f g \\ wpc_helper (P, P') (Q, Q') (bcorres_underlying t f g)\"\n by (simp add: wpc_helper_def)\n\nlemma wpc_helper_s_bcorres:\n \"s_bcorres_underlying t f g s \\ wpc_helper (P, P') (Q, Q') (s_bcorres_underlying t f g s)\"\n by (simp add: wpc_helper_def)\n\nwpc_setup \"\\f. bcorres_underlying t f g\" wpc_helper_bcorres\nwpc_setup \"\\f. s_bcorres_underlying t f g s\" wpc_helper_bcorres\n\nlemma s_bcorres_underlying_split[wp_split]:\n \"(\\r s'. (r,s') \\ fst (f s) \\ (s_bcorres_underlying t (g r) (g' r) s')) \\\n s_bcorres_underlying t f f' s \\\n s_bcorres_underlying t (f >>= g) (f' >>= g') s\"\n by (clarsimp simp: s_bcorres_underlying_def bind_def) force\n\nlemma bcorres_underlying_split[wp_split]:\n \"(\\r. (bcorres_underlying t (g r) (g' r))) \\\n bcorres_underlying t f f' \\\n bcorres_underlying t (f >>= g) (f' >>= g')\"\n by (simp add: bcorres_underlying_def s_bcorres_underlying_split)\n\nlemma get_s_bcorres_underlying[wp]:\n \"s_bcorres_underlying t (f s) (f' (t s)) s \\ s_bcorres_underlying t (get >>= f) (get >>= f') s\"\n by (simp add: gets_def s_bcorres_underlying_def get_def bind_def return_def)\n\nlemma get_bcorres[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' (t x))) \\ bcorres_underlying t (get >>= f) (get >>= f')\"\n by (simp add: bcorres_underlying_def get_s_bcorres_underlying)\n\nlemma gets_s_bcorres_underlying[wp]:\n \"x' (t s) = x s \\ s_bcorres_underlying t (gets x) (gets x') s\"\n by (simp add: s_bcorres_underlying_def gets_def get_def bind_def return_def)\n\nlemma gets_bcorres_underlying[wp]:\n \"(\\s. x' (t s) = x s) \\ bcorres_underlying t (gets x) (gets x')\"\n by (simp add: bcorres_underlying_def gets_s_bcorres_underlying)\n\nlemma gets_map_bcorres_underlying[wp]:\n \"(\\s. f' (t s) p = f s p) \\ bcorres_underlying t (gets_map f p) (gets_map f' p)\"\n by (simp add: gets_map_def bcorres_underlying_def s_bcorres_underlying_def simpler_gets_def\n bind_def assert_opt_def fail_def return_def\n split: option.splits)\n\nlemma gets_bcorres_underlying':\n \"(\\xa. bcorres_underlying t (f (x xa)) (f' (x' (t xa)))) \\\n bcorres_underlying t (gets x >>= f) (gets x' >>= f')\"\n by (wpsimp simp: gets_def)\n\nlemma assert_bcorres_underlying[wp]:\n \"f = f' \\ bcorres_underlying t (assert f) (assert f')\"\n by (simp add: assert_def bcorres_underlying_def return_def s_bcorres_underlying_def fail_def)\n\nlemma return_bcorres[wp]:\n \"bcorres_underlying t (return x) (return x)\"\n by (simp add:return_def bcorres_underlying_def s_bcorres_underlying_def)\n\nlemma drop_sbcorres_underlying:\n \"bcorres_underlying t f g \\ s_bcorres_underlying t f g s\"\n by (simp add: bcorres_underlying_def)\n\nlemma use_sbcorres_underlying:\n \"(\\s. s_bcorres_underlying t f g s) \\ bcorres_underlying t f g\"\n by (simp add: bcorres_underlying_def)\n\nlemma bcorres_underlying_throwError[wp]:\n \"bcorres_underlying t (throwError a) (throwError a)\"\n by (wpsimp simp: throwError_def)\n\nlemma s_bcorres_underlying_splitE[wp_split]:\n \"(\\r s'. (Inr r,s') \\ fst (f s) \\ s_bcorres_underlying t (g r) (g' r) s') \\\n s_bcorres_underlying t f f' s \\\n s_bcorres_underlying t (f >>=E g) (f' >>=E g') s\"\n by (wpsimp simp: bindE_def lift_def split: sum.splits | rule conjI drop_sbcorres_underlying)+\n\nlemma get_s_bcorres_underlyingE[wp]:\n \"s_bcorres_underlying t (f s) (f' (t s)) s \\\n s_bcorres_underlying t (liftE get >>=E f) (liftE get >>=E f') s\"\n by (simp add: gets_def s_bcorres_underlying_def get_def bindE_def bind_def return_def liftE_def lift_def)\n\nlemma bcorres_underlying_splitE[wp_split]:\n \"(\\r. bcorres_underlying t (g r) (g' r)) \\\n bcorres_underlying t f f' \\\n bcorres_underlying t (f >>=E g) (f' >>=E g')\"\n by (simp add: bcorres_underlying_def s_bcorres_underlying_splitE)\n\nlemmas return_s_bcorres_underlying[wp] = drop_sbcorres_underlying[OF return_bcorres]\n\nlemma liftE_s_bcorres_underlying[wp]:\n \"s_bcorres_underlying t f f' s \\ s_bcorres_underlying t (liftE f) (liftE f') s\"\n by (wpsimp simp: liftE_def)\n\nlemma liftE_bcorres_underlying[wp]:\n \"bcorres_underlying t f f' \\ bcorres_underlying t (liftE f) (liftE f')\"\n by (simp add: bcorres_underlying_def liftE_s_bcorres_underlying)\n\nlemma returnOk_bcorres_underlying[wp]:\n \"bcorres_underlying t (returnOk x) (returnOk x)\"\n by (wpsimp simp: returnOk_def)\n\nlemma whenE_s_bcorres_underlying[wp]:\n \"\\ \\P = P'; P\\ \\ s_bcorres_underlying t f f' s; P = P' \\ \\\n s_bcorres_underlying t (whenE P f) (whenE P' f') s\"\n by (wpsimp simp: whenE_def|rule drop_sbcorres_underlying)+\n\nlemma select_s_bcorres_underlying[wp]:\n \"A \\ B \\ s_bcorres_underlying t (select A) (select B) s\"\n by (simp add: s_bcorres_underlying_def select_def image_def) blast\n\nlemma fail_s_bcorres_underlying[wp]:\n \"s_bcorres_underlying t fail fail s\"\n by (simp add: s_bcorres_underlying_def fail_def)\n\nlemma fail_bcorres_underlying[wp]:\n \"bcorres_underlying t fail fail\"\n by (simp add: bcorres_underlying_def fail_s_bcorres_underlying)\n\nlemma assertE_bcorres_underlying[wp]:\n \"bcorres_underlying t (assertE P) (assertE P)\"\n by (wpsimp simp: assertE_def returnOk_def|rule conjI)+\n\nlemmas assertE_s_bcorres_underlying[wp] = drop_sbcorres_underlying[OF assertE_bcorres_underlying]\n\nlemma when_s_bcorres_underlying[wp]:\n \"(P \\ s_bcorres_underlying t f f' s) \\ s_bcorres_underlying t (when P f) (when P f') s\"\n by (simp add: return_s_bcorres_underlying when_def)\n\nlemma when_bcorres_underlying[wp]:\n \"(P \\ bcorres_underlying t f f') \\ bcorres_underlying t (when P f) (when P f')\"\n by (simp add: bcorres_underlying_def when_s_bcorres_underlying)\n\nlemma put_bcorres_underlying[wp]:\n \"t f = f' \\ bcorres_underlying t (put f) (put f')\"\n by (simp add: bcorres_underlying_def s_bcorres_underlying_def put_def)\n\nlemma modify_bcorres_underlying[wp]:\n \"(\\x. t (f x) = f' (t x)) \\ bcorres_underlying t (modify f) (modify f')\"\n by (wpsimp simp: modify_def)\n\nlemma liftM_bcorres_underlying[wp]:\n \"bcorres_underlying t m m' \\ bcorres_underlying t (liftM f m) (liftM f m')\"\n by (wpsimp simp: liftM_def)\n\nlemma sequence_x_bcorres_underlying[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\\n bcorres_underlying t (sequence_x (map f xs)) (sequence_x (map f' xs))\"\n by (induct xs; wpsimp simp: sequence_x_def)\n\nlemma sequence_bcorres_underlying[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\\n bcorres_underlying t (sequence (map f xs)) (sequence (map f' xs))\"\n by (induct xs; wpsimp simp: sequence_def)\n\nlemma mapM_x_bcorres_underlying[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\ bcorres_underlying t (mapM_x f xs) (mapM_x f' xs)\"\n by (wpsimp simp: mapM_x_def)\n\nlemma mapM_bcorres_underlying[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\ bcorres_underlying t (mapM f xs) (mapM f' xs)\"\n by (simp add: mapM_def | wp)+\n\nlemma gets_s_bcorres_underlyingE':\n \"s_bcorres_underlying t (f (x s)) (f' (x' (t s))) s \\\n s_bcorres_underlying t (liftE (gets x) >>=E f) (liftE (gets x') >>=E f') s\"\n by (simp add: gets_def liftE_def lift_def bindE_def) wp\n\nlemma bcorres_underlying_filterM[wp]:\n \"(\\x. bcorres_underlying t (a x) (a' x)) \\ bcorres_underlying t (filterM a b) (filterM a' b)\"\n by (induct b; wpsimp simp: filterM_def)\n\nlemma option_rec_bcorres_underlying[wp_split]:\n \"(\\x y. bcorres_underlying t (g x y) (g' x y)) \\\n (\\x. bcorres_underlying t (f x) (f' x)) \\\n bcorres_underlying t (rec_option f g a b) (rec_option f' g' a b)\"\n by (cases a, simp+)\n\nlemma bcorres_underlying_mapME[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\ bcorres_underlying t (mapME f r) (mapME f' r)\"\n by (induct r; wpsimp simp: mapME_def sequenceE_def)\n\nlemma handle2_bcorres_underlying[wp]:\n \"bcorres_underlying t f f' \\\n (\\x. bcorres_underlying t (g x) (g' x)) \\\n bcorres_underlying t (f g) (f' g')\"\n by (wpsimp simp: handleE'_def)\n\nlemma liftME_bcorres_underlying[wp]:\n \"bcorres_underlying t f f' \\ bcorres_underlying t (liftME a f) (liftME a f')\"\n by (wpsimp simp: liftME_def)\n\nlemma zipWithM_x_bcorres[wp]:\n \"(\\x y. bcorres_underlying t (f x y) (f' x y) ) \\\n bcorres_underlying t (zipWithM_x f xs ys) (zipWithM_x f' xs ys)\"\n by (wpsimp simp: zipWithM_x_def zipWith_def split_def)\n\nlemma mapME_x_bcorres_underlying[wp]:\n \"(\\x. bcorres_underlying t (f x) (f' x)) \\ bcorres_underlying t (mapME_x f xs) (mapME_x f' xs)\"\n by (induct xs; wpsimp simp: mapME_x_def sequenceE_x_def)\n\nlemma liftE_bind_bcorres[wp]:\n \"bcorres_underlying t (f >>= g) (f' >>= g') \\\n bcorres_underlying t (liftE f >>=E g) (liftE f' >>=E g')\"\n by (simp add: gets_def bcorres_underlying_def s_bcorres_underlying_def get_def bind_def return_def\n split_def liftE_def bindE_def lift_def)\n\nlemma select_f_bcorres[wp]: \"bcorres_underlying t (select_f f) (select_f f)\"\n by (fastforce simp: select_f_def bcorres_underlying_def s_bcorres_underlying_def)\n\nlemma bcorres_underlying_if[wp]:\n \"(b \\ bcorres_underlying t f f') \\\n (\\b \\ bcorres_underlying t g g') \\\n bcorres_underlying t (if b then f else g) (if b then f' else g')\"\n by (case_tac b; simp)\n\nlemma assert_opt_bcorres_underlying[wp]:\n \"bcorres_underlying t (assert_opt f) (assert_opt f)\"\n by (wpsimp simp: assert_opt_def)\n\nlemma unlessb_corres_underlying[wp]:\n \"bcorres_underlying t f f' \\ bcorres_underlying t (unless a f) (unless a f')\"\n by (wpsimp simp: unless_def)\n\nlemma select_bcorres_underlying[wp]:\n \"A \\ B \\ bcorres_underlying t (select A) (select B)\"\n by (fastforce simp: bcorres_underlying_def select_def s_bcorres_underlying_def)\n\nlemma catch_bcorres[wp]:\n \"bcorres_underlying t f f' \\\n (\\x. bcorres_underlying t (g x) (g' x)) \\\n bcorres_underlying t (f g) (f' g')\"\n unfolding catch_def by wpsimp\n\nlemma whenE_bcorres_underlying[wp]:\n \"\\ \\P = P'; P\\ \\ bcorres_underlying t f f'; P = P' \\ \\\n bcorres_underlying t (whenE P f) (whenE P' f')\"\n unfolding whenE_def by wpsimp\n\nlemma unlessE_bcorres[wp]:\n \"bcorres_underlying t f f' \\ bcorres_underlying t (unlessE P f) (unlessE P f')\"\n by (wpsimp simp: unlessE_def)\n\nlemma alternative_bcorres[wp]:\n \"\\ bcorres_underlying t f f'; bcorres_underlying t g g' \\ \\\n bcorres_underlying t (f \\ g) (f' \\ g')\"\n by (fastforce simp: alternative_def bcorres_underlying_def s_bcorres_underlying_def)\n\nlemma gets_the_bcorres_underlying[wp]:\n \"(\\s. f' (t s) = f s) \\ bcorres_underlying t (gets_the f) (gets_the f')\"\n by (wpsimp simp: gets_the_def)\n\nML \\\nstructure CrunchBCorresInstance : CrunchInstance =\nstruct\n val name = \"bcorres\";\n type extra = term;\n val eq_extra = ae_conv;\n fun parse_extra ctxt extra\n = case extra of\n \"\" => error \"bcorres needs truncate function\"\n | e =>(Syntax.parse_term ctxt \"%_. True\", Syntax.parse_term ctxt e);\n val has_preconds = false;\n fun mk_term _ body extra =\n (Syntax.parse_term @{context} \"bcorres_underlying\") $ extra $ body $ body;\n fun dest_term (Const (@{const_name \"bcorres_underlying\"}, _) $ extra $ body $ _)\n = SOME (Term.dummy, body, extra)\n | dest_term _ = NONE;\n fun put_precond _ ((v as Const (@{const_name \"bcorres_underlying\"}, _)) $ extra $ body $ body')\n = v $ extra $ body $ body'\n | put_precond _ _ = error \"put_precond: not an bcorres term\";\n val pre_thms = [];\n val wpc_tactic = WeakestPreCases.wp_cases_tac @{thms wpc_processors};\n fun wps_tactic _ _ _ = no_tac;\n val magic = Syntax.parse_term @{context}\n \"\\mapp_lambda_ignore. bcorres_underlying t_free_ignore mapp_lambda_ignore g_free_ignore\";\n val get_monad_state_type = get_nondet_monad_state_type;\nend;\n\nstructure CrunchBCorres : CRUNCH = Crunch(CrunchBCorresInstance);\n\\\n\nsetup \\\n add_crunch_instance \"bcorres\" (CrunchBCorres.crunch_x, CrunchBCorres.crunch_ignore_add_del)\n\\\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/BCorres_UL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.26317655700486653}} {"text": "chapter \\Semantic Formalization \\& Specification\\\n\nsection \\Core Monadic Language\\\n\ntext \\Notions of procedure and control flow combinator, which enable formalizing\nmost of imperative languages.\\\n\nsection \\Specifications on Fictional \\-SL\\\n\ntext \\\\begin{remark}[Source \\& Target]\nAs both ToA and view shift constitutes a morphism,\n\\[ \\X \\\\\\

\\\\\\\\ Y \\\\\\ P\\ \\]\n\\[ \\X \\\\\\\\\\\\ Y \\\\\\ P\\ \\]\nwe name the above \\X\\ and \\Y\\ as \\<^emph>\\source\\ and \\<^emph>\\target\\ respectively.\nWe also name the \\P\\ \\<^emph>\\side fact\\ as it is a side effect generated during the transformation.\n\\end{remark}\\\n\ntext \\\n\\begin{remark}[Multi-Term Form (MTF)]\n\\[ \\(x\\<^sub>1 \\ T\\<^sub>1) * \\ * (x\\<^sub>n \\ T\\<^sub>n) \\\\\\\\ a\\<^sub>1 \\ a\\<^sub>m. P\\ \\]\nWe call \\x\\<^sub>i \\ T\\<^sub>i\\ for \\1 \\ i \\ n\\ an \\<^emph>\\item\\ in the MTF.\n\\end{remark}\n\n\\begin{remark}[Simple Multi-Term Form]\nWe call a MTF that does not have any existence and conjunction as \\<^emph>\\simple MTF\\.\n\\[ \\(x\\<^sub>1 \\ T\\<^sub>1) * \\ * (x\\<^sub>n \\ T\\<^sub>n)\\ \\]\n\\end{remark}\n\\\n\n\n\nchapter \\Integrated Deduction Environment for Certified Programming\\\n\ntheory Chapter_System\n imports \"../IDE_CP\"\nbegin\n\ntext \\The major component for programming in \\-System is\nIntegrated Deduction Environment for Certified Programming (IDE-CP).\nThe environment is an extensible framework targeting on the core monadic language.\nProgramming features like mutable variable or any specific control flow like branches\nare added later to the environment as the framework and the core monadic language is extensible.\nThe chapter focuses on the core designs of the framework, and leaves\npluggable components to the later chapters.\n\n\nThe programming in \\-System primarily involves 3 (sorts of) Isar commands:\n\\<^item> A sort of declaration commands like @{command proc} that declare program elements and perhaps\n instantiates a proof context for certifying the element.\n\\<^item> Commands @{command \\} and @{command \\} that opens and closes respectively a programming context\n \\footnote{Here proof context is that in Isabelle, and programming context is invented by IDE-CP.}\n from a proof context or nestedly from another programming context.\n\\<^item> Command @{command \";;\"} that builds a statement in a programming context.\n\nSo the overall structure of the source code is very nature as demonstrated in the following example,\n\\\n\n(*TODO: give an example*)\n\ntext \\The source code begins with a declaration (@{command proc} here),\nopens and closes programming scope using @{command \\} and @{command \\} just like\nthe bracket \\<^verbatim>\\{\\ and \\<^verbatim>\\}\\ in usual languages like C,\nand separates statements by @{command \";;\"} just like \\<^verbatim>\\;\\ in C.\n\n\\begin{remarks}\nIndeed, the statement text is an argument of the command @{command \";;\"}.\nThere is an implicit @{command \";;\"} immediately after @{command \\}\nso one can write a statement text following @{command \\} and\nmakes the source more like @{command \";;\"} separates statements or ends a statement\ninstead of the actual fact that @{command \";;\"} leads a statement.\n\\end{remarks}\n\nIDE-CP is based on the theory of Calculus of Programming (CoP).\nWe introduce CoP briefly here and highly recommend readers to its paper~\\cite{CoP}.\nIn CoP, programming is identical to deducing a state sequent.\nOne may view the state sequent a specialized variant of Hoare triple which specifies and\ncertifies the returning state of evaluating the current program segment of the on-going\nconstruction, starting from an input state specified by a fixed pre-condition.\n\nCentering on deduction of the state sequent, IDE-CP is an environment\nequipped with various mechanical assistance including\nautomated reasoning, syntax and interactive interface, programming synthesis, and others.\n\nA feature of the IDE-CP is that the state sequent of the programming is instantly\ndisplayed in the output window of Isabelle.\nOnce can move the cursor onto each statement to inspect the computation state after\nexecuting each statement, which resembles a kind of symbolic execution.\nThe state involves the value of each variable and the state of resources over the abstraction\nlifted by the abstraction relations, i.e., an intuitive and intelligible abstraction enabling\nusers to grasp the value and the state very easily, such as expressions of natural numbers or lists,\ninstead of any complicated representation of the concrete computation model.\n\nBy inserting @{command \";;\"} in a statement to split it into two, one can inspect\nthe computation state after each operation.\nSpecifically and recalling @{command \";;\"} actually leads a statement,\nfor a statement \\C\\<^sub>1 \\ C\\<^sub>i C\\<^sub>i\\<^sub>+\\<^sub>1 \\ C\\<^sub>n ;;\\ consisting of \\n\\ operations, by inserting @{command \";;\"}\nbetween \\C\\<^sub>i\\ and \\C\\<^sub>i\\<^sub>+\\<^sub>1\\ (and moving the cursor before the inserted @{command \";;\"})\none can inspect the computation state after evaluating operations \\C\\<^sub>1 \\ C\\<^sub>i\\.\nWe highly recommend users to inspect in this way the change of the state step by step in\nour examples, which is very good for understanding the mechanism of the system.\n\nBefore we dive into more depth of the system, it is good to clarify from the very beginning that\nconstruction in the system actually involves three modes for constructing respectively\n\\<^item> procedures\n\\<^item> view shifts\n\\<^item> transformations of abstraction (\\-BI implications)\nwhich are both identical in the way of construction and therefore we mainly\ndiscuss using the procedure mode as an exemplar.\nThe differences in detail are presented in later sections \\cref{???} for the construction of\nthe each element.\n\nFor view-shift mode and transformation-of-abstraction mode, the programming or in another word\nthe construction is a forward deduction applying view-shifts or transformations-of-abstraction\nstepwisely from the initial view or the initial abstraction to the destined view or abstraction.\nThe following example demonstrates the such programming approach\\\n\n(*TODO: example*)\n\ntext \\\nAfter such a brief warm-up, now it is the time to start the journey and it begins from\nan overview of the whole mechanism.\n%we shall explore mechanisms of the system first.\n\\\n\nsection \\Overview of the Mechanism\\\n\ntext \\\nMentioned previously, programming in IDE-CP centers on state sequent.\nBecause the hypotheses of the state sequent is managed by the system internally, we only\nconsider its proposition excluding the hypotheses (i.e. \\P\\ in \\\\ \\ P\\) in the manual.\n\nThe proposition of the state sequent is represented in Heredity Harrop Formula (HHF) and\nthe deduction is proceeded in a manner of logic programming\n--- antecedents of the state sequent tells users what are the jobs required to do next in order,\nand premises of each antecedent give us, figuratively speaking,\navailable \\<^emph>\\resources\\ to complete the job.\n\nTo illustrate, a job can be either of\n\\<^item> a transformation of abstraction demanded to be reasoned, denoted by \\X \\\\\\

\\\\\\\\ Y \\\\\\ P\\\n\\<^item> a proof obligation intended to be solved by users, denoted by \\\\\\\\\\\\\\\\\\\\\\ P\\\n\\<^item> a parameter expected to be given by users, denoted by \\\\

\\\\\\\\ ?x\\\n\\<^item> a specification of a sub-procedure waiting for users programming it,\n denoted by \\\\

\\\\\\ ?F \\ X \\ Y \\\\\\\\\\\\ E \\\\.\nMore detailed elucidation are given later in \\cref{sec:antecedent-jobs}.\n\n\\begin{remark}\nSometimes, we name an antecedent as \\<^emph>\\antecedent job\\ to emphasize it is a job expecting\nresoners or users to do something.\n\\end{remark}\n\n\nReaders who are familiar with Isabelle may remember of another sequent that is also in HHF,\nthe internal representation of a proof state.\n\\[ \\A\\<^sub>1 \\ \\ \\ A\\<^sub>n \\ C\\ \\]\nAntecedents \\\\ \\ {A\\<^sub>i}\\<^sub>1\\<^sub>\\\\<^sub>i\\<^sub>\\\\<^sub>n\\ are subgoals for proving conclusion \\C\\.\nEach antecedent \\A\\<^sub>i \\ (\\x\\<^sub>i \\ x\\<^sub>l. P\\<^sub>1 \\ \\ \\ P\\<^sub>m \\ G\\<^sub>i)\\ may contains locally fixed variables\n\\{x\\<^sub>k}\\<^sub>1\\<^sub>\\\\<^sub>k\\<^sub>\\\\<^sub>l\\ and premises \\{P\\<^sub>j}\\<^sub>1\\<^sub>\\\\<^sub>j\\<^sub>\\\\<^sub>m\\ which are available during the proof of the proposition \\G\\<^sub>i\\.\n\nAntecedents \\\\\\ in a proof state sequent have the identical interpretation with that in\nstate sequents during programming.\nIndeed, one may even view such proof state sequent as a kind of state sequent in\nproof context, and the difference between them two is just how we name them\n\\footnote{We still need the name of state sequent because there is not the sequent of proof state\nin programming context.}.\n\nDeclaration commands like @{command proc} and others (except those requiring no proof nor programming)\nare indeed specialized proof goal statement like command @{command lemma} and @{command theorem},\nwhich initiates a standard Isabelle proof context having for examples the following proof states\ncorresponding to the three construction mode,\n\\[ \\\\

\\\\\\ ?F \\ X \\ Y \\\\\\\\\\\\ E \\ \\ \\

\\\\\\ ?F \\ X \\ Y \\\\\\\\\\\\ E \\\\ \\]\n\\[ \\X \\\\\\\\\\\\ Y \\\\\\ P \\ X \\\\\\\\\\\\ Y \\\\\\ P\\ \\]\n\\[ \\X \\\\\\

\\\\\\\\ Y \\\\\\ P \\ X \\\\\\

\\\\\\\\ Y \\\\\\ P\\ \\]\nwhere the only subgoal is exact the desired conclusion,\nand the subgoal is meantime also an antecedent job\nasking users respectively to program some procedure \\?F\\ satisfying the specification,\nto deduce the view shift from \\X\\ to \\Y\\,\nand to transform abstraction \\X\\ to \\Y\\ by forward deduction.\n\nCommand @{command \\} addresses the above three kinds of antecedent jobs, which opens a programming\ncontext allowing users to program or to deduce the desired construct.\nAnd the programming is deducing a state sequent.\n\nIn the programming, the proposition of a state sequent falls in two sorts of forms:\n\\<^item> \\<^emph>\\ready state\\ like \\<^prop>\\\\\\\\\\\\\\\\ state [R] \\\\\\\\\\\\\\ \\\\ P\\ representing the previous construction\n is finished, the computation state is now as specified by \\P\\, and the system is ready for\n the next construction.\n\\<^item> \\<^emph>\\pending state\\ like \\<^prop>\\\\ \\ \\

\\\\\\\\\\\\ F \\\\ state [R] \\\\\\\\\\\\\\ \\\\ Q \\\\\\\\\\\\ E\\\n is deduced after applying a procedure \\<^prop>\\\\ \\ \\

\\\\\\ F \\ P \\ Q \\ \\\\\\\\\\\\ E\\ on the ready state.\n It represents the application of \\F\\ is pending the finish of antecedent jobs \\\\\\.\n\n\\begin{remark}\nWe reuse the notation of \\<^emph>\\conjunction of aggreagted antecedents\\ in \\cite{CoP} where\na family \\\\ = {A\\<^sub>i}\\<^sub>1\\<^sub>\\\\<^sub>i\\<^sub>\\\\<^sub>n\\ of antecedents in \\\\ \\ C\\ denotes nested implications of the antecedents\nas \\A\\<^sub>1 \\ \\ \\ A\\<^sub>n \\ C\\.\n\\end{remark}\n\nThose antecedent jobs have various functions, like a transformation of abstraction or\na demanded annotation or even another sub-procedure waiting for programming\n(cf. control flow combinators).\nOnce all the pending jobs \\\\\\ are finished, meaning state sequent\n\\<^prop>\\\\

\\\\\\\\\\\\ F \\\\ state [R] \\\\\\\\\\\\\\ \\\\ Q \\\\\\\\\\\\ E\\ is deduced, the system accepts the procedure \\F\\\nand deduces the next state sequent in ready form \\<^prop>\\\\\\\\\\\\\\\\ state' [R] \\\\\\\\\\\\\\ \\\\ Q\\.\nThe \\state'\\ denotes the resulted state of evaluating procedure \\F\\.\n\nThe programming is then essentially a loop of switching between the ready state and the pending\nstate, where users apply a procedure on a ready state and\nfinishes the antecedent jobs on the pending state.\n\nAt last, @{command \\} closes the programming context, and obtains the resulted\nspecification theorem for the procedure or the view shift or the transformation.\nThen using the theorem, it solves the antecedent which the corresponding @{command \\} targets.\n\nThis is the overview of the deductive programming in the logic programming manner.\nNext we will dive into specific usages of each command and and each antecedent jobs.\n\\\n\nsection \\Overall Structure of Programs\\\n\nsubsection \\Declarative Commands\\\n\nsubsubsection \\Procedure\\\n\nsubsubsection \\Transformation of Abstraction (ToA) \\& View Shift\\\n\ntext \\Because their roles are in purely theoretical level serving for proofs and deductions,\ninstead of any specific program element or pragmatic usage,\ntherefore we do not involve a specialized command to declare them.\nWe use standard goal statement commands in Isar directly,\nlike @{command lemma} and @{command theorem}, where the desired transformation or the view shift\nis given in the goal statement directly together with any assumptions as antecedents.\\\n\nlemma example:\n assumes A: \\x \\ T \\\\\\

\\\\\\\\ y \\ U \\\\\\ P\\\n and B: \\y \\ U \\\\\\

\\\\\\\\ z \\ Z \\\\\\ Q\\\n shows \\x \\ T \\\\\\

\\\\\\\\ z \\ Z \\\\\\ P \\ Q\\\n \\ A B \\. .\n\ntext \\Recalling the sequent of the Isar proof state\n\\x \\ T \\\\\\

\\\\\\\\ z \\ Z \\\\\\ P \\ Q \\ x \\ T \\\\\\

\\\\\\\\ z \\ Z \\\\\\ P \\ Q\\\nwhere the only sub-goal is also an antecedent, the sub-goal as an antecedent is opened by\n@{command \\} by which we enter the programming mode where we can deduce the transformation\nforwardly and stepwisely by applying the transformation \\A\\ first and then \\B\\.\n\\\n(*Explain \\. and \\ and the last . after \\.*)\n\nsubsection \\Commands Opening and Closing Programming Context\\\n\nsubsection \\The Command Writing Statements\\\n\nsection \\Antecedent Jobs for User Input\\\n\ntext \\Antecedent jobs can be classified in two sorts\n\\<^item> programming job for user input\n\\<^item> reasoning job for a specific problem, invoking the related reasoning process\\\n\ntext \\The section introduces the first sort that for user input, and leaves that about\nreasoning to \\cref{sec:reasoning}.\\\n\nsubsection \\Parameter\\\n\nsubsection \\Rule as an Argument\\\n\nsubsection \\Label of Text\\\n\n\n\nsection \\Applying Procedures \\& Other Constructs\\\n\nparagraph \\Procedure\\\n\nparagraph \\View Shift\\\n\nparagraph \\Transformation of Abstraction\\\n\nparagraph \\Meta Operation\\\ntext \\is a bundle of operations \\\n\nsubsubsection \\Extend by User Specified Application Method\\\n\nsection \\Program Synthesis\\\n\nsection \\Reasoning \\label{sec:reasoning}\\\n\n\nsection \\Access Value or Variable\\\n\n(*Notice*)\ntext \\Internal representation of the values and their names are hidden by default during the\n programming, but you can turn on @{attribute \\display_value_internal_name} to display them.\\\n\ntext \\By default, remaining values in the previous statement will be removed in the successive\n statement. You can turn off @{attribute \\statement_clean_values} to disable this behavior.\\\n\n\n(*Unsorted*)\n\nsubsection \\Options enabling Expert Display\\\n\ntext \\\n\\<^descr> @{attribute \\display_value_internal_name} enables the display of internal names of values.\n By turning on this option, values will be displayed as \\<^term>\\x \\ \\\\\\[internal] T\\\n by contrast to the default display \\<^term>\\x \\ \\\\\\ T\\.\n This \\<^term>\\internal\\ is the internal semantic representation of value.\n\\<^descr> \\display_brk_frame displays the internal and technical separation items for breaking frame.\n\\\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/User_Manual/Chapter_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.263176549773106}} {"text": "(* Authors: Gerwin Klein and Rafal Kolanski, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\ntheory Sep_Tactics_Test\nimports \"../Sep_Tactics\"\nbegin\n\ntext \\Substitution and forward/backward reasoning\\\n\ntypedecl p\ntypedecl val\ntypedecl heap\n\naxiomatization where heap_sep_algebra: \"OFCLASS(heap, sep_algebra_class)\"\ninstance heap :: sep_algebra by (rule heap_sep_algebra)\n\naxiomatization\n points_to :: \"p \\ val \\ heap \\ bool\" and\n val :: \"heap \\ p \\ val\"\nwhere\n points_to: \"(points_to p v ** P) h \\ val h p = v\"\n\n\nlemma\n \"\\ Q2 (val h p); (K ** T ** blub ** P ** points_to p v ** P ** J) h \\\n \\ Q (val h p) (val h p)\"\n apply (sep_subst (2) points_to)\n apply (sep_subst (asm) points_to)\n apply (sep_subst points_to)\n oops\n\nlemma\n \"\\ Q2 (val h p); (K ** T ** blub ** P ** points_to p v ** P ** J) h \\\n \\ Q (val h p) (val h p)\"\n apply (sep_drule points_to)\n apply simp\n oops\n\nlemma\n \"\\ Q2 (val h p); (K ** T ** blub ** P ** points_to p v ** P ** J) h \\\n \\ Q (val h p) (val h p)\"\n apply (sep_frule points_to)\n apply simp\n oops\n\nconsts\n update :: \"p \\ val \\ heap \\ heap\"\n\nschematic_goal\n assumes a: \"\\P. (stuff p ** P) H \\ (other_stuff p v ** P) (update p v H)\"\n shows \"(X ** Y ** other_stuff p ?v) (update p v H)\"\n apply (sep_rule a)\n oops\n\n\ntext \\Example of low-level rewrites\\\n\nlemma \"\\ unrelated s ; (P ** Q ** R) s \\ \\ (A ** B ** Q ** P) s\"\n apply (tactic \\dresolve_tac @{context} [mk_sep_select_rule @{context} true (3, 1)] 1\\)\n apply (tactic \\resolve_tac @{context} [mk_sep_select_rule @{context} false (4, 2)] 1\\)\n (* now sep_conj_impl1 can be used *)\n apply (erule (1) sep_conj_impl)\n oops\n\n\ntext \\Conjunct selection\\\n\nlemma \"(A ** B ** Q ** P) s\"\n apply (sep_select 1)\n apply (sep_select 3)\n apply (sep_select 4)\n oops\n\nlemma \"\\ also unrelated; (A ** B ** Q ** P) s \\ \\ unrelated\"\n apply (sep_select_asm 2)\n oops\n\n\nsection \\Test cases for \\sep_cancel\\.\\\n\nlemma\n assumes forward: \"\\s g p v. A g p v s \\ AA g p s \"\n shows \"\\xv yv P s y x s. (A g x yv ** A g y yv ** P) s \\ (AA g y ** sep_true) s\"\n by (sep_cancel add: forward)\n\nlemma\n assumes forward: \"\\s. generic s \\ instance s\"\n shows \"(A ** generic ** B) s \\ (instance ** sep_true) s\"\n by (sep_cancel add: forward)\n\nlemma \"\\ (A ** B) sa ; (A ** Y) s \\ \\ (A ** X) s\"\n apply (sep_cancel)\n oops\n\nlemma \"\\ (A ** B) sa ; (A ** Y) s \\ \\ (\\s. (A ** X) s) s\"\n apply (sep_cancel)\n oops\n\nschematic_goal \"\\ (B ** A ** C) s \\ \\ (\\s. (A ** ?X) s) s\"\n by (sep_cancel)\n\n(* test backtracking on premises with same state *)\nlemma\n assumes forward: \"\\s. generic s \\ instance s\"\n shows \"\\ (A ** B) s ; (generic ** Y) s \\ \\ (X ** instance) s\"\n apply (sep_cancel add: forward)\n oops\n\nlemma\n assumes forward: \"\\s. generic s \\ instance s\"\n shows \"generic s \\ instance s\"\n by (sep_cancel add: forward)\n\nlemma\n assumes forward: \"\\s. generic s \\ instance s\"\n assumes forward2: \"\\s. instance s \\ instance2 s\"\n shows \"generic s \\ (instance2 ** sep_true) s\"\n by (sep_cancel_blast add: forward forward2)\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Separation_Algebra/ex/Sep_Tactics_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.566018549837479, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2631429132459306}} {"text": "theory flash57Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_Get )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv2) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Put2VsInv57: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv57: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv57: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv57 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash57Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2631429064391312}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoareTotalDef.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Hoare Logic for Total Correctness\\\n\ntheory HoareTotalDef imports HoarePartialDef Termination begin \n\nsubsection \\Validity of Hoare Tuples: \\\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\ndefinition\n validt :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A \\ (\\s \\ Normal ` P. \\\\c\\s)\"\n\ndefinition\n cvalidt::\n \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_,_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60, 60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n\nnotation (ASCII)\n validt (\"_|=t'/_/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60) and\n cvalidt (\"_,_|=t'/_ / _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\n\nsubsection \\Properties of Validity\\\n\nlemma validtI: \n \"\\\\s t. \\\\\\\\c,Normal s\\ \\ t;s \\ P;t \\ Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. s \\ P \\ \\\\ c\\(Normal s) \\\n \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: validt_def valid_def)\n\nlemma cvalidtI: \n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P; \n t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A; s\\P\\ \\ \\\\c\\(Normal s)\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_postD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s \\ \\ t;\n s \\ P;t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_termD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;s \\ P\\ \n \\ \\\\c\\(Normal s)\"\n by (simp add: cvalidt_def validt_def valid_def)\n\n\nlemma validt_augment_Faults:\n assumes valid:\"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n using valid F'\n by (auto intro: valid_augment_Faults simp add: validt_def)\n\nsubsection \\The Hoare Rules: \\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\\\\n\ninductive \"hoaret\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \n => bool\"\n (\"(3_,_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,_))\" [61,60,60,1000,20,1000,1000]60) \n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ Q} (Basic f) Q,A\"\n\n| Spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} (Spec r) Q,A\"\n\n| Seq: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n \n| Cond: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c\\<^sub>1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c\\<^sub>2 Q,A\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\wf r; \\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t,\\)\\r} \\ P),A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n\n| Guard: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n\n| Guarantee: \"\\f \\ F; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec: \n \"\\(P,p,Q,A) \\ Specs;\n wf r; \n Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s,q),(\\,p)) \\ r},q,Q,A)) ` Specs);\n \\(P,p,Q,A)\\ Specs. \n p \\ dom \\ \\ (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\n \\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| DynCom: \"\\s \\ P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n\n| Throw: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"(P,p,Q,A) \\ \\ \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| ExFalso: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n \\ \\This is a hack rule that enables us to derive completeness for\n an arbitrary context \\\\\\, from completeness for an empty context.\\\n\n \ntext \\Does not work, because of rule ExFalso, the context \\\\\\ is to blame.\n A weaker version with empty context can be derived from soundness \n later on.\\\nlemma hoaret_to_hoarep:\n assumes hoaret: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing hoaret\nproof (induct)\n case Skip thus ?case by (rule hoarep.intros)\nnext\n case Basic thus ?case by (rule hoarep.intros)\nnext\n case Seq thus ?case by - (rule hoarep.intros)\nnext\n case Cond thus ?case by - (rule hoarep.intros)\nnext\n case (While r \\ F P b c A)\n hence \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\"\n by (rule HoarePartialDef.conseq) blast\n then show \"\\,\\\\\\<^bsub>/F\\<^esub> P While b c (P \\ - b),A\"\n by (rule hoarep.While)\nnext\n case Guard thus ?case by - (rule hoarep.intros)\n(*next\n case (CallRec A F P Procs Q Z \\ p r)\n hence hyp: \"\\p\\Procs. \\\\ Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\p\\Procs. \\Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n (P p Z) (the (\\ p)) (Q p Z),(A p Z)\" \n proof (intro ballI allI)\n fix p Z\n assume \"p \\ Procs\"\n with hyp\n have hyp': \"\\ \\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z, A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\\\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n (is \"\\\\. \\,?\\'\\\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\")\n proof (rule allI, rule WeakenContext [OF hyp'],clarify)\n fix \\ P' c Q' A'\n assume \"(P', c, Q', A') \\ \\ \\\n (\\q\\Procs.\n \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,\n A q Z)})\" (is \"(P', c, Q', A') \\ \\ \\ ?Spec\")\n then show \"\\,?\\'\\\\<^bsub>/F\\<^esub> P' c Q',A'\"\n proof (cases rule: UnE [consumes 1])\n assume \"(P',c,Q',A') \\ \\\" \n then show ?thesis\n by (blast intro: HoarePartialDef.Asm)\n next\n assume \"(P',c,Q',A') \\ ?Spec\" \n then show ?thesis\n proof (clarify)\n fix q Z\n assume q: \"q \\ Procs\"\n show \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z \\ {s. ((s, q), \\, p) \\ r}) \n Call q \n (Q q Z),(A q Z)\"\n proof -\n from q\n have \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z) Call q (Q q Z),(A q Z)\"\n by - (rule HoarePartialDef.Asm,blast)\n thus ?thesis\n by (rule HoarePartialDef.conseqPre) blast\n qed\n qed\n qed\n qed\n then show \"\\,\\ \\ (\\q\\Procs. \\Z. {(P q Z, Call q, Q q Z,A q Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by (rule HoarePartialDef.conseq) blast\n qed\n thus ?case\n by - (rule hoarep.CallRec)*)\nnext\n case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n case Throw thus ?case by - (rule hoarep.Throw)\nnext\n case Catch thus ?case by - (rule hoarep.Catch)\nnext\n case Conseq thus ?case by - (rule hoarep.Conseq,blast)\nnext\n case Asm thus ?case by (rule HoarePartialDef.Asm)\nnext\n case (ExFalso \\ F P c Q A)\n assume \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n oops\n\n\nlemma hoaret_augment_context: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\\\'. \\ \\ \\' \\ \\,\\'\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n case (CallRec P p Q A Specs r Specs_wf \\ F \\')\n have aug: \"\\ \\ \\'\" by fact\n then\n have h: \"\\\\ p. \\ \\ Specs_wf p \\\n \\ \\' \\ Specs_wf p \\\"\n by blast\n have \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A \\\n (\\x. \\ \\ Specs_wf p \\\n \\ x \\\n \\,x\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A))\" by fact\n hence \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\ \n (\\\\. \\,\\'\\ Specs_wf p \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\"\n apply (clarify)\n apply (rename_tac P p Q A)\n apply (drule (1) bspec)\n apply (clarsimp)\n apply (erule_tac x=\\ in allE)\n apply clarify\n apply (erule_tac x=\"\\' \\ Specs_wf p \\\" in allE)\n apply (insert aug)\n apply auto\n done\n with CallRec show ?case by - (rule hoaret.CallRec)\nnext\n case DynCom thus ?case by (blast intro: hoaret.DynCom)\nnext\n case (Conseq P \\ F c Q A \\')\n from Conseq\n have \"\\s \\ P. (\\P' Q' A'. (\\,\\' \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\"\n by blast\n with Conseq show ?case by - (rule hoaret.Conseq)\nnext\n case (ExFalso \\ F P c Q A \\')\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\ \\'\" by fact+\n then show ?case\n by (fastforce intro: hoaret.ExFalso simp add: cvalidt_def)\nqed (blast intro: hoaret.intros)+\n\nsubsection \\Some Derived Rules\\\n\n\nlemma Conseq': \"\\s. s \\ P \\ \n (\\P' Q' A'. \n (\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\\n (\\Z. s \\ P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)))\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q)\\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq) blast\n\ntheorem conseqPrePost: \n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where ?P'=\"\\Z. P'\" and ?Q'=\"\\Z. Q'\"]) auto\n\nlemma conseqPre: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A \\ P \\ P' \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq) auto\n\n\nlemma Spec_wf_conv: \n \"(\\(P, q, Q, A). (P \\ {s. ((s, q), \\, p) \\ r}, q, Q, A)) `\n (\\p\\Procs. \\Z. {(P p Z, p, Q p Z, A p Z)}) = \n (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r}, q, Q q Z, A q Z)})\"\n by (auto intro!: image_eqI)\n\nlemma CallRec': \n \"\\p\\Procs; Procs \\ dom \\;\n wf r; \n \\p\\Procs. \\\\ Z. \n \\,\\\\(\\q\\Procs. \\Z. \n {((P q Z) \\ {s. ((s,q),(\\,p)) \\ r},q,Q q Z,(A q Z))})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ (P p Z)) (the (\\ p)) (Q p Z),(A p Z)\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)}\" and\n r=r])\napply blast\napply assumption\napply (rule refl)\napply (clarsimp)\napply (rename_tac p')\napply (rule conjI)\napply blast\napply (intro allI)\napply (rename_tac Z \\)\napply (drule_tac x=p' in bspec, assumption)\napply (erule_tac x=\\ in allE)\napply (erule_tac x=Z in allE)\napply (fastforce simp add: Spec_wf_conv)\ndone\n\nend\n\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoareTotalDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.26298433478565963}} {"text": "theory Final_ML\n imports Semantics_Final\nbegin\n\nML \\\nval pwriteln = Pretty.writeln\nval pretty_term = Syntax.pretty_term\n\\\n\\ \\temporal logic expression\\\nML \\\nfun tempval ctxt temp v p = \n let val fun_h1 = nth (v |> Thm.term_of |> Term.strip_comb |> snd) 1\n val fun_h2 = nth (v |> Thm.term_of |> Term.strip_comb |> snd) 2\n val ch1 = Thm.cterm_of ctxt fun_h1\n val ch2 = Thm.cterm_of ctxt fun_h2\n in\n case temp of\n Const (@{const_name \"Before\"}, _) $ event $ n =>\n let\n val cevent = Thm.cterm_of @{context} event\n val cn = Thm.cterm_of @{context} n\n val before_th = @{thm Before};\n val args = before_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val idp = nth args 2 |> Term.dest_Var\n val idE = hd args |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idn = hd args |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val idh1 = nth (tl args |> hd |> Term.strip_comb |> snd) 1 |> Term.dest_Var\n val idh2 = nth (tl args |> hd |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val th1 = before_th |> Drule.instantiate_normalize ([], [(idE, cevent), (idp, p), \n (idn, cn), (idh1, ch1), (idh2, ch2)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs;\n val rhs2 = th2 |> Thm.rhs_of\n val b1 = (Thm.term_of rhs2 aconv @{term True})\n val b2 = (Thm.term_of rhs2 aconv @{term False})\n in\n (if b1 then true else (if b2 then false \n else (raise TERM (\"Expression can't be simplified!\", []))))\n (*Thm.term_of rhs2 aconv @{term True}*)\n end\n | Const (@{const_name \"After\"}, _) $ event $ n =>\n let\n val cevent = Thm.cterm_of @{context} event\n val cn = Thm.cterm_of @{context} n\n val after_th = @{thm After};\n val args = after_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val idp = nth args 2 |> Term.dest_Var\n val idE = hd args |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idn = hd args |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val idh1 = nth (tl args |> hd |> Term.strip_comb |> snd) 1 |> Term.dest_Var\n val idh2 = nth (tl args |> hd |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val th1 = after_th |> Drule.instantiate_normalize ([], [(idE, cevent), (idp, p), \n (idn, cn), (idh1, ch1), (idh2, ch2)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs;\n val rhs2 = th2 |> Thm.rhs_of\n val b1 = (Thm.term_of rhs2 aconv @{term True})\n val b2 = (Thm.term_of rhs2 aconv @{term False})\n in\n (if b1 then true else (if b2 then false \n else (raise TERM (\"Expression can't be simplified!\", []))))\n (*Thm.term_of rhs2 aconv @{term True}*)\n end\n | Const (@{const_name \"At\"}, _) $ event $ n =>\n let\n val cevent = Thm.cterm_of @{context} event\n val cn = Thm.cterm_of @{context} n\n val at_th = @{thm At};\n val args = at_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val idp = nth args 2 |> Term.dest_Var\n val idE = hd args |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idn = hd args |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val idh1 = nth (tl args |> hd |> Term.strip_comb |> snd) 1 |> Term.dest_Var\n val idh2 = nth (tl args |> hd |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val th1 = at_th |> Drule.instantiate_normalize ([], [(idE, cevent), (idp, p), \n (idn, cn), (idh1, ch1), (idh2, ch2)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs;\n val rhs2 = th2 |> Thm.rhs_of\n val b1 = (Thm.term_of rhs2 aconv @{term True})\n val b2 = (Thm.term_of rhs2 aconv @{term False})\n in\n (if b1 then true else (if b2 then false \n else (raise TERM (\"Expression can't be simplified!\", []))))\n (*Thm.term_of rhs2 aconv @{term True}*)\n end\n | Const (@{const_name \"Every\"}, _) $ event $ n =>\n let\n val cevent = Thm.cterm_of @{context} event\n val cn = Thm.cterm_of @{context} n\n val every_th = @{thm Every};\n val args = every_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val idp = nth args 2 |> Term.dest_Var\n val idE = hd args |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idn = hd args |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val idh1 = nth (tl args |> hd |> Term.strip_comb |> snd) 1 |> Term.dest_Var\n val idh2 = nth (tl args |> hd |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val th1 = every_th |> Drule.instantiate_normalize ([], [(idE, cevent), (idp, p), \n (idn, cn), (idh1, ch1), (idh2, ch2)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs;\n val rhs2 = th2 |> Thm.rhs_of\n val b1 = (Thm.term_of rhs2 aconv @{term True})\n val b2 = (Thm.term_of rhs2 aconv @{term False})\n in\n (if b1 then true else (if b2 then false \n else (raise TERM (\"Expression can't be simplified!\", []))))\n (*Thm.term_of rhs2 aconv @{term True}*)\n end\n | _ => raise TERM (\"Not supported\", [temp])\n end\n\\\n\n\\ \\evaluation for update_vals2\\\nML \\\nfun evaluate_update_vals ctxt a1 a2 v = \n if a1 aconvc @{cterm \"No_Expr\"} then\n let\n val Update_NoExpr_th1 = @{thm Update_NoExpr1}\n val args = Update_NoExpr_th1 |> Thm.concl_of \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val ida2 = nth args 1 |> Term.dest_Var\n val idv = nth args 2 |> Term.dest_Var\n in\n Update_NoExpr_th1 |> Drule.instantiate_normalize ([], [(ida2, a2), (idv, v)])\n end\n else if a2 aconvc @{cterm \"No_Expr\"} then\n let\n val Update_NoExpr_th2 = @{thm Update_NoExpr2}\n val args = Update_NoExpr_th2 |> Thm.concl_of \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val ida1 = nth args 0|> Term.dest_Var\n val idv = nth args 2 |> Term.dest_Var\n in\n Update_NoExpr_th2 |> Drule.instantiate_normalize ([], [(ida1, a1), (idv, v)])\n end\n else\n let\n val Update_aexp2_th = @{thm Update_exp2}\n val args = Update_aexp2_th |> Thm.concl_of \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val ida1 = nth args 0 |> Term.dest_Var\n val ida2 = nth args 1 |> Term.dest_Var\n val idv = nth args 2 |> Term.dest_Var\n val th1 = Update_aexp2_th |> Drule.instantiate_normalize ([], [(ida1, a1), \n (ida2, a2), (idv, v)])\n val th2 = asm_full_simplify ctxt th1\n val a1_1 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd |> hd |>\n Thm.cterm_of ctxt\n val ida1_1 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd |> tl |> hd |>\n Term.dest_Var\n val a2_1 = th2 |> Thm.prems_of |> tl |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd |> hd |>\n Thm.cterm_of ctxt\n val ida2_1 = th2 |> Thm.prems_of |> tl |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd |> tl |> hd |>\n Term.dest_Var\n val a1_2 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd \n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val ida1_2 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd \n |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val a2_2 = th2 |> Thm.prems_of |> tl |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd \n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val ida2_2 = th2 |> Thm.prems_of |> tl |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd \n |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th3 = th2 |> Drule.instantiate_normalize ([], [(ida1_1, a1_1), (ida1_2, a1_2),\n (ida2_1, a2_1), (ida2_2, a2_2)])\n val th4 = asm_full_simplify ctxt th3\n val th5 = @{thm refl} RS th4\n val v2 = th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> tl |> hd |> Thm.cterm_of ctxt\n val th_update = evaluate_update_vals ctxt a1_2 a2_2 v2\n in\n th_update RS th5\n end\n\\\n\n\n\\ \\evaluation for some simple actions\\\nML \\\nfun evaluate_skip env e p s = \n let\n val skip_th = @{thm Skip}\n val args = skip_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n in\n skip_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e),\n (idp, p), (ids, s)])\n end\n\\\n\nML \\\nval ctxt = @{context}\nfun evaluate_assign ctxt env x a e p s = \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val assign_th = @{thm Assign}\n val args = assign_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idx = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ida = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = assign_th |> Drule.instantiate_normalize ([], [(idenv, env),(idv, v), (idp, p), \n (ide, e), (idI, I), (idx, x), (ida, a)])\n val th2 = [@{thm refl}, @{thm refl}] MRS th1\n in\n asm_full_simplify ctxt th2\n end\n\\\n\nML \\\nfun evaluate_On1 ctxt env temp as1 e p s = \n let\n val ON1_th = @{thm On1}\n val args = ON1_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val x = as1 |> Thm.dest_arg1\n val a = as1 |> Thm.dest_arg\n val th_assign = evaluate_assign ctxt env x a e p s\n val th1 = ON1_th |> Drule.instantiate_normalize ([], [(idenv, env), (idt, temp), \n (idas, as1), (ide, e), (idp, p), (ids, s)]);\n val th2 = asm_full_simplify ctxt th1\n in\n [th_assign] MRS th2\n end;\n\nfun evaluate_On2 ctxt env temp as1 e p s = \n let\n val ON2_th = @{thm On2}\n val args = ON2_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = ON2_th |> Drule.instantiate_normalize ([], [(idenv, env),(idt, temp), (idas, as1), \n (ide, e), (idp, p),(ids, s)])\n in\n asm_full_simplify ctxt th1\n end\n\nfun evaluate_On3 ctxt env event as1 e p s = \n let\n val ON3_th = @{thm On3}\n val args = ON3_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val x = as1 |> Thm.dest_arg1\n val a = as1 |> Thm.dest_arg\n val _ = pwriteln (pretty_term ctxt (Thm.term_of as1))\n val th_assign = evaluate_assign ctxt env x a e p s\n val th1 = ON3_th |> Drule.instantiate_normalize ([], [(idenv, env),(idt, event), (idas, as1), \n (ide, e), (idp, p),(ids, s)])\n val th2 = asm_full_simplify ctxt th1\n in\n th_assign RS th2\n end\n\nfun evaluate_On4 ctxt env event as1 e p s = \n let\n val ON4_th = @{thm On4}\n val args = ON4_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = ON4_th |> Drule.instantiate_normalize ([], [(idenv, env),(idt, event), (idas, as1), \n (ide, e), (idp, p),(ids, s)])\n in\n asm_full_simplify ctxt th1\n end\n\\\n\n\nML \\\nfun evaluate_Print1 ctxt env message e p s = \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val print1_th = @{thm Print1}\n val args = print1_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idmessage = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = print1_th |> Drule.instantiate_normalize ([], [(idenv, env),(idv, v), (idp, p), \n (idmessage, message), (idI, I), (ide, e)])\n val th2 = [@{thm refl},@{thm refl}] MRS th1\n in\n asm_full_simplify ctxt th2\n end;\n\nfun evaluate_Print2 ctxt env message e p s = \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val print2_th = @{thm Print2}\n val args = print2_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idmessage = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = print2_th |> Drule.instantiate_normalize ([], [(idenv, env),(idv, v), (idp, p), \n (idmessage, message), (idI, I), (ide, e)])\n val th2 = [@{thm refl}, @{thm refl}] MRS th1\n in\n asm_full_simplify ctxt th2\n end\n\\\n\nML \\\nfun evaluate_Send5 ctxt env msg e p s = \nlet\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val send5_th = @{thm Send5}\n val args = send5_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idmsg = nth args 1 |> Term.dest_comb |> snd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = send5_th |> Drule.instantiate_normalize ([], [(idenv, env),(idv, v), (idp, p), \n (idmsg, msg), (idI, I), (ide, e)])\n val th2 = @{thm refl} RS th1\nin\n asm_full_simplify ctxt th2\nend\n\\\n\nML \\\nfun evaluate_al1 env e p s = \n let\n val al1_th = @{thm ActionList_Execution1}\n val args = al1_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n (*val ida = args |> hd |> Term.strip_comb |> snd |> hd |> Term.dest_Var*)\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4|> Term.dest_Var\n in\n al1_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e), \n (idp, p), (ids, s)])\n end\n\\\n\n\\ \\Enable\\\nML \\\nfun enable_ML ctxt t e s p = \n let\n val condition = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 1 \n val c = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 2 |> (Thm.cterm_of ctxt)\n val src = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 0 |> Thm.cterm_of ctxt\n val a1 = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val a2 = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val trg = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n in\n case condition of\n Const (@{const_name \"S\"}, _) $_ =>\n let\n val enable1_th = @{thm Enable1}\n val str = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 1 |> Term.dest_comb\n |> snd |> (Thm.cterm_of ctxt)\n val args = enable1_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb |> snd;\n val ide = nth args 0 |> Term.strip_comb |> snd |> tl \n |> hd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idstr = nth args 0 |> Term.strip_comb |> snd |> tl \n |> hd |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val idc = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ids = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idp = nth (nth args 1 |> Term.strip_comb |> snd) 2 |> Term.dest_Var;\n val th1 = enable1_th |> Drule.instantiate_normalize ([], [(idstr,str),(ids, s), (idp, p), \n (ide,e),(idc, c)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs;\n val rhs2 = th2 |> Thm.rhs_of\n in\n Thm.term_of rhs2 aconv @{term True}\n end\n | Const (@{const_name \"T1\"}, _) $temp' =>\n let\n val enable2_th = @{thm Enable2}\n val temp = Thm.cterm_of ctxt temp'\n val args = enable2_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb |> snd;\n val idtemp = nth args 0 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idc = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ids = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idp = nth (nth args 1 |> Term.strip_comb |> snd) 2 |> Term.dest_Var;\n val th1 = enable2_th |> Drule.instantiate_normalize ([], [(idtemp,temp),(ids, s), (idp, p), \n (idc, c)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs\n val rhs2 = th2 |> Thm.rhs_of\n in\n Thm.term_of rhs2 aconv @{term True}\n end\n | Const (@{const_name \"M\"}, _) $msg' =>\n let\n val enable3_th = @{thm Enable3}\n val msg = Thm.cterm_of ctxt msg'\n val args = enable3_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb |> snd\n val idmsg = nth args 0 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ids = nth args 0 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idc = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idp = nth args 1 |> Term.strip_comb |> snd |> tl |> tl |> hd |> Term.dest_Var\n val idsrc = nth (nth args 1 |> Term.strip_comb |> snd |> tl |> hd \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd \n |> hd |> Term.strip_comb |> snd) 0 |> Term.dest_Var\n val ida1 = nth (nth args 1 |> Term.strip_comb |> snd |> tl |> hd \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd \n |> hd |> Term.strip_comb |> snd) 3 |> Term.dest_Var\n val ida2 = nth (nth args 1 |> Term.strip_comb |> snd |> tl |> hd \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd \n |> hd |> Term.strip_comb |> snd) 4 |> Term.dest_Var\n val idtrg = nth (nth args 1 |> Term.strip_comb |> snd |> tl |> hd \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd \n |> hd |> Term.strip_comb |> snd) 5 |> Term.dest_Var\n val th1 = enable3_th |> Drule.instantiate_normalize ([], [(idmsg,msg),(ids, s),\n (idc, c), (idp, p), (idsrc, src), (ida1, a1), (ida2, a2), (idtrg, trg)])\n val th1' = th1 RS @{thm eq_reflection}\n val rhs = th1' |> Thm.rhs_of\n val th2 = Simplifier.asm_full_rewrite ctxt rhs\n val rhs2 = th2 |> Thm.rhs_of\n in\n Thm.term_of rhs2 aconv @{term True}\n end\n | _ => raise TERM (\"Not supported\", [condition])\n end\n\\\n\nML\\\nval ctxt = @{context}\nval t = @{cterm \"Trans (P [''A'']) (M ''a'') \n((V ''x'') [>] (V ''y'')) SKIP SKIP (P [''B''])\"}\nval e = @{cterm \"''E''\"}\nval s = @{cterm \"Status v I \"}\nval p = @{cterm \"[''A'']\"}\nval condition = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\nval src = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 0 |> Thm.cterm_of ctxt\nval a1 = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\nval a2 = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\nval trg = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt;\nval res = enable_ML ctxt t e s p\n\\\n\n\nML \\\nfun evaluate_Fail ctxt env t e p s = \n let\n val Fail_th = @{thm Fail}\n val args = Fail_th |> Thm.concl_of |> Term.strip_comb |> snd |> hd \n |> Term.strip_comb |> snd \n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = Fail_th |> Drule.instantiate_normalize ([], [(idt,t), (idp, p), \n (idenv, env), (ids, s), (ide, e)])\n val th2 = asm_full_simplify ctxt th1\n in\n @{thm refl} RS th2\n end\n\\\n\nML \\\nfun evaluate_Termination env e p s = \n let\n val Term_th = @{thm Termination}\n val args = Term_th |> Thm.concl_of |> Term.strip_comb |> snd |> hd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n in\n Term_th |> Drule.instantiate_normalize ([], [(idp, p), \n (idenv, env), (ids, s), (ide, e)])\n end\n\\\n\n\n\nML \\\nfun evaluate_No_Composition_Exit env name e s = \n let\n val No_Composition_Exit_th = @{thm No_Composition_Exit}\n val args = No_Composition_Exit_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n in\n No_Composition_Exit_th |> Drule.instantiate_normalize ([], [(idenv, env), (idname, name),\n (ide, e), (ids, s)])\n end\n\\\n\nML \\\nfun evaluate_No_State_Exit ctxt env e s = \n let\n val No_State_Exit_th = @{thm State_Exit2}\n val args = No_State_Exit_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val ids = nth args 3 |> Term.dest_Var\n val th1 = No_State_Exit_th |> Drule.instantiate_normalize ([], [(idenv, env),(ide, e), \n (ids, s)])\n in\n asm_full_simplify ctxt th1\n end\n\\\n\nML \\\nfun evaluate_State_Exit3 ctxt env ST e s = \n let\n val State_Exit3_th = @{thm State_Exit3}\n val args = State_Exit3_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val ids = nth args 3 |> Term.dest_Var\n val th1 = State_Exit3_th |> Drule.instantiate_normalize ([], [(idST,ST),(idenv, env), \n (ide, e), (ids, s)])\n val th2 = @{thm refl} RS th1\n in\n asm_full_simplify ctxt th2\n end\n\\\n\nML \\\nfun evaluate_No_State_Entry env e p s = \nlet\n val No_State_Entry_th = @{thm State_Entry2}\n val args = No_State_Entry_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb\n |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\nin\n No_State_Entry_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e),\n (ids, s),(idp, p)])\nend\n\\\n\nML \\\nfun evaluate_No_Composition_Entry env name e p s = \nlet\n val No_Composition_Entry_th = @{thm No_Composition_Entry}\n val args = No_Composition_Entry_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb\n |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\nin\n No_Composition_Entry_th |> Drule.instantiate_normalize ([], [(idname,name),(ide,e)\n ,(idenv, env),(idp,p),(ids, s)])\nend\n\\\n\n\nML \\\nfun evaluate_No_State_Execution env e is_send s = \n let\n val No_State_Execution_th = @{thm No_State_Execution}\n val args = No_State_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idis_send = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n in\n No_State_Execution_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e),\n (ids, s),(idis_send, is_send)])\n end\n\\\n\nML \\\nfun evaluate_No_Composition_Execution env name e is_send s = \n let\n val No_Composition_Execution_th = @{thm No_Composition_Execution}\n val args = No_Composition_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n in\n No_Composition_Execution_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e),\n (ids, s),(idname, name),(idis_send, is_send)])\n end\n\\\n\nML \\\nfun evaluate_Empty_Pathlist_Execution env f e is_send s = \n let\n val Empty_Pathlist_Execution_th = @{thm Empty_Pathlist_Execution}\n val args = Empty_Pathlist_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idf = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n in\n Empty_Pathlist_Execution_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide, e),\n (ids, s),(idf, f),(idis_send, is_send)])\n end\n\\\n\nML \\\nval ctxt = @{context}\nfun evaluate_Inactive_State_Execution ctxt env ST e is_send s = \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val Inactive_State_Execution_th = @{thm Inactive_State_Execution}\n val args = Inactive_State_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idis_send = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Inactive_State_Execution_th |> Drule.instantiate_normalize ([], [(idenv, env), \n (ide, e),(idST,ST),(idv, v),(idI, I),(idis_send, is_send)])\n val args2 = th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd\n |> Term.strip_comb |> snd\n val idname = nth args2 0 |> Term.dest_Var\n val iden_act = nth args2 1 |> Term.dest_Var\n val iddu_act = nth args2 2 |> Term.dest_Var\n val idex_act = nth args2 3 |> Term.dest_Var\n val idtrans_out = nth args2 4 |> Term.dest_Var\n val idtrans_in = nth args2 5 |> Term.dest_Var\n val idC = nth args2 6 |> Term.dest_Var\n val state = th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val name = nth state 0 |> Thm.cterm_of ctxt\n val en_act = nth state 1 |> Thm.cterm_of ctxt\n val du_act = nth state 2 |> Thm.cterm_of ctxt\n val ex_act = nth state 3 |> Thm.cterm_of ctxt\n val trans_out = nth state 4 |> Thm.cterm_of ctxt\n val trans_in = nth state 5 |> Thm.cterm_of ctxt\n val C = nth state 6 |> Thm.cterm_of ctxt\n val th2 = th1 |> Drule.instantiate_normalize ([], [(idname, name), (iden_act, en_act),\n (iddu_act,du_act),(idex_act, ex_act),(idtrans_out, trans_out),\n (idtrans_in, trans_in), (idC, C)])\n in\n asm_full_simplify ctxt th2\n end\n\\\n\n\\ \\all execution need to be written together because the action \n\"Send\" need call the Root Execution\\\n\nML \\\nfun evaluate_action ctxt env cmd e p s =\n case cmd of\n Const (@{const_name \"SKIP\"}, _) =>\n evaluate_skip env e p s\n | Const (@{const_name \"Assign\"}, _) $ x $ a =>\n let\n val cx = Thm.cterm_of ctxt x\n val ca = Thm.cterm_of ctxt a\n in\n evaluate_assign ctxt env cx ca e p s |> asm_full_simplify ctxt\n end\n | Const (@{const_name \"Seq\"}, _) $ cmd1 $ cmd2 =>\n let\n val th1 = evaluate_action ctxt env cmd1 e p s\n val args = th1 |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val b = nth args 6 |> Thm.cterm_of ctxt\n val s2 = nth args 5 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"True\"} then\n let\n val th2 = evaluate_action ctxt env cmd2 e p s2\n in\n [th1, th2] MRS @{thm Seq1}\n end\n else\n th1 RS @{thm Seq2}\n end\n | Const (@{const_name \"On1\"}, _) $ temp $ as1 =>\n let\n val ctemp = Thm.cterm_of ctxt temp\n val cas1 = Thm.cterm_of ctxt as1\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n in\n (if (tempval ctxt temp v p = true) then \n let\n val ON1_th = @{thm On1}\n val args = ON1_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th_assign = evaluate_action ctxt env as1 e p s\n val th1 = ON1_th |> Drule.instantiate_normalize ([], [(idenv, env), (idt, ctemp), \n (idas, cas1), (ide, e), (idp, p), (ids, s)]);\n val th2 = asm_full_simplify ctxt th1\n in\n [th_assign] MRS th2\n end\n else (evaluate_On2 ctxt env ctemp cas1 e p s))\n end\n | Const (@{const_name \"On2\"}, _) $ event' $ as1' =>\n let\n val event = Thm.cterm_of ctxt event'\n val as1 = Thm.cterm_of ctxt as1'\n in\n if event aconvc e then\n let\n val ON3_th = @{thm On3}\n val args = ON3_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idas = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th_assign = evaluate_action ctxt env as1' e p s\n val th1 = ON3_th |> Drule.instantiate_normalize ([], [(idenv, env),(idt, event), (idas, as1), \n (ide, e), (idp, p),(ids, s)])\n val th2 = asm_full_simplify ctxt th1\n in\n th_assign RS th2\n end\n else\n evaluate_On4 ctxt env event as1 e p s\n end\n | Const (@{const_name \"Print1\"}, _) $ message =>\n let\n val cmessage = Thm.cterm_of ctxt message\n in\n evaluate_Print1 ctxt env cmessage e p s\n end\n | Const (@{const_name \"Print2\"}, _) $ message =>\n let\n val cmessage = Thm.cterm_of ctxt message\n in\n evaluate_Print2 ctxt env cmessage e p s\n end\n\n\\ \\here b0 is a boolean value to tell whether this send action is in transition actions\\\n | Const (@{const_name \"Send1\"}, _) $ e' $ b0' =>\n let\n val e1 = Thm.cterm_of ctxt e'\n val empty_p = @{cterm \"[]::string list\"}\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n in\n if b0' aconv @{term \"False\"} then\n let\n val Send1_th = @{thm Send1}\n val args = Send1_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Send1_th |> Drule.instantiate_normalize ([], [(idenv, env),(ide, e),\n (ide1, e1), (idp, p), (idv, v), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val root = env |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val comp_th = evaluate_Composition_Execution ctxt env root empty_p e1 @{cterm \"True\"} s\n val th3 = comp_th RS th2\n val I1 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> fst |> Thm.cterm_of ctxt\n val src_p = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> snd |> Thm.cterm_of ctxt\n val info_th = Thm.apply I1 src_p \n |> Simplifier.rewrite ctxt\n val info_eq = info_th RS @{thm meta_eq_to_obj_eq}\n val th4 = info_eq RS th3\n in\n asm_full_simplify ctxt th4\n end\n else\n let\n val Send2_th = @{thm Send2}\n val args = Send2_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Send2_th |> Drule.instantiate_normalize ([], [(idenv, env),(ide, e),\n (ide1, e1), (idp, p), (idv, v), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val root = env |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val comp_th = evaluate_Composition_Execution ctxt env root empty_p e1 @{cterm \"True\"} s\n val th3 = comp_th RS th2\n val I1 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> fst |> Thm.cterm_of ctxt\n val src_p = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> snd |> Thm.cterm_of ctxt\n val info_th = Thm.apply I1 src_p \n |> Simplifier.rewrite ctxt\n val info_eq = info_th RS @{thm meta_eq_to_obj_eq}\n val th4 = info_eq RS th3\n val th5 = @{thm refl} RS th4\n in\n asm_full_simplify ctxt th5\n end\n end\n | Const (@{const_name \"Send2\"}, _) $ e' $ b0' $ p1' => (*directed send to p1*)\n let\n val e1 = Thm.cterm_of ctxt e'\n val p1 = Thm.cterm_of ctxt p1'\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n in\n if b0' aconv @{term \"False\"} then\n let\n val Send3_th = @{thm Send3}\n val args = Send3_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idp1 = nth (nth args 1 |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Send3_th |> Drule.instantiate_normalize ([], [(idenv, env),(ide, e),\n (ide1, e1), (idp1, p1), (idp, p), (idv, v), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val ST = nth (th2 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_State_Execution ctxt env ST e1 @{cterm \"True\"} s\n val th3 = state_th RS th2\n val I1 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> fst |> Thm.cterm_of ctxt\n val src_p = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> snd |> Thm.cterm_of ctxt\n val info_th = Thm.apply I1 src_p \n |> Simplifier.rewrite ctxt\n val info_eq = info_th RS @{thm meta_eq_to_obj_eq}\n val th4 = info_eq RS th3\n in\n asm_full_simplify ctxt th4\n end\n else\n let\n val Send4_th = @{thm Send4}\n val args = Send4_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idp1 = nth (nth args 1 |> Term.strip_comb |> snd) 2 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Send4_th |> Drule.instantiate_normalize ([], [(idenv, env),(ide, e),\n (ide1, e1), (idp1, p1), (idp, p), (idv, v), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val ST = nth (th2 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_State_Execution ctxt env ST e1 @{cterm \"True\"} s\n val th3 = state_th RS th2\n val I1 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> fst |> Thm.cterm_of ctxt\n val src_p = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Term.dest_comb |> snd |> Thm.cterm_of ctxt\n val info_th = Thm.apply I1 src_p \n |> Simplifier.rewrite ctxt\n val info_eq = info_th RS @{thm meta_eq_to_obj_eq}\n val th4 = info_eq RS th3\n val th5 = @{thm refl} RS th4\n in\n asm_full_simplify ctxt th5\n end\n end\n | Const (@{const_name \"Send3\"}, _) $ msg' =>\n let\n val msg = Thm.cterm_of ctxt msg'\n in\n evaluate_Send5 ctxt env msg e p s\n end\n | Const (@{const_name \"Funapp\"}, _) $ a1' $ f' $ a2' => \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val a1 = Thm.cterm_of ctxt a1'\n val f = Thm.cterm_of ctxt f'\n val a2 = Thm.cterm_of ctxt a2'\n val funapp_th = @{thm Funapp}\n val args = funapp_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ida1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idf = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ida2 = nth args 1 |> Term.strip_comb |> snd |> tl |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = funapp_th |> Drule.instantiate_normalize ([], [(idenv, env),\n (ide,e),(ida1,a1),(idf,f),(ida2,a2),\n (idv,v),(idp, p),(idI, I)])\n val th1_2 = asm_full_simplify ctxt th1\n val th1_3 = @{thm refl} RS th1_2\n val th1' = asm_full_simplify ctxt th1_3\n val args2 = th1' |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val tmp_a = nth args2 1 |> Thm.cterm_of ctxt\n val update_th1 = evaluate_update_vals ctxt a2 tmp_a v\n val th2 = update_th1 RS th1'\n val cmd = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 \n val s1 = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val act_th = evaluate_action ctxt env cmd e p s1\n val th3 = act_th RS th2\n val tmp_a = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Thm.cterm_of ctxt\n val v2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val update_th2 = evaluate_update_vals ctxt tmp_a a1 v2\n in\n update_th2 RS th3\n end\n | Const (@{const_name \"Grafun\"}, _) $ a1' $ f' $ a2' => \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val a1 = Thm.cterm_of ctxt a1'\n val f = Thm.cterm_of ctxt f'\n val a2 = Thm.cterm_of ctxt a2'\n val grafun_th = @{thm Grafun}\n val args = grafun_th |> Thm.concl_of |> \n Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ida1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idf = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ida2 = nth args 1 |> Term.strip_comb |> snd |> tl |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = grafun_th |> Drule.instantiate_normalize ([], [(idenv, env),\n (ide,e),(ida1,a1),(idf,f),(ida2,a2),\n (idv,v),(idp, p),(idI, I)])\n val th1_2 = asm_full_simplify ctxt th1\n val th1_3 = @{thm refl} RS th1_2\n val th1' = asm_full_simplify ctxt th1_3\n val args2 = th1' |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val tmp_a = nth args2 1 |> Thm.cterm_of ctxt\n val update_th1 = evaluate_update_vals ctxt a2 tmp_a v\n val th2 = update_th1 RS th1'\n val TL = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s1 = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val trans_th = evaluate_transition_list ctxt env TL @{cterm \"''''::string\"} p s1\n val th3 = trans_th RS th2\n val tmp_a = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 0 |> Thm.cterm_of ctxt\n val v2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val update_th2 = evaluate_update_vals ctxt tmp_a a1 v2\n in\n update_th2 RS th3\n end\n | _ => raise TERM (\"Not supported\", [cmd])\nand evaluate_actionlist ctxt env al e p s = \n if ((Thm.term_of al) aconv @{term \"[]::act list\"})\n then evaluate_al1 env e p s\n else\n let \n val cmd = al |> Thm.term_of |> Term.strip_comb |> snd |> hd\n val rest_al = hd (map (Thm.cterm_of ctxt) \n (al |> Thm.term_of |> Term.strip_comb |> snd |> tl))\n val th1 = evaluate_action ctxt env cmd e p s\n val args = th1 |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val b = nth args 6 |> Thm.cterm_of ctxt\n val s2 = nth args 5 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"True\"} then\n let\n val th2 = evaluate_actionlist ctxt env rest_al e p s2\n in\n [th1, th2] MRS @{thm ActionList_Execution2}\n end\n else\n th1 RS @{thm ActionList_Execution3}\n end\n\nand evaluate_transition ctxt env t e p s = \n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val Trans_th = @{thm Trans_Execution1}\n val args = Trans_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Trans_th |> Drule.instantiate_normalize ([], [(idt,t),(idv, v), (idp, p), \n (ide, e), (idenv, env), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val args1 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.dest_comb |> fst\n val args2 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.dest_comb |> snd\n val idv2 = args1 |> Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val v2 = args1 |> Term.dest_comb |> snd |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val idI2 = args2 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val I2 = args2 |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val th3' = th2 |> Drule.instantiate_normalize ([], [(idv2,v2),(idI2, I2)])\n val th3'' = asm_full_simplify ctxt th3'\n val condition_action = nth (t |> Thm.term_of |> Term.strip_comb |> snd) 3\n val s2 = nth (th3'' |> Thm.prems_of |> hd |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val th3 = evaluate_action ctxt env condition_action e p s2\n val args = th3 |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val b = nth args 6 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"True\"} then\n [th3,@{thm refl},@{thm refl}] MRS th3''\n else\n let\n val Trans2_th = @{thm Trans_Execution2}\n val args = Trans2_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Trans2_th |> Drule.instantiate_normalize ([], [(idt,t),(idv, v), (idp, p), \n (ide, e), (idenv, env), (idI, I)])\n val th2 = asm_full_simplify ctxt th1\n val args1 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.dest_comb |> fst\n val args2 = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.dest_comb |> snd\n val idv2 = args1 |> Term.dest_comb |> snd |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val v2 = args1 |> Term.dest_comb |> snd |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val idI2 = args2 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val I2 = args2 |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val th3' = th2 |> Drule.instantiate_normalize ([], [(idv2,v2),(idI2, I2)])\n val th3'' = asm_full_simplify ctxt th3'\n in\n th3 RS th3''\n end\n end\n\nand evaluate_transition_list ctxt env TL e p s = \n if (Thm.term_of TL) aconv @{term \"[]::transition list\"} then (*Termination*)\n evaluate_Termination env e p s\n else\n let \n val t = TL |> Thm.term_of |> Term.strip_comb |> snd |> hd |> (Thm.cterm_of ctxt)\n val T = TL |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd (*t#T*)\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n in\n if enable_ML ctxt t e s p = false then\n if T aconv @{term \"[]::transition list\"} then (*Fail*)\n evaluate_Fail ctxt env t e p s\n else (*TLInduction*)\n let\n val C_T = Thm.cterm_of ctxt T\n val TLInduction_th = @{thm TLinduction}\n val args = TLInduction_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idT = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = TLInduction_th |> Drule.instantiate_normalize ([], [(idt,t)\n ,(idT, C_T),(ids, s), (idp, p), (idenv, env), (ide, e)])\n val th2 = asm_full_simplify ctxt th1\n val th3 = @{thm refl} RS th2\n val s2 = nth (th3 |> Thm.prems_of |> hd |> Term.strip_comb |> snd |> hd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val th_Induction = evaluate_transition_list ctxt env C_T e p s2\n in\n th_Induction RS th3\n end\n else\n let\n val th_trans = evaluate_transition ctxt env t e p s\n val args1 = th_trans |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val b = nth args1 6 |> Thm.cterm_of ctxt\n val trg = nth args1 8\n in\n if b aconvc @{cterm \"False\"} then\n let\n val C_T = Thm.cterm_of ctxt T\n val inactive_th = @{thm SrcInactive}\n val args = inactive_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idT = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = inactive_th |> Drule.instantiate_normalize ([], [(idT, C_T)])\n in\n th_trans RS th1\n end\n else\n case trg of\n Const (@{const_name \"P\"}, _) $ _ => (*ToState*)\n let\n val ToState_th = @{thm ToState}\n val args = ToState_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idT = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = ToState_th |> Drule.instantiate_normalize ([], [(idt,t),(idenv,env),\n (idT,(Thm.cterm_of ctxt T)),(ids, s),(idp, p),(ide, e)])\n val th2 = [th_trans, @{thm refl}] MRS th1\n val th3 = asm_full_simplify ctxt th2\n in\n @{thm refl} RS th3\n end \n | Const (@{const_name \"HJ\"}, _) $ _ => (*ToHistoryJucntion*)\n let\n val ToHJ_th = @{thm ToHistoryJunction}\n val args = ToHJ_th |> Thm.concl_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idt = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idT = nth args 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = ToHJ_th |> Drule.instantiate_normalize ([], [(idt,t)\n ,(idT, (Thm.cterm_of ctxt T)),(idv, v), (idp, p), (idenv, env), (idI, I), (ide, e)])\n val th2 = [th_trans, @{thm refl}] MRS th1\n val th3 = asm_full_simplify ctxt th2\n val th4 = [@{thm refl}] MRS th3\n val th5 = asm_full_simplify ctxt th4\n val th6 = @{thm refl} RS th5\n val th7 = asm_full_simplify ctxt th6\n val th8 = @{thm refl} RS th7\n in\n asm_full_simplify ctxt th8\n end\n | Const (@{const_name \"J\"}, _) $ str =>\n let\n val s2 = nth args1 5 |> Thm.cterm_of ctxt\n val g = nth (env |> Thm.term_of |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val TL2 = (Thm.term_of g) $ str |> Thm.cterm_of ctxt \n |> Simplifier.rewrite ctxt |> Thm.rhs_of (*TL2 = g(str)*)\n val th_trans2 = evaluate_transition_list ctxt env TL2 e p s2\n val b2 = nth (th_trans2 |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 7 |> Thm.cterm_of ctxt\n in\n if b2 aconvc @{cterm \"False\"} then\n let\n val C_T = Thm.cterm_of ctxt T\n val ToJunc2_th = @{thm ToJunctionInduction2}\n val args2 = ToJunc2_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idT = nth args2 1 |> Term.strip_comb |> snd \n |> tl |> hd |> Term.dest_Var\n val th1 = ToJunc2_th |> Drule.instantiate_normalize ([], [(idT, C_T)])\n val th2 = th_trans RS th1\n val th2' = @{thm refl} RS th2\n val th3 = asm_full_simplify ctxt th2'\n in\n th_trans2 RS th3\n end\n else\n let \n val n = nth (th_trans2 |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n val s3 = nth (th_trans2 |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n in\n if n aconvc @{cterm \"-1::int\"} then\n let\n val ToJunc5_th = @{thm ToJunctionInduction5}\n val args2 = ToJunc5_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idT = nth args2 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val C_T = T |> Thm.cterm_of ctxt (*cterm of T*)\n val th1 = ToJunc5_th |> Drule.instantiate_normalize ([], [(idT,C_T)])\n val th2 = th_trans RS th1\n val th2' = @{thm refl} RS th2\n val th3 = asm_full_simplify ctxt th2'\n in\n th_trans2 RS th3\n end\n else if n aconvc @{cterm \"0::int\"} then\n if T aconv @{term \"[]::transition list\"} then (*ToJunctionInduction3*)\n let \n val ToJunc4_th = @{thm ToJunctionInduction4}\n val th1 = th_trans RS ToJunc4_th\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n in\n th_trans2 RS th3\n end\n else (*ToJunctionInduction3*)\n let \n val C_T = T |> Thm.cterm_of ctxt (*cterm of T*)\n val th_trans3 = evaluate_transition_list ctxt env C_T e p s3\n val ToJunc3_th = @{thm ToJunctionInduction3}\n val args2 = ToJunc3_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idT = nth args2 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = ToJunc3_th |> Drule.instantiate_normalize ([], [(idT,C_T)])\n val th2 = th_trans RS th1\n val th2' = @{thm refl} RS th2\n val th3 = asm_full_simplify ctxt th2'\n in\n [th_trans2, th_trans3] MRS th3\n end\n else if n aconvc @{cterm \"1::int\"} then (*ToJunctionInduction1*)\n let\n val C_T = T |> Thm.cterm_of ctxt (*cterm of T*)\n val ToJunc1_th = @{thm ToJunctionInduction1}\n val args2 = ToJunc1_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idT = nth args2 1 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = ToJunc1_th |> Drule.instantiate_normalize ([], [(idT,C_T)])\n val th2 = th_trans RS th1\n val th2' = @{thm refl} RS th2\n val th3 = asm_full_simplify ctxt th2'\n val th4 = th_trans2 RS th3\n val th5 = asm_full_simplify ctxt th4\n in\n @{thm refl} RS th5\n end\n else\n raise CTERM (\"n can't be this value!\", [n]) \n end\n end\n | _ => raise TERM (\"Transition Target Type Error\", [trg])\n end\n end\n\nand evaluate_exit_state ctxt env ST e s = \n if (Thm.term_of ST) aconv @{term \"No_State\"} then (*State_Exit2*)\n evaluate_No_State_Exit ctxt env e s\n else\n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val name = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 0 |> Thm.cterm_of ctxt\n val b1 = @{term \"is_active_state\"} $ (Thm.term_of name) $ (Thm.term_of I)\n |> Thm.cterm_of ctxt |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val C = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n val exit_action = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 3\n in\n if (Thm.term_of b1) aconv @{term \"False\"} then (*State_Exit3*)\n evaluate_State_Exit3 ctxt env ST e s\n else\n let\n val comp_th = evaluate_exit_composition ctxt env C name e s\n val b2 = nth (comp_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b2 aconvc @{cterm \"False\"} then\n let\n val State_Exit4_th = @{thm State_Exit4}\n val args = State_Exit4_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idv = nth args 3 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 3 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = State_Exit4_th |> Drule.instantiate_normalize ([], [(idST,ST),(ide, e), \n (idenv, env), (idv, v), (idI, I)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n in\n comp_th RS th3\n end\n else\n let\n val State_Exit1_th = @{thm State_Exit1}\n val args = State_Exit1_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idv = nth args 3 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 3 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = State_Exit1_th |> Drule.instantiate_normalize ([], [(idST,ST),(ide, e), \n (idenv, env), (idv, v), (idI, I)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th3' = comp_th RS th3\n val th3'' = asm_full_simplify ctxt th3'\n val s2 = nth (th3'' |> Thm.prems_of |> hd |> Term.strip_comb |> snd |> hd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val action_th = evaluate_action ctxt env exit_action e name s2\n val b3 = nth (action_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b3 aconvc @{cterm \"False\"} then\n let\n val State_Exit5_th = @{thm State_Exit5}\n val args = State_Exit5_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idv = nth args 3 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 3 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = State_Exit5_th |> Drule.instantiate_normalize ([], [(idST,ST),(ide, e), \n (idenv, env), (idv, v), (idI, I)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th4 = comp_th RS th3\n in\n action_th RS th4\n end\n else\n let\n val th4 = action_th RS th3''\n val I3 = nth (action_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 5 \n |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val tmp = Thm.apply I3 name |> Simplifier.rewrite ctxt\n val Chart_th = tmp RS @{thm meta_eq_to_obj_eq}\n in\n [Chart_th, @{thm refl}] MRS th4\n end\n end\n end\n end\nand evaluate_exit_composition ctxt env C name e s = \n case (Thm.term_of C) of\n Const (@{const_name \"No_Composition\"}, _) => (*No_Composition_Exit*)\n evaluate_No_Composition_Exit env name e s\n | Const (@{const_name \"Or\"}, _) $ _ $ _ $ _ => (*Or_Exit*)\n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val Or_Exit1_th = @{thm Or_Exit1}\n val args = Or_Exit1_th |> Thm.concl_of |> Term.dest_comb |> \n snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Or_Exit1_th |> Drule.instantiate_normalize ([], [(idenv, env), (idC, C),\n (idv, v),(idname,name), (idI, I), (ide, e)])\n val tmp = Thm.apply I name |> Simplifier.rewrite ctxt\n val Chart_th = tmp RS @{thm meta_eq_to_obj_eq}\n val th2 = [@{thm refl}, Chart_th] MRS th1\n val th3 = asm_full_simplify ctxt th2\n val ST = nth (th3 |> Thm.prems_of |> hd |> Term.strip_comb |> snd |> hd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_exit_state ctxt env ST e s\n val b = nth (state_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n let\n val Or_Exit2_th = @{thm Or_Exit2}\n val th1 = Or_Exit2_th |> Drule.instantiate_normalize ([], [(idenv, env), (idC, C),\n (idv, v),(idname,name), (idI, I), (ide, e)])\n val tmp = Thm.apply I name |> Simplifier.rewrite ctxt\n val Chart_th = tmp RS @{thm meta_eq_to_obj_eq}\n val th2 = [@{thm refl}, Chart_th] MRS th1\n val th3 = asm_full_simplify ctxt th2\n in\n state_th RS th3\n end\n else\n let\n val th4 = state_th RS th3\n val th5 = asm_full_simplify ctxt th4\n in\n [@{thm refl}, @{thm refl}] MRS th5\n end\n end\n | Const (@{const_name \"And\"}, _) $ sl' $ f' => (*And_Exit*)\n let\n val sl = Thm.cterm_of ctxt sl'\n val f = Thm.cterm_of ctxt f'\n val And_Exit1_th = @{thm And_Exit1}\n val args = And_Exit1_th |> Thm.concl_of |> Term.dest_comb |> \n snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = And_Exit1_th |> Drule.instantiate_normalize ([], [(idC, C),\n (idenv, env), (ids, s), (idname,name), (ide, e)])\n val th2 = @{thm refl} RS th1\n val pathlist_th = path_lsit_exit_execution ctxt env sl e f s\n val b = nth (pathlist_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n let\n val And_Exit2_th = @{thm And_Exit2}\n val th1 = And_Exit2_th |> Drule.instantiate_normalize ([], [(idC, C),\n (idenv, env), (ids, s), (idname,name), (ide, e)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n in\n pathlist_th RS th3\n end\n else\n let\n val th3 = asm_full_simplify ctxt th2\n in\n pathlist_th RS th3\n end\n end\n |_ => raise CTERM (\"Not supported\", [C])\nand path_lsit_exit_execution ctxt env sl e f s = \n if (Thm.term_of sl) aconv @{term \"[]::string list\"} then\n let\n val empty_list_exit_th = @{thm Empty_List_Exit}\n val args = empty_list_exit_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idf = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n in\n empty_list_exit_th |> Drule.instantiate_normalize ([], [(idenv, env), (ide,e), \n (idf,f), (ids, s)])\n end\n else\n let\n val Term_butlast = @{term butlast}\n val Term_last = @{term last}\n val sl1 = Term_butlast $ (Thm.term_of sl) |> Thm.cterm_of ctxt |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val str = Term_last $ (Thm.term_of sl) |> Thm.cterm_of ctxt |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val path_list_exit1_th = @{thm List_Exit1}\n val args = path_list_exit1_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idsl1 = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idstr = nth args 1 |> Term.dest_comb |> snd |> Term.strip_comb \n |> snd |> hd |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idf = nth args 3 |> Term.dest_Var\n val ids = nth args 4 |> Term.dest_Var\n val th1 = path_list_exit1_th |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env), (idstr,str),(ide,e),(idf,f),(ids, s)])\n val th2 = asm_full_simplify ctxt th1\n \\ \\This is a trick that we can't use f(str) to construct the state\\\n (*val state = (Thm.term_of f) $ (Thm.term_of str) |> \n Term.dest_comb |> fst;*)\n val state = th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val state_th = evaluate_exit_state ctxt env state e s\n val b = nth (state_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n let\n val path_list_exit2_th = @{thm List_Exit2}\n val th1 = path_list_exit2_th |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env), (idstr,str),(ide,e),(idf,f),(ids, s)])\n val th2 = asm_full_simplify ctxt th1\n in\n state_th RS th2\n end\n else\n let\n val th3 = state_th RS th2\n val th4 = asm_full_simplify ctxt th3\n val args2 = th4 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val s2 = nth args2 4 |> Thm.cterm_of ctxt\n val sl1_exit_th = path_lsit_exit_execution ctxt env sl1 e f s2\n in\n sl1_exit_th RS th4\n end\n end\n\nand evaluate_entry_state ctxt env ST e p s = \n if (Thm.term_of ST) aconv @{term \"No_State\"} then (*No_State_Entry*)\n evaluate_No_State_Entry env e p s\n else\n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val name = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 0 |> (Thm.cterm_of ctxt)\n val C = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 6 |> (Thm.cterm_of ctxt)\n val State_Entry1_th = @{thm State_Entry1}\n val args = State_Entry1_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idp = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = State_Entry1_th |> Drule.instantiate_normalize ([], [(idST,ST),(idv, v), \n (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th1\n val tmp = Thm.apply I name |> Simplifier.rewrite ctxt\n val Chart_th = tmp RS @{thm meta_eq_to_obj_eq}\n val th3 = Chart_th RS th2\n val cterm_butlast = @{cterm butlast}\n val tmp2 = Thm.apply I (Thm.apply cterm_butlast name) |> Simplifier.rewrite ctxt\n val Chart_th2 = tmp2 RS @{thm meta_eq_to_obj_eq}\n val th4 = [Chart_th2, @{thm refl}, @{thm refl}] MRS th3\n val th4' = asm_full_simplify ctxt th4\n val entry_action = nth (ST |> Thm.term_of |> Term.strip_comb |> snd) 1\n val s2 = nth (th4' |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val action_th = evaluate_action ctxt env entry_action e name s2\n val b1 = nth (action_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b1 aconvc @{cterm \"False\"} then\n let\n val State_Entry3_th = @{thm State_Entry3}\n val th1 = State_Entry3_th |> Drule.instantiate_normalize ([], [(idST,ST),(idv, v), \n (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th1\n val tmp = Thm.apply I name |> Simplifier.rewrite ctxt\n val Chart_th = tmp RS @{thm meta_eq_to_obj_eq}\n val th3 = Chart_th RS th2\n val cterm_butlast = @{cterm butlast}\n val tmp2 = Thm.apply I (Thm.apply cterm_butlast name) |> Simplifier.rewrite ctxt\n val Chart_th2 = tmp2 RS @{thm meta_eq_to_obj_eq}\n val th4 = [Chart_th2, @{thm refl}, @{thm refl}] MRS th3\n val th4' = asm_full_simplify ctxt th4\n in\n action_th RS th4'\n end\n else\n let\n val th6 = action_th RS th4'\n val s3 = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val new_p = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val Comp_th = evaluate_entry_composition ctxt env C name e new_p s3\n in\n Comp_th RS th6\n end\n end\nand evaluate_entry_composition ctxt env C name e p s = \ncase (Thm.term_of C) of\n Const (@{const_name \"No_Composition\"}, _) => (*No_Composition_Entry*)\n evaluate_No_Composition_Entry env name e p s\n| Const (@{const_name \"Or\"}, _) $ TL' $ b' $ _ => (*Or_Entry*)\n let\n val TL = Thm.cterm_of ctxt TL'\n in\n if (Thm.term_of p) aconv @{term \"[]::string list\"} then\n if b' aconv @{term \"False\"} then\n let\n val Or_Entry1_th = @{thm Or_Entry1} (*Or_Entry1*)\n val args = Or_Entry1_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = Or_Entry1_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name), \n (idenv, env), (ide, e), (idp, p), (ids, s)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val name = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val trans_th = evaluate_transition_list ctxt env TL e name s\n val b1 = nth (trans_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 7 |> Thm.cterm_of ctxt\n in\n if b1 aconvc @{cterm \"False\"} then\n let\n val Or_Entry2_th = @{thm Or_Entry2} (*Or_Entry2*)\n val th1 = Or_Entry2_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name), \n (idenv, env), (ide, e), (idp, p), (ids, s)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n in\n trans_th RS th3\n end\n else\n let\n val th4 = trans_th RS th3\n val th5 = asm_full_simplify ctxt th4\n val th6 = @{thm refl} RS th5\n val action_list = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s2 = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val actionlist_th = evaluate_actionlist ctxt env action_list e name s2\n val b2 = nth (actionlist_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b2 aconvc @{cterm \"False\"} then\n let\n val Or_Entry3_th = @{thm Or_Entry3} (*Or_Entry3*)\n val th1 = Or_Entry3_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name), \n (idenv, env), (ide, e), (idp, p), (ids, s)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th4 = trans_th RS th3\n val th5 = asm_full_simplify ctxt th4\n val th6 = @{thm refl} RS th5\n in\n actionlist_th RS th6\n end\n else\n let\n val th7 = actionlist_th RS th6\n val th8 = asm_full_simplify ctxt th7\n val ST = nth (th8 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s3 = nth (th8 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val new_p = nth (th8 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e new_p s3\n in\n state_th RS th8\n end\n end\n end\n else\n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val Or_Entry5_th = @{thm Or_Entry5} (*Or_Entry5*)\n val args = Or_Entry5_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val idv = nth args 5 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 5 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Or_Entry5_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name)\n ,(idv, v), (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th4 = @{thm refl} RS th3\n val str2 = nth (th4 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Term.strip_comb \n |> snd) 0|> Thm.cterm_of ctxt\n in\n if str2 aconvc @{cterm \"[]::string\"} then \n let\n val Or_Entry9_th = @{thm Or_Entry9} (*Or_Entry9*)\n val th1 = Or_Entry9_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name)\n ,(idv, v), (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th3' = @{thm refl} RS th3\n val th3'' = asm_full_simplify ctxt th3'\n val trans_th = evaluate_transition_list ctxt env TL e name s\n val b1 = nth (trans_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 7 |> Thm.cterm_of ctxt\n in\n if b1 aconvc @{cterm \"False\"} then\n trans_th RS th3''\n else\n let\n val Or_Entry10_th = @{thm Or_Entry10} (*Or_Entry10*)\n val th1 = Or_Entry10_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name)\n ,(idv, v), (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th3' = @{thm refl} RS th3\n val th3'' = asm_full_simplify ctxt th3'\n val th4 = trans_th RS th3''\n val th5 = asm_full_simplify ctxt th4\n val th6 = @{thm refl} RS th5\n val action_list = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s2 = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val actionlist_th = evaluate_actionlist ctxt env action_list e name s2\n val b2 = nth (actionlist_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b2 aconvc @{cterm \"False\"} then\n actionlist_th RS th6\n else\n let\n val Or_Entry8_th = @{thm Or_Entry8} (*Or_Entry8*)\n val th1 = Or_Entry8_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name)\n ,(idv, v), (idenv, env), (ide, e), (idI, I), (idp, p)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val th3' = @{thm refl} RS th3\n val th3'' = asm_full_simplify ctxt th3'\n val th4 = trans_th RS th3''\n val th5 = asm_full_simplify ctxt th4\n val th6 = @{thm refl} RS th5\n val th8 = actionlist_th RS th6\n val th9 = asm_full_simplify ctxt th8\n val ST = nth (th9 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s3 = nth (th9 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val new_p = nth (th9 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e new_p s3\n in\n state_th RS th9\n end\n end\n end\n else\n let\n val th5 = asm_full_simplify ctxt th4\n val ST = nth (th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e p s\n in\n state_th RS th5\n end\n end\n else\n let\n val Or_Entry7_th = @{thm Or_Entry7} (*Or_Entry7*)\n val args = Or_Entry7_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = Or_Entry7_th |> Drule.instantiate_normalize ([], [(idC,C),(idname,name), \n (idenv, env), (ide, e), (idp, p), (ids, s)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val ST = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e p s\n in\n state_th RS th3\n end\n end\n| Const (@{const_name \"And\"}, _) $ sl' $ f' => (*And_Entry*)\n let\n val sl = Thm.cterm_of ctxt sl'\n val f = Thm.cterm_of ctxt f'\n val And_Entry_th = @{thm And_Entry}\n val args = And_Entry_th |> Thm.concl_of |> Term.dest_comb |> \n snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = And_Entry_th |> Drule.instantiate_normalize ([], [(idC, C), (idenv, env),\n (idname,name), (ide, e), (idp, p), (ids, s)])\n val th2 = @{thm refl} RS th1\n val th3 = asm_full_simplify ctxt th2\n val pathlist_th = path_list_entry_execution ctxt env sl f e p s\n in\n pathlist_th RS th3\n end\n|_ => raise CTERM (\"Not supported\", [C])\nand path_list_entry_execution ctxt env sl f e p s = \n if (Thm.term_of sl) aconv @{term \"[]::string list\"} then\n let\n val empty_list_entry_th = @{thm Empty_List_Entry}\n val args = empty_list_entry_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idf = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n in\n empty_list_entry_th |> Drule.instantiate_normalize ([], [(ids,s), (ide, e),\n (idenv, env), (idp, p), (idf,f)])\n end\n else\n let\n val sl1 = @{term tl} $ (Thm.term_of sl) |> Thm.cterm_of ctxt \n |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val str = @{term hd} $ (Thm.term_of sl) |> Thm.cterm_of ctxt \n |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val hd_p = Thm.apply @{cterm hd} p |> Simplifier.rewrite ctxt |> Thm.rhs_of\n in\n if str aconvc hd_p then\n let\n val path_list_entry_th2 = @{thm Path_List_Entry2}\n val args = path_list_entry_th2 |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idstr = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idsl1 = nth args 1 |> Term.dest_comb |> snd |> Term.dest_Var\n val idf = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = path_list_entry_th2 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env),(idstr,str),(ids,s),(idf,f),(ide,e),(idp,p)])\n val th2 = asm_full_simplify ctxt th1\n val ST = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e p s\n val b = nth (state_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n state_th RS th2\n else\n let\n val path_list_entry_th1 = @{thm Path_List_Entry1}\n val th1 = path_list_entry_th1 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env),(idstr,str),(ids,s),(idf,f),(ide,e),(idp,p)])\n val th2 = asm_full_simplify ctxt th1\n val th3 = state_th RS th2\n val th4 = asm_full_simplify ctxt th3\n val s2 = nth (state_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val path_list_th = path_list_entry_execution ctxt env sl1 f e p s2\n in\n path_list_th RS th4\n end\n end\n else\n let\n val empty_p = @{cterm \"[]::string list\"}\n val path_list_entry_th5 = @{thm Path_List_Entry5}\n val args = path_list_entry_th5 |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idstr = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idsl1 = nth args 1 |> Term.dest_comb |> snd |> Term.dest_Var\n val idf = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idp = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = path_list_entry_th5 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env),(idstr,str),(ids,s),(idf,f),(ide,e),(idp,p)])\n val th2 = asm_full_simplify ctxt th1\n val ST = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_entry_state ctxt env ST e empty_p s\n val b = nth (state_th |> Thm.concl_of |> Term.dest_comb \n |> snd |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n state_th RS th2\n else\n let\n val path_list_entry_th4 = @{thm Path_List_Entry4}\n val th1 = path_list_entry_th4 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idenv, env),(idstr,str),(ids,s),(idf,f),(ide,e),(idp,p)])\n val th2 = asm_full_simplify ctxt th1\n val th3 = state_th RS th2\n val th4 = asm_full_simplify ctxt th3\n val s2 = nth (state_th |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val path_list_th = path_list_entry_execution ctxt env sl1 f e p s2\n in\n path_list_th RS th4\n end\n end \n end\n\nand evaluate_State_Execution ctxt env ST e is_send s = \nif ST aconvc @{cterm \"No_State\"} then\n evaluate_No_State_Execution env e is_send s\nelse\n let\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val Outer_Trans_Execution1_th = @{thm Outer_Trans_Execution1}\n val args = Outer_Trans_Execution1_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idis_send = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Outer_Trans_Execution1_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val args3 = nth (th1 |> Thm.prems_of) 2 |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd\n |> Term.strip_comb |> snd\n val ids = nth args3 0 |> Term.dest_Var\n val idh1 = nth args3 1 |> Term.dest_Var\n val idh2 = nth args3 2 |> Term.dest_Var\n val idh3 = nth args3 3 |> Term.dest_Var\n val ido1 = nth args3 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ido2 = nth args3 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val V = nth (th1 |> Thm.prems_of) 2 |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val s = nth V 0 |> Thm.cterm_of ctxt\n val h1 = nth V 1 |> Thm.cterm_of ctxt\n val h2 = nth V 2 |> Thm.cterm_of ctxt\n val h3 = nth V 3 |> Thm.cterm_of ctxt\n val o1 = nth V 4 |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val o2 = nth V 4 |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2),(idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val trans_out = nth (th4 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s2 = nth (th4 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val name = nth (th4 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val outer_trans_th = evaluate_transition_list ctxt env trans_out e name s2\n val n1 = nth (outer_trans_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n val b1 = nth (outer_trans_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 7 |> Thm.cterm_of ctxt\n in\n if b1 aconvc @{cterm \"False\"} then\n let\n val Outer_Trans_Termination_th = @{thm Outer_Trans_Termination} (*Outer Transition Termination*)\n val th1 = Outer_Trans_Termination_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n in\n outer_trans_th RS th4\n end\n else if n1 aconvc @{cterm \"1::int\"} then\n let\n val th5 = outer_trans_th RS th4\n val idp0 = th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd\n |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val p0 = th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th6 = th5 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th6 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th7 = th_tmp RS th6\n val th8 = @{thm refl} RS th7\n val th9 = asm_full_simplify ctxt th8\n val C_out = nth (th9 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val name2 = nth (th9 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val s3 = nth (th9 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val comp_exit_th = evaluate_exit_composition ctxt env C_out name2 e s3\n val b6 = nth (comp_exit_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b6 aconvc @{cterm \"False\"} then\n let\n val Outer_Trans_Execution2_th = @{thm Outer_Trans_Execution2} \n (* Outer_Trans Terminate in Exit \"Send\" *)\n val th1 = Outer_Trans_Execution2_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = th5 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th6 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th7 = th_tmp RS th6\n val th8 = @{thm refl} RS th7\n val th9 = asm_full_simplify ctxt th8\n in\n comp_exit_th RS th9\n end\n else\n let\n val th10 = comp_exit_th RS th9\n val action_list = nth (th10 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val name = nth (th10 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val s4 = nth (th10 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val actionlist_th = evaluate_actionlist ctxt env action_list e name s4\n val b7 = nth (actionlist_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b7 aconvc @{cterm \"False\"} then\n let\n val Outer_Trans_Execution3_th = @{thm Outer_Trans_Execution3}\n (* Outer_Trans Terminate in Transition action \"Send\" *)\n val th1 = Outer_Trans_Execution3_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = th5 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th6 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th7 = th_tmp RS th6\n val th8 = @{thm refl} RS th7\n val th9 = asm_full_simplify ctxt th8\n val th10 = comp_exit_th RS th9\n in\n actionlist_th RS th10\n end\n else\n let\n val th11 = actionlist_th RS th10\n val th13 = [@{thm refl}, @{thm refl}] MRS th11\n val th14 = asm_full_simplify ctxt th13\n val C_in = nth (th14 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val name3 = nth (th14 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val s5 = nth (th14 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val p_in = nth (th14 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val comp_entry_th = evaluate_entry_composition ctxt env C_in name3 e p_in s5\n in\n comp_entry_th RS th14\n end\n end\n end\n else\n let\n val Fail_Trans_Execution_th = @{thm Fail_Trans_Execution}\n val args = Fail_Trans_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idST = nth args 1 |> Term.dest_Var\n val ide = nth args 2 |> Term.dest_Var\n val idis_send = nth args 3 |> Term.dest_Var\n val idv = nth args 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Fail_Trans_Execution_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val args3 = nth (th1 |> Thm.prems_of) 2 |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd\n |> Term.strip_comb |> snd\n val ids = nth args3 0 |> Term.dest_Var\n val idh1 = nth args3 1 |> Term.dest_Var\n val idh2 = nth args3 2 |> Term.dest_Var\n val idh3 = nth args3 3 |> Term.dest_Var\n val ido1 = nth args3 4 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val ido2 = nth args3 4 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val V = nth (th1 |> Thm.prems_of) 2 |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Term.strip_comb |> snd\n val s = nth V 0 |> Thm.cterm_of ctxt\n val h1 = nth V 1 |> Thm.cterm_of ctxt\n val h2 = nth V 2 |> Thm.cterm_of ctxt\n val h3 = nth V 3 |> Thm.cterm_of ctxt\n val o1 = nth V 4 |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val o2 = nth V 4 |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n val du_act = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s3 = nth (th6 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val during_action_th = evaluate_action ctxt env (Thm.term_of du_act) e name s3\n val b2 = nth (during_action_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b2 aconvc @{cterm \"False\"} then\n let\n val Inner_Trans_Execution2_th = @{thm Inner_Trans_Execution2}\n (* Inner_Trans Terminate in During \"Send\" *)\n val th1 = Inner_Trans_Execution2_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n in\n during_action_th RS th6\n end\n else\n let\n val th8 = during_action_th RS th6\n val trans_in = nth (th8 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s4 = nth (th8 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val inner_trans_th = evaluate_transition_list ctxt env trans_in e name s4\n val n2 = nth (inner_trans_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n val b3 = nth (inner_trans_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 7 |> Thm.cterm_of ctxt\n in\n if b3 aconvc @{cterm \"False\"} then\n let\n val Inner_Trans_Termination_th = @{thm Inner_Trans_Termination}\n (* Inner_Trans Terminate in Inner Transition *)\n val th1 = Inner_Trans_Termination_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n val th8 = during_action_th RS th6\n in\n inner_trans_th RS th8\n end\n else if n2 aconvc @{cterm \"1::int\"} then\n let\n val Inner_Trans_Execution1_th = @{thm Inner_Trans_Execution1}\n (* Inner_Trans Terminate Succeed *)\n val th1 = Inner_Trans_Execution1_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n val th8 = during_action_th RS th6\n val th9 = inner_trans_th RS th8\n val th10 = asm_full_simplify ctxt th9\n val idp0 = th10 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val p0 = th10 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th11 = th10 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th11 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th12 = th_tmp RS th11\n val th12' = @{thm refl} RS th12\n val th12'' = asm_full_simplify ctxt th12'\n val C = nth (th12'' |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val ex_ST = nth (th12'' |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val s5 = nth (th12'' |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val comp_exit_th = evaluate_exit_composition ctxt env C ex_ST e s5\n val b4 = nth (comp_exit_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b4 aconvc @{cterm \"False\"} then\n let\n val Inner_Trans_Execution3_th = @{thm Inner_Trans_Execution3}\n (* Inner_Trans Terminate in Exit \"Send\" *)\n val th1 = Inner_Trans_Execution3_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n val th8 = during_action_th RS th6\n val th9 = inner_trans_th RS th8\n val th10 = asm_full_simplify ctxt th9\n val th11 = th10 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th11 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th12 = th_tmp RS th11\n val th12' = @{thm refl} RS th12\n val th12'' = asm_full_simplify ctxt th12'\n in\n comp_exit_th RS th12''\n end\n else\n let\n val th13 = comp_exit_th RS th12''\n val action_list = nth (th13 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s6 = nth (th13 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val actionlist_th = evaluate_actionlist ctxt env action_list e name s6\n val b5 = nth (actionlist_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b5 aconvc @{cterm \"False\"} then\n let\n val Inner_Trans_Execution4_th = @{thm Inner_Trans_Execution4}\n (* Inner_Trans Terminate in Transition Action \"Send\" *)\n val th1 = Inner_Trans_Execution4_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idST,ST),(idenv, env),(idI, I),(idis_send, is_send)])\n val th2 = @{thm refl} RS th1\n val th2' = th2 |> Drule.instantiate_normalize ([], [(ids, s), (idh1, h1),\n (idh2,h2), (idh3, h3), (ido1, o1),(ido2, o2)])\n val th3 = asm_full_simplify ctxt th2'\n val th4 = [@{thm refl}, @{thm refl}, @{thm refl}] MRS th3\n val th5 = outer_trans_th RS th4\n val th6 = asm_full_simplify ctxt th5\n val th8 = during_action_th RS th6\n val th9 = inner_trans_th RS th8\n val th10 = asm_full_simplify ctxt th9\n val th11 = th10 |> Drule.instantiate_normalize ([], [(idp0,p0)])\n val ctrm = th11 |>Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val th_tmp = (Thm.beta_conversion true ctrm) RS @{thm meta_eq_to_obj_eq}\n val th12 = th_tmp RS th11\n val th12' = @{thm refl} RS th12\n val th12'' = asm_full_simplify ctxt th12'\n val th13 = comp_exit_th RS th12''\n in\n actionlist_th RS th13\n end\n else\n let\n val th15 = actionlist_th RS th13\n val th16 = [@{thm refl}, @{thm refl}] MRS th15\n val th17 = asm_full_simplify ctxt th16\n val C_in = nth (th17 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val name2 = nth (th17 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val s7 = nth (th17 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val p_in = nth (th17 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 4 |> Thm.cterm_of ctxt\n val comp_entry_th = evaluate_entry_composition ctxt env C_in name2 e p_in s7\n in\n comp_entry_th RS th17\n end \n end\n end\n else\n let\n val th9 = inner_trans_th RS th8\n val th10 = asm_full_simplify ctxt th9\n val C = nth (th10 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val s5 = nth (th10 |>Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val comp_exec_th = \n evaluate_Composition_Execution ctxt env C name e is_send s5\n in\n comp_exec_th RS th10\n end\n end\n end\n end\nand evaluate_Composition_Execution ctxt env C name e is_send s = \nlet\n val v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val I = s |> Thm.term_of |> Term.strip_comb |> snd |> tl |> hd |> Thm.cterm_of ctxt\n val empty_p = @{cterm \"[]::string list\"}\n val info = Simplifier.rewrite ctxt (Thm.apply I empty_p) |> Thm.rhs_of\n val b0 = info |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\nin\n if (b0 aconvc @{cterm \"False\"}) then\n let\n val Start_Execution_th = @{thm Start_Execution}\n val args = Start_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val idv = nth args 5 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 5 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Start_Execution_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idC,C), (idname, name),(idI, I),(idenv, env),(idis_send, is_send)])\n val th3 = asm_full_simplify ctxt th1\n val th5 = @{thm refl} RS th3\n val ST = nth (th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val empty_p = @{cterm \"[]::string list\"}\n val state_entry_th = evaluate_entry_state ctxt env ST e empty_p s\n \n in\n state_entry_th RS th5\n end\n else\n case (Thm.term_of C) of\n Const (@{const_name \"No_Composition\"}, _) => (*No_Composition_Execution*)\n evaluate_No_Composition_Execution env name e is_send s\n | Const (@{const_name \"Or\"}, _) $ TL' $ b' $ f' => (*Or_Execution*)\n let\n val TL = Thm.cterm_of ctxt TL'\n val b = Thm.cterm_of ctxt b'\n val f = Thm.cterm_of ctxt f'\n val Or_Execution_th = @{thm Or_Execution}\n val args = Or_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val idv = nth args 5 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idI = nth args 5 |> Term.strip_comb |> snd |> tl |> hd |> Term.dest_Var\n val th1 = Or_Execution_th |> Drule.instantiate_normalize ([], [(idv, v), (ide, e),\n (idC,C), (idname, name),(idI, I),(idenv, env),(idis_send, is_send)])\n val idTL = nth (th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb \n |> snd) 0 |> Term.dest_Var\n val idb = nth (th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb \n |> snd) 1 |> Term.dest_Var\n val idf = nth (th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb \n |> snd) 2 |> Term.dest_Var\n val th2 = th1 |> Drule.instantiate_normalize ([], [(idTL,TL),(idb, b), \n (idf, f)])\n val th3 = asm_full_simplify ctxt th2\n val th4 = @{thm refl} RS th3\n val th5 = asm_full_simplify ctxt th4\n val ST = nth (th5 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_execution_th = \n evaluate_State_Execution ctxt env ST e is_send s\n in\n state_execution_th RS th5\n end\n | Const (@{const_name \"And\"}, _) $ sl' $ f' => (*And_Execution*)\n let\n val sl = Thm.cterm_of ctxt sl'\n val f = Thm.cterm_of ctxt f'\n val And_Execution_th = @{thm And_Execution}\n val args = And_Execution_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idC = nth args 1 |> Term.dest_Var\n val idname = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = And_Execution_th |> Drule.instantiate_normalize ([], [(ids, s), (ide, e),\n (idC,C), (idname, name),(idenv, env),(idis_send, is_send)])\n val idsl = nth (th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb \n |> snd) 0 |> Term.dest_Var\n val idf = nth (th1 |> Thm.prems_of |> hd |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd |> tl |> hd |> Term.strip_comb \n |> snd) 1 |> Term.dest_Var\n val th2 = th1 |> Drule.instantiate_normalize ([], [(idsl,sl),(idf, f)])\n val th3 = asm_full_simplify ctxt th2\n val path_list_execution_th = \n evaluate_path_list_execution ctxt env sl f e is_send s\n in\n path_list_execution_th RS th3\n end\n |_ => raise CTERM (\"Not supported\", [C])\nend\nand evaluate_path_list_execution ctxt env sl f e is_send s = \nif sl aconvc @{cterm \"[]::string list\"} then\n evaluate_Empty_Pathlist_Execution env f e is_send s\nelse\n let\n val sl1 = @{term tl} $ (Thm.term_of sl) |> Thm.cterm_of ctxt \n |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val str = @{term hd} $ (Thm.term_of sl) |> Thm.cterm_of ctxt \n |> Simplifier.rewrite ctxt |> Thm.rhs_of\n val pathlist_execution_th2 = @{thm Pathlist_Execution2}\n val args = pathlist_execution_th2 |> Thm.concl_of |> Term.dest_comb |> snd\n |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val idstr = nth args 1 |> Term.strip_comb |> snd |> hd |> Term.dest_Var\n val idsl1 = nth args 1 |> Term.dest_comb |> snd |> Term.dest_Var\n val idf = nth args 2 |> Term.dest_Var\n val ide = nth args 3 |> Term.dest_Var\n val idis_send = nth args 4 |> Term.dest_Var\n val ids = nth args 5 |> Term.dest_Var\n val th1 = pathlist_execution_th2 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idstr,str),(ids,s),(idf,f),(ide,e),(idenv,env),(idis_send, is_send)])\n val th2 = asm_full_simplify ctxt th1\n val ST = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val state_th = evaluate_State_Execution ctxt env ST e is_send s\n val b = nth (state_th |> Thm.concl_of |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 6 |> Thm.cterm_of ctxt\n in\n if b aconvc @{cterm \"False\"} then\n state_th RS th2\n else\n let\n val pathlist_execution_th1 = @{thm Pathlist_Execution1}\n val th1 = pathlist_execution_th1 |> Drule.instantiate_normalize ([], [(idsl1,sl1),\n (idstr,str),(ids,s),(idf,f),(ide,e),(idenv,env),(idis_send, is_send)])\n val th2 = asm_full_simplify ctxt th1\n val th3 = state_th RS th2\n val s2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 5 |> Thm.cterm_of ctxt\n val path_list_execution_th = \n evaluate_path_list_execution ctxt env sl1 f e is_send s2\n in\n path_list_execution_th RS th3\n end\n end\n\\\n\nML \\\nfun evaluate_root_exec_for_times ctxt env e n s = \n if n aconvc @{cterm \"0::int\"} then\n let\n val root_exec_for_times_th1 = @{thm Root_Exec_for_Times1}\n val args = root_exec_for_times_th1 |> Thm.concl_of \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 1 |> Term.dest_Var\n val ids = nth args 3 |> Term.dest_Var\n in\n root_exec_for_times_th1 |> Drule.instantiate_normalize ([], [(idenv, env),\n (ide, e), (ids, s)])\n end\n else\n let\n val root_exec_for_times_th2 = @{thm Root_Exec_for_Times2}\n val args = root_exec_for_times_th2 |> Thm.concl_of \n |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val idenv = nth args 0 |> Term.dest_Var\n val ide = nth args 1 |> Term.dest_Var\n val ids = nth args 3 |> Term.dest_Var\n val idn = nth args 2 |> Term.dest_Var\n val th1 = root_exec_for_times_th2 |> Drule.instantiate_normalize ([], [(idenv, env),\n (ide, e), (ids, s), (idn, n)])\n val th2 = asm_full_simplify ctxt th1\n val empty_name = @{cterm \"[]::string list\"}\n val is_send = @{cterm \"False\"}\n val e' = nth (th2 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val root = env |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\n val t_start = Timing.start ()\n val comp_th = evaluate_Composition_Execution ctxt env root empty_name e' is_send s\n val th3 = comp_th RS th2\n val t_end = Timing.result t_start\n val _ = writeln (\"Test\" ^ (Timing.message t_end))\n val s2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\n val n2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\n val e2 = nth (th3 |> Thm.prems_of |> hd |> Term.dest_comb |> snd \n |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\n val root_exec_th = evaluate_root_exec_for_times ctxt env e2 n2 s2\n in\n root_exec_th RS th3\n end\n\n\\\n\nschematic_goal myconj:\"?x = ?x \\ ?y = ?y\"\n by auto\n\\ \\some tests in ML level\\\nML \\\nval ctxt = @{context}\nval A = @{cterm \"State [''A''] SKIP SKIP SKIP [] [Trans (P [''A'']) (T1 (Before ''E_one'' (N 2))) \n((V ''x'') [>] (V ''y'')) SKIP SKIP (P [''B''])] No_Composition\"}\nval B = @{cterm \"State [''B''] SKIP SKIP SKIP [] [] No_Composition\"}\nval Root = @{cterm \"Or [Trans NONE (S '''') (Bc True) SKIP SKIP (P [''A''])] False\n(\\x. (if x = ''A'' then (State [''A''] SKIP SKIP SKIP [] [Trans (P [''A'']) (T1 (Before ''E_one'' (N 2))) \n((V ''x'') [>] (V ''y'')) SKIP SKIP (P [''B''])] No_Composition) else\n(if x = ''B'' then (State [''B''] SKIP SKIP SKIP [] [] No_Composition) else No_State)))\"}\nval env = @{cterm \"Env (Or [Trans NONE (S '''') (Bc True) SKIP SKIP (P [''A''])] False\n(\\x. (if x = ''A'' then (State [''A''] SKIP SKIP SKIP [] [Trans (P [''A'']) (T1 (Before ''E_one'' (N 2))) \n((V ''x'') [>] (V ''y'')) (''x'' ::= (N 2)) SKIP (P [''B''])] No_Composition) else\n(if x = ''B'' then (State [''B''] SKIP SKIP SKIP [] [] No_Composition) else No_State))))\n(\\name. (SKIP, No_Expr, No_Expr))\n(\\name. ((Trans NONE (S []) (Bc True) SKIP SKIP NONE), No_Expr, No_Expr))\n(\\x.[]::transition list)\"}\nval root = env |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\nval fe = nth (env |> Thm.term_of |> Term.strip_comb |> snd) 1 |> Thm.cterm_of ctxt\nval ge = nth (env |> Thm.term_of |> Term.strip_comb |> snd) 2 |> Thm.cterm_of ctxt\nval g = nth (env |> Thm.term_of |> Term.strip_comb |> snd) 3 |> Thm.cterm_of ctxt\nval p = @{cterm \"[''A'']\"}\nval e = @{cterm \"''E_one''::string\"}\nval t = @{cterm \"Trans (P [''A'']) (T1 (Before ''E_one'' (N 2))) \n((V ''x'') [>] (V ''y'')) (print1 ''cond_act'') SKIP (P [''B''])\"}\nval T = @{cterm \"[Trans (P [''A'']) (T1 (After ''E_one'' (N 2))) \n((V ''x'') [>] (V ''y'')) (print1 ''cond_act'') SKIP (P [''B''])]\"}\nval Chart = @{cterm \"\\x. (if x = [''A''] then (Info True [] []) else\nif x = ([]::string list) then (Info True ''A'' []) else\n(Info False [] []))\"}\nval s = @{cterm \"Status (Vals (\\x. (if x = ''x'' then (1::int) else (0::int)))\n (\\p str. 0) (\\x. 0) (\\x. []) ([], [])) (\\x. (if x = [''A''] then (Info True [] []) else\nif x = ([]::string list) then (Info True ''A'' []) else\n(Info False [] [])))\"}\nval v = s |> Thm.term_of |> Term.strip_comb |> snd |> hd |> Thm.cterm_of ctxt\nval th = evaluate_exit_state ctxt env A e s\n\\\ndefinition fe::fenv where \"\n fe name = (SKIP, No_Expr, No_Expr)\"\n\n\nML \\\nsignature STATEFLOW_EXECUTION1 = \nsig\n val stateflow_execution1_tac: Proof.context -> tactic\nend\n\nstructure Stateflow_Execution1 : STATEFLOW_EXECUTION1 = \nstruct\n\nfun stateflow_execution1_tac ctxt state = \n let\n val subgoals = state |> Thm.cprop_of |> Drule.strip_imp_prems\n (*val _ = pwriteln (pretty_term ctxt (Thm.term_of (hd subgoals)))*)\n in\n if null subgoals then Seq.empty else\n let\n val c_subgoal = hd subgoals\n val subgoal = Thm.term_of c_subgoal\n val args = subgoal |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val env = nth args 0 |> Thm.cterm_of ctxt\n val C = nth args 1 |> Thm.cterm_of ctxt\n val name = nth args 2 |> Thm.cterm_of ctxt\n val e = nth args 3 |> Thm.cterm_of ctxt\n val s1 = nth args 5 |> Thm.cterm_of ctxt\n val th = evaluate_Composition_Execution ctxt env C name e @{cterm \"False\"} s1\n val args_res = th |> Thm.prop_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val _ = pwriteln (pretty_term ctxt (nth args_res 6))\n(* val _ = pwriteln (pretty_term ctxt (Thm.prop_of th)) *)\n in\n Seq.single (th RS state)\n end\n end\nend\n\n\\\n\nlemma \"V ''x'' = V ''x''\"\n by auto\nschematic_goal test:\"?x = ?x \\ ?y = ?y\"\n by auto\n\nmethod_setup stateflow_execution1 \n= \\Scan.succeed (SIMPLE_METHOD o Stateflow_Execution1.stateflow_execution1_tac)\\ \n\"Stateflow_Execution1 prover\"\n\n\nML \\\nsignature STATEFLOW_EXECUTION2 = \nsig\n val stateflow_execution2_tac: Proof.context -> tactic\nend\n\nstructure Stateflow_Execution2 : STATEFLOW_EXECUTION2 = \nstruct\n\nfun stateflow_execution2_tac ctxt state = \n let\n val subgoals = state |> Thm.cprop_of |> Drule.strip_imp_prems\n (*val _ = pwriteln (pretty_term ctxt (Thm.term_of (hd subgoals)))*)\n in\n if null subgoals then Seq.empty else\n let\n val c_subgoal = hd subgoals\n val subgoal = Thm.term_of c_subgoal\n val args = subgoal |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val env = nth args 0 |> Thm.cterm_of ctxt\n val e = nth args 1 |> Thm.cterm_of ctxt\n val n = nth args 2 |> Thm.cterm_of ctxt\n val s1 = nth args 3 |> Thm.cterm_of ctxt\n val th = evaluate_root_exec_for_times ctxt env e n s1\n val args_res = th |> Thm.prop_of |> Term.dest_comb |> snd |> Term.strip_comb |> snd\n val _ = pwriteln (pretty_term ctxt (nth args_res 4))\n(* val _ = pwriteln (pretty_term ctxt (Thm.prop_of th)) *)\n in\n Seq.single (th RS state)\n end\n end\nend\n\n\\\n\nmethod_setup stateflow_execution2 \n= \\Scan.succeed (SIMPLE_METHOD o Stateflow_Execution2.stateflow_execution2_tac)\\ \n\"Stateflow_Execution2 prover\"\n\n\nend ", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/Semantic_Stateflow/Final_ML.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6113819591324418, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.262984328694038}} {"text": "(* \n Title: Psi-calculi \n Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Cong_Pres\n imports Weak_Psi_Congruence Weak_Cong_Sim_Pres Weak_Bisim_Pres\nbegin\n\ncontext env begin\n\nlemma weakPsiCongInputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"\\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]\"\n\n shows \"\\ \\ M\\\\*xvec N\\.P \\ M\\\\*xvec N\\.Q\"\nproof -\n from assms have \"\\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]\"\n by simp\n thus ?thesis\n proof(induct rule: weakPsiCongSymI)\n case(cSym P Q)\n thus ?case by(auto dest: weakBisimE)\n next\n case(cSim P Q)\n show ?case \n by(induct rule: weakCongSimI) auto\n next\n case(cWeakBisim P Q)\n thus ?case by(rule_tac weakBisimInputPres) auto\n qed\nqed\n \nlemma weakPsiCongOutputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ M\\N\\.P \\ M\\N\\.Q\"\nusing assms\nproof(induct rule: weakPsiCongSymI)\n case(cSym P Q)\n thus ?case by(rule weakPsiCongSym)\nnext\n case(cSim P Q)\n show ?case by(induct rule: weakCongSimI) auto\nnext\n case(cWeakBisim P Q)\n thus ?case by(metis weakPsiCongE weakBisimOutputPres)\nqed\n\nlemma weakBisimCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes A: \"\\\\ P. (\\, P) mem CsP \\ \\Q. (\\, Q) mem CsQ \\ guarded Q \\ (\\\\. \\ \\ P \\ Q)\"\n and B: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ (\\\\. \\ \\ P \\ Q)\"\n\n shows \"\\ \\ Cases CsP \\ Cases CsQ\"\nproof -\n let ?X = \"{(\\, Cases CsP, Cases CsQ) | \\ CsP CsQ. (\\\\ P. (\\, P) mem CsP \\ (\\Q. (\\, Q) mem CsQ \\ guarded Q \\ (\\\\. \\ \\ P \\ Q))) \\\n (\\\\ Q. (\\, Q) mem CsQ \\ (\\P. (\\, P) mem CsP \\ guarded P \\ (\\\\. \\ \\ P \\ Q)))}\"\n from assms have \"(\\, Cases CsP, Cases CsQ) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cStatImp \\ CasesP CasesQ)\n thus ?case\n apply(auto simp add: weak_stat_imp_def)\n by(rule_tac x=\"Cases CsQ\" in exI, auto)\n next\n case(cSim \\ CasesP CasesQ)\n then obtain CsP CsQ where C1: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ (\\\\. \\ \\ P \\ Q)\"\n and A: \"CasesP = Cases CsP\" and B: \"CasesQ = Cases CsQ\"\n by auto\n note C1\n moreover have \"\\\\ P Q. \\ \\ P \\ Q \\ \\ \\ P \\ Q\" by(rule weakBisimE)\n moreover note weakPsiCongE(1) weakPsiCongE(2)\n ultimately have \"\\ \\ Cases CsP \\ Cases CsQ\"\n by(rule_tac caseWeakSimPres) (assumption | blast)+\n hence \"\\ \\ Cases CsP \\<(?X \\ weakBisim)> Cases CsQ\"\n by(rule_tac weakSimMonotonic) auto\n with A B show ?case by blast\n next\n case(cExt \\ P Q \\')\n thus ?case by auto\n next\n case(cSym \\ P Q)\n thus ?case by auto (metis weakPsiCongSym)+\n qed\nqed\n\nlemma weakPsiCongCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes A: \"\\\\ P. (\\, P) mem CsP \\ \\Q. (\\, Q) mem CsQ \\ guarded Q \\ (\\\\. \\ \\ P \\ Q)\"\n and B: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ (\\\\. \\ \\ P \\ Q)\"\n\n shows \"\\ \\ Cases CsP \\ Cases CsQ\"\nproof -\n let ?Prop = \"\\CsP CsQ. \\\\ P. (\\, P) mem CsP \\ (\\Q. (\\, Q) mem CsQ \\ guarded Q \\ (\\\\. \\ \\ P \\ Q))\"\n from A B have \"?Prop CsP CsQ \\ ?Prop CsQ CsP\" by(metis weakPsiCongSym)\n thus ?thesis\n proof(induct rule: weakPsiCongSymI[where C=\"\\P. Cases P\"])\n case(cSym P Q)\n thus ?case by auto\n next\n case(cWeakBisim CsP CsQ)\n thus ?case\n by(rule_tac weakBisimCasePres) (metis weakPsiCongSym)+\n next\n case(cSim CsP CsQ)\n thus ?case \n apply auto\n apply(rule_tac weakCongSimCasePres, auto)\n by(blast dest: weakPsiCongE)\n qed\nqed\n\nlemma weakPsiCongResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n \n assumes \"\\ \\ P \\ Q\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\ \\\\x\\Q\"\nusing `\\ \\ P \\ Q`\nproof(induct rule: weakPsiCongSymI)\n case(cSym P Q)\n thus ?case by(rule weakPsiCongSym)\nnext\n case(cWeakBisim P Q)\n thus ?case using `x \\ \\` by(metis weakPsiCongE weakBisimResPres)\nnext\n case(cSim P Q)\n obtain y::name where \"y \\ \\\" and \"y \\ P\" and \"y \\ Q\"\n by(generate_fresh \"name\") auto\n from `\\ \\ P \\ Q` have \"([(x, y)] \\ \\) \\ ([(x, y)] \\ P) \\ ([(x, y)] \\ Q)\" by(rule weakPsiCongClosed)\n hence \"([(x, y)] \\ \\) \\ ([(x, y)] \\ P) \\\\weakBisim\\ ([(x, y)] \\ Q)\" by(rule weakPsiCongE)\n with `x \\ \\` `y \\ \\` have \"\\ \\ ([(x, y)] \\ P) \\\\weakBisim\\ ([(x, y)] \\ Q)\" by simp\n moreover have \"eqvt weakBisim\" by simp\n moreover note `y \\ \\`\n moreover have \"weakBisim \\ weakBisim\" by auto\n moreover note weakBisimResPres\n ultimately have \"\\ \\ \\\\y\\([(x, y)] \\ P) \\\\weakBisim\\ \\\\y\\([(x, y)] \\ Q)\" by(rule weakCongSimResPres)\n with `y \\ P` `y \\ Q` show ?case by(simp add: alpha_res)\nqed\n\nlemma weakPsiCongResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\ Q\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q\"\nusing assms\nby(induct xvec) (auto intro: weakPsiCongResPres)\n\nlemma weakPsiCongParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\\\. \\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nusing assms\nproof(induct rule: weakPsiCongSymI[where C=\"\\P. P \\ R\"])\n case(cSym P Q)\n thus ?case by(blast dest: weakPsiCongSym)\nnext\n case(cWeakBisim P Q)\n thus ?case by(metis weakBisimParPres weakPsiCongE)\nnext\n case(cSim P Q)\n {\n fix \\\n from `\\\\. \\ \\ P \\ Q` have \"\\ \\ P \\\\weakBisim\\ Q\" by(auto dest: weakPsiCongE)\n }\n moreover {\n fix \\\n from `\\\\. \\ \\ P \\ Q` have \"\\ \\ P \\ Q\" by(auto dest: weakPsiCongE weakBisimE)\n }\n moreover {\n fix \\\n from `\\\\. \\ \\ P \\ Q` have \"\\ \\ P \\ Q\" by(auto dest: weakPsiCongE)\n hence \"\\ \\ Q \\ P\" by(metis weakBisimE)\n }\n ultimately show ?case using weakBisimEqvt weakBisimEqvt weakBisimE(4) weakBisimE(3) weakBisimParPresAux weakBisimResChainPres statEqWeakBisim\n by(rule_tac weakCongSimParPres)\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Cong_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.2629521700187601}} {"text": "(* Title: HOL/Imperative_HOL/Array.thy\n Author: John Matthews, Galois Connections; Alexander Krauss, Lukas Bulwahn & Florian Haftmann, TU Muenchen\n*)\n\nsection \\Monadic arrays\\\n\ntheory Array\nimports Heap_Monad\nbegin\n\nsubsection \\Primitives\\\n\ndefinition present :: \"heap \\ 'a::heap array \\ bool\" where\n \"present h a \\ addr_of_array a < lim h\"\n\ndefinition get :: \"heap \\ 'a::heap array \\ 'a list\" where\n \"get h a = map from_nat (arrays h (TYPEREP('a)) (addr_of_array a))\"\n\ndefinition set :: \"'a::heap array \\ 'a list \\ heap \\ heap\" where\n \"set a x = arrays_update (\\h. h(TYPEREP('a) := ((h(TYPEREP('a))) (addr_of_array a:=map to_nat x))))\"\n\ndefinition alloc :: \"'a list \\ heap \\ 'a::heap array \\ heap\" where\n \"alloc xs h = (let\n l = lim h;\n r = Array l;\n h'' = set r xs (h\\lim := l + 1\\)\n in (r, h''))\"\n\ndefinition length :: \"heap \\ 'a::heap array \\ nat\" where\n \"length h a = List.length (get h a)\"\n \ndefinition update :: \"'a::heap array \\ nat \\ 'a \\ heap \\ heap\" where\n \"update a i x h = set a ((get h a)[i:=x]) h\"\n\ndefinition noteq :: \"'a::heap array \\ 'b::heap array \\ bool\" (infix \"=!!=\" 70) where\n \"r =!!= s \\ TYPEREP('a) \\ TYPEREP('b) \\ addr_of_array r \\ addr_of_array s\"\n\n\nsubsection \\Monad operations\\\n\ndefinition new :: \"nat \\ 'a::heap \\ 'a array Heap\" where\n [code del]: \"new n x = Heap_Monad.heap (alloc (replicate n x))\"\n\ndefinition of_list :: \"'a::heap list \\ 'a array Heap\" where\n [code del]: \"of_list xs = Heap_Monad.heap (alloc xs)\"\n\ndefinition make :: \"nat \\ (nat \\ 'a::heap) \\ 'a array Heap\" where\n [code del]: \"make n f = Heap_Monad.heap (alloc (map f [0 ..< n]))\"\n\ndefinition len :: \"'a::heap array \\ nat Heap\" where\n [code del]: \"len a = Heap_Monad.tap (\\h. length h a)\"\n\ndefinition nth :: \"'a::heap array \\ nat \\ 'a Heap\" where\n [code del]: \"nth a i = Heap_Monad.guard (\\h. i < length h a)\n (\\h. (get h a ! i, h))\"\n\ndefinition upd :: \"nat \\ 'a \\ 'a::heap array \\ 'a::heap array Heap\" where\n [code del]: \"upd i x a = Heap_Monad.guard (\\h. i < length h a)\n (\\h. (a, update a i x h))\"\n\ndefinition map_entry :: \"nat \\ ('a::heap \\ 'a) \\ 'a array \\ 'a array Heap\" where\n [code del]: \"map_entry i f a = Heap_Monad.guard (\\h. i < length h a)\n (\\h. (a, update a i (f (get h a ! i)) h))\"\n\ndefinition swap :: \"nat \\ 'a \\ 'a::heap array \\ 'a Heap\" where\n [code del]: \"swap i x a = Heap_Monad.guard (\\h. i < length h a)\n (\\h. (get h a ! i, update a i x h))\"\n\ndefinition freeze :: \"'a::heap array \\ 'a list Heap\" where\n [code del]: \"freeze a = Heap_Monad.tap (\\h. get h a)\"\n\n\nsubsection \\Properties\\\n\ntext \\FIXME: Does there exist a \"canonical\" array axiomatisation in\nthe literature?\\\n\ntext \\Primitives\\\n\nlemma noteq_sym: \"a =!!= b \\ b =!!= a\"\n and unequal [simp]: \"a \\ a' \\ a =!!= a'\"\n unfolding noteq_def by auto\n\nlemma noteq_irrefl: \"r =!!= r \\ False\"\n unfolding noteq_def by auto\n\nlemma present_alloc_noteq: \"present h a \\ a =!!= fst (alloc xs h)\"\n by (simp add: present_def noteq_def alloc_def Let_def)\n\nlemma get_set_eq [simp]: \"get (set r x h) r = x\"\n by (simp add: get_def set_def o_def)\n\nlemma get_set_neq [simp]: \"r =!!= s \\ get (set s x h) r = get h r\"\n by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n \"set r x (set r y h) = set r x h\"\n by (simp add: set_def)\n\nlemma set_set_swap:\n \"r =!!= r' \\ set r x (set r' x' h) = set r' x' (set r x h)\"\n by (simp add: Let_def fun_eq_iff noteq_def set_def)\n\nlemma get_update_eq [simp]:\n \"get (update a i v h) a = (get h a) [i := v]\"\n by (simp add: update_def)\n\nlemma nth_update_neq [simp]:\n \"a =!!= b \\ get (update b j v h) a ! i = get h a ! i\"\n by (simp add: update_def noteq_def)\n\nlemma get_update_elem_neqIndex [simp]:\n \"i \\ j \\ get (update a j v h) a ! i = get h a ! i\"\n by simp\n\nlemma length_update [simp]: \n \"length (update b i v h) = length h\"\n by (simp add: update_def length_def set_def get_def fun_eq_iff)\n\nlemma update_swap_neq:\n \"a =!!= a' \\ \n update a i v (update a' i' v' h) \n = update a' i' v' (update a i v h)\"\napply (unfold update_def)\napply simp\napply (subst set_set_swap, assumption)\napply (subst get_set_neq)\napply (erule noteq_sym)\napply simp\ndone\n\nlemma update_swap_neqIndex:\n \"\\ i \\ i' \\ \\ update a i v (update a i' v' h) = update a i' v' (update a i v h)\"\n by (auto simp add: update_def set_set_swap list_update_swap)\n\nlemma get_alloc:\n \"get (snd (alloc xs h)) (fst (alloc ys h)) = xs\"\n by (simp add: Let_def split_def alloc_def)\n\nlemma length_alloc:\n \"length (snd (alloc (xs :: 'a::heap list) h)) (fst (alloc (ys :: 'a list) h)) = List.length xs\"\n by (simp add: Array.length_def get_alloc)\n\nlemma set:\n \"set (fst (alloc ls h))\n new_ls (snd (alloc ls h))\n = snd (alloc new_ls h)\"\n by (simp add: Let_def split_def alloc_def)\n\nlemma present_update [simp]: \n \"present (update b i v h) = present h\"\n by (simp add: update_def present_def set_def get_def fun_eq_iff)\n\nlemma present_alloc [simp]:\n \"present (snd (alloc xs h)) (fst (alloc xs h))\"\n by (simp add: present_def alloc_def set_def Let_def)\n\nlemma not_present_alloc [simp]:\n \"\\ present h (fst (alloc xs h))\"\n by (simp add: present_def alloc_def Let_def)\n\n\ntext \\Monad operations\\\n\nlemma execute_new [execute_simps]:\n \"execute (new n x) h = Some (alloc (replicate n x) h)\"\n by (simp add: new_def execute_simps)\n\nlemma success_newI [success_intros]:\n \"success (new n x) h\"\n by (auto intro: success_intros simp add: new_def)\n\nlemma effect_newI [effect_intros]:\n assumes \"(a, h') = alloc (replicate n x) h\"\n shows \"effect (new n x) h h' a\"\n by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_newE [effect_elims]:\n assumes \"effect (new n x) h h' r\"\n obtains \"r = fst (alloc (replicate n x) h)\" \"h' = snd (alloc (replicate n x) h)\" \n \"get h' r = replicate n x\" \"present h' r\" \"\\ present h r\"\n using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_of_list [execute_simps]:\n \"execute (of_list xs) h = Some (alloc xs h)\"\n by (simp add: of_list_def execute_simps)\n\nlemma success_of_listI [success_intros]:\n \"success (of_list xs) h\"\n by (auto intro: success_intros simp add: of_list_def)\n\nlemma effect_of_listI [effect_intros]:\n assumes \"(a, h') = alloc xs h\"\n shows \"effect (of_list xs) h h' a\"\n by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_of_listE [effect_elims]:\n assumes \"effect (of_list xs) h h' r\"\n obtains \"r = fst (alloc xs h)\" \"h' = snd (alloc xs h)\" \n \"get h' r = xs\" \"present h' r\" \"\\ present h r\"\n using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_make [execute_simps]:\n \"execute (make n f) h = Some (alloc (map f [0 ..< n]) h)\"\n by (simp add: make_def execute_simps)\n\nlemma success_makeI [success_intros]:\n \"success (make n f) h\"\n by (auto intro: success_intros simp add: make_def)\n\nlemma effect_makeI [effect_intros]:\n assumes \"(a, h') = alloc (map f [0 ..< n]) h\"\n shows \"effect (make n f) h h' a\"\n by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_makeE [effect_elims]:\n assumes \"effect (make n f) h h' r\"\n obtains \"r = fst (alloc (map f [0 ..< n]) h)\" \"h' = snd (alloc (map f [0 ..< n]) h)\" \n \"get h' r = map f [0 ..< n]\" \"present h' r\" \"\\ present h r\"\n using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_len [execute_simps]:\n \"execute (len a) h = Some (length h a, h)\"\n by (simp add: len_def execute_simps)\n\nlemma success_lenI [success_intros]:\n \"success (len a) h\"\n by (auto intro: success_intros simp add: len_def)\n\nlemma effect_lengthI [effect_intros]:\n assumes \"h' = h\" \"r = length h a\"\n shows \"effect (len a) h h' r\"\n by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_lengthE [effect_elims]:\n assumes \"effect (len a) h h' r\"\n obtains \"r = length h' a\" \"h' = h\" \n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_nth [execute_simps]:\n \"i < length h a \\\n execute (nth a i) h = Some (get h a ! i, h)\"\n \"i \\ length h a \\ execute (nth a i) h = None\"\n by (simp_all add: nth_def execute_simps)\n\nlemma success_nthI [success_intros]:\n \"i < length h a \\ success (nth a i) h\"\n by (auto intro: success_intros simp add: nth_def)\n\nlemma effect_nthI [effect_intros]:\n assumes \"i < length h a\" \"h' = h\" \"r = get h a ! i\"\n shows \"effect (nth a i) h h' r\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_nthE [effect_elims]:\n assumes \"effect (nth a i) h h' r\"\n obtains \"i < length h a\" \"r = get h a ! i\" \"h' = h\"\n using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_upd [execute_simps]:\n \"i < length h a \\\n execute (upd i x a) h = Some (a, update a i x h)\"\n \"i \\ length h a \\ execute (upd i x a) h = None\"\n by (simp_all add: upd_def execute_simps)\n\nlemma success_updI [success_intros]:\n \"i < length h a \\ success (upd i x a) h\"\n by (auto intro: success_intros simp add: upd_def)\n\nlemma effect_updI [effect_intros]:\n assumes \"i < length h a\" \"h' = update a i v h\"\n shows \"effect (upd i v a) h h' a\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updE [effect_elims]:\n assumes \"effect (upd i v a) h h' r\"\n obtains \"r = a\" \"h' = update a i v h\" \"i < length h a\"\n using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_map_entry [execute_simps]:\n \"i < length h a \\\n execute (map_entry i f a) h =\n Some (a, update a i (f (get h a ! i)) h)\"\n \"i \\ length h a \\ execute (map_entry i f a) h = None\"\n by (simp_all add: map_entry_def execute_simps)\n\nlemma success_map_entryI [success_intros]:\n \"i < length h a \\ success (map_entry i f a) h\"\n by (auto intro: success_intros simp add: map_entry_def)\n\nlemma effect_map_entryI [effect_intros]:\n assumes \"i < length h a\" \"h' = update a i (f (get h a ! i)) h\" \"r = a\"\n shows \"effect (map_entry i f a) h h' r\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_map_entryE [effect_elims]:\n assumes \"effect (map_entry i f a) h h' r\"\n obtains \"r = a\" \"h' = update a i (f (get h a ! i)) h\" \"i < length h a\"\n using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_swap [execute_simps]:\n \"i < length h a \\\n execute (swap i x a) h =\n Some (get h a ! i, update a i x h)\"\n \"i \\ length h a \\ execute (swap i x a) h = None\"\n by (simp_all add: swap_def execute_simps)\n\nlemma success_swapI [success_intros]:\n \"i < length h a \\ success (swap i x a) h\"\n by (auto intro: success_intros simp add: swap_def)\n\nlemma effect_swapI [effect_intros]:\n assumes \"i < length h a\" \"h' = update a i x h\" \"r = get h a ! i\"\n shows \"effect (swap i x a) h h' r\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_swapE [effect_elims]:\n assumes \"effect (swap i x a) h h' r\"\n obtains \"r = get h a ! i\" \"h' = update a i x h\" \"i < length h a\"\n using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_freeze [execute_simps]:\n \"execute (freeze a) h = Some (get h a, h)\"\n by (simp add: freeze_def execute_simps)\n\nlemma success_freezeI [success_intros]:\n \"success (freeze a) h\"\n by (auto intro: success_intros simp add: freeze_def)\n\nlemma effect_freezeI [effect_intros]:\n assumes \"h' = h\" \"r = get h a\"\n shows \"effect (freeze a) h h' r\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_freezeE [effect_elims]:\n assumes \"effect (freeze a) h h' r\"\n obtains \"h' = h\" \"r = get h a\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma upd_return:\n \"upd i x a \\ return a = upd i x a\"\n by (rule Heap_eqI) (simp add: bind_def guard_def upd_def execute_simps)\n\nlemma array_make:\n \"new n x = make n (\\_. x)\"\n by (rule Heap_eqI) (simp add: map_replicate_trivial execute_simps)\n\nlemma array_of_list_make [code]:\n \"of_list xs = make (List.length xs) (\\n. xs ! n)\"\n by (rule Heap_eqI) (simp add: map_nth execute_simps)\n\nhide_const (open) present get set alloc length update noteq new of_list make len nth upd map_entry swap freeze\n\n\nsubsection \\Code generator setup\\\n\nsubsubsection \\Logical intermediate layer\\\n\ndefinition new' where\n [code del]: \"new' = Array.new o nat_of_integer\"\n\n\n\ndefinition make' where\n [code del]: \"make' i f = Array.make (nat_of_integer i) (f o of_nat)\"\n\nlemma [code]:\n \"Array.make n f = make' (of_nat n) (f o nat_of_integer)\"\n by (simp add: make'_def o_def)\n\ndefinition len' where\n [code del]: \"len' a = Array.len a \\ (\\n. return (of_nat n))\"\n\nlemma [code]:\n \"Array.len a = len' a \\ (\\i. return (nat_of_integer i))\"\n by (simp add: len'_def)\n\ndefinition nth' where\n [code del]: \"nth' a = Array.nth a o nat_of_integer\"\n\nlemma [code]:\n \"Array.nth a n = nth' a (of_nat n)\"\n by (simp add: nth'_def)\n\ndefinition upd' where\n [code del]: \"upd' a i x = Array.upd (nat_of_integer i) x a \\ return ()\"\n\nlemma [code]:\n \"Array.upd i x a = upd' a (of_nat i) x \\ return a\"\n by (simp add: upd'_def upd_return)\n\nlemma [code]:\n \"Array.map_entry i f a = do {\n x \\ Array.nth a i;\n Array.upd i (f x) a\n }\"\n by (rule Heap_eqI) (simp add: bind_def guard_def map_entry_def execute_simps)\n\nlemma [code]:\n \"Array.swap i x a = do {\n y \\ Array.nth a i;\n Array.upd i x a;\n return y\n }\"\n by (rule Heap_eqI) (simp add: bind_def guard_def swap_def execute_simps)\n\nlemma [code]:\n \"Array.freeze a = do {\n n \\ Array.len a;\n Heap_Monad.fold_map (\\i. Array.nth a i) [0..x. fst (the (if x < Array.length h a\n then Some (Array.get h a ! x, h) else None)))\n [0.. Array.len a;\n Heap_Monad.fold_map (Array.nth a) [0.. Array.len a;\n Heap_Monad.fold_map (Array.nth a) [0..SML\\\n\ncode_printing type_constructor array \\ (SML) \"_/ array\"\ncode_printing constant Array \\ (SML) \"raise/ (Fail/ \\\"bare Array\\\")\"\ncode_printing constant Array.new' \\ (SML) \"(fn/ ()/ =>/ Array.array/ (IntInf.toInt _,/ (_)))\"\ncode_printing constant Array.of_list \\ (SML) \"(fn/ ()/ =>/ Array.fromList/ _)\"\ncode_printing constant Array.make' \\ (SML) \"(fn/ ()/ =>/ Array.tabulate/ (IntInf.toInt _,/ _ o IntInf.fromInt))\"\ncode_printing constant Array.len' \\ (SML) \"(fn/ ()/ =>/ IntInf.fromInt (Array.length/ _))\"\ncode_printing constant Array.nth' \\ (SML) \"(fn/ ()/ =>/ Array.sub/ ((_),/ IntInf.toInt _))\"\ncode_printing constant Array.upd' \\ (SML) \"(fn/ ()/ =>/ Array.update/ ((_),/ IntInf.toInt _,/ (_)))\"\ncode_printing constant \"HOL.equal :: 'a array \\ 'a array \\ bool\" \\ (SML) infixl 6 \"=\"\n\ncode_reserved SML Array\n\n\ntext \\OCaml\\\n\ncode_printing type_constructor array \\ (OCaml) \"_/ array\"\ncode_printing constant Array \\ (OCaml) \"failwith/ \\\"bare Array\\\"\"\ncode_printing constant Array.new' \\ (OCaml) \"(fun/ ()/ ->/ Array.make/ (Z.to'_int/ _)/ _)\"\ncode_printing constant Array.of_list \\ (OCaml) \"(fun/ ()/ ->/ Array.of'_list/ _)\"\ncode_printing constant Array.make' \\ (OCaml)\n \"(fun/ ()/ ->/ Array.init/ (Z.to'_int/ _)/ (fun k'_ ->/ _/ (Z.of'_int/ k'_)))\"\ncode_printing constant Array.len' \\ (OCaml) \"(fun/ ()/ ->/ Z.of'_int/ (Array.length/ _))\"\ncode_printing constant Array.nth' \\ (OCaml) \"(fun/ ()/ ->/ Array.get/ _/ (Z.to'_int/ _))\"\ncode_printing constant Array.upd' \\ (OCaml) \"(fun/ ()/ ->/ Array.set/ _/ (Z.to'_int/ _)/ _)\"\ncode_printing constant \"HOL.equal :: 'a array \\ 'a array \\ bool\" \\ (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml Array\n\n\ntext \\Haskell\\\n\ncode_printing type_constructor array \\ (Haskell) \"Heap.STArray/ Heap.RealWorld/ _\"\ncode_printing constant Array \\ (Haskell) \"error/ \\\"bare Array\\\"\"\ncode_printing constant Array.new' \\ (Haskell) \"Heap.newArray\"\ncode_printing constant Array.of_list \\ (Haskell) \"Heap.newListArray\"\ncode_printing constant Array.make' \\ (Haskell) \"Heap.newFunArray\"\ncode_printing constant Array.len' \\ (Haskell) \"Heap.lengthArray\"\ncode_printing constant Array.nth' \\ (Haskell) \"Heap.readArray\"\ncode_printing constant Array.upd' \\ (Haskell) \"Heap.writeArray\"\ncode_printing constant \"HOL.equal :: 'a array \\ 'a array \\ bool\" \\ (Haskell) infix 4 \"==\"\ncode_printing class_instance array :: HOL.equal \\ (Haskell) -\n\n\ntext \\Scala\\\n\ncode_printing type_constructor array \\ (Scala) \"!Array.T[_]\"\ncode_printing constant Array \\ (Scala) \"!sys.error(\\\"bare Array\\\")\"\ncode_printing constant Array.new' \\ (Scala) \"('_: Unit)/ => / Array.alloc((_))((_))\"\ncode_printing constant Array.make' \\ (Scala) \"('_: Unit)/ =>/ Array.make((_))((_))\"\ncode_printing constant Array.len' \\ (Scala) \"('_: Unit)/ =>/ Array.len((_))\"\ncode_printing constant Array.nth' \\ (Scala) \"('_: Unit)/ =>/ Array.nth((_), (_))\"\ncode_printing constant Array.upd' \\ (Scala) \"('_: Unit)/ =>/ Array.upd((_), (_), (_))\"\ncode_printing constant Array.freeze \\ (Scala) \"('_: Unit)/ =>/ Array.freeze((_))\"\ncode_printing constant \"HOL.equal :: 'a array \\ 'a array \\ bool\" \\ (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Imperative_HOL/Array.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725053, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.26295216285397854}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory ArrayAssertion\n\nimports\n \"$L4V_ARCH/ArchArraysMemInstance\"\n \"StructSupport\"\n\nbegin\n\nlemma array_tag_n_eq:\n \"(array_tag_n n :: ('a :: c_type['b :: finite]) field_desc typ_desc) =\n TypDesc (TypAggregate\n (map (\\n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..<(card (UNIV :: 'b :: finite set))]))\n (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @ nat_to_bin_string (card (UNIV :: 'b :: finite set)))\"\n by (simp add: typ_info_array array_tag_def array_tag_n_eq)\n\ndefinition\n \"uinfo_array_tag_n_m (v :: 'a itself) n m = TypDesc\n (TypAggregate (map (\\i. DTPair (typ_uinfo_t TYPE('a)) (replicate i CHR ''1'')) [0 ..< n]))\n (typ_name (typ_uinfo_t TYPE('a :: c_type)) @ ''_array_'' @ nat_to_bin_string m)\"\n\nlemma map_td_list_map:\n \"map_td_list f = map (map_td_pair f)\"\n apply (rule ext)\n apply (induct_tac x, simp_all)\n done\n\nlemma uinfo_array_tag_n_m_eq:\n \"n \\ CARD('b)\n \\ export_uinfo (array_tag_n n :: (('a :: wf_type)['b :: finite]) field_desc typ_desc)\n = uinfo_array_tag_n_m TYPE ('a) n (CARD('b))\"\n apply (clarsimp simp: uinfo_array_tag_n_m_def array_tag_n_eq\n map_td_list_map o_def adjust_ti_def map_td_map)\n apply (simp add: typ_uinfo_t_def export_uinfo_def)\n apply (rule map_td_extI)\n apply simp\n apply (clarsimp simp: field_norm_blah)\n done\n\nlemma typ_uinfo_array_tag_n_m_eq:\n \"typ_uinfo_t TYPE (('a :: wf_type)['b :: finite])\n = uinfo_array_tag_n_m TYPE ('a) (CARD('b)) (CARD('b))\"\n by (simp add: typ_uinfo_t_def typ_info_array array_tag_def\n uinfo_array_tag_n_m_eq)\n\ntext {* Alternative to h_t_valid for arrays. This allows reasoning\nabout arrays of variable width. *}\ndefinition\n h_t_array_valid :: \"heap_typ_desc \\ ('a :: c_type) ptr \\ nat \\ bool\"\nwhere\n \"h_t_array_valid htd ptr n = valid_footprint htd (ptr_val ptr) (uinfo_array_tag_n_m TYPE ('a) n n)\"\n\ntext {* Assertion that pointer p is within an array that continues\nfor at least n more elements. *}\ndefinition\n \"array_assertion (p :: ('a :: c_type) ptr) n htd\n = (\\q i j. h_t_array_valid htd q j\n \\ p = CTypesDefs.ptr_add q (int i) \\ i < j \\ i + n \\ j)\"\n\nlemma array_assertion_shrink_right:\n \"array_assertion p n htd \\ n' \\ n \\ array_assertion p n' htd\"\n by (fastforce simp: array_assertion_def)\n\nlemma array_assertion_shrink_leftD:\n \"array_assertion p n htd \\ j < n \\ array_assertion (CTypesDefs.ptr_add p (int j)) (n - j) htd\"\n apply (clarsimp simp: array_assertion_def)\n apply (rule exI, rule_tac x=\"i + j\" in exI, rule exI, erule conjI)\n apply (simp add: CTypesDefs.ptr_add_def field_simps)\n done\n\nlemma array_assertion_shrink_leftI:\n \"array_assertion (CTypesDefs.ptr_add p (- (int j))) (n + j) htd\n \\ n \\ 0 \\ array_assertion p n htd\"\n apply (drule_tac j=j in array_assertion_shrink_leftD, simp)\n apply (simp add: CTypesDefs.ptr_add_def)\n done\n\nlemma h_t_array_valid:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ h_t_array_valid htd (ptr_coerce p :: 'a ptr) (CARD('b))\"\n by (clarsimp simp: h_t_valid_def h_t_array_valid_def\n typ_uinfo_array_tag_n_m_eq)\n\nlemma array_ptr_valid_array_assertionD:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ array_assertion (ptr_coerce p :: 'a ptr) (CARD('b)) htd\"\n apply (clarsimp simp: array_assertion_def dest!: h_t_array_valid)\n apply (fastforce intro: exI[where x=0])\n done\n\nlemma array_ptr_valid_array_assertionI:\n \"h_t_valid htd gd (q :: (('a :: wf_type)['b :: finite]) ptr)\n \\ q = ptr_coerce p\n \\ n \\ CARD('b)\n \\ array_assertion (p :: 'a ptr) n htd\"\n by (auto dest: array_ptr_valid_array_assertionD\n simp: array_assertion_shrink_right)\n\ntext {* Derived from array_assertion, an appropriate assertion for performing\na pointer addition, or for dereferencing a pointer addition (the strong case).\n\nIn either case, there must be an array connecting the two ends of the pointer\ntransition, with the caveat that the last address can be just out of the array\nif the pointer is not dereferenced, thus the strong/weak distinction.\n\nIf the pointer doesn't actually move, nothing is learned.\n*}\ndefinition\n ptr_add_assertion :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\"\nwhere\n \"ptr_add_assertion ptr offs strong htd \\ offs = 0\n \\ array_assertion (if offs < 0 then CTypesDefs.ptr_add ptr offs else ptr)\n (if offs < 0 then nat (- offs) else if strong then Suc (nat offs) else nat offs)\n htd\"\n\nlemma ptr_add_assertion_positive:\n \"offs \\ 0 \\ ptr_add_assertion ptr offs strong htd\n = (offs = 0 \\ array_assertion ptr (case strong of True \\ Suc (nat offs)\n | False \\ nat offs) htd)\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_negative:\n \"offs < 0 \\ ptr_add_assertion ptr offs strong htd\n = array_assertion (CTypesDefs.ptr_add ptr offs) (nat (- offs)) htd\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_uint[simp]:\n \"ptr_add_assertion ptr (uint offs) strong htd\n = (offs = 0 \\ array_assertion ptr\n (case strong of True \\ Suc (unat offs) | False \\ unat offs) htd)\"\n by (simp add: ptr_add_assertion_positive uint_0_iff unat_def\n split: bool.split)\n\ntext {* Ignore char and void pointers. The C standard specifies that arithmetic on\nchar and void pointers doesn't create any special checks. *}\n\ndefinition\n ptr_add_assertion' :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\"\nwhere\n \"ptr_add_assertion' ptr offs strong htd = (typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE(word8)\n \\ typ_uinfo_t TYPE ('a) = typ_uinfo_t TYPE(unit)\n \\ ptr_add_assertion ptr offs strong htd)\"\n\n(* Useful for clearing away these assumptions. *)\nlemma td_diff_from_typ_name:\n \"typ_name td \\ typ_name td' \\ td \\ td'\"\n by clarsimp\n\nlemma typ_name_void:\n \"typ_name (typ_uinfo_t TYPE(unit)) = ''unit''\"\n by (simp add: typ_uinfo_t_def)\n\nlemmas ptr_add_assertion' = ptr_add_assertion'_def td_diff_from_typ_name typ_name_void\n\ntext {* Mechanism for retyping a range of memory to a non-constant array size. *}\n\ndefinition\n ptr_arr_retyps :: \"nat \\ ('a :: c_type) ptr \\ heap_typ_desc \\ heap_typ_desc\"\nwhere\n \"ptr_arr_retyps n p \\\n htd_update_list (ptr_val p)\n (map (\\i. list_map (typ_slice_t (uinfo_array_tag_n_m TYPE('a) n n) i))\n [0.. ptr_arr_retyps n (p :: ('c :: wf_type) ptr) = ptr_retyp (ptr_coerce p :: ('c['b]) ptr)\"\n apply (rule ext)\n apply (simp add: ptr_arr_retyps_def ptr_retyp_def typ_slices_def\n typ_uinfo_array_tag_n_m_eq)\n done\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/umm_heap/ArrayAssertion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.26294014911576163}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m3_kerberos4.thy (Isabelle/HOL 2016-1)\n ID: $Id: m3_kerberos4.thy 132890 2016-12-24 10:25:57Z csprenge $\n Authors Ivano Somaini, ETH Zurich \n Christoph Sprenger, ETH Zurich \n\n Key distribution protocols\n Third refinement: core Kerberos IV\n\n Copyright (c) 2009-2016 Ivano Somaini, Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Core Kerberos 4 (L3)\\\n\ntheory m3_kerberos4 imports m2_kerberos \"../Refinement/Message\"\nbegin\n\ntext \\\nWe model the core Kerberos 4 protocol:\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B \\\\ \n \\mathrm{M2.} & S \\rightarrow A: & \\{Kab, B, Ts, Na, \\{Kab, A, Ts\\}_{Kbs} \\}_{Kas} \\\\\n \\mathrm{M3.} & A \\rightarrow B: & \\{A, Ta\\}_{Kab}, \\{Kab, A, Ts\\}_{Kbs} \\\\\n \\mathrm{M4.} & B \\rightarrow A: & \\{Ta\\}_{Kab} \\\\\n\\end{array}\n\\]\n\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\.\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\Setup\\\n(******************************************************************************)\n\ntext \\Now we can define the initial key knowledge.\\\n\noverloading ltkeySetup' \\ ltkeySetup begin\ndefinition ltkeySetup_def: \"ltkeySetup' \\ {(sharK C, A) | C A. A = C \\ A = Sv}\"\nend\n\nlemma corrKey_shrK_bad [simp]: \"corrKey = shrK`bad\"\nby (auto simp add: keySetup_def ltkeySetup_def corrKey_def)\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\The secure channels are star-shaped to/from the server. Therefore,\nwe have only one agent in the relation.\\\n\nrecord m3_state = \"m1_state\" +\n IK :: \"msg set\" \\ \\intruder knowledge\\\n\n\ntext \\Observable state:\n@{term \"runs\"}, @{term \"clk\"}, and @{term \"cache\"}.\\\n\ntype_synonym\n m3_obs = \"m2_obs\"\n\ndefinition\n m3_obs :: \"m3_state \\ m3_obs\" where\n \"m3_obs s \\ \\ runs = runs s, leak = leak s, clk = clk s, cache = cache s \\\"\n\ntype_synonym\n m3_pred = \"m3_state set\"\n\ntype_synonym\n m3_trans = \"(m3_state \\ m3_state) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext \\Protocol events.\\\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m2_step1\"}\\\n m3_step1 :: \"[rid_t, agent, agent, nonce] \\ m3_trans\"\nwhere\n \"m3_step1 Ra A B Na \\ {(s, s1).\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n Na = Ra$na \\ \\ \\generated nonce\\\n\n \\ \\actions:\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n IK := insert \\Agent A, Agent B, Nonce Na\\ (IK s) \\ \\send \\M1\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m2_step2\"}\\\n m3_step2 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step2 \\ m1_step2\"\n\ndefinition \\ \\by @{text \"Server\"}, refines @{term m2_step3}\\\n m3_step3 :: \"[rid_t, agent, agent, key, nonce, time] \\ m3_trans\"\nwhere\n \"m3_step3 Rs A B Kab Na Ts \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh server run\\\n Kab = sesK (Rs$sk) \\ \\ \\fresh session key\\\n\n \\Agent A, Agent B, Nonce Na\\ \\ IK s \\ \\ \\recv \\M1\\\\\n Ts = clk s \\ \\ \\fresh timestamp\\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M2\\\\\n s1 = s\\\n runs := (runs s)(Rs \\ (Serv, [A, B], [aNon Na, aNum Ts])),\n IK := insert (Crypt (shrK A) \\ \\send \\M2\\\\\n \\Key Kab, Agent B, Number Ts, Nonce Na,\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\\\)\n (IK s)\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step4}\\\n m3_step4 :: \"[rid_t, agent, agent, nonce, key, time, time, msg] \\ m3_trans\"\nwhere\n \"m3_step4 Ra A B Na Kab Ts Ta X \\ {(s, s1).\n\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\ \\ \\key not yet recv'd\\\n Na = Ra$na \\ \\ \\generated nonce\\\n\n Crypt (shrK A) \\ \\recv \\M2\\\\\n \\Key Kab, Agent B, Number Ts, Nonce Na, X\\ \\ IK s \\\n\n \\ \\read current time\\\n Ta = clk s \\\n\n \\ \\check freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M3\\\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n IK := insert \\Crypt Kab \\Agent A, Number Ta\\, X\\ (IK s) \\ \\\\M3\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m2_step5}\\\n m3_step5 :: \"[rid_t, agent, agent, key, time, time] \\ m3_trans\"\nwhere\n \"m3_step5 Rb A B Kab Ts Ta \\ {(s, s1).\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n \\Crypt Kab \\Agent A, Number Ta\\, \\ \\recv \\M3\\\\\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\\\ \\ IK s \\\n\n \\ \\ensure freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\check authenticator's validity and replay; 'replays' with fresh authenticator ok!\\\n clk s < Ta + La \\\n (B, Kab, Ta) \\ cache s \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n cache := insert (B, Kab, Ta) (cache s),\n IK := insert (Crypt Kab (Number Ta)) (IK s) \\ \\send \\M4\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step6}\\\n m3_step6 :: \"[rid_t, agent, agent, nonce, key, time, time] \\ m3_trans\"\nwhere\n \"m3_step6 Ra A B Na Kab Ts Ta \\ {(s, s').\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]) \\ \\ \\knows key\\\n Na = Ra$na \\ \\ \\generated nonce\\\n clk s < Ts + Ls \\ \\ \\check session key's recentness\\\n\n Crypt Kab (Number Ta) \\ IK s \\ \\ \\recv \\M4\\\\\n\n \\ \\actions:\\\n s' = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))\n \\\n }\"\n\ntext \\Clock tick event\\\n\ndefinition \\ \\refines @{term \"m2_tick\"}\\\n m3_tick :: \"time \\ m3_trans\"\nwhere\n \"m3_tick \\ m1_tick\"\n\n\ntext \\Purge event: purge cache of expired timestamps\\\n\ndefinition \\ \\refines @{term \"m2_purge\"}\\\n m3_purge :: \"agent \\ m3_trans\"\nwhere\n \"m3_purge \\ m1_purge\"\n\n\ntext \\Session key compromise.\\\n\ndefinition \\ \\refines @{term m2_leak}\\\n m3_leak :: \"[rid_t, agent, agent, nonce, time] \\ m3_trans\"\nwhere\n \"m3_leak Rs A B Na Ts \\ {(s, s1).\n \\ \\guards:\\\n runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]) \\\n (clk s \\ Ts + Ls) \\ \\ \\only compromise 'old' session keys!\\\n\n \\ \\actions:\\\n \\ \\record session key as leaked and add it to intruder knowledge\\\n s1 = s\\ leak := insert (sesK (Rs$sk), A, B, Na, Ts) (leak s),\n IK := insert (Key (sesK (Rs$sk))) (IK s) \\\n }\"\n\n\ntext \\Intruder fake event. The following \"Dolev-Yao\" event generates all\nintruder-derivable messages.\\\n\ndefinition \\ \\refines @{term \"m2_fake\"}\\\n m3_DY_fake :: \"m3_trans\"\nwhere\n \"m3_DY_fake \\ {(s, s1).\n\n \\ \\actions:\\\n s1 = s\\ IK := synth (analz (IK s)) \\ \\ \\take DY closure\\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\ndefinition\n m3_init :: \"m3_pred\"\nwhere\n \"m3_init \\ { \\\n runs = Map.empty,\n leak = shrK`bad \\ {undefined},\n clk = 0,\n cache = {},\n IK = Key`shrK`bad\n \\ }\"\n\ndefinition\n m3_trans :: \"m3_trans\" where\n \"m3_trans \\ (\\A B Ra Rb Rs Na Kab Ts Ta T X.\n m3_step1 Ra A B Na \\\n m3_step2 Rb A B \\\n m3_step3 Rs A B Kab Na Ts \\\n m3_step4 Ra A B Na Kab Ts Ta X \\\n m3_step5 Rb A B Kab Ts Ta \\\n m3_step6 Ra A B Na Kab Ts Ta \\\n m3_tick T \\\n m3_purge A \\\n m3_leak Rs A B Na Ts \\\n m3_DY_fake \\\n Id\n )\"\n\ndefinition\n m3 :: \"(m3_state, m3_obs) spec\" where\n \"m3 \\ \\\n init = m3_init,\n trans = m3_trans,\n obs = m3_obs\n \\\"\n\nlemmas m3_loc_defs =\n m3_def m3_init_def m3_trans_def m3_obs_def\n m3_step1_def m3_step2_def m3_step3_def m3_step4_def m3_step5_def\n m3_step6_def m3_tick_def m3_purge_def m3_leak_def m3_DY_fake_def\n\nlemmas m3_defs = m3_loc_defs m2_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\ntext \\Specialized injection that we can apply more aggressively.\\\n\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\n\ndeclare parts_Inj_IK [dest!]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\inv4: Secrecy of pre-distributed shared keys\\\n(*inv**************************************************************************)\n\ndefinition\n m3_inv4_lkeysec :: \"m3_pred\"\nwhere\n \"m3_inv4_lkeysec \\ {s. \\C.\n (Key (shrK C) \\ parts (IK s) \\ C \\ bad) \\\n (C \\ bad \\ Key (shrK C) \\ IK s)\n }\"\n\nlemmas m3_inv4_lkeysecI = m3_inv4_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv4_lkeysecE [elim] = m3_inv4_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv4_lkeysecD = m3_inv4_lkeysec_def [THEN setc_def_to_dest, rule_format]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv4_lkeysec_init [iff]:\n \"init m3 \\ m3_inv4_lkeysec\"\nby (auto simp add: m3_defs intro!: m3_inv4_lkeysecI)\n\nlemma PO_m3_inv4_lkeysec_trans [iff]:\n \"{m3_inv4_lkeysec} trans m3 {> m3_inv4_lkeysec}\"\nby (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv4_lkeysecI)\n (auto dest!: Body)\n\nlemma PO_m3_inv4_lkeysec [iff]: \"reach m3 \\ m3_inv4_lkeysec\"\nby (rule inv_rule_incr) (fast+)\n\n\ntext \\Useful simplifier lemmas\\\n\nlemma m3_inv4_lkeysec_for_parts [simp]:\n \"\\ s \\ m3_inv4_lkeysec \\ \\ Key (shrK C) \\ parts (IK s) \\ C \\ bad\"\nby auto\n\nlemma m3_inv4_lkeysec_for_analz [simp]:\n \"\\ s \\ m3_inv4_lkeysec \\ \\ Key (shrK C) \\ analz (IK s) \\ C \\ bad\"\nby auto\n\n\nsubsubsection \\inv6: Ticket shape for honestly encrypted M2\\\n(*inv**************************************************************************)\n\ndefinition\n m3_inv6_ticket :: \"m3_pred\"\nwhere\n \"m3_inv6_ticket \\ {s. \\A B T K N X.\n A \\ bad \\\n Crypt (shrK A) \\Key K, Agent B, Number T, Nonce N, X\\ \\ parts (IK s) \\\n X = Crypt (shrK B) \\Key K, Agent A, Number T\\ \\ K \\ range sesK\n }\"\n\nlemmas m3_inv6_ticketI = m3_inv6_ticket_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv6_ticketE [elim] = m3_inv6_ticket_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv6_ticketD = m3_inv6_ticket_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv6_ticket_init [iff]:\n \"init m3 \\ m3_inv6_ticket\"\nby (auto simp add: m3_defs intro!: m3_inv6_ticketI)\n\nlemma PO_m3_inv6_ticket_trans [iff]:\n \"{m3_inv6_ticket \\ m3_inv4_lkeysec} trans m3 {> m3_inv6_ticket}\"\napply (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv6_ticketI)\napply (auto dest: m3_inv6_ticketD)\n\\ \\2 subgoals\\\napply (drule parts_cut, drule Body, auto dest: m3_inv6_ticketD)+\ndone\n\nlemma PO_m3_inv6_ticket [iff]: \"reach m3 \\ m3_inv6_ticket\"\nby (rule inv_rule_incr) (auto del: subsetI)\n\n\nsubsubsection \\inv7: Session keys not used to encrypt other session keys\\\n(*inv**************************************************************************)\n\ntext \\Session keys are not used to encrypt other keys. Proof requires\ngeneralization to sets of session keys.\n\nNOTE: For Kerberos 4, this invariant cannot be inherited from the corresponding\nL2 invariant. The simulation relation is only an implication not an equivalence.\n\\\n\ndefinition\n m3_inv7a_sesK_compr :: \"m3_pred\"\nwhere\n \"m3_inv7a_sesK_compr \\ {s. \\K KK.\n KK \\ range sesK \\\n (Key K \\ analz (Key`KK \\ (IK s))) = (K \\ KK \\ Key K \\ analz (IK s))\n }\"\n\nlemmas m3_inv7a_sesK_comprI = m3_inv7a_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv7a_sesK_comprE = m3_inv7a_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv7a_sesK_comprD = m3_inv7a_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Additional lemma\\\nlemmas insert_commute_Key = insert_commute [where x=\"Key K\" for K]\n\nlemmas m3_inv7a_sesK_compr_simps =\n m3_inv7a_sesK_comprD\n m3_inv7a_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n m3_inv7a_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n insert_commute_Key\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv7a_sesK_compr_step4:\n \"{m3_inv7a_sesK_compr \\ m3_inv6_ticket \\ m3_inv4_lkeysec}\n m3_step4 Ra A B Na Kab Ts Ta X\n {> m3_inv7a_sesK_compr}\"\nproof -\n { fix K KK s\n assume H:\n \"s \\ m3_inv4_lkeysec\" \"s \\ m3_inv7a_sesK_compr\" \"s \\ m3_inv6_ticket\"\n \"runs s Ra = Some (Init, [A, B], [])\"\n \"Na = Ra$na\"\n \"KK \\ range sesK\"\n \"Crypt (shrK A) \\Key Kab, Agent B, Number Ts, Nonce Na, X\\ \\ analz (IK s)\"\n have\n \"(Key K \\ analz (insert X (Key ` KK \\ IK s))) =\n (K \\ KK \\ Key K \\ analz (insert X (IK s)))\"\n proof (cases \"A \\ bad\")\n case True\n with H have \"X \\ analz (IK s)\" by (auto dest!: Decrypt)\n moreover\n with H have \"X \\ analz (Key ` KK \\ IK s)\"\n by (auto intro: analz_monotonic)\n ultimately show ?thesis using H\n by (auto simp add: m3_inv7a_sesK_compr_simps analz_insert_eq)\n next\n case False thus ?thesis using H\n by (fastforce simp add: m3_inv7a_sesK_compr_simps\n dest!: m3_inv6_ticketD [OF analz_into_parts])\n qed\n }\n thus ?thesis\n by (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv7a_sesK_comprI dest!: analz_Inj_IK)\nqed\n\ntext \\All together now.\\\n\nlemmas PO_m3_inv7a_sesK_compr_trans_lemmas =\n PO_m3_inv7a_sesK_compr_step4\n\nlemma PO_m3_inv7a_sesK_compr_init [iff]:\n \"init m3 \\ m3_inv7a_sesK_compr\"\nby (auto simp add: m3_defs intro!: m3_inv7a_sesK_comprI)\n\nlemma PO_m3_inv7a_sesK_compr_trans [iff]:\n \"{m3_inv7a_sesK_compr \\ m3_inv6_ticket \\ m3_inv4_lkeysec}\n trans m3\n {> m3_inv7a_sesK_compr}\"\nby (auto simp add: m3_def m3_trans_def intro!: PO_m3_inv7a_sesK_compr_trans_lemmas)\n (auto simp add: PO_hoare_defs m3_defs m3_inv7a_sesK_compr_simps intro!: m3_inv7a_sesK_comprI)\n\nlemma PO_m3_inv7a_sesK_compr [iff]: \"reach m3 \\ m3_inv7a_sesK_compr\"\nby (rule_tac J=\"m3_inv6_ticket \\ m3_inv4_lkeysec\" in inv_rule_incr) (auto)\n\n\nsubsubsection \\inv7b: Session keys not used to encrypt nonces\\\n(*inv**************************************************************************)\n\ntext \\Session keys are not used to encrypt nonces. The proof requires a\ngeneralization to sets of session keys.\\\n\ndefinition\n m3_inv7b_sesK_compr_non :: \"m3_pred\"\nwhere\n \"m3_inv7b_sesK_compr_non \\ {s. \\N KK.\n KK \\ range sesK \\ (Nonce N \\ analz (Key`KK \\ (IK s))) = (Nonce N \\ analz (IK s))\n }\"\n\nlemmas m3_inv7b_sesK_compr_nonI = m3_inv7b_sesK_compr_non_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv7b_sesK_compr_nonE = m3_inv7b_sesK_compr_non_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv7b_sesK_compr_nonD = m3_inv7b_sesK_compr_non_def [THEN setc_def_to_dest, rule_format]\n\nlemmas m3_inv7b_sesK_compr_non_simps =\n m3_inv7b_sesK_compr_nonD\n m3_inv7b_sesK_compr_nonD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n m3_inv7b_sesK_compr_nonD [where KK=\"{Kab}\" for Kab, simplified]\n insert_commute_Key\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv7b_sesK_compr_non_step3:\n \"{m3_inv7b_sesK_compr_non} m3_step3 Rs A B Kab Na Ts {> m3_inv7b_sesK_compr_non}\"\nby (auto simp add: PO_hoare_defs m3_defs m3_inv7b_sesK_compr_non_simps\n intro!: m3_inv7b_sesK_compr_nonI dest!: analz_Inj_IK)\n\nlemma PO_m3_inv7b_sesK_compr_non_step4:\n \"{m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec}\n m3_step4 Ra A B Na Kab Ts Ta X\n {> m3_inv7b_sesK_compr_non}\"\nproof -\n { fix N KK s\n assume H:\n \"s \\ m3_inv4_lkeysec\"\"s \\ m3_inv7b_sesK_compr_non\"\n \"s \\ m3_inv6_ticket\"\n \"runs s Ra = Some (Init, [A, B], [])\"\n \"Na = Ra$na\"\n \"KK \\ range sesK\"\n \"Crypt (shrK A) \\Key Kab, Agent B, Number Ts, Nonce Na, X\\ \\ analz (IK s)\"\n have\n \"(Nonce N \\ analz (insert X (Key ` KK \\ IK s))) =\n (Nonce N \\ analz (insert X (IK s)))\"\n proof (cases)\n assume \"A \\ bad\" show ?thesis\n proof -\n from \\A \\ bad\\ have \"X \\ analz (IK s)\" using H\n by (auto dest!: Decrypt)\n moreover\n hence \"X \\ analz (Key ` KK \\ IK s)\"\n by (auto intro: analz_monotonic)\n ultimately show ?thesis using H\n by (auto simp add: m3_inv7b_sesK_compr_non_simps analz_insert_eq)\n qed\n next\n assume \"A \\ bad\" thus ?thesis using H\n by (fastforce simp add: m3_inv7b_sesK_compr_non_simps\n dest!: m3_inv6_ticketD [OF analz_into_parts])\n qed\n }\n thus ?thesis\n by (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv7b_sesK_compr_nonI\n dest!: analz_Inj_IK)\nqed\n\n\ntext \\All together now.\\\n\nlemmas PO_m3_inv7b_sesK_compr_non_trans_lemmas =\n PO_m3_inv7b_sesK_compr_non_step3 PO_m3_inv7b_sesK_compr_non_step4\n\nlemma PO_m3_inv7b_sesK_compr_non_init [iff]:\n \"init m3 \\ m3_inv7b_sesK_compr_non\"\nby (auto simp add: m3_defs intro!: m3_inv7b_sesK_compr_nonI)\n\nlemma PO_m3_inv7b_sesK_compr_non_trans [iff]:\n \"{m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec}\n trans m3\n {> m3_inv7b_sesK_compr_non}\"\nby (auto simp add: m3_def m3_trans_def intro!: PO_m3_inv7b_sesK_compr_non_trans_lemmas)\n (auto simp add: PO_hoare_defs m3_defs m3_inv7b_sesK_compr_non_simps\n intro!: m3_inv7b_sesK_compr_nonI)\n\nlemma PO_m3_inv7b_sesK_compr_non [iff]: \"reach m3 \\ m3_inv7b_sesK_compr_non\"\nby (rule_tac J=\"m3_inv6_ticket \\ m3_inv4_lkeysec\" in inv_rule_incr)\n (auto)\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\nsubsubsection \\Message abstraction and simulation relation\\\n(******************************************************************************)\n\ntext \\Abstraction function on sets of messages.\\\n\ninductive_set\n abs_msg :: \"msg set \\ chmsg set\"\n for H :: \"msg set\"\nwhere\n am_M1:\n \"\\Agent A, Agent B, Nonce N\\ \\ H\n \\ Insec A B (Msg [aNon N]) \\ abs_msg H\"\n| am_M2a:\n \"Crypt (shrK C) \\Key K, Agent B, Number T, Nonce N, X\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt B, aNum T, aNon N]) \\ abs_msg H\"\n| am_M2b:\n \"Crypt (shrK C) \\Key K, Agent A, Number T\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt A, aNum T]) \\ abs_msg H\"\n| am_M3:\n \"Crypt K \\Agent A, Number T\\ \\ H\n \\ dAuth K (Msg [aAgt A, aNum T]) \\ abs_msg H\"\n| am_M4:\n \"Crypt K (Number T) \\ H\n \\ dAuth K (Msg [aNum T]) \\ abs_msg H\"\n\n\ntext \\R23: The simulation relation. This is a data refinement of\nthe insecure and secure channels of refinement 2.\\\n\ndefinition\n R23_msgs :: \"(m2_state \\ m3_state) set\" where\n \"R23_msgs \\ {(s, t). abs_msg (parts (IK t)) \\ chan s }\"\n\ndefinition\n R23_keys :: \"(m2_state \\ m3_state) set\" where\n \"R23_keys \\ {(s, t). \\KK K. KK \\ range sesK \\\n Key K \\ analz (Key`KK \\ (IK t)) \\ aKey K \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_non :: \"(m2_state \\ m3_state) set\" where\n \"R23_non \\ {(s, t). \\KK N. KK \\ range sesK \\\n Nonce N \\ analz (Key`KK \\ (IK t)) \\ aNon N \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_pres :: \"(m2_state \\ m3_state) set\" where\n \"R23_pres \\ {(s, t). runs s = runs t \\ leak s = leak t \\ clk s = clk t \\ cache s = cache t}\"\n\ndefinition\n R23 :: \"(m2_state \\ m3_state) set\" where\n \"R23 \\ R23_msgs \\ R23_keys \\ R23_non \\ R23_pres\"\n\nlemmas R23_defs =\n R23_def R23_msgs_def R23_keys_def R23_non_def R23_pres_def\n\n\ntext \\The mediator function is the identity here.\\\n\ndefinition\n med32 :: \"m3_obs \\ m2_obs\" where\n \"med32 \\ id\"\n\n\nlemmas R23_msgsI = R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_msgsE' [elim] =\n R23_msgs_def [THEN rel_def_to_dest, simplified, rule_format, THEN subsetD]\n\nlemmas R23_keysI = R23_keys_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_keysE [elim] = R23_keys_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_keysD = R23_keys_def [THEN rel_def_to_dest, simplified, rule_format, rotated 2]\n\nlemmas R23_nonI = R23_non_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_nonE [elim] = R23_non_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_nonD = R23_non_def [THEN rel_def_to_dest, simplified, rule_format, rotated 2]\n\nlemmas R23_presI = R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_keysI R23_nonI R23_presI\n\n\ntext \\Lemmas for various instantiations (keys and nonces).\\\n\nlemmas R23_keys_dests =\n R23_keysD\n R23_keysD [where KK=\"{}\", simplified]\n R23_keysD [where KK=\"{K}\" for K, simplified]\n R23_keysD [where KK=\"insert K KK\" for K KK, simplified, OF _ _ conjI]\n\nlemmas R23_non_dests =\n R23_nonD\n R23_nonD [where KK=\"{}\", simplified]\n R23_nonD [where KK=\"{K}\" for K, simplified]\n R23_nonD [where KK=\"insert K KK\" for K KK, simplified, OF _ _ conjI]\n\nlemmas R23_dests = R23_keys_dests R23_non_dests\n\n\nsubsubsection \\General lemmas\\\n(******************************************************************************)\n\ntext \\General facts about @{term \"abs_msg\"}\\\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n \"abs_msg (G \\ H) = abs_msg G \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n \"\\ m \\ abs_msg G; G \\ H \\ \\ m \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n \"\\ m \\ abs_msg H \\ \\ m \\ abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\Facts about @{term \"abs_msg\"} concerning abstraction of fakeable\nmessages. This is crucial for proving the refinement of the intruder event.\\\n\nlemma abs_msg_DY_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs; (s, t) \\ R23_keys; (s, t) \\ R23_non; t \\ m3_inv4_lkeysec \\\n \\ abs_msg (synth (analz (IK t))) \\ fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n\\ \\9 subgoals, deal with replays first\\\nprefer 2 apply (blast)\nprefer 3 apply (blast)\nprefer 4 apply (blast)\nprefer 5 apply (blast)\n\\ \\remaining 5 subgoals are real fakes\\\napply (intro fake_StatCh fake_DynCh, auto dest: R23_dests)+\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\ntext \\Pair decomposition. These were set to \\texttt{elim!}, which is too\nagressive here.\\\n\ndeclare MPair_analz [rule del, elim]\ndeclare MPair_parts [rule del, elim]\n\n\ntext \\Protocol events.\\\n\nlemma PO_m3_step1_refines_m2_step1:\n \"{R23}\n (m2_step1 Ra A B Na), (m3_step1 Ra A B Na)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n \"{R23}\n (m2_step2 Rb A B), (m3_step2 Rb A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_step3_refines_m2_step3:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv7a_sesK_compr \\ m3_inv4_lkeysec)}\n (m2_step3 Rs A B Kab Na Ts), (m3_step3 Rs A B Kab Na Ts)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_non\"\n \"(s, t) \\ R23_pres\"\n \"s \\ m2_inv3a_sesK_compr\"\n \"t \\ m3_inv7a_sesK_compr\" \"t \\ m3_inv4_lkeysec\"\n \"Kab = sesK (Rs$sk)\" \"Rs \\ dom (runs t)\"\n \"\\Agent A, Agent B, Nonce Na\\ \\ parts (IK t)\"\n let ?s'=\n \"s\\ runs := runs s(Rs \\ (Serv, [A, B], [aNon Na, aNum (clk t)])),\n chan := insert (Secure Sv A (Msg [aKey Kab, aAgt B, aNum (clk t), aNon Na]))\n (insert (Secure Sv B (Msg [aKey Kab, aAgt A, aNum (clk t)])) (chan s)) \\\"\n let ?t'=\n \"t\\ runs := runs t(Rs \\ (Serv, [A, B], [aNon Na, aNum (clk t)])),\n IK := insert\n (Crypt (shrK A)\n \\ Key Kab, Agent B, Number (clk t), Nonce Na,\n Crypt (shrK B) \\ Key Kab, Agent A, Number (clk t) \\\\)\n (IK t) \\\"\n \\ \\here we go\\\n have \"(?s', ?t') \\ R23_msgs\" using H\n by (-) (rule R23_intros, auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\" using H\n by (-) (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv7a_sesK_compr_simps dest: R23_keys_dests)\n moreover\n have \"(?s', ?t') \\ R23_non\" using H\n by (-) (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv7a_sesK_compr_simps dest: R23_non_dests)\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (-) (rule R23_intros, auto)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs)\nqed\n\nlemma PO_m3_step4_refines_m2_step4:\n \"{R23 \\ (UNIV)\n \\ (m3_inv7a_sesK_compr \\ m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec)}\n (m2_step4 Ra A B Na Kab Ts Ta), (m3_step4 Ra A B Na Kab Ts Ta X)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_non\" \"(s, t) \\ R23_pres\"\n \"t \\ m3_inv7a_sesK_compr\" \"t \\ m3_inv7b_sesK_compr_non\"\n \"t \\ m3_inv6_ticket\" \"t \\ m3_inv4_lkeysec\"\n \"runs t Ra = Some (Init, [A, B], [])\"\n \"Na = Ra$na\"\n \"Crypt (shrK A) \\Key Kab, Agent B, Number Ts, Nonce Na, X\\ \\ analz (IK t)\"\n let ?s' = \"s\\ runs := runs s(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum (clk t)])),\n chan := insert (dAuth Kab (Msg [aAgt A, aNum (clk t)])) (chan s) \\\"\n and ?t' = \"t\\ runs := runs t(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts, aNum (clk t)])),\n IK := insert \\ Crypt Kab \\Agent A, Number (clk t)\\, X \\ (IK t) \\\"\n from H have\n \"Secure Sv A (Msg [aKey Kab, aAgt B, aNum Ts, aNon Na]) \\ chan s\"\n by (auto)\n moreover\n have \"X \\ parts (IK t)\" using H by (auto dest!: Body MPair_parts)\n hence \"(?s', ?t') \\ R23_msgs\" using H by (auto intro!: R23_intros) (auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\"\n proof (cases)\n assume \"A \\ bad\"\n with H have \"X \\ analz (IK t)\" by (-) (drule Decrypt, auto)\n with H show ?thesis\n by (-) (rule R23_intros, auto dest!: analz_cut intro: analz_monotonic)\n next\n assume \"A \\ bad\" show ?thesis\n proof -\n note H\n moreover\n with \\A \\ bad\\\n have \"X = Crypt (shrK B) \\Key Kab, Agent A, Number Ts \\ \\ Kab \\ range sesK\"\n by (auto dest!: m3_inv6_ticketD)\n moreover\n { assume H1: \"Key (shrK B) \\ analz (IK t)\"\n have \"aKey Kab \\ extr ik0 (chan s)\"\n proof -\n note calculation\n moreover\n hence \"Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts]) \\ chan s\"\n by (-) (drule analz_into_parts, drule Body, elim MPair_parts, auto)\n ultimately\n show ?thesis using H1 by auto\n qed\n }\n ultimately show ?thesis\n by (-) (rule R23_intros, auto simp add: m3_inv7a_sesK_compr_simps)\n qed\n qed\n moreover\n have \"(?s', ?t') \\ R23_non\"\n proof (cases)\n assume \"A \\ bad\"\n hence \"X \\ analz (IK t)\" using H by (-) (drule Decrypt, auto)\n thus ?thesis using H\n by (-) (rule R23_intros, auto dest!: analz_cut intro: analz_monotonic)\n next\n assume \"A \\ bad\"\n hence \"X = Crypt (shrK B) \\Key Kab, Agent A, Number Ts \\ \\ Kab \\ range sesK\" using H\n by (auto dest!: m3_inv6_ticketD)\n thus ?thesis using H\n by (-) (rule R23_intros,\n auto simp add: m3_inv7a_sesK_compr_simps m3_inv7b_sesK_compr_non_simps)\n qed\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (auto intro!: R23_intros)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs dest!: analz_Inj_IK)\nqed\n\nlemma PO_m3_step5_refines_m2_step5:\n \"{R23}\n (m2_step5 Rb A B Kab Ts Ta), (m3_step5 Rb A B Kab Ts Ta)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step6_refines_m2_step6:\n \"{R23}\n (m2_step6 Ra A B Na Kab Ts Ta), (m3_step6 Ra A B Na Kab Ts Ta)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_tick_refines_m2_tick:\n \"{R23}\n (m2_tick T), (m3_tick T)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_purge_refines_m2_purge:\n \"{R23}\n (m2_purge A), (m3_purge A)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\n\ntext \\Intruder events.\\\n\nlemma PO_m3_leak_refines_m2_leak:\n \"{R23}\n (m2_leak Rs A B Na Ts), (m3_leak Rs A B Na Ts)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto dest: R23_dests)\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n \"{R23 \\ UNIV \\ (m3_inv4_lkeysec)}\n m2_fake, m3_DY_fake\n {> R23}\"\napply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros\n del: abs_msg.cases)\napply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]\n del: abs_msg.cases)\napply (auto dest: R23_dests)\ndone\n\n\ntext \\All together now...\\\n\nlemmas PO_m3_trans_refines_m2_trans =\n PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n PO_m3_step3_refines_m2_step3 PO_m3_step4_refines_m2_step4\n PO_m3_step5_refines_m2_step5 PO_m3_step6_refines_m2_step6\n PO_m3_tick_refines_m2_tick PO_m3_purge_refines_m2_purge\n PO_m3_leak_refines_m2_leak PO_m3_DY_fake_refines_m2_fake\n\n\nlemma PO_m3_refines_init_m2 [iff]:\n \"init m3 \\ R23``(init m2)\"\nby (auto simp add: R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n \"{R23 \\ (m2_inv3a_sesK_compr)\n \\ (m3_inv7a_sesK_compr \\ m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec)}\n (trans m2), (trans m3)\n {> R23}\"\nby (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\n (blast intro!: PO_m3_trans_refines_m2_trans)+\n\nlemma PO_m3_observation_consistent [iff]:\n \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m3_defs)\n\n\ntext \\Refinement result.\\\n\nlemma m3_refines_m2 [iff]:\n \"refines\n (R23 \\\n (m2_inv3a_sesK_compr) \\\n (m3_inv7a_sesK_compr \\ m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec))\n med32 m2 m3\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m3_implements_m2 [iff]:\n \"implements med32 m2 m3\"\nby (rule refinement_soundness) (auto)\n\n\nsubsection \\Inherited invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv3 (derived): Key secrecy for initiator\\\n(*invh*************************************************************************)\n\ndefinition\n m3_inv3_ikk_init :: \"m3_state set\"\nwhere\n \"m3_inv3_ikk_init \\ {s. \\A B Ra K Ts nl.\n runs s Ra = Some (Init, [A, B], aKey K # aNum Ts # nl) \\ A \\ good \\ B \\ good \\\n Key K \\ analz (IK s) \\\n (K, A, B, Ra$na, Ts) \\ leak s\n }\"\n\nlemmas m3_inv3_ikk_initI = m3_inv3_ikk_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_ikk_initE [elim] = m3_inv3_ikk_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_ikk_initD = m3_inv3_ikk_init_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv3_ikk_init: \"reach m3 \\ m3_inv3_ikk_init\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n show \"Range (R23 \\\n m2_inv3a_sesK_compr\n \\ (m3_inv7a_sesK_compr \\ m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec)\n \\ m2_inv6_ikk_init \\ UNIV)\n \\ m3_inv3_ikk_init\"\n by (auto simp add: R23_def R23_pres_def intro!: m3_inv3_ikk_initI)\n (elim m2_inv6_ikk_initE, auto dest: R23_keys_dests)\nqed auto\n\n\nsubsubsection \\inv4 (derived): Key secrecy for responder\\\n(*invh*************************************************************************)\n\ndefinition\n m3_inv4_ikk_resp :: \"m3_state set\"\nwhere\n \"m3_inv4_ikk_resp \\ {s. \\A B Rb K Ts nl.\n runs s Rb = Some (Resp, [A, B], aKey K # aNum Ts # nl) \\ A \\ good \\ B \\ good \\\n Key K \\ analz (IK s) \\\n (\\Na. (K, A, B, Na, Ts) \\ leak s)\n }\"\n\nlemmas m3_inv4_ikk_respI = m3_inv4_ikk_resp_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv4_ikk_respE [elim] = m3_inv4_ikk_resp_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv4_ikk_respD = m3_inv4_ikk_resp_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv4_ikk_resp: \"reach m3 \\ m3_inv4_ikk_resp\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n show \"Range (R23 \\ m2_inv3a_sesK_compr\n \\ (m3_inv7a_sesK_compr \\ m3_inv7b_sesK_compr_non \\ m3_inv6_ticket \\ m3_inv4_lkeysec)\n \\ m2_inv7_ikk_resp \\ UNIV)\n \\ m3_inv4_ikk_resp\"\n by (auto simp add: R23_def R23_pres_def intro!: m3_inv4_ikk_respI)\n (elim m2_inv7_ikk_respE, auto dest: R23_keys_dests)\nqed auto\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m3_kerberos4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.26294014911576163}} {"text": "theory SINVAR_ACLcommunicateWith_impl\nimports SINVAR_ACLcommunicateWith \"../TopoS_Interface_impl\"\nbegin\n\ncode_identifier code_module SINVAR_ACLcommunicateWith_impl => (Scala) SINVAR_ACLcommunicateWith\n\n\nsubsubsection {* List Implementation *}\n\nfun sinvar :: \"'v list_graph \\ ('v \\ 'v list) \\ bool\" where\n \"sinvar G nP = (\\ v \\ set (nodesL G). \\a \\ (set (succ_tran G v)). a \\ set (nP v))\"\n\n\ndefinition \"NetModel_node_props (P::('v::vertex, 'v list) TopoS_Params) = \n (\\ i. (case (node_properties P) i of Some property \\ property | None \\ SINVAR_ACLcommunicateWith.default_node_properties))\"\n\n\ndefinition \"ACLcommunicateWith_offending_list = Generic_offending_list sinvar\"\n\ndefinition \"ACLcommunicateWith_eval G P = (wf_list_graph G \\ \n sinvar G (SecurityInvariant.node_props SINVAR_ACLcommunicateWith.default_node_properties P))\"\n\n\nlemma sinvar_correct: \"wf_list_graph G \\ SINVAR_ACLcommunicateWith.sinvar (list_graph_to_graph G) nP = sinvar G nP\"\nby (metis SINVAR_ACLcommunicateWith.sinvar.simps SINVAR_ACLcommunicateWith_impl.sinvar.simps graph.select_convs(1) list_graph_to_graph_def succ_tran_correct)\n\n\ninterpretation SINVAR_ACLcommunicateWith_impl:TopoS_List_Impl \n where default_node_properties=SINVAR_ACLcommunicateWith.default_node_properties\n and sinvar_spec=SINVAR_ACLcommunicateWith.sinvar\n and sinvar_impl=sinvar\n and receiver_violation=SINVAR_ACLcommunicateWith.receiver_violation\n and offending_flows_impl=ACLcommunicateWith_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=ACLcommunicateWith_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(rule conjI)\n apply(simp add: TopoS_ACLcommunicateWith; fail)\n apply(intro allI impI)\n apply(fact sinvar_correct)\n apply(rule conjI)\n apply(unfold ACLcommunicateWith_offending_list_def)\n apply(intro allI impI)\n apply(rule Generic_offending_list_correct)\n apply(assumption)\n apply(simp only: sinvar_correct; fail)\n apply(rule conjI)\n apply(intro allI)\n apply(simp only: NetModel_node_props_def)\n apply(metis ACLcommunicateWith.node_props.simps ACLcommunicateWith.node_props_eq_node_props_formaldef)\n apply(simp only: ACLcommunicateWith_eval_def)\n apply(intro allI impI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_ACLcommunicateWith])\n apply(simp only: sinvar_correct; fail)\ndone\n\n\nsubsubsection {* packing *}\n definition SINVAR_LIB_ACLcommunicateWith:: \"('v::vertex, 'v list) TopoS_packed\" where\n \"SINVAR_LIB_ACLcommunicateWith \\ \n \\ nm_name = ''ACLcommunicateWith'', \n nm_receiver_violation = SINVAR_ACLcommunicateWith.receiver_violation,\n nm_default = SINVAR_ACLcommunicateWith.default_node_properties, \n nm_sinvar = sinvar,\n nm_offending_flows = ACLcommunicateWith_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = ACLcommunicateWith_eval\n \\\"\n interpretation SINVAR_LIB_ACLcommunicateWith_interpretation: TopoS_modelLibrary SINVAR_LIB_ACLcommunicateWith\n SINVAR_ACLcommunicateWith.sinvar\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_ACLcommunicateWith_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\n\n\ntext {* Examples*}\ncontext begin\n text{*\n 1 can access 2 and 3\n 2 can access 3\n *}\n private lemma \"sinvar\n \\ nodesL = [1::nat, 2, 3],\n edgesL = [(1,2), (2,3)]\\\n (((\\v. SINVAR_ACLcommunicateWith.default_node_properties)\n (1 := [2,3]))\n (2 := [3]))\" by eval\n\n text{*\n Everyone can access everyone, except for 1: 1 must not access 4.\n The offending flows may be any edge on the path from 1 to 4\n *}\n lemma \"ACLcommunicateWith_offending_list \n \\ nodesL = [1::nat, 2, 3, 4],\n edgesL = [(1,2), (2,3), (3, 4)]\\\n (((((\\v. SINVAR_ACLcommunicateWith.default_node_properties)\n (1 := [1,2,3]))\n (2 := [1,2,3,4]))\n (3 := [1,2,3,4]))\n (4 := [1,2,3,4])) =\n [[(1, 2)], [(2, 3)], [(3, 4)]]\" by eval\n text{*\n If we add the additional edge from 1 to 3, then the offending flows are either\n \\<^item> [(3.4)], because this disconnects 4 from the graph completely\n \\<^item> any pair of edges which disconnects 1 from 3\n *}\n lemma \"ACLcommunicateWith_offending_list \n \\ nodesL = [1::nat, 2, 3, 4],\n edgesL = [(1,2), (1,3), (2,3), (3, 4)]\\\n (((((\\v. SINVAR_ACLcommunicateWith.default_node_properties)\n (1 := [1,2,3]))\n (2 := [1,2,3,4]))\n (3 := [1,2,3,4]))\n (4 := [1,2,3,4])) =\n [[(1, 2), (1, 3)], [(1, 3), (2, 3)], [(3, 4)]]\" by eval\nend\n\n\nhide_const (open) NetModel_node_props\nhide_const (open) sinvar\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Security_Invariants/SINVAR_ACLcommunicateWith_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056167854461, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.2627767882488757}} {"text": "(* Title: HOL/HOLCF/IOA/meta_theory/RefCorrectness.thy\n Author: Olaf Müller\n*)\n\nsection {* Correctness of Refinement Mappings in HOLCF/IOA *}\n\ntheory RefCorrectness\nimports RefMappings\nbegin\n\ndefinition\n corresp_exC :: \"('a,'s2)ioa => ('s1 => 's2) => ('a,'s1)pairs\n -> ('s1 => ('a,'s2)pairs)\" where\n \"corresp_exC A f = (fix$(LAM h ex. (%s. case ex of\n nil => nil\n | x##xs => (flift1 (%pr. (@cex. move A cex (f s) (fst pr) (f (snd pr)))\n @@ ((h$xs) (snd pr)))\n $x) )))\"\ndefinition\n corresp_ex :: \"('a,'s2)ioa => ('s1 => 's2) =>\n ('a,'s1)execution => ('a,'s2)execution\" where\n \"corresp_ex A f ex = (f (fst ex),(corresp_exC A f$(snd ex)) (fst ex))\"\n\ndefinition\n is_fair_ref_map :: \"('s1 => 's2) => ('a,'s1)ioa => ('a,'s2)ioa => bool\" where\n \"is_fair_ref_map f C A =\n (is_ref_map f C A &\n (! ex : executions(C). fair_ex C ex --> fair_ex A (corresp_ex A f ex)))\"\n\n(* Axioms for fair trace inclusion proof support, not for the correctness proof\n of refinement mappings!\n Note: Everything is superseded by LiveIOA.thy! *)\n\naxiomatization where\ncorresp_laststate:\n \"Finite ex ==> laststate (corresp_ex A f (s,ex)) = f (laststate (s,ex))\"\n\naxiomatization where\ncorresp_Finite:\n \"Finite (snd (corresp_ex A f (s,ex))) = Finite ex\"\n\naxiomatization where\nFromAtoC:\n \"fin_often (%x. P (snd x)) (snd (corresp_ex A f (s,ex))) ==> fin_often (%y. P (f (snd y))) ex\"\n\naxiomatization where\nFromCtoA:\n \"inf_often (%y. P (fst y)) ex ==> inf_often (%x. P (fst x)) (snd (corresp_ex A f (s,ex)))\"\n\n\n(* Proof by case on inf W in ex: If so, ok. If not, only fin W in ex, ie there is\n an index i from which on no W in ex. But W inf enabled, ie at least once after i\n W is enabled. As W does not occur after i and W is enabling_persistent, W keeps\n enabled until infinity, ie. indefinitely *)\naxiomatization where\npersistent:\n \"[|inf_often (%x. Enabled A W (snd x)) ex; en_persistent A W|]\n ==> inf_often (%x. fst x :W) ex | fin_often (%x. ~Enabled A W (snd x)) ex\"\n\naxiomatization where\ninfpostcond:\n \"[| is_exec_frag A (s,ex); inf_often (%x. fst x:W) ex|]\n ==> inf_often (% x. set_was_enabled A W (snd x)) ex\"\n\n\nsubsection \"corresp_ex\"\n\nlemma corresp_exC_unfold: \"corresp_exC A f = (LAM ex. (%s. case ex of\n nil => nil\n | x##xs => (flift1 (%pr. (@cex. move A cex (f s) (fst pr) (f (snd pr)))\n @@ ((corresp_exC A f $xs) (snd pr)))\n $x) ))\"\napply (rule trans)\napply (rule fix_eq2)\napply (simp only: corresp_exC_def)\napply (rule beta_cfun)\napply (simp add: flift1_def)\ndone\n\nlemma corresp_exC_UU: \"(corresp_exC A f$UU) s=UU\"\napply (subst corresp_exC_unfold)\napply simp\ndone\n\nlemma corresp_exC_nil: \"(corresp_exC A f$nil) s = nil\"\napply (subst corresp_exC_unfold)\napply simp\ndone\n\nlemma corresp_exC_cons: \"(corresp_exC A f$(at>>xs)) s =\n (@cex. move A cex (f s) (fst at) (f (snd at)))\n @@ ((corresp_exC A f$xs) (snd at))\"\napply (rule trans)\napply (subst corresp_exC_unfold)\napply (simp add: Consq_def flift1_def)\napply simp\ndone\n\n\ndeclare corresp_exC_UU [simp] corresp_exC_nil [simp] corresp_exC_cons [simp]\n\n\n\nsubsection \"properties of move\"\n\nlemma move_is_move:\n \"[|is_ref_map f C A; reachable C s; (s,a,t):trans_of C|] ==>\n move A (@x. move A x (f s) a (f t)) (f s) a (f t)\"\napply (unfold is_ref_map_def)\napply (subgoal_tac \"? ex. move A ex (f s) a (f t) \")\nprefer 2\napply simp\napply (erule exE)\napply (rule someI)\napply assumption\ndone\n\nlemma move_subprop1:\n \"[|is_ref_map f C A; reachable C s; (s,a,t):trans_of C|] ==>\n is_exec_frag A (f s,@x. move A x (f s) a (f t))\"\napply (cut_tac move_is_move)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop2:\n \"[|is_ref_map f C A; reachable C s; (s,a,t):trans_of C|] ==>\n Finite ((@x. move A x (f s) a (f t)))\"\napply (cut_tac move_is_move)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop3:\n \"[|is_ref_map f C A; reachable C s; (s,a,t):trans_of C|] ==>\n laststate (f s,@x. move A x (f s) a (f t)) = (f t)\"\napply (cut_tac move_is_move)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\nlemma move_subprop4:\n \"[|is_ref_map f C A; reachable C s; (s,a,t):trans_of C|] ==>\n mk_trace A$((@x. move A x (f s) a (f t))) =\n (if a:ext A then a>>nil else nil)\"\napply (cut_tac move_is_move)\ndefer\napply assumption+\napply (simp add: move_def)\ndone\n\n\n(* ------------------------------------------------------------------ *)\n(* The following lemmata contribute to *)\n(* TRACE INCLUSION Part 1: Traces coincide *)\n(* ------------------------------------------------------------------ *)\n\nsection \"Lemmata for <==\"\n\n(* --------------------------------------------------- *)\n(* Lemma 1.1: Distribution of mk_trace and @@ *)\n(* --------------------------------------------------- *)\n\nlemma mk_traceConc: \"mk_trace C$(ex1 @@ ex2)= (mk_trace C$ex1) @@ (mk_trace C$ex2)\"\napply (simp add: mk_trace_def filter_act_def MapConc)\ndone\n\n\n\n(* ------------------------------------------------------\n Lemma 1 :Traces coincide\n ------------------------------------------------------- *)\ndeclare split_if [split del]\n\nlemma lemma_1:\n \"[|is_ref_map f C A; ext C = ext A|] ==>\n !s. reachable C s & is_exec_frag C (s,xs) -->\n mk_trace C$xs = mk_trace A$(snd (corresp_ex A f (s,xs)))\"\napply (unfold corresp_ex_def)\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm is_exec_frag_def}] 1 *})\n(* cons case *)\napply (auto simp add: mk_traceConc)\napply (frule reachable.reachable_n)\napply assumption\napply (erule_tac x = \"y\" in allE)\napply (simp add: move_subprop4 split add: split_if)\ndone\n\ndeclare split_if [split]\n\n(* ------------------------------------------------------------------ *)\n(* The following lemmata contribute to *)\n(* TRACE INCLUSION Part 2: corresp_ex is execution *)\n(* ------------------------------------------------------------------ *)\n\nsection \"Lemmata for ==>\"\n\n(* -------------------------------------------------- *)\n(* Lemma 2.1 *)\n(* -------------------------------------------------- *)\n\nlemma lemma_2_1 [rule_format (no_asm)]:\n\"Finite xs -->\n (!s .is_exec_frag A (s,xs) & is_exec_frag A (t,ys) &\n t = laststate (s,xs)\n --> is_exec_frag A (s,xs @@ ys))\"\n\napply (rule impI)\napply (tactic {* Seq_Finite_induct_tac @{context} 1 *})\n(* main case *)\napply (auto simp add: split_paired_all)\ndone\n\n\n(* ----------------------------------------------------------- *)\n(* Lemma 2 : corresp_ex is execution *)\n(* ----------------------------------------------------------- *)\n\n\n\nlemma lemma_2:\n \"[| is_ref_map f C A |] ==>\n !s. reachable C s & is_exec_frag C (s,xs)\n --> is_exec_frag A (corresp_ex A f (s,xs))\"\n\napply (unfold corresp_ex_def)\n\napply simp\napply (tactic {* pair_induct_tac @{context} \"xs\" [@{thm is_exec_frag_def}] 1 *})\n(* main case *)\napply auto\napply (rule_tac t = \"f y\" in lemma_2_1)\n\n(* Finite *)\napply (erule move_subprop2)\napply assumption+\napply (rule conjI)\n\n(* is_exec_frag *)\napply (erule move_subprop1)\napply assumption+\napply (rule conjI)\n\n(* Induction hypothesis *)\n(* reachable_n looping, therefore apply it manually *)\napply (erule_tac x = \"y\" in allE)\napply simp\napply (frule reachable.reachable_n)\napply assumption\napply simp\n(* laststate *)\napply (erule move_subprop3 [symmetric])\napply assumption+\ndone\n\n\nsubsection \"Main Theorem: TRACE - INCLUSION\"\n\nlemma trace_inclusion:\n \"[| ext C = ext A; is_ref_map f C A |]\n ==> traces C <= traces A\"\n\n apply (unfold traces_def)\n\n apply (simp (no_asm) add: has_trace_def2)\n apply auto\n\n (* give execution of abstract automata *)\n apply (rule_tac x = \"corresp_ex A f ex\" in bexI)\n\n (* Traces coincide, Lemma 1 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (erule lemma_1 [THEN spec, THEN mp])\n apply assumption+\n apply (simp add: executions_def reachable.reachable_0)\n\n (* corresp_ex is execution, Lemma 2 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (simp add: executions_def)\n (* start state *)\n apply (rule conjI)\n apply (simp add: is_ref_map_def corresp_ex_def)\n (* is-execution-fragment *)\n apply (erule lemma_2 [THEN spec, THEN mp])\n apply (simp add: reachable.reachable_0)\n done\n\n\nsubsection \"Corollary: FAIR TRACE - INCLUSION\"\n\nlemma fininf: \"(~inf_often P s) = fin_often P s\"\napply (unfold fin_often_def)\napply auto\ndone\n\n\nlemma WF_alt: \"is_wfair A W (s,ex) =\n (fin_often (%x. ~Enabled A W (snd x)) ex --> inf_often (%x. fst x :W) ex)\"\napply (simp add: is_wfair_def fin_often_def)\napply auto\ndone\n\nlemma WF_persistent: \"[|is_wfair A W (s,ex); inf_often (%x. Enabled A W (snd x)) ex;\n en_persistent A W|]\n ==> inf_often (%x. fst x :W) ex\"\napply (drule persistent)\napply assumption\napply (simp add: WF_alt)\napply auto\ndone\n\n\nlemma fair_trace_inclusion: \"!! C A.\n [| is_ref_map f C A; ext C = ext A;\n !! ex. [| ex:executions C; fair_ex C ex|] ==> fair_ex A (corresp_ex A f ex) |]\n ==> fairtraces C <= fairtraces A\"\napply (simp (no_asm) add: fairtraces_def fairexecutions_def)\napply auto\napply (rule_tac x = \"corresp_ex A f ex\" in exI)\napply auto\n\n (* Traces coincide, Lemma 1 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (erule lemma_1 [THEN spec, THEN mp])\n apply assumption+\n apply (simp add: executions_def reachable.reachable_0)\n\n (* corresp_ex is execution, Lemma 2 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (simp add: executions_def)\n (* start state *)\n apply (rule conjI)\n apply (simp add: is_ref_map_def corresp_ex_def)\n (* is-execution-fragment *)\n apply (erule lemma_2 [THEN spec, THEN mp])\n apply (simp add: reachable.reachable_0)\n\ndone\n\nlemma fair_trace_inclusion2: \"!! C A.\n [| inp(C) = inp(A); out(C)=out(A);\n is_fair_ref_map f C A |]\n ==> fair_implements C A\"\napply (simp add: is_fair_ref_map_def fair_implements_def fairtraces_def fairexecutions_def)\napply auto\napply (rule_tac x = \"corresp_ex A f ex\" in exI)\napply auto\n\n (* Traces coincide, Lemma 1 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (erule lemma_1 [THEN spec, THEN mp])\n apply (simp (no_asm) add: externals_def)\n apply (auto)[1]\n apply (simp add: executions_def reachable.reachable_0)\n\n (* corresp_ex is execution, Lemma 2 *)\n apply (tactic {* pair_tac @{context} \"ex\" 1 *})\n apply (simp add: executions_def)\n (* start state *)\n apply (rule conjI)\n apply (simp add: is_ref_map_def corresp_ex_def)\n (* is-execution-fragment *)\n apply (erule lemma_2 [THEN spec, THEN mp])\n apply (simp add: reachable.reachable_0)\n\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/meta_theory/RefCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.26277656757891465}} {"text": "(*\n Author: Benedikt Seidl\n License: BSD\n*)\n\nsection \\Code export to Standard ML\\\n\ntheory Code_Export\nimports\n \"LTL_to_DRA/DRA_Instantiation\"\n LTL.Code_Equations\n \"HOL-Library.Code_Target_Numeral\"\nbegin\n\nsubsection \\Hashing Sets\\\n\nglobal_interpretation comp_fun_commute \"plus o cube o hashcode :: ('a :: hashable) \\ hashcode \\ hashcode\"\n by unfold_locales (auto simp: cube_def)\n\n\n\nlemma [code]:\n \"hashcode (abs_ltln\\<^sub>P \\) = hashcode (min_dnf \\)\"\n by simp\n\n\n\nlemma [code]:\n \"hashcode (abs_ltln\\<^sub>Q \\) = hashcode (min_dnf (Unf \\))\"\n by simp\n\n\nsubsection \\LTL to DRA\\\n\ndeclare ltl_to_dra\\<^sub>P.af_letter\\<^sub>F_lifted_semantics [code]\ndeclare ltl_to_dra\\<^sub>P.af_letter\\<^sub>G_lifted_semantics [code]\ndeclare ltl_to_dra\\<^sub>P.af_letter\\<^sub>\\_lifted_semantics [code]\n\ndeclare ltl_to_dra\\<^sub>Q.af_letter\\<^sub>F_lifted_semantics [code]\ndeclare ltl_to_dra\\<^sub>Q.af_letter\\<^sub>G_lifted_semantics [code]\ndeclare ltl_to_dra\\<^sub>Q.af_letter\\<^sub>\\_lifted_semantics [code]\n\ndefinition atoms_ltlc_list_literals :: \"String.literal ltlc \\ String.literal list\"\nwhere\n \"atoms_ltlc_list_literals = atoms_ltlc_list\"\n\ndefinition ltlc_to_draei_literals :: \"equiv \\ String.literal ltlc \\ (String.literal set, nat) draei\"\nwhere\n \"ltlc_to_draei_literals = ltlc_to_draei\"\n\ndefinition sort_transitions :: \"(nat \\ String.literal set \\ nat) list \\ (nat \\ String.literal set \\ nat) list\"\nwhere\n \"sort_transitions = sort_key fst\"\n\nexport_code True_ltlc Iff_ltlc ltlc_to_draei_literals Prop PropUnfold\n alphabetei initialei transitionei conditionei\n integer_of_nat atoms_ltlc_list_literals sort_transitions set\n in SML module_name LTL file_prefix LTL_to_DRA\n\n\n\nsubsection \\LTL to NBA\\\n\n(* TODO *)\n\n\n\nsubsection \\LTL to LDBA\\\n\n(* TODO *)\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LTL_Master_Theorem/Code_Export.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2627116407731443}} {"text": "theory Wasm_Instantiation imports Wasm_Module_Checker Wasm_Interpreter_Properties begin\n\nfun alloc_Xs :: \"(s \\ 'a \\ (s \\ i)) \\ s \\ 'a list \\ (s \\ i list)\" where\n \"alloc_Xs f s [] = (s,[])\"\n| \"alloc_Xs f s (m_X#m_Xs) = (let (s'', i_X) = f s m_X in\n let (s',i_Xs) = alloc_Xs f s'' m_Xs in\n (s',i_X#i_Xs))\"\n\ndefinition alloc_func :: \"s \\ module_func \\ inst \\ (s \\ i)\" where\n \"alloc_func s m_f inst =\n (case m_f of (i_t, loc_ts, b_es) \\\n (s\\s.funcs := (funcs s)@[Func_native inst ((types inst)!i_t) loc_ts b_es]\\,length (funcs s)))\"\n\nabbreviation \"alloc_funcs s m_fs i \\ alloc_Xs (\\s m_f. alloc_func s m_f i) s m_fs\"\n\ndefinition alloc_tab :: \"s \\ tab_t \\ (s \\ i)\" where\n \"alloc_tab s m_t = (s\\s.tabs := (tabs s)@[(replicate (l_min m_t) None, (l_max m_t))]\\,length (tabs s))\"\n\nabbreviation \"alloc_tabs \\ alloc_Xs alloc_tab\"\n\ndefinition alloc_mem :: \"s \\ mem_t \\ (s \\ i)\" where\n \"alloc_mem s m_m = (s\\s.mems := (mems s)@[mem_mk m_m]\\,length (mems s))\"\n\nabbreviation \"alloc_mems \\ alloc_Xs alloc_mem\"\n\ndefinition alloc_glob :: \"s \\ (module_glob \\ v) \\ (s \\ i)\" where\n \"alloc_glob s m_g_v = \n (case m_g_v of (m_g, v) \\\n (s\\s.globs := (globs s)@[\\g_mut=(tg_mut (module_glob.g_type m_g)), g_val=v\\]\\,length (globs s)))\"\n\nabbreviation \"alloc_globs s m_gs vs \\ alloc_Xs alloc_glob s (zip m_gs vs)\"\n\nlemma alloc_func_length:\n assumes \"alloc_func s m_f i = (s', i_f)\"\n shows \"length (funcs s) = i_f\"\n \"length (funcs s') = Suc i_f\"\n \"\\farb. (funcs s)@[farb] = (funcs s')\"\n \"(tabs s) = (tabs s')\"\n \"(mems s) = (mems s')\"\n \"(globs s) = (globs s')\"\n using assms[symmetric]\n unfolding alloc_func_def\n by (simp_all split: prod.splits)\n\nlemma alloc_tab_length:\n assumes \"alloc_tab s m_t = (s', i_t)\"\n shows \"length (tabs s) = i_t\"\n \"length (tabs s') = Suc i_t\"\n \"(funcs s) = (funcs s')\"\n \"\\tarb. (tabs s)@[tarb] = (tabs s')\"\n \"(mems s) = (mems s')\"\n \"(globs s) = (globs s')\"\n using assms[symmetric]\n unfolding alloc_tab_def\n by (simp_all split: prod.splits)\n\nlemma alloc_mem_length:\n assumes \"alloc_mem s m_m = (s', i_m)\"\n shows \"length (mems s) = i_m\"\n \"length (mems s') = Suc i_m\"\n \"(funcs s) = (funcs s')\"\n \"(tabs s) = (tabs s')\"\n \"\\marb. (mems s)@[marb] = (mems s')\"\n \"(globs s) = (globs s')\"\n using assms[symmetric]\n unfolding alloc_mem_def\n by (simp_all split: prod.splits)\n\nlemma alloc_glob_length:\n assumes \"alloc_glob s (m_g, v) = (s', i_g)\"\n shows \"length (globs s) = i_g\"\n \"length (globs s') = Suc i_g\"\n \"(funcs s) = (funcs s')\"\n \"(tabs s) = (tabs s')\"\n \"(mems s) = (mems s')\"\n \"(globs s)@[\\g_mut=(tg_mut (module_glob.g_type m_g)), g_val=v\\] = (globs s')\"\n using assms[symmetric]\n unfolding alloc_glob_def\n by (simp_all split: prod.splits)\n\nlemma alloc_funcs_range:\n assumes \"alloc_funcs s m_fs i = (s', i_fs)\"\n shows \"i_fs = [length (funcs s) ..< (length (funcs s) + length m_fs)] \\\n (\\farb. (funcs s)@farb = (funcs s')) \\\n (tabs s) = (tabs s') \\\n (mems s) = (mems s') \\\n (globs s) = (globs s')\"\n using assms\nproof (induction m_fs arbitrary: s i_fs)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons m_f m_fs)\n obtain s'' i_f' i_fs' where s''_is:\"alloc_func s m_f i = (s'', i_f')\"\n \"alloc_funcs s'' m_fs i = (s', i_fs')\"\n \"i_f' # i_fs' = i_fs\"\n using Cons(2)\n by (simp split: prod.splits)\n thus ?case\n using Cons(1)[OF s''_is(2)] using alloc_func_length[OF s''_is(1)] upt_rec\n apply (simp split: prod.splits)\n apply (metis append_assoc)\n done\nqed\n\nlemma alloc_tabs_range:\n assumes \"alloc_tabs s m_ts = (s', i_ts)\"\n shows \"i_ts = [length (tabs s) ..< (length (tabs s) + length m_ts)] \\\n (funcs s) = (funcs s') \\\n (\\tarb. (tabs s)@tarb = (tabs s')) \\\n (mems s) = (mems s') \\\n (globs s) = (globs s')\"\n using assms\nproof (induction m_ts arbitrary: s i_ts)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons m_t m_ts)\n obtain s'' i_t' i_ts' where s''_is:\"alloc_tab s m_t = (s'', i_t')\"\n \"alloc_tabs s'' m_ts = (s', i_ts')\"\n \"i_t' # i_ts' = i_ts\"\n using Cons(2)\n by (simp split: prod.splits)\n thus ?case\n using Cons(1)[OF s''_is(2)] using alloc_tab_length[OF s''_is(1)] upt_rec\n apply (simp split: prod.splits)\n apply (metis append_assoc)\n done\nqed\n\nlemma alloc_mems_range:\n assumes \"alloc_mems s m_ms = (s', i_ms)\"\n shows \"i_ms = [length (mems s) ..< (length (mems s) + length m_ms)] \\\n (funcs s) = (funcs s') \\\n (tabs s) = (tabs s') \\\n (\\marb. (mems s)@marb = (mems s')) \\\n (globs s) = (globs s')\"\n using assms\nproof (induction m_ms arbitrary: s i_ms)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons m_m m_ms)\n obtain s'' i_m' i_ms' where s''_is:\"alloc_mem s m_m = (s'', i_m')\"\n \"alloc_mems s'' m_ms = (s', i_ms')\"\n \"i_m' # i_ms' = i_ms\"\n using Cons(2)\n by (simp split: prod.splits)\n thus ?case\n using Cons(1)[OF s''_is(2)] using alloc_mem_length[OF s''_is(1)] upt_rec\n apply (simp split: prod.splits)\n apply (metis append_assoc)\n done\nqed\n\nlemma alloc_globs_range:\n assumes \"alloc_globs s m_gs vs = (s', i_gs)\"\n shows \"i_gs = [length (globs s) ..< (length (globs s) + min (length m_gs) (length vs))] \\\n (funcs s) = (funcs s') \\\n (tabs s) = (tabs s') \\\n (mems s) = (mems s') \\\n ((globs s)@(map2 (\\m_g v. \\g_mut=(tg_mut (module_glob.g_type m_g)), g_val=v\\) m_gs vs) = (globs s'))\"\n using assms\nproof (induction m_gs arbitrary: s i_gs vs)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons m_g m_gs)\n note outer_Cons = Cons\n show ?case\n proof (cases vs)\n case Nil\n thus ?thesis\n using Cons\n by simp\n next\n case (Cons v vs')\n then obtain s'' i_g' i_gs' where s''_is:\"alloc_glob s (m_g, v) = (s'', i_g')\"\n \"alloc_globs s'' m_gs vs' = (s', i_gs')\"\n \"i_g' # i_gs' = i_gs\"\n using outer_Cons(2)\n by (simp split: prod.splits)\n thus ?thesis\n using outer_Cons(1)[OF s''_is(2)] using alloc_glob_length[OF s''_is(1)] upt_rec Cons\n apply (simp)\n apply (metis (no_types, lifting) append_Cons append_assoc self_append_conv2)\n done\n qed\nqed\n\nlemma length_alloc_Xs:\n assumes \"alloc_Xs f s m_Xs = (s', i_Xs)\"\n shows \"length i_Xs = length m_Xs\"\n using assms\nproof (induction m_Xs arbitrary: s i_Xs)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons m_X m_Xs)\n thus ?case\n by (fastforce split: prod.splits)\nqed\n\nlemma alloc_Xs_app:\n assumes \"alloc_Xs f s (m_Xs@m_Ys) = (s', i_XYs)\"\n shows \"\\s'' i_Xs i_Ys. i_XYs = i_Xs@i_Ys \\\n alloc_Xs f s m_Xs = (s'', i_Xs) \\\n alloc_Xs f s'' m_Ys = (s', i_Ys)\"\n using assms\nproof (induction f s \"(m_Xs@m_Ys)\" arbitrary: m_Xs i_XYs rule: alloc_Xs.induct)\n case (1 f s)\n thus ?case\n by simp\nnext\n case (2 f s m_X' m_XYs')\n consider (a) \"m_Xs = []\" \"m_X' # m_XYs' = m_Ys\"\n | (b) m_Xs' where \"m_X' # m_Xs' = m_Xs\" \"m_XYs' = m_Xs' @ m_Ys\"\n using Cons_eq_append_conv[of m_X' m_XYs' m_Xs m_Ys]\n 2(2)\n by blast\n thus ?case\n proof cases\n case a\n thus ?thesis\n using 2\n by fastforce\n next\n case b\n obtain s'' i_XY i_XYs' where s''_is:\n \"m_Xs = m_X' # m_Xs'\"\n \"f s m_X' = (s'', i_XY)\"\n \"alloc_Xs f s'' (m_Xs' @ m_Ys) = (s', i_XYs')\"\n \"i_XY # i_XYs' = i_XYs\"\n using 2(3) b(1)[symmetric]\n by (simp split: prod.splits)\n thus ?thesis\n using 2(1)[OF _ _ b(2) s''_is(3), of _ i_XY]\n by (fastforce split: prod.splits)\n qed\nqed\n\nlemma alloc_Xs_snoc:\n assumes \"alloc_Xs f s (m_Xs@[m_X]) = (s', i_XYs)\"\n shows \"\\s'' i_Xs i_X. i_XYs = i_Xs@[i_X] \\\n alloc_Xs f s m_Xs = (s'', i_Xs) \\\n f s'' m_X = (s', i_X)\"\n using alloc_Xs_app[OF assms]\n apply (simp split: prod.splits)\n apply (metis prod.exhaust_sel)\n done\n\ninductive alloc_module :: \"s \\ m \\ v_ext list \\ v list \\ (s \\ inst \\ module_export list) \\ bool\" where\n \"\\inst = \\types=(m_types m),\n funcs=(ext_funcs imps)@i_fs,\n tabs=(ext_tabs imps)@i_ts,\n mems=(ext_mems imps)@i_ms,\n globs=(ext_globs imps)@i_gs\\;\n alloc_funcs s (m_funcs m) inst = (s1,i_fs);\n alloc_tabs s1 (m_tabs m) = (s2,i_ts);\n alloc_mems s2 (m_mems m) = (s3,i_ms);\n alloc_globs s3 (m_globs m) gvs = (s',i_gs);\n exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\n \\ \\ alloc_module s m imps gvs (s',inst,exps)\"\n\ndefinition interp_alloc_module :: \"s \\ m \\ v_ext list \\ v list \\ (s \\ inst \\ module_export list)\" where\n \"interp_alloc_module s m imps gvs =\n (let i_fs = [length (funcs s) ..< (length (funcs s) + length (m_funcs m))] in\n let i_ts = [length (tabs s) ..< (length (tabs s) + length (m_tabs m))] in\n let i_ms = [length (mems s) ..< (length (mems s) + length (m_mems m))] in\n let i_gs = [length (globs s) ..< (length (globs s) + min (length (m_globs m)) (length gvs))] in\n let inst = \\types=(m_types m),\n funcs=(ext_funcs imps)@i_fs,\n tabs=(ext_tabs imps)@i_ts,\n mems=(ext_mems imps)@i_ms,\n globs=(ext_globs imps)@i_gs\\ in\n let (s1,_) = alloc_funcs s (m_funcs m) inst in\n let (s2,_) = alloc_tabs s1 (m_tabs m) in\n let (s3,_) = alloc_mems s2 (m_mems m) in\n let (s',_) = alloc_globs s3 (m_globs m) gvs in\n let exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m) in\n (s', inst, exps))\"\n\nlemma alloc_module_imp_interp_alloc_module:\n assumes \"alloc_module s m imps gvs (s',inst,exps)\"\n shows \"(interp_alloc_module s m imps gvs = (s',inst,exps))\"\nproof -\n obtain s1 s2 s3 i_fs i_ts i_ms i_gs where s'_is:\n \"inst = \\types=(m_types m),\n funcs=(ext_funcs imps)@i_fs,\n tabs=(ext_tabs imps)@i_ts,\n mems=(ext_mems imps)@i_ms,\n globs=(ext_globs imps)@i_gs\\\"\n \"alloc_funcs s (m_funcs m) inst = (s1,i_fs)\"\n \"alloc_tabs s1 (m_tabs m) = (s2,i_ts)\"\n \"alloc_mems s2 (m_mems m) = (s3,i_ms)\"\n \"alloc_globs s3 (m_globs m) gvs = (s',i_gs)\"\n \"exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\"\n using assms\n unfolding alloc_module.simps\n by blast\n have \"i_fs = [length (funcs s) ..< (length (funcs s) + length (m_funcs m))]\"\n \"i_ts = [length (tabs s) ..< (length (tabs s) + length (m_tabs m))]\"\n \"i_ms = [length (mems s) ..< (length (mems s) + length (m_mems m))]\"\n \"i_gs = [length (globs s) ..< (length (globs s) + min (length (m_globs m)) (length gvs))]\"\n using alloc_funcs_range[OF s'_is(2)] alloc_tabs_range[OF s'_is(3)]\n alloc_mems_range[OF s'_is(4)] alloc_globs_range[OF s'_is(5)]\n by auto\n thus ?thesis\n using s'_is\n unfolding interp_alloc_module_def\n by (simp add: Let_def split: prod.splits)\nqed\n\nlemma interp_alloc_module_imp_alloc_module:\n assumes \"(interp_alloc_module s m imps gvs = (s',inst,exps))\"\n shows \"alloc_module s m imps gvs (s',inst,exps)\"\nproof -\n obtain i_fs i_ts i_ms i_gs i_fs' i_ts' i_ms' i_gs' s1 s2 s3 where s'_is:\n \"i_fs = [length (funcs s) ..< (length (funcs s) + length (m_funcs m))]\"\n \"i_ts = [length (tabs s) ..< (length (tabs s) + length (m_tabs m))]\"\n \"i_ms = [length (mems s) ..< (length (mems s) + length (m_mems m))]\"\n \"i_gs = [length (globs s) ..< (length (globs s) + min (length (m_globs m)) (length gvs))]\"\n \"inst = \\types=(m_types m),\n funcs=(ext_funcs imps)@i_fs,\n tabs=(ext_tabs imps)@i_ts,\n mems=(ext_mems imps)@i_ms,\n globs=(ext_globs imps)@i_gs\\\"\n \"(s1,i_fs') = alloc_funcs s (m_funcs m) inst\"\n \"(s2,i_ts') = alloc_tabs s1 (m_tabs m)\"\n \"(s3,i_ms') = alloc_mems s2 (m_mems m)\"\n \"(s',i_gs') = alloc_globs s3 (m_globs m) gvs\"\n \"exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\"\n using assms\n unfolding interp_alloc_module_def\n by (auto simp add: Let_def split: prod.splits)\n have \"i_fs = i_fs'\"\n \"i_ts = i_ts'\"\n \"i_ms = i_ms'\"\n \"i_gs = i_gs'\"\n using s'_is(1,2,3,4)\n alloc_funcs_range[OF s'_is(6)[symmetric]]\n alloc_tabs_range[OF s'_is(7)[symmetric]]\n alloc_mems_range[OF s'_is(8)[symmetric]]\n alloc_globs_range[OF s'_is(9)[symmetric]]\n by metis+\n thus ?thesis\n using alloc_module.intros[OF s'_is(5) _ _ _ _ s'_is(10)]\n by (metis (no_types, lifting) s'_is(6,7,8,9))\nqed\n\nlemma alloc_module_equiv_interp_alloc_module:\n \"alloc_module s m imps gvs (s',inst,exps) = (interp_alloc_module s m imps gvs = (s',inst,exps))\"\n using alloc_module_imp_interp_alloc_module interp_alloc_module_imp_alloc_module\n by blast\n\ndefinition init_tab :: \"s \\ inst \\ nat \\ module_elem \\ s\" where\n \"init_tab s inst e_ind e = (let t_ind = ((inst.tabs inst)!(e_tab e)) in\n let (tab_e,max) = (tabs s)!t_ind in\n let e_pay = map (\\i. Some ((inst.funcs inst)!i)) (e_init e) in\n let tab'_e = ((take e_ind tab_e) @ e_pay @ (drop (e_ind + length e_pay) tab_e)) in\n s\\tabs := (tabs s)[t_ind := (tab'_e,max)]\\)\"\n\ndefinition init_tabs :: \"s \\ inst \\ nat list \\ module_elem list \\ s\" where\n \"init_tabs s inst e_inds es = foldl (\\s' (e_ind,e). init_tab s' inst e_ind e) s (zip e_inds es)\"\n\ndefinition init_mem :: \"s \\ inst \\ nat \\ module_data \\ s\" where\n \"init_mem s inst d_ind d = (let m_ind = ((inst.mems inst)!(d_data d)) in\n let mem = (mems s)!m_ind in\n let mem' = write_bytes mem d_ind (d_init d) in\n s\\mems := (mems s)[m_ind := mem']\\)\"\n\ndefinition init_mems :: \"s \\ inst \\ nat list \\ module_data list \\ s\" where\n \"init_mems s inst d_inds ds = foldl (\\s' (d_ind,d). init_mem s' inst d_ind d) s (zip d_inds ds)\"\n\ninductive instantiate :: \"s \\ m \\ v_ext list \\ ((s \\ inst \\ (module_export list)) \\ (nat option)) \\ bool\" where\n \"\\module_typing m t_imps t_exps;\n list_all2 (external_typing s) v_imps t_imps;\n alloc_module s m v_imps g_inits (s', inst, v_exps);\n f = \\ f_locs = [], f_inst = inst \\;\n list_all2 (\\g v. reduce_trans (s',f,$*(g_init g)) (s',f,[$C v])) (m_globs m) g_inits;\n list_all2 (\\e c. reduce_trans (s',f,$*(e_off e)) (s',f,[$C ConstInt32 c])) (m_elem m) e_offs;\n list_all2 (\\d c. reduce_trans (s',f,$*(d_off d)) (s',f,[$C ConstInt32 c])) (m_data m) d_offs;\n list_all2 (\\e_off e. ((nat_of_int e_off) + (length (e_init e))) \\ length (fst ((tabs s')!((inst.tabs inst)!(e_tab e))))) e_offs (m_elem m);\n list_all2 (\\d_off d. ((nat_of_int d_off) + (length (d_init d))) \\ mem_length ((mems s')!((inst.mems inst)!(d_data d)))) d_offs (m_data m);\n map_option (\\i_s. ((inst.funcs inst)!i_s)) (m_start m) = start;\n init_tabs s' inst (map nat_of_int e_offs) (m_elem m) = s'';\n init_mems s'' inst (map nat_of_int d_offs) (m_data m) = s_end\n \\ \\ instantiate s m v_imps ((s_end, inst, v_exps), start)\"\n\ndefinition interp_get_v :: \"s \\ inst \\ b_e list \\ v\" where\n \"interp_get_v s inst b_es = \n (case run_v 2 0 (s,\\ f_locs = [], f_inst = inst \\,b_es) of\n (_,RValue [v]) \\ v)\"\n\ndefinition interp_get_i32 :: \"s \\ inst \\ b_e list \\ i32\" where\n \"interp_get_i32 s inst b_es = \n (case interp_get_v s inst b_es of\n ConstInt32 c \\ c\n | _ \\ 0)\"\n\nfun interp_instantiate :: \"s \\ m \\ v_ext list \\ ((s \\ inst \\ (module_export list)) \\ (nat option)) option\" where\n \"interp_instantiate s m v_imps =\n (case (module_type_checker m) of\n Some (t_imps, t_exps) \\\n if (list_all2 (external_typing s) v_imps t_imps) then\n let g_inits = \n map (\\g. interp_get_v s \\types=[],funcs=[],tabs=[],mems=[],globs=ext_globs v_imps\\ (g_init g)) (m_globs m) in\n let (s', inst, v_exps) = interp_alloc_module s m v_imps g_inits in\n let e_offs = map (\\e. interp_get_i32 s' inst (e_off e)) (m_elem m) in\n let d_offs = map (\\d. interp_get_i32 s' inst (d_off d)) (m_data m) in\n if (list_all2 (\\e_off e. ((nat_of_int e_off) + (length (e_init e))) \\ length (fst ((tabs s')!((inst.tabs inst)!(e_tab e))))) e_offs (m_elem m) \\\n list_all2 (\\d_off d. ((nat_of_int d_off) + (length (d_init d))) \\ mem_length ((mems s')!((inst.mems inst)!(d_data d)))) d_offs (m_data m)) then\n let start = map_option (\\i_s. ((inst.funcs inst)!i_s)) (m_start m) in\n let s'' = init_tabs s' inst (map nat_of_int e_offs) (m_elem m) in\n let s_end = init_mems s'' inst (map nat_of_int d_offs) (m_data m) in\n Some ((s_end, inst, v_exps), start)\n else None\n else None\n | _ \\ None)\"\n\nlemma const_expr_is:\n assumes \"const_expr \\ b_e\"\n \"\\ \\ [b_e] : (ts _> ts')\"\n shows \"\\t. (\\ \\ [b_e] : ([] _> [t])) \\ ts' = ts@[t] \\ \n ((\\v. b_e = (C v) \\ typeof v = t) \\\n (\\j. b_e = (Get_global j) \\ j < length (global \\) \\\n tg_mut ((global \\)!j) = T_immut \\\n tg_t ((global \\)!j) = t))\"\n using assms(2,1)\nproof (induction \"\\\" \"[b_e]\" \"(ts _> ts')\" arbitrary: ts ts' rule: b_e_typing.induct)\n case (const \\ v)\n thus ?case\n using b_e_typing.const\n by blast\nnext\n case (get_global i \\ t)\n thus ?case\n using b_e_typing.get_global const_expr.cases\n by fastforce\nnext\n case (weakening \\ t1s t2s ts)\n thus ?case\n by simp\nqed (auto simp add: const_expr.simps)\n\nlemma const_exprs_empty:\n assumes \"const_exprs \\ b_es\"\n \"\\ \\ b_es : ([] _> [])\"\n shows \"b_es = []\"\n using assms(2,1)\nproof (induction \"([] _> [])\" rule: b_e_typing.induct)\n case (composition \\ es t2s e)\n thus ?case\n by (metis (no_types, lifting) Nil_is_append_conv const_expr_is list.pred_inject(2) list_all_append)\nnext\n case (weakening \\ es t1s t2s ts)\n thus ?case\n by blast\nqed (auto simp add: const_expr.simps)\n\nlemma const_exprs_is:\n assumes \"const_exprs \\ b_es\"\n \"\\ \\ b_es : ([] _> [t])\"\n shows \"(\\v. b_es = [C v] \\ typeof v = t) \\\n (\\j. b_es = [Get_global j] \\ j < length (global \\) \\\n tg_mut ((global \\)!j) = T_immut \\\n tg_t ((global \\)!j) = t)\"\n using assms(2,1)\nproof (induction \"\\\" \"b_es\" \"([] _> [t])\" rule: b_e_typing.induct)\n case (composition \\ es t2s e)\n have 1:\"const_exprs \\ es\" \"const_expr \\ e\"\n using composition(5)\n by simp_all\n have \"t2s = []\" \"es = []\"\n using const_expr_is[OF 1(2) composition(3)] composition(1) const_exprs_empty 1(1)\n by auto\n thus ?case\n using composition\n by simp\nqed (auto simp add: const_expr.simps)\n\nlemma const_exprs_run_v:\n assumes \"const_exprs \\ b_es\"\n \"\\ \\ b_es : ([] _> [t])\"\n \"global \\ = tgs\"\n \"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) igs tgs\"\n \"inst.globs inst = igs@arb\"\n shows \"\\v. typeof v = t \\ run_v 2 0 (s, \\ f_locs=[], f_inst=inst \\,b_es) = (s, RValue [v])\"\nproof -\n consider (1) v where \"b_es = [C v] \\ typeof v = t\"\n | (2) j where \"b_es = [Get_global j]\"\n \"j < length (global \\)\"\n \"tg_mut (global \\ ! j) = T_immut\"\n \"tg_t (global \\ ! j) = t\"\n using const_exprs_is[OF assms(1,2)]\n by blast\n thus ?thesis\n proof cases\n case 1\n thus ?thesis\n by (auto simp add: const_list_def is_const_def Suc_1[symmetric])\n next\n case 2\n thus ?thesis\n using assms\n unfolding list_all2_conv_all_nth external_typing.simps\n by (auto simp add: const_list_def is_const_def Suc_1[symmetric] glob_typing_def nth_append sglob_def sglob_ind_def sglob_val_def app_s_f_v_s_get_global_def)\n qed\nqed\n\nlemma const_exprs_reduce_trans:\n assumes \"const_exprs \\ b_es\"\n \"\\ \\ b_es : ([] _> [t])\"\n \"reduce_trans (s_r,f,$*b_es) (s',f',[$C v])\"\n \"global \\ = tgs\"\n \"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) igs tgs\"\n \"globs s_r = (globs s)@arbg1\"\n \"globs s_v = (globs s)@arbg2\"\n \"inst.globs (f_inst f) = igs@arbi1\"\n \"inst.globs inst_v = igs@arbi2\"\n shows \"s_r = s' \\ f = f' \\ typeof v = t \\ run_v 2 0 (s_v,\\ f_locs=vs_arb, f_inst=inst_v\\,b_es) = (s_v, RValue [v])\"\nproof -\n consider (1) v_r where \"b_es = [C v_r] \\ typeof v_r = t\"\n | (2) j where \"b_es = [Get_global j]\"\n \"j < length (global \\)\"\n \"tg_mut (global \\ ! j) = T_immut\"\n \"tg_t (global \\ ! j) = t\"\n using const_exprs_is[OF assms(1,2)]\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(3) reduce_trans_consts\n apply (simp add: const_list_def is_const_def Suc_1[symmetric])\n apply (metis (mono_tags, lifting) append_Nil2 case_prod_conv list.inject split_vals_e.simps(1,2) split_vals_e_conv_app)\n done\n next\n case 2\n have type_is:\"typeof (sglob_val s (f_inst f) j) = t\" \"j < length igs\" \"(igs!j) < length (globs s)\"\n using assms(4,5,6,8) 2(2,3,4)\n unfolding list_all2_conv_all_nth external_typing.simps\n by (simp_all add: glob_typing_def nth_append sglob_def sglob_ind_def sglob_val_def)\n show ?thesis\n using assms(3)\n unfolding reduce_trans_def\n proof (cases rule: converse_rtranclpE)\n case base\n thus ?thesis\n using 2(1)\n by auto\n next\n case (step y)\n then obtain s_y f_y es_y where y_is:\"\\s_r;f;[$Get_global j]\\ \\ \\s_y;f_y;es_y\\\" \"y = (s_y, f_y, es_y)\"\n using 2\n by fastforce\n hence s_y_is:\"s_y = s_r \\ f_y = f \\ es_y = [$C sglob_val s (f_inst f) j]\"\n using assms(6,8)\n proof (induction s_r f \"[$Get_global j]\" s_y f_y es_y arbitrary: y rule: reduce.induct)\n case (basic e' s vs i)\n thus ?case\n using lfilled_single\n apply cases\n apply auto\n done\n next\n case (get_global s vs i)\n thus ?case\n using type_is(2,3)\n by (simp_all add: sglob_def sglob_ind_def sglob_val_def nth_append)\n next\n case (label s vs es i s' vs' es' k lholed les')\n thus ?case\n using lfilled_single[OF label(3)]\n by (metis Lfilled_exact.L0 Lfilled_exact_imp_Lfilled e.distinct(5) lfilled_eq reduce_not_nil)\n qed auto\n thus ?thesis\n using step(2) y_is reduce_trans_consts[of s_y f_y \"[sglob_val s (f_inst f) j]\" s' f' \"[v]\"] 2 type_is\n apply (simp add: assms nth_append sglob_def sglob_ind_def sglob_val_def reduce_trans_def const_list_def is_const_def Suc_1[symmetric] app_s_f_v_s_get_global_def split: prod.splits)\n using s_y_is type_is(1)\n apply blast\n done\n qed\n qed\nqed\n\nlemma ext_globs_ind:\n assumes \"ij. j < length v_imps \\ Ext_glob ((ext_globs v_imps) ! i) = v_imps!j\"\n using assms\nproof (induction v_imps arbitrary: i)\ncase Nil\n thus ?case\n by (simp add: map_filter_simps(2))\nnext\n case (Cons v_imp v_imps)\n consider (1) k where \"v_imp = Ext_glob k\" | (2) \"\\k. v_imp \\ Ext_glob k\"\n by blast\n thus ?case\n proof (cases)\n case 1\n show ?thesis\n proof (cases i)\n case 0\n thus ?thesis\n using 1\n by (auto simp add: map_filter_def)\n next\n case (Suc i')\n hence Suc1:\"i' < length (ext_globs (v_imps))\"\n using 1 Cons(2)\n by (simp add: map_filter_def)\n thus ?thesis\n using Cons(1)[OF Suc1] Suc 1\n by (auto simp add: map_filter_def)\n qed\n next\n case 2\n hence a2:\"ext_globs v_imps = ext_globs (v_imp#v_imps)\"\n apply (cases v_imp)\n apply (simp_all add: map_filter_def)\n done\n hence b2:\"i < length (ext_globs (v_imps))\"\n using Cons(2)\n by simp\n thus ?thesis\n using Cons(1)[OF b2] a2\n by auto\n qed\nqed\n\nlemma alloc_glob_ext_typing:\n assumes \"alloc_glob s (m_g, v) = (s', i_g)\"\n \"typeof v = (tg_t (g_type m_g))\"\n shows \"external_typing s' (Ext_glob i_g) (Te_glob (g_type m_g))\"\n using assms alloc_glob_length[OF assms(1)]\n unfolding alloc_glob_def external_typing.simps glob_typing_def\n apply simp\n apply (metis global.select_convs(1) global.select_convs(2) nth_append_length)\n done\n\nlemma alloc_globs_ext_typing:\n assumes \"alloc_globs s m_gs vs = (s', i_gs)\"\n \"list_all2 (\\v m_g. typeof v = (tg_t (g_type m_g))) vs m_gs\"\n shows \"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) i_gs (map g_type m_gs)\"\n using assms(2,1)\nproof (induction arbitrary: s i_gs rule: list_all2_induct)\ncase Nil\n thus ?case\n by simp\nnext\n case (Cons x xs y ys)\n obtain i_g i_gs' s'' where i_gs_is:\"i_gs = i_g#i_gs'\"\n \"alloc_glob s (y,x) = (s'', i_g)\"\n \"alloc_globs s'' ys xs = (s', i_gs')\"\n using Cons(4)\n by (fastforce split: prod.splits)\n have \"external_typing s' (Ext_glob i_g) (Te_glob (g_type y))\"\n using alloc_glob_ext_typing[OF i_gs_is(2) Cons(1)] alloc_globs_range[OF i_gs_is(3)] list_all2_lengthD[OF Cons(2)]\n nth_append[of \"s.globs s''\"]\n unfolding external_typing.simps\n apply simp\n apply (metis length_append trans_less_add1)\n done\n thus ?case\n using alloc_glob_ext_typing[OF i_gs_is(2) Cons(1)] Cons(3)[OF i_gs_is(3)] i_gs_is(1)\n by (simp split: prod.splits)\nqed\n\nlemma list_all2_external_typing_glob_alloc:\n assumes \"list_all2 (\\i t. external_typing s i t) v_imps t_imps\"\n shows \"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) (ext_globs v_imps) (ext_t_globs t_imps)\"\n using assms\nproof (induction t_imps rule: list_all2_induct)\n case Nil\n thus ?case\n by (simp add: map_filter_simps(2))\nnext\n case (Cons x xs y ys)\n thus ?case\n proof (cases rule: external_typing.cases)\n case (4 i gt)\n thus ?thesis\n using Cons\n by (simp add: map_filter_def)\n qed (fastforce simp add: map_filter_def)+\nqed\n\nlemma alloc_module_ext_arb:\n assumes \"alloc_module s m imps gvs (s',inst,exps)\"\n shows \"\\farbs tarbs marbs garbs.\n (funcs s)@farbs = funcs s' \\\n (tabs s)@tarbs = tabs s' \\\n (mems s)@marbs = mems s' \\\n (globs s)@garbs = globs s'\"\nproof -\n obtain s1 s2 s3 i_fs i_ts i_ms i_gs where inst_is:\n \"inst = \\types=(m_types m),\n funcs=(ext_funcs imps)@i_fs,\n tabs=(ext_tabs imps)@i_ts,\n mems=(ext_mems imps)@i_ms,\n globs=(ext_globs imps)@i_gs\\\"\n \"alloc_funcs s (m_funcs m) inst = (s1,i_fs)\"\n \"alloc_tabs s1 (m_tabs m) = (s2,i_ts)\"\n \"alloc_mems s2 (m_mems m) = (s3,i_ms)\"\n \"alloc_globs s3 (m_globs m) gvs = (s',i_gs)\"\n \"exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\"\n using assms(1)\n unfolding alloc_module.simps\n by blast\n show ?thesis\n using alloc_funcs_range[OF inst_is(2)]\n alloc_tabs_range[OF inst_is(3)]\n alloc_mems_range[OF inst_is(4)]\n alloc_globs_range[OF inst_is(5)]\n by fastforce\nqed\n\nlemma alloc_module_external_typing_preserved:\n assumes \"alloc_module s m imps gvs (s',inst,exps)\"\n \"external_typing s v_imp t_imp\"\n shows \"external_typing s' v_imp t_imp\"\n using assms(2,1)\nproof (cases rule: external_typing.cases)\n case (1 i tf)\n thus ?thesis\n using alloc_module_ext_arb[OF assms(1)]\n by (metis add.commute external_typing.intros(1) length_append nth_append trans_less_add2)\nnext\n case (2 i tt)\n thus ?thesis\n using alloc_module_ext_arb[OF assms(1)]\n by (metis external_typing.intros(2) length_append nth_append trans_less_add1)\nnext\n case (3 i mt)\n thus ?thesis\n using alloc_module_ext_arb[OF assms(1)]\n by (metis external_typing.intros(3) length_append nth_append trans_less_add1)\nnext\n case (4 i gt)\n thus ?thesis\n using alloc_module_ext_arb[OF assms(1)]\n by (metis external_typing.intros(4) length_append nth_append trans_less_add1)\nqed\n\nlemma g_init_type_interp:\n assumes \"interp_get_v s inst (g_init m_g) = gv\"\n \"(module_glob_typing \\) m_g gt\"\n \"global \\ = tgs\"\n \"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) igs tgs\"\n \"inst.globs inst = igs@arb\"\n shows \"typeof gv = tg_t (g_type m_g)\"\nproof -\n have 1:\"const_exprs \\ (g_init m_g)\"\n using assms(2)\n unfolding module_glob_typing.simps\n by fastforce\n have 2:\"\\ \\ (g_init m_g) : ([] _> [tg_t (g_type m_g)])\"\n using assms(2)\n unfolding module_glob_typing.simps\n by fastforce\n show ?thesis\n using const_exprs_run_v[OF 1 2 assms(3,4,5)] assms(1)\n unfolding interp_get_v_def\n by (simp split: prod.splits)\nqed\n\nlemma interp_instantiate_imp_instantiate:\n assumes \"(interp_instantiate s m v_imps = Some ((s_end, inst, v_exps), start))\"\n shows \"(instantiate s m v_imps ((s_end, inst, v_exps), start))\"\nproof -\n obtain t_imps t_exps g_inits s' e_offs d_offs s'' inst' where s_end_is:\n \"module_type_checker m = Some (t_imps, t_exps)\"\n \"(list_all2 (external_typing s) v_imps t_imps)\"\n \"g_inits = map (\\g. interp_get_v s inst' (g_init g)) (m_globs m)\"\n \"(s', inst, v_exps) = interp_alloc_module s m v_imps g_inits\"\n \"e_offs = map (\\e. interp_get_i32 s' inst (e_off e)) (m_elem m)\"\n \"d_offs = map (\\d. interp_get_i32 s' inst (d_off d)) (m_data m)\"\n \"list_all2 (\\e_off e. ((nat_of_int e_off) + (length (e_init e))) \\ length (fst ((tabs s')!((inst.tabs inst)!(e_tab e))))) e_offs (m_elem m)\"\n \"list_all2 (\\d_off d. ((nat_of_int d_off) + (length (d_init d))) \\ mem_length ((mems s')!((inst.mems inst)!(d_data d)))) d_offs (m_data m)\"\n \"start = map_option (\\i_s. ((inst.funcs inst)!i_s)) (m_start m)\"\n \"s'' = init_tabs s' inst (map nat_of_int e_offs) (m_elem m)\"\n \"s_end = init_mems s'' inst (map nat_of_int d_offs) (m_data m)\"\n \"inst' = \\types=[],funcs=[],tabs=[],mems=[],globs=ext_globs v_imps\\\"\n using assms\n by (fastforce simp add: Let_def split: if_splits option.splits prod.splits)\n\n have 1:\"module_typing m t_imps t_exps\"\n using s_end_is(1) module_type_checker_imp_module_typing\n by blast\n have 2:\"alloc_module s m v_imps g_inits (s', inst, v_exps)\"\n using s_end_is(4) interp_alloc_module_imp_alloc_module\n by metis\n\n obtain fs fts ts ms gs gts els ds i_opt imps exps tfs ifts itts imts igts \\ \\' where m_is:\n \"list_all2 (module_func_typing \\) fs fts\"\n \"list_all (module_tab_typing) ts\"\n \"list_all (module_mem_typing) ms\"\n \"list_all2 (module_glob_typing \\') gs gts\"\n \"list_all (module_elem_typing \\) els\"\n \"list_all (module_data_typing \\) ds\"\n \"pred_option (module_start_typing \\) i_opt\"\n \"list_all2 (\\imp. module_import_typing \\ (I_desc imp)) imps t_imps\"\n \"list_all2 (\\exp. module_export_typing \\ (E_desc exp)) exps t_exps\"\n \"ifts = ext_t_funcs t_imps\"\n \"itts = ext_t_tabs t_imps\"\n \"imts = ext_t_mems t_imps\"\n \"igts = ext_t_globs t_imps\"\n \"\\ = \\types_t=tfs, func_t=ifts@fts, global=igts@gts, table=itts@ts, memory=imts@ms, local=[], label=[], return=None\\\"\n \"\\' = \\types_t=[], func_t=[], global=igts, table=[], memory=[], local=[], label=[], return=None\\\"\n \"m = \\m_types = tfs,\n m_funcs = fs,\n m_tabs = ts,\n m_mems = ms,\n m_globs = gs,\n m_elem = els,\n m_data = ds,\n m_start = i_opt,\n m_imports = imps,\n m_exports = exps\\\"\n using 1\n unfolding module_typing.simps\n by blast\n\n obtain s1 s2 s3 i_fs i_ts i_ms i_gs where inst_is:\n \"inst = \\types=(m_types m),\n funcs=(ext_funcs v_imps)@i_fs,\n tabs=(ext_tabs v_imps)@i_ts,\n mems=(ext_mems v_imps)@i_ms,\n globs=(ext_globs v_imps)@i_gs\\\"\n \"alloc_funcs s (m_funcs m) inst = (s1,i_fs)\"\n \"alloc_tabs s1 (m_tabs m) = (s2,i_ts)\"\n \"alloc_mems s2 (m_mems m) = (s3,i_ms)\"\n \"alloc_globs s3 (m_globs m) g_inits = (s',i_gs)\"\n \"v_exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\"\n using 2\n unfolding alloc_module.simps\n by blast\n\n have 12:\"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) (inst.globs inst') (global \\')\"\n using s_end_is(2,12) m_is(13,15) ext_globs_ind list_all2_external_typing_glob_alloc\n by simp\n have 11:\"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) (inst.globs inst) (global \\)\"\n proof -\n have \"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) (inst.globs inst') (global \\')\"\n using alloc_module_external_typing_preserved[OF 2] 12\n unfolding list_all2_conv_all_nth\n by fastforce\n moreover\n have 111:\"list_all2 (\\v m_g. typeof v = tg_t (g_type m_g)) g_inits (m_globs m)\"\n using s_end_is(3)[symmetric] g_init_type_interp[OF _ _ _ 12, of inst' _ _ \\' _ \"[]\"] m_is(4,16)\n by (auto simp add: list_all2_conv_all_nth)\n have \"(gather_m_g_types (m_globs m)) = gts\"\n using m_is(4,16)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n apply simp\n apply (metis length_map module_glob.select_convs(1) nth_equalityI nth_map)\n done\n hence \"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) i_gs gts\"\n using alloc_globs_ext_typing[OF inst_is(5) 111]\n by blast\n ultimately\n show ?thesis\n using list_all2_appendI\n by (fastforce simp add: m_is(14,15) inst_is(1) s_end_is(12))\n qed\n\n have 3:\"list_all2 (\\g v. reduce_trans (s',\\ f_locs=[], f_inst=inst \\,$*(g_init g)) (s',\\ f_locs=[], f_inst=inst \\,[$C v])) (m_globs m) g_inits\"\n proof -\n { fix i\n assume local_assms:\"length (m_globs m) = length g_inits\" \"i' (g_init (m_globs m ! i))\"\n using m_is(4,16)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n by auto\n obtain t where l2:\"\\' \\ (g_init (m_globs m ! i)) : ([] _> [t])\"\n using local_assms m_is(4,16)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n by auto\n obtain v_r where \"run_v 2 0 (s, \\ f_locs=[], f_inst=inst' \\, (g_init (m_globs m ! i))) = (s, RValue [v_r])\"\n using const_exprs_run_v[OF l1 l2 _ 12, of inst']\n by auto\n hence a_runv:\"run_v 2 0 (s,\\ f_locs=[], f_inst=inst'\\,(g_init ((m_globs m)!i))) = (s,RValue [(g_inits!i)])\"\n using s_end_is(3) local_assms\n by (simp add: interp_get_v_def split: v.splits)\n obtain f_temp where f_temp_is:\n \"reduce_trans (s, \\f_locs = [], f_inst = inst'\\, $* g_init (m_globs m ! i)) (s, f_temp, $C* [g_inits ! i])\"\n using run_v_sound[OF a_runv]\n by fastforce\n hence l3:\"reduce_trans (s,\\ f_locs=[], f_inst=inst' \\,$*(g_init ((m_globs m)!i))) (s,\\ f_locs=[], f_inst=inst' \\,[$C (g_inits!i)])\"\n using reduce_trans_length_locals[OF f_temp_is] reduce_trans_inst_is[OF f_temp_is]\n apply simp\n apply (metis (full_types) f.surjective unit.exhaust)\n done\n obtain arbg arbi where arbgi:\"(globs s)@arbg = (globs s')\"\n \"inst.globs inst = inst.globs inst' @ arbi\"\n using alloc_module_ext_arb[OF 2] 2 s_end_is(12)\n unfolding alloc_module.simps\n by auto\n have run_v_is:\"run_v 2 0 (s', \\ f_locs=[], f_inst=inst \\, g_init (m_globs m ! i)) = (s', RValue [g_inits ! i])\"\n using const_exprs_reduce_trans[OF l1 l2 l3] _ 12 _ arbgi(1)[symmetric] _ arbgi(2)\n by fastforce\n obtain f_temp where \"reduce_trans (s',\\ f_locs=[], f_inst=inst \\,$*(g_init ((m_globs m)!i))) (s',f_temp,[$C (g_inits!i)])\"\n using run_v_sound[OF run_v_is]\n by auto\n hence \"reduce_trans (s',\\ f_locs=[], f_inst=inst \\,$*(g_init ((m_globs m)!i))) (s',\\ f_locs=[], f_inst=inst \\,[$C (g_inits!i)])\"\n using reduce_trans_length_locals reduce_trans_inst_is\n by (metis (full_types) f.select_convs(1) f.surjective length_greater_0_conv unit.exhaust)\n }\n thus ?thesis\n using s_end_is(3)\n unfolding list_all2_conv_all_nth\n by fastforce\n qed\n\n have 4:\"list_all2 (\\e c. reduce_trans (s',\\ f_locs=[], f_inst=inst \\,$*(e_off e)) (s',\\ f_locs=[], f_inst=inst \\,[$C ConstInt32 c])) (m_elem m) e_offs\"\n proof -\n { fix i\n assume local_assms:\"length (m_elem m) = length e_offs\" \"i (e_off (m_elem m ! i))\"\n by (metis m_is(5,16) list_all_length m.select_convs(6) module_elem.select_convs(2) module_elem_typing.cases)\n have l2:\"\\ \\ (e_off (m_elem m ! i)) : ([] _> [T_i32])\"\n using local_assms\n by (metis m_is(5,16) list_all_length m.select_convs(6) module_elem.select_convs(2) module_elem_typing.cases)\n obtain c_r where \"run_v 2 0 (s', \\ f_locs=[], f_inst=inst \\, e_off (m_elem m ! i)) = (s', RValue [ConstInt32 c_r])\"\n using const_exprs_run_v[OF l1 l2 _ 11, of inst \"[]\"] typeof_i32\n by auto\n hence run_v_is:\"run_v 2 0 (s', \\ f_locs=[], f_inst=inst \\, e_off (m_elem m ! i)) = (s', RValue [ConstInt32 (e_offs ! i)])\"\n using s_end_is(5) local_assms\n by (simp add: interp_get_i32_def interp_get_v_def split: v.splits)\n obtain f_temp where \"reduce_trans (s', \\ f_locs=[], f_inst=inst \\, $* e_off (m_elem m ! i)) (s', f_temp, [$C ConstInt32 (e_offs ! i)])\"\n using run_v_sound[OF run_v_is]\n by auto\n hence \"reduce_trans (s', \\ f_locs=[], f_inst=inst \\, $* e_off (m_elem m ! i)) (s', \\ f_locs=[], f_inst=inst \\, [$C ConstInt32 (e_offs ! i)])\"\n using reduce_trans_length_locals reduce_trans_inst_is\n by (metis (full_types) f.select_convs(1) f.surjective length_greater_0_conv old.unit.exhaust)\n }\n thus ?thesis\n using s_end_is(5)\n unfolding list_all2_conv_all_nth\n by fastforce\n qed\n have 5:\"list_all2 (\\d c. reduce_trans (s',\\ f_locs=[], f_inst=inst \\,$*(d_off d)) (s',\\ f_locs=[], f_inst=inst \\,[$C ConstInt32 c])) (m_data m) d_offs\"\n proof -\n { fix i\n assume local_assms:\"length (m_data m) = length d_offs\" \"i (d_off (m_data m ! i))\"\n by (metis list_all_length m.select_convs(7) m_is(6,16) module_data.select_convs(2) module_data_typing.simps)\n have l2:\"\\ \\ (d_off (m_data m ! i)) : ([] _> [T_i32])\"\n using local_assms\n by (metis list_all_length m.select_convs(7) m_is(6,16) module_data.select_convs(2) module_data_typing.simps)\n obtain c_r where \"run_v 2 0 (s', \\ f_locs=[], f_inst=inst \\, d_off (m_data m ! i)) = (s', RValue [ConstInt32 c_r])\"\n using const_exprs_run_v[OF l1 l2 _ 11, of inst \"[]\"] typeof_i32\n by auto\n hence run_v_is:\"run_v 2 0 (s', \\ f_locs=[], f_inst=inst \\, d_off (m_data m ! i)) = (s', RValue [ConstInt32 (d_offs ! i)])\"\n using s_end_is(6) local_assms\n by (simp add: interp_get_i32_def interp_get_v_def split: v.splits)\n obtain f_temp where \"reduce_trans (s', \\ f_locs=[], f_inst=inst \\, $* d_off (m_data m ! i)) (s', f_temp, [$C ConstInt32 (d_offs ! i)])\"\n using run_v_sound[OF run_v_is]\n by auto\n hence \"reduce_trans (s', \\ f_locs=[], f_inst=inst \\, $* d_off (m_data m ! i)) (s', \\ f_locs=[], f_inst=inst \\, [$C ConstInt32 (d_offs ! i)])\"\n using reduce_trans_length_locals reduce_trans_inst_is\n by (metis (full_types) f.select_convs(1) f.surjective length_greater_0_conv old.unit.exhaust)\n }\n thus ?thesis\n using s_end_is(6)\n unfolding list_all2_conv_all_nth\n by fastforce\n qed\n show ?thesis\n using instantiate.intros\n 1 s_end_is(2) 2 3 4 5 s_end_is(7,8) s_end_is(9,10,11)[symmetric]\n by blast\nqed\n\nlemma map_intro_length:\n assumes \"\\i. i < length ls \\ F (ls!i) = fls!i\"\n \"length ls = length fls\"\n shows \"map F ls = fls\"\n using assms\n by (metis length_map nth_equalityI nth_map)\n\nlemma instantiate_imp_interp_instantiate:\n assumes \"(instantiate s m v_imps ((s_end, inst, v_exps), start))\"\n shows \"(interp_instantiate s m v_imps = Some ((s_end, inst, v_exps), start))\"\nproof -\n obtain fs ts ms gs els ds i_opt imps exps tfs where m_is:\n \"m = \\m_types = tfs,\n m_funcs = fs,\n m_tabs = ts,\n m_mems = ms,\n m_globs = gs,\n m_elem = els,\n m_data = ds,\n m_start = i_opt,\n m_imports = imps,\n m_exports = exps\\\"\n using m.cases\n by blast\n obtain inst' where inst'_is:\n \"inst' = \\types=[],funcs=[],tabs=[],mems=[],globs=ext_globs v_imps\\\"\n using inst.cases\n by blast\n\n obtain t_imps t_exps g_inits s' e_offs d_offs s'' f where s_end_is:\n \"module_typing m t_imps t_exps\"\n \"list_all2 (external_typing s) v_imps t_imps\"\n \"alloc_module s m v_imps g_inits (s', inst, v_exps)\"\n \"list_all2 (\\g v. reduce_trans (s',f,$*(g_init g)) (s',f,[$C v])) gs g_inits\"\n \"list_all2 (\\e c. reduce_trans (s',f,$*(e_off e)) (s',f,[$C ConstInt32 c])) els e_offs\"\n \"list_all2 (\\d c. reduce_trans (s',f,$*(d_off d)) (s',f,[$C ConstInt32 c])) ds d_offs\"\n \"list_all2 (\\e_off e. ((nat_of_int e_off) + (length (e_init e))) \\ length (fst ((tabs s')!((inst.tabs inst)!(e_tab e))))) e_offs els\"\n \"list_all2 (\\d_off d. ((nat_of_int d_off) + (length (d_init d))) \\ mem_length ((mems s')!((inst.mems inst)!(d_data d)))) d_offs ds\"\n \"map_option (\\i_s. ((inst.funcs inst)!i_s)) i_opt = start\"\n \"init_tabs s' inst (map nat_of_int e_offs) els = s''\"\n \"init_mems s'' inst (map nat_of_int d_offs) ds = s_end\"\n \"f = \\ f_locs=[], f_inst=inst \\\"\n using assms m_is\n unfolding instantiate.simps\n by fastforce\n\n obtain fts gts ifts itts imts igts \\ \\' where m_is_2:\n \"list_all2 (module_func_typing \\) fs fts\"\n \"list_all (module_tab_typing) ts\"\n \"list_all (module_mem_typing) ms\"\n \"list_all2 (module_glob_typing \\') gs gts\"\n \"list_all (module_elem_typing \\) els\"\n \"list_all (module_data_typing \\) ds\"\n \"pred_option (module_start_typing \\) i_opt\"\n \"list_all2 (\\imp. module_import_typing \\ (I_desc imp)) imps t_imps\"\n \"list_all2 (\\exp. module_export_typing \\ (E_desc exp)) exps t_exps\"\n \"ifts = ext_t_funcs t_imps\"\n \"itts = ext_t_tabs t_imps\"\n \"imts = ext_t_mems t_imps\"\n \"igts = ext_t_globs t_imps\"\n \"\\ = \\types_t=tfs, func_t=ifts@fts, global=igts@gts, table=itts@ts, memory=imts@ms, local=[], label=[], return=None\\\"\n \"\\' = \\types_t=[], func_t=[], global=igts, table=[], memory=[], local=[], label=[], return=None\\\"\n using s_end_is(1) m_is\n unfolding module_typing.simps\n by blast\n\n obtain s1 s2 s3 i_fs i_ts i_ms i_gs where inst_is:\n \"inst = \\types=(m_types m),\n funcs=(ext_funcs v_imps)@i_fs,\n tabs=(ext_tabs v_imps)@i_ts,\n mems=(ext_mems v_imps)@i_ms,\n globs=(ext_globs v_imps)@i_gs\\\"\n \"alloc_funcs s fs inst = (s1,i_fs)\"\n \"alloc_tabs s1 ts = (s2,i_ts)\"\n \"alloc_mems s2 ms = (s3,i_ms)\"\n \"alloc_globs s3 gs g_inits = (s',i_gs)\"\n \"v_exps = map (\\m_exp. \\E_name=(E_name m_exp), E_desc=(export_get_v_ext inst (E_desc m_exp))\\) (m_exports m)\"\n using s_end_is(3) m_is\n unfolding alloc_module.simps\n by fastforce\n\n have 12:\"list_all2 (\\ig tg. external_typing s (Ext_glob ig) (Te_glob tg)) (inst.globs inst') (global \\')\"\n using ext_globs_ind list_all2_external_typing_glob_alloc\n by (simp add: inst'_is m_is_2(13,15) s_end_is(2))\n have 11:\"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) (inst.globs inst) (global \\)\"\n proof -\n have \"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) (inst.globs inst') (global \\')\"\n using alloc_module_external_typing_preserved[OF s_end_is(3)] 12\n unfolding list_all2_conv_all_nth\n by fastforce\n moreover\n have 111:\"list_all2 (\\v m_g. typeof v = tg_t (g_type m_g)) g_inits gs\"\n proof -\n { fix i\n assume local_assms: \"i < length gs\"\n have l2:\"\\' \\ (g_init (gs ! i)) : ([] _> [tg_t (g_type (gs!i))])\"\n \"const_exprs \\' (g_init (gs ! i))\"\n using local_assms m_is m_is m_is_2(4,15)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n by auto\n have l1:\"reduce_trans (s',f,$*(g_init (gs!i))) (s',f,[$C (g_inits!i)])\"\n using s_end_is(4) local_assms\n unfolding list_all2_conv_all_nth\n by blast\n have \"typeof (g_inits!i) = tg_t (g_type (gs!i))\"\n using local_assms const_exprs_reduce_trans[OF l2(2,1) l1 _ 12]\n alloc_module_ext_arb[OF s_end_is(3)] s_end_is(3)\n unfolding alloc_module.simps s_end_is(12)\n apply simp\n apply (metis (mono_tags, lifting) inst'_is inst.select_convs(5))\n done\n }\n thus ?thesis\n using s_end_is(4)\n unfolding list_all2_conv_all_nth\n by metis\n qed\n have \"(gather_m_g_types gs) = gts\"\n using m_is_2(4,15)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n apply simp\n apply (metis length_map module_glob.select_convs(1) nth_equalityI nth_map)\n done\n hence \"list_all2 (\\ig tg. external_typing s' (Ext_glob ig) (Te_glob tg)) i_gs gts\"\n using alloc_globs_ext_typing[OF inst_is(5) 111]\n by blast\n ultimately\n show ?thesis\n using list_all2_appendI inst'_is\n by (fastforce simp add: m_is_2(14,15) inst_is(1) s_end_is(11))\n qed\n\n have \"(module_type_checker m) = Some (t_imps, t_exps)\"\n using s_end_is(1) module_typing_equiv_module_type_checker\n by blast\n moreover\n have \"g_inits = map (\\g. interp_get_v s inst' (g_init g)) gs\"\n proof -\n { fix i\n assume local_assms: \"i < length gs\"\n obtain t where l2:\"\\' \\ (g_init (gs ! i)) : ([] _> [t])\"\n \"const_exprs \\' (g_init (gs ! i))\"\n using local_assms m_is m_is m_is_2(4,15)\n unfolding list_all2_conv_all_nth module_glob_typing.simps\n by auto\n have l1:\"reduce_trans (s',f,$*(g_init (gs!i))) (s',f,[$C (g_inits!i)])\"\n using s_end_is(4) local_assms\n unfolding list_all2_conv_all_nth\n by blast\n have \"run_v 2 0 (s,\\ f_locs=[], f_inst=inst' \\,(g_init (gs!i))) = (s,RValue [g_inits!i])\"\n using const_exprs_reduce_trans[OF l2(2,1) l1 _ 12, of _ s \"[]\" _ inst' \"[]\"]\n alloc_module_ext_arb[OF s_end_is(3)] s_end_is(3)\n unfolding alloc_module.simps s_end_is(12)\n apply (simp split: prod.splits del: run_v.simps)\n apply (metis (mono_tags, lifting) inst'_is inst.select_convs(5))\n done\n hence \"interp_get_v s inst' (g_init (gs!i)) = g_inits!i\"\n unfolding interp_get_v_def\n by fastforce\n }\n thus ?thesis\n using map_intro_length[symmetric, of gs \"(\\g. interp_get_v s inst' (g_init g))\" g_inits]\n list_all2_lengthD[OF s_end_is(4)]\n by fastforce\n qed\n moreover\n have \"interp_alloc_module s m v_imps g_inits = (s', inst, v_exps)\"\n using s_end_is(3) alloc_module_equiv_interp_alloc_module\n by blast\n moreover\n have \"e_offs = map (\\e. interp_get_i32 s' inst (e_off e)) els\"\n proof -\n { fix i\n assume local_assms: \"i < length els\"\n have l2:\"const_exprs \\ (e_off (els ! i))\"\n \"\\ \\ e_off (els ! i) : ([] _> [T_i32])\"\n using m_is_2(5)\n by (metis list_all_length local_assms module_elem.select_convs(2) module_elem_typing.cases)+\n have l1:\"reduce_trans (s',f,$*(e_off (els!i))) (s',f,[$C ConstInt32 (e_offs!i)])\"\n using s_end_is(5) local_assms\n unfolding list_all2_conv_all_nth\n by blast\n have \"run_v 2 0 (s',f,(e_off (els!i))) = (s',RValue [ConstInt32 (e_offs!i)])\"\n using const_exprs_reduce_trans[OF l2(1,2) l1 _ 11]\n unfolding s_end_is(12)\n by fastforce\n hence \"interp_get_i32 s' inst (e_off (els!i)) = e_offs!i\"\n unfolding interp_get_i32_def interp_get_v_def s_end_is(12)\n by fastforce\n }\n thus ?thesis\n using map_intro_length[symmetric, of els \"(\\e. interp_get_i32 s' inst (e_off e))\" e_offs]\n list_all2_lengthD[OF s_end_is(5)]\n by fastforce\n qed\n moreover\n have \"d_offs = map (\\d. interp_get_i32 s' inst (d_off d)) ds\"\n proof -\n { fix i\n assume local_assms: \"i < length ds\"\n have l2:\"const_exprs \\ (d_off (ds ! i))\"\n \"\\ \\ d_off (ds ! i) : ([] _> [T_i32])\"\n using m_is_2(6)\n by (metis list_all_length local_assms module_data.select_convs(2) module_data_typing.cases)+\n have l1:\"reduce_trans (s',f,$*(d_off (ds!i))) (s',f,[$C ConstInt32 (d_offs!i)])\"\n using s_end_is(6) local_assms\n unfolding list_all2_conv_all_nth\n by blast\n have \"run_v 2 0 (s',f,(d_off (ds!i))) = (s',RValue [ConstInt32 (d_offs!i)])\"\n using const_exprs_reduce_trans[OF l2(1,2) l1 _ 11]\n unfolding s_end_is(12)\n by fastforce\n hence \"interp_get_i32 s' inst (d_off (ds!i)) = d_offs!i\"\n unfolding interp_get_i32_def interp_get_v_def s_end_is(12)\n by fastforce\n }\n thus ?thesis\n using map_intro_length[symmetric, of ds \"(\\e. interp_get_i32 s' inst (d_off e))\" d_offs]\n list_all2_lengthD[OF s_end_is(6)]\n by fastforce\n qed\n ultimately\n show ?thesis\n using s_end_is(2,7,8,9,10,11) m_is inst'_is\n by simp\nqed\n\ntheorem instantiate_equiv_interp_instantiate:\n \"(instantiate s m v_imps ((s_end, inst, v_exps), start)) = (interp_instantiate s m v_imps = Some ((s_end, inst, v_exps), start))\"\n using instantiate_imp_interp_instantiate interp_instantiate_imp_instantiate\n by blast\nend", "meta": {"author": "WasmCert", "repo": "WasmCert-Isabelle", "sha": "f61ec8eab5d551347a268e858e83b7ac7da0d8b5", "save_path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle", "path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle/WasmCert-Isabelle-f61ec8eab5d551347a268e858e83b7ac7da0d8b5/WebAssembly/Wasm_Instantiation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.26271164077314424}} {"text": "theory flash100Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX10VsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX10_homeVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX11VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Put )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Remote_GetX_NakVsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv100: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_WbVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX1VsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX2VsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX1VsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_PutVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Local_PutXVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv100: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv100 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_GetVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv100: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv100 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv100: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv100 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash100Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.26271164077314424}} {"text": "theory IO\n imports\n Main\n \"HOL-Library.Countable\"\n \"HOL-Library.Monad_Syntax\"\nbegin\n\n(*\n We don't use HOL-Imperative_HOL Library, because it does implement\n arrays as a list in a cell. We will follow the same idea about Heap,\n but implement arrays as sequent cells in a memory.\n*)\n\nclass heap = typerep + countable\n\ninstance unit :: heap ..\ninstance bool :: heap ..\ninstance nat :: heap ..\ninstance int :: heap ..\n\ntype_synonym addr = nat\n\nrecord heap = \n memory :: \"addr \\ nat\"\n lim :: addr\n\ndatatype 'a ref = Ref addr\n\nprimrec addr_of_ref :: \"'a ref \\ addr\" where\n \"addr_of_ref (Ref r) = r\"\n\nlemma addr_of_ref_inj [simp]:\n \"addr_of_ref r = addr_of_ref r' \\ r = r'\"\n by (cases r, cases r') simp_all\n\nprimrec nat_of_ref :: \"'a ref \\ nat\" where\n \"nat_of_ref (Ref r) = r\"\n\ninstance ref :: (type) countable\n apply (rule countable_classI [of nat_of_ref])\n apply (metis nat_of_ref.simps ref.exhaust)\n done\n\ninstance ref :: (type) heap ..\n\ndatatype 'a io = IO \"heap \\ ('a \\ heap)\"\n\nprimrec execute :: \"'a io \\ heap \\ ('a \\ heap)\" where\n [code del]: \"execute (IO f) = f\"\n\nlemma io_execute [simp]:\n \"IO (execute f) = f\"\n by (cases f, simp)\n\ndefinition tap :: \"(heap \\ 'a) \\ 'a io\" where\n [code del]: \"tap f = IO (\\h. (f h, h))\"\n\nlemma execute_tap:\n \"execute (tap f) h = (f h, h)\"\n by (simp add: tap_def)\n\ndefinition effect :: \"'a io \\ heap \\ heap \\ 'a \\ bool\" where\n \"effect c h h' r = (execute c h = (r,h'))\"\n\nlemma effectI: \"execute c h = (r,h') \\ effect c h h' r\"\n by (simp add: effect_def)\n\nlemma effectE:\n assumes \"effect c h h' r\"\n shows \"execute c h = (r,h')\"\n using assms by (simp add: effect_def)\n\ndefinition return :: \"'a \\ 'a io\" where\n [code del]: \"return x = IO (\\h. (x,h))\"\n\ndefinition bind :: \"'a io \\ ('a \\ 'b io) \\ 'b io\" where\n [code del]: \"bind x f = IO (\\h. case execute x h of (y,h') \\ execute (f y) h')\"\n\nadhoc_overloading\n Monad_Syntax.bind IO.bind\n\n(* IO monad *)\n\nlemma monad_left_id[simp]: \"return a \\ f = f a\"\n apply (simp add: return_def bind_def)\n done\n\nlemma monad_right_id[simp]: \"m \\ return = m\"\n apply (simp add: return_def bind_def comp_def)\n done\n\nlemma monad_assoc[simp]:\n fixes m :: \"'a::heap io\"\n shows \"(m \\ f) \\ g = m \\ (\\x. f x \\ g)\"\n unfolding bind_def comp_def by (auto split: prod.splits)\n\n(* Monadic Combinators *)\n\nfun forMu :: \"'a list \\ ('a \\ unit io) \\ unit io\" where\n \"forMu [] f = return ()\"\n| \"forMu (x#xs) f = f x \\ (\\_. forMu xs f)\"\n\nfun mapM :: \"('a \\ 'b::heap io) \\ 'a list \\ 'b list io\" where\n \"mapM f [] = return []\"\n| \"mapM f (x#xs) = f x \\ (\\r. mapM f xs \\ (\\rs. return (r#rs)))\"\n\nfun whenu :: \"bool \\ unit io \\ unit io\" where\n \"whenu cond f = (if cond then f else return ())\"\n\nfun whenM :: \"bool io \\ unit io \\ unit io\" where\n \"whenM cond f = cond \\ (\\b. if b then f else return ())\"\n\nlemma execute_bind: \"execute (m \\ k) h = (case (execute m h) of (val,h') \\ execute (k val) h')\"\n by (simp add: IO.bind_def)\n\nlemma effect_bind:\n assumes \"effect (m \\ k) h h' r\"\n obtains h'' a where \"effect m h h'' a\" \"effect (k a) h'' h' r\"\n using assms\n apply (simp add: effect_def execute_bind)\n by (metis case_prod_beta prod.exhaust_sel)\n\nlemma effect_return_unit [simp]:\n assumes \"effect (return ()) h h' ()\"\n shows \"h' = h\"\n by (metis assms effectE execute.simps return_def snd_conv)\n\nlemma forMu_nil [simp]: \"execute (forMu [] p) h = ((),h)\"\n by (simp add: return_def)\n\nlemma forMu_app_return:\n \"execute (forMu (as@bs) program) h = execute (do {\n _ \\ forMu as program;\n _ \\ forMu bs program;\n return ()\n }) h\"\n apply (induct as arbitrary: h, simp)\n apply (simp add: execute_bind)\n done\n\nlemma forMu_app:\n \"execute (forMu (as@bs) program) h = execute (do {\n _ \\ forMu as program;\n forMu bs program\n }) h\"\n apply (induct as arbitrary: h, simp)\n apply (simp add: execute_bind)\n done\n\ncode_printing\n type_constructor io \\ (Haskell) \"IO _\"\n | type_constructor ref \\ (Haskell) \"IORef _\"\n | constant return \\ (Haskell) \"return\"\n | constant bind \\ (Haskell) infixl 5 \">>=\"\n\n(* Refs *)\n\ndefinition present :: \"heap \\ 'a::heap ref \\ bool\" where\n \"present h v = (addr_of_ref v < lim h)\"\n\ndefinition set :: \"'a::heap ref \\ 'a \\ heap \\ heap\" where\n \"set r v h = h \\ memory := (\\i. if i = addr_of_ref r then to_nat v else memory h i) \\\"\n\ndefinition alloc :: \"'a \\ heap \\ 'a::heap ref \\ heap\" where\n \"alloc v h = (let l = lim h; r = Ref l in (r, set r v (h \\ lim := lim h + 1 \\)))\"\n\ndefinition get :: \"heap \\ 'a::heap ref \\ 'a\" where\n \"get h = from_nat \\ memory h \\ addr_of_ref\"\n\ndefinition ref :: \"'a::heap \\ 'a ref io\" where\n \"ref v = IO (alloc v)\"\n\ndefinition lookup :: \"'a::heap ref \\ 'a io\" (\"!_\" 61) where\n \"lookup r = tap (\\h. get h r)\"\n\ndefinition update :: \"'a ref \\ 'a::heap \\ unit io\" (\"_ := _\" 62) where\n \"update r v = IO (\\h. ((), set r v h))\"\n\nlemma get_set_eq [simp]: \"get (set r x h) r = x\"\n by (simp add: get_def set_def)\n\nlemma heap_eqI:\n assumes \"\\x. m1 x = m2 x\" and \"l1 = l2\"\n shows \"\\ memory = m1, lim = l1 \\ = \\ memory = m2, lim = l2 \\\"\n using assms by auto\n\nlemma set_same [simp]: \"set r x (set r y h) = set r x h\"\n apply (simp add: set_def)\nproof-\n have \"\\P x y. P x \\ (\\y. x \\ y \\ P y) \\ (\\z. P z)\"\n by metis\n hence \"\\f g. f (addr_of_ref r) = g (addr_of_ref r) \\ (\\x. x \\ addr_of_ref r \\ f x = g x) \\ (\\z. f z = g z)\"\n by smt\n hence \"\\z. (\\i. if i = addr_of_ref r then to_nat x else memory (h\\memory := \\i. if i = addr_of_ref r then to_nat y else memory h i\\) i) z = (\\i. if i = addr_of_ref r then to_nat x else memory h i) z\"\n by auto\n thus \"h\\memory := \\i. if i = addr_of_ref r then to_nat x else memory (h\\memory := \\i. if i = addr_of_ref r then to_nat y else memory h i\\) i\\ = h\\memory := \\i. if i = addr_of_ref r then to_nat x else memory h i\\\"\n by simp\nqed\n\nlemma execute_ref: \"execute (ref v) h = alloc v h\"\n by (simp add: ref_def)\n\nlemma execute_lookup: \"execute (lookup r) h = (get h r, h)\"\n by (simp add: lookup_def execute_def tap_def)\n\nlemma execute_update: \"execute (update r v) h = ((), set r v h)\"\n by (simp add: update_def)\n\ndefinition noteq :: \"'a::heap ref \\ 'b::heap ref \\ bool\" (infix \"=!=\" 70) where\n \"r =!= s \\ addr_of_ref r \\ addr_of_ref s\"\n\nlemma noteq_sym: \"r =!= s \\ s =!= r\"\n apply (simp add: noteq_def)\n done\n\nlemma noteq_set_get:\n assumes \"r =!= s\"\n shows \"get (set r val h) s = get h s\"\n apply (auto simp add: noteq_def IO.set_def get_def)\n using assms apply (simp add: noteq_def)\n done\n\nlemma effect_forMu_app:\n assumes \"effect (forMu (as@bs) program) h h' ()\"\n shows \"effect (do {\n _ \\ forMu as program;\n forMu bs program\n }) h h' ()\"\n using assms\n apply (simp add: effect_def)\n apply (simp add: forMu_app)\n done\n\nlemma alloc_get: \"alloc v h = (r,h') \\ get h' r = v\"\n apply (simp add: alloc_def get_def)\n by (metis comp_apply get_def get_set_eq prod.sel(1) snd_conv)\n\nhide_const (open) present get set alloc\n\nend\n", "meta": {"author": "myuon", "repo": "algo", "sha": "691b21ad06f1ac2c41ecd3462c3d5b65110c2b14", "save_path": "github-repos/isabelle/myuon-algo", "path": "github-repos/isabelle/myuon-algo/algo-691b21ad06f1ac2c41ecd3462c3d5b65110c2b14/isabelle/IO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.26271163403753856}} {"text": "theory Class3\nimports Class2\nbegin\n\ntext \\3rd Main Lemma\\\n\nlemma Cut_a_redu_elim:\n assumes a: \"Cut .M (x).N \\\\<^sub>a R\"\n shows \"(\\M'. R = Cut .M' (x).N \\ M \\\\<^sub>a M') \\\n (\\N'. R = Cut .M (x).N' \\ N \\\\<^sub>a N') \\\n (Cut .M (x).N \\\\<^sub>c R) \\\n (Cut .M (x).N \\\\<^sub>l R)\"\nusing a\napply(erule_tac a_redu.cases)\napply(simp_all)\napply(simp_all add: trm.inject)\napply(rule disjI1)\napply(auto simp add: alpha)[1]\napply(rule_tac x=\"[(a,aa)]\\M'\" in exI)\napply(perm_simp add: fresh_left calc_atm a_redu.eqvt fresh_a_redu)\napply(rule_tac x=\"[(a,aa)]\\M'\" in exI)\napply(perm_simp add: fresh_left calc_atm a_redu.eqvt fresh_a_redu)\napply(rule disjI2)\napply(rule disjI1)\napply(auto simp add: alpha)[1]\napply(rule_tac x=\"[(x,xa)]\\N'\" in exI)\napply(perm_simp add: fresh_left calc_atm a_redu.eqvt fresh_a_redu)\napply(rule_tac x=\"[(x,xa)]\\N'\" in exI)\napply(perm_simp add: fresh_left calc_atm a_redu.eqvt fresh_a_redu)\ndone\n\nlemma Cut_c_redu_elim:\n assumes a: \"Cut .M (x).N \\\\<^sub>c R\"\n shows \"(R = M{a:=(x).N} \\ \\fic M a) \\\n (R = N{x:=.M} \\ \\fin N x)\"\nusing a\napply(erule_tac c_redu.cases)\napply(simp_all)\napply(simp_all add: trm.inject)\napply(rule disjI1)\napply(auto simp add: alpha)[1]\napply(simp add: subst_rename fresh_atm)\napply(simp add: subst_rename fresh_atm)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(perm_simp)\napply(simp add: subst_rename fresh_atm fresh_prod)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(perm_simp)\napply(rule disjI2)\napply(auto simp add: alpha)[1]\napply(simp add: subst_rename fresh_atm)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(perm_simp)\napply(simp add: subst_rename fresh_atm fresh_prod)\napply(simp add: subst_rename fresh_atm fresh_prod)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(perm_simp)\ndone\n\nlemma not_fic_crename_aux:\n assumes a: \"fic M c\" \"c\\(a,b)\"\n shows \"fic (M[a\\c>b]) c\" \nusing a\napply(nominal_induct M avoiding: c a b rule: trm.strong_induct)\napply(auto dest!: fic_elims intro!: fic.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh)\ndone\n\nlemma not_fic_crename:\n assumes a: \"\\(fic (M[a\\c>b]) c)\" \"c\\(a,b)\"\n shows \"\\(fic M c)\" \nusing a\napply(auto dest: not_fic_crename_aux)\ndone\n\nlemma not_fin_crename_aux:\n assumes a: \"fin M y\"\n shows \"fin (M[a\\c>b]) y\" \nusing a\napply(nominal_induct M avoiding: a b rule: trm.strong_induct)\napply(auto dest!: fin_elims intro!: fin.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh)\ndone\n\nlemma not_fin_crename:\n assumes a: \"\\(fin (M[a\\c>b]) y)\" \n shows \"\\(fin M y)\" \nusing a\napply(auto dest: not_fin_crename_aux)\ndone\n\nlemma crename_fresh_interesting1:\n fixes c::\"coname\"\n assumes a: \"c\\(M[a\\c>b])\" \"c\\(a,b)\"\n shows \"c\\M\"\nusing a\napply(nominal_induct M avoiding: c a b rule: trm.strong_induct)\napply(auto split: if_splits simp add: abs_fresh)\ndone\n\nlemma crename_fresh_interesting2:\n fixes x::\"name\"\n assumes a: \"x\\(M[a\\c>b])\" \n shows \"x\\M\"\nusing a\napply(nominal_induct M avoiding: x a b rule: trm.strong_induct)\napply(auto split: if_splits simp add: abs_fresh abs_supp fin_supp fresh_atm)\ndone\n\n\nlemma fic_crename:\n assumes a: \"fic (M[a\\c>b]) c\" \"c\\(a,b)\"\n shows \"fic M c\" \nusing a\napply(nominal_induct M avoiding: c a b rule: trm.strong_induct)\napply(auto dest!: fic_elims intro!: fic.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh\n split: if_splits)\napply(auto dest: crename_fresh_interesting1 simp add: fresh_prod fresh_atm)\ndone\n\nlemma fin_crename:\n assumes a: \"fin (M[a\\c>b]) x\"\n shows \"fin M x\" \nusing a\napply(nominal_induct M avoiding: x a b rule: trm.strong_induct)\napply(auto dest!: fin_elims intro!: fin.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh\n split: if_splits)\napply(auto dest: crename_fresh_interesting2 simp add: fresh_prod fresh_atm)\ndone\n\nlemma crename_Cut:\n assumes a: \"R[a\\c>b] = Cut .M (x).N\" \"c\\(a,b,N,R)\" \"x\\(M,R)\"\n shows \"\\M' N'. R = Cut .M' (x).N' \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ c\\N' \\ x\\M'\"\nusing a\napply(nominal_induct R avoiding: a b c x M N rule: trm.strong_induct)\napply(auto split: if_splits)\napply(simp add: trm.inject)\napply(auto simp add: alpha)\napply(rule_tac x=\"[(name,x)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(auto simp add: fresh_atm)[1]\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name,x)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(auto simp add: fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_NotR:\n assumes a: \"R[a\\c>b] = NotR (x).N c\" \"x\\R\" \"c\\(a,b)\"\n shows \"\\N'. (R = NotR (x).N' c) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b c x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_NotR':\n assumes a: \"R[a\\c>b] = NotR (x).N c\" \"x\\R\" \"c\\a\"\n shows \"(\\N'. (R = NotR (x).N' c) \\ N'[a\\c>b] = N) \\ (\\N'. (R = NotR (x).N' a) \\ b=c \\ N'[a\\c>b] = N)\"\nusing a\napply(nominal_induct R avoiding: a b c x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(name,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(name,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_NotR_aux:\n assumes a: \"R[a\\c>b] = NotR (x).N c\" \n shows \"(a=c \\ a=b) \\ (a\\c)\" \nusing a\napply(nominal_induct R avoiding: a b c x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_NotL:\n assumes a: \"R[a\\c>b] = NotL .N y\" \"c\\(R,a,b)\"\n shows \"\\N'. (R = NotL .N' y) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b c y N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_AndL1:\n assumes a: \"R[a\\c>b] = AndL1 (x).N y\" \"x\\R\"\n shows \"\\N'. (R = AndL1 (x).N' y) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b x y N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name1,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_AndL2:\n assumes a: \"R[a\\c>b] = AndL2 (x).N y\" \"x\\R\"\n shows \"\\N'. (R = AndL2 (x).N' y) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b x y N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name1,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_AndR_aux:\n assumes a: \"R[a\\c>b] = AndR .M .N e\" \n shows \"(a=e \\ a=b) \\ (a\\e)\" \nusing a\napply(nominal_induct R avoiding: a b c d e M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_AndR:\n assumes a: \"R[a\\c>b] = AndR .M .N e\" \"c\\(a,b,d,e,N,R)\" \"d\\(a,b,c,e,M,R)\" \"e\\(a,b)\"\n shows \"\\M' N'. R = AndR .M' .N' e \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ c\\N' \\ d\\M'\"\nusing a\napply(nominal_induct R avoiding: a b c d e M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha)\napply(simp add: fresh_atm fresh_prod)\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[a\\c>b]\" in sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_AndR':\n assumes a: \"R[a\\c>b] = AndR .M .N e\" \"c\\(a,b,d,e,N,R)\" \"d\\(a,b,c,e,M,R)\" \"e\\a\"\n shows \"(\\M' N'. R = AndR .M' .N' e \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ c\\N' \\ d\\M') \\\n (\\M' N'. R = AndR .M' .N' a \\ b=e \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ c\\N' \\ d\\M')\"\nusing a\napply(nominal_induct R avoiding: a b c d e M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha)[1]\napply(auto split: if_splits simp add: trm.inject alpha)[1]\napply(auto split: if_splits simp add: trm.inject alpha)[1]\napply(auto split: if_splits simp add: trm.inject alpha)[1]\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm trm.inject alpha)[1]\napply(case_tac \"coname3=a\")\napply(simp)\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm trm.inject alpha split: if_splits)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[a\\c>e]\" in sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(simp)\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm trm.inject alpha split: if_splits)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[a\\c>b]\" in sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_OrR1_aux:\n assumes a: \"R[a\\c>b] = OrR1 .M e\" \n shows \"(a=e \\ a=b) \\ (a\\e)\" \nusing a\napply(nominal_induct R avoiding: a b c e M rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_OrR1:\n assumes a: \"R[a\\c>b] = OrR1 .N d\" \"c\\(R,a,b)\" \"d\\(a,b)\"\n shows \"\\N'. (R = OrR1 .N' d) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_OrR1':\n assumes a: \"R[a\\c>b] = OrR1 .N d\" \"c\\(R,a,b)\" \"d\\a\"\n shows \"(\\N'. (R = OrR1 .N' d) \\ N'[a\\c>b] = N) \\\n (\\N'. (R = OrR1 .N' a) \\ b=d \\ N'[a\\c>b] = N)\" \nusing a\napply(nominal_induct R avoiding: a b c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_OrR2_aux:\n assumes a: \"R[a\\c>b] = OrR2 .M e\" \n shows \"(a=e \\ a=b) \\ (a\\e)\" \nusing a\napply(nominal_induct R avoiding: a b c e M rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_OrR2:\n assumes a: \"R[a\\c>b] = OrR2 .N d\" \"c\\(R,a,b)\" \"d\\(a,b)\"\n shows \"\\N'. (R = OrR2 .N' d) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_OrR2':\n assumes a: \"R[a\\c>b] = OrR2 .N d\" \"c\\(R,a,b)\" \"d\\a\"\n shows \"(\\N'. (R = OrR2 .N' d) \\ N'[a\\c>b] = N) \\\n (\\N'. (R = OrR2 .N' a) \\ b=d \\ N'[a\\c>b] = N)\" \nusing a\napply(nominal_induct R avoiding: a b c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_OrL:\n assumes a: \"R[a\\c>b] = OrL (x).M (y).N z\" \"x\\(y,z,N,R)\" \"y\\(x,z,M,R)\"\n shows \"\\M' N'. R = OrL (x).M' (y).N' z \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ x\\N' \\ y\\M'\"\nusing a\napply(nominal_induct R avoiding: a b x y z M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha)\napply(rule_tac x=\"[(name2,y)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name1,x)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name1,x)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name2,y)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[a\\c>b]\" in sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_ImpL:\n assumes a: \"R[a\\c>b] = ImpL .M (y).N z\" \"c\\(a,b,N,R)\" \"y\\(z,M,R)\"\n shows \"\\M' N'. R = ImpL .M' (y).N' z \\ M'[a\\c>b] = M \\ N'[a\\c>b] = N \\ c\\N' \\ y\\M'\"\nusing a\napply(nominal_induct R avoiding: a b c y z M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha)\napply(rule_tac x=\"[(name1,y)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name1,y)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[a\\c>b]\" in sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_ImpR_aux:\n assumes a: \"R[a\\c>b] = ImpR (x)..M e\" \n shows \"(a=e \\ a=b) \\ (a\\e)\" \nusing a\napply(nominal_induct R avoiding: x a b c e M rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma crename_ImpR:\n assumes a: \"R[a\\c>b] = ImpR (x)..N d\" \"c\\(R,a,b)\" \"d\\(a,b)\" \"x\\R\" \n shows \"\\N'. (R = ImpR (x)..N' d) \\ N'[a\\c>b] = N\" \nusing a\napply(nominal_induct R avoiding: a b x c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_perm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name,x)]\\[(coname1, c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_supp fin_supp abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_ImpR':\n assumes a: \"R[a\\c>b] = ImpR (x)..N d\" \"c\\(R,a,b)\" \"x\\R\" \"d\\a\"\n shows \"(\\N'. (R = ImpR (x)..N' d) \\ N'[a\\c>b] = N) \\\n (\\N'. (R = ImpR (x)..N' a) \\ b=d \\ N'[a\\c>b] = N)\" \nusing a\napply(nominal_induct R avoiding: x a b c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject abs_perm calc_atm)\napply(rule_tac x=\"[(name,x)]\\[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod abs_supp fin_supp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(name,x)]\\[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod abs_supp fin_supp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma crename_ax2:\n assumes a: \"N[a\\c>b] = Ax x c\"\n shows \"\\d. N = Ax x d\"\nusing a\napply(nominal_induct N avoiding: a b rule: trm.strong_induct)\napply(auto split: if_splits)\napply(simp add: trm.inject)\ndone\n\nlemma crename_interesting1:\n assumes a: \"distinct [a,b,c]\"\n shows \"M[a\\c>c][c\\c>b] = M[c\\c>b][a\\c>b]\"\nusing a\napply(nominal_induct M avoiding: a c b rule: trm.strong_induct)\napply(auto simp add: rename_fresh simp add: trm.inject alpha)\napply(blast)\napply(rotate_tac 12)\napply(drule_tac x=\"a\" in meta_spec)\napply(rotate_tac 15)\napply(drule_tac x=\"c\" in meta_spec)\napply(rotate_tac 15)\napply(drule_tac x=\"b\" in meta_spec)\napply(blast)\napply(blast)\napply(blast)\ndone\n\nlemma crename_interesting2:\n assumes a: \"a\\c\" \"a\\d\" \"a\\b\" \"c\\d\" \"b\\c\"\n shows \"M[a\\c>b][c\\c>d] = M[c\\c>d][a\\c>b]\"\nusing a\napply(nominal_induct M avoiding: a c b d rule: trm.strong_induct)\napply(auto simp add: rename_fresh simp add: trm.inject alpha)\ndone\n\nlemma crename_interesting3:\n shows \"M[a\\c>c][x\\n>y] = M[x\\n>y][a\\c>c]\"\napply(nominal_induct M avoiding: a c x y rule: trm.strong_induct)\napply(auto simp add: rename_fresh simp add: trm.inject alpha)\ndone\n\nlemma crename_credu:\n assumes a: \"(M[a\\c>b]) \\\\<^sub>c M'\"\n shows \"\\M0. M0[a\\c>b]=M' \\ M \\\\<^sub>c M0\"\nusing a\napply(nominal_induct M\\\"M[a\\c>b]\" M' avoiding: M a b rule: c_redu.strong_induct)\napply(drule sym)\napply(drule crename_Cut)\napply(simp)\napply(simp)\napply(auto)\napply(rule_tac x=\"M'{a:=(x).N'}\" in exI)\napply(rule conjI)\napply(simp add: fresh_atm abs_fresh subst_comm fresh_prod)\napply(rule c_redu.intros)\napply(auto dest: not_fic_crename)[1]\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(drule sym)\napply(drule crename_Cut)\napply(simp)\napply(simp)\napply(auto)\napply(rule_tac x=\"N'{x:=.M'}\" in exI)\napply(rule conjI)\napply(simp add: fresh_atm abs_fresh subst_comm fresh_prod)\napply(rule c_redu.intros)\napply(auto dest: not_fin_crename)[1]\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\ndone\n\nlemma crename_lredu:\n assumes a: \"(M[a\\c>b]) \\\\<^sub>l M'\"\n shows \"\\M0. M0[a\\c>b]=M' \\ M \\\\<^sub>l M0\"\nusing a\napply(nominal_induct M\\\"M[a\\c>b]\" M' avoiding: M a b rule: l_redu.strong_induct)\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(case_tac \"aa=ba\")\napply(simp add: crename_id)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(assumption)\napply(frule crename_ax2)\napply(auto)[1]\napply(case_tac \"d=aa\")\napply(simp add: trm.inject)\napply(rule_tac x=\"M'[a\\c>aa]\" in exI)\napply(rule conjI)\napply(rule crename_interesting1)\napply(simp)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fic_crename simp add: fresh_prod fresh_atm)[1]\napply(simp add: trm.inject)\napply(rule_tac x=\"M'[a\\c>b]\" in exI)\napply(rule conjI)\napply(rule crename_interesting2)\napply(simp)\napply(simp)\napply(simp)\napply(simp)\napply(simp)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fic_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_prod fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(case_tac \"aa=b\")\napply(simp add: crename_id)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(assumption)\napply(frule crename_ax2)\napply(auto)[1]\napply(case_tac \"d=aa\")\napply(simp add: trm.inject)\napply(simp add: trm.inject)\napply(rule_tac x=\"N'[x\\n>y]\" in exI)\napply(rule conjI)\napply(rule sym)\napply(rule crename_interesting3)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\n(* LNot *)\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_NotR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_NotL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N'b (x).N'a\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LAnd1 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule crename_AndR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_AndL1)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .M'a (x).N'a\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LAnd2 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule crename_AndR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_AndL2)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N'b (x).N'a\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LOr1 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule crename_OrL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_OrR1)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(auto)\napply(rule_tac x=\"Cut .N' (x1).M'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LOr2 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule crename_OrL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_OrR2)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(auto)\napply(rule_tac x=\"Cut .N' (x2).N'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: crename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* ImpL *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm abs_supp fin_supp)\napply(auto)[1]\napply(drule crename_ImpL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule crename_ImpR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .(Cut .M'a (x).N') (y).N'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh abs_supp fin_supp fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: crename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: crename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: crename_fresh_interesting1)[1]\ndone\n\nlemma crename_aredu:\n assumes a: \"(M[a\\c>b]) \\\\<^sub>a M'\" \"a\\b\"\n shows \"\\M0. M0[a\\c>b]=M' \\ M \\\\<^sub>a M0\"\nusing a\napply(nominal_induct \"M[a\\c>b]\" M' avoiding: M a b rule: a_redu.strong_induct)\napply(drule crename_lredu)\napply(blast)\napply(drule crename_credu)\napply(blast)\n(* Cut *)\napply(drule sym)\napply(drule crename_Cut)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"Cut .M0 (x).N'\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule conjI)\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule crename_fresh_interesting2)\napply(simp add: fresh_a_redu)\napply(simp)\napply(auto)[1]\napply(drule sym)\napply(drule crename_Cut)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"Cut .M' (x).M0\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule conjI)\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(drule crename_fresh_interesting1)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_a_redu)\napply(simp)\napply(simp)\napply(auto)[1]\n(* NotL *)\napply(drule sym)\napply(drule crename_NotL)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotL .M0 x\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* NotR *)\napply(drule sym)\napply(frule crename_NotR_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_NotR')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotR (x).M0 a\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotR (x).M0 aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* AndR *)\napply(drule sym)\napply(frule crename_AndR_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_AndR')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"ba\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M0 .N' c\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M0 .N' aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule sym)\napply(frule crename_AndR_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_AndR')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"ba\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M' .M0 c\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M' .M0 aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\n(* AndL1 *)\napply(drule sym)\napply(drule crename_AndL1)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL1 (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* AndL2 *)\napply(drule sym)\napply(drule crename_AndL2)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL2 (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* OrL *)\napply(drule sym)\napply(drule crename_OrL)\napply(simp)\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M0 (y).N' z\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\napply(drule sym)\napply(drule crename_OrL)\napply(simp)\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M' (y).M0 z\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\napply(simp)\n(* OrR1 *)\napply(drule sym)\napply(frule crename_OrR1_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_OrR1')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"ba\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR1 .M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR1 .M0 aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* OrR2 *)\napply(drule sym)\napply(frule crename_OrR2_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_OrR2')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"ba\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR2 .M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR2 .M0 aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* ImpL *)\napply(drule sym)\napply(drule crename_ImpL)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M0 (x).N' y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule sym)\napply(drule crename_ImpL)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M' (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule crename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\n(* ImpR *)\napply(drule sym)\napply(frule crename_ImpR_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule crename_ImpR')\napply(simp)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"ba\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpR (x)..M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpR (x)..M0 aa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\ndone\n\nlemma SNa_preserved_renaming1:\n assumes a: \"SNa M\"\n shows \"SNa (M[a\\c>b])\"\nusing a\napply(induct rule: SNa_induct)\napply(case_tac \"a=b\")\napply(simp add: crename_id)\napply(rule SNaI)\napply(drule crename_aredu)\napply(blast)+\ndone\n\nlemma nrename_interesting1:\n assumes a: \"distinct [x,y,z]\"\n shows \"M[x\\n>z][z\\n>y] = M[z\\n>y][x\\n>y]\"\nusing a\napply(nominal_induct M avoiding: x y z rule: trm.strong_induct)\napply(auto simp add: rename_fresh simp add: trm.inject alpha)\napply(blast)\napply(blast)\napply(rotate_tac 12)\napply(drule_tac x=\"x\" in meta_spec)\napply(rotate_tac 15)\napply(drule_tac x=\"y\" in meta_spec)\napply(rotate_tac 15)\napply(drule_tac x=\"z\" in meta_spec)\napply(blast)\napply(rotate_tac 11)\napply(drule_tac x=\"x\" in meta_spec)\napply(rotate_tac 14)\napply(drule_tac x=\"y\" in meta_spec)\napply(rotate_tac 14)\napply(drule_tac x=\"z\" in meta_spec)\napply(blast)\ndone\n\nlemma nrename_interesting2:\n assumes a: \"x\\z\" \"x\\u\" \"x\\y\" \"z\\u\" \"y\\z\"\n shows \"M[x\\n>y][z\\n>u] = M[z\\n>u][x\\n>y]\"\nusing a\napply(nominal_induct M avoiding: x y z u rule: trm.strong_induct)\napply(auto simp add: rename_fresh simp add: trm.inject alpha)\ndone\n\nlemma not_fic_nrename_aux:\n assumes a: \"fic M c\" \n shows \"fic (M[x\\n>y]) c\" \nusing a\napply(nominal_induct M avoiding: c x y rule: trm.strong_induct)\napply(auto dest!: fic_elims intro!: fic.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh)\ndone\n\nlemma not_fic_nrename:\n assumes a: \"\\(fic (M[x\\n>y]) c)\" \n shows \"\\(fic M c)\" \nusing a\napply(auto dest: not_fic_nrename_aux)\ndone\n\nlemma fin_nrename:\n assumes a: \"fin M z\" \"z\\(x,y)\"\n shows \"fin (M[x\\n>y]) z\" \nusing a\napply(nominal_induct M avoiding: x y z rule: trm.strong_induct)\napply(auto dest!: fin_elims intro!: fin.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh\n split: if_splits)\ndone\n\nlemma nrename_fresh_interesting1:\n fixes z::\"name\"\n assumes a: \"z\\(M[x\\n>y])\" \"z\\(x,y)\"\n shows \"z\\M\"\nusing a\napply(nominal_induct M avoiding: x y z rule: trm.strong_induct)\napply(auto split: if_splits simp add: abs_fresh abs_supp fin_supp)\ndone\n\nlemma nrename_fresh_interesting2:\n fixes c::\"coname\"\n assumes a: \"c\\(M[x\\n>y])\" \n shows \"c\\M\"\nusing a\napply(nominal_induct M avoiding: x y c rule: trm.strong_induct)\napply(auto split: if_splits simp add: abs_fresh abs_supp fin_supp fresh_atm)\ndone\n\nlemma fin_nrename2:\n assumes a: \"fin (M[x\\n>y]) z\" \"z\\(x,y)\"\n shows \"fin M z\" \nusing a\napply(nominal_induct M avoiding: x y z rule: trm.strong_induct)\napply(auto dest!: fin_elims intro!: fin.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh\n split: if_splits)\napply(auto dest: nrename_fresh_interesting1 simp add: fresh_atm fresh_prod)\ndone\n\nlemma nrename_Cut:\n assumes a: \"R[x\\n>y] = Cut .M (z).N\" \"c\\(N,R)\" \"z\\(x,y,M,R)\"\n shows \"\\M' N'. R = Cut .M' (z).N' \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N \\ c\\N' \\ z\\M'\"\nusing a\napply(nominal_induct R avoiding: c y x z M N rule: trm.strong_induct)\napply(auto split: if_splits)\napply(simp add: trm.inject)\napply(auto simp add: alpha fresh_atm)\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name,z)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule conjI)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(auto simp add: fresh_atm)[1]\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_NotR:\n assumes a: \"R[x\\n>y] = NotR (z).N c\" \"z\\(R,x,y)\" \n shows \"\\N'. (R = NotR (z).N' c) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: x y c z N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name,z)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_NotL:\n assumes a: \"R[x\\n>y] = NotL .N z\" \"c\\R\" \"z\\(x,y)\"\n shows \"\\N'. (R = NotL .N' z) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: x y c z N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_NotL':\n assumes a: \"R[x\\n>y] = NotL .N u\" \"c\\R\" \"x\\y\" \n shows \"(\\N'. (R = NotL .N' u) \\ N'[x\\n>y] = N) \\ (\\N'. (R = NotL .N' x) \\ y=u \\ N'[x\\n>y] = N)\"\nusing a\napply(nominal_induct R avoiding: y u c x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(coname,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(coname,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_NotL_aux:\n assumes a: \"R[x\\n>y] = NotL .N u\" \n shows \"(x=u \\ x=y) \\ (x\\u)\" \nusing a\napply(nominal_induct R avoiding: y u c x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma nrename_AndL1:\n assumes a: \"R[x\\n>y] = AndL1 (z).N u\" \"z\\(R,x,y)\" \"u\\(x,y)\"\n shows \"\\N'. (R = AndL1 (z).N' u) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: z u x y N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name1,z)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_AndL1':\n assumes a: \"R[x\\n>y] = AndL1 (v).N u\" \"v\\(R,u,x,y)\" \"x\\y\" \n shows \"(\\N'. (R = AndL1 (v).N' u) \\ N'[x\\n>y] = N) \\ (\\N'. (R = AndL1 (v).N' x) \\ y=u \\ N'[x\\n>y] = N)\"\nusing a\napply(nominal_induct R avoiding: y u v x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(name1,v)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(name1,v)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_AndL1_aux:\n assumes a: \"R[x\\n>y] = AndL1 (v).N u\" \n shows \"(x=u \\ x=y) \\ (x\\u)\" \nusing a\napply(nominal_induct R avoiding: y u v x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma nrename_AndL2:\n assumes a: \"R[x\\n>y] = AndL2 (z).N u\" \"z\\(R,x,y)\" \"u\\(x,y)\"\n shows \"\\N'. (R = AndL2 (z).N' u) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: z u x y N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name1,z)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_AndL2':\n assumes a: \"R[x\\n>y] = AndL2 (v).N u\" \"v\\(R,u,x,y)\" \"x\\y\" \n shows \"(\\N'. (R = AndL2 (v).N' u) \\ N'[x\\n>y] = N) \\ (\\N'. (R = AndL2 (v).N' x) \\ y=u \\ N'[x\\n>y] = N)\"\nusing a\napply(nominal_induct R avoiding: y u v x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(name1,v)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(name1,v)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_AndL2_aux:\n assumes a: \"R[x\\n>y] = AndL2 (v).N u\" \n shows \"(x=u \\ x=y) \\ (x\\u)\" \nusing a\napply(nominal_induct R avoiding: y u v x N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma nrename_AndR:\n assumes a: \"R[x\\n>y] = AndR .M .N e\" \"c\\(d,e,N,R)\" \"d\\(c,e,M,R)\" \n shows \"\\M' N'. R = AndR .M' .N' e \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N \\ c\\N' \\ d\\M'\"\nusing a\napply(nominal_induct R avoiding: x y c d e M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha)\napply(simp add: fresh_atm fresh_prod)\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname1,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(coname2,d)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>y]\" in sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_OrR1:\n assumes a: \"R[x\\n>y] = OrR1 .N d\" \"c\\(R,d)\" \n shows \"\\N'. (R = OrR1 .N' d) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: x y c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_OrR2:\n assumes a: \"R[x\\n>y] = OrR2 .N d\" \"c\\(R,d)\" \n shows \"\\N'. (R = OrR2 .N' d) \\ N'[x\\n>y] = N\" \nusing a\napply(nominal_induct R avoiding: x y c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(coname1,c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_OrL:\n assumes a: \"R[u\\n>v] = OrL (x).M (y).N z\" \"x\\(y,z,u,v,N,R)\" \"y\\(x,z,u,v,M,R)\" \"z\\(u,v)\"\n shows \"\\M' N'. R = OrL (x).M' (y).N' z \\ M'[u\\n>v] = M \\ N'[u\\n>v] = N \\ x\\N' \\ y\\M'\"\nusing a\napply(nominal_induct R avoiding: u v x y z M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha fresh_prod fresh_atm)\napply(rule_tac x=\"[(name1,x)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name2,y)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[u\\n>v]\" in sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_OrL':\n assumes a: \"R[x\\n>y] = OrL (v).M (w).N u\" \"v\\(R,N,u,x,y)\" \"w\\(R,M,u,x,y)\" \"x\\y\" \n shows \"(\\M' N'. (R = OrL (v).M' (w).N' u) \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N) \\ \n (\\M' N'. (R = OrL (v).M' (w).N' x) \\ y=u \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N)\"\nusing a\napply(nominal_induct R avoiding: y x u v w M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(name1,v)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name2,w)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule conjI)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>u]\" in sym)\napply(drule_tac pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(name1,v)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name2,w)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule conjI)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>y]\" in sym)\napply(drule_tac pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_OrL_aux:\n assumes a: \"R[x\\n>y] = OrL (v).M (w).N u\" \n shows \"(x=u \\ x=y) \\ (x\\u)\" \nusing a\napply(nominal_induct R avoiding: y x w u v M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma nrename_ImpL:\n assumes a: \"R[x\\n>y] = ImpL .M (u).N z\" \"c\\(N,R)\" \"u\\(y,x,z,M,R)\" \"z\\(x,y)\"\n shows \"\\M' N'. R = ImpL .M' (u).N' z \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N \\ c\\N' \\ u\\M'\"\nusing a\napply(nominal_induct R avoiding: u x c y z M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: trm.inject alpha fresh_prod fresh_atm)\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(rule_tac x=\"[(name1,u)]\\trm2\" in exI)\napply(perm_simp)\napply(auto simp add: abs_fresh fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>y]\" in sym)\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm fresh_prod fresh_atm)\ndone\n\nlemma nrename_ImpL':\n assumes a: \"R[x\\n>y] = ImpL .M (w).N u\" \"c\\(R,N)\" \"w\\(R,M,u,x,y)\" \"x\\y\" \n shows \"(\\M' N'. (R = ImpL .M' (w).N' u) \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N) \\ \n (\\M' N'. (R = ImpL .M' (w).N' x) \\ y=u \\ M'[x\\n>y] = M \\ N'[x\\n>y] = N)\"\nusing a\napply(nominal_induct R avoiding: y x u c w M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_fresh alpha trm.inject)\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name1,w)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule conjI)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>u]\" in sym)\napply(drule_tac pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\napply(rule_tac x=\"[(coname,c)]\\trm1\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name1,w)]\\trm2\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule conjI)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(simp add: eqvts calc_atm)\napply(drule_tac s=\"trm2[x\\n>y]\" in sym)\napply(drule_tac pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_ImpL_aux:\n assumes a: \"R[x\\n>y] = ImpL .M (w).N u\" \n shows \"(x=u \\ x=y) \\ (x\\u)\" \nusing a\napply(nominal_induct R avoiding: y x w u c M N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm alpha abs_fresh trm.inject)\ndone\n\nlemma nrename_ImpR:\n assumes a: \"R[u\\n>v] = ImpR (x)..N d\" \"c\\(R,d)\" \"x\\(R,u,v)\" \n shows \"\\N'. (R = ImpR (x)..N' d) \\ N'[u\\n>v] = N\" \nusing a\napply(nominal_induct R avoiding: u v x c d N rule: trm.strong_induct)\napply(auto split: if_splits simp add: fresh_prod fresh_atm abs_perm alpha abs_fresh trm.inject)\napply(rule_tac x=\"[(name,x)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_fresh fresh_left calc_atm fresh_prod)\napply(rule_tac x=\"[(name,x)]\\[(coname1, c)]\\trm\" in exI)\napply(perm_simp)\napply(simp add: abs_supp fin_supp abs_fresh fresh_left calc_atm fresh_prod)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst,OF at_coname_inst])\napply(drule pt_bij1[OF pt_name_inst,OF at_name_inst])\napply(simp add: eqvts calc_atm)\ndone\n\nlemma nrename_credu:\n assumes a: \"(M[x\\n>y]) \\\\<^sub>c M'\"\n shows \"\\M0. M0[x\\n>y]=M' \\ M \\\\<^sub>c M0\"\nusing a\napply(nominal_induct M\\\"M[x\\n>y]\" M' avoiding: M x y rule: c_redu.strong_induct)\napply(drule sym)\napply(drule nrename_Cut)\napply(simp)\napply(simp)\napply(auto)\napply(rule_tac x=\"M'{a:=(x).N'}\" in exI)\napply(rule conjI)\napply(simp add: fresh_atm abs_fresh subst_comm fresh_prod)\napply(rule c_redu.intros)\napply(auto dest: not_fic_nrename)[1]\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(drule sym)\napply(drule nrename_Cut)\napply(simp)\napply(simp)\napply(auto)\napply(rule_tac x=\"N'{x:=.M'}\" in exI)\napply(rule conjI)\napply(simp add: fresh_atm abs_fresh subst_comm fresh_prod)\napply(rule c_redu.intros)\napply(auto)\napply(drule_tac x=\"xa\" and y=\"y\" in fin_nrename)\napply(auto simp add: fresh_prod abs_fresh)\ndone\n\nlemma nrename_ax2:\n assumes a: \"N[x\\n>y] = Ax z c\"\n shows \"\\z. N = Ax z c\"\nusing a\napply(nominal_induct N avoiding: x y rule: trm.strong_induct)\napply(auto split: if_splits)\napply(simp add: trm.inject)\ndone\n\nlemma fic_nrename:\n assumes a: \"fic (M[x\\n>y]) c\" \n shows \"fic M c\" \nusing a\napply(nominal_induct M avoiding: c x y rule: trm.strong_induct)\napply(auto dest!: fic_elims intro!: fic.intros simp add: fresh_prod fresh_atm rename_fresh abs_fresh\n split: if_splits)\napply(auto dest: nrename_fresh_interesting2 simp add: fresh_prod fresh_atm)\ndone\n\nlemma nrename_lredu:\n assumes a: \"(M[x\\n>y]) \\\\<^sub>l M'\"\n shows \"\\M0. M0[x\\n>y]=M' \\ M \\\\<^sub>l M0\"\nusing a\napply(nominal_induct M\\\"M[x\\n>y]\" M' avoiding: M x y rule: l_redu.strong_induct)\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(case_tac \"xa=y\")\napply(simp add: nrename_id)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(assumption)\napply(frule nrename_ax2)\napply(auto)[1]\napply(case_tac \"z=xa\")\napply(simp add: trm.inject)\napply(simp)\napply(rule_tac x=\"M'[a\\c>b]\" in exI)\napply(rule conjI)\napply(rule crename_interesting3)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fic_nrename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_prod fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(case_tac \"xa=ya\")\napply(simp add: nrename_id)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(assumption)\napply(frule nrename_ax2)\napply(auto)[1]\napply(case_tac \"z=xa\")\napply(simp add: trm.inject)\napply(rule_tac x=\"N'[x\\n>xa]\" in exI)\napply(rule conjI)\napply(rule nrename_interesting1)\napply(auto)[1]\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fin_nrename2 simp add: fresh_prod fresh_atm)[1]\napply(simp add: trm.inject)\napply(rule_tac x=\"N'[x\\n>y]\" in exI)\napply(rule conjI)\napply(rule nrename_interesting2)\napply(simp_all)\napply(rule l_redu.intros)\napply(simp)\napply(simp add: fresh_atm)\napply(auto dest: fin_nrename2 simp add: fresh_prod fresh_atm)[1]\n(* LNot *)\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_NotR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_NotL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N'b (x).N'a\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_prod fresh_atm intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting2)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LAnd1 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule nrename_AndR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_AndL1)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .M'a (x).N'b\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\n(* LAnd2 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule nrename_AndR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_AndL2)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N'a (x).N'b\" in exI)\napply(simp add: fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\n(* LOr1 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule nrename_OrL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_OrR1)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N' (x1).M'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* LOr2 *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto)[1]\napply(drule nrename_OrL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_OrR2)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .N' (x2).N'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm fresh_prod intro: nrename_fresh_interesting1)[1]\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\n(* ImpL *)\napply(auto dest: fin_crename simp add: fresh_prod fresh_atm)[1]\napply(drule sym) \napply(drule nrename_Cut)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm abs_supp fin_supp)\napply(auto)[1]\napply(drule nrename_ImpL)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(drule nrename_ImpR)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(simp add: fresh_prod abs_fresh fresh_atm)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)[1]\napply(rule_tac x=\"Cut .(Cut .M'a (x).N') (y).N'a\" in exI)\napply(rule conjI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule l_redu.intros)\napply(auto simp add: fresh_atm abs_fresh abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting1)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting2)[1]\napply(auto simp add: abs_fresh fresh_atm abs_supp fin_supp fresh_prod intro: nrename_fresh_interesting2)[1]\ndone\n\nlemma nrename_aredu:\n assumes a: \"(M[x\\n>y]) \\\\<^sub>a M'\" \"x\\y\"\n shows \"\\M0. M0[x\\n>y]=M' \\ M \\\\<^sub>a M0\"\nusing a\napply(nominal_induct \"M[x\\n>y]\" M' avoiding: M x y rule: a_redu.strong_induct)\napply(drule nrename_lredu)\napply(blast)\napply(drule nrename_credu)\napply(blast)\n(* Cut *)\napply(drule sym)\napply(drule nrename_Cut)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"Cut .M0 (x).N'\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule conjI)\napply(rule trans)\napply(rule nrename.simps)\napply(drule nrename_fresh_interesting2)\napply(simp add: fresh_a_redu)\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule nrename_fresh_interesting1)\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_a_redu)\napply(simp)\napply(auto)[1]\napply(drule sym)\napply(drule nrename_Cut)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"Cut .M' (x).M0\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(rule conjI)\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: fresh_a_redu)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(simp)\napply(auto)[1]\n(* NotL *)\napply(drule sym)\napply(frule nrename_NotL_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_NotL')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotL .M0 x\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotL .M0 xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* NotR *)\napply(drule sym)\napply(drule nrename_NotR)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"NotR (x).M0 a\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* AndR *)\napply(drule sym)\napply(drule nrename_AndR)\napply(simp)\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M0 .N' c\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\napply(drule sym)\napply(drule nrename_AndR)\napply(simp)\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto simp add: fresh_atm fresh_prod)[1]\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndR .M' .M0 c\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\napply(simp)\n(* AndL1 *)\napply(drule sym)\napply(frule nrename_AndL1_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_AndL1')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL1 (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL1 (x).M0 xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* AndL2 *)\napply(drule sym)\napply(frule nrename_AndL2_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_AndL2')\napply(simp)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL2 (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"AndL2 (x).M0 xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* OrL *)\napply(drule sym)\napply(frule nrename_OrL_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_OrL')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M0 (y).N' z\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M0 (y).N' xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule sym)\napply(frule nrename_OrL_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_OrL')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M' (y).M0 z\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrL (x).M' (y).M0 xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm fresh_prod)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp)\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\n(* OrR1 *)\napply(drule sym)\napply(drule nrename_OrR1)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR1 .M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* OrR2 *)\napply(drule sym)\napply(drule nrename_OrR2)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"OrR2 .M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\n(* ImpL *)\napply(drule sym)\napply(frule nrename_ImpL_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_ImpL')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M0 (x).N' y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M0 (x).N' xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(drule sym)\napply(frule nrename_ImpL_aux)\napply(erule disjE)\napply(auto)[1]\napply(drule nrename_ImpL')\napply(simp add: fresh_prod fresh_atm)\napply(simp add: fresh_atm)\napply(simp add: fresh_atm)\napply(erule disjE)\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"ya\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M' (x).M0 y\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(drule_tac x=\"N'a\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpL .M' (x).M0 xa\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\napply(rule trans)\napply(rule nrename.simps)\napply(auto intro: fresh_a_redu)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(simp add: fresh_prod abs_fresh abs_supp fin_supp fresh_atm)[1]\n(* ImpR *)\napply(drule sym)\napply(drule nrename_ImpR)\napply(simp)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(auto)[1]\napply(rule_tac x=\"ImpR (x)..M0 b\" in exI)\napply(simp add: abs_fresh abs_supp fin_supp fresh_atm)[1]\napply(auto)[1]\ndone\n\nlemma SNa_preserved_renaming2:\n assumes a: \"SNa N\"\n shows \"SNa (N[x\\n>y])\"\nusing a\napply(induct rule: SNa_induct)\napply(case_tac \"x=y\")\napply(simp add: nrename_id)\napply(rule SNaI)\napply(drule nrename_aredu)\napply(blast)+\ndone\n\ntext \\helper-stuff to set up the induction\\\n\nabbreviation\n SNa_set :: \"trm set\"\nwhere\n \"SNa_set \\ {M. SNa M}\"\n\nabbreviation\n A_Redu_set :: \"(trm\\trm) set\"\nwhere\n \"A_Redu_set \\ {(N,M)| M N. M \\\\<^sub>a N}\"\n\nlemma SNa_elim:\n assumes a: \"SNa M\"\n shows \"(\\M. (\\N. M \\\\<^sub>a N \\ P N)\\ P M) \\ P M\"\nusing a\nby (induct rule: SNa.induct) (blast)\n\nlemma wf_SNa_restricted:\n shows \"wf (A_Redu_set \\ (UNIV \\ SNa_set))\"\napply(unfold wf_def)\napply(intro strip)\napply(case_tac \"SNa x\")\napply(simp (no_asm_use))\napply(drule_tac P=\"P\" in SNa_elim)\napply(erule mp)\napply(blast)\n(* other case *)\napply(drule_tac x=\"x\" in spec)\napply(erule mp)\napply(fast)\ndone\n\ndefinition SNa_Redu :: \"(trm \\ trm) set\" where\n \"SNa_Redu \\ A_Redu_set \\ (UNIV \\ SNa_set)\"\n\nlemma wf_SNa_Redu:\n shows \"wf SNa_Redu\"\napply(unfold SNa_Redu_def)\napply(rule wf_SNa_restricted)\ndone\n\nlemma wf_measure_triple:\nshows \"wf ((measure size) <*lex*> SNa_Redu <*lex*> SNa_Redu)\"\nby (auto intro: wf_SNa_Redu)\n\nlemma my_wf_induct_triple: \n assumes a: \" wf(r1 <*lex*> r2 <*lex*> r3)\" \n and b: \"\\x. \\\\y. ((fst y,fst (snd y),snd (snd y)),(fst x,fst (snd x), snd (snd x))) \n \\ (r1 <*lex*> r2 <*lex*> r3) \\ P y\\ \\ P x\" \n shows \"P x\"\nusing a\napply(induct x rule: wf_induct_rule)\napply(rule b)\napply(simp)\ndone\n\nlemma my_wf_induct_triple': \n assumes a: \" wf(r1 <*lex*> r2 <*lex*> r3)\" \n and b: \"\\x1 x2 x3. \\\\y1 y2 y3. ((y1,y2,y3),(x1,x2,x3)) \\ (r1 <*lex*> r2 <*lex*> r3) \\ P (y1,y2,y3)\\ \n \\ P (x1,x2,x3)\" \n shows \"P (x1,x2,x3)\"\napply(rule_tac my_wf_induct_triple[OF a])\napply(case_tac x rule: prod.exhaust)\napply(simp)\napply(rename_tac p a b)\napply(case_tac b)\napply(simp)\napply(rule b)\napply(blast)\ndone\n\nlemma my_wf_induct_triple'': \n assumes a: \" wf(r1 <*lex*> r2 <*lex*> r3)\" \n and b: \"\\x1 x2 x3. \\\\y1 y2 y3. ((y1,y2,y3),(x1,x2,x3)) \\ (r1 <*lex*> r2 <*lex*> r3) \\ P y1 y2 y3\\\n \\ P x1 x2 x3\" \n shows \"P x1 x2 x3\"\napply(rule_tac my_wf_induct_triple'[where P=\"\\(x1,x2,x3). P x1 x2 x3\", simplified])\napply(rule a)\napply(rule b)\napply(auto)\ndone\n\nlemma excluded_m:\n assumes a: \":M \\ (\\\\)\" \"(x):N \\ (\\(B)\\)\"\n shows \"(:M \\ BINDINGc B (\\(B)\\) \\ (x):N \\ BINDINGn B (\\\\))\n \\\\(:M \\ BINDINGc B (\\(B)\\) \\ (x):N \\ BINDINGn B (\\\\))\"\nby (blast)\n\nlemma tricky_subst:\n assumes a1: \"b\\(c,N)\"\n and a2: \"z\\(x,P)\"\n and a3: \"M\\Ax z b\"\n shows \"(Cut .N (z).M){b:=(x).P} = Cut .N (z).(M{b:=(x).P})\"\nusing a1 a2 a3\napply -\napply(generate_fresh \"coname\")\napply(subgoal_tac \"Cut .N (z).M = Cut .([(ca,c)]\\N) (z).M\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh)\napply(simp)\napply(subgoal_tac \"b\\([(ca,c)]\\N)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: trm.inject)\napply(rule sym)\napply(simp add: alpha fresh_prod fresh_atm)\ndone\n\ntext \\3rd lemma\\\n\nlemma CUT_SNa_aux:\n assumes a1: \":M \\ (\\\\)\"\n and a2: \"SNa M\"\n and a3: \"(x):N \\ (\\(B)\\)\"\n and a4: \"SNa N\"\n shows \"SNa (Cut .M (x).N)\"\nusing a1 a2 a3 a4\napply(induct B M N arbitrary: a x rule: my_wf_induct_triple''[OF wf_measure_triple])\napply(rule SNaI)\napply(drule Cut_a_redu_elim)\napply(erule disjE)\n(* left-inner reduction *)\napply(erule exE)\napply(erule conjE)+\napply(simp)\napply(drule_tac x=\"x1\" in meta_spec)\napply(drule_tac x=\"M'a\" in meta_spec)\napply(drule_tac x=\"x3\" in meta_spec)\napply(drule conjunct2)\napply(drule mp)\napply(rule conjI)\napply(simp)\napply(rule disjI1)\napply(simp add: SNa_Redu_def)\napply(drule_tac x=\"a\" in spec)\napply(drule mp)\napply(simp add: CANDs_preserved_single)\napply(drule mp)\napply(simp add: a_preserves_SNa)\napply(drule_tac x=\"x\" in spec)\napply(simp)\napply(erule disjE)\n(* right-inner reduction *)\napply(erule exE)\napply(erule conjE)+\napply(simp)\napply(drule_tac x=\"x1\" in meta_spec)\napply(drule_tac x=\"x2\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule conjunct2)\napply(drule mp)\napply(rule conjI)\napply(simp)\napply(rule disjI2)\napply(simp add: SNa_Redu_def)\napply(drule_tac x=\"a\" in spec)\napply(drule mp)\napply(simp add: CANDs_preserved_single)\napply(drule mp)\napply(assumption)\napply(drule_tac x=\"x\" in spec)\napply(drule mp)\napply(simp add: CANDs_preserved_single)\napply(drule mp)\napply(simp add: a_preserves_SNa)\napply(assumption)\napply(erule disjE)\n(******** c-reduction *********)\napply(drule Cut_c_redu_elim)\n(* c-left reduction*)\napply(erule disjE)\napply(erule conjE)\napply(frule_tac B=\"x1\" in fic_CANDS)\napply(simp)\napply(erule disjE)\n(* in AXIOMSc *)\napply(simp add: AXIOMSc_def)\napply(erule exE)+\napply(simp add: ctrm.inject)\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(rule impI)\napply(simp)\napply(subgoal_tac \"fic (Ax y b) b\")(*A*)\napply(simp)\n(*A*)\napply(auto)[1]\napply(simp)\napply(rule impI)\napply(simp)\napply(subgoal_tac \"fic (Ax ([(a,aa)]\\y) a) a\")(*B*)\napply(simp)\n(*B*)\napply(auto)[1]\n(* in BINDINGc *)\napply(simp)\napply(drule BINDINGc_elim)\napply(simp)\n(* c-right reduction*)\napply(erule conjE)\napply(frule_tac B=\"x1\" in fin_CANDS)\napply(simp)\napply(erule disjE)\n(* in AXIOMSc *)\napply(simp add: AXIOMSn_def)\napply(erule exE)+\napply(simp add: ntrm.inject)\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(rule impI)\napply(simp)\napply(subgoal_tac \"fin (Ax xa b) xa\")(*A*)\napply(simp)\n(*A*)\napply(auto)[1]\napply(simp)\napply(rule impI)\napply(simp)\napply(subgoal_tac \"fin (Ax x ([(x,xa)]\\b)) x\")(*B*)\napply(simp)\n(*B*)\napply(auto)[1]\n(* in BINDINGc *)\napply(simp)\napply(drule BINDINGn_elim)\napply(simp)\n(*********** l-reductions ************)\napply(drule Cut_l_redu_elim)\napply(erule disjE)\n(* ax1 *)\napply(erule exE)\napply(simp)\napply(simp add: SNa_preserved_renaming1)\napply(erule disjE)\n(* ax2 *)\napply(erule exE)\napply(simp add: SNa_preserved_renaming2)\napply(erule disjE)\n(* LNot *)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"NotL .N' x\" in spec)\napply(simp)\napply(simp add: better_NotR_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .NotR (y).M'a a' (x).NotL .N' x) \n = Cut .NotR (y).M'a c (x).NotL .N' x\")\napply(simp)\napply(subgoal_tac \"Cut .NotR (y).M'a c (x).NotL .N' x \\\\<^sub>a Cut .N' (y).M'a\")\napply(simp only: a_preserves_SNa)\napply(rule al_redu)\napply(rule better_LNot_intro)\napply(simp)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"NotR (y).M'a a\" in spec)\napply(simp)\napply(simp add: better_NotL_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\x'. Cut .NotR (y).M'a a (x').NotL .N' x') \n = Cut .NotR (y).M'a a (c).NotL .N' c\")\napply(simp)\napply(subgoal_tac \"Cut .NotR (y).M'a a (c).NotL .N' c \\\\<^sub>a Cut .N' (y).M'a\")\napply(simp only: a_preserves_SNa)\napply(rule al_redu)\napply(rule better_LNot_intro)\napply(simp)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* none of them in BINDING *)\napply(simp)\napply(erule conjE)\napply(frule CAND_NotR_elim)\napply(assumption)\napply(erule exE)\napply(frule CAND_NotL_elim)\napply(assumption)\napply(erule exE)\napply(simp only: ty.inject)\napply(drule_tac x=\"B'\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"M'a\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(drule_tac x=\"b\" in spec)\napply(rotate_tac 13)\napply(drule mp)\napply(assumption)\napply(rotate_tac 13)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(drule_tac x=\"y\" in spec)\napply(rotate_tac 13)\napply(drule mp)\napply(assumption)\napply(rotate_tac 13)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* LAnd1 case *)\napply(erule disjE)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"AndL1 (y).N' x\" in spec)\napply(simp)\napply(simp add: better_AndR_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .AndR .M1 .M2 a' (x).AndL1 (y).N' x) \n = Cut .AndR .M1 .M2 ca (x).AndL1 (y).N' x\")\napply(simp)\napply(subgoal_tac \"Cut .AndR .M1 .M2 ca (x).AndL1 (y).N' x \\\\<^sub>a Cut .M1 (y).N'\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LAnd1_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"AndR .M1 .M2 a\" in spec)\napply(simp)\napply(simp add: better_AndL1_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\z'. Cut .AndR .M1 .M2 a (z').AndL1 (y).N' z') \n = Cut .AndR .M1 .M2 a (ca).AndL1 (y).N' ca\")\napply(simp)\napply(subgoal_tac \"Cut .AndR .M1 .M2 a (ca).AndL1 (y).N' ca \\\\<^sub>a Cut .M1 (y).N'\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LAnd1_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm) \napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* none of them in BINDING *)\napply(simp)\napply(erule conjE)\napply(frule CAND_AndR_elim)\napply(assumption)\napply(erule exE)\napply(frule CAND_AndL1_elim)\napply(assumption)\napply(erule exE)+\napply(simp only: ty.inject)\napply(drule_tac x=\"B1\" in meta_spec)\napply(drule_tac x=\"M1\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(drule_tac x=\"b\" in spec)\napply(rotate_tac 14)\napply(drule mp)\napply(assumption)\napply(rotate_tac 14)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(drule_tac x=\"y\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* LAnd2 case *)\napply(erule disjE)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"AndL2 (y).N' x\" in spec)\napply(simp)\napply(simp add: better_AndR_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .AndR .M1 .M2 a' (x).AndL2 (y).N' x) \n = Cut .AndR .M1 .M2 ca (x).AndL2 (y).N' x\")\napply(simp)\napply(subgoal_tac \"Cut .AndR .M1 .M2 ca (x).AndL2 (y).N' x \\\\<^sub>a Cut .M2 (y).N'\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LAnd2_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"AndR .M1 .M2 a\" in spec)\napply(simp)\napply(simp add: better_AndL2_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\z'. Cut .AndR .M1 .M2 a (z').AndL2 (y).N' z') \n = Cut .AndR .M1 .M2 a (ca).AndL2 (y).N' ca\")\napply(simp)\napply(subgoal_tac \"Cut .AndR .M1 .M2 a (ca).AndL2 (y).N' ca \\\\<^sub>a Cut .M2 (y).N'\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LAnd2_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm) \napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* none of them in BINDING *)\napply(simp)\napply(erule conjE)\napply(frule CAND_AndR_elim)\napply(assumption)\napply(erule exE)\napply(frule CAND_AndL2_elim)\napply(assumption)\napply(erule exE)+\napply(simp only: ty.inject)\napply(drule_tac x=\"B2\" in meta_spec)\napply(drule_tac x=\"M2\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(drule_tac x=\"c\" in spec)\napply(rotate_tac 14)\napply(drule mp)\napply(assumption)\napply(rotate_tac 14)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(drule_tac x=\"y\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* LOr1 case *)\napply(erule disjE)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"OrL (z).M1 (y).M2 x\" in spec)\napply(simp)\napply(simp add: better_OrR1_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .OrR1 .N' a' (x).OrL (z).M1 (y).M2 x) \n = Cut .OrR1 .N' c (x).OrL (z).M1 (y).M2 x\")\napply(simp)\napply(subgoal_tac \"Cut .OrR1 .N' c (x).OrL (z).M1 (y).M2 x \\\\<^sub>a Cut .N' (z).M1\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LOr1_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp add: abs_fresh)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"OrR1 .N' a\" in spec)\napply(simp)\napply(simp add: better_OrL_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\z'. Cut .OrR1 .N' a (z').OrL (z).M1 (y).M2 z') \n = Cut .OrR1 .N' a (c).OrL (z).M1 (y).M2 c\")\napply(simp)\napply(subgoal_tac \"Cut .OrR1 .N' a (c).OrL (z).M1 (y).M2 c \\\\<^sub>a Cut .N' (z).M1\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LOr1_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm) \napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* none of them in BINDING *)\napply(simp)\napply(erule conjE)\napply(frule CAND_OrR1_elim)\napply(assumption)\napply(erule exE)+\napply(frule CAND_OrL_elim)\napply(assumption)\napply(erule exE)+\napply(simp only: ty.inject)\napply(drule_tac x=\"B1\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"M1\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(drule_tac x=\"b\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(drule_tac x=\"z\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* LOr2 case *)\napply(erule disjE)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"OrL (z).M1 (y).M2 x\" in spec)\napply(simp)\napply(simp add: better_OrR2_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .OrR2 .N' a' (x).OrL (z).M1 (y).M2 x) \n = Cut .OrR2 .N' c (x).OrL (z).M1 (y).M2 x\")\napply(simp)\napply(subgoal_tac \"Cut .OrR2 .N' c (x).OrL (z).M1 (y).M2 x \\\\<^sub>a Cut .N' (y).M2\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LOr2_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp add: abs_fresh)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"OrR2 .N' a\" in spec)\napply(simp)\napply(simp add: better_OrL_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\z'. Cut .OrR2 .N' a (z').OrL (z).M1 (y).M2 z') \n = Cut .OrR2 .N' a (c).OrL (z).M1 (y).M2 c\")\napply(simp)\napply(subgoal_tac \"Cut .OrR2 .N' a (c).OrL (z).M1 (y).M2 c \\\\<^sub>a Cut .N' (y).M2\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LOr2_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm) \napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* none of them in BINDING *)\napply(simp)\napply(erule conjE)\napply(frule CAND_OrR2_elim)\napply(assumption)\napply(erule exE)+\napply(frule CAND_OrL_elim)\napply(assumption)\napply(erule exE)+\napply(simp only: ty.inject)\napply(drule_tac x=\"B2\" in meta_spec)\napply(drule_tac x=\"N'\" in meta_spec)\napply(drule_tac x=\"M2\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(drule_tac x=\"b\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(drule_tac x=\"y\" in spec)\napply(rotate_tac 15)\napply(drule mp)\napply(assumption)\napply(rotate_tac 15)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* LImp case *)\napply(erule exE)+\napply(auto)[1]\napply(frule_tac excluded_m)\napply(assumption)\napply(erule disjE)\n(* one of them in BINDING *)\napply(erule disjE)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGc_elim)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"ImpL .N1 (y).N2 x\" in spec)\napply(simp)\napply(simp add: better_ImpR_substc)\napply(generate_fresh \"coname\")\napply(subgoal_tac \"fresh_fun (\\a'. Cut .ImpR (z)..M'a a' (x).ImpL .N1 (y).N2 x)\n = Cut .ImpR (z)..M'a ca (x).ImpL .N1 (y).N2 x\")\napply(simp)\napply(subgoal_tac \"Cut .ImpR (z)..M'a ca (x).ImpL .N1 (y).N2 x \\\\<^sub>a \n Cut .Cut .N1 (z).M'a (y).N2\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LImp_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp add: abs_fresh)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp)\n(* other case of in BINDING *)\napply(drule fin_elims)\napply(drule fic_elims)\napply(simp)\napply(drule BINDINGn_elim)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"ImpR (z)..M'a a\" in spec)\napply(simp)\napply(simp add: better_ImpL_substn)\napply(generate_fresh \"name\")\napply(subgoal_tac \"fresh_fun (\\z'. Cut .ImpR (z)..M'a a (z').ImpL .N1 (y).N2 z')\n = Cut .ImpR (z)..M'a a (ca).ImpL .N1 (y).N2 ca\")\napply(simp)\napply(subgoal_tac \"Cut .ImpR (z)..M'a a (ca).ImpL .N1 (y).N2 ca \\\\<^sub>a \n Cut .Cut .N1 (z).M'a (y).N2\")\napply(auto intro: a_preserves_SNa)[1]\napply(rule al_redu)\napply(rule better_LImp_intro)\napply(simp add: abs_fresh fresh_prod fresh_atm) \napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(simp)\napply(fresh_fun_simp (no_asm))\napply(simp add: abs_fresh abs_supp fin_supp)\napply(simp add: abs_fresh abs_supp fin_supp)\napply(simp)\n(* none of them in BINDING *)\napply(erule conjE)\napply(frule CAND_ImpL_elim)\napply(assumption)\napply(erule exE)+\napply(frule CAND_ImpR_elim) (* check here *)\napply(assumption)\napply(erule exE)+\napply(erule conjE)+\napply(simp only: ty.inject)\napply(erule conjE)+\napply(case_tac \"M'a=Ax z b\")\n(* case Ma = Ax z b *)\napply(rule_tac t=\"Cut .(Cut .N1 (z).M'a) (y).N2\" and s=\"Cut .(M'a{z:=.N1}) (y).N2\" in subst)\napply(simp)\napply(drule_tac x=\"c\" in spec)\napply(drule_tac x=\"N1\" in spec)\napply(drule mp)\napply(simp)\napply(drule_tac x=\"B2\" in meta_spec)\napply(drule_tac x=\"M'a{z:=.N1}\" in meta_spec)\napply(drule_tac x=\"N2\" in meta_spec)\napply(drule conjunct1)\napply(drule mp)\napply(simp)\napply(rotate_tac 17)\napply(drule_tac x=\"b\" in spec)\napply(drule mp)\napply(assumption)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(rotate_tac 17)\napply(drule_tac x=\"y\" in spec)\napply(drule mp)\napply(assumption)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* case Ma \\ Ax z b *)\napply(subgoal_tac \":Cut .N1 (z).M'a \\ \\\\\") (* lemma *)\napply(frule_tac meta_spec)\napply(drule_tac x=\"B2\" in meta_spec)\napply(drule_tac x=\"Cut .N1 (z).M'a\" in meta_spec)\napply(drule_tac x=\"N2\" in meta_spec)\napply(erule conjE)+\napply(drule mp)\napply(simp)\napply(rotate_tac 20)\napply(drule_tac x=\"b\" in spec)\napply(rotate_tac 20)\napply(drule mp)\napply(assumption)\napply(rotate_tac 20)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(rotate_tac 20)\napply(drule_tac x=\"y\" in spec)\napply(rotate_tac 20)\napply(drule mp)\napply(assumption)\napply(rotate_tac 20)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(* lemma *)\napply(subgoal_tac \":Cut .N1 (z).M'a \\ BINDINGc B2 (\\(B2)\\)\") (* second lemma *)\napply(simp add: BINDING_implies_CAND)\n(* second lemma *)\napply(simp (no_asm) add: BINDINGc_def)\napply(rule exI)+\napply(rule conjI)\napply(rule refl)\napply(rule allI)+\napply(rule impI)\napply(generate_fresh \"name\")\napply(rule_tac t=\"Cut .N1 (z).M'a\" and s=\"Cut .N1 (ca).([(ca,z)]\\M'a)\" in subst)\napply(simp add: trm.inject alpha fresh_prod fresh_atm)\napply(rule_tac t=\"(Cut .N1 (ca).([(ca,z)]\\M'a)){b:=(xa).P}\" \n and s=\"Cut .N1 (ca).(([(ca,z)]\\M'a){b:=(xa).P})\" in subst)\napply(rule sym)\napply(rule tricky_subst)\napply(simp)\napply(simp)\napply(clarify)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm)\napply(drule_tac x=\"B1\" in meta_spec)\napply(drule_tac x=\"N1\" in meta_spec)\napply(drule_tac x=\"([(ca,z)]\\M'a){b:=(xa).P}\" in meta_spec)\napply(drule conjunct1)\napply(drule mp)\napply(simp)\napply(rotate_tac 19)\napply(drule_tac x=\"c\" in spec)\napply(drule mp)\napply(assumption)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(rotate_tac 19)\napply(drule_tac x=\"ca\" in spec)\napply(subgoal_tac \"(ca):([(ca,z)]\\M'a){b:=(xa).P} \\ \\(B1)\\\")(*A*)\napply(drule mp)\napply(assumption)\napply(drule mp)\napply(simp add: CANDs_imply_SNa)\napply(assumption)\n(*A*)\napply(drule_tac x=\"[(ca,z)]\\xa\" in spec)\napply(drule_tac x=\"[(ca,z)]\\P\" in spec)\napply(rotate_tac 19)\napply(simp add: fresh_prod fresh_left)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm)[1]\napply(rule conjI)\napply(auto simp add: calc_atm)[1]\napply(drule_tac pi=\"[(ca,z)]\" and x=\"(xa):P\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name)\napply(drule_tac pi=\"[(ca,z)]\" and X=\"\\(B1)\\\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name csubst_eqvt)\napply(perm_simp)\ndone\n\n\n(* parallel substitution *)\n\n\nlemma CUT_SNa:\n assumes a1: \":M \\ (\\\\)\"\n and a2: \"(x):N \\ (\\(B)\\)\"\n shows \"SNa (Cut .M (x).N)\"\nusing a1 a2\napply -\napply(rule CUT_SNa_aux[OF a1])\napply(simp_all add: CANDs_imply_SNa)\ndone \n\n\nfun \n findn :: \"(name\\coname\\trm) list\\name\\(coname\\trm) option\"\nwhere\n \"findn [] x = None\"\n| \"findn ((y,c,P)#\\_n) x = (if y=x then Some (c,P) else findn \\_n x)\"\n\nlemma findn_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\findn \\_n x) = findn (pi1\\\\_n) (pi1\\x)\" \n and \"(pi2\\findn \\_n x) = findn (pi2\\\\_n) (pi2\\x)\"\napply(induct \\_n)\napply(auto simp add: perm_bij) \ndone\n\nlemma findn_fresh:\n assumes a: \"x\\\\_n\"\n shows \"findn \\_n x = None\"\nusing a\napply(induct \\_n)\napply(auto simp add: fresh_list_cons fresh_atm fresh_prod)\ndone\n\nfun \n findc :: \"(coname\\name\\trm) list\\coname\\(name\\trm) option\"\nwhere\n \"findc [] x = None\"\n| \"findc ((c,y,P)#\\_c) a = (if a=c then Some (y,P) else findc \\_c a)\"\n\nlemma findc_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\findc \\_c a) = findc (pi1\\\\_c) (pi1\\a)\" \n and \"(pi2\\findc \\_c a) = findc (pi2\\\\_c) (pi2\\a)\"\napply(induct \\_c)\napply(auto simp add: perm_bij) \ndone\n\nlemma findc_fresh:\n assumes a: \"a\\\\_c\"\n shows \"findc \\_c a = None\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_atm fresh_prod)\ndone\n\nabbreviation \n nmaps :: \"(name\\coname\\trm) list \\ name \\ (coname\\trm) option \\ bool\" (\"_ nmaps _ to _\" [55,55,55] 55) \nwhere\n \"\\_n nmaps x to P \\ (findn \\_n x) = P\"\n\nabbreviation \n cmaps :: \"(coname\\name\\trm) list \\ coname \\ (name\\trm) option \\ bool\" (\"_ cmaps _ to _\" [55,55,55] 55) \nwhere\n \"\\_c cmaps a to P \\ (findc \\_c a) = P\"\n\nlemma nmaps_fresh:\n shows \"\\_n nmaps x to Some (c,P) \\ a\\\\_n \\ a\\(c,P)\"\napply(induct \\_n)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\napply(case_tac \"aa=x\")\napply(auto)\napply(case_tac \"aa=x\")\napply(auto)\ndone\n\nlemma cmaps_fresh:\n shows \"\\_c cmaps a to Some (y,P) \\ x\\\\_c \\ x\\(y,P)\"\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\napply(case_tac \"a=aa\")\napply(auto)\napply(case_tac \"a=aa\")\napply(auto)\ndone\n\nlemma nmaps_false:\n shows \"\\_n nmaps x to Some (c,P) \\ x\\\\_n \\ False\"\napply(induct \\_n)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma cmaps_false:\n shows \"\\_c cmaps c to Some (x,P) \\ c\\\\_c \\ False\"\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nfun \n lookupa :: \"name\\coname\\(coname\\name\\trm) list\\trm\"\nwhere\n \"lookupa x a [] = Ax x a\"\n| \"lookupa x a ((c,y,P)#\\_c) = (if a=c then Cut .Ax x a (y).P else lookupa x a \\_c)\"\n\nlemma lookupa_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(lookupa x a \\_c)) = lookupa (pi1\\x) (pi1\\a) (pi1\\\\_c)\"\n and \"(pi2\\(lookupa x a \\_c)) = lookupa (pi2\\x) (pi2\\a) (pi2\\\\_c)\"\napply -\napply(induct \\_c)\napply(auto simp add: eqvts)\napply(induct \\_c)\napply(auto simp add: eqvts)\ndone\n\nlemma lookupa_fire:\n assumes a: \"\\_c cmaps a to Some (y,P)\"\n shows \"(lookupa x a \\_c) = Cut .Ax x a (y).P\"\nusing a\napply(induct \\_c arbitrary: x a y P)\napply(auto)\ndone\n\nfun \n lookupb :: \"name\\coname\\(coname\\name\\trm) list\\coname\\trm\\trm\"\nwhere\n \"lookupb x a [] c P = Cut .P (x).Ax x a\"\n| \"lookupb x a ((d,y,N)#\\_c) c P = (if a=d then Cut .P (y).N else lookupb x a \\_c c P)\"\n\nlemma lookupb_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(lookupb x a \\_c c P)) = lookupb (pi1\\x) (pi1\\a) (pi1\\\\_c) (pi1\\c) (pi1\\P)\"\n and \"(pi2\\(lookupb x a \\_c c P)) = lookupb (pi2\\x) (pi2\\a) (pi2\\\\_c) (pi2\\c) (pi2\\P)\"\napply -\napply(induct \\_c)\napply(auto simp add: eqvts)\napply(induct \\_c)\napply(auto simp add: eqvts)\ndone\n\nfun \n lookup :: \"name\\coname\\(name\\coname\\trm) list\\(coname\\name\\trm) list\\trm\"\nwhere\n \"lookup x a [] \\_c = lookupa x a \\_c\"\n| \"lookup x a ((y,c,P)#\\_n) \\_c = (if x=y then (lookupb x a \\_c c P) else lookup x a \\_n \\_c)\"\n\nlemma lookup_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(lookup x a \\_n \\_c)) = lookup (pi1\\x) (pi1\\a) (pi1\\\\_n) (pi1\\\\_c)\"\n and \"(pi2\\(lookup x a \\_n \\_c)) = lookup (pi2\\x) (pi2\\a) (pi2\\\\_n) (pi2\\\\_c)\"\napply -\napply(induct \\_n)\napply(auto simp add: eqvts)\napply(induct \\_n)\napply(auto simp add: eqvts)\ndone\n\nfun \n lookupc :: \"name\\coname\\(name\\coname\\trm) list\\trm\"\nwhere\n \"lookupc x a [] = Ax x a\"\n| \"lookupc x a ((y,c,P)#\\_n) = (if x=y then P[c\\c>a] else lookupc x a \\_n)\"\n\nlemma lookupc_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(lookupc x a \\_n)) = lookupc (pi1\\x) (pi1\\a) (pi1\\\\_n)\"\n and \"(pi2\\(lookupc x a \\_n)) = lookupc (pi2\\x) (pi2\\a) (pi2\\\\_n)\"\napply -\napply(induct \\_n)\napply(auto simp add: eqvts)\napply(induct \\_n)\napply(auto simp add: eqvts)\ndone\n\nfun \n lookupd :: \"name\\coname\\(coname\\name\\trm) list\\trm\"\nwhere\n \"lookupd x a [] = Ax x a\"\n| \"lookupd x a ((c,y,P)#\\_c) = (if a=c then P[y\\n>x] else lookupd x a \\_c)\"\n\nlemma lookupd_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(lookupd x a \\_n)) = lookupd (pi1\\x) (pi1\\a) (pi1\\\\_n)\"\n and \"(pi2\\(lookupd x a \\_n)) = lookupd (pi2\\x) (pi2\\a) (pi2\\\\_n)\"\napply -\napply(induct \\_n)\napply(auto simp add: eqvts)\napply(induct \\_n)\napply(auto simp add: eqvts)\ndone\n\nlemma lookupa_fresh:\n assumes a: \"a\\\\_c\"\n shows \"lookupa y a \\_c = Ax y a\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons fresh_atm)\ndone\n\nlemma lookupa_csubst:\n assumes a: \"a\\\\_c\"\n shows \"Cut .Ax y a (x).P = (lookupa y a \\_c){a:=(x).P}\"\nusing a by (simp add: lookupa_fresh)\n\nlemma lookupa_freshness:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_c,c) \\ a\\lookupa y c \\_c\"\n and \"x\\(\\_c,y) \\ x\\lookupa y c \\_c\"\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons abs_fresh fresh_atm)\ndone\n\nlemma lookupa_unicity:\n assumes a: \"lookupa x a \\_c= Ax y b\" \"b\\\\_c\" \"y\\\\_c\"\n shows \"x=y \\ a=b\"\nusing a\napply(induct \\_c)\napply(auto simp add: trm.inject fresh_list_cons fresh_prod fresh_atm)\napply(case_tac \"a=aa\")\napply(auto)\napply(case_tac \"a=aa\")\napply(auto)\ndone\n\nlemma lookupb_csubst:\n assumes a: \"a\\(\\_c,c,N)\"\n shows \"Cut .N (x).P = (lookupb y a \\_c c N){a:=(x).P}\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_atm fresh_prod)\napply(rule sym)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(subgoal_tac \"Cut .N (y).Ax y a = Cut .([(caa,c)]\\N) (ca).Ax ca a\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh)\napply(simp)\napply(subgoal_tac \"a\\([(caa,c)]\\N)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: trm.inject)\napply(rule conjI)\napply(rule sym)\napply(simp add: alpha fresh_prod fresh_atm)\napply(simp add: alpha calc_atm fresh_prod fresh_atm)\ndone\n\nlemma lookupb_freshness:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_c,c,b,P) \\ a\\lookupb y c \\_c b P\"\n and \"x\\(\\_c,y,P) \\ x\\lookupb y c \\_c b P\"\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons abs_fresh fresh_atm)\ndone\n\nlemma lookupb_unicity:\n assumes a: \"lookupb x a \\_c c P = Ax y b\" \"b\\(\\_c,c,P)\" \"y\\\\_c\"\n shows \"x=y \\ a=b\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\napply(case_tac \"a=aa\")\napply(auto)\napply(case_tac \"a=aa\")\napply(auto)\ndone\n\nlemma lookupb_lookupa:\n assumes a: \"x\\\\_c\"\n shows \"lookupb x c \\_c a P = (lookupa x c \\_c){x:=.P}\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_list_cons fresh_prod)\napply(generate_fresh \"coname\")\napply(generate_fresh \"name\")\napply(subgoal_tac \"Cut .Ax x c (aa).b = Cut .Ax x ca (caa).([(caa,aa)]\\b)\")\napply(simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp)\napply(simp)\napply(subgoal_tac \"x\\([(caa,aa)]\\b)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(simp add: trm.inject)\napply(rule conjI)\napply(simp add: alpha calc_atm fresh_atm fresh_prod)\napply(rule sym)\napply(simp add: alpha calc_atm fresh_atm fresh_prod)\ndone\n\nlemma lookup_csubst:\n assumes a: \"a\\(\\_n,\\_c)\"\n shows \"lookup y c \\_n ((a,x,P)#\\_c) = (lookup y c \\_n \\_c){a:=(x).P}\"\nusing a\napply(induct \\_n)\napply(auto simp add: fresh_prod fresh_list_cons)\napply(simp add: lookupa_csubst)\napply(simp add: lookupa_freshness forget fresh_atm fresh_prod)\napply(rule lookupb_csubst)\napply(simp)\napply(auto simp add: lookupb_freshness forget fresh_atm fresh_prod)\ndone\n\nlemma lookup_fresh:\n assumes a: \"x\\(\\_n,\\_c)\"\n shows \"lookup x c \\_n \\_c = lookupa x c \\_c\"\nusing a\napply(induct \\_n)\napply(auto simp add: fresh_prod fresh_list_cons fresh_atm)\ndone\n\nlemma lookup_unicity:\n assumes a: \"lookup x a \\_n \\_c= Ax y b\" \"b\\(\\_c,\\_n)\" \"y\\(\\_c,\\_n)\"\n shows \"x=y \\ a=b\"\nusing a\napply(induct \\_n)\napply(auto simp add: trm.inject fresh_list_cons fresh_prod fresh_atm)\napply(drule lookupa_unicity)\napply(simp)+\napply(drule lookupa_unicity)\napply(simp)+\napply(case_tac \"x=aa\")\napply(auto)\napply(drule lookupb_unicity)\napply(simp add: fresh_atm)\napply(simp)\napply(simp)\napply(case_tac \"x=aa\")\napply(auto)\napply(drule lookupb_unicity)\napply(simp add: fresh_atm)\napply(simp)\napply(simp)\ndone\n\nlemma lookup_freshness:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(c,\\_c,\\_n) \\ a\\lookup y c \\_n \\_c\"\n and \"x\\(y,\\_c,\\_n) \\ x\\lookup y c \\_n \\_c\" \napply(induct \\_n)\napply(auto simp add: fresh_prod fresh_list_cons abs_fresh fresh_atm)\napply(simp add: fresh_atm fresh_prod lookupa_freshness)\napply(simp add: fresh_atm fresh_prod lookupa_freshness)\napply(simp add: fresh_atm fresh_prod lookupb_freshness)\napply(simp add: fresh_atm fresh_prod lookupb_freshness)\ndone\n\nlemma lookupc_freshness:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_c,c) \\ a\\lookupc y c \\_c\"\n and \"x\\(\\_c,y) \\ x\\lookupc y c \\_c\"\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons abs_fresh fresh_atm)\napply(rule rename_fresh)\napply(simp add: fresh_atm)\napply(rule rename_fresh)\napply(simp add: fresh_atm)\ndone\n\nlemma lookupc_fresh:\n assumes a: \"y\\\\_n\"\n shows \"lookupc y a \\_n = Ax y a\"\nusing a\napply(induct \\_n)\napply(auto simp add: fresh_prod fresh_list_cons fresh_atm)\ndone\n\nlemma lookupc_nmaps:\n assumes a: \"\\_n nmaps x to Some (c,P)\"\n shows \"lookupc x a \\_n = P[c\\c>a]\"\nusing a\napply(induct \\_n)\napply(auto)\ndone \n\nlemma lookupc_unicity:\n assumes a: \"lookupc y a \\_n = Ax x b\" \"x\\\\_n\"\n shows \"y=x\"\nusing a\napply(induct \\_n)\napply(auto simp add: trm.inject fresh_list_cons fresh_prod)\napply(case_tac \"y=aa\")\napply(auto)\napply(subgoal_tac \"x\\(ba[aa\\c>a])\")\napply(simp add: fresh_atm)\napply(rule rename_fresh)\napply(simp)\ndone\n\nlemma lookupd_fresh:\n assumes a: \"a\\\\_c\"\n shows \"lookupd y a \\_c = Ax y a\"\nusing a\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons fresh_atm)\ndone \n\nlemma lookupd_unicity:\n assumes a: \"lookupd y a \\_c = Ax y b\" \"b\\\\_c\"\n shows \"a=b\"\nusing a\napply(induct \\_c)\napply(auto simp add: trm.inject fresh_list_cons fresh_prod)\napply(case_tac \"a=aa\")\napply(auto)\napply(subgoal_tac \"b\\(ba[aa\\n>y])\")\napply(simp add: fresh_atm)\napply(rule rename_fresh)\napply(simp)\ndone\n\nlemma lookupd_freshness:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_c,c) \\ a\\lookupd y c \\_c\"\n and \"x\\(\\_c,y) \\ x\\lookupd y c \\_c\"\napply(induct \\_c)\napply(auto simp add: fresh_prod fresh_list_cons abs_fresh fresh_atm)\napply(rule rename_fresh)\napply(simp add: fresh_atm)\napply(rule rename_fresh)\napply(simp add: fresh_atm)\ndone\n\nlemma lookupd_cmaps:\n assumes a: \"\\_c cmaps a to Some (x,P)\"\n shows \"lookupd y a \\_c = P[x\\n>y]\"\nusing a\napply(induct \\_c)\napply(auto)\ndone \n\nnominal_primrec (freshness_context: \"\\_n::(name\\coname\\trm)\")\n stn :: \"trm\\(name\\coname\\trm) list\\trm\" \nwhere\n \"stn (Ax x a) \\_n = lookupc x a \\_n\"\n| \"\\a\\(N,\\_n);x\\(M,\\_n)\\ \\ stn (Cut .M (x).N) \\_n = (Cut .M (x).N)\" \n| \"x\\\\_n \\ stn (NotR (x).M a) \\_n = (NotR (x).M a)\"\n| \"a\\\\_n \\stn (NotL .M x) \\_n = (NotL .M x)\"\n| \"\\a\\(N,d,b,\\_n);b\\(M,d,a,\\_n)\\ \\ stn (AndR .M .N d) \\_n = (AndR .M .N d)\"\n| \"x\\(z,\\_n) \\ stn (AndL1 (x).M z) \\_n = (AndL1 (x).M z)\"\n| \"x\\(z,\\_n) \\ stn (AndL2 (x).M z) \\_n = (AndL2 (x).M z)\"\n| \"a\\(b,\\_n) \\ stn (OrR1 .M b) \\_n = (OrR1 .M b)\"\n| \"a\\(b,\\_n) \\ stn (OrR2 .M b) \\_n = (OrR2 .M b)\"\n| \"\\x\\(N,z,u,\\_n);u\\(M,z,x,\\_n)\\ \\ stn (OrL (x).M (u).N z) \\_n = (OrL (x).M (u).N z)\"\n| \"\\a\\(b,\\_n);x\\\\_n\\ \\ stn (ImpR (x)..M b) \\_n = (ImpR (x)..M b)\"\n| \"\\a\\(N,\\_n);x\\(M,z,\\_n)\\ \\ stn (ImpL .M (x).N z) \\_n = (ImpL .M (x).N z)\"\napply(finite_guess)+\napply(rule TrueI)+\napply(simp add: abs_fresh abs_supp fin_supp)+\napply(fresh_guess)+\ndone\n\nnominal_primrec (freshness_context: \"\\_c::(coname\\name\\trm)\")\n stc :: \"trm\\(coname\\name\\trm) list\\trm\" \nwhere\n \"stc (Ax x a) \\_c = lookupd x a \\_c\"\n| \"\\a\\(N,\\_c);x\\(M,\\_c)\\ \\ stc (Cut .M (x).N) \\_c = (Cut .M (x).N)\" \n| \"x\\\\_c \\ stc (NotR (x).M a) \\_c = (NotR (x).M a)\"\n| \"a\\\\_c \\ stc (NotL .M x) \\_c = (NotL .M x)\"\n| \"\\a\\(N,d,b,\\_c);b\\(M,d,a,\\_c)\\ \\ stc (AndR .M .N d) \\_c = (AndR .M .N d)\"\n| \"x\\(z,\\_c) \\ stc (AndL1 (x).M z) \\_c = (AndL1 (x).M z)\"\n| \"x\\(z,\\_c) \\ stc (AndL2 (x).M z) \\_c = (AndL2 (x).M z)\"\n| \"a\\(b,\\_c) \\ stc (OrR1 .M b) \\_c = (OrR1 .M b)\"\n| \"a\\(b,\\_c) \\ stc (OrR2 .M b) \\_c = (OrR2 .M b)\"\n| \"\\x\\(N,z,u,\\_c);u\\(M,z,x,\\_c)\\ \\ stc (OrL (x).M (u).N z) \\_c = (OrL (x).M (u).N z)\"\n| \"\\a\\(b,\\_c);x\\\\_c\\ \\ stc (ImpR (x)..M b) \\_c = (ImpR (x)..M b)\"\n| \"\\a\\(N,\\_c);x\\(M,z,\\_c)\\ \\ stc (ImpL .M (x).N z) \\_c = (ImpL .M (x).N z)\"\napply(finite_guess)+\napply(rule TrueI)+\napply(simp add: abs_fresh abs_supp fin_supp)+\napply(fresh_guess)+\ndone\n\nlemma stn_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(stn M \\_n)) = stn (pi1\\M) (pi1\\\\_n)\"\n and \"(pi2\\(stn M \\_n)) = stn (pi2\\M) (pi2\\\\_n)\"\napply -\napply(nominal_induct M avoiding: \\_n rule: trm.strong_induct)\napply(auto simp add: eqvts fresh_bij fresh_prod eq_bij fresh_atm)\napply(nominal_induct M avoiding: \\_n rule: trm.strong_induct)\napply(auto simp add: eqvts fresh_bij fresh_prod eq_bij fresh_atm)\ndone\n\nlemma stc_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(stc M \\_c)) = stc (pi1\\M) (pi1\\\\_c)\"\n and \"(pi2\\(stc M \\_c)) = stc (pi2\\M) (pi2\\\\_c)\"\napply -\napply(nominal_induct M avoiding: \\_c rule: trm.strong_induct)\napply(auto simp add: eqvts fresh_bij fresh_prod eq_bij fresh_atm)\napply(nominal_induct M avoiding: \\_c rule: trm.strong_induct)\napply(auto simp add: eqvts fresh_bij fresh_prod eq_bij fresh_atm)\ndone\n\nlemma stn_fresh:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_n,M) \\ a\\stn M \\_n\"\n and \"x\\(\\_n,M) \\ x\\stn M \\_n\"\napply(nominal_induct M avoiding: \\_n a x rule: trm.strong_induct)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\ndone\n\nlemma stc_fresh:\n fixes a::\"coname\"\n and x::\"name\"\n shows \"a\\(\\_c,M) \\ a\\stc M \\_c\"\n and \"x\\(\\_c,M) \\ x\\stc M \\_c\"\napply(nominal_induct M avoiding: \\_c a x rule: trm.strong_induct)\napply(auto simp add: abs_fresh fresh_prod fresh_atm)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\ndone\n\nlemma case_option_eqvt1[eqvt_force]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n and B::\"(name\\trm) option\"\n and r::\"trm\"\n shows \"(pi1\\(case B of Some (x,P) \\ s x P | None \\ r)) = \n (case (pi1\\B) of Some (x,P) \\ (pi1\\s) x P | None \\ (pi1\\r))\"\n and \"(pi2\\(case B of Some (x,P) \\ s x P| None \\ r)) = \n (case (pi2\\B) of Some (x,P) \\ (pi2\\s) x P | None \\ (pi2\\r))\"\napply(cases \"B\")\napply(auto)\napply(perm_simp)\napply(cases \"B\")\napply(auto)\napply(perm_simp)\ndone\n\nlemma case_option_eqvt2[eqvt_force]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n and B::\"(coname\\trm) option\"\n and r::\"trm\"\n shows \"(pi1\\(case B of Some (x,P) \\ s x P | None \\ r)) = \n (case (pi1\\B) of Some (x,P) \\ (pi1\\s) x P | None \\ (pi1\\r))\"\n and \"(pi2\\(case B of Some (x,P) \\ s x P| None \\ r)) = \n (case (pi2\\B) of Some (x,P) \\ (pi2\\s) x P | None \\ (pi2\\r))\"\napply(cases \"B\")\napply(auto)\napply(perm_simp)\napply(cases \"B\")\napply(auto)\napply(perm_simp)\ndone\n\nnominal_primrec (freshness_context: \"(\\_n::(name\\coname\\trm) list,\\_c::(coname\\name\\trm) list)\")\n psubst :: \"(name\\coname\\trm) list\\(coname\\name\\trm) list\\trm\\trm\" (\"_,_<_>\" [100,100,100] 100) \nwhere\n \"\\_n,\\_c = lookup x a \\_n \\_c\" \n| \"\\a\\(N,\\_n,\\_c);x\\(M,\\_n,\\_c)\\ \\ \\_n,\\_c.M (x).N> = \n Cut .(if \\x. M=Ax x a then stn M \\_n else \\_n,\\_c) \n (x).(if \\a. N=Ax x a then stc N \\_c else \\_n,\\_c)\" \n| \"x\\(\\_n,\\_c) \\ \\_n,\\_c = \n (case (findc \\_c a) of \n Some (u,P) \\ fresh_fun (\\a'. Cut .NotR (x).(\\_n,\\_c) a' (u).P) \n | None \\ NotR (x).(\\_n,\\_c) a)\"\n| \"a\\(\\_n,\\_c) \\ \\_n,\\_c.M x> = \n (case (findn \\_n x) of \n Some (c,P) \\ fresh_fun (\\x'. Cut .P (x').(NotL .(\\_n,\\_c) x')) \n | None \\ NotL .(\\_n,\\_c) x)\"\n| \"\\a\\(N,c,\\_n,\\_c);b\\(M,c,\\_n,\\_c);b\\a\\ \\ (\\_n,\\_c.M .N c>) = \n (case (findc \\_c c) of \n Some (x,P) \\ fresh_fun (\\a'. Cut .(AndR .(\\_n,\\_c) .(\\_n,\\_c) a') (x).P)\n | None \\ AndR .(\\_n,\\_c) .(\\_n,\\_c) c)\"\n| \"x\\(z,\\_n,\\_c) \\ (\\_n,\\_c) = \n (case (findn \\_n z) of \n Some (c,P) \\ fresh_fun (\\z'. Cut .P (z').AndL1 (x).(\\_n,\\_c) z') \n | None \\ AndL1 (x).(\\_n,\\_c) z)\"\n| \"x\\(z,\\_n,\\_c) \\ (\\_n,\\_c) = \n (case (findn \\_n z) of \n Some (c,P) \\ fresh_fun (\\z'. Cut .P (z').AndL2 (x).(\\_n,\\_c) z') \n | None \\ AndL2 (x).(\\_n,\\_c) z)\"\n| \"\\x\\(N,z,\\_n,\\_c);u\\(M,z,\\_n,\\_c);x\\u\\ \\ (\\_n,\\_c) =\n (case (findn \\_n z) of \n Some (c,P) \\ fresh_fun (\\z'. Cut .P (z').OrL (x).(\\_n,\\_c) (u).(\\_n,\\_c) z') \n | None \\ OrL (x).(\\_n,\\_c) (u).(\\_n,\\_c) z)\"\n| \"a\\(b,\\_n,\\_c) \\ (\\_n,\\_c.M b>) = \n (case (findc \\_c b) of\n Some (x,P) \\ fresh_fun (\\a'. Cut .OrR1 .(\\_n,\\_c) a' (x).P) \n | None \\ OrR1 .(\\_n,\\_c) b)\"\n| \"a\\(b,\\_n,\\_c) \\ (\\_n,\\_c.M b>) = \n (case (findc \\_c b) of\n Some (x,P) \\ fresh_fun (\\a'. Cut .OrR2 .(\\_n,\\_c) a' (x).P) \n | None \\ OrR2 .(\\_n,\\_c) b)\"\n| \"\\a\\(b,\\_n,\\_c); x\\(\\_n,\\_c)\\ \\ (\\_n,\\_c.M b>) = \n (case (findc \\_c b) of\n Some (z,P) \\ fresh_fun (\\a'. Cut .ImpR (x)..(\\_n,\\_c) a' (z).P)\n | None \\ ImpR (x)..(\\_n,\\_c) b)\"\n| \"\\a\\(N,\\_n,\\_c); x\\(z,M,\\_n,\\_c)\\ \\ (\\_n,\\_c.M (x).N z>) = \n (case (findn \\_n z) of\n Some (c,P) \\ fresh_fun (\\z'. Cut .P (z').ImpL .(\\_n,\\_c) (x).(\\_n,\\_c) z') \n | None \\ ImpL .(\\_n,\\_c) (x).(\\_n,\\_c) z)\"\napply(finite_guess)+\napply(rule TrueI)+\napply(simp add: abs_fresh stc_fresh)\napply(simp add: abs_fresh stn_fresh)\napply(case_tac \"findc \\_c x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findc \\_c x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findc \\_c x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule_tac x=\"x3\" in cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findc \\_c x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findc \\_c x3\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule_tac a=\"x3\" in nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findc \\_c x4\")\napply(simp add: abs_fresh abs_supp fin_supp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm abs_supp fin_supp)\napply(case_tac \"findc \\_c x4\")\napply(simp add: abs_fresh abs_supp fin_supp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp (no_asm))\napply(drule_tac x=\"x2\" in cmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm abs_supp fin_supp)\napply(case_tac \"findn \\_n x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(case_tac \"findn \\_n x5\")\napply(simp add: abs_fresh)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp (no_asm))\napply(drule_tac a=\"x3\" in nmaps_fresh)\napply(auto simp add: fresh_prod)[1]\napply(simp add: abs_fresh fresh_prod fresh_atm)\napply(fresh_guess)+\ndone\n\nlemma case_cong:\n assumes a: \"B1=B2\" \"x1=x2\" \"y1=y2\"\n shows \"(case B1 of None \\ x1 | Some (x,P) \\ y1 x P) = (case B2 of None \\ x2 | Some (x,P) \\ y2 x P)\"\nusing a\napply(auto)\ndone\n\nlemma find_maps:\n shows \"\\_c cmaps a to (findc \\_c a)\"\n and \"\\_n nmaps x to (findn \\_n x)\"\napply(auto)\ndone\n\nlemma psubst_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"pi1\\(\\_n,\\_c) = (pi1\\\\_n),(pi1\\\\_c)<(pi1\\M)>\"\n and \"pi2\\(\\_n,\\_c) = (pi2\\\\_n),(pi2\\\\_c)<(pi2\\M)>\"\napply(nominal_induct M avoiding: \\_n \\_c rule: trm.strong_induct)\napply(auto simp add: eq_bij fresh_bij eqvts perm_pi_simp)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\napply(rule case_cong)\napply(rule find_maps)\napply(simp)\napply(perm_simp add: eqvts)\ndone\n\nlemma ax_psubst:\n assumes a: \"\\_n,\\_c = Ax x a\"\n and b: \"a\\(\\_n,\\_c)\" \"x\\(\\_n,\\_c)\"\n shows \"M = Ax x a\"\nusing a b\napply(nominal_induct M avoiding: \\_n \\_c rule: trm.strong_induct)\napply(auto)\napply(drule lookup_unicity)\napply(simp)+\napply(case_tac \"findc \\_c coname\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findn \\_n name\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findc \\_c coname3\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findn \\_n name3\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp)\ndone\n\nlemma better_Cut_substc1:\n assumes a: \"a\\(P,b)\" \"b\\N\" \n shows \"(Cut .M (x).N){b:=(y).P} = Cut .(M{b:=(y).P}) (x).N\"\nusing a\napply -\napply(generate_fresh \"coname\")\napply(generate_fresh \"name\")\napply(subgoal_tac \"Cut .M (x).N = Cut .([(c,a)]\\M) (ca).([(ca,x)]\\N)\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh)\napply(auto)[1]\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm fresh_atm)\napply(subgoal_tac\"b\\([(ca,x)]\\N)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(perm_simp)\napply(simp add: fresh_left calc_atm)\napply(simp add: trm.inject)\napply(rule conjI)\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\ndone\n\nlemma better_Cut_substc2:\n assumes a: \"x\\(y,P)\" \"b\\(a,M)\" \"N\\Ax x b\"\n shows \"(Cut .M (x).N){b:=(y).P} = Cut .M (x).(N{b:=(y).P})\"\nusing a\napply -\napply(generate_fresh \"coname\")\napply(generate_fresh \"name\")\napply(subgoal_tac \"Cut .M (x).N = Cut .([(c,a)]\\M) (ca).([(ca,x)]\\N)\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh)\napply(auto)[1]\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm fresh_atm fresh_prod)\napply(subgoal_tac\"b\\([(c,a)]\\M)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(perm_simp)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(simp add: trm.inject)\napply(rule conjI)\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\ndone\n\nlemma better_Cut_substn1:\n assumes a: \"y\\(x,N)\" \"a\\(b,P)\" \"M\\Ax y a\"\n shows \"(Cut .M (x).N){y:=.P} = Cut .(M{y:=.P}) (x).N\"\nusing a\napply -\napply(generate_fresh \"coname\")\napply(generate_fresh \"name\")\napply(subgoal_tac \"Cut .M (x).N = Cut .([(c,a)]\\M) (ca).([(ca,x)]\\N)\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(auto)[1]\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm fresh_atm fresh_prod)\napply(subgoal_tac\"y\\([(ca,x)]\\N)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(perm_simp)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(simp add: trm.inject)\napply(rule conjI)\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\ndone\n\nlemma better_Cut_substn2:\n assumes a: \"x\\(P,y)\" \"y\\M\" \n shows \"(Cut .M (x).N){y:=.P} = Cut .M (x).(N{y:=.P})\"\nusing a\napply -\napply(generate_fresh \"coname\")\napply(generate_fresh \"name\")\napply(subgoal_tac \"Cut .M (x).N = Cut .([(c,a)]\\M) (ca).([(ca,x)]\\N)\")\napply(simp)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(auto)[1]\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm fresh_atm)\napply(subgoal_tac\"y\\([(c,a)]\\M)\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(perm_simp)\napply(simp add: fresh_left calc_atm)\napply(simp add: trm.inject)\napply(rule conjI)\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\napply(rule sym)\napply(simp add: alpha eqvts calc_atm fresh_prod fresh_atm subst_fresh)[1]\ndone\n\nlemma psubst_fresh_name:\n fixes x::\"name\"\n assumes a: \"x\\\\_n\" \"x\\\\_c\" \"x\\M\"\n shows \"x\\\\_n,\\_c\"\nusing a\napply(nominal_induct M avoiding: x \\_n \\_c rule: trm.strong_induct)\napply(simp add: lookup_freshness)\napply(auto simp add: abs_fresh)[1]\napply(simp add: lookupc_freshness)\napply(simp add: lookupc_freshness)\napply(simp add: lookupc_freshness)\napply(simp add: lookupd_freshness)\napply(simp add: lookupd_freshness)\napply(simp add: lookupc_freshness)\napply(simp)\napply(case_tac \"findc \\_c coname\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname3\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name3\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh abs_supp fin_supp)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh abs_supp fin_supp fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\ndone\n\nlemma psubst_fresh_coname:\n fixes a::\"coname\"\n assumes a: \"a\\\\_n\" \"a\\\\_c\" \"a\\M\"\n shows \"a\\\\_n,\\_c\"\nusing a\napply(nominal_induct M avoiding: a \\_n \\_c rule: trm.strong_induct)\napply(simp add: lookup_freshness)\napply(auto simp add: abs_fresh)[1]\napply(simp add: lookupd_freshness)\napply(simp add: lookupd_freshness)\napply(simp add: lookupc_freshness)\napply(simp add: lookupd_freshness)\napply(simp add: lookupc_freshness)\napply(simp add: lookupd_freshness)\napply(simp)\napply(case_tac \"findc \\_c coname\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname3\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name3\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(auto simp add: abs_fresh abs_supp fin_supp)[1]\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh abs_supp fin_supp fresh_prod fresh_atm cmaps_fresh)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(auto simp add: abs_fresh)[1]\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(simp add: abs_fresh fresh_prod fresh_atm nmaps_fresh)\ndone\n\nlemma psubst_csubst:\n assumes a: \"a\\(\\_n,\\_c)\"\n shows \"\\_n,((a,x,P)#\\_c) = ((\\_n,\\_c){a:=(x).P})\"\nusing a\napply(nominal_induct M avoiding: a x \\_n \\_c P rule: trm.strong_induct)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp add: lookup_csubst)\napply(simp add: fresh_list_cons fresh_prod)\napply(auto)[1]\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp add: lookupd_fresh)\napply(subgoal_tac \"a\\lookupc xa coname \\_n\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(rule sym)\napply(simp add: alpha nrename_swap fresh_atm)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: lookupd_unicity)\napply(rule impI)\napply(subgoal_tac \"a\\lookupc xa coname \\_n\")\napply(subgoal_tac \"a\\lookupd name aa \\_c\")\napply(simp add: forget)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(drule ax_psubst)\napply(simp)\napply(simp)\napply(blast)\napply(rule impI)\napply(subgoal_tac \"a\\lookupc xa coname \\_n\")\napply(simp add: forget)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: trm.inject)\napply(rule sym)\napply(simp add: alpha)\napply(simp add: alpha nrename_swap fresh_atm)\napply(simp add: lookupd_fresh)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: lookupd_unicity)\napply(rule impI)\napply(subgoal_tac \"a\\lookupd name aa \\_c\")\napply(simp add: forget)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc)\napply(simp)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule impI)\napply(drule ax_psubst)\napply(simp)\napply(simp)\napply(blast)\n(* NotR *)\napply(simp)\napply(case_tac \"findc \\_c coname\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule cmaps_false)\napply(assumption)\napply(simp)\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc1)\napply(simp)\napply(simp add: cmaps_fresh)\napply(auto simp add: fresh_prod fresh_atm)[1]\n(* NotL *)\napply(simp)\napply(case_tac \"findn \\_n name\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(drule_tac a=\"a\" in nmaps_fresh)\napply(assumption)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc2)\napply(simp)\napply(simp)\napply(simp)\napply(simp)\n(* AndR *)\napply(simp)\napply(case_tac \"findc \\_c coname3\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule cmaps_false)\napply(assumption)\napply(simp)\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc1)\napply(simp)\napply(simp add: cmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* AndL1 *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(drule_tac a=\"a\" in nmaps_fresh)\napply(assumption)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc2)\napply(simp)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* AndL2 *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(drule_tac a=\"a\" in nmaps_fresh)\napply(assumption)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc2)\napply(simp)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrR1 *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule cmaps_false)\napply(assumption)\napply(simp)\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc1)\napply(simp)\napply(simp add: cmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrR2 *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule cmaps_false)\napply(assumption)\napply(simp)\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc1)\napply(simp)\napply(simp add: cmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrL *)\napply(simp)\napply(case_tac \"findn \\_n name3\")\napply(simp)\napply(auto simp add: fresh_list_cons psubst_fresh_name fresh_atm fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(drule_tac a=\"a\" in nmaps_fresh)\napply(assumption)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc2)\napply(simp)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_name fresh_prod fresh_atm)[1]\n(* ImpR *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule cmaps_false)\napply(assumption)\napply(simp)\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc1)\napply(simp)\napply(simp add: cmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* ImpL *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons psubst_fresh_coname psubst_fresh_name fresh_atm fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(simp add: abs_fresh subst_fresh)\napply(drule_tac a=\"a\" in nmaps_fresh)\napply(assumption)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substc2)\napply(simp)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname psubst_fresh_name fresh_prod fresh_atm)[1]\ndone\n\nlemma psubst_nsubst:\n assumes a: \"x\\(\\_n,\\_c)\"\n shows \"((x,a,P)#\\_n),\\_c = ((\\_n,\\_c){x:=.P})\"\nusing a\napply(nominal_induct M avoiding: a x \\_n \\_c P rule: trm.strong_induct)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp add: lookup_fresh)\napply(rule lookupb_lookupa)\napply(simp)\napply(rule sym)\napply(rule forget)\napply(rule lookup_freshness)\napply(simp add: fresh_atm)\napply(auto simp add: lookupc_freshness fresh_list_cons fresh_prod)[1]\napply(simp add: lookupc_fresh)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh fresh_atm)\napply(simp add: lookupd_fresh)\napply(subgoal_tac \"x\\lookupd name aa \\_c\")\napply(simp add: forget)\napply(simp add: trm.inject)\napply(rule sym)\napply(simp add: alpha crename_swap fresh_atm)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh) \napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: lookupc_unicity)\napply(rule impI)\napply(subgoal_tac \"x\\lookupc xa coname \\_n\")\napply(subgoal_tac \"x\\lookupd name aa \\_c\")\napply(simp add: forget)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule lookupc_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: trm.inject)\napply(rule sym)\napply(simp add: alpha crename_swap fresh_atm)\napply(rule impI)\napply(simp add: lookupc_fresh)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(simp add: lookupc_unicity)\napply(rule impI)\napply(subgoal_tac \"x\\lookupc xa coname \\_n\")\napply(simp add: forget)\napply(rule lookupc_freshness)\napply(simp add: fresh_prod fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule conjI)\napply(rule impI)\napply(drule ax_psubst)\napply(simp)\napply(simp)\napply(simp)\napply(blast)\napply(rule impI)\napply(subgoal_tac \"x\\lookupd name aa \\_c\")\napply(simp add: forget)\napply(rule lookupd_freshness)\napply(simp add: fresh_atm)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh fresh_atm)\napply(simp)\napply(rule impI)\napply(drule ax_psubst)\napply(simp)\napply(simp)\napply(blast)\n(* NotR *)\napply(simp)\napply(case_tac \"findc \\_c coname\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn1)\napply(simp add: cmaps_fresh)\napply(simp)\napply(simp)\napply(simp)\n(* NotL *)\napply(simp)\napply(case_tac \"findn \\_n name\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule nmaps_false)\napply(simp)\napply(simp)\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn2)\napply(simp)\napply(simp add: nmaps_fresh)\napply(simp add: fresh_prod fresh_atm)\n(* AndR *)\napply(simp)\napply(case_tac \"findc \\_c coname3\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn1)\napply(simp add: cmaps_fresh)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* AndL1 *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule nmaps_false)\napply(simp)\napply(simp)\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn2)\napply(simp)\napply(simp add: nmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* AndL2 *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule nmaps_false)\napply(simp)\napply(simp)\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn2)\napply(simp)\napply(simp add: nmaps_fresh)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrR1 *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn1)\napply(simp add: cmaps_fresh)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrR2 *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn1)\napply(simp add: cmaps_fresh)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* OrL *)\napply(simp)\napply(case_tac \"findn \\_n name3\")\napply(simp)\napply(auto simp add: fresh_list_cons psubst_fresh_name fresh_atm fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule nmaps_false)\napply(simp)\napply(simp)\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn2)\napply(simp)\napply(simp add: nmaps_fresh)\napply(auto simp add: psubst_fresh_name fresh_prod fresh_atm)[1]\n(* ImpR *)\napply(simp)\napply(case_tac \"findc \\_c coname2\")\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_list_cons fresh_prod fresh_atm)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn1)\napply(simp add: cmaps_fresh)\napply(simp)\napply(simp)\napply(auto simp add: psubst_fresh_coname fresh_prod fresh_atm)[1]\n(* ImpL *)\napply(simp)\napply(case_tac \"findn \\_n name2\")\napply(simp)\napply(auto simp add: fresh_list_cons psubst_fresh_coname psubst_fresh_name fresh_atm fresh_prod)[1]\napply(simp)\napply(auto simp add: fresh_list_cons fresh_prod)[1]\napply(drule nmaps_false)\napply(simp)\napply(simp)\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(fresh_fun_simp)\napply(rule sym)\napply(rule trans)\napply(rule better_Cut_substn2)\napply(simp)\napply(simp add: nmaps_fresh)\napply(auto simp add: psubst_fresh_coname psubst_fresh_name fresh_prod fresh_atm)[1]\ndone\n\ndefinition \n ncloses :: \"(name\\coname\\trm) list\\(name\\ty) list \\ bool\" (\"_ ncloses _\" [55,55] 55) \nwhere\n \"\\_n ncloses \\ \\ \\x B. ((x,B) \\ set \\ \\ (\\c P. \\_n nmaps x to Some (c,P) \\ :P \\ (\\\\)))\"\n \ndefinition \n ccloses :: \"(coname\\name\\trm) list\\(coname\\ty) list \\ bool\" (\"_ ccloses _\" [55,55] 55) \nwhere\n \"\\_c ccloses \\ \\ \\a B. ((a,B) \\ set \\ \\ (\\x P. \\_c cmaps a to Some (x,P) \\ (x):P \\ (\\(B)\\)))\"\n\nlemma ncloses_elim:\n assumes a: \"(x,B) \\ set \\\"\n and b: \"\\_n ncloses \\\"\n shows \"\\c P. \\_n nmaps x to Some (c,P) \\ :P \\ (\\\\)\"\nusing a b by (auto simp add: ncloses_def)\n\nlemma ccloses_elim:\n assumes a: \"(a,B) \\ set \\\"\n and b: \"\\_c ccloses \\\"\n shows \"\\x P. \\_c cmaps a to Some (x,P) \\ (x):P \\ (\\(B)\\)\"\nusing a b by (auto simp add: ccloses_def)\n\nlemma ncloses_subset:\n assumes a: \"\\_n ncloses \\\"\n and b: \"set \\' \\ set \\\"\n shows \"\\_n ncloses \\'\"\nusing a b by (auto simp add: ncloses_def)\n\nlemma ccloses_subset:\n assumes a: \"\\_c ccloses \\\"\n and b: \"set \\' \\ set \\\"\n shows \"\\_c ccloses \\'\"\nusing a b by (auto simp add: ccloses_def)\n\nlemma validc_fresh:\n fixes a::\"coname\"\n and \\::\"(coname\\ty) list\"\n assumes a: \"a\\\\\"\n shows \"\\(\\B. (a,B)\\set \\)\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma validn_fresh:\n fixes x::\"name\"\n and \\::\"(name\\ty) list\"\n assumes a: \"x\\\\\"\n shows \"\\(\\B. (x,B)\\set \\)\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma ccloses_extend:\n assumes a: \"\\_c ccloses \\\" \"a\\\\\" \"a\\\\_c\" \"(x):P\\\\(B)\\\"\n shows \"(a,x,P)#\\_c ccloses (a,B)#\\\"\nusing a\napply(simp add: ccloses_def)\napply(drule validc_fresh)\napply(auto)\ndone\n\nlemma ncloses_extend:\n assumes a: \"\\_n ncloses \\\" \"x\\\\\" \"x\\\\_n\" \":P\\\\\\\"\n shows \"(x,a,P)#\\_n ncloses (x,B)#\\\"\nusing a\napply(simp add: ncloses_def)\napply(drule validn_fresh)\napply(auto)\ndone\n\n\ntext \\typing relation\\\n\ninductive\n typing :: \"ctxtn \\ trm \\ ctxtc \\ bool\" (\"_ \\ _ \\ _\" [100,100,100] 100)\nwhere\n TAx: \"\\validn \\;validc \\; (x,B)\\set \\; (a,B)\\set \\\\ \\ \\ \\ Ax x a \\ \\\"\n| TNotR: \"\\x\\\\; ((x,B)#\\) \\ M \\ \\; set \\' = {(a,NOT B)}\\set \\; validc \\'\\ \n \\ \\ \\ NotR (x).M a \\ \\'\"\n| TNotL: \"\\a\\\\; \\ \\ M \\ ((a,B)#\\); set \\' = {(x,NOT B)} \\ set \\; validn \\'\\ \n \\ \\' \\ NotL .M x \\ \\\"\n| TAndL1: \"\\x\\(\\,y); ((x,B1)#\\) \\ M \\ \\; set \\' = {(y,B1 AND B2)} \\ set \\; validn \\'\\ \n \\ \\' \\ AndL1 (x).M y \\ \\\"\n| TAndL2: \"\\x\\(\\,y); ((x,B2)#\\) \\ M \\ \\; set \\' = {(y,B1 AND B2)} \\ set \\; validn \\'\\ \n \\ \\' \\ AndL2 (x).M y \\ \\\"\n| TAndR: \"\\a\\(\\,N,c); b\\(\\,M,c); a\\b; \\ \\ M \\ ((a,B)#\\); \\ \\ N \\ ((b,C)#\\); \n set \\' = {(c,B AND C)}\\set \\; validc \\'\\ \n \\ \\ \\ AndR .M .N c \\ \\'\"\n| TOrL: \"\\x\\(\\,N,z); y\\(\\,M,z); x\\y; ((x,B)#\\) \\ M \\ \\; ((y,C)#\\) \\ N \\ \\;\n set \\' = {(z,B OR C)} \\ set \\; validn \\'\\ \n \\ \\' \\ OrL (x).M (y).N z \\ \\\"\n| TOrR1: \"\\a\\(\\,b); \\ \\ M \\ ((a,B1)#\\); set \\' = {(b,B1 OR B2)}\\set \\; validc \\'\\ \n \\ \\ \\ OrR1 .M b \\ \\'\"\n| TOrR2: \"\\a\\(\\,b); \\ \\ M \\ ((a,B2)#\\); set \\' = {(b,B1 OR B2)}\\set \\; validc \\'\\ \n \\ \\ \\ OrR2 .M b \\ \\'\"\n| TImpL: \"\\a\\(\\,N); x\\(\\,M,y); \\ \\ M \\ ((a,B)#\\); ((x,C)#\\) \\ N \\ \\;\n set \\' = {(y,B IMP C)} \\ set \\; validn \\'\\ \n \\ \\' \\ ImpL .M (x).N y \\ \\\"\n| TImpR: \"\\a\\(\\,b); x\\\\; ((x,B)#\\) \\ M \\ ((a,C)#\\); set \\' = {(b,B IMP C)}\\set \\; validc \\'\\ \n \\ \\ \\ ImpR (x)..M b \\ \\'\"\n| TCut: \"\\a\\(\\,N); x\\(\\,M); \\ \\ M \\ ((a,B)#\\); ((x,B)#\\) \\ N \\ \\\\ \n \\ \\ \\ Cut .M (x).N \\ \\\"\n\nequivariance typing\n\nlemma fresh_set_member:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\L \\ e\\set L \\ x\\e\"\n and \"a\\L \\ e\\set L \\ a\\e\" \nby (induct L) (auto simp add: fresh_list_cons) \n\nlemma fresh_subset:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\L \\ set L' \\ set L \\ x\\L'\"\n and \"a\\L \\ set L' \\ set L \\ a\\L'\" \napply(induct L' arbitrary: L) \napply(auto simp add: fresh_list_cons fresh_list_nil intro: fresh_set_member)\ndone\n\nlemma fresh_subset_ext:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\L \\ x\\e \\ set L' \\ set (e#L) \\ x\\L'\"\n and \"a\\L \\ a\\e \\ set L' \\ set (e#L) \\ a\\L'\" \napply(induct L' arbitrary: L) \napply(auto simp add: fresh_list_cons fresh_list_nil intro: fresh_set_member)\ndone\n\nlemma fresh_under_insert:\n fixes x::\"name\"\n and a::\"coname\"\n and \\::\"ctxtn\"\n and \\::\"ctxtc\"\n shows \"x\\\\ \\ x\\y \\ set \\' = insert (y,B) (set \\) \\ x\\\\'\"\n and \"a\\\\ \\ a\\c \\ set \\' = insert (c,B) (set \\) \\ a\\\\'\" \napply(rule fresh_subset_ext(1))\napply(auto simp add: fresh_prod fresh_atm fresh_ty)\napply(rule fresh_subset_ext(2))\napply(auto simp add: fresh_prod fresh_atm fresh_ty)\ndone\n\nnominal_inductive typing\n apply (simp_all add: abs_fresh fresh_atm fresh_list_cons fresh_prod fresh_ty fresh_ctxt \n fresh_list_append abs_supp fin_supp)\n apply(auto intro: fresh_under_insert)\n done\n\nlemma validn_elim:\n assumes a: \"validn ((x,B)#\\)\"\n shows \"validn \\ \\ x\\\\\"\nusing a\napply(erule_tac validn.cases)\napply(auto)\ndone\n\nlemma validc_elim:\n assumes a: \"validc ((a,B)#\\)\"\n shows \"validc \\ \\ a\\\\\"\nusing a\napply(erule_tac validc.cases)\napply(auto)\ndone\n\nlemma context_fresh:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\\\ \\ \\(\\B. (x,B)\\set \\)\"\n and \"a\\\\ \\ \\(\\B. (a,B)\\set \\)\"\napply -\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma typing_implies_valid:\n assumes a: \"\\ \\ M \\ \\\"\n shows \"validn \\ \\ validc \\\"\nusing a\napply(nominal_induct rule: typing.strong_induct)\napply(auto dest: validn_elim validc_elim)\ndone\n\nlemma ty_perm:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n and B::\"ty\"\n shows \"pi1\\B=B\" and \"pi2\\B=B\"\napply(nominal_induct B rule: ty.strong_induct)\napply(auto simp add: perm_string)\ndone\n\nlemma ctxt_perm:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n and \\::\"ctxtn\"\n and \\::\"ctxtc\"\n shows \"pi2\\\\=\\\" and \"pi1\\\\=\\\"\napply -\napply(induct \\)\napply(auto simp add: calc_atm ty_perm)\napply(induct \\)\napply(auto simp add: calc_atm ty_perm)\ndone\n\nlemma typing_Ax_elim1: \n assumes a: \"\\ \\ Ax x a \\ ((a,B)#\\)\"\n shows \"(x,B)\\set \\\"\nusing a\napply(erule_tac typing.cases)\napply(simp_all add: trm.inject)\napply(auto)\napply(auto dest: validc_elim context_fresh)\ndone\n\nlemma typing_Ax_elim2: \n assumes a: \"((x,B)#\\) \\ Ax x a \\ \\\"\n shows \"(a,B)\\set \\\"\nusing a\napply(erule_tac typing.cases)\napply(simp_all add: trm.inject)\napply(auto dest!: validn_elim context_fresh)\ndone\n\nlemma psubst_Ax_aux: \n assumes a: \"\\_c cmaps a to Some (y,N)\"\n shows \"lookupb x a \\_c c P = Cut .P (y).N\"\nusing a\napply(induct \\_c)\napply(auto)\ndone\n\nlemma psubst_Ax:\n assumes a: \"\\_n nmaps x to Some (c,P)\"\n and b: \"\\_c cmaps a to Some (y,N)\"\n shows \"\\_n,\\_c = Cut .P (y).N\"\nusing a b\napply(induct \\_n)\napply(auto simp add: psubst_Ax_aux)\ndone\n\nlemma psubst_Cut:\n assumes a: \"\\x. M\\Ax x c\"\n and b: \"\\a. N\\Ax x a\"\n and c: \"c\\(\\_n,\\_c,N)\" \"x\\(\\_n,\\_c,M)\"\n shows \"\\_n,\\_c.M (x).N> = Cut .(\\_n,\\_c) (x).(\\_n,\\_c)\"\nusing a b c\napply(simp)\ndone\n\nlemma all_CAND: \n assumes a: \"\\ \\ M \\ \\\"\n and b: \"\\_n ncloses \\\"\n and c: \"\\_c ccloses \\\"\n shows \"SNa (\\_n,\\_c)\"\nusing a b c\nproof(nominal_induct avoiding: \\_n \\_c rule: typing.strong_induct)\n case (TAx \\ \\ x B a \\_n \\_c)\n then show ?case\n apply -\n apply(drule ncloses_elim)\n apply(assumption)\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(erule conjE)+\n apply(rule_tac s=\"Cut .P (xa).Pa\" and t=\"\\_n,\\_c\" in subst)\n apply(rule sym)\n apply(simp only: psubst_Ax)\n apply(simp add: CUT_SNa)\n done\nnext\n case (TNotR x \\ B M \\ \\' a \\_n \\_c) \n then show ?case \n apply(simp)\n apply(subgoal_tac \"(a,NOT B) \\ set \\'\")\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp)\n apply(generate_fresh \"coname\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"NOT B\" in CUT_SNa)\n apply(simp)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"c\" in exI)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule conjI)\n apply(rule fic.intros)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(simp add: psubst_nsubst[symmetric])\n apply(drule_tac x=\"(x,aa,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(assumption)\n apply(simp)\n apply(blast)\n done\nnext\n case (TNotL a \\ \\ M B \\' x \\_n \\_c)\n then show ?case\n apply(simp)\n apply(subgoal_tac \"(x,NOT B) \\ set \\'\")\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp del: NEGc.simps)\n apply(generate_fresh \"name\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"NOT B\" in CUT_SNa)\n apply(simp)\n apply(rule NEG_intro)\n apply(simp (no_asm))\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule conjI)\n apply(rule fin.intros)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp (no_asm))\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp (no_asm))\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_csubst[symmetric])\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(blast)\n done\nnext\n case (TAndL1 x \\ y B1 M \\ \\' B2 \\_n \\_c)\n then show ?case \n apply(simp)\n apply(subgoal_tac \"(y,B1 AND B2) \\ set \\'\")\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+ \n apply(simp del: NEGc.simps)\n apply(generate_fresh \"name\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B1 AND B2\" in CUT_SNa)\n apply(simp)\n apply(rule NEG_intro)\n apply(simp (no_asm))\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule conjI)\n apply(rule fin.intros)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp (no_asm))\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp (no_asm))\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_nsubst[symmetric])\n apply(drule_tac x=\"(x,a,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(drule meta_mp)\n apply(assumption)\n apply(assumption)\n apply(blast)\n done\nnext\n case (TAndL2 x \\ y B2 M \\ \\' B1 \\_n \\_c)\n then show ?case \n apply(simp)\n apply(subgoal_tac \"(y,B1 AND B2) \\ set \\'\")\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+ \n apply(simp del: NEGc.simps)\n apply(generate_fresh \"name\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B1 AND B2\" in CUT_SNa)\n apply(simp)\n apply(rule NEG_intro)\n apply(simp (no_asm))\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule conjI)\n apply(rule fin.intros)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp (no_asm))\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp (no_asm))\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_nsubst[symmetric])\n apply(drule_tac x=\"(x,a,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(drule meta_mp)\n apply(assumption)\n apply(assumption)\n apply(blast)\n done\nnext\n case (TAndR a \\ N c b M \\ B C \\' \\_n \\_c)\n then show ?case \n apply(simp)\n apply(subgoal_tac \"(c,B AND C) \\ set \\'\")\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp)\n apply(generate_fresh \"coname\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B AND C\" in CUT_SNa)\n apply(simp)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"b\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule conjI)\n apply(rule fic.intros)\n apply(simp add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule conjI)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(simp add: psubst_csubst[symmetric])\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(assumption)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp)\n apply(rule_tac x=\"b\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(simp add: psubst_csubst[symmetric])\n apply(rotate_tac 14)\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(b,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(assumption)\n apply(simp)\n apply(blast)\n done\nnext\n case (TOrL x \\ N z y M B \\ C \\' \\_n \\_c)\n then show ?case \n apply(simp)\n apply(subgoal_tac \"(z,B OR C) \\ set \\'\")\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp del: NEGc.simps)\n apply(generate_fresh \"name\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B OR C\" in CUT_SNa)\n apply(simp)\n apply(rule NEG_intro)\n apply(simp (no_asm))\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"y\" in exI)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule conjI)\n apply(rule fin.intros)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule conjI)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp del: NEGc.simps)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_nsubst[symmetric])\n apply(drule_tac x=\"(x,a,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(drule meta_mp)\n apply(assumption)\n apply(assumption)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp del: NEGc.simps)\n apply(rule_tac x=\"y\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_nsubst[symmetric])\n apply(rotate_tac 14)\n apply(drule_tac x=\"(y,a,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(drule meta_mp)\n apply(assumption)\n apply(assumption)\n apply(blast)\n done\nnext\n case (TOrR1 a \\ b \\ M B1 \\' B2 \\_n \\_c)\n then show ?case\n apply(simp)\n apply(subgoal_tac \"(b,B1 OR B2) \\ set \\'\")\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+ \n apply(simp del: NEGc.simps)\n apply(generate_fresh \"coname\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B1 OR B2\" in CUT_SNa)\n apply(simp)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule conjI)\n apply(rule fic.intros)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp (no_asm))\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp (no_asm))\n apply(rule allI)+\n apply(rule impI) \n apply(simp del: NEGc.simps add: psubst_csubst[symmetric])\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(simp)\n apply(blast)\n done\nnext\n case (TOrR2 a \\ b \\ M B2 \\' B1 \\_n \\_c)\n then show ?case \n apply(simp)\n apply(subgoal_tac \"(b,B1 OR B2) \\ set \\'\")\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+ \n apply(simp del: NEGc.simps)\n apply(generate_fresh \"coname\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B1 OR B2\" in CUT_SNa)\n apply(simp)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule conjI)\n apply(rule fic.intros)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp (no_asm))\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp (no_asm))\n apply(rule allI)+\n apply(rule impI) \n apply(simp del: NEGc.simps add: psubst_csubst[symmetric])\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(simp)\n apply(blast)\n done\nnext\n case (TImpL a \\ N x \\ M y B C \\' \\_n \\_c)\n then show ?case\n apply(simp)\n apply(subgoal_tac \"(y,B IMP C) \\ set \\'\")\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp del: NEGc.simps)\n apply(generate_fresh \"name\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B IMP C\" in CUT_SNa)\n apply(simp)\n apply(rule NEG_intro)\n apply(simp (no_asm))\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"ca\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule conjI)\n apply(rule fin.intros)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(simp del: NEGc.simps add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_name)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule conjI)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp del: NEGc.simps)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_csubst[symmetric])\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(assumption)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(assumption)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp del: NEGc.simps)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp del: NEGc.simps)\n apply(rule allI)+\n apply(rule impI)\n apply(simp del: NEGc.simps add: psubst_nsubst[symmetric])\n apply(rotate_tac 12)\n apply(drule_tac x=\"(x,aa,Pa)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(rule ncloses_subset)\n apply(assumption)\n apply(blast)\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(drule meta_mp)\n apply(assumption)\n apply(assumption)\n apply(blast)\n done\nnext\n case (TImpR a \\ b x \\ B M C \\' \\_n \\_c)\n then show ?case\n apply(simp)\n apply(subgoal_tac \"(b,B IMP C) \\ set \\'\")\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(simp)\n apply(generate_fresh \"coname\")\n apply(fresh_fun_simp)\n apply(rule_tac B=\"B IMP C\" in CUT_SNa)\n apply(simp)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"c\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule conjI)\n apply(rule fic.intros)\n apply(simp add: abs_fresh fresh_prod fresh_atm)\n apply(rule psubst_fresh_coname)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(rule conjI)\n apply(rule allI)+\n apply(rule impI)\n apply(simp add: psubst_csubst[symmetric])\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,((a,z,Pa)#\\_c)\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(rule_tac t=\"\\_n,((a,z,Pa)#\\_c){x:=.Pb}\" and \n s=\"((x,aa,Pb)#\\_n),((a,z,Pa)#\\_c)\" in subst)\n apply(rule psubst_nsubst)\n apply(simp add: fresh_prod fresh_atm fresh_list_cons)\n apply(drule_tac x=\"(x,aa,Pb)#\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,z,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(assumption)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(auto intro: fresh_subset simp del: NEGc.simps)[1]\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(rule allI)+\n apply(rule impI)\n apply(simp add: psubst_nsubst[symmetric])\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"((x,ca,Q)#\\_n),\\_c\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(rule_tac t=\"((x,ca,Q)#\\_n),\\_c{a:=(xaa).Pa}\" and \n s=\"((x,ca,Q)#\\_n),((a,xaa,Pa)#\\_c)\" in subst)\n apply(rule psubst_csubst)\n apply(simp add: fresh_prod fresh_atm fresh_list_cons)\n apply(drule_tac x=\"(x,ca,Q)#\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xaa,Pa)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(assumption)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(drule meta_mp)\n apply(rule ccloses_extend)\n apply(rule ccloses_subset)\n apply(assumption)\n apply(blast)\n apply(auto intro: fresh_subset simp del: NEGc.simps)[1]\n apply(simp)\n apply(simp)\n apply(assumption)\n apply(simp)\n apply(blast)\n done\nnext\n case (TCut a \\ N x \\ M B \\_n \\_c)\n then show ?case \n apply -\n apply(case_tac \"\\y. M\\Ax y a\")\n apply(case_tac \"\\c. N\\Ax x c\")\n apply(simp)\n apply(rule_tac B=\"B\" in CUT_SNa)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)\n apply(rule allI)\n apply(rule impI)\n apply(simp add: psubst_csubst[symmetric]) (*?*)\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,P)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend) \n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)\n apply(rule allI)\n apply(rule impI)\n apply(simp add: psubst_nsubst[symmetric]) (*?*)\n apply(rotate_tac 11)\n apply(drule_tac x=\"(x,aa,P)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(drule_tac meta_mp)\n apply(assumption)\n apply(assumption)\n (* cases at least one axiom *)\n apply(simp (no_asm_use))\n apply(erule exE)\n apply(simp del: psubst.simps)\n apply(drule typing_Ax_elim2)\n apply(auto simp add: trm.inject)[1]\n apply(rule_tac B=\"B\" in CUT_SNa)\n (* left term *)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGc_def)\n apply(simp)\n apply(rule_tac x=\"a\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)+\n apply(rule impI)\n apply(drule_tac x=\"\\_n\" in meta_spec)\n apply(drule_tac x=\"(a,xa,P)#\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(assumption)\n apply(drule meta_mp)\n apply(rule ccloses_extend) \n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(simp add: psubst_csubst[symmetric]) (*?*)\n (* right term -axiom *)\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(erule conjE)\n apply(frule_tac y=\"x\" in lookupd_cmaps)\n apply(drule cmaps_fresh)\n apply(assumption)\n apply(simp)\n apply(subgoal_tac \"(x):P[xa\\n>x] = (xa):P\")\n apply(simp)\n apply(simp add: ntrm.inject)\n apply(simp add: alpha fresh_prod fresh_atm)\n apply(rule sym)\n apply(rule nrename_swap)\n apply(simp)\n (* M is axiom *)\n apply(simp)\n apply(auto)[1]\n (* both are axioms *)\n apply(rule_tac B=\"B\" in CUT_SNa)\n apply(drule typing_Ax_elim1)\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(erule conjE)\n apply(frule_tac a=\"a\" in lookupc_nmaps)\n apply(drule_tac a=\"a\" in nmaps_fresh)\n apply(assumption)\n apply(simp)\n apply(subgoal_tac \":P[c\\c>a] = :P\")\n apply(simp)\n apply(simp add: ctrm.inject)\n apply(simp add: alpha fresh_prod fresh_atm)\n apply(rule sym)\n apply(rule crename_swap)\n apply(simp)\n apply(drule typing_Ax_elim2)\n apply(drule ccloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(erule conjE)\n apply(frule_tac y=\"x\" in lookupd_cmaps)\n apply(drule cmaps_fresh)\n apply(assumption)\n apply(simp)\n apply(subgoal_tac \"(x):P[xa\\n>x] = (xa):P\")\n apply(simp)\n apply(simp add: ntrm.inject)\n apply(simp add: alpha fresh_prod fresh_atm)\n apply(rule sym)\n apply(rule nrename_swap)\n apply(simp)\n (* N is not axioms *)\n apply(rule_tac B=\"B\" in CUT_SNa)\n (* left term *)\n apply(drule typing_Ax_elim1)\n apply(drule ncloses_elim)\n apply(assumption)\n apply(erule exE)+\n apply(erule conjE)\n apply(frule_tac a=\"a\" in lookupc_nmaps)\n apply(drule_tac a=\"a\" in nmaps_fresh)\n apply(assumption)\n apply(simp)\n apply(subgoal_tac \":P[c\\c>a] = :P\")\n apply(simp)\n apply(simp add: ctrm.inject)\n apply(simp add: alpha fresh_prod fresh_atm)\n apply(rule sym)\n apply(rule crename_swap)\n apply(simp)\n apply(rule BINDING_implies_CAND)\n apply(unfold BINDINGn_def)\n apply(simp)\n apply(rule_tac x=\"x\" in exI)\n apply(rule_tac x=\"\\_n,\\_c\" in exI)\n apply(simp)\n apply(rule allI)\n apply(rule allI)\n apply(rule impI)\n apply(simp add: psubst_nsubst[symmetric]) (*?*)\n apply(rotate_tac 10)\n apply(drule_tac x=\"(x,aa,P)#\\_n\" in meta_spec)\n apply(drule_tac x=\"\\_c\" in meta_spec)\n apply(drule meta_mp)\n apply(rule ncloses_extend)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(assumption)\n apply(drule_tac meta_mp)\n apply(assumption)\n apply(assumption)\n done\nqed\n\nprimrec \"idn\" :: \"(name\\ty) list\\coname\\(name\\coname\\trm) list\" where\n \"idn [] a = []\"\n| \"idn (p#\\) a = ((fst p),a,Ax (fst p) a)#(idn \\ a)\"\n\nprimrec \"idc\" :: \"(coname\\ty) list\\name\\(coname\\name\\trm) list\" where\n \"idc [] x = []\"\n| \"idc (p#\\) x = ((fst p),x,Ax x (fst p))#(idc \\ x)\"\n\nlemma idn_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(idn \\ a)) = idn (pi1\\\\) (pi1\\a)\"\n and \"(pi2\\(idn \\ a)) = idn (pi2\\\\) (pi2\\a)\"\napply(induct \\)\napply(auto)\ndone\n\nlemma idc_eqvt[eqvt]:\n fixes pi1::\"name prm\"\n and pi2::\"coname prm\"\n shows \"(pi1\\(idc \\ x)) = idc (pi1\\\\) (pi1\\x)\"\n and \"(pi2\\(idc \\ x)) = idc (pi2\\\\) (pi2\\x)\"\napply(induct \\)\napply(auto)\ndone\n\nlemma ccloses_id:\n shows \"(idc \\ x) ccloses \\\"\napply(induct \\)\napply(auto simp add: ccloses_def)\napply(rule Ax_in_CANDs)\napply(rule Ax_in_CANDs)\ndone\n\nlemma ncloses_id:\n shows \"(idn \\ a) ncloses \\\"\napply(induct \\)\napply(auto simp add: ncloses_def)\napply(rule Ax_in_CANDs)\napply(rule Ax_in_CANDs)\ndone\n\nlemma fresh_idn:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\\\ \\ x\\idn \\ a\"\n and \"a\\(\\,b) \\ a\\idn \\ b\"\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_list_nil fresh_atm fresh_prod)\ndone\n\nlemma fresh_idc:\n fixes x::\"name\"\n and a::\"coname\"\n shows \"x\\(\\,y) \\ x\\idc \\ y\"\n and \"a\\\\ \\ a\\idc \\ y\"\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_list_nil fresh_atm fresh_prod)\ndone\n\nlemma idc_cmaps:\n assumes a: \"idc \\ y cmaps b to Some (x,M)\"\n shows \"M=Ax x b\"\nusing a\napply(induct \\)\napply(auto)\napply(case_tac \"b=a\")\napply(auto)\ndone\n\nlemma idn_nmaps:\n assumes a: \"idn \\ a nmaps x to Some (b,M)\"\n shows \"M=Ax x b\"\nusing a\napply(induct \\)\napply(auto)\napply(case_tac \"aa=x\")\napply(auto)\ndone\n\nlemma lookup1:\n assumes a: \"x\\(idn \\ b)\"\n shows \"lookup x a (idn \\ b) \\_c = lookupa x a \\_c\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma lookup2:\n assumes a: \"\\(x\\(idn \\ b))\"\n shows \"lookup x a (idn \\ b) \\_c = lookupb x a \\_c b (Ax x b)\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma lookup3:\n assumes a: \"a\\(idc \\ y)\"\n shows \"lookupa x a (idc \\ y) = Ax x a\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm)\ndone\n\nlemma lookup4:\n assumes a: \"\\(a\\(idc \\ y))\"\n shows \"lookupa x a (idc \\ y) = Cut .(Ax x a) (y).Ax y a\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma lookup5:\n assumes a: \"a\\(idc \\ y)\"\n shows \"lookupb x a (idc \\ y) c P = Cut .P (x).Ax x a\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma lookup6:\n assumes a: \"\\(a\\(idc \\ y))\"\n shows \"lookupb x a (idc \\ y) c P = Cut .P (y).Ax y a\"\nusing a\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma lookup7:\n shows \"lookupc x a (idn \\ b) = Ax x a\"\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma lookup8:\n shows \"lookupd x a (idc \\ y) = Ax x a\"\napply(induct \\)\napply(auto simp add: fresh_list_cons fresh_prod fresh_atm fresh_list_nil)\ndone\n\nlemma id_redu:\n shows \"(idn \\ x),(idc \\ a) \\\\<^sub>a* M\"\napply(nominal_induct M avoiding: \\ \\ x a rule: trm.strong_induct)\napply(auto)\n(* Ax *)\napply(case_tac \"name\\(idn \\ x)\")\napply(simp add: lookup1)\napply(case_tac \"coname\\(idc \\ a)\")\napply(simp add: lookup3)\napply(simp add: lookup4)\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp)\napply(simp add: lookup2)\napply(case_tac \"coname\\(idc \\ a)\")\napply(simp add: lookup5)\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp)\napply(simp add: lookup6)\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp)\n(* Cut *)\napply(auto simp add: fresh_idn fresh_idc psubst_fresh_name psubst_fresh_coname fresh_atm fresh_prod )[1]\napply(simp add: lookup7 lookup8)\napply(simp add: lookup7 lookup8)\napply(simp add: a_star_Cut)\napply(simp add: lookup7 lookup8)\napply(simp add: a_star_Cut)\napply(simp add: a_star_Cut)\n(* NotR *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findc (idc \\ a) coname\")\napply(simp)\napply(simp add: a_star_NotR)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(drule idc_cmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(assumption)\napply(simp add: crename_fresh)\napply(simp add: a_star_NotR)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* NotL *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findn (idn \\ x) name\")\napply(simp)\napply(simp add: a_star_NotL)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(drule idn_nmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxL_intro)\napply(rule fin.intros)\napply(assumption)\napply(simp add: nrename_fresh)\napply(simp add: a_star_NotL)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* AndR *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findc (idc \\ a) coname3\")\napply(simp)\napply(simp add: a_star_AndR)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(drule idc_cmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(auto simp add: fresh_idn fresh_idc psubst_fresh_name crename_fresh fresh_atm fresh_prod )[1]\napply(rule aux3)\napply(rule crename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp add: fresh_prod fresh_atm)\napply(rule fresh_idc)\napply(simp)\napply(simp)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp add: fresh_prod fresh_atm)\napply(rule fresh_idc)\napply(simp)\napply(simp)\napply(simp)\napply(simp)\napply(simp add: crename_fresh)\napply(simp add: a_star_AndR)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* AndL1 *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findn (idn \\ x) name2\")\napply(simp)\napply(simp add: a_star_AndL1)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(drule idn_nmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxL_intro)\napply(rule fin.intros)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule nrename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(simp)\napply(simp add: nrename_fresh)\napply(simp add: a_star_AndL1)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* AndL2 *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findn (idn \\ x) name2\")\napply(simp)\napply(simp add: a_star_AndL2)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(drule idn_nmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxL_intro)\napply(rule fin.intros)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule nrename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(simp)\napply(simp add: nrename_fresh)\napply(simp add: a_star_AndL2)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* OrR1 *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findc (idc \\ a) coname2\")\napply(simp)\napply(simp add: a_star_OrR1)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(drule idc_cmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule crename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(simp)\napply(simp add: crename_fresh)\napply(simp add: a_star_OrR1)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* OrR2 *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findc (idc \\ a) coname2\")\napply(simp)\napply(simp add: a_star_OrR2)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(drule idc_cmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule crename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(simp)\napply(simp add: crename_fresh)\napply(simp add: a_star_OrR2)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* OrL *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findn (idn \\ x) name3\")\napply(simp)\napply(simp add: a_star_OrL)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(drule idn_nmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxL_intro)\napply(rule fin.intros)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule nrename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(simp)\napply(simp)\napply(simp add: nrename_fresh)\napply(simp add: a_star_OrL)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* ImpR *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findc (idc \\ a) coname2\")\napply(simp)\napply(simp add: a_star_ImpR)\napply(auto)[1]\napply(generate_fresh \"coname\")\napply(fresh_fun_simp)\napply(drule idc_cmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxR_intro)\napply(rule fic.intros)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule crename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(simp)\napply(simp add: crename_fresh)\napply(simp add: a_star_ImpR)\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\n(* ImpL *)\napply(simp add: fresh_idn fresh_idc)\napply(case_tac \"findn (idn \\ x) name2\")\napply(simp)\napply(simp add: a_star_ImpL)\napply(auto)[1]\napply(generate_fresh \"name\")\napply(fresh_fun_simp)\napply(drule idn_nmaps)\napply(simp)\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(subgoal_tac \"c\\idn \\ x,idc \\ a\")\napply(rule a_star_trans)\napply(rule a_starI)\napply(rule al_redu)\napply(rule better_LAxL_intro)\napply(rule fin.intros)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(rule aux3)\napply(rule nrename.simps)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_coname)\napply(rule fresh_idn)\napply(simp add: fresh_atm)\napply(rule fresh_idc)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(auto simp add: fresh_prod fresh_atm)[1]\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp add: fresh_prod fresh_atm)\napply(simp)\napply(simp)\napply(simp add: nrename_fresh)\napply(simp add: a_star_ImpL)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\napply(rule psubst_fresh_name)\napply(rule fresh_idn)\napply(simp)\napply(rule fresh_idc)\napply(simp)\napply(simp)\ndone\n\ntheorem ALL_SNa:\n assumes a: \"\\ \\ M \\ \\\"\n shows \"SNa M\"\nproof -\n fix x have \"(idc \\ x) ccloses \\\" by (simp add: ccloses_id)\n moreover\n fix a have \"(idn \\ a) ncloses \\\" by (simp add: ncloses_id)\n ultimately have \"SNa ((idn \\ a),(idc \\ x))\" using a by (simp add: all_CAND)\n moreover\n have \"((idn \\ a),(idc \\ x)) \\\\<^sub>a* M\" by (simp add: id_redu)\n ultimately show \"SNa M\" by (simp add: a_star_preserves_SNa)\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Nominal/Examples/Class3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.26271163403753856}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory SPRViewNonDetIndInit\nimports\n SPRView\n KBPsAuto\n SPRViewNonDet\nbegin\n(*>*)\n\nsubsubsection{*Perfect Recall in Independently-Initialised Non-deterministic Broadcast Environments*}\n\ntext{*\n\n\\label{sec:kbps-theory-spr-non-deterministic-protocols-ind-init}\n\nIf the private and environment parts of the initial states are\nindependent we can simplify the construction of the previous section\nand consider only sets of states rather than relations. This greatly\nreduces the state space that the algorithm traverses.\n\nWe capture this independence by adding some assumptions to the @{term\n\"FiniteBroadcastEnvironment\"} locale of\nFigure~\\ref{fig:kbps-theory-broadcast-envs}; the result is the @{term\n\"FiniteBroadcastEnvironmentIndependentInit\"} locale shown in\nFigure~\\ref{fig:kbps-theory-broadcast-envs-ind-init}. We ask that the\ninitial states be the Cartesian product of possible private and\nenvironment states; in other words there is nothing for the agents to\nlearn about correlations amongst the initial states. As there are\ninitially no public actions from the previous round, we use the @{term\n\"default\"} class to indicate that there is a fixed but arbitrary\nchoice to be made here.\n\nAgain we introduce common and agent-specific abstraction functions:\n\n\n*}\n\ntext_raw{*\n\\begin{figure}[ht]\n\\begin{isabellebody}%\n*}\nlocale FiniteBroadcastEnvironmentIndependentInit =\n FiniteBroadcastEnvironment jkbp envInit envAction envTrans envVal envObs\n envObsC envActionES envTransES\n for jkbp :: \"('a::finite, 'p, ('pPubAct::{default,finite} \\ 'ps::finite)) JKBP\"\n and envInit :: \"('a, 'ePubAct :: {default, finite}, 'es :: finite,\n 'pPubAct, 'ps) BEState list\"\n and envAction :: \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState\n \\ ('ePubAct \\ 'ePrivAct) list\"\n and envTrans :: \"('ePubAct \\ 'ePrivAct)\n \\ ('a \\ ('pPubAct \\ 'ps))\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState\"\n and envVal :: \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState \\ 'p \\ bool\"\n and envObs :: \"'a \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState\n \\ ('cobs \\ 'ps \\ ('ePubAct \\ ('a \\ 'pPubAct)))\"\n and envObsC :: \"'es \\ 'cobs\"\n and envActionES :: \"'es \\ ('ePubAct \\ ('a \\ 'pPubAct))\n \\ ('ePubAct \\ 'ePrivAct) list\"\n and envTransES :: \"('ePubAct \\ 'ePrivAct) \\ ('a \\ 'pPubAct)\n \\ 'es \\ 'es\"\n\n+ fixes agents :: \"'a list\"\n fixes envInitBits :: \"'es list \\ ('a \\ 'ps list)\"\n defines envInit_def:\n \"envInit \\ [ \\ es = esf, ps = psf, pubActs = (default, \\_. default) \\\n . psf \\ listToFuns (snd envInitBits) agents\n , esf \\ fst envInitBits ]\"\n assumes agents: \"set agents = UNIV\" \"distinct agents\"\n\ntext_raw{*\n \\end{isabellebody}%\n \\caption{Finite broadcast environments with non-deterministic\n KBPs, where the initial private and environment states are\n independent.}\n \\label{fig:kbps-theory-broadcast-envs-ind-init}\n\\end{figure}\n*}\n\ncontext FiniteBroadcastEnvironmentIndependentInit\nbegin\n\ndefinition\n tObsC_ii_abs :: \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState Trace\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState set\"\nwhere \"tObsC_ii_abs t \\\n { tLast t' |t'. t' \\ SPR.jkbpC \\ tObsC t' = tObsC t }\"\n\ndefinition\n agent_ii_abs :: \"'a \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState Trace\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState set\"\nwhere \"agent_ii_abs a t \\\n { tLast t' |t'. t' \\ SPR.jkbpC \\ spr_jview a t' = spr_jview a t }\"\n(*<*)\n\nlemma tObsC_ii_abs_jview_eq[dest, intro]:\n \"spr_jview a t' = spr_jview a t\n \\ tObsC_ii_abs t = tObsC_ii_abs t'\"\n unfolding tObsC_ii_abs_def by (fastforce dest: spr_jview_tObsC)\n\nlemma tObsC_ii_absI[intro]:\n \"\\ t' \\ SPR.jkbpC; tObsC t' = tObsC t; v = tLast t' \\\n \\ v \\ tObsC_ii_abs t\"\n unfolding tObsC_ii_abs_def by blast\n\nlemma tObsC_ii_abs_conv:\n \" v \\ tObsC_ii_abs t\n \\ (\\t'. t' \\ SPR.jkbpC \\ tObsC t' = tObsC t \\ v = tLast t')\"\n unfolding tObsC_ii_abs_def by blast\n\nlemma agent_ii_absI[elim]:\n \"\\ t' \\ SPR.jkbpC; spr_jview a t' = spr_jview a t; v = tLast t' \\\n \\ v \\ agent_ii_abs a t\"\n unfolding agent_ii_abs_def by blast\n\nlemma agent_ii_abs_tLastD[simp]:\n \"v \\ agent_ii_abs a t \\ envObs a v = envObs a (tLast t)\"\n unfolding agent_ii_abs_def by auto\n\nlemma agent_ii_abs_inv[dest]:\n \"v \\ agent_ii_abs a t\n \\ \\t'. t' \\ SPR.jkbpC \\ spr_jview a t' = spr_jview a t\n \\ v = tLast t'\"\n unfolding agent_ii_abs_def by blast\n\n(*>*)\ntext{*\n\nThe simulation is similar to the single-agent case\n(\\S\\ref{sec:kbps-spr-single-agent}); for a given canonical trace\n@{term \"t\"} it pairs the set of worlds that any agent considers\npossible with the final state of @{term \"t\"}:\n\n*}\n\ntype_synonym (in -) ('a, 'ePubAct, 'es, 'pPubAct, 'ps) SPRstate =\n \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState set\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState\"\n\ndefinition\n spr_ii_sim :: \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) BEState Trace\n \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) SPRstate\"\nwhere \"spr_ii_sim \\ \\t. (tObsC_ii_abs t, tLast t)\"\n(*<*)\n\nlemma spr_ii_sim_tFirst_tLast:\n \"\\ spr_ii_sim t = s; t \\ SPR.jkbpC \\ \\ snd s \\ fst s\"\n unfolding spr_ii_sim_def by auto\n\n(*>*)\ntext{*\n\nThe Kripke structure over simulated traces is also quite similar:\n\n*}\n\ndefinition\n spr_ii_simRels :: \"'a \\ ('a, 'ePubAct, 'es, 'pPubAct, 'ps) SPRstate Relation\"\nwhere \"spr_ii_simRels \\ \\a.\n { (s, s') |s s'. envObs a (snd s) = envObs a (snd s') \\ fst s = fst s' }\"\n\ndefinition\n spr_ii_simVal :: \"('a, 'ePubAct, 'es, 'pPubAct, 'ps) SPRstate \\ 'p \\ bool\"\nwhere \"spr_ii_simVal \\ envVal \\ snd\"\n\nabbreviation\n \"spr_ii_simMC \\ mkKripke (spr_ii_sim ` SPR.jkbpC) spr_ii_simRels spr_ii_simVal\"\n(*<*)\n\nlemma spr_ii_simVal_def2[iff]:\n \"spr_ii_simVal (spr_ii_sim t) = envVal (tLast t)\"\n unfolding spr_ii_sim_def spr_ii_simVal_def by simp\n\n(* Same as for SPRViewNonDet but different base case. *)\n\nlemma tSplice_jkbpC:\n assumes tt': \"{t, t'} \\ SPR.jkbpC\"\n assumes tObsC: \"tObsC t = tObsC t'\"\n shows \"t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t' \\ SPR.jkbpC\"\nusing tObsC_tLength[OF tObsC] tt' tObsC\nproof(induct rule: trace_induct2)\n case (tInit s s') thus ?case\n apply clarsimp\n unfolding envInit_def sSplice_def\n apply clarsimp\n apply (rule_tac x=\"x(a := xa a)\" in bexI)\n using listToFun_splice[OF agents]\n apply auto\n done\nnext\n case (tStep s s' t t')\n\n hence tt': \"t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t' \\ SPR.jkbpC\"\n and tLen: \"tLength t' = tLength t\"\n and tObsC: \"tObsC (t \\ s) = tObsC (t' \\ s')\"\n by auto\n\n hence tt'n: \"t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t' \\ SPR.jkbpCn (tLength t)\"\n by auto\n\n from tStep\n have ts: \"t \\ s \\ SPR.jkbpCn (Suc (tLength t))\"\n and t's': \"t' \\ s' \\ SPR.jkbpCn (Suc (tLength t'))\"\n apply -\n apply ((rule SPR.jkbpC_tLength_inv, simp_all)[1])+\n done\n\n from ts obtain eact aact\n where eact: \"eact \\ set (envAction (tLast t))\"\n and aact: \"\\a. aact a \\ set (jAction (SPR.mkM (SPR.jkbpCn (tLength t))) t a)\"\n and trans: \"envTrans eact aact (tLast t) = s\"\n apply (auto iff: Let_def)\n done\n\n from t's' obtain eact' aact'\n where eact': \"eact' \\ set (envAction (tLast t'))\"\n and aact': \"\\a. aact' a \\ set (jAction (SPR.mkM (SPR.jkbpCn (tLength t'))) t' a)\"\n and trans': \"envTrans eact' aact' (tLast t') = s'\"\n apply (auto iff: Let_def)\n done\n\n def aact'' \\ \"aact (a := aact' a)\"\n\n from tObsC trans trans'\n have aact''_fst: \"fst \\ aact'' = fst \\ aact\"\n unfolding envTrans_def aact''_def\n apply -\n apply (rule ext)\n apply (auto iff: tObsC_tStep)\n apply (erule o_eq_elim)\n apply simp\n done\n\n from tObsC trans trans'\n have aact''_snd: \"snd \\ aact'' = (snd \\ aact)(a := ps s' a)\"\n unfolding envTrans_def aact''_def\n apply -\n apply (rule ext)\n apply auto\n done\n\n have \"envTrans eact aact'' (tLast (t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t'))\n = sSplice a (envTrans eact aact (tLast t)) s'\"\n unfolding envTrans_def sSplice_def\n using tSplice_es[OF tLen[symmetric]] aact''_fst aact''_snd\n apply clarsimp\n done\n\n moreover\n\n { fix a'\n have \"aact'' a' \\ set (jAction (SPR.mkM (SPR.jkbpCn (tLength t))) (t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t') a')\"\n proof(cases \"a' = a\")\n case False\n with tStep have \"jAction (SPR.mkM (SPR.jkbpCn (tLength t))) (t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t') a'\n = jAction (SPR.mkM (SPR.jkbpCn (tLength t))) t a'\"\n apply -\n apply (rule S5n_jAction_eq)\n apply simp\n unfolding SPR.mkM_def\n using tSplice_spr_jview_not_a tt'\n apply auto\n done\n with False aact show ?thesis\n unfolding aact''_def by simp\n next\n case True\n with tStep have \"jAction (SPR.mkM (SPR.jkbpCn (tLength t))) (t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t') a\n = jAction (SPR.mkM (SPR.jkbpCn (tLength t))) t' a\"\n apply -\n apply (rule S5n_jAction_eq)\n apply simp\n unfolding SPR.mkM_def\n using tSplice_spr_jview_a tt'\n apply auto\n done\n with True aact' tLen show ?thesis\n unfolding aact''_def by simp\n qed }\n\n moreover\n\n from tStep have \"envAction (tLast (t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t')) = envAction (tLast t)\"\n using tSplice_envAction by blast\n\n moreover note eact trans tt'n\n\n ultimately have \"(t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> t') \\ sSplice a s s' \\ SPR.jkbpCn (Suc (tLength t))\"\n apply (simp add: Let_def del: split_paired_Ex)\n apply (rule exI[where x=\"eact\"])\n apply (rule exI[where x=\"aact''\"])\n apply simp\n done\n\n thus ?case\n apply (simp only: tZip.simps)\n apply blast\n done\nqed\n\nlemma spr_ii_sim_r:\n \"sim_r SPR.MC spr_ii_simMC spr_ii_sim\"\nproof(rule sim_rI)\n fix a p q'\n assume pT: \"p \\ worlds SPR.MC\"\n and fpq': \"(spr_ii_sim p, q') \\ relations spr_ii_simMC a\"\n from fpq' obtain vq\n where q': \"q' = (tObsC_ii_abs p, vq)\"\n and vq: \"envObs a (tLast p) = envObs a vq\"\n unfolding mkKripke_def spr_ii_sim_def spr_ii_simRels_def\n by fastforce\n\n from fpq' have \"q' \\ worlds spr_ii_simMC\" by simp\n with q' have \"vq \\ tObsC_ii_abs p\"\n using spr_ii_sim_tFirst_tLast[where s=q']\n apply auto\n done\n\n then obtain t\n where tT: \"t \\ SPR.jkbpC\"\n and tp: \"tObsC t = tObsC p\"\n and tvq: \"tLast t = vq\"\n by (auto iff: tObsC_ii_abs_conv)\n\n def q \\ \"t \\<^bsub>\\<^esub>\\\\<^bsub>a\\<^esub> p\"\n\n from tp\n have \"spr_jview a p = spr_jview a q\"\n unfolding q_def by (simp add: tSplice_spr_jview_a)\n\n with pT tT tp\n have pt: \"(p, q) \\ relations SPR.MC a\"\n unfolding SPR.mkM_def q_def by (simp add: tSplice_jkbpC)\n from q' vq tp tvq\n have ftq': \"spr_ii_sim q = q'\"\n unfolding spr_ii_sim_def q_def\n using tSplice_tObsC[where a=a and t=t and t'=p]\n apply clarsimp\n apply (intro conjI)\n apply (auto dest: tObsC_tLength)[2]\n unfolding tObsC_ii_abs_def (* FIXME abstract *)\n apply auto\n done\n from pt ftq'\n show \"\\q. (p, q) \\ relations SPR.MC a \\ spr_ii_sim q = q'\"\n by blast\nqed\n\n(*>*)\ntext{*\n\nThe proofs that this simulation is adequate are similar to those in\nthe previous section. We elide the details.\n\n*}\n\nlemma spr_ii_sim: \"sim SPR.MC spr_ii_simMC spr_ii_sim\"\n(*<*)\nproof\n show \"sim_range SPR.MC spr_ii_simMC spr_ii_sim\"\n by (rule sim_rangeI) (simp_all add: spr_ii_sim_def)\nnext\n show \"sim_val SPR.MC spr_ii_simMC spr_ii_sim\"\n by (rule sim_valI) simp\nnext\n show \"sim_f SPR.MC spr_ii_simMC spr_ii_sim\"\n unfolding spr_ii_simRels_def spr_ii_sim_def mkKripke_def SPR.mkM_def\n by (rule sim_fI, auto simp del: split_paired_Ex)\nnext\n show \"sim_r SPR.MC spr_ii_simMC spr_ii_sim\"\n by (rule spr_ii_sim_r)\nqed\n(*>*)\n\nend (* context FiniteBroadcastEnvironment *)\n\nsublocale FiniteBroadcastEnvironmentIndependentInit\n < SPRii!: SimIncrEnvironment jkbp envInit envAction envTrans envVal\n spr_jview envObs spr_jviewInit spr_jviewIncr\n spr_ii_sim spr_ii_simRels spr_ii_simVal\n(*<*)\n by default (simp add: spr_ii_sim)\n\nend\n(*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/KBPs/SPRViewNonDetIndInit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2627116273019328}} {"text": "theory Decision_NCPC\nimports \"../Observation_Setup\" Decision_Value_Setup \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\Confidentiality protection from non-PC-members\\\n\ntext \\We verify the following property:\n\n\\ \\\\\nA group of users UIDs learn\nnothing about the various updates of a paper's decision\nexcept for the last edited version\nunless/until\na user in UIDs becomes PC member in the paper's conference having no conflict with that paper\nand the conference moves to the decision stage.\n\n\\ \\\\\n\\\n\n(* perhaps this should further strengthened *)\n\nfun T :: \"(state,act,out) trans \\ bool\" where\n\"T (Trans _ _ ou s') =\n (\\ uid \\ UIDs. \\ cid.\n PID \\\\ paperIDs s' cid \\ isPC s' cid uid \\ pref s' uid PID \\ Conflict \\\n phase s' cid \\ disPH\n )\"\n\ndeclare T.simps [simp del]\n\ndefinition B :: \"value list \\ value list \\ bool\" where\n\"B vl vl1 \\ vl \\ [] \\ vl1 \\ [] \\ last vl = last vl1\"\n\ninterpretation BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nlemma reachNT_non_isPC_isChair:\nassumes \"reachNT s\" and \"uid \\ UIDs\"\nshows\n\"(PID \\\\ paperIDs s cid \\ isPC s cid uid \\ phase s cid \\ disPH \\ pref s uid PID = Conflict) \\\n (PID \\\\ paperIDs s cid \\ isChair s cid uid \\ phase s cid \\ disPH \\ pref s uid PID = Conflict)\"\n using assms\n apply induct\n apply (auto simp: istate_def)[]\n apply(intro conjI)\n subgoal for trn apply(cases trn, auto simp: T.simps reachNT_reach)[] .\n by (metis T.elims(3) isChair_isPC reachNT_reach reach.Step tgtOf_simps)\n\n(* important: *) lemma T_\\_\\:\nassumes 1: \"reachNT s\" and 2: \"step s a = (ou,s')\" \"\\ (Trans s a ou s')\"\nshows \"\\ \\ (Trans s a ou s')\"\nusing reachNT_non_isPC_isChair[OF 1] 2 unfolding T.simps \\_def2\nby (fastforce simp add: uu_defs)\n\nlemma eqExcPID2_eqExcPID:\n\"eqExcPID2 s s1 \\ eqExcPID s s1\"\nunfolding eqExcPID_def eqExcPID2_def eeqExcPID_def eeqExcPID2_def eqExcD2 eqExcD by auto\n\n(* major *) lemma eqExcPID_step_out:\nassumes s's1': \"eqExcPID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sT: \"reachNT s\" and s1: \"reach s1\"\nand PID: \"PID \\\\ paperIDs s cid\"\nand ph: \"phase s cid = disPH\"\nand UIDs: \"userOfA a \\ UIDs\"\nshows \"ou = ou1\"\nproof-\n note Inv = reachNT_non_isPC_isChair[OF sT UIDs]\n note eqs = eqExcPID_imp[OF s's1']\n note eqs' = eqExcPID_imp1[OF s's1']\n note s = reachNT_reach[OF sT]\n\n note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_def eeqExcPID_def eqExcD\n note * = step step1 eqs eqs' s s1 PID UIDs ph paperIDs_equals[OF s] Inv\n\n show ?thesis\n proof (cases a)\n case (Cact x1)\n then show ?thesis using * by (cases x1) auto\n next\n case (Uact x2)\n then show ?thesis using * by (cases x2) auto\n next\n case (UUact x3)\n then show ?thesis using * by (cases x3) auto\n next\n case (Ract x4)\n show ?thesis\n proof (cases x4)\n case (rMyReview x81 x82 x83 x84)\n then show ?thesis using * Ract by (auto simp add: getNthReview_def)\n next\n case (rReviews x91 x92 x93 x94)\n then show ?thesis using * Ract by (clarsimp; metis eqExcPID_imp2 s's1')\n next\n case (rDecs x101 x102 x103 x104)\n then show ?thesis using * Ract by (clarsimp; metis)\n next\n case (rFinalDec x131 x132 x133 x134)\n then show ?thesis using * Ract by (clarsimp; metis Suc_n_not_le_n)\n qed (use * Ract in auto)\n next\n case (Lact x5)\n then show ?thesis using * by (cases x5; auto; presburger)\n qed\nqed\n\n(* major *) lemma eqExcPID2_step_out:\nassumes ss1: \"eqExcPID2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sT: \"reachNT s\" and s1: \"reach s1\"\nand PID: \"PID \\\\ paperIDs s cid\"\nand ph: \"phase s cid \\ disPH\"\nand UIDs: \"userOfA a \\ UIDs\"\nand decs_exit: \"decsPaper (paper s PID) \\ []\" \"decsPaper (paper s1 PID) \\ []\"\nshows \"ou = ou1\"\nproof-\n note Inv = reachNT_non_isPC_isChair[OF sT UIDs]\n note eqs = eqExcPID2_imp[OF ss1]\n note eqs' = eqExcPID2_imp1[OF ss1]\n note s = reachNT_reach[OF sT]\n\n have \"PID \\\\ paperIDs s1 cid\" using PID ss1 unfolding eqExcPID2_def by auto\n hence decs_exit': \"decsPaper (paper s' PID) \\ []\" \"decsPaper (paper s1' PID) \\ []\"\n using nonempty_decsPaper_persist s s1 PID decs_exit step step1 by metis+\n\n note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID2_def eeqExcPID2_def eqExcD2\n note * = step step1 eqs eqs' s s1 PID UIDs ph paperIDs_equals[OF s] Inv\n\n show ?thesis\n proof (cases a)\n case (Cact x1)\n then show ?thesis using * by (cases x1) auto\n next\n case (Uact x2)\n then show ?thesis using * by (cases x2) auto\n next\n case (UUact x3)\n then show ?thesis using * by (cases x3) auto\n next\n case (Ract x4)\n show ?thesis\n proof (cases x4)\n case (rMyReview x81 x82 x83 x84)\n then show ?thesis using * Ract by (auto simp add: getNthReview_def)\n next\n case (rReviews x91 x92 x93 x94)\n then show ?thesis using * Ract by (clarsimp; metis eqExcPID2_imp2 ss1)\n next\n case (rDecs x101 x102 x103 x104)\n then show ?thesis using * Ract by (clarsimp; metis)\n next\n case (rFinalDec x131 x132 x133 x134)\n then show ?thesis using * Ract by (clarsimp; metis decs_exit' list.sel(1) list.simps(5) neq_Nil_conv)\n qed (use * Ract in auto)\n next\n case (Lact x5)\n then show ?thesis using * by (cases x5; auto; presburger)\n qed\nqed\n\nlemma eqExcPID_step_eqExcPID2:\nassumes a: \"a = UUact (uuDec cid uid p PID dec)\"\nand ss1: \"eqExcPID s s1\"\nand step: \"step s a = (outOK,s')\" and step1: \"step s1 a = (outOK,s1')\"\nand s: \"reach s\" \"reach s1\" and PID: \"PID \\\\ paperIDs s cid\" and ph: \"phase s cid < notifPH\"\nshows \"eqExcPID2 s' s1'\"\nproof-\n have \"eqExcPID s' s1'\" using assms by (metis eqExcPID_step)\n moreover have \"hd (decsPaper (paper s' PID)) = hd (decsPaper (paper s1' PID))\"\n using step step1 unfolding a\n apply(simp add: uu_defs)\n by (metis decsPaper.simps fun_upd_same list.sel(1) select_convs(8) surjective update_convs(8))\n ultimately show ?thesis\n unfolding eqExcPID_def eqExcPID2_def eeqExcPID_def eeqExcPID2_def eqExcD2 eqExcD by auto\nqed\n\n(* major *) lemma eqExcPID_step_\\_eqExcPID2:\nassumes ss1: \"eqExcPID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand \\: \"\\ (Trans s a ou s')\"\nand s: \"reach s\" \"reach s1\" and PID: \"PID \\\\ paperIDs s cid\" and ph: \"phase s cid \\ disPH\"\nshows \"eqExcPID2 s' s1'\"\nproof-\n obtain cid1 uid p dec where a: \"a = UUact (uuDec cid1 uid p PID dec)\" and ou: \"ou = outOK\"\n using \\ unfolding \\_def2 by auto\n have PID1: \"PID \\\\ paperIDs s cid1\" using step unfolding a ou by (auto simp: uu_defs)\n hence cid1: \"cid1 = cid\" using paperIDs_equals[OF s(1) PID] by auto\n have \\1: \"\\ (Trans s1 a ou1 s1')\" using \\ ss1 by (metis eqExcPID_step_\\_imp step step1)\n hence ou1: \"ou1 = outOK\" using \\ unfolding \\_def2 by auto\n show ?thesis\n using eqExcPID_step_eqExcPID2[OF a ss1 step[unfolded ou] step1[unfolded ou1] s]\n PID ph unfolding cid1 by auto\nqed\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < disPH) \\\n s = s1 \\ B vl vl1\"\n(* \"Critical phase not yet reached: either PID not yet registered\n or the phase of its conference not yet submission \" *)\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\\n \\ cid uid.\n PID \\\\ paperIDs s cid \\ phase s cid = disPH \\\n isChair s cid uid \\ pref s uid PID \\ Conflict \\\n eqExcPID s s1 \\ B vl vl1\"\n(* \"PID registered to a conference which is in the discussion phase, values not completely flushed,\n state equality only up to the decision for PID which is a singleton list;\n assumption that there exists at least a non-conflict chair of the conference\n (the situation when no such chair exists is covered by \\e,\n since then vl cannot be flushed)\" *)\n\ndefinition \\3 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\3 s vl s1 vl1 \\\n \\ cid.\n PID \\\\ paperIDs s cid \\ phase s cid \\ disPH \\\n decsPaper (paper s PID) \\ [] \\ decsPaper (paper s1 PID) \\ [] \\ eqExcPID2 s s1 \\\n vl = [] \\ vl1 = []\"\n(* \"During or after discussion, values flushed,\n state equality a bit tighter: up to the tail of the decision list (so strict equality on the head,\n which is the only thing a potential author may see);\n the list of decisions also have to be nonempty in order\n for eqExcPID2 to be preserved by transitions\" *)\n\ndefinition \\e :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\e s vl s1 vl1 \\\n vl \\ [] \\\n ((\\ cid. PID \\\\ paperIDs s cid \\ phase s cid > disPH)\n \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid \\ disPH \\\n \\ (\\ uid. isChair s cid uid \\ pref s uid PID \\ Conflict))\n )\"\n\nlemma istate_\\1:\nassumes B: \"B vl vl1\"\nshows \"\\1 istate vl istate vl1\"\nusing B unfolding \\1_def B_def istate_def by auto\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1,\\2,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\2 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\1 s vl s1 vl1\"\n hence rs: \"reach s\" and ss1: \"s1 = s\"\n and vl: \"vl \\ []\" and vl1: \"vl1 \\ []\" and vl_vl1: \"last vl1 = last vl\"\n and ph_PID: \"\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < disPH\"\n using reachNT_reach unfolding \\1_def B_def by auto\n note vlvl1 = vl vl1 vl_vl1\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have \\: \"\\ \\ ?trn\"\n proof (cases a)\n case (UUact x3)\n then show ?thesis\n using step ph_PID\n by (cases x3; fastforce simp: uu_defs)\n qed auto\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\ by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1\"\n proof(cases \"\\ cid. PID \\\\ paperIDs s cid\")\n case False note PID = False\n have ph_PID': \"\\ cid. PID \\\\ paperIDs s' cid \\ phase s' cid < disPH\" using PID step rs\n apply(cases a)\n subgoal for _ x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for _ x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for _ x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using ph_PID' vlvl1 by auto\n thus ?thesis by auto\n next\n case True\n then obtain CID where PID: \"PID \\\\ paperIDs s CID\" by auto\n hence ph: \"phase s CID < disPH\" using ph_PID by auto\n have PID': \"PID \\\\ paperIDs s' CID\" by (metis PID paperIDs_mono step)\n show ?thesis\n proof(cases \"phase s' CID < disPH\")\n case True note ph' = True\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using vlvl1 ph' PID'\n by (auto; metis reach_PairI paperIDs_equals rs step)\n thus ?thesis by auto\n next\n case False note ph' = False\n hence ph': \"phase s' CID = disPH\" using ph PID step rs\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n show ?thesis\n proof(cases \"\\uid. isChair s' CID uid \\ pref s' uid PID \\ Conflict\")\n case True\n hence \"\\2 s' vl' s' vl1\" unfolding \\2_def B_def vl' using vlvl1 ph' PID' by auto\n thus ?thesis by auto\n next\n case False\n hence \"\\e s' vl' s' vl1\" unfolding \\e_def vl' using vlvl1 ph' PID' by auto\n thus ?thesis by auto\n qed\n qed\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by auto\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2,\\3,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\3 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\2 s vl s1 vl1\"\n then obtain CID uid where uid: \"isChair s CID uid\" \"pref s uid PID \\ Conflict\"\n and rs: \"reach s\" and ph: \"phase s CID = disPH\" (is \"?ph = _\")\n and PID: \"PID \\\\ paperIDs s CID\" and ss1: \"eqExcPID s s1\"\n and vl: \"vl \\ []\" and vl1: \"vl1 \\ []\" and vl_vl1: \"last vl = last vl1\"\n using reachNT_reach unfolding \\2_def B_def by auto\n note vlvl1 = vl vl1 vl_vl1\n from vl vl1 obtain v vl' v1 vl1' where vl: \"vl = v # vl'\" and vl1: \"vl1 = v1 # vl1'\" by (metis list.exhaust)\n have uid_notin: \"uid \\ UIDs\"\n using ph uid reachNT_non_isPC_isChair[OF rsT] PID by fastforce\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases \"vl1' = []\")\n case False note vl1' = False\n hence vl_vl1': \"last vl = last vl1'\" using vl_vl1 unfolding vl1 by simp\n have uid1: \"isChair s1 CID uid\" \"pref s1 uid PID \\ Conflict\" using ss1 uid unfolding eqExcPID_def by auto\n define a1 where \"a1 \\ UUact (uuDec CID uid (pass s uid) PID v1)\"\n obtain s1' ou1 where step1: \"step s1 a1 = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have s1s1': \"eqExcPID s1 s1'\" using a1_def step1 UUact_uuDec_step_eqExcPID by auto\n have ss1': \"eqExcPID s s1'\" using eqExcPID_trans[OF ss1 s1s1'] .\n hence many_s1': \"PID \\\\ paperIDs s1' CID\" \"isChair s1' CID uid\"\n \"pref s1' uid PID \\ Conflict\" \"phase s1' CID = disPH\"\n \"pass s1' uid = pass s uid\"\n using uid PID ph unfolding eqExcPID_def by auto\n hence more_s1': \"uid \\\\ userIDs s1'\" \"CID \\\\ confIDs s1'\"\n by (metis paperIDs_confIDs reach_PairI roles_userIDs rs1 step1 many_s1'(1))+\n have f: \"f ?trn1 = v1\" unfolding a1_def by simp\n have rs1': \"reach s1'\" using rs1 step1 by (auto intro: reach_PairI)\n have ou1: \"ou1 = outOK\"\n using step1 uid1 ph unfolding a1_def by (auto simp add: uu_defs many_s1' more_s1')\n have ?iact proof\n show \"step s1 a1 = (ou1,s1')\" by fact\n next\n show \\: \"\\ ?trn1\" using ou1 unfolding a1_def by simp\n thus \"consume ?trn1 vl1 vl1'\" using f unfolding consume_def vl1 by simp\n next\n show \"\\ \\ ?trn1\" by (simp add: a1_def uid_notin)\n next\n have \"\\2 s vl s1' vl1'\" unfolding \\2_def B_def using ph PID ss1' uid vl_vl1' vl1' vl by auto\n thus \"?\\ s vl s1' vl1'\" by simp\n qed\n thus ?thesis by auto\n next\n case True hence vl1: \"vl1 = [v1]\" unfolding vl1 by simp\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vll'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vll'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have uid': \"isChair s' CID uid \\ pref s' uid PID \\ Conflict\"\n using uid step rs ph PID pref_Conflict_disPH isChair_persistent by auto\n show \"match ?\\ s s1 vl1 a ou s' vll' \\ ignore ?\\ s s1 vl1 a ou s' vll'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case False note \\ = False\n have vll': \"vll' = vl\" using c \\ unfolding consume_def by (cases vl) auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID s' s1'\" using eqExcPID_step[OF ss1 step] step1 rs rs1 PID ph by auto\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID_step_\\[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_step_out[OF ss1 step step1 rsT rs1 PID ph] by simp\n (* note that in this setting eqExcPID_step_out needs the additional phase assumption *)\n next\n show \"?\\ s' vll' s1' vl1\"\n proof(cases \"?ph' = disPH\")\n case True\n hence \"\\2 s' vll' s1' vl1\" using PID' s's1' uid' vlvl1 unfolding \\2_def B_def vll' by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > disPH\" using ph rs step by (metis le_less phase_increases)\n hence \"\\e s' vll' s1' vl1\" unfolding \\e_def vll' using vlvl1 PID' by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by simp\n next\n case True note \\ = True\n hence vll': \"vll' = vl'\" using c unfolding vl consume_def by simp\n obtain cid uid p where a: \"a = UUact (uuDec cid uid p PID v)\" and ou: \"ou = outOK\"\n using \\ c PID unfolding vl consume_def \\_def2 vll' by fastforce\n (* hence cid: \"cid = CID\" using step PID rs by (auto simp add: uu_defs paperIDs_equals) *)\n hence \\: \"\\ \\ ?trn\" using step T rsT by (metis T_\\_\\ True)\n hence f: \"f ?trn = v\" using c \\ unfolding consume_def vl by auto\n have s's: \"eqExcPID s' s\" using eqExcPID_sym[OF \\_step_eqExcPID[OF \\ step]] .\n have s's1: \"eqExcPID s' s1\" using eqExcPID_trans[OF s's ss1] .\n have ph': \"phase s' CID = disPH\" using s's ph unfolding eqExcPID_def by auto\n show ?thesis\n proof(cases \"vl' = []\")\n case False note vl' = False\n hence vl'_vl1: \"last vl' = last vl1\" using vl_vl1 unfolding vl by auto\n have ?ignore proof\n show \"\\ \\ ?trn\" by fact\n next\n show \"?\\ s' vll' s1 vl1\"\n proof(cases \"?ph' = disPH\")\n case True\n hence \"\\2 s' vll' s1 vl1\" using s's1 PID' uid' vl' vl1 vl_vl1 unfolding \\2_def B_def vl vll' by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > disPH\" using ph rs step by (metis le_less phase_increases)\n hence \"\\e s' vll' s1 vl1\" unfolding \\e_def vll' using vlvl1 vl' PID' by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by auto\n next\n case True note vl' = True hence vl: \"vl = [v]\" unfolding vl by simp\n(* the transition to \\3: \\ holds and both vl and vl1 are singletons: *)\n hence v1v: \"v1 = v\" using vl_vl1 unfolding vl1 by simp\n obtain s1' ou1 where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have \\1: \"\\ ?trn1\" using eqExcPID_step_\\_imp[OF ss1 step step1 \\] .\n hence ou1: \"ou1 = outOK\" unfolding \\_def2 by auto\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 []\" unfolding consume_def using \\1 by (simp add: a vl1 v1v)\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_step_out[OF ss1 step step1 rsT rs1 PID ph] by simp\n next\n have \"\\3 s' vll' s1' []\" unfolding vll' vl' \\3_def\n using PID' ph' eqExcPID_step_\\_eqExcPID2[OF ss1 step step1 \\ rs rs1 PID] ph\n using step step1 unfolding a by (auto simp: uu_defs ou ou1)\n thus \"?\\ s' vll' s1' []\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n qed\n thus ?thesis using vl by auto\n qed\nqed\n\nlemma unwind_cont_\\3: \"unwind_cont \\3 {\\3,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\3 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\3 s vl s1 vl1\"\n then obtain CID where rs: \"reach s\" and ph: \"phase s CID \\ disPH\" (is \"?ph \\ _\")\n and PID: \"PID \\\\ paperIDs s CID\"\n and decs: \"decsPaper (paper s PID) \\ []\" \"decsPaper (paper s1 PID) \\ []\"\n and ss1: \"eqExcPID2 s s1\" and vl: \"vl = []\" and vl1: \"vl1 = []\"\n using reachNT_reach unfolding \\3_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have \"?react\"\n proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have ph': \"phase s' CID \\ disPH\" using ph rs step by (meson dual_order.trans phase_increases)\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have \\: \"\\ \\ ?trn\" and vl': \"vl' = []\" using c unfolding consume_def vl by auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID2 s' s1'\" using eqExcPID2_step[OF ss1 step step1] .\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID2_step_\\[OF ss1 step step1] .\n have PID1: \"PID \\\\ paperIDs s1 CID\" using PID ss1 unfolding eqExcPID2_def by auto\n have decs': \"decsPaper (paper s' PID) \\ []\" \"decsPaper (paper s1' PID) \\ []\"\n by (metis PID PID1 decs nonempty_decsPaper_persist rs step rs1 step1)+\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID2_step_out[OF ss1 step step1 rsT rs1 PID ph _ decs] by simp\n next\n have \"\\3 s' vl' s1' vl1\" using ph' PID' s's1' unfolding \\3_def vl1 vl' by (auto simp: decs')\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\n(* Exit arguments: *)\ndefinition K1exit where\n\"K1exit cid s \\\n phase s cid \\ disPH \\ PID \\\\ paperIDs s cid \\ \\ (\\ uid. isChair s cid uid \\ pref s uid PID \\ Conflict)\"\n\nlemma invarNT_K1exit: \"invarNT (K1exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n subgoal for _ a apply(cases a)\n subgoal for x1 apply(cases x1)\n apply (fastforce simp add: c_defs K1exit_def geq_noPH_confIDs)+ .\n subgoal for x2 apply(cases x2)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n subgoal for x61 apply(cases \"x61 = cid\")\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)+ .\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals) .\n subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K1exit_def)+ .\n apply (fastforce simp add: uu_defs K1exit_def)+ .\ndone\n\nlemma noVal_K1exit: \"noVal (K1exit cid) v\"\napply(rule no\\_noVal)\nunfolding no\\_def apply safe\n subgoal for _ a apply(cases a)\n apply (fastforce simp add: c_defs K1exit_def)\n apply (fastforce simp add: c_defs K1exit_def)\n subgoal for x3 apply(cases x3) apply (auto simp add: uu_defs K1exit_def)\n apply (metis paperIDs_equals reachNT_reach) (* safety used *) .\n by auto\ndone\n\ndefinition K2exit where\n\"K2exit cid s \\ PID \\\\ paperIDs s cid \\ phase s cid > disPH\"\n\nlemma invarNT_K2exit: \"invarNT (K2exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n subgoal for _ a apply(cases a)\n subgoal for x1 apply(cases x1)\n apply (fastforce simp add: c_defs K2exit_def geq_noPH_confIDs)+ .\n subgoal for x2 apply(cases x2)\n apply (fastforce simp add: u_defs K2exit_def paperIDs_equals)+ .\n subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K2exit_def)+ .\n apply (fastforce simp add: uu_defs K2exit_def)+ .\ndone\n\nlemma noVal_K2exit: \"noVal (K2exit cid) v\"\napply(rule no\\_noVal)\nunfolding no\\_def apply safe\n subgoal for _ a apply(cases a)\n apply (fastforce simp add: c_defs K2exit_def)\n apply (fastforce simp add: c_defs K2exit_def)\n subgoal for x3 apply(cases x3) apply (auto simp add: uu_defs K2exit_def)\n using paperIDs_equals reachNT_reach apply fastforce (* safety used *) .\n by auto\ndone\n\nlemma unwind_exit_\\e: \"unwind_exit \\e\"\nproof\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\e: \"\\e s vl s1 vl1\"\n hence vl: \"vl \\ []\" using reachNT_reach unfolding \\e_def by auto\n then obtain CID where \"K1exit CID s \\ K2exit CID s\" using \\e unfolding K1exit_def K2exit_def \\e_def by auto\n thus \"vl \\ [] \\ exit s (hd vl)\" apply(simp add: vl)\n by (metis rsT exitI2 invarNT_K1exit noVal_K1exit invarNT_K2exit noVal_K2exit)\nqed\n\ntheorem secure: secure\napply(rule unwind_decomp3_secure[of \\1 \\2 \\e \\3])\nusing\nistate_\\1\nunwind_cont_\\1 unwind_cont_\\2 unwind_cont_\\3\nunwind_exit_\\e\nby auto\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Decision_Confidentiality/Decision_NCPC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.26271162730193276}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m3_ds.thy (Isabelle/HOL 2016-1)\n ID: $Id: m3_ds.thy 132890 2016-12-24 10:25:57Z csprenge $\n Authors: Christoph Sprenger, ETH Zurich \n Ivano Somaini, ETH Zurich \n\n Key distribution protocols\n Level 3: Denning-Sacco protocol\n\n Copyright (c) 2009-2016 Christoph Sprenger, Ivano Somaini\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Denning-Sacco protocol (L3)\\\n\ntheory m3_ds imports m2_ds \"../Refinement/Message\"\nbegin\n\ntext \\\nWe model the Denning-Sacco protocol:\n\\[\n\\begin{array}{lll}\n \\mathrm{M1.} & A \\rightarrow S: & A, B \\\\ \n \\mathrm{M2.} & S \\rightarrow A: & \\{Kab, B, Ts, Na, \\{Kab, A, Ts\\}_{Kbs} \\}_{Kas} \\\\\n \\mathrm{M3.} & A \\rightarrow B: & \\{Kab, A, Ts\\}_{Kbs}\n\\end{array}\n\\]\n\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\.\\\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\Setup\\\n(******************************************************************************)\n\ntext \\Now we can define the initial key knowledge.\\\n\noverloading ltkeySetup' \\ ltkeySetup begin\ndefinition ltkeySetup_def: \"ltkeySetup' \\ {(sharK C, A) | C A. A = C \\ A = Sv}\"\nend\n\nlemma corrKey_shrK_bad [simp]: \"corrKey = shrK`bad\"\nby (auto simp add: keySetup_def ltkeySetup_def corrKey_def)\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\The secure channels are star-shaped to/from the server. Therefore,\nwe have only one agent in the relation.\\\n\nrecord m3_state = \"m1_state\" +\n IK :: \"msg set\" \\ \\intruder knowledge\\\n\n\ntext \\Observable state:\n@{term \"runs\"}, @{term \"leak\"}, @{term \"clk\"}, and @{term \"cache\"}.\\\n\ntype_synonym\n m3_obs = \"m2_obs\"\n\ndefinition\n m3_obs :: \"m3_state \\ m3_obs\" where\n \"m3_obs s \\ \\ runs = runs s, leak = leak s, clk = clk s \\\"\n\ntype_synonym\n m3_pred = \"m3_state set\"\n\ntype_synonym\n m3_trans = \"(m3_state \\ m3_state) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext \\Protocol events.\\\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m2_step1\"}\\\n m3_step1 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step1 Ra A B \\ {(s, s1).\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n\n \\ \\actions:\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n IK := insert \\Agent A, Agent B\\ (IK s) \\ \\send \\M1\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m2_step2\"}\\\n m3_step2 :: \"[rid_t, agent, agent] \\ m3_trans\"\nwhere\n \"m3_step2 \\ m1_step2\"\n\ndefinition \\ \\by @{text \"Server\"}, refines @{term m2_step3}\\\n m3_step3 :: \"[rid_t, agent, agent, key, time] \\ m3_trans\"\nwhere\n \"m3_step3 Rs A B Kab Ts \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh server run\\\n Kab = sesK (Rs$sk) \\ \\ \\fresh session key\\\n\n \\Agent A, Agent B\\ \\ IK s \\ \\ \\recv \\M1\\\\\n Ts = clk s \\ \\ \\fresh timestamp\\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M2\\\\\n s1 = s\\\n runs := (runs s)(Rs \\ (Serv, [A, B], [aNum Ts])),\n IK := insert (Crypt (shrK A) \\ \\send \\M2\\\\\n \\Key Kab, Agent B, Number Ts,\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\\\)\n (IK s)\n \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term m2_step4}\\\n m3_step4 :: \"[rid_t, agent, agent, key, time, msg] \\ m3_trans\"\nwhere\n \"m3_step4 Ra A B Kab Ts X \\ {(s, s1).\n\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n Crypt (shrK A) \\ \\recv \\M2\\\\\n \\Key Kab, Agent B, Number Ts, X\\ \\ IK s \\\n\n \\ \\check freshness of session key\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key and send \\M3\\\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts])),\n IK := insert X (IK s) \\ \\send \\M3\\\\\n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m2_step5}\\\n m3_step5 :: \"[rid_t, agent, agent, key, time] \\ m3_trans\"\nwhere\n \"m3_step5 Rb A B Kab Ts \\ {(s, s1).\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \\ \\key not yet recv'd\\\n\n Crypt (shrK B) \\Key Kab, Agent A, Number Ts\\ \\ IK s \\ \\ \\recv \\M3\\\\\n\n \\ \\ensure freshness of session key; replays with fresh authenticator ok!\\\n clk s < Ts + Ls \\\n\n \\ \\actions:\\\n \\ \\record session key\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, aNum Ts]))\n \\\n }\"\n\n\ntext \\Clock tick event\\\n\ndefinition \\ \\refines @{term \"m2_tick\"}\\\n m3_tick :: \"time \\ m3_trans\"\nwhere\n \"m3_tick \\ m1_tick\"\n\n\ntext \\Session key compromise.\\\n\ndefinition \\ \\refines @{term m2_leak}\\\n m3_leak :: \"rid_t \\ m3_trans\"\nwhere\n \"m3_leak Rs \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\\n fst (the (runs s Rs)) = Serv \\ \\ \\compromise server run \\Rs\\\\\n\n \\ \\actions:\\\n \\ \\record session key as leaked and add it to intruder knowledge\\\n s1 = s\\ leak := insert (sesK (Rs$sk)) (leak s),\n IK := insert (Key (sesK (Rs$sk))) (IK s) \\\n }\"\n\n\ntext \\Intruder fake event. The following \"Dolev-Yao\" event generates all\nintruder-derivable messages.\\\n\ndefinition \\ \\refines @{term \"m2_fake\"}\\\n m3_DY_fake :: \"m3_trans\"\nwhere\n \"m3_DY_fake \\ {(s, s1).\n\n \\ \\actions:\\\n s1 = s\\ IK := synth (analz (IK s)) \\ \\ \\take DY closure\\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\ndefinition\n m3_init :: \"m3_pred\"\nwhere\n \"m3_init \\ { \\\n runs = Map.empty,\n leak = shrK`bad,\n clk = 0,\n IK = Key`shrK`bad\n \\ }\"\n\ndefinition\n m3_trans :: \"m3_trans\" where\n \"m3_trans \\ (\\A B Ra Rb Rs Kab Ts T X.\n m3_step1 Ra A B \\\n m3_step2 Rb A B \\\n m3_step3 Rs A B Kab Ts \\\n m3_step4 Ra A B Kab Ts X \\\n m3_step5 Rb A B Kab Ts \\\n m3_tick T \\\n m3_leak Rs \\\n m3_DY_fake \\\n Id\n )\"\n\ndefinition\n m3 :: \"(m3_state, m3_obs) spec\" where\n \"m3 \\ \\\n init = m3_init,\n trans = m3_trans,\n obs = m3_obs\n \\\"\n\nlemmas m3_loc_defs =\n m3_def m3_init_def m3_trans_def m3_obs_def\n m3_step1_def m3_step2_def m3_step3_def m3_step4_def m3_step5_def\n m3_tick_def m3_leak_def m3_DY_fake_def\n\nlemmas m3_defs = m3_loc_defs m2_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\ntext \\Specialized injection that we can apply more aggressively.\\\n\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\n\ndeclare parts_Inj_IK [dest!]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\inv1: Secrecy of pre-distributed shared keys\\\n(******************************************************************************)\n\ndefinition\n m3_inv1_lkeysec :: \"m3_pred\"\nwhere\n \"m3_inv1_lkeysec \\ {s. \\C.\n (Key (shrK C) \\ parts (IK s) \\ C \\ bad) \\\n (C \\ bad \\ Key (shrK C) \\ IK s)\n }\"\n\nlemmas m3_inv1_lkeysecI = m3_inv1_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_lkeysecE [elim] = m3_inv1_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_lkeysecD = m3_inv1_lkeysec_def [THEN setc_def_to_dest, rule_format]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv1_lkeysec_init [iff]:\n \"init m3 \\ m3_inv1_lkeysec\"\nby (auto simp add: m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec_trans [iff]:\n \"{m3_inv1_lkeysec} trans m3 {> m3_inv1_lkeysec}\"\nby (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv1_lkeysecI)\n (auto dest!: Body)\n\nlemma PO_m3_inv1_lkeysec [iff]: \"reach m3 \\ m3_inv1_lkeysec\"\nby (rule inv_rule_incr) (fast+)\n\n\ntext \\Useful simplifier lemmas\\\n\nlemma m3_inv1_lkeysec_for_parts [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ parts (IK s) \\ C \\ bad\"\nby auto\n\nlemma m3_inv1_lkeysec_for_analz [simp]:\n \"\\ s \\ m3_inv1_lkeysec \\ \\ Key (shrK C) \\ analz (IK s) \\ C \\ bad\"\nby auto\n\n\nsubsubsection \\inv2: Ticket shape for honestly encrypted M2\\\n(******************************************************************************)\n\ndefinition\n m3_inv2_ticket :: \"m3_pred\"\nwhere\n \"m3_inv2_ticket \\ {s. \\A B T K X.\n A \\ bad \\\n Crypt (shrK A) \\Key K, Agent B, Number T, X\\ \\ parts (IK s) \\\n X = Crypt (shrK B) \\Key K, Agent A, Number T\\ \\ K \\ range sesK\n }\"\n\nlemmas m3_inv2_ticketI = m3_inv2_ticket_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv2_ticketE [elim] = m3_inv2_ticket_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv2_ticketD = m3_inv2_ticket_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv2_ticket_init [iff]:\n \"init m3 \\ m3_inv2_ticket\"\nby (auto simp add: m3_defs intro!: m3_inv2_ticketI)\n\nlemma PO_m3_inv2_ticket_trans [iff]:\n \"{m3_inv2_ticket \\ m3_inv1_lkeysec} trans m3 {> m3_inv2_ticket}\"\napply (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv2_ticketI)\napply (auto dest: m3_inv2_ticketD)\n\\ \\2 subgoals, from step4\\\napply (drule parts_cut, drule Body, auto dest: m3_inv2_ticketD)+\ndone\n\nlemma PO_m3_inv2_ticket [iff]: \"reach m3 \\ m3_inv2_ticket\"\nby (rule inv_rule_incr) (auto del: subsetI)\n\n\nsubsubsection \\inv3: Session keys not used to encrypt other session keys\\\n(******************************************************************************)\n\ntext \\Session keys are not used to encrypt other keys. Proof requires\ngeneralization to sets of session keys.\\\n\ndefinition\n m3_inv3_sesK_compr :: \"m3_pred\"\nwhere\n \"m3_inv3_sesK_compr \\ {s. \\K KK.\n KK \\ range sesK \\\n (Key K \\ analz (Key`KK \\ (IK s))) = (K \\ KK \\ Key K \\ analz (IK s))\n }\"\n\nlemmas m3_inv3_sesK_comprI = m3_inv3_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_sesK_comprE = m3_inv3_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_sesK_comprD = m3_inv3_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Additional lemma\\\nlemmas insert_commute_Key = insert_commute [where x=\"Key K\" for K]\n\nlemmas m3_inv3_sesK_compr_simps =\n m3_inv3_sesK_comprD\n m3_inv3_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n m3_inv3_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n insert_commute_Key \\ \\to get the keys to the front\\\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv3_sesK_compr_step4:\n \"{m3_inv3_sesK_compr \\ m3_inv2_ticket \\ m3_inv1_lkeysec}\n m3_step4 Ra A B Kab Ts X\n {> m3_inv3_sesK_compr}\"\nproof -\n { fix K KK s\n assume H:\n \"s \\ m3_inv1_lkeysec\" \"s \\ m3_inv3_sesK_compr\" \"s \\ m3_inv2_ticket\"\n \"runs s Ra = Some (Init, [A, B], [])\"\n \"KK \\ range sesK\"\n \"Crypt (shrK A) \\Key Kab, Agent B, Number Ts, X\\ \\ analz (IK s)\"\n have\n \"(Key K \\ analz (insert X (Key ` KK \\ IK s))) =\n (K \\ KK \\ Key K \\ analz (insert X (IK s)))\"\n proof (cases \"A \\ bad\")\n case True show ?thesis\n proof -\n note H\n moreover\n with \\A \\ bad\\ have \"X \\ analz (IK s)\"\n by (auto dest!: Decrypt)\n moreover\n hence \"X \\ analz (Key ` KK \\ IK s)\"\n by (auto intro: analz_mono [THEN [2] rev_subsetD])\n ultimately\n show ?thesis\n by (auto simp add: m3_inv3_sesK_compr_simps analz_insert_eq)\n qed\n next\n case False thus ?thesis using H\n by (fastforce simp add: m3_inv3_sesK_compr_simps dest!: m3_inv2_ticketD [OF analz_into_parts])\n qed\n }\n thus ?thesis\n by (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv3_sesK_comprI dest!: analz_Inj_IK)\nqed\n\n\ntext \\All together now.\\\n\nlemmas PO_m3_inv3_sesK_compr_trans_lemmas =\n PO_m3_inv3_sesK_compr_step4\n\nlemma PO_m3_inv3_sesK_compr_init [iff]:\n \"init m3 \\ m3_inv3_sesK_compr\"\nby (auto simp add: m3_defs intro!: m3_inv3_sesK_comprI)\n\nlemma PO_m3_inv3_sesK_compr_trans [iff]:\n \"{m3_inv3_sesK_compr \\ m3_inv2_ticket \\ m3_inv1_lkeysec}\n trans m3\n {> m3_inv3_sesK_compr}\"\nby (auto simp add: m3_def m3_trans_def intro!: PO_m3_inv3_sesK_compr_trans_lemmas)\n (auto simp add: PO_hoare_defs m3_defs m3_inv3_sesK_compr_simps intro!: m3_inv3_sesK_comprI)\n\n\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\nsubsubsection \\Message abstraction and simulation relation\\\n(******************************************************************************)\n\ntext \\Abstraction function on sets of messages.\\\n\ninductive_set\n abs_msg :: \"msg set \\ chmsg set\"\n for H :: \"msg set\"\nwhere\n am_M1:\n \"\\Agent A, Agent B\\ \\ H\n \\ Insec A B (Msg []) \\ abs_msg H\"\n| am_M2a:\n \"Crypt (shrK C) \\Key K, Agent B, Number T, X\\ \\ H\n \\ Secure Sv C (Msg [aAgt B, aKey K, aNum T]) \\ abs_msg H\"\n| am_M2b:\n \"Crypt (shrK C) \\Key K, Agent A, Number T\\ \\ H\n \\ Secure Sv C (Msg [aKey K, aAgt A, aNum T]) \\ abs_msg H\"\n\n\ntext \\R23: The simulation relation. This is a data refinement of\nthe insecure and secure channels of refinement 2.\\\n\ndefinition\n R23_msgs :: \"(m2_state \\ m3_state) set\" where\n \"R23_msgs \\ {(s, t). abs_msg (parts (IK t)) \\ chan s }\"\n\ndefinition\n R23_keys :: \"(m2_state \\ m3_state) set\" where\n \"R23_keys \\ {(s, t). \\KK K. KK \\ range sesK \\\n Key K \\ analz (Key`KK \\ (IK t)) \\ aKey K \\ extr (aKey`KK \\ ik0) (chan s)\n }\"\n\ndefinition\n R23_pres :: \"(m2_state \\ m3_state) set\" where\n \"R23_pres \\ {(s, t). runs s = runs t \\ clk s = clk t \\ leak s = leak t}\"\n\ndefinition\n R23 :: \"(m2_state \\ m3_state) set\" where\n \"R23 \\ R23_msgs \\ R23_keys \\ R23_pres\"\n\nlemmas R23_defs =\n R23_def R23_msgs_def R23_keys_def R23_pres_def\n\n\ntext \\The mediator function is the identity here.\\\n\ndefinition\n med32 :: \"m3_obs \\ m2_obs\" where\n \"med32 \\ id\"\n\n\nlemmas R23_msgsI = R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_keysI = R23_keys_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_keysE [elim] = R23_keys_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_presI = R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_keysI R23_presI\n\n\ntext \\Lemmas for various instantiations (for keys).\\\n\nlemmas R23_keys_dest = R23_keys_def [THEN rel_def_to_dest, simplified, rule_format, rotated 2]\nlemmas R23_keys_dests =\n R23_keys_dest\n R23_keys_dest [where KK=\"{}\", simplified]\n R23_keys_dest [where KK=\"{K'}\" for K', simplified]\n R23_keys_dest [where KK=\"insert K' KK\" for K' KK, simplified, OF _ _ conjI]\n\n\nsubsubsection \\General lemmas\\\n(******************************************************************************)\n\ntext \\General facts about @{term \"abs_msg\"}\\\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n \"abs_msg (G \\ H) = abs_msg G \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n \"\\ m \\ abs_msg G; G \\ H \\ \\ m \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n \"\\ m \\ abs_msg H \\ \\ m \\ abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\Facts about @{term \"abs_msg\"} concerning abstraction of fakeable\nmessages. This is crucial for proving the refinement of the intruder event.\\\n\nlemma abs_msg_DY_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs; (s, t) \\ R23_keys; (s, t) \\ R23_non; t \\ m3_inv1_lkeysec \\\n \\ abs_msg (synth (analz (IK t))) \\ fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n\\ \\4 subgoals, deal with replays first\\\napply (blast)\ndefer 1 apply (blast)\n\\ \\remaining 2 subgoals are real fakes\\\napply (rule fake_StatCh, auto dest: R23_keys_dests)+\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\ntext \\Pair decomposition. These were set to \\texttt{elim!}, which is too\nagressive here.\\\n\ndeclare MPair_analz [rule del, elim]\ndeclare MPair_parts [rule del, elim]\n\n\ntext \\Protocol events.\\\n\nlemma PO_m3_step1_refines_m2_step1:\n \"{R23}\n (m2_step1 Ra A B), (m3_step1 Ra A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n \"{R23}\n (m2_step2 Rb A B), (m3_step2 Rb A B)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step3_refines_m2_step3:\n \"{R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv3_sesK_compr \\ m3_inv1_lkeysec)}\n (m2_step3 Rs A B Kab Ts), (m3_step3 Rs A B Kab Ts)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_pres\"\n \"s \\ m2_inv3a_sesK_compr\" \"t \\ m3_inv3_sesK_compr\" \"t \\ m3_inv1_lkeysec\"\n \"Kab = sesK (Rs$sk)\" \"Rs \\ dom (runs t)\"\n \"\\Agent A, Agent B\\ \\ parts (IK t)\"\n let ?s'=\n \"s\\ runs := runs s(Rs \\ (Serv, [A, B], [aNum (clk t)])),\n chan := insert (Secure Sv A (Msg [aAgt B, aKey Kab, aNum (clk t)]))\n (insert (Secure Sv B (Msg [aKey Kab, aAgt A, aNum (clk t)])) (chan s)) \\\"\n let ?t'=\n \"t\\ runs := runs t(Rs \\ (Serv, [A, B], [aNum (clk t)])),\n IK := insert\n (Crypt (shrK A)\n \\ Key Kab, Agent B, Number (clk t),\n Crypt (shrK B) \\ Key Kab, Agent A, Number (clk t) \\\\)\n (IK t) \\\"\n have \"(?s', ?t') \\ R23_msgs\" using H\n by (-) (rule R23_intros, auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\" using H\n by (-) (rule R23_intros,\n auto simp add: m2_inv3a_sesK_compr_simps m3_inv3_sesK_compr_simps dest: R23_keys_dests)\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (-) (rule R23_intros, auto)\n moreover\n note calculation\n }\n thus ?thesis by (auto simp add: PO_rhoare_defs R23_def m3_defs)\nqed\n\nlemma PO_m3_step4_refines_m2_step4:\n \"{R23 \\\n UNIV \\ (m3_inv3_sesK_compr \\ m3_inv2_ticket \\ m3_inv1_lkeysec)}\n (m2_step4 Ra A B Kab Ts), (m3_step4 Ra A B Kab Ts X)\n {> R23}\"\nproof -\n { fix s t\n assume H:\n \"(s, t) \\ R23_msgs\" \"(s, t) \\ R23_keys\" \"(s, t) \\ R23_pres\"\n \"t \\ m3_inv3_sesK_compr\" \"t \\ m3_inv2_ticket\" \"t \\ m3_inv1_lkeysec\"\n \"runs t Ra = Some (Init, [A, B], [])\"\n \"Crypt (shrK A) \\Key Kab, Agent B, Number Ts, X\\ \\ analz (IK t)\"\n let ?s' = \"s\\ runs := runs s(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts])) \\\"\n and ?t' = \"t\\ runs := runs t(Ra \\ (Init, [A, B], [aKey Kab, aNum Ts])),\n IK := insert X (IK t) \\\"\n from H have\n \"Secure Sv A (Msg [aAgt B, aKey Kab, aNum Ts]) \\ chan s\"\n by (auto)\n moreover\n have \"X \\ parts (IK t)\" using H\n by (auto dest!: Body MPair_parts)\n hence \"(?s', ?t') \\ R23_msgs\" using H\n by (auto intro!: R23_intros) (auto)\n moreover\n have \"(?s', ?t') \\ R23_keys\"\n proof (cases)\n assume \"A \\ bad\" show ?thesis\n proof -\n note H\n moreover\n hence \"X \\ analz (IK t)\" using \\A \\ bad\\\n by (-) (drule Decrypt, auto)\n ultimately\n show ?thesis\n by (-) (rule R23_intros, auto dest!: analz_cut intro: analz_monotonic)\n qed\n next\n assume \"A \\ bad\" show ?thesis\n proof -\n note H\n moreover\n with \\A \\ bad\\ have\n \"X = Crypt (shrK B) \\Key Kab, Agent A, Number Ts \\ \\ Kab \\ range sesK\"\n by (auto dest!: m3_inv2_ticketD)\n moreover\n { assume H1: \"Key (shrK B) \\ analz (IK t)\"\n have \"aKey Kab \\ extr ik0 (chan s)\"\n proof -\n note calculation\n moreover\n hence \"Secure Sv B (Msg [aKey Kab, aAgt A, aNum Ts]) \\ chan s\"\n by (-) (drule analz_into_parts, drule Body, elim MPair_parts, auto)\n ultimately\n show ?thesis using H1 by auto\n qed\n }\n ultimately show ?thesis\n by (-) (rule R23_intros, auto simp add: m3_inv3_sesK_compr_simps)\n qed\n qed\n moreover\n have \"(?s', ?t') \\ R23_pres\" using H\n by (auto intro!: R23_intros)\n moreover\n note calculation\n }\n thus ?thesis\n by (auto simp add: PO_rhoare_defs R23_def m3_defs dest!: analz_Inj_IK)\nqed\n\nlemma PO_m3_step5_refines_m2_step5:\n \"{R23}\n (m2_step5 Rb A B Kab Ts), (m3_step5 Rb A B Kab Ts)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_tick_refines_m2_tick:\n \"{R23}\n (m2_tick T), (m3_tick T)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto)\n\n\ntext \\Intruder events.\\\n\nlemma PO_m3_leak_refines_m2_leak:\n \"{R23}\n (m2_leak Rs), (m3_leak Rs)\n {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n (auto dest: R23_keys_dests)\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n \"{R23 \\ UNIV \\ (m3_inv1_lkeysec)}\n m2_fake, m3_DY_fake\n {> R23}\"\napply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros del: abs_msg.cases)\napply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD] del: abs_msg.cases\n dest: R23_keys_dests)\ndone\n\n\ntext \\All together now...\\\n\nlemmas PO_m3_trans_refines_m2_trans =\n PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n PO_m3_step3_refines_m2_step3 PO_m3_step4_refines_m2_step4\n PO_m3_step5_refines_m2_step5 PO_m3_tick_refines_m2_tick\n PO_m3_leak_refines_m2_leak PO_m3_DY_fake_refines_m2_fake\n\n\nlemma PO_m3_refines_init_m2 [iff]:\n \"init m3 \\ R23``(init m2)\"\nby (auto simp add: R23_def m3_defs ik0_def intro!: R23_intros)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n \"{R23 \\\n (m2_inv3a_sesK_compr) \\ (m3_inv3_sesK_compr \\ m3_inv2_ticket \\ m3_inv1_lkeysec)}\n (trans m2), (trans m3)\n {> R23}\"\nby (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\n (blast intro!: PO_m3_trans_refines_m2_trans)+\n\nlemma PO_m3_observation_consistent [iff]:\n \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m3_defs)\n\n\ntext \\Refinement result.\\\n\nlemma m3_refines_m2 [iff]:\n \"refines\n (R23 \\ (m2_inv3a_sesK_compr) \\ (m3_inv3_sesK_compr \\ m3_inv2_ticket \\ m3_inv1_lkeysec))\n med32 m2 m3\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m3_implements_m2 [iff]:\n \"implements med32 m2 m3\"\nby (rule refinement_soundness) (auto)\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m3_ds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.26271162730193276}} {"text": "chapter {* Define processes that are linear in execution *}\n\ntheory SimpleSimulation\nimports Main\nbegin\n\nrecord ('a, 'b) data_type =\n Init :: \"'b \\ 'a set\"\n Fin :: \"'a \\ 'b\"\n Run :: \"('a \\ 'a) set\"\n\ntext {*\nWe follow a simple strategy that allows us to use as much of the NICTA seL4 libraries as\npossible. First, we define linear versions of constructs (e.g. the Hoare triple) in terms\nof the more complex NICTA constructs. Then we prove simple introduction lemmas which allow us\nto reason about linear constructs using lemmas defined over NICTA constructs. \n*}\ndefinition execution where\n\"execution A \\ \\s. Fin A ` (Run A `` Init A s)\"\n\ndefinition hoare_triple where\n\"hoare_triple A P Q \\ \\s s'. s \\ P \\ s' \\ execution A s \\ s' \\ Q\"\n\ndefinition\n refines :: \"('c,'b) data_type \\ ('a,'b) data_type \\ bool\" (infix \"\\\" 60)\nwhere\n \"C \\ A \\ \\s. execution C s \\ execution A s\"\n\nlemma hoare_triple_refinement:\n \"C \\ A = (\\P Q. hoare_triple A P Q \\ hoare_triple C P Q)\"\n by (simp add: refines_def hoare_triple_def) blast\n\ndefinition\n rel_semi :: \"('a \\ 'b) set \\ ('b \\ 'c) set \\ ('a \\ 'c) set\" (infixl \";;;\" 65) \nwhere\n \"A ;;; B \\ A O B\"\n\ndefinition\n fw_sim :: \"('a \\ 'c) set \\ ('c,'b) data_type \\ ('a,'b) data_type \\ bool\"\nwhere\n \"fw_sim R C A \\ (\\s. Init C s \\ R `` Init A s) \\ \n (R ;;; Run C \\ Run A ;;; R) \\\n (\\s s'. (s,s') \\ R \\ Fin C s' = Fin A s)\"\n\ndefinition\n fw_simulates :: \"('c,'b) data_type \\ ('a,'b) data_type \\ bool\" (infixl \"\\\\<^sub>F\" 50)\nwhere\n \"C \\\\<^sub>F A \\ \\R. fw_sim R C A\"\n\nlemma sim_imp_refines:\n fixes C :: \"('c,'b) data_type\" and A :: \"('a,'b) data_type\"\n assumes \"C \\\\<^sub>F A\"\n shows \"C \\ A\"\nproof -\n from assms have \"\\R. fw_sim R C A\" unfolding fw_simulates_def .\n then obtain R where \"fw_sim R C A\" ..\n hence init: \"\\s. Init C s \\ R `` Init A s\"\n and run: \"R ;;; Run C \\ Run A ;;; R\"\n and fin: \"\\s s'. (s,s') \\ R \\ Fin C s' = Fin A s\"\n unfolding fw_sim_def by auto\n have \"\\s. execution C s \\ execution A s\"\n proof (safe)\n fix s s'\n assume \"s' \\ execution C s\"\n hence \"s' \\ Fin C ` (Run C `` Init C s)\" unfolding execution_def .\n hence \"\\s\\<^sub>C' \\ (Run C `` Init C s). s' = Fin C s\\<^sub>C'\" by auto\n then obtain s\\<^sub>C' where \"s\\<^sub>C' \\ (Run C `` Init C s)\" and \"s' = Fin C s\\<^sub>C'\" ..\n hence \"\\s\\<^sub>C \\ Init C s. (s\\<^sub>C, s\\<^sub>C') \\ Run C\" by auto\n then obtain s\\<^sub>C where \"s\\<^sub>C \\ Init C s\" and \"(s\\<^sub>C, s\\<^sub>C') \\ Run C\" ..\n with init have \"s\\<^sub>C \\ R `` Init A s\" by auto\n hence \"\\s\\<^sub>A \\ Init A s. (s\\<^sub>A, s\\<^sub>C) \\ R\" by auto\n then obtain s\\<^sub>A where \"s\\<^sub>A \\ Init A s\" and \"(s\\<^sub>A, s\\<^sub>C) \\ R\" ..\n with `(s\\<^sub>C, s\\<^sub>C') \\ Run C` have \"(s\\<^sub>A, s\\<^sub>C') \\ R ;;; Run C\" unfolding rel_semi_def by auto\n with run have \"(s\\<^sub>A, s\\<^sub>C') \\ Run A ;;; R\" by auto\n hence \"\\s\\<^sub>A'. (s\\<^sub>A, s\\<^sub>A') \\ Run A \\ (s\\<^sub>A', s\\<^sub>C') \\ R\" unfolding rel_semi_def by auto\n then obtain s\\<^sub>A' where \"(s\\<^sub>A, s\\<^sub>A') \\ Run A\" and \"(s\\<^sub>A', s\\<^sub>C') \\ R\" by auto\n with fin and `s' = Fin C s\\<^sub>C'` have \"s' = Fin A s\\<^sub>A'\" by auto\n with `s\\<^sub>A \\ Init A s` and `(s\\<^sub>A, s\\<^sub>A') \\ Run A` have \"s' \\ Fin A ` (Run A `` Init A s)\" by auto\n thus \"s' \\ execution A s\" unfolding execution_def .\n qed\n thus \"C \\ A\" unfolding refines_def .\nqed\n\ndefinition\n invariant_holds :: \"('a,'b) data_type \\ 'a set \\ bool\" (infix \"\\\" 60)\nwhere\n \"invariant_holds A I \\ (\\s. Init A s \\ I) \\ (Run A `` I \\ I)\"\n\nlemma invariant_T [iff]: \"D \\ UNIV\"\n by (simp add: invariant_holds_def)\n\nlemma invariantI:\n \"\\ \\s. Init D s \\ I; Run D `` I \\ I \\ \\ D \\ I\"\nby (simp add: invariant_holds_def)\n\nlemma invariant_CollectI [intro?]:\n assumes init: \"\\s a. s \\ Init D a \\ I s\"\n assumes step: \"\\s s'. \\ I s; (s,s') \\ Run D \\ \\ I s'\"\n shows \"D \\ Collect I\"\nproof (rule invariantI)\n show \"\\a. Init D a \\ Collect I\" by (fast intro: init)\nnext\n show \"Run D `` Collect I \\ Collect I\"\n by (auto simp add: Image_def intro: step)\nqed\n\nlemma invariant_conjI:\n \"D \\ P \\ D \\ Q \\ D \\ P \\ Q\"\n by (simp add: invariant_holds_def) blast\n\nlemma invariant_conjI2:\n \"\\ D \\ I; \\s. Init D s \\ I \\ Init D s \\ J; \n Run D `` (I \\ J) \\ J \\ \\ D \\ I \\ J\" \n by (simp add: invariant_holds_def) blast\n\ndefinition\n LI :: \"('a,'b) data_type \\ ('c,'b) data_type \\ ('a \\ 'c) set \\ ('a \\ 'c) set \\ bool\"\nwhere\n \"LI A C R I \\ (\\s. Init C s \\ R `` Init A s) \\ \n ((R \\ I) ;;; Run C \\ Run A ;;; R) \\\n (\\s s'. (s,s') \\ R \\ I \\ Fin C s' = Fin A s)\"\n(* Arash *)\nlemma LI_fw_sim:\n fixes C :: \"('c,'b) data_type\" and A :: \"('a,'b) data_type\" and R I\\<^sub>A I\\<^sub>C \n assumes ia: \"A \\ I\\<^sub>a\" and ic: \"C \\ I\\<^sub>c\" and li: \"LI A C R (I\\<^sub>a \\ I\\<^sub>c)\"\n shows \"fw_sim (R \\ I\\<^sub>a \\ I\\<^sub>c) C A\"\napply (simp add:fw_sim_def) \nproof (rule conjI)\n show \"\\s. Init C s \\ (R \\ I\\<^sub>a \\ I\\<^sub>c) `` Init A s\"\n proof \n fix s\n from li have 0 : \"Init C s \\ R `` Init A s\" unfolding LI_def by auto\n show \"Init C s \\ (R \\ I\\<^sub>a \\ I\\<^sub>c) `` Init A s\"\n proof\n fix c\n assume \"c \\ Init C s\"\n from this and ic have \"c \\ I\\<^sub>c\" unfolding invariant_holds_def by auto\n from `c \\ Init C s` and 0 have \"c \\ (R `` Init A s)\" by auto\n then have \"\\ a. a \\ Init A s \\ (a,c) \\ R\" by auto\n then obtain a where aCond:\"a \\ Init A s \\ (a,c) \\ R\" by auto\n then have \"a \\ I\\<^sub>a\" using ia unfolding invariant_holds_def by auto\n then have \"(a,c) \\ R \\(I\\<^sub>a \\ I\\<^sub>c)\" using `c \\ I\\<^sub>c` and aCond by blast\n then show \"c \\ (R \\ I\\<^sub>a \\ I\\<^sub>c) `` Init A s\" using aCond by blast\n qed\n qed\nnext\n show \"R \\ I\\<^sub>a \\ I\\<^sub>c ;;; Run C \\ Run A ;;; R \\ I\\<^sub>a \\ I\\<^sub>c \\\n (\\s s'. (s, s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c \\ Fin C s' = Fin A s)\"\n proof(safe)\n fix a c \n assume 0:\"(a,c) \\ R \\ I\\<^sub>a \\ I\\<^sub>c ;;; Run C\"\n from ia have iaa: \"(s,s') \\ Run A \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>a\" \n by (auto simp: invariant_holds_def)\n from ic have icc: \"(xx,xx') \\ Run C \\ xx \\ I\\<^sub>c \\ xx' \\ I\\<^sub>c\"\n by (auto simp: invariant_holds_def)\n from 0 have aIa: \"a \\ I\\<^sub>a\" unfolding rel_semi_def by auto\n from 0 have cIc: \"c \\ I\\<^sub>c\" using ic unfolding rel_semi_def\n proof -\n assume \"(a,c) \\ (R \\ I\\<^sub>a \\ I\\<^sub>c) O Run C\"\n then have \"\\ cc. (a,cc) \\ R \\ I\\<^sub>a \\ I\\<^sub>c \\ (cc,c) \\ Run C\" using 0 by blast\n then obtain cc where ccCond:\"(a,cc) \\ R \\ I\\<^sub>a \\ I\\<^sub>c \\ (cc,c) \\ Run C\" by auto\n then have \"cc \\ I\\<^sub>c\" by auto\n then show \"c \\ I\\<^sub>c\" using ccCond ic unfolding invariant_holds_def by auto\n qed\n have 1: \"(a,c) \\ Run A ;;; R\"\n proof -\n from li have \"R \\ I\\<^sub>a \\ I\\<^sub>c ;;; Run C \\ Run A ;;; R\" unfolding LI_def by auto\n then show ?thesis using 0 by blast\n qed\n from 1 have \"\\ b . (a,b) \\ Run A \\ (b,c) \\ R\" unfolding rel_semi_def by auto\n then obtain b where bCon: \"(a,b) \\ Run A \\ (b,c) \\ R\" ..\n from this and aIa and iaa have bIa: \"b \\ I\\<^sub>a\" \n by (meson ImageI ia invariant_holds_def subsetCE) \n from bCon have \"(b,c) \\ R\" by auto\n from this and cIc and bIa have \"(b,c) \\ R \\ (I\\<^sub>a \\ I\\<^sub>c)\" by blast\n from bCon have \"(a,b) \\ Run A\" by auto\n from this and `(b,c) \\ R \\ (I\\<^sub>a \\ I\\<^sub>c)` have \"(a,c) \\ Run A ;;; R \\ (I\\<^sub>a \\ I\\<^sub>c)\" \n by (auto simp: rel_semi_def)\n from this show \"(a,c) \\ Run A ;;; R \\ (I\\<^sub>a \\ I\\<^sub>c)\" by auto\n next\n fix s s'\n assume \"(s,s') \\ R\" and \"s \\ I\\<^sub>a\" and \"s' \\ I\\<^sub>c\"\n from this and li have \"(s,s') \\ R \\ (I\\<^sub>a \\ I\\<^sub>c)\" by auto\n from this and li show \"Fin C s' = Fin A s\" by (simp add: LI_def)\n qed\nqed\n\n (* Arash *) \nlemma weaken_LI:\n fixes C :: \"('c,'b) data_type\" and A :: \"('a,'b) data_type\" and R I I'\n assumes LI: \"LI A C R I'\" and weaker: \"I \\ I'\"\n shows \"LI A C R I\"\napply(simp_all add: LI_def)\nproof\n show \"\\s. Init C s \\ R `` Init A s\" using LI unfolding LI_def by auto\n next show \" R \\ I ;;; Run C \\ Run A ;;; R \\\n (\\s s'. (s, s') \\ R \\ (s, s') \\ I \\ Fin C s' = Fin A s)\"\n proof (safe)\n fix a c\n assume \"(a,c) \\ R \\ I ;;; Run C\"\n then have \"\\ b. (a,b) \\ R \\ I \\ (b,c) \\ Run C\" unfolding rel_semi_def by auto\n then obtain b where bCond:\"(a,b) \\ R \\ I \\ (b,c) \\ Run C\" by auto\n then have \"(a,b) \\ R \\ I'\" using weaker by auto\n then have \"(a,c) \\ R \\ I' ;;; Run C\" using bCond by (auto simp:rel_semi_def)\n then show \"(a,c) \\ Run A;;; R\" using LI unfolding LI_def by auto\n next\n fix s s'\n assume \"(s,s') \\ R\" and \"(s,s') \\ I\"\n then have \"(s,s') \\ I'\" using weaker by auto\n then have \"(s,s') \\ R \\ I'\" using `(s,s') \\ R` by auto\n then show \"Fin C s' = Fin A s\" using LI unfolding LI_def by auto\n qed\nqed \n\nlemma fw_sim_eq_LI: \"fw_sim r C A = LI A C r UNIV\"\nunfolding fw_sim_def LI_def by simp\n\nlemma fw_sim_LI: \"fw_sim r C A \\ LI A C r I\"\nby (simp add: fw_sim_eq_LI weaken_LI[where I'=UNIV])\n\nlemma L_invariantI:\n assumes \"A \\ I\\<^sub>a\" and \"C \\ I\\<^sub>c\" and \"LI A C r (I\\<^sub>a \\ I\\<^sub>c)\"\n shows \"C \\\\<^sub>F A\"\n using assms\n by (simp add: fw_simulates_def, rule_tac x=\"r \\ I\\<^sub>a \\ I\\<^sub>c\" in exI,\n simp add: LI_fw_sim)\n\nlemma refinement_refl[simp]: \"A \\ A\"\nunfolding refines_def by auto\n\nlemma refinement_trans [trans]: \"\\C \\ B; B \\ A\\ \\ C \\ A\"\nunfolding refines_def by auto\n\n(* Arash *)\nlemma fw_inv_transport2:\n fixes A I\\<^sub>a C I\\<^sub>c R\n assumes \"A \\ I\\<^sub>a\" and \"C \\ I\\<^sub>c\" and li:\"LI A C R (I\\<^sub>a \\ I\\<^sub>c)\"\n shows \"C \\ {s'. \\s. (s,s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c}\"\napply(simp add:invariant_holds_def)\nproof \n show \"\\s. Init C s \\ {s'. \\s. (s, s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c}\"\n proof\n fix s\n show \"Init C s \\ {s'. \\s. (s, s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c}\"\n proof\n fix x\n assume \"x \\ Init C s\"\n then have \"x \\ R `` Init A s\" using li unfolding LI_def by auto\n then have \"\\ s' . s' \\ Init A s \\ (s',x) \\ R\" by auto\n then obtain s' where c1:\"s' \\ Init A s \\ (s',x) \\ R\" by auto\n then have c2:\"s' \\ I\\<^sub>a\" using `A \\ I\\<^sub>a` unfolding invariant_holds_def by auto\n from `C \\ I\\<^sub>c`` x \\ Init C s` have c3: \"x \\ I\\<^sub>c\" unfolding invariant_holds_def by auto\n then have \"(s', x) \\ R \\ s' \\ I\\<^sub>a \\ x \\ I\\<^sub>c\" using c1 c2 by auto\n then show \"x \\ {xx . \\s' . (s',xx) \\ R \\ s' \\ I\\<^sub>a \\ xx \\ I\\<^sub>c}\" by auto\n qed\n qed\nnext\n let ?X = \"{s'. \\s. (s, s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c}\"\n show \"Run C `` ?X \\ ?X\"\n proof\n fix b\n assume \"b \\ Run C `` ?X\"\n then have \"\\ a. a \\ ?X \\ (a,b) \\ Run C\" by auto\n then obtain a where 0:\"a \\ ?X \\ (a,b) \\ Run C\" by auto\n then have \"\\ s . (s,a) \\ R \\ s \\ I\\<^sub>a \\ a \\ I\\<^sub>c\" by auto\n then obtain s where 1:\"(s,a) \\ R \\ s \\ I\\<^sub>a \\ a \\ I\\<^sub>c\" by auto\n then have \"(s,a) \\ R \\ (I\\<^sub>a\\I\\<^sub>c)\" by blast\n then have \"(s,b) \\ R \\ (I\\<^sub>a\\I\\<^sub>c) ;;; Run C\" using 0 unfolding rel_semi_def by blast\n then have \"(s,b) \\ Run A ;;; R\" using li unfolding LI_def by blast\n then have \"\\ ss. (s,ss) \\ Run A \\ (ss,b) \\ R\" unfolding rel_semi_def by blast\n then obtain ss where 2:\"(s,ss) \\ Run A \\ (ss,b) \\ R\" by auto\n from 1 have \"s \\ I\\<^sub>a\" by auto\n then have \"ss \\ I\\<^sub>a\" using 2 `A \\ I\\<^sub>a` unfolding invariant_holds_def by blast\n from 0 1 `C \\ I\\<^sub>c` have \"b \\ I\\<^sub>c\" unfolding invariant_holds_def by blast\n from 2 `ss \\ I\\<^sub>a` `b \\ I\\<^sub>c` have \"(ss,b) \\ R \\ ss \\ I\\<^sub>a \\ b \\ I\\<^sub>c\" by auto\n then show \"b \\ ?X\" by auto\n qed\nqed\n\nlemma fw_inv_transport:\n \"\\ A \\ I\\<^sub>a; C \\ I\\<^sub>c; LI A C R (I\\<^sub>a \\ I\\<^sub>c) \\ \\ C \\ {s'. \\s. (s,s') \\ R \\ s \\ I\\<^sub>a \\ s' \\ I\\<^sub>c}\"\nby (simp add: fw_inv_transport2)\n\nlemma fw_sim_refl: \"fw_sim Id A A\"\nunfolding fw_sim_def rel_semi_def by simp\n\nlemma fw_simulates_refl[simp]: \"A \\\\<^sub>F A\"\nunfolding fw_simulates_def by (blast intro: fw_sim_refl)\n\nlemma nondet_app_sub : \"X \\ Y \\ R `` X \\ R `` Y\" by auto\nlemma comp_sub : \" X \\ Y \\ R O X \\ R O Y\" by auto\nlemma comp_sub2 : \"X \\ Y \\ X O R \\ Y O R\" by auto\nlemma comp_ass : \"R1 O (R2 O R3) = (R1 O R2) O R3\" by auto\nlemma nondet_app_com : \"R1``(R2`` X) = (R2 O R1) `` X\" by auto\n\n(* Arash *)\nlemma fw_sim_trans2:\n assumes fwsr1cb:\"fw_sim R1 C B\" and fwsr2ba:\"fw_sim R2 B A\"\n shows \"fw_sim (R2 O R1) C A\"\nproof -\n let ?R = \"R2 O R1\"\n have init:\"\\s. Init C s \\ ?R `` Init A s\"\n proof\n fix s\n have initCB:\"Init C s \\ R1 `` Init B s\" using fwsr1cb unfolding fw_sim_def by auto\n have initBA:\"Init B s \\ R2 `` Init A s\" using fwsr2ba unfolding fw_sim_def by auto\n then have \"R1 `` Init B s \\ R1 `` (R2 `` Init A s)\" using nondet_app_sub by auto\n then have \"Init C s \\ R1 `` (R2 `` Init A s)\" using initCB by auto\n then show \"Init C s \\ (R2 O R1) `` Init A s\" using nondet_app_com by force\n qed\n have run:\"?R ;;; Run C \\ Run A ;;; ?R\"\n proof -\n have runCB: \"R1 O Run C \\ Run B O R1\" using fwsr1cb unfolding fw_sim_def rel_semi_def by auto\n have runBA: \"R2 O Run B \\ Run A O R2\" using fwsr2ba unfolding fw_sim_def rel_semi_def by auto\n have 0: \"R2 O R1 O Run C \\ R2 O Run B O R1\" using runCB by blast\n have \"R2 O Run B O R1 \\ Run A O R2 O R1\" using runBA by blast\n then have \"R2 O R1 O Run C \\ Run A O R2 O R1\" using 0 by blast\n then show \"(R2 O R1) ;;; Run C \\ Run A ;;; (R2 O R1)\" unfolding rel_semi_def by blast\n qed\n have fin:\"(\\s s'. (s, s') \\ ?R \\ Fin C s' = Fin A s)\"\n proof (safe)\n fix s s' x y z\n show \"(x, y) \\ R2 \\ (y,z) \\ R1 \\ Fin C z = Fin A x\"\n proof -\n assume xyr2:\"(x, y) \\ R2\" and \"(y,z) \\ R1\"\n then have 0:\"Fin C z = Fin B y\" using fwsr1cb unfolding fw_sim_def by auto\n have \"Fin B y = Fin A x\" using fwsr2ba xyr2 unfolding fw_sim_def by auto\n then show \"Fin C z = Fin A x\" using 0 by auto\n qed\n qed\n from init run fin show \"fw_sim ?R C A\" using fw_sim_def by blast\nqed\n\nlemma fw_sim_trans: \"\\fw_sim Q C B; fw_sim R B A\\ \\ fw_sim (R O Q) C A\"\nby (simp add:fw_sim_trans2)\n\nlemma fw_simulates_trans: \"\\C \\\\<^sub>F B; B \\\\<^sub>F A\\ \\ C \\\\<^sub>F A\"\nunfolding fw_simulates_def by (blast dest: fw_sim_trans)\n\nend", "meta": {"author": "CriticalTechnologiesInc", "repo": "SableModel", "sha": "a452a2b5e3636b612a4d04cfb6e2ab1c1a132639", "save_path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel", "path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel/SableModel-a452a2b5e3636b612a4d04cfb6e2ab1c1a132639/lib/SimpleSimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.262696024503923}} {"text": "theory ReduceAction\n imports ReduceProper ReduceWTS\nbegin\n \n (* ###### constructive permission definitions.\n the idea here is that i want to constructively state which permissions are being consumed.\n the difficult part is that because the \"permissions consumed\" involves \n *)\n \ndatatype gen_act =\n NoResAct\n | AddResAct string p_type perm_use_env\n | Add2ResAct string string p_type\n | ReadResAct\n | WriteResAct string perm_use_env\n \nfun red_env :: \"pt_env \\ gen_act \\ pt_env\" where\n \"red_env env NoResAct = env\"\n| \"red_env env (AddResAct x tau r_s) = add_env env (Loc x) tau\"\n| \"red_env env (Add2ResAct x1 x2 tau) = add_env (add_env env (Loc x1) (ChanTy tau SEnd)) (Loc x2) (ChanTy tau REnd)\"\n| \"red_env env ReadResAct = env\"\n| \"red_env env (WriteResAct x r_s) = env\"\n\nfun exp_red_use_env where\n \"exp_red_use_env r_s NoResAct = r_s\"\n (* remove resources used to create the value, add the new perm *)\n| \"exp_red_use_env r_s (AddResAct x tau r_s') = add_use_env r_s (Loc x) OwnPerm\"\n| \"exp_red_use_env r_s (Add2ResAct x1 x2 tau) = add_use_env (add_use_env r_s (Loc x1) OwnPerm) (Loc x2) OwnPerm\"\n| \"exp_red_use_env r_s ReadResAct = r_s\" \n| \"exp_red_use_env r_s (WriteResAct x r_s') = (diff_use_env r_s r_s')\"\n \nfun end_red_use_env where \n \"end_red_use_env r_s (WriteResAct x r_s') = (diff_use_env r_s r_s')\"\n| \"end_red_use_env r_s r_ax = r_s\"\n \nfun red_nres_map :: \"nres_map \\ gen_act \\ nres_map\" where\n \"red_nres_map rs_map NoResAct = rs_map\" \n| \"red_nres_map rs_map (AddResAct x tau r_s) = add_env rs_map x r_s\"\n| \"red_nres_map rs_map (Add2ResAct x1 x2 tau) = add_env (add_env rs_map x1 empty_use_env) x2 empty_use_env\"\n| \"red_nres_map rs_map ReadResAct = rs_map\"\n| \"red_nres_map rs_map (WriteResAct x r_s) = add_env rs_map x (comp_use_env (nres_lookup rs_map x) r_s)\"\n \nfun safe_act where\n \"safe_act s r_s NoResAct = True\"\n| \"safe_act s r_s (AddResAct x tau r_x) = (s x = None \\ leq_use_env r_x r_s)\"\n| \"safe_act s r_s (Add2ResAct x1 x2 tau) = (s x1 = None \\ s x2 = None \\ x1 \\ x2)\"\n| \"safe_act s r_s ReadResAct = True\"\n| \"safe_act s r_s (WriteResAct x r_x) = (s x \\ None \\ leq_use_env r_x r_s)\"\n \nfun corr_act where\n \"corr_act ax NoResAct = (ax = NoAct)\"\n| \"corr_act ax (AddResAct x tau r_s) = (ax = MakeAct x)\"\n| \"corr_act ax (Add2ResAct x1 x2 tau) = (ax = Mk2Act x1 x2)\"\n| \"corr_act ax ReadResAct = (\\ x. ax = UseAct x)\"\n| \"corr_act ax (WriteResAct x r_s) = (\\ x. ax = UseAct x)\" \n \n \nlemma leq_safe_act: \"\\ safe_act s r_x g_ax; leq_use_env r_x r_s \\ \\ safe_act s r_s g_ax\" \n apply (case_tac g_ax)\n apply (auto)\n apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n apply (auto)\n done \n \n \ndefinition valid_reduct where\n \"valid_reduct r_exp = (\\ are s1 rs_map env r_f r_s1 e1 tau r_s2 rx ax s2 e2. (\n r_exp are (s1, e1) ax (s2, e2) \\ well_typed env r_s1 e1 tau r_s2 rx \\ proper_exp rs_map e1 \\\n well_typed_state s1 env rs_map \\ valid_exp_use_env s1 rs_map r_f \\ leq_use_env r_s1 r_f) \\\n (\\ g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax)\n )\" \n \n \nlemma red_contain_env: \"\\ safe_act s r_s g_ax; sub_env s env \\ \\ contain_env (red_env env g_ax) env\"\n apply (case_tac g_ax)\n apply (auto)\n apply (rule_tac id_contain_env)\n apply (rule_tac add_contain_env)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"Loc x21\" in allE)\n apply (auto)\n apply (rule_tac env_b=\"add_env env (Loc x31) (ChanTy x33 SEnd)\" in trans_contain_env)\n apply (rule_tac add_contain_env)\n apply (simp add: add_env_def)\n apply (case_tac \"env (Loc x32)\")\n apply (auto)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"Loc x32\" in allE)\n apply (auto)\n apply (rule_tac add_contain_env)\n apply (case_tac \"env (Loc x31)\")\n apply (auto)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"Loc x31\" in allE)\n apply (auto)\n apply (rule_tac id_contain_env)\n apply (rule_tac id_contain_env)\n done \n \n (* ##### safe-reduction specific validity lemmas ##### *)\n \nlemma red_sep_nres_map: \"\\ p_map u = Some r_s; disj_nres_map p_map; sub_nres_map s1 p_map;\n safe_act s1 r_s g_ax; sub_use_env s1 r_s \\ \\ sep_nres_map (exp_red_use_env r_s g_ax) (rem_env p_map u)\"\n apply (simp add: sep_nres_map_def)\n apply (auto)\n (* we dont have to check x = u, since u has been removed from the map *)\n apply (case_tac \"u = x\")\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n (* otherwise, the lookup is the same as it was in p_map *)\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" in nres_rem_diff)\n apply (auto)\n (* from here we do case analysis on the possible ways that r_s has been modified *)\n (* if it has not been modified the case is simple *)\n apply (case_tac \"exp_red_use_env r_s g_ax = r_s\")\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n (* make case: if x21 has been added, the rest of r_s is disjoint from p_map x *)\n apply (case_tac g_ax)\n apply (auto)\n apply (rule_tac add_strong_disj_use_env)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n (* now we have to prove that x21 was not in p_map, which should be true since p_map is sub-ordinate to s *)\n apply (case_tac \"p_map x\")\n apply (simp add: nres_lookup_def)\n apply (simp add: empty_use_env_def)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: sub_use_env_def)\n apply (erule_tac x=\"Loc x21\" in allE)\n apply (auto)\n (* make 2 case: start by assuming we have p_map x *)\n apply (case_tac \"p_map x\")\n apply (simp add: nres_lookup_def)\n apply (rule_tac empty_strong_disj_use_env2)\n (* otherwise, prove r_s disjoint from p_map x *)\n apply (rule_tac add_strong_disj_use_env)\n apply (rule_tac add_strong_disj_use_env)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n (* after this, prove x31 / x32 do not appear in p_map x *)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: sub_use_env_def)\n apply (erule_tac x=\"Loc x31\" in allE)\n apply (auto)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: sub_use_env_def)\n apply (erule_tac x=\"Loc x32\" in allE)\n apply (auto)\n (* write case: otherwise, x42 was removed from r_s, so disjointness should be simple *)\n apply (rule_tac r_s=\"r_s\" in strong_disj_leq_use_env1)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n done \n\nlemma red_sep_nres_map2: \"\\ p_map v = Some r_p; p_map u = Some r_s; u \\ v; disj_nres_map p_map;\n safe_act s1 r_s g_ax; sep_nres_map r_p rs_map \\ \\ sep_nres_map r_p (red_nres_map rs_map g_ax)\" \n apply (case_tac g_ax)\n apply (auto)\n (* make case *)\n apply (rule_tac add_sep_nres_map)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in strong_disj_leq_use_env2)\n apply (simp add: disj_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"v\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n (* make 2 case *)\n apply (rule_tac add_sep_nres_map)\n apply (rule_tac add_sep_nres_map)\n apply (simp)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (rule_tac empty_strong_disj_use_env2)\n (* write case *)\n apply (rule_tac add_sep_nres_map)\n apply (simp)\n apply (rule_tac strong_disj_comp_use_env1)\n apply (simp add: sep_nres_map_def)\n apply (rule_tac r_s=\"r_s\" in strong_disj_leq_use_env2)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"v\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n done \n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ReduceAction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.26269601740679277}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_lemma_inv__1_on_rules imports n_mutualExOnI_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.38861802670584894, "lm_q1q2_score": 0.26261430576568756}} {"text": "section \\Type System\\\ntheory Type_System\nimports Main Gen_Scheduler_Refine Decide_Locality\nbegin\n text \\Currently only a very basic type system:\n Checks that no expression contains overflowing numerals,\n and that all accessed variables exist.\n\\\n\n section \\Typing of Programs\\\n\n type_synonym tenv_valuation = \"ident \\ unit\"\n type_synonym tenv_fs = \"tenv_valuation \\ tenv_valuation\"\n\n definition ty_val :: \"tenv_valuation \\ valuation \\ bool\" where\n \"ty_val \\ vars \\ dom \\ = dom vars\"\n\n abbreviation \"ty_local_state \\ ls \\ ty_val \\ (local_state.variables ls)\"\n abbreviation \"ty_global_state \\ gs \\ ty_val \\ (global_state.variables gs)\"\n\n fun ty_fs :: \"tenv_fs \\ focused_state \\ bool\" where\n \"ty_fs (\\l, \\g) (ls,gs) \\ ty_local_state \\l ls \\ ty_global_state \\g gs\"\n\n declare ty_fs.simps[simp del] \n\n fun ty_expr :: \"tenv_fs \\ exp \\ unit\"\n where\n \"ty_expr (\\l, \\g) (e_var x) = (if x\\dom \\l \\ x\\dom \\g then Some () else None)\"\n | \"ty_expr (\\l, \\g) (e_localvar x) = (if x\\dom \\l then Some () else None)\"\n | \"ty_expr (\\l, \\g) (e_globalvar x) = (if x\\dom \\g then Some () else None)\"\n | \"ty_expr _ (e_const c) = (if min_signed \\ c \\ c \\ max_signed then Some () else None)\"\n | \"ty_expr (\\l, \\g) (e_bin bop e1 e2) = do {\n ty_expr (\\l, \\g) e1;\n ty_expr (\\l, \\g) e2;\n Some ()\n }\"\n | \"ty_expr (\\l, \\g) (e_un uop e) = do {\n ty_expr (\\l, \\g) e;\n Some ()\n }\"\n\n lemma ty_expr_noerr: \n notes [simp] = ty_fs.simps\n shows \"ty_fs \\ fs \\ eval_exp e fs \\ None \\ ty_expr \\ e \\ None\"\n apply (induction e)\n apply (cases fs, cases \\)\n apply (auto split: option.splits simp: ty_val_def) []\n apply (cases fs, cases \\)\n apply (auto split: option.splits simp: ty_val_def) []\n apply (cases fs, cases \\)\n apply (auto split: option.splits simp: ty_val_def) []\n apply (cases fs, cases \\)\n apply (auto split: option.splits simp: ty_val_def) []\n apply (cases fs, cases \\)\n apply (auto split: option.splits Option.bind_splits simp: ty_val_def) []\n apply (cases fs, cases \\)\n apply (auto split: option.splits simp: ty_val_def) []\n done\n\n lemma ty_expr_noerr': \n \"ty_fs \\ fs \\ ty_expr \\ e = Some () \\ (\\v. eval_exp e fs = Some v)\"\n using ty_expr_noerr\n by auto\n\n type_synonym tenv_cmd = \"tenv_fs \\ bool\" \n\n function ty_cmd :: \"tenv_cmd \\ cmd \\ bool\" where\n \"ty_cmd ((\\l,\\g),loop) (Assign c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n (x\\dom \\l | x\\dom \\g) \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_cmd ((\\l,\\g),loop) (Assign_local c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n (x\\dom \\l) \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_cmd ((\\l,\\g),loop) (Assign_global c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n (x\\dom \\g) \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_cmd ((\\l,\\g),loop) (Test e) \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_cmd ((\\l,\\g),loop) (Skip) \\ True\"\n | \"ty_cmd ((\\l,\\g),loop) (Seq c1 c2) \\ ty_cmd ((\\l,\\g),loop) c1 \\ ty_cmd ((\\l,\\g),loop) c2\"\n | \"ty_cmd ((\\l,\\g),loop) (Or c1 c2) \\ ty_cmd ((\\l,\\g),loop) c1 \\ ty_cmd ((\\l,\\g),loop) c2\"\n | \"ty_cmd ((\\l,\\g),loop) (Break) \\ loop\"\n | \"ty_cmd ((\\l,\\g),loop) (Continue) \\ loop\"\n | \"ty_cmd ((\\l,\\g),loop) (Iterate c1 c2) \\ ty_cmd ((\\l,\\g),True) c1 \\ ty_cmd ((\\l,\\g),True) c2\"\n | \"ty_cmd ((\\l,\\g),loop) (Invalid) \\ False\"\n by pat_completeness auto\n \n termination\n apply (relation \"inv_image (reachable_term_order_aux <*mlex*> measure size) snd\")\n apply (auto simp: mlex_prod_def)\n done\n \n theorem ty_cmd_no_internal: \"ty_cmd (\\,False) c \\ cfg c a c' \\ isl a\"\n apply (rotate_tac)\n apply (induction rule: cfg.induct)\n apply (cases \\, (auto) [])+\n done\n\n lemma ty_cmd_pres_aux: \"ty_cmd ((\\l,\\g),loop) c \\ cfg c a c' \\ \n (ty_cmd ((\\l,\\g),loop) c' \\ a=Inr AIBreak \\ a=Inr AIContinue)\" \n apply (rotate_tac)\n apply (induction arbitrary: loop rule: cfg.induct)\n apply auto\n done\n \n corollary ty_cmd_pres: \n \"ty_cmd ((\\l,\\g),False) c \\ cfg c a c' \\ ty_cmd ((\\l,\\g),False) c'\"\n apply (frule (1) ty_cmd_pres_aux)\n apply (frule (1) ty_cmd_no_internal)\n apply auto\n done\n\n definition ty_proc_decl :: \"tenv_valuation \\ proc_decl \\ bool\" where\n \"ty_proc_decl \\g pd \\ let\n \\l = (\\x. if x \\ set (proc_decl.local_vars pd) then Some () else None)\n in\n ty_cmd ((\\l,\\g),False) (proc_decl.body pd)\"\n\n definition ty_program :: \"program \\ bool\" where\n \"ty_program prog == let\n \\g = (\\x. if x\\set (program.global_vars prog) then Some () else None)\n in\n \\pd\\set (program.processes prog). ty_proc_decl \\g pd\"\n\n definition ty_local :: \"cmd \\ local_state \\ global_state \\ bool\" where\n \"ty_local c ls gs \\ \\\\. ty_cmd (\\,False) c \\ ty_fs \\ (ls,gs)\"\n\n definition \"cfg' c a c' \\ cfg c (Inl a) c'\"\n lemma cfg'_eq: \"ty_cmd (\\,False) c \\ cfg c a c' \\ (\\aa. a=Inl aa \\ cfg' c aa c')\"\n by (cases a) (auto dest: ty_cmd_no_internal[of _ c a c'] simp: cfg'_def)\n\n lemma cfg_eq: \"ty_cmd (\\,False) c \\ cfg' c a c' \\ cfg c (Inl a) c'\" \n by (auto simp: cfg'_eq)\n\n section \\Typing of Actions\\ \n text \\\n We split the proof that steps from well-typed configurations\n do not fail and preserve well-typedness in two steps:\n \n First, we show that actions from well-types commands are well-typed.\n Then, we show that well-typed actions do not fail, and preserve \n well-typedness.\n\\\n\n\n fun ty_la :: \"tenv_fs \\ action \\ bool\" where\n \"ty_la (\\l,\\g) (AAssign c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n (x\\dom \\l \\ x\\dom \\g) \\ ty_expr (\\l,\\g) e \\ None\" \n | \"ty_la (\\l,\\g) (AAssign_local c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n x\\dom \\l \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_la (\\l,\\g) (AAssign_global c x e) \\ ty_expr (\\l,\\g) c \\ None \\\n x\\dom \\g \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_la (\\l,\\g) (ATest e) \\ ty_expr (\\l,\\g) e \\ None\"\n | \"ty_la (\\l,\\g) (ASkip) \\ True\"\n\n\n lemma ty_cmd_imp_ty_la_aux:\n assumes \"ty_cmd (\\,loop) c\"\n assumes \"cfg c (Inl a) c'\"\n shows \"ty_la \\ a\"\n using assms (2,1)\n apply (induction c \"Inl a::action+brk_ctd\" c' arbitrary: loop)\n apply (case_tac [!] \\)\n apply auto\n done\n\n lemma ty_cmd_imp_ty_la:\n assumes \"ty_cmd (\\,False) c\"\n assumes \"cfg' c a c'\"\n shows \"ty_la \\ a\"\n using assms\n unfolding cfg_eq[OF assms(1)]\n by (rule ty_cmd_imp_ty_la_aux)\n\n lemma ty_en_defined:\n assumes \"ty_fs \\ fs\"\n assumes \"ty_la \\ a\"\n shows \"la_en fs a \\ None\"\n using assms\n apply (cases \\, cases fs)\n apply (cases a)\n apply (auto\n split: Option.bind_splits \n dest: ty_expr_noerr)\n done\n\n lemma ty_ex_defined: \n assumes \"ty_fs \\ fs\"\n assumes \"ty_la \\ a\"\n assumes \"la_en fs a = Some True\"\n shows \"la_ex fs a \\ None\"\n using assms\n apply (cases \\, cases fs)\n apply (cases a)\n apply (auto\n split: Option.bind_splits \n dest: ty_expr_noerr, \n auto simp: ty_val_def ty_fs.simps)\n apply blast+\n done\n\n lemma ty_ex_pres:\n assumes \"ty_fs \\ fs\"\n assumes \"la_ex fs a = Some fs'\"\n shows \"ty_fs \\ fs'\"\n using assms\n apply (cases \\, cases fs)\n apply (cases a)\n apply (auto\n split: Option.bind_splits if_split_asm \n dest: ty_expr_noerr, \n auto simp: ty_val_def ty_fs.simps)\n done\n\n\n section \\Actions that do not fail\\ \n\n text \\\n We define a refinement of the actions, which \n map failure to not enabled/identity.\n \n This allows for simple POR-related proofs, as non-failure can\n be assumed.\n \\\n definition \"la_en' fs a \\ case la_en fs a of Some b \\ b | None \\ False\"\n definition \"la_ex' fs a \\ case la_ex fs a of Some fs' \\ fs' | None \\ fs\"\n\n interpretation li': Gen_Scheduler'_linit cfg' la_en' la_ex' \"{init_gc prog}\" global_config.state\n for prog .\n\n interpretation li': sched_typing\n cfg la_en la_ex\n cfg' la_en' la_ex'\n ty_local\n apply unfold_locales\n unfolding ty_local_def\n apply (auto \n simp: cfg'_eq\n simp: la_en'_def dest: ty_en_defined[OF _ ty_cmd_imp_ty_la]\n simp: la_ex'_def dest: ty_ex_defined[OF _ ty_cmd_imp_ty_la]\n dest: ty_ex_pres ty_cmd_pres\n split: option.splits\n ) [4]\n\n apply (clarsimp)\n apply (intro exI conjI)\n apply assumption+\n apply (frule (1) ty_ex_pres)\n apply (simp add: ty_val_def ty_fs.simps)\n done\n \n locale well_typed_prog =\n fixes prog\n assumes well_typed_prog: \"ty_program prog\"\n begin\n lemma ty_init[simp, intro!]: \"li'.wf_gglobal (init_gc prog)\"\n using well_typed_prog\n apply (auto \n simp: in_multiset_in_set\n simp: init_gc_def init_pc_def li'.wf_gglobal_def ty_local_def\n simp: ty_program_def ty_proc_decl_def\n dest!: split_list)\n apply (intro exI conjI)\n apply assumption\n apply (auto \n simp: ty_fs.simps ty_val_def init_valuation_def \n split: if_split_asm\n )\n done\n \n sublocale li': sched_typing_init\n cfg la_en la_ex\n cfg' la_en' la_ex'\n \"{init_gc prog}\" global_config.state\n ty_local\n apply unfold_locales\n by auto\n\n lemma \"li'.sa.accept prog = ref_accept prog\" \n by (rule li'.accept_eq)\n\n lemma \"ref_is_run prog r \\ (\\r'. r=Some o r' \\ li'.sa.is_run prog r')\" \n by (rule li'.is_run_conv)\n\n end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/Type_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2624082661398748}} {"text": "section \\Refinement Rule Management\\\ntheory Sepref_Rules\nimports Sepref_Basic Sepref_Constraints\nbegin\n text \\This theory contains tools for managing the refinement rules used by Sepref\\\n\n text \\The theories are based on uncurried functions, i.e.,\n every function has type @{typ \"'a\\'b\"}, where @{typ 'a} is the \n tuple of parameters, or unit if there are none.\n \\\n\n \n definition \"non_dep R \\ \\b. R b = R undefined\"\n lemma non_dep_simp: \"non_dep R \\ NO_MATCH undefined x \\ R x = R undefined\"\n by (auto simp: non_dep_def)\n \n lemma non_dep_K[simp, intro!]: \"non_dep (\\_. c)\" \n by (auto simp: non_dep_def)\n \n definition \"non_dep2 R \\ \\a b. R a b = R undefined undefined\"\n lemma non_dep2_simp: \n \"non_dep2 R \\ NO_MATCH undefined x \\ R x y = R undefined undefined\"\n \"non_dep2 R \\ NO_MATCH undefined y \\ R x y = R undefined undefined\"\n by (auto simp: non_dep2_def)\n \n lemma non_dep2_K[simp, intro!]: \"non_dep2 (\\_ _. c)\" \n by (auto simp: non_dep2_def)\n \n \n \n\n subsection \\Assertion Interface Binding\\\n text \\Binding of interface types to refinement assertions\\\n definition intf_of_assn :: \"('a \\ _ \\ assn) \\ 'b itself \\ bool\" where\n [simp]: \"intf_of_assn a b = True\"\n\n lemma intf_of_assnI: \"intf_of_assn R TYPE('a)\" by simp\n \n named_theorems_rev intf_of_assn \\Links between refinement assertions and interface types\\ \n\n lemma intf_of_assn_fallback: \"intf_of_assn (R :: 'a \\ _ \\ assn) TYPE('a)\" by simp\n\n subsection \\Function Refinement with Precondition\\\n definition fref :: \"('c \\ bool) \\ ('a \\ 'c) set \\ ('c \\ ('b \\ 'd) set)\n \\ (('a \\ 'b) \\ ('c \\ 'd)) set\"\n (\"[_]\\<^sub>f\\<^sub>d _ \\ _\" [0,60,60] 60) \n where \"[P]\\<^sub>f\\<^sub>d R \\ S \\ {(f,g). \\x y. P y \\ (x,y)\\R \\ (f x, g y)\\S y}\"\n \n abbreviation freft (\"_ \\\\<^sub>f\\<^sub>d _\" [60,60] 60) where \"R \\\\<^sub>f\\<^sub>d S \\ ([\\_. True]\\<^sub>f\\<^sub>d R \\ S)\"\n abbreviation freftnd (\"_ \\\\<^sub>f _\" [60,60] 60) where \"R \\\\<^sub>f S \\ ([\\_. True]\\<^sub>f\\<^sub>d R \\ (\\_. S))\"\n abbreviation frefnd (\"[_]\\<^sub>f _ \\ _\" [0,60,60] 60) where \"[P]\\<^sub>f R \\ S \\ [P]\\<^sub>f\\<^sub>d R \\ (\\_. S)\"\n\n \n \n \n\n lemma fref_cons: \n assumes \"(f,g) \\ [P]\\<^sub>f\\<^sub>d R \\ S\"\n assumes \"\\c a. (c,a)\\R' \\ Q a \\ P a\"\n assumes \"R' \\ R\"\n assumes \"\\c a. \\(c,a)\\R'; Q a\\ \\ S a \\ S' a\"\n shows \"(f,g) \\ [Q]\\<^sub>f\\<^sub>d R' \\ S'\"\n using assms\n unfolding fref_def\n by fastforce\n\n lemmas fref_cons' = fref_cons[OF _ _ order_refl order_refl] \n\n lemma frefI[intro?]: \n assumes \"\\x y. \\P y; (x,y)\\R\\ \\ (f x, g y)\\S y\"\n shows \"(f,g)\\fref P R S\"\n using assms\n unfolding fref_def\n by auto\n\n lemma fref_ncI: \"(f,g)\\R\\S \\ (f,g)\\R\\\\<^sub>fS\" \n apply (rule frefI)\n apply parametricity\n done\n\n lemma frefD: \n assumes \"(f,g)\\fref P R S\"\n shows \"\\P y; (x,y)\\R\\ \\ (f x, g y)\\S y\"\n using assms\n unfolding fref_def\n by auto\n\n lemma fref_ncD: \"(f,g)\\R\\\\<^sub>fS \\ (f,g)\\R\\S\" \n apply (rule fun_relI)\n apply (drule frefD)\n apply simp\n apply assumption+\n done\n\n\n \n definition \"rr_comp S R1 R2 x \\ if non_dep R1 then R1 undefined O R2 x else (\\{R1 y | y. (y,x)\\S}) O R2 x\" \n \n lemma rr_comp_K[simp]: \"rr_comp S (\\_. R1) R2 = (\\x. R1 O R2 x)\"\n by (auto simp: rr_comp_def fun_eq_iff)\n\n lemma rr_comp_nondep: \"rr_comp T (\\_. A) R = (\\x. A O (R x))\"\n unfolding rr_comp_def\n by (auto simp: fun_eq_iff)\n \n \n lemma fref_compI: \n \"fref P R1 R2 O fref Q S1 S2 \\\n fref (\\x. Q x \\ (\\y. (y,x)\\S1 \\ P y)) (R1 O S1) (rr_comp S1 R2 S2)\"\n unfolding fref_def rr_comp_def \n apply (cases \"non_dep R2\"; simp)\n subgoal by (fastforce simp: non_dep_simp[of R2])\n subgoal by fastforce\n done\n \n lemma fref_compI':\n \"\\ (f,g)\\fref P R1 R2; (g,h)\\fref Q S1 S2 \\ \n \\ (f,h) \\ fref (\\x. Q x \\ (\\y. (y,x)\\S1 \\ P y)) (R1 O S1) (rr_comp S1 R2 S2)\"\n using fref_compI[of P R1 R2 Q S1 S2] \n by auto\n\n lemma fref_unit_conv:\n \"(\\_. c, \\_. a) \\ fref P unit_rel S \\ (P () \\ (c,a)\\S ())\" \n by (auto simp: fref_def)\n\n lemma fref_uncurry_conv:\n \"(uncurry c, uncurry a) \\ fref P (R1\\\\<^sub>rR2) S \n \\ (\\x1 y1 x2 y2. P (y1,y2) \\ (x1,y1)\\R1 \\ (x2,y2)\\R2 \\ (c x1 x2, a y1 y2) \\ S (y1,y2))\"\n by (auto simp: fref_def)\n\n lemma fref_mono: \"\\ \\x. P' x \\ P x; R' \\ R; \\x y. P' x \\ S x \\ S' x \\ \n \\ fref P R S \\ fref P' R' S'\" \n unfolding fref_def\n by auto blast\n\n lemma fref_composeI:\n assumes FR1: \"(f,g)\\fref P R1 R2\"\n assumes FR2: \"(g,h)\\fref Q S1 S2\"\n assumes C1: \"\\x. P' x \\ Q x\"\n assumes C2: \"\\x y. \\P' x; (y,x)\\S1\\ \\ P y\"\n assumes R1: \"R' \\ R1 O S1\"\n assumes R2: \"\\x. \\ P' x \\ \\ rr_comp S1 R2 S2 x \\ S' x\"\n assumes FH: \"f'=f\" \"h'=h\"\n shows \"(f',h') \\ fref P' R' S'\"\n unfolding FH\n apply (rule set_mp[OF fref_mono fref_compI'[OF FR1 FR2]])\n using C1 C2 apply blast\n using R1 apply blast\n using R2 apply blast\n done\n\n lemma fref_triv: \"A\\Id \\ (f,f)\\[P]\\<^sub>f A \\ Id\"\n by (auto simp: fref_def)\n\n\n subsection \\Heap-Function Refinement\\\n text \\\n The following relates a heap-function with a pure function.\n It contains a precondition, a refinement assertion for the arguments\n before and after execution, and a refinement relation for the result.\n \\\n (* TODO: We only use this with keep/destroy information, so we could model\n the parameter relations as such (('a\\'ai \\ assn) \\ bool) *)\n definition hfref \n :: \"\n ('a \\ bool) \n \\ (('a \\ 'ai \\ assn) \\ ('a \\ 'ai \\ assn)) \n \\ ('a \\ 'ai \\ 'b \\ 'bi \\ assn) \n \\ (('ai \\ 'bi llM) \\ ('a\\'b nres)) set\"\n (\"[_]\\<^sub>a\\<^sub>d _ \\ _\" [0,60,60] 60)\n where\n \"[P]\\<^sub>a\\<^sub>d RS \\ T \\ { (f,g) . \\c a. P a \\ hn_refine (fst RS a c) (f c) (snd RS a c) (T a c) (g a)}\"\n\n abbreviation hfrefnd (\"[_]\\<^sub>a _ \\ _\" [0,60,60] 60) where \"[P]\\<^sub>a RS \\ T \\ ([P]\\<^sub>a\\<^sub>d RS \\ (\\_ _. T))\"\n abbreviation hfreft (\"_ \\\\<^sub>a\\<^sub>d _\" [60,60] 60) where \"RS \\\\<^sub>a\\<^sub>d T \\ ([\\_. True]\\<^sub>a\\<^sub>d RS \\ T)\"\n abbreviation hfreftnd (\"_ \\\\<^sub>a _\" [60,60] 60) where \"RS \\\\<^sub>a T \\ [\\_. True]\\<^sub>a RS \\ T\"\n\n lemma hfrefI[intro?]: \n assumes \"\\c a. P a \\ hn_refine (fst RS a c) (f c) (snd RS a c) (T a c) (g a)\"\n shows \"(f,g)\\hfref P RS T\"\n using assms unfolding hfref_def by blast\n\n lemma hfrefD: \n assumes \"(f,g)\\hfref P RS T\"\n shows \"\\c a. P a \\ hn_refine (fst RS a c) (f c) (snd RS a c) (T a c) (g a)\"\n using assms unfolding hfref_def by blast\n\n lemma hfref_to_ASSERT_conv: \n \"NO_MATCH (\\_. True) P \\ (a,b)\\[P]\\<^sub>a\\<^sub>d R \\ S \\ (a,\\x. doN {ASSERT (P x); b x}) \\ R \\\\<^sub>a\\<^sub>d S\" \n unfolding hfref_def\n apply (clarsimp; safe; clarsimp?)\n apply (rule hn_refine_nofailI)\n apply (simp add: refine_pw_simps)\n subgoal for xc xa\n apply (drule spec[of _ xc])\n apply (drule spec[of _ xa])\n by simp\n done\n\n text \\\n A pair of argument refinement assertions can be created by the \n input assertion and the information whether the parameter is kept or destroyed\n by the function.\n \\ \n primrec hf_pres \n :: \"('a \\ 'b \\ assn) \\ bool \\ ('a \\ 'b \\ assn)\\('a \\ 'b \\ assn)\"\n where \n \"hf_pres R True = (R,R)\" | \"hf_pres R False = (R,invalid_assn R)\"\n\n abbreviation hfkeep \n :: \"('a \\ 'b \\ assn) \\ ('a \\ 'b \\ assn)\\('a \\ 'b \\ assn)\" \n (\"(_\\<^sup>k)\" [1000] 999)\n where \"R\\<^sup>k \\ hf_pres R True\"\n abbreviation hfdrop \n :: \"('a \\ 'b \\ assn) \\ ('a \\ 'b \\ assn)\\('a \\ 'b \\ assn)\" \n (\"(_\\<^sup>d)\" [1000] 999)\n where \"R\\<^sup>d \\ hf_pres R False\"\n\n abbreviation \"hn_kede R kd \\ hn_ctxt (snd (hf_pres R kd))\"\n abbreviation \"hn_keep R \\ hn_kede R True\"\n abbreviation \"hn_dest R \\ hn_kede R False\"\n\n lemma keep_drop_sels[simp]: \n \"fst (R\\<^sup>k) = R\"\n \"snd (R\\<^sup>k) = R\"\n \"fst (R\\<^sup>d) = R\"\n \"snd (R\\<^sup>d) = invalid_assn R\"\n by auto\n\n lemma hf_pres_fst[simp]: \"fst (hf_pres R k) = R\" by (cases k) auto\n\n text \\\n The following operator combines multiple argument assertion-pairs to\n argument assertion-pairs for the product. It is required to state\n argument assertion-pairs for uncurried functions.\n \\ \n definition hfprod :: \"\n (('a \\ 'b \\ assn)\\('a \\ 'b \\ assn)) \n \\ (('c \\ 'd \\ assn)\\('c \\ 'd \\ assn))\n \\ ((('a\\'c) \\ ('b \\ 'd) \\ assn) \\ (('a\\'c) \\ ('b \\ 'd) \\ assn))\"\n (infixl \"*\\<^sub>a\" 65)\n where \"RR *\\<^sub>a SS \\ (prod_assn (fst RR) (fst SS), prod_assn (snd RR) (snd SS))\"\n\n lemma hfprod_fst_snd[simp]:\n \"fst (A *\\<^sub>a B) = prod_assn (fst A) (fst B)\" \n \"snd (A *\\<^sub>a B) = prod_assn (snd A) (snd B)\" \n unfolding hfprod_def by auto\n\n\n\n subsubsection \\Conversion from fref to hfref\\ \n (* TODO: Variant of import-param! Automate this! *)\n lemma fref_to_pure_hfref':\n assumes \"(f,g) \\ [P]\\<^sub>f R\\\\S\\nres_rel\"\n assumes \"\\x. x\\Domain R \\ R\\``Collect P \\ f x = RETURN (f' x)\"\n shows \"(return o f', g) \\ [P]\\<^sub>a (pure R)\\<^sup>k\\pure S\"\n proof -\n \n {\n fix c a\n assume A: \"P a\" \"nofail (g a)\" \"(c, a) \\ R\"\n hence \"\\x. (f' c, x) \\ S \\ RETURN x \\ g a\" \n using assms\n by (fastforce simp: fref_def pw_le_iff pw_nres_rel_iff refine_pw_simps)\n \n hence \"ENTAILS F ((\\((c, a) \\ R) \\* (\\s. \\x. (\\((f' c, x) \\ S) \\* \\(RETURN x \\ g a)) s)) \\* F)\" \n for F :: assn \n using A by vcg\n } note AUX=this \n \n show ?thesis\n apply (rule hfrefI) apply (rule hn_refineI)\n unfolding pure_def \n apply vcg\n apply (rule AUX)\n .\n qed \n\n\n subsubsection \\Conversion from hfref to hnr\\ \n text \\This section contains the lemmas. The ML code is further down. \\\n lemma hf2hnr:\n assumes \"(f,g) \\ [P]\\<^sub>a\\<^sub>d R \\ S\"\n shows \"\\x xi. P x \\ hn_refine (hn_ctxt (fst R) x xi ** \\) (f$xi) (hn_ctxt (snd R) x xi ** \\) (S x xi) (g$x)\"\n using assms\n unfolding hfref_def \n by (auto simp: hn_ctxt_def)\n\n (* Products that stem from currying are tagged by a special refinement relation *) \n definition [simp]: \"to_hnr_prod \\ prod_assn\"\n\n lemma to_hnr_prod_fst_snd:\n \"fst (A *\\<^sub>a B) = to_hnr_prod (fst A) (fst B)\" \n \"snd (A *\\<^sub>a B) = to_hnr_prod (snd A) (snd B)\" \n unfolding hfprod_def by auto\n\n (* Warning: This lemma is carefully set up to be applicable as an unfold rule,\n for more than one level of uncurrying*)\n lemma hnr_uncurry_unfold: \"\n (\\x xi. P x \\ \n hn_refine \n (hn_ctxt (to_hnr_prod A B) x xi ** \\) \n (fi xi) \n (hn_ctxt (to_hnr_prod A' B') x xi ** \\') \n (R x xi) \n (f x))\n\\ (\\b bi a ai. P (a,b) \\\n hn_refine \n (hn_ctxt A a ai ** hn_ctxt B b bi ** \\) \n (fi (ai,bi)) \n (hn_ctxt A' a ai ** hn_ctxt B' b bi ** \\')\n (R (a,b) (ai,bi))\n (f (a,b))\n )\"\n by (auto simp: hn_ctxt_def prod_assn_def sep_conj_ac)\n \n (* \n lemma hnr_intro_dummy:\n \"\\x xi. P x \\ hn_refine (\\ x xi) (c xi) (\\' x xi) (R x) (a x) \\ \\x xi. P x \\ hn_refine (\\ x xi ** \\) (c xi) (\\' x xi ** \\) (R x) (a x)\" \n by simp\n *)\n\n lemma hn_ctxt_ctxt_fix_conv: \"hn_ctxt (hn_ctxt R) = hn_ctxt R\"\n by (simp add: hn_ctxt_def[abs_def])\n\n lemma uncurry_APP: \"uncurry f$(a,b) = f$a$b\" by auto\n\n (* TODO: Replace by more general rule. *) \n lemma norm_RETURN_o: \n \"\\f. (RETURN o f)$x = (RETURN$(f$x))\"\n \"\\f. (RETURN oo f)$x$y = (RETURN$(f$x$y))\"\n \"\\f. (RETURN ooo f)$x$y$z = (RETURN$(f$x$y$z))\"\n \"\\f. (\\x. RETURN ooo f x)$x$y$z$a = (RETURN$(f$x$y$z$a))\"\n \"\\f. (\\x y. RETURN ooo f x y)$x$y$z$a$b = (RETURN$(f$x$y$z$a$b))\"\n by auto\n\n lemma norm_return_o: \n \"\\f. (return o f)$x = (return$(f$x))\"\n \"\\f. (return oo f)$x$y = (return$(f$x$y))\"\n \"\\f. (return ooo f)$x$y$z = (return$(f$x$y$z))\"\n \"\\f. (\\x. return ooo f x)$x$y$z$a = (return$(f$x$y$z$a))\"\n \"\\f. (\\x y. return ooo f x y)$x$y$z$a$b = (return$(f$x$y$z$a$b))\"\n by auto\n\n \n lemma hn_val_unit_conv_emp[simp]: \"hn_val unit_rel x y = \\\"\n by (auto simp: hn_ctxt_def pure_def sep_algebra_simps)\n\n subsubsection \\Conversion from hnr to hfref\\ \n text \\This section contains the lemmas. The ML code is further down. \\\n\n abbreviation \"id_assn \\ pure Id\"\n abbreviation \"unit_assn \\ id_assn :: unit \\ _\"\n\n lemma pure_unit_rel_eq_empty: \"unit_assn x y = \\\" \n by (auto simp: pure_def sep_algebra_simps)\n\n lemma uc_hfprod_sel:\n \"fst (A *\\<^sub>a B) a c = (case (a,c) of ((a1,a2),(c1,c2)) \\ fst A a1 c1 ** fst B a2 c2)\" \n \"snd (A *\\<^sub>a B) a c = (case (a,c) of ((a1,a2),(c1,c2)) \\ snd A a1 c1 ** snd B a2 c2)\" \n by auto\n\n subsubsection \\Conversion from relation to fref\\ \n text \\This section contains the lemmas. The ML code is further down. \\\n\n definition \"CURRY R \\ { (f,g). (uncurry f, uncurry g) \\ R }\"\n\n lemma fref_param1: \"R\\S = R\\\\<^sub>fS\" \n by (auto simp: fref_def fun_relD)\n\n lemma fref_nest: \"[P1]\\<^sub>f R1 \\ ([P2]\\<^sub>f R2 \\ S) \n \\ CURRY ([(\\(a,b). P1 a \\ P2 b)]\\<^sub>f (R1\\\\<^sub>rR2) \\ S)\"\n apply (rule eq_reflection)\n by (auto simp: fref_def CURRY_def)\n\n lemma in_CURRY_conv: \"(f,g) \\ CURRY R \\ (uncurry f, uncurry g) \\ R\" \n unfolding CURRY_def by auto\n\n lemma uncurry0_APP[simp]: \"uncurry0 c $ x = c\" by auto\n\n lemma fref_param0I: \"(c,a)\\R \\ (uncurry0 c, uncurry0 a) \\ unit_rel \\\\<^sub>f R\"\n by (auto simp: fref_def)\n\n subsubsection \\Composition\\\n definition hr_comp :: \"('b \\ 'c \\ assn) \\ ('b \\ 'a) set \\ 'a \\ 'c \\ assn\"\n \\ \\Compose refinement assertion with refinement relation\\\n where \"hr_comp R1 R2 a c \\ EXS b. R1 b c ** \\((b,a)\\R2)\"\n\n definition hrp_comp \n :: \"('d \\ 'b \\ assn) \\ ('d \\ 'c \\ assn)\n \\ ('d \\ 'a) set \\ ('a \\ 'b \\ assn) \\ ('a \\ 'c \\ assn)\"\n \\ \\Compose argument assertion-pair with refinement relation\\ \n where \"hrp_comp RR' S \\ (hr_comp (fst RR') S, hr_comp (snd RR') S) \"\n\n lemma hr_compI: \"(b,a)\\R2 \\ R1 b c \\ hr_comp R1 R2 a c\" \n unfolding hr_comp_def\n by (auto simp: sep_algebra_simps entails_def pred_lift_extract_simps)\n\n lemma hr_comp_Id1[simp]: \"hr_comp (pure Id) R = pure R\" \n unfolding hr_comp_def[abs_def] pure_def\n apply (intro ext)\n by (auto simp: pred_lift_extract_simps)\n\n lemma hr_comp_Id2[simp]: \"hr_comp R Id = R\" \n unfolding hr_comp_def[abs_def]\n apply (intro ext)\n by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n \n lemma hr_comp_emp[simp]: \"hr_comp (\\a c. \\) R a c = \\(\\b. (b,a)\\R)\"\n unfolding hr_comp_def[abs_def]\n apply (intro ext)\n by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n\n lemma hr_comp_prod_conv[simp]:\n \"hr_comp (prod_assn Ra Rb) (Ra' \\\\<^sub>r Rb') \n = prod_assn (hr_comp Ra Ra') (hr_comp Rb Rb')\" \n unfolding hr_comp_def[abs_def] prod_assn_def[abs_def]\n apply (intro ext)\n apply (auto 0 3 simp: sep_algebra_simps pred_lift_extract_simps)\n done\n\n lemma hr_comp_pure: \"hr_comp (pure R) S = pure (R O S)\" \n apply (intro ext)\n unfolding hr_comp_def[abs_def] pure_def\n by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n\n lemma hr_comp_is_pure[safe_constraint_rules]: \"is_pure A \\ is_pure (hr_comp A B)\"\n by (auto simp: hr_comp_pure is_pure_conv)\n\n lemma hr_comp_the_pure: \"is_pure A \\ the_pure (hr_comp A B) = the_pure A O B\"\n unfolding is_pure_conv\n by (clarsimp simp: hr_comp_pure)\n\n lemma rdomp_hrcomp_conv[simp]: \"rdomp (hr_comp A R) x \\ (\\y. rdomp A y \\ (y,x)\\R)\"\n by (auto simp: rdomp_def hr_comp_def sep_algebra_simps pred_lift_extract_simps)\n\n lemma hn_rel_compI: \n \"\\nofail a; (b,a)\\\\R2\\nres_rel\\ \\ hn_rel R1 b c \\ hn_rel (hr_comp R1 R2) a c\"\n unfolding hr_comp_def hn_rel_def nres_rel_def entails_def\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n apply (drule (1) order_trans)\n apply (auto simp add: ret_le_down_conv)\n done\n\n (* \n lemma hr_comp_precise[constraint_rules]:\n assumes [safe_constraint_rules]: \"precise R\"\n assumes SV: \"single_valued S\"\n shows \"precise (hr_comp R S)\"\n apply (rule preciseI)\n unfolding hr_comp_def\n apply clarsimp\n by (metis SV assms(1) preciseD single_valuedD)\n *)\n\n lemma hr_comp_assoc: \"hr_comp (hr_comp R S) T = hr_comp R (S O T)\"\n apply (intro ext)\n unfolding hr_comp_def\n by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n\n \n lemma hrp_comp_Id1[simp]: \"hrp_comp (hf_pres (pure Id) pp) R = hf_pres (pure R) pp\"\n unfolding hrp_comp_def apply (cases pp) apply auto\n by (auto simp: hr_comp_def[abs_def] invalid_assn_def[abs_def] fun_eq_iff sep_algebra_simps pred_lift_extract_simps)\n \n lemma hrp_comp_Id2[simp]: \"hrp_comp A Id = A\"\n unfolding hrp_comp_def by auto\n\n lemma hnr_comp_aux:\n assumes \"RETURN x \\ m\" \"nofail m'\" \"(m,m')\\\\R\\nres_rel\"\n obtains x' where \"(x,x')\\R\" \"RETURN x' \\ m'\"\n by (meson assms(1) assms(2) assms(3) inres_def nres_relD pwD2 pw_conc_inres)\n \n \n \n definition \"hrr_comp R R1 R2 x y a c \\ \n if non_dep2 R1 then\n hr_comp (R1 undefined undefined) (R2 x) a c\n else\n EXS b. \\((b,x)\\R) ** hr_comp (R1 b y) (R2 x) a c\"\n \n lemma hnr_comp:\n assumes R: \"\\b1 c1. P b1 \\ hn_refine (R1 b1 c1 ** \\) (c c1) (R1p b1 c1 ** \\') (R b1 c1) (b b1)\"\n assumes S: \"\\a1 b1. \\Q a1; (b1,a1)\\R1'\\ \\ (b b1,a a1)\\\\R' a1\\nres_rel\"\n assumes PQ: \"\\a1 b1. \\Q a1; (b1,a1)\\R1'\\ \\ P b1\"\n assumes Q: \"Q a1\"\n shows \"hn_refine \n (hr_comp R1 R1' a1 c1 ** \\) \n (c c1)\n (hr_comp R1p R1' a1 c1 ** \\') \n (hrr_comp R1' R R' a1 c1) \n (a a1)\"\n proof -\n\n note [vcg_rules] = R[THEN hn_refineD, of _ c1]\n \n have [simp]: \"nofail (b x)\" if \"nofail (a a1)\" \"(x, a1) \\ R1'\" for x\n using that Q S nres_rel_def pw_ref_iff by fastforce\n \n \n show ?thesis \n unfolding hn_refine_alt\n unfolding hr_comp_def hn_rel_def hrr_comp_def\n apply (cases \"non_dep2 R\"; simp)\n subgoal premises prems\n apply (auto simp: sep_algebra_simps)\n using PQ[OF Q] \n supply [simp] = non_dep2_simp[OF prems]\n apply vcg\n apply (frule S[OF Q])\n apply (erule (2) hnr_comp_aux)\n by vcg_try_solve\n subgoal \n apply (auto simp: sep_algebra_simps)\n using PQ[OF Q]\n apply vcg\n apply (frule S[OF Q])\n apply (erule (2) hnr_comp_aux)\n by vcg_try_solve\n \n done\n qed\n \n\n lemma hnr_comp1_aux:\n assumes R: \"\\b1 c1. P b1 \\ hn_refine (hn_ctxt R1 b1 c1) (c c1) (hn_ctxt R1p b1 c1) (R b1 c1) (b$b1)\"\n assumes S: \"\\a1 b1. \\Q a1; (b1,a1)\\R1'\\ \\ (b$b1,a$a1)\\\\R' a1\\nres_rel\"\n assumes PQ: \"\\a1 b1. \\Q a1; (b1,a1)\\R1'\\ \\ P b1\"\n assumes Q: \"Q a1\"\n shows \"hn_refine \n (hr_comp R1 R1' a1 c1) \n (c c1)\n (hr_comp R1p R1' a1 c1) \n (hrr_comp R1' R R' a1 c1) \n (a a1)\"\n using assms hnr_comp[where \\=\\ and \\'=\\ and a=a and b=b and c=c and P=P and Q=Q] \n unfolding hn_ctxt_def\n by auto\n\n lemma hfcomp:\n assumes A: \"(f,g) \\ [P]\\<^sub>a\\<^sub>d RR' \\ S\"\n assumes B: \"(g,h) \\ [Q]\\<^sub>f\\<^sub>d T \\ (\\x. \\U x\\nres_rel)\"\n shows \"(f,h) \\ [\\a. Q a \\ (\\a'. (a',a)\\T \\ P a')]\\<^sub>a\\<^sub>d \n hrp_comp RR' T \\ hrr_comp T S U\"\n using assms \n unfolding fref_def hfref_def hrp_comp_def\n apply clarsimp\n apply (rule hnr_comp1_aux[of \n P \"fst RR'\" f \"snd RR'\" S g \"\\a. Q a \\ (\\a'. (a',a)\\T \\ P a')\" T h U])\n apply (auto simp: hn_ctxt_def)\n done\n\n lemma hrr_comp_nondep: \"hrr_comp T (\\_ _. A) R = (\\x _. hr_comp A (R x))\"\n unfolding hrr_comp_def\n by (auto simp: fun_eq_iff)\n \n (* TODO: Concept of lifting dependent relation over other relation! Allows us to handle hrr_comp R R1 (\\_. Id) *)\n lemma hrr_comp_Id_R_Id: \"hrr_comp Id R1 (\\_. Id) = R1\"\n by (auto simp: hrr_comp_def fun_eq_iff pred_lift_extract_simps non_dep2_simp[of R1])\n \n lemma hrr_comp_id_conv[simp]: \"hrr_comp Id R1 R2 = (\\x y. hr_comp (R1 x y) (R2 x))\"\n unfolding hrr_comp_def\n by (auto simp: fun_eq_iff pred_lift_extract_simps non_dep2_simp[of R1])\n \n \n lemma hfref_weaken_pre_nofail: \n assumes \"(f,g) \\ [P]\\<^sub>a\\<^sub>d R \\ S\" \n shows \"(f,g) \\ [\\x. nofail (g x) \\ P x]\\<^sub>a\\<^sub>d R \\ S\"\n using assms\n unfolding hfref_def hn_refine_def\n by auto\n\n lemma hfref_cons:\n assumes \"(f,g) \\ [P]\\<^sub>a\\<^sub>d R \\ S\"\n assumes \"\\x. P' x \\ P x\"\n assumes \"\\x y. fst R' x y \\ fst R x y\"\n assumes \"\\x y. snd R x y \\ snd R' x y\"\n assumes \"\\x y a c. P' a \\ S a c x y \\ S' a c x y\"\n shows \"(f,g) \\ [P']\\<^sub>a\\<^sub>d R' \\ S'\"\n unfolding hfref_def\n apply clarsimp\n apply (rule hn_refine_cons)\n apply (rule assms(3))\n defer\n \n apply (rule entails_trans[OF assms(4) entails_refl])\n apply (erule assms(5))\n apply (frule assms(2))\n using assms(1)\n unfolding hfref_def\n apply auto\n done\n \n (*lemma xfer_hrr_comp:\n assumes \"\\x y a c. \\ (x,y)\\T \\ \\ R x a c \\ R' y a c\" \n shows \"hrr_comp T R S x a c \\ (hr_comp (R' x) S) a c\"\n using assms unfolding hrr_comp_def\n apply (cases \"non_dep R\"; simp)\n subgoal sorry\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps entails_def hr_comp_def non_dep_simp[of R])\n *) \n\n subsubsection \\Composition Automation\\ \n text \\This section contains the lemmas. The ML code is further down. \\\n\n lemma prod_hrp_comp: \n \"hrp_comp (A *\\<^sub>a B) (C \\\\<^sub>r D) = hrp_comp A C *\\<^sub>a hrp_comp B D\"\n unfolding hrp_comp_def hfprod_def by simp\n \n lemma hrp_comp_keep: \"hrp_comp (A\\<^sup>k) B = (hr_comp A B)\\<^sup>k\"\n by (auto simp: hrp_comp_def)\n\n lemma hr_comp_invalid: \"hr_comp (invalid_assn R1) R2 = invalid_assn (hr_comp R1 R2)\"\n apply (intro ext)\n unfolding invalid_assn_def hr_comp_def\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n apply (auto simp: pure_part_def) (* TODO: too low-level! *)\n done\n\n lemma hrp_comp_dest: \"hrp_comp (A\\<^sup>d) B = (hr_comp A B)\\<^sup>d\"\n by (auto simp: hrp_comp_def hr_comp_invalid)\n\n\n\n definition \"hrp_imp RR RR' \\ \n \\a b. (fst RR' a b \\ fst RR a b) \\ (snd RR a b \\ snd RR' a b)\"\n\n lemma hfref_imp: \"hrp_imp RR RR' \\ [P]\\<^sub>a RR \\ S \\ [P]\\<^sub>a RR' \\ S\" \n apply clarsimp\n apply (erule hfref_cons)\n apply (simp_all add: hrp_imp_def)\n done\n \n lemma hrp_imp_refl: \"hrp_imp RR RR\"\n unfolding hrp_imp_def by auto\n\n lemma hrp_imp_reflI: \"RR = RR' \\ hrp_imp RR RR'\"\n unfolding hrp_imp_def by auto\n\n\n lemma hrp_comp_cong: \"hrp_imp A A' \\ B=B' \\ hrp_imp (hrp_comp A B) (hrp_comp A' B')\"\n by (auto simp: hrp_imp_def hrp_comp_def hr_comp_def entails_def sep_algebra_simps pred_lift_extract_simps)\n \n lemma hrp_prod_cong: \"hrp_imp A A' \\ hrp_imp B B' \\ hrp_imp (A*\\<^sub>aB) (A'*\\<^sub>aB')\"\n by (auto simp: hrp_imp_def prod_assn_def sep_algebra_simps pred_lift_extract_simps\n intro: conj_entails_mono\n )\n\n lemma hrp_imp_trans: \"hrp_imp A B \\ hrp_imp B C \\ hrp_imp A C\" \n unfolding hrp_imp_def\n by (fastforce intro: entails_trans)\n\n lemma fcomp_norm_dflt_init: \"x\\[P]\\<^sub>a R \\ T \\ hrp_imp R S \\ x\\[P]\\<^sub>a S \\ T\"\n apply (erule set_rev_mp)\n by (rule hfref_imp)\n\n definition \"comp_PRE R P Q S \\ \\x. S x \\ (P x \\ (\\y. (y,x)\\R \\ Q x y))\"\n\n lemma comp_PRE_cong[cong]: \n assumes \"R\\R'\"\n assumes \"\\x. P x \\ P' x\"\n assumes \"\\x. S x \\ S' x\"\n assumes \"\\x y. \\P x; (y,x)\\R; y\\Domain R; S' x \\ \\ Q x y \\ Q' x y\"\n shows \"comp_PRE R P Q S \\ comp_PRE R' P' Q' S'\"\n using assms\n by (fastforce simp: comp_PRE_def intro!: eq_reflection ext)\n\n lemma fref_compI_PRE:\n \"\\ (f,g)\\fref P R1 R2; (g,h)\\fref Q S1 S2 \\ \n \\ (f,h) \\ fref (comp_PRE S1 Q (\\_. P) (\\_. True)) (R1 O S1) (rr_comp S1 R2 S2)\"\n using fref_compI[of P R1 R2 Q S1 S2] \n unfolding comp_PRE_def\n by auto\n\n lemma PRE_D1: \"(Q x \\ P x) \\ comp_PRE S1 Q (\\x _. P x) S x\"\n by (auto simp: comp_PRE_def)\n\n lemma PRE_D2: \"(Q x \\ (\\y. (y,x)\\S1 \\ S x \\ P x y)) \\ comp_PRE S1 Q P S x\"\n by (auto simp: comp_PRE_def)\n\n lemma fref_weaken_pre: \n assumes \"\\x. P x \\ P' x\" \n assumes \"(f,h) \\ fref P' R S\"\n shows \"(f,h) \\ fref P R S\"\n apply (rule set_rev_mp[OF assms(2) fref_mono])\n using assms(1) by auto\n \n lemma fref_PRE_D1:\n assumes \"(f,h) \\ fref (comp_PRE S1 Q (\\x _. P x) X) R S\" \n shows \"(f,h) \\ fref (\\x. Q x \\ P x) R S\"\n by (rule fref_weaken_pre[OF PRE_D1 assms])\n\n lemma fref_PRE_D2:\n assumes \"(f,h) \\ fref (comp_PRE S1 Q P X) R S\" \n shows \"(f,h) \\ fref (\\x. Q x \\ (\\y. (y,x)\\S1 \\ X x \\ P x y)) R S\"\n by (rule fref_weaken_pre[OF PRE_D2 assms])\n\n lemmas fref_PRE_D = fref_PRE_D1 fref_PRE_D2\n\n lemma hfref_weaken_pre: \n assumes \"\\x. P x \\ P' x\" \n assumes \"(f,h) \\ hfref P' R S\"\n shows \"(f,h) \\ hfref P R S\"\n using assms\n by (auto simp: hfref_def)\n\n lemma hfref_weaken_pre': \n assumes \"\\x. \\P x; rdomp (fst R) x\\ \\ P' x\" \n assumes \"(f,h) \\ hfref P' R S\"\n shows \"(f,h) \\ hfref P R S\"\n apply (rule hfrefI)\n apply (rule hn_refine_preI)\n using assms\n by (auto simp: hfref_def rdomp_def)\n\n lemma hfref_weaken_pre_nofail': \n assumes \"(f,g) \\ [P]\\<^sub>a\\<^sub>d R \\ S\" \n assumes \"\\x. \\nofail (g x); Q x\\ \\ P x\"\n shows \"(f,g) \\ [Q]\\<^sub>a\\<^sub>d R \\ S\"\n apply (rule hfref_weaken_pre[OF _ assms(1)[THEN hfref_weaken_pre_nofail]])\n using assms(2) \n by blast\n\n lemma hfref_with_rdomI:\n assumes \"(c,a)\\[\\x. P x \\ rdomp (fst A) x]\\<^sub>a\\<^sub>d A \\ R\"\n shows \"(c,a)\\[P]\\<^sub>a\\<^sub>d A \\ R\"\n by (metis (no_types, lifting) assms hfref_weaken_pre')\n \n lemma hfref_compI_PRE_aux:\n assumes A: \"(f,g) \\ [P]\\<^sub>a\\<^sub>d RR' \\ S\"\n assumes B: \"(g,h) \\ [Q]\\<^sub>f\\<^sub>d T \\ (\\x. \\U x\\nres_rel)\"\n shows \"(f,h) \\ [comp_PRE T Q (\\_. P) (\\_. True)]\\<^sub>a\\<^sub>d \n hrp_comp RR' T \\ hrr_comp T S U\"\n apply (rule hfref_weaken_pre[OF _ hfcomp[OF A B]])\n by (auto simp: comp_PRE_def)\n\n\n lemma hfref_compI_PRE:\n assumes A: \"(f,g) \\ [P]\\<^sub>a\\<^sub>d RR' \\ S\"\n assumes B: \"(g,h) \\ [Q]\\<^sub>f\\<^sub>d T \\ (\\x. \\U x\\nres_rel)\"\n shows \"(f,h) \\ [comp_PRE T Q (\\x y. P y) (\\x. nofail (h x))]\\<^sub>a\\<^sub>d \n hrp_comp RR' T \\ hrr_comp T S U\"\n using hfref_compI_PRE_aux[OF A B, THEN hfref_weaken_pre_nofail] \n apply (rule hfref_weaken_pre[rotated])\n apply (auto simp: comp_PRE_def)\n done\n\n lemma hfref_PRE_D1:\n assumes \"(f,h) \\ hfref (comp_PRE S1 Q (\\x _. P x) X) R S\" \n shows \"(f,h) \\ hfref (\\x. Q x \\ P x) R S\"\n by (rule hfref_weaken_pre[OF PRE_D1 assms])\n\n lemma hfref_PRE_D2:\n assumes \"(f,h) \\ hfref (comp_PRE S1 Q P X) R S\" \n shows \"(f,h) \\ hfref (\\x. Q x \\ (\\y. (y,x)\\S1 \\ X x \\ P x y)) R S\"\n by (rule hfref_weaken_pre[OF PRE_D2 assms])\n\n lemma hfref_PRE_D3:\n assumes \"(f,h) \\ hfref (comp_PRE S1 Q P X) R S\" \n shows \"(f,h) \\ hfref (comp_PRE S1 Q P X) R S\"\n using assms .\n\n lemmas hfref_PRE_D = hfref_PRE_D1 hfref_PRE_D3\n\n subsection \\Automation\\ \n text \\Purity configuration for constraint solver\\\n lemmas [safe_constraint_rules] = pure_pure\n\n lemma invalid_pure[safe_constraint_rules]: \"is_pure (invalid_assn A)\"\n unfolding invalid_assn_def is_pure_def by auto\n \n text \\Configuration for hfref to hnr conversion\\\n named_theorems to_hnr_post \\to_hnr converter: Postprocessing unfold rules\\\n\n lemma uncurry0_add_app_tag: \"uncurry0 (RETURN c) = uncurry0 (RETURN$c)\" by simp\n\n thm sep_conj_empty[of \"P::ll_assn\" for P]\n \n lemmas [to_hnr_post] = norm_RETURN_o norm_return_o\n uncurry0_add_app_tag uncurry0_apply uncurry0_APP hn_val_unit_conv_emp\n sep_conj_empty[of \"P::ll_assn\" for P] sep_conj_empty'[of \"P::ll_assn\" for P]\n\n named_theorems to_hfref_post \\to_hfref converter: Postprocessing unfold rules\\ \n lemma prod_casesK[to_hfref_post]: \"case_prod (\\_ _. k) = (\\_. k)\" by auto\n lemma uncurry0_hfref_post[to_hfref_post]: \"hfref (uncurry0 True) R S = hfref (\\_. True) R S\" \n apply (fo_rule arg_cong fun_cong)+ by auto\n\n\n (* Currently not used, we keep it in here anyway. *) \n text \\Configuration for relation normalization after composition\\\n named_theorems fcomp_norm_unfold \\fcomp-normalizer: Unfold theorems\\\n named_theorems fcomp_norm_simps \\fcomp-normalizer: Simplification theorems\\\n named_theorems fcomp_norm_init \"fcomp-normalizer: Initialization rules\" \n named_theorems fcomp_norm_trans \"fcomp-normalizer: Transitivity rules\" \n named_theorems fcomp_norm_cong \"fcomp-normalizer: Congruence rules\" \n named_theorems fcomp_norm_norm \"fcomp-normalizer: Normalization rules\" \n named_theorems fcomp_norm_refl \"fcomp-normalizer: Reflexivity rules\" \n\n text \\Default Setup\\\n lemmas [fcomp_norm_unfold] = prod_rel_comp nres_rel_comp Id_O_R R_O_Id\n lemmas [fcomp_norm_unfold] = hr_comp_Id1 hr_comp_Id2 hrp_comp_Id1 hrp_comp_Id2\n find_theorems rr_comp\n lemmas [fcomp_norm_unfold] = hrr_comp_nondep rr_comp_nondep\n lemmas [fcomp_norm_unfold] = hr_comp_prod_conv\n lemmas [fcomp_norm_unfold] = prod_hrp_comp hrp_comp_keep hrp_comp_dest hr_comp_pure\n (*lemmas [fcomp_norm_unfold] = prod_casesK uncurry0_hfref_post*)\n\n lemma [fcomp_norm_simps]: \"CONSTRAINT is_pure P \\ pure (the_pure P) = P\" by simp\n lemmas [fcomp_norm_simps] = True_implies_equals \n \n lemmas [fcomp_norm_init] = fcomp_norm_dflt_init\n lemmas [fcomp_norm_trans] = hrp_imp_trans\n lemmas [fcomp_norm_cong] = hrp_comp_cong hrp_prod_cong\n (*lemmas [fcomp_norm_norm] = hrp_comp_dest*)\n lemmas [fcomp_norm_refl] = refl hrp_imp_refl\n\n lemma ensure_fref_nresI: \"(f,g)\\[P]\\<^sub>f\\<^sub>d R\\S \\ (RETURN o f, RETURN o g)\\[P]\\<^sub>f\\<^sub>d R\\(\\x. \\S x\\nres_rel)\" \n by (auto intro: nres_relI simp: fref_def)\n\n lemma ensure_fref_nres_unfold:\n \"\\f. RETURN o (uncurry0 f) = uncurry0 (RETURN f)\" \n \"\\f. RETURN o (uncurry f) = uncurry (RETURN oo f)\"\n \"\\f. (RETURN ooo uncurry) f = uncurry (RETURN ooo f)\"\n by auto\n\n text \\Composed precondition normalizer\\ \n named_theorems fcomp_prenorm_simps \\fcomp precondition-normalizer: Simplification theorems\\\n\n text \\Support for preconditions of the form @{text \"_\\Domain R\"}, \n where @{text R} is the relation of the next more abstract level.\\\n declare DomainI[fcomp_prenorm_simps]\n\n lemma auto_weaken_pre_init_hf: \n assumes \"\\x. PROTECT P x \\ P' x\" \n assumes \"(f,h) \\ hfref P' R S\"\n shows \"(f,h) \\ hfref P R S\"\n using assms\n by (auto simp: hfref_def)\n\n lemma auto_weaken_pre_init_f: \n assumes \"\\x. PROTECT P x \\ P' x\" \n assumes \"(f,h) \\ fref P' R S\"\n shows \"(f,h) \\ fref P R S\"\n using assms\n by (auto simp: fref_def)\n\n lemmas auto_weaken_pre_init = auto_weaken_pre_init_hf auto_weaken_pre_init_f \n\n lemma auto_weaken_pre_uncurry_step:\n assumes \"PROTECT f a \\ f'\"\n shows \"PROTECT (\\(x,y). f x y) (a,b) \\ f' b\" \n using assms\n by (auto simp: curry_def dest!: meta_eq_to_obj_eq intro!: eq_reflection)\n\n lemma auto_weaken_pre_uncurry_finish: \n \"PROTECT f x \\ f x\" by (auto)\n\n lemma auto_weaken_pre_uncurry_start:\n assumes \"P \\ P'\"\n assumes \"P'\\Q\"\n shows \"P\\Q\"\n using assms by (auto)\n\n \n\n lemma auto_weaken_pre_to_imp_nf:\n \"(A\\B\\C) = (A\\B \\ C)\"\n \"((A\\B)\\C) = (A\\B\\C)\"\n by auto\n\n lemma auto_weaken_pre_add_dummy_imp:\n \"P \\ True \\ P\" by simp\n\n\n text \\Synthesis for hfref statements\\ \n definition hfsynth_ID_R :: \"('a \\ _ \\ assn) \\ 'a \\ bool\" where\n [simp]: \"hfsynth_ID_R _ _ \\ True\"\n\n lemma hfsynth_ID_R_D:\n fixes I :: \"'a itself\"\n assumes \"hfsynth_ID_R R a\"\n assumes \"intf_of_assn R I\"\n shows \"a ::\\<^sub>i I\"\n by simp\n\n lemma hfsynth_hnr_from_hfI:\n assumes \"\\x xi. P x \\ hfsynth_ID_R (fst R) x \\ hn_refine (hn_ctxt (fst R) x xi ** \\) (f$xi) (hn_ctxt (snd R) x xi ** \\) (S x xi) (g$x)\"\n shows \"(f,g) \\ [P]\\<^sub>a\\<^sub>d R \\ S\"\n using assms\n unfolding hfref_def \n by (auto simp: hn_ctxt_def)\n\n\n lemma hfsynth_ID_R_uncurry_unfold: \n \"hfsynth_ID_R (to_hnr_prod R S) (a,b) \\ hfsynth_ID_R R a \\ hfsynth_ID_R S b\" \n \"hfsynth_ID_R (fst (hf_pres R k)) \\ hfsynth_ID_R R\"\n by (auto intro!: eq_reflection)\n\n \n ML \\\n\n signature SEPREF_RULES = sig\n (* Analysis of relations, both fref and fun_rel *)\n (* \"R1\\...\\Rn\\_\" / \"[_]\\<^sub>f ((R1\\\\<^sub>rR2)...\\\\<^sub>rRn)\" \\ \"[R1,...,Rn]\" *)\n val binder_rels: term -> term list \n (* \"_\\...\\_\\S\" / \"[_]\\<^sub>f _ \\ S\" \\ \"S\" *)\n val body_rel: term -> term \n (* Map \\/fref to (precond,args,res). NONE if no/trivial precond. *)\n val analyze_rel: term -> term option * term list * term \n (* Make trivial (\"\\_. True\") precond *)\n val mk_triv_precond: term list -> term \n (* Make \"[P]\\<^sub>f\\<^sub>d ((R1\\\\<^sub>rR2)...\\\\<^sub>rRn) \\ S\". Insert trivial precond if NONE. *)\n val mk_rel: term option * term list * term -> term \n (* Map relation to (args,res) *)\n val strip_rel: term -> term list * term \n\n (* Make hfprod (op *\\<^sub>a) *)\n val mk_hfprod : term * term -> term\n val mk_hfprods : term list -> term\n\n (* Determine interface type of refinement assertion, using default fallback\n if necessary. Use named_thms intf_of_assn for configuration. *)\n val intf_of_assn : Proof.context -> term -> typ\n\n (*\n Convert a parametricity theorem in higher-order form to\n uncurried fref-form. For functions without arguments, \n a unit-argument is added.\n\n TODO/FIXME: Currently this only works for higher-order theorems,\n i.e., theorems of the form (f,g)\\R1\\\\\\Rn. \n \n First-order theorems are silently treated as refinement theorems\n for functions with zero arguments, i.e., a unit-argument is added.\n *)\n val to_fref : Proof.context -> thm -> thm\n\n (* Convert a parametricity or fref theorem to first order form *)\n val to_foparam : Proof.context -> thm -> thm\n\n (* Convert schematic hfref goal to hnr-goal *)\n val prepare_hfref_synth_tac : Proof.context -> tactic'\n\n (* Convert theorem in hfref-form to hnr-form *)\n val to_hnr : Proof.context -> thm -> thm\n\n (* Convert theorem in hnr-form to hfref-form *)\n val to_hfref: Proof.context -> thm -> thm\n\n (* Convert theorem to given form, if not yet in this form *)\n val ensure_fref : Proof.context -> thm -> thm\n val ensure_fref_nres : Proof.context -> thm -> thm\n val ensure_hfref : Proof.context -> thm -> thm\n val ensure_hnr : Proof.context -> thm -> thm\n\n\n type hnr_analysis = {\n thm: thm, (* Original theorem, may be normalized *)\n precond: term, (* Precondition, abstracted over abs-arguments *)\n prems : term list, (* Premises not depending on arguments *)\n ahead: term * bool, (* Abstract function, has leading RETURN *)\n chead: term * bool, (* Concrete function, has leading return *)\n argrels: (term * bool) list, (* Argument relations, preserved (keep-flag) *)\n result_rel: term (* Result relation *)\n }\n \n val analyze_hnr: Proof.context -> thm -> hnr_analysis\n val pretty_hnr_analysis: Proof.context -> hnr_analysis -> Pretty.T\n val mk_hfref_thm: Proof.context -> hnr_analysis -> thm\n \n \n\n (* Simplify precondition of fref/hfref-theorem *)\n val simplify_precond: Proof.context -> thm -> thm\n\n (* Normalize hfref-theorem after composition *)\n val norm_fcomp_rule: Proof.context -> thm -> thm\n\n (* Replace \"pure ?A\" by \"?A'\" and is_pure constraint, then normalize *)\n val add_pure_constraints_rule: Proof.context -> thm -> thm\n\n (* Compose fref/hfref and fref theorem, to produce hfref theorem.\n The input theorems may also be in ho-param or hnr form, and\n are converted accordingly.\n *)\n val gen_compose : Proof.context -> thm -> thm -> thm\n\n (* FCOMP-attribute *)\n val fcomp_attrib: attribute context_parser\n end\n\n structure Sepref_Rules: SEPREF_RULES = struct\n\n local open Refine_Util Relators in\n fun binder_rels @{mpat \"?F \\ ?G\"} = F::binder_rels G\n | binder_rels @{mpat \"fref _ ?F _\"} = strip_prodrel_left F\n | binder_rels _ = []\n \n local \n fun br_aux @{mpat \"_ \\ ?G\"} = br_aux G\n | br_aux R = R\n in \n fun body_rel @{mpat \"fref _ _ ?G\"} = G\n | body_rel R = br_aux R\n end\n \n fun strip_rel R = (binder_rels R, body_rel R) \n \n fun analyze_rel @{mpat \"fref (\\_. True) ?R ?S\"} = (NONE,strip_prodrel_left R,S)\n | analyze_rel @{mpat \"fref ?P ?R ?S\"} = (SOME P,strip_prodrel_left R,S)\n | analyze_rel R = let\n val (args,res) = strip_rel R\n val argTuc = \n map (fastype_of #> HOLogic.dest_setT #> HOLogic.dest_prodT #> snd) args \n |> list_prodT_left\n val res = Term.absdummy argTuc res\n in\n (NONE,args,res)\n end\n \n fun mk_triv_precond Rs = absdummy (map rel_absT Rs |> list_prodT_left) @{term True}\n \n fun mk_rel (P,Rs,S) = let \n val R = list_prodrel_left Rs \n \n val P = case P of \n SOME P => P \n | NONE => mk_triv_precond Rs\n \n in \n @{mk_term \"fref ?P ?R ?S\"} \n end\n end\n\n\n fun mk_hfprod (a, b) = @{mk_term \"?a*\\<^sub>a?b\"}\n \n local \n fun mk_hfprods_rev [] = @{mk_term \"unit_assn\\<^sup>k\"}\n | mk_hfprods_rev [Rk] = Rk\n | mk_hfprods_rev (Rkn::Rks) = mk_hfprod (mk_hfprods_rev Rks, Rkn)\n in\n val mk_hfprods = mk_hfprods_rev o rev\n end\n\n\n fun intf_of_assn ctxt t = let\n val orig_ctxt = ctxt\n val (t,ctxt) = yield_singleton (Variable.import_terms false) t ctxt\n\n val v = TVar ((\"T\",0),Proof_Context.default_sort ctxt (\"T\",0)) |> Logic.mk_type\n val goal = @{mk_term \"Trueprop (intf_of_assn ?t ?v)\"}\n\n val i_of_assn_rls = \n Named_Theorems_Rev.get ctxt @{named_theorems_rev intf_of_assn}\n @ @{thms intf_of_assn_fallback}\n\n fun tac ctxt = REPEAT_ALL_NEW (resolve_tac ctxt i_of_assn_rls)\n\n val thm = Goal.prove ctxt [] [] goal (fn {context,...} => ALLGOALS (tac context))\n val intf = case Thm.concl_of thm of\n @{mpat \"Trueprop (intf_of_assn _ (?v AS\\<^sub>p TYPE (_)))\"} => v \n | _ => raise THM(\"Intf_of_assn: Proved a different theorem?\",~1,[thm])\n\n val intf = singleton (Variable.export_terms ctxt orig_ctxt) intf\n |> Logic.dest_type\n\n in\n intf\n end\n\n datatype rthm_type = \n RT_HOPARAM (* (_,_) \\ _ \\ \\ \\ _ *)\n | RT_FREF (* (_,_) \\ [_]\\<^sub>f _ \\ _ *)\n | RT_HNR (* hn_refine _ _ _ _ _ *)\n | RT_HFREF (* (_,_) \\ [_]\\<^sub>a _ \\ _ *)\n | RT_OTHER\n\n fun rthm_type thm =\n case Thm.concl_of thm |> HOLogic.dest_Trueprop of\n @{mpat \"(_,_) \\ fref _ _ _\"} => RT_FREF\n | @{mpat \"(_,_) \\ hfref _ _ _\"} => RT_HFREF\n | @{mpat \"hn_refine _ _ _ _ _\"} => RT_HNR\n | @{mpat \"(_,_) \\ _\"} => RT_HOPARAM (* TODO: Distinction between ho-param and fo-param *)\n | _ => RT_OTHER\n\n\n fun to_fref ctxt thm = let\n open Conv\n in \n case Thm.concl_of thm |> HOLogic.dest_Trueprop of\n @{mpat \"(_,_)\\_\\_\"} =>\n Local_Defs.unfold0 ctxt @{thms fref_param1} thm\n |> fconv_rule (repeat_conv (Refine_Util.ftop_conv (K (rewr_conv @{thm fref_nest})) ctxt))\n |> Local_Defs.unfold0 ctxt @{thms in_CURRY_conv}\n | @{mpat \"(_,_)\\_\"} => thm RS @{thm fref_param0I} \n | _ => raise THM (\"to_fref: Expected theorem of form (_,_)\\_\",~1,[thm])\n end\n\n fun to_foparam ctxt thm = let\n val unf_thms = @{thms \n split_tupled_all prod_rel_simp uncurry_apply cnv_conj_to_meta Product_Type.split}\n in\n case Thm.concl_of thm of\n @{mpat \"Trueprop ((_,_) \\ fref _ _ _)\"} =>\n (@{thm frefD} OF [thm])\n |> forall_intr_vars\n |> Local_Defs.unfold0 ctxt unf_thms\n |> Variable.gen_all ctxt\n | @{mpat \"Trueprop ((_,_) \\ _)\"} =>\n Parametricity.fo_rule thm\n | _ => raise THM(\"Expected parametricity or fref theorem\",~1,[thm])\n end\n\n fun to_hnr ctxt thm =\n (thm RS @{thm hf2hnr})\n |> Local_Defs.unfold0 ctxt @{thms to_hnr_prod_fst_snd keep_drop_sels} (* Resolve fst and snd over *\\<^sub>a and R\\<^sup>k, R\\<^sup>d *)\n |> Local_Defs.unfold0 ctxt @{thms hnr_uncurry_unfold} (* Resolve products for uncurried parameters *)\n |> Local_Defs.unfold0 ctxt @{thms uncurry_apply uncurry_APP sep_conj_empty' split} (* Remove the uncurry modifiers, the emp-dummy, and unfold product cases *)\n |> Local_Defs.unfold0 ctxt @{thms hn_ctxt_ctxt_fix_conv} (* Remove duplicate hn_ctxt tagging *)\n |> Local_Defs.unfold0 ctxt @{thms all_to_meta imp_to_meta HOL.True_implies_equals HOL.implies_True_equals Pure.triv_forall_equality cnv_conj_to_meta} (* Convert to meta-level, remove vacuous condition *)\n |> Local_Defs.unfold0 ctxt (Named_Theorems.get ctxt @{named_theorems to_hnr_post}) (* Post-Processing *)\n |> Goal.norm_result ctxt\n |> Conv.fconv_rule Thm.eta_conversion\n\n (* Convert schematic hfref-goal to hn_refine goal *) \n fun prepare_hfref_synth_tac ctxt = let\n val i_of_assn_rls = \n Named_Theorems_Rev.get ctxt @{named_theorems_rev intf_of_assn}\n @ @{thms intf_of_assn_fallback}\n\n val to_hnr_post_rls = \n Named_Theorems.get ctxt @{named_theorems to_hnr_post}\n\n val i_of_assn_tac = (\n REPEAT' (\n DETERM o dresolve_tac ctxt @{thms hfsynth_ID_R_D}\n THEN' DETERM o SOLVED' (REPEAT_ALL_NEW (resolve_tac ctxt i_of_assn_rls))\n )\n )\n in\n (* Note: To re-use the to_hnr infrastructure, we first work with\n $-tags on the abstract function, which are finally removed.\n *)\n resolve_tac ctxt @{thms hfsynth_hnr_from_hfI} THEN_ELSE' (\n SELECT_GOAL (\n unfold_tac ctxt @{thms to_hnr_prod_fst_snd keep_drop_sels hf_pres_fst} (* Distribute fst,snd over product and hf_pres *)\n THEN unfold_tac ctxt @{thms hnr_uncurry_unfold hfsynth_ID_R_uncurry_unfold} (* Curry parameters *)\n THEN unfold_tac ctxt @{thms uncurry_apply uncurry_APP sep_conj_empty' split} (* Curry parameters (II) and remove emp assertion *)\n (*THEN unfold_tac ctxt @{thms hn_ctxt_ctxt_fix_conv} (* Remove duplicate hn_ctxt (Should not be necessary) *)*)\n THEN unfold_tac ctxt @{thms all_to_meta imp_to_meta HOL.True_implies_equals HOL.implies_True_equals Pure.triv_forall_equality cnv_conj_to_meta} (* Convert precondition to meta-level *)\n THEN ALLGOALS i_of_assn_tac (* Generate _::\\<^sub>i_ premises*)\n THEN unfold_tac ctxt to_hnr_post_rls (* Postprocessing *)\n THEN unfold_tac ctxt @{thms APP_def} (* Get rid of $ - tags *)\n )\n ,\n K all_tac\n )\n end\n\n\n (************************************) \n (* Analyze hnr *)\n structure Termtab2 = Table(\n type key = term * term \n val ord = prod_ord Term_Ord.fast_term_ord Term_Ord.fast_term_ord);\n \n type hnr_analysis = {\n thm: thm, \n precond: term, \n prems : term list,\n ahead: term * bool, \n chead: term * bool, \n argrels: (term * bool) list, \n result_rel: term \n }\n \n \n fun analyze_hnr (ctxt:Proof.context) thm = let\n \n (* Debug information: Stores string*term pairs, which are pretty-printed on error *)\n val dbg = Unsynchronized.ref []\n fun add_dbg msg ts = (\n dbg := (msg,ts) :: !dbg;\n ()\n )\n fun pretty_dbg (msg,ts) = Pretty.block [\n Pretty.str msg,\n Pretty.str \":\",\n Pretty.brk 1,\n Pretty.list \"[\" \"]\" (map (Syntax.pretty_term ctxt) ts)\n ]\n fun pretty_dbgs l = map pretty_dbg l |> Pretty.fbreaks |> Pretty.block\n \n fun trace_dbg msg = Pretty.block [Pretty.str msg, Pretty.fbrk, pretty_dbgs (rev (!dbg))] |> Pretty.string_of |> tracing\n \n fun fail msg = (trace_dbg msg; raise THM(msg,~1,[thm])) \n fun assert cond msg = cond orelse fail msg;\n \n \n (* Heads may have a leading return/RETURN.\n The following code strips off the leading return, unless it has the form\n \"return x\" for an argument x\n *)\n fun check_strip_leading args t f = (* Handle the case RETURN x, where x is an argument *)\n if Termtab.defined args f then (t,false) else (f,true)\n \n fun strip_leading_RETURN args (t as @{mpat \"RETURN$(?f)\"}) = check_strip_leading args t f\n | strip_leading_RETURN args (t as @{mpat \"RETURN ?f\"}) = check_strip_leading args t f\n | strip_leading_RETURN _ t = (t,false)\n \n fun strip_leading_return args (t as @{mpat \"return$(?f)\"}) = check_strip_leading args t f\n | strip_leading_return args (t as @{mpat \"return ?f\"}) = check_strip_leading args t f\n | strip_leading_return _ t = (t,false)\n \n \n (* The following code strips the arguments of the concrete or abstract\n function. It knows how to handle APP-tags ($), and stops at PR_CONST-tags.\n \n Moreover, it only strips actual arguments that occur in the \n precondition-section of the hn_refine-statement. This ensures\n that non-arguments, like maxsize, are treated correctly.\n *) \n fun strip_fun _ (t as @{mpat \"PR_CONST _\"}) = (t,[])\n | strip_fun s (t as @{mpat \"?f$?x\"}) = check_arg s t f x\n | strip_fun s (t as @{mpat \"?f ?x\"}) = check_arg s t f x\n | strip_fun _ f = (f,[])\n and check_arg s t f x = \n if Termtab.defined s x then\n strip_fun s f |> apsnd (curry op :: x)\n else (t,[]) \n \n (* Arguments in the pre/postcondition are wrapped into hn_ctxt tags. \n This function strips them off. *) \n fun dest_hn_ctxt @{mpat \"hn_ctxt ?R ?a ?c\"} = ((a,c),R)\n | dest_hn_ctxt _ = fail \"Invalid hn_ctxt parameter in pre or postcondition\"\n \n \n fun dest_hn_refine @{mpat \"(hn_refine ?G ?c ?G' ?R ?a)\"} = (G,c,G',R,a) \n | dest_hn_refine _ = fail \"Conclusion is not a hn_refine statement\"\n \n (*\n Strip separation conjunctions. Special case for \"emp\", which is ignored. \n *) \n fun is_emp @{mpat \\} = true | is_emp _ = false\n \n val strip_star' = Sepref_Basic.strip_star #> filter (not o is_emp)\n \n (* Compare Termtab2s for equality of keys *) \n fun pairs_eq pairs1 pairs2 = \n Termtab2.forall (Termtab2.defined pairs1 o fst) pairs2\n andalso Termtab2.forall (Termtab2.defined pairs2 o fst) pairs1\n \n \n fun atomize_prem @{mpat \"Trueprop ?p\"} = p\n | atomize_prem _ = fail \"Non-atomic premises\"\n \n (* Make HOL conjunction list *) \n fun mk_conjs [] = @{const True}\n | mk_conjs [p] = p\n | mk_conjs (p::ps) = HOLogic.mk_binop @{const_name \"HOL.conj\"} (p,mk_conjs ps)\n \n \n (***********************) \n (* Start actual analysis *)\n \n val _ = add_dbg \"thm\" [Thm.prop_of thm]\n val prems = Thm.prems_of thm\n val concl = Thm.concl_of thm |> HOLogic.dest_Trueprop\n val (G,c,G',R,a) = dest_hn_refine concl\n \n val pre_pairs = G \n |> strip_star'\n |> tap (add_dbg \"precondition\")\n |> map dest_hn_ctxt\n |> Termtab2.make\n \n val post_pairs = G' \n |> strip_star'\n |> tap (add_dbg \"postcondition\")\n |> map dest_hn_ctxt\n |> Termtab2.make\n \n val _ = assert (pairs_eq pre_pairs post_pairs) \n \"Parameters in precondition do not match postcondition\"\n \n val aa_set = pre_pairs |> Termtab2.keys |> map fst |> Termtab.make_set\n val ca_set = pre_pairs |> Termtab2.keys |> map snd |> Termtab.make_set\n \n val (a,leading_RETURN) = strip_leading_RETURN aa_set a\n val (c,leading_return) = strip_leading_return ca_set c\n \n val _ = add_dbg \"stripped abstract term\" [a]\n val _ = add_dbg \"stripped concrete term\" [c]\n \n val (ahead,aargs) = strip_fun aa_set a;\n val (chead,cargs) = strip_fun ca_set c;\n \n val _ = add_dbg \"abstract head\" [ahead]\n val _ = add_dbg \"abstract args\" aargs\n val _ = add_dbg \"concrete head\" [chead]\n val _ = add_dbg \"concrete args\" cargs\n \n \n val _ = assert (length cargs = length aargs) \"Different number of abstract and concrete arguments\";\n \n val _ = assert (not (has_duplicates op aconv aargs)) \"Duplicate abstract arguments\"\n val _ = assert (not (has_duplicates op aconv cargs)) \"Duplicate concrete arguments\"\n \n val argpairs = aargs ~~ cargs\n val ap_set = Termtab2.make_set argpairs\n val _ = assert (pairs_eq pre_pairs ap_set) \"Arguments from pre/postcondition do not match operation's arguments\"\n \n val pre_rels = map (the o (Termtab2.lookup pre_pairs)) argpairs\n val post_rels = map (the o (Termtab2.lookup post_pairs)) argpairs\n \n val _ = add_dbg \"pre-rels\" pre_rels\n val _ = add_dbg \"post-rels\" post_rels\n\n fun adjust_hf_pres @{mpat \"snd (?R\\<^sup>k)\"} = R\n | adjust_hf_pres t = t\n \n val post_rels = map adjust_hf_pres post_rels\n \n fun is_invalid R @{mpat \"invalid_assn ?R'\"} = R aconv R'\n | is_invalid _ @{mpat \"snd (_\\<^sup>d)\"} = true\n | is_invalid _ _ = false\n \n fun is_keep (R,R') =\n if R aconv R' then true\n else if is_invalid R R' then false\n else fail \"Mismatch between pre and post relation for argument\"\n \n val keep = map is_keep (pre_rels ~~ post_rels)\n \n val argrels = pre_rels ~~ keep\n\n val aa_set = Termtab.make_set aargs\n val ca_set = Termtab.make_set cargs\n\n fun is_precond t =\n (exists_subterm (Termtab.defined ca_set) t andalso fail \"Premise contains concrete argument\")\n orelse exists_subterm (Termtab.defined aa_set) t\n\n val (preconds, prems) = split is_precond prems \n \n val precond = \n map atomize_prem preconds \n |> mk_conjs\n |> fold lambda aargs\n \n val _ = add_dbg \"precond\" [precond]\n val _ = add_dbg \"prems\" prems\n \n in\n {\n thm = thm,\n precond = precond,\n prems = prems,\n ahead = (ahead,leading_RETURN),\n chead = (chead,leading_return),\n argrels = argrels,\n result_rel = R\n }\n end \n \n fun pretty_hnr_analysis \n ctxt \n ({thm,precond,ahead,chead,argrels,result_rel,...}) \n : Pretty.T =\n let \n val _ = thm (* Suppress unused warning for thm *)\n\n fun pretty_argrel (R,k) = Pretty.block [\n Syntax.pretty_term ctxt R,\n if k then Pretty.str \"\\<^sup>k\" else Pretty.str \"\\<^sup>d\"\n ]\n \n val pretty_chead = case chead of \n (t,false) => Syntax.pretty_term ctxt t \n | (t,true) => Pretty.block [Pretty.str \"return \", Syntax.pretty_term ctxt t]\n\n val pretty_ahead = case ahead of \n (t,false) => Syntax.pretty_term ctxt t \n | (t,true) => Pretty.block [Pretty.str \"RETURN \", Syntax.pretty_term ctxt t]\n\n in\n Pretty.fbreaks [\n (*Display.pretty_thm ctxt thm,*)\n Pretty.block [ \n Pretty.enclose \"[\" \"]\" [pretty_chead, pretty_ahead],\n Pretty.enclose \"[\" \"]\" [Syntax.pretty_term ctxt precond],\n Pretty.brk 1,\n Pretty.block (Pretty.separate \" \\\" (map pretty_argrel argrels @ [Syntax.pretty_term ctxt result_rel]))\n ]\n ] |> Pretty.block\n \n end\n \n \n fun mk_hfref_thm \n ctxt \n ({thm,precond,prems,ahead,chead,argrels,result_rel}) = \n let\n \n fun mk_keep (R,true) = @{mk_term \"?R\\<^sup>k\"}\n | mk_keep (R,false) = @{mk_term \"?R\\<^sup>d\"}\n \n (* TODO: Move, this is of general use! *) \n fun mk_uncurry f = @{mk_term \"uncurry ?f\"} \n \n (* Uncurry function for the given number of arguments. \n For zero arguments, add a unit-parameter.\n *)\n fun rpt_uncurry n t =\n if n=0 then @{mk_term \"uncurry0 ?t\"}\n else if n=1 then t \n else funpow (n-1) mk_uncurry t\n \n (* Rewrite uncurried lambda's to \\(_,_). _ form. Use top-down rewriting\n to correctly handle nesting to the left. \n \n TODO: Combine with abstraction and uncurry-procedure,\n and mark the deviation about uncurry as redundant \n intermediate step to be eliminated.\n *) \n fun rew_uncurry_lambda t = let\n val rr = map (Logic.dest_equals o Thm.prop_of) @{thms uncurry_def uncurry0_def}\n val thy = Proof_Context.theory_of ctxt\n in \n Pattern.rewrite_term_top thy rr [] t \n end \n \n (* Shortcuts for simplification tactics *)\n fun gsimp_only ctxt sec = let\n val ss = put_simpset HOL_basic_ss ctxt |> sec\n in asm_full_simp_tac ss end\n \n fun simp_only ctxt thms = gsimp_only ctxt (fn ctxt => ctxt addsimps thms)\n \n \n (********************************)\n (* Build theorem statement *)\n (* \\prems\\ \\ (chead,ahead) \\ [precond] rels \\ R *)\n \n (* Uncurry precondition *)\n val num_args = length argrels\n val precond = precond\n |> rpt_uncurry num_args\n |> rew_uncurry_lambda (* Convert to nicer \\((...,_),_) - form*)\n\n (* Re-attach leading RETURN/return *)\n fun mk_RETURN (t,r) = if r then \n let\n val T = funpow num_args range_type (fastype_of (fst ahead))\n val tRETURN = Const (@{const_name RETURN}, T --> Type(@{type_name nres},[T]))\n in\n Refine_Util.mk_compN num_args tRETURN t\n end \n else t\n \n fun mk_return (t,r) = if r then @{mk_term \"return ?t :: _ llM\"}\n (*let\n val T = funpow num_args range_type (fastype_of (fst chead))\n val tRETURN = Const (@{const_name return}, T --> Type(@{type_name llvm_memory},[T]))\n in\n Refine_Util.mk_compN num_args tRETURN t\n end *)\n else t\n \n (* Hrmpf!: Gone for good from 2015\\2016. Inserting ctxt-based substitute here. *) \n fun certify_inst ctxt (instT, inst) =\n (map (apsnd (Thm.ctyp_of ctxt)) instT,\n map (apsnd (Thm.cterm_of ctxt)) inst);\n\n (* \n fun mk_RETURN (t,r) = if r then @{mk_term \"RETURN o ?t\"} else t\n fun mk_return (t,r) = if r then @{mk_term \"return o ?t\"} else t\n *)\n \n (* Uncurry abstract and concrete function, append leading return *)\n val ahead = ahead |> mk_RETURN |> rpt_uncurry num_args \n val chead = chead |> mk_return |> rpt_uncurry num_args \n \n (* Add keep-flags and summarize argument relations to product *)\n val argrel = map mk_keep argrels |> rev (* TODO: Why this rev? *) |> mk_hfprods\n \n (* Produce final result statement *)\n \n val _ = @{print} chead\n val _ = @{print} (fastype_of chead)\n \n val result = @{mk_term \"Trueprop ((?chead,?ahead) \\ [?precond]\\<^sub>a ?argrel \\ ?result_rel)\"}\n val result = Logic.list_implies (prems,result)\n \n (********************************)\n (* Prove theorem *)\n \n (* Create context and import result statement and original theorem *)\n val orig_ctxt = ctxt\n (*val thy = Proof_Context.theory_of ctxt*)\n val (insts, ctxt) = Variable.import_inst true [result] ctxt\n val insts' = certify_inst ctxt insts\n val result = Term_Subst.instantiate insts result\n val thm = Thm.instantiate insts' thm\n \n (* Unfold APP tags. This is required as some APP-tags have also been unfolded by analysis *)\n val thm = Local_Defs.unfold0 ctxt @{thms APP_def} thm\n \n (* Tactic to prove the theorem. \n A first step uses hfrefI to get a hnr-goal.\n This is then normalized in several consecutive steps, which \n get rid of uncurrying. Finally, the original theorem is used for resolution,\n where the pre- and postcondition, and result relation are connected with \n a consequence rule, to handle unfolded hn_ctxt-tags, re-ordered relations,\n and introduced unit-parameters (TODO: \n Mark artificially introduced unit-parameter specially, it may get confused \n with intentional unit-parameter, e.g., functional empty_set ()!)\n \n *)\n fun tac ctxt = \n resolve_tac ctxt @{thms hfrefI}\n THEN' gsimp_only ctxt (fn c => c \n addsimps @{thms uncurry_def hn_ctxt_def uncurry0_def\n keep_drop_sels uc_hfprod_sel o_apply\n APP_def}\n |> Splitter.add_split @{thm prod.split}\n ) \n \n THEN' TRY o (\n REPEAT_ALL_NEW (match_tac ctxt @{thms allI impI})\n THEN' simp_only ctxt @{thms Product_Type.split prod.inject})\n \n THEN' TRY o REPEAT_ALL_NEW (ematch_tac ctxt @{thms conjE})\n THEN' TRY o hyp_subst_tac ctxt\n THEN' simp_only ctxt @{thms triv_forall_equality}\n THEN' (\n resolve_tac ctxt @{thms hn_refine_cons[rotated]} \n THEN' (resolve_tac ctxt [thm] THEN_ALL_NEW assume_tac ctxt))\n THEN_ALL_NEW simp_only ctxt \n @{thms hn_ctxt_def entails_refl pure_unit_rel_eq_empty\n mult_ac mult_1 mult_1_right keep_drop_sels} \n \n (* Prove theorem *) \n val result = Thm.cterm_of ctxt result\n val rthm = Goal.prove_internal ctxt [] result (fn _ => ALLGOALS (tac ctxt))\n \n (* Export statement to original context *)\n val rthm = singleton (Variable.export ctxt orig_ctxt) rthm\n \n (* Post-processing *)\n val rthm = Local_Defs.unfold0 ctxt (Named_Theorems.get ctxt @{named_theorems to_hfref_post}) rthm\n\n in\n rthm\n end\n \n fun to_hfref ctxt = analyze_hnr ctxt #> mk_hfref_thm ctxt\n\n\n\n\n (***********************************)\n (* Composition *)\n\n local\n fun norm_set_of ctxt = {\n trans_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_trans},\n cong_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_cong},\n norm_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_norm},\n refl_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_refl}\n }\n \n fun init_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_init}\n fun unfold_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_unfold}\n fun simp_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_simps}\n\n in \n fun norm_fcomp_rule ctxt = let\n open PO_Normalizer Refine_Util\n val norm1 = gen_norm_rule (init_rules_of ctxt) (norm_set_of ctxt) ctxt\n val norm2 = Local_Defs.unfold0 ctxt (unfold_rules_of ctxt)\n val norm3 = Conv.fconv_rule (\n Simplifier.asm_full_rewrite \n (put_simpset HOL_basic_ss ctxt addsimps simp_rules_of ctxt))\n \n val norm = changed_rule (try_rule norm1 o try_rule norm2 o try_rule norm3)\n in\n repeat_rule norm\n end\n end \n\n fun add_pure_constraints_rule ctxt thm = let\n val orig_ctxt = ctxt\n \n val t = Thm.prop_of thm\n \n fun \n cnv (@{mpat (typs) \"pure (mpaq_STRUCT (mpaq_Var ?x _) :: (?'v_c\\?'v_a) set)\"}) = \n let\n val T = a --> c --> @{typ assn}\n val t = Var (x,T)\n val t = @{mk_term \"(the_pure ?t)\"}\n in\n [(x,T,t)]\n end\n | cnv (t$u) = union op= (cnv t) (cnv u)\n | cnv (Abs (_,_,t)) = cnv t \n | cnv _ = []\n \n val pvars = cnv t\n \n val _ = (pvars |> map #1 |> has_duplicates op=) \n andalso raise TERM (\"Duplicate indexname with different type\",[t]) (* This should not happen *)\n \n val substs = map (fn (x,_,t) => (x,t)) pvars\n \n val t' = subst_Vars substs t \n \n fun mk_asm (x,T,_) = let\n val t = Var (x,T)\n val t = @{mk_term \"Trueprop (CONSTRAINT is_pure ?t)\"}\n in\n t\n end\n \n val assms = map mk_asm pvars\n \n fun add_prems prems t = let\n val prems' = Logic.strip_imp_prems t\n val concl = Logic.strip_imp_concl t\n in\n Logic.list_implies (prems@prems', concl)\n end\n \n val t' = add_prems assms t'\n \n val (t',ctxt) = yield_singleton (Variable.import_terms true) t' ctxt\n \n val thm' = Goal.prove_internal ctxt [] (Thm.cterm_of ctxt t') (fn _ => \n ALLGOALS (resolve_tac ctxt [thm] THEN_ALL_NEW assume_tac ctxt))\n \n val thm' = norm_fcomp_rule ctxt thm'\n\n val thm' = singleton (Variable.export ctxt orig_ctxt) thm'\n in\n thm'\n end \n\n\n val cfg_simp_precond = \n Attrib.setup_config_bool @{binding fcomp_simp_precond} (K true)\n\n local\n fun mk_simp_thm ctxt t = let\n val st = t\n |> HOLogic.mk_Trueprop\n |> Thm.cterm_of ctxt\n |> Goal.init\n \n val ctxt = Context_Position.set_visible false ctxt \n val ctxt = ctxt addsimps (\n refine_pw_simps.get ctxt \n @ Named_Theorems.get ctxt @{named_theorems fcomp_prenorm_simps}\n @ @{thms split_tupled_all cnv_conj_to_meta} \n )\n \n val trace_incomplete_transfer_tac =\n COND (Thm.prems_of #> exists (strip_all_body #> Logic.strip_imp_concl #> Term.is_open))\n (print_tac ctxt \"Failed transfer from intermediate level:\") all_tac\n \n val tac = \n ALLGOALS (resolve_tac ctxt @{thms auto_weaken_pre_comp_PRE_I} )\n THEN ALLGOALS (Simplifier.asm_full_simp_tac ctxt)\n THEN trace_incomplete_transfer_tac\n THEN ALLGOALS (TRY o filter_prems_tac ctxt (K false))\n THEN Local_Defs.unfold0_tac ctxt [Drule.triv_forall_equality]\n \n val st' = tac st |> Seq.take 1 |> Seq.list_of\n val thm = case st' of [st'] => Goal.conclude st' | _ => raise THM(\"Simp_Precond: Simp-Tactic failed\",~1,[st])\n \n (* Check generated premises for leftover intermediate stuff *)\n val _ = exists (Logic.is_all) (Thm.prems_of thm) \n andalso raise THM(\"Simp_Precond: Transfer from intermediate level failed\",~1,[thm])\n \n val thm = \n thm\n (*|> map (Simplifier.asm_full_simplify ctxt)*)\n |> Conv.fconv_rule (Object_Logic.atomize ctxt)\n |> Local_Defs.unfold0 ctxt @{thms auto_weaken_pre_to_imp_nf}\n \n val thm = case Thm.concl_of thm of\n @{mpat \"Trueprop (_ \\ _)\"} => thm\n | @{mpat \"Trueprop _\"} => thm RS @{thm auto_weaken_pre_add_dummy_imp} \n | _ => raise THM(\"Simp_Precond: Generated odd theorem, expected form 'P\\Q'\",~1,[thm])\n \n \n in\n thm\n end\n in \n fun simplify_precond ctxt thm = let\n val orig_ctxt = ctxt\n val thm = Refine_Util.OF_fst @{thms auto_weaken_pre_init} [asm_rl,thm]\n val thm = \n Local_Defs.unfold0 ctxt @{thms split_tupled_all} thm\n OF @{thms auto_weaken_pre_uncurry_start}\n \n fun rec_uncurry thm =\n case try (fn () => thm OF @{thms auto_weaken_pre_uncurry_step}) () of\n NONE => thm OF @{thms auto_weaken_pre_uncurry_finish}\n | SOME thm => rec_uncurry thm \n \n val thm = rec_uncurry thm \n |> Conv.fconv_rule Thm.eta_conversion\n \n val t = case Thm.prems_of thm of\n t::_ => t | _ => raise THM(\"Simp-Precond: Expected at least one premise\",~1,[thm])\n \n val (t,ctxt) = yield_singleton (Variable.import_terms false) t ctxt\n val ((_,t),ctxt) = Variable.focus NONE t ctxt\n val t = case t of\n @{mpat \"Trueprop (_ \\ ?t)\"} => t | _ => raise TERM(\"Simp_Precond: Expected implication\",[t])\n \n val simpthm = mk_simp_thm ctxt t \n |> singleton (Variable.export ctxt orig_ctxt)\n \n val thm = thm OF [simpthm] \n val thm = Local_Defs.unfold0 ctxt @{thms prod_casesK} thm\n in\n thm\n end\n\n fun simplify_precond_if_cfg ctxt =\n if Config.get ctxt cfg_simp_precond then\n simplify_precond ctxt\n else I\n\n end \n\n (* fref O fref *)\n fun compose_ff ctxt A B = \n (@{thm fref_compI_PRE} OF [A,B])\n |> norm_fcomp_rule ctxt\n |> simplify_precond_if_cfg ctxt\n |> Conv.fconv_rule Thm.eta_conversion\n\n (* hfref O fref *)\n fun compose_hf ctxt A B =\n (@{thm hfref_compI_PRE} OF [A,B])\n |> norm_fcomp_rule ctxt\n |> simplify_precond_if_cfg ctxt\n |> Conv.fconv_rule Thm.eta_conversion\n |> add_pure_constraints_rule ctxt\n |> Conv.fconv_rule Thm.eta_conversion\n\n fun ensure_fref ctxt thm = case rthm_type thm of\n RT_HOPARAM => to_fref ctxt thm\n | RT_FREF => thm\n | _ => raise THM(\"Expected parametricity or fref theorem\",~1,[thm])\n\n fun ensure_fref_nres ctxt thm = let\n val thm = ensure_fref ctxt thm\n in\n case Thm.concl_of thm of\n @{mpat (typs) \"Trueprop (_\\fref _ _ (_::_ \\ (_ nres\\_)set))\"} => thm\n | @{mpat \"Trueprop ((_,_)\\fref _ _ _)\"} => \n (thm RS @{thm ensure_fref_nresI}) |> Local_Defs.unfold0 ctxt @{thms ensure_fref_nres_unfold}\n | _ => raise THM(\"Expected fref-theorem\",~1,[thm])\n end\n\n fun ensure_hfref ctxt thm = case rthm_type thm of\n RT_HNR => to_hfref ctxt thm\n | RT_HFREF => thm\n | _ => raise THM(\"Expected hnr or hfref theorem\",~1,[thm])\n\n fun ensure_hnr ctxt thm = case rthm_type thm of\n RT_HNR => thm\n | RT_HFREF => to_hnr ctxt thm\n | _ => raise THM(\"Expected hnr or hfref theorem\",~1,[thm])\n\n fun gen_compose ctxt A B = let\n val rtA = rthm_type A\n in\n if rtA = RT_HOPARAM orelse rtA = RT_FREF then\n compose_ff ctxt (ensure_fref ctxt A) (ensure_fref ctxt B)\n else \n compose_hf ctxt (ensure_hfref ctxt A) ((ensure_fref_nres ctxt B))\n \n end\n\n val parse_fcomp_flags = Refine_Util.parse_paren_lists \n (Refine_Util.parse_bool_config \"prenorm\" cfg_simp_precond)\n\n val fcomp_attrib = parse_fcomp_flags |-- Attrib.thm >> (fn B => Thm.rule_attribute [] (fn context => fn A => \n let\n val ctxt = Context.proof_of context\n in \n gen_compose ctxt A B\n end))\n\n end\n \\\n\n attribute_setup to_fref = \\\n Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_fref o Context.proof_of))\n \\ \"Convert parametricity theorem to uncurried fref-form\" \n\n attribute_setup to_foparam = \\\n Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_foparam o Context.proof_of))\n \\ \\Convert param or fref rule to first order rule\\\n (* Overloading existing param_fo - attribute from Parametricity.thy *)\n attribute_setup param_fo = \\\n Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_foparam o Context.proof_of))\n \\ \\Convert param or fref rule to first order rule\\\n\n attribute_setup to_hnr = \\\n Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_hnr o Context.proof_of))\n \\ \"Convert hfref-rule to hnr-rule\"\n \n attribute_setup to_hfref = \\Scan.succeed (\n Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.to_hfref)\n )\\ \\Convert hnr to hfref theorem\\\n\n\n attribute_setup ensure_fref_nres = \\Scan.succeed (\n Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.ensure_fref_nres)\n )\\\n\n attribute_setup sepref_dbg_norm_fcomp_rule = \\Scan.succeed (\n Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.norm_fcomp_rule)\n )\\\n\n attribute_setup sepref_simplify_precond = \\Scan.succeed (\n Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.simplify_precond)\n )\\ \\Simplify precondition of fref/hfref-theorem\\\n\n attribute_setup FCOMP = Sepref_Rules.fcomp_attrib \"Composition of refinement rules\"\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/Sepref_Rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2624082661398747}} {"text": "theory Incredible_Correctness\nimports\n Abstract_Rules_To_Incredible\n Natural_Deduction\nbegin\n\ntext \\\nIn this theory, we prove that if we have a graph that proves a given abstract task (which is\nrepresented as the context @{term Tasked_Proof_Graph}), then we can prove @{term solved}.\n\\\n\ncontext Tasked_Proof_Graph\nbegin\n\ndefinition adjacentTo :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex \\ ('form, 'var) out_port)\" where\n \"adjacentTo v p = (SOME ps. (ps, (v,p)) \\ edges)\"\n\nfun isReg where\n \"isReg v p = (case p of Hyp h c \\ False | Reg c \\\n (case nodeOf v of\n Conclusion a \\ False\n | Assumption a \\ False\n | Rule r \\ True\n | Helper \\ True\n ))\"\n\nfun toNatRule where\n \"toNatRule v p = (case p of Hyp h c \\ Axiom | Reg c \\\n (case nodeOf v of\n Conclusion a \\ Axiom \\ \\a lie\\\n | Assumption a \\ Axiom\n | Rule r \\ NatRule (r,c)\n | Helper \\ Cut\n ))\"\n\n\ninductive_set global_assms' :: \"'var itself \\ 'form set\" for i where\n \"v |\\| vertices \\ nodeOf v = Assumption p \\ labelAtOut v (Reg p) \\ global_assms' i\"\n\nlemma finite_global_assms': \"finite (global_assms' i)\"\nproof-\n have \"finite (fset vertices)\" by (rule finite_fset)\n moreover\n have \"global_assms' i \\ (\\ v. case nodeOf v of Assumption p \\ labelAtOut v (Reg p)) ` fset vertices\"\n by (force simp add: global_assms'.simps fmember.rep_eq image_iff )\n ultimately\n show ?thesis by (rule finite_surj)\nqed\n\ncontext includes fset.lifting\nbegin\n lift_definition global_assms :: \"'var itself \\ 'form fset\" is global_assms' by (rule finite_global_assms')\n lemmas global_assmsI = global_assms'.intros[Transfer.transferred]\n lemmas global_assms_simps = global_assms'.simps[Transfer.transferred]\nend\n\nfun extra_assms :: \"('vertex \\ ('form, 'var) in_port) \\ 'form fset\" where\n \"extra_assms (v, p) = (\\ p. labelAtOut v p) |`| hyps_for (nodeOf v) p\"\n\nfun hyps_along :: \"('vertex, 'form, 'var) edge' list \\ 'form fset\" where\n \"hyps_along pth = ffUnion (extra_assms |`| snd |`| fset_from_list pth) |\\| global_assms TYPE('var)\"\n\nlemma hyps_alongE[consumes 1, case_names Hyp Assumption]:\n assumes \"f |\\| hyps_along pth\"\n obtains v p h where \"(v,p) \\ snd ` set pth\" and \"f = labelAtOut v h \" and \"h |\\| hyps_for (nodeOf v) p\"\n | v pf where \"v |\\| vertices\" and \"nodeOf v = Assumption pf\" \"f = labelAtOut v (Reg pf)\"\n using assms\n apply (auto simp add: fmember.rep_eq ffUnion.rep_eq global_assms_simps[unfolded fmember.rep_eq])\n apply (metis image_iff snd_conv)\n done\n\ntext \\Here we build the natural deduction tree, by walking the graph.\\\n\nprimcorec tree :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex, 'form, 'var) edge' list \\ (('form entailment), ('rule \\ 'form) NatRule) dtree\" where\n \"root (tree v p pth) =\n ((hyps_along ((adjacentTo v p,(v,p))#pth) \\ labelAtIn v p),\n (case adjacentTo v p of (v', p') \\ toNatRule v' p'\n ))\"\n | \"cont (tree v p pth) =\n (case adjacentTo v p of (v', p') \\\n (if isReg v' p' then ((\\ p''. tree v' p'' ((adjacentTo v p,(v,p))#pth)) |`| inPorts (nodeOf v')) else {||}\n ))\"\n\n\nlemma fst_root_tree[simp]: \"fst (root (tree v p pth)) = (hyps_along ((adjacentTo v p,(v,p))#pth) \\ labelAtIn v p)\" by simp\n\nlemma out_port_cases[consumes 1, case_names Assumption Hyp Rule Helper]:\n assumes \"p |\\| outPorts n\"\n obtains\n a where \"n = Assumption a\" and \"p = Reg a\"\n | r h c where \"n = Rule r\" and \"p = Hyp h c\"\n | r f where \"n = Rule r\" and \"p = Reg f\"\n | \"n = Helper\" and \"p = Reg anyP\"\n using assms by (atomize_elim, cases p; cases n) auto\n\nlemma hyps_for_fimage: \"hyps_for (Rule r) x = (if x |\\| f_antecedent r then (\\ f. Hyp f x) |`| (a_hyps x) else {||})\"\n apply (rule fset_eqI)\n apply (rename_tac p')\n apply (case_tac p')\n apply (auto simp add: split: if_splits out_port.splits)\n done\n\ntext \\Now we prove that the thus produced tree is well-formed.\\\n\ntheorem wf_tree:\n assumes \"valid_in_port (v,p)\"\n assumes \"terminal_path v t pth\"\n shows \"wf (tree v p pth)\"\nusing assms\nproof (coinduction arbitrary: v p pth)\ncase (wf v p pth)\n let ?t = \"tree v p pth\"\n from saturated[OF wf(1)]\n obtain v' p'\n where e:\"((v',p'),(v,p)) \\ edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n\n let ?e = \"((v',p'),(v,p))\"\n let ?pth' = \"?e#pth\"\n let ?\\ = \"hyps_along ?pth'\"\n let ?l = \"labelAtIn v p\"\n\n from e valid_edges have \"v' |\\| vertices\" and \"p' |\\| outPorts (nodeOf v')\" by auto\n hence \"nodeOf v' \\ sset nodes\" using valid_nodes by (meson image_eqI notin_fset subsetD)\n\n from \\?e \\ edges\\\n have s: \"labelAtOut v' p' = labelAtIn v p\" by (rule solved)\n\n from \\p' |\\| outPorts (nodeOf v')\\\n show ?case\n proof (cases rule: out_port_cases)\n case (Hyp r h c)\n\n from Hyp \\p' |\\| outPorts (nodeOf v')\\\n have \"h |\\| a_hyps c\" and \"c |\\| f_antecedent r\" by auto\n hence \"hyps (nodeOf v') (Hyp h c) = Some c\" using Hyp by simp\n\n from well_scoped[OF \\ _ \\ edges\\[unfolded Hyp] this]\n have \"(v, p) = (v', c) \\ v \\ scope (v', c)\".\n hence \"(v', c) \\ insert (v, p) (snd ` set pth)\"\n proof\n assume \"(v, p) = (v', c)\"\n thus ?thesis by simp\n next\n assume \"v \\ scope (v', c)\"\n from this terminal_path_end_is_terminal[OF wf(2)] terminal_path_is_path[OF wf(2)]\n have \"(v', c) \\ snd ` set pth\" by (rule scope_find)\n thus ?thesis by simp\n qed\n moreover\n\n\n from \\hyps (nodeOf v') (Hyp h c) = Some c\\\n have \"Hyp h c |\\| hyps_for (nodeOf v') c\" by simp\n hence \"labelAtOut v' (Hyp h c) |\\| extra_assms (v',c)\" by auto\n ultimately\n\n have \"labelAtOut v' (Hyp h c) |\\| ?\\\"\n by (fastforce simp add: fmember.rep_eq ffUnion.rep_eq)\n\n hence \"labelAtIn v p |\\| ?\\\" by (simp add: s[symmetric] Hyp fmember.rep_eq)\n thus ?thesis\n using Hyp\n apply (auto intro: exI[where x = ?t] simp add: eff.simps simp del: hyps_along.simps)\n done\n next\n case (Assumption f)\n\n from \\v' |\\| vertices\\ \\nodeOf v' = Assumption f\\\n have \"labelAtOut v' (Reg f) |\\| global_assms TYPE('var)\"\n by (rule global_assmsI)\n hence \"labelAtOut v' (Reg f) |\\| ?\\\" by auto\n hence \"labelAtIn v p |\\| ?\\\" by (simp add: s[symmetric] Assumption fmember.rep_eq)\n thus ?thesis using Assumption\n by (auto intro: exI[where x = ?t] simp add: eff.simps)\n next\n case (Rule r f)\n with \\nodeOf v' \\ sset nodes\\\n have \"r \\ sset rules\"\n by (auto simp add: nodes_def stream.set_map)\n\n from Rule\n have \"hyps (nodeOf v') p' = None\" by simp\n with e \\terminal_path v t pth\\\n have \"terminal_path v' t ?pth'\"..\n\n from Rule \\p' |\\| outPorts (nodeOf v')\\\n have \"f |\\| f_consequent r\" by simp\n hence \"f \\ set (consequent r)\" by (simp add: f_consequent_def)\n with \\r \\ sset rules\\\n have \"NatRule (r, f) \\ sset (smap NatRule n_rules)\"\n by (auto simp add: stream.set_map n_rules_def no_empty_conclusions)\n moreover\n\n {\n from \\f |\\| f_consequent r\\\n have \"f \\ set (consequent r)\" by (simp add: f_consequent_def)\n hence \"natEff_Inst (r, f) f (f_antecedent r)\"\n by (rule natEff_Inst.intros)\n hence \"eff (NatRule (r, f)) (?\\ \\ subst (inst v') (freshen (vidx v') f))\n ((\\ant. ((\\p. subst (inst v') (freshen (vidx v') p)) |`| a_hyps ant |\\| ?\\ \\ subst (inst v') (freshen (vidx v') (a_conc ant)))) |`| f_antecedent r)\"\n (is \"eff _ _ ?ants\")\n proof (rule eff.intros)\n fix ant f\n assume \"ant |\\| f_antecedent r\"\n from \\v' |\\| vertices\\ \\ant |\\| f_antecedent r\\\n have \"valid_in_port (v',ant)\" by (simp add: Rule)\n\n assume \"f |\\| ?\\\"\n thus \"freshenLC (vidx v') ` a_fresh ant \\ lconsts f = {}\"\n proof(induct rule: hyps_alongE)\n case (Hyp v'' p'' h'')\n\n from Hyp(1) snd_set_path_verties[OF terminal_path_is_path[OF \\terminal_path v' t ?pth'\\]]\n have \"v'' |\\| vertices\" by (force simp add: fmember.rep_eq)\n\n from \\terminal_path v' t ?pth'\\ Hyp(1)\n have \"v'' \\ scope (v', ant)\" by (rule hyps_free_path_not_in_scope)\n with \\valid_in_port (v',ant)\\ \\v'' |\\| vertices\\\n have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\ subst_lconsts (inst v'') = {}\"\n by (rule out_of_scope)\n moreover\n from hyps_free_vertices_distinct'[OF \\terminal_path v' t ?pth'\\] Hyp.hyps(1)\n have \"v'' \\ v'\" by (metis distinct.simps(2) fst_conv image_eqI list.set_map)\n hence \"vidx v'' \\ vidx v'\" using \\v' |\\| vertices\\ \\v'' |\\| vertices\\ by (meson vidx_inj inj_onD notin_fset)\n hence \"freshenLC (vidx v') ` a_fresh ant \\ freshenLC (vidx v'') ` lconsts (labelsOut (nodeOf v'') h'') = {}\"by auto\n moreover\n have \"lconsts f \\ lconsts (freshen (vidx v'') (labelsOut (nodeOf v'') h'')) \\ subst_lconsts (inst v'') \" using \\f = _\\\n by (simp add: labelAtOut_def fv_subst)\n ultimately\n show ?thesis\n by (fastforce simp add: lconsts_freshen)\n next\n case (Assumption v pf)\n hence \"f = subst (inst v) (freshen (vidx v) pf)\" by (simp add: labelAtOut_def)\n moreover\n from Assumption have \"Assumption pf \\ sset nodes\" using valid_nodes by (auto simp add: fmember.rep_eq)\n hence \"pf \\ set assumptions\" unfolding nodes_def by (auto simp add: stream.set_map)\n hence \"closed pf\" by (rule assumptions_closed)\n ultimately\n have \"lconsts f = {}\" by (simp add: closed_no_lconsts lconsts_freshen subst_closed freshen_closed)\n thus ?thesis by simp\n qed\n next\n fix ant\n assume \"ant |\\| f_antecedent r\"\n from \\v' |\\| vertices\\ \\ant |\\| f_antecedent r\\\n have \"valid_in_port (v',ant)\" by (simp add: Rule)\n moreover\n note \\v' |\\| vertices\\\n moreover\n hence \"v' \\ scope (v', ant)\" by (rule scopes_not_refl)\n ultimately\n have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\ subst_lconsts (inst v') = {}\"\n by (rule out_of_scope)\n thus \"freshenLC (vidx v') ` a_fresh ant \\ subst_lconsts (inst v') = {}\" by simp\n qed\n also\n have \"subst (inst v') (freshen (vidx v') f) = labelAtOut v' p'\" using Rule by (simp add: labelAtOut_def)\n also\n note \\labelAtOut v' p' = labelAtIn v p\\\n also\n have \"?ants = ((\\x. (extra_assms (v',x) |\\| hyps_along ?pth' \\ labelAtIn v' x)) |`| f_antecedent r)\"\n by (rule fimage_cong[OF refl])\n (auto simp add: labelAtIn_def labelAtOut_def Rule hyps_for_fimage fmember.rep_eq ffUnion.rep_eq)\n finally\n have \"eff (NatRule (r, f))\n (?\\, labelAtIn v p)\n ((\\x. extra_assms (v',x) |\\| ?\\ \\ labelAtIn v' x) |`| f_antecedent r)\".\n }\n moreover\n\n { fix x\n assume \"x |\\| cont ?t\"\n then obtain a where \"x = tree v' a ?pth'\" and \"a |\\| f_antecedent r\"\n by (auto simp add: Rule)\n note this(1)\n moreover\n\n from \\v' |\\| vertices\\ \\a |\\| f_antecedent r\\\n have \"valid_in_port (v',a)\" by (simp add: Rule)\n moreover\n\n note \\terminal_path v' t ?pth'\\\n ultimately\n\n have \"\\v p pth. x = tree v p pth \\ valid_in_port (v,p) \\ terminal_path v t pth\"\n by blast\n }\n ultimately\n\n show ?thesis using Rule\n by (auto intro!: exI[where x = ?t] simp add: comp_def funion_assoc)\n next\n case Helper\n from Helper\n have \"hyps (nodeOf v') p' = None\" by simp\n with e \\terminal_path v t pth\\\n have \"terminal_path v' t ?pth'\"..\n\n have \"labelAtIn v' (plain_ant anyP) = labelAtIn v p\"\n unfolding s[symmetric]\n using Helper by (simp add: labelAtIn_def labelAtOut_def)\n moreover\n { fix x\n assume \"x |\\| cont ?t\"\n\n hence \"x = tree v' (plain_ant anyP) ?pth'\"\n by (auto simp add: Helper)\n note this(1)\n moreover\n\n from \\v' |\\| vertices\\\n have \"valid_in_port (v',plain_ant anyP)\" by (simp add: Helper)\n moreover\n\n note \\terminal_path v' t ?pth'\\\n ultimately\n\n have \"\\v p pth. x = tree v p pth \\ valid_in_port (v,p) \\ terminal_path v t pth\"\n by blast\n }\n ultimately\n\n show ?thesis using Helper\n by (auto intro!: exI[where x = ?t] simp add: comp_def funion_assoc )\n qed\nqed\n\nlemma global_in_ass: \"global_assms TYPE('var) |\\| ass_forms\"\nproof\n fix x\n assume \"x |\\| global_assms TYPE('var)\"\n then obtain v pf where \"v |\\| vertices\" and \"nodeOf v = Assumption pf\" and \"x = labelAtOut v (Reg pf)\"\n by (auto simp add: global_assms_simps)\n from this (1,2) valid_nodes\n have \"Assumption pf \\ sset nodes\" by (auto simp add: fmember.rep_eq)\n hence \"pf \\ set assumptions\" by (auto simp add: nodes_def stream.set_map)\n hence \"closed pf\" by (rule assumptions_closed)\n with \\x = labelAtOut v (Reg pf)\\\n have \"x = pf\" by (auto simp add: labelAtOut_def lconsts_freshen closed_no_lconsts freshen_closed subst_closed)\n thus \"x |\\| ass_forms\" using \\pf \\ set assumptions\\ by (auto simp add: ass_forms_def)\nqed\n\nprimcorec edge_tree :: \"'vertex \\ ('form, 'var) in_port \\ ('vertex, 'form, 'var) edge' tree\" where\n \"root (edge_tree v p) = (adjacentTo v p, (v,p))\"\n | \"cont (edge_tree v p) =\n (case adjacentTo v p of (v', p') \\\n (if isReg v' p' then ((\\ p. edge_tree v' p) |`| inPorts (nodeOf v')) else {||}\n ))\"\n\nlemma tfinite_map_tree: \"tfinite (map_tree f t) \\ tfinite t\"\nproof\n assume \"tfinite (map_tree f t)\"\n thus \"tfinite t\"\n by (induction \"map_tree f t\" arbitrary: t rule: tfinite.induct)\n (fastforce intro: tfinite.intros simp add: tree.map_sel)\nnext\n assume \"tfinite t\"\n thus \"tfinite (map_tree f t)\"\n by (induction t rule: tfinite.induct)\n (fastforce intro: tfinite.intros simp add: tree.map_sel)\nqed\n\n\nlemma finite_tree_edge_tree:\n \"tfinite (tree v p pth) \\ tfinite (edge_tree v p)\"\nproof-\n have \"map_tree (\\ _. ()) (tree v p pth) = map_tree (\\ _. ()) (edge_tree v p)\"\n by(coinduction arbitrary: v p pth)\n (fastforce simp add: tree.map_sel rel_fset_def rel_set_def split: prod.split out_port.split graph_node.split option.split)\n thus ?thesis by (metis tfinite_map_tree)\nqed\n\ncoinductive forbidden_path :: \"'vertex \\ ('vertex, 'form, 'var) edge' stream \\ bool\" where\n forbidden_path: \"((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2)) \\ edges \\ hyps (nodeOf v\\<^sub>1) p\\<^sub>1 = None \\ forbidden_path v\\<^sub>1 pth \\ forbidden_path v\\<^sub>2 (((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2))##pth)\"\n\nlemma path_is_forbidden:\n assumes \"valid_in_port (v,p)\"\n assumes \"ipath (edge_tree v p) es\"\n shows \"forbidden_path v es\"\nusing assms\nproof(coinduction arbitrary: v p es)\n case forbidden_path\n\n let ?es' = \"stl es\"\n\n from forbidden_path(2)\n obtain t' where \"root (edge_tree v p) = shd es\" and \"t' |\\| cont (edge_tree v p)\" and \"ipath t' ?es'\"\n by rule blast\n\n from \\root (edge_tree v p) = shd es\\\n have [simp]: \"shd es = (adjacentTo v p, (v,p))\" by simp\n\n from saturated[OF \\valid_in_port (v,p)\\]\n obtain v' p'\n where e:\"((v',p'),(v,p)) \\ edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n let ?e = \"((v',p'),(v,p))\"\n\n from e have \"p' |\\| outPorts (nodeOf v')\" using valid_edges by auto\n thus ?case\n proof(cases rule: out_port_cases)\n case Hyp\n with \\t' |\\| cont (edge_tree v p)\\\n have False by auto\n thus ?thesis..\n next\n case Assumption\n with \\t' |\\| cont (edge_tree v p)\\\n have False by auto\n thus ?thesis..\n next\n case (Rule r f)\n from \\t' |\\| cont (edge_tree v p)\\ Rule\n obtain a where [simp]: \"t' = edge_tree v' a\" and \"a |\\| f_antecedent r\" by auto\n\n have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n moreover\n\n have \"?e \\ edges\" using e by simp\n moreover\n\n from \\p' = Reg f\\ \\nodeOf v' = Rule r\\\n have \"hyps (nodeOf v') p' = None\" by simp\n moreover\n\n from e valid_edges have \"v' |\\| vertices\" by auto\n with \\nodeOf v' = Rule r\\ \\a |\\| f_antecedent r\\\n have \"valid_in_port (v', a)\" by simp\n moreover\n\n have \"ipath (edge_tree v' a) ?es'\" using \\ipath t' _\\ by simp\n ultimately\n\n show ?thesis by metis\n next\n case Helper\n from \\t' |\\| cont (edge_tree v p)\\ Helper\n have [simp]: \"t' = edge_tree v' (plain_ant anyP)\" by simp\n\n have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n moreover\n\n have \"?e \\ edges\" using e by simp\n moreover\n\n from \\p' = Reg anyP\\ \\nodeOf v' = Helper\\\n have \"hyps (nodeOf v') p' = None\" by simp\n moreover\n\n from e valid_edges have \"v' |\\| vertices\" by auto\n with \\nodeOf v' = Helper\\\n have \"valid_in_port (v', plain_ant anyP)\" by simp\n moreover\n\n have \"ipath (edge_tree v' (plain_ant anyP)) ?es'\" using \\ipath t' _\\ by simp\n ultimately\n\n show ?thesis by metis\n qed\nqed\n\nlemma forbidden_path_prefix_is_path:\n assumes \"forbidden_path v es\"\n obtains v' where \"path v' v (rev (stake n es))\"\n using assms\n apply (atomize_elim)\n apply (induction n arbitrary: v es)\n apply simp\n apply (simp add: path_snoc)\n apply (subst (asm) (2) forbidden_path.simps)\n apply auto\n done\n\nlemma forbidden_path_prefix_is_hyp_free:\n assumes \"forbidden_path v es\"\n shows \"hyps_free (rev (stake n es))\"\n using assms\n apply (induction n arbitrary: v es)\n apply (simp add: hyps_free_def)\n apply (subst (asm) (2) forbidden_path.simps)\n apply (force simp add: hyps_free_def)\n done\n\n\ntext \\And now we prove that the tree is finite, which requires the above notion of a\n@{term forbidden_path}, i.e.\\@ an infinite path.\\\n\ntheorem finite_tree:\n assumes \"valid_in_port (v,p)\"\n assumes \"terminal_vertex v\"\n shows \"tfinite (tree v p pth)\"\nproof(rule ccontr)\n let ?n = \"Suc (fcard vertices)\"\n assume \"\\ tfinite (tree v p pth)\"\n hence \"\\ tfinite (edge_tree v p)\" unfolding finite_tree_edge_tree.\n then obtain es :: \"('vertex, 'form, 'var) edge' stream\"\n where \"ipath (edge_tree v p) es\" using Konig by blast\n with \\valid_in_port (v,p)\\\n have \"forbidden_path v es\" by (rule path_is_forbidden)\n from forbidden_path_prefix_is_path[OF this] forbidden_path_prefix_is_hyp_free[OF this]\n obtain v' where \"path v' v (rev (stake ?n es))\" and \"hyps_free (rev (stake ?n es))\"\n by blast\n from this \\terminal_vertex v\\\n have \"terminal_path v' v (rev (stake ?n es))\" by (rule terminal_pathI)\n hence \"length (rev (stake ?n es)) \\ fcard vertices\"\n by (rule hyps_free_limited)\n thus False by simp\nqed\n\ntext \\The main result of this theory.\\\n\ntheorem solved\nunfolding solved_def\nproof(intro ballI allI conjI impI)\n fix c\n assume \"c |\\| conc_forms\"\n hence \"c \\ set conclusions\" by (auto simp add: conc_forms_def)\n from this(1) conclusions_present\n obtain v where \"v |\\| vertices\" and \"nodeOf v = Conclusion c\"\n by (auto, metis (no_types, lifting) image_iff image_subset_iff notin_fset)\n\n have \"valid_in_port (v, (plain_ant c))\"\n using \\v |\\| vertices\\ \\nodeOf _ = _ \\ by simp\n\n have \"terminal_vertex v\" using \\v |\\| vertices\\ \\nodeOf v = Conclusion c\\ by auto\n\n let ?t = \"tree v (plain_ant c) []\"\n\n have \"fst (root ?t) = (global_assms TYPE('var), c)\"\n using \\c \\ set conclusions\\ \\nodeOf _ = _\\\n by (auto simp add: labelAtIn_def conclusions_closed closed_no_lconsts freshen_def rename_closed subst_closed)\n moreover\n\n have \"global_assms TYPE('var) |\\| ass_forms\" by (rule global_in_ass)\n moreover\n\n from \\terminal_vertex v\\\n have \"terminal_path v v []\" by (rule terminal_path_empty)\n with \\valid_in_port (v, (plain_ant c))\\\n have \"wf ?t\" by (rule wf_tree)\n moreover\n\n from \\valid_in_port (v, plain_ant c)\\ \\terminal_vertex v\\\n have \"tfinite ?t\" by (rule finite_tree)\n ultimately\n\n show \"\\\\ t. fst (root t) = (\\ \\ c) \\ \\ |\\| ass_forms \\ wf t \\ tfinite t\" by blast\nqed\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Incredible_Proof_Machine/Incredible_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2624082661398747}} {"text": "(* Title: JinjaThreads/J/SmallTypeSafe.thy\n Author: Tobias Nipkow, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Type Safety Proof} *}\n\ntheory TypeSafe\nimports\n Progress\n DefAssPreservation\nbegin\n\nsubsection{*Basic preservation lemmas*}\n\ntext{* First two easy preservation lemmas. *}\n\ntheorem (in J_conf_read)\n shows red_preserves_hconf:\n \"\\ extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\; P,E,hp s \\ e : T; hconf (hp s) \\ \\ hconf (hp s')\"\n and reds_preserves_hconf:\n \"\\ extTA,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\; P,E,hp s \\ es [:] Ts; hconf (hp s) \\ \\ hconf (hp s')\"\nproof (induct arbitrary: T E and Ts E rule: red_reds.inducts)\n case RedNew thus ?case\n by(auto intro: hconf_heap_ops_mono)\nnext\n case RedNewFail thus ?case\n by(auto intro: hconf_heap_ops_mono)\nnext\n case RedNewArray thus ?case\n by(auto intro: hconf_heap_ops_mono)\nnext\n case RedNewArrayFail thus ?case\n by(auto intro: hconf_heap_ops_mono)\nnext\n case (RedAAss h a U n i v U' h' l)\n from `sint i < int n` `0 <=s i`\n have \"nat (sint i) < n\" by(metis nat_less_iff sint_0 word_sle_def)\n thus ?case using RedAAss\n by(fastforce elim: hconf_heap_write_mono intro: addr_loc_type.intros simp add: conf_def)\nnext\n case RedFAss thus ?case\n by(fastforce elim: hconf_heap_write_mono intro: addr_loc_type.intros simp add: conf_def)\nnext\n case (RedCallExternal s a U M Ts T' D vs ta va h' ta' e' s')\n hence \"P,hp s \\ a\\M(vs) : T\"\n by(fastforce simp add: external_WT'_iff dest: sees_method_fun)\n with RedCallExternal show ?case by(auto dest: external_call_hconf)\nqed auto\n\ntheorem (in J_heap) red_preserves_lconf:\n \"\\ extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\; P,E,hp s \\ e:T; P,hp s \\ lcl s (:\\) E \\ \\ P,hp s' \\ lcl s' (:\\) E\"\n and reds_preserves_lconf:\n \"\\ extTA,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\; P,E,hp s \\ es[:]Ts; P,hp s \\ lcl s (:\\) E \\ \\ P,hp s' \\ lcl s' (:\\) E\"\nproof(induct arbitrary: T E and Ts E rule:red_reds.inducts)\n case RedNew thus ?case\n by(fastforce intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case RedNewFail thus ?case\n by(auto intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case RedNewArray thus ?case\n by(fastforce intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case RedNewArrayFail thus ?case\n by(fastforce intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case RedLAss thus ?case \n by(fastforce elim: lconf_upd simp add: conf_def simp del: fun_upd_apply )\nnext\n case RedAAss thus ?case\n by(fastforce intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case RedFAss thus ?case\n by(fastforce intro:lconf_hext hext_heap_ops simp del: fun_upd_apply)\nnext\n case (BlockRed e h x V vo ta e' h' x' T T' E)\n note red = `extTA,P,t \\ \\e,(h, x(V := vo))\\ -ta\\ \\e',(h', x')\\`\n note IH = `\\T E. \\P,E,hp (h, x(V := vo)) \\ e : T;\n P,hp (h, x(V := vo)) \\ lcl (h, x(V := vo)) (:\\) E\\\n \\ P,hp (h', x') \\ lcl (h', x') (:\\) E`\n note wt = `P,E,hp (h, x) \\ {V:T=vo; e} : T'`\n note lconf = `P,hp (h, x) \\ lcl (h, x) (:\\) E`\n from lconf_hext[OF lconf[simplified] red_hext_incr[OF red, simplified]]\n have \"P,h' \\ x (:\\) E\" .\n moreover from wt have \"P,E(V\\T),h \\ e : T'\" by(cases vo, auto)\n moreover from lconf wt have \"P,h \\ x(V := vo) (:\\) E(V \\ T)\"\n by(cases vo)(simp add: lconf_def,auto intro: lconf_upd2 simp add: conf_def)\n ultimately have \"P,h' \\ x' (:\\) E(V\\T)\" \n by(auto intro: IH[simplified])\n with `P,h' \\ x (:\\) E` show ?case\n by(auto simp add: lconf_def split: split_if_asm)\nnext\n case (RedCallExternal s a U M Ts T' D vs ta va h' ta' e' s')\n from `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\` have \"hp s \\ h'\" by(rule red_external_hext)\n with `s' = (h', lcl s)` `P,hp s \\ lcl s (:\\) E` show ?case by(auto intro: lconf_hext)\nqed auto\n\ntext{* Combining conformance of heap and local variables: *}\n\ndefinition (in J_heap_conf_base) sconf :: \"env \\ ('addr, 'heap) Jstate \\ bool\" (\"_ \\ _ \\\" [51,51]50)\n where \"E \\ s \\ \\ let (h,l) = s in hconf h \\ P,h \\ l (:\\) E \\ preallocated h\"\n\ncontext J_conf_read begin\n\nlemma red_preserves_sconf:\n \"\\ extTA,P,t \\ \\e,s\\ -tas\\ \\e',s'\\; P,E,hp s \\ e : T; E \\ s \\ \\ \\ E \\ s' \\\"\napply(auto dest: red_preserves_hconf red_preserves_lconf simp add:sconf_def)\napply(fastforce dest: red_hext_incr intro: preallocated_hext)\ndone\n\nlemma reds_preserves_sconf:\n \"\\ extTA,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\; P,E,hp s \\ es [:] Ts; E \\ s \\ \\ \\ E \\ s' \\\"\napply(auto dest: reds_preserves_hconf reds_preserves_lconf simp add: sconf_def)\napply(fastforce dest: reds_hext_incr intro: preallocated_hext)\ndone\n\nend\n\nlemma (in J_heap_base) wt_external_call:\n \"\\ conf_extRet P h va T; P,E,h \\ e : T \\ \\ \\T'. P,E,h \\ extRet2J e va : T' \\ P \\ T' \\ T\"\nby(cases va)(auto simp add: conf_def)\n\nsubsection \"Subject reduction\"\n\ntheorem (in J_conf_read) assumes wf: \"wf_J_prog P\"\n shows subject_reduction:\n \"\\ extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\; E \\ s \\; P,E,hp s \\ e:T; P,hp s \\ t \\t \\\n \\ \\T'. P,E,hp s' \\ e':T' \\ P \\ T' \\ T\"\n and subjects_reduction:\n \"\\ extTA,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\; E \\ s \\; P,E,hp s \\ es[:]Ts; P,hp s \\ t \\t \\\n \\ \\Ts'. P,E,hp s' \\ es'[:]Ts' \\ P \\ Ts' [\\] Ts\"\nproof (induct arbitrary: T E and Ts E rule:red_reds.inducts)\n case RedNew\n thus ?case by(auto dest: allocate_SomeD)\nnext\n case RedNewFail thus ?case unfolding sconf_def\n by(fastforce intro:typeof_OutOfMemory preallocated_heap_ops simp add: xcpt_subcls_Throwable[OF _ wf]) \nnext\n case NewArrayRed\n thus ?case by fastforce\nnext\n case RedNewArray\n thus ?case by(auto dest: allocate_SomeD)\nnext\n case RedNewArrayNegative thus ?case unfolding sconf_def\n by(fastforce intro: preallocated_heap_ops simp add: xcpt_subcls_Throwable[OF _ wf]) \nnext\n case RedNewArrayFail thus ?case unfolding sconf_def\n by(fastforce intro:typeof_OutOfMemory preallocated_heap_ops simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (CastRed e s ta e' s' C T E)\n have esse: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\" \n and IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\"\n and hconf: \"E \\ s \\\"\n and wtc: \"P,E,hp s \\ Cast C e : T\" by fact+\n thus ?case\n proof(clarsimp)\n fix T'\n assume wte: \"P,E,hp s \\ e : T'\" \"is_type P T\"\n from wte and hconf and IH and `P,hp s \\ t \\t` have \"\\U. P,E,hp s' \\ e' : U \\ P \\ U \\ T'\" by simp\n then obtain U where wtee: \"P,E,hp s' \\ e' : U\" and UsTT: \"P \\ U \\ T'\" by blast\n from wtee `is_type P T` have \"P,E,hp s' \\ Cast T e' : T\" by(rule WTrtCast)\n thus \"\\T'. P,E,hp s' \\ Cast T e' : T' \\ P \\ T' \\ T\" by blast\n qed\nnext\n case RedCast thus ?case\n by(clarsimp simp add: is_refT_def)\nnext\n case RedCastFail thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (InstanceOfRed e s ta e' s' U T E)\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\"\n and hconf: \"E \\ s \\\"\n and wtc: \"P,E,hp s \\ e instanceof U : T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wtc obtain T' where \"P,E,hp s \\ e : T'\" by auto\n from IH[OF hconf this tconf] obtain T'' where \"P,E,hp s' \\ e' : T''\" by auto\n with wtc show ?case by auto\nnext\n case RedInstanceOf thus ?case\n by(clarsimp)\nnext\n case (BinOpRed1 e\\<^sub>1 s ta e\\<^sub>1' s' bop e\\<^sub>2 T E)\n have red: \"extTA,P,t \\ \\e\\<^sub>1, s\\ -ta\\ \\e\\<^sub>1', s'\\\"\n and IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e\\<^sub>1:T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e\\<^sub>1' : U \\ P \\ U \\ T\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt obtain T1 T2 where wt1: \"P,E,hp s \\ e\\<^sub>1 : T1\"\n and wt2: \"P,E,hp s \\ e\\<^sub>2 : T2\" and wtbop: \"P \\ T1\\bop\\T2 : T\" by auto\n from IH[OF conf wt1 tconf] obtain T1' where wt1': \"P,E,hp s' \\ e\\<^sub>1' : T1'\"\n and sub: \"P \\ T1' \\ T1\" by blast\n from WTrt_binop_widen_mono[OF wtbop sub widen_refl]\n obtain T' where wtbop': \"P \\ T1'\\bop\\T2 : T'\" and sub': \"P \\ T' \\ T\" by blast\n from wt1' WTrt_hext_mono[OF wt2 red_hext_incr[OF red]] wtbop'\n have \"P,E,hp s' \\ e\\<^sub>1' \\bop\\ e\\<^sub>2 : T'\" by(rule WTrtBinOp)\n with sub' show ?case by blast\nnext\n case (BinOpRed2 e\\<^sub>2 s ta e\\<^sub>2' s' v\\<^sub>1 bop T E)\n have red: \"extTA,P,t \\ \\e\\<^sub>2,s\\ -ta\\ \\e\\<^sub>2',s'\\\" by fact\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e\\<^sub>2:T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e\\<^sub>2' : U \\ P \\ U \\ T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n have conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ (Val v\\<^sub>1) \\bop\\ e\\<^sub>2 : T\" by fact+\n from wt obtain T1 T2 where wt1: \"P,E,hp s \\ Val v\\<^sub>1 : T1\"\n and wt2: \"P,E,hp s \\ e\\<^sub>2 : T2\" and wtbop: \"P \\ T1\\bop\\T2 : T\" by auto\n from IH[OF conf wt2 tconf] obtain T2' where wt2': \"P,E,hp s' \\ e\\<^sub>2' : T2'\"\n and sub: \"P \\ T2' \\ T2\" by blast\n from WTrt_binop_widen_mono[OF wtbop widen_refl sub]\n obtain T' where wtbop': \"P \\ T1\\bop\\T2' : T'\" and sub': \"P \\ T' \\ T\" by blast\n from WTrt_hext_mono[OF wt1 red_hext_incr[OF red]] wt2' wtbop'\n have \"P,E,hp s' \\ Val v\\<^sub>1 \\bop\\ e\\<^sub>2' : T'\" by(rule WTrtBinOp)\n with sub' show ?case by blast\nnext\n case (RedBinOp bop v1 v2 v s)\n from `E \\ s \\` have preh: \"preallocated (hp s)\" by(cases s)(simp add: sconf_def)\n from `P,E,hp s \\ Val v1 \\bop\\ Val v2 : T` obtain T1 T2\n where \"typeof\\<^bsub>hp s\\<^esub> v1 = \\T1\\\" \"typeof\\<^bsub>hp s\\<^esub> v2 = \\T2\\\" \"P \\ T1\\bop\\T2 : T\" by auto\n with wf preh have \"P,hp s \\ v :\\ T\" using `binop bop v1 v2 = \\Inl v\\`\n by(rule binop_type)\n thus ?case by(auto simp add: conf_def)\nnext\n case (RedBinOpFail bop v1 v2 a s)\n from `E \\ s \\` have preh: \"preallocated (hp s)\" by(cases s)(simp add: sconf_def)\n from `P,E,hp s \\ Val v1 \\bop\\ Val v2 : T` obtain T1 T2\n where \"typeof\\<^bsub>hp s\\<^esub> v1 = \\T1\\\" \"typeof\\<^bsub>hp s\\<^esub> v2 = \\T2\\\" \"P \\ T1\\bop\\T2 : T\" by auto\n with wf preh have \"P,hp s \\ Addr a :\\ Class Throwable\" using `binop bop v1 v2 = \\Inr a\\`\n by(rule binop_type)\n thus ?case by(auto simp add: conf_def)\nnext\n case RedVar thus ?case by (fastforce simp:sconf_def lconf_def conf_def)\nnext\n case LAssRed thus ?case by(blast intro:widen_trans)\nnext\n case RedLAss thus ?case by fastforce\nnext\n case (AAccRed1 a s ta a' s' i T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ a : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ a' : T' \\ P \\ T' \\ T\"\n and assa: \"extTA,P,t \\ \\a,s\\ -ta\\ \\a',s'\\\"\n and wt: \"P,E,hp s \\ a\\i\\ : T\"\n and hconf: \"E \\ s \\\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have wti: \"P,E,hp s \\ i : Integer\" by auto\n from wti red_hext_incr[OF assa] have wti': \"P,E,hp s' \\ i : Integer\" by - (rule WTrt_hext_mono)\n { assume wta: \"P,E,hp s \\ a : T\\\\\"\n from IH[OF hconf wta tconf]\n obtain U where wta': \"P,E,hp s' \\ a' : U\" and UsubT: \"P \\ U \\ T\\\\\" by fastforce\n with wta' wti' have ?case by(cases U, auto simp add: widen_Array) }\n moreover\n { assume wta: \"P,E,hp s \\ a : NT\"\n from IH[OF hconf wta tconf] have \"P,E,hp s' \\ a' : NT\" by fastforce\n from this wti' have ?case\n by(fastforce intro:WTrtAAccNT) }\n ultimately show ?case using wt by auto\nnext\n case (AAccRed2 i s ta i' s' a T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ i : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ i' : T' \\ P \\ T' \\ T\"\n and issi: \"extTA,P,t \\ \\i,s\\ -ta\\ \\i',s'\\\"\n and wt: \"P,E,hp s \\ Val a\\i\\ : T\"\n and sconf: \"E \\ s \\\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have wti: \"P,E,hp s \\ i : Integer\" by auto\n from wti IH sconf tconf have wti': \"P,E,hp s' \\ i' : Integer\" by blast\n from wt show ?case\n proof (rule WTrt_elim_cases)\n assume wta: \"P,E,hp s \\ Val a : T\\\\\"\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : T\\\\\" by (rule WTrt_hext_mono)\n from wta' wti' show ?case by(fastforce)\n next\n assume wta: \"P,E,hp s \\ Val a : NT\"\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : NT\" by (rule WTrt_hext_mono)\n from wta' wti' show ?case\n by(fastforce elim:WTrtAAccNT)\n qed\nnext\n case RedAAccNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case RedAAccBounds thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (RedAAcc h a T n i v l T' E)\n from `E \\ (h, l) \\` have \"hconf h\" by(clarsimp simp add: sconf_def)\n from `0 <=s i` `sint i < int n`\n have \"nat (sint i) < n\" by(metis nat_less_iff sint_0 word_sle_def)\n with `typeof_addr h a = \\Array_type T n\\` have \"P,h \\ a@ACell (nat (sint i)) : T\"\n by(auto intro: addr_loc_type.intros)\n from heap_read_conf[OF `heap_read h a (ACell (nat (sint i))) v` this] `hconf h`\n have \"P,h \\ v :\\ T\" by simp\n thus ?case using RedAAcc by(auto simp add: conf_def)\nnext\n case (AAssRed1 a s ta a' s' i e T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ a : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ a' : T' \\ P \\ T' \\ T\"\n and assa: \"extTA,P,t \\ \\a,s\\ -ta\\ \\a',s'\\\"\n and wt: \"P,E,hp s \\ a\\i\\ := e : T\"\n and sconf: \"E \\ s \\\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have void: \"T = Void\" by blast\n from wt have wti: \"P,E,hp s \\ i : Integer\" by auto\n from wti red_hext_incr[OF assa] have wti': \"P,E,hp s' \\ i : Integer\" by - (rule WTrt_hext_mono)\n { assume wta: \"P,E,hp s \\ a : NT\"\n from IH[OF sconf wta tconf] have wta': \"P,E,hp s' \\ a' : NT\" by fastforce\n from wt wta obtain V where wte: \"P,E,hp s \\ e : V\" by(auto)\n from wte red_hext_incr[OF assa] have wte': \"P,E,hp s' \\ e : V\" by - (rule WTrt_hext_mono)\n from wta' wti' wte' void have ?case\n by(fastforce elim: WTrtAAssNT) }\n moreover\n { fix U\n assume wta: \"P,E,hp s \\ a : U\\\\\"\n from IH[OF sconf wta tconf]\n obtain U' where wta': \"P,E,hp s' \\ a' : U'\" and UsubT: \"P \\ U' \\ U\\\\\" by fastforce\n with wta' have ?case\n proof(cases U')\n case NT\n assume UNT: \"U' = NT\"\n from UNT wt wta obtain V where wte: \"P,E,hp s \\ e : V\" by(auto)\n from wte red_hext_incr[OF assa] have wte': \"P,E,hp s' \\ e : V\" by - (rule WTrt_hext_mono)\n from wta' UNT wti' wte' void show ?thesis\n by(fastforce elim: WTrtAAssNT)\n next\n case (Array A)\n have UA: \"U' = A\\\\\" by fact\n with UA UsubT wt wta obtain V where wte: \"P,E,hp s \\ e : V\" by auto\n from wte red_hext_incr[OF assa] have wte': \"P,E,hp s' \\ e : V\" by - (rule WTrt_hext_mono)\n with wta' wte' UA wti' void show ?thesis by (fast elim:WTrtAAss)\n qed(simp_all add: widen_Array) }\n ultimately show ?case using wt by blast\nnext\n case (AAssRed2 i s ta i' s' a e T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ i : T; P,hp s \\ t \\t \\ \\ \\T'. P,E,hp s' \\ i' : T' \\ P \\ T' \\ T\" \n and issi: \"extTA,P,t \\ \\i,s\\ -ta\\ \\i',s'\\\" \n and wt: \"P,E,hp s \\ Val a\\i\\ := e : T\" \n and sconf: \"E \\ s \\\" and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have void: \"T = Void\" by blast\n from wt have wti: \"P,E,hp s \\ i : Integer\" by auto\n from IH[OF sconf wti tconf] have wti': \"P,E,hp s' \\ i' : Integer\" by fastforce\n from wt show ?case\n proof(rule WTrt_elim_cases)\n fix U T'\n assume wta: \"P,E,hp s \\ Val a : U\\\\\"\n and wte: \"P,E,hp s \\ e : T'\"\n from wte red_hext_incr[OF issi] have wte': \"P,E,hp s' \\ e : T'\" by - (rule WTrt_hext_mono)\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : U\\\\\" by - (rule WTrt_hext_mono)\n from wta' wti' wte' void show ?case by (fastforce elim:WTrtAAss)\n next\n fix T'\n assume wta: \"P,E,hp s \\ Val a : NT\"\n and wte: \"P,E,hp s \\ e : T'\"\n from wte red_hext_incr[OF issi] have wte': \"P,E,hp s' \\ e : T'\" by - (rule WTrt_hext_mono)\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : NT\" by - (rule WTrt_hext_mono)\n from wta' wti' wte' void show ?case by (fastforce elim:WTrtAAss)\n qed\nnext\n case (AAssRed3 e s ta e' s' a i T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\" \n and issi: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\" \n and wt: \"P,E,hp s \\ Val a\\Val i\\ := e : T\" \n and sconf: \"E \\ s \\\" and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have void: \"T = Void\" by blast\n from wt have wti: \"P,E,hp s \\ Val i : Integer\" by auto\n from wti red_hext_incr[OF issi] have wti': \"P,E,hp s' \\ Val i : Integer\" by - (rule WTrt_hext_mono)\n from wt show ?case\n proof(rule WTrt_elim_cases)\n fix U T'\n assume wta: \"P,E,hp s \\ Val a : U\\\\\"\n and wte: \"P,E,hp s \\ e : T'\"\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : U\\\\\" by - (rule WTrt_hext_mono)\n from IH[OF sconf wte tconf]\n obtain V where wte': \"P,E,hp s' \\ e' : V\" by fastforce\n from wta' wti' wte' void show ?case by (fastforce elim:WTrtAAss)\n next\n fix T'\n assume wta: \"P,E,hp s \\ Val a : NT\"\n and wte: \"P,E,hp s \\ e : T'\"\n from wta red_hext_incr[OF issi] have wta': \"P,E,hp s' \\ Val a : NT\" by - (rule WTrt_hext_mono)\n from IH[OF sconf wte tconf]\n obtain V where wte': \"P,E,hp s' \\ e' : V\" by fastforce\n from wta' wti' wte' void show ?case by (fastforce elim:WTrtAAss)\n qed\nnext\n case RedAAssNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case RedAAssBounds thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case RedAAssStore thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case RedAAss thus ?case\n by(auto simp del:fun_upd_apply)\nnext\n case (ALengthRed a s ta a' s' T E)\n note IH = `\\T'. \\E \\ s \\; P,E,hp s \\ a : T'; P,hp s \\ t \\t\\\n \\ \\T''. P,E,hp s' \\ a' : T'' \\ P \\ T'' \\ T'`\n from `P,E,hp s \\ a\\length : T`\n show ?case\n proof(rule WTrt_elim_cases)\n fix T'\n assume [simp]: \"T = Integer\"\n and wta: \"P,E,hp s \\ a : T'\\\\\"\n from wta `E \\ s \\` IH `P,hp s \\ t \\t`\n obtain T'' where wta': \"P,E,hp s' \\ a' : T''\" \n and sub: \"P \\ T'' \\ T'\\\\\" by blast\n from sub have \"P,E,hp s' \\ a'\\length : Integer\"\n unfolding widen_Array\n proof(rule disjE)\n assume \"T'' = NT\"\n with wta' show ?thesis by(auto)\n next\n assume \"\\V. T'' = V\\\\ \\ P \\ V \\ T'\"\n then obtain V where \"T'' = V\\\\\" \"P \\ V \\ T'\" by blast\n with wta' show ?thesis by -(rule WTrtALength, simp)\n qed\n thus ?thesis by(simp)\n next\n assume \"P,E,hp s \\ a : NT\"\n with `E \\ s \\` IH `P,hp s \\ t \\t`\n obtain T'' where wta': \"P,E,hp s' \\ a' : T''\" \n and sub: \"P \\ T'' \\ NT\" by blast\n from sub have \"T'' = NT\" by auto\n with wta' show ?thesis by(auto)\n qed\nnext\n case (RedALength h a T n l T' E)\n from `P,E,hp (h, l) \\ addr a\\length : T'` `typeof_addr h a = \\Array_type T n\\`\n have [simp]: \"T' = Integer\" by(auto)\n thus ?case by(auto)\nnext\n case RedALengthNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (FAccRed e s ta e' s' F D T E)\n have IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ e\\F{D} : T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n -- \"Now distinguish the two cases how wt can have arisen.\"\n { fix T' C fm\n assume wte: \"P,E,hp s \\ e : T'\"\n and icto: \"class_type_of' T' = \\C\\\"\n and has: \"P \\ C has F:T (fm) in D\"\n from IH[OF conf wte tconf]\n obtain U where wte': \"P,E,hp s' \\ e' : U\" and UsubC: \"P \\ U \\ T'\" by auto\n -- \"Now distinguish what @{term U} can be.\"\n with UsubC have ?case\n proof(cases \"U = NT\")\n case True\n thus ?thesis using wte' by(blast intro:WTrtFAccNT widen_refl) \n next\n case False\n with icto UsubC obtain C' where icto': \"class_type_of' U = \\C'\\\"\n and C'subC: \"P \\ C' \\\\<^sup>* C\"\n by(rule widen_is_class_type_of)\n from has_field_mono[OF has C'subC] wte' icto'\n show ?thesis by(auto intro!:WTrtFAcc) \n qed }\n moreover\n { assume \"P,E,hp s \\ e : NT\"\n hence \"P,E,hp s' \\ e' : NT\" using IH[OF conf _ tconf] by fastforce\n hence ?case by(fastforce intro:WTrtFAccNT widen_refl) }\n ultimately show ?case using wt by blast\nnext\n case RedFAcc thus ?case unfolding sconf_def\n by(fastforce dest: heap_read_conf intro: addr_loc_type.intros simp add: conf_def)\nnext\n case RedFAccNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (FAssRed1 e s ta e' s' F D e\\<^sub>2)\n have red: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\"\n and IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ e\\F{D}:=e\\<^sub>2 : T\"\n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have void: \"T = Void\" by blast\n -- \"We distinguish if @{term e} has type @{term NT} or a Class type\"\n { assume \"P,E,hp s \\ e : NT\"\n hence \"P,E,hp s' \\ e' : NT\" using IH[OF conf _ tconf] by fastforce\n moreover obtain T\\<^sub>2 where \"P,E,hp s \\ e\\<^sub>2 : T\\<^sub>2\" using wt by auto\n from this red_hext_incr[OF red] have \"P,E,hp s' \\ e\\<^sub>2 : T\\<^sub>2\"\n by(rule WTrt_hext_mono)\n ultimately have ?case using void by(blast intro!:WTrtFAssNT)\n }\n moreover\n { fix T' C TF T\\<^sub>2 fm\n assume wt\\<^sub>1: \"P,E,hp s \\ e : T'\" and icto: \"class_type_of' T' = \\C\\\" and wt\\<^sub>2: \"P,E,hp s \\ e\\<^sub>2 : T\\<^sub>2\"\n and has: \"P \\ C has F:TF (fm) in D\" and sub: \"P \\ T\\<^sub>2 \\ TF\"\n obtain U where wt\\<^sub>1': \"P,E,hp s' \\ e' : U\" and UsubC: \"P \\ U \\ T'\"\n using IH[OF conf wt\\<^sub>1 tconf] by blast\n have wt\\<^sub>2': \"P,E,hp s' \\ e\\<^sub>2 : T\\<^sub>2\"\n by(rule WTrt_hext_mono[OF wt\\<^sub>2 red_hext_incr[OF red]])\n -- \"Is @{term U} the null type or a class type?\"\n have ?case\n proof(cases \"U = NT\")\n case True\n with wt\\<^sub>1' wt\\<^sub>2' void show ?thesis by(blast intro!:WTrtFAssNT)\n next\n case False\n with icto UsubC obtain C' where icto': \"class_type_of' U = \\C'\\\"\n and \"subclass\": \"P \\ C' \\\\<^sup>* C\" by(rule widen_is_class_type_of)\n have \"P \\ C' has F:TF (fm) in D\" by(rule has_field_mono[OF has \"subclass\"])\n with wt\\<^sub>1' show ?thesis using wt\\<^sub>2' sub void icto' by(blast intro:WTrtFAss)\n qed }\n ultimately show ?case using wt by blast\nnext\n case (FAssRed2 e\\<^sub>2 s ta e\\<^sub>2' s' v F D T E)\n have red: \"extTA,P,t \\ \\e\\<^sub>2,s\\ -ta\\ \\e\\<^sub>2',s'\\\"\n and IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e\\<^sub>2 : T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e\\<^sub>2' : U \\ P \\ U \\ T\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ Val v\\F{D}:=e\\<^sub>2 : T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt have [simp]: \"T = Void\" by auto\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix U C TF T\\<^sub>2 fm\n assume wt\\<^sub>1: \"P,E,hp s \\ Val v : U\"\n and icto: \"class_type_of' U = \\C\\\"\n and has: \"P \\ C has F:TF (fm) in D\"\n and wt\\<^sub>2: \"P,E,hp s \\ e\\<^sub>2 : T\\<^sub>2\" and TsubTF: \"P \\ T\\<^sub>2 \\ TF\"\n have wt\\<^sub>1': \"P,E,hp s' \\ Val v : U\"\n by(rule WTrt_hext_mono[OF wt\\<^sub>1 red_hext_incr[OF red]])\n obtain T\\<^sub>2' where wt\\<^sub>2': \"P,E,hp s' \\ e\\<^sub>2' : T\\<^sub>2'\" and T'subT: \"P \\ T\\<^sub>2' \\ T\\<^sub>2\"\n using IH[OF conf wt\\<^sub>2 tconf] by blast\n have \"P,E,hp s' \\ Val v\\F{D}:=e\\<^sub>2' : Void\"\n by(rule WTrtFAss[OF wt\\<^sub>1' icto has wt\\<^sub>2' widen_trans[OF T'subT TsubTF]])\n thus ?case by auto\n next\n fix T\\<^sub>2 assume null: \"P,E,hp s \\ Val v : NT\" and wt\\<^sub>2: \"P,E,hp s \\ e\\<^sub>2 : T\\<^sub>2\"\n from null have \"v = Null\" by simp\n moreover\n obtain T\\<^sub>2' where \"P,E,hp s' \\ e\\<^sub>2' : T\\<^sub>2' \\ P \\ T\\<^sub>2' \\ T\\<^sub>2\"\n using IH[OF conf wt\\<^sub>2 tconf] by blast\n ultimately show ?thesis by(fastforce intro:WTrtFAssNT)\n qed\nnext\n case RedFAss thus ?case by(auto simp del:fun_upd_apply)\nnext\n case RedFAssNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (CallObj e s ta e' s' M es T E)\n have red: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\"\n and IH: \"\\E T. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\\n \\ \\U. P,E,hp s' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ e\\M(es) : T\"\n and tconf: \"P,hp s \\ t \\t\" by fact+\n -- \"We distinguish if @{term e} has type @{term NT} or a Class type\"\n from wt show ?case\n proof(rule WTrt_elim_cases)\n fix T' C Ts meth D Us\n assume wte: \"P,E,hp s \\ e : T'\" and icto: \"class_type_of' T' = \\C\\\"\n and method: \"P \\ C sees M:Ts\\T = meth in D\"\n and wtes: \"P,E,hp s \\ es [:] Us\" and subs: \"P \\ Us [\\] Ts\"\n obtain U where wte': \"P,E,hp s' \\ e' : U\" and UsubC: \"P \\ U \\ T'\"\n using IH[OF conf wte tconf] by blast\n show ?thesis\n proof(cases \"U = NT\")\n case True\n moreover have \"P,E,hp s' \\ es [:] Us\"\n by(rule WTrts_hext_mono[OF wtes red_hext_incr[OF red]])\n ultimately show ?thesis using wte' by(blast intro!:WTrtCallNT)\n next\n case False\n with icto UsubC obtain C'\n where icto': \"class_type_of' U = \\C'\\\" and \"subclass\": \"P \\ C' \\\\<^sup>* C\"\n by(rule widen_is_class_type_of)\n\n obtain Ts' T' meth' D'\n where method': \"P \\ C' sees M:Ts'\\T' = meth' in D'\"\n and subs': \"P \\ Ts [\\] Ts'\" and sub': \"P \\ T' \\ T\"\n using Call_lemma[OF method \"subclass\" wf] by fast\n have wtes': \"P,E,hp s' \\ es [:] Us\"\n by(rule WTrts_hext_mono[OF wtes red_hext_incr[OF red]])\n show ?thesis using wtes' wte' icto' subs method' subs' sub' by(blast intro:widens_trans)\n qed\n next\n fix Ts\n assume \"P,E,hp s \\ e:NT\"\n hence \"P,E,hp s' \\ e' : NT\" using IH[OF conf _ tconf] by fastforce\n moreover\n fix Ts assume wtes: \"P,E,hp s \\ es [:] Ts\"\n have \"P,E,hp s' \\ es [:] Ts\"\n by(rule WTrts_hext_mono[OF wtes red_hext_incr[OF red]])\n ultimately show ?thesis by(blast intro!:WTrtCallNT)\n qed\nnext\n case (CallParams es s ta es' s' v M T E)\n have reds: \"extTA,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\\"\n and IH: \"\\Ts E. \\E \\ s \\; P,E,hp s \\ es [:] Ts; P,hp s \\ t \\t\\\n \\ \\Ts'. P,E,hp s' \\ es' [:] Ts' \\ P \\ Ts' [\\] Ts\"\n and conf: \"E \\ s \\\" and wt: \"P,E,hp s \\ Val v\\M(es) : T\" \n and tconf: \"P,hp s \\ t \\t\" by fact+\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix U C Ts meth D Us\n assume wte: \"P,E,hp s \\ Val v : U\" and icto: \"class_type_of' U = \\C\\\"\n and \"P \\ C sees M:Ts\\T = meth in D\"\n and wtes: \"P,E,hp s \\ es [:] Us\" and \"P \\ Us [\\] Ts\"\n moreover have \"P,E,hp s' \\ Val v : U\"\n by(rule WTrt_hext_mono[OF wte reds_hext_incr[OF reds]])\n moreover obtain Us' where \"P,E,hp s' \\ es' [:] Us'\" \"P \\ Us' [\\] Us\"\n using IH[OF conf wtes tconf] by blast\n ultimately show ?thesis by(fastforce intro:WTrtCall widens_trans)\n next\n fix Us\n assume null: \"P,E,hp s \\ Val v : NT\" and wtes: \"P,E,hp s \\ es [:] Us\"\n from null have \"v = Null\" by simp\n moreover\n obtain Us' where \"P,E,hp s' \\ es' [:] Us' \\ P \\ Us' [\\] Us\"\n using IH[OF conf wtes tconf] by blast\n ultimately show ?thesis by(fastforce intro:WTrtCallNT)\n qed\nnext\n case (RedCall s a U M Ts T pns body D vs T' E)\n have hp: \"typeof_addr (hp s) a = \\U\\\"\n and method: \"P \\ class_type_of U sees M: Ts\\T = \\(pns,body)\\ in D\"\n and wt: \"P,E,hp s \\ addr a\\M(map Val vs) : T'\" by fact+\n obtain Ts' where wtes: \"P,E,hp s \\ map Val vs [:] Ts'\"\n and subs: \"P \\ Ts' [\\] Ts\" and T'isT: \"T' = T\"\n using wt method hp wf by(auto 4 3 dest: sees_method_fun)\n from wtes subs have length_vs: \"length vs = length Ts\"\n by(auto simp add: WTrts_conv_list_all2 dest!: list_all2_lengthD)\n have UsubD: \"P \\ ty_of_htype U \\ Class (class_type_of U)\"\n by(cases U)(simp_all add: widen_array_object)\n from sees_wf_mdecl[OF wf method] obtain T''\n where wtabody: \"P,[this#pns [\\] Class D#Ts] \\ body :: T''\"\n and T''subT: \"P \\ T'' \\ T\" and length_pns: \"length pns = length Ts\"\n by(fastforce simp:wf_mdecl_def simp del:map_upds_twist)\n from wtabody have \"P,empty(this#pns [\\] Class D#Ts),hp s \\ body : T''\"\n by(rule WT_implies_WTrt)\n hence \"P,E(this#pns [\\] Class D#Ts),hp s \\ body : T''\"\n by(rule WTrt_env_mono) simp\n hence \"P,E,hp s \\ blocks (this#pns) (Class D#Ts) (Addr a#vs) body : T''\"\n using wtes subs hp sees_method_decl_above[OF method] length_vs length_pns UsubD\n by(auto simp add:wt_blocks rel_list_all2_Cons2 intro: widen_trans)\n with T''subT T'isT show ?case by blast\nnext\n case (RedCallExternal s a U M Ts T' D vs ta va h' ta' e' s')\n from `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\` have \"hp s \\ h'\" by(rule red_external_hext)\n with `P,E,hp s \\ addr a\\M(map Val vs) : T`\n have \"P,E,h' \\ addr a\\M(map Val vs) : T\" by(rule WTrt_hext_mono)\n moreover from `typeof_addr (hp s) a = \\U\\` `P \\ class_type_of U sees M: Ts\\T' = Native in D` `P,E,hp s \\ addr a\\M(map Val vs) : T`\n have \"P,hp s \\ a\\M(vs) : T'\"\n by(fastforce simp add: external_WT'_iff dest: sees_method_fun)\n ultimately show ?case using RedCallExternal\n by(auto 4 3 intro: red_external_conf_extRet[OF wf] intro!: wt_external_call simp add: sconf_def dest: sees_method_fun[where C=\"class_type_of U\"])\nnext\n case RedCallNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (BlockRed e h x V vo ta e' h' x' T T' E)\n note IH = `\\T E. \\E \\ (h, x(V := vo)) \\; P,E,hp (h, x(V := vo)) \\ e : T; P,hp (h, x(V := vo)) \\ t \\t\\\n \\ \\T'. P,E,hp (h', x') \\ e' : T' \\ P \\ T' \\ T`[simplified]\n from `P,E,hp (h, x) \\ {V:T=vo; e} : T'` have \"P,E(V\\T),h \\ e : T'\" by(cases vo, auto)\n moreover from `E \\ (h, x) \\` `P,E,hp (h, x) \\ {V:T=vo; e} : T'`\n have \"(E(V \\ T)) \\ (h, x(V := vo)) \\\"\n by(cases vo)(simp add: lconf_def sconf_def,auto simp add: sconf_def conf_def intro: lconf_upd2)\n ultimately obtain T'' where wt': \"P,E(V\\T),h' \\ e' : T''\" \"P \\ T'' \\ T'\" using `P,hp (h, x) \\ t \\t`\n by(auto dest: IH)\n { fix v\n assume vo: \"x' V = \\v\\\"\n from `(E(V \\ T)) \\ (h, x(V := vo)) \\` `extTA,P,t \\ \\e,(h, x(V := vo))\\ -ta\\ \\e',(h', x')\\` `P,E(V\\T),h \\ e : T'`\n have \"P,h' \\ x' (:\\) (E(V \\ T))\" by(auto simp add: sconf_def dest: red_preserves_lconf)\n with vo have \"\\T'. typeof\\<^bsub>h'\\<^esub> v = \\T'\\ \\ P \\ T' \\ T\" by(fastforce simp add: sconf_def lconf_def conf_def)\n then obtain T' where \"typeof\\<^bsub>h'\\<^esub> v = \\T'\\\" \"P \\ T' \\ T\" by blast\n hence ?case using wt' vo by(auto) }\n moreover\n { assume \"x' V = None\" with wt' have ?case by(auto) }\n ultimately show ?case by blast\nnext \n case RedBlock thus ?case by auto\nnext\n case (SynchronizedRed1 o' s ta o'' s' e T E)\n have red: \"extTA,P,t \\ \\o',s\\ -ta\\ \\o'',s'\\\" by fact\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ o' : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ o'' : T' \\ P \\ T' \\ T\" by fact\n have conf: \"E \\ s \\\" by fact\n have wt: \"P,E,hp s \\ sync(o') e : T\" by fact+\n thus ?case\n proof(rule WTrt_elim_cases)\n fix To\n assume wto: \"P,E,hp s \\ o' : To\"\n and refT: \"is_refT To\" \n and wte: \"P,E,hp s \\ e : T\"\n from IH[OF conf wto `P,hp s \\ t \\t`] obtain To' where \"P,E,hp s' \\ o'' : To'\" and sub: \"P \\ To' \\ To\" by auto\n moreover have \"P,E,hp s' \\ e : T\"\n by(rule WTrt_hext_mono[OF wte red_hext_incr[OF red]])\n moreover have \"is_refT To'\" using refT sub by(auto intro: widen_refT)\n ultimately show ?thesis by(auto)\n qed\nnext\n case SynchronizedNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case LockSynchronized thus ?case by(auto)\nnext\n case (SynchronizedRed2 e s ta e' s' a T E)\n have red: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\" by fact\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\" by fact\n have conf: \"E \\ s \\\" by fact\n have wt: \"P,E,hp s \\ insync(a) e : T\" by fact\n thus ?case\n proof(rule WTrt_elim_cases)\n fix Ta\n assume \"P,E,hp s \\ e : T\"\n and hpa: \"typeof_addr (hp s) a = \\Ta\\\"\n from `P,E,hp s \\ e : T` conf `P,hp s \\ t \\t` obtain T'\n where \"P,E,hp s' \\ e' : T'\" \"P \\ T' \\ T\" by(blast dest: IH)\n moreover from red have hext: \"hp s \\ hp s'\" by(auto dest: red_hext_incr)\n with hpa have \"P,E,hp s' \\ addr a : ty_of_htype Ta\"\n by(auto intro: typeof_addr_hext_mono)\n ultimately show ?thesis by auto\n qed\nnext\n case UnlockSynchronized thus ?case by(auto)\nnext\n case SeqRed thus ?case\n apply(auto)\n apply(drule WTrt_hext_mono[OF _ red_hext_incr], assumption)\n by auto\nnext\n case (CondRed b s ta b' s' e1 e2 T E)\n have red: \"extTA,P,t \\ \\b,s\\ -ta\\ \\b',s'\\\" by fact\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ b : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ b' : T' \\ P \\ T' \\ T\" by fact\n have conf: \"E \\ s \\\" by fact\n have wt: \"P,E,hp s \\ if (b) e1 else e2 : T\" by fact\n thus ?case\n proof(rule WTrt_elim_cases)\n fix T1 T2\n assume wtb: \"P,E,hp s \\ b : Boolean\"\n and wte1: \"P,E,hp s \\ e1 : T1\"\n and wte2: \"P,E,hp s \\ e2 : T2\"\n and lub: \"P \\ lub(T1, T2) = T\"\n from IH[OF conf wtb `P,hp s \\ t \\t`] have \"P,E,hp s' \\ b' : Boolean\" by(auto)\n moreover have \"P,E,hp s' \\ e1 : T1\"\n by(rule WTrt_hext_mono[OF wte1 red_hext_incr[OF red]])\n moreover have \"P,E,hp s' \\ e2 : T2\"\n by(rule WTrt_hext_mono[OF wte2 red_hext_incr[OF red]])\n ultimately show ?thesis using lub by auto\n qed\nnext\n case (ThrowRed e s ta e' s' T E)\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\" by fact\n have conf: \"E \\ s \\\" by fact\n have wt: \"P,E,hp s \\ throw e : T\" by fact\n then obtain T'\n where wte: \"P,E,hp s \\ e : T'\" \n and nobject: \"P \\ T' \\ Class Throwable\" by auto\n from IH[OF conf wte `P,hp s \\ t \\t`] obtain T'' \n where wte': \"P,E,hp s' \\ e' : T''\"\n and PT'T'': \"P \\ T'' \\ T'\" by blast\n from nobject PT'T'' have \"P \\ T'' \\ Class Throwable\"\n by(auto simp add: widen_Class)(erule notE, rule rtranclp_trans)\n hence \"P,E,hp s' \\ throw e' : T\" using wte' PT'T''\n by -(erule WTrtThrow)\n thus ?case by(auto)\nnext\n case RedThrowNull thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case (TryRed e s ta e' s' C V e2 T E)\n have red: \"extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\\" by fact\n have IH: \"\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T\" by fact\n have conf: \"E \\ s \\\" by fact\n have wt: \"P,E,hp s \\ try e catch(C V) e2 : T\" by fact\n thus ?case\n proof(rule WTrt_elim_cases)\n fix T1\n assume wte: \"P,E,hp s \\ e : T1\"\n and wte2: \"P,E(V \\ Class C),hp s \\ e2 : T\"\n and sub: \"P \\ T1 \\ T\"\n from IH[OF conf wte `P,hp s \\ t \\t`] obtain T1' where \"P,E,hp s' \\ e' : T1'\" and \"P \\ T1' \\ T1\" by(auto)\n moreover have \"P,E(V \\ Class C),hp s' \\ e2 : T\"\n by(rule WTrt_hext_mono[OF wte2 red_hext_incr[OF red]])\n ultimately show ?thesis using sub by(auto elim: widen_trans)\n qed\nnext\n case RedTryFail thus ?case unfolding sconf_def\n by(fastforce simp add: xcpt_subcls_Throwable[OF _ wf])\nnext\n case RedSeq thus ?case by auto\nnext\n case RedCondT thus ?case by(auto dest: is_lub_upper)\nnext\n case RedCondF thus ?case by(auto dest: is_lub_upper)\nnext\n case RedWhile thus ?case by(fastforce) \nnext\n case RedTry thus ?case by auto\nnext\n case RedTryCatch thus ?case by(fastforce)\nnext\n case (ListRed1 e s ta e' s' es Ts E)\n note IH = `\\T E. \\E \\ s \\; P,E,hp s \\ e : T; P,hp s \\ t \\t\\ \\ \\T'. P,E,hp s' \\ e' : T' \\ P \\ T' \\ T`\n from `P,E,hp s \\ e # es [:] Ts` obtain T Ts' where \"Ts = T # Ts'\" \"P,E,hp s \\ e : T\" \"P,E,hp s \\ es [:] Ts'\" by auto\n with IH[of E T] `E \\ s \\` WTrts_hext_mono[OF `P,E,hp s \\ es [:] Ts'` red_hext_incr[OF `extTA,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`]]\n show ?case using `P,hp s \\ t \\t` by(auto simp add: list_all2_Cons2 intro: widens_refl)\nnext\n case ListRed2 thus ?case\n by(fastforce dest: hext_typeof_mono[OF reds_hext_incr])\nqed(fastforce)+\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/J/TypeSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073507867328, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.26240825911103616}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory GraphLang\n\nimports\n \"CLib.TypHeapLib\"\n \"Lib.SplitRule\"\n \"CommonOps\"\n\nbegin\n\ntext \\Note that machine states here are assumed to be countable and\nare thus represented by naturals.\\\n\ndatatype variable =\n VarNone\n | VarWord8 word8\n | VarWord16 word16\n | VarWord32 word32\n | VarWord64 word64\n | VarMem \"machine_word \\ word8\"\n | VarDom \"machine_word set\"\n | VarGhostState \"ghost_assertions\"\n | VarHTD \"heap_typ_desc\"\n | VarMS \"unit \\ nat\"\n | VarBool bool\n\ntext \\States are a mapping from names to the variable type, which is\na union of the available names.\\\n\ndatatype state = State \"string \\ variable\"\n\ntext \\Accessors for grabbing variables by name and expected type.\\\n\ndefinition\n \"var_acc nm st = (case st of State f \\ f nm)\"\n\ndefinition\n \"var_word8 nm st = (case var_acc nm st of\n VarWord8 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word16 nm st = (case var_acc nm st of\n VarWord16 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word32 nm st = (case var_acc nm st of\n VarWord32 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_word64 nm st = (case var_acc nm st of\n VarWord64 w \\ w | _ \\ 0)\"\n\ndefinition\n \"var_ghoststate nm st = (case var_acc nm st of\n VarGhostState arr \\ arr | _ \\ (\\_. 0))\"\n\ndefinition\n \"var_mem nm st = (case var_acc nm st of\n VarMem m \\ m | _ \\ \\_. 0)\"\n\ndefinition\n \"var_dom nm st = (case var_acc nm st of\n VarDom d \\ d | _ \\ {})\"\n\ndefinition\n \"var_htd nm st = (case var_acc nm st of\n VarHTD htd \\ htd | _ \\ empty_htd)\"\n\ndefinition\n \"var_ms nm st = (case var_acc nm st of\n VarMS ms \\ ms | _ \\ ((), 0))\"\n\ndefinition\n \"var_bool nm st = (case var_acc nm st of\n VarBool bool \\ bool | _ \\ False)\"\n\ntext \\The variable updator.\\\n\ndefinition\n \"var_upd nm v st = (case st of State f \\ State (f (nm := v)))\"\n\ndefinition\n \"default_state = State (\\_. VarNone)\"\n\ntext \\The type of nodes.\\\n\ndatatype next_node =\n NextNode nat | Ret | Err\n\ndatatype node =\n Basic next_node \"(string \\ (state \\ variable)) list\"\n | Cond next_node next_node \"state \\ bool\"\n | Call next_node string \"(state \\ variable) list\" \"string list\"\n\ndefinition Skip where\n \"Skip nn = Cond nn nn (\\x. True)\"\n\ntext \\The type for a total graph function, including list of inputs,\n list of outputs, graph, and entry point.\\\n\ndatatype graph_function\n = GraphFunction \"string list\" \"string list\" \"nat \\ node option\" nat\n\nprimrec entry_point where\n \"entry_point (GraphFunction inputs outputs graph ep) = ep\"\n\nprimrec function_graph where\n \"function_graph (GraphFunction inputs outputs graph ep) = graph\"\n\nprimrec function_inputs where\n \"function_inputs (GraphFunction inputs outputs graph ep) = inputs\"\n\nprimrec function_outputs where\n \"function_outputs (GraphFunction inputs outputs graph ep) = outputs\"\n\ntext \\The definition of execution, including a stack to allow function calls.\\\n\ndefinition\n save_vals :: \"string list \\ variable list \\ state \\ state\"\nwhere\n \"save_vals vars vals st = fold (\\(var, val). var_upd var val) (zip vars vals) st\"\n\ndefinition\n init_vars :: \"string list \\ (state \\ variable) list \\ state \\ state\"\nwhere\n \"init_vars vars accs st = save_vals vars (map (\\i. i st) accs) default_state\"\n\ndefinition\n acc_vars :: \"string list \\ state \\ variable list\"\nwhere\n \"acc_vars vars st = map (\\v. var_acc v st) vars\"\n\ndefinition\n return_vars :: \"string list \\ string list \\ state \\ state \\ state\"\nwhere\n \"return_vars inner outer inner_st = save_vals outer (acc_vars inner inner_st)\"\n\ndefinition\n upd_vars :: \"(string \\ (state \\ variable)) list \\ state \\ state\"\nwhere\n \"upd_vars upds st = save_vals (map fst upds) (map (\\(nm, vf). vf st) upds) st\"\n\ntype_synonym stack = \"(next_node \\ state \\ string) list\"\n\nprimrec\n upd_stack :: \"next_node \\ (state \\ state) \\ stack \\ stack\"\nwhere\n \"upd_stack nn stf (x # xs) = (nn, stf (fst (snd x)), snd (snd x)) # xs\"\n | \"upd_stack nn stf [] = []\"\n\nprimrec\n exec_node :: \"(string \\ graph_function option)\n \\ state \\ node \\ stack \\ stack set\"\nwhere\n \"exec_node Gamma st (Basic cont upds) stack\n = {upd_stack cont (K (upd_vars upds st)) stack}\"\n | \"exec_node Gamma st (Cond left right cond) stack\n = {upd_stack (if cond st then left else right) id stack}\"\n | \"exec_node Gamma st (Call cont fname inputs outputs) stack\n = (case Gamma fname of None \\ {upd_stack Err id stack}\n | Some (GraphFunction inps outps graph ep)\n \\ {(NextNode ep, init_vars inps inputs st, fname)\n # stack})\"\n\nprimrec\n exec_node_return :: \"(string \\ graph_function option)\n \\ state \\ node \\ stack \\ stack set\"\nwhere\n \"exec_node_return _ _ (Basic _ _) stack = {}\"\n | \"exec_node_return _ _ (Cond _ _ _) stack = {}\"\n | \"exec_node_return Gamma st (Call cont fname inputs outputs) stack\n = (case Gamma fname of None \\ {}\n | Some (GraphFunction inps outps graph ep)\n \\ {upd_stack cont (return_vars outps outputs st) stack})\"\n\ntext \\The single-step relation on graph states.\\\n\ndefinition\n exec_graph_step :: \"(string \\ graph_function option)\n \\ (stack \\ stack) set\"\nwhere\n \"exec_graph_step Gamma = {(stack, stack'). case stack of\n (NextNode nn, st, fname) # _ \\\n (case Gamma fname of None \\ False\n | Some (GraphFunction _ _ graph _) \\\n (case graph nn of None \\ stack' = upd_stack Err id stack\n | Some node \\ stack' \\ exec_node Gamma st node stack))\n | (Ret, st, _) # (NextNode nn, _, fname) # _ \\\n (case Gamma fname of None \\ False\n | Some (GraphFunction _ _ graph _) \\\n (case graph nn of None \\ stack' = upd_stack Err id (tl stack)\n | Some node \\ stack' \\ exec_node_return Gamma st node (tl stack)))\n | [] \\ False\n | [_] \\ False \\ \\note NextNode case is handled\\\n | _ \\ stack' = upd_stack Err id (tl stack)\n }\"\n\ntext \\Multi-step relations.\\\n\ndefinition exec_graph\nwhere \"exec_graph Gamma = rtrancl (exec_graph_step Gamma)\"\n\ndefinition exec_graph_n\nwhere \"exec_graph_n Gamma n = exec_graph_step Gamma ^^ n\"\n\nlemma relpow_Suc_simp2:\n \"R ^^ Suc n = R O R ^^ n\"\n apply safe\n apply (erule relpow_Suc_E2, blast)\n apply (blast intro: relpow_Suc_I2)\n done\n\nlemma exec_graph_n_take_step:\n \"\\ (stack, stack') \\ exec_graph_n GGamma n;\n \\ n = 0; stack' = stack \\ \\ P;\n \\stack''. \\ n > 0; (stack, stack'') \\ exec_graph_step GGamma;\n (stack'', stack') \\ exec_graph_n GGamma (n - 1) \\\n \\ P \\ \\ P\"\n apply (cases n, simp_all only: exec_graph_n_def relpow_Suc_simp2)\n apply simp\n apply clarsimp\n done\n\nlemma exec_graph_take_step:\n \"\\ ((NextNode m, gst, fname) # stack, stack') \\ exec_graph_n GGamma n;\n GGamma fname = Some gf; function_graph gf m = Some node \\\n \\ (n = 0 \\ stack' = (NextNode m, gst, fname) # stack)\n \\ (\\stack''. n \\ 1\n \\ stack'' \\ exec_node GGamma gst node\n ((NextNode m, gst, fname) # stack)\n \\ (stack'', stack') \\ exec_graph_n GGamma (n - 1))\"\n apply (erule exec_graph_n_take_step)\n apply simp\n apply (clarsimp simp: exec_graph_step_def split: graph_function.split_asm)\n apply blast\n done\n\ndefinition\n continuing :: \"stack \\ bool\"\nwhere\n \"continuing st = (case st of [] \\ False\n | [(NextNode _, _, _)] \\ True | [_] \\ False | _ \\ True)\"\n\nlemma continuing_simps[simp]:\n \"\\ continuing []\"\n \"continuing [(unn, st, g)] = (unn \\ Ret \\ unn \\ Err)\"\n \"continuing ((Ret, st, g) # stk) = (stk \\ [])\"\n \"continuing (stf # stf' # stk)\"\n \"continuing ((NextNode nn, st, g) # stk)\"\n \"continuing ((Err, st, g) # stk) = (stk \\ [])\"\n by (simp_all add: continuing_def split: next_node.split list.split)\n\nlemma consume_Not_eq:\n \"(\\ P) = Q \\ P = (\\ Q)\"\n by clarsimp\n\nlemma exec_node_case_helper:\n \"(stk' \\ exec_node Gamma st node stk)\n = (case node of Basic _ _ \\ stk' \\ id (exec_node Gamma) st node stk\n | _ \\ stk' \\ id (exec_node Gamma) st node stk)\"\n \"(stk' \\ exec_node_return Gamma st node stk)\n = (case node of Basic _ _ \\ stk' \\ id (exec_node_return Gamma) st node stk\n | _ \\ stk' \\ id (exec_node_return Gamma) st node stk)\"\n by (simp_all split: node.split)\n\nlemmas splits_raw = prod.split list.split option.split\n next_node.split graph_function.split node.split\nlemmas splits_cooked = splits_raw[where P=Not, THEN consume_Not_eq]\n option.split[where P=\"\\S. x \\ S\", THEN consume_Not_eq]\n graph_function.split[where P=\"\\S. x \\ S\", THEN consume_Not_eq] for x\n\nlemmas all_exec_graph_step_cases = exec_graph_step_def[THEN eqset_imp_iff,\n simplified, unfolded exec_node_case_helper splits_cooked, simplified,\n unfolded splits_cooked, simplified]\n\nlemma exec_node_stack_extend:\n \"continuing stack \\\n (stack' \\ exec_node Gamma st node (stack @ xs))\n = (\\stack''. stack' = stack'' @ xs\n \\ stack'' \\ exec_node Gamma st node stack)\"\n apply (cases node, simp_all)\n apply (simp_all add: continuing_def\n split: list.split_asm prod.split_asm next_node.split_asm)\n apply (auto split: option.split graph_function.split)\n done\n\nlemma exec_node_return_stack_extend:\n \"continuing stack \\\n (stack' \\ exec_node_return Gamma st node (stack @ xs))\n = (\\stack''. stack' = stack'' @ xs\n \\ stack'' \\ exec_node_return Gamma st node stack)\"\n apply (cases node, simp_all)\n apply (simp_all add: continuing_def\n split: list.split_asm prod.split_asm next_node.split_asm)\n apply (auto split: option.split graph_function.split)\n done\n\nlemma exec_graph_step_stack_extend:\n \"continuing stack \\\n ((stack @ xs, stack') \\ exec_graph_step Gamma)\n = (\\stack''. stack' = stack'' @ xs\n \\ (stack, stack'') \\ exec_graph_step Gamma)\"\n using exec_node_stack_extend[where stack'=stack' and stack=stack\n and Gamma=Gamma and xs=xs]\n exec_node_return_stack_extend[where stack'=stack' and stack=\"tl stack\"\n and Gamma=Gamma and xs=xs]\n apply (simp add: exec_graph_step_def)\n apply (cases stack, simp_all)\n apply clarsimp\n apply (case_tac a, simp_all)\n apply (clarsimp split: option.split graph_function.split)\n apply (clarsimp simp: neq_Nil_conv split: list.split)\n apply (clarsimp split: next_node.split option.split graph_function.split)\n apply (clarsimp simp: neq_Nil_conv split: list.split)\n done\n\nlemma exec_graph_n_stack_extend:\n \"continuing stack \\\n ((stack @ xs, stack') \\ exec_graph_n Gamma n)\n = (\\stack'' n'. (stack, stack'') \\ (exec_graph_step Gamma\n \\ {(st, _). continuing st}) ^^ n'\n \\ ((n' < n \\ \\ continuing stack''\n \\ (stack'' @ xs, stack') \\ exec_graph_n Gamma (n - n'))\n \\ (stack' = stack'' @ xs \\ n' = n)))\"\n unfolding exec_graph_n_def\nproof (induct n arbitrary: stack)\n case 0\n show ?case\n by auto[1]\nnext\n case (Suc n stack)\n show ?case\n apply (simp only: relpow_Suc_simp2)\n apply (rule iffI)\n apply (clarsimp simp: exec_graph_step_stack_extend Suc.prems)\n apply (case_tac \"continuing stack''\")\n apply (frule Suc.hyps, clarsimp)\n apply (rule_tac x=\"stack''a\" in exI, rule_tac x=\"Suc n'\" in exI)\n apply (simp only: relpow_Suc_simp2, clarsimp)\n apply (blast intro: Suc.prems)\n apply (rule_tac x=\"stack''\" in exI, rule_tac x=1 in exI)\n apply (auto simp: Suc.prems)[1]\n apply (clarsimp)\n apply (case_tac n', simp_all only: minus_nat.diff_0 relpow_Suc_simp2)\n apply auto[1]\n apply clarsimp\n apply (rule_tac b=\"y @ xs\" in relcompI)\n apply (simp add: exec_graph_step_stack_extend Suc.prems)\n apply (case_tac \"nat = 0\")\n apply auto[1]\n apply (subst Suc.hyps)\n apply (case_tac nat, simp_all only: relpow_Suc_simp2, auto)[1]\n apply auto[1]\n done\nqed\n\ndefinition\n \"init_state fname gfun xs =\n (NextNode (entry_point gfun), save_vals (function_inputs gfun) xs default_state, fname)\"\n\nlemma exec_graph_step_nonempty:\n \"\\ (stack, stack') \\ exec_graph_step Gamma ^^ n; stack \\ [] \\\n \\ stack' \\ []\"\n by (cases n, auto simp: all_exec_graph_step_cases\n split: graph_function.split_asm)\n\nlemma relpow_mono:\n \"\\ R \\ (S :: ('a \\ 'a) set) \\ \\ R ^^ n \\ S ^^ n\"\n by (induct n, auto)\n\nlemma drop_eq_Cons:\n \"(drop n xs = x # ys) = (\\zs. length zs = n \\ xs = zs @ x # ys)\"\n apply (induct n arbitrary: xs)\n apply simp\n apply (case_tac xs, auto simp add: length_Suc_conv)\n done\n\nlemma exec_graph_step_n_Err:\n \"(((Err, st, graph) # stack, stack') \\ exec_graph_n Gamma n)\n \\ stack' = upd_stack Err id (drop n ((Err, st, graph) # stack))\n \\ drop n ((Err, st, graph) # stack) \\ []\"\nproof (induct n arbitrary: stack')\n case 0\n show ?case using 0\n by (auto simp add: exec_graph_n_def)\nnext\n case (Suc n)\n show ?case using Suc.prems\n apply (clarsimp simp: exec_graph_n_def relcomp_unfold linorder_not_le)\n apply (drule exec_graph_step_def[THEN eqset_imp_iff, THEN iffD1])\n apply (case_tac y, simp_all)\n apply (drule Suc.hyps[rotated, unfolded exec_graph_n_def])\n apply (simp only: neq_Nil_conv)\n apply (clarsimp simp: linorder_not_le drop_eq_Cons)\n apply (clarsimp split: list.split_asm)\n apply (case_tac zs, simp_all)\n done\nqed\n\ntext \\Possibly infinite traces.\\\n\ndefinition nat_trace_rel\n where \"nat_trace_rel cont r = {tr. (\\n. (tr n = None \\ tr (Suc n) = None)\n \\ (tr (Suc n) \\ None \\ (the (tr n), the (tr (Suc n))) \\ r)\n \\ (tr n \\ None \\ cont (the (tr n)) \\ tr (Suc n) \\ None))}\"\n\ntype_synonym trace = \"(nat \\ stack option)\"\n\ndefinition\n trace_end :: \"(nat \\ 'a option) \\ 'a option\"\nwhere\n \"trace_end tr = (if \\n. tr n = None then tr (Max (dom tr)) else None)\"\n\nlemma nat_trace_rel_Some_range:\n \"tr \\ nat_trace_rel cont r \\ tr n = Some v\n \\ \\i \\ n. \\v'. tr i = Some v'\"\n apply (induct n arbitrary: v, simp_all)\n apply (simp add: nat_trace_rel_def le_Suc_eq)\n apply (drule_tac x=n in spec, clarsimp)\n done\n\nlemma trace_None_dom_subset:\n \"tr n = None \\ tr \\ nat_trace_rel cont R\n \\ dom tr \\ {..< n}\"\n apply clarsimp\n apply (drule_tac n=x in nat_trace_rel_Some_range, simp+)\n apply (drule_tac x=\"n\" in spec)\n apply simp\n done\n\nlemma nat_trace_Max_dom_None:\n \"tr \\ nat_trace_rel cont R \\ tr n \\ None \\ (tr (Max (dom tr)) \\ None)\"\n apply (rule notI)\n apply (frule(1) trace_None_dom_subset)\n apply (cases \"dom tr = {}\")\n apply clarsimp\n apply (drule Max_in[rotated])\n apply (simp add: finite_subset)\n apply clarsimp\n done\n\nlemma trace_end_NoneD:\n \"trace_end tr = None \\ tr \\ nat_trace_rel cont r\n \\ tr = (\\_. None) \\ (\\f. tr = Some o f)\"\n apply (subst disj_commute, rule disjCI)\n apply (clarsimp simp: fun_eq_iff)\n apply (simp add: trace_end_def split: if_split_asm)\n apply (metis nat_trace_Max_dom_None not_None_eq)\n apply (rule_tac x=\"the o tr\" in exI, simp)\n done\n\nlemma trace_end_SomeD:\n \"trace_end tr = Some v \\ tr \\ nat_trace_rel cont r\n \\ \\n. tr n = Some v \\ tr (Suc n) = None \\ \\ cont v\"\n apply (clarsimp simp: trace_end_def split: if_split_asm)\n apply (rule exI, rule conjI, assumption)\n apply (case_tac \"tr (Suc (Max (dom tr)))\")\n apply (simp add: nat_trace_rel_def)\n apply (metis option.sel option.simps(3))\n apply (cut_tac x=\"Suc y\" for y in Max_ge[OF finite_subset domI])\n apply (erule(1) trace_None_dom_subset[rotated])\n apply simp+\n done\n\ndefinition\n exec_trace :: \"(string \\ graph_function option) \\ string \\ trace set\"\nwhere\n \"exec_trace Gamma fname\n = {trace. \\gf. Gamma fname = Some gf\n \\ (\\st. trace 0 = Some [(NextNode (entry_point gf), st, fname)])\n \\ trace \\ nat_trace_rel continuing (exec_graph_step Gamma)}\"\n\nlemma relpow_nat_trace:\n \"((s, s') \\ r ^^ n) = (\\tr \\ nat_trace_rel (\\x. False) r. tr 0 = Some s\n \\ tr n = Some s' \\ tr (Suc n) = None)\"\n apply (simp add: relpow_fun_conv, safe)\n apply (rule_tac x=\"\\x. if x < Suc n then Some (f x) else None\" in bexI)\n apply simp\n apply (simp add: nat_trace_rel_def)\n apply (rule_tac x=\"the o tr\" in exI)\n apply (frule(1) nat_trace_rel_Some_range[where n=n])\n apply (clarsimp simp: nat_trace_rel_def)\n done\n\ntext \\Parsing code for the graph language.\\\n\nML \\\n\nstructure ParseGraph = struct\n\nexception PARSEGRAPH of string list\n\nval debug = ref false\n\nfun trace s = if (! debug) then writeln s else ()\n\nfun parse_int str = if String.isPrefix \"-\" str\n then ~ (parse_int (unprefix \"-\" str))\n else case read_int (raw_explode str)\n of (n, []) => n\n | _ => raise PARSEGRAPH [\"read_int:\", str]\n\nval s = @{term \"s :: state\"}\n\nfun parse_n p (n :: ss) = let\n val n = parse_int n\n in funpow_yield n p ss end\n | parse_n _ [] = raise PARSEGRAPH [\"parse_n: empty\"]\n\nfun mk_binT sz = Word_Lib.mk_wordT sz |> dest_Type |> snd |> hd\n\nval ptr_size_str =\n case @{typ machine_word} of\n @{typ word32} => \"32\"\n | @{typ word64} => \"64\"\n\nfun parse_typ (\"Word\" :: n :: ss) = let\n val n = parse_int n\n in (Word_Lib.mk_wordT n, ss) end\n | parse_typ (\"Bool\" :: ss) = (@{typ bool}, ss)\n | parse_typ (\"Mem\" :: ss) = (@{typ \"machine_word \\ word8\"}, ss)\n | parse_typ (\"Dom\" :: ss) = (@{typ \"machine_word set\"}, ss)\n | parse_typ (\"HTD\" :: ss) = (@{typ heap_typ_desc}, ss)\n | parse_typ (\"PMS\" :: ss) = (@{typ nat}, ss)\n | parse_typ (\"UNIT\" :: ss) = (@{typ unit}, ss)\n | parse_typ (\"Array\" :: ss) = let\n val (el_typ, ss) = parse_typ ss\n val (n, ss) = case ss of (n :: ss) => (parse_int n, ss)\n | [] => raise PARSEGRAPH [\"parse_typ: array index\"]\n in (Type (@{type_name array}, [el_typ, mk_binT n]), ss) end\n | parse_typ (bad as (\"WordArray\" :: \"50\" :: element_size :: ss)) =\n (if element_size = ptr_size_str\n then (@{typ \"ghost_assertions\"}, ss)\n else raise PARSEGRAPH (\"parse_typ: bad ghost assertion codomain\" :: bad))\n | parse_typ (\"Struct\" :: nm :: ss) = (Type (nm, []), ss)\n | parse_typ (\"Ptr\" :: ss) = let\n val (obj_typ, ss) = parse_typ ss\n in (Type (@{type_name ptr}, [obj_typ]), ss) end\n | parse_typ ss = raise PARSEGRAPH (\"parse_typ: malformed\" :: ss)\n\nfun parse_lval (\"VarUpdate\" :: nm :: ss) = let\n val (_, ss) = parse_typ ss (* FIXME: check typ? *)\n in (nm, ss) end\n | parse_lval ss = raise PARSEGRAPH (\"parse_lval\" :: ss)\n\nfun parse_var ss = parse_lval (\"VarUpdate\" :: ss)\n\nval opers = Symtab.make [\n (\"Plus\", @{const_name \"plus\"}),\n (\"Minus\", @{const_name \"minus\"}),\n (\"Times\", @{const_name \"times\"}),\n (\"Modulus\", @{const_name \"modulo_class.modulo\"}),\n (\"DividedBy\", @{const_name \"divide_class.divide\"}),\n (\"BWAnd\", @{const_name \"bitAND\"}),\n (\"BWOr\", @{const_name \"bitOR\"}),\n (\"BWXOR\", @{const_name \"bitXOR\"}),\n (\"And\", @{const_name \"conj\"}),\n (\"Or\", @{const_name \"disj\"}),\n (\"Implies\", @{const_name \"implies\"}),\n (\"Equals\", @{const_name \"HOL.eq\"}),\n (\"Less\", @{const_name \"less\"}),\n (\"LessEquals\", @{const_name \"less_eq\"}),\n (\"SignedLess\", @{const_name \"word_sless\"}),\n (\"SignedLessEquals\", @{const_name \"word_sle\"}),\n (\"Not\", @{const_name \"Not\"}),\n (\"BWNot\", @{const_name \"bitNOT\"}),\n (\"WordCast\", @{const_name \"ucast\"}),\n (\"WordCastSigned\", @{const_name \"scast\"}),\n (\"WordArrayAccess\", @{const_name \"fun_app\"}),\n (\"WordArrayUpdate\", @{const_name \"fun_upd\"}),\n (\"CountLeadingZeroes\", @{const_name \"bv_clz\"}),\n (\"CountTrailingZeroes\", @{const_name \"bv_ctz\"}),\n (\"True\", @{const_name \"True\"}),\n (\"False\", @{const_name \"False\"}),\n (\"IfThenElse\", @{const_name \"If\"}),\n (\"MemAcc\", @{const_name \"mem_acc\"}),\n (\"MemUpdate\", @{const_name \"mem_upd\"}),\n (\"MemDom\", @{const_name \"Set.member\"}),\n (\"ShiftLeft\", @{const_name \"bvshl\"}),\n (\"ShiftRight\", @{const_name \"bvlshr\"}),\n (\"SignedShiftRight\", @{const_name \"bvashr\"}),\n (\"PValid\", @{const_name pvalid}),\n (\"PArrayValid\", @{const_name parray_valid}),\n (\"PAlignValid\", @{const_name palign_valid}),\n (\"PGlobalValid\", @{const_name pglobal_valid}),\n (\"PWeakValid\", @{const_name pweak_valid}),\n (\"HTDUpdate\", @{const_name all_htd_updates})\n ]\n\nfun mk_acc nm typ st = (case typ of\n @{typ word8} => @{term var_word8}\n | @{typ word16} => @{term var_word16}\n | @{typ word32} => @{term var_word32}\n | @{typ word64} => @{term var_word64}\n | @{typ \"machine_word \\ word8\"} => @{term var_mem}\n | @{typ \"machine_word set\"} => @{term var_dom}\n | @{typ \"ghost_assertions\"} => @{term var_ghoststate}\n | @{typ \"heap_typ_desc\"} => @{term var_htd}\n | @{typ \"nat\"} => @{term var_ms}\n | @{typ bool} => @{term var_bool}\n | Type (@{type_name ptr}, [_]) =>\n (case @{typ \"machine_word\"} of\n @{typ word32} => @{term var_word32}\n | @{typ word64} => @{term var_word64})\n | _ => raise PARSEGRAPH [\"mk_acc\", nm, fst (dest_Type typ)])\n $ HOLogic.mk_string nm $ st\n\nfun parse_val (\"Num\" :: ss) = let\n val (n, ss) = case ss of n :: ss => (n, ss)\n | [] => raise PARSEGRAPH [\"parse_val: parsing num, no numeral\"]\n val (typ, ss) = parse_typ ss\n val n = parse_int n\n in (HOLogic.mk_number typ n, ss) end\n | parse_val (\"Op\" :: nm :: ss) = let\n val const = case Symtab.lookup opers nm\n of SOME c => c\n | NONE => raise PARSEGRAPH [\"parse_val: unexpected op\", nm]\n val (typ, ss) = parse_typ ss\n val (args, ss) = parse_n parse_val ss\n val oper = Const (const, map fastype_of args ---> typ)\n in trace (\"parsed oper \" ^ nm ^ \" and args\");\n (list_comb (oper, args), ss) end\n | parse_val (\"Var\" :: nm :: ss) = let\n val (typ, ss) = parse_typ ss\n in (mk_acc nm typ s, ss) end\n | parse_val (\"Type\" :: ss) = let\n val (typ, ss) = parse_typ ss\n in (Logic.mk_type typ, ss) end\n | parse_val (\"Symbol\" :: nm :: ss) = let\n val (_, ss) = parse_typ ss\n in (TermsTypes.symbol_table $ HOLogic.mk_string nm, ss) end\n | parse_val ss = raise PARSEGRAPH (\"parse_val: malformed\" :: ss)\n\nval parse_lvals = parse_n parse_lval\n\nval parse_vars = parse_n parse_var\n\nfun mk_var_typ T = (case T of\n @{typ word8} => @{term VarWord8}\n | @{typ word16} => @{term VarWord16}\n | @{typ word32} => @{term VarWord32}\n | @{typ word64} => @{term VarWord64}\n | Type (@{type_name word}, [Type (@{type_name signed}, [T2])])\n => let val uT = Type (@{type_name word}, [T2])\n in Abs (\"t\", T, mk_var_typ uT $ (Const (@{const_name ucast}, T --> uT) $ Bound 0)) end\n | @{typ \"machine_word \\ word8\"} => @{term VarMem}\n | @{typ \"ghost_assertions\"} => @{term VarGhostState}\n | @{typ \"machine_word set\"} => @{term VarDom}\n | @{typ \"heap_typ_desc\"} => @{term VarHTD}\n | @{typ \"unit \\ nat\"} => @{term VarMS}\n | @{typ bool} => @{term VarBool}\n | _ => raise TYPE (\"mk_var_typ: unexpected var typ\", [T], []))\n\nfun mk_var_term t = betapply (mk_var_typ (fastype_of t), t)\n\nfun parse_val_acc ss = let\n val (t, ss) = parse_val ss\n in (Term.lambda_name (\"s\", s) (mk_var_term t), ss) end\n\nfun parse_cond ss = let\n val (t, ss) = parse_val ss\n in (Term.lambda_name (\"s\", s) t, ss) end\n\nval parse_vals = parse_n parse_val_acc\n\nfun mk_NextNode n = @{term NextNode} $ HOLogic.mk_number @{typ nat} n\n\nfun parse_nn \"Err\" = @{term Err}\n | parse_nn \"Ret\" = @{term Ret}\n | parse_nn n = mk_NextNode (parse_int n)\n\nfun parse_fun_decl (\"Function\" :: nm :: ss) = let\n val (xs, ss) = parse_vars ss\n val (ys, ss) = parse_vars ss\n in\n ss = [] orelse raise PARSEGRAPH (\"parse_fun_decl: trailing\" :: ss);\n (nm, xs, ys)\n end\n | parse_fun_decl ss = raise PARSEGRAPH (\"parse_fun_decl: malformed\" :: ss)\n\nfun parse_var_and_val_acc ss = let\n val (var, ss) = parse_var ss\n val (v, ss) = parse_val_acc ss\n in (HOLogic.mk_prod (HOLogic.mk_string var, v), ss) end\n\nval mk_stringlist = map HOLogic.mk_string #> HOLogic.mk_list @{typ string}\n\nfun parse_node (n :: ss) = let\n val n = parse_int n\n val (t, ss) = case ss of\n \"Cond\" :: l :: r :: ss => let\n val l = parse_nn l\n val r = parse_nn r\n val (c, ss) = parse_cond ss\n in (@{term Cond} $ l $ r $ c, ss) end\n | \"Basic\" :: c :: ss => let\n val c = parse_nn c\n val (upds, ss) = parse_n parse_var_and_val_acc ss\n in (@{term Basic} $ c $ HOLogic.mk_list\n @{typ \"string \\ (state \\ variable)\"} upds, ss) end\n | \"Call\" :: c :: fname :: ss => let\n val c = parse_nn c\n val (args, ss) = parse_vals ss\n val (rets, ss) = parse_vars ss\n in (@{term Call} $ c $ HOLogic.mk_string fname\n $ HOLogic.mk_list @{typ \"state \\ variable\"} args\n $ mk_stringlist rets, ss) end\n | _ => raise PARSEGRAPH (\"parse_node: malformed\" :: ss)\n in\n ss = [] orelse raise PARSEGRAPH (\"parse_node: trailing\" :: ss);\n (n, t)\n end\n | parse_node [] = raise PARSEGRAPH ([\"parse_node: empty\"])\n\nfun parse_fun ([\"Function\" :: ss]) = let\n val (nm, xs, ys) = parse_fun_decl (\"Function\" :: ss)\n in SOME (nm, (xs, ys, NONE)) end\n | parse_fun ((\"Function\" :: ss) :: sss) = let\n val (nm, xs, ys) = parse_fun_decl (\"Function\" :: ss)\n val _ = tracing (\"Parsing \" ^ nm)\n val (node_sss, sss) = chop_prefix\n (fn ss => not (is_prefix (op =) [\"EntryPoint\"] ss)) sss\n val (ep, _) = case sss of (ep :: sss) => (ep, sss)\n | [] => raise PARSEGRAPH [\n \"parse_fun: EntryPoint not found\"]\n val ep = case ep of [_, n] => parse_int n\n | _ => raise PARSEGRAPH (\n \"parse_fun: EntryPoint line malformed\" :: ep)\n in\n SOME (nm, (xs, ys, SOME (ep, map parse_node node_sss,\n Abs (\"g\", @{typ \"nat \\ node option\"}, @{term GraphFunction}\n $ mk_stringlist xs $ mk_stringlist ys\n $ Bound 0 $ HOLogic.mk_number @{typ nat} ep))))\n end\n | parse_fun [] = raise PARSEGRAPH [\"parse_fun: empty\"]\n | parse_fun (ss :: _) = (warning (\"parse_fun: ignoring: \"\n ^ space_implode \" \" ss); NONE)\n\nfun fun_groups gp ((fs as (\"Function\" :: _)) :: sss) =\n (if null gp then [] else [rev gp]) @ fun_groups [fs] sss\n | fun_groups gp ([] :: sss) = fun_groups gp sss\n | fun_groups gp (ss :: sss) = fun_groups (ss :: gp) sss\n | fun_groups gp [] = [rev gp]\n\nfun filename_relative thy name =\n Path.append (Resources.master_directory thy) (Path.explode name)\n |> File.standard_path\n\nfun mkdir_relative thy name =\n Path.append (Resources.master_directory thy) (Path.explode name)\n |> Isabelle_System.mkdirs\n\nfun openIn_relative thy = filename_relative thy #> TextIO.openIn\n\nfun get_funs thy file = let\n val f = openIn_relative thy file\n fun get () = case TextIO.inputLine f\n of NONE => []\n | SOME s => unsuffix \"\\n\" s :: get ()\n val lines = get ()\n |> map (Library.space_explode \" \" #> filter (fn s => s <> \"\"))\n |> filter_out null\n |> filter_out (fn (s :: _) => String.isPrefix \"#\" s | _ => false)\n in fun_groups [] lines end\n\ntype funs = (string list * string list * (int * (int * term) list * term) option) Symtab.table\n\nfun funs thy file : funs = get_funs thy file\n |> map_filter parse_fun\n |> Symtab.make\n\nfun define_graph s nodes = let\n val nodes = sort (int_ord o apply2 fst) nodes\n in StaticFun.define_tree_and_save_thms (Binding.name s)\n (map (fst #> Int.toString #> prefix (s ^ \"_\")) nodes)\n (map (apfst (HOLogic.mk_number @{typ nat})) nodes)\n @{term \"id :: nat => nat\"} []\n end\n\nfun define_graph_fun (funs : funs) b1 b2 nm ctxt =\n case (Symtab.lookup funs nm) of\n SOME (_, _, SOME (_, g, gf))\n => let\n val (graph_term, ctxt) = define_graph b1 g ctxt\n val (_, ctxt) = Local_Theory.define ((b2, NoSyn), ((Thm.def_binding b2, []),\n betapply (gf, graph_term))) ctxt\n in ctxt end\n | _ => error (\"define_graph_fun: \" ^ nm ^ \" not in funs\")\n\nend\n\n\\\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/asmrefine/GraphLang.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891307678321, "lm_q2_score": 0.44552953503957277, "lm_q1q2_score": 0.2623675006208504}} {"text": "\ntheory localesDef imports cache\nbegin\n\nlocale pRule0VsPInv0=\n fixes paraRule ::\" rule\" and paraInv::\"formula \"\n assumes\n\n b:\"\n invHoldForRule' s (paraInv) (paraRule ) (invariants N) \" \nbegin\ntheorem pRule0VsPInv0:\n\n shows \"invHoldForRule' s (paraInv) (paraRule ) (invariants N) \" \n by(cut_tac a1 b,auto)\nend\n\n\nlocale pRule0VspInv1=\n fixes paraRule ::\"rule\" and paraInv::\"nat\\formula \" \n and iInv1::\"nat\" and N::\"nat\"\n assumes \n b:\"invHoldForRule' s (paraInv iInv1) (paraRule) invariants \" \nbegin\ntheorem pRule10VspInv1:\n assumes a1:\"iInv1 \\ N\" \n\n\n shows \"invHoldForRule' s (paraInv iInv1) (paraRule ) invariants \" \n by(cut_tac a1 b,auto)\nend\n\n\n\nlocale pRule0VsPInv2=\n fixes paraRule ::\" rule\" and paraInv::\"nat\\nat\\formula \" and iInv1::\"nat\" and iInv2::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n assumes \n\n b:\" invHoldForRule' s (paraInv iInv1 iInv2) (paraRule) invariants \" \nbegin\ntheorem pRule0VsPInv2:\n assumes a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \"\n and a4:\"iInv1 \\ iInv2\" \n\n\n shows \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule ) invariants \" \n \n by(cut_tac a1 b,auto)\nend\n\nlocale pRule0VsPInv3=\n fixes paraRule ::\" rule\" and paraInv::\"nat\\nat\\nat\\formula \" and iInv1::\"nat\" and iInv2::\"nat\" \n and iInv3::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n assumes a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \" and a4:\"iInv3 \\ N \"\n and a5:\"iInv1 \\ iInv2\" and a6:\"iInv1 \\ iInv3\" and a7:\"iInv2 \\ iInv3\" and\n\n b:\" invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule) invariants \" \nbegin\ntheorem pRule0VsPInv2:\n\n\n shows \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule ) invariants \" \n \n by(cut_tac b,auto)\nend\n\n\nlocale pRule1VsPInv0=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"formula \" \n and iRule1::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n assumes\n b:\"\n invHoldForRule' s (paraInv) (paraRule iRule1) invariants \" \nbegin\ntheorem pRule1VsPInv0:\n assumes\n a1:\"iRule1 \\ N \"\n\n shows \"invHoldForRule' s (paraInv) (paraRule iRule1 ) invariants \" \n (is \"?P paraInv paraRule iRule1 invs\")\n by(cut_tac a1 b,auto)\nend\n \n\n\nlocale pRule1VspInv1=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"nat \\ formula \" \n and iRule::\"nat\" and iInv1::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n assumes \n \n b:\" iRule = iInv1 \\ \n (invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\" and \n c:\" iRule \\ iInv1 \\ \n (invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\" \nbegin\ntheorem pRule1VspInv1:\n assumes\n a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \"\n shows \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\"\n (is \"?P paraInv iInv1 paraRule iRule invariants\")\n proof -\n have e2:\"iRule=iInv1 \\ iRule \\ iInv1 \" by auto\n \n \n moreover\n {assume e3:\" iRule=iInv1 \"\n \n have \"?P paraInv iInv1 paraRule iRule invariants\"\n by (metis a1 a2 b e3)\n } \n moreover\n {assume e3:\"iRule\\iInv1 \"\n have \"?P paraInv iInv1 paraRule iRule invariants \"\n by (metis a1 a2 c e3)\n }\n ultimately show \"?P paraInv iInv1 paraRule iRule invariants \"\n by blast\n qed\nend\n \n locale pRule1VspInv2=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"nat \\ nat\\formula \" \n and iRule::\"nat\" and iInv1::\"nat\" and iInv2::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n \n assumes\n b:\"iRule \\ N\\ iInv1 \\ N \\iInv2 \\ N\\iInv1 \\ iInv2 \\ iRule = iInv1\\\n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants \" and \n c:\"iRule \\ N\\ iInv1 \\ N \\iInv2 \\ N\\iInv1 \\ iInv2 \\iRule = iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants\" and\n d:\"iRule \\ N\\ iInv1 \\ N \\iInv2 \\ N\\iInv1 \\ iInv2 \\iRule \\ iInv1 \\iRule \\ iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants\"\nbegin\ntheorem pRule1VspInv2:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \"and a4:\"iInv1 \\ iInv2\" \n \n shows \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants \" (is \"?P paraInv iInv paraRule iRule invs\")\n proof -\n have d2:\"iRule=iInv1 \\ iRule=iInv2 \\ ((iRule \\ iInv1) \\ (iRule\\iInv2))\" by auto\n moreover\n {assume e1:\"iRule=iInv1\"\n have \"?P paraInv iInv paraRule iRule invs \"\n by (metis a2 a3 a4 b e1)\n \n \n } \n \n moreover\n {assume e1:\"iRule = iInv2\" \n have \"?P paraInv iInv paraRule iRule invs\"\n by (metis a2 a3 a4 c e1)\n }\n \n \n moreover\n {assume e1:\"iRule\\iInv1 \\ iRule\\iInv2\"\n have \"?P paraInv iInv paraRule iRule invs\"\n by (metis a1 a2 a3 a4 d e1)\n \n }\n ultimately show \"?P paraInv iInv paraRule iRule invs\"\n by blast\n qed\nend\n\n\nlocale pRule1VspInv3=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"nat \\ nat\\nat\\formula \" \n and iRule::\"nat\" and iInv1::\"nat\" and iInv2::\"nat\" and iInv3::\"nat\" and N::\"nat\" and invariants::\"formula set\" \n assumes \n b:\"iRule = iInv1 \\ \n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \" and \n c:\" iRule = iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants\" and\n d:\" iRule = iInv3 \\\n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants\" and\n \n e:\" iRule \\ iInv1 \\iRule \\ iInv2 \\ iRule \\ iInv3 \\\n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants\"\nbegin\ntheorem pRule1VspInv3:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \" and a4:\"iInv3 \\ N \"\n and a5:\"iInv1 \\ iInv2\" and a6:\"iInv1 \\ iInv3\" and a7:\"iInv2 \\ iInv3\"\n shows \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \" \n proof -\n have d2:\"iRule=iInv1 \\ iRule=iInv2 \\ iRule=iInv3 \\ ((iRule \\ iInv1) \\ (iRule\\iInv2) \\ iRule \\ iInv3 )\" by auto\n moreover\n {assume e1:\"iRule=iInv1\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \" \n by (cut_tac b e1, auto)\n \n \n } \n moreover\n {assume e1:\"iRule = iInv2\" \n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \" \n by (cut_tac c e1,auto)\n }\n \n \n moreover\n {assume e1:\"iRule = iInv3\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \" \n by (cut_tac d e1,auto)\n \n }\n \n moreover\n {assume e1:\"iRule\\iInv1 \\ iRule\\iInv2 \\ iRule\\iInv3\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \"\n by (metis e e1) \n \n }\n ultimately show \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule) invariants \"\n by blast\n qed\nend\n\n\n\nlocale paraRuleInstValidateExLessInvInst=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"nat \\ formula \" \n and iRule::\"nat\" and iInv1::\"nat\" and N::\"nat\"\n assumes \n b:\"iRule \\ N \\iInv1 \\ N\\ iRule = iInv1 \\ \n (invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\" and \n c:\"iRule \\ N \\iInv1 \\ N\\ iRule \\ iInv1 \\ \n (invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\" \nbegin\ntheorem paraRuleInstValidateExLessInvInst:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \"\n shows \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule) invariants )\"\n (is \"?P paraInv iInv1 paraRule iRule invariants\")\n proof -\n have e2:\"iRule=iInv1 \\ iRule \\ iInv1 \" by auto\n \n \n moreover\n {assume e3:\" iRule=iInv1 \"\n \n have \"?P paraInv iInv1 paraRule iRule invariants\"\n by (metis a1 a2 b e3)\n } \n moreover\n {assume e3:\"iRule\\iInv1 \"\n have \"?P paraInv iInv1 paraRule iRule invariants \"\n by (metis a1 a2 c e3)\n }\n ultimately show \"?P paraInv iInv1 paraRule iRule invariants \"\n by blast\n qed\nend\n \n \nlocale paraRuleInstValidateExTwoLessInvInst=\n fixes paraRule ::\"nat \\ rule\" and paraInv::\"nat \\ nat\\formula \" \n and iRule::\"nat\" and iInv1::\"nat\" and iInv2::\"nat\" and N::\"nat\"\n assumes \n b:\"iInv1 \\ iInv2\\iRule \\ N \\iInv1 \\ N\\iInv2 \\ N\\iRule = iInv1 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants \" and \n c:\"iInv1 \\ iInv2\\iRule \\ N \\iInv1 \\ N\\iInv2 \\ N\\iRule = iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants\" and\n d:\"iInv1 \\ iInv2\\iRule \\ N \\iInv1 \\ N\\iInv2 \\ N\\iRule \\ iInv1 \\iRule \\ iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants\"\nbegin\ntheorem paraRuleInstValidateExTwoLessInvInst:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \"\n and a4:\"iInv1 \\ iInv2\"\n shows \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule) invariants \" (is \"?P paraInv iInv paraRule iRule invs\")\n proof -\n have d2:\"iRule=iInv1 \\ iRule=iInv2 \\ ((iRule \\ iInv1) \\ (iRule\\iInv2))\" by auto\n moreover\n {assume e1:\"iRule=iInv1\"\n have \"?P paraInv iInv paraRule iRule invs \"\n by (metis a2 a3 a4 b e1)\n \n \n } \n moreover\n {assume e1:\"iRule = iInv2\" \n have \"?P paraInv iInv paraRule iRule invs\"\n by (metis a2 a3 a4 c e1)\n }\n \n \n moreover\n {assume e1:\"iRule\\iInv1 \\ iRule\\iInv2\"\n have \"?P paraInv iInv paraRule iRule invs\"\n by (metis a1 a2 a3 a4 d e1)\n \n }\n ultimately show \"?P paraInv iInv paraRule iRule invs\"\n by blast\n qed\nend\n\n\n\nlocale pRule2VsPInv0=\n fixes paraRule ::\"nat \\ nat\\ rule\" and paraInv::\"formula \" \n and iRule1::\"nat\" and iRule2::\"nat\" and N::\"nat\"\n assumes\n\n b:\"\n invHoldForRule' s (paraInv) (paraRule iRule1 iRule2) invariants \" \nbegin\ntheorem pRule12sPInv0:\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\N\"\n\n shows \"invHoldForRule' s (paraInv) (paraRule iRule1 iRule2) invariants \" \n \n by(cut_tac a1 a2 b,auto)\nend\n \n\n\nlocale pRule2VspInv1=\n fixes paraRule ::\"nat \\nat\\ rule\" and paraInv::\"nat \\ formula \" \n and iRule1::\"nat\" and iRule2::\"nat\" and iInv1::\"nat\" and N::\"nat\"\n assumes \n b:\" iRule1 = iInv1 \\ \n (invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" and \n c:\" iRule2= iInv1 \\\n (invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" and \n d:\" iRule1\\ iInv1 \\iRule2\\ iInv1 \\\n (invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \nbegin\ntheorem pRule2VspInv1:\n assumes a1:\"iRule1 \\ N\" and a2:\" iRule2 \\ N \" and a3:\" iInv1 \\ N \"\n shows \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \n proof -\n have e2:\"iRule1=iInv1 \\ iRule2 = iInv1 \\ (iRule1\\ iInv1 \\ iRule2\\ iInv1) \" by auto\n \n \n moreover\n {assume e3:\" iRule1=iInv1 \"\n \n have \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \n by (cut_tac b e3,auto )\n } \n moreover\n {assume e3:\" iRule2=iInv1 \"\n \n have \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \n by (cut_tac c e3,auto )\n }\n moreover\n {assume e3:\" (iRule1\\ iInv1 \\ iRule2\\ iInv1) \"\n \n have \"(invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \n by (cut_tac d e3,auto )\n }\n ultimately show\"(invHoldForRule' s (paraInv iInv1) (paraRule iRule1 iRule2) invariants )\" \n by blast\n qed\nend\n \n\nlocale pRule2VsPInv2=\n fixes paraRule ::\"nat \\ nat\\rule\" and paraInv::\"nat \\ nat\\formula \" \n and iRule1::\"nat\" and iRule2::\"nat\" and iInv1::\"nat\" and iInv2::\"nat\" and N::\"nat\" and invariants::\"formula set\"\n assumes\n b:\"iRule1 = iInv1 \\ iRule2 = iInv2\\\n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \" and \n c:\"iRule1 = iInv1 \\ iRule2 \\ iInv2\\\n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \" and\n d:\"iRule1 = iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants\" and\n e:\"iRule1 \\ iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants\" \nbegin\ntheorem pRule1VspInv2:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \"\n and a4:\"iInv1 \\ iInv2\"\n shows \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n proof -\n have d2:\"(iRule1 = iInv1 \\ iRule2 = iInv2)\\ (iRule1 = iInv1 \\ iRule2 \\ iInv2) \\ iRule1=iInv2 \\ ( (iRule1\\iInv2))\" by auto\n moreover\n {assume e1:\"iRule1=iInv1 \\ iRule2 = iInv2\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n by (cut_tac b e1,auto)\n \n \n } \n moreover\n {assume e1:\"iRule1 = iInv1 \\ iRule2 \\ iInv2\" \n have \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n by (metis a2 a3 a4 c e1)\n }\n \n \n moreover\n {assume e1: \"iRule1=iInv2 \"\n have \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n by (metis d e1)\n \n }\n moreover\n {assume e1: \"iRule1\\iInv2 \"\n have \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n by (metis e e1)\n \n }\n ultimately show \"invHoldForRule' s (paraInv iInv1 iInv2) (paraRule iRule1 iRule2) invariants \"\n by blast\n qed\nend\n\n\nlocale pRule2VspInv3=\n fixes paraRule ::\"nat \\ nat\\rule\" and paraInv::\"nat \\ nat\\nat\\formula \" \n and iRule1::\"nat\" and iRule2::\"nat\" and iInv1::\"nat\" and iInv2::\"nat\" and iInv3::\"nat\" and N::\"nat\"\n and invariants::\"formula set\"\n assumes \n b:\"iRule1 = iInv1 \\ \n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \" and \n c:\" iRule1 = iInv2 \\ \n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2 ) invariants\" and\n d:\" iRule1 = iInv3 \\\n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants\" and\n \n e:\" iRule1 \\ iInv1 \\iRule1 \\ iInv2 \\ iRule1 \\ iInv3 \\\n invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants\"\nbegin\ntheorem pRule1VspInv3:\n assumes a1:\"iRule \\ N\" and a2:\" iInv1 \\ N \" and a3:\"iInv2 \\ N \" and a4:\"iInv3 \\ N \"\n and a5:\"iInv1 \\ iInv2\" and a6:\"iInv1 \\ iInv3\" and a7:\"iInv2 \\ iInv3\"\n shows \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \" \n proof -\n have d2:\"iRule1=iInv1 \\ iRule1=iInv2 \\ iRule1=iInv3 \\ ((iRule1 \\ iInv1) \\ (iRule1\\iInv2) \\ iRule1 \\ iInv3 )\" by auto\n moreover\n {assume e1:\"iRule1=iInv1\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \"\n by (cut_tac b e1, auto)\n \n \n } \n moreover\n {assume e1:\"iRule1 = iInv2\" \n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \"\n by (cut_tac c e1,auto)\n }\n \n \n moreover\n {assume e1:\"iRule1=iInv3\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \" \n by (cut_tac d e1,auto)\n \n }\n \n moreover\n {assume e1:\"iRule1\\iInv1 \\ iRule1\\iInv2 \\ iRule1\\iInv3\"\n have \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \" \n by (cut_tac e e1,auto)\n \n }\n ultimately show \"invHoldForRule' s (paraInv iInv1 iInv2 iInv3) (paraRule iRule1 iRule2) invariants \" \n by blast\n qed\nend\n\n\nlocale iniImplyInv0= \n fixes paraInv ::\" formula\" and specOnAVar::\"formula\" and specOnAVars::\"formula list\"\n assumes a:\" formEval specOnAVar s \\formEval ( paraInv ) s\" and\n b:\"specOnAVar \\set specOnAVars\"\nbegin \ntheorem iniImplyInv: \n assumes a1:\"ex0P N ( invariant = paraInv )\" and \n a2:\"formEval (andList specOnAVars) s\" \n shows \"formEval invariant s \" \nproof - \n \n \n have b2:\"formEval specOnAVar s\" \n by (metis a2 andList1 b)\n \n \n \n then show b5:\"formEval ( invariant ) s\" \n \n apply - \n apply(cut_tac a1 a2 a)\n by (metis (poly_guards_query) a ex0P_def)\n \n \nqed \nend \n \nlocale iniImplyInv1= \n fixes paraInv ::\" nat \\ formula\" and N::\"nat\" and specOnAVar::\"formula\" and specOnAVars::\"formula list\"\n assumes a:\"\\i . i\\N \\ formEval specOnAVar s \\formEval ( paraInv i ) s\" and\n b:\"specOnAVar \\set specOnAVars\"\nbegin \ntheorem iniImplyInv: \n assumes a1: \" ex1P N (%i. invariant = paraInv i )\" \n and a2:\"formEval (andList specOnAVars) s\" \n shows \"formEval invariant s \" \nproof - \n from a1 obtain i j where b1:\"i \\ N \\ invariant =paraInv i\" \n apply - \n apply(simp add:ex1P_def) \n apply auto \n done \n \n have b2:\"formEval specOnAVar s\" \n by (metis a2 andList1 b)\n \n \n \n then have b5:\"formEval ( paraInv i) s\" \n \n apply - \n apply(cut_tac a1 b2 a)\n by (metis b1 local.a) \n \n \n then show \"formEval invariant s \"\n by (metis b1) \n \nqed \nend \n \nlocale iniImplyInv2= \n fixes paraInv ::\" nat \\nat \\ formula\" and N::\"nat\" and specOnAVar::\"formula\" and specOnAVars::\"formula list\"\n assumes a:\"\\i j. i\\N \\ j\\N \\ formEval specOnAVar s \\formEval ( paraInv i j) s\" and\n b:\"specOnAVar \\set specOnAVars\"\nbegin \ntheorem iniImplyInv: \n assumes a1: \" ex2P N (%i j. invariant = paraInv i j)\" \n and a2:\"formEval (andList specOnAVars) s\" \n shows \"formEval invariant s \" \nproof - \n from a1 obtain i j where b1:\"i \\ N \\ j\\N \\ invariant =paraInv i j\" \n apply - \n apply(simp add:ex2P_def) \n apply auto \n done \n \n have b2:\"formEval specOnAVar s\" \n by (metis a2 andList1 b)\n \n \n \n then have b5:\"formEval ( paraInv i j) s\" \n \n apply - \n apply(cut_tac a1 b2 a)\n by (metis b1 local.a) \n \n \n then show \"formEval invariant s \"\n by (metis b1) \n \nqed \nend \n\n\nlocale iniImplyInv3= \n fixes paraInv ::\" nat \\nat \\ nat\\formula\" and N::\"nat\" and specOnAVar::\"formula\" and specOnAVars::\"formula list\"\n assumes a:\"\\i j k. i\\N \\ j\\N \\ k \\N \\ formEval specOnAVar s \\formEval ( paraInv i j k) s\" and\n b:\"specOnAVar \\set specOnAVars\"\nbegin \ntheorem iniImplyInv: \n assumes a1: \" ex3P N (%i j k. invariant = paraInv i j k)\" \n and a2:\"formEval (andList specOnAVars) s\" \n shows \"formEval invariant s \" \nproof - \n from a1 obtain i j k where b1:\"i \\ N \\ j\\N \\ k \\N \\ invariant =paraInv i j k\" \n apply - \n apply(simp add:ex3P_def) \n apply auto \n done \n \n have b2:\"formEval specOnAVar s\" \n by (metis a2 andList1 b)\n \n \n \n then have b5:\"formEval ( paraInv i j k) s\" \n \n apply - \n apply(cut_tac a1 b2 a)\n by (metis b1 local.a) \n \n \n then show \"formEval invariant s \"\n by (metis b1) \n \nqed \nend \n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/localesDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.26224946369766605}} {"text": "(* Title: HOL/Library/Old_SMT.thy\n Author: Sascha Boehme, TU Muenchen\n*)\n\nsection \\Old Version of Bindings to Satisfiability Modulo Theories (SMT) solvers\\\n\ntheory Old_SMT\nimports \"../Real\" \"../Word/Word\"\nkeywords \"old_smt_status\" :: diag\nbegin\n\nML_file \"Old_SMT/old_smt_utils.ML\"\nML_file \"Old_SMT/old_smt_failure.ML\"\nML_file \"Old_SMT/old_smt_config.ML\"\n\n\nsubsection \\Triggers for quantifier instantiation\\\n\ntext \\\nSome SMT solvers support patterns as a quantifier instantiation\nheuristics. Patterns may either be positive terms (tagged by \"pat\")\ntriggering quantifier instantiations -- when the solver finds a\nterm matching a positive pattern, it instantiates the corresponding\nquantifier accordingly -- or negative terms (tagged by \"nopat\")\ninhibiting quantifier instantiations. A list of patterns\nof the same kind is called a multipattern, and all patterns in a\nmultipattern are considered conjunctively for quantifier instantiation.\nA list of multipatterns is called a trigger, and their multipatterns\nact disjunctively during quantifier instantiation. Each multipattern\nshould mention at least all quantified variables of the preceding\nquantifier block.\n\\\n\ntypedecl pattern\n\nconsts\n pat :: \"'a \\ pattern\"\n nopat :: \"'a \\ pattern\"\n\ndefinition trigger :: \"pattern list list \\ bool \\ bool\" where \"trigger _ P = P\"\n\n\nsubsection \\Quantifier weights\\\n\ntext \\\nWeight annotations to quantifiers influence the priority of quantifier\ninstantiations. They should be handled with care for solvers, which support\nthem, because incorrect choices of weights might render a problem unsolvable.\n\\\n\ndefinition weight :: \"int \\ bool \\ bool\" where \"weight _ P = P\"\n\ntext \\\nWeights must be non-negative. The value \\0\\ is equivalent to providing\nno weight at all.\n\nWeights should only be used at quantifiers and only inside triggers (if the\nquantifier has triggers). Valid usages of weights are as follows:\n\n\\begin{itemize}\n\\item\n@{term \"\\x. trigger [[pat (P x)]] (weight 2 (P x))\"}\n\\item\n@{term \"\\x. weight 3 (P x)\"}\n\\end{itemize}\n\\\n\n\nsubsection \\Higher-order encoding\\\n\ntext \\\nApplication is made explicit for constants occurring with varying\nnumbers of arguments. This is achieved by the introduction of the\nfollowing constant.\n\\\n\ndefinition fun_app where \"fun_app f = f\"\n\ntext \\\nSome solvers support a theory of arrays which can be used to encode\nhigher-order functions. The following set of lemmas specifies the\nproperties of such (extensional) arrays.\n\\\n\nlemmas array_rules = ext fun_upd_apply fun_upd_same fun_upd_other\n fun_upd_upd fun_app_def\n\n\nsubsection \\First-order logic\\\n\ntext \\\nSome SMT solvers only accept problems in first-order logic, i.e.,\nwhere formulas and terms are syntactically separated. When\ntranslating higher-order into first-order problems, all\nuninterpreted constants (those not built-in in the target solver)\nare treated as function symbols in the first-order sense. Their\noccurrences as head symbols in atoms (i.e., as predicate symbols) are\nturned into terms by logically equating such atoms with @{term True}.\nFor technical reasons, @{term True} and @{term False} occurring inside\nterms are replaced by the following constants.\n\\\n\ndefinition term_true where \"term_true = True\"\ndefinition term_false where \"term_false = False\"\n\n\nsubsection \\Integer division and modulo for Z3\\\n\ndefinition z3div :: \"int \\ int \\ int\" where\n \"z3div k l = (if 0 \\ l then k div l else -(k div (-l)))\"\n\ndefinition z3mod :: \"int \\ int \\ int\" where\n \"z3mod k l = (if 0 \\ l then k mod l else k mod (-l))\"\n\n\nsubsection \\Setup\\\n\nML_file \"Old_SMT/old_smt_builtin.ML\"\nML_file \"Old_SMT/old_smt_datatypes.ML\"\nML_file \"Old_SMT/old_smt_normalize.ML\"\nML_file \"Old_SMT/old_smt_translate.ML\"\nML_file \"Old_SMT/old_smt_solver.ML\"\nML_file \"Old_SMT/old_smtlib_interface.ML\"\nML_file \"Old_SMT/old_z3_interface.ML\"\nML_file \"Old_SMT/old_z3_proof_parser.ML\"\nML_file \"Old_SMT/old_z3_proof_tools.ML\"\nML_file \"Old_SMT/old_z3_proof_literals.ML\"\nML_file \"Old_SMT/old_z3_proof_methods.ML\"\nnamed_theorems old_z3_simp \"simplification rules for Z3 proof reconstruction\"\nML_file \"Old_SMT/old_z3_proof_reconstruction.ML\"\nML_file \"Old_SMT/old_z3_model.ML\"\nML_file \"Old_SMT/old_smt_setup_solvers.ML\"\n\nsetup \\\n Old_SMT_Config.setup #>\n Old_SMT_Normalize.setup #>\n Old_SMTLIB_Interface.setup #>\n Old_Z3_Interface.setup #>\n Old_SMT_Setup_Solvers.setup\n\\\n\nmethod_setup old_smt = \\\n Scan.optional Attrib.thms [] >>\n (fn thms => fn ctxt =>\n (legacy_feature \"Proof method \\\"old_smt\\\" will be discontinued soon -- use \\\"smt\\\" instead\";\n METHOD (fn facts => HEADGOAL (Old_SMT_Solver.smt_tac ctxt (thms @ facts)))))\n\\ \"apply an SMT solver to the current goal\"\n\n\nsubsection \\Configuration\\\n\ntext \\\nThe current configuration can be printed by the command\n\\old_smt_status\\, which shows the values of most options.\n\\\n\n\n\nsubsection \\General configuration options\\\n\ntext \\\nThe option \\old_smt_solver\\ can be used to change the target SMT\nsolver. The possible values can be obtained from the \\old_smt_status\\\ncommand.\n\nDue to licensing restrictions, Yices and Z3 are not installed/enabled\nby default. Z3 is free for non-commercial applications and can be enabled\nby setting the \\OLD_Z3_NON_COMMERCIAL\\ environment variable to\n\\yes\\.\n\\\n\ndeclare [[ old_smt_solver = z3 ]]\n\ntext \\\nSince SMT solvers are potentially non-terminating, there is a timeout\n(given in seconds) to restrict their runtime. A value greater than\n120 (seconds) is in most cases not advisable.\n\\\n\ndeclare [[ old_smt_timeout = 20 ]]\n\ntext \\\nSMT solvers apply randomized heuristics. In case a problem is not\nsolvable by an SMT solver, changing the following option might help.\n\\\n\ndeclare [[ old_smt_random_seed = 1 ]]\n\ntext \\\nIn general, the binding to SMT solvers runs as an oracle, i.e, the SMT\nsolvers are fully trusted without additional checks. The following\noption can cause the SMT solver to run in proof-producing mode, giving\na checkable certificate. This is currently only implemented for Z3.\n\\\n\ndeclare [[ old_smt_oracle = false ]]\n\ntext \\\nEach SMT solver provides several commandline options to tweak its\nbehaviour. They can be passed to the solver by setting the following\noptions.\n\\\n\ndeclare [[ old_cvc3_options = \"\" ]]\ndeclare [[ old_yices_options = \"\" ]]\ndeclare [[ old_z3_options = \"\" ]]\n\ntext \\\nEnable the following option to use built-in support for datatypes and\nrecords. Currently, this is only implemented for Z3 running in oracle\nmode.\n\\\n\ndeclare [[ old_smt_datatypes = false ]]\n\ntext \\\nThe SMT method provides an inference mechanism to detect simple triggers\nin quantified formulas, which might increase the number of problems\nsolvable by SMT solvers (note: triggers guide quantifier instantiations\nin the SMT solver). To turn it on, set the following option.\n\\\n\ndeclare [[ old_smt_infer_triggers = false ]]\n\ntext \\\nThe SMT method monomorphizes the given facts, that is, it tries to\ninstantiate all schematic type variables with fixed types occurring\nin the problem. This is a (possibly nonterminating) fixed-point\nconstruction whose cycles are limited by the following option.\n\\\n\ndeclare [[ monomorph_max_rounds = 5 ]]\n\ntext \\\nIn addition, the number of generated monomorphic instances is limited\nby the following option.\n\\\n\ndeclare [[ monomorph_max_new_instances = 500 ]]\n\n\n\nsubsection \\Certificates\\\n\ntext \\\nBy setting the option \\old_smt_certificates\\ to the name of a file,\nall following applications of an SMT solver a cached in that file.\nAny further application of the same SMT solver (using the very same\nconfiguration) re-uses the cached certificate instead of invoking the\nsolver. An empty string disables caching certificates.\n\nThe filename should be given as an explicit path. It is good\npractice to use the name of the current theory (with ending\n\\.certs\\ instead of \\.thy\\) as the certificates file.\nCertificate files should be used at most once in a certain theory context,\nto avoid race conditions with other concurrent accesses.\n\\\n\ndeclare [[ old_smt_certificates = \"\" ]]\n\ntext \\\nThe option \\old_smt_read_only_certificates\\ controls whether only\nstored certificates are should be used or invocation of an SMT solver\nis allowed. When set to \\true\\, no SMT solver will ever be\ninvoked and only the existing certificates found in the configured\ncache are used; when set to \\false\\ and there is no cached\ncertificate for some proposition, then the configured SMT solver is\ninvoked.\n\\\n\ndeclare [[ old_smt_read_only_certificates = false ]]\n\n\n\nsubsection \\Tracing\\\n\ntext \\\nThe SMT method, when applied, traces important information. To\nmake it entirely silent, set the following option to \\false\\.\n\\\n\ndeclare [[ old_smt_verbose = true ]]\n\ntext \\\nFor tracing the generated problem file given to the SMT solver as\nwell as the returned result of the solver, the option\n\\old_smt_trace\\ should be set to \\true\\.\n\\\n\ndeclare [[ old_smt_trace = false ]]\n\ntext \\\nFrom the set of assumptions given to the SMT solver, those assumptions\nused in the proof are traced when the following option is set to\n@{term true}. This only works for Z3 when it runs in non-oracle mode\n(see options \\old_smt_solver\\ and \\old_smt_oracle\\ above).\n\\\n\ndeclare [[ old_smt_trace_used_facts = false ]]\n\n\n\nsubsection \\Schematic rules for Z3 proof reconstruction\\\n\ntext \\\nSeveral prof rules of Z3 are not very well documented. There are two\nlemma groups which can turn failing Z3 proof reconstruction attempts\ninto succeeding ones: the facts in \\z3_rule\\ are tried prior to\nany implemented reconstruction procedure for all uncertain Z3 proof\nrules; the facts in \\z3_simp\\ are only fed to invocations of\nthe simplifier when reconstructing theory-specific proof steps.\n\\\n\nlemmas [old_z3_rule] =\n refl eq_commute conj_commute disj_commute simp_thms nnf_simps\n ring_distribs field_simps times_divide_eq_right times_divide_eq_left\n if_True if_False not_not\n\nlemma [old_z3_rule]:\n \"(P \\ Q) = (\\(\\P \\ \\Q))\"\n \"(P \\ Q) = (\\(\\Q \\ \\P))\"\n \"(\\P \\ Q) = (\\(P \\ \\Q))\"\n \"(\\P \\ Q) = (\\(\\Q \\ P))\"\n \"(P \\ \\Q) = (\\(\\P \\ Q))\"\n \"(P \\ \\Q) = (\\(Q \\ \\P))\"\n \"(\\P \\ \\Q) = (\\(P \\ Q))\"\n \"(\\P \\ \\Q) = (\\(Q \\ P))\"\n by auto\n\nlemma [old_z3_rule]:\n \"(P \\ Q) = (Q \\ \\P)\"\n \"(\\P \\ Q) = (P \\ Q)\"\n \"(\\P \\ Q) = (Q \\ P)\"\n \"(True \\ P) = P\"\n \"(P \\ True) = True\"\n \"(False \\ P) = True\"\n \"(P \\ P) = True\"\n by auto\n\nlemma [old_z3_rule]:\n \"((P = Q) \\ R) = (R | (Q = (\\P)))\"\n by auto\n\nlemma [old_z3_rule]:\n \"(\\True) = False\"\n \"(\\False) = True\"\n \"(x = x) = True\"\n \"(P = True) = P\"\n \"(True = P) = P\"\n \"(P = False) = (\\P)\"\n \"(False = P) = (\\P)\"\n \"((\\P) = P) = False\"\n \"(P = (\\P)) = False\"\n \"((\\P) = (\\Q)) = (P = Q)\"\n \"\\(P = (\\Q)) = (P = Q)\"\n \"\\((\\P) = Q) = (P = Q)\"\n \"(P \\ Q) = (Q = (\\P))\"\n \"(P = Q) = ((\\P \\ Q) \\ (P \\ \\Q))\"\n \"(P \\ Q) = ((\\P \\ \\Q) \\ (P \\ Q))\"\n by auto\n\nlemma [old_z3_rule]:\n \"(if P then P else \\P) = True\"\n \"(if \\P then \\P else P) = True\"\n \"(if P then True else False) = P\"\n \"(if P then False else True) = (\\P)\"\n \"(if P then Q else True) = ((\\P) \\ Q)\"\n \"(if P then Q else True) = (Q \\ (\\P))\"\n \"(if P then Q else \\Q) = (P = Q)\"\n \"(if P then Q else \\Q) = (Q = P)\"\n \"(if P then \\Q else Q) = (P = (\\Q))\"\n \"(if P then \\Q else Q) = ((\\Q) = P)\"\n \"(if \\P then x else y) = (if P then y else x)\"\n \"(if P then (if Q then x else y) else x) = (if P \\ (\\Q) then y else x)\"\n \"(if P then (if Q then x else y) else x) = (if (\\Q) \\ P then y else x)\"\n \"(if P then (if Q then x else y) else y) = (if P \\ Q then x else y)\"\n \"(if P then (if Q then x else y) else y) = (if Q \\ P then x else y)\"\n \"(if P then x else if P then y else z) = (if P then x else z)\"\n \"(if P then x else if Q then x else y) = (if P \\ Q then x else y)\"\n \"(if P then x else if Q then x else y) = (if Q \\ P then x else y)\"\n \"(if P then x = y else x = z) = (x = (if P then y else z))\"\n \"(if P then x = y else y = z) = (y = (if P then x else z))\"\n \"(if P then x = y else z = y) = (y = (if P then x else z))\"\n by auto\n\nlemma [old_z3_rule]:\n \"0 + (x::int) = x\"\n \"x + 0 = x\"\n \"x + x = 2 * x\"\n \"0 * x = 0\"\n \"1 * x = x\"\n \"x + y = y + x\"\n by auto\n\nlemma [old_z3_rule]: (* for def-axiom *)\n \"P = Q \\ P \\ Q\"\n \"P = Q \\ \\P \\ \\Q\"\n \"(\\P) = Q \\ \\P \\ Q\"\n \"(\\P) = Q \\ P \\ \\Q\"\n \"P = (\\Q) \\ \\P \\ Q\"\n \"P = (\\Q) \\ P \\ \\Q\"\n \"P \\ Q \\ P \\ \\Q\"\n \"P \\ Q \\ \\P \\ Q\"\n \"P \\ (\\Q) \\ P \\ Q\"\n \"(\\P) \\ Q \\ P \\ Q\"\n \"P \\ Q \\ P \\ (\\Q)\"\n \"P \\ Q \\ (\\P) \\ Q\"\n \"P \\ \\Q \\ P \\ Q\"\n \"\\P \\ Q \\ P \\ Q\"\n \"P \\ y = (if P then x else y)\"\n \"P \\ (if P then x else y) = y\"\n \"\\P \\ x = (if P then x else y)\"\n \"\\P \\ (if P then x else y) = x\"\n \"P \\ R \\ \\(if P then Q else R)\"\n \"\\P \\ Q \\ \\(if P then Q else R)\"\n \"\\(if P then Q else R) \\ \\P \\ Q\"\n \"\\(if P then Q else R) \\ P \\ R\"\n \"(if P then Q else R) \\ \\P \\ \\Q\"\n \"(if P then Q else R) \\ P \\ \\R\"\n \"(if P then \\Q else R) \\ \\P \\ Q\"\n \"(if P then Q else \\R) \\ P \\ R\"\n by auto\n\nML_file \"Old_SMT/old_smt_real.ML\"\nML_file \"Old_SMT/old_smt_word.ML\"\n\nhide_type (open) pattern\nhide_const fun_app term_true term_false z3div z3mod\nhide_const (open) trigger pat nopat weight\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Library/Old_SMT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.26224945703371133}} {"text": "(* Title: HOL/MicroJava/Comp/TranslCompTp.thy\n Author: Martin Strecker\n*)\n\ntheory TranslCompTp\nimports Index \"../BV/JVMType\"\nbegin\n\n(**********************************************************************)\n\ndefinition comb :: \"['a \\ 'b list \\ 'c, 'c \\ 'b list \\ 'd, 'a] \\ 'b list \\ 'd\" where \n \"comb == (\\ f1 f2 x0. let (xs1, x1) = f1 x0; \n (xs2, x2) = f2 x1 \n in (xs1 @ xs2, x2))\"\n\ndefinition comb_nil :: \"'a \\ 'b list \\ 'a\" where\n \"comb_nil a == ([], a)\"\n\nnotation (xsymbols)\n comb (infixr \"\\\" 55)\n\nlemma comb_nil_left [simp]: \"comb_nil \\ f = f\"\nby (simp add: comb_def comb_nil_def split_beta)\n\nlemma comb_nil_right [simp]: \"f \\ comb_nil = f\"\nby (simp add: comb_def comb_nil_def split_beta)\n\nlemma comb_assoc [simp]: \"(fa \\ fb) \\ fc = fa \\ (fb \\ fc)\"\nby (simp add: comb_def split_beta)\n\nlemma comb_inv: \"(xs', x') = (f1 \\ f2) x0 \\\n \\ xs1 x1 xs2 x2. (xs1, x1) = (f1 x0) \\ (xs2, x2) = f2 x1 \\ xs'= xs1 @ xs2 \\ x'=x2\"\napply (case_tac \"f1 x0\")\napply (case_tac \"f2 x1\")\napply (simp add: comb_def split_beta)\ndone\n\n(**********************************************************************)\n\nabbreviation (input)\n mt_of :: \"method_type \\ state_type \\ method_type\"\n where \"mt_of == fst\"\n\nabbreviation (input)\n sttp_of :: \"method_type \\ state_type \\ state_type\"\n where \"sttp_of == snd\"\n\ndefinition nochangeST :: \"state_type \\ method_type \\ state_type\" where\n \"nochangeST sttp == ([Some sttp], sttp)\"\n\ndefinition pushST :: \"[ty list, state_type] \\ method_type \\ state_type\" where\n \"pushST tps == (\\ (ST, LT). ([Some (ST, LT)], (tps @ ST, LT)))\"\n\ndefinition dupST :: \"state_type \\ method_type \\ state_type\" where\n \"dupST == (\\ (ST, LT). ([Some (ST, LT)], (hd ST # ST, LT)))\"\n\ndefinition dup_x1ST :: \"state_type \\ method_type \\ state_type\" where\n \"dup_x1ST == (\\ (ST, LT). ([Some (ST, LT)], \n (hd ST # hd (tl ST) # hd ST # (tl (tl ST)), LT)))\"\n\ndefinition popST :: \"[nat, state_type] \\ method_type \\ state_type\" where\n \"popST n == (\\ (ST, LT). ([Some (ST, LT)], (drop n ST, LT)))\"\n\ndefinition replST :: \"[nat, ty, state_type] \\ method_type \\ state_type\" where\n \"replST n tp == (\\ (ST, LT). ([Some (ST, LT)], (tp # (drop n ST), LT)))\"\n\ndefinition storeST :: \"[nat, ty, state_type] \\ method_type \\ state_type\" where\n \"storeST i tp == (\\ (ST, LT). ([Some (ST, LT)], (tl ST, LT [i:= OK tp])))\"\n\n\n(* Expressions *)\n\nprimrec compTpExpr :: \"java_mb \\ java_mb prog \\ expr \\\n state_type \\ method_type \\ state_type\"\n and compTpExprs :: \"java_mb \\ java_mb prog \\ expr list \\\n state_type \\ method_type \\ state_type\"\nwhere\n \"compTpExpr jmb G (NewC c) = pushST [Class c]\"\n| \"compTpExpr jmb G (Cast c e) = (compTpExpr jmb G e) \\ (replST 1 (Class c))\"\n| \"compTpExpr jmb G (Lit val) = pushST [the (typeof (\\v. None) val)]\"\n| \"compTpExpr jmb G (BinOp bo e1 e2) =\n (compTpExpr jmb G e1) \\ (compTpExpr jmb G e2) \\ \n (case bo of \n Eq => popST 2 \\ pushST [PrimT Boolean] \\ popST 1 \\ pushST [PrimT Boolean]\n | Add => replST 2 (PrimT Integer))\"\n| \"compTpExpr jmb G (LAcc vn) = (\\ (ST, LT). \n pushST [ok_val (LT ! (index jmb vn))] (ST, LT))\"\n| \"compTpExpr jmb G (vn::=e) = \n (compTpExpr jmb G e) \\ dupST \\ (popST 1)\"\n| \"compTpExpr jmb G ( {cn}e..fn ) = \n (compTpExpr jmb G e) \\ replST 1 (snd (the (field (G,cn) fn)))\"\n| \"compTpExpr jmb G (FAss cn e1 fn e2 ) = \n (compTpExpr jmb G e1) \\ (compTpExpr jmb G e2) \\ dup_x1ST \\ (popST 2)\"\n| \"compTpExpr jmb G ({C}a..mn({fpTs}ps)) =\n (compTpExpr jmb G a) \\ (compTpExprs jmb G ps) \\ \n (replST ((length ps) + 1) (method_rT (the (method (G,C) (mn,fpTs)))))\"\n| \"compTpExprs jmb G [] = comb_nil\"\n| \"compTpExprs jmb G (e#es) = (compTpExpr jmb G e) \\ (compTpExprs jmb G es)\"\n\n\n(* Statements *)\nprimrec compTpStmt :: \"java_mb \\ java_mb prog \\ stmt \\ \n state_type \\ method_type \\ state_type\"\nwhere\n \"compTpStmt jmb G Skip = comb_nil\"\n| \"compTpStmt jmb G (Expr e) = (compTpExpr jmb G e) \\ popST 1\"\n| \"compTpStmt jmb G (c1;; c2) = (compTpStmt jmb G c1) \\ (compTpStmt jmb G c2)\"\n| \"compTpStmt jmb G (If(e) c1 Else c2) = \n (pushST [PrimT Boolean]) \\ (compTpExpr jmb G e) \\ popST 2 \\\n (compTpStmt jmb G c1) \\ nochangeST \\ (compTpStmt jmb G c2)\"\n| \"compTpStmt jmb G (While(e) c) = \n (pushST [PrimT Boolean]) \\ (compTpExpr jmb G e) \\ popST 2 \\\n (compTpStmt jmb G c) \\ nochangeST\"\n\ndefinition compTpInit :: \"java_mb \\ (vname * ty)\n \\ state_type \\ method_type \\ state_type\" where\n \"compTpInit jmb == (\\ (vn,ty). (pushST [ty]) \\ (storeST (index jmb vn) ty))\"\n\nprimrec compTpInitLvars :: \"[java_mb, (vname \\ ty) list] \\\n state_type \\ method_type \\ state_type\"\nwhere\n \"compTpInitLvars jmb [] = comb_nil\"\n| \"compTpInitLvars jmb (lv#lvars) = (compTpInit jmb lv) \\ (compTpInitLvars jmb lvars)\"\n\ndefinition start_ST :: \"opstack_type\" where\n \"start_ST == []\"\n\ndefinition start_LT :: \"cname \\ ty list \\ nat \\ locvars_type\" where\n \"start_LT C pTs n == (OK (Class C))#((map OK pTs))@(replicate n Err)\"\n\ndefinition compTpMethod :: \"[java_mb prog, cname, java_mb mdecl] \\ method_type\" where\n \"compTpMethod G C == \\ ((mn,pTs),rT, jmb). \n let (pns,lvars,blk,res) = jmb\n in (mt_of\n ((compTpInitLvars jmb lvars \\ \n compTpStmt jmb G blk \\ \n compTpExpr jmb G res \\\n nochangeST)\n (start_ST, start_LT C pTs (length lvars))))\"\n\ndefinition compTp :: \"java_mb prog => prog_type\" where\n \"compTp G C sig == let (D, rT, jmb) = (the (method (G, C) sig))\n in compTpMethod G C (sig, rT, jmb)\"\n\n\n\n(**********************************************************************)\n (* Computing the maximum stack size from the method_type *)\n\ndefinition ssize_sto :: \"(state_type option) \\ nat\" where\n \"ssize_sto sto == case sto of None \\ 0 | (Some (ST, LT)) \\ length ST\"\n\ndefinition max_of_list :: \"nat list \\ nat\" where\n \"max_of_list xs == foldr max xs 0\"\n\ndefinition max_ssize :: \"method_type \\ nat\" where\n \"max_ssize mt == max_of_list (map ssize_sto mt)\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/Comp/TranslCompTp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.262225240136346}} {"text": "(* Title: JinjaDCI/BV/BVConform.thy\n\n Author: Cornelia Pusch, Gerwin Klein, Susannah Mansky\n Copyright 1999 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory BV/BVConform.thy by Cornelia Pusch and Gerwin Klein\n\nThe invariant for the type safety proof.\n*)\n\nsection \\ BV Type Safety Invariant \\\n\ntheory BVConform\nimports BVSpec \"../JVM/JVMExec\" \"../Common/Conform\"\nbegin\n\nsubsection \\ @{text \"correct_state\"} definitions \\\n\ndefinition confT :: \"'c prog \\ heap \\ val \\ ty err \\ bool\" \n (\"_,_ \\ _ :\\\\<^sub>\\ _\" [51,51,51,51] 50)\nwhere\n \"P,h \\ v :\\\\<^sub>\\ E \\ case E of Err \\ True | OK T \\ P,h \\ v :\\ T\"\n\nnotation (ASCII)\n confT (\"_,_ |- _ :<=T _\" [51,51,51,51] 50)\n\nabbreviation\n confTs :: \"'c prog \\ heap \\ val list \\ ty\\<^sub>l \\ bool\" \n (\"_,_ \\ _ [:\\\\<^sub>\\] _\" [51,51,51,51] 50) where\n \"P,h \\ vs [:\\\\<^sub>\\] Ts \\ list_all2 (confT P h) vs Ts\"\n\nnotation (ASCII)\n confTs (\"_,_ |- _ [:<=T] _\" [51,51,51,51] 50)\n\nfun Called_context :: \"jvm_prog \\ cname \\ instr \\ bool\" where\n\"Called_context P C\\<^sub>0 (New C') = (C\\<^sub>0=C')\" |\n\"Called_context P C\\<^sub>0 (Getstatic C F D) = ((C\\<^sub>0=D) \\ (\\t. P \\ C has F,Static:t in D))\" |\n\"Called_context P C\\<^sub>0 (Putstatic C F D) = ((C\\<^sub>0=D) \\ (\\t. P \\ C has F,Static:t in D))\" |\n\"Called_context P C\\<^sub>0 (Invokestatic C M n)\n = (\\Ts T m D. (C\\<^sub>0=D) \\ P \\ C sees M,Static:Ts \\ T = m in D)\" |\n\"Called_context P _ _ = False\"\n\nabbreviation Called_set :: \"instr set\" where\n\"Called_set \\ {i. \\C. i = New C} \\ {i. \\C M n. i = Invokestatic C M n}\n \\ {i. \\C F D. i = Getstatic C F D} \\ {i. \\C F D. i = Putstatic C F D}\"\n\nlemma Called_context_Called_set:\n \"Called_context P D i \\ i \\ Called_set\" by(cases i, auto)\n\nfun valid_ics :: \"jvm_prog \\ heap \\ sheap \\ cname \\ mname \\ pc \\ init_call_status \\ bool\"\n (\"_,_,_ \\\\<^sub>i _\" [51,51,51,51] 50) where\n\"valid_ics P h sh (C,M,pc,Calling C' Cs)\n = (let ins = instrs_of P C M in Called_context P (last (C'#Cs)) (ins!pc)\n \\ is_class P C')\" |\n\"valid_ics P h sh (C,M,pc,Throwing Cs a)\n =(let ins = instrs_of P C M in \\C1. Called_context P C1 (ins!pc)\n \\ (\\obj. h a = Some obj))\" |\n\"valid_ics P h sh (C,M,pc,Called Cs)\n = (let ins = instrs_of P C M\n in \\C1 sobj. Called_context P C1 (ins!pc) \\ sh C1 = Some sobj)\" |\n\"valid_ics P _ _ _ = True\"\n\ndefinition conf_f :: \"jvm_prog \\ heap \\ sheap \\ ty\\<^sub>i \\ bytecode \\ frame \\ bool\"\nwhere\n \"conf_f P h sh \\ \\(ST,LT) is (stk,loc,C,M,pc,ics).\n P,h \\ stk [:\\] ST \\ P,h \\ loc [:\\\\<^sub>\\] LT \\ pc < size is \\ P,h,sh \\\\<^sub>i (C,M,pc,ics)\"\n\nlemma conf_f_def2:\n \"conf_f P h sh (ST,LT) is (stk,loc,C,M,pc,ics) \\\n P,h \\ stk [:\\] ST \\ P,h \\ loc [:\\\\<^sub>\\] LT \\ pc < size is \\ P,h,sh \\\\<^sub>i (C,M,pc,ics)\"\n by (simp add: conf_f_def)\n\nprimrec conf_fs :: \"[jvm_prog,heap,sheap,ty\\<^sub>P,cname,mname,nat,ty,frame list] \\ bool\"\nwhere\n \"conf_fs P h sh \\ C\\<^sub>0 M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 [] = True\"\n| \"conf_fs P h sh \\ C\\<^sub>0 M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 (f#frs) =\n (let (stk,loc,C,M,pc,ics) = f in\n (\\ST LT b Ts T mxs mxl\\<^sub>0 is xt.\n \\ C M ! pc = Some (ST,LT) \\ \n (P \\ C sees M,b:Ts \\ T = (mxs,mxl\\<^sub>0,is,xt) in C) \\\n ((\\D Ts' T' m D'. M\\<^sub>0 \\ clinit \\ ics = No_ics \\\n is!pc = Invoke M\\<^sub>0 n\\<^sub>0 \\ ST!n\\<^sub>0 = Class D \\\n P \\ D sees M\\<^sub>0,NonStatic:Ts' \\ T' = m in D' \\ P \\ C\\<^sub>0 \\\\<^sup>* D' \\ P \\ T\\<^sub>0 \\ T') \\\n (\\D Ts' T' m. M\\<^sub>0 \\ clinit \\ ics = No_ics \\\n is!pc = Invokestatic D M\\<^sub>0 n\\<^sub>0 \\\n P \\ D sees M\\<^sub>0,Static:Ts' \\ T' = m in C\\<^sub>0 \\ P \\ T\\<^sub>0 \\ T') \\\n (M\\<^sub>0 = clinit \\ (\\Cs. ics = Called Cs))) \\\n conf_f P h sh (ST, LT) is f \\ conf_fs P h sh \\ C M (size Ts) T frs))\"\n\nfun ics_classes :: \"init_call_status \\ cname list\" where\n\"ics_classes (Calling C Cs) = Cs\" |\n\"ics_classes (Throwing Cs a) = Cs\" |\n\"ics_classes (Called Cs) = Cs\" |\n\"ics_classes _ = []\"\n\nfun frame_clinit_classes :: \"frame \\ cname list\" where\n\"frame_clinit_classes (stk,loc,C,M,pc,ics) = (if M=clinit then [C] else []) @ ics_classes ics\"\n\nabbreviation clinit_classes :: \"frame list \\ cname list\" where\n\"clinit_classes frs \\ concat (map frame_clinit_classes frs)\"\n\ndefinition distinct_clinit :: \"frame list \\ bool\" where\n\"distinct_clinit frs \\ distinct (clinit_classes frs)\"\n\ndefinition conf_clinit :: \"jvm_prog \\ sheap \\ frame list \\ bool\" where\n\"conf_clinit P sh frs\n \\ distinct_clinit frs \\\n (\\C \\ set(clinit_classes frs). is_class P C \\ (\\sfs. sh C = Some(sfs, Processing)))\"\n\n(*************************)\n\ndefinition correct_state :: \"[jvm_prog,ty\\<^sub>P,jvm_state] \\ bool\" (\"_,_ \\ _ \\\" [61,0,0] 61)\nwhere\n \"correct_state P \\ \\ \\(xp,h,frs,sh).\n case xp of\n None \\ (case frs of\n [] \\ True\n | (f#fs) \\ P\\ h\\ \\ P,h\\\\<^sub>s sh\\ \\ conf_clinit P sh frs \\\n (let (stk,loc,C,M,pc,ics) = f\n in \\b Ts T mxs mxl\\<^sub>0 is xt \\.\n (P \\ C sees M,b:Ts\\T = (mxs,mxl\\<^sub>0,is,xt) in C) \\\n \\ C M ! pc = Some \\ \\\n conf_f P h sh \\ is f \\ conf_fs P h sh \\ C M (size Ts) T fs))\n | Some x \\ frs = []\" \n\nnotation\n correct_state (\"_,_ |- _ [ok]\" [61,0,0] 61)\n\nsubsection \\ Values and @{text \"\\\"} \\\n\nlemma confT_Err [iff]: \"P,h \\ x :\\\\<^sub>\\ Err\" \n by (simp add: confT_def)\n\nlemma confT_OK [iff]: \"P,h \\ x :\\\\<^sub>\\ OK T = (P,h \\ x :\\ T)\"\n by (simp add: confT_def)\n\nlemma confT_cases:\n \"P,h \\ x :\\\\<^sub>\\ X = (X = Err \\ (\\T. X = OK T \\ P,h \\ x :\\ T))\"\n by (cases X) auto\n\nlemma confT_hext [intro?, trans]:\n \"\\ P,h \\ x :\\\\<^sub>\\ T; h \\ h' \\ \\ P,h' \\ x :\\\\<^sub>\\ T\"\n by (cases T) (blast intro: conf_hext)+\n\nlemma confT_widen [intro?, trans]:\n \"\\ P,h \\ x :\\\\<^sub>\\ T; P \\ T \\\\<^sub>\\ T' \\ \\ P,h \\ x :\\\\<^sub>\\ T'\"\n by (cases T', auto intro: conf_widen)\n\n\nsubsection \\ Stack and Registers \\\n\nlemmas confTs_Cons1 [iff] = list_all2_Cons1 [of \"confT P h\"] for P h\n\nlemma confTs_confT_sup:\nassumes confTs: \"P,h \\ loc [:\\\\<^sub>\\] LT\" and n: \"n < size LT\" and\n LTn: \"LT!n = OK T\" and subtype: \"P \\ T \\ T'\"\nshows \"P,h \\ (loc!n) :\\ T'\"\n(*<*)\nproof -\n have len: \"n < length loc\" using list_all2_lengthD[OF confTs] n\n by simp\n show ?thesis\n using list_all2_nthD[OF confTs len] conf_widen[OF _ subtype] LTn\n by simp\nqed\n(*>*)\n\nlemma confTs_hext [intro?]:\n \"P,h \\ loc [:\\\\<^sub>\\] LT \\ h \\ h' \\ P,h' \\ loc [:\\\\<^sub>\\] LT\"\n by (fast elim: list_all2_mono confT_hext) \n\nlemma confTs_widen [intro?, trans]:\n \"P,h \\ loc [:\\\\<^sub>\\] LT \\ P \\ LT [\\\\<^sub>\\] LT' \\ P,h \\ loc [:\\\\<^sub>\\] LT'\"\n by (rule list_all2_trans, rule confT_widen)\n\nlemma confTs_map [iff]:\n \"\\vs. (P,h \\ vs [:\\\\<^sub>\\] map OK Ts) = (P,h \\ vs [:\\] Ts)\"\n by (induct Ts) (auto simp: list_all2_Cons2)\n\nlemma reg_widen_Err [iff]:\n \"\\LT. (P \\ replicate n Err [\\\\<^sub>\\] LT) = (LT = replicate n Err)\"\n by (induct n) (auto simp: list_all2_Cons1)\n \n\n\nsubsection \\ valid @{text \"init_call_status\"} \\\n\nlemma valid_ics_shupd:\nassumes \"P,h,sh \\\\<^sub>i (C, M, pc, ics)\" and \"distinct (C'#ics_classes ics)\"\nshows \"P,h,sh(C' \\ (sfs, i')) \\\\<^sub>i (C, M, pc, ics)\"\nusing assms by(cases ics; clarsimp simp: fun_upd_apply) fastforce\n \nsubsection \\ correct-frame \\\n\nlemma conf_f_Throwing:\nassumes \"conf_f P h sh (ST, LT) is (stk, loc, C, M, pc, Called Cs)\"\n and \"is_class P C'\" and \"h xcp = Some obj\" and \"sh C' = Some(sfs,Processing)\"\nshows \"conf_f P h sh (ST, LT) is (stk, loc, C, M, pc, Throwing (C' # Cs) xcp)\"\nusing assms by(auto simp: conf_f_def2)\n\nlemma conf_f_shupd:\nassumes \"conf_f P h sh (ST,LT) ins f\"\n and \"i = Processing\n \\ (distinct (C#ics_classes (ics_of f)) \\ (curr_method f = clinit \\ C \\ curr_class f))\"\nshows \"conf_f P h (sh(C \\ (sfs, i))) (ST,LT) ins f\"\nusing assms\n by(cases f, cases \"ics_of f\"; clarsimp simp: conf_f_def2 fun_upd_apply) fastforce+\n\nlemma conf_f_shupd':\nassumes \"conf_f P h sh (ST,LT) ins f\"\n and \"sh C = Some(sfs,i)\"\nshows \"conf_f P h (sh(C \\ (sfs', i))) (ST,LT) ins f\"\nusing assms\n by(cases f, cases \"ics_of f\"; clarsimp simp: conf_f_def2 fun_upd_apply) fastforce+\n\nsubsection \\ correct-frames \\\n\nlemmas [simp del] = fun_upd_apply\n\nlemma conf_fs_hext:\n \"\\C M n T\\<^sub>r. \n \\ conf_fs P h sh \\ C M n T\\<^sub>r frs; h \\ h' \\ \\ conf_fs P h' sh \\ C M n T\\<^sub>r frs\"\n(*<*)\nproof(induct frs)\n case (Cons fr frs)\n obtain stk ls C M pc ics where fr: \"fr = (stk, ls, C, M, pc, ics)\" by(cases fr) simp\n moreover obtain ST LT where \\: \"\\ C M ! pc = \\(ST, LT)\\\" and\n ST: \"P,h \\ stk [:\\] ST\" and LT: \"P,h \\ ls [:\\\\<^sub>\\] LT\"\n using Cons.prems(1) fr by(auto simp: conf_f_def)\n ultimately show ?case using Cons confs_hext[OF ST Cons(3)] confTs_hext[OF LT Cons(3)]\n by (fastforce simp: conf_f_def)\nqed simp\n(*>*)\n\n\nlemma conf_fs_shupd:\nassumes \"conf_fs P h sh \\ C\\<^sub>0 M n T frs\"\n and dist: \"distinct (C#clinit_classes frs)\"\nshows \"conf_fs P h (sh(C \\ (sfs, i))) \\ C\\<^sub>0 M n T frs\"\nusing assms proof(induct frs arbitrary: C\\<^sub>0 C M n T)\n case (Cons f' frs')\n then obtain stk' loc' C' M' pc' ics' where f': \"f' = (stk',loc',C',M',pc',ics')\" by(cases f')\n with assms Cons obtain ST LT b Ts T1 mxs mxl\\<^sub>0 ins xt where\n ty: \"\\ C' M' ! pc' = Some (ST,LT)\" and\n meth: \"P \\ C' sees M',b:Ts \\ T1 = (mxs,mxl\\<^sub>0,ins,xt) in C'\" and\n conf: \"conf_f P h sh (ST, LT) ins f'\" and\n confs: \"conf_fs P h sh \\ C' M' (size Ts) T1 frs'\" by clarsimp\n\n from f' Cons.prems(2) have\n \"distinct (C#ics_classes (ics_of f')) \\ (curr_method f' = clinit \\ C \\ curr_class f')\"\n by fastforce\n with conf_f_shupd[where C=C, OF conf] have\n conf': \"conf_f P h (sh(C \\ (sfs, i))) (ST, LT) ins f'\" by simp\n\n from Cons.prems(2) have dist': \"distinct (C # clinit_classes frs')\"\n by(auto simp: distinct_length_2_or_more)\n from Cons.hyps[OF confs dist'] have\n confs': \"conf_fs P h (sh(C \\ (sfs, i))) \\ C' M' (length Ts) T1 frs'\" by simp\n\n from conf' confs' ty meth f' Cons.prems show ?case by(fastforce dest: sees_method_fun)\nqed(simp)\n\nlemma conf_fs_shupd':\nassumes \"conf_fs P h sh \\ C\\<^sub>0 M n T frs\"\n and shC: \"sh C = Some(sfs,i)\"\nshows \"conf_fs P h (sh(C \\ (sfs', i))) \\ C\\<^sub>0 M n T frs\"\nusing assms proof(induct frs arbitrary: C\\<^sub>0 C M n T sfs i sfs')\n case (Cons f' frs')\n then obtain stk' loc' C' M' pc' ics' where f': \"f' = (stk',loc',C',M',pc',ics')\" by(cases f')\n with assms Cons obtain ST LT b Ts T1 mxs mxl\\<^sub>0 ins xt where\n ty: \"\\ C' M' ! pc' = Some (ST,LT)\" and\n meth: \"P \\ C' sees M',b:Ts \\ T1 = (mxs,mxl\\<^sub>0,ins,xt) in C'\" and\n conf: \"conf_f P h sh (ST, LT) ins f'\" and\n confs: \"conf_fs P h sh \\ C' M' (size Ts) T1 frs'\" and\n shC': \"sh C = Some(sfs,i)\" by clarsimp\n\n have conf': \"conf_f P h (sh(C \\ (sfs', i))) (ST, LT) ins f'\" by(rule conf_f_shupd'[OF conf shC'])\n\n from Cons.hyps[OF confs shC'] have\n confs': \"conf_fs P h (sh(C \\ (sfs', i))) \\ C' M' (length Ts) T1 frs'\" by simp\n\n from conf' confs' ty meth f' Cons.prems show ?case by(fastforce dest: sees_method_fun)\nqed(simp)\n\nsubsection \\ correctness wrt @{term clinit} use \\\n\nlemma conf_clinit_Cons:\nassumes \"conf_clinit P sh (f#frs)\"\nshows \"conf_clinit P sh frs\"\nproof -\n from assms have dist: \"distinct_clinit (f#frs)\"\n by(cases \"curr_method f = clinit\", auto simp: conf_clinit_def)\n then have dist': \"distinct_clinit frs\" by(simp add: distinct_clinit_def)\n\n with assms show ?thesis by(cases frs; fastforce simp: conf_clinit_def)\nqed\n\nlemma conf_clinit_Cons_Cons:\n \"conf_clinit P sh (f'#f#frs) \\ conf_clinit P sh (f'#frs)\"\n by(auto simp: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_diff:\nassumes \"conf_clinit P sh ((stk,loc,C,M,pc,ics)#frs)\"\nshows \"conf_clinit P sh ((stk',loc',C,M,pc',ics)#frs)\"\nusing assms by(cases \"M = clinit\", simp_all add: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_diff':\nassumes \"conf_clinit P sh ((stk,loc,C,M,pc,ics)#frs)\"\nshows \"conf_clinit P sh ((stk',loc',C,M,pc',No_ics)#frs)\"\nusing assms by(cases \"M = clinit\", simp_all add: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_Called_Throwing:\n \"conf_clinit P sh ((stk', loc', C', clinit, pc', ics') # (stk, loc, C, M, pc, Called Cs) # fs)\n \\ conf_clinit P sh ((stk, loc, C, M, pc, Throwing (C' # Cs) xcp) # fs)\"\n by(simp add: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_Throwing:\n \"conf_clinit P sh ((stk, loc, C, M, pc, Throwing (C'#Cs) xcp) # fs)\n \\ conf_clinit P sh ((stk, loc, C, M, pc, Throwing Cs xcp) # fs)\"\n by(simp add: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_Called:\n \"\\ conf_clinit P sh ((stk, loc, C, M, pc, Called (C'#Cs)) # frs);\n P \\ C' sees clinit,Static: [] \\ Void=(mxs',mxl',ins',xt') in C' \\\n \\ conf_clinit P sh (create_init_frame P C' # (stk, loc, C, M, pc, Called Cs) # frs)\"\n by(simp add: conf_clinit_def distinct_clinit_def)\n\nlemma conf_clinit_Cons_nclinit:\nassumes \"conf_clinit P sh frs\" and nclinit: \"M \\ clinit\"\nshows \"conf_clinit P sh ((stk, loc, C, M, pc, No_ics) # frs)\"\nproof -\n from nclinit\n have \"clinit_classes ((stk, loc, C, M, pc, No_ics) # frs) = clinit_classes frs\" by simp\n with assms show ?thesis by(simp add: conf_clinit_def distinct_clinit_def)\nqed\n\nlemma conf_clinit_Invoke:\nassumes \"conf_clinit P sh ((stk, loc, C, M, pc, ics) # frs)\" and \"M' \\ clinit\"\nshows \"conf_clinit P sh ((stk', loc', C', M', pc', No_ics) # (stk, loc, C, M, pc, No_ics) # frs)\"\n using assms conf_clinit_Cons_nclinit conf_clinit_diff' by auto\n\nlemma conf_clinit_nProc_dist:\nassumes \"conf_clinit P sh frs\"\n and \"\\sfs. sh C \\ Some(sfs,Processing)\"\nshows \"distinct (C # clinit_classes frs)\"\nusing assms by(auto simp: conf_clinit_def distinct_clinit_def)\n\n\nlemma conf_clinit_shupd:\nassumes \"conf_clinit P sh frs\"\n and dist: \"distinct (C#clinit_classes frs)\"\nshows \"conf_clinit P (sh(C \\ (sfs, i))) frs\"\nusing assms by(simp add: conf_clinit_def fun_upd_apply)\n\nlemma conf_clinit_shupd':\nassumes \"conf_clinit P sh frs\"\n and \"sh C = Some(sfs,i)\"\nshows \"conf_clinit P (sh(C \\ (sfs', i))) frs\"\nusing assms by(fastforce simp: conf_clinit_def fun_upd_apply)\n\nlemma conf_clinit_shupd_Called:\nassumes \"conf_clinit P sh ((stk,loc,C,M,pc,Calling C' Cs)#frs)\"\n and dist: \"distinct (C'#clinit_classes ((stk,loc,C,M,pc,Calling C' Cs)#frs))\"\n and cls: \"is_class P C'\"\nshows \"conf_clinit P (sh(C' \\ (sfs, Processing))) ((stk,loc,C,M,pc,Called (C'#Cs))#frs)\"\nusing assms by(clarsimp simp: conf_clinit_def fun_upd_apply distinct_clinit_def)\n\nlemma conf_clinit_shupd_Calling:\nassumes \"conf_clinit P sh ((stk,loc,C,M,pc,Calling C' Cs)#frs)\"\n and dist: \"distinct (C'#clinit_classes ((stk,loc,C,M,pc,Calling C' Cs)#frs))\"\n and cls: \"is_class P C'\"\nshows \"conf_clinit P (sh(C' \\ (sfs, Processing)))\n ((stk,loc,C,M,pc,Calling (fst(the(class P C'))) (C'#Cs))#frs)\"\nusing assms by(clarsimp simp: conf_clinit_def fun_upd_apply distinct_clinit_def)\n\nsubsection \\ correct state \\\n\nlemma correct_state_Cons:\nassumes cr: \"P,\\ |- (xp,h,f#frs,sh) [ok]\"\nshows \"P,\\ |- (xp,h,frs,sh) [ok]\"\nproof -\n from cr have dist: \"conf_clinit P sh (f#frs)\"\n by(simp add: correct_state_def)\n then have \"conf_clinit P sh frs\" by(rule conf_clinit_Cons)\n\n with cr show ?thesis by(cases frs; fastforce simp: correct_state_def)\nqed\n\nlemma correct_state_shupd:\nassumes cs: \"P,\\ |- (xp,h,frs,sh) [ok]\" and shC: \"sh C = Some(sfs,i)\"\n and dist: \"distinct (C#clinit_classes frs)\"\nshows \"P,\\ |- (xp,h,frs,sh(C \\ (sfs, i'))) [ok]\"\nusing assms\nproof(cases xp)\n case None with assms show ?thesis\n proof(cases frs)\n case (Cons f' frs')\n let ?sh = \"sh(C \\ (sfs, i'))\"\n\n obtain stk' loc' C' M' pc' ics' where f': \"f' = (stk',loc',C',M',pc',ics')\" by(cases f')\n with cs Cons None obtain b Ts T mxs mxl\\<^sub>0 ins xt ST LT where\n meth: \"P \\ C' sees M',b:Ts\\T = (mxs,mxl\\<^sub>0,ins,xt) in C'\"\n and ty: \"\\ C' M' ! pc' = Some (ST,LT)\" and conf: \"conf_f P h sh (ST,LT) ins f'\"\n and confs: \"conf_fs P h sh \\ C' M' (size Ts) T frs'\"\n and confc: \"conf_clinit P sh frs\"\n and h_ok: \"P\\ h\\\" and sh_ok: \"P,h \\\\<^sub>s sh \\\"\n by(auto simp: correct_state_def)\n\n from Cons dist have dist': \"distinct (C#clinit_classes frs')\"\n by(auto simp: distinct_length_2_or_more)\n\n from shconf_upd_obj[OF sh_ok shconfD[OF sh_ok shC]] have sh_ok': \"P,h \\\\<^sub>s ?sh \\\"\n by simp\n\n from conf f' valid_ics_shupd Cons dist have conf': \"conf_f P h ?sh (ST,LT) ins f'\"\n by(auto simp: conf_f_def2 fun_upd_apply)\n have confs': \"conf_fs P h ?sh \\ C' M' (size Ts) T frs'\" by(rule conf_fs_shupd[OF confs dist'])\n\n have confc': \"conf_clinit P ?sh frs\" by(rule conf_clinit_shupd[OF confc dist])\n\n with h_ok sh_ok' meth ty conf' confs' f' Cons None show ?thesis\n by(fastforce simp: correct_state_def)\n qed(simp add: correct_state_def)\nqed(simp add: correct_state_def)\n\nlemma correct_state_Throwing_ex:\nassumes correct: \"P,\\ \\ (xp,h,(stk,loc,C,M,pc,ics)#frs,sh)\\\"\nshows \"\\Cs a. ics = Throwing Cs a \\ \\obj. h a = Some obj\"\nusing correct by(clarsimp simp: correct_state_def conf_f_def)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/BVConform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.262225240136346}} {"text": "theory Proof_2_3\n imports Requirements VCTheoryLemmas\nbegin\n\ntheorem proof_2_3: \"VC3 inv2 s0 requestButtonValue\"\n apply(simp only: VC3_def inv2_def R2_def extraInv_def)\nproof\n print_state\n assume \"((toEnvP s0 \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED)) \\\n toEnvP s0 \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ T2) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)) \\\n env (setVarAny s0 requestButtonValue) requestButtonValue \\\n getPstate (setVarAny s0 requestButtonValue) Ctrl = minimalRed \\\n getVarBool (setVarAny s0 requestButtonValue) Ctrl \\\n \\ MINIMAL_RED_TIME_LIMIT\n \\ ltimeEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED) Ctrl\"\n then obtain reqs0: \"(toEnvP s0 \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 s0 \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED))\" \nand ei0: \"toEnvP s0\"\nand ei1: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \" \nand ei2: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n ((\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\ s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed))) \"\nand ei3: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s1 Ctrl = minimalRed) \"\nand ei4: \"\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed ) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl\" \nand ei5: \"\\ s1 . toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\\n getVarBool s1 requestButtonPressed = False \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed \\ ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\ngetVarBool s2 requestButtonPressed = False \\ (\\ s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\ \ngetVarBool s3 requestButtonPressed = False \\ getVarBool s3 requestButton = NOT_PRESSED))\"\nand ei6: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n0< ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \"\nand ei7: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = redAfterMinimalRed \\ \n(getVarBool s2 requestButtonPressed = True \\ getVarBool s2 requestButton = PRESSED)))\"\nand ei8: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ getPstate s1 Ctrl = redToGreen) \"\nand ei9: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \"\nand ei10: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT)\"\nand ei11: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\ngetPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \"\nand ei12: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\\ntoEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s1 Ctrl = green)\"\nand ei13: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\ \n(\\ s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\ntoEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \"\nand ei14: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 trafficLight = GREEN) \"\nand ei15: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 trafficLight = RED) \"\nand ei16: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\ getPstate s1 Ctrl = redAfterMinimalRed \\\n getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green)\"\nand ei17: \"(\\ s1 s2. toEnvP s1 \\ toEnvP s2 \\ substate s1 s2 \\ substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - 1 \\ getPstate s2 Ctrl = minimalRed \\\n getVarBool s2 requestButtonPressed = False \\ getVarBool s1 requestButton = NOT_PRESSED)\"\nand ei18: \"(\\ s2. toEnvP s2 \\ substate s2 s0 \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 requestButtonPressed = True \\\n(\\ s1. toEnvP s1 \\ substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - 1 \\ getVarBool s1 requestButton = PRESSED))\"\nand ei19: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 requestButtonPressed \\\n(\\ s2. toEnvP s2 \\ substate s2 s1 \\ toEnvNum s2 s1 = 1 \\ getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 requestButtonPressed \\ getVarBool s1 requestButton = PRESSED)))\"\nand ei20: \"(\\ s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 requestButtonPressed = False)\"\nand vc: \" env (setVarAny s0 requestButtonValue) requestButtonValue \\\n getPstate (setVarAny s0 requestButtonValue) Ctrl = minimalRed \\\n getVarBool (setVarAny s0 requestButtonValue) Ctrl \\\n \\ MINIMAL_RED_TIME_LIMIT\n \\ ltimeEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED) Ctrl\"\n by fast\n show \"(toEnvP (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n (\\s1 s2 s3.\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED)) \\\n toEnvP (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ T2) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl \\ green \\\n getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)\"\n apply(rule conjI)\n apply(rule conjI)\n apply(simp)\n proof(rule allI; rule allI; rule allI)\n fix s1 s2 s3\n show \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 1: \"s3 = (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n from ei2 ei0 vc substate_refl have \" ((\\ s2. toEnvP s2 \\ substate s2 s0\n \\ toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\\n getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\ s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed))\"\n by auto\n thus ?thesis\n proof\n assume \"\\s2. toEnvP s2 \\\n substate s2 s0 \\ toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = T2\"\n then obtain g where 2: \"toEnvP g \\\n substate g s0 \\ toEnvNum g s0 = ltimeEnv s0 Ctrl \\ getPstate g Ctrl = green \\ ltimeEnv g Ctrl = T2\" ..\n show ?thesis\n proof cases\n assume 4: \"substate s2 g\" \n from ei11 2 have \"(\\ s2. toEnvP s2 \\ substate s2 g \\ toEnvNum s2 g = ltimeEnv g Ctrl \\\ngetPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)\" by blast\n then obtain rg where 3: \" toEnvP rg \\ substate rg g \\ toEnvNum rg g = ltimeEnv g Ctrl \\\ngetPstate rg Ctrl = redToGreen \\ ltimeEnv rg Ctrl = RED_TO_GREEN_TIME_LIMIT\" ..\n show ?thesis\n proof cases\n assume 5: \"substate s2 rg\"\n from ei0 have \"0 < ltimeEnv s0 Ctrl\" by ((cases s0); auto)\n with 2 3 toEnvNum3[of rg g s0] substate_trans[of rg g s0] have 6: \"toEnvNum rg s0 > T2\"\n by auto\n from 2 3 substate_trans have \"substate rg s0\" by blast\n with 5 6 toEnvNum3[of s2 rg s0] substate_trans[of s2 rg s0] have \"toEnvNum s2 s0 > T2\"\n by auto\n with 1 show ?thesis by auto\n next\n assume 5: \"\\ (substate s2 rg)\"\n with 3 4 substate_refl substate_total have 6: \"substate rg s2 \\ rg \\ s2\" by auto\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n show \"getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 8: \"substate s1 rg\"\n from ei0 have \"0 < ltimeEnv s0 Ctrl\" by ((cases s0); auto)\n with 2 3 toEnvNum3[of rg g s0] substate_trans[of rg g s0] have 6: \"toEnvNum rg s0 > T2\"\n by auto\n from 2 3 substate_trans have \"substate rg s0\" by blast\n with 8 6 toEnvNum3 have 9: \"toEnvNum s1 s0 > T2\" by auto\n from 1 7 9 have 10: \"substate s2 s0\" by ((simp split: if_splits); auto)\n with 7 9 toEnvNum3 have \"toEnvNum s2 s0 \\ T2\" by auto\n with 1 10 substate_refl toEnvNum3[of s2 s0 s3] have \"toEnvNum s2 s3 > T2\" by auto\n with 7 show ?thesis by auto\n next \n assume 8: \"\\ substate s1 rg\"\n from 4 7 substate_trans have 9: \"substate s1 g\" by blast\n from 2 4 substate_trans have 10: \"substate s2 s0\" by blast\n with 1 7 substate_refl substate_asym[of s0 s3] have \"toEnvNum s2 s0 + 1 < T2\" by ((simp split: if_splits); auto)\n with 7 10 toEnvNum3 have \"toEnvNum s1 s0 < T2\" by auto\n with 2 9 toEnvNum3 have \"toEnvNum s1 g < ltimeEnv g Ctrl\" by auto\n with 2 7 9 ei12 have \"getPstate s1 Ctrl = green\" by blast\n with ei14 7 show ?thesis using 2 9 substate_trans by blast\n qed\n qed\n qed\n next\n assume 4: \"\\ substate s2 g\"\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3 (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n have \"getVarBool s2 minimalRed =NOT_PRESSED\"\n proof cases\n assume 3: \"s2 = (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n from vc have \"getPstate s0 Ctrl \\ green\" by auto\n with ei0 substate_refl ei15 have \"getVarBool s0 trafficLight = RED\" by blast\n with 3 show ?thesis by auto\n next \n assume 3: \"s2 \\ (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n with 1 7 have 5: \"substate s2 s0\" by ((simp split: if_splits); auto)\n from 4 2 5 substate_total substate_refl have 6: \"substate g s2 \\ s2 \\ g\" by blast\n with 2 7 gtimeE_inj have 9: \"toEnvNum emptyState g \\ toEnvNum emptyState s2\" by blast\n from 5 6 toEnvNum3 have \"toEnvNum s2 s0 \\ toEnvNum g s0\" by auto\n from le_imp_less_or_eq[OF this]\n show ?thesis\n proof\n assume \"toEnvNum s2 s0 < toEnvNum g s0\"\n with 2 have 8: \"toEnvNum s2 s0 < ltimeEnv s0 Ctrl\" by auto\n from vc have \"getPstate s0 Ctrl = minimalRed\" by auto\n with ei3 7 ei0 5 substate_refl 8 have \"getPstate s2 Ctrl = minimalRed\" by blast\n with 5 7 ei15 show ?thesis by auto\n next \n assume \"toEnvNum s2 s0 = toEnvNum g s0\"\n with 9 have 10: \"toEnvNum emptyState g +toEnvNum g s0 \\ toEnvNum emptyState s2 +toEnvNum s2 s0\"\n by auto\n from emptyState_substate 5 toEnvNum3 have 11: \"toEnvNum emptyState s0 = toEnvNum emptyState s2 + toEnvNum s2 s0\"\n by auto \n from emptyState_substate 5 6 substate_trans[of g s2 s0] toEnvNum3 \n have \"toEnvNum emptyState s0 = toEnvNum emptyState g + toEnvNum g s0\"\n by auto\n with 10 11 show ?thesis by auto\n qed\n qed\n with 7 show \" getVarBool s3 minimalRed = PRESSED\" by auto\n qed\n qed\n next\n assume 2: \" \\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \"\n show \" \\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\\n substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED \\\n getVarBool s3 minimalRed = PRESSED\"\n proof cases\n assume 3: \"s2 = (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n from vc have \"getPstate s0 Ctrl \\ green\" by auto\n with ei0 substate_refl ei15 have \"getVarBool s0 trafficLight = RED\" by blast\n with 3 show ?thesis by auto\n next \n assume 3: \"s2 \\ (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n show ?thesis\n proof\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n with 1 3 have \"substate s2 s0\" by ((simp split: if_splits); auto)\n with 2 7 ei15 show \" getVarBool s3 minimalRed = PRESSED\" by auto\n qed\n qed\n qed\n next\n assume 1: \" s3 \\\n (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED))\"\n show ?thesis\n proof\n print_state\n assume 7: \"substate s1 s2 \\\n substate s2 s3 \\\n substate s3\n (toEnv (setVarBool (setVarAny s0 requestButtonValue) redAfterMinimalRed PRESSED)) \\\n toEnvP s1 \\\n toEnvP s2 \\\n toEnvP s3 \\\n toEnvNum s1 s2 = Ctrl \\\n toEnvNum s2 s3 < T2 \\ getVarBool s1 minimalRed \\ PRESSED \\ getVarBool s2 minimalRed = PRESSED\"\n with 1 have \"substate s3 s0\" by ((simp split: if_splits); auto)\n with 7 reqs0 show \" getVarBool s3 minimalRed = PRESSED\" by blast\n qed\n qed\n next\n (*prove extraInv*)\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/Proof_2_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.66192288918838, "lm_q2_score": 0.3960681662740417, "lm_q1q2_score": 0.26216658493565737}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \ntheory n_mutualEx_lemma_inv__3_on_rules imports n_mutualEx_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule Interp s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__3) done\n }\n\n ultimately show \"invHoldForRule Interp s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.2621562578783629}} {"text": "(* Title: HOL/HOLCF/IOA/Storage/Impl.thy\n Author: Olaf Müller\n*)\n\nsection {* The implementation of a memory *}\n\ntheory Impl\nimports IOA Action\nbegin\n\ndefinition\n impl_sig :: \"action signature\" where\n \"impl_sig = (UN l.{Free l} Un {New},\n UN l.{Loc l},\n {})\"\n\ndefinition\n impl_trans :: \"(action, nat * bool)transition set\" where\n \"impl_trans =\n {tr. let s = fst(tr); k = fst s; b = snd s;\n t = snd(snd(tr)); k' = fst t; b' = snd t\n in\n case fst(snd(tr))\n of\n New => k' = k & b' |\n Loc l => b & l= k & k'= (Suc k) & ~b' |\n Free l => k'=k & b'=b}\"\n\ndefinition\n impl_ioa :: \"(action, nat * bool)ioa\" where\n \"impl_ioa = (impl_sig, {(0,False)}, impl_trans,{},{})\"\n\nlemma in_impl_asig:\n \"New : actions(impl_sig) &\n Loc l : actions(impl_sig) &\n Free l : actions(impl_sig) \"\n by (simp add: impl_sig_def actions_def asig_projections)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/Storage/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832804, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2620952280295094}} {"text": "(* Title: JinjaDCI/BV/BVExec.thy\n\n Author: Tobias Nipkow, Gerwin Klein, Susannah Mansky\n Copyright 2000 TUM, 2020 UIUC\n\n Based on the Jinja theory BV/BVExec.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\ Kildall for the JVM \\label{sec:JVM} \\\n\ntheory BVExec\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ndefinition kiljvm :: \"jvm_prog \\ nat \\ nat \\ ty \\ \n instr list \\ ex_table \\ ty\\<^sub>i' err list \\ ty\\<^sub>i' err list\"\nwhere\n \"kiljvm P mxs mxl T\\<^sub>r is xt \\\n kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) \n (exec P mxs T\\<^sub>r xt is)\"\n\ndefinition wt_kildall :: \"jvm_prog \\ cname \\ staticb \\ ty list \\ ty \\ nat \\ nat \\ \n instr list \\ ex_table \\ bool\"\nwhere\n \"wt_kildall P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\\n 0 < size is \\ \n (let first = Some ([],(case b of Static \\ [] | NonStatic \\ [OK (Class C')])\n @(map OK Ts)@(replicate mxl\\<^sub>0 Err));\n start = (OK first)#(replicate (size is - 1) (OK None));\n result = kiljvm P mxs\n ((case b of Static \\ 0 | NonStatic \\ 1)+size Ts+mxl\\<^sub>0)\n T\\<^sub>r is xt start\n in \\n < size is. result!n \\ Err)\"\n\ndefinition wf_jvm_prog\\<^sub>k :: \"jvm_prog \\ bool\"\nwhere\n \"wf_jvm_prog\\<^sub>k P \\\n wf_prog (\\P C' (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). wt_kildall P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt) P\"\n\n\ntheorem (in start_context) is_bcv_kiljvm:\n \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n(*<*)\n apply (insert wf)\n apply (unfold kiljvm_def)\n apply (fold r_def f_def step_def_exec)\n apply (rule is_bcv_kildall)\n apply simp apply (rule Semilat.intro)\n apply (fold sl_def2)\n apply (erule semilat_JVM)\n apply simp\n apply blast\n apply (simp add: JVM_le_unfold)\n apply (rule exec_pres_type)\n apply (rule bounded_step)\n apply (erule step_mono)\n done\n(*>*)\n\n(* FIXME: move? *)\nlemma subset_replicate [intro?]: \"set (replicate n x) \\ {x}\"\n by (induct n) auto\n\nlemma in_set_replicate:\n assumes \"x \\ set (replicate n y)\"\n shows \"x = y\"\n(*<*)\nproof -\n note assms\n also have \"set (replicate n y) \\ {y}\" ..\n finally show ?thesis by simp\nqed\n(*>*)\n\nlemma (in start_context) start_in_A [intro?]:\n \"0 < size is \\ start \\ list (size is) A\"\n using Ts C\n(*<*)\n apply (simp add: JVM_states_unfold)\n apply (cases b; force intro!: listI list_appendI dest!: in_set_replicate)\n done\n(*>*)\n\n\ntheorem (in start_context) wt_kil_correct:\n assumes wtk: \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n shows \"\\\\s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n(*<*)\nproof -\n from wtk obtain res where \n result: \"res = kiljvm P mxs mxl T\\<^sub>r is xt start\" and\n success: \"\\n < size is. res!n \\ Err\" and\n instrs: \"0 < size is\" \n by (unfold wt_kildall_def) simp\n \n have bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n by (rule is_bcv_kiljvm)\n \n from instrs have \"start \\ list (size is) A\" ..\n with bcv success result have \n \"\\ts\\list (size is) A. start [\\\\<^sub>r] ts \\ wt_step r Err step ts\"\n by (unfold is_bcv_def) blast\n then obtain \\s' where\n in_A: \"\\s' \\ list (size is) A\" and\n s: \"start [\\\\<^sub>r] \\s'\" and\n w: \"wt_step r Err step \\s'\"\n by blast\n hence wt_err_step: \"wt_err_step (sup_state_opt P) step \\s'\"\n by (simp add: wt_err_step_def JVM_le_Err_conv)\n\n from in_A have l: \"size \\s' = size is\" by simp \n moreover {\n from in_A have \"check_types P mxs mxl \\s'\" by (simp add: check_types_def)\n also from w have \"\\x \\ set \\s'. x \\ Err\" \n by (auto simp add: wt_step_def all_set_conv_all_nth)\n hence [symmetric]: \"map OK (map ok_val \\s') = \\s'\" \n by (auto intro!: map_idI simp add: wt_step_def)\n finally have \"check_types P mxs mxl (map OK (map ok_val \\s'))\" .\n } \n moreover { \n from s have \"start!0 \\\\<^sub>r \\s'!0\" by (rule le_listD) simp\n moreover\n from instrs w l \n have \"\\s'!0 \\ Err\" by (unfold wt_step_def) simp\n then obtain \\s0 where \"\\s'!0 = OK \\s0\" by auto\n ultimately\n have \"wt_start P C b Ts mxl\\<^sub>0 (map ok_val \\s')\" using l instrs\n by (unfold wt_start_def) \n (cases b; simp add: lesub_def JVM_le_Err_conv Err.le_def)\n }\n moreover \n from in_A have \"set \\s' \\ A\" by simp \n with wt_err_step bounded_step\n have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\s')\"\n by (auto intro: wt_err_imp_wt_app_eff simp add: l)\n ultimately\n have \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\s')\"\n using instrs by (simp add: wt_method_def2 check_types_def del: map_map)\n thus ?thesis by blast\nqed\n(*>*)\n\n\ntheorem (in start_context) wt_kil_complete:\n assumes wtm: \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n shows \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n(*<*)\nproof -\n from wtm obtain\n instrs: \"0 < size is\" and\n length: \"length \\s = length is\" and \n ck_type: \"check_types P mxs mxl (map OK \\s)\" and\n wt_start: \"wt_start P C b Ts mxl\\<^sub>0 \\s\" and\n app_eff: \"wt_app_eff (sup_state_opt P) app eff \\s\"\n by (simp add: wt_method_def2 check_types_def)\n\n from ck_type\n have in_A: \"set (map OK \\s) \\ A\" \n by (simp add: check_types_def) \n with app_eff in_A bounded_step\n have \"wt_err_step (sup_state_opt P) (err_step (size \\s) app eff) (map OK \\s)\"\n by - (erule wt_app_eff_imp_wt_err,\n auto simp add: exec_def length states_def)\n hence wt_err: \"wt_err_step (sup_state_opt P) step (map OK \\s)\" \n by (simp add: length)\n have is_bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n by (rule is_bcv_kiljvm)\n moreover from instrs have \"start \\ list (size is) A\" ..\n moreover\n let ?\\s = \"map OK \\s\" \n have less_\\s: \"start [\\\\<^sub>r] ?\\s\"\n proof (rule le_listI)\n from length instrs\n show \"length start = length (map OK \\s)\" by simp\n next\n fix n\n from wt_start have \"P \\ ok_val (start!0) \\' \\s!0\" \n by (cases b; simp add: wt_start_def)\n moreover from instrs length have \"0 < length \\s\" by simp\n ultimately have \"start!0 \\\\<^sub>r ?\\s!0\" \n by (simp add: JVM_le_Err_conv lesub_def)\n moreover {\n fix n'\n have \"OK None \\\\<^sub>r ?\\s!n\"\n by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n split: err.splits)\n hence \"\\n = Suc n'; n < size start\\ \\ start!n \\\\<^sub>r ?\\s!n\" by simp\n }\n ultimately\n show \"n < size start \\ start!n \\\\<^sub>r ?\\s!n\" by (cases n, blast+) \n qed\n moreover\n from ck_type length\n have \"?\\s \\ list (size is) A\"\n by (auto intro!: listI simp add: check_types_def)\n moreover\n from wt_err have \"wt_step r Err step ?\\s\" \n by (simp add: wt_err_step_def JVM_le_Err_conv)\n ultimately\n have \"\\p. p < size is \\ kiljvm P mxs mxl T\\<^sub>r is xt start ! p \\ Err\" \n by (unfold is_bcv_def) blast\n with instrs \n show \"wt_kildall P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\" by (unfold wt_kildall_def) simp\nqed\n(*>*)\n\n\ntheorem jvm_kildall_correct:\n \"wf_jvm_prog\\<^sub>k P = wf_jvm_prog P\"\n(*<*)\nproof \n let ?\\ = \"\\C M. let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C M in \n SOME \\s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s\"\n\n \\ \\soundness\\\n assume wt: \"wf_jvm_prog\\<^sub>k P\"\n hence \"wf_jvm_prog\\<^bsub>?\\\\<^esub> P\"\n apply (unfold wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def) \n apply (erule wf_prog_lift)\n apply (auto dest!: start_context.wt_kil_correct [OF start_context.intro] \n intro: someI)\n apply (erule sees_method_is_class)\n done\n thus \"wf_jvm_prog P\" by (unfold wf_jvm_prog_def) fast\nnext\n \\ \\completeness\\\n assume wt: \"wf_jvm_prog P\"\n thus \"wf_jvm_prog\\<^sub>k P\"\n apply (unfold wf_jvm_prog_def wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)\n apply (clarify)\n apply (erule wf_prog_lift)\n apply (auto intro!: start_context.wt_kil_complete start_context.intro)\n apply (erule sees_method_is_class)\n done\nqed\n(*>*)\n\nend\n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/BV/BVExec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.4339814648038985, "lm_q1q2_score": 0.26209521565468225}} {"text": "theory IICF_HOL_List\nimports \"../Intf/IICF_List\"\nbegin\n\ncontext \nbegin\n\nprivate lemma id_take_nth_drop_rl:\n assumes \"il1 x l2. \\l=l1@x#l2; i = length l1 \\ \\ P (l1@x#l2)\"\n shows \"P l\" \n apply (subst id_take_nth_drop[OF assms(1)])\n apply (rule assms(2))\n apply (subst id_take_nth_drop[OF assms(1)])\n apply simp\n apply (simp add: assms(1))\n done\n\n\nprivate lemma list_set_entails_aux: \n shows \"list_assn A l li * A x xi \\\\<^sub>A list_assn A (l[i := x]) (li[i := xi]) * true\"\n apply (rule entails_preI)\n apply (clarsimp)\n apply (cases \"i < length l\"; cases \"i < length li\"; (sep_auto dest!: list_assn_aux_eqlen_simp;fail)?)\n apply (erule id_take_nth_drop_rl)\n apply (erule id_take_nth_drop_rl)\n apply (sep_auto simp add: list_update_append)\n done\n\nprivate lemma list_set_hd_tl_aux: \n \"a \\ [] \\ list_assn R a c \\\\<^sub>A R (hd a) (hd c) * true\"\n \"a \\ [] \\ list_assn R a c \\\\<^sub>A list_assn R (tl a) (tl c) * true\"\n by (cases c; cases a; sep_auto; fail)+\n\nprivate lemma list_set_last_butlast_aux:\n \"a \\ [] \\ list_assn R a c \\\\<^sub>A R (last a) (last c) * true\"\n \"a \\ [] \\ list_assn R a c \\\\<^sub>A list_assn R (butlast a) (butlast c) * true\"\n by (cases c rule: rev_cases; cases a rule: rev_cases; sep_auto; fail)+\n\nprivate lemma swap_decomp_simp[simp]: \n \"swap (l1 @ x # c21' @ xa # l2a) (length l1) (Suc (length l1 + length c21')) = l1@xa#c21'@x#l2a\"\n \"swap (l1 @ x # c21' @ xa # l2a) (Suc (length l1 + length c21')) (length l1) = l1@xa#c21'@x#l2a\"\n by (auto simp: swap_def list_update_append nth_append)\n\nprivate lemma list_swap_aux: \"\\i < length l; j < length l\\ \\ list_assn A l li \\\\<^sub>A list_assn A (swap l i j) (swap li i j) * true\"\n apply (subst list_assn_aux_len; clarsimp)\n apply (cases \"i=j\"; (sep_auto;fail)?)\n apply (rule id_take_nth_drop_rl[where l=l and i=i]; simp)\n apply (rule id_take_nth_drop_rl[where l=l and i=j]; simp)\n apply (erule list_match_lel_lel; simp)\n apply (split_list_according li l; sep_auto)\n apply (split_list_according li l; sep_auto)\n done\n \nprivate lemma list_rotate1_aux: \"list_assn A a c \\\\<^sub>A list_assn A (rotate1 a) (rotate1 c) * true\" \n by (cases a; cases c; sep_auto)\n\nprivate lemma list_rev_aux: \"list_assn A a c \\\\<^sub>A list_assn A (rev a) (rev c) * true\"\n apply (subst list_assn_aux_len; clarsimp)\n apply (induction rule: list_induct2)\n apply sep_auto\n apply sep_auto\n apply (erule ent_frame_fwd, frame_inference)\n apply sep_auto\n done\n\nlemma mod_starE: \n assumes \"h \\ A*B\"\n obtains h1 h2 where \"h1\\A\" \"h2\\B\"\n using assms by (auto simp: mod_star_conv)\n\nprivate lemma CONSTRAINT_is_pureE:\n assumes \"CONSTRAINT is_pure A\"\n obtains R where \"A=pure R\"\n using assms by (auto simp: is_pure_conv)\n\nprivate method solve_dbg = \n ( (elim CONSTRAINT_is_pureE; (simp only: list_assn_pure_conv the_pure_pure)?)?;\n sep_auto \n simp: pure_def hn_ctxt_def invalid_assn_def list_assn_aux_eqlen_simp \n intro!: hn_refineI[THEN hn_refine_preI] hfrefI \n elim!: mod_starE\n intro: list_set_entails_aux list_set_hd_tl_aux list_set_last_butlast_aux\n list_swap_aux list_rotate1_aux list_rev_aux\n ;\n ((rule entails_preI; sep_auto simp: list_assn_aux_eqlen_simp | (parametricity; simp; fail))?)\n )\n\nprivate method solve = solve_dbg; fail\n\n(* TODO: Establish sepref_import param mechanism that can handle this! *)\n\nlemma HOL_list_empty_hnr_aux: \"(uncurry0 (return op_list_empty), uncurry0 (RETURN op_list_empty)) \\ unit_assn\\<^sup>k \\\\<^sub>a (list_assn A)\" by solve\nlemma HOL_list_is_empty_hnr[sepref_fr_rules]: \"(return \\ op_list_is_empty, RETURN \\ op_list_is_empty) \\ (list_assn A)\\<^sup>k \\\\<^sub>a bool_assn\" by solve\nlemma HOL_list_prepend_hnr[sepref_fr_rules]: \"(uncurry (return \\\\ op_list_prepend), uncurry (RETURN \\\\ op_list_prepend)) \\ A\\<^sup>d *\\<^sub>a (list_assn A)\\<^sup>d \\\\<^sub>a list_assn A\" by solve\nlemma HOL_list_append_hnr[sepref_fr_rules]: \"(uncurry (return \\\\ op_list_append), uncurry (RETURN \\\\ op_list_append)) \\ (list_assn A)\\<^sup>d *\\<^sub>a A\\<^sup>d \\\\<^sub>a list_assn A\" by solve\nlemma HOL_list_concat_hnr[sepref_fr_rules]: \"(uncurry (return \\\\ op_list_concat), uncurry (RETURN \\\\ op_list_concat)) \\ (list_assn A)\\<^sup>d *\\<^sub>a (list_assn A)\\<^sup>d \\\\<^sub>a list_assn A\" by solve\nlemma HOL_list_length_hnr[sepref_fr_rules]: \"(return \\ op_list_length, RETURN \\ op_list_length) \\ (list_assn A)\\<^sup>k \\\\<^sub>a nat_assn\" by solve\nlemma HOL_list_set_hnr[sepref_fr_rules]: \"(uncurry2 (return \\\\\\ op_list_set), uncurry2 (RETURN \\\\\\ op_list_set)) \\ (list_assn A)\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a A\\<^sup>d \\\\<^sub>a list_assn A\" by solve\nlemma HOL_list_hd_hnr[sepref_fr_rules]: \"(return \\ op_list_hd, RETURN \\ op_list_hd) \\ [\\y. y \\ []]\\<^sub>a (list_assn R)\\<^sup>d \\ R\" by solve\nlemma HOL_list_tl_hnr[sepref_fr_rules]: \"(return \\ op_list_tl, RETURN \\ op_list_tl) \\ [\\y. y \\ []]\\<^sub>a (list_assn A)\\<^sup>d \\ list_assn A\" by solve\nlemma HOL_list_last_hnr[sepref_fr_rules]: \"(return \\ op_list_last, RETURN \\ op_list_last) \\ [\\y. y \\ []]\\<^sub>a (list_assn R)\\<^sup>d \\ R\" by solve\n\n\nlemma HOL_list_replicate_hnr[sepref_fr_rules]: \"CONSTRAINT is_pure A \\ (uncurry (return \\\\ op_list_replicate), uncurry (RETURN \\\\ op_list_replicate)) \\ nat_assn\\<^sup>k *\\<^sub>a A\\<^sup>k \\\\<^sub>a list_assn A\" by solve\nlemma HOL_list_get_hnr[sepref_fr_rules]: \"CONSTRAINT is_pure A \\ (uncurry (return \\\\ op_list_get), uncurry (RETURN \\\\ op_list_get)) \\ [\\(a, b). b < length a]\\<^sub>a (list_assn A)\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\ A\" by solve\n\n(* TODO: Ad-hoc hack! *)\nprivate lemma bool_by_paramE: \"\\ a; (a,b)\\Id \\ \\ b\" by simp\nprivate lemma bool_by_paramE': \"\\ a; (b,a)\\Id \\ \\ b\" by simp\n\nlemma HOL_list_contains_hnr[sepref_fr_rules]: \"\\CONSTRAINT is_pure A; single_valued (the_pure A); single_valued ((the_pure A)\\)\\\n \\ (uncurry (return \\\\ op_list_contains), uncurry (RETURN \\\\ op_list_contains)) \\ A\\<^sup>k *\\<^sub>a (list_assn A)\\<^sup>k \\\\<^sub>a bool_assn\" \n apply solve_dbg\n apply (erule bool_by_paramE[where a=\"_\\set _\"]) apply parametricity\n apply (erule bool_by_paramE'[where a=\"_\\set _\"]) apply parametricity\n done\n \n\nlemmas HOL_list_empty_hnr_mop = HOL_list_empty_hnr_aux[FCOMP mk_mop_rl0_np[OF mop_list_empty_alt]]\nlemmas HOL_list_is_empty_hnr_mop[sepref_fr_rules] = HOL_list_is_empty_hnr[FCOMP mk_mop_rl1_np[OF mop_list_is_empty_alt]]\nlemmas HOL_list_prepend_hnr_mop[sepref_fr_rules] = HOL_list_prepend_hnr[FCOMP mk_mop_rl2_np[OF mop_list_prepend_alt]]\nlemmas HOL_list_append_hnr_mop[sepref_fr_rules] = HOL_list_append_hnr[FCOMP mk_mop_rl2_np[OF mop_list_append_alt]]\nlemmas HOL_list_concat_hnr_mop[sepref_fr_rules] = HOL_list_concat_hnr[FCOMP mk_mop_rl2_np[OF mop_list_concat_alt]]\nlemmas HOL_list_length_hnr_mop[sepref_fr_rules] = HOL_list_length_hnr[FCOMP mk_mop_rl1_np[OF mop_list_length_alt]]\nlemmas HOL_list_set_hnr_mop[sepref_fr_rules] = HOL_list_set_hnr[FCOMP mk_mop_rl3[OF mop_list_set_alt]]\nlemmas HOL_list_hd_hnr_mop[sepref_fr_rules] = HOL_list_hd_hnr[FCOMP mk_mop_rl1[OF mop_list_hd_alt]]\nlemmas HOL_list_tl_hnr_mop[sepref_fr_rules] = HOL_list_tl_hnr[FCOMP mk_mop_rl1[OF mop_list_tl_alt]]\nlemmas HOL_list_last_hnr_mop[sepref_fr_rules] = HOL_list_last_hnr[FCOMP mk_mop_rl1[OF mop_list_last_alt]]\nlemmas HOL_list_butlast_hnr_mop[sepref_fr_rules] = HOL_list_butlast_hnr[FCOMP mk_mop_rl1[OF mop_list_butlast_alt]]\nlemmas HOL_list_swap_hnr_mop[sepref_fr_rules] = HOL_list_swap_hnr[FCOMP mk_mop_rl3[OF mop_list_swap_alt]]\nlemmas HOL_list_rotate1_hnr_mop[sepref_fr_rules] = HOL_list_rotate1_hnr[FCOMP mk_mop_rl1_np[OF mop_list_rotate1_alt]]\nlemmas HOL_list_rev_hnr_mop[sepref_fr_rules] = HOL_list_rev_hnr[FCOMP mk_mop_rl1_np[OF mop_list_rev_alt]]\nlemmas HOL_list_replicate_hnr_mop[sepref_fr_rules] = HOL_list_replicate_hnr[FCOMP mk_mop_rl2_np[OF mop_list_replicate_alt]]\nlemmas HOL_list_get_hnr_mop[sepref_fr_rules] = HOL_list_get_hnr[FCOMP mk_mop_rl2[OF mop_list_get_alt]]\nlemmas HOL_list_contains_hnr_mop[sepref_fr_rules] = HOL_list_contains_hnr[FCOMP mk_mop_rl2_np[OF mop_list_contains_alt]]\n\nlemmas HOL_list_empty_hnr = HOL_list_empty_hnr_aux HOL_list_empty_hnr_mop\n\nend\n\ndefinition [simp]: \"op_HOL_list_empty \\ op_list_empty\"\ninterpretation HOL_list: list_custom_empty \"list_assn A\" \"return []\" op_HOL_list_empty\n apply unfold_locales\n apply (sep_auto intro!: hfrefI hn_refineI)\n by simp\n\n\nschematic_goal\n notes [sepref_fr_rules] = HOL_list_empty_hnr\n shows\n \"hn_refine (emp) (?c::?'c Heap) ?\\' ?R (do {\n x \\ RETURN [1,2,3::nat];\n let x2 = op_list_append x 5;\n ASSERT (length x = 4);\n let x = op_list_swap x 1 2;\n x \\ mop_list_swap x 1 2;\n RETURN (x@x)\n })\" \n by sepref\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/IICF_HOL_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2618379106627909}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Sep_Tactic_Examples\nimports\n \"SepDSpec.Sep_Tactic_Helper\"\n KHeap_DP\nbegin\n\n\n(* Thesis : Automated Tactics for Seperation Logic *)\n\n(* seperation logic *)\n\n(* after we show that addition and disjointedness on our heap obeys certain laws, we get a seperation algebra *)\n\n(* connectives *)\n\nterm \"P \\* Q\"\n\nterm \"P \\* Q\"\n\nlemma frame_rule:\n \"\\R. \\P\\ f \\\\_. Q\\ \\ \\P \\* R\\ f \\\\_. Q \\* R\\\"\n oops\n\nlemma\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp set_cap_wp) (* set_cap doesn't apply *)\nthm set_cap_wp[no_vars]\n apply (rule hoare_strengthen_post)\n apply (wp set_cap_wp)\n apply (clarsimp simp: sep_conj_ac )\noops\n\n\n(* tactics we had pre-thesis *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4)\n apply (sep_select_asm 3)\n apply (sep_select 2)\n apply (sep_cancel)\n apply (sep_cancel)\n apply (sep_cancel)\ndone\n\n(* forward reasoning *)\n\n\nlemma example_drule:\n \"(ptr \\o obj) s\n \\ (ptr \\S obj \\* ptr \\f obj) s\"\n by (metis sep_conj_commute sep_map_o_decomp)\n\nlemma sep_drule_example:\n \"(ptr \\o obj \\* A \\* B ) s\n \\ (A \\* B \\* ptr \\f obj \\* ptr \\S obj) s\"\n apply (sep_drule example_drule)\n apply (sep_solve)\ndone\n\n(* backwards reasoning *)\n\nlemma example_rule:\n \"(ptr \\f obj \\* ptr \\S obj) s\n \\ (ptr \\o obj) s\"\n by (metis sep_map_o_decomp)\n\nlemma sep_rule_example: \"(ptr \\f obj \\* A \\* B \\* ptr \\S obj ) s \\ (ptr \\o obj \\* A \\* B) s\"\n apply (sep_rule example_rule)\n apply (sep_solve)\ndone\n\n\n\n(* the state of proving before new stuff *)\n\nlemma swap_cap_wp_old:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp add: swap_cap_def)\n apply (wp swap_parents_wp set_cap_wp)\n apply (rule hoare_chain)\n apply (rule set_cap_wp)\n apply (sep_solve)+\ndone\n\n\nlemma move_cap_wp_old:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n including no_pre\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp)\n apply (rule hoare_strengthen_post)\n apply (rule set_cap_wp)\n apply (sep_select 2)\n apply (sep_solve)\n apply (rule hoare_chain)\n apply (rule insert_cap_orphan_wp)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\nlemma invoke_cnode_rotate2_wp_old:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n including no_pre\n apply (clarsimp simp: invoke_cnode_def)\n apply (wp)\n apply (rule hoare_strengthen_post)\n apply (rule move_cap_wp)\n apply (sep_solve )\n apply (rule hoare_chain)\n apply (rule move_cap_wp)\n apply (sep_select_asm 2, sep_select_asm 3)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\n(* new sep_select/asm *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4 3 2 1)\n apply (sep_select_asm 4 3 2 1)\n apply (sep_select_asm 2 4)\noops\n\n\n(* sep_select_pre/post *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\n(* can be made to work for arbitrary monads *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, \\E\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, -\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"(P \\* (P \\* Q)) s \\ Q s\"\n apply (sep_mp, assumption )\n done\n\nlemma \"P s \\ (Q \\* (P \\* Q)) s\"\n apply (erule sep_curry[rotated])\n apply (assumption)\n done\n\n\n(* wp tactic testing *)\n\n\n(* sep_wand approach *)\n\nmethod_setup debug = \\\n Attrib.thms >> (fn _ => fn ctxt =>\n let\n val wp_pre_tac = SELECT_GOAL (NO_CONTEXT_TACTIC ctxt\n (Method_Closure.apply_method ctxt @{method wp_pre} [] [] [] ctxt []))\n in\n SIMPLE_METHOD' (CHANGED o wp_pre_tac)\n end\n)\n\\\n\nlemma move_cap_wp2:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (sep_wp set_cap_wp swap_parents_wp insert_cap_orphan_wp)+\n apply (sep_solve)\n done\n\nlemma swap_cap_wp2:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp: swap_cap_def)\n apply (sep_wp swap_parents_wp set_cap_wp)+\n apply (sep_solve)\n done\n\nlemma invoke_cnode_rotate2_wp:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n apply (clarsimp simp: invoke_cnode_def)\n apply (sep_wp move_cap_wp)+\n apply (sep_solve)\n done\n\n\n(* sep_drule/rule *)\n\nlemma sep_rule_example2:\n \"\\(ptr \\o obj) s; finite (dom (object_slots obj))\\ \\\n (ptr \\E obj \\* ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (subst (asm) sep_map_o_decomp)\n apply (subst (asm) sep_map_S_decomp, simp+)\n apply sep_solve\n done\n\nlemma sep_drule_example2:\n \"\\(ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* ptr \\E obj) s;\n finite (dom (object_slots obj))\\\n \\\n (ptr \\o obj) s\"\n by (metis sep_map_S_decomp sep_map_o_decomp)\n\n(* sep_curry *)\n\nlemma sep_drule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\f obj \\* A \\* B \\*\n (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* D \\* G \\* E \\* F \\* ptr \\E obj ) s;\n finite (dom (object_slots obj))\\\n \\\n (D \\* G \\* E \\* F \\* ptr \\o obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B) s\"\n apply (sep_drule sep_drule_example2)\n apply assumption\n apply sep_solve\n done\n\n\n(* sep_back *)\n\n\nlemma sep_rule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\o obj \\* A \\* B \\* D \\* G \\* E \\* F ) s;\n finite (dom (object_slots obj))\\ \\\n (D \\* G \\* E \\* F \\* ptr \\f obj \\* H \\* Z \\* J \\* L \\* Y \\* ptr \\E obj \\*\n A \\* B \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (sep_rule sep_rule_example2)\n apply sep_solve\n apply assumption\n done\n\n\n(* works even with multiple conjuncts in assumptions and conclusions *)\nlemma sep_rule_double_conjunct_example:\n \"\\((obj_id, slot) \\c cap \\* obj_id \\f obj) s;\n object_slots obj slot = Some cap\\\n \\ ((obj_id, slot) \\s obj \\* obj_id \\f obj) s\"\n apply (sep_drule sep_map_s_sep_map_c)\n apply assumption\n apply (sep_cancel)+\n done\n\nlemma sep_rule_double_conjunct_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_rule sep_rule_double_conjunct_example)\n apply sep_solve\n apply assumption\n done\n\n(* side-conditions*)\n\n\nlemma sep_drule_side_condition_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_drule sep_rule_double_conjunct_example, assumption)\n apply (sep_solve)\n done\n\nschematic_goal \"(P \\* ?A) s \\ (A \\* B \\* P) s\"\n apply (sep_solve)\n done\n\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/capDL-api/Sep_Tactic_Examples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2618379106627909}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Sep_ImpI\nimports Sep_Provers Sep_Cancel_Set Sep_Tactic_Helpers\nbegin\n\nlemma sep_wand_lens: \"(\\s. T s = Q s) \\ ((P \\* T) \\* R) s \\ ((P \\* Q) \\* R) s\"\n apply (sep_erule_full refl_imp)\n apply (clarsimp simp: sep_impl_def)\n done\n\nlemma sep_wand_lens': \"(\\s. T s = Q s) \\ ((T \\* P) \\* R) s \\ ((Q \\* P) \\* R) s\" \n apply (sep_erule_full refl_imp, erule sep_curry[rotated])\n apply (clarsimp)\n apply (erule sep_mp)\n done\n\n(* Removing wands from the conclusions *)\n\nML {* \n\nfun sep_wand_lens ctxt = resolve_tac ctxt[@{thm sep_wand_lens}]\nfun sep_wand_lens' ctxt = resolve_tac ctxt [@{thm sep_wand_lens'}]\n\nfun sep_wand_rule_tac tac ctxt =\n let\n val r = rotator' ctxt\n in \n tac |> r (sep_wand_lens' ctxt) |> r (sep_wand_lens ctxt) |> r (sep_select ctxt)\n end\n\nfun sep_wand_rule_tac' thms ctxt =\n let \n val r = rotator' ctxt\n in\n eresolve_tac ctxt thms |> r (sep_wand_lens ctxt) |> r (sep_select ctxt) |> r (sep_asm_select ctxt)\n end\n\nfun sep_wand_rule_method thms ctxt = SIMPLE_METHOD' (sep_wand_rule_tac thms ctxt)\nfun sep_wand_rule_method' thms ctxt = SIMPLE_METHOD' (sep_wand_rule_tac' thms ctxt)\n\n*}\n\n\nlemma sep_wand_match:\n \"(\\s. Q s \\ Q' s) \\ (R \\* R') s ==> (Q \\* R \\* Q' \\* R') s\" \n apply (erule sep_curry[rotated])\n apply (sep_select_asm 1 3)\n apply (sep_drule (direct) sep_mp_frame)\n apply (sep_erule_full refl_imp, clarsimp)\n done\n\nlemma sep_wand_trivial: \"(\\s. Q s \\ Q' s) \\ R' s ==> (Q \\* Q' \\* R') s\"\n apply (erule sep_curry[rotated])\n apply (sep_erule_full refl_imp)\n apply (clarsimp)\n done \n\nlemma sep_wand_collapse: \"(P \\* Q \\* R) s \\ (P \\* Q \\* R) s \"\n apply (erule sep_curry[rotated])+\n apply (clarsimp simp: sep_conj_assoc)\n apply (erule sep_mp)\n done\n\nlemma sep_wand_match_less_safe: \n assumes drule: \" \\s. (Q' \\* R) s \\ ((P \\* R') \\* Q' \\* R'' ) s \"\n shows \"(Q' \\* R) s \\ (\\s. Q' s \\ Q s) \\ ((P \\* Q \\* R') \\* R'') s\" \n apply (drule drule)\n apply (sep_erule_full refl_imp)\n apply (erule sep_conj_sep_impl)\n apply (clarsimp simp: sep_conj_assoc)\n apply (sep_select_asm 1 3)\n apply (sep_drule (direct) sep_mp_frame, sep_erule_full refl_imp)\n apply (clarsimp)\n done\n \nML {*\nfun sep_match_trivial_tac ctxt =\n let\n fun flip f a b = f b a \n val sep_cancel = flip (sep_apply_tactic ctxt) (SepCancel_Rules.get ctxt |> rev)\n fun f x = x |> rotate_prems ~1 |> (fn x => [x]) |> eresolve0_tac |> sep_cancel\n val sep_thms = map f [@{thm sep_wand_trivial}, @{thm sep_wand_match}]\n in\n sep_wand_rule_tac (resolve0_tac [@{thm sep_rule}] THEN' FIRST' sep_thms) ctxt\n end\n\nfun sep_safe_method ctxt = SIMPLE_METHOD' (sep_match_trivial_tac ctxt)\n*}\n\nmethod_setup sep_safe = {* \n Scan.succeed (sep_safe_method) \n*}\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/Sep_ImpI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2618379106627909}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory NonDetMonadVCG\nimports NonDetMonadLemmas WP WPC\nbegin\n\ndeclare K_def [simp]\n\nsection \"Satisfiability\"\n\ntext {*\n The dual to validity: an existential instead of a universal\n quantifier for the post condition. In refinement, it is\n often sufficient to know that there is one state that\n satisfies a condition.\n*}\ndefinition\n exs_valid :: \"('a \\ bool) \\ ('a, 'b) nondet_monad \\\n ('b \\ 'a \\ bool) \\ bool\"\n (\"\\_\\ _ \\\\_\\\")\nwhere\n \"exs_valid P f Q \\ (\\s. P s \\ (\\(rv, s') \\ fst (f s). Q rv s'))\"\n\n\ntext {* The above for the exception monad *}\ndefinition\n ex_exs_validE :: \"('a \\ bool) \\ ('a, 'e + 'b) nondet_monad \\\n ('b \\ 'a \\ bool) \\ ('e \\ 'a \\ bool) \\ bool\"\n (\"\\_\\ _ \\\\_\\, \\_\\\")\nwhere\n \"ex_exs_validE P f Q E \\\n exs_valid P f (\\rv. case rv of Inl e \\ E e | Inr v \\ Q v)\"\n\n\nsection \"Lemmas\"\n\nsubsection {* Determinism *}\n\nlemma det_set_iff:\n \"det f \\ (r \\ fst (f s)) = (fst (f s) = {r})\"\n apply (simp add: det_def)\n apply (rule iffI)\n apply (erule_tac x=s in allE)\n apply auto\n done\n\nlemma return_det [iff]:\n \"det (return x)\"\n by (simp add: det_def return_def)\n\nlemma put_det [iff]:\n \"det (put s)\"\n by (simp add: det_def put_def)\n\nlemma get_det [iff]:\n \"det get\"\n by (simp add: det_def get_def)\n\nlemma det_gets [iff]:\n \"det (gets f)\"\n by (auto simp add: gets_def det_def get_def return_def bind_def)\n\nlemma det_UN:\n \"det f \\ (\\x \\ fst (f s). g x) = (g (THE x. x \\ fst (f s)))\"\n unfolding det_def\n apply simp\n apply (drule spec [of _ s])\n apply clarsimp\n done\n\nlemma bind_detI [simp, intro!]:\n \"\\ det f; \\x. det (g x) \\ \\ det (f >>= g)\"\n apply (simp add: bind_def det_def split_def)\n apply clarsimp\n apply (erule_tac x=s in allE)\n apply clarsimp\n apply (erule_tac x=\"a\" in allE)\n apply (erule_tac x=\"b\" in allE)\n apply clarsimp\n done\n\nlemma the_run_stateI:\n \"fst (M s) = {s'} \\ the_run_state M s = s'\"\n by (simp add: the_run_state_def)\n\nlemma the_run_state_det:\n \"\\ s' \\ fst (M s); det M \\ \\ the_run_state M s = s'\"\n by (simp add: the_run_stateI det_set_iff)\n\nsubsection \"Lifting and Alternative Basic Definitions\"\n\nlemma liftE_liftM: \"liftE = liftM Inr\"\n apply (rule ext)\n apply (simp add: liftE_def liftM_def)\n done\n\nlemma liftME_liftM: \"liftME f = liftM (case_sum Inl (Inr \\ f))\"\n apply (rule ext)\n apply (simp add: liftME_def liftM_def bindE_def returnOk_def lift_def)\n apply (rule_tac f=\"bind x\" in arg_cong)\n apply (rule ext)\n apply (case_tac xa)\n apply (simp_all add: lift_def throwError_def)\n done\n\nlemma liftE_bindE:\n \"(liftE a) >>=E b = a >>= b\"\n apply (simp add: liftE_def bindE_def lift_def bind_assoc)\n done\n\nlemma liftM_id[simp]: \"liftM id = id\"\n apply (rule ext)\n apply (simp add: liftM_def)\n done\n\nlemma liftM_bind:\n \"(liftM t f >>= g) = (f >>= (\\x. g (t x)))\"\n by (simp add: liftM_def bind_assoc)\n\nlemma gets_bind_ign: \"gets f >>= (\\x. m) = m\"\n apply (rule ext)\n apply (simp add: bind_def simpler_gets_def)\n done\n\nlemma get_bind_apply: \"(get >>= f) x = f x x\"\n by (simp add: get_def bind_def)\n\n\n\nlemma exec_get:\n \"(get >>= m) s = m s s\"\n by (simp add: get_def bind_def)\n\nlemma bind_eqI:\n \"\\ f = f'; \\x. g x = g' x \\ \\ f >>= g = f' >>= g'\"\n apply (rule ext)\n apply (simp add: bind_def)\n apply (auto simp: split_def)\n done\n\nsubsection \"Simplification Rules for Lifted And/Or\"\n\nlemma pred_andE[elim!]: \"\\ (A and B) x; \\ A x; B x \\ \\ R \\ \\ R\"\n by(simp add:pred_conj_def)\n\nlemma pred_andI[intro!]: \"\\ A x; B x \\ \\ (A and B) x\"\n by(simp add:pred_conj_def)\n\nlemma pred_conj_app[simp]: \"(P and Q) x = (P x \\ Q x)\"\n by(simp add:pred_conj_def)\n\nlemma bipred_andE[elim!]: \"\\ (A And B) x y; \\ A x y; B x y \\ \\ R \\ \\ R\"\n by(simp add:bipred_conj_def)\n\nlemma bipred_andI[intro!]: \"\\ A x y; B x y \\ \\ (A And B) x y\"\n by (simp add:bipred_conj_def)\n\nlemma bipred_conj_app[simp]: \"(P And Q) x = (P x and Q x)\"\n by(simp add:pred_conj_def bipred_conj_def)\n\nlemma pred_disjE[elim!]: \"\\ (P or Q) x; P x \\ R; Q x \\ R \\ \\ R\"\n by (fastforce simp: pred_disj_def)\n\nlemma pred_disjI1[intro]: \"P x \\ (P or Q) x\"\n by (simp add: pred_disj_def)\n\nlemma pred_disjI2[intro]: \"Q x \\ (P or Q) x\"\n by (simp add: pred_disj_def)\n\nlemma pred_disj_app[simp]: \"(P or Q) x = (P x \\ Q x)\"\n by auto\n\nlemma bipred_disjI1[intro]: \"P x y \\ (P Or Q) x y\"\n by (simp add: bipred_disj_def)\n\nlemma bipred_disjI2[intro]: \"Q x y \\ (P Or Q) x y\"\n by (simp add: bipred_disj_def)\n\nlemma bipred_disj_app[simp]: \"(P Or Q) x = (P x or Q x)\"\n by(simp add:pred_disj_def bipred_disj_def)\n\nlemma pred_notnotD[simp]: \"(not not P) = P\"\n by(simp add:pred_neg_def)\n\nlemma pred_and_true[simp]: \"(P and \\) = P\"\n by(simp add:pred_conj_def)\n\nlemma pred_and_true_var[simp]: \"(\\ and P) = P\"\n by(simp add:pred_conj_def)\n\nlemma pred_and_false[simp]: \"(P and \\) = \\\"\n by(simp add:pred_conj_def)\n\nlemma pred_and_false_var[simp]: \"(\\ and P) = \\\"\n by(simp add:pred_conj_def)\n\nsubsection \"Hoare Logic Rules\"\n\nlemma validE_def2:\n \"\\P\\ f \\Q\\,\\R\\ \\ \\s. P s \\ (\\(r,s') \\ fst (f s). case r of Inr b \\ Q b s'\n | Inl a \\ R a s')\"\n by (unfold valid_def validE_def)\n\nlemma seq':\n \"\\ \\A\\ f \\B\\;\n \\x. P x \\ \\C\\ g x \\D\\;\n \\x s. B x s \\ P x \\ C s \\ \\\n \\A\\ do x \\ f; g x od \\D\\\"\n apply (clarsimp simp: valid_def bind_def)\n apply fastforce\n done\n\nlemma seq:\n assumes f_valid: \"\\A\\ f \\B\\\"\n assumes g_valid: \"\\x. P x \\ \\C\\ g x \\D\\\"\n assumes bind: \"\\x s. B x s \\ P x \\ C s\"\n shows \"\\A\\ do x \\ f; g x od \\D\\\"\napply (insert f_valid g_valid bind)\napply (blast intro: seq')\ndone\n\nlemma seq_ext':\n \"\\ \\A\\ f \\B\\;\n \\x. \\B x\\ g x \\C\\ \\ \\\n \\A\\ do x \\ f; g x od \\C\\\"\n by (fastforce simp: valid_def bind_def Let_def split_def)\n\nlemma seq_ext:\n assumes f_valid: \"\\A\\ f \\B\\\"\n assumes g_valid: \"\\x. \\B x\\ g x \\C\\\"\n shows \"\\A\\ do x \\ f; g x od \\C\\\"\n apply(insert f_valid g_valid)\n apply(blast intro: seq_ext')\ndone\n\nlemma seqE':\n \"\\ \\A\\ f \\B\\,\\E\\;\n \\x. \\B x\\ g x \\C\\,\\E\\ \\ \\\n \\A\\ doE x \\ f; g x odE \\C\\,\\E\\\"\n apply(simp add:bindE_def lift_def bind_def Let_def split_def)\n apply(clarsimp simp:validE_def2)\n apply (fastforce simp add: throwError_def return_def lift_def\n split: sum.splits)\n done\n\nlemma seqE:\n assumes f_valid: \"\\A\\ f \\B\\,\\E\\\"\n assumes g_valid: \"\\x. \\B x\\ g x \\C\\,\\E\\\"\n shows \"\\A\\ doE x \\ f; g x odE \\C\\,\\E\\\"\n apply(insert f_valid g_valid)\n apply(blast intro: seqE')\n done\n\nlemma hoare_TrueI: \"\\P\\ f \\\\_. \\\\\"\n by (simp add: valid_def)\n\nlemma hoareE_TrueI: \"\\P\\ f \\\\_. \\\\, \\\\r. \\\\\"\n by (simp add: validE_def valid_def)\n\nlemma hoare_True_E_R [simp]:\n \"\\P\\ f \\\\r s. True\\, -\"\n by (auto simp add: validE_R_def validE_def valid_def split: sum.splits)\n\nlemma hoare_post_conj [intro!]:\n \"\\ \\ P \\ a \\ Q \\; \\ P \\ a \\ R \\ \\ \\ \\ P \\ a \\ Q And R \\\"\n by (fastforce simp: valid_def split_def bipred_conj_def)\n\nlemma hoare_pre_disj [intro!]:\n \"\\ \\ P \\ a \\ R \\; \\ Q \\ a \\ R \\ \\ \\ \\ P or Q \\ a \\ R \\\"\n by (simp add:valid_def pred_disj_def)\n\nlemma hoare_conj:\n \"\\ \\P\\ f \\Q\\; \\P'\\ f \\Q'\\ \\ \\ \\P and P'\\ f \\Q And Q'\\\"\n unfolding valid_def by auto\n\nlemma hoare_post_taut: \"\\ P \\ a \\ \\\\ \\\"\n by (simp add:valid_def)\n\nlemma wp_post_taut: \"\\\\r. True\\ f \\\\r s. True\\\"\n by (rule hoare_post_taut)\n\nlemma wp_post_tautE: \"\\\\r. True\\ f \\\\r s. True\\,\\\\f s. True\\\"\nproof -\n have P: \"\\r. (case r of Inl a \\ True | _ \\ True) = True\"\n by (case_tac r, simp_all)\n show ?thesis\n by (simp add: validE_def P wp_post_taut)\nqed\n\nlemma hoare_pre_cont [simp]: \"\\ \\ \\ a \\ P \\\"\n by (simp add:valid_def)\n\n\nsubsection {* Strongest Postcondition Rules *}\n\nlemma get_sp:\n \"\\P\\ get \\\\a s. s = a \\ P s\\\"\n by(simp add:get_def valid_def)\n\nlemma put_sp:\n \"\\\\\\ put a \\\\_ s. s = a\\\"\n by(simp add:put_def valid_def)\n\nlemma return_sp:\n \"\\P\\ return a \\\\b s. b = a \\ P s\\\"\n by(simp add:return_def valid_def)\n\nlemma assert_sp:\n \"\\ P \\ assert Q \\ \\r s. P s \\ Q \\\"\n by (simp add: assert_def fail_def return_def valid_def)\n\nlemma hoare_gets_sp:\n \"\\P\\ gets f \\\\rv s. rv = f s \\ P s\\\"\n by (simp add: valid_def simpler_gets_def)\n\nlemma hoare_return_drop_var [iff]: \"\\ Q \\ return x \\ \\r. Q \\\"\n by (simp add:valid_def return_def)\n\nlemma hoare_gets [intro!]: \"\\ \\s. P s \\ Q (f s) s \\ \\ \\ P \\ gets f \\ Q \\\"\n by (simp add:valid_def gets_def get_def bind_def return_def)\n\nlemma hoare_modifyE_var [intro!]:\n \"\\ \\s. P s \\ Q (f s) \\ \\ \\ P \\ modify f \\ \\r s. Q s \\\"\n by(simp add: valid_def modify_def put_def get_def bind_def)\n\nlemma hoare_if [intro!]:\n \"\\ P \\ \\ Q \\ a \\ R \\; \\ P \\ \\ Q \\ b \\ R \\ \\ \\\n \\ Q \\ if P then a else b \\ R \\\"\n by (simp add:valid_def)\n\nlemma hoare_pre_subst: \"\\ A = B; \\A\\ a \\C\\ \\ \\ \\B\\ a \\C\\\"\n by(clarsimp simp:valid_def split_def)\n\nlemma hoare_post_subst: \"\\ B = C; \\A\\ a \\B\\ \\ \\ \\A\\ a \\C\\\"\n by(clarsimp simp:valid_def split_def)\n\nlemma hoare_pre_tautI: \"\\ \\A and P\\ a \\B\\; \\A and not P\\ a \\B\\ \\ \\ \\A\\ a \\B\\\"\n by(fastforce simp:valid_def split_def pred_conj_def pred_neg_def)\n\nlemma hoare_pre_imp: \"\\ \\s. P s \\ Q s; \\Q\\ a \\R\\ \\ \\ \\P\\ a \\R\\\"\n by (fastforce simp add:valid_def)\n\nlemma hoare_post_imp: \"\\ \\r s. Q r s \\ R r s; \\P\\ a \\Q\\ \\ \\ \\P\\ a \\R\\\"\n by(fastforce simp:valid_def split_def)\n\nlemma hoare_post_impErr': \"\\ \\P\\ a \\Q\\,\\E\\;\n \\r s. Q r s \\ R r s;\n \\e s. E e s \\ F e s \\ \\\n \\P\\ a \\R\\,\\F\\\"\n apply (simp add: validE_def)\n apply (rule_tac Q=\"\\r s. case r of Inl a \\ E a s | Inr b \\ Q b s\" in hoare_post_imp)\n apply (case_tac r)\n apply simp_all\n done\n\nlemma hoare_post_impErr: \"\\ \\P\\ a \\Q\\,\\E\\;\n \\r s. Q r s \\ R r s;\n \\e s. E e s \\ F e s \\ \\\n \\P\\ a \\R\\,\\F\\\"\n apply (blast intro: hoare_post_impErr')\n done\n\nlemma hoare_validE_cases:\n \"\\ \\ P \\ f \\ Q \\, \\ \\_ _. True \\; \\ P \\ f \\ \\_ _. True \\, \\ R \\ \\\n \\ \\ P \\ f \\ Q \\, \\ R \\\"\n by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc:\n \"\\\\P\\ a \\\\r. Q\\; \\s. Q s \\ R s\\ \\ \\P\\ a \\\\r. R\\,\\\\r. R\\\"\n by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc2:\n \"\\\\P\\ a \\\\r. Q\\; \\s. Q s \\ R s\\ \\ \\P\\ a \\\\r. R\\,\\\\r s. True\\\"\n by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc2E:\n \"\\\\P\\ a \\\\r. Q\\; \\s. Q s \\ R s\\ \\ \\P\\ a \\\\r s. True\\, \\\\r. R\\\"\n by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_imp_dc2E_actual:\n \"\\\\P\\ a \\\\r. R\\\\ \\ \\P\\ a \\\\r s. True\\, \\\\r. R\\\"\n by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_imp_dc2_actual:\n \"\\\\P\\ a \\\\r. R\\\\ \\ \\P\\ a \\\\r. R\\, \\\\r s. True\\\"\n by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_impE: \"\\ \\r s. Q r s \\ R r s; \\P\\ a \\Q\\ \\ \\ \\P\\ a \\R\\\"\n by (fastforce simp:valid_def split_def)\n\nlemma hoare_conjD1:\n \"\\P\\ f \\\\rv. Q rv and R rv\\ \\ \\P\\ f \\\\rv. Q rv\\\"\n unfolding valid_def by auto\n\nlemma hoare_conjD2:\n \"\\P\\ f \\\\rv. Q rv and R rv\\ \\ \\P\\ f \\\\rv. R rv\\\"\n unfolding valid_def by auto\n\nlemma hoare_post_disjI1:\n \"\\P\\ f \\\\rv. Q rv\\ \\ \\P\\ f \\\\rv. Q rv or R rv\\\"\n unfolding valid_def by auto\n\nlemma hoare_post_disjI2:\n \"\\P\\ f \\\\rv. R rv\\ \\ \\P\\ f \\\\rv. Q rv or R rv\\\"\n unfolding valid_def by auto\n\nlemma hoare_weaken_pre:\n \"\\\\Q\\ a \\R\\; \\s. P s \\ Q s\\ \\ \\P\\ a \\R\\\"\n apply (rule hoare_pre_imp)\n prefer 2\n apply assumption\n apply blast\n done\n\nlemma hoare_strengthen_post:\n \"\\\\P\\ a \\Q\\; \\r s. Q r s \\ R r s\\ \\ \\P\\ a \\R\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply assumption\n apply blast\n done\n\nlemma use_valid: \"\\(r, s') \\ fst (f s); \\P\\ f \\Q\\; P s \\ \\ Q r s'\"\n apply (simp add: valid_def)\n apply blast\n done\n\nlemma use_validE_norm: \"\\ (Inr r', s') \\ fst (B s); \\ P \\ B \\ Q \\,\\ E \\; P s \\ \\ Q r' s'\"\n apply (clarsimp simp: validE_def valid_def)\n apply force\n done\n\nlemma use_validE_except: \"\\ (Inl r', s') \\ fst (B s); \\ P \\ B \\ Q \\,\\ E \\; P s \\ \\ E r' s'\"\n apply (clarsimp simp: validE_def valid_def)\n apply force\n done\n\nlemma in_inv_by_hoareD:\n \"\\ \\P. \\P\\ f \\\\_. P\\; (x,s') \\ fst (f s) \\ \\ s' = s\"\n by (auto simp add: valid_def) blast\n\nsubsection \"Satisfiability\"\n\nlemma exs_hoare_post_imp: \"\\\\r s. Q r s \\ R r s; \\P\\ a \\\\Q\\\\ \\ \\P\\ a \\\\R\\\"\n apply (simp add: exs_valid_def)\n apply safe\n apply (erule_tac x=s in allE, simp)\n apply blast\n done\n\nlemma use_exs_valid: \"\\\\P\\ f \\\\Q\\; P s \\ \\ \\(r, s') \\ fst (f s). Q r s'\"\n by (simp add: exs_valid_def)\n\ndefinition \"exs_postcondition P f \\ (\\a b. \\(rv, s)\\ f a b. P rv s)\"\n\nlemma exs_valid_is_triple:\n \"exs_valid P f Q = triple_judgement P f (exs_postcondition Q (\\s f. fst (f s)))\"\n by (simp add: triple_judgement_def exs_postcondition_def exs_valid_def)\n\nlemmas [wp_trip] = exs_valid_is_triple\n\nlemma exs_valid_weaken_pre [wp_comb]:\n \"\\ \\ P' \\ f \\\\ Q \\; \\s. P s \\ P' s \\ \\ \\ P \\ f \\\\ Q \\\"\n apply atomize\n apply (clarsimp simp: exs_valid_def)\n done\n\nlemma exs_valid_chain:\n \"\\ \\ P \\ f \\\\ Q \\; \\s. R s \\ P s; \\r s. Q r s \\ S r s \\ \\ \\ R \\ f \\\\ S \\\"\n apply atomize\n apply (fastforce simp: exs_valid_def Bex_def)\n done\n\nlemma exs_valid_assume_pre:\n \"\\ \\s. P s \\ \\ P \\ f \\\\ Q \\ \\ \\ \\ P \\ f \\\\ Q \\\"\n apply (fastforce simp: exs_valid_def)\n done\n\nlemma exs_valid_bind [wp_split]:\n \"\\ \\x. \\B x\\ g x \\\\C\\; \\A\\ f \\\\B\\ \\ \\ \\ A \\ f >>= (\\x. g x) \\\\ C \\\"\n apply atomize\n apply (clarsimp simp: exs_valid_def bind_def')\n apply blast\n done\n\nlemma exs_valid_return [wp]:\n \"\\ Q v \\ return v \\\\ Q \\\"\n by (clarsimp simp: exs_valid_def return_def)\n\nlemma exs_valid_select [wp]:\n \"\\ \\s. \\r \\ S. Q r s \\ select S \\\\ Q \\\"\n by (clarsimp simp: exs_valid_def select_def)\n\nlemma exs_valid_get [wp]:\n \"\\ \\s. Q s s \\ get \\\\ Q \\\"\n by (clarsimp simp: exs_valid_def get_def)\n\nlemma exs_valid_gets [wp]:\n \"\\ \\s. Q (f s) s \\ gets f \\\\ Q \\\"\n by (clarsimp simp: gets_def, wp)\n\nlemma exs_valid_put [wp]:\n \"\\ Q v \\ put v \\\\ Q \\\"\n by (clarsimp simp: put_def exs_valid_def)\n\nlemma exs_valid_state_assert [wp]:\n \"\\ \\s. Q () s \\ G s \\ state_assert G \\\\ Q \\\"\n by (clarsimp simp: state_assert_def exs_valid_def get_def\n assert_def bind_def' return_def)\n\nlemmas exs_valid_guard = exs_valid_state_assert\n\nlemma exs_valid_fail [wp]:\n \"\\ \\_. False \\ fail \\\\ Q \\\"\n by (clarsimp simp: fail_def exs_valid_def)\n\nlemma exs_valid_condition [wp]:\n \"\\ \\ P \\ L \\\\ Q \\; \\ P' \\ R \\\\ Q \\ \\ \\\n \\ \\s. (C s \\ P s) \\ (\\ C s \\ P' s) \\ condition C L R \\\\ Q \\\"\n by (clarsimp simp: condition_def exs_valid_def split: sum.splits)\n\n\nsubsection MISC\n\nlemma hoare_return_simp:\n \"\\P\\ return x \\Q\\ = (\\s. P s \\ Q x s)\"\n by (simp add: valid_def return_def)\n\nlemma hoare_gen_asm:\n \"(P \\ \\P'\\ f \\Q\\) \\ \\P' and K P\\ f \\Q\\\"\n by (fastforce simp add: valid_def)\n\nlemma hoare_when_wp [wp]:\n \"\\ P \\ \\Q\\ f \\R\\ \\ \\ \\if P then Q else R ()\\ when P f \\R\\\"\n by (clarsimp simp: when_def valid_def return_def)\n\nlemma hoare_conjI:\n \"\\ \\P\\ f \\Q\\; \\P\\ f \\R\\ \\ \\ \\P\\ f \\\\r s. Q r s \\ R r s\\\"\n unfolding valid_def by blast\n\nlemma hoare_disjI1:\n \"\\ \\P\\ f \\Q\\ \\ \\ \\P\\ f \\\\r s. Q r s \\ R r s \\\"\n unfolding valid_def by blast\n\nlemma hoare_disjI2:\n \"\\ \\P\\ f \\R\\ \\ \\ \\P\\ f \\\\r s. Q r s \\ R r s \\\"\n unfolding valid_def by blast\n\nlemma hoare_assume_pre:\n \"(\\s. P s \\ \\P\\ f \\Q\\) \\ \\P\\ f \\Q\\\"\n by (auto simp: valid_def)\n\nlemma hoare_returnOk_sp:\n \"\\P\\ returnOk x \\\\r s. r = x \\ P s\\, \\Q\\\"\n by (simp add: valid_def validE_def returnOk_def return_def)\n\nlemma hoare_assume_preE:\n \"(\\s. P s \\ \\P\\ f \\Q\\,\\R\\) \\ \\P\\ f \\Q\\,\\R\\\"\n by (auto simp: valid_def validE_def)\n\nlemma hoare_allI:\n \"(\\x. \\P\\f\\Q x\\) \\ \\P\\f\\\\r s. \\x. Q x r s\\\"\n by (simp add: valid_def) blast\n\nlemma validE_allI:\n \"(\\x. \\P\\ f \\\\r s. Q x r s\\,\\E\\) \\ \\P\\ f \\\\r s. \\x. Q x r s\\,\\E\\\"\n by (fastforce simp: valid_def validE_def split: sum.splits)\n\nlemma hoare_exI:\n \"\\P\\ f \\Q x\\ \\ \\P\\ f \\\\r s. \\x. Q x r s\\\"\n by (simp add: valid_def) blast\n\nlemma hoare_impI:\n \"(R \\ \\P\\f\\Q\\) \\ \\P\\f\\\\r s. R \\ Q r s\\\"\n by (simp add: valid_def) blast\n\nlemma validE_impI:\n \" \\\\E. \\P\\ f \\\\_ _. True\\,\\E\\; (P' \\ \\P\\ f \\Q\\,\\E\\)\\ \\\n \\P\\ f \\\\r s. P' \\ Q r s\\, \\E\\\"\n by (fastforce simp: validE_def valid_def split: sum.splits)\n\nlemma hoare_case_option_wp:\n \"\\ \\P\\ f None \\Q\\;\n \\x. \\P' x\\ f (Some x) \\Q' x\\ \\\n \\ \\case_option P P' v\\ f v \\\\rv. case v of None \\ Q rv | Some x \\ Q' x rv\\\"\n by (cases v) auto\n\nsubsection \"Reasoning directly about states\"\n\nlemma in_throwError:\n \"((v, s') \\ fst (throwError e s)) = (v = Inl e \\ s' = s)\"\n by (simp add: throwError_def return_def)\n\nlemma in_returnOk:\n \"((v', s') \\ fst (returnOk v s)) = (v' = Inr v \\ s' = s)\"\n by (simp add: returnOk_def return_def)\n\nlemma in_bind:\n \"((r,s') \\ fst ((do x \\ f; g x od) s)) =\n (\\s'' x. (x, s'') \\ fst (f s) \\ (r, s') \\ fst (g x s''))\"\n apply (simp add: bind_def split_def)\n apply force\n done\n\nlemma in_bindE_R:\n \"((Inr r,s') \\ fst ((doE x \\ f; g x odE) s)) =\n (\\s'' x. (Inr x, s'') \\ fst (f s) \\ (Inr r, s') \\ fst (g x s''))\"\n apply (simp add: bindE_def lift_def split_def bind_def)\n apply (clarsimp simp: throwError_def return_def lift_def split: sum.splits)\n apply safe\n apply (case_tac a)\n apply fastforce\n apply fastforce\n apply force\n done\n\nlemma in_bindE_L:\n \"((Inl r, s') \\ fst ((doE x \\ f; g x odE) s)) \\\n (\\s'' x. (Inr x, s'') \\ fst (f s) \\ (Inl r, s') \\ fst (g x s'')) \\ ((Inl r, s') \\ fst (f s))\"\n apply (simp add: bindE_def lift_def bind_def)\n apply safe\n apply (simp add: return_def throwError_def lift_def split_def split: sum.splits split_if_asm)\n apply force\n done\n\nlemma in_liftE:\n \"((v, s') \\ fst (liftE f s)) = (\\v'. v = Inr v' \\ (v', s') \\ fst (f s))\"\n by (force simp add: liftE_def bind_def return_def split_def)\n\nlemma in_whenE: \"((v, s') \\ fst (whenE P f s)) = ((P \\ (v, s') \\ fst (f s)) \\\n (\\P \\ v = Inr () \\ s' = s))\"\n by (simp add: whenE_def in_returnOk)\n\nlemma inl_whenE:\n \"((Inl x, s') \\ fst (whenE P f s)) = (P \\ (Inl x, s') \\ fst (f s))\"\n by (auto simp add: in_whenE)\n\nlemma in_fail:\n \"r \\ fst (fail s) = False\"\n by (simp add: fail_def)\n\nlemma in_return:\n \"(r, s') \\ fst (return v s) = (r = v \\ s' = s)\"\n by (simp add: return_def)\n\nlemma in_assert:\n \"(r, s') \\ fst (assert P s) = (P \\ s' = s)\"\n by (simp add: assert_def return_def fail_def)\n\nlemma in_assertE:\n \"(r, s') \\ fst (assertE P s) = (P \\ r = Inr () \\ s' = s)\"\n by (simp add: assertE_def returnOk_def return_def fail_def)\n\nlemma in_assert_opt:\n \"(r, s') \\ fst (assert_opt v s) = (v = Some r \\ s' = s)\"\n by (auto simp: assert_opt_def in_fail in_return split: option.splits)\n\nlemma in_get:\n \"(r, s') \\ fst (get s) = (r = s \\ s' = s)\"\n by (simp add: get_def)\n\nlemma in_gets:\n \"(r, s') \\ fst (gets f s) = (r = f s \\ s' = s)\"\n by (simp add: simpler_gets_def)\n\nlemma in_put:\n \"(r, s') \\ fst (put x s) = (s' = x \\ r = ())\"\n by (simp add: put_def)\n\nlemma in_when:\n \"(v, s') \\ fst (when P f s) = ((P \\ (v, s') \\ fst (f s)) \\ (\\P \\ v = () \\ s' = s))\"\n by (simp add: when_def in_return)\n\nlemma in_modify:\n \"(v, s') \\ fst (modify f s) = (s'=f s \\ v = ())\"\n by (simp add: modify_def bind_def get_def put_def)\n\nlemma gets_the_in_monad:\n \"((v, s') \\ fst (gets_the f s)) = (s' = s \\ f s = Some v)\"\n by (auto simp: gets_the_def in_bind in_gets in_assert_opt split: option.split)\n\nlemma in_alternative:\n \"(r,s') \\ fst ((f \\ g) s) = ((r,s') \\ fst (f s) \\ (r,s') \\ fst (g s))\"\n by (simp add: alternative_def)\n\nlemmas in_monad = inl_whenE in_whenE in_liftE in_bind in_bindE_L\n in_bindE_R in_returnOk in_throwError in_fail\n in_assertE in_assert in_return in_assert_opt\n in_get in_gets in_put in_when unlessE_whenE\n unless_when in_modify gets_the_in_monad\n in_alternative\n\nsubsection \"Non-Failure\"\n\nlemma no_failD:\n \"\\ no_fail P m; P s \\ \\ \\(snd (m s))\"\n by (simp add: no_fail_def)\n\nlemma non_fail_modify [wp,simp]:\n \"no_fail \\ (modify f)\"\n by (simp add: no_fail_def modify_def get_def put_def bind_def)\n\nlemma non_fail_gets [simp]:\n \"no_fail \\ (gets f)\"\n by (simp add: no_fail_def simpler_gets_def)\n\nlemma non_fail_select [simp]:\n \"no_fail \\ (select S)\"\n by (simp add: no_fail_def select_def)\n\nlemma no_fail_pre:\n \"\\ no_fail P f; \\s. Q s \\ P s\\ \\ no_fail Q f\"\n by (simp add: no_fail_def)\n\nlemma no_fail_alt [wp]:\n \"\\ no_fail P f; no_fail Q g \\ \\ no_fail (P and Q) (f OR g)\"\n by (simp add: no_fail_def alternative_def)\n\nlemma no_fail_return [simp, wp]:\n \"no_fail \\ (return x)\"\n by (simp add: return_def no_fail_def)\n\nlemma no_fail_get [simp, wp]:\n \"no_fail \\ get\"\n by (simp add: get_def no_fail_def)\n\nlemma no_fail_put [simp, wp]:\n \"no_fail \\ (put s)\"\n by (simp add: put_def no_fail_def)\n\nlemma no_fail_when [wp]:\n \"(P \\ no_fail Q f) \\ no_fail (if P then Q else \\) (when P f)\"\n by (simp add: when_def)\n\nlemma no_fail_unless [wp]:\n \"(\\P \\ no_fail Q f) \\ no_fail (if P then \\ else Q) (unless P f)\"\n by (simp add: unless_def when_def)\n\nlemma no_fail_fail [simp, wp]:\n \"no_fail \\ fail\"\n by (simp add: fail_def no_fail_def)\n\nlemmas [wp] = non_fail_gets\n\nlemma no_fail_assert [simp, wp]:\n \"no_fail (\\_. P) (assert P)\"\n by (simp add: assert_def)\n\nlemma no_fail_assert_opt [simp, wp]:\n \"no_fail (\\_. P \\ None) (assert_opt P)\"\n by (simp add: assert_opt_def split: option.splits)\n\nlemma no_fail_case_option [wp]:\n assumes f: \"no_fail P f\"\n assumes g: \"\\x. no_fail (Q x) (g x)\"\n shows \"no_fail (if x = None then P else Q (the x)) (case_option f g x)\"\n by (clarsimp simp add: f g)\n\nlemma no_fail_if [wp]:\n \"\\ P \\ no_fail Q f; \\P \\ no_fail R g \\ \\\n no_fail (if P then Q else R) (if P then f else g)\"\n by simp\n\nlemma no_fail_apply [wp]:\n \"no_fail P (f (g x)) \\ no_fail P (f $ g x)\"\n by simp\n\nlemma no_fail_undefined [simp, wp]:\n \"no_fail \\ undefined\"\n by (simp add: no_fail_def)\n\nlemma no_fail_returnOK [simp, wp]:\n \"no_fail \\ (returnOk x)\"\n by (simp add: returnOk_def)\n\ntext {* Empty results implies non-failure *}\n\nlemma empty_fail_modify [simp]:\n \"empty_fail (modify f)\"\n by (simp add: empty_fail_def simpler_modify_def)\n\nlemma empty_fail_gets [simp]:\n \"empty_fail (gets f)\"\n by (simp add: empty_fail_def simpler_gets_def)\n\nlemma empty_failD:\n \"\\ empty_fail m; fst (m s) = {} \\ \\ snd (m s)\"\n by (simp add: empty_fail_def)\n\nlemma empty_fail_select_f [simp]:\n assumes ef: \"fst S = {} \\ snd S\"\n shows \"empty_fail (select_f S)\"\n by (fastforce simp add: empty_fail_def select_f_def intro: ef)\n\nlemma empty_fail_bind [simp]:\n \"\\ empty_fail a; \\x. empty_fail (b x) \\ \\ empty_fail (a >>= b)\"\n apply (simp add: bind_def empty_fail_def split_def)\n apply clarsimp\n apply (case_tac \"fst (a s) = {}\")\n apply blast\n apply (clarsimp simp: ex_in_conv [symmetric])\n done\n\nlemma empty_fail_return [simp]:\n \"empty_fail (return x)\"\n by (simp add: empty_fail_def return_def)\n\nlemma empty_fail_mapM [simp]:\n assumes m: \"\\x. empty_fail (m x)\"\n shows \"empty_fail (mapM m xs)\"\nproof (induct xs)\n case Nil\n thus ?case by (simp add: mapM_def sequence_def)\nnext\n case Cons\n have P: \"\\m x xs. mapM m (x # xs) = (do y \\ m x; ys \\ (mapM m xs); return (y # ys) od)\"\n by (simp add: mapM_def sequence_def Let_def)\n from Cons\n show ?case by (simp add: P m)\nqed\n\nlemma empty_fail [simp]:\n \"empty_fail fail\"\n by (simp add: fail_def empty_fail_def)\n\nlemma empty_fail_assert_opt [simp]:\n \"empty_fail (assert_opt x)\"\n by (simp add: assert_opt_def split: option.splits)\n\nlemma empty_fail_mk_ef:\n \"empty_fail (mk_ef o m)\"\n by (simp add: empty_fail_def mk_ef_def)\n\nsubsection \"Failure\"\n\nlemma fail_wp: \"\\\\x. True\\ fail \\Q\\\"\n by (simp add: valid_def fail_def)\n\nlemma failE_wp: \"\\\\x. True\\ fail \\Q\\,\\E\\\"\n by (simp add: validE_def fail_wp)\n\nlemma fail_update [iff]:\n \"fail (f s) = fail s\"\n by (simp add: fail_def)\n\n\ntext {* We can prove postconditions using hoare triples *}\n\nlemma post_by_hoare: \"\\ \\P\\ f \\Q\\; P s; (r, s') \\ fst (f s) \\ \\ Q r s'\"\n apply (simp add: valid_def)\n apply blast\n done\n\ntext {* Weakest Precondition Rules *}\n\nlemma hoare_vcg_prop:\n \"\\\\s. P\\ f \\\\rv s. P\\\"\n by (simp add: valid_def)\n\nlemma return_wp:\n \"\\P x\\ return x \\P\\\"\n apply(simp add:valid_def return_def)\ndone\n\nlemma get_wp:\n \"\\\\s. P s s\\ get \\P\\\"\n apply(simp add:valid_def split_def get_def)\ndone\n\nlemma gets_wp:\n \"\\\\s. P (f s) s\\ gets f \\P\\\"\n apply(simp add:valid_def split_def gets_def return_def get_def bind_def)\ndone\n\nlemma modify_wp:\n \"\\\\s. P () (f s)\\ modify f \\P\\\"\n apply(simp add:valid_def split_def modify_def get_def put_def bind_def)\ndone\n\nlemma put_wp:\n \"\\\\s. P () x\\ put x \\P\\\"\n apply(simp add:valid_def put_def)\ndone\n\nlemma returnOk_wp:\n \"\\P x\\ returnOk x \\P\\,\\E\\\"\n apply(simp add:validE_def2 returnOk_def return_def)\ndone\n\nlemma throwError_wp:\n \"\\E e\\ throwError e \\P\\,\\E\\\"\n apply(simp add:validE_def2 throwError_def return_def)\ndone\n\nlemma returnOKE_R_wp : \"\\P x\\ returnOk x \\P\\, -\"\n by (simp add: validE_R_def validE_def valid_def\n returnOk_def return_def)\n\nlemma liftE_wp:\n \"\\P\\ f \\Q\\ \\ \\P\\ liftE f \\Q\\,\\E\\\"\n apply(clarsimp simp:valid_def validE_def2 liftE_def split_def Let_def bind_def return_def)\ndone\n\nlemma catch_wp:\n \"\\ \\x. \\E x\\ handler x \\Q\\; \\P\\ f \\Q\\,\\E\\ \\ \\\n \\P\\ catch f handler \\Q\\\"\n apply (unfold catch_def valid_def validE_def return_def)\n apply (clarsimp simp: bind_def)\n apply (fastforce split: sum.splits)\n done\n\nlemma handleE'_wp:\n \"\\ \\x. \\F x\\ handler x \\Q\\,\\E\\; \\P\\ f \\Q\\,\\F\\ \\ \\\n \\P\\ f handler \\Q\\,\\E\\\"\n apply (unfold handleE'_def valid_def validE_def return_def)\n apply (clarsimp simp: bind_def)\n apply (fastforce split: sum.splits)\n done\n\nlemma handleE_wp:\n assumes x: \"\\x. \\F x\\ handler x \\Q\\,\\E\\\"\n assumes y: \"\\P\\ f \\Q\\,\\F\\\"\n shows \"\\P\\ f handler \\Q\\,\\E\\\"\n by (simp add: handleE_def handleE'_wp [OF x y])\n\nlemma hoare_vcg_split_if:\n \"\\ P \\ \\Q\\ f \\S\\; \\P \\ \\R\\ g \\S\\ \\ \\\n \\\\s. (P \\ Q s) \\ (\\P \\ R s)\\ if P then f else g \\S\\\"\n by simp\n\nlemma hoare_vcg_split_ifE:\n \"\\ P \\ \\Q\\ f \\S\\,\\E\\; \\P \\ \\R\\ g \\S\\,\\E\\ \\ \\\n \\\\s. (P \\ Q s) \\ (\\P \\ R s)\\ if P then f else g \\S\\,\\E\\\"\n by simp\n\nlemma hoare_liftM_subst: \"\\P\\ liftM f m \\Q\\ = \\P\\ m \\Q \\ f\\\"\n apply (simp add: liftM_def bind_def return_def split_def)\n apply (simp add: valid_def Ball_def)\n apply (rule_tac f=All in arg_cong)\n apply (rule ext)\n apply fastforce\n done\n\nlemma liftE_validE[simp]: \"\\P\\ liftE f \\Q\\,\\E\\ = \\P\\ f \\Q\\\"\n apply (simp add: liftE_liftM validE_def hoare_liftM_subst o_def)\n done\n\nlemma liftM_wp: \"\\P\\ m \\Q \\ f\\ \\ \\P\\ liftM f m \\Q\\\"\n by (simp add: hoare_liftM_subst)\n\nlemma hoare_liftME_subst: \"\\P\\ liftME f m \\Q\\,\\E\\ = \\P\\ m \\Q \\ f\\,\\E\\\"\n apply (simp add: validE_def liftME_liftM hoare_liftM_subst o_def)\n apply (rule_tac f=\"valid P m\" in arg_cong)\n apply (rule ext)+\n apply (case_tac x, simp_all)\n done\n\nlemma liftME_wp: \"\\P\\ m \\Q \\ f\\,\\E\\ \\ \\P\\ liftME f m \\Q\\,\\E\\\"\n by (simp add: hoare_liftME_subst)\n\n(* FIXME: Move *)\nlemma o_const_simp[simp]: \"(\\x. C) \\ f = (\\x. C)\"\n by (simp add: o_def)\n\nlemma hoare_vcg_split_case_option:\n \"\\ \\x. x = None \\ \\P x\\ f x \\R x\\;\n \\x y. x = Some y \\ \\Q x y\\ g x y \\R x\\ \\ \\\n \\\\s. (x = None \\ P x s) \\\n (\\y. x = Some y \\ Q x y s)\\\n case x of None \\ f x\n | Some y \\ g x y\n \\R x\\\"\n apply(simp add:valid_def split_def)\n apply(case_tac x, simp_all)\ndone\n\nlemma hoare_vcg_split_case_optionE:\n assumes none_case: \"\\x. x = None \\ \\P x\\ f x \\R x\\,\\E x\\\"\n assumes some_case: \"\\x y. x = Some y \\ \\Q x y\\ g x y \\R x\\,\\E x\\\"\n shows \"\\\\s. (x = None \\ P x s) \\\n (\\y. x = Some y \\ Q x y s)\\\n case x of None \\ f x\n | Some y \\ g x y\n \\R x\\,\\E x\\\"\n apply(case_tac x, simp_all)\n apply(rule none_case, simp)\n apply(rule some_case, simp)\ndone\n\nlemma hoare_vcg_split_case_sum:\n \"\\ \\x a. x = Inl a \\ \\P x a\\ f x a \\R x\\;\n \\x b. x = Inr b \\ \\Q x b\\ g x b \\R x\\ \\ \\\n \\\\s. (\\a. x = Inl a \\ P x a s) \\\n (\\b. x = Inr b \\ Q x b s) \\\n case x of Inl a \\ f x a\n | Inr b \\ g x b\n \\R x\\\"\n apply(simp add:valid_def split_def)\n apply(case_tac x, simp_all)\ndone\n\nlemma hoare_vcg_split_case_sumE:\n assumes left_case: \"\\x a. x = Inl a \\ \\P x a\\ f x a \\R x\\\"\n assumes right_case: \"\\x b. x = Inr b \\ \\Q x b\\ g x b \\R x\\\"\n shows \"\\\\s. (\\a. x = Inl a \\ P x a s) \\\n (\\b. x = Inr b \\ Q x b s) \\\n case x of Inl a \\ f x a\n | Inr b \\ g x b\n \\R x\\\"\n apply(case_tac x, simp_all)\n apply(rule left_case, simp)\n apply(rule right_case, simp)\ndone\n\nlemma hoare_vcg_precond_imp:\n \"\\ \\Q\\ f \\R\\; \\s. P s \\ Q s \\ \\ \\P\\ f \\R\\\"\n by (fastforce simp add:valid_def)\n\nlemma hoare_vcg_precond_impE:\n \"\\ \\Q\\ f \\R\\,\\E\\; \\s. P s \\ Q s \\ \\ \\P\\ f \\R\\,\\E\\\"\n by (fastforce simp add:validE_def2)\n\nlemma hoare_seq_ext:\n assumes g_valid: \"\\x. \\B x\\ g x \\C\\\"\n assumes f_valid: \"\\A\\ f \\B\\\"\n shows \"\\A\\ do x \\ f; g x od \\C\\\"\n apply(insert f_valid g_valid)\n apply(blast intro: seq_ext')\ndone\n\nlemma hoare_vcg_seqE:\n assumes g_valid: \"\\x. \\B x\\ g x \\C\\,\\E\\\"\n assumes f_valid: \"\\A\\ f \\B\\,\\E\\\"\n shows \"\\A\\ doE x \\ f; g x odE \\C\\,\\E\\\"\n apply(insert f_valid g_valid)\n apply(blast intro: seqE')\ndone\n\nlemma hoare_seq_ext_nobind:\n \"\\ \\B\\ g \\C\\;\n \\A\\ f \\\\r s. B s\\ \\ \\\n \\A\\ do f; g od \\C\\\"\n apply (clarsimp simp: valid_def bind_def Let_def split_def)\n apply fastforce\ndone\n\nlemma hoare_seq_ext_nobindE:\n \"\\ \\B\\ g \\C\\,\\E\\;\n \\A\\ f \\\\r s. B s\\,\\E\\ \\ \\\n \\A\\ doE f; g odE \\C\\,\\E\\\"\n apply (clarsimp simp:validE_def)\n apply (simp add:bindE_def Let_def split_def bind_def lift_def)\n apply (fastforce simp add: valid_def throwError_def return_def lift_def\n split: sum.splits)\n done\n\nlemma hoare_chain:\n \"\\ \\P\\ f \\Q\\;\n \\s. R s \\ P s;\n \\r s. Q r s \\ S r s \\ \\\n \\R\\ f \\S\\\"\n by(fastforce simp add:valid_def split_def)\n\nlemma validE_weaken:\n \"\\ \\P'\\ A \\Q'\\,\\E'\\; \\s. P s \\ P' s; \\r s. Q' r s \\ Q r s; \\r s. E' r s \\ E r s \\ \\ \\P\\ A \\Q\\,\\E\\\"\n by (fastforce simp: validE_def2 split: sum.splits)\n\nlemmas hoare_chainE = validE_weaken\n\nlemma hoare_vcg_handle_elseE:\n \"\\ \\P\\ f \\Q\\,\\E\\;\n \\e. \\E e\\ g e \\R\\,\\F\\;\n \\x. \\Q x\\ h x \\R\\,\\F\\ \\ \\\n \\P\\ f g h \\R\\,\\F\\\"\n apply (simp add: handle_elseE_def validE_def)\n apply (rule seq_ext)\n apply assumption\n apply (case_tac x, simp_all)\n done\n\nlemma alternative_valid:\n assumes x: \"\\P\\ f \\Q\\\"\n assumes y: \"\\P\\ f' \\Q\\\"\n shows \"\\P\\ f OR f' \\Q\\\"\n apply (simp add: valid_def alternative_def)\n apply safe\n apply (simp add: post_by_hoare [OF x])\n apply (simp add: post_by_hoare [OF y])\n done\n\nlemma alternative_wp:\n assumes x: \"\\P\\ f \\Q\\\"\n assumes y: \"\\P'\\ f' \\Q\\\"\n shows \"\\P and P'\\ f OR f' \\Q\\\"\n apply (rule alternative_valid)\n apply (rule hoare_pre_imp [OF _ x], simp)\n apply (rule hoare_pre_imp [OF _ y], simp)\n done\n\nlemma alternativeE_wp:\n assumes x: \"\\P\\ f \\Q\\,\\E\\\" and y: \"\\P'\\ f' \\Q\\,\\E\\\"\n shows \"\\P and P'\\ f OR f' \\Q\\,\\E\\\"\n apply (unfold validE_def)\n apply (wp add: x y alternative_wp | simp | fold validE_def)+\n done\n\nlemma alternativeE_R_wp:\n \"\\ \\P\\ f \\Q\\,-; \\P'\\ f' \\Q\\,- \\ \\ \\P and P'\\ f OR f' \\Q\\,-\"\n apply (simp add: validE_R_def)\n apply (rule alternativeE_wp)\n apply assumption+\n done\n\nlemma alternative_R_wp:\n \"\\ \\P\\ f -,\\Q\\; \\P'\\ g -,\\Q\\ \\ \\ \\P and P'\\ f \\ g -, \\Q\\\"\n by (fastforce simp: alternative_def validE_E_def validE_def valid_def)\n\nlemma select_wp: \"\\\\s. \\x \\ S. Q x s\\ select S \\Q\\\"\n by (simp add: select_def valid_def)\n\nlemma select_f_wp:\n \"\\\\s. \\x\\fst S. Q x s\\ select_f S \\Q\\\"\n by (simp add: select_f_def valid_def)\n\nlemma state_select_wp [wp]: \"\\ \\s. \\t. (s, t) \\ f \\ P () t \\ state_select f \\ P \\\"\n apply (clarsimp simp: state_select_def)\n apply (clarsimp simp: valid_def)\n done\n\nlemma condition_wp [wp]:\n \"\\ \\ Q \\ A \\ P \\; \\ R \\ B \\ P \\ \\ \\ \\ \\s. if C s then Q s else R s \\ condition C A B \\ P \\\"\n apply (clarsimp simp: condition_def)\n apply (clarsimp simp: valid_def pred_conj_def pred_neg_def split_def)\n done\n\nlemma conditionE_wp [wp]:\n \"\\ \\ P \\ A \\ Q \\,\\ R \\; \\ P' \\ B \\ Q \\,\\ R \\ \\ \\ \\ \\s. if C s then P s else P' s \\ condition C A B \\Q\\,\\R\\\"\n apply (clarsimp simp: condition_def)\n apply (clarsimp simp: validE_def valid_def)\n done\n\nlemma state_assert_wp [wp]: \"\\ \\s. f s \\ P () s \\ state_assert f \\ P \\\"\n apply (clarsimp simp: state_assert_def get_def\n assert_def bind_def valid_def return_def fail_def)\n done\n\ntext {* The weakest precondition handler which works on conjunction *}\n\nlemma hoare_vcg_conj_lift:\n assumes x: \"\\P\\ f \\Q\\\"\n assumes y: \"\\P'\\ f \\Q'\\\"\n shows \"\\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\\"\n apply (subst bipred_conj_def[symmetric], rule hoare_post_conj)\n apply (rule hoare_pre_imp [OF _ x], simp)\n apply (rule hoare_pre_imp [OF _ y], simp)\n done\n\nlemma hoare_vcg_conj_liftE1:\n \"\\ \\P\\ f \\Q\\,-; \\P'\\ f \\Q'\\,\\E\\ \\ \\\n \\P and P'\\ f \\\\r s. Q r s \\ Q' r s\\,\\E\\\"\n unfolding valid_def validE_R_def validE_def\n apply (clarsimp simp: split_def split: sum.splits)\n apply (erule allE, erule (1) impE)\n apply (erule allE, erule (1) impE)\n apply (drule (1) bspec)\n apply (drule (1) bspec)\n apply clarsimp\n done\n\nlemma hoare_vcg_disj_lift:\n assumes x: \"\\P\\ f \\Q\\\"\n assumes y: \"\\P'\\ f \\Q'\\\"\n shows \"\\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\\"\n apply (simp add: valid_def)\n apply safe\n apply (erule(1) post_by_hoare [OF x])\n apply (erule notE)\n apply (erule(1) post_by_hoare [OF y])\n done\n\nlemma hoare_vcg_const_Ball_lift:\n \"\\ \\x. x \\ S \\ \\P x\\ f \\Q x\\ \\ \\ \\\\s. \\x\\S. P x s\\ f \\\\rv s. \\x\\S. Q x rv s\\\"\n by (fastforce simp: valid_def)\n\nlemma hoare_vcg_const_Ball_lift_R:\n \"\\ \\x. x \\ S \\ \\P x\\ f \\Q x\\,- \\ \\\n \\\\s. \\x \\ S. P x s\\ f \\\\rv s. \\x \\ S. Q x rv s\\,-\"\n apply (simp add: validE_R_def validE_def)\n apply (rule hoare_strengthen_post)\n apply (erule hoare_vcg_const_Ball_lift)\n apply (simp split: sum.splits)\n done\n\nlemma hoare_vcg_all_lift:\n \"\\ \\x. \\P x\\ f \\Q x\\ \\ \\ \\\\s. \\x. P x s\\ f \\\\rv s. \\x. Q x rv s\\\"\n by (fastforce simp: valid_def)\n\n(*\n * hoare_vcg_all_lift_R\n *\n * \\x. \\?P x\\ ?f \\?Q x\\, -) \\ \\\\s. \\x. ?P x s\\ ?f \\\\rv s. \\x. ?Q x rv s\\, -\n *)\nlemmas hoare_vcg_all_lift_R = hoare_vcg_const_Ball_lift_R[where S=UNIV, simplified]\n\nlemma hoare_vcg_const_imp_lift:\n \"\\ P \\ \\Q\\ m \\R\\ \\ \\\n \\\\s. P \\ Q s\\ m \\\\rv s. P \\ R rv s\\\"\n by (cases P, simp_all add: hoare_vcg_prop)\n\nlemma hoare_vcg_const_imp_lift_R:\n \"(P \\ \\Q\\ m \\R\\,-) \\ \\\\s. P \\ Q s\\ m \\\\rv s. P \\ R rv s\\,-\"\n by (fastforce simp: validE_R_def validE_def valid_def split_def split: sum.splits)\n\nlemma hoare_weak_lift_imp:\n \"\\P'\\ f \\Q\\ \\ \\\\s. P \\ P' s\\ f \\\\rv s. P \\ Q rv s\\\"\n by (auto simp add: valid_def split_def)\n\nlemma hoare_vcg_ex_lift:\n \"\\ \\x. \\P x\\ f \\Q x\\ \\ \\ \\\\s. \\x. P x s\\ f \\\\rv s. \\x. Q x rv s\\\"\n by (clarsimp simp: valid_def, blast)\n\nlemma hoare_vcg_ex_lift_R1:\n \"(\\x. \\P x\\ f \\Q\\, -) \\ \\\\s. \\x. P x s\\ f \\Q\\, -\"\n by (fastforce simp: valid_def validE_R_def validE_def split: sum.splits)\n\n(* for instantiations *)\nlemma hoare_triv: \"\\P\\f\\Q\\ \\ \\P\\f\\Q\\\" .\nlemma hoare_trivE: \"\\P\\ f \\Q\\,\\E\\ \\ \\P\\ f \\Q\\,\\E\\\" .\nlemma hoare_trivE_R: \"\\P\\ f \\Q\\,- \\ \\P\\ f \\Q\\,-\" .\nlemma hoare_trivR_R: \"\\P\\ f -,\\E\\ \\ \\P\\ f -,\\E\\\" .\n\nlemma hoare_weaken_preE_E:\n \"\\ \\P'\\ f -,\\Q\\; \\s. P s \\ P' s \\ \\ \\P\\ f -,\\Q\\\"\n by (fastforce simp add: validE_E_def validE_def valid_def)\n\nlemma hoare_vcg_E_conj:\n \"\\ \\P\\ f -,\\E\\; \\P'\\ f \\Q'\\,\\E'\\ \\\n \\ \\\\s. P s \\ P' s\\ f \\Q'\\, \\\\rv s. E rv s \\ E' rv s\\\"\n apply (unfold validE_def validE_E_def)\n apply (rule hoare_post_imp [OF _ hoare_vcg_conj_lift], simp_all)\n apply (case_tac r, simp_all)\n done\n\nlemma hoare_vcg_E_elim:\n \"\\ \\P\\ f -,\\E\\; \\P'\\ f \\Q\\,- \\\n \\ \\\\s. P s \\ P' s\\ f \\Q\\,\\E\\\"\n by (rule hoare_post_impErr [OF hoare_vcg_E_conj],\n (simp add: validE_R_def)+)\n\nlemma hoare_vcg_R_conj:\n \"\\ \\P\\ f \\Q\\,-; \\P'\\ f \\Q'\\,- \\\n \\ \\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\,-\"\n apply (unfold validE_R_def validE_def)\n apply (rule hoare_post_imp [OF _ hoare_vcg_conj_lift], simp_all)\n apply (case_tac r, simp_all)\n done\n\nlemma valid_validE:\n \"\\P\\ f \\\\rv. Q\\ \\ \\P\\ f \\\\rv. Q\\,\\\\rv. Q\\\"\n apply (simp add: validE_def)\n done\n\nlemma valid_validE2:\n \"\\ \\P\\ f \\\\_. Q'\\; \\s. Q' s \\ Q s; \\s. Q' s \\ E s \\ \\ \\P\\ f \\\\_. Q\\,\\\\_. E\\\"\n unfolding valid_def validE_def\n by (clarsimp split: sum.splits) blast\n\nlemma validE_valid: \"\\P\\ f \\\\rv. Q\\,\\\\rv. Q\\ \\ \\P\\ f \\\\rv. Q\\\"\n apply (unfold validE_def)\n apply (rule hoare_post_imp)\n defer\n apply assumption\n apply (case_tac r, simp_all)\n done\n\nlemma valid_validE_R:\n \"\\P\\ f \\\\rv. Q\\ \\ \\P\\ f \\\\rv. Q\\,-\"\n by (simp add: validE_R_def hoare_post_impErr [OF valid_validE])\n\nlemma valid_validE_E:\n \"\\P\\ f \\\\rv. Q\\ \\ \\P\\ f -,\\\\rv. Q\\\"\n by (simp add: validE_E_def hoare_post_impErr [OF valid_validE])\n\nlemma validE_validE_R: \"\\P\\ f \\Q\\,\\\\\\\\ \\ \\P\\ f \\Q\\,-\"\n by (simp add: validE_R_def)\n\nlemma validE_R_validE: \"\\P\\ f \\Q\\,- \\ \\P\\ f \\Q\\,\\\\\\\\\"\n by (simp add: validE_R_def)\n\nlemma hoare_post_imp_R: \"\\ \\P\\ f \\Q'\\,-; \\r s. Q' r s \\ Q r s \\ \\ \\P\\ f \\Q\\,-\"\n apply (unfold validE_R_def)\n apply (rule hoare_post_impErr, simp+)\n done\n\nlemma hoare_post_comb_imp_conj:\n \"\\ \\P'\\ f \\Q\\; \\P\\ f \\Q'\\; \\s. P s \\ P' s \\ \\ \\P\\ f \\\\rv s. Q rv s \\ Q' rv s\\\"\n apply (rule hoare_pre_imp)\n defer\n apply (rule hoare_vcg_conj_lift)\n apply assumption+\n apply simp\n done\n\nlemma hoare_vcg_precond_impE_R: \"\\ \\P'\\ f \\Q\\,-; \\s. P s \\ P' s \\ \\ \\P\\ f \\Q\\,-\"\n by (unfold validE_R_def, rule hoare_vcg_precond_impE, simp+)\n\nlemma valid_is_triple:\n \"valid P f Q = triple_judgement P f (postcondition Q (\\s f. fst (f s)))\"\n by (simp add: triple_judgement_def valid_def postcondition_def)\n\nlemma validE_is_triple:\n \"validE P f Q E = triple_judgement P f\n (postconditions (postcondition Q (\\s f. {(rv, s'). (Inr rv, s') \\ fst (f s)}))\n (postcondition E (\\s f. {(rv, s'). (Inl rv, s') \\ fst (f s)})))\"\n apply (simp add: validE_def triple_judgement_def valid_def postcondition_def\n postconditions_def split_def split: sum.split)\n apply fastforce\n done\n\nlemma validE_R_is_triple:\n \"validE_R P f Q = triple_judgement P f\n (postcondition Q (\\s f. {(rv, s'). (Inr rv, s') \\ fst (f s)}))\"\n by (simp add: validE_R_def validE_is_triple postconditions_def postcondition_def)\n\nlemma validE_E_is_triple:\n \"validE_E P f E = triple_judgement P f\n (postcondition E (\\s f. {(rv, s'). (Inl rv, s') \\ fst (f s)}))\"\n by (simp add: validE_E_def validE_is_triple postconditions_def postcondition_def)\n\nlemmas hoare_wp_combs =\n hoare_post_comb_imp_conj hoare_vcg_precond_imp hoare_vcg_conj_lift\n\nlemmas hoare_wp_combsE =\n hoare_vcg_precond_impE\n hoare_vcg_precond_impE_R\n validE_validE_R\n hoare_vcg_R_conj\n hoare_vcg_E_elim\n hoare_vcg_E_conj\n\nlemmas hoare_wp_state_combsE =\n hoare_vcg_precond_impE[OF valid_validE]\n hoare_vcg_precond_impE_R[OF valid_validE_R]\n valid_validE_R\n hoare_vcg_R_conj[OF valid_validE_R]\n hoare_vcg_E_elim[OF valid_validE_E]\n hoare_vcg_E_conj[OF valid_validE_E]\n\nlemmas hoare_wp_splits [wp_split] =\n hoare_seq_ext hoare_vcg_seqE handleE'_wp handleE_wp\n validE_validE_R [OF hoare_vcg_seqE [OF validE_R_validE]]\n validE_validE_R [OF handleE'_wp [OF validE_R_validE]]\n validE_validE_R [OF handleE_wp [OF validE_R_validE]]\n catch_wp hoare_vcg_split_if hoare_vcg_split_ifE\n validE_validE_R [OF hoare_vcg_split_ifE [OF validE_R_validE validE_R_validE]]\n liftM_wp liftME_wp\n validE_validE_R [OF liftME_wp [OF validE_R_validE]]\n validE_valid\n\nlemmas [wp_comb] = hoare_wp_state_combsE hoare_wp_combsE hoare_wp_combs\n\nlemmas [wp] = hoare_vcg_prop\n return_wp\n put_wp\n get_wp\n gets_wp\n modify_wp\n returnOk_wp\n throwError_wp\n fail_wp\n failE_wp\n liftE_wp\n select_f_wp\n\nlemmas [wp_trip] = valid_is_triple validE_is_triple validE_E_is_triple validE_R_is_triple\n\ntext {* Simplifications on conjunction *}\n\nlemma hoare_post_eq: \"\\ Q = Q'; \\P\\ f \\Q'\\ \\ \\ \\P\\ f \\Q\\\"\n by simp\nlemma hoare_post_eqE1: \"\\ Q = Q'; \\P\\ f \\Q'\\,\\E\\ \\ \\ \\P\\ f \\Q\\,\\E\\\"\n by simp\nlemma hoare_post_eqE2: \"\\ E = E'; \\P\\ f \\Q\\,\\E'\\ \\ \\ \\P\\ f \\Q\\,\\E\\\"\n by simp\nlemma hoare_post_eqE_R: \"\\ Q = Q'; \\P\\ f \\Q'\\,- \\ \\ \\P\\ f \\Q\\,-\"\n by simp\n\nlemma pred_conj_apply_elim: \"(\\r. Q r and Q' r) = (\\r s. Q r s \\ Q' r s)\"\n by (simp add: pred_conj_def)\nlemma pred_conj_conj_elim: \"(\\r s. (Q r and Q' r) s \\ Q'' r s) = (\\r s. Q r s \\ Q' r s \\ Q'' r s)\"\n by simp\nlemma conj_assoc_apply: \"(\\r s. (Q r s \\ Q' r s) \\ Q'' r s) = (\\r s. Q r s \\ Q' r s \\ Q'' r s)\"\n by simp\nlemma all_elim: \"(\\rv s. \\x. P rv s) = P\"\n by simp\nlemma all_conj_elim: \"(\\rv s. (\\x. P rv s) \\ Q rv s) = (\\rv s. P rv s \\ Q rv s)\"\n by simp\n\nlemmas vcg_rhs_simps = pred_conj_apply_elim pred_conj_conj_elim\n conj_assoc_apply all_elim all_conj_elim\n\nlemma if_apply_reduct: \"\\P\\ If P' (f x) (g x) \\Q\\ \\ \\P\\ If P' f g x \\Q\\\"\n by (cases P', simp_all)\nlemma if_apply_reductE: \"\\P\\ If P' (f x) (g x) \\Q\\,\\E\\ \\ \\P\\ If P' f g x \\Q\\,\\E\\\"\n by (cases P', simp_all)\nlemma if_apply_reductE_R: \"\\P\\ If P' (f x) (g x) \\Q\\,- \\ \\P\\ If P' f g x \\Q\\,-\"\n by (cases P', simp_all)\n\nlemmas hoare_wp_simps [wp_split] =\n vcg_rhs_simps [THEN hoare_post_eq] vcg_rhs_simps [THEN hoare_post_eqE1]\n vcg_rhs_simps [THEN hoare_post_eqE2] vcg_rhs_simps [THEN hoare_post_eqE_R]\n if_apply_reduct if_apply_reductE if_apply_reductE_R TrueI\n\nschematic_lemma if_apply_test: \"\\?Q\\ (if A then returnOk else K fail) x \\P\\,\\E\\\"\n apply (wp | unfold K_def)+\n done\n\nlemma hoare_elim_pred_conj:\n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\ \\ \\P\\ f \\\\r. Q r and Q' r\\\"\n by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE1:\n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\,\\E\\ \\ \\P\\ f \\\\r. Q r and Q' r\\,\\E\\\"\n by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE2:\n \"\\P\\ f \\Q\\, \\\\x s. E x s \\ E' x s\\ \\ \\P\\ f \\Q\\,\\\\x. E x and E' x\\\"\n by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE_R:\n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\,- \\ \\P\\ f \\\\r. Q r and Q' r\\,-\"\n by (unfold pred_conj_def)\n\nlemmas hoare_wp_pred_conj_elims =\n hoare_elim_pred_conj hoare_elim_pred_conjE1\n hoare_elim_pred_conjE2 hoare_elim_pred_conjE_R\n\nlemmas hoare_weaken_preE = hoare_vcg_precond_impE\n\nlemmas hoare_pre =\n hoare_weaken_pre\n hoare_weaken_preE\n hoare_vcg_precond_impE_R\n hoare_weaken_preE_E\n\ntext {* Miscellaneous lemmas on hoare triples *}\n\nlemma hoare_vcg_mp:\n assumes a: \"\\P\\ f \\Q\\\"\n assumes b: \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\\"\n shows \"\\P\\ f \\Q'\\\"\n using assms\n by (auto simp: valid_def split_def)\n\n(* note about this precond stuff: rules get a chance to bind directly\n before any of their combined forms. As a result, these precondition\n implication rules are only used when needed. *)\n\nlemma hoare_add_post:\n assumes r: \"\\P'\\ f \\Q'\\\"\n assumes impP: \"\\s. P s \\ P' s\"\n assumes impQ: \"\\P\\ f \\\\rv s. Q' rv s \\ Q rv s\\\"\n shows \"\\P\\ f \\Q\\\"\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule r)\n apply (rule impQ)\n apply simp\n apply (erule impP)\n apply simp\n done\n\nlemma hoare_whenE_wp:\n \"(P \\ \\Q\\ f \\R\\, \\E\\) \\ \\if P then Q else R ()\\ whenE P f \\R\\, \\E\\\"\n unfolding whenE_def\n apply clarsimp\n apply wp\n done\n\nlemma hoare_gen_asmE:\n \"(P \\ \\P'\\ f \\Q\\,-) \\ \\P' and K P\\ f \\Q\\, -\"\n by (simp add: validE_R_def validE_def valid_def) blast\n\nlemma hoare_list_case:\n assumes P1: \"\\P1\\ f f1 \\Q\\\"\n assumes P2: \"\\y ys. xs = y#ys \\ \\P2 y ys\\ f (f2 y ys) \\Q\\\"\n shows \"\\case xs of [] \\ P1 | y#ys \\ P2 y ys\\\n f (case xs of [] \\ f1 | y#ys \\ f2 y ys)\n \\Q\\\"\n apply (cases xs)\n apply simp\n apply (rule P1)\n apply simp\n apply (rule P2)\n apply simp\n done\n\nlemma hoare_unless_wp:\n \"(\\P \\ \\Q\\ f \\R\\) \\ \\if P then R () else Q\\ unless P f \\R\\\"\n unfolding unless_def by wp auto\n\nlemma hoare_use_eq:\n assumes x: \"\\P. \\\\s. P (f s)\\ m \\\\rv s. P (f s)\\\"\n assumes y: \"\\f. \\\\s. P f s\\ m \\\\rv s. Q f s\\\"\n shows \"\\\\s. P (f s) s\\ m \\\\rv s. Q (f s :: 'c :: type) s \\\"\n apply (rule_tac Q=\"\\rv s. \\f'. f' = f s \\ Q f' s\" in hoare_post_imp)\n apply simp\n apply (wp hoare_vcg_ex_lift x y)\n apply simp\n done\n\nlemma hoare_return_sp:\n \"\\P\\ return x \\\\r. P and K (r = x)\\\"\n by (simp add: valid_def return_def)\n\nlemma hoare_fail_any [simp]:\n \"\\P\\ fail \\Q\\\" by wp\n\nlemma hoare_failE [simp]: \"\\P\\ fail \\Q\\,\\E\\\" by wp\n\nlemma hoare_FalseE [simp]:\n \"\\\\s. False\\ f \\Q\\,\\E\\\"\n by (simp add: valid_def validE_def)\n\nlemma hoare_K_bind [wp]:\n \"\\P\\ f \\Q\\ \\ \\P\\ K_bind f x \\Q\\\"\n by simp\n\ntext {* Setting up the precondition case splitter. *}\n\nlemma wpc_helper_valid:\n \"\\Q\\ g \\S\\ \\ wpc_helper (P, P') (Q, Q') \\P\\ g \\S\\\"\n by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validE:\n \"\\Q\\ f \\R\\,\\E\\ \\ wpc_helper (P, P') (Q, Q') \\P\\ f \\R\\,\\E\\\"\n by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validE_R:\n \"\\Q\\ f \\R\\,- \\ wpc_helper (P, P') (Q, Q') \\P\\ f \\R\\,-\"\n by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validR_R:\n \"\\Q\\ f -,\\E\\ \\ wpc_helper (P, P') (Q, Q') \\P\\ f -,\\E\\\"\n by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_no_fail_final:\n \"no_fail Q f \\ wpc_helper (P, P') (Q, Q') (no_fail P f)\"\n by (clarsimp simp: wpc_helper_def elim!: no_fail_pre)\n\nlemma wpc_helper_validNF:\n \"\\Q\\ g \\S\\! \\ wpc_helper (P, P') (Q, Q') \\P\\ g \\S\\!\"\n apply (clarsimp simp: wpc_helper_def)\n by (metis hoare_wp_combs(2) no_fail_pre validNF_def)\n\nwpc_setup \"\\m. \\P\\ m \\Q\\\" wpc_helper_valid\nwpc_setup \"\\m. \\P\\ m \\Q\\,\\E\\\" wpc_helper_validE\nwpc_setup \"\\m. \\P\\ m \\Q\\,-\" wpc_helper_validE_R\nwpc_setup \"\\m. \\P\\ m -,\\E\\\" wpc_helper_validR_R\nwpc_setup \"\\m. no_fail P m\" wpc_helper_no_fail_final\nwpc_setup \"\\m. \\P\\ m \\Q\\!\" wpc_helper_validNF\n\n\nlemma in_liftM:\n \"((r, s') \\ fst (liftM t f s)) = (\\r'. (r', s') \\ fst (f s) \\ r = t r')\"\n apply (simp add: liftM_def return_def bind_def)\n apply (simp add: Bex_def)\n done\n\n(*\n * handy_liftM_lemma\n *\n * ((?r, ?s') \\ fst (liftM ?t ?f ?s)) = (\\r'. (r', ?s') \\ fst (?f ?s) \\ ?r = ?t r')\n *)\nlemmas handy_liftM_lemma = in_liftM\n\nlemma hoare_fun_app_wp[wp]:\n \"\\P\\ f' x \\Q'\\ \\ \\P\\ f' $ x \\Q'\\\"\n \"\\P\\ f x \\Q\\,\\E\\ \\ \\P\\ f $ x \\Q\\,\\E\\\"\n \"\\P\\ f x \\Q\\,- \\ \\P\\ f $ x \\Q\\,-\"\n \"\\P\\ f x -,\\E\\ \\ \\P\\ f $ x -,\\E\\\"\n by simp+\n\nlemma hoare_validE_pred_conj:\n \"\\ \\P\\f\\Q\\,\\E\\; \\P\\f\\R\\,\\E\\ \\ \\ \\P\\f\\Q And R\\,\\E\\\"\n unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma hoare_validE_conj:\n \"\\ \\P\\f\\Q\\,\\E\\; \\P\\f\\R\\,\\E\\ \\ \\ \\P\\ f \\\\r s. Q r s \\ R r s\\,\\E\\\"\n unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma hoare_valid_validE:\n \"\\P\\f\\\\r. Q\\ \\ \\P\\f\\\\r. Q\\,\\\\r. Q\\\"\n unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma liftE_validE_E [wp]:\n \"\\\\\\ liftE f -, \\Q\\\"\n by (clarsimp simp: validE_E_def valid_def)\n\nlemma validE_validE_E [wp_comb]:\n \"\\P\\ f \\\\\\\\, \\E\\ \\ \\P\\ f -, \\E\\\"\n by (simp add: validE_E_def)\n\nlemma validE_E_validE:\n \"\\P\\ f -, \\E\\ \\ \\P\\ f \\\\\\\\, \\E\\\"\n by (simp add: validE_E_def)\n\n(*\n * if_validE_E:\n *\n * \\?P1 \\ \\?Q1\\ ?f1 -, \\?E\\; \\ ?P1 \\ \\?R1\\ ?g1 -, \\?E\\\\ \\ \\\\s. (?P1 \\ ?Q1 s) \\ (\\ ?P1 \\ ?R1 s)\\ if ?P1 then ?f1 else ?g1 -, \\?E\\\n *)\nlemmas if_validE_E [wp_split] =\n validE_validE_E [OF hoare_vcg_split_ifE [OF validE_E_validE validE_E_validE]]\n\nlemma returnOk_E [wp]:\n \"\\\\\\ returnOk r -, \\Q\\\"\n by (simp add: validE_E_def) wp\n\nlemma hoare_drop_imp:\n \"\\P\\ f \\Q\\ \\ \\P\\ f \\\\r s. R r s \\ Q r s\\\"\n by (auto simp: valid_def)\n\nlemma hoare_drop_impE:\n \"\\\\P\\ f \\\\r. Q\\, \\E\\\\ \\ \\P\\ f \\\\r s. R r s \\ Q s\\, \\E\\\"\n by (metis (lifting, mono_tags) hoare_post_impErr')\n\nlemma hoare_drop_impE_R:\n \"\\P\\ f \\Q\\,- \\ \\P\\ f \\\\r s. R r s \\ Q r s\\, -\"\n by (auto simp: validE_R_def validE_def valid_def split_def split: sum.splits)\n\nlemma hoare_drop_impE_E:\n \"\\P\\ f -,\\Q\\ \\ \\P\\ f -,\\\\r s. R r s \\ Q r s\\\"\n by (auto simp: validE_E_def validE_def valid_def split_def split: sum.splits)\n\nlemmas hoare_drop_imps = hoare_drop_imp hoare_drop_impE_R hoare_drop_impE_E\n\nlemma bind_det_exec:\n \"fst (a s) = {(r,s')} \\ fst ((a >>= b) s) = fst (b r s')\"\n by (simp add: bind_def)\n\nlemma in_bind_det_exec:\n \"fst (a s) = {(r,s')} \\ (s'' \\ fst ((a >>= b) s)) = (s'' \\ fst (b r s'))\"\n by (simp add: bind_def)\n\nlemma exec_put:\n \"(put s' >>= m) s = m () s'\"\n by (simp add: bind_def put_def)\n\nlemma bind_execI:\n \"\\ (r'',s'') \\ fst (f s); \\x \\ fst (g r'' s''). P x \\ \\\n \\x \\ fst ((f >>= g) s). P x\"\n by (force simp: in_bind split_def bind_def)\n\nlemma True_E_E [wp]: \"\\\\\\ f -,\\\\\\\\\"\n by (auto simp: validE_E_def validE_def valid_def split: sum.splits)\n\n(*\n * \\\\x. \\?B1 x\\ ?g1 x -, \\?E\\; \\?P\\ ?f1 \\?B1\\, \\?E\\\\ \\ \\?P\\ ?f1 >>=E ?g1 -, \\?E\\\n *)\nlemmas [wp_split] =\n validE_validE_E [OF hoare_vcg_seqE [OF validE_E_validE]]\n\nlemma case_option_wp:\n assumes x: \"\\x. \\P x\\ m x \\Q\\\"\n assumes y: \"\\P'\\ m' \\Q\\\"\n shows \"\\\\s. (x = None \\ P' s) \\ (x \\ None \\ P (the x) s)\\\n case_option m' m x \\Q\\\"\n apply (cases x, simp_all)\n apply (rule y)\n apply (rule x)\n done\n\nlemma case_option_wpE:\n assumes x: \"\\x. \\P x\\ m x \\Q\\,\\E\\\"\n assumes y: \"\\P'\\ m' \\Q\\,\\E\\\"\n shows \"\\\\s. (x = None \\ P' s) \\ (x \\ None \\ P (the x) s)\\\n case_option m' m x \\Q\\,\\E\\\"\n apply (cases x, simp_all)\n apply (rule y)\n apply (rule x)\n done\n\nlemma in_bindE:\n \"(rv, s') \\ fst ((f >>=E (\\rv'. g rv')) s) =\n ((\\ex. rv = Inl ex \\ (Inl ex, s') \\ fst (f s)) \\\n (\\rv' s''. (rv, s') \\ fst (g rv' s'') \\ (Inr rv', s'') \\ fst (f s)))\"\n apply (rule iffI)\n apply (clarsimp simp: bindE_def bind_def)\n apply (case_tac a)\n apply (clarsimp simp: lift_def throwError_def return_def)\n apply (clarsimp simp: lift_def)\n apply safe\n apply (clarsimp simp: bindE_def bind_def)\n apply (erule rev_bexI)\n apply (simp add: lift_def throwError_def return_def)\n apply (clarsimp simp: bindE_def bind_def)\n apply (erule rev_bexI)\n apply (simp add: lift_def)\n done\n\n(*\n * \\?P\\ ?m1 -, \\?E\\ \\ \\?P\\ liftME ?f1 ?m1 -, \\?E\\\n *)\nlemmas [wp_split] = validE_validE_E [OF liftME_wp, simplified, OF validE_E_validE]\n\nlemma assert_A_True[simp]: \"assert True = return ()\"\n by (simp add: assert_def)\n\nlemma assert_wp [wp]: \"\\\\s. P \\ Q () s\\ assert P \\Q\\\"\n by (cases P, (simp add: assert_def | wp)+)\n\nlemma list_cases_wp:\n assumes a: \"\\P_A\\ a \\Q\\\"\n assumes b: \"\\x xs. ts = x#xs \\ \\P_B x xs\\ b x xs \\Q\\\"\n shows \"\\case_list P_A P_B ts\\ case ts of [] \\ a | x # xs \\ b x xs \\Q\\\"\n by (cases ts, auto simp: a b)\n\n(* FIXME: make wp *)\nlemma whenE_throwError_wp:\n \"\\\\s. \\Q \\ P s\\ whenE Q (throwError e) \\\\rv. P\\, -\"\n apply (simp add: whenE_def split del: split_if)\n apply (rule hoare_pre)\n apply wp\n apply simp\n done\n\nlemma select_throwError_wp:\n \"\\\\s. \\x\\S. Q x s\\ select S >>= throwError -, \\Q\\\"\n by (simp add: bind_def throwError_def return_def select_def validE_E_def\n validE_def valid_def)\n\n\nsection \"validNF Rules\"\n\nsubsection \"Basic validNF theorems\"\n\nlemma validNF [intro?]:\n \"\\ \\ P \\ f \\ Q \\; no_fail P f \\ \\ \\ P \\ f \\ Q \\!\"\n apply (clarsimp simp: validNF_def)\n done\n\nlemma validNF_valid: \"\\ \\ P \\ f \\ Q \\! \\ \\ \\ P \\ f \\ Q \\\"\n apply (clarsimp simp: validNF_def)\n done\n\nlemma validNF_no_fail: \"\\ \\ P \\ f \\ Q \\! \\ \\ no_fail P f\"\n apply (clarsimp simp: validNF_def)\n done\n\nlemma snd_validNF:\n \"\\ \\ P \\ f \\ Q \\!; P s \\ \\ \\ snd (f s)\"\n by (clarsimp simp: validNF_def no_fail_def)\n\nlemma use_validNF:\n \"\\ (r', s') \\ fst (f s); \\ P \\ f \\ Q \\!; P s \\ \\ Q r' s'\"\n by (fastforce simp: validNF_def valid_def)\n\nsubsection \"validNF weakest pre-condition rules\"\n\nlemma validNF_return [wp]:\n \"\\ P x \\ return x \\ P \\!\"\n apply rule\n apply wp\n apply (clarsimp simp: no_fail_def return_def)\n done\n\nlemma validNF_get [wp]:\n \"\\ \\s. P s s \\ get \\ P \\!\"\n apply rule\n apply wp\n apply (clarsimp simp: no_fail_def get_def)\n done\n\nlemma validNF_put [wp]:\n \"\\ \\s. P () x \\ put x \\ P \\!\"\n apply rule\n apply wp\n apply (clarsimp simp: no_fail_def put_def)\n done\n\nlemma validNF_K_bind [wp]:\n \"\\ P \\ x \\ Q \\! \\ \\ P \\ K_bind x f \\ Q \\!\"\n apply (clarsimp simp: validNF_def)\n done\n\nlemma validNF_fail [wp]:\n \"\\ \\s. False \\ fail \\ Q \\!\"\n by (clarsimp simp: validNF_def fail_def no_fail_def)\n\nlemma validNF_prop [wp_unsafe]:\n \"\\ no_fail (\\s. P) f \\ \\ \\ \\s. P \\ f \\ \\rv s. P \\!\"\n apply rule\n apply wp\n apply simp\n done\n\nlemma validNF_post_conj [intro!]:\n \"\\ \\ P \\ a \\ Q \\!; \\ P \\ a \\ R \\! \\ \\ \\ P \\ a \\ Q And R \\!\"\n apply (clarsimp simp: validNF_def)\n done\n\nlemma validNF_pre_disj [intro!]:\n \"\\ \\ P \\ a \\ R \\!; \\ Q \\ a \\ R \\! \\ \\ \\ P or Q \\ a \\ R \\!\"\n apply rule\n apply (drule validNF_valid)+\n apply auto[1]\n apply (drule validNF_no_fail)+\n apply (clarsimp simp: no_fail_def)\n done\n\n(*\n * Setup combination rules for WP, which also requires\n * a \"wp_trip\" rule for validNF.\n *)\n\ndefinition \"validNF_property Q s b \\ \\ snd (b s) \\ (\\(r', s') \\ fst (b s). Q r' s')\"\n\nlemma validNF_is_triple [wp_trip]:\n \"validNF P f Q = triple_judgement P f (validNF_property Q)\"\n apply (clarsimp simp: validNF_def triple_judgement_def validNF_property_def)\n apply (clarsimp simp: no_fail_def valid_def)\n apply auto\n done\n\nlemma validNF_weaken_pre [wp_comb]:\n \"\\\\Q\\ a \\R\\!; \\s. P s \\ Q s\\ \\ \\P\\ a \\R\\!\"\n by (metis hoare_pre_imp no_fail_pre validNF_def)\n\nlemma validNF_post_comb_imp_conj:\n \"\\ \\P'\\ f \\Q\\!; \\P\\ f \\Q'\\!; \\s. P s \\ P' s \\ \\ \\P\\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n by (fastforce simp: validNF_def valid_def)\n\nlemma validNF_post_comb_conj_L:\n \"\\ \\P'\\ f \\Q\\!; \\P\\ f \\Q'\\ \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n apply (clarsimp simp: validNF_def valid_def no_fail_def)\n apply force\n done\n\nlemma validNF_post_comb_conj_R:\n \"\\ \\P'\\ f \\Q\\; \\P\\ f \\Q'\\! \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n apply (clarsimp simp: validNF_def valid_def no_fail_def)\n apply force\n done\n\nlemma validNF_post_comb_conj:\n \"\\ \\P'\\ f \\Q\\!; \\P\\ f \\Q'\\! \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n apply (clarsimp simp: validNF_def valid_def no_fail_def)\n apply force\n done\n\nlemma validNF_split_if [wp_split]:\n \"\\P \\ \\Q\\ f \\S\\!; \\ P \\ \\R\\ g \\S\\!\\ \\ \\\\s. (P \\ Q s) \\ (\\ P \\ R s)\\ if P then f else g \\S\\!\"\n by simp\n\nlemma validNF_vcg_conj_lift:\n \"\\ \\P\\ f \\Q\\!; \\P'\\ f \\Q'\\! \\ \\\n \\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n apply (subst bipred_conj_def[symmetric], rule validNF_post_conj)\n apply (erule validNF_weaken_pre, fastforce)\n apply (erule validNF_weaken_pre, fastforce)\n done\n\nlemma validNF_vcg_disj_lift:\n \"\\ \\P\\ f \\Q\\!; \\P'\\ f \\Q'\\! \\ \\\n \\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\!\"\n apply (clarsimp simp: validNF_def)\n apply safe\n apply (auto intro!: hoare_vcg_disj_lift)[1]\n apply (clarsimp simp: no_fail_def)\n done\n\nlemma validNF_vcg_all_lift [wp]:\n \"\\ \\x. \\P x\\ f \\Q x\\! \\ \\ \\\\s. \\x. P x s\\ f \\\\rv s. \\x. Q x rv s\\!\"\n apply atomize\n apply rule\n apply (clarsimp simp: validNF_def)\n apply (rule hoare_vcg_all_lift)\n apply force\n apply (clarsimp simp: no_fail_def validNF_def)\n done\n\nlemma validNF_bind [wp_split]:\n \"\\ \\x. \\B x\\ g x \\C\\!; \\A\\ f \\B\\! \\ \\\n \\A\\ do x \\ f; g x od \\C\\!\"\n apply rule\n apply (metis validNF_valid hoare_seq_ext)\n apply (clarsimp simp: no_fail_def validNF_def bind_def' valid_def)\n apply blast\n done\n\nlemmas validNF_seq_ext = validNF_bind\n\nsubsection \"validNF compound rules\"\n\nlemma validNF_state_assert [wp]:\n \"\\ \\s. P () s \\ G s \\ state_assert G \\ P \\!\"\n apply rule\n apply wp\n apply simp\n apply (clarsimp simp: no_fail_def state_assert_def\n bind_def' assert_def return_def get_def)\n done\n\nlemma validNF_modify [wp]:\n \"\\ \\s. P () (f s) \\ modify f \\ P \\!\"\n apply (clarsimp simp: modify_def)\n apply wp\n done\n\nlemma validNF_gets [wp]:\n \"\\\\s. P (f s) s\\ gets f \\P\\!\"\n apply (clarsimp simp: gets_def)\n apply wp\n done\n\nlemma validNF_condition [wp]:\n \"\\ \\ Q \\ A \\P\\!; \\ R \\ B \\P\\!\\ \\ \\\\s. if C s then Q s else R s\\ condition C A B \\P\\!\"\n apply rule\n apply (drule validNF_valid)+\n apply (erule (1) condition_wp)\n apply (drule validNF_no_fail)+\n apply (clarsimp simp: no_fail_def condition_def)\n done\n\nlemma validNF_alt_def:\n \"validNF P m Q = (\\s. P s \\ ((\\(r', s') \\ fst (m s). Q r' s') \\ \\ snd (m s)))\"\n by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_assert [wp]:\n \"\\ (\\s. P) and (R ()) \\ assert P \\ R \\!\"\n apply rule\n apply (clarsimp simp: valid_def in_return)\n apply (clarsimp simp: no_fail_def return_def)\n done\n\nlemma validNF_false_pre:\n \"\\ \\_. False \\ P \\ Q \\!\"\n apply (clarsimp simp: validNF_def no_fail_def)\n done\n\nlemma validNF_chain:\n \"\\\\P'\\ a \\R'\\!; \\s. P s \\ P' s; \\r s. R' r s \\ R r s\\ \\ \\P\\ a \\R\\!\"\n apply (fastforce simp: validNF_def valid_def no_fail_def Ball_def)\n done\n\nlemma validNF_case_prod [wp]:\n \"\\ \\x y. validNF (P x y) (B x y) Q \\ \\ validNF (case_prod P v) (case_prod (\\x y. B x y) v) Q\"\n by (metis prod.exhaust split_conv)\n\nlemma validE_NF_case_prod [wp]:\n \"\\ \\a b. \\P a b\\ f a b \\Q\\, \\E\\! \\ \\\n \\case x of (a, b) \\ P a b\\ case x of (a, b) \\ f a b \\Q\\, \\E\\!\"\n apply (clarsimp simp: validE_NF_alt_def)\n apply (erule validNF_case_prod)\n done\n\nlemma no_fail_is_validNF_True: \"no_fail P s = (\\ P \\ s \\ \\_ _. True \\!)\"\n apply (clarsimp simp: no_fail_def validNF_def valid_def)\n done\n\nsubsection \"validNF reasoning in the exception monad\"\n\nlemma validE_NF [intro?]:\n \"\\ \\ P \\ f \\ Q \\,\\ E \\; no_fail P f \\ \\ \\ P \\ f \\ Q \\,\\ E \\!\"\n apply (clarsimp simp: validE_NF_def)\n done\n\nlemma validE_NF_valid:\n \"\\ \\ P \\ f \\ Q \\,\\ E \\! \\ \\ \\ P \\ f \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_NF_def)\n done\n\nlemma validE_NF_no_fail:\n \"\\ \\ P \\ f \\ Q \\,\\ E \\! \\ \\ no_fail P f\"\n apply (clarsimp simp: validE_NF_def)\n done\n\nlemma validE_NF_weaken_pre [wp_comb]:\n \"\\\\Q\\ a \\R\\,\\E\\!; \\s. P s \\ Q s\\ \\ \\P\\ a \\R\\,\\E\\!\"\n apply (clarsimp simp: validE_NF_alt_def)\n apply (erule validNF_weaken_pre)\n apply simp\n done\n\nlemma validE_NF_post_comb_conj_L:\n \"\\ \\P\\ f \\Q\\, \\ E \\!; \\P'\\ f \\Q'\\, \\ \\_ _. True \\ \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\, \\ E \\!\"\n apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n valid_def no_fail_def split: sum.splits)\n apply force\n done\n\nlemma validE_NF_post_comb_conj_R:\n \"\\ \\P\\ f \\Q\\, \\ \\_ _. True \\; \\P'\\ f \\Q'\\, \\ E \\! \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\, \\ E \\!\"\n apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n valid_def no_fail_def split: sum.splits)\n apply force\n done\n\nlemma validE_NF_post_comb_conj:\n \"\\ \\P\\ f \\Q\\, \\ E \\!; \\P'\\ f \\Q'\\, \\ E \\! \\ \\ \\\\s. P s \\ P' s \\ f \\\\rv s. Q rv s \\ Q' rv s\\, \\ E \\!\"\n apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n valid_def no_fail_def split: sum.splits)\n apply force\n done\n\nlemma validE_NF_chain:\n \"\\\\P'\\ a \\R'\\,\\E'\\!;\n \\s. P s \\ P' s;\n \\r' s'. R' r' s' \\ R r' s';\n \\r'' s''. E' r'' s'' \\ E r'' s''\\ \\\n \\\\s. P s \\ a \\\\r' s'. R r' s'\\,\\\\r'' s''. E r'' s''\\!\"\n apply (fastforce simp: validE_NF_def validE_def2 no_fail_def Ball_def split: sum.splits)\n done\n\nlemma validE_NF_bind_wp [wp]:\n \"\\\\x. \\B x\\ g x \\C\\, \\E\\!; \\A\\ f \\B\\, \\E\\!\\ \\ \\A\\ f >>=E (\\x. g x) \\C\\, \\E\\!\"\n apply (unfold validE_NF_alt_def bindE_def)\n apply (rule validNF_bind [rotated])\n apply assumption\n apply (clarsimp simp: lift_def throwError_def split: sum.splits)\n apply wp\n apply simp\n done\n\nlemma validNF_catch [wp]:\n \"\\\\x. \\E x\\ handler x \\Q\\!; \\P\\ f \\Q\\, \\E\\!\\ \\ \\P\\ f (\\x. handler x) \\Q\\!\"\n apply (unfold validE_NF_alt_def catch_def)\n apply (rule validNF_bind [rotated])\n apply assumption\n apply (clarsimp simp: lift_def throwError_def split: sum.splits)\n apply wp\n done\n\nlemma validNF_throwError [wp]:\n \"\\E e\\ throwError e \\P\\, \\E\\!\"\n apply (unfold validE_NF_alt_def throwError_def o_def)\n apply wp\n apply simp\n done\n\nlemma validNF_returnOk [wp]:\n \"\\P e\\ returnOk e \\P\\, \\E\\!\"\n apply (clarsimp simp: validE_NF_alt_def returnOk_def)\n apply wp\n apply clarsimp\n done\n\nlemma validNF_whenE [wp]:\n \"(P \\ \\Q\\ f \\R\\, \\E\\!) \\ \\if P then Q else R ()\\ whenE P f \\R\\, \\E\\!\"\n unfolding whenE_def\n apply clarsimp\n apply wp\n done\n\nlemma validNF_nobindE [wp]:\n \"\\ \\B\\ g \\C\\,\\E\\!;\n \\A\\ f \\\\r s. B s\\,\\E\\! \\ \\\n \\A\\ doE f; g odE \\C\\,\\E\\!\"\n apply clarsimp\n apply wp\n apply auto\n done\n\n(*\n * Setup triple rules for validE_NF so that we can use the\n * \"wp_comb\" attribute.\n *)\n\ndefinition \"validE_NF_property Q E s b \\ \\ snd (b s)\n \\ (\\(r', s') \\ fst (b s). case r' of Inl x \\ E x s' | Inr x \\ Q x s')\"\n\nlemma validE_NF_is_triple [wp_trip]:\n \"validE_NF P f Q E = triple_judgement P f (validE_NF_property Q E)\"\n apply (clarsimp simp: validE_NF_def validE_def2 no_fail_def triple_judgement_def\n validE_NF_property_def split: sum.splits)\n apply blast\n done\n\nlemmas [wp_comb] = validE_NF_weaken_pre\n\nlemma validNF_cong:\n \"\\ \\s. P s = P' s; \\s. P s \\ m s = m' s;\n \\r' s' s. \\ P s; (r', s') \\ fst (m s) \\ \\ Q r' s' = Q' r' s' \\ \\\n (\\ P \\ m \\ Q \\!) = (\\ P' \\ m' \\ Q' \\!)\"\n by (fastforce simp: validNF_alt_def)\n\nlemma validE_NF_liftE [wp]:\n \"\\P\\ f \\Q\\! \\ \\P\\ liftE f \\Q\\,\\E\\!\"\n apply (clarsimp simp: validE_NF_alt_def liftE_def)\n apply wp\n apply clarsimp\n done\n\nlemma validE_NF_handleE' [wp]:\n \"\\ \\x. \\F x\\ handler x \\Q\\,\\E\\!; \\P\\ f \\Q\\,\\F\\! \\ \\\n \\P\\ f (\\x. handler x) \\Q\\,\\E\\!\"\n apply (unfold validE_NF_alt_def handleE'_def)\n apply (rule validNF_bind [rotated])\n apply assumption\n apply (clarsimp split: sum.splits)\n apply wp\n apply simp\n done\n\nlemma validE_NF_handleE [wp]:\n \"\\ \\x. \\F x\\ handler x \\Q\\,\\E\\!; \\P\\ f \\Q\\,\\F\\! \\ \\\n \\P\\ f handler \\Q\\,\\E\\!\"\n apply (unfold handleE_def)\n apply (metis validE_NF_handleE')\n done\n\nlemma validE_NF_condition [wp]:\n \"\\ \\ Q \\ A \\P\\,\\ E \\!; \\ R \\ B \\P\\,\\ E \\!\\\n \\ \\\\s. if C s then Q s else R s\\ condition C A B \\P\\,\\ E \\!\"\n apply rule\n apply (drule validE_NF_valid)+\n apply (wp, simp, simp)\n apply (drule validE_NF_no_fail)+\n apply (clarsimp simp: no_fail_def condition_def)\n done\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/wp/NonDetMonadVCG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.26183791066279083}} {"text": "header {* Code Generation for the Skeleton Algorithm \\label{sec:skel_code}*}\ntheory Gabow_Skeleton_Code\nimports \n Gabow_Skeleton\n \"../CAVA_Automata/Digraph_Impl\"\n \"../CAVA_Automata/CAVA_Base/CAVA_Code_Target\"\nbegin\n\nsection {* Statistics *}\ntext {*\n In this section, we do the ML setup that gathers statistics about the \n algorithm's execution.\n*}\n\ncode_printing\n code_module Gabow_Skeleton_Statistics \\ (SML) {*\n structure Gabow_Skeleton_Statistics = struct\n val active = Unsynchronized.ref false\n val num_vis = Unsynchronized.ref 0\n\n val time = Unsynchronized.ref Time.zeroTime\n\n fun is_active () = !active\n fun newnode () = num_vis := !num_vis + 1\n\n fun start () = (active := true; time := Time.now ())\n fun stop () = (time := Time.- (Time.now (), !time))\n\n fun to_string () = let\n val t = Time.toMilliseconds (!time)\n val states_per_ms = real (!num_vis) / real t\n val realStr = Real.fmt (StringCvt.FIX (SOME 2))\n in\n \"Required time: \" ^ IntInf.toString (t) ^ \"ms\\n\"\n ^ \"States per ms: \" ^ realStr states_per_ms ^ \"\\n\"\n ^ \"# states: \" ^ IntInf.toString (!num_vis) ^ \"\\n\"\n end\n \n val _ = Statistics.register_stat (\"Gabow-Skeleton\",is_active,to_string)\n\n end\n*}\ncode_reserved SML Gabow_Skeleton_Statistics\n\ncode_printing\n constant stat_newnode \\ (SML) \"Gabow'_Skeleton'_Statistics.newnode\"\n| constant stat_start \\ (SML) \"Gabow'_Skeleton'_Statistics.start\"\n| constant stat_stop \\ (SML) \"Gabow'_Skeleton'_Statistics.stop\"\n\nsection {* Automatic Refinement Setup *}\nconsts i_node_state :: interface\n\ndefinition \"node_state_rel \\ {(-1::int,DONE)} \\ {(int k,STACK k) | k. True }\"\nlemma node_state_rel_simps[simp]:\n \"(i,DONE)\\node_state_rel \\ i=-1\"\n \"(i,STACK n)\\node_state_rel \\ i = int n\"\n unfolding node_state_rel_def\n by auto\n\nlemma node_state_rel_sv[simp,intro!,relator_props]:\n \"single_valued node_state_rel\"\n unfolding node_state_rel_def\n by (auto intro: single_valuedI)\n\nlemmas [autoref_rel_intf] = REL_INTFI[of node_state_rel i_node_state]\n\nprimrec is_DONE where\n \"is_DONE DONE = True\"\n| \"is_DONE (STACK _) = False\"\n\nlemma node_state_rel_refine[autoref_rules]:\n \"(-1,DONE)\\node_state_rel\"\n \"(int,STACK)\\nat_rel\\node_state_rel\"\n \"(\\i. i<0,is_DONE)\\node_state_rel\\bool_rel\"\n \"((\\f g i. if i\\0 then f (nat i) else g),case_node_state)\n \\(nat_rel \\ R) \\ R \\ node_state_rel \\ R\"\n unfolding node_state_rel_def \n apply auto [3]\n apply (fastforce dest: fun_relD)\n done\n\n\n\n(* TODO: Make changing the Autoref-config simpler, by concentrating\n everything here *)\nconsts i_node :: interface\n\n(* TODO: Move generic part of this locale to Digraph_impl *)\nlocale fr_graph_impl_loc = fr_graph G\n for mrel and G_impl and G :: \"('v::hashable,'more) fr_graph_rec_scheme\"\n +\n assumes G_refine: \"(G_impl,G)\\\\mrel,Id\\frg_impl_rel_ext\"\nbegin\n abbreviation \"node_rel \\ Id :: ('v \\ _) set\"\n lemmas [autoref_rel_intf] = REL_INTFI[of node_rel i_node]\n\n lemmas [autoref_rules] = G_refine\n\n lemma locale_this: \"fr_graph_impl_loc mrel G_impl G\"\n by unfold_locales\n\n abbreviation \"oGSi_rel \\ \\node_rel,node_state_rel\\dflt_ahm_rel\"\n\n abbreviation \"GSi_rel \\ \n \\node_rel\\as_rel \n \\\\<^sub>r \\nat_rel\\as_rel \n \\\\<^sub>r \\node_rel,node_state_rel\\dflt_ahm_rel\n \\\\<^sub>r \\nat_rel \\\\<^sub>r \\node_rel\\list_set_rel\\as_rel\"\n\n lemmas [autoref_op_pat] = GS.S_def GS.B_def GS.I_def GS.P_def\n\nend\n\nsection {* Generating the Code *}\n\ncontext fr_graph_impl_loc\nbegin\n schematic_lemma push_code_aux: \"(?c,push_impl)\\node_rel \\ GSi_rel \\ GSi_rel\"\n unfolding push_impl_def_opt[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n concrete_definition (in -) push_code uses fr_graph_impl_loc.push_code_aux\n lemmas [autoref_rules] = push_code.refine[OF locale_this]\n \n schematic_lemma pop_code_aux: \"(?c,pop_impl)\\GSi_rel \\ \\GSi_rel\\nres_rel\"\n unfolding pop_impl_def_opt[abs_def]\n unfolding GS.mark_as_done_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n concrete_definition (in -) pop_code uses fr_graph_impl_loc.pop_code_aux\n lemmas [autoref_rules] = pop_code.refine[OF locale_this]\n\n schematic_lemma S_idx_of_code_aux: \n notes [autoref_rules] = IdI[of \"undefined::nat\"] (* TODO: hack!*)\n shows \"(?c,GS.S_idx_of)\\GSi_rel \\ node_rel \\ nat_rel\"\n unfolding GS.S_idx_of_def[abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n concrete_definition (in -) S_idx_of_code \n uses fr_graph_impl_loc.S_idx_of_code_aux\n lemmas [autoref_rules] = S_idx_of_code.refine[OF locale_this] \n\n schematic_lemma idx_of_code_aux:\n notes [autoref_rules] = IdI[of \"undefined::nat\"] (* TODO: hack!*)\n shows \"(?c,GS.idx_of_impl)\\ GSi_rel \\ node_rel \\ \\nat_rel\\nres_rel\"\n unfolding \n GS.idx_of_impl_def[abs_def, unfolded GS.find_seg_impl_def GS.S_idx_of_def,\n THEN opt_GSdef, unfolded GS_sel_simps, abs_def]\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n concrete_definition (in -) idx_of_code uses fr_graph_impl_loc.idx_of_code_aux\n lemmas [autoref_rules] = idx_of_code.refine[OF locale_this] \n\n schematic_lemma collapse_code_aux: \n \"(?c,collapse_impl)\\node_rel \\ GSi_rel \\ \\GSi_rel\\nres_rel\"\n unfolding collapse_impl_def_opt[abs_def] \n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal))\n done\n concrete_definition (in -) collapse_code \n uses fr_graph_impl_loc.collapse_code_aux\n lemmas [autoref_rules] = collapse_code.refine[OF locale_this] \n\n term select_edge_impl\n schematic_lemma select_edge_code_aux:\n \"(?c,select_edge_impl) \n \\ GSi_rel \\ \\\\node_rel\\option_rel \\\\<^sub>r GSi_rel\\nres_rel\"\n unfolding select_edge_impl_def_opt[abs_def] \n\n using [[autoref_trace_failed_id]]\n using [[goals_limit=1]]\n apply (autoref (keep_goal,trace))\n done\n concrete_definition (in -) select_edge_code \n uses fr_graph_impl_loc.select_edge_code_aux\n lemmas [autoref_rules] = select_edge_code.refine[OF locale_this] \n\n context begin interpretation autoref_syn .\n\n term fr_graph.pop_impl\n lemma [autoref_op_pat]: \n \"push_impl \\ OP push_impl\"\n \"collapse_impl \\ OP collapse_impl\"\n \"select_edge_impl \\ OP select_edge_impl\"\n \"pop_impl \\ OP pop_impl\"\n by simp_all\n \n end\n\n schematic_lemma skeleton_code_aux:\n \"(?c,skeleton_impl) \\ \\oGSi_rel\\nres_rel\"\n unfolding skeleton_impl_def[abs_def] initial_impl_def GS_initial_impl_def\n unfolding path_is_empty_impl_def is_on_stack_impl_def is_done_impl_def \n is_done_oimpl_def\n unfolding GS.is_on_stack_impl_def GS.is_done_impl_def\n using [[autoref_trace_failed_id]]\n\n apply (autoref (keep_goal,trace))\n done\n concrete_definition (in -) skeleton_code \n uses fr_graph_impl_loc.skeleton_code_aux\n lemmas [autoref_rules] = skeleton_code.refine[OF locale_this] \n \n\n schematic_lemma pop_tr_aux: \"RETURN ?c \\ pop_code s\"\n unfolding pop_code_def by refine_transfer\n concrete_definition (in -) pop_tr uses fr_graph_impl_loc.pop_tr_aux\n lemmas [refine_transfer] = pop_tr.refine[OF locale_this]\n\n schematic_lemma select_edge_tr_aux: \"RETURN ?c \\ select_edge_code s\"\n unfolding select_edge_code_def by refine_transfer\n concrete_definition (in -) select_edge_tr \n uses fr_graph_impl_loc.select_edge_tr_aux\n lemmas [refine_transfer] = select_edge_tr.refine[OF locale_this]\n\n schematic_lemma idx_of_tr_aux: \"RETURN ?c \\ idx_of_code v s\"\n unfolding idx_of_code_def by refine_transfer\n concrete_definition (in -) idx_of_tr uses fr_graph_impl_loc.idx_of_tr_aux\n lemmas [refine_transfer] = idx_of_tr.refine[OF locale_this]\n\n schematic_lemma collapse_tr_aux: \"RETURN ?c \\ collapse_code v s\"\n unfolding collapse_code_def by refine_transfer\n concrete_definition (in -) collapse_tr uses fr_graph_impl_loc.collapse_tr_aux\n lemmas [refine_transfer] = collapse_tr.refine[OF locale_this]\n\n schematic_lemma skeleton_tr_aux: \"RETURN ?c \\ skeleton_code g\"\n unfolding skeleton_code_def by refine_transfer\n concrete_definition (in -) skeleton_tr uses fr_graph_impl_loc.skeleton_tr_aux\n lemmas [refine_transfer] = skeleton_tr.refine[OF locale_this]\n\nend\n\nterm skeleton_tr\n\nexport_code skeleton_tr checking SML\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Gabow_SCC/Gabow_Skeleton_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.26183791066279083}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Laws_Weak\n imports Weaken_Bisimulation Weak_Congruence Tau_Sim Tau_Stat_Imp\nbegin\n\ncontext weakTauLaws begin\n\nlemma tauLaw1:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n \n shows \"\\ \\ \\.(P) \\ P\"\nproof - \n let ?X = \"{(\\, \\.(P), P) | \\ P. True}\" let ?Y = \"{(\\, P, \\.(P)) | \\ P. True}\"\n have \"(\\, \\.(P), P) \\ ?X \\ ?Y\" by auto\n moreover have \"eqvt(?X \\ ?Y)\" by(auto simp add: eqvt_def simp add: eqvts)\n ultimately have \"\\ \\ \\.(P) \\\\<^sub>w P\"\n proof(coinduct rule: weakenTransitiveCoinduct)\n case(cStatImp \\ P Q)\n show ?case\n proof(cases \"(\\, P, Q) \\ ?X\")\n case True\n {\n fix \\ P\n have \"\\ \\ P \\\\<^sub>w<(?X \\ ?Y \\ weakBisim)> P\" by(auto simp add: weakenStatImp_def intro: weakBisimReflexive)\n moreover have \"(\\, \\.(P), P) \\ ?X \\ ?Y \\ weakBisim\" by auto\n ultimately have \"\\ \\ \\.(P) \\\\<^sub>w<(?X \\ ?Y \\ weakBisim)> P\"\n by(rule tauLaw1StatImpLeft)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?thesis by auto \n next\n case False\n from \\(\\, P, Q) \\ ?X\\ \\(\\, P, Q) \\ ?X \\ ?Y\\ have \"(\\, P, Q) \\ ?Y\" by auto\n {\n fix \\ P\n have \"\\ \\ P \\ P\" using weakBisimReflexive\n by(rule weakBisimE)\n moreover have \"\\\\ P Q R. \\\\ \\ P \\ Q; \\ \\ Q \\ R\\ \\ (\\, P, R) \\ ?X \\ ?Y \\ weakBisim\"\n by(fastforce intro: weakBisimTransitive strongBisimWeakBisim)\n ultimately have \"\\ \\ P \\<( ?X \\ ?Y \\ weakBisim)> \\.(P)\" by(rule tauLaw1StatImpRight)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?X \\ ?Y \\ weakBisim; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?X \\ ?Y \\ weakBisim\"\n by(auto dest: statEqWeakBisim)\n ultimately have \"\\ \\ P \\\\<^sub>w<( ?X \\ ?Y \\ weakBisim)> \\.(P)\" by(rule weakStatImpWeakenStatImp)\n }\n with \\(\\, P, Q) \\ ?Y\\ show ?thesis by auto\n qed\n next\n case(cSim \\ P Q)\n let ?Z = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ ?X \\ ?Y \\ weakenBisim \\ \\ \\ Q' \\ Q}\"\n have \"eqvt ?Z\" \n apply auto\n apply(auto simp add: eqvt_def eqvts)\n apply(rule_tac x=\"(p \\ (\\.(Q')))\" in exI)\n apply(auto intro: bisimClosed)\n apply(simp add: eqvts)\n apply(blast intro: bisimClosed weakBisimClosed)\n apply(rule_tac x=\"(p \\ P')\" in exI)\n apply(auto intro: bisimClosed)\n apply(rule_tac x=\"\\.(p \\ P')\" in exI)\n apply auto\n apply(drule_tac p=p and Q=b in bisimClosed)\n apply(simp add: eqvts)\n apply(rule_tac x=\"(p \\ P')\" in exI)\n apply(auto intro: bisimClosed)\n apply(rule_tac x=\"p \\ Q'\" in exI)\n apply auto\n by(blast intro: bisimClosed dest: weakBisimClosed)+\n show ?case\n proof(cases \"(\\, P, Q) \\ ?X\")\n case True\n {\n fix P\n have \"\\ \\ P \\ P\" using weakenBisimEqWeakBisim by(blast intro: weakSimReflexive weakBisimReflexive bisimReflexive)\n moreover note \\eqvt ?Z\\\n moreover have \"\\\\ P Q R. \\\\ \\ P \\ Q; (\\, Q, R) \\ ?Z\\ \\ (\\, P, R) \\ ?Z\"\n by(blast intro: bisimTransitive)\n ultimately have \"\\ \\ \\.(P) \\ P\"\n by(rule tauLaw1SimLeft)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?Z; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?Z\"\n by simp (blast intro: statEqWeakBisim statEqBisim)\n ultimately have \"\\ \\ \\.(P) \\\\<^sub>w P\" by(rule weakSimWeakenSim)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?thesis by auto\n next\n case False\n from \\(\\, P, Q) \\ ?X\\ \\(\\, P, Q) \\ ?X \\ ?Y\\ have \"(\\, P, Q) \\ ?Y\" by auto\n moreover {\n fix P\n note \\eqvt ?Z\\ \n moreover have \"(\\, P, P) \\ ?Z\" by simp (blast intro: weakBisimReflexive bisimReflexive)\n moreover have \"\\\\ P Q R. \\(\\, P, Q) \\ ?Z; \\ \\ Q \\ R\\ \\ (\\, P, R) \\ ?Z\"\n by(blast intro: bisimTransitive)\n ultimately have \"\\ \\ P \\ \\.(P)\" by(rule tauLaw1SimRight)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?Z; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?Z\"\n by simp (blast intro: statEqWeakBisim statEqBisim)\n ultimately have \"\\ \\ P \\\\<^sub>w \\.(P)\" by(rule weakSimWeakenSim)\n }\n ultimately show ?thesis by auto\n qed\n next\n case(cExt \\ P Q \\')\n thus ?case by auto\n next\n case(cSym \\ P Q)\n thus ?case by auto\n qed\n thus ?thesis by simp\nqed\n\nlemma tauLaw3:\n fixes \\ :: 'b\n and \\ :: \"'a prefix\"\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ \\\\(\\.(P)) \\ \\\\P\"\nproof -\n let ?X = \"({(\\, \\\\(\\.(P)), \\\\P) | \\ \\ P. True})\"\n let ?Y = \"({(\\, \\\\P, \\\\(\\.(P))) | \\ \\ P. True})\"\n\n have \"(\\, \\\\(\\.(P)), \\\\P) \\ ?X \\ ?Y\" by blast\n moreover have \"eqvt(?X \\ ?Y)\" by(fastforce simp add: eqvt_def simp add: eqvts)\n ultimately have \"\\ \\ \\\\(\\.(P)) \\\\<^sub>w \\\\P\"\n proof(coinduct rule: weakenTransitiveCoinduct)\n case(cStatImp \\ P Q)\n show ?case\n proof(cases \"(\\, P, Q) \\ ?X\")\n case True\n {\n fix \\ \\ P\n have \"\\\\'. (\\ \\ \\', \\\\(\\.(P)), \\\\P) \\ ?X \\ ?Y \\ weakenBisim\" by auto\n hence \"\\ \\ \\\\(\\.(P)) \\<(?X \\ ?Y \\ weakenBisim)> \\\\P\" by(rule tauLaw3StatImpLeft)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?X \\ ?Y \\ weakenBisim; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?X \\ ?Y \\ weakenBisim\"\n by(fastforce intro: statEqWeakBisim)\n ultimately have \"\\ \\ \\\\(\\.(P)) \\\\<^sub>w<(?X \\ ?Y \\ weakenBisim)> \\\\P\" by(rule weakStatImpWeakenStatImp)\n }\n with \\(\\, P, Q) \\ ?X\\ show ?thesis by blast\n next\n case False\n {\n fix \\ \\ P\n have \"\\\\'. (\\ \\ \\', \\\\P, \\\\(\\.(P))) \\ ?X \\ ?Y \\ weakenBisim\" by auto\n hence \"\\ \\ \\\\P \\<(?X \\ ?Y \\ weakenBisim)> \\\\(\\.(P))\" by(rule tauLaw3StatImpRight)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?X \\ ?Y \\ weakenBisim; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?X \\ ?Y \\ weakenBisim\"\n by(fastforce intro: statEqWeakBisim)\n ultimately have \"\\ \\ \\\\P \\\\<^sub>w<(?X \\ ?Y \\ weakenBisim)> \\\\(\\.(P))\" by(rule weakStatImpWeakenStatImp)\n }\n moreover from \\(\\, P, Q) \\ ?X\\ \\(\\, P, Q) \\ ?X \\ ?Y\\ have \"(\\, P, Q) \\ ?Y\" by blast\n ultimately show ?thesis by auto\n qed\n next\n case(cSim \\ P Q)\n let ?Z = \"{(\\, P, Q) | \\ P Q. \\P' Q'. \\ \\ P \\ P' \\ (\\, P', Q') \\ ?X \\ ?Y \\ weakenBisim \\ \\ \\ Q' \\ Q}\"\n have \"eqvt ?Z\" \n apply(clarsimp simp add: eqvt_def)\n apply(elim disjE)\n apply(rule_tac x=\"p \\ P'\" in exI)\n apply(clarsimp simp add: bisimClosed eqvts)\n apply(blast intro: bisimClosed eqvts)\n apply(rule_tac x=\"p \\ P'\" in exI)\n apply(clarsimp simp add: bisimClosed eqvts)\n apply(rule_tac x=\"p \\ (\\\\(\\.(P)))\" in exI)\n apply(clarsimp simp add: eqvts)\n apply(rule conjI)\n apply(rule disjI2)\n apply(blast intro: bisimClosed eqvts)\n apply(drule_tac p=p in bisimClosed)\n apply(drule_tac p=p in bisimClosed)\n apply(simp add: eqvts)\n by(blast dest: bisimClosed weakBisimClosed)\n show ?case\n proof(cases \"(\\, P, Q) \\ ?X\")\n case True\n note \\(\\, P, Q) \\ ?X\\\n moreover {\n fix \\ P \\\n note \\eqvt ?Z\\\n moreover have \"(\\, P, P) \\ ?Z\" using weakenBisimEqWeakBisim by(blast intro: weakBisimReflexive bisimReflexive)\n moreover have \"\\xvec Tvec. length xvec = length Tvec \\ (\\, P[xvec::=Tvec], P[xvec::=Tvec]) \\ ?Z\"\n using weakenBisimEqWeakBisim by(blast intro: weakBisimReflexive bisimReflexive)\n moreover have \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ ?Z; \\ \\ R \\ S\\ \\ (\\, P, S) \\ ?Z\" by(blast intro: bisimTransitive)\n moreover have \"\\\\ P Q \\'. (\\, P, Q) \\ ?Z \\ (\\ \\ \\', P, Q) \\ ?Z\" by(blast dest: weakenBisimE(3) bisimE(3))\n ultimately have \"\\ \\ \\\\(\\.(P)) \\ \\\\P\" by(rule tauLaw3SimLeft)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?Z; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?Z\" by simp (blast dest: statEqWeakBisim statEqBisim)\n ultimately have \"\\ \\ \\\\(\\.(P)) \\\\<^sub>w \\\\P\" by(rule weakSimWeakenSim)\n }\n ultimately show ?thesis by auto\n next\n case False\n from \\(\\, P, Q) \\ ?X\\ \\(\\, P, Q) \\ ?X \\ ?Y\\ have \"(\\, P, Q) \\ ?Y\" by blast\n moreover {\n fix \\ P \\\n note \\eqvt ?Z\\\n moreover have \"\\\\ xvec Tvec. length xvec=length Tvec \\ (\\, P[xvec::=Tvec], \\.(P[xvec::=Tvec])) \\ ?Z\"\n by simp (blast intro: weakBisimE(4) bisimReflexive tauLaw1)\n moreover have \"\\\\ P Q R S. \\\\ \\ P \\ Q; (\\, Q, R) \\ ?Z; \\ \\ R \\ S\\ \\ (\\, P, S) \\ ?Z\" by(blast intro: bisimTransitive)\n moreover have \"\\\\. (\\, P, \\.(P)) \\ ?Z\" by simp (blast intro: weakBisimE(4) bisimReflexive tauLaw1)\n ultimately have \"\\ \\ \\\\P \\ \\\\(\\.(P))\" by(rule tauLaw3SimRight)\n moreover have \"\\\\ P Q \\'. \\(\\, P, Q) \\ ?Z; \\ \\ \\'\\ \\ (\\', P, Q) \\ ?Z\" by simp (blast dest: statEqWeakBisim statEqBisim)\n ultimately have \"\\ \\ \\\\P \\\\<^sub>w \\\\(\\.(P))\" by(rule weakSimWeakenSim)\n }\n ultimately show ?thesis by auto\n qed\n next\n case(cExt \\ P Q \\')\n thus ?case by auto\n next\n case(cSym \\ P Q)\n thus ?case by blast \n qed\n thus ?thesis by simp\nqed\n \nlemma tauLaw3PsiCong:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ \\\\(\\.(P)) \\ \\\\P\"\nproof(induct rule: weakPsiCongI)\n case cWeakBisim\n show ?case by(rule tauLaw3)\nnext\n case cSimLeft\n have \"\\ \\ P \\ P\" by(rule weakBisimReflexive)\n moreover have \"\\\\ P Q R S. \\\\ \\ P \\ Q; \\ \\ Q \\ R; \\ \\ R \\ S\\ \\ \\ \\ P \\ S\"\n by(blast intro: weakBisimTransitive strongBisimWeakBisim)\n ultimately show ?case using weakBisimE(3) by(rule tauLaw3CongSimLeft)\nnext\n case cSimRight\n have \"\\ \\ P \\ P\" by(rule weakBisimReflexive)\n moreover have \"\\\\ P Q R S. \\\\ \\ P \\ Q; \\ \\ Q \\ R; \\ \\ R \\ S\\ \\ \\ \\ P \\ S\"\n by(blast intro: weakBisimTransitive strongBisimWeakBisim)\n ultimately show ?case using tauLaw1[THEN weakBisimE(4)]\n by(rule tauLaw3CongSimRight)\nqed\n \nlemma tauLaw3Cong:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\\\(\\.(P)) \\\\<^sub>c \\\\P\"\nproof(induct rule: weakCongI)\n case(cWeakPsiCong \\ \\)\n show ?case\n proof(nominal_induct \\ rule: prefix.strong_inducts)\n next\n case(pInput M yvec N)\n obtain p where \"set p \\ set yvec \\ set(p \\ yvec)\" and \"(p \\ yvec) \\* N\" and \"(p \\ yvec) \\* P\" and \"(p \\ yvec) \\* \\\"\n by(rule_tac xvec=yvec and c=\"(N, P, \\)\" in name_list_avoiding) auto\n thus ?case using \\wellFormedSubst \\\\ tauLaw3PsiCong[where \\=\"pInput (substTerm.seqSubst M \\) (p \\ yvec) (substTerm.seqSubst (p \\ N) \\)\"]\n by(simp add: inputChainAlpha' eqvts)\n next\n case(pOutput M N)\n thus ?case using \\wellFormedSubst \\\\ tauLaw3PsiCong[where \\=\"pOutput (substTerm.seqSubst M \\) (substTerm.seqSubst N \\)\"]\n by simp\n next\n case pTau\n thus ?case using \\wellFormedSubst \\\\ tauLaw3PsiCong[where \\=\"pTau\"]\n by simp\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Tau_Laws_Weak.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2617899998530847}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Sep_Tactic_Examples\nimports\n \"../sep-capDL/Sep_Tactic_Helper\"\n KHeap_DP\nbegin\n\n\n(* Thesis : Automated Tactics for Seperation Logic *)\n\n(* seperation logic *)\n\n(* after we show that addition and disjointedness on our heap obeys certain laws, we get a seperation algebra *)\n\n(* connectives *)\n\nterm \"P \\* Q\"\n\nterm \"P \\* Q\"\n\nlemma frame_rule:\n \"\\R. \\P\\ f \\\\_. Q\\ \\ \\P \\* R\\ f \\\\_. Q \\* R\\\"\n oops\n\nthm swap_cap_wp[no_vars]\n\nlemma\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp set_cap_wp) (* set_cap doesn't apply *)\nthm set_cap_wp[no_vars]\n apply (rule hoare_strengthen_post)\n apply (wp set_cap_wp)\n apply (clarsimp simp: sep_conj_ac )\noops\n\n\n(* tactics we had pre-thesis *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4)\n apply (sep_select_asm 3)\n apply (sep_select 2)\n apply (sep_cancel)\n apply (sep_cancel)\n apply (sep_cancel)\ndone\n\n(* forward reasoning *)\n\n\nlemma example_drule:\n \"(ptr \\o obj) s\n \\ (ptr \\S obj \\* ptr \\f obj) s\"\n by (metis sep_conj_commute sep_map_o_decomp)\n\nlemma sep_drule_example:\n \"(ptr \\o obj \\* A \\* B ) s\n \\ (A \\* B \\* ptr \\f obj \\* ptr \\S obj) s\"\n apply (sep_drule example_drule)\n apply (sep_solve)\ndone\n\n(* backwards reasoning *)\n\nlemma example_rule:\n \"(ptr \\f obj \\* ptr \\S obj) s\n \\ (ptr \\o obj) s\"\n by (metis sep_map_o_decomp)\n\nlemma sep_rule_example: \"(ptr \\f obj \\* A \\* B \\* ptr \\S obj ) s \\ (ptr \\o obj \\* A \\* B) s\"\n apply (sep_rule example_rule)\n apply (sep_solve)\ndone\n\n\n\n(* the state of proving before new stuff *)\n\nlemma swap_cap_wp_old:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp add: swap_cap_def)\n apply (wp swap_parents_wp set_cap_wp)\n apply (rule hoare_chain)\n apply (wp set_cap_wp)\n apply (sep_solve)+\ndone\n\n\nlemma move_cap_wp_old:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n including no_pre\n apply (simp add: move_cap_def)\n apply (wp swap_parents_wp)\n apply (rule hoare_strengthen_post)\n apply (wp set_cap_wp)\n apply (sep_select 2)\n apply (sep_solve)\n apply (rule hoare_chain)\n apply (wp insert_cap_orphan_wp)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\nlemma invoke_cnode_rotate2_wp_old:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n including no_pre\n apply (clarsimp simp: invoke_cnode_def)\n apply (wp)\n apply (rule hoare_strengthen_post)\n apply (rule move_cap_wp)\n apply (sep_solve )\n apply (rule hoare_chain)\n apply (rule move_cap_wp)\n apply (sep_select_asm 2, sep_select_asm 3)\n apply (sep_solve)\n apply (sep_solve)\ndone\n\n(* new sep_select/asm *)\n\nlemma \"(A \\* B \\* C \\* D) s \\ (A \\* B \\* C \\* D) s\"\n apply (sep_select 4 3 2 1)\n apply (sep_select_asm 4 3 2 1)\n apply (sep_select_asm 2 4)\noops\n\n\n(* sep_select_pre/post *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\n(* can be made to work for arbitrary monads *)\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, \\E\\\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"\\A \\* B \\* C \\* D\\ f \\\\_. A \\* B \\* C \\* D\\, -\"\n apply (sep_select_pre 4 1 2 3)\n apply (sep_select_post 3 4 2 1)\n apply (sep_select_post 3 4)\noops\n\nlemma \"(P \\* (P \\* Q)) s \\ Q s\"\n apply (sep_mp, assumption )\n done\n\nlemma \"P s \\ (Q \\* (P \\* Q)) s\"\n apply (erule sep_curry[rotated])\n apply (assumption)\n done\n\nthm sep_mp[no_vars] sep_curry[rotated, no_vars]\n\n\n(* wp tactic testing *)\n\n\n(* sep_wand approach *)\n\n\nlemma move_cap_wp2:\n \"\\c - \\* src \\c cap \\* R>\\\n move_cap cap' src dest\n \\\\_. c cap' \\* src \\c NullCap \\* R>\\\"\n apply (simp add: move_cap_def)\n apply (sep_wp set_cap_wp swap_parents_wp insert_cap_orphan_wp)+\n apply (sep_solve)\n done\n\nlemma swap_cap_wp2:\n \"\\c cap \\* src \\c cap' \\* R>\\\n swap_cap cap' src cap dest\n \\\\_.c cap' \\* src \\c cap \\* R>\\\"\n apply (clarsimp simp: swap_cap_def)\n apply (sep_wp swap_parents_wp set_cap_wp)+\n apply (sep_solve)\n done\n\nlemma invoke_cnode_rotate2_wp:\n \"(dest) \\ (rnd) \\\n \\c cap1 \\* src \\c cap2 \\*\n rnd \\c - \\* R>\\\n invoke_cnode (RotateCall cap1 cap2 dest src rnd)\n \\\\_. c NullCap \\* src \\c cap1 \\*\n rnd \\c cap2 \\* R>\\\"\n apply (clarsimp simp: invoke_cnode_def)\n apply (sep_wp move_cap_wp)+\n apply (sep_solve)\n done\n\n\n(* sep_drule/rule *)\n\nlemma sep_rule_example2:\n \"\\(ptr \\o obj) s; finite (dom (object_slots obj))\\ \\\n (ptr \\E obj \\* ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (subst (asm) sep_map_o_decomp)\n apply (subst (asm) sep_map_S_decomp, simp+)\n apply sep_solve\n done\n\nlemma sep_drule_example2:\n \"\\(ptr \\f obj \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* ptr \\E obj) s;\n finite (dom (object_slots obj))\\\n \\\n (ptr \\o obj) s\"\n by (metis sep_map_S_decomp sep_map_o_decomp)\n\n(* sep_curry *)\n\nlemma sep_drule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\f obj \\* A \\* B \\*\n (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj) \\* D \\* G \\* E \\* F \\* ptr \\E obj ) s;\n finite (dom (object_slots obj))\\\n \\\n (D \\* G \\* E \\* F \\* ptr \\o obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B) s\"\n apply (sep_drule sep_drule_example2)\n apply assumption\n apply sep_solve\n done\n\n\n(* sep_back *)\n\n\nlemma sep_rule_example_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* ptr \\o obj \\* A \\* B \\* D \\* G \\* E \\* F ) s;\n finite (dom (object_slots obj))\\ \\\n (D \\* G \\* E \\* F \\* ptr \\f obj \\* H \\* Z \\* J \\* L \\* Y \\* ptr \\E obj \\*\n A \\* B \\* (\\* slot\\dom (object_slots obj). (ptr, slot) \\s obj)) s\"\n apply (sep_rule sep_rule_example2)\n apply sep_solve\n apply assumption\n done\n\n\n(* works even with multiple conjuncts in assumptions and conclusions *)\nlemma sep_rule_double_conjunct_example:\n \"\\((obj_id, slot) \\c cap \\* obj_id \\f obj) s;\n object_slots obj slot = Some cap\\\n \\ ((obj_id, slot) \\s obj \\* obj_id \\f obj) s\"\n apply (sep_drule sep_map_s_sep_map_c)\n apply assumption\n apply (sep_cancel)+\n done\n\nlemma sep_rule_double_conjunct_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_rule sep_rule_double_conjunct_example)\n apply sep_solve\n apply assumption\n done\n\n(* side-conditions*)\n\n\nlemma sep_drule_side_condition_lemma:\n \"\\(H \\* Z \\* J \\* L \\* Y \\* obj_id \\f obj \\* A \\* B \\* D \\* G \\* E \\* F \\* (obj_id, slot) \\c cap ) s;\n object_slots obj slot = Some cap\\ \\\n (D \\* G \\* E \\* F \\*(obj_id, slot) \\s obj \\* H \\* Z \\* J \\* L \\* Y \\* A \\* B \\* obj_id \\f obj) s\"\n apply (sep_drule sep_rule_double_conjunct_example, assumption)\n apply (sep_solve)\n done\n\nschematic_goal \"(P \\* ?A) s \\ (A \\* B \\* P) s\"\n apply (sep_solve)\n done\n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/capDL-api/Sep_Tactic_Examples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.2617899998530847}} {"text": "(* Title: SSA_CFG_code.thy\n Author: Denis Lohner, Sebastian Ullrich\n*)\n\ntheory SSA_CFG_code imports\n SSA_CFG\n Mapping_Exts\n \"~~/src/HOL/Library/Product_Lexorder\"\nbegin\n\ndefinition Union_of :: \"('a \\ 'b set) \\ 'a set \\ 'b set\"\n where \"Union_of f A \\ \\(f ` A)\"\n\nlemma Union_of_alt_def: \"Union_of f A = (\\x \\ A. f x)\"\n unfolding Union_of_def by simp\n\ntype_synonym ('node, 'val) phis_code = \"('node \\ 'val, 'val list) mapping\"\n\ncontext CFG_base begin\n definition addN :: \"'node \\ ('var, 'node set) mapping \\ ('var, 'node set) mapping\"\n where \"addN n \\ fold (\\v. Mapping.map_default v {} (insert n)) (sorted_list_of_set (uses n))\"\n definition \"addN' n = fold (\\v m. m(v \\ case_option {n} (insert n) (m v))) (sorted_list_of_set (uses n))\"\n\n lemma addN_transfer [transfer_rule]:\n \"rel_fun op = (rel_fun (pcr_mapping op = op =) (pcr_mapping op = op =)) addN' addN\"\n unfolding addN_def [abs_def] addN'_def [abs_def]\n Mapping.map_default_def [abs_def] Mapping.default_def\n apply (auto simp: mapping.pcr_cr_eq rel_fun_def cr_mapping_def)\n apply transfer\n apply (rule fold_cong)\n apply simp\n apply simp\n apply (intro ext)\n by auto\n\n definition \"useNodes_of = fold (addN) \\n Mapping.empty\"\n lemmas useNodes_of_code = useNodes_of_def [unfolded addN_def [abs_def]]\n declare useNodes_of_code [code]\n\n lemma lookup_useNodes_of':\n assumes [simp]: \"\\n. finite (uses n)\"\n shows \"Mapping.lookup (useNodes_of) v =\n (if (\\n \\ set \\n. v \\ uses n) then Some {n \\ set \\n. v \\ uses n} else None)\"\n proof -\n { fix m n xs v\n have \"Mapping.lookup (fold (\\v. Mapping.map_default (v::'var) {} (insert (n::'node))) xs m) v=\n (case Mapping.lookup m v of None \\ (if v \\ set xs then Some {n} else None)\n | Some N \\ (if v \\ set xs then Some (insert n N) else Some N))\"\n by (induction xs arbitrary: m) (auto simp: Mapping_lookup_map_default split: option.splits)\n }\n note addN_conv = this [of n \"sorted_list_of_set (uses n)\" for n, folded addN_def, simplified]\n { fix xs m v\n have \"Mapping.lookup (fold (addN) xs m) v = (case Mapping.lookup m v of None \\ if (\\n\\set xs. v \\ uses n) then Some {n\\set xs. v \\ uses n} else None\n | Some N \\ Some ({n\\set xs. v \\ uses n} \\ N))\"\n by (induction xs arbitrary: m) (auto split: option.splits simp: addN_conv)\n }\n note this [of \"\\n\" Mapping.empty, simp]\n show ?thesis unfolding useNodes_of_def\n by (auto split: option.splits simp: lookup_empty)\n qed\nend\n\ncontext CFG begin\n lift_definition useNodes_of' :: \" ('var, 'node set) mapping\"\n is \"\\v. if (\\n \\ set \\n. v \\ uses n) then Some {n \\ set \\n. v \\ uses n} else None\" .\n\n lemma useNodes_of': \"useNodes_of' = useNodes_of\"\n proof-\n { fix m n xs\n have \"fold (\\v m. m(v::'var \\ case m v of None \\ {n::'node} | Some x \\ insert n x)) xs m =\n (\\v. case m v of None \\ (if v \\ set xs then Some {n} else None)\n | Some N \\ (if v \\ set xs then Some (insert n N) else Some N))\"\n by (induction xs arbitrary: m)(auto split: option.splits)\n }\n note addN'_conv = this [of n \"sorted_list_of_set (uses n)\" for n, folded addN'_def, simplified]\n { fix xs m\n have \"fold (addN') xs m = (\\v. case m v of None \\ if (\\n\\set xs. v \\ uses n) then Some {n\\set xs. v \\ uses n} else None\n | Some N \\ Some ({n\\set xs. v \\ uses n} \\ N))\"\n by (induction xs arbitrary: m) (auto 4 4 split: option.splits if_splits simp: addN'_conv intro!: ext)\n }\n note this [of \"\\n\" Map.empty, simp]\n show \"useNodes_of' = useNodes_of\"\n unfolding mmap_def useNodes_of_def\n by (transfer fixing:) auto\n qed\n\n declare useNodes_of'.transfer [unfolded useNodes_of', transfer_rule]\n\n \n\nend\n\ncontext CFG_SSA_base begin\n definition phis_addN\n where \"phis_addN n = fold (\\v. Mapping.map_default v {} (insert n)) (case_option [] id (phis n))\"\n\n definition phidefNodes where [code]:\n \"phidefNodes = fold (\\(n,v). Mapping.update v n) (sorted_list_of_set (dom phis)) Mapping.empty\"\n\n lemma keys_phidefNodes:\n assumes \"finite (dom phis)\"\n shows \"Mapping.keys (phidefNodes) = snd ` dom phis\"\n proof -\n { fix xs m x\n have \"fold (\\(a,b) m. m(b \\ a)) (xs::('node \\ 'val) list) m x = (if x \\ snd ` set xs then (Some \\ fst) (last [(b,a)\\xs. a = x]) else m x)\"\n by (induction xs arbitrary: m) (auto split: if_splits simp: filter_empty_conv intro: rev_image_eqI)\n }\n from this [of \"sorted_list_of_set (dom phis)\" Map.empty] assms\n show ?thesis\n unfolding phidefNodes_def keys_dom_lookup\n by (transfer fixing: phis) (auto simp: dom_def intro: rev_image_eqI)\n qed\n\n definition phiNodes_of :: \" ('val, ('node \\ 'val) set) mapping\"\n where \"phiNodes_of = fold (phis_addN) (sorted_list_of_set (dom phis)) Mapping.empty\"\n\n lemma lookup_phiNodes_of:\n assumes [simp]: \"finite (dom phis)\"\n shows \"Mapping.lookup (phiNodes_of) v =\n (if (\\n \\ dom phis. v \\ set (the (phis n))) then Some {n \\ dom phis. v \\ set (the (phis n))} else None)\"\n proof -\n {\n fix m n xs v\n have \"Mapping.lookup (fold (\\v. Mapping.map_default v {} (insert (n::'node \\ 'val))) xs (m::('val, ('node \\ 'val) set) mapping)) v =\n (case Mapping.lookup m v of None \\ (if v \\ set xs then Some {n} else None)\n | Some N \\ (if v \\ set xs then Some (insert n N) else Some N))\"\n by (induction xs arbitrary: m) (auto simp: Mapping_lookup_map_default split: option.splits)\n }\n note phis_addN_conv = this [of n \"case_option [] id (phis n)\" for n, folded phis_addN_def]\n {\n fix xs m v\n have \"Mapping.lookup (fold (phis_addN) xs m) v =\n (case Mapping.lookup m v of None \\ if (\\n \\ set xs. v \\ set (case_option [] id (phis n))) then Some {n \\ set xs. v \\ set (case_option [] id (phis n))} else None\n | Some N \\ Some ({n \\ set xs. v \\ set (case_option [] id (phis n))} \\ N))\"\n by (induction xs arbitrary: m) (auto simp: phis_addN_conv split: option.splits if_splits)+\n }\n note this [of \"sorted_list_of_set (dom phis)\", simp]\n show ?thesis\n unfolding phiNodes_of_def\n by (force split: option.splits simp: lookup_empty)\n qed\n\n lemmas phiNodes_of_code = phiNodes_of_def [unfolded phis_addN_def [abs_def]]\n declare phiNodes_of_code [code]\n\ninterpretation lifting_syntax .\nlemma phis_transfer [transfer_rule]: \"pcr_mapping op = op = phis (Mapping.Mapping phis)\"\n by (auto simp: mapping.pcr_cr_eq rel_fun_def cr_mapping_def Mapping.Mapping_inverse)\n\nend\n\ncontext CFG_SSA begin\n declare lookup_phiNodes_of [OF phis_finite, simp]\n declare keys_phidefNodes [OF phis_finite, simp]\nend\n\nlocale CFG_SSA_ext_base = CFG_SSA_base \\n predecessors Entry \"defs\" \"uses\" phis\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \"'node \\ 'val set\"\n and phis :: \" ('node, 'val) phis\"\nbegin\n abbreviation \"cache f \\ Mapping.tabulate \\n f\"\n\n lemma lookup_cache[simp]: \"n \\ set \\n \\ Mapping.lookup (cache f) n = Some (f n)\"\n by transfer (auto simp: Map.map_of_map_restrict)\n\n lemma lookup_cacheD [dest]: \"Mapping.lookup (cache f) x = Some y \\ y = f x\"\n by transfer (auto simp: Map.map_of_map_restrict restrict_map_def split: if_splits)\n\n lemma lookup_cache_usesD: \"Mapping.lookup (cache uses) n = Some vs \\ vs = uses n\"\n by blast\nend\n\ndefinition[simp]: \"usesOf m n \\ case_option {} id (Mapping.lookup m n)\"\n\nlocale CFG_SSA_ext = CFG_SSA_ext_base \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA \\n predecessors Entry \"defs\" \"uses\" phis\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \"'node \\ 'val set\"\n and phis :: \" ('node, 'val) phis\"\nbegin\n lemma usesOf_cache[abs_def, simp]: \"usesOf (cache uses) n = uses n\"\n by (auto simp: uses_in_\\n dest: lookup_cache_usesD split: option.split)\nend\n\nlocale CFG_SSA_base_code = CFG_SSA_ext_base \\n predecessors Entry \"defs\" \"usesOf uses\" \"Mapping.lookup phis\"\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \" ('node, 'val set) mapping\"\n and phis :: \" ('node, 'val) phis_code\"\nbegin\n declare phis_transfer [simplified, transfer_rule]\n\n lemma phiDefs_code [code]:\n \"phiDefs n = snd ` Set.filter (\\(n',v). n' = n) (Mapping.keys phis)\"\n unfolding phiDefs_def\n by transfer (auto 4 3 intro: rev_image_eqI simp: Set.filter_def)\n\n lemmas phiUses_code [code] = phiUses_def [folded Union_of_alt_def]\n declare allUses_def [code]\n lemmas allVars_code [code] = allVars_def [folded Union_of_alt_def]\nend\n\nlocale CFG_SSA_code = CFG_SSA_base_code \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA_ext \\n predecessors Entry \"defs\" \"usesOf uses\" \"Mapping.lookup phis\"\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \" ('node, 'val set) mapping\"\n and phis :: \" ('node, 'val) phis_code\"\n\n\ndefinition \"the_trivial v vs = (case (foldl (\\(good,v') w. if w = v then (good,v')\n else case v' of Some v' \\ (good \\ w = v', Some v')\n | None \\ (good, Some w))\n (True, None) vs)\n of (False, _) \\ None | (True,v) \\ v)\"\n\nlemma the_trivial_Nil [simp]: \"the_trivial x [] = None\"\n unfolding the_trivial_def by simp\n\nlemma the_trivialI:\n assumes \"set vs \\ {v, v'}\"\n and \"v' \\ v\"\n shows \"the_trivial v vs = (if set vs \\ {v} then None else Some v')\"\nproof -\n { fix vx\n have \"\\ set vs \\ {v, v'}; v' \\ v; vx \\ {None, Some v'} \\\n \\ (case foldl (\\(good, v') w.\n if w = v then (good, v')\n else case v' of None \\ (good, Some w) | Some v' \\ (good \\ w = v', Some v'))\n (True, vx) vs of\n (True, x) \\ x | (False, x) \\ None) = (if set vs \\ {v} then vx else Some v')\"\n by (induction vs arbitrary: vx; case_tac vx; auto)\n }\n with assms show ?thesis unfolding the_trivial_def by simp\nqed\n\nlemma the_trivial_conv:\n shows \"the_trivial v vs = (if \\v' \\ set vs. v' \\ v \\ set vs - {v'} \\ {v} then Some (THE v'. v' \\ set vs \\ v' \\ v \\ set vs - {v'} \\ {v}) else None)\"\nproof -\n { fix b a vs\n have \"a \\ v\n \\ foldl (\\(good, v') w.\n if w = v then (good, v')\n else case v' of None \\ (good, Some w) | Some v' \\ (good \\ w = v', Some v'))\n (b, Some a) vs =\n (b \\ set vs \\ {v, a}, Some a)\"\n by (induction vs arbitrary: b; clarsimp)\n }\n note this[simp]\n { fix b vx\n have \"\\ vx \\ insert None (Some ` set vs); case_option True (\\vx. vx \\ v) vx \\\n \\ foldl (\\(good, v') w.\n if w = v then (good, v')\n else case v' of None \\ (good, Some w) | Some v' \\ (good \\ w = v', Some v'))\n (b, vx) vs = (b \\ (case vx of Some w \\ set vs \\ {v, w} | None \\ \\w. set vs \\ {v, w}),\n (case vx of Some w \\ Some w | None \\ if (\\v'\\set vs. v' \\ v) then Some (hd (filter (\\v'. v' \\ v) vs)) else None))\"\n by (induction vs arbitrary: b vx; auto)\n }\n hence \"the_trivial v vs = (if \\v' \\ set vs. v' \\ v \\ set vs - {v'} \\ {v} then Some (hd (filter (\\v'. v' \\ v) vs)) else None)\"\n unfolding the_trivial_def by (auto split: bool.splits)\n thus ?thesis\n apply (auto split: if_splits)\n apply (rule the_equality [THEN sym])\n by (thin_tac \"P\" for P, (induction vs; auto))+\nqed\n\nlemma the_trivial_SomeE:\n assumes \"the_trivial v vs = Some v'\"\n obtains \"v \\ v'\" and \"set vs = {v'}\" | \"v \\ v'\" and \"set vs = {v,v'}\"\nusing assms\napply atomize_elim\napply (subst(asm) the_trivial_conv)\napply (split if_splits; simp)\nby (subgoal_tac \"(THE v'. v' \\ set vs \\ v' \\ v \\ set vs - {v'} \\ {v}) = hd (filter (\\v'. v' \\ v) vs)\")\n (fastforce simp: set_double_filter_hd set_single_hd set_minus_one)+\n\nlocale CFG_SSA_wf_base_code = CFG_SSA_base_code \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA_wf_base \\n predecessors Entry \"defs\" \"usesOf uses\" \"Mapping.lookup phis\"\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \" ('node, 'val set) mapping\"\n and phis :: \" ('node, 'val) phis_code\"\nbegin\n definition [code]:\n \"trivial_code (v::'val) vs = (the_trivial v vs \\ None)\"\n definition[code]: \"trivial_phis = Set.filter (\\(n,v). trivial_code v (the (Mapping.lookup phis (n,v)))) (Mapping.keys phis)\"\n definition [code]: \"redundant_code = (trivial_phis \\ {})\"\nend\n\nlocale CFG_SSA_wf_code = CFG_SSA_code \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA_wf_base_code \\n predecessors Entry \"defs\" \"uses\" phis\n + CFG_SSA_wf \\n predecessors Entry \"defs\" \"usesOf uses\" \"Mapping.lookup phis\"\n for \\n :: \"'node::linorder list\"\n and predecessors :: \"'node \\ 'node list\"\n and Entry :: \"'node\"\n and \"defs\" :: \"'node \\ 'val::linorder set\"\n and \"uses\" :: \" ('node, 'val set) mapping\"\n and phis :: \" ('node, 'val) phis_code\"\nbegin\n lemma trivial_code:\n \"phi v = Some vs \\ trivial v = trivial_code v vs\"\n unfolding trivial_def trivial_code_def\n apply (auto split: option.splits simp: isTrivialPhi_def)\n apply (clarsimp simp: the_trivial_conv split: if_splits)\n apply (clarsimp simp: the_trivial_conv split: if_splits)\n apply (erule the_trivial_SomeE)\n apply simp\n apply (rule phiArg_in_allVars; auto simp: phiArg_def)\n apply (rename_tac v')\n apply (rule_tac x=v' in bexI)\n apply simp\n apply (rule phiArg_in_allVars; auto simp: phiArg_def)\n done\n\n lemma trivial_phis:\n \"trivial_phis = {(n,v). Mapping.lookup phis (n,v) \\ None \\ trivial v}\"\n unfolding trivial_phis_def Set.filter_def\n apply (auto simp add: phi_def keys_dom_lookup)\n apply (subst trivial_code)\n apply (auto simp: image_def trivial_in_allVars phis_phi)\n apply (frule trivial_phi)\n apply (auto simp add: trivial_code phi_def[symmetric] phis_phi)\n done\n\n lemma redundant_code:\n \"redundant = redundant_code\"\n unfolding redundant_def redundant_code_def trivial_phis[of]\n apply (auto simp: image_def trivial_in_allVars)\n apply (frule trivial_phi)\n apply (auto simp: phi_def)\n done\n\n lemma trivial_code_mapI:\n \"\\ trivial_code v vs; f ` (set vs - {v}) \\ {v} ; f v = v \\ \\ trivial_code v (map f vs)\"\n unfolding trivial_code_def the_trivial_conv\n by (auto split: if_splits)\n\n lemma trivial_code_map_conv:\n \"f v = v \\ trivial_code v (map f vs) \\ (\\v'\\set vs. f v' \\ v \\ (f ` set vs) - {f v'} \\ {v})\"\n unfolding trivial_code_def the_trivial_conv\n by auto\n\nend\n\nlocale CFG_SSA_Transformed_code = ssa: CFG_SSA_wf_code \\n predecessors Entry \"defs\" \"uses\" phis\n +\n CFG_SSA_Transformed \\n predecessors Entry oldDefs oldUses \"defs\" \"usesOf uses\" \"Mapping.lookup phis\" var\nfor\n \\n :: \"'node::linorder list\" and\n predecessors :: \"'node \\ 'node list\" and\n Entry::\"'node\" and\n oldDefs :: \"'node \\ 'var::linorder set\" and\n oldUses :: \"'node \\ 'var set\" and\n \"defs\" :: \"'node \\ 'val::linorder set\" and\n \"uses\" :: \" ('node, 'val set) mapping\" and\n phis :: \" ('node, 'val) phis_code\" and\n var :: \"'val \\ 'var\"\n+\nassumes dom_uses_in_graph: \"Mapping.keys uses \\ set \\n\"\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/SSA_CFG_code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.26176483855874816}} {"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: XVcgEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Parallel Assignments\"\n\ntheory XVcgEx \nimports \"../XVcg\"\n\nbegin\n\nrecord \"globals\" =\n \"G_'\"::\"nat\"\n \"H_'\"::\"nat\"\n\nrecord 'g vars = \"'g state\" +\n A_' :: nat\n B_' :: nat\n C_' :: nat\n I_' :: nat\n M_' :: nat\n N_' :: nat\n R_' :: nat\n S_' :: nat\n Arr_' :: \"nat list\"\n Abr_':: string\n\nterm \"BASIC\n \\A :== x,\n \\B :== y \n END\"\n\nterm \"BASIC\n \\G :== \\H,\n \\H :== \\G \n END\"\n\nterm \"BASIC\n LET (x,y) = (\\A,b);\n z = \\B\n IN \\A :== x,\n \\G :== \\A + y + z\n END\"\n\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\B :== b,\n \\C :== c\n END\n \\\\A = x \\ \\B = y \\ \\C = c\\\"\napply vcg\noops\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply vcg\noops\n\ndefinition foo:: \"nat \\ (nat \\ nat \\ nat)\"\n where \"foo n = (n,n+1,n+2)\"\n\nlemma \"\\\\ \\\\A = 0\\ \n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN \n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply (vcg add: foo_def snd_conv fst_conv)\noops\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/XVcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2617648322033695}} {"text": "(* Title: Monad_Normalisation_Test.thy\n Author: Manuel Eberl, TU München\n Author: Andreas Lochbihler, ETH Zurich\n Author: Joshua Schneider, ETH Zurich\n*)\n\ntheory Monad_Normalisation_Test\nimports Monad_Normalisation\nbegin\n\nsection \\Tests and examples\\\n\ncontext includes monad_normalisation\nbegin\n\nlemma\n assumes \"f = id\"\n shows\n \"do {x \\ B; z \\ C x; d \\ E z x; a \\ D z x; y \\ A; return_pmf (x,y)} =\n do {y \\ A; x \\ B; z \\ C x; a \\ D z x; d \\ E z x; return_pmf (f (x,y))}\"\napply (simp)\napply (simp add: assms)\ndone\n\nlemma \"(do {a \\ E; b \\ E; w \\ B b a; z \\ B a b; return_pmf (w,z)}) =\n (do {a \\ E; b \\ E; z \\ B a b; w \\ B b a; return_pmf (w,z)})\"\nby (simp)\n\nlemma \"(do {a \\ E; b \\ E; w \\ B b a; z \\ B a b; return_pmf (w,z)}) =\n (do {a \\ E; b \\ E; z \\ B a b; w \\ B b a; return_pmf (w,z)})\"\nby (simp)\n\nlemma \"do {y \\ A; x \\ A; z \\ B x y y; w \\ B x x y; Some (x,y)} =\n do {x \\ A; y \\ A; z \\ B x x y; w \\ B x y y; Some (x,y)}\"\nby (simp)\n\nlemma \"do {y \\ A; x \\ A; z \\ B x y y; w \\ B x x y; {x,y}} =\n do {x \\ A; y \\ A; z \\ B x x y; w \\ B x y y; {x,y}}\"\nby (simp)\n\nlemma \"do {y \\ A; x \\ A; z \\ B x y y; w \\ B x x y; return_pmf (x,y)} =\n do {x \\ A; y \\ A; z \\ B x x y; w \\ B x y y; return_pmf (x,y)}\"\nby (simp)\n\nlemma \"do {x \\ A 0; y \\ A x; w \\ B y y; z \\ B x y; a \\ C; Predicate.single (a,a)} =\n do {x \\ A 0; y \\ A x; z \\ B x y; w \\ B y y; a \\ C; Predicate.single (a,a)}\"\nby (simp)\n\nlemma \"do {x \\ A 0; y \\ A x; z \\ B x y; w \\ B y y; a \\ C; return_pmf (a,a)} =\n do {x \\ A 0; y \\ A x; z \\ B y y; w \\ B x y; a \\ C; return_pmf (a,a)}\"\nby (simp)\n\nlemma \"do {x \\ B; z \\ C x; d \\ E z x; a \\ D z x; y \\ A; return_pmf (x,y)} =\n do {y \\ A; x \\ B; z \\ C x; a \\ D z x; d \\ E z x; return_pmf (x,y)}\"\nby (simp)\n\n\nno_adhoc_overloading Monad_Syntax.bind bind_pmf\n\ncontext\n fixes \\1 :: \"'a \\ (('a \\ 'a) \\ 'b) spmf\"\n and \\2 :: \"'a \\ 'a \\ 'b \\ bool spmf\"\n and sample_uniform :: \"nat \\ nat spmf\"\n and order :: \"'a \\ nat\"\nbegin\n\nlemma \n \"do {\n x \\ sample_uniform (order \\);\n y \\ sample_uniform (order \\);\n z \\ sample_uniform (order \\);\n b \\ coin_spmf;\n ((msg1, msg2), \\) \\ \\1 (f x);\n _ :: unit \\ assert_spmf (valid_plain msg1 \\ valid_plain msg2);\n guess \\ \\2 (f y, xor (f z) (if b then msg1 else msg2)) \\;\n return_spmf (guess \\ b)\n } = do {\n x \\ sample_uniform (order \\);\n y \\ sample_uniform (order \\);\n ((msg1, msg2), \\) \\ \\1 (f x);\n _ :: unit \\ assert_spmf (valid_plain msg1 \\ valid_plain msg2);\n b \\ coin_spmf;\n x \\ sample_uniform (order \\);\n guess \\ \\2 (f y, xor (f x) (if b then msg1 else msg2)) \\;\n return_spmf (guess \\ b)\n }\"\nby (simp add: split_def)\n\nlemma\n \"do {\n x \\ sample_uniform (order \\);\n xa \\ sample_uniform (order \\);\n x \\ \\1 (f x);\n case x of\n (x, xb) \\\n (case x of\n (msg1, msg2) \\\n \\\\. do {\n a \\ assert_spmf (valid_plain msg1 \\ valid_plain msg2);\n x \\ coin_spmf;\n xaa \\ map_spmf f (sample_uniform (order \\));\n guess \\ \\2 (f xa, xaa) \\;\n return_spmf (guess \\ x)\n })\n xb\n } = do {\n x \\ sample_uniform (order \\);\n xa \\ sample_uniform (order \\);\n x \\ \\1 (f x);\n case x of\n (x, xb) \\\n (case x of\n (msg1, msg2) \\\n \\\\. do {\n a \\ assert_spmf (valid_plain msg1 \\ valid_plain msg2);\n z \\ map_spmf f (sample_uniform (order \\));\n guess \\ \\2 (f xa, z) \\;\n map_spmf ((\\) guess) coin_spmf\n })\n xb\n }\"\nby (simp add: map_spmf_conv_bind_spmf)\n\nlemma elgamal_step3:\n \"do {\n x \\ sample_uniform (order \\);\n y \\ sample_uniform (order \\);\n b \\ coin_spmf;\n p \\ \\1 (f x);\n _ \\ assert_spmf (valid_plain (fst (fst p)) \\ valid_plain (snd (fst p)));\n guess \\\n \\2 (f y, xor (f (x * y)) (if b then fst (fst p) else snd (fst p)))\n (snd p);\n return_spmf (guess \\ b)\n } = do {\n y \\ sample_uniform (order \\);\n b \\ coin_spmf;\n p \\ \\1 (f y);\n _ \\ assert_spmf (valid_plain (fst (fst p)) \\ valid_plain (snd (fst p)));\n ya \\ sample_uniform (order \\);\n b' \\ \\2 (f ya,\n xor (f (y * ya)) (if b then fst (fst p) else snd (fst p)))\n (snd p);\n return_spmf (b' \\ b)\n }\"\nby (simp)\n\nend\n\ntext \\Distributivity\\\n\nlemma\n \"do {\n x \\ A :: nat spmf;\n a \\ B;\n b \\ B;\n if a = b then do {\n return_spmf x\n } else do {\n y \\ C;\n return_spmf (x + y)\n }\n } = do {\n a \\ B;\n b \\ B;\n if b = a then A else do {\n y \\ C;\n x \\ A;\n return_spmf (y + x)\n }\n }\"\nby (simp add: add.commute cong: if_cong)\n\nlemma\n \"do {\n x \\ A :: nat spmf;\n p \\ do {\n a \\ B;\n b \\ B;\n return_spmf (a, b)\n };\n q \\ coin_spmf;\n if q then do {\n return_spmf (x + fst p)\n } else do {\n y \\ C;\n return_spmf (y + snd p)\n }\n } = do {\n q \\ coin_spmf;\n if q then do {\n x \\ A;\n a \\ B;\n _ \\ B;\n return_spmf (x + a)\n } else do {\n y \\ C;\n a \\ B;\n _ \\ B;\n _ \\ A;\n return_spmf (y + a)\n }\n }\"\nby (simp cong: if_cong)\n\nlemma\n fixes f :: \"nat \\ nat \\ nat + nat\"\n shows\n \"do {\n x \\ (A::nat set);\n a \\ B;\n b \\ B;\n case f a b of\n Inl c \\ {x}\n | Inr c \\ do {\n y \\ C x;\n {(x + y + c)}\n }\n } = do {\n a \\ B;\n b \\ B;\n case f b a of\n Inl c \\ A\n | Inr c \\ do {\n x \\ A;\n y \\ C x;\n {(y + c + x)}\n }\n }\"\nby (simp add: add.commute add.left_commute cong: sum.case_cong)\n\n\nsection \\Limits\\\n\ntext \\\n The following example shows that the combination of monad normalisation and regular ordered\n rewriting is not necessarily confluent.\n\\\n\nlemma \"do {a \\ A; b \\ A; Some (a \\ b, b)} =\n do {a \\ A; b \\ A; Some (a \\ b, a)}\"\napply (simp add: conj_comms)? \\ \\no progress made\\\napply (rewrite option_bind_commute) \\ \\force a particular binder order\\\napply (simp only: conj_comms)\ndone\n\ntext \\\n The next example shows that even monad normalisation alone is not confluent because \n the term ordering prevents the reordering of \\f A\\ with \\f B\\.\n But if we change \\A\\ to \\E\\, then the reordering works as expected.\n\\\n\nlemma\n \"do {a \\ f A; b \\ f B; c \\ D b; d \\ f C; F a c d} = \n do {b \\ f B; c \\ D b; a \\ f A; d \\ f C; F a c d}\"\n for f :: \"'b \\ 'a option\" and D :: \"'a \\ 'a option\"\n apply(simp)? \\ \\no progress made\\\n apply(subst option_bind_commute, subst (2) option_bind_commute, rule refl)\n done\n\nlemma\n \"do {a \\ f E; b \\ f B; c \\ D b; d \\ f C; F a c d} = \n do {b \\ f B; c \\ D b; a \\ f E; d \\ f C; F a c d}\"\n for f :: \"'b \\ 'a option\" and D :: \"'a \\ 'a option\"\n by simp\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Normalisation/Monad_Normalisation_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.26175662303632063}} {"text": "section {*FUNCTION\\_\\_LR\\_PARSER\\_\\_part4*}\ntheory\n FUNCTION__LR_PARSER__part4\n\nimports\n FUNCTION__LR_PARSER__part3\n\nbegin\n\nlemma no_shift_shift_conflicts1: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ y \\ cfgSTD_first G' (k - Suc 0) (\\ @ liftB z)\n \\ ya \\ cfgSTD_first G' (k - Suc 0) (\\' @ liftB za)\n \\ \\prod_lhs = A, prod_rhs = \\ @ teB aa # \\\\ \\ cfg_productions G\n \\ \\prod_lhs = Aa, prod_rhs = \\' @ teB aa # \\'\\ \\ cfg_productions G\n \\ \\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB aa # \\, cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do # \\)\n \\ \\cfg_item_lhs = Aa, cfg_item_rhs1 = \\', cfg_item_rhs2 = teB aa # \\', cfg_item_look_ahead = za\\ \\ valid_item_set G' k (teB Do # \\')\n \\ last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))\n \\ (aa # y) \\ (aa # ya)\n \\ y = ya\"\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"valid_cfg G'\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule F_CFG_AUGMENT__makes_CFG)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"valid_dfa M\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in Theorem6__27_a)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_Connected)\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac c)(*strict*)\n apply(blast)+\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"valid_parser P\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in AF_LR_PARSER_valid_parser)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"set (teB Do # \\') \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"set (teB Do # \\) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"\\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB aa # \\, cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do # \\')\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(subgoal_tac \"valid_item_set G' k (teB Do # \\') = (if (teB Do # \\')=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')))\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(rename_tac c)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # \\) = (if (teB Do # \\)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)))\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(rename_tac c)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(thin_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))\")\n apply(rename_tac c)(*strict*)\n apply(thin_tac \"\\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB aa # \\, cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do # \\)\")\n apply(rename_tac c)(*strict*)\n apply(thin_tac \"set (teB Do # \\) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(subgoal_tac \"length y \\ (k-Suc 0)\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule cfgSTD_firstk_shorter_than_k)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"length (y@c) \\ (k-Suc 0)\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule cfgSTD_firstk_shorter_than_k)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(case_tac \"length y < k - Suc 0\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"suffix y z\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(rule cfgSTD_first_suffix_is_shorter)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(force)\n apply(rename_tac c)(*strict*)\n apply(subgoal_tac \"length z < k - Suc 0\")\n apply(rename_tac c)(*strict*)\n prefer 2\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: valid_item_set_def valid_item_set_n_def)\n apply(clarsimp)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\) \\cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\)\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n prefer 2\n apply(rule F_CFG_AUGMENT__FirstStep)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply (metis cfgRM_derivations_are_cfg_derivations)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(subgoal_tac \"da (Suc 0)= Some (pair (Some \\prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\) \\cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\)\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n prefer 2\n apply(rule F_CFG_AUGMENT__FirstStep)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply (metis cfgRM_derivations_are_cfg_derivations)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(subgoal_tac \"aa \\ Do\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n prefer 2\n apply(subgoal_tac \"aa \\ cfg_events G\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(erule conjE)+\n apply(erule_tac\n x=\"\\prod_lhs = A, prod_rhs = \\ @ teB aa # \\\\\"\n and A=\"cfg_productions G\"\n in ballE)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply (metis elemInsetB set_mp_prime)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(case_tac n)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\ zb \\'a e1a e2a zaa)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c na d da \\ zb \\'a e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\'a e1a e2a zaa)(*strict*)\n apply(case_tac \"\\'a\")\n apply(rename_tac c na d da \\'a e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\'a e1a e2a zaa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c na d da e1a e2a zaa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac c na d da e1a e2a zaa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c na d da e1a e2a zaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da e1a e2a zaa lista a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\ zb \\'a e1a e2a zaa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c n na d da \\ e1 e2 zb \\'a e1a e2a zaa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\ e1 e2 zb \\'a e1a e2a zaa nat)(*strict*)\n apply(case_tac na)\n apply(rename_tac c na d da \\ e1 e2 zb \\'a e1a e2a zaa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb \\'a zaa nat)(*strict*)\n apply(case_tac \"\\'a\")\n apply(rename_tac c d da \\ e1 e2 zb \\'a zaa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb nat)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c d da \\ e1 e2 zb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(case_tac list)\n apply(rename_tac c d da e1 e2 zb nat list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac c d da e1 e2 zb nat lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e1 e2 zb nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb nat lista a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb \\'a zaa nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c na d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf SSc=[teB Do]@w@[teB Do]\" for SSc)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and i=\"nat\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(force)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf SSc=[teB Do]@w@[teB Do]\" for SSc)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"nata\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(force)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata w wa)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 zb \\'a e1a e2a zaa nat nata w wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb \\' e1a e2a zaa nat nata w wa list)(*strict*)\n apply(rename_tac w1)\n apply(rename_tac c d da e1 e2 zb \\' e1a e2a zaa nat nata w wa w1)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e1 e2 zb \\' e1a e2a zaa nat nata w wa w1)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb \\' e1a e2a zaa nat nata w wa w1 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 list)(*strict*)\n apply(rename_tac w2)\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 w2)(*strict*)\n apply(case_tac zb)\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 w2 a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. zb = w' @ [x']\")\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 w2 a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 zb e1a e2a zaa nat nata w wa w1 w2 a list)(*strict*)\n apply(thin_tac \"zb=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w')(*strict*)\n apply(rename_tac w3)\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w3)(*strict*)\n apply(case_tac zaa)\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w3)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w3 a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. zaa = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w3 a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a zaa nat nata wa w1 w2 w3 a list)(*strict*)\n apply(thin_tac \"zaa=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w')(*strict*)\n apply(rename_tac w4)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca)(*strict*)\n apply(case_tac \"k - length w4\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca)(*strict*)\n apply(clarsimp)\n apply (metis Nat.add_0_right liftB_reflects_length add_Suc diff_is_0_eq' le_refl less_diff_conv add.commute not_less0 take_all_length)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\y. z = y@[Do]\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb)(*strict*)\n prefer 2\n apply(case_tac \"z\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. z = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb a list)(*strict*)\n apply(thin_tac \"z=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb w' x')(*strict*)\n apply(rule liftB_terminal_tail_equals)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb y)(*strict*)\n apply(subgoal_tac \"w4=liftB y\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb y)(*strict*)\n prefer 2\n apply(rule liftB_terminal_butlast_equals)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 w4 ca natb y)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y)(*strict*)\n apply(thin_tac \"liftB y @ [teB Do] = liftB (y @ [Do])\")\n apply(case_tac \"k - length w3\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y)(*strict*)\n prefer 2\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"ca @ y @ [Do] \\ cfgSTD_first G' (k - Suc 0) (\\ @ liftB (y @ [Do]))\")\n apply(simp add: cfgSTD_first_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(subgoal_tac \"suffix x za\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n prefer 2\n apply(rule liftB_creates_suffix)\n apply(subgoal_tac \"\\d' e. cfgRM.derivation G' d' \\ maximum_of_domain d' n \\ d' 0 = Some (pair None \\cfg_conf=\\' @ liftB za\\) \\ d' n = Some (pair e \\cfg_conf=liftB x\\)\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"db\"\n in cfg_derivation_can_be_translated_to_cfgRM_derivation)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(rule_tac\n d=\"d'\"\n and i=\"0\"\n and j=\"n\"\n in CFGRM_terminals_stay_at_end)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc x db e1b n)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(case_tac \"(k - Suc (length cb))\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule_tac\n A=\"set(take (k - Suc 0) cb)\"\n in set_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule List.set_take_subset)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule_tac\n t=\"take (k - Suc 0) cb\"\n and s=\"ca @ y @ Do # c\"\n in ssubst)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb v)(*strict*)\n apply(clarsimp)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"prefix (ca @ y @ [Do]) cb \\ prefix cb (ca @ y @ [Do])\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(erule disjE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd v)(*strict*)\n apply(clarsimp)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(case_tac cc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc v)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n natd v)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cc = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd cc a list)(*strict*)\n apply(thin_tac \"cc=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w')(*strict*)\n apply(subgoal_tac \"take (Suc natd) za = w'@Do#c\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w')(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule_tac\n w=\"cb\"\n in append_linj)\n apply(metis concat_asso)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w')(*strict*)\n apply(clarsimp)\n apply(case_tac za)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w')(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. za = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' a list)(*strict*)\n apply(thin_tac \"za=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' w'a x')(*strict*)\n apply(subgoal_tac \"w3=liftB w'a\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' w'a x')(*strict*)\n apply(subgoal_tac \"Do=x'\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' w'a x')(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. c = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a a list)(*strict*)\n apply(thin_tac \"c=a#list\")\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB w'a)\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB w'a)\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(thin_tac \"teB Do \\ set (liftB w'a)\")\n apply(rule_tac\n B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n in nset_mp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(simp add: two_elements_construct_domain_def AF_LR_PARSER_input_def)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(case_tac \"Suc natd - length w'a\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x')(*strict*)\n apply(clarsimp)\n apply (metis set_liftB_insert take_reflects_mem)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'a w'b x' nate)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 ca natb y natc db e1b n cb natd w' w'b nate)(*strict*)\n apply (metis head_in_set set_liftB_insert set_append_contra2)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' w'a x')(*strict*)\n apply(rule sym)\n apply(rule liftB_terminal_tail_equals)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y natc db e1b n cb natd w' w'a x')(*strict*)\n apply(rule liftB_terminal_butlast_equals)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"ca @ y @ [Do] \\ cfgSTD_first G' (k - Suc 0) (\\ @ liftB (y @ [Do]))\")\n apply(simp add: cfgSTD_first_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(subgoal_tac \"suffix x za\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n prefer 2\n apply(rule liftB_creates_suffix)\n apply(subgoal_tac \"\\d' e. cfgRM.derivation G' d' \\ maximum_of_domain d' n \\ d' 0 = Some (pair None \\cfg_conf=\\' @ liftB za\\) \\ d' n = Some (pair e \\cfg_conf=liftB x\\)\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"db\"\n in cfg_derivation_can_be_translated_to_cfgRM_derivation)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(rule_tac\n d=\"d'\"\n and i=\"0\"\n and j=\"n\"\n in CFGRM_terminals_stay_at_end)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n d' e)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y x db e1b n)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(case_tac \"(k - Suc (length cb))\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule_tac\n A=\"set(take (k - Suc 0) cb)\"\n in set_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule List.set_take_subset)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule_tac\n t=\"take (k - Suc 0) cb\"\n and s=\"ca @ y @ Do # c\"\n in ssubst)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb v)(*strict*)\n apply(clarsimp)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"prefix (ca @ y @ [Do]) cb \\ prefix cb (ca @ y @ [Do])\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n prefer 2\n apply(rule mutual_prefix_prefix)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(erule disjE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc v)(*strict*)\n apply(clarsimp)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(case_tac cc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(subgoal_tac \"set cb \\ cfg_events G\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(subgoal_tac \"Do \\ set cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule_tac\n B=\"cfg_events G\"\n in nset_mp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule liftB_in_two_elements_construct_domain_to_subset)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1b of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB za\\\" for SSc)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"db\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule_tac\n B=\"set (\\' @ teB aa # \\')\"\n in subset_trans)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule prod_rhs_in_cfg_events)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(rule prod_rhs_in_nonterms)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc p)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc)(*strict*)\n apply(erule exE)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc v)(*strict*)\n apply(erule conjE)+\n apply(subgoal_tac \"v=liftB cb\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc v)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc v)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n natc v)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. cc = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc cc a list)(*strict*)\n apply(thin_tac \"cc=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w')(*strict*)\n apply(subgoal_tac \"take (Suc natc) za = w'@Do#c\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w')(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule_tac\n w=\"cb\"\n in append_linj)\n apply(metis concat_asso)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w')(*strict*)\n apply(clarsimp)\n apply(case_tac za)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w')(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. za = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' a list)(*strict*)\n apply(thin_tac \"za=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x')(*strict*)\n apply(case_tac c)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x')(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. c = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' a list)(*strict*)\n apply(thin_tac \"c=a#list\")\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB w'a)\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB w'a)\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(thin_tac \"teB Do \\ set (liftB w'a)\")\n apply(rule_tac\n B=\"set(liftB (w'a @ [x']))\"\n in nset_mp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply (smt set_liftB_commute set_app_subset)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(rule_tac\n B=\"set(take k w3)\"\n in nset_mp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(rule_tac\n B=\"set w3\"\n in nset_mp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(rule List.set_take_subset)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(rule_tac\n B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n in nset_mp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(case_tac \"Suc natc - length w'a\")\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a)(*strict*)\n apply(clarsimp)\n apply (metis set_liftB_insert take_reflects_mem)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'a x' w'b x'a natd)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a nat nata w1 w2 w3 ca natb y db e1b n cb natc w' w'b x'a natd)(*strict*)\n apply (metis head_in_set set_liftB_insert set_append_contra2)\n done\n\ntheorem no_shift_shift_conflicts: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ (parser_marker P) r1 = Some None\n \\ (parser_marker P) r2 = Some None\n \\ r1 \\ parser_rules P\n \\ r2 \\ parser_rules P\n \\ rule_lpop r2 \\ rule_lpop r1 \\ rule_lpop r1 \\ rule_lpop r2\n \\ rule_rpop r1 \\ rule_rpop r2 \\ rule_rpop r2 \\ rule_rpop r1\n \\ r1 = r2\"\n apply(case_tac r1)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(subgoal_tac \" \\q\\ y \\ z A \\ a \\. y \\ (cfgSTD_first G' (k- 1) (\\@(liftB z))) \\ \\prod_lhs=A,prod_rhs=\\@(teB a)#\\\\ \\ cfg_productions G \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\)) \\ \\cfg_item_lhs = A,cfg_item_rhs1 = \\,cfg_item_rhs2 = (teB a)#\\,cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do#\\) \\ rule_lpopa=[q\\] \\ rule_rpopa=a#y \\ rule_lpush=[q\\,F_DFA_GOTO M q\\ (teB a)] \\ rule_rpush=y\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_shift2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(case_tac r2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(subgoal_tac \" \\q\\ y \\ z A \\ a \\. y \\ (cfgSTD_first G' (k- 1) (\\@(liftB z))) \\ \\prod_lhs=A,prod_rhs=\\@(teB a)#\\\\ \\ cfg_productions G \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\)) \\ \\cfg_item_lhs = A,cfg_item_rhs1 = \\,cfg_item_rhs2 = (teB a)#\\,cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do#\\) \\ rule_lpopaa=[q\\] \\ rule_rpopaa=a#y \\ rule_lpusha=[q\\,F_DFA_GOTO M q\\ (teB a)] \\ rule_rpusha=y\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_shift2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(clarsimp)\n apply(rename_tac y ya \\ \\' z za A \\ a Aa \\' aa \\ \\')(*strict*)\n apply(subgoal_tac \"a=aa\")\n apply(rename_tac y ya \\ \\' z za A \\ a Aa \\' aa \\ \\')(*strict*)\n prefer 2\n apply(erule_tac\n P=\"(a # y) \\ (aa # ya)\"\n in disjE)\n apply(rename_tac y ya \\ \\' z za A \\ a Aa \\' aa \\ \\')(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac y ya \\ \\' z za A \\ a Aa \\' aa \\ \\')(*strict*)\n apply(simp add: prefix_def)\n apply(rename_tac y ya \\ \\' z za A \\ a Aa \\' aa \\ \\')(*strict*)\n apply(clarsimp)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(subgoal_tac \"[last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))] = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))]\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n prefer 2\n apply(erule_tac\n P=\"[last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))] \\ [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))]\"\n in disjE)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(simp add: suffix_def)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(clarsimp)\n apply(thin_tac \"parser_marker P \\rule_lpop = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))], rule_rpop = aa # y, rule_lpush = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)), F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) (teB aa)], rule_rpush = y\\ = Some None\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(thin_tac \"parser_marker P \\rule_lpop = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))], rule_rpop = aa # ya, rule_lpush = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)), F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) (teB aa)], rule_rpush = ya\\ = Some None\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))], rule_rpop = aa # y, rule_lpush = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)), F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) (teB aa)], rule_rpush = y\\ \\ parser_rules P\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))], rule_rpop = aa # ya, rule_lpush = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)), F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) (teB aa)], rule_rpush = ya\\ \\ parser_rules P\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(thin_tac \"[last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))] \\ [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))]\")\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(erule disjE)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(rule no_shift_shift_conflicts1)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(rule sym)\n apply(rule no_shift_shift_conflicts1)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n apply(rename_tac y ya \\ \\' z za A \\ Aa \\' aa \\ \\')(*strict*)\n apply(force)\n done\n\nlemma no_reduce_reduce_conflicts_hlp: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ valid_cfg G'\n \\ \\cfg_item_lhs = A1, cfg_item_rhs1 = w1, cfg_item_rhs2 = [], cfg_item_look_ahead = y1\\ \\ valid_item_set G' k (teB Do # w)\n \\ \\cfg_item_lhs = A2, cfg_item_rhs1 = w2, cfg_item_rhs2 = [], cfg_item_look_ahead = y2\\ \\ valid_item_set G' k (teB Do # w)\n \\ prefix y1 y2\n \\ y1 = y2\"\n apply(simp add: valid_item_set_def valid_item_set_n_def prefix_def)\n apply(clarsimp)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(subgoal_tac \"\\e c. d (Suc 0) = Some (pair e c)\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc n\"\n in cfgRM.pre_some_position_is_some_position)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(subgoal_tac \"\\e c. da (Suc 0) = Some (pair e c)\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc na\"\n in cfgRM.pre_some_position_is_some_position)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za)(*strict*)\n apply(clarsimp)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(subgoal_tac \"teB Do \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf ca=[teB Do]@w@[teB Do]\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and i=\"0\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf cb=[teB Do]@w@[teB Do]\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"0\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = \\ @ w1 @ z\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and i=\"n\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = \\' @ w2 @ za\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"na\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(force)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb)(*strict*)\n apply(clarsimp)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb wa waa wb wc)(*strict*)\n apply(case_tac ca)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb wa waa wb wc cfg_confa)(*strict*)\n apply(case_tac cb)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea ca cb wa waa wb wc cfg_confa cfg_confaa)(*strict*)\n apply(clarsimp)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc)(*strict*)\n apply(case_tac n)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac na c d da \\ e2 z \\' e1a e2a za ea wa wb wc)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac na c d da \\ e2 z \\' e1a e2a za ea wa wb wc)(*strict*)\n prefer 2\n apply(rename_tac na c d da \\ e2 z \\' e1a e2a za ea wa wb wc a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac na c d da \\ e2 z \\' e1a e2a za ea wa wb wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc)(*strict*)\n apply(case_tac y1)\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc)(*strict*)\n prefer 2\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc)(*strict*)\n apply(clarsimp)\n apply(case_tac na)\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e2a za wb wc)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e2 \\' e2a za wb wc)(*strict*)\n prefer 2\n apply(rename_tac c d da e2 \\' e2a za wb wc a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e2a za wb wc)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 e2a wc)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d da e2 e2a wc)(*strict*)\n apply(force)\n apply(rename_tac c d da e2 e2a wc a list)(*strict*)\n apply(force)\n apply(rename_tac na c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = \\' @ teA A2 # za\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"nat\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(force)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = teB Do # wc @ [teB Do]\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"Suc nat\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(force)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w)(*strict*)\n apply(case_tac w2)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 e1a e2a za ea wa wb wc nat w)(*strict*)\n apply(case_tac za)\n apply(rename_tac c d da e2 e1a e2a za ea wa wb wc nat w)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 e1a e2a za ea wa wb wc nat w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. za = w' @ [x']\")\n apply(rename_tac c d da e2 e1a e2a za ea wa wb wc nat w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e2 e1a e2a za ea wa wb wc nat w a list)(*strict*)\n apply(thin_tac \"za=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w a list)(*strict*)\n apply(subgoal_tac \"\\w' x'. w2 = w' @ [x']\")\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w a list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w a list)(*strict*)\n apply(thin_tac \"w2=a#list\")\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w w')(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w w')(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 \\' e1a e2a za ea wa wb wc nat w w' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 e1a e2a za ea wa wc nat w w' list)(*strict*)\n apply(case_tac za)\n apply(rename_tac c d da e2 e1a e2a za ea wa wc nat w w' list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e2 e1a e2a za ea wa wc nat w w' list a lista)(*strict*)\n apply(subgoal_tac \"\\w' x'. za = w' @ [x']\")\n apply(rename_tac c d da e2 e1a e2a za ea wa wc nat w w' list a lista)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e2 e1a e2a za ea wa wc nat w w' list a lista)(*strict*)\n apply(thin_tac \"za=a#lista\")\n apply(clarsimp)\n apply(rename_tac n na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat)(*strict*)\n apply(case_tac na)\n apply(rename_tac na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z \\' e2a za e wa wb wc nat)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da \\ e1 e2 z \\' e2a za e wa wb wc nat)(*strict*)\n prefer 2\n apply(rename_tac c d da \\ e1 e2 z \\' e2a za e wa wb wc nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z \\' e2a za e wa wb wc nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z e2a e w wb wc nat)(*strict*)\n apply(case_tac c)\n apply(rename_tac c d da \\ e1 e2 z e2a e w wb wc nat)(*strict*)\n prefer 2\n apply(rename_tac c d da \\ e1 e2 z e2a e w wb wc nat a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d da \\ e1 e2 z e2a e w wb wc nat a list)(*strict*)\n apply (metis Nil_is_append_conv liftB_reflects_Nil list.simps(3))\n apply(rename_tac c d da \\ e1 e2 z e2a e w wb wc nat)(*strict*)\n apply(force)\n apply(rename_tac na c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = \\ @ teA A1 # z\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n and i=\"nat\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(force)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(subgoal_tac \"\\w. set w \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ cfg_conf \\cfg_conf = \\' @ teA A2 # za\\=[teB Do]@w@[teB Do]\")\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"da\"\n and i=\"nata\"\n in F_CFG_AUGMENT__reachableConf_of_certain_form)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(rule cfgSTD.derivation_initialI)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(rule cfgRM_derivations_are_cfg_derivations)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def valid_cfg_def)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(force)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata wd we)(*strict*)\n apply(case_tac \"\\\")\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata wd we)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da \\ e1 e2 z \\' e1a e2a za e ea wa waa wb wc nat nata wd we a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 z \\' e1a e2a za e ea w wa wb wc nat nata wd we list)(*strict*)\n apply(case_tac \"\\'\")\n apply(rename_tac c d da e1 e2 z \\' e1a e2a za e ea w wa wb wc nat nata wd we list)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 z \\' e1a e2a za e ea w wa wb wc nat nata wd we list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 z e1a e2a za e ea w wa wb wc nat nata wd we list lista)(*strict*)\n apply(case_tac \"z\")\n apply(rename_tac c d da e1 e2 z e1a e2a za e ea w wa wb wc nat nata wd we list lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 z e1a e2a za e ea w wa wb wc nat nata wd we list lista a listb)(*strict*)\n apply(subgoal_tac \"\\w' x'. z = w' @ [x']\")\n apply(rename_tac c d da e1 e2 z e1a e2a za e ea w wa wb wc nat nata wd we list lista a listb)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 z e1a e2a za e ea w wa wb wc nat nata wd we list lista a listb)(*strict*)\n apply(thin_tac \"z=a#listb\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a za e ea w wa wc nat nata we list lista w')(*strict*)\n apply(case_tac \"za\")\n apply(rename_tac c d da e1 e2 e1a e2a za e ea w wa wc nat nata we list lista w')(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a za e ea w wa wc nat nata we list lista w' a listb)(*strict*)\n apply(subgoal_tac \"\\w' x'. za = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a za e ea w wa wc nat nata we list lista w' a listb)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a za e ea w wa wc nat nata we list lista w' a listb)(*strict*)\n apply(thin_tac \"za=a#listb\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a)(*strict*)\n apply(case_tac \"k-length w'\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a)(*strict*)\n apply(clarsimp)\n apply (metis liftB_reflects_length self_append_conv takeShorter take_all take_all_length take_append take_append_prime)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb)(*strict*)\n apply(clarsimp)\n apply(case_tac y1)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb a listb)(*strict*)\n apply(subgoal_tac \"\\w' x'. y1 = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb a listb)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb a listb)(*strict*)\n apply(thin_tac \"y1=a#listb\")\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b x')(*strict*)\n apply(subgoal_tac \"x'=Do\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b x')(*strict*)\n prefer 2\n apply(rule_tac\n v=\"w'\"\n and w=\"w'b\"\n in liftB_terminal_tail_equals)\n apply(blast)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b x')(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b)(*strict*)\n apply(subgoal_tac \"w'=liftB w'b\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b)(*strict*)\n prefer 2\n apply(rule liftB_terminal_butlast_equals)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w' w'a natb w'b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(case_tac \"k - length w'a\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"teB Do \\ set w'a\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(subgoal_tac \"teB Do \\ set w'a\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(rule_tac\n A=\"set(take k w'a)\"\n in set_mp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(rule List.set_take_subset)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(rule_tac\n A=\"set(liftB (w'b @ Do # c))\"\n in set_mp)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b)(*strict*)\n apply (metis liftB_BiElem head_in_set not_in_setBI set_append_contra2)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc)(*strict*)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc)(*strict*)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc a listb)(*strict*)\n apply(subgoal_tac \"\\w' x'. c = w' @ [x']\")\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc a listb)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac c d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc a listb)(*strict*)\n apply(thin_tac \"c=a#listb\")\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w' x')(*strict*)\n apply(subgoal_tac \"x'=Do\")\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w' x')(*strict*)\n prefer 2\n apply(rule_tac\n v=\"w'a\"\n and w=\"w'b@Do#w'\"\n in liftB_terminal_tail_equals)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w')(*strict*)\n apply(subgoal_tac \"w'a=liftB (w'b@Do#w')\")\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w')(*strict*)\n prefer 2\n apply(rule liftB_terminal_butlast_equals)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista w'a natb w'b natc w')(*strict*)\n apply(clarsimp)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista natb w'b natc w')(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB (w'b @ Do # w'))\")\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista natb w'b natc w')(*strict*)\n apply(subgoal_tac \"teB Do \\ set (liftB (w'b @ Do # w'))\")\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista natb w'b natc w')(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista natb w'b natc w')(*strict*)\n apply(force)\n apply(rename_tac d da e1 e2 e1a e2a e ea w wa nat nata list lista natb w'b natc w')(*strict*)\n apply (metis liftB_BiElem head_in_set not_in_setBI set_append_contra2)\n done\n\ntheorem no_reduce_reduce_conflicts: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ conflict_free G G' k\n \\ (parser_marker P) r1 = Some (Some \\prod_lhs = A1, prod_rhs = w1\\)\n \\ (parser_marker P) r2 = Some (Some \\prod_lhs = A2, prod_rhs = w2\\)\n \\ r1 \\ parser_rules P\n \\ r2 \\ parser_rules P\n \\ rule_lpop r2 \\ rule_lpop r1 \\ rule_lpop r1 \\ rule_lpop r2\n \\ rule_rpop r1 \\ rule_rpop r2 \\ rule_rpop r2 \\ rule_rpop r1\n \\ r1 = r2\"\n apply(case_tac r1)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(subgoal_tac \" rule_rpopa=rule_rpush \\ \\prod_lhs=A1,prod_rhs=w1\\ \\ (cfg_productions G) \\ (\\q\\. rule_lpopa=q\\#F_DFA_GOTO_SEQUENCE M q\\ w1 \\ rule_lpush=q\\#(F_DFA_GOTO_SEQUENCE M q\\ [teA A1]) \\ (\\\\. \\cfg_item_lhs = A1,cfg_item_rhs1 = w1,cfg_item_rhs2 = [],cfg_item_look_ahead = rule_rpopa\\ \\ valid_item_set G' k (teB Do#\\@w1) \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\))))\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_reduce2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(case_tac r2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(subgoal_tac \" rule_rpopaa=rule_rpusha \\ \\prod_lhs=A2,prod_rhs=w2\\ \\ (cfg_productions G) \\ (\\q\\. rule_lpopaa=q\\#F_DFA_GOTO_SEQUENCE M q\\ w2 \\ rule_lpusha=q\\#(F_DFA_GOTO_SEQUENCE M q\\ [teA A2]) \\ (\\\\. \\cfg_item_lhs = A2,cfg_item_rhs1 = w2,cfg_item_rhs2 = [],cfg_item_look_ahead = rule_rpopaa\\ \\ valid_item_set G' k (teB Do#\\@w2) \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\))))\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_reduce2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(thin_tac \"parser_marker P r1 = Some (Some \\prod_lhs = A1, prod_rhs = w1\\)\")\n apply(thin_tac \"parser_marker P r2 = Some (Some \\prod_lhs = A2, prod_rhs = w2\\)\")\n apply(clarsimp)\n apply(rename_tac rule_rpush rule_rpusha \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) w1, rule_rpop = rule_rpush, rule_lpush = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) [teA A1], rule_rpush = rule_rpush\\ \\ parser_rules P\")\n apply(rename_tac rule_rpush rule_rpusha \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))) w2, rule_rpop = rule_rpusha, rule_lpush = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))) [teA A2], rule_rpush = rule_rpusha\\ \\ parser_rules P\")\n apply(rename_tac rule_rpush rule_rpusha \\ \\')(*strict*)\n apply(rename_tac y1 y2 v1 v2)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_cfg G'\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_CFG_AUGMENT__makes_CFG)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_dfa M\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in Theorem6__27_a)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_Connected)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_parser P\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in AF_LR_PARSER_valid_parser)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"set (teB Do # v1 @ w1) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"set (teB Do # v2 @ w2) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1 @ w1)=valid_item_set G' k (teB Do # v2 @ w2)\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1 @ w1) = (if (teB Do # v1 @ w1)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1 @ w1)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2 @ w2) = (if (teB Do # v2 @ w2)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2 @ w2)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1) = (if (teB Do # v1)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (rule two_elements_construct_domain_setB)\n apply(rule_tac\n B=\"set (teB Do # v1 @ w1)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (rule two_elements_construct_domain_setA)\n apply(rule_tac\n B=\"set (teB Do # v1 @ w1)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2) = (if (teB Do # v2)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (rule two_elements_construct_domain_setB)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (rule two_elements_construct_domain_setA)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length w2 = length (F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2)\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))\"\n and s=\"valid_item_set G' k (teB Do # v2)\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"length w1 = length (F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))) w1)\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\"\n and s=\"valid_item_set G' k (teB Do # v1)\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"length (teB Do#v2) = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"length (teB Do#v1) = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2 @ w2))\"\n and s=\"last((last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2))\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(case_tac w2)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(rule conjI)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(rule impI)\n apply(subgoal_tac \"\\w' x'. w2 = w' @ [x']\")\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"length list\"\n in NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(thin_tac \"w2=a#list\")\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"teB Do # v2 @ w' @ [x']\"\n and s=\"(teB Do # v2) @ (w' @ [x'])\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) ((teB Do # v2) @ (w' @ [x']))\"\n and s=\"F_DFA_GOTO_SEQUENCE M SSp SSw1 @ (F_DFA_GOTO_SEQUENCE M (last (SSp#(F_DFA_GOTO_SEQUENCE M SSp SSw1))) SSw2)\" for SSp SSw1 SSw2\n in ssubst)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1 @ w1))\"\n and s=\"last((last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))) w1))\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(case_tac w1)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(rule conjI)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(rule impI)\n apply(subgoal_tac \"\\w' x'. w1 = w' @ [x']\")\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"length list\"\n in NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 a list)(*strict*)\n apply(thin_tac \"w1=a#list\")\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"teB Do # v1 @ w' @ [x']\"\n and s=\"(teB Do # v1) @ (w' @ [x'])\"\n in ssubst)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) ((teB Do # v1) @ (w' @ [x']))\"\n and s=\"F_DFA_GOTO_SEQUENCE M SSp SSw1 @ (F_DFA_GOTO_SEQUENCE M (last (SSp#(F_DFA_GOTO_SEQUENCE M SSp SSw1))) SSw2)\" for SSp SSw1 SSw2\n in ssubst)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y2 v1 v2 w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule suffix_last_eq)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"y1=y2\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp only: conflict_free_def)\n apply(erule_tac\n x=\"(teB Do # v1 @ w1)\"\n in allE)\n apply(erule impE)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(erule conjE)+\n apply(thin_tac \"\\I1 I2. I1 \\ valid_item_set G' k (teB Do # v1 @ w1) \\ I2 \\ valid_item_set G' k (teB Do # v1 @ w1) \\ item_core I1 \\ cfg_productions G \\ item_core I2 \\ cfg_productions G \\ \\ item_shift_reduce_conflict G' k I1 I2\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(erule_tac\n x=\"\\cfg_item_lhs = A1, cfg_item_rhs1 = w1, cfg_item_rhs2 = [], cfg_item_look_ahead = y1\\\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_item_lhs = A2, cfg_item_rhs1 = w2, cfg_item_rhs2 = [], cfg_item_look_ahead = y2\\\"\n in allE)\n apply(erule impE)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule conjI)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule conjI)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: item_core_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: item_reduce_reduce_conflict_def)\n apply(subgoal_tac \" F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2 = F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))) w2 \\ last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)) = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule mutual_prefix_equal_suffix)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1) = (if (teB Do # v1)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (rule two_elements_construct_domain_setB)\n apply(rule_tac\n B=\"set (teB Do # v1 @ w1)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (rule two_elements_construct_domain_setA)\n apply(rule_tac\n B=\"set (teB Do # v1 @ w1)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2) = (if (teB Do # v2)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)))\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply (rule two_elements_construct_domain_setB)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply (rule two_elements_construct_domain_setA)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(subgoal_tac \"length w2 = length (F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2)\")\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))\"\n and s=\"valid_item_set G' k (teB Do # v2)\"\n in ssubst)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(subgoal_tac \"length w2 = length (F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))) w2)\")\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y2 v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\"\n and s=\"valid_item_set G' k (teB Do # v1)\"\n in ssubst)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1 @ w1) \\ epda_states M\")\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n prefer 2\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(erule_tac\n P=\"y1 \\ y2\"\n in disjE)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule no_reduce_reduce_conflicts_hlp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(rule sym)\n apply(rule no_reduce_reduce_conflicts_hlp)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y2 v1 v2)(*strict*)\n apply(force)\n done\n\nlemma translate_cfgSTD_first_with_single: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ y \\ cfgSTD_first G' (k - Suc 0) w\n \\ take k (a # y) \\ cfgSTD_first G' k (teB a # w)\"\n apply(simp add: cfgSTD_first_def)\n apply(clarsimp)\n apply(rename_tac x d e1 n)(*strict*)\n apply(rule inMap)\n apply(clarsimp)\n apply(rule_tac\n x=\"a # x\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac x d e1 n)(*strict*)\n prefer 2\n apply(case_tac k)\n apply(rename_tac x d e1 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d e1 n nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d e1 n)(*strict*)\n apply(rule_tac\n x=\"derivation_map d (\\v. \\cfg_conf=(teB a)#(cfg_conf v)\\)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d e1 n)(*strict*)\n apply(rule cfgSTD.derivation_map_preserves_derivation2)\n apply(rename_tac x d e1 n)(*strict*)\n apply(force)\n apply(rename_tac x d e1 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d e1 n aa e b)(*strict*)\n apply(simp add: cfgSTD_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x d e1 n aa e b l r)(*strict*)\n apply(rule_tac\n x=\"teB a#l\"\n in exI)\n apply(rule_tac\n x=\"r\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x d e1 n)(*strict*)\n apply(rule_tac\n x=\"e1\"\n in exI)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(simp add: derivation_map_def maximum_of_domain_def)\n done\n\ntheorem no_shift_reduce_conflicts: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ conflict_free G G' k\n \\ (parser_marker P) r1 = Some None\n \\ (parser_marker P) r2 = Some (Some \\prod_lhs = A2, prod_rhs = w2\\)\n \\ r1 \\ parser_rules P\n \\ r2 \\ parser_rules P\n \\ rule_lpop r2 \\ rule_lpop r1 \\ rule_lpop r1 \\ rule_lpop r2\n \\ rule_rpop r1 \\ rule_rpop r2 \\ rule_rpop r2 \\ rule_rpop r1\n \\ r1 = r2\"\n apply(case_tac r1)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(subgoal_tac \" \\q\\ y \\ z A \\ a \\. y \\ (cfgSTD_first G' (k- 1) (\\@(liftB z))) \\ \\prod_lhs=A,prod_rhs=\\@(teB a)#\\\\ \\ cfg_productions G \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\)) \\ \\cfg_item_lhs = A,cfg_item_rhs1 = \\,cfg_item_rhs2 = (teB a)#\\,cfg_item_look_ahead = z\\ \\ valid_item_set G' k (teB Do#\\) \\ rule_lpopa=[q\\] \\ rule_rpopa=a#y \\ rule_lpush=[q\\,F_DFA_GOTO M q\\ (teB a)] \\ rule_rpush=y\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_shift2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush)(*strict*)\n apply(case_tac r2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(subgoal_tac \" rule_rpopaa=rule_rpusha \\ \\prod_lhs=A2,prod_rhs=w2\\ \\ (cfg_productions G) \\ (\\q\\. rule_lpopaa=q\\#F_DFA_GOTO_SEQUENCE M q\\ w2 \\ rule_lpusha=q\\#(F_DFA_GOTO_SEQUENCE M q\\ [teA A2]) \\ (\\\\. \\cfg_item_lhs = A2,cfg_item_rhs1 = w2,cfg_item_rhs2 = [],cfg_item_look_ahead = rule_rpopaa\\ \\ valid_item_set G' k (teB Do#\\@w2) \\ q\\=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do#\\))))\")\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n prefer 2\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in X6_3_InformationOnRules_reduce2)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(force)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac rule_lpopa rule_rpopa rule_lpush rule_rpush rule_lpopaa rule_rpopaa rule_lpusha rule_rpusha)(*strict*)\n apply(thin_tac \"parser_marker P r1 = Some None\")\n apply(thin_tac \"parser_marker P r2 = Some (Some \\prod_lhs = A2, prod_rhs = w2\\)\")\n apply(clarsimp)\n apply(rename_tac rule_rpusha y \\ z A \\ a \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))], rule_rpop = a # y, rule_lpush = [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\)), F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\))) (teB a)], rule_rpush = y\\ \\ parser_rules P\")\n apply(rename_tac rule_rpusha y \\ z A \\ a \\ \\')(*strict*)\n apply(thin_tac \"\\rule_lpop = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))) w2, rule_rpop = rule_rpusha, rule_lpush = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\')) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # \\'))) [teA A2], rule_rpush = rule_rpusha\\ \\ parser_rules P\")\n apply(rename_tac rule_rpusha y \\ z A \\ a \\ \\')(*strict*)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_cfg G'\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_CFG_AUGMENT__makes_CFG)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_dfa M\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in Theorem6__27_a)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_Connected)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"some_step_from_every_configuration M\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n in F_LR_MACHINE_Complete)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_parser P\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n in AF_LR_PARSER_valid_parser)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"set (teB Do # v1) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"set (teB Do # v2 @ w2) \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule viable_prefix_in_CFG)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule Fact6_12__1)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1)=valid_item_set G' k (teB Do # v2 @ w2)\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v1) = (if (teB Do # v1)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1)))\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2 @ w2) = (if (teB Do # v2 @ w2)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2 @ w2)))\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply (metis two_elements_construct_domain_setB)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply (metis two_elements_construct_domain_setA)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2) = (if (teB Do # v2)=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)))\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_LR_MACHINE_all_SOUND)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply (rule two_elements_construct_domain_setB)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply (rule two_elements_construct_domain_setA)\n apply(rule_tac\n B=\"set (teB Do # v2 @ w2)\"\n in subset_trans)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length w2 = length (F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2)\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))\"\n and s=\"valid_item_set G' k (teB Do # v2)\"\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"length (teB Do#v2) = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"length (teB Do#v1) = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2 @ w2))\"\n and s=\"last((last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2))\"\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(clarsimp)\n apply(case_tac w2)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 aa list)(*strict*)\n apply(rule conjI)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 aa list)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 aa list)(*strict*)\n apply(rule impI)\n apply(subgoal_tac \"\\w' x'. w2 = w' @ [x']\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2 aa list)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"length list\"\n in NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 aa list)(*strict*)\n apply(thin_tac \"w2=aa#list\")\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"teB Do # v2 @ w' @ [x']\"\n and s=\"(teB Do # v2) @ (w' @ [x'])\"\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(rule_tac\n t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) ((teB Do # v2) @ (w' @ [x']))\"\n and s=\"F_DFA_GOTO_SEQUENCE M SSp SSw1 @ (F_DFA_GOTO_SEQUENCE M (last (SSp#(F_DFA_GOTO_SEQUENCE M SSp SSw1))) SSw2)\" for SSp SSw1 SSw2\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_LR_MACHINE_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 w' x')(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule_tac\n t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))\"\n and s=\"last([last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))])\"\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule suffix_last_eq)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: conflict_free_def)\n apply(erule_tac\n x=\"(teB Do # v2 @ w2)\"\n in allE)\n apply(erule impE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(erule conjE)+\n apply(thin_tac \"(\\I1 I2. I1 \\ valid_item_set G' k (teB Do # v2 @ w2) \\ I2 \\ valid_item_set G' k (teB Do # v2 @ w2) \\ item_core I1 \\ cfg_productions G \\ item_core I2 \\ cfg_productions G \\ \\ item_reduce_reduce_conflict I1 I2)\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(erule_tac\n x=\"\\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB a # \\, cfg_item_look_ahead = z\\\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_item_lhs = A2, cfg_item_rhs1 = w2, cfg_item_rhs2 = [], cfg_item_look_ahead = y1\\\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: item_core_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: item_shift_reduce_conflict_def)\n defer\n apply(subgoal_tac \"valid_item_set G' k (teB Do # v2 @ w2) \\ epda_states M\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n prefer 2\n apply(rule LRM_contains_theEqClasses2)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"y1 \\ cfgSTD_first G' k (teB a # \\ @ liftB z)\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(subgoal_tac \"take k (a#y) = y1\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(clarify)\n apply(rule translate_cfgSTD_first_with_single)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(case_tac k)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"valid_item G' 0 \\cfg_item_lhs = A2, cfg_item_rhs1 = w2, cfg_item_rhs2 = [], cfg_item_look_ahead = y1\\\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(simp add: valid_item_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(rule Fact6_12__2)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(rule_tac\n t=\"k\"\n and s=\"Suc nat\"\n in ssubst)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(rule_tac\n S'=\"S'\"\n and Do=\"Do\"\n and G'=\"G'\"\n and G=\"G\"\n in no_shift_reduce_conflicts_hlp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: two_elements_construct_domain_def)\n apply(rule conjI)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n P=\"teB Do \\ teA ` cfg_nonterminals G'\"\n in disjE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def F_LR_PARSER_def)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: two_elements_construct_domain_def)\n apply(rule disjI2)\n apply(clarsimp)\n apply(rule inMap)\n apply(clarsimp)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(clarsimp)\n apply(erule_tac\n A=\"cfg_productions G\"\n and x=\"\\prod_lhs = A, prod_rhs = \\ @ teB a # \\\\\"\n in ballE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(simp add: setBConcat)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\prod_lhs = A, prod_rhs = \\ @ teB a # \\\\\"\n and A=\"cfg_productions G\"\n in ballE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\prod_lhs = A2, prod_rhs = w2\\\"\n and A=\"cfg_productions G\"\n in ballE)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(force)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(simp add: cfgSTD_first_def)\n apply(clarsimp)\n apply(rename_tac y1 y \\ z A \\ a v1 v2 nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(thin_tac \"(last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2) \\ [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))] \\ [last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v1))] \\ (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2)) # F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v2))) w2)\")\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(thin_tac \"y1 \\ cfgSTD_first G' (Suc nat) (teB a # \\ @ liftB z)\")\n apply(thin_tac \"\\prod_lhs = A2, prod_rhs = w2\\ \\ cfg_productions G\")\n apply(thin_tac \"(a # w @ Do # v) \\ y1 \\ y1 \\ (a # w @ Do # v)\")\n apply(subgoal_tac \" (\\w. set w \\ cfg_events G \\ ((cfg_item_look_ahead SSI = w \\ length w=Suc nat) \\ (cfg_item_look_ahead SSI = w@[Do] \\ length w z A \\ a v1 v2 nat w v)(*strict*)\n prefer 2\n apply(rule_tac\n I=\"\\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB a # \\, cfg_item_look_ahead = z\\\"\n in lookaheads_are_kprefixes)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(clarsimp)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\prod_lhs = A, prod_rhs = \\ @ teB a # \\\\\"\n and A=\"cfg_productions G\"\n in ballE)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v)(*strict*)\n apply(clarsimp)\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v wa)(*strict*)\n apply(thin_tac \"\\cfg_item_lhs = A, cfg_item_rhs1 = \\, cfg_item_rhs2 = teB a # \\, cfg_item_look_ahead = z\\ \\ valid_item_set G' (Suc nat) (teB Do # v2 @ w2)\")\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v wa)(*strict*)\n apply(thin_tac \"\\cfg_item_lhs = A2, cfg_item_rhs1 = w2, cfg_item_rhs2 = [], cfg_item_look_ahead = y1\\ \\ valid_item_set G' (Suc nat) (teB Do # v2 @ w2)\")\n apply(rename_tac y1 \\ z A \\ a v1 v2 nat w v wa)(*strict*)\n apply(thin_tac \"valid_dfa M\")\n apply(thin_tac \"every_state_in_some_accessible_configuration M\")\n apply(thin_tac \"some_step_from_every_configuration M\")\n apply(thin_tac \"valid_parser P\")\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v1 v2 nat w v wa)(*strict*)\n apply(thin_tac \"valid_item_set G' (Suc nat) (teB Do # v1) = valid_item_set G' (Suc nat) (teB Do # v2 @ w2)\")\n apply(rename_tac \\ z A \\ a v1 v2 nat w v wa)(*strict*)\n apply(thin_tac \"teB Do \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(thin_tac \"set v1 \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(thin_tac \"set v2 \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(thin_tac \"set w2 \\ two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n apply(simp add: cfgSTD_first_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(subgoal_tac \"suffix x z\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(subgoal_tac \"set c \\ cfg_events G\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(subgoal_tac \"strict_prefix w (take nat c) \\ prefix (take nat c) w\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(erule_tac\n P=\"strict_prefix w (take nat c)\"\n in disjE)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c ca)(*strict*)\n apply(case_tac ca)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c ca aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(subgoal_tac \"aa=Do\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(rule_tac\n A=\"set c\"\n in set_mp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(rule_tac\n A=\"set(take nat c)\"\n in set_mp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(rule_tac\n t=\"take nat c\"\n and s=\"w@Do#list\"\n in ssubst)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(rule_tac\n t=\"aa\"\n and s=\"((w @ aa # list) @ take (nat - length c) z)!(length w)\"\n in ssubst)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply (metis Cons_eq_appendI append_eq_appendI nth_append_length)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(rule_tac\n t=\"Do\"\n and s=\"(w @ Do # v)!(length w)\"\n in ssubst)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply (metis nth_append_length)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(rule_tac\n t=\"(w @ Do # v)\"\n and s=\"(w @ aa # list) @ take (nat - length c) z\"\n in ssubst)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa list)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(erule disjE)\n apply(rename_tac \\ z A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(rule_tac\n A=\"set wa\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(rule_tac\n A=\"set(take (nat - length c) wa)\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(rule_tac\n t=\"take (nat - length c) wa\"\n and s=\"ca@Do#v\"\n in ssubst)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac \\ z A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(case_tac v)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(case_tac \"nat - (length c + length wa)\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(rule_tac\n A=\"set wa\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(rule_tac\n A=\"set(take (nat - length c) wa)\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(rule_tac\n t=\"take (nat - length c) wa\"\n and s=\"ca@[Do]\"\n in ssubst)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. v = w' @ [x']\")\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat v wa d e1 n c ca aa list)(*strict*)\n apply(thin_tac \"v=aa#list\")\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(case_tac \"nat - (length c + length wa)\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(subgoal_tac \"Do \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(rule_tac\n A=\"set wa\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(rule_tac\n A=\"set(take (nat - length c) wa)\"\n in set_mp)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply (metis List.set_take_subset)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(rule_tac\n t=\"take (nat - length c) wa\"\n and s=\"ca @ Do # w' @ [x']\"\n in ssubst)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x')(*strict*)\n apply(simp (no_asm))\n apply(rename_tac \\ A \\ a v2 nat wa d e1 n c ca w' x' nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ A \\ a v2 nat d e1 n c ca w' nata)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (cfg_events G) \\ cfg_events G\")\n apply(rename_tac \\ A \\ a v2 nat d e1 n c ca w' nata)(*strict*)\n apply(force)\n apply(rename_tac \\ A \\ a v2 nat d e1 n c ca w' nata)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(rule mutual_strict_prefix_prefix)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n prefer 2\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(rule liftB_creates_suffix)\n apply(subgoal_tac \"\\d' e. cfgRM.derivation G' d' \\ maximum_of_domain d' n \\ d' 0 = Some (pair None \\cfg_conf=\\ @ liftB z\\) \\ d' n = Some (pair e \\cfg_conf=liftB x\\)\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d\"\n in cfg_derivation_can_be_translated_to_cfgRM_derivation)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(rule_tac\n d=\"d'\"\n and i=\"0\"\n and j=\"n\"\n in CFGRM_terminals_stay_at_end)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply (metis setA_liftB)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa x d e1 n d' e)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(subgoal_tac \"\\v. set v \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\ (case e1 of None \\ True|Some e' \\ e' \\ cfg_productions G) \\ SSc=\\cfg_conf = v @ liftB z\\\" for SSc)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n prefer 2\n apply(rule_tac\n n=\"n\"\n and d=\"d\"\n in CFG_preserves_partial_belongs)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def valid_cfg_def)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(erule_tac\n x=\"\\prod_lhs = A, prod_rhs = \\ @ teB a # \\\\\"\n and A=\"cfg_productions G\"\n in ballE)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(clarsimp)\n apply(simp add: setAConcat setBConcat two_elements_construct_domain_def)\n apply(clarsimp)\n apply(case_tac x)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c aa)(*strict*)\n apply(rule inMap)\n apply(clarsimp)\n apply (metis setA_set_not subsetE)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x b)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c b)(*strict*)\n apply (metis inMap2 set_setB set_mp_prime)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c p)(*strict*)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def)\n apply(clarsimp)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT_def)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\ cfg_nonterminals G\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: AF_LR_PARSER_def AF_LR_PARSER_input_def valid_cfg_def)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c)(*strict*)\n apply(erule exE)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c va)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c va x)(*strict*)\n apply(simp add: liftB_commutes_over_concat take_liftB)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(subgoal_tac \"teB x \\ set(liftB c)\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n prefer 2\n apply(rule set_liftB_insert)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(thin_tac \"x \\ set c\")\n apply(subgoal_tac \"teB x \\ two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(simp add: two_elements_construct_domain_def)\n apply(erule_tac\n P=\"teB x \\ teA ` cfg_nonterminals G\"\n in disjE)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(force)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(clarsimp)\n apply(rename_tac \\ z A \\ a v2 nat w v wa d e1 n c x)(*strict*)\n apply(force)\n done\n\ntheorem Lemma_6_36_ReduceReduce_Conflict_implies_nondeterminism: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ conflict_free G G' k\n \\ parserS.is_forward_edge_deterministic_accessible P\"\n apply(subgoal_tac \"valid_cfg G'\")\n prefer 2\n apply(rule F_CFG_AUGMENT__makes_CFG)\n apply(simp add: F_CFG_AUGMENT__input_def AF_LR_PARSER_input_def)\n apply(force)\n apply(simp add: parserS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(rename_tac r1 r2)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(subgoal_tac \"r1 \\ parser_rules P\")\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n prefer 2\n apply(simp add: parserS_step_relation_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(subgoal_tac \"r2 \\ parser_rules P\")\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n prefer 2\n apply(simp add: parserS_step_relation_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(subgoal_tac \"(rule_lpop r2 \\ rule_lpop r1 \\ rule_lpop r1 \\ rule_lpop r2) \\ (rule_rpop r1 \\ rule_rpop r2 \\ rule_rpop r2 \\ rule_rpop r1)\")\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n prefer 2\n apply(simp add: parserS_step_relation_def)\n apply(case_tac c1)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera)(*strict*)\n apply(case_tac c2)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa)(*strict*)\n apply(case_tac c)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb)(*strict*)\n prefer 2\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb x xa xb xc)(*strict*)\n apply(rule_tac\n b=\"xa\"\n and d=\"xc\"\n in mutual_prefix_prefix)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb)(*strict*)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb x xa xb xc)(*strict*)\n apply(subgoal_tac \"x @ rule_lpop r1 = xb @ rule_lpop r2\")\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb x xa xb xc)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 parserS_conf_stacka parserS_conf_schedulera parserS_conf_stackaa parserS_conf_scheduleraa parserS_conf_stackb parserS_conf_schedulerb x xa xb xc)(*strict*)\n apply(rule_tac\n a=\"xb\"\n in mutual_suffix_suffix)\n apply(rule sym)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(clarsimp)\n apply(case_tac \"(parser_marker P) r1\")\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(subgoal_tac \"parser_marker P r1 \\ None\")\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(rule_tac\n G=\"G\"\n in X6_3_InformationOnRules_EffectNotNone)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(case_tac \"(parser_marker P) r2\")\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(subgoal_tac \"parser_marker P r2 \\ None\")\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(rule_tac\n G=\"G\"\n in X6_3_InformationOnRules_EffectNotNone)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(simp add: AF_LR_PARSER_input_def)\n apply(rename_tac c c1 c2 r1 r2 a)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(case_tac a)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(case_tac aa)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(rule no_shift_shift_conflicts)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab)(*strict*)\n apply(case_tac ab)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(rule no_shift_reduce_conflicts)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab)(*strict*)\n apply(case_tac aa)\n apply(rename_tac c c1 c2 r1 r2 a aa ab)(*strict*)\n apply(rule sym)\n apply(case_tac ab)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(rule no_shift_reduce_conflicts)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab prod_lhs prod_rhs)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac)(*strict*)\n apply(case_tac ab)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs)(*strict*)\n apply(case_tac ac)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(rule no_reduce_reduce_conflicts)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 r1 r2 a aa ab ac prod_lhs prod_rhs prod_lhsa prod_rhsa)(*strict*)\n apply(force)\n done\n\ntheorem F_LR_PARSER_is_forward_edge_deterministic_accessible: \"\n AF_LR_PARSER_input G F Do S' G' M P k\n \\ cfgSTD.Nonblockingness_branching G\n \\ cfg_LRk G k\n \\ parserS.is_forward_edge_deterministic_accessible P\"\n apply(rule Lemma_6_36_ReduceReduce_Conflict_implies_nondeterminism)\n apply(force)\n apply(rule cfg_LRk_implies_conflict_free)\n apply(simp add: AF_LR_PARSER_input_def F_CFG_AUGMENT__input_def)\n apply(force)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_06_05/FUNCTION__LR_PARSER__part4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.26175662303632063}} {"text": "theory Distributed_WebApp\nimports \"../TopoS_Impl\"\nbegin\n\nsection\\Distributed Web Application Example\\\n\ntext\\\n The symbolic policy names are of type @{typ string}, e.g. @{term \"''WebFrnt''\"}\n\\\n\ntext\\We start with the empty policy, only the entities are defined.\\\ndefinition policy :: \"string list_graph\" where\n \"policy \\ \\ nodesL = [''WebFrnt'', ''DB'', ''Log'', ''WebApp'', ''INET''],\n edgesL = [] \\\"\n\ntext\\Sanity check\\\nlemma \"wf_list_graph policy\" by eval\n(*proof by eval means we have executable code to show the lemma. No need to show anything by hand*)\n\n\ntext\\Defining the security invariants\\\ndefinition LogSink_m::\"(string SecurityInvariant)\" where\n \"LogSink_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\ \n node_properties = [''Log'' \\ Sink]\n \\ ''No information must leave the logging server''\"\n\ntext\\\n0 - unclassified\n1 - confidential\n\\\n\\ \\trusted: can access any security level, privacy-level 0: can reveal to anyone. I.e. can declassify\\\ndefinition BLP_m::\"(string SecurityInvariant)\" where\n \"BLP_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\ \n node_properties = [''DB'' \\ \\ security_level = 1, trusted = False \\,\n ''Log'' \\ \\ security_level = 1, trusted = False \\,\n ''WebApp'' \\ \\ security_level = 0, trusted = True \\ \n ]\n \\ ''The database and the logging server have confidential information''\"\n\ndefinition Subnet_m::\"(string SecurityInvariant)\" where\n \"Subnet_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\ \n node_properties = [''DB'' \\ Member,\n ''Log'' \\ Member,\n ''WebApp'' \\ Member,\n ''WebFrnt'' \\ InboundGateway \\ \\DMZ\\\n ]\n \\ ''internal/DMZ structure''\"\n\n\ndefinition DBACL_m::\"(string SecurityInvariant)\" where\n \"DBACL_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\ \n node_properties = [''DB'' \\ Master [''WebApp''],\n ''WebApp'' \\ Care\n ]\n \\ ''ACL of db''\"\n\ntext\\The list of security invariants\\\ndefinition \"security_invariants = [Subnet_m, BLP_m, LogSink_m, DBACL_m]\"\n\ntext\\All security invariants are fulfilled (obviously, the policy permits no flows).\\\nlemma \"all_security_requirements_fulfilled security_invariants policy\" by eval\n\ntext\\Obviously, no policy rules violate the security invariants.\\\nlemma \"implc_get_offending_flows security_invariants policy = []\" by eval\n\n\ntext\\We generate the maximum security policy.\\\ndefinition \"max_policy = generate_valid_topology security_invariants \\nodesL = nodesL policy, edgesL = List.product (nodesL policy) (nodesL policy) \\\"\n\n\ntext\\Calculating the maximum policy (executing it).\\\nvalue \"max_policy\"\nlemma \"max_policy = \n \\nodesL = [''WebFrnt'', ''DB'', ''Log'', ''WebApp'', ''INET''],\n edgesL = [(''WebFrnt'', ''WebFrnt''), (''WebFrnt'', ''Log''), (''WebFrnt'', ''WebApp''), (''WebFrnt'', ''INET''), (''DB'', ''DB''),\n (''DB'', ''Log''), (''DB'', ''WebApp''), (''Log'', ''Log''), (''WebApp'', ''WebFrnt''), (''WebApp'', ''DB''),\n (''WebApp'', ''Log''), (''WebApp'', ''WebApp''), (''WebApp'', ''INET''), (''INET'', ''WebFrnt''), (''INET'', ''INET'')]\\\"\nby eval (*proof by eval means it can be directly executed*)\n\ntext\\\nVisualizing the maximum policy\n\\\nML\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"max_policy\"};\n\\\n\ntext\\The maximum policy also fulfills all security invariants.\\\nlemma \"all_security_requirements_fulfilled security_invariants max_policy\" by eval\ntext\\This holds in general: @{thm generate_valid_topology_sound}.\\\n\ntext\\fine-tuning generated policy.\\\ndefinition \"my_policy = \\nodesL = [''WebFrnt'', ''DB'', ''Log'', ''WebApp'', ''INET''],\n edgesL = [(''WebFrnt'', ''WebFrnt''), (''WebFrnt'', ''Log''), (''WebFrnt'', ''WebApp''), (''DB'', ''DB''), (''DB'', ''Log''),\n (''DB'', ''WebApp''), (''Log'', ''Log''), (''WebApp'', ''WebFrnt''), (''WebApp'', ''DB''), (''WebApp'', ''Log''), (''WebApp'', ''WebApp''),\n (''WebApp'', ''INET''), (''INET'', ''WebFrnt''), (''INET'', ''INET'')]\\\"\nlemma \"all_security_requirements_fulfilled security_invariants my_policy\" by eval\nlemma \"set (edgesL my_policy) \\ set (edgesL max_policy)\" by eval\n\ntext\\\nThe diff to the maximum policy.\n\\\nML_val\\\nvisualize_edges @{context} @{term \"edgesL my_policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#3399FF\\\", constraint=false]\", @{term \"[e \\ edgesL max_policy. e \\ set (edgesL my_policy)]\"})] \"\"; \n\\\n\n\n\nsection\\A stateful implementation\\\ndefinition \"stateful_policy = generate_valid_stateful_policy_IFSACS my_policy security_invariants\"\nvalue \"stateful_policy\"\n\ntext\\the stateful compliance criteria\\\n\ntext\\No information flow violations\\\n lemma \"all_security_requirements_fulfilled (get_IFS security_invariants) (stateful_list_policy_to_list_graph stateful_policy)\" by eval\n \n text\\No access control side effects\\\n lemma \"\\ F \\ set (implc_get_offending_flows (get_ACS security_invariants) (stateful_list_policy_to_list_graph stateful_policy)).\n set F \\ set (backlinks (flows_stateL stateful_policy)) - (set (flows_fixL stateful_policy))\" by eval\n\n text\\In general, the calculated stateful policy complies with the security policy: @{thm generate_valid_stateful_policy_IFSACS_stateful_policy_compliance}\\\n\ntext\\Visualizing the stateful policy.\\\nML_val\\\nvisualize_edges @{context} @{term \"flows_fixL stateful_policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL stateful_policy\"})] \"\"; \n\\\n\n\nsubsection\\Exporting to Network Security Mechanism Configurations\\\n\n\ntext\\Space-separated policy dump\\\nML_val\\\niterate_edges_ML @{context} @{term \"flows_fixL stateful_policy\"}\n (fn (v1,v2) => writeln (\"\"^v1^\" \"^v2) )\n (fn _ => () )\n (fn _ => () );\n\nwriteln \"# stateful answers\";\niterate_edges_ML @{context} @{term \"flows_stateL stateful_policy\"}\n (fn (v1,v2) => writeln (v2^\" \"^v1) )\n (fn _ => () )\n (fn _ => () )\n\\\n\ntext\\firewall -- classical use case\\\nML_val\\\n\n(*header*)\nwriteln (\"echo 1 > /proc/sys/net/ipv4/ip_forward\"^\"\\n\"^\n \"# flush all rules\"^\"\\n\"^\n \"iptables -F\"^\"\\n\"^\n \"#default policy for FORWARD chain:\"^\"\\n\"^\n \"iptables -P FORWARD DROP\");\n\niterate_edges_ML @{context} @{term \"flows_fixL stateful_policy\"}\n (fn (v1,v2) => writeln (\"iptables -A FORWARD -i $\"^v1^\"_iface -s $\"^v1^\"_ipv4 -o $\"^v2^\"_iface -d $\"^v2^\"_ipv4 -j ACCEPT\"^\" # \"^v1^\" -> \"^v2) )\n (fn _ => () )\n (fn _ => () );\n\niterate_edges_ML @{context} @{term \"flows_stateL stateful_policy\"}\n (fn (v1,v2) => writeln (\"iptables -I FORWARD -m state --state ESTABLISHED -i $\"^v2^\"_iface -s $\"^v2^\"_ipv4 -o $\"^v1^\"_iface -d $\"^v1^\"_ipv4 -j ACCEPT # \"^v2^\" -> \"^v1^\" (answer)\") )\n (fn _ => () )\n (fn _ => () )\n\\\n\ntext\\firewall -- OpenVPN scenario\\\nML_val\\\n\n(*header*)\nwriteln (\"echo 1 > /proc/sys/net/ipv4/ip_forward\"^\"\\n\"^\n \"# flush all rules\"^\"\\n\"^\n \"iptables -F\"^\"\\n\"^\n \"#default policy for FORWARD chain:\"^\"\\n\"^\n \"iptables -P FORWARD DROP\");\n\nfun iface (s: string): string =\n if s = \"INET\" then \"eth0\" else \"tun0\";\n\niterate_edges_ML @{context} @{term \"[(s,r) \\ flows_fixL stateful_policy. s \\ r]\"}\n (fn (v1,v2) => writeln (\"iptables -A FORWARD -i \"^iface v1^\" -s $\"^v1^\"_ipv4 -o \"^iface v2^\" -d $\"^v2^\"_ipv4 -j ACCEPT\") )\n (fn _ => () )\n (fn _ => () );\n\niterate_edges_ML @{context} @{term \"flows_stateL stateful_policy\"}\n (fn (v1,v2) => writeln (\"iptables -I FORWARD -m state --state ESTABLISHED -i \"^iface v2^\" -s $\"^v2^\"_ipv4 -o \"^iface v1^\" -d $\"^v1^\"_ipv4 -j ACCEPT\") )\n (fn _ => () )\n (fn _ => () )\n\\\n\n\nlemma \"set (flows_stateL stateful_policy) \\ set (flows_fixL stateful_policy)\" by eval\n\ndefinition stateful_flows :: \"(string \\ string) list\" where\n \"stateful_flows \\ [(src, dst) \\ flows_stateL stateful_policy. src \\ dst]\"\nvalue \"stateful_flows\"\n\ndefinition stateless_flows :: \"(string \\ string) list\" where\n \"stateless_flows \\ [(src, dst) \\ flows_fixL stateful_policy. src \\ dst \\ (src, dst) \\ set stateful_flows]\"\nvalue \"stateless_flows\"\n\ntext\\OpenFlow Flow table Rules\\\nML_val\\\nfun ARP (src: string) (dst: string): string =\n \"# ARP Request\\n\"^\n \"in_port=${port_\"^src^\"} dl_src=${mac_\"^src^\"} dl_dst=ff:ff:ff:ff:ff:ff arp arp_sha=${mac_\"^src^\"} \"^\n \"arp_spa=${ip4_\"^src^\"} arp_tpa=${ip4_\"^dst^\"} priority=40000 action=mod_dl_dst:${mac_\"^dst^\"},output:${port_\"^dst^\"}\"^\"\\n\"^\n \"# ARP Reply\\n\"^\n \"dl_src=${mac_\"^dst^\"} dl_dst=${mac_\"^src^\"} arp arp_sha=${mac_\"^dst^\"} \"^\n \"arp_spa=${ip4_\"^dst^\"} arp_tpa=${ip4_\"^src^\"} priority=40000 action=output:${port_\"^src^\"}\";\n\nlocal\n fun IPv4_helper (priority: int) (nw_src_wildcard: bool) (nw_dst_wildcard: bool) (src: string) (dst: string): string =\n let\n val nw_src = (if nw_src_wildcard then \"*\" else \"${ip4_\"^src^\"}\");\n val nw_dst = (if nw_dst_wildcard then \"*\" else \"${ip4_\"^dst^\"}\");\n in\n \"in_port=${port_\"^src^\"} dl_src=${mac_\"^src^\"} ip nw_src=\"^nw_src^\" \"^\n \"nw_dst=\"^nw_dst^\" priority=\"^(Int.toString priority)^\" action=mod_dl_dst:${mac_\"^dst^\"},output:${port_\"^dst^\"}\"\n end;\nin\n fun IPv4 (src: string) (dst: string): string =\n if dst = \"INET\" then\n IPv4_helper 30000 false true src dst\n else if src = \"INET\" then\n IPv4_helper 30000 true false src dst\n else\n IPv4_helper 40000 false false src dst\n ;\nend;\n\niterate_edges_ML @{context} @{term \"stateful_flows\"}\n (fn (v1,v2) => writeln ((ARP v1 v2) ^ \"\\n\" ^ (ARP v2 v1) ^ \"\\n\" ^ (IPv4 v1 v2) ^ \"\\n\" ^ (IPv4 v2 v1) ^\"\\n\"))\n (fn _ => () )\n (fn _ => () );\n\niterate_edges_ML @{context} @{term \"stateless_flows\"}\n (fn (v1,v2) => writeln ((ARP v1 v2) ^ \"\\n\" ^ (IPv4 v1 v2) ^ \"\\n\"))\n (fn _ => () )\n (fn _ => () )\n\\\n\n\ntext\\Finally, all the functions demonstrated here can be exported to several programming languages\n to obtain a stand-alone tool.\\\nexport_code\n security_invariants\n policy\n all_security_requirements_fulfilled\n implc_get_offending_flows\n max_policy\n my_policy\n generate_valid_stateful_policy_IFSACS\n stateful_policy\n stateful_flows\n stateless_flows\nin Scala\n\n\n\n\n\n\n(*dockermynet4*)\n\n\ndefinition dockermynet4policy :: \"string list_graph\" where\n \"dockermynet4policy \\ \\ nodesL = [''WebFrnt'', ''DB'', ''Log'', ''WebApp'', ''INET''],\n edgesL = [(''INET'',''INET''),\n (''INET'',''WebFrnt''),\n (''WebApp'',''INET''),\n (''WebApp'',''WebApp''),\n (''WebApp'',''DB''),\n (''WebApp'',''Log''),\n (''WebApp'',''WebFrnt''),\n (''DB'',''WebApp''),\n (''DB'',''DB''),\n (''DB'',''Log''),\n (''Log'',''Log''),\n (''Log'',''WebFrnt''),\n (''WebFrnt'',''WebApp''),\n (''WebFrnt'',''Log''),\n (''WebFrnt'',''WebFrnt'')] \\\"\n\nlemma \"wf_list_graph dockermynet4policy\" by eval\n\nML\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"dockermynet4policy\"};\n\\\n\nML_val\\\nwriteln (\"*filter\"^\"\\n\"^\n \":INPUT ACCEPT [0:0]\"^\"\\n\"^\n \":FORWARD DROP [0:0]\"^\"\\n\"^\n \":OUTPUT ACCEPT [0:0]\"^\"\\n\");\n\nfun mkiface s = if s = \"INET\" then \"INET_iface\" else \"br-b74b417b331f\";\n\niterate_edges_ML @{context} @{term \"flows_fixL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"}\n (fn (v1,v2) => writeln (\"-A FORWARD -i \"^mkiface v1^\" -s $\"^v1^\"_ipv4 -o \"^mkiface v2^\" -d $\"^v2^\"_ipv4 -j ACCEPT\") )\n (fn _ => () )\n (fn _ => () );\n\niterate_edges_ML @{context} @{term \"flows_stateL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"}\n (fn (v1,v2) => writeln (\"-I FORWARD -m state --state ESTABLISHED -i \"^mkiface v2^\" -s $\"^v2^\"_ipv4 -o \"^mkiface v1^\" -d $\"^v1^\"_ipv4 -j ACCEPT\") )\n (fn _ => () )\n (fn _ => () );\n\nwriteln (\"COMMIT\"^\"\\n\");\n\\\n\n\nML_val\\\nvisualize_edges @{context} @{term \"flows_fixL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"})] \"\"; \n\\\n\n(*dfwfw (docker firewall) rules: https://github.com/irsl/dfwfw*)\n\nML_val\\\nwriteln (\"{\"^\"\\n\"^\n \"\\\"container_to_container\\\": {\"^\"\\n\"^\n \"\\\"rules\\\": [\"^\"\\n\"^\n \"\\n\");\n\nfun mkdfwfwrule filter v1 v2 = \"{\"^\"\\n\"^\n \" \\\"network\\\": \\\"mynet\\\",\"^\"\\n\"^\n \" \\\"src_container\\\": \\\"Name =~ ^\"^ String.map Char.toLower v1 ^\"-?\\\\\\\\d*$\\\",\"^\"\\n\"^\n \" \\\"dst_container\\\": \\\"Name =~ ^\"^ String.map Char.toLower v2 ^\"-?\\\\\\\\d*$\\\",\"^\"\\n\"^\n \" \\\"filter\\\": \\\"\"^filter^\"\\\",\"^\"\\n\"^\n \" \\\"action\\\": \\\"ACCEPT\\\"\"^\"\\n\"^\n \"},\";\n\niterate_edges_ML @{context} @{term \"flows_fixL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"}\n (fn (v1,v2) => writeln (mkdfwfwrule \"\" v1 v2) )\n (fn _ => () )\n (fn _ => () );\n\niterate_edges_ML @{context} @{term \"flows_stateL (generate_valid_stateful_policy_IFSACS max_policy security_invariants)\"}\n (fn (v1,v2) => writeln (mkdfwfwrule \"-m state --state ESTABLISHED\" v2 v1))\n (fn _ => () )\n (fn _ => () );\n\nwriteln (\"]}}\"^\"\\n\");\n\\\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Examples/Distributed_WebApp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.26175660985256194}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory TailrecPre\nimports\n \"Word_Lib.WordSetup\"\n \"Lib.Lib\"\nbegin\n\ndefinition\n \"tailrec_pre (f1 :: 'a \\ 'a) guard precondition (x::'a) \\\n (\\k. (\\m. m < k \\ guard ((f1 ^^ m) x)) \\ precondition ((f1 ^^ k) x)) \\\n (\\n. \\ guard ((f1 ^^ n) x))\"\n\ndefinition\n \"short_tailrec_pre (f :: 'a \\ ('a + 'b) \\ bool) \\\n tailrec_pre (theLeft o fst o f) (isLeft o fst o f) (snd o f)\"\n\npartial_function (tailrec)\n tailrec :: \"('a \\ 'a) \\ ('a \\ 'b) \\ ('a \\ bool) \\ 'a \\ 'b\"\nwhere\n \"tailrec f1 f2 g x = (if g x then tailrec f1 f2 g (f1 x) else f2 x)\"\n\nlemma tailrec_steps:\n \"g x \\ tailrec f1 f2 g x = tailrec f1 f2 g (f1 x)\"\n \"\\ g x \\ tailrec f1 f2 g x = f2 x\"\n by (simp_all add: tailrec.simps cong: if_weak_cong split del: if_split)\n\ndefinition\n \"short_tailrec (f :: 'a \\ ('a + 'b) \\ bool) \\\n tailrec (theLeft o fst o f) (theRight o fst o f) (isLeft o fst o f)\"\n\ndefinition\n \"short_tailrec_pair stp v = (short_tailrec_pre stp v, short_tailrec stp v)\"\n\nlemma tailrec_pre_lemma:\n \"!f1 g p x. tailrec_pre f1 g p (x::'a) = (p x \\ (g x \\ tailrec_pre f1 g p (f1 x)))\"\n apply (clarsimp simp add: tailrec_pre_def)\n apply (rule iffI)\n apply (rule conjI)\n apply auto[1]\n apply clarsimp\n apply (rule conjI[rotated])\n apply (case_tac n)\n apply simp\n apply (clarsimp simp: funpow_swap1)\n apply auto[1]\n apply clarsimp\n apply (drule_tac x=\"Suc n\" for n in spec, simp add: funpow_swap1)\n apply (erule mp)\n apply clarsimp\n apply (case_tac m, simp_all add: funpow_swap1)[1]\n apply (case_tac \"g x\")\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (case_tac k)\n apply auto[1]\n apply (simp_all add: funpow_swap1)[1]\n apply (erule allE, erule impE)\n prefer 2\n apply assumption\n apply (rule allI)\n apply (rule impI)\n apply (drule_tac x=\"Suc m\" in spec, simp_all add: funpow_swap1)\n apply (rule_tac x=\"Suc n\" in exI)\n apply (simp add: funpow_swap1)\n apply (rule conjI)\n prefer 2\n apply (rule_tac x=\"0\" in exI)\n apply auto[1]\n apply (rule allI)\n apply (rule impI)\n apply (case_tac k)\n apply auto\n done\n\nlemma tailrec_pre_lemmata:\n \"g x \\ tailrec_pre f1 g p (x::'a) = (p x \\ tailrec_pre f1 g p (f1 x))\"\n \"\\ g x \\ tailrec_pre f1 g p (x::'a) = p x\"\n by (metis tailrec_pre_lemma)+\n\ntheorem short_tailrec_thm:\n \"\\f x. short_tailrec f x = (if isLeft (fst (f x))\n then short_tailrec f (theLeft (fst (f x)))\n else theRight (fst (f x))) \\\n (short_tailrec_pre f x = (snd (f x)\n \\ (isLeft (fst (f x)) \\ short_tailrec_pre f (theLeft (fst (f x))))))\"\n apply (clarsimp simp add: short_tailrec_pre_def short_tailrec_def)\n apply (simp add: tailrec_pre_lemmata tailrec_steps)\n done\n\nlemma short_tailrec_pair_single_step:\n \"\\v. \\ isLeft (fst (f v))\n \\ short_tailrec_pair f = (\\v. let (rv, b) = (f v) in (b, theRight rv))\"\n apply (rule ext)\n apply (simp add: short_tailrec_pair_def split_def Let_def)\n apply (simp add: short_tailrec_thm cong: imp_cong[OF _ refl] if_weak_cong)\n done\n\nlemma eq_true_imp:\n \"(x == Trueprop True) ==> PROP x\"\n apply auto\n done\n\nlemma forall_true:\n \"(!x. True) = True\"\n apply auto\n done\n\nlemmas split_thm = split_conv\n\ndefinition\n line_number :: \"word32 \\ bool\"\nwhere\n \"line_number n \\ True\"\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/TailrecPre.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.26173846153682745}} {"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\nsection \\CleanQ List Model to Ring Buffer Model refinement COMPLEX to SIMPLE\\\n\ntext \\\n The second refinement is from unbounded lists to bounded buffer rings for transferring\n ownership between two agents.\n\\\n\ntheory CleanQ_ListRBRefinement\n(*<*) imports\n \"../Refinements\"\n CleanQ_ListModel\n CleanQ_RBModel\n CleanQ_SetListRefinement (* Only for the pre condition of the lists*)\nbegin\n(*>*)\n\n\n(* ==================================================================================== *)\nsubsection \\RB Pre- and post- conditions\\\n(* ==================================================================================== *)\n\n\ndefinition CleanQ_RB_enq_x_pre :: \"'a set \\ 'a \\ ('a CleanQ_RB_State, 'a CleanQ_RB_State) Semantic.xstate set\"\n where \"CleanQ_RB_enq_x_pre K b = Semantic.Normal ` {rb. CleanQ_RB_Invariants K rb \\ CleanQ_RB_enq_x_possible rb \\ b \\ rSX rb }\"\n\ndefinition CleanQ_RB_enq_y_pre :: \"'a set \\ 'a \\ ('a CleanQ_RB_State, 'a CleanQ_RB_State) Semantic.xstate set\"\n where \"CleanQ_RB_enq_y_pre K b = Semantic.Normal ` {rb. CleanQ_RB_Invariants K rb \\ CleanQ_RB_enq_y_possible rb \\ b \\ rSY rb}\"\n\ndefinition CleanQ_RB_deq_x_pre :: \"'a set \\ 'a \\ ('a CleanQ_RB_State, 'a CleanQ_RB_State) Semantic.xstate set\" \n where \"CleanQ_RB_deq_x_pre K buf = Semantic.Normal ` {rb. CleanQ_RB_Invariants K rb \\ CleanQ_RB_deq_x_possible rb \\\n buf = rb_read_tail (rTYX rb)}\"\ndefinition CleanQ_RB_deq_y_pre :: \"'a set \\ 'a \\ ('a CleanQ_RB_State, 'a CleanQ_RB_State) Semantic.xstate set\" \n where \"CleanQ_RB_deq_y_pre K buf = Semantic.Normal ` {rb. CleanQ_RB_Invariants K rb \\ CleanQ_RB_deq_y_possible rb \\\n buf = rb_read_tail (rTXY rb)}\"\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\Enqueue Refinement\\\n(* ------------------------------------------------------------------------------------ *)\n\nlemma\n CleanQ_listRBRefinement_enq_x: \n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_enq_x_pre K buf\" \n shows\n \"((\\a, CleanQ_List_enq_x_pre K buf, Language.Basic (CleanQ_List_enq_x buf)), \n (\\c, CleanQ_RB_enq_x_pre K buf, Language.Basic (CleanQ_RB_enq_x buf)))\n \\ refinement_s (separable_lift CleanQ_RB2List CleanQ_RB2List)\"\n apply(rule refinement_s_BasicI) (* Problem applying this after unfolding*)\n unfolding separable_lift_def\nproof -\n show \"\\sc. Semantic.xstate.Normal sc \\ CleanQ_RB_enq_x_pre K buf \\ CleanQ_RB2List (CleanQ_RB_enq_x buf sc) = CleanQ_List_enq_x buf (CleanQ_RB2List sc)\" \n using precond CleanQ_RB_enq_x_equal\n using CleanQ_RB_enq_x_pre_def by fastforce\n next\n have core_g2: \"Semantic.xstate.Normal (CleanQ_RB2List sc) \\ CleanQ_List_enq_x_pre K buf\" using precond\n proof -\n fix b\n have b_in_sx: \"b \\ (rSX sc) \\ b \\ lSX (CleanQ_RB2List sc)\"\n by (simp add: CleanQ_RB2List_def)\n have b_notin_txy: \"b \\ (rSX sc) \\ b \\ set (lTXY (CleanQ_RB2List sc))\" \n using precond\n unfolding CleanQ_RB_enq_x_pre_def CleanQ_RB2List_def\n using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n \n have final: \"Semantic.xstate.Normal sc \\ CleanQ_RB_enq_x_pre K buf \\ Semantic.xstate.Normal (CleanQ_RB2List sc) \\ CleanQ_List_enq_x_pre K buf\" \n using b_in_sx b_notin_txy precond unfolding CleanQ_RB2List_def CleanQ_RB_enq_x_pre_def CleanQ_List_enq_x_pre_def\n by (smt CleanQ_List_State.select_convs(1) CleanQ_List_State.select_convs(3) CleanQ_RB2List_def \n CleanQ_RB_Invariants_List_Invariants CleanQ_RB_Invariants_def CollectD CollectI I2_rb_img_def \n Semantic.xstate.inject(1) Set.set_insert disjoint_insert(1) imageE imageI)\n\n show ?thesis using final precond\n by blast\n qed\n show \"Semantic.xstate.case_xstate (\\sc. Semantic.xstate.Normal (CleanQ_RB2List sc)) (\\sc. Abrupt (CleanQ_RB2List sc)) (\\fc. Semantic.xstate.Fault (CleanQ_RB2List fc))\n Semantic.xstate.Stuck ` CleanQ_RB_enq_x_pre K buf \\ CleanQ_List_enq_x_pre K buf\"\n using core_g2 CleanQ_RB_Invariants_List_Invariants unfolding CleanQ_RB_enq_x_pre_def CleanQ_List_enq_x_pre_def\n by (smt CleanQ_List_State.select_convs(1) CleanQ_List_State.select_convs(3) CleanQ_RB2List_def CleanQ_RB_Invariants_def \n CollectI I2_rb_img_def Semantic.xstate.simps(16) disjoint_iff_not_equal image_Collect_subsetI image_def image_image)\n \nqed\n\nlemma\n CleanQ_listRBRefinement_enq_y: \n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_enq_y_pre K buf\" \n shows\n \"((\\a, CleanQ_List_enq_y_pre K buf, Language.Basic (CleanQ_List_enq_y buf)), \n (\\c, CleanQ_RB_enq_y_pre K buf, Language.Basic (CleanQ_RB_enq_y buf)))\n \\ refinement_s (separable_lift CleanQ_RB2List CleanQ_RB2List)\"\n apply(rule refinement_s_BasicI) (* Problem applying this after unfolding*)\n unfolding separable_lift_def\nproof -\n show \"\\sc. Semantic.xstate.Normal sc \\ CleanQ_RB_enq_y_pre K buf \\ CleanQ_RB2List (CleanQ_RB_enq_y buf sc) = CleanQ_List_enq_y buf (CleanQ_RB2List sc)\" \n using precond CleanQ_RB_enq_y_equal\n using CleanQ_RB_enq_y_pre_def by fastforce\n next\n have core_g2: \"Semantic.xstate.Normal (CleanQ_RB2List sc) \\ CleanQ_List_enq_y_pre K buf\" using precond\n proof -\n fix b\n have b_in_sx: \"b \\ (rSY sc) \\ b \\ lSY (CleanQ_RB2List sc)\"\n by (simp add: CleanQ_RB2List_def)\n have b_notin_tyx: \"b \\ (rSY sc) \\ b \\ set (lTYX (CleanQ_RB2List sc))\" \n using precond\n unfolding CleanQ_RB_enq_y_pre_def CleanQ_RB2List_def\n using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n \n have final: \"Semantic.xstate.Normal sc \\ CleanQ_RB_enq_y_pre K buf \\ Semantic.xstate.Normal (CleanQ_RB2List sc) \\ CleanQ_List_enq_y_pre K buf\" \n using b_in_sx b_notin_tyx precond unfolding CleanQ_RB2List_def CleanQ_RB_enq_y_pre_def CleanQ_List_enq_y_pre_def\n by (smt CleanQ_List_State.select_convs(2) CleanQ_List_State.select_convs(4) CleanQ_RB2List_def\n CleanQ_RB_Invariants_List_Invariants CleanQ_RB_Invariants_def CollectD CollectI I2_rb_img_def \n Semantic.xstate.inject(1) Set.set_insert disjoint_insert(1) imageE imageI)\n\n show ?thesis using final precond\n by simp\n qed\n show \"Semantic.xstate.case_xstate (\\sc. Semantic.xstate.Normal (CleanQ_RB2List sc)) (\\sc. Abrupt (CleanQ_RB2List sc)) (\\fc. Semantic.xstate.Fault (CleanQ_RB2List fc))\n Semantic.xstate.Stuck ` CleanQ_RB_enq_y_pre K buf \\ CleanQ_List_enq_y_pre K buf\"\n using core_g2 CleanQ_RB_Invariants_List_Invariants unfolding CleanQ_RB_enq_y_pre_def CleanQ_List_enq_y_pre_def\n by (smt CleanQ_List_State.select_convs(2) CleanQ_List_State.select_convs(4) CleanQ_RB2List_def \n CleanQ_RB_Invariants_def CollectD CollectI I2_rb_img_def Semantic.xstate.simps(16) \n disjoint_iff_not_equal image_iff image_subsetI)\n \nqed\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\Dequeue Refinement\\\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\\n We first show some helper lemmas that connect the two preconditions on the Ring buffer\n model and the List model. \n\\\n\nlemma \n refine_hd_list_tl_ring_tyx:\n fixes buf sc\n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_x_pre K buf\"\n shows \"buf = the (ring (rTYX sc) (tail (rTYX sc))) \\ buf = hd (lTYX (CleanQ_RB2List sc))\"\n using precond unfolding CleanQ_RB2List_def \n apply auto\n by (metis (mono_tags, lifting) CleanQ_RB_Invariants_def CleanQ_RB_deq_x_possible_def CleanQ_RB_deq_x_pre_def \n CollectD I4_rb_valid_def imageE prod.sel(1) rb_deq_def rb_deq_list_was_head state_simps(1))\n \n \n \n\nlemma \n refine_hd_list_tl_ring_txy:\n fixes buf sc\n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_y_pre K buf\"\n shows \"buf = the (ring (rTXY sc) (tail (rTXY sc))) \\ buf = hd (lTXY (CleanQ_RB2List sc))\"\n using precond unfolding CleanQ_RB2List_def CleanQ_RB_deq_y_pre_def\n apply auto\n by (metis (no_types) CleanQ_RB_Invariants_def CleanQ_RB_deq_y_possible_def I4_rb_valid_def prod.sel(1) \n rb_deq_def rb_deq_list_was_head)\n \nlemma \n deq_x_rb_pre_implies_list_pre:\n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_x_pre K buf\"\n shows \"CleanQ_RB_Invariants K sc \\ buf = the (ring (rTYX sc) (tail (rTYX sc))) \\ \\ rb_empty (rTYX sc)\n \\ CleanQ_List_Invariants K (CleanQ_RB2List sc) \\ buf = hd (lTYX (CleanQ_RB2List sc)) \\ lTYX (CleanQ_RB2List sc) \\ []\"\nproof -\n have precond_buf: \" buf = hd (lTYX (CleanQ_RB2List sc)) \\ buf = the (ring (rTYX sc) (tail (rTYX sc)))\"\n using refine_hd_list_tl_ring_tyx precond\n by (smt CleanQ_RB_deq_x_pre_def CollectD Semantic.xstate.inject(1) imageE rb_read_tail_def)\n \n have non_empty: \"CleanQ_RB_deq_x_possible sc \\ lTYX (CleanQ_RB2List sc) \\ []\" \n using precond unfolding CleanQ_RB_deq_x_possible_def CleanQ_RB2List_def CleanQ_RB_deq_x_pre_def\n using CleanQ_RB_Invariants_def I4_rb_valid_def rb_deq_not_empty by fastforce\n \n show ?thesis using non_empty precond_buf CleanQ_RB_Invariants_List_Invariants \n using precond non_empty refine_hd_list_tl_ring_tyx precond_buf \n unfolding CleanQ_RB2List_def CleanQ_RB_deq_x_pre_def CleanQ_List_deq_x_pre_def\n by (smt CollectD imageE rb_read_tail_def state_simps(1))\n qed\n\n\nlemma \n deq_y_rb_pre_implies_list_pre:\n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_y_pre K buf\"\n shows \"CleanQ_RB_Invariants K sc \\ buf = the (ring (rTXY sc) (tail (rTXY sc))) \\ \\ rb_empty (rTXY sc) \n \\ CleanQ_List_Invariants K (CleanQ_RB2List sc) \\ buf = hd (lTXY (CleanQ_RB2List sc)) \\ lTXY (CleanQ_RB2List sc) \\ []\"\nproof -\n have precond_buf: \" buf = hd (lTXY (CleanQ_RB2List sc)) \\ buf = the (ring (rTXY sc) (tail (rTXY sc)))\"\n using refine_hd_list_tl_ring_txy precond unfolding CleanQ_RB_deq_y_pre_def\n by (smt CollectD imageE precond rb_read_tail_def refine_hd_list_tl_ring_txy state_simps(1)) \n \n have non_empty: \"CleanQ_RB_deq_y_possible sc \\ lTXY (CleanQ_RB2List sc) \\ []\" \n using precond unfolding CleanQ_RB_deq_y_possible_def\n by (smt CleanQ_List_State.select_convs(3) CleanQ_RB2List_def CleanQ_RB_Invariants_def \n CleanQ_RB_deq_y_pre_def CollectD I4_rb_valid_def image_def rb_deq_not_empty state_simps(1))\n \n show ?thesis using non_empty precond_buf CleanQ_RB_Invariants_List_Invariants \n using precond non_empty refine_hd_list_tl_ring_txy precond_buf \n unfolding CleanQ_RB2List_def CleanQ_RB_deq_y_pre_def CleanQ_List_deq_y_pre_def\n by (smt CollectD imageE rb_read_tail_def state_simps(1)) \n qed\n\ntext \\\n Finally the proofs for the Dequeue refinement.\n\\\n\nlemma\n CleanQ_listRBRefinement_deq_x: \n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_x_pre K buf\" \n shows\n \"((\\a, CleanQ_List_deq_x_pre K buf, Language.Basic (CleanQ_List_deq_x)), \n (\\c, CleanQ_RB_deq_x_pre K buf, Language.Basic (CleanQ_RB_deq_x)))\n \\ refinement_s (separable_lift CleanQ_RB2List CleanQ_RB2List)\"\n apply(rule refinement_s_BasicI) (* Problem applying this after unfolding*)\n unfolding separable_lift_def\nproof auto\n show \"\\sc. Semantic.xstate.Normal sc \\ CleanQ_RB_deq_x_pre K buf \\ CleanQ_RB2List (CleanQ_RB_deq_x sc) = CleanQ_List_deq_x (CleanQ_RB2List sc)\" \n using CleanQ_RB_deq_x_equal\n by (smt CleanQ_RB_deq_x_pre_def CollectD image_def state_simps(1))\nnext\n have core: \"\\x. Semantic.xstate.Normal x \\ CleanQ_RB_deq_x_pre K buf \\ Semantic.xstate.Normal (CleanQ_RB2List x)\n \\ CleanQ_List_deq_x_pre K buf\"\n using deq_x_rb_pre_implies_list_pre precond CleanQ_RB_Invariants_List_Invariants \n unfolding CleanQ_RB_deq_x_pre_def CleanQ_List_deq_x_pre_def CleanQ_RB_deq_x_possible_def\n rb_can_deq_def rb_read_tail_def\n by (smt CleanQ_RB_deq_x_pre_def CollectD CollectI imageE image_eqI rb_can_deq_def rb_read_tail_def state_simps(1))\n \n show \"\\xa. xa \\ CleanQ_RB_deq_x_pre K buf \\\n (case xa of Semantic.xstate.Normal sc \\ Semantic.xstate.Normal (CleanQ_RB2List sc) | Abrupt sc \\ Abrupt (CleanQ_RB2List sc) | Semantic.xstate.Fault fc \\ Semantic.xstate.Fault (CleanQ_RB2List fc)\n | Semantic.xstate.Stuck \\ Semantic.xstate.Stuck)\n \\ CleanQ_List_deq_x_pre K buf\" \n unfolding CleanQ_RB_deq_x_pre_def CleanQ_List_deq_x_pre_def\n apply (auto)\n using core precond unfolding CleanQ_RB_deq_x_pre_def CleanQ_List_deq_x_pre_def\n by auto\n qed\n\n\nlemma\n CleanQ_listRBRefinement_deq_y: \n assumes precond: \"Semantic.xstate.Normal sc \\ CleanQ_RB_deq_y_pre K buf\" \n shows\n \"((\\a, CleanQ_List_deq_y_pre K buf, Language.Basic (CleanQ_List_deq_y)), \n (\\c, CleanQ_RB_deq_y_pre K buf, Language.Basic (CleanQ_RB_deq_y)))\n \\ refinement_s (separable_lift CleanQ_RB2List CleanQ_RB2List)\"\n apply(rule refinement_s_BasicI) (* Problem applying this after unfolding*)\n unfolding separable_lift_def\nproof auto\n show \"\\sc. Semantic.xstate.Normal sc \\ CleanQ_RB_deq_y_pre K buf \\ CleanQ_RB2List (CleanQ_RB_deq_y sc) = CleanQ_List_deq_y (CleanQ_RB2List sc)\" \n using CleanQ_RB_deq_y_equal\n by (smt CleanQ_RB_deq_y_pre_def CollectD image_def state_simps(1))\nnext\n have core: \"\\x. Semantic.xstate.Normal x \\ CleanQ_RB_deq_y_pre K buf \\ Semantic.xstate.Normal (CleanQ_RB2List x)\n \\ CleanQ_List_deq_y_pre K buf\"\n using deq_y_rb_pre_implies_list_pre precond CleanQ_RB_Invariants_List_Invariants \n unfolding CleanQ_RB_deq_y_pre_def CleanQ_List_deq_y_pre_def CleanQ_RB_deq_y_possible_def\n rb_can_deq_def rb_read_tail_def\n by (smt CleanQ_RB_deq_y_pre_def CollectD CollectI imageE image_eqI rb_can_deq_def rb_read_tail_def state_simps(1)) \n\n show \"\\xa. xa \\ CleanQ_RB_deq_y_pre K buf \\\n (case xa of Semantic.xstate.Normal sc \\ Semantic.xstate.Normal (CleanQ_RB2List sc) | Abrupt sc \\ Abrupt (CleanQ_RB2List sc) | Semantic.xstate.Fault fc \\ Semantic.xstate.Fault (CleanQ_RB2List fc)\n | Semantic.xstate.Stuck \\ Semantic.xstate.Stuck)\n \\ CleanQ_List_deq_y_pre K buf\" \n unfolding CleanQ_RB_deq_y_pre_def CleanQ_List_deq_x_pre_def\n apply (auto)\n using core precond unfolding CleanQ_RB_deq_y_pre_def CleanQ_List_deq_y_pre_def\n by auto\nqed\n\nend", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_ListRBRefinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2617384546463628}} {"text": "theory ext_BigStepContinuous\n imports ext_BigStepSimple\nbegin\n\n\nsubsection \\Hoare rules for ODE\\\n\ntext \\Weakest precondition form\\\ntheorem Valid_ode:\n \"Valid\n (\\(a,s) tr. (\\b s \\ Q (a,s) tr) \\\n (\\d p. 0 < d \\ ODEsol ode p d \\ p 0 = s \\ (\\t. 0 \\ t \\ t < d \\ b (p t)) \\ \\b (p d) \\\n Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({}, {})])))\n (Cont ode b)\n Q\"\n unfolding Valid_def\n apply (auto elim!: contE)\n done\n\nsubsection \\Hoare rules for interrupt\\\n\ntext \\Weakest precondition form\\\ntheorem Valid_interrupt:\n assumes \"\\i. i < length cs \\\n case cs ! i of\n (ch[!]e, p2) \\\n (\\Q. \\ {Q} p2 {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. Q (a,s) (tr @ [OutBlock ch (e (a,s))]))) \\\n (P \\\\<^sub>A (\\(a,s) tr. \\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs),\n OutBlock ch (e (a,p d))]))))\n | (ch[?]var, p2) \\\n (\\Q. \\ {Q} p2 {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. \\v. Q (a,s(var := v)) (tr @ [InBlock ch v]))) \\\n (P \\\\<^sub>A (\\(a,s) tr. \\d>0. \\p v. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,(p d)(var := v)) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs),\n InBlock ch v]))))\"\n and \"P \\\\<^sub>A (\\(a,s) tr. \\b s \\ R (a,s) tr)\"\n and \"P \\\\<^sub>A (\\(a,s) tr. (\\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\ \\b (p d) \\\n R (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs)])))\"\n shows \"\\ {P} Interrupt ode b cs {R}\"\nproof -\n have a: \"R s2 (tr1 @ OutBlock ch (e s1) # tr2)\"\n if *: \"P s1 tr1\"\n \"i < length cs\"\n \"cs ! i = (ch[!]e, p2)\"\n \"big_step p2 s1 tr2 s2\" for s1 tr1 s2 i ch e p2 tr2\n proof -\n from assms obtain Q where 1:\n \"\\ {Q} p2 {R}\"\n \"P \\\\<^sub>A (\\(a,s) tr. Q (a,s) (tr @ [OutBlock ch (e (a,s))]))\"\n using *(2,3) by fastforce\n have 2: \"Q s1 (tr1 @ [OutBlock ch (e s1)])\"\n using 1(2) *(1) unfolding entails_def \n by blast\n then show ?thesis\n using *(4) 1(1) unfolding Valid_def by fastforce\n qed\n have b: \"R s2 (tr1 @ WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs) # OutBlock ch (e (a,p d)) # tr2)\"\n if *: \"P (a,p 0) tr1\"\n \"0 < d\"\n \"ODEsol ode p d\"\n \"\\t. 0 \\ t \\ t < d \\ b (p t)\"\n \"i < length cs\"\n \"cs ! i = (ch[!]e, p2)\"\n \"big_step p2 (a,p d) tr2 s2\" for a tr1 s2 d p i ch e p2 tr2\n proof -\n from assms obtain Q where 1:\n \"\\ {Q} p2 {R}\"\n \"P \\\\<^sub>A (\\(a,s) tr. \\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs),\n OutBlock ch (e (a,p d))]))\"\n using *(5,6) by fastforce\n have \"Q (a,p d) (tr1 @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs),\n OutBlock ch (e (a,p d))])\"\n using 1(2) *(1-4) unfolding entails_def by auto\n then show ?thesis\n using *(7) 1(1) unfolding Valid_def by fastforce\n qed\n have c: \"R s2 (tr1 @ InBlock ch v # tr2)\"\n if *: \"P (a1,s1) tr1\"\n \"i < length cs\"\n \"cs ! i = (ch[?]var, p2)\"\n \"big_step p2 (a1,s1(var := v)) tr2 s2\" for a1 s1 tr1 s2 i ch var p2 v tr2\n proof -\n from assms obtain Q where 1:\n \"\\ {Q} p2 {R}\"\n \"P \\\\<^sub>A (\\(a,s) tr. \\v. Q (a,s(var := v)) (tr @ [InBlock ch v]))\"\n using *(2,3) by fastforce\n have 2: \"Q (a1,s1(var := v)) (tr1 @ [InBlock ch v])\"\n using 1(2) *(1) unfolding entails_def by auto\n then show ?thesis\n using *(4) 1(1) unfolding Valid_def by fastforce\n qed\n have d: \"R s2 (tr1 @ WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs) # InBlock ch v # tr2a)\"\n if *: \"P (a,p 0) tr1\"\n \"0 < d\"\n \"ODEsol ode p d\"\n \"\\t. 0 \\ t \\ t < d \\ b (p t)\"\n \"i < length cs\"\n \"cs ! i = (ch[?]var, p2)\"\n \"big_step p2 (a,(p d)(var := v)) tr2a s2\" for a tr1 s2 d p i ch var p2 v tr2a\n proof -\n from assms obtain Q where 1:\n \"\\ {Q} p2 {R}\"\n \"P \\\\<^sub>A (\\(a,s) tr. \\d>0. \\p v. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,(p d)(var := v)) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs),\n InBlock ch v]))\"\n using *(5,6) by fastforce\n have \"Q (a,(p d)(var := v)) (tr1 @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs), InBlock ch v])\"\n using 1(2) *(1-4) unfolding entails_def by auto\n then show ?thesis\n using *(7) 1(1) unfolding Valid_def by fastforce\n qed\n show ?thesis\n unfolding Valid_def\n apply (auto elim!: interruptE)\n using a b c d assms(2-3) unfolding entails_def by auto\nqed\n\ntext \\Simpler versions with one input/output\\\n\ntheorem Valid_interrupt_In:\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\(a,s) tr. (\\v. Q (a,s(var := v)) (tr @ [InBlock ch v])) \\\n (\\d>0. \\p v. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,(p d)(var := v)) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({}, {ch}),\n InBlock ch v])) \\\n (\\b s \\ R (a,s) tr) \\\n (\\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\ \\b (p d) \\\n R (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({}, {ch})]))}\n Interrupt ode b [(ch[?]var, p)]\n {R}\"\n apply (rule Valid_interrupt)\n apply auto apply (rule exI[where x=Q])\n by (auto simp add: assms entails_def)\n\ntheorem Valid_interrupt_Out:\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\(a,s) tr. (Q (a,s) (tr @ [OutBlock ch (e (a,s))])) \\\n (\\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({ch}, {}),\n OutBlock ch (e (a,p d))])) \\\n (\\b s \\ R (a,s) tr) \\\n (\\d>0. \\p. ODEsol ode p d \\ p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\ \\b (p d) \\\n R (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({ch}, {})]))}\n Interrupt ode b [(ch[!]e, p)]\n {R}\"\n apply (rule Valid_interrupt)\n apply auto apply (rule exI[where x=Q])\n by (auto simp add: assms entails_def)\n\n\nsubsection \\Assertions for ODEs\\\n\ntext \\ODE without interrupt\\\ninductive ode_assn :: \"'a ext_state \\ ODE \\ fform \\ 'a ext_state \\ 'a tassn\" (\"ODE\\<^sub>t\") where\n \"\\b s \\ ODE\\<^sub>t (a,s) ode b (a,s) []\"\n| \"0 < d \\ ODEsol ode p d \\ p 0 = s \\ (\\t. 0 \\ t \\ t < d \\ b (p t)) \\ \\b (p d) \\\n ODE\\<^sub>t (a,s) ode b (a,p d) [WaitBlk d (\\\\. EState (a,p \\)) ({}, {})]\"\nthm ode_assn.induct\nlemmas ode_assn_induct = ode_assn.induct[split_format(complete)]\nlemma ode_assn_ext_con:\n\"ODE\\<^sub>t (a, s) ode b (a', s') tr \\ a' = a\"\n apply(induct rule:ode_assn_induct)\n by auto\n\ntext \\ODE interrupted by communication\\\ninductive ode_in_assn :: \"'a ext_state \\ ODE \\ fform \\ 'a ext_state \\ cname \\ var \\ rdy_info \\ 'a tassn\" (\"ODEin\\<^sub>t\") where\n \"ODEin\\<^sub>t (a,s) ode b (a,s(var := v)) ch var rdy [InBlock ch v]\"\n| \"0 < d \\ ODEsol ode p d \\ p 0 = s \\\n \\t. 0 \\ t \\ t < d \\ b (p t) \\\n ODEin\\<^sub>t (a,s) ode b (a,(p d)(var := v)) ch var rdy\n [WaitBlk d (\\\\. EState (a,p \\)) rdy, InBlock ch v]\"\nlemmas ode_in_assn_induct = ode_in_assn.induct[split_format(complete)]\n\n\n\ninductive ode_out_assn :: \"'a ext_state \\ ODE \\ fform \\ 'a ext_state \\ cname \\ 'a ext_exp \\ rdy_info \\ 'a tassn\" (\"ODEout\\<^sub>t\") where\n \"ODEout\\<^sub>t (a,s) ode b (a,s) ch e rdy [OutBlock ch (e (a,s))]\"\n| \"0 < d \\ ODEsol ode p d \\ p 0 = s \\\n \\t. 0 \\ t \\ t < d \\ b (p t) \\\n ODEout\\<^sub>t (a,s) ode b (a,p d) ch e rdy\n [WaitBlk d (\\\\. EState (a,p \\)) rdy, OutBlock ch (e (a,p d))]\"\nlemmas ode_out_assn_induct = ode_out_assn.induct[split_format(complete)]\n\n\ntext \\ODE with interrupt, but reached boundary\\\ninductive ode_rdy_assn :: \"'a ext_state \\ ODE \\ fform \\ 'a ext_state \\ rdy_info \\ 'a tassn\" (\"ODErdy\\<^sub>t\") where\n \"\\b s \\ ODErdy\\<^sub>t (a,s) ode b (a,s) rdy []\"\n| \"0 < d \\ ODEsol ode p d \\ p 0 = s \\\n \\t. 0 \\ t \\ t < d \\ b (p t) \\ \\b (p d) \\\n ODErdy\\<^sub>t (a,s) ode b (a,p d) rdy\n [WaitBlk d (\\\\. EState (a,p \\)) rdy]\"\n\n\nsubsection \\Simpler rules for ODE\\\n\ntheorem Valid_ode':\n \"\\ {\\(a,s) tr. \\s'. (ODE\\<^sub>t (a,s) ode b (a,s') @- Q (a,s')) tr}\n Cont ode b\n {Q}\"\nproof -\n have 1: \"Q (a,s) tr\"\n if \"\\s'. (ODE\\<^sub>t (a,s) ode b (a,s') @- Q (a,s')) tr\" \"\\ b s\" for a s tr\n proof -\n have \"(ODE\\<^sub>t (a,s) ode b (a,s) @- Q (a,s)) tr\"\n using that(1) by auto\n moreover have \"ODE\\<^sub>t (a,s) ode b (a,s) []\"\n using that(2) by (auto intro: ode_assn.intros)\n ultimately show ?thesis\n by (auto simp add: magic_wand_assn_def)\n qed\n have 2: \"Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) ({}, {})])\"\n if \"\\s'. (ODE\\<^sub>t (a,p 0) ode b (a,s') @- Q (a,s')) tr\"\n \"0 < d\" \"ODEsol ode p d\" \"\\t. 0 \\ t \\ t < d \\ b (p t)\" \"\\ b (p d)\" for a p d tr\n proof -\n have \"(ODE\\<^sub>t (a,p 0) ode b (a,p d) @- Q (a,p d)) tr\"\n using that(1) by auto\n moreover have \"ODE\\<^sub>t (a,p 0) ode b (a,p d) [WaitBlk d (\\\\. EState (a,p \\)) ({}, {})]\"\n apply (rule ode_assn.intros)\n using that by auto\n ultimately show ?thesis\n by (auto simp add: magic_wand_assn_def)\n qed\n show ?thesis\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode)\n unfolding entails_def using 1 2 by auto\nqed\n\ntext \\Strongest postcondition rule for ODE\\\ntheorem Valid_ode_sp:\n \"\\ {\\s t. P s t}\n Cont ode b\n {\\s t. \\s'. (P s' @\\<^sub>t ODE\\<^sub>t s' ode b s) t}\"\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode')\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def) \n\ntheorem Valid_ode_sp':\n \"\\ {\\(a,s) t. P (a,s) t}\n Cont ode b\n {\\(a,s) t. \\s'. (P (a,s') @\\<^sub>t ODE\\<^sub>t (a,s') ode b (a,s)) t}\"\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode')\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def) \n\ntext \\Strongest postcondition rule for ODE with fixed initial state\\\ntheorem Valid_ode_sp_st:\n \"\\ {\\s t. s = (a0,s0) \\ Q s t}\n Cont ode b\n {\\s t. (Q (a0,s0) @\\<^sub>t ODE\\<^sub>t (a0,s0) ode b s) t}\"\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode')\n apply (auto simp add: entails_def)\n using entails_mp by (auto simp add: entails_tassn_def)\n\ntheorem Valid_ode_sp_st':\n \"\\ {\\(a,s) t. s = s0 \\ Q (a,s) t}\n Cont ode b\n {\\(a,s) t. (Q (a,s0) @\\<^sub>t ODE\\<^sub>t (a,s0) ode b (a,s)) t}\"\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode')\n apply (auto simp add: entails_def)\n using entails_mp by (auto simp add: entails_tassn_def)\n\n\ntext \\Auxiliary lemma, converting ODE assertion to Wait assertion\n when the ODE can be solved exactly.\n\\\ntheorem Valid_ode_unique_solution_aux:\n assumes\n \"d > 0\" \"ODEsol ode p d\" \"\\t. t \\ 0 \\ t < d \\ b (p t)\"\n \"\\ b (p d)\" \"p 0 = st\"\n \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n \"ODE\\<^sub>t (a,st) ode b (a,st') tr\"\n shows\n \"st' = p d \\ Wait\\<^sub>t d (\\\\. EState (a,p \\)) ({}, {}) tr\"\nproof -\n have \"b st\"\n using assms(1,3,5) by auto\n have main: \"d2 = d \\ p d = p2 d2 \\ (\\\\\\{0..d}. EState (a,p \\)) = (\\\\\\{0..d2}. EState (a,p2 \\)) \\\n Wait\\<^sub>t d (\\s. EState (a,p s)) ({}, {}) [WaitBlk d2 (\\\\. EState (a,p2 \\)) ({}, {})]\"\n if cond: \"0 < d2\"\n \"ODEsol ode p2 d2\"\n \"(\\t. 0 \\ t \\ t < d2 \\ b (p2 t))\"\n \"\\ b (p2 d2)\"\n \"p2 0 = st\" for p2 d2\n proof -\n interpret loc:ll_on_open_it \"{-1<..}\"\n \"\\t v. ODE2Vec ode (vec2state v)\" UNIV 0\n apply standard\n using assms(6) by auto\n have s1: \"((\\t. state2vec (p t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..d} UNIV\"\n using assms(2) using ODEsol_old[OF assms(2)] unfolding ODEsol_def solves_ode_def by auto\n have s2: \"(loc.flow 0 (state2vec st)) t = (\\t. state2vec (p t)) t\" if \"t \\ {0..d}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s1])\n using that by (auto simp add: state2vec_def assms(1,5))\n have s3: \"((\\t. state2vec(p2 t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..d2} UNIV\"\n using cond(2) using ODEsol_old[OF cond(2)] unfolding ODEsol_def solves_ode_def by auto\n have s4: \"loc.flow 0 (state2vec st) t = state2vec (p2 t)\" if \"t\\{0..d2}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s3])\n using cond(1,5) that by auto\n have s5: \"d \\ d2\"\n proof (rule ccontr)\n assume 0: \"\\(d \\ d2)\"\n from 0 have 1: \"(\\t. state2vec (p t)) d2 = (\\t. state2vec (p2 t)) d2\"\n using s2[of d2] s4[of d2] cond(1) by auto\n from 1 have \"p d2 = p2 d2\"\n by (auto simp add: state2vec_def)\n show False\n using \"0\" \\p d2 = p2 d2\\ assms(3) that(1) that(4)\n using less_eq_real_def by auto\n qed\n have s6: \"d2 \\ d\"\n proof (rule ccontr)\n assume 0: \"\\(d2 \\ d)\"\n from 0 have 1: \"(\\t. state2vec (p t)) d = (\\t. state2vec (p2 t)) d\"\n using s2[of d] s4[of d] assms(1) by auto\n from 1 have \"p d = p2 d\"\n by (auto simp add: state2vec_def)\n show False\n using \"0\" \\p d = p2 d\\ assms(1) assms(4) that(3) by auto\n qed\n have s7: \"d = d2\" using s5 s6 by auto\n have s8: \"t\\{0..d} \\ p2 t = p t\" for t\n using s2 s4 s7 by (metis vec_state_map1)\n have s10: \"p d = p2 d\"\n using s8 by (simp add: assms(1) less_eq_real_def)\n have s11: \"WaitBlk d (\\\\. EState (a,p \\)) ({}, {}) = WaitBlk d2 (\\\\. EState (a,p2 \\)) ({}, {})\"\n apply (rule WaitBlk_ext_real) using s7 s8 by auto\n have s12: \"Wait\\<^sub>t d (\\s. EState (a,p s)) ({}, {}) [WaitBlk d2 (\\\\. EState (a,p2 \\)) ({}, {})]\"\n unfolding s11[symmetric]\n apply (rule wait_assn.intros)\n using assms(1) by auto\n show ?thesis using s7 s8 s10 s12 by auto\n qed\n show ?thesis\n using assms(7) apply (auto simp add: ode_assn.simps)\n subgoal using \\b st\\ by auto\n subgoal using \\b st\\ by auto\n subgoal for d1 p1\n using main[of d1 p1] by auto\n subgoal for d1 p1\n using main[of d1 p1] by auto\n done\nqed\n\n\n\ntext \\Strongest postcondition rule for ODE when the ODE can be solved exactly\\\ntheorem Valid_ode_unique_solution_sp:\n assumes \"\\s. b s \\ d s > 0 \\ ODEsol ode (p s) (d s) \\\n (\\t. t \\ 0 \\ t < d s \\ b (p s t)) \\\n \\b (p s (d s)) \\ p s 0 = s\"\n and \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n shows \"\\\n {\\(a,s) t. P (a,s) t}\n Cont ode b\n {\\(a,s) t. \\s'. if b s' then (\\(s = p s' (d s')) \\\\<^sub>t P (a,s') @\\<^sub>t Wait\\<^sub>t (d s') (\\\\. EState (a,p s' \\)) ({}, {})) t\n else (\\(s = s') \\\\<^sub>t P (a,s')) t}\"\nproof -\n have a: \"s' = p s (d s) \\ Wait\\<^sub>t (d s) (\\\\. EState (a,p s \\)) ({}, {}) tr2\"\n if \"ODE\\<^sub>t (a,s) ode b (a,s') tr2\" \"b s\" for a s s' tr2\n proof -\n have a1: \"d s > 0\" \"ODEsol ode (p s) (d s)\" \"\\t. 0 \\ t \\ t < d s \\ b (p s t)\"\n \"\\b (p s (d s))\" \"p s 0 = s\"\n using assms(1) that(2) by auto\n show ?thesis\n using Valid_ode_unique_solution_aux[OF a1(1-2) _ a1(4-5) assms(2) that(1)] a1(3)\n by auto\n qed\n have b: \"ODE\\<^sub>t (a,s) ode b (a,s') tr2 \\ \\b s \\ s = s' \\ tr2 = []\" for a s s' tr2\n apply (induct rule: ode_assn_induct) by auto\n show ?thesis\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode')\n apply (auto simp add: entails_def magic_wand_assn_def)\n subgoal for a s tr1 s' tr2\n apply (rule exI[where x=s])\n apply (auto simp add: join_assn_def conj_assn_def pure_assn_def)\n apply (auto simp add: a)\n using b apply metis\n using b by fastforce\n done\nqed\n\ntext \\Strongest postcondition rule for ODE when the ODE can be solved exactly,\n for fixed initial state.\n\\\ntheorem Valid_ode_unique_solution_st:\n assumes\n \"d > 0\" \"ODEsol ode p d\" \"\\t. t \\ 0 \\ t < d \\ b (p t)\"\n \"\\ b (p d)\" \"p 0 = st\"\n \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n shows \"\\\n {\\s tr. s = (a,st) \\ Q s tr}\n Cont ode b\n {\\s tr. s = (a,p d) \\ (Q (a,st) @\\<^sub>t Wait\\<^sub>t d (\\\\. EState (a,p \\)) ({}, {})) tr}\"\nproof -\n have \"b st\"\n using assms(1,3,5) by auto\n have *: \"ODE\\<^sub>t (a,st) ode b (a,s) tr2 \\ s = p d \\ Wait\\<^sub>t d (\\s. EState (a,p s)) ({}, {}) tr2\" for s tr2\n using Valid_ode_unique_solution_aux[OF assms(1-6)] by metis\n show ?thesis\n apply (rule Valid_strengthen_post)\n prefer 2 apply (rule Valid_ode_sp_st)\n apply (auto simp add: \\b st\\ entails_def join_assn_def * ode_assn_ext_con)\n subgoal for a' s' tr1 tr2\n using * ode_assn_ext_con by metis\n using * ode_assn_ext_con by metis\nqed\n\ntext \\Case where the initial state does not satisfy domain\\\ntheorem Valid_ode_exit_st:\n assumes \"\\ b st\"\n shows \"\\\n {\\s tr. s = (a,st) \\ Q tr}\n Cont ode b\n {\\s tr. s = (a,st) \\ Q tr}\"\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule Valid_ode)\n using assms by (auto simp add: entails_def)\n\nsubsection \\Simpler rules for interrupt\\\n\ntheorem Valid_interrupt':\n assumes \"\\i. i < length cs \\\n case cs ! i of\n (ch[!]e, p2) \\\n (\\Q. \\ {Q} p2 {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. \\s'. (ODEout\\<^sub>t (a,s) ode b (a,s') ch e (rdy_of_echoice cs) @- Q (a,s')) tr)))\n | (ch[?]var, p2) \\\n (\\Q. \\ {Q} p2 {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. \\s'. (ODEin\\<^sub>t (a,s) ode b (a,s') ch var (rdy_of_echoice cs) @- Q (a,s')) tr)))\"\n and \"P \\\\<^sub>A (\\(a,s) tr. \\s'. (ODErdy\\<^sub>t (a,s) ode b (a,s') (rdy_of_echoice cs) @- R (a,s')) tr)\"\n shows \"\\ {P} Interrupt ode b cs {R}\"\nproof -\n have 1: \"\\Q. \\ {Q} p {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. Q (a,s) (tr @ [OutBlock ch (e (a,s))]))) \\\n (P \\\\<^sub>A\n (\\(a,s) tr.\n \\d>0. \\p. ODEsol ode p d \\\n p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n Q (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs), OutBlock ch (e (a,p d))])))\"\n if *: \"i < length cs\" \"cs ! i = (ch[!]e, p)\" for i ch e p\n proof -\n from assms(1) obtain Q where\n Q: \"\\ {Q} p {R} \\ (P \\\\<^sub>A (\\(a,s) tr. \\s'. (ODEout\\<^sub>t (a,s) ode b (a,s') ch e (rdy_of_echoice cs) @- Q (a,s')) tr))\"\n using * by fastforce\n show ?thesis\n apply (rule exI[where x=Q])\n using Q ode_out_assn.intros apply (auto simp add: entails_def magic_wand_assn_def)\n apply (simp add: ode_out_assn.intros(1))\n apply (simp add: ode_out_assn.intros(2))\n done\n qed\n have 2: \"\\Q. \\ {Q} p {R} \\\n (P \\\\<^sub>A (\\(a,s) tr. \\v. Q (a,s(var := v)) (tr @ [InBlock ch v]))) \\\n (P \\\\<^sub>A\n (\\(a,s) tr.\n \\d>0. \\p. ODEsol ode p d \\\n p 0 = s \\\n (\\t. 0 \\ t \\ t < d \\ b (p t)) \\\n (\\v. Q (a,(p d)(var := v)) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs), InBlock ch v]))))\"\n if *: \"i < length cs\" \"cs ! i = (ch[?]var, p)\" for i ch var p\n proof -\n from assms(1) obtain Q where\n Q: \"\\ {Q} p {R} \\ (P \\\\<^sub>A (\\(a,s) tr. \\s'. (ODEin\\<^sub>t (a,s) ode b (a,s') ch var (rdy_of_echoice cs) @- Q (a,s')) tr))\"\n using * by fastforce\n show ?thesis\n apply (rule exI[where x=Q])\n using Q ode_in_assn.intros apply (auto simp add: entails_def magic_wand_assn_def)\n apply (simp add: ode_in_assn.intros(1))\n apply (simp add: ode_in_assn.intros(2))\n done\n qed\n have 3: \"R (a,s) tr\"\n if \"\\s'. (ODErdy\\<^sub>t (a,s) ode b (a,s') (rdy_of_echoice cs) @- R (a,s')) tr\" \"\\ b s\" for a s tr\n proof -\n have \"(ODErdy\\<^sub>t (a,s) ode b (a,s) (rdy_of_echoice cs) @- R (a,s)) tr\"\n using that(1) by auto\n moreover have \"ODErdy\\<^sub>t (a,s) ode b (a,s) (rdy_of_echoice cs) []\"\n using that(2) by (auto intro: ode_rdy_assn.intros)\n ultimately show ?thesis\n by (auto simp add: magic_wand_assn_def)\n qed\n have 4: \"R (a,p d) (tr @ [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs)])\"\n if \"\\s'. (ODErdy\\<^sub>t (a,p 0) ode b (a,s') (rdy_of_echoice cs) @- R (a,s')) tr\"\n \"0 < d\" \"ODEsol ode p d\"\n \"\\t. 0 \\ t \\ t < d \\ b (p t)\" \"\\ b (p d)\" for a p d tr\n proof -\n have \"(ODErdy\\<^sub>t (a,p 0) ode b (a,p d) (rdy_of_echoice cs) @- R (a,p d)) tr\"\n using that(1) by auto\n moreover have \"ODErdy\\<^sub>t (a,p 0) ode b (a,p d) (rdy_of_echoice cs) [WaitBlk d (\\\\. EState (a,p \\)) (rdy_of_echoice cs)]\"\n apply (rule ode_rdy_assn.intros)\n using that by auto\n ultimately show ?thesis\n by (auto simp add: magic_wand_assn_def)\n qed\n show ?thesis\n apply (rule Valid_interrupt)\n subgoal for i apply (cases \"cs ! i\")\n subgoal for ch p apply (cases ch)\n using 1 2 by auto\n done\n subgoal apply (rule entails_trans[OF assms(2)])\n by (auto simp add: entails_def 3)\n subgoal apply (rule entails_trans[OF assms(2)])\n by(auto simp add: 4 entails_def)\n done\nqed\n\ntheorem Valid_interrupt_In':\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\(a,s) tr. (\\s'. (ODEin\\<^sub>t (a,s) ode b (a,s') ch var ({}, {ch}) @- Q (a,s')) tr) \\\n (\\s'. (ODErdy\\<^sub>t (a,s) ode b (a,s') ({}, {ch}) @- R (a,s')) tr)}\n Interrupt ode b [(ch[?]var, p)]\n {R}\"\n apply (rule Valid_interrupt')\n using assms by (auto simp add: entails_def)\n\n\ntheorem Valid_interrupt_In'':\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\s tr. (\\s'. (ODEin\\<^sub>t s ode b s' ch var ({}, {ch}) @- Q s') tr) \\\n (\\s'. (ODErdy\\<^sub>t s ode b s' ({}, {ch}) @- R s') tr)}\n Interrupt ode b [(ch[?]var, p)]\n {R}\"\n apply (rule Valid_interrupt')\n using assms by (auto simp add: entails_def)\n\ntheorem Valid_interrupt_Out':\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\(a,s) tr. (\\s'. (ODEout\\<^sub>t (a,s) ode b (a,s') ch e ({ch}, {}) @- Q (a,s')) tr) \\\n (\\s'. (ODErdy\\<^sub>t (a,s) ode b (a,s') ({ch}, {}) @- R (a,s')) tr)}\n Interrupt ode b [(ch[!]e, p)]\n {R}\"\n apply (rule Valid_interrupt')\n using assms by (auto simp add: entails_def)\n\ntheorem Valid_interrupt_Out'':\n assumes \"\\ {Q} p {R}\"\n shows \"\\\n {\\s tr. (\\s'. (ODEout\\<^sub>t s ode b s' ch e ({ch}, {}) @- Q s') tr) \\\n (\\s'. (ODErdy\\<^sub>t s ode b s' ({ch}, {}) @- R s') tr)}\n Interrupt ode b [(ch[!]e, p)]\n {R}\"\n apply (rule Valid_interrupt')\n using assms by (auto simp add: entails_def)\n\ntheorem Valid_interrupt_sp:\n assumes \"\\i. i < length cs \\\n case cs ! i of\n (ch[!]e, p2) \\\n \\ {\\s tr. (P st @\\<^sub>t ODEout\\<^sub>t st ode b s ch e (rdy_of_echoice cs)) tr} p2 {Q}\n | (ch[?]var, p2) \\\n \\ {\\s tr. (P st @\\<^sub>t ODEin\\<^sub>t st ode b s ch var (rdy_of_echoice cs)) tr} p2 {Q}\"\n assumes \"(\\s tr. (P st @\\<^sub>t (ODErdy\\<^sub>t st ode b s (rdy_of_echoice cs))) tr) \\\\<^sub>A Q\"\n shows \"\\\n {\\s tr. s = st \\ P s tr}\n Interrupt ode b cs\n {Q}\"\n apply (rule Valid_interrupt')\n subgoal for i\n apply (cases \"cs ! i\") apply auto\n subgoal for comm p2\n apply (cases comm)\n subgoal for ch e\n apply auto\n apply (rule exI[where x=\"\\s tr. (P st @\\<^sub>t ODEout\\<^sub>t st ode b s ch e (rdy_of_echoice cs)) tr\"])\n using assms(1)[of i]\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def)\n subgoal for ch var\n apply auto\n apply (rule exI[where x=\"\\s tr. (P st @\\<^sub>t ODEin\\<^sub>t st ode b s ch var (rdy_of_echoice cs)) tr\"])\n using assms(1)[of i]\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def)\n done\n done\n using assms(2) apply (auto simp add: entails_def magic_wand_assn_def)\n using join_assn_def by metis\n\n\ntheorem Valid_interrupt_sp':\n assumes \"\\i. i < length cs \\\n case cs ! i of\n (ch[!]e, p2) \\\n \\ {\\(a,s) tr. (P (a,st) @\\<^sub>t ODEout\\<^sub>t (a,st) ode b (a,s) ch e (rdy_of_echoice cs)) tr} p2 {Q}\n | (ch[?]var, p2) \\\n \\ {\\(a,s) tr. (P (a,st) @\\<^sub>t ODEin\\<^sub>t (a,st) ode b (a,s) ch var (rdy_of_echoice cs)) tr} p2 {Q}\"\n assumes \"(\\(a,s) tr. (P (a,st) @\\<^sub>t (ODErdy\\<^sub>t (a,st) ode b (a,s) (rdy_of_echoice cs))) tr) \\\\<^sub>A Q\"\n shows \"\\\n {\\(a,s) tr. s = st \\ P (a,s) tr}\n Interrupt ode b cs\n {Q}\"\n apply (rule Valid_interrupt')\n subgoal for i\n apply (cases \"cs ! i\") apply auto\n subgoal for comm p2\n apply (cases comm)\n subgoal for ch e\n apply auto\n apply (rule exI[where x=\"\\(a,s) tr. (P (a,st) @\\<^sub>t ODEout\\<^sub>t (a,st) ode b (a,s) ch e (rdy_of_echoice cs)) tr\"])\n using assms(1)[of i]\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def)\n subgoal for ch var\n apply auto\n apply (rule exI[where x=\"\\(a,s)tr. (P (a,st) @\\<^sub>t ODEin\\<^sub>t (a,st) ode b (a,s) ch var (rdy_of_echoice cs)) tr\"])\n using assms(1)[of i]\n by (auto simp add: entails_def magic_wand_assn_def join_assn_def)\n done\n done\n using assms(2) apply (auto simp add: entails_def magic_wand_assn_def)\n using join_assn_def by metis\n\ntheorem Valid_interrupt_In_sp:\n assumes \"\\ {\\s tr. (P st @\\<^sub>t ODEin\\<^sub>t st ode b s ch var ({}, {ch})) tr} p {Q}\"\n shows \"\\\n {\\s tr. s = st \\ P s tr}\n Interrupt ode b [(ch[?]var, p)]\n {\\s tr. Q s tr \\ (P st @\\<^sub>t (ODErdy\\<^sub>t st ode b s ({}, {ch}))) tr}\"\n apply (rule Valid_interrupt_sp)\n using assms by (auto simp add: Valid_def entails_def)\n\ntheorem Valid_interrupt_In_sp':\n assumes \"\\ {\\(a,s) tr. (P (a,st) @\\<^sub>t ODEin\\<^sub>t (a,st) ode b (a,s) ch var ({}, {ch})) tr} p {Q}\"\n shows \"\\\n {\\(a,s) tr. s = st \\ P (a,s) tr}\n Interrupt ode b [(ch[?]var, p)]\n {\\(a,s) tr. Q (a,s) tr \\ (P (a,st) @\\<^sub>t (ODErdy\\<^sub>t (a,st) ode b (a,s) ({}, {ch}))) tr}\"\n apply (rule Valid_interrupt_sp')\n using assms by (auto simp add: Valid_def entails_def)\n\ntheorem Valid_interrupt_Out_sp:\n assumes \"\\ {\\s tr. (P st @\\<^sub>t ODEout\\<^sub>t st ode b s ch e ({ch}, {})) tr} p {Q}\"\n shows \"\\\n {\\s tr. s = st \\ P s tr}\n Interrupt ode b [(ch[!]e, p)]\n {\\s tr. Q s tr \\ (P st @\\<^sub>t (ODErdy\\<^sub>t st ode b s ({ch}, {}))) tr}\"\n apply (rule Valid_interrupt_sp)\n using assms by (auto simp add: Valid_def entails_def)\n\ntheorem Valid_interrupt_Out_sp':\n assumes \"\\ {\\(a,s) tr. (P (a,st) @\\<^sub>t ODEout\\<^sub>t (a,st) ode b (a,s) ch e ({ch}, {})) tr} p {Q}\"\n shows \"\\\n {\\(a,s) tr. s = st \\ P (a,s) tr}\n Interrupt ode b [(ch[!]e, p)]\n {\\(a,s) tr. Q (a,s) tr \\ (P (a,st) @\\<^sub>t (ODErdy\\<^sub>t (a,st) ode b (a,s) ({ch}, {}))) tr}\"\n apply (rule Valid_interrupt_sp')\n using assms by (auto simp add: Valid_def entails_def)\n\nlemma ODErdy_false:\n \"ODErdy\\<^sub>t st ode b s rdy tr \\ b = (\\_. True) \\ False\"\n apply (induct rule: ode_rdy_assn.induct) by auto\n\ndefinition supp :: \"state \\ var set\" where\n \"supp s = {v. s v \\ 0}\"\n\nfun ode_supp :: \"ODE \\ var set\" where\n \"ode_supp (ODE ode) = {v. ode v \\ (\\_. 0)}\"\n\ntheorem Valid_interrupt_Out_sp2:\n assumes \"\\ {\\(a,s) tr. \\st'. s = st' \\ supp st' \\ VS \\\n (P (a,st) @\\<^sub>t ODEout\\<^sub>t (a,st) (ODE ode) (\\_. True) (a,st') ch e ({ch}, {})) tr} p {Q}\"\n and \"ode_supp (ODE ode) \\ VS\"\n and \"supp st \\ VS\"\n shows \"\\\n {\\(a,s) tr. s = st \\ P (a,s) tr}\n Interrupt (ODE ode) (\\_. True) [(ch[!]e, p)]\n {Q}\"\n apply (rule Valid_strengthen_post)\n prefer 2\n apply (rule Valid_interrupt_Out_sp')\n apply (rule Valid_weaken_pre)\n prefer 2 apply (rule assms)\n apply (auto simp add: entails_def)\n apply (auto simp add: Valid_def entails_def join_assn_def)\n subgoal for a s x tr1 tr2\n subgoal premises pre\n proof(rule ccontr)\n assume cond:\"x \\ VS\"\n have 1:\"ODEout\\<^sub>t (a,st) (ODE ode) (\\_. True) (a,s) ch e ({ch}, {}) tr2 \\ tr2 = [OutBlock ch (e (a,s))] \\ st = s\"\n apply (induct rule: ode_out_assn_induct) by auto\n have 2:\"ODEout\\<^sub>t (a,st) (ODE ode) (\\_. True) (a,s) ch e ({ch}, {}) tr2 \\ tr2 = [OutBlock ch (e (a,s))] \\ False\"\n using 1 pre cond assms(3) unfolding supp_def by auto\n have 3:\"ODEout\\<^sub>t (a,st) (ODE ode) (\\_. True) (a,s) ch e ({ch}, {}) tr2 \\ tr2 \\ [OutBlock ch (e (a,s))] \\\n\\ p d. (0 < (d::real) \\ ODEsol (ODE ode) p d \\ p 0 = st \\\n s = p d \\ tr2 = [WaitBlk d (\\\\. EState (a,p \\)) ({ch}, {}), OutBlock ch (e (a,p d))])\"\n apply (induct rule: ode_out_assn_induct) by auto\n have 4:\"ODEout\\<^sub>t (a,st) (ODE ode) (\\_. True) (a,s) ch e ({ch}, {}) tr2 \\ tr2 \\ [OutBlock ch (e (a,s))] \\False\"\n subgoal premises pre1\n proof-\n obtain p and d where condd:\"0 < (d::real)\"\" ODEsol (ODE ode) p d\"\"p 0 = st\"\" s = p d \"\n using pre1 3 by auto\n have a1:\"p 0 x = 0\" using pre condd cond assms(3) unfolding supp_def by auto\n have a2:\"ode x = (\\_. 0)\"\n using assms(2) cond by auto\n have a3:\"((\\t. p t x) has_vderiv_on (\\t. 0)) {0 .. d}\"\n using ODEsol_old[OF condd(2)]\n using has_vderiv_on_proj[of \"(\\t. state2vec (p t))\" \"(\\t. ODE2Vec (ODE ode) (p t))\" \"{0 .. d}\" x]\n apply auto\n unfolding state2vec_def apply auto\n using a2 by auto\n then have 4:\"p 0 x = p d x\"\n unfolding has_vderiv_on_def has_vector_derivative_def\n using mvt_real_eq[of d \"(\\t. p t x)\" \"\\t. (\\x. x *\\<^sub>R 0)\" d] \n using condd by auto\n then show ?thesis using a1 cond pre condd unfolding supp_def by auto\n qed\n done\n show False using 2 4 pre by auto\n qed\n done\n using ODErdy_false by blast\n\ninductive wait_in_assn :: \"real \\ 'a \\ (real \\ state) \\ cname \\ real \\ rdy_info \\ 'a tassn\" (\"WaitIn\\<^sub>t\") where\n \"WaitIn\\<^sub>t 0 a p ch v rdy [InBlock ch v]\"\n| \"d > 0 \\ WaitIn\\<^sub>t d a p ch v rdy [WaitBlk d (\\\\. EState (a,p \\)) rdy, InBlock ch v]\"\n\n\ninductive wait_out_assn :: \"real \\ 'a \\ (real \\ state) \\ cname \\ 'a ext_exp \\ rdy_info \\ 'a tassn\" (\"WaitOut\\<^sub>t\") where\n \"WaitOut\\<^sub>t 0 a p ch e rdy [OutBlock ch (e (a,p 0))]\"\n| \"d > 0 \\ WaitOut\\<^sub>t d a p ch e rdy [WaitBlk d (\\\\. EState (a,p \\)) rdy, OutBlock ch (e (a,p d))]\"\n\n\ntheorem Valid_ode_out_unique_solution_aux:\n assumes\n \"ODEsolInf ode p\" \"\\t\\0. b (p t)\" \"p 0 = st\"\n \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n \"ODEout\\<^sub>t (a,st) ode b (a,st') ch e rdy tr\"\n shows\n \"\\d. st' = p d \\ WaitOut\\<^sub>t d a p ch e rdy tr\"\nproof -\n have main: \"p2 d = p d \\ (\\\\\\{0..d}. EState (a,p2 \\) = EState (a,p \\))\"\n if cond: \"0 < d\"\n \"ODEsol ode p2 d\"\n \"\\t. 0 \\ t \\ t < d \\ b (p2 t)\"\n \"p2 0 = st\" for d p2\n proof -\n interpret loc:ll_on_open_it \"{-1<..}\"\n \"\\t v. ODE2Vec ode (vec2state v)\" UNIV 0\n apply standard\n using assms(4) by auto\n have s1: \"((\\t. state2vec (p t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..} UNIV\"\n using assms(1) using ODEsolInf_old[OF assms(1)] unfolding ODEsolInf_def solves_ode_def by auto\n have s2: \"(loc.flow 0 (state2vec st)) t = (\\t. state2vec (p t)) t\" if \"t \\ {0..d}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s1])\n using that by (auto simp add: state2vec_def assms(3))\n have s3: \"((\\t. state2vec(p2 t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..d} UNIV\"\n using cond(2) using ODEsol_old[OF cond(2)]unfolding ODEsol_def solves_ode_def by auto\n have s4: \"loc.flow 0 (state2vec st) t = state2vec (p2 t)\" if \"t\\{0..d}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s3])\n using cond that by auto\n have s8: \"t\\{0..d} \\ p2 t = p t\" for t\n using s2 s4 by (metis vec_state_map1)\n have s10: \"p d = p2 d\"\n using s8 that(1) by auto\n show ?thesis using s8 s10 by auto\n qed\n show ?thesis\n using assms(5) apply (elim ode_out_assn.cases)\n apply auto\n apply (rule exI[where x=0])\n subgoal for rdy1 rdy2\n by (auto simp add: assms(3) wait_out_assn.simps)\n subgoal for d p2 rdy1 rdy2\n apply (rule exI[where x=d])\n apply (auto simp add: wait_out_assn.simps)\n using main[of d p2] apply (auto simp: WaitBlk.simps)\n done\n done\nqed\n\n\ntheorem Valid_ode_rdy_unique_solution_aux:\n assumes\n \"ODEsolInf ode p\" \"\\t\\0. b (p t)\" \"p 0 = st\"\n \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n \"ODErdy\\<^sub>t (a,st) ode b (a,st') rdy tr\"\n shows\n \"False\"\nproof -\n have \"b st\"\n using assms(2,3) by auto\n have main: \"False\"\n if cond: \"0 < d1\"\n \"ODEsol ode p1 d1\"\n \"st = p1 0\"\n \"\\t. 0 \\ t \\ t < d1 \\ b (p1 t)\"\n \"\\ b (p1 d1)\" for d1 p1\n proof -\n interpret loc:ll_on_open_it \"{-1<..}\"\n \"\\t v. ODE2Vec ode (vec2state v)\" UNIV 0\n apply standard\n using assms(4) by auto\n have s1: \"((\\t. state2vec (p t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..} UNIV\"\n using assms(1) using ODEsolInf_old[OF assms(1)] unfolding ODEsolInf_def solves_ode_def by auto\n have s2: \"(loc.flow 0 (state2vec st)) t = (\\t. state2vec (p t)) t\" if \"t \\ {0..d1}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s1])\n using that by (auto simp add: state2vec_def assms(3))\n have s3: \"((\\t. state2vec(p1 t)) solves_ode ((\\t v. ODE2Vec ode (vec2state v)))) {0..d1} UNIV\"\n using cond(2) using ODEsol_old[OF cond(2)] unfolding ODEsol_def solves_ode_def by auto\n have s4: \"loc.flow 0 (state2vec st) t = state2vec (p1 t)\" if \"t\\{0..d1}\" for t\n apply (rule loc.maximal_existence_flow(2)[OF s3])\n using cond that by auto\n have s8: \"t\\{0..d1} \\ p1 t = p t\" for t\n using s2 s4 by (metis vec_state_map1)\n have s10: \"p d1 = p1 d1\"\n using s8 that(1) by auto\n show ?thesis using assms(2) cond(1,5) s10\n using less_eq_real_def by auto\n qed \n show ?thesis\n using assms(5) apply (auto simp add: ode_rdy_assn.simps)\n subgoal using \\b st\\ by auto\n subgoal for d1 p1\n using main by auto\n done\nqed\n\ntheorem Valid_ode_out_unique_solution:\n assumes\n \"ODEsolInf ode p\" \"\\t\\0. b (p t)\" \"p 0 = st\"\n \"local_lipschitz {- 1<..} UNIV (\\(t::real) v. ODE2Vec ode (vec2state v))\"\n \"\\ {\\(a,s) tr. \\d. s = p d \\ (P (a,st) @\\<^sub>t WaitOut\\<^sub>t d a p ch e ({ch}, {})) tr} p2 {Q}\"\n shows \"\\\n {\\(a,s) tr. s = st \\ P (a,s) tr}\n Interrupt ode b [(ch[!]e, p2)]\n {Q}\"\nproof -\n have *: \"ODEout\\<^sub>t (a,st) ode b (a,s) ch e ({ch}, {}) tr2 \\\n \\d. s = p d \\ WaitOut\\<^sub>t d a p ch e ({ch}, {}) tr2\" for a s tr2\n using Valid_ode_out_unique_solution_aux[OF assms(1-4)] by auto\n have **: \"ODErdy\\<^sub>t (a,st) ode b (a,s) ({ch}, {}) tr2 \\ False\" for a s tr2\n using Valid_ode_rdy_unique_solution_aux[OF assms(1-4)] by auto\n show ?thesis\n apply (rule Valid_strengthen_post)\n prefer 2 apply (rule Valid_interrupt_Out_sp'[where Q=Q])\n subgoal\n apply (auto simp add: Valid_def join_assn_def)\n apply (drule *)\n using assms(5) apply (auto simp add: Valid_def join_assn_def join_assoc)\n by fastforce\n apply (auto simp add: entails_def join_assn_def)\n using ** by metis\nqed\n\n\n\nend", "meta": {"author": "AgHHL", "repo": "lics2023", "sha": "e2ea9c15a8c0e1bf658679274ee87f30baf4abc3", "save_path": "github-repos/isabelle/AgHHL-lics2023", "path": "github-repos/isabelle/AgHHL-lics2023/lics2023-e2ea9c15a8c0e1bf658679274ee87f30baf4abc3/case2/ext_BigStepContinuous.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165382362517, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2615984807969706}} {"text": "(* The value setup for paper confidentiality *)\ntheory Decision_Value_Setup2\nimports Decision_Value_Setup\nbegin\n\nsection\\Preliminaries\\\n\n(* two papers equal everywhere but w.r.t. the tail of the decision: *)\nfun eqExcD2 :: \"paper \\ paper \\ bool\" where\n\"eqExcD2 (Paper title abstract ct reviews dis decs )\n (Paper title1 abstract1 ct1 reviews1 dis1 decs1) =\n (title = title1 \\ abstract = abstract1 \\ ct = ct1 \\ reviews = reviews1 \\ dis = dis1 \\\n hd decs = hd decs1)\"\n\nlemma eqExcD2:\n\"eqExcD2 pap pap1 =\n (titlePaper pap = titlePaper pap1 \\ abstractPaper pap = abstractPaper pap1 \\\n contentPaper pap = contentPaper pap1 \\\n reviewsPaper pap = reviewsPaper pap1 \\ disPaper pap = disPaper pap1 \\\n hd (decsPaper pap) = hd (decsPaper pap1)\n )\"\nby(cases pap, cases pap1, auto)\n\nlemma eqExcD2_eq[simp,intro!]: \"eqExcD2 pap pap\"\nby(cases pap) auto\n\nlemma eqExcD2_sym:\nassumes \"eqExcD2 pap pap1\"\nshows \"eqExcD2 pap1 pap\"\napply(cases pap, cases pap1)\nusing assms by auto\n\nlemma eqExcD2_trans:\nassumes \"eqExcD2 pap pap1\" and \"eqExcD2 pap1 pap2\"\nshows \"eqExcD2 pap pap2\"\napply(cases pap, cases pap1, cases pap2)\nusing assms by auto\n\n(* Auxiliary notion: *)\ndefinition eeqExcPID2 where\n\"eeqExcPID2 paps paps1 \\\n \\ pid. if pid = PID then eqExcD2 (paps pid) (paps1 pid) else paps pid = paps1 pid\"\n\nlemma eeqExcPID2_eeq[simp,intro!]: \"eeqExcPID2 s s\"\nunfolding eeqExcPID2_def by auto\n\nlemma eeqExcPID2_sym:\nassumes \"eeqExcPID2 s s1\" shows \"eeqExcPID2 s1 s\"\nusing assms eqExcD2_sym unfolding eeqExcPID2_def by auto\n\nlemma eeqExcPID2_trans:\nassumes \"eeqExcPID2 s s1\" and \"eeqExcPID2 s1 s2\" shows \"eeqExcPID2 s s2\"\nusing assms eqExcD2_trans unfolding eeqExcPID2_def by simp blast\n\nlemma eeqExcPID2_imp:\n\"eeqExcPID2 paps paps1 \\ eqExcD2 (paps PID) (paps1 PID)\"\n\"\\eeqExcPID2 paps paps1; pid \\ PID\\ \\ paps pid = paps1 pid\"\nunfolding eeqExcPID2_def by auto\n\nlemma eeqExcPID2_cong:\nassumes \"eeqExcPID2 paps paps1\"\nand \"pid = PID \\ eqExcD2 uu uu1\"\nand \"pid \\ PID \\ uu = uu1\"\nshows \"eeqExcPID2 (paps (pid := uu)) (paps1(pid := uu1))\"\nusing assms unfolding eeqExcPID2_def by auto\n\nlemma eeqExcPID2_RDD:\n\"eeqExcPID2 paps paps1 \\\n titlePaper (paps PID) = titlePaper (paps1 PID) \\\n abstractPaper (paps PID) = abstractPaper (paps1 PID) \\\n contentPaper (paps PID) = contentPaper (paps1 PID) \\\n reviewsPaper (paps PID) = reviewsPaper (paps1 PID) \\\n disPaper (paps PID) = disPaper (paps1 PID) \\\n hd (decsPaper (paps PID)) = hd (decsPaper (paps PID))\"\nusing eeqExcPID2_def unfolding eqExcD2 by auto\n\n(* The notion of two states being equal everywhere but on the tail of the decision of\n the paper associated to a given PID *)\ndefinition eqExcPID2 :: \"state \\ state \\ bool\" where\n\"eqExcPID2 s s1 \\\n confIDs s = confIDs s1 \\ conf s = conf s1 \\\n userIDs s = userIDs s1 \\ pass s = pass s1 \\ user s = user s1 \\ roles s = roles s1 \\\n paperIDs s = paperIDs s1\n \\\n eeqExcPID2 (paper s) (paper s1)\n \\\n pref s = pref s1 \\\n voronkov s = voronkov s1 \\\n news s = news s1 \\ phase s = phase s1\"\n\nlemma eqExcPID2_eq[simp,intro!]: \"eqExcPID2 s s\"\nunfolding eqExcPID2_def by auto\n\nlemma eqExcPID2_sym:\nassumes \"eqExcPID2 s s1\" shows \"eqExcPID2 s1 s\"\nusing assms eeqExcPID2_sym unfolding eqExcPID2_def by auto\n\nlemma eqExcPID2_trans:\nassumes \"eqExcPID2 s s1\" and \"eqExcPID2 s1 s2\" shows \"eqExcPID2 s s2\"\nusing assms eeqExcPID2_trans unfolding eqExcPID2_def by auto\n\n(* Implications from eqExcPID2, including w.r.t. auxiliary operations: *)\nlemma eqExcPID2_imp:\n\"eqExcPID2 s s1 \\\n confIDs s = confIDs s1 \\ conf s = conf s1 \\\n userIDs s = userIDs s1 \\ pass s = pass s1 \\ user s = user s1 \\ roles s = roles s1 \\\n paperIDs s = paperIDs s1\n \\\n eeqExcPID2 (paper s) (paper s1)\n \\\n pref s = pref s1 \\\n voronkov s = voronkov s1 \\\n news s = news s1 \\ phase s = phase s1 \\\n\n getAllPaperIDs s = getAllPaperIDs s1 \\\n isRev s cid uid pid = isRev s1 cid uid pid \\\n getReviewIndex s cid uid pid = getReviewIndex s1 cid uid pid \\\n getRevRole s cid uid pid = getRevRole s1 cid uid pid\"\nunfolding eqExcPID2_def getAllPaperIDs_def\nunfolding isRev_def getReviewIndex_def getRevRole_def by auto\n\nlemma eqExcPID2_imp1:\n\"eqExcPID2 s s1 \\ eqExcD2 (paper s pid) (paper s1 pid)\"\n\"eqExcPID2 s s1 \\ pid \\ PID \\ PID \\ pid \\\n paper s pid = paper s1 pid \\\n getNthReview s pid n = getNthReview s1 pid n\"\nunfolding eqExcPID2_def getNthReview_def eeqExcPID2_def\napply auto\nby (metis eqExcD2_eq)\n\nlemma eqExcPID2_imp2:\nassumes \"eqExcPID2 s s1\" and \"pid \\ PID \\ PID \\ pid\"\nshows \"getReviewersReviews s cid pid = getReviewersReviews s1 cid pid\"\nproof-\n have\n \"(\\uID. if isRev s cid uID pid then [(uID, getNthReview s pid (getReviewIndex s cid uID pid))] else []) =\n (\\uID. if isRev s1 cid uID pid then [(uID, getNthReview s1 pid (getReviewIndex s1 cid uID pid))] else [])\"\n apply(rule ext)\n using assms by (auto simp: eqExcPID2_imp eqExcPID2_imp1)\n thus ?thesis unfolding getReviewersReviews_def using assms by (simp add: eqExcPID2_imp)\nqed\n\nlemma eqExcPID2_RDD:\n\"eqExcPID2 s s1 \\\n titlePaper (paper s PID) = titlePaper (paper s1 PID) \\\n abstractPaper (paper s PID) = abstractPaper (paper s1 PID) \\\n contentPaper (paper s PID) = contentPaper (paper s1 PID) \\\n reviewsPaper (paper s PID) = reviewsPaper (paper s1 PID) \\\n disPaper (paper s PID) = disPaper (paper s1 PID)\"\nusing eqExcPID2_imp eeqExcPID2_RDD by auto\n\nlemma eqExcPID2_cong[simp, intro]:\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\confIDs := uu1\\) (s1 \\confIDs := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\conf := uu1\\) (s1 \\conf := uu2\\)\"\n\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\userIDs := uu1\\) (s1 \\userIDs := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\pass := uu1\\) (s1 \\pass := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\user := uu1\\) (s1 \\user := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\roles := uu1\\) (s1 \\roles := uu2\\)\"\n\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\paperIDs := uu1\\) (s1 \\paperIDs := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ eeqExcPID2 uu1 uu2 \\ eqExcPID2 (s \\paper := uu1\\) (s1 \\paper := uu2\\)\"\n\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\pref := uu1\\) (s1 \\pref := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\voronkov := uu1\\) (s1 \\voronkov := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\news := uu1\\) (s1 \\news := uu2\\)\"\n\"\\ uu1 uu2. eqExcPID2 s s1 \\ uu1 = uu2 \\ eqExcPID2 (s \\phase := uu1\\) (s1 \\phase := uu2\\)\"\nunfolding eqExcPID2_def by auto\n\nlemma eqExcPID2_Paper:\nassumes s's1': \"eqExcPID2 s s1\"\nand \"paper s pid = Paper title abstract content reviews dis decs\"\nand \"paper s1 pid = Paper title1 abstract1 content1 reviews1 dis1 decs1\"\nshows \"title = title1 \\ abstract = abstract1 \\ content = content1 \\ reviews = reviews1 \\\n dis = dis1\"\nusing assms unfolding eqExcPID2_def apply (auto simp: eqExcD2 eeqExcPID2_def)\n by (metis titlePaper.simps abstractPaper.simps contentPaper.simps reviewsPaper.simps\ndisPaper.simps)+\n\n\nsection\\Value Setup\\\n\n(* These hold for eeqExcPID, but not for eeqExcPID2:\nlemma UUact_uuDec_step_eqExcPID2:\nassumes a: \"a = UUact (uuDec cid uid p PID dec)\"\nand \"step s a = (ou,s')\"\nshows \"eqExcPID2 s s'\"\nusing assms unfolding eqExcPID2_def eeqExcPID2_def by (auto simp: uu_defs)\n\nlemma \\_step_eqExcPID2:\nassumes \\: \"\\ (Trans s a ou s')\"\nand s: \"step s a = (ou,s')\"\nshows \"eqExcPID2 s s'\"\nusing \\ UUact_uuDec_step_eqExcPID2[OF _ s] unfolding \\_def2 by blast\n*)\n\n(* major *) lemma eqExcPID2_step:\nassumes s's1': \"eqExcPID2 s s1\"\nand step: \"step s a = (ou,s')\"\nand step1: \"step s1 a = (ou1,s1')\"\nshows \"eqExcPID2 s' s1'\"\nproof -\n note eqs = eqExcPID2_imp[OF s's1']\n note eqs' = eqExcPID2_imp1[OF s's1']\n\n note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID2_def eeqExcPID2_def eqExcD2\n\n show ?thesis\n using s's1' step step1 eqs eqs'\n apply(cases a, simp_all only:)\n subgoal for x1 apply(cases x1)\n apply auto[] apply auto[] apply auto[] apply auto[]\n apply auto[] apply auto[] apply auto[] apply auto[] .\n subgoal for x2 apply(cases x2)\n apply auto[] apply auto[] apply auto[] apply auto[]\n apply auto[] apply auto[] apply auto[] .\n subgoal for x3 apply(cases x3)\n apply auto[] apply auto[] apply auto[] apply auto[] .\n apply auto\n done\nqed\n\nlemma eqExcPID2_step_\\_imp:\nassumes s's1': \"eqExcPID2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand \\: \"\\ (Trans s a ou s')\"\nshows \"\\ (Trans s1 a ou1 s1')\"\nusing assms unfolding \\_def2 by (auto simp add: uu_defs eqExcPID2_imp)\n\nlemma eqExcPID2_step_\\:\nassumes s's1': \"eqExcPID2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nshows \"\\ (Trans s a ou s') = \\ (Trans s1 a ou1 s1')\"\nby (metis eqExcPID2_step_\\_imp eqExcPID2_sym assms)\n\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Decision_Confidentiality/Decision_Value_Setup2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.26159847342666115}} {"text": "section \\Final Instantiation of Algorithms Related to Complementation\\\n\ntheory Complementation_Final\nimports\n \"Complementation_Implement\"\n \"Formula\"\n \"Transition_Systems_and_Automata.NBA_Translate\"\n \"Transition_Systems_and_Automata.NGBA_Algorithms\"\n \"HOL-Library.Multiset\"\nbegin\n\n subsection \\Syntax\\\n\n (* TODO: this syntax has unnecessarily high inner binding strength, requiring extra parentheses\n the regular let syntax correctly uses inner binding strength 0: (\"(2_ =/ _)\" 10) *)\n no_syntax \"_do_let\" :: \"[pttrn, 'a] \\ do_bind\" (\"(2let _ =/ _)\" [1000, 13] 13)\n syntax \"_do_let\" :: \"[pttrn, 'a] \\ do_bind\" (\"(2let _ =/ _)\" 13)\n\n subsection \\Hashcodes on Complement States\\\n\n definition \"hci k \\ uint32_of_nat k * 1103515245 + 12345\"\n definition \"hc \\ \\ (p, q, b). hci p + hci q * 31 + (if b then 1 else 0)\"\n definition \"list_hash xs \\ fold ((XOR) \\ hc) xs 0\"\n\n lemma list_hash_eq:\n assumes \"distinct xs\" \"distinct ys\" \"set xs = set ys\"\n shows \"list_hash xs = list_hash ys\"\n proof -\n have \"mset (remdups xs) = mset (remdups ys)\" using assms(3)\n using set_eq_iff_mset_remdups_eq by blast \n then have \"mset xs = mset ys\" using assms(1, 2) by (simp add: distinct_remdups_id)\n have \"fold ((XOR) \\ hc) xs = fold ((XOR) \\ hc) ys\"\n apply (rule fold_multiset_equiv)\n apply (simp_all add: fun_eq_iff ac_simps)\n using \\mset xs = mset ys\\ .\n then show ?thesis unfolding list_hash_def by simp\n qed\n\n definition state_hash :: \"nat \\ Complementation_Implement.state \\ nat\" where\n \"state_hash n p \\ nat_of_hashcode (list_hash p) mod n\"\n\n lemma state_hash_bounded_hashcode[autoref_ga_rules]: \"is_bounded_hashcode state_rel\n (gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\))) state_hash\"\n proof\n show [param]: \"(gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\)), (=)) \\ state_rel \\ state_rel \\ bool_rel\" by autoref\n show \"state_hash n xs = state_hash n ys\" if \"xs \\ Domain state_rel\" \"ys \\ Domain state_rel\"\n \"gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list))\n (list_map_lookup (=)) (prod_eq (=) (=)) xs ys\" for xs ys n\n proof -\n have 1: \"distinct (map fst xs)\" \"distinct (map fst ys)\"\n using that(1, 2) unfolding list_map_rel_def list_map_invar_def by (auto simp: in_br_conv)\n have 2: \"distinct xs\" \"distinct ys\" using 1 by (auto intro: distinct_mapI)\n have 3: \"(xs, map_of xs) \\ state_rel\" \"(ys, map_of ys) \\ state_rel\"\n using 1 unfolding list_map_rel_def list_map_invar_def by (auto simp: in_br_conv)\n have 4: \"(gen_equals (Gen_Map.gen_ball (foldli \\ list_map_to_list)) (list_map_lookup (=))\n (prod_eq (=) (\\)) xs ys, map_of xs = map_of ys) \\ bool_rel\" using 3 by parametricity\n have 5: \"map_to_set (map_of xs) = map_to_set (map_of ys)\" using that(3) 4 by simp\n have 6: \"set xs = set ys\" using map_to_set_map_of 1 5 by blast\n show \"state_hash n xs = state_hash n ys\" unfolding state_hash_def using list_hash_eq 2 6 by metis\n qed\n show \"state_hash n x < n\" if \"1 < n\" for n x using that unfolding state_hash_def by simp\n qed\n\n subsection \\Complementation\\\n\n schematic_goal complement_impl:\n assumes [simp]: \"finite (NBA.nodes A)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, op_translate (complement_4 A)) \\ ?R\"\n by (autoref_monadic (plain))\n concrete_definition complement_impl uses complement_impl\n\n theorem complement_impl_correct:\n assumes \"finite (NBA.nodes A)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"NBA.language (nbae_nba (nbaei_nbae (complement_impl Ai))) =\n streams (nba.alphabet A) - NBA.language A\"\n using op_translate_language[OF complement_impl.refine[OF assms]]\n using complement_4_correct[OF assms(1)]\n by simp\n\n subsection \\Language Subset\\\n\n definition [simp]: \"op_language_subset A B \\ NBA.language A \\ NBA.language B\"\n\n lemmas [autoref_op_pat] = op_language_subset_def[symmetric]\n\n schematic_goal language_subset_impl:\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }) \\ ?R\"\n\t\tby (autoref_monadic (plain))\n concrete_definition language_subset_impl uses language_subset_impl\n lemma language_subset_impl_refine[autoref_rules]:\n assumes \"SIDE_PRECOND (finite (NBA.nodes A))\"\n assumes \"SIDE_PRECOND (finite (NBA.nodes B))\"\n assumes \"SIDE_PRECOND (nba.alphabet A \\ nba.alphabet B)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(language_subset_impl Ai Bi, (OP op_language_subset :::\n \\Id, nat_rel\\ nbai_nba_rel \\ \\Id, nat_rel\\ nbai_nba_rel \\ bool_rel) $ A $ B) \\ bool_rel\"\n proof -\n have \"(RETURN (language_subset_impl Ai Bi), do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }) \\ \\bool_rel\\ nres_rel\"\n using language_subset_impl.refine assms(2, 4, 5) unfolding autoref_tag_defs by this\n also have \"(do {\n let AB' = intersect' A (complement_4 B);\n ASSERT (finite (NGBA.nodes AB'));\n RETURN (NGBA.language AB' = {})\n }, RETURN (NBA.language A \\ NBA.language B)) \\ \\bool_rel\\ nres_rel\"\n proof refine_vcg\n show \"finite (NGBA.nodes (intersect' A (complement_4 B)))\" using assms(1, 2) by auto\n have 1: \"NBA.language A \\ streams (nba.alphabet B)\"\n using nba.language_alphabet streams_mono2 assms(3) unfolding autoref_tag_defs by blast\n have 2: \"NBA.language (complement_4 B) = streams (nba.alphabet B) - NBA.language B\"\n using complement_4_correct assms(2) by auto\n show \"(NGBA.language (intersect' A (complement_4 B)) = {},\n NBA.language A \\ NBA.language B) \\ bool_rel\" using 1 2 by auto\n qed\n finally show ?thesis using RETURN_nres_relD unfolding nres_rel_comp by force\n qed\n\n subsection \\Language Equality\\\n\n definition [simp]: \"op_language_equal A B \\ NBA.language A = NBA.language B\"\n\n lemmas [autoref_op_pat] = op_language_equal_def[symmetric]\n\n schematic_goal language_equal_impl:\n assumes [simp]: \"finite (NBA.nodes A)\"\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [simp]: \"nba.alphabet A = nba.alphabet B\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, NBA.language A \\ NBA.language B \\ NBA.language B \\ NBA.language A) \\ ?R\"\n by autoref\n concrete_definition language_equal_impl uses language_equal_impl\n lemma language_equal_impl_refine[autoref_rules]:\n assumes \"SIDE_PRECOND (finite (NBA.nodes A))\"\n assumes \"SIDE_PRECOND (finite (NBA.nodes B))\"\n assumes \"SIDE_PRECOND (nba.alphabet A = nba.alphabet B)\"\n assumes \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(language_equal_impl Ai Bi, (OP op_language_equal :::\n \\Id, nat_rel\\ nbai_nba_rel \\ \\Id, nat_rel\\ nbai_nba_rel \\ bool_rel) $ A $ B) \\ bool_rel\"\n using language_equal_impl.refine[OF assms[unfolded autoref_tag_defs]] by auto\n\n schematic_goal product_impl:\n assumes [simp]: \"finite (NBA.nodes B)\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n assumes [autoref_rules]: \"(Bi, B) \\ \\Id, nat_rel\\ nbai_nba_rel\"\n shows \"(?f :: ?'c, do {\n let AB' = intersect A (complement_4 B);\n ASSERT (finite (NBA.nodes AB'));\n op_translate AB'\n }) \\ ?R\"\n\t\tby (autoref_monadic (plain))\n concrete_definition product_impl uses product_impl\n\n (* TODO: possible optimizations:\n - introduce op_map_map operation for maps instead of manually iterating via FOREACH\n - consolidate various binds and maps in expand_map_get_7 *)\n export_code\n Set.empty Set.insert Set.member\n \"Inf :: 'a set set \\ 'a set\" \"Sup :: 'a set set \\ 'a set\" image Pow set\n nat_of_integer integer_of_nat\n Variable Negation Conjunction Disjunction satisfies map_formula\n nbaei alphabetei initialei transitionei acceptingei\n nbae_nba_impl complement_impl language_equal_impl product_impl\n in SML module_name Complementation file_prefix Complementation\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Buchi_Complementation/Complementation_Final.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2615984734266611}} {"text": "(* Title: SatSolverVerification/Decide.thy\n Author: Filip Maric\n Maintainer: Filip Maric \n*)\n\ntheory Decide\nimports AssertLiteral\nbegin\n\n(******************************************************************************)\n(* A P P L Y D E C I D E *)\n(******************************************************************************) \n\nlemma applyDecideEffect:\nassumes \n \"\\ vars(elements (getM state)) \\ Vbl\" and\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\nshows \n \"let literal = selectLiteral state Vbl in \n let state' = applyDecide state Vbl in \n var literal \\ vars (elements (getM state)) \\ \n var literal \\ Vbl \\ \n getM state' = getM state @ [(literal, True)] \\ \n getF state' = getF state\"\nusing assms\nusing selectLiteral_def[of \"Vbl\" \"state\"]\nunfolding applyDecide_def\nusing assertLiteralEffect[of \"state\" \"selectLiteral state Vbl\" \"True\"]\nby (simp add: Let_def)\n\nlemma InvariantConsistentAfterApplyDecide:\nassumes \n \"\\ vars(elements (getM state)) \\ Vbl\" and\n \"InvariantConsistent (getM state)\" and\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\nshows\n \"let state' = applyDecide state Vbl in\n InvariantConsistent (getM state')\"\nusing assms\nusing applyDecideEffect[of \"Vbl\" \"state\"]\nusing InvariantConsistentAfterDecide[of \"getM state\" \"selectLiteral state Vbl\" \"getM (applyDecide state Vbl)\"]\nby (simp add: Let_def)\n\n\nlemma InvariantUniqAfterApplyDecide:\nassumes \n \"\\ vars(elements (getM state)) \\ Vbl\" and\n \"InvariantUniq (getM state)\" and\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\nshows\n \"let state' = applyDecide state Vbl in\n InvariantUniq (getM state')\"\nusing assms\nusing applyDecideEffect[of \"Vbl\" \"state\"]\nusing InvariantUniqAfterDecide[of \"getM state\" \"selectLiteral state Vbl\" \"getM (applyDecide state Vbl)\"]\nby (simp add: Let_def)\n\nlemma InvariantQCharacterizationAfterApplyDecide:\nassumes \n \"\\ vars(elements (getM state)) \\ Vbl\" and\n\n \"InvariantConsistent (getM state)\" and\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n \"InvariantWatchListsUniq (getWatchList state)\"\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n\n \"getQ state = []\"\nshows\n \"let state' = applyDecide state Vbl in\n InvariantQCharacterization (getConflictFlag state') (getQ state') (getF state') (getM state')\"\nproof-\n let ?state' = \"applyDecide state Vbl\"\n let ?literal = \"selectLiteral state Vbl\"\n have \"getM ?state' = getM state @ [(?literal, True)]\"\n using assms\n using applyDecideEffect[of \"Vbl\" \"state\"]\n by (simp add: Let_def)\n hence \"InvariantConsistent (getM state @ [(?literal, True)])\"\n using InvariantConsistentAfterApplyDecide[of \"Vbl\" \"state\"]\n using assms\n by (simp add: Let_def)\n thus ?thesis\n using assms\n using InvariantQCharacterizationAfterAssertLiteralNotInQ[of \"state\" \"?literal\" \"True\"]\n unfolding applyDecide_def\n by simp\nqed\n\nlemma InvariantEquivalentZLAfterApplyDecide:\nassumes\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantEquivalentZL (getF state) (getM state) F0\"\nshows\n \"let state' = applyDecide state Vbl in\n InvariantEquivalentZL (getF state') (getM state') F0\"\nproof-\n let ?state' = \"applyDecide state Vbl\"\n let ?l = \"selectLiteral state Vbl\"\n\n have \"getM ?state' = getM state @ [(?l, True)]\"\n \"getF ?state' = getF state\"\n unfolding applyDecide_def\n using assertLiteralEffect[of \"state\" \"?l\" \"True\"]\n using assms\n by (auto simp only: Let_def)\n have \"prefixToLevel 0 (getM ?state') = prefixToLevel 0 (getM state)\"\n proof (cases \"currentLevel (getM state) > 0\")\n case True\n thus ?thesis\n using prefixToLevelAppend[of \"0\" \"getM state\" \"[(?l, True)]\"]\n using \\getM ?state' = getM state @ [(?l, True)]\\\n by auto\n next\n case False\n hence \"prefixToLevel 0 (getM state @ [(?l, True)]) = \n getM state @ (prefixToLevel_aux [(?l, True)] 0 (currentLevel (getM state)))\"\n using prefixToLevelAppend[of \"0\" \"getM state\" \"[(?l, True)]\"]\n by simp\n hence \"prefixToLevel 0 (getM state @ [(?l, True)]) = getM state\"\n by simp\n thus ?thesis\n using \\getM ?state' = getM state @ [(?l, True)]\\\n using currentLevelZeroTrailEqualsItsPrefixToLevelZero[of \"getM state\"]\n using False\n by simp\n qed\n thus ?thesis\n using \\InvariantEquivalentZL (getF state) (getM state) F0\\\n unfolding InvariantEquivalentZL_def\n using \\getF ?state' = getF state\\\n by simp\nqed\n\n\nlemma InvariantGetReasonIsReasonAfterApplyDecide:\nassumes\n \"\\ vars (elements (getM state)) \\ Vbl\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\" and\n \"InvariantWatchListsUniq (getWatchList state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\"\n \"getQ state = []\"\nshows\n \"let state' = applyDecide state Vbl in \n InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state'))\"\nproof-\n let ?l = \"selectLiteral state Vbl\"\n let ?stateM = \"state \\ getM := getM state @ [(?l, True)] \\\"\n have \"InvariantGetReasonIsReason (getReason ?stateM) (getF ?stateM) (getM ?stateM) (set (getQ ?stateM))\"\n proof-\n {\n fix l::Literal\n assume *: \"l el (elements (getM ?stateM))\" \"\\ l el (decisions (getM ?stateM))\" \"elementLevel l (getM ?stateM) > 0\"\n have \"\\ reason. getReason ?stateM l = Some reason \\\n 0 \\ reason \\ reason < length (getF ?stateM) \\\n isReason (getF ?stateM ! reason) l (elements (getM ?stateM))\"\n proof (cases \"l el (elements (getM state))\")\n case True\n moreover\n hence \"\\ l el (decisions (getM state))\"\n using *\n by (simp add: markedElementsAppend)\n moreover\n have \"elementLevel l (getM state) > 0\"\n proof-\n {\n assume \"\\ ?thesis\"\n with *\n have \"l = ?l\"\n using True\n using elementLevelAppend[of \"l\" \"getM state\" \"[(?l, True)]\"]\n by simp\n hence \"var ?l \\ vars (elements (getM state))\"\n using True\n using valuationContainsItsLiteralsVariable[of \"l\" \"elements (getM state)\"]\n by simp\n hence False\n using \\\\ vars (elements (getM state)) \\ Vbl\\\n using selectLiteral_def[of \"Vbl\" \"state\"]\n by auto\n } thus ?thesis\n by auto\n qed\n ultimately\n obtain reason\n where \"getReason state l = Some reason \\\n 0 \\ reason \\ reason < length (getF state) \\\n isReason (getF state ! reason) l (elements (getM state))\"\n using \\InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\\\n unfolding InvariantGetReasonIsReason_def\n by auto\n thus ?thesis\n using isReasonAppend[of \"nth (getF ?stateM) reason\" \"l\" \"elements (getM state)\" \"[?l]\"]\n by auto\n next\n case False\n hence \"l = ?l\"\n using *\n by auto\n hence \"l el (decisions (getM ?stateM))\"\n using markedElementIsMarkedTrue[of \"l\" \"getM ?stateM\"]\n by auto\n with *\n have False\n by auto\n thus ?thesis\n by simp\n qed\n }\n thus ?thesis\n using \\getQ state = []\\\n unfolding InvariantGetReasonIsReason_def\n by auto\n qed\n thus ?thesis\n using assms\n using InvariantGetReasonIsReasonAfterNotifyWatches[of \"?stateM\" \"getWatchList ?stateM (opposite ?l)\"\n \"opposite ?l\" \"getM state\" \"True\" \"{}\" \"[]\"]\n unfolding applyDecide_def\n unfolding assertLiteral_def\n unfolding notifyWatches_def\n unfolding InvariantWatchListsCharacterization_def\n unfolding InvariantWatchListsContainOnlyClausesFromF_def\n unfolding InvariantWatchListsUniq_def\n using \\getQ state = []\\\n by (simp add: Let_def)\nqed\n\nlemma InvariantsVarsAfterApplyDecide:\nassumes\n \"\\ vars (elements (getM state)) \\ Vbl\"\n \"InvariantConsistent (getM state)\"\n \"InvariantUniq (getM state)\"\n \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n \"InvariantWatchListsUniq (getWatchList state)\"\n \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n\n \"InvariantVarsM (getM state) F0 Vbl\"\n \"InvariantVarsF (getF state) F0 Vbl\"\n \"getQ state = []\"\nshows\n \"let state' = applyDecide state Vbl in \n InvariantVarsM (getM state') F0 Vbl \\ \n InvariantVarsF (getF state') F0 Vbl \\ \n InvariantVarsQ (getQ state') F0 Vbl\"\nproof-\n let ?state' = \"applyDecide state Vbl\"\n let ?l = \"selectLiteral state Vbl\"\n\n have \"InvariantVarsM (getM ?state') F0 Vbl\" \"InvariantVarsF (getF ?state') F0 Vbl\"\n using assms\n using applyDecideEffect[of \"Vbl\" \"state\"]\n using varsAppendValuation[of \"elements (getM state)\" \"[?l]\"]\n unfolding InvariantVarsM_def\n by (auto simp add: Let_def)\n moreover\n have \"InvariantVarsQ (getQ ?state') F0 Vbl\"\n using InvariantVarsQAfterAssertLiteral[of \"state\" \"?l\" \"True\" \"F0\" \"Vbl\"]\n using assms\n using InvariantConsistentAfterApplyDecide[of \"Vbl\" \"state\"]\n using InvariantUniqAfterApplyDecide[of \"Vbl\" \"state\"]\n using assertLiteralEffect[of \"state\" \"?l\" \"True\"]\n unfolding applyDecide_def\n unfolding InvariantVarsQ_def\n by (simp add: Let_def)\n ultimately\n show ?thesis\n by (simp add: Let_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SATSolverVerification/Decide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2615984734266611}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory PackedTypes\nimports \"../lib/WordSetup\" CProof\nbegin\n\nsection {* Underlying definitions for the class axioms *}\n\ntext {* field_access / field_update is the identity for packed types *}\n\ndefinition\n \"fa_fu_idem fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd (field_update fd bs v) bs' = bs\"\n\n(* Is it better to do this or to use a fold over td? This seems easier to use *)\nprimrec\n td_fafu_idem :: \"'a field_desc typ_desc \\ bool\" and\n td_fafu_idem_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fafu_idem_list :: \" ('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fafu_idem_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fai0: \"td_fafu_idem (TypDesc ts n) = td_fafu_idem_struct ts\"\n\n| fai1: \"td_fafu_idem_struct (TypScalar n algn d) = fa_fu_idem d n\"\n| fai2: \"td_fafu_idem_struct (TypAggregate ts) = td_fafu_idem_list ts\"\n\n| fai3: \"td_fafu_idem_list [] = True\"\n| fai4: \"td_fafu_idem_list (x#xs) = (td_fafu_idem_pair x \\ td_fafu_idem_list xs)\"\n\n| fai5: \"td_fafu_idem_pair (DTPair x n) = td_fafu_idem x\"\n\nlemmas td_fafu_idem_simps = fai0 fai1 fai2 fai3 fai4 fai5\n\ntext {* field_access is independent of the underlying bytes *}\n\ndefinition\n \"fa_heap_indep fd n \\\n \\bs bs' v. length bs = n \\ length bs' = n \\ field_access fd v bs = field_access fd v bs'\"\n\n\nprimrec\n td_fa_hi :: \"'a field_desc typ_desc \\ bool\" and\n td_fa_hi_struct :: \"'a field_desc typ_struct \\ bool\" and\n td_fa_hi_list :: \"('a field_desc typ_desc, char list) dt_pair list \\ bool\" and\n td_fa_hi_pair :: \"('a field_desc typ_desc, char list) dt_pair \\ bool\"\nwhere\n fahi0: \"td_fa_hi (TypDesc ts n) = td_fa_hi_struct ts\"\n\n| fahi1: \"td_fa_hi_struct (TypScalar n algn d) = fa_heap_indep d n\"\n| fahi2: \"td_fa_hi_struct (TypAggregate ts) = td_fa_hi_list ts\"\n\n| fahi3: \"td_fa_hi_list [] = True\"\n| fahi4: \"td_fa_hi_list (x#xs) = (td_fa_hi_pair x \\ td_fa_hi_list xs)\"\n\n| fahi5: \"td_fa_hi_pair (DTPair x n) = td_fa_hi x\"\n\nlemmas td_fa_hi_simps = fahi0 fahi1 fahi2 fahi3 fahi4 fahi5\n\nsection {* Lemmas about td_fafu_idem *}\n\nlemma field_lookup_td_fafu_idem:\n shows \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup t f m = Some (s, n); td_fafu_idem t \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_struct st f m = Some (s, n); td_fafu_idem_struct st \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_list ts f m = Some (s, n); td_fafu_idem_list ts \\ \\ td_fafu_idem s\"\n and \"\\(s :: 'a field_desc typ_desc) f m n. \\ field_lookup_pair p f m = Some (s, n); td_fafu_idem_pair p \\ \\ td_fafu_idem s\"\n by (induct t and st and ts and p) (auto split: split_if_asm option.splits)\n\nlemma field_access_update_same:\n fixes t :: \"'a :: mem_type field_desc typ_desc\" and st :: \"'a field_desc typ_struct\"\n shows \"\\(v :: 'a) bs bs'. \\ td_fafu_idem t; wf_fd t; length bs = size_td t; length bs' = size_td t\\\n \\ access_ti t (update_ti t bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_struct st; wf_fd_struct st; length bs = size_td_struct st; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti_struct st bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_list ts; wf_fd_list ts; length bs = size_td_list ts; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti_list ts bs v) bs' = bs\"\n and \"\\(v :: 'a) bs bs'. \\ td_fafu_idem_pair p; wf_fd_pair p; length bs = size_td_pair p; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti_pair p bs v) bs' = bs\"\nproof (induct t and st and ts and p)\n case TypScalar thus ?case by (clarsimp simp: fa_fu_idem_def)\nnext\n case (Cons_typ_desc p' ts' v bs bs')\n hence \"fu_commutes (update_ti_pair_t p') (update_ti_list_t ts')\" by clarsimp\n moreover have \"update_ti_pair p' (take (size_td_pair p') bs) = update_ti_pair_t p' (take (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_pair_t_def min_ll)\n moreover have \"update_ti_list ts' (drop (size_td_pair p') bs) = update_ti_list_t ts' (drop (size_td_pair p') bs)\"\n using Cons_typ_desc.prems by (simp add: update_ti_list_t_def)\n ultimately have\n updeq: \"(update_ti_pair p' (take (size_td_pair p') bs) (update_ti_list ts' (drop (size_td_pair p') bs) v))\n = (update_ti_list ts' (drop (size_td_pair p') bs) (update_ti_pair p' (take (size_td_pair p') bs) v))\"\n unfolding fu_commutes_def by simp\n\n show ?case using Cons_typ_desc.prems\n by (clarsimp simp add: Cons_typ_desc.hyps) (simp add: updeq Cons_typ_desc.hyps)\nqed simp+\n\nlemma access_ti_pair_dt_fst:\n \"access_ti_pair p v bs = access_ti (dt_fst p) v bs\"\n by (cases p, simp)\n\nlemma size_td_pair_dt_fst:\n \"size_td_pair p = size_td (dt_fst p)\"\n by (cases p, simp)\n\nlemma wf_fd_pair_dt_fst:\n \"wf_fd_pair p = wf_fd (dt_fst p)\"\n by (cases p, simp)\n\nlemma field_lookup_offset2:\n assumes fl: \"(field_lookup t f (m + n) = Some (s, q))\"\n shows \"field_lookup t f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup t f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup t f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(1)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_list:\n assumes fl: \"(field_lookup_list ts f (m + n) = Some (s, q))\"\n shows \"field_lookup_list ts f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_list ts f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_list ts f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(3)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset2_pair:\n assumes fl: \"(field_lookup_pair p f (m + n) = Some (s, q))\"\n shows \"field_lookup_pair p f m = Some (s, q - n)\"\nproof -\n from fl have le: \"m + n \\ q\"\n by (rule field_lookup_offset_le)\n\n hence \"q = (m + n) + (q - (m + n))\"\n by simp\n\n hence \"field_lookup_pair p f (m + n) = Some (s, (m + n) + (q - (m + n)))\" using fl by simp\n\n hence \"field_lookup_pair p f m = Some (s, m + (q - (m + n)))\"\n by (rule iffD1 [OF field_lookup_offset'(4)])\n\n thus ?thesis using le by simp\nqed\n\nlemma field_lookup_offset_size':\n shows \"field_lookup t f 0 = Some (t',n) \\ size_td t' + n \\ size_td t\"\n apply(drule td_set_field_lookupD)\n apply(erule td_set_offset_size)\ndone\n\nlemma field_access_update_nth_inner:\n shows \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\ field_lookup t f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd t;\n length bs = size_td s; length bs' = size_td t \\\n \\ access_ti t (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_struct st f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_struct st;\n length bs = size_td s; length bs' = size_td_struct st \\\n \\ access_ti_struct st (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_list ts f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_list ts;\n length bs = size_td s; length bs' = size_td_list ts\\\n \\ access_ti_list ts (update_ti s bs v) bs' ! x = bs ! (x - n)\"\n\n and \"\\f (s :: 'a :: mem_type field_desc typ_desc) n x v bs bs'.\n \\field_lookup_pair p f 0 = Some (s, n); n \\ x; x < n + size_td s; td_fafu_idem s; wf_fd s; wf_fd_pair p;\n length bs = size_td s; length bs' = size_td_pair p\\\n \\ access_ti_pair p (update_ti s bs v) bs' ! x = bs ! (x - n)\"\nproof (induct t and st and ts and p)\n case (TypDesc typ_struct ls f s n x v bs bs')\n\n show ?case\n proof (cases \"f = []\")\n case False thus ?thesis using TypDesc by clarsimp\n next\n case True\n thus ?thesis using TypDesc.prems\n by (simp add: field_access_update_same)\n qed\nnext\n case (Cons_typ_desc p' ts' f s n x v bs bs')\n have nlex: \"n \\ x\" and xln: \"x < n + size_td s\"\n and lbs: \"length bs = size_td s\" and lbs': \"length bs' = size_td_list (p' # ts')\" by fact+\n from Cons_typ_desc have wf: \"wf_fd (dt_fst p')\" and wfts: \"wf_fd_list ts'\" by (cases p', auto)\n\n {\n assume fl: \"field_lookup_list ts' f (size_td (dt_fst p')) = Some (s, n)\"\n\n hence mlt: \"size_td (dt_fst p') \\ n\"\n by (rule field_lookup_offset_le)\n\n hence \"size_td (dt_fst p') \\ x\"\n by (rule order_trans) fact\n\n hence ?case using wf lbs lbs'\n proof (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst)\n from fl have fl': \"field_lookup_list ts' f 0 = Some (s, n - size_td (dt_fst p'))\"\n\tby (rule field_lookup_offset2_list [where m = 0, simplified])\n\n show \"access_ti_list ts' (update_ti s bs v) (drop (size_td (dt_fst p')) bs') ! (x - size_td (dt_fst p')) = bs ! (x - n)\"\n\tusing mlt nlex xln lbs lbs' wf wfts `td_fafu_idem s` `wf_fd s`\n\tby (simp add: Cons_typ_desc.hyps(2) [OF fl'] size_td_pair_dt_fst)\n qed\n }\n moreover\n {\n note ih = Cons_typ_desc.hyps(1)[simplified access_ti_pair_dt_fst wf_fd_pair_dt_fst]\n\n assume fl: \"field_lookup_pair p' f 0 = Some (s, n)\"\n\n hence \"x < size_td (dt_fst p')\"\n apply -\n apply (cases p')\n apply (simp split: split_if_asm)\n apply (drule field_lookup_offset_size')\n apply (rule order_less_le_trans [OF xln])\n apply simp\n done\n\n hence ?case using wf lbs lbs' nlex xln wf wfts `td_fafu_idem s` `wf_fd s`\n by (simp add: nth_append length_fa_ti access_ti_pair_dt_fst size_td_pair_dt_fst ih[OF fl])\n }\n ultimately show ?case using `field_lookup_list (p' # ts') f 0 = Some (s, n)` by (simp split: option.splits)\nqed (clarsimp split: split_if_asm)+\n\nsubsection {* td_fa_hi *}\n\n(* \\ size_of TYPE('a::mem_type) \\ length h; size_of TYPE('a) \\ length h' \\ \\ *)\n\nlemma fa_heap_indepD:\n \"\\ fa_heap_indep fd n; length bs = n; length bs' = n \\ \\\n field_access fd v bs = field_access fd v bs'\"\n unfolding fa_heap_indep_def\n apply (drule spec, drule spec, drule spec)\n apply (drule (1) mp)\n apply (erule (1) mp)\n done\n\n(* The simplifier spins on the IHs here, hence the proofs for each case *)\nlemma td_fa_hi_heap_independence:\n shows \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi t; length h = size_td t; length h' = size_td t \\\n \\ access_ti t v h = access_ti t v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_struct st; length h = size_td_struct st; length h' = size_td_struct st\\\n \\ access_ti_struct st v h = access_ti_struct st v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_list ts; length h = size_td_list ts; length h' = size_td_list ts \\\n \\ access_ti_list ts v h = access_ti_list ts v h'\"\n and \"\\(v :: 'a :: mem_type) h h'. \\ td_fa_hi_pair p; length h = size_td_pair p; length h' = size_td_pair p \\\n \\ access_ti_pair p v h = access_ti_pair p v h'\"\nproof (induct t and st and ts and p)\n case TypDesc\n from TypDesc.prems show ?case\n by (simp) (erule (2) TypDesc.hyps)\nnext\n case TypScalar\n from TypScalar.prems show ?case\n by simp (erule (2) fa_heap_indepD)\nnext\n case TypAggregate\n from TypAggregate.prems show ?case\n by (simp) (erule (2) TypAggregate.hyps)\nnext\n case Nil_typ_desc thus ?case by simp\nnext\n case Cons_typ_desc\n from Cons_typ_desc.prems show ?case\n apply simp\n apply (erule conjE)\n apply (rule arg_cong2 [where f = \"op @\"])\n apply (erule Cons_typ_desc.hyps, simp, simp)\n apply (erule Cons_typ_desc.hyps, simp, simp)\n done\nnext\n case DTPair_typ_desc\n from DTPair_typ_desc.prems show ?case\n by simp (erule (2) DTPair_typ_desc.hyps)\nqed\n\nsection {* Simp rules for deriving packed props from the type combinators *}\n\nsubsection {* td_fafu_idem *}\n\nlemma td_fafu_idem_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fafu_idem (final_pad t) = td_fafu_idem t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fafu_idem_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fafu_idem (ti_typ_pad_combine t xf xfu nm s) = td_fafu_idem (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fafu_idem_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fafu_idem_list (xs @ ys) = (td_fafu_idem_list xs \\ td_fafu_idem_list ys)\"\n by (induct xs) simp+\n\nlemma td_fafu_idem_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fafu_idem s\"\n and at: \"td_fafu_idem t\"\n shows \"td_fafu_idem (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fafu_idem_list_append)\n done\n\nlemma fd_cons_access_updateD:\n \"\\ fd_cons_access_update d n; length bs = n; length bs' = n\\ \\ field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n unfolding fd_cons_access_update_def by clarsimp\n\n(* Beer crime? *)\nlemma fa_fu_idem_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_fu_idem (update_desc xf xfu a) n = fa_fu_idem a n\"\nproof\n assume asm: \"fa_fu_idem (update_desc xf xfu a) n\"\n\n let ?fu = \"\\bs. if length bs = n then field_update a bs else id\"\n let ?a' = \"\\ field_access = field_access a, field_update = ?fu \\\"\n\n show \"fa_fu_idem a n\"\n unfolding fa_fu_idem_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n hence \"(\\v. field_access a (field_update a bs (xf v)) bs' = bs)\n = (\\v. field_access a (?fu bs (xf v)) bs' = bs)\" by simp\n\n also have \"\\ = (\\v. field_access a (field_update a bs v) bs' = bs)\" using fd\n apply -\n apply rule\n apply (rule allI)\n apply (subst (asm) fd_cons_access_updateD [OF _ l l', where d = ?a', simplified])\n apply (simp add: fd_cons_struct_def fd_cons_desc_def)\n apply (fastforce simp: l l')\n apply (fastforce simp: l l')\n done\n\n finally show \"field_access a (field_update a bs v) bs' = bs\" using asm fg l l'\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\n qed\nnext\n assume \"fa_fu_idem a n\"\n thus \"fa_fu_idem (update_desc xf xfu a) n\"\n unfolding fa_fu_idem_def update_desc_def using fg\n by (clarsimp simp add: update_desc_def fa_fu_idem_def fg_cons_def)\nqed\n\nlemma td_fafu_idem_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fafu_idem (map_td (\\_ _. update_desc xf xfu) t) = td_fafu_idem t\"\n and \"wf_fd_struct st \\ td_fafu_idem_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fafu_idem_struct st\"\n and \"wf_fd_list ts \\ td_fafu_idem_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fafu_idem_list ts\"\n and \"wf_fd_pair p \\ td_fafu_idem_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fafu_idem_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_fu_idem_update_desc [OF fg])\n\nlemmas td_fafu_idem_adjust_ti = td_fafu_idem_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fafu_idem_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fafu_idem (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fafu_idem s\"\n shows \"td_fafu_idem (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fafu_idem_list_append)\n apply (subst td_fafu_idem_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fafu_idem_ptr:\n \"td_fafu_idem (typ_info_t TYPE('a :: c_type ptr))\"\n apply (clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (clarsimp simp add: size_of_def word_size)\n apply simp\n done\n\nlemma td_fafu_idem_word:\n \"td_fafu_idem (typ_info_t TYPE('a :: len8 word))\"\n apply(clarsimp simp add: fa_fu_idem_def)\n apply (subst word_rsplit_rcat_size)\n apply (insert len8_dv8)\n apply (clarsimp simp add: size_of_def word_size)\n apply (subst dvd_div_mult_self)\n apply simp\n apply simp\n apply simp\n done\n\nlemma fg_cons_array [simp]:\n \"n < card (UNIV :: 'b :: finite set) \\ fg_cons (\\x. index x n) (\\x f. Arrays.update (f :: 'a['b]) n x)\"\n unfolding fg_cons_def by simp\n\nlemma td_fafu_idem_array_n:\n \"\\td_fafu_idem (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fafu_idem (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fafu_idem_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fafu_idem_array:\n \"td_fafu_idem (typ_info_t TYPE('a)) \\ td_fafu_idem (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fafu_idem_array_n)\n apply simp\n done\n\nlemma td_fafu_idem_empty_typ_info:\n \"td_fafu_idem (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsubsection {* td_fa_hi *}\n\n(* These are mostly identical to the above --- surely there is something which implies both? *)\n\nlemma td_fa_hi_final_pad:\n \"padup (2 ^ align_td t) (size_td t) = 0\n \\ td_fa_hi (final_pad t) = td_fa_hi t\"\n unfolding final_pad_def\n by (clarsimp simp add: padup_def Let_def)\n\nlemma td_fa_hi_ti_typ_pad_combine:\n fixes t :: \"'a :: c_type itself\" and s :: \"'b :: c_type field_desc typ_desc\"\n assumes pad: \"padup (align_of TYPE('a)) (size_td s) = 0\"\n shows \"td_fa_hi (ti_typ_pad_combine t xf xfu nm s) = td_fa_hi (ti_typ_combine t xf xfu nm s)\"\n unfolding ti_typ_pad_combine_def using pad\n by (clarsimp simp: Let_def)\n\nlemma td_fa_hi_list_append:\n fixes xs :: \"'a :: c_type field_desc typ_pair list\"\n shows \"td_fa_hi_list (xs @ ys) = (td_fa_hi_list xs \\ td_fa_hi_list ys)\"\n by (induct xs) simp+\n\nlemma td_fa_hi_extend_ti:\n fixes t :: \"'a :: c_type field_desc typ_desc\"\n assumes as: \"td_fa_hi s\"\n and at: \"td_fa_hi t\"\n shows \"td_fa_hi (extend_ti s t nm)\" using as at\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (simp add: td_fa_hi_list_append)\n done\n\n(* Beer crime? *)\nlemma fa_heap_indep_update_desc:\n fixes a :: \"'a field_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and fd: \"fd_cons_struct (TypScalar n n' a)\"\n shows \"fa_heap_indep (update_desc xf xfu a) n = fa_heap_indep a n\"\nproof\n assume asm: \"fa_heap_indep (update_desc xf xfu a) n\"\n\n have xf_xfu: \"\\v v'. xf (xfu v v') = v\" using fg\n unfolding fg_cons_def\n by simp\n\n show \"fa_heap_indep a n\"\n unfolding fa_heap_indep_def\n proof (intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n with asm have \"field_access (update_desc xf xfu a) (xfu v undefined) bs =\n field_access (update_desc xf xfu a) (xfu v undefined) bs'\"\n by (rule fa_heap_indepD)\n\n thus \"field_access a v bs = field_access a v bs'\"\n unfolding update_desc_def\n by (simp add: xf_xfu)\n qed\nnext\n assume asm: \"fa_heap_indep a n\"\n show \"fa_heap_indep (update_desc xf xfu a) n\"\n unfolding fa_heap_indep_def update_desc_def\n proof (simp, intro impI conjI allI)\n fix bs :: \"byte list\" and bs' :: \"byte list\" and v\n assume l: \"length bs = n\" and l': \"length bs' = n\"\n\n with asm show \"field_access a (xf v) bs = field_access a (xf v) bs'\"\n by (rule fa_heap_indepD)\n qed\nqed\n\nlemma td_fa_hi_map_td_update_desc:\n assumes fg: \"fg_cons xf xfu\"\n shows \"wf_fd t \\ td_fa_hi (map_td (\\_ _. update_desc xf xfu) t) = td_fa_hi t\"\n and \"wf_fd_struct st \\ td_fa_hi_struct (map_td_struct (\\_ _. update_desc xf xfu) st) = td_fa_hi_struct st\"\n and \"wf_fd_list ts \\ td_fa_hi_list (map_td_list (\\_ _. update_desc xf xfu) ts) = td_fa_hi_list ts\"\n and \"wf_fd_pair p \\ td_fa_hi_pair (map_td_pair (\\_ _. update_desc xf xfu) p) = td_fa_hi_pair p\"\n by (induct t and st and ts and p) (auto elim!: fa_heap_indep_update_desc [OF fg])\n\nlemmas td_fa_hi_adjust_ti = td_fa_hi_map_td_update_desc(1)[folded adjust_ti_def]\n\nlemma td_fa_hi_ti_typ_combine:\n fixes s :: \"'b :: c_type field_desc typ_desc\"\n assumes fg: \"fg_cons xf xfu\"\n and tda: \"td_fa_hi (typ_info_t TYPE('a :: mem_type))\"\n and tds: \"td_fa_hi s\"\n shows \"td_fa_hi (ti_typ_combine TYPE('a :: mem_type) xf xfu nm s)\"\n unfolding ti_typ_combine_def using tda tds\n apply (clarsimp simp: Let_def)\n apply (cases s)\n apply (rename_tac typ_struct xs)\n apply (case_tac typ_struct)\n apply simp\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n apply (simp add: td_fa_hi_list_append)\n apply (subst td_fa_hi_adjust_ti [OF fg wf_fd], assumption)\n done\n\nlemma td_fa_hi_ptr:\n \"td_fa_hi (typ_info_t TYPE('a :: c_type ptr))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_word:\n \"td_fa_hi (typ_info_t TYPE('a :: len8 word))\"\n by (clarsimp simp add: fa_heap_indep_def)\n\nlemma td_fa_hi_array_n:\n \"\\td_fa_hi (typ_info_t TYPE('a)); n \\ card (UNIV :: 'b set) \\ \\ td_fa_hi (array_tag_n n :: ('a :: mem_type ['b :: finite]) field_desc typ_desc)\"\n apply (induct n)\n apply (simp add: array_tag_n.simps empty_typ_info_def)\n apply (simp add: array_tag_n.simps)\n apply (rule td_fa_hi_ti_typ_combine)\n apply simp\n apply simp\n apply simp\n done\n\nlemma td_fa_hi_array:\n \"td_fa_hi (typ_info_t TYPE('a)) \\ td_fa_hi (typ_info_t TYPE('a :: mem_type ['b :: finite]))\"\n apply (clarsimp simp add: typ_info_array array_tag_def fa_fu_idem_def)\n apply (erule td_fa_hi_array_n)\n apply simp\n done\n\nlemma td_fa_hi_empty_typ_info:\n \"td_fa_hi (empty_typ_info t)\"\n unfolding empty_typ_info_def\n by simp\n\nsection {* The type class and simp sets *}\n\ntext {* Packed types, with no padding, have the defining property that\n access is invariant under substitution of the underlying heap and\n access/update is the identity *}\n\nclass packed_type = mem_type +\n assumes td_fafu_idem: \"td_fafu_idem (typ_info_t TYPE('a::c_type))\"\n assumes td_fa_hi: \"td_fa_hi (typ_info_t TYPE('a::c_type))\"\n\nlemmas td_fafu_idem_intro_simps =\n -- \"Axioms\"\n td_fafu_idem\n -- \"Combinators\"\n td_fafu_idem_final_pad td_fafu_idem_ti_typ_pad_combine td_fafu_idem_ti_typ_combine td_fafu_idem_empty_typ_info\n -- \"Constructors\"\n td_fafu_idem_ptr td_fafu_idem_word td_fafu_idem_array\n\nlemmas td_fa_hi_intro_simps =\n -- \"Axioms\"\n td_fa_hi\n -- \"Combinators\"\n td_fa_hi_final_pad td_fa_hi_ti_typ_pad_combine td_fa_hi_ti_typ_combine td_fa_hi_empty_typ_info\n -- \"Constructors\"\n td_fa_hi_ptr td_fa_hi_word td_fa_hi_array\n\nlemma align_td_array':\n \"align_td (typ_info_t TYPE('a :: c_type['b :: finite])) = align_td (typ_info_t TYPE('a))\"\n by (simp add: typ_info_array array_tag_def align_td_array_tag)\n\nlemmas packed_type_intro_simps =\n td_fafu_idem_intro_simps td_fa_hi_intro_simps align_td_array' size_td_simps size_td_array\n\nlemma access_ti_append':\n \"\\list.\n access_ti_list (xs @ ys) t list =\n access_ti_list xs t (take (size_td_list xs) list) @\n access_ti_list ys t (drop (size_td_list xs) list)\"\nproof(induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nsection {* Instances *}\n\ntext {* Words (of multiple of 8 size) are packed *}\n\ninstantiation word :: (len8) packed_type\nbegin\ninstance\n apply(intro_classes)\n apply (rule td_fafu_idem_word)\n apply (rule td_fa_hi_word)\n done\nend\n\ntext {* Pointers are always packed *}\n\ninstantiation ptr :: (c_type)packed_type\nbegin\ninstance\n apply intro_classes\n apply (simp add: fa_fu_idem_def word_rsplit_rcat_size word_size)\n apply (simp add: fa_heap_indep_def)\n done\nend\n\ntext {* Arrays of packed types are in turn packed *}\n\nclass oneMB_packed = packed_type + oneMB_size\n\ninstantiation word :: (len8)oneMB_packed\nbegin\ninstance\n apply(intro_classes)\ndone\nend\n\ninstantiation array :: (oneMB_packed,fourthousand_count) packed_type\nbegin\ninstance\n apply(intro_classes)\n apply (simp add: td_fafu_idem_intro_simps)\n apply (simp add: td_fa_hi_intro_simps)\n done\nend\n\nsection {* Theorems about packed types *}\n\nsubsection {* td_fa_hi *}\n\nlemma heap_independence:\n \"\\length h = size_of TYPE('a :: packed_type); length h' = size_of TYPE('a) \\\n \\ access_ti (typ_info_t TYPE('a)) v h = access_ti (typ_info_t TYPE('a)) v h'\"\n by (rule td_fa_hi_heap_independence(1)[OF td_fa_hi], simp_all add: size_of_def)\n\ntheorem packed_heap_update_collapse:\n fixes u::\"'a::packed_type\"\n fixes v::\"'a\"\n shows\n \"heap_update p v (heap_update p u h) = heap_update p v h\"\n apply(simp add:heap_update_def)\n apply(rule ext)\n apply(case_tac \"x \\ {ptr_val p..+size_of TYPE('a)}\")\n apply((subst heap_update_mem_same_point, simp, simp)+)\n apply(simp add:to_bytes_def)\n apply(subst heap_independence)\n apply(simp)\n prefer 2\n apply(force)\n apply(simp)\n apply((subst heap_update_nmem_same, simp)+)\n apply(rule refl)\ndone\n\nlemma packed_heap_update_collapse_hrs:\n fixes p :: \"'a :: packed_type ptr\"\n shows \"(hrs_mem_update (heap_update p v) (hrs_mem_update (heap_update p v') hp)) =\n (hrs_mem_update (heap_update p v) hp)\"\n unfolding hrs_mem_update_def\n by (simp add: split_def packed_heap_update_collapse)\n\nsubsection {* td_fafu_idem *}\n\nlemma order_leE:\n fixes x :: \"'a :: order\"\n shows \"\\ x \\ y; x = y \\ P; x < y \\ P \\ \\ P\"\n by (auto simp: order_le_less)\n\nlemma of_nat_mono_maybe_le:\n shows \"\\X < 2 ^ len_of TYPE('a); Y \\ X\\ \\ (of_nat Y :: 'a :: len word) \\ of_nat X\"\n apply (erule order_leE)\n apply simp\n apply (rule order_less_imp_le)\n apply (erule (1) of_nat_mono_maybe)\n done\n\nlemma intvl_le_lower:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ y \\ x\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (erule word_plus_mono_right2)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n done\n\nlemma intvl_less_upper:\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ {y..+n}; y \\ y + of_nat (n - 1); n < 2 ^ len_of TYPE('a) \\ \\ x \\ y + of_nat (n - 1)\"\n apply (drule intvlD)\n apply (elim conjE exE)\n apply (erule ssubst)\n apply (rule word_plus_mono_right)\n apply (rule of_nat_mono_maybe_le)\n apply simp\n apply simp\n apply assumption\n done\n\nlemma packed_type_access_ti:\n fixes v :: \"'a :: packed_type\"\n assumes lbs: \"length bs = size_of TYPE('a)\"\n shows \"access_ti (typ_info_t TYPE('a)) v bs = access_ti\\<^sub>0 (typ_info_t TYPE('a)) v\"\n unfolding access_ti\\<^sub>0_def using lbs\n apply -\n apply (rule heap_independence)\n apply simp\n apply (simp add: size_of_def)\n done\n\nlemma update_ti_update_ti_t:\n \"length bs = size_td s \\ update_ti s bs v = update_ti_t s bs v\"\n unfolding update_ti_t_def by simp\n\nlemma heap_list_nth:\n \"m < n \\ heap_list hp n p ! m = hp (p + of_nat m)\"\nproof (induct m arbitrary: n p)\n case (0 n' p')\n\n thus ?case by (cases n', simp_all)\nnext\n case (Suc m' n' p')\n\n show ?case\n proof (cases n')\n case 0 thus ?thesis using `Suc m' < n'` by simp\n next\n case (Suc n'')\n hence \"m' < n''\" using `Suc m' < n'` by simp\n thus ?thesis using Suc\n by (simp add: Suc.hyps ac_simps)\n qed\nqed\n\nlemma c_guard_field_lvalue:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cg: \"c_guard p\"\n and fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n)\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('b :: mem_type)\"\n shows \"c_guard (Ptr &(p\\f) :: 'b :: mem_type ptr)\"\n unfolding c_guard_def\nproof (rule conjI)\n from cg fl eu show \"ptr_aligned (Ptr &(p\\f) :: 'b ptr)\"\n by (rule c_guard_ptr_aligned_fl)\nnext\n from eu have std: \"size_td t = size_of TYPE('b)\" using fl\n by (simp add: export_size_of)\n\n from cg have \"c_null_guard p\" unfolding c_guard_def ..\n thus \"c_null_guard (Ptr &(p\\f) :: 'b ptr)\" unfolding c_null_guard_def\n apply (rule contrapos_nn)\n apply (rule subsetD [OF field_tag_sub, OF fl])\n apply (simp add: std)\n done\nqed\n\n(* Similar in TypHeap, but for w32 *)\nlemma unat_minus':\n fixes x :: \"'a :: len word\"\n shows \"x \\ 0 \\ unat (-x) = 2 ^ len_of TYPE('a) - unat x\"\n apply (simp add: unat_def word_minus_def)\n apply (simp add: int_word_uint zmod_zminus1_eq_if uint_0_iff)\n apply (subst nat_diff_distrib)\n apply simp\n apply (rule order_less_imp_le [OF uint_lt2p])\n apply (clarsimp simp: nat_power_eq)\n done\n\nlemma word_wrap_of_natD:\n fixes x :: \"'a :: len word\"\n assumes wraps: \"\\ x \\ x + of_nat n\"\n shows \"\\k. x + of_nat k = 0 \\ k \\ n\"\nproof -\n show ?thesis\n proof (rule exI [where x = \"unat (- x)\"], intro conjI)\n show \"x + of_nat (unat (-x)) = 0\"\n by simp\n next\n show \"unat (-x) \\ n\"\n proof (subst unat_minus')\n from wraps show \"x \\ 0\"\n\tby (rule contrapos_pn, simp add: not_le)\n next\n show \"2 ^ len_of TYPE('a) - unat x \\ n\" using wraps\n\tapply (simp add: no_olen_add_nat le_diff_conv not_less)\n\tapply (erule order_trans)\n\tapply (simp add: unat_of_nat)\n\tdone\n qed\n qed\nqed\n\nlemma nat_le_Suc_less:\n \"0 < y \\ (x \\ y - Suc 0) = (x < y)\"\n by arith\n\nlemma c_guard_no_wrap:\n fixes p :: \"'a :: mem_type ptr\"\n assumes cgrd: \"c_guard p\"\n shows \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('a) - 1)\"\n using cgrd unfolding c_guard_def c_null_guard_def\n apply -\n apply (erule conjE)\n apply (erule contrapos_np)\n apply (simp add: intvl_def)\n apply (drule word_wrap_of_natD)\n apply (erule exE)\n apply (rule exI)\n apply (simp add: nat_le_Suc_less)\n done\n\ntheorem packed_heap_super_field_update:\n fixes v :: \"'a :: packed_type\" and p :: \"'b :: packed_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (t, n)\"\n and cgrd: \"c_guard p\"\n and eu: \"export_uinfo t = typ_uinfo_t TYPE('a)\"\n shows \"heap_update (Ptr &(p\\f)) v hp = heap_update p (update_ti t (to_bytes_p v) (h_val hp p)) hp\"\n unfolding heap_update_def to_bytes_def\nproof (simp add: packed_type_access_ti, rule ext)\n fix x\n let ?LHS = \"heap_update_list &(p\\f) (to_bytes_p v) hp x\"\n let ?RHS = \"heap_update_list (ptr_val p) (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) hp x\"\n\n from cgrd have al: \"ptr_val p \\ ptr_val p + of_nat (size_of TYPE('b) - 1)\" by (rule c_guard_no_wrap)\n\n have szb: \"size_of TYPE('b) < 2 ^ len_of TYPE(32)\"\n apply (fold card_word)\n apply (fold addr_card_def)\n apply (rule max_size)\n done\n\n have szt: \"n + size_td t \\ size_of TYPE('b)\"\n unfolding size_of_def\n by (subst add.commute, rule field_lookup_offset_size [OF fl])\n moreover have t0: \"0 < size_td t\" using fl wf_size_desc\n by (rule field_lookup_wf_size_desc_gt)\n ultimately have szn: \"n < size_of TYPE('b)\" by simp\n from szt have szt1: \"n + (size_td t - 1) \\ size_of TYPE('b)\"\n by simp\n\n have b0: \"0 < size_of (TYPE ('b))\" using wf_size_desc\n unfolding size_of_def\n by (rule wf_size_desc_gt)\n\n have uofn: \"unat (of_nat n :: 32 word) = n\" using szn szb\n by (simp add: unat_simps)\n\n from eu have std: \"size_td t = size_of TYPE('a)\" using fl\n by (simp add: export_size_of)\n\n hence \"?LHS = (if x \\ {&(p\\f)..+size_td t} then (to_bytes_p v) ! unat (x - &(p\\f)) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n also have \"... = ?RHS\"\n proof (simp, intro impI conjI)\n assume xin: \"x \\ {&(p\\f)..+size_td t}\"\n have \"to_bytes_p v ! unat (x - &(p\\f)) = to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p)) ! unat (x - ptr_val p)\"\n proof (simp add: to_bytes_p_def to_bytes_def, subst field_access_update_nth_inner(1)[OF fl, simplified])\n\n have \"c_guard (Ptr &(p\\f) :: 'a ptr)\" using cgrd fl eu\n\tby (rule c_guard_field_lvalue)\n hence pft: \"&(p\\f) \\ &(p\\f) + of_nat (size_td t - 1)\"\n\tapply -\n\tapply (drule c_guard_no_wrap)\n\tapply (simp add: std)\n\tdone\n\n have szt': \"size_td t < 2 ^ len_of TYPE(32)\"\n\tapply (subst std)\n\tapply (fold card_word)\n\tapply (fold addr_card_def)\n\tapply (rule max_size)\n\tdone\n\n have ofn: \"of_nat n \\ x - ptr_val p\"\n proof (rule le_minus')\n\tfrom xin show \"ptr_val p + of_nat n \\ x\" using pft szt'\n\t unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\t by (rule intvl_le_lower)\n next\n\tfrom szb szn have \"of_nat n \\ (of_nat (size_of TYPE('b) - 1) :: 32 word)\"\n\t apply -\n\t apply (rule of_nat_mono_maybe_le)\n\t apply simp_all\n\t done\n\twith al show \"ptr_val p \\ ptr_val p + of_nat n\"\n\t by (rule word_plus_mono_right2)\n qed\n\n thus nlt: \"n \\ unat (x - ptr_val p)\"\n\tby (simp add: word_le_nat_alt uofn)\n have \"x \\ ptr_val p + (of_nat n + of_nat (size_td t - 1))\" using xin pft szt' t0\n\tunfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\tapply -\n\tapply (drule (2) intvl_less_upper)\n\tapply (simp add: add.assoc)\n\tdone\n moreover have \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n\tby (rule subsetD [OF field_tag_sub])\n ultimately have \"x - ptr_val p \\ (of_nat n + of_nat (size_td t - 1))\" using al szb\n\tapply -\n\tapply (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n apply (metis (hide_lams, mono_tags) add.commute of_nat_add)\n\tapply (erule (2) intvl_le_lower)\n\tdone\n moreover have \"unat (of_nat n + of_nat (size_td t - 1) :: 32 word) = n + size_td t - 1\"\n\tusing t0 order_le_less_trans [OF szt1 szb]\n\tapply (subst Abs_fnat_homs(1))\n\tapply (subst unat_of_nat)\n\tapply simp\n\tdone\n ultimately have \"unat (x - ptr_val p) \\ n + size_td t - 1\"\n\tby (simp add: word_le_nat_alt)\n thus \"unat (x - ptr_val p) < n + size_td t\" using t0\n\tby simp\n\n show \"td_fafu_idem t\"\n\tby (rule field_lookup_td_fafu_idem(1)[OF fl td_fafu_idem])\n\n show \"wf_fd t\"\n\tby (rule wf_fd_field_lookupD [OF fl wf_fd])\n\n show \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n\tusing wf_fd [where 'a = 'a]\n\tby (simp add: length_fa_ti size_of_def std)\n\n show \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n\tby (simp add: size_of_def)\n\n have \"unat (x - &(p\\f)) = unat ((x - ptr_val p) - of_nat n)\"\n \tby (simp add: field_lvalue_def field_lookup_offset_eq [OF fl])\n also have \"\\ = unat (x - ptr_val p) - n\"\n\tby (simp add: unat_sub [OF ofn] uofn)\n finally have \"unat (x - &(p\\f)) = unat (x - ptr_val p) - n\" .\n\n thus \"access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! unat (x - &(p\\f)) =\n\taccess_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0) ! (unat (x - ptr_val p) - n)\"\n\tby simp\n qed\n\n thus \"to_bytes_p v ! unat (x - &(p\\f)) = ?RHS\"\n proof (subst heap_update_mem_same_point, simp_all)\n show \"x \\ {ptr_val p..+size_of TYPE('b)}\" using fl xin\n\tby (rule subsetD [OF field_tag_sub])\n qed\n next\n assume xni: \"x \\ {&(p\\f)..+size_td t}\"\n have \"?RHS = (if x \\ {ptr_val p..+size_of TYPE('b)}\n then (to_bytes_p (update_ti t (to_bytes_p v) (h_val hp p))) ! unat (x - ptr_val p) else hp x)\"\n by (simp add: heap_update_mem_same_point heap_update_nmem_same)\n\n also\n {\n assume xin: \"x \\ {ptr_val p..+size_of TYPE('b)}\"\n\n hence \"access_ti (typ_info_t TYPE('b))\n\t(update_ti_t t (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) (h_val hp p))\n\t(replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n proof (subst field_access_update_nth_disjD [OF fl])\n\thave \"x - ptr_val p \\ of_nat (size_of TYPE('b) - 1)\"\n\tproof (rule word_diff_ls(4)[where xa=x and x=x for x, simplified])\n \t from xin show \"x \\ of_nat (size_of TYPE('b) - 1) + ptr_val p\" using al szb\n\t by (subst add.commute, rule intvl_less_upper)\n\t show \"ptr_val p \\ x\" using xin al szb\n\t by (rule intvl_le_lower)\n\tqed\n\tthus unx: \"unat (x - ptr_val p) < size_td (typ_info_t TYPE('b))\" using szb b0\n\t by (simp add: word_le_nat_alt size_of_def unat_of_nat)\n\n\tshow \"unat (x - ptr_val p) < n - 0 \\ n - 0 + size_td t \\ unat (x - ptr_val p)\" using xin xni\n \t unfolding field_lvalue_def field_lookup_offset_eq [OF fl]\n\t apply -\n\t apply (erule intvl_cut)\n\t apply simp\n\t apply (rule max_size)\n\t done\n\n\tshow \"wf_fd (typ_info_t TYPE('b))\" by (rule wf_fd)\n\t(* clag *)\n\tshow \"length (access_ti (typ_info_t TYPE('a)) v (replicate (size_of TYPE('a)) 0)) = size_td t\"\n\t using wf_fd [where 'a = 'a]\n\t by (simp add: length_fa_ti size_of_def std)\n\n\tshow \"length (replicate (size_of TYPE('b)) 0) = size_td (typ_info_t TYPE('b))\"\n\t by (simp add: size_of_def)\n\n\thave \"heap_list hp (size_td (typ_info_t TYPE('b))) (ptr_val p) ! unat (x - ptr_val p) = hp x\"\n\t apply (subst heap_list_nth)\n\t apply (rule unx)\n\t apply simp\n\t done\n\n\tthus \"access_ti (typ_info_t TYPE('b)) (h_val hp p) (replicate (size_of TYPE('b)) 0) ! unat (x - ptr_val p) = hp x\"\n\t unfolding h_val_def\n\t by (simp add: from_bytes_def update_ti_t_def size_of_def field_access_update_same(1)[OF td_fafu_idem wf_fd])\n qed\n }\n hence \"\\ = hp x\"\n by (simp add: to_bytes_p_def to_bytes_def update_ti_update_ti_t length_fa_ti [OF wf_fd] std size_of_def)\n finally show \"hp x = ?RHS\" by simp\n qed\n finally show \"?LHS = ?RHS\" .\nqed\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/PackedTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.26145495115824113}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\n(* Definitions supporting the extremely long CTypes.thy *)\n\ntheory CTypesDefs\nimports\n \"~~/src/HOL/Library/Prefix_Order\"\n \"../../lib/SignedWords\"\n CTypesBase\nbegin\n\nsection \"C types setup\"\n\ntype_synonym field_name = string\ntype_synonym qualified_field_name = \"field_name list\"\n\ntype_synonym typ_name = string\n\n\nsection \"XXX: unsectioned and mostly uncommented, as in original\"\n\n(* XXX FIXME TODO:\n * Figure out sectioning here first and *then* try make CTypes.thy conform\n to that sectioning.\n * Also, all definitions from CTypes.thy are here. Some might be local-only\n and thus might need to be put back.\n * Some definitions are closely followed by [simp] lemmas simplifying their\n most common usage. Perhaps put these in here with the defs?\n *)\n\ntext {* A typ_desc wraps a typ_struct with a typ name.\n A typ_struct is either a Scalar, with size, alignment and either a\n field accessor/updator pair (for typ_info) or a 'normalisor'\n (for typ_uinfo), or an Aggregate, with a list of typ_desc,\n field name pairs.*}\n\ndatatype 'a typ_desc = TypDesc \"'a typ_struct\" typ_name\n and 'a typ_struct = TypScalar nat nat \"'a\" |\n TypAggregate \"('a typ_desc,field_name) dt_pair list\"\n\ntype_synonym 'a typ_pair = \"('a typ_desc,field_name) dt_pair\"\n\ntype_synonym typ_uinfo = \"normalisor typ_desc\"\ntype_synonym typ_uinfo_struct = \"normalisor typ_struct\"\ntype_synonym typ_uinfo_pair = \"normalisor typ_pair\"\n\nrecord 'a field_desc =\n field_access :: \"'a \\ byte list \\ byte list\"\n field_update :: \"byte list \\ 'a \\ 'a\"\n\ntype_synonym 'a typ_info = \"'a field_desc typ_desc\"\ntype_synonym 'a typ_info_struct = \"'a field_desc typ_struct\"\ntype_synonym 'a typ_info_pair = \"'a field_desc typ_pair\"\n\ndefinition fu_commutes :: \"('b \\ 'a \\ 'a) \\ ('c \\ 'a \\ 'a) \\ bool\" where\n \"fu_commutes f g \\ \\v bs bs'. f bs (g bs' v) = g bs' (f bs v)\"\n\n\ntext {* size_td returns the sum of the sizes of all Scalar fields\n comprising a typ_desc i.e. the overall size of the type *}\n\n(* Could express this and many other typ_desc primrecs as tree fold/map\n combos, but the intuition this way is clearer for anything non-trivial *)\nprimrec\n size_td :: \"'a typ_desc \\ nat\" and\n size_td_struct :: \"'a typ_struct \\ nat\" and\n size_td_list :: \"'a typ_pair list \\ nat\" and\n size_td_pair :: \"'a typ_pair \\ nat\"\nwhere\n tz0: \"size_td (TypDesc st nm) = size_td_struct st\"\n\n| tz1: \"size_td_struct (TypScalar n algn d) = n\"\n| tz2: \"size_td_struct (TypAggregate xs) = size_td_list xs\"\n\n| tz3: \"size_td_list [] = 0\"\n| tz4: \"size_td_list (x#xs) = size_td_pair x + size_td_list xs\"\n\n| tz5: \"size_td_pair (DTPair t n) = size_td t\"\n\n\ntext {* access_ti overlays the byte-wise representation of an object\n on a given byte list, given the typ_info (i.e. the layout) *}\n\nprimrec\n access_ti :: \"'a typ_info \\ ('a \\ byte list \\ byte list)\" and\n access_ti_struct :: \"'a typ_info_struct \\\n ('a \\ byte list \\ byte list)\" and\n access_ti_list :: \"'a typ_info_pair list \\\n ('a \\ byte list \\ byte list)\" and\n access_ti_pair :: \"'a typ_info_pair \\ ('a \\ byte list \\ byte list)\"\nwhere\n fa0: \"access_ti (TypDesc st nm) = access_ti_struct st\"\n\n| fa1: \"access_ti_struct (TypScalar n algn d) = field_access d\"\n| fa2: \"access_ti_struct (TypAggregate xs) = access_ti_list xs\"\n\n| fa3: \"access_ti_list [] = (\\v bs. [])\"\n| fa4: \"access_ti_list (x#xs) =\n (\\v bs. access_ti_pair x v (take (size_td_pair x) bs) @\n access_ti_list xs v (drop (size_td_pair x) bs))\"\n\n| fa5: \"access_ti_pair (DTPair t nm) = access_ti t\"\n\ntext {* access_ti\\<^sub>0 overlays the representation of an object on a\n list of zero bytes *}\n\ndefinition access_ti\\<^sub>0 :: \"'a typ_info \\ ('a \\ byte list)\" where\n \"access_ti\\<^sub>0 t \\ \\v. access_ti t v (replicate (size_td t) 0)\"\n\ntext {* update_ti updates an object, given a list of bytes (the\n representation of the new value), and the typ_info *}\n\nprimrec\n update_ti :: \"'a typ_info \\ (byte list \\ 'a \\ 'a)\" and\n update_ti_struct :: \"'a typ_info_struct \\ (byte list \\ 'a \\ 'a)\" and\n update_ti_list :: \"'a typ_info_pair list \\ (byte list \\ 'a \\ 'a)\" and\n update_ti_pair :: \"'a typ_info_pair \\ (byte list \\ 'a \\ 'a)\"\nwhere\n fu0: \"update_ti (TypDesc st nm) = update_ti_struct st\"\n\n| fu1: \"update_ti_struct (TypScalar n algn d) = field_update d\"\n| fu2: \"update_ti_struct (TypAggregate xs) = update_ti_list xs\"\n\n| fu3: \"update_ti_list [] = (\\bs. id)\"\n| fu4: \"update_ti_list (x#xs) = (\\bs v.\n update_ti_pair x (take (size_td_pair x) bs)\n (update_ti_list xs (drop (size_td_pair x) bs) v))\"\n\n| fu5: \"update_ti_pair (DTPair t nm) = update_ti t\"\n\n\ntext {* update_ti_t updates an object only if the length of the\n supplied representation equals the object size *}\n\ndefinition update_ti_t :: \"'a typ_info \\ (byte list \\ 'a \\ 'a)\" where\n \"update_ti_t t \\ \\bs. if length bs = size_td t then\n update_ti t bs else id\"\n\ndefinition update_ti_struct_t :: \"'a typ_info_struct \\ (byte list \\ 'a \\ 'a)\" where\n \"update_ti_struct_t t \\ \\bs. if length bs = size_td_struct t then\n update_ti_struct t bs else id\"\n\ndefinition update_ti_list_t :: \"'a typ_info_pair list \\ (byte list \\ 'a \\ 'a)\" where\n \"update_ti_list_t t \\ \\bs. if length bs = size_td_list t then\n update_ti_list t bs else id\"\n\ndefinition update_ti_pair_t :: \"'a typ_info_pair \\ (byte list \\ 'a \\ 'a)\" where\n \"update_ti_pair_t t \\ \\bs. if length bs = size_td_pair t then\n update_ti_pair t bs else id\"\n\n\ntext {* field_desc generates the access/update pair for a field,\n given the field's type_desc *}\n\ndefinition field_desc :: \"'a typ_info \\ 'a field_desc\" where\n \"field_desc t \\ \\ field_access = access_ti t,\n field_update = update_ti_t t \\\"\n\ndeclare field_desc_def [simp add]\n\ndefinition field_desc_struct :: \"'a typ_info_struct \\ 'a field_desc\" where\n \"field_desc_struct t \\ \\ field_access = access_ti_struct t,\n field_update = update_ti_struct_t t \\\"\n\ndeclare field_desc_struct_def [simp add]\n\ndefinition field_desc_list :: \"'a typ_info_pair list \\ 'a field_desc\"\nwhere\n \"field_desc_list t \\ \\ field_access = access_ti_list t,\n field_update = update_ti_list_t t \\\"\n\ndeclare field_desc_list_def [simp add]\n\ndefinition field_desc_pair :: \"'a typ_info_pair \\ 'a field_desc\"\nwhere\n \"field_desc_pair t \\ \\ field_access = access_ti_pair t,\n field_update = update_ti_pair_t t \\\"\n\ndeclare field_desc_pair_def [simp add]\n\n\nprimrec\n map_td :: \"(nat \\ nat \\ 'a \\ 'b) \\ 'a typ_desc \\ 'b typ_desc\" and\n map_td_struct :: \"(nat \\ nat \\ 'a \\ 'b) \\ 'a typ_struct \\ 'b typ_struct\" and\n map_td_list :: \"(nat \\ nat \\ 'a \\ 'b) \\ 'a typ_pair list \\\n 'b typ_pair list\" and\n map_td_pair :: \"(nat \\ nat \\ 'a \\ 'b) \\ 'a typ_pair \\ 'b typ_pair\"\nwhere\n mat0: \"map_td f (TypDesc st nm) = TypDesc (map_td_struct f st) nm\"\n\n| mat1: \"map_td_struct f (TypScalar n algn d) = TypScalar n algn (f n algn d)\"\n| mat2: \"map_td_struct f (TypAggregate xs) = TypAggregate (map_td_list f xs)\"\n\n| mat3: \"map_td_list f [] = []\"\n| mat4: \"map_td_list f (x#xs) = map_td_pair f x # map_td_list f xs\"\n\n| mat5: \"map_td_pair f (DTPair t n) = DTPair (map_td f t) n\"\n\ndefinition field_norm :: \"nat \\ nat \\ 'a field_desc \\ (byte list \\ byte list)\"\nwhere\n \"field_norm \\ \\n algn d bs.\n if length bs = n then\n field_access d (field_update d bs undefined) (replicate n 0) else\n []\"\n\ndefinition export_uinfo :: \"'a typ_info \\ typ_uinfo\" where\n \"export_uinfo t \\ map_td field_norm t\"\n\n\nprimrec\n wf_desc :: \"'a typ_desc \\ bool\" and\n wf_desc_struct :: \"'a typ_struct \\ bool\" and\n wf_desc_list :: \"'a typ_pair list \\ bool\" and\n wf_desc_pair :: \"'a typ_pair \\ bool\"\nwhere\n wfd0: \"wf_desc (TypDesc ts n) = wf_desc_struct ts\"\n\n| wfd1: \"wf_desc_struct (TypScalar n algn d) = True\"\n| wfd2: \"wf_desc_struct (TypAggregate ts) = wf_desc_list ts\"\n\n| wfd3: \"wf_desc_list [] = True\"\n| wfd4: \"wf_desc_list (x#xs) = (wf_desc_pair x \\ \\ dt_snd x \\ dt_snd ` set xs \\\n wf_desc_list xs)\"\n\n| wfd5: \"wf_desc_pair (DTPair x n) = wf_desc x\"\n\n\nprimrec\n wf_size_desc :: \"'a typ_desc \\ bool\" and\n wf_size_desc_struct :: \"'a typ_struct \\ bool\" and\n wf_size_desc_list :: \"'a typ_pair list \\ bool\" and\n wf_size_desc_pair :: \"'a typ_pair \\ bool\"\nwhere\n wfsd0: \"wf_size_desc (TypDesc ts n) = wf_size_desc_struct ts\"\n\n| wfsd1: \"wf_size_desc_struct (TypScalar n algn d) = (0 < n)\"\n| wfsd2: \"wf_size_desc_struct (TypAggregate ts) =\n (ts \\ [] \\ wf_size_desc_list ts)\"\n\n| wfsd3: \"wf_size_desc_list [] = True\"\n| wfsd4: \"wf_size_desc_list (x#xs) =\n (wf_size_desc_pair x \\ wf_size_desc_list xs)\"\n\n| wfsd5: \"wf_size_desc_pair (DTPair x n) = wf_size_desc x\"\n\n\nprimrec\n typ_struct :: \"'a typ_desc \\ 'a typ_struct\"\nwhere\n \"typ_struct (TypDesc st sz) = st\"\n\nprimrec\n typ_name :: \"'a typ_desc \\ typ_name\"\nwhere\n \"typ_name (TypDesc st nm) = nm\"\n\nprimrec\n norm_tu :: \"typ_uinfo \\ normalisor\" and\n norm_tu_struct :: \"typ_uinfo_struct \\ normalisor\" and\n norm_tu_list :: \"typ_uinfo_pair list \\ normalisor\" and\n norm_tu_pair :: \"typ_uinfo_pair \\ normalisor\"\nwhere\n tn0: \"norm_tu (TypDesc st nm) = norm_tu_struct st\"\n\n| tn1: \"norm_tu_struct (TypScalar n aln f) = f\"\n| tn2: \"norm_tu_struct (TypAggregate xs) = norm_tu_list xs\"\n\n| tn3: \"norm_tu_list [] = (\\bs. [])\"\n| tn4: \"norm_tu_list (x#xs) = (\\bs.\n norm_tu_pair x (take (size_td_pair x) bs) @\n norm_tu_list xs (drop (size_td_pair x) bs))\"\n\n| tn5: \"norm_tu_pair (DTPair t n) = norm_tu t\"\n\nclass c_type\n\ninstance c_type \\ type ..\n\nconsts\n typ_info_t :: \"'a::c_type itself \\ 'a typ_info\"\n typ_name_itself :: \"'a::c_type itself \\ typ_name\"\n\ndefinition typ_uinfo_t :: \"'a::c_type itself \\ typ_uinfo\" where\n \"typ_uinfo_t t \\ export_uinfo (typ_info_t TYPE('a))\"\n\ndefinition to_bytes :: \"'a::c_type \\ byte list \\ byte list\" where\n \"to_bytes v \\ access_ti (typ_info_t TYPE('a)) v\"\n\n\n(* from_bytes is now total - all partial C types 'a need to be instantiated\n as c_types using 'a option and the parser needs to do some work\n extracting the value and generating guards for non-None when these are\n used. Luckily for us in our work we never use them. *)\ndefinition from_bytes :: \"byte list \\ 'a::c_type\" where\n \"from_bytes bs \\\n field_update (field_desc (typ_info_t TYPE('a))) bs undefined\"\n\n\ntype_synonym 'a flr = \"('a typ_desc \\ nat) option\"\n\nprimrec\n field_lookup :: \"'a typ_desc \\ qualified_field_name \\ nat \\ 'a flr\" and\n field_lookup_struct :: \"'a typ_struct \\ qualified_field_name \\ nat \\\n 'a flr\" and\n field_lookup_list :: \"'a typ_pair list \\ qualified_field_name \\ nat \\\n 'a flr\" and\n field_lookup_pair :: \"'a typ_pair \\ qualified_field_name \\ nat \\ 'a flr\"\nwhere\n fl0: \"field_lookup (TypDesc st nm) f m =\n (if f=[] then Some (TypDesc st nm,m) else field_lookup_struct st f m)\"\n\n| fl1: \"field_lookup_struct (TypScalar n algn d) f m = None\"\n| fl2: \"field_lookup_struct (TypAggregate xs) f m = field_lookup_list xs f m\"\n\n| fl3: \"field_lookup_list [] f m = None\"\n| fl4: \"field_lookup_list (x#xs) f m = (\n case field_lookup_pair x f m of\n None \\ field_lookup_list xs f (m + size_td (dt_fst x)) |\n Some y \\ Some y)\"\n\n| fl5: \"field_lookup_pair (DTPair t nm) f m =\n (if nm=hd f \\ f \\ [] then field_lookup t (tl f) m else None)\"\n\n\ndefinition map_td_flr :: \"(nat \\ nat \\ 'a \\ 'b) \\\n ('a typ_desc \\ nat) option \\ 'b flr\"\nwhere\n \"map_td_flr f \\ case_option None (\\(s,n). Some (map_td f s,n))\"\n\n\ndefinition\n import_flr :: \"(nat \\ nat \\ 'b \\ 'a) \\ 'a flr \\ ('b typ_desc \\ nat) option \\ bool\"\nwhere\n \"import_flr f s k \\ case_option (k=None)\n (\\(s,m). case_option False (\\(t,n). n=m \\ map_td f t=s) k )\n s\"\n\ndefinition\n field_offset_untyped :: \"'a typ_desc \\ qualified_field_name \\ nat\"\nwhere\n \"field_offset_untyped t n \\ snd (the (field_lookup t n 0))\"\n\ndefinition\n field_offset :: \"'a::c_type itself \\ qualified_field_name \\ nat\"\nwhere\n \"field_offset t n \\ field_offset_untyped (typ_uinfo_t TYPE('a)) n\"\n\ndefinition\n field_ti :: \"'a::c_type itself \\ qualified_field_name \\ 'a typ_info\"\nwhere\n \"field_ti t n \\ case_option None (Some \\ fst)\n (field_lookup (typ_info_t TYPE('a)) n 0)\"\n\n\ndefinition\n field_size :: \"'a::c_type itself \\ qualified_field_name \\ nat\"\nwhere\n \"field_size t n \\ size_td (the (field_ti t n))\"\n\ndefinition\n field_lvalue :: \"'a::c_type ptr \\ qualified_field_name \\ addr\" (\"&'(_\\_')\")\nwhere\n \"&(p\\f) \\ ptr_val (p::'a ptr) + of_nat (field_offset TYPE('a) f)\"\n\ndefinition\n size_of :: \"'a::c_type itself \\ nat\" where\n \"size_of t \\ size_td (typ_info_t TYPE('a))\"\n\ndefinition\n norm_bytes :: \"'a::c_type itself \\ normalisor\" where\n \"norm_bytes t \\ norm_tu (export_uinfo (typ_info_t t))\"\n\ndefinition to_bytes_p :: \"'a::c_type \\ byte list\" where\n \"to_bytes_p v \\ to_bytes v (replicate (size_of TYPE('a)) 0)\"\n\nprimrec\n align_td :: \"'a typ_desc \\ nat\" and\n align_td_struct :: \"'a typ_struct \\ nat\" and\n align_td_list :: \"'a typ_pair list \\ nat\" and\n align_td_pair :: \"'a typ_pair \\ nat\"\nwhere\n al0: \"align_td (TypDesc st nm) = align_td_struct st\"\n\n| al1: \"align_td_struct (TypScalar n algn d) = algn\"\n| al2: \"align_td_struct (TypAggregate xs) = align_td_list xs\"\n\n| al3: \"align_td_list [] = 0\"\n| al4: \"align_td_list (x#xs) = max (align_td_pair x) (align_td_list xs)\"\n\n| al5: \"align_td_pair (DTPair t n) = align_td t\"\n\n\ndefinition align_of :: \"'a::c_type itself \\ nat\" where\n \"align_of t \\ 2^(align_td (typ_info_t TYPE('a)))\"\n\ndefinition\n ptr_add :: \"('a::c_type) ptr \\ int \\ 'a ptr\" (infixl \"+\\<^sub>p\" 65)\nwhere\n \"ptr_add (a :: ('a::c_type) ptr) w \\\n Ptr (ptr_val a + of_int w * of_nat (size_of (TYPE('a))))\"\n\nlemma ptr_add_def':\n \"ptr_add (Ptr p :: ('a::c_type) ptr) n\n = (Ptr (p + of_int n * of_nat (size_of TYPE('a))))\"\n by (cases p, auto simp: ptr_add_def scast_id)\n\ndefinition\n ptr_sub :: \"('a::c_type) ptr \\ ('a::c_type) ptr \\ 32 signed word\" (infixl \"-\\<^sub>p\" 65)\nwhere\n \"ptr_sub (a :: ('a::c_type) ptr) p \\\n ucast (ptr_val a - ptr_val p) div of_nat (size_of (TYPE('a)))\"\n\ndefinition ptr_aligned :: \"'a::c_type ptr \\ bool\" where\n \"ptr_aligned p \\ align_of TYPE('a) dvd unat (ptr_val (p::'a ptr))\"\n\nprimrec\n td_set :: \"'a typ_desc \\ nat \\ ('a typ_desc \\ nat) set\" and\n td_set_struct :: \"'a typ_struct \\ nat \\ ('a typ_desc \\ nat) set\" and\n td_set_list :: \"'a typ_pair list \\ nat \\ ('a typ_desc \\ nat) set\" and\n td_set_pair :: \"'a typ_pair \\ nat \\ ('a typ_desc \\ nat) set\"\nwhere\n ts0: \"td_set (TypDesc st nm) m = {(TypDesc st nm,m)} \\ td_set_struct st m\"\n\n| ts1: \"td_set_struct (TypScalar n algn d) m = {}\"\n| ts2: \"td_set_struct (TypAggregate xs) m = td_set_list xs m\"\n\n| ts3: \"td_set_list [] m = {}\"\n| ts4: \"td_set_list (x#xs) m = td_set_pair x m \\ td_set_list xs (m + size_td (dt_fst x))\"\n\n| ts5: \"td_set_pair (DTPair t nm) m = td_set t m\"\n\n\ninstantiation typ_desc :: (type) ord\nbegin\n\ndefinition\n typ_tag_le_def: \"s \\ (t::'a typ_desc) \\ (\\n. (s,n) \\ td_set t 0)\"\ndefinition\n typ_tag_lt_def: \"s < (t::'a typ_desc) \\ s \\ t \\ s \\ t\"\ninstance ..\n\nend\n\n\ndefinition\n fd_cons_double_update :: \"'a field_desc \\ bool\"\nwhere\n \"fd_cons_double_update d \\\n (\\v bs bs'. length bs = length bs' \\ field_update d bs (field_update d bs' v) = field_update d bs v)\"\n\ndefinition\n fd_cons_update_access :: \"'a field_desc \\ nat \\ bool\"\nwhere\n \"fd_cons_update_access d n \\\n (\\v bs. length bs = n \\ field_update d (field_access d v bs) v = v)\"\n\ndefinition\n norm_desc :: \"'a field_desc \\ nat \\ (byte list \\ byte list)\"\nwhere\n \"norm_desc d n \\ \\bs. field_access d (field_update d bs undefined) (replicate n 0)\"\n\ndefinition\n fd_cons_length :: \"'a field_desc \\ nat \\ bool\"\nwhere\n \"fd_cons_length d n \\ \\v bs. length bs = n \\ length (field_access d v bs) = n\"\n\ndefinition\n fd_cons_access_update :: \"'a field_desc \\ nat \\ bool\"\nwhere\n \"fd_cons_access_update d n \\ \\bs bs' v v'. length bs = n \\\n length bs' = n \\\n field_access d (field_update d bs v) bs' = field_access d (field_update d bs v') bs'\"\n\n\ndefinition\n fd_cons_update_normalise :: \"'a field_desc \\ nat \\ bool\"\nwhere\n \"fd_cons_update_normalise d n \\\n (\\v bs. length bs=n \\ field_update d (norm_desc d n bs) v = field_update d bs v)\"\n\n\ndefinition\n fd_cons_desc :: \"'a field_desc \\ nat \\ bool\"\nwhere\n \"fd_cons_desc d n \\ fd_cons_double_update d \\\n fd_cons_update_access d n \\\n fd_cons_access_update d n \\\n fd_cons_length d n\"\n\ndefinition\n fd_cons :: \"'a typ_info \\ bool\"\nwhere\n \"fd_cons t \\ fd_cons_desc (field_desc t) (size_td t)\"\n\ndefinition\n fd_cons_struct :: \"'a typ_info_struct \\ bool\"\nwhere\n \"fd_cons_struct t \\ fd_cons_desc (field_desc_struct t) (size_td_struct t)\"\n\ndefinition\n fd_cons_list :: \"'a typ_info_pair list \\ bool\"\nwhere\n \"fd_cons_list t \\ fd_cons_desc (field_desc_list t) (size_td_list t)\"\n\ndefinition\n fd_cons_pair :: \"'a typ_info_pair \\ bool\"\nwhere\n \"fd_cons_pair t \\ fd_cons_desc (field_desc_pair t) (size_td_pair t)\"\n\n\ndefinition\n fa_fu_ind :: \"'a field_desc \\ 'a field_desc \\ nat \\ nat \\bool\"\nwhere\n \"fa_fu_ind d d' n n' \\ \\v bs bs'. length bs = n \\ length bs' = n' \\\n field_access d (field_update d' bs v) bs' = field_access d v bs'\"\n\ndefinition\n wf_fdp :: \"('a typ_info \\ qualified_field_name) set \\ bool\"\nwhere\n \"wf_fdp t \\ \\x m. (x,m) \\ t \\ (fd_cons x \\ (\\y n. (y,n) \\ t \\ \\ m \\ n \\ \\ n \\ m\n \\ fu_commutes (field_update (field_desc x)) (field_update (field_desc y)) \\\n fa_fu_ind (field_desc x) (field_desc y) (size_td y) (size_td x)))\"\n\nlemma wf_fdp_list:\n \"wf_fdp (xs \\ ys) \\ wf_fdp xs \\ wf_fdp ys\"\n by (auto simp: wf_fdp_def)\n\n\nprimrec\n wf_fd :: \"'a typ_info \\ bool\" and\n wf_fd_struct :: \"'a typ_info_struct \\ bool\" and\n wf_fd_list :: \"'a typ_info_pair list \\ bool\" and\n wf_fd_pair :: \"'a typ_info_pair \\ bool\"\nwhere\n wffd0: \"wf_fd (TypDesc ts n) = (wf_fd_struct ts)\"\n\n| wffd1: \"wf_fd_struct (TypScalar n algn d) = fd_cons_struct (TypScalar n algn d)\"\n| wffd2: \"wf_fd_struct (TypAggregate ts) = wf_fd_list ts\"\n\n| wffd3: \"wf_fd_list [] = True\"\n| wffd4: \"wf_fd_list (x#xs) = (wf_fd_pair x \\ wf_fd_list xs \\\n fu_commutes (update_ti_pair_t x) (update_ti_list_t xs) \\\n fa_fu_ind (field_desc_pair x) (field_desc_list xs) (size_td_list xs) (size_td_pair x)\\\n fa_fu_ind (field_desc_list xs) (field_desc_pair x) (size_td_pair x) (size_td_list xs))\"\n\n| wffd5: \"wf_fd_pair (DTPair x n) = wf_fd x\"\n\n\ndefinition\n tf_set :: \"'a typ_info \\ ('a typ_info \\ qualified_field_name) set\"\nwhere\n \"tf_set td \\ {(s,f) | s f. \\n. field_lookup td f 0 = Some (s,n)}\"\n\ndefinition\n tf_set_struct :: \"'a typ_info_struct \\ ('a typ_info \\ qualified_field_name) set\"\nwhere\n \"tf_set_struct td \\ {(s,f) | s f. \\n. field_lookup_struct td f 0 = Some (s,n)}\"\n\ndefinition\n tf_set_list :: \"'a typ_info_pair list \\ ('a typ_info \\ qualified_field_name) set\"\nwhere\n \"tf_set_list td \\ {(s,f) | s f. \\n. field_lookup_list td f 0 = Some (s,n)}\"\n\ndefinition\n tf_set_pair :: \"'a typ_info_pair \\ ('a typ_info \\ qualified_field_name) set\"\nwhere\n \"tf_set_pair td \\ {(s,f) | s f. \\n. field_lookup_pair td f 0 = Some (s,n)}\"\n\n\nrecord 'a leaf_desc =\n lf_fd :: \"'a field_desc\"\n lf_sz :: nat\n lf_fn :: qualified_field_name\n\nprimrec\n lf_set :: \"'a typ_info \\ qualified_field_name \\ 'a leaf_desc set\" and\n lf_set_struct :: \"'a typ_info_struct \\ qualified_field_name \\ 'a leaf_desc set\" and\n lf_set_list :: \"'a typ_info_pair list \\ qualified_field_name \\ 'a leaf_desc set\" and\n lf_set_pair :: \"'a typ_info_pair \\ qualified_field_name \\ 'a leaf_desc set\"\nwhere\n fds0: \"lf_set (TypDesc st nm) fn = lf_set_struct st fn\"\n\n| fds1: \"lf_set_struct (TypScalar n algn d) fn = {(\\ lf_fd = d, lf_sz = n, lf_fn = fn \\)}\"\n| fds2: \"lf_set_struct (TypAggregate xs) fn = lf_set_list xs fn\"\n\n| fds3: \"lf_set_list [] fn = {}\"\n| fds4: \"lf_set_list (x#xs) fn = lf_set_pair x fn \\ lf_set_list xs fn\"\n\n| fds5: \"lf_set_pair (DTPair t n) fn = lf_set t (fn@[n])\"\n\n\ndefinition\n wf_lf :: \"'a leaf_desc set \\ bool\"\nwhere\n \"wf_lf D \\ \\x. x \\ D \\ (fd_cons_desc (lf_fd x) (lf_sz x) \\ (\\y. y \\ D \\ lf_fn y \\ lf_fn x\n \\ fu_commutes (field_update (lf_fd x)) (field_update (lf_fd y)) \\\n fa_fu_ind (lf_fd x) (lf_fd y) (lf_sz y) (lf_sz x)))\"\n\ndefinition\n ti_ind :: \"'a leaf_desc set \\ 'a leaf_desc set \\ bool\"\nwhere\n \"ti_ind X Y \\ \\x y. x \\ X \\ y \\ Y \\ (\n fu_commutes (field_update (lf_fd x)) (field_update (lf_fd y)) \\\n fa_fu_ind (lf_fd x) (lf_fd y) (lf_sz y) (lf_sz x) \\\n fa_fu_ind (lf_fd y) (lf_fd x) (lf_sz x) (lf_sz y))\"\n\n\ndefinition\n t2d :: \"('a typ_info \\ qualified_field_name) \\ 'a leaf_desc\"\nwhere\n \"t2d x \\ \\ lf_fd = field_desc (fst x), lf_sz = size_td (fst x), lf_fn = snd x\\\"\n\n\ndefinition\n fd_consistent :: \"'a typ_info \\ bool\"\nwhere\n \"fd_consistent t \\ \\f s n. field_lookup t f 0 = Some (s,n)\n \\ fd_cons s\"\n\nclass wf_type = c_type +\n assumes wf_desc [simp]: \"wf_desc (typ_info_t TYPE('a::c_type))\"\n assumes wf_size_desc [simp]: \"wf_size_desc (typ_info_t TYPE('a::c_type))\"\n assumes wf_lf [simp]: \"wf_lf (lf_set (typ_info_t TYPE('a::c_type)) [])\"\n\ndefinition\n super_update_bs :: \"byte list \\ byte list \\ nat \\ byte list\"\nwhere\n \"super_update_bs v bs n \\ take n bs @ v @\n drop (n + length v) bs\"\n\ndefinition\n disj_fn :: \"qualified_field_name \\ qualified_field_name \\ bool\"\nwhere\n \"disj_fn s t \\ \\ s \\ t \\ \\ t \\ s\"\n\ndefinition\n fs_path :: \"qualified_field_name list \\ qualified_field_name set\"\nwhere\n \"fs_path xs \\ {x. \\k. k \\ set xs \\ x \\ k} \\ {x. \\k. k \\ set xs \\ k \\ x}\"\n\ndefinition\n field_names :: \"'a typ_desc \\ qualified_field_name set\"\nwhere\n \"field_names t \\ {f. field_lookup t f 0 \\ None}\"\n\ndefinition\n align_field :: \"'a typ_desc \\ bool\"\nwhere\n \"align_field ti \\ \\f s n. field_lookup ti f 0 = Some (s,n) \\\n 2^(align_td s) dvd n\"\n\nclass mem_type_sans_size = wf_type +\n assumes upd:\n \"length bs = size_of TYPE('a) \\\n update_ti_t (typ_info_t TYPE('a::c_type)) bs v\n = update_ti_t (typ_info_t TYPE('a)) bs w\"\n assumes align_size_of: \"align_of (TYPE('a::c_type)) dvd size_of TYPE('a)\"\n assumes align_field: \"align_field (typ_info_t TYPE('a::c_type))\"\n\n\nclass mem_type = mem_type_sans_size +\n assumes max_size: \"size_of (TYPE('a::c_type)) < addr_card\"\n\n\nprimrec\n aggregate :: \"'a typ_desc \\ bool\" and\n aggregate_struct :: \"'a typ_struct \\ bool\"\nwhere\n \"aggregate (TypDesc st tn) = aggregate_struct st\"\n\n| \"aggregate_struct (TypScalar n algn d) = False\"\n| \"aggregate_struct (TypAggregate ts) = True\"\n\nclass simple_mem_type = mem_type +\n assumes simple_tag: \"\\ aggregate (typ_info_t TYPE('a::c_type))\"\n\ndefinition\n field_of :: \"addr \\ 'a typ_desc \\ 'a typ_desc \\ bool\"\nwhere\n \"field_of q s t \\ (s,unat q) \\ td_set t 0\"\n\ndefinition\n field_of_t :: \"'a::c_type ptr \\ 'b::c_type ptr \\ bool\"\nwhere\n \"field_of_t p q \\ field_of (ptr_val p - ptr_val q) (typ_uinfo_t TYPE('a))\n (typ_uinfo_t TYPE('b))\"\n\ndefinition\n h_val :: \"heap_mem \\ 'a::c_type ptr \\ 'a\"\nwhere\n \"h_val h \\ \\p. from_bytes (heap_list h (size_of TYPE ('a))\n (ptr_val (p::'a ptr)))\"\n\nprimrec\n heap_update_list :: \"addr \\ byte list \\ heap_mem \\ heap_mem\"\nwhere\n heap_update_list_base: \"heap_update_list p [] h = h\"\n| heap_update_list_rec:\n \"heap_update_list p (x#xs) h = heap_update_list (p + 1) xs (h(p:= x))\"\n\ntype_synonym 'a typ_heap_g = \"'a ptr \\ 'a\"\n\n(* FIXME: now redundant with h_val *)\ndefinition\n lift :: \"heap_mem \\ 'a::c_type typ_heap_g\"\nwhere\n \"lift h \\ h_val h\"\n\ndefinition\n heap_update :: \"'a::c_type ptr \\ 'a \\ heap_mem \\ heap_mem\"\nwhere\n \"heap_update p v h \\ heap_update_list (ptr_val p) (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h\"\n\nfun\n fold_td' :: \"(typ_name \\ ('a \\ field_name) list \\ 'a) \\ 'a typ_desc \\ 'a\"\nwhere\nfot0: \"fold_td' (f,TypDesc st nm) = (case st of\n TypScalar n algn d \\ d |\n TypAggregate ts \\ f nm (map (\\x. case x of DTPair t n \\ (fold_td' (f,t),n)) ts))\"\n\n\ndefinition\n fold_td :: \"(typ_name \\ ('a \\ field_name) list \\ 'a) \\ 'a typ_desc \\ 'a\"\nwhere\n \"fold_td \\ \\f t. fold_td' (f,t)\"\n\ndeclare fold_td_def [simp add]\n\ndefinition\n fold_td_struct :: \"typ_name \\ (typ_name \\ ('a \\ field_name) list \\ 'a) \\ 'a typ_struct \\ 'a\"\nwhere\n \"fold_td_struct tn f st \\ (case st of\n TypScalar n algn d \\ d |\n TypAggregate ts \\ f tn (map (\\x. case x of DTPair t n \\ (fold_td' (f,t),n)) ts))\"\n\ndeclare fold_td_struct_def [simp add]\n\ndefinition\n fold_td_list :: \"typ_name \\ (typ_name \\ ('a \\ field_name) list \\ 'a) \\ 'a typ_pair list \\ 'a\"\nwhere\n \"fold_td_list tn f ts \\ f tn (map (\\x. case x of DTPair t n \\ (fold_td' (f,t),n)) ts)\"\n\ndeclare fold_td_list_def [simp add]\n\ndefinition\n fold_td_pair :: \"(typ_name \\ ('a \\ field_name) list \\ 'a) \\ 'a typ_pair \\ 'a\"\nwhere\n \"fold_td_pair f x \\ (case x of DTPair t n \\ fold_td' (f,t))\"\n\ndeclare fold_td_pair_def [simp add]\n\nfun\n map_td' :: \"(nat \\ nat \\ 'a \\ 'b) \\ 'a typ_desc \\ 'b typ_desc\"\nwhere\n \"map_td' (f,TypDesc st nm) = (TypDesc (case st of\n TypScalar n algn d \\ TypScalar n algn (f n algn d) |\n TypAggregate ts \\ TypAggregate (map (\\x. case x of DTPair t n \\ DTPair (map_td' (f,t)) n) ts)) nm)\"\n\ndefinition\n tnSum :: \"typ_name \\ (nat \\ field_name) list \\ nat\"\nwhere\n \"tnSum \\ \\tn ts. foldr (op + o fst) ts 0\"\n\ndefinition\n tnMax :: \"typ_name \\ (nat \\ field_name) list \\ nat\"\nwhere\n \"tnMax \\ \\tn ts. foldr (\\x y. max (fst x) y) ts 0\"\n\ndefinition\n wfd :: \"typ_name \\ (bool \\ field_name) list \\ bool\"\nwhere\n \"wfd \\ \\tn ts. distinct (map snd ts) \\ foldr (op \\) (map fst ts) True\"\n\ndefinition\n wfsd :: \"typ_name \\ (bool \\ field_name) list \\ bool\"\nwhere\n \"wfsd \\ \\tn ts. ts \\ [] \\ foldr (op \\) (map fst ts) True\"\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/umm_heap/CTypesDefs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.26143760118911036}} {"text": "theory Analyze_SQRL_Shorewall\nimports \n Iptables_Semantics.Parser\nbegin\n\n\nsection\\Example: SQRL Shorewall\\\n\n\nparse_iptables_save SQRL_fw=\"iptables-saveakachan\"\n\n\nthm SQRL_fw_def\nthm SQRL_fw_FORWARD_default_policy_def\n\nvalue[code] \"map (\\(c,rs). (c, map (quote_rewrite \\ common_primitive_rule_toString) rs)) SQRL_fw\"\n\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''smurflog''))\" by eval\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''logflags''))\" by eval\nlemma \"Semantics_Goto.terminal_chain (the ((map_of_string_ipv4 SQRL_fw) ''reject''))\" by eval\n\n(*12.942s*)\nvalue[code] \"Semantics_Goto.rewrite_Goto SQRL_fw\"\n\ndefinition \"unfolded = unfold_ruleset_FORWARD SQRL_fw_FORWARD_default_policy (map_of_string_ipv4 (Semantics_Goto.rewrite_Goto SQRL_fw))\"\n\n(*\n(*2174.839s elapsed time, 3308.410s cpu time, 161.539s GC time*)\nvalue[code] \"unfolded\"*)\n(*0.561s*)\nvalue[code] \"let x = unfolded in ()\" (*pretty printing is slow, not the unfolding! ML forces evaluation of unfolded!*)\n(*39.149s*)\nvalue[code] \"map (quote_rewrite \\ common_primitive_rule_toString) (unfolded)\"\n(*2.871s*)\nlemma \"length unfolded = 2649\" by eval\n\n\n(*17.554s*)\nvalue[code] \"map (quote_rewrite \\ common_primitive_rule_toString) (upper_closure unfolded)\"\nlemma \"length (upper_closure unfolded) = 1986\" by eval\n\n\nvalue[code] \"upper_closure (packet_assume_new unfolded)\"\n\n(*28.550s*)\nlemma \"length (lower_closure unfolded) = 5715\" by eval\n\nlemma \"check_simple_fw_preconditions (upper_closure unfolded) = False\" by eval\nlemma \"\\m \\ get_match`set (upper_closure (packet_assume_new unfolded)). normalized_nnf_match m\" by eval\n\nlemma \"\\m \\ get_match`set (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))). normalized_nnf_match m\" by eval\n\nlemma \"check_simple_fw_preconditions (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))\" by eval\nlemma \"length (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))) = 1389\" by eval\n(*22.240s*)\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded)))))\"\n\n(*25.480s*)\nvalue[code] \"map ipv4addr_wordinterval_toString (getParts (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new unfolded))))))\"\n\n(*43.702s*)\nlemma \"length (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))) = 5120\" by eval\n\n(*71.518s*)\nvalue[code] \"length (remdups_rev (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))))\" (*not smaller*)\n\nvalue[code] \"map ipv4addr_wordinterval_toString (getParts (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded))))))\"\n\nlemma \"simple_fw_valid (to_simple_firewall (lower_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded)))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall (upper_closure (optimize_matches abstract_for_simple_firewall (lower_closure (packet_assume_new unfolded)))))\" by eval\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Examples/SQRL_Shorewall/Analyze_SQRL_Shorewall.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512488, "lm_q2_score": 0.4035668537353746, "lm_q1q2_score": 0.26142989416247714}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Cogent\nimports Util\nbegin\n\n\nsection {* Utility lemmas, probably should be in a separate theory *}\n\nlemma map_snd_app [simp]: \nshows \"map (snd \\ (\\ (a , b). (a , f b))) l = map (f \\ snd) l\" \nby (induct l, auto)\n\nlemma map_snd_ignore [simp]: \nshows \"map (snd \\ (\\ (a , b). (f a , b))) l = map (snd) l\" \nby (induct l, auto)\n\nlemma map_fst_app [simp]:\nshows \"map (fst \\ (\\ (a , b). (f a , b))) l = map (f \\ fst) l\" \nby (induct l, auto)\n\nlemma map_fst_ignore [simp]:\nshows \"map (fst \\ (\\ (a , b). (a , f b))) l = map fst l\" \nby (induct l, auto)\n\nlemma map_fst_update:\nassumes \"ts ! f = (t, x)\"\nand \"f < length ts\"\nshows \"map fst (ts[f := (t,x')]) = map fst ts\"\nproof -\nfrom assms have \"map fst ts ! f = t\" by (clarsimp)\nthen show ?thesis by (auto simp add: map_update)\nqed\n\nlemma map_zip [simp]:\nshows \"map (\\ (a , b). (f a, g b)) (zip as bs) = zip (map f as) (map g bs)\"\nby (induct as arbitrary:bs, simp, case_tac bs, simp_all)\n\nlemma distinct_fst:\nassumes \"distinct (map fst ls)\"\nand \"(a, b) \\ set ls\"\nand \"(a, b') \\ set ls\"\nshows \"b = b'\"\nusing assms\n apply (clarsimp simp: set_conv_nth distinct_conv_nth)\n apply (drule_tac x = i in spec, simp)\n apply (drule_tac x = ia in spec, simp)\n apply (case_tac \"ls ! i\")\n apply (case_tac \"ls ! ia\")\n apply (auto)\ndone\n\nlemma map_filter_fst:\nshows \"map (\\(c, t). (c, f t)) [x\\ts . P (fst x)]\n = [x \\ map (\\(c,t). (c, f t)) ts. P (fst x)]\"\nproof -\nhave \"(\\x. P (fst x)) \\ (\\(c, t). (c, f t)) = (\\x. P (fst x))\"\n by (rule ext, case_tac x, simp)\nthen show ?thesis by (simp add: filter_map)\nqed\n\nlemma set_subset_map:\nassumes \"set a \\ set b\"\nshows \"set (map f a) \\ set (map f b)\"\nusing assms by auto\n\n\nlemma prod_in_set:\nassumes \"(a, b) \\ set l\"\nshows \"a \\ set (map fst l)\"\nand \"b \\ set (map snd l)\"\nusing assms by (force intro: imageI)+ \n\nlemma filter_fst_ignore:\nshows \"filter (\\ x. P (fst x)) (map (\\(a,b). (a, f b)) ls) \n = map (\\(a,b). (a, f b)) (filter (\\ x. P (fst x)) ls)\"\nby (induct_tac ls, auto)\n\nsection {* Terms and Types of Cogent *}\n\ntype_synonym name = string\n\ntype_synonym index = nat\n\ntype_synonym field = nat\n\ndatatype num_type = U8 | U16 | U32 | U64 \n\ndatatype prim_type = Num num_type | Bool | String\n\ndatatype sigil = ReadOnly | Writable | Unboxed\n\n\ndatatype prim_op \n = Plus num_type \n | Minus num_type \n | Times num_type \n | Divide num_type \n | Mod num_type\n | Not | And | Or\n | Gt num_type\n | Lt num_type \n | Le num_type \n | Ge num_type \n | Eq prim_type \n | NEq prim_type\n | BitAnd num_type \n | BitOr num_type \n | BitXor num_type \n | LShift num_type\n | RShift num_type\n | Complement num_type\n\n\ndatatype type = TVar index\n | TVarBang index\n | TCon name \"type list\" sigil\n | TFun type type \n | TPrim prim_type\n | TSum \"(name \\ type) list\"\n | TProduct \"type\" \"type\"\n | TRecord \"(type \\ bool) list\" sigil\n | TUnit\n\ndatatype lit = LBool bool\n | LU8 \"8 word\"\n | LU16 \"16 word\"\n | LU32 \"32 word\"\n | LU64 \"64 word\"\n (* etc *)\n\nfun cast_to :: \"num_type \\ lit \\ lit option\" where\n \"cast_to U8 (LU8 x) = Some (LU8 x)\"\n| \"cast_to U16 (LU8 x) = Some (LU16 (ucast x))\"\n| \"cast_to U16 (LU16 x) = Some (LU16 x)\"\n| \"cast_to U32 (LU8 x) = Some (LU32 (ucast x))\"\n| \"cast_to U32 (LU16 x) = Some (LU32 (ucast x))\"\n| \"cast_to U32 (LU32 x) = Some (LU32 x)\"\n| \"cast_to U64 (LU8 x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU16 x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU32 x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU64 x) = Some (LU64 x)\"\n\ndatatype 'f expr = Var index\n | AFun 'f \"type list\"\n | Fun \"'f expr\" \"type list\"\n | Prim prim_op \"'f expr list\"\n | App \"'f expr\" \"'f expr\"\n | Con \"(name \\ type) list\" name \"'f expr\" (* promotes \"inlined\" *)\n | Promote \"(name \\ type) list\" \"'f expr\"\n | Struct \"type list\" \"'f expr list\"\n | Member \"'f expr\" field \n | Unit\n | Lit lit\n | Cast num_type \"'f expr\"\n | Tuple \"'f expr\" \"'f expr\"\n | Put \"'f expr\" field \"'f expr\"\n | Let \"'f expr\" \"'f expr\"\n | LetBang \"index set\" \"'f expr\" \"'f expr\"\n | Case \"'f expr\" name \"'f expr\" \"'f expr\"\n | Esac \"'f expr\"\n | If \"'f expr\" \"'f expr\" \"'f expr\"\n | Take \"'f expr\" field \"'f expr\"\n | Split \"'f expr\" \"'f expr\"\n\ndatatype kind_comp = D | S | E\n\ntype_synonym kind = \"kind_comp set\"\n\ntype_synonym poly_type = \"kind list \\ type \\ type\"\n\ntype_synonym 'v env = \"'v list\"\n\ntype_synonym 'a substitution = \"'a list\"\n\nsection {* Kinding rules *}\n\nprimrec sigil_kind :: \"sigil \\ kind\" where \n \"sigil_kind ReadOnly = {D,S}\"\n| \"sigil_kind Writable = {E}\"\n| \"sigil_kind Unboxed = {D,S,E}\"\n\n\n\ninductive kinding :: \"kind env \\ type \\ kind \\ bool\" (\"_ \\ _ :\\ _\" [30,0,20] 60) \n and kinding_all :: \"kind env \\ type list \\ kind \\ bool\" (\"_ \\* _ :\\ _\" [30,0,20] 60) \n and kinding_record :: \"kind env \\ (type \\ bool) list \\ kind \\ bool\" (\"_ \\* _ :\\r _\" [30,0,20] 60) where\n\n kind_tvar : \"\\ k \\ (K ! i) ; i < length K \\ \\ K \\ TVar i :\\ k\"\n| kind_tvarb : \"\\ k \\ {D, S} ; i < length K \\ \\ K \\ TVarBang i :\\ k\"\n| kind_tcon : \"\\ K \\* ts :\\ k ; k \\ sigil_kind s \\ \\ K \\ TCon n ts s :\\ k\"\n| kind_tfun : \"\\ K \\ a :\\ ka ; K \\ b :\\ kb \\ \\ K \\ TFun a b :\\ k\"\n| kind_tprim : \"K \\ TPrim p :\\ k\"\n| kind_tsum : \"\\ distinct (map fst ts); K \\* map snd ts :\\ k \\ \\ K \\ TSum ts :\\ k\"\n| kind_tprod : \"\\ K \\ t :\\ k; K \\ u :\\ k \\ \\ K \\ TProduct t u :\\ k\"\n| kind_trec : \"\\ K \\* ts :\\r k ; k \\ sigil_kind s \\ \\ K \\ TRecord ts s :\\ k\"\n| kind_tunit : \"K \\ TUnit :\\ k\"\n\n| kind_all_empty : \"K \\* [] :\\ k\"\n| kind_all_cons : \"\\ K \\ x :\\ k ; K \\* xs :\\ k \\ \\ K \\* (x # xs) :\\ k\"\n\n| kind_record_empty : \"K \\* [] :\\r k\"\n| kind_record_cons1 : \"\\ K \\ x :\\ k ; K \\* xs :\\r k \\ \\ K \\* ((x,False) # xs) :\\r k\"\n| kind_record_cons2 : \"\\ K \\ x :\\ k' ; K \\* xs :\\r k \\ \\ K \\* ((x,True) # xs) :\\r k\"\n\ninductive_cases kind_tvarE [elim] : \"K \\ TVar i :\\ k\"\ninductive_cases kind_tvarbE [elim] : \"K \\ TVarBang i :\\ k\"\ninductive_cases kind_tconE [elim] : \"K \\ TCon n ts s :\\ k\"\ninductive_cases kind_tfunE [elim] : \"K \\ TFun a b :\\ k\"\ninductive_cases kind_tsumE [elim] : \"K \\ TSum ts :\\ k\"\ninductive_cases kind_tprodE [elim] : \"K \\ TProduct t u :\\ k\"\ninductive_cases kind_trecE [elim] : \"K \\ TRecord ts s :\\ k\"\ninductive_cases kind_all_emptyE [elim] : \"K \\* [] :\\ k\"\ninductive_cases kind_all_consE [elim] : \"K \\* (x # xs) :\\ k\"\ninductive_cases kind_record_emptyE [elim] : \"K \\* [] :\\r k\"\ninductive_cases kind_record_consE [elim] : \"K \\* (x # xs) :\\r k\"\ninductive_cases kind_record_cons1E [elim] : \"K \\* ((x,False) # xs) :\\r k\"\ninductive_cases kind_record_cons2E [elim] : \"K \\* ((x,True) # xs) :\\r k\"\n\n\ndefinition type_wellformed :: \"kind env \\ type \\ bool\" (\"_ \\ _ wellformed\" [30,20] 60) where\n \"K \\ \\ wellformed \\ \\k. K \\ \\ :\\ k\" \n\ndeclare type_wellformed_def [simp]\n\n\ndefinition type_wellformed_all :: \"kind env \\ type list \\ bool\" (\"_ \\* _ wellformed\"[30,20]60) where\n \"K \\* \\s wellformed \\ \\k. K \\* \\s :\\ k\" \n\ndeclare type_wellformed_all_def [simp]\n\ndefinition proc_ctx_wellformed :: \"('f \\ poly_type) \\ bool\" where\n \"proc_ctx_wellformed \\ = (\\ f. let (K, \\i, \\o) = \\ f in K \\ TFun \\i \\o wellformed )\"\n\nsection {* Observation and type instantiation *}\n\nprimrec bang_sigil :: \"sigil \\ sigil\" where \n \"bang_sigil (ReadOnly) = ReadOnly\"\n| \"bang_sigil (Writable) = ReadOnly\"\n| \"bang_sigil (Unboxed) = Unboxed\"\n\nfun bang :: \"type \\ type\" where \n \"bang (TVar i) = TVarBang i\"\n| \"bang (TVarBang i) = TVarBang i\"\n| \"bang (TCon n ts s) = TCon n (map bang ts) (bang_sigil s)\"\n| \"bang (TFun a b) = TFun a b\"\n| \"bang (TPrim p) = TPrim p\"\n| \"bang (TSum ps) = TSum (map (\\ (c, t). (c, bang t)) ps)\"\n| \"bang (TProduct t u) = TProduct (bang t) (bang u)\"\n| \"bang (TRecord ts s) = TRecord (map (\\ (t, b). (bang t, b)) ts) (bang_sigil s)\"\n| \"bang (TUnit) = TUnit\"\n\n\nfun instantiate :: \"type substitution \\ type \\ type\" where \n \"instantiate \\ (TVar i) = (if i < length \\ then \\ ! i else TVar i)\"\n| \"instantiate \\ (TVarBang i) = (if i < length \\ then bang (\\ ! i) else TVarBang i)\"\n| \"instantiate \\ (TCon n ts s) = TCon n (map (instantiate \\) ts) s\"\n| \"instantiate \\ (TFun a b) = TFun (instantiate \\ a) (instantiate \\ b)\"\n| \"instantiate \\ (TPrim p) = TPrim p\"\n| \"instantiate \\ (TSum ps) = TSum (map (\\ (c, t). (c, instantiate \\ t)) ps)\"\n| \"instantiate \\ (TProduct t u) = TProduct (instantiate \\ t) (instantiate \\ u)\"\n| \"instantiate \\ (TRecord ts s) = TRecord (map (\\ (t, b). (instantiate \\ t, b)) ts) s\"\n| \"instantiate \\ (TUnit) = TUnit\"\n\nfun specialise :: \"type substitution \\ 'f expr \\ 'f expr\" where \n \"specialise \\ (Var i) = Var i\"\n| \"specialise \\ (Fun f ts) = Fun f (map (instantiate \\) ts)\"\n| \"specialise \\ (AFun f ts) = AFun f (map (instantiate \\) ts)\"\n| \"specialise \\ (Prim p es) = Prim p (map (specialise \\) es)\"\n| \"specialise \\ (App a b) = App (specialise \\ a) (specialise \\ b)\"\n| \"specialise \\ (Con as t e) = Con (map (\\ (c,t). (c, instantiate \\ t)) as) t (specialise \\ e)\" \n| \"specialise \\ (Promote as e) = Promote (map (\\ (c,t). (c, instantiate \\ t)) as) (specialise \\ e)\"\n| \"specialise \\ (Struct ts vs) = Struct (map (instantiate \\) ts) (map (specialise \\) vs)\"\n| \"specialise \\ (Member v f) = Member (specialise \\ v) f\"\n| \"specialise \\ (Unit) = Unit\"\n| \"specialise \\ (Cast t e) = Cast t (specialise \\ e)\"\n| \"specialise \\ (Lit v) = Lit v\"\n| \"specialise \\ (Tuple a b) = Tuple (specialise \\ a) (specialise \\ b)\"\n| \"specialise \\ (Put e f e') = Put (specialise \\ e) f (specialise \\ e')\"\n| \"specialise \\ (Let e e') = Let (specialise \\ e) (specialise \\ e')\"\n| \"specialise \\ (LetBang vs e e') = LetBang vs (specialise \\ e) (specialise \\ e')\"\n| \"specialise \\ (Case e t a b) = Case (specialise \\ e) t (specialise \\ a) (specialise \\ b)\"\n| \"specialise \\ (Esac e) = Esac (specialise \\ e)\"\n| \"specialise \\ (If c t e) = If (specialise \\ c) (specialise \\ t) (specialise \\ e)\"\n| \"specialise \\ (Take e f e') = Take (specialise \\ e) f (specialise \\ e')\"\n| \"specialise \\ (Split v va) = Split (specialise \\ v) (specialise \\ va)\"\n\n\nsection {* Contexts *}\n \ntype_synonym ctx = \"type option env\"\n\ndefinition empty :: \"nat \\ ctx\" where \n \"empty \\ (\\ x. replicate x None)\"\n\ndefinition singleton :: \"nat \\ index \\ type \\ ctx\" where \n \"singleton n i t \\ (empty n)[i := Some t]\"\n\ndeclare singleton_def [simp]\ndefinition instantiate_ctx :: \"type substitution \\ ctx \\ ctx\" where\n \"instantiate_ctx \\ \\ \\ map (map_option (instantiate \\)) \\\"\n\ninductive split_comp :: \"kind env \\ type option \\ type option \\ type option \\ bool\"\n (\"_ \\ _ \\ _ \\ _\" [30,0,0,20] 60) where\n none : \"K \\ None \\ None \\ None\"\n| left : \"\\ K \\ t :\\ k \\ \\ K \\ Some t \\ Some t \\ None\"\n| right : \"\\ K \\ t :\\ k \\ \\ K \\ Some t \\ None \\ (Some t)\"\n| share : \"\\ K \\ t :\\ k ; S \\ k \\ \\ K \\ Some t \\ Some t \\ Some t\" \n\ninductive split :: \"kind env \\ ctx \\ ctx \\ ctx \\ bool\" (\"_ \\ _ \\ _ | _\" [30,0,0,20] 60) where\n split_empty : \"K \\ [] \\ [] | []\"\n| split_cons : \"\\ K \\ x \\ a \\ b ; K \\ xs \\ as | bs \\ \\ K \\ (x # xs) \\ (a # as) | (b # bs)\"\n\ndefinition pred :: \"nat \\ nat\" where\n \"pred n \\ (case n of Suc n' \\ n')\"\n\ninductive split_bang :: \"kind env \\ index set \\ ctx \\ ctx \\ ctx \\ bool\" where \n split_bang_empty : \"split_bang K is [] [] []\"\n| split_bang_cons : \"\\ 0 \\ is \n ; K \\ x \\ a \\ b\n ; split_bang K (pred ` is) xs as bs\n \\ \\ split_bang K is (x # xs) (a # as) (b # bs) \"\n| split_bang_bang : \"\\ 0 \\ is \n ; is' = Set.remove (0 :: index) is\n ; split_bang K (pred ` is') xs as bs\n \\ \\ split_bang K is (Some x # xs) (Some (bang x) # as) (Some x # bs)\"\n\n\ninductive weakening_comp :: \"kind env \\ type option \\ type option \\ bool\" where\n none : \"weakening_comp K None None\"\n| keep : \"\\ K \\ t :\\ k \\ \\ weakening_comp K (Some t) (Some t)\"\n| drop : \"\\ K \\ t :\\ k ; D \\ k \\ \\ weakening_comp K (Some t) None\"\n\ndefinition weakening :: \"kind env \\ ctx \\ ctx \\ bool\" (\"_ \\ _ \\w _\" [30,0,20] 60) where \n \"weakening \\ (\\K. list_all2 (weakening_comp K))\"\n\ndefinition is_consumed :: \"kind env \\ ctx \\ bool\" (\"_ \\ _ consumed\" [30,20] 60 ) where \n \"K \\ \\ consumed \\ K \\ \\ \\w empty (length \\)\" \n\ndeclare is_consumed_def [simp]\n\nsection {* Built-in types *}\n\nprimrec prim_op_type :: \"prim_op \\ prim_type list \\ prim_type\" where \n \"prim_op_type (Plus t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Times t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Minus t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Divide t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Mod t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitAnd t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitOr t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitXor t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (LShift t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (RShift t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Complement t) = ([Num t], Num t)\"\n| \"prim_op_type (Gt t) = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Lt t) = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Le t) = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Ge t) = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Eq t) = ([t , t ], Bool )\"\n| \"prim_op_type (NEq t) = ([t , t ], Bool )\"\n| \"prim_op_type (And) = ([Bool , Bool ], Bool )\"\n| \"prim_op_type (Or) = ([Bool , Bool ], Bool )\"\n| \"prim_op_type (Not) = ([Bool], Bool )\"\n\nprimrec lit_type :: \"lit \\ prim_type\" where \n \"lit_type (LBool _) = Bool\" \n| \"lit_type (LU8 _) = Num U8\" \n| \"lit_type (LU16 _) = Num U16\" \n| \"lit_type (LU32 _) = Num U32\" \n| \"lit_type (LU64 _) = Num U64\"\n\nfun upcast_valid :: \"num_type \\ num_type \\ bool\" where\n \"upcast_valid U8 U8 = True\"\n| \"upcast_valid U8 U16 = True\"\n| \"upcast_valid U8 U32 = True\"\n| \"upcast_valid U8 U64 = True\"\n| \"upcast_valid U16 U16 = True\"\n| \"upcast_valid U16 U32 = True\"\n| \"upcast_valid U16 U64 = True\"\n| \"upcast_valid U32 U32 = True\"\n| \"upcast_valid U32 U64 = True\"\n| \"upcast_valid U64 U64 = True\"\n| \"upcast_valid _ _ = False\"\n\nprimrec prim_lbool where\n \"prim_lbool (LBool b) = b\"\n| \"prim_lbool (LU8 w) = False\"\n| \"prim_lbool (LU16 w) = False\"\n| \"prim_lbool (LU32 w) = False\"\n| \"prim_lbool (LU64 w) = False\"\n\ndefinition prim_word_op\n where prim_word_op_def[simp]:\n \"prim_word_op f8 f16 f32 f64 xs = (case (take 2 xs) of\n [LU8 x, LU8 y] \\ LU8 (f8 x y)\n | [LU16 x, LU16 y] \\ LU16 (f16 x y)\n | [LU32 x, LU32 y] \\ LU32 (f32 x y)\n | [LU64 x, LU64 y] \\ LU64 (f64 x y)\n | _ \\ LBool False)\"\n\ndefinition prim_word_comp\n where prim_word_comp_def[simp]:\n \"prim_word_comp f8 f16 f32 f64 xs = (case (take 2 xs) of\n [LU8 x, LU8 y] \\ LBool (f8 x y)\n | [LU16 x, LU16 y] \\ LBool (f16 x y)\n | [LU32 x, LU32 y] \\ LBool (f32 x y)\n | [LU64 x, LU64 y] \\ LBool (f64 x y)\n | _ \\ LBool False)\"\n\nprimrec eval_prim_op :: \"prim_op \\ lit list \\ lit\"\nwhere\n \"eval_prim_op Not xs = LBool (\\ prim_lbool (hd xs))\"\n | \"eval_prim_op And xs = LBool (prim_lbool (hd xs) \\ prim_lbool (xs ! 1))\"\n | \"eval_prim_op Or xs = LBool (prim_lbool (hd xs) \\ prim_lbool (xs ! 1))\"\n | \"eval_prim_op (Eq _) xs = LBool (hd xs = xs ! 1)\"\n | \"eval_prim_op (NEq _) xs = LBool (hd xs \\ xs ! 1)\"\n | \"eval_prim_op (Plus _) xs = prim_word_op (op +) (op +) (op +) (op +) xs\"\n | \"eval_prim_op (Minus _) xs = prim_word_op (op -) (op -) (op -) (op -) xs\"\n | \"eval_prim_op (Times _) xs = prim_word_op (op *) (op *) (op *) (op *) xs\"\n | \"eval_prim_op (Divide _) xs = prim_word_op checked_div checked_div checked_div checked_div xs\"\n | \"eval_prim_op (Mod _) xs = prim_word_op checked_mod checked_mod checked_mod checked_mod xs\"\n | \"eval_prim_op (Gt _) xs = prim_word_comp greater greater greater greater xs\"\n | \"eval_prim_op (Lt _) xs = prim_word_comp less less less less xs\"\n | \"eval_prim_op (Le _) xs = prim_word_comp less_eq less_eq less_eq less_eq xs\"\n | \"eval_prim_op (Ge _) xs = prim_word_comp greater_eq greater_eq greater_eq greater_eq xs\"\n | \"eval_prim_op (BitAnd _) xs = prim_word_op bitAND bitAND bitAND bitAND xs\"\n | \"eval_prim_op (BitOr _) xs = prim_word_op bitOR bitOR bitOR bitOR xs\"\n | \"eval_prim_op (BitXor _) xs = prim_word_op bitXOR bitXOR bitXOR bitXOR xs\"\n | \"eval_prim_op (LShift _) xs = prim_word_op (checked_shift shiftl) (checked_shift shiftl)\n (checked_shift shiftl) (checked_shift shiftl) xs\"\n | \"eval_prim_op (RShift _) xs = prim_word_op (checked_shift shiftr) (checked_shift shiftr)\n (checked_shift shiftr) (checked_shift shiftr) xs\"\n | \"eval_prim_op (Complement _) xs = prim_word_op (\\x y. bitNOT x) (\\x y. bitNOT x)\n (\\x y. bitNOT x) (\\x y. bitNOT x) [hd xs, hd xs]\"\n\nlemma eval_prim_op_lit_type:\n \"prim_op_type pop = (\\s, \\) \\ map lit_type xs = \\s\n \\ lit_type (eval_prim_op pop xs) = \\\"\n by (cases pop, auto split: lit.split)\n\nsection {* Typing rules *}\n\ninductive typing :: \"('f \\ poly_type) \\ kind env \\ ctx \\ 'f expr \\ type \\ bool\" \n (\"_, _, _ \\ _ : _\" [30,0,0,0,20] 60)\n and typing_all :: \"('f \\ poly_type) \\ kind env \\ ctx \\ 'f expr list \\ type list \\ bool\"\n (\"_, _, _ \\* _ : _\" [30,0,0,0,20] 60) where\n\n typing_var : \"\\ K \\ \\ \\w singleton (length \\) i t \n ; i < length \\\n \\ \\ \\, K, \\ \\ Var i : t\"\n\n| typing_afun : \"\\ \\ f = (K', t, u)\n ; list_all2 (kinding K) ts K' \n ; K' \\ TFun t u wellformed\n ; K \\ \\ consumed\n \\ \\ \\, K, \\ \\ AFun f ts : instantiate ts (TFun t u)\"\n\n| typing_fun : \"\\ \\, K', [Some t] \\ f : u \n ; K \\ \\ consumed\n ; K' \\ t wellformed\n ; list_all2 (kinding K) ts K'\n \\ \\ \\, K, \\ \\ Fun f ts : instantiate ts (TFun t u)\"\n\n| typing_app : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ a : TFun x y\n ; \\, K, \\2 \\ b : x \n \\ \\ \\, K, \\ \\ App a b : y\"\n\n| typing_con : \"\\ \\, K, \\ \\ x : t; (tag,t) \\ set ts \n ; K \\* (map snd ts) wellformed\n ; distinct (map fst ts)\n \\ \\ \\, K, \\ \\ Con ts tag x : TSum ts\"\n\n| typing_prom : \"\\ \\, K, \\ \\ x : TSum ts\n ; set ts \\ set ts' \n ; K \\* (map snd ts') wellformed\n ; distinct (map fst ts')\n \\ \\ \\, K, \\ \\ Promote ts' x : TSum ts'\"\n\n| typing_cast : \"\\ \\, K, \\ \\ e : TPrim (Num \\)\n ; upcast_valid \\ \\' \n \\ \\ \\, K, \\ \\ Cast \\' e : TPrim (Num \\')\"\n\n| typing_tuple : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ t : T \n ; \\, K, \\2 \\ u : U\n \\ \\ \\, K, \\ \\ Tuple t u : TProduct T U\"\n\n| typing_split : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ x : TProduct t u\n ; \\, K, (Some t)#(Some u)#\\2 \\ y : t'\n \\ \\ \\, K, \\ \\ Split x y : t'\" \n\n| typing_let : \"\\ K \\ \\ \\ \\1 | \\2 \n ; \\, K, \\1 \\ x : t\n ; \\, K, (Some t # \\2) \\ y : u\n \\ \\ \\, K, \\ \\ Let x y : u\"\n\n| typing_letb : \"\\ split_bang K is \\ \\1 \\2\n ; \\, K, \\1 \\ x : t\n ; \\, K, (Some t # \\2) \\ y : u\n ; K \\ t :\\ k\n ; E \\ k\n \\ \\ \\, K, \\ \\ LetBang is x y : u\"\n\n| typing_case : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ x : TSum ts\n ; (tag, t) \\ set ts\n ; \\, K, (Some t # \\2) \\ a : u\n ; \\, K, (Some (TSum (filter (\\ x. fst x \\ tag) ts)) # \\2) \\ b : u\n \\ \\ \\, K, \\ \\ Case x tag a b : u\" \n\n| typing_esac : \"\\ \\, K, \\ \\ x : TSum [(tag,t)]\n \\ \\ \\, K, \\ \\ Esac x : t\"\n\n| typing_if : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ x : TPrim Bool\n ; \\, K, \\2 \\ a : t\n ; \\, K, \\2 \\ b : t\n \\ \\ \\, K, \\ \\ If x a b : t\"\n\n| typing_prim : \"\\ \\, K, \\ \\* args : map TPrim ts \n ; prim_op_type oper = (ts,t)\n \\ \\ \\, K, \\ \\ Prim oper args : TPrim t\"\n\n| typing_lit : \"\\ K \\ \\ consumed\n \\ \\ \\, K, \\ \\ Lit l : TPrim (lit_type l)\" \n\n| typing_unit : \"\\ K \\ \\ consumed\n \\ \\ \\, K, \\ \\ Unit : TUnit\"\n\n| typing_struct : \"\\ \\, K, \\ \\* es : ts\n \\ \\ \\, K, \\ \\ Struct ts es : TRecord (zip ts (replicate (length ts) False)) Unboxed\"\n\n| typing_member : \"\\ \\, K, \\ \\ e : TRecord ts s\n ; K \\ TRecord ts s :\\ k\n ; S \\ k\n ; f < length ts\n ; ts ! f = (t, False)\n \\ \\ \\, K, \\ \\ Member e f : t\"\n\n| typing_take : \"\\ K \\ \\ \\ \\1 | \\2 \n ; \\, K, \\1 \\ e : TRecord ts s\n ; s \\ ReadOnly\n ; f < length ts\n ; ts ! f = (t, False)\n ; K \\ t :\\ k\n ; S \\ k \\ taken\n ; \\, K, (Some t # Some (TRecord (ts [f := (t,taken)]) s) # \\2) \\ e' : u\n \\ \\ \\, K, \\ \\ Take e f e' : u\"\n\n| typing_put : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ e : TRecord ts s\n ; s \\ ReadOnly\n ; f < length ts\n ; ts ! f = (t, taken)\n ; K \\ t :\\ k\n ; D \\ k \\ taken\n ; \\, K, \\2 \\ e' : t\n \\ \\ \\, K, \\ \\ Put e f e' : TRecord (ts [f := (t,False)]) s\"\n\n| typing_all_empty : \"\\, K, empty n \\* [] : []\"\n\n| typing_all_cons : \"\\ K \\ \\ \\ \\1 | \\2\n ; \\, K, \\1 \\ e : t\n ; \\, K, \\2 \\* es : ts\n \\ \\ \\, K, \\ \\* (e # es) : (t # ts)\"\n\ninductive_cases typing_num [elim]: \"\\, K, \\ \\ e : TPrim (Num \\)\"\ninductive_cases typing_bool [elim]: \"\\, K, \\ \\ e : TPrim Bool\"\ninductive_cases typing_varE [elim]: \"\\, K, \\ \\ Var i : \\\"\ninductive_cases typing_appE [elim]: \"\\, K, \\ \\ App x y : \\\"\ninductive_cases typing_litE [elim]: \"\\, K, \\ \\ Lit l : \\\"\ninductive_cases typing_funE [elim]: \"\\, K, \\ \\ Fun f ts : \\\"\ninductive_cases typing_afunE [elim]: \"\\, K, \\ \\ AFun f ts : \\\"\ninductive_cases typing_ifE [elim]: \"\\, K, \\ \\ If c t e : \\\"\ninductive_cases typing_conE [elim]: \"\\, K, \\ \\ Con ts t e : \\\"\ninductive_cases typing_unitE [elim]: \"\\, K, \\ \\ Unit : \\\"\ninductive_cases typing_promE [elim]: \"\\, K, \\ \\ Promote ts e : \\\"\ninductive_cases typing_primE [elim]: \"\\, K, \\ \\ Prim p es : \\\"\ninductive_cases typing_memberE [elim]: \"\\, K, \\ \\ Member e f : \\\"\ninductive_cases typing_tupleE [elim]: \"\\, K, \\ \\ Tuple a b : \\\"\ninductive_cases typing_caseE [elim]: \"\\, K, \\ \\ Case x t m n : \\\"\ninductive_cases typing_esacE [elim]: \"\\, K, \\ \\ Esac e : \\\"\ninductive_cases typing_castE [elim]: \"\\, K, \\ \\ Cast t e : \\\"\ninductive_cases typing_letE [elim]: \"\\, K, \\ \\ Let a b : \\\"\ninductive_cases typing_structE [elim]: \"\\, K, \\ \\ Struct ts es : \\\"\ninductive_cases typing_letbE [elim]: \"\\, K, \\ \\ LetBang vs a b : \\\"\ninductive_cases typing_takeE [elim]: \"\\, K, \\ \\ Take x f e : \\\"\ninductive_cases typing_putE [elim]: \"\\, K, \\ \\ Put x f e : \\\"\ninductive_cases typing_splitE [elim]: \"\\, K, \\ \\ Split x e : \\\"\ninductive_cases typing_all_emptyE [elim]: \"\\, K, \\ \\* [] : \\s\"\ninductive_cases typing_all_consE [elim]: \"\\, K, \\ \\* (x # xs) : \\s\"\n\nsection {* Syntax structural judgements *}\n\nsubsection {* A-normal form *}\n\ninductive atom ::\"'f expr \\ bool\" where \n \"atom (Var x)\"\n| \"atom (Fun f ts)\"\n| \"atom (AFun f ts)\"\n| \"atom (Prim p (map Var is))\"\n| \"atom (Con ts n (Var x))\"\n| \"atom (Promote ts (Var x))\"\n| \"atom (Struct ts (map Var is))\"\n| \"atom (Cast t (Var x))\"\n| \"atom (Member (Var x) f)\"\n| \"atom Unit\"\n| \"atom (Lit l)\"\n| \"atom (Tuple (Var x) (Var y))\"\n| \"atom (Esac (Var x))\"\n| \"atom (App (Var a) (Var b))\"\n| \"atom (App (Fun f ts) (Var b))\"\n| \"atom (App (AFun f ts) (Var b))\"\n| \"atom (Put (Var x) f (Var y))\"\n\ninductive a_normal :: \"'f expr \\ bool\" where \n \"\\ atom x \\ \\ a_normal x\"\n| \"\\ atom x ; a_normal y \\ \\ a_normal (Let x y)\"\n| \"\\ a_normal x ; a_normal y \\ \\ a_normal (LetBang is x y)\"\n| \"\\ a_normal m ; a_normal n \\ \\ a_normal (Case (Var x) t m n)\"\n| \"\\ a_normal t ; a_normal e \\ \\ a_normal (If (Var x) t e)\"\n| \"\\ a_normal y \\ \\ a_normal (Split (Var x) y)\"\n| \"\\ a_normal y \\ \\ a_normal (Take (Var x) f y)\"\n\ninductive_cases a_normal_E: \"a_normal x\"\ninductive_cases a_normal_LetE: \"a_normal (Let x y)\"\ninductive_cases a_normal_LetBangE: \"a_normal (LetBang is x y)\"\ninductive_cases a_normal_CaseE: \"a_normal (Case x t m n)\"\ninductive_cases a_normal_IfE: \"a_normal (If x t e)\"\ninductive_cases a_normal_Split: \"a_normal (Split x y)\"\ninductive_cases a_normal_TakeE: \"a_normal (Take x f e)\"\n\nsection {* Representation Types (for use in C-refinement) *}\n\n\ndatatype repr = RPtr repr\n | RCon name \"repr list\"\n | RFun\n | RPrim prim_type\n | RSum \"(name \\ repr) list\"\n | RProduct \"repr\" \"repr\"\n | RRecord \"repr list\"\n | RUnit\n\nfun type_repr :: \"type \\ repr\" where\n \"type_repr (TFun t t') = RFun\"\n| \"type_repr (TPrim t) = RPrim t\"\n| \"type_repr (TSum ts) = RSum (map (\\(a,b).(a, type_repr b)) ts)\"\n| \"type_repr (TProduct a b) = RProduct (type_repr a) (type_repr b)\"\n| \"type_repr (TCon n ts Unboxed) = RCon n (map type_repr ts)\"\n| \"type_repr (TCon n ts _) = RPtr (RCon n (map type_repr ts))\"\n| \"type_repr (TRecord ts Unboxed) = RRecord (map (\\a. type_repr (fst a)) ts)\" \n| \"type_repr (TRecord ts _) = RPtr (RRecord (map (\\a. type_repr (fst a)) ts))\"\n| \"type_repr (TUnit) = RUnit\"\n\nsection {* Kinding lemmas *}\n\nlemma supersumption:\nfixes k' :: kind\nassumes k_is_superset : \"k' \\ k\"\nshows \"K \\ t :\\ k \\ K \\ t :\\ k'\" \nand \"K \\* ts :\\ k \\ K \\* ts :\\ k'\"\nand \"K \\* fs :\\r k \\ K \\* fs :\\r k'\"\nusing k_is_superset proof (induct rule: kinding_kinding_all_kinding_record.inducts)\nqed (auto intro: subset_trans kinding_kinding_all_kinding_record.intros)\n\n\nlemma kind_top:\nshows \"k \\ {D, S, E}\"\nby (force intro: kind_comp.exhaust)\n\nlemma kinding_all_nth:\nfixes n :: nat\nassumes \"K \\* ts :\\ k\" \nand \"n < length ts\"\nshows \"K \\ (ts ! n) :\\ k\"\nusing assms proof (induct ts arbitrary: n)\n case Nil then show ?case by auto\nnext case Cons then show ?case by (case_tac n, auto)\nqed\n\nlemma kinding_all_set:\nshows \"(K \\* ts :\\ k) = (\\ t \\ set ts. K \\ t :\\ k)\"\nproof (rule iffI)\n assume \"K \\* ts :\\ k\"\nthen show \"\\ t \\ set ts. K \\ t :\\ k\"\n by (rule kinding_kinding_all_kinding_record.inducts, simp+)\n\nnext assume \"\\ t \\ set ts. K \\ t :\\ k\"\nthen show \"K \\* ts :\\ k\" \n by (induct ts, auto intro: kinding_kinding_all_kinding_record.intros)\nqed\n\nlemma kinding_all_subset:\nassumes \"K \\* ts :\\ k\"\nand \"set us \\ set ts\"\nshows \"K \\* us :\\ k\"\nusing assms by (auto simp add: kinding_all_set)\n\nlemma kinding_record_wellformed:\nassumes \"K \\* ts :\\r k\"\nand \"(a,b) \\ set ts\" \nshows \"K \\ a wellformed\"\nusing assms proof (induct ts)\n case Nil then show ?case by (simp add: set_conv_nth)\nnext case Cons then show ?case by (auto split: prod.split\n elim: kinding_record.cases)\nqed\n\nlemma kinding_record_wellformed_nth:\nassumes \"K \\* ts :\\r k\"\nand \"ts ! n = (a,b)\"\nand \"n < length ts\" \nshows \"K \\ a wellformed\"\nusing assms(1)\n and assms(2) [THEN sym] \n and assms(3) by (force intro: kinding_record_wellformed [simplified]\n simp: set_conv_nth)\n\n\nlemma kinding_all_record:\nassumes \"K \\* ts :\\ k\"\nshows \"K \\* zip ts (replicate (length ts) False) :\\r k\"\nusing assms proof (induct ts)\nqed (force intro: kinding_kinding_all_kinding_record.intros)+\n\n\nlemma kinding_all_record':\nassumes \"K \\* map fst ts :\\ k\"\nshows \"K \\* ts :\\r k\"\nusing assms proof (induct ts)\n case Nil then show ?case by (force intro: kinding_kinding_all_kinding_record.intros)\nnext case (Cons a ts) then show ?case apply (clarsimp)\n apply (case_tac a)\n apply (case_tac b)\n apply (auto intro: kinding_kinding_all_kinding_record.intros)\n done\nqed\n\nlemma kinding_record_update:\nassumes \"K \\* ts :\\r k\"\nand \"ts ! n = (a, b)\"\nand \"K \\ a :\\ k'\"\nshows \"K \\* (ts[ n := (a, False)]) :\\r (k \\ k')\"\nusing assms proof (induct ts arbitrary: n)\n case Nil then show ?case by (force intro: kinding_kinding_all_kinding_record.intros)\nnext case Cons\n note A = this\n show ?case proof (cases n)\n case 0 with A show ?thesis by (force elim!: kind_record_consE\n intro!: kinding_kinding_all_kinding_record.intros \n intro: supersumption)\n next case Suc with A show ?thesis by (force elim!: kind_record_consE\n intro!: kinding_kinding_all_kinding_record.intros \n intro: supersumption)\n qed\nqed\n\nlemma sigil_kind_writable:\nassumes \"s \\ ReadOnly\"\nand \"k \\ sigil_kind Writable\"\nshows \"k \\ sigil_kind s\"\nproof (cases s)\nqed (simp_all add: assms(1) assms(2)[simplified] kind_top)\n\nsection {* Bang lemmas *}\n\nlemma bang_sigil_idempotent:\nshows \"bang_sigil (bang_sigil s) = bang_sigil s\"\nby (cases s, simp+)\n\nlemma bang_idempotent:\nshows \"bang (bang \\) = bang \\\"\nby (force intro: bang.induct [where P = \"\\ \\ . bang (bang \\) = bang \\\"]\n simp: bang_sigil_idempotent)\n\nlemma bang_sigil_kind: \nshows \"{D , S} \\ sigil_kind (bang_sigil s)\" \nby (case_tac s,auto)\n\nlemma bang_kind:\nshows \"K \\ t :\\ k \\ K \\ bang t :\\ {D, S}\"\nand \"K \\* ts :\\ k \\ K \\* map bang ts :\\ {D, S}\"\nand \"K \\* fs :\\r k \\ K \\* map (\\(a,b). (bang a, b)) fs :\\r {D, S}\"\nby ( induct rule: kinding_kinding_all_kinding_record.inducts\n , auto intro: kinding_kinding_all_kinding_record.intros\n intro!: bang_sigil_kind)\n\nsection {* Instantiation *}\n\nlemma instantiate_bang [simp]:\nshows \"instantiate \\ (bang \\) = bang (instantiate \\ \\)\"\nby (force intro: bang.induct [where P = \"\\ \\. instantiate \\ (bang \\) = bang (instantiate \\ \\)\"] \n simp: bang_idempotent)\n\nlemma instantiate_instantiate [simp]:\nassumes \"list_all2 (kinding K') \\' K\"\nand \"length K' = length \\\"\nshows \"K \\ x wellformed \\ instantiate \\ (instantiate \\' x) = instantiate (map (instantiate \\) \\') x\"\nusing assms proof (induct x arbitrary: \\' rule: instantiate.induct)\n\nnext case 3 then show ?case by (force simp: set_conv_nth \n dest: kinding_all_nth)\nnext case 8 then show ?case by (fastforce dest: kinding_record_wellformed) \nnext case 6 note IH = this(1)\n and REST = this(2-)\n from REST show ?case apply (clarsimp elim!: kind_tsumE) \n apply (rule IH, simp,simp)\n apply (bestsimp simp: set_conv_nth \n dest!: prod_in_set(2) \n dest: kinding_all_nth [ where ts = \"map snd ts\" for ts\n , simplified])+\n done (*TODO automate properly*)\nqed (force dest: list_all2_lengthD)+\n \nlemma instantiate_tprim [simp]:\nshows \"instantiate \\ \\ TPrim = TPrim\"\nby (rule ext, simp)\n\n\nlemma instantiate_nothing:\nshows \"instantiate [] e = e\"\nby (induct e) (auto simp: prod_set_defs intro: map_idI)\n\nlemma instantiate_nothing_id[simp]:\nshows \"instantiate [] = id\"\nby (rule ext, simp add: instantiate_nothing)\n\nlemma instantiate_ctx_nothing:\nshows \"instantiate_ctx [] e = e\"\nunfolding instantiate_ctx_def\nby (induct e, auto simp: map_option.id [simplified id_def])\n\nlemma instantiate_ctx_nothing_id[simp]:\nshows \"instantiate_ctx [] = id\"\nby (rule ext, simp add: instantiate_ctx_nothing)\n\nlemma specialise_nothing:\nshows \"specialise [] e = e\"\nby (induct e) (auto simp: prod_set_defs intro: map_idI)\n\nlemma specialise_nothing_id[simp]:\nshows \"specialise [] = id\"\nby (rule ext, simp add: specialise_nothing)\n\n\n\nlemmas typing_struct_instantiate = typing_struct [where ts = \"map (instantiate \\) ts\" for ts, simplified]\n\nsubsection {* substitutivity *}\n\nlemma substitutivity:\nfixes \\ :: \"type substitution\"\nand K K' :: \"kind env\"\nassumes well_kinded: \"list_all2 (kinding K') \\ K\"\nshows \"K \\ t :\\ k \\ K' \\ instantiate \\ t :\\ k\"\nand \"K \\* ts :\\ k \\ K' \\* map (instantiate \\) ts :\\ k\"\nand \"K \\* fs :\\r k \\ K' \\* map (\\(a,b). (instantiate \\ a, b)) fs :\\r k\"\nusing well_kinded proof (induct rule: kinding_kinding_all_kinding_record.inducts)\n case (kind_tvar k K i)\n assume \"list_all2 (kinding K') \\ K\"\n and \"i < length K\"\n and \"k \\ K ! i\" \n moreover then have \"i < length \\\" by (auto dest: list_all2_lengthD)\n ultimately also have \"K' \\ (\\ ! i) :\\ (K ! i)\" by (auto intro: list_all2_nthD)\n ultimately show ?case by (auto intro: supersumption)\nnext case (kind_tvarb k i K)\n assume \"list_all2 (kinding K') \\ K\"\n and \"i < length K\"\n and \"k \\ {D, S}\"\n moreover then have \"i < length \\\" by (auto dest: list_all2_lengthD)\n ultimately also have \"K' \\ (\\ ! i) :\\ (K ! i)\" by (auto intro: list_all2_nthD)\n ultimately show ?case by (auto intro: supersumption bang_kind)\nqed (auto intro: kinding_kinding_all_kinding_record.intros)\n\nlemma list_all2_substitutivity:\nfixes \\ :: \"type substitution\"\nand K K' :: \"kind env\"\nassumes well_kinded: \"list_all2 (kinding K') \\ K\"\nshows \"list_all2 (kinding K) ts ks \\ list_all2 (kinding K') (map (instantiate \\) ts) ks\"\nby ( induct rule: list_all2_induct\n , auto dest: substitutivity [OF well_kinded])\n\nsubsection {* Instantiation of contexts *}\n\nlemma instantiate_ctx_weaken:\nassumes \"K \\ \\ \\w \\'\"\nand \"list_all2 (kinding K') \\ K\"\nshows \"K' \\ instantiate_ctx \\ \\ \\w instantiate_ctx \\ \\'\"\nusing assms(1) [simplified weakening_def] and assms(2) proof (induct rule: list_all2_induct)\n case Nil then show ?case by (simp add: instantiate_ctx_def weakening_def) \nnext case Cons then show ?case by (fastforce intro: weakening_comp.intros \n elim: weakening_comp.cases\n simp: instantiate_ctx_def \n weakening_def \n dest: substitutivity)\nqed\n\n\nlemma instantiate_ctx_empty [simplified, simp]:\nshows \"instantiate_ctx \\ (empty l) = empty l\"\nby (induct l, simp_all add: empty_def\n instantiate_ctx_def)\n\n\n\nlemma instantiate_ctx_singleton [simplified, simp]:\nshows \"instantiate_ctx \\ (singleton l i \\) = singleton l i (instantiate \\ \\)\"\nby (induct l arbitrary: i, simp_all add: instantiate_ctx_def \n empty_def \n split: nat.split)\n\nlemma instantiate_ctx_length [simp]:\nshows \"length (instantiate_ctx \\ \\) = length \\\"\nby (simp add: instantiate_ctx_def)\n\nlemma instantiate_ctx_consumed [simplified]:\nassumes \"K \\ \\ consumed\"\nand \"list_all2 (kinding K') \\ K\"\nshows \"K' \\ instantiate_ctx \\ \\ consumed\"\nusing assms by (auto intro: instantiate_ctx_weaken [where \\' = \"empty (length \\)\", simplified])\n\nlemma map_option_instantiate_split_comp:\nassumes \"K \\ c \\ c1 \\ c2\"\nand \"list_all2 (kinding K') \\ K\"\nshows \"K' \\ map_option (instantiate \\) c \\ map_option (instantiate \\) c1 \\ map_option (instantiate \\) c2\"\nusing assms(1) by ( rule split_comp.cases\n , auto elim: split_comp.cases \n intro: substitutivity(1) assms(2) split_comp.intros)\n\nlemma instantiate_ctx_split:\nassumes \"K \\ \\ \\ \\1 | \\2\"\nand \"list_all2 (kinding K') \\ K\"\nshows \"K' \\ instantiate_ctx \\ \\ \\ instantiate_ctx \\ \\1 | instantiate_ctx \\ \\2\"\nusing assms proof (induct rule: split.induct)\ncase split_empty then show ?case by (auto simp: instantiate_ctx_def\n intro: split.intros)\ncase split_cons then show ?case by (auto simp: instantiate_ctx_def\n intro: split.intros\n map_option_instantiate_split_comp)\nqed\n\n\nlemma instantiate_ctx_split_bang:\nassumes \"split_bang K is \\ \\1 \\2\"\nand \"list_all2 (kinding K') \\ K\"\nshows \"split_bang K' is (instantiate_ctx \\ \\) (instantiate_ctx \\ \\1) (instantiate_ctx \\ \\2)\"\nusing assms proof (induct rule: split_bang.induct)\n case split_bang_empty then show ?case by (auto simp: instantiate_ctx_def\n intro: split_bang.intros)\nnext case split_bang_cons then show ?case by (auto simp: instantiate_ctx_def\n intro: split_bang.intros\n map_option_instantiate_split_comp)\nnext case split_bang_bang then show ?case by (auto simp: instantiate_ctx_def \n intro: split_bang.intros)\nqed\n\n\nlemma instantiate_ctx_cons [simp]:\nshows \"instantiate_ctx \\ (Some x # \\) = Some (instantiate \\ x) # instantiate_ctx \\ \\\"\nby (simp add: instantiate_ctx_def)\n\n\n\nsection {* Lemmas about contexts, splitting and weakening *}\n\nlemma empty_length: \nshows \"length (empty n) = n\"\nby (induct n, simp_all add: empty_def)\n\nlemma weakening_length:\nshows \"K \\ \\ \\w \\' \\ length \\ = length \\'\"\nby (auto simp: weakening_def dest:list_all2_lengthD)\n\nlemma weakening_preservation:\nassumes weak: \"K \\ \\ \\w \\'\"\nand idx: \"\\' ! x = Some t\"\nshows \"\\ ! x = Some t\"\nusing weak[simplified weakening_def]\n and weakening_length[OF weak] \n and idx\n proof (induct arbitrary: x rule: list_all2_induct)\n case Nil then show ?case by auto\nnext case (Cons x xs y ys a) then show ?case by (case_tac a, auto elim: weakening_comp.cases)\nqed \n\nlemma weakening_nth:\nassumes weak: \"K \\ \\ \\w \\'\"\nand \"i < length \\\"\nshows \"weakening_comp K (\\!i) (\\'!i)\"\nusing assms by (auto simp add: weakening_def dest: list_all2_nthD)\n\n\nlemma typing_to_kinding :\nshows \"\\, K, \\ \\ e : t \\ K \\ t wellformed\" \nand \"\\, K, \\ \\* es : ts \\ K \\* ts wellformed\"\nproof (induct rule: typing_typing_all.inducts)\n case typing_var then show ?case by (fastforce dest: weakening_preservation weakening_nth\n simp: empty_length \n elim: weakening_comp.cases)\nnext case typing_fun then show ?case by (fastforce intro: kinding_kinding_all_kinding_record.intros \n substitutivity)\nnext case typing_afun then show ?case by (fastforce intro: kinding_kinding_all_kinding_record.intros \n substitutivity)\nnext case typing_esac then show ?case by (fastforce)\nnext case typing_member then show ?case by (fastforce intro: kinding_record_wellformed_nth)\nnext case typing_struct then show ?case by ( clarsimp\n , intro exI kind_trec kinding_all_record\n , simp_all add: kind_top )\nnext case typing_take then show ?case by (simp) \nnext case typing_put then show ?case by (fastforce intro: kinding_kinding_all_kinding_record.intros\n kinding_record_update)\nqed (auto intro: supersumption kinding_kinding_all_kinding_record.intros)\n\nlemma upcast_valid_cast_to :\nassumes \"upcast_valid \\ \\'\"\n and \"lit_type l = Num \\\"\nobtains x where \"cast_to \\' l = Some x\"\n and \"lit_type x = Num \\'\"\nusing assms by (cases l, auto elim: upcast_valid.elims)\n\nlemma bang_type_repr [simp]:\nshows \"[] \\ t :\\ k \\ (type_repr (bang t) = type_repr t)\"\nand \"[] \\* ts :\\ k \\ (map (type_repr \\ bang) ts) = map (type_repr) ts \"\nand \"[] \\* fs :\\r k \\ (map (type_repr \\ bang \\ fst) fs) = map (type_repr \\ fst) fs\"\nby ( induct \"[] :: kind list\" t k\n and \"[] :: kind list\" ts k\n and \"[] :: kind list\" fs k\n rule: kinding_kinding_all_kinding_record.inducts\n , auto, (case_tac s,auto)+)\n\n\nsubsection {* Specialisation *}\n\n\nlemma specialisation:\nassumes well_kinded: \"list_all2 (kinding K') \\ K\"\nshows \"\\ , K , \\ \\ e : \\ \\ \\ , K' , instantiate_ctx \\ \\ \\ specialise \\ e : instantiate \\ \\ \"\nand \"\\ , K , \\ \\* es : \\s \\ \\ , K' , instantiate_ctx \\ \\ \\* map (specialise \\) es : map (instantiate \\) \\s\"\nusing assms proof (induct rule: typing_typing_all.inducts)\nnext case typing_case then show ?case by (force intro: typing_typing_all.intros instantiate_ctx_split \n simp: set_conv_nth \n filter_fst_ignore [where P =\"\\f. f \\ c\" for c]\n split: prod.split)\nnext case (typing_afun \\ f ks t u K ts ks)\nthen also have \"instantiate \\ (instantiate ts t) = instantiate (map (instantiate \\) ts) t\"\n and \"instantiate \\ (instantiate ts u) = instantiate (map (instantiate \\) ts) u\"\n by (force dest: list_all2_lengthD intro: instantiate_instantiate)+\nultimately show ?case by (auto intro!: list_all2_substitutivity\n typing_typing_all.typing_afun [simplified] \n instantiate_ctx_consumed)\nnext case (typing_fun \\ K t f u \\ ks ts)\nthen also have \"instantiate \\ (instantiate ts t) = instantiate (map (instantiate \\) ts) t\"\n and \"instantiate \\ (instantiate ts u) = instantiate (map (instantiate \\) ts) u\"\n by (force dest: list_all2_lengthD intro: instantiate_instantiate dest!: typing_to_kinding)+\nultimately show ?case by (auto intro!: list_all2_substitutivity\n typing_typing_all.typing_fun [simplified] \n instantiate_ctx_consumed)\nqed (force intro!: typing_struct_instantiate\n typing_typing_all.intros\n dest: substitutivity\n instantiate_ctx_split\n instantiate_ctx_split_bang\n instantiate_ctx_weaken\n instantiate_ctx_consumed\n simp: instantiate_ctx_def [where \\ = \"[]\", simplified]\n map_update)+\n\n\n\nfun expr_size :: \"'f expr \\ nat\" where\n \"expr_size (Let a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (LetBang vs a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (Fun f ts) = Suc (expr_size f)\"\n| \"expr_size (Unit) = 0\"\n| \"expr_size (Member x f) = Suc (expr_size x)\"\n| \"expr_size (Cast t x) = Suc (expr_size x)\"\n| \"expr_size (Con c x ts) = Suc (expr_size ts)\"\n| \"expr_size (App a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (Prim p as) = Suc (listsum (map expr_size as))\"\n| \"expr_size (Var v) = 0\"\n| \"expr_size (AFun v va) = 0\"\n| \"expr_size (Promote v va) = Suc (expr_size va)\"\n| \"expr_size (Struct v va) = Suc (listsum ( map expr_size va))\"\n| \"expr_size (Lit v) = 0\"\n| \"expr_size (Tuple v va) = Suc ((expr_size v) + (expr_size va))\"\n| \"expr_size (Put v va vb) = Suc ((expr_size v) + (expr_size vb))\"\n| \"expr_size (Esac x) = Suc (expr_size x)\"\n| \"expr_size (If x a b) = Suc ((expr_size x) + (expr_size a) + (expr_size b))\"\n| \"expr_size (Split x y) = Suc ((expr_size x) + (expr_size y))\"\n| \"expr_size (Case x v a b) = Suc ((expr_size x) + (expr_size a) + (expr_size b))\"\n| \"expr_size (Take x f y) = Suc ((expr_size x) + (expr_size y))\"\n\nlemma specialise_size [simp]:\n shows \"expr_size (specialise \\s x) = expr_size x\"\nproof -\nhave \"\\ as . (\\ x. x \\ set as \\ expr_size (specialise \\s x) = expr_size x) \\\n listsum (map (expr_size \\ specialise \\s) as) = listsum (map expr_size as)\"\nby (rule allI, induct_tac as, simp+)\nthen show ?thesis by (induct x rule: expr_size.induct, auto)\nqed\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/cogent/isa/Cogent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.4035668537353746, "lm_q1q2_score": 0.26142988318615396}} {"text": "header {* \\isaheader{Basic Parametricity Reasoning} *}\ntheory Param_Tool\nimports \"Relators\"\nbegin\n\n subsection {* Auxiliary Lemmas *}\n lemma tag_both: \"\\ (Let x f,Let x' f')\\R \\ \\ (f x,f' x')\\R\" by simp\n lemma tag_rhs: \"\\ (c,Let x f)\\R \\ \\ (c,f x)\\R\" by simp\n lemma tag_lhs: \"\\ (Let x f,a)\\R \\ \\ (f x,a)\\R\" by simp\n\n lemma tagged_fun_relD_both: \n \"\\ (f,f')\\A\\B; (x,x')\\A \\ \\ (Let x f,Let x' f')\\B\"\n and tagged_fun_relD_rhs: \"\\ (f,f')\\A\\B; (x,x')\\A \\ \\ (f x,Let x' f')\\B\"\n and tagged_fun_relD_lhs: \"\\ (f,f')\\A\\B; (x,x')\\A \\ \\ (Let x f,f' x')\\B\"\n and tagged_fun_relD_none: \"\\ (f,f')\\A\\B; (x,x')\\A \\ \\ (f x,f' x')\\B\"\n by (simp_all add: fun_relD)\n\n\n subsection {* ML-Setup*}\n\n ML {*\n signature PARAMETRICITY = sig\n type param_ruleT = {\n lhs: term,\n rhs: term,\n R: term,\n rhs_head: term,\n arity: int\n }\n \n val dest_param_term: term -> param_ruleT\n val dest_param_rule: thm -> param_ruleT\n val dest_param_goal: int -> thm -> param_ruleT\n\n val safe_fun_relD_tac: Proof.context -> tactic'\n\n val adjust_arity: int -> thm -> thm\n val adjust_arity_tac: int -> Proof.context -> tactic'\n val unlambda_tac: tactic'\n val prepare_tac: Proof.context -> tactic'\n\n val fo_rule: thm -> thm\n\n (*** Basic tactics ***)\n val param_rule_tac: Proof.context -> thm -> tactic'\n val param_rules_tac: Proof.context -> thm list -> tactic'\n val asm_param_tac: Proof.context -> tactic'\n\n\n (*** Nets of parametricity rules ***)\n type param_net\n val net_empty: param_net\n val net_add: thm -> param_net -> param_net\n val net_del: thm -> param_net -> param_net\n val net_add_int: thm -> param_net -> param_net\n val net_del_int: thm -> param_net -> param_net\n val net_tac: param_net -> Proof.context -> tactic'\n \n (*** Default parametricity rules ***)\n val add_dflt: thm -> Context.generic -> Context.generic\n val add_dflt_attr: attribute\n val del_dflt: thm -> Context.generic -> Context.generic\n val del_dflt_attr: attribute\n val get_dflt: Proof.context -> param_net\n\n (** Configuration **)\n val cfg_use_asm: bool Config.T\n val cfg_single_step: bool Config.T\n\n (** Setup **)\n val setup: theory -> theory\n end\n\n structure Parametricity : PARAMETRICITY = struct\n type param_ruleT = {\n lhs: term,\n rhs: term,\n R: term,\n rhs_head: term,\n arity: int\n }\n\n fun dest_param_term t = \n case \n strip_all_body t |> Logic.strip_imp_concl |> HOLogic.dest_Trueprop\n of \n @{mpat \"(?lhs,?rhs):?R\"} => let \n val (rhs_head,arity) = \n case strip_comb rhs of\n (c as Const _,l) => (c,length l)\n | (c as Free _,l) => (c,length l)\n | (c as Abs _,l) => (c,length l)\n | _ => raise TERM (\"dest_param_term: Head\",[t])\n in \n { lhs = lhs, rhs = rhs, R=R, rhs_head = rhs_head, arity = arity }\n end\n | t => raise TERM (\"dest_param_term: Expected (_,_):_\",[t])\n\n val dest_param_rule = dest_param_term o prop_of\n fun dest_param_goal i st = \n if i > nprems_of st then\n raise THM (\"dest_param_goal\",i,[st])\n else\n dest_param_term (Logic.concl_of_goal (prop_of st) i)\n\n\n fun safe_fun_relD_tac ctxt = let\n fun t a b = fo_resolve_tac [a] ctxt THEN' rtac b\n in\n DETERM o (\n t @{thm tag_both} @{thm tagged_fun_relD_both} ORELSE'\n t @{thm tag_rhs} @{thm tagged_fun_relD_rhs} ORELSE'\n t @{thm tag_lhs} @{thm tagged_fun_relD_lhs} ORELSE'\n rtac @{thm tagged_fun_relD_none}\n )\n end\n\n fun adjust_arity i thm = \n if i = 0 then thm \n else if i<0 then funpow (~i) (fn thm => thm RS @{thm fun_relI}) thm\n else funpow i (fn thm => thm RS @{thm fun_relD}) thm\n\n fun NTIMES k tac = \n if k <= 0 then K all_tac \n else tac THEN' NTIMES (k-1) tac\n\n fun adjust_arity_tac n ctxt i st = \n (if n = 0 then K all_tac\n else if n>0 then NTIMES n (DETERM o rtac @{thm fun_relI})\n else NTIMES (~n) (safe_fun_relD_tac ctxt)) i st\n\n fun unlambda_tac i st = \n case try (dest_param_goal i) st of\n NONE => Seq.empty\n | SOME g => let\n val n = Term.strip_abs (#rhs_head g) |> #1 |> length\n in NTIMES n (rtac @{thm fun_relI}) i st end\n\n fun prepare_tac ctxt = \n Subgoal.FOCUS (K (PRIMITIVE (Drule.eta_contraction_rule))) ctxt\n THEN' unlambda_tac\n\n\n fun could_param_rl rl i st = \n if i > nprems_of st then NONE\n else (\n case (try (dest_param_goal i) st, try dest_param_term rl) of\n (SOME g, SOME r) =>\n if Term.could_unify (#rhs_head g, #rhs_head r) then\n SOME (#arity r - #arity g)\n else NONE\n | _ => NONE\n )\n\n fun param_rule_tac_aux ctxt rl i st = \n case could_param_rl (prop_of rl) i st of\n SOME adj => (adjust_arity_tac adj ctxt THEN' rtac rl) i st\n | _ => Seq.empty\n\n fun param_rule_tac ctxt rl = \n prepare_tac ctxt THEN' param_rule_tac_aux ctxt rl\n\n fun param_rules_tac ctxt rls = \n prepare_tac ctxt THEN' FIRST' (map (param_rule_tac_aux ctxt) rls)\n\n fun asm_param_tac_aux ctxt i st = \n if i > nprems_of st then Seq.empty\n else let\n val prems = Logic.prems_of_goal (prop_of st) i |> tag_list 1\n \n fun tac (n,t) i st = case could_param_rl t i st of\n SOME adj => (adjust_arity_tac adj ctxt THEN' rprem_tac n ctxt) i st\n | NONE => Seq.empty\n in\n FIRST' (map tac prems) i st\n end\n\n fun asm_param_tac ctxt = prepare_tac ctxt THEN' asm_param_tac_aux ctxt\n \n type param_net = (param_ruleT * thm) Item_Net.T\n\n local\n val param_get_key = single o #rhs_head o #1\n in \n val net_empty = Item_Net.init (Thm.eq_thm o pairself #2) param_get_key\n end\n\n fun wrap_pr_op f thm = case try (`dest_param_rule) thm of\n NONE => \n let \n val msg = \"Ignoring invalid parametricity theorem: \"\n ^ Display.string_of_thm_without_context thm\n val _ = warning msg\n in I end\n | SOME p => f p\n \n val net_add_int = wrap_pr_op Item_Net.update \n val net_del_int = wrap_pr_op Item_Net.remove\n\n val net_add = Item_Net.update o `dest_param_rule\n val net_del = Item_Net.remove o `dest_param_rule\n\n fun net_tac_aux net ctxt i st = \n if i > nprems_of st then \n Seq.empty \n else\n let\n val g = dest_param_goal i st\n val rls = Item_Net.retrieve net (#rhs_head g)\n \n fun tac (r,thm) = \n adjust_arity_tac (#arity r - #arity g) ctxt \n THEN' DETERM o rtac thm\n \n in \n FIRST' (map tac rls) i st\n end\n\n fun net_tac net ctxt = prepare_tac ctxt THEN' net_tac_aux net ctxt\n\n structure dflt_rules = Generic_Data (\n type T = param_net\n val empty = net_empty\n val extend = I\n val merge = Item_Net.merge\n )\n \n fun add_dflt thm = dflt_rules.map (net_add_int thm)\n fun del_dflt thm = dflt_rules.map (net_del_int thm)\n val add_dflt_attr = Thm.declaration_attribute add_dflt\n val del_dflt_attr = Thm.declaration_attribute del_dflt\n\n val get_dflt = dflt_rules.get o Context.Proof\n\n val cfg_use_asm = \n Attrib.setup_config_bool @{binding param_use_asm} (K true)\n val cfg_single_step = \n Attrib.setup_config_bool @{binding param_single_step} (K false)\n\n local\n open Refine_Util\n\n val param_modifiers =\n [Args.add -- Args.colon >> K (Method.modifier add_dflt_attr @{here}),\n Args.del -- Args.colon >> K (Method.modifier del_dflt_attr @{here}),\n Args.$$$ \"only\" -- Args.colon >>\n K {init = Context.proof_map (dflt_rules.map (K net_empty)),\n attribute = add_dflt_attr, pos = @{here}}]\n\n val param_flags = \n parse_bool_config \"use_asm\" cfg_use_asm\n || parse_bool_config \"single_step\" cfg_single_step\n\n in\n \n val parametricity_method = \n parse_paren_lists param_flags |-- Method.sections param_modifiers >> \n (fn _ => fn ctxt => \n let\n val net2 = get_dflt ctxt\n val asm_tac = \n if Config.get ctxt cfg_use_asm then \n asm_param_tac ctxt\n else K no_tac\n \n val RPT = \n if Config.get ctxt cfg_single_step then I\n else REPEAT_ALL_NEW_FWD\n \n in\n SIMPLE_METHOD' (\n RPT (\n (atac \n ORELSE' net_tac net2 ctxt\n ORELSE' asm_tac)\n ) \n )\n end\n )\n end\n\n fun fo_rule thm = case concl_of thm of\n @{mpat \"Trueprop ((_,_)\\_\\_)\"} => fo_rule (thm RS @{thm fun_relD})\n | _ => thm \n \n val param_fo_attr = Scan.succeed (Thm.rule_attribute (K fo_rule))\n\n val setup = I\n #> Attrib.setup @{binding param} \n (Attrib.add_del add_dflt_attr del_dflt_attr)\n \"declaration of parametricity theorem\"\n #> Global_Theory.add_thms_dynamic (@{binding param}, \n map #2 o Item_Net.content o dflt_rules.get)\n #> Method.setup @{binding parametricity} parametricity_method \n \"Parametricity solver\"\n #> Attrib.setup @{binding param_fo} param_fo_attr \n \"Parametricity: Rule in first-order form\"\n\n end\n *}\n\n setup Parametricity.setup\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Automatic_Refinement/Parametricity/Param_Tool.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.26138470744939374}} {"text": "theory TopoS_Interface_impl\nimports \"Lib/FiniteGraph\" \"Lib/FiniteListGraph\" TopoS_Interface TopoS_Helper\nbegin\n\nsection{*Executable Implementation with Lists*}\n text {*Correspondence List Implementation and set Specification*}\n \n subsection{*Abstraction from list implementation to set specification*}\n text{*Nomenclature: @{text \"_spec\"} is the specification, @{text \"_impl\"} the corresponding implementation.*}\n\n text{*@{text \"_spec\"} and @{text \"_impl\"} only need to comply for @{const wf_graph}s. \n We will always require the stricter @{const wf_list_graph}, which implies @{const wf_graph}.\n *}\n lemma \"wf_list_graph G \\ wf_graph (list_graph_to_graph G)\"\n by %invisible (metis wf_list_graph_def wf_list_graph_iff_wf_graph)\n\n locale TopoS_List_Impl = \n fixes default_node_properties :: \"'a\" (\"\\\") \n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\"\n and sinvar_impl::\"('v::vertex) list_graph \\ ('v::vertex \\ 'a) \\ bool\"\n and receiver_violation :: \"bool\"\n and offending_flows_impl::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n and node_props_impl::\"('v::vertex, 'a) TopoS_Params \\ ('v \\ 'a)\"\n and eval_impl::\"('v::vertex) list_graph \\ ('v, 'a) TopoS_Params \\ bool\"\n assumes\n spec: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\" --\"specification is valid\"\n and\n sinvar_spec_impl: \"wf_list_graph G \\ \n (sinvar_spec (list_graph_to_graph G) nP) = (sinvar_impl G nP)\"\n and\n offending_flows_spec_impl: \"wf_list_graph G \\ \n (SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP) = \n set`set (offending_flows_impl G nP)\"\n and \n node_props_spec_impl: \n \"SecurityInvariant.node_props_formaldef default_node_properties P = node_props_impl P\"\n and\n eval_spec_impl:\n \"(distinct (nodesL G) \\ distinct (edgesL G) \\ \n SecurityInvariant.eval sinvar_spec default_node_properties (list_graph_to_graph G) P ) = \n (eval_impl G P)\"\n\n subsection {* Security Invariants Packed*}\n\n text {* We pack all necessary functions and properties of a security invariant in a struct-like data structure.*}\n record ('v::vertex, 'a) TopoS_packed =\n nm_name :: \"string\"\n nm_receiver_violation :: \"bool\"\n nm_default :: \"'a\"\n nm_sinvar::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ bool\"\n nm_offending_flows::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n nm_node_props::\"('v::vertex, 'a) TopoS_Params \\ ('v \\ 'a)\" \n nm_eval::\"('v::vertex) list_graph \\ ('v, 'a)TopoS_Params \\ bool\"\n \n\n\n text{*The packed list implementation must comply with the formal definition. *}\n locale TopoS_modelLibrary =\n fixes m :: \"('v::vertex, 'a) TopoS_packed\" -- \"concrete model implementation\"\n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\" --\"specification\"\n assumes\n name_not_empty: \"length (nm_name m) > 0\"\n and\n impl_spec: \"TopoS_List_Impl \n (nm_default m)\n sinvar_spec\n (nm_sinvar m)\n (nm_receiver_violation m)\n (nm_offending_flows m)\n (nm_node_props m)\n (nm_eval m)\"\n\n\n\n subsection{*Helpful Lemmata*}\n\n text{*show that @{term \"sinvar\"} complies*}\n lemma TopoS_eval_impl_proofrule: \n assumes inst: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\"\n assumes ev: \"\\nP. wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"\n (distinct (nodesL G) \\ distinct (edgesL G) \\ \n SecurityInvariant.eval sinvar_spec default_node_properties (list_graph_to_graph G) P) =\n (wf_list_graph G \\ sinvar_impl G (SecurityInvariant.node_props default_node_properties P))\"\n proof (cases \"wf_list_graph G\")\n case True\n hence \"sinvar_spec (list_graph_to_graph G) (SecurityInvariant.node_props default_node_properties P) =\n sinvar_impl G (SecurityInvariant.node_props default_node_properties P)\"\n using ev by blast\n\n with inst show ?thesis\n unfolding wf_list_graph_def \n by (simp add: wf_list_graph_iff_wf_graph SecurityInvariant.eval_def)\n next\n case False\n hence \"(distinct (nodesL G) \\ distinct (edgesL G) \\ wf_list_graph_axioms G) = False\"\n unfolding wf_list_graph_def by blast\n with False show ?thesis\n unfolding SecurityInvariant.eval_def[OF inst]\n by (fastforce simp: wf_list_graph_iff_wf_graph)\n qed\n\n\nsubsection {*Helper lemmata*}\n\n text{* Provide @{term sinvar} function and get back a function that computes the list of offending flows\n \n Exponential time!\n *}\n definition Generic_offending_list:: \"('v list_graph \\ ('v \\ 'a) \\ bool )\\ 'v list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\" where\n \"Generic_offending_list sinvar G nP = [f \\ (sublists (edgesL G)). \n (\\ sinvar G nP \\ sinvar (FiniteListGraph.delete_edges G f) nP) \\ \n (\\(e1, e2)\\set f. \\ sinvar (add_edge e1 e2 (FiniteListGraph.delete_edges G f)) nP)]\"\n \n \n text{*proof rule: if @{term sinvar} complies, @{const Generic_offending_list} complies *}\n lemma Generic_offending_list_correct: \n assumes valid: \"wf_list_graph G\"\n assumes spec_impl: \"\\G nP. wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP = \n set`set( Generic_offending_list sinvar_impl G nP )\"\n proof -\n have \"\\ P G. set ` {x \\ set (sublists (edgesL G)). P G (set x)} = {x \\ set ` set (sublists (edgesL G)). P G (x)}\"\n by fastforce\n hence subset_sublists_filter: \"\\ G P. {f. f \\ edges (list_graph_to_graph G) \\ P G f} \n = set ` set [f\\sublists (edgesL G) . P G (set f)]\"\n unfolding list_graph_to_graph_def\n by (auto simp: sublists_powset)\n\n from valid delete_edges_wf have \"\\f. wf_list_graph(FiniteListGraph.delete_edges G f)\" by fast\n with spec_impl[symmetric] FiniteListGraph.delete_edges_correct[of \"G\"] have impl_spec_delete:\n \"\\f. sinvar_impl (FiniteListGraph.delete_edges G f) nP = \n sinvar_spec (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)) nP\" by simp\n\n from spec_impl[OF valid, symmetric] have impl_spec_not:\n \"(\\ sinvar_impl G nP) = (\\ sinvar_spec (list_graph_to_graph G) nP)\" by auto\n\n from spec_impl[symmetric, OF FiniteListGraph.add_edge_wf[OF FiniteListGraph.delete_edges_wf[OF valid]]] have impl_spec_allE:\n \"\\ e1 e2 E. sinvar_impl (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E)) nP =\n sinvar_spec (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E))) nP\" by simp\n\n have list_graph: \"\\ e1 e2 G f. (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G f))) = \n (FiniteGraph.add_edge e1 e2 (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)))\"\n by(simp add: FiniteListGraph.add_edge_correct FiniteListGraph.delete_edges_correct)\n \n show ?thesis \n unfolding SecurityInvariant_withOffendingFlows.set_offending_flows_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_def\n Generic_offending_list_def\n apply(subst impl_spec_delete)\n apply(subst impl_spec_not)\n apply(subst impl_spec_allE)\n apply(subst list_graph)\n apply(rule subset_sublists_filter)\n done\n qed\n\n lemma all_edges_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\(e1, e2)\\ (edges (list_graph_to_graph G)). P (list_graph_to_graph G) e1 e2) = (\\(e1, e2)\\set (edgesL G). Pl G e1 e2)\"\n unfolding list_graph_to_graph_def\n by simp\n\n lemma all_nodes_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\n \\ (nodes (list_graph_to_graph G)). P (list_graph_to_graph G) n) = (\\ n \\set (nodesL G). Pl G n)\"\n unfolding list_graph_to_graph_def\n by simp\n\n\n\n\n\n\n fun minimalize_offending_overapprox :: \"('v list_graph \\ bool) \\ \n ('v \\ 'v) list \\ ('v \\ 'v) list \\ 'v list_graph \\ ('v \\ 'v) list\" where\n \"minimalize_offending_overapprox _ [] keep _ = keep\" |\n \"minimalize_offending_overapprox m (f#fs) keep G = (if m (delete_edges G (fs@keep)) then\n minimalize_offending_overapprox m fs keep G\n else\n minimalize_offending_overapprox m fs (f#keep) G\n )\"\n\n thm minimalize_offending_overapprox_boundnP (*is usage of this one better?*)\n lemma minimalize_offending_overapprox_spec_impl:\n assumes valid: \"wf_list_graph (G::'v::vertex list_graph)\"\n and spec_impl: \"\\G nP::('v \\ 'a). wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"minimalize_offending_overapprox (\\G. sinvar_impl G nP) fs keeps G =\n TopoS_withOffendingFlows.minimalize_offending_overapprox (\\G. sinvar_spec G nP) fs keeps (list_graph_to_graph G)\"\n apply(subst minimalize_offending_overapprox_boundnP)\n using valid spec_impl apply(induction fs arbitrary: keeps)\n apply(simp add: SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox.simps; fail)\n apply(simp add: SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox.simps)\n apply (metis FiniteListGraph.delete_edges_wf delete_edges_list_set list_graph_correct(5))\n done\n\n text{*With @{const minimalize_offending_overapprox}, we can get one offending flow*}\n lemma minimalize_offending_overapprox_gives_some_offending_flow:\n assumes wf: \"wf_list_graph G\"\n and NetModelLib: \"TopoS_modelLibrary m sinvar_spec\"\n and violation: \"\\ (nm_sinvar m) G nP\"\n shows \"set (minimalize_offending_overapprox (\\G. (nm_sinvar m) G nP) (edgesL G) [] G) \\\n SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP\"\n proof -\n from wf have wfG: \"wf_graph (list_graph_to_graph G)\"\n by (simp add: wf_list_graph_def wf_list_graph_iff_wf_graph)\n from wf have dist_edges: \"distinct (edgesL G)\" by (simp add: wf_list_graph_def)\n\n let ?spec_algo=\"TopoS_withOffendingFlows.minimalize_offending_overapprox\n (\\G. sinvar_spec G nP) (edgesL G) [] (list_graph_to_graph G)\"\n\n note spec=TopoS_List_Impl.spec[OF TopoS_modelLibrary.impl_spec[OF NetModelLib]]\n\n from spec have spec_prelim: \"SecurityInvariant_preliminaries sinvar_spec\"\n by(simp add: SecurityInvariant_def)\n from spec_prelim SecurityInvariant_preliminaries.sinvar_monoI have mono:\n \"SecurityInvariant_withOffendingFlows.sinvar_mono sinvar_spec\" by blast\n \n from spec_prelim have empty_edges: \"sinvar_spec \\nodes = set (nodesL G), edges = {}\\ nP\"\n using SecurityInvariant_preliminaries.defined_offending \n SecurityInvariant_withOffendingFlows.sinvar_mono_imp_sinvar_mono \n SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows \n mono empty_subsetI graph.simps(1) \n list_graph_to_graph_def local.wf wf_list_graph_def wf_list_graph_iff_wf_graph\n by (metis)\n\n (*TODO: tune*)\n have spec_impl: \"wf_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = (nm_sinvar m) G nP\" for G nP\n using NetModelLib TopoS_List_Impl.sinvar_spec_impl TopoS_modelLibrary.impl_spec by fastforce\n \n from minimalize_offending_overapprox_spec_impl[OF wf] spec_impl have alog_spec:\n \"minimalize_offending_overapprox (\\G. (nm_sinvar m) G nP) fs keeps G =\n TopoS_withOffendingFlows.minimalize_offending_overapprox (\\G. sinvar_spec G nP) fs keeps (list_graph_to_graph G)\"\n for fs keeps by blast\n\n (*TODO: tune*)\n from spec_impl violation have\n \"SecurityInvariant_withOffendingFlows.is_offending_flows sinvar_spec (set (edgesL G)) (list_graph_to_graph G) nP\"\n apply(simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply(intro conjI)\n apply (simp add: local.wf; fail)\n apply(simp add: FiniteGraph.delete_edges_simp2 list_graph_to_graph_def)\n apply(simp add: empty_edges)\n done\n hence goal: \"SecurityInvariant_withOffendingFlows.is_offending_flows_min_set sinvar_spec\n (set ?spec_algo) (list_graph_to_graph G) nP\"\n apply(subst minimalize_offending_overapprox_boundnP) (*we do this subst pretty often. is this the right abstraction here?*)\n apply(rule SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_minimalize_offending_overapprox[OF\n mono wfG _ _ dist_edges])\n apply(simp add: list_graph_to_graph_def)+\n done\n\n from SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox_subseteq_input[of\n \"sinvar_spec\" \"(edgesL G)\" \"[]\"] have subset_edges:\n \"set ?spec_algo \\ edges (list_graph_to_graph G)\" \n apply(subst minimalize_offending_overapprox_boundnP)\n by(simp add: list_graph_to_graph_def)\n\n from goal show ?thesis\n by(simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def alog_spec subset_edges)\n qed\n\n\n\n\n\n\n(*TODO: this should be a header of TopoS_Libary. The header should be printed BEFORE the imports are processed. *)\nsection{*Security Invariant Library*}\n(*The SINVAR_* theory files all use the \"subsection\" command. Here is the top-section.*)\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/TopoS_Interface_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.26129276349019154}} {"text": "theory Extra2\n imports ExtraInv VCTheoryLemmas\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\\n(toEnv\n (setPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR\n Ctrl'emergency))\"\n\ntheorem extra2: \"VC2 extraInv env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n apply(simp only: VC2_def extraInv_def)\n apply(rule impI)\n apply(rule conjI)\n apply simp\n subgoal\n apply((drule conjE[of _ _ ?thesis])+)\n defer\n apply assumption+\n subgoal premises prems\n apply(rule conjI)\n using prems(1-4) prems(5) apply simp\n apply(rule conjI)\n using prems(1-4) prems(6) apply simp\n apply(rule conjI)\n using prems(1-4) prems(7) apply simp\n apply(rule conjI)\n using prems(1-4) prems(8) apply simp\n apply(rule conjI)\n using prems(1-4) prems(9) apply simp\n apply(rule conjI)\n using prems(1-4) prems(10) apply simp\n apply(rule conjI)\n using prems(1-4) prems(11) apply simp\n apply(rule conjI)\n using prems(1-4) prems(12) apply simp\n apply(rule conjI)\n using prems(1-4) prems(13) apply simp\n apply(rule conjI)\n using prems(1-4) prems(14) apply simp\n apply(rule conjI)\n using prems(1-4) prems(15) apply simp\n apply(rule conjI)\n using prems(1-4) prems(16) apply simp\n apply(rule conjI)\n apply(rule allI)\n subgoal for s1\n apply(cases \"s1 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n apply(rule impI)\n apply(rule exI[of _ s0])\n apply(rule exI[of _ \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"])\n using prems(1-4) substate_refl toEnvNum_id apply -\n apply(((rule conjI),simp)+)\n using substate_trans substate_antisym\n apply (metis le_numeral_extra(4) not_one_le_zero)\n using prems(17) by simp\n apply(rule conjI)\n using prems(1-4) prems(18) apply simp\n apply(rule conjI)\n using prems(1-4) prems(19) apply simp\n apply(rule conjI)\n using prems(1-4) prems(20) apply simp\n using prems(1-4) prems(21) by simp\n done\n done\n\nend \n ", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Extra2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.26123332732715493}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory CreateIRQCaps_SI\nimports\n \"../proof/capDL-api/IRQ_DP\"\n ObjectInitialised_SI\n RootTask_SI\n SysInit_SI\nbegin\n\n(*****************\n * Helper lemmas *\n *****************)\n\n\n\nlemma si_cnode_caps:\n \"si_cnode_cap = si_cspace_cap\"\n by (simp add: si_cnode_cap_def si_cspace_cap_def)\n\nlemma hoare_grab_exs2:\n \"(\\x. P x \\ \\P' x\\ f \\Q\\) \\ \\\\s. \\x. P x \\ P' x s\\ f \\Q\\\"\n by (fastforce simp: valid_def)\n\nlemma sep_map_irq_sep_irq_node:\n \"(irq \\irq k_irq_table irq \\* R) s\n \\ sep_irq_node s irq = Some (k_irq_table irq)\"\n by (fastforce simp: sep_map_irq_def sep_conj_def\n sep_disj_sep_state_def sep_state_disj_def\n plus_sep_state_def sep_state_add_def\n map_disj_def map_add_Some_iff)\n\n(*********************************************************************************\n * A new definition of si_irq_nodes that states that the mapping is injective. *\n *********************************************************************************)\n\nlemma sep_map_o_distinct:\n \"(obj_id \\o obj \\* obj_id' \\o obj') s \\ obj_id \\ obj_id'\"\n by (fastforce simp: sep_map_o_def sep_map_general_def sep_conj_def object_to_sep_state_def\n sep_disj_sep_state_def sep_state_disj_def\n map_disj_def dom_def disjoint_iff_not_equal)\n\nlemma sep_any_map_o_false_eq:\n \"(obj_id \\o - \\* obj_id \\o -) = sep_false\"\n by (fastforce simp: sep_any_def sep_map_o_def sep_map_general_def sep_conj_def\n object_to_sep_state_def sep_disj_sep_state_def sep_state_disj_def\n map_disj_def dom_def disjoint_iff_not_equal)\n\nlemma sep_any_map_o_false:\n \"(obj_id \\o - \\* obj_id \\o -) s \\ False\"\n by (simp add: sep_any_map_o_false_eq)\n\nlemma sep_map_o_false:\n \"(obj_id \\o obj \\* obj_id \\o obj') s \\ False\"\n by (metis sep_map_o_distinct)\n\nlemma sep_map_o_any_distinct_list:\n \"((f x) \\o - \\* \\* map (\\x. (f x) \\o -) xs) s\n \\ x \\ set xs\"\n apply clarsimp\n apply (subst (asm) sep_list_conj_map_remove1, assumption)\n apply (sep_drule sep_any_map_o_false)\n apply clarsimp\n done\n\nlemma sep_any_map_o_inj_on:\n \"(\\* map (\\x. (f x) \\o -) xs) s\n \\ inj_on f (set xs)\"\n apply (induct xs arbitrary: s)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: sep_conj_def)\n apply clarsimp\n apply (frule sep_map_o_any_distinct_list)\n apply simp\n done\n\nlemma sep_any_map_o_inj_on_set:\n \"\\(\\* x \\ A. (f x) \\o -) s; finite A\\\n \\ inj_on f A\"\n apply (drule sep_map_set_conj_sep_list_conj [where P=\"\\x. (f x) \\o -\"])\n apply clarsimp\n apply (erule sep_any_map_o_inj_on)\n done\n\nlemma sep_map_o_inj_on_set:\n \"\\(\\* x \\ A. (f x) \\o obj) s; finite A\\\n \\ inj_on f A\"\n apply (rule sep_any_map_o_inj_on_set [rotated, where s=s], assumption)\n apply (erule sep_map_set_conj_impl)\n apply (fastforce simp: sep_any_def)\n apply simp\n done\n\nlemma sep_conj_existL:\n \"(P \\* Q) s \\ \\s. P s\"\n by (auto simp: sep_conj_def)\n\nlemma sep_conj_existR:\n \"(P \\* Q) s \\ \\s. Q s\"\n by (auto simp: sep_conj_def)\n\nlemma si_irq_nodes_def2:\n \"si_irq_nodes spec =\n (\\s. \\k_irq_table. inj_on k_irq_table (used_irqs spec) \\\n (\\* irq\\used_irqs spec. irq \\irq k_irq_table irq \\*\n k_irq_table irq \\o IRQNode empty_irq_node) s)\"\n apply (rule ext)\n apply (clarsimp simp: si_irq_nodes_def)\n apply (rule iffI)\n apply clarsimp\n apply (rule_tac x=k_irq_table in exI, simp)\n apply (subst (asm) sep.prod.distrib)\n apply (drule sep_conj_existR, clarsimp)\n apply (erule sep_map_o_inj_on_set) (* Why doesn't sep_rule work? *)\n apply simp\n apply blast\n done\n\n\n\n(*******************************************\n * The actual proofs about create_irq_caps *\n *******************************************)\n\nlemma well_formed_default_irq_node_empty:\n \"\\well_formed spec; irq \\ used_irqs spec\\\n \\ object_at (\\obj. object_default_state obj = IRQNode empty_irq_node) (cdl_irq_node spec irq) spec\"\n apply (frule (1) well_formed_used_irqs_have_irq_node, clarsimp)\n apply (frule (1) well_formed_irq_is_irq_node)\n apply (frule (1) well_formed_size_irq_node)\n apply (clarsimp simp: object_at_def empty_irq_node_def object_default_state_def2\n is_irq_node_def object_size_bits_def\n split: cdl_object.splits)\n done\n\nlemma create_irq_cap_sep:\n \"\\\\(si_cnode_id, unat free_cptr) \\c NullCap \\*\n irq \\irq kernel_irq_id \\*\n kernel_irq_id \\o (IRQNode empty_irq_node) \\*\n si_objects \\* R\\ and\n K(well_formed spec \\\n irq \\ used_irqs spec \\\n t' (cdl_irq_node spec irq) = Some kernel_irq_id \\\n irq_caps irq = Some free_cptr \\\n free_cptr < 2 ^ si_cnode_size)\\\n create_irq_cap spec (irq, free_cptr)\n \\\\_.\n \\irq_empty spec t' irq \\*\n si_irq_cap_at irq_caps spec irq \\*\n si_objects \\*\n R\\\\\"\n apply (rule hoare_gen_asm, clarsimp)\n apply (frule (1) well_formed_used_irqs_have_irq_node, clarsimp)\n apply (frule (1) well_formed_default_irq_node_empty, clarsimp simp: object_at_def)\n apply (clarsimp simp: create_irq_cap_def si_objects_def si_cnode_caps\n irq_empty_def irq_initialised_general_def\n si_irq_cap_at_def sep_conj_assoc)\n apply (wp add: hoare_drop_imp sep_wp: seL4_IRQHandler_IRQControl_Get, simp)\n apply (rule conjI)\n apply sep_solve\n apply (simp add: offset_slot_si_cnode_size' guard_equal_si_cspace_cap word_bits_def)\n done\n\nlemma create_irq_caps_sep_helper:\n \"\\\\((\\* cptr \\ set (take (card (used_irqs spec)) free_cptrs).\n ((si_cnode_id, unat cptr) \\c NullCap)) \\*\n si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\*\n si_objects \\* si_irq_nodes spec \\* R) and\n K (well_formed spec \\\n list_all (\\n. n < 2 ^ si_cnode_size) free_cptrs \\\n distinct free_cptrs \\\n card (used_irqs spec) \\ length free_cptrs)\\ \\\n create_irq_caps spec free_cptrs\n \\\\rv s. \\(t'::32 word \\ 32 word option).\n \\(irqs_empty spec t' (used_irqs spec) \\*\n si_irq_caps_at (fst rv) spec (used_irqs spec) \\*\n si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\*\n si_objects \\* R)\n and K ((map_of (zip (used_irq_list spec) free_cptrs), drop (card (used_irqs spec)) free_cptrs) = rv \\\n inj_on t' (used_irq_nodes spec) \\\n dom t' = used_irq_nodes spec)\\ s\\\"\n including no_pre\n apply clarsimp\n apply (rule hoare_gen_asm_conj)\n apply (clarsimp simp: create_irq_caps_def si_irq_nodes_def2 sep_conj_exists)\n apply wp\n apply simp\n apply (rule hoare_grab_exs2)\n apply (rule_tac x=\"(\\obj_id. Some ((k_irq_table \\ inv (cdl_irq_node spec)) obj_id))\n |` used_irq_nodes spec\" in hoare_exI)\n\n apply (rule_tac P1 = \"\\(irq,free_cptr). (si_cnode_id, unat free_cptr) \\c NullCap \\*\n irq \\irq k_irq_table irq \\*\n k_irq_table irq \\o IRQNode empty_irq_node\" and\n Q1 = \"\\(irq,free_cptr). irq_empty spec ((\\obj_id. Some ((k_irq_table \\ inv (cdl_irq_node spec)) obj_id))\n |` used_irq_nodes spec) irq \\*\n si_irq_cap_at (map_of (zip (used_irq_list spec) free_cptrs)) spec irq\" and\n I1 = \"si_objects\" and\n R1 = \"si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\*\n R\" in hoare_chain [OF mapM_x_set_sep])\n apply (metis distinct_zipI2)\n apply (clarsimp split:prod.splits)\n apply (clarsimp simp: sep_conj_assoc)\n apply (wp sep_wp: create_irq_cap_sep, simp+)\n apply (rule conjI)\n apply (clarsimp simp: sep_conj_assoc sep_conj_exists)\n apply sep_solve\n apply (frule well_formed_inj_cdl_irq_node)\n apply (frule set_zip_leftD)\n apply (frule in_set_zip2)\n apply (simp add: map_of_zip_tuple_in list_all_iff unat_less_2_si_cnode_size\n restrict_map_def used_irq_nodes_def)\n\n apply (subst sep_list_conj_sep_map_set_conj [symmetric], erule distinct_zipI2)\n apply (subst (asm) sep_list_conj_sep_map_set_conj [symmetric, where xs = \"used_irq_list spec\", simplified])\n apply (subst split_beta')\n apply (subst sep_list_conj_map_add)\n apply (subst zip_take_length [symmetric])\n apply (subst split_beta' [symmetric])+\n apply (subst map_zip_snd', simp)\n\n apply (subst (asm) (3) append_take_drop_id [where n=\"card (used_irqs spec)\" and xs=free_cptrs, symmetric])\n apply (subst map_zip_fst', simp)\n apply (subst sep_list_conj_sep_map_set_conj, fastforce simp: used_irq_list_def)\n apply (simp add: comp_def)\n apply sep_solve\n\n apply simp\n apply (subst (asm) sep_list_conj_sep_map_set_conj [symmetric], erule distinct_zipI2)\n apply (subst (asm) map_zip_fst', simp)\n apply (subst (asm) sep_list_conj_map_add)\n apply (subst (asm) sep_list_conj_sep_map_set_conj,\n metis used_irq_list_def distinct_sorted_list_of_set)\n apply (subst (asm) sep_list_conj_sep_map_set_conj,\n metis used_irq_list_def distinct_sorted_list_of_set)\n apply (clarsimp simp: irqs_empty_def si_irq_caps_at_def)\n apply (rule conjI)\n apply sep_solve\n apply (frule well_formed_inj_cdl_irq_node)\n apply (fastforce simp: inj_on_def used_irq_nodes_def)\n done\n\n\n\n\n\n(*****************************************************************************\n * The above lemma has an injection on just the IRQs. *\n * We take the above proof, and join it with the result of CreateObjects *\n * to produce an injection on all objects. *\n * *\n * The sum of the two injections \"t_irqs\" and \"t_real\" is injective because: *\n * - Each individual relation is injective *\n * - The domains are separate *\n * - The ranges are separate *\n * *\n * The first two are easily true. *\n * The last one is hard and only true because we have *\n obj_id \\o Untyped \\* obj_id \\ IRQ, and so the obj_ids are distinct. *\n *****************************************************************************)\n\nlemma irq_empty_cong:\n \"t (cdl_irq_node spec irq) = t' (cdl_irq_node spec irq)\n \\ irq_empty spec t irq = irq_empty spec t' irq\"\n by (clarsimp simp: irq_empty_def irq_initialised_general_def)\n\nlemma object_empty_cong:\n \"t obj_id = t' obj_id\n \\ object_empty spec t obj_id = object_empty spec t' obj_id\"\n by (clarsimp simp: object_empty_def object_initialised_general_def)\n\nlemma si_cap_at_cong:\n \"t obj_id = t' obj_id\n \\ si_cap_at t si_caps spec dev obj_id = si_cap_at t' si_caps spec dev obj_id\"\n by (clarsimp simp: si_cap_at_def)\n\nlemma irq_empty_map_add:\n \"\\dom t' = cdl_irq_node spec ` irqs\\\n \\ irqs_empty spec t' irqs = irqs_empty spec (t++t') irqs\"\n apply (clarsimp simp: irqs_empty_def)\n apply (rule sep.prod.cong, simp)\n apply (subst irq_empty_cong [where t'=\"t++t'\" and t=t'], simp_all)\n by (metis imageI map_add_eval_right)\n\nlemma object_empty_map_add:\n \"\\dom t = obj_ids; map_disj t t'\\\n \\ objects_empty spec t obj_ids = objects_empty spec (t++t') obj_ids\"\n apply (clarsimp simp: objects_empty_def)\n apply (rule sep.prod.cong, simp)\n apply (subst object_empty_cong [where t'=\"t++t'\" and t=t], simp_all)\n by (metis map_add_eval_left)\n\nlemma si_caps_at_map_add:\n \"\\dom t = obj_ids; map_disj t t'\\\n \\ si_caps_at t si_caps spec dev obj_ids = si_caps_at (t++t') si_caps spec dev obj_ids\"\n apply (clarsimp simp: si_caps_at_def)\n apply (rule sep.prod.cong, simp)\n apply (subst si_cap_at_cong [where t'=\"t++t'\" and t=t], simp_all)\n by (metis map_add_eval_left)\n\n\nlemma inj_on_map_add:\n \"\\inj_on m (dom m); inj_on m' (dom m');\n dom m \\ dom m' = {}; ran m \\ ran m' = {}; A = dom m \\ dom m'\\\n \\ inj_on (m ++ m') A\"\n apply (rule inj_onI)\n apply clarsimp\n apply (elim disjE)\n apply (metis inj_on_eq_iff inter_empty_not_both map_add_eval_left')\n apply (metis dom_ran map_add_comm map_add_eval_right orthD1)\n apply (metis dom_ran map_add_comm map_add_eval_right orthD1)\n apply (metis inj_on_def map_add_eval_right)\n done\n\nlemma inter_emptyI:\n \"\\\\x. x \\ A \\ x \\ B \\ False\\ \\ A \\ B = {}\"\n by auto\n\nlemma ran_inter_emptyI:\n \"\\\\x a b. f a = Some x \\ g b = Some x \\ False\\ \\ ran f \\ ran g = {}\"\n apply (rule inter_emptyI)\n apply (auto simp: ran_def)\n done\n\nlemma irq_empty_objects_empty_ran_distinct:\n \"\\\\irqs_empty spec t_irq (used_irqs spec) \\*\n objects_empty spec t_real {obj_id. real_object_at obj_id spec} \\* R\\ s;\n well_formed spec;\n inj_on t_irq (cdl_irq_node spec ` used_irqs spec); dom t_irq = cdl_irq_node spec ` used_irqs spec;\n inj_on t_real {obj_id. real_object_at obj_id spec}; dom t_real = {obj_id. real_object_at obj_id spec}\\\n \\ ran t_real \\ ran t_irq = {}\"\n apply (frule well_formed_inj_cdl_irq_node)\n apply (clarsimp simp: irqs_empty_def irq_empty_def irq_initialised_general_def\n objects_empty_def object_empty_def object_initialised_general_def)\n apply (rule ran_inter_emptyI)\n apply clarsimp\n apply (frule domI [where m=t_real])\n apply (frule domI [where m=t_irq])\n apply clarsimp\n apply (rename_tac irq_obj_id obj_id irq)\n apply (subst (asm) sep.prod.remove, simp, assumption)\n apply (subst (asm) sep.prod.remove, simp, fast)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (sep_drule sep_map_o_false, simp)\n done\n\n\nlemma si_objects_extra_caps'_split:\n \"\\well_formed spec; distinct free_cptrs';\n free_cptrs = drop (card {obj_id. real_object_at obj_id spec}) free_cptrs'\\ \\\n si_objects_extra_caps' {obj_id. real_object_at obj_id spec} free_cptrs' untyped_cptrs\n =\n ((\\* cptr \\ set (take (card (used_irqs spec)) free_cptrs). (si_cnode_id, unat cptr) \\c NullCap) \\*\n si_objects_extra_caps' (dom (cdl_objects spec)) free_cptrs' untyped_cptrs)\"\n apply (frule well_formed_objects_card [symmetric])\n apply (subst (asm) add.commute)\n apply (clarsimp simp: si_objects_extra_caps'_def sep_conj_exists sep_conj_assoc)\n apply (subst take_drop_append [where a=\"card {obj_id. real_object_at obj_id spec}\"\n and b=\"card (used_irqs spec)\"])\n apply clarsimp\n apply (subst sep.prod.union_disjoint, (simp add: distinct_take_drop_append)+)\n apply (clarsimp simp: sep_conj_ac)\n done\n\n\nlemma create_irq_caps_sep:\n \"\\\\s. \\t_real.\n \\(objects_empty spec t_real {obj_id. real_object_at obj_id spec} \\*\n si_caps_at t_real orig_caps spec dev {obj_id. real_object_at obj_id spec} \\*\n si_objects \\*\n si_objects_extra_caps' {obj_id. real_object_at obj_id spec} free_cptrs_orig untyped_cptrs \\*\n si_irq_nodes spec \\* R) and\n K (well_formed spec \\\n distinct free_cptrs_orig \\\n list_all (\\n. n < 2 ^ si_cnode_size) free_cptrs \\\n card (used_irqs spec) \\ length free_cptrs \\\n inj_on t_real {obj_id. real_object_at obj_id spec} \\\n dom t_real = {obj_id. real_object_at obj_id spec} \\\n dom orig_caps = {obj_id. real_object_at obj_id spec} \\\n free_cptrs = drop (card {obj_id. real_object_at obj_id spec}) free_cptrs_orig)\\ s\\\n create_irq_caps spec free_cptrs\n \\\\rv s. \\(t::32 word \\ 32 word option).\n \\(objects_empty spec t {obj_id. real_object_at obj_id spec} \\*\n irqs_empty spec t (used_irqs spec) \\*\n si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\*\n si_irq_caps_at (fst rv) spec (used_irqs spec) \\*\n si_objects \\*\n si_objects_extra_caps' (dom (cdl_objects spec)) free_cptrs_orig untyped_cptrs \\*\n R) and\n K ((map_of (zip (used_irq_list spec) free_cptrs), drop (card (used_irqs spec)) free_cptrs) = rv \\\n inj_on t (dom (cdl_objects spec)) \\ dom t = dom (cdl_objects spec))\\ s\\\"\n apply (rule hoare_ex_pre)\n apply (rule hoare_gen_lifted_asm)\n apply (elim conjE)\n apply (subst si_objects_extra_caps'_split, assumption+)\n apply (rule hoare_chain [OF create_irq_caps_sep_helper, where orig_caps1=orig_caps])\n apply (rule pred_andI)\n apply sep_solve\n apply clarsimp\n apply clarsimp\n apply (rule_tac x=\"t_real ++ t'\" in exI)\n apply clarsimp\n apply (frule well_formed_objects_real_or_irq)\n apply (frule well_formed_objects_only_real_or_irq)\n apply (clarsimp simp: used_irq_nodes_def)\n apply (subgoal_tac \"map_disj t_real t'\")\n apply (rule conjI)\n apply (subst object_empty_map_add [symmetric], assumption+)\n apply (subst irq_empty_map_add [symmetric],simp add: used_irq_nodes_def)\n apply (subst si_caps_at_map_add [symmetric], assumption+)\n apply (clarsimp simp: si_objects_extra_caps'_def sep_conj_exists sep_conj_assoc)\n apply (rule_tac x=untyped_caps in exI)\n apply (rule_tac x=all_available_ids in exI)\n apply sep_solve\n apply (rule conjI)\n apply (rule inj_on_map_add, simp+)\n apply (rule irq_empty_objects_empty_ran_distinct, sep_solve, simp+)\n apply (metis sup_commute)\n apply (clarsimp simp: map_disjI)\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/sys-init/CreateIRQCaps_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177488, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.26113244080387116}} {"text": "theory WTLemma\n imports GenSubEnv WellTypedExp PermEnvMisc NormEnv \nbegin\n \n (* \n ####################################\n P2. general well-typed lemmas\n ####################################\n *)\n\nlemma well_typed_perm_leq: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_use_env r_s2 r_s1\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n done\n\nlemma well_typed_perm_leqx: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_use_env rx r_s2\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* if case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n done\n\nlemma well_typed_spec_perm_leq: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ leq_perm (r_s2 x) (r_s1 x)\"\n apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" in well_typed_perm_leq)\n apply (auto)\n apply (simp add: leq_use_env_def)\n done \n \n (* \n ####################################\n P3. well-typed free var lemmas\n ####################################\n *)\n \nlemma well_typed_fv_env_use: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e \\ \\ env x \\ None\"\n (*apply (simp add: env_gen_use_def)*)\n apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n apply (case_tac \"\\ y. add_env env x1a t1 x = Some y\")\n apply (simp add: add_env_def)\n apply (auto)\n done\n \nlemma well_typed_rv_env_use: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ ref_vars e \\ \\ env x \\ None\"\n (*apply (simp add: env_gen_use_def)*)\n apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n apply (case_tac \"x = x1a\")\n apply (auto)\n apply (case_tac x2a)\n apply (auto)\n apply (simp add: deref_name_def)\n apply (case_tac \"x = x1a\")\n apply (auto)\n apply (case_tac \"\\ y. add_env env x1a t1 x = Some y\")\n apply (simp add: add_env_def)\n apply (auto)\n done \n \nlemma well_typed_no_npv_use: \"\\ well_typed env r_s1 e tau r_s2 rx; r_s1 x = NoPerm \\ \\ x \\ non_prim_vars env e\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const + op case *)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_vars_def)\n (* var case. *)\n apply (cut_tac r_x=\"ereq_use_env x1a tau_x\" and r_s=\"r_s1\" in leq_use_none)\n apply (auto)\n apply (case_tac \"x \\ x1a\")\n apply (simp add: non_prim_vars_def)\n apply (cut_tac x=\"x\" and tau=\"tau_x\" in ereq_use_none)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n (* pair case 1 *)\n apply (case_tac \"x \\ free_vars (PairExp e1 e2)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* pair case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* if case 1 *)\n apply (case_tac \"x \\ free_vars (IfExp e1 e2 e3)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e1\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* if case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e2\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* if case 3 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e3\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* lambda case *)\n apply (case_tac \"x \\ x1a\")\n apply (auto)\n apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (auto)\n apply (cut_tac r_s=\"rxa\" and y=\"x1a\" and r=\"r\" and x=\"x\" in add_use_none_rev)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars (add_env env x1a t1) e\")\n apply (simp add: non_prim_vars_def)\n apply (case_tac \"\\ non_prim_entry (add_env env x1a t1) x\")\n apply (simp add: non_prim_entry_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* app case 1 *)\n apply (case_tac \"x \\ free_vars (AppExp e1 e2)\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e1\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* app case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (case_tac \"x \\ non_prim_vars env e2\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n done\n \n \n \n(*\nlemma well_typed_no_fv_use: \"\\ well_typed env r_s1 e tau r_s2 rx; r_s1 x = NoPerm \\ \\ x \\ free_vars e\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (cut_tac r_x=\"req_use_env x tau\" and r_s=\"r_s1\" in leq_use_none)\n apply (auto)\n apply (cut_tac x=\"x\" in req_use_none)\n apply (auto)\n (* if case 1 *)\n apply (metis)\n (* if case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (metis)\n (* if case 3 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (metis)\n (* lambda case *)\n apply (case_tac \"x \\ x1a\")\n apply (auto)\n apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (auto)\n apply (cut_tac r_s=\"rxa\" and y=\"x1a\" and r=\"r\" and x=\"x\" in add_use_none_rev)\n apply (auto)\n apply (metis)\n (* app case 1 *)\n apply (metis)\n (* app case 2 *)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (metis)\n done *)\n \nlemma well_typed_aff_fv_own: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e; env x = Some t; req_type t = Aff \\ \\ r_s1 x = OwnPerm\" \n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac \"ereq_use_env x t x \\ OwnPerm\")\n apply (simp add: ereq_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (simp add: one_use_env_def)\n apply (cut_tac r_x=\"ereq_use_env x t\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (auto)\n (* pair case 2 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* if case 2 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* if case 3 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* lambda case *)\n apply (rule_tac r_x=\"rxa\" in leq_use_own)\n apply (auto)\n apply (case_tac \"\\ add_use_env rxa x1a r x = OwnPerm\")\n apply (auto)\n apply (case_tac \"\\ add_env env x1a t1 x = Some t\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n (* app case *)\n apply (rule_tac r_x = \"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n done \n \n (*\nlemma well_typed_fv_start_use: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e; env x = Some t; aff_fun_ty t \\ \\ r_s1 x = OwnPerm\" \n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (case_tac \"req_use_env x t x \\ OwnPerm\")\n apply (simp add: req_use_env_def)\n apply (simp add: start_req_perm_def)\n apply (simp add: one_use_env_def)\n apply (cut_tac r_x=\"req_use_env x t\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (auto)\n (* if case 2 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* if case 3 *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n (* lambda case *)\n apply (rule_tac r_x=\"rxa\" in leq_use_own)\n apply (auto)\n apply (case_tac \"\\ add_use_env rxa x1a r x = OwnPerm\")\n apply (auto)\n apply (case_tac \"\\ add_env env x1a t1 x = Some t\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n (* app case*)\n apply (rule_tac r_x = \"r_s2a\" in leq_use_own)\n apply (auto)\n apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n apply (auto)\n done*)\n \n (* \n ####################################\n P4. well-typed manipulation for type environments\n ####################################\n *)\n\nlemma well_typed_add_vars: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e; x \\ ref_vars e \\ \\ well_typed (add_env env x t) r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: add_env_def)\n apply (simp add: deref_name_def)\n apply (case_tac x2a)\n apply (auto)\n apply (simp add: add_env_def)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto) \n (* lambda case 1 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (case_tac \"x = x1a\")\n apply (cut_tac env=\"env\" and x=\"x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"x1a\" and y=\"x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n apply (auto)\n (* lambda case 2 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac env=\"env\" and x=\"x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n\nlemma well_typed_rem_vars: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e; x \\ ref_vars e \\ \\ well_typed (rem_env env x) r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: rem_env_def)\n apply (simp add: deref_name_def)\n apply (case_tac x2a)\n apply (auto)\n apply (simp add: rem_env_def)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lambda case 1 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (case_tac \"x = x1a\")\n apply (cut_tac env=\"env\" and x=\"x\" and t=\"t1\" in partial_add_rem_env)\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"x\" and y=\"x1a\" and t=\"t1\" in almost_comm_add_rem_env)\n apply (auto)\n (* lambda case 2 *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac env=\"env\" and x=\"x\" and t=\"t1\" in partial_add_rem_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n\nlemma well_typed_add_vars_rev: \"\\ well_typed (add_env env x t) r_s1 e tau r_s2 rx; x \\ free_vars e; x \\ ref_vars e \\ \\ well_typed env r_s1 e tau r_s2 rx\"\n apply (cut_tac env=\"add_env env x t\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_vars)\n apply (auto)\n apply (case_tac \"env x = None\")\n apply (auto)\n apply (cut_tac env=\"env\" and x=\"x\" and t=\"t\" in cancel_rem_add_env)\n apply (auto)\n apply (rule_tac t=\"well_typed env r_s1 e tau r_s2 rx\" and s=\"well_typed (add_env (rem_env env x) x y) r_s1 e tau r_s2 rx\" in subst)\n apply (cut_tac env=\"env\" and x=\"x\" and y=\"y\" in cancel_add_rem_env)\n apply (auto)\n apply (rule_tac well_typed_add_vars)\n apply (cut_tac env=\"env\" and x=\"x\" and y=\"t\" in partial_rem_add_env)\n apply (auto)\n done\n\nlemma well_typed_contain_env: \"\\ contain_env env env'; well_typed env' r_s1 e tau r_s2 rx \\ \\ well_typed env r_s1 e tau r_s2 rx\" \n apply (induct e arbitrary: env env' r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"deref_name x1a x2a\" in allE)\n apply (auto)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"x1a\" in allE)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (cut_tac r_s=\"env\" and r_x=\"env'\" and x=\"x1a\" and t=\"t1\" in dist_add_contain_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done\n \n (* \n ####################################\n P5. well-typed manipulation for start permissions\n ####################################\n *) \n \nlemma well_typed_comp_start_perm: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (comp_use_env r_s1 r_ex) e tau r_s2 rx\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const, op, var case 1 *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* var case 2 *)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau_x) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done\n \nlemma well_typed_comp_start_perm2: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (comp_use_env r_ex r_s1) e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_start_perm)\n apply (auto)\n done \n \nlemma well_typed_incr_start_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_s1 r_c \\ \\ well_typed env r_c e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_c\" and r_x=\"r_s1\" in cancel_comp_use_env2)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and r_ex=\"r_c\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" in well_typed_comp_start_perm2)\n apply (auto)\n done\n \n (* \n ####################################\n P6. well-typed manipulation for sweeping changes\n ####################################\n *) \n \n (* - diff perm lemmas *)\n \nlemma wtdp_start_perm_req: \"\\ y \\ own_env_vars r_x; leq_use_env (req_use_env y tau) r_s1 \\\n \\ leq_use_env (req_use_env y tau) (diff_use_env r_s1 r_x)\" \n apply (rule_tac r_s=\"r_s1\" in req_leq_use_env)\n apply (simp)\n apply (cut_tac r_s=\"r_s1\" and x=\"y\" and r_x=\"r_x\" in diff_use_eq)\n apply (auto)\n apply (simp add: own_env_vars_def)\n done\n \nlemma lhs_ddl_use_env: \"\\ disj_use_env r_s r_x \\ \\ leq_use_env (diff_use_env r_s (diff_use_env r_ex r_x)) (diff_use_env r_s r_ex)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n\nlemma weak_diff_req_use_env: \"weak_use_env (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (auto)\n apply (case_tac \"req_use_env x tau xa\")\n apply (auto)\n done\n \nlemma wtdp_disj_req_use_env2: \"\\ r_x x \\ OwnPerm \\ \\ disj_use_env r_x (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n apply (cut_tac x=\"x\" and tau=\"tau\" in weak_diff_req_use_env)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"req_use_env x tau\" in leq_use_none)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac req_use_none_alt)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (simp add: weak_use_env_def)\n done\n \nlemma wtdp_end_req: \"\\ non_prim_vars env e \\ own_env_vars r_x = {}; x \\ free_vars e; env x = Some tau;\n r_x x = OwnPerm \\ \\ end_req_perm tau = NoPerm\" \n apply (case_tac \"x \\ non_prim_vars env e\")\n apply (simp add: own_env_vars_def)\n apply (auto)\n apply (case_tac \"req_type tau \\ Prim\")\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (simp add: end_req_perm_def)\n done\n \nlemma well_typed_diff_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; non_prim_vars env e \\ own_env_vars r_x = {} \\ \\\n well_typed env (diff_use_env r_s1 r_x) e tau (diff_use_env r_s2 r_x) (diff_use_env rx r_x)\"\n apply (induction e arbitrary: env r_s1 tau r_s2 rx r_x)\n apply (auto)\n (* const case *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* op case *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* var case p1. manipulation to show that x1a exists in r_s2 *)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp)\n apply (simp add: ereq_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x1a x2a\" and r_x=\"r_x\" and x=\"x1a\" in wtdp_end_req)\n apply (auto)\n (* var case p2 *)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_pull_comp_use_env)\n apply (cut_tac r_ex=\"r_ex\" and r_x=\"r_x\" in sum_comp_diff_use_env)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - use disjointess of r_x from (req x tau) to remove - r_x *)\n apply (rule_tac disj_diff_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env1)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x1a x2a\" and r_x=\"r_x\" and x=\"x1a\" in wtdp_end_req)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env2)\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: one_use_env_def)\n (* - through a slightly more involved process we can also remove it from the left *)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env (ereq_use_env x1a tau_x) (ereq_use_env x1a tau_x)) r_ex\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac lhs_ddl_use_env)\n apply (rule_tac comm_disj_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env1)\n apply (auto)\n apply (rule_tac env=\"env\" and e=\"VarExp x1a x2a\" and r_x=\"r_x\" and x=\"x1a\" in wtdp_end_req)\n apply (auto)\n apply (rule_tac one_mini_disj_use_env2)\n apply (auto)\n apply (simp add: one_use_env_def)\n (* pair case *)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (*apply (rule_tac aff_diff_use_env)\n apply (simp)*)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n apply (rule_tac t=\"diff_use_env (diff_use_env r_s3 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s3 r_ex) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env) \n apply (simp add: pair_req_def)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (simp add: dist_diff_comp_use_env)\n apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_x)\n (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"diff_use_env rx' r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e3 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (rule_tac dist_minus_comp_use_env)\n (* lambda case *)\n apply (rule_tac x=\"diff_use_env rxa r_x\" in exI)\n apply (auto)\n apply (rule_tac x=\"diff_use_env r_end (rem_use_env r_x x1a)\" in exI)\n apply (rule_tac x=\"diff_use_env r_s' (rem_use_env r_x x1a)\" in exI)\n apply (cut_tac r_s=\"rxa\" and x=\"x1a\" and r=\"r\" and r_x=\"r_x\" in diff_add_rem_use_env)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars (add_env env x1a t1) e \\ own_env_vars (rem_use_env r_x x1a) = {}\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (simp add: own_env_vars_def)\n apply (case_tac \"x = x1a\")\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (simp add: non_prim_entry_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac aff_diff_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n (* - proving bounds *)\n apply (rule_tac t=\"diff_use_env (diff_use_env r_s1 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s1 r_ex) r_x\" in subst)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"diff_use_env (diff_use_env rxa r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env rxa r_ex) r_x\" in subst)\n apply (cut_tac r_s=\"rxa\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e1 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n apply (auto)\n apply (case_tac \"\\ non_prim_vars env e2 \\ own_env_vars r_x = {}\")\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* - reusable substitutions *)\n apply (case_tac \"\\ lift_use_env (diff_use_env rx2 r_x) r = diff_use_env (lift_use_env rx2 r) r_x\")\n apply (cut_tac r_s=\"rx2\" and r=\"r\" and r_x=\"r_x\" in lift_diff_use_env)\n apply (simp)\n (* - last instantiation *)\n apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n apply (auto)\n (* - prove the bound for r_s2 *)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove lift safety *)\n (* - prove rx1 + rx2 is subtractable *)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n (* - prove disjointedness *)\n apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove r_ex bound *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* - prove the bound for rx *)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env rx2 r_x)\" and s=\"diff_use_env (comp_use_env rx1 rx2) r_x\" in subst)\n apply (simp add: diff_use_env_def)\n apply (rule_tac dist_minus_comp_use_env) \n apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env (lift_use_env rx2 r) r_x)\" and\n s=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in subst)\n apply (simp add: diff_use_env_def)\n apply (rule_tac dist_minus_comp_use_env)\n apply (rule_tac t=\"comp_use_env (diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x) (diff_use_env r_ex r_x)\" and\n s=\"diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n apply (simp add: diff_use_env_def)\n apply (rule_tac dist_minus_comp_use_env)\n apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) r_x) (diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x)\" and\n s=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in subst)\n apply (rule_tac dist_sq_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n done \n\nlemma well_typed_rem_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e \\ \\\n well_typed env (rem_use_env r_s1 x) e tau (rem_use_env r_s2 x) (rem_use_env rx x)\" \n apply (cut_tac r_s=\"r_s1\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (simp add: one_use_env_def)\n apply (simp add: own_env_vars_def)\n apply (case_tac \"x = xa\")\n apply (auto)\n done\n\nlemma well_typed_add_perms_rev: \"\\ well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r') (add_use_env rx x r3);\n r_s1 x = NoPerm; r_s2 x = NoPerm; rx x = NoPerm; x \\ non_prim_vars env e \\ \\ well_typed env r_s1 e tau r_s2 rx\"\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r'\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r3\" in cancel_rem_add_use_env)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"add_use_env r_s1 x r\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"add_use_env r_s2 x r'\" and rx=\"add_use_env rx x r3\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n done\n \n (* \n ####################################\n P7. well-typed manipulation for permission changes\n ####################################\n *) \n\nlemma well_typed_comp_perms_gen: \"\\ well_typed env r_s1 e tau r_s2 rx; mini_disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* op case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* var case *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permission bounds check *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau_x) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n (* - second half of end permission bounds check *)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* - various bounds checks *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sa=\"r_s1\" and r_sb=\"r_s2a\" and r_sc=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permissions bounds check *)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* - second half of end permissions bounds check *)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n (* - final bounds checks *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done \n \nlemma well_typed_comp_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n apply (rule_tac well_typed_comp_perms_gen)\n apply (simp)\n apply (simp add: disj_use_env_def)\n done\n \n (*\nlemma well_typed_comp_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* op case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* var case *)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permission bounds check *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (req_use_env x1a tau) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n (* - second half of end permission bounds check *)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* - various bounds checks *)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in disj_leq_use_env1)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sa=\"r_s1\" and r_sb=\"r_s2a\" and r_sc=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n (* - first half of end permissions bounds check *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n (* - second half of end permissions bounds check *)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"r_s1\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n (* - final bounds checks *)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n done*)\n\nlemma well_typed_comp_perms2: \"\\ well_typed env r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\ \\\n well_typed env (comp_use_env r_ex r_s1) e tau (comp_use_env r_ex r_s2) rx\" \n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env) \n apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s2\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (auto)\n done \n \nlemma well_typed_add_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e; r = OwnPerm; rx x = NoPerm \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in ignore_rem_use_env)\n apply (simp)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n apply (rule_tac disj_one_use_env)\n apply (simp add: rem_use_env_def)\n done \n \n (*\nlemma well_typed_add_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ free_vars e; r = OwnPerm; rx x = NoPerm \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in ignore_rem_use_env)\n apply (simp)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_perms)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n apply (rule_tac disj_one_use_env)\n apply (simp add: rem_use_env_def)\n done *)\n \nlemma well_typed_incr_simul_perm: \"\\ leq_use_env r_s r_c; well_typed env r_s e tau r_s rx \\ \\ well_typed env r_c e tau r_c rx\"\n apply (rule_tac t=\"r_c\" and s=\"comp_use_env r_s (diff_use_env r_c r_s)\" in subst)\n apply (rule_tac msum_diff_comp_use_env)\n apply (simp)\n apply (rule_tac well_typed_comp_perms_gen)\n apply (simp)\n apply (rule_tac mini_disj_diff_use_env)\n done \n \nlemma well_typed_lift_perms: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) rx\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx) \n apply (auto)\n (* const + op cases *)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* var cases *)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"comp_use_env (ereq_use_env x1a tau_x) r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex\" and r=\"r\" in lift_diff_use_env)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n done \n \n (* \n ####################################\n P8. well-typed manipulation for end permissions\n ####################################\n *) \n \nlemma wtdep_diff_use_env: \"\\ leq_use_env r_x (diff_use_env r_s r_xa) \\ \\ diff_use_env r_x r_ex = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa)\" \n apply (case_tac \"\\ x. diff_use_env r_x r_ex x = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa) x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n\nlemma wtdep_strong_use_vars: \"\\ well_typed env (diff_use_env r_s1 r_x) e tau r_s2 rx; strong_use_env r_x \\ \\ non_prim_vars env e \\ own_env_vars r_x = {}\" \n apply (auto)\n apply (case_tac \"r_x x \\ NoPerm\")\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (cut_tac r_s=\"r_s1\" and r_ex=\"r_x\" and x=\"x\" in diff_use_none_ex)\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and env=\"env\" and ?r_s1.0=\"diff_use_env r_s1 r_x\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: own_env_vars_def)\n done\n \n \nlemma well_typed_break: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env r_s1 e tau (norm_use_env r_s1 r_s2) rx\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* const case *)\n apply (rule_tac self_norm_leq_use_env)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n (* op case *)\n apply (rule_tac self_norm_leq_use_env)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac diff_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (* pair case *)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac spec_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (auto)\n (* - common substitution *)\n apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s2\" in well_typed_perm_leq)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s2\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s2\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (simp)\n (* - rx1 *)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - rx2 *)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e3\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac diff_norm_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_norm_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s3\" in well_typed_perm_leq)\n apply (auto)\n apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n apply (rule_tac sub_norm_use_env)\n apply (simp)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac spec_norm_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n done\n \n (* when we perform substitution, we need to be able to stop \"requiring\" permissions. the\n intuition behind this lemma is that we no longer need a permission if we simply remove it from\n the list of permissions in the environment. *) \n\nlemma well_typed_diff_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s1 \\ \\\n well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n apply (auto)\n (* const case + op case are trivial since they never require permissions *)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* var case *)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e1\" and ?r_s2.0=\"r_s2a\" in well_typed_break)\n apply (auto)\n apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in ex_norm_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - setup r_s2 \\ r_s1 - r_exa *)\n apply (cut_tac r_sc=\"r_s2\" and r_sb=\"r_s2a\" and r_sa=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - prelim for both inductions *)\n apply (case_tac \"diff_use_env r_s2 (comp_use_env (diff_use_env r_ex r_exa) r_exa) \\ diff_use_env (diff_use_env r_s2 (diff_use_env r_ex r_exa)) r_exa\")\n apply (cut_tac r_s=\"r_s2\" and r_x=\"diff_use_env r_ex r_exa\" and r_ex=\"r_exa\" in diff_comp_use_env)\n apply (auto)\n apply (cut_tac r_sc=\"diff_use_env r_ex r_exa\" and r_sb=\"r_ex\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n (* - first induction *)\n apply (rule_tac x=\"diff_use_env r_s1 r_exa\" in exI)\n apply (auto)\n apply (rule_tac x=\"diff_use_env rx1 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac t=\"diff_use_env rx1 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx1 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n apply (rule_tac diff_comp_use_env)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e2\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - lemma to prove non-prim x is not in e2 *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" and e=\"e2\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - second induction *)\n apply (rule_tac x=\"diff_use_env rx2 r_ex\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (cut_tac r_x=\"rx2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac t=\"diff_use_env rx2 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx2 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n apply (rule_tac diff_comp_use_env)\n apply (rule_tac well_typed_diff_perms)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e3\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - lemma to prove non-prim x is not in e3 *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" and e=\"e3\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac rhs_self_norm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - final equality *)\n apply (simp add: diff_use_env_def)\n apply (rule_tac dist_minus_comp_use_env)\n (* the lambda case allows us to select any r_s2 + rx as long as they match. *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s1 r_exa) r_ex\" in trans_leq_use_env)\n apply (rule_tac diff_comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n apply (auto)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp)\n done\n\nlemma well_typed_rem_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; r_s1 x = OwnPerm \\ \\ well_typed env r_s1 e tau (rem_use_env r_s2 x) (rem_use_env rx x)\" \n apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n done \n \nlemma well_typed_decr_end_perm: \"\\ well_typed env r_s1 e tau r_c rx; leq_use_env r_s2 r_c; leq_use_env rx r_s2 \\ \\ well_typed env r_s1 e tau r_s2 rx\" \n apply (induction e arbitrary: env r_s1 tau rx)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx1\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx2\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n apply (auto)\n done\n \nlemma well_typed_diff_decr_end_perm: \"\\ well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex');\n leq_use_env r_ex' r_ex; leq_use_env r_ex r_s1 \\ \\ \n well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n apply (case_tac \"well_typed env r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex) =\n well_typed env r_s1 e tau (diff_use_env (diff_use_env r_s2 r_ex) r_ex) (diff_use_env (diff_use_env rx r_ex') r_ex)\")\n apply (simp)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n apply (cut_tac r_s=\"r_s2\" and r_x=\"r_ex\" in double_diff_use_env)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex'\" and r_c=\"r_ex\" in cancel_diff_use_env)\n apply (auto)\n done \n\nlemma well_typed_diff_decr_end_perm_gen: \"\\ well_typed env r_s1 e tau (diff_use_env r_s2 r_exb) (diff_use_env rx r_exb);\n leq_use_env r_exb r_exa; leq_use_env r_exa r_s1 \\ \\ well_typed env r_s1 e tau (diff_use_env r_s2 r_exa) (diff_use_env rx r_exa)\" \n apply (cut_tac r_s=\"r_s2\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n apply (auto)\n apply (cut_tac r_s=\"rx\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n apply (auto)\n apply (rule_tac well_typed_diff_end_perm)\n apply (auto)\n done \n \n (* \n ####################################\n P9. well-typed manipulation for requirements\n ####################################\n *)\n\nlemma well_typed_comp_req1: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\ \\\n well_typed env r_s1 e tau r_s2 (comp_use_env r_ex rx)\"\n apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n apply (auto)\n (* const + op case *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* var cases *)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_ex rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac assoc_comp_use_env)\n (* lambda case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n done\n \nlemma well_typed_comp_req2: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\ \\\n well_typed env r_s1 e tau r_s2 (comp_use_env rx r_ex)\"\n apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac well_typed_comp_req1)\n apply (auto)\n done\n\nlemma well_typed_incr_req: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env rx rc; leq_use_env rc r_s2 \\ \\ well_typed env r_s1 e tau r_s2 rc\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rc\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"rx1\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp)\n apply (rule_tac x=\"rc\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"rx2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (case_tac \"\\ x. rc x = comp_use_env rc rc x\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (case_tac \"rc x\")\n apply (auto)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n done \n\nlemma well_typed_simul_end_perm: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env r_c r_s2;\n leq_use_env rc r_c; leq_use_env rx rc \\ \\ well_typed env r_s1 e tau r_c rc\"\n apply (rule_tac rx=\"rx\" in well_typed_incr_req)\n apply (rule_tac r_c=\"r_s2\" in well_typed_decr_end_perm)\n apply (auto)\n apply (rule_tac r_sb=\"rc\" in trans_leq_use_env)\n apply (auto)\n done \n (*\nlemma well_typed_add_perms2: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n apply (rule_tac rx=\"rem_use_env rx x\" in well_typed_incr_req)\n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (rule_tac well_typed_comp_perms)\n apply (rule_tac well_typed_rem_perms)\n apply (auto)\n apply (simp add: disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rem_use_env_def)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n apply (auto)\n done *) \n \nlemma well_typed_add_permsx: \"\\ well_typed env r_s1 e tau r_s2 rx; x \\ non_prim_vars env e \\ \\\n well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) (add_use_env rx x r)\" \n apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env) \n apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env) \n apply (simp)\n apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (cut_tac r_s=\"rem_use_env rx x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (rule_tac well_typed_comp_req2)\n apply (rule_tac well_typed_comp_perms)\n apply (rule_tac well_typed_rem_perms)\n apply (auto)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rem_use_env_def)\n apply (rule_tac self_comp_leq_use_env2)\n done\n \n (* \n ####################################\n P10. well-typed manipulation involving lifts\n ####################################\n *) \n\nlemma well_typed_lift_req: \"\\ well_typed env r_s1 e tau r_s2 rx; leq_use_env (lift_use_env rx r) r_s2 \\ \\ well_typed env r_s1 e tau r_s2 (lift_use_env rx r)\" \n apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n apply (auto)\n (* var case *)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"lift_use_env rx1 r\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"lift_use_env rx1 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (auto)\n apply (rule_tac x=\"lift_use_env rx2 r\" in exI)\n apply (auto)\n apply (cut_tac r_sc=\"lift_use_env rx2 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (auto)\n apply (rule_tac lift_comp_use_env)\n (* lam case *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (auto)\n done \n \nlemma well_typed_lift_all_perms: \"\\ well_typed env r_s1 e tau r_s2 rx \\ \\ well_typed env (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) (lift_use_env rx r)\"\n apply (rule_tac well_typed_lift_req)\n apply (rule_tac well_typed_lift_perms)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n done \n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/WTLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2611324408038711}} {"text": "section \\Adversary Rule\\\n\ntheory Adversary_Rule\n imports Helping_Lemmas\nbegin\n\nlocale adversary_rule =\n fixes s :: \"nat \\ context\" \n fixes s' :: \"nat \\ context\"\n fixes R :: predicate\n fixes aux :: var\n fixes Rv defines \"Rv \\ deidx12 (fvp R)\"\nbegin\n\ndefinition \"subst C = substitute C s\"\ndefinition \"subst' C = substitute C s'\"\n\nlemma finite_Rv: \"finite Rv\"\n unfolding Rv_def deidx12_def apply simp\n unfolding vimage_def[symmetric] \n by (meson finite_fvp finite_vimageI idx_inj injI)+\n\nabbreviation \"qrhlC V C \\ qRHL (R \\ Eq V) (subst C) (subst' C) (R \\ Eq V)\"\n\nlemma context_induct[\n params i and p and e C1 C2 and e C and x C and q C and C1 C2, \n case_names Hole program[program] IfTE[IH1 IH2] While[IH] LocalC[IH program classical] LocalQ[IH program quantum] Seq[IH1 IH2]]:\n fixes P :: \"context \\ bool\"\n and \"context\" :: \"context\"\n assumes \"\\i. P (Hole i)\"\n and \"\\p. program p \\ P p\"\n and \"\\e C1 C2. P C1 \\ P C2 \\ P (IfTE e C1 C2)\"\n and \"\\e C. P C \\ P (While e C)\"\n and \"\\x C. P C \\ \\ program C \\ is_classical x \\ P (Local x C)\"\n and \"\\q C. P C \\ \\ program C \\ is_quantum q \\ P (Local q C)\"\n and \"\\C1 C2. P C1 \\ P C2 \\ P (Seq C1 C2)\"\n shows \"P context\"\n apply (rule context.induct)\n using assms apply (auto intro!: program.intros)\n by (meson program.intros(9))\n\nlemma adversary_rule0:\n fixes V :: \"var set\"\n fixes Vmid :: \"var set\"\n assumes inf_aux: \"infinite_var aux\" \n assumes quant_aux: \"is_quantum aux\"\n assumes aux_R: \"aux \\ Rv\"\n assumes aux_si: \"\\i. i \\ holes C \\ aux \\ fv (s i)\"\n assumes aux_s'i: \"\\i. i \\ holes C \\ aux \\ fv (s' i)\"\n assumes finite_Vmid: \"finite Vmid\"\n assumes qrhl_s: \"\\i. i\\holes C \\ qRHL (R \\ Eq Vmid) (s i) (s' i) (R \\ Eq Vmid)\"\n assumes aux_Vmid: \"aux \\ Vmid\"\n assumes Vmid_V: \"Vmid \\ V \\ inner C\"\n assumes Vmid_R: \"Vmid \\ Rv \\ V \\ covered C\"\n assumes Vmid_s: \"\\i. i\\holes C \\ Vmid \\ (fv (s i) \\ fv (s' i)) \\ classical' (overwr (s i) \\ overwr (s' i)) \\ covered C \\ V\"\n assumes fv_V: \"fv C \\ V\"\n assumes R_inner: \"Rv \\ inner C = {}\"\n assumes R_written: \"Rv \\ written C = {}\"\n shows \"qrhlC V C\"\n using aux_si aux_s'i finite_Vmid qrhl_s aux_Vmid Vmid_V Vmid_R Vmid_s fv_V R_inner R_written apply atomize\nproof (induction C arbitrary: V Vmid rule:context_induct)\n case (program p)\n\n from program.prems\n have R_written: \"Rv \\ written p = {}\"\n by simp\n\n from \\fv p \\ V\\\n have \"qRHL (Eq V) p p (Eq V)\"\n by (rule equal_rule)\n then have \"qRHL (R \\ Eq V) p p (R \\ Eq V)\"\n unfolding inf.commute[of R]\n apply (rule frame_rule[rotated -1])\n using R_written \\program p\\\n by (auto simp add: Rv_def deidx12_def idx12_def is_classical'_def)\n then show ?case \n by (simp add: program.program subst_def subst'_def substitute_program)\nnext\n case (Seq C1 C2)\n have subst: \"subst (Seq C1 C2) = Seq (subst C1) (subst C2)\"\n unfolding subst_def by simp\n have subst': \"subst' (Seq C1 C2) = Seq (subst' C1) (subst' C2)\"\n unfolding subst'_def by simp\n\n have \"qrhlC V C1\"\n apply (rule Seq.IH1)\n using Seq.prems by (auto simp: idx12_def)\n moreover have \"qrhlC V C2\"\n apply (rule Seq.IH2)\n using Seq.prems by (auto simp: idx12_def)\n ultimately show ?case\n unfolding subst subst'\n by (rule seq)\nnext\n case (IfTE e C1 C2)\n have subst: \"subst (IfTE e C1 C2) = IfTE e (subst C1) (subst C2)\"\n unfolding subst_def by simp\n have subst': \"subst' (IfTE e C1 C2) = IfTE e (subst' C1) (subst' C2)\"\n unfolding subst'_def by simp\n\n from IfTE.prems\n have \"CVar ` fve e \\ V\"\n by auto\n then have Eq_e: \"Eq V \\ Eq (CVar ` fve e)\"\n apply (subst asm_rl[of \"V = (CVar ` fve e) \\ (V - CVar ` fve e)\"], blast)\n apply (subst Eq_split)\n by (auto simp: is_classical'_def)\n\n have \"qrhlC V C1\"\n apply (rule IfTE.IH1)\n using IfTE.prems by (auto simp: idx12_def) \n moreover have \"qrhlC V C2\"\n apply (rule IfTE.IH2)\n using IfTE.prems by (auto simp: idx12_def)\n ultimately show ?case\n unfolding subst subst'\n apply (rule joint_if_rule[rotated -2])\n using Eq_e by (simp_all add: inf.coboundedI2)\nnext\n case (While e C)\n have subst: \"subst (While e C) = While e (subst C)\"\n unfolding subst_def by simp\n have subst': \"subst' (While e C) = While e (subst' C)\"\n unfolding subst'_def by simp\n\n from While.prems\n have \"CVar ` fve e \\ V\"\n by simp\n then have Eq_e: \"Eq V \\ Eq (CVar ` fve e)\"\n apply (subst asm_rl[of \"V = (CVar ` fve e) \\ (V - CVar ` fve e)\"], blast)\n apply (subst Eq_split)\n by (auto simp: is_classical'_def)\n\n have \"qrhlC V C\"\n apply (rule While.IH)\n using While.prems apply simp\n using While.prems apply (auto simp: idx12_def)[1]\n using While.prems by auto\n then show ?case\n unfolding subst subst'\n apply (rule joint_while_rule[rotated 1])\n using Eq_e by (simp_all add: inf.coboundedI2)\nnext\n case (LocalC x C)\n have subst: \"subst (Local x C) = Local x (subst C)\"\n unfolding subst_def by simp\n have subst': \"subst' (Local x C) = Local x (subst' C)\"\n unfolding subst'_def by simp\n\n from LocalC.classical\n obtain x' where x': \"x = CVar x'\"\n using is_classical.cases by blast\n\n from LocalC.program\n have inner: \"inner (Local x C) = {x} \\ inner C\"\n by simp\n moreover \n from LocalC.prems\n have R_inner: \"Rv \\ inner (Local x C) = {}\"\n by simp\n ultimately have xR: \" x \\ Rv\"\n by auto\n\n have [simp]: \"CVar (idxc b x') = idx b x\" for b\n unfolding x' by simp\n\n have \"qrhlC (insert x V) C\"\n apply (rule LocalC.IH[where V=\"insert x V\"])\n using LocalC.prems inner by (auto simp: idx12_def)\n then have \"qrhlC (V-{x}) (Local x C)\"\n unfolding subst subst'\n apply (rule_tac joint_local0_rule[rotated -1])\n using xR by (auto simp: Rv_def deidx12_def)\n then have \"qRHL (R \\ Eq (V-{x}) \\ Eq (V\\{x}))\n (subst (Local x C)) (subst' (Local x C))\n (R \\ Eq (V-{x}) \\ Eq (V\\{x}))\"\n apply (rule frame_rule[rotated -1])\n by (auto simp: is_classical'_def subst subst' idx12_def intro!: program.intros)\n then show ?case\n unfolding inf.assoc \n unfolding inf.commute[of \"Eq (V-{x})\"]\n apply (subst (asm) Eq_split[symmetric], simp add: is_classical'_def LocalC.classical)\n apply (subst (asm) Eq_split[symmetric], simp add: is_classical'_def LocalC.classical)\n by (simp add: Un_Diff_Int Un_commute)\nnext\n case (LocalQ q C)\n\n from LocalQ.program\n have [simp]: \"inner (Local q C) = insert q (inner C)\"\n by simp\n\n from LocalQ.prems\n have [simp]: \"finite V\"\n using rev_finite_subset by blast\n\n have cofin: \"\\x. compatible q x \\ P x\" if \"finite {x. \\ P x}\" for P :: \"var \\ bool\" and q\n proof -\n have \"{x. compatible q x \\ P x} = Collect (compatible q) - {x. \\ P x}\"\n by auto\n also have \"infinite (Collect (compatible q) - {x. \\ P x})\"\n using that apply (rule Diff_infinite_finite)\n by (simp add: compatible_inexhaust)\n finally have \"{x. compatible q x \\ P x} \\ {}\"\n by force\n then show ?thesis\n by auto\n qed\n\n have [simp]: \"finite {r. \\i\\holes C. r \\ fv (s i)}\"\n apply (subst Collect_bex_eq)\n apply (rule finite_Union)\n by auto\n\n obtain r :: var where [simp]: \\compatible q r\\\n and \"r \\ fv (subst C)\"\n and \"r \\ fv (subst' C)\"\n and \"r \\ Rv\"\n and \"r \\ q\"\n and \"r \\ V\"\n and [simp]: \"\\i. i\\holes C \\ r \\ fv (s i)\"\n and [simp]: \"\\i. i\\holes C \\ r \\ fv (s' i)\"\n apply atomize_elim\n apply (rule cofin)\n by (auto intro!: finite_Rv finite_vimageI[unfolded vimage_def, unfolded inj_on_def, rule_format])\n from \\compatible q r\\ have [simp]: \\is_quantum r\\\n using LocalQ.quantum compatible_is_classical by blast\n\n from LocalQ.quantum \\is_quantum r\\\n obtain q' r' :: qvar where q': \"q = QVar q'\" and r': \"r = QVar r'\"\n by (metis (full_types) is_classical_CVar var.exhaust)\n with \\compatible q r\\ have [simp]: \\compatible (QVar q') (QVar r')\\\n by simp\n\n define V' where\n \"V' = (if q\\V then insert r V - {q} else V)\"\n\n have \"q \\ V'\"\n unfolding V'_def by auto\n\n from LocalQ.prems\n have qR: \"q \\ Rv\"\n by simp\n\n have subst: \"subst (Local q C) = Local q (subst C)\"\n unfolding subst_def by simp\n have subst': \"subst' (Local q C) = Local q (subst' C)\"\n unfolding subst'_def by simp\n\n from LocalQ.prems\n have qrhl_s: \"qRHL (R \\ Eq Vmid) (s i) (s' i) (R \\ Eq Vmid)\" if \"i\\holes C\" for i\n using that by simp\n\n from LocalQ.prems\n have aux_si: \"\\i. i \\ holes C \\ aux \\ fv (s i)\" \n and aux_s'i: \"\\i. i \\ holes C \\ aux \\ fv (s' i)\"\n by auto\n\n have qrhl_sr: \"qRHL (R \\ Eq (insert r Vmid)) (s i) (s' i) (R \\ Eq (insert r Vmid))\" \n if \"i\\holes C\" for i\n apply (subst asm_rl[of \"insert r Vmid = (Vmid-{aux}) \\ {aux,r}\"], \n (auto simp add: \\aux \\ Vmid\\)[1])+\n apply (rule varchange[where Q=\"{aux}\" and q=aux, rotated -1])\n apply (subst asm_rl[of \"Vmid - {aux} \\ {aux} = Vmid\"], (auto simp add: \\aux \\ Vmid\\)[1])+\n using that apply (rule qrhl_s)\n using quant_aux \\is_quantum r\\ inf_aux aux_R aux_si aux_s'i that\n by (auto simp add: is_quantum'_def Rv_def deidx12_def)\n\n have \"qrhlC (insert q V') C\"\n proof (rule LocalQ.IH[where Vmid = \"insert r Vmid\"])\n show \"finite (insert r Vmid)\"\n using LocalQ.prems by simp\n show \"aux \\ insert r Vmid\"\n using LocalQ.prems by simp\n show \"insert q V' \\ inner C \\ insert r Vmid\"\n using LocalQ.prems V'_def by auto\n show \"insert r Vmid \\ Rv \\ insert q V' \\ covered C\"\n using LocalQ.prems \\r \\ Rv\\\n by (auto simp: idx12_diff V'_def)\n show \"\\i. i\\holes C \\ insert r Vmid \\ (fv (s i) \\ fv (s' i))\n \\ classical' (overwr (s i) \\ overwr (s' i)) \\ covered C \\ insert q V'\"\n using LocalQ.prems unfolding V'_def by auto\n show \"fv C \\ insert q V'\"\n using LocalQ.prems V'_def by auto\n show \"Rv \\ inner C = {}\"\n using LocalQ.prems by auto\n from LocalQ.prems\n have R_written: \"Rv \\ written (Local q C) = {}\"\n by simp\n then show \"Rv \\ written C = {}\"\n using qR by auto\n qed (auto simp add: qrhl_sr aux_si aux_s'i)\n\n then have qrhl_V': \"qrhlC V' (Local q C)\"\n unfolding subst subst'\n apply (rule joint_local0_rule[rotated -1])\n using qR \\q \\ V'\\ \\q \\ V'\\ by (auto simp: Rv_def deidx12_def)\n\n have [simp]: \"QVar q' \\ fv (subst' (Local (QVar q') C))\"\n using subst' by (simp add: q')\n have [simp]: \"QVar r' \\ fv (subst' (Local (QVar q') C))\"\n using \\r \\ fv (subst' C)\\ subst' by (simp add: r' q')\n have [simp]: \"QVar q' \\ fv (subst (Local (QVar q') C))\"\n using subst by (simp add: q')\n have [simp]: \"QVar r' \\ fv (subst (Local (QVar q') C))\"\n using \\r \\ fv (subst C)\\ subst by (simp add: r' q')\n have idx_r_R[simp]: \"idx b r \\ fvp R\" for b\n apply (cases b)\n using \\r \\ Rv\\ by (simp_all add: r' deidx12_def Rv_def)\n have idx_q_R[simp]: \"idx b q \\ fvp R\" for b\n apply (cases b)\n using qR by (simp_all add: Rv_def deidx12_def)\n\n have swap_V': \"transpose (QVar q') (QVar r') ` V' = V\"\n unfolding V'_def\n using \\r \\ q\\ \\r \\ V\\\n by (auto simp: transpose_def q'[symmetric] r'[symmetric])\n\n have \"R \\ Eq V\n = substp_bij (transpose (idx True q) (idx True r) o\n (transpose (idx False q) (idx False r))) (R \\ Eq V')\"\n apply (subst substp_bij_inter)\n apply (auto intro!: valid_var_subst_comp compatible_idx simp: bij_swap_iff)[2]\n apply (subst substp_bij_id)\n apply (auto intro!: valid_var_subst_comp compatible_idx simp: bij_swap_iff)[3]\n apply (metis idx_q_R idx_r_R transpose_apply_other)\n using substp_bij_Eq q' r' apply auto\n by (metis \\compatible q r\\ \\r \\ q\\ swap_V')\n also have \\\\ = substp (transpose (idx True q) (idx True r)) (substp (transpose (idx False q) (idx False r)) (R \\ Eq V'))\\\n apply (subst substp_bij_comp[symmetric])\n apply auto[4]\n apply (subst substp_substp_bij[where \\=\\transpose (idx True q) (idx True r)\\])\n apply auto[3]\n apply (subst substp_substp_bij[where \\=\\transpose (idx False q) (idx False r)\\])\n by auto\n\n also have \"qRHL \\ (subst (Local q C)) (subst' (Local q C)) \\\"\n unfolding q' r'\n apply (rule rename_qrhl1)\n apply auto[3]\n apply (rule rename_qrhl2)\n apply auto[3]\n using q' qrhl_V' by blast\n\n finally show \"qrhlC V (Local q C)\"\n by simp\nnext\n case (Hole i)\n\n define X Y Q C where \"X = {x\\Vmid-V. is_classical x \\ x \\ overwr (s i) \\ x \\ overwr (s' i)}\" \n and \"Y = {x\\Vmid-V. is_classical x \\ \\ (x \\ overwr (s i) \\ x \\ overwr (s' i))}\"\n and \"Q = {x\\Vmid-V. is_quantum x}\" and [simp]: \"C = Hole i\"\n \n have quant_Q[simp]: \"is_quantum' Q\"\n unfolding is_quantum'_def Q_def by simp\n have class_Y[simp]: \"is_classical' Y\"\n using Y_def is_classical'_def by blast\n\n from \\aux \\ Vmid\\ quant_aux\n have [simp]: \"aux \\ V \\ Q\"\n by (simp add: Q_def)\n\n from Hole.prems\n have Vmid_s: \"Vmid \\ (fv (s i) \\ fv (s' i)) \\ classical' (overwr (s i) \\ overwr (s' i)) \\ covered C \\ V\"\n and Vmid_R: \"Vmid \\ Rv \\ V \\ covered C\"\n and Vmid_V: \"V \\ inner C \\ Vmid\"\n and qrhl_s: \"qRHL (R \\ Eq Vmid) (s i) (s' i) (R \\ Eq Vmid)\"\n by simp_all\n\n from Vmid_s\n have sQ: \"fv (s i) \\ Q = {}\" and s'Q: \"fv (s' i) \\ Q = {}\"\n by (auto simp add: Q_def classical'_def)\n\n from \\finite Vmid\\\n have \"finite X\"\n unfolding X_def by simp\n\n have class_X: \"is_classical' X\"\n unfolding X_def is_classical'_def by simp\n\n from Vmid_s\n have X_overwr_si: \"X \\ overwr (s i)\" and X_overwr_si': \"X \\ overwr (s' i)\"\n using overwr_fv[of \"s i\"] overwr_fv[of \"s' i\"] unfolding X_def classical'_def by auto\n\n then obtain Xlist where Xlist: \"X = CVar ` set Xlist\"\n using class_X \\finite X\\\n by (metis finite_list is_classical'_def finite_subset_image imageI is_classical.simps subsetI)\n have Vmid_XYQ: \"Vmid = V \\ X \\ Y \\ Q\"\n unfolding X_def Y_def Q_def using Vmid_V by blast\n have \"X \\ V = {}\" and \"X \\ Y = {}\" and \"X \\ Q = {}\"\n unfolding X_def Y_def Q_def\n by auto\n moreover \n from \\X \\ V = {}\\\n have \"idx12 X \\ idx12 V = {}\"\n unfolding idx12_def by auto\n then have \"idx12 X \\ fvp R = {}\"\n using Vmid_R unfolding Rv_def deidx12_def idx12_def Vmid_XYQ idx12_union by auto\n ultimately have 1: \"idx12 X \\ fvp (R \\ Eq (V \\ Y \\ Q)) = {}\"\n apply (rule_tac fvp_inter_empty)\n by (auto simp add: idx12_def)\n\n have \"Y \\ V = {}\" and \"Y \\ Q = {}\"\n unfolding Y_def Q_def by auto\n moreover \n from \\Y \\ V = {}\\\n have \"idx12 Y \\ idx12 V = {}\"\n unfolding idx12_def by auto\n then have \"idx12 Y \\ fvp R = {}\"\n using Vmid_R unfolding Rv_def idx12_def deidx12_def Vmid_XYQ idx12_union by auto\n ultimately have 2: \"idx12 Y \\ fvp (R \\ Eq (V \\ Q)) = {}\"\n apply (rule_tac fvp_inter_empty)\n by (auto simp add: idx12_def)\n have siY: \"fv (s i) \\ Y = {}\" and s'iY: \"fv (s' i) \\ Y = {}\"\n using Vmid_s unfolding Y_def classical'_def by auto\n\n have \"R \\ Eq (V \\ Q) \\ Eq Y = R \\ Eq (V \\ Y \\ Q)\"\n apply (subst asm_rl[of \"V \\ Y \\ Q = Y \\ (V \\ Q)\"], blast)\n apply (subst Eq_split[where X=Y], simp)\n by (simp add: inf_commute inf_left_commute)\n also have \"qRHL (R \\ Eq (V \\ Y \\ Q)) (Assign Xlist some_constant) (Assign Xlist some_constant) (R \\ Eq Vmid)\"\n apply (subst asm_rl[of \"R \\ Eq Vmid = Eq (CVar ` set Xlist) \\ (R \\ Eq (V \\ Y \\ Q))\"])\n apply (metis Eq_split Vmid_XYQ Xlist class_X inf_left_commute sup_commute sup_left_commute)\n apply (subst asm_rl[of \"(R \\ Eq (V \\ Y \\ Q)) = top \\ (R \\ Eq (V \\ Y \\ Q))\"], simp)\n apply (rule frame_rule)\n using 1 apply (auto simp: idx12_def Xlist[symmetric] intro!: program.intros) [2]\n by (rule assign_Eq)\n also from qrhl_s have \"qrhlC Vmid C\"\n unfolding subst_def subst'_def by auto\n also have \"Assign Xlist some_constant; subst C =d= subst C\"\n apply (rule denot_eq_init)\n unfolding subst_def apply auto using X_overwr_si Xlist by blast\n also have \"Assign Xlist some_constant; subst' C =d= subst' C\"\n apply (rule denot_eq_init)\n unfolding subst'_def apply auto using X_overwr_si' Xlist by blast\n also have \"R \\ Eq Vmid \\ R \\ Eq (V \\ Q)\"\n apply (rule inf_mono, simp)\n apply (rule weaken_Eq)\n using class_X Vmid_XYQ is_classical'_def Q_def\n by blast+\n finally have \"qRHL (R \\ Eq (V \\ Q) \\ Eq Y) (subst C) (subst' C) (R \\ Eq (V \\ Q))\"\n by auto\n\n then have qrhl_VQ: \"qrhlC (V \\ Q) C\"\n apply (rule drop_Eq[rotated -1]) \n using 2 siY s'iY by (auto simp: subst_def subst'_def)\n\n from Hole.prems\n have aux_si: \"aux \\ fv (s i)\"\n and aux_s'i: \"aux \\ fv (s' i)\"\n by auto\n\n have \"qrhlC ((V - {aux}) \\ (V \\ {aux})) (Hole i)\"\n apply (rule varchange[where Q=\"insert aux Q\" and q=aux])\n using inf_aux quant_aux quant_Q aux_R\n aux_si aux_s'i sQ s'Q\n apply (auto simp: is_quantum'_def idx12_def subst_def subst'_def Rv_def deidx12_def)[6]\n using qrhl_VQ \\aux \\ V \\ Q\\\n by (metis C_def Un_insert_right insert_Diff_single insert_absorb sup_commute)\n\n then show ?case\n by (simp add: Un_Diff_Int)\nqed\n\nlemma adversary_rule:\n fixes Vin :: \"var set\"\n fixes Vout :: \"var set\"\n fixes Vmid :: \"var set\"\n assumes inf_aux: \"infinite_var aux\" \n assumes quant_aux: \"is_quantum aux\"\n assumes aux_R: \"aux \\ Rv\"\n assumes finite_Vmid: \"finite Vmid\"\n assumes finite_Vin: \"finite Vin\"\n assumes aux_si: \"\\i. i \\ holes C \\ aux \\ fv (s i)\"\n assumes aux_s'i: \"\\i. i \\ holes C \\ aux \\ fv (s' i)\"\n assumes qrhl_s: \"\\i. i \\ holes C \\ qRHL (R \\ Eq Vmid) (s i) (s' i) (R \\ Eq Vmid)\"\n assumes aux_Vmid: \"aux \\ Vmid\"\n assumes inner_Vmid: \"inner C \\ Vmid\"\n assumes Vout_Vmid: \"Vout \\ Vmid\"\n assumes Vout_overwr_Vin: \"Vout - overwr C \\ Vin\"\n assumes Vout_Vin_R: \"(Vout - Vin) \\ Rv = {}\"\n assumes Vin_Vout_overwr: \"quantum' Vin \\ Vout \\ overwr C\"\n assumes Vin_Vout_R: \"quantum' (Vin - Vout) \\ Rv = {}\"\n assumes Vmid_R_Vin_covered: \"Vmid \\ Rv \\ Vin \\ covered C\"\n assumes Vmid_R_Vout_covered: \"quantum' (Vmid \\ Rv) \\ Vout \\ covered C\"\n assumes Vmid_s_Vin_covered: \"\\i. i \\ holes C \\ Vmid \\ (fv (s i) \\ fv (s' i)) \\ Vin \\ covered C \\ classical' (overwr (s i) \\ overwr (s' i))\"\n assumes Vmid_s_Vout_covered: \"\\i. i \\ holes C \\ quantum' Vmid \\ (fv (s i) \\ fv (s' i)) \\ Vout \\ covered C\"\n assumes C_Vmid: \"fv C \\ Vmid\"\n assumes C_Vin_overwr: \"fv C \\ Vin \\ overwr C\"\n assumes C_Vin_R: \"fv C \\ Rv \\ Vin\"\n assumes C_Vout: \"quantum' (fv C) \\ Vout\"\n assumes R_inner: \"Rv \\ inner C = {}\"\n assumes R_written: \"Rv \\ written C = {}\"\n\n shows \"qRHL (R \\ Eq Vin) (subst C) (subst' C) (R \\ Eq Vout)\"\nproof -\n define V where \n \"V = Vmid \\ (overwr C \\ Vin) \\ (Vin \\ - Rv) \\ (Vout \\ range CVar)\"\n\n have [simp]: \"finite V\"\n unfolding V_def\n using finite_Vmid by blast\n\n have Vmid_V: \"V \\ inner C \\ Vmid\"\n unfolding V_def using inner_Vmid by auto\n have Vmid_R: \"Vmid \\ Rv \\ V \\ covered C\"\n unfolding V_def\n using Vmid_R_Vin_covered Vmid_R_Vout_covered\n unfolding quantum'_def is_classical.simps\n by auto\n have Vmid_s: \"Vmid \\ (fv (s i) \\ fv (s' i))\n \\ classical' (overwr (s i) \\ overwr (s' i)) \\ covered C \\ V\" if \"i\\holes C\" for i\n unfolding V_def Un_Int_distrib\n apply (rule Int_greatest)+\n apply blast\n using Vmid_s_Vin_covered that apply blast\n using Vmid_s_Vin_covered that apply fastforce\n using Vmid_s_Vout_covered that by (auto simp: quantum'_def is_classical.simps)\n have fv_V: \"fv C \\ V\"\n using C_Vmid C_Vin_overwr C_Vin_R C_Vout\n unfolding V_def Rv_def quantum'_def is_classical.simps by auto\n have V_Vin_overwr: \"V - Vin \\ overwr C\"\n unfolding V_def by auto\n have Vin_V_overwr: \"quantum' (Vin - V) \\ overwr C\"\n using Vout_Vmid Vin_Vout_overwr\n unfolding V_def quantum'_def\n by auto\n have V_Vin_R: \"idx12 (V - Vin) \\ fvp R = {}\"\n unfolding V_def idx12_def deidx12_def Rv_def by auto\n have \"quantum' (Vin - V) \\ deidx12 (fvp R) = {}\"\n using Vin_Vout_R Diff_disjoint Vout_Vmid \n unfolding V_def quantum'_def Rv_def\n by auto\n then have Vin_V_R: \"idx12 (quantum' (Vin - V)) \\ fvp R = {}\"\n unfolding deidx12_def idx12_def by auto\n have Vout_V: \"Vout \\ V\"\n using Vout_Vmid Vout_overwr_Vin Vout_Vin_R \n unfolding deidx12_def V_def Rv_def\n by auto\n have Vout_V_class: \"is_classical' (V - Vout)\"\n unfolding V_def is_classical'_def by auto\n\n from inf_aux quant_aux aux_R aux_si aux_s'i finite_Vmid qrhl_s aux_Vmid Vmid_V Vmid_R Vmid_s fv_V R_inner R_written\n have \\qrhlC V C\\\n by (rule adversary_rule0[where Vmid=Vmid])\n\n then have \\qRHL (R \\ Eq Vin) (subst C) (subst' C) (R \\ Eq V)\\\n apply (rule change_Eq_precondition[rotated -1])\n using V_Vin_overwr overwr_subst subst'_def subst_def apply auto[1]\n using Vin_V_overwr overwr_subst subst'_def subst_def apply auto[1] \n using \\finite V\\ \\finite Vin\\ V_Vin_R Vin_V_R by simp_all\n also have \"R \\ Eq V \\ R \\ Eq Vout\"\n apply (rule inf_mono, simp)\n apply (subst asm_rl[of \"V = (V-Vout) \\ Vout\"])\n using Vout_V apply auto[1]\n apply (subst Eq_split)\n using Vout_V_class by auto\n finally show ?thesis\n by auto \n\nqed\n\nend\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "qrhl-local-variables-isabelle", "sha": "372d8b88b62628a1088931392e71d82302178512", "save_path": "github-repos/isabelle/dominique-unruh-qrhl-local-variables-isabelle", "path": "github-repos/isabelle/dominique-unruh-qrhl-local-variables-isabelle/qrhl-local-variables-isabelle-372d8b88b62628a1088931392e71d82302178512/Adversary_Rule.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.2610727378605809}} {"text": "(* Author: Florian Haftmann, TU Muenchen *)\n\nsection \\Reflecting Pure types into HOL\\\n\ntheory Typerep\nimports String\nbegin\n\ndatatype typerep = Typerep String.literal \"typerep list\"\n\nclass typerep =\n fixes typerep :: \"'a itself \\ typerep\"\nbegin\n\ndefinition typerep_of :: \"'a \\ typerep\" where\n [simp]: \"typerep_of x = typerep TYPE('a)\"\n\nend\n\nsyntax\n \"_TYPEREP\" :: \"type => logic\" (\"(1TYPEREP/(1'(_')))\")\n\nparse_translation \\\n let\n fun typerep_tr (*\"_TYPEREP\"*) [ty] =\n Syntax.const \\<^const_syntax>\\typerep\\ $\n (Syntax.const \\<^syntax_const>\\_constrain\\ $ Syntax.const \\<^const_syntax>\\Pure.type\\ $\n (Syntax.const \\<^type_syntax>\\itself\\ $ ty))\n | typerep_tr (*\"_TYPEREP\"*) ts = raise TERM (\"typerep_tr\", ts);\n in [(\\<^syntax_const>\\_TYPEREP\\, K typerep_tr)] end\n\\\n\ntyped_print_translation \\\n let\n fun typerep_tr' ctxt (*\"typerep\"*)\n (Type (\\<^type_name>\\fun\\, [Type (\\<^type_name>\\itself\\, [T]), _]))\n (Const (\\<^const_syntax>\\Pure.type\\, _) :: ts) =\n Term.list_comb\n (Syntax.const \\<^syntax_const>\\_TYPEREP\\ $ Syntax_Phases.term_of_typ ctxt T, ts)\n | typerep_tr' _ T ts = raise Match;\n in [(\\<^const_syntax>\\typerep\\, typerep_tr')] end\n\\\n\nsetup \\\nlet\n\nfun add_typerep tyco thy =\n let\n val sorts = replicate (Sign.arity_number thy tyco) \\<^sort>\\typerep\\;\n val vs = Name.invent_names Name.context \"'a\" sorts;\n val ty = Type (tyco, map TFree vs);\n val lhs = Const (\\<^const_name>\\typerep\\, Term.itselfT ty --> \\<^typ>\\typerep\\)\n $ Free (\"T\", Term.itselfT ty);\n val rhs = \\<^term>\\Typerep\\ $ HOLogic.mk_literal tyco\n $ HOLogic.mk_list \\<^typ>\\typerep\\ (map (HOLogic.mk_typerep o TFree) vs);\n val eq = HOLogic.mk_Trueprop (HOLogic.mk_eq (lhs, rhs));\n in\n thy\n |> Class.instantiation ([tyco], vs, \\<^sort>\\typerep\\)\n |> `(fn lthy => Syntax.check_term lthy eq)\n |-> (fn eq => Specification.definition NONE [] [] (Binding.empty_atts, eq))\n |> snd\n |> Class.prove_instantiation_exit (fn ctxt => Class.intro_classes_tac ctxt [])\n end;\n\nfun ensure_typerep tyco thy =\n if not (Sorts.has_instance (Sign.classes_of thy) tyco \\<^sort>\\typerep\\)\n andalso Sorts.has_instance (Sign.classes_of thy) tyco \\<^sort>\\type\\\n then add_typerep tyco thy else thy;\n\nin\n\nadd_typerep \\<^type_name>\\fun\\\n#> Typedef.interpretation (Local_Theory.background_theory o ensure_typerep)\n#> Code.type_interpretation ensure_typerep\n\nend\n\\\n\n\n\nlemma [code nbe]:\n \"HOL.equal (x :: typerep) x \\ True\"\n by (fact equal_refl)\n\ncode_printing\n type_constructor typerep \\ (Eval) \"Term.typ\"\n| constant Typerep \\ (Eval) \"Term.Type/ (_, _)\"\n\ncode_reserved Eval Term\n\nhide_const (open) typerep Typerep\n\nend\n", "meta": {"author": "landonf", "repo": "isabelle-legacy", "sha": "e40f3ca7e9a42bb91e57fd15f969388e6e83f692", "save_path": "github-repos/isabelle/landonf-isabelle-legacy", "path": "github-repos/isabelle/landonf-isabelle-legacy/isabelle-legacy-e40f3ca7e9a42bb91e57fd15f969388e6e83f692/src/HOL/Typerep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.26107273786058083}} {"text": "theory User_Execution\n \nimports Context_Switch\n \n\nbegin \n\n\n\ndefinition\n ptable_lift_user :: \"vaddr \\ p_state \\ paddr \\ bool\" (\"(_/ \\\\<^sub>_/ \\<^sub>u\\<^sub>s\\<^sub>e\\<^sub>r / _)\")\nwhere\n \"ptable_lift_user va s p \\ (ptable_lift_m (heap s) (root s) User va = Some p)\"\n\n\n\ndefinition \n user_safe :: \"p_state \\ vaddr set\"\nwhere\n \"user_safe s = {va. \\p. va \\\\<^sub>s \\<^sub>u\\<^sub>s\\<^sub>e\\<^sub>r p } \"\n\n\n\n\nlemma mmu_layout_no_phy:\n \"\\ mmu_layout s; mode s = User; ptable_lift_m (heap s) (root s) (mode s) (Addr vp) = Some p \\ \n \\ p \\ kernel_phy_mem\"\n by (clarsimp simp: mmu_layout_def user_mappings_def dest!: root_map_rootsD)\n\nlemma phy_mem_data_area:\n \"\\ mmu_layout s; p \\ kernel_phy_mem \\ \n \\ p \\ kernel_data_area s\"\n apply (clarsimp simp: mmu_layout_def )\n by blast\n \n \n\nlemma user_safe_assignment:\n \"\\ \\ \\s. mmu_layout s \\ mode s = User \\ \\\\ s = {} \\\n aval lval s = Some vp \\ aval rval s = Some v \\ \n ptable_lift_m (heap s) (root s) (mode s) (Addr vp) = Some p \\\n lval ::= rval\n \\\\s. mmu_layout s \\ mode s = User \\ \\\\ s = {} \\ heap s p = Some v\\\"\n apply vcgm\n apply (rule conjI)\n apply (clarsimp simp: \\\\_def)\n apply (frule_tac vp = vp and p = p in mmu_layout_no_phy , clarsimp , clarsimp)\n apply (frule_tac p = p in phy_mem_data_area, simp)\n apply (clarsimp simp: mmu_layout_global_heap_upd)\n apply (frule_tac mmu_layout_global_set_subset, simp)\n apply (simp add: mmu_layout_ptable_comp mmu_layout_upd)\n apply (simp add: \\\\_def)\n done\n\n \nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Logic/User_Execution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4073334000459302, "lm_q1q2_score": 0.26095238094326667}} {"text": "section \\Secure composition: Encrypt then MAC\\\n\ntheory Secure_Channel imports\n One_Time_Pad\n Message_Authentication_Code\nbegin\n\ncontext begin\ninterpretation INSEC: insec_channel .\n\ninterpretation MAC: macode \"rnd \\\" \"mac \\\" for \\ . \ninterpretation AUTH: auth_channel . \n\ninterpretation CIPHER: cipher \"key \\\" \"enc \\\" \"dec \\\" for \\ . \ninterpretation SEC: sec_channel .\n\nlemma plossless_enc [plossless_intro]:\n \"plossless_converter (\\_uniform (nlists UNIV \\) UNIV) (\\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform (nlists UNIV \\) UNIV) (CIPHER.enc \\)\"\n unfolding CIPHER.enc_def\n by(rule plossless_converter_of_callee) (auto simp add: stateless_callee_def enc_def in_nlists_UNIV)\n\nlemma plossless_dec [plossless_intro]:\n \"plossless_converter (\\_uniform UNIV (insert None (Some ` nlists UNIV \\))) (\\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform UNIV (insert None (Some ` nlists UNIV \\))) (CIPHER.dec \\)\"\n unfolding CIPHER.dec_def\n by(rule plossless_converter_of_callee) (auto simp add: stateless_callee_def dec_def in_nlists_UNIV split: option.split)\n\nlemma callee_invariant_on_key_oracle:\n \"callee_invariant_on\n (CIPHER.KEY.key_oracle \\ \\\\<^sub>O CIPHER.KEY.key_oracle \\)\n (\\x. case x of None \\ True | Some x' \\ length x' = \\)\n (\\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_full)\"\nproof(unfold_locales, goal_cases)\n case (1 s x y s')\n then show ?case by(cases x; clarsimp split: option.splits; simp add: key_def in_nlists_UNIV)\nnext\n case (2 s)\n then show ?case by(clarsimp intro!: WT_calleeI split: option.split_asm)(simp_all add: in_nlists_UNIV key_def)\nqed\n\ninterpretation key: callee_invariant_on\n \"CIPHER.KEY.key_oracle \\ \\\\<^sub>O CIPHER.KEY.key_oracle \\\"\n \"\\x. case x of None \\ True | Some x' \\ length x' = \\\"\n \"\\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_full\" for \\\n by(rule callee_invariant_on_key_oracle)\n\nlemma WT_enc [WT_intro]: \"\\_uniform (nlists UNIV \\) UNIV,\n \\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform (vld \\) UNIV \\\\<^sub>C CIPHER.enc \\ \\\"\n unfolding CIPHER.enc_def\n by (rule WT_converter_of_callee) (simp_all add: stateless_callee_def vld_def enc_def in_nlists_UNIV)\n\nlemma WT_dec [WT_intro]: \"\\_uniform UNIV (insert None (Some ` nlists UNIV \\)),\n \\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform UNIV (insert None (Some ` vld \\)) \\\\<^sub>C\n CIPHER.dec \\ \\\"\n unfolding CIPHER.dec_def\n by(rule WT_converter_of_callee)(auto simp add: stateless_callee_def dec_def vld_def in_nlists_UNIV)\n\nlemma bound_enc [interaction_bound]: \"interaction_any_bounded_converter (CIPHER.enc \\) (enat 2)\"\n unfolding CIPHER.enc_def\n by (rule interaction_any_bounded_converter_of_callee) \n (auto simp add: stateless_callee_def map_gpv_id_bind_gpv zero_enat_def one_enat_def)\n\nlemma bound_dec [interaction_bound]: \"interaction_any_bounded_converter (CIPHER.dec \\) (enat 2)\"\n unfolding CIPHER.dec_def\n by (rule interaction_any_bounded_converter_of_callee)\n (auto simp add: stateless_callee_def map_gpv_id_bind_gpv zero_enat_def one_enat_def split: sum.split option.split)\n\ntheorem mac_otp:\n defines \"\\_real \\ \\\\. \\_uniform {x. valid_mac_query \\ x} UNIV\"\n and \"\\_ideal \\ \\_. \\_full\"\n and \"\\_common \\ \\\\. \\_uniform (vld \\) UNIV \\\\<^sub>\\ \\_full\"\n shows\n \"constructive_security\n (\\\\. 1\\<^sub>C |\\<^sub>= (CIPHER.enc \\ |\\<^sub>= CIPHER.dec \\) \\ parallel_wiring \\\n parallel_resource1_wiring \\\n CIPHER.KEY.res \\ \\\n (1\\<^sub>C |\\<^sub>= MAC.enm \\ |\\<^sub>= MAC.dem \\ \\\n 1\\<^sub>C |\\<^sub>= parallel_wiring \\\n parallel_resource1_wiring \\ MAC.RO.res \\ \\ INSEC.res))\n (\\_. SEC.res)\n (\\\\. CNV Message_Authentication_Code.sim (Inl None) \\ CNV One_Time_Pad.sim None)\n (\\\\. \\_uniform (Set.Collect (valid_mac_query \\)) (insert None (Some ` (nlists UNIV \\ \\ nlists UNIV \\))))\n (\\\\. \\_uniform UNIV {None, Some \\})\n (\\\\. \\_uniform (nlists UNIV \\) UNIV \\\\<^sub>\\ \\_uniform UNIV (insert None (Some ` nlists UNIV \\)))\n (\\_. enat q) True (\\\\. (id, map_option length) \\\\<^sub>w (insec_query_of, map_option snd))\"\nproof(rule composability[OF one_time_pad[THEN constructive_security2.constructive_security, unfolded CIPHER.res_alt_def comp_converter_parallel2 comp_converter_id_left]\n secure_mac[unfolded MAC.res_def, \n THEN constructive_security.parallel_resource1,\n THEN constructive_security.lifting],\n where ?\\_res2=\"\\\\. \\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform UNIV (nlists UNIV \\)\" and ?bound_conv1=\"\\_. 2\" and ?q3 = \"2 * q\" and bound_sim = \"\\_. \\\",\nsimplified]\n , goal_cases)\n case (1 \\)\n have [simp]: \"\\_uniform UNIV (nlists UNIV \\) \\c CIPHER.KEY.key_oracle \\ s \\\"\n if \"pred_option (\\x. length x = \\) s\" for s \\\n apply(rule WT_calleeI)\n subgoal for call using that by(cases s; cases call; clarsimp; auto simp add: key_def in_nlists_UNIV)\n done\n have *: \"callee_invariant_on (CIPHER.KEY.key_oracle \\ \\\\<^sub>O CIPHER.KEY.key_oracle \\) (pred_option (\\x. length x = \\))\n (\\_uniform UNIV (nlists UNIV \\) \\\\<^sub>\\ \\_uniform UNIV (nlists UNIV \\))\" for \\\n apply(unfold_locales)\n subgoal for s x y s' by(cases s; cases x; clarsimp; auto simp add: key_def in_nlists_UNIV)\n subgoal for s by auto\n done\n then show ?case unfolding CIPHER.KEY.res_def\n by(rule callee_invariant_on.WT_resource_of_oracle) simp\n\n case (2 \\)\n show ?case \n unfolding CIPHER.KEY.res_def\n apply(rule callee_invariant_on.lossless_resource_of_oracle[OF *])\n subgoal for s x by(cases s; cases x)(auto split: plus_oracle_split; simp add: key_def)+\n subgoal by simp\n done\n\n case (3 \\)\n show ?case by(rule WT_intro)+\n\n case (4 \\)\n show ?case by interaction_bound_converter code_simp\n\n case (5 \\)\n show ?case by (simp add: mult_2_right)\n\n case (6 \\)\n show ?case unfolding vld_def by(rule plossless_intro WT_intro[unfolded vld_def])+\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Constructive_Cryptography/Examples/Secure_Channel/Secure_Channel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.2609523753537261}} {"text": "(*<*)\ntheory Everything\nimports DenotationalEquivalences Correctness CorrectnessUpd \"Correctness-Counterexample\" \"~~/src/HOL/Library/LaTeXsugar\" \nbegin\n\nnotation (latex output) DenotationalUpd.ESem (\"\\_\\\\<^bsup>u\\<^esup>\\<^bsub>_\\<^esub>\" [60,60] 60)\nnotation (latex output) \"Denotational-PropsUpd.HSem_syn\" (\"\\_\\\\<^bsup>u\\<^esup>_\" [60,60] 60)\n\ntranslations\n \"xs\" <= \"CONST set xs\"\ntranslations\n \"xs\" <= \"CONST asToHeap xs\"\ntranslations\n \"a\" <= \"CONST atom a\"\n\nlemma Terms:\n \"\\ x assn e'. (e = (Lam [x]. e') \\ (e = Var x) \\ (e = App e' x) \\ (e = Let assn e'))\"\n by (metis Terms.exp_assn.exhaust(1))\nlemma expressions_grammar:\n\"(\\ var. y = Var var \\ P) \\\n(\\ exp var. y = App exp var \\ P) \\\n(\\ assn exp. y = Terms.Let assn exp \\ P) \\ (\\ var exp. y = Lam [var]. exp \\ P) \\ P\"\n by (metis exp_assn.exhaust(1)) \n\nabbreviation (Grammar output)\n \"grammar_imp\"\nwhere\n \"grammar_imp \\ op \\\"\n\nsyntax (Grammar output)\n \"_grapats\" :: \"term \\ term \\ term\" (\"_ | _\")\n \"_grafirst\" :: \"term \\ term \\ term\" (\"_ ::= _\")\n \"_grarest\" :: \"term \\ term \\ term\"\n \"_firsteq\" :: \"term \\ term \\ term\"\n \"_resteq\" :: \"term \\ term \\ term\"\n\ntranslations\n \"_grapats (_firsteq all) (_grarest (CONST grammar_imp rest1 rest2))\" <= \"CONST grammar_imp all (CONST grammar_imp rest1 rest2)\"\n \"_grapats (_resteq all) (_grarest (CONST grammar_imp rest1 rest2))\" <= \"_grarest (CONST grammar_imp all (CONST grammar_imp rest1 rest2))\"\n \"_resteq all\" <= \"_grarest (CONST grammar_imp all rest)\"\n \"_resteq all\" <= \"_resteq (CONST grammar_imp all rest)\"\n \"_firsteq all\" <= \"_firsteq (CONST grammar_imp all rest)\"\n \"_firsteq imp\" <= \"_firsteq (ALL x. imp)\"\n \"_resteq imp\" <= \"_resteq (ALL x. imp)\"\n \"_grafirst x t\" <= \"_firsteq (x = t)\"\n \"t\" <= \"_resteq (x = t)\"\n\n(*\nthm expressions_grammar[no_vars]\nthm (Grammar) expressions_grammar[no_vars]\nthm (latex) expressions_grammar[no_vars]\nthm (latex Grammar) expressions_grammar[no_vars]\n*)\n\ndeclare [[names_short]]\n\n(*>*)\nsubsection {* Main definitions and theorems *}\n\ntext {*\nFor your convenience, the main definitions and theorems of the present work are assembled in this section. The following \nformulas are mechanically pretty-printed versions of the statements as defined resp.\\ proven in Isabelle.\nFree variables are all-quantified. Some type conversion functions (like @{term_type set}) are omitted.\nThe relations @{text \\} and @{text \"\\*\"} come from the Nominal package and express freshness of the\nvariables on the left with regard to the expressions on the right.\n\n\\input{map.tex}\n*}\n\nsubsubsection {* Expressions *}\n\ntext {*\nThe type @{typ var} of variables is abstract and provided by the Nominal package. All we know about\nit is that it is countably infinite.\nExpressions of type @{typ exp} are given by the following grammar:\n\\begin{alignatstar}{2}\n@{term e} \\Coloneqq {}& @{term \"Lam [x]. e\"} &\\quad& \\text{lambda abstraction}\\\\\n\\mid {} & @{term \"App e x\"} && \\text{application}\\\\\n\\mid {} & @{term \"Var x\"} && \\text{variable} \\\\\n\\mid {} & @{term \"Let as e\"} && \\text{recursive let}\n\\end{alignatstar}\nIn the introduction we pretty-print expressions to match the notation in \\cite{launchbury} and omit\nthe constructor names @{term Var}, @{term App}, @{text Lam} and @{term Let}. In the actual theories, these are visible.\nThese expressions are, due to the machinery of the Nominal package, actually alpha-equivalency classes, so @{thm alpha_test[no_vars]} holds provably. This differs from Launchbury's original definition, which expects distinctly-named expressions and performs explicit alpha-renaming in the semantics.\n\nThe type @{type heap} is an abbreviation for @{typ \"(var \\ exp) list\"}. These are \\emph{not} alpha-equivalency classes, i.e.\\ we manage the bindings in heaps explicitly.\n*}\n\nsubsubsection {* The natural semantics *}\n\ntext_raw {*\n\\newlength{\\rulelen}\n\\setlength{\\rulelen}{\\linewidth}\n\\newlength{\\rulenamelen}\n\\settowidth{\\rulenamelen}{~{\\sc Application}}\n\\addtolength{\\rulelen}{-\\rulenamelen}\n*}\n\ntext {*\nLaunchbury's original semantics, extended with some technical overhead related to name binding,\nis defined as follows:\\\\\n%\\begin{center}\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Axiom] Launchbury.reds.Lambda[no_vars]}}~{\\sc Lambda}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Application[no_vars]}}~{\\sc Application}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Variable[no_vars]}}~{\\sc Variable}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Let[no_vars]}}~{\\sc Let}\n%\\end{center}\n*}\n\nsubsubsection {* The stacked semantics *}\n\ntext {*\nThis is our modified semantics that allows the correctness theorem to go through without generalisation:\\\\\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Axiom] LaunchburyStacked.reds.Lambda[no_vars]}}~{\\sc Lambda}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Application[no_vars]}}~{\\sc Application}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Variable[no_vars]}}~{\\sc Variable}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Let[no_vars]}}~{\\sc Let}\n*}\nsubsubsection {* The denotational semantics *}\n\ntext {*\nThe value domain of the denotational semantics is the initial solution to\n\\[\nD = [D \\to D]_\\bot\n\\]\nas introduced in \\cite{abramsky}. The type @{typ Value}, together with the bottom value @{term_type \"\\::Value\"}, the\ninjection @{term_type \"Fn\"} and the projection @{term \"DUMMY \\Fn DUMMY\"}@{text \"::\"}@{typeof \"Fn_project\"},\nis constructed as a pointed chain-complete partial order from this equation by the HOLCF package.\nThe type of semantic environments, @{typ Env}, is an abbreviation for @{typ \"var f\\ Value\"}.\n\nThe semantics of an expression @{term_type \"e :: exp\"} in an environment @{term \"\\\"}@{text \"::\"}@{typ Env} is \nwritten \\mbox{@{term_type \"Denotational.ESem e \\\"}} and defined by the following equations:\n\\begin{alignstar}\n@{thm (lhs) Denotational.ESem.simps(1)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(1)[no_vars]} && \\text{if } @{thm (prem 1) Denotational.ESem.simps(1)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(2)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(2)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(3)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(3)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(4)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(4)[no_vars]} && \\text{if } @{thm (prem 1) Denotational.ESem.simps(4)[no_vars]}.\n\\end{alignstar}\n*}\n\ntext {*\nWe study two alternatives for the semantics @{term \"Denotational.HSem \\ \\\"}@{text \"::\"}@{typ Env} of a\nheap @{term \"\\ :: heap\"}@{text \"::\"}@{typ heap}\nin an environment @{term \"\\\"}@{text \"::\"}@{typ Env}. As this is used in denotations of a Let expression,\nwe have also two expression semantics. Their defining equations are, besides the choice of heap semantics, identical.\n\nThe first involves a least upper bound ($\\sqcup$) and is defined by the recursive equation\n\\[ @{thm (concl) Denotational.HSem_eq[no_vars]}, \\]\nwhere the set in the index position indicates the expansion of the map to the given domain and\n@{term \"heapToEnv:: heap \\ (exp \\ Value) \\ Env\"}@{text \"::\"}@{typ \"heap \\ (exp \\ Value) \\ Env\"}\nmaps the given expression semantics over the heap, producing a semantic environment.\n\nThe other, here shown with a superscript @{text \"u\"}, uses the right-sided update operator @{text \"f++\"}\nand is defined by the recursive equation\n\\[ @{thm \"Denotational-PropsUpd.HSem_eq\"[no_vars]}. \\]\n\nThe semantics of the heap in the empty environment @{term \"fempty\"} is abbreviated as @{abbrev \"HSem_fempty \\\"}.\n\nIt is worth noting that the two semantics agree on expressions, i.e. @{thm HSem_join_update(1)[no_vars] },\nbut obviously not on heaps that bind variables that also occur in the environment.\n*}\n\nsubsubsection {* Equivalences *}\ntext {*\nThe stacked semantics is equivalent to the original semantics in the following sense:\n\\begin{itemize}\n\\item If @{thm[mode=IfThen] (prem 1) forget_stack_nice[no_vars] } is derivable in the stacked semantics,\nand @{term L} is chosen such that @{thm[mode=IfThen] (prem 2) forget_stack_nice[no_vars]} holds, then\n @{thm[mode=IfThen] (concl) forget_stack_nice[no_vars]} is derivable in the original semantics.\n\\item If @{thm[mode=IfThen] (prem 1) add_stack[no_vars]} is derivable in the original semantics and\n@{term \"x\"} and @{term \"\\'\"} are chosen such that @{thm[mode=IfThen] (prem 2) add_stack[no_vars]} and\n@{thm[mode=IfThen] (prem 3) add_stack[no_vars]} holds, then @{thm[mode=IfThen] (concl) add_stack[no_vars]}\nis derivable in the stacked semantics.\n\\end{itemize}\n*}\n\nsubsubsection {* Correctness *}\ntext {* The statement of correctness for the stacked semantics reads:\nIf @{thm [mode=IfThen] (prem 1) CorrectnessStacked.correctness[no_vars]} and, as a side condition,\n@{thm [mode=IfThen] (prem 2) CorrectnessStacked.correctness[no_vars]} holds, then @{thm [mode=IfThen] (concl) CorrectnessStacked.correctness(1)[no_vars]}. *}\n\ntext {* By the stated equivalency, we obtain the correctness of the original semantics:\nIf \\mbox{@{thm [mode=IfThen] (prem 1) Correctness.correctness(1)[no_vars]}} and, as a side condition,\n@{thm [mode=IfThen] (prem 2) Correctness.correctness(1)[no_vars]} holds, then @{thm [mode=IfThen] (concl) Correctness.correctness(1)[no_vars]} and \n @{thm [mode=IfThen] (concl) Correctness.correctness(2)[no_vars]} *}\n\ntext {* The generalization introduced by Launchbury is true if the update-based semantics is chosen:\nIf @{thm [mode=IfThen] (prem 1) CorrectnessUpd.correctness(1)[no_vars]} and, as a side condition,\n@{thm [mode=IfThen] (prem 2) CorrectnessUpd.correctness(1)[no_vars]} and\n\\mbox{@{thm [mode=IfThen] (prem 3) CorrectnessUpd.correctness(1)[no_vars]}} hold,\nthen @{thm [mode=IfThen] (concl) CorrectnessUpd.correctness(1)[no_vars]} and @{thm [mode=IfThen] (concl) CorrectnessUpd.correctness(2)[no_vars]}. *}\n\n\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/Everything.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2608342326594719}} {"text": "(* Title: Native_Cast.thy\n Author: Andreas Lochbihler, ETH Zurich\n*)\n\nchapter \\Conversions between unsigned words and between char\\\n\ntheory Native_Cast\n imports\n Uint8\n Uint16\n Uint32\n Uint64\nbegin\n\ntext \\Auxiliary stuff\\\n\nlemma integer_of_char_char_of_integer [simp]:\n \"integer_of_char (char_of_integer x) = x mod 256\"\n by (simp add: integer_of_char_def char_of_integer_def)\n\nlemma char_of_integer_integer_of_char [simp]:\n \"char_of_integer (integer_of_char x) = x\"\n by (simp add: integer_of_char_def char_of_integer_def)\n\nlemma int_lt_numeral [simp]: \"int x < numeral n \\ x < numeral n\"\nby (metis nat_numeral zless_nat_eq_int_zless)\n\nlemma int_of_integer_ge_0: \"0 \\ int_of_integer x \\ 0 \\ x\"\nincluding integer.lifting by transfer simp\n\nlemma integer_of_char_ge_0 [simp]: \"0 \\ integer_of_char x\"\n including integer.lifting unfolding integer_of_char_def\n by transfer (simp add: of_char_def)\n\n\nsection \\Conversion between native words\\\n\nlift_definition uint8_of_uint16 :: \"uint16 \\ uint8\" is ucast .\nlift_definition uint8_of_uint32 :: \"uint32 \\ uint8\" is ucast .\nlift_definition uint8_of_uint64 :: \"uint64 \\ uint8\" is ucast .\n\nlift_definition uint16_of_uint8 :: \"uint8 \\ uint16\" is ucast .\nlift_definition uint16_of_uint32 :: \"uint32 \\ uint16\" is ucast .\nlift_definition uint16_of_uint64 :: \"uint64 \\ uint16\" is ucast .\n\nlift_definition uint32_of_uint8 :: \"uint8 \\ uint32\" is ucast .\nlift_definition uint32_of_uint16 :: \"uint16 \\ uint32\" is ucast .\nlift_definition uint32_of_uint64 :: \"uint64 \\ uint32\" is ucast .\n\nlift_definition uint64_of_uint8 :: \"uint8 \\ uint64\" is ucast .\nlift_definition uint64_of_uint16 :: \"uint16 \\ uint64\" is ucast .\nlift_definition uint64_of_uint32 :: \"uint32 \\ uint64\" is ucast .\n\ndefinition mask where \"mask = (0xFFFFFFFF :: integer)\"\n\ncode_printing\n constant uint8_of_uint16 \\\n (SML_word) \"Word8.fromLarge (Word16.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n (Scala) \"_.toByte\"\n| constant uint8_of_uint32 \\\n (SML) \"Word8.fromLarge (Word32.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n (Scala) \"_.toByte\"\n| constant uint8_of_uint64 \\\n (SML) \"Word8.fromLarge (Uint64.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n (Scala) \"_.toByte\"\n| constant uint16_of_uint8 \\\n (SML_word) \"Word16.fromLarge (Word8.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n (Scala) \"((_).toInt & 0xFF).toChar\"\n| constant uint16_of_uint32 \\\n (SML_word) \"Word16.fromLarge (Word32.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n (Scala) \"_.toChar\"\n| constant uint16_of_uint64 \\\n (SML_word) \"Word16.fromLarge (Uint64.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n (Scala) \"_.toChar\"\n| constant uint32_of_uint8 \\\n (SML) \"Word32.fromLarge (Word8.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n (Scala) \"((_).toInt & 0xFF)\"\n| constant uint32_of_uint16 \\\n (SML_word) \"Word32.fromLarge (Word16.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n (Scala) \"(_).toInt\"\n| constant uint32_of_uint64 \\\n (SML_word) \"Word32.fromLarge (Uint64.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n (Scala) \"(_).toInt\" and\n (OCaml) \"Int64.to'_int32\"\n| constant uint64_of_uint8 \\\n (SML_word) \"Word64.fromLarge (Word8.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n (Scala) \"((_).toLong & 0xFF)\"\n| constant uint64_of_uint16 \\\n (SML_word) \"Word64.fromLarge (Word16.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n (Scala) \"_.toLong\"\n| constant uint64_of_uint32 \\\n (SML_word) \"Word64.fromLarge (Word32.toLarge _)\" and\n (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n (Scala) \"((_).toLong & 0xFFFFFFFFL)\" and\n (OCaml) \"Int64.logand (Int64.of'_int32 _) (Int64.of'_string \\\"4294967295\\\")\"\n\ntext \\\n Use @{const Abs_uint8'} etc. instead of @{const Rep_uint8} in code equations\n for conversion functions to avoid exceptions during code generation when the\n target language provides only some of the uint types.\n\\\n\nlemma uint8_of_uint16_code [code]:\n \"uint8_of_uint16 x = Abs_uint8' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint8_of_uint32_code [code]:\n \"uint8_of_uint32 x = Abs_uint8' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint8_of_uint64_code [code]:\n \"uint8_of_uint64 x = Abs_uint8' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint16_of_uint8_code [code]:\n \"uint16_of_uint8 x = Abs_uint16' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint16_of_uint32_code [code]:\n \"uint16_of_uint32 x = Abs_uint16' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint16_of_uint64_code [code]:\n \"uint16_of_uint64 x = Abs_uint16' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint32_of_uint8_code [code]:\n \"uint32_of_uint8 x = Abs_uint32' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint32_of_uint16_code [code]:\n \"uint32_of_uint16 x = Abs_uint32' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint32_of_uint64_code [code]:\n \"uint32_of_uint64 x = Abs_uint32' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint64_of_uint8_code [code]:\n \"uint64_of_uint8 x = Abs_uint64' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint64_of_uint16_code [code]:\n \"uint64_of_uint16 x = Abs_uint64' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint64_of_uint32_code [code]:\n \"uint64_of_uint32 x = Abs_uint64' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Native_Word/Native_Cast.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.26067985162986895}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Memset\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"memset.c\"\ninstall_C_file \"memset.c\"\n\nautocorres [\n heap_abs_syntax,\n no_heap_abs=memset,\n no_signed_word_abs=memset,\n unsigned_word_abs=memset] \"memset.c\"\n\nlemma c_guard_word8_ptr [simp]:\n \"c_guard (x :: word8 ptr) = (x \\ NULL)\"\n apply (clarsimp simp: c_guard_def ptr_aligned_def c_null_guard_def)\n apply (metis Ptr_ptr_val first_in_intvl intvl_Suc not_less_eq ptr_val.ptr_val_def)\n done\n\nlemma to_bytes_word8 [simp]: \"to_bytes (a :: word8) x = [a]\"\n by (clarsimp simp: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma heap_update_list_id [simp]:\n \"heap_update_list x [] = (\\x. x)\"\n apply (rule ext)\n apply simp\n done\n\nlemma heap_update_heap_update_list:\n \"\\ ptr_val p = q + (of_nat (length l)); Suc (length l) < addr_card \\ \\\n heap_update (p :: word8 ptr) v (heap_update_list q l s) = (heap_update_list q (l @ [v]) s)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def unat_of_nat\n addr_card word_bits_def fun_upd_def)\n apply (subst heap_update_list_value, clarsimp simp: addr_card)\n apply safe\n apply (subst if_P)\n apply (fastforce intro: intvlI)\n apply (clarsimp simp: unat_of_nat word_bits_def)\n apply (subst (1 2) heap_update_list_value,\n simp add: addr_card,\n simp add: addr_card)\n apply (case_tac \"x \\ {q..+length l}\")\n apply (subst if_P, simp)\n apply (subst if_P)\n apply clarsimp\n apply (metis (full_types) intvlD intvlI less_SucI)\n apply (subst nth_append, clarsimp)\n apply (metis (hide_lams, no_types) add_diff_cancel2 intvlD le_unat_uoi less_or_eq_imp_le not_le)\n apply clarsimp\n apply (metis intvlD intvlI less_antisym)\n done\n\nlemma (in memset) memset:\n \"\\s\\<^sub>0. \\ \\s. s = s\\<^sub>0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update (\n heap_update_list (ptr_val p) (replicate n (scast c)))) s\\<^sub>0 \\!\"\nproof -\n {\n fix s0\n have \"\\ \\s. s = s0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update\n (heap_update_list (ptr_val p) (replicate n (scast c)))) s0 \\!\"\n apply (rule validNF_assume_pre)\n apply (unfold memset'_def)\n apply (subst whileLoop_add_inv [where M=\"\\((d', n'), _). n'\"\n and I=\"\\(d', n') s.\n n' \\ n \\\n (n' \\ n \\ d' = ptr_coerce p +\\<^sub>p int (n - n')) \\\n (n' \\ n \\ s = t_hrs_'_update\n (hrs_mem_update (heap_update_list (ptr_val p) (replicate (n - n') (scast c)))) s0)\"])\n apply wp\n apply (clarsimp simp:)\n apply (intro conjI impI)\n apply arith\n apply (clarsimp simp: ptr_add_def)\n apply (rule globals.fold_congs, simp, simp)\n apply (clarsimp simp: hrs_mem_update_def)\n apply (subst heap_update_heap_update_list)\n apply (clarsimp simp: ptr_add_def)\n apply (clarsimp)\n apply arith\n apply (metis diff_Suc_diff_eq2 diff_diff_left minus_nat.diff_0 replicate_Suc_append)\n apply (clarsimp simp: ptr_add_def)\n apply (metis (hide_lams, no_types) add_less_cancel_right add.left_neutral intvl_inter_le le0 le_add_diff_inverse of_nat_diff semiring_1_class.of_nat_0)\n apply clarsimp\n apply (clarsimp simp: hrs_mem_update_def)\n done\n }\n\n thus ?thesis\n by simp\nqed\n\nlemma word_rsplit_sword_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize signed word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma word_rsplit_word_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma heap_update_zero_node [simplified]:\n \"heap_update_list p (replicate (size_of TYPE(node_C)) 0) = heap_update (Ptr p) (node_C NULL 0)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def to_bytes_def)\n apply (subst packed_type_access_ti, simp)\n apply (clarsimp simp: access_ti\\<^sub>0_def)\n apply (clarsimp simp: to_bytes_def to_bytes_p_def node_C_tag_def node_C_typ_tag)\n apply (subst final_pad_def)\n apply (clarsimp simp: typ_info_word size_td_lt_ti_typ_pad_combine Let_def padup_def)\n apply (clarsimp simp: ti_typ_pad_combine_def)\n apply (clarsimp simp: ti_typ_combine_def empty_typ_info_def typ_info_ptr typ_info_word)\n done\n\nlemma (in memset) is_valid_node_C_non_NULL [simp]:\n \"is_valid_node_C (lift_global_heap s) p \\ 0 \\ {ptr_val p ..+ size_of TYPE(node_C)}\"\n by (auto simp: lift_global_heap_def c_guard_def c_null_guard_def dest: simple_lift_c_guard)\n\nlemma (in memset) zero_node:\n \"\\s\\<^sub>0. \\ \\s. is_valid_node_C s p \\ s = s\\<^sub>0\\ zero_node' p \\ \\rv s. s = s\\<^sub>0[p := (node_C NULL 0) ] \\! \"\n including nf_no_pre\n apply (clarsimp simp: zero_node'_def)\n apply (wp add: memset [THEN validNF_make_schematic_post, simplified])\n apply (fastforce dest: simple_lift_c_guard is_valid_node_C_non_NULL\n simp: addr_card lift_global_heap_def heap_update_zero_node\n memset.update_node_def typ_simple_heap_simps fun_upd_def)\n done\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/examples/Memset.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.26067983873669676}} {"text": "(* Title: JinjaThreads/Execute/Round_Robin.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Round robin scheduler\\\n\ntheory Round_Robin\nimports\n Scheduler\nbegin\n\ntext \\\n A concrete scheduler must pick one possible reduction step from the small-step semantics for invidivual threads.\n Currently, this is only possible if there is only one such by using @{term Predicate.the}.\n\\\n\nsubsection \\Concrete schedulers\\\n\nsubsection \\Round-robin schedulers\\\n\ntype_synonym 'queue round_robin = \"'queue \\ nat\"\n \\ \\Waiting queue of threads and remaining number of steps of the first thread until it has to return resources\\\n\nprimrec enqueue_new_thread :: \"'t list \\ ('t,'x,'m) new_thread_action \\ 't list\"\nwhere \n \"enqueue_new_thread queue (NewThread t x m) = queue @ [t]\"\n| \"enqueue_new_thread queue (ThreadExists t b) = queue\"\n\ndefinition enqueue_new_threads :: \"'t list \\ ('t,'x,'m) new_thread_action list \\ 't list\"\nwhere\n \"enqueue_new_threads = foldl enqueue_new_thread\"\n\nprimrec round_robin_update_state :: \"nat \\ 't list round_robin \\ 't \\ ('l,'t,'x,'m,'w,'o) thread_action \\ 't list round_robin\"\nwhere \n \"round_robin_update_state n0 (queue, n) t ta =\n (let queue' = enqueue_new_threads queue \\ta\\\\<^bsub>t\\<^esub>\n in if n = 0 \\ Yield \\ set \\ta\\\\<^bsub>c\\<^esub> then (rotate1 queue', n0) else (queue', n - 1))\"\n\ncontext multithreaded_base begin\n\nabbreviation round_robin_step :: \"nat \\ 't list round_robin \\ ('l,'t,'x,'m,'w) state \\ 't \\ ('t \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) option \\ 't list round_robin) option\"\nwhere\n \"round_robin_step n0 \\ s t \\ step_thread (round_robin_update_state n0 \\ t) s t\"\n\npartial_function (option) round_robin_reschedule :: \"'t \\ \n 't list \\ nat \\ ('l,'t,'x,'m,'w) state \\ ('t \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) option \\ 't list round_robin) option\"\nwhere\n \"round_robin_reschedule t0 queue n0 s =\n (let\n t = hd queue;\n queue' = tl queue\n in\n if t = t0 then\n None\n else\n case round_robin_step n0 (t # queue', n0) s t of\n None \\ round_robin_reschedule t0 (queue' @ [t]) n0 s\n | \\ttaxm\\\\ \\ \\ttaxm\\\\)\"\n\nfun round_robin :: \"nat \\ 't list round_robin \\ ('l,'t,'x,'m,'w) state \\ ('t \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) option \\ 't list round_robin) option\"\nwhere \n \"round_robin n0 ([], n) s = None\"\n| \"round_robin n0 (t # queue, n) s =\n (case round_robin_step n0 (t # queue, n) s t of\n \\ttaxm\\\\ \\ \\ttaxm\\\\\n | None \\ round_robin_reschedule t (queue @ [t]) n0 s)\"\n\nend\n\nprimrec round_robin_invar :: \"'t list round_robin \\ 't set \\ bool\"\nwhere \"round_robin_invar (queue, n) T \\ set queue = T \\ distinct queue\"\n\nlemma set_enqueue_new_thread: \n \"set (enqueue_new_thread queue nta) = set queue \\ {t. \\x m. nta = NewThread t x m}\"\nby(cases nta) auto\n\nlemma set_enqueue_new_threads: \n \"set (enqueue_new_threads queue ntas) = set queue \\ {t. \\x m. NewThread t x m \\ set ntas}\"\napply(induct ntas arbitrary: queue)\napply(auto simp add: enqueue_new_threads_def set_enqueue_new_thread)\ndone\n\nlemma enqueue_new_thread_eq_Nil [simp]:\n \"enqueue_new_thread queue nta = [] \\ queue = [] \\ (\\t b. nta = ThreadExists t b)\"\nby(cases nta) simp_all\n\nlemma enqueue_new_threads_eq_Nil [simp]:\n \"enqueue_new_threads queue ntas = [] \\ queue = [] \\ set ntas \\ {ThreadExists t b|t b. True}\"\napply(induct ntas arbitrary: queue)\napply(auto simp add: enqueue_new_threads_def)\ndone\n\nlemma distinct_enqueue_new_threads:\n fixes ts :: \"('l,'t,'x) thread_info\"\n and ntas :: \"('t,'x,'m) new_thread_action list\"\n assumes \"thread_oks ts ntas\" \"set queue = dom ts\" \"distinct queue\"\n shows \"distinct (enqueue_new_threads queue ntas)\"\nusing assms\nproof(induct ntas arbitrary: ts queue)\n case Nil thus ?case by(simp add: enqueue_new_threads_def)\nnext\n case (Cons nt ntas)\n from \\thread_oks ts (nt # ntas)\\\n have \"thread_ok ts nt\" and \"thread_oks (redT_updT ts nt) ntas\" by simp_all\n from \\thread_ok ts nt\\ \\set queue = dom ts\\ \\distinct queue\\\n have \"set (enqueue_new_thread queue nt) = dom (redT_updT ts nt) \\ distinct (enqueue_new_thread queue nt)\"\n by(cases nt)(auto)\n with \\thread_oks (redT_updT ts nt) ntas\\\n have \"distinct (enqueue_new_threads (enqueue_new_thread queue nt) ntas)\"\n by(blast intro: Cons.hyps)\n thus ?case by(simp add: enqueue_new_threads_def)\nqed\n\nlemma round_robin_reschedule_induct [consumes 1, case_names head rotate]:\n assumes major: \"t0 \\ set queue\"\n and head: \"\\queue. P (t0 # queue)\"\n and rotate: \"\\queue t. \\ t \\ t0; t0 \\ set queue; P (queue @ [t]) \\ \\ P (t # queue)\"\n shows \"P queue\"\nusing major\nproof(induct n\\\"length (takeWhile (\\x. x\\t0) queue)\" arbitrary: queue)\n case 0\n then obtain queue' where \"queue = t0 # queue'\"\n by(cases queue)(auto split: if_split_asm)\n thus ?case by(simp add: head)\nnext\n case (Suc n)\n then obtain t queue' where [simp]: \"queue = t # queue'\"\n and t: \"t \\ t0\" and n: \"n = length (takeWhile (\\x. x \\ t0) queue')\"\n and t0: \"t0 \\ set queue'\"\n by(cases queue)(auto split: if_split_asm)\n from n t0 have \"n = length (takeWhile (\\x. x \\ t0) (queue' @ [t]))\" by(simp)\n moreover from t0 have \"t0 \\ set (queue' @ [t])\" by simp\n ultimately have \"P (queue' @ [t])\" by(rule Suc.hyps)\n with t t0 show ?case by(simp add: rotate)\nqed\n\ncontext multithreaded_base begin\n\ndeclare actions_ok_iff [simp del]\ndeclare actions_ok.cases [rule del]\n\nlemma round_robin_step_invar_None:\n \"\\ round_robin_step n0 \\ s t' = \\(t, None, \\')\\; round_robin_invar \\ (dom (thr s)) \\\n \\ round_robin_invar \\' (dom (thr s))\"\nby(cases \\)(auto dest: step_thread_Some_NoneD simp add: set_enqueue_new_threads distinct_enqueue_new_threads)\n\nlemma round_robin_step_invar_Some:\n \"\\ deterministic I; round_robin_step n0 \\ s t' = \\(t, \\(ta, x', m')\\, \\')\\; round_robin_invar \\ (dom (thr s)); s \\ I \\\n \\ round_robin_invar \\' (dom (thr s) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})\"\napply(cases \\)\napply clarsimp\napply(frule (1) step_thread_Some_SomeD)\napply(auto split: if_split_asm simp add: split_beta set_enqueue_new_threads deterministic_THE)\napply(auto simp add: actions_ok_iff distinct_enqueue_new_threads)\ndone\n\nlemma round_robin_reschedule_Cons:\n \"round_robin_reschedule t0 (t0 # queue) n0 s = None\"\n \"t \\ t0 \\ round_robin_reschedule t0 (t # queue) n0 s =\n (case round_robin_step n0 (t # queue, n0) s t of\n None \\ round_robin_reschedule t0 (queue @ [t]) n0 s\n | Some ttaxm\\ \\ Some ttaxm\\)\"\nby(simp_all add: round_robin_reschedule.simps)\n\nlemma round_robin_reschedule_NoneD:\n assumes rrr: \"round_robin_reschedule t0 queue n0 s = None\"\n and t0: \"t0 \\ set queue\"\n shows \"set (takeWhile (\\t'. t' \\ t0) queue) \\ active_threads s = {}\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n case (head queue)\n thus ?case by simp\nnext\n case (rotate queue t)\n from \\round_robin_reschedule t0 (t # queue) n0 s = None\\ \\t \\ t0\\\n have \"round_robin_step n0 (t # queue, n0) s t = None\" \n and \"round_robin_reschedule t0 (queue @ [t]) n0 s = None\"\n by(simp_all add: round_robin_reschedule_Cons)\n from this(1) have \"t \\ active_threads s\" by(rule step_thread_NoneD)\n moreover from \\round_robin_reschedule t0 (queue @ [t]) n0 s = None\\ \n have \"set (takeWhile (\\t'. t' \\ t0) (queue @ [t])) \\ active_threads s = {}\"\n by(rule rotate.hyps)\n moreover have \"takeWhile (\\t'. t' \\ t0) (queue @ [t]) = takeWhile (\\t'. t' \\ t0) queue\"\n using \\t0 \\ set queue\\ by simp\n ultimately show ?case using \\t \\ t0\\ by simp\nqed\n\nlemma round_robin_reschedule_Some_NoneD:\n assumes rrr: \"round_robin_reschedule t0 queue n0 s = \\(t, None, \\')\\\"\n and t0: \"t0 \\ set queue\"\n shows \"\\x ln n. thr s t = \\(x, ln)\\ \\ ln $ n > 0 \\ \\ waiting (wset s t) \\ may_acquire_all (locks s) t ln\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n case (rotate queue t')\n show ?case\n proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n case None\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, None, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\(t, None, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis by(rule rotate.hyps)\n next\n case (Some a)\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, None, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_step n0 (t' # queue, n0) s t' = \\(t, None, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis by(blast dest: step_thread_Some_NoneD)\n qed\nqed\n\nlemma round_robin_reschedule_Some_SomeD:\n assumes \"deterministic I\"\n and rrr: \"round_robin_reschedule t0 queue n0 s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and t0: \"t0 \\ set queue\"\n and I: \"s \\ I\"\n shows \"\\x. thr s t = \\(x, no_wait_locks)\\ \\ t \\ \\x, shr s\\ -ta\\ \\x', m'\\ \\ actions_ok s t ta\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n case (rotate queue t')\n show ?case\n proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n case None\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis by(rule rotate.hyps)\n next\n case (Some a)\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_step n0 (t' # queue, n0) s t' = \\(t, \\(ta, x', m')\\, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis using I by(blast dest: step_thread_Some_SomeD[OF \\deterministic I\\])\n qed\nqed\n\nlemma round_robin_reschedule_invar_None:\n assumes rrr: \"round_robin_reschedule t0 queue n0 s = \\(t, None, \\')\\\"\n and invar: \"round_robin_invar (queue, n0) (dom (thr s))\"\n and t0: \"t0 \\ set queue\"\n shows \"round_robin_invar \\' (dom (thr s))\"\nusing t0 rrr invar\nproof(induct queue rule: round_robin_reschedule_induct)\n case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n case (rotate queue t')\n show ?case\n proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n case None\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, None, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\(t, None, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n moreover from \\round_robin_invar (t' # queue, n0) (dom (thr s))\\\n have \"round_robin_invar (queue @ [t'], n0) (dom (thr s))\" by simp\n ultimately show ?thesis by(rule rotate.hyps)\n next\n case (Some a)\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, None, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_step n0 (t' # queue, n0) s t' = \\(t, None, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis using \\round_robin_invar (t' # queue, n0) (dom (thr s))\\\n by(rule round_robin_step_invar_None)\n qed\nqed\n\nlemma round_robin_reschedule_invar_Some:\n assumes \"deterministic I\"\n and rrr: \"round_robin_reschedule t0 queue n0 s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and invar: \"round_robin_invar (queue, n0) (dom (thr s))\"\n and t0: \"t0 \\ set queue\"\n and \"s \\ I\"\n shows \"round_robin_invar \\' (dom (thr s) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})\"\nusing t0 rrr invar\nproof(induct queue rule: round_robin_reschedule_induct)\n case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n case (rotate queue t')\n show ?case\n proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n case None\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n moreover from \\round_robin_invar (t' # queue, n0) (dom (thr s))\\\n have \"round_robin_invar (queue @ [t'], n0) (dom (thr s))\" by simp\n ultimately show ?thesis by(rule rotate.hyps)\n next\n case (Some a)\n with \\round_robin_reschedule t0 (t' # queue) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\\ \\t' \\ t0\\\n have \"round_robin_step n0 (t' # queue, n0) s t' = \\(t, \\(ta, x', m')\\, \\')\\\"\n by(simp add: round_robin_reschedule_Cons)\n thus ?thesis using \\round_robin_invar (t' # queue, n0) (dom (thr s))\\ \\s \\ I\\\n by(rule round_robin_step_invar_Some[OF \\deterministic I\\])\n qed\nqed\n\nlemma round_robin_NoneD: \n assumes rr: \"round_robin n0 \\ s = None\"\n and invar: \"round_robin_invar \\ (dom (thr s))\"\n shows \"active_threads s = {}\"\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n show ?thesis\n proof(cases queue)\n case Nil\n thus ?thesis using invar \\ by(fastforce elim: active_threads.cases)\n next\n case (Cons t queue')\n with rr \\ have \"round_robin_step n0 (t # queue', n) s t = None\"\n and \"round_robin_reschedule t (queue' @ [t]) n0 s = None\" by simp_all\n from \\round_robin_step n0 (t # queue', n) s t = None\\\n have \"t \\ active_threads s\" by(rule step_thread_NoneD)\n moreover from \\round_robin_reschedule t (queue' @ [t]) n0 s = None\\\n have \"set (takeWhile (\\x. x \\ t) (queue' @ [t])) \\ active_threads s = {}\"\n by(rule round_robin_reschedule_NoneD) simp\n moreover from invar \\ Cons\n have \"takeWhile (\\x. x \\ t) (queue' @ [t]) = queue'\"\n by(subst takeWhile_append2) auto\n moreover from invar have \"active_threads s \\ set queue\"\n using \\ by(auto elim: active_threads.cases)\n ultimately show ?thesis using Cons by auto\n qed\nqed\n\nlemma round_robin_Some_NoneD:\n assumes rr: \"round_robin n0 \\ s = \\(t, None, \\')\\\"\n shows \"\\x ln n. thr s t = \\(x, ln)\\ \\ ln $ n > 0 \\ \\ waiting (wset s t) \\ may_acquire_all (locks s) t ln\"\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n with rr have \"queue \\ []\" by clarsimp\n then obtain t' queue' where queue: \"queue = t' # queue'\"\n by(auto simp add: neq_Nil_conv)\n show ?thesis\n proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n case (Some a)\n with rr queue \\ have \"round_robin_step n0 (t' # queue', n) s t' = \\(t, None, \\')\\\" by simp\n thus ?thesis by(blast dest: step_thread_Some_NoneD)\n next\n case None\n with rr queue \\ have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\(t, None, \\')\\\" by simp\n thus ?thesis by(rule round_robin_reschedule_Some_NoneD)simp\n qed\nqed\n\nlemma round_robin_Some_SomeD:\n assumes \"deterministic I\"\n and rr: \"round_robin n0 \\ s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and \"s \\ I\"\n shows \"\\x. thr s t = \\(x, no_wait_locks)\\ \\ t \\ \\x, shr s\\ -ta\\ \\x', m'\\ \\ actions_ok s t ta\"\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n with rr have \"queue \\ []\" by clarsimp\n then obtain t' queue' where queue: \"queue = t' # queue'\"\n by(auto simp add: neq_Nil_conv)\n show ?thesis\n proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n case (Some a)\n with rr queue \\ have \"round_robin_step n0 (t' # queue', n) s t' = \\(t, \\(ta, x', m')\\, \\')\\\" by simp\n thus ?thesis using \\s \\ I\\ by(blast dest: step_thread_Some_SomeD[OF \\deterministic I\\])\n next\n case None\n with rr queue \\ have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\" by simp\n thus ?thesis by(rule round_robin_reschedule_Some_SomeD[OF \\deterministic I\\])(simp_all add: \\s \\ I\\)\n qed\nqed\n\nlemma round_robin_invar_None:\n assumes rr: \"round_robin n0 \\ s = \\(t, None, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr s))\"\n shows \"round_robin_invar \\' (dom (thr s))\"\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n with rr have \"queue \\ []\" by clarsimp\n then obtain t' queue' where queue: \"queue = t' # queue'\"\n by(auto simp add: neq_Nil_conv)\n show ?thesis\n proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n case (Some a)\n with rr queue \\ have \"round_robin_step n0 (t' # queue', n) s t' = \\(t, None, \\')\\\" by simp\n thus ?thesis using invar unfolding \\ queue by(rule round_robin_step_invar_None)\n next\n case None\n with rr queue \\ have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\(t, None, \\')\\\" by simp\n moreover from invar queue \\ have \"round_robin_invar (queue' @ [t'], n0) (dom (thr s))\" by simp\n ultimately show ?thesis by(rule round_robin_reschedule_invar_None) simp\n qed\nqed\n\nlemma round_robin_invar_Some:\n assumes \"deterministic I\"\n and rr: \"round_robin n0 \\ s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr s))\" \"s \\ I\"\n shows \"round_robin_invar \\' (dom (thr s) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})\"\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n with rr have \"queue \\ []\" by clarsimp\n then obtain t' queue' where queue: \"queue = t' # queue'\"\n by(auto simp add: neq_Nil_conv)\n show ?thesis\n proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n case (Some a)\n with rr queue \\ have \"round_robin_step n0 (t' # queue', n) s t' = \\(t, \\(ta, x', m')\\, \\')\\\" by simp\n thus ?thesis using invar unfolding \\ queue by(rule round_robin_step_invar_Some[OF \\deterministic I\\])\n next\n case None\n with rr queue \\ have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\(t, \\(ta, x', m')\\, \\')\\\" by simp\n moreover from invar queue \\\n have \"round_robin_invar (queue' @ [t'], n0) (dom (thr s))\" by simp\n ultimately show ?thesis by(rule round_robin_reschedule_invar_Some[OF \\deterministic I\\])(simp_all add: \\s \\ I\\)\n qed\nqed\n\nend\n\nlocale round_robin_base =\n scheduler_base_aux\n final r convert_RA\n thr_\\ thr_invar thr_lookup thr_update\n ws_\\ ws_invar ws_lookup\n is_\\ is_invar is_memb is_ins is_delete\n for final :: \"'x \\ bool\"\n and r :: \"'t \\ ('x \\ 'm) \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) Predicate.pred\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and \"output\" :: \"'queue round_robin \\ 't \\ ('l,'t,'x,'m,'w,'o) thread_action \\ 'q option\"\n and thr_\\ :: \"'m_t \\ ('l,'t,'x) thread_info\"\n and thr_invar :: \"'m_t \\ bool\"\n and thr_lookup :: \"'t \\ 'm_t \\ ('x \\ 'l released_locks)\"\n and thr_update :: \"'t \\ 'x \\ 'l released_locks \\ 'm_t \\ 'm_t\"\n and ws_\\ :: \"'m_w \\ ('w,'t) wait_sets\"\n and ws_invar :: \"'m_w \\ bool\"\n and ws_lookup :: \"'t \\ 'm_w \\ 'w wait_set_status\"\n and ws_update :: \"'t \\ 'w wait_set_status \\ 'm_w \\ 'm_w\"\n and ws_delete :: \"'t \\ 'm_w \\ 'm_w\"\n and ws_iterate :: \"'m_w \\ ('t \\ 'w wait_set_status, 'm_w) set_iterator\"\n and ws_sel :: \"'m_w \\ ('t \\ 'w wait_set_status \\ bool) \\ ('t \\ 'w wait_set_status)\"\n and is_\\ :: \"'s_i \\ 't interrupts\"\n and is_invar :: \"'s_i \\ bool\"\n and is_memb :: \"'t \\ 's_i \\ bool\"\n and is_ins :: \"'t \\ 's_i \\ 's_i\"\n and is_delete :: \"'t \\ 's_i \\ 's_i\"\n +\n fixes queue_\\ :: \"'queue \\ 't list\"\n and queue_invar :: \"'queue \\ bool\"\n and queue_empty :: \"unit \\ 'queue\"\n and queue_isEmpty :: \"'queue \\ bool\"\n and queue_enqueue :: \"'t \\ 'queue \\ 'queue\"\n and queue_dequeue :: \"'queue \\ 't \\ 'queue\"\n and queue_push :: \"'t \\ 'queue \\ 'queue\"\nbegin\n\ndefinition queue_rotate1 :: \"'queue \\ 'queue\"\nwhere \"queue_rotate1 = case_prod queue_enqueue \\ queue_dequeue\"\n\nprimrec enqueue_new_thread :: \"'queue \\ ('t,'x,'m) new_thread_action \\ 'queue\"\nwhere \n \"enqueue_new_thread ts (NewThread t x m) = queue_enqueue t ts\"\n| \"enqueue_new_thread ts (ThreadExists t b) = ts\"\n\ndefinition enqueue_new_threads :: \"'queue \\ ('t,'x,'m) new_thread_action list \\ 'queue\"\nwhere\n \"enqueue_new_threads = foldl enqueue_new_thread\"\n\nprimrec round_robin_update_state :: \"nat \\ 'queue round_robin \\ 't \\ ('l,'t,'x,'m,'w,'o) thread_action \\ 'queue round_robin\"\nwhere \n \"round_robin_update_state n0 (queue, n) t ta =\n (let queue' = enqueue_new_threads queue \\ta\\\\<^bsub>t\\<^esub>\n in if n = 0 \\ Yield \\ set \\ta\\\\<^bsub>c\\<^esub> then (queue_rotate1 queue', n0) else (queue', n - 1))\"\n\nabbreviation round_robin_step ::\n \"nat \\ 'queue round_robin \\ ('l,'t,'m,'m_t,'m_w,'s_i) state_refine \\ 't \n \\ ('t \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) option \\ 'queue round_robin) option\"\nwhere\n \"round_robin_step n0 \\ s t \\ step_thread (round_robin_update_state n0 \\ t) s t\"\n\npartial_function (option) round_robin_reschedule ::\n \"'t \\ 'queue \\ nat \\ ('l,'t,'m,'m_t,'m_w,'s_i) state_refine \n \\ ('t \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) option \\ 'queue round_robin) option\"\nwhere\n \"round_robin_reschedule t0 queue n0 s =\n (let\n (t, queue') = queue_dequeue queue\n in\n if t = t0 then\n None \n else\n case round_robin_step n0 (queue_push t queue', n0) s t of\n None \\ round_robin_reschedule t0 (queue_enqueue t queue') n0 s\n | \\ttaxm\\\\ \\ \\ttaxm\\\\)\"\n\nprimrec round_robin :: \"nat \\ ('l,'t,'x,'m,'w,'o,'m_t,'m_w,'s_i,'queue round_robin) scheduler\"\nwhere \n \"round_robin n0 (queue, n) s = \n (if queue_isEmpty queue then None\n else\n let\n (t, queue') = queue_dequeue queue\n in\n (case round_robin_step n0 (queue_push t queue', n) s t of\n \\ttaxm\\\\ \\ \\ttaxm\\\\\n | None \\ round_robin_reschedule t (queue_enqueue t queue') n0 s))\"\n\nprimrec round_robin_invar :: \"'queue round_robin \\ 't set \\ bool\"\nwhere \"round_robin_invar (queue, n) T \\ queue_invar queue \\ Round_Robin.round_robin_invar (queue_\\ queue, n) T\"\n\ndefinition round_robin_\\ :: \"'queue round_robin \\ 't list round_robin\"\nwhere \"round_robin_\\ = apfst queue_\\\"\n\ndefinition round_robin_start :: \"nat \\ 't \\ 'queue round_robin\"\nwhere \"round_robin_start n0 t = (queue_enqueue t (queue_empty ()), n0)\"\n\nlemma round_robin_invar_correct:\n \"round_robin_invar \\ T \\ Round_Robin.round_robin_invar (round_robin_\\ \\) T\"\nby(cases \\)(simp add: round_robin_\\_def)\n\nend\n\nlocale round_robin =\n round_robin_base\n final r convert_RA \"output\"\n thr_\\ thr_invar thr_lookup thr_update\n ws_\\ ws_invar ws_lookup ws_update ws_delete ws_iterate ws_sel\n is_\\ is_invar is_memb is_ins is_delete\n queue_\\ queue_invar queue_empty queue_isEmpty queue_enqueue queue_dequeue queue_push\n +\n scheduler_aux\n final r convert_RA\n thr_\\ thr_invar thr_lookup thr_update\n ws_\\ ws_invar ws_lookup\n is_\\ is_invar is_memb is_ins is_delete\n +\n ws: map_update ws_\\ ws_invar ws_update +\n ws: map_delete ws_\\ ws_invar ws_delete +\n ws: map_iteratei ws_\\ ws_invar ws_iterate +\n ws: map_sel' ws_\\ ws_invar ws_sel +\n queue: list queue_\\ queue_invar +\n queue: list_empty queue_\\ queue_invar queue_empty +\n queue: list_isEmpty queue_\\ queue_invar queue_isEmpty +\n queue: list_enqueue queue_\\ queue_invar queue_enqueue +\n queue: list_dequeue queue_\\ queue_invar queue_dequeue +\n queue: list_push queue_\\ queue_invar queue_push\n for final :: \"'x \\ bool\"\n and r :: \"'t \\ ('x \\ 'm) \\ (('l,'t,'x,'m,'w,'o) thread_action \\ 'x \\ 'm) Predicate.pred\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and \"output\" :: \"'queue round_robin \\ 't \\ ('l,'t,'x,'m,'w,'o) thread_action \\ 'q option\"\n and thr_\\ :: \"'m_t \\ ('l,'t,'x) thread_info\"\n and thr_invar :: \"'m_t \\ bool\"\n and thr_lookup :: \"'t \\ 'm_t \\ ('x \\ 'l released_locks)\"\n and thr_update :: \"'t \\ 'x \\ 'l released_locks \\ 'm_t \\ 'm_t\"\n and ws_\\ :: \"'m_w \\ ('w,'t) wait_sets\"\n and ws_invar :: \"'m_w \\ bool\"\n and ws_lookup :: \"'t \\ 'm_w \\ 'w wait_set_status\"\n and ws_update :: \"'t \\ 'w wait_set_status \\ 'm_w \\ 'm_w\"\n and ws_delete :: \"'t \\ 'm_w \\ 'm_w\"\n and ws_iterate :: \"'m_w \\ ('t \\ 'w wait_set_status, 'm_w) set_iterator\"\n and ws_sel :: \"'m_w \\ ('t \\ 'w wait_set_status \\ bool) \\ ('t \\ 'w wait_set_status)\"\n and is_\\ :: \"'s_i \\ 't interrupts\"\n and is_invar :: \"'s_i \\ bool\"\n and is_memb :: \"'t \\ 's_i \\ bool\"\n and is_ins :: \"'t \\ 's_i \\ 's_i\"\n and is_delete :: \"'t \\ 's_i \\ 's_i\"\n and queue_\\ :: \"'queue \\ 't list\"\n and queue_invar :: \"'queue \\ bool\"\n and queue_empty :: \"unit \\ 'queue\"\n and queue_isEmpty :: \"'queue \\ bool\"\n and queue_enqueue :: \"'t \\ 'queue \\ 'queue\"\n and queue_dequeue :: \"'queue \\ 't \\ 'queue\"\n and queue_push :: \"'t \\ 'queue \\ 'queue\"\nbegin\n\nlemma queue_rotate1_correct:\n assumes \"queue_invar queue\" \"queue_\\ queue \\ []\"\n shows \"queue_\\ (queue_rotate1 queue) = rotate1 (queue_\\ queue)\"\n and \"queue_invar (queue_rotate1 queue)\"\nusing assms\napply(auto simp add: queue_rotate1_def split_beta queue.dequeue_correct queue.enqueue_correct)\nby(cases \"queue_\\ queue\") simp_all\n\nlemma enqueue_thread_correct:\n assumes \"queue_invar queue\"\n shows \"queue_\\ (enqueue_new_thread queue nta) = Round_Robin.enqueue_new_thread (queue_\\ queue) nta\"\n and \"queue_invar (enqueue_new_thread queue nta)\"\nusing assms\nby(case_tac [!] nta)(simp_all add: queue.enqueue_correct)\n\nlemma enqueue_threads_correct:\n assumes \"queue_invar queue\"\n shows \"queue_\\ (enqueue_new_threads queue ntas) = Round_Robin.enqueue_new_threads (queue_\\ queue) ntas\"\n and \"queue_invar (enqueue_new_threads queue ntas)\"\nusing assms\napply(induct ntas arbitrary: queue)\napply(simp_all add: enqueue_new_threads_def Round_Robin.enqueue_new_threads_def enqueue_thread_correct)\ndone\n\nlemma round_robin_update_thread_correct:\n assumes \"round_robin_invar \\ T\" \"t' \\ T\"\n shows \"round_robin_\\ (round_robin_update_state n0 \\ t ta) = Round_Robin.round_robin_update_state n0 (round_robin_\\ \\) t ta\"\nusing assms\napply(cases \\)\napply(auto simp add: round_robin_\\_def queue_rotate1_correct enqueue_threads_correct del: conjI)\napply(subst (1 2) queue_rotate1_correct)\napply(auto simp add: enqueue_threads_correct)\ndone\n\nlemma round_robin_step_correct:\n assumes det: \"\\.deterministic I\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n shows\n \"map_option (apsnd (apsnd round_robin_\\)) (round_robin_step n0 \\ s t) = \n \\.round_robin_step n0 (round_robin_\\ \\) (state_\\ s) t\" (is ?thesis1)\n and \"case_option True (\\(t, taxm, \\). round_robin_invar \\ (case taxm of None \\ dom (thr_\\ (thr s)) | Some (ta, x', m') \\ dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})) (round_robin_step n0 \\ s t)\"\n (is ?thesis2)\nproof -\n have \"?thesis1 \\ ?thesis2\"\n proof(cases \"dom (thr_\\ (thr s)) = {}\")\n case True\n thus ?thesis using invar\n apply(cases \\)\n apply(auto dest: step_thread_Some_NoneD[OF det] step_thread_Some_SomeD[OF det])\n apply(fastforce simp add: \\.step_thread_eq_None_conv elim: \\.active_threads.cases intro: sym)\n done\n next\n case False\n then obtain t' where t': \"t' \\ dom (thr_\\ (thr s))\" by blast\n hence ?thesis1\n using step_thread_correct(1)[of I round_robin_invar \\ s round_robin_\\ \"round_robin_update_state n0 \\ t\" t, OF det invar]\n unfolding o_def using invar\n by(subst (asm) round_robin_update_thread_correct) auto\n moreover\n { fix ta :: \"('l, 't, 'x, 'm, 'w, 'o) thread_action\"\n assume \"FWThread.thread_oks (thr_\\ (thr s)) \\ta\\\\<^bsub>t\\<^esub>\"\n moreover from t' invar have \"queue_\\ (fst \\) \\ []\" by(cases \\) auto\n ultimately have \"round_robin_invar (round_robin_update_state n0 \\ t ta) (dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})\"\n using invar t' by(cases \\)(auto simp add: queue_rotate1_correct enqueue_threads_correct set_enqueue_new_threads iff del: domIff intro: distinct_enqueue_new_threads) }\n from step_thread_correct(2)[OF det, of round_robin_invar \\ s \"round_robin_update_state n0 \\ t\" t, OF invar this]\n have ?thesis2 using t' invar by simp\n ultimately show ?thesis by blast\n qed\n thus ?thesis1 ?thesis2 by blast+\nqed\n\nlemma round_robin_reschedule_correct:\n assumes det: \"\\.deterministic I\"\n and invar: \"round_robin_invar (queue, n) (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n and t0: \"t0 \\ set (queue_\\ queue)\"\n shows \"map_option (apsnd (apsnd round_robin_\\)) (round_robin_reschedule t0 queue n0 s) =\n \\.round_robin_reschedule t0 (queue_\\ queue) n0 (state_\\ s)\"\n and \"case_option True (\\(t, taxm, \\). round_robin_invar \\ (case taxm of None \\ dom (thr_\\ (thr s)) | Some (ta, x', m') \\ dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})) (round_robin_reschedule t0 queue n0 s)\"\nusing t0 invar\nproof(induct \"queue_\\ queue\" arbitrary: queue n rule: round_robin_reschedule_induct)\n case head\n { case 1 thus ?case using head[symmetric]\n by(subst round_robin_reschedule.simps)(subst \\.round_robin_reschedule.simps, clarsimp simp add: split_beta queue.dequeue_correct) \n next\n case 2 thus ?case using head[symmetric]\n by(subst round_robin_reschedule.simps)(clarsimp simp add: split_beta queue.dequeue_correct) }\nnext\n case (rotate \\queue' t)\n obtain t' queue' where queue': \"queue_dequeue queue = (t', queue')\" by(cases \"queue_dequeue queue\")\n note [simp] = \\t # \\queue' = queue_\\ queue\\[symmetric]\n { case 1\n with queue' have [simp]: \"t' = t\" \"\\queue' = queue_\\ queue'\" \"queue_invar queue'\" by(auto elim: queue.removelE)\n from 1 queue' have invar': \"round_robin_invar (queue_push t queue', n0) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.push_correct)\n show ?case\n proof(cases \"round_robin_step n0 (queue_push t queue', n0) s t\")\n case Some thus ?thesis\n using queue' \\t \\ t0\\ round_robin_step_correct[OF det invar' \\state_invar s\\, of n0 t] invar' \\state_\\ s \\ I\\\n by(subst round_robin_reschedule.simps)(subst \\.round_robin_reschedule.simps, auto simp add: round_robin_\\_def queue.push_correct)\n next\n case None\n hence \\None: \"\\.round_robin_step n0 (queue_\\ (queue_push t queue'), n0) (state_\\ s) t = None\"\n using round_robin_step_correct[OF det invar' \\state_invar s\\, of n0 t] invar' \\state_\\ s \\ I\\\n by(auto simp add: queue.push_correct round_robin_\\_def)\n have \"\\queue' @ [t] = queue_\\ (queue_enqueue t queue')\" by(simp add: queue.enqueue_correct)\n moreover from invar'\n have \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.enqueue_correct queue.push_correct)\n ultimately \n have \"map_option (apsnd (apsnd round_robin_\\)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) =\n \\.round_robin_reschedule t0 (queue_\\ (queue_enqueue t queue')) n0 (state_\\ s)\"\n using \\state_invar s\\ \\state_\\ s \\ I\\ by(rule rotate.hyps)\n thus ?thesis using None \\None \\t \\ t0\\ invar' queue'\n by(subst round_robin_reschedule.simps)(subst \\.round_robin_reschedule.simps, auto simp add: queue.enqueue_correct queue.push_correct)\n qed\n next\n case 2\n with queue' have [simp]: \"t' = t\" \"\\queue' = queue_\\ queue'\" \"queue_invar queue'\" by(auto elim: queue.removelE)\n from 2 queue' have invar': \"round_robin_invar (queue_push t queue', n0) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.push_correct)\n show ?case\n proof(cases \"round_robin_step n0 (queue_push t queue', n0) s t\")\n case Some thus ?thesis\n using queue' \\t \\ t0\\ round_robin_step_correct[OF det invar' \\state_invar s\\, of n0 t] invar' \\state_\\ s \\ I\\\n by(subst round_robin_reschedule.simps)(auto simp add: round_robin_\\_def queue.push_correct)\n next\n case None\n have \"\\queue' @ [t] = queue_\\ (queue_enqueue t queue')\" by(simp add: queue.enqueue_correct)\n moreover from invar'\n have \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.enqueue_correct queue.push_correct)\n ultimately \n have \"case_option True (\\(t, taxm, \\). round_robin_invar \\ (case_option (dom (thr_\\ (thr s))) (\\(ta, x', m'). dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>}) taxm)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s)\"\n using \\state_invar s\\ \\state_\\ s \\ I\\ by(rule rotate.hyps)\n thus ?thesis using None \\t \\ t0\\ invar' queue'\n by(subst round_robin_reschedule.simps)(auto simp add: queue.enqueue_correct queue.push_correct)\n qed\n }\nqed\n\nlemma round_robin_correct:\n assumes det: \"\\.deterministic I\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n shows \"map_option (apsnd (apsnd round_robin_\\)) (round_robin n0 \\ s) =\n \\.round_robin n0 (round_robin_\\ \\) (state_\\ s)\"\n (is ?thesis1)\n and \"case_option True (\\(t, taxm, \\). round_robin_invar \\ (case taxm of None \\ dom (thr_\\ (thr s)) | Some (ta, x', m') \\ dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})) (round_robin n0 \\ s)\"\n (is ?thesis2)\nproof -\n obtain queue n where \\: \"\\ = (queue, n)\" by(cases \\)\n have \"?thesis1 \\ ?thesis2\"\n proof(cases \"queue_\\ queue\")\n case Nil thus ?thesis using invar \\\n by(auto simp add: split_beta queue.isEmpty_correct round_robin_\\_def)\n next\n case (Cons t \\queue')\n with invar \\ obtain queue'\n where [simp]: \"queue_dequeue queue = (t, queue')\" \"\\queue' = queue_\\ queue'\" \"queue_invar queue'\"\n by(auto elim: queue.removelE)\n from invar \\ Cons have invar': \"round_robin_invar (queue_push t queue', n) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.push_correct)\n from invar \\ Cons have invar'': \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\ (thr s)))\"\n by(auto simp add: queue.enqueue_correct)\n show ?thesis\n proof(cases \"round_robin_step n0 (queue_push t queue', n) s t\")\n case Some\n with \\ Cons invar show ?thesis\n using round_robin_step_correct[OF det invar' \\state_invar s\\, of n0 t]\n by(auto simp add: queue.isEmpty_correct queue.push_correct round_robin_\\_def)\n next\n case None\n from invar \\ Cons have \"t \\ set (queue_\\ (queue_enqueue t queue'))\"\n by(auto simp add: queue.enqueue_correct) \n from round_robin_reschedule_correct[OF det invar'' \\state_invar s\\, OF \\state_\\ s \\ I\\ this, of n0] None \\ Cons invar\n round_robin_step_correct[OF det invar' \\state_invar s\\, of n0 t]\n show ?thesis by(auto simp add: queue.isEmpty_correct queue.push_correct round_robin_\\_def queue.enqueue_correct)\n qed\n qed\n thus ?thesis1 ?thesis2 by simp_all\nqed\n\nlemma round_robin_scheduler_spec:\n assumes det: \"\\.deterministic I\"\n shows \"scheduler_spec final r (round_robin n0) round_robin_invar thr_\\ thr_invar ws_\\ ws_invar is_\\ is_invar I\"\nproof\n fix \\ s\n assume rr: \"round_robin n0 \\ s = None\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n from round_robin_correct[OF det, OF invar, of n0] rr\n have \"\\.round_robin n0 (round_robin_\\ \\) (state_\\ s) = None\" by simp\n moreover from invar have \"Round_Robin.round_robin_invar (round_robin_\\ \\) (dom (thr (state_\\ s)))\"\n by(simp add: round_robin_invar_correct)\n ultimately show \"\\.active_threads (state_\\ s) = {}\" by(rule \\.round_robin_NoneD)\nnext\n fix \\ s t \\'\n assume rr: \"round_robin n0 \\ s = \\(t, None, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n from round_robin_correct[OF det, OF invar, of n0] rr\n have rr': \"\\.round_robin n0 (round_robin_\\ \\) (state_\\ s) = \\(t, None, round_robin_\\ \\')\\\" by simp\n then show \"\\x ln n. thr_\\ (thr s) t = \\(x, ln)\\ \\ 0 < ln $ n \\ \\ waiting (ws_\\ (wset s) t) \\ may_acquire_all (locks s) t ln\"\n by(rule \\.round_robin_Some_NoneD[where s=\"state_\\ s\", unfolded state_\\_conv])\nnext\n fix \\ s t ta x' m' \\'\n assume rr: \"round_robin n0 \\ s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n from round_robin_correct[OF det, OF invar, of n0] rr\n have rr': \"\\.round_robin n0 (round_robin_\\ \\) (state_\\ s) = \\(t, \\(ta, x', m')\\, round_robin_\\ \\')\\\" by simp\n thus \"\\x. thr_\\ (thr s) t = \\(x, no_wait_locks)\\ \\ Predicate.eval (r t (x, shr s)) (ta, x', m') \\ \\.actions_ok (state_\\ s) t ta\"\n using \\state_\\ s \\ I\\ by(rule \\.round_robin_Some_SomeD[OF det, where s=\"state_\\ s\", unfolded state_\\_conv])\nnext\n fix \\ s t \\'\n assume rr: \"round_robin n0 \\ s = \\(t, None, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n from round_robin_correct[OF det, OF invar, of n0] rr\n show \"round_robin_invar \\' (dom (thr_\\ (thr s)))\" by simp\nnext\n fix \\ s t ta x' m' \\'\n assume rr: \"round_robin n0 \\ s = \\(t, \\(ta, x', m')\\, \\')\\\"\n and invar: \"round_robin_invar \\ (dom (thr_\\ (thr s)))\" \"state_invar s\" \"state_\\ s \\ I\"\n from round_robin_correct[OF det, OF invar, of n0] rr\n show \"round_robin_invar \\' (dom (thr_\\ (thr s)) \\ {t. \\x m. NewThread t x m \\ set \\ta\\\\<^bsub>t\\<^esub>})\" by simp\nqed\n\nlemma round_robin_start_invar:\n \"round_robin_invar (round_robin_start n0 t0) {t0}\"\nby(simp add: round_robin_start_def queue.empty_correct queue.enqueue_correct)\n\nend\n\nsublocale round_robin_base <\n scheduler_base\n final r convert_RA\n \"round_robin n0\" \"output\" \"pick_wakeup_via_sel (\\s P. ws_sel s (\\(k,v). P k v))\" round_robin_invar\n thr_\\ thr_invar thr_lookup thr_update\n ws_\\ ws_invar ws_lookup ws_update ws_delete ws_iterate\n is_\\ is_invar is_memb is_ins is_delete\n for n0 .\n\nsublocale round_robin <\n pick_wakeup_spec\n final r convert_RA\n \"pick_wakeup_via_sel (\\s P. ws_sel s (\\(k,v). P k v))\" round_robin_invar\n thr_\\ thr_invar\n ws_\\ ws_invar\n is_\\ is_invar\nby(rule pick_wakeup_spec_via_sel)(unfold_locales)\n\ncontext round_robin begin\n\nlemma round_robin_scheduler:\n assumes det: \"\\.deterministic I\"\n shows \n \"scheduler\n final r convert_RA\n (round_robin n0) (pick_wakeup_via_sel (\\s P. ws_sel s (\\(k,v). P k v))) round_robin_invar \n thr_\\ thr_invar thr_lookup thr_update \n ws_\\ ws_invar ws_lookup ws_update ws_delete ws_iterate\n is_\\ is_invar is_memb is_ins is_delete\n I\"\nproof -\n interpret scheduler_spec\n final r convert_RA\n \"round_robin n0\" round_robin_invar\n thr_\\ thr_invar\n ws_\\ ws_invar\n is_\\ is_invar\n I\n using det by(rule round_robin_scheduler_spec)\n\n show ?thesis by(unfold_locales)(rule \\.deterministic_invariant3p[OF det])\nqed\n\nend\n\nlemmas [code] =\n round_robin_base.queue_rotate1_def\n round_robin_base.enqueue_new_thread.simps\n round_robin_base.enqueue_new_threads_def\n round_robin_base.round_robin_update_state.simps\n round_robin_base.round_robin_reschedule.simps\n round_robin_base.round_robin.simps\n round_robin_base.round_robin_start_def\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Execute/Round_Robin.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.2606217981738243}} {"text": "(*<*)\n(*:maxLineLen=78:*)\ntheory RecursiveVDM\nimports VDMToolkit\nbegin\n(*>*)\n\n(*****************************************************************************)\nsection \\Introduction\\label{sec:Intro}\\\ntext \\This paper describes a translation strategy for a variety of recursive\ndefinitions from VDM to Isabelle/HOL. The strategy takes into account the\ndifferences in how termination and well-foundedness are represented in both\nformalisms.\n\nBeyond overcoming technical practicalities, which we discuss, a major\nobjective is to create translation strategy templates. These templates must\ncover a wide variety of VDM recursive definitions, as well as having their\nproof obligations being highly automated. The result is an extension to the\nVDM to Isabelle/HOL translation strategy and implementation as a plugin to\nVDMJ~@{cite Battle09} and extension to VDM-VSCode @{cite AdvancedVSCodePaper}.\n\nIsabelle uses literate programming, where formal specification, proofs and\ndocumentation are all within the same environment. We omit proof scripts\nbelow; the full VDM and Isabelle sources and proofs can be found at the VDM\ntoolkit repository at\n\\<^verbatim>\\./plugins/vdm2isa/src/main/resources/RecursiveVDM.*\\\\<^footnote>\\in~\\<^url>\\https://github.com/leouk/VDM_Toolkit\\\\.\n\nIn the next section, we present background on VDM and Isabelle recursion and\nmeasure relations. Section~\\ref{sec:VDMTypes} briefly discusses VDM basic\ntypes translation and their consequence for recursion. Next,\nSection~\\ref{sec:Recursion} describes how both VDM and Isabelle recursive\ndefinitions work and how they differ. Our translation strategy is then\npresented in Section~\\ref{sec:Strategy} for basic types, sets, maps, and\ncomplex recursive patterns. Finally, we conclude in\nSection~\\ref{sec:Conclusion}. \\\n\n(******************************************************************************)\nsection \\Background\\label{sec:Background}\\ \n\ntext \\Our VDM to Isabelle/HOL translator caters for a wide range of the VDM-SL\nAST. It copes with all kinds of expressions, a variety of patterns, almost all\ntypes, imports and exports, functions and specifications, traces, and some of\nstate and operations @{cite NimFull and AdvancedVSCodePaper}. Although not\nall VDM patterns are allowed, the translator copes with most, and\nwhere it does not, there is a corresponding equivalent.\n\nOne particular area we want to extend translation is over recursively defined\nfunctions. VDM requires the user to define a measure function to justify why\nrecursion terminates. It then generates proof obligations to ensure\ntotality and termination.\n\nFinally, our translation strategy follows the size-change termination (SCT)\nproof strategy described in @{cite SCT_POPL and SCNP_POPL}. In particular, its\nSCP (polynomial) and SCNP (non-polynomial) subclasses of recursive definitions\nwithin the SCT, which permits efficient termination checking. Effectively, if\nevery infinite computation would give rise to an infinitely decreasing value\nsequence (according to the size-change principle), then no infinite\ncomputation is possible. Termination problems in this class have a global\nranking function of a certain form, which can be found using SAT solving,\nhence increasing automation.\\\n(*\\<^bold>\\ANYTHING ELSE? Related work?\\*)\n\n(*****************************************************************************)\nsection \\VDM basic types in Isabelle\\label{sec:VDMTypes}\\\n\ntext \\Isabelle represents natural numbers (\\<^typ>\\\\\\) as a (data) type with\ntwo constructors (\\<^term>\\0::\\\\ and \\<^term>\\Suc n\\), where all numbers are\nprojections over such constructions (\\<^emph>\\e.g.\\~@{lemma \\2 = (Suc (Suc 0))\\ by\nsimp}). Isabelle integers (\\<^typ>\\\\\\) are defined as a quotient type\ninvolving two natural numbers. Isabelle quotient types are injections into a\nconstructively defined type. As with integers, other Isabelle numeric types\n(\\<^emph>\\e.g.,\\~rationals \\<^typ>\\\\\\, reals \\<^typ>\\\\\\, \\<^emph>\\etc\\.) are defined in\nterms of some involved natural number construction. Type conversions (or\ncoercions) are then defined to allow users to jump between type spaces.\nNevertheless, Isabelle has no implicit type widening rule for \\<^typ>\\\\\\;\ninstead, it takes conventions like @{lemma[show_types] \\(0 - x::\\) = 0\\ by\nsimp}. For expressions involving a mixutre of \\<^typ>\\\\\\ and \\<^typ>\\\\\\ typed\nterms, explicit user-defined type coercions might be needed\n(\\<^emph>\\e.g.,\\~@{lemma[show_types] \\(2::\\) - (3::\\) = -1\\ by simp}).\n \nVDM expressions with basic-typed (\\<^bold>\\nat\\, \\<^bold>\\int\\) variables have specific\ntype widening rules. For example, even if both variables are \\<^bold>\\nat\\, the\nresult might be \\<^bold>\\int\\. (\\<^emph>\\e.g.,\\~in VDM, \\<^verbatim>\\0 - x:nat = -x:int\\). Therefore,\nour translation strategy considers VDM \\<^bold>\\nat\\ as the Isabelle type\n\\<^typ>\\VDMNat\\, which is just a type synonym for \\<^typ>\\\\\\. This simplifies\nthe translation process to Isabelle, such that no type coercions are\nnecessary to encode all VDM type widenning rules. On the other hand, this\ndesign decision on type widening means encoding of recursive functions over\n\\<^bold>\\nat\\ to have to follow the scheme for \\<^typ>\\\\\\, given VDM's \\<^bold>\\nat\\ is \nrepresented as Isabelle's \\<^typ>\\\\\\.\n\n Despite this design decision over basic types and their consequences,\n recursion over VDM \\<^bold>\\int\\, sets or maps will still be involved. That is\n because these types are not constructively defined in Isabelle.\\\n\n(*****************************************************************************)\nsection \\Recursion in VDM and in Isabelle\\label{sec:Recursion}\\\n\ntext \\An important aspect of every recursive definition is an argument that\njustifies its termination. Otherwise, the recursion might go into an infinite\nloop. In VDM, this is defined using a recursive measure:~it has the same input\ntype signature as the recursive definition, and returns a \\<^bold>\\nat\\, which\n\\<^bold>\\must\\ monotonically decrease at each recursive call, eventually reaching\nzero. This is how termination of recursive definitions are justified in VDM. A\nsimple example of a VDM recursive definition is one for calculating the\nfactorial of a given natural number\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n fact: nat -> nat \n fact(n) == if n = 0 then 1 else n * fact(n - 1) measure n; \n\\end{vdmsl} \n%\n% -- For the measure below, VDMJ produces a measure function as: \n% -- measure_fact: nat -> nat\n% -- measure_fact(n) == n\n\\noindent The VDM \\<^verbatim>\\fact\\-function recursive measure uses the given \\<^verbatim>\\n\\ input itself as its\nresult. This works because the only recursive call is made with a decreasing\nvalue of \\<^verbatim>\\n\\, until it reaches the base case \\<^verbatim>\\0\\ and terminates. VDMJ generates three\nproof obligations for the definition above. They are trivial to discharge in\nIsabelle given the measure definition expanded is just \n@{lemma \\(\\ n::\\ . \\ n = 0 \\ n - 1 \\ 0)\\ by simp} and \n@{lemma \\(\\ n::\\ . \\ n = 0 \\ n > n - 1)\\ by simp}.\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n Proof Obligation 1: (Unproved) fact; measure_fact: total function obligation \n (forall n:nat & is_(measure_fact(n), nat))\n \n Proof Obligation 2: (Unproved) fact: subtype obligation \n (forall n:nat & (not (n = 0) => (n - 1) >= 0))\n \n Proof Obligation 3: (Unproved) fact: recursive function obligation \n (forall n:nat & (not (n=0) => measure_fact(n) > measure_fact((n-1))))\n\\end{vdmsl} \n%\n%Remove?\nMoreover, even though measures over recursive type structures are impossible\nto define in VDM, they are easily described in Isabelle. For example, it is\nnot possible to write a measure in VDM over a recursive record defining a\nlinked list, such as \\<^verbatim>\\R :: v: nat n: R\\. This is automatically generated for\nour representation of VDM records in Isabelle as a datatype. Other complex\nrecursive patterns are hard/impossible to represent in VDM (see\nSection~\\ref{subsec:Complex}).\n \nIn Isabelle, recursive definitions can be provided through primitive recursion\nover inputs that are constructively defined, or more general function\ndefinitions that produce proof obligations. The former insists on definition\nfor each type constructor and only provides simplification rules; whereas the\nlatter allows for more sophisticated input patterns and provides\nsimplification, elimination and induction rules, as well as partial function\nconsiderations. For the purposes of this paper, we only consider function\ndefinitions. Readers can find more about these differences in~@{cite\nIsaFunctionPackage}.\n\nIsabelle's recursive functions require a proof obligation that its parameters\nrepresent a constructive and compatible pattern, and that recursive calls\nterminate. Constructive patterns covers all constructors in the data type\nbeing used in the recursion inputs (\\<^emph>\\i.e.,\\~one equation for each of the\nconstructors of \\<^typ>\\\\\\, hence one involving \\<^term>\\0::\\\\ and another\ninvolving \\<^term>\\Suc n\\). Compatible patterns cover the multiple ways\npatterns can be constructed will boil down to the pattern completeness cases\n(\\<^emph>\\e.g.,\\~\\<^term>\\n + 2::\\\\ being simply multiple calls over defined\nconstructors like \\<^term>\\Suc (Suc n)\\). This is important to ensure that\nrecursion is well structured (\\<^emph>\\i.e.,\\~recursive calls will not get stuck\nbecause some constructs are not available). For example, if you miss the\n\\<^term>\\0::\\\\ case, eventually the \\<^term>\\Suc n\\ case will reach zero and\nfail, as no patterns for zero exist. The proof obligation for termination\nestablishes that the recursion is well-founded. This has to be proved whenever\nproperties of the defined function are meant to be total.\n\nIsabelle's function definitions can be given with either \\<^term>\\fun\\ or\n\\<^term>\\function\\ syntax. The former attempts to automatically prove the\npattern constructive and compatible proofs and finds a measure for the\ntermination proof obligation. The latter requires the user to do these proofs\nmanually by providing a measure relation. It is better suited for cases where\n\\<^term>\\fun\\ declarations fail, which usually involve complex or ill-defined\nrecursion.\n\nThe termination relation must be well-founded, which means have a well-ordered\ninduction principle over a partially ordered relation defined as\\<^footnote>\\Details on \nwell-ordered induction are in Isabelle's \\<^verbatim>\\Wellfounded.thy\\ theory.\\ \n@{thm[display,show_types] wf_def} A version of the factorial definition that\nIsabelle discovers all three termination and well-formedness proofs is given as\\\n(* find_theorems name:wellorder print_locale! wellorder *)\nfun fact' :: \\\\ \\ \\\\ where \\fact' n = (if n = 0 then 1 else n * (fact' (n - 1)))\\ \n\ntext \\This definition is quite similar in VDM. Nevertheless, VDM basic types\nwidening rules necessitate we translate them to \\<^typ>\\VDMNat\\. The same\nversion of \\<^term>\\fact\\ defined for \\<^typ>\\\\\\ will fail with the error that\n``\\<^emph>\\Could not find lexicographic termination order\\''. That is, Isabelle\nmanages to discharge the pattern proofs, but not the termination one. This is\nbecause the user must provide a projection relation from the \\<^typ>\\\\\\\nquotient type back into the constructive type \\<^typ>\\\\\\.\n\nEven if we could avoid this translation technicality, the same problem would\noccur for recursion over non-constructive types, such as sets or maps. They\nrequire recursion over finite sets, which are defined inductively. The only\neasy recursive translations are those involving lists, given lists in Isabelle\nare defined constructively and VDM sequences map directly.\n\nTherefore, defining recursive functions over non-constructive types entail\ncompatibility and completeness proofs. They also lead to partial function\ndefinitions, given Isabelle cannot tell whether termination is immediately\nobvious. In VDM, however, recursive functions on sets (as well as map domains)\nare common, hence the need for extending our translation strategy.\\\n\n(******************************************************************************)\nsection \\VDM recursion translation strategy\\label{sec:Strategy}\\\n\ntext \\We want to identify a translation strategy that will cater for \nissues described above not only for basic types, but also for sets, sequences,\nmaps, as well as mutual recursion.\n\nThe VDM-SL AST tags all recursive functions, even those without an explicit\nmeasure. All such functions will be translated using Isabelle's \\<^term>\\fun\\\nsyntax, which will attempt to discover proofs for compatibility and\ntermination. For our setup of the \\<^verbatim>\\fact\\ example, where Isabelle discovers the\ntermination proof.\\\n\n(*<*)\ndefinition pre_fact'' :: \\VDMNat \\ \\\\ where [simp]:\\pre_fact'' n \\ inv_VDMNat n\\\nfun fact'' :: \\VDMNat \\ VDMNat\\ where \n\\fact'' n = (if pre_fact'' n then (if n = 0 then 1 else n * (fact'' (n - 1))) else undefined)\\\n(*>*)\n\ntext \\ If that had failed, the user could define a VDM \\<^verbatim>\\@IsaMeasure\\\nannotation. VDM annotations are comments that will be processed according to\nspecific implementations @{cite VDMJAnnotations and AdvancedVSCodePaper}. If\nthe user does not provide an \\<^verbatim>\\@IsaMeasure\\ annotation and \\<^term>\\fun\\\nfails, then it is up to the user to figure out the necessary proof setup.\n\nThe \\<^verbatim>\\@IsaMeasure\\ annotation defines a well-founded measure relation that\nwill participate in the setup for Isabelle termination proof. For example, for\nthe \\<^verbatim>\\fact\\ example, the user would have to write an annotation before the VDM\nmeasure.\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n --@IsaMeasure( { (n -1, n) | n : nat & n <> 0 } )\n\\end{vdmsl}\n\\noindent This measure relation corresponds to the relationship between the\nrecursive call (\\<^verbatim>\\fact(n-1)\\) and its defining equation (\\<^verbatim>\\fact(n)\\), where\nthe filtering condition determines which values of \\<^verbatim>\\n\\ the relation should \nrefer to. More interesting measure relations are defined in\nSection~\\ref{subsec:Complex}.\n\nDuring translation, the \\<^verbatim>\\vdm2isa\\ plugin will typecheck the \\<^verbatim>\\@IsaMeasure\\ annotation\n(\\<^emph>\\i.e.,\\~it is a type correct relation over the function signature). Next, it\nwill translate the annotation and some automation lemmas as a series of\nIsabelle definitions to be used during the proof of termination of translated\nVDM recursive functions. If no annotation is provided, following similar\nprinciples from Isabelle, then the plugin will try to automatically infer what\nthe measure relation should be based on the structure of the recursive\nfunction definition. If this fails, then the user is informed. Still, even\nif measure-relation synthesis succeeds, the user still has to appropriately\nuse it during Isabelle's termination proof.\n\nIn what follows, we will detail the translation strategy for each relevant VDM\ntype. For details of the overall translation strategy, see examples in the\ndistribution\\<^footnote>\\\\<^url>\\https://github.com/leouk/VDM_Toolkit\\\\ and~@{cite NimFull}.\nThe translation strategy imposes various implicit VDM checks as explicit predicates. \nFor example, VDM sets are always finite, and type invariants over set, sequence\nand map elements must hold for every element.\\\n\n(*----------------------------------------------------------------------------*)\nsubsection \\Recursion over VDM basic types (\\<^bold>\\nat\\, \\<^bold>\\int\\)\\label{subsec:VDMNat}\\\n\ntext \\Following the general translation strategy~@{cite NimFull}, we first\nencode the implicit precondition, which insists that\nthe given parameter \\<^term>\\n\\ is a \\<^typ>\\VDMNat\\, alongside a list of\ndefining constants that are useful for proof strategy synthesis.\\\n(* COMMENT: make pre_XXX a simplification rule for fun declarations! *)\n\ndefinition pre_fact :: \\VDMNat \\ \\\\ where \\pre_fact n \\ inv_VDMNat n\\\nlemmas pre_fact_defs = pre_fact_def \n\ntext \\Next, we define factorial recursively. When the precondition fails, we\nreturn \\<^term>\\undefined\\, which is a term that cannot be reasoned with in\nIsabelle The \\<^term>\\domintros\\ tag tells Isabelle to generate domain\npredicates, in case this function is not total. Domain predicates are\nimportant to our strategy because every VDM function will be undefined, when\napplied outside its precondition. It also generates domain-predicate sensitive\nproof rules listed below.\\\nfunction (domintros) fact :: \\VDMNat \\ VDMNat\\ where\n\\fact n = (if pre_fact n then (if n = 0 then 1 else n * (fact (n - 1))) else undefined)\\\n\ntext \\The proof obligations for pattern compatibility and completeness are\ndischarged with the usual Isabelle proof strategy for simple recursive\npatterns with the @{method pat_completeness} method. In the general case\ndiscussed in Section~\\ref{subsec:Complex}, the user might have goals to\ndischarge. Isabelle proves various theorems abou case analysis and\n(partial) rules for elimination, induction and simplification.\\\n by (pat_completeness, auto) \\<^marker>\\tag invisible\\\n \ntext \\Partial rules require the domain predicate @{term fact_dom} as an assumption.\nIt represents a well-founded relation that ensures termination. That is, if\nthe user does not want (or knows how) to prove termination, such domain\npredicates will follow every application of definitions,\nhence documenting the requirement that such well-founded relation is still\nmissing.\n\nIf/when the termination proof is discharged, these p-rules can be simplified\ninto total rules that do not depend on a domain predicate, given a\nwell-founded relation has been provided. Domain predicates will complicate\nuser proofs, and also make proof strategy synthesis harder to automate.\n\nTermination proof is discharged by establishing a well-founded relation\nassociated with the function recursive call(s) with respect to its\ndeclaration. The \\<^verbatim>\\@IsaMeasure\\ annotation is translated as an\nIsabelle abbreviation. The filter that the function\nprecondition holds:~this is important to ensure the termination proof never\nreaches the \\<^term>\\undefined\\ case. The other filter comes from the negated\ntest from the if-statement. More complex definitions will have more\ninvolved filters. We use abbreviation instead of definition to avoid needing\nto expand the defined term in proofs.\\\n\nabbreviation fact_wf :: \\(VDMNat \\ VDMNat) set\\ where\n \\fact_wf \\ { (n - 1, n) | n . pre_fact n \\ n \\ 0 }\\\n\ntext \\Given \\<^verbatim>\\fact\\ definition is simple (non-mutual, single call-site, easy\nmeasure relation choice) recursion, its setup is easy to\nestablish well-foundedness. For recursions of this nature, we can piggyback on\nIsabelle machinery to prove well foundedness by using terms\n@{term gen_VDMNat_term} and @{term int_ge_less_than}.\n\nThe first term is defined in terms of the second, which is a subset of our\nwell-founded relation \\<^term>\\fact_wf\\. Isabelle has proofs about the \nwell foundedness of \\<^term>\\int_ge_less_than\\. Thus, making the proof our\nterm being well-founded trivial for @{command sledgehammer}. \nAs part of the translation strategy, we define\n(and attempt to discover the proof of) the following lemma. This follows\nthe strategy described in~@{cite KrausSCNP}.\\\nlemma l_fact_term_wf: \\wf (gen_VDMNat_term fact_wf)\\\n by (simp add: wf_int_ge_less_than wf_Int1) \\<^marker>\\tag invisible\\\n\ntext \\Finally, we prove termination using the previously proved lemma using\nthe @{method relation}. This simplifies the goal into well-foundedness of\ntermination relation and that the precondition implies it, both of which are\neasily proved with simplification in this case.\\\ntermination \\<^marker>\\tag invisible\\\n apply (relation \\(gen_VDMNat_term fact_wf)\\) \\<^marker>\\tag invisible\\\ntext \\This transforms the abstract domain predicate into two new subgoals as\n@{subgoals[display]}\\\n using l_fact_term_wf apply presburger \\<^marker>\\tag invisible\\\n by (simp add: pre_fact_defs int_ge_less_than_def) \\<^marker>\\tag invisible\\\n\ntext \\For this example, subgoals are proved with @{command\nsledgehammer}. In general, the user will have to either find the proof, or\ndeal with domain predicates involving the recursive call. After the\ntermination proof is discharged, Isabelle provides versions of rules for\nelimination, induction and simplification that are total and do not depend on\nthe domain predicates. \n\nTo make sure our choice does not lead to the empty relation, we ensure that\nthe termination relation is in fact the same as the well founded\npredicate by proving the next goal. This is something users might want to do,\nbut is not part of the translation strategy. In case the measure relation is\nempty, the recursive call simplification rules will not be useful anyhow.\\\n\nlemma l_fact_term_valid: \\(gen_VDMNat_term fact_wf) = fact_wf\\\n apply (simp ) \\<^marker>\\tag invisible\\\n apply (intro equalityI subsetI)\\<^marker>\\tag invisible\\\n apply (simp_all add: pre_fact_defs int_ge_less_than_def case_prod_beta)\\<^marker>\\tag invisible\\\n by auto\\<^marker>\\tag invisible\\\n\n(*---------------------------------------------------------------------------*)\nsubsection \\Recursion over VDM sets\\label{subsec:VDMSet}\\\n\ntext \\Next, we extend the translation strategy for VDM sets.\nFor this, we use a function that sums the elements of a set.\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n sumset: set of nat -> nat \n sumset(s) == if s = {} then 0 else let e in set s in sumset(s - {e}) + e\n --@IsaMeasure({(x - { let e in set x in e }, x) | x : set of nat & x <> {}}) \n --@Witness(sumset({ 1 }))\n measure card s;\n\\end{vdmsl}\n%\n\\noindent Most common VDM-recursion over sets consume the\nset by picking an arbitrary set element and then continue the recursion without\nthe element picked, until the set is empty. The VDM measure states that the\nrecursion is based on the cardinality of the input parameter. VDM measures are\nnot suitable for Isabelle proofs, given Isabelle requires a relation;~hence,\nVDM measures are mostly ignored. They might still be useful during\nproofs as potential witnesses to existentially-quantified goals.\n\nThe implicit VDM checks are defined as the precondition, which\nensures that the given set only contains natural numbers and is finite, as\ndefined by \\<^term>\\inv_VDMSet'\\.\\\n\ndefinition pre_sumset :: \\VDMNat VDMSet \\ \\\\ where\n \\pre_sumset s \\ inv_VDMSet' inv_VDMNat s\\\nlemmas pre_sumset_defs = pre_sumset_def inv_VDMSet'_defs \n\ntext \\We define the VDM recursive function in Isabelle next. It checks whether\nthe given set satisfies the function precondition, returning \\<^term>\\undefined\\\nif not. Each case is encoded pretty much 1-1 from VDM after that. The\ntranslation strategy for VDM \\<^verbatim>\\let-in-set\\ patterns uses Isabelle's Hilbert's\nchoice operator (\\<^term>\\\\ x . x \\ s\\). Note this naturally extends to VDM's\n\\<^verbatim>\\let-be-st\\ patterns as well.\\\nfunction (domintros) sumset :: \\VDMNat VDMSet \\ VDMNat\\ where \n \\sumset s = (if pre_sumset s then \n (if s = {} then 0 else let e = (\\ x . x \\ s) in sumset (s - {e}) + e) \n else undefined)\\\n by (pat_completeness, auto) \\<^marker>\\tag invisible\\\n\ntext \\The pattern completeness and compatibility goals are trivial.\nThe measure relation defined with \\<^verbatim>\\@IsaMeasure\\ is next.\nIt is defined as the smaller set after picking \\<^term>\\e\\ and the set used \nat the entry call, leading to the pairs \\<^term>\\(s - {(\\ e . e \\ s)}, s)\\. \nFinally, we ensure all the relation elements satisfy the function precondition\nand that the if-test is negated. \\\nabbreviation sumset_wf_rel :: \\(VDMNat VDMSet \\ VDMNat VDMSet) set\\ where\n \\sumset_wf_rel \\ { (s - {(\\ e . e \\ s)}, s)| s . pre_sumset s \\ s \\ {}}\\\n\ntext \\Given this is a simple recursion, again we can piggyback on Isabelle \nmachinery by using the terms @{term gen_set_term} and @{term finite_psubset}.\nThey establishes that a relation where the first element is strictly smaller\nset than the second in the relation pair is well-founded. This makes\nthe proof of well-foundedness easy for @{command sledgehammer}.\\\n\nlemma l_sumset_rel_wf: \\wf (gen_set_term sumset_wf_rel)\\\n using l_gen_set_term_wf \\<^marker>\\tag invisible\\\n by blast \\<^marker>\\tag invisible\\\n\ntext \\Next, we tackle the termination proof, with the same setup with @{method\nrelation} again.\\\ntermination\\<^marker>\\tag invisible\\\n apply (relation \\(gen_set_term sumset_wf_rel)\\)\\<^marker>\\tag invisible\\\n using l_sumset_rel_wf \\<^marker>\\tag invisible\\ \n apply force\\<^marker>\\tag invisible\\\n text \\Unfortunately, using @{command sledgehammer} fails to discharge the\n second subgoal @{subgoals[display]}\\\n oops\\<^marker>\\tag invisible\\\n\ntext \\Fortunately, for most simple situations, this is easy to decompose in\ngeneral. The translation strategy takes the \\<^verbatim>\\@IsaMeasure\\ expression and\ndecomposes its parts, such that the filtering predicates are assumptions, and\nthe element in the relation belongs to the well-founded measure chosen. This \nis defined in the next lemma, which require some manual intervention until \nIsabelle's @{command sledgehammer} can finish the proof.\\\nlemma l_pre_sumset_sumset_wf_rel: \n \\pre_sumset s \\ s \\ {} \\ (s - {(\\ x. x \\ s)}, s) \\ (gen_set_term sumset_wf_rel)\\\n unfolding gen_set_term_def \\<^marker>\\tag invisible\\\n apply (simp add: pre_sumset_defs)\\<^marker>\\tag invisible\\\n by (metis Diff_subset member_remove psubsetI remove_def some_in_eq)\\<^marker>\\tag invisible\\\n\ntext \\The intuition behind this lemma is that elements in the measure\nrelation satisfy well-foundedness under the function precondition and the\nfiltering case (\\<^term>\\s \\ {}\\) where the recursive call is made. That is,\nthe precondition and filtering condition help establish the terminating\nrelation. For this particular proof, the only aspect needed from the\nprecondition is that the set is finite.\nWith this, we try the termination proof and @{command\nsledgehammer} find proofs for all subgoals.\\\ntermination\\<^marker>\\tag invisible\\\n apply (relation \\(gen_set_term sumset_wf_rel)\\)\\<^marker>\\tag invisible\\\n using l_sumset_rel_wf apply force\\<^marker>\\tag invisible\\\n using l_pre_sumset_sumset_wf_rel by presburger\\<^marker>\\tag invisible\\\n(*<*)\nlemma l_pre_fact_wf_rel': \\pre_fact n \\ n \\ 0 \\ (n - 1, n) \\ gen_VDMNat_term fact_wf\\\n unfolding gen_VDMNat_term_def gen_VDMInt_term_def\n using l_fact_term_valid by force\n(*>*)\n\ntext \\Note we omit such lemma over termination and precondition for the\n\\<^typ>\\VDMNat\\ case in Section~\\ref{subsec:VDMNat}. The translation strategy\ndoes define it following the same recipe, where @{command sledgehammer} \nfind the proof once more.\\\nlemma l_pre_fact_wf_rel: \n \\\\pre_fact n; n \\ 0\\ \\ (n - 1, n) \\ gen_VDMNat_term fact_wf\\\n unfolding gen_VDMNat_term_def gen_VDMInt_term_def \\<^marker>\\tag invisible\\\n using l_less_than_VDMNat_subset_int_ge_less_than pre_fact_def \\<^marker>\\tag invisible\\\n by auto \\<^marker>\\tag invisible\\\n\n(*<*)\nlemma l_sumset_wf_rel_valid: \\gen_set_term sumset_wf_rel = sumset_wf_rel\\\n apply (intro equalityI subsetI, simp) \\<^marker>\\tag invisible\\\n using l_pre_sumset_sumset_wf_rel by blast \\<^marker>\\tag invisible\\\n(*>*)\n\ntext \\Finally, even though this was not necessary for this proof, we encourage\nusers to always provide a witness for the top recursive call. This is done by\nusing the \\<^verbatim>\\@Witness\\ annotation~@{cite AdvancedVSCodePaper}:~it provides a \nconcrete example for the function input parameters. This witness is useful \nfor existentially quantified predicates of involved termination \nproofs (see Section~\\ref{subsec:Complex}).\\\n\n(*---------------------------------------------------------------------------*)\nsubsection \\Recursion over VDM maps\\label{subsec:VDMMap}\\\n\ntext \\Recursive functions over maps are a special case of sets, given\nmap recursion usually iterates over the map's domain. For example, the\nfunction that sums the elements of the map's range is defined as\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n sum_elems: map nat to nat -> nat\n sum_elems(m) == \n if m = {|->} then 0 else let d in set dom m in m(d) + sum_elems({d}<-:m)\n --@IsaMeasure({({d} <-: m, m) | m : map nat to nat, d: nat & \n m <> {} and d in set dom m})\n --@Witness( sum_elems({ 1 |-> 1 }) )\n measure card dom m;\n\\end{vdmsl}\n%\n\\noindent As with sets, it iterates over the map by picking a domain element,\nperforming the necessary computation, and then recursing on the map filtered by\nremoving the chosen element, until the map is empty and the function\nterminates. The measure relation follows the same\npattern:~recursive call site related with defining site, where both the\nif-test and the \\<^verbatim>\\let-in-set\\ choice is part of the filtering predicate.\n\nFollowing the general translation strategy for maps~@{cite NimFull}, we define\nthe function precondition using \\<^term>\\inv_Map\\. It insists that both the map\ndomain and range are finite, and that all domain and range elements satisfy\ntheir corresponding type invariant. Note that, if the recursion was defined\nover sets other than the domain and range, then Isabelle requires a proof that\nsuch set is finite. Given both domain and range sets are finite,\nthis should be easy, if needed.\\\n\ndefinition pre_sum_elems :: \\(VDMNat \\ VDMNat) \\ \\\\ where\n \\pre_sum_elems m \\ inv_VDMMap inv_VDMNat inv_VDMNat m\\\nlemmas pre_sum_elems_defs = pre_sum_elems_def inv_VDMMap_defs \n\ntext \\VDM maps in Isabelle (\\<^typ>\\(VDMNat \\ VDMNat)\\) are defined as a HOL\nfunction which maps to an optional result. That is, if the element is in the\ndomain, then the map results in a non {\\texttt{\\<^bold>\\nil\\}} value; whereas, if the\nelement does not belong to the domain, then the map results in a {\\texttt{\\<^bold>\\nil\\}}\nvalue. This makes all maps total, where values outside the domain\nmap to {\\texttt{\\<^bold>\\nil\\}}. The Isabelle translation and compatibility proof\nfollows patterns used before.\\\nfunction (domintros) sum_elems :: \\(VDMNat \\ VDMNat) \\ VDMNat\\ where\n \\sum_elems m = \n (if pre_sum_elems m then\n if m = Map.empty then 0 else\n let d = (\\ e . e \\ dom m) in the(m d) + (sum_elems ({d} -\\ m))\n else undefined)\\\n by (pat_completeness, auto) \\<^marker>\\tag invisible\\\n\ntext \\Similarly, the well-founded relation is translated\nnext, where the precondition is included as part of the relation's\nfilter. The \\<^term>\\{d}-\\m\\ corresponds to the VDM domain anti-filtering operator\n\\<^verbatim>\\{d}<-:m\\.\\\nabbreviation \n sum_elems_wf :: \\((VDMNat \\ VDMNat) \\ (VDMNat \\ VDMNat)) VDMSet\\ \n where \\sum_elems_wf \\ \n { (({d} -\\ m), m) | m d . pre_sum_elems m \\ m \\ Map.empty \\ d \\ dom m }\\\n\ntext \\For the well-founded lemma over the recursive measure relation, there is\nno available Isabelle help, and projecting the domain element of the maps\nwithin the relation is awkward. Thus, we have to prove the well-founded lemma \nand this will not be automatic in general. This is one difference in terms of\ntranslation of VDM recursive functions over sets and maps.\n\nFortunately, the proof strategy for such situations is somewhat known:~it\nfollows a similar strategy to the proof of well foundedness of the\n\\<^term>\\finite_psubset\\. It uses the provided VDM measure expression to extract \nthe right projection of interest, then follows the proof for\n \\<^term>\\finite_psubset\\, where @{command sledgehammer} can \nfind the final steps.\n\nThe precondition subgoal and the termination proof follow the same\npatterns as before. Their proof was discovered with @{command\nsledgehammer}, yet this will not be the case in general.\\\nlemma l_sum_elems_wf: \\wf sum_elems_wf\\\n apply (rule wf_measure[of \\\\ m . card (dom m)\\, THEN wf_subset]) \\<^marker>\\tag invisible\\\n apply (simp add: measure_def inv_image_def less_than_def less_eq)\\<^marker>\\tag invisible\\\n apply (rule subsetI, simp add: case_prod_beta)\\<^marker>\\tag invisible\\\n apply (elim exE conjE)\\<^marker>\\tag invisible\\\n by (simp add: l_VDMMap_filtering_card pre_sum_elems_defs)\\<^marker>\\tag invisible\\\n\nlemma l_pre_sum_elems_sum_elems_wf: \n \\\\pre_sum_elems m; m \\ Map.empty\\ \\ \n ({(\\ e. e \\ dom m)} -\\ m, m) \\ sum_elems_wf\\\n apply (simp add: pre_sum_elems_defs) \\<^marker>\\tag invisible\\\n by (metis domIff empty_iff some_in_eq) \\<^marker>\\tag invisible\\\n\ntermination \\<^marker>\\tag invisible\\\n apply (relation sum_elems_wf)\\<^marker>\\tag invisible\\\n(* apply (rule \\termination\\[OF l_sum_elems_wf])\\<^marker>\\tag invisible\\ *)\n apply (simp add: l_sum_elems_wf)\\<^marker>\\tag invisible\\\n using l_pre_sum_elems_sum_elems_wf by presburger\\<^marker>\\tag invisible\\\n\nlemma l_sum_elems_wf_valid: \\sum_elems_wf \\ {}\\\n apply safe \\<^marker>\\tag invisible\\\n apply (erule equalityE)\\<^marker>\\tag invisible\\\n apply (simp add: subset_eq)\\<^marker>\\tag invisible\\\n apply (erule_tac x=\\[1 \\ 1]\\ in allE)\\<^marker>\\tag invisible\\\n by (simp add: pre_sum_elems_defs) \\<^marker>\\tag invisible\\\n\ntext \\Finally, we also prove that the well founded termination relation\nis not empty, as we did for sets and \\<^bold>\\nat\\\nrecursion. Note that here the \\<^verbatim>\\@Witness\\ annotation is useful in discharging\nthe actual value to use as the witness demonstrating the relation is not\nempty.\\\n\n(*---------------------------------------------------------------------------*)\nsubsection \\VDM recursion involving complex measures\\label{subsec:Complex}\\\n\ntext \\The class of recursive examples shown so far have covered a wide range of\nsituations, and have a good level of automation. Nevertheless, the same\nstrategy can also be applied for more complex recursive definitions. The cost\nfor the VDM user is the need of involved \\<^verbatim>\\@IsaMeasure\\ definitions and\nthe highly likely need for extra user-defined lemmas. These lemmas can be\ndefined in VDM itself using the \\<^verbatim>\\@Lemma\\ annotation.\nTo illustrate this, we define in VDM the (in)famous Ackermann\nfunction\\<^footnote>\\\\<^url>\\https://en.wikipedia.org/wiki/Ackermann_function\\\\, which is a\nstaple example of complex recursion.\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n ack: nat * nat -> nat \n ack(m,n) == if m = 0 then n+1\n else if n = 0 then ack(m-1, 1)\n else ack(m-1, ack(m, (n-1)))\n --@IsaMeasure( pair_less_VDMNat )\n --@Witness( ack(2, 1) )\n measure is not yet specified;\n\\end{vdmsl}\n%\n\\noindent Note that the VDM measure is not defined, and that the\n\\<^verbatim>\\@IsaMeasure\\ uses a construct from Isabelle called \\<^term>\\pair_less\\. It\nis part of Isabelle's machinery of concrete orders for SCNP problems @{cite\nKrausSCNP}. It considers recursions over multiple parameters, where some might\nincrease the number of calls (\\<^emph>\\e.g.\\~size-change). We are not aware of a\nmechanism to define such measures in VDM.\n\nWe instantiate \\<^term>\\pair_less\\ to \\<^typ>\\VDMNat\\ as the\nlexicographic product over the transitive closure of a totally ordered\nrelation between inputs\\<^footnote>\\Details of this definition are in the\n\\<^verbatim>\\VDMToolkit.thy\\ within the distribution.\\.\nIf VDM measures were over relations, then the Ackermann measure could be defined\nin VDM, assuming a standard definition of transitive closure\\<^footnote>\\The\n\\<^verbatim>\\Relations.vdmsl\\ provides such definition in the VDM toolkit distribution.\\.\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\npair_less_VDMNat: () -> set of ((nat*nat) * (nat*nat))\npair_less_VDMNat() == lex_prod[nat, nat](less_than_VDMNat(), less_than_VDMNat());\n\nless_than_VDMNat: () -> set of (nat*nat)\nless_than_VDMNat() == trans_closure[nat]({ mk_(z', z) | z', z : nat & z' < z });\n\nlex_prod[@A,@B]: set of (@A*@A) * set of (@B*@B) -> set of ((@A*@B) * (@A*@B))\nlex_prod(ra,rb) == { mk_(mk_(a, b), mk_(a', b')) | a, a': @A, b, b': @B & \n mk_(a,a') in set ra or a = a' and mk_(b, b') in set rb };\n\\end{vdmsl}\n%\nThat represents the lexicographic product of possibilities that are ordered in \nits parameters. Translation then outputs:\\\n\ndefinition pre_ack :: \\VDMNat \\ VDMNat \\ \\\\ where\n \\pre_ack m n \\ inv_VDMNat m \\ inv_VDMNat n\\\nlemmas pre_ack_defs = pre_ack_def \n\nfunction (domintros) ack :: \\VDMNat \\ VDMNat \\ VDMNat\\ where\n \\ack m n = (if pre_ack m n then\n if m = 0 then n+1\n else if n = 0 then ack (m-1) 1\n else ack (m-1) (ack m (n-1))\n else undefined)\\\n by (pat_completeness, auto) \\<^marker>\\tag invisible\\\n\nabbreviation ack_wf :: \\((VDMNat \\ VDMNat) \\ (VDMNat \\ VDMNat)) VDMSet\\ \n where \\ack_wf \\ pair_less_VDMNat\\\n\ntermination \\<^marker>\\tag invisible\\\n apply (relation ack_wf)\\<^marker>\\tag invisible\\\n using wf_pair_less_VDMNat \\<^marker>\\tag invisible\\ apply blast \\<^marker>\\tag invisible\\\n apply (simp add: l_pair_less_VDMNat_I1 pre_ack_def) \\<^marker>\\tag invisible\\\n apply (simp add: pre_ack_def) \\<^marker>\\tag invisible\\\n by (simp add: pair_less_VDMNat_def pre_ack_def) \\<^marker>\\tag invisible\\\n\ntext \\Compatibility and termination proofs are similar, despite the more \ncomplex measure, because of available Isabelle automation. We also show that \nthis version of Ackermann with \\<^typ>\\VDMNat\\ is equivalent to the usual Isabelle \ndefinition using \\<^typ>\\\\\\. We omit details here, but have proved that they are \nequivalent by induction.\\\n(*<*)\nfun ack' :: \\\\ \\ \\ \\ \\\\ where\n \\ack' 0 n = Suc n\\\n| \\ack' (Suc m) 0 = ack' m 1\\\n| \\ack' (Suc m) (Suc n) = ack' m (ack' (Suc m) n)\\\n\nfun ack'' :: \\\\ \\ \\ \\ \\\\ where\n \\ack'' m n = (if m = 0 then Suc n else if n = 0 then \n ack'' (m - 1) 1 else ack'' (m-1) (ack'' m (n -1)))\\\nlemma l_ack''_1[simp]: \\ack'' 0 n = Suc n\\ by simp\nlemma l_ack''_2[simp]: \\ack'' (Suc m) 0 = ack'' m 1\\ by simp\nlemma l_ack''_3[simp]: \\ack'' (Suc m) (Suc n) = ack'' m (ack'' (Suc m) n)\\ by simp\n\nfunction ack''' :: \\\\ \\ \\ \\ \\\\ where\n \\ack''' 0 n = Suc n\\\n| \\ack''' (Suc m) 0 = ack''' m 1\\\n| \\ack''' (Suc m) (Suc n) = ack''' m (ack''' (Suc m) n)\\\n by (pat_completeness, auto) \ntermination \n text \\Through the sledgehammer version, I unpicked the various bits and\n pieces needed.\\\n(*\n using \\termination\\ lessI pair_lessI1 pair_less_iff1 wf_pair_less by presburger\n*)\n thm lessI pair_lessI1 pair_less_def pair_less_iff1 wf_pair_less\n apply (relation pair_less)\n apply (simp)\n using lessI pair_lessI1 apply presburger\n using lessI pair_less_iff1 apply presburger\n using lessI pair_lessI1 by presburger\n(*>*)\n\ntheorem ack_correct: \\ack' m n = ack m n\\\n apply (induction \\m\\ \\n\\ rule: ack'.induct) by (simp add: pre_ack_defs)+\n\ntext \\In general, each complex recursive function will require such a setup.\nFortunately, Isabelle has a number of options available. Yet, in general, the\nmore complex the recursion, the more users will have to provide further\nautomation.\\\n\n(*---------------------------------------------------------------------------*)\nsubsection \\Harder examples\\label{subsec:Hard}\\\n\n(*<*)\n\ntext \\Other examples from @{cite SCT_POPL}. Example 3 is Ackermann, example 4\nis permutation. Example 5 are yet to be finished.\\\n\nfun sct1_rev :: \\'a list \\ 'a list\\\nand sct1_r1 :: \\'a list \\ 'a list \\ 'a list\\ \nwhere\n \\sct1_rev ls = sct1_r1 ls []\\\n| \\sct1_r1 ls a = (if ls = [] then a else sct1_r1 (tl ls) ((hd ls)#a))\\\n\nfun sct2_f :: \\'a list \\ 'a list \\ 'a list\\\nand sct2_g :: \\'a list \\ 'a list \\ 'a list \\ 'a list\\\n where\n \\sct2_f i x = (if i = [] then x else (sct2_g (tl i) x i))\\\n| \\sct2_g a b c = sct2_f a (b @ c)\\\n\nfunction sct5_f :: \\'a list \\ 'a list \\ 'a list\\ where\n \\sct5_f x y = (if y = [] then x else if x = [] then sct5_f y (tl y) else sct5_f y (tl x))\\\n by (pat_completeness, auto)\n\nabbreviation sct5_f_wf_rel :: \\(('a list \\ 'a list) \\ 'a list \\ 'a list) set\\ where\n \\sct5_f_wf_rel \\\n { ((y, tl y), (x, y)) | x y . y \\ [] \\ x = [] } \\ \n { ((y, tl x), (x, y)) | x y . y \\ [] \\ x \\ [] }\\\n\nlemma l_sct5__wf_rel_VDM_measure: \n \\sct5_f_wf_rel \\ measure (\\ (x,y) . if y = [] then 0 else if x = [] then length y else length x + length y)\\\n apply (intro subsetI, case_tac x, case_tac a)\n apply (simp add: case_prod_beta)\n apply (elim disjE conjE, simp) \n nitpick\n oops\n\n(*lemma l_sct5_f_wf: \\wf sct5_f_wf_rel\\ \n using l_sct5__wf_rel_VDM_measure \n by (rule wf_subset [OF wf_measure])\n\ntermination\n apply (relation sct5_f_wf_rel)\n using l_sct5_f_wf apply blast\n by simp+*)\n\nfun sct6_f :: \\'a list \\ 'a list \\ 'a list\\ \nand sct6_g :: \\'a list \\ 'a list \\ 'a list\\\nwhere\n \\sct6_f a b = (if b = [] then sct6_g a [] else sct6_f ((hd b)#a) (tl b))\\\n| \\sct6_g c d = (if c = [] then d else sct6_g (tl c) ((hd c)#d))\\\n\n(*>*)\n\ntext \\We can handle all examples from~@{cite SCT_POPL}. We show here some that\nrequire an elaborate setup. For example, the permutation function shows\npermuting decreasing parameters with an involved measure. The precondition was\nrequired for finishing the termination proof and shows an example why proofs\nover \\<^typ>\\\\\\ can be harder. This illustrated how Isabelle (failed) proofs \nhelped to improve the VDM specification. \n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n perm: int * int * int -> int \n perm(m,n,r) == if 0 < r then perm(m, r-1, n) \n else if 0 < n then perm(r, n-1, m) else m\n --@IsaMeasure({mk_(mk_(m, r-1, n), mk_(m,n,r)) | ... & 0 < r} union \n -- {mk_(mk_(r, n-1, m), mk_(m,n,r)) | ... & not 0 < r and 0 < n})\n pre ((0 < r or 0 < n) => m+n+r > 0) measure maxs({m+n+r, 0}); \n\n tak: int * int * int -> int\n tak(x,y,z) == if x <= y then y \n else tak(tak(x-1,y,z), tak(y-1,z,x), tak(z-1,x,y))\n measure is not yet specified;\n\\end{vdmsl}\\\n\ndefinition pre_perm :: \\VDMInt \\ VDMInt \\ VDMInt \\ \\\\ where\n \\pre_perm m n r \\ ((0 < r \\ 0 < n) \\ m+n+r > 0)\\\nlemmas pre_perm_defs = pre_perm_def inv_VDMInt_def inv_True_def\n\nlemma l_pre_perm_trivial[simp]: \\(pre_perm m n r) = ((0 < r \\ 0 < n) \\ m+n+r > 0)\\ \\<^marker>\\tag invisible\\\n unfolding pre_perm_def inv_VDMInt_def \\<^marker>\\tag invisible\\\n by simp \\<^marker>\\tag invisible\\\n\nfunction (domintros) perm :: \\VDMInt \\ VDMInt \\ VDMInt \\ VDMInt\\ where\n \\perm m n r = (if pre_perm m n r then\n if 0 < r then perm m (r-1) n \n else if 0 < n then perm r (n-1) m else m\n else undefined)\\\n by (pat_completeness, auto) \\<^marker>\\tag invisible\\\n\n(*perm_wf_rel :: \\((VDMInt \\ VDMInt \\ VDMInt) \\ (VDMInt \\ VDMInt \\ VDMInt)) VDMSet\\\n where*)\ndefinition \\perm_wf_rel \\ \n { ((m, r-1, n), (m, n, r)) | m r n . pre_perm m n r \\ 0 < r } \\ \n { ((r, n-1, m), (m, n, r)) | m r n . pre_perm m n r \\ \\ 0 < r \\ 0 < n }\\\n\ntext \\Its measure relation contains elements for each recursive call, filtered\nfor the corresponding if-then case. The proof of well-foundedness of such\nmeasure relations involving multiple recursive calls require further proof\nengineering, which is stated in the next lemma.\\\n\nlemma l_perm_wf_rel_VDM_measure: \n \\perm_wf_rel \\ measure (\\ (m, r, n) . nat (max 0 (m+r+n)))\\\nproof - \\<^marker>\\tag invisible\\\n show ?thesis\n apply (intro subsetI, case_tac x)\n apply (simp add: perm_wf_rel_def case_prod_beta max_def)\n apply (elim disjE conjE, simp) \n apply (intro impI conjI, simp_all)\n done\nqed\n\nlemma l_perm_wf_rel: \\wf perm_wf_rel\\\nproof - \\<^marker>\\tag invisible\\\n from l_perm_wf_rel_VDM_measure show ?thesis\n by (rule wf_subset [OF wf_measure])\nqed\n\ntext \\The Isabelle \\<^term>\\measure\\ definition projects the less-than ordered\ninverse image\\<^footnote>\\That is, @{thm measure_def}. Inverse image is defined as @{thm\ninv_image_def}.\\ of a given function as the recursive measure relation. Here\nthe VDM-defined measure is given as such measure function projection. This\nhighlights to the VDM user the relationship (and differences) between VDM and\nIsabelle recursive measures.\n\nThe setup works here if the @{term pre_perm} specifically curbs negative\nsums of parameters. This was not immediately obvious. With the added\nprecondition the termination proof is discovered with @{command sledgehammer}.\\\ntermination \\<^marker>\\tag invisible\\\n apply (relation \\perm_wf_rel\\) \\<^marker>\\tag invisible\\\n apply (simp add: l_perm_wf_rel) \\<^marker>\\tag invisible\\\n by (simp_all add: perm_wf_rel_def) \\<^marker>\\tag invisible\\\n\ntext \\Finally, Takeuchi's\nfunction\\<^footnote>\\\\<^url>\\https://isabelle.in.tum.de/library/HOL/HOL-Examples/Functions.html\\\\,\nwhich contains both permutation and inner recursion is defined next, where the\nimportant part is the SCNP setup using multi-sets @{cite KrausSCNP}. That is\nneeded because ordered lexicographic products are not strong enough to capture\nthis type of recursion. It has not implicit precondition. The translation\nstrategy works for these definitions, yet stands little chance of finding\nproofs automatically.\\\nfunction (domintros) tak :: \\VDMInt \\ VDMInt \\ VDMInt \\ VDMInt\\ where\n \\tak x y z = (if x \\ y then y else tak (tak (x-1) y z) (tak (y-1) z x) (tak (z-1) x y))\\\n by auto \\<^marker>\\tag invisible\\\n\ntext \\Next is an example of how one has to keep domain predicates as \nassumptions prior to termination proofs.\\\nlemma tak_pcorrect:\n \\tak_dom (x, y, z) \\ tak x y z = (if x \\ y then y else if y \\ z then z else x)\\\n thm tak.pinduct tak.psimps \\<^marker>\\tag invisible\\\n apply (induction x y z rule: tak.pinduct) \\<^marker>\\tag invisible\\\n by (simp add: tak.psimps) \\<^marker>\\tag invisible\\\n\ntext \\Each case (including the non-recursive call) is represented in the SCNP\nsetup, and then their measure-lexicographic\\<^footnote>\\The measure-lexicographic product\n\\<^term>\\f <*mlex*> R\\ is represented as the inverse image of the lexicographic product @{thm\nmlex_prod_def}.\\ composition is used as the measure relation for the\ntermination proof.\\\ndefinition tak_m1 where \\tak_m1 = (\\(x,y,z). if x \\ y then 0 else 1)\\\ndefinition tak_m2 where \\tak_m2 = (\\(x,y,z). nat (Max {x, y, z} - Min {x, y, z}))\\\ndefinition tak_m3 where \\tak_m3 = (\\(x,y,z). nat (x - Min {x, y, z}))\\\n\n(*<*)\nlemma \\(((x1,y1,z1),(x2,y2,z2)) \\ tak_m3 <*mlex*> {}) \\ (nat (x1 - Min {x1, y1, z1}) < nat (x2 - Min {x2, y2, z2}))\\\n apply (simp add: mlex_iff)\n unfolding tak_m3_def\n (*apply (simp only: case_prod_beta fst_conv snd_conv) *)\n by simp\n\nlemma \\((x1,y1,z1),(x2,y2,z2)) \\ (tak_m2 <*mlex*> (tak_m3 <*mlex*> {}))\\\n apply (simp add: mlex_iff)\n unfolding tak_m3_def tak_m2_def\n apply (simp only: case_prod_beta fst_conv snd_conv, clarify)\n oops\n\nlemma l_call1: \n \\x > y \\ ((x-1,y,z),(x,y,z)) \\ tak_m1 <*mlex*> (tak_m2 <*mlex*> (tak_m3 <*mlex*> {}))\\ \n apply (simp add: mlex_iff) \\<^marker>\\tag invisible\\\n unfolding tak_m3_def tak_m2_def tak_m1_def \\<^marker>\\tag invisible\\\n apply (simp add: case_prod_beta)\\<^marker>\\tag invisible\\\n unfolding min_def max_def\\<^marker>\\tag invisible\\\n by (simp_all split:if_splits)\\<^marker>\\tag invisible\\\n\nlemma l_call2:\n \\x > y \\ ((y-1,z,x),(x,y,z)) \\ tak_m1 <*mlex*> (tak_m2 <*mlex*> (tak_m3 <*mlex*> {}))\\\n apply (simp add: mlex_iff)\n unfolding tak_m3_def tak_m2_def tak_m1_def\n by (simp add: case_prod_beta)\n \nlemma l_call3:\n \\x > y \\ ((z-1,x,y),(x,y,z)) \\ tak_m1 <*mlex*> (tak_m2 <*mlex*> (tak_m3 <*mlex*> {}))\\\n apply (simp add: mlex_iff)\n unfolding tak_m3_def tak_m2_def tak_m1_def\n by (simp add: case_prod_beta)\n \nlemma l_call4:\n \\x >y \\ tak_dom (z - 1, x, y) \\\n tak_dom (y - 1, z, x) \\\n tak_dom (x - 1, y, z) \\\n ((tak (x - 1) y z, tak (y - 1) z x, tak (z - 1) x y), x, y, z)\n \\ tak_m1 <*mlex*> tak_m2 <*mlex*> tak_m3 <*mlex*> {}\\\n apply (simp add: mlex_iff)\n apply (simp add: tak_pcorrect)\n unfolding tak_m3_def tak_m2_def tak_m1_def \n by (simp add: case_prod_beta)\n(*>*)\n\ntext \\The termination proof uses the measure relation @{term \\tak_m1 <*mlex*>\ntak_m2 <*mlex*> tak_m3 <*mlex*> {}\\}. It requires user-defined lemmas for each\nof the four cases.\\\ntermination \\<^marker>\\tag invisible\\\n apply (relation \\tak_m1 <*mlex*> tak_m2 <*mlex*> tak_m3 <*mlex*> {}\\) \\<^marker>\\tag invisible\\\n apply (simp add: wf_mlex) \\<^marker>\\tag invisible\\\n apply (simp add: l_call1)\\<^marker>\\tag invisible\\\n apply (simp add: l_call2)\\<^marker>\\tag invisible\\\n apply (simp add: l_call3)\\<^marker>\\tag invisible\\\n by (simp add: l_call4)\\<^marker>\\tag invisible\\\n\ntext \\With the total version of induction and simplification rules are\navailable. Then, it is possible to prove its rather simpler equivalence.\\\n\ntheorem tak_correct: \\tak x y z = (if x \\ y then y else if y \\ z then z else x)\\\n by (induction x y z rule: tak.induct) auto\n\n(*---------------------------------------------------------------------------*)\nsubsection \\Mutual recursion\\label{subsec:MutualRec}\\\n\ntext \\Finally, we handle mutual recursion. VDM has few bounds on mutually\nrecursive definitions. We reuse the VDM type checker cyclic-measure discovery\nalgorithm in order to deduce related recursive calls. Note this is not\ncomplete and may fail to discover involved recursive calls, such as those\nunder some lambda-term result, for example. If that recursive call graph\ndiscovery fails, then users have to annotate at least one of the mutually\nrecursive definitions with an \\<^verbatim>\\@IsaMutualRec\\ annotation listing all expected\nfunction names involved.\n\nMutually recursive definitions proof obligations refer to each others\nmeasure functions. Isabelle requires all related functions to be given in a\nsingle definition, where Isabelle's sum (or union) types are used in the proof\nsetup. Where needed, termination proof setup will be involved and with limited \nautomation. Here is a simple example and its translation, which works with\n \\<^term>\\fun\\ syntax, hence has no further proof obligation needs. Note that in \nthis case using \\<^term>\\fun\\ syntax, we declare implicit preconditions as \nsimplification rules.\n%\n\\begin{vdmsl}[frame=none,basicstyle=\\ttfamily\\scriptsize]\n --@IsaMutualRec({odd})\n even: nat -> bool\n even(n) == if n = 0 then true else odd(n-1) measure n;\n \n --@IsaMutualRec({even})\n --@TheoremAttribte pre_even_def = {termination_simp}\n odd: nat -> bool\n odd(n) == if n = 0 then false else even(n-1) measure n;\n\\end{vdmsl}\n\\\ndefinition pre_even :: \\VDMNat \\ \\\\ where [termination_simp]: \\pre_even n \\ inv_VDMNat n\\ \ndefinition pre_odd :: \\VDMNat \\ \\\\ where [termination_simp]: \\pre_odd n \\ inv_VDMNat n\\ \nfun (domintros) even :: \\VDMNat \\ \\\\ and odd :: \\VDMNat \\ \\\\ where \n \\even n = (if pre_even n then (if n = 0 then True else odd (n-1)) else undefined)\\\n| \\odd n = (if pre_odd n then (if n = 0 then False else even (n-1)) else undefined)\\\n\n(******************************************************************************)\nsection \\Discussion and conclusion\\label{sec:Conclusion}\\\n\ntext \\This paper has presented a translation strategy from VDM to Isabelle for\nrecursive functions over basic types, sets and maps, as well as mutual\nrecursion. We present how the strategy works for complex recursion.\n\nThe complex recursion examples hint at possible VDM recursive measure\nextensions to use a combination of measure relations and functions. The full\nVDM and Isabelle sources and proofs can be found at the VDM toolkit repository\nat \\<^verbatim>\\RecursiveVDM*.thy\\\\<^footnote>\\\\<^url>\\https://github.com/leouk/VDM_Toolkit\\\\.\n\n\\<^bold>\\Future work.\\~We are implementing the translation strategy in the\n\\<^verbatim>\\vdm2isa\\ plugin, which should be available soon.\n\n\\<^bold>\\Acknowledgements.\\~We appreciated discussions with Stephan Merz on pointers\nfor complex well-founded recursion proofs in Isabelle, and with Nick Battle on\nlimits for VDM recursive measures. Peter Gorm Larsen would also like to\nacknowledge the Poul Due Jensen Foundation for funding the project Digital\nTwins for Cyber-Physical Systems (DiT4CPS).\\\n\n(*<*)\nlemma l_sumset_rel_wf': \\wf sumset_wf_rel\\\n apply (rule wf_measure[of \\\\ s . card s\\, THEN wf_subset])\\<^marker>\\tag invisible\\\n apply (simp add: measure_def inv_image_def less_than_def less_eq)\\<^marker>\\tag invisible\\\n apply (rule subsetI, simp add: case_prod_beta)\\<^marker>\\tag invisible\\\n apply (elim exE conjE)\\<^marker>\\tag invisible\\\n by (metis card_Diff1_less_iff fst_conv inv_VDMMap_defs(2) inv_VDMMap_defs(3) \n pre_sumset_defs(1) snd_conv some_in_eq)\\<^marker>\\tag invisible\\\n(*>*)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/plugins/vdm2isa/pub/recursion/RecursiveVDM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2605642847355641}} {"text": "theory MainHC\nimports Main\nbegin\n\n-- \"we need full proof object support to use translate_thm later on\"\nML {* proofs := 2 *}\n\ntype_synonym 'a partial = \"'a option\"\n\n(* negation of is_none *)\nprimrec defOp :: \"'a partial => bool\"\nwhere\n\"defOp None = False\" |\n\"defOp (Some x) = True\"\n\ndefinition makeTotal :: \"'a partial => 'a\"\nwhere \"makeTotal == the\"\n\ndefinition makePartial :: \"'a => 'a partial\"\nwhere \"makePartial == Some\"\n\n(* undefined is predefined *)\ndefinition undefinedOp :: \"'a partial\"\nwhere \"undefinedOp == None\"\n\n(* backward compatibility only *)\ndefinition noneOp :: \"'a partial\"\nwhere \"noneOp == undefinedOp\"\n\ndefinition restrictOp :: \"'a partial => bool => 'a partial\"\nwhere \"restrictOp a b == if b then a else undefinedOp\"\n\n(* utilities *)\ndefinition flip :: \"('a => 'b => 'c) => 'b => 'a => 'c\"\nwhere \"flip f a b == f b a\"\n\ndefinition uncurryOp :: \"('a => 'b => 'c) => 'a * 'b => 'c\"\nwhere \"uncurryOp f p == f (fst p) (snd p)\"\n\ndefinition curryOp :: \"('a * 'b => 'c) => 'a => 'b => 'c\"\nwhere \"curryOp f a b == f (a, b)\"\n\n(* map on pairs *)\ndefinition mapFst :: \"('a => 'b) => 'a * 'c => 'b * 'c\"\nwhere \"mapFst f p == (f (fst p), snd p)\"\n\ndefinition mapSnd :: \"('b => 'c) => 'a * 'b => 'a * 'c\"\nwhere \"mapSnd f p == (fst p, f (snd p))\"\n\n(* predefined HasCASL functions *)\ndefinition ifImplOp :: \"bool * bool => bool\"\nwhere \"ifImplOp p == snd p --> fst p\"\n\ndefinition existEqualOp :: \"'a partial => 'a partial => bool\"\n (\"(_ =e=/ _)\" [50, 51] 50)\nwhere \"existEqualOp a b == defOp a & defOp b & makeTotal a = makeTotal b\"\n\ndefinition exEqualOp :: \"'a partial * 'a partial => bool\"\nwhere \"exEqualOp == uncurryOp existEqualOp\"\n\ndefinition strongEqualOp :: \"'a partial => 'a partial => bool\"\n (\"(_ =s=/ _)\" [50, 51] 50)\nwhere \"strongEqualOp a b == a = b\"\n\ndefinition whenElseOp :: \"('a partial * bool) * 'a partial => 'a partial\"\nwhere \"whenElseOp t == case t of\n (p, e) => if snd p then fst p else e\"\n\n(*resOp :: \"'a partial * 'b partial => 'a\"\n\"resOp p == makeTotal (restrictOp (fst p) (defOp (snd p)))\"*)\n\ndefinition resOp :: \"'a partial * 'b partial => 'a partial\"\nwhere \"resOp p == restrictOp (fst p) (defOp (snd p))\"\n\n\n(* conversions *)\ndefinition lift2partial :: \"('a => 'b partial) => 'a partial => 'b partial\"\nwhere \"lift2partial f s == restrictOp (f (makeTotal s)) (defOp s)\"\n\ndefinition mapPartial :: \"('a => 'b) => 'a partial => 'b partial\"\nwhere \"mapPartial f s == restrictOp (makePartial (f (makeTotal s))) (defOp s)\"\n\ndefinition unpackPartial :: \"(('a => 'b) => 'c => 'd partial)\n => ('a => 'b) partial => 'c => 'd partial\"\nwhere \"unpackPartial c s a == lift2partial (flip c a) s\"\n\ndefinition unpackBool :: \"(('a => 'b) => 'c => bool)\n => ('a => 'b) partial => 'c => bool\"\nwhere \"unpackBool c s a == defOp s & c (makeTotal s) a\"\n\ndefinition unpack2partial :: \"(('a => 'b) => 'c => 'd)\n => ('a => 'b) partial => 'c => 'd partial\"\nwhere \"unpack2partial c s a == mapPartial (flip c a) s\"\n\ndefinition unpack2bool :: \"(('a => 'b) => 'c => 'd)\n => ('a => 'b) partial => 'c => bool\"\nwhere \"unpack2bool c s a == defOp s\"\n\ndefinition bool2partial :: \"bool => unit partial\"\nwhere \"bool2partial b == restrictOp (makePartial ()) b\"\n\ndefinition liftUnit2unit :: \"('a => 'b) => bool => bool\"\nwhere \"liftUnit2unit f b == b\"\n\ndefinition liftUnit2bool :: \"(unit => bool) => bool => bool\"\nwhere \"liftUnit2bool f b == b & f ()\"\n\ndefinition liftUnit2partial :: \"(unit => 'a partial) => bool => 'a partial\"\nwhere \"liftUnit2partial f b == restrictOp (f ()) b\"\n\ndefinition liftUnit :: \"(unit => 'a) => bool => 'a partial\"\nwhere \"liftUnit f b ==restrictOp (makePartial (f ())) b\"\n\ndefinition lift2unit :: \"('b => 'c) => ('a partial => bool)\"\nwhere \"lift2unit f == defOp\"\n\ndefinition lift2bool :: \"('a => bool) => 'a partial => bool\"\nwhere \"lift2bool f s == defOp s & f (makeTotal s)\"\n\n(* old stuff *)\nprimrec app :: \"('a => 'b option) option => 'a option => 'b option\"\nwhere\n \"app None a = None\" |\n \"app (Some f) x = (case x of\n None => None\n | Some x' => f x')\"\n\nprimrec apt :: \"('a => 'b) option => 'a option => 'b option\"\nwhere\n \"apt None a = None\" |\n \"apt (Some f) x = (case x of\n None => None\n | Some x' => Some (f x'))\"\n\nprimrec pApp :: \"('a => bool) option => 'a option => bool\"\nwhere\n \"pApp None a = False\" |\n \"pApp (Some f) x = (case x of\n None => False\n | Some y => f y)\"\n\nprimrec pair :: \"'a option => 'b option => ('a * 'b) option\"\nwhere\n \"pair None a = None\" |\n \"pair (Some x) z = (case z of\n None => None\n | Some y => Some (x,y))\"\n\nlemma some_inj : \"Some x = Some y ==> x = y\"\napply (auto)\ndone\n\n(* Monad law added by Lutz Schroeder *)\n\nlemma partial_monad_unit1[simp]: \"lift2partial f (makePartial a) = f a\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def)\ndone\n\nlemma partial_monad_unit2[simp]: \"lift2partial makePartial m = m\"\napply (auto simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\napply (case_tac \"m\")\napply (auto)\napply (case_tac \"m\")\napply (auto)\ndone\n\nlemma partial_monad_assoc[simp]:\n \"lift2partial g (lift2partial f m) =\n lift2partial (%x. lift2partial g (f x)) m\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\ndone\n\nlemma strictness_closure:\n \"defOp (lift2partial f a) = (defOp (lift2partial f a) & defOp a)\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\ndone\n\n(*\n Identities added by Ewaryst Schulz\n*)\n(*\nlemma defOp_implies_makePartial:\n\"defOp(x :: 'a partial) ==> (EX (y :: 'a). x = makePartial y)\"\n-- \"for isabelle 2009\"\n by (rule Option.option.exhaust [of x], simp, simp add: exI makePartial_def)\n-- \"for isabelle 2008\"\n by (rule Datatype.option.exhaust [of x], simp, simp add: exI makePartial_def)\n-- \"for both versions:\"\n sorry\n*)\n\naxiomatization\nwhere\ndefOp_implies_makePartial:\n\"defOp(x :: 'a partial) ==> (EX (y :: 'a). x = makePartial y)\"\n\n\n-- \"need this to expand a term for application of lemmas\"\nlemma partial_identity: \"!!x. makeTotal(makePartial(x)) = x\"\n by (simp add: makeTotal_def makePartial_def)\n\naxiomatization\npreDefOp :: \"'a partial => bool\"\nwhere\npreDefOp_atom[simp]: \"preDefOp a = defOp a\"\nand\npreDefOp_lift[simp]:\n\"preDefOp (lift2partial f a) = (defOp (lift2partial f a) & preDefOp a)\"\n\n\nend\n", "meta": {"author": "spechub", "repo": "Hets-lib", "sha": "7bed416952e7000e2fa37f0b6071b5291b299b77", "save_path": "github-repos/isabelle/spechub-Hets-lib", "path": "github-repos/isabelle/spechub-Hets-lib/Hets-lib-7bed416952e7000e2fa37f0b6071b5291b299b77/Isabelle/MainHC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2605642776960263}} {"text": "(* Title: HOL/Library/Phantom_Type.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\A generic phantom type\\\n\ntheory Phantom_Type\nimports Main\nbegin\n\ndatatype ('a, 'b) phantom = phantom (of_phantom: 'b)\n\nlemma type_definition_phantom': \"type_definition of_phantom phantom UNIV\"\nby(unfold_locales) simp_all\n\nlemma phantom_comp_of_phantom [simp]: \"phantom \\ of_phantom = id\"\n and of_phantom_comp_phantom [simp]: \"of_phantom \\ phantom = id\"\nby(simp_all add: o_def id_def)\n\nsyntax \"_Phantom\" :: \"type \\ logic\" (\"(1Phantom/(1'(_')))\")\ntranslations\n \"Phantom('t)\" => \"CONST phantom :: _ \\ ('t, _) phantom\"\n\ntyped_print_translation \\\n let\n fun phantom_tr' ctxt (Type (\\<^type_name>\\fun\\, [_, Type (\\<^type_name>\\phantom\\, [T, _])])) ts =\n list_comb\n (Syntax.const \\<^syntax_const>\\_Phantom\\ $ Syntax_Phases.term_of_typ ctxt T, ts)\n | phantom_tr' _ _ _ = raise Match;\n in [(\\<^const_syntax>\\phantom\\, phantom_tr')] end\n\\\n\nlemma of_phantom_inject [simp]:\n \"of_phantom x = of_phantom y \\ x = y\"\nby(cases x y rule: phantom.exhaust[case_product phantom.exhaust]) simp\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Library/Phantom_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2605642776960263}} {"text": "section {*L\\_ATS\\_Language*}\ntheory\n L_ATS_Language\n\nimports\n L_ATS_Language0\n\nbegin\n\nlocale ATS_Language =\n ATS_Language0\n \"TSstructure :: 'TSstructure \\ bool\"\n \"configurations :: 'TSstructure \\ 'conf set\"\n \"initial_configurations :: 'TSstructure \\ 'conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"step_relation :: 'TSstructure \\ 'conf \\ 'label \\ 'conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event set\"\n \"marking_condition :: 'TSstructure \\ ('label,'conf)derivation \\ bool\"\n \"marked_effect :: 'TSstructure \\ ('label,'conf)derivation \\ 'event set\"\n \"unmarked_effect :: 'TSstructure \\ ('label,'conf)derivation \\ 'event set\"\n for\n TSstructure configurations initial_configurations step_labels step_relation effects marking_condition marked_effect unmarked_effect\n +\n\nassumes AX_effect_inclusion1: \"\n TSstructure G\n \\ derivation_initial G d\n \\ marking_condition G d\n \\ marked_effect G d \\ unmarked_effect G d\"\n\nassumes AX_effect_inclusion2: \"\n TSstructure G\n \\ unmarked_language G \\ effects G\"\n\nassumes AX_marking_condition_implies_existence_of_effect: \"\n TSstructure G\n \\ derivation_initial G d\n \\ marking_condition G d\n \\ marked_effect G d \\ {}\"\n\nassumes AX_unmarked_effect_persists: \"\n TSstructure G\n \\ derivation_initial G d\n \\ unmarked_effect G (derivation_take d n) \\ unmarked_effect G d\"\n\ncontext ATS_Language\nbegin\n\nlemma lang_inclusion: \"\n TSstructure M\n \\ marked_language M \\ unmarked_language M\"\n apply(simp add: marked_language_def unmarked_language_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(rule_tac\n x=\"d\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n A=\"marked_effect M d\"\n in set_mp)\n apply(rename_tac x d)(*strict*)\n apply(rule AX_effect_inclusion1)\n apply(rename_tac x d)(*strict*)\n apply(auto)\n done\n\nlemma Nonblockingness_branching_implies_non_empty_lang: \"\n TSstructure G\n \\ Nonblockingness_branching G\n \\ marked_language G = {}\n \\ c \\ initial_configurations G\n \\ Q\"\n apply(simp add: Nonblockingness_branching_def)\n apply(erule_tac\n x=\"der1 c\"\n in allE)\n apply(subgoal_tac \"derivation_initial G (der1 c) \\ maximum_of_domain (der1 c) 0\")\n apply(clarsimp)\n prefer 2\n apply(simp add: derivation_initial_def)\n apply(rule conjI)\n apply(rule der1_is_derivation)\n apply(simp add: maximum_of_domain_def der1_def)\n apply(erule_tac\n x=\"0\"\n in allE)\n apply(erule impE)\n apply(force)\n apply(clarsimp)\n apply(rename_tac dc x)(*strict*)\n apply(simp add: marked_language_def)\n apply(subgoal_tac \"derivation_initial G (derivation_append (der1 c) dc 0)\")\n apply(rename_tac dc x)(*strict*)\n prefer 2\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac dc x)(*strict*)\n apply(simp add: derivation_initial_def)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(simp add: der1_def)\n apply(case_tac \"dc 0\")\n apply(rename_tac dc x)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_def derivation_append_fit_def)\n apply(rename_tac dc x a)(*strict*)\n apply(simp add: derivation_def derivation_append_fit_def)\n apply(case_tac a)\n apply(rename_tac dc x a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac dc x option b)(*strict*)\n apply(case_tac option)\n apply(rename_tac dc x option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac dc x option b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac dc x)(*strict*)\n apply(subgoal_tac \"marked_effect G (derivation_append (der1 c) dc 0) \\ {}\")\n apply(rename_tac dc x)(*strict*)\n prefer 2\n apply(rule AX_marking_condition_implies_existence_of_effect)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(subgoal_tac \"\\x. x \\ marked_effect G (derivation_append (der1 c) dc 0)\")\n apply(rename_tac dc x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac dc x)(*strict*)\n apply(thin_tac \"marked_effect G (derivation_append (der1 c) dc 0)\\{}\")\n apply(clarsimp)\n apply(rename_tac dc x xa)(*strict*)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule_tac\n x=\"derivation_append (der1 c) dc 0\"\n in allE)\n apply(clarsimp)\n apply(simp add: derivation_initial_def)\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_01/L_ATS_Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2605005768218274}} {"text": "(* Title: HOL/Auth/n_mesi_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_on_inis imports n_mesi_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2605005701429106}} {"text": "section \\Definition of the CFG\\\n\ntheory PCFG imports ProcState begin\n\ndefinition Main :: \"pname\"\n where \"Main = ''Main''\"\n\ndatatype label = Label nat | Entry | Exit\n\nsubsection\\The CFG for every procedure\\\n\nsubsubsection \\Definition of \\\\\\\\\n\nfun label_incr :: \"label \\ nat \\ label\" (\"_ \\ _\" 60)\nwhere \"(Label l) \\ i = Label (l + i)\"\n | \"Entry \\ i = Entry\"\n | \"Exit \\ i = Exit\"\n\n\nlemma Exit_label_incr [dest]: \"Exit = n \\ i \\ n = Exit\"\n by(cases n,auto)\n\nlemma label_incr_Exit [dest]: \"n \\ i = Exit \\ n = Exit\"\n by(cases n,auto)\n\nlemma Entry_label_incr [dest]: \"Entry = n \\ i \\ n = Entry\"\n by(cases n,auto)\n\nlemma label_incr_Entry [dest]: \"n \\ i = Entry \\ n = Entry\"\n by(cases n,auto)\n\nlemma label_incr_inj:\n \"n \\ c = n' \\ c \\ n = n'\"\nby(cases n)(cases n',auto)+\n\nlemma label_incr_simp:\"n \\ i = m \\ (i + j) \\ n = m \\ j\"\nby(cases n,auto,cases m,auto)\n\n\n\nlemma label_incr_start_Node_smaller:\n \"Label l = n \\ i \\ n = Label (l - i)\"\nby(cases n,auto)\n\nlemma label_incr_start_Node_smaller_rev:\n \"n \\ i = Label l \\ n = Label (l - i)\"\nby(cases n,auto)\n\n\nlemma label_incr_ge:\"Label l = n \\ i \\ l \\ i\"\nby(cases n) auto\n\nlemma label_incr_0 [dest]:\n \"\\Label 0 = n \\ i; i > 0\\ \\ False\" \nby(cases n) auto\n\nlemma label_incr_0_rev [dest]:\n \"\\n \\ i = Label 0; i > 0\\ \\ False\" \nby(cases n) auto\n\nsubsubsection \\The edges of the procedure CFG\\\n\ntext \\Control flow information in this language is the node, to which we return\n after the calles procedure is finished.\\\n\ndatatype p_edge_kind = \n IEdge \"(vname,val,pname \\ label,pname) edge_kind\"\n| CEdge \"pname \\ expr list \\ vname list\"\n\n\ntype_synonym p_edge = \"(label \\ p_edge_kind \\ label)\"\n\ninductive Proc_CFG :: \"cmd \\ label \\ p_edge_kind \\ label \\ bool\"\n(\"_ \\ _ -_\\\\<^sub>p _\")\nwhere\n\n Proc_CFG_Entry_Exit:\n \"prog \\ Entry -IEdge (\\s. False)\\<^sub>\\\\\\<^sub>p Exit\"\n\n| Proc_CFG_Entry:\n \"prog \\ Entry -IEdge (\\s. True)\\<^sub>\\\\\\<^sub>p Label 0\"\n\n| Proc_CFG_Skip: \n \"Skip \\ Label 0 -IEdge \\id\\\\<^sub>p Exit\"\n\n| Proc_CFG_LAss: \n \"V:=e \\ Label 0 -IEdge \\(\\cf. update cf V e)\\\\<^sub>p Label 1\"\n\n| Proc_CFG_LAssSkip:\n \"V:=e \\ Label 1 -IEdge \\id\\\\<^sub>p Exit\"\n\n| Proc_CFG_SeqFirst:\n \"\\c\\<^sub>1 \\ n -et\\\\<^sub>p n'; n' \\ Exit\\ \\ c\\<^sub>1;;c\\<^sub>2 \\ n -et\\\\<^sub>p n'\"\n\n| Proc_CFG_SeqConnect: \n \"\\c\\<^sub>1 \\ n -et\\\\<^sub>p Exit; n \\ Entry\\ \\ c\\<^sub>1;;c\\<^sub>2 \\ n -et\\\\<^sub>p Label #:c\\<^sub>1\"\n\n| Proc_CFG_SeqSecond: \n \"\\c\\<^sub>2 \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \\ c\\<^sub>1;;c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -et\\\\<^sub>p n' \\ #:c\\<^sub>1\"\n\n| Proc_CFG_CondTrue:\n \"if (b) c\\<^sub>1 else c\\<^sub>2 \\ Label 0 \n -IEdge (\\cf. state_check cf b (Some true))\\<^sub>\\\\\\<^sub>p Label 1\"\n\n| Proc_CFG_CondFalse:\n \"if (b) c\\<^sub>1 else c\\<^sub>2 \\ Label 0 -IEdge (\\cf. state_check cf b (Some false))\\<^sub>\\\\\\<^sub>p \n Label (#:c\\<^sub>1 + 1)\"\n\n| Proc_CFG_CondThen:\n \"\\c\\<^sub>1 \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \\ if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ 1 -et\\\\<^sub>p n' \\ 1\"\n\n| Proc_CFG_CondElse:\n \"\\c\\<^sub>2 \\ n -et\\\\<^sub>p n'; n \\ Entry\\ \n \\ if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ (#:c\\<^sub>1 + 1) -et\\\\<^sub>p n' \\ (#:c\\<^sub>1 + 1)\"\n\n| Proc_CFG_WhileTrue:\n \"while (b) c' \\ Label 0 -IEdge (\\cf. state_check cf b (Some true))\\<^sub>\\\\\\<^sub>p Label 2\"\n\n| Proc_CFG_WhileFalse:\n \"while (b) c' \\ Label 0 -IEdge (\\cf. state_check cf b (Some false))\\<^sub>\\\\\\<^sub>p Label 1\"\n\n| Proc_CFG_WhileFalseSkip:\n \"while (b) c' \\ Label 1 -IEdge \\id\\\\<^sub>p Exit\"\n\n| Proc_CFG_WhileBody:\n \"\\c' \\ n -et\\\\<^sub>p n'; n \\ Entry; n' \\ Exit\\ \n \\ while (b) c' \\ n \\ 2 -et\\\\<^sub>p n' \\ 2\"\n\n| Proc_CFG_WhileBodyExit:\n \"\\c' \\ n -et\\\\<^sub>p Exit; n \\ Entry\\ \\ while (b) c' \\ n \\ 2 -et\\\\<^sub>p Label 0\"\n\n| Proc_CFG_Call:\n \"Call p es rets \\ Label 0 -CEdge (p,es,rets)\\\\<^sub>p Label 1\"\n\n| Proc_CFG_CallSkip:\n \"Call p es rets \\ Label 1 -IEdge \\id\\\\<^sub>p Exit\"\n\n\nsubsubsection\\Some lemmas about the procedure CFG\\\n\nlemma Proc_CFG_Exit_no_sourcenode [dest]:\n \"prog \\ Exit -et\\\\<^sub>p n' \\ False\"\nby(induct prog n\\\"Exit\" et n' rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_Entry_no_targetnode [dest]:\n \"prog \\ n -et\\\\<^sub>p Entry \\ False\"\nby(induct prog n et n'\\\"Entry\" rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_IEdge_intra_kind:\n \"prog \\ n -IEdge et\\\\<^sub>p n' \\ intra_kind et\"\nby(induct prog n x\\\"IEdge et\" n' rule:Proc_CFG.induct,auto simp:intra_kind_def)\n\n\nlemma [dest]:\"prog \\ n -IEdge (Q:r\\\\<^bsub>p\\<^esub>fs)\\\\<^sub>p n' \\ False\"\nby(fastforce dest:Proc_CFG_IEdge_intra_kind simp:intra_kind_def)\n\nlemma [dest]:\"prog \\ n -IEdge (Q\\\\<^bsub>p\\<^esub>f)\\\\<^sub>p n' \\ False\"\nby(fastforce dest:Proc_CFG_IEdge_intra_kind simp:intra_kind_def)\n\n\nlemma Proc_CFG_sourcelabel_less_num_nodes:\n \"prog \\ Label l -et\\\\<^sub>p n' \\ l < #:prog\"\nproof(induct prog \"Label l\" et n' arbitrary:l rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 et n' c\\<^sub>2 l)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 et c\\<^sub>2 l)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1 l) \n note n = \\n \\ #:c\\<^sub>1 = Label l\\ \n note IH = \\\\l. n = Label l \\ l < #:c\\<^sub>2\\\n from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n with n l' show ?case by simp\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2 l) \n note n = \\n \\ 1 = Label l\\\n note IH = \\\\l. n = Label l \\ l < #:c\\<^sub>1\\\n from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n from IH[OF this] have \"l' < #:c\\<^sub>1\" .\n with n l' show ?case by simp\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1 l)\n note n = \\n \\ (#:c\\<^sub>1 + 1) = Label l\\\n note IH = \\\\l. n = Label l \\ l < #:c\\<^sub>2\\\n from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n with n l' show ?case by simp\nnext\n case (Proc_CFG_WhileBody c' n et n' b l)\n note n = \\n \\ 2 = Label l\\ \n note IH = \\\\l. n = Label l \\ l < #:c'\\\n from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n from IH[OF this] have \"l' < #:c'\" .\n with n l' show ?case by simp\nnext\n case (Proc_CFG_WhileBodyExit c' n et b l)\n note n = \\n \\ 2 = Label l\\ \n note IH = \\\\l. n = Label l \\ l < #:c'\\\n from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n from IH[OF this] have \"l' < #:c'\" .\n with n l' show ?case by simp\nqed (auto simp:num_inner_nodes_gr_0)\n\n\nlemma Proc_CFG_targetlabel_less_num_nodes:\n \"prog \\ n -et\\\\<^sub>p Label l \\ l < #:prog\"\nproof(induct prog n et \"Label l\" arbitrary:l rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n et c\\<^sub>2 l)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1 l)\n note n' = \\n' \\ #:c\\<^sub>1 = Label l\\ \n note IH = \\\\l. n' = Label l \\ l < #:c\\<^sub>2\\\n from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n with n' l' show ?case by simp\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2 l)\n note n' = \\n' \\ 1 = Label l\\ \n note IH = \\\\l. n' = Label l \\ l < #:c\\<^sub>1\\\n from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n from IH[OF this] have \"l' < #:c\\<^sub>1\" .\n with n' l' show ?case by simp\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1 l)\n note n' = \\n' \\ (#:c\\<^sub>1 + 1) = Label l\\ \n note IH = \\\\l. n' = Label l \\ l < #:c\\<^sub>2\\\n from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n with n' l' show ?case by simp\nnext\n case (Proc_CFG_WhileBody c' n et n' b l)\n note n' = \\n' \\ 2 = Label l\\ \nnote IH = \\\\l. n' = Label l \\ l < #:c'\\\n from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n from IH[OF this] have \"l' < #:c'\" .\n with n' l' show ?case by simp\nqed (auto simp:num_inner_nodes_gr_0)\n\n\nlemma Proc_CFG_EntryD:\n \"prog \\ Entry -et\\\\<^sub>p n' \n \\ (n' = Exit \\ et = IEdge(\\s. False)\\<^sub>\\) \\ (n' = Label 0 \\ et = IEdge (\\s. True)\\<^sub>\\)\"\nby(induct prog n\\\"Entry\" et n' rule:Proc_CFG.induct,auto)\n\n\n\n\n\ntext \\Lots of lemmas for call edges \\\\\\\\\n\nlemma Proc_CFG_Call_Labels:\n \"prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n' \\ \\l. n = Label l \\ n' = Label (Suc l)\"\nby(induct prog n et\\\"CEdge (p,es,rets)\" n' rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_Call_target_0:\n \"prog \\ n -CEdge (p,es,rets)\\\\<^sub>p Label 0 \\ n = Entry\"\nby(induct prog n et\\\"CEdge (p,es,rets)\" n'\\\"Label 0\" rule:Proc_CFG.induct)\n (auto dest:Proc_CFG_Call_Labels)\n\n\nlemma Proc_CFG_Call_Intra_edge_not_same_source:\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n -IEdge et\\\\<^sub>p n''\\ \\ False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n -IEdge et\\\\<^sub>p n'' \\ False\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \n \\n' \\ Exit\\\n obtain nx where \"c\\<^sub>1 \\ n -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG_Entry_Exit Proc_CFG_Entry)\n by(case_tac n)(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\\n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n -IEdge et\\\\<^sub>p n'' \\ False\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>2 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>2 \\ n -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n apply(cases n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(cases n,auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n -IEdge et\\\\<^sub>p n'' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ 1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>1 \\ n -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n) apply auto apply(case_tac n) apply auto\n apply(cases n) apply auto\n by(case_tac n)(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n -IEdge et\\\\<^sub>p n'' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ #:c\\<^sub>1 + 1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>2 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>2 \\ n -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n) apply auto\n apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(cases n,auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n -IEdge et\\\\<^sub>p n'' \\ False\\\n from \\while (b) c' \\ n \\ 2 -IEdge et\\\\<^sub>p n''\\ \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\ \\n' \\ Exit\\\n obtain nx where \"c' \\ n -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(drule label_incr_ge[OF sym]) apply simp\n apply(cases n) apply auto apply(case_tac n) apply auto\n by(cases n,auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBodyExit c' n b)\n from \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\\n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ Label 0 -IEdge et\\\\<^sub>p n''\\\n show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_Intra_edge_not_same_target:\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n'' -IEdge et\\\\<^sub>p n'\\ \\ False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n'' -IEdge et\\\\<^sub>p n' \\ False\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n'\\ \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \n \\n' \\ Exit\\\n have \"c\\<^sub>1 \\ n'' -IEdge et\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG_Entry dest:Proc_CFG_targetlabel_less_num_nodes) \n by(case_tac n')(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\\n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n' \\ False\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n' \\ #:c\\<^sub>1\\ \\c\\<^sub>2 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\ \n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>2 \\ nx -IEdge et\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(fastforce intro:Proc_CFG_Entry_Exit)\n apply(cases n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n apply(cases n') apply(auto dest:Proc_CFG_Call_Labels)\n by(case_tac n') auto\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n'' -IEdge et\\\\<^sub>p n' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n' \\ 1\\ \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>1 \\ nx -IEdge et\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply(auto intro:Proc_CFG_Entry_Exit)\n apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n apply(cases n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n apply(cases n') apply auto apply(case_tac n') apply auto\n apply(cases n') apply auto\n apply(case_tac n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n by(case_tac n')(auto dest:Proc_CFG_Call_Labels)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n'' -IEdge et\\\\<^sub>p n' \\ #:c\\<^sub>1 + 1\\ \\c\\<^sub>2 \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>2 \\ nx -IEdge et\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply(auto intro:Proc_CFG_Entry_Exit)\n apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n apply(cases n') apply auto\n apply(case_tac n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n apply(case_tac n') apply(auto dest:Proc_CFG_Call_Labels)\n by(cases n',auto,case_tac n',auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n'' -IEdge et\\\\<^sub>p n' \\ False\\\n from \\while (b) c' \\ n'' -IEdge et\\\\<^sub>p n' \\ 2\\ \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\ \\n' \\ Exit\\\n obtain nx where \"c' \\ nx -IEdge et\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n apply(cases n') apply auto\n by(cases n',auto,case_tac n',auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBodyExit c' n b)\n from \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\\n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ n'' -IEdge et\\\\<^sub>p Label 1\\\n show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_nodes_eq:\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\\\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\c\\<^sub>1;; c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n have \"c\\<^sub>1 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(fastforce dest:Proc_CFG_Call_Labels)\n by(case_tac n,(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)+)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p Exit\\ have False\n by(fastforce dest:Proc_CFG_Call_Labels)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -CEdge (p',es',rets')\\\\<^sub>p n''\\ \\n \\ Entry\\\n obtain nx where edge:\"c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p nx\" and nx:\"nx \\ #:c\\<^sub>1 = n''\"\n apply - apply(erule Proc_CFG.cases,auto)\n by(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes label_incr_inj)+\n from edge have \"n' = nx \\ p = p' \\ es = es' \\ rets = rets'\" by (rule IH)\n with nx show ?case by auto\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ 1 -CEdge (p',es',rets')\\\\<^sub>p n''\\\n obtain nx where \"c\\<^sub>1 \\ n -CEdge (p',es',rets')\\\\<^sub>p nx \\ nx \\ 1 = n''\"\n proof(rule Proc_CFG.cases)\n fix c\\<^sub>2' nx etx nx' bx c\\<^sub>1'\n assume \"if (b) c\\<^sub>1 else c\\<^sub>2 = if (bx) c\\<^sub>1' else c\\<^sub>2'\"\n and \"n \\ 1 = nx \\ #:c\\<^sub>1' + 1\" and \"nx \\ Entry\"\n with \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\ obtain l where \"n = Label l\" and \"l \\ #:c\\<^sub>1\"\n by(cases n,auto,cases nx,auto)\n with \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\ have False\n by(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)\n thus ?thesis by simp\n qed (auto dest:label_incr_inj)\n then obtain nx where edge:\"c\\<^sub>1 \\ n -CEdge (p',es',rets')\\\\<^sub>p nx\" \n and nx:\"nx \\ 1 = n''\" by blast\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ #:c\\<^sub>1 + 1 -CEdge (p',es',rets')\\\\<^sub>p n''\\\n obtain nx where \"c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p nx \\ nx \\ #:c\\<^sub>1 + 1 = n''\"\n proof(rule Proc_CFG.cases)\n fix c\\<^sub>1' nx etx nx' bx c\\<^sub>2'\n assume ifs:\"if (b) c\\<^sub>1 else c\\<^sub>2 = if (bx) c\\<^sub>1' else c\\<^sub>2'\"\n and \"n \\ #:c\\<^sub>1 + 1 = nx \\ 1\" and \"nx \\ Entry\"\n and edge:\"c\\<^sub>1' \\ nx -etx\\\\<^sub>p nx'\"\n then obtain l where \"nx = Label l\" and \"l \\ #:c\\<^sub>1\"\n by(cases n,auto,cases nx,auto)\n with edge ifs have False\n by(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)\n thus ?thesis by simp\n qed (auto dest:label_incr_inj)\n then obtain nx where edge:\"c\\<^sub>2 \\ n -CEdge (p',es',rets')\\\\<^sub>p nx\"\n and nx:\"nx \\ #:c\\<^sub>1 + 1 = n''\"\n by blast\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n -CEdge (p',es',rets')\\\\<^sub>p n''\n \\ n' = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\while (b) c' \\ n \\ 2 -CEdge (p',es',rets')\\\\<^sub>p n''\\\n obtain nx where \"c' \\ n -CEdge (p',es',rets')\\\\<^sub>p nx \\ nx \\ 2 = n''\"\n by(rule Proc_CFG.cases,auto dest:label_incr_inj Proc_CFG_Call_Labels)\n then obtain nx where edge:\"c' \\ n -CEdge (p',es',rets')\\\\<^sub>p nx\" \n and nx:\"nx \\ 2 = n''\" by blast\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_WhileBodyExit c' n b)\n from \\c' \\ n -CEdge (p,es,rets)\\\\<^sub>p Exit\\ have False\n by(fastforce dest:Proc_CFG_Call_Labels)\n thus ?case by simp\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ Label 0 -CEdge (p',es',rets')\\\\<^sub>p n''\\\n have \"p = p' \\ es = es' \\ rets = rets' \\ n'' = Label 1\"\n by(auto elim:Proc_CFG.cases)\n then show ?case by simp\nqed\n\n\nlemma Proc_CFG_Call_nodes_eq':\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\\\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n have \"c\\<^sub>1 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(fastforce dest:Proc_CFG_Call_Labels)\n by(case_tac n',auto dest:Proc_CFG_targetlabel_less_num_nodes Proc_CFG_Call_Labels)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p Exit\\ have False\n by(fastforce dest:Proc_CFG_Call_Labels)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n' \\ #:c\\<^sub>1\\\n obtain nx where edge:\"c\\<^sub>2 \\ nx -CEdge (p',es',rets')\\\\<^sub>p n'\" and nx:\"nx \\ #:c\\<^sub>1 = n''\"\n apply - apply(erule Proc_CFG.cases,auto)\n by(cases n',\n auto dest:Proc_CFG_targetlabel_less_num_nodes Proc_CFG_Call_Labels \n label_incr_inj)\n from edge have \"n = nx \\ p = p' \\ es = es' \\ rets = rets'\" by (rule IH)\n with nx show ?case by auto\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n' \\ 1\\\n obtain nx where \"c\\<^sub>1 \\ nx -CEdge (p',es',rets')\\\\<^sub>p n' \\ nx \\ 1 = n''\"\n proof(cases)\n case (Proc_CFG_CondElse nx nx')\n from \\n' \\ 1 = nx' \\ #:c\\<^sub>1 + 1\\\n \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain l where \"n' = Label l\" and \"l \\ #:c\\<^sub>1\"\n by(cases n', auto dest:Proc_CFG_Call_Labels,cases nx',auto)\n with \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\ have False\n by(fastforce dest:Proc_CFG_targetlabel_less_num_nodes)\n thus ?thesis by simp\n qed (auto dest:label_incr_inj)\n then obtain nx where edge:\"c\\<^sub>1 \\ nx -CEdge (p',es',rets')\\\\<^sub>p n'\" \n and nx:\"nx \\ 1 = n''\"\n by blast\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n' \\ #:c\\<^sub>1 + 1\\\n obtain nx where \"c\\<^sub>2 \\ nx -CEdge (p',es',rets')\\\\<^sub>p n' \\ nx \\ #:c\\<^sub>1 + 1 = n''\"\n proof(cases)\n case (Proc_CFG_CondThen nx nx')\n from \\n' \\ #:c\\<^sub>1 + 1 = nx' \\ 1\\\n \\c\\<^sub>1 \\ nx -CEdge (p',es',rets')\\\\<^sub>p nx'\\\n obtain l where \"nx' = Label l\" and \"l \\ #:c\\<^sub>1\"\n by(cases n',auto,cases nx',auto dest:Proc_CFG_Call_Labels)\n with \\c\\<^sub>1 \\ nx -CEdge (p',es',rets')\\\\<^sub>p nx'\\\n have False by(fastforce dest:Proc_CFG_targetlabel_less_num_nodes)\n thus ?thesis by simp\n qed (auto dest:label_incr_inj)\n then obtain nx where edge:\"c\\<^sub>2 \\ nx -CEdge (p',es',rets')\\\\<^sub>p n'\" \n and nx:\"nx \\ #:c\\<^sub>1 + 1 = n''\"\n by blast\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n'\n \\ n = n'' \\ p = p' \\ es = es' \\ rets = rets'\\\n from \\while (b) c' \\ n'' -CEdge (p',es',rets')\\\\<^sub>p n' \\ 2\\\n obtain nx where edge:\"c' \\ nx -CEdge (p',es',rets')\\\\<^sub>p n'\" and nx:\"nx \\ 2 = n''\"\n by(rule Proc_CFG.cases,auto dest:label_incr_inj)\n from IH[OF edge] nx show ?case by simp\nnext\n case (Proc_CFG_WhileBodyExit c' n b)\n from \\c' \\ n -CEdge (p,es,rets)\\\\<^sub>p Exit\\\n have False by(fastforce dest:Proc_CFG_Call_Labels)\n thus ?case by simp\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ n'' -CEdge (p',es',rets')\\\\<^sub>p Label 1\\\n have \"p = p' \\ es = es' \\ rets = rets' \\ n'' = Label 0\"\n by(auto elim:Proc_CFG.cases)\n then show ?case by simp\nqed\n\n\nlemma Proc_CFG_Call_targetnode_no_Call_sourcenode:\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n' -CEdge (p',es',rets')\\\\<^sub>p n''\\ \n \\ False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n' -CEdge (p', es', rets')\\\\<^sub>p n'' \\ False\\\n from \\c\\<^sub>1;; c\\<^sub>2 \\ n' -CEdge (p',es',rets')\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n have \"c\\<^sub>1 \\ n' -CEdge (p',es',rets')\\\\<^sub>p n''\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(fastforce dest:Proc_CFG_Call_Labels)\n by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p Exit\\ have False\n by(fastforce dest:Proc_CFG_Call_Labels)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n' -CEdge (p', es', rets')\\\\<^sub>p n'' \\ False\\\n from \\c\\<^sub>1;; c\\<^sub>2 \\ n' \\ #:c\\<^sub>1 -CEdge (p', es', rets')\\\\<^sub>p n''\\ \\c\\<^sub>2 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c\\<^sub>2 \\ n' -CEdge (p',es',rets')\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n apply(fastforce dest:Proc_CFG_Call_Labels)\n by(cases n',auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n' -CEdge (p',es',rets')\\\\<^sub>p n'' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n' \\ 1 -CEdge (p', es', rets')\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c\\<^sub>1 \\ n' -CEdge (p',es',rets')\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply auto apply(case_tac n) apply auto\n apply(cases n') apply auto\n by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n' -CEdge (p',es',rets')\\\\<^sub>p n'' \\ False\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n' \\ #:c\\<^sub>1 + 1 -CEdge (p', es', rets')\\\\<^sub>p n''\\ \n \\c\\<^sub>2 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c\\<^sub>2 \\ n' -CEdge (p',es',rets')\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply auto\n apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(cases n',auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n' -CEdge (p',es',rets')\\\\<^sub>p n'' \\ False\\\n from \\while (b) c' \\ n' \\ 2 -CEdge (p', es', rets')\\\\<^sub>p n''\\ \\c' \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c' \\ n' -CEdge (p',es',rets')\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n by(cases n',auto,case_tac n,auto)+\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBodyExit c' n b)\n from \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\ \n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ Label 1 -CEdge (p', es', rets')\\\\<^sub>p n''\\\n show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_follows_id_edge:\n \"\\prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'; prog \\ n' -IEdge et\\\\<^sub>p n''\\ \\ et = \\id\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n' -IEdge et\\\\<^sub>p n'' \\ et = \\id\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n' -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\ \\n' \\ Exit\\\n obtain nx where \"c\\<^sub>1 \\ n' -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n from \\c\\<^sub>1 \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\\n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n' -IEdge et\\\\<^sub>p n'' \\ et = \\id\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n' \\ #:c\\<^sub>1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>2 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c\\<^sub>2 \\ n' -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(cases n',auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n note IH = \\\\n''. c\\<^sub>1 \\ n' -IEdge et\\\\<^sub>p n'' \\ et = \\id\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n' \\ 1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>1 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n \\n \\ Entry\\\n obtain nx where \"c\\<^sub>1 \\ n' -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply auto apply(case_tac n) apply auto\n apply(cases n') apply auto\n by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n note IH = \\\\n''. c\\<^sub>2 \\ n' -IEdge et\\\\<^sub>p n'' \\ et = \\id\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n' \\ #:c\\<^sub>1 + 1 -IEdge et\\\\<^sub>p n''\\ \\c\\<^sub>2 \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c\\<^sub>2 \\ n' -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply auto\n apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(cases n',auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBody c' n n' b)\n note IH = \\\\n''. c' \\ n' -IEdge et\\\\<^sub>p n'' \\ et = \\id\\\n from \\while (b) c' \\ n' \\ 2 -IEdge et\\\\<^sub>p n''\\ \\c' \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\\\n obtain nx where \"c' \\ n' -IEdge et\\\\<^sub>p nx\"\n apply - apply(erule Proc_CFG.cases,auto)\n apply(cases n') apply auto\n apply(cases n') apply auto apply(case_tac n) apply auto\n by(cases n',auto,case_tac n,auto)\n then show ?case by (rule IH)\nnext\n case (Proc_CFG_WhileBodyExit c' n et' b)\n from \\c' \\ n -CEdge (p, es, rets)\\\\<^sub>p Exit\\ \n show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n case Proc_CFG_Call\n from \\Call p es rets \\ Label 1 -IEdge et\\\\<^sub>p n''\\ show ?case\n by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_edge_det:\n \"\\prog \\ n -et\\\\<^sub>p n'; prog \\ n -et'\\\\<^sub>p n'\\ \\ et = et'\"\nproof(induct rule:Proc_CFG.induct)\n case Proc_CFG_Entry_Exit thus ?case by(fastforce dest:Proc_CFG_EntryD)\nnext\n case Proc_CFG_Entry thus ?case by(fastforce dest:Proc_CFG_EntryD)\nnext\n case Proc_CFG_Skip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_LAss thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_LAssSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case (Proc_CFG_SeqFirst c\\<^sub>1 n et n' c\\<^sub>2)\n note edge = \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\ \n note IH = \\c\\<^sub>1 \\ n -et'\\\\<^sub>p n' \\ et = et'\\\n from edge \\n' \\ Exit\\ obtain l where l:\"n' = Label l\" by (cases n') auto\n with edge have \"l < #:c\\<^sub>1\" by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n with \\c\\<^sub>1;;c\\<^sub>2 \\ n -et'\\\\<^sub>p n'\\ l have \"c\\<^sub>1 \\ n -et'\\\\<^sub>p n'\"\n by(fastforce elim:Proc_CFG.cases intro:Proc_CFG.intros dest:label_incr_ge)\n from IH[OF this] show ?case .\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n et c\\<^sub>2)\n note edge = \\c\\<^sub>1 \\ n -et\\\\<^sub>p Exit\\\n note IH = \\c\\<^sub>1 \\ n -et'\\\\<^sub>p Exit \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have \"l < #:c\\<^sub>1\" by(fastforce intro: Proc_CFG_sourcelabel_less_num_nodes)\n with \\c\\<^sub>1;;c\\<^sub>2 \\ n -et'\\\\<^sub>p Label #:c\\<^sub>1\\ l have \"c\\<^sub>1 \\ n -et'\\\\<^sub>p Exit\"\n by(fastforce elim:Proc_CFG.cases \n dest:Proc_CFG_targetlabel_less_num_nodes label_incr_ge)\n from IH[OF this] show ?case .\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n note edge = \\c\\<^sub>2 \\ n -et\\\\<^sub>p n'\\ \n note IH = \\c\\<^sub>2 \\ n -et'\\\\<^sub>p n' \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have \"l < #:c\\<^sub>2\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n with \\c\\<^sub>1;;c\\<^sub>2 \\ n \\ #:c\\<^sub>1 -et'\\\\<^sub>p n' \\ #:c\\<^sub>1\\ l have \"c\\<^sub>2 \\ n -et'\\\\<^sub>p n'\"\n by -(erule Proc_CFG.cases,\n (fastforce dest:Proc_CFG_sourcelabel_less_num_nodes label_incr_ge\n dest!:label_incr_inj)+)\n from IH[OF this] show ?case .\nnext\n case Proc_CFG_CondTrue thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_CondFalse thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n note edge = \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\\n note IH = \\c\\<^sub>1 \\ n -et'\\\\<^sub>p n' \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have \"l < #:c\\<^sub>1\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n with \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ 1 -et'\\\\<^sub>p n' \\ 1\\ l have \"c\\<^sub>1 \\ n -et'\\\\<^sub>p n'\"\n by -(erule Proc_CFG.cases,(fastforce dest:label_incr_ge label_incr_inj)+)\n from IH[OF this] show ?case .\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n note edge = \\c\\<^sub>2 \\ n -et\\\\<^sub>p n'\\\n note IH = \\c\\<^sub>2 \\ n -et'\\\\<^sub>p n' \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have \"l < #:c\\<^sub>2\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n with \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n \\ (#:c\\<^sub>1 + 1) -et'\\\\<^sub>p n' \\ (#:c\\<^sub>1 + 1)\\ l \n have \"c\\<^sub>2 \\ n -et'\\\\<^sub>p n'\"\n by -(erule Proc_CFG.cases,(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes \n label_incr_inj label_incr_ge label_incr_simp_rev)+)\n from IH[OF this] show ?case .\nnext\n case Proc_CFG_WhileTrue thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_WhileFalse thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_WhileFalseSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case (Proc_CFG_WhileBody c' n et n' b)\n note edge = \\c' \\ n -et\\\\<^sub>p n'\\\n note IH = \\c' \\ n -et'\\\\<^sub>p n' \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have less:\"l < #:c'\" \n by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n from edge \\n' \\ Exit\\ obtain l' where l':\"n' = Label l'\" by (cases n') auto\n with edge have \"l' < #:c'\" by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n with \\while (b) c' \\ n \\ 2 -et'\\\\<^sub>p n' \\ 2\\ l less l' have \"c' \\ n -et'\\\\<^sub>p n'\"\n by(fastforce elim:Proc_CFG.cases dest:label_incr_start_Node_smaller)\n from IH[OF this] show ?case .\nnext\n case (Proc_CFG_WhileBodyExit c' n et b)\n note edge = \\c' \\ n -et\\\\<^sub>p Exit\\\n note IH = \\c' \\ n -et'\\\\<^sub>p Exit \\ et = et'\\\n from edge \\n \\ Entry\\ obtain l where l:\"n = Label l\" by (cases n) auto\n with edge have \"l < #:c'\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n with \\while (b) c' \\ n \\ 2 -et'\\\\<^sub>p Label 0\\ l have \"c' \\ n -et'\\\\<^sub>p Exit\"\n by -(erule Proc_CFG.cases,auto dest:label_incr_start_Node_smaller)\n from IH[OF this] show ?case .\nnext\n case Proc_CFG_Call thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n case Proc_CFG_CallSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma WCFG_deterministic:\n \"\\prog \\ n\\<^sub>1 -et\\<^sub>1\\\\<^sub>p n\\<^sub>1'; prog \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n\\<^sub>1 = n\\<^sub>2; n\\<^sub>1' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et\\<^sub>1 = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\nproof(induct arbitrary:n\\<^sub>2 n\\<^sub>2' rule:Proc_CFG.induct)\n case (Proc_CFG_Entry_Exit prog)\n from \\prog \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Entry = n\\<^sub>2\\ \\Exit \\ n\\<^sub>2'\\\n have \"et\\<^sub>2 = IEdge (\\s. True)\\<^sub>\\\" by(fastforce dest:Proc_CFG_EntryD)\n thus ?case by simp\nnext\n case (Proc_CFG_Entry prog)\n from \\prog \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Entry = n\\<^sub>2\\ \\Label 0 \\ n\\<^sub>2'\\\n have \"et\\<^sub>2 = IEdge (\\s. False)\\<^sub>\\\" by(fastforce dest:Proc_CFG_EntryD)\n thus ?case by simp\nnext\n case Proc_CFG_Skip\n from \\Skip \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Exit \\ n\\<^sub>2'\\\n have False by(fastforce elim:Proc_CFG.cases)\n thus ?case by simp\nnext\n case (Proc_CFG_LAss V e)\n from \\V:=e \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Label 1 \\ n\\<^sub>2'\\\n have False by -(erule Proc_CFG.cases,auto)\n thus ?case by simp\nnext\n case (Proc_CFG_LAssSkip V e)\n from \\V:=e \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 1 = n\\<^sub>2\\ \\Exit \\ n\\<^sub>2'\\\n have False by -(erule Proc_CFG.cases,auto)\n thus ?case by simp\nnext\n case (Proc_CFG_SeqFirst c\\<^sub>1 n et n' c\\<^sub>2)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\ \\n = n\\<^sub>2\\ \\n' \\ n\\<^sub>2'\\\n have \"c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2' \\ (c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p Exit \\ n\\<^sub>2' = Label #:c\\<^sub>1)\"\n apply hypsubst_thin apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros)\n by(case_tac n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)+\n thus ?case\n proof\n assume \"c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\"\n from IH[OF this \\n = n\\<^sub>2\\ \\n' \\ n\\<^sub>2'\\] show ?case .\n next\n assume \"c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p Exit \\ n\\<^sub>2' = Label #:c\\<^sub>1\"\n hence edge:\"c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p Exit\" and n2':\"n\\<^sub>2' = Label #:c\\<^sub>1\" by simp_all\n from IH[OF edge \\n = n\\<^sub>2\\ \\n' \\ Exit\\] show ?case .\n qed\nnext\n case (Proc_CFG_SeqConnect c\\<^sub>1 n et c\\<^sub>2)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; Exit \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c\\<^sub>1 \\ n -et\\\\<^sub>p Exit\\ \\n = n\\<^sub>2\\ \\n \\ Entry\\\n \\Label #:c\\<^sub>1 \\ n\\<^sub>2'\\ have \"c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2' \\ Exit \\ n\\<^sub>2'\"\n apply hypsubst_thin apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros)\n by(case_tac n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)+\n from IH[OF this[THEN conjunct1] \\n = n\\<^sub>2\\ this[THEN conjunct2]]\n show ?case .\nnext\n case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\c\\<^sub>1;;c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c\\<^sub>2 \\ n -et\\\\<^sub>p n'\\ \\n \\ #:c\\<^sub>1 = n\\<^sub>2\\\n \\n' \\ #:c\\<^sub>1 \\ n\\<^sub>2'\\ \\n \\ Entry\\\n obtain nx where \"c\\<^sub>2 \\ n -et\\<^sub>2\\\\<^sub>p nx \\ nx \\ #:c\\<^sub>1 = n\\<^sub>2'\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros)\n apply(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n apply(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(fastforce dest:label_incr_inj)\n with \\n' \\ #:c\\<^sub>1 \\ n\\<^sub>2'\\ have edge:\"c\\<^sub>2 \\ n -et\\<^sub>2\\\\<^sub>p nx\" and neq:\"n' \\ nx\"\n by auto\n from IH[OF edge _ neq] show ?case by simp\nnext\n case (Proc_CFG_CondTrue b c\\<^sub>1 c\\<^sub>2)\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Label 1 \\ n\\<^sub>2'\\\n show ?case by -(erule Proc_CFG.cases,auto)\nnext\n case (Proc_CFG_CondFalse b c\\<^sub>1 c\\<^sub>2)\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Label (#:c\\<^sub>1 + 1) \\ n\\<^sub>2'\\\n show ?case by -(erule Proc_CFG.cases,auto)\nnext\n case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c\\<^sub>1 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c\\<^sub>1 \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\ \n \\n \\ 1 = n\\<^sub>2\\ \\n' \\ 1 \\ n\\<^sub>2'\\\n obtain nx where \"c\\<^sub>1 \\ n -et\\<^sub>2\\\\<^sub>p nx \\ n' \\ nx\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros simp del:One_nat_def)\n apply(drule label_incr_inj) apply(auto simp del:One_nat_def)\n apply(drule label_incr_simp_rev[OF sym])\n by(case_tac na,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\if (b) c\\<^sub>1 else c\\<^sub>2 \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c\\<^sub>2 \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\ \n \\n \\ #:c\\<^sub>1 + 1 = n\\<^sub>2\\ \\n' \\ #:c\\<^sub>1 + 1 \\ n\\<^sub>2'\\\n obtain nx where \"c\\<^sub>2 \\ n -et\\<^sub>2\\\\<^sub>p nx \\ n' \\ nx\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros simp del:One_nat_def)\n apply(drule label_incr_simp_rev)\n apply(case_tac na,auto,cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n by(fastforce dest:label_incr_inj)\n from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n case (Proc_CFG_WhileTrue b c')\n from \\while (b) c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Label 2 \\ n\\<^sub>2'\\\n show ?case by -(erule Proc_CFG.cases,auto)\nnext\n case (Proc_CFG_WhileFalse b c')\n from \\while (b) c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 0 = n\\<^sub>2\\ \\Label 1 \\ n\\<^sub>2'\\\n show ?case by -(erule Proc_CFG.cases,auto)\nnext\n case (Proc_CFG_WhileFalseSkip b c')\n from \\while (b) c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\Label 1 = n\\<^sub>2\\ \\Exit \\ n\\<^sub>2'\\\n show ?case by -(erule Proc_CFG.cases,auto dest:label_incr_ge)\nnext\n case (Proc_CFG_WhileBody c' n et n' b)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\while (b) c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c' \\ n -et\\\\<^sub>p n'\\ \\n \\ Entry\\\n \\n' \\ Exit\\ \\n \\ 2 = n\\<^sub>2\\ \\n' \\ 2 \\ n\\<^sub>2'\\\n obtain nx where \"c' \\ n -et\\<^sub>2\\\\<^sub>p nx \\ n' \\ nx\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros)\n apply(fastforce dest:label_incr_ge[OF sym])\n apply(fastforce dest:label_incr_inj)\n by(fastforce dest:label_incr_inj)\n from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n case (Proc_CFG_WhileBodyExit c' n et b)\n note IH = \\\\n\\<^sub>2 n\\<^sub>2'. \\c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; Exit \\ n\\<^sub>2'\\\n \\ \\Q Q'. et = IEdge (Q)\\<^sub>\\ \\ et\\<^sub>2 = IEdge (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\\\n from \\while (b) c' \\ n\\<^sub>2 -et\\<^sub>2\\\\<^sub>p n\\<^sub>2'\\ \\c' \\ n -et\\\\<^sub>p Exit\\ \\n \\ Entry\\\n \\n \\ 2 = n\\<^sub>2\\ \\Label 0 \\ n\\<^sub>2'\\\n obtain nx where \"c' \\ n -et\\<^sub>2\\\\<^sub>p nx \\ Exit \\ nx\"\n apply - apply(erule Proc_CFG.cases)\n apply(auto intro:Proc_CFG.intros)\n apply(fastforce dest:label_incr_ge[OF sym])\n by(fastforce dest:label_incr_inj)\n from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n case Proc_CFG_Call thus ?case by -(erule Proc_CFG.cases,auto)\nnext\n case Proc_CFG_CallSkip thus ?case by -(erule Proc_CFG.cases,auto)\nqed\n\n\nsubsection \\And now: the interprocedural CFG\\\n\nsubsubsection \\Statements containing calls\\\n\ntext \\A procedure is a tuple composed of its name, its input and output variables\n and its method body\\\n\ntype_synonym proc = \"(pname \\ vname list \\ vname list \\ cmd)\"\ntype_synonym procs = \"proc list\"\n\n\ntext \\\\containsCall\\ guarantees that a call to procedure p is in\n a certain statement.\\\n\ndeclare conj_cong[fundef_cong]\n\nfunction containsCall :: \n \"procs \\ cmd \\ pname list \\ pname \\ bool\"\nwhere \"containsCall procs Skip ps p \\ False\"\n | \"containsCall procs (V:=e) ps p \\ False\"\n | \"containsCall procs (c\\<^sub>1;;c\\<^sub>2) ps p \\ \n containsCall procs c\\<^sub>1 ps p \\ containsCall procs c\\<^sub>2 ps p\"\n | \"containsCall procs (if (b) c\\<^sub>1 else c\\<^sub>2) ps p \\ \n containsCall procs c\\<^sub>1 ps p \\ containsCall procs c\\<^sub>2 ps p\"\n | \"containsCall procs (while (b) c) ps p \\ \n containsCall procs c ps p\"\n | \"containsCall procs (Call q es' rets') ps p \\ p = q \\ ps = [] \\ \n (\\ins outs c ps'. ps = q#ps' \\ (q,ins,outs,c) \\ set procs \\\n containsCall procs c ps' p)\"\nby pat_completeness auto\ntermination containsCall\nby(relation \"measures [\\(procs,c,ps,p). length ps, \n \\(procs,c,ps,p). size c]\") auto\n\n\nlemmas containsCall_induct[case_names Skip LAss Seq Cond While Call] = \n containsCall.induct\n\n\nlemma containsCallcases: \n \"containsCall procs prog ps p\n \\ ps = [] \\ containsCall procs prog ps p \\ \n (\\q ins outs c ps'. ps = ps'@[q] \\ (q,ins,outs,c) \\ set procs \\\n containsCall procs c [] p \\ containsCall procs prog ps' q)\"\nproof(induct procs prog ps p rule:containsCall_induct)\n case (Call procs q es' rets' ps p)\n note IH = \\\\x y z ps'. \\ps = q#ps'; (q,x,y,z) \\ set procs;\n containsCall procs z ps' p\\\n \\ ps' = [] \\ containsCall procs z ps' p \\ \n (\\qx ins outs c psx. ps' = psx@[qx] \\ (qx,ins,outs,c) \\ set procs \\\n containsCall procs c [] p \\ \n containsCall procs z psx qx)\\\n from \\containsCall procs (Call q es' rets') ps p\\\n have \"p = q \\ ps = [] \\ \n (\\ins outs c ps'. ps = q#ps' \\ (q,ins,outs,c) \\ set procs \\\n containsCall procs c ps' p)\" by simp\n thus ?case\n proof\n assume assms:\"p = q \\ ps = []\"\n hence \"containsCall procs (Call q es' rets') ps p\" by simp\n with assms show ?thesis by simp\n next\n assume \"\\ins outs c ps'. ps = q#ps' \\ (q,ins,outs,c) \\ set procs \\\n containsCall procs c ps' p\"\n then obtain ins outs c ps' where \"ps = q#ps'\" and \"(q,ins,outs,c) \\ set procs\"\n and \"containsCall procs c ps' p\" by blast\n from IH[OF this] have \"ps' = [] \\ containsCall procs c ps' p \\\n (\\qx insx outsx cx psx. \n ps' = psx @ [qx] \\ (qx,insx,outsx,cx) \\ set procs \\\n containsCall procs cx [] p \\ containsCall procs c psx qx)\" .\n thus ?thesis\n proof\n assume assms:\"ps' = [] \\ containsCall procs c ps' p\"\n have \"containsCall procs (Call q es' rets') [] q\" by simp\n with assms \\ps = q#ps'\\ \\(q,ins,outs,c) \\ set procs\\ show ?thesis by fastforce\n next\n assume \"\\qx insx outsx cx psx. \n ps' = psx@[qx] \\ (qx,insx,outsx,cx) \\ set procs \\\n containsCall procs cx [] p \\ containsCall procs c psx qx\"\n then obtain qx insx outsx cx psx\n where \"ps' = psx@[qx]\" and \"(qx,insx,outsx,cx) \\ set procs\"\n and \"containsCall procs cx [] p\"\n and \"containsCall procs c psx qx\" by blast\n from \\(q,ins,outs,c) \\ set procs\\ \\containsCall procs c psx qx\\\n have \"containsCall procs (Call q es' rets') (q#psx) qx\" by fastforce\n with \\ps' = psx@[qx]\\ \\ps = q#ps'\\ \\(qx,insx,outsx,cx) \\ set procs\\\n \\containsCall procs cx [] p\\ show ?thesis by fastforce\n qed\n qed\nqed auto\n\n\n\nlemma containsCallE:\n \"\\containsCall procs prog ps p; \n \\ps = []; containsCall procs prog ps p\\ \\ P procs prog ps p;\n \\q ins outs c es' rets' ps'. \\ps = ps'@[q]; (q,ins,outs,c) \\ set procs; \n containsCall procs c [] p; containsCall procs prog ps' q\\ \n \\ P procs prog ps p\\ \\ P procs prog ps p\"\n by(auto dest:containsCallcases)\n\n\nlemma containsCall_in_proc: \n \"\\containsCall procs prog qs q; (q,ins,outs,c) \\ set procs; \n containsCall procs c [] p\\\n \\ containsCall procs prog (qs@[q]) p\"\nproof(induct procs prog qs q rule:containsCall_induct)\n case (Call procs qx esx retsx ps p')\n note IH = \\\\x y z psx. \\ps = qx#psx; (qx,x,y,z) \\ set procs;\n containsCall procs z psx p'; (p',ins,outs,c) \\ set procs; \n containsCall procs c [] p\\ \\ containsCall procs z (psx@[p']) p\\\n from \\containsCall procs (Call qx esx retsx) ps p'\\\n have \"p' = qx \\ ps = [] \\\n (\\insx outsx cx psx. ps = qx#psx \\ (qx,insx,outsx,cx) \\ set procs \\\n containsCall procs cx psx p')\" by simp\n thus ?case\n proof\n assume assms:\"p' = qx \\ ps = []\"\n with \\(p', ins, outs, c) \\ set procs\\ \\containsCall procs c [] p\\\n have \"containsCall procs (Call qx esx retsx) [p'] p\" by fastforce\n with assms show ?thesis by simp\n next\n assume \"\\insx outsx cx psx. ps = qx#psx \\ (qx,insx,outsx,cx) \\ set procs \\\n containsCall procs cx psx p'\"\n then obtain insx outsx cx psx where \"ps = qx#psx\" \n and \"(qx,insx,outsx,cx) \\ set procs\"\n and \"containsCall procs cx psx p'\" by blast\n from IH[OF this \\(p', ins, outs, c) \\ set procs\\ \n \\containsCall procs c [] p\\] \n have \"containsCall procs cx (psx @ [p']) p\" .\n with \\ps = qx#psx\\ \\(qx,insx,outsx,cx) \\ set procs\\\n show ?thesis by fastforce\n qed\nqed auto\n \n\nlemma containsCall_indirection:\n \"\\containsCall procs prog qs q; containsCall procs c ps p;\n (q,ins,outs,c) \\ set procs\\\n \\ containsCall procs prog (qs@q#ps) p\"\nproof(induct procs prog qs q rule:containsCall_induct)\n case (Call procs px esx retsx ps' p')\n note IH = \\\\x y z psx. \\ps' = px # psx; (px, x, y, z) \\ set procs;\n containsCall procs z psx p'; containsCall procs c ps p;\n (p', ins, outs, c) \\ set procs\\\n \\ containsCall procs z (psx @ p' # ps) p\\\n from \\containsCall procs (Call px esx retsx) ps' p'\\\n have \"p' = px \\ ps' = [] \\\n (\\insx outsx cx psx. ps' = px#psx \\ (px,insx,outsx,cx) \\ set procs \\\n containsCall procs cx psx p')\" by simp\n thus ?case\n proof\n assume \"p' = px \\ ps' = []\"\n with \\containsCall procs c ps p\\ \\(p', ins, outs, c) \\ set procs\\\n show ?thesis by fastforce\n next\n assume \"\\insx outsx cx psx. ps' = px#psx \\ (px,insx,outsx,cx) \\ set procs \\\n containsCall procs cx psx p'\"\n then obtain insx outsx cx psx where \"ps' = px#psx\" \n and \"(px,insx,outsx,cx) \\ set procs\"\n and \"containsCall procs cx psx p'\" by blast\n from IH[OF this \\containsCall procs c ps p\\\n \\(p', ins, outs, c) \\ set procs\\] \n have \"containsCall procs cx (psx @ p' # ps) p\" .\n with \\ps' = px#psx\\ \\(px,insx,outsx,cx) \\ set procs\\\n show ?thesis by fastforce\n qed\nqed auto\n\n\nlemma Proc_CFG_Call_containsCall:\n \"prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n' \\ containsCall procs prog [] p\"\nby(induct prog n et\\\"CEdge (p,es,rets)\" n' rule:Proc_CFG.induct,auto)\n\n\nlemma containsCall_empty_Proc_CFG_Call_edge: \n assumes \"containsCall procs prog [] p\"\n obtains l es rets l' where \"prog \\ Label l -CEdge (p,es,rets)\\\\<^sub>p Label l'\"\nproof(atomize_elim)\n from \\containsCall procs prog [] p\\\n show \"\\l es rets l'. prog \\ Label l -CEdge (p,es,rets)\\\\<^sub>p Label l'\"\n proof(induct procs prog ps\\\"[]::pname list\" p rule:containsCall_induct)\n case Seq thus ?case\n by auto(fastforce dest:Proc_CFG_SeqFirst,fastforce dest:Proc_CFG_SeqSecond)\n next\n case Cond thus ?case\n by auto(fastforce dest:Proc_CFG_CondThen,fastforce dest:Proc_CFG_CondElse)\n next\n case While thus ?case by(fastforce dest:Proc_CFG_WhileBody)\n next\n case Call thus ?case by(fastforce intro:Proc_CFG_Call)\n qed auto\nqed\n\n\nsubsubsection\\The edges of the combined CFG\\\n\ntype_synonym node = \"(pname \\ label)\"\ntype_synonym edge = \"(node \\ (vname,val,node,pname) edge_kind \\ node)\"\n\nfun get_proc :: \"node \\ pname\"\n where \"get_proc (p,l) = p\"\n\n\ninductive PCFG :: \n \"cmd \\ procs \\ node \\ (vname,val,node,pname) edge_kind \\ node \\ bool\" \n(\"_,_ \\ _ -_\\ _\" [51,51,0,0,0] 81)\nfor prog::cmd and procs::procs\nwhere\n\n Main:\n \"prog \\ n -IEdge et\\\\<^sub>p n' \\ prog,procs \\ (Main,n) -et\\ (Main,n')\"\n\n| Proc:\n \"\\(p,ins,outs,c) \\ set procs; c \\ n -IEdge et\\\\<^sub>p n'; \n containsCall procs prog ps p\\ \n \\ prog,procs \\ (p,n) -et\\ (p,n')\"\n\n\n| MainCall:\n \"\\prog \\ Label l -CEdge (p,es,rets)\\\\<^sub>p n'; (p,ins,outs,c) \\ set procs\\\n \\ prog,procs \\ (Main,Label l) \n -(\\s. True):(Main,n')\\\\<^bsub>p\\<^esub>map (\\e cf. interpret e cf) es\\ (p,Entry)\"\n\n| ProcCall:\n \"\\(p,ins,outs,c) \\ set procs; c \\ Label l -CEdge (p',es',rets')\\\\<^sub>p Label l';\n (p',ins',outs',c') \\ set procs; containsCall procs prog ps p\\\n \\ prog,procs \\ (p,Label l) \n -(\\s. True):(p,Label l')\\\\<^bsub>p'\\<^esub>map (\\e cf. interpret e cf) es'\\ (p',Entry)\"\n\n| MainReturn:\n \"\\prog \\ Label l -CEdge (p,es,rets)\\\\<^sub>p Label l'; (p,ins,outs,c) \\ set procs\\\n \\ prog,procs \\ (p,Exit) -(\\cf. snd cf = (Main,Label l'))\\\\<^bsub>p\\<^esub>\n (\\cf cf'. cf'(rets [:=] map cf outs))\\ (Main,Label l')\"\n\n| ProcReturn:\n \"\\(p,ins,outs,c) \\ set procs; c \\ Label l -CEdge (p',es',rets')\\\\<^sub>p Label l'; \n (p',ins',outs',c') \\ set procs; containsCall procs prog ps p\\\n \\ prog,procs \\ (p',Exit) -(\\cf. snd cf = (p,Label l'))\\\\<^bsub>p'\\<^esub>\n (\\cf cf'. cf'(rets' [:=] map cf outs'))\\ (p,Label l')\"\n\n| MainCallReturn:\n \"prog \\ n -CEdge (p,es,rets)\\\\<^sub>p n'\n \\ prog,procs \\ (Main,n) -(\\s. False)\\<^sub>\\\\ (Main,n')\"\n\n| ProcCallReturn:\n \"\\(p,ins,outs,c) \\ set procs; c \\ n -CEdge (p',es',rets')\\\\<^sub>p n'; \n containsCall procs prog ps p\\ \n \\ prog,procs \\ (p,n) -(\\s. False)\\<^sub>\\\\ (p,n')\"\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/Proc/PCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2604192571459823}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m1_keydist_iirn.thy (Isabelle/HOL 2016-1)\n ID: $Id: m1_keydist_iirn.thy 133854 2017-03-20 17:53:50Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n\n Key distribution protocols\n Level 1, 1st refinement: Abstract server-based key transport protocol with \n initiator and responder roles. Provides injective server authentication to \n the initiator and non-injective server authenticaiton to the responder.\n\n Copyright (c) 2009-2016 Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Abstract (i/n)-authenticated key transport (L1)\\\n\ntheory m1_keydist_iirn imports m1_keydist \"../Refinement/a0i_agree\"\nbegin\n\ntext \\We add authentication for the initiator and responder to the basic\nserver-based key transport protocol: \n\\begin{enumerate}\n\\item the initiator injectively agrees with the server on the key and some\nadditional data\n\\item the responder non-injectively agrees with the server on the key and \nsome additional data.\n\\end{enumerate}\nThe \"additional data\" is a parameter of this model.\\\n\ndeclare option.split [split]\n(* declare option.split_asm [split] *)\n\nconsts\n na :: \"nat\"\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\The state type remains the same, but in this model we will record\nnonces and timestamps in the run frame.\\\n\ntype_synonym m1a_state = \"m1x_state\"\ntype_synonym m1a_obs = \"m1x_obs\"\n\ntype_synonym 'x m1a_pred = \"'x m1x_pred\"\ntype_synonym 'x m1a_trans = \"'x m1x_trans\"\n\n\ntext \\We need some parameters regarding the list of freshness values\nstored by the server. These should be defined in further refinements.\\\n\nconsts \n is_len :: \"nat\" \\ \\num of agreeing list elements for initiator-server\\ \n rs_len :: \"nat\" \\ \\num of agreeing list elements for responder-server\\\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m1x_step1\"}\\\n m1a_step1 :: \"[rid_t, agent, agent, nonce] \\ 'x m1r_trans\"\nwhere\n \"m1a_step1 Ra A B Na \\ {(s, s1).\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n Na = Ra$na \\ \\ \\NEW: generate a nonce\\\n\n \\ \\actions:\\\n \\ \\create initiator thread\\\n s1 = s\\ runs := (runs s)(Ra \\ (Init, [A, B], [])) \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term \"m1x_step2\"}\\\n m1a_step2 :: \"[rid_t, agent, agent] \\ 'x m1r_trans\"\nwhere\n \"m1a_step2 \\ m1x_step2\"\n\ndefinition \\ \\by @{term \"Server\"}, refines @{term m1x_step3}\\\n m1a_step3 :: \"[rid_t, agent, agent, key, nonce, atom list] \\ 'x m1r_trans\"\nwhere\n \"m1a_step3 Rs A B Kab Na al \\ {(s, s1).\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\fresh run id\\\n Kab = sesK (Rs$sk) \\ \\ \\generate session key\\\n\n \\ \\actions:\\\n s1 = s\\ runs := (runs s)(Rs \\ (Serv, [A, B], aNon Na # al)) \\\n }\"\n\ndefinition \\ \\by @{text \"A\"}, refines @{term m1x_step4}\\\n m1a_step4 :: \"[rid_t, agent, agent, nonce, key, atom list] \\ 'x m1a_trans\"\nwhere\n \"m1a_step4 Ra A B Na Kab nla \\ {(s, s').\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\\n (Kab \\ leak s \\ (Kab, A) \\ azC (runs s)) \\ \\ \\authorization guard\\\n Na = Ra$na \\ \\ \\fix parameter\\\n\n \\ \\new guard for agreement with server on \\(Kab, B, Na, isl)\\,\\\n \\ \\where \\isl = take is_len nla\\; injectiveness by including \\Na\\\\\n (A \\ bad \\ (\\Rs. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], aNon Na # take is_len nla))) \\\n\n \\ \\actions:\\\n s' = s\\ runs := (runs s)(Ra \\ (Init, [A, B], aKey Kab # nla)) \\\n }\" \n\ndefinition \\ \\by @{term \"B\"}, refines @{term m1x_step5}\\\n m1a_step5 :: \"[rid_t, agent, agent, key, atom list] \\ 'x m1a_trans\"\nwhere\n \"m1a_step5 Rb A B Kab nlb \\ {(s, s1). \n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \n (Kab \\ leak s \\ (Kab, B) \\ azC (runs s)) \\ \\ \\authorization guard\\\n\n \\ \\guard for showing agreement with server on \\(Kab, A, rsl)\\,\\\n \\ \\where \\rsl = take rs_len nlb\\; this agreement is non-injective\\\n\n (B \\ bad \\ (\\Rs Na. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], aNon Na # take rs_len nlb))) \\\n\n \\ \\actions:\\\n s1 = s\\ runs := (runs s)(Rb \\ (Resp, [A, B], aKey Kab # nlb)) \\\n }\"\n\ndefinition \\ \\by attacker, refines @{term m1x_leak}\\\n m1a_leak :: \"rid_t \\ 'x m1x_trans\"\nwhere\n \"m1a_leak = m1x_leak\" \n\n\n(******************************************************************************)\nsubsection \\Specification\\\n(******************************************************************************)\n\ndefinition\n m1a_init :: \"m1a_state set\"\nwhere\n \"m1a_init \\ m1x_init\" \n\ndefinition \n m1a_trans :: \"'x m1a_trans\" where\n \"m1a_trans \\ (\\A B Ra Rb Rs Na Kab nls nla nlb.\n m1a_step1 Ra A B Na \\\n m1a_step2 Rb A B \\\n m1a_step3 Rs A B Kab Na nls \\\n m1a_step4 Ra A B Na Kab nla \\\n m1a_step5 Rb A B Kab nlb \\\n m1a_leak Rs \\\n Id\n )\"\n\ndefinition \n m1a :: \"(m1a_state, m1a_obs) spec\" where\n \"m1a \\ \\\n init = m1a_init,\n trans = m1a_trans,\n obs = id\n \\\" \n\nlemma init_m1a: \"init m1a = m1a_init\"\nby (simp add: m1a_def)\n\nlemma trans_m1a: \"trans m1a = m1a_trans\"\nby (simp add: m1a_def)\n\nlemma obs_m1a [simp]: \"obs m1a = id\"\nby (simp add: m1a_def)\n\nlemmas m1a_loc_defs = \n m1a_def m1a_init_def m1a_trans_def\n m1a_step1_def m1a_step2_def m1a_step3_def m1a_step4_def m1a_step5_def \n m1a_leak_def \n\nlemmas m1a_defs = m1a_loc_defs m1x_defs\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv0: Finite domain\\\n(*inv**************************************************************************)\n\ntext \\There are only finitely many runs. This is needed to establish\nthe responder/initiator agreement.\\\n\ndefinition \n m1a_inv0_fin :: \"'x m1r_pred\"\nwhere\n \"m1a_inv0_fin \\ {s. finite (dom (runs s))}\"\n\nlemmas m1a_inv0_finI = m1a_inv0_fin_def [THEN setc_def_to_intro, rule_format]\nlemmas m1a_inv0_finE [elim] = m1a_inv0_fin_def [THEN setc_def_to_elim, rule_format]\nlemmas m1a_inv0_finD = m1a_inv0_fin_def [THEN setc_def_to_dest, rule_format]\n\ntext \\Invariance proof.\\\n\nlemma PO_m1a_inv0_fin_init [iff]:\n \"init m1a \\ m1a_inv0_fin\"\nby (auto simp add: m1a_defs intro!: m1a_inv0_finI)\n\n\n\nlemma PO_m1a_inv0_fin [iff]: \"reach m1a \\ m1a_inv0_fin\"\nby (rule inv_rule_incr, auto del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\m1x\\\\\n(******************************************************************************)\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\Define run abstraction.\\\n\nfun \n rm1x1a :: \"role_t \\ atom list \\ atom list\"\nwhere\n \"rm1x1a Init = take 1\" \\ \\take \\Kab\\ from \\Kab # nla\\\\\n| \"rm1x1a Resp = take 1\" \\ \\take \\Kab\\ from \\Kab # nlb\\\\\n| \"rm1x1a Serv = take 0\" \\ \\drop all from \\[Na]\\\\\n\nabbreviation \n runs1x1a :: \"runs_t \\ runs_t\" where \n \"runs1x1a \\ map_runs rm1x1a\"\n\ntext \\med1x1: The mediator function maps a concrete observation to an \nabstract one.\\\n\ndefinition\n med1x1a :: \"m1a_obs \\ m1x_obs\" where\n \"med1x1a t \\ \\ runs = runs1x1a (runs t), leak = leak t \\\"\n\ntext \\R1x1a: The simulation relation is defined in terms of the mediator\nfunction.\\\n\ndefinition\n R1x1a :: \"(m1x_state \\ m1a_state) set\" where\n \"R1x1a \\ {(s, t). s = med1x1a t}\"\n\nlemmas R1x1a_defs = \n R1x1a_def med1x1a_def \n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_m1x_step1:\n \"{R1x1a} \n (m1x_step1 Ra A B), (m1a_step1 Ra A B Na) \n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_m1x_step2:\n \"{R1x1a} \n (m1x_step2 Rb A B), (m1a_step2 Rb A B) \n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_m1x_step3:\n \"{R1x1a} \n (m1x_step3 Rs A B Kab), (m1a_step3 Rs A B Kab Na nls)\n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step4_refines_m1x_step4:\n \"{R1x1a} \n (m1x_step4 Ra A B Kab), (m1a_step4 Ra A B Na Kab nla) \n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\nlemma PO_m1a_step5_refines_m1x_step5:\n \"{R1x1a} \n (m1x_step5 A B Rb Kab), (m1a_step5 A B Rb Kab nlb) \n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\nlemma PO_m1a_leak_refines_m1x_leak:\n \"{R1x1a} \n (m1x_leak Rs), (m1a_leak Rs) \n {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\n\ntext \\All together now...\\\n\nlemmas PO_m1a_trans_refines_m1x_trans = \n PO_m1a_step1_refines_m1x_step1 PO_m1a_step2_refines_m1x_step2\n PO_m1a_step3_refines_m1x_step3 PO_m1a_step4_refines_m1x_step4\n PO_m1a_step5_refines_m1x_step5 PO_m1a_leak_refines_m1x_leak\n\n\nlemma PO_m1a_refines_init_m1x [iff]:\n \"init m1a \\ R1x1a``(init m1x)\"\nby (auto simp add: R1x1a_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_m1x [iff]:\n \"{R1x1a} \n (trans m1x), (trans m1a) \n {> R1x1a}\"\napply (auto simp add: m1a_def m1a_trans_def m1x_def m1x_trans_def\n intro!: PO_m1a_trans_refines_m1x_trans)\napply (force intro!: PO_m1a_trans_refines_m1x_trans)+\ndone\n\ntext \\Observation consistency.\\\n\nlemma obs_consistent_med1x1a [iff]: \n \"obs_consistent R1x1a med1x1a m1x m1a\"\nby (auto simp add: obs_consistent_def R1x1a_def m1a_defs)\n\n\ntext \\Refinement result.\\\n\nlemma PO_m1a_refines_m1x [iff]: \n \"refines R1x1a med1x1a m1x m1a\"\nby (rule Refinement_basic) (auto del: subsetI)\n\nlemma m1a_implements_m1x [iff]: \"implements med1x1a m1x m1a\"\nby (rule refinement_soundness) (fast)\n\ntext \\By transitivity:\\\n\nlemma m1a_implements_s0g [iff]: \"implements (med01x o med1x1a) s0g m1a\"\nby (rule implements_trans, auto)\n\n\nsubsubsection \\inv (inherited): Secrecy\\\n(*invh*************************************************************************)\n\ntext \\Secrecy preserved from \\m1x\\.\\\n\nlemma knC_runs1x1a [simp]: \"knC (runs1x1a runz) = knC runz\"\napply (auto simp add: map_runs_def elim!: knC.cases, auto)\n\\ \\5 subgoals\\\napply (rename_tac b, case_tac b, auto)\napply (rename_tac b, case_tac b, auto)\napply (rule knC_init, auto simp add: map_runs_def)\napply (rule knC_resp, auto simp add: map_runs_def)\napply (rule knC_serv, auto simp add: map_runs_def)\ndone\n\nlemma PO_m1a_obs_secrecy [iff]: \"oreach m1a \\ m1x_secrecy\"\napply (rule_tac Q=m1x_secrecy in external_invariant_translation)\napply (auto del: subsetI)\napply (auto simp add: med1x1a_def m1x_secrecy_def)\ndone\n\nlemma PO_m1a_secrecy [iff]: \"reach m1a \\ m1x_secrecy\"\nby (rule external_to_internal_invariant) (auto del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\a0i\\ for initiator/server\\\n(******************************************************************************)\n\ntext \\For the initiator, we get an injective agreement with the server on \nthe session key, the responder name, the initiator's nonce and the list of \nfreshness values @{term \"isl\"}.\\\n\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed initiator and server runs.\\\n\ntype_synonym \n issig = \"key \\ agent \\ nonce \\ atom list\"\n\nfun\n is_runs2sigs :: \"runs_t \\ issig signal \\ nat\"\nwhere\n \"is_runs2sigs runz (Running [A, Sv] (Kab, B, Na, nl)) = \n (if \\Rs. Kab = sesK (Rs$sk) \\ \n runz Rs = Some (Serv, [A, B], aNon Na # nl) \n then 1 else 0)\"\n\n| \"is_runs2sigs runz (Commit [A, Sv] (Kab, B, Na, nl)) = \n (if \\Ra nla. Na = Ra$na \\ \n runz Ra = Some (Init, [A, B], aKey Kab # nla) \\ \n take is_len nla = nl\n then 1 else 0)\"\n\n| \"is_runs2sigs runz _ = 0\"\n\n\ntext \\Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\\n\ndefinition \n med_a0m1a_is :: \"m1a_obs \\ issig a0i_obs\" where\n \"med_a0m1a_is o1 \\ \\ signals = is_runs2sigs (runs o1), corrupted = {} \\\"\n\ndefinition\n R_a0m1a_is :: \"(issig a0i_state \\ m1a_state) set\" where\n \"R_a0m1a_is \\ {(s, t). signals s = is_runs2sigs (runs t) \\ corrupted s = {} }\"\n\nlemmas R_a0m1a_is_defs = R_a0m1a_is_def med_a0m1a_is_def \n\n\nsubsubsection \\Lemmas about the auxiliary functions\\\n(******************************************************************************)\n\nlemma is_runs2sigs_empty [simp]: \n \"runz = Map.empty \\ is_runs2sigs runz = (\\s. 0)\"\nby (rule ext, erule rev_mp) \n (rule is_runs2sigs.induct, auto)\n\n\ntext \\Update lemmas\\\n\nlemma is_runs2sigs_upd_init_none [simp]:\n \"\\ Ra \\ dom runz \\\n \\ is_runs2sigs (runz(Ra \\ (Init, [A, B], []))) = is_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n (rule is_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma is_runs2sigs_upd_resp_none [simp]:\n \"\\ Rb \\ dom runz \\\n \\ is_runs2sigs (runz(Rb \\ (Resp, [A, B], []))) = is_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n (rule is_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma is_runs2sigs_upd_serv [simp]:\n \"\\ Rs \\ dom runz \\\n \\ is_runs2sigs (runz(Rs \\ (Serv, [A, B], aNon Na # ils))) = \n (is_runs2sigs runz)(Running [A, Sv] (sesK (Rs$sk), B, Na, ils) := 1)\"\napply (rule ext, (erule rev_mp)+) \napply (rule is_runs2sigs.induct)\napply (safe, simp_all)+\napply (fastforce simp add: domIff)+\ndone\n\nlemma is_runs2sigs_upd_init_some [simp]:\n \"\\ runz Ra = Some (Init, [A, B], []); ils = take is_len nla \\\n \\ is_runs2sigs (runz(Ra \\ (Init, [A, B], aKey Kab # nla))) =\n (is_runs2sigs runz)(Commit [A, Sv] (Kab, B, Ra$na, ils) := 1)\"\napply (rule ext, (erule rev_mp)+)\napply (rule is_runs2sigs.induct)\napply (safe, simp_all)+ \napply (fastforce)+\ndone\n\nlemma is_runs2sigs_upd_resp_some [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], []) \\\n \\ is_runs2sigs (runz(Rb \\ (Resp, [A, B], aKey Kab # nlb))) =\n is_runs2sigs runz\" \napply (rule ext, erule rev_mp)\napply (rule is_runs2sigs.induct, auto) \ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_a0_is_skip:\n \"{R_a0m1a_is} \n Id, (m1a_step1 Ra A B Na) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_a0_is_skip:\n \"{R_a0m1a_is} \n Id, (m1a_step2 Rb A B) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_a0_is_running:\n \"{R_a0m1a_is} \n (a0i_running [A, Sv] (Kab, B, Na, nls)), \n (m1a_step3 Rs A B Kab Na nls) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs a0i_defs m1a_defs \n dest: dom_lemmas)\n\nlemma PO_m1a_step4_refines_a0_is_commit:\n \"{R_a0m1a_is \\ UNIV \\ m1a_inv0_fin} \n (a0i_commit [A, Sv] (Kab, B, Na, take is_len nla)), \n (m1a_step4 Ra A B Na Kab nla) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs a0i_defs m1a_defs)\n\nlemma PO_m1a_step5_refines_a0_is_skip:\n \"{R_a0m1a_is} \n Id, (m1a_step5 A B Rb Kab nlb) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\nlemma PO_m1a_leak_refines_a0_is_skip:\n \"{R_a0m1a_is} \n Id, (m1a_leak Rs) \n {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\ntext \\All together now...\\\n\nlemmas PO_m1a_trans_refines_a0_is_trans = \n PO_m1a_step1_refines_a0_is_skip PO_m1a_step2_refines_a0_is_skip\n PO_m1a_step3_refines_a0_is_running PO_m1a_step4_refines_a0_is_commit\n PO_m1a_step5_refines_a0_is_skip PO_m1a_leak_refines_a0_is_skip\n \n\nlemma PO_m1a_refines_init_a0_is [iff]:\n \"init m1a \\ R_a0m1a_is``(init a0i)\"\nby (auto simp add: R_a0m1a_is_defs a0i_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_a0_is [iff]:\n \"{R_a0m1a_is \\ a0i_inv1_iagree \\ m1a_inv0_fin} \n (trans a0i), (trans m1a) \n {> R_a0m1a_is}\"\nby (force simp add: m1a_def m1a_trans_def a0i_def a0i_trans_def\n intro!: PO_m1a_trans_refines_a0_is_trans)\n\nlemma obs_consistent_med_a0m1a_is [iff]: \n \"obs_consistent R_a0m1a_is med_a0m1a_is a0i m1a\"\nby (auto simp add: obs_consistent_def R_a0m1a_is_def med_a0m1a_is_def \n a0i_def m1a_def)\n\ntext \\Refinement result.\\\n\nlemma PO_m1a_refines_a0_is [iff]: \n \"refines (R_a0m1a_is \\ a0i_inv1_iagree \\ m1a_inv0_fin) med_a0m1a_is a0i m1a\"\nby (rule Refinement_using_invariants) \n (auto del: subsetI)\n\nlemma m1a_implements_a0_is: \"implements med_a0m1a_is a0i m1a\"\nby (rule refinement_soundness) (fast)\n\n\nsubsubsection \\inv2i (inherited): Initiator and server\\\n(*invh*************************************************************************)\n\ntext \\This is a translation of the agreement property to Level 1. It\nfollows from the refinement and is needed to prove inv1.\\\n\ndefinition \n m1a_inv2i_serv :: \"'x m1x_state_scheme set\"\nwhere\n \"m1a_inv2i_serv \\ {s. \\A B Ra Kab nla.\n A \\ bad \\\n runs s Ra = Some (Init, [A, B], aKey Kab # nla) \\\n (\\Rs. Kab = sesK (Rs$sk) \\ \n runs s Rs = Some (Serv, [A, B], aNon (Ra$na) # take is_len nla))\n }\"\n\nlemmas m1a_inv2i_servI = \n m1a_inv2i_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1a_inv2i_servE = (* DO NOT declare elim: leads to slow proofs! *)\n m1a_inv2i_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1a_inv2i_servD = (* DO NOT declare dest: leads to slow proofs! *)\n m1a_inv2i_serv_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Invariance proof, see below after init/serv authentication proof.\\\n\nlemma PO_m1a_inv2i_serv [iff]:\n \"reach m1a \\ m1a_inv2i_serv\"\napply (rule INV_from_Refinement_basic [OF PO_m1a_refines_a0_is])\napply (auto simp add: R_a0m1a_is_def a0i_inv1_iagree_def \n intro!: m1a_inv2i_servI)\napply (drule_tac x=\"[A, Sv]\" in spec, force)\ndone\n\n\nsubsubsection \\inv1: Key freshness for initiator\\\n(*inv**************************************************************************)\n\ntext \\The initiator obtains key freshness from the injective agreement\nwith the server AND the fact that there is only one server run with a \ngiven key.\\\n\ndefinition \n m1a_inv1_ifresh :: \"'x m1a_pred\"\nwhere\n \"m1a_inv1_ifresh \\ {s. \\A A' B B' Ra Ra' Kab nl nl'.\n runs s Ra = Some (Init, [A, B], aKey Kab # nl) \\\n runs s Ra' = Some (Init, [A', B'], aKey Kab # nl') \\\n A \\ bad \\ B \\ bad \\ Kab \\ leak s \\\n Ra = Ra'\n }\"\n\nlemmas m1a_inv1_ifreshI = m1a_inv1_ifresh_def [THEN setc_def_to_intro, rule_format]\nlemmas m1a_inv1_ifreshE [elim] = m1a_inv1_ifresh_def [THEN setc_def_to_elim, rule_format]\nlemmas m1a_inv1_ifreshD = m1a_inv1_ifresh_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proof\\\n\nlemma PO_m1a_inv1_ifresh_init [iff]:\n \"init m1a \\ m1a_inv1_ifresh\"\nby (auto simp add: m1a_defs intro!: m1a_inv1_ifreshI)\n\n\nlemma PO_m1a_inv1_ifresh_step4:\n \"{m1a_inv1_ifresh \\ m1a_inv2i_serv \\ m1x_secrecy} \n m1a_step4 Ra A B Na Kab nla\n {> m1a_inv1_ifresh}\"\nproof (auto simp add: PO_hoare_defs m1a_defs intro!: m1a_inv1_ifreshI, (* UGLY *)\n auto dest: m1a_inv1_ifreshD, auto dest: m1a_inv2i_servD)\n fix Rs Ra' A' B' nl' s \n assume H: \n \"(sesK (Rs $ sk), A) \\ azC (runs s)\" \"sesK (Rs $ sk) \\ leak s\" \n \"A \\ bad\" \"B \\ bad\" \"Ra' \\ Ra\"\n \"runs s Ra = Some (Init, [A, B], [])\" \n \"runs s Rs = Some (Serv, [A, B], aNon (Ra $ na) # take is_len nla)\" \n \"runs s Ra' = Some (Init, [A', B'], aKey (sesK (Rs $ sk)) # nl')\"\n \"s \\ m1x_secrecy\" \"s \\ m1a_inv2i_serv\" \n thus False\n proof (cases \"A' \\ bad\")\n case True \n from H have \"(sesK (Rs$sk), A') \\ azC (runs s)\" by (elim m1x_secrecyE, auto) \n with H True show ?thesis by (elim azC.cases) (auto dest: m1a_inv2i_servD) \n next \n case False thus ?thesis using H by (auto dest: m1a_inv2i_servD)\n qed\nnext\n fix A' B' Ra' nl s\n assume \n \"(Kab, A) \\ azC (runs s)\" \"Kab \\ leak s\" \n \"A' \\ bad\" \"B' \\ bad\" \"A \\ bad\" \"Ra' \\ Ra\"\n \"runs s Ra' = Some (Init, [A', B'], aKey Kab # nl)\"\n \"runs s Ra = Some (Init, [A, B], [])\"\n \"s \\ m1a_inv2i_serv\" \n thus False \n by (elim azC.cases, auto dest: m1a_inv2i_servD)\nqed \n\nlemma PO_m1a_inv1_ifresh_trans [iff]:\n \"{m1a_inv1_ifresh \\ m1a_inv2i_serv \\ m1x_secrecy} trans m1a {> m1a_inv1_ifresh}\"\nproof (simp add: m1a_def m1a_trans_def, safe)\n fix Ra A B Kab Ts nla\n show\n \"{m1a_inv1_ifresh \\ m1a_inv2i_serv \\ m1x_secrecy} \n m1a_step4 Ra A B Kab Ts nla\n {> m1a_inv1_ifresh}\"\n by (rule PO_m1a_inv1_ifresh_step4)\nqed (auto simp add: PO_hoare_defs m1a_defs intro!: m1a_inv1_ifreshI)\n\nlemma PO_m1a_inv1_ifresh [iff]: \"reach m1a \\ m1a_inv1_ifresh\"\nby (rule_tac J=\" m1a_inv2i_serv \\ m1x_secrecy\" in inv_rule_incr) \n (auto simp add: Int_assoc del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\a0n\\ for responder/server\\\n(******************************************************************************)\n\ntext \\For the responder, we get a non-injective agreement with the server on \nthe session key, the initiator's name, and additional data.\\\n\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed responder and server runs.\\\n\ntype_synonym\n rssig = \"key \\ agent \\ atom list\"\n\nabbreviation\n rs_commit :: \"[runs_t, agent, agent, key, atom list] \\ rid_t set\" \nwhere\n \"rs_commit runz A B Kab rsl \\ {Rb. \\nlb. \n runz Rb = Some (Resp, [A, B], aKey Kab # nlb) \\ take rs_len nlb = rsl \n }\"\n\nfun\n rs_runs2sigs :: \"runs_t \\ rssig signal \\ nat\"\nwhere\n \"rs_runs2sigs runz (Running [B, Sv] (Kab, A, rsl)) = \n (if (\\Rs Na. Kab = sesK (Rs$sk) \\ \n runz Rs = Some (Serv, [A, B], aNon Na # rsl)) \n then 1 else 0)\"\n\n| \"rs_runs2sigs runz (Commit [B, Sv] (Kab, A, rsl)) = \n card (rs_commit runz A B Kab rsl)\"\n\n| \"rs_runs2sigs runz _ = 0\"\n\n\ntext \\Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\\n\ndefinition \n med_a0m1a_rs :: \"m1a_obs \\ rssig a0n_obs\" where\n \"med_a0m1a_rs o1 \\ \\ signals = rs_runs2sigs (runs o1), corrupted = {} \\\"\n\ndefinition\n R_a0m1a_rs :: \"(rssig a0n_state \\ m1a_state) set\" where\n \"R_a0m1a_rs \\ {(s, t). signals s = rs_runs2sigs (runs t) \\ corrupted s = {} }\"\n\nlemmas R_a0m1a_rs_defs = R_a0m1a_rs_def med_a0m1a_rs_def \n\n\nsubsubsection \\Lemmas about the auxiliary functions\\\n(******************************************************************************)\n\ntext \\Other lemmas\\\n\nlemma rs_runs2sigs_empty [simp]: \n \"runz = Map.empty \\ rs_runs2sigs runz = (\\s. 0)\"\nby (rule ext, erule rev_mp) \n (rule rs_runs2sigs.induct, auto)\n\nlemma rs_commit_finite [simp, intro]:\n \"finite (dom runz) \\ finite (rs_commit runz A B Kab nls)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\Update lemmas\\\n\nlemma rs_runs2sigs_upd_init_none [simp]:\n \"\\ Ra \\ dom runz \\\n \\ rs_runs2sigs (runz(Ra \\ (Init, [A, B], []))) = rs_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_resp_none [simp]:\n \"\\ Rb \\ dom runz \\\n \\ rs_runs2sigs (runz(Rb \\ (Resp, [A, B], []))) = rs_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_serv [simp]:\n \"\\ Rs \\ dom runz \\\n \\ rs_runs2sigs (runz(Rs \\ (Serv, [A, B], aNon Na # nls))) = \n (rs_runs2sigs runz)(Running [B, Sv] (sesK (Rs$sk), A, nls) := 1)\"\nby (rule ext, erule rev_mp) \n (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_init_some [simp]:\n \"\\ runz Ra = Some (Init, [A, B], []) \\\n \\ rs_runs2sigs (runz(Ra \\ (Init, [A, B], aKey Kab # nl))) =\n rs_runs2sigs runz\" \nby (rule ext, erule rev_mp)\n (rule rs_runs2sigs.induct, auto dest: dom_lemmas) \n\nlemma rs_runs2sigs_upd_resp_some [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], []); finite (dom runz);\n rsl = take rs_len nlb \\\n \\ rs_runs2sigs (runz(Rb \\ (Resp, [A, B], aKey Kab # nlb))) =\n (rs_runs2sigs runz)(\n Commit [B, Sv] (Kab, A, rsl) := Suc (card (rs_commit runz A B Kab rsl)))\"\napply (rule ext, (erule rev_mp)+) \napply (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\\ \\1 subgoal\\\napply (rule_tac s=\"card (insert Rb (rs_commit runz A B Kab (take rs_len nlb)))\" \n in trans, fast, auto)\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_a0_rs_skip:\n \"{R_a0m1a_rs} \n Id, (m1a_step1 Ra A B Na) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_a0_rs_skip:\n \"{R_a0m1a_rs} \n Id, (m1a_step2 Rb A B) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_a0_rs_running:\n \"{R_a0m1a_rs} \n (a0n_running [B, Sv] (Kab, A, nls)), \n (m1a_step3 Rs A B Kab Na nls) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0i_defs m1a_defs\n dest: dom_lemmas)\n\nlemma PO_m1a_step4_refines_a0_rs_skip:\n \"{R_a0m1a_rs} \n Id, (m1a_step4 Ra A B Na Kab nla) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0i_defs m1a_defs)\n\nlemma PO_m1a_step5_refines_a0_rs_commit:\n \"{R_a0m1a_rs \\ UNIV \\ m1a_inv0_fin} \n (a0n_commit [B, Sv] (Kab, A, take rs_len nlb)), \n (m1a_step5 Rb A B Kab nlb) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0i_defs m1a_defs)\n\nlemma PO_m1a_leak_refines_a0_rs_skip:\n \"{R_a0m1a_rs} \n Id, (m1a_leak Rs) \n {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0i_defs m1a_defs)\n\n\ntext \\All together now...\\\n\nlemmas PO_m1a_trans_refines_a0_rs_trans = \n PO_m1a_step1_refines_a0_rs_skip PO_m1a_step2_refines_a0_rs_skip\n PO_m1a_step3_refines_a0_rs_running PO_m1a_step4_refines_a0_rs_skip\n PO_m1a_step5_refines_a0_rs_commit PO_m1a_leak_refines_a0_rs_skip\n\n\nlemma PO_m1a_refines_init_ra0n [iff]:\n \"init m1a \\ R_a0m1a_rs``(init a0n)\"\nby (auto simp add: R_a0m1a_rs_defs a0n_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_ra0n [iff]:\n \"{R_a0m1a_rs \\ a0n_inv1_niagree \\ m1a_inv0_fin} \n (trans a0n), (trans m1a) \n {> R_a0m1a_rs}\"\nby (force simp add: m1a_def m1a_trans_def a0n_def a0n_trans_def\n intro!: PO_m1a_trans_refines_a0_rs_trans)\n\nlemma obs_consistent_med_a0m1a_rs [iff]: \n \"obs_consistent \n (R_a0m1a_rs \\ a0n_inv1_niagree \\ m1a_inv0_fin) \n med_a0m1a_rs a0n m1a\"\nby (auto simp add: obs_consistent_def R_a0m1a_rs_def med_a0m1a_rs_def \n a0n_def m1a_def)\n\n\ntext \\Refinement result.\\\n\nlemma PO_m1a_refines_a0_rs [iff]: \n \"refines (R_a0m1a_rs \\ a0n_inv1_niagree \\ m1a_inv0_fin) med_a0m1a_rs a0n m1a\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m1a_implements_ra0n: \"implements med_a0m1a_rs a0n m1a\"\nby (rule refinement_soundness) (fast)\n\n\nsubsubsection \\inv2r (inherited): Responder and server\\\n(*invh*************************************************************************)\n\ntext \\This is a translation of the agreement property to Level 1. It\nfollows from the refinement and not needed here but later.\\\n\ndefinition \n m1a_inv2r_serv :: \"'x m1x_state_scheme set\"\nwhere\n \"m1a_inv2r_serv \\ {s. \\A B Rb Kab nlb.\n B \\ bad \\ \n runs s Rb = Some (Resp, [A, B], aKey Kab # nlb) \\\n (\\Rs Na. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], aNon Na # take rs_len nlb))\n }\"\n\nlemmas m1a_inv2r_servI = \n m1a_inv2r_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1a_inv2r_servE [elim] = \n m1a_inv2r_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1a_inv2r_servD = \n m1a_inv2r_serv_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Invariance proof\\\n\nlemma PO_m1a_inv2r_serv [iff]:\n \"reach m1a \\ m1a_inv2r_serv\"\napply (rule INV_from_Refinement_basic [OF PO_m1a_refines_a0_rs])\napply (auto simp add: R_a0m1a_rs_def a0n_inv1_niagree_def intro!: m1a_inv2r_servI)\napply (rename_tac x A B Rb Kab nlb a, drule_tac x=\"[B, Sv]\" in spec, clarsimp)\napply (rename_tac x A B Rb Kab nlb a, drule_tac x=\"Kab\" in spec, force)\ndone\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m1_keydist_iirn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.26026301076539066}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Auth_simple/m3_sig.thy (Isabelle/HOL 2016-1)\n ID: $Id: m3_sig.thy 133852 2017-03-20 15:59:33Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n\n One-Way authentication protocols\n Refinement 3: protocol using signatures\n\n Copyright (c) 2009-2016 Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Refinement 3a: Signature-based Dolev-Yao Protocol (Variant A)\\\n\ntheory m3_sig imports m2_auth_chan \"../Refinement/Message\"\nbegin\n\ntext \\We implement the channel protocol of the previous refinement with\nsignatures and add a full-fledged Dolev-Yao adversary. In this variant, the\nadversary is realized using Paulson's closure operators for message derivation\n(as opposed to a collection of one-step derivation events a la Strand spaces).\n\\\n\ntext \\Proof tool configuration. Avoid annoying automatic unfolding of\n\\dom\\ (again).\\\n\ndeclare domIff [simp, iff del]\ndeclare analz_into_parts [dest]\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\We extend the state of @{term m1} with insecure and authentic\nchannels between each pair of agents.\\\n\nrecord m3_state = m1_state +\n IK :: \"msg set\" \\ \\intruder knowledge\\\n\ntype_synonym\n m3_obs = m1_state\n\ndefinition\n m3_obs :: \"m3_state \\ m3_obs\" where\n \"m3_obs s \\ \\\n runs = runs s\n \\\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ndefinition\n m3_step1 :: \"[rid_t, agent, agent, nonce] \\ (m3_state \\ m3_state) set\"\nwhere\n \"m3_step1 Ra A B Na \\ {(s, s1).\n\n \\ \\guards\\\n Ra \\ dom (runs s) \\\n Na = Ra$0 \\\n\n \\ \\actions\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [])),\n IK := insert \\Agent A, Agent B, Nonce Na\\ (IK s) \\ \\send msg 1\\\n \\\n }\"\n\ndefinition\n m3_step2 :: \"[rid_t, agent, agent, nonce, nonce] \\ (m3_state \\ m3_state) set\"\nwhere\n \"m3_step2 Rb A B Na Nb \\ {(s, s1).\n\n \\ \\guards\\\n Rb \\ dom (runs s) \\\n Nb = Rb$0 \\\n\n \\Agent A, Agent B, Nonce Na\\ \\ IK s \\ \\ \\receive msg 1\\\n\n \\ \\actions\\\n s1 = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aNon Na])),\n \\ \\send msg 2\\\n IK := insert (Crypt (priK B) \\Nonce Nb, Nonce Na, Agent A\\) (IK s)\n \\\n }\"\n\ndefinition\n m3_step3 :: \"[rid_t, agent, agent, nonce, nonce] \\ (m3_state \\ m3_state) set\"\nwhere\n \"m3_step3 Ra A B Na Nb \\ {(s, s1).\n\n \\ \\guards\\\n runs s Ra = Some (Init, [A, B], []) \\\n Na = Ra$0 \\\n\n Crypt (priK B) \\Nonce Nb, Nonce Na, Agent A\\ \\ IK s \\ \\ \\recv msg 2\\\n\n \\ \\actions\\\n s1 = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aNon Nb]))\n \\\n }\"\n\n\ntext \\The intruder messages are now generated by a full-fledged Dolev-Yao\nintruder.\\\n\ndefinition\n m3_DY_fake :: \"(m3_state \\ m3_state) set\"\nwhere\n \"m3_DY_fake \\ {(s, s1).\n\n \\ \\actions:\\\n s1 = s\\\n IK := synth (analz (IK s))\n \\\n }\"\n\n\ntext \\Transition system.\\\n\ndefinition\n m3_init :: \"m3_state set\"\nwhere\n \"m3_init \\ { \\\n runs = Map.empty,\n IK = (Key`priK`bad) \\ (Key`range pubK) \\ (Key`shrK`bad)\n \\ }\"\n\ndefinition\n m3_trans :: \"(m3_state \\ m3_state) set\" where\n \"m3_trans \\ (\\ A B Ra Rb Na Nb.\n m3_step1 Ra A B Na \\\n m3_step2 Rb A B Na Nb \\\n m3_step3 Ra A B Na Nb \\\n m3_DY_fake \\\n Id\n )\"\n\ndefinition\n m3 :: \"(m3_state, m3_obs) spec\" where\n \"m3 \\ \\\n init = m3_init,\n trans = m3_trans,\n obs = m3_obs\n \\\"\n\nlemmas m3_defs =\n m3_def m3_init_def m3_trans_def m3_obs_def\n m3_step1_def m3_step2_def m3_step3_def\n m3_DY_fake_def\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\ntext \\Specialize injectiveness of parts to enable aggressive application.\\\n\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\n\n\ntext \\The following invariants do not depend on the protocol messages.\nWe want to keep this compilation refinement from channel protocols to\nfull-fledged Dolev-Yao protocols as generic as possible.\\\n\n\nsubsubsection \\inv1: Long-term key secrecy\\\n(******************************************************************************)\n\ntext \\Private signing keys are secret, that is, the intruder only knows\nprivate keys of corrupted agents.\n\nThe invariant uses the weaker @{term parts} operator instead of the perhaps\nmore intuitive @{term analz} in its premise. This strengthens the invariant\nand potentially simplifies its proof.\n\\\n\ndefinition\n m3_inv1_lkeysec :: \"m3_state set\" where\n \"m3_inv1_lkeysec \\ {s. \\ A.\n Key (priK A) \\ analz (IK s) \\ A \\ bad\n }\"\n\nlemmas m3_inv1_lkeysecI =\n m3_inv1_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_lkeysecE [elim] =\n m3_inv1_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_lkeysecD =\n m3_inv1_lkeysec_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\nlemma PO_m3_inv1_lkeysec_init [iff]:\n \"init m3 \\ m3_inv1_lkeysec\"\nby (auto simp add: PO_hoare_def m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec_trans [iff]:\n \"{m3_inv1_lkeysec} trans m3 {> m3_inv1_lkeysec}\"\nby (auto simp add: PO_hoare_def m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec [iff]: \"reach m3 \\ m3_inv1_lkeysec\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv2: Intruder knows long-term keys of bad guys\\\n(******************************************************************************)\n\ndefinition\n m3_inv2_badkeys :: \"m3_state set\"\nwhere\n \"m3_inv2_badkeys \\ {s. \\C.\n C \\ bad \\ Key (priK C) \\ analz (IK s)\n }\"\n\nlemmas m3_inv2_badkeysI =\n m3_inv2_badkeys_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv2_badkeysE [elim] =\n m3_inv2_badkeys_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv2_badkeysD [dest] =\n m3_inv2_badkeys_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv2_badkeys_init [iff]:\n \"init m3 \\ m3_inv2_badkeys\"\nby (auto simp add: m3_defs m3_inv2_badkeys_def)\n\nlemma PO_m3_inv2_badkeys_trans [iff]:\n \"{m3_inv2_badkeys} trans m3 {> m3_inv2_badkeys}\"\nby (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv2_badkeysI)\n\nlemma PO_m3_inv2_badkeys [iff]: \"reach m3 \\ m3_inv2_badkeys\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv3: Intruder knows all public keys (NOT USED)\\\n(******************************************************************************)\n\ntext \\This invariant is only needed with equality in \\R23_msgs\\.\\\n\ndefinition\n m3_inv3_pubkeys :: \"m3_state set\"\nwhere\n \"m3_inv3_pubkeys \\ {s. \\C.\n Key (pubK C) \\ analz (IK s)\n }\"\n\nlemmas m3_inv3_pubkeysI =\n m3_inv3_pubkeys_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_pubkeysE [elim] =\n m3_inv3_pubkeys_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_pubkeysD [dest] =\n m3_inv3_pubkeys_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m3_inv3_pubkeys_init [iff]:\n \"init m3 \\ m3_inv3_pubkeys\"\nby (auto simp add: m3_defs m3_inv3_pubkeys_def)\n\nlemma PO_m3_inv3_pubkeys_trans [iff]:\n \"{m3_inv3_pubkeys} trans m3 {> m3_inv3_pubkeys}\"\nby (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv3_pubkeysI)\n\nlemma PO_m3_inv3_pubkeys [iff]: \"reach m3 \\ m3_inv3_pubkeys\"\nby (rule inv_rule_basic) (auto)\n\n\n(******************************************************************************)\nsubsection \\Refinement\\\n(******************************************************************************)\n\ntext \\Automatic tool tuning. Tame too-agressive pair decomposition, which is\ndeclared as a safe elim rule ([elim!]).\\\n\nlemmas MPair_parts [rule del, elim]\nlemmas MPair_analz [rule del, elim]\n\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\nabbreviation\n nonces :: \"msg set \\ nonce set\"\nwhere\n \"nonces H \\ {N. Nonce N \\ analz H}\"\n\nabbreviation\n ink :: \"chmsg set \\ nonce set\"\nwhere\n \"ink H \\ {N. aNon N \\ extr ik0 H}\"\n\n\ntext \\Abstraction function on sets of messages.\\\n\ninductive_set\n abs_msg :: \"msg set \\ chmsg set\"\n for H :: \"msg set\"\nwhere\n am_M1:\n \"\\Agent A, Agent B, Nonce Na\\ \\ H\n \\ Insec A B (Msg [aNon Na]) \\ abs_msg H\"\n\n| am_M2:\n \"Crypt (priK B) \\Nonce Nb, Nonce Na, Agent A\\ \\ H\n \\ Auth B A (Msg [aNon Nb, aNon Na]) \\ abs_msg H\"\n\n\ntext \\The simulation relation is canonical. It states that the protocol\nmessages in the intruder knowledge refine the abstract messages appearing in\nthe channels @{term Insec} and @{term Auth}.\\\n\ndefinition\n R23_msgs :: \"(m2_state \\ m3_state) set\" where\n \"R23_msgs \\ {(s, t). abs_msg (parts (IK t)) \\ chan s}\" \\ \\with \\parts\\!\\\n\ndefinition\n R23_ink :: \"(m2_state \\ m3_state) set\" where\n \"R23_ink \\ {(s, t). nonces (IK t) \\ ink (chan s)}\"\n\ndefinition\n R23_preserved :: \"(m2_state \\ m3_state) set\" where\n \"R23_preserved \\ {(s, t). runs s = runs t}\"\n\ndefinition\n R23 :: \"(m2_state \\ m3_state) set\" where\n \"R23 \\ R23_msgs \\ R23_ink \\ R23_preserved\"\n\nlemmas R23_defs = R23_def R23_msgs_def R23_ink_def R23_preserved_def\n\n\ntext \\Mediator function: nothing new.\\\n\ndefinition\n med32 :: \"m3_obs \\ m2_obs\" where\n \"med32 \\ id\"\n\n\nlemmas R23_msgsI =\n R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] =\n R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_msgsE' [elim] =\n R23_msgs_def [THEN rel_def_to_dest, simplified, rule_format, THEN subsetD]\n\nlemmas R23_inkI =\n R23_ink_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_inkE [elim] =\n R23_ink_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_preservedI =\n R23_preserved_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_preservedE [elim] =\n R23_preserved_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_inkI R23_preservedI\n\n\nsubsubsection \\Facts about the abstraction function\\\n(******************************************************************************)\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n \"abs_msg (G \\ H) = abs_msg G \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n \"\\ m \\ abs_msg G; G \\ H \\ \\ m \\ abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n \"\\ m \\ abs_msg H \\ \\ m \\ abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\Abstraction of concretely fakeable message yields abstractly fakeable\nmessages. This is the key lemma for the refinement of the intruder.\\\n\nlemma abs_msg_DY_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs; (s, t) \\ R23_ink; t \\ m3_inv1_lkeysec \\\n \\ abs_msg (synth (analz (IK t))) \\ fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n apply (rule fake_intros, auto)\n apply (rule fake_Inj, auto)\n apply (rule fake_intros, auto)\ndone\n\nlemma absmsg_parts_subset_fakeable:\n \"\\ (s, t) \\ R23_msgs \\\n \\ abs_msg (parts (IK t)) \\ fake ik0 (-dom (runs s)) (chan s)\"\nby (rule_tac B=\"chan s\" in subset_trans) (auto)\n\ndeclare abs_msg_DY_subset_fakeable [simp, intro!]\ndeclare absmsg_parts_subset_fakeable [simp, intro!]\n\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m3_step1_refines_m2_step1:\n \"{R23}\n (m2_step1 Ra A B Na), (m3_step1 Ra A B Na)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n \"{R23 \\<^cancel>\\\\ UNIV \\ m3_inv3_pubkeys\\}\n (m2_step2 Rb A B Na Nb), (m3_step2 Rb A B Na Nb)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n (auto)\n\nlemma PO_m3_step3_refines_m2_step3:\n \"{R23}\n (m2_step3 Ra A B Na Nb), (m3_step3 Ra A B Na Nb)\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n (auto)\n\n\ntext \\The Dolev-Yao fake event refines the abstract fake event.\\\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n \"{R23 \\ UNIV \\ (m3_inv1_lkeysec \\ m3_inv2_badkeys)}\n m2_fake, m3_DY_fake\n {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs)\n (rule R23_intros, auto)+\n\n\ntext \\All together now...\\\n\nlemmas PO_m3_trans_refines_m2_trans =\n PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n PO_m3_step3_refines_m2_step3 PO_m3_DY_fake_refines_m2_fake\n\nlemma PO_m3_refines_init_m2 [iff]:\n \"init m3 \\ R23``(init m2)\"\nby (auto simp add: R23_defs m2_defs m3_defs)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n \"{R23 \\ UNIV \\ (m3_inv2_badkeys \\ m3_inv1_lkeysec)}\n (trans m2), (trans m3)\n {> R23}\"\napply (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\napply (blast intro!: PO_m3_trans_refines_m2_trans)+\ndone\n\nlemma PO_obs_consistent [iff]:\n \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m2_defs m3_defs)\n\nlemma PO_m3_refines_m2:\n \"refines\n (R23 \\ UNIV \\ (m3_inv2_badkeys \\ m3_inv1_lkeysec))\n med32 m2 m3\"\nby (rule Refinement_using_invariants) (auto)\n\n\nend\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Auth_simple/m3_sig.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.26026301076539066}} {"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoareTotalDef.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Hoare Logic for Total Correctness *}\n\ntheory HoareTotalDef imports HoarePartialDef Termination begin \n\nsubsection {* Validity of Hoare Tuples: @{text \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n validt :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^bsub>/F\\<^esub> P c Q,A \\ (\\s \\ Normal ` P. \\\\c\\s)\"\n\ndefinition\n cvalidt::\n \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \\ bool\"\n (\"_,_\\\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\" [61,60, 60,1000, 20, 1000,1000] 60)\nwhere\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ (\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\ \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n\nnotation (ascii)\n validt (\"_|=t'/_/ _ _ _,_\" [61,60,1000, 20, 1000,1000] 60) and\n cvalidt (\"_,_|=t'/_ / _ _ _,_\" [61,60,60,1000, 20, 1000,1000] 60)\n\nsubsection {* Properties of Validity *}\n\nlemma validtI: \n \"\\\\s t. \\\\\\\\c,Normal s\\ \\ t;s \\ P;t \\ Fault ` F\\ \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. s \\ P \\ \\\\ c\\(Normal s) \\\n \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: validt_def valid_def)\n\nlemma cvalidtI: \n \"\\\\s t. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s\\ \\ t;s \\ P; \n t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A;\n \\s. \\\\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A; s\\P\\ \\ \\\\c\\(Normal s)\\\n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_postD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\\\\\c,Normal s \\ \\ t;\n s \\ P;t \\ Fault ` F\\ \n \\ t \\ Normal ` Q \\ Abrupt ` A\"\n by (simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_termD: \n \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\(P,p,Q,A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;s \\ P\\ \n \\ \\\\c\\(Normal s)\"\n by (simp add: cvalidt_def validt_def valid_def)\n\n\nlemma validt_augment_Faults:\n assumes valid:\"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes F': \"F \\ F'\"\n shows \"\\\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n using valid F'\n by (auto intro: valid_augment_Faults simp add: validt_def)\n\nsubsection {* The Hoare Rules: @{text \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" } *}\n\ninductive \"hoaret\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com,'s assn,'s assn] \n => bool\"\n (\"(3_,_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,_))\" [61,60,60,1000,20,1000,1000]60) \n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ Q} (Basic f) Q,A\"\n\n| Spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} (Spec r) Q,A\"\n\n| Seq: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n \n| Cond: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c\\<^sub>1 Q,A; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c\\<^sub>2 Q,A\\\n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\wf r; \\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t,\\)\\r} \\ P),A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n\n| Guard: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n\n| Guarantee: \"\\f \\ F; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec: \n \"\\(P,p,Q,A) \\ Specs;\n wf r; \n Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s,q),(\\,p)) \\ r},q,Q,A)) ` Specs);\n \\(P,p,Q,A)\\ Specs. \n p \\ dom \\ \\ (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\n \\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| DynCom: \"\\s \\ P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n\n| Throw: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\s \\ P. \\P' Q' A'. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ s \\ P' \\ Q' \\ Q \\ A' \\ A \n \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"(P,p,Q,A) \\ \\ \n \\ \n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| ExFalso: \"\\\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\ \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n -- {* This is a hack rule that enables us to derive completeness for\n an arbitrary context @{text \"\\\"}, from completeness for an empty context.*}\n\n \ntext {* Does not work, because of rule ExFalso, the context @{text \\} is to blame.\n A weaker version with empty context can be derived from soundness \n later on. *}\nlemma hoaret_to_hoarep:\n assumes hoaret: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P p Q,A\"\nusing hoaret\nproof (induct)\n case Skip thus ?case by (rule hoarep.intros)\nnext\n case Basic thus ?case by (rule hoarep.intros)\nnext\n case Seq thus ?case by - (rule hoarep.intros)\nnext\n case Cond thus ?case by - (rule hoarep.intros)\nnext\n case (While r \\ F P b c A)\n hence \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n by iprover\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A\"\n by (rule HoarePartialDef.conseq) blast\n then show \"\\,\\\\\\<^bsub>/F\\<^esub> P While b c (P \\ - b),A\"\n by (rule hoarep.While)\nnext\n case Guard thus ?case by - (rule hoarep.intros)\n(*next\n case (CallRec A F P Procs Q Z \\ p r)\n hence hyp: \"\\p\\Procs. \\\\ Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\p\\Procs. \\Z. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n (P p Z) (the (\\ p)) (Q p Z),(A p Z)\" \n proof (intro ballI allI)\n fix p Z\n assume \"p \\ Procs\"\n with hyp\n have hyp': \"\\ \\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z, A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by blast\n have \"\\\\. \n \\,\\ \\ (\\q\\Procs. \\Z. {(P q Z,\n Call q, Q q Z,A q Z)})\\\\<^bsub>/F\\<^esub>\n ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n (is \"\\\\. \\,?\\'\\\\<^bsub>/F\\<^esub> ({\\} \\ P p Z) (the (\\ p)) (Q p Z),(A p Z)\")\n proof (rule allI, rule WeakenContext [OF hyp'],clarify)\n fix \\ P' c Q' A'\n assume \"(P', c, Q', A') \\ \\ \\\n (\\q\\Procs.\n \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r},\n Call q, Q q Z,\n A q Z)})\" (is \"(P', c, Q', A') \\ \\ \\ ?Spec\")\n then show \"\\,?\\'\\\\<^bsub>/F\\<^esub> P' c Q',A'\"\n proof (cases rule: UnE [consumes 1])\n assume \"(P',c,Q',A') \\ \\\" \n then show ?thesis\n by (blast intro: HoarePartialDef.Asm)\n next\n assume \"(P',c,Q',A') \\ ?Spec\" \n then show ?thesis\n proof (clarify)\n fix q Z\n assume q: \"q \\ Procs\"\n show \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z \\ {s. ((s, q), \\, p) \\ r}) \n Call q \n (Q q Z),(A q Z)\"\n proof -\n from q\n have \"\\,?\\'\\\\<^bsub>/F\\<^esub> (P q Z) Call q (Q q Z),(A q Z)\"\n by - (rule HoarePartialDef.Asm,blast)\n thus ?thesis\n by (rule HoarePartialDef.conseqPre) blast\n qed\n qed\n qed\n qed\n then show \"\\,\\ \\ (\\q\\Procs. \\Z. {(P q Z, Call q, Q q Z,A q Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n by (rule HoarePartialDef.conseq) blast\n qed\n thus ?case\n by - (rule hoarep.CallRec)*)\nnext\n case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n case Throw thus ?case by - (rule hoarep.Throw)\nnext\n case Catch thus ?case by - (rule hoarep.Catch)\nnext\n case Conseq thus ?case by - (rule hoarep.Conseq,blast)\nnext\n case Asm thus ?case by (rule HoarePartialDef.Asm)\nnext\n case (ExFalso \\ F P c Q A)\n assume \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n hence \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n oops\n\n\nlemma hoaret_augment_context: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n shows \"\\\\'. \\ \\ \\' \\ \\,\\'\\\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n case (CallRec P p Q A Specs r Specs_wf \\ F \\')\n have aug: \"\\ \\ \\'\" by fact\n then\n have h: \"\\\\ p. \\ \\ Specs_wf p \\\n \\ \\' \\ Specs_wf p \\\"\n by blast\n have \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A \\\n (\\x. \\ \\ Specs_wf p \\\n \\ x \\\n \\,x\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A))\" by fact\n hence \"\\(P,p,Q,A)\\Specs. p \\ dom \\ \\ \n (\\\\. \\,\\'\\ Specs_wf p \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A)\"\n apply (clarify)\n apply (rename_tac P p Q A)\n apply (drule (1) bspec)\n apply (clarsimp)\n apply (erule_tac x=\\ in allE)\n apply clarify\n apply (erule_tac x=\"\\' \\ Specs_wf p \\\" in allE)\n apply (insert aug)\n apply auto\n done\n with CallRec show ?case by - (rule hoaret.CallRec)\nnext\n case DynCom thus ?case by (blast intro: hoaret.DynCom)\nnext\n case (Conseq P \\ F c Q A \\')\n from Conseq\n have \"\\s \\ P. (\\P' Q' A'. (\\,\\' \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\"\n by blast\n with Conseq show ?case by - (rule hoaret.Conseq)\nnext\n case (ExFalso \\ F P c Q A \\')\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\ \\ \\'\" by fact+\n then show ?case\n by (fastforce intro: hoaret.ExFalso simp add: cvalidt_def)\nqed (blast intro: hoaret.intros)+\n\nsubsection {* Some Derived Rules *}\n\n\nlemma Conseq': \"\\s. s \\ P \\ \n (\\P' Q' A'. \n (\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\\n (\\Z. s \\ P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)))\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q)\\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq) blast\n\ntheorem conseqPrePost: \n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where ?P'=\"\\Z. P'\" and ?Q'=\"\\Z. Q'\"]) auto\n\nlemma conseqPre: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A \\ P \\ P' \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\\ Q' \\ Q \\ A' \\ A \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq) auto\n\n\nlemma Spec_wf_conv: \n \"(\\(P, q, Q, A). (P \\ {s. ((s, q), \\, p) \\ r}, q, Q, A)) `\n (\\p\\Procs. \\Z. {(P p Z, p, Q p Z, A p Z)}) = \n (\\q\\Procs. \\Z. {(P q Z \\ {s. ((s, q), \\, p) \\ r}, q, Q q Z, A q Z)})\"\napply (rule)\napply fastforce\napply (fastforce simp add: image_def)\ndone\n\nlemma CallRec': \n \"\\p\\Procs; Procs \\ dom \\;\n wf r; \n \\p\\Procs. \\\\ Z. \n \\,\\\\(\\q\\Procs. \\Z. \n {((P q Z) \\ {s. ((s,q),(\\,p)) \\ r},q,Q q Z,(A q Z))})\n \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ (P p Z)) (the (\\ p)) (Q p Z),(A p Z)\\\n \\\n \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\p\\Procs. \\Z. {((P p Z),p,Q p Z,A p Z)}\" and\n r=r])\napply blast\napply assumption\napply (rule refl)\napply (clarsimp)\napply (rename_tac p')\napply (rule conjI)\napply blast\napply (intro allI)\napply (rename_tac Z \\)\napply (drule_tac x=p' in bspec, assumption)\napply (erule_tac x=\\ in allE)\napply (erule_tac x=Z in allE)\napply (fastforce simp add: Spec_wf_conv)\ndone\n\nend\n\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/HoareTotalDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2602630037940149}} {"text": "theory BinarySearch\n imports\n BinarySearchAsm\nbegin\n\nsublocale WordArray \\ Generated_cogent_shallow _ upd.wa_abs_repr val.wa_abs_typing_v upd.wa_abs_typing_u wa_abs_upd_val\n by (unfold_locales)\n\ncontext WordArray begin\n\nthm corres_shallow_C_binarySearch_concrete\n\nsection \"record simps\"\n\nfun t0_unmake\n where\n\"t0_unmake x = (T0.p1\\<^sub>f x, T0.p2\\<^sub>f x, T0.p3\\<^sub>f x)\" \n\nfun t0_make\n where\n\"t0_make (a, b, c) = T0.make a b c\"\n\nfun t1_make\n where\n\"t1_make (a, b) = T1.make a b\"\n\nfun t1_unmake\n where\n\"t1_unmake x = (T1.p1\\<^sub>f x, T1.p2\\<^sub>f x)\"\n\nlemma t0_make_simps:\n \"T0.p1\\<^sub>f (t0_make x) = (\\(a,b,c). a) x\"\n \"T0.p2\\<^sub>f (t0_make x) = (\\(a,b,c). b) x\"\n \"T0.p3\\<^sub>f (t0_make x) = (\\(a,b,c). c) x\"\n apply (clarsimp split: prod.splits simp: valRel_records)+\n done\n\nlemma t1_make_simps:\n \"T1.p1\\<^sub>f (t1_make x) = (\\(a,b). a) x\"\n \"T1.p2\\<^sub>f (t1_make x) = (\\(a,b). b) x\"\n apply (clarsimp split: prod.splits simp: valRel_records)+\n done\n\nsection \"word simps\"\n\nlemma unat_ucast_of_nat:\n \"x \\ unat (max_word :: 32 word) \\ unat (UCAST(32 \\ 64) (of_nat (x))) = x\"\n apply (clarsimp simp: max_word_def ucast_of_nat_small )\n apply (subst le_unat_uoi[where z = \"4294967295\"]; simp)\n done\n\nlemma unatSuc_comm:\n \"(1 :: ('a :: len8) word) + n \\ 0 \\ unat (n + 1) = Suc (unat n)\"\n apply (drule unatSuc)\n apply (simp add: add.commute)\n done\n\nsection \"midpoint lemmas\"\n\nlemma midpoint_alt:\n \"a < b \\ (a ::nat) + (b - a) div 2 = (a + b) div 2\"\n apply (induct a)\n apply simp\n apply simp\n done\n\nlemma midpoint_bounds_upper:\n \"\\a < b; b \\ d\\ \\ (a ::nat) + (b - a) div 2 < d\"\n apply (induct a)\n apply simp\n apply simp\n done\n\nsection \"search_stop simps\"\n\ndefinition search_stop0\n where\n\"search_stop0 = (\\ds\\<^sub>0. \\ T0.p2\\<^sub>f (StepParam.acc\\<^sub>f ds\\<^sub>0) \\ T0.p1\\<^sub>f (StepParam.acc\\<^sub>f ds\\<^sub>0) \\ p3\\<^sub>f (StepParam.acc\\<^sub>f ds\\<^sub>0))\"\n\nlemma search_stop0_simp:\n \"Generated_Shallow_Desugar.searchStop = search_stop0\"\n unfolding Generated_Shallow_Desugar.searchStop_def search_stop0_def\n apply (clarsimp simp: Let_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def valRel_records swa_get_def split: if_splits)\n done\n\ndefinition search_stop1\n where\n\"search_stop1 = (\\a b. \\ T0.p2\\<^sub>f a \\ T0.p1\\<^sub>f a \\ p3\\<^sub>f a)\"\n\nlemma search_stop1_simp:\n \"(\\a b. search_stop0 \\StepParam.acc\\<^sub>f = a, obsv\\<^sub>f = b\\) = search_stop1\"\n unfolding search_stop0_def search_stop1_def\n apply (clarsimp simp: Let_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def valRel_records swa_get_def split: if_splits)\n done\n\ndefinition search_stop2\n where\n\"search_stop2 = (\\(a, b, c) (d, e). \\ b \\ a \\ c)\"\n\nlemma search_stop2_simp:\n \"(\\a b. search_stop1 (t0_make a) (t1_make b)) = search_stop2\"\n unfolding search_stop1_def search_stop2_def\n apply (clarsimp simp: fun_eq_iff valRel_records split: prod.splits)\n done\n\nsection \"search_next simps\"\n\nlemma searchNext_simps:\n \"(\\a (b, c). t0_unmake (Generated_Shallow_Desugar.searchNext \\StepParam.acc\\<^sub>f = t0_make a, obsv\\<^sub>f = \\T1.p1\\<^sub>f = SWA b, p2\\<^sub>f = c\\\\))\n = (\\(a0, a1, a2) (b, c). t0_unmake (Generated_Shallow_Desugar.searchNext \\StepParam.acc\\<^sub>f = t0_make (a0, a1, a2), obsv\\<^sub>f = \\T1.p1\\<^sub>f = SWA b, p2\\<^sub>f = c\\\\))\"\n unfolding Generated_Shallow_Desugar.searchNext_def swa_get_def\n apply (clarsimp simp: Let_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def valRel_records checked_div_def t1_make_simps t0_make_simps fun_eq_iff\n split: if_splits)\n done\n\ndefinition search_next0\n where\n\"search_next0 = (\\(a0, a1, a2) (b, c).\n (if (if unat (a0 + (a1 - a0) div 2) < length b then b ! unat (a0 + (a1 - a0) div 2) else 0) < c\n then (a0 + (a1 - a0) div 2 + 1, a1, a2)\n else if c < (if unat (a0 + (a1 - a0) div 2) < length b then b ! unat (a0 + (a1 - a0) div 2) else 0)\n then (a0, a0 + (a1 - a0) div 2, a2)\n else (a0 + (a1 - a0) div 2, a1, True)))\"\nlemma search_next_simp:\n \"(\\(a0, a1, a2) (b, c). t0_unmake (Generated_Shallow_Desugar.searchNext \\StepParam.acc\\<^sub>f = t0_make (a0, a1, a2), obsv\\<^sub>f = \\T1.p1\\<^sub>f = SWA b, p2\\<^sub>f = c\\\\))\n = search_next0\"\n unfolding Generated_Shallow_Desugar.searchNext_def swa_get_def search_next0_def\n apply (clarsimp simp: Let_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def valRel_records checked_div_def t1_make_simps t0_make_simps fun_eq_iff\n split: if_splits)\n done\n\ndefinition search_next1\n where\n\"search_next1 = (\\(a0, a1, a2) (b, c).\n (if (if ((a0 + a1) div 2) < length b then b ! ((a0 + a1) div 2) else 0) < c\n then ((a0 + a1) div 2 + 1, a1, a2)\n else if c < (if ((a0 + a1) div 2) < length b then b ! ((a0 + a1) div 2) else 0)\n then (a0, (a0 + a1 ) div 2, a2)\n else ((a0 + a1) div 2, a1, True)))\"\n\nlemma search_next1_simp:\n \"\\length xs \\ unat (max_word :: 32 word); a0 < a1; unat a0 < length xs; unat a1 \\ length xs\\ \\ \n (\\(a0, a1, b). (unat a0, unat a1, b)) ((search_next0 ((a0) :: 32 word, a1, a2) (xs, (v :: ('a :: len8) word))))\n = search_next1 (unat a0, unat a1, a2) (xs, v)\"\n apply (subgoal_tac \"unat (a0 + (a1 - a0) div 2) = ((unat a0) + (unat a1)) div 2\")\n unfolding search_next0_def search_next1_def\n apply (clarsimp split: prod.splits)\n apply (rule conjI; clarsimp)\n apply (subst unatSuc_comm)\n apply (subst add.commute)\n apply (rule_tac k = max_word in less_is_non_zero_p1)\n apply (subst word_less_nat_alt)\n apply simp\n apply simp\n apply (subst unatSuc_comm)\n apply (subst add.commute)\n apply (rule_tac k = max_word in less_is_non_zero_p1)\n apply (subst word_less_nat_alt)\n apply simp\n apply simp\n apply (subst unat_add_lem')\n apply (simp add: unat_div unat_sub)+\n apply (simp add: unat_div unat_sub midpoint_bounds_upper max_word_def)\n apply (simp add: unat_div unat_sub)\n apply (subst midpoint_alt; simp add: word_less_nat_alt)\n done\n \ndefinition search_stop3\n where\n\"search_stop3 = (\\a (b, c). search_stop2 a (SWA b, c))\"\n\ndefinition search_stop4\n where\n\"search_stop4 = (\\(a0, a1, a2) (b, c). (\\ (a1 :: nat) \\ a0 \\ a2))\"\n\nlemma search_next1_simp2:\n \"\\length xs \\ unat (max_word :: 32 word); a0 < a1; unat a0 < length xs; unat a1 \\ length xs;\n search_next0 ((a0) :: 32 word, a1, a2) (xs, (v :: ('a :: len8) word)) = (l, h, b)\\\n \\ search_next1 (unat a0, unat a1, a2) (xs, v) = (unat l, unat h, b)\"\n apply (subgoal_tac \"unat (a0 + (a1 - a0) div 2) = ((unat a0) + (unat a1)) div 2\")\n unfolding search_next0_def search_next1_def\n apply (clarsimp split: prod.splits)\n apply (rule conjI; clarsimp)+\n apply (subst unatSuc_comm)\n apply (subst add.commute)\n apply (rule_tac k = max_word in less_is_non_zero_p1)\n apply (subst word_less_nat_alt)\n apply simp\n apply simp\n apply (rule conjI; clarsimp)+\n apply (subst unatSuc_comm)\n apply (subst add.commute)\n apply (rule_tac k = max_word in less_is_non_zero_p1)\n apply (subst word_less_nat_alt)\n apply simp\n apply simp\n apply (rule conjI; clarsimp)+\n apply (subst unatSuc_comm)\n apply (subst add.commute)\n apply (rule_tac k = max_word in less_is_non_zero_p1)\n apply (subst word_less_nat_alt)\n apply simp\n apply simp\n apply (subst unat_add_lem')\n apply (simp add: unat_div unat_sub)+\n apply (simp add: unat_div unat_sub midpoint_bounds_upper max_word_def)\n apply (simp add: unat_div unat_sub)\n apply (subst midpoint_alt; simp add: word_less_nat_alt)\n done\n\nsection \"repeat simps\"\n\nlemma repeatatm_simps:\n \"repeatatm n f1 f2 \\T0.p1\\<^sub>f = a, p2\\<^sub>f = b, p3\\<^sub>f = c\\ \\T1.p1\\<^sub>f = d, p2\\<^sub>f = e\\ \n = t0_make (repeatatm n (\\a b. f1 (t0_make a) (t1_make b)) (\\a b. t0_unmake (f2 (t0_make a) (t1_make b))) (a,b,c) (d,e))\"\n apply (induct n arbitrary: a b c)\n apply (simp add: repeatatm.simps valRel_records)\n apply (clarsimp simp: repeatatm.simps valRel_records)\n apply (erule_tac x = \"T0.p1\\<^sub>f (f2 \\T0.p1\\<^sub>f = a, p2\\<^sub>f = b, p3\\<^sub>f = c\\ \\T1.p1\\<^sub>f = d, p2\\<^sub>f = e\\)\" in meta_allE)\n apply (erule_tac x = \"T0.p2\\<^sub>f (f2 \\T0.p1\\<^sub>f = a, p2\\<^sub>f = b, p3\\<^sub>f = c\\ \\T1.p1\\<^sub>f = d, p2\\<^sub>f = e\\)\" in meta_allE)\n apply (erule_tac x = \"T0.p3\\<^sub>f (f2 \\T0.p1\\<^sub>f = a, p2\\<^sub>f = b, p3\\<^sub>f = c\\ \\T1.p1\\<^sub>f = d, p2\\<^sub>f = e\\)\" in meta_allE)\n by (metis (mono_tags, lifting) T0.surjective old.unit.exhaust)\n\n\nlemma repeatatm_simps2:\n \"repeatatm n f g (a, b, c) (SWA xs, v) \n = repeatatm n (\\a (b, c). f a (list_to_swa b, c)) (\\a (b, c). g a (list_to_swa b, c)) (a, b, c) (xs, v)\"\n apply (induct n arbitrary: a b c)\n apply (simp add: repeatatm.simps)\n apply (clarsimp simp: repeatatm.simps)\n by (metis WordArray.t0_make.cases)\n\n\nlemma repeatatm_nat_simp:\n \"\\repeatatm n search_stop3 search_next0 ((i :: 32 word), j, b) (xs, (v :: ('a :: len8) word)) = (l, h, b');\n unat i < length xs; unat j \\ length xs; length xs \\ unat (max_word :: 32 word)\\\n \\ repeatatm n search_stop4 search_next1 (unat i, unat j, b) (xs, v) = (unat l, unat h, b')\"\n apply (induct n arbitrary: i j b)\n apply (simp add: repeatatm.simps)\n apply (simp add: repeatatm.simps)\n apply (rule conjI; clarsimp)\n apply (rotate_tac 1; subst (asm) search_stop3_def)\n apply (clarsimp simp: search_stop2_def search_stop4_def not_le word_less_nat_alt)\n apply (rotate_tac 1; subst (asm) search_stop3_def)\n apply (clarsimp simp: search_stop2_def not_le word_less_nat_alt)\n apply (subst (asm) search_stop4_def)\n apply simp\n apply (subgoal_tac \"\\x y z. search_next0 (i, j, False) (xs, v) = (x, y, z) \\ unat y \\ length xs\")\n apply (elim exE conjE)\n apply simp\n apply (drule search_next1_simp2[rotated -1]; simp?)\n apply (clarsimp simp: word_less_nat_alt not_le)\n apply (case_tac \"unat x < length xs\"; clarsimp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps)\n apply (rule conjI; clarsimp)\n apply (subst (asm) search_stop3_def)\n apply (clarsimp simp: search_stop2_def search_stop4_def not_le word_less_nat_alt)\n apply (subst (asm) search_stop3_def)\n apply (clarsimp simp: search_stop2_def not_le word_less_nat_alt)\n apply (rotate_tac -1; subst (asm) search_stop4_def)\n apply simp\n apply (subst search_next0_def)\n apply clarsimp\n done\n\nsection \"binary search nat lemmas\"\n\nlemma binary_search_range_shrink:\n \"\\repeatatm n search_stop4 search_next1 (i, j, b) (xs, v) = (l, h, b'); \n i < j; j \\ length xs\\\n \\ i \\ l \\ h \\ j\"\n apply (induct n arbitrary: i j b)\n apply (clarsimp simp: repeatatm.simps)\n apply (clarsimp simp: repeatatm.simps)\n apply (rotate_tac 1; subst (asm) search_stop4_def; clarsimp split: if_splits)\n apply (rotate_tac -1; subst (asm) search_next1_def; subst (asm) search_next1_def)\n apply (subst (asm) search_next1_def[symmetric])\n apply (clarsimp split: if_splits)\n apply (case_tac \"Suc ((i + j) div 2) < j\"; clarsimp)\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply clarsimp\n apply (rule_tac b = \"Suc ((i + j) div 2)\" in order.trans; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (case_tac \"i < (i + j) div 2\"; clarsimp)\n apply (rule_tac b = \"(i + j) div 2\" in order.trans; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply arith\n apply arith\n done\n\nlemma binary_search_correct_range:\n \"\\repeatatm n search_stop4 search_next1 (i, j, False) (xs, v) = (l, h, b'); \n i < j; j \\ length xs; sorted xs\\\n \\ (b' \\ xs ! l = v \\ l < length xs) \\ (\\b' \\\n (l < h \\ (\\k. (i \\ k \\ k < l \\ xs ! k < v) \\ (h \\ k \\ k < j \\ xs ! k > v))) \\ \n (\\ l < h \\ (\\k. i \\k \\ k < j \\ xs ! k \\ v)))\"\n apply (induct n arbitrary: i j)\n apply (clarsimp simp: repeatatm.simps)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: repeatatm.simps)\n apply (rotate_tac -4; subst (asm) search_stop4_def; clarsimp split: if_splits)\n apply (subst (asm) search_next1_def; subst (asm) search_next1_def)\n apply (subst (asm) search_next1_def[symmetric])\n apply (clarsimp split: if_splits)\n apply (case_tac \"Suc ((i + j) div 2) < j\")\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (erule_tac x = k in allE; clarsimp)\n apply (drule binary_search_range_shrink; simp?)\n apply (clarsimp simp: not_le)\n apply (rule_tac y = \"xs ! ((i + j) div 2)\" in le_less_trans; simp?)\n apply (rule sorted_nth_mono; simp?)\n apply (erule_tac x = k in allE; clarsimp)\n apply (drule binary_search_range_shrink; simp?)\n apply (clarsimp simp: not_le not_less)\n apply (drule_tac i = k and j = \"((i + j) div 2)\" in sorted_nth_mono; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (clarsimp simp: not_le not_less)\n apply (drule_tac i = k and j = \"((i + h) div 2)\" in sorted_nth_mono; simp?)\n apply (drule_tac i = k and j = \"((i + h) div 2)\" in sorted_nth_mono; simp?)\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (clarsimp simp: not_le not_less)\n apply (case_tac \"i < (i + j) div 2\"; clarsimp)\n apply (rule conjI; clarsimp)\n apply (drule binary_search_range_shrink; simp?)\n apply clarsimp\n apply (erule_tac x = k in allE; clarsimp)\n apply (drule_tac i = \"((i + j) div 2)\" and j = k in sorted_nth_mono; simp?)\n apply (drule binary_search_range_shrink; simp?)\n apply clarsimp\n apply (erule_tac x = k in allE; clarsimp)\n apply (drule_tac i = \"((i + j) div 2)\" and j = k in sorted_nth_mono; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (drule_tac i = \"((l + j) div 2)\" and j = k in sorted_nth_mono; simp?)\n apply (drule_tac i = \"((l + j) div 2)\" and j = k in sorted_nth_mono; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n done\n\nlemma binary_search_completes:\n \"\\repeatatm n search_stop4 search_next1 (i, j, False) (xs, v) = (l, h, b'); \n i < j; j \\ length xs; n \\ j - i\\\n \\ b' \\ l \\ h\"\n apply (induct n arbitrary: i j)\n apply (clarsimp simp: repeatatm.simps)\n apply (clarsimp simp: repeatatm.simps)\n apply (rotate_tac 1; subst (asm) search_stop4_def; clarsimp split: if_splits)\n apply (subst (asm) search_next1_def; subst (asm) search_next1_def)\n apply (subst (asm) search_next1_def[symmetric])\n apply (clarsimp split: if_splits)\n apply (case_tac \"Suc ((i + j) div 2) < j\")\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply simp\n apply (case_tac \"i < (i + j) div 2\")\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply simp\n apply simp\n done\n\ntext \"This provides a tighter bound for time complexity analysis\"\n\nlemma binary_search_completes_tight:\n \"\\repeatatm n search_stop4 search_next1 (i, j, False) (xs, v) = (l, h, b'); \n i < j; j \\ length xs; 2 ^ n > j - i\\\n \\ b' \\ l \\ h\"\n apply (induct n arbitrary: i j)\n apply (clarsimp simp: repeatatm.simps)\n apply (clarsimp simp: repeatatm.simps)\n apply (rotate_tac 1; subst (asm) search_stop4_def; clarsimp split: if_splits)\n apply (subst (asm) search_next1_def; subst (asm) search_next1_def)\n apply (subst (asm) search_next1_def[symmetric])\n apply (clarsimp split: if_splits)\n apply (case_tac \"Suc ((i + j) div 2) < j\")\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply simp\n apply (case_tac \"i < (i + j) div 2\")\n apply (elim meta_allE, erule meta_impE, assumption; simp?)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply (case_tac n; clarsimp simp: repeatatm.simps search_stop4_def split: if_splits)\n apply simp\n apply simp\n done\n\nsection \"binary search functional correctness theorem\"\n\ntheorem binary_search_correct:\n \"\\sorted xs; i = unat (Generated_Shallow_Desugar.binarySearch \\T1.p1\\<^sub>f = SWA xs, p2\\<^sub>f = v\\);\n length xs \\ unat (max_word :: 32 word)\\ \\ \n (i < length xs \\ xs ! i = v) \\ \n (\\ i < length xs \\ v \\ set xs)\"\n unfolding Generated_Shallow_Desugar.binarySearch_def swa_length_def repeat'_def swa_get_def \n apply (clarsimp simp: Let_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def valRel_records unat_ucast_of_nat\n search_stop0_simp search_stop1_simp repeatatm_simps \n search_stop2_simp t0_make_simps checked_div_def\n t1_make_simps repeatatm_simps2 le_unat_uoi[where z = \"max_word :: 32 word\"]\n split: prod.splits;\n subst (asm) t0_unmake.simps[symmetric]; subst (asm) searchNext_simps; subst (asm) search_next_simp)\n apply (subst (asm) search_stop3_def[symmetric])\n apply (case_tac xs, clarsimp)\n apply (drule repeatatm_nat_simp, simp)\n apply (subst le_unat_uoi[where z = \"max_word :: 32 word\"]; simp)\n apply simp\n apply (frule binary_search_completes)\n apply (subst le_unat_uoi[where z = \"max_word :: 32 word\"]; simp)+\n apply (drule binary_search_correct_range)\n apply (subst le_unat_uoi[where z = \"max_word :: 32 word\"]; simp)+\n apply simp\n apply (thin_tac \"xs = _ \")\n apply clarsimp\n apply (subst (asm) le_unat_uoi[where z = \"max_word :: 32 word\"], simp)\n apply (simp add: set_conv_nth)\n apply clarsimp\n apply (rename_tac k)\n apply (erule_tac x = k in allE; clarsimp)\n done\n\ndefinition\n array :: \"(lifted_globals \\ WordArray_u32_C ptr) \\\n (WordArray_u32_C \\\n abstyp \\\n vabstyp \\\n vabstyp \\\n 32 word WordArray)\"\nwhere\n \"array sp = \n (let (s, p) = sp;\n w = heap s p;\n l = (SCAST(32 signed \\ 32))(len_C w);\n arr = values_C w;\n xs = (map (\\i. heap_w32 s (arr +\\<^sub>p int i)) [0..<(unat l)]);\n vxs = (map (\\i. VPrim (LU32 i)) xs);\n rp = RCon ''WordArray'' [RPrim (Num U32)]\n in (w,\n UWA (TPrim (Num U32)) l (ptr_val arr),\n VWA (TPrim (Num U32)) vxs,\n VWA (TPrim (Num U32)) vxs,\n SWA xs))\"\n\nabbreviation \"arr\\<^sub>c \\ prod.fst \\ array\"\nabbreviation \"arr\\<^sub>u \\ prod.fst \\ prod.snd \\ array\"\nabbreviation \"arr\\<^sub>m \\ prod.fst \\ prod.snd \\ prod.snd \\ array\"\nabbreviation \"arr\\<^sub>p \\ prod.fst \\ prod.snd \\ prod.snd \\ prod.snd \\ array\"\nabbreviation \"arr\\<^sub>s \\ prod.snd \\ prod.snd \\ prod.snd \\ prod.snd \\ array\"\nabbreviation \"arrlist \\ swa_to_list \\ arr\\<^sub>s\"\nabbreviation \"arrptrs s p \\ map (\\i. ptr_val (values_C (arr\\<^sub>c (s, p)) +\\<^sub>p int i))[0.. 32))(len_C (arr\\<^sub>c (s, p))))]\"\n\n\ndefinition\n inputs :: \"(lifted_globals \\ t8_C) \\\n ((funtyp, atyp, ptrtyp) uval \\\n (funtyp, vabstyp) vval \\\n (funtyp, vabstyp) vval \\\n (32 word WordArray, 32 word) T1)\"\nwhere\n \"inputs sx = \n (let (s, x) = sx;\n p = t8_C.p1_C x;\n v = t8_C.p2_C x;\n rp = RCon ''WordArray'' [RPrim (Num U32)]\n in (URecord [(UPtr (ptr_val p) rp, RPtr rp), (UPrim (LU32 v), RPrim (Num U32))] None,\n VRecord [VAbstract (arr\\<^sub>m (s, p)), VPrim (LU32 v)],\n VRecord [VAbstract (arr\\<^sub>p (s, p)), VPrim (LU32 v)],\n \\T1.p1\\<^sub>f = arr\\<^sub>s (s, p), p2\\<^sub>f = v\\))\"\n\ndefinition\n valid_array :: \"lifted_globals \\ WordArray_u32_C ptr \\ bool\"\nwhere\n \"valid_array s p = \n (let w = heap s p;\n l = (SCAST(32 signed \\ 32))(len_C w);\n arr = values_C w\n in is_valid s p \\ \n size_of (TYPE(32 word)) * unat l \\ unat (max_word :: 32 word) \\\n (\\i < l. is_valid_w32 s (arr +\\<^sub>p uint i)) \\\n (\\i < l. ptr_val p \\ ptr_val (arr +\\<^sub>p uint i)))\"\n\ndefinition\n same_array :: \"lifted_globals \\ lifted_globals \\ WordArray_u32_C ptr \\ bool\"\nwhere\n \"same_array s s' p = \n (let w = heap s p;\n l = (SCAST(32 signed \\ 32))(len_C w);\n w' = heap s' p;\n arr = values_C w\n in valid_array s p \\\n valid_array s' p \\\n w = w' \\\n (\\i < l. heap_w32 s (arr +\\<^sub>p uint i) = heap_w32 s' (arr +\\<^sub>p uint i)))\"\n\nlemma \n \"unat ((of_nat (size_of (TYPE(32 word)))) :: ptrtyp) = size_of (TYPE(32 word))\"\n apply simp\n done\n\nabbreviation \"uv\\<^sub>m \\ prod.fst \\ inputs\"\n\nabbreviation \"vv\\<^sub>m \\ prod.fst \\ prod.snd \\ inputs\"\n\nabbreviation \"vv\\<^sub>p \\ prod.fst \\ prod.snd \\ prod.snd \\ inputs\"\n\nabbreviation \"vv\\<^sub>s \\ prod.snd \\ prod.snd \\ prod.snd \\ inputs\"\n\nlemma inputs_uv_matches:\n \"\\valid_array s p; \\ (ptr_val p) = option.Some (UAbstract (arr\\<^sub>u (s, p)));\n \\p \\ set (arrptrs s p). \\ p = option.Some (UPrim (LU32 (heap_w32 s (PTR(32 word)p))))\\ \\\n u_v_matches \\ \\ [uv\\<^sub>m (s, t8_C p v)] [vv\\<^sub>m (s, t8_C p v)]\n [Some (fst (snd (snd (snd Generated_TypeProof.binarySearch_type))))]\n (insert (ptr_val p) (set (arrptrs s p))) {}\"\n apply (clarsimp simp: inputs_def\n array_def\n Let_def\n Generated_TypeProof.binarySearch_type_def\n Generated_TypeProof.abbreviated_type_defs)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_p_abs_ro[where a = \"arr\\<^sub>u (s, p)\" and ts = \"[TPrim (Num U32)]\", simplified]\n u_v_prim'\n u_v_r_empty; (simp add: array_def Let_def u_v_matches.intros(1))?)\n apply (clarsimp simp: wa_abs_upd_val_def)\n apply (rule conjI)\n apply (clarsimp simp: upd.wa_abs_typing_u_def valid_array_def Let_def)\n apply (rule conjI)\n apply (rule equalityI; clarsimp simp: word_less_nat_alt array_def Let_def)\n apply (intro exI conjI; simp?)\n apply (subst le_unat_uoi[OF order.strict_implies_order]; simp?)\n apply (rule image_eqI; simp?)\n apply clarsimp\n apply (erule_tac x = \"unat i\" in ballE; simp?)\n apply (rule l0.upd.u_t_prim'; simp?)\n apply (clarsimp simp: word_less_nat_alt)\n apply (rule conjI)\n apply (clarsimp simp: val.wa_abs_typing_v_def valid_array_def Let_def)\n apply (rule l0.val.v_t_prim'; simp?)\n apply clarsimp\n apply (erule_tac x = \"unat i\" in ballE; simp?)\n apply (subst nth_map)\n apply (simp add: word_less_nat_alt)\n apply simp\n apply (rule l0.u_v_prim'; simp?)\n apply (simp add: word_less_nat_alt)\n apply (rename_tac i)\n apply (subgoal_tac \"(PTR(32 word) (ptr_val (values_C (heap s p)) + 4 * i)) = (values_C (heap s p) +\\<^sub>p int (unat i))\")\n apply simp\n apply (cut_tac p = \"values_C (heap s p)\" and x = \"of_nat x\" in upd.ptr_val_add[where ?'a = \"32 word\"])\n apply (subst ptr_val_inj[symmetric])\n apply simp\n apply (simp add: word_less_nat_alt)\n done\n\nlemma inputs_staterel_valrel:\n \"\\valid_array s p\\ \\\n \\\\. (\\, s) \\ upd.state_rel \\\n \\ (ptr_val p) = option.Some (UAbstract (arr\\<^sub>u (s, p))) \\\n (\\p \\ set (arrptrs s p). \\ p = option.Some (UPrim (LU32 (heap_w32 s (PTR(32 word)p))))) \\\n val_rel_shallow_C rename (vv\\<^sub>s (s, (t8_C p v))) (t8_C p v) (vv\\<^sub>p (s, (t8_C p v))) (uv\\<^sub>m (s, (t8_C p v))) \\p1 \\ \\\"\n apply (clarsimp simp: val_rel_shallow_C_def\n valRel_records inputs_def\n Let_def\n upd.val_rel_simp\n valRel_WordArrayWord\n ucast_id)\n apply (rule_tac x = \"(\\l. if l = ptr_val p then option.Some (UAbstract (arr\\<^sub>u (s, p))) \n else if l \\ set (arrptrs s p)\n then option.Some (UPrim (LU32 (heap_w32 s (PTR(32 word)l))))\n else None)\" in exI)\n apply (rule conjI)\n apply (clarsimp simp: upd.state_rel_def upd.heap_rel_def)\n apply (rule conjI;\n clarsimp simp: upd.heap_rel_ptr_meta\n upd.heap_rel_meta_def\n array_def\n Let_def\n upd.type_rel_simp\n upd.wa_abs_repr_def\n valid_array_def\n upd.val_rel_simp)\n apply (rename_tac i)\n apply (erule_tac x = \"of_nat i\" in allE)\n apply (clarsimp simp: word_less_nat_alt)\n apply (cut_tac y = i and z = \"(SCAST(32 signed \\ 32) (len_C (heap s p)))\" in le_unat_uoi; simp?)\n apply (subgoal_tac \"x = values_C (heap s p) +\\<^sub>p uint (of_nat i)\")\n apply clarsimp\n apply assumption\n apply (cut_tac p = \"values_C (heap s p)\" and x = \"of_nat i\" in upd.ptr_val_add[where ?'a = \"32 word\"])\n apply (simp add: ptr_add_def )\n apply (subst ptr_val_inj[symmetric])\n apply simp\n apply (rule conjI; clarsimp simp: array_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_array_def Let_def)\n apply (rename_tac i)\n apply (erule_tac x = \"of_nat i\" in allE)+\n apply (cut_tac y = i and z = \"(SCAST(32 signed \\ 32) (len_C (heap s p)))\" in le_unat_uoi; simp?)\n apply (clarsimp simp: word_less_nat_alt)\n apply (frule_tac v = v and \\ = \"(\\l. if l = ptr_val p then option.Some (UAbstract (arr\\<^sub>u (s, p))) \n else if l \\ set (arrptrs s p)\n then option.Some (UPrim (LU32 (heap_w32 s (PTR(32 word)l))))\n else None)\" in inputs_uv_matches; simp?)\n apply (clarsimp simp: valid_array_def Let_def)\n apply (rename_tac j)\n apply (erule_tac x = \"of_nat j\" in allE)+\n apply (clarsimp simp: word_less_nat_alt)\n apply (cut_tac y = j and z = \"(SCAST(32 signed \\ 32) (len_C (heap s p)))\" in le_unat_uoi; simp?)\n apply (clarsimp simp: array_def Let_def u_v_matches.intros(1))+\n (*apply (rule_tac x = \"fst (snd Generated_TypeProof.binarySearch_type)\" in exI)*)\n apply (drule_tac i = 0 in u_v_matches_proj_single'; simp?)\n apply clarsimp\n apply (clarsimp simp: inputs_def array_def Let_def)\n apply (intro exI conjI; assumption)\n done\n\nlemma inputs_rename_monoval:\n \"vv\\<^sub>m sx = val.rename_val rename (val.monoval (vv\\<^sub>p sx))\"\n apply (clarsimp simp: rename_def inputs_def Let_def array_def split: prod.splits)\n done\n\nlemma inputs_val_matches:\n \"val.matches \\ [vv\\<^sub>m (s, t8_C p v)] \n [Some (fst (snd (snd (snd Generated_TypeProof.binarySearch_type))))]\"\n apply (clarsimp simp: val.matches_def\n inputs_def\n Let_def\n array_def\n Generated_TypeProof.binarySearch_type_def\n Generated_TypeProof.abbreviated_type_defs)\n apply (intro val.v_t_record val.v_t_r_cons1 val.v_t_r_empty val.v_t_prim' val.v_t_abstract; simp?)\n apply (clarsimp simp: val.wa_abs_typing_v_def)\n apply (rule l0.val.v_t_prim'; simp?)\n done\n\nlemma WordArray_u32_C_eq_simps:\n \"x = y \\ len_C x = len_C y \\ values_C x = values_C y\"\n apply (rule iffI)\n apply clarsimp\n apply clarsimp\n by (metis WordArray_u32_C_idupdates(1))\n\ncorollary binary_search_C_correct:\n \"\\sorted (arrlist (s, p));\n cc = upd.binarySearch' (t8_C p v);\n valid_array s p\\ \\\n \\ prod.snd (cc s) \\ \n (\\r s'. (r, s') \\ prod.fst (cc s) \\\n same_array s s' p \\\n (unat r < length (arrlist (s, p)) \\ (arrlist (s, p)) ! unat r = v) \\ \n (\\ unat r < length (arrlist (s, p)) \\ v \\ set (arrlist (s, p))))\"\n apply (frule_tac v = v in inputs_staterel_valrel; clarsimp)\n apply (frule_tac s = s in \n corres_shallow_C_binarySearch_concrete[rotated 1,\n OF _ inputs_val_matches[where s = s and p = p and v = v]];\n (simp add: inputs_rename_monoval[simplified])?)\n apply (clarsimp simp: corres_shallow_C_def proc_ctx_wellformed_\\ \\_1_\\m1_matchesuv_\\ upd.\\_1_matchesu_\\)\n apply (erule impE)\n apply (subst inputs_rename_monoval[simplified, symmetric])\n apply (frule_tac \\ = \\ and v = v in inputs_uv_matches; simp?)\n apply (intro exI; assumption)\n apply clarsimp\n apply (erule_tac x = r in allE)\n apply (erule_tac x = s' in allE)\n apply clarsimp\n apply (rule conjI)\n apply (thin_tac \"_ \\ upd.state_rel\")\n apply (frule_tac v = v in inputs_uv_matches; simp?)\n apply (drule u_v_matches_to_matches_ptrs)\n\n apply (drule (1) upd.preservation(1)[where \\s = \"[]\" and K = \"[]\", simplified, \n OF subst_wellformed_nothing proc_ctx_wellformed_\\ _ \n upd.\\_1_matchesu_\\ _ binarySearch_typecorrect', simplified, rotated 1])\n apply (clarsimp simp: Generated_TypeProof.binarySearch_type_def)\n apply (frule upd.tprim_no_pointers(1))\n apply (drule upd.tprim_no_pointers(2))\n apply clarsimp\n apply (drule upd.frame_empty)\n apply (clarsimp simp: valid_array_def same_array_def)\n apply (clarsimp simp: Let_def upd.state_rel_def upd.heap_rel_def upd.heap_rel_ptr_meta)\n apply (erule_tac x = p in allE)\n apply (clarsimp simp: upd.heap_rel_meta_def array_def Let_def type_rel_simps upd.wa_abs_repr_def val_rel_simps)\n apply (rule conjI)\n apply clarsimp\n apply (rename_tac i)\n apply (erule_tac x = \"unat i\" in ballE; simp?)\n apply (subgoal_tac \"(PTR(32 word) (ptr_val (values_C (heap s p)) + 4 * i)) = (values_C (heap s p) +\\<^sub>p uint i)\")\n apply simp\n apply (erule_tac x = \"values_C (heap s' p) +\\<^sub>p uint i\" in allE)\n apply (clarsimp simp: upd.heap_rel_meta_def array_def Let_def type_rel_simps upd.wa_abs_repr_def val_rel_simps)\n apply (simp add: ptr_add_def)\n apply (clarsimp simp: word_less_nat_alt)\n apply (rule conjI)\n apply (clarsimp simp: WordArray_u32_C_eq_simps)\n apply clarsimp\n apply (rename_tac i)\n apply (erule_tac x = \"unat i\" in ballE; simp?)\n apply (subgoal_tac \"(PTR(32 word) (ptr_val (values_C (heap s p)) + 4 * i)) = (values_C (heap s p) +\\<^sub>p uint i)\")\n apply simp\n apply (erule_tac x = \"values_C (heap s' p) +\\<^sub>p uint i\" in allE)\n apply (clarsimp simp: upd.heap_rel_meta_def array_def Let_def type_rel_simps upd.wa_abs_repr_def val_rel_simps)\n apply (simp add: ptr_add_def)\n apply (clarsimp simp: word_less_nat_alt)\n apply (rotate_tac -1; subst (asm) val_rel_shallow_C_def)\n apply (clarsimp simp: val_rel_simps valRel_records)\n apply (erule u_v_uvprimE)\n apply (drule_tac i = \"unat r\" and v = v in binary_search_correct; simp?)\n apply (clarsimp simp: inputs_def array_def Let_def unat_le_helper)+\n done\n \nend (* of context *)\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/BinarySearch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2602630037940149}} {"text": "section \\Safety Properties\\\n\ntext \\This section describes the invariants that hold in the system, shows that the implementation\npreserves the invariants, and shows that the invariants imply the required safety properties.\\\n\ntheory Zen\n imports Implementation OneSlot\nbegin\n\nsubsection \\Invariants on messages\\\n\ntext \\Firstly, a set of invariants that hold on the set of messages that\nhave ever been sent, without considering the state of any individual\nnode.\\\n\nfun nat_inductive_def :: \"'a \\ (nat \\ 'a \\ 'a) \\ nat \\ 'a\"\n where\n \"nat_inductive_def zeroCase sucCase 0 = zeroCase\"\n | \"nat_inductive_def zeroCase sucCase (Suc i) = sucCase i (nat_inductive_def zeroCase sucCase i)\"\n\nlocale zenMessages =\n fixes messages :: \"RoutedMessage set\"\n fixes isMessageFromTo :: \"Node \\ Message \\ Destination \\ bool\" (\"(_) \\\\ _ \\\\ (_)\" [1000,55,1000])\n defines \"s \\\\ m \\\\ d \\ \\ sender = s, destination = d, payload = m \\ \\ messages\"\n fixes isMessageFrom :: \"Node \\ Message \\ bool\" (\"(_) \\\\ _ \\\\\" [1000,55])\n defines \"s \\\\ m \\\\ \\ \\ d. s \\\\ m \\\\ d\"\n fixes isMessageTo :: \"Message \\ Destination \\ bool\" (\"\\ _ \\\\ (_)\" [55,1000])\n defines \"\\ m \\\\ d \\ \\ s. s \\\\ m \\\\ d\"\n fixes isMessage :: \"Message \\ bool\" (\"\\ _ \\\\\" [55])\n defines \"\\ m \\\\ \\ \\ s. s \\\\ m \\\\\"\n (* value proposed in a slot & a term *)\n fixes v :: \"Slot \\ Term \\ Value\"\n defines \"v i t \\ THE x. \\ PublishRequest i t x \\\\\"\n (* whether a slot is committed *)\n fixes isCommitted :: \"Slot \\ bool\"\n defines \"isCommitted i \\ \\ t. \\ ApplyCommit i t \\\\\"\n (* whether all preceding slots are committed *)\n fixes committedTo :: \"Slot \\ bool\" (\"committed\\<^sub><\")\n defines \"committed\\<^sub>< i \\ \\ j < i. isCommitted j\"\n (* the committed value in a slot *)\n fixes v\\<^sub>c :: \"Slot \\ Value\"\n defines \"v\\<^sub>c i \\ v i (SOME t. \\ ApplyCommit i t \\\\)\"\n (* the configuration of a slot *)\n fixes V :: \"Slot \\ Node set\"\n defines \"V \\ nat_inductive_def V\\<^sub>0 (\\i Vi. if isReconfiguration (v\\<^sub>c i) then getConf (v\\<^sub>c i) else Vi)\"\n (* predicate to say whether an applicable Vote has been sent *)\n fixes promised :: \"Slot \\ Node \\ Node \\ Term \\ bool\"\n defines \"promised i s dn t \\ \\ i' \\ i. \\ a. s \\\\ Vote i' t a \\\\ (OneNode dn)\"\n (* set of previously-accepted terms *)\n fixes prevAccepted :: \"Slot \\ Term \\ Node set \\ Term set\"\n defines \"prevAccepted i t senders\n \\ {t'. \\ s \\ senders. s \\\\ Vote i t (SomeTerm t') \\\\ }\"\n fixes lastCommittedClusterStateBefore :: \"Slot \\ ClusterState\"\n defines \"lastCommittedClusterStateBefore \\ nat_inductive_def CS\\<^sub>0\n (\\i CSi. case v\\<^sub>c i of ClusterStateDiff diff \\ diff CSi | _ \\ CSi)\"\n\n(* ASSUMPTIONS *)\nassumes Vote_future:\n \"\\i i' s t t' a.\n \\ s \\\\ Vote i t a \\\\; i < i'; t' < t \\\n \\ \\ s \\\\ PublishResponse i' t' \\\\\"\nassumes Vote_None:\n \"\\i s t t'.\n \\ s \\\\ Vote i t NO_TERM \\\\; t' < t \\\n \\ \\ s \\\\ PublishResponse i t' \\\\\"\nassumes Vote_Some_lt:\n \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\\n \\ t' < t\"\nassumes Vote_Some_PublishResponse:\n \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\\n \\ s \\\\ PublishResponse i t' \\\\\"\nassumes Vote_Some_max:\n \"\\i s t t' t''. \\ s \\\\ Vote i t (SomeTerm t') \\\\; t' < t''; t'' < t \\\n \\ \\ s \\\\ PublishResponse i t'' \\\\\"\nassumes Vote_not_broadcast:\n \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\"\nassumes Vote_unique_destination:\n \"\\i s t a a' d d'. \\ s \\\\ Vote i t a \\\\ d; s \\\\ Vote i' t a' \\\\ d' \\\n \\ d = d'\"\nassumes PublishRequest_committedTo:\n \"\\i t x. \\ PublishRequest i t x \\\\ \\ committedTo i\"\nassumes PublishRequest_quorum:\n \"\\i s t x. s \\\\ PublishRequest i t x \\\\\n \\ \\ q \\ majorities (V i). (\\ n \\ q. promised i n s t) \\\n (prevAccepted i t q = {}\n \\ (\\ t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t'\n \\ \\ PublishResponse i t' \\\\ \\ t' < t))\"\nassumes PublishRequest_function:\n \"\\i t x x'. \\ \\ PublishRequest i t x \\\\; \\ PublishRequest i t x' \\\\ \\\n \\ x = x'\"\nassumes finite_messages:\n \"finite messages\"\nassumes PublishResponse_PublishRequest:\n \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\ x. \\ PublishRequest i t x \\\\\"\nassumes ApplyCommit_quorum:\n \"\\i t. \\ ApplyCommit i t \\\\\n \\ \\ q \\ majorities (V i). \\ s \\ q. s \\\\ PublishResponse i t \\\\\"\nassumes CatchUpResponse_committedTo:\n \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\"\nassumes CatchUpResponse_V:\n \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\"\nassumes CatchUpResponse_lastCommittedClusterStateBefore:\n \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\"\n\ndefinition (in zenMessages) votedFor :: \"Node \\ Node \\ Term \\ bool\"\n where \"votedFor n\\<^sub>1 n\\<^sub>2 t \\ \\ i. promised i n\\<^sub>1 n\\<^sub>2 t\"\n\nlemma (in zenMessages) votedFor_unique:\n assumes \"votedFor n n\\<^sub>1 t\"\n assumes \"votedFor n n\\<^sub>2 t\"\n shows \"n\\<^sub>1 = n\\<^sub>2\"\n using assms unfolding votedFor_def by (meson Destination.inject Vote_unique_destination promised_def)\n\nlemma (in zenMessages) V_simps[simp]:\n \"V 0 = V\\<^sub>0\"\n \"V (Suc i) = (if isReconfiguration (v\\<^sub>c i) then getConf (v\\<^sub>c i) else V i)\"\n unfolding V_def by simp_all\n\nlemma (in zenMessages) lastCommittedClusterStateBefore_simps[simp]:\n \"lastCommittedClusterStateBefore 0 = CS\\<^sub>0\"\n \"lastCommittedClusterStateBefore (Suc i) = (case v\\<^sub>c i of ClusterStateDiff diff \\ diff | _ \\ id) (lastCommittedClusterStateBefore i)\"\n unfolding lastCommittedClusterStateBefore_def by (simp, cases \"v\\<^sub>c i\", auto)\n\ndeclare [[goals_limit = 40]]\n\nsubsubsection \\Utility lemmas\\\n\ntext \\Some results that are useful later:\\\n\nlemma (in zenMessages) V_finite: \"finite (V i)\"\n by (induct i, simp_all add: finite_V\\<^sub>0 getConf_finite)\n\nlemma (in zenMessages) V_intersects: \"majorities (V i) \\ majorities (V i)\"\n using V_finite majorities_intersect by simp\n\nlemma (in zenMessages) ApplyCommit_PublishResponse:\n assumes \"\\ ApplyCommit i t \\\\\"\n obtains s where \"s \\\\ PublishResponse i t \\\\\"\n by (meson ApplyCommit_quorum majorities_member assms)\n\nlemma (in zenMessages) ApplyCommit_PublishRequest:\n assumes \"\\ ApplyCommit i t \\\\\"\n shows \"\\ PublishRequest i t (v i t) \\\\\"\n by (metis ApplyCommit_PublishResponse PublishResponse_PublishRequest assms the_equality v_def PublishRequest_function)\n\nlemma (in zenMessages) PublishRequest_Vote:\n assumes \"s \\\\ PublishRequest i t x \\\\\"\n obtains i' n a where \"i' \\ i\" \"n \\\\ Vote i' t a \\\\ (OneNode s)\"\n by (meson PublishRequest_quorum majorities_member assms isMessage_def promised_def)\n\nlemma (in zenMessages) finite_prevAccepted: \"finite (prevAccepted i t ns)\"\nproof -\n fix t\\<^sub>0\n define f :: \"RoutedMessage \\ Term\" where \"f \\ \\ m. case payload m of Vote _ _ (SomeTerm t') \\ t' | _ \\ t\\<^sub>0\"\n have \"prevAccepted i t ns \\ f ` messages\"\n apply (simp add: prevAccepted_def f_def isMessageFrom_def isMessageFromTo_def, intro subsetI)\n using image_iff by fastforce\n with finite_messages show ?thesis using finite_surj by auto\nqed\n\nlemma (in zenMessages) promised_long_def: \"\\d. promised i s d t\n \\ (s \\\\ Vote i t NO_TERM \\\\\n \\ (\\i'a. s \\\\ Vote i' t a \\\\))\n \\ (\\t'. s \\\\ Vote i t (SomeTerm t') \\\\)\"\n (is \"?LHS == ?RHS\")\nproof -\n have \"?LHS = ?RHS\"\n apply (intro iffI)\n apply (metis TermOption.exhaust isMessageFrom_def nat_less_le promised_def)\n by (metis Destination.exhaust Vote_not_broadcast isMessageFrom_def isMessageTo_def nat_less_le not_le promised_def)\n thus \"?LHS == ?RHS\" by simp\nqed\n\nlemma (in zenMessages) Vote_value_function:\n assumes \"s \\\\ Vote i t a\\<^sub>1 \\\\\" and \"s \\\\ Vote i t a\\<^sub>2 \\\\\"\n shows \"a\\<^sub>1 = a\\<^sub>2\"\nproof (cases a\\<^sub>1)\n case NO_TERM\n with assms show ?thesis\n by (metis TermOption.exhaust Vote_None Vote_Some_PublishResponse Vote_Some_lt)\nnext\n case (SomeTerm t\\<^sub>1)\n with assms obtain t\\<^sub>2 where a\\<^sub>2: \"a\\<^sub>2 = SomeTerm t\\<^sub>2\"\n using Vote_None Vote_Some_PublishResponse Vote_Some_lt TermOption.exhaust by metis\n\n from SomeTerm a\\<^sub>2 assms show ?thesis\n by (metis Vote_Some_PublishResponse Vote_Some_lt less_linear Vote_Some_max)\nqed\n\nlemma (in zenMessages) shows finite_messages_insert: \"finite (insert m messages)\"\n using finite_messages by auto\n\nlemma (in zenMessages) isCommitted_committedTo:\n assumes \"isCommitted i\"\n shows \"committed\\<^sub>< i\"\n using ApplyCommit_PublishRequest PublishRequest_committedTo assms isCommitted_def by blast\n\nlemma (in zenMessages) isCommitted_committedTo_Suc:\n assumes \"isCommitted i\"\n shows \"committed\\<^sub>< (Suc i)\"\n using assms committedTo_def isCommitted_committedTo less_antisym by blast\n\nlemma (in zenMessages) promised_unique:\n assumes \"promised i s d t\" and \"promised i' s d' t\"\n shows \"d = d'\"\n by (meson Destination.inject Vote_unique_destination assms promised_def)\n\nlemma (in zenMessages) PublishResponse_PublishRequest_v:\n assumes \"\\ PublishResponse i t \\\\\"\n shows \"\\ PublishRequest i t (v i t) \\\\\"\nproof -\n from assms obtain s where \"s \\\\ PublishResponse i t \\\\\" unfolding isMessage_def by blast\n with PublishResponse_PublishRequest\n obtain x where x: \"\\ PublishRequest i t x \\\\\" by blast\n have \"v i t = x\" unfolding v_def using x by (intro the_equality PublishRequest_function)\n with x show ?thesis by simp\nqed\n\nlemma (in zenMessages) Vote_PublishRequest_v:\n assumes \"\\ Vote i t (SomeTerm t') \\\\\"\n shows \"\\ PublishRequest i t' (v i t') \\\\\"\n using assms Vote_Some_PublishResponse PublishResponse_PublishRequest_v\n unfolding isMessage_def by metis\n\nsubsubsection \\Relationship to @{term oneSlot}\\\n\ntext \\This shows that each slot @{term i} in Zen satisfies the assumptions of the @{term\noneSlot} model above.\\\n\nlemma (in zenMessages) zen_is_oneSlot:\n fixes i\n shows \"oneSlot (majorities (V i)) (v i)\n (\\ s t. s \\\\ Vote i t NO_TERM \\\\\n \\ (\\ i' < i. \\ a. s \\\\ Vote i' t a \\\\))\n (\\ s t t'. s \\\\ Vote i t (SomeTerm t') \\\\)\n (\\ t. \\ x. \\ PublishRequest i t x \\\\)\n (\\ s t. s \\\\ PublishResponse i t \\\\)\n (\\ t. \\ ApplyCommit i t \\\\)\"\nproof (unfold_locales, fold prevAccepted_def promised_long_def)\n from V_intersects show \"majorities (V i) \\ majorities (V i)\".\nnext\n fix s t t'\n assume \"t' < t\" \"s \\\\ Vote i t NO_TERM \\\\ \\ (\\i'a. s \\\\ Vote i' t a \\\\)\"\n thus \"\\ s \\\\ PublishResponse i t' \\\\\"\n using Vote_None Vote_future by auto\nnext\n fix s t t'\n assume j: \"s \\\\ Vote i t (SomeTerm t') \\\\\"\n from j show \"t' < t\" using Vote_Some_lt by blast\n from j show \"s \\\\ PublishResponse i t' \\\\\" using Vote_Some_PublishResponse by blast\n\n fix t'' assume \"t' < t''\" \"t'' < t\"\n with j show \"\\ s \\\\ PublishResponse i t'' \\\\\" using Vote_Some_max by blast\nnext\n fix t\n assume \"\\x. \\ PublishRequest i t x \\\\\"\n then obtain x s where \"s \\\\ PublishRequest i t x \\\\\" by (auto simp add: isMessage_def)\n from PublishRequest_quorum [OF this] PublishResponse_PublishRequest\n show \"\\q \\ majorities (V i). (\\n\\q. \\d. promised i n d t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ (\\x. \\ PublishRequest i t' x \\\\) \\ t' < t))\"\n unfolding isMessageFrom_def by (meson PublishResponse_PublishRequest_v)\nnext\n fix s t assume \"s \\\\ PublishResponse i t \\\\\"\n thus \"\\x. \\ PublishRequest i t x \\\\\"\n by (simp add: PublishResponse_PublishRequest)\nnext\n fix t assume \"\\ ApplyCommit i t \\\\\"\n thus \"\\q \\ majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\"\n by (simp add: ApplyCommit_quorum)\nnext\n fix t\\<^sub>0\n define f :: \"RoutedMessage \\ Term\"\n where \"f \\ \\ m. case payload m of PublishRequest i t x \\ t | _ \\ t\\<^sub>0\"\n\n have \"{t. \\x. \\ PublishRequest i t x \\\\} \\ f ` messages\"\n apply (unfold isMessage_def isMessageFrom_def isMessageFromTo_def)\n using f_def image_iff by fastforce\n\n moreover have \"finite (f ` messages)\"\n by (simp add: finite_messages)\n\n ultimately show \"finite {t. \\x. \\ PublishRequest i t x \\\\}\"\n using finite_subset by blast\nqed\n\ntext \\From this it follows that all committed values are equal.\\\n\ntheorem (in zenMessages) consistent:\n assumes \"\\ ApplyCommit i t\\<^sub>1 \\\\\"\n assumes \"\\ ApplyCommit i t\\<^sub>2 \\\\\"\n assumes \"\\ PublishRequest i t\\<^sub>1 v\\<^sub>1 \\\\\"\n assumes \"\\ PublishRequest i t\\<^sub>2 v\\<^sub>2 \\\\\"\n shows \"v\\<^sub>1 = v\\<^sub>2\"\nproof -\n from oneSlot.consistent [OF zen_is_oneSlot] assms\n have \"v i t\\<^sub>1 = v i t\\<^sub>2\" by blast\n moreover have \"v\\<^sub>1 = v i t\\<^sub>1\" using ApplyCommit_PublishRequest assms PublishRequest_function by blast\n moreover have \"v\\<^sub>2 = v i t\\<^sub>2\" using ApplyCommit_PublishRequest assms PublishRequest_function by blast\n ultimately show ?thesis by simp\nqed\n\nlemma (in zenMessages) ApplyCommit_v\\<^sub>c:\n assumes \"\\ ApplyCommit i t \\\\\"\n shows \"v\\<^sub>c i = v i t\"\nproof (unfold v\\<^sub>c_def, intro someI2 [where Q = \"\\t'. v i t' = v i t\"])\n from assms show \"\\ ApplyCommit i t \\\\\" .\n fix t' assume \"\\ ApplyCommit i t' \\\\\"\n thus \"v i t' = v i t\" by (intro oneSlot.consistent [OF zen_is_oneSlot] assms)\nqed\n\nlemma (in zenMessages) ApplyCommit_PublishRequest_v\\<^sub>c:\n assumes \"\\ ApplyCommit i t \\\\\"\n shows \"\\ PublishRequest i t (v\\<^sub>c i) \\\\\"\n unfolding ApplyCommit_v\\<^sub>c [OF assms]\n using ApplyCommit_PublishRequest assms .\n\nsubsection \\Invariants on node states\\\n\ntext \\A set of invariants which relate the states of the individual nodes to the set of messages sent.\\\n\nlocale zen = zenMessages +\n fixes nodeState :: \"Node \\ NodeData\"\n assumes currentNode_nodeState: \"\\n. currentNode (nodeState n) = n\"\n assumes committedTo_firstUncommittedSlot:\n \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\"\n assumes currentVotingNodes_firstUncommittedSlot:\n \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\"\n assumes firstUncommittedSlot_PublishRequest:\n \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\"\n assumes firstUncommittedSlot_PublishResponse:\n \"\\i n t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\"\n assumes lastAcceptedTerm_None: \"\\n t. lastAcceptedTerm (nodeState n) = NO_TERM\n \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\"\n assumes lastAcceptedTerm_Some_sent: \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t\n \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\"\n assumes lastAcceptedTerm_Some_max: \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t\n \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\\n \\ t' \\ t\"\n assumes lastAcceptedTerm_Some_currentTerm: \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t\n \\ t \\ currentTerm (nodeState n)\"\n assumes lastAcceptedTerm_Some_value: \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t\n \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\"\n assumes Vote_currentTerm:\n \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\"\n assumes Vote_slot_function:\n \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\"\n assumes PublishRequest_currentTerm:\n \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\\n \\ t \\ currentTerm (nodeState n)\"\n assumes PublishRequest_publishPermitted_currentTerm:\n \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\\n \\ publishPermitted (nodeState n)\n \\ t < currentTerm (nodeState n)\"\n assumes joinVotes:\n \"\\ n n'. n' \\ joinVotes (nodeState n)\n \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\"\n assumes electionWon_isQuorum:\n \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\"\n assumes joinVotes_max: \"\\n n' a'.\n \\ \\ (\\ x. \\ PublishRequest (firstUncommittedSlot (nodeState n))\n (currentTerm (nodeState n)) x \\\\);\n n' \\ joinVotes (nodeState n);\n n' \\\\ Vote (firstUncommittedSlot (nodeState n))\n (currentTerm (nodeState n))\n a' \\\\ (OneNode n) \\\n \\ a' \\ lastAcceptedTerm (nodeState n)\"\n assumes publishVotes: \"\\n n'. n' \\ publishVotes (nodeState n)\n \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n))\n (currentTerm (nodeState n)) \\\\\"\n assumes currentClusterState_lastCommittedClusterStateBefore:\n \"\\n. currentClusterState (nodeState n)\n = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\"\n\nlemma (in zen) joinVotes_votedFor:\n assumes \"n' \\ joinVotes (nodeState n)\"\n shows \"votedFor n' n (currentTerm (nodeState n))\"\n using joinVotes assms unfolding votedFor_def by auto\n\nlocale zenStep = zen +\n fixes messages' :: \"RoutedMessage set\"\n fixes nodeState' :: \"Node \\ NodeData\"\n fixes n\\<^sub>0 :: Node\n\nassumes messages_subset: \"messages \\ messages'\"\nfixes nd :: NodeData\ndefines \"nd \\ nodeState n\\<^sub>0\"\nfixes nd' :: NodeData\ndefines \"nd' \\ nodeState' n\\<^sub>0\"\nassumes nodeState_unchanged: \"\\n. n \\ n\\<^sub>0 \\ nodeState' n = nodeState n\"\n (* updated definitions from zenMessages *)\nfixes isMessageFromTo' :: \"Node \\ Message \\ Destination \\ bool\" (\"(_) \\\\ _ \\\\' (_)\" [1000,55,1000])\ndefines \"s \\\\ m \\\\' d \\ \\ sender = s, destination = d, payload = m \\ \\ messages'\"\nfixes isMessageFrom' :: \"Node \\ Message \\ bool\" (\"(_) \\\\ _ \\\\'\" [1000,55])\ndefines \"s \\\\ m \\\\' \\ \\ d. s \\\\ m \\\\' d\"\nfixes isMessageTo' :: \"Message \\ Destination \\ bool\" (\"\\ _ \\\\' (_)\" [55,1000])\ndefines \"\\ m \\\\' d \\ \\ s. s \\\\ m \\\\' d\"\nfixes isMessage' :: \"Message \\ bool\" (\"\\ _ \\\\'\" [55])\ndefines \"\\ m \\\\' \\ \\ s. s \\\\ m \\\\'\"\n (* value proposed in a slot & a term *)\nfixes v' :: \"nat \\ Term \\ Value\"\ndefines \"v' i t \\ THE x. \\ PublishRequest i t x \\\\'\"\n (* whether a slot is committed *)\nfixes isCommitted' :: \"nat \\ bool\"\ndefines \"isCommitted' i \\ \\ t. \\ ApplyCommit i t \\\\'\"\n (* whether all preceding slots are committed *)\nfixes committedTo' :: \"nat \\ bool\" (\"committed\\<^sub><'\")\ndefines \"committed\\<^sub><' i \\ \\ j < i. isCommitted' j\"\n (* the committed value in a slot *)\nfixes v\\<^sub>c' :: \"nat \\ Value\"\ndefines \"v\\<^sub>c' i \\ v' i (SOME t. \\ ApplyCommit i t \\\\')\"\n (* the configuration of a slot *)\nfixes V' :: \"Slot \\ Node set\"\ndefines \"V' \\ nat_inductive_def V\\<^sub>0 (\\i Vi. if isReconfiguration (v\\<^sub>c' i) then getConf (v\\<^sub>c' i) else Vi)\"\n (* predicate to say whether an applicable Vote has been sent *)\nfixes promised' :: \"nat \\ Node \\ Node \\ Term \\ bool\"\ndefines \"promised' i s dn t \\ \\ i' \\ i. \\ a. s \\\\ Vote i' t a \\\\' (OneNode dn)\"\n (* set of previously-accepted terms *)\nfixes prevAccepted' :: \"nat \\ Term \\ Node set \\ Term set\"\ndefines \"prevAccepted' i t senders\n \\ {t'. \\ s \\ senders. s \\\\ Vote i t (SomeTerm t') \\\\' }\"\nfixes lastCommittedClusterStateBefore' :: \"nat \\ ClusterState\"\ndefines \"lastCommittedClusterStateBefore' \\ nat_inductive_def CS\\<^sub>0\n (\\i CSi. case v\\<^sub>c' i of ClusterStateDiff diff \\ diff CSi | _ \\ CSi)\"\nfixes sendTo :: \"Destination \\ (NodeData * Message option) \\ RoutedMessage set\"\ndefines \"sendTo d result \\ case snd result of\n None \\ messages | Some m \\ insert \\ sender = n\\<^sub>0, destination = d, payload = m \\ messages\"\n\nlemma (in zenStep) nodeState'_def: \"nodeState' n \\ if n = n\\<^sub>0 then nd' else nodeState n\"\n using nodeState_unchanged nd'_def by presburger\n\nlemma (in zenStep) V'_simps[simp]:\n \"V' 0 = V\\<^sub>0\"\n \"V' (Suc i) = (if isReconfiguration (v\\<^sub>c' i) then getConf (v\\<^sub>c' i) else V' i)\"\n unfolding V'_def by simp_all\n\nlemma (in zenStep) lastCommittedClusterStateBefore'_simps[simp]:\n \"lastCommittedClusterStateBefore' 0 = CS\\<^sub>0\"\n \"lastCommittedClusterStateBefore' (Suc i) = (case v\\<^sub>c' i of ClusterStateDiff diff \\ diff | _ \\ id) (lastCommittedClusterStateBefore' i)\"\n unfolding lastCommittedClusterStateBefore'_def by (simp, cases \"v\\<^sub>c' i\", auto)\n\nlemma (in zenStep) sendTo_simps[simp]:\n \"sendTo d (nd'', None) = messages\"\n \"sendTo d (nd'', Some m) = insert \\ sender = n\\<^sub>0, destination = d, payload = m \\ messages\"\n by (auto simp add: sendTo_def)\n\nlemma currentTerm_ensureCurrentTerm[simp]: \"currentTerm nd \\ t \\ currentTerm (ensureCurrentTerm t nd) = t\"\n by (auto simp add: ensureCurrentTerm_def)\n\nlemma (in zenStep)\n assumes \"\\i i' s t t' a. s \\\\ Vote i t a \\\\' \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\'\"\n assumes \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\' \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\'\"\n assumes \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\' \\ t' < t\"\n assumes \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\' \\ s \\\\ PublishResponse i t' \\\\'\"\n assumes \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\' \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\'\"\n assumes \"\\i t a d. \\ Vote i t a \\\\' d \\ d \\ Broadcast\"\n assumes \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\' d \\ s \\\\ Vote i' t a' \\\\' d' \\ d = d'\"\n assumes \"\\i t x. \\ PublishRequest i t x \\\\' \\ committed\\<^sub><' i\"\n assumes \"\\i s t x. s \\\\ PublishRequest i t x \\\\' \\ \\q\\majorities (V' i). (\\n\\q. promised' i n s t) \\ (prevAccepted' i t q = {} \\ (\\t'. v' i t = v' i t' \\ maxTerm (prevAccepted' i t q) \\ t' \\ \\ PublishResponse i t' \\\\' \\ t' < t))\"\n assumes \"\\i t x x'. \\ PublishRequest i t x \\\\' \\ \\ PublishRequest i t x' \\\\' \\ x = x'\"\n assumes \"finite messages'\"\n assumes \"\\i s t. s \\\\ PublishResponse i t \\\\' \\ \\x. \\ PublishRequest i t x \\\\'\"\n assumes \"\\i t. \\ ApplyCommit i t \\\\' \\ \\q\\majorities (V' i). \\s\\q. s \\\\ PublishResponse i t \\\\'\"\n assumes \"\\n. currentNode (nodeState' n) = n\"\n assumes \"\\n. committed\\<^sub><' (firstUncommittedSlot (nodeState' n))\"\n assumes \"\\n. currentVotingNodes (nodeState' n) = V' (firstUncommittedSlot (nodeState' n))\"\n assumes \"\\i n t x. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishRequest i t x \\\\'\"\n assumes \"\\i n t. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishResponse i t \\\\'\"\n assumes \"\\n t. lastAcceptedTerm (nodeState' n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\'\"\n assumes \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\'\"\n assumes \"\\n t t'. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t' \\\\' \\ t' \\ t\"\n assumes \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState' n)) t (lastAcceptedValue (nodeState' n)) \\\\'\"\n assumes \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ t \\ currentTerm (nodeState' n)\"\n assumes \"\\n i t a. n \\\\ Vote i t a \\\\' \\ t \\ currentTerm (nodeState' n)\"\n assumes \"\\n i i' t a a'. n \\\\ Vote i t a \\\\' \\ n \\\\ Vote i' t a' \\\\' \\ i = i'\"\n assumes \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\' \\ t \\ currentTerm (nodeState' n)\"\n assumes \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\' \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState' n)\"\n assumes \"\\n n'. n' \\ joinVotes (nodeState' n) \\ promised' (firstUncommittedSlot (nodeState' n)) n' n (currentTerm (nodeState' n))\"\n assumes \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState' n) (joinVotes (nodeState' n))\"\n assumes \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState' n)) x \\\\') \\ n' \\ joinVotes (nodeState' n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState' n)) a' \\\\' (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState' n)\"\n assumes \"\\n n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState' n)) \\\\'\"\n assumes \"\\n. currentClusterState (nodeState' n) = lastCommittedClusterStateBefore' (firstUncommittedSlot (nodeState' n))\"\n assumes \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ committed\\<^sub><' i\"\n assumes \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ V' i = conf\"\n assumes \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ lastCommittedClusterStateBefore' i = cs\"\n shows zenI: \"zen messages' nodeState'\"\n apply (unfold_locales)\n apply (fold isMessageFromTo'_def)\n apply (fold isMessageTo'_def)\n apply (fold isMessageFrom'_def)\n apply (fold isMessage'_def)\n apply (fold v'_def)\n apply (fold isCommitted'_def)\n apply (fold committedTo'_def)\n apply (fold v\\<^sub>c'_def)\n apply (fold V'_def)\n apply (fold promised'_def)\n apply (fold prevAccepted'_def)\n apply (fold lastCommittedClusterStateBefore'_def)\n using assms proof - qed\n\nlemma (in zenStep)\n assumes \"zen messages' nodeState'\" \"messages' \\ messages''\" \"\\n. n \\ n\\<^sub>0 \\ nodeState' n = nodeState'' n\"\n shows zenStepI1: \"zenStep messages' nodeState' messages'' nodeState'' n\\<^sub>0\"\nproof (intro_locales)\n from `zen messages' nodeState'`\n show \"zenMessages messages'\" \"zen_axioms messages' nodeState'\"\n unfolding zen_def by simp_all\n\n from assms\n show \"zenStep_axioms messages' nodeState' messages'' nodeState'' n\\<^sub>0\"\n by (intro zenStep_axioms.intro, auto)\nqed\n\nlemma (in zenStep)\n assumes \"messages \\ messages''\" \"\\n. n \\ n\\<^sub>0 \\ nodeState n = nodeState'' n\"\n shows zenStepI2: \"zenStep messages nodeState messages'' nodeState'' n\\<^sub>0\"\nproof (intro_locales)\n from assms\n show \"zenStep_axioms messages nodeState messages'' nodeState'' n\\<^sub>0\"\n by (intro zenStep_axioms.intro, auto)\nqed\n\nlemma (in zenStep) Broadcast_to_OneNode:\n fixes x\n assumes nodeState': \"nodeState' = nodeState\"\n assumes sent: \"n\\<^sub>0 \\\\ m \\\\ Broadcast\"\n assumes messages': \"messages' = sendTo (OneNode d) (nd'', Some m)\"\n shows \"zen messages' nodeState'\"\nproof -\n have messages': \"messages' = insert \\sender = n\\<^sub>0, destination = OneNode d, payload = m \\ messages\"\n by (simp add: messages')\n\n from Vote_not_broadcast sent have not_Vote: \"\\i t a. m \\ Vote i t a\"\n unfolding isMessageTo_def by blast\n\n from sent not_Vote have message_simps:\n \"\\s m'. (s \\\\ m' \\\\') = (s \\\\ m' \\\\)\"\n \"\\m'. (\\ m' \\\\') = (\\ m' \\\\)\"\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n by (auto simp add: isMessageFromTo'_def isMessageTo'_def isMessage'_def isMessageFrom'_def,\n auto simp add: isMessageFromTo_def isMessageTo_def isMessage_def isMessageFrom_def messages')\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n by (unfold nodeState', auto)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def message_simps)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def message_simps)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def message_simps)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def message_simps)\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def message_simps)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from joinVotes_max show \" \\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n qed\nqed\n\nlemma (in zenStep) send_spontaneous_message:\n assumes messages': \"messages' = sendTo d\\<^sub>0 (nd, Some m)\"\n assumes spontaneous: \"case m of StartJoin _ \\ True | ClientValue _ \\ True | Reboot \\ True | CatchUpRequest \\ True | _ \\ False\"\n assumes nodeState': \"nodeState' = nodeState\"\n shows \"zen messages' nodeState'\"\nproof -\n have messages': \"messages' = insert \\sender = n\\<^sub>0, destination = d\\<^sub>0, payload = m \\ messages\"\n by (simp add: messages')\n\n from spontaneous\n have message_simps[simp]:\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\s d i t. (s \\\\ PublishResponse i t \\\\' d) = (s \\\\ PublishResponse i t \\\\ d)\"\n \"\\s d i t x. (s \\\\ PublishRequest i t x \\\\' d) = (s \\\\ PublishRequest i t x \\\\ d)\"\n \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = (s \\\\ ApplyCommit i t \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n \"\\d i t. (\\ PublishResponse i t \\\\' d) = (\\ PublishResponse i t \\\\ d)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\' d) = (\\ PublishRequest i t x \\\\ d)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = (\\ ApplyCommit i t \\\\ d)\"\n \"\\s i t a. (s \\\\ Vote i t a \\\\') = (s \\\\ Vote i t a \\\\)\"\n \"\\s i t. (s \\\\ PublishResponse i t \\\\') = (s \\\\ PublishResponse i t \\\\)\"\n \"\\s i t x. (s \\\\ PublishRequest i t x \\\\') = (s \\\\ PublishRequest i t x \\\\)\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = (s \\\\ ApplyCommit i t \\\\)\"\n \"\\d i t a. (\\ Vote i t a \\\\') = (\\ Vote i t a \\\\)\"\n \"\\d i t. (\\ PublishResponse i t \\\\') = (\\ PublishResponse i t \\\\)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\') = (\\ PublishRequest i t x \\\\)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\') = (\\ ApplyCommit i t \\\\)\"\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\)\"\n by (auto simp add: isMessageFromTo'_def isMessageTo'_def isMessage'_def isMessageFrom'_def,\n auto simp add: isMessageFromTo_def isMessageTo_def isMessage_def isMessageFrom_def messages')\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n by (unfold nodeState', auto)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from joinVotes_max show \" \\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n qed\nqed\n\nlemma (in zenStep) send_StartJoin:\n assumes messages': \"messages' = sendTo d\\<^sub>0 (nd, Some (StartJoin t\\<^sub>0))\"\n assumes nodeState': \"nodeState' = nodeState\"\n shows \"zen messages' nodeState'\"\n using assms by (intro send_spontaneous_message, auto)\n\nlemma (in zenStep) send_ClientValue:\n assumes messages': \"messages' = sendTo d\\<^sub>0 (nd, Some (ClientValue x\\<^sub>0))\"\n assumes nodeState': \"nodeState' = nodeState\"\n shows \"zen messages' nodeState'\"\n using assms by (intro send_spontaneous_message, auto)\n\nlemma (in zenStep) send_CatchUpRequest:\n assumes messages': \"messages' = sendTo d\\<^sub>0 (nd, Some CatchUpRequest)\"\n assumes nodeState': \"nodeState' = nodeState\"\n shows \"zen messages' nodeState'\"\n using assms by (intro send_spontaneous_message, auto)\n\nlemma (in zenStep) send_Reboot:\n assumes messages': \"messages' = sendTo d\\<^sub>0 (nd, Some Reboot)\"\n assumes nodeState': \"nodeState' = nodeState\"\n shows \"zen messages' nodeState'\"\n using assms by (intro send_spontaneous_message, auto)\n\nlemma (in zenStep) ensureCurrentTerm_invariants:\n assumes nd': \"nd' = ensureCurrentTerm t nd\"\n assumes messages': \"messages' = messages\"\n shows \"zen messages' nodeState'\"\nproof (cases \"t \\ currentTerm nd\")\n case True\n hence \"nodeState' = nodeState\"\n by (intro ext, unfold nodeState'_def, auto simp add: nd' ensureCurrentTerm_def nd_def)\n with zen_axioms messages' show ?thesis by simp\nnext\n case False hence t: \"currentTerm nd < t\" by simp\n\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"currentTerm (nodeState' n\\<^sub>0) = t\"\n \"electionWon (nodeState' n\\<^sub>0) = False\"\n \"joinVotes (nodeState' n\\<^sub>0) = {}\"\n \"publishPermitted (nodeState' n\\<^sub>0) = True\"\n \"publishVotes (nodeState' n\\<^sub>0) = {}\"\n using t\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' ensureCurrentTerm_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\n have currentTerm_increases: \"\\n. currentTerm (nodeState n) \\ currentTerm (nodeState' n)\"\n using nd_def nodeState'_def property_simps t by auto\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have promised_eq: \"\\i n n' t. promised' i n n' t = promised i n n' t\" by (simp add: promised_def promised'_def)\n have prevAccepted_eq: \"\\i t q. prevAccepted' i t q = prevAccepted i t q\" by (simp add: prevAccepted_def prevAccepted'_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n\n from Vote_currentTerm currentTerm_increases\n show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState' n)\"\n using dual_order.trans by blast\n\n from PublishRequest_publishPermitted_currentTerm currentTerm_increases property_simps\n show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState' n)\"\n by (metis False PublishRequest_currentTerm dual_order.trans leI nd_def nodeState_unchanged)\n\n from joinVotes\n show \"\\n n'. n' \\ joinVotes (nodeState' n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState' n))\"\n unfolding nodeState'_def by (auto simp add: nd'_def)\n\n from PublishRequest_currentTerm currentTerm_increases\n show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState' n)\"\n using dual_order.trans by blast\n\n from publishVotes\n show \"\\n n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState' n)) \\\\\"\n unfolding nodeState'_def by (auto simp add: nd'_def)\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState n) (joinVotes (nodeState' n))\"\n unfolding nodeState'_def by (auto simp add: nd'_def)\n\n from lastAcceptedTerm_Some_currentTerm currentTerm_increases\n show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState' n)\"\n using dual_order.trans by blast\n\n show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState' n)) x \\\\) \\ n' \\ joinVotes (nodeState' n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState' n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\"\n by (metis ex_in_conv joinVotes_max nodeState_unchanged property_simps(10))\n qed\nqed\n\nlemma (in zenStep) sendVote_invariants:\n assumes messages': \"messages' = sendTo (OneNode d\\<^sub>0) (nd'',\n Some (Vote (firstUncommittedSlot nd) (currentTerm nd) (lastAcceptedTerm nd)))\"\n assumes nd': \"nd' = nd\"\n assumes not_sent: \"\\i a. \\ n\\<^sub>0 \\\\ Vote i (currentTerm nd) a \\\\\"\n assumes not_accepted: \"\\t'. lastAcceptedTerm nd = SomeTerm t' \\ t' < currentTerm nd\"\n shows \"zen messages' nodeState'\"\nproof -\n have messages': \"messages' = insert \\sender = n\\<^sub>0, destination = OneNode d\\<^sub>0,\n payload = Vote (firstUncommittedSlot nd) (currentTerm nd) (lastAcceptedTerm nd)\\ messages\"\n by (simp add: messages')\n\n have nodeState'[simp]: \"nodeState' = nodeState\"\n by (intro ext, auto simp add: nodeState'_def nd' nd_def)\n\n have message_simps[simp]:\n \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = (s \\\\ ApplyCommit i t \\\\ d)\"\n \"\\s d i t x. (s \\\\ PublishRequest i t x \\\\' d) = (s \\\\ PublishRequest i t x \\\\ d)\"\n \"\\s d i t. (s \\\\ PublishResponse i t \\\\' d) = (s \\\\ PublishResponse i t \\\\ d)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = (\\ ApplyCommit i t \\\\ d)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\' d) = (\\ PublishRequest i t x \\\\ d)\"\n \"\\d i t. (\\ PublishResponse i t \\\\' d) = (\\ PublishResponse i t \\\\ d)\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = (s \\\\ ApplyCommit i t \\\\)\"\n \"\\s i t x. (s \\\\ PublishRequest i t x \\\\') = (s \\\\ PublishRequest i t x \\\\)\"\n \"\\s i t. (s \\\\ PublishResponse i t \\\\') = (s \\\\ PublishResponse i t \\\\)\"\n \"\\i t. (\\ ApplyCommit i t \\\\') = (\\ ApplyCommit i t \\\\)\"\n \"\\i t x. (\\ PublishRequest i t x \\\\') = (\\ PublishRequest i t x \\\\)\"\n \"\\i t. (\\ PublishResponse i t \\\\') = (\\ PublishResponse i t \\\\)\"\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have Vote':\n \"\\s d i t' a. (s \\\\ Vote i t' a \\\\' d) =\n ((s \\\\ Vote i t' a \\\\ d)\n \\ (s, i, t', a, d) = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd, lastAcceptedTerm nd, OneNode d\\<^sub>0))\"\n \"\\d i t' a. (\\ Vote i t' a \\\\' d) =\n ((\\ Vote i t' a \\\\ d)\n \\ (i, t', a, d) = (firstUncommittedSlot nd, currentTerm nd, lastAcceptedTerm nd, OneNode d\\<^sub>0))\"\n \"\\s i t' a. (s \\\\ Vote i t' a \\\\') =\n ((s \\\\ Vote i t' a \\\\)\n \\ (s, i, t', a) = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd, lastAcceptedTerm nd))\"\n \"\\i t' a. (\\ Vote i t' a \\\\') =\n ((\\ Vote i t' a \\\\)\n \\ (i, t', a) = (firstUncommittedSlot nd, currentTerm nd, lastAcceptedTerm nd))\"\n by (unfold isMessageFromTo'_def isMessageFromTo_def isMessageTo'_def isMessageTo_def\n isMessageFrom'_def isMessageFrom_def isMessage'_def isMessage_def, auto simp add: messages')\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n\n have promised_eq: \"\\i s dn t. promised' i s dn t = (promised i s dn t \\ (firstUncommittedSlot nd \\ i \\ s = n\\<^sub>0 \\ dn = d\\<^sub>0 \\ t = currentTerm nd))\"\n unfolding promised'_def promised_def Vote' by auto\n\n have prevAccepted_eq: \"\\i t q. prevAccepted' i t q = prevAccepted i t q \\ {t'. n\\<^sub>0 \\ q \\ i = firstUncommittedSlot nd \\ t = currentTerm nd \\ lastAcceptedTerm nd = SomeTerm t'}\"\n unfolding prevAccepted_def prevAccepted'_def Vote' by auto\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' addElectionVote_def Let_def)\n\n show \"zen messages' nodeState'\"\n apply (intro zenI)\n apply (unfold message_simps property_simps committedTo_eq V_eq lastCommittedClusterStateBefore_eq v_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\' \\ t \\ currentTerm (nodeState n)\"\n unfolding Vote' by (auto simp add: nd_def)\n\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised' (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\"\n unfolding promised_eq by simp\n\n from Vote_future firstUncommittedSlot_PublishResponse\n show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\' \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\"\n unfolding Vote' nd_def by auto\n\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\' \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\"\n unfolding Vote' using Vote_future lastAcceptedTerm_None nd' nd'_def by auto\n\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\' \\ t' < t\"\n unfolding Vote' using not_accepted lastAcceptedTerm_def\n by (smt fst_conv TermOption.distinct(1) snd_conv)\n\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\' \\ s \\\\ PublishResponse i t' \\\\\"\n unfolding Vote' using lastAcceptedTerm_Some_sent nd' nd'_def nd_def\n by (smt Pair_inject TermOption.distinct(1))\n\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\' \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\"\n unfolding Vote' nd_def\n by (smt Pair_inject TermOption.distinct(1) \\\\t' t na. \\lastAcceptedTerm (nodeState na) = SomeTerm t; na \\\\ PublishResponse (firstUncommittedSlot (nodeState na)) t' \\\\\\ \\ t' \\ t\\ leD)\n\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\' d \\ d \\ Broadcast\"\n unfolding Vote' by blast\n\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\' d \\ s \\\\ Vote i' t a' \\\\' d' \\ d = d'\"\n unfolding Vote' using isMessageFrom_def not_sent by auto\n\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\' \\ n \\\\ Vote i' t a' \\\\' \\ i = i'\"\n unfolding Vote'\n by (metis Vote'(3) Message.inject(2) RoutedMessage.ext_inject insert_iff isMessageFrom'_def isMessageFromTo'_def isMessageFromTo_def isMessageFrom_def messages' not_sent)\n\n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\' (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\"\n unfolding Vote'\n by (smt Vote'(1) Message.inject(2) RoutedMessage.ext_inject insert_iff isMessageFromTo'_def isMessageFrom_def joinVotes messages' not_sent promised_def zen.Vote_slot_function zenMessages.Vote_value_function zenMessages_axioms zen_axioms)\n\n fix i s t x\n assume \"s \\\\ PublishRequest i t x \\\\\"\n from PublishRequest_quorum [OF this]\n obtain q where q_majority: \"q \\ majorities (V i)\" \n and q_promised: \"\\n. n \\ q \\ promised i n s t\"\n and q_value: \"prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t)\" by blast\n\n from not_sent q_promised\n have no_new_terms: \"{t'. n\\<^sub>0 \\ q \\ i = firstUncommittedSlot nd \\ t = currentTerm nd \\ lastAcceptedTerm nd = SomeTerm t'} = {}\"\n unfolding isMessageFrom_def promised_def by blast\n hence prevAccepted_eq: \"prevAccepted' i t q = prevAccepted i t q\"\n unfolding prevAccepted_eq by auto\n\n show \"\\q\\majorities (V i). (\\n\\q. promised' i n s t) \\ (prevAccepted' i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted' i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\"\n proof (intro bexI conjI)\n from q_majority show \"q \\ majorities (V i)\" .\n from q_promised show \"\\n\\q. promised' i n s t\" unfolding promised_eq by simp\n\n from q_value show \"prevAccepted' i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted' i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t)\"\n unfolding prevAccepted_eq by simp\n qed\n qed\nqed\n\nlemma (in zenStep) handleStartJoin_invariants:\n fixes t\n defines \"result \\ handleStartJoin t nd\"\n assumes nd': \"nd' = fst result\"\n assumes sent: \"s \\\\ StartJoin t \\\\\"\n assumes messages': \"messages' = sendTo (OneNode s) result\"\n shows \"zen messages' nodeState'\"\nproof (cases \"currentTerm nd < t\")\n case False\n hence result: \"result = (nd, None)\" by (simp add: result_def handleStartJoin_def)\n have \"messages' = messages\" by (auto simp add: messages' result)\n moreover\n have \"nodeState' = nodeState\" by (intro ext, unfold nodeState'_def, simp add: nd' result nd_def)\n moreover note zen_axioms\n ultimately show ?thesis by simp\nnext\n case True\n hence new_term: \"currentTerm nd < t\" by simp\n\n have result: \"result = (ensureCurrentTerm t nd, Some (Vote (firstUncommittedSlot nd) t (lastAcceptedTerm nd)))\"\n by (simp add: result_def handleStartJoin_def True)\n\n have nd': \"nd' = ensureCurrentTerm t nd\" by (simp add: nd' result)\n\n have zen1: \"zen messages nodeState'\"\n proof (intro zenStep.ensureCurrentTerm_invariants)\n show \"messages = messages\" ..\n from nd' show \"nodeState' n\\<^sub>0 = ensureCurrentTerm t (nodeState n\\<^sub>0)\" by (simp add: nd'_def nd_def)\n show \"zenStep messages nodeState messages nodeState' n\\<^sub>0\"\n by (intro_locales, intro zenStep_axioms.intro nodeState_unchanged, simp_all)\n qed\n\n with nodeState_unchanged messages_subset\n have zenStep1: \"zenStep messages nodeState' messages' nodeState' n\\<^sub>0\"\n by (intro_locales, simp add: zen_def, intro zenStep_axioms.intro, auto)\n\n have nodeState': \"nodeState' = (\\ n. if n = n\\<^sub>0 then nd' else nodeState' n)\"\n by (auto simp add: nodeState'_def)\n\n have nd'_eq: \"nodeState' n\\<^sub>0 = nd'\"\n by (simp add: nodeState'_def)\n\n from True\n have currentTerm_nd': \"currentTerm nd' = t\" by (auto simp add: nd')\n\n have [simp]: \"firstUncommittedSlot nd' = firstUncommittedSlot nd\"\n \"lastAcceptedTerm nd' = lastAcceptedTerm nd\"\n by (auto simp add: nd' ensureCurrentTerm_def lastAcceptedTerm_def\n lastAcceptedValue_def)\n\n show \"zen messages' nodeState'\"\n proof (intro zenStep.sendVote_invariants [OF zenStep1], unfold nd'_eq currentTerm_nd', simp_all add: messages' result)\n show \"\\i a. \\d. \\sender = n\\<^sub>0, destination = d, payload = Vote i t a\\ \\ messages\"\n using nd_def new_term zen.Vote_currentTerm zen_axioms by fastforce\n show \"\\t'. lastAcceptedTerm nd = SomeTerm t' \\ t' < t\" using True lastAcceptedTerm_Some_currentTerm unfolding nd_def by fastforce\n qed\nqed\n\nlemma (in zenStep) addElectionVote_invariants:\n assumes nd': \"nd' = addElectionVote s i a nd\"\n assumes messages': \"messages' = messages\"\n assumes sent: \"s \\\\ Vote i (currentTerm nd) a \\\\ (OneNode n\\<^sub>0)\"\n assumes precondition:\n \"i < firstUncommittedSlot nd \\ (i = firstUncommittedSlot nd \\ a \\ lastAcceptedTerm nd)\"\n shows \"zen messages' nodeState'\"\nproof -\n from precondition have slot: \"i \\ firstUncommittedSlot nd\" by auto\n\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' addElectionVote_def Let_def\n lastAcceptedValue_def lastAcceptedTerm_def)\n\n have updated_properties:\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n) \\ (if n = n\\<^sub>0 then {s} else {})\"\n \"\\n. electionWon (nodeState' n) = (if n = n\\<^sub>0 then isQuorum nd (insert s (joinVotes nd)) else electionWon (nodeState n))\"\n unfolding nodeState'_def by (auto simp add: nd' addElectionVote_def Let_def nd_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n\n show \"zen messages' nodeState'\"\n apply (intro zenI)\n apply (unfold message_simps property_simps committedTo_eq v_eq V_eq promised_eq lastCommittedClusterStateBefore_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState n) (joinVotes (nodeState' n))\"\n unfolding updated_properties by (auto simp add: nd_def)\n\n fix n\n\n from joinVotes nd_def precondition sent\n show \"\\n'. n' \\ joinVotes (nodeState' n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\"\n using precondition sent unfolding updated_properties nd_def apply (cases \"n = n\\<^sub>0\", simp_all)\n using nd_def promised_def slot by blast\n\n fix n' a'\n assume fresh_request: \"\\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\)\"\n and n'_joinVotes: \"n' \\ joinVotes (nodeState' n)\"\n and n'_vote: \"n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n)\"\n\n show \"a' \\ lastAcceptedTerm (nodeState n)\"\n proof (cases \"n = n\\<^sub>0\")\n case False\n with fresh_request n'_joinVotes n'_vote joinVotes_max\n show ?thesis by (simp add: updated_properties)\n next\n case n_eq: True\n\n show ?thesis\n proof (cases \"n' = s\")\n case n'_eq: True\n have i: \"i = firstUncommittedSlot nd\"\n proof (intro Vote_slot_function)\n from n'_vote show \"n' \\\\ Vote (firstUncommittedSlot nd) (currentTerm nd) a' \\\\\"\n unfolding isMessageFrom_def nd_def n_eq by auto\n from sent show \"n' \\\\ Vote i (currentTerm nd) a \\\\\"\n unfolding isMessageFrom_def nd_def n'_eq by auto\n qed\n\n have a: \"a = a'\"\n proof (intro Vote_value_function)\n from n'_vote show \"n' \\\\ Vote (firstUncommittedSlot nd) (currentTerm nd) a' \\\\\"\n unfolding isMessageFrom_def nd_def n_eq by auto\n from sent show \"n' \\\\ Vote (firstUncommittedSlot nd) (currentTerm nd) a \\\\\"\n unfolding isMessageFrom_def nd_def n'_eq i by auto\n qed\n\n from precondition show ?thesis by (auto simp add: i a n_eq nd_def)\n next\n case False with n'_joinVotes have n'_joinVotes: \"n' \\ joinVotes nd\" by (simp add: nd_def n_eq updated_properties)\n with fresh_request n'_vote joinVotes_max show ?thesis unfolding nd_def n_eq by auto\n qed\n qed\n qed\nqed\n\nlemma (in zenStep) publishValue_invariants:\n fixes x\n defines \"result \\ publishValue x nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo Broadcast result\"\n assumes x: \"lastAcceptedTerm nd \\ NO_TERM \\ x = lastAcceptedValue nd\"\n shows \"zen messages' nodeState'\"\nproof (cases \"electionWon nd \\ publishPermitted nd\")\n case False\n hence result: \"result = (nd, None)\" by (simp add: result_def publishValue_def)\n have \"messages' = messages\" by (auto simp add: messages' result)\n moreover\n have \"nodeState' = nodeState\" by (intro ext, unfold nodeState'_def, simp add: nd' result nd_def)\n moreover note zen_axioms\n ultimately show ?thesis by simp\nnext\n case won: True\n hence result: \"result = (nd \\ publishPermitted := False \\,\n Some (PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x))\"\n by (simp add: result_def publishValue_def)\n\n have messages': \"messages' = insert \\sender = n\\<^sub>0, destination = Broadcast, payload = PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x\\ messages\"\n by (simp add: messages' result)\n\n have message_simps:\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\s d i t. (s \\\\ PublishResponse i t \\\\' d) = (s \\\\ PublishResponse i t \\\\ d)\"\n \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = (s \\\\ ApplyCommit i t \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n \"\\d i t. (\\ PublishResponse i t \\\\' d) = (\\ PublishResponse i t \\\\ d)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = (\\ ApplyCommit i t \\\\ d)\"\n \"\\s i t a. (s \\\\ Vote i t a \\\\') = (s \\\\ Vote i t a \\\\)\"\n \"\\s i t. (s \\\\ PublishResponse i t \\\\') = (s \\\\ PublishResponse i t \\\\)\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = (s \\\\ ApplyCommit i t \\\\)\"\n \"\\d i t a. (\\ Vote i t a \\\\') = (\\ Vote i t a \\\\)\"\n \"\\d i t. (\\ PublishResponse i t \\\\') = (\\ PublishResponse i t \\\\)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\') = (\\ ApplyCommit i t \\\\)\"\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\)\"\n by (auto simp add: isMessageFromTo'_def isMessageTo'_def isMessage'_def isMessageFrom'_def,\n auto simp add: isMessageFromTo_def isMessageTo_def isMessage_def isMessageFrom_def messages')\n\n have PublishRequest': \"\\s d i t x'. (s \\\\ PublishRequest i t x' \\\\' d) = ((s \\\\ PublishRequest i t x' \\\\ d)\n \\ (s, d, i, t, x') = (n\\<^sub>0, Broadcast, firstUncommittedSlot nd, currentTerm nd, x))\"\n \"\\s i t x'. (s \\\\ PublishRequest i t x' \\\\') = ((s \\\\ PublishRequest i t x' \\\\)\n \\ (s, i, t, x') = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd, x))\"\n \"\\d i t x'. (\\ PublishRequest i t x' \\\\' d) = ((\\ PublishRequest i t x' \\\\ d)\n \\ (d, i, t, x') = (Broadcast, firstUncommittedSlot nd, currentTerm nd, x))\"\n \"\\i t x'. (\\ PublishRequest i t x' \\\\') = ((\\ PublishRequest i t x' \\\\)\n \\ (i, t, x') = (firstUncommittedSlot nd, currentTerm nd, x))\"\n by (auto simp add: isMessageFromTo'_def isMessageFrom'_def isMessageTo'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageFrom_def isMessageTo_def isMessage_def)\n\n have fresh_request: \"\\x. \\ \\ PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x \\\\\"\n proof (intro notI)\n fix x'\n assume \"\\ PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x' \\\\\"\n with won obtain s d where\n s: \"s \\\\ PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x' \\\\ d\"\n by (auto simp add: isMessage_def isMessageFrom_def)\n\n with PublishRequest_quorum [where s = s and i = \"firstUncommittedSlot nd\" and t = \"currentTerm nd\" and x = x']\n obtain q where q: \"q \\ majorities (V (firstUncommittedSlot nd))\" and promised: \"\\n. n \\ q \\ promised (firstUncommittedSlot nd) n s (currentTerm nd)\"\n by (auto simp add: isMessageFrom_def, blast)\n\n from won have \"isQuorum nd (joinVotes nd)\"\n by (unfold nd_def, intro electionWon_isQuorum, simp)\n with currentVotingNodes_firstUncommittedSlot [of n\\<^sub>0]\n have \"joinVotes nd \\ majorities (V (firstUncommittedSlot nd))\" using nd_def isQuorum_def by auto\n\n from q this V_intersects have \"q \\ joinVotes nd \\ {}\"\n by (auto simp add: intersects_def)\n then obtain n where n: \"n \\ q\" \"n \\ joinVotes nd\" by auto\n\n from promised [OF `n \\ q`]\n obtain i' a' where \"n \\\\ Vote i' (currentTerm nd) a' \\\\ (OneNode s)\"\n by (auto simp add: promised_def)\n\n moreover from joinVotes n\n obtain i'' a'' where \"n \\\\ Vote i'' (currentTerm nd) a'' \\\\ (OneNode n\\<^sub>0)\"\n by (auto simp add: nd_def promised_def, blast)\n\n ultimately have \"OneNode s = OneNode n\\<^sub>0\"\n by (intro Vote_unique_destination)\n\n with s have \"n\\<^sub>0 \\\\ PublishRequest (firstUncommittedSlot nd) (currentTerm nd) x' \\\\\"\n by (auto simp add: isMessageFrom_def)\n\n hence \"currentTerm nd < currentTerm (nodeState n\\<^sub>0)\"\n proof (intro PublishRequest_publishPermitted_currentTerm, fold nd_def)\n from won show \"publishPermitted nd\" by (simp add: nd_def)\n qed\n thus False by (simp add: nd_def)\n qed\n\n have v_eq: \"\\i t x. \\ PublishRequest i t x \\\\ \\ v' i t = v i t\"\n proof -\n fix i t x'\n\n assume \"\\ PublishRequest i t x' \\\\\"\n with fresh_request have ne: \"(i, t) \\ (firstUncommittedSlot nd, currentTerm nd)\" by auto\n\n have sent_eq: \"\\x''. \\ PublishRequest i t x'' \\\\' = \\ PublishRequest i t x'' \\\\\"\n proof (intro iffI)\n fix x''\n show \"\\ PublishRequest i t x'' \\\\ \\ \\ PublishRequest i t x'' \\\\'\" by (simp add: PublishRequest')\n assume \"\\ PublishRequest i t x'' \\\\'\" with ne show \"\\ PublishRequest i t x'' \\\\\"\n by (unfold PublishRequest', auto)\n qed\n\n show \"v' i t = v i t\"\n by (unfold v'_def v_def sent_eq, simp)\n qed\n\n have isCommitted_eq: \"isCommitted' = isCommitted\"\n by (intro ext, simp add: isCommitted_def isCommitted'_def message_simps)\n\n have committedTo_eq: \"committed\\<^sub><' = committed\\<^sub><\"\n by (intro ext, simp add: committedTo_def committedTo'_def isCommitted_eq)\n\n have v\\<^sub>c_eq: \"\\i. isCommitted i \\ v\\<^sub>c' i = v\\<^sub>c i\"\n proof -\n fix i assume i: \"isCommitted i\"\n define t where \"t \\ SOME t. \\ ApplyCommit i t \\\\\"\n have t: \"\\ ApplyCommit i t \\\\\"\n proof -\n from i obtain t where t: \"\\ ApplyCommit i t \\\\\" by (auto simp add: isCommitted_def)\n thus ?thesis by (unfold t_def, intro someI)\n qed\n hence v_eq: \"v' i t = v i t\" by (intro v_eq [OF ApplyCommit_PublishRequest])\n\n have \"v\\<^sub>c' i = v' i t\" by (simp add: v\\<^sub>c'_def t_def message_simps)\n also note v_eq\n also have \"v i t = v\\<^sub>c i\" by (simp add: v\\<^sub>c_def t_def)\n finally show \"?thesis i\" by simp\n qed\n\n have V_eq: \"\\i. committed\\<^sub>< i \\ V' i = V i\"\n proof -\n fix i assume i: \"committed\\<^sub>< i\"\n thus \"?thesis i\"\n proof (induct i)\n case (Suc i')\n hence prems: \"committed\\<^sub>< i'\" \"isCommitted i'\" unfolding committedTo_def by auto\n thus ?case using Suc v\\<^sub>c_eq by simp\n qed simp\n qed\n\n have lastCommittedClusterStateBefore_eq: \"\\i. committed\\<^sub>< i \\ lastCommittedClusterStateBefore' i = lastCommittedClusterStateBefore i\"\n proof -\n fix i assume \"committed\\<^sub>< i\"\n thus \"?thesis i\"\n proof (induct i)\n case (Suc i')\n hence prems: \"committed\\<^sub>< i'\" \"isCommitted i'\" unfolding committedTo_def by auto\n thus ?case using Suc v\\<^sub>c_eq by (cases \"v\\<^sub>c i'\", simp_all)\n qed simp\n qed\n\n have promised_eq: \"\\i n n' t. promised' i n n' t = promised i n n' t\"\n by (simp add: promised_def promised'_def message_simps)\n\n have prevAccepted_eq: \"\\i t q. prevAccepted' i t q = prevAccepted i t q\"\n by (simp add: prevAccepted_def prevAccepted'_def message_simps)\n\n from committedTo_firstUncommittedSlot V_eq\n have V_slot_eq: \"\\n. V' (firstUncommittedSlot (nodeState n)) = V (firstUncommittedSlot (nodeState n))\" by blast\n\n have lastCommittedClusterStateBefore_slot_eq: \"\\n. lastCommittedClusterStateBefore' (firstUncommittedSlot (nodeState n)) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\"\n by (intro lastCommittedClusterStateBefore_eq committedTo_firstUncommittedSlot)\n\n have v_prevAccepted_eq: \"\\i t q. prevAccepted i t q \\ {} \\ v' i (maxTerm (prevAccepted i t q)) = v i (maxTerm (prevAccepted i t q))\"\n proof -\n fix i t q\n assume nonempty: \"prevAccepted i t q \\ {}\"\n have \"maxTerm (prevAccepted i t q) \\ prevAccepted i t q\"\n by (intro maxTerm_mem finite_prevAccepted nonempty)\n hence \"\\ Vote i t (SomeTerm (maxTerm (prevAccepted i t q))) \\\\\"\n by (auto simp add: prevAccepted_def isMessage_def)\n hence \"\\ PublishResponse i (maxTerm (prevAccepted i t q)) \\\\\"\n using Vote_Some_PublishResponse unfolding isMessage_def by blast\n then obtain x' where \"\\ PublishRequest i (maxTerm (prevAccepted i t q)) x' \\\\\"\n using PublishResponse_PublishRequest unfolding isMessage_def by blast\n thus \"?thesis i t q\" by (intro v_eq)\n qed\n\n have nd': \"nd' = nd \\ publishPermitted := False \\\" by (simp add: nd' result)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' addElectionVote_def Let_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_slot_eq\n lastCommittedClusterStateBefore_slot_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n {\n fix i conf cs assume a: \"\\ CatchUpResponse i conf cs \\\\\"\n with CatchUpResponse_committedTo show \"committed\\<^sub>< i\" .\n with a V_eq lastCommittedClusterStateBefore_eq CatchUpResponse_V CatchUpResponse_lastCommittedClusterStateBefore\n show \"V' i = conf\" \"lastCommittedClusterStateBefore' i = cs\" by auto\n }\n\n from lastAcceptedTerm_Some_value PublishRequest'\n show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\'\"\n by (meson isMessage'_def isMessageFrom'_def isMessageFrom_def isMessage_def)\n\n from PublishRequest_currentTerm\n show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\' \\ t \\ currentTerm (nodeState n)\"\n using PublishRequest' isMessageFrom'_def isMessageFrom_def nd_def by fastforce\n\n from fresh_request PublishRequest_function\n show \"\\i t x x'. \\ PublishRequest i t x \\\\' \\ \\ PublishRequest i t x' \\\\' \\ x = x'\"\n unfolding PublishRequest' by auto\n\n from messages' finite_messages show \"finite messages'\" by simp\n\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\'\"\n unfolding PublishRequest' by blast\n\n from ApplyCommit_quorum V_eq isCommitted_committedTo\n show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V' i). \\s\\q. s \\\\ PublishResponse i t \\\\\"\n unfolding isCommitted_def by fastforce\n\n fix n\n\n from firstUncommittedSlot_PublishRequest\n show \"\\i t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\'\"\n by (cases \"n = n\\<^sub>0\", unfold nodeState'_def PublishRequest' isMessageFrom'_def isMessageFrom_def, auto simp add: nd' nd_def)\n\n from PublishRequest_publishPermitted_currentTerm\n show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\' \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState n)\"\n unfolding isMessageFrom'_def PublishRequest'\n by (cases \"n = n\\<^sub>0\", auto simp add: nodeState'_def nd' isMessageFrom_def)\n\n show PublishRequest_committedTo': \"\\i t x. \\ PublishRequest i t x \\\\' \\ committed\\<^sub>< i\"\n using PublishRequest_committedTo committedTo_firstUncommittedSlot\n by (auto simp add: committedTo_def PublishRequest' nd_def)\n\n from joinVotes_max\n show \"\\n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\') \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\"\n by (cases \"n = n\\<^sub>0\", auto simp add: nodeState'_def nd' PublishRequest')\n\n {\n fix i s t x'\n assume \"s \\\\ PublishRequest i t x' \\\\'\"\n thus \"\\q\\majorities (V' i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v' i t = v' i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\"\n unfolding PublishRequest'\n proof (elim disjE)\n assume sent: \"s \\\\ PublishRequest i t x' \\\\\"\n from sent have [simp]: \"V' i = V i\" by (intro V_eq PublishRequest_committedTo, auto simp add: isMessage_def)\n from sent have [simp]: \"v' i t = v i t\" by (intro v_eq, auto simp add: isMessage_def)\n\n from PublishRequest_quorum [OF sent]\n obtain q where q_quorum: \"q \\ majorities (V i)\"\n and q_promised: \"\\n. n \\ q \\ promised i n s t\"\n and q_value: \"prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t)\"\n by blast\n\n show ?thesis\n proof (cases \"prevAccepted i t q = {}\")\n case True with q_quorum q_promised show ?thesis by auto\n next\n case False\n with q_value obtain t' where t': \"v i t = v i t'\" \"maxTerm (prevAccepted i t q) \\ t'\" \"\\ PublishResponse i t' \\\\\" \"t' < t\" by blast\n\n show ?thesis\n proof (intro bexI conjI disjI2 exI ballI)\n from q_promised show \"\\n. n \\ q \\ promised i n s t\" .\n from t' show \"maxTerm (prevAccepted i t q) \\ t'\" \"\\ PublishResponse i t' \\\\\" \"t' < t\" by simp_all\n from q_quorum show \"q \\ majorities (V' i)\" by simp\n\n have \"v' i t = v i t\" by simp\n also have \"... = v i t'\" using t' by simp\n also have \"... = v' i t'\" unfolding v_def v'_def PublishRequest' using t'\n by (metis PublishResponse_PublishRequest_v fresh_request fst_conv snd_conv)\n finally show \"v' i t = v' i t'\" .\n qed\n qed\n next\n assume \"(s, i, t, x') = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd, x)\"\n hence [simp]: \"s = n\\<^sub>0\" \"i = firstUncommittedSlot nd\" \"t = currentTerm nd\" \"x' = x\" by simp_all\n\n have Vi: \"V' i = V i\"\n using committedTo_firstUncommittedSlot by (intro V_eq, simp add: nd_def)\n define q where \"q \\ joinVotes nd\"\n\n show ?thesis\n proof (intro bexI conjI ballI)\n from won have \"isQuorum nd q\" unfolding nd_def q_def by (intro electionWon_isQuorum, simp)\n with currentVotingNodes_firstUncommittedSlot Vi show \"q \\ majorities (V' i)\" by (auto simp add: nd_def isQuorum_def)\n fix n assume \"n \\ q\"\n with joinVotes show \"promised i n s t\" by (simp add: nd_def q_def)\n next\n show \"prevAccepted i t q = {} \\ (\\t'. v' i t = v' i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t)\"\n proof (cases \"prevAccepted i t q = {}\")\n case True thus ?thesis by simp\n next\n case False\n then obtain t' n' where n'_vote: \"n' \\ q\" and n'_sent: \"n' \\\\ Vote i t (SomeTerm t') \\\\\"\n unfolding prevAccepted_def by auto\n\n from n'_sent n'_vote\n have n'_sent: \"n' \\\\ Vote i t (SomeTerm t') \\\\ (OneNode n\\<^sub>0)\" unfolding isMessageFrom_def q_def nd_def\n using \\t = currentTerm nd\\ isMessageFromTo_def nd_def zen.joinVotes zenMessages.Vote_unique_destination zenMessages_axioms zen_axioms by blast\n\n have t'_latis: \"SomeTerm t' \\ lastAcceptedTerm nd\"\n unfolding nd_def\n proof (intro joinVotes_max)\n from fresh_request\n show \"\\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n\\<^sub>0)) (currentTerm (nodeState n\\<^sub>0)) x \\\\)\"\n unfolding nd_def by auto\n\n from n'_vote show \"n' \\ joinVotes (nodeState n\\<^sub>0)\" by (simp add: q_def nd_def)\n\n from n'_sent\n show \"n' \\\\ Vote (firstUncommittedSlot (nodeState n\\<^sub>0)) (currentTerm (nodeState n\\<^sub>0)) (SomeTerm t') \\\\ (OneNode n\\<^sub>0)\"\n by (simp add: nd_def)\n qed\n\n then obtain t'' where t'': \"lastAcceptedTerm nd = SomeTerm t''\"\n by (cases \"lastAcceptedTerm nd\", auto)\n\n show ?thesis\n proof (intro disjI2 exI conjI)\n from t''\n have slots: \"firstUncommittedSlot nd = firstUncommittedSlot nd\"\n by (cases \"firstUncommittedSlot nd = firstUncommittedSlot nd\", simp_all add: lastAcceptedTerm_def)\n \n from t'' have lat: \"lastAcceptedTerm nd = SomeTerm t''\"\n by (cases \"firstUncommittedSlot nd = firstUncommittedSlot nd\", simp_all add: lastAcceptedTerm_def)\n \n from lastAcceptedTerm_Some_sent lat slots\n show accepted: \"\\ PublishResponse i t'' \\\\\" by (auto simp add: nd_def isMessage_def)\n \n from fresh_request\n have \"\\x'. \\ PublishRequest i t x' \\\\' \\ x' = x\" unfolding PublishRequest' by simp\n hence \"v' i t = x\" unfolding v'_def using \\s \\\\ PublishRequest i t x' \\\\'\\ isMessage'_def by blast\n \n also from x have \"x = lastAcceptedValue nd\" by (simp add: t'')\n \n also have \"... = v i t''\"\n proof (intro PublishRequest_function)\n from accepted PublishResponse_PublishRequest_v show \"\\ PublishRequest i t'' (v i t'') \\\\\" by simp\n \n from lat lastAcceptedTerm_Some_value slots\n show \"\\ PublishRequest i t'' (lastAcceptedValue nd) \\\\\"\n by (simp add: nd_def)\n qed\n \n also have \"... = v' i t''\"\n proof (intro sym [OF v_eq])\n from accepted PublishResponse_PublishRequest_v show \"\\ PublishRequest i t'' (v i t'') \\\\\" by simp\n qed\n \n finally show \"v' i t = v' i t''\" .\n \n show \"maxTerm (prevAccepted i t q) \\ t''\"\n proof (intro maxTerm_le False finite_prevAccepted)\n fix t''' assume \"t''' \\ prevAccepted i t q\"\n thus \"t''' \\ t''\" unfolding prevAccepted_def apply auto\n by (metis \\\\t s i' ia d' d a' a. \\s \\\\ Vote ia t a \\\\ d; s \\\\ Vote i' t a' \\\\ d'\\ \\ d = d'\\ fresh_request isMessageFrom_def joinVotes joinVotes_max le_SomeTerm nd_def promised_def q_def t'')\n qed\n \n have \"t'' \\ t\" using \\t = currentTerm nd\\ lastAcceptedTerm_Some_currentTerm lat nd_def by blast\n moreover have \"t'' \\ t\" apply (intro notI) using accepted fresh_request\n using lastAcceptedTerm_Some_value lat nd_def slots by auto\n ultimately show \"t'' < t\" by simp\n qed\n qed\n qed\n qed\n }\n qed\nqed\n\nlemma (in zenStep) handleVote_invariants:\n fixes s i t a\n defines \"result \\ handleVote s i t a nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo Broadcast result\"\n assumes sent: \"s \\\\ Vote i t a \\\\ (OneNode n\\<^sub>0)\"\n shows \"zen messages' nodeState'\"\nproof (cases \"t = currentTerm nd\n \\ (i < firstUncommittedSlot nd\n \\ (i = firstUncommittedSlot nd\n \\ (a \\ lastAcceptedTerm nd)))\")\n case False\n have [simp]: \"result = (nd, None)\" unfolding result_def handleVote_def by (simp add: False Let_def)\n have [simp]: \"messages' = messages\" by (simp add: messages')\n have [simp]: \"nodeState' = nodeState\" unfolding nodeState'_def by (intro ext, simp add: nd' nd_def)\n from zen_axioms show ?thesis by simp\nnext\n case True\n hence True': \"i \\ firstUncommittedSlot nd\"\n \"t = currentTerm nd\"\n \"i < firstUncommittedSlot nd \\ (i = firstUncommittedSlot nd \\ a \\ lastAcceptedTerm nd)\"\n by auto\n\n define nd1 where \"nd1 \\ addElectionVote s i a nd\"\n define nodeState1 where \"\\n. nodeState1 n \\ if n = n\\<^sub>0 then nd1 else nodeState n\"\n\n have zenStep1: \"zenStep messages nodeState messages nodeState1 n\\<^sub>0\"\n by (intro zenStepI2, auto simp add: nodeState1_def)\n\n have zenStep2: \"zenStep messages nodeState1 messages' nodeState' n\\<^sub>0\"\n proof (intro zenStep.zenStepI1 [OF zenStep1] zenStep.addElectionVote_invariants [OF zenStep1] refl messages_subset,\n fold nd_def isMessageFromTo_def)\n show \"nodeState1 n\\<^sub>0 = addElectionVote s i a nd\" by (simp add: nodeState1_def nd1_def)\n from True' sent show \"s \\\\ Vote i (currentTerm nd) a \\\\ (OneNode n\\<^sub>0)\" by simp\n from True' show \"i < firstUncommittedSlot nd \\ (i = firstUncommittedSlot nd \\ a \\ lastAcceptedTerm nd)\" by simp\n show \"\\n. n \\ n\\<^sub>0 \\ nodeState1 n = nodeState' n\" unfolding nodeState1_def nodeState'_def by simp\n qed\n\n note zenStep.publishValue_invariants\n have latis_eq: \"lastAcceptedTerm nd1 = lastAcceptedTerm nd\"\n by (simp add: nd1_def addElectionVote_def Let_def)\n\n show ?thesis\n proof (cases \"lastAcceptedTerm nd1\")\n case (SomeTerm t')\n with True' latis_eq\n have handleVote_eq: \"handleVote s i t a nd = publishValue (lastAcceptedValue nd1) nd1\"\n unfolding handleVote_def nd1_def by (simp add: addElectionVote_def Let_def)\n\n show ?thesis\n proof (intro zenStep.publishValue_invariants [OF zenStep2])\n show \"nodeState' n\\<^sub>0 = fst (publishValue (lastAcceptedValue nd1) (nodeState1 n\\<^sub>0))\"\n by (simp add: nodeState1_def nd1_def nodeState'_def nd' result_def handleVote_eq)\n\n show \"messages' = (case snd (publishValue (lastAcceptedValue nd1) (nodeState1 n\\<^sub>0)) of None \\ messages | Some m \\ insert \\sender = n\\<^sub>0, destination = Broadcast, payload = m\\ messages)\"\n by (cases \"publishValue (lastAcceptedValue nd1) nd1\", cases \"snd (publishValue (lastAcceptedValue nd1) nd1)\",\n simp_all add: nodeState1_def messages' result_def handleVote_eq)\n\n show \"lastAcceptedValue nd1 = lastAcceptedValue (nodeState1 n\\<^sub>0)\" by (simp add: nodeState1_def)\n qed\n\n next\n case NO_TERM\n with True' latis_eq\n have handleVote_eq: \"handleVote s i t a nd = (nd1, None)\" unfolding handleVote_def nd1_def by simp\n have [simp]: \"messages' = messages\" by (simp add: messages' result_def handleVote_eq)\n have [simp]: \"nodeState' = nodeState1\" by (intro ext, simp add: nodeState'_def nodeState1_def nd' result_def handleVote_eq)\n from zenStep2 show ?thesis by (simp add: zenStep_def)\n qed\nqed\n\nlemma (in zenStep) handleClientValue_invariants:\n fixes x\n defines \"result \\ handleClientValue x nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo Broadcast result\"\n shows \"zen messages' nodeState'\"\nproof (cases \"lastAcceptedTerm nd\")\n case (SomeTerm t')\n hence \"handleClientValue x nd = (nd, None)\" by (auto simp add: handleClientValue_def)\n hence [simp]: \"result = (nd, None)\" by (simp add: result_def)\n have [simp]: \"messages' = messages\" by (simp add: messages')\n have [simp]: \"nodeState' = nodeState\" unfolding nodeState'_def by (intro ext, simp add: nd' nd_def)\n from zen_axioms show ?thesis by simp\nnext\n case NO_TERM\n hence handleClientValue_eq[simp]: \"handleClientValue x nd = publishValue x nd\"\n by (auto simp add: handleClientValue_def)\n\n have result: \"result = publishValue x nd\"\n unfolding result_def by simp\n\n show ?thesis\n proof (intro publishValue_invariants)\n show \"nd' = fst (publishValue x nd)\" by (simp add: result nd')\n show \"messages' = sendTo Broadcast (publishValue x nd)\" by (simp_all add: messages' result)\n from NO_TERM show \"lastAcceptedTerm nd \\ NO_TERM \\ x = lastAcceptedValue nd\"\n by simp\n qed\nqed\n\nlemma (in zenStep) handlePublishRequest_invariants:\n fixes i t x\n defines \"result \\ handlePublishRequest i t x nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo (OneNode s) result\"\n assumes sent: \"s \\\\ PublishRequest i t x \\\\\"\n shows \"zen messages' nodeState'\"\nproof (cases \"i = firstUncommittedSlot nd \\ t = currentTerm nd\")\n case False\n hence [simp]: \"result = (nd, None)\"\n by (simp add: result_def handlePublishRequest_def)\n\n have [simp]: \"messages' = messages\"\n by (simp add: messages')\n\n have [simp]: \"nodeState' = nodeState\"\n unfolding nodeState'_def\n by (intro ext, simp add: nd' nd_def)\n\n from zen_axioms show ?thesis by simp\n\nnext\n case precondition: True\n\n hence result: \"result = (nd\\lastAcceptedData := Some \\ tvTerm = t, tvValue = x\\ \\,\n Some (PublishResponse i t))\"\n by (auto simp add: result_def handlePublishRequest_def)\n\n have messages': \"messages' = insert \\ sender = n\\<^sub>0, destination = OneNode s, payload = PublishResponse i t \\ messages\"\n by (simp add: messages' result)\n\n have message_simps[simp]:\n \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = (s \\\\ ApplyCommit i t \\\\ d)\"\n \"\\s d i t x. (s \\\\ PublishRequest i t x \\\\' d) = (s \\\\ PublishRequest i t x \\\\ d)\"\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = (\\ ApplyCommit i t \\\\ d)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\' d) = (\\ PublishRequest i t x \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = (s \\\\ ApplyCommit i t \\\\)\"\n \"\\s i t x. (s \\\\ PublishRequest i t x \\\\') = (s \\\\ PublishRequest i t x \\\\)\"\n \"\\s i t a. (s \\\\ Vote i t a \\\\') = (s \\\\ Vote i t a \\\\)\"\n \"\\i t. (\\ ApplyCommit i t \\\\') = (\\ ApplyCommit i t \\\\)\"\n \"\\i t x. (\\ PublishRequest i t x \\\\') = (\\ PublishRequest i t x \\\\)\"\n \"\\i t a. (\\ Vote i t a \\\\') = (\\ Vote i t a \\\\)\"\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"lastAcceptedTerm nd' = SomeTerm t\"\n \"lastAcceptedValue nd' = x\"\n using precondition\n by (unfold nodeState'_def, auto simp add: result nd' nd_def isQuorum_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\n have updated_properties:\n \"\\n. lastAcceptedTerm (nodeState' n) = (if n = n\\<^sub>0 then SomeTerm t else lastAcceptedTerm (nodeState n))\"\n \"\\n. lastAcceptedValue (nodeState' n) = (if n = n\\<^sub>0 then x else lastAcceptedValue (nodeState n))\"\n by (unfold nodeState'_def, auto simp add: result nd' nd_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\n have PublishResponse': \"\\s' d i t'. (s' \\\\ PublishResponse i t' \\\\' d) =\n ((s' \\\\ PublishResponse i t' \\\\ d) \\ (s', i, t', d) = (n\\<^sub>0, firstUncommittedSlot nd, t, OneNode s))\"\n \"\\d i t'. (\\ PublishResponse i t' \\\\' d) =\n ((\\ PublishResponse i t' \\\\ d) \\ (i, t', d) = (firstUncommittedSlot nd, t, OneNode s))\"\n \"\\s' i t'. (s' \\\\ PublishResponse i t' \\\\') =\n ((s' \\\\ PublishResponse i t' \\\\) \\ (s', i, t') = (n\\<^sub>0, firstUncommittedSlot nd, t))\"\n \"\\i t'. (\\ PublishResponse i t' \\\\') =\n ((\\ PublishResponse i t' \\\\) \\ (i, t') = (firstUncommittedSlot nd, t))\"\n unfolding isMessageFromTo_def isMessageFromTo'_def isMessageFrom_def isMessageFrom'_def isMessageTo_def isMessageTo'_def isMessage_def isMessage'_def\n by (auto simp add: messages' precondition)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\'\"\n using precondition unfolding PublishResponse' nd_def by (metis Vote_currentTerm Pair_inject leD)\n\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\'\"\n using precondition unfolding PublishResponse' nd_def by (metis Vote_currentTerm Pair_inject leD)\n\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\'\"\n using precondition unfolding PublishResponse' nd_def by metis\n\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\'\"\n using precondition unfolding PublishResponse' nd_def using Vote_currentTerm by fastforce\n\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\' \\ t' < t))\" \n unfolding PublishResponse' by meson\n\n fix n\n\n from firstUncommittedSlot_PublishResponse show \"\\i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\'\" \n using precondition property_simps unfolding PublishResponse' nd_def by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_None show \"\\i t. lastAcceptedTerm (nodeState' n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\'\"\n using precondition property_simps updated_properties unfolding PublishResponse' nd_def by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\'\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by (metis nd'_def nodeState_unchanged TermOption.inject)\n\n from lastAcceptedTerm_Some_max show \"\\t t'. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\' \\ t' \\ t\"\n using precondition property_simps updated_properties unfolding PublishResponse' nd_def apply (cases \"n = n\\<^sub>0\", auto)\n by (meson TermOption.exhaust lastAcceptedTerm_None lastAcceptedTerm_Some_currentTerm le_trans)\n \n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState' n)\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by (metis isMessage_def nodeState_unchanged sent)\n\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\'\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by blast\n\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\' \\ \\x. \\ PublishRequest i t x \\\\\"\n using precondition property_simps unfolding PublishResponse' nd_def\n using isMessage_def sent by auto\n\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\'\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by meson\n\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState' n)) \\\\\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by (metis isMessage_def nd'_def nodeState_unchanged TermOption.inject sent)\n\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\"\n using precondition property_simps unfolding PublishResponse' nd_def\n by (metis eq_imp_le TermOption.inject updated_properties(1))\n qed\nqed\n\nlemma (in zenStep) addPublishVote_invariants:\n assumes nd': \"nd' = nd \\ publishVotes := insert s (publishVotes nd) \\\"\n assumes messages': \"messages' = messages\"\n assumes sent: \"s \\\\ PublishResponse (firstUncommittedSlot nd) (currentTerm nd) \\\\\"\n shows \"zen messages' nodeState'\"\nproof -\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' addElectionVote_def Let_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\n have updated_properties[simp]:\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n) \\ (if n = n\\<^sub>0 then {s} else {})\"\n by (unfold nodeState'_def, auto simp add: nd' nd_def isQuorum_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\"\n unfolding updated_properties using sent apply auto by (metis empty_iff nd_def singleton_iff)\n qed\nqed\n\nlemma (in zenStep) commitIfQuorate_invariants:\n fixes s i t\n defines \"result \\ commitIfQuorate nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo Broadcast result\"\n shows \"zen messages' nodeState'\"\nproof (cases \"isQuorum nd (publishVotes nd)\")\n case False\n hence [simp]: \"result = (nd, None)\"\n by (simp add: result_def commitIfQuorate_def)\n\n have [simp]: \"messages' = messages\"\n by (simp add: messages')\n\n have [simp]: \"nodeState' = nodeState\"\n unfolding nodeState'_def\n by (intro ext, simp add: nd' nd_def)\n\n from zen_axioms show ?thesis by simp\n\nnext\n case isQuorum: True\n hence result: \"result = (nd, Some (ApplyCommit (firstUncommittedSlot nd) (currentTerm nd)))\"\n by (simp add: result_def commitIfQuorate_def)\n\n have nodeState': \"nodeState' = nodeState\"\n unfolding nodeState'_def\n by (intro ext, simp add: nd' nd_def result)\n\n have messages': \"messages' = insert \\ sender = n\\<^sub>0, destination = Broadcast, payload = ApplyCommit (firstUncommittedSlot nd) (currentTerm nd) \\ messages\"\n by (simp add: messages' result)\n\n have message_simps[simp]:\n \"\\s d i t. (s \\\\ PublishResponse i t \\\\' d) = (s \\\\ PublishResponse i t \\\\ d)\"\n \"\\s d i t x. (s \\\\ PublishRequest i t x \\\\' d) = (s \\\\ PublishRequest i t x \\\\ d)\"\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\d i t. (\\ PublishResponse i t \\\\' d) = (\\ PublishResponse i t \\\\ d)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\' d) = (\\ PublishRequest i t x \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n \"\\s i t. (s \\\\ PublishResponse i t \\\\') = (s \\\\ PublishResponse i t \\\\)\"\n \"\\s i t x. (s \\\\ PublishRequest i t x \\\\') = (s \\\\ PublishRequest i t x \\\\)\"\n \"\\s i t a. (s \\\\ Vote i t a \\\\') = (s \\\\ Vote i t a \\\\)\"\n \"\\i t. (\\ PublishResponse i t \\\\') = (\\ PublishResponse i t \\\\)\"\n \"\\i t x. (\\ PublishRequest i t x \\\\') = (\\ PublishRequest i t x \\\\)\"\n \"\\i t a. (\\ Vote i t a \\\\') = (\\ Vote i t a \\\\)\"\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d)\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\)\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have ApplyCommit': \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = ((s \\\\ ApplyCommit i t \\\\ d)\n \\ (s, i, t, d) = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd, Broadcast))\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = ((s \\\\ ApplyCommit i t \\\\)\n \\ (s, i, t) = (n\\<^sub>0, firstUncommittedSlot nd, currentTerm nd))\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = ((\\ ApplyCommit i t \\\\ d)\n \\ (i, t, d) = (firstUncommittedSlot nd, currentTerm nd, Broadcast))\"\n \"\\i t. (\\ ApplyCommit i t \\\\') = ((\\ ApplyCommit i t \\\\)\n \\ (i, t) = (firstUncommittedSlot nd, currentTerm nd))\"\n unfolding isMessageFromTo_def isMessageFromTo'_def isMessageFrom_def isMessageFrom'_def isMessageTo_def isMessageTo'_def isMessage_def isMessage'_def\n by (auto simp add: messages')\n\n from committedTo_firstUncommittedSlot\n have committedTo_current: \"committed\\<^sub>< (firstUncommittedSlot nd)\"\n by (simp add: nd_def)\n\n have isCommitted_eq: \"\\i. isCommitted' i = (isCommitted i \\ i = firstUncommittedSlot nd)\"\n using isCommitted'_def isCommitted_def by (auto simp add: ApplyCommit')\n\n have committedTo_eq: \"\\i. committed\\<^sub><' i = ((committed\\<^sub>< i) \\ (i = Suc (firstUncommittedSlot nd)))\"\n proof -\n fix i\n show \"?thesis i\"\n proof (cases \"isCommitted (firstUncommittedSlot nd)\")\n case True with isCommitted_eq have 1: \"isCommitted' = isCommitted\" by (intro ext, auto)\n from True isCommitted_committedTo_Suc have 2: \"committed\\<^sub>< (Suc (firstUncommittedSlot nd))\" by simp\n from 1 2 show ?thesis by (simp add: committedTo'_def committedTo_def, blast)\n next\n case False\n with committedTo_current isCommitted_committedTo\n have isCommitted_lt[simp]: \"\\j. isCommitted j = (j < firstUncommittedSlot nd)\"\n using committedTo_def nat_neq_iff by blast\n have isCommitted'_le[simp]: \"\\j. isCommitted' j = (j \\ firstUncommittedSlot nd)\"\n by (auto simp add: isCommitted_eq)\n show ?thesis\n by (simp add: committedTo'_def committedTo_def, auto, presburger)\n qed\n qed\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n\n note oneSlot.consistent [OF oneSlot.commit [OF zen_is_oneSlot]]\n\n have v\\<^sub>c_eq: \"\\i. isCommitted i \\ v\\<^sub>c' i = v\\<^sub>c i\"\n proof -\n fix i assume \"isCommitted i\" then obtain t where t: \"\\ ApplyCommit i t \\\\\" unfolding isCommitted_def by blast\n show \"?thesis i\"\n proof (cases \"i = firstUncommittedSlot nd\")\n case False thus ?thesis unfolding v\\<^sub>c_def v\\<^sub>c'_def v_eq ApplyCommit' by simp\n next\n case i: True\n show \"v\\<^sub>c' i = v\\<^sub>c i\"\n unfolding v\\<^sub>c_def v\\<^sub>c'_def v_eq\n proof (intro oneSlot.consistent [OF oneSlot.commit [OF zen_is_oneSlot]])\n from isQuorum show \"publishVotes nd \\ majorities (V i)\" unfolding nd_def i isQuorum_def using currentVotingNodes_firstUncommittedSlot by simp\n from publishVotes show \"\\n. n \\ publishVotes nd \\ n \\\\ PublishResponse i (currentTerm nd) \\\\\" unfolding nd_def i .\n from t have \"\\ ApplyCommit i (SOME t. \\ ApplyCommit i t \\\\) \\\\\" by (intro someI)\n thus \"\\ ApplyCommit i (SOME t. \\ ApplyCommit i t \\\\) \\\\ \\ (SOME t. \\ ApplyCommit i t \\\\) = currentTerm nd\" by simp\n show \"\\ ApplyCommit i (SOME t. \\ ApplyCommit i t \\\\') \\\\ \\ (SOME t. \\ ApplyCommit i t \\\\') = currentTerm nd\"\n proof (rule someI2)\n from t show \"\\ ApplyCommit i t \\\\'\"\n \"\\x. \\ ApplyCommit i x \\\\' \\ \\ ApplyCommit i x \\\\ \\ x = currentTerm nd\"\n by (simp_all add: ApplyCommit' i)\n qed\n qed\n qed\n qed\n\n have V_eq: \"\\i. committed\\<^sub>< i \\ V' i = V i\"\n proof -\n fix i assume i: \"committed\\<^sub>< i\"\n thus \"?thesis i\"\n proof (induct i)\n case (Suc i')\n hence prems: \"committed\\<^sub>< i'\" \"isCommitted i'\" unfolding committedTo_def by auto\n thus ?case using Suc v\\<^sub>c_eq by simp\n qed simp\n qed\n hence V_era_eq: \"\\n. V' (firstUncommittedSlot (nodeState n)) = V (firstUncommittedSlot (nodeState n))\"\n using committedTo_firstUncommittedSlot by blast\n\n have lastCommittedClusterStateBefore_eq: \"\\i. committed\\<^sub>< i \\ lastCommittedClusterStateBefore' i = lastCommittedClusterStateBefore i\"\n proof -\n fix i assume \"committed\\<^sub>< i\"\n thus \"?thesis i\"\n proof (induct i)\n case (Suc i')\n hence prems: \"committed\\<^sub>< i'\" \"isCommitted i'\" unfolding committedTo_def by auto\n thus ?case using Suc v\\<^sub>c_eq by (cases \"v\\<^sub>c i'\", simp_all)\n qed simp\n qed\n hence lastCommittedClusterStateBefore_slot_eq:\n \"\\n. lastCommittedClusterStateBefore' (firstUncommittedSlot (nodeState n))\n = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\"\n using committedTo_firstUncommittedSlot by blast\n\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold nodeState' message_simps V_era_eq lastCommittedClusterStateBefore_slot_eq promised_eq prevAccepted_eq v_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n {\n fix i conf cs assume a: \"\\ CatchUpResponse i conf cs \\\\\"\n with CatchUpResponse_committedTo have committedTo: \"committed\\<^sub>< i\" .\n thus \"committed\\<^sub><' i\" unfolding committedTo_eq by simp\n from a committedTo V_eq lastCommittedClusterStateBefore_eq CatchUpResponse_V CatchUpResponse_lastCommittedClusterStateBefore\n show \"V' i = conf\" \"lastCommittedClusterStateBefore' i = cs\" by auto\n }\n\n from committedTo_firstUncommittedSlot\n show \"\\n. committed\\<^sub><' (firstUncommittedSlot (nodeState n))\"\n unfolding committedTo_eq by simp\n\n from PublishRequest_committedTo\n show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub><' i\"\n unfolding committedTo_eq by simp\n\n from PublishRequest_quorum\n show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V' i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\"\n using V_eq PublishRequest_committedTo isMessage_def by metis\n\n from ApplyCommit_quorum\n show \"\\i t. \\ ApplyCommit i t \\\\' \\ \\q\\majorities (V' i). \\s\\q. s \\\\ PublishResponse i t \\\\\"\n using V_eq committedTo_firstUncommittedSlot unfolding ApplyCommit' committedTo_def isCommitted_def\n by (metis ApplyCommit_PublishRequest_v\\<^sub>c PublishRequest_committedTo V_eq isQuorum currentVotingNodes_firstUncommittedSlot nd_def prod.inject publishVotes isQuorum_def)\n qed\nqed\n\nlemma (in zenStep) handlePublishResponse_invariants:\n fixes s i t\n defines \"result \\ handlePublishResponse s i t nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo Broadcast result\"\n assumes sent: \"s \\\\ PublishResponse i t \\\\\"\n shows \"zen messages' nodeState'\"\nproof (cases \"i = firstUncommittedSlot nd \\ t = currentTerm nd\")\n case False\n hence [simp]: \"result = (nd, None)\"\n by (auto simp add: result_def handlePublishResponse_def Let_def)\n\n have [simp]: \"messages' = messages\"\n by (simp add: messages')\n\n have [simp]: \"nodeState' = nodeState\"\n unfolding nodeState'_def\n by (intro ext, simp add: nd' nd_def)\n\n from zen_axioms show ?thesis by simp\n\nnext\n case True\n hence i: \"i = firstUncommittedSlot nd\"\n and t: \"t = currentTerm nd\"\n by simp_all\n\n define nd1 where \"nd1 \\ nd \\publishVotes := insert s (publishVotes nd)\\\"\n define nodeState1 where \"nodeState1 \\ \\n. if n = n\\<^sub>0 then nd1 else nodeState n\"\n\n have result: \"result = commitIfQuorate nd1\"\n by (simp add: result_def handlePublishResponse_def i t nd1_def)\n\n have zenStep1: \"zenStep messages nodeState messages nodeState1 n\\<^sub>0\"\n by (intro zenStepI2, auto simp add: nodeState1_def)\n\n have zenStep2: \"zenStep messages nodeState1 messages' nodeState' n\\<^sub>0\"\n proof (intro zenStep.zenStepI1 [OF zenStep1] zenStep.addPublishVote_invariants [OF zenStep1] refl messages_subset,\n fold isMessageFromTo_def isMessageFrom_def nd_def)\n show \"nodeState1 n\\<^sub>0 = nd\\publishVotes := insert s (publishVotes nd)\\\"\n by (simp add: nodeState1_def nd1_def)\n from sent show \"s \\\\ PublishResponse (firstUncommittedSlot nd) (currentTerm nd) \\\\\" by (simp add: True)\n show \"\\n. n \\ n\\<^sub>0 \\ nodeState1 n = nodeState' n\" unfolding nodeState1_def nodeState'_def by simp\n qed\n\n show ?thesis\n proof (intro zenStep.commitIfQuorate_invariants [OF zenStep2])\n show \"nodeState' n\\<^sub>0 = fst (commitIfQuorate (nodeState1 n\\<^sub>0))\"\n by (simp add: nodeState'_def nd' result nodeState1_def)\n show \"messages' = (case snd (commitIfQuorate (nodeState1 n\\<^sub>0)) of None \\ messages | Some m \\ insert \\sender = n\\<^sub>0, destination = Broadcast, payload = m\\ messages)\"\n by (cases \"commitIfQuorate (nodeState1 n\\<^sub>0)\", cases \"snd (commitIfQuorate (nodeState1 n\\<^sub>0))\",\n simp_all add: nodeState1_def messages' result_def handlePublishResponse_def i t nd1_def)\n qed\nqed\n\nlemma (in zenStep) handleApplyCommit_invariants:\n assumes nd': \"nd' = handleApplyCommit i t nd\"\n assumes messages'[simp]: \"messages' = messages\"\n assumes sent: \"\\ ApplyCommit i t \\\\\"\n shows \"zen messages' nodeState'\"\nproof (cases \"i = firstUncommittedSlot nd \\ lastAcceptedTerm nd = SomeTerm t\")\n case False\n hence nd'[simp]: \"nd' = nd\"\n by (auto simp add: nd' handleApplyCommit_def)\n\n have nodeState'[simp]: \"nodeState' = nodeState\" unfolding nodeState'_def by (intro ext, simp add: nd_def)\n\n from zen_axioms show ?thesis unfolding nodeState' by simp\n\nnext\n case True\n hence i: \"i = firstUncommittedSlot nd\"\n and t: \"lastAcceptedTerm nd = SomeTerm t\" by simp_all\n\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n from sent t\n have lastAcceptedValue_eq: \"v\\<^sub>c i = lastAcceptedValue nd\"\n unfolding i nd_def using lastAcceptedTerm_Some_value [of n\\<^sub>0 t]\n by (intro PublishRequest_function [OF ApplyCommit_PublishRequest_v\\<^sub>c])\n\n show ?thesis\n proof (cases \"isReconfiguration (v\\<^sub>c i)\")\n case False\n\n have \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\n \\ currentTerm (nodeState' n) = currentTerm (nodeState n)\n \\ currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\n \\ joinVotes (nodeState' n) = joinVotes (nodeState n)\n \\ electionWon (nodeState' n) = electionWon (nodeState n)\n \\ isQuorum (nodeState' n) = isQuorum (nodeState n)\"\n proof (cases \"lastAcceptedValue nd\")\n case NoOp thus \"\\n. ?thesis n\"\n unfolding nodeState'_def nd' handleApplyCommit_def i t applyAcceptedValue_def isQuorum_def nd_def\n by simp\n next\n case ClusterStateDiff thus \"\\n. ?thesis n\"\n unfolding nodeState'_def nd' handleApplyCommit_def i t applyAcceptedValue_def isQuorum_def nd_def\n by simp\n next\n case Reconfigure with False lastAcceptedValue_eq show \"\\n. ?thesis n\" by simp\n qed\n hence property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n \"\\n. electionWon (nodeState' n) = electionWon (nodeState n)\"\n \"\\n. isQuorum (nodeState' n) = isQuorum (nodeState n)\"\n by simp_all\n\n have \"\\n. firstUncommittedSlot (nodeState' n) = (if n = n\\<^sub>0 then Suc (firstUncommittedSlot (nodeState n)) else firstUncommittedSlot (nodeState n))\n \\ publishPermitted (nodeState' n) = (publishPermitted (nodeState n) \\ n = n\\<^sub>0)\n \\ publishVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else publishVotes (nodeState n))\n \\ lastAcceptedTerm (nodeState' n) = (if n = n\\<^sub>0 then NO_TERM else lastAcceptedTerm (nodeState n))\"\n proof (cases \"lastAcceptedValue nd\")\n case NoOp\n with i t show \"\\n. ?thesis n\"\n by (unfold nodeState'_def, auto simp add: lastAcceptedValue_eq nd_def nd' applyAcceptedValue_def isQuorum_def handleApplyCommit_def lastAcceptedTerm_def)\n next\n case ClusterStateDiff\n with i t show \"\\n. ?thesis n\"\n by (unfold nodeState'_def, auto simp add: lastAcceptedValue_eq nd_def nd' applyAcceptedValue_def isQuorum_def handleApplyCommit_def lastAcceptedTerm_def)\n next\n case Reconfigure with False lastAcceptedValue_eq show \"\\n. ?thesis n\" by simp\n qed\n hence updated_properties:\n \"\\n. firstUncommittedSlot (nodeState' n) = (if n = n\\<^sub>0 then Suc (firstUncommittedSlot (nodeState n)) else firstUncommittedSlot (nodeState n)) \"\n \"\\n. publishPermitted (nodeState' n) = (publishPermitted (nodeState n) \\ n = n\\<^sub>0)\"\n \"\\n. publishVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else publishVotes (nodeState n))\"\n \"\\n. lastAcceptedTerm (nodeState' n) = (if n = n\\<^sub>0 then NO_TERM else lastAcceptedTerm (nodeState n))\"\n by simp_all\n\n show ?thesis\n apply (intro zenI)\n apply (unfold messages' message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages\" .\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n\n fix n\n\n from firstUncommittedSlot_PublishResponse show \"\\i t. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" \n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_None show \"\\i t. lastAcceptedTerm (nodeState' n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n using updated_properties firstUncommittedSlot_PublishResponse by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_sent show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_max show \"\\t t'. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t' \\\\ \\ t' \\ t\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_value show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState' n)) t (lastAcceptedValue (nodeState' n)) \\\\\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto, simp add: nodeState'_def)\n\n from lastAcceptedTerm_Some_currentTerm show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from committedTo_firstUncommittedSlot show \"committed\\<^sub>< (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties committedTo_def apply (cases \"n = n\\<^sub>0\", auto)\n using i isCommitted_def less_antisym nd_def sent by blast\n\n from joinVotes_max show \"\\n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState' n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using isMessageFromTo_def zen.Vote_slot_function zen.joinVotes zen_axioms by fastforce\n\n from publishVotes show \"\\n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) \\\\\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto) done\n\n from joinVotes show \"\\n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState' n)) n' n (currentTerm (nodeState n))\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n by (meson le_SucI promised_def)\n\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties using False i nd_def by (cases \"n = n\\<^sub>0\", auto)\n\n from firstUncommittedSlot_PublishRequest show \"\\i t x. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto) done\n\n from PublishRequest_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto simp add: firstUncommittedSlot_PublishRequest) done\n\n from PublishRequest_publishPermitted_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto simp add: firstUncommittedSlot_PublishRequest) done\n\n from currentClusterState_lastCommittedClusterStateBefore\n show \"currentClusterState (nodeState' n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState' n))\"\n proof (cases \"n = n\\<^sub>0\")\n case False with currentClusterState_lastCommittedClusterStateBefore\n show ?thesis unfolding nodeState'_def by auto\n next\n case True\n show ?thesis\n proof (cases \"v\\<^sub>c i\")\n case NoOp\n with currentClusterState_lastCommittedClusterStateBefore True lastAcceptedValue_eq i t\n show ?thesis\n unfolding nodeState'_def\n by (simp add: nd' nd_def applyAcceptedValue_def handleApplyCommit_def)\n next\n case Reconfigure with False show ?thesis by simp\n next\n case (ClusterStateDiff diff)\n with lastAcceptedValue_eq have \"lastAcceptedValue nd = ClusterStateDiff diff\" by simp\n with ClusterStateDiff True i t currentClusterState_lastCommittedClusterStateBefore\n show ?thesis\n unfolding nodeState'_def\n by (simp add: nd' nd_def applyAcceptedValue_def handleApplyCommit_def)\n qed\n qed\n qed\n\n next\n case True\n then obtain newConfig where Reconfigure: \"v\\<^sub>c i = Reconfigure newConfig\" by (cases \"v\\<^sub>c i\", auto)\n with lastAcceptedValue_eq have lastAcceptedValue_eq: \"lastAcceptedValue nd = Reconfigure newConfig\" by simp\n\n hence property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. joinVotes (nodeState' n) = joinVotes (nodeState n)\"\n unfolding nodeState'_def by (auto simp add: nd' handleApplyCommit_def applyAcceptedValue_def nd_def\n lastAcceptedTerm_def firstUncommittedSlot_def lastAcceptedValue_def)\n\n have updated_properties:\n \"\\n. firstUncommittedSlot (nodeState' n) = (if n = n\\<^sub>0 then Suc (firstUncommittedSlot (nodeState n)) else firstUncommittedSlot (nodeState n)) \"\n \"\\n. publishPermitted (nodeState' n) = (publishPermitted (nodeState n) \\ n = n\\<^sub>0)\"\n \"\\n. publishVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else publishVotes (nodeState n))\"\n \"\\n. currentVotingNodes (nodeState' n) = (if n = n\\<^sub>0 then set newConfig else currentVotingNodes (nodeState n))\"\n \"\\n. electionWon (nodeState' n) = (if n = n\\<^sub>0 then joinVotes nd \\ majorities (set newConfig) else electionWon (nodeState n))\"\n \"\\n. isQuorum (nodeState' n) = (if n = n\\<^sub>0 then (\\q. q \\ majorities (set newConfig)) else isQuorum (nodeState n))\"\n \"\\n. currentVotingNodes (nodeState' n) = (if n = n\\<^sub>0 then set newConfig else currentVotingNodes (nodeState n))\"\n \"\\n. lastAcceptedTerm (nodeState' n) = (if n = n\\<^sub>0 then NO_TERM else lastAcceptedTerm (nodeState n))\"\n \"\\n. n \\ n\\<^sub>0 \\ lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n unfolding nodeState'_def using i t lastAcceptedValue_eq\n by (auto simp add: nd' handleApplyCommit_def applyAcceptedValue_def nd_def isQuorum_def lastAcceptedTerm_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold messages' message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages\" .\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n\n fix n\n\n from firstUncommittedSlot_PublishResponse show \"\\i t. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishResponse i t \\\\\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_None show \"\\i t. lastAcceptedTerm (nodeState' n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n using updated_properties firstUncommittedSlot_PublishResponse by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_sent show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_max show \"\\t t'. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t' \\\\ \\ t' \\ t\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_value show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState' n)) t (lastAcceptedValue (nodeState' n)) \\\\\"\n using updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from committedTo_firstUncommittedSlot show \"committed\\<^sub>< (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties committedTo_def apply (cases \"n = n\\<^sub>0\", auto)\n using i isCommitted_def less_antisym nd_def sent by blast\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState' n) (joinVotes (nodeState n))\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto simp add: nd_def) done\n\n from joinVotes_max show \"\\n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState' n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using isMessageFromTo_def zen.Vote_slot_function zen.joinVotes zen_axioms by fastforce\n\n from publishVotes show \"\\n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) \\\\\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto) done\n\n from joinVotes show \"\\n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState' n)) n' n (currentTerm (nodeState n))\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n by (meson le_SucI promised_def)\n\n from firstUncommittedSlot_PublishRequest show \"\\i t x. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto) done\n\n from PublishRequest_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto simp add: firstUncommittedSlot_PublishRequest) done\n\n from PublishRequest_publishPermitted_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto simp add: firstUncommittedSlot_PublishRequest) done\n\n from currentClusterState_lastCommittedClusterStateBefore Reconfigure i nd_def\n show \"currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties committedTo_def by (cases \"n = n\\<^sub>0\", auto)\n\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState' n) = V (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties committedTo_def using Reconfigure i nd_def by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_currentTerm show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto) done\n qed\n qed\nqed\n\nlemma (in zenStep) handleCatchUpRequest_invariants:\n fixes s i t\n defines \"result \\ handleCatchUpRequest nd\"\n assumes nd': \"nd' = fst result\"\n assumes messages': \"messages' = sendTo d\\<^sub>0 result\"\n shows \"zen messages' nodeState'\"\nproof -\n\n have result: \"result = (nd, Some (CatchUpResponse (firstUncommittedSlot nd) (currentVotingNodes nd) (currentClusterState nd)))\"\n by (simp add: result_def handleCatchUpRequest_def)\n\n have nd'[simp]: \"nd' = nd\" by (simp add: nd' result)\n have nodeState'[simp]: \"nodeState' = nodeState\" by (intro ext, simp add: nodeState'_def result nd_def)\n\n have messages': \"messages' = insert \\ sender = n\\<^sub>0, destination = d\\<^sub>0, payload = CatchUpResponse (firstUncommittedSlot nd) (currentVotingNodes nd) (currentClusterState nd) \\ messages\"\n by (simp add: messages' result)\n\n have message_simps[simp]:\n \"\\s d i t. (s \\\\ PublishResponse i t \\\\' d) = (s \\\\ PublishResponse i t \\\\ d)\"\n \"\\s d i t. (s \\\\ ApplyCommit i t \\\\' d) = (s \\\\ ApplyCommit i t \\\\ d)\"\n \"\\s d i t x. (s \\\\ PublishRequest i t x \\\\' d) = (s \\\\ PublishRequest i t x \\\\ d)\"\n \"\\s d i t a. (s \\\\ Vote i t a \\\\' d) = (s \\\\ Vote i t a \\\\ d)\"\n \"\\d i t. (\\ PublishResponse i t \\\\' d) = (\\ PublishResponse i t \\\\ d)\"\n \"\\d i t. (\\ ApplyCommit i t \\\\' d) = (\\ ApplyCommit i t \\\\ d)\"\n \"\\d i t x. (\\ PublishRequest i t x \\\\' d) = (\\ PublishRequest i t x \\\\ d)\"\n \"\\d i t a. (\\ Vote i t a \\\\' d) = (\\ Vote i t a \\\\ d)\"\n \"\\s i t. (s \\\\ PublishResponse i t \\\\') = (s \\\\ PublishResponse i t \\\\)\"\n \"\\s i t. (s \\\\ ApplyCommit i t \\\\') = (s \\\\ ApplyCommit i t \\\\)\"\n \"\\s i t x. (s \\\\ PublishRequest i t x \\\\') = (s \\\\ PublishRequest i t x \\\\)\"\n \"\\s i t a. (s \\\\ Vote i t a \\\\') = (s \\\\ Vote i t a \\\\)\"\n \"\\i t. (\\ PublishResponse i t \\\\') = (\\ PublishResponse i t \\\\)\"\n \"\\i t. (\\ ApplyCommit i t \\\\') = (\\ ApplyCommit i t \\\\)\"\n \"\\i t x. (\\ PublishRequest i t x \\\\') = (\\ PublishRequest i t x \\\\)\"\n \"\\i t a. (\\ Vote i t a \\\\') = (\\ Vote i t a \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have CatchUpResponse':\n \"\\s d i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\' d) = (s \\\\ CatchUpResponse i conf cs \\\\ d\n \\ (s, i, conf, cs, d) = (n\\<^sub>0, firstUncommittedSlot nd, currentVotingNodes nd, currentClusterState nd, d\\<^sub>0))\"\n \"\\d i conf cs. (\\ CatchUpResponse i conf cs \\\\' d) = (\\ CatchUpResponse i conf cs \\\\ d\n \\ (i, conf, cs, d) = (firstUncommittedSlot nd, currentVotingNodes nd, currentClusterState nd, d\\<^sub>0))\"\n \"\\s i conf cs. (s \\\\ CatchUpResponse i conf cs \\\\') = (s \\\\ CatchUpResponse i conf cs \\\\\n \\ (s, i, conf, cs) = (n\\<^sub>0, firstUncommittedSlot nd, currentVotingNodes nd, currentClusterState nd))\"\n \"\\i conf cs. (\\ CatchUpResponse i conf cs \\\\') = (\\ CatchUpResponse i conf cs \\\\\n \\ (i, conf, cs) = (firstUncommittedSlot nd, currentVotingNodes nd, currentClusterState nd))\"\n unfolding isMessageFromTo_def isMessageFromTo'_def isMessageFrom_def isMessageFrom'_def isMessageTo_def isMessageTo'_def isMessage_def isMessage'_def\n by (auto simp add: messages')\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq promised_eq prevAccepted_eq nodeState')\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\".\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from electionWon_isQuorum show \"\\n. electionWon (nodeState n) \\ isQuorum (nodeState n) (joinVotes (nodeState n))\".\n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n from CatchUpResponse_committedTo committedTo_firstUncommittedSlot\n show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ committed\\<^sub>< i\"\n unfolding CatchUpResponse' nd_def by blast\n\n from CatchUpResponse_V currentVotingNodes_firstUncommittedSlot\n show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ V i = conf\"\n unfolding CatchUpResponse' nd_def isQuorum_def by auto\n\n from CatchUpResponse_lastCommittedClusterStateBefore currentClusterState_lastCommittedClusterStateBefore\n show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\' \\ lastCommittedClusterStateBefore i = cs\"\n unfolding CatchUpResponse' nd_def by auto\n qed\nqed\n\n\nlemma (in zenStep) handleCatchUpResponse_invariants:\n assumes nd': \"nd' = handleCatchUpResponse i conf cs nd\"\n assumes messages'[simp]: \"messages' = messages\"\n assumes sent: \"\\ CatchUpResponse i conf cs \\\\\"\n shows \"zen messages' nodeState'\"\nproof (cases \"firstUncommittedSlot nd < i\")\n case False\n hence nd'[simp]: \"nd' = nd\"\n by (auto simp add: nd' handleCatchUpResponse_def)\n\n have nodeState'[simp]: \"nodeState' = nodeState\" unfolding nodeState'_def by (intro ext, simp add: nd_def)\n\n from zen_axioms show ?thesis unfolding nodeState' by simp\n\nnext\n case True\n\n hence nd': \"nd' = nd \\ firstUncommittedSlot := i\n , publishPermitted := True\n , publishVotes := {}\n , currentVotingNodes := conf\n , currentClusterState := cs\n , joinVotes := {}\n , electionWon := False\n , lastAcceptedData := None \\\"\n by (simp add: nd', simp add: handleCatchUpResponse_def)\n\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n unfolding nodeState'_def by (auto simp add: nd' nd_def lastAcceptedTerm_def firstUncommittedSlot_def lastAcceptedValue_def)\n\n have updated_properties:\n \"\\n. firstUncommittedSlot (nodeState' n) = (if n = n\\<^sub>0 then i else firstUncommittedSlot (nodeState n)) \"\n \"\\n. publishPermitted (nodeState' n) = (publishPermitted (nodeState n) \\ n = n\\<^sub>0)\"\n \"\\n. publishVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else publishVotes (nodeState n))\"\n \"\\n. currentVotingNodes (nodeState' n) = (if n = n\\<^sub>0 then conf else currentVotingNodes (nodeState n))\"\n \"\\n. joinVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else joinVotes (nodeState n))\"\n \"\\n. electionWon (nodeState' n) = (electionWon (nodeState n) \\ n \\ n\\<^sub>0)\"\n \"\\n. currentVotingNodes (nodeState' n) = (if n = n\\<^sub>0 then conf else currentVotingNodes (nodeState n))\"\n \"\\n. isQuorum (nodeState' n) = (if n = n\\<^sub>0 then (\\q. q \\ majorities conf) else isQuorum (nodeState n))\"\n \"\\n. currentClusterState (nodeState' n) = (if n = n\\<^sub>0 then cs else currentClusterState (nodeState n))\"\n unfolding nodeState'_def\n by (auto simp add: nd' nd_def isQuorum_def)\n\n have \"\\n. lastAcceptedTerm (nodeState' n) = (if n = n\\<^sub>0 then NO_TERM else lastAcceptedTerm (nodeState n))\"\n using True unfolding lastAcceptedTerm_def updated_properties property_simps nd_def\n using not_le by (simp add: nodeState'_def nd')\n note updated_properties = updated_properties this\n\n show ?thesis\n apply (intro zenI)\n apply (unfold messages' message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages\" .\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties apply auto\n using CatchUpResponse_committedTo sent by blast\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState' n) (joinVotes (nodeState' n))\"\n unfolding updated_properties apply auto done\n\n from joinVotes_max show \"\\n n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState' n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState' n)\"\n unfolding updated_properties apply auto done\n\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) (currentTerm (nodeState n)) \\\\\"\n unfolding updated_properties apply auto done\n\n from joinVotes show \"\\n n'. n' \\ joinVotes (nodeState' n) \\ promised (firstUncommittedSlot (nodeState' n)) n' n (currentTerm (nodeState n))\"\n unfolding updated_properties apply auto done\n\n fix n\n\n from firstUncommittedSlot_PublishRequest show \"\\i t x. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\"\n unfolding updated_properties using True nd_def by (cases \"n = n\\<^sub>0\", auto)\n\n from PublishRequest_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using True firstUncommittedSlot_PublishRequest nd_def by blast\n\n from PublishRequest_publishPermitted_currentTerm show \"\\t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState' n)) t x \\\\ \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState n)\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using True firstUncommittedSlot_PublishRequest nd_def by blast\n\n from currentClusterState_lastCommittedClusterStateBefore show \"currentClusterState (nodeState' n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using CatchUpResponse_lastCommittedClusterStateBefore sent by blast\n\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState' n) = V (firstUncommittedSlot (nodeState' n))\"\n unfolding updated_properties using CatchUpResponse_V sent by (cases \"n = n\\<^sub>0\", auto)\n\n from firstUncommittedSlot_PublishResponse show \"\\i t. firstUncommittedSlot (nodeState' n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" \n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using True dual_order.strict_trans nd_def by blast\n\n from lastAcceptedTerm_None show \"\\i t. lastAcceptedTerm (nodeState' n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n unfolding updated_properties apply (cases \"n = n\\<^sub>0\", auto)\n using True firstUncommittedSlot_PublishResponse nd_def by blast\n\n from lastAcceptedTerm_Some_sent show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t \\\\\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_max show \"\\t t'. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState' n)) t' \\\\ \\ t' \\ t\" \n unfolding updated_properties by (cases \"n = n\\<^sub>0\", auto)\n\n from lastAcceptedTerm_Some_value show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState' n)) t (lastAcceptedValue (nodeState' n)) \\\\\" \n unfolding updated_properties lastAcceptedValue_def by (cases \"n = n\\<^sub>0\", auto simp add: nodeState'_def)\n\n from lastAcceptedTerm_Some_currentTerm show \"\\t. lastAcceptedTerm (nodeState' n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\" \n unfolding updated_properties by (cases \"n = n\\<^sub>0\", auto)\n qed\nqed\n\nlemma (in zenStep) handleDiscardJoinVotes_invariants:\n assumes nd': \"nd' = handleDiscardJoinVotes nd\"\n assumes messages': \"messages' = messages\"\n shows \"zen messages' nodeState'\"\nproof -\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n \"\\n. publishPermitted (nodeState' n) = publishPermitted (nodeState n)\"\n \"\\n. publishVotes (nodeState' n) = publishVotes (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' handleDiscardJoinVotes_def Let_def\n lastAcceptedValue_def lastAcceptedTerm_def)\n\n have updated_properties:\n \"\\n. joinVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else joinVotes (nodeState n))\"\n \"\\n. electionWon (nodeState' n) = (electionWon (nodeState n) \\ n \\ n\\<^sub>0)\"\n by (unfold nodeState'_def, auto simp add: nd' nd_def handleDiscardJoinVotes_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\" .\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\" .\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState n) \\ t < currentTerm (nodeState n)\".\n from publishVotes show \"\\n n'. n' \\ publishVotes (nodeState n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\".\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState n) (joinVotes (nodeState' n))\"\n unfolding updated_properties by simp\n\n fix n\n\n from joinVotes show \"\\n'. n' \\ joinVotes (nodeState' n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", simp_all)\n from joinVotes_max show \"\\n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState' n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", simp_all)\n qed\nqed\n\nlemma (in zenStep) handleReboot_invariants:\n assumes nd': \"nd' = handleReboot nd\"\n assumes messages': \"messages' = messages\"\n shows \"zen messages' nodeState'\"\nproof -\n have message_simps[simp]:\n \"\\s p d. (s \\\\ p \\\\' d) = (s \\\\ p \\\\ d)\"\n \"\\p d. (\\ p \\\\' d) = (\\ p \\\\ d)\"\n \"\\s p. (s \\\\ p \\\\') = (s \\\\ p \\\\)\"\n \"\\p. (\\ p \\\\') = (\\ p \\\\)\"\n by (unfold isMessageFromTo'_def isMessageTo'_def isMessageFrom'_def isMessage'_def,\n auto simp add: messages' isMessageFromTo_def isMessageTo_def isMessageFrom_def isMessage_def)\n\n have property_simps[simp]:\n \"\\n. currentNode (nodeState' n) = currentNode (nodeState n)\"\n \"\\n. firstUncommittedSlot (nodeState' n) = firstUncommittedSlot (nodeState n)\"\n \"\\n. currentVotingNodes (nodeState' n) = currentVotingNodes (nodeState n)\"\n \"\\n q. isQuorum (nodeState' n) q = isQuorum (nodeState n) q\"\n \"\\n. lastAcceptedTerm (nodeState' n) = lastAcceptedTerm (nodeState n)\"\n \"\\n. lastAcceptedValue (nodeState' n) = lastAcceptedValue (nodeState n)\"\n \"\\n. currentTerm (nodeState' n) = currentTerm (nodeState n)\"\n \"\\n. currentClusterState (nodeState' n) = currentClusterState (nodeState n)\"\n by (unfold nodeState'_def, auto simp add: nd_def isQuorum_def nd' handleReboot_def Let_def\n lastAcceptedValue_def lastAcceptedTerm_def)\n\n have updated_properties:\n \"\\n. publishPermitted (nodeState' n) = (publishPermitted (nodeState n) \\ n \\ n\\<^sub>0)\"\n \"\\n. joinVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else joinVotes (nodeState n))\"\n \"\\n. electionWon (nodeState' n) = (electionWon (nodeState n) \\ n \\ n\\<^sub>0)\"\n \"\\n. publishVotes (nodeState' n) = (if n = n\\<^sub>0 then {} else publishVotes (nodeState n))\"\n by (unfold nodeState'_def, auto simp add: nd' nd_def handleReboot_def)\n\n have v_eq[simp]: \"v' = v\" by (intro ext, auto simp add: v'_def v_def)\n have v\\<^sub>c_eq[simp]: \"v\\<^sub>c' = v\\<^sub>c\" by (intro ext, auto simp add: v\\<^sub>c'_def v\\<^sub>c_def)\n have isCommitted_eq[simp]: \"isCommitted' = isCommitted\" by (intro ext, auto simp add: isCommitted'_def isCommitted_def)\n have committedTo_eq[simp]: \"committed\\<^sub><' = committed\\<^sub><\" by (intro ext, auto simp add: committedTo'_def committedTo_def)\n have V_eq[simp]: \"V' = V\" using v\\<^sub>c_eq V'_def V_def by blast\n have promised_eq[simp]: \"promised' = promised\" by (intro ext, auto simp add: promised'_def promised_def)\n have lastCommittedClusterStateBefore_eq[simp]: \"lastCommittedClusterStateBefore' = lastCommittedClusterStateBefore\"\n unfolding lastCommittedClusterStateBefore_def lastCommittedClusterStateBefore'_def v\\<^sub>c_eq ..\n have prevAccepted_eq[simp]: \"prevAccepted' = prevAccepted\" by (intro ext, auto simp add: prevAccepted'_def prevAccepted_def)\n\n show ?thesis\n apply (intro zenI)\n apply (unfold message_simps committedTo_eq V_eq v_eq\n lastCommittedClusterStateBefore_eq property_simps promised_eq prevAccepted_eq)\n proof -\n from finite_messages show \"finite messages'\" by (simp add: messages')\n from Vote_future show \"\\i i' s t t' a. s \\\\ Vote i t a \\\\ \\ i < i' \\ t' < t \\ \\ s \\\\ PublishResponse i' t' \\\\\".\n from Vote_None show \"\\i s t t'. s \\\\ Vote i t NO_TERM \\\\ \\ t' < t \\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_lt show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t\".\n from Vote_Some_PublishResponse show \"\\i s t t'. s \\\\ Vote i t (SomeTerm t') \\\\ \\ s \\\\ PublishResponse i t' \\\\\".\n from Vote_Some_max show \"\\i s t t' t''. s \\\\ Vote i t (SomeTerm t') \\\\ \\ t' < t'' \\ t'' < t \\ \\ s \\\\ PublishResponse i t'' \\\\\".\n from Vote_not_broadcast show \"\\i t a d. \\ Vote i t a \\\\ d \\ d \\ Broadcast\".\n from Vote_unique_destination show \"\\i' i s t a a' d d'. s \\\\ Vote i t a \\\\ d \\ s \\\\ Vote i' t a' \\\\ d' \\ d = d'\".\n from currentNode_nodeState show \"\\n. currentNode (nodeState n) = n\" .\n from committedTo_firstUncommittedSlot show \"\\n. committed\\<^sub>< (firstUncommittedSlot (nodeState n))\" .\n from firstUncommittedSlot_PublishResponse show \"\\n i t. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishResponse i t \\\\\" .\n from lastAcceptedTerm_None show \"\\n i t. lastAcceptedTerm (nodeState n) = NO_TERM \\ \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\".\n from lastAcceptedTerm_Some_sent show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t \\\\\" .\n from lastAcceptedTerm_Some_max show \"\\n t t'. lastAcceptedTerm (nodeState n) = SomeTerm t \\ n \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) t' \\\\ \\ t' \\ t\" .\n from lastAcceptedTerm_Some_value show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ \\ PublishRequest (firstUncommittedSlot (nodeState n)) t (lastAcceptedValue (nodeState n)) \\\\\" .\n from Vote_currentTerm show \"\\n i t a. n \\\\ Vote i t a \\\\ \\ t \\ currentTerm (nodeState n)\".\n from Vote_slot_function show \"\\n i i' t a a'. n \\\\ Vote i t a \\\\ \\ n \\\\ Vote i' t a' \\\\ \\ i = i'\".\n from currentClusterState_lastCommittedClusterStateBefore show \"\\n. currentClusterState (nodeState n) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n))\".\n from PublishRequest_committedTo show \"\\i t x. \\ PublishRequest i t x \\\\ \\ committed\\<^sub>< i\".\n from PublishRequest_quorum show \"\\i s t x. s \\\\ PublishRequest i t x \\\\ \\ \\q\\majorities (V i). (\\n\\q. promised i n s t) \\ (prevAccepted i t q = {} \\ (\\t'. v i t = v i t' \\ maxTerm (prevAccepted i t q) \\ t' \\ \\ PublishResponse i t' \\\\ \\ t' < t))\".\n from PublishRequest_function show \"\\i t x x'. \\ PublishRequest i t x \\\\ \\ \\ PublishRequest i t x' \\\\ \\ x = x'\".\n from PublishResponse_PublishRequest show \"\\i s t. s \\\\ PublishResponse i t \\\\ \\ \\x. \\ PublishRequest i t x \\\\\".\n from ApplyCommit_quorum show \"\\i t. \\ ApplyCommit i t \\\\ \\ \\q\\majorities (V i). \\s\\q. s \\\\ PublishResponse i t \\\\\".\n from currentVotingNodes_firstUncommittedSlot show \"\\n. currentVotingNodes (nodeState n) = V (firstUncommittedSlot (nodeState n))\".\n from firstUncommittedSlot_PublishRequest show \"\\i n t x. firstUncommittedSlot (nodeState n) < i \\ \\ n \\\\ PublishRequest i t x \\\\\".\n from PublishRequest_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ t \\ currentTerm (nodeState n)\".\n from CatchUpResponse_committedTo show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ committed\\<^sub>< i\".\n from CatchUpResponse_V show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ V i = conf\".\n from CatchUpResponse_lastCommittedClusterStateBefore show \"\\i conf cs. \\ CatchUpResponse i conf cs \\\\ \\ lastCommittedClusterStateBefore i = cs\".\n from lastAcceptedTerm_Some_currentTerm show \"\\n t. lastAcceptedTerm (nodeState n) = SomeTerm t \\ t \\ currentTerm (nodeState n)\".\n\n from electionWon_isQuorum show \"\\n. electionWon (nodeState' n) \\ isQuorum (nodeState n) (joinVotes (nodeState' n))\"\n unfolding updated_properties by simp\n from PublishRequest_publishPermitted_currentTerm show \"\\n t x. n \\\\ PublishRequest (firstUncommittedSlot (nodeState n)) t x \\\\ \\ publishPermitted (nodeState' n) \\ t < currentTerm (nodeState n)\"\n unfolding updated_properties by simp\n\n fix n\n\n from joinVotes show \"\\n'. n' \\ joinVotes (nodeState' n) \\ promised (firstUncommittedSlot (nodeState n)) n' n (currentTerm (nodeState n))\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", simp_all)\n from publishVotes show \"\\n'. n' \\ publishVotes (nodeState' n) \\ n' \\\\ PublishResponse (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) \\\\\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", simp_all)\n from joinVotes_max show \"\\n' a'. \\ (\\x. \\ PublishRequest (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) x \\\\) \\ n' \\ joinVotes (nodeState' n) \\ n' \\\\ Vote (firstUncommittedSlot (nodeState n)) (currentTerm (nodeState n)) a' \\\\ (OneNode n) \\ a' \\ lastAcceptedTerm (nodeState n)\"\n unfolding updated_properties by (cases \"n = n\\<^sub>0\", simp_all)\n qed\nqed\n\nfun insertOption :: \"RoutedMessage option \\ RoutedMessage set \\ RoutedMessage set\"\n where\n \"insertOption None = id\"\n | \"insertOption (Some m) = insert m\"\n\nlemma currentNode_ensureCurrentTerm[simp]: \"currentNode (ensureCurrentTerm t nd) = currentNode nd\"\n by (auto simp add: ensureCurrentTerm_def)\n\nlemma currentNode_publishValue[simp]: \"currentNode (fst (publishValue x nd)) = currentNode nd\"\n by (auto simp add: publishValue_def)\n\nlemma currentNode_addElectionVote[simp]: \"currentNode (addElectionVote s i a nd) = currentNode nd\"\n by (auto simp add: addElectionVote_def Let_def)\n\nlemma currentNode_handleVote[simp]: \"currentNode (fst (handleVote s i t a nd)) = currentNode nd\"\n by (auto simp add: handleVote_def Let_def)\n\ntext \\\\pagebreak\\\n\nlemma initial_state_satisfies_invariants:\n shows \"zen {} initialNodeState\"\n by (unfold_locales, simp_all add: initialNodeState_def isQuorum_def\n lastAcceptedTerm_def lastAcceptedValue_def)\n\nlemma (in zen) invariants_preserved_by_ProcessMessage:\n fixes n\\<^sub>0\n assumes \"m \\ messages\"\n defines \"nd \\ nodeState n\\<^sub>0\"\n defines \"result \\ ProcessMessage nd m\"\n defines \"nodeState' \\ \\n. if n = n\\<^sub>0 then (fst result) else nodeState n\"\n defines \"messages' \\ insertOption (snd result) messages\"\n shows \"zen messages' nodeState'\"\nproof -\n {\n assume r: \"result = (nd, None)\"\n from r have \"nodeState' = nodeState\"\n by (auto simp add: nodeState'_def nd_def)\n moreover from r have \"messages' = messages\" by (simp add: messages'_def)\n ultimately have \"zen messages' nodeState'\"\n using zen_axioms by blast\n }\n note noop = this\n\n from `m \\ messages`\n have m: \"(sender m) \\\\ payload m \\\\ (destination m)\"\n by (cases m, auto simp add: isMessageFromTo_def)\n\n have currentNode[simp]: \"currentNode nd = n\\<^sub>0\" \"\\n. currentNode (nodeState n) = n\"\n by (simp_all add: nd_def currentNode_nodeState)\n\n have zenStep: \"zenStep messages nodeState messages' nodeState' n\\<^sub>0\"\n proof (intro_locales, intro zenStep_axioms.intro)\n show \"messages \\ messages'\"\n by (cases \"snd result\", auto simp add: messages'_def)\n qed (simp add: nodeState'_def)\n\n have [simp]: \"nodeState n\\<^sub>0 = nd\" by (simp add: nd_def)\n\n define broadcast' :: \"(NodeData * Message option) \\ (NodeData * RoutedMessage option)\" where\n \"\\p. broadcast' p \\ case p of\n (nd, Some m') \\ (nd, Some \\sender = currentNode nd,\n destination = Broadcast,\n payload = m' \\)\n | (nd, None) \\ (nd, None)\"\n\n define respond' :: \"(NodeData * Message option) \\ (NodeData * RoutedMessage option)\" where\n \"\\p. respond' p \\ case p of\n (nd, Some m') \\ (nd, Some \\sender = currentNode nd,\n destination = OneNode (sender m),\n payload = m' \\)\n | (nd, None) \\ (nd, None)\"\n\n have fst_broadcast[simp]: \"\\p. fst (broadcast' p) = fst p\"\n unfolding broadcast'_def by (simp add: case_prod_unfold option.case_eq_if)\n\n have fst_respond[simp]: \"\\p. fst (respond' p) = fst p\"\n unfolding respond'_def by (simp add: case_prod_unfold option.case_eq_if)\n\n show ?thesis\n proof (cases \"destination m = Broadcast \\ destination m = OneNode (currentNode nd)\")\n case False\n hence \"result = (nd, None)\"\n unfolding result_def ProcessMessage_def Let_def by simp\n thus ?thesis by (intro noop)\n next\n case dest_ok: True\n have dest_True: \"destination m \\ {Broadcast, OneNode (currentNode nd)} = True\"\n using dest_ok by simp\n show ?thesis\n proof (cases \"payload m\")\n case (StartJoin t)\n\n have result: \"result = respond' (handleStartJoin t nd)\"\n unfolding result_def respond'_def ProcessMessage_def dest_True StartJoin by auto\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by (auto simp add: handleStartJoin_def)\n\n show ?thesis\n proof (intro zenStep.handleStartJoin_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handleStartJoin t (nodeState n\\<^sub>0))\"\n by (simp add: result nodeState'_def)\n\n from currentNode_eq\n show \"messages' = (case snd (handleStartJoin t (nodeState n\\<^sub>0)) of None \\ messages | Some m' \\ insert \\sender = n\\<^sub>0, destination = OneNode (sender m), payload = m'\\ messages)\"\n unfolding messages'_def result respond'_def nodeState'_def by (cases \"handleStartJoin t nd\", cases \"snd (handleStartJoin t nd)\", auto)\n\n from m show \"\\d. \\sender = sender m, destination = d, payload = StartJoin t\\ \\ messages\"\n by (auto simp add: isMessageFromTo_def StartJoin)\n qed\n next\n case (Vote i t a)\n\n from Vote_not_broadcast m Vote dest_ok\n have dest_m: \"destination m = OneNode n\\<^sub>0\"\n apply (cases \"destination m\")\n using isMessageTo_def apply fastforce\n by auto\n\n from Vote_not_broadcast m Vote dest_ok\n have m: \"(sender m) \\\\ Vote i t a \\\\ (OneNode n\\<^sub>0)\"\n apply (cases \"destination m\")\n using isMessageTo_def apply fastforce\n by auto\n\n have result: \"result = broadcast' (handleVote (sender m) i t a nd)\"\n unfolding result_def ProcessMessage_def Vote dest_True broadcast'_def by simp\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by simp\n\n show ?thesis\n proof (intro zenStep.handleVote_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handleVote (sender m) i t a (nodeState n\\<^sub>0))\"\n by (simp add: result nodeState'_def)\n\n from currentNode_eq\n show \"messages' = (case snd (handleVote (sender m) i t a (nodeState n\\<^sub>0)) of None \\ messages | Some m \\ insert \\sender = n\\<^sub>0, destination = Broadcast, payload = m\\ messages)\"\n unfolding messages'_def result broadcast'_def nodeState'_def by (cases \"handleVote (sender m) i t a nd\", cases \"snd (handleVote (sender m) i t a nd)\", auto)\n\n from m\n show \"\\sender = sender m, destination = OneNode n\\<^sub>0, payload = Vote i t a\\ \\ messages\"\n by (auto simp add: Vote isMessageFromTo_def)\n qed\n\n next\n case (ClientValue x)\n\n have result: \"result = broadcast' (handleClientValue x nd)\"\n unfolding result_def ProcessMessage_def ClientValue dest_True broadcast'_def by simp\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by (simp add: handleClientValue_def)\n\n show ?thesis\n proof (intro zenStep.handleClientValue_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handleClientValue x (nodeState n\\<^sub>0))\"\n by (simp add: result nodeState'_def)\n\n from currentNode_eq\n show \"messages' = (case snd (handleClientValue x (nodeState n\\<^sub>0)) of None \\ messages | Some m \\ insert \\sender = n\\<^sub>0, destination = Broadcast, payload = m\\ messages)\"\n unfolding messages'_def result broadcast'_def nodeState'_def by (cases \"handleClientValue x (nodeState n\\<^sub>0)\", cases \"snd (handleClientValue x (nodeState n\\<^sub>0))\", auto)\n qed\n\n next\n case (PublishRequest i t x)\n\n have result: \"result = respond' (handlePublishRequest i t x nd)\"\n unfolding result_def ProcessMessage_def PublishRequest dest_True by (simp add: respond'_def)\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by (simp add: handlePublishRequest_def)\n\n show ?thesis\n proof (intro zenStep.handlePublishRequest_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handlePublishRequest i t x (nodeState n\\<^sub>0))\"\n by (simp add: nodeState'_def result)\n\n from currentNode_eq\n show \"messages' = (case snd (handlePublishRequest i t x (nodeState n\\<^sub>0)) of None \\ messages | Some m' \\ insert \\sender = n\\<^sub>0, destination = OneNode (sender m), payload = m'\\ messages)\"\n unfolding messages'_def result respond'_def nodeState'_def by (cases \"handlePublishRequest i t x (nodeState n\\<^sub>0)\", cases \"snd (handlePublishRequest i t x (nodeState n\\<^sub>0))\", auto)\n\n from m\n show \"\\d. \\sender = sender m, destination = d, payload = PublishRequest i t x\\ \\ messages\"\n by (auto simp add: PublishRequest isMessageFromTo_def)\n qed\n\n next\n case (PublishResponse i t)\n\n have result: \"result = broadcast' (handlePublishResponse (sender m) i t nd)\"\n unfolding result_def ProcessMessage_def PublishResponse dest_True by (simp add: broadcast'_def)\n\n show ?thesis\n proof (intro zenStep.handlePublishResponse_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handlePublishResponse (sender m) i t (nodeState n\\<^sub>0))\"\n by (simp add: result nodeState'_def)\n\n show \"messages' = (case snd (handlePublishResponse (sender m) i t (nodeState n\\<^sub>0)) of None \\ messages | Some m \\ insert \\sender = n\\<^sub>0, destination = Broadcast, payload = m\\ messages)\"\n by (simp_all add: messages'_def result broadcast'_def handlePublishResponse_def commitIfQuorate_def)\n\n from m\n show \"\\d. \\sender = sender m, destination = d, payload = PublishResponse i t\\ \\ messages\"\n by (auto simp add: PublishResponse isMessageFromTo_def)\n qed\n\n next\n case (ApplyCommit i t)\n\n have result: \"result = (handleApplyCommit i t nd, None)\"\n unfolding result_def ProcessMessage_def ApplyCommit dest_True by simp\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by (cases \"lastAcceptedValue nd\", simp_all add: handleApplyCommit_def applyAcceptedValue_def)\n\n show ?thesis\n proof (intro zenStep.handleApplyCommit_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = handleApplyCommit i t (nodeState n\\<^sub>0)\"\n by (simp add: result nodeState'_def)\n show \"messages' = messages\"\n by (simp add: result messages'_def)\n from m show \"\\s d. \\sender = s, destination = d, payload = ApplyCommit i t\\ \\ messages\"\n by (auto simp add: ApplyCommit isMessageFromTo_def)\n qed\n\n next\n case Reboot\n\n have result: \"result = (handleReboot nd, None)\"\n unfolding result_def ProcessMessage_def Reboot dest_True by simp\n\n show ?thesis\n proof (intro zenStep.handleReboot_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = handleReboot (nodeState n\\<^sub>0)\"\n by (simp add: nodeState'_def result)\n\n show \"messages' = messages\"\n by (simp add: result messages'_def)\n qed\n\n next\n case DiscardJoinVotes\n\n have result: \"result = (handleDiscardJoinVotes nd, None)\"\n unfolding result_def ProcessMessage_def DiscardJoinVotes dest_True by simp\n\n show ?thesis\n proof (intro zenStep.handleDiscardJoinVotes_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = handleDiscardJoinVotes (nodeState n\\<^sub>0)\"\n by (simp add: nodeState'_def result)\n\n show \"messages' = messages\"\n by (simp add: result messages'_def)\n qed\n\n next\n case CatchUpRequest\n\n have result: \"result = respond' (handleCatchUpRequest nd)\"\n unfolding result_def ProcessMessage_def CatchUpRequest dest_True by (simp add: respond'_def)\n\n have currentNode_eq: \"currentNode (nodeState' n\\<^sub>0) = currentNode (nodeState n\\<^sub>0)\"\n unfolding nodeState'_def result by (cases \"lastAcceptedValue nd\", simp_all add: handleCatchUpRequest_def)\n\n show ?thesis\n proof (intro zenStep.handleCatchUpRequest_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = fst (handleCatchUpRequest (nodeState n\\<^sub>0))\"\n by (simp add: nodeState'_def result)\n\n show \"messages' = (case snd (handleCatchUpRequest (nodeState n\\<^sub>0)) of None \\ messages | Some m' \\ insert \\sender = n\\<^sub>0, destination = OneNode (sender m), payload = m'\\ messages)\"\n by (simp_all add: messages'_def result respond'_def handleCatchUpRequest_def)\n qed\n\n next\n case (CatchUpResponse i conf cs)\n\n have result: \"result = (handleCatchUpResponse i conf cs nd, None)\"\n unfolding result_def ProcessMessage_def CatchUpResponse dest_True by simp\n\n show ?thesis\n proof (intro zenStep.handleCatchUpResponse_invariants [OF zenStep])\n show \"nodeState' n\\<^sub>0 = handleCatchUpResponse i conf cs (nodeState n\\<^sub>0)\"\n by (simp add: nodeState'_def result)\n\n show \"messages' = messages\"\n by (simp add: result messages'_def)\n\n from m show \"\\s d. \\sender = s, destination = d, payload = CatchUpResponse i conf cs\\ \\ messages\"\n unfolding CatchUpResponse isMessageFromTo_def by auto\n qed\n qed\n qed\nqed\n\ntheorem (in zen) invariants_imply_consistent_states:\n assumes\n \"firstUncommittedSlot (nodeState n\\<^sub>1) = firstUncommittedSlot (nodeState n\\<^sub>2)\"\n shows\n \"currentClusterState (nodeState n\\<^sub>1) = currentClusterState (nodeState n\\<^sub>2)\"\nproof -\n have \"currentClusterState (nodeState n\\<^sub>1) = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n\\<^sub>1))\"\n using currentClusterState_lastCommittedClusterStateBefore .\n also have \"... = lastCommittedClusterStateBefore (firstUncommittedSlot (nodeState n\\<^sub>2))\" using assms by simp\n also have \"... = currentClusterState (nodeState n\\<^sub>2)\"\n using currentClusterState_lastCommittedClusterStateBefore ..\n finally show ?thesis .\nqed\n\nend\n", "meta": {"author": "elastic", "repo": "elasticsearch-formal-models", "sha": "ca30663506a7e18de9d23fabbc70a369903d7c98", "save_path": "github-repos/isabelle/elastic-elasticsearch-formal-models", "path": "github-repos/isabelle/elastic-elasticsearch-formal-models/elasticsearch-formal-models-ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Zen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.26009643876289057}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: Implem.thy (Isabelle/HOL 2016-1)\n ID: $Id: Implem.thy 132885 2016-12-23 18:41:32Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Parametric channel message implementation\n - definition of 'valid' implementations\n - assumptions for channel implementations (formulated as locales)\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Assumptions for Channel Message Implementation\\\n\ntext \\We define a series of locales capturing our assumptions on channel message \nimplementations.\\\n\ntheory Implem\nimports Channels Payloads\nbegin\n\nsubsection \\First step: basic implementation locale\\\n(**************************************************************************************************)\n\ntext \\This locale has no assumptions, it only fixes an implementation function and \ndefines some useful abbreviations (impl*, impl*Set) and \\valid\\.\n\\\n\nlocale basic_implem =\n fixes implem :: \"chan \\ msg\"\nbegin\n\nabbreviation \"implInsec A B M \\ implem (Insec A B M)\"\nabbreviation \"implConfid A B M \\ implem (Confid A B M)\"\nabbreviation \"implAuth A B M \\ implem (Auth A B M)\"\nabbreviation \"implSecure A B M \\ implem (Secure A B M)\"\n\nabbreviation implInsecSet :: \"msg set \\ msg set\"\nwhere \"implInsecSet G \\ {implInsec A B M | A B M. M \\ G}\"\n\nabbreviation implConfidSet :: \"(agent * agent) set \\ msg set \\ msg set\"\nwhere \"implConfidSet Ag G \\ {implConfid A B M | A B M. (A, B) \\ Ag \\ M \\ G}\"\n\nabbreviation implAuthSet :: \"msg set \\ msg set\"\nwhere \"implAuthSet G \\ {implAuth A B M | A B M. M \\ G}\"\n\nabbreviation implSecureSet :: \"(agent * agent) set \\ msg set \\ msg set\"\nwhere \"implSecureSet Ag G \\ {implSecure A B M | A B M. (A, B) \\ Ag \\ M \\ G}\"\n\ndefinition\n valid :: \"msg set\"\nwhere\n \"valid \\ {implem (Chan x A B M) | x A B M. M \\ payload}\"\n\nlemma validI:\n \"M \\ payload \\ implem (Chan x A B M) \\ valid\"\nby (auto simp add: valid_def)\n\nlemma validE:\n \"X \\ valid \\ (\\ x A B M. X = implem (Chan x A B M) \\ M \\ payload \\ P) \\ P\"\nby (auto simp add: valid_def)\n\nlemma valid_cases:\nfixes X P\nassumes \"X \\ valid\"\n \"(\\A B M. X = implInsec A B M \\ M \\ payload \\ P)\"\n \"(\\A B M. X = implConfid A B M \\ M \\ payload \\ P)\"\n \"(\\A B M. X = implAuth A B M \\ M \\ payload \\ P)\"\n \"(\\A B M. X = implSecure A B M \\ M \\ payload \\ P)\"\nshows \"P\"\nproof -\n from assms have \"(\\ x A B M. X = implem (Chan x A B M) \\ M \\ payload \\ P) \\ P\"\n by (auto elim: validE)\n moreover from assms have \"\\ x A B M. X = implem (Chan x A B M) \\ M \\ payload \\ P\"\n proof -\n fix x A B M\n assume \"X = implem (Chan x A B M)\" \"M \\ payload\"\n with assms show \"P\" by (cases x, auto)\n qed\n ultimately show ?thesis .\nqed\n\nend\n\nsubsection \\Second step: basic and analyze assumptions\\\n(**************************************************************************************************)\n\ntext \\This locale contains most of the assumptions on implem, i.e.:\n\\begin{itemize}\n\\item \\impl_inj\\: injectivity\n\\item \\parts_impl_inj\\: injectivity through parts\n\\item \\Enc_parts_valid_impl\\: if Enc X Y appears in parts of an implem, then it is \n in parts of the payload, or the key is either long term or payload\n\\item \\impl_composed\\: the implementations are composed (not nonces, agents, tags etc.)\n\\item \\analz_Un_implXXXSet\\: move the impl*Set out of the analz (only keep the payloads)\n\\item \\impl_Impl\\: implementations contain implementation material\n\\item \\LtK_parts_impl\\: no exposed long term keys in the implementations \n (i.e., they are only used as keys, or under hashes)\n\\end{itemize}\n\\\n\nlocale semivalid_implem = basic_implem +\n\\ \\injectivity\\\nassumes impl_inj:\n \"implem (Chan x A B M) = implem (Chan x' A' B' M') \n \\ x = x' \\ A = A' \\ B = B' \\ M = M'\"\n\\ \\implementations and parts\\\nand parts_impl_inj:\n \"M' \\ payload \\\n implem (Chan x A B M) \\ parts {implem (Chan x' A' B' M')} \\ \n x = x' \\ A = A' \\ B = B' \\ M = M'\"\nand Enc_keys_clean_valid: \"I \\ valid \\ Enc_keys_clean I\"\nand impl_composed: \"composed (implem Z)\"\nand impl_Impl: \"implem (Chan x A B M) \\ payload\"\n\\ \\no ltk in the parts of an implementation\\\nand LtK_parts_impl: \"X \\ valid \\ LtK K \\ parts {X}\"\n\n\\ \\analyze assumptions:\\\nand analz_Un_implInsecSet:\n \"\\ G \\ payload; Enc_keys_clean H \\ \n \\ analz (implInsecSet G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nand analz_Un_implConfidSet:\n \"\\ G \\ payload; Enc_keys_clean H \\ \n \\ analz (implConfidSet Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nand analz_Un_implConfidSet_2:\n \"\\ G \\ payload; Enc_keys_clean H; Ag \\ broken (parts H \\ range LtK) = {} \\\n \\ analz (implConfidSet Ag G \\ H) \\ synth (analz H) \\ -payload\"\nand analz_Un_implAuthSet:\n \"\\ G \\ payload; Enc_keys_clean H \\\n \\ analz (implAuthSet G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nand analz_Un_implSecureSet:\n \"\\ G \\ payload; Enc_keys_clean H \\\n \\ analz (implSecureSet Ag G \\ H) \\ synth (analz (G \\ H)) \\ -payload\"\nand analz_Un_implSecureSet_2:\n \"\\ G \\ payload; Enc_keys_clean H; Ag \\ broken (parts H \\ range LtK) = {} \\\n \\ analz (implSecureSet Ag G \\ H) \\ synth (analz H) \\ -payload\"\n\nbegin\n\\ \\declare some attributes and abbreviations for the hypotheses\\\n\\ \\and prove some simple consequences of the hypotheses\\\ndeclare impl_inj [simp]\n\nlemmas parts_implE [elim] = parts_impl_inj [rotated 1]\n\ndeclare impl_composed [simp, intro]\n\nlemma composed_arg_cong: \"X = Y \\ composed X \\ composed Y\"\nby (rule arg_cong)\n\nlemma implem_Tags_aux: \"implem (Chan x A B M) \\ Tags\" by (cases x, auto dest: composed_arg_cong)\nlemma implem_Tags [simp]: \"implem x \\ Tags\" by (cases x, auto simp add: implem_Tags_aux)\nlemma implem_LtK_aux: \"implem (Chan x A B M) \\ LtK K\" by (cases x, auto dest: composed_arg_cong)\nlemma implem_LtK [simp]: \"implem x \\ LtK K\" by (cases x, auto simp add: implem_LtK_aux)\nlemma implem_LtK2 [simp]: \"implem x \\ range LtK\" by (cases x, auto simp add: implem_LtK_aux)\n\ndeclare impl_Impl [simp]\n\nlemma LtK_parts_impl_insert:\n \"LtK K \\ parts (insert (implem (Chan x A B M)) S) \\ M \\ payload \\ LtK K \\ parts S\"\napply (simp add: parts_insert [of _ S], clarify)\napply (auto dest: validI LtK_parts_impl)\ndone\n\n\ndeclare LtK_parts_impl_insert [dest]\ndeclare Enc_keys_clean_valid [simp, intro]\n\nlemma valid_composed [simp,dest]: \"M \\ valid \\ composed M\"\nby (auto elim: validE)\n\n\\ \\lemmas: valid/payload are mutually exclusive\\\nlemma valid_payload [dest]: \"\\ X \\ valid; X \\ payload \\ \\ P\"\nby (auto elim!: validE)\n \n\\ \\valid/LtK are mutually exclusive\\\nlemma valid_isLtKey [dest]: \"\\ X \\ valid; X \\ range LtK \\ \\ P\"\nby (auto)\n\nlemma analz_valid:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n implem (Chan x A B M) \\ analz H \\\n implem (Chan x A B M) \\ H\"\napply (drule analz_into_parts, \n drule parts_monotone [of _ H \"payload \\ H \\ valid \\ range LtK \\ Tags\"], auto)\napply (drule parts_singleton, auto elim!:validE dest: parts_impl_inj)\ndone\n\nlemma parts_valid_LtKeys_disjoint:\n \"I \\ valid \\ parts I \\ range LtK = {}\"\napply (safe, drule parts_singleton, clarsimp)\napply (auto dest: subsetD LtK_parts_impl)\ndone\n\nlemma analz_LtKeys:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n analz H \\ range LtK \\ H\"\napply auto\napply (drule analz_into_parts, drule parts_monotone [of _ H \"payload \\ valid \\ H \\ range LtK \\ Tags\"], auto)\napply (drule parts_singleton, auto elim!:validE dest: parts_impl_inj)\ndone\n\nend\n\n\nsubsection \\Third step: \\valid_implem\\\\\n(**************************************************************************************************)\n\ntext \\This extends @{locale \"semivalid_implem\"} with four new assumptions, which under certain \n conditions give information on $A$, $B$, $M$ when @{term \"implXXX A B M \\ synth (analz Z)\"}.\n These assumptions are separated because interpretations are more easily proved, if the \n conclusions that follow from the @{locale \"semivalid_implem\"} assumptions are already \n available.\n\\\n\nlocale valid_implem = semivalid_implem +\n\n\\ \\Synthesize assumptions: conditions on payloads $M$ implied by derivable\\\n\\ \\channel messages with payload $M$.\\\nassumes implInsec_synth_analz:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n implInsec A B M \\ synth (analz H) \\\n implInsec A B M \\ H \\ M \\ synth (analz H)\"\nand implConfid_synth_analz:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n implConfid A B M \\ synth (analz H) \\\n implConfid A B M \\ H \\ M \\ synth (analz H)\"\nand implAuth_synth_analz:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n implAuth A B M \\ synth (analz H) \\\n implAuth A B M \\ H \\ (M \\ synth (analz H) \\ (A, B) \\ broken H)\"\nand implSecure_synth_analz:\n \"H \\ payload \\ valid \\ range LtK \\ Tags \\\n implSecure A B M \\ synth (analz H) \\\n implSecure A B M \\ H \\ (M \\ synth (analz H) \\ (A, B) \\ broken H)\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Implem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.44167300566462564, "lm_q1q2_score": 0.2600964323894571}} {"text": "theory flash95Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( eqn ( IVar ( Para ''Dir_ShrSet'' Home) ) ( Const true )) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Remote_GetX_NakVsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv95: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX1VsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX2VsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX1VsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_PutVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Local_PutXVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv95: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv95 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_GetVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv95: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv95 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv95: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv95 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash95Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784074525098, "lm_q2_score": 0.4532618480153862, "lm_q1q2_score": 0.26002653512844826}} {"text": "subsection \"Termination-Sensitive Systems\"\n\ntheory Sec_TypingT imports Sec_Type_Expr\nbegin\n\nsubsubsection \"A Syntax Directed System\"\n\ninductive sec_type :: \"nat \\ com \\ bool\" (\"(_/ \\ _)\" [0,0] 50) where\nSkip:\n \"l \\ SKIP\" |\nAssign:\n \"\\ sec x \\ sec a; sec x \\ l \\ \\ l \\ x ::= a\" |\nSeq:\n \"l \\ c\\<^sub>1 \\ l \\ c\\<^sub>2 \\ l \\ c\\<^sub>1;;c\\<^sub>2\" |\nIf:\n \"\\ max (sec b) l \\ c\\<^sub>1; max (sec b) l \\ c\\<^sub>2 \\\n \\ l \\ IF b THEN c\\<^sub>1 ELSE c\\<^sub>2\" |\nWhile:\n \"sec b = 0 \\ 0 \\ c \\ 0 \\ WHILE b DO c\"\n\ncode_pred (expected_modes: i => i => bool) sec_type .\n\ninductive_cases [elim!]:\n \"l \\ x ::= a\" \"l \\ c\\<^sub>1;;c\\<^sub>2\" \"l \\ IF b THEN c\\<^sub>1 ELSE c\\<^sub>2\" \"l \\ WHILE b DO c\"\n\n\nlemma anti_mono: \"l \\ c \\ l' \\ l \\ l' \\ c\"\napply(induction arbitrary: l' rule: sec_type.induct)\napply (metis sec_type.intros(1))\napply (metis le_trans sec_type.intros(2))\napply (metis sec_type.intros(3))\napply (metis If le_refl sup_mono sup_nat_def)\nby (metis While le_0_eq)\n\n\nlemma confinement: \"(c,s) \\ t \\ l \\ c \\ s = t (< l)\"\nproof(induction rule: big_step_induct)\n case Skip thus ?case by simp\nnext\n case Assign thus ?case by auto\nnext\n case Seq thus ?case by auto\nnext\n case (IfTrue b s c1)\n hence \"max (sec b) l \\ c1\" by auto\n hence \"l \\ c1\" by (metis max.cobounded2 anti_mono)\n thus ?case using IfTrue.IH by metis\nnext\n case (IfFalse b s c2)\n hence \"max (sec b) l \\ c2\" by auto\n hence \"l \\ c2\" by (metis max.cobounded2 anti_mono)\n thus ?case using IfFalse.IH by metis\nnext\n case WhileFalse thus ?case by auto\nnext\n case (WhileTrue b s1 c)\n hence \"l \\ c\" by auto\n thus ?case using WhileTrue by metis\nqed\n\nlemma termi_if_non0: \"l \\ c \\ l \\ 0 \\ \\ t. (c,s) \\ t\"\napply(induction arbitrary: s rule: sec_type.induct)\napply (metis big_step.Skip)\napply (metis big_step.Assign)\napply (metis big_step.Seq)\napply (metis IfFalse IfTrue le0 le_antisym max.cobounded2)\napply simp\ndone\n\ntheorem noninterference: \"(c,s) \\ s' \\ 0 \\ c \\ s = t (\\ l)\n \\ \\ t'. (c,t) \\ t' \\ s' = t' (\\ l)\"\nproof(induction arbitrary: t rule: big_step_induct)\n case Skip thus ?case by auto\nnext\n case (Assign x a s)\n have \"sec x >= sec a\" using \\0 \\ x ::= a\\ by auto\n have \"(x ::= a,t) \\ t(x := aval a t)\" by auto\n moreover\n have \"s(x := aval a s) = t(x := aval a t) (\\ l)\"\n proof auto\n assume \"sec x \\ l\"\n with \\sec x \\ sec a\\ have \"sec a \\ l\" by arith\n thus \"aval a s = aval a t\"\n by (rule aval_eq_if_eq_le[OF \\s = t (\\ l)\\])\n next\n fix y assume \"y \\ x\" \"sec y \\ l\"\n thus \"s y = t y\" using \\s = t (\\ l)\\ by simp\n qed\n ultimately show ?case by blast\nnext\n case Seq thus ?case by blast\nnext\n case (IfTrue b s c1 s' c2)\n have \"sec b \\ c1\" \"sec b \\ c2\" using \\0 \\ IF b THEN c1 ELSE c2\\ by auto\n obtain t' where t': \"(c1, t) \\ t'\" \"s' = t' (\\ l)\"\n using IfTrue.IH[OF anti_mono[OF \\sec b \\ c1\\] \\s = t (\\ l)\\] by blast\n show ?case\n proof cases\n assume \"sec b \\ l\"\n hence \"s = t (\\ sec b)\" using \\s = t (\\ l)\\ by auto\n hence \"bval b t\" using \\bval b s\\ by(simp add: bval_eq_if_eq_le)\n thus ?thesis by (metis t' big_step.IfTrue)\n next\n assume \"\\ sec b \\ l\"\n hence 0: \"sec b \\ 0\" by arith\n have 1: \"sec b \\ IF b THEN c1 ELSE c2\"\n by(rule sec_type.intros)(simp_all add: \\sec b \\ c1\\ \\sec b \\ c2\\)\n from confinement[OF big_step.IfTrue[OF IfTrue(1,2)] 1] \\\\ sec b \\ l\\\n have \"s = s' (\\ l)\" by auto\n moreover\n from termi_if_non0[OF 1 0, of t] obtain t' where\n t': \"(IF b THEN c1 ELSE c2,t) \\ t'\" ..\n moreover\n from confinement[OF t' 1] \\\\ sec b \\ l\\\n have \"t = t' (\\ l)\" by auto\n ultimately\n show ?case using \\s = t (\\ l)\\ by auto\n qed\nnext\n case (IfFalse b s c2 s' c1)\n have \"sec b \\ c1\" \"sec b \\ c2\" using \\0 \\ IF b THEN c1 ELSE c2\\ by auto\n obtain t' where t': \"(c2, t) \\ t'\" \"s' = t' (\\ l)\"\n using IfFalse.IH[OF anti_mono[OF \\sec b \\ c2\\] \\s = t (\\ l)\\] by blast\n show ?case\n proof cases\n assume \"sec b \\ l\"\n hence \"s = t (\\ sec b)\" using \\s = t (\\ l)\\ by auto\n hence \"\\ bval b t\" using \\\\ bval b s\\ by(simp add: bval_eq_if_eq_le)\n thus ?thesis by (metis t' big_step.IfFalse)\n next\n assume \"\\ sec b \\ l\"\n hence 0: \"sec b \\ 0\" by arith\n have 1: \"sec b \\ IF b THEN c1 ELSE c2\"\n by(rule sec_type.intros)(simp_all add: \\sec b \\ c1\\ \\sec b \\ c2\\)\n from confinement[OF big_step.IfFalse[OF IfFalse(1,2)] 1] \\\\ sec b \\ l\\\n have \"s = s' (\\ l)\" by auto\n moreover\n from termi_if_non0[OF 1 0, of t] obtain t' where\n t': \"(IF b THEN c1 ELSE c2,t) \\ t'\" ..\n moreover\n from confinement[OF t' 1] \\\\ sec b \\ l\\\n have \"t = t' (\\ l)\" by auto\n ultimately\n show ?case using \\s = t (\\ l)\\ by auto\n qed\nnext\n case (WhileFalse b s c)\n hence [simp]: \"sec b = 0\" by auto\n have \"s = t (\\ sec b)\" using \\s = t (\\ l)\\ by auto\n hence \"\\ bval b t\" using \\\\ bval b s\\ by (metis bval_eq_if_eq_le le_refl)\n with WhileFalse.prems(2) show ?case by auto\nnext\n case (WhileTrue b s c s'' s')\n let ?w = \"WHILE b DO c\"\n from \\0 \\ ?w\\ have [simp]: \"sec b = 0\" by auto\n have \"0 \\ c\" using \\0 \\ WHILE b DO c\\ by auto\n from WhileTrue.IH(1)[OF this \\s = t (\\ l)\\]\n obtain t'' where \"(c,t) \\ t''\" and \"s'' = t'' (\\l)\" by blast\n from WhileTrue.IH(2)[OF \\0 \\ ?w\\ this(2)]\n obtain t' where \"(?w,t'') \\ t'\" and \"s' = t' (\\l)\" by blast\n from \\bval b s\\ have \"bval b t\"\n using bval_eq_if_eq_le[OF \\s = t (\\l)\\] by auto\n show ?case\n using big_step.WhileTrue[OF \\bval b t\\ \\(c,t) \\ t''\\ \\(?w,t'') \\ t'\\]\n by (metis \\s' = t' (\\ l)\\)\nqed\n\nsubsubsection \"The Standard System\"\n\ntext\\The predicate \\<^prop>\\l \\ c\\ is nicely intuitive and executable. The\nstandard formulation, however, is slightly different, replacing the maximum\ncomputation by an antimonotonicity rule. We introduce the standard system now\nand show the equivalence with our formulation.\\\n\ninductive sec_type' :: \"nat \\ com \\ bool\" (\"(_/ \\'' _)\" [0,0] 50) where\nSkip':\n \"l \\' SKIP\" |\nAssign':\n \"\\ sec x \\ sec a; sec x \\ l \\ \\ l \\' x ::= a\" |\nSeq':\n \"l \\' c\\<^sub>1 \\ l \\' c\\<^sub>2 \\ l \\' c\\<^sub>1;;c\\<^sub>2\" |\nIf':\n \"\\ sec b \\ l; l \\' c\\<^sub>1; l \\' c\\<^sub>2 \\ \\ l \\' IF b THEN c\\<^sub>1 ELSE c\\<^sub>2\" |\nWhile':\n \"\\ sec b = 0; 0 \\' c \\ \\ 0 \\' WHILE b DO c\" |\nanti_mono':\n \"\\ l \\' c; l' \\ l \\ \\ l' \\' c\"\n\nlemma sec_type_sec_type': \n \"l \\ c \\ l \\' c\"\napply(induction rule: sec_type.induct)\napply (metis Skip')\napply (metis Assign')\napply (metis Seq')\napply (metis max.commute max.absorb_iff2 nat_le_linear If' anti_mono')\nby (metis While')\n\n\nlemma sec_type'_sec_type:\n \"l \\' c \\ l \\ c\"\napply(induction rule: sec_type'.induct)\napply (metis Skip)\napply (metis Assign)\napply (metis Seq)\napply (metis max.absorb2 If)\napply (metis While)\nby (metis anti_mono)\n\ncorollary sec_type_eq: \"l \\ c \\ l \\' c\"\nby (metis sec_type'_sec_type sec_type_sec_type')\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/IMP/Sec_TypingT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525098, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.26002653512844826}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: AlternativeSmallStep.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Alternative Small Step Semantics *}\n\ntheory AlternativeSmallStep imports HoareTotalDef\nbegin\n\n\ntext {* \nThis is the small-step semantics, which is described and used in my PhD-thesis \\cite{Schirmer-PhD}. \nIt decomposes the statement into a list of statements and finally executes the head.\nSo the redex is always the head of the list. The equivalence between termination\n(based on the big-step semantics) and the absence of infinite computations in\nthis small-step semantics follows the same lines of reasoning as for\nthe new small-step semantics. However, it is technically more involved since\nthe configurations are more complicated. Thats why I switched to the new small-step\nsemantics in the \"main trunk\". I keep this alternative version and the important\nproofs in this theory, so that one can compare both approaches.\n*}\n\n\nsubsection {*Small-Step Computation: @{text \"\\\\(cs, css, s) \\ (cs', css', s')\"}*}\n\ntype_synonym ('s,'p,'f) continuation = \"('s,'p,'f) com list \\ ('s,'p,'f) com list\"\n \ntype_synonym ('s,'p,'f) config =\n \"('s,'p,'f)com list \\ ('s,'p,'f)continuation list \\ ('s,'f) xstate\"\n\n\n\ninductive \"step\"::\"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\/ _)\" [81,81,81] 100)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\\\(Skip#cs,css,Normal s) \\ (cs,css,Normal s)\"\n| Guard: \"s\\g \\ \\\\(Guard f g c#cs,css,Normal s) \\ (c#cs,css,Normal s)\"\n \n| GuardFault: \"s\\g \\ \\\\(Guard f g c#cs,css,Normal s) \\ (cs,css,Fault f)\"\n\n| FaultProp: \"\\\\(c#cs,css,Fault f) \\ (cs,css,Fault f)\" \n| FaultPropBlock: \"\\\\([],(nrms,abrs)#css,Fault f) \\ (nrms,css,Fault f)\"\n (* FaultPropBlock: \"\\\\([],cs#css,Fault) \\ ([],css,Fault)\"*)\n \n| AbruptProp: \"\\\\(c#cs,css,Abrupt s) \\ (cs,css,Abrupt s)\"\n \n| ExitBlockNormal: \n \"\\\\([],(nrms,abrs)#css,Normal s) \\ (nrms,css,Normal s)\"\n| ExitBlockAbrupt: \n \"\\\\([],(nrms,abrs)#css,Abrupt s) \\ (abrs,css,Normal s)\"\n\n| Basic: \"\\\\(Basic f#cs,css,Normal s) \\ (cs,css,Normal (f s))\"\n\n| Spec: \"(s,t) \\ r \\ \\\\(Spec r#cs,css,Normal s) \\ (cs,css,Normal t)\"\n| SpecStuck: \"\\t. (s,t) \\ r \\ \\\\(Spec r#cs,css,Normal s) \\ (cs,css,Stuck)\"\n\n| Seq: \"\\\\(Seq c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>1#c\\<^sub>2#cs,css,Normal s)\"\n\n| CondTrue: \"s\\b \\ \\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>1#cs,css,Normal s)\"\n| CondFalse: \"s\\b \\ \\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ (c\\<^sub>2#cs,css,Normal s)\"\n\n| WhileTrue: \"\\s\\b\\ \n \\ \n \\\\(While b c#cs,css,Normal s) \\ (c#While b c#cs,css,Normal s)\"\n| WhileFalse: \"\\s\\b\\ \n \\ \n \\\\(While b c#cs,css,Normal s) \\ (cs,css,Normal s)\"\n\n| Call: \"\\ p=Some bdy \\\n \\\\(Call p#cs,css,Normal s) \\ ([bdy],(cs,Throw#cs)#css,Normal s)\"\n\n| CallUndefined: \"\\ p=None \\\n \\\\(Call p#cs,css,Normal s) \\ (cs,css,Stuck)\"\n\n| StuckProp: \"\\\\(c#cs,css,Stuck) \\ (cs,css,Stuck)\" \n| StuckPropBlock: \"\\\\([],(nrms,abrs)#css,Stuck) \\ (nrms,css,Stuck)\"\n\n| DynCom: \"\\\\(DynCom c#cs,css,Normal s) \\ (c s#cs,css,Normal s)\"\n\n| Throw: \"\\\\(Throw#cs,css,Normal s) \\ (cs,css,Abrupt s)\"\n| Catch: \"\\\\(Catch c\\<^sub>1 c\\<^sub>2#cs,css,Normal s) \\ ([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s)\"\n\nlemmas step_induct = step.induct [of _ \"(c,css,s)\" \"(c',css',s')\", split_format (complete), \ncase_names\nSkip Guard GuardFault FaultProp FaultPropBlock AbruptProp ExitBlockNormal ExitBlockAbrupt\nBasic Spec SpecStuck Seq CondTrue CondFalse WhileTrue WhileFalse Call CallUndefined\nStuckProp StuckPropBlock DynCom Throw Catch, induct set]\n\ninductive_cases step_elim_cases [cases set]:\n \"\\\\(c#cs,css,Fault f) \\ u\"\n \"\\\\([],css,Fault f) \\ u\"\n \"\\\\(c#cs,css,Stuck) \\ u\"\n \"\\\\([],css,Stuck) \\ u\"\n \"\\\\(c#cs,css,Abrupt s) \\ u\"\n \"\\\\([],css,Abrupt s) \\ u\"\n \"\\\\([],css,Normal s) \\ u\"\n \"\\\\(Skip#cs,css,s) \\ u\"\n \"\\\\(Guard f g c#cs,css,s) \\ u\"\n \"\\\\(Basic f#cs,css,s) \\ u\"\n \"\\\\(Spec r#cs,css,s) \\ u\"\n \"\\\\(Seq c1 c2#cs,css,s) \\ u\"\n \"\\\\(Cond b c1 c2#cs,css,s) \\ u\"\n \"\\\\(While b c#cs,css,s) \\ u\"\n \"\\\\(Call p#cs,css,s) \\ u\"\n \"\\\\(DynCom c#cs,css,s) \\ u\"\n \"\\\\(Throw#cs,css,s) \\ u\"\n \"\\\\(Catch c1 c2#cs,css,s) \\ u\"\n\ninductive_cases step_Normal_elim_cases [cases set]:\n \"\\\\(c#cs,css,Fault f) \\ u\"\n \"\\\\([],css,Fault f) \\ u\"\n \"\\\\(c#cs,css,Stuck) \\ u\"\n \"\\\\([],css,Stuck) \\ u\"\n \"\\\\([],(nrms,abrs)#css,Normal s) \\ u\"\n \"\\\\([],(nrms,abrs)#css,Abrupt s) \\ u\"\n \"\\\\(Skip#cs,css,Normal s) \\ u\"\n \"\\\\(Guard f g c#cs,css,Normal s) \\ u\"\n \"\\\\(Basic f#cs,css,Normal s) \\ u\"\n \"\\\\(Spec r#cs,css,Normal s) \\ u\"\n \"\\\\(Seq c1 c2#cs,css,Normal s) \\ u\"\n \"\\\\(Cond b c1 c2#cs,css,Normal s) \\ u\"\n \"\\\\(While b c#cs,css,Normal s) \\ u\"\n \"\\\\(Call p#cs,css,Normal s) \\ u\"\n \"\\\\(DynCom c#cs,css,Normal s) \\ u\"\n \"\\\\(Throw#cs,css,Normal s) \\ u\"\n \"\\\\(Catch c1 c2#cs,css,Normal s) \\ u\"\n\nabbreviation\n \"step_rtrancl\" :: \"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where\n \"\\\\cs0 \\\\<^sup>* cs1 == (step \\)\\<^sup>*\\<^sup>* cs0 cs1\"\n\nabbreviation\n\n \"step_trancl\" :: \"[('s,'p,'f) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\ (_ \\\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\cs0 \\\\<^sup>+ cs1 == (step \\)\\<^sup>+\\<^sup>+ cs0 cs1\"\n\n\nsubsubsection {* Structural Properties of Small Step Computations *}\n\nlemma Fault_app_steps: \"\\\\(cs@xs,css,Fault f) \\\\<^sup>* (xs,css,Fault f)\"\nproof (induct cs)\n case Nil thus ?case by simp\nnext\n case (Cons c cs)\n have \"\\\\(c#cs@xs, css, Fault f) \\\\<^sup>* (xs, css, Fault f)\"\n proof -\n have \"\\\\(c#cs@xs, css, Fault f) \\ (cs@xs, css, Fault f)\"\n by (rule step.FaultProp)\n also \n have \"\\\\(cs@xs, css, Fault f) \\\\<^sup>* (xs, css, Fault f)\"\n by (rule Cons.hyps)\n finally show ?thesis .\n qed\n thus ?case\n by simp\nqed\n\nlemma Stuck_app_steps: \"\\\\(cs@xs,css,Stuck) \\\\<^sup>* (xs,css,Stuck)\"\nproof (induct cs)\n case Nil thus ?case by simp\nnext\n case (Cons c cs)\n have \"\\\\(c#cs@xs, css, Stuck) \\\\<^sup>* (xs, css, Stuck)\"\n proof -\n have \"\\\\(c#cs@xs, css, Stuck) \\ (cs@xs, css, Stuck)\"\n by (rule step.StuckProp)\n also \n have \"\\\\(cs@xs, css, Stuck) \\\\<^sup>* (xs, css, Stuck)\"\n by (rule Cons.hyps)\n finally show ?thesis .\n qed\n thus ?case\n by simp\nqed\n\ntext {* We can only append commands inside a block, if execution does not\n enter or exit a block.\n *}\nlemma app_step: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\"\n shows \"css=css' \\ \\\\(cs@xs,css,s) \\ (cs'@xs,css',t)\"\nusing step\napply induct\napply (simp_all del: fun_upd_apply,(blast intro: step.intros)+)\ndone\n\ntext {* We can append whole blocks, without interfering with the actual\n block. Outer blocks do not influence execution of\n inner blocks. *}\nlemma app_css_step: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\"\n shows \"\\\\(cs,css@xs,s) \\ (cs',css'@xs,t)\"\nusing step\napply induct\napply (simp_all del: fun_upd_apply,(blast intro: step.intros)+)\ndone\n\nML {*\n ML_Thms.bind_thm (\"trancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(ax, ay, az)\"),\n (((\"b\", 0), Position.none), \"(bx, by, bz)\")] []\n @{thm tranclp_induct}));\n*}\n\nlemma app_css_steps: \n assumes step: \"\\\\(cs,css,s) \\\\<^sup>+ (cs',css',t)\"\n shows \"\\\\(cs,css@xs,s) \\\\<^sup>+ (cs',css'@xs,t)\"\napply(rule trancl_induct3 [OF step])\n apply (rule app_css_step [THEN tranclp.r_into_trancl [of \"step \\\"]],assumption)\napply(blast intro:app_css_step tranclp_trans)\ndone\n\nlemma step_Cons': \n assumes step: \"\\\\(ccs,css,s) \\ (cs',css',t)\"\n shows\n \"\\c cs. ccs=c#cs \\ \\css''. css'=css''@css \\\n (if css''=[] then \\p. cs'=p@cs\n else (\\pnorm pabr. css''=[(pnorm@cs,pabr@cs)]))\"\nusing step\nby induct force+\n\nlemma step_Cons: \n assumes step: \"\\\\(c#cs,css,s) \\ (cs',css',t)\"\n shows \"\\pcss. css'=pcss@css \\\n (if pcss=[] then \\ps. cs'=ps@cs\n else (\\pcs_normal pcs_abrupt. pcss=[(pcs_normal@cs,pcs_abrupt@cs)]))\"\nusing step_Cons' [OF step]\nby blast \n\n\nlemma step_Nil': \n assumes step: \"\\\\(cs,asscss,s) \\ (cs',css',t)\"\n shows\n \"\\ass. \\cs=[]; asscss=ass@css; ass\\Nil\\ \\ \n css'=tl ass@css \\\n (case s of \n Abrupt s' \\ cs'=snd (hd ass) \\ t=Normal s'\n | _ \\ cs'=fst (hd ass) \\ t=s)\"\nusing step\nby (induct) (fastforce simp add: neq_Nil_conv)+\n\nlemma step_Nil: \n assumes step: \"\\\\([],ass@css,s) \\ (cs',css',t)\"\n assumes ass_not_Nil: \"ass\\[]\"\n shows \"css'=tl ass@css \\\n (case s of \n Abrupt s' \\ cs'=snd (hd ass) \\ t=Normal s'\n | _ \\ cs'=fst (hd ass) \\ t=s)\"\n using step_Nil' [OF step _ _ ass_not_Nil]\n by simp\n\nlemma step_Nil'': \n assumes step: \"\\\\([],(pcs_normal,pcs_abrupt)#pcss@css,s) \\ (cs',pcss@css,t)\"\n shows \"(case s of \n Abrupt s' \\ cs'=pcs_abrupt \\ t=Normal s'\n | _ \\ cs'=pcs_normal \\ t=s)\"\n using step_Nil' [OF step, where ass =\"(pcs_normal,pcs_abrupt)#pcss\" and css=\"css\"]\n by (auto split: xstate.splits)\n\nlemma drop_suffix_css_step':\nassumes step: \"\\\\(cs,cssxs,s) \\ (cs',css'xs,t)\"\nshows \"\\css css' xs. \\cssxs = css@xs; css'xs=css'@xs\\ \n \\ \\\\(cs,css,s) \\ (cs',css',t)\"\nusing step\napply induct\napply (fastforce intro: step.intros)+\ndone\n\nlemma drop_suffix_css_step:\nassumes step: \"\\\\(cs,pcss@css,s) \\ (cs',pcss'@css,t)\"\nshows \"\\\\(cs,pcss,s) \\ (cs',pcss',t)\"\nusing step by (blast intro: drop_suffix_css_step')\n\nlemma drop_suffix_hd_css_step': \n assumes step: \"\\\\ (pcs,css,s) \\ (cs',css'css,t)\"\n shows \"\\p ps cs pnorm pabr. \\pcs=p#ps@cs; css'css=(pnorm@cs,pabr@cs)#css\\ \n \\ \\\\ (p#ps,css,s) \\ (cs',(pnorm,pabr)#css,t)\"\nusing step\nby induct (force intro: step.intros)+\n\nlemma drop_suffix_hd_css_step'': \n assumes step: \"\\\\ (p#ps@cs,css,s) \\ (cs',(pnorm@cs,pabr@cs)#css,t)\"\n shows \"\\\\ (p#ps,css,s) \\ (cs',(pnorm,pabr)#css,t)\"\nusing drop_suffix_hd_css_step' [OF step]\nby auto\n\nlemma drop_suffix_hd_css_step: \n assumes step: \"\\\\ (p#ps@cs,css,s) \\ (cs',[(pnorm@ps@cs,pabr@ps@cs)]@css,t)\"\n shows \"\\\\ (p#ps,css,s) \\ (cs',[(pnorm@ps,pabr@ps)]@css,t)\"\nproof -\n from step drop_suffix_hd_css_step'' [of _ p ps cs css s cs' \"pnorm@ps\" \"pabr@ps\" t]\n show ?thesis\n by auto\nqed\n\nlemma drop_suffix': \n assumes step: \"\\\\(csxs,css,s) \\ (cs'xs,css',t)\"\n shows \"\\xs cs cs'. \\css=css'; csxs=cs@xs; cs'xs = cs'@xs; cs\\[] \\ \n \\ \\\\(cs,css,s) \\ (cs',css,t)\"\nusing step\napply induct\napply (fastforce intro: step.intros simp add: neq_Nil_conv)+\ndone\n\nlemma drop_suffix: \n assumes step: \"\\\\(c#cs@xs,css,s) \\ (cs'@xs,css,t)\" \n shows \"\\\\(c#cs,css,s) \\ (cs',css,t)\"\n by(rule drop_suffix' [OF step _ _ _]) auto\n\nlemma drop_suffix_same_css_step: \n assumes step: \"\\\\(cs@xs,css,s) \\ (cs'@xs,css,t)\" \n assumes not_Nil: \"cs\\[]\"\n shows \"\\\\(cs,xss,s) \\ (cs',xss,t)\"\nproof-\n from drop_suffix' [OF step _ _ _ not_Nil]\n have \"\\\\(cs,css,s) \\ (cs',css,t)\"\n by auto\n with drop_suffix_css_step [of _ cs \"[]\" css s cs' \"[]\" t]\n have \"\\\\ (cs, [], s) \\ (cs', [], t)\"\n by auto\n from app_css_step [OF this]\n show ?thesis\n by auto\nqed\n \nlemma Cons_change_css_step:\n assumes step: \"\\\\ (cs,css,s) \\ (cs',css'@css,t)\"\n shows \"\\\\ (cs,xss,s) \\ (cs',css'@xss,t)\"\nproof -\n from step\n drop_suffix_css_step [where cs=cs and pcss=\"[]\" and css=css and s=s\n and cs'=cs' and pcss'=css' and t=t]\n have \"\\\\ (cs, [], s) \\ (cs', css', t)\"\n by auto\n from app_css_step [where xs=xss, OF this]\n show ?thesis\n by auto\nqed\n\nlemma Nil_change_css_step:\n assumes step: \"\\\\([],ass@css,s) \\ (cs',ass'@css,t)\"\n assumes ass_not_Nil: \"ass\\[]\"\n shows \"\\\\([],ass@xss,s) \\ (cs',ass'@xss,t)\"\nproof -\n from step drop_suffix_css_step [of _ \"[]\" ass css s cs' ass' t]\n have \"\\\\ ([], ass, s) \\ (cs', ass', t)\"\n by auto\n from app_css_step [where xs=xss, OF this]\n show ?thesis\n by auto\nqed\n\nsubsubsection {* Equivalence between Big and Small-Step Semantics *}\n \nlemma exec_impl_steps:\n assumes exec: \"\\\\\\c,s\\ \\ t\"\n shows \"\\cs css. \\\\(c#cs,css,s) \\\\<^sup>* (cs,css,t)\"\nusing exec\nproof (induct)\n case Skip thus ?case by (blast intro: step.Skip)\nnext\n case Guard thus ?case by (blast intro: step.Guard rtranclp_trans)\nnext\n case GuardFault thus ?case by (blast intro: step.GuardFault)\nnext\n case FaultProp thus ?case by (blast intro: step.FaultProp)\nnext\n case Basic thus ?case by (blast intro: step.Basic)\nnext\n case Spec thus ?case by (blast intro: step.Spec)\nnext\n case SpecStuck thus ?case by (blast intro: step.SpecStuck)\nnext\n case Seq thus ?case by (blast intro: step.Seq rtranclp_trans)\nnext\n case CondTrue thus ?case by (blast intro: step.CondTrue rtranclp_trans)\nnext\n case CondFalse thus ?case by (blast intro: step.CondFalse rtranclp_trans)\nnext\n case WhileTrue thus ?case by (blast intro: step.WhileTrue rtranclp_trans)\nnext\n case WhileFalse thus ?case by (blast intro: step.WhileFalse)\nnext\n case (Call p bdy s s' cs css)\n have bdy: \"\\ p = Some bdy\" by fact\n have steps_body: \"\\\\([bdy],(cs,Throw#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,Throw#cs)#css, s')\" by fact\n show ?case\n proof (cases s')\n case (Normal s'')\n note steps_body\n also from Normal have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n next\n case (Abrupt s'')\n with steps_body \n have \"\\\\([bdy],(cs,Throw#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,Throw#cs)#css, Abrupt s'')\" by simp\n also have \"\\\\([],(cs,Throw#cs)#css, Abrupt s'') \\ (Throw#cs,css,Normal s'')\"\n by (rule ExitBlockAbrupt)\n also have \"\\\\(Throw#cs,css,Normal s'') \\ (cs,css,Abrupt s'')\"\n by (rule Throw)\n finally show ?thesis\n using bdy Abrupt\n by (auto intro: step.Call rtranclp_trans)\n next\n case Fault\n note steps_body\n also from Fault have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n next\n case Stuck\n note steps_body\n also from Stuck have \"\\\\([],(cs,Throw#cs)#css, s') \\ (cs,css,s')\"\n by (auto intro: step.intros)\n finally show ?thesis\n using bdy\n by (blast intro: step.Call rtranclp_trans)\n qed\nnext\n case (CallUndefined p s cs css)\n have undef: \"\\ p = None\" by fact\n hence \"\\\\(Call p # cs, css, Normal s) \\ (cs, css, Stuck)\"\n by (rule step.CallUndefined)\n thus ?case ..\nnext\n case StuckProp thus ?case by (blast intro: step.StuckProp rtrancl_trans)\nnext\n case DynCom thus ?case by (blast intro: step.DynCom rtranclp_trans)\nnext\n case Throw thus ?case by (blast intro: step.Throw)\nnext\n case AbruptProp thus ?case by (blast intro: step.AbruptProp)\nnext\n case (CatchMatch c\\<^sub>1 s s' c\\<^sub>2 s'' cs css) \n have steps_c1: \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* \n ([],(cs,c\\<^sub>2#cs)#css,Abrupt s')\" by fact\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Abrupt s') \\ (c\\<^sub>2#cs,css,Normal s')\"\n by (rule ExitBlockAbrupt)\n also \n have steps_c2: \"\\\\(c\\<^sub>2#cs,css,Normal s') \\\\<^sup>* (cs,css,s'')\" by fact\n finally\n show \"\\\\(Catch c\\<^sub>1 c\\<^sub>2 # cs, css, Normal s) \\\\<^sup>* (cs, css, s'')\"\n by (blast intro: step.Catch rtranclp_trans)\nnext\n case (CatchMiss c\\<^sub>1 s s' c\\<^sub>2 cs css) \n assume notAbr: \"\\ isAbr s'\"\n have steps_c1: \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,s')\" by fact\n show \"\\\\(Catch c\\<^sub>1 c\\<^sub>2 # cs, css, Normal s) \\\\<^sup>* (cs, css, s')\"\n proof (cases s')\n case (Normal w)\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Normal w)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Normal w) \\ (cs,css,Normal w)\"\n by (rule ExitBlockNormal)\n finally show ?thesis using Normal\n by (auto intro: step.Catch rtranclp_trans)\n next\n case Abrupt with notAbr show ?thesis by simp\n next\n case (Fault f)\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Fault f)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Fault f) \\ (cs,css,Fault f)\"\n by (rule FaultPropBlock)\n finally show ?thesis using Fault\n by (auto intro: step.Catch rtranclp_trans)\n next\n case Stuck\n with steps_c1\n have \"\\\\([c\\<^sub>1],(cs,c\\<^sub>2#cs)#css,Normal s) \\\\<^sup>* ([],(cs,c\\<^sub>2#cs)#css,Stuck)\"\n by simp\n also\n have \"\\\\([],(cs,c\\<^sub>2#cs)#css,Stuck) \\ (cs,css,Stuck)\"\n by (rule StuckPropBlock)\n finally show ?thesis using Stuck\n by (auto intro: step.Catch rtranclp_trans)\n qed\nqed\n\n\ninductive \"execs\"::\"[('s,'p,'f) body,('s,'p,'f) com list,\n ('s,'p,'f) continuation list,\n ('s,'f) xstate,('s,'f) xstate] \\ bool\"\n (\"_\\ \\_,_,_\\ \\ _\" [50,50,50,50,50] 50)\n for \\:: \"('s,'p,'f) body\"\nwhere\n Nil: \"\\\\\\[],[],s\\ \\ s\"\n\n| ExitBlockNormal: \"\\\\\\nrms,css,Normal s\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Normal s\\ \\ t\"\n\n| ExitBlockAbrupt: \"\\\\\\abrs,css,Normal s\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Abrupt s\\ \\ t\"\n\n| ExitBlockFault: \"\\\\\\nrms,css,Fault f\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Fault f\\ \\ t\"\n\n| ExitBlockStuck: \"\\\\\\nrms,css,Stuck\\ \\ t\n \\\n \\\\\\[],(nrms,abrs)#css,Stuck\\ \\ t\"\n\n| Cons: \"\\\\\\\\c,s\\ \\ t; \\\\\\cs,css,t\\ \\ u\\ \n \\ \n \\\\\\c#cs,css,s\\ \\ u\"\n\n\ninductive_cases execs_elim_cases [cases set]:\n \"\\\\\\[],css,s\\ \\ t\"\n \"\\\\\\c#cs,css,s\\ \\ t\"\n\nML {*\n ML_Thms.bind_thm (\"converse_rtrancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(cs, css, s)\"),\n (((\"b\", 0), Position.none), \"(cs', css', t)\")] []\n @{thm converse_rtranclp_induct}));\n*}\n\nlemma execs_Fault_end: \n assumes execs: \"\\\\\\cs,css,s\\ \\ t\" shows \"s=Fault f\\ t=Fault f\"\n using execs\n by (induct) (auto dest: Fault_end)\n\nlemma execs_Stuck_end: \n assumes execs: \"\\\\\\cs,css,s\\ \\ t\" shows \"s=Stuck \\ t=Stuck\"\n using execs\n by (induct) (auto dest: Stuck_end)\n\n\ntheorem steps_impl_execs: \n assumes steps: \"\\\\(cs,css,s) \\\\<^sup>* ([],[],t)\" \n shows \"\\\\\\cs,css,s\\ \\ t\"\nusing steps\nproof (induct rule: converse_rtrancl_induct3 [consumes 1])\n show \"\\\\\\[],[],t\\ \\ t\" by (rule execs.Nil)\nnext\n fix cs css s cs' css' w\n assume step: \"\\\\(cs,css, s) \\ (cs',css', w)\" \n assume execs: \"\\\\\\cs',css',w\\ \\ t\"\n from step \n show \"\\\\\\cs,css,s\\ \\ t\"\n proof (cases)\n case (Catch c1 c2 cs s)\n with execs obtain t' where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ t'\" and\n execs_rest: \"\\\\\\[],(cs, c2 # cs) # css,t'\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n have \"\\\\\\Catch c1 c2 # cs,css,Normal s\\ \\ t\"\n proof (cases t')\n case (Normal t'')\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ t'\"\n by (auto intro: exec.CatchMiss)\n moreover\n from execs_rest Normal have \"\\\\\\cs,css,t'\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n next\n case (Abrupt t'')\n from execs_rest Abrupt have \"\\\\\\c2#cs,css,Normal t''\\ \\ t\"\n by (cases) auto\n then obtain v where\n exec_c2: \"\\\\\\c2,Normal t''\\ \\ v\" and\n rest: \"\\\\\\cs,css,v\\ \\ t\"\n by cases\n from exec_c1 Abrupt exec_c2\n have \"\\\\\\Catch c1 c2,Normal s\\ \\ v\"\n by - (rule exec.CatchMatch, auto)\n from this rest\n show ?thesis\n by (rule execs.Cons)\n next\n case (Fault f)\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ Fault f\"\n by (auto intro: exec.intros)\n moreover from execs_rest Fault have \"\\\\\\cs,css,Fault f\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n next\n case Stuck\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ Stuck\"\n by (auto intro: exec.intros)\n moreover from execs_rest Stuck have \"\\\\\\cs,css,Stuck\\ \\ t\"\n by (cases) auto\n ultimately show ?thesis\n by (rule execs.Cons)\n qed\n with Catch show ?thesis by simp\n next\n case (Call p bdy cs s)\n have bdy: \"\\ p = Some bdy\" by fact\n from Call execs obtain t' where\n exec_body: \"\\\\\\bdy,Normal s\\ \\ t'\" and\n execs_rest: \n \"\\\\\\[],(cs,Throw#cs)#css ,t'\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n have \"\\\\\\Call p # cs,css,Normal s\\ \\ t\"\n proof (cases t')\n case (Normal t'')\n with exec_body bdy\n have \"\\\\\\Call p ,Normal s\\ \\ Normal t''\" \n by (auto intro: exec.intros)\n moreover\n from execs_rest Normal\n have \"\\\\\\cs,css ,Normal t''\\ \\ t\" \n by cases auto\n ultimately show ?thesis by (rule execs.Cons)\n next\n case (Abrupt t'')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Abrupt t''\"\n by (auto intro: exec.intros)\n moreover\n from execs_rest Abrupt have \n \"\\\\\\Throw # cs,css,Normal t''\\ \\ t\"\n by (cases) auto\n then obtain v where \n \"\\\\\\Throw,Normal t''\\ \\ v\" and \n rest: \"\\\\\\cs,css,v\\ \\ t\"\n by (clarsimp elim!: execs_elim_cases)\n moreover from this have \"v=Abrupt t''\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately \n show ?thesis by (auto intro: execs.Cons)\n next\n case (Fault f)\n with exec_body bdy have \"\\\\\\Call p,Normal s\\ \\ Fault f\"\n by (auto intro: exec.intros)\n moreover from execs_rest Fault have \"\\\\\\cs,css,Fault f\\ \\ t\"\n by (cases) (auto elim: execs_elim_cases dest: Fault_end)\n ultimately \n show ?thesis by (rule execs.Cons)\n next\n case Stuck\n with exec_body bdy have \"\\\\\\Call p,Normal s\\ \\ Stuck\"\n by (auto intro: exec.intros)\n moreover from execs_rest Stuck have \"\\\\\\cs,css,Stuck\\ \\ t\"\n by (cases) (auto elim: execs_elim_cases dest: Stuck_end)\n ultimately \n show ?thesis by (rule execs.Cons)\n qed \n with Call show ?thesis by simp\n qed (insert execs,\n (blast intro:execs.intros exec.intros elim!: execs_elim_cases)+)\nqed\n\ntheorem steps_impl_exec: \n assumes steps: \"\\\\([c],[],s) \\\\<^sup>* ([],[],t)\" \n shows \"\\\\\\c,s\\ \\ t\"\nusing steps_impl_execs [OF steps]\nby (blast elim: execs_elim_cases)\n\ncorollary steps_eq_exec: \"\\\\([c],[],s) \\\\<^sup>* ([],[],t) = \\\\\\c,s\\ \\ t\"\n by (blast intro: steps_impl_exec exec_impl_steps)\n\n\nsubsection {* Infinite Computations: @{text \"inf \\ cs css s\"}*}\n\ndefinition inf :: \n \"[('s,'p,'f) body,('s,'p,'f) com list,('s,'p,'f) continuation list,('s,'f) xstate]\n \\ bool\"\nwhere \"inf \\ cs css s = (\\f. f 0 = (cs,css,s) \\ (\\i. \\\\f i \\ f(Suc i)))\"\n\nlemma not_infI: \"\\\\f. \\f 0 = (cs,css,s); \\i. \\\\f i \\ f (Suc i)\\ \\ False\\ \n \\ \\inf \\ cs css s\"\n by (auto simp add: inf_def)\n\nsubsection {* Equivalence of Termination and Absence of Infinite Computations *}\n\n\ninductive \"terminatess\":: \"[('s,'p,'f) body,('s,'p,'f) com list,\n ('s,'p,'f) continuation list,('s,'f) xstate] \\ bool\" \n (\"_\\_,_ \\ _\" [60,20,60] 89)\n for \\::\"('s,'p,'f) body\"\nwhere\n Nil: \"\\\\[],[]\\s\"\n\n| ExitBlockNormal: \"\\\\nrms,css\\Normal s\n \\ \n \\\\[],(nrms,abrs)#css\\Normal s\"\n\n| ExitBlockAbrupt: \"\\\\abrs,css\\Normal s\n \\ \n \\\\[],(nrms,abrs)#css\\Abrupt s\"\n\n| ExitBlockFault: \"\\\\nrms,css\\Fault f\n \\ \n \\\\[],(nrms,abrs)#css\\Fault f\"\n\n| ExitBlockStuck: \"\\\\nrms,css\\Stuck\n \\ \n \\\\[],(nrms,abrs)#css\\Stuck\"\n\n\n| Cons: \"\\\\\\c\\s; (\\t. \\\\\\c,s\\ \\ t \\ \\\\cs,css\\t)\\\n \\ \n \\\\c#cs,css\\s\"\n \ninductive_cases terminatess_elim_cases [cases set]:\n \"\\\\[],css\\t\"\n \"\\\\c#cs,css\\t\"\n\nlemma terminatess_Fault: \"\\cs. \\\\cs,css\\Fault f\"\nproof (induct css)\n case Nil\n show \"\\\\cs,[]\\Fault f\"\n proof (induct cs)\n case Nil show \"\\\\[],[]\\Fault f\" by (rule terminatess.Nil)\n next\n case (Cons c cs)\n thus ?case\n by (auto intro: terminatess.intros terminates.intros dest: Fault_end)\n qed\nnext\n case (Cons d css)\n have hyp: \"\\cs. \\\\cs,css\\Fault f\" by fact\n obtain nrms abrs where d: \"d=(nrms,abrs)\" by (cases d) auto\n have \"\\\\cs,(nrms,abrs)#css\\Fault f\"\n proof (induct cs)\n case Nil\n show \"\\\\[],(nrms, abrs) # css\\Fault f\"\n by (rule terminatess.ExitBlockFault) (rule hyp)\n next\n case (Cons c cs)\n have hyp1: \"\\\\cs,(nrms, abrs) # css\\Fault f\" by fact\n show \"\\\\c#cs,(nrms, abrs)#css\\Fault f\"\n by (auto intro: hyp1 terminatess.Cons terminates.intros dest: Fault_end)\n qed\n with d show ?case by simp\nqed\n\nlemma terminatess_Stuck: \"\\cs. \\\\cs,css\\Stuck\"\nproof (induct css)\n case Nil\n show \"\\\\cs,[]\\Stuck\"\n proof (induct cs)\n case Nil show \"\\\\[],[]\\Stuck\" by (rule terminatess.Nil)\n next\n case (Cons c cs)\n thus ?case\n by (auto intro: terminatess.intros terminates.intros dest: Stuck_end)\n qed\nnext\n case (Cons d css)\n have hyp: \"\\cs. \\\\cs,css\\Stuck\" by fact\n obtain nrms abrs where d: \"d=(nrms,abrs)\" by (cases d) auto\n have \"\\\\cs,(nrms,abrs)#css\\Stuck\"\n proof (induct cs)\n case Nil\n show \"\\\\[],(nrms, abrs) # css\\Stuck\"\n by (rule terminatess.ExitBlockStuck) (rule hyp)\n next\n case (Cons c cs)\n have hyp1: \"\\\\cs,(nrms, abrs) # css\\Stuck\" by fact\n show \"\\\\c#cs,(nrms, abrs)#css\\Stuck\"\n by (auto intro: hyp1 terminatess.Cons terminates.intros dest: Stuck_end)\n qed\n with d show ?case by simp\nqed\n\n\nlemma Basic_terminates: \"\\\\Basic f \\ t\"\n by (cases t) (auto intro: terminates.intros)\n\nlemma step_preserves_terminations: \n assumes step: \"\\\\(cs,css,s) \\ (cs',css',t)\" \n shows \"\\\\cs,css\\s \\ \\\\cs',css'\\t\"\nusing step\nproof (induct)\n case Skip thus ?case\n by (auto elim: terminates_Normal_elim_cases terminatess_elim_cases\n intro: exec.intros)\nnext\n case Guard thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case GuardFault thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case FaultProp show ?case by (rule terminatess_Fault)\nnext\n case FaultPropBlock show ?case by (rule terminatess_Fault)\nnext\n case AbruptProp thus ?case\n by (blast elim: terminatess_elim_cases \n intro: terminatess.intros)\nnext\n case ExitBlockNormal thus ?case\n by (blast elim: terminatess_elim_cases\n intro: terminatess.intros )\nnext\n case ExitBlockAbrupt thus ?case\n by (blast elim: terminatess_elim_cases\n intro: terminatess.intros )\nnext\n case Basic thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Spec thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case SpecStuck thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Seq thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case CondTrue thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case CondFalse thus ?case \n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case WhileTrue thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case WhileFalse thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case (Call p bdy cs css s)\n have bdy: \"\\ p = Some bdy\" by fact\n from Call obtain \n term_body: \"\\\\bdy \\ Normal s\" and\n term_rest: \"\\t. \\\\\\Call p,Normal s\\ \\ t \\ \\\\cs,css\\t\"\n by (fastforce elim!: terminatess_elim_cases terminates_Normal_elim_cases)\n show \"\\\\[bdy],(cs,Throw # cs)#css\\Normal s\"\n proof (rule terminatess.Cons [OF term_body],clarsimp)\n fix t\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n show \"\\\\[],(cs,Throw # cs) # css\\t\"\n proof (cases t)\n case (Normal t')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Normal t'\"\n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\Normal t'\"\n by iprover\n with Normal show ?thesis\n by (auto intro: terminatess.intros terminates.intros\n elim: exec_Normal_elim_cases)\n next\n case (Abrupt t')\n with exec_body bdy\n have \"\\\\\\Call p,Normal s\\ \\ Abrupt t'\"\n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\Abrupt t'\"\n by iprover\n with Abrupt show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: exec_Normal_elim_cases)\n next\n case Fault\n thus ?thesis\n by (iprover intro: terminatess_Fault)\n next\n case Stuck\n thus ?thesis\n by (iprover intro: terminatess_Stuck)\n qed\n qed\nnext\n case CallUndefined thus ?case\n by (iprover intro: terminatess_Stuck)\nnext\n case StuckProp show ?case by (rule terminatess_Stuck)\nnext\n case StuckPropBlock show ?case by (rule terminatess_Stuck)\nnext\n case DynCom thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case Throw thus ?case\n by (blast elim: terminatess_elim_cases terminates_Normal_elim_cases\n intro: terminatess.intros terminates.intros exec.intros)\nnext\n case (Catch c1 c2 cs css s) \n then obtain \n term_c1: \"\\\\c1 \\ Normal s\" and\n term_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ Abrupt s' \\ \\\\c2 \\ Normal s'\"and\n term_rest: \"\\t. \\\\\\Catch c1 c2,Normal s\\ \\ t \\ \\\\cs,css\\t\"\n by (clarsimp elim!: terminatess_elim_cases terminates_Normal_elim_cases)\n show \"\\\\[c1],(cs, c2 # cs) # css\\Normal s\"\n proof (rule terminatess.Cons [OF term_c1],clarsimp)\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s\\ \\ t\" \n show \"\\\\[],(cs, c2 # cs) # css\\t\"\n proof (cases t)\n case (Normal t')\n with exec_c1 have \"\\\\\\Catch c1 c2,Normal s\\ \\ t\" \n by (auto intro: exec.intros)\n with term_rest have \"\\\\cs,css\\t\"\n by iprover\n with Normal show ?thesis\n by (iprover intro: terminatess.intros)\n next\n case (Abrupt t')\n with exec_c1 term_c2 have \"\\\\c2 \\ Normal t'\"\n by auto\n moreover\n {\n fix w\n assume exec_c2: \"\\\\\\c2,Normal t'\\ \\ w\" \n have \"\\\\cs,css\\w\" \n proof -\n from exec_c1 Abrupt exec_c2\n have \"\\\\\\Catch c1 c2,Normal s\\ \\ w\"\n by (auto intro: exec.intros)\n with term_rest show ?thesis by simp\n qed\n }\n ultimately\n show ?thesis using Abrupt\n by (auto intro: terminatess.intros)\n next\n case Fault thus ?thesis\n by (iprover intro: terminatess_Fault)\n next\n case Stuck thus ?thesis\n by (iprover intro: terminatess_Stuck)\n qed\n qed\nqed\n\n\nML {*\n ML_Thms.bind_thm (\"rtrancl_induct3\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(ax, ay, az)\"),\n (((\"b\", 0), Position.none), \"(bx, by, bz)\")] []\n @{thm rtranclp_induct}));\n*}\n\nlemma steps_preserves_terminations: \n assumes steps: \"\\\\(cs,css,s) \\\\<^sup>* (cs',css',t)\" \n shows \"\\\\cs,css\\s \\ \\\\cs',css'\\t\"\nusing steps\nproof (induct rule: rtrancl_induct3 [consumes 1])\n assume \"\\\\cs,css\\s\" then show \"\\\\cs,css\\s\". \nnext\n fix cs'' css'' w cs' css' t\n assume \"\\\\(cs'',css'', w) \\ (cs',css', t)\" \"\\\\cs,css\\s \\ \\\\cs'',css''\\w\"\n \"\\\\cs,css\\s\"\n then show \"\\\\cs',css'\\t\"\n by (blast dest: step_preserves_terminations)\nqed\n\ntheorem steps_preserves_termination: \n assumes steps: \"\\\\([c],[],s) \\\\<^sup>* (c'#cs',css',t)\" \n assumes term_c: \"\\\\c\\s\" \n shows \"\\\\c'\\t\"\nproof -\n from term_c have \"\\\\[c],[]\\s\"\n by (auto intro: terminatess.intros)\n from steps this\n have \"\\\\c'#cs',css'\\t\"\n by (rule steps_preserves_terminations)\n thus \"\\\\c'\\t\"\n by (auto elim: terminatess_elim_cases)\nqed\n\n\n\n\n\nlemma renumber':\n assumes f: \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r\" \n assumes a_b: \"(a,b) \\ r\\<^sup>*\" \n shows \"b = f 0 \\ (\\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r))\"\nusing a_b\nproof (induct rule: converse_rtrancl_induct [consumes 1])\n assume \"b = f 0\"\n with f show \"\\f. f 0 = b \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by blast\nnext\n fix a z\n assume a_z: \"(a, z) \\ r\" and \"(z, b) \\ r\\<^sup>*\" \n assume \"b = f 0 \\ \\f. f 0 = z \\ (\\i. (f i, f (Suc i)) \\ r)\"\n \"b = f 0\"\n then obtain f where f0: \"f 0 = z\" and seq: \"\\i. (f i, f (Suc i)) \\ r\"\n by iprover\n {\n fix i have \"((\\i. case i of 0 \\ a | Suc i \\ f i) i, f i) \\ r\"\n using seq a_z f0\n by (cases i) auto\n }\n then\n show \"\\f. f 0 = a \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by - (rule exI [where x=\"\\i. case i of 0 \\ a | Suc i \\ f i\"],simp)\nqed\n\nlemma renumber:\n \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r \n \\ \\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r)\"\n by(blast dest:renumber')\n\nlemma not_inf_Fault': \n assumes enum_step: \"\\i. \\\\f i \\ f (Suc i)\"\n shows \"\\k cs. f k = (cs,css,Fault m) \\ False\"\nproof (induct css)\n case Nil\n have f_k: \"f k = (cs,[],Fault m)\" by fact\n have \"\\k. f k = (cs,[],Fault m) \\ False\"\n proof (induct cs)\n case Nil \n have \"f k = ([], [], Fault m)\" by fact\n moreover\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n ultimately show \"False\"\n by (fastforce elim: step_elim_cases)\n next\n case (Cons c cs)\n have fk: \"f k = (c # cs, [], Fault m)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,[],Fault m)\"\n by (fastforce elim: step_elim_cases)\n with enum_step Cons.hyps\n show False\n by blast\n qed\n from this f_k show False by blast\nnext\n case (Cons ds css)\n then obtain nrms abrs where ds: \"ds=(nrms,abrs)\" by (cases ds) auto\n have hyp: \"\\k cs. f k = (cs,css,Fault m) \\ False\" by fact\n have \"\\k. f k = (cs,(nrms,abrs)#css,Fault m) \\ False\"\n proof (induct cs)\n case Nil\n have fk: \"f k = ([], (nrms, abrs) # css, Fault m)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (nrms,css,Fault m)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp)\n next\n case (Cons c cs)\n have fk: \"f k = (c#cs, (nrms, abrs) # css, Fault m)\" by fact\n have hyp1: \"\\k. f k = (cs, (nrms, abrs) # css, Fault m) \\ False\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,(nrms,abrs)#css,Fault m)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp1)\n qed\n with ds Cons.prems show False by auto\nqed\n\nlemma not_inf_Fault:\n \"\\ inf \\ cs css (Fault m)\"\napply (rule not_infI)\napply (rule_tac f=f in not_inf_Fault' )\nby auto\n\nlemma not_inf_Stuck': \n assumes enum_step: \"\\i. \\\\f i \\ f (Suc i)\"\n shows \"\\k cs. f k = (cs,css,Stuck) \\ False\"\nproof (induct css)\n case Nil\n have f_k: \"f k = (cs,[],Stuck)\" by fact\n have \"\\k. f k = (cs,[],Stuck) \\ False\"\n proof (induct cs)\n case Nil \n have \"f k = ([], [], Stuck)\" by fact\n moreover\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n ultimately show \"False\"\n by (fastforce elim: step_elim_cases)\n next\n case (Cons c cs)\n have fk: \"f k = (c # cs, [], Stuck)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,[],Stuck)\"\n by (fastforce elim: step_elim_cases)\n with enum_step Cons.hyps\n show False\n by blast\n qed\n from this f_k show False .\nnext\n case (Cons ds css)\n then obtain nrms abrs where ds: \"ds=(nrms,abrs)\" by (cases ds) auto\n have hyp: \"\\k cs. f k = (cs,css,Stuck) \\ False\" by fact\n have \"\\k. f k = (cs,(nrms,abrs)#css,Stuck) \\ False\"\n proof (induct cs)\n case Nil\n have fk: \"f k = ([], (nrms, abrs) # css, Stuck)\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (nrms,css,Stuck)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp)\n next\n case (Cons c cs)\n have fk: \"f k = (c#cs, (nrms, abrs) # css, Stuck)\" by fact\n have hyp1: \"\\k. f k = (cs, (nrms, abrs) # css, Stuck) \\ False\" by fact\n from enum_step have \"\\\\f k \\ f (Suc k)\"..\n with fk have \"f (Suc k) = (cs,(nrms,abrs)#css,Stuck)\"\n by (fastforce elim: step_elim_cases)\n thus ?case\n by (rule hyp1)\n qed\n with ds Cons.prems show False by auto\nqed\n\nlemma not_inf_Stuck:\n \"\\ inf \\ cs css Stuck\"\napply (rule not_infI)\napply (rule_tac f=f in not_inf_Stuck')\nby auto\n\nlemma last_butlast_app: \nassumes butlast: \"butlast as = xs @ butlast bs\"\nassumes not_Nil: \"bs \\ []\" \"as \\ []\"\nassumes last: \"fst (last as) = fst (last bs)\" \"snd (last as) = snd (last bs)\"\nshows \"as = xs @ bs\"\nproof -\n from last have \"last as = last bs\"\n by (cases \"last as\",cases \"last bs\") simp\n moreover\n from not_Nil have \"as = butlast as @ [last as]\" \"bs = butlast bs @ [last bs]\"\n by auto\n ultimately show ?thesis\n using butlast\n by simp\nqed\n\n\nlemma last_butlast_tl:\nassumes butlast: \"butlast bs = x # butlast as\" \nassumes not_Nil: \"bs \\ []\" \"as \\ []\" \nassumes last: \"fst (last as) = fst (last bs)\" \"snd (last as) = snd (last bs)\"\nshows \"as = tl bs\"\nproof -\n from last have \"last as = last bs\"\n by (cases \"last as\",cases \"last bs\") simp\n moreover\n from not_Nil have \"as = butlast as @ [last as]\" \"bs = butlast bs @ [last bs]\"\n by auto\n ultimately show ?thesis\n using butlast\n by simp\nqed\n\nlocale inf =\nfixes CS:: \"('s,'p,'f) config \\ ('s, 'p,'f) com list\"\n and CSS:: \"('s,'p,'f) config \\ ('s, 'p,'f) continuation list\" \n and S:: \"('s,'p,'f) config \\ ('s,'f) xstate\" \n defines CS_def : \"CS \\ fst\"\n defines CSS_def : \"CSS \\ \\c. fst (snd c)\"\n defines S_def: \"S \\ \\c. snd (snd c)\"\n\nlemma (in inf) steps_hd_drop_suffix:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nassumes simul: \"\\i\\k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\ndefines \"p\\\\i. (pcs i, pcss i, S (f i))\"\nshows \"\\i\\ p i \\ p (Suc i)\"\nusing not_finished simul\nproof (induct k)\n case 0\n thus ?case by simp\nnext\n case (Suc k)\n have simul: \"\\i\\Suc k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\" by fact\n have not_finished': \"\\i < Suc k. \\ (CS (f i) = cs \\ CSS (f i) = css)\" by fact\n with simul \n have not_finished: \"\\i (pcs i = [] \\ pcss i = [])\"\n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n show ?case\n proof (clarify)\n fix i\n assume i_le_Suc_k: \"i < Suc k\"\n show \"\\\\ p i \\ p (Suc i)\"\n proof (cases \"i < k\")\n case True\n with not_finished' simul Suc.hyps\n show ?thesis\n by auto\n next\n case False\n with i_le_Suc_k\n have eq_i_k: \"i=k\"\n by simp\n show \"\\\\p i \\ p (Suc i)\"\n proof -\n obtain cs' css' t' where \n f_Suc_i: \"f (Suc i) = (cs', css', t')\"\n by (cases \"f (Suc i)\")\n obtain cs'' css'' t'' where \n f_i: \"f i = (cs'',css'',t'')\"\n by (cases \"f i\")\n from not_finished eq_i_k \n have pcs_pcss_not_Nil: \"\\ (pcs i = [] \\ pcss i = [])\"\n by auto\n from simul [rule_format, of i] i_le_Suc_k f_i\n have pcs_pcss_i:\n \"if pcss i = [] then css''=css \\ cs''=pcs i@cs \n else cs''=pcs i \\ \n css''= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css\"\n by (simp add: CS_def CSS_def S_def cong: if_cong)\n from simul [rule_format, of \"Suc i\"] i_le_Suc_k f_Suc_i \n have pcs_pcss_Suc_i: \n \"if pcss (Suc i) = [] then css' = css \\ cs' = pcs (Suc i) @ cs\n else cs' = pcs (Suc i) \\\n css' = butlast (pcss (Suc i)) @\n [(fst (last (pcss (Suc i))) @ cs, snd (last (pcss (Suc i))) @ cs)] @ \n css\"\n by (simp add: CS_def CSS_def S_def cong: if_cong)\n show ?thesis\n proof (cases \"pcss i = []\")\n case True\n note pcss_Nil = this\n with pcs_pcss_i pcs_pcss_not_Nil obtain p ps where\n pcs_i: \"pcs i = p#ps\" and\n css'': \"css''=css\" and \n cs'': \"cs''=(p#ps)@cs\"\n by (auto simp add: neq_Nil_conv)\n with f_i have \"f i = (p#(ps@cs),css,t'')\"\n by simp\n with f_Suc_i f_step [rule_format, of i]\n have step_css: \"\\\\ (p#(ps@cs),css,t'') \\ (cs',css',t')\"\n by simp\n from step_Cons' [OF this, of p \"ps@cs\"]\n obtain css''' where\n css''': \"css' = css''' @ css\" \n \"if css''' = [] then \\p. cs' = p @ ps @ cs\n else (\\pnorm pabr. css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)])\"\n by auto\n show ?thesis\n proof (cases \"css''' = []\")\n case True\n with css'''\n obtain p' where \n css': \"css' = css\" and\n cs': \"cs' = p' @ ps @ cs\"\n by auto\n (*from cs' css' f_Suc_i f_i [rule_format, of \"Suc k\"]\n have p_ps_not_Nil: \"p'@ps \\ Nil\"\n by auto*)\n from css' cs' step_css \n have step: \"\\\\ (p#(ps@cs),css,t'') \\ (p'@ps@cs,css,t')\"\n by simp\n hence \"\\\\ ((p#ps)@cs,css,t'') \\ ((p'@ps)@cs,css,t')\"\n by simp\n from drop_suffix_css_step' [OF drop_suffix_same_css_step [OF this], \n where xs=\"css\" and css=\"[]\" and css'=\"[]\"]\n have \"\\\\ (p#ps,[],t'') \\ (p'@ps,[],t')\"\n by simp \n moreover \n from css' cs' pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = p'@ps\" and \"pcss (Suc i) = []\"\n by (simp split: split_if_asm)\n ultimately show ?thesis\n using pcs_i pcss_Nil f_i f_Suc_i\n by (simp add: CS_def CSS_def S_def p_def)\n next\n case False\n with css'''\n obtain pnorm pabr where \n css': \"css'=css'''@css\"\n \"css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)]\"\n by auto\n with css''' step_css \n have \"\\\\ (p#ps@cs,css,t'') \\ (cs',[(pnorm@ps@cs,pabr@ps@cs)]@css,t')\"\n by simp\n then \n have \"\\\\(p#ps, css, t'') \\ (cs', [(pnorm@ps, pabr@ps)] @ css, t')\" \n by (rule drop_suffix_hd_css_step)\n from drop_suffix_css_step' [OF this,\n where css=\"[]\" and xs=\"css\" and css'=\"[(pnorm@ps, pabr@ps)]\"]\n have \"\\\\ (p#ps,[],t'') \\ (cs',[(pnorm@ps, pabr@ps)],t')\"\n by simp\n moreover\n from css' pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = [(pnorm@ps, pabr@ps)]\"\n apply (cases \"pcss (Suc i)\")\n apply (auto split: split_if_asm)\n done\n ultimately show ?thesis\n using pcs_i pcss_Nil f_i f_Suc_i \n by (simp add: p_def CS_def CSS_def S_def)\n qed\n next\n case False\n note pcss_i_not_Nil = this\n with pcs_pcss_i obtain\n cs'': \"cs''=pcs i\" and \n css'': \"css''= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css\"\n by auto\n from f_Suc_i f_i f_step [rule_format, of i]\n have step_i_full: \"\\\\ (cs'',css'',t'') \\ (cs',css',t')\"\n by simp\n show ?thesis\n proof (cases cs'')\n case (Cons c' cs)\n with step_Cons' [OF step_i_full]\n obtain css''' where css': \"css' = css'''@css''\"\n by auto\n with step_i_full \n have \"\\\\ (cs'',css'',t'') \\ (cs',css'''@css'',t')\"\n by simp\n from Cons_change_css_step [OF this, where xss=\"pcss i\"] Cons cs''\n have \"\\\\ (pcs i, pcss i,t'') \\ (cs',css'''@pcss i,t')\"\n by simp\n moreover\n from cs'' css'' css' False pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = css'''@pcss i\"\n apply (auto split: split_if_asm)\n apply (drule (4) last_butlast_app)\n by simp\n ultimately show ?thesis\n using f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n next\n case Nil\n note cs''_Nil = this\n show ?thesis\n proof (cases \"butlast (pcss i)\")\n case (Cons bpcs bpcss)\n with cs''_Nil step_i_full css''\n have \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',css',t')\"\n by simp\n moreover\n from step_Nil [OF this]\n have css': \"css'=tl css''\"\n by simp\n ultimately have \n step_i_full: \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',tl css'',t')\"\n by simp\n from css'' Cons pcss_i_not_Nil\n have \"hd css'' = hd (pcss i)\"\n by (auto simp add: neq_Nil_conv split: split_if_asm)\n with cs'' cs''_Nil\n Nil_change_css_step [where ass=\"[hd css'']\" and\n css=\"tl css''\" and ass'=\"[]\" and \n xss=\"tl (pcss i)\", simplified, OF step_i_full [simplified]]\n have \"\\\\ (pcs i,[hd (pcss i)]@tl (pcss i),t'') \\ (cs',tl (pcss i),t')\"\n by simp\n with pcss_i_not_Nil \n have \"\\\\ (pcs i,pcss i,t'') \\ (cs',tl (pcss i),t')\"\n by simp\n moreover\n from css' css'' cs''_Nil Cons pcss_i_not_Nil pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = cs'\" \"pcss (Suc i) = tl (pcss i)\" \n apply (clarsimp split: split_if_asm)\n apply (drule (4) last_butlast_tl)\n by simp\n ultimately show ?thesis\n using f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n next\n case Nil\n with css'' pcss_i_not_Nil\n obtain pnorm pabr\n where css'': \"css''= [(pnorm@cs,pabr@cs)]@css\" and\n pcss_i: \"pcss i = [(pnorm,pabr)]\"\n by (force simp add: neq_Nil_conv split: split_if_asm)\n with cs''_Nil step_i_full\n have \"\\\\([],[(pnorm@cs,pabr@cs)]@css,t'') \\ (cs',css',t')\"\n by simp\n from step_Nil [OF this]\n obtain \n css': \"css'=css\" and\n cs': \"(case t'' of\n Abrupt s' \\ cs' = pabr @ cs \\ t' = Normal s'\n | _ \\ cs' = pnorm @ cs \\ t' = t'')\"\n by (simp cong: xstate.case_cong)\n let \"?pcs_Suc_i \" = \"(case t'' of Abrupt s' \\ pabr | _ \\ pnorm)\"\n from cs'\n have \"\\\\([],[(pnorm,pabr)],t'') \\ (?pcs_Suc_i,[],t')\"\n by (auto intro: step.intros split: xstate.splits)\n moreover\n from css'' css' cs' pcss_i pcs_pcss_Suc_i\n obtain \"pcs (Suc i) = ?pcs_Suc_i\" \"pcss (Suc i) = []\"\n by (simp split: split_if_asm xstate.splits)\n ultimately\n show ?thesis\n using pcss_i cs'' cs''_Nil f_i f_Suc_i\n by (simp add: p_def CS_def CSS_def S_def)\n qed\n qed\n qed\n qed\n qed\n qed\nqed\n\nlemma k_steps_to_rtrancl: \n assumes steps: \"\\i\\ p i \\ p (Suc i)\"\n shows \"\\\\p 0\\\\<^sup>* p k\"\nusing steps\nproof (induct k)\n case 0 thus ?case by auto\nnext\n case (Suc k)\n have \"\\i\\ p i \\ p (Suc i)\" by fact\n then obtain\n step_le_k: \"\\i\\ p i \\ p (Suc i)\" and step_k: \"\\\\ p k \\ p (Suc k)\"\n by auto\n from Suc.hyps [OF step_le_k]\n have \"\\\\ p 0 \\\\<^sup>* p k\".\n also note step_k\n finally show ?case .\nqed\n\n \n\nlemma (in inf) steps_hd_drop_suffix_finite:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nassumes simul: \"\\i\\k.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\nshows \"\\\\([c],[],s) \\\\<^sup>* (pcs k, pcss k, S (f k))\"\nproof -\n from steps_hd_drop_suffix [OF f_0 f_step not_finished simul]\n have \"\\i\\ (pcs i, pcss i, S (f i)) \\ \n (pcs (Suc i), pcss (Suc i), S (f (Suc i)))\".\n from k_steps_to_rtrancl [OF this]\n have \"\\\\ (pcs 0, pcss 0, S (f 0)) \\\\<^sup>* (pcs k, pcss k, S (f k))\".\n moreover from f_0 simul [rule_format, of 0]\n have \"(pcs 0, pcss 0, S (f 0)) = ([c],[],s)\"\n by (auto split: split_if_asm simp add: CS_def CSS_def S_def)\n ultimately show ?thesis by simp\nqed\n\nlemma (in inf) steps_hd_drop_suffix_infinite:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\" \nassumes not_finished: \"\\i. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\n(*assumes not_finished: \"\\i. \\ (pcs i = [] \\ pcss i = [])\"*)\nassumes simul: \"\\i.\n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\ndefines \"p\\\\i. (pcs i, pcss i, S (f i))\"\nshows \"\\\\ p i \\ p (Suc i)\"\nproof -\n from steps_hd_drop_suffix [OF f_0 f_step, of \"Suc i\" pcss pcs] not_finished simul\n show ?thesis\n by (auto simp add: p_def)\nqed\n\nlemma (in inf) steps_hd_progress:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\"\nassumes c_unfinished: \"\\i < k. \\ (CS (f i) = cs \\ CSS (f i) = css)\"\nshows \"\\i \\ k. (\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css))\"\nusing c_unfinished \nproof (induct k)\n case 0\n with f_0 show ?case\n by (simp add: CSS_def CS_def)\nnext\n case (Suc k)\n have c_unfinished: \"\\i (CS (f i) = cs \\ CSS (f i) = css)\" by fact\n hence c_unfinished': \"\\i< k. \\ (CS (f i) = cs \\ CSS (f i) = css)\" by simp\n show ?case\n proof (clarify)\n fix i\n assume i_le_Suc_k: \"i \\ Suc k\"\n show \"\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n proof (cases \"i < Suc k\")\n case True\n with Suc.hyps [OF c_unfinished', rule_format, of i] c_unfinished\n show ?thesis\n by auto\n next\n case False\n with i_le_Suc_k have eq_i_Suc_k: \"i=Suc k\"\n by auto\n obtain cs' css' t' where \n f_Suc_k: \"f (Suc k) = (cs', css', t')\"\n by (cases \"f (Suc k)\")\n obtain cs'' css'' t'' where \n f_k: \"f k = (cs'',css'',t'')\"\n by (cases \"f k\")\n with Suc.hyps [OF c_unfinished',rule_format, of k] \n obtain pcs pcss where \n pcs_pcss_k: \n \"if pcss = [] then css'' = css \\ cs'' = pcs @ cs\n else cs'' = pcs \\\n css'' = butlast pcss @ \n [(fst (last pcss) @ cs, snd (last pcss) @ cs)] @ \n css\"\n by (auto simp add: CSS_def CS_def cong: if_cong)\n from c_unfinished [rule_format, of k] f_k pcs_pcss_k\n have pcs_pcss_empty: \"\\ (pcs = [] \\ pcss = [])\" \n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n show ?thesis\n proof (cases \"pcss = []\")\n case True\n note pcss_Nil = this\n with pcs_pcss_k pcs_pcss_empty obtain p ps where\n pcs_i: \"pcs = p#ps\" and\n css'': \"css''=css\" and \n cs'': \"cs''=(p#ps)@cs\"\n by (cases \"pcs\") auto\n with f_k have \"f k = (p#(ps@cs),css,t'')\"\n by simp \n with f_Suc_k f_step [rule_format, of k]\n have step_css: \"\\\\ (p#(ps@cs),css,t'') \\ (cs',css',t')\"\n by simp\n from step_Cons' [OF this, of p \"ps@cs\"]\n obtain css''' where\n css''': \"css' = css''' @ css\" \n \"if css''' = [] then \\p. cs' = p @ ps @ cs\n else (\\pnorm pabr. css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)])\"\n by auto\n show ?thesis\n proof (cases \"css''' = []\")\n case True\n with css'''\n obtain p' where \n css': \"css' = css\" and\n cs': \"cs' = p' @ ps @ cs\"\n by auto\n from css' cs' f_Suc_k\n show ?thesis\n apply (rule_tac x=\"p'@ps\" in exI) \n apply (rule_tac x=\"[]\" in exI)\n apply (simp add: CSS_def CS_def eq_i_Suc_k)\n done\n next\n case False\n with css'''\n obtain pnorm pabr where \n css': \"css'=css'''@css\"\n \"css'''=[(pnorm @ ps @ cs,pabr @ ps @ cs)]\"\n by auto\n with f_Suc_k eq_i_Suc_k\n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"[(pnorm@ps, pabr@ps)]\" in exI) \n by (simp add: CSS_def CS_def)\n qed\n next\n case False\n note pcss_k_not_Nil = this\n with pcs_pcss_k obtain\n cs'': \"cs''=pcs\" and \n css'': \"css''= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css\"\n by auto\n from f_Suc_k f_k f_step [rule_format, of k]\n have step_i_full: \"\\\\ (cs'',css'',t'') \\ (cs',css',t')\"\n by simp \n show ?thesis\n proof (cases cs'')\n case (Cons c' cs)\n with step_Cons' [OF step_i_full]\n obtain css''' where css': \"css' = css'''@css''\"\n by auto\n with cs'' css'' f_Suc_k eq_i_Suc_k pcss_k_not_Nil\n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"css'''@pcss\" in exI)\n by (clarsimp simp add: CSS_def CS_def butlast_append)\n next\n case Nil\n note cs''_Nil = this\n show ?thesis\n proof (cases \"butlast pcss\")\n case (Cons bpcs bpcss)\n with cs''_Nil step_i_full css''\n have \"\\\\ ([],[hd css'']@tl css'',t'') \\ (cs',css',t')\"\n by simp\n moreover\n from step_Nil [OF this]\n obtain css': \"css'=tl css''\" and\n cs': \"cs' = (case t'' of Abrupt s' \\ snd (hd css'') \n | _ \\ fst (hd css''))\"\n by (auto split: xstate.splits)\n from css'' Cons pcss_k_not_Nil\n have \"hd css'' = hd pcss\"\n by (auto simp add: neq_Nil_conv split: split_if_asm)\n with css' cs' css'' cs''_Nil Cons pcss_k_not_Nil f_Suc_k eq_i_Suc_k \n show ?thesis\n apply (rule_tac x=\"cs'\" in exI)\n apply (rule_tac x=\"tl pcss\" in exI)\n apply (clarsimp split: xstate.splits \n simp add: CS_def CSS_def neq_Nil_conv split: split_if_asm)\n done\n next\n case Nil\n with css'' pcss_k_not_Nil\n obtain pnorm pabr\n where css'': \"css''= [(pnorm@cs,pabr@cs)]@css\" and\n pcss_k: \"pcss = [(pnorm,pabr)]\"\n by (force simp add: neq_Nil_conv split: split_if_asm)\n with cs''_Nil step_i_full\n have \"\\\\([],[(pnorm@cs,pabr@cs)]@css,t'') \\ (cs',css',t')\"\n by simp\n from step_Nil [OF this]\n obtain \n css': \"css'=css\" and\n cs': \"(case t'' of\n Abrupt s' \\ cs' = pabr @ cs \\ t' = Normal s'\n | _ \\ cs' = pnorm @ cs \\ t' = t'')\"\n by (simp cong: xstate.case_cong)\n let \"?pcs_Suc_k \" = \"(case t'' of Abrupt s' \\ pabr | _ \\ pnorm)\"\n from css'' css' cs' pcss_k f_Suc_k eq_i_Suc_k\n show ?thesis\n apply (rule_tac x=\"?pcs_Suc_k\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (simp split: xstate.splits add: CS_def CSS_def)\n done\n qed\n qed\n qed\n qed\n qed\nqed\n \nlemma (in inf) inf_progress:\nassumes f_0: \"f 0 = (c#cs,css,s)\"\nassumes f_step: \"\\i. \\\\ f(i) \\ f(Suc i)\"\nassumes unfinished: \"\\i. \\ ((CS (f i) = cs) \\ (CSS (f i) = css))\"\nshows \"\\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\nproof -\n from steps_hd_progress [OF f_0 f_step, of \"i\"] unfinished\n show ?thesis\n by auto\nqed\n\nlemma skolemize1: \"\\x. P x \\ (\\y. Q x y) \\ \\f.\\x. P x \\ Q x (f x)\"\n by (rule choice) blast\n\nlemma skolemize2: \"\\x. P x \\ (\\y z. Q x y z) \\ \\f g.\\x. P x \\ Q x (f x) (g x)\"\napply (drule skolemize1)\napply (erule exE)\napply (drule skolemize1)\napply fast\ndone\n\nlemma skolemize2': \"\\x.\\y z. P x y z \\ \\f g.\\x. P x (f x) (g x)\"\napply (drule choice)\napply (erule exE)\napply (drule choice)\napply fast\ndone\n\ntheorem (in inf) inf_cases:\n fixes c::\"('s,'p,'f) com\"\n assumes inf: \"inf \\ (c#cs) css s\" \n shows \"inf \\ [c] [] s \\ (\\t. \\\\\\c,s\\ \\ t \\ inf \\ cs css t)\"\nproof -\n from inf obtain f where\n f_0: \"f 0 = (c#cs,css,s)\" and\n f_step: \"(\\i. \\\\f i \\ f (Suc i))\"\n by (auto simp add: inf_def)\n show ?thesis\n proof (cases \"\\i. CS (f i) = cs \\ CSS (f i) = css\")\n case True\n def k\\\"(LEAST i. CS (f i) = cs \\ CSS (f i) = css)\"\n from True\n obtain CS_f_k: \"CS (f k) = cs\" and CSS_f_k: \"CSS (f k) = css\" \n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n have less_k_prop: \"\\i (CS (f i) = cs \\ CSS (f i) = css)\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply simp\n done\n have \"\\\\([c], [], s) \\\\<^sup>* ([],[],S (f k))\"\n proof -\n have \"\\i\\k. \\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n by (rule steps_hd_progress \n [OF f_0 f_step, where k=k, OF less_k_prop])\n from skolemize2 [OF this] obtain pcs pcss where\n pcs_pcss: \n \"\\i\\k. \n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by iprover\n from pcs_pcss [rule_format, of k] CS_f_k CSS_f_k \n have finished: \"pcs k = []\" \"pcss k = []\"\n by (auto simp add: CS_def CSS_def S_def split: split_if_asm)\n from pcs_pcss\n have simul: \"\\i\\k. (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by auto\n from steps_hd_drop_suffix_finite [OF f_0 f_step less_k_prop simul] finished\n show ?thesis\n by simp\n qed\n hence \"\\\\\\c,s\\ \\ S (f k)\"\n by (rule steps_impl_exec)\n moreover\n from CS_f_k CSS_f_k f_step\n have \"inf \\ cs css (S (f k))\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (i + k)\" in exI)\n apply simp\n apply (auto simp add: CS_def CSS_def S_def)\n done\n ultimately\n have \"(\\t. \\\\\\c,s\\ \\ t \\ inf \\ cs css t)\"\n by blast\n thus ?thesis\n by simp\n next\n case False\n hence unfinished: \"\\i. \\ ((CS (f i) = cs) \\ (CSS (f i) = css))\"\n by simp\n from inf_progress [OF f_0 f_step this]\n have \"\\i. \\pcs pcss. \n (if pcss = [] then CSS (f i)=css \\ CS (f i)=pcs@cs \n else CS (f i)=pcs \\ \n CSS (f i)= butlast pcss@\n [(fst (last pcss)@cs,(snd (last pcss))@cs)]@\n css)\"\n by auto\n from skolemize2' [OF this] obtain pcs pcss where \n pcs_pcss: \"\\i. \n (if pcss i = [] then CSS (f i)=css \\ CS (f i)=pcs i@cs \n else CS (f i)=pcs i \\ \n CSS (f i)= butlast (pcss i)@\n [(fst (last (pcss i))@cs,(snd (last (pcss i)))@cs)]@\n css)\"\n by iprover\n def \"g\" \\ \"\\i. (pcs i, pcss i, S (f i))\"\n from pcs_pcss [rule_format, of 0] f_0\n have \"g 0 = ([c],[],s)\"\n by (auto split: split_if_asm simp add: CS_def CSS_def S_def g_def)\n moreover\n from steps_hd_drop_suffix_infinite [OF f_0 f_step unfinished pcs_pcss]\n have \"\\i. \\\\g i \\ g (Suc i)\"\n by (simp add: g_def)\n ultimately\n have \"inf \\ [c] [] s\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma infE [consumes 1]:\n assumes inf: \"inf \\ (c#cs) css s\" \n assumes cases: \"inf \\ [c] [] s \\ P\"\n \"\\t. \\\\\\\\c,s\\ \\ t; inf \\ cs css t\\ \\ P\"\n shows P\nusing inf cases\napply -\napply (drule inf.inf_cases)\napply auto\ndone\n\nlemma inf_Seq: \n \"inf \\ (Seq c1 c2#cs) css (Normal s) = inf \\ (c1#c2#cs) css (Normal s)\" \nproof \n assume \"inf \\ (Seq c1 c2 # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (Seq c1 c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from f_step [rule_format, of 0] f_0\n have \"f 1 = (c1#c2#cs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ (c1#c2#cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ (c1 # c2 # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (c1# c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def g\\\"\\i. case i of 0 \\ (Seq c1 c2#cs,css,Normal s) | Suc j \\ f j\" \n with f_0 have\n \"\\\\g 0 \\ g (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\g i \\ g (Suc i)\"\n by (auto simp add: g_def split: nat.splits)\n ultimately\n show \"inf \\ (Seq c1 c2 # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=g in exI)\n apply (simp add: g_def split: nat.splits)\n done\nqed\n \nlemma inf_WhileTrue: \n assumes b: \"s \\ b\"\n shows \"inf \\ (While b c#cs) css (Normal s) = \n inf \\ (c#While b c#cs) css (Normal s)\" \nproof\n assume \"inf \\ (While b c # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (While b c#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from b f_step [rule_format, of 0] f_0\n have \"f 1 = (c#While b c#cs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ (c # While b c # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ (c # While b c # cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (c # While b c #cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def h\\\"\\i. case i of 0 \\ (While b c#cs,css,Normal s) | Suc j \\ f j\" \n with b f_0 have\n \"\\\\h 0 \\ h (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\h i \\ h (Suc i)\"\n by (auto simp add: h_def split: nat.splits)\n ultimately\n show \"inf \\ (While b c # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=h in exI)\n apply (simp add: h_def split: nat.splits)\n done\nqed\n\nlemma inf_Catch:\n\"inf \\ (Catch c1 c2#cs) css (Normal s) = inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\nproof\n assume \"inf \\ (Catch c1 c2#cs) css (Normal s)\"\n then obtain f where \n f_0: \"f 0 = (Catch c1 c2#cs,css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n from f_step [rule_format, of 0] f_0\n have \"f 1 = ([c1],(cs,c2#cs)#css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step show \"inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n apply simp\n done\nnext\n assume \"inf \\ [c1] ((cs,c2#cs)#css) (Normal s)\"\n then obtain f where \n f_0: \"f 0 = ([c1],(cs,c2#cs)#css,Normal s)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n def h\\\"\\i. case i of 0 \\ (Catch c1 c2#cs,css,Normal s) | Suc j \\ f j\" \n with f_0 have\n \"\\\\h 0 \\ h (Suc 0)\"\n by (auto intro: step.intros)\n moreover\n from f_step have \"\\i. i\\0 \\ \\\\h i \\ h (Suc i)\"\n by (auto simp add: h_def split: nat.splits)\n ultimately\n show \"inf \\ (Catch c1 c2 # cs) css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=h in exI)\n apply (simp add: h_def split: nat.splits)\n done\nqed\n\ntheorem terminates_impl_not_inf: \n assumes termi: \"\\\\c \\ s\"\n shows \"\\inf \\ [c] [] s\"\nusing termi\nproof induct\n case (Skip s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Skip], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Basic g s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Basic g], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal (g s))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Spec r s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Spec r], [], Normal s)\" \n with f_step [of 0]\n have \"\\\\([Spec r], [], Normal s) \\ f (Suc 0)\"\n by simp\n then show False\n proof (cases)\n fix t\n assume \"(s, t) \\ r\" \"f (Suc 0) = ([], [], Normal t)\"\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n assume \"\\t. (s, t) \\ r\" \"f (Suc 0) = ([], [], Stuck)\"\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\n qed\nnext\n case (Guard s g c m)\n have g: \"s \\ g\" by fact\n have hyp: \"\\ inf \\ [c] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Guard m g c], [], Normal s)\" \n from g f_step [of 0] f_0\n have \"f (Suc 0) = ([c],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False ..\n qed\nnext\n case (GuardFault s g m c)\n have g: \"s \\ g\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Guard m g c], [], Normal s)\" \n from g f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Fault c m)\n thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Fault m)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Seq c1 s c2)\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n have hyp_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ s' \\ \\\\c2 \\ s' \\ \\ inf \\ [c2] [] s'\" by fact\n have \"\\ inf \\ ([c1,c2]) [] (Normal s)\"\n proof \n assume \"inf \\ [c1, c2] [] (Normal s)\"\n then show False\n proof (cases rule: infE)\n assume \"inf \\ [c1] [] (Normal s)\"\n with hyp_c1 show ?thesis by simp\n next\n fix t\n assume \"\\\\\\c1,Normal s\\ \\ t\" \"inf \\ [c2] [] t\"\n with hyp_c2 show ?thesis by simp\n qed\n qed\n thus ?case\n by (simp add: inf_Seq)\nnext\n case (CondTrue s b c1 c2)\n have b: \"s \\ b\" by fact\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Cond b c1 c2], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = ([c1],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c1] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c1 show False by simp\n qed\nnext\n case (CondFalse s b c2 c1)\n have b: \"s \\ b\" by fact\n have hyp_c2: \"\\ inf \\ [c2] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Cond b c1 c2], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = ([c2],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [c2] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c2 show False by simp\n qed\nnext\n case (WhileTrue s b c)\n have b: \"s \\ b\" by fact\n have hyp_c: \"\\ inf \\ [c] [] (Normal s)\" by fact\n have hyp_w: \"\\s'. \\\\\\c,Normal s\\ \\ s' \\ \n \\\\While b c \\ s' \\ \\ inf \\ [While b c] [] s'\" by fact\n have \"\\ inf \\ [c,While b c] [] (Normal s)\"\n proof \n assume \"inf \\ [c,While b c] [] (Normal s)\"\n from this hyp_c hyp_w show False\n by (cases rule: infE) auto\n qed\n with b show ?case\n by (simp add: inf_WhileTrue)\nnext\n case (WhileFalse s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([While b c], [], Normal s)\" \n from b f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Call p bdy s)\n have bdy: \"\\ p = Some bdy\" by fact\n have hyp: \"\\ inf \\ [bdy] [] (Normal s)\" by fact\n have not_inf_bdy:\n \"\\ inf \\ [bdy] [([],[Throw])] (Normal s)\"\n proof \n assume \"inf \\ [bdy] [([],[Throw])] (Normal s)\"\n then show False\n proof (rule infE)\n assume \"inf \\ [bdy] [] (Normal s)\"\n with hyp show False by simp\n next\n fix t\n assume \"\\\\\\bdy,Normal s\\ \\ t\"\n assume inf: \"inf \\ [] [([], [Throw])] t\"\n then obtain f where\n f_0: \"f 0 = ([],[([], [Throw])],t)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n show False\n proof (cases t)\n case (Normal t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],(Normal t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step.cases)\n next \n case (Abrupt t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([Throw],[],(Normal t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n have \"f (Suc (Suc 0)) = ([],[],(Abrupt t'))\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc(Suc 0)\"]\n show False\n by (auto elim: step.cases)\n next\n case (Fault m)\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n have \"f (Suc (Suc 0)) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc (Suc 0)\"]\n show False\n by (auto elim: step.cases)\n next\n case Stuck\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n have \"f (Suc (Suc 0)) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc (Suc 0)\"]\n show False\n by (auto elim: step.cases)\n qed\n qed\n qed \n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Call p], [], Normal s)\" \n from bdy f_step [of 0] f_0\n have \"f (Suc 0) = \n ([bdy],[([],[Throw])],Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"inf \\ [bdy] [([],[Throw])] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with not_inf_bdy\n show False by simp\n qed\nnext\n case (CallUndefined p s)\n have undef: \"\\ p = None\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Call p], [], Normal s)\" \n from undef f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Stuck c)\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Stuck)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (DynCom c s)\n have hyp: \"\\ inf \\ [(c s)] [] (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([DynCom c], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([(c s)], [], Normal s)\"\n by (auto elim: step_elim_cases)\n with f_step have \"inf \\ [(c s)] [] (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp\n show False by simp\n qed\nnext\n case (Throw s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([Throw], [], Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Abrupt s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Abrupt c s)\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = ([c], [], Abrupt s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = ([],[],Abrupt s)\"\n by (auto elim: step_elim_cases)\n with f_step [rule_format, of \"Suc 0\"]\n show False\n by (auto elim: step_elim_cases)\n qed\nnext\n case (Catch c1 s c2)\n have hyp_c1: \"\\ inf \\ [c1] [] (Normal s)\" by fact\n have hyp_c2: \"\\s'. \\\\\\c1,Normal s\\ \\ Abrupt s' \\\n \\\\c2 \\ Normal s' \\ \\ inf \\ [c2] [] (Normal s')\" by fact\n have \"\\ inf \\ [c1] [([],[c2])] (Normal s)\"\n proof \n assume \"inf \\ [c1] [([],[c2])] (Normal s)\"\n then show False\n proof (rule infE) \n assume \"inf \\ [c1] [] (Normal s)\"\n with hyp_c1 show False by simp\n next\n fix t\n assume eval: \"\\\\\\c1,Normal s\\ \\ t\" \n assume inf: \"inf \\ [] [([], [c2])] t\"\n then obtain f where\n f_0: \"f 0 = ([],[([], [c2] )],t)\" and\n f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n by (auto simp add: inf_def)\n show False\n proof (cases t)\n case (Normal t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Normal t')\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n case (Abrupt t')\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([c2],[],Normal t')\"\n by (auto elim: step_Normal_elim_cases)\n with f_step eval Abrupt\n have \"inf \\ [c2] [] (Normal t')\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with eval hyp_c2 Abrupt show False by simp\n next\n case (Fault m)\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Fault m)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n next\n case Stuck\n with f_0 f_step [rule_format, of 0]\n have \"f (Suc 0) = ([],[],Stuck)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step [rule_format, of 1]\n show False\n by (auto elim: step_elim_cases)\n qed\n qed\n qed\n thus ?case\n by (simp add: inf_Catch)\nqed\n\nlemma terminatess_impl_not_inf:\n assumes termi: \"\\\\cs,css\\s\" \n shows \"\\inf \\ cs css s\"\nusing termi\nproof (induct)\n case (Nil s)\n show ?case\n proof (rule not_infI)\n fix f\n assume \"\\i. \\\\f i \\ f (Suc i)\"\n hence \"\\\\f 0 \\ f (Suc 0)\" \n by simp\n moreover\n assume \"f 0 = ([], [], s)\"\n ultimately show False\n by (fastforce elim: step.cases)\n qed\nnext\n case (ExitBlockNormal nrms css s abrs)\n have hyp: \"\\ inf \\ nrms css (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f0: \"f 0 = ([], (nrms, abrs) # css, Normal s)\"\n with f_step [of 0] have \"f (Suc 0) = (nrms,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step have \"inf \\ nrms css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp \n with hyp show False ..\n qed\nnext\n case (ExitBlockAbrupt abrs css s nrms)\n have hyp: \"\\ inf \\ abrs css (Normal s)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f0: \"f 0 = ([], (nrms, abrs) # css, Abrupt s)\"\n with f_step [of 0] have \"f (Suc 0) = (abrs,css,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step have \"inf \\ abrs css (Normal s)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp \n with hyp show False ..\n qed\nnext\n case (ExitBlockFault nrms css f abrs)\n show ?case\n by (rule not_inf_Fault)\nnext\n case (ExitBlockStuck nrms css abrs)\n show ?case\n by (rule not_inf_Stuck)\nnext\n case (Cons c s cs css)\n have termi_c: \"\\\\c \\ s\" by fact\n have hyp: \"\\t. \\\\\\c,s\\ \\ t \\ \\\\cs,css\\t \\ \\ inf \\ cs css t\" by fact\n show \"\\ inf \\ (c # cs) css s\"\n proof \n assume \"inf \\ (c # cs) css s\"\n thus False\n proof (rule infE)\n assume \"inf \\ [c] [] s\"\n with terminates_impl_not_inf [OF termi_c]\n show False ..\n next\n fix t\n assume \"\\\\\\c,s\\ \\ t\" \"inf \\ cs css t\"\n with hyp show False by simp\n qed\n qed\nqed\n\nlemma lem:\n \"\\y. r\\<^sup>+\\<^sup>+ a y \\ P a \\ P y \n \\ ((b,a) \\ {(y,x). P x \\ r x y}\\<^sup>+) = ((b,a) \\ {(y,x). P x \\ r\\<^sup>+\\<^sup>+ x y})\"\napply(rule iffI)\n apply clarify\n apply(erule trancl_induct)\n apply blast\n apply(blast intro:tranclp_trans)\napply clarify\napply(erule tranclp_induct)\n apply blast\napply(blast intro:trancl_trans)\ndone\n\ncorollary terminatess_impl_no_inf_chain:\n assumes terminatess: \"\\\\cs,css\\s\"\n shows \"\\(\\f. f 0 = (cs,css,s) \\ (\\i::nat. \\\\f i \\\\<^sup>+ f(Suc i)))\"\nproof -\n have \"wf({(y,x). \\\\(cs,css,s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n proof (rule wf_trancl)\n show \"wf {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\"\n proof (simp only: wf_iff_no_infinite_down_chain,clarify,simp)\n fix f\n assume \"\\i. \\\\(cs, css, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from terminatess\n have \"\\ (\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (rule terminatess_impl_not_inf [unfolded inf_def])\n ultimately show False\n by simp\n qed\n qed\n hence \"\\ (\\f. \\i. (f (Suc i), f i)\n \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n by (simp add: wf_iff_no_infinite_down_chain)\n thus ?thesis\n proof (rule contrapos_nn)\n assume \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\\\<^sup>+ f (Suc i))\"\n then obtain f where\n f0: \"f 0 = (cs, css, s)\" and\n seq: \"\\i. \\\\f i \\\\<^sup>+ f (Suc i)\"\n by iprover\n show \n \"\\f. \\i. (f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof (rule exI [where x=f],rule allI)\n fix i\n show \"(f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof - \n {\n fix i have \"\\\\(cs,css,s) \\\\<^sup>* f i\"\n proof (induct i)\n case 0 show \"\\\\(cs, css, s) \\\\<^sup>* f 0\"\n by (simp add: f0)\n next\n case (Suc n)\n have \"\\\\(cs, css, s) \\\\<^sup>* f n\" by fact\n with seq show \"\\\\(cs, css, s) \\\\<^sup>* f (Suc n)\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n qed\n }\n hence \"\\\\(cs,css,s) \\\\<^sup>* f i\"\n by iprover\n with seq have\n \"(f (Suc i), f i) \\ {(y, x). \\\\(cs, css, s) \\\\<^sup>* x \\ \\\\x \\\\<^sup>+ y}\"\n by clarsimp\n moreover \n have \"\\y. \\\\f i \\\\<^sup>+ y\\\\\\(cs, css, s) \\\\<^sup>* f i\\\\\\(cs, css, s) \\\\<^sup>* y\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n ultimately \n show ?thesis \n by (subst lem)\n qed\n qed\n qed\nqed\n\ncorollary terminates_impl_no_inf_chain:\n \"\\\\c\\s \\ \\(\\f. f 0 = ([c],[],s) \\ (\\i::nat. \\\\f i \\\\<^sup>+ f(Suc i)))\"\n by (rule terminatess_impl_no_inf_chain) (iprover intro: terminatess.intros)\n\n\ndefinition\n termi_call_steps :: \"('s,'p,'f) body \\ (('s \\ 'p) \\ ('s \\ 'p))set\"\nwhere\n\"termi_call_steps \\ =\n {((t,q),(s,p)). \\\\the (\\ p)\\Normal s \\ \n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t))}\"\n\ntext {* Sequencing computations, or more exactly continuation stacks *}\nprimrec seq:: \"(nat \\ 'a list) \\ nat \\ 'a list\"\nwhere\n\"seq css 0 = []\" |\n\"seq css (Suc i) = css i@seq css i\"\n\n\ntheorem wf_termi_call_steps: \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix S\n assume inf:\n \"\\i. (\\(t,q) (s,p). \\\\(the (\\ p)) \\ Normal s \\\n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t)))\n (S (Suc i)) (S i)\"\n obtain s p where \"s = (\\i. fst (S i))\" and \"p = (\\i. snd (S i))\" \n by auto\n with inf\n have inf':\n \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n (\\css. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css,Normal (s (Suc i))))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply auto\n done\n show False\n proof -\n from inf' -- {* Skolemization of css with axiom of choice *}\n have \"\\css. \\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css i,Normal (s (Suc i)))\"\n apply -\n apply (rule choice)\n by blast\n then obtain css where\n termi_css: \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i)\" and\n step_css: \"\\i. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css i,Normal (s (Suc i)))\"\n by blast\n def f == \"\\i. ([the (\\ (p i))], seq css i,Normal (s i)::('a,'c) xstate)\"\n have \"f 0 = ([the (\\ (p 0))],[],Normal (s 0))\"\n by (simp add: f_def)\n moreover\n have \"\\i. \\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n proof \n fix i\n from step_css [rule_format, of i]\n have \"\\\\([the (\\ (p i))], [], Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))], css i, Normal (s (Suc i)))\".\n from app_css_steps [OF this,simplified]\n have \"\\\\([the (\\ (p i))], seq css i, Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))], css i@seq css i, Normal (s (Suc i)))\".\n thus \"\\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n by (simp add: f_def)\n qed\n moreover from termi_css [rule_format, of 0]\n have \"\\ (\\f. (f 0 = ([the (\\ (p 0))],[],Normal (s 0)) \\ \n (\\i. \\\\(f i) \\\\<^sup>+ f(Suc i))))\"\n by (rule terminates_impl_no_inf_chain)\n ultimately show False\n by auto\n qed\nqed\n\ntext {* An alternative proof using Hilbert-choice instead of axiom of choice.*}\ntheorem \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix S\n assume inf:\n \"\\i. (\\(t,q) (s,p). \\\\(the (\\ p)) \\ Normal s \\\n (\\css. \\\\([the (\\ p)],[],Normal s) \\\\<^sup>+ ([the (\\ q)],css,Normal t)))\n (S (Suc i)) (S i)\"\n obtain s p where \"s = (\\i. fst (S i))\" and \"p = (\\i. snd (S i))\" \n by auto\n with inf\n have inf':\n \"\\i. \\\\(the (\\ (p i))) \\ Normal (s i) \\\n (\\css. \\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (Suc i)))],css,Normal (s (Suc i))))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply auto\n done\n show \"False\"\n proof -\n def CSS \\ \"\\i. (SOME css. \n \\\\([the (\\ (p i))],[], Normal (s i)) \\\\<^sup>+\n ([the (\\ (p (i+1)))],css,Normal (s (i+1))))\"\n def f == \"\\i. ([the (\\ (p i))], seq CSS i,Normal (s i)::('a,'c) xstate)\"\n have \"f 0 = ([the (\\ (p 0))],[],Normal (s 0))\"\n by (simp add: f_def)\n moreover\n have \"\\i. \\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n proof \n fix i\n from inf' [rule_format, of i] obtain css where\n css: \"\\\\([the (\\ (p i))],[],Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (i+1)))],css,Normal (s (i+1)))\"\n by fastforce\n hence \"\\\\([the (\\ (p i))], seq CSS i, Normal (s i)) \\\\<^sup>+ \n ([the (\\ (p (i+1)))], CSS i @ seq CSS i, Normal (s (i+1)))\"\n apply -\n apply (unfold CSS_def)\n apply (rule someI2 \n [where P=\"\\css. \n \\\\([the (\\ (p i))],[],Normal (s i))\\\\<^sup>+\n ([the (\\ (p (i+1)))],css, Normal (s (i+1)))\"])\n apply (rule css)\n apply (fastforce dest: app_css_steps)\n done\n thus \"\\\\ (f i) \\\\<^sup>+ (f (i+1))\"\n by (simp add: f_def)\n qed\n moreover from inf' [rule_format, of 0]\n have \"\\\\the (\\ (p 0)) \\ Normal (s 0)\" \n by iprover\n then have \"\\ (\\f. (f 0 = ([the (\\ (p 0))],[],Normal (s 0)) \\ \n (\\i. \\\\(f i) \\\\<^sup>+ f(Suc i))))\"\n by (rule terminates_impl_no_inf_chain)\n ultimately show False\n by auto\n qed\nqed\n\nlemma not_inf_implies_wf: assumes not_inf: \"\\ inf \\ cs css s\"\n shows \"wf {(c2,c1). \\ \\ (cs,css,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nproof (simp only: wf_iff_no_infinite_down_chain,clarify, simp)\n fix f\n assume \"\\i. \\\\(cs, css, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from not_inf\n have \"\\ (\\f. f 0 = (cs, css, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (unfold inf_def)\n ultimately show False\n by simp\nqed\n\nlemma wf_implies_termi_reach:\nassumes wf: \"wf {(c2,c1). \\ \\ (cs,css,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nshows \"\\cs1 css1 s1. \\\\ \\ (cs,css,s) \\\\<^sup>* c1; c1=(cs1,css1,s1)\\\\ \\\\cs1,css1\\s1\"\nusing wf \nproof (induct c1, simp)\n fix cs1 css1 s1\n assume reach: \"\\\\(cs, css, s) \\\\<^sup>* (cs1, css1, s1)\"\n assume hyp_raw: \"\\y cs2 css2 s2. \\\\ \\ (cs1,css1,s1) \\ (cs2,css2,s2);\n \\ \\ (cs,css,s) \\\\<^sup>* (cs2,css2,s2); y=(cs2,css2,s2)\\ \\ \n \\\\cs2,css2\\s2\"\n have hyp: \"\\cs2 css2 s2. \\\\ \\ (cs1,css1,s1) \\ (cs2,css2,s2)\\ \\ \n \\\\cs2,css2\\s2\"\n apply -\n apply (rule hyp_raw)\n apply assumption\n using reach \n apply simp\n apply (rule refl)\n done\n show \"\\\\cs1,css1\\s1\"\n proof (cases s1)\n case (Normal s1')\n show ?thesis\n proof (cases cs1)\n case Nil\n note cs1_Nil = this\n show ?thesis\n proof (cases css1)\n case Nil\n with cs1_Nil show ?thesis\n by (auto intro: terminatess.intros)\n next\n case (Cons nrms_abrs css1')\n then obtain nrms abrs where nrms_abrs: \"nrms_abrs=(nrms,abrs)\"\n by (cases \"nrms_abrs\")\n have \"\\ \\ ([],(nrms,abrs)#css1',Normal s1') \\ (nrms,css1',Normal s1')\"\n by (rule step.intros)\n from hyp [simplified cs1_Nil Cons nrms_abrs Normal, OF this]\n have \"\\\\nrms,css1'\\Normal s1'\".\n from ExitBlockNormal [OF this] cs1_Nil Cons nrms_abrs Normal\n show ?thesis\n by auto\n qed\n next\n case (Cons c1 cs1')\n have \"\\\\c1#cs1',css1\\Normal s1'\"\n proof (cases c1)\n case Skip\n have \"\\ \\ (Skip#cs1',css1,Normal s1') \\ (cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Skip Normal, OF this]\n have \"\\\\cs1',css1\\Normal s1'\".\n with Normal Skip show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Basic f)\n have \"\\ \\ (Basic f#cs1',css1,Normal s1') \\ (cs1',css1,Normal (f s1'))\"\n by (rule step.intros)\n from hyp [simplified Cons Basic Normal, OF this]\n have \"\\\\cs1',css1\\Normal (f s1')\".\n with Normal Basic show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Spec r)\n with Normal show ?thesis\n apply simp\n apply (rule terminatess.Cons)\n apply (fastforce intro: terminates.intros)\n apply (clarify)\n apply (erule exec_Normal_elim_cases)\n apply clarsimp\n apply (rule hyp)\n apply (fastforce intro: step.intros simp add: Cons Spec Normal )\n apply (fastforce intro: terminatess_Stuck)\n done\n next\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have \"\\ \\ (Seq c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>1#c\\<^sub>2#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Seq Normal, OF this]\n have \"\\\\c\\<^sub>1 # c\\<^sub>2 # cs1',css1\\Normal s1'\".\n with Normal Seq show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n show ?thesis\n proof (cases \"s1' \\ b\")\n case True\n hence \"\\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>1#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Cond Normal, OF this]\n have \"\\\\c\\<^sub>1 # cs1',css1\\Normal s1'\".\n with Normal Cond True show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n hence \"\\\\(Cond b c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ (c\\<^sub>2#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Cond Normal, OF this]\n have \"\\\\c\\<^sub>2 # cs1',css1\\Normal s1'\".\n with Normal Cond False show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros\n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n next\n case (While b c')\n show ?thesis\n proof (cases \"s1' \\ b\")\n case True\n then have \"\\\\(While b c' # cs1', css1, Normal s1') \\ \n (c' # While b c' # cs1', css1, Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons While Normal, OF this]\n have \"\\\\c' # While b c' # cs1',css1\\Normal s1'\".\n with Cons While True Normal\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n then \n have \"\\\\(While b c' # cs1', css1, Normal s1') \\ (cs1', css1, Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons While Normal, OF this]\n have \"\\\\cs1',css1\\Normal s1'\".\n with Cons While False Normal\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n next\n case (Call p)\n show ?thesis\n proof (cases \"\\ p\")\n case None\n with Call Normal show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros terminatess_Stuck\n elim: exec_Normal_elim_cases)\n next\n case (Some bdy)\n then\n have \"\\ \\ (Call p#cs1',css1,Normal s1') \\ \n ([bdy],(cs1',Throw#cs1')#css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Call Normal Some, OF this]\n have \"\\\\[bdy],(cs1', Throw # cs1') # css1\\Normal s1'\".\n with Some Call Normal show ?thesis\n apply simp\n apply (rule terminatess.intros)\n apply (blast elim: terminatess_elim_cases intro: terminates.intros)\n apply clarify\n apply (erule terminatess_elim_cases)\n apply (erule exec_Normal_elim_cases)\n prefer 2\n apply simp\n apply (erule_tac x=t in allE)\n apply (case_tac t)\n apply (auto intro: terminatess_Stuck terminatess_Fault exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n done\n qed\n next\n case (DynCom c')\n have \"\\ \\ (DynCom c'#cs1',css1,Normal s1') \\ (c' s1'#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons DynCom Normal, OF this]\n have \"\\\\c' s1'#cs1',css1\\Normal s1'\".\n with Normal DynCom show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case (Guard f g c')\n show ?thesis\n proof (cases \"s1' \\ g\")\n case True\n then have \"\\ \\ (Guard f g c'#cs1',css1,Normal s1') \\ (c'#cs1',css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Guard Normal, OF this]\n have \"\\\\c'#cs1',css1\\Normal s1'\".\n with Normal Guard True show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n next\n case False\n with Guard Normal show ?thesis\n by (fastforce intro: terminatess.intros terminatess_Fault \n terminates.intros \n elim: exec_Normal_elim_cases)\n qed\n next\n case Throw\n have \"\\ \\ (Throw#cs1',css1,Normal s1') \\ (cs1',css1,Abrupt s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Throw Normal, OF this]\n have \"\\\\cs1',css1\\Abrupt s1'\".\n with Normal Throw show ?thesis\n by (auto intro: terminatess.intros terminates.intros \n elim: exec_Normal_elim_cases)\n next\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\ \\ (Catch c\\<^sub>1 c\\<^sub>2#cs1',css1,Normal s1') \\ \n ([c\\<^sub>1], (cs1',c\\<^sub>2#cs1')# css1,Normal s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Catch Normal, OF this]\n have \"\\\\[c\\<^sub>1],(cs1', c\\<^sub>2 # cs1') # css1\\Normal s1'\".\n with Normal Catch show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed \n with Cons Normal show ?thesis\n by simp\n qed\n next\n case (Abrupt s1')\n show ?thesis\n proof (cases cs1)\n case Nil\n note cs1_Nil = this\n show ?thesis\n proof (cases css1)\n case Nil\n with cs1_Nil show ?thesis by (auto intro: terminatess.intros)\n next\n case (Cons nrms_abrs css1')\n then obtain nrms abrs where nrms_abrs: \"nrms_abrs=(nrms,abrs)\"\n by (cases \"nrms_abrs\")\n have \"\\ \\ ([],(nrms,abrs)#css1',Abrupt s1') \\ (abrs,css1',Normal s1')\"\n by (rule step.intros)\n from hyp [simplified cs1_Nil Cons nrms_abrs Abrupt, OF this]\n have \"\\\\abrs,css1'\\Normal s1'\".\n from ExitBlockAbrupt [OF this] cs1_Nil Cons nrms_abrs Abrupt\n show ?thesis\n by auto\n qed\n next\n case (Cons c1 cs1')\n have \"\\\\c1#cs1',css1\\Abrupt s1'\"\n proof -\n have \"\\ \\ (c1#cs1',css1,Abrupt s1') \\ (cs1',css1,Abrupt s1')\"\n by (rule step.intros)\n from hyp [simplified Cons Abrupt, OF this]\n have \"\\\\cs1',css1\\Abrupt s1'\".\n with Cons Abrupt\n show ?thesis\n by (fastforce intro: terminatess.intros terminates.intros exec.intros \n elim: terminatess_elim_cases exec_Normal_elim_cases)\n qed\n with Cons Abrupt show ?thesis by simp\n qed\n next\n case (Fault f)\n thus ?thesis by (auto intro: terminatess_Fault)\n next\n case Stuck\n thus ?thesis by (auto intro: terminatess_Stuck)\n qed\nqed\n\nlemma not_inf_impl_terminatess:\n assumes not_inf: \"\\ inf \\ cs css s\"\n shows \"\\\\cs,css\\s\"\nproof -\n from not_inf_implies_wf [OF not_inf]\n have wf: \"wf {(c2, c1). \\\\(cs, css, s) \\\\<^sup>* c1 \\ \\\\c1 \\ c2}\".\n show ?thesis\n by (rule wf_implies_termi_reach [OF wf]) auto\nqed\n\nlemma not_inf_impl_terminates:\n assumes not_inf: \"\\ inf \\ [c] [] s\"\n shows \"\\\\c\\s\"\nproof -\n from not_inf_impl_terminatess [OF not_inf]\n have \"\\\\[c],[]\\s\".\n thus ?thesis\n by (auto elim: terminatess_elim_cases)\nqed\n\ntheorem terminatess_iff_not_inf: \n \"\\\\cs,css\\s = (\\ inf \\ cs css s)\"\n apply rule\n apply (erule terminatess_impl_not_inf)\n apply (erule not_inf_impl_terminatess)\n done\n\ncorollary terminates_iff_not_inf: \n \"\\\\c\\s = (\\ inf \\ [c] [] s)\"\n apply (rule)\n apply (erule terminates_impl_not_inf)\n apply (erule not_inf_impl_terminates)\n done\n\nsubsection {* Completeness of Total Correctness Hoare Logic*}\n\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\n\n\n\ntext {* To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n *}\nlemma Call_lemma:\n assumes \n Call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule Call)\napply blast\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\napply blast\ndone\n\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext {* Another proof of @{text MGT_Call}, maybe a little more readable *}\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n def Specs == \"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n def Specs_wf == \"(\\p \\. (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs)\"\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/AlternativeSmallStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2600265351284482}} {"text": "theory Simple_Network_Language\n imports Main\n Networks.State_Networks\n Uppaal_Networks.UPPAAL_State_Networks_Impl\n FinFun.FinFun\nbegin\n\nparagraph \\Tagging\\\n\ndefinition TAG (\"_ \\ _\" [8, 8] 9) where\n \"TAG t x = x\"\n\ndefinition\n \"TAG' t x = TAG t x\"\n\nlemmas TAG = TAG'_def[symmetric]\n\nlemmas add_tag = TAG_def[symmetric]\n\nlemma rm_TAG:\n assumes \"TAG t x\" \"TAG t x = TAG' t x\"\n shows True\n by auto\n\nmethod tags uses del keep =\n (unfold keep)?,\n ((drule rm_TAG, rule del)+)?,\n (unfold keep[symmetric])?\n\ndatatype 'a tag = ANY 'a | TRANS 'a | SEL 'a | SEND 'a | RECV 'a\n\nlemma\n assumes \"TAG 1 False\" \"TAG (TRANS STR ''remove'') (x > 0)\"\n shows False\n using assms\n apply -\n apply (tags del: TAG[of \"TRANS t\" for t] TAG[of 1] keep: TAG[of 1])\n unfolding TAG_def .\n\n\nsection \\Simple networks of automata with broadcast channels and committed locations\\\n\nno_notation top_assn (\"true\")\n\ndatatype ('a, 'b) bexp =\n true |\n not \"('a, 'b) bexp\" |\n \"and\" \"('a, 'b) bexp\" \"('a, 'b) bexp\" |\n or \"('a, 'b) bexp\" \"('a, 'b) bexp\" |\n imply \"('a, 'b) bexp\" \"('a, 'b) bexp\" | \\ \\Boolean connectives\\\n eq \"('a, 'b) exp\" \"('a, 'b) exp\" |\n le \"('a, 'b) exp\" \"('a, 'b) exp\" |\n lt \"('a, 'b) exp\" \"('a, 'b) exp\" |\n ge \"('a, 'b) exp\" \"('a, 'b) exp\" |\n gt \"('a, 'b) exp\" \"('a, 'b) exp\"\nand ('a, 'b) exp =\n const 'b | var 'a | if_then_else \"('a, 'b) bexp\" \"('a, 'b) exp\" \"('a, 'b) exp\" |\n binop \"'b \\ 'b \\ 'b\" \"('a, 'b) exp\" \"('a, 'b) exp\" | unop \"'b \\ 'b\" \"('a, 'b) exp\"\n\ninductive check_bexp :: \"('a \\ 'b) \\ ('a, 'b :: linorder) bexp \\ bool \\ bool\" and is_val\n where\n \"check_bexp s true True\" |\n \"check_bexp s (not e) (\\ b)\" if \"check_bexp s e b\" |\n \"check_bexp s (and e1 e2) (a \\ b)\" if \"check_bexp s e1 a\" \"check_bexp s e2 b\" |\n \"check_bexp s (or e1 e2) (a \\ b)\" if \"check_bexp s e1 a\" \"check_bexp s e2 b\" |\n \"check_bexp s (imply e1 e2) (a \\ b)\" if \"check_bexp s e1 a\" \"check_bexp s e2 b\" |\n \"check_bexp s (eq a b) (x = v)\" if \"is_val s a v\" \"is_val s b x\" |\n \"check_bexp s (le a b) (v \\ x)\" if \"is_val s a v\" \"is_val s b x\" |\n \"check_bexp s (lt a b) (v < x)\" if \"is_val s a v\" \"is_val s b x\" |\n \"check_bexp s (ge a b) (v \\ x)\" if \"is_val s a v\" \"is_val s b x\" |\n \"check_bexp s (gt a b) (v > x)\" if \"is_val s a v\" \"is_val s b x\" |\n \"is_val s (const c) c\" |\n \"is_val s (var x) v\" if \"s x = Some v\" |\n \"is_val s (if_then_else b e1 e2) (if bv then v1 else v2)\"\n if \"is_val s e1 v1\" \"is_val s e2 v2\" \"check_bexp s b bv\" |\n \"is_val s (binop f e1 e2) (f v1 v2)\" if \"is_val s e1 v1\" \"is_val s e2 v2\" |\n \"is_val s (unop f e) (f v)\" if \"is_val s e v\"\n\ntype_synonym\n ('c, 't, 's) invassn = \"'s \\ ('c, 't) cconstraint\"\n\ntype_synonym\n ('a, 'b) upd = \"('a * ('a, 'b) exp) list\"\n\ntype_synonym\n ('a, 's, 'c, 't, 'x, 'v) transition =\n \"'s \\ ('x, 'v) bexp \\ ('c, 't) cconstraint \\ 'a \\ ('x, 'v) upd \\ 'c list \\ 's\"\n\ntype_synonym\n ('a, 's, 'c, 't, 'x, 'v) sta =\n \"'s set \\ 's set \\ ('a, 's, 'c, 't, 'x, 'v) transition set \\ ('c, 't, 's) invassn\"\n\ntype_synonym\n ('a, 's, 'c, 't, 'x, 'v) nta = \"'a set \\ ('a act, 's, 'c, 't, 'x, 'v) sta list \\ ('x \\ 'v * 'v)\"\n\ncontext begin\n\nqualified definition conv_t where \"conv_t \\ \\ (l,b,g,a,f,r,l'). (l,b,conv_cc g,a,f,r,l')\"\n\nqualified definition conv_A where \"conv_A \\ \\ (C, U, T, I). (C, U, conv_t ` T, conv_cc o I)\"\n\ndefinition conv where\n \"conv \\ \\(broadcast, automata, bounds). (broadcast, map conv_A automata, bounds)\"\n\nend\n\ndatatype 'b label = Del | Internal 'b | Bin 'b | Broad 'b\n\ndefinition bounded where\n \"bounded bounds s \\ dom s = dom bounds \\\n (\\x \\ dom s. fst (the (bounds x)) \\ the (s x) \\ the (s x) \\ snd (the (bounds x)))\"\n\ndefinition is_upd where\n \"is_upd s upds s' \\ \\xs. list_all2 (\\ (l1, r1) (l2, r2). l1 = l2 \\ is_val s r1 r2) upds xs\n \\ s' = fold (\\ (l, r) s. s(l := Some r)) xs s\"\n\ninductive is_upds where\n \"is_upds s [] s\" |\n \"is_upds s (x # xs) s''\" if \"is_upd s x s'\" \"is_upds s' xs s''\"\n\ndefinition committed :: \"('a, 's, 'c, 't, 'x, 'v) sta \\ 's set\" where\n \"committed A \\ fst A\"\n\ndefinition urgent :: \"('a, 's, 'c, 't, 'x, 'v) sta \\ 's set\" where\n \"urgent A \\ fst (snd A)\"\n\ndefinition trans :: \"('a, 's, 'c, 't, 'x, 'v) sta \\ ('a, 's, 'c, 't, 'x, 'v) transition set\"\n where\n \"trans A \\ fst (snd (snd A))\"\n\ndefinition inv :: \"('a, 's, 'c, 't, 'x, 'v) sta \\ ('c, 't, 's) invassn\" where\n \"inv A \\ snd (snd (snd A))\"\n\nno_notation step_sn (\"_ \\ \\_, _, _\\ \\\\<^bsub>_\\<^esub> \\_, _, _\\\" [61,61,61,61,61] 61)\nno_notation steps_sn (\"_ \\ \\_, _, _\\ \\* \\_, _, _\\\" [61, 61, 61,61,61] 61)\n\ninductive step_u ::\n \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval\n \\ 'a label \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval \\ bool\"\n(\"_ \\ \\_, _, _\\ \\\\<^bsub>_\\<^esub> \\_, _, _\\\" [61,61,61,61,61] 61)\nwhere\n step_t:\n \"\\\n ''target invariant'' \\ \\p < length N. u \\ d \\ inv (N ! p) (L ! p);\n ''nonnegative'' \\ d \\ 0;\n ''urgent'' \\ (\\p < length N. L ! p \\ urgent (N ! p)) \\ d = 0;\n ''bounded'' \\ bounded B s\n \\\n \\ (broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L, s, u \\ d\\\" |\n step_int:\n \"\\\n TRANS ''silent'' \\ (l, b, g, Sil a, f, r, l') \\ trans (N ! p);\n ''committed'' \\ l \\ committed (N ! p) \\ (\\p < length N. L ! p \\ committed (N ! p));\n ''bexp'' \\ check_bexp s b True;\n ''guard'' \\ u \\ g;\n ''target invariant'' \\ \\p < length N. u' \\ inv (N ! p) (L' ! p);\n ''loc'' \\ L!p = l;\n ''range'' \\ p < length L;\n ''new loc'' \\ L' = L[p := l'];\n ''new valuation'' \\ u' = [r\\0]u;\n ''is_upd'' \\ is_upd s f s';\n ''bounded'' \\ bounded B s'\n \\\n \\ (broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Internal a\\<^esub> \\L', s', u'\\\" |\n step_bin:\n \"\\\n ''not broadcast'' \\ (a \\ broadcast);\n TRANS ''in'' \\ (l1, b1, g1, In a, f1, r1, l1') \\ trans (N ! p);\n TRANS ''out'' \\ (l2, b2, g2, Out a, f2, r2, l2') \\ trans (N ! q);\n ''committed'' \\\n l1 \\ committed (N ! p) \\ l2 \\ committed (N ! q) \\ (\\p < length N. L ! p \\ committed (N ! p));\n ''bexp'' \\ check_bexp s b1 True; ''bexp'' \\ check_bexp s b2 True;\n ''guard'' \\ u \\ g1; ''guard'' \\ u \\ g2;\n ''target invariant'' \\ \\p < length N. u' \\ inv (N ! p) (L' ! p);\n RECV ''loc'' \\ L!p = l1; SEND ''loc'' \\ L!q = l2;\n RECV ''range'' \\ p < length L; SEND ''range'' \\ q < length L;\n ''different'' \\ p \\ q;\n ''new loc'' \\ L' = L[p := l1', q := l2'];\n ''new valuation'' \\ u' = [r1@r2\\0]u;\n ''upd'' \\ is_upd s f1 s'; ''upd'' \\ is_upd s' f2 s'';\n ''bounded'' \\ bounded B s''\n \\\n \\ (broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Bin a\\<^esub> \\L', s'', u'\\\" |\n step_broad:\n \"\\\n ''broadcast'' \\ a \\ broadcast;\n TRANS ''out'' \\ (l, b, g, Out a, f, r, l') \\ trans (N ! p);\n TRANS ''in'' \\ (\\p \\ set ps. (L ! p, bs p, gs p, In a, fs p, rs p, ls' p) \\ trans (N ! p));\n ''committed'' \\ (l \\ committed (N ! p) \\ (\\p \\ set ps. L ! p \\ committed (N ! p))\n \\ (\\p < length N. L ! p \\ committed (N ! p)));\n ''bexp'' \\ check_bexp s b True;\n ''bexp'' \\ \\p \\ set ps. check_bexp s (bs p) True;\n ''guard'' \\ u \\ g;\n ''guard'' \\ \\p \\ set ps. u \\ gs p;\n ''maximal'' \\ \\q < length N. q \\ set ps \\ p \\ q\n \\ (\\b g f r l'. (L!q, b, g, In a, f, r, l') \\ trans (N ! q)\n \\ \\ check_bexp s b True \\ \\ u \\ g);\n ''target invariant'' \\ \\p < length N. u' \\ inv (N ! p) (L' ! p);\n SEND ''loc'' \\ L!p = l;\n SEND ''range'' \\ p < length L;\n SEL ''range'' \\ set ps \\ {0.. p \\ set ps;\n SEL ''distinct'' \\ distinct ps;\n SEL ''sorted'' \\ sorted ps;\n ''new loc'' \\ L' = (fold (\\p L . L[p := ls' p]) ps L)[p := l'];\n ''new valuation'' \\ u' = [r@concat (map rs ps)\\0]u;\n ''upd'' \\ is_upd s f s';\n ''upds'' \\ is_upds s' (map fs ps) s'';\n ''bounded'' \\ bounded B s''\n \\\n \\ (broadcast, N, B) \\ \\L, s, u\\ \\\\<^bsub>Broad a\\<^esub> \\L', s'', u'\\\"\nlemmas [intro?] = step_u.intros[unfolded TAG_def]\n\ntext \\Comments:\n\\<^item> Should there be an error transition + state if states run of bounds or updates are undefined?\nThen one could run a reachability check for the error state.\n\\<^item> Should the state be total?\n\\<^item> Note that intermediate states are allowed to run out of bounds\n\\\n\ndefinition steps_u ::\n \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval\n \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval \\ bool\"\n(\"_ \\ \\_, _, _\\ \\* \\_, _, _\\\" [61,61,61,61,61] 61)\nwhere\n \"A \\ \\L, s, u\\ \\* \\L', s', u'\\ \\\n (\\ (L, s, u) (L', s', u'). \\a. A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\)\\<^sup>*\\<^sup>* (L, s, u) (L', s', u')\"\n\nparagraph \\Misc\\\n\nlemma clock_val_concat_iff:\n \\u \\ concat gs \\ (\\g \\ set gs. u \\ g)\\\n by (auto intro: guard_concat concat_guard)\n\nlemma clock_val_append_iff:\n \\u \\ g1 @ g2 \\ u \\ g1 \\ u \\ g2\\\nproof -\n have \"u \\ g1 @ g2 \\ u \\ concat [g1, g2]\"\n by simp\n also have \"... \\ u \\ g1 \\ u \\ g2\"\n unfolding clock_val_concat_iff by simp\n finally show ?thesis .\nqed\n\n\nsubsection \\Product construction\\\n\nlocale Prod_TA_Defs =\n fixes A :: \"('a, 's, 'c, 't, 'x, 'v :: linorder) nta\"\nbegin\n\ndefinition\n \"broadcast = fst A\"\n\ndefinition\n \"N i = fst (snd A) ! i\"\n\ndefinition\n \"bounds = snd (snd A)\"\n\ndefinition \\\\Number of processes\\\n \"n_ps = length (fst (snd A))\"\n\ndefinition states :: \"'s list set\" where\n \"states \\ {L. length L = n_ps \\\n (\\ i. i < n_ps --> L ! i \\ (\\ (l, e, g, a, r, u, l') \\ (trans (N i)). {l, l'}))}\"\n\ndefinition\n \"prod_inv \\ \\(L, s). if L \\ states then concat (map (\\i. inv (N i) (L ! i)) [0.. trans (N p) \\\n (l \\ committed (N p) \\ (\\p < n_ps. L ! p \\ committed (N p))) \\\n L!p = l \\ p < length L \\ L' = L[p := l'] \\ is_upd s f s' \\ check_bexp s b True \\\n L \\ states \\ bounded bounds s \\ bounded bounds s'\n }\"\n\ndefinition\n \"trans_bin =\n {((L, s), g1 @ g2, Bin a, r1 @ r2, (L', s'')) |\n L s L' s' s'' a p q l1 b1 g1 f1 r1 l1' l2 b2 g2 f2 r2 l2'.\n a \\ broadcast \\\n (l1, b1, g1, In a, f1, r1, l1') \\ trans (N p) \\\n (l2, b2, g2, Out a, f2, r2, l2') \\ trans (N q) \\\n (l1 \\ committed (N p) \\ l2 \\ committed (N q) \\ (\\p < n_ps. L ! p \\ committed (N p))) \\\n L!p = l1 \\ L!q = l2 \\ p < length L \\ q < length L \\ p \\ q \\\n check_bexp s b1 True \\ check_bexp s b2 True \\\n L' = L[p := l1', q := l2'] \\ is_upd s f1 s' \\ is_upd s' f2 s'' \\\n L \\ states \\ bounded bounds s \\ bounded bounds s''\n }\"\n\ndefinition\n \"trans_broad =\n {((L, s), g @ concat (map gs ps), Broad a, r @ concat (map rs ps), (L', s'')) |\n L s L' s' s'' a p l b g f r l' bs gs fs rs ls' ps.\n a \\ broadcast \\\n (l, b, g, Out a, f, r, l') \\ trans (N p) \\\n (\\p \\ set ps. (L ! p, bs p, gs p, In a, fs p, rs p, ls' p) \\ trans (N p)) \\\n (l \\ committed (N p) \\ (\\p \\ set ps. L ! p \\ committed (N p))\n \\ (\\p < n_ps. L ! p \\ committed (N p))) \\\n (\\q < n_ps. q \\ set ps \\ p \\ q \\\n \\ (\\b g f r l'. (L!q, b, g, In a, f, r, l') \\ trans (N q) \\ check_bexp s b True)) \\\n L!p = l \\\n p < length L \\ set ps \\ {0.. p \\ set ps \\ distinct ps \\ sorted ps \\\n check_bexp s b True \\ (\\p \\ set ps. check_bexp s (bs p) True) \\\n L' = (fold (\\p L . L[p := ls' p]) ps L)[p := l'] \\\n is_upd s f s' \\ is_upds s' (map fs ps) s'' \\\n L \\ states \\ bounded bounds s \\ bounded bounds s''\n }\"\n\ndefinition\n \"trans_prod = trans_int \\ trans_bin \\ trans_broad\"\n\ndefinition\n \"prod_ta = (trans_prod, prod_inv :: ('s list \\ ('x \\ 'v option) \\ _))\"\n\nlemma inv_of_prod[simp]:\n \"inv_of prod_ta = prod_inv\"\n unfolding prod_ta_def inv_of_def by simp\n\nlemma trans_of_prod[simp]:\n \"trans_of prod_ta = trans_prod\"\n unfolding prod_ta_def trans_of_def by simp\n\nlemma A_split:\n \\A = (broadcast, map N [0..\n unfolding broadcast_def N_def bounds_def n_ps_def by (cases A) (simp add: List.map_nth)\n\nlemma map_N_n_ps_simp:\n \"map N [0.. (\\ (l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\" \"L \\ states\"\n shows \"L[p := l'] \\ states\"\n using assms unfolding states_def by (fastforce simp: nth_list_update')\n\nlemma state_preservation_fold_updI:\n assumes \"\\p \\ set ps. ls' p \\ (\\ (l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\" \"L \\ states\"\n shows \"fold (\\p L. L[p := ls' p]) ps L \\ states\"\n using assms by (induction ps arbitrary: L) (auto intro: state_preservation_updI)\n\nlemma state_set_states:\n \"Simulation_Graphs_TA.state_set prod_ta \\ {(l, s). l \\ states}\"\n unfolding prod_ta_def state_set_def\n unfolding trans_of_def trans_prod_def\n unfolding trans_int_def trans_bin_def trans_broad_def\n by auto (auto intro: state_preservation_updI state_preservation_fold_updI)\n\nlemma trans_prod_bounded_inv:\n \\bounded bounds s'\\ if \\((L, s), g, a, r, (L', s')) \\ trans_prod\\\n using that unfolding bounds_def trans_prod_def trans_int_def trans_bin_def trans_broad_def\n by (auto simp: bounds_def)\n\nlemma trans_prod_states_inv:\n \\L' \\ states\\ if \\((L, s), g, a, r, (L', s')) \\ trans_prod\\ \\L \\ states\\\n using that\n unfolding bounds_def trans_prod_def trans_int_def trans_bin_def trans_broad_def\n apply clarsimp\n apply safe\n apply (force intro!: state_preservation_updI)\n apply (force intro!: state_preservation_updI)\n apply (force intro!: state_preservation_updI)\n apply (force intro!: state_preservation_updI)\n apply (force intro!: state_preservation_updI)\n apply (fastforce intro!: state_preservation_updI state_preservation_fold_updI)\n subgoal\n apply (rule state_preservation_updI)\n apply force\n apply (force intro!: state_preservation_fold_updI)\n done\n apply (fastforce intro!: state_preservation_updI state_preservation_fold_updI)\n done\n\nend (* Prod TA Defs *)\n\n\nlocale Prod_TA_sem =\n Prod_TA_Defs A for A :: \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta\"\nbegin\n\nlemma prod_invI[intro]:\n \\u \\ prod_inv (L, s)\\ if \\\\p Simple_Network_Language.inv (N p) (L ! p)\\\n using that unfolding prod_inv_def by (auto intro!: guard_concat)\n\nlemma prod_invD[dest]:\n \\\\p Simple_Network_Language.inv (N p) (L ! p)\\ if \\u \\ prod_inv (L, s)\\ \\L \\ states\\\n using that unfolding prod_inv_def by (auto elim: concat_guard)\n\nlemma delay_sound:\n assumes \"prod_ta \\ \\(L, s), u\\ \\\\<^bsup>d\\<^esup> \\(L', s'), u'\\\" \"L \\ states\" \"bounded bounds s\"\n \"\\N \\ set (fst (snd A)). urgent N = {}\"\n shows \"A \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L', s', u'\\\"\nproof -\n from assms(4) have \"l \\ urgent (N p)\" if \"p < n_ps\" for p l\n using that unfolding N_def n_ps_def by auto\n then show ?thesis\n by (subst A_split) (use assms in \\cases, auto intro!: step_t simp: TAG_def\\)\nqed\n\nlemma action_sound:\n \"A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\" if \"prod_ta \\ \\(L, s), u\\ \\\\<^bsub>a\\<^esub> \\(L', s'), u'\\\"\n using that\nproof cases\n case prems: (1 g r)\n note [simp add] = map_N_n_ps_simp clock_val_append_iff clock_val_concat_iff\n from \\prod_ta \\ (L, s) \\\\<^bsup>g,a,r\\<^esup> (L', s')\\[THEN state_setI2] have \"L' \\ states\"\n using state_set_states that by fast\n from \\prod_ta \\ (L, s) \\\\<^bsup>g,a,r\\<^esup> (L', s')\\ show ?thesis\n unfolding trans_of_prod trans_prod_def\n proof safe\n assume \"((L, s), g, a, r, L', s') \\ trans_int\"\n then show \"A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\"\n unfolding trans_int_def\n apply clarsimp\n using prems \\L' \\ _\\\n by (subst A_split) (intro step_int; simp add: TAG_def; elim prod_invD; assumption)\n next\n assume \"((L, s), g, a, r, L', s') \\ trans_bin\"\n then show \"A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\"\n unfolding trans_bin_def\n using prems \\L' \\ _\\\n apply clarsimp\n apply (subst A_split, standard)\n apply (assumption | simp; elim prod_invD; assumption)+\n done\n next\n assume \"((L, s), g, a, r, L', s') \\ trans_broad\"\n then show \"A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\"\n using prems \\L' \\ _\\\n unfolding trans_broad_def inv_of_prod\n apply clarsimp\n apply (subst A_split)\n apply standard\n apply (assumption | simp; elim prod_invD; assumption | fastforce)+\n done\n qed\nqed\n\nlemma bounded_inv:\n \\bounded bounds s'\\ if \\A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\\\n using that unfolding bounds_def by cases (simp add: TAG_def)+\n\nlemma states_inv:\n \\L' \\ states\\ if \\A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\\ \\L \\ states\\\n using that unfolding bounds_def\nproof cases\n case (step_t N d B broadcast)\n with \\L \\ states\\ show ?thesis\n by simp\nnext\n case prems[unfolded TAG_def]: (step_int l b g a f r l' N' p B broadcast)\n from \\A = _\\ prems(3) have \"l' \\ (\\ (l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\"\n by force\n with \\L \\ states\\ show ?thesis\n unfolding \\L' = _\\ by (intro state_preservation_updI)\nnext\n case prems[unfolded TAG_def]:\n (step_bin broadcast a l1 b1 g1 f1 r1 l1' N' p l2 b2 g2 f2 r2 l2' q s' B)\n from \\A = _\\ prems(4, 5) have\n \"l1' \\ (\\ (l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\"\n \"l2' \\ (\\ (l, b, g, a, r, u, l') \\ trans (N q). {l, l'})\"\n by force+\n with \\L \\ states\\ show ?thesis\n unfolding \\L' = _\\ by (intro state_preservation_updI)\nnext\n case prems[unfolded TAG_def]: (step_broad a broadcast l b g f r l' N' p ps bs gs fs rs ls' s' B)\n from \\A = _\\ prems(4, 5) have\n \"l' \\ (\\ (l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\"\n \"\\ q \\ set ps. ls' q \\ (\\ (l, b, g, a, r, u, l') \\ trans (N q). {l, l'})\"\n by force+\n with \\L \\ states\\ show ?thesis\n unfolding \\L' = _\\ by (intro state_preservation_updI state_preservation_fold_updI)\nqed\n\nend (* Prod TA Defs on a time domain *)\n\n\nlocale Prod_TA =\n Prod_TA_sem A for A :: \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta\" +\n assumes broadcast_receivers_unguarded:\n \"\\p < n_ps. \\l b g a f r l'. (l, b, g, In a, f, r, l') \\ trans (N p) \\ a \\ broadcast \\ g = []\"\nbegin\n\nlemma action_complete:\n \"prod_ta \\ \\(L, s), u\\ \\\\<^bsub>a\\<^esub> \\(L', s'), u'\\\"\n if \"A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\\" \"a \\ Del\" \"L \\ states\" \"bounded bounds s\"\nusing that(1) proof cases\n case (step_t N d B broadcast)\n then show ?thesis\n using that(2) by auto\nnext\n case prems[unfolded TAG_def]: (step_int l b g a' f r l' N' p B broadcast')\n have [simp]:\n \"B = bounds\" \"broadcast' = broadcast\" \"length N' = n_ps\"\n unfolding bounds_def broadcast_def n_ps_def unfolding prems(1) by simp+\n have [simp]:\n \"N' ! i = N i\" for i\n unfolding N_def unfolding prems(1) by simp\n have \"prod_ta \\ (L, s) \\\\<^bsup>g,Internal a',r\\<^esup> (L', s')\"\n proof -\n from prems \\L \\ states\\ \\bounded _ s\\ have \"((L, s),g,Internal a',r,(L', s')) \\ trans_int\"\n unfolding trans_int_def\n by simp (rule exI conjI HOL.refl | assumption | (simp; fail))+\n then show ?thesis\n unfolding prod_ta_def trans_of_def trans_prod_def by simp\n qed\n moreover have \"u \\ g\"\n by (rule prems)\n moreover have \"u' \\ inv_of prod_ta (L', s')\"\n using prems(7) by auto\n moreover have \"u' = [r\\0]u\"\n by (rule prems)\n ultimately show ?thesis\n unfolding \\a = _\\ ..\nnext\n case prems[unfolded TAG_def]:\n (step_bin a' broadcast' l1 b1 g1 f1 r1 l1' N' p l2 b2 g2 f2 r2 l2' q s'' B)\n have [simp]:\n \"B = bounds\" \"broadcast' = broadcast\" \"length N' = n_ps\"\n unfolding bounds_def broadcast_def n_ps_def unfolding prems(1) by simp+\n have [simp]:\n \"N' ! i = N i\" for i\n unfolding N_def unfolding prems(1) by simp\n have \"prod_ta \\ (L, s) \\\\<^bsup>g1 @ g2,Bin a',r1 @ r2\\<^esup> (L', s')\"\n proof -\n from prems \\L \\ states\\ \\bounded bounds s\\ have\n \"((L, s),g1 @ g2,Bin a',r1 @ r2,(L', s')) \\ trans_bin\"\n unfolding trans_bin_def\n using [[simproc add: ex_reorder4]]\n by simp (rule exI conjI HOL.refl | assumption | fast)+\n then show ?thesis\n unfolding prod_ta_def trans_of_def trans_prod_def by simp\n qed\n moreover have \"u \\ g1 @ g2\"\n using \\u \\ g1\\ \\u \\ g2\\ by (rule guard_append)\n moreover have \"u' \\ inv_of prod_ta (L', s')\"\n using prems by auto\n moreover have \"u' = [r1@r2\\0]u\"\n by (rule prems)\n ultimately show ?thesis\n unfolding \\a = _\\ ..\nnext\n case prems[unfolded TAG_def]: (step_broad a' broadcast' l b g f r l' N' p ps bs gs fs rs ls' s'' B)\n have [simp]:\n \"B = bounds\" \"broadcast' = broadcast\" \"length N' = n_ps\"\n unfolding bounds_def broadcast_def n_ps_def unfolding prems(1) by simp+\n have [simp]:\n \"N' ! i = N i\" for i\n unfolding N_def unfolding prems(1) by simp\n let ?r = \"r @ concat (map rs ps)\" and ?g = \"g @ concat (map gs ps)\"\n have \"prod_ta \\ (L, s) \\\\<^bsup>?g,Broad a',?r\\<^esup> (L', s')\"\n proof -\n have *: \"\\ u \\ g \\ False\" if\n \"p < n_ps\" \"(l, b, g, In a', f, r, l') \\ Simple_Network_Language.trans (N p)\"\n \"a' \\ broadcast\"\n for l b g a' f r l' p\n proof -\n from that broadcast_receivers_unguarded have \\g = []\\\n by blast\n then show ?thesis\n by auto\n qed\n from prems \\L \\ states\\ \\bounded bounds s\\ have \"((L, s),?g,Broad a',?r,(L', s')) \\ trans_broad\"\n unfolding trans_broad_def\n by clarsimp\n (intro exI conjI HOL.refl; (rule HOL.refl | assumption | fastforce simp: *))\n then show ?thesis\n unfolding prod_ta_def trans_of_def trans_prod_def by simp\n qed\n moreover have \"u \\ ?g\"\n using prems by (auto intro!: guard_append guard_concat)\n moreover have \"u' \\ inv_of prod_ta (L', s')\"\n using prems by auto\n moreover have \"u' = [?r\\0]u\"\n by (rule prems)\n ultimately show ?thesis\n unfolding \\a = _\\ ..\nqed\n\nlemma delay_complete:\n assumes \"A \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L', s', u'\\\"\n obtains d where \"prod_ta \\ \\(L, s), u\\ \\\\<^bsup>d\\<^esup> \\(L', s'), u'\\\"\n using assms\nproof cases\n case prems: (step_t N' d B broadcast)\n have [simp]:\n \"length N' = n_ps\"\n unfolding n_ps_def unfolding prems(1) by simp+\n have [simp]:\n \"N' ! i = N i\" for i\n unfolding N_def unfolding prems(1) by simp\n from prems show ?thesis\n by (intro that[of d]; unfold \\u' = _\\ \\L' = L\\ \\s' = s\\ TAG_def)\n (rule step_t.intros; (unfold inv_of_prod; rule prod_invI)?; simp)\nqed\n\nlemma step_iff:\n \"(\\ a. A \\ \\L, s, u\\ \\\\<^bsub>a\\<^esub> \\L', s', u'\\) \\ prod_ta \\ \\(L, s), u\\ \\ \\(L', s'), u'\\\"\n if \"bounded bounds s\" \"L \\ states\" \"\\N \\ set (fst (snd A)). urgent N = {}\"\n using that(1,2)\n apply (auto intro: action_sound delay_sound[OF _ _ _ that(3)])\n subgoal for a\n by (cases a; blast dest: action_complete elim: delay_complete)\n done\n\nend (* Prod TA *)\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/Simple_Network_Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2600265351284482}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory PleSle\nimports\n \"BilbyFsConsts.BilbyFs_Shallow_Desugar_Tuples\"\n \"../adt/WordArrayT\"\n \"../adt/ArrayT\"\n \"../adt/BufferT\"\n \"HOL-Eisbach.Eisbach\"\nbegin\n\ntext{* axioms and lemmas that are *not* specific to 32 word. -> should be refactored.*}\naxiomatization\nwhere\n u32_to_u8_is_ucast:\n \"u32_to_u8 = ucast\"\nand\n u64_to_u8_is_ucast:\n \"u64_to_u8 = ucast\"\nand\n u64_to_u32_is_ucast:\n \"u64_to_u32 = ucast\"\nand\n u16_to_u8_is_ucast:\n \"u16_to_u8 = ucast\"\n \nlemmas less_to_le = order_class.order.strict_implies_order\n\nlemma test_bit_out_of_bounds:\n \"\\n \\ 8\\ \\ ((w :: 8 word) !! n) = False\"\n by (auto dest!: test_bit_size simp:word_size)\n \nlemma mod_range_eq:\n \"\\n \\ (a::nat)*8; (n::nat) < (a+1)*8\\ \\ n mod 8 = n - (a*8)\"\n by (simp add: div_nat_eqI modulo_nat_def mult.commute)\n \nlemma range_le:\n \"\\(n :: nat) \\ (a::nat)*8; n < (a+1)*8\\ \\\n n - (a*8) < 8\"\n by simp\n \nlemma div_range_le:\n \"\\n < (a*8)\\ \\ (n :: nat) div 8 < a\"\n by auto\n\nlemma take_decomp:\n \"length l \\ n \\ n > 0 \\ (take n l) = ((hd l) # (take (n - 1) (tl l)))\"\n by (induct l) (simp add: take_Cons split: nat.split)+\n \nlemma take_drop_decomp:\n \"k < length l \\ length (drop k l) \\ n \\ n > 0 \n \\ take n (drop k l) = (l ! k) # take (n - 1) (drop (k + 1) l)\"\n by (simp add: take_decomp hd_drop_conv_nth drop_Suc[symmetric] drop_tl[symmetric])\n\nlemma elem_take_n:\n \"i (take n xs ! i) = xs ! i\"\n by simp\n \nlemma take_n_eq_simp:\n \"take len ys = take len xs \\\n idx < len \\\n ys !idx = xs !idx\"\nby (metis elem_take_n)\n\n lemma take_n_and_len'_eq_simp:\n \"take len ys = take len xs \\\n idx < len' \\\n len' \\ len \\\n ys !idx = xs !idx\"\nby (erule take_n_eq_simp) simp\n\nlemma drop_n_then_nth_eq:\n assumes \"n + i \\ length xs\"\n assumes \"n + i \\ length ys\"\n assumes \"ys ! (n + i) = xs ! (n + i)\"\n shows \"drop n ys ! (0 + i) = drop n xs ! (0 + i)\"\n using assms by auto\n \n lemma drop_n_then_nth_eq_wo_0:\n assumes \"n + i \\ length xs\"\n assumes \"n + i \\ length ys\"\n assumes \"ys ! (n + i) = xs ! (n + i)\"\n shows \"drop n ys ! i = drop n xs ! i\"\n using assms by auto\n\nlemma plus_no_overflow_unat_lift: \n \"(a::'a::len word ) < a + b \\ unat (a+b) = unat a + unat b\"\n by unat_arith\n\n\nmethod handle_wa_mod for offs :: \"U32\" =\n(rule wordarray_modify_ret[where index=offs, simplified Let_def],\n simp_all add: wordarray_make ArrA.defs ElemAO.defs ElemA.defs\n setu8_def[unfolded tuple_simps sanitizers], unat_arith)\n\nlemma take_list_update:\n \"i < length xs\n \\ take n (xs[i := x]) = (if i < n then (take n xs)[i := x] else take n xs)\"\n by (induct xs arbitrary: n i, simp_all add: take_Cons split: nat.split)\n\nlemma drop_list_update:\n \"i < length xs\n \\ drop n (xs[i := x]) = (if i < n then drop n xs else (drop n xs)[i - n := x])\"\n by (induct xs arbitrary: n i, simp_all add: drop_Cons split: nat.split)\n\ndefinition ple16 :: \"8 word list \\ 32 word \\ 16 word\"\nwhere\n \"ple16 data offs \\ word_rcat (rev (take 2 (drop (unat offs) data)))\"\n \ndefinition sle16 :: \"U16 \\ U8 list\"\nwhere\n \"sle16 \\ rev \\ word_rsplit\"\n \nlemma deserialise_le16_ret:\nassumes valid_offs:\n \"unat offs + 1 < length (\\wa $ data\\<^sub>f buf)\"\nassumes no_ovf:\n \"offs < offs + 2\"\nshows\n \"deserialise_le16 (buf, offs) = (ple16 (\\wa $ data\\<^sub>f buf) offs)\"\nusing valid_offs\n apply (subgoal_tac \"(\\i\\{0..1}. unat (offs+i) < length (\\wa (data\\<^sub>f buf)))\")\n prefer 2\n apply unat_arith\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple16_def \n deserialise_le16_def)\n apply (subgoal_tac \"(unat (offs + 1) > 0)\")\n prefer 2\n apply (drule_tac x=1 in bspec, simp)\n using no_ovf apply unat_arith\n apply auto[1]\n apply (subst take_drop_decomp, (simp+))+\n apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=2], simp add: word_size)\n apply simp\n apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n\nlemma serial_le16_helper:\n \"unat offs + 2 < length (\\wa (data\\<^sub>f buf)) \\\n [u16_to_u8 v, u16_to_u8 (v >> 8)]\n = sle16 v\"\n apply (clarsimp simp: u16_to_u8_is_ucast sle16_def)\n apply (subst word_rsplit_upt[where n=2])\n apply ((simp add: word_size upt_rec)+)[2]\n apply (simp add: upt_rec)\n done\n \nlemma serialise_le16_ret:\n assumes no_overflow: \"offs < offs + 2\"\n and valid_offs:\n \"unat offs + 2 < length (\\wa (data\\<^sub>f buf))\"\nshows\n \"(serialise_le16 (buf, offs, v)) =\n buf \\data\\<^sub>f:=WordArrayT.make (buf_sub_slice buf offs (offs+2) (sle16 v))\\\"\nproof -\n have unat_plus:\n \"\\n. n \\ 2 \\ unat (offs + n) = unat offs + unat n\"\n using no_overflow valid_offs\n by clarsimp unat_arith\n show ?thesis\n using valid_offs\n apply (simp add: serialise_le16_def[unfolded sanitizers] serialise_u8_def[unfolded sanitizers] Let_def)\n apply (handle_wa_mod \"offs\")\n apply (handle_wa_mod \"offs+1\")\n apply (simp add: serial_le16_helper[OF valid_offs, where v=v,symmetric])\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n \n apply (simp add: buf_sub_slice_def)\n apply (rule trans, rule_tac n=\"unat offs\" in append_take_drop_id[symmetric],\n rule arg_cong2[where f=append])\n apply (simp add: unat_plus order_le_less_trans[OF _ valid_offs] take_list_update)\n apply (simp add: unat_plus)\n apply (cut_tac valid_offs, simp)\n apply (simp add: max_absorb1)\n apply clarsimp\n apply (simp add: list_eq_iff_nth_eq)\n apply (rule conjI)\n using valid_offs\n apply (simp add: nth_Cons split: nat.split)\n using valid_offs\n apply (clarsimp simp only:)\n apply (subst nth_list_update, unat_arith) +\n apply clarsimp\n apply (rule arg_cong[where f=\"nth (\\wa (data\\<^sub>f buf))\"])\n apply simp\n done\nqed\n\n\nlemma ple16_take:\n assumes offs:\"offs < offs+2\"\n assumes ntake:\"unat (offs + 2) \\ ntake\"\n shows \"ple16 (take ntake ys) offs = ple16 ys offs\"\n apply (simp add: ple16_def)\n apply (rule arg_cong[where f=\"word_rcat\"])\n apply (rule arg_cong[where f=\"rev\"])\n apply (subst list_eq_iff_nth_eq)\n using offs ntake less_to_le[OF offs, simplified unat_plus_simple]\n apply fastforce\n done\n \nlemma ple16_append:\n assumes no_overflow: \"offs < offs + 2\" \n assumes len_ys: \"unat (offs + 2) \\ length ys\"\n shows \"ple16 (ys@zs) offs = ple16 ys offs\"\n using plus_no_overflow_unat_lift[OF no_overflow] len_ys\n by (simp add: ple16_def)\n \nlemma ple16_append_Cons:\n assumes no_overflow: \"offs < offs + 2\"\n assumes len_ys: \"unat (offs + 2) \\ length (v#ys)\"\n shows \"ple16 (v#ys@zs) offs = ple16 (v#ys) offs\"\nproof -\n have unat_nth_simp_Cons: \"\\ n xs ys . \n unat n < Suc (length xs) \\ (v#xs@ys)!(unat n) = (v#xs)!(unat n)\"\n by (case_tac \"0 < unat n\") (fastforce simp: nth_append) +\n show ?thesis\n apply(subgoal_tac \"unat offs < Suc (length ys)\")\n apply(rule ple16_append[where ys = \"v#ys\" and zs = \"zs\" and offs=\"offs\", \n simplified List.append.append_Cons])\n using no_overflow apply clarsimp\n using len_ys apply clarsimp\n using assms by unat_arith\nqed\n\ndefinition ple64 :: \"8 word list \\ 32 word \\ 64 word\"\nwhere\n \"ple64 data offs \\ word_rcat (rev (take 8 (drop (unat offs) data)))\"\n\ndefinition ple32 :: \"8 word list \\ 32 word \\ 32 word\"\nwhere\n \"ple32 data offs \\ word_rcat (rev (take 4 (drop (unat offs) data)))\"\n\ndefinition sle32 :: \"U32 \\ U8 list\"\nwhere\n \"sle32 \\ rev \\ word_rsplit\"\n\nlemma deserialise_le32_ret:\nassumes valid_offs:\n \"unat offs + 3 < length (\\wa $ data\\<^sub>f buf)\"\nassumes no_ovf:\n \"offs < offs + 3\"\nshows\n \"deserialise_le32 (buf, offs) = (ple32 (\\wa $ data\\<^sub>f buf) offs)\"\nusing valid_offs\n apply (subgoal_tac \"(\\i\\{0..3}. unat (offs+i) < length (\\wa (data\\<^sub>f buf)))\")\n prefer 2\n apply unat_arith\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple32_def \n deserialise_le32_def)\n apply (subgoal_tac \"\\j\\{1..3}. (unat (offs + j) > 0)\")\n prefer 2\n apply clarsimp\n apply (drule_tac x=j in bspec, simp)\n using no_ovf apply unat_arith\n apply auto[1]\n apply (subst take_drop_decomp, (simp+))+\n apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n apply simp\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=4], simp add: word_size)\n apply simp\n apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n\n\nlemma serial_le32_helper:\n \"unat offs + 4 < length (\\wa (data\\<^sub>f buf)) \\\n [u32_to_u8 v, u32_to_u8 (v >> 8), u32_to_u8 (v >> 16), u32_to_u8 (v >> 24)]\n = sle32 v\"\n apply (clarsimp simp: u32_to_u8_is_ucast sle32_def)\n apply (subst word_rsplit_upt[where n=4])\n apply ((simp add: word_size upt_rec)+)[2]\n apply (simp add: upt_rec)\n done\n \nlemma serialise_le32_ret:\n assumes no_overflow: \"offs < offs + 4\"\n and valid_offs:\n \"unat offs + 4 < length (\\wa (data\\<^sub>f buf))\"\n notes wa_modify_ret = wordarray_modify_ret[rotated - 1, simplified Let_def]\nshows\n \"(serialise_le32 (buf, offs, v)) =\n buf\\data\\<^sub>f:=WordArrayT.make (buf_sub_slice buf offs (offs+4) (sle32 v))\\\"\nproof -\n have unat_plus:\n \"\\n. n \\ 4 \\ unat (offs + n) = unat offs + unat n\"\n using no_overflow valid_offs\n by unat_arith auto\n show ?thesis\n using valid_offs\n apply (simp add: serialise_le32_def[unfolded sanitizers] serialise_u8_def[unfolded sanitizers] Let_def)\n apply (handle_wa_mod \"offs\")\n apply (handle_wa_mod \"offs+1\")\n apply (handle_wa_mod \"offs+2\")\n apply (handle_wa_mod \"offs+3\")\n apply (simp add: serial_le32_helper[OF valid_offs, where v=v,symmetric])\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n \n apply (simp add: buf_sub_slice_def)\n apply (rule trans, rule_tac n=\"unat offs\" in append_take_drop_id[symmetric],\n rule arg_cong2[where f=append])\n apply (simp add: unat_plus order_le_less_trans[OF _ valid_offs] take_list_update)\n apply (simp add: unat_plus)\n apply (cut_tac valid_offs, simp)\n apply (simp add: max_absorb1)\n apply (simp add: list_eq_iff_nth_eq)\n apply (rule conjI)\n using valid_offs\n apply (simp add: nth_Cons split: nat.split)\n using valid_offs\n apply (clarsimp simp only:)\n apply (subst nth_list_update, unat_arith) +\n apply force\n done\nqed\n\nlemma ple32_take:\n assumes offs:\"offs < offs+4\"\n assumes ntake:\"unat (offs + 4) \\ ntake\"\n shows \"ple32 (take ntake ys) offs = ple32 ys offs\"\n apply (simp add: ple32_def)\n apply (rule arg_cong[where f=\"word_rcat\"])\n apply (rule arg_cong[where f=\"rev\"])\n apply (subst list_eq_iff_nth_eq)\n using offs ntake less_to_le[OF offs, simplified unat_plus_simple]\n apply fastforce\n done\n \nlemma plus4_offs_ntake:\n fixes offs ::U32\n assumes \"unat (offs + 4) \\ ntake\"\n assumes offs_overflow: \" (offs) < ((offs+4))\"\n assumes \"n \\ {0,1,2,3}\"\n shows \"unat (offs+n) < ntake\"\n using assms apply (clarsimp)\n apply (erule disjE, unat_arith, fastforce?)+\n apply simp\n apply unat_arith\n done\n \nlemma ple32_append:\n assumes no_overflow: \"offs < offs+4\" \n assumes len_ys: \"unat (offs + 4) \\ length ys\"\n shows \"ple32 (ys@zs) offs = ple32 ys offs\"\n using plus_no_overflow_unat_lift[OF no_overflow] len_ys\n by (simp add: ple32_def)\n \nlemma ple32_append_Cons:\n assumes no_overflow: \"offs < offs+4\"\n assumes len_ys: \"unat (offs + 4) \\ length (v#ys)\"\n shows \"ple32 (v#ys@zs) offs = ple32 (v#ys) offs\"\nproof -\n have unat_nth_simp_Cons: \"\\ n xs ys . \n unat n < Suc (length xs) \\ (v#xs@ys)!(unat n) = (v#xs)!(unat n)\"\n by (case_tac \"0 < unat n\") (fastforce simp: nth_append) +\n show ?thesis\n apply(subgoal_tac \"unat offs < Suc (length ys)\")\n apply(rule ple32_append[where ys = \"v#ys\" and zs = \"zs\" and offs=\"offs\", simplified List.append.append_Cons])\n using no_overflow apply clarsimp\n using len_ys apply clarsimp\n using assms by unat_arith\nqed\n\n \ndefinition sle64 :: \"U64 \\ U8 list\"\nwhere\n \"sle64 \\ rev \\ word_rsplit\"\n\nlemma deserialise_le64_ret:\nassumes valid_offs:\n \"unat offs + 8 \\ length (\\wa $ data\\<^sub>f buf)\"\nassumes no_ovf:\n \"offs \\ offs + 8\"\nshows\n \"deserialise_le64 (buf, offs) = (ple64 (\\wa $ data\\<^sub>f buf) offs)\"\nusing valid_offs\n apply (subgoal_tac \"(\\i\\{0..7}. unat (offs+i) < length (\\wa (data\\<^sub>f buf)))\")\n prefer 2\n apply unat_arith\n apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple64_def \n deserialise_le64_def)\n apply (subgoal_tac \"\\j\\{1..7}. (unat (offs + j) > 0)\")\n prefer 2\n apply clarsimp\n apply (drule_tac x=j in bspec, simp)\n using no_ovf apply unat_arith\n apply auto[1]\n apply (subst take_drop_decomp, (simp+))+\n apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs])[1])+\n apply simp\n apply (rule trans, rule word_rcat_rsplit[symmetric])\n apply (rule arg_cong[where f=word_rcat])\n apply (subst word_rsplit_upt[where n=8], simp add: word_size)\n apply simp\n apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n\nlemma serial_le64_helper:\n \"unat offs + 8 < length (\\wa (data\\<^sub>f buf)) \\\n [u64_to_u8 v, u64_to_u8 (v >> 8), u64_to_u8 (v >> 16), u64_to_u8 (v >> 24),\n u64_to_u8 (v >> 32), u64_to_u8 (v >> 40), u64_to_u8 (v >> 48), u64_to_u8 (v >> 56)]\n = sle64 v\"\n apply (clarsimp simp: u64_to_u8_is_ucast sle64_def)\n apply (subst word_rsplit_upt[where n=8])\n apply ((simp add: word_size upt_rec)+)[2]\n apply (simp add: upt_rec)\n done\n\nlemma serialise_le64_ret:\n assumes no_overflow: \"offs < offs + 8\"\n and valid_offs:\n \"unat offs + 8 < length (\\wa (data\\<^sub>f buf))\"\nshows\n \"(serialise_le64 (buf, offs, v)) =\n buf\\data\\<^sub>f:=WordArrayT.make (buf_sub_slice buf offs (offs+8) (sle64 v))\\\"\nproof -\n have unat_plus:\n \"\\n. n \\ 8 \\ unat (offs + n) = unat offs + unat n\"\n using no_overflow valid_offs\n by unat_arith auto\n show ?thesis\n\n apply (simp add: serialise_le64_def[unfolded sanitizers] serialise_u8_def[unfolded sanitizers] Let_def)\n using valid_offs apply -\n apply (handle_wa_mod \"offs\")\n apply (handle_wa_mod \"offs+1\")\n apply (handle_wa_mod \"offs+2\")\n apply (handle_wa_mod \"offs+3\")\n apply (handle_wa_mod \"offs+4\")\n apply (handle_wa_mod \"offs+5\")\n apply (handle_wa_mod \"offs+6\")\n apply (handle_wa_mod \"offs+7\")\n apply (simp add: serial_le64_helper[OF valid_offs, where v=v,symmetric])\n\n apply (rule arg_cong[where f=\"\\v. Buffer.data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=\"WordArrayT.make\"])\n \n apply (simp add: buf_sub_slice_def)\n apply (rule trans, rule_tac n=\"unat offs\" in append_take_drop_id[symmetric],\n rule arg_cong2[where f=append])\n apply (simp add: unat_plus order_le_less_trans[OF _ valid_offs] take_list_update)\n apply (simp add: unat_plus)\n apply (cut_tac valid_offs, simp)\n apply (simp add: max_absorb1)\n apply (simp add: list_eq_iff_nth_eq)\n apply (rule conjI)\n using valid_offs\n apply (simp add: nth_Cons split: nat.split)\n using valid_offs\n apply (clarsimp simp only:)\n apply (subst nth_list_update, unat_arith) +\n apply force\n done\nqed\n\nlemma ple64_take:\n assumes offs:\"offs < offs+8\"\n assumes ntake:\"unat (offs + 8) \\ ntake\"\n shows \"ple64 (take ntake ys) offs = ple64 ys offs\"\n apply (simp add: ple64_def)\n apply (rule arg_cong[where f=\"word_rcat\"])\n apply (rule arg_cong[where f=\"rev\"])\n apply (subst list_eq_iff_nth_eq)\n using offs ntake less_to_le[OF offs, simplified unat_plus_simple]\n apply fastforce\n done\n \nlemma ple64_append:\n assumes no_overflow: \"offs < offs + 8\" \n assumes len_ys: \"unat (offs + 8) \\ length ys\"\n shows \"ple64 (ys@zs) offs = ple64 ys offs\"\n using plus_no_overflow_unat_lift[OF no_overflow] len_ys\n by (simp add: ple64_def)\n \nlemma ple64_append_Cons:\n assumes no_overflow: \"offs < offs + 8\"\n assumes len_ys: \"unat (offs + 8) \\ length (v#ys)\"\n shows \"ple64 (v#ys@zs) offs = ple64 (v#ys) offs\"\nproof -\n have unat_nth_simp_Cons: \"\\ n xs ys . \n unat n < Suc (length xs) \\ (v#xs@ys)!(unat n) = (v#xs)!(unat n)\"\n by (case_tac \"0 < unat n\") (fastforce simp: nth_append) +\n show ?thesis\n apply(subgoal_tac \"unat offs < Suc (length ys)\")\n apply(rule ple64_append[where ys = \"v#ys\" and zs = \"zs\" and offs=\"offs\", simplified List.append.append_Cons])\n using no_overflow apply clarsimp\n using len_ys apply clarsimp\n using assms by unat_arith\nqed\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/spec/PleSle.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.26002653512844814}} {"text": "(* \n Author: Salomon Sickert\n License: BSD\n*)\n\nsection \\LTL Translation Layer\\\n\ntheory LTL_Compat\n imports Main LTL.LTL \"../LTL_FGXU\"\nbegin\n\n\\ \\The following infrastructure translates the generic @{datatype ltln} datatype to special structure used in this project\\\n\nabbreviation LTLRelease :: \"'a ltl \\ 'a ltl \\ 'a ltl\" (\"_ R _\" [87,87] 86)\nwhere\n \"\\ R \\ \\ (G \\) or (\\ U (\\ and \\))\"\n\nabbreviation LTLWeakUntil :: \"'a ltl \\ 'a ltl \\ 'a ltl\" (\"_ W _\" [87,87] 86)\nwhere\n \"\\ W \\ \\ (\\ U \\) or (G \\)\"\n\nabbreviation LTLStrongRelease :: \"'a ltl \\ 'a ltl \\ 'a ltl\" (\"_ M _\" [87,87] 86)\nwhere\n \"\\ M \\ \\ \\ U (\\ and \\)\"\n\nfun ltln_to_ltl :: \"'a ltln \\ 'a ltl\"\nwhere\n \"ltln_to_ltl true\\<^sub>n = true\"\n| \"ltln_to_ltl false\\<^sub>n = false\"\n| \"ltln_to_ltl prop\\<^sub>n(q) = p(q)\"\n| \"ltln_to_ltl nprop\\<^sub>n(q) = np(q)\"\n| \"ltln_to_ltl (\\ and\\<^sub>n \\) = ltln_to_ltl \\ and ltln_to_ltl \\\"\n| \"ltln_to_ltl (\\ or\\<^sub>n \\) = ltln_to_ltl \\ or ltln_to_ltl \\\"\n| \"ltln_to_ltl (\\ U\\<^sub>n \\) = (if \\ = true\\<^sub>n then F (ltln_to_ltl \\) else (ltln_to_ltl \\) U (ltln_to_ltl \\))\"\n| \"ltln_to_ltl (\\ R\\<^sub>n \\) = (if \\ = false\\<^sub>n then G (ltln_to_ltl \\) else (ltln_to_ltl \\) R (ltln_to_ltl \\))\"\n| \"ltln_to_ltl (\\ W\\<^sub>n \\) = (if \\ = false\\<^sub>n then G (ltln_to_ltl \\) else (ltln_to_ltl \\) W (ltln_to_ltl \\))\"\n| \"ltln_to_ltl (\\ M\\<^sub>n \\) = (if \\ = true\\<^sub>n then F (ltln_to_ltl \\) else (ltln_to_ltl \\) M (ltln_to_ltl \\))\"\n| \"ltln_to_ltl (X\\<^sub>n \\) = X (ltln_to_ltl \\)\"\n\nlemma ltln_to_ltl_semantics:\n \"w \\ ltln_to_ltl \\ \\ w \\\\<^sub>n \\\"\n by (induction \\ arbitrary: w)\n (simp_all del: semantics_ltln.simps(9-11), unfold ltln_Release_alterdef ltln_weak_strong(1) ltl_StrongRelease_Until_con, insert nat_less_le, auto)\n\nlemma ltln_to_ltl_atoms:\n \"vars (ltln_to_ltl \\) = atoms_ltln \\\"\n by (induction \\) auto\n\nfun atoms_list :: \"'a ltln \\'a list\"\nwhere \n \"atoms_list (\\ and\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (\\ or\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (\\ U\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (\\ R\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (\\ W\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (\\ M\\<^sub>n \\) = List.union (atoms_list \\) (atoms_list \\)\"\n| \"atoms_list (X\\<^sub>n \\) = atoms_list \\\"\n| \"atoms_list (prop\\<^sub>n(a)) = [a]\"\n| \"atoms_list (nprop\\<^sub>n(a)) = [a]\"\n| \"atoms_list _ = []\"\n\nlemma atoms_list_correct:\n \"set (atoms_list \\) = atoms_ltln \\\"\n by (induction \\) auto\n\nlemma atoms_list_distinct:\n \"distinct (atoms_list \\)\"\n by (induction \\) auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LTL_to_DRA/Impl/LTL_Compat.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2600265285209796}} {"text": "(* Title: HOL/Auth/ZhouGollmann.thy\n Author: Giampaolo Bella and L C Paulson, Cambridge Univ Computer Lab\n Copyright 2003 University of Cambridge\n\nThe protocol of\n Jianying Zhou and Dieter Gollmann,\n A Fair Non-Repudiation Protocol,\n Security and Privacy 1996 (Oakland)\n 55-61\n*)\n\ntheory ZhouGollmann imports Public begin\n\nabbreviation\n TTP :: agent where \"TTP == Server\"\n\nabbreviation f_sub :: nat where \"f_sub == 5\"\nabbreviation f_nro :: nat where \"f_nro == 2\"\nabbreviation f_nrr :: nat where \"f_nrr == 3\"\nabbreviation f_con :: nat where \"f_con == 4\"\n\n\ndefinition broken :: \"agent set\" where \n --{*the compromised honest agents; TTP is included as it's not allowed to\n use the protocol*}\n \"broken == bad - {Spy}\"\n\ndeclare broken_def [simp]\n\ninductive_set zg :: \"event list set\"\n where\n\n Nil: \"[] \\ zg\"\n\n| Fake: \"[| evsf \\ zg; X \\ synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf \\ zg\"\n\n| Reception: \"[| evsr \\ zg; Says A B X \\ set evsr |] ==> Gets B X # evsr \\ zg\"\n\n (*L is fresh for honest agents.\n We don't require K to be fresh because we don't bother to prove secrecy!\n We just assume that the protocol's objective is to deliver K fairly,\n rather than to keep M secret.*)\n| ZG1: \"[| evs1 \\ zg; Nonce L \\ used evs1; C = Crypt K (Number m);\n K \\ symKeys;\n NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, C|}|]\n ==> Says A B {|Number f_nro, Agent B, Nonce L, C, NRO|} # evs1 \\ zg\"\n\n (*B must check that NRO is A's signature to learn the sender's name*)\n| ZG2: \"[| evs2 \\ zg;\n Gets B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs2;\n NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, C|};\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, C|}|]\n ==> Says B A {|Number f_nrr, Agent A, Nonce L, NRR|} # evs2 \\ zg\"\n\n (*A must check that NRR is B's signature to learn the sender's name;\n without spy, the matching label would be enough*)\n| ZG3: \"[| evs3 \\ zg; C = Crypt K M; K \\ symKeys;\n Says A B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs3;\n Gets A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs3;\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, C|};\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|}|]\n ==> Says A TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|}\n # evs3 \\ zg\"\n\n (*TTP checks that sub_K is A's signature to learn who issued K, then\n gives credentials to A and B. The Notes event models the availability of\n the credentials, but the act of fetching them is not modelled. We also\n give con_K to the Spy. This makes the threat model more dangerous, while \n also allowing lemma @{text Crypt_used_imp_spies} to omit the condition\n @{term \"K \\ priK TTP\"}. *)\n| ZG4: \"[| evs4 \\ zg; K \\ symKeys;\n Gets TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|}\n \\ set evs4;\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n con_K = Crypt (priK TTP) {|Number f_con, Agent A, Agent B,\n Nonce L, Key K|}|]\n ==> Says TTP Spy con_K\n #\n Notes TTP {|Number f_con, Agent A, Agent B, Nonce L, Key K, con_K|}\n # evs4 \\ zg\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare Fake_parts_insert_in_Un [dest]\ndeclare analz_into_parts [dest]\n\ndeclare symKey_neq_priEK [simp]\ndeclare symKey_neq_priEK [THEN not_sym, simp]\n\n\ntext{*A \"possibility property\": there are traces that reach the end*}\nlemma \"[|A \\ B; TTP \\ A; TTP \\ B; K \\ symKeys|] ==>\n \\L. \\evs \\ zg.\n Notes TTP {|Number f_con, Agent A, Agent B, Nonce L, Key K,\n Crypt (priK TTP) {|Number f_con, Agent A, Agent B, Nonce L, Key K|} |}\n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] zg.Nil\n [THEN zg.ZG1, THEN zg.Reception [of _ A B],\n THEN zg.ZG2, THEN zg.Reception [of _ B A],\n THEN zg.ZG3, THEN zg.Reception [of _ A TTP], \n THEN zg.ZG4])\napply (basic_possibility, auto)\ndone\n\nsubsection {*Basic Lemmas*}\n\nlemma Gets_imp_Says:\n \"[| Gets B X \\ set evs; evs \\ zg |] ==> \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\nlemma Gets_imp_knows_Spy:\n \"[| Gets B X \\ set evs; evs \\ zg |] ==> X \\ spies evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\n\ntext{*Lets us replace proofs about @{term \"used evs\"} by simpler proofs \nabout @{term \"parts (spies evs)\"}.*}\nlemma Crypt_used_imp_spies:\n \"[| Crypt K X \\ used evs; evs \\ zg |]\n ==> Crypt K X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule zg.induct)\napply (simp_all add: parts_insert_knows_A) \ndone\n\nlemma Notes_TTP_imp_Gets:\n \"[|Notes TTP {|Number f_con, Agent A, Agent B, Nonce L, Key K, con_K |}\n \\ set evs;\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n evs \\ zg|]\n ==> Gets TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\ntext{*For reasoning about C, which is encrypted in message ZG2*}\nlemma ZG2_msg_in_parts_spies:\n \"[|Gets B {|F, B', L, C, X|} \\ set evs; evs \\ zg|]\n ==> C \\ parts (spies evs)\"\nby (blast dest: Gets_imp_Says)\n\n(*classical regularity lemma on priK*)\nlemma Spy_see_priK [simp]:\n \"evs \\ zg ==> (Key (priK A) \\ parts (spies evs)) = (A \\ bad)\"\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)\ndone\n\ntext{*So that blast can use it too*}\ndeclare Spy_see_priK [THEN [2] rev_iffD1, dest!]\n\nlemma Spy_analz_priK [simp]:\n \"evs \\ zg ==> (Key (priK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto \n\n\nsubsection{*About NRO: Validity for @{term B}*}\n\ntext{*Below we prove that if @{term NRO} exists then @{term A} definitely\nsent it, provided @{term A} is not broken.*}\n\ntext{*Strong conclusion for a good agent*}\nlemma NRO_validity_good:\n \"[|NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, C|};\n NRO \\ parts (spies evs);\n A \\ bad; evs \\ zg |]\n ==> Says A B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto) \ndone\n\nlemma NRO_sender:\n \"[|Says A' B {|n, b, l, C, Crypt (priK A) X|} \\ set evs; evs \\ zg|]\n ==> A' \\ {A,Spy}\"\napply (erule rev_mp) \napply (erule zg.induct, simp_all)\ndone\n\ntext{*Holds also for @{term \"A = Spy\"}!*}\ntheorem NRO_validity:\n \"[|Gets B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs;\n NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, C|};\n A \\ broken; evs \\ zg |]\n ==> Says A B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule NRO_sender, auto)\ntxt{*We are left with the case where the sender is @{term Spy} and not\n equal to @{term A}, because @{term \"A \\ bad\"}. \n Thus theorem @{text NRO_validity_good} applies.*}\napply (blast dest: NRO_validity_good [OF refl])\ndone\n\n\nsubsection{*About NRR: Validity for @{term A}*}\n\ntext{*Below we prove that if @{term NRR} exists then @{term B} definitely\nsent it, provided @{term B} is not broken.*}\n\ntext{*Strong conclusion for a good agent*}\nlemma NRR_validity_good:\n \"[|NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, C|};\n NRR \\ parts (spies evs);\n B \\ bad; evs \\ zg |]\n ==> Says B A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct) \napply (frule_tac [5] ZG2_msg_in_parts_spies, auto) \ndone\n\nlemma NRR_sender:\n \"[|Says B' A {|n, a, l, Crypt (priK B) X|} \\ set evs; evs \\ zg|]\n ==> B' \\ {B,Spy}\"\napply (erule rev_mp) \napply (erule zg.induct, simp_all)\ndone\n\ntext{*Holds also for @{term \"B = Spy\"}!*}\ntheorem NRR_validity:\n \"[|Says B' A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs;\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, C|};\n B \\ broken; evs \\ zg|]\n ==> Says B A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs\"\napply clarify \napply (frule NRR_sender, auto)\ntxt{*We are left with the case where @{term \"B' = Spy\"} and @{term \"B' \\ B\"},\n i.e. @{term \"B \\ bad\"}, when we can apply @{text NRR_validity_good}.*}\n apply (blast dest: NRR_validity_good [OF refl])\ndone\n\n\nsubsection{*Proofs About @{term sub_K}*}\n\ntext{*Below we prove that if @{term sub_K} exists then @{term A} definitely\nsent it, provided @{term A} is not broken. *}\n\ntext{*Strong conclusion for a good agent*}\nlemma sub_K_validity_good:\n \"[|sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n sub_K \\ parts (spies evs);\n A \\ bad; evs \\ zg |]\n ==> Says A TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt{*Fake*} \napply (blast dest!: Fake_parts_sing_imp_Un)\ndone\n\nlemma sub_K_sender:\n \"[|Says A' TTP {|n, b, l, k, Crypt (priK A) X|} \\ set evs; evs \\ zg|]\n ==> A' \\ {A,Spy}\"\napply (erule rev_mp) \napply (erule zg.induct, simp_all)\ndone\n\ntext{*Holds also for @{term \"A = Spy\"}!*}\ntheorem sub_K_validity:\n \"[|Gets TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs;\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n A \\ broken; evs \\ zg |]\n ==> Says A TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule sub_K_sender, auto)\ntxt{*We are left with the case where the sender is @{term Spy} and not\n equal to @{term A}, because @{term \"A \\ bad\"}. \n Thus theorem @{text sub_K_validity_good} applies.*}\napply (blast dest: sub_K_validity_good [OF refl])\ndone\n\n\n\nsubsection{*Proofs About @{term con_K}*}\n\ntext{*Below we prove that if @{term con_K} exists, then @{term TTP} has it,\nand therefore @{term A} and @{term B}) can get it too. Moreover, we know\nthat @{term A} sent @{term sub_K}*}\n\nlemma con_K_validity:\n \"[|con_K \\ used evs;\n con_K = Crypt (priK TTP)\n {|Number f_con, Agent A, Agent B, Nonce L, Key K|};\n evs \\ zg |]\n ==> Notes TTP {|Number f_con, Agent A, Agent B, Nonce L, Key K, con_K|}\n \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt{*Fake*}\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt{*ZG2*} \napply (blast dest: parts_cut)\ndone\n\ntext{*If @{term TTP} holds @{term con_K} then @{term A} sent\n @{term sub_K}. We assume that @{term A} is not broken. Importantly, nothing\n needs to be assumed about the form of @{term con_K}!*}\nlemma Notes_TTP_imp_Says_A:\n \"[|Notes TTP {|Number f_con, Agent A, Agent B, Nonce L, Key K, con_K|}\n \\ set evs;\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n A \\ broken; evs \\ zg|]\n ==> Says A TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt{*ZG4*}\napply clarify \napply (rule sub_K_validity, auto) \ndone\n\ntext{*If @{term con_K} exists, then @{term A} sent @{term sub_K}. We again\n assume that @{term A} is not broken. *}\ntheorem B_sub_K_validity:\n \"[|con_K \\ used evs;\n con_K = Crypt (priK TTP) {|Number f_con, Agent A, Agent B,\n Nonce L, Key K|};\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n A \\ broken; evs \\ zg|]\n ==> Says A TTP {|Number f_sub, Agent B, Nonce L, Key K, sub_K|} \\ set evs\"\nby (blast dest: con_K_validity Notes_TTP_imp_Says_A)\n\n\nsubsection{*Proving fairness*}\n\ntext{*Cannot prove that, if @{term B} has NRO, then @{term A} has her NRR.\nIt would appear that @{term B} has a small advantage, though it is\nuseless to win disputes: @{term B} needs to present @{term con_K} as well.*}\n\ntext{*Strange: unicity of the label protects @{term A}?*}\nlemma A_unicity: \n \"[|NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, Crypt K M|};\n NRO \\ parts (spies evs);\n Says A B {|Number f_nro, Agent B, Nonce L, Crypt K M', NRO'|}\n \\ set evs;\n A \\ bad; evs \\ zg |]\n ==> M'=M\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto) \ntxt{*ZG1: freshness*}\napply (blast dest: parts.Body) \ndone\n\n\ntext{*Fairness lemma: if @{term sub_K} exists, then @{term A} holds \nNRR. Relies on unicity of labels.*}\nlemma sub_K_implies_NRR:\n \"[| NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, Crypt K M|};\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, Crypt K M|};\n sub_K \\ parts (spies evs);\n NRO \\ parts (spies evs);\n sub_K = Crypt (priK A) {|Number f_sub, Agent B, Nonce L, Key K|};\n A \\ bad; evs \\ zg |]\n ==> Gets A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs\"\napply clarify\napply hypsubst_thin\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt{*Fake*}\napply blast \ntxt{*ZG1: freshness*}\napply (blast dest: parts.Body) \ntxt{*ZG3*} \napply (blast dest: A_unicity [OF refl]) \ndone\n\n\nlemma Crypt_used_imp_L_used:\n \"[| Crypt (priK TTP) {|F, A, B, L, K|} \\ used evs; evs \\ zg |]\n ==> L \\ used evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ntxt{*Fake*}\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt{*ZG2: freshness*}\napply (blast dest: parts.Body) \ndone\n\n\ntext{*Fairness for @{term A}: if @{term con_K} and @{term NRO} exist, \nthen @{term A} holds NRR. @{term A} must be uncompromised, but there is no\nassumption about @{term B}.*}\ntheorem A_fairness_NRO:\n \"[|con_K \\ used evs;\n NRO \\ parts (spies evs);\n con_K = Crypt (priK TTP)\n {|Number f_con, Agent A, Agent B, Nonce L, Key K|};\n NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, Crypt K M|};\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, Crypt K M|};\n A \\ bad; evs \\ zg |]\n ==> Gets A {|Number f_nrr, Agent A, Nonce L, NRR|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\n txt{*Fake*}\n apply (simp add: parts_insert_knows_A) \n apply (blast dest: Fake_parts_sing_imp_Un) \n txt{*ZG1*}\n apply (blast dest: Crypt_used_imp_L_used) \n txt{*ZG2*}\n apply (blast dest: parts_cut)\ntxt{*ZG4*} \napply (blast intro: sub_K_implies_NRR [OF refl] \n dest: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\ntext{*Fairness for @{term B}: NRR exists at all, then @{term B} holds NRO.\n@{term B} must be uncompromised, but there is no assumption about @{term\nA}. *}\ntheorem B_fairness_NRR:\n \"[|NRR \\ used evs;\n NRR = Crypt (priK B) {|Number f_nrr, Agent A, Nonce L, C|};\n NRO = Crypt (priK A) {|Number f_nro, Agent B, Nonce L, C|};\n B \\ bad; evs \\ zg |]\n ==> Gets B {|Number f_nro, Agent B, Nonce L, C, NRO|} \\ set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt{*Fake*}\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt{*ZG2*}\napply (blast dest: parts_cut)\ndone\n\n\ntext{*If @{term con_K} exists at all, then @{term B} can get it, by @{text\ncon_K_validity}. Cannot conclude that also NRO is available to @{term B},\nbecause if @{term A} were unfair, @{term A} could build message 3 without\nbuilding message 1, which contains NRO. *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/ZhouGollmann.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.259930563617163}} {"text": "theory TheoremD5\nimports TheoremD4\nbegin\n\ncontext LocalLexing begin\n\n\n\nlemma \\_no_tokens: \"\\ k {} I = limit (\\ I. Complete k (Predict k I)) I\"\n by (simp add: \\_def Scan_empty)\n\nlemma bin_elem: \"x \\ bin I k \\ x \\ I\"\n by (auto simp add: bin_def)\n\nlemma Gen_implies_pvalid: \"x \\ Gen P \\ \\ p \\ P. pvalid p x\"\n by (auto simp add: Gen_def)\n\nlemma wellformed_init_item[simp]: \"r \\ \\ \\ k \\ length Doc \\ wellformed_item (init_item r k)\"\n by (simp add: init_item_def wellformed_item_def)\n\nlemma init_item_origin[simp]: \"item_origin (init_item r k) = k\"\n by (auto simp add: item_origin_def init_item_def)\n\nlemma init_item_end[simp]: \"item_end (init_item r k) = k\"\n by (auto simp add: item_end_def init_item_def)\n\nlemma init_item_nonterminal[simp]: \"item_nonterminal (init_item r k) = fst r\"\n by (auto simp add: init_item_def item_nonterminal_def)\n\nlemma init_item_\\[simp]: \"item_\\ (init_item r k) = []\"\n by (auto simp add: init_item_def item_\\_def)\n\nlemma Predict_elem_in_Gen:\n assumes I_in_Gen_P: \"I \\ Gen P\"\n assumes k: \"k \\ length Doc\"\n assumes x_in_Predict: \"x \\ Predict k I\"\n shows \"x \\ Gen P\"\nproof -\n have \"x \\ I \\ (\\ r y. r \\ \\ \\ x = init_item r k \\ y \\ bin I k \\ next_symbol y = Some(fst r))\"\n using x_in_Predict by (auto simp add: Predict_def)\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1 thus ?case using I_in_Gen_P by blast\n next\n case 2 \n then obtain r y where ry: \"r \\ \\ \\ x = init_item r k \\ y \\ bin I k \\ \n next_symbol y = Some (fst r)\" by blast\n then have \"\\ p \\ P. pvalid p y\"\n using Gen_implies_pvalid I_in_Gen_P bin_elem subsetCE by blast \n then obtain p where p: \"p \\ P \\ pvalid p y\" by blast\n have wellformed_p: \"wellformed_tokens p\" using p by (auto simp add: pvalid_def)\n have wellformed_x: \"wellformed_item x\"\n by (simp add: ry k)\n from ry have \"item_end y = k\" by (auto simp add: bin_def)\n with p have charslength_p[simplified]: \"charslength p = k\" by (auto simp add: pvalid_def)\n have item_end_x: \"item_end x = k\" by (simp add: ry)\n have pvalid_x: \"pvalid p x\"\n apply (auto simp add: pvalid_def)\n apply (simp add: wellformed_p)\n apply (simp add: wellformed_x)\n apply (rule_tac x=\"length p\" in exI)\n apply (auto simp add: charslength_p ry)\n by (metis append_Cons next_symbol_starts_item_\\ p pvalid_def \n pvalid_is_derivation_terminals_item_\\ ry)\n then show ?case using Gen_def mem_Collect_eq p by blast\n qed\nqed\n\nlemma Predict_subset_Gen:\n assumes \"I \\ Gen P\"\n assumes \"k \\ length Doc\"\n shows \"Predict k I \\ Gen P\"\nusing Predict_elem_in_Gen assms by blast\n\nlemma nth_superfluous_append[simp]: \"i < length a \\ (a@b)!i = a!i\"\nby (simp add: nth_append)\n\nlemma tokens_nth_in_\\: \n \"p \\ \\ \\ \\ i. i < length p \\ (\\ u. p ! i \\ \\ (charslength (take i p)) u)\"\nproof (induct rule: \\_induct)\n case Base thus ?case by simp\nnext\n case (Induct p k u)\n then have \"p \\ limit (Append (\\ k (Suc u)) k) (\\

k u)\" by simp\n then show ?case\n proof (induct rule: limit_induct)\n case (Init p) thus ?case using Induct by auto\n next\n case (Iterate p Y)\n from Iterate(2) have \"p \\ Y \\ (\\ q t. p = q@[t] \\ q \\ by_length k Y \\ t \\ \\ k (Suc u) \\ \n admissible (q @ [t]))\"\n by (auto simp add: Append_def)\n then show ?case\n proof (induct rule: disjCases2)\n case 1 thus ?case using Iterate(1) by auto\n next\n case 2 \n then obtain q t where \n qt: \"p = q @ [t] \\ q \\ by_length k Y \\ t \\ \\ k (Suc u) \\ admissible (q @ [t])\" by blast\n then have q_in_Y: \"q \\ Y\" by auto\n with qt have k: \"k = charslength q\" by auto\n with qt have t: \"t \\ \\ k (Suc u)\" by auto\n show ?case\n proof(auto simp add: qt)\n fix i\n assume i: \"i < Suc (length q)\"\n then have \"i < length q \\ i = length q\" by arith\n then show \"\\u. (q @ [t]) ! i \\ \\ (length (chars (take i q))) u\"\n proof (induct rule: disjCases2)\n case 1\n from Iterate(1)[OF q_in_Y]\n show ?case by (simp add: 1)\n next\n case 2\n show ?case \n apply (auto simp add: 2)\n apply (rule_tac x=\"Suc u\" in exI)\n using k t by auto \n qed\n qed\n qed\n qed\nqed\n\nlemma path_append_token:\n assumes p: \"p \\ \\

k u\"\n assumes t: \"t \\ \\ k (Suc u)\"\n assumes pt: \"admissible (p@[t])\"\n assumes k: \"charslength p = k\"\n shows \"p@[t] \\ \\

k (Suc u)\"\napply (simp only: \\

.simps)\napply (rule_tac n=\"Suc 0\" in limit_elem)\nusing p t pt k apply (auto simp only: Append_def funpower.simps)\nby fastforce\n\ndefinition indexlt_rel :: \"((nat \\ nat) \\ (nat \\ nat)) set\" where\n \"indexlt_rel = less_than <*lex*> less_than\"\n\ndefinition indexlt :: \"nat \\ nat \\ nat \\ nat \\ bool\" where\n \"indexlt k' u' k u = (((k', u'), (k, u)) \\ indexlt_rel)\"\n\nlemma indexlt_simp: \"indexlt k' u' k u = (k' < k \\ (k' = k \\ u' < u))\"\n by (auto simp add: indexlt_def indexlt_rel_def)\n\nlemma wf_indexlt_rel: \"wf indexlt_rel\"\n using indexlt_rel_def pair_less_def by auto\n\nlemma \\

_induct[consumes 1, case_names Induct]:\n assumes \"p \\ \\

k u\"\n assumes induct: \"\\ p k u . (\\ p' k' u'. p' \\ \\

k' u' \\ indexlt k' u' k u \\ P p' k' u') \n \\ p \\ \\

k u \\ P p k u\"\n shows \"P p k u\"\nproof -\n let ?R = \"indexlt_rel <*lex*> {}\"\n have wf_R: \"wf ?R\" by (auto simp add: wf_indexlt_rel)\n let ?P = \"\\ a. snd a \\ \\

(fst (fst a)) (snd (fst a)) \\ P (snd a) (fst (fst a)) (snd (fst a))\"\n have \"p \\ \\

k u \\ P p k u\"\n apply (rule wf_induct[OF wf_R, where P = ?P and a = \"((k, u), p)\", simplified])\n apply (auto simp add: indexlt_def[symmetric])\n apply (rule_tac p=ba and k=a and u=b in induct)\n by auto\n thus ?thesis using assms by auto \nqed\n\nlemma nonempty_path_indices: \n assumes p: \"p \\ \\

k u\"\n assumes nonempty: \"p \\ []\"\n shows \"k > 0 \\ u > 0\"\nproof (cases \"u = 0\")\n case True\n note u = True\n have \"k > 0\"\n proof (cases \"k = 0\")\n case True\n with p u have \"p = []\" by simp\n with nonempty have \"False\" by auto\n then show ?thesis by auto\n next\n case False\n then show ?thesis by arith\n qed\n then show ?thesis by blast\nnext\n case False\n then show ?thesis by arith\nqed\n\nlemma base_paths:\n assumes p: \"p \\ \\

k 0\"\n assumes k: \"k > 0\"\n shows \"\\ u. p \\ \\

(k - 1) u\"\nproof -\n from k have \"\\ i. k = Suc i\" by arith\n then obtain i where i: \"k = Suc i\" by blast\n from p show ?thesis\n by (auto simp add: i natUnion_def)\nqed\n\nlemma indexlt_trans: \"indexlt k'' u'' k' u' \\ indexlt k' u' k u \\ indexlt k'' u'' k u\"\nusing dual_order.strict_trans indexlt_simp by auto\n\ndefinition is_continuation :: \"nat \\ nat \\ tokens \\ tokens \\ bool\" where\n \"is_continuation k u q ts = (q \\ \\

k u \\ charslength q = k \\ admissible (q@ts) \\ \n (\\ t \\ set ts. t \\ \\ k (Suc u)) \\ (\\ t \\ set (butlast ts). chars_of_token t = []))\"\n\nlemma limit_Append_path_nonelem_split: \"p \\ limit (Append T k) (\\

k u) \\ p \\ \\

k u \\\n \\ q ts. p = q@ts \\ q \\ \\

k u \\ charslength q = k \\ admissible (q@ts) \\ (\\ t \\ set ts. t \\ T) \\ \n (\\ t \\ set (butlast ts). chars_of_token t = [])\"\nproof (induct rule: limit_induct)\n case (Init p) thus ?case by auto\nnext\n case (Iterate p Y)\n show ?case\n proof (cases \"p \\ Y\")\n case True\n from Iterate(1)[OF True Iterate(3)] show ?thesis by blast\n next\n case False\n with Append_def Iterate(2) \n have \"\\ q t. p = q@[t] \\ q \\ by_length k Y \\ t \\ T \\ admissible (q @ [t])\" by auto\n then obtain q t where qt: \"p = q@[t] \\ q \\ by_length k Y \\ t \\ T \\ admissible (q @ [t])\" \n by blast\n from qt have qlen: \"charslength q = k\" by auto\n have \"q \\ \\

k u \\ q \\ \\

k u\" by blast\n then show ?thesis\n proof(induct rule: disjCases2)\n case 1\n show ?case\n apply (rule_tac x=q in exI)\n apply (rule_tac x=\"[t]\" in exI)\n using qlen by (simp add: qt 1)\n next\n case 2\n have q_in_Y: \"q \\ Y\" using qt by auto\n from Iterate(1)[OF q_in_Y 2] \n obtain q' ts where \n q'ts: \"q = q' @ ts \\ q' \\ \\

k u \\ charslength q' = k \\ (\\t\\set ts. t \\ T) \\\n (\\t\\set(butlast ts). chars_of_token t = [])\"\n by blast\n with qlen have \"charslength ts = 0\" by auto\n hence empty: \"\\ t \\ set(ts). chars_of_token t = []\" \n apply (induct ts)\n by auto\n show ?case\n apply (rule_tac x=q' in exI)\n apply (rule_tac x=\"ts@[t]\" in exI)\n using qt q'ts empty by auto\n qed\n qed\nqed\n\nlemma limit_Append_path_nonelem_split': \n \"p \\ limit (Append (\\ k (Suc u)) k) (\\

k u) \\ p \\ \\

k u \\\n \\ q ts. p = q@ts \\ is_continuation k u q ts\"\napply (simp only: is_continuation_def)\napply (rule_tac limit_Append_path_nonelem_split)\nby auto\n\nlemma final_step_of_path: \"p \\ \\

k u \\ p \\ [] \\ (\\ q ts k' u'. p = q@ts \\ indexlt k' u' k u \n \\ is_continuation k' u' q ts)\"\nproof (induct rule: \\

_induct)\n case (Induct p k u)\n from Induct(2) Induct(3) have ku_0: \"k > 0 \\ u > 0\"\n using nonempty_path_indices by blast\n show ?case \n proof (cases \"u = 0\")\n case True\n with ku_0 have k_0: \"k > 0\" by arith\n with True Induct(2) base_paths have \"\\ u'. p \\ \\

(k - 1) u'\" by auto\n then obtain u' where u': \"p \\ \\

(k - 1) u'\" by blast\n have indexlt: \"indexlt (k - 1) u' k u\" by (simp add: indexlt_simp k_0)\n from Induct(1)[OF u' indexlt Induct(3)] show ?thesis\n using indexlt indexlt_trans by blast\n next\n case False \n then have \"\\ u'. u = Suc u'\" by arith\n then obtain u' where u': \"u = Suc u'\" by blast\n with Induct(2) have p_limit: \"p \\ limit (Append (\\ k (Suc u')) k) (\\

k u')\"\n using \\

.simps(2) by blast\n from u' have indexlt: \"indexlt k u' k u\" by (simp add: indexlt_simp)\n have \"p \\ \\

k u' \\ p \\ \\

k u'\" by blast\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1\n from Induct(1)[OF 1 indexlt Induct(3)] show ?case\n using indexlt indexlt_trans by blast\n next\n case 2\n from limit_Append_path_nonelem_split'[OF p_limit 2]\n show ?case using indexlt u' by auto\n qed\n qed\nqed \n\n\n\nlemma empty_in_\\\\<^sub>P[simp]: \"[] \\ \\\\<^sub>P\"\n apply (simp add: \\\\<^sub>P_def is_derivation_def)\n apply (rule_tac x=\"[\\]\" in exI)\n by simp \n \n\n\nlemma \\_are_admissible: \"p \\ \\ \\ admissible p\"\nproof (induct rule: \\_induct)\n case Base thus ?case by simp\nnext\n case (Induct p k u)\n from Induct(2)[simplified] show ?case\n proof (induct rule: limit_induct)\n case (Init p) from Induct(1)[OF Init] show ?case .\n next\n case (Iterate p Y) \n have \"\\ (\\ k u) (\\

k u) k \\ \\ k\" by (metis \\.simps(2) \\_subset_\\)\n then have 1: \"Append (\\ (\\ k u) (\\

k u) k) k Y \\ Append (\\ k) k Y\"\n by (rule Append_mono, simp) \n have 2: \"p \\ Append (\\ k) k Y \\ admissible p\"\n apply (auto simp add: Append_def)\n by (simp add: Iterate)\n show ?case \n apply (rule 2)\n using \"1\" Iterate(2) by blast\n qed \nqed\n\nlemma prefix_of_empty_is_empty: \"is_prefix q [] \\ q = []\"\nby (metis is_prefix_cons neq_Nil_conv)\n\nlemma subset_\\

:\n assumes leq: \"k' < k \\ (k' = k \\ u' \\ u)\"\n shows \"\\

k' u' \\ \\

k u\"\nproof -\n from leq show ?thesis\n proof (induct rule: disjCases2)\n case 1\n have s1: \"\\

k' u' \\ \\ k'\" by (rule_tac subset_\\

\\k) \n have s2: \"\\ k' \\ \\ (k - 1)\" \n apply (rule_tac subset_\\)\n using 1 by arith\n from subset_\\\\

Suc[where k=\"k - 1\"] 1 have s3: \"\\ (k - 1) \\ \\

k 0\"\n by simp\n have s4: \"\\

k 0 \\ \\

k u\" by (rule_tac subset_\\

k, simp)\n from s1 s2 s3 s4 subset_trans show ?case by blast\n next\n case 2 thus ?case by (simp add : subset_\\

k)\n qed\nqed \n\nlemma empty_path_is_elem[simp]: \"[] \\ \\

k u\"\nproof -\n have \"[] \\ \\

0 0\" by simp\n then show \"[] \\ \\

k u\" by (metis le0 not_gr0 subsetCE subset_\\

) \nqed\n\nlemma is_prefix_of_append:\n assumes \"is_prefix p (a@b)\"\n shows \"is_prefix p a \\ (\\ b'. b' \\ [] \\ is_prefix b' b \\ p = a@b')\"\napply (auto simp add: is_prefix_def) \nby (metis append_Nil2 append_eq_append_conv2 assms is_prefix_cancel is_prefix_def)\n\nlemma prefix_is_continuation: \"is_continuation k u p ts \\ is_prefix ts' ts \\ \n is_continuation k u p ts'\"\napply (auto simp add: is_continuation_def is_prefix_def)\napply (metis \\\\<^sub>P_split admissible_def append_assoc terminals_append)\nusing in_set_butlast_appendI by fastforce \n\nlemma charslength_0: \"(\\ t \\ set ts. chars_of_token t = []) = (charslength ts = 0)\"\nby (induct ts, auto)\n \nlemma is_continuation_in_\\

: \"is_continuation k u p ts \\ p@ts \\ \\

k (Suc u)\"\nproof(induct ts rule: rev_induct)\n case Nil thus ?case \n apply (auto simp add: is_continuation_def)\n using subset_\\

Suc by fastforce\nnext\n case (snoc t ts)\n from snoc(2) have \"is_continuation k u p ts\"\n by (metis append_Nil2 is_prefix_cancel is_prefix_empty prefix_is_continuation)\n note induct = snoc(1)[OF this]\n then have pts: \"p@ts \\ limit (Append (\\ k (Suc u)) k) (\\

k u)\" by simp\n note is_cont = snoc(2)\n then have admissible: \"admissible (p@ts@[t])\" by (simp add: is_continuation_def)\n from is_cont have t: \"t \\ \\ k (Suc u)\" by (simp add: is_continuation_def)\n from is_cont have \"\\ t \\ set ts. chars_of_token t = []\" by (simp add: is_continuation_def)\n then have charslength_ts: \"charslength ts = 0\" by (simp only: charslength_0)\n from is_cont have plen: \"charslength p = k\" by (simp add: is_continuation_def)\n show ?case\n apply (simp only: \\

.simps)\n apply (rule_tac limit_step_pointwise[OF pts])\n apply (simp add: pointwise_Append)\n apply (auto simp add: Append_def)\n apply (rule_tac x=\"fst t\" in exI)\n apply (rule_tac x=\"snd t\" in exI)\n apply (auto simp add: admissible)\n using charslength_ts apply simp\n using plen apply simp\n using t by simp\nqed \n\nlemma indexlt_subset_\\

: \"indexlt k' u' k u \\ \\

k' (Suc u') \\ \\

k u\"\napply (rule_tac subset_\\

)\napply (simp add: indexlt_simp)\napply arith\ndone\n\nlemma prefixes_are_paths: \"p \\ \\

k u \\ is_prefix x p \\ x \\ \\

k u\"\nproof (induct arbitrary: x rule: \\

_induct)\n case (Induct p k u)\n show ?case\n proof (cases \"p = []\")\n case True\n then have \"x = []\"\n using Induct.prems prefix_of_empty_is_empty by blast \n then show \"x \\ \\

k u\" by simp\n next\n case False\n from final_step_of_path[OF Induct(2) False]\n obtain q ts k' u' where step: \"p = q@ts \\ indexlt k' u' k u \\ is_continuation k' u' q ts\"\n by blast\n have subset: \"\\

k' u' \\ \\

k u\"\n by (metis indexlt_simp less_or_eq_imp_le step subset_\\

)\n have \"is_prefix x q \\ (\\ ts'. ts' \\ [] \\ is_prefix ts' ts \\ x = q@ts')\"\n apply (rule_tac is_prefix_of_append)\n using Induct(3) step by auto\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1\n have x: \"x \\ \\

k' u'\"\n using 1 Induct step by (auto simp add: is_continuation_def)\n then show \"x \\ \\

k u\" using subset subsetCE by blast\n next\n case 2\n then obtain ts' where ts': \"is_prefix ts' ts \\ x = q@ts'\" by blast\n have \"is_continuation k' u' q ts'\" using step prefix_is_continuation ts' by blast \n with ts' have \"x \\ \\

k' (Suc u')\"\n apply (simp only: ts')\n apply (rule_tac is_continuation_in_\\

)\n by simp\n with subset show \"x \\ \\

k u\" using indexlt_subset_\\

step by blast\n qed\n qed\nqed \n\nlemma empty_or_last_of_suffix:\n assumes \"q = q' @ [t]\"\n assumes \"q = p @ ts\"\n shows \"ts = [] \\ (\\ ts'. q' = p @ ts' \\ ts'@[t] = ts)\"\nby (metis assms(1) assms(2) butlast_append last_appendR snoc_eq_iff_butlast)\n\nlemma is_prefix_butlast: \"is_prefix q (butlast p) \\ is_prefix q p\"\nby (metis butlast_conv_take is_prefix_append is_prefix_def is_prefix_take)\n \nlemma last_step_of_path:\n \"q \\ \\

k u \\ q = q'@[t] \\\n \\ k' u'. indexlt k' u' k u \\ q \\ \\

k' (Suc u') \\ charslength q' = k' \\ t \\ \\ k' (Suc u')\"\nproof (induct arbitrary: q' t rule: \\

_induct)\n case (Induct q k u)\n have \"\\ p ts k' u'. q = p@ts \\ indexlt k' u' k u \\ is_continuation k' u' p ts\"\n apply (rule_tac final_step_of_path)\n apply (simp add: Induct(2))\n apply (simp add: Induct(3))\n done\n then obtain p ts k' u' where pts: \"q = p@ts \\ indexlt k' u' k u \\ is_continuation k' u' p ts\"\n by blast\n then have indexlt: \"indexlt k' u' k u\" by auto\n from pts have \"ts = [] \\ (\\ ts'. q' = p @ ts' \\ ts'@[t] = ts)\"\n by (metis empty_or_last_of_suffix Induct(3))\n then show ?case\n proof (induct rule: disjCases2)\n case 1\n with pts have q: \"q \\ \\

k' u'\" by (auto simp add: is_continuation_def)\n from Induct(1)[OF this indexlt Induct(3)] show ?case\n using indexlt indexlt_trans by blast\n next\n case 2\n then obtain ts' where ts': \"q' = p @ ts' \\ ts'@[t] = ts\" by blast\n then have \"is_prefix ts' ts\" using is_prefix_def by blast \n then have \"is_continuation k' u' p ts'\" by (metis prefix_is_continuation pts)\n have \"charslength ts' = 0\" using charslength_0 is_continuation_def pts ts' by auto \n then have q'len: \"charslength q' = k'\" using is_continuation_def pts ts' by auto \n have \"t \\ set ts\" using ts' by auto\n with pts have t_in_\\: \"t \\ \\ k' (Suc u')\" using is_continuation_def by blast \n have q_dom: \"q \\ \\

k' (Suc u')\" using pts is_continuation_in_\\

by blast\n show ?case \n apply (rule_tac x=k' in exI)\n apply (rule_tac x=u' in exI)\n by (simp only: indexlt q'len t_in_\\ q_dom)\n qed\nqed\n \nlemma charslength_of_butlast_0: \"p \\ \\

k 0 \\ p = q@[t] \\ charslength q < k\"\nusing last_step_of_path LocalLexing_axioms indexlt_simp by blast\n\nlemma charslength_of_butlast: \"p \\ \\

k u \\ p = q@[t] \\ charslength q \\ k\"\nby (metis indexlt_simp last_step_of_path eq_imp_le less_imp_le_nat)\n\nlemma last_token_of_path:\n assumes \"q \\ \\

k u\"\n assumes \"q = q'@[t]\"\n assumes \"charslength q' = k\"\n shows \"t \\ \\ k u\"\nproof -\n from assms have \"\\ k' u'. indexlt k' u' k u \\ q \\ \\

k' (Suc u') \\ charslength q' = k' \\ \n t \\ \\ k' (Suc u')\" using last_step_of_path by blast\n then obtain k' u' where th: \"indexlt k' u' k u \\ q \\ \\

k' (Suc u') \\ charslength q' = k' \\ \n t \\ \\ k' (Suc u')\" by blast\n with assms(3) have k': \"k' = k\" by blast\n with th have \"t \\ \\ k' (Suc u') \\ u' < u\" using indexlt_simp by auto\n then show ?thesis\n by (metis (no_types, hide_lams) \\_subset_Suc k' linorder_neqE_nat not_less_eq \n subsetCE subset_fSuc_strict)\nqed\n\nlemma final_step_of_path': \"p \\ \\

k u \\ p \\ \\

k (u - 1) \\ \n \\ q ts. u > 0 \\ p = q@ts \\ is_continuation k (u - 1) q ts\"\nby (metis Suc_diff_1 \\

.simps(2) diff_0_eq_0 limit_Append_path_nonelem_split' not_gr0)\n\nlemma is_continuation_continue:\n assumes \"is_continuation k u q ts\"\n assumes \"charslength ts = 0\"\n assumes \"t \\ \\ k (Suc u)\"\n assumes \"admissible (q @ ts @ [t])\"\n shows \"is_continuation k u q (ts@[t])\"\nproof -\n from assms show ?thesis\n by (simp add: is_continuation_def charslength_0)\nqed\n\n(* In an older version of local lexing, compatibility was an assumption we had to make, \n but now it is a theorem *)\n\ntheorem compatibility_def:\n assumes p_in_dom: \"p \\ \\

k u\"\n assumes q_in_dom: \"q \\ \\

k u\"\n assumes p_charslength: \"charslength p = k\"\n assumes q_split: \"q = q'@[t]\"\n assumes q'len: \"charslength q' = k\"\n assumes admissible: \"admissible (p @ [t])\" \n shows \"p @ [t] \\ \\

k u\"\nproof - \n have u: \"u > 0\"\n proof (cases \"u = 0\")\n case True\n then have \"charslength q' < k\" \n using charslength_of_butlast_0 q_in_dom q_split by blast \n with q'len have \"False\" by arith\n then show ?thesis by blast\n next\n case False\n then show ?thesis by arith\n qed\n have t_dom: \"t \\ \\ k u\" using last_token_of_path q'len q_in_dom q_split by blast \n have \"p \\ \\

k (u - 1) \\ p \\ \\

k (u - 1)\" by blast\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1\n with t_dom p_charslength admissible u have \"is_continuation k (u - 1) p [t]\"\n by (auto simp add: is_continuation_def)\n with u show \"p@[t] \\ \\

k u\"\n by (metis One_nat_def Suc_pred is_continuation_in_\\

)\n next\n case 2\n from final_step_of_path'[OF p_in_dom 2] \n obtain p' ts where p': \"p = p' @ ts \\ is_continuation k (u - 1) p' ts\"\n by blast\n from p' p_charslength is_continuation_def have charslength_ts: \"charslength ts = 0\"\n by auto\n from u have u': \"Suc (u - 1) = u\" by arith\n have \"is_continuation k (u - 1) p' (ts@[t])\"\n apply (rule_tac is_continuation_continue)\n using p' apply blast\n using charslength_ts apply blast\n apply (simp only: u' t_dom)\n using admissible p' apply auto\n done\n from is_continuation_in_\\

[OF this] show ?case by (simp only: p' u', simp)\n qed\nqed \n\nlemma is_prefix_admissible:\n assumes \"is_prefix a b\"\n assumes \"admissible b\"\n shows \"admissible a\"\nproof -\n from assms show ?thesis\n by (auto simp add: is_prefix_def admissible_def \\\\<^sub>P_def)\nqed \n\nlemma butlast_split: \"n < length q \\ butlast q = (take n q)@(drop n (butlast q))\"\nby (metis append_take_drop_id take_butlast)\n\nlemma in_\\

_charslength:\n assumes p_dom: \"p \\ \\

k u\"\n shows \"\\ v. p \\ \\

(charslength p) v\"\nproof (cases \"charslength p \\ k\")\n case True\n show ?thesis\n apply (rule_tac x=u in exI)\n by (metis True le_neq_implies_less p_dom subsetCE subset_\\

)\nnext\n case False\n then have charslength: \"charslength p < k\" by arith\n have \"p = [] \\ p \\ []\" by blast\n thus ?thesis\n proof (induct rule: disjCases2)\n case 1 thus ?case by simp\n next\n case 2\n from final_step_of_path[OF p_dom 2] obtain q ts k' u' where\n step: \"p = q @ ts \\ indexlt k' u' k u \\ is_continuation k' u' q ts\" by blast\n from step have k': \"charslength q = k'\" using is_continuation_def by blast \n from step have \"charslength q \\ charslength p\" by simp \n with k' have k': \"k' \\ charslength p\" by simp\n from step have \"p \\ \\

k' (Suc u')\" using is_continuation_in_\\

by blast \n with k' have \"p \\ \\

(charslength p) (Suc u')\"\n by (metis le_neq_implies_less subsetCE subset_\\

) \n then show ?case by blast\n qed\nqed\n\ntheorem general_compatibility:\n \"p \\ \\

k u \\ q \\ \\

k u \\ charslength p = charslength (take n q) \n \\ charslength p \\ k \\ admissible (p @ (drop n q)) \\ p @ (drop n q) \\ \\

k u\"\nproof (induct \"length q - n\" arbitrary: p q n k u)\n case 0\n from 0 have \"0 = length q - n\" by auto\n then have n: \"n \\ length q\" by arith\n then have \"drop n q = []\" by auto\n then show ?case by (simp add: \"0.prems\"(1)) \nnext\n case (Suc l)\n have \"n \\ length q \\ n < length q\" by arith\n then show ?case\n proof (induct rule: disjCases2)\n case 1\n then have \"drop n q = []\" by auto\n then show ?case by (simp add: Suc.prems(1))\n next\n case 2\n then have \"length q > 0\" by auto\n then have q_nonempty: \"q \\ []\" by auto\n let ?q' = \"butlast q\"\n from q_nonempty Suc(2) have h1: \"l = length ?q' - n\" by auto\n have h2: \"?q' \\ \\

k u\"\n by (metis Suc.prems(2) butlast_conv_take is_prefix_take prefixes_are_paths)\n have h3: \"charslength p = charslength (take n ?q')\"\n using \"2.hyps\" Suc.prems(3) take_butlast by force\n have \"is_prefix (p @ drop n ?q') (p @ drop n q)\"\n by (simp add: butlast_conv_take drop_take)\n note h4 = is_prefix_admissible[OF this Suc.prems(5)] \n note induct = Suc(1)[OF h1 Suc(3) h2 h3 Suc.prems(4) h4] \n let ?p' = \"p @ (drop n (butlast q))\"\n from induct have \"?p' \\ \\

k u\" .\n let ?i = \"charslength ?p'\"\n have charslength_i[symmetric]: \"charslength ?q' = ?i\"\n using Suc.prems(3) apply simp\n apply (subst butlast_split[OF 2])\n by simp\n have q_split: \"q = ?q'@[last q]\" by (simp add: q_nonempty)\n with Suc.prems(2) charslength_of_butlast have charslength_q': \"charslength ?q' \\ k\" \n by blast \n from q_nonempty have p'last: \"?p'@[last q] = p@(drop n q)\"\n by (metis \"2.hyps\" append_assoc drop_eq_Nil drop_keep_last not_le q_split)\n have \"?i \\ k\" by (simp only: charslength_i charslength_q')\n then have \"?i = k \\ ?i < k\" by auto\n then show ?case\n proof (induct rule: disjCases2)\n case 1\n have charslength_q': \"charslength ?q' = k\" using charslength_i[symmetric] 1 by blast\n from compatibility_def[OF induct Suc.prems(2) 1 q_split charslength_q']\n show ?case by (simp only: p'last Suc.prems(5))\n next\n case 2\n from in_\\

_charslength[OF induct]\n obtain v1 where v1: \"?p' \\ \\

?i v1\" by blast \n from last_step_of_path[OF Suc.prems(2) q_split] \n have \"\\ u. q \\ \\

?i u\" by (metis charslength_i)\n then obtain v2 where v2: \"q \\ \\

?i v2\" by blast\n let ?v = \"max v1 v2\"\n have \"v1 \\ ?v\" by auto\n with v1 have dom1: \"?p' \\ \\

?i ?v\" by (metis (no_types, hide_lams) subsetCE subset_\\

k) \n have \"v2 \\ ?v\" by auto\n with v2 have dom2: \"q \\ \\

?i ?v\" by (metis (no_types, hide_lams) subsetCE subset_\\

k) \n from compatibility_def[OF dom1 dom2 _ q_split] \n have \"p @ drop n q \\ \\

?i ?v\"\n by (simp only: p'last charslength_i[symmetric] Suc.prems(5))\n then show \"p @ drop n q \\ \\

k u\" by (meson \"2.hyps\" subsetCE subset_\\

) \n qed \n qed \nqed\n\nlemma wellformed_item_derives:\n assumes wellformed: \"wellformed_item x\"\n shows \"derives [item_nonterminal x] (item_rhs x)\"\nproof -\n from wellformed have \"(item_nonterminal x, item_rhs x) \\ \\\"\n by (simp add: item_nonterminal_def item_rhs_def wellformed_item_def)\n then show ?thesis\n by (metis append_Nil2 derives1_def derives1_implies_derives is_sentence_concat \n rule_\\_type self_append_conv2)\nqed \n\nlemma wellformed_complete_item_\\:\n assumes wellformed: \"wellformed_item x\"\n assumes complete: \"is_complete x\" \n shows \"item_\\ x = []\"\nusing complete is_complete_def item_\\_def by auto\n\nlemma wellformed_complete_item_derives:\n assumes wellformed: \"wellformed_item x\"\n assumes complete: \"is_complete x\" \n shows \"derives [item_nonterminal x] (item_\\ x)\"\nusing complete is_complete_def item_\\_def wellformed wellformed_item_derives by auto \n\nlemma is_derivation_implies_admissible:\n \"is_derivation (terminals p @ \\) \\ is_word (terminals p) \\ admissible p\"\nusing \\\\<^sub>P_def admissible_def by blast\n\nlemma item_rhs_of_inc_item[simp]: \"item_rhs (inc_item x k) = item_rhs x\"\n by (auto simp add: inc_item_def item_rhs_def)\n\nlemma item_rule_of_inc_item[simp]: \"item_rule (inc_item x k) = item_rule x\"\n by (simp add: inc_item_def)\n\nlemma item_origin_of_inc_item[simp]: \"item_origin (inc_item x k) = item_origin x\"\n by (simp add: inc_item_def)\n\nlemma item_end_of_inc_item[simp]: \"item_end (inc_item x k) = k\"\n by (simp add: inc_item_def)\n\nlemma item_dot_of_inc_item[simp]: \"item_dot (inc_item x k) = (item_dot x) + 1\"\n by (simp add: inc_item_def)\n\nlemma item_nonterminal_of_inc_item[simp]: \"item_nonterminal (inc_item x k) = item_nonterminal x\"\n by (simp add: inc_item_def item_nonterminal_def)\n\nlemma wellformed_inc_item:\n assumes wellformed: \"wellformed_item x\"\n assumes next_symbol: \"next_symbol x = Some s\"\n assumes k_upper_bound: \"k \\ length Doc\"\n assumes k_lower_bound: \"k \\ item_end x\"\n shows \"wellformed_item (inc_item x k)\"\nproof -\n have k_lower_bound': \"k \\ item_origin x\"\n using k_lower_bound wellformed wellformed_item_def by auto \n show ?thesis\n apply (auto simp add: wellformed_item_def k_upper_bound k_lower_bound')\n using wellformed wellformed_item_def apply blast\n using is_complete_def next_symbol next_symbol_not_complete not_less_eq_eq by blast\nqed \n\nlemma item_\\_of_inc_item:\n assumes wellformed: \"wellformed_item x\"\n assumes next_symbol: \"next_symbol x = Some s\"\n shows \"item_\\ (inc_item x k) = item_\\ x @ [s]\"\nby (metis (mono_tags, lifting) item_dot_of_inc_item item_rhs_of_inc_item \n One_nat_def add.right_neutral add_Suc_right is_complete_def item_\\_def item_\\_def \n le_neq_implies_less list.sel(1) next_symbol next_symbol_not_complete next_symbol_starts_item_\\ \n take_hd_drop wellformed wellformed_item_def)\n\nlemma derives1_pad: \n assumes derives1: \"derives1 \\ \\\"\n assumes u: \"is_sentence u\"\n assumes v: \"is_sentence v\"\n shows \"derives1 (u@\\@v) (u@\\@v)\"\nproof -\n from derives1 have \n \"\\x y N \\. \\ = x @ [N] @ y \\ \\ = x @ \\ @ y \\ is_sentence x \\ is_sentence y \\ (N, \\) \\ \\\"\n by (auto simp add: derives1_def)\n then obtain x y N \\ where \n 1: \"\\ = x @ [N] @ y \\ \\ = x @ \\ @ y \\ is_sentence x \\ is_sentence y \\ (N, \\) \\ \\\" by blast\n show ?thesis\n apply (simp only: derives1_def)\n apply (rule_tac x=\"u@x\" in exI)\n apply (rule_tac x=\"y@v\" in exI)\n apply (rule_tac x=N in exI)\n apply (rule_tac x=\\ in exI)\n using 1 u v is_sentence_concat by auto\nqed\n\nlemma derives_pad:\n \"derives \\ \\ \\ is_sentence u \\ is_sentence v \\ derives (u@\\@v) (u@\\@v)\"\nproof (induct rule: derives_induct)\n case Base thus ?case by simp\nnext\n case (Step y z) \n from Step have 1: \"derives (u@\\@v) (u@y@v)\" by auto\n from Step have 2: \"derives1 y z\" by auto\n then have \"derives1 (u@y@v) (u@z@v)\" by (simp add: Step.prems derives1_pad) \n then show ?case\n using \"1\" derives1_implies_derives derives_trans by blast\nqed \n\nlemma derives1_is_sentence: \"derives1 \\ \\ \\ is_sentence \\ \\ is_sentence \\\"\nusing Derives1_sentence1 Derives1_sentence2 derives1_implies_Derives1 by blast\n\nlemma derives_is_sentence: \"derives \\ \\ \\ (\\ = \\) \\ (is_sentence \\ \\ is_sentence \\)\"\nproof (induct rule: derives_induct)\n case Base thus ?case by simp\nnext\n case (Step y z) \n show ?case using Step.hyps(2) Step.hyps(3) derives1_is_sentence by blast\nqed\n\nlemma derives_append: \n assumes au: \"derives a u\"\n assumes bv: \"derives b v\"\n assumes is_sentence_a: \"is_sentence a\"\n assumes is_sentence_b: \"is_sentence b\"\n shows \"derives (a@b) (u@v)\"\nproof -\n from au have \"a = u \\ (is_sentence a \\ is_sentence u)\"\n using derives_is_sentence by blast\n then have au_sentences: \"is_sentence a \\ is_sentence u\" using is_sentence_a by blast \n from bv have \"b = v \\ (is_sentence b \\ is_sentence v)\"\n using derives_is_sentence by blast\n then have bv_sentences: \"is_sentence b \\ is_sentence v\" using is_sentence_b by blast \n have 1: \"derives (a@b) (u@b)\"\n apply (rule_tac derives_pad[OF au, where u=\"[]\", simplified])\n using is_sentence_b by auto\n have 2: \"derives (u@b) (u@v)\"\n apply (rule_tac derives_pad[OF bv, where v=\"[]\", simplified])\n apply (simp add: au_sentences)\n done\n from 1 2 derives_trans show ?thesis by blast\nqed \n\nlemma is_sentence_item_\\: \"wellformed_item x \\ is_sentence (item_\\ x)\"\n by (metis is_sentence_take item_\\_def item_rhs_def prod.collapse rule_\\_type wellformed_item_def)\n\nlemma is_nonterminal_item_nonterminal: \"wellformed_item x \\ is_nonterminal (item_nonterminal x)\"\n by (metis item_nonterminal_def prod.collapse rule_nonterminal_type wellformed_item_def)\n \nlemma Complete_elem_in_Gen:\n assumes I_in_Gen: \"I \\ Gen (\\

k u)\"\n assumes k: \"k \\ length Doc\"\n assumes x_in_Complete: \"x \\ Complete k I\"\n shows \"x \\ Gen (\\

k u)\"\nproof -\n let ?P = \"\\

k u\"\n from x_in_Complete have \"x \\ I \\ (\\ x1 x2. x = inc_item x1 k \\ \n x1 \\ bin I (item_origin x2) \\ x2 \\ bin I k \\ is_complete x2 \\ \n next_symbol x1 = Some (item_nonterminal x2))\"\n by (auto simp add: Complete_def)\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1 thus ?case using I_in_Gen subsetCE by blast \n next\n case 2 \n then obtain x1 x2 where x12: \"x = inc_item x1 k \\ \n x1 \\ bin I (item_origin x2) \\ x2 \\ bin I k \\ is_complete x2 \\ \n next_symbol x1 = Some (item_nonterminal x2)\" by blast\n from x12 have \"\\ p1 p2. p1 \\ ?P \\ pvalid p1 x1 \\ p2 \\ ?P \\ pvalid p2 x2\"\n by (meson Gen_implies_pvalid I_in_Gen bin_elem subsetCE)\n then obtain p1 p2 where p1: \"p1 \\ ?P \\ pvalid p1 x1\" and p2: \"p2 \\ ?P \\ pvalid p2 x2\"\n by blast\n from p1 obtain w \\ where p1valid:\n \"wellformed_tokens p1 \\\n wellformed_item x1 \\\n w \\ length p1 \\\n charslength p1 = item_end x1 \\\n charslength (take w p1) = item_origin x1 \\\n is_derivation (terminals (take w p1) @ [item_nonterminal x1] @ \\) \\\n derives (item_\\ x1) (terminals (drop w p1))\"\n using pvalid_def by blast\n from p2 obtain y \\ where p2valid:\n \"wellformed_tokens p2 \\\n wellformed_item x2 \\\n y \\ length p2 \\\n charslength p2 = item_end x2 \\\n charslength (take y p2) = item_origin x2 \\\n is_derivation (terminals (take y p2) @ [item_nonterminal x2] @ \\) \\\n derives (item_\\ x2) (terminals (drop y p2))\"\n using pvalid_def by blast\n let ?r = \"p1 @ (drop y p2)\"\n have charslength_p1_eq: \"charslength p1 = item_end x1\" by (simp only: p1valid)\n from x12 have item_end_x1: \"item_end x1 = item_origin x2\" \n using bin_def mem_Collect_eq by blast\n have item_end_x2: \"item_end x2 = k\" using bin_def x12 by blast \n then have charslength_p1_leq: \"charslength p1 \\ k\"\n using charslength_p1_eq item_end_x1 p2valid wellformed_item_def by auto \n have \"\\\\'. item_\\ x1 = [item_nonterminal x2] @ \\'\"\n by (simp add: next_symbol_starts_item_\\ p1valid x12) \n then obtain \\' where \\': \"item_\\ x1 = [item_nonterminal x2] @ \\'\" by blast\n have \"is_derivation ((terminals (take w p1))@(item_rhs x1)@\\)\"\n using is_derivation_derives p1valid wellformed_item_derives by blast\n then have \"is_derivation ((terminals (take w p1))@(item_\\ x1 @ item_\\ x1)@\\)\"\n by (simp add: item_rhs_split)\n then have \"is_derivation ((terminals (take w p1))@((terminals (drop w p1)) @ item_\\ x1)@\\)\"\n using is_derivation_derives p1valid by auto\n then have \"is_derivation ((terminals p1)@(item_\\ x1)@\\)\"\n by (metis append_assoc append_take_drop_id terminals_append)\n then have \"is_derivation ((terminals p1)@([item_nonterminal x2] @ \\')@\\)\"\n using is_derivation_derives \\' by auto\n then have \"is_derivation ((terminals p1)@(terminals (drop y p2)) @ \\' @\\)\"\n using is_complete_def is_derivation_derives is_derivation_step item_\\_def \n item_nonterminal_def item_rhs_def p2valid wellformed_item_def x12 by auto\n then have \"is_derivation (terminals (p1 @ (drop y p2)) @ (\\' @ \\))\" by simp\n then have admissible_r: \"admissible (p1 @ (drop y p2))\"\n apply (rule_tac is_derivation_implies_admissible)\n apply auto\n apply (rule is_word_terminals)\n apply (simp add: p1valid)\n using p2valid using is_word_terminals_drop terminals_drop by auto \n have r_in_dom: \"?r \\ \\

k u\"\n apply (rule_tac general_compatibility)\n apply (simp add: p1)\n apply (simp add: p2)\n apply (simp only: p2valid charslength_p1_eq item_end_x1)\n apply (simp only: charslength_p1_leq)\n by (simp add: admissible_r)\n have wellformed_r: \"wellformed_tokens ?r\" \n using admissible_r admissible_wellformed_tokens by blast \n have wellformed_x: \"wellformed_item x\"\n apply (simp add: x12)\n apply (rule_tac wellformed_inc_item)\n apply (simp add: p1valid)\n apply (simp add: x12)\n apply (simp add: k)\n using charslength_p1_eq charslength_p1_leq by auto\n have charslength_p1_as_p2: \"charslength p1 = charslength (take y p2)\"\n using charslength_p1_eq item_end_x1 p2valid by linarith \n then have charslength_r: \"charslength ?r = item_end x\"\n apply (simp add: x12)\n apply (subst length_append[symmetric])\n apply (subst chars_append[symmetric])\n apply (subst append_take_drop_id)\n using item_end_x2 p2valid by auto\n have item_\\_x: \"item_\\ x = item_\\ x1 @ [item_nonterminal x2]\"\n using x12 p1valid by (simp add: item_\\_of_inc_item)\n from p2valid have derives_item_nonterminal_x2:\n \"derives [item_nonterminal x2] (terminals (drop y p2))\"\n using derives_trans wellformed_complete_item_derives x12 by blast\n have \"pvalid ?r x\"\n apply (auto simp only: pvalid_def)\n apply (rule_tac x=w in exI)\n apply (rule_tac x=\\ in exI)\n apply (auto simp only:)\n apply (simp add: wellformed_r)\n apply (simp add: wellformed_x)\n using p1valid apply simp\n apply (simp only: charslength_r)\n using x12 p1valid apply simp\n using x12 p1valid apply simp\n apply (simp add: item_\\_x)\n apply (rule_tac derives_append)\n using p1valid apply simp\n using derives_item_nonterminal_x2 p1valid apply auto[1]\n using is_sentence_item_\\ p1valid apply blast\n using is_derivation_is_sentence is_sentence_concat p2valid by blast\n with r_in_dom show ?case using Gen_def mem_Collect_eq by blast\n qed\nqed\n\nlemma Complete_subset_Gen:\n assumes I_in_Gen_P: \"I \\ Gen (\\

k u)\"\n assumes k: \"k \\ length Doc\"\n shows \"Complete k I \\ Gen (\\

k u)\"\nusing Complete_elem_in_Gen I_in_Gen_P k by blast\n\nlemma \\

_are_admissible: \"p \\ \\

k u \\ admissible p\"\napply (rule_tac \\_are_admissible)\nusing \\_covers_\\

subsetCE by blast\n\nlemma is_continuation_base:\n assumes p_dom: \"p \\ \\

k u\"\n assumes charslength_p: \"charslength p = k\"\n shows \"is_continuation k u p []\"\napply (auto simp add: is_continuation_def)\napply (simp add: p_dom)\nusing charslength_p apply simp\nusing \\

_are_admissible p_dom by blast\n\nlemma is_continuation_empty_chars: \n \"is_continuation k u q ts \\ charslength (q@ts) = k \\ chars ts = []\"\nby (simp add: is_continuation_def)\n\nlemma \\_subset: \"u \\ v \\ \\ k u \\ \\ k v\"\nusing \\_subset_Suc subset_fSuc by blast\n\nlemma is_continuation_increase_u:\n assumes cont: \"is_continuation k u q ts\"\n assumes uv: \"u \\ v\"\n shows \"is_continuation k v q ts\"\nproof -\n have \"q \\ \\

k u\" using cont is_continuation_def by blast\n with uv have q_dom: \"q \\ \\

k v\" by (meson subsetCE subset_\\

k) \n from uv have \\: \"\\ t. t \\ \\ k (Suc u) \\ t \\ \\ k (Suc v)\"\n using \\_subset le_neq_implies_less less_imp_le_nat not_less_eq subsetCE by blast \n show ?thesis\n apply (auto simp only: is_continuation_def)\n apply (simp add: q_dom)\n using cont is_continuation_def apply simp\n using cont is_continuation_def apply simp\n using cont is_continuation_def \\ apply simp\n using cont is_continuation_def apply (simp only:)\n done\nqed\n\nlemma pvalid_next_symbol_derivable:\n assumes pvalid: \"pvalid p x\" \n assumes next_symbol: \"next_symbol x = Some s\"\n shows \"\\ \\. is_derivation((terminals p)@[s]@\\)\"\nproof -\n from pvalid pvalid_def have wellformed_x: \"wellformed_item x\" by auto\n from next_symbol_starts_item_\\[OF wellformed_x next_symbol]\n obtain \\ where \\: \"item_\\ x = [s] @ \\\" by auto\n from pvalid have \"\\ \\. is_derivation((terminals p)@(item_\\ x)@\\)\"\n using pvalid_is_derivation_terminals_item_\\ by blast\n then obtain \\ where \"is_derivation((terminals p)@(item_\\ x)@\\)\" by blast\n with \\ have \"is_derivation((terminals p)@[s]@\\@\\)\" by auto\n then show ?thesis by blast\nqed\n\nlemma pvalid_admissible: \n assumes pvalid: \"pvalid p x\" \n shows \"admissible p\"\nproof -\n have \"\\ \\. is_derivation((terminals p)@(item_\\ x)@\\)\"\n by (simp add: pvalid pvalid_is_derivation_terminals_item_\\)\n then obtain \\ where \\: \"is_derivation((terminals p)@(item_\\ x)@\\)\" by blast\n have is_word: \"is_word (terminals p)\"\n using pvalid_def is_word_terminals pvalid by blast \n show ?thesis using \\ is_derivation_implies_admissible is_word by blast\nqed \n\nlemma pvalid_next_terminal_admissible:\n assumes pvalid: \"pvalid p x\" \n assumes next_symbol: \"next_symbol x = Some t\"\n assumes terminal: \"is_terminal t\"\n shows \"admissible (p@[(t, c)])\"\nproof -\n have \"is_word (terminals p)\"\n using is_word_terminals pvalid pvalid_def by blast\n then show ?thesis\n using is_derivation_implies_admissible next_symbol pvalid pvalid_next_symbol_derivable \n terminal by fastforce\nqed\n\nlemma \\_wellformed: \"t \\ \\ k \\ wellformed_token t\"\n by (simp add: \\_are_terminals wellformed_token_def)\n\nlemma \\_wellformed: \"t \\ \\ k u \\ wellformed_token t\"\n using \\_wellformed \\_subset_\\ by blast\n \nlemma Scan_elem_in_Gen:\n assumes I_in_Gen: \"I \\ Gen (\\

k u)\"\n assumes k: \"k \\ length Doc\"\n assumes T: \"T \\ \\ k u\"\n assumes x_in_Scan: \"x \\ Scan T k I\"\n shows \"x \\ Gen (\\

k u)\"\nproof -\n have \"u = 0 \\ x \\ I\" \n proof -\n assume \"u = 0\"\n then have \"\\ k u = {}\" by simp\n then have \"T = {}\" using T by blast\n then have \"Scan T k I = I\" by (simp add: Scan_empty)\n then show \"x \\ I\" using x_in_Scan by simp\n qed\n then have \"x \\ I \\ (u > 0 \\ (\\ y t c. x = inc_item y (k + length c) \\ y \\ bin I k \\ \n (t, c) \\ T \\ next_symbol y = Some t))\" using x_in_Scan Scan_def by auto\n then show ?thesis\n proof (induct rule: disjCases2)\n case 1 thus ?case using I_in_Gen by blast\n next\n case 2 \n then obtain y t c where x_is_scan: \"x = inc_item y (k + length c) \\ y \\ bin I k \\ \n (t, c) \\ T \\ next_symbol y = Some t\" by blast\n have u_gt_0: \"0 < u\" using 2 by blast\n have \"\\ p \\ \\

k u. pvalid p y\" using Gen_implies_pvalid I_in_Gen bin_elem x_is_scan by blast \n then obtain p where p: \"p \\ \\

k u \\ pvalid p y\" by blast\n have p_dom: \"p \\ \\

k u\" using p by blast\n from p pvalid_def x_is_scan have charslength_p: \"charslength p = k\"\n using bin_def mem_Collect_eq by auto \n obtain tok where tok: \"tok = (t, c)\" using x_is_scan by blast\n have tok_dom: \"tok \\ \\ k u\" using tok x_is_scan T by blast\n have \"p = [] \\ p \\ []\" by blast\n then have \"\\ q ts u'. p = q@ts \\ u' < u \\ charslength ts = 0 \\ is_continuation k u' q ts\"\n proof (induct rule: disjCases2)\n case 1 thus ?case\n apply (rule_tac x=p in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (rule_tac x=\"0\" in exI)\n apply (simp add: 2 is_continuation_def)\n using charslength_p by simp\n next\n case 2\n from final_step_of_path[OF p_dom 2] obtain q ts k' u'\n where final_step: \"p = q @ ts \\ indexlt k' u' k u \\ is_continuation k' u' q ts\" by blast\n then have \"k' \\ k\" using indexlt_simp by auto \n then have \"k' < k \\ k' = k\" by arith\n then show ?case\n proof (induct rule: disjCases2)\n case 1 \n have \"p \\ \\

k' (Suc u')\" using final_step is_continuation_in_\\

by blast \n then have p_dom: \"p \\ \\

k 0\" by (meson 1 subsetCE subset_\\

) \n with charslength_p have \"is_continuation k 0 p []\" using is_continuation_base by blast \n then show ?case\n apply (rule_tac x=p in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (rule_tac x=\"0\" in exI)\n apply (simp add: u_gt_0)\n done\n next\n case 2\n with final_step indexlt_simp have \"u' < u\" by auto\n then show ?case\n apply (rule_tac x=q in exI)\n apply (rule_tac x=ts in exI)\n apply (rule_tac x=u' in exI)\n using final_step 2 apply auto\n using charslength_p is_continuation_empty_chars by blast\n qed\n qed\n then obtain q ts u' where \n p_split: \"p = q@ts \\ u' < u \\ charslength ts = 0 \\ is_continuation k u' q ts\" by blast\n then have \"\\ u''. u' \\ u'' \\ Suc u'' = u\" by (auto, arith)\n then obtain u'' where u'': \" u' \\ u'' \\ Suc u'' = u\" by blast\n with p_split have cont_u'': \"is_continuation k u'' q ts\" \n using is_continuation_increase_u by blast \n have admissible: \"admissible (p@[tok])\"\n apply (simp add: tok)\n apply (rule_tac pvalid_next_terminal_admissible[where x=y])\n apply (simp add: p)\n apply (simp add: x_is_scan)\n using \\_wellformed tok tok_dom wellformed_token_def by auto \n have \"is_continuation k u'' q (ts@[tok])\"\n apply (rule is_continuation_continue)\n apply (simp add: cont_u'')\n using p_split apply simp\n using u'' tok_dom apply simp\n using admissible p_split by auto\n with p_split u'' have ptok_dom: \"p@[tok] \\ \\

k u\" \n using append_assoc is_continuation_in_\\

by auto \n from p obtain i \\ where valid:\n \"wellformed_tokens p \\\n wellformed_item y \\\n i \\ length p \\\n charslength p = item_end y \\\n charslength (take i p) = item_origin y \\\n is_derivation (terminals (take i p) @ [item_nonterminal y] @ \\) \\\n derives (item_\\ y) (terminals (drop i p))\" using pvalid_def by blast \n have clen_ptok: \"k + length c = charslength (p@[tok])\"\n using charslength_p tok by simp\n from ptok_dom have ptok_doc_tokens: \"doc_tokens (p@[tok])\"\n using \\_are_doc_tokens \\_covers_\\

rev_subsetD by blast\n have wellformed_x: \"wellformed_item x\"\n apply (simp add: x_is_scan)\n apply (rule_tac wellformed_inc_item)\n apply (simp add: valid)\n apply (simp add: x_is_scan)\n apply (simp only: clen_ptok) \n using ptok_doc_tokens charslength.simps doc_tokens_length apply presburger \n apply (simp only: clen_ptok)\n using valid by auto\n have \"pvalid (p@[tok]) x\"\n apply (auto simp only: pvalid_def)\n apply (rule_tac x=i in exI)\n apply (rule_tac x=\\ in exI)\n apply (auto simp only:)\n using ptok_dom admissible admissible_wellformed_tokens apply blast \n apply (simp add: wellformed_x)\n using valid apply simp\n apply (simp add: x_is_scan clen_ptok)\n using valid apply (simp add: x_is_scan)\n using valid apply (simp add: x_is_scan)\n using valid apply (simp add: x_is_scan)\n apply (subst item_\\_of_inc_item)\n using valid apply simp\n using x_is_scan apply simp\n apply (rule_tac derives_append)\n apply simp\n apply (simp add: tok)\n using is_sentence_item_\\ apply blast\n by (meson pvalid_next_symbol_derivable LocalLexing_axioms is_derivation_is_sentence \n is_sentence_concat p x_is_scan)\n with ptok_dom show ?thesis\n using Gen_def mem_Collect_eq by blast\n qed\nqed\n\nlemma Scan_subset_Gen:\n assumes I_in_Gen: \"I \\ Gen (\\

k u)\"\n assumes k: \"k \\ length Doc\"\n assumes T: \"T \\ \\ k u\"\n shows \"Scan T k I \\ Gen (\\

k u)\"\nusing I_in_Gen Scan_elem_in_Gen T k by blast\n\ntheorem thmD5:\n assumes I: \"I \\ Gen (\\

k u)\"\n assumes k: \"k \\ length Doc\"\n assumes T: \"T \\ \\ k u\"\n shows \"\\ k T I \\ Gen (\\

k u)\"\napply (simp add: \\_def)\napply (rule_tac limit_upperbound)\nusing I k T Predict_subset_Gen Complete_subset_Gen Scan_subset_Gen apply metis\nby (simp add: I)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LocalLexing/TheoremD5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.25993055671454346}} {"text": "theory LaunchburyAbstractTransformation\nimports Launchbury\nbegin\n\n\nlocale reds_rel = \n fixes rel :: \"(heap \\ exp) \\ var list \\ (heap \\ exp) \\ bool\" (\"_ \\\\<^bsub>_\\<^esub> _\" [50,50,50] 50 )\n\nlocale reds_rel_fresh = reds_rel +\n assumes fresh_rel1[simp]: \"(\\, e) \\\\<^bsub>L\\<^esub> (\\', e') \\ a \\ \\ \\ a \\ \\'\"\n assumes fresh_rel2[simp]: \"(\\, e) \\\\<^bsub>L\\<^esub> (\\', e') \\ a \\ e \\ a \\ e'\"\n\nlocale rel_lambda_cong = reds_rel + \n assumes rel_lambda_cong: \"(\\, Lam [x]. e) \\\\<^bsub>L\\<^esub> (\\', lam) \\ (\\e'. lam = Lam [x]. e' \\ thesis) \\ thesis\"\n\nlocale rel_lambda_case = rel_lambda_cong\nbegin\nlemma lambda_case:\n fixes \\ x e L \\' e'\n assumes \"(\\, Lam [x]. e) \\\\<^bsub>L\\<^esub> (\\', e')\"\n shows \"\\\\' z'. (\\, Lam [x]. e) \\\\<^bsub>L\\<^esub> (\\', z') \\ \\' : e' \\\\<^bsub>L\\<^esub> \\' : z'\"\nproof-\n note assms\n moreover\n then obtain e'' where \"e' = Lam [x]. e''\" by (rule rel_lambda_cong)\n moreover\n have \"\\' : Lam [x]. e'' \\\\<^bsub>L\\<^esub> \\' : Lam [x]. e''\"..\n ultimately show ?thesis by auto\nqed\nend\n\nlocale rel_app_cong = reds_rel + \n assumes rel_app_cong: \"(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', e') \\ (\\e''. e' = App e'' x \\ thesis) \\ thesis\"\n\nlocale rel_app_case = reds_rel_fresh + rel_lambda_cong + rel_app_cong +\n assumes rel_app_apply: \"(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', App e'' x) \\ (\\, e) \\\\<^bsub>x # L\\<^esub> (\\', e'')\"\n assumes rel_lam_subst: \"(\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\', Lam [y]. body') \\ (\\, body[y::=x]) \\\\<^bsub>L\\<^esub> (\\', body'[y::=x])\"\nbegin\nlemma app_case:\n fixes y \\ e x L \\ \\ z body\n assumes \"atom y \\ \\\"\n assumes \"atom y \\ e\"\n assumes \"atom y \\ x\"\n assumes \"atom y \\ L\"\n assumes \"atom y \\ \\\"\n assumes \"atom y \\ \\\"\n assumes \"atom y \\ z\"\n assumes \"\\ : e \\\\<^bsub>x # L\\<^esub> \\ : Lam [y]. body\"\n assumes \"\\ \\' e'. (\\, e) \\\\<^bsub>x # L\\<^esub> (\\', e') \\ \\\\'' z'. (\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\'', z') \\ \\' : e' \\\\<^bsub>x # L\\<^esub> \\'' : z'\"\n assumes \"\\ : body[y::=x] \\\\<^bsub>L\\<^esub> \\ : z\"\n assumes \"\\ \\' e'. (\\, body[y::=x]) \\\\<^bsub>L\\<^esub> (\\', e') \\ \\\\' z'. (\\, z) \\\\<^bsub>L\\<^esub> (\\', z') \\ \\' : e' \\\\<^bsub>L\\<^esub> \\' : z'\"\n assumes \"(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', e')\"\n shows \"\\\\' z'. (\\, z) \\\\<^bsub>L\\<^esub> (\\', z') \\ \\' : e' \\\\<^bsub>L\\<^esub> \\' : z'\"\nproof-\n from `(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', e')`\n obtain e'' where \"e' = App e'' x\" by (rule rel_app_cong)\n from `(\\, App e x) \\\\<^bsub>L\\<^esub> (\\', e')`[unfolded this]\n have \"(\\, e) \\\\<^bsub>x # L\\<^esub> (\\', e'')\" by (rule rel_app_apply)\n from assms(9)[OF this]\n obtain \\' lam\n where \"(\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\', lam)\" and reds1: \"\\' : e'' \\\\<^bsub>x # L\\<^esub> \\' : lam\" by blast\n from this(1)\n obtain body' where \"lam = Lam [y]. body'\" by (rule rel_lambda_cong)\n\n from `(\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\', lam)`[unfolded `lam = _`]\n have \"(\\, body[y::=x]) \\\\<^bsub>L\\<^esub> (\\', body'[y::=x])\" by (rule rel_lam_subst)\n from assms(11)[OF this]\n obtain \\' z'\n where \"(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')\" and reds2: \"\\' : body'[y::=x] \\\\<^bsub>L\\<^esub> \\' : z'\" by blast\n\n have \"atom y \\ (\\', e'', x, L, \\', \\', z')\"\n using assms(1-7) `(\\, e) \\\\<^bsub>x # L\\<^esub> (\\', e'')` `(\\, Lam [y]. body) \\\\<^bsub>x # L\\<^esub> (\\', lam)` `(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')`\n by (auto simp add: fresh_Pair)\n \n hence \"\\' : App e'' x \\\\<^bsub>L\\<^esub> \\' : z'\"\n by (rule reds.Application[OF _ reds1[unfolded `lam = _`] reds2])\n with `(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')` `e' = _`\n show ?thesis by blast\nqed\nend\n\nlocale rel_var_cong = reds_rel + \n assumes rel_var_cong: \"(\\, Var x) \\\\<^bsub>L\\<^esub> (\\', e') \\ e' = Var x\"\n\nlocale rel_var_case = rel_var_cong +\n assumes rel_lookup: \"(\\, Var x) \\\\<^bsub>L\\<^esub> (\\', Var x) \\ map_of \\ x = Some e \\ (\\e'. map_of \\' x = Some e' \\ (delete x \\, e) \\\\<^bsub>x # L\\<^esub> (delete x \\', e') \\ thesis) \\ thesis\"\n assumes rel_add_binding: \" x \\ domA \\ \\ (\\, z) \\\\<^bsub>x # L\\<^esub> (\\'', z') \\ ((x, z) # \\, z) \\\\<^bsub>L\\<^esub> ((x, z') # \\'', z')\"\nbegin\nlemma var_case:\n fixes \\ x e L \\ z \\' var\n assumes \"map_of \\ x = Some e\"\n assumes \"delete x \\ : e \\\\<^bsub>x # L\\<^esub> \\ : z\"\n assumes \"\\ \\' e'. (delete x \\, e) \\\\<^bsub>x # L\\<^esub> (\\', e') \\ \\\\'' z'. (\\, z) \\\\<^bsub>x # L\\<^esub> (\\'', z') \\ \\' : e' \\\\<^bsub>x # L\\<^esub> \\'' : z'\"\n assumes \"(\\, Var x) \\\\<^bsub>L\\<^esub> (\\', var)\"\n shows \"\\\\'' z'. ((x, z) # \\, z) \\\\<^bsub>L\\<^esub> (\\'', z') \\ \\' : var \\\\<^bsub>L\\<^esub> \\'' : z'\"\n proof-\n from `(\\, Var x) \\\\<^bsub>L\\<^esub> (\\', var)`\n have \"var = Var x\" by (rule rel_var_cong)\n \n from `(\\, Var x) \\\\<^bsub>L\\<^esub> (\\', var)`[unfolded `var = _`]\n and `map_of \\ x = Some e`\n obtain e' where \"map_of \\' x = Some e'\" and \"(delete x \\, e) \\\\<^bsub>x # L\\<^esub> (delete x \\', e')\" by (rule rel_lookup)\n from assms(3)[OF this(2)]\n obtain \\'' z'\n where \"(\\, z) \\\\<^bsub>x # L\\<^esub> (\\'', z')\" and \"delete x \\' : e' \\\\<^bsub>x # L\\<^esub> \\'' : z'\" by blast\n\n have \"x \\ domA \\\" by (rule reds_avoids_live[OF assms(2)]) simp_all\n with `(\\, z) \\\\<^bsub>x # L\\<^esub> (\\'', z')`\n have \"((x,z)#\\, z) \\\\<^bsub>L\\<^esub> ((x,z')#\\'', z')\" by (rule rel_add_binding[rotated])\n moreover\n from `map_of \\' x = Some e'` and `delete x \\' : e' \\\\<^bsub>x # L\\<^esub> \\'' : z'`\n have \"\\' : (Var x) \\\\<^bsub>L\\<^esub> (x,z')#\\'' : z'\"..\n ultimately\n show ?thesis unfolding `var = _` by auto\n qed\nend\n\nlocale rel_let_cong = reds_rel +\n fixes \\ as body\n assumes rel_let_cong: \"(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let') \\ (\\as' body'. let' = Let as' body' \\ map fst as = map fst as' \\ thesis) \\ thesis\"\n\nlocale rel_let_case = rel_let_cong + reds_rel_fresh + \n assumes rel_let:\n \"(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', Let as' body') \\\n map fst as = map fst as' \\\n atom ` domA as \\* \\ \\ \n atom ` domA as \\* L \\ \n (as @ \\, body) \\\\<^bsub>L\\<^esub> (as' @ \\', body')\"\n (* assumes rel_heap_subset: \" (\\, e) \\\\<^bsub>L\\<^esub> (\\', e'') \\ domA as' \\ domA as\" *)\nbegin\nlemma let_case:\n fixes L \\ z \\' let'\n assumes \"atom ` domA as \\* \\\"\n assumes \"atom ` domA as \\* L\"\n assumes \"as @ \\ : body \\\\<^bsub>L\\<^esub> \\ : z\"\n assumes \"\\ \\' e' . (as @ \\, body) \\\\<^bsub>L\\<^esub> (\\', e') \\ \\\\'' z'. (\\, z) \\\\<^bsub>L\\<^esub> (\\'', z') \\ \\' : e' \\\\<^bsub>L\\<^esub> \\'' : z'\"\n assumes \"(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let')\"\n shows \"\\\\'' z'. (\\, z) \\\\<^bsub>L\\<^esub> (\\'', z') \\ \\' : let' \\\\<^bsub>L\\<^esub> \\'' : z'\"\nproof-\n from `(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let')`\n obtain as' body' where \"let' = Let as' body'\" and \"map fst as = map fst as'\" by (rule rel_let_cong)\n\n from `(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let')`[unfolded `let' = _`] `map _ _ = _` assms(1,2)\n have \"(as@\\, body) \\\\<^bsub>L\\<^esub> (as'@\\', body')\" by (rule rel_let)\n from assms(4)[OF this]\n obtain \\' z' where \"(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')\" and \"as' @ \\' : body' \\\\<^bsub>L\\<^esub> \\' : z'\" by blast\n\n (* from `(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let')`[unfolded `let' = _`] *)\n have \"domA as' \\ domA as\" using `map fst as = map fst as'` unfolding domA_def by (metis list.set_map order_refl)\n hence \"atom ` domA as' \\* (\\', L)\"\n using assms(1-2) `(\\, Let as body) \\\\<^bsub>L\\<^esub> (\\', let')`\n by (auto simp add: fresh_Pair fresh_star_def)\n\n from this `as' @ \\' : body' \\\\<^bsub>L\\<^esub> \\' : z'`\n have \"\\' : Let as' body' \\\\<^bsub>L\\<^esub> \\' : z'\"\n by (rule reds.Let)\n with `(\\, z) \\\\<^bsub>L\\<^esub> (\\', z')`\n show ?thesis unfolding `let' = _` by auto\nqed\nend\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/LaunchburyAbstractTransformation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2599305567145434}} {"text": "theory R_L_Spark_User\nimports\n R_L_Spark_Specification\n R_L_Spark_Declaration\n Global_User\nbegin\n\nlemma goal2'1:\n assumes \"0 <= j''\"\n assumes \"j'' <= 79\"\n shows\n \"(block_permutation___default_arr''\n (0 := 0, 1 := 1, 2 := 2, 3 := 3, 4 := 4, 5 := 5, 6 := 6, 7 := 7,\n 8 := 8, 9 := 9, 10 := 10, 11 := 11, 12 := 12, 13 := 13, 14 := 14,\n 15 := 15, 16 := 7, 17 := 4, 18 := 13, 19 := 1, 20 := 10, 21 := 6,\n 22 := 15, 23 := 3, 24 := 12, 25 := 0, 26 := 9, 27 := 5, 28 := 2,\n 29 := 14, 30 := 11, 31 := 8, 32 := 3, 33 := 10, 34 := 14, 35 := 4,\n 36 := 9, 37 := 15, 38 := 8, 39 := 1, 40 := 2, 41 := 7, 42 := 0,\n 43 := 6, 44 := 13, 45 := 11, 46 := 5, 47 := 12, 48 := 1, 49 := 9,\n 50 := 11, 51 := 10, 52 := 0, 53 := 8, 54 := 12, 55 := 4, 56 := 13,\n 57 := 3, 58 := 7, 59 := 15, 60 := 14, 61 := 5, 62 := 6, 63 := 2,\n 64 := 4, 65 := 0, 66 := 5, 67 := 9, 68 := 7, 69 := 12, 70 := 2,\n 71 := 10, 72 := 14, 73 := 1, 74 := 3, 75 := 8, 76 := 11, 77 := 6,\n 78 := 15, 79 := 13))\n j'' =\n R_L_Spark_Specification.r_l' j''\"\nproof -\n note nth_list_to_fun_eff_eq\n moreover have \"0 <= nat j''\" by simp\n moreover from `j'' <= 79` have \"nat j'' < length r_list\"\n unfolding r_list_def by simp\n ultimately have conversion:\n \"int (r_list ! nat j'') =\n list_to_fun_eff\n r_list 0 block_permutation___default_arr'' (int (nat j''))\" .\n show ?thesis\n unfolding r_def conversion\n unfolding r_list_def\n using `0 <= j''` `j'' <= 79`\n by simp\nqed\n\nlemma goal2'2:\n assumes \"0 <= j''\"\n assumes \"j'' <= 79\"\n shows \"0 \\ (block_permutation___default_arr''\n (0 := 0, 1 := 1, 2 := 2, 3 := 3, 4 := 4, 5 := 5, 6 := 6, 7 := 7,\n 8 := 8, 9 := 9, 10 := 10, 11 := 11, 12 := 12, 13 := 13, 14 := 14,\n 15 := 15, 16 := 7, 17 := 4, 18 := 13, 19 := 1, 20 := 10, 21 := 6,\n 22 := 15, 23 := 3, 24 := 12, 25 := 0, 26 := 9, 27 := 5, 28 := 2,\n 29 := 14, 30 := 11, 31 := 8, 32 := 3, 33 := 10, 34 := 14, 35 := 4,\n 36 := 9, 37 := 15, 38 := 8, 39 := 1, 40 := 2, 41 := 7, 42 := 0,\n 43 := 6, 44 := 13, 45 := 11, 46 := 5, 47 := 12, 48 := 1, 49 := 9,\n 50 := 11, 51 := 10, 52 := 0, 53 := 8, 54 := 12, 55 := 4, 56 := 13,\n 57 := 3, 58 := 7, 59 := 15, 60 := 14, 61 := 5, 62 := 6, 63 := 2,\n 64 := 4, 65 := 0, 66 := 5, 67 := 9, 68 := 7, 69 := 12, 70 := 2,\n 71 := 10, 72 := 14, 73 := 1, 74 := 3, 75 := 8, 76 := 11, 77 := 6,\n 78 := 15, 79 := 13))\n j''\"\n unfolding goal2'1[OF assms]\nby simp\n\nlemma goal2'3:\n assumes \"0 <= j''\"\n assumes \"j'' <= 79\"\n shows\n \"(block_permutation___default_arr''\n (0 := 0, 1 := 1, 2 := 2, 3 := 3, 4 := 4, 5 := 5, 6 := 6, 7 := 7,\n 8 := 8, 9 := 9, 10 := 10, 11 := 11, 12 := 12, 13 := 13, 14 := 14,\n 15 := 15, 16 := 7, 17 := 4, 18 := 13, 19 := 1, 20 := 10, 21 := 6,\n 22 := 15, 23 := 3, 24 := 12, 25 := 0, 26 := 9, 27 := 5, 28 := 2,\n 29 := 14, 30 := 11, 31 := 8, 32 := 3, 33 := 10, 34 := 14, 35 := 4,\n 36 := 9, 37 := 15, 38 := 8, 39 := 1, 40 := 2, 41 := 7, 42 := 0,\n 43 := 6, 44 := 13, 45 := 11, 46 := 5, 47 := 12, 48 := 1, 49 := 9,\n 50 := 11, 51 := 10, 52 := 0, 53 := 8, 54 := 12, 55 := 4, 56 := 13,\n 57 := 3, 58 := 7, 59 := 15, 60 := 14, 61 := 5, 62 := 6, 63 := 2,\n 64 := 4, 65 := 0, 66 := 5, 67 := 9, 68 := 7, 69 := 12, 70 := 2,\n 71 := 10, 72 := 14, 73 := 1, 74 := 3, 75 := 8, 76 := 11, 77 := 6,\n 78 := 15, 79 := 13))\n j''\n \\ 15\"\nproof -\n have \"r_list ! nat j'' \\ foldl max 0 r_list\"\n by (insert assms, rule list_max) (simp_all add: r_list_def)\n thus ?thesis unfolding goal2'1[OF assms] r_def\n by (rule list_max_int) (simp_all add: assms r_list_def)\nqed\n\nlemmas userlemmas = goal2'1 goal2'2 goal2'3\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/RIPEMD-160-SPARK/R_L_Spark_User.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.2598774697734578}} {"text": "chapter\\Main Theorems\\\n\ntheory Hygge_Theory\nimports\n Corecursive_Prop\n\nbegin\ntext \\\n Using the properties we have shown about the interpretation of configurations \n and the stepwise unfolding of the denotational semantics, we can now prove \n several important results about the construction of runs from a specification.\n\\\nsection \\Initial configuration\\\n\ntext \\\n The denotational semantics of a specification @{term \\\\\\} is the interpretation \n at the first instant of a configuration which has @{term \\\\\\} as its present.\n This means that we can start to build a run that satisfies a specification by \n starting from this configuration.\n\\\n\n\nsection \\Soundness\\\ntext \\\n The interpretation of a configuration @{term \\\\\\<^sub>2\\} that is a refinement of a\n configuration @{term \\\\\\<^sub>1\\} is contained in the interpretation of @{term \\\\\\<^sub>1\\}.\n This means that by making successive choices in building the instants of a run,\n we preserve the soundness of the constructed run with regard to the original \n specification.\n\\\nlemma sound_reduction:\n assumes \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) \\ (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n shows \\\\\\ \\\\<^sub>1 \\\\\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\ \\\\ \\\\<^sub>1 \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\ n\\<^sub>1\\<^esup> \\ \\\\ \\\\<^sub>1 \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\ Suc n\\<^sub>1\\<^esup>\n \\ \\\\ \\\\<^sub>2 \\\\\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\ \\\\ \\\\<^sub>2 \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\ n\\<^sub>2\\<^esup> \\ \\\\ \\\\<^sub>2 \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\ Suc n\\<^sub>2\\<^esup>\\ (is ?P)\nproof -\n from assms consider\n (a) \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) \\\\<^sub>i (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n | (b) \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) \\\\<^sub>e (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n using operational_semantics_step.simps by blast\n thus ?thesis\n proof (cases)\n case a\n thus ?thesis by (simp add: operational_semantics_intro.simps)\n next\n case b thus ?thesis\n proof (rule operational_semantics_elim.cases)\n fix \\ n K\\<^sub>1 \\ K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ (K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\ \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (\\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_sporadicon_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 \\ K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ (K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\ \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\)\\\n thus ?P using HeronConf_interp_stepwise_sporadicon_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 R \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ (time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\ \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((\\\\\\<^sub>v\\<^sub>a\\<^sub>r (K\\<^sub>1, n), \\\\<^sub>v\\<^sub>a\\<^sub>r (K\\<^sub>2, n)\\ \\ R) # \\), n\n \\ \\ \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\))\\\n thus ?P using HeronConf_interp_stepwise_tagrel_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ (K\\<^sub>1 implies K\\<^sub>2) # \\ \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_implies_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_implies_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_implies_not_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_implies_not_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 \\\\ K\\<^sub>2 K\\<^sub>3 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) =\n (\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) =\n (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\\\n thus ?P using HeronConf_interp_stepwise_timedelayed_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 \\\\ K\\<^sub>2 K\\<^sub>3 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) =\n (\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\n = (((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\\\n thus ?P using HeronConf_interp_stepwise_timedelayed_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_weakly_precedes_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_strictly_precedes_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) = (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_kills_cases\n HeronConf_interpretation.simps by blast\n next\n fix \\ n K\\<^sub>1 K\\<^sub>2 \\ \\\n assume \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) = (\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\)\\\n and \\(\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) =\n (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\\\n thus ?P using HeronConf_interp_stepwise_kills_cases\n HeronConf_interpretation.simps by blast\n qed\n qed\nqed\n\ninductive_cases step_elim:\\\\\\<^sub>1 \\ \\\\<^sub>2\\\n\nlemma sound_reduction':\n assumes \\\\\\<^sub>1 \\ \\\\<^sub>2\\\n shows \\\\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof -\n have \\\\s\\<^sub>1 s\\<^sub>2. (\\ s\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ s\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g) \\ \\(s\\<^sub>1 \\ s\\<^sub>2)\\\n using sound_reduction by fastforce\n thus ?thesis using assms by blast\nqed\n\nlemma sound_reduction_generalized:\n assumes \\\\\\<^sub>1 \\\\<^bsup>k\\<^esup> \\\\<^sub>2\\\n shows \\\\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof -\n from assms show ?thesis\n proof (induction k arbitrary: \\\\<^sub>2)\n case 0\n hence *: \\\\\\<^sub>1 \\\\<^bsup>0\\<^esup> \\\\<^sub>2 \\ \\\\<^sub>1 = \\\\<^sub>2\\ by auto\n moreover have \\\\\\<^sub>1 = \\\\<^sub>2\\ using * \"0.prems\" by linarith\n ultimately show ?case by auto\n next\n case (Suc k)\n thus ?case\n proof -\n fix k :: nat\n assume ff: \\\\\\<^sub>1 \\\\<^bsup>Suc k\\<^esup> \\\\<^sub>2\\\n assume hi: \\\\\\\\<^sub>2. \\\\<^sub>1 \\\\<^bsup>k\\<^esup> \\\\<^sub>2 \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n obtain \\\\<^sub>n where red_decomp: \\(\\\\<^sub>1 \\\\<^bsup>k\\<^esup> \\\\<^sub>n) \\ (\\\\<^sub>n \\ \\\\<^sub>2)\\ using ff by auto\n hence \\\\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>n \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ using hi by simp\n also have \\\\ \\\\<^sub>n \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by (simp add: red_decomp sound_reduction')\n ultimately show \\\\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by simp\n qed\n qed\nqed\n\ntext \\\n From the initial configuration, a configuration @{term \\\\\\} obtained after any \n number @{term \\k\\} of reduction steps denotes runs from the \n initial specification @{term \\\\\\}.\n\\\ntheorem soundness:\n assumes \\([], 0 \\ \\ \\ []) \\\\<^bsup>k\\<^esup> \\\\\n shows \\\\\\ \\ \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using assms sound_reduction_generalized solve_start by blast\n\nsection \\Completeness\\\n\ntext \\\n We will now show that any run that satisfies a specification can be derived\n from the initial configuration, at any number of steps.\n\n We start by proving that any run that is denoted by a configuration @{term \\\\\\}\n is necessarily denoted by at least one of the configurations that can be reached\n from @{term \\\\\\}.\n\\\nlemma complete_direct_successors:\n shows \\\\ \\, n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ (\\X\\\\\\<^sub>n\\<^sub>e\\<^sub>x\\<^sub>t (\\, n \\ \\ \\ \\). \\ X \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\n proof (induct \\)\n case Nil\n show ?case\n using HeronConf_interp_stepwise_instant_cases operational_semantics_step.simps\n operational_semantics_intro.instant_i\n by fastforce\n next\n case (Cons \\ \\) thus ?case\n proof (cases \\)\n case (SporadicOn K1 \\ K2) thus ?thesis \n using HeronConf_interp_stepwise_sporadicon_cases\n [of \\\\\\ \\n\\ \\K1\\ \\\\\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_sporadicon[of \\\\\\ \\n\\ \\\\\\ \\K1\\ \\\\\\ \\K2\\ \\\\\\] by blast\n next\n case (TagRelation K\\<^sub>1 K\\<^sub>2 R) thus ?thesis\n using HeronConf_interp_stepwise_tagrel_cases\n [of \\\\\\ \\n\\ \\K\\<^sub>1\\ \\K\\<^sub>2\\ \\R\\ \\\\\\ \\\\\\]\n Cnext_solve_tagrel[of \\K\\<^sub>1\\ \\n\\ \\K\\<^sub>2\\ \\R\\ \\\\\\ \\\\\\ \\\\\\] by blast\n next\n case (Implies K1 K2) thus ?thesis\n using HeronConf_interp_stepwise_implies_cases\n [of \\\\\\ \\n\\ \\K1\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_implies[of \\K1\\ \\n\\ \\\\\\ \\\\\\ \\K2\\ \\\\\\] by blast\n next\n case (ImpliesNot K1 K2) thus ?thesis\n using HeronConf_interp_stepwise_implies_not_cases\n [of \\\\\\ \\n\\ \\K1\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_implies_not[of \\K1\\ \\n\\ \\\\\\ \\\\\\ \\K2\\ \\\\\\] by blast\n next\n case (TimeDelayedBy Kmast \\ Kmeas Kslave) thus ?thesis\n using HeronConf_interp_stepwise_timedelayed_cases\n [of \\\\\\ \\n\\ \\Kmast\\ \\\\\\ \\Kmeas\\ \\Kslave\\ \\\\\\ \\\\\\]\n Cnext_solve_timedelayed\n [of \\Kmast\\ \\n\\ \\\\\\ \\\\\\ \\\\\\ \\Kmeas\\ \\Kslave\\ \\\\\\] by blast\n next\n case (WeaklyPrecedes K1 K2) thus ?thesis\n using HeronConf_interp_stepwise_weakly_precedes_cases\n [of \\\\\\ \\n\\ \\K1\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_weakly_precedes[of \\K2\\ \\n\\ \\K1\\ \\\\\\ \\\\\\ \\\\\\]\n by blast\n next\n case (StrictlyPrecedes K1 K2) thus ?thesis\n using HeronConf_interp_stepwise_strictly_precedes_cases\n [of \\\\\\ \\n\\ \\K1\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_strictly_precedes[of \\K2\\ \\n\\ \\K1\\ \\\\\\ \\\\\\ \\\\\\]\n by blast\n next\n case (Kills K1 K2) thus ?thesis\n using HeronConf_interp_stepwise_kills_cases[of \\\\\\ \\n\\ \\K1\\ \\K2\\ \\\\\\ \\\\\\]\n Cnext_solve_kills[of \\K1\\ \\n\\ \\\\\\ \\\\\\ \\K2\\ \\\\\\] by blast\n qed\n qed\n\nlemma complete_direct_successors':\n shows \\\\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ (\\X\\\\\\<^sub>n\\<^sub>e\\<^sub>x\\<^sub>t \\. \\ X \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\nproof -\n from HeronConf_interpretation.cases obtain \\ n \\ \\\n where \\\\ = (\\, n \\ \\ \\ \\)\\ by blast\n with complete_direct_successors[of \\\\\\ \\n\\ \\\\\\ \\\\\\] show ?thesis by simp\nqed\n\ntext \\\n Therefore, if a run belongs to a configuration, it necessarily belongs to a\n configuration derived from it.\n\\\nlemma branch_existence:\n assumes \\\\ \\ \\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n shows \\\\\\\\<^sub>2. (\\\\<^sub>1 \\ \\\\<^sub>2) \\ (\\ \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\nproof -\n from assms complete_direct_successors' have \\\\ \\ (\\X\\\\\\<^sub>n\\<^sub>e\\<^sub>x\\<^sub>t \\\\<^sub>1. \\ X \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\ by blast\n hence \\\\s\\\\\\<^sub>n\\<^sub>e\\<^sub>x\\<^sub>t \\\\<^sub>1. \\ \\ \\ s \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by simp\n thus ?thesis by blast\nqed\n\nlemma branch_existence':\n assumes \\\\ \\ \\ \\\\<^sub>1 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n shows \\\\\\\\<^sub>2. (\\\\<^sub>1 \\\\<^bsup>k\\<^esup> \\\\<^sub>2) \\ (\\ \\ \\ \\\\<^sub>2 \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\nproof (induct k)\n case 0\n thus ?case by (simp add: assms)\nnext\n case (Suc k)\n thus ?case\n using branch_existence relpowp_Suc_I[of \\k\\ \\operational_semantics_step\\]\n by blast\nqed\n\ntext\\\n Any run that belongs to the original specification @{term \\\\\\} has a corresponding \n configuration @{term \\\\\\} at any number @{term \\k\\} of reduction steps\n from the initial configuration. Therefore, any run that satisfies a specification\n can be derived from the initial configuration at any level of reduction.\n\\\ntheorem completeness:\n assumes \\\\ \\ \\\\ \\ \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\\n shows \\\\\\. (([], 0 \\ \\ \\ []) \\\\<^bsup>k\\<^esup> \\)\n \\ \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using assms branch_existence' solve_start by blast\n\nsection \\Progress\\\n\ntext \\\n Reduction steps do not guarantee that the construction of a run progresses in the\n sequence of instants. We need to show that it is always possible to reach the next \n instant, and therefore any future instant, through a number of steps.\n\\\nlemma instant_index_increase:\n assumes \\\\ \\ \\ \\, n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n shows \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ \\ \\ \\) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof (insert assms, induct \\ arbitrary: \\ \\)\n case (Nil \\ \\)\n then show ?case\n proof -\n have \\(\\, n \\ [] \\ \\) \\\\<^bsup>1\\<^esup> (\\, Suc n \\ \\ \\ [])\\\n using instant_i intro_part by fastforce\n moreover have \\\\ \\, n \\ [] \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g = \\ \\, Suc n \\ \\ \\ [] \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n by auto\n moreover have \\\\ \\ \\ \\, Suc n \\ \\ \\ [] \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using assms Nil.prems calculation(2) by blast\n ultimately show ?thesis by blast\n qed\nnext\n case (Cons \\ \\)\n then show ?case\n proof (induct \\)\n case (SporadicOn K\\<^sub>1 \\ K\\<^sub>2)\n have branches: \\\\ \\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ \\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_sporadicon_cases by simp\n have br1: \\\\ \\ \\ \\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((\\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h1: \\\\ \\ \\ \\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n hence \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ (\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\n using h1 SporadicOn.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\((\\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have\n \\(\\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\)\n \\ (\\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\))\\\n by (simp add: elims_part sporadic_on_e1)\n with fp relpowp_Suc_I2 have\n \\((\\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\ by auto\n thus ?thesis using fp by blast\n qed\n have br2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n hence \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h2 SporadicOn.prems by simp\n\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\((((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have pc:\\(\\, n \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\)\\\n by (simp add: elims_part sporadic_on_e2)\n hence \\(\\, n \\ (K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\ \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n from branches SporadicOn.prems(2) have\n \\\\ \\ \\ \\, n \\ \\ \\ ((K\\<^sub>1 sporadic \\ on K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n @ \\) # \\), n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n by simp\n with br1 br2 show ?case by blast\n next\n case (TagRelation K\\<^sub>1 K\\<^sub>2 R)\n have branches: \\\\ \\, n \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ ((\\\\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\ \\ R) # \\), n\n \\ \\ \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_tagrel_cases by simp\n thus ?case\n proof -\n have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((((\\\\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\ \\ R) # \\), n\n \\ \\ \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)) \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using TagRelation.prems by simp\n\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\((((\\\\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\ \\ R) # \\), n\n \\ \\ \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have pc:\\(\\, n \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\) \\ \\)\n \\ (((\\\\\\<^sub>v\\<^sub>a\\<^sub>r (K\\<^sub>1, n), \\\\<^sub>v\\<^sub>a\\<^sub>r (K\\<^sub>2, n)\\ \\ R) # \\), n\n \\ \\ \\ ((time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\))\\\n by (simp add: elims_part tagrel_e)\n hence \\(\\, n \\ (time-relation \\K\\<^sub>1, K\\<^sub>2\\ \\ R) # \\ \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n next\n case (Implies K\\<^sub>1 K\\<^sub>2)\n have branches: \\\\ \\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_implies_cases by simp\n moreover have br1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h1 Implies.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have pc:\\(\\, n \\ (K\\<^sub>1 implies K\\<^sub>2) # \\ \\ \\)\n \\ (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\\\n by (simp add: elims_part implies_e1)\n hence \\(\\, n \\ (K\\<^sub>1 implies K\\<^sub>2) # \\ \\ \\) \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n moreover have br2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. (\n (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\n ) \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h2 Implies.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\(((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\))\\\n by (simp add: elims_part implies_e2)\n hence \\(\\, n \\ ((K\\<^sub>1 implies K\\<^sub>2) # \\) \\ \\) \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using Implies.prems(2) by blast\n next\n case (ImpliesNot K\\<^sub>1 K\\<^sub>2)\n have branches: \\\\ \\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_implies_not_cases by simp\n moreover have br1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h1 ImpliesNot.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have pc:\\(\\, n \\ (K\\<^sub>1 implies not K\\<^sub>2) # \\ \\ \\)\n \\ (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\\\n by (simp add: elims_part implies_not_e1)\n hence \\(\\, n \\ (K\\<^sub>1 implies not K\\<^sub>2) # \\ \\ \\) \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n moreover have br2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. (\n (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\)) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\n ) \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h2 ImpliesNot.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\(((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\))\\\n by (simp add: elims_part implies_not_e2)\n hence \\(\\, n \\ ((K\\<^sub>1 implies not K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using ImpliesNot.prems(2) by blast\n next\n case (TimeDelayedBy K\\<^sub>1 \\\\ K\\<^sub>2 K\\<^sub>3)\n have branches:\n \\\\ \\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ ((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_timedelayed_cases by simp\n moreover have br1:\n \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h1 TimeDelayedBy.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\(((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\\\ n) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\\\n by (simp add: elims_part timedelayed_e1)\n hence \\(\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n moreover have br2:\n \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h2: \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h2 TimeDelayedBy.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\(((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\ n) # (K\\<^sub>2 @ n \\ \\\\ \\ K\\<^sub>3) # \\), n\n \\ \\ \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\))\\\n by (simp add: elims_part timedelayed_e2)\n with fp relpowp_Suc_I2 have\n \\(\\, n \\ ((K\\<^sub>1 time-delayed by \\\\ on K\\<^sub>2 implies K\\<^sub>3) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using TimeDelayedBy.prems(2) by blast\n next\n case (WeaklyPrecedes K\\<^sub>1 K\\<^sub>2)\n have \\\\ \\, n \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g =\n \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_weakly_precedes_cases by simp\n moreover have \\\\ \\ \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ (\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ (\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g))\\\n proof -\n assume \\\\ \\ \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n hence \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ (\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\n using WeaklyPrecedes.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\(((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\ \\)\n \\ (((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>\\ K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\))\\\n by (simp add: elims_part weakly_precedes_e)\n with fp relpowp_Suc_I2 have \\(\\, n \\ ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using WeaklyPrecedes.prems(2) by blast\n next\n case (StrictlyPrecedes K\\<^sub>1 K\\<^sub>2)\n have \\\\ \\, n \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g =\n \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_strictly_precedes_cases by simp\n moreover have \\\\ \\ \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ (\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ (\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g))\\\n proof -\n assume \\\\ \\ \\ ((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n hence \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ (\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\n using StrictlyPrecedes.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where fp:\\(((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\ \\)\n \\ (((\\#\\<^sup>\\ K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\ \\ (\\(x, y). x \\ y)) # \\), n\n \\ \\ \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\))\\\n by (simp add: elims_part strictly_precedes_e)\n with fp relpowp_Suc_I2 have \\(\\, n \\ ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using StrictlyPrecedes.prems(2) by blast\n next\n case (Kills K\\<^sub>1 K\\<^sub>2)\n have branches: \\\\ \\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n = \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using HeronConf_interp_stepwise_kills_cases by simp\n moreover have br1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h1: \\\\ \\ \\ ((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h1 Kills.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\((((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have pc:\\(\\, n \\ (K\\<^sub>1 kills K\\<^sub>2) # \\ \\ \\)\n \\ (((K\\<^sub>1 \\\\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\\\n by (simp add: elims_part kills_e1)\n hence \\(\\, n \\ (K\\<^sub>1 kills K\\<^sub>2) # \\ \\ \\) \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n moreover have br2:\n \\\\ \\ \\ ((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\)\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n proof -\n assume h2: \\\\ \\ \\((K\\<^sub>1 \\ n)#(K\\<^sub>2 \\\\ \\ n)#\\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2)#\\)\\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n then have \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. (\n (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\n ) \\ \\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using h2 Kills.prems by simp\n from this obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k where\n fp:\\(((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\n \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n and rc:\\\\ \\ \\ \\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\ by blast\n have \\(\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\)\n \\ (((K\\<^sub>1 \\ n) # (K\\<^sub>2 \\\\ \\ n) # \\), n \\ \\ \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\))\\\n by (simp add: elims_part kills_e2)\n hence \\(\\, n \\ ((K\\<^sub>1 kills K\\<^sub>2) # \\) \\ \\) \\\\<^bsup>Suc k\\<^esup> (\\\\<^sub>k, Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\\\n using fp relpowp_Suc_I2 by auto\n with rc show ?thesis by blast\n qed\n ultimately show ?case using Kills.prems(2) by blast\n qed\nqed\n\nlemma instant_index_increase_generalized:\n assumes \\n < n\\<^sub>k\\\n assumes \\\\ \\ \\ \\, n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n shows \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. ((\\, n \\ \\ \\ \\) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, n\\<^sub>k \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, n\\<^sub>k \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof -\n obtain \\k where diff: \\n\\<^sub>k = \\k + Suc n\\\n using add.commute assms(1) less_iff_Suc_add by auto\n show ?thesis\n proof (subst diff, subst diff, insert assms(2), induct \\k)\n case 0 thus ?case\n using instant_index_increase assms(2) by simp\n next\n case (Suc \\k)\n have f0: \\\\ \\ \\ \\, n \\ \\ \\ \\ \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ \\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((\\, n \\ \\ \\ \\) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using Suc.hyps by blast\n obtain \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k\n where cont: \\((\\, n \\ \\ \\ \\) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using f0 assms(1) Suc.prems by blast\n then have fcontinue: \\\\\\\\<^sub>k' \\\\<^sub>k' \\\\<^sub>k' k'. ((\\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\n \\\\<^bsup>k'\\<^esup> (\\\\<^sub>k', Suc (\\k + Suc n) \\ \\\\<^sub>k' \\ \\\\<^sub>k'))\n \\ \\ \\ \\ \\\\<^sub>k', Suc (\\k + Suc n) \\ \\\\<^sub>k' \\ \\\\<^sub>k' \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using f0 cont instant_index_increase by blast\n obtain \\\\<^sub>k' \\\\<^sub>k' \\\\<^sub>k' k'\n where cont2: \\((\\\\<^sub>k, \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k)\n \\\\<^bsup>k'\\<^esup> (\\\\<^sub>k', Suc (\\k + Suc n) \\ \\\\<^sub>k' \\ \\\\<^sub>k'))\n \\ \\ \\ \\ \\\\<^sub>k', Suc (\\k + Suc n) \\ \\\\<^sub>k' \\ \\\\<^sub>k' \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using Suc.prems using fcontinue cont by blast\n have trans: \\(\\, n \\ \\ \\ \\) \\\\<^bsup>k + k'\\<^esup> (\\\\<^sub>k', Suc (\\k + Suc n) \\ \\\\<^sub>k' \\ \\\\<^sub>k')\\\n using operational_semantics_trans_generalized cont cont2 by blast\n moreover have suc_assoc: \\Suc \\k + Suc n = Suc (\\k + Suc n)\\ by arith\n ultimately show ?case\n proof (subst suc_assoc)\n show \\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k.\n ((\\, n \\ \\ \\ \\) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, Suc (\\k + Suc n) \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, Suc \\k + Suc n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using cont2 local.trans by auto\n qed\n qed\nqed\n\ntext\\\n Any run that belongs to a specification @{term \\\\\\} has a corresponding \n configuration that develops it up to the @{term \\n\\}\\textsuperscript{th} instant.\n\\\ntheorem progress:\n assumes \\\\ \\ \\\\ \\ \\\\\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\\n shows \\\\k \\\\<^sub>k \\\\<^sub>k \\\\<^sub>k. (([], 0 \\ \\ \\ []) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, n \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, n \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof -\n have 1:\\\\\\\\<^sub>k \\\\<^sub>k \\\\<^sub>k k. (([], 0 \\ \\ \\ []) \\\\<^bsup>k\\<^esup> (\\\\<^sub>k, 0 \\ \\\\<^sub>k \\ \\\\<^sub>k))\n \\ \\ \\ \\ \\\\<^sub>k, 0 \\ \\\\<^sub>k \\ \\\\<^sub>k \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\n using assms relpowp_0_I solve_start by fastforce\n show ?thesis\n proof (cases \\n = 0\\)\n case True\n thus ?thesis using assms relpowp_0_I solve_start by fastforce\n next\n case False hence pos:\\n > 0\\ by simp\n from assms solve_start have \\\\ \\ \\ [], 0 \\ \\ \\ [] \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\ by blast\n from instant_index_increase_generalized[OF pos this] show ?thesis by blast\n qed\nqed\n\nsection \\Local termination\\\ntext \\\n Here, we prove that the computation of an instant in a run always terminates.\n Since this computation terminates when the list of constraints for the present\n instant becomes empty, we introduce a measure for this formula.\n\\\nprimrec measure_interpretation :: \\'\\::linordered_field TESL_formula \\ nat\\ (\\\\\\)\nwhere\n \\\\ [] = (0::nat)\\\n| \\\\ (\\ # \\) = (case \\ of\n _ sporadic _ on _ \\ 1 + \\ \\\n | _ \\ 2 + \\ \\)\\\n\nfun measure_interpretation_config :: \\'\\::linordered_field config \\ nat\\ (\\\\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\)\nwhere\n \\\\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g (\\, n \\ \\ \\ \\) = \\ \\\\\n\ntext \\\n We then show that the elimination rules make this measure decrease.\n\\\nlemma elimation_rules_strictly_decreasing:\n assumes \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) \\\\<^sub>e (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n shows \\\\ \\\\<^sub>1 > \\ \\\\<^sub>2\\\nusing assms by (auto elim: operational_semantics_elim.cases)\n\nlemma elimation_rules_strictly_decreasing_meas:\n assumes \\(\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1) \\\\<^sub>e (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n shows \\(\\\\<^sub>2, \\\\<^sub>1) \\ measure \\\\\nusing assms by (auto elim: operational_semantics_elim.cases)\n\nlemma elimation_rules_strictly_decreasing_meas':\n assumes \\\\\\<^sub>1 \\\\<^sub>e \\\\<^sub>2\\\n shows \\(\\\\<^sub>2, \\\\<^sub>1) \\ measure \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\\nproof -\n from assms obtain \\\\<^sub>1 n\\<^sub>1 \\\\<^sub>1 \\\\<^sub>1 where p1:\\\\\\<^sub>1 = (\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1)\\\n using measure_interpretation_config.cases by blast\n from assms obtain \\\\<^sub>2 n\\<^sub>2 \\\\<^sub>2 \\\\<^sub>2 where p2:\\\\\\<^sub>2 = (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2)\\\n using measure_interpretation_config.cases by blast\n from elimation_rules_strictly_decreasing_meas assms p1 p2\n have \\(\\\\<^sub>2, \\\\<^sub>1) \\ measure \\\\ by blast\n hence \\\\ \\\\<^sub>2 < \\ \\\\<^sub>1\\ by simp\n hence \\\\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g (\\\\<^sub>2, n\\<^sub>2 \\ \\\\<^sub>2 \\ \\\\<^sub>2) < \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g (\\\\<^sub>1, n\\<^sub>1 \\ \\\\<^sub>1 \\ \\\\<^sub>1)\\ by simp\n with p1 p2 show ?thesis by simp\nqed\n\ntext \\\n Therefore, the relation made up of elimination rules is well-founded and the\n computation of an instant terminates.\n\\\ntheorem instant_computation_termination:\n \\wfP (\\(\\\\<^sub>1::'a::linordered_field config) \\\\<^sub>2. (\\\\<^sub>1 \\\\<^sub>e\\<^sup>\\ \\\\<^sub>2))\\\nproof (simp add: wfP_def)\n show \\wf {((\\\\<^sub>1::'a::linordered_field config), \\\\<^sub>2). \\\\<^sub>1 \\\\<^sub>e\\<^sup>\\ \\\\<^sub>2}\\\n proof (rule wf_subset)\n have \\measure \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g = {(\\\\<^sub>2, (\\\\<^sub>1::'a::linordered_field config)).\n \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\\\<^sub>2 < \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\\\<^sub>1}\\\n by (simp add: inv_image_def less_eq measure_def)\n thus \\{((\\\\<^sub>1::'a::linordered_field config), \\\\<^sub>2). \\\\<^sub>1 \\\\<^sub>e\\<^sup>\\ \\\\<^sub>2} \\ (measure \\\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g)\\\n using elimation_rules_strictly_decreasing_meas'\n operational_semantics_elim_inv_def by blast\n next\n show \\wf (measure measure_interpretation_config)\\ by simp\n qed\nqed\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/TESL_Language/Hygge_Theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.25985576301744695}} {"text": "(*\n * Copyright 2016, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\n\nsection \\The COMPLX Syntax\\\n\ntheory Language\nimports Main\nbegin\n\nsubsection \\The Core Language\\\n\ntext \\We use a shallow embedding of boolean expressions as well as assertions\nas sets of states. \n\\\n\ntype_synonym 's bexp = \"'s set\"\ntype_synonym 's assn = \"'s set\"\n\ndatatype ('s, 'p, 'f) com =\n Skip\n | Basic \"'s \\ 's\"\n | Spec \"('s \\ 's) set\"\n | Seq \"('s ,'p, 'f) com\" \"('s,'p, 'f) com\" \n | Cond \"'s bexp\" \"('s,'p,'f) com\" \"('s,'p,'f) com\"\n | While \"'s bexp\" \"('s,'p,'f) com\"\n | Call \"'p\"\n | DynCom \"'s \\ ('s,'p,'f) com\" \n | Guard \"'f\" \"'s bexp\" \"('s,'p,'f) com\" \n | Throw\n | Catch \"('s,'p,'f) com\" \"('s,'p,'f) com\"\n | Parallel \"('s, 'p, 'f) com list\"\n | Await \"'s bexp\" \"('s,'p,'f) com\"\n\n\nsubsection \\Derived Language Constructs\\\n\ntext \\We inherit the remainder of derived language constructs from SIMPL\\\n\ndefinition\n raise:: \"('s \\ 's) \\ ('s,'p,'f) com\" where\n \"raise f = Seq (Basic f) Throw\"\n\ndefinition\n condCatch:: \"('s,'p,'f) com \\ 's bexp \\ ('s,'p,'f) com \\ ('s,'p,'f) com\" where\n \"condCatch c\\<^sub>1 b c\\<^sub>2 = Catch c\\<^sub>1 (Cond b c\\<^sub>2 Throw)\"\n\ndefinition\n bind:: \"('s \\ 'v) \\ ('v \\ ('s,'p,'f) com) \\ ('s,'p,'f) com\" where\n \"bind e c = DynCom (\\s. c (e s))\"\n\ndefinition\n bseq:: \"('s,'p,'f) com \\ ('s,'p,'f) com \\ ('s,'p,'f) com\" where\n \"bseq = Seq\"\n \ndefinition\n block:: \"['s\\'s ,('s,'p,'f) com,'s\\'s\\'s,'s\\'s\\('s,'p,'f) com]\\('s,'p,'f) com\"\nwhere\n \"block init bdy restore return =\n DynCom (\\s. (Seq (Catch (Seq (Basic init) bdy) (Seq (Basic (restore s)) Throw)) \n (DynCom (\\t. Seq (Basic (restore s)) (return s t))))\n )\" \n\ndefinition\n call:: \"('s\\'s) \\ 'p \\ ('s \\ 's \\ 's)\\('s\\'s\\('s,'p,'f) com)\\('s,'p,'f)com\" where\n \"call init p restore return = block init (Call p) restore return\"\n\ndefinition\n dynCall:: \"('s\\'s) \\ ('s \\ 'p) \\ ('s \\ 's \\ 's) \\\n ('s \\ 's \\ ('s,'p,'f) com) \\ ('s,'p,'f) com\" where\n \"dynCall init p restore return = DynCom (\\s. call init (p s) restore return)\"\n\ndefinition\n fcall:: \"('s\\'s) \\ 'p \\ ('s \\ 's \\ 's)\\('s \\ 'v) \\ ('v\\('s,'p,'f) com)\n \\('s,'p,'f) com\" where\n \"fcall init p restore result return = call init p restore (\\s t. return (result t))\"\n\ndefinition\n lem:: \"'x \\ ('s,'p,'f)com \\('s,'p,'f)com\" where\n \"lem x c = c\"\n\nprimrec switch:: \"('s \\ 'v) \\ ('v set \\ ('s,'p,'f) com) list \\ ('s,'p,'f) com\" \nwhere\n\"switch v [] = Skip\" |\n\"switch v (Vc#vs) = Cond {s. v s \\ fst Vc} (snd Vc) (switch v vs)\"\n\ndefinition guaranteeStrip:: \"'f \\ 's set \\ ('s,'p,'f) com \\ ('s,'p,'f) com\"\n where \"guaranteeStrip f g c = Guard f g c\"\n\ndefinition guaranteeStripPair:: \"'f \\ 's set \\ ('f \\ 's set)\"\n where \"guaranteeStripPair f g = (f,g)\"\n\nprimrec guards:: \"('f \\ 's set ) list \\ ('s,'p,'f) com \\ ('s,'p,'f) com\"\nwhere\n\"guards [] c = c\" |\n\"guards (g#gs) c = Guard (fst g) (snd g) (guards gs c)\"\n\ndefinition\n while:: \"('f \\ 's set) list \\ 's bexp \\ ('s,'p,'f) com \\ ('s, 'p, 'f) com\"\nwhere\n \"while gs b c = guards gs (While b (Seq c (guards gs Skip)))\"\n\ndefinition\n whileAnno:: \n \"'s bexp \\ 's assn \\ ('s \\ 's) assn \\ ('s,'p,'f) com \\ ('s,'p,'f) com\" where\n \"whileAnno b I V c = While b c\"\n\ndefinition\n whileAnnoG:: \n \"('f \\ 's set) list \\ 's bexp \\ 's assn \\ ('s \\ 's) assn \\ \n ('s,'p,'f) com \\ ('s,'p,'f) com\" where\n \"whileAnnoG gs b I V c = while gs b c\"\n \ndefinition\n specAnno:: \"('a \\ 's assn) \\ ('a \\ ('s,'p,'f) com) \\ \n ('a \\ 's assn) \\ ('a \\ 's assn) \\ ('s,'p,'f) com\"\n where \"specAnno P c Q A = (c undefined)\"\n\ndefinition\n whileAnnoFix:: \n \"'s bexp \\ ('a \\ 's assn) \\ ('a \\ ('s \\ 's) assn) \\ ('a \\ ('s,'p,'f) com) \\ \n ('s,'p,'f) com\" where\n \"whileAnnoFix b I V c = While b (c undefined)\"\n\ndefinition\n whileAnnoGFix:: \n \"('f \\ 's set) list \\ 's bexp \\ ('a \\ 's assn) \\ ('a \\ ('s \\ 's) assn) \\ \n ('a \\ ('s,'p,'f) com) \\ ('s,'p,'f) com\" where\n \"whileAnnoGFix gs b I V c = while gs b (c undefined)\"\n\ndefinition if_rel::\"('s \\ bool) \\ ('s \\ 's) \\ ('s \\ 's) \\ ('s \\ 's) \\ ('s \\ 's) set\" \n where \"if_rel b f g h = {(s,t). if b s then t = f s else t = g s \\ t = h s}\"\n\nlemma fst_guaranteeStripPair: \"fst (guaranteeStripPair f g) = f\"\n by (simp add: guaranteeStripPair_def)\n\nlemma snd_guaranteeStripPair: \"snd (guaranteeStripPair f g) = g\"\n by (simp add: guaranteeStripPair_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Complx/Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25982405718051205}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory LemmaBucket_C\nimports\n Basics.CLib\n TypHeapLib\nbegin\n\nlemma Ptr_not_null_pointer_not_zero: \"(Ptr p \\ NULL)=(p\\0)\"\n by simp\n\nlemma hrs_mem_f: \"f (hrs_mem s) = hrs_mem (hrs_mem_update f s)\"\n apply (cases s)\n apply (clarsimp simp: hrs_mem_def hrs_mem_update_def)\n done\n\nlemma hrs_mem_heap_update:\n \"heap_update p v (hrs_mem s) = hrs_mem (hrs_mem_update (heap_update p v) s)\"\n by (rule hrs_mem_f)\n\nlemma addr_card_wb:\n \"addr_card = 2 ^ word_bits\"\n by (simp add: addr_card_def card_word word_bits_conv)\n\nlemma surj_Ptr [simp]:\n \"surj Ptr\"\n by (rule surjI [where f = ptr_val], simp)\n\nlemma inj_Ptr [simp]:\n \"inj Ptr\"\n apply (rule injI)\n apply simp\n done\n\nlemma bij_Ptr :\n \"bij Ptr\"\n by (simp add: bijI)\n\nlemma exec_Guard:\n \"(G \\ \\Guard Err S c, Normal s\\ \\ s')\n = (if s \\ S then G \\ \\c, Normal s\\ \\ s'\n else s' = Fault Err)\"\n using exec.intros by (auto split: if_split elim!: exec_elim_cases)\n\nlemma to_bytes_word8:\n \"to_bytes (v :: word8) xs = [v]\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma byte_ptr_guarded:\"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc simp del: word_neq_0_conv)\n\nlemma heap_update_list_append:\n fixes v :: word8\n shows \"heap_update_list s (xs @ ys) hp =\n heap_update_list (s + of_nat (length xs)) ys (heap_update_list s xs hp)\"\nproof (induct xs arbitrary: ys rule: rev_induct)\n case Nil\n show ?case by simp\nnext\n case (snoc v' vs')\n show ?case\n apply (simp add: snoc.hyps field_simps)\n apply (rule arg_cong [where f = \"heap_update_list (1 + (s + of_nat (length vs'))) ys\"])\n apply (rule ext)\n apply simp\n done\nqed\n\nlemma intvl_aligned_bottom_eq:\n fixes p :: \"'a::len word\"\n assumes al1: \"is_aligned x n\"\n and al2: \"is_aligned p bits\"\n and nb: \"\\ n < bits\"\n and off: \"off \\ 2 ^ bits\" \"off \\ 0\"\n shows \"(x \\ {p ..+ off}) = (x = p)\"\nproof (rule iffI)\n assume \"x = p\"\n thus \"x \\ {p ..+ off}\" using off\n by (simp add: intvl_self)\nnext\n assume x_in_intvl: \"x \\ {p ..+ off}\"\n\n show \"x = p\"\n proof cases\n assume wb: \"bits < len_of TYPE('a)\"\n\n from x_in_intvl obtain kp where xp: \"x = p + of_nat kp\" and kp: \"kp < off\"\n by (clarsimp dest!: intvlD)\n\n hence \"is_aligned (p + of_nat kp) n\" using al1 by simp\n hence \"2 ^ n dvd unat (p + of_nat kp)\" unfolding is_aligned_def .\n hence \"2 ^ n dvd unat p + kp\" using kp off wb\n apply -\n apply (subst (asm) iffD1 [OF unat_plus_simple])\n apply (rule is_aligned_no_wrap' [OF al2])\n apply (rule of_nat_power)\n apply simp_all[2]\n apply (subst (asm) unat_of_nat)\n apply (subst (asm) mod_less)\n apply (erule order_less_le_trans)\n apply (erule order_trans)\n apply simp\n apply simp\n done\n\n moreover from al2 obtain q2 where pbits: \"p = 2 ^ bits * of_nat q2\"\n and q2: \"q2 < 2 ^ (len_of TYPE('a) - bits)\"\n by (rule is_alignedE)\n\n moreover from nb obtain kn where nbits: \"n = bits + kn\"\n by (clarsimp simp: linorder_not_less le_iff_add)\n\n ultimately have \"2 ^ bits dvd 2 ^ bits * q2 + kp\"\n apply (simp add: power_add)\n apply (simp add: unat_mult_power_lem [OF q2])\n apply (erule dvd_mult_left)\n done\n\n hence \"2 ^ bits dvd kp\"\n by (simp add: dvd_add_right_iff)\n with kp have \"kp = 0\"\n apply -\n apply (erule contrapos_pp)\n apply (simp add: linorder_not_less)\n apply (drule (1) dvd_imp_le)\n apply (erule order_trans [OF off(1)])\n done\n\n thus ?thesis using xp by simp\n next\n assume wb: \"\\ bits < len_of TYPE('a)\"\n with assms\n show ?thesis by (simp add: is_aligned_mask mask_def power_overflow)\n qed\nqed\n\nlemma intvl_mem_weaken: \"x \\ {p..+a - n} \\ x \\ {p..+a}\"\n apply (drule intvlD)\n apply clarsimp\n apply (rule intvlI)\n apply simp\n done\n\n\nlemma upto_intvl_eq:\n fixes x :: \"'a::len word\"\n assumes al: \"is_aligned x n\"\n shows \"{x..+2 ^ n} = {x .. x + 2 ^ n - 1}\"\nproof cases\n assume \"n < len_of TYPE('a)\"\n with assms show ?thesis\n unfolding intvl_def\n apply simp\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k < (2 :: 'a word) ^ n\")\n apply (intro conjI)\n apply (erule (1) is_aligned_no_wrap')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (simp add: word_less_sub_1)\n apply (simp add: field_simps is_aligned_no_overflow)\n apply (simp add: of_nat_power)\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply clarsimp\n apply (rule unat_less_power, assumption)\n apply (subst word_less_sub_le [symmetric])\n apply assumption\n apply (rule word_diff_ls'(4))\n apply (simp add: field_simps)\n apply assumption\n done\nnext\n assume \"\\ n < len_of TYPE('a)\"\n with assms show ?thesis\n apply (simp add: is_aligned_mask mask_def power_overflow intvl_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rename_tac w)\n apply (case_tac w rule: word_nat_cases)\n apply (rename_tac m)\n apply (rule_tac x=m in exI)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n done\nqed\n\nlemma upto_intvl_eq':\n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ x + (of_nat b - 1); b \\ 0; b \\ 2 ^ len_of TYPE('a)\\ \\ {x..+b} = {x .. x + of_nat b - 1}\"\n unfolding intvl_def\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k \\ (of_nat (b - 1) :: 'a word)\")\n apply (intro conjI)\n apply (erule word_random)\n apply simp\n apply (subst field_simps [symmetric], rule word_plus_mono_right)\n apply simp\n apply assumption\n apply (rule of_nat_mono_maybe_le; simp)\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply simp\n apply (simp add: unat_sub)\n apply (rule nat_diff_less)\n apply (subst (asm) word_le_nat_alt, erule order_le_less_trans)\n apply (subst add_diff_eq[symmetric], subst unat_plus_if')\n apply (simp add: no_olen_add_nat le_eq_less_or_eq)\n apply (metis gt0_iff_gem1 unat_less_helper unat_ucast_less_no_overflow unsigned_0 unsigned_less)\n apply (simp add: word_le_nat_alt)\n done\n\nlemma intvl_aligned_top:\n fixes x :: \"'a::len word\"\n assumes al1: \"is_aligned x n\"\n and al2: \"is_aligned p bits\"\n and nb: \"n \\ bits\"\n and offn: \"off < 2 ^ n\"\n and wb: \"bits < len_of TYPE('a)\"\n shows \"(x \\ {p ..+ 2 ^ bits - off}) = (x \\ {p ..+ 2 ^ bits})\"\nproof (rule iffI)\n assume \"x \\ {p..+2 ^ bits - off}\"\n thus \"x \\ {p..+2 ^ bits}\" by (rule intvl_mem_weaken)\nnext\n assume asm: \"x \\ {p..+2 ^ bits}\"\n\n show \"x \\ {p..+2 ^ bits - off}\"\n proof (cases \"n = 0\")\n case True\n with offn asm show ?thesis by simp\n next\n case False\n\n from asm have \"x \\ {p .. p + 2 ^ bits - 1}\"\n by (simp add: upto_intvl_eq [OF al2])\n then obtain q where xp: \"x = p + of_nat (q * 2 ^ n)\" and qb: \"q < 2 ^ (bits - n)\" using False nb\n by (fastforce dest!: is_aligned_diff[OF al1 al2 wb,simplified field_simps])\n\n have \"q * 2 ^ n < 2 ^ bits - off\"\n proof -\n show ?thesis using offn qb nb\n apply (simp add: less_diff_conv)\n apply (erule (1) nat_add_offset_less)\n apply arith\n done\n qed\n\n with xp show ?thesis\n apply -\n apply (erule ssubst)\n apply (erule intvlI)\n done\n qed\nqed\n\nlemma heap_update_list_update:\n fixes v :: word8\n shows \"x \\ y \\ heap_update_list s xs (hp(y := v)) x = heap_update_list s xs hp x\"\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp add: heap_update_list_append cong: if_cong)\n done\n\n(* FIXME: generalise *)\nlemma heap_update_list_append2:\n \"length xs + length ys < 2 ^ word_bits \\\n heap_update_list s (xs @ ys) hp\n = heap_update_list s xs (heap_update_list (s + of_nat (length xs)) ys hp)\"\nproof (induct xs arbitrary: hp s)\n case Nil\n show ?case by simp\nnext\n case (Cons v' vs')\n\n have \"(1 :: addr) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"\\ \\ 0\" using Cons.prems\n apply -\n apply (rule of_nat_neq_0)\n apply simp\n apply (simp add: word_bits_conv)\n done\n finally have neq0: \"(1 :: addr) + of_nat (length vs') \\ 0\" .\n\n have \"(1 :: addr) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"unat \\ + length ys < 2 ^ word_bits\" using Cons.prems\n apply (subst unat_of_nat)\n apply (simp add: word_bits_conv)\n done\n finally have lt: \"unat ((1 :: addr) + of_nat (length vs')) + length ys < 2 ^ word_bits\" .\n\n from Cons.prems have \"length vs' + length ys < 2 ^ word_bits\" by simp\n thus ?case\n apply simp\n apply (subst Cons.hyps, assumption)\n apply (rule arg_cong [where f = \"heap_update_list (s + 1) vs'\"])\n apply (rule ext)\n apply (case_tac \"x = s\")\n apply simp\n apply (subst heap_update_nmem_same)\n apply (subst add.assoc)\n apply (rule intvl_nowrap[OF neq0 order_less_imp_le\n [OF lt[unfolded word_bits_def]]])\n apply simp\n apply (clarsimp simp: heap_update_list_update field_simps)\n done\nqed\n\nlemma heap_update_word8:\n \"heap_update p (v :: word8) hp = hp(ptr_val p := v)\"\n unfolding heap_update_def by (simp add: to_bytes_word8)\n\nlemma index_foldr_update2:\n \"\\ n \\ i; i < CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. i < n; n \\ CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\"\n shows \"{a..+b} \\ {c..+d} = {}\"\nproof (unfold disjoint_iff_not_equal, intro ballI notI)\n fix x y\n assume x: \"x \\ {a..+b}\" and y: \"y \\ {c..+d}\" and xy: \"x = y\"\n\n from x obtain kx where \"x = a + of_nat kx\" and kx: \"kx < b\"\n by (clarsimp dest!: intvlD)\n\n moreover from y obtain ky where \"y = c + of_nat ky\" and ky: \"ky < d\"\n by (clarsimp dest!: intvlD)\n\n ultimately have ac: \"a + of_nat kx = c + of_nat ky\" using xy by simp\n\n have \"of_nat kx < (of_nat b :: 'a word)\" using blt kx\n by (rule of_nat_mono_maybe)\n hence \"a + of_nat kx < a + of_nat b\" using alb\n by (rule word_plus_strict_mono_right)\n\n also have \"\\ \\ c\" by (rule abc)\n also have \"\\ \\ c + of_nat ky\" using cld dlt ky\n by (meson less_imp_le of_nat_mono_maybe word_random)\n finally show False using ac by simp\nqed\n\nlemma intvl_disjoint2:\n fixes a :: \"'a :: len word\"\n assumes abc: \"a + of_nat b \\ c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\"\n shows \"{c..+d} \\ {a..+b} = {}\"\n using abc alb cld blt dlt\n by (subst Int_commute, rule intvl_disjoint1)\n\n\nlemma intvl_off_disj:\n fixes x :: addr\n assumes ylt: \"y \\ off\"\n and zoff: \"z + off < 2 ^ word_bits\"\n shows \"{x ..+ y} \\ {x + of_nat off ..+ z} = {}\"\n using ylt zoff\n apply (cases \"off = 0\")\n apply simp\n apply (rule contrapos_pp [OF TrueI])\n apply (drule intvl_inter)\n apply (erule disjE)\n apply (cut_tac intvl_nowrap [where x = x and y = \"of_nat off :: addr\" and z = z])\n apply simp\n apply (rule of_nat_neq_0)\n apply simp\n apply (unfold word_bits_len_of)\n apply simp\n apply (simp add: unat_of_nat word_bits_conv)\n apply (drule intvlD)\n apply clarsimp\n apply (drule (1) order_less_le_trans)\n apply (drule unat_cong)\n apply (simp add: unat_of_nat word_bits_conv)\n done\n\n\nlemma list_map_comono:\n assumes s: \"list_map m \\\\<^sub>m list_map n\"\n shows \"m \\ n\"\n using s\nproof (induct m arbitrary: n rule: rev_induct)\n case Nil thus ?case unfolding list_map_def by simp\nnext\n case (snoc x xs)\n\n note [[syntax_ambiguity_warning=false]]\n from snoc.prems have\n sm: \"[length xs \\ x] ++ list_map xs \\\\<^sub>m list_map n\"\n unfolding list_map_def by simp\n\n hence xsn: \"xs \\ n\"\n by (rule snoc.hyps [OF map_add_le_mapE])\n\n have \"list_map n (length xs) = Some x\" using sm\n by (simp add: map_le_def list_map_def merge_dom2 set_zip)\n\n hence \"length xs < length n\" and \"x = n ! length xs\"\n by (auto simp add: list_map_eq split: if_split_asm)\n\n thus \"xs @ [x] \\ n\" using xsn\n by (simp add: append_one_prefix less_eq_list_def)\nqed\n\nlemma typ_slice_t_self:\n \"td \\ fst ` set (typ_slice_t td m)\"\n by (fact ladder_set_self)\n\nlemma drop_heap_list_le2:\n \"heap_list h n (x + of_nat k)\n = drop k (heap_list h (n + k) x)\"\n by (simp add: drop_heap_list_le)\n\nlemma index_fold_update:\n \"\\ distinct xs; set xs \\ {..< card (UNIV :: 'b set)}; n < card (UNIV :: 'b set) \\ \\\n index (foldr (\\n (arr :: 'a['b :: finite]). Arrays.update arr n (f n (index arr n))) xs v) n\n = (if n \\ set xs then f n (index v n) else index v n)\"\n apply (induct xs)\n apply simp\n apply (rename_tac x xs)\n apply (case_tac \"x = n\"; simp)\n done\n\nlemma heap_update_list_id:\n \"heap_list hp n ptr = xs \\ heap_update_list ptr xs hp = hp\"\n apply (induct xs arbitrary: ptr n)\n apply simp\n apply simp\n apply (case_tac n, simp_all)\n apply (clarsimp simp add: fun_upd_idem)\n done\n\nlemma size_td_list_map2: \"\\f adjs. \\ \\a. size_td_pair (f a) = size_td_pair a \\\n \\ size_td_list (map f adjs) = size_td_list adjs\"\n by (induct_tac adjs, simp_all)\n\nlemma hrs_mem_update_cong:\n \"\\ \\x. f x = f' x \\ \\ hrs_mem_update f = hrs_mem_update f'\"\n by (simp add: hrs_mem_update_def)\n\nlemma Guard_no_cong:\n \"\\ A=A'; c=c' \\ \\ Guard A P c = Guard A' P c'\"\n by simp\n\nlemma heap_update_list_concat_fold:\n assumes \"ptr' = ptr + of_nat (length ys)\"\n shows \"heap_update_list ptr' xs (heap_update_list ptr ys s)\n = heap_update_list ptr (ys @ xs) s\"\n unfolding assms\n apply (induct ys arbitrary: ptr s)\n apply simp\n apply simp\n apply (elim meta_allE)\n apply (erule trans[rotated])\n apply (simp add: field_simps)\n done\n\nlemma heap_update_list_concat_fold_hrs_mem:\n \"ptr' = ptr + of_nat (length ys) \\\n hrs_mem_update (heap_update_list ptr' xs)\n (hrs_mem_update (heap_update_list ptr ys) s)\n = hrs_mem_update (heap_update_list ptr (ys @ xs)) s\"\n by (simp add: hrs_mem_update_def split_def\n heap_update_list_concat_fold)\n\nlemmas heap_update_list_concat_unfold\n = heap_update_list_concat_fold[OF refl, symmetric]\n\nlemma coerce_heap_update_to_heap_updates:\n assumes n: \"n = chunk * m\" and len: \"length xs = n\"\n shows \"heap_update_list x xs\n = (\\s. foldl (\\s n. heap_update_list (x + (of_nat n * of_nat chunk))\n (take chunk (drop (n * chunk) xs)) s)\n s [0 ..< m])\"\n using len[simplified n]\n apply (induct m arbitrary: x xs)\n apply (rule ext, simp)\n apply (rule ext)\n apply (simp only: upt_conv_Cons map_Suc_upt[symmetric])\n apply (subgoal_tac \"\\ys zs. length ys = chunk \\ xs = ys @ zs\")\n apply (clarsimp simp: heap_update_list_concat_unfold foldl_map\n field_simps)\n apply (rule_tac x=\"take chunk xs\" in exI)\n apply (rule_tac x=\"drop chunk xs\" in exI)\n apply simp\n done\n\nlemma update_ti_list_array':\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = y;\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m)) \\\n \\ y = foldr (\\n arr. Arrays.update arr n (update_ti_t (g n) (take v3 (drop (v3 * n) xs)) (index arr n))) [0 ..< n] v\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs y v)\n apply simp\n apply (simp add: access_ti_append)\n apply (elim meta_allE, drule(1) meta_mp)\n apply simp\n apply (rule foldr_cong, (rule refl)+)\n apply (simp add: take_drop)\n apply (subst min.absorb1)\n apply (fold mult_Suc_right, rule mult_le_mono2)\n apply simp\n apply simp\n done\n\nlemma update_ti_list_array:\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = (y :: 'a['b :: finite]);\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m));\n n \\ card (UNIV :: 'b set) \\\n \\ \\m < n. update_ti_t (g m) (take v3 (drop (v3 * m) xs)) (index v m) = index y m\"\n apply (subst update_ti_list_array'[where y=y], assumption+)\n apply clarsimp\n apply (subst index_fold_update)\n apply clarsimp+\n done\n\nlemma access_in_array:\n fixes y :: \"('a :: c_type)['b :: finite]\"\n assumes assms: \"h_val hp x = y\"\n \"n < card (UNIV :: 'b set)\"\n and subst: \"\\xs v. length xs = size_of TYPE('a)\n \\ update_ti_t (typ_info_t TYPE('a)) xs v = f xs\"\n shows \"h_val hp\n (Ptr (ptr_val x + of_nat (n * size_of TYPE('a)))) = index y n\"\n using assms\n apply (simp add: h_val_def drop_heap_list_le2 del: of_nat_mult)\n apply (subst take_heap_list_le[symmetric, where n=\"card (UNIV :: 'b set) * size_of TYPE ('a)\"])\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n apply (simp add: from_bytes_def typ_info_array')\n apply (drule update_ti_list_array, simp+)\n apply (simp add: size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply simp\n apply (drule spec, drule(1) mp)\n apply (simp add: size_of_def ac_simps drop_take)\n apply (subgoal_tac \"length v = size_of TYPE('a)\" for v)\n apply (subst subst, assumption)\n apply (subst(asm) subst, assumption)\n apply simp\n apply (simp add: size_of_def min.absorb_iff2[symmetric])\n apply (subst le_diff_conv2)\n apply simp\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n done\n\nlemma access_ti_list_array:\n \"\\ \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m. m < n \\ v3 \\ length (drop (v3 * m) xs)\n \\ access_ti_pair (f m) (FCP g) (take v3 (drop (v3 * m) xs)) = (h m)\n \\ \\\n access_ti_list (map f [0 ..< n]) (FCP g) xs\n = foldl (@) [] (map h [0 ..< n])\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs)\n apply simp\n apply (simp add: access_ti_append)\n apply (erule_tac x=\"take (v3 * n) xs\" in meta_allE)\n apply simp\n apply (frule spec, drule mp, rule conjI, rule lessI)\n apply simp\n apply simp\n apply (erule meta_mp)\n apply (auto simp add: drop_take)\n done\n\ndefinition\n array_ptr_index :: \"(('a :: c_type)['b :: finite]) ptr \\ bool \\ nat \\ 'a ptr\"\nwhere\n \"array_ptr_index p coerce n = CTypesDefs.ptr_add (ptr_coerce p)\n (if coerce \\ n \\ CARD ('b) then 0 else of_nat n)\"\n\nlemmas array_ptr_index_simps\n = array_ptr_index_def[where coerce=False, simplified]\n array_ptr_index_def[where coerce=True, simplified]\n\nlemma heap_update_Array:\n \"heap_update (p ::('a::packed_type['b::finite]) ptr) arr\n = (\\s. foldl (\\s n. heap_update (array_ptr_index p False n)\n (Arrays.index arr n) s) s [0 ..< card (UNIV :: 'b set)])\"\n apply (rule ext, simp add: heap_update_def)\n apply (subst coerce_heap_update_to_heap_updates\n [OF _ refl, where chunk=\"size_of TYPE('a)\" and m=\"card (UNIV :: 'b set)\"])\n apply simp\n apply (rule foldl_cong[OF refl refl])\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def)\n apply (rule_tac f=\"\\xs. heap_update_list p xs s\" for p s in arg_cong)\n apply (simp add: to_bytes_def size_of_def\n packed_type_access_ti)\n apply (simp add: typ_info_array')\n apply (subst fcp_eta[symmetric], subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: packed_type_access_ti size_of_def)\n apply fastforce\n apply (rule take_drop_foldl_concat)\n apply (simp add: size_of_def)\n apply simp\n done\n\nlemma from_bytes_Array_element:\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n assumes len: \"length bs = size_of TYPE('a) * CARD('b)\"\n shows\n \"index (from_bytes bs :: 'a['b]) n\n = from_bytes (take (size_of TYPE('a)) (drop (n * size_of TYPE('a)) bs))\"\n using less\n apply (simp add: from_bytes_def size_of_def typ_info_array')\n apply (subst update_ti_list_array'[OF refl])\n apply simp\n apply (simp add: len size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply (simp add: split_upt_on_n[OF less])\n apply (rule trans, rule foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp+\n apply (subst foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp\n apply (simp add: mult.commute)\n apply (frule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (rule upd_rf)\n apply (simp add: size_of_def len mult.commute)\n done\n\nlemma heap_access_Array_element':\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n shows\n \"index (h_val hp p) n\n = h_val hp (array_ptr_index p False n)\"\n using less\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def h_val_def)\n apply (simp add: from_bytes_Array_element)\n apply (simp add: drop_heap_list_le take_heap_list_le)\n apply (subst take_heap_list_le)\n apply (simp add: le_diff_conv2)\n apply (drule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (simp add: mult.commute)\n apply simp\n done\n\nlemmas heap_access_Array_element\n = heap_access_Array_element'[simplified array_ptr_index_simps]\n\nlemma heap_update_id:\n \"h_val hp ptr = (v :: 'a :: packed_type)\n \\ heap_update ptr v hp = hp\"\n apply (simp add: h_val_def heap_update_def)\n apply (rule heap_update_list_id[where n=\"size_of TYPE('a)\"])\n apply clarsimp\n apply (simp add: from_bytes_def to_bytes_def update_ti_t_def\n size_of_def field_access_update_same\n td_fafu_idem)\n done\n\nlemma fold_cong':\n \"a = b \\ xs = ys \\ (\\x. x \\ set xs =simp=> f x = g x)\n \\ fold f xs a = fold g ys b\"\n unfolding simp_implies_def\n by (metis fold_cong)\n\nlemma intvl_empty2:\n \"({p ..+ n} = {}) = (n = 0)\"\n by (auto simp add: intvl_def)\n\nlemma heap_update_list_commute:\n \"{p ..+ length xs} \\ {q ..+ length ys} = {}\n \\ heap_update_list p xs (heap_update_list q ys hp)\n = heap_update_list q ys (heap_update_list p xs hp)\"\n apply (cases \"length xs < addr_card\")\n apply (cases \"length ys < addr_card\")\n apply (rule ext, simp add: heap_update_list_value)\n apply blast\n apply (simp_all add: addr_card intvl_overflow intvl_empty2)\n done\n\nlemma heap_update_commute:\n \"\\ {ptr_val p ..+ size_of TYPE('a)} \\ {ptr_val q ..+ size_of TYPE('b)} = {};\n wf_fd (typ_info_t TYPE('a)); wf_fd (typ_info_t TYPE('b)) \\\n \\ heap_update p v (heap_update q (u :: 'b :: c_type) h)\n = heap_update q u (heap_update p (v :: 'a :: c_type) h)\"\n apply (simp add: heap_update_def)\n apply (simp add: heap_update_list_commute heap_list_update_disjoint_same\n to_bytes_def length_fa_ti size_of_def Int_commute)\n done\n\nlemma heap_update_Array_update:\n assumes n: \"n < CARD('b :: finite)\"\n assumes size: \"CARD('b) * size_of TYPE('a :: packed_type) < 2 ^ addr_bitsize\"\n shows \"heap_update p (Arrays.update (arr :: 'a['b]) n v) hp\n = heap_update (array_ptr_index p False n) v (heap_update p arr hp)\"\nproof -\n\n have P: \"\\x k. \\ x < CARD('b); k < size_of TYPE('a) \\\n \\ unat (of_nat x * of_nat (size_of TYPE('a)) + (of_nat k :: addr))\n = x * size_of TYPE('a) + k\"\n using size\n apply (case_tac \"size_of TYPE('a)\", simp_all)\n apply (case_tac \"CARD('b)\", simp_all)\n apply (subst unat_add_lem[THEN iffD1])\n apply (simp add: unat_word_ariths unat_of_nat less_Suc_eq_le)\n apply (subgoal_tac \"Suc x * size_of TYPE('a) < 2 ^ addr_bitsize\", simp_all)\n apply (erule order_le_less_trans[rotated], simp add: add_mono)\n apply (subst unat_mult_lem[THEN iffD1])\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n apply (rule order_less_le_trans, erule order_le_less_trans[rotated],\n rule add_mono, simp+)\n apply (simp add: less_Suc_eq_le trans_le_add2)\n apply simp\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n done\n\n let ?key_upd = \"heap_update (array_ptr_index p False n) v\"\n note commute = fold_commute_apply[where h=\"?key_upd\"\n and xs=\"[Suc n ..< CARD('b)]\", where g=f' and f=f' for f']\n\n show ?thesis using n\n apply (simp add: heap_update_Array split_upt_on_n[OF n]\n foldl_conv_fold)\n apply (subst commute)\n apply (simp_all add: packed_heap_update_collapse\n cong: fold_cong')\n apply (rule ext, simp)\n apply (rule heap_update_commute, simp_all add: ptr_add_def)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def intvl_def Suc_le_eq)\n apply (rule set_eqI, clarsimp)\n apply (drule word_unat.Rep_inject[THEN iffD2])\n apply (clarsimp simp: P nat_eq_add_iff1)\n apply (case_tac x, simp_all add: less_Suc_eq_le Suc_diff_le)\n done\nqed\n\nlemma heap_update_id_Array:\n fixes arr :: \"('a :: packed_type)['b :: finite]\"\n shows \"arr = h_val hp p\n \\ heap_update p arr hp = hp\"\n apply (simp add: heap_update_Array)\n apply (rule foldl_does_nothing[where s=hp])\n apply (simp add: heap_access_Array_element' heap_update_id)\n done\n\nlemma heap_update_Array_element'':\n fixes p' :: \"(('a :: packed_type)['b::finite]) ptr\"\n fixes p :: \"('a :: packed_type) ptr\"\n fixes hp w\n assumes p: \"p = array_ptr_index p' False n\"\n assumes n: \"n < CARD('b)\"\n assumes size: \"CARD('b) * size_of TYPE('a) < 2 ^ addr_bitsize\"\n shows \"heap_update p' (Arrays.update (h_val hp p') n w) hp\n = heap_update p w hp\"\n apply (subst heap_update_Array_update[OF n size])\n apply (simp add: heap_update_id_Array p)\n done\n\nlemmas heap_update_Array_element'\n = heap_update_Array_element''[simplified array_ptr_index_simps]\n\nlemma array_count_size:\n \"CARD('b :: array_max_count) * size_of TYPE('a :: array_outer_max_size) < 2 ^ addr_bitsize\"\n using array_outer_max_size_ax[where 'a='a] array_max_count_ax[where 'a='b]\n apply (clarsimp dest!: nat_le_Suc_less_imp)\n apply (drule(1) mult_mono, simp+)\n done\n\nlemmas heap_update_Array_element\n = heap_update_Array_element'[OF refl _ array_count_size]\n\nlemma typ_slice_list_cut:\n \"\\ (\\x \\ set xs. size_td (dt_fst x) = m); m \\ 0; n < (length xs * m) \\\n \\ typ_slice_list xs n =\n typ_slice_pair (xs ! (n div m)) (n mod m)\"\n apply (induct xs arbitrary: n, simp_all)\n apply (intro conjI impI)\n apply simp\n apply (subgoal_tac \"\\n'. n = n' + m\")\n apply (clarsimp simp add: div_add1_eq)\n apply (rule_tac x=\"n - m\" in exI)\n apply simp\n done\n\nlemma typ_slice_t_array:\n \"\\ n < CARD('b); y < size_of TYPE('a) \\\n \\ typ_slice_t (export_uinfo (typ_info_t TYPE('a))) y \\\n typ_slice_t (export_uinfo (array_tag TYPE('a['b :: finite])))\n (y + size_of TYPE('a :: mem_type) * n)\"\n apply (simp add: array_tag_def array_tag_n_eq\n split del: if_split)\n apply (rule disjI2)\n apply (subgoal_tac \"y + (size_of TYPE('a) * n) < CARD('b) * size_of TYPE('a)\")\n apply (simp add: typ_slice_list_cut[where m=\"size_of TYPE('a)\"]\n map_td_list_map o_def size_of_def\n sz_nzero[unfolded size_of_def])\n apply (simp add: export_uinfo_def[symmetric])\n apply (rule_tac y=\"Suc n * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n done\n\nlemma h_t_valid_Array_element':\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); coerce \\ n < CARD('b) \\\n \\ htd \\\\<^sub>t array_ptr_index p coerce n\"\n apply (clarsimp simp only: h_t_valid_def valid_footprint_def Let_def\n c_guard_def c_null_guard_def)\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n apply (clarsimp simp: size_td_array size_of_def typ_uinfo_t_def\n typ_info_array array_tag_def)\n apply (intro conjI)\n apply (clarsimp simp: CTypesDefs.ptr_add_def\n field_simps)\n apply (drule_tac x=\"offs * size_of TYPE('a) + y\" in spec)\n apply (drule mp)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (clarsimp simp: field_simps)\n apply (erule map_le_trans[rotated])\n apply (rule list_map_mono)\n apply (subst mult.commute, rule typ_slice_t_array[unfolded array_tag_def])\n apply assumption\n apply (simp add: size_of_def)\n apply (simp add: ptr_aligned_def align_of_def align_td_array\n array_ptr_index_def\n CTypesDefs.ptr_add_def unat_word_ariths unat_of_nat)\n using align_size_of[where 'a='a] align[where 'a='a]\n apply (simp add: align_of_def size_of_def addr_card_def card_word)\n apply (simp add: dvd_mod)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: intvl_def simp del: word_neq_0_conv)\n apply (drule_tac x=\"offs * size_of TYPE('a) + k\" in spec)\n apply (drule mp)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def field_simps)\n apply (erule notE)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (auto simp add: array_ptr_index_def intro: exI[where x=0])\n done\n\nlemma h_t_valid_Array_element:\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); 0 \\ n; n < int CARD('b) \\\n \\ htd \\\\<^sub>t ((ptr_coerce p :: 'a ptr) +\\<^sub>p n)\"\n apply (drule_tac n=\"nat n\" and coerce=False in h_t_valid_Array_element')\n apply simp\n apply (simp add: array_ptr_index_def)\n done\n\nlemma ptr_safe_Array_element:\n \"\\ ptr_safe (p :: (('a :: mem_type)['b :: finite]) ptr) htd; coerce \\ n < CARD('b) \\\n \\ ptr_safe (array_ptr_index p coerce n) htd\"\n apply (simp add: ptr_safe_def)\n apply (erule order_trans[rotated])\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n prefer 2\n apply (auto simp: array_ptr_index_def intro: exI[where x=0])[1]\n apply (clarsimp simp: s_footprint_def s_footprint_untyped_def\n CTypesDefs.ptr_add_def\n size_td_array size_of_def)\n apply (rule_tac x=\"offs * size_of TYPE('a) + x\" in exI)\n apply (simp add: size_of_def)\n apply (rule conjI)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def)\n apply (rule mult_le_mono1)\n apply simp\n apply (thin_tac \"coerce \\ P\" for P)\n apply (elim disjE exE conjE, simp_all add: typ_uinfo_t_def)\n apply (erule order_less_le_trans)\n apply (rule prefix_length_le)\n apply (rule order_trans, erule typ_slice_t_array)\n apply (simp add: size_of_def)\n apply (simp add: size_of_def field_simps typ_info_array)\n done\n\nlemma from_bytes_eq:\n \"from_bytes [x] = x\"\n by (clarsimp simp:from_bytes_def update_ti_t_def typ_info_word word_rcat_def)\n\nlemma bytes_disjoint:\"(x::('a::c_type) ptr) \\ y \\ {ptr_val x + a ..+ 1} \\ {ptr_val y + a ..+ 1} = {}\"\n by (clarsimp simp:intvl_def)\n\nlemma byte_ptrs_disjoint:\"(x::('a::c_type) ptr) \\ y \\ \\i < of_nat (size_of TYPE('a)). ptr_val x + i \\ ptr_val y + i\"\n by force\n\nlemma le_step:\"\\(x::('a::len) word) < y + 1; x \\ y\\ \\ x < y\"\n by (metis less_x_plus_1 max_word_max order_less_le)\n\nlemma ptr_add_disjoint:\n \"\\ ptr_val y \\ {ptr_val x ..+ size_of TYPE('a)};\n ptr_val (x::('a::c_type) ptr) < ptr_val (y::('b::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val x + a < ptr_val y\"\n apply (erule swap)\n apply (rule intvl_inter_le [where k=0 and ka=\"unat (ptr_val y - ptr_val x)\"])\n apply clarsimp\n apply (metis (mono_tags) add_diff_cancel2 add_diff_inverse diff_add_cancel\n trans_less_add1 unat_less_helper word_le_less_eq word_less_add_right\n word_of_nat_less word_unat.Rep_inverse)\n apply simp\n done\n\nlemma ptr_add_disjoint2:\n \"\\ ptr_val x \\ {ptr_val y ..+ size_of TYPE('a)};\n ptr_val (y::('b::c_type) ptr) < ptr_val (x::('a::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val y + a < ptr_val x\"\n apply (erule swap)\n apply (rule intvl_inter_le[where k=0 and ka=\"unat (ptr_val x - ptr_val y)\"])\n apply clarsimp\n apply (metis (no_types) add.commute less_imp_le less_le_trans not_le unat_less_helper\n word_diff_ls'(4))\n apply simp\n done\n\nlemma ptr_aligned_is_aligned:\"\\ptr_aligned (x::('a::c_type) ptr); align_of TYPE('a) = 2 ^ n\\ \\ is_aligned (ptr_val x) n\"\n by (clarsimp simp: ptr_aligned_def is_aligned_def)\n\nlemma intvl_no_overflow:\n assumes no_overflow: \"unat a + b < 2 ^ len_of TYPE('a::len)\"\n shows \"(x \\ {(a :: 'a word) ..+ b}) = (a \\ x \\ x < (a + of_nat b))\"\nproof -\n obtain \"sk\" :: \"'a word \\ 'a word \\ nat \\ nat\"\n where f1: \"\\x y z. x \\ {y..+z} \\ x = y + of_nat (sk x y z) \\ sk x y z < z\"\n using [[metis_new_skolem]] by (metis intvlD)\n\n have f2: \"\\x. a + x < a + of_nat b \\ \\ x < of_nat b\"\n using no_overflow\n by (metis PackedTypes.of_nat_mono_maybe_le add_lessD1 le_add1\n add.commute olen_add_eqv unat_of_nat_eq word_arith_nat_add\n word_plus_strict_mono_right)\n\n have f3: \"\\x y. y \\ {x..+b} \\ of_nat (sk y x b) < (of_nat b :: 'a word)\"\n using no_overflow f1\n by (metis add_lessD1 add.commute of_nat_mono_maybe)\n\n have \"x < a + of_nat b \\ \\ of_nat (sk x a b) < (of_nat b :: 'a word) \\ ?thesis\"\n using f1 f2 by metis\n\n hence \"x < a + of_nat b \\ ?thesis\"\n using f3 by metis\n\n thus \"?thesis\"\n apply (rule disjE)\n apply (rule iffI)\n apply (clarsimp simp: intvl_def)\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (subgoal_tac \"k + (b + unat a) < 2 ^ len_of (TYPE('a)) + b\")\n apply (subgoal_tac \"k + unat a < 2 ^ len_of (TYPE('a))\")\n apply (metis add_lessD1 le_def less_not_refl2 add.commute unat_eq_of_nat word_arith_nat_add)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (rule exI [where x=\"unat (x - a)\"])\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (metis diff_le_self le_add_diff_inverse le_diff_conv le_eq_less_or_eq le_unat_uoi add.commute nat_neq_iff unat_of_nat_eq word_arith_nat_add)\n apply simp\n done\nqed\n\n(* arg_cong specified for FCP because it does not apply as is. *)\nlemma FCP_arg_cong:\"f = g \\ FCP f = FCP g\"\n by simp\n\nlemma h_val_id:\n \"h_val (hrs_mem (hrs_mem_update (heap_update x y) s)) x = (y::'a::mem_type)\"\n apply (subst hrs_mem_update)\n apply (rule h_val_heap_update)\n done\n\nlemma heap_update_id2:\n \"hrs_mem_update (heap_update p ((h_val (hrs_mem s) p)::'a::packed_type)) s = s\"\n apply (clarsimp simp:hrs_mem_update_def case_prod_beta)\n apply (subst heap_update_id)\n apply (simp add:hrs_mem_def)+\n done\n\nlemma intvlI_unat:\"unat b < unat c \\ a + b \\ {a ..+ unat c}\"\n by (metis intvlI word_unat.Rep_inverse)\n\nlemma neq_imp_bytes_disjoint:\n \"\\ c_guard (x::'a::c_type ptr); c_guard y; unat j < align_of TYPE('a);\n unat i < align_of TYPE('a); x \\ y; 2 ^ n = align_of TYPE('a); n < 32\\ \\\n ptr_val x + j \\ ptr_val y + i\"\n apply (rule ccontr)\n apply (subgoal_tac \"is_aligned (ptr_val x) n\")\n apply (subgoal_tac \"is_aligned (ptr_val y) n\")\n apply (subgoal_tac \"(ptr_val x + j && ~~ mask n) = (ptr_val y + i && ~~ mask n)\")\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply clarsimp\n apply simp\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n done\n\nlemma heap_update_list_base':\"heap_update_list p [] = id\"\n by (rule ext, simp)\n\nlemma hrs_mem_update_id3: \"hrs_mem_update id = id\"\n unfolding hrs_mem_update_def by simp\n\nabbreviation\n ptr_span :: \"'a::mem_type ptr \\ addr set\" where\n \"ptr_span p \\ {ptr_val p ..+ size_of TYPE('a)}\"\n\nabbreviation (input)\n cptr_type :: \"('a :: c_type) ptr \\ 'a itself\"\nwhere\n \"cptr_type p \\ TYPE('a)\"\n\nlemma ptr_retyp_valid_footprint_disjoint2:\n \"\\valid_footprint (ptr_retyp (q::'b::mem_type ptr) d) p s; {p..+size_td s} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ valid_footprint d p s\"\n apply(clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule (1) mp)\n apply(subgoal_tac \"p + of_nat y \\ {p..+size_td s}\")\n apply (subst (asm) ptr_retyp_d)\n apply clarsimp\n apply fast\n apply (clarsimp simp add: ptr_retyp_d_eq_fst split: if_split_asm)\n apply fast\n apply (erule intvlI)\n done\n\nlemma ptr_retyp_disjoint2:\n \"\\ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q;\n {ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\n apply(clarsimp simp: h_t_valid_def)\n apply(erule ptr_retyp_valid_footprint_disjoint2)\n apply(simp add: size_of_def)\n apply fast\n done\n\nlemma ptr_retyp_disjoint_iff:\n \"{ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {}\n \\ ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q = d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\n apply rule\n apply (erule (1) ptr_retyp_disjoint2)\n apply (erule (1) ptr_retyp_disjoint)\n done\n\nlemma h_t_valid_ptr_retyp_eq:\n \"\\ cptr_type p <\\<^sub>\\ cptr_type p' \\ h_t_valid (ptr_retyp p td) g p'\n = (if ptr_span p \\ ptr_span p' = {} then h_t_valid td g p'\n else field_of_t p' p \\ g p')\"\n apply (clarsimp simp: ptr_retyp_disjoint_iff split: if_split)\n apply (cases \"g p'\")\n apply (rule iffI)\n apply (rule ccontr, drule h_t_valid_neq_disjoint, rule ptr_retyp_h_t_valid, simp+)\n apply (simp add: Int_commute)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (drule sub_h_t_valid[where p=p, rotated], rule ptr_retyp_h_t_valid, simp, simp)\n apply (erule(1) h_t_valid_guard_subst)\n apply (simp add: h_t_valid_def)\n done\n\nlemma field_lookup_list_Some_again:\n \"dt_snd (xs ! i) = f\n \\ i < length xs\n \\ f \\ dt_snd ` set ((take i xs))\n \\ field_lookup_list xs [f] n\n = Some (dt_fst (xs ! i), n + sum_list (map (size_td o dt_fst) (take i xs)))\"\n apply (induct xs arbitrary: i n, simp_all)\n apply (case_tac x1, simp)\n apply (case_tac i, auto split: if_split)\n done\n\nlemma field_lookup_array:\n \"n < CARD('b) \\ field_lookup (typ_info_t TYPE(('a :: c_type)['b :: finite]))\n [replicate n (CHR ''1'')] i = Some (adjust_ti (typ_info_t TYPE('a))\n (\\x. x.[n]) (\\x f. Arrays.update f n x), i + n * size_of TYPE ('a))\"\n apply (simp add: typ_info_array array_tag_def array_tag_n_eq)\n apply (subst field_lookup_list_Some_again[where i=n],\n auto simp add: take_map o_def sum_list_triv size_of_def)\n done\n\nlemma field_of_t_refl:\n \"field_of_t p p' = (p = p')\"\n apply (safe, simp_all add: field_of_t_def)\n apply (simp add: field_of_def)\n apply (drule td_set_size_lte)\n apply (simp add: unat_eq_0)\n done\n\nlemma ptr_retyp_same_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p' \\ {ptr_val p..+ size_of TYPE('a)} \\ {ptr_val p' ..+ size_of TYPE('a)} = {}\"\n using ht\n by (simp add: h_t_valid_ptr_retyp_eq[where p=p and p'=p'] field_of_t_refl\n split: if_split_asm)\n\nlemma h_t_valid_ptr_retyp_inside_eq:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes inside: \"ptr_val p' \\ {ptr_val p ..+ size_of TYPE('a)}\"\n and ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p'\"\n using ptr_retyp_same_cleared_region[OF ht] inside mem_type_self[where p=p']\n by blast\n\nlemma typ_slice_t_self_nth:\n \"\\n < length (typ_slice_t td m). \\b. typ_slice_t td m ! n = (td, b)\"\n using typ_slice_t_self [where td = td and m = m]\n by (fastforce simp add: in_set_conv_nth)\n\nlemma ptr_retyp_other_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'b :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n and tdisj: \"typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b :: mem_type)\"\n and clear: \"\\x \\ {ptr_val p ..+ size_of TYPE('a)}. \\n b. snd (td x) n \\ Some (typ_uinfo_t TYPE('b), b)\"\n shows \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} = {}\"\nproof (rule classical)\n assume asm: \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} \\ {}\"\n then obtain mv where mvp: \"mv \\ {ptr_val p..+size_of TYPE('a)}\"\n and mvp': \"mv \\ {ptr_val p'..+size_of TYPE('b)}\"\n by blast\n\n then obtain k' where mv: \"mv = ptr_val p' + of_nat k'\" and klt: \"k' < size_td (typ_info_t TYPE('b))\"\n by (clarsimp dest!: intvlD simp: size_of_def)\n\n let ?mv = \"ptr_val p' + of_nat k'\"\n\n obtain n b where nl: \"n < length (typ_slice_t (typ_uinfo_t TYPE('b)) k')\"\n and tseq: \"typ_slice_t (typ_uinfo_t TYPE('b)) k' ! n = (typ_uinfo_t TYPE('b), b)\"\n using typ_slice_t_self_nth [where td = \"typ_uinfo_t TYPE('b)\" and m = k']\n by clarsimp\n\n with ht have \"snd (ptr_retyp p td ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n unfolding h_t_valid_def\n apply -\n apply (clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule mp [OF _ klt])\n apply (clarsimp simp: map_le_def)\n apply (drule bspec)\n apply simp\n apply simp\n done\n\n moreover {\n assume \"snd (ptr_retyp p empty_htd ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n hence \"(typ_uinfo_t TYPE('b)) \\ fst ` set (typ_slice_t (typ_uinfo_t TYPE('a))\n (unat (ptr_val p' + of_nat k' - ptr_val p)))\"\n using asm mv mvp\n apply -\n apply (rule_tac x = \"(typ_uinfo_t TYPE('b), b)\" in image_eqI)\n apply simp\n apply (fastforce simp add: ptr_retyp_footprint list_map_eq in_set_conv_nth split: if_split_asm)\n done\n\n with typ_slice_set have \"(typ_uinfo_t TYPE('b)) \\ fst ` td_set (typ_uinfo_t TYPE('a)) 0\"\n by (rule subsetD)\n\n hence False using tdisj by (clarsimp simp: tag_disj_def typ_tag_le_def)\n } ultimately show ?thesis using mvp mvp' mv unfolding h_t_valid_def valid_footprint_def\n apply -\n apply (subst (asm) ptr_retyp_d_eq_snd)\n apply (auto simp add: map_add_Some_iff clear)\n done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/LemmaBucket_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2597796708710577}} {"text": "section {*LR1\\_Property\\_Satisfaction\\_\\_compute\\_latest\\_production*}\ntheory\n LR1_Property_Satisfaction__compute_latest_production\n\nimports\n PRJ_12_04_06_06_12__ENTRY\n\nbegin\n\ndeclare [[ hypsubst_thin = false ]]\ndatatype DT_revert_position =\n elim \"nat\"\n | gen \"nat\" \"nat\"\ndeclare [[ hypsubst_thin = true ]]\n\ndefinition Pident_line :: \"\n ('q, 's, 't) PSplitItem\n \\ bool\"\n where\n \"Pident_line S \\\n PSplitItem_prods S = []\n \\ PSplitItem_elim S = []\"\n\ndefinition Pident_lines :: \"\n ('q, 's, 't) PSplit\n \\ nat set\"\n where\n \"Pident_lines S \\\n {n. n < length S \\ Pident_line (S ! n)}\"\n\ndefinition first_empty_rhs :: \"\n (('q, 's) DT_l2_l3_nonterminals, 't) cfg_step_label list\n \\ (('q, 's) DT_l2_l3_nonterminals, 't) cfg_step_label\"\n where\n \"first_empty_rhs w \\\n THE p.\n \\i.\n w ! i = p\n \\ prod_rhs p = []\n \\ (\\j < i. prod_rhs (w ! j) \\ [])\"\n\ndefinition get_prod_at_DT_revert_position :: \"\n ('q, 's, 't) PSplit\n \\ DT_revert_position\n \\ (('q, 's) DT_l2_l3_nonterminals, 't) cfg_step_label\"\n where\n \"get_prod_at_DT_revert_position S rp \\\n case rp of\n elim n \\ first_empty_rhs (hd (PSplitItem_elim_prods (S ! n)))\n | gen n m \\ hd (filterB [PSplitItem_prods (S ! n) ! m])\"\n\ndefinition valid_DT_revert_position :: \"\n ('q, 's, 't) PSplit\n \\ DT_revert_position\n \\ bool\"\n where\n \"valid_DT_revert_position S rp \\\n case rp of\n elim n \\\n n < length S\n \\ PSplitItem_elim (S ! n) \\ []\n | gen n m \\\n n < length S\n \\ m < length (PSplitItem_prods (S ! n))\n \\ setA [PSplitItem_prods (S ! n) ! m] = {}\"\n\ndefinition before_ident_line :: \"\n ('q, 's, 't) PSplit\n \\ nat\n \\ bool\"\n where\n \"before_ident_line S n \\\n \\i < n. \\ Pident_line (S ! i)\"\n\ndefinition get_line :: \"\n DT_revert_position\n \\ nat\"\n where\n \"get_line rp \\\n case rp of\n elim n \\ n\n | gen n m \\ n\"\n\ndefinition is_DT_revert_position :: \"\n ('q, 's, 't) PSplit\n \\ DT_revert_position\n \\ bool\"\n where\n \"is_DT_revert_position S rp \\\n valid_DT_revert_position S rp\n \\ before_ident_line S (get_line rp)\n \\ (case rp of\n elim n \\ True\n | gen n m \\ (\n let\n prod = get_prod_at_DT_revert_position S rp\n in\n (prod_rhs prod = [] \\ Suc m < length (PSplitItem_prods (S ! n)))\n \\ (Suc n \\ Pident_lines S \\ Suc m = length (PSplitItem_prods (S ! n)))))\"\n\ndefinition get_pos :: \"\n DT_revert_position\n \\ nat\"\n where\n \"get_pos rp \\\n case rp of\n elim n \\ 0\n | gen n m \\ Suc m\"\n\ndefinition leq :: \"\n DT_revert_position\n \\ DT_revert_position\n \\ bool\"\n where\n \"leq rp1 rp2 \\\n get_line rp1 < get_line rp2\n \\ (get_line rp1 = get_line rp2\n \\ get_pos rp1 \\ get_pos rp2)\"\n\ndefinition get_DT_revert_position :: \"\n ('q, 's, 't) PSplit\n \\ DT_revert_position option\"\n where\n \"get_DT_revert_position S \\\n if \\rp. is_DT_revert_position S rp\n then Some (THE rp.\n is_DT_revert_position S rp\n \\ (\\rp'. is_DT_revert_position S rp' \\ leq rp rp'))\n else None\"\n\ndefinition get_revert_prod :: \"\n ('q, 's, 't) PSplit\n \\ (('q, 's) DT_l2_l3_nonterminals, 't) cfg_step_label option\"\n where\n \"get_revert_prod S \\\n case get_DT_revert_position S of\n None \\ None\n | Some rp \\ Some (get_prod_at_DT_revert_position S rp)\"\n\nlemma get_DT_revert_position_eq: \"\n is_DT_revert_position S rp\n \\ (THE rp. is_DT_revert_position S rp \\ (\\rp'. is_DT_revert_position S rp' \\ leq rp rp')) = p\n \\ get_DT_revert_position S = Some p\"\n apply(simp add: get_DT_revert_position_def)\n apply(force)\n done\n\nlemma leq_leq_eq: \"\n leq x y\n \\ leq y x\n \\ x=y\"\n apply(simp add: leq_def)\n apply(case_tac x)\n apply(rename_tac nat)(*strict*)\n apply(case_tac y)\n apply(rename_tac nat nata)(*strict*)\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(clarsimp)\n apply(rename_tac nat nat1 nat2)(*strict*)\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(rename_tac nat1 nat2)(*strict*)\n apply(case_tac y)\n apply(rename_tac nat1 nat2 nat)(*strict*)\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(rename_tac nat1 nat2 nat1a nat2a)(*strict*)\n apply(clarsimp)\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(force)\n done\n\nlemma THE_get_DT_revert_position_eq: \"\n is_DT_revert_position S rp\n \\ (\\rp'. is_DT_revert_position S rp' \\ leq rp rp')\n \\ (THE rp. is_DT_revert_position S rp \\ (\\rp'. is_DT_revert_position S rp' \\ leq rp rp')) = rp\"\n apply(rule the_equality)\n apply(force)\n apply(rename_tac rpa)(*strict*)\n apply(clarsimp)\n apply(rule leq_leq_eq)\n apply(rename_tac rpa)(*strict*)\n apply(force)\n apply(rename_tac rpa)(*strict*)\n apply(force)\n done\n\nlemma get_DT_revert_position_eq2: \"\n is_DT_revert_position S rp\n \\ (is_DT_revert_position S rp \\ (\\rp'. is_DT_revert_position S rp' \\ leq rp rp'))\n \\ get_DT_revert_position S = Some rp\"\n apply(rule get_DT_revert_position_eq)\n apply(force)\n apply(rule THE_get_DT_revert_position_eq)\n apply(force)\n apply(force)\n done\n\nlemma leq_gen_elim: \"\n m leq (gen m x) (elim n)\"\n apply(simp add: leq_def get_line_def get_pos_def)\n done\n\nlemma first_empty_rhs_with_left_degen_front: \"\n valid_cfg G\n \\ cfgLM.trans_der G d c \\ c'\n \\ left_degen G d\n \\ first_empty_rhs\n (\\ @ \\prod_lhs = A, prod_rhs = []\\ # w) = \\prod_lhs = A, prod_rhs = []\\\"\n apply(simp add: first_empty_rhs_def)\n apply(rule the_equality)\n apply(rule_tac\n x=\"length \\\"\n in exI)\n apply(clarsimp)\n apply(rename_tac j)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac j)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d\"\n and i=\"j\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(force)\n apply(rename_tac j)(*strict*)\n apply(clarsimp)\n apply(rename_tac j e ci ci')(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac j e ci ci' l r)(*strict*)\n apply(simp add: left_degen_def)\n apply(simp add: sat_refined_def)\n apply(erule_tac\n x=\"j\"\n in allE)\n apply(clarsimp)\n apply(rename_tac j e ci ci' l r wa Aa waa)(*strict*)\n apply (metis list.simps(2) nth_append_1)\n apply(rename_tac p)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i=length \\\")\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(case_tac \"i>length \\\")\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(subgoal_tac \"i\")\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"False\")\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac i)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d\"\n and i=\"i\"\n and kleene_starT=\"False\"\n and END=\"False\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(force)\n apply(rename_tac i)(*strict*)\n apply(clarsimp)\n apply(rename_tac i e ci ci')(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i e ci ci' l r)(*strict*)\n apply(simp add: left_degen_def)\n apply(simp add: sat_refined_def)\n apply(thin_tac \"\\j @ \\prod_lhs = A, prod_rhs = []\\ # w) ! j) \\ []\")\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac i e ci ci' l r wa Aa waa)(*strict*)\n apply (metis list.simps(2) nth_append_1)\n done\n\nlemma leq_elim_elim: \"\n n\\m\n \\ leq (elim n) (elim m)\"\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(force)\n done\n\nlemma leq_elim_gen: \"\n n\\m\n \\ leq (elim n) (gen m x)\"\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(force)\n done\n\nlemma get_revert_prod_sound_rhs_empty: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G (S1 @ SL # S2 # Sb)\n \\ EValidSplit G (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ EValidSplitExt (S1 @ SL # S2 # Sb)\n \\ EValidSplitExt (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ Esplit_signature (Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)) = r @ [teB b]\n \\ setA (Esplit_signature Sb) = {}\n \\ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ \\ cfg_productions G\n \\ ESplitItem_elem SL = Some (teA (cons_l3 q1 X q2))\n \\ length (Esplit_signature S1) = length S1\n \\ ESplitItem_elem S2 = Some (teB b)\n \\ length (nat_seq 0 (length S1)) = Suc (length S1)\n \\ nat_seq 0 (length S1) ! length S1 = length S1\n \\ r = []\n \\ get_revert_prod (restrict G' G \n (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb) (Suc (length S1 + length r))) \n = Some \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\\"\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_mergeL_def Xstep_elem_def nth_opt_def)\n apply(case_tac SL)\n apply(rename_tac ESplitItem_elim ESplitItem_from ESplitItem_ignore ESplitItem_elim_prods ESplitItem_prodsa ESplitItem_elema ESplitItem_to)(*strict*)\n apply(clarsimp)\n apply(rename_tac ESplitItem_elim ESplitItem_from ESplitItem_ignore ESplitItem_elim_prods ESplitItem_prods ESplitItem_to)(*strict*)\n apply(rename_tac el fr ig el\\ \\ to)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: Xstep_merge1_def)\n apply(rule conjI)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_merge1_toWasNotEliminated_def)\n apply(simp add: get_revert_prod_def)\n apply(subgoal_tac \"get_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) = Some (gen (length S1) (length \\))\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) (length S1) ! length \\\"\n and s=\"teB \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: restrict_newprods_def restrict_newprodsX_def)\n apply(rule_tac\n t=\"(map SSf SSw)!SSn\" for SSf SSw SSn\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nth_map)\n apply(rule_tac\n t=\"length (nat_seq 0 n)\" for n\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"liftB (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2) ! length \\\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule liftB_nth)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 SSX ! SSY\" for SSX SSY\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G (\\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2) = []\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: strict_prefix_def option_to_list_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule_tac\n G=\"G\"\n in derive_empty_if_first_prod_has_empty_rhs)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"EValidSplit_ValidItem G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_belongs_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule_tac\n rp=\"gen (length S1) (length \\)\"\n in get_DT_revert_position_eq2)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(rule_tac\n t=\"before_ident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) (get_line (gen (length S1) (length \\)))\"\n and s=\"True\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: before_ident_line_def get_line_def)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\ Pident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! i)\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp add: Eident_lines_def Eident_line_def Pident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! i = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: Pident_line_def)\n apply(subgoal_tac \"length(restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) i) = length(ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i))\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(ESplitItem_elim ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! i)) = length(ESplitItem_elim ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i))\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! i\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"(map SSf SSw)!SSn\" for SSf SSw SSn\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"length (restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) (length S1)) = length(\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2)\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: valid_DT_revert_position_def)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(rule_tac\n t=\"(map SSf SSw)!SSn\" for SSf SSw SSn\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nth_map)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(case_tac \"foldl (@) [] (ESplitItem_elim_prods S2) = [] \\ ESplitItem_prods S2 = []\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplit_ValidItem G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and d=\"d\"\n and i=\"length \\\"\n and kleene_starT=\"False\"\n and END=\"True\"\n in cfgLM.trans_der_step_detail)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to d)(*strict*)\n apply(simp add: cfgLM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to d e ci l r)(*strict*)\n apply(case_tac ci)\n apply(rename_tac el fr ig el\\ \\ to d e ci l r cfg_confa)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to d e l r)(*strict*)\n apply(simp add: option_to_list_def)\n apply(case_tac fr)\n apply(rename_tac el fr ig el\\ \\ to d e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e l r)(*strict*)\n apply(subgoal_tac \"SSrenPI=[] \\ SSc2=\\cfg_conf=[]\\\" for SSrenPI SSc2)\n apply(rename_tac el ig el\\ \\ to d e l r)(*strict*)\n prefer 2\n apply(rule_tac cfgLM_trans_der_from_empty)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to d e l r a)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(subgoal_tac \"(\\d c \\ c'. cfgLM.trans_der G d c \\ c' \\ (\\w1 w2. cfg_conf c = liftB w1 @ liftA w2) \\ (\\w1 w2. cfg_conf c' = liftB w1 @ liftA w2))\")\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def CFGtermLeft_def)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = [teA a]\\\"\n in allE)\n apply(erule_tac\n x=\"\\\"\n in allE)\n apply(erule_tac\n x=\"\\cfg_conf = l @ teA (cons_l3 q1 X q2) # r\\\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(simp add: cfgLM.trans_der_def)\n apply(rule_tac\n m=\"Suc 0\"\n and v=\"[Some SSx]\" for SSx\n in get_labels_drop_tail)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(erule impE)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(rule_tac\n x=\"[]\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"[SSX]\" for SSX\n in exI)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e l r a)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e l r a w1 w2)(*strict*)\n apply(case_tac l)\n apply(rename_tac el ig el\\ \\ to d e l r a w1 w2)(*strict*)\n prefer 2\n apply(rename_tac el ig el\\ \\ to d e l r a w1 w2 aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w1 w2 list)(*strict*)\n apply(case_tac w1)\n apply(rename_tac el ig el\\ \\ to d e r a w1 w2 list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list)(*strict*)\n apply(case_tac w2)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w1 w2 list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list lista)(*strict*)\n apply(case_tac list)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list lista)(*strict*)\n prefer 2\n apply(rename_tac el ig el\\ \\ to d e r a w2 list lista aa listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 lista aa listb)(*strict*)\n apply(case_tac \"ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (case ESplitItem_from S2 of None \\ [] | Some A \\ [A])) to\")\n apply(rename_tac el ig el\\ \\ to d e r a w2 lista aa listb)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 lista aa listb ab list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e r a w2 list lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w2 lista)(*strict*)\n apply(case_tac lista)\n apply(rename_tac el ig el\\ \\ to d e a w2 lista)(*strict*)\n prefer 2\n apply(rename_tac el ig el\\ \\ to d e a w2 lista aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w2 lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w2)(*strict*)\n apply(case_tac w2)\n apply(rename_tac el ig el\\ \\ to d e a w2)(*strict*)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e a w2 aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a list)(*strict*)\n apply(subgoal_tac \"ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (case ESplitItem_from S2 of None \\ [] | Some A \\ [A])) to = list\")\n apply(rename_tac el ig el\\ \\ to d e a list)(*strict*)\n prefer 2\n apply(rule liftA_inj)\n apply(force)\n apply(rename_tac el ig el\\ \\ to d e a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a)(*strict*)\n apply(erule_tac\n x=\"length \\\"\n in allE)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac el ig el\\ \\ to d e l r a w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w1 w2)(*strict*)\n apply(case_tac w1)\n apply(rename_tac el ig el\\ \\ to d e a w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w2)(*strict*)\n apply(case_tac w2)\n apply(rename_tac el ig el\\ \\ to d e a w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w2 aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac el ig el\\ \\ to d e a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac el ig el\\ \\ to d e a w1 w2 aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(rule_tac\n t=\"liftB (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2) ! length \\\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule liftB_nth)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(rule_tac\n t=\"nat_seq 0 SSX ! SSY\" for SSX SSY\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G (\\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2) = []\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: strict_prefix_def option_to_list_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule_tac\n G=\"G\"\n in derive_empty_if_first_prod_has_empty_rhs)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"EValidSplit_ValidItem G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_belongs_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: restrict_newprods_def)\n apply(simp add: restrict_newprodsX_def)\n apply(rule_tac\n t=\"length(nat_seq SSx SSy)\" for SSx SSy\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (liftB (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2))\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule liftB_length)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to rp')(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(clarsimp)\n apply(thin_tac \"prod_rhs (get_prod_at_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) (gen (length S1) (length \\))) = [] \\ Suc (length \\) < length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! length S1)) \\ Suc (length S1) \\ Pident_lines (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) \\ Suc (length \\) = length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! length S1))\")\n apply(rename_tac el fr ig el\\ \\ to rp')(*strict*)\n apply(case_tac rp')\n apply(rename_tac el fr ig el\\ \\ to rp' nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(thin_tac \"length \\ < length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! length S1))\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(thin_tac \" (case PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! length S1) ! length \\ of teA a \\ {a} | teB b \\ {}) = {}\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule leq_gen_elim)\n apply(subgoal_tac \"length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) = Suc(length S1)\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! nat) = []\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (length S1) ! nat\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_no_elim_before_nonterminal_def)\n apply(erule conjE)+\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(case_tac \"nat < length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! nat\"\n and s=\"S1!nat\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"S1!nat\"\n and s=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat\"\n in subst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! nat\"\n and s=\"[\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]!SSX\" for SSX\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_2_prime)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat=length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to rp' nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! nat1) ! nat2\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) = Suc(length S1)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1))) = Suc (length S1)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: leq_def get_pos_def get_line_def)\n apply(case_tac \"length S1 = nat1 \\ length \\ \\ nat2\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) ! nat1 = (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! nat1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule_tac\n ?x1.0=\"Sb\"\n and ?x2.0=\"[]\"\n in nth_eq_ignore_append)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! nat1)) = length (ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) ! nat1))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def restrict_newprodsX_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length (ESplitItem_prods ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! nat1)) - Suc 0))\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule liftB_length)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(erule disjE)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_no_pop_in_prods_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat2\"\n in allE)\n apply(erule_tac\n P=\"nat2 < length (ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1))\"\n in impE)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(subgoal_tac \"(ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1) ! nat2)= ba\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n t=\"S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb\"\n and s=\"S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # (S2 # Sb)\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n el=\"el\"\n and fr=\"fr\"\n and ig=\"ig\"\n and el\\=\"el\\\"\n and to=\"ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\"\n and G=\"G\"\n and G'=\"G'\"\n and ?S1.0=\"Sb\"\n in nonabstracted_productions_are_unmodified)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(case_tac \"nat1=length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1\"\n and s=\"S1!nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n t=\"S1!nat1\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! nat1\"\n in subst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"nat1=length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat1 \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc nat1\"\n in allE)\n apply(case_tac \"Suc nat1 < length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(simp add: Pident_line_def Pident_lines_def)\n apply(clarsimp)\n apply(case_tac \"Suc nat1=length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: Eident_line_def Eident_lines_def Pident_line_def Pident_lines_def)\n apply(clarsimp)\n apply(subgoal_tac \"length(ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! Suc nat1)) = length(PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! Suc nat1))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(ESplitItem_elim ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! Suc nat1)) = length(PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\ # Sb) (Suc (length S1)) ! Suc nat1))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (length S1) ! Suc nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n f=\"\\X. length(ESplitItem_elim X)\"\n in arg_cong)\n apply(rule nth_eq_ignore_append)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (length S1) ! Suc nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! Suc nat1 = (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (ESplitItem_elim_prods S2) @ ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2 @ drop (length (ESplitItem_elim S2) + length (option_to_list (ESplitItem_from S2))) to\\]) ! Suc nat1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length(nat_seq SSx SSy)\" for SSx SSy\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule liftB_length)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_eq_ignore_append)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_merge1_toWasEliminated_def)\n apply(simp add: get_revert_prod_def)\n apply(subgoal_tac \"get_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1))) = Some (elim (length S1))\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"el\\=[]\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig \\ to)(*strict*)\n apply(subgoal_tac \"EValidSplit_ValidItem G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = [], ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac el fr ig \\ to)(*strict*)\n apply(simp add: EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_gen_def)\n apply(clarsimp)\n apply(rename_tac el fr ig \\ to d da)(*strict*)\n apply(rule_tac\n d=\"d\"\n in first_empty_rhs_with_left_degen_front)\n apply(rename_tac el fr ig \\ to d da)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac el fr ig \\ to d da)(*strict*)\n apply(force)\n apply(rename_tac el fr ig \\ to d da)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_no_elim_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def )\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplitExt_no_elim_before_nonterminal_def)\n apply(erule_tac\n x=\"(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"(length S1)\"\n in allE)\n apply(clarsimp)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"length (el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2)) = length(option_to_list fr @ drop (length to) (ESplitItem_elim S2))\")\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplit_producing G (S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"\\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\\"\n in ballE)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply (metis append_Cons eq_Nil_appendI in_set_butlast list.simps(3))\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac ig el\\ \\ to y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_elim_def)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_def EValidSplit_ValidItem_def EValidSplitItem_def EValidSplitItem_elim_def)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(rule get_DT_revert_position_eq2)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(rule_tac\n t=\"before_ident_line (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1))) (get_line (elim (length S1)))\"\n and s=\"True\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp add: before_ident_line_def get_line_def)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"\\ Pident_line (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! i)\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(simp add: Eident_lines_def Eident_line_def Pident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! i = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: Pident_line_def)\n apply(subgoal_tac \"length(restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) i) = length(ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i))\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(ESplitItem_elim ((S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! i)) = length(ESplitItem_elim ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i))\")\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\" ((S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! i)\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to i)(*strict*)\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"EValidSplit_producing G (S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"\\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\\"\n in ballE)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply(simp add: option_to_list_def)\n apply(clarsimp)\n apply(rename_tac fr ig el\\ \\ to)(*strict*)\n apply (metis Cons_eq_appendI append_Nil in_set_butlast list.simps(2))\n apply(rename_tac el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to rp')(*strict*)\n apply(case_tac rp')\n apply(rename_tac el fr ig el\\ \\ to rp' nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule leq_elim_elim)\n apply(case_tac \"nat \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitExt_no_elim_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def )\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(simp add: EValidSplitExt_no_elim_before_nonterminal_def)\n apply(erule_tac\n x=\"(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! nat = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(subgoal_tac \"length(PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! nat)) = length(ESplitItem_elim ((S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) ! nat))\")\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! nat\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) ! nat\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) ! nat = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to rp' nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule leq_elim_gen)\n apply(case_tac \"nat1 \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitExt_no_pop_in_prods_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat2\"\n in allE)\n apply(erule impE)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule_tac\n t=\"length (ESplitItem_prods (S1 ! nat1))\"\n and s=\"length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! nat1))\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def restrict_newprodsX_def)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (ESplitItem_prods (S1 ! nat1)) - Suc 0)) = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule conjI)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule liftB_length)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: get_prod_at_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! nat1) ! nat2\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"ESplitItem_prods ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1) ! nat2 = ba\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n k=\"Suc 0\"\n in nonabstracted_productions_are_unmodified2)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n t=\"length (ESplitItem_prods (S1 ! nat1))\"\n and s=\"length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! nat1))\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def restrict_newprodsX_def)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! nat1\"\n in ssubst)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"length (nat_seq 0 (length (ESplitItem_prods (S1 ! nat1)) - Suc 0)) = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule liftB_length)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! nat1) ! nat2\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! length S1) \\ []\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(thin_tac \"length S1 < length (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(case_tac \"Suc nat1 < length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(subgoal_tac \"Suc nat1=length S1\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: Pident_lines_def Pident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)) ! length S1) = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2)\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"EValidSplit_producing G (S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def)\n apply(rename_tac fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: EValidSplit_producing_def)\n apply(erule_tac\n x=\"\\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\\"\n in ballE)\n apply(rename_tac fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply (metis append_Cons eq_Nil_appendI in_set_butlast list.simps(3))\n apply(rename_tac fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac ig el\\ \\ to nat1 nat2 ba y)(*strict*)\n apply(simp add: option_to_list_def)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc nat1\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"Suc nat1 \\ Pident_lines (restrict G' G (S1 @ \\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\ # Sb) (Suc (length S1)))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp (no_asm) add: Pident_lines_def Pident_line_def Eident_lines_def Eident_line_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! Suc nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) ! Suc nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! Suc nat1 = SSX\" for SSX)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el @ option_to_list fr @ drop (length to) (ESplitItem_elim S2), ESplitItem_from = ESplitItem_from S2, ESplitItem_ignore = ESplitItem_ignore S2, ESplitItem_elim_prods = el\\ @ (\\ @ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = []\\ # foldl (@) [] (take (length to) (ESplitItem_elim_prods S2))) # drop (length to) (ESplitItem_elim_prods S2), ESplitItem_prods = ESplitItem_prods S2, ESplitItem_elem = Some (teB b), ESplitItem_to = ESplitItem_to S2\\]) (Suc nat1)) = length (ESplitItem_prods (S1 ! Suc nat1))\")\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n done\n\nlemma leq_gen_gen: \"\n n\\m \\ x\\y\n \\ leq (gen n x) (gen m y)\"\n apply(simp add: leq_def get_line_def get_pos_def)\n apply(force)\n done\n\nlemma get_revert_prod_sound_rhs_read: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G (S1 @ SL # S2 # Sb)\n \\ EValidSplit G (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\ # Xstep_gen [B] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ EValidSplitExt (S1 @ SL # S2 # Sb)\n \\ EValidSplitExt (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\ # Xstep_gen [B] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ Esplit_signature (Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\ # Xstep_gen [B] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)) = [teB ba, teA B, teB b]\n \\ setA (Esplit_signature Sb) = {}\n \\ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\ \\ cfg_productions G\n \\ ESplitItem_elem SL = Some (teA (cons_l3 q1 X q2))\n \\ length (Esplit_signature S1) = length S1\n \\ ESplitItem_elem S2 = Some (teB b)\n \\ length (nat_seq 0 (length S1)) = Suc (length S1)\n \\ nat_seq 0 (length S1) ! length S1 = length S1\n \\ get_revert_prod (restrict G' G (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\ # Xstep_gen [B] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb) (Suc (Suc (Suc (length S1))))) = Some \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA B]\\\"\n apply(case_tac B)\n apply(rename_tac q bb)(*strict*)\n apply(subgoal_tac \"LR1ProdForm G\")\n apply(rename_tac q bb)(*strict*)\n apply(simp add: LR1ProdForm_def)\n apply(erule_tac\n x=\"\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l2 q bb)]\\\"\n in ballE)\n apply(rename_tac q bb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q bb)(*strict*)\n apply(simp add: split_TSstructure_def F2LR1inputx_def)\n apply(rule sub_of_F_SDPDA_TO_CFG_STD__implies_LR1ProdForm)\n apply(force)\n apply(rename_tac q1a bb q2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2')\n apply(rename_tac q1' X' q2')(*strict*)\n apply(subgoal_tac \"nat_seq 0 0 = [0]\")\n apply(rename_tac q1' X' q2')(*strict*)\n prefer 2\n apply (metis natUptTo_n_n)\n apply(rename_tac q1' X' q2')(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_mergeL_def Xstep_elem_def nth_opt_def)\n apply(case_tac SL)\n apply(rename_tac q1' X' q2' ESplitItem_elim ESplitItem_from ESplitItem_ignorea ESplitItem_elim_prods ESplitItem_prodsa ESplitItem_elema ESplitItem_toa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' ESplitItem_elim ESplitItem_from ESplitItem_ignore ESplitItem_elim_prods ESplitItem_prods ESplitItem_to)(*strict*)\n apply(rename_tac el fr ig el\\ \\ to)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: Esplit_signature_def)\n apply(simp add: option_to_list_def)\n apply(simp add: get_revert_prod_def)\n apply(subgoal_tac \"get_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) = Some (gen (length S1) (length \\))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule get_DT_revert_position_eq2)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(simp add: valid_DT_revert_position_def)\n apply(rule_tac\n t=\"before_ident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (get_line (gen (length S1) (length \\)))\"\n and s=\"True\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: Pident_lines_def Pident_line_def restrict_def restrict_map_def restrict_len_def before_ident_line_def)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: Pident_line_def get_line_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! i = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! i = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! i = S1 ! i\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \" length(restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) i) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[\\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]\"\n and G=\"G\"\n and G'=\"G'\"\n and ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\]\"\n and n=\"length S1\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp (no_asm) add: Pident_lines_def Pident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = ([\\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\,S2])!SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[S2]\"\n and G=\"G\"\n and G'=\"G'\"\n and ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\]\"\n and n=\"Suc(length S1)\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\]) ! Suc (length S1) = [SSy]!SSX\" for SSy SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1) ! length \\\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (Suc (length S1)) = []\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1) = []\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI setA_liftB liftB_length Suc_length nth_setA)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(case_tac \"restrict_newprodsXX G (nat_seq 0 (length \\) ! length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\]) (Some (teB ba)) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = (cons_l3 q1' X' q2') # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! length \\ = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\] = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule derives_single)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def restrict_newto_def restrict_newignore_def new_post_sig_def)\n apply(subgoal_tac \"length (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule drop_and_crop_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"Suc (length to + length ig) \\ Suc (length to)+ length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)) \\ Suc (length to)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2])\"\n and i=\"Suc(length S1)\"\n in ignore_toberemoved_suffix)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(case_tac c)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp add: drop_and_crop_def cropTol3l2_def butn_def)\n apply(case_tac \"Suc (length to + length ig) \\ length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(to @ ig) =length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(thin_tac \"to @ ig = a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (length to + length ig) - length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)) = Suc (length(a#list))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"length to+length ig\"\n and s=\"length(to@ig)\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(rule_tac\n t=\"Suc (length (to @ ig))\"\n and s=\"Suc(length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"to = [] \\ (Suc (length list) \\ length to \\ ig = [])\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(case_tac \"butlast (take (Suc (length list)) to) @ [cropTol3l2_single (last (take (Suc (length list)) to))]\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"to @ ig = restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"\\ strict_prefix [teB ba, teA (cons_l3 q1' X' q2')] (teB ba # liftA (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length to + length ig)))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"suffix SSX (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n k=\"Suc(Suc (length S1))\"\n in ESplitItem_ignore_restrict_toberemoved_suffix)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n c=\"c\"\n in entirely_ignored_can_not_happend_to_early)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(thin_tac \"EValidSplit G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (Suc (length S1))\"\n in subst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"[S2]!0\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to rp')(*strict*)\n apply(case_tac \"rp'\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to rp' nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule leq_gen_elim)\n apply(case_tac \"nat \\ length S1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitExt_no_elim_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(simp add: EValidSplitExt_no_elim_before_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat = (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\])!nat\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"nat = length S1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) = ESplitItem_elim ((S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) ! length S1)\")\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(subgoal_tac \"nat < length S1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat) = ESplitItem_elim ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\]) ! nat)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! nat = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! nat\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"S1!nat\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\]) ! nat\"\n in subst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to rp' nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule leq_gen_gen)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule ccontr)\n apply(subgoal_tac \"nat1 \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! nat1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc nat1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_prods (S1 ! nat1)) = length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule sym)\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (gen (length S1) (length \\))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat1) ! nat2\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1 = S1!nat1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(erule disjE)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and k=\"Suc(Suc(Suc 0))\"\n and ba=\"bb\"\n and n=\"nat1\"\n and m=\"nat2\"\n and ?S1.0=\"S1\"\n in nonabstracted_productions_are_unmodified2)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat1\"\n in allE)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc nat1\"\n in allE)\n apply(case_tac \"Suc nat1 \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc nat1 \\ Pident_lines (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def Pident_lines_def Pident_line_def)\n apply(clarsimp)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"length(ESplitItem_prods ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\]) ! Suc nat1)) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and ?S2.0=\" \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # [S2]\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(rule_tac\n t=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) ! Suc nat1\"\n and s=\"((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\]) ! Suc nat1)\"\n in subst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) ! Suc nat1 = (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc nat1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(rule sym)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (gen (length S1) (length \\))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(case_tac \"length S1 \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) = (Suc (Suc (Suc (length S1))))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) = Suc (Suc (Suc (length S1)))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat1) ! nat2\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"Suc(length S1)=nat1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(subgoal_tac \"length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (length (nat_seq 0 (length S1))))) ! length (nat_seq 0 (length S1)))) = 0\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length S1))\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp (no_asm))\n apply(rule_tac\n t=\"min (length S1) (Suc (Suc (Suc (length S1))))\"\n and s=\"length S1\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (Suc(Suc(length S1))) ! Suc(length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length S1))\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp (no_asm))\n apply(subgoal_tac \"SSX = length (ESplitItem_prods ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2])! (Suc (length S1))))\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[]\"\n in restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(thin_tac \"Suc (length S1) = length (nat_seq 0 (length S1))\")\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(subgoal_tac \"Suc(length S1) < nat1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"nat1=Suc(Suc(length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2 bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp add: get_line_def before_ident_line_def)\n apply(erule_tac\n x=\"Suc (length S1)\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Pident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(thin_tac \"\\ Pident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp add: Pident_line_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)=SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(restrict_newprods G' G ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2])@[]) (Suc (length S1))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[]\"\n in restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"length (foldl (@) [] (map (option_to_list \\ ESplitItem_elem) S1)) = length S1\")\n apply(subgoal_tac \"length S1=nat1\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"nat2 < length \\\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(erule disjE)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"Suc nat2 < length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(thin_tac \"before_ident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (get_line (gen (length S1) nat2))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! nat2\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length S1 < length (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(thin_tac \"nat2 < length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_no_pop_in_prods_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(simp add: EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(erule_tac\n x=\"Suc(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat2\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\]) ! nat2 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\]\"\n and k=\"(Suc (Suc 0))\"\n in nonabstracted_productions_are_unmodified2)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\]) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2 bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1)) = length(\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\])\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (Suc (Suc (length S1))) ! length S1\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\]\"\n and ?S2.0=\"[\\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]\"\n and n=\"length S1\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"False\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(subgoal_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ \\ teA a\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(thin_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ = teA a\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1) = []\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI setA_liftB liftB_length Suc_length nth_setA)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(subgoal_tac \"length (nat_seq 0 (length \\)) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprodsXX G (nat_seq 0 (length \\) ! length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\]) (Some (teB ba)) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! length \\ = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\] = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule derives_single)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\] = [teB ba, teA (cons_l3 q1' X' q2')]\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: option_to_list_def restrict_newto_def restrict_newignore_def new_post_sig_def)\n apply(subgoal_tac \"length (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule drop_and_crop_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"Suc (length to + length ig) \\ Suc (length to)+ length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)) \\ Suc (length to)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2])\"\n and i=\"Suc(length S1)\"\n in ignore_toberemoved_suffix)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp add: drop_and_crop_def cropTol3l2_def butn_def)\n apply(case_tac \"Suc (length to + length ig) \\ length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(to @ ig) =length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(thin_tac \"to @ ig = a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (length to + length ig) - length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)) = Suc (length(a#list))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"length to+length ig\"\n and s=\"length(to@ig)\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(rule_tac\n t=\"Suc (length (to @ ig))\"\n and s=\"Suc(length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)))\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"to = [] \\ (Suc (length list) \\ length to \\ ig = [])\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(case_tac \"butlast (take (Suc (length list)) to) @ [cropTol3l2_single (last (take (Suc (length list)) to))]\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"to @ ig = restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"\\ strict_prefix [teB ba, teA (cons_l3 q1' X' q2')] (teB ba # liftA (drop_and_crop (cons_l3 q1' X' q2' # to @ ig) (length to + length ig)))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"suffix SSX (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (length S1))\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n k=\"Suc(Suc (length S1))\"\n in ESplitItem_ignore_restrict_toberemoved_suffix)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n c=\"c\"\n in entirely_ignored_can_not_happend_to_early)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(thin_tac \"EValidSplit G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) ! Suc (Suc (length S1))\"\n in subst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"[S2]!0\"\n in ssubst)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ = teB (\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(simp add: get_DT_revert_position_def)\n apply(case_tac \"\\rp. is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) rp\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb rp)(*strict*)\n apply(thin_tac \"(THE rp. is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) rp \\ (\\rp'. is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) rp' \\ leq rp rp')) = gen (length S1) (length \\)\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb rp)(*strict*)\n apply(thin_tac \"is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) rp\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb rp)(*strict*)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1) = []\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI liftB_nth2 Suc_length nth_append_length)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(subgoal_tac \"length(nat_seq 0 (length \\)) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! (length \\) = SSX\" for SSX)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(force)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprodsXX G (length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\]) (Some (teB ba)) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teB ba, teA (cons_l3 q1' X' q2')]\\], ESplitItem_elem = Some (teB ba), ESplitItem_to = cons_l3 q1' X' q2' # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q1' X' q2'), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' X' q2' el fr ig el\\ \\ to bb)(*strict*)\n apply(clarsimp)\n done\n\nlemma get_revert_prod_sound_rhs_push: \"\nF2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G (S1 @ SL # S2 # Sb)\n \\ EValidSplit G (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\ # Xstep_gen [C] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ EValidSplitExt (S1 @ SL # S2 # Sb)\n \\ EValidSplitExt (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\ # Xstep_gen [C] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb)\n \\ Esplit_signature (Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\ # Xstep_gen [C] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)) = [teA B, teA C, teB b]\n \\ setA (Esplit_signature Sb) = {}\n \\ \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\ \\ cfg_productions G\n \\ ESplitItem_elem SL = Some (teA (cons_l3 q1 X q2))\n \\ length (Esplit_signature S1) = length S1\n \\ ESplitItem_elem S2 = Some (teB b)\n \\ length (nat_seq 0 (length S1)) = Suc (length S1)\n \\ nat_seq 0 (length S1) ! length S1 = length S1\n \\ get_revert_prod (restrict G' G (S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\ # Xstep_gen [C] (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2) @ Sb) (Suc (Suc (Suc (length S1))))) = Some \\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\\"\n apply(subgoal_tac \"LR1ProdForm G\")\n prefer 2\n apply(rule sub_of_F_SDPDA_TO_CFG_STD__implies_LR1ProdForm)\n apply(simp add: split_TSstructure_def F2LR1inputx_def)\n apply(force)\n apply(simp add: LR1ProdForm_def)\n apply(erule_tac\n x=\"\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA B, teA C]\\\"\n in ballE)\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(rename_tac q2a q3 A2)(*strict*)\n apply(rename_tac q1' q2' X')\n apply(rename_tac q1' q2' X')(*strict*)\n apply(subgoal_tac \"nat_seq 0 0 = [0]\")\n apply(rename_tac q1' q2' X')(*strict*)\n prefer 2\n apply (metis natUptTo_n_n)\n apply(rename_tac q1' q2' X')(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(simp add: Xstep_mergeL_def Xstep_elem_def nth_opt_def)\n apply(case_tac SL)\n apply(rename_tac q1' q2' X' ESplitItem_elim ESplitItem_from ESplitItem_ignorea ESplitItem_elim_prods ESplitItem_prodsa ESplitItem_elema ESplitItem_toa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' ESplitItem_elim ESplitItem_from ESplitItem_ignore ESplitItem_elim_prods ESplitItem_prods ESplitItem_to)(*strict*)\n apply(rename_tac el fr ig el\\ \\ to)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: Esplit_signature_def)\n apply(simp add: option_to_list_def)\n apply(simp add: get_revert_prod_def)\n apply(subgoal_tac \"get_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) = Some (gen (length S1) (length \\))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule get_DT_revert_position_eq2)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(simp add: valid_DT_revert_position_def)\n apply(rule_tac\n t=\"before_ident_line (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (get_line (gen (length S1) (length \\)))\"\n and s=\"True\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: Pident_lines_def Pident_line_def restrict_def restrict_map_def restrict_len_def before_ident_line_def)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: Pident_line_def get_line_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! i = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! i = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! i = S1 ! i\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(simp add: EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! i = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \" length(restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) i) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n prefer 2\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to i)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[\\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]\"\n and G=\"G\"\n and G'=\"G'\"\n and ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\]\"\n and n=\"length S1\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp (no_asm) add: Pident_lines_def Pident_line_def)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[S2]\"\n and G=\"G\"\n and G'=\"G'\"\n and ?S1.0=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\]\"\n and n=\"Suc(length S1)\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\]) ! Suc (length S1) = [SSy]!SSX\" for SSy SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1) ! length \\\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"restrict_newprods G' G (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (Suc (length S1)) = []\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1) = []\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI setA_liftB liftB_length Suc_length nth_setA)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(case_tac \"restrict_newprodsXX G (nat_seq 0 (length \\) ! length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\]) (Some (teA (cons_l3 q1' X' q2'))) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! length \\ = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\] = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule derives_single)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def restrict_newto_def restrict_newignore_def new_post_sig_def)\n apply(subgoal_tac \"length (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule drop_and_crop_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"Suc (length to + length ig) \\ Suc (length to)+ length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)) \\ Suc (length to)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2])\"\n and i=\"Suc(length S1)\"\n in ignore_toberemoved_suffix)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(case_tac c)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp add: drop_and_crop_def cropTol3l2_def butn_def)\n apply(case_tac \"Suc (length to + length ig) \\ length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(to @ ig) =length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(thin_tac \"to @ ig = a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (length to + length ig) - length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)) = Suc (length(a#list))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"length to+length ig\"\n and s=\"length(to@ig)\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(rule_tac\n t=\"Suc (length (to @ ig))\"\n and s=\"Suc(length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"to = [] \\ (Suc (length list) \\ length to \\ ig = [])\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(case_tac \"butlast (take (Suc (length list)) to) @ [cropTol3l2_single (last (take (Suc (length list)) to))]\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"to @ ig = restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"\\ strict_prefix [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)] (teA (cons_l3 q1' X' q2') # liftA (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length to + length ig)))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"suffix SSX (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n k=\"Suc(Suc (length S1))\"\n in ESplitItem_ignore_restrict_toberemoved_suffix)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n c=\"c\"\n in entirely_ignored_can_not_happend_to_early)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(thin_tac \"EValidSplit G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (Suc (length S1))\"\n in subst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"[S2]!0\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to rp')(*strict*)\n apply(case_tac \"rp'\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to rp' nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule leq_gen_elim)\n apply(case_tac \"nat \\ length S1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"EValidSplitExt_no_elim_before_nonterminal (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(simp add: EValidSplitExt_no_elim_before_nonterminal_def)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat = (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\])!nat\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(case_tac \"nat = length S1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) = ESplitItem_elim ((S1 @ \\ESplitItem_elim = [], ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) ! length S1)\")\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(subgoal_tac \"nat < length S1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(subgoal_tac \"PSplitItem_elim (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat) = ESplitItem_elim ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\]) ! nat)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! nat = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! nat\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule_tac\n t=\"S1!nat\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\]) ! nat\"\n in subst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to rp' nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule leq_gen_gen)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(rule ccontr)\n apply(subgoal_tac \"nat1 \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! nat1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc nat1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(subgoal_tac \"length (ESplitItem_prods (S1 ! nat1)) = length (PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule sym)\n apply(rule restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"is_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) (gen (length S1) (length \\))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! nat1) ! nat2\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb) ! nat1 = S1!nat1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(erule disjE)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and k=\"Suc(Suc(Suc 0))\"\n and ba=\"ba\"\n and n=\"nat1\"\n and m=\"nat2\"\n and ?S1.0=\"S1\"\n in nonabstracted_productions_are_unmodified2)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"length S1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat1\"\n in allE)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"EValidSplitExt (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc nat1\"\n in allE)\n apply(case_tac \"Suc nat1 \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc nat1 \\ Pident_lines (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def Pident_lines_def Pident_line_def)\n apply(clarsimp)\n apply(simp add: Eident_lines_def Eident_line_def)\n apply(subgoal_tac \"length(ESplitItem_prods ((S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\]) ! Suc nat1)) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(rule sym)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and ?S2.0=\" \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # [S2]\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule_tac\n t=\"((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) ! Suc nat1\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\])!(Suc nat1)\"\n in subst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) ! Suc nat1 = (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2#[]) ! Suc nat1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(rule sym)\n apply(rule nth_append_2_prime_prime_X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"is_DT_revert_position (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1))))) (gen (length S1) (length \\))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(case_tac \"length S1 \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1))))) = (Suc (Suc (Suc (length S1))))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1))))) = Suc (Suc (Suc (length S1)))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(case_tac \"PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! nat1) ! nat2\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"Suc(length S1)=nat1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(subgoal_tac \"length (PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (length (nat_seq 0 (length S1))))) ! length (nat_seq 0 (length S1)))) = 0\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length S1))\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp (no_asm))\n apply(rule_tac\n t=\"min (length S1) (Suc (Suc (Suc (length S1))))\"\n and s=\"length S1\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (Suc(Suc(length S1))) ! Suc(length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length S1))\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp (no_asm))\n apply(subgoal_tac \"SSX = length (ESplitItem_prods (((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # []))! (Suc (length S1))))\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[]\"\n in restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(subgoal_tac \"((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # [])) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(thin_tac \"Suc (length S1) = length (nat_seq 0 (length S1))\")\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(subgoal_tac \"Suc(length S1) < nat1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"nat1=Suc(Suc(length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp add: get_line_def before_ident_line_def)\n apply(erule_tac\n x=\"Suc (length S1)\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Pident_line (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(thin_tac \"\\ Pident_line (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp add: Pident_line_def)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # [])) ! Suc (length S1)=SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(restrict_newprods G' G (((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # []))@[]) (Suc (length S1))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule_tac\n ?S2.0=\"[]\"\n in restrict_newprods_preserves_length)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(thin_tac \"length (foldl (@) [] (map (option_to_list \\ ESplitItem_elem) S1)) = length S1\")\n apply(subgoal_tac \"length S1=nat1\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"nat2 < length \\\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(erule disjE)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"Suc nat2 < length (PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(thin_tac \"before_ident_line (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1))))) (get_line (gen (length S1) nat2))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(case_tac \"PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1) ! nat2\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length S1 < length (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(thin_tac \"nat2 < length (PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(subgoal_tac \"EValidSplitExt_no_pop_in_prods_before_nonterminal ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(simp add: EValidSplitExt_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(simp add: EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(erule_tac\n x=\"Suc(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"(length S1)\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"nat2\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\]) ! nat2 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # [])\"\n and k=\"(Suc (Suc 0))\"\n in nonabstracted_productions_are_unmodified2)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(subgoal_tac \"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # []) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2 ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1)) = length(\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\])\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (Suc (Suc (length S1))) ! length S1\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"(S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # [])\"\n and n=\"length S1\"\n in restrict_newprods_preserves_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to nat2)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(case_tac \"PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"False\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(subgoal_tac \"PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ \\ teA a\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(thin_tac \"PSplitItem_prods (restrict G' G ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb)) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ = teA a\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore ((S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # [])) (length S1) = []\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI setA_liftB liftB_length Suc_length nth_setA)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(subgoal_tac \"length (nat_seq 0 (length \\)) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprodsXX G (nat_seq 0 (length \\) ! length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\]) (Some (teA (cons_l3 q1' X' q2'))) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! length \\ = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsXX_def)\n apply(subgoal_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\] = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule derives_single)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"derives G [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\] = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: option_to_list_def restrict_newto_def restrict_newignore_def new_post_sig_def)\n apply(subgoal_tac \"length (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule drop_and_crop_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"length (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))) = Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"Suc (length to + length ig) \\ Suc (length to)+ length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"Suc (length to + length ig) - length (restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)) \\ Suc (length to)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]\"\n and i=\"Suc(length S1)\"\n in ignore_toberemoved_suffix)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(subgoal_tac \"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(case_tac c)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp add: drop_and_crop_def cropTol3l2_def butn_def)\n apply(case_tac \"Suc (length to + length ig) \\ length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(to @ ig) =length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(thin_tac \"to @ ig = a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"Suc (length to + length ig) - length (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)) = Suc (length(a#list))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"length to+length ig\"\n and s=\"length(to@ig)\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(rule_tac\n t=\"Suc (length (to @ ig))\"\n and s=\"Suc(length(a # list @ restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)))\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(case_tac \"to = [] \\ (Suc (length list) \\ length to \\ ig = [])\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(clarsimp)\n apply(simp add: strict_prefix_def)\n apply(case_tac \"butlast (take (Suc (length list)) to) @ [cropTol3l2_single (last (take (Suc (length list)) to))]\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to a list aa lista)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"to @ ig = restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(thin_tac \"\\ strict_prefix [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)] (teA (cons_l3 q1' X' q2') # liftA (drop_and_crop (cons_l3 q2' X q2 # to @ ig) (length to + length ig)))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(subgoal_tac \"restrict_toberemovedX (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule restrict_toberemovedX_equals_restrict_toberemoved)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"suffix SSX (restrict_toberemoved (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (length S1))\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n prefer 2\n apply(rule_tac\n k=\"Suc(Suc (length S1))\"\n in ESplitItem_ignore_restrict_toberemoved_suffix)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to)(*strict*)\n apply(simp add: suffix_def)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n c=\"c\"\n in entirely_ignored_can_not_happend_to_early)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(thin_tac \"EValidSplit G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\, ESplitItem_elem = Some (teA (cons_l3 q1 X q2)), ESplitItem_to = to\\ # S2 # Sb)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"(S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) ! Suc (Suc (length S1))\"\n in subst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(rule_tac\n t=\"S2\"\n and s=\"[S2]!0\"\n in ssubst)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to c)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"PSplitItem_prods (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1)))) ! length S1) ! length \\ = teB (\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\)\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(thin_tac \"get_DT_revert_position (restrict G' G (S1 @ \\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\ # \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\ # S2 # Sb) (Suc (Suc (Suc (length S1))))) = Some (gen (length S1) (length \\))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"length(nat_seq 0 (Suc (Suc (length S1)))) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (Suc (Suc (length S1))) ! length S1 = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(case_tac \"restrict_newignore (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1) = []\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n prefer 2\n apply(clarsimp)\n apply (metis Nat.lessI liftB_nth2 Suc_length nth_append_length)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(subgoal_tac \"length(nat_seq 0 (length \\)) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"nat_seq 0 (length \\) ! (length \\) = SSX\" for SSX)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(force)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newprodsXX G (length \\) (\\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\]) (Some (teA (cons_l3 q1' X' q2'))) (restrict_newto (S1 @ [\\ESplitItem_elim = el, ESplitItem_from = fr, ESplitItem_ignore = ig, ESplitItem_elim_prods = el\\, ESplitItem_prods = \\ @ [\\prod_lhs = cons_l3 q1 X q2, prod_rhs = [teA (cons_l3 q1' X' q2'), teA (cons_l3 q2' X q2)]\\], ESplitItem_elem = Some (teA (cons_l3 q1' X' q2')), ESplitItem_to = cons_l3 q2' X q2 # to\\, \\ESplitItem_elim = [], ESplitItem_from = Some (cons_l3 q2' X q2), ESplitItem_ignore = to @ ig, ESplitItem_elim_prods = [], ESplitItem_prods = [], ESplitItem_elem = Some (teA (cons_l3 q2' X q2)), ESplitItem_to = []\\, S2]) (length S1))\")\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac q1' q2' X' el fr ig el\\ \\ to ba)(*strict*)\n apply(clarsimp)\n done\n\nlemma get_revert_prod_sound: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G S\n \\ EValidSplit G (Sa @ Sb)\n \\ EValidSplitExt S\n \\ EValidSplitExt (Sa @ Sb)\n \\ A=(cons_l3 q1 X q2)\n \\ Esplit_signature S = xl @ teA A # teB b # x\n \\ Esplit_signature Sa = xl @ r @ [teB b]\n \\ Esplit_signature Sb = x\n \\ length Sa = length (Esplit_signature Sa)\n \\ Esplit_step_relation G S \\prod_lhs = A, prod_rhs = r\\ (Sa @ Sb)\n \\ setA x = {}\n \\ get_revert_prod (restrict G' G (Sa @ Sb) (length Sa)) = Some \\prod_lhs = A, prod_rhs = r\\\"\n apply(simp add: Esplit_step_relation_def)\n apply(clarsimp)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp add: Esplit_signature_append setAConcat)\n apply(subgoal_tac \"Esplit_signature [SL] = [teA (cons_l3 q1 X q2)]\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"Esplit_signature (SL # S2) = Esplit_signature [SL] @ Esplit_signature S2\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"SL#S2\"\n and s=\"[SL]@S2\"\n in ssubst)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp (no_asm) only: Esplit_signature_append)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"Esplit_signature (SL # S2) = teA (cons_l3 q1 X q2) # Esplit_signature S2\")\n apply(subgoal_tac \"Esplit_signature S2 = teB b # Esplit_signature Sb\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(subgoal_tac \"strict_prefix (Esplit_signature S1) xl \\ SSX\" for SSX)\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(rule mutual_strict_prefix_strict_prefix)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(erule disjE)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 c)(*strict*)\n apply(case_tac c)\n apply(rename_tac S1 SL S2 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 list)(*strict*)\n apply(simp add: Esplit_signature_append setAConcat)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(erule disjE)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 c)(*strict*)\n apply(case_tac c)\n apply(rename_tac S1 SL S2 c)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 c a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(subgoal_tac \" list @ teA (cons_l3 q1 X q2) # Esplit_signature S2 = teB b # Esplit_signature Sb\")\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(case_tac list)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 a lista)(*strict*)\n apply (metis elemInsetA emptyE)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(rule_tac\n a=\"xl@[a]\"\n and b=\"xl@[teA (cons_l3 q1 X q2)]\"\n in append_linj_length)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(rule_tac\n t=\"(xl @ [teA (cons_l3 q1 X q2)]) @ teB b # Esplit_signature Sb\"\n and s=\"Esplit_signature S1 @ teA (cons_l3 q1 X q2) # Esplit_signature S2\"\n in ssubst)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(rule_tac\n t=\"Esplit_signature S1\"\n and s=\"xl @ a # list\"\n in ssubst)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"Esplit_signature S1 = xl\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(case_tac \"S2\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL)(*strict*)\n apply(simp add: Esplit_signature_def)\n apply(rename_tac S1 SL S2 a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL a list)(*strict*)\n apply(rename_tac S2 S2L)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(simp add: nth_opt_def)\n apply(subgoal_tac \"Esplit_signature [S2] = [teB b]\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(simp add: Esplit_signature_def)\n apply(case_tac \"ESplitItem_elem S2\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rule_tac\n xs=\"S2L\"\n in rev_cases)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n apply(subgoal_tac \"(\\x\\ set (butlast (S1 @ SL # S2 # ys @ [y])). (\\y. ESplitItem_from x = Some y) \\ (\\y. ESplitItem_elem x = Some y))\")\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n prefer 2\n apply(simp add: EValidSplit_def EValidSplit_producing_def)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n apply(erule_tac\n x=\"S2\"\n in ballE)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n apply(subgoal_tac \"(butlast (S1 @ SL # S2 # ys @ [y]))=SSX\" for SSX)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac S1 SL S2 ys y)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L a)(*strict*)\n apply(subgoal_tac \"foldl (@) (option_to_list (ESplitItem_elem S2)) (map (option_to_list \\ ESplitItem_elem) S2L) = SSX\" for SSX)\n apply(rename_tac S1 SL S2 S2L a)(*strict*)\n prefer 2\n apply(rule foldl_first)\n apply(rename_tac S1 SL S2 S2L a)(*strict*)\n apply(clarsimp)\n apply(simp add: option_to_list_def)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(subgoal_tac \"Esplit_signature (S2#S2L) = Esplit_signature [S2] @ Esplit_signature S2L\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"S2#S2L\"\n and s=\"[S2]@S2L\"\n in ssubst)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(simp (no_asm) only: Esplit_signature_append)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"Esplit_signature (S2 # S2L) = teB b # Esplit_signature Sb\")\n apply(subgoal_tac \"length (Esplit_signature S1) = length S1\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply (metis EValidSplit_Esplit_signature_length list.simps(3))\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(Xstep_mergeL (Xstep_elem SL \\prod_lhs = (cons_l3 q1 X q2), prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)) = Suc(length r)\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(subgoal_tac \"length(Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) = length r - Suc 0\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(rule Xstep_gen_length)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(simp (no_asm) add: Xstep_mergeL_def)\n apply(rule conjI)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(case_tac \"ESplitItem_elem (Xstep_elem SL \\prod_lhs = (cons_l3 q1 X q2), prod_rhs = r\\)\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(rename_tac S1 SL S2 S2L a)(*strict*)\n apply(clarsimp)\n apply(case_tac r)\n apply(rename_tac S1 SL S2 S2L a)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_elem_def nth_opt_def)\n apply(rename_tac S1 SL S2 S2L a aa list)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_elem_def nth_opt_def)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(case_tac \"filterA list = []\")\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(simp add: Xstep_elem_def nth_opt_def)\n apply(case_tac r)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(case_tac r)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(clarsimp)\n apply(case_tac list)\n apply(rename_tac S1 SL S2 S2L a list)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L a list aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L a aa lista)(*strict*)\n apply(simp add: split_TSstructure_def LR1ProdFormSimp_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"\\prod_lhs = cons_l3 q1 X q2, prod_rhs = a # aa # lista\\\"\n in ballE)\n apply(rename_tac S1 SL S2 S2L a aa lista)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S1 SL S2 S2L a aa lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L a aa lista ba A B)(*strict*)\n apply(subgoal_tac \"nat_seq 0 0 = [0]\")\n apply(rename_tac S1 SL S2 S2L a aa lista ba A B)(*strict*)\n prefer 2\n apply (metis natUptTo_n_n)\n apply(rename_tac S1 SL S2 S2L a aa lista ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac S1 SL S2 S2L a aa lista ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L ba B)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(rename_tac S1 SL S2 S2L a aa lista ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 S2L B C)(*strict*)\n apply(simp add: Xstep_gen_def)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(subgoal_tac \"Sa = S1 @ Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)\")\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n prefer 2\n apply(rule length_append_equal)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 S2L)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp add: Esplit_signature_append setAConcat)\n apply(thin_tac \"Esplit_signature [SL] = [teA (cons_l3 q1 X q2)]\")\n apply(thin_tac \"length (Xstep_mergeL (Xstep_elem SL \\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\ # Xstep_gen (filterA (tl r)) (ESplitItem_to SL @ ESplitItem_ignore SL)) (Some S2)) = Suc (length r)\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"ESplitItem_elem S2 = Some (teB b)\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(case_tac \"ESplitItem_elem S2\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 a)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(thin_tac \"Esplit_signature [S2] = [teB b]\")\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"LR1ProdFormSimp G\")\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(simp add: LR1ProdFormSimp_def)\n apply(erule_tac\n x=\"\\prod_lhs = cons_l3 q1 X q2, prod_rhs = r\\\"\n in ballE)\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"length(nat_seq 0 (length S1))=SSX\" for SSX)\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(subgoal_tac \"nat_seq 0 (length S1) ! (length S1) = SSX\" for SSX)\n apply(rename_tac S1 SL S2)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(rule get_revert_prod_sound_rhs_empty)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2)(*strict*)\n apply(erule exE)+\n apply(rename_tac S1 SL S2 ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac S1 SL S2 ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(rule get_revert_prod_sound_rhs_read)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba B)(*strict*)\n apply(force)\n apply(rename_tac S1 SL S2 ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac S1 SL S2 ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 B)(*strict*)\n apply(subgoal_tac \"LR1ProdForm G\")\n apply(rename_tac S1 SL S2 B)(*strict*)\n prefer 2\n apply(simp add: Esplit_TSstructure_def F2LR1input_def F2LR1inputx_def)\n apply(clarsimp)\n apply(rule sub_of_F_SDPDA_TO_CFG_STD__implies_LR1ProdForm)\n apply(force)\n apply(rename_tac S1 SL S2 B)(*strict*)\n apply(simp add: LR1ProdForm_def)\n apply(force)\n apply(rename_tac S1 SL S2 ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac S1 SL S2 B C)(*strict*)\n apply(rule get_revert_prod_sound_rhs_push)\n apply(rename_tac S1 SL S2 B C)(*strict*)\n apply(force)+\n done\n\nlemma LR1_property_part2_equal_productions2: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G S1\n \\ EValidSplit G (S1a @ S1b)\n \\ EValidSplitExt S1\n \\ EValidSplitExt (S1a @ S1b)\n \\ A1=(cons_l3 q11 X1 q12)\n \\ A2=(cons_l3 q21 X2 q22)\n \\ Esplit_signature S1 = xl1 @ teA A1 # teB b # Esplit_signature S1b\n \\ Esplit_signature S1a = xl1 @ r1 @ [teB b]\n \\ length S1a = length (Esplit_signature S1a)\n \\ Esplit_step_relation G S1 \\prod_lhs = A1, prod_rhs = r1\\ (S1a @ S1b)\n \\ EValidSplit G S2\n \\ EValidSplit G (S2a @ S2b)\n \\ EValidSplitExt S2\n \\ EValidSplitExt (S2a @ S2b)\n \\ Esplit_signature S2 = xl2 @ teA A2 # teB b # Esplit_signature S2b\n \\ Esplit_signature S2a = xl2 @ r2 @ [teB b]\n \\ length S2a = length (Esplit_signature S2a)\n \\ Esplit_step_relation G S2 \\prod_lhs = A2, prod_rhs = r2\\ (S2a @ S2b)\n \\ restrict G' G (S1a @ S1b) (length S1a) = restrict G' G (S2a @ S2b) (length S2a)\n \\ setA (Esplit_signature S1b) = {}\n \\ setA (Esplit_signature S2b) = {}\n \\ \\prod_lhs = A1, prod_rhs = r1\\ = \\prod_lhs = A2, prod_rhs = r2\\\"\n apply(subgoal_tac \"get_revert_prod (restrict G' G (S1a @ S1b) (length S1a)) = Some \\prod_lhs = A1, prod_rhs = r1\\\")\n apply(subgoal_tac \"get_revert_prod (restrict G' G (S2a @ S2b) (length S2a)) = Some \\prod_lhs = A2, prod_rhs = r2\\\")\n apply(subgoal_tac \"get_revert_prod (restrict G' G (S1a @ S1b) (length S1a)) = get_revert_prod (restrict G' G (S2a @ S2b) (length S2a))\")\n apply(force)\n apply(force)\n apply(rule get_revert_prod_sound)\n apply(force)\n apply(force)\n prefer 4\n apply(force)\n prefer 4\n apply(force)\n prefer 4\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(rule get_revert_prod_sound)\n apply(force)\n apply(force)\n prefer 2\n apply(force)\n prefer 3\n apply(force)\n prefer 3\n apply(force)\n prefer 3\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma LR1_property_part2_equal_productions: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G S1\n \\ EValidSplit G (S1a @ S1b)\n \\ EValidSplitExt S1\n \\ EValidSplitExt (S1a @ S1b)\n \\ A1=(cons_l3 q11 X1 q12)\n \\ A2=(cons_l3 q21 X2 q22)\n \\ Esplit_signature S1 = xl1 @ teA A1 # teB b # Esplit_signature S1b\n \\ Esplit_signature (S1a @ S1b) = xl1 @ r1 @ teB b # Esplit_signature S1b\n \\ Esplit_signature S1a = xl1 @ r1 @ [teB b]\n \\ length S1a = Suc (length xl1 + length r1)\n \\ Esplit_step_relation G S1 \\prod_lhs = A1, prod_rhs = r1\\ (S1a @ S1b)\n \\ EValidSplit G S2\n \\ EValidSplit G (S2a @ S2b)\n \\ EValidSplitExt S2\n \\ EValidSplitExt (S2a @ S2b)\n \\ Esplit_signature S2 = xl2 @ teA A2 # teB b # Esplit_signature S2b\n \\ Esplit_signature (S2a @ S2b) = xl2 @ r2 @ teB b # Esplit_signature S2b\n \\ Esplit_signature S2a = xl2 @ r2 @ [teB b]\n \\ length S2a = Suc (length xl2 + length r2)\n \\ Esplit_step_relation G S2 \\prod_lhs = A2, prod_rhs = r2\\ (S2a @ S2b)\n \\ xl1 @ r1 = xl2 @ r2\n \\ restrict G' G (S1a @ S1b) (Suc (length xl1 + length r1)) = restrict G' G (S2a @ S2b) (Suc (length xl2 + length r2))\n \\ setA (Esplit_signature S1b) = {}\n \\ setA (Esplit_signature S2b) = {}\n \\ A1 = A2 \\ r1 = r2\"\n apply(subgoal_tac \"Esplit_signature (S2a @ S2b) = SSX\" for SSX)\n prefer 2\n apply(rule Esplit_signature_append)\n apply(subgoal_tac \"Esplit_signature (S1a @ S1b) = SSX\" for SSX)\n prefer 2\n apply(rule Esplit_signature_append)\n apply(thin_tac \"Esplit_signature (S2a @ S2b) = xl2 @ r2 @ teB b # Esplit_signature S2b\")\n apply(thin_tac \"Esplit_signature (S1a @ S1b) = xl1 @ r1 @ teB b # Esplit_signature S1b\")\n apply(subgoal_tac \"\\prod_lhs = A1, prod_rhs = r1\\ = \\prod_lhs = A2, prod_rhs = r2\\\")\n apply(force)\n apply(rule_tac\n S1a=\"S1a\"\n and S2a=\"S2a\"\n and ?S1.0=\"S1\"\n and ?S1b.0=\"S1b\"\n and ?S2b.0=\"S2b\"\n and ?S2.0=\"S2\"\n in LR1_property_part2_equal_productions2)\n apply(force)+\n done\n\ntheorem LR1_property_part2: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ cfgRM.derivation_initial G d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf=xl1@teA A1#teB b#x1\\)\n \\ d1 (Suc n1) = Some (pair (Some \\prod_lhs = A1, prod_rhs = r1\\) \\cfg_conf=xl1@r1@teB b#x1\\)\n \\ cfgRM.derivation_initial G d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf=xl2@teA A2#teB b#x2\\)\n \\ d2 (Suc n2) = Some (pair (Some \\prod_lhs = A2, prod_rhs = r2\\) \\cfg_conf=xl2@r2@teB b#x2\\)\n \\ xl1@r1=xl2@r2\n \\ \\prod_lhs = A1, prod_rhs = r1\\ = \\prod_lhs = A2, prod_rhs = r2\\\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1\"\n and n=\"n1\"\n in cfgRM_derivation_to_Esplit_derivation)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac d2a S)(*strict*)\n apply(rename_tac d1x S1)\n apply(rename_tac d1x S1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d2\"\n and n=\"n2\"\n in cfgRM_derivation_to_Esplit_derivation)\n apply(rename_tac d1x S1)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2a S)(*strict*)\n apply(rename_tac d2x S2)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"EValidSplit G S1\")\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(subgoal_tac \"S1 \\ SSC\" for SSC)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1x\"\n in Esplit.belongs_configurations)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule Esplit.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_configurations_def)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"EValidSplit G S2\")\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(subgoal_tac \"S2 \\ SSC\" for SSC)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2x\"\n in Esplit.belongs_configurations)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule Esplit.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_configurations_def)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1\"\n and e=\"\\prod_lhs = A1, prod_rhs = r1\\\"\n and w=\"xl1 @ teA A1 # teB b # x1\"\n and w'=\"xl1 @ r1 @ teB b # x1\"\n in ESplit_cfgRM_step_can_be_simulated)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n and m=\"Suc n1\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S')(*strict*)\n apply(rename_tac S1x)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2\"\n and e=\"\\prod_lhs = A2, prod_rhs = r2\\\"\n and w=\"xl2 @ teA A2 # teB b # x2\"\n and w'=\"xl2 @ r2 @ teB b # x2\"\n in ESplit_cfgRM_step_can_be_simulated)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"n2\"\n and m=\"Suc n2\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1x S')(*strict*)\n apply(rename_tac S2x)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1x\"\n and b=\"b\"\n and x=\"x1\"\n and v=\"xl1 @ r1\"\n in EValidSplit_take_prefix)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S2a)(*strict*)\n apply(rename_tac S1a S1b)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2x\"\n and b=\"b\"\n and x=\"x2\"\n and v=\"xl2 @ r2\"\n in EValidSplit_take_prefix)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S1c S2a)(*strict*)\n apply(rename_tac S2a S2b)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"S1a\"\n and S1'=\"S1b\"\n and ?S2.0=\"S2a\"\n and S2'=\"S2b\"\n and ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n and ?n1.0=\"Suc n1\"\n and ?n2.0=\"Suc n2\"\n and v=\"xl1 @ r1\"\n and b=\"b\"\n and ?x1.0=\"Esplit_signature S1b\"\n in equal_split_prefix)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule_tac\n t=\"xl1@r1\"\n and s=\"xl2@r2\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"setA (Esplit_signature S1b) = {}\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n and m=\"Suc n1\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n apply(subgoal_tac \"\\l'. liftB l' = r\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"filterB r\"\n in exI)\n apply (rule liftBDeConv2)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(subgoal_tac \"strict_prefix xl1 l \\ SSX\" for SSX)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n prefer 2\n apply(rule mutual_strict_prefix_strict_prefix)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c)(*strict*)\n apply(rule_tac\n xs=\"c\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y)(*strict*)\n apply(case_tac ys)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(subgoal_tac \"LR1ProdFormSimp G\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(simp add: LR1ProdFormSimp_def)\n apply(erule_tac\n x=\"\\prod_lhs = A1, prod_rhs = r1\\\"\n in ballE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(case_tac list)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarify)\n apply(subgoal_tac \"A1=B\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n prefer 2\n apply(rule sym)\n apply (metis Cons_eq_appendI append_Nil DT_two_elements.inject(1) unequal_by_first_char)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarify)\n apply(thin_tac \"[teA A1] @ list @ [y, teA A1] = teA A1 # list @ [y, teA A1]\")\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(subgoal_tac \"CFG_no_self_loop G\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(simp add: CFG_no_self_loop_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(case_tac list)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c)(*strict*)\n apply(rule_tac\n xs=\"c\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y)(*strict*)\n apply(case_tac ys)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(case_tac l')\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' y list)(*strict*)\n apply (metis ConsApp setA_liftB setA_decompose setA_setmp_concat_2 all_not_in_conv append_Nil elemInsetA emptyE empty_subsetI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l')(*strict*)\n apply(case_tac l')\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"setA (Esplit_signature S2b) = {}\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"n2\"\n and m=\"Suc n2\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n apply(subgoal_tac \"\\l'. liftB l' = r\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"filterB r\"\n in exI)\n apply (rule liftBDeConv2)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(subgoal_tac \"strict_prefix xl2 l \\ SSX\" for SSX)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n prefer 2\n apply(rule mutual_strict_prefix_strict_prefix)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c)(*strict*)\n apply(rule_tac\n xs=\"c\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' c ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y)(*strict*)\n apply(case_tac ys)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' ys y a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(subgoal_tac \"LR1ProdFormSimp G\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(simp add: LR1ProdFormSimp_def)\n apply(erule_tac\n x=\"\\prod_lhs = A2, prod_rhs = r2\\\"\n in ballE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(case_tac list)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarify)\n apply(subgoal_tac \"A2=B\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n prefer 2\n apply(rule sym)\n apply (metis Cons_eq_appendI append_Nil DT_two_elements.inject(1) unequal_by_first_char)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarify)\n apply(thin_tac \"[teA A2] @ list @ [y, teA A2] = teA A2 # list @ [y, teA A2]\")\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(subgoal_tac \"CFG_no_self_loop G\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list)(*strict*)\n apply(simp add: CFG_no_self_loop_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' y list ba A B)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(case_tac list)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' list a lista)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(erule disjE)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(simp add: strict_prefix_def)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c)(*strict*)\n apply(rule_tac\n xs=\"c\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' c ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y)(*strict*)\n apply(case_tac ys)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(case_tac l')\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' ys y a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l' y list)(*strict*)\n apply (metis ConsApp setA_liftB setA_decompose setA_setmp_concat_2 all_not_in_conv append_Nil elemInsetA emptyE empty_subsetI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l')(*strict*)\n apply(case_tac l')\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l')(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b l' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(case_tac A1)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n and \\=\"map the (get_labels d1 n1)\"\n in cfgRM_reachable_only_l3_nonterminals)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule cfgRM.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n t=\"length (get_labels d1 n1)\"\n and s=\"n1\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n G=\"G\"\n in cfgRM.get_labels_the_Some_on_defined_positions)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(case_tac \"d1 0\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba a option baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba baa)(*strict*)\n apply(simp add: cfg_initial_configurations_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (get_labels d1 n1)\"\n and s=\"n1\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n xs=\"teB b # Esplit_signature S1b\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (xl1 @ teA (cons_l2 q ba) # ys @ [y]) = SSX\" for SSX)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n apply(clarsimp)\n apply(simp add: filterA_distrib_append filterA_liftB)\n apply (metis only_l3_nonterminals_drop only_l3_nonterminals_l2_at_front)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(case_tac A2)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"n2\"\n and \\=\"map the (get_labels d2 n2)\"\n in cfgRM_reachable_only_l3_nonterminals)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule cfgRM.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule_tac\n t=\"length (get_labels d2 n2)\"\n and s=\"n2\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule_tac\n G=\"G\"\n in cfgRM.get_labels_the_Some_on_defined_positions)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(case_tac \"d2 0\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa a option bb)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa bb)(*strict*)\n apply(simp add: cfg_initial_configurations_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (get_labels d2 n2)\"\n and s=\"n2\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(rule_tac\n xs=\"teB b # Esplit_signature S2b\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (xl2 @ teA (cons_l2 q baa) # ys @ [y]) = SSX\" for SSX)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa ys y)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q baa ys y)(*strict*)\n apply(clarsimp)\n apply(simp add: filterA_distrib_append filterA_liftB)\n apply (metis only_l3_nonterminals_drop only_l3_nonterminals_l2_at_front)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 q1a baa q2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac q11 A1 q12 q21 A2 q22)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"EValidSplitExt S1\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"EValidSplitExt S2\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"EValidSplitExt (S1a@S1b)\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"EValidSplitExt (S2a@S2b)\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"Esplit.derivation_initial G d1x\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"Esplit.derivation_initial G d2x\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(thin_tac \"get_labels d2x n2 = get_labels d2 n2\")\n apply(thin_tac \"get_labels d1x n1 = get_labels d1 n1\")\n apply(thin_tac \"d1x n1 = Some (pair e1 S1)\")\n apply(thin_tac \"d2x n2 = Some (pair e2 S2)\")\n apply(thin_tac \"cfgRM.derivation_initial G d1\")\n apply(thin_tac \"d1 n1 = SSX\" for SSX)\n apply(thin_tac \"d1 (Suc n1) = SSX\" for SSX)\n apply(thin_tac \"cfgRM.derivation_initial G d2\")\n apply(thin_tac \"d2 n2 = SSX\" for SSX)\n apply(thin_tac \"d2 (Suc n2) = SSX\" for SSX)\n apply(clarsimp)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(rule_tac\n ?A1.0=\"cons_l3 q11 A1 q12\"\n and ?A2.0=\"cons_l3 q21 A2 q22\"\n and S2a=\"S2a\"\n and S1a=\"S1a\"\n and ?S1.0=\"S1\"\n and ?S2.0=\"S2\"\n in LR1_property_part2_equal_productions)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"length xl1 + length r1\"\n and s=\"length (xl1@r1)\"\n in ssubst)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"length xl2 + length r2\"\n and s=\"length (xl2@r2)\"\n in ssubst)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp (no_asm))\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n t=\"Suc (length xl1 + length r1)\"\n and s=\"Suc (length xl2 + length r2)\"\n in ssubst)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply (metis length_append)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac S1 S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and d=\"derivation_append d2x (der2 S2 \\prod_lhs = cons_l3 q21 A2 q22, prod_rhs = r2\\ (S2a @ S2b)) n2\"\n and n=\"Suc n2\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation_initial)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.der2_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and d=\"derivation_append d1x (der2 S1 \\prod_lhs = cons_l3 q11 A1 q12, prod_rhs = r1\\ (S1a @ S1b)) n1\"\n and n=\"Suc n1\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation_initial)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule Esplit.der2_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and d=\"d2x\"\n and n=\"n2\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(rule_tac\n G=\"G\"\n and G'=\"G'\"\n and d=\"d1x\"\n and n=\"n1\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q11 A1 q12 q21 A2 q22)(*strict*)\n apply(force)\n done\n\nlemma no_pre_DT_revert_position: \"\n F2LR1inputx G G'\n \\ split_TSstructure G\n \\ EValidSplit G S\n \\ EValidSplitExt S\n \\ Esplit_signature S = w @ v @ teA A # liftB \\\n \\ is_DT_revert_position (restrict G' G S (length w)) rp\n \\ w \\ []\n \\ Q\"\n apply(subgoal_tac \"get_line rp \\ length w\")\n prefer 2\n apply(simp add: is_DT_revert_position_def valid_DT_revert_position_def restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (min (length S) (length w) - Suc 0))=SSX\" for SSX)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(case_tac rp)\n apply(rename_tac nat)(*strict*)\n apply(clarsimp)\n apply(simp add: get_line_def)\n apply(rename_tac nat1 nat2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_line_def)\n apply(subgoal_tac \"\\Sw Sv SA S\\. S = Sw @ Sv @ SA # S\\ \\ Esplit_signature Sw = w \\ length Sw = length (Esplit_signature Sw) \\ Esplit_signature Sv = v \\ length Sv = length (Esplit_signature Sv) \\ Esplit_signature [SA] = [teA A] \\ Esplit_signature S\\ = liftB \\ \")\n prefer 2\n apply(rule no_pre_DT_revert_position_hlp2)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac Sw Sv SA S\\)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"Sw@Sv\"\n in EValidSplit_Esplit_signature_length)\n apply(force)\n apply(rename_tac Sw Sv SA S\\)(*strict*)\n apply(clarsimp)\n apply(case_tac rp)\n apply(rename_tac Sw Sv SA S\\ nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac i)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(subgoal_tac \"(Sw@Sv @ SA # S\\) ! length (Sw@Sv) = (SA#S\\)!SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n prefer 2\n apply(rule nth_append_2_prime)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(simp add: EValidSplitExt_def EValidSplitExt_no_elim_before_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"length (Sw@Sv)\"\n in allE)\n apply(erule impE)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(erule impE)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(clarsimp)\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(case_tac \"ESplitItem_elem SA\")\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i a)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(simp add: get_line_def)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply (simp add: Esplit_signature_append)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature Sw) - Suc 0)) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(subgoal_tac \"(nat_seq 0 (length (Esplit_signature Sw) - Suc 0) ! i) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(subgoal_tac \"length(PSplitItem_elim (restrict G' G (Sw @ Sv @ SA # S\\) (length (Esplit_signature Sw)) ! i)) = length(ESplitItem_elim ((Sw @ Sv @ SA # S\\) ! i)) \")\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"(map SSf SSw)!SSn\" for SSf SSw SSn\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(rule nth_map)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(Sw @ Sv @ SA # S\\) ! i = Sw!i\")\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ nat1 nat2)(*strict*)\n apply(simp add: get_line_def)\n apply(rename_tac i1 i2)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(simp add: is_DT_revert_position_def)\n apply(simp add: valid_DT_revert_position_def)\n apply(clarsimp)\n apply(subgoal_tac \"length (nat_seq 0 (length (Esplit_signature Sw) - Suc 0)) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(subgoal_tac \"(Sw @ Sv @ SA # S\\) ! i1 = Sw!i1\")\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(case_tac \"PSplitItem_prods (restrict G' G (Sw @ Sv @ SA # S\\) (length (Esplit_signature Sw)) ! i1) ! i2\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"get_prod_at_DT_revert_position (restrict G' G (Sw @ Sv @ SA # S\\) (length (Esplit_signature Sw))) (gen i1 i2) = b\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(simp add: EValidSplitExt_def EValidSplitExt_no_pop_in_prods_before_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"length (Sw@Sv)\"\n in allE)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule_tac\n t=\"(Sw @ Sv @ SA # S\\) ! length (Esplit_signature (Sw @ Sv))\"\n and s=\"(SA#S\\)!X\" for X\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule nth_append_2_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(case_tac \"ESplitItem_elem SA\")\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(erule_tac\n x=\"i1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"i2\"\n in allE)\n apply(subgoal_tac \" length (ESplitItem_prods ((Sw @ Sv @ SA # S\\) ! i1)) = length (PSplitItem_prods (restrict G' G (Sw @ Sv @ SA # S\\) (length (Esplit_signature Sw)) ! i1))\")\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(subgoal_tac \"(i1 + (length Sw - i1 - Suc 0) + Suc 0) = length (Esplit_signature Sw)\")\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(subgoal_tac \"ESplitItem_prods (Sw ! i1) ! i2 = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n prefer 2\n apply(rule_tac\n k=\"length Sw - i1 - Suc 0\"\n and G=\"G\"\n and S1'=\"Sv@SA#S\\\"\n and G'=\"G'\"\n in nonabstracted_productions_are_unmodified3)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(simp (no_asm) add: restrict_def restrict_map_def restrict_len_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"(map SSf SSw)!SSn\" for SSf SSw SSn\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule nth_map)\n apply(rule_tac\n t=\"length (nat_seq 0 (length (Esplit_signature Sw) - Suc 0))\"\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"nat_seq 0 (length (Esplit_signature Sw) - Suc 0) ! i1\"\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule nat_seq_nth_compute)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprods_def)\n apply(rule conjI)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (nat_seq 0 (length (ESplitItem_prods (Sw ! i1)) - Suc 0))\"\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(rule nat_seq_length_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2)(*strict*)\n apply(clarsimp)\n apply (metis liftB_length)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(simp add: get_prod_at_DT_revert_position_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: EValidSplitExt_def EValidSplitExt_ident_line_is_always_at_the_latest_nonterminal_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"length (Esplit_signature Sw) + length (Esplit_signature Sv)\"\n in allE)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(erule impE)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(rule_tac\n t=\"(Sw @ Sv @ SA # S\\) ! length (Esplit_signature (Sw @ Sv))\"\n and s=\"(SA#S\\)!X\" for X\n in ssubst)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(rule nth_append_2_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: Esplit_signature_def option_to_list_def)\n apply(case_tac \"ESplitItem_elem SA\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b a)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(case_tac \"Suc i1 = length (Sw@Sv)\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: Pident_line_def Pident_lines_def)\n apply(clarsimp)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(erule_tac\n x=\"Suc i1\"\n in allE)\n apply(erule impE)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply (simp add: Esplit_signature_append)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(simp add: Eident_line_def Eident_lines_def Pident_line_def Pident_lines_def)\n apply(clarsimp)\n apply(simp add: restrict_def restrict_map_def restrict_len_def)\n apply(subgoal_tac \"nat_seq 0 (length (Esplit_signature Sw) - Suc 0) ! Suc i1 = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n prefer 2\n apply(rule nat_seq_nth_compute)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"(Sw @ Sv @ SA # S\\) ! Suc i1 = Sw!Suc i1\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n prefer 2\n apply(rule nth_append_1)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length (restrict_newprods G' G Sw (Suc i1)) = length (ESplitItem_prods (Sw ! Suc i1))\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(force)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(simp add: restrict_newprods_def)\n apply(subgoal_tac \"length(nat_seq 0 (length (ESplitItem_prods (Sw ! Suc i1)) - Suc 0)) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n prefer 2\n apply(rule nat_seq_length_prime)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(case_tac \"restrict_newignore Sw (nat_seq 0 (length (Esplit_signature Sw) - Suc 0) ! i1) = []\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newignore Sw (Suc i1) = []\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(liftB (ESplitItem_prods (Sw ! Suc i1))) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n prefer 2\n apply(rule liftB_length)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(case_tac \"ESplitItem_prods (Sw ! Suc i1)\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(case_tac \"restrict_newignore Sw (Suc i1) = []\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: restrict_newprodsX_def)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"length(liftB (ESplitItem_prods (Sw ! Suc i1))) = SSX\" for SSX)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n prefer 2\n apply(rule liftB_length)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(case_tac \"ESplitItem_prods (Sw ! Suc i1)\")\n apply(rename_tac Sw Sv SA S\\ i1 i2 b)(*strict*)\n apply(clarsimp)\n apply(rename_tac Sw Sv SA S\\ i1 i2 b a list)(*strict*)\n apply(clarsimp)\n done\n\nlemma F_SDPDA_TO_CFG_STD__enforces_cfg_LRk_3: \"\n F2LR1inputx G' G\n \\ split_TSstructure G'\n \\ cfgRM.derivation_initial G' d1\n \\ d1 n1 = Some (pair e1 \\cfg_conf = \\1 @ teA A1 # teB b # liftB \\3\\)\n \\ d1 (Suc n1) = Some (pair (Some \\prod_lhs = A1, prod_rhs = \\2\\) \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\3\\)\n \\ cfgRM.derivation_initial G' d2\n \\ d2 n2 = Some (pair e2 \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\1 @ teA A2 # liftB \\2\\)\n \\ d2 (Suc n2) = Some (pair (Some \\prod_lhs = A2, prod_rhs = []\\) \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\1 @ liftB \\2\\)\n \\ \\prod_lhs = A1, prod_rhs = \\2\\ \\ cfg_productions G'\n \\ \\prod_lhs = A2, prod_rhs = []\\ \\ cfg_productions G'\n \\ False\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d1\"\n and n=\"n1\"\n in cfgRM_derivation_to_Esplit_derivation)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac d2a S)(*strict*)\n apply(rename_tac d1x S1)\n apply(rename_tac d1x S1)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1)(*strict*)\n prefer 2\n apply(rule_tac\n ?d1.0=\"d2\"\n and n=\"n2\"\n in cfgRM_derivation_to_Esplit_derivation)\n apply(rename_tac d1x S1)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(force)\n apply(rename_tac d1x S1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2a S)(*strict*)\n apply(rename_tac d2x S2)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"EValidSplit G' S1\")\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(subgoal_tac \"S1 \\ SSC\" for SSC)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1x\"\n in Esplit.belongs_configurations)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule Esplit.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_configurations_def)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"EValidSplit G' S2\")\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(subgoal_tac \"S2 \\ SSC\" for SSC)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2x\"\n in Esplit.belongs_configurations)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule Esplit.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_configurations_def)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1\"\n and e=\"\\prod_lhs = A1, prod_rhs = \\2\\\"\n and w=\"\\1 @ teA A1 # teB b # liftB \\3\"\n and w'=\"\\1 @ \\2 @ teB b # liftB \\3\"\n in ESplit_cfgRM_step_can_be_simulated)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n and m=\"Suc n1\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S')(*strict*)\n apply(rename_tac S1x)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2\"\n and e=\"\\prod_lhs = A2, prod_rhs = []\\\"\n and w=\"\\1 @ \\2 @ teB b # liftB \\1 @ teA A2 # liftB \\2\"\n and w'=\"\\1 @ \\2 @ teB b # liftB \\1 @ liftB \\2\"\n in ESplit_cfgRM_step_can_be_simulated)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n and n=\"n2\"\n and m=\"Suc n2\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1x S')(*strict*)\n apply(rename_tac S2x)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S1x\"\n and b=\"b\"\n and x=\"liftB \\3\"\n and v=\"\\1 @ \\2\"\n in EValidSplit_take_prefix)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1x S2x)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S2a)(*strict*)\n apply(rename_tac S1a S1b)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n prefer 2\n apply(rule_tac\n S=\"S2x\"\n and b=\"b\"\n and x=\"liftB \\1 @ liftB \\2\"\n and v=\"\\1 @ \\2\"\n in EValidSplit_take_prefix)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S2x S1a S1b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S1c S2a)(*strict*)\n apply(rename_tac S2a S2b)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n ?S1.0=\"S1a\"\n and S1'=\"S1b\"\n and ?S2.0=\"S2a\"\n and S2'=\"S2b\"\n and ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n and ?n1.0=\"Suc n1\"\n and ?n2.0=\"Suc n2\"\n and v=\"\\1 @ \\2\"\n and b=\"b\"\n and ?x1.0=\"Esplit_signature S1b\"\n in equal_split_prefix)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"setA (Esplit_signature S1b) = {}\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply (simp add: Esplit_signature_append)\n apply(rule setA_liftB)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"setA (Esplit_signature S2b) = {}\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply (simp add: Esplit_signature_append)\n apply(simp add: setAConcat setA_liftB)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply (simp add: Esplit_signature_append)\n apply(subgoal_tac \"EValidSplitExt S1\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and d=\"d1x\"\n and n=\"n1\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"EValidSplitExt S2\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and d=\"d2x\"\n and n=\"n2\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"EValidSplitExt (S1a@S1b)\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and d=\"derivation_append d1x (der2 S1 \\prod_lhs = A1, prod_rhs = \\2\\ (S1a @ S1b)) n1\"\n and n=\"Suc n1\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation_initial)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.der2_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(subgoal_tac \"EValidSplitExt (S2a@S2b)\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and d=\"derivation_append d2x (der2 S2 \\prod_lhs = A2, prod_rhs = []\\ (S2a @ S2b)) n2\"\n and n=\"Suc n2\"\n in Esplit_derivation_enforces_EValidSplitExt)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation_initial)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: Esplit_TSstructure_def F2LR1input_def)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_append_preserves_derivation)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(rule Esplit.der2_is_derivation)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(clarsimp)\n apply(simp add: der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b)(*strict*)\n apply(case_tac A1)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d1\"\n and n=\"n1\"\n and \\=\"map the (get_labels d1 n1)\"\n in cfgRM_reachable_only_l3_nonterminals)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule cfgRM.derivation_initial_belongs)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: split_TSstructure_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(simp add: cfgRM.trans_der_def cfgRM.derivation_initial_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n t=\"length (get_labels d1 n1)\"\n and s=\"n1\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n G=\"G'\"\n in cfgRM.get_labels_the_Some_on_defined_positions)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule conjI)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(case_tac \"d1 0\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba a option baa)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba baa)(*strict*)\n apply(simp add: cfg_initial_configurations_def)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n t=\"length (get_labels d1 n1)\"\n and s=\"n1\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply (metis get_labels_length)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(rule_tac\n xs=\"teB b # Esplit_signature S1b\"\n in rev_cases)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"butlast (\\1 @ teA (cons_l2 q ba) # ys @ [y]) = SSX\" for SSX)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n prefer 2\n apply(rule butlast_direct)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q ba ys y)(*strict*)\n apply(clarsimp)\n apply(simp add: filterA_distrib_append filterA_liftB)\n apply (metis only_l3_nonterminals_drop only_l3_nonterminals_l2_at_front)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 2\n apply(rule_tac\n Sa=\"S1a\"\n and Sb=\"S1b\"\n in get_revert_prod_sound)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(subgoal_tac \"get_revert_prod (restrict G G' (S2a @ S2b) (length S2a)) = Some \\prod_lhs = cons_l3 q1 ba q2, prod_rhs = \\2\\\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(simp add: get_revert_prod_def)\n apply(case_tac \"get_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2)))\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_DT_revert_position_def)\n apply(case_tac \"\\rp. is_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))) rp\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 a)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(thin_tac \"get_prod_at_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))) (THE rp. is_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))) rp \\ (\\rp'. is_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))) rp' \\ leq rp rp')) = \\prod_lhs = cons_l3 q1 ba q2, prod_rhs = \\2\\\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(subgoal_tac \"restrict G G' S2 (length (\\1 @ \\2 @ [teB b])) = restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))\")\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(rule_tac\n w=\"\\1@\\2@[teB b]\"\n and S=\"S2\"\n in no_pre_DT_revert_position)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(rule_tac\n t=\"restrict G G' S2 (length (\\1 @ \\2 @ [teB b]))\"\n and s=\"restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(thin_tac \"cfgRM.derivation_initial G' d1\")\n apply(thin_tac \"d1 n1 = Some (pair e1 \\cfg_conf = \\1 @ teA (cons_l3 q1 ba q2) # teB b # liftB \\3\\)\")\n apply(thin_tac \"d1 (Suc n1) = Some (pair (Some \\prod_lhs = cons_l3 q1 ba q2, prod_rhs = \\2\\) \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\3\\)\")\n apply(thin_tac \"cfgRM.derivation_initial G' d2\")\n apply(thin_tac \"d2 n2 = Some (pair e2 \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\1 @ teA A2 # liftB \\2\\)\")\n apply(thin_tac \"d2 (Suc n2) = Some (pair (Some \\prod_lhs = A2, prod_rhs = []\\) \\cfg_conf = \\1 @ \\2 @ teB b # liftB \\1 @ liftB \\2\\)\")\n apply(thin_tac \"\\prod_lhs = cons_l3 q1 ba q2, prod_rhs = \\2\\ \\ cfg_productions G'\")\n apply(thin_tac \"\\prod_lhs = A2, prod_rhs = []\\ \\ cfg_productions G'\")\n apply(thin_tac \"Esplit.derivation_initial G' d1x\")\n apply(thin_tac \"d1x n1 = Some (pair e1 S1)\")\n apply(thin_tac \"Esplit_signature S1 = \\1 @ teA (cons_l3 q1 ba q2) # teB b # liftB \\3\")\n apply(thin_tac \"get_labels d1x n1 = get_labels d1 n1\")\n apply(thin_tac \"Esplit.derivation_initial G' d2x\")\n apply(thin_tac \"d2x n2 = Some (pair e2 S2)\")\n apply(thin_tac \"get_labels d2x n2 = get_labels d2 n2\")\n apply(thin_tac \"EValidSplit G' S1\")\n apply(thin_tac \"EValidSplit G' (S1a @ S1b)\")\n apply(thin_tac \"Esplit_step_relation G' S1 \\prod_lhs = cons_l3 q1 ba q2, prod_rhs = \\2\\ (S1a @ S1b)\")\n apply(thin_tac \"Esplit_signature S1a = \\1 @ \\2 @ [teB b]\")\n apply(thin_tac \"length S1a = Suc (length \\1 + length \\2)\")\n apply(thin_tac \"Esplit_signature S1b = liftB \\3\")\n apply(thin_tac \"restrict G G' (S1a @ S1b) (Suc (length \\1 + length \\2)) = restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))\")\n apply(thin_tac \"setA (liftB \\3) = {}\")\n apply(thin_tac \"setA (liftB \\1 @ liftB \\2) = {}\")\n apply(thin_tac \"EValidSplitExt S1\")\n apply(thin_tac \"EValidSplitExt (S1a @ S1b)\")\n apply(thin_tac \"is_DT_revert_position (restrict G G' (S2a @ S2b) (Suc (length \\1 + length \\2))) rp\")\n apply(rule_tac\n t=\"length (\\1 @ \\2 @ [teB b])\"\n and s=\"Suc(length (\\1 @ \\2))\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(rule_tac\n t=\"Suc (length \\1 + length \\2)\"\n and s=\"Suc(length (\\1 @ \\2))\"\n in ssubst)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(rule_tac restrict_equal_before_step_nonterminal)\n apply(rename_tac d1x S1 d2x S2 S1a S1b S2a S2b q1 ba q2 rp)(*strict*)\n apply(force)+\n done\n\ntheorem F_SDPDA_TO_CFG_STD__enforces_cfg_LRk: \"\n valid_simple_dpda G\n \\ valid_cfg G'\n \\ cfg_sub G' (F_SDPDA_TO_CFG_STD G)\n \\ cfg_nonterminals G' = cfgLM_accessible_nonterminals G' \\ cfgSTD_Nonblockingness_nonterminals G'\n \\ \\ duplicate_marking G\n \\ cfg_LRk G' (Suc 0)\"\n apply(subgoal_tac \"valid_cfg (F_SDPDA_TO_CFG_STD G)\")\n prefer 2\n apply (metis F_SDPDA_TO_CFG_STD__makes_CFG)\n apply(subgoal_tac \"F2LR1inputx G' G\")\n prefer 2\n apply(simp add: F2LR1inputx_def)\n apply(rule duplicate_marking_to_duplicate_markingH)\n apply(simp add: valid_simple_dpda_def valid_dpda_def valid_pda_def)\n apply(force)\n apply(subgoal_tac \"split_TSstructure G'\")\n prefer 2\n apply(rule F2LR1input_implies_split_TSstructure)\n apply(simp add: F2LR1input_def)\n apply(force)\n apply(simp add: cfg_LRk_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 y1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v)(*strict*)\n apply(case_tac \"y1\")\n apply(rename_tac d1 n1 \\1 A1 y1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v)(*strict*)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n in F_SDPDA_TO_CFG_STD__enforces_cfg_LRk_1)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2)(*strict*)\n apply(force)+\n apply(rename_tac d1 n1 \\1 A1 y1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a list)(*strict*)\n apply(rename_tac a w1)\n apply(rename_tac d1 n1 \\1 A1 y1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1)(*strict*)\n apply(case_tac v)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1)(*strict*)\n apply(case_tac y2)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1)(*strict*)\n apply(simp add: kPrefix_def)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1 aa list)(*strict*)\n apply(rename_tac b w2)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1 b w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 a w1 b w2)(*strict*)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and d=\"d1\"\n and n=\"n1\"\n and m=\"Suc n1\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l r)(*strict*)\n apply(subgoal_tac \"r=teB b # liftB w1\")\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l r)(*strict*)\n prefer 2\n apply (metis Cons_eq_appendI setA_liftB liftB.simps(2) append_Nil terminalTailEquals1)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and d=\"d2\"\n and n=\"n2\"\n and m=\"Suc n2\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l la r)(*strict*)\n apply(subgoal_tac \"r=teB b # liftB w2\")\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l la r)(*strict*)\n prefer 2\n apply (metis Cons_eq_appendI setA_liftB liftB.simps(2) append_Nil terminalTailEquals1)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 e2 e2' \\2 w1 b w2 l la r)(*strict*)\n apply(clarsimp)\n apply(thin_tac \"setA (liftB w1) = {}\")\n apply(thin_tac \"setA (liftB w2) = {}\")\n apply(rename_tac \\1 \\2)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and G'=\"G\"\n and ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n in LR1_property_part2)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 e2 e2' w1 b w2 l la)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 v a w1 aa list)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 a w1 aa list)(*strict*)\n apply(simp add: kPrefix_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and d=\"d1\"\n and n=\"n1\"\n and m=\"Suc n1\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l r)(*strict*)\n apply(subgoal_tac \"r=teB aa # liftB w1\")\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l r)(*strict*)\n prefer 2\n apply (metis Cons_eq_appendI setA_liftB liftB.simps(2) append_Nil terminalTailEquals1)\n apply(rename_tac d1 n1 \\1 A1 e1 e1' \\1 d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l r)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n apply(subgoal_tac \"X\" for X)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n prefer 2\n apply(rule_tac\n G=\"G'\"\n and d=\"d2\"\n and n=\"n2\"\n and m=\"Suc n2\"\n in cfgRM.step_detail_before_some_position)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n apply(rule cfgRM.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l)(*strict*)\n apply(clarsimp)\n apply(simp add: cfgRM_step_relation_def)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l la r)(*strict*)\n apply(subgoal_tac \"r=liftB y2\")\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l la r)(*strict*)\n prefer 2\n apply (metis Cons_eq_appendI setA_liftB liftB.simps(2) append_Nil terminalTailEquals1)\n apply(rename_tac d1 n1 e1 e1' d2 n2 \\2 A2 y2 e2 e2' \\2 w1 aa list l la r)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 e1' d2 n2 y2 e2 e2' w1 aa list l la)(*strict*)\n apply(thin_tac \"setA (liftB y2) = {}\")\n apply(thin_tac \"setA (liftB w1) = {}\")\n apply(case_tac e1')\n apply(rename_tac d1 n1 e1 e1' d2 n2 y2 e2 e2' w1 aa list l la prod_lhsa prod_rhsa)(*strict*)\n apply(case_tac e2')\n apply(rename_tac d1 n1 e1 e1' d2 n2 y2 e2 e2' w1 aa list l la prod_lhsa prod_rhsa prod_lhsaa prod_rhsaa)(*strict*)\n apply(rename_tac b \\ l1 cons_l2 A1 r1 A2 r2)\n apply(rename_tac d1 n1 e1 e1' d2 n2 y2 e2 e2' w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n apply(rule_tac\n xs=\"r2\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n prefer 2\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2 ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y)(*strict*)\n apply(subgoal_tac \"LR1ProdForm G'\")\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y)(*strict*)\n prefer 2\n apply(simp add: split_TSstructure_def F2LR1inputx_def)\n apply(rule sub_of_F_SDPDA_TO_CFG_STD__implies_LR1ProdForm)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y)(*strict*)\n apply(simp add: LR1ProdForm_def)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y)(*strict*)\n apply(erule_tac\n x=\"\\prod_lhs = A2, prod_rhs = ys @ [y]\\\"\n in ballE)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y)(*strict*)\n prefer 2\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y ba q1 q2 q3 q4 A1a)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y ba q1 q2 q3 q4 A1a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 ba q1 q2 A1a)(*strict*)\n apply(rule_tac\n xs=\"\\\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 ba q1 q2 A1a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 ba q1 q2 A1a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b l1 l2a A1 r1 ba q1 q2 A1a ys y)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y ba q1 q2 q3 q4 A1a)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y ba q1 q2 q3 q4 A1a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 ba q1 q2 q3 A1a)(*strict*)\n apply(rule_tac\n xs=\"\\\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 ba q1 q2 q3 A1a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 ba q1 q2 q3 A1a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b l1 cons_l2 A1 r1 ba q1 q2 q3 A1a ys y)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y ba q1 q2 q3 q4 A1a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 A1a A2a)(*strict*)\n apply(rule_tac\n xs=\"\\\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 A1a A2a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b l1 l2a A1 r1 q1 q2 A1a A2a ys y)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(erule disjE)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 A2 ys y q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 q3 A1a A2a)(*strict*)\n apply(rule_tac\n xs=\"\\\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 q3 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 l2a A1 r1 q1 q2 q3 A1a A2a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b l1 l2a A1 r1 q1 q2 q3 A1a A2a ys y)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 ys y q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(rule_tac\n xs=\"\\\"\n in rev_cases)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 q1 q2 q3 q4 A1a A2a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 q1 q2 q3 q4 A1a A2a ys y)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b l1 cons_l2 A1 r1 q1 q2 q3 q4 A1a A2a ys y)(*strict*)\n apply(simp add: liftB_commutes_over_concat)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 cons_l2 A1 r1 A2 r2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d1 n1 e1 d2 n2 y2 e2 w1 b \\ l1 A1 r1 A2)(*strict*)\n apply(rename_tac \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(rule_tac\n ?d1.0=\"d1\"\n and ?d2.0=\"d2\"\n in F_SDPDA_TO_CFG_STD__enforces_cfg_LRk_3)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n apply(rename_tac d1 n1 e1 d2 n2 \\2 e2 \\3 b \\1 \\1 A1 \\2 A2)(*strict*)\n apply(force)\n done\n\nhide_fact first_empty_rhs_with_left_degen_front\nhide_fact F_SDPDA_TO_CFG_STD__enforces_cfg_LRk_3\nhide_fact get_DT_revert_position_eq\nhide_fact get_DT_revert_position_eq2\nhide_fact get_revert_prod_sound\nhide_fact get_revert_prod_sound_rhs_empty\nhide_fact get_revert_prod_sound_rhs_push\nhide_fact get_revert_prod_sound_rhs_read\nhide_fact leq_elim_elim\nhide_fact leq_elim_gen\nhide_fact leq_gen_elim\nhide_fact leq_gen_gen\nhide_fact leq_leq_eq\nhide_fact LR1_property_part2\nhide_fact LR1_property_part2_equal_productions\nhide_fact LR1_property_part2_equal_productions2\nhide_fact no_pre_DT_revert_position\nhide_fact THE_get_DT_revert_position_eq\n (* important F_SDPDA_TO_CFG_STD__enforces_cfg_LRk *)\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_06_12/LR1_Property_Satisfaction__compute_latest_production.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4148988457967688, "lm_q1q2_score": 0.2597781984574746}} {"text": "(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* WP-specific Eisbach methods *)\n\ntheory Eisbach_WP\nimports\n \"../../Eisbach_Methods\"\n \"../NonDetMonadVCG\"\n \"../../Conjuncts\"\n \"../../Rule_By_Method\"\n \"WPI\"\nbegin\n\n\ntext \\\n Methods for manipulating the post conditions of hoare triples as if they\n were proper subgoals.\n\n post_asm can be used with the @ attribute to modify existing proofs. Useful\n for proving large postconditions in one proof and then subsequently decomposing it.\n\n\\\ncontext begin\n\ndefinition \"packed_valid P f si r s \\ P si \\ (r, s) \\ fst (f si)\"\n\nlemma packed_validE:\"(\\si r s. packed_valid P f si r s \\ Q r s) \\ \\P\\ f \\Q\\\"\n by (clarsimp simp: valid_def packed_valid_def)\n\nlemma packed_validI: \"\\P\\ f \\Q\\ \\ \\si r s. packed_valid P f si r s \\ Q r s\"\n apply (clarsimp simp: valid_def packed_valid_def)\n by auto\n\ndefinition \"packed_validR P f si r s \\ P si \\ (Inr r, s) \\ fst (f si)\"\n\n\nlemma packed_validRE:\"(\\si r s. packed_validR P f si r s \\ Q r s) \\ \\P\\ f \\Q\\,-\"\n apply (clarsimp simp: validE_R_def validE_def valid_def packed_validR_def)\n by (metis sum.case sumE)\n\nlemma packed_validRI: \"\\P\\ f \\Q\\,- \\ \\si r s. packed_validR P f si r s \\ Q r s\"\n apply (clarsimp simp: valid_def validE_R_def validE_def packed_validR_def)\n by fastforce\n\nlemma trivial_imp: \"\\r s. Q r s \\ Q r s\" by simp\n\nlemma uncurry2: \"\\r s. Q r s \\ Q' r s \\ Q'' r s \\ \\r s. Q r s \\ Q' r s \\ Q'' r s\"\n by simp\n\nnamed_theorems hoare_post_imps\n\nlemmas [hoare_post_imps] = hoare_post_imp_R hoare_post_imp[rotated]\n\nmethod post_asm_raw methods m =\n (drule hoare_post_imps,\n atomize (full),\n focus_concl\n \\intro impI allI,\n m,\n atomize (full),\n ((rule uncurry2)+)?\\,\n rule trivial_imp)\n\nmethod post_asm methods m =\n (post_asm_raw \\(simp only: bipred_conj_def pred_conj_def)?,(elim conjE)?,m\\)\n\n\nnamed_theorems packed_validEs\n\nlemmas [packed_validEs] = packed_validE packed_validRE\n\nnamed_theorems packed_validIs\n\nlemmas [packed_validIs] = packed_validI packed_validRI\n\nmethod post_raw methods m =\n (focus_concl\n \\rule packed_validEs,\n focus_concl \\m,fold_subgoals\\,\n atomize (full),\n rule packed_validI\\)\n\nmethod post_strong methods m_distinct m_all =\n (post_raw\n \\(simp only: pred_conj_def bipred_conj_def)?,\n (intro impI conjI allI)?,\n distinct_subgoals_strong \\m_distinct\\,\n all \\m_all\\,\n fold_subgoals\\)\n\nmethod post methods m = post_strong \\(assumption | erule mp)+\\ \\m\\\n\nend\n\n\ntext \\\n Method (meant to be used with @ as an attribute) used for producing multiple facts out of\n a single hoare triple with a conjunction in its post condition.\n\\\n\ncontext begin\n\nprivate lemma hoare_decompose:\n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\ \\ \\P\\ f \\Q\\ \\ \\P\\ f \\Q'\\\"\n by (fastforce simp add: valid_def pred_conj_def)\n\nprivate lemma hoare_decomposeE_R:\n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\,- \\ \\P\\ f \\Q\\,- \\ \\P\\ f \\Q'\\,-\"\n by (fastforce simp add: validE_R_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemma hoare_decomposeE_E:\n \"\\P\\ f -,\\\\r s. Q r s \\ Q' r s\\ \\ \\P\\ f -,\\Q\\ \\ \\P\\ f -,\\Q'\\\"\n by (fastforce simp add: validE_E_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemma hoare_decomposeE:\n \"\\P\\ f \\\\r s. E r s \\ E' r s\\,\\\\r s. R r s \\ R' r s\\ \\ \\P\\ f \\E\\,- \\ \\P\\ f \\E'\\,- \\ \\P\\ f -,\\R\\ \\ \\P\\ f -,\\R'\\\"\n by (fastforce simp add: validE_R_def validE_E_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemmas hoare_decomposes' = hoare_decompose hoare_decomposeE_R hoare_decomposeE_E hoare_decomposeE\n\nprivate method add_pred_conj = (subst pred_conj_def[symmetric])\nprivate method add_bipred_conj = (subst bipred_conj_def[symmetric])\n\nprivate lemmas hoare_decomposes[THEN conjE] =\n hoare_decomposes'\n hoare_decomposes'[# \\add_pred_conj\\]\n hoare_decomposes'[# \\add_bipred_conj\\]\n hoare_decomposeE[# \\add_pred_conj, add_pred_conj\\]\n hoare_decomposeE[# \\add_bipred_conj, add_pred_conj\\]\n hoare_decomposeE[# \\add_pred_conj, add_bipred_conj\\]\n hoare_decomposeE[# \\add_bipred_conj, add_bipred_conj\\]\n\nmethod hoare_decompose = (elim hoare_decomposes)\n\nend\n\n\nnotepad begin\n fix A :: \"'a \\ bool\" and B C D f\n assume A: \"\\s. A s = True\" and\n B: \"\\s :: 'a. B s = True\" and\n C: \"\\s :: 'a. C s = True\" and\n D: \"\\s :: 'a. D s = True\" and\n f: \"f = (return () :: ('a,unit) nondet_monad)\"\n\n have f_valid[@ \\hoare_decompose\\,conjuncts]: \"\\A\\ f \\\\_. B and C and D\\\"\n apply (simp add: f)\n apply wp\n by (simp add: B C D)\n\n note f_valid' = conjuncts\n\n have f_d: \"\\A\\ f \\\\_. D\\\" by (rule f_valid')\n\n have f_valid_interm: \"\\A\\ f \\\\_. B and C and (\\s. D s \\ B s)\\\"\n apply (post_strong \\simp\\ \\-\\)\n apply (wp f_valid')\n by simp\n\n (* All rotations are attempted when strengthening *)\n\n have f_valid_interm: \"\\A\\ f \\\\_. (\\s. D s \\ B s) and B and C \\\"\n apply (post_strong \\simp\\ \\-\\, wp f_valid')\n by simp\n\nend\n\n\n\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Monad_WP/wp/Eisbach_WP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2596656053268259}} {"text": "(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* WP-specific Eisbach methods *)\n\ntheory Eisbach_WP\nimports\n \"../../Eisbach_Methods\"\n \"../NonDetMonadVCG\"\n \"../../Conjuncts\"\n \"../../Rule_By_Method\"\n \"WPI\"\nbegin\n\n\ntext \\ \n Methods for manipulating the post conditions of hoare triples as if they\n were proper subgoals.\n\n post_asm can be used with the @ attribute to modify existing proofs. Useful\n for proving large postconditions in one proof and then subsequently decomposing it.\n\n\\\ncontext begin\n\ndefinition \"packed_valid P f si r s \\ P si \\ (r, s) \\ fst (f si)\"\n\nlemma packed_validE:\"(\\si r s. packed_valid P f si r s \\ Q r s) \\ \\P\\ f \\Q\\\"\n by (clarsimp simp: valid_def packed_valid_def)\n\nlemma packed_validI: \"\\P\\ f \\Q\\ \\ \\si r s. packed_valid P f si r s \\ Q r s\"\n apply (clarsimp simp: valid_def packed_valid_def)\n by auto\n\ndefinition \"packed_validR P f si r s \\ P si \\ (Inr r, s) \\ fst (f si)\"\n\n\nlemma packed_validRE:\"(\\si r s. packed_validR P f si r s \\ Q r s) \\ \\P\\ f \\Q\\,-\"\n apply (clarsimp simp: validE_R_def validE_def valid_def packed_validR_def)\n by (metis sum.case sumE)\n\nlemma packed_validRI: \"\\P\\ f \\Q\\,- \\ \\si r s. packed_validR P f si r s \\ Q r s\"\n apply (clarsimp simp: valid_def validE_R_def validE_def packed_validR_def)\n by fastforce\n\nlemma trivial_imp: \"\\r s. Q r s \\ Q r s\" by simp\n\nlemma uncurry2: \"\\r s. Q r s \\ Q' r s \\ Q'' r s \\ \\r s. Q r s \\ Q' r s \\ Q'' r s\"\n by simp\n\nnamed_theorems hoare_post_imps\n\nlemmas [hoare_post_imps] = hoare_post_imp_R hoare_post_imp[rotated]\n\nmethod post_asm_raw methods m = \n (drule hoare_post_imps,\n atomize (full),\n focus_concl \n \\intro impI allI, \n m, \n atomize (full),\n ((rule uncurry2)+)?\\,\n rule trivial_imp)\n\nmethod post_asm methods m = \n (post_asm_raw \\(simp only: bipred_conj_def pred_conj_def)?,(elim conjE)?,m\\)\n\n\nnamed_theorems packed_validEs\n\nlemmas [packed_validEs] = packed_validE packed_validRE\n\nnamed_theorems packed_validIs\n\nlemmas [packed_validIs] = packed_validI packed_validRI\n\nmethod post_raw methods m = \n (focus_concl \n \\rule packed_validEs,\n focus_concl \\m,fold_subgoals\\, \n atomize (full),\n rule packed_validI\\)\n\nmethod post_strong methods m_distinct m_all = \n (post_raw\n \\(simp only: pred_conj_def bipred_conj_def)?,\n (intro impI conjI allI)?,\n distinct_subgoals_strong \\m_distinct\\,\n all \\m_all\\,\n fold_subgoals\\)\n\nmethod post methods m = post_strong \\(assumption | erule mp)+\\ \\m\\\n\nend\n\n\ntext \\\n Method (meant to be used with @ as an attribute) used for producing multiple facts out of \n a single hoare triple with a conjunction in its post condition.\n\\\n\ncontext begin\n\nprivate lemma hoare_decompose: \n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\ \\ \\P\\ f \\Q\\ \\ \\P\\ f \\Q'\\\"\n by (fastforce simp add: valid_def pred_conj_def)\n\nprivate lemma hoare_decomposeE_R: \n \"\\P\\ f \\\\r s. Q r s \\ Q' r s\\,- \\ \\P\\ f \\Q\\,- \\ \\P\\ f \\Q'\\,-\"\n by (fastforce simp add: validE_R_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemma hoare_decomposeE_E: \n \"\\P\\ f -,\\\\r s. Q r s \\ Q' r s\\ \\ \\P\\ f -,\\Q\\ \\ \\P\\ f -,\\Q'\\\"\n by (fastforce simp add: validE_E_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemma hoare_decomposeE:\n \"\\P\\ f \\\\r s. E r s \\ E' r s\\,\\\\r s. R r s \\ R' r s\\ \\ \\P\\ f \\E\\,- \\ \\P\\ f \\E'\\,- \\ \\P\\ f -,\\R\\ \\ \\P\\ f -,\\R'\\\"\n by (fastforce simp add: validE_R_def validE_E_def validE_def valid_def pred_conj_def split: prod.splits sum.splits)\n\nprivate lemmas hoare_decomposes' = hoare_decompose hoare_decomposeE_R hoare_decomposeE_E hoare_decomposeE\n\nprivate method add_pred_conj = (subst pred_conj_def[symmetric])\nprivate method add_bipred_conj = (subst bipred_conj_def[symmetric])\n\nprivate lemmas hoare_decomposes[THEN conjE] = \n hoare_decomposes' \n hoare_decomposes'[# \\add_pred_conj\\]\n hoare_decomposes'[# \\add_bipred_conj\\]\n hoare_decomposeE[# \\add_pred_conj, add_pred_conj\\]\n hoare_decomposeE[# \\add_bipred_conj, add_pred_conj\\]\n hoare_decomposeE[# \\add_pred_conj, add_bipred_conj\\]\n hoare_decomposeE[# \\add_bipred_conj, add_bipred_conj\\]\n\nmethod hoare_decompose = (elim hoare_decomposes)\n\nend\n\n\nnotepad begin\n fix A :: \"'a \\ bool\" and B C D f\n assume A: \"\\s. A s = True\" and\n B: \"\\s :: 'a. B s = True\" and\n C: \"\\s :: 'a. C s = True\" and\n D: \"\\s :: 'a. D s = True\" and\n f: \"f = (return () :: ('a,unit) nondet_monad)\"\n\n have f_valid[@ \\hoare_decompose\\,conjuncts]: \"\\A\\ f \\\\_. B and C and D\\\"\n apply (simp add: f)\n apply wp\n by (simp add: B C D)\n\n note f_valid' = conjuncts\n\n have f_d: \"\\A\\ f \\\\_. D\\\" by (rule f_valid')\n\n have f_valid_interm: \"\\A\\ f \\\\_. B and C and (\\s. D s \\ B s)\\\"\n apply (post_strong \\simp\\ \\-\\)\n apply (wp f_valid')\n by simp\n \n (* All rotations are attempted when strengthening *)\n\n have f_valid_interm: \"\\A\\ f \\\\_. (\\s. D s \\ B s) and B and C \\\"\n apply (post_strong \\simp\\ \\-\\, wp f_valid')\n by simp\n\nend\n\n\n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/Monad_WP/wp/Eisbach_WP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2596656053268259}} {"text": "section\\Inductive Study of Confidentiality against the General Attacker\\\n\ntheory ConfidentialityGA imports NS_Public_Bad_GA begin\n\ntext\\New subsidiary lemmas to reason on a generic agent initial state\\\n\nlemma parts_initState: \"parts(initState C) = initState C\"\nby (cases C, simp)\n\nlemma analz_initState: \"analz(initState C) = initState C\"\nby (cases C, force dest: analz_into_parts)\n\n\ntext\\Generalising over all initial secrets the existing treatment, which is limited to private encryption keys\\\n\ndefinition staticSecret :: \"agent \\ msg set\" where\n [simp]: \"staticSecret A == {Key (priEK A), Key (priSK A), Key (shrK A)}\"\n\n\ntext\\More subsidiary lemmas combining initial secrets and knowledge of generic agent\\\n\nlemma staticSecret_in_initState [simp]:\n\"staticSecret A \\ initState A\"\nby (cases A, simp)\nthm parts_insert\n\nlemma staticSecretA_notin_initStateB:\n\"m \\ staticSecret A \\ m \\ initState B = (A=B)\"\nby (cases B, auto)\n\nlemma staticSecretA_notin_parts_initStateB:\n\"m \\ staticSecret A \\ m \\ parts(initState B) = (A=B)\"\nby (cases B, auto)\n\nlemma staticSecretA_notin_analz_initStateB:\n\"m \\ staticSecret A \\ m \\ analz(initState B) = (A=B)\"\nby (cases B, force dest: analz_into_parts)\n\nlemma staticSecret_synth_eq: \n\"m \\ staticSecret A \\ (m \\ synth H) = (m \\ H)\"\napply force\ndone\n\ndeclare staticSecret_def [simp del]\n\nlemma nonce_notin_analz_initState:\n \"Nonce N \\ analz(initState A)\" \nby(cases A, auto dest: analz_into_parts)\n\n\nsubsection\\Protocol independent study\\\n\nlemma staticSecret_parts_agent:\n \"\\m \\ parts (knows C evs); m \\ staticSecret A\\ \\ \n A=C \\ \n (\\D E X. Says D E X \\ set evs \\ m \\ parts{X}) \\\n (\\Y. Notes C Y \\ set evs \\ m \\ parts{Y})\"\napply (erule rev_mp)\napply (induct_tac evs)\ntxt\\@{subgoals [display,indent =1]}\\\napply (simp add: staticSecretA_notin_parts_initStateB)\napply (induct_tac a)\n(*Says*) \napply (rule impI) \napply simp\napply (drule parts_insert [THEN equalityD1, THEN subsetD])\napply blast\n(*Gets*)\napply simp\n(*Notes*)\napply simp\napply clarify \ntxt\\@{subgoals [display,indent =1]}\\\napply (drule parts_insert [THEN equalityD1, THEN subsetD])\napply blast\ndone\n\nlemma staticSecret_analz_agent:\n \"\\m \\ analz (knows C evs); m \\ staticSecret A\\ \\ \n A=C \\ \n (\\D E X. Says D E X \\ set evs \\ m \\ parts{X}) \\\n (\\Y. Notes C Y \\ set evs \\ m \\ parts{Y})\"\nby (drule analz_into_parts [THEN staticSecret_parts_agent])\n\nlemma secret_parts_agent:\n \"m \\ parts (knows C evs) \\ m \\ initState C \\\n (\\A B X. Says A B X \\ set evs \\ m \\ parts{X}) \\\n (\\Y. Notes C Y \\ set evs \\ m \\ parts{Y})\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp add: parts_initState)\napply (induct_tac \"a\")\n(*Says*)\napply (rule impI)\napply simp\napply (drule parts_insert [THEN equalityD1, THEN subsetD])\napply blast\n(*Gets*)\napply simp\n(*Notes*)\napply simp \napply clarify\napply (drule parts_insert [THEN equalityD1, THEN subsetD])\napply blast\ndone\n\nsubsection\\Protocol dependent study\\\n\n(*NS_no_Notes moved up in NS_Public_Bad_GA.thy so that it's visible to a sibling theory of this one's\n\nAs with DolevYao, studying a guarantee similar to\nNS_no_Says_staticSecret makes the specialisation proof strategy collapse, because it elicits the same assumptions of the theorem that should be specified.\n*)\n\nlemma NS_staticSecret_parts_agent_weak:\n \"\\m \\ parts (knows C evs); m \\ staticSecret A; \n evs \\ ns_public\\ \\\n A=C \\ (\\D E X. Says D E X \\ set evs \\ m \\ parts{X})\"\napply (blast dest: NS_no_Notes staticSecret_parts_agent)\ndone\n\ntext\\Can't prove the homologous theorem of NS\\_Says\\_Spy\\_staticSecret, hence the specialisation proof strategy cannot be applied\\\n\n(*Simple though illustrative corollary*)\n(*note use of Says_imp_knows, an enforcement of the threat model*)\nlemma NS_staticSecret_parts_agent_parts:\n\"\\m \\ parts (knows C evs); m \\ staticSecret A; A\\C; evs \\ ns_public\\ \\\n m \\ parts(knows D evs)\"\napply (blast dest: NS_staticSecret_parts_agent_weak Says_imp_knows [THEN parts.Inj] parts_trans)\n(*Alternative proof\napply (blast dest: staticSecret_parts_agent NS_no_Notes Says_imp_knows [THEN parts.Inj] parts_trans)*)\ndone\n\ntext\\\nThe previous theorems show that in general any agent could send anybody's initial secret, namely the threat model does not impose anything against it. However, the actual protocol specification will, where agents either follow the protocol or build messages out of their traffic analysis - this is actually the same in DY\n\nTherefore, we are only left with the direct proof strategy.\n\\\n\nlemma NS_staticSecret_parts_agent:\n \"\\m \\ parts (knows C evs); m \\ staticSecret A; \n C\\A; evs \\ ns_public\\\n \\ \\ B X. Says A B X \\ set evs \\ m \\ parts {X}\"\napply (erule rev_mp, erule ns_public.induct)\n(*Nil*)\napply (simp add: staticSecretA_notin_parts_initStateB)\n(*Fake*)\napply simp\napply clarify\napply (drule parts_insert [THEN equalityD1, THEN subsetD])(*shot1*)\napply (case_tac \"Aa=A\") \napply clarify\ntxt\\@{subgoals [display,indent=1,goals_limit=2]}\\\napply blast\n(*Aa\\A*)\napply simp\napply clarify (*applies induction hypothesis!*)(*shot2*)\ntxt\\@{subgoals [display,indent=1,goals_limit=1]}\\\napply (drule Fake_parts_sing [THEN subsetD], simp) (*shot3*)\napply (simp add: staticSecret_synth_eq) \ntxt\\@{subgoals [display,indent=1,goals_limit=1]}\\\napply (blast dest: NS_staticSecret_parts_agent_parts)\n(*rest!*)\napply (force simp add: staticSecret_def)+\ndone\n\n\nlemma NS_agent_see_staticSecret:\n \"\\m \\ staticSecret A; C\\A; evs \\ ns_public\\\n \\ m \\ parts (knows C evs) = (\\ B X. Says A B X \\ set evs \\ m \\ parts {X})\"\napply (force dest: NS_staticSecret_parts_agent Says_imp_knows [THEN parts.Inj] intro: parts_trans)\ndone\n\n\ndeclare analz.Decrypt [rule del]\n\nlemma analz_insert_analz: \"\n\\ c \\ parts{Z}; \\K. Key K \\ parts{Z}; c \\ analz(insert Z H)\\ \\ c \\ analz H\"\napply (erule rev_mp, erule rev_mp)\napply (erule analz.induct)\nprefer 4\napply clarify\ntxt\\@{subgoals [display,indent=1,goals_limit=1]}\\\napply (blast dest: parts.Body analz.Decrypt)\napply blast+\ndone\n\nlemma Agent_not_see_NA:\n \"\\ Key (priEK B) \\ analz(knows C evs); \n Key (priEK A) \\ analz(knows C evs);\n \\S R Y. Says S R Y \\ set evs \\ \n Y = Crypt (pubEK B) \\Nonce NA, Agent A\\ \\\n Y = Crypt (pubEK A) \\Nonce NA, Nonce NB\\ \\\n Nonce NA \\ parts{Y} \\ (\\K. Key K \\ parts{Y});\n C\\A; C\\B; evs \\ ns_public\\ \n \\ Nonce NA \\ analz (knows C evs)\"\napply (erule rev_mp, erule rev_mp, erule rev_mp, erule ns_public.induct) \napply (simp add: nonce_notin_analz_initState)\napply clarify\napply simp\n(*fixing confidentiality of both private keys*)\napply (drule subset_insertI [THEN analz_mono, THEN contra_subsetD])+\ntxt\\@{subgoals [display,indent=1,goals_limit=1]}\\\napply (subgoal_tac \"\n \\S R Y.\n (S = Aa \\ R = Ba \\ Y = X \\\n X = Crypt (pubK B) \\Nonce NA, Agent A\\ \\\n X = Crypt (pubK A) \\Nonce NA, Nonce NB\\ \\\n Nonce NA \\ parts {X} \\ (\\K. Key K \\ parts {X}))\")\nprefer 2 \napply blast \napply simp\ntxt\\@{subgoals [display,indent=1,goals_limit=1]}\\\napply (force dest!: analz_insert_analz)\n(*Alternative proof\napply (erule disjE) apply simp \napply (erule disjE) apply simp \napply (blast dest: analz_insert_analz)\n*)\napply auto\ndone\n\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Inductive_Confidentiality/GeneralAttacker/ConfidentialityGA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2596656053268259}} {"text": "theory \"BAN_concrete_Andrew_Secure_RPC_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: BAN concrete Andrew Secure RPC *)\n\n(* text: \n Modeled after the model in the SPORE library.\n\n Notable differences:\n\n 1. 'succ(x)' is invertible. Hence, we just model it as a tuple ('succ',x) of\n a global constant 'succ' and the variable x. This means that we only\n exploit the tagging properties of 'succ', but do not assume any\n information hiding.\n\n 2. Instead of implicit typing, we are using explicit global constants to\n discern messages.\n *)\n\nrole A\nwhere \"A =\n [ Send ''1'' <| sAV ''A'', sN ''Na'' |>\n , Recv ''2'' <| sMV ''B'',\n PEnc <| sC ''2'', sN ''Na'', sMV ''Kab'' |>\n ( sKbd (AVar ''A'') (MVar ''B'') )\n |>\n , Send ''3'' ( PEnc <| sC ''3'', sN ''Na'' |> ( sMV ''Kab'' ) )\n , Recv ''4'' ( sMV ''Nb'' )\n ]\"\n\nrole B\nwhere \"B =\n [ Recv ''1'' <| sMV ''A'', sMV ''Na'' |>\n , Send ''2'' <| sAV ''B'',\n PEnc <| sC ''2'', sMV ''Na'', sN ''Kab'' |>\n ( sKbd (MVar ''A'') (AVar ''B'') )\n |>\n , Recv ''3'' ( PEnc <| sC ''3'', sMV ''Na'' |> ( sN ''Kab'' ) )\n , Send ''4'' ( sN ''Nb'' )\n ]\"\n\nprotocol Andrew\nwhere \"Andrew = { A, B }\"\n\nlocale restricted_Andrew_state = Andrew_state\n\ntype_invariant Andrew_msc_typing for Andrew\nwhere \"Andrew_msc_typing = mk_typing\n [ ((B, ''A''), (KnownT B_1))\n , ((A, ''B''), (KnownT A_2))\n , ((A, ''Kab''), (SumT (KnownT A_2) (NonceT B ''Kab'')))\n , ((B, ''Na''), (KnownT B_1))\n , ((A, ''Nb''), (KnownT A_4))\n ]\"\n\nsublocale Andrew_state < Andrew_msc_typing_state\nproof -\n have \"(t,r,s) : approx Andrew_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF Andrew_msc_typing.monoTyp, completeness_cases_rule])\n case (A_2_B t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_2_Kab t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid0, s(MV ''Kab'' tid0) |}\n ( Kbd ( s(AV ''A'' tid0) ) ( s(MV ''B'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_1_A t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_A\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_1_Na t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_Na\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n qed\n thus \"Andrew_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Andrew_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection: Security Properties *)\n\nlemma (in restricted_Andrew_state) B_sec_Kab:\n assumes facts:\n \"roleMap r tid0 = Some B\"\n \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n \"LN ''Kab'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''Kab'' tid0 \")\n case B_2_Kab note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Andrew_state) A_sec_Kab:\n assumes facts:\n \"roleMap r tid0 = Some A\"\n \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid0)) ~: reveals t\"\n \"( tid0, A_2 ) : steps t\"\n \"s(MV ''Kab'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid0, s(MV ''Kab'' tid0) |}\n ( Kbd ( s(AV ''A'' tid0) ) ( s(MV ''B'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_2_enc tid1) note_unified facts = this facts\n hence \"Kbd ( s(AV ''B'' tid1) )\n ( s(MV ''A'' tid1) ) = Kbd ( s(AV ''A'' tid0) ) ( s(MV ''B'' tid0) )\"\n by simp note facts = this facts\n thus ?thesis proof(cases rule: Kbd_cases)\n case noswap note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n next\n case swapped note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n qed (fastforce+)?\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \nNo agreement on the agent identities is achieved because they may be swapped\ndue to the bidirectional shared key. As Lowe noted this gives rise to an attack\non entity authentication.\n *)\n\nlemma (in restricted_Andrew_state) A_noninjective_agreement:\n assumes facts:\n \"roleMap r tid1 = Some A\"\n \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid1)) ~: reveals t\"\n \"( tid1, A_2 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some B &\n LN ''Na'' tid1 = s(MV ''Na'' tid2) &\n s(MV ''Kab'' tid1) = LN ''Kab'' tid2)\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid1, s(MV ''Kab'' tid1) |}\n ( Kbd ( s(AV ''A'' tid1) ) ( s(MV ''B'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_2_enc tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) B_noninjective_agreement:\n assumes facts:\n \"roleMap r tid1 = Some B\"\n \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid1)) ~: reveals t\"\n \"( tid1, B_3 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some A &\n s(MV ''Na'' tid1) = LN ''Na'' tid2 &\n LN ''Kab'' tid1 = s(MV ''Kab'' tid2))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''3'', s(MV ''Na'' tid1) |} ( LN ''Kab'' tid1 ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n next\n case (A_3_enc tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/BAN_concrete_Andrew_Secure_RPC_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.25956709700669656}} {"text": "theory GTT_Transitive_Closure\n imports GTT_Compose\nbegin\n\nsubsection \\GTT closure under transitivity\\\n\ninductive_set \\_trancl_set :: \"('q, 'f) ta \\ ('q, 'f) ta \\ ('q \\ 'q) set\" for A B where\n \\_set_cong: \"TA_rule f ps p |\\| rules A \\ TA_rule f qs q |\\| rules B \\ length ps = length qs \\\n (\\i. i < length qs \\ (ps ! i, qs ! i) \\ \\_trancl_set A B) \\ (p, q) \\ \\_trancl_set A B\"\n| \\_set_eps1: \"(p, p') |\\| eps A \\ (p, q) \\ \\_trancl_set A B \\ (p', q) \\ \\_trancl_set A B\"\n| \\_set_eps2: \"(q, q') |\\| eps B \\ (p, q) \\ \\_trancl_set A B \\ (p, q') \\ \\_trancl_set A B\"\n| \\_set_trans: \"(p, q) \\ \\_trancl_set A B \\ (q, r) \\ \\_trancl_set A B \\ (p, r) \\ \\_trancl_set A B\"\n\nlemma \\_trancl_set_states: \"\\_trancl_set \\ \\ \\ fset (\\ \\ |\\| \\ \\)\"\nproof -\n {fix p q assume \"(p, q) \\ \\_trancl_set \\ \\\" then have \"(p, q) \\ fset (\\ \\ |\\| \\ \\)\"\n by (induct) (auto dest: rule_statesD eps_statesD simp flip: fmember_iff_member_fset)}\n then show ?thesis by auto\nqed\n\nlemma finite_\\_trancl_set [simp]: \"finite (\\_trancl_set \\ \\)\"\n using finite_subset[OF \\_trancl_set_states]\n by simp\n\ncontext\nincludes fset.lifting\nbegin\nlift_definition \\_trancl :: \"('q, 'f) ta \\ ('q, 'f) ta \\ ('q \\ 'q) fset\" is \\_trancl_set by simp\nlemmas \\_trancl_cong = \\_set_cong [Transfer.transferred]\nlemmas \\_trancl_eps1 = \\_set_eps1 [Transfer.transferred]\nlemmas \\_trancl_eps2 = \\_set_eps2 [Transfer.transferred]\nlemmas \\_trancl_cases = \\_trancl_set.cases[Transfer.transferred]\nlemmas \\_trancl_induct [consumes 1, case_names \\_cong \\_eps1 \\_eps2 \\_trans] = \\_trancl_set.induct[Transfer.transferred]\nlemmas \\_trancl_intros = \\_trancl_set.intros[Transfer.transferred]\nlemmas \\_trancl_simps = \\_trancl_set.simps[Transfer.transferred]\nend\n\n\nlemma \\_trancl_cl [simp]:\n \"(\\_trancl A B)|\\<^sup>+| = \\_trancl A B\"\nproof -\n {fix s t assume \"(s, t) |\\| (\\_trancl A B)|\\<^sup>+|\" then have \"(s, t) |\\| \\_trancl A B\"\n by (induct rule: ftrancl_induct) (auto intro: \\_trancl_intros)}\n then show ?thesis by auto\nqed\n\nlemma \\_trancl_states: \"\\_trancl \\ \\ |\\| (\\ \\ |\\| \\ \\)\"\n using \\_trancl_set_states\n by (metis \\_trancl.rep_eq fSigma_cong less_eq_fset.rep_eq)\n\ndefinition GTT_trancl where\n \"GTT_trancl G =\n (let \\ = \\_trancl (snd G) (fst G) in\n (TA (rules (fst G)) (eps (fst G) |\\| \\),\n TA (rules (snd G)) (eps (snd G) |\\| (\\|\\|))))\"\n\nlemma \\_trancl_inv:\n \"(\\_trancl A B)|\\| = \\_trancl B A\"\nproof -\n have [dest]: \"(p, q) |\\| \\_trancl A B \\ (q, p) |\\| \\_trancl B A\" for p q A B\n by (induct rule: \\_trancl_induct) (auto intro: \\_trancl_intros)\n show ?thesis by auto\nqed\n\nlemma gtt_states_GTT_trancl:\n \"gtt_states (GTT_trancl G) |\\| gtt_states G\"\n unfolding GTT_trancl_def\n by (auto simp: gtt_states_def \\_def \\_trancl_inv dest!: fsubsetD[OF \\_trancl_states] simp flip: fmember_iff_member_fset)\n\nlemma gtt_syms_GTT_trancl:\n \"gtt_syms (GTT_trancl G) = gtt_syms G\"\n by (auto simp: GTT_trancl_def ta_sig_def \\_trancl_inv)\n\nlemma GTT_trancl_base:\n \"gtt_lang G \\ gtt_lang (GTT_trancl G)\"\n using gtt_lang_mono[of G \"GTT_trancl G\"] by (auto simp: \\_trancl_inv GTT_trancl_def)\n\nlemma GTT_trancl_trans:\n \"gtt_lang (GTT_comp (GTT_trancl G) (GTT_trancl G)) \\ gtt_lang (GTT_trancl G)\"\nproof -\n have [dest]: \"(p, q) |\\| \\\\<^sub>\\ (TA (rules A) (eps A |\\| (\\_trancl B A)))\n (TA (rules B) (eps B |\\| (\\_trancl A B))) \\ (p, q) |\\| \\_trancl A B\" for p q A B\n by (induct rule: \\\\<^sub>\\_induct) (auto intro: \\_trancl_intros simp: \\_trancl_inv[of B A, symmetric])\n show ?thesis\n by (intro gtt_lang_mono[of \"GTT_comp (GTT_trancl G) (GTT_trancl G)\" \"GTT_trancl G\"])\n (auto simp: GTT_comp_def GTT_trancl_def fmember.abs_eq \\_trancl_inv)\nqed\n\nlemma agtt_lang_base:\n \"agtt_lang G \\ agtt_lang (GTT_trancl G)\"\n by (rule agtt_lang_mono) (auto simp: GTT_trancl_def \\_trancl_inv)\n\n\nlemma \\\\<^sub>\\_tr_incl:\n \"\\\\<^sub>\\ (TA (rules A) (eps A |\\| \\_trancl B A)) (TA (rules B) (eps B |\\| \\_trancl A B)) = \\_trancl A B\"\n (is \"?LS = ?RS\")\nproof -\n {fix p q assume \"(p, q) |\\| ?LS\" then have \"(p, q) |\\| ?RS\"\n by (induct rule: \\\\<^sub>\\_induct)\n (auto simp: \\_trancl_inv[of B A, symmetric] intro: \\_trancl_intros)}\n moreover\n {fix p q assume \"(p, q) |\\| ?RS\" then have \"(p, q) |\\| ?LS\"\n by (induct rule: \\_trancl_induct)\n (auto simp: \\_trancl_inv[of B A, symmetric] intro: \\\\<^sub>\\_intros)}\n ultimately show ?thesis\n by auto\nqed\n\n\nlemma agtt_lang_trans:\n \"gcomp_rel UNIV (agtt_lang (GTT_trancl G)) (agtt_lang (GTT_trancl G)) \\ agtt_lang (GTT_trancl G)\"\nproof -\n have [intro!, dest]: \"(p, q) |\\| \\\\<^sub>\\ (TA (rules A) (eps A |\\| (\\_trancl B A)))\n (TA (rules B) (eps B |\\| (\\_trancl A B))) \\ (p, q) |\\| \\_trancl A B\" for p q A B\n by (induct rule: \\\\<^sub>\\_induct) (auto intro: \\_trancl_intros simp: \\_trancl_inv[of B A, symmetric])\n show ?thesis\n by (rule subset_trans[OF gtt_comp_acomplete agtt_lang_mono])\n (auto simp: GTT_comp_def GTT_trancl_def \\_trancl_inv)\nqed\n\nlemma GTT_trancl_acomplete:\n \"gtrancl_rel UNIV (agtt_lang G) \\ agtt_lang (GTT_trancl G)\"\n unfolding gtrancl_rel_def\n using agtt_lang_base[of G] gmctxt_cl_mono_rel[OF agtt_lang_base[of G], of UNIV]\n using agtt_lang_trans[of G]\n unfolding gcomp_rel_def\n by (intro kleene_trancl_induct) blast+\n\nlemma Restr_rtrancl_gtt_lang_eq_trancl_gtt_lang:\n \"(gtt_lang G)\\<^sup>* = (gtt_lang G)\\<^sup>+\"\n by (auto simp: rtrancl_trancl_reflcl simp del: reflcl_trancl dest: tranclD tranclD2 intro: gmctxt_cl_refl)\n\nlemma GTT_trancl_complete:\n \"(gtt_lang G)\\<^sup>+ \\ gtt_lang (GTT_trancl G)\"\n using GTT_trancl_base subset_trans[OF gtt_comp_lang_complete GTT_trancl_trans]\n by (metis trancl_id trancl_mono_set trans_O_iff)\n\nlemma trancl_gtt_lang_arg_closed:\n assumes \"length ss = length ts\" \"\\i < length ts. (ss ! i, ts ! i) \\ (gtt_lang \\)\\<^sup>+\"\n shows \"(GFun f ss, GFun f ts) \\ (gtt_lang \\)\\<^sup>+\" (is \"?e \\ _\")\nproof -\n have \"all_ctxt_closed UNIV ((gtt_lang \\)\\<^sup>+)\" by (intro all_ctxt_closed_trancl) auto\n from all_ctxt_closedD[OF this _ assms] show ?thesis\n by auto\nqed\n\nlemma \\_trancl_sound:\n assumes \"(p, q) |\\| \\_trancl A B\"\n obtains s t where \"(s, t) \\ (gtt_lang (B, A))\\<^sup>+\" \"p |\\| gta_der A s\" \"q |\\| gta_der B t\"\n using assms\nproof (induct arbitrary: thesis rule: \\_trancl_induct)\n case (\\_cong f ps p qs q)\n have \"\\si ti. (si, ti) \\ (gtt_lang (B, A))\\<^sup>+ \\ ps ! i |\\| gta_der A (si) \\\n qs ! i |\\| gta_der B (ti)\" if \"i < length qs\" for i\n using \\_cong(5)[OF that] by metis\n then obtain ss ts where\n \"\\i. i < length qs \\ (ss i, ts i) \\ (gtt_lang (B, A))\\<^sup>+ \\ ps ! i |\\| gta_der A (ss i) \\ qs ! i |\\| gta_der B (ts i)\" by metis\n then show ?case using \\_cong(1-5)\n by (intro \\_cong(6)[of \"GFun f (map ss [0.._eps1 p p' q) then show ?case\n by (metis gta_der_def ta_der_eps)\nnext\n case (\\_eps2 q q' p) then show ?case\n by (metis gta_der_def ta_der_eps)\nnext\n case (\\_trans p q r)\n obtain s1 t1 where \"(s1, t1) \\ (gtt_lang (B, A))\\<^sup>+\" \"p |\\| gta_der A s1\" \"q |\\| gta_der B t1\"\n using \\_trans(2) .note 1 = this\n obtain s2 t2 where \"(s2, t2) \\ (gtt_lang (B, A))\\<^sup>+\" \"q |\\| gta_der A s2\" \"r |\\| gta_der B t2\"\n using \\_trans(4) . note 2 = this\n have \"(t1, s2) \\ gtt_lang (B, A)\" using 1(1,3) 2(1,2)\n by (auto simp: Restr_rtrancl_gtt_lang_eq_trancl_gtt_lang[symmetric] gtt_lang_join)\n then have \"(s1, t2) \\ (gtt_lang (B, A))\\<^sup>+\" using 1(1) 2(1)\n by (meson trancl.trancl_into_trancl trancl_trans)\n then show ?case using 1(2) 2(3) by (auto intro: \\_trans(5)[of s1 t2])\nqed\n\nlemma GTT_trancl_sound_aux:\n assumes \"p |\\| gta_der (TA (rules A) (eps A |\\| (\\_trancl B A))) s\"\n shows \"\\t. (s, t) \\ (gtt_lang (A, B))\\<^sup>+ \\ p |\\| gta_der A t\"\n using assms\nproof (induct s arbitrary: p)\n case (GFun f ss)\n let ?eps = \"eps A |\\| \\_trancl B A\"\n obtain qs q where q: \"TA_rule f qs q |\\| rules A\" \"q = p \\ (q, p) |\\| ?eps|\\<^sup>+|\" \"length qs = length ss\"\n \"\\i. i < length ss \\ qs ! i |\\| gta_der (TA (rules A) ?eps) (ss ! i)\"\n using GFun(2) by (auto simp: gta_der_def)\n have \"\\i. i < length ss \\ \\ti. (ss ! i, ti) \\ (gtt_lang (A, B))\\<^sup>+ \\ qs ! i |\\| gta_der A (ti)\"\n using GFun(1)[OF nth_mem q(4)] unfolding gta_der_def by fastforce\n then obtain ts where ts: \"\\i. i < length ss \\ (ss ! i, ts i) \\ (gtt_lang (A, B))\\<^sup>+ \\ qs ! i |\\| gta_der A (ts i)\"\n by metis\n then have q': \"q |\\| gta_der A (GFun f (map ts [0.. (gtt_lang (A, B))\\<^sup>+\" using q(1, 3)\n by (auto simp: gta_der_def intro!: exI[of _ qs] exI[of _ q] trancl_gtt_lang_arg_closed)\n {fix p q u assume ass: \"(p, q) |\\| \\_trancl B A\" \"(GFun f ss, u) \\ (gtt_lang (A, B))\\<^sup>+ \\ p |\\| gta_der A u\"\n from \\_trancl_sound[OF this(1)] obtain s t\n where \"(s, t) \\ (gtt_lang (A, B))\\<^sup>+\" \"p |\\| gta_der B s\" \"q |\\| gta_der A t\" . note st = this\n have \"(u, s) \\ gtt_lang (A, B)\" using st conjunct2[OF ass(2)]\n by (auto simp: Restr_rtrancl_gtt_lang_eq_trancl_gtt_lang[symmetric] gtt_lang_join)\n then have \"(GFun f ss, t) \\ (gtt_lang (A, B))\\<^sup>+\"\n using ass st(1) by (meson trancl_into_trancl2 trancl_trans)\n then have \"\\ s t. (GFun f ss, t) \\ (gtt_lang (A, B))\\<^sup>+ \\ q |\\| gta_der A t\" using st by blast}\n note trancl_step = this\n show ?case\n proof (cases \"q = p\")\n case True\n then show ?thesis using ts q(1, 3)\n by (auto simp: gta_der_def intro!: exI[of _\"GFun f (map ts [0..< length ss])\"] trancl_gtt_lang_arg_closed) blast\n next\n case False\n then have \"(q, p) |\\| ?eps|\\<^sup>+|\" using q(2) by simp\n then show ?thesis using q(1) q'\n proof (induct rule: ftrancl_induct)\n case (Base q p) from Base(1) show ?case\n proof\n assume \"(q, p) |\\| eps A\" then show ?thesis using Base(2) ts q(3)\n by (auto simp: gta_der_def intro!: exI[of _\"GFun f (map ts [0..< length ss])\"]\n trancl_gtt_lang_arg_closed exI[of _ qs] exI[of _ q])\n next\n assume \"(q, p) |\\| (\\_trancl B A)\"\n then have \"(q, p) |\\| \\_trancl B A\" by (simp add: fmember.abs_eq) \n from trancl_step[OF this] show ?thesis using Base(3, 4)\n by auto\n qed\n next\n case (Step p q r)\n from Step(2, 4-) obtain s' where s': \"(GFun f ss, s') \\ (gtt_lang (A, B))\\<^sup>+ \\ q |\\| gta_der A s'\" by auto\n show ?case using Step(3)\n proof\n assume \"(q, r) |\\| eps A\" then show ?thesis using s'\n by (auto simp: gta_der_def ta_der_eps intro!: exI[of _ s'])\n next\n assume \"(q, r) |\\| \\_trancl B A\"\n then have \"(q, r) |\\| \\_trancl B A\" by (simp add: fmember.abs_eq) \n from trancl_step[OF this] show ?thesis using s' by auto\n qed\n qed\n qed\nqed\n\nlemma GTT_trancl_asound:\n \"agtt_lang (GTT_trancl G) \\ gtrancl_rel UNIV (agtt_lang G)\"\nproof (intro subrelI, goal_cases LR)\n case (LR s t)\n then obtain s' q t' where *: \"(s, s') \\ (gtt_lang G)\\<^sup>+\"\n \"q |\\| gta_der (fst G) s'\" \"q |\\| gta_der (snd G) t'\" \"(t', t) \\ (gtt_lang G)\\<^sup>+\"\n by (auto simp: agtt_lang_def GTT_trancl_def trancl_converse \\_trancl_inv\n simp flip: gtt_lang_swap[of \"fst G\" \"snd G\", unfolded prod.collapse agtt_lang_def, simplified]\n dest!: GTT_trancl_sound_aux)\n then have \"(s', t') \\ agtt_lang G\" using *(2,3)\n by (auto simp: agtt_lang_def)\n then show ?case using *(1,4) unfolding gtrancl_rel_def\n by auto\nqed\n\nlemma GTT_trancl_sound:\n \"gtt_lang (GTT_trancl G) \\ (gtt_lang G)\\<^sup>+\"\nproof -\n note [dest] = GTT_trancl_sound_aux\n have \"gtt_accept (GTT_trancl G) s t \\ (s, t) \\ (gtt_lang G)\\<^sup>+\" for s t unfolding gtt_accept_def\n proof (induct rule: gmctxt_cl.induct)\n case (base s t)\n from base obtain q where join: \"q |\\| gta_der (fst (GTT_trancl G)) s\" \"q |\\| gta_der (snd (GTT_trancl G)) t\"\n by (auto simp: agtt_lang_def)\n obtain s' where \"(s, s') \\ (gtt_lang G)\\<^sup>+\" \"q |\\| gta_der (fst G) s'\" using base join\n by (auto simp: GTT_trancl_def \\_trancl_inv agtt_lang_def)\n moreover obtain t' where \"(t', t) \\ (gtt_lang G)\\<^sup>+\" \"q |\\| gta_der (snd G) t'\" using join\n by (auto simp: GTT_trancl_def gtt_lang_swap[of \"fst G\" \"snd G\", symmetric] trancl_converse \\_trancl_inv)\n moreover have \"(s', t') \\ gtt_lang G\" using calculation\n by (auto simp: Restr_rtrancl_gtt_lang_eq_trancl_gtt_lang[symmetric] gtt_lang_join)\n ultimately show \"(s, t) \\ (gtt_lang G)\\<^sup>+\" by (meson trancl.trancl_into_trancl trancl_trans)\n qed (auto intro!: trancl_gtt_lang_arg_closed)\n then show ?thesis by (auto simp: gtt_accept_def)\nqed\n\nlemma GTT_trancl_alang:\n \"agtt_lang (GTT_trancl G) = gtrancl_rel UNIV (agtt_lang G)\"\n using GTT_trancl_asound GTT_trancl_acomplete by blast\n\nlemma GTT_trancl_lang:\n \"gtt_lang (GTT_trancl G) = (gtt_lang G)\\<^sup>+\"\n using GTT_trancl_sound GTT_trancl_complete by blast\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regular_Tree_Relations/GTT_Transitive_Closure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2595389365769605}} {"text": "theory RepeatScorres\n imports\n RepeatShallow\n RepeatMono\n \"build/Generated_SCorres_Normal\"\nbegin\n\nsection \"Shallow repeat loop definition\"\n\noverloading repeat' \\ repeat\nbegin\ndefinition repeat' :: \"(64 word, ('a, 'b) StepParam \\ bool, ('a, 'b) StepParam \\ 'a, 'a, 'b) RepParam \\ 'a\"\n where\n\"repeat x =\n repeatatm (unat (RepParam.n\\<^sub>f x))\n (\\(a :: 'a) (b :: 'b). (RepParam.stop\\<^sub>f x) \\StepParam.acc\\<^sub>f = a, obsv\\<^sub>f = b\\)\n (\\(a :: 'a) (b :: 'b). (RepParam.step\\<^sub>f x) \\StepParam.acc\\<^sub>f = a, obsv\\<^sub>f = b\\)\n (RepParam.acc\\<^sub>f x)\n (RepParam.obsv\\<^sub>f x)\"\nend (* of overloading *)\n\nsection \"Repeat loop scorres\"\n\ncontext shallow begin\n\nlemma vrepeat_bod_scorres:\n \"\\rel_leq \\' \\'';\n valRel \\'' (x ::(64 word, ('c, 'd) StepParam \\ bool, ('c, 'd) StepParam \\ 'c, 'c, 'd) RepParam)\n (VRecord [VPrim (LU64 n), f, g, acc, obsv]); is_vvalfun f; is_vvalfun g;\n vrepeat_bod \\' (unat n) (vvalfun_to_expr f) (vvalfun_to_expr g) acc obsv v'\\\n \\ valRel \\''\n (repeatatm (unat (n\\<^sub>f x)) (\\a b. stop\\<^sub>f x \\StepParam.acc\\<^sub>f = a, obsv\\<^sub>f = b\\)\n (\\a b. step\\<^sub>f x \\StepParam.acc\\<^sub>f = a, obsv\\<^sub>f = b\\) (RepParam.acc\\<^sub>f x) (RepParam.obsv\\<^sub>f x))\n v'\"\n apply (induct n arbitrary: acc x)\n apply (clarsimp simp: valRel_RepParam)\n apply (subst repeatatm.simps)\n apply simp\n apply (drule unatSuc; clarsimp)\n apply (rename_tac n acc x b)\n apply (case_tac b; clarsimp)\n apply (clarsimp simp: valRel_RepParam)\n apply (subst repeatatm.simps; clarsimp)\n apply (erule notE)\n apply (erule disjE; clarsimp)\n apply (elim v_sem_appE v_sem_funE v_sem_varE; clarsimp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [v', obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = \"VPrim (LBool True)\" in allE)\n apply (drule_tac \\b = \\'' in v_sem_v_sem_all_rel_leqD(1)[rotated 1]; simp)\n apply (elim v_sem_appE v_sem_afunE v_sem_varE; clarsimp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [v', obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = \"VPrim (LBool True)\" in allE)\n apply (erule impE; simp?)\n apply (rule rel_leqD[rotated 1]; assumption)\n apply (rename_tac acc')\n apply (drule_tac x = acc' in meta_spec)\n apply clarsimp\n apply (drule_tac\n x = \"\\RepParam.n\\<^sub>f = n, stop\\<^sub>f = stop\\<^sub>f x, step\\<^sub>f = step\\<^sub>f x,\n acc\\<^sub>f = step\\<^sub>f x \\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\,\n obsv\\<^sub>f = RepParam.obsv\\<^sub>f x \\\" in meta_spec)\n apply (elim meta_allE meta_impE; assumption?)\n apply (clarsimp simp: valRel_RepParam)\n apply (thin_tac \"_ \\ _\")\n apply (thin_tac \"_, _ \\ _ \\ _\")\n apply (elim disjE v_sem_appE v_sem_varE; clarsimp; elim v_sem_funE v_sem_afunE; clarsimp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [acc, obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = acc' in allE)\n apply (drule_tac \\b = \\'' in v_sem_v_sem_all_rel_leqD(1)[rotated 1]; simp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [acc, obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = acc' in allE)\n apply (erule impE; simp?)\n apply (rule rel_leqD[rotated 1]; assumption)\n apply clarsimp\n apply (subst (asm) valRel_RepParam; clarsimp)\n apply (erule v_sem_appE; erule disjE; clarsimp; elim v_sem_funE v_sem_afunE v_sem_varE; clarsimp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [acc, obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = \"VPrim (LBool False)\" in allE)\n apply (erule impE; simp?)\n apply (rule rel_leqD[rotated 1]; assumption)\n apply (subst repeatatm.simps; clarsimp)\n apply (erule_tac x = \"\\StepParam.acc\\<^sub>f = RepParam.acc\\<^sub>f x, obsv\\<^sub>f = RepParam.obsv\\<^sub>f x\\\" in allE)\n apply (erule_tac x = \"VRecord [acc, obsv]\" in allE)\n apply (erule impE, simp add: valRel_StepParam)\n apply (erule_tac x = \"VPrim (LBool False)\" in allE)\n apply (erule impE, rule v_sem_v_sem_all_rel_leqD(1); simp)\n apply (subst repeatatm.simps; clarsimp)\n done\n\nlemma repeat_scorres: \n \"\\rel_leq \\' \\''; \\'' ''repeat'' = prepeat \\'\\ \\ \n scorres repeat (AFun ''repeat'' ts []) \\ \\''\"\n unfolding scorres_def\n apply clarsimp\n apply (erule v_sem_afunE; clarsimp)\n apply (erule notE)\n unfolding repeat'_def prepeat_def\n apply clarsimp\n apply (rule vrepeat_bod_scorres; simp?)\n done\n\nend (* of context *)\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/RepeatScorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.25952217008764894}} {"text": "theory sch\n imports task2\nbegin\n\n\ndefinition Pr :: char where \"Pr = CHR ''p''\"\n\ndefinition G :: char where \"G = CHR ''g''\"\n\n\nfun sched_push :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_push t (Sch p rn rp) s = Sch (p @ [(s (CHR ''p''), t)]) rn rp\"\n| \"sched_push t (Task st ent tp) s = undefined\"\n| \"sched_push t None s = undefined\"\n\nfun sched_assign :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_assign t (Sch p rn rp) s = Sch p t (s (CHR ''p''))\"\n| \"sched_assign t (Task st ent tp) s = undefined\"\n| \"sched_assign t None s = undefined\"\n\nfun get_max_default :: \"real \\ tid \\ (real \\ tid) list \\ real \\ tid\" where\n \"get_max_default (prior, t) [] = (prior, t)\"\n| \"get_max_default (prior, t) ((prior2, t2) # rest) =\n (if prior \\ prior2 then\n get_max_default (prior, t) rest\n else\n get_max_default (prior2, t2) rest)\"\n\nfun get_max :: \"(real \\ tid) list \\ real \\ tid\" where\n \"get_max [] = (-1, -1)\"\n| \"get_max ((prior, t) # rest) = get_max_default (prior, t) rest\"\n\nfun del_proc :: \"(real \\ tid) list \\ tid \\ (real \\ tid) list\" where\n \"del_proc [] t = []\"\n| \"del_proc ((prior, t) # rest) t2 =\n (if t = t2 then rest\n else (prior, t) # del_proc rest t2)\"\n\nfun sched_get_max :: \"estate \\ state \\ estate\" where\n \"sched_get_max (Sch p rn rp) s =\n (let (prior, t) = get_max p in Sch (del_proc p t) t prior)\"\n| \"sched_get_max (Task st ent tp) s = undefined\"\n| \"sched_get_max None s = undefined\"\n\nfun sched_get_max' :: \"estate \\ estate\" where\n \"sched_get_max' (Sch p rn rp) =\n (let (prior, t) = get_max p in Sch (del_proc p t) t prior)\"\n| \"sched_get_max' (Task st ent tp) = undefined\"\n| \"sched_get_max' None = undefined\"\n\nlemma sched_get_max_eq:\n\"sched_get_max e s = sched_get_max' e\"\n apply(cases e)\n by auto\n\nfun sched_clear :: \"estate \\ state \\ estate\" where\n \"sched_clear (Sch p rn rp) s = Sch [] (-1) (-1)\"\n| \"sched_clear (Task st ent tp) s = undefined\"\n| \"sched_clear None s = undefined\"\n\nfun sched_clear' :: \"estate \\ estate\" where\n \"sched_clear' (Sch p rn rp) = Sch [] (-1) (-1)\"\n| \"sched_clear' (Task st ent tp) = undefined\"\n| \"sched_clear' None = undefined\"\n\nlemma sched_clear_eq:\n\"sched_clear e s = sched_clear' e\"\n apply(cases e)\n by auto\n\n\nfun sched_del_proc :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_del_proc t (Sch p rn rp) s = Sch (del_proc p t) rn rp\"\n| \"sched_del_proc t (Task st ent tp) s = undefined\"\n| \"sched_del_proc t None s = undefined\"\n\n\nfun sched_del_proc' :: \"tid \\ estate \\ estate\" where\n \"sched_del_proc' t (Sch p rn rp) = Sch (del_proc p t) rn rp\"\n| \"sched_del_proc' t (Task st ent tp) = undefined\"\n| \"sched_del_proc' t None = undefined\"\n\nlemma sched_del_proc_eq:\n\"sched_del_proc t e s = sched_del_proc' t e\"\n apply(cases e)\n by auto\n\n\nfun run_now_assign :: \"real \\ estate \\ state \\ estate\" where\n\"run_now_assign rn (Sch p n rp) s = (Sch p rn rp)\"\n\nfun run_prior_assign :: \"estate \\ state \\ estate\" where\n\"run_prior_assign (Sch p n rp) s = (Sch p n (s Pr))\"\n\n\ndefinition properp :: \"tid \\ real \\ bool\" where\n\"properp rn rp = ((rn = 1 \\ rp = 2) \\ (rn = 2 \\ rp = 1) \\ (rn = -1 \\ rp = -1) \\ rp \\ {-1,1,2} \\ rn \\ {-1,1,2})\"\n\nfun properl :: \"(real \\ tid) list \\ bool\" where\n \"properl [] = True\"\n| \"properl ((rp,rn) # v) = (properl v \\ properp rn rp \\ rn > 0 \\ rn \\ 1)\"\n\nlemma properl_p1:\n\"properl (p @ [(a, b)]) = (properl p \\ properp b a \\ b > 0 \\ b \\ 1)\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n show ?case\n apply(cases c)\n subgoal for ca cb\n apply simp\n using Cons[of a b]\n by auto\ndone\nqed\n\nlemma properl_p2:\n\"properl p \\ properp rn rp \\ properp (snd(get_max_default (rp,rn) p)) (fst(get_max_default (rp,rn) p))\"\nproof(induction p arbitrary: rn rp)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n by auto\n done\nqed\n\n\nlemma properl_p3:\n\"properl p \\ properp (snd (get_max p)) (fst (get_max p)) \"\nproof(induction p)\n case Nil\n then show ?case \n apply auto\n unfolding properp_def\n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n apply auto\n apply(rule properl_p2)\n by auto\n done\nqed\n\n\nlemma properl_p4:\n\"properl p \\ properl (del_proc p t)\"\nproof(induction p)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n by auto\n done\nqed\n\nlemma proper_getmax1':\n\"fst (get_max_default (a,b) p) < d \\ a' < d \\ fst (get_max_default (a,b) (p@[(a',b')])) < d\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons g p)\n then show ?case \n apply(cases g)\n subgoal for ga gb\n by auto\n done\nqed\n\nlemma proper_getmax1:\n\"fst (get_max p) < d \\ a' < d \\ fst (get_max(p@[(a',b')])) < d\"\nproof(induction p)\n case Nil\n then show ?case by auto\nnext\n case (Cons g p)\n then show ?case \n apply (cases g)\n subgoal for ga gb\n apply auto\n using proper_getmax1'\n by auto\n done\nqed\n\n\nlemma proper_getmax2:\n\"properl p \\ snd (get_max p) \\ 1 \\ (gb \\ 1 \\ snd (get_max_default (ga, gb) p) \\ 1)\"\nproof(induction p arbitrary: ga gb)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons h p)\n then show ?case \n apply (cases h)\n subgoal for ha hb\n by auto\n done\nqed\n\nlemma properl_p5':\n \"properl ((a,b)#p) \\ snd(get_max_default (a,b) p) > 0\"\nproof(induction p arbitrary: a b)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons g p)\n then show ?case \n apply(cases g)\n by auto\nqed\n\nlemma properl_p5:\n\"length p > 0 \\ properl p \\ properp (snd (get_max p)) (fst (get_max p)) \\ (snd (get_max p)) > 0 \\ (snd (get_max p)) \\ 1\"\nproof(induction p)\n case Nil\n then show ?case \n by auto\nnext\n case (Cons c p)\n then show ?case \n apply(cases c)\n subgoal for a b\n apply auto\n subgoal\n apply(rule properl_p2)\n apply auto\n done\n prefer 2\n subgoal\n using proper_getmax2 apply auto\n done\n using properl_p5'[of 1 2 p] \n apply auto\n unfolding properp_def\n by auto\n done\nqed\n\n\n\ndefinition proper :: \"estate \\ bool \" where\n\"proper schs = ((properp (run_now schs) (run_prior schs)) \\ properl (pool schs))\"\n\n\ndefinition SCH :: \"estate proc\" where\n\"SCH = EChoice [(req_ch 1[?]Pr,IF (\\ s. run_prior (fst s) \\ (snd s) Pr) THEN Basic (sched_push 1) \n ELSE (IF (\\ s. run_now (fst s) = 2) THEN Cm (preempt_ch 2[!](\\_ . 0)) ELSE Skip FI; Cm (run_ch 1[!](\\_ . 0));Basic (run_now_assign 1);Basic run_prior_assign) FI),\n (req_ch 2[?]Pr,IF (\\ s. run_prior (fst s) \\ (snd s) Pr) THEN Basic (sched_push 2) \n ELSE (IF (\\ s. run_now (fst s) = 1) THEN Cm (preempt_ch 1[!](\\_ . 0)) ELSE Skip FI; Cm (run_ch 2[!](\\_ . 0));Basic (run_now_assign 2);Basic run_prior_assign) FI),\n (free_ch 1[?]G,IF (\\ s. length (pool (fst s)) > 0) THEN ((Basic sched_get_max);(IF (\\ s. run_now (fst s) = 1)THEN Cm (run_ch 1[!](\\_.0)) ELSE Cm (run_ch 2[!](\\_.0)) FI)) \n ELSE Basic sched_clear FI),\n (free_ch 2[?]G,IF (\\ s. length (pool (fst s)) > 0) THEN ((Basic sched_get_max);(IF (\\ s. run_now (fst s) = 1)THEN Cm (run_ch 1[!](\\_.0)) ELSE Cm (run_ch 2[!](\\_.0)) FI)) \n ELSE Basic sched_clear FI),\n (exit_ch 1[?]G,Basic (sched_del_proc 1)),\n (exit_ch 2[?]G,Basic (sched_del_proc 2))]\"\n\ndefinition QQ :: \"(real \\ tid) list \\ tid \\ real \\ state \\ estate assn \\ estate assn\"where \n\"QQ p rn rp ss P = (\\ s t. (if rp \\ 2 then s = (Sch (p @ [(2, 1)]) rn rp,ss(Pr:=2)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) 2 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t \n else if rn = 2 then s = (Sch p 1 2, ss(Pr:=2)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) 2 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (preempt_ch 2) 0) @\\<^sub>t (Out0\\<^sub>t (run_ch 1) 0) \\\\<^sub>t (Waitp\\<^sub>t ({preempt_ch 2},{})) @\\<^sub>t true\\<^sub>A \\\\<^sub>t (Out0\\<^sub>t (preempt_ch 2) 0) @\\<^sub>t(Waitp\\<^sub>t ({run_ch 1},{})) @\\<^sub>t true\\<^sub>A)) t \n else s = (Sch p 1 2, ss(Pr:=2)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) 2 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 1) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 1},{})) @\\<^sub>t true\\<^sub>A )) t)\n \\ (\\ v\\2. (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t true\\<^sub>A ) t)\n \\ (if rp \\ 1 then s = (Sch (p @ [(1, 2)]) rn rp,ss(Pr:=1)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) 1 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t \n else if rn = 1 then s = (Sch p 2 1, ss(Pr:=1)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) 1 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (preempt_ch 1) 0) @\\<^sub>t (Out0\\<^sub>t (run_ch 2) 0) \\\\<^sub>t (Waitp\\<^sub>t ({preempt_ch 1},{})) @\\<^sub>t true\\<^sub>A \\\\<^sub>t (Out0\\<^sub>t (preempt_ch 1) 0) @\\<^sub>t(Waitp\\<^sub>t ({run_ch 2},{})) @\\<^sub>t true\\<^sub>A)) t \n else s = (Sch p 2 1, ss(Pr:=1)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) 1 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 2) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 2},{})) @\\<^sub>t true\\<^sub>A )) t)\n \\ (\\ v\\1. (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t true\\<^sub>A ) t)\n \\ (\\ v. if length p > 0 then s = (sched_get_max'(Sch p rn rp),ss(G:=v)) \n \\ (if run_now(sched_get_max'(Sch p rn rp)) = 1 \n then (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 1) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 1},{})) @\\<^sub>t true\\<^sub>A )) t \n else (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 2) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 2},{})) @\\<^sub>t true\\<^sub>A )) t) \n else s = (sched_clear'(Sch p rn rp),ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\n \\ (\\ v. if length p > 0 then s = (sched_get_max'(Sch p rn rp),ss(G:=v)) \n \\ (if run_now(sched_get_max'(Sch p rn rp)) = 1 \n then (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 1) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 1},{})) @\\<^sub>t true\\<^sub>A )) t \n else (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) @\\<^sub>t ((Out0\\<^sub>t (run_ch 2) 0) \\\\<^sub>t (Waitp\\<^sub>t ({run_ch 2},{})) @\\<^sub>t true\\<^sub>A )) t) \n else s = (sched_clear'(Sch p rn rp),ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\n \\ (\\ v. s = (sched_del_proc' 1 (Sch p rn rp),ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\n \\ (\\ v. s = (sched_del_proc' 2 (Sch p rn rp),ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t))\"\n\nlemma Sch_Valid_1:\n\"\\ {\\s t. s = (Sch p rn rp,ss) \\ P s t}\n SCH\n {\\ s t. QQ p rn rp ss P s t}\"\n unfolding SCH_def\n apply(rule Valid_echoice)\n apply auto\n subgoal for i a p2\n apply(cases i)\n subgoal \n apply auto\n apply(rule exI[where x=\"\\ s t. (s = (Sch p rn rp, ss(Pr:=2)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) 2 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t) \\ \n (\\ v\\2. s = (Sch p rn rp, ss(Pr:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n\n apply(rule conjI)\n subgoal \n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_cond_sp)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_seq)\n apply(rule Valid_cond_sp)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_skip)\n apply(rule Valid_seq)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_seq)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_basic_sp1)\n apply(rule entails_disjE')\n subgoal\n unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply auto\n unfolding QQ_def \n apply(rule disjI1)\n apply (auto simp add: Pr_def)\n by (metis prod.exhaust_sel)\n done\n subgoal\n unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply auto\n unfolding QQ_def \n apply(rule disjI1)\n apply(cases s)\n apply (auto simp add: Pr_def pure_assn_def conj_assn_def join_assn_def)\n subgoal for tr2 tr1b tr2a tr2b\n apply(rule exI[where x=tr1b])\n apply auto\n apply(rule exI[where x=tr2b])\n apply auto\n unfolding disj_assn_def\n apply(erule disjE)\n subgoal \n apply(erule disjE)\n subgoal by auto\n subgoal \n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: true_assn_def)\n done\n subgoal\n apply(erule disjE)\n subgoal\n apply(rule disjI2)\n apply(rule disjI2)\n by(auto simp add: true_assn_def)\n subgoal\n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: true_assn_def)\n done\n done\n subgoal for tr2 tr1a tr2a\n apply(rule exI[where x=tr1a])\n by auto\n done\n done\n done\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply(rule Valid_weaken_pre[where P'=\"\\ s t. (\\(v\\2) \\\\<^sub>t (P (Sch p rn rp, ss)) @\\<^sub>t\n Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))t\"])\n subgoal\n unfolding entails_def pure_assn_def conj_assn_def\n by auto\n subgoal\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_true)\n unfolding QQ_def\n apply(rule entails_disjI2')\n unfolding entails_def\n by (auto simp add:pure_assn_def conj_assn_def join_assoc)\n done\n done\n done\n apply(rule conjI)\n subgoal unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply(rule impI)\n apply simp\n apply(rule allI)\n subgoal for v\n apply(cases \"v=2\")\n subgoal apply(rule disjI1)\n apply auto\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(1) by blast\n subgoal apply(rule disjI2)\n apply auto\n apply(rule exI[where x=v])\n apply simp\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(1) by blast\n done\n done\n done\n subgoal unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply(rule impI)\n apply simp\n apply(rule allI)\n subgoal for d\n apply(rule impI)\n apply(rule allI)\n subgoal for v\n apply(cases \"v=2\")\n subgoal apply(rule disjI1)\n apply auto\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(2) by blast\n subgoal apply(rule disjI2)\n apply auto\n apply(rule exI[where x=v])\n apply simp\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(2) by blast\n done\n done\n done\n done\n done\n subgoal for i'\n apply(cases i')\n subgoal\n apply auto\n apply(rule exI[where x=\"\\ s t. (s = (Sch p rn rp, ss(Pr:=1)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) 1 ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t) \\ \n (\\ v\\1. s = (Sch p rn rp, ss(Pr:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n apply(rule conjI)\n subgoal \n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_cond_sp)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_seq)\n apply(rule Valid_cond_sp)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_skip)\n apply(rule Valid_seq)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_seq)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_basic_sp1)\n apply(rule entails_disjE')\n subgoal\n unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply auto\n unfolding QQ_def \n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: Pr_def)\n by (metis prod.exhaust_sel)\n done\n subgoal\n unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply auto\n unfolding QQ_def \n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply(cases s)\n apply (auto simp add: Pr_def pure_assn_def conj_assn_def join_assn_def)\n subgoal for tr2 tr1b tr2a tr2b\n apply(rule exI[where x=tr1b])\n apply auto\n apply(rule exI[where x=tr2b])\n apply auto\n unfolding disj_assn_def\n apply(erule disjE)\n subgoal \n apply(erule disjE)\n subgoal by auto\n subgoal \n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: true_assn_def)\n done\n subgoal\n apply(erule disjE)\n subgoal\n apply(rule disjI2)\n apply(rule disjI2)\n by(auto simp add: true_assn_def)\n subgoal\n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: true_assn_def)\n done\n done\n subgoal for tr2 tr1a tr2a\n apply(rule exI[where x=tr1a])\n by auto\n done\n done\n done\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply(rule Valid_weaken_pre[where P'=\"\\ s t. (\\(v\\1) \\\\<^sub>t (P (Sch p rn rp, ss)) @\\<^sub>t\n Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))t\"])\n subgoal\n unfolding entails_def pure_assn_def conj_assn_def\n by auto\n subgoal\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_true)\n unfolding QQ_def\n apply(rule entails_disjI2')\n unfolding entails_def\n by (auto simp add:pure_assn_def conj_assn_def join_assoc)\n done\n done\n done\n apply(rule conjI)\n subgoal unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply(rule impI)\n apply simp\n apply(rule allI)\n subgoal for v\n apply(cases \"v=1\")\n subgoal apply(rule disjI1)\n apply auto\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(1) by blast\n subgoal apply(rule disjI2)\n apply auto\n apply(rule exI[where x=v])\n apply simp\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(1) by blast\n done\n done\n done\n subgoal unfolding entails_def\n apply(rule allI)+\n subgoal for s tr\n apply(rule impI)\n apply simp\n apply(rule allI)\n subgoal for d\n apply(rule impI)\n apply(rule allI)\n subgoal for v\n apply(cases \"v=1\")\n subgoal apply(rule disjI1)\n apply auto\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(2) by blast\n subgoal apply(rule disjI2)\n apply auto\n apply(rule exI[where x=v])\n apply simp\n apply(auto simp add:join_assn_def) \n using inrdy_assn.intros(2) by blast\n done\n done\n done\n done\n done\n subgoal for i''\n apply(cases i'')\n subgoal\n apply auto\n apply(rule exI[where x=\"\\ s t. (\\ v. s = (Sch p rn rp, ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n apply(rule conjI)\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_cond_sp)\n apply(rule Valid_seq)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_cond_sp)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_basic_sp1)\n apply(rule entails_disjE')\n apply(rule entails_disjE')\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr2 tr1a tr2a\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n subgoal for v tr1a tr2a tr1b tr2b\n apply(cases s)\n apply(rule exI[where x=v])\n apply (auto simp add:true_assn_def)\n apply(rule exI[where x=tr1a])\n apply (auto simp add:true_assn_def)\n done\n done\n done\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr2 tr1a tr2a\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n subgoal for v tr1a tr2a tr1b tr2b\n apply(cases s)\n apply(rule exI[where x=v])\n apply (auto simp add:true_assn_def)\n apply(rule exI[where x=tr1a])\n apply (auto simp add:true_assn_def)\n done\n done\n done\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr1 tr2\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n done\n done\n done\n apply(rule conjI)\n subgoal unfolding entails_def\n apply(rule allI)+\n apply(rule impI)\n apply auto\n by (metis (no_types, opaque_lifting) inrdy_assn.intros(1) join_assn_def)\n subgoal unfolding entails_def\n apply(rule allI)+\n apply(rule impI)\n apply auto\n subgoal for tr d v\n apply(rule exI[where x=v])\n apply (auto simp add:join_assn_def)\n apply(rule exI[where x=tr])\n apply auto\n apply(rule )\n by auto\n done\n done\n subgoal for i'''\n apply(cases i''')\n subgoal\n apply auto\n apply(rule exI[where x=\"\\ s t. (\\ v. s = (Sch p rn rp, ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n apply(rule conjI)\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_cond_sp)\n apply(rule Valid_seq)\n apply(rule Valid_basic_sp1)\n apply(rule Valid_cond_sp)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_send_sp_assm0)\n apply(rule Valid_basic_sp1)\n apply(rule entails_disjE')\n apply(rule entails_disjE')\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr2 tr1a tr2a\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n subgoal for v tr1a tr2a tr1b tr2b\n apply(cases s)\n apply(rule exI[where x=v])\n apply (auto simp add:true_assn_def)\n apply(rule exI[where x=tr1a])\n apply (auto simp add:true_assn_def)\n done\n done\n done\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr2 tr1a tr2a\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n subgoal for v tr1a tr2a tr1b tr2b\n apply(cases s)\n apply(rule exI[where x=v])\n apply (auto simp add:true_assn_def)\n apply(rule exI[where x=tr1a])\n apply (auto simp add:true_assn_def)\n done\n done\n done\n subgoal\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n subgoal for s tr\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add: pure_assn_def conj_assn_def join_assn_def disj_assn_def)\n subgoal for v tr1 tr2\n apply(cases s)\n apply(rule exI[where x=v])\n by auto\n done\n done\n done\n apply(rule conjI)\n subgoal unfolding entails_def\n apply(rule allI)+\n apply(rule impI)\n apply auto\n by (metis (no_types, opaque_lifting) inrdy_assn.intros(1) join_assn_def)\n subgoal unfolding entails_def\n apply(rule allI)+\n apply(rule impI)\n apply auto\n subgoal for tr d v\n apply(rule exI[where x=v])\n apply (auto simp add:join_assn_def)\n apply(rule exI[where x=tr])\n apply auto\n apply(rule )\n by auto\n done\n done\n subgoal for i''''\n apply(cases i'''')\n subgoal\n apply auto\n apply(rule exI[where x=\"\\ s t. (\\ v. s = (Sch p rn rp, ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 1) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n apply(rule conjI)\n subgoal\n apply(rule Valid_ex_pre)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_basic_sp1)\n apply auto\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by auto\n apply(rule conjI)\n subgoal\n unfolding entails_def\n apply auto\n by (metis inrdy_assn.intros(1) join_assn_def)\n subgoal\n unfolding entails_def\n apply (auto simp add:join_assn_def)\n subgoal for tr d v\n apply(rule exI[where x=v])\n apply auto\n apply(rule exI[where x=tr])\n apply auto\n apply(rule ) by auto\n done\n done\n subgoal for i'''''\n subgoal\n apply auto\n apply(rule exI[where x=\"\\ s t. (\\ v. s = (Sch p rn rp, ss(G:=v)) \\ (P (Sch p rn rp, ss) @\\<^sub>t (Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 2) v ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}))) t)\"])\n apply(rule conjI)\n subgoal\n apply(rule Valid_ex_pre)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_basic_sp1)\n apply auto\n unfolding QQ_def entails_def\n apply(rule allI)+\n apply(rule impI)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n by auto\n apply(rule conjI)\n subgoal\n unfolding entails_def\n apply auto\n by (metis inrdy_assn.intros(1) join_assn_def)\n subgoal\n unfolding entails_def\n apply (auto simp add:join_assn_def)\n subgoal for tr d v\n apply(rule exI[where x=v])\n apply auto\n apply(rule exI[where x=tr])\n apply auto\n apply(rule ) by auto\n done\n done\n done\n done\n done\n done\n done\n done\n done\n\n \nfun SCH_tr:: \"nat \\ estate ext_state \\ estate tassn\" where\n \"SCH_tr 0 (Sch p rn rp,ss) = emp\\<^sub>t\" \n| \"SCH_tr (Suc k) (Sch p rn rp,ss) = (\n (Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) 2\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) \n @\\<^sub>t (if rp \\ 2 then SCH_tr k (Sch (p @ [(2, 1)]) rn rp,ss(Pr := 2)) \n else if rn = 2 then Out0\\<^sub>t (preempt_ch 2) 0 @\\<^sub>t Out0\\<^sub>t (run_ch 1) 0 @\\<^sub>t SCH_tr k (Sch p 1 2,ss(Pr := 2)) \\\\<^sub>t\n Waitp\\<^sub>t ({preempt_ch 2}, {}) @\\<^sub>t true\\<^sub>A \\\\<^sub>t\n Out0\\<^sub>t (preempt_ch 2) 0 @\\<^sub>t Waitp\\<^sub>t ({run_ch 1}, {}) @\\<^sub>t true\\<^sub>A \n else Out0\\<^sub>t (run_ch 1) 0 @\\<^sub>t SCH_tr k (Sch p 1 2,ss(Pr := 2))\\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 1}, {}) @\\<^sub>t true\\<^sub>A)\n \\\\<^sub>t(\\\\<^sub>t v. \\(v\\2) \\\\<^sub>t Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 1) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t true\\<^sub>A ) \n \\\\<^sub>t(Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) 1\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})) \n @\\<^sub>t (if rp \\ 1 then SCH_tr k (Sch (p @ [(1, 2)]) rn rp,ss(Pr := 1)) \n else if rn = 1 then Out0\\<^sub>t (preempt_ch 1) 0 @\\<^sub>t Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t SCH_tr k (Sch p 2 1,ss(Pr := 1)) \\\\<^sub>t\n Waitp\\<^sub>t ({preempt_ch 1}, {}) @\\<^sub>t true\\<^sub>A \\\\<^sub>t\n Out0\\<^sub>t (preempt_ch 1) 0 @\\<^sub>t Waitp\\<^sub>t ({run_ch 2}, {}) @\\<^sub>t true\\<^sub>A \n else Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t SCH_tr k (Sch p 2 1,ss(Pr := 1))\\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 2}, {}) @\\<^sub>t true\\<^sub>A)\n \\\\<^sub>t(\\\\<^sub>t v. \\(v\\1) \\\\<^sub>t Inrdy\\<^sub>t (Sch p rn rp, ss) (req_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t true\\<^sub>A ) \n \\\\<^sub>t(\\\\<^sub>t v. Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 1) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t \n (if length p > 0 then if run_now (sched_get_max' (Sch p rn rp)) = 1 \n then (Out0\\<^sub>t (run_ch 1) 0 @\\<^sub>t SCH_tr k (sched_get_max' (Sch p rn rp), ss(G := v)) \\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 1}, {}) @\\<^sub>t true\\<^sub>A)\n else (Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t SCH_tr k (sched_get_max' (Sch p rn rp), ss(G := v)) \\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 2}, {}) @\\<^sub>t true\\<^sub>A)\n else SCH_tr k (sched_clear' (Sch p rn rp), ss(G := v))))\n \\\\<^sub>t(\\\\<^sub>t v. Inrdy\\<^sub>t (Sch p rn rp, ss) (free_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t \n (if length p > 0 then if run_now (sched_get_max' (Sch p rn rp)) = 1 \n then (Out0\\<^sub>t (run_ch 1) 0 @\\<^sub>t SCH_tr k (sched_get_max' (Sch p rn rp), ss(G := v)) \\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 1}, {}) @\\<^sub>t true\\<^sub>A)\n else (Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t SCH_tr k (sched_get_max' (Sch p rn rp), ss(G := v)) \\\\<^sub>t\n Waitp\\<^sub>t ({run_ch 2}, {}) @\\<^sub>t true\\<^sub>A)\n else SCH_tr k (sched_clear' (Sch p rn rp), ss(G := v))))\n \\\\<^sub>t(\\\\<^sub>t v. Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 1) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) \n @\\<^sub>t SCH_tr k (sched_del_proc' 1 (Sch p rn rp), ss(G := v)))\n \\\\<^sub>t(\\\\<^sub>t v. Inrdy\\<^sub>t (Sch p rn rp, ss) (exit_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) \n @\\<^sub>t SCH_tr k (sched_del_proc' 2 (Sch p rn rp), ss(G := v)))\n)\"\n \n\n\n\nlemma Valid_SCH_rep:\n \"\\ {\\s t. s = (Sch p rn rp,ss) \\ emp\\<^sub>t t}\n Rep SCH\n {\\s t. (\\n. (emp\\<^sub>t @\\<^sub>t SCH_tr n (Sch p rn rp,ss)) t)}\"\napply(rule Valid_rep'')\n subgoal for n P\n apply(induction n arbitrary:P p rn rp ss)\n subgoal for P\n apply auto\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_skip)\n unfolding entails_def by auto\n subgoal premises pre for n P p rn rp ss\n subgoal\n unfolding RepN.simps\n apply(rule Valid_seq)\n apply(rule Sch_Valid_1)\n thm pre\n unfolding QQ_def\n apply(rule Valid_pre_or)\n subgoal\n apply(cases \"2\\rp\")\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI1)\n by auto\n apply(cases \"rn = 2\")\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def)\n subgoal by metis\n subgoal by metis\n subgoal by metis\n done\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def)\n by metis\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_ex_pre)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_true)\n subgoal for v\n apply(rule tassn_to_assn)\n apply (simp del:SCH_tr.simps add:join_assoc)\n apply(rule impI)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI1)\n by (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(cases \"1\\rp\")\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by auto\n apply(cases \"rn = 1\")\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def)\n subgoal by metis\n subgoal by metis\n subgoal by metis\n done\n subgoal \n apply(rule Valid_strengthen_post)\n prefer 2\n apply simp\n apply(rule pre)\n apply(simp only:join_assoc)\n apply(rule tassn_to_assn)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def)\n by metis\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_ex_pre)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule Valid_true)\n subgoal for v\n apply(rule tassn_to_assn)\n apply (simp del:SCH_tr.simps add:join_assoc)\n apply(rule impI)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply(cases \"length p > 0\")\n subgoal\n apply(cases \"run_now (sched_get_max' (Sch p rn rp)) = 1\")\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(cases \"get_max p\")\n subgoal for pp tt\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n subgoal by metis\n subgoal by metis\n done\n done\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(cases \"get_max p\")\n subgoal for pp tt\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n subgoal by metis\n subgoal by metis\n done\n done\n done\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: ex_assn_def)\n done\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply(cases \"length p > 0\")\n subgoal\n apply(cases \"run_now (sched_get_max' (Sch p rn rp)) = 1\")\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(cases \"get_max p\")\n subgoal for pp tt\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n subgoal by metis\n subgoal by metis\n done\n done\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(cases \"get_max p\")\n subgoal for pp tt\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n apply (auto simp add:join_assn_def true_assn_def ex_assn_def pure_assn_def conj_assn_def)\n subgoal by metis\n subgoal by metis\n done\n done\n done\n subgoal\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: ex_assn_def)\n done\n done\n apply(rule Valid_pre_or)\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI1)\n by(auto simp add: ex_assn_def)\n done\n subgoal\n apply(rule Valid_ex_pre)\n subgoal for v\n apply (simp del: SCH_tr.simps)\n apply(rule Valid_strengthen_post)\n prefer 2\n apply(rule pre)\n apply(rule tassn_to_assn)\n apply(simp del: SCH_tr.simps add: join_assoc)\n apply(rule entails_tassn_cancel_left)\n unfolding entails_tassn_def\n apply(rule allI)\n apply(rule impI)\n unfolding disj_assn_def SCH_tr.simps\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n apply(rule disjI2)\n by(auto simp add: ex_assn_def)\n done\n done\n done\n done\n done\n\n\n\n \n\n\n\n\nend", "meta": {"author": "AgHHL", "repo": "lics2023", "sha": "e2ea9c15a8c0e1bf658679274ee87f30baf4abc3", "save_path": "github-repos/isabelle/AgHHL-lics2023", "path": "github-repos/isabelle/AgHHL-lics2023/lics2023-e2ea9c15a8c0e1bf658679274ee87f30baf4abc3/case2/sch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.25952216355204033}} {"text": "section {* Correctness of Type Checker *}\n\ntheory Wasm_Checker_Properties imports Wasm_Checker Wasm_Properties begin\n\nsubsection {* Soundness *}\n\nlemma b_e_check_single_type_sound:\n assumes \"type_update (Type x1) (to_ct_list t_in) (Type t_out) = Type x2\"\n \"c_types_agree (Type x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (Type x1) tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms(2) b_e_typing.weakening[OF assms(3)] type_update_type[OF assms(1)]\n by auto\n\nlemma b_e_check_single_top_sound:\n assumes \"type_update (TopType x1) (to_ct_list t_in) (Type t_out) = TopType x2\"\n \"c_types_agree (TopType x2) tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree (TopType x1) tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n obtain t_ag where t_ag_def:\"ct_suffix (to_ct_list t_out) x2\"\n \"tm = t_ag @ t_out\"\n \"c_types_agree (TopType x1) (t_ag @ t_in)\"\n using type_update_top_top[OF assms(1,2)]\n by fastforce\n hence \"\\ \\ [e] : (t_ag@t_in _> t_ag@t_out)\"\n using b_e_typing.weakening[OF assms(3)]\n by fastforce\n thus ?thesis\n using t_ag_def\n by fastforce\nqed\n\nlemma b_e_check_single_top_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (TopType []) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n shows \"\\tn. c_types_agree ts tn \\ suffix t_in tn\"\nproof (cases ts)\n case (TopType x1)\n then obtain t_int where \"consume (TopType x1) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using TopType ct_suffix_ct_list_compat_exists ct_suffix_ts_conv_suffix\n unfolding consume.simps\n by (metis append_Nil c_types_agree.simps(2) ct_suffix_def)\nnext\n case (Type x2)\n then obtain t_int where \"consume (Type x2) (to_ct_list t_in) = t_int\" \"t_int \\ Bot\"\n using assms(1,2,3)\n by fastforce\n thus ?thesis\n using c_types_agree_id Type consume_type suffixI ct_suffix_ts_conv_suffix\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_type_not_bot_sound:\n assumes \"type_update ts (to_ct_list t_in) (Type t_out) = ts'\"\n \"ts \\ Bot\"\n \"ts' \\ Bot\"\n \"c_types_agree ts' tm\"\n \"\\ \\ [e] : (t_in _> t_out)\"\n shows \"\\tn. c_types_agree ts tn \\ \\ \\ [e] : (tn _> tm)\"\n using assms b_e_check_single_type_sound\nproof (cases ts)\n case (TopType x1)\n then obtain x1' where x_def:\"TopType x1' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(1) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_top_sound TopType\n by fastforce\nnext\n case (Type x2)\n then obtain x2' where x_def:\"Type x2' = ts'\"\n using assms\n by (simp, metis (full_types) produce.simps(2) produce.simps(6))\n thus ?thesis\n using assms b_e_check_single_type_sound Type\n by fastforce\nnext\n case Bot\n thus ?thesis\n using assms(2)\n by simp\nqed\n\nlemma b_e_check_single_sound_unop_testop_cvtop:\n assumes \"check_single \\ e tn' = tm'\"\n \"(e = (Unop t uw) \\ unop_t_agree op t)\n \\ (e = (Testop t uv) \\ is_int_t t)\n \\ (e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\n \\ (e = (Cvtop t1 Reinterpret t sx) \\ ((t1 \\ t) \\ t_length t1 = t_length t \\ sx = None))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"(e = (Cvtop t1 Convert t sx) \\ convert_cond t1 t sx)\"\n using assms(2)\n by simp\n have 1:\"type_update tn' (to_ct_list [t]) (Type [arity_1_result e]) = tm'\"\n using assms arity_1_result_def\n unfolding to_ct_list_def\n apply (simp del: convert_cond.simps)\n apply fastforce\n done\n have \"\\ \\ [e] : ([t] _> [arity_1_result e])\"\n using assms(2) b_e_typing.intros(2,3,6,9,10)\n unfolding arity_1_result_def\n apply simp\n apply (metis (no_types, lifting) assms(1,5) b_e.simps(801,803,805) b_e_typing.reinterpret b_e_typing.testop check_single.simps(2))\n done\n thus ?thesis\n using b_e_check_single_type_not_bot_sound[OF 1 assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_check_single_sound_binop_relop:\n assumes \"check_single \\ e tn' = tm'\"\n \"((e = Binop t iop \\ binop_t_agree op t)\n \\ (e = Relop t irop \\ relop_t_agree irop t))\"\n \"c_types_agree tm' tm\"\n \"tn' \\ Bot\"\n \"tm' \\ Bot\"\n shows \"\\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\nproof -\n have \"type_update tn' (to_ct_list [t,t]) (Type [arity_2_result e]) = tm'\"\n using assms arity_2_result_def\n unfolding to_ct_list_def\n by auto\n moreover\n have \"\\ \\ [e] : ([t,t] _> [arity_2_result e])\"\n using assms(2) b_e_typing.intros(4,5,7,8)\n unfolding arity_2_result_def\n by (metis (no_types) assms(1,2,5) b_e.simps(802,804) b_e_typing.relop binop check_single.simps(3))\n ultimately\n show ?thesis\n using b_e_check_single_type_not_bot_sound[OF _ assms(4,5,3)]\n by fastforce\nqed\n\nlemma b_e_type_checker_sound:\n assumes \"b_e_type_checker \\ es (tn _> tm)\"\n shows \"\\ \\ es : (tn _> tm)\"\nproof -\n fix e tn'\n have \"b_e_type_checker \\ es (tn _> tm) \\\n \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check \\ es tn' = tm' \\\n c_types_agree tm' tm \\\n \\tn. c_types_agree tn' tn \\ \\ \\ es : (tn _> tm)\"\n and \"\\tm' tm.\n check_single \\ e tn' = tm' \\\n c_types_agree tm' tm \\\n tn' \\ Bot \\\n tm' \\ Bot \\\n \\tn. c_types_agree tn' tn \\ \\ \\ [e] : (tn _> tm)\"\n proof (induction rule: b_e_type_checker_check_check_single.induct)\n case (1 \\ es tn' tm)\n thus ?case\n by simp\n next\n case (2 \\ es' ts)\n show ?case\n proof (cases es')\n case Nil\n thus ?thesis\n using 2(5,6)\n by (simp add: b_e_type_empty)\n next\n case (Cons e es)\n thus ?thesis\n proof (cases ts)\n case (TopType x1)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) TopType Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(2)[OF Cons TopType check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(1)[OF Cons _ ts'_def] TopType c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case (Type x2)\n have check_expand:\"check \\ es (check_single \\ e ts) = tm'\"\n using 2(5,6) Type Cons\n by simp\n obtain ts' where ts'_def:\"check_single \\ e ts = ts'\"\n by blast\n obtain t_int where t_int_def:\"\\ \\ es : (t_int _> tm)\"\n \"c_types_agree ts' t_int\"\n using 2(4)[OF Cons Type check_expand 2(6)] ts'_def\n by blast\n obtain t_int' where \"c_types_agree ts t_int'\" \"\\ \\ [e] : (t_int' _> t_int)\"\n using 2(3)[OF Cons _ ts'_def] Type c_types_agree.simps(3) t_int_def(2)\n by blast\n thus ?thesis\n using t_int_def(1) b_e_type_comp_conc Cons\n by fastforce\n next\n case Bot\n then show ?thesis\n using 2(5,6) Cons\n by auto\n qed\n qed\n next\n case (3 \\ v ts)\n hence \"type_update ts [] (Type [typeof v]) = tm'\"\n by simp\n moreover\n have \"\\ \\ [C v] : ([] _> [typeof v])\"\n using b_e_typing.intros(1)\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 3(3,4,2)]\n by (metis list.simps(8) to_ct_list_def)\n next\n case (4 \\ t op ts)\n hence \"unop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 4\n by fastforce\n next\n case (5 \\ t op ts)\n hence \"binop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 5\n by fastforce\n next\n case (6 \\ t op ts)\n hence \"is_int_t t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 6\n by fastforce\n next\n case (7 \\ t op ts)\n hence \"relop_t_agree op t\"\n by (simp, meson)\n thus ?case\n using b_e_check_single_sound_binop_relop 7\n by fastforce\n next\n case (8 \\ t1 t2 sx ts)\n hence \"convert_cond t1 t2 sx\"\n by (simp del: convert_cond.simps, meson)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 8\n by fastforce\n next\n case (9 \\ t1 t2 sx ts)\n hence \"t1 \\ t2 \\ t_length t1 = t_length t2 \\ sx = None\"\n by (simp, presburger)\n thus ?case\n using b_e_check_single_sound_unop_testop_cvtop 9\n by fastforce\n next\n case (10 \\ ts)\n thus ?case\n using b_e_typing.intros(8) c_types_agree_not_bot_exists\n by blast\n next\n case (11 \\ ts)\n thus ?case\n using b_e_typing.intros(9,32)\n by fastforce\n next\n case (12 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n thus ?thesis\n proof (cases x1 rule: List.rev_cases)\n case Nil\n have \"\\ \\ [Drop] : (tm@[T_i32] _> tm)\"\n using b_e_typing.intros(10,32)\n by fastforce\n thus ?thesis\n using c_types_agree_top1 Nil TopType\n by fastforce\n next\n case (snoc ys y)\n hence temp1:\"(consume (TopType (ys@[y])) [TAny]) = tm'\"\n using 12 TopType type_update_empty\n by (metis check_single.simps(10))\n hence temp2:\"c_types_agree (TopType ys) tm\"\n using consume_top_geq[OF temp1] 12(2,3,4)\n by (metis Suc_leI add_diff_cancel_right' append_eq_conv_conj consume.simps(2)\n ct_suffix_def length_Cons length_append list.size(3) trans_le_add2\n zero_less_Suc)\n obtain t where \"ct_list_compat [y] (to_ct_list [t])\"\n using ct_list_compat_exists\n unfolding ct_list_compat_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_compat snoc TopType\n by (simp add: to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(10,32)\n by fastforce\n qed\n next\n case (Type x2)\n thus ?thesis\n proof (cases x2 rule: List.rev_cases)\n case Nil\n hence \"(consume (Type []) [TAny]) = tm'\"\n using 12 Type type_update_empty\n by fastforce\n thus ?thesis\n using 12(4) ct_list_compat_def ct_suffix_def to_ct_list_def\n by simp\n next\n case (snoc ys y)\n hence temp1:\"(consume (Type (ys@[y])) [TAny]) = tm'\"\n using 12 Type type_update_empty\n by (metis check_single.simps(10))\n hence temp2:\"c_types_agree (Type ys) tm\"\n using 12(2,3,4) ct_suffix_def\n by (simp, metis One_nat_def butlast_conv_take butlast_snoc c_types_agree.simps(1)\n length_Cons list.size(3))\n obtain t where \"ct_list_compat [TSome y] (to_ct_list [t])\"\n using ct_list_compat_exists\n unfolding ct_list_compat_def to_ct_list_def list_all2_map2\n by (metis list_all2_Cons1 list_all2_Nil)\n hence \"c_types_agree ts (tm@[t])\"\n using temp2 ct_suffix_extend_ct_list_compat snoc Type\n by (simp add: ct_list_compat_def to_ct_list_def)\n thus ?thesis\n using b_e_typing.intros(10,32)\n by fastforce\n qed\n qed simp\n next\n case (13 \\ ts)\n thus ?case\n proof (cases ts)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"tm' = TopType [TAny]\"\n using TopType 13\n by simp\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 13(2) ct_suffix_def\n by (simp, metis Nil_is_append_conv append_butlast_last_id checker_type.inject(1)\n ct_prefixI ct_prefix_nil(2) produce.simps(1) produce_nil)\n have \"\\ \\ [Select] : ([t'',t'',T_i32] _> [t''])\"\n using b_e_typing.intros(11)\n by blast\n thus ?thesis\n using TopType 13 1 tm_def b_e_typing.intros(32) c_types_agree.simps(2) c_types_agree_top1\n by fastforce\n next\n case 2\n have \"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n unfolding check_single.simps\n by simp\n hence x1_def:\"ct_list_compat x1 [TSome T_i32]\" \"tm' = TopType [TAny]\"\n using type_update_select_length1[OF _ 2 13(4)]\n by simp_all\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n using 13(2) ct_suffix_def\n by (metis Nil_is_append_conv append_butlast_last_id c_types_agree.simps(2) ct_prefixI\n ct_prefix_nil(2) list.simps(8) to_ct_list_def)\n have \"c_types_agree (TopType x1) ((tm''@[t'',t''])@[T_i32])\"\n using x1_def(1)\n by (metis c_types_agree_top2 list.simps(8,9) to_ct_list_def)\n thus ?thesis\n using TopType b_e_typing.intros(11,32) tm_def\n by auto\n next\n case 3\n have \"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n unfolding check_single.simps\n by simp\n then obtain ct1 ct2 where x1_def:\"x1 = [ct1, ct2]\"\n \"ct_compat ct2 (TSome T_i32)\"\n \"tm' = TopType [ct1]\"\n using type_update_select_length2[OF _ 3 13(4)]\n by blast\n then obtain t'' tm'' where tm_def:\"tm = tm''@[t'']\"\n \"ct_list_compat [ct1] [(TSome t'')]\"\n using 13(2) c_types_agree_imp_ct_list_compat[of \"[ct1]\" tm]\n by (metis append_Nil2 append_butlast_last_id append_eq_append_conv_if append_eq_conv_conj\n ct_list_compat_length diff_Suc_1 length_Cons length_butlast length_map\n list.simps(8,9) list.size(3) nat.distinct(2) to_ct_list_def)\n hence \"ct_list_compat x1 (to_ct_list [ t'', T_i32])\"\n using x1_def(1,2)\n unfolding ct_list_compat_def to_ct_list_def\n by fastforce\n hence \"c_types_agree (TopType x1) ((tm''@[t''])@[t'',T_i32])\"\n using c_types_agree_top2\n by blast\n thus ?thesis\n using TopType b_e_typing.intros(11,32) tm_def\n by auto\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n hence tm'_def:\"type_update_select (TopType x1) = tm'\"\n using 13 TopType\n by simp\n then obtain tm_int where \"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = tm_int\"\n \"tm_int \\ Bot\"\n using nat_def 13(4)\n unfolding type_update_select.simps\n by fastforce\n then obtain x2 where x2_def:\"(select_return_top x1\n (x1 ! (length x1 - 2))\n (x1 ! (length x1 - 3))) = TopType x2\"\n using select_return_top_exists\n by fastforce\n have \"ct_suffix x1 [TAny, TAny, TSome T_i32] \\ ct_suffix [TAny, TAny, TSome T_i32] x1\"\n using tm'_def nat_def 13(4)\n by (simp, metis (full_types) produce.simps(6))\n hence tm'_eq:\"tm' = TopType x2\"\n using tm'_def nat_def 13(4) x2_def\n by force\n then obtain cts' ct1 ct2 ct3 where cts'_def:\"x1 = cts'@[ct1, ct2, ct3]\"\n \"ct_compat ct3 (TSome T_i32)\"\n using type_update_select_length3 tm'_def 4\n by blast\n then obtain c' cm' where tm_def:\"tm = cm'@[c']\"\n \"ct_suffix cts' (to_ct_list cm')\"\n \"ct_compat (x1 ! (length x1 - 2)) (TSome c')\"\n \"ct_compat (x1 ! (length x1 - 3)) (TSome c')\"\n using select_return_top_ct_compat[OF x2_def 4] tm'_eq 4 13(2)\n by fastforce\n then obtain as bs where cm'_def:\"cm' = as@bs\"\n \"ct_list_compat (to_ct_list bs) cts'\"\n using ct_list_compat_cons_ct_list1 ct_list_compat_ts_conv_eq\n by (metis ct_suffix_def to_ct_list_append(2))\n hence \"ct_compat ct1 (TSome c')\"\n \"ct_compat ct2 (TSome c')\"\n using cts'_def tm_def\n apply simp_all\n apply (metis append.assoc append_Cons append_Nil length_append_singleton nth_append_length)\n done\n hence \"c_types_agree ts (cm'@[c',c',T_i32])\"\n using c_types_agree_top2[of _ _ as] cm'_def(1) TopType\n ct_list_compat_concat[OF ct_list_compat_commute[OF cm'_def(2)]] cts'_def\n unfolding to_ct_list_def ct_list_compat_def\n by fastforce\n thus ?thesis\n using b_e_typing.intros(11,32) tm_def\n by auto\n qed\n next\n (* TODO: refactor *)\n case (Type x2)\n hence x2_cond:\"(length x2 \\ 3 \\ (x2!(length x2-2)) = (x2!(length x2-3)))\"\n using 13\n by (simp, meson)\n hence tm'_def:\"consume (Type x2) [TAny, TSome T_i32] = tm'\"\n using 13 Type\n by simp\n obtain ts' ts'' where cts_def:\"x2 = ts'@ ts''\" \"length ts'' = 3\"\n using x2_cond\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain t1 ts''2 where \"ts'' = t1#ts''2\" \"length ts''2 = Suc (Suc 0)\"\n using List.length_Suc_conv[of ts' \"Suc (Suc 0)\"]\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain t2 t3 where \"ts'' = [t1,t2,t3]\"\n using List.length_Suc_conv[of ts''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n hence cts_def2:\"x2 = ts'@ [t1,t2,t3]\"\n using cts_def\n by simp\n have ts'_suffix:\"ct_suffix [TAny, TSome T_i32] (to_ct_list (ts' @ [t1, t2, t3]))\"\n using tm'_def 13(4)\n by (simp, metis cts_def2)\n hence tm'_def:\"tm' = Type (ts'@[t1])\"\n using tm'_def 13(4) cts_def2\n by simp\n obtain as bs where \"(to_ct_list (ts' @ [t1])) @ (to_ct_list ([t2, t3])) = as@bs\"\n \"ct_list_compat bs [TAny, TSome T_i32]\"\n using ts'_suffix\n unfolding ct_suffix_def to_ct_list_def\n by fastforce\n hence \"t3 = T_i32\"\n unfolding to_ct_list_def ct_list_compat_def\n by (metis (no_types, lifting) Nil_is_map_conv append_eq_append_conv ct_compat.simps(1)\n length_Cons list.sel(1,3) list.simps(9) list_all2_Cons2 list_all2_lengthD)\n moreover\n have \"t1 = t2\"\n using x2_cond cts_def2\n by (simp, metis append.left_neutral append_Cons append_assoc length_append_singleton\n nth_append_length)\n ultimately\n have \"c_types_agree (Type x2) ((ts'@[t1,t1])@[T_i32])\"\n using cts_def2\n by simp\n thus ?thesis\n using b_e_typing.intros(11,32) Type tm'_def 13(2)\n by fastforce\n qed simp\n next\n case (14 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 14\n by (simp, meson)\n hence \"\\ \\ [Block (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(12)[OF _ 14(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 14(4,5,3)]\n by blast\n next\n case (15 \\ tn'' tm'' es ts)\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tn''] @ (label \\))\\) es (tn'' _> tm''))\"\n using 15\n by (simp, meson)\n hence \"\\ \\ [Loop (tn'' _> tm'') es] : (tn'' _> tm'')\"\n using b_e_typing.intros(13)[OF _ 15(1)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 15(4,5,3)]\n by blast\n next\n case (16 \\ tn'' tm'' es1 es2 ts)\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n by auto\n moreover\n have \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es1 (tn'' _> tm''))\"\n \"(b_e_type_checker (\\\\label := ([tm''] @ (label \\))\\) es2 (tn'' _> tm''))\"\n using 16\n by (simp, meson)+\n hence \"\\ \\ [If (tn'' _> tm'') es1 es2] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(14)[OF _ 16(1,2)]\n by blast\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 16(5,6,4)]\n by blast\n next\n case (17 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i)) (TopType []) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 17\n by (simp, meson)\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 17(3,4)]\n b_e_typing.intros(15)\n b_e_typing.intros(32)\n by (metis suffix_def)\n next\n case (18 \\ i ts)\n hence \"type_update ts (to_ct_list ((label \\)!i @ [T_i32])) (Type ((label \\)!i)) = tm'\"\n by auto\n moreover\n have \"i < length (label \\)\"\n using 18\n by (simp, meson)\n hence \"\\ \\ [Br_if i] : ((label \\)!i @ [T_i32] _> (label \\)!i)\"\n using b_e_typing.intros(16)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 18(3,4,2)]\n by fastforce\n next\n case (19 \\ \"is\" i ts)\n then obtain tls where tls_def:\"(same_lab (is@[i]) (label \\)) = Some tls\"\n by fastforce\n hence \"type_update ts (to_ct_list (tls @ [T_i32])) (TopType []) = tm'\"\n using 19\n by simp\n thus ?case\n using b_e_check_single_top_not_bot_sound[OF _ 19(3,4)]\n b_e_typing.intros(17)[OF same_lab_conv_list_all[OF tls_def]]\n b_e_typing.intros(32)\n by (metis suffix_def)\n next\n case (20 \\ ts)\n then obtain ts_r where \"(return \\) = Some ts_r\"\n by fastforce\n moreover\n hence \"type_update ts (to_ct_list ts_r) (TopType []) = tm'\"\n using 20\n by simp\n ultimately\n show ?case\n using b_e_check_single_top_not_bot_sound[OF _ 20(3,4)]\n b_e_typing.intros(18,32)\n by (metis suffix_def)\n next\n case (21 \\ i ts)\n obtain tn'' tm'' where func_def:\"(func_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list tn'') (Type tm'') = tm'\"\n using 21\n by auto\n moreover\n have \"i < length (func_t \\)\"\n using 21\n by (simp, meson)\n hence \"\\ \\ [Call i] : (tn'' _> tm'')\"\n using b_e_typing.intros(19) func_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 21(3,4,2)]\n by fastforce\n next\n case (22 \\ i ts)\n obtain tn'' tm'' where type_def:\"(types_t \\)!i = (tn'' _> tm'')\"\n using tf.exhaust\n by blast\n hence \"type_update ts (to_ct_list (tn''@[T_i32])) (Type tm'') = tm'\"\n using 22\n by auto\n moreover\n have \"length (table \\) \\ 1 \\ i < length (types_t \\)\"\n using 22\n by (simp, meson)\n hence \"\\ \\ [Call_indirect i] : (tn''@[T_i32] _> tm'')\"\n using b_e_typing.intros(20) type_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 22(3,4,2)]\n by fastforce\n next\n case (23 \\ i ts)\n hence \"type_update ts [] (Type [(local \\)!i]) = tm'\"\n by auto\n moreover\n have \"i < length (local \\)\"\n using 23\n by (simp, meson)\n hence \"\\ \\ [Get_local i] : ([] _> [(local \\)!i])\"\n using b_e_typing.intros(21)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 23(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (24 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 24\n by (simp, meson)\n hence \"\\ \\ [Set_local i] : ([(local \\)!i] _> [])\"\n using b_e_typing.intros(22)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 24(3,4,2)]\n by fastforce\n next\n case (25 \\ i ts)\n hence \"type_update ts (to_ct_list [(local \\)!i]) (Type [(local \\)!i]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (local \\)\"\n using 25\n by (simp, meson)\n hence \"\\ \\ [Tee_local i] : ([(local \\)!i] _> [(local \\)!i])\"\n using b_e_typing.intros(23)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 25(3,4,2)]\n by fastforce\n next\n case (26 \\ i ts)\n hence \"type_update ts [] (Type [tg_t ((global \\)!i)]) = tm'\"\n by auto\n moreover\n have \"i < length (global \\)\"\n using 26\n by (simp, meson)\n hence \"\\ \\ [Get_global i] : ([] _> [tg_t ((global \\)!i)])\"\n using b_e_typing.intros(24)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 26(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (27 \\ i ts)\n hence \"type_update ts (to_ct_list [tg_t ((global \\)!i)]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"i < length (global \\) \\ is_mut (global \\ ! i)\"\n using 27\n by (simp, meson)\n then obtain t where \"(global \\ ! i) = \\tg_mut = T_mut, tg_t = t\\\" \"i < length (global \\)\"\n unfolding is_mut_def\n by (cases \"global \\ ! i\", auto)\n hence \"\\ \\ [Set_global i] : ([tg_t (global \\ ! i)] _> [])\"\n using b_e_typing.intros(25)[of i \\ \"tg_t (global \\ ! i)\"]\n unfolding is_mut_def tg_t_def\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 27(3,4,2)]\n by fastforce\n next\n case (28 \\ t tp_sx a off ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [t]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \\ load_store_t_bounds a (option_projl tp_sx) t\"\n using 28\n by (simp, meson)\n hence \"\\ \\ [Load t tp_sx a off] : ([T_i32] _> [t])\"\n using b_e_typing.intros(26)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 28(3,4,2)]\n by fastforce\n next\n case (29 \\ t tp a off ts)\n hence \"type_update ts (to_ct_list [T_i32,t]) (Type []) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \\ load_store_t_bounds a tp t\"\n using 29\n by (simp, meson)\n hence \"\\ \\ [Store t tp a off] : ([T_i32,t] _> [])\"\n using b_e_typing.intros(27)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 29(3,4,2)]\n by fastforce\n next\n case (30 \\ ts)\n hence \"type_update ts [] (Type [T_i32]) = tm'\"\n by auto\n moreover\n have \"length (memory \\) \\ 1 \" \n using 30\n by (simp, meson)\n hence \"\\ \\ [Current_memory] : ([] _> [T_i32])\"\n using b_e_typing.intros(28)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 30(3,4,2)]\n unfolding to_ct_list_def\n by (metis list.map_disc_iff)\n next\n case (31 \\ ts)\n hence \"type_update ts (to_ct_list [T_i32]) (Type [T_i32]) = tm'\"\n unfolding to_ct_list_def\n by auto\n moreover\n have \"length (memory \\) \\ 1 \" \n using 31\n by (simp, meson)\n hence \"\\ \\ [Grow_memory] : ([T_i32] _> [T_i32])\"\n using b_e_typing.intros(29)\n by fastforce\n ultimately\n show ?case\n using b_e_check_single_type_not_bot_sound[OF _ 31(3,4,2)]\n by fastforce\n qed\n thus ?thesis\n using assms\n by simp\nqed\n\nsubsection {* Completeness *}\n\nlemma check_single_imp:\n assumes \"check_single \\ e ctn = ctm\"\n \"ctm \\ Bot\"\n shows \"check_single \\ e = id\n \\ check_single \\ e = (\\ctn. type_update_select ctn)\n \\ (\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using assms\n apply (cases rule: check_single.cases[of \"(\\, e, ctn)\"])\n apply (fastforce split: if_splits option.splits tf.splits)+\n done\n\nlemma check_equiv_fold:\n \"check \\ es ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts es\"\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n obtain ts' where ts'_def:\"check \\ (e # es) ts = ts'\"\n by blast\n show ?case\n proof (cases \"ts = Bot\")\n case True\n thus ?thesis\n using ts'_def\n by (induction es, simp_all)\n next\n case False\n thus ?thesis\n using ts'_def Cons\n by (cases ts, simp_all)\n qed\nqed\n\nlemma check_neq_bot_snoc:\n assumes \"check \\ (es@[e]) ts \\ Bot\"\n shows \"check \\ es ts \\ Bot\"\n using assms\nproof (induction es arbitrary: ts)\n case Nil\n thus ?case\n by (cases ts, simp_all)\nnext\n case (Cons a es)\n thus ?case\n by (cases ts, simp_all)\nqed\n\nlemma check_unfold_snoc:\n assumes \"check \\ es ts \\ Bot\"\n shows \"check \\ (es@[e]) ts = check_single \\ e (check \\ es ts)\"\nproof -\n obtain f where f_def:\"f = (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts))\"\n by blast\n have f_simp:\"\\ts. ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n proof -\n fix ts\n show \"ts \\ Bot \\ (f e ts = check_single \\ e ts)\"\n using f_def\n by (cases ts, simp_all)\n qed\n have \"check \\ (es@[e]) ts = foldl (\\ ts e. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) ts (es@[e])\"\n using check_equiv_fold\n by simp\n also\n have \"... = foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev (es@[e])) ts\"\n using foldl_conv_foldr\n by fastforce\n also\n have \"... = f e (foldr (\\ e ts. (case ts of Bot \\ Bot | _ \\ check_single \\ e ts)) (rev es) ts)\"\n using f_def\n by simp\n also\n have \"... = f e (check \\ es ts)\"\n using foldr_conv_foldl[of _ \"(rev es)\" ts] rev_rev_ident[of es] check_equiv_fold\n by simp\n also\n have \"... = check_single \\ e (check \\ es ts)\"\n using assms f_simp\n by simp\n finally\n show ?thesis .\nqed\n\nlemma check_single_imp_weakening:\n assumes \"check_single \\ e (Type t1s) = ctm\"\n \"ctm \\ Bot\"\n \"c_types_agree ctn t1s\"\n \"c_types_agree ctm t2s\"\n shows \"\\ctm'. check_single \\ e ctn = ctm' \\ c_types_agree ctm' t2s\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1,3,4)\n by fastforce\n next\n (* TODO: better proof *)\n case 2\n note outer_2 = 2\n hence t1s_cond:\"(length t1s \\ 3 \\ (t1s!(length t1s-2)) = (t1s!(length t1s-3)))\"\n using assms(1,2)\n by (simp, meson)\n hence ctm_def:\"ctm = consume (Type t1s) [TAny, TSome T_i32]\"\n using assms(1,2) 2\n by simp\n then obtain c_t where c_t_def:\"ctm = Type c_t\"\n using assms(2)\n by (meson consume.simps(1))\n hence t2s_eq:\"t2s = c_t\"\n using assms(4)\n by simp\n hence t2s_len:\"length t2s > 0\"\n using t1s_cond ctm_def c_t_def assms(2)\n by (metis Suc_leI Suc_n_not_le_n checker_type.inject(2) consume.simps(1)\n diff_is_0_eq dual_order.trans length_0_conv length_Cons length_greater_0_conv\n nat.simps(3) numeral_3_eq_3 take_eq_Nil)\n have t1s_suffix_full:\"ct_suffix [TAny, TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis consume.simps(1))\n hence t1s_suffix:\"ct_suffix [TSome T_i32] (to_ct_list t1s)\"\n using assms(2) ctm_def ct_suffix_less\n by (metis append_butlast_last_id last.simps list.distinct(1))\n obtain t t1s' where t1s_suffix2:\"t1s = t1s'@[t,t,T_i32]\"\n using type_update_select_type_length3 assms(1) c_t_def outer_2\n by fastforce\n hence t2s_def:\"t2s = t1s'@[t]\"\n using ctm_def c_t_def t2s_eq t1s_suffix assms(2) t1s_suffix_full\n by simp\n show ?thesis\n using assms(1,3,4)\n proof (cases ctn)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = 1\"\n | (3) \"length x1 = 2\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof (cases)\n case 1\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using 2 TopType\n by simp\n thus ?thesis\n using ct_suffix_singleton to_ct_list_def t2s_len\n by auto\n next\n case 2\n hence \"ct_suffix [TSome T_i32] x1\"\n using assms(3) TopType ct_suffix_imp_ct_list_compat ct_suffix_shared t1s_suffix\n by (metis One_nat_def append_Nil c_types_agree.simps(2) ct_list_compat_commute ct_suffix_def\n diff_self_eq_0 drop_0 length_Cons list.size(3))\n hence \"check_single \\ e ctn = TopType [TAny]\"\n using outer_2 TopType 2\n by simp\n thus ?thesis\n using t2s_len ct_suffix_singleton\n by (simp add: to_ct_list_def)\n next\n case 3\n have \"ct_list_compat (to_ct_list t1s) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2\n by (simp add: ct_list_compat_ts_conv_eq)\n hence temp1:\"to_ct_list t1s = (to_ct_list (t1s' @ [t])) @ (to_ct_list [t, T_i32])\"\n using t1s_suffix2 to_ct_list_def\n by simp\n hence \"ct_suffix (to_ct_list [t, T_i32]) (to_ct_list t1s)\"\n using ct_suffix_def[of \"(to_ct_list [t, T_i32])\" \"(to_ct_list t1s)\"]\n by (simp add: ct_suffix_cons_it)\n hence \"ct_suffix (to_ct_list [t, T_i32]) x1\"\n using assms(3) TopType 3\n by (simp, metis temp1 append_Nil ct_suffix_cons2 ct_suffix_def length_Cons length_map\n list.size(3) numeral_2_eq_2 to_ct_list_def)\n hence temp3:\"ct_list_compat (to_ct_list [t, T_i32]) x1\"\n using 3 ct_suffix_imp_ct_list_compat\n unfolding to_ct_list_def\n by (metis Suc_leI ct_list_compat_commute diff_is_0_eq drop_0 length_Cons length_map lessI\n list.size(3) numeral_2_eq_2)\n hence temp4:\"ct_suffix [TSome T_i32] x1\" \n using ct_suffix_less[of \"[TSome t]\" \"[TSome T_i32]\" x1]\n ct_suffix_extend_ct_list_compat[of \"[]\" \"[]\"] ct_suffix_nil\n unfolding to_ct_list_def\n by fastforce\n hence \"ct_suffix (take 1 x1) (to_ct_list [t])\"\n using temp3 ct_suffix_nil ct_list_compat_commute ct_suffix_extend_ct_list_compat[of \"[]\" \"[]\" \"(take 1 x1)\" \"(to_ct_list [t])\"]\n unfolding to_ct_list_def\n by (simp, metis butlast.simps(2) butlast_conv_take ct_list_compat_take diff_Suc_1 length_Cons\n list.distinct(1) list.size(3))\n thus ?thesis\n using TopType 2 3 ct_suffix_nil temp3 temp4 t2s_def to_ct_list_def\n apply (simp, safe)\n apply (metis append.assoc ct_suffix_def)\n done\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n obtain x1' x x' x'' where x1_split:\"x1 = x1'@[x,x',x'']\"\n proof -\n assume local_assms:\"(\\x1' x x' x''. x1 = x1' @ [x, x', x''] \\ thesis)\"\n obtain x1' x1'' where tn_split:\"x1 = x1'@x1''\"\n \"length x1'' = 3\"\n using 4\n by (metis append_take_drop_id diff_diff_cancel length_drop)\n then obtain x x1''2 where \"x1'' = x#x1''2\" \"length x1''2 = Suc (Suc 0)\"\n by (metis length_Suc_conv numeral_3_eq_3)\n then obtain x' x'' where tn''_def:\"x1''= [x,x',x'']\"\n using List.length_Suc_conv[of x1''2 \"Suc 0\"]\n by (metis length_0_conv length_Suc_conv)\n thus ?thesis\n using tn_split local_assms\n by simp\n qed\n hence a:\"ct_suffix (x1'@[x,x',x'']) (to_ct_list (t1s' @ [t, t, T_i32]))\"\n using t1s_suffix2 assms(3) TopType\n by simp\n hence b:\"ct_suffix (x1'@[x,x']) (to_ct_list (t1s' @ [t, t])) \\ (ct_compat x'' (TSome T_i32))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x,x'])\" \"x''\" \"to_ct_list (t1s' @ [t, t])\"]\n by fastforce\n hence c:\"ct_suffix (x1'@[x]) (to_ct_list (t1s' @ [t])) \\ (ct_compat x' (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1'@[x])\" \"x'\" \"to_ct_list (t1s' @ [t])\"]\n by fastforce\n hence d:\"ct_suffix x1' (to_ct_list t1s') \\ (ct_compat x (TSome t))\"\n using to_ct_list_def ct_suffix_unfold_one[of \"(x1')\" \"x\" \"to_ct_list (t1s')\"]\n by fastforce\n have \"(take (length x1 - 3) x1) = x1'\"\n using x1_split\n by simp\n have x'_ind:\"(x1!(length x1-2)) = x'\"\n using x1_split List.nth_append_length[of \"x1' @ [x]\"]\n by simp\n have x_ind:\"(x1!(length x1-3)) = x\"\n using x1_split\n by simp\n have \"ct_suffix [TSome T_i32] x1\"\n using b x1_split ct_suffix_def ct_list_compat_def ct_suffixI[of x1 \"x1' @ [x, x']\"]\n by simp\n hence \"check_single \\ e (TopType x1) = (select_return_top x1 (x1!(length x1-2)) (x1!(length x1-3)))\"\n using type_update_select_conv_select_return_top[OF _ 4]\n unfolding 2\n by blast\n moreover\n have \"... = (TopType (x1'@[x])) \\ ... = (TopType (x1'@[x']))\"\n apply (cases x; cases x')\n using x1_split 4 nat_def 2 x_ind x'_ind c d\n by simp_all\n moreover\n have \"ct_suffix (x1'@[x]) (to_ct_list t2s)\"\n by (simp add: c t2s_def)\n moreover\n have \"ct_suffix (x1'@[x']) (to_ct_list t2s)\"\n using ct_suffix_unfold_one[symmetric, of x' \"(TSome t)\" x1' \"(to_ct_list t1s')\"] c d\n t2s_def\n unfolding to_ct_list_def\n by fastforce\n ultimately\n show ?thesis\n using TopType\n by auto\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where c_s_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence ctm_def:\"ctm = type_update (Type t1s) cons prods\"\n using assms(1)\n by fastforce\n hence cons_suffix:\"ct_suffix cons (to_ct_list t1s)\"\n using assms\n by (simp, metis (full_types) produce.simps(6))\n hence t_int_def:\"consume (Type t1s) cons = (Type (take (length t1s - length cons) t1s))\"\n using ctm_def\n by simp\n hence ctm_def2:\"ctm = produce (Type (take (length t1s - length cons) t1s)) prods\"\n using ctm_def\n by simp\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n hence \"ct_suffix x1 (to_ct_list t1s)\"\n using assms(3)\n by simp\n thus ?thesis\n using assms(2) ctm_def2\n proof (cases prods)\n case (TopType x1)\n thus ?thesis\n using consume_c_types_agree[OF t_int_def assms(3)] ctm_def2 assms(4) c_s_def\n by (metis c_types_agree.elims(2) produce.simps(3,4) type_update.simps)\n next\n case (Type x2)\n hence ctm_def3:\"ctm = Type ((take (length t1s - length cons) t1s)@ x2)\"\n using ctm_def2\n by simp\n have \"ct_suffix x1 cons \\ ct_suffix cons x1\"\n using ct_suffix_shared assms(3) TopType cons_suffix\n by auto\n thus ?thesis\n proof (rule disjE)\n assume \"ct_suffix x1 cons\"\n hence \"consume (TopType x1) cons = TopType []\"\n by (simp add: ct_suffix_length)\n hence \"check_single \\ e ctn = TopType (to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n thus ?thesis\n using TopType ctm_def3 assms(4) c_types_agree_top2 ct_list_compat_refl\n by auto\n next\n assume \"ct_suffix cons x1\"\n hence 4:\"consume (TopType x1) cons = TopType (take (length x1 - length cons ) x1)\"\n by (simp add: ct_suffix_length)\n hence 3:\"check_single \\ e ctn = TopType ((take (length x1 - length cons ) x1) @ to_ct_list x2)\"\n using c_s_def TopType Type\n by simp\n have \"((take (length t1s - length cons ) t1s) @ x2) = t2s\"\n using assms(4) ctm_def3\n by simp\n have \"c_types_agree (TopType (take (length x1 - length cons ) x1)) (take (length t1s - length cons) t1s)\"\n using consume_c_types_agree[OF t_int_def assms(3)] 4 TopType\n by simp\n hence \"c_types_agree (TopType (take (length x1 - length cons ) x1 @ to_ct_list x2)) (take (length t1s - length cons) t1s @ x2)\"\n unfolding c_types_agree.simps to_ct_list_def\n by (simp add: ct_suffix_cons2 ct_suffix_cons_it ct_suffix_extend_ct_list_compat)\n thus ?thesis\n using ctm_def3 assms 3\n by simp\n qed\n qed simp\n next\n case (Type x2)\n thus ?thesis\n using assms\n by simp\n next\n case Bot\n thus ?thesis\n using assms\n by simp\n qed\n qed\nqed\n\nlemma b_e_type_checker_compose:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n \"b_e_type_checker \\ [e] (t2s _> t3s)\"\n shows \"b_e_type_checker \\ (es @ [e]) (t1s _> t3s)\"\nproof -\n have \"c_types_agree (check_single \\ e (Type t2s)) t3s\"\n using assms(2)\n by simp\n then obtain ctm where ctm_def:\"check_single \\ e (Type t2s) = ctm\"\n \"c_types_agree ctm t3s\"\n \"ctm \\ Bot\"\n by fastforce\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n thus ?thesis\n using check_single_imp_weakening[OF ctm_def(1,3) ctn_def(2) ctm_def(2)]\n check_unfold_snoc[of \\ es \"(Type t1s)\" e]\n by simp\nqed\n\nlemma b_e_check_single_type_type:\n assumes \"check_single \\ e xs = (Type tm)\"\n shows \"\\tn. xs = (Type tn)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n note outer_2 = 2\n thus ?thesis\n using assms\n proof (cases xs)\n case (TopType x1)\n consider\n (1) \"length x1 = 0\"\n | (2) \"length x1 = Suc 0\"\n | (3) \"length x1 = Suc (Suc 0)\"\n | (4) \"length x1 \\ 3\"\n by linarith\n thus ?thesis\n proof cases\n case 1\n thus ?thesis\n using assms 2 TopType\n by simp\n next\n case 2\n thus ?thesis\n using assms outer_2 TopType produce_type_type\n by fastforce\n next\n case 3\n thus ?thesis\n using assms 2 TopType\n by (simp, metis checker_type.distinct(1) checker_type.distinct(5))\n next\n case 4\n then obtain nat where nat_def:\"length x1 = Suc (Suc (Suc nat))\"\n by (metis add_eq_if diff_Suc_1 le_Suc_ex numeral_3_eq_3 nat.distinct(2))\n thus ?thesis\n using assms 2 TopType\n proof -\n {\n assume a1: \"produce (if ct_suffix [TAny, TAny, TSome T_i32] x1 then TopType (take (length x1 - length [TAny, TAny, TSome T_i32]) x1) else if ct_suffix x1 [TAny, TAny, TSome T_i32] then TopType [] else Bot) (select_return_top x1 (x1 ! Suc nat) (x1 ! nat)) = Type tm\"\n obtain tts :: \"checker_type \\ t list\" where\n f2: \"\\c. (\\ca ts. produce c ca \\ Type ts) \\ c = Type (tts c)\"\n using produce_type_type by moura\n then have f3: \"\\ts. \\ ct_suffix [TAny, TAny, TSome T_i32] x1 \\ Type tm \\ Type ts\"\n using a1 by fastforce\n then have \"\\ts. \\ ct_suffix x1 [TAny, TAny, TSome T_i32] \\ Type tm \\ Type ts\"\n using f2 a1 by fastforce\n then have False\n using f3 a1 by fastforce\n }\n thus ?thesis\n using assms 2 TopType nat_def\n by simp\n qed\n qed\n qed simp_all\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume xs cons) prods = (Type tm)\"\n using assms(1)\n by simp\n thus ?thesis\n using assms check_def consume_type_type produce_type_type\n by blast\n qed\nqed\n\nlemma b_e_check_single_weaken_type:\n assumes \"check_single \\ e (Type tn) = (Type tm)\"\n shows \"check_single \\ e (Type (ts@tn)) = Type (ts@tm)\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms(1)\n by simp\n next\n case 2\n hence cond:\"(length tn \\ 3 \\ (tn!(length tn-2)) = (tn!(length tn-3)))\"\n using assms\n by (simp, metis checker_type.distinct(5))\n hence \"consume (Type tn) [TAny, TSome T_i32] = (Type tm)\"\n using assms 2\n by simp\n hence \"consume (Type (ts@tn)) [TAny, TSome T_i32] = (Type (ts@tm))\"\n using consume_weaken_type\n by blast\n moreover\n have \"(length (ts@tn) \\ 3 \\ ((ts@tn)!(length (ts@tn)-2)) = ((ts@tn)!(length (ts@tn)-3)))\"\n using cond\n by (simp, metis add.commute add_leE nth_append_length_plus numeral_Bit1 numeral_One\n one_add_one ordered_cancel_comm_monoid_diff_class.diff_add_assoc2)\n ultimately\n show ?thesis\n using 2\n by simp\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (Type tm)\"\n using assms(1)\n by simp\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis consume.simps(1) produce.simps(6))\n thus ?thesis\n using assms(1) check_def\n consume_weaken_type[OF t_int_def, of ts]\n produce_weaken_type[of t_int prods tm ts]\n by simp\n qed\nqed\n\nlemma b_e_check_single_weaken_top:\n assumes \"check_single \\ e (Type tn) = TopType tm\"\n shows \"check_single \\ e (Type (ts@tn)) = TopType tm\"\nproof -\n consider (1) \"check_single \\ e = id\" \n | (2) \"check_single \\ e = (\\ctn. type_update_select ctn)\"\n | (3) \"(\\cons prods. (check_single \\ e = (\\ctn. type_update ctn cons prods)))\"\n using check_single_imp assms\n by blast\n thus ?thesis\n proof (cases)\n case 1\n thus ?thesis\n using assms\n by simp\n next\n case 2\n thus ?thesis\n using assms\n by (simp, metis checker_type.distinct(1) checker_type.distinct(3) consume.simps(1))\n next\n case 3\n then obtain cons prods where check_def:\"check_single \\ e = (\\ctn. type_update ctn cons prods)\"\n by blast\n hence \"produce (consume (Type tn) cons) prods = (TopType tm)\"\n using assms(1)\n by simp\n moreover\n then obtain t_int where t_int_def:\"consume (Type tn) cons = (Type t_int)\"\n by (metis checker_type.distinct(3) consume.simps(1) produce.simps(6))\n ultimately\n show ?thesis\n using check_def consume_weaken_type\n by (cases prods, auto)\n qed\nqed\n\nlemma b_e_check_weaken_type:\n assumes \"check \\ es (Type tn) = (Type tm)\"\n shows \"check \\ es (Type (ts@tn)) = (Type (ts@tm))\"\n using assms\nproof (induction es arbitrary: tn tm rule: List.rev_induct)\n case Nil\n thus ?case\n by simp\nnext\n case (snoc e es)\n hence \"check_single \\ e (check \\ es (Type tn)) = Type tm\"\n using check_unfold_snoc[OF check_neq_bot_snoc]\n by (metis checker_type.distinct(5))\n thus ?case\n using b_e_check_single_weaken_type b_e_check_single_type_type snoc\n by (metis check_unfold_snoc checker_type.distinct(5))\nqed\n\nlemma check_bot: \"check \\ es Bot = Bot\"\n by (simp add: list.case_eq_if)\n\nlemma b_e_check_weaken_top:\n assumes \"check \\ es (Type tn) = (TopType tm)\"\n shows \"check \\ es (Type (ts@tn)) = (TopType tm)\"\n using assms\nproof (induction es arbitrary: tn tm)\n case Nil\n thus ?case\n by simp\nnext\n case (Cons e es)\n show ?case\n proof (cases \"(check_single \\ e (Type tn))\")\n case (TopType x1)\n hence \"check_single \\ e (Type (ts@tn)) = TopType x1\"\n using b_e_check_single_weaken_top\n by blast\n thus ?thesis\n using TopType Cons\n by simp\n next\n case (Type x2)\n hence \"check_single \\ e (Type (ts@tn)) = Type (ts@x2)\"\n using b_e_check_single_weaken_type\n by blast\n thus ?thesis\n using Cons Type\n by fastforce\n next\n case Bot\n thus ?thesis\n using check_bot Cons\n by simp\n qed\n \nqed\n\nlemma b_e_type_checker_weaken:\n assumes \"b_e_type_checker \\ es (t1s _> t2s)\"\n shows \"b_e_type_checker \\ es (ts@t1s _> ts@t2s)\"\nproof -\n have \"c_types_agree (check \\ es (Type t1s)) t2s\"\n using assms(1)\n by simp\n then obtain ctn where ctn_def:\"check \\ es (Type t1s) = ctn\"\n \"c_types_agree ctn t2s\"\n \"ctn \\ Bot\"\n by fastforce\n show ?thesis\n proof (cases ctn)\n case (TopType x1)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_top[of \\ es t1s x1 ts]\n by (metis append_assoc b_e_type_checker.simps c_types_agree_imp_ct_list_compat c_types_agree_top2)\n next\n case (Type x2)\n thus ?thesis\n using ctn_def(1,2) b_e_check_weaken_type[of \\ es t1s x2 ts]\n by simp\n next\n case Bot\n thus ?thesis\n using ctn_def(3)\n by simp\n qed\nqed\n\nlemma b_e_type_checker_complete:\n assumes \"\\ \\ es : (tn _> tm)\"\n shows \"b_e_type_checker \\ es (tn _> tm)\"\n using assms\nproof (induction es \"(tn _> tm)\" arbitrary: tn tm rule: b_e_typing.induct)\n case (select \\ t)\n have \"ct_list_compat [TAny, TSome T_i32] [TSome t, TSome T_i32]\"\n by (simp add: to_ct_list_def ct_list_compat_def)\n thus ?case\n using ct_suffix_extend_ct_list_compat[OF ct_suffix_nil[of \"[TSome t]\"]] to_ct_list_def\n by auto\nnext\n case (br_table \\ ts \"is\" i t1s t2s)\n show ?case\n using list_all_conv_same_lab[OF br_table]\n by (auto simp add: to_ct_list_def ct_suffix_nil ct_suffix_cons_it)\nnext\n case (set_global i \\ t)\n thus ?case\n using to_ct_list_def ct_suffix_refl is_mut_def tg_t_def\n by auto\nnext\n case (composition \\ es t1s t2s e t3s)\n thus ?case\n using b_e_type_checker_compose\n by simp\nnext\n case (weakening \\ es t1s t2s ts)\n thus ?case\n using b_e_type_checker_weaken\n by simp\nqed (auto simp add: to_ct_list_def ct_suffix_refl ct_suffix_nil ct_suffix_cons_it\n ct_suffix_singleton_any)\n\ntheorem b_e_typing_equiv_b_e_type_checker:\n shows \"(\\ \\ es : tf) = (b_e_type_checker \\ es tf)\"\n using b_e_type_checker_sound b_e_type_checker_complete\n by (metis tf.exhaust)\n\nend\n", "meta": {"author": "WasmCert", "repo": "WasmCert-Isabelle", "sha": "f61ec8eab5d551347a268e858e83b7ac7da0d8b5", "save_path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle", "path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle/WasmCert-Isabelle-f61ec8eab5d551347a268e858e83b7ac7da0d8b5/WebAssembly/Wasm_Checker_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.25952216355204033}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx_lemma_inv__1_on_rules imports n_mutualEx_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule Interp s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule Interp s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__1) done\n }\n\n ultimately show \"invHoldForRule Interp s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.4073334000459302, "lm_q1q2_score": 0.25948391944965465}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection \\EPIC Level 1 in the Strong Attacker Model\\\ntheory EPIC_L1_SA\n imports\n \"../Parametrized_Dataplane_3_directed\"\n \"../infrastructure/Keys\"\nbegin\n\ntype_synonym EPIC_HF = \"(unit, msgterm) HF\"\ntype_synonym UINFO = \"nat\"\n\nlocale epic_l1_defs = network_assums_direct _ _ _ auth_seg0 \n for auth_seg0 :: \"(msgterm \\ ahi list) set\" +\n fixes no_oracle :: \"msgterm \\ UINFO \\ bool\"\nbegin\n\n\n(******************************************************************************)\nsubsection \\Hop validation check and extract functions\\\n(******************************************************************************)\n\ntext\\The predicate @{term \"hf_valid\"} is given to the concrete parametrized model as a parameter.\nIt ensures the authenticity of the hop authenticator in the hop field. The predicate takes an authenticated\ninfo field (in this model always a numeric value, hence the matching on Num ts), an unauthenticated\ninfo field uinfo, the hop field to be validated and in some cases the next hop field.\n\nWe distinguish if there is a next hop field (this yields the two cases below). If there is not, then\nthe hop authenticator @{text \"\\\"} simply consists of a MAC over the authenticated info field and the local\nrouting information of the hop, using the key of the hop to which the hop field belongs. If on the\nother hand, there is a subsequent hop field, then the uhi field of that hop field is also included\nin the MAC computation.\n\nThe hop authenticator @{text \"\\\"} is used to compute both the hop validation field and the uhi field.\nThe first is computed as a MAC over the path origin (pair of absolute timestamp ts and the relative\ntimestamp given in uinfo), using the hop authenticator as a key to the MAC. The hop authenticator\nis not secret, and any end host can use it to create a valid hvf. The uhi field, according to the \nprotocol description, is @{text \"\\\"} shortened to a few bytes. We model this as applying the hash on @{text \"\\\"}.\n\nThe predicate @{term \"hf_valid\"} checks if the hop authenticator, hvf and uhi field are computed\ncorrectly.\\\nfun hf_valid :: \"msgterm \\ UINFO\n \\ EPIC_HF\n \\ EPIC_HF option \\ bool\" where \n \"hf_valid (Num ts) uinfo \\AHI = ahi, UHI = uhi, HVF = x\\ (Some \\AHI = ahi2, UHI = uhi2, HVF = x2\\) \\ \n (\\\\ upif downif. \\ = Mac[macKey (ASID ahi)] (L [Num ts, upif, downif, uhi2]) \\\n ASIF (DownIF ahi) downif \\ ASIF (UpIF ahi) upif \\ uhi = Hash \\ \\ x = Mac[\\] \\Num ts, Num uinfo\\)\"\n| \"hf_valid (Num ts) uinfo \\AHI = ahi, UHI = uhi, HVF = x\\ None \\ \n (\\\\ upif downif. \\ = Mac[macKey (ASID ahi)] (L [Num ts, upif, downif]) \\\n ASIF (DownIF ahi) downif \\ ASIF (UpIF ahi) upif \\ uhi = Hash \\ \\ x = Mac[\\] \\Num ts, Num uinfo\\)\"\n| \"hf_valid _ _ _ _ = False\"\n\ndefinition upd_uinfo :: \"nat \\ EPIC_HF \\ nat\" where\n \"upd_uinfo uinfo hf \\ uinfo\"\n\ntext\\We can extract the entire path from the uhi field, since it includes the hop authenticator, \nwhich includes the local forwarding information as well as, recursively, all upstream hop \nauthenticators and their hop information.\nHowever, the parametrized model defines the extract function to operate on the hop validation field,\nnot the uhi field. We therefore define a separate function that extracts the path from a hvf. \nWe can do so, as both hvf and uhi contain the hop authenticator.\nInternally, that function uses @{term \"extrUhi\"}.\\\nfun extrUhi :: \"msgterm \\ ahi list\" where\n \"extrUhi (Hash (Mac[macKey asid] (L [ts, upif, downif, uhi2])))\n = \\UpIF = term2if upif, DownIF = term2if downif, ASID = asid\\ # extrUhi uhi2\"\n| \"extrUhi (Hash (Mac[macKey asid] (L [ts, upif, downif])))\n = [\\UpIF = term2if upif, DownIF = term2if downif, ASID = asid\\]\"\n| \"extrUhi _ = []\"\n\ntext\\This function extracts from a hop validation field (HVF hf) the entire path.\\\nfun extr :: \"msgterm \\ ahi list\" where\n \"extr (Mac[\\] _) = extrUhi (Hash \\)\" \n | \"extr _ = []\"\n\ntext\\Extract the authenticated info field from a hop validation field.\\\nfun extr_ainfo :: \"msgterm \\ msgterm\" where \n \"extr_ainfo (Mac[_] \\Num ts, _\\) = Num ts\"\n| \"extr_ainfo _ = \\\"\n\nabbreviation term_ainfo :: \"msgterm \\ msgterm\" where\n \"term_ainfo \\ id\"\n\ntext\\When observing a hop field, an attacker learns the HVF and the UHI. The AHI only contains \npublic information that are not terms.\\\nfun terms_hf :: \"EPIC_HF \\ msgterm set\" where \n \"terms_hf hf = {HVF hf, UHI hf}\"\n\nabbreviation terms_uinfo :: \"UINFO \\ msgterm set\" where \n \"terms_uinfo x \\ {}\"\n\ntext\\An authenticated info field is always a number (corresponding to a timestamp). The \n unauthenticated info field is as well a number, representing combination of timestamp offset\n and SRC address.\\\ndefinition auth_restrict where \n \"auth_restrict ainfo uinfo l \\ (\\ts. ainfo = Num ts)\"\n\ntext\\We now define useful properties of the above definition.\\\nlemma hf_valid_invert:\n \"hf_valid tsn uinfo hf mo \\\n ((\\ahi ahi2 \\ ts upif downif asid x upif2 downif2 asid2 uhi uhi2 x2.\n hf = \\AHI = ahi, UHI = uhi, HVF = x\\ \\\n ASID ahi = asid \\ ASIF (DownIF ahi) downif \\ ASIF (UpIF ahi) upif \\\n mo = Some \\AHI = ahi2, UHI = uhi2, HVF = x2\\ \\\n ASID ahi2 = asid2 \\ ASIF (DownIF ahi2) downif2 \\ ASIF (UpIF ahi2) upif2 \\\n \\ = Mac[macKey asid] (L [tsn, upif, downif, uhi2]) \\\n tsn = Num ts \\\n uhi = Hash \\ \\\n x = Mac[\\] \\tsn, Num uinfo\\)\n \\ (\\ahi \\ ts upif downif asid uhi x.\n hf = \\AHI = ahi, UHI = uhi, HVF = x\\ \\\n ASID ahi = asid \\ ASIF (DownIF ahi) downif \\ ASIF (UpIF ahi) upif \\\n mo = None \\\n \\ = Mac[macKey asid] (L [tsn, upif, downif]) \\\n tsn = Num ts \\\n uhi = Hash \\ \\\n x = Mac[\\] \\tsn, Num uinfo\\)\n )\"\n apply(auto elim!: hf_valid.elims) using option.exhaust ASIF.simps by metis+\n\nlemma hf_valid_auth_restrict[dest]: \"hf_valid ainfo uinfo hf z \\ auth_restrict ainfo uinfo l\"\n by(auto simp add: hf_valid_invert auth_restrict_def)\n\nlemma auth_restrict_ainfo[dest]: \"auth_restrict ainfo uinfo l \\ \\ts. ainfo = Num ts\"\n by(auto simp add: auth_restrict_def)\n\nlemma info_hvf: \n assumes \"hf_valid ainfo uinfo m z\" \"HVF m = Mac[\\] \\ainfo', Num uinfo'\\ \\ hf_valid ainfo' uinfo' m z'\" \n shows \"uinfo = uinfo'\" \"ainfo' = ainfo\"\n using assms by(auto simp add: hf_valid_invert)\n\n\n(******************************************************************************)\nsubsection\\Definitions and properties of the added intruder knowledge\\\n(******************************************************************************)\ntext\\Here we define two sets which are added to the intruder knowledge: @{text \"ik_add\"}, which contains hop\nauthenticators. And @{text \"ik_oracle\"}, which contains the oracle's output to the strong attacker.\\\nprint_locale dataplane_3_directed_defs \nsublocale dataplane_3_directed_defs _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo term_ainfo \n terms_hf terms_uinfo upd_uinfo no_oracle\n by unfold_locales\n\nabbreviation is_oracle where \"is_oracle ainfo t \\ \\ no_oracle ainfo t \"\n\n\ndeclare TWu.holds_set_list[dest]\ndeclare TWu.holds_takeW_is_identity[simp]\ndeclare parts_singleton[dest]\n\ntext\\This additional Intruder Knowledge allows us to model the attacker's access not only to the \nhop validation fields and segment identifiers of authorized segments (which are already given in \n@{text \"ik_hfs\"}), but to the underlying hop authenticators that are used to create them.\\\n\ndefinition ik_add :: \"msgterm set\" where\n \"ik_add \\ { \\ | ainfo uinfo l hf \\. \n (ainfo::msgterm, l::(EPIC_HF list)) \\ \n ((local.auth_seg2 uinfo)::((msgterm \\ EPIC_HF list) set))\n \\ hf \\ set l \\ HVF hf = Mac[\\] \\ainfo, Num uinfo\\ }\"\n\nlemma ik_addI:\n \"\\(ainfo, l) \\ local.auth_seg2 uinfo; hf \\ set l; HVF hf = Mac[\\] \\ainfo, Num uinfo\\\\ \\ \\ \\ ik_add\"\n by(auto simp add: ik_add_def)\n\nlemma ik_add_form: \"t \\ local.ik_add \\ \\ asid l . t = Mac[macKey asid] l\"\n(* using [[unify_trace_failure]]*)\n by(auto simp add: ik_add_def auth_seg2_def dest!: TWu.holds_set_list)\n (auto simp add: hf_valid_invert)\n\nlemma parts_ik_add[simp]: \"parts ik_add = ik_add\"\n by (auto intro!: parts_Hash dest: ik_add_form)\n\ntext\\This is the oracle output provided to the adversary. Only those hop validation fields and \nsegment identifiers whose path origin (combination of ainfo uinfo) is not contained in \n@{term \"no_oracle\"} appears here.\\\ndefinition ik_oracle :: \"msgterm set\" where \n \"ik_oracle = {t | t ainfo hf l uinfo . hf \\ set l \\ hfs_valid_None ainfo uinfo l \\ \n is_oracle ainfo uinfo \\ (\\uinfo' . (ainfo, l) \\ auth_seg2 uinfo') \\ \n (t = HVF hf \\ t = UHI hf) }\"\n\nlemma ik_oracle_parts_form:\n\"t \\ ik_oracle \\ \n (\\ asid l ainfo uinfo . t = Mac[Mac[macKey asid] l] \\ainfo, uinfo\\) \\\n (\\ asid l . t = Hash (Mac[macKey asid] l))\"\n by(auto simp add: ik_oracle_def hf_valid_invert dest!: TWu.holds_set_list)\n\nlemma parts_ik_oracle[simp]: \"parts ik_oracle = ik_oracle\"\n by (auto intro!: parts_Hash dest: ik_oracle_parts_form)\n\nlemma ik_oracle_simp: \"t \\ ik_oracle \\\n (\\ainfo hf l uinfo. hf \\ set l \\ hfs_valid_None ainfo uinfo l \\ is_oracle ainfo uinfo\n \\ (\\uinfo'. (ainfo, l) \\ auth_seg2 uinfo') \\ (t = HVF hf \\ t = UHI hf))\"\n by(rule iffI, frule ik_oracle_parts_form)\n (auto simp add: ik_oracle_def hf_valid_invert)\n\n(******************************************************************************)\nsubsection\\Properties of the intruder knowledge, including @{text \"ik_add\"} and @{text \"ik_oracle\"}\\\n(******************************************************************************)\ntext\\We now instantiate the parametrized model's definition of the intruder knowledge, using the\ndefinitions of @{text \"ik_add\"} and @{text \"ik_oracle\"} from above. We then prove the properties \nthat we need to instantiate the @{text \"dataplane_3_directed\"} locale.\\\nsublocale\n dataplane_3_directed_ik_defs _ _ _ auth_seg0 terms_uinfo no_oracle hf_valid auth_restrict extr extr_ainfo term_ainfo \n terms_hf upd_uinfo ik_add ik_oracle \n by unfold_locales\n\nlemma ik_hfs_form: \"t \\ parts ik_hfs \\ \\ t' . t = Hash t'\"\n by(auto 3 4 simp add: auth_seg2_def hf_valid_invert)\n\ndeclare ik_hfs_def[simp del]\n\nlemma parts_ik_hfs[simp]: \"parts ik_hfs = ik_hfs\"\n by (auto intro!: parts_Hash ik_hfs_form)\n\ntext\\This lemma allows us not only to expand the definition of @{term \"ik_hfs\"}, but also \nto obtain useful properties, such as a term being a Hash, and it being part of a valid hop field.\\\nlemma ik_hfs_simp: \n \"t \\ ik_hfs \\ (\\t' . t = Hash t') \\ (\\hf . (t = HVF hf \\ t = UHI hf)\n \\ (\\hfs. hf \\ set hfs \\ (\\ainfo uinfo . (ainfo, hfs) \\ auth_seg2 uinfo\n \\ (\\nxt. hf_valid ainfo uinfo hf nxt))))\" (is \"?lhs \\ ?rhs\")\nproof \n assume asm: \"?lhs\" \n then obtain ainfo uinfo hf hfs where \n dfs: \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\" \"t = HVF hf \\ t = UHI hf\"\n by(auto simp add: ik_hfs_def)\n then have \"hfs_valid_None ainfo uinfo hfs\" \"(ainfo, AHIS hfs) \\ auth_seg0\"\n by(auto simp add: auth_seg2_def)\n then show \"?rhs\" using asm dfs \n using upd_uinfo_def \n by (auto 3 4 simp add: auth_seg2_def intro!: ik_hfs_form exI[of _ hf] exI[of _ hfs] \n dest: TWu.holds_set_list_no_update)\nqed(auto simp add: ik_hfs_def)\n\n(******************************************************************************)\nsubsubsection \\Properties of Intruder Knowledge\\\n(******************************************************************************)\nlemma auth_ainfo[dest]: \"\\(ainfo, hfs) \\ auth_seg2 uinfo\\ \\ \\ ts . ainfo = Num ts\"\n by(auto simp add: auth_seg2_def)\n\ntext \\There are no ciphertexts (or signatures) in @{term \"parts ik\"}. Thus, @{term \"analz ik\"}\nand @{term \"parts ik\"} are identical.\\\nlemma analz_parts_ik[simp]: \"analz ik = parts ik\"\n apply(rule no_crypt_analz_is_parts)\n by(auto simp add: ik_def auth_seg2_def auth_restrict_def ik_hfs_simp)\n (auto simp add: ik_add_def ik_oracle_def auth_seg2_def hf_valid_invert hfs_valid_prefix_generic_def \n dest!: TWu.holds_set_list)\n\nlemma parts_ik[simp]: \"parts ik = ik\"\n by(auto 3 4 simp add: ik_def auth_seg2_def auth_restrict_def dest!: parts_singleton_set)\n\nlemma key_ik_bad: \"Key (macK asid) \\ ik \\ asid \\ bad\"\n by(auto simp add: ik_def hf_valid_invert ik_oracle_simp)\n (auto 3 4 simp add: auth_seg2_def ik_hfs_simp ik_add_def hf_valid_invert)\n\n(******************************************************************************)\nsubsubsection\\Hop authenticators are agnostic to uinfo field\\\n(******************************************************************************)\ntext\\Those hop validation fields contained in @{term \"auth_seg2\"} or that can be generated from the hop\nauthenticators in @{text \"ik_add\"} have the property that they are agnostic about the uinfo field. If a\nhop validation field is contained in @{term \"auth_seg2\"} (resp. derivable from @{text \"ik_add\"}), \nthen a field with a different uinfo is also contained (resp. derivable).\nTo show this, we first define a function that updates uinfo in a hop validation field.\\\nfun uinfo_change_hf :: \"UINFO \\ EPIC_HF \\ EPIC_HF\" where\n \"uinfo_change_hf new_uinfo hf = \n (case HVF hf of Mac[\\] \\ainfo, uinfo\\ \\ hf\\HVF := Mac[\\] \\ainfo, Num new_uinfo\\\\ | _ \\ hf)\"\n\nfun uinfo_change :: \"UINFO \\ EPIC_HF list \\ EPIC_HF list\" where \n \"uinfo_change new_uinfo hfs = map (uinfo_change_hf new_uinfo) hfs\"\n\nlemma uinfo_change_valid: \n \"hfs_valid ainfo uinfo l nxt \\ hfs_valid ainfo new_uinfo (uinfo_change new_uinfo l) nxt\"\n apply(induction l nxt rule: TWu.holds.induct[where ?upd=upd_uinfo])\n apply auto\n subgoal for info x y ys nxt\n by(cases \"map (uinfo_change_hf new_uinfo) ys\")\n (cases info, auto 3 4 simp add: TWu.holds_split_tail hf_valid_invert upd_uinfo_def)+\n by(auto 3 4 simp add: TWu.holds_split_tail hf_valid_invert TWu.holds.simps upd_uinfo_def)\n\nlemma uinfo_change_hf_AHI: \"AHI (uinfo_change_hf new_uinfo hf) = AHI hf\"\n apply(cases \"HVF hf\") apply auto\n subgoal for x apply(cases x) apply auto\n subgoal for x1 x2 apply(cases x2) by auto\n done\n done\n\nlemma uinfo_change_hf_AHIS[simp]: \"AHIS (map (uinfo_change_hf new_uinfo) l) = AHIS l\"\n apply(induction l) using uinfo_change_hf_AHI by auto\n\nlemma uinfo_change_auth_seg2:\n assumes \"hf_valid ainfo uinfo m z\" \"\\ = Mac[Key (macK asid)] j\"\n \"HVF m = Mac[\\] \\ainfo, Num uinfo'\\\" \"\\ \\ ik_add\" \"no_oracle ainfo uinfo\"\n shows \"\\hfs. m \\ set hfs \\ (\\uinfo''. (ainfo, hfs) \\ auth_seg2 uinfo'')\"\nproof-\n from assms(4) obtain ainfo_add uinfo_add l_add hf_add where\n \"(ainfo_add, l_add) \\ auth_seg2 uinfo_add\" \"hf_add \\ set l_add\" \"HVF hf_add = Mac[\\] \\ainfo_add, Num uinfo_add\\\"\n by(auto simp add: ik_add_def)\n then have add: \"m \\ set (uinfo_change uinfo l_add)\" \"(ainfo_add, (uinfo_change uinfo l_add)) \\ auth_seg2 uinfo\"\n using assms(1-3,5) apply(auto simp add: auth_seg2_def simp del: AHIS_def)\n apply(auto simp add: hf_valid_invert intro!: image_eqI dest!: TWu.holds_set_list)[1]\n apply(auto simp add: auth_restrict_def intro!: exI elim: ahi_eq dest: uinfo_change_valid simp del: AHIS_def)\n by(auto simp add: hf_valid_invert upd_uinfo_def dest!: TWu.holds_set_list_no_update)\n then have \"ainfo_add = ainfo\" \n using assms(1) by(auto simp add: auth_seg2_def dest!: TWu.holds_set_list dest: info_hvf)\n then show ?thesis using add by fastforce\nqed\n\nlemma MAC_synth_oracle:\n assumes \"hf_valid ainfo uinfo m z\" \"HVF m \\ ik_oracle\"\n shows \"is_oracle ainfo uinfo\"\n using assms \n by(auto simp add: ik_oracle_def assms(1) hf_valid_invert upd_uinfo_def \n dest!: TWu.holds_set_list_no_update)\n\nlemma ik_oracle_is_oracle:\n \"\\Mac[\\] \\ainfo, Num uinfo\\ \\ ik_oracle\\ \\ is_oracle ainfo uinfo\"\n by (auto simp add: ik_oracle_def dest: info_hvf)\n (auto dest!: TWu.holds_set_list_no_update simp add: hf_valid_invert upd_uinfo_def)\n\nlemma MAC_synth_helper:\n\"\\hf_valid ainfo uinfo m z; no_oracle ainfo uinfo;\n HVF m = Mac[\\] \\ainfo, Num uinfo\\; \\ = Mac[Key (macK asid)] j; \\ \\ ik \\ HVF m \\ ik\\\n \\ \\hfs. m \\ set hfs \\ (\\uinfo'. (ainfo, hfs) \\ auth_seg2 uinfo')\"\n apply(auto simp add: ik_def ik_hfs_simp \n dest: MAC_synth_oracle ik_add_form ik_oracle_parts_form[simplified])\n prefer 3 subgoal by(auto elim!: uinfo_change_auth_seg2)\n prefer 3 subgoal by(auto elim!: uinfo_change_auth_seg2 intro: ik_addI dest: info_hvf HOL.sym)\n by(auto simp add: hf_valid_invert)\n\ntext\\This definition helps with the limiting the number of cases generated. We don't require it, \nbut it is convenient. Given a hop validation field and an asid, return if the hvf has the expected\nformat.\\\ndefinition mac_format :: \"msgterm \\ as \\ bool\" where \n \"mac_format m asid \\ \\ j ts uinfo . m = Mac[Mac[macKey asid] j] \\Num ts, uinfo\\\"\n\ntext\\If a valid hop field is derivable by the attacker, but does not belong to the attacker, and is\nover a path origin that does not belong to an oracle query, then the hop field is already \ncontained in the set of authorized segments.\\\nlemma MAC_synth:\n assumes \"hf_valid ainfo uinfo m z\" \"HVF m \\ synth ik\" \"mac_format (HVF m) asid\"\n \"asid \\ bad\" \"no_oracle ainfo uinfo\" \n shows \"\\hfs . m \\ set hfs \\ (\\uinfo'. (ainfo, hfs) \\ auth_seg2 uinfo')\"\n using assms\n apply(auto simp add: mac_format_def elim!: MAC_synth_helper dest!: key_ik_bad)\n apply(auto simp add: ik_def ik_hfs_simp dest: ik_add_form dest!: ik_oracle_parts_form) (* takes a few seconds *)\n using assms(1) by(auto dest: info_hvf simp add: hf_valid_invert)\n\n(******************************************************************************)\nsubsection\\Direct proof goals for interpretation of @{text \"dataplane_3_directed\"}\\\n(******************************************************************************)\n\nlemma COND_honest_hf_analz:\n assumes \"ASID (AHI hf) \\ bad\" \"hf_valid ainfo uinfo hf nxt\" \"terms_hf hf \\ synth (analz ik)\"\n \"no_oracle ainfo uinfo\"\n shows \"terms_hf hf \\ analz ik\"\nproof-\n let ?asid = \"ASID (AHI hf)\"\n from assms(3) have hf_synth_ik: \"HVF hf \\ synth ik\" \"UHI hf \\ synth ik\" by auto\n from assms(2) have \"mac_format (HVF hf) ?asid\"\n by(auto simp add: mac_format_def hf_valid_invert)\n then obtain hfs uinfo where \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\"\n using assms(1,2,4) hf_synth_ik by(auto dest!: MAC_synth)\n then have \"HVF hf \\ ik\" \"UHI hf \\ ik\" \n using assms(2)\n by(auto simp add: ik_hfs_def intro!: ik_ik_hfs intro!: exI) \n then show ?thesis by auto\nqed\n\nlemma COND_terms_hf: \n assumes \"hf_valid ainfo uinfo hf z\" and \"HVF hf \\ ik\" and \"no_oracle ainfo uinfo\"\n shows \"\\hfs. hf \\ set hfs \\ (\\uinfo . (ainfo, hfs) \\ auth_seg2 uinfo)\"\nproof-\n obtain hfs ainfo where hfs_def: \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\"\n using assms by(auto 3 4 simp add: hf_valid_invert ik_hfs_simp ik_def dest: ahi_eq\n dest!: ik_oracle_is_oracle ik_add_form)\n then obtain hfs ainfo where hfs_def: \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\" by auto\n show ?thesis \n using hfs_def apply (auto simp add: auth_seg2_def dest!: TWu.holds_set_list)\n using hfs_def assms(1) by (auto simp add: auth_seg2_def dest: info_hvf)\nqed\n\n\nlemma COND_extr_prefix_path:\n \"\\hfs_valid ainfo uinfo l nxt; nxt = None\\ \\ prefix (extr_from_hd l) (AHIS l)\"\n by(induction l nxt rule: TWu.holds.induct[where ?upd=upd_uinfo])\n (auto simp add: upd_uinfo_def TWu.holds_split_tail TWu.holds.simps(1) hf_valid_invert,\n auto split: list.split_asm simp add: hf_valid_invert intro!: ahi_eq elim: ASIF.elims)\n\nlemma COND_path_prefix_extr:\n \"prefix (AHIS (hfs_valid_prefix ainfo uinfo l nxt))\n (extr_from_hd l)\"\n apply(induction l nxt rule: TWu.takeW.induct[where ?Pa=\"hf_valid ainfo\",where ?upd=upd_uinfo])\n by(auto simp add: upd_uinfo_def TWu.takeW_split_tail TWu.takeW.simps(1))\n (auto 3 4 simp add: hf_valid_invert intro!: ahi_eq elim: ASIF.elims)\n\nlemma COND_hf_valid_uinfo:\n \"\\hf_valid ainfo uinfo hf nxt; hf_valid ainfo' uinfo' hf nxt'\\ \\ uinfo' = uinfo\"\n by(auto dest: info_hvf)\n\nlemma COND_upd_uinfo_ik: \n \"\\terms_uinfo uinfo \\ synth (analz ik); terms_hf hf \\ synth (analz ik)\\ \n \\ terms_uinfo (upd_uinfo uinfo hf) \\ synth (analz ik)\"\n by (auto simp add: upd_uinfo_def)\n\nlemma COND_upd_uinfo_no_oracle: \n \"no_oracle ainfo uinfo \\ no_oracle ainfo (upd_uinfo uinfo fld)\"\n by (auto simp add: upd_uinfo_def)\n\nlemma COND_auth_restrict_upd:\n \"auth_restrict ainfo uinfo (x#y#hfs) \n \\ auth_restrict ainfo (upd_uinfo uinfo y) (y#hfs)\"\n by (auto simp add: auth_restrict_def upd_uinfo_def)\n\n\n(******************************************************************************)\nsubsection\\Instantiation of @{text \"dataplane_3_directed\"} locale\\\n(******************************************************************************)\nprint_locale dataplane_3_directed\nsublocale\n dataplane_3_directed _ _ _ auth_seg0 terms_uinfo terms_hf hf_valid auth_restrict extr extr_ainfo term_ainfo \n upd_uinfo ik_add \n ik_oracle no_oracle\n apply unfold_locales\n using COND_terms_hf COND_honest_hf_analz COND_extr_prefix_path\n COND_path_prefix_extr COND_hf_valid_uinfo COND_upd_uinfo_ik COND_upd_uinfo_no_oracle \n COND_auth_restrict_upd by auto\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/instances/EPIC_L1_SA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.25948336460000776}} {"text": "theory Matching\nimports Semantics\nbegin\n\nsubsection\\Boolean Matcher Algebra\\\n\nlemma MatchOr: \"matches \\ (MatchOr m1 m2) p \\ matches \\ m1 p \\ matches \\ m2 p\"\n by(simp add: MatchOr_def)\n\nlemma opt_MatchAny_match_expr_correct: \"matches \\ (opt_MatchAny_match_expr m) = matches \\ m\"\n proof -\n have \"matches \\ (opt_MatchAny_match_expr_once m) = matches \\ m\" for m\n apply(simp add: fun_eq_iff)\n by(induction m rule: opt_MatchAny_match_expr_once.induct) (simp_all)\n thus ?thesis\n apply(simp add: opt_MatchAny_match_expr_def)\n apply(rule repeat_stabilize_induct)\n by(simp)+\n qed\n \n\nlemma matcheq_matchAny: \"\\ has_primitive m \\ matcheq_matchAny m \\ matches \\ m p\"\n by(induction m) simp_all\n\nlemma matcheq_matchNone: \"\\ has_primitive m \\ matcheq_matchNone m \\ \\ matches \\ m p\"\n by(auto dest: matcheq_matchAny matachAny_matchNone)\n\nlemma matcheq_matchNone_not_matches: \"matcheq_matchNone m \\ \\ matches \\ m p\"\n by(induction m rule: matcheq_matchNone.induct) auto\n\n\ntext\\Lemmas about matching in the @{const iptables_bigstep} semantics.\\\n\nlemma matches_rule_iptables_bigstep:\n assumes \"matches \\ m p \\ matches \\ m' p\"\n shows \"\\,\\,p\\ \\[Rule m a], s\\ \\ t \\ \\,\\,p\\ \\[Rule m' a], s\\ \\ t\" (is \"?l \\?r\")\nproof -\n {\n fix m m'\n assume \"\\,\\,p\\ \\[Rule m a], s\\ \\ t\" \"matches \\ m p \\ matches \\ m' p\"\n hence \"\\,\\,p\\ \\[Rule m' a], s\\ \\ t\"\n by (induction \"[Rule m a]\" s t rule: iptables_bigstep_induct)\n (auto intro: iptables_bigstep.intros simp: Cons_eq_append_conv dest: skipD)\n }\n with assms show ?thesis by blast\nqed\n\nlemma matches_rule_and_simp_help:\n assumes \"matches \\ m p\"\n shows \"\\,\\,p\\ \\[Rule (MatchAnd m m') a'], Undecided\\ \\ t \\ \\,\\,p\\ \\[Rule m' a'], Undecided\\ \\ t\" (is \"?l \\?r\")\nproof\n assume ?l thus ?r\n by (induction \"[Rule (MatchAnd m m') a']\" Undecided t rule: iptables_bigstep_induct)\n (auto intro: iptables_bigstep.intros simp: assms Cons_eq_append_conv dest: skipD)\nnext\n assume ?r thus ?l\n by (induction \"[Rule m' a']\" Undecided t rule: iptables_bigstep_induct)\n (auto intro: iptables_bigstep.intros simp: assms Cons_eq_append_conv dest: skipD)\nqed\n\nlemma matches_MatchNot_simp: \n assumes \"matches \\ m p\"\n shows \"\\,\\,p\\ \\[Rule (MatchNot m) a], Undecided\\ \\ t \\ \\,\\,p\\ \\[], Undecided\\ \\ t\" (is \"?l \\ ?r\")\nproof\n assume ?l thus ?r\n by (induction \"[Rule (MatchNot m) a]\" \"Undecided\" t rule: iptables_bigstep_induct)\n (auto intro: iptables_bigstep.intros simp: assms Cons_eq_append_conv dest: skipD)\nnext\n assume ?r\n hence \"t = Undecided\"\n by (metis skipD)\n with assms show ?l\n by (fastforce intro: nomatch)\nqed\n\nlemma matches_MatchNotAnd_simp:\n assumes \"matches \\ m p\"\n shows \"\\,\\,p\\ \\[Rule (MatchAnd (MatchNot m) m') a], Undecided\\ \\ t \\ \\,\\,p\\ \\[], Undecided\\ \\ t\" (is \"?l \\ ?r\")\nproof\n assume ?l thus ?r\n by (induction \"[Rule (MatchAnd (MatchNot m) m') a]\" \"Undecided\" t rule: iptables_bigstep_induct)\n (auto intro: iptables_bigstep.intros simp add: assms Cons_eq_append_conv dest: skipD)\nnext\n assume ?r\n hence \"t = Undecided\"\n by (metis skipD)\n with assms show ?l\n by (fastforce intro: nomatch)\nqed\n \nlemma matches_rule_and_simp:\n assumes \"matches \\ m p\"\n shows \"\\,\\,p\\ \\[Rule (MatchAnd m m') a'], s\\ \\ t \\ \\,\\,p\\ \\[Rule m' a'], s\\ \\ t\"\nproof (cases s)\n case Undecided\n with assms show ?thesis\n by (simp add: matches_rule_and_simp_help)\nnext\n case Decision\n thus ?thesis by (metis decision decisionD)\nqed\n\nlemma iptables_bigstep_MatchAnd_comm:\n \"\\,\\,p\\ \\[Rule (MatchAnd m1 m2) a], s\\ \\ t \\ \\,\\,p\\ \\[Rule (MatchAnd m2 m1) a], s\\ \\ t\"\nproof -\n { fix m1 m2\n have \"\\,\\,p\\ \\[Rule (MatchAnd m1 m2) a], s\\ \\ t \\ \\,\\,p\\ \\[Rule (MatchAnd m2 m1) a], s\\ \\ t\"\n proof (induction \"[Rule (MatchAnd m1 m2) a]\" s t rule: iptables_bigstep_induct)\n case Seq thus ?case\n by (metis Nil_is_append_conv append_Nil butlast_append butlast_snoc seq)\n qed (auto intro: iptables_bigstep.intros)\n }\n thus ?thesis by blast\nqed\n\n\nsubsection\\Add match\\\n\ndefinition add_match :: \"'a match_expr \\ 'a rule list \\ 'a rule list\" where\n \"add_match m rs = map (\\r. case r of Rule m' a' \\ Rule (MatchAnd m m') a') rs\"\n\nlemma add_match_split: \"add_match m (rs1@rs2) = add_match m rs1 @ add_match m rs2\"\n unfolding add_match_def\n by (fact map_append)\n\nlemma add_match_split_fst: \"add_match m (Rule m' a' # rs) = Rule (MatchAnd m m') a' # add_match m rs\"\n unfolding add_match_def\n by simp\n\n\nlemma add_match_distrib:\n \"\\,\\,p\\ \\add_match m1 (add_match m2 rs), s\\ \\ t \\ \\,\\,p\\ \\add_match m2 (add_match m1 rs), s\\ \\ t\"\nproof -\n {\n fix m1 m2\n have \"\\,\\,p\\ \\add_match m1 (add_match m2 rs), s\\ \\ t \\ \\,\\,p\\ \\add_match m2 (add_match m1 rs), s\\ \\ t\"\n proof (induction rs arbitrary: s)\n case Nil thus ?case by (simp add: add_match_def)\n next\n case (Cons r rs)\n from Cons obtain m a where r: \"r = Rule m a\" by (cases r) simp\n with Cons.prems obtain ti where 1: \"\\,\\,p\\ \\[Rule (MatchAnd m1 (MatchAnd m2 m)) a], s\\ \\ ti\" and 2: \"\\,\\,p\\ \\add_match m1 (add_match m2 rs), ti\\ \\ t\"\n apply(simp add: add_match_split_fst)\n apply(erule seqE_cons)\n by simp\n from 1 r have base: \"\\,\\,p\\ \\[Rule (MatchAnd m2 (MatchAnd m1 m)) a], s\\ \\ ti\"\n by (metis matches.simps(1) matches_rule_iptables_bigstep)\n from 2 Cons.IH have IH: \"\\,\\,p\\ \\add_match m2 (add_match m1 rs), ti\\ \\ t\" by simp\n from base IH seq'_cons have \"\\,\\,p\\ \\Rule (MatchAnd m2 (MatchAnd m1 m)) a # add_match m2 (add_match m1 rs), s\\ \\ t\" by fast\n thus ?case using r by(simp add: add_match_split_fst[symmetric])\n qed\n }\n thus ?thesis by blast\nqed\n\nlemma add_match_split_fst': \"add_match m (a # rs) = add_match m [a] @ add_match m rs\"\n by (simp add: add_match_split[symmetric])\n\n\n\nlemma matches_add_match_simp:\n assumes m: \"matches \\ m p\"\n shows \"\\,\\,p\\ \\add_match m rs, s\\ \\ t \\ \\,\\,p\\ \\rs, s\\ \\ t\" (is \"?l \\ ?r\")\n proof\n assume ?l with m show ?r\n proof (induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n hence IH: \"\\,\\,p\\ \\add_match m rs, s\\ \\ t \\ \\,\\,p\\ \\rs, s\\ \\ t\" by(simp add: add_match_split_fst)\n obtain m' a where r: \"r = Rule m' a\" by (cases r)\n with Cons.prems(2) obtain ti where \"\\,\\,p\\ \\[Rule (MatchAnd m m') a], s\\ \\ ti\" and \"\\,\\,p\\ \\add_match m rs, ti\\ \\ t\"\n by(auto elim:seqE_cons simp add: add_match_split_fst)\n with Cons.prems(1) IH have \"\\,\\,p\\ \\[Rule m' a], s\\ \\ ti\" by(simp add: matches_rule_and_simp)\n with \\\\,\\,p\\ \\add_match m rs, ti\\ \\ t\\ IH r show ?case by(metis decision state.exhaust iptables_bigstep_deterministic seq_cons)\n qed\n next\n assume ?r with m show ?l\n proof (induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n hence IH: \" \\,\\,p\\ \\rs, s\\ \\ t \\ \\,\\,p\\ \\add_match m rs, s\\ \\ t\" by(simp add: add_match_split_fst)\n obtain m' a where r: \"r = Rule m' a\" by (cases r)\n with Cons.prems(2) obtain ti where \"\\,\\,p\\ \\[Rule m' a], s\\ \\ ti\" and \"\\,\\,p\\ \\rs, ti\\ \\ t\"\n by(auto elim:seqE_cons simp add: add_match_split_fst)\n with Cons.prems(1) IH have \"\\,\\,p\\ \\[Rule (MatchAnd m m') a], s\\ \\ ti\" by(simp add: matches_rule_and_simp)\n with \\\\,\\,p\\ \\rs, ti\\ \\ t\\ IH r show ?case \n apply(simp add: add_match_split_fst)\n by(metis decision state.exhaust iptables_bigstep_deterministic seq_cons)\n qed\n qed\n\nlemma matches_add_match_MatchNot_simp:\n assumes m: \"matches \\ m p\"\n shows \"\\,\\,p\\ \\add_match (MatchNot m) rs, s\\ \\ t \\ \\,\\,p\\ \\[], s\\ \\ t\" (is \"?l s \\ ?r s\")\n proof (cases s)\n case Undecided\n have \"?l Undecided \\ ?r Undecided\"\n proof\n assume \"?l Undecided\" with m show \"?r Undecided\"\n proof (induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n thus ?case\n by (cases r) (metis matches_MatchNotAnd_simp skipD seqE_cons add_match_split_fst)\n qed\n next\n assume \"?r Undecided\" with m show \"?l Undecided\"\n proof (induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n thus ?case\n by (cases r) (metis matches_MatchNotAnd_simp skipD seq'_cons add_match_split_fst)\n qed\n qed\n with Undecided show ?thesis by fast\n next\n case (Decision d)\n thus ?thesis\n by(metis decision decisionD)\n qed\n\nlemma not_matches_add_match_simp:\n assumes \"\\ matches \\ m p\"\n shows \"\\,\\,p\\ \\add_match m rs, Undecided\\ \\ t \\ \\,\\,p\\ \\[], Undecided\\ \\ t\"\n proof(induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n thus ?case\n by (cases r) (metis assms add_match_split_fst matches.simps(1) nomatch seq'_cons nomatchD seqE_cons)\n qed\n\nlemma iptables_bigstep_add_match_notnot_simp: \n \"\\,\\,p\\ \\add_match (MatchNot (MatchNot m)) rs, s\\ \\ t \\ \\,\\,p\\ \\add_match m rs, s\\ \\ t\"\n proof(induction rs)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case (Cons r rs)\n thus ?case\n by (cases r)\n (metis decision decisionD state.exhaust matches.simps(2) matches_add_match_simp not_matches_add_match_simp)\n qed\n\n\nlemma add_match_match_not_cases:\n \"\\,\\,p\\ \\add_match (MatchNot m) rs, Undecided\\ \\ Undecided \\ matches \\ m p \\ \\,\\,p\\ \\rs, Undecided\\ \\ Undecided\"\n by (metis matches.simps(2) matches_add_match_simp)\n\n\nlemma not_matches_add_matchNot_simp:\n \"\\ matches \\ m p \\ \\,\\,p\\ \\add_match (MatchNot m) rs, s\\ \\ t \\ \\,\\,p\\ \\rs, s\\ \\ t\"\n by (simp add: matches_add_match_simp)\n\nlemma iptables_bigstep_add_match_and:\n \"\\,\\,p\\ \\add_match m1 (add_match m2 rs), s\\ \\ t \\ \\,\\,p\\ \\add_match (MatchAnd m1 m2) rs, s\\ \\ t\"\n proof(induction rs arbitrary: s t)\n case Nil\n thus ?case\n unfolding add_match_def by simp\n next\n case(Cons r rs)\n show ?case\n proof (cases r, simp only: add_match_split_fst)\n fix m a\n show \"\\,\\,p\\ \\Rule (MatchAnd m1 (MatchAnd m2 m)) a # add_match m1 (add_match m2 rs), s\\ \\ t \\ \\,\\,p\\ \\Rule (MatchAnd (MatchAnd m1 m2) m) a # add_match (MatchAnd m1 m2) rs, s\\ \\ t\" (is \"?l \\ ?r\")\n proof\n assume ?l with Cons.IH show ?r\n apply -\n apply(erule seqE_cons)\n apply(case_tac s)\n apply(case_tac ti)\n apply (metis matches.simps(1) matches_rule_and_simp matches_rule_and_simp_help nomatch seq'_cons)\n apply (metis add_match_split_fst matches.simps(1) matches_add_match_simp not_matches_add_match_simp seq_cons)\n apply (metis decision decisionD)\n done\n next\n assume ?r with Cons.IH show ?l\n apply -\n apply(erule seqE_cons)\n apply(case_tac s)\n apply(case_tac ti)\n apply (metis matches.simps(1) matches_rule_and_simp matches_rule_and_simp_help nomatch seq'_cons)\n apply (metis add_match_split_fst matches.simps(1) matches_add_match_simp not_matches_add_match_simp seq_cons)\n apply (metis decision decisionD)\n done\n qed\n qed\n qed\n\n\nlemma optimize_matches_option_generic:\n assumes \"\\ r \\ set rs. P (get_match r)\"\n and \"(\\m m'. P m \\ f m = Some m' \\ matches \\ m' p = matches \\ m p)\"\n and \"(\\m. P m \\ f m = None \\ \\ matches \\ m p)\"\n shows \"\\,\\,p\\ \\optimize_matches_option f rs, s\\ \\ t \\ \\,\\,p\\ \\rs, s\\ \\ t\"\n (is \"?lhs \\ ?rhs\")\n proof\n assume ?rhs\n from this assms show ?lhs\n apply(induction rs s t rule: iptables_bigstep_induct)\n apply(auto simp: optimize_matches_option_append intro: iptables_bigstep.intros split: option.split)\n done\n next\n assume ?lhs\n from this assms show ?rhs\n apply(induction f rs arbitrary: s rule: optimize_matches_option.induct)\n apply(simp; fail)\n apply(simp split: option.split_asm)\n apply(subgoal_tac \"\\ matches \\ m p\")\n prefer 2 apply blast\n apply (metis decision nomatch seq'_cons state.exhaust)\n apply(erule seqE_cons)\n apply(rule_tac t=ti in seq'_cons)\n apply (meson matches_rule_iptables_bigstep)\n by blast\n qed\n\nlemma optimize_matches_generic: \"\\ r \\ set rs. P (get_match r) \\ \n (\\m. P m \\ matches \\ (f m) p = matches \\ m p) \\\n \\,\\,p\\ \\optimize_matches f rs, s\\ \\ t \\ \\,\\,p\\ \\rs, s\\ \\ t\"\n unfolding optimize_matches_def\n apply(rule optimize_matches_option_generic)\n apply(simp; fail)\n apply(simp split: if_split_asm)\n apply blast\n apply(simp split: if_split_asm)\n using matcheq_matchNone_not_matches by fast\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Matching.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2594833646000077}} {"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System *)\n(* File: Railways_Impl.thy *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK) *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk *)\n(******************************************************************************)\n(* LAST REVIEWED: 22 Sep 2017 *)\n\nsection {* Railways Implementation *}\n\ntheory Railways_Impl\nimports Railways_Spec\nbegin\n\nsubsection {* Interlocking FMU *}\n\nsubsubsection {* Initialisation *}\n\ndefinition init_ilock :: \"railways_state hrel\" where [urel_defs]:\n\"init_ilock =\n (cdv, tc, relays, signals, switches) := (\n mk_vector\\<^sub>u 11 true,\n mk_vector\\<^sub>u 4 false,\n mk_vector\\<^sub>u 5 false,\n mk_vector\\<^sub>u 3 false,\n mk_vector\\<^sub>u 5 \\STRAIGHT\\)\"\n\nsubsubsection {* Cyclic Behaviour *}\n\nparagraph {* Relay Setting *}\n\ndefinition set_relays :: \"railways_state hrel\" where\n[urel_defs]: \"set_relays =\n ((relays[1] := true) \\ TC[4] \\ \\ TC[3] \\ \\ R2 \\ \\ R4 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[5] \\\\<^sub>r II) ;;\n ((relays[2] := true) \\ TC[3] \\ \\ TC[4] \\ \\ R1 \\ \\ R3 \\ \\ R4 \\ \\ R5 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[8] \\ CDV[9] \\ CDV[10] \\ CDV[1] \\\\<^sub>r II) ;;\n ((relays[4] := true) \\ TC[3] \\ \\ TC[4] \\ \\ R1 \\ \\ R2 \\ \\ R3 \\ \\ R5 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[8] \\ CDV[9] \\ CDV[11] \\ CDV[2] \\\\<^sub>r II) ;;\n ((relays[3] := true) \\ TC[1] \\ \\ R2 \\ \\ R4 \\ \\ R5 \\ (*\\ CDV[1] \\*) CDV[10] \\ CDV[9] \\ CDV[8] \\ CDV[7] \\ CDV[6] \\\\<^sub>r II) ;;\n ((relays[5] := true) \\ TC[2] \\ \\ R2 \\ \\ R3 \\ \\ R4 \\ (*\\ CDV[2] \\*) CDV[11] \\ CDV[9] \\ CDV[8] \\ CDV[7] \\ CDV[6] \\\\<^sub>r II)\"\n\nparagraph {* Relay Clearing *}\n\ndefinition clear_relays :: \"railways_state hrel\" where\n[urel_defs]: \"clear_relays =\n ((relays[1] := false) \\ R1 \\ \\ CDV[5] \\\\<^sub>r II) ;;\n ((relays[2] := false) \\ R2 \\ \\ CDV[1] \\\\<^sub>r II) ;;\n ((relays[3] := false) \\ R3 \\ \\ CDV[6] \\\\<^sub>r II) ;;\n ((relays[4] := false) \\ R4 \\ \\ CDV[2] \\\\<^sub>r II) ;;\n ((relays[5] := false) \\ R5 \\ \\ CDV[6] \\\\<^sub>r II)\"\n\nparagraph {* Switch Setting *}\n\ndefinition set_switches :: \"railways_state hrel\" where\n[urel_defs]: \"set_switches = (\n (switches[1] := \\STRAIGHT\\) ;;\n ((switches[2] := \\STRAIGHT\\) \\ R3 \\ R5 \\\\<^sub>r (switches[2] := \\DIVERGING\\)) ;;\n ((switches[3] := \\STRAIGHT\\) \\ R1 \\\\<^sub>r (switches[3] := \\DIVERGING\\)) ;;\n (switches[4] := \\STRAIGHT\\) ;;\n ((switches[5] := \\STRAIGHT\\) \\ R2 \\ R3 \\\\<^sub>r (switches[5] := \\DIVERGING\\)))\"\n\nsubsubsection {* Signal Setting *}\n\ndefinition set_signals :: \"railways_state hrel\" where\n[urel_defs]: \"set_signals = (\n (signals[1] := (R3 \\ SW5 =\\<^sub>u \\STRAIGHT\\ \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\)) ;;\n (signals[2] := (R5 \\ SW5 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\)) ;;\n (signals[3] := ((R1 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\STRAIGHT\\) \\\n (R2 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\STRAIGHT\\) \\\n (R4 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\DIVERGING\\))))\"\n\nparagraph {* Complete Cycle *}\n\ndefinition ilock_cycle :: \"railways_state hrel\" where [urel_defs]:\n\"ilock_cycle = (set_relays ;; clear_relays ;; set_switches ;; set_signals)\"\n\nsubsubsection {* Invariant Proofs *}\n\nparagraph {* Proof Support *}\n\nlemma relays_excl_inv_extr:\n\"`relays_excl_inv \\ P \\ Q` = `relays_excl_inv \\ P \\ Q`\"\n by (simp add: impl_alt_def utp_pred_laws.sup.assoc)\n\ntext {* Do \\,\\ and \\;\\ have the same precedence? Are they right-associative? *}\n\nmethod ilock_relays_excl_inv_tac =\n (hoare_split_inv; (\n (unfold relays_excl_inv_extr)?,\n (unfold relays_excl_inv_cases),\n (rel_simp);\n (unfold valid_relay_states_def),\n (safe; simp)))\n\nparagraph {* Invariant Preservation *}\n\nlemma init_ilock_relays_excl_inv:\n\"\\true\\init_ilock\\relays_excl_inv\\\\<^sub>u\"\n unfolding init_ilock_def by (rel_simp)\n\nlemma set_relays_relays_excl_inv:\n\"\\relays_excl_inv\\set_relays\\relays_excl_inv\\\\<^sub>u\"\n unfolding set_relays_def by (ilock_relays_excl_inv_tac)\n\nlemma clear_relays_relays_excl_inv:\n\"\\relays_excl_inv\\clear_relays\\relays_excl_inv\\\\<^sub>u\"\n unfolding clear_relays_def by (ilock_relays_excl_inv_tac)\n\nlemma set_switches_relays_excl_inv:\n\"\\relays_excl_inv\\set_switches\\relays_excl_inv\\\\<^sub>u\"\n unfolding set_switches_def by (ilock_relays_excl_inv_tac)\n\nlemma set_signals_relays_excl_inv:\n\"\\relays_excl_inv\\set_signals\\relays_excl_inv\\\\<^sub>u\"\n unfolding set_signals_def by (ilock_relays_excl_inv_tac)\n\nlemma \"\\relays_excl_inv\\ilock_cycle\\relays_excl_inv\\\\<^sub>u\"\napply (unfold ilock_cycle_def)\napply (hoare_split)\napply (rule set_relays_relays_excl_inv)\napply (rule clear_relays_relays_excl_inv)\napply (rule set_switches_relays_excl_inv)\napply (rule set_signals_relays_excl_inv)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/Railways_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665855647394, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.25948335830002073}} {"text": "(* Title: HOL/NanoJava/State.thy\n Author: David von Oheimb\n Copyright 2001 Technische Universitaet Muenchen\n*)\n\nsection \"Program State\"\n\ntheory State imports TypeRel begin\n\ndefinition body :: \"cname \\ mname => stmt\" where\n \"body \\ \\(C,m). bdy (the (method C m))\"\n\ntext {* Locations, i.e.\\ abstract references to objects *}\ntypedecl loc \n\ndatatype val\n = Null --{* null reference *}\n | Addr loc --{* address, i.e. location of object *}\n\ntype_synonym fields\n = \"(fname \\ val)\"\n\ntype_synonym\n obj = \"cname \\ fields\"\n\ntranslations\n (type) \"fields\" \\ (type) \"fname => val option\"\n (type) \"obj\" \\ (type) \"cname \\ fields\"\n\ndefinition init_vars :: \"('a \\ 'b) => ('a \\ val)\" where\n \"init_vars m == map_option (\\T. Null) o m\"\n \ntext {* private: *}\ntype_synonym heap = \"loc \\ obj\"\ntype_synonym locals = \"vname \\ val\" \n\ntext {* private: *}\nrecord state\n = heap :: heap\n locals :: locals\n\ntranslations\n (type) \"heap\" \\ (type) \"loc => obj option\"\n (type) \"locals\" \\ (type) \"vname => val option\"\n (type) \"state\" \\ (type) \"(|heap :: heap, locals :: locals|)\"\n\ndefinition del_locs :: \"state => state\" where\n \"del_locs s \\ s (| locals := empty |)\"\n\ndefinition init_locs :: \"cname => mname => state => state\" where\n \"init_locs C m s \\ s (| locals := locals s ++ \n init_vars (map_of (lcl (the (method C m)))) |)\"\n\ntext {* The first parameter of @{term set_locs} is of type @{typ state} \n rather than @{typ locals} in order to keep @{typ locals} private.*}\ndefinition set_locs :: \"state => state => state\" where\n \"set_locs s s' \\ s' (| locals := locals s |)\"\n\ndefinition get_local :: \"state => vname => val\" (\"_<_>\" [99,0] 99) where\n \"get_local s x \\ the (locals s x)\"\n\n--{* local function: *}\ndefinition get_obj :: \"state => loc => obj\" where\n \"get_obj s a \\ the (heap s a)\"\n\ndefinition obj_class :: \"state => loc => cname\" where\n \"obj_class s a \\ fst (get_obj s a)\"\n\ndefinition get_field :: \"state => loc => fname => val\" where\n \"get_field s a f \\ the (snd (get_obj s a) f)\"\n\n--{* local function: *}\ndefinition hupd :: \"loc => obj => state => state\" (\"hupd'(_|->_')\" [10,10] 1000) where\n \"hupd a obj s \\ s (| heap := ((heap s)(a\\obj))|)\"\n\ndefinition lupd :: \"vname => val => state => state\" (\"lupd'(_|->_')\" [10,10] 1000) where\n \"lupd x v s \\ s (| locals := ((locals s)(x\\v ))|)\"\n\nnotation (xsymbols)\n hupd (\"hupd'(_\\_')\" [10,10] 1000) and\n lupd (\"lupd'(_\\_')\" [10,10] 1000)\n\ndefinition new_obj :: \"loc => cname => state => state\" where\n \"new_obj a C \\ hupd(a\\(C,init_vars (field C)))\"\n\ndefinition upd_obj :: \"loc => fname => val => state => state\" where\n \"upd_obj a f v s \\ let (C,fs) = the (heap s a) in hupd(a\\(C,fs(f\\v))) s\"\n\ndefinition new_Addr :: \"state => val\" where\n \"new_Addr s == SOME v. (\\a. v = Addr a \\ (heap s) a = None) | v = Null\"\n\n\nsubsection \"Properties not used in the meta theory\"\n\nlemma locals_upd_id [simp]: \"s\\locals := locals s\\ = s\" \nby simp\n\nlemma lupd_get_local_same [simp]: \"lupd(x\\v) s = v\"\nby (simp add: lupd_def get_local_def)\n\nlemma lupd_get_local_other [simp]: \"x \\ y \\ lupd(x\\v) s = s\"\napply (drule not_sym)\nby (simp add: lupd_def get_local_def)\n\nlemma get_field_lupd [simp]:\n \"get_field (lupd(x\\y) s) a f = get_field s a f\"\nby (simp add: lupd_def get_field_def get_obj_def)\n\nlemma get_field_set_locs [simp]:\n \"get_field (set_locs l s) a f = get_field s a f\"\nby (simp add: lupd_def get_field_def set_locs_def get_obj_def)\n\nlemma get_field_del_locs [simp]:\n \"get_field (del_locs s) a f = get_field s a f\"\nby (simp add: lupd_def get_field_def del_locs_def get_obj_def)\n\nlemma new_obj_get_local [simp]: \"new_obj a C s = s\"\nby (simp add: new_obj_def hupd_def get_local_def)\n\nlemma heap_lupd [simp]: \"heap (lupd(x\\y) s) = heap s\"\nby (simp add: lupd_def)\n\nlemma heap_hupd_same [simp]: \"heap (hupd(a\\obj) s) a = Some obj\"\nby (simp add: hupd_def)\n\nlemma heap_hupd_other [simp]: \"aa \\ a \\ heap (hupd(aa\\obj) s) a = heap s a\"\napply (drule not_sym)\nby (simp add: hupd_def)\n\nlemma hupd_hupd [simp]: \"hupd(a\\obj) (hupd(a\\obj') s) = hupd(a\\obj) s\"\nby (simp add: hupd_def)\n\nlemma heap_del_locs [simp]: \"heap (del_locs s) = heap s\"\nby (simp add: del_locs_def)\n\nlemma heap_set_locs [simp]: \"heap (set_locs l s) = heap s\"\nby (simp add: set_locs_def)\n\nlemma hupd_lupd [simp]: \n \"hupd(a\\obj) (lupd(x\\y) s) = lupd(x\\y) (hupd(a\\obj) s)\"\nby (simp add: hupd_def lupd_def)\n\nlemma hupd_del_locs [simp]: \n \"hupd(a\\obj) (del_locs s) = del_locs (hupd(a\\obj) s)\"\nby (simp add: hupd_def del_locs_def)\n\nlemma new_obj_lupd [simp]: \n \"new_obj a C (lupd(x\\y) s) = lupd(x\\y) (new_obj a C s)\"\nby (simp add: new_obj_def)\n\nlemma new_obj_del_locs [simp]: \n \"new_obj a C (del_locs s) = del_locs (new_obj a C s)\"\nby (simp add: new_obj_def)\n\nlemma upd_obj_lupd [simp]: \n \"upd_obj a f v (lupd(x\\y) s) = lupd(x\\y) (upd_obj a f v s)\"\nby (simp add: upd_obj_def Let_def split_beta)\n\nlemma upd_obj_del_locs [simp]: \n \"upd_obj a f v (del_locs s) = del_locs (upd_obj a f v s)\"\nby (simp add: upd_obj_def Let_def split_beta)\n\nlemma get_field_hupd_same [simp]:\n \"get_field (hupd(a\\(C, fs)) s) a = the \\ fs\"\napply (rule ext)\nby (simp add: get_field_def get_obj_def)\n\nlemma get_field_hupd_other [simp]:\n \"aa \\ a \\ get_field (hupd(aa\\obj) s) a = get_field s a\"\napply (rule ext)\nby (simp add: get_field_def get_obj_def)\n\nlemma new_AddrD: \n\"new_Addr s = v \\ (\\a. v = Addr a \\ heap s a = None) | v = Null\"\napply (unfold new_Addr_def)\napply (erule subst)\napply (rule someI)\napply (rule disjI2)\napply (rule HOL.refl)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/NanoJava/State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2593807164439105}} {"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\nsection \\List Model Simpl proofs\\\n\ntext \\\n Due to problems importing both SIMPL and COMPLX we split the files and have all the proofs\n using SIMPL in this file\n\\\n\ntheory CleanQ_ListModel_Simpl\n(*<*)\n imports Main \"../Simpl/Vcg\" CleanQ_ListModel\n(*>*)\nbegin\n\n(* ==================================================================================== *)\nsubsection \\Integration in SIMPL\\\n(* ==================================================================================== *)\n\n\ntext \\\n We now integrate the the CleanQ List Model into SIMPL. For each of the two operations,\n enqueue and dequeue, we specify a Hoare-triple with pre and post conditions, and\n the operation.\n\\\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\Enqueue Operation\\\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\\n We first show, that we can define a Hoare triple for the enqueue operations from both\n agents X and Y, and that in both cases the invariant is preserved.\n\\\n\nlemma CleanQ_List_enq_x_preserves_invariants : \n \"\\\\ \\ rb' = \\ListRB \\ CleanQ_List_Invariants K \\ListRB \\ b \\ lSX \\ListRB \\ \n \\ListRB :== (CleanQ_List_enq_x b \\ListRB) \n \\ CleanQ_List_Invariants K \\ListRB \\\"\n by(vcg, simp only: CleanQ_List_enq_x_Invariants)\n\n\nlemma CleanQ_List_enq_y_preserves_invariants : \n \"\\\\ \\ rb' = \\ListRB \\ CleanQ_List_Invariants K \\ListRB \\ b \\ lSY \\ListRB \\ \n \\ListRB :== (CleanQ_List_enq_y b \\ListRB) \n \\ CleanQ_List_Invariants K \\ListRB \\\"\n by(vcg, simp only: CleanQ_List_enq_y_Invariants)\n\ntext \\\n The same applies for the multi-step \\verb+eneuque_n+ operation.\n\\\n\nlemma CleanQ_List_enq_n_x_preserves_invariants : \n \"\\\\ \\ rb' = \\ListRB \\ CleanQ_List_Invariants K \\ListRB \n \\ (\\b \\ set B. b \\ (lSX \\ListRB)) \\ distinct B \\ \n \\ListRB :== (CleanQ_List_enq_n_x B \\ListRB) \n \\ CleanQ_List_Invariants K \\ListRB \\\"\n apply(vcg) using CleanQ_List_enq_n_x_Invariants by blast\n\nlemma CleanQ_List_enq_n_y_preserves_invariants : \n \"\\\\ \\ rb' = \\ListRB \\ CleanQ_List_Invariants K \\ListRB \n \\ (\\b \\ set B. b \\ (lSY \\ListRB)) \\ distinct B \\ \n \\ListRB :== (CleanQ_List_enq_n_y B \\ListRB) \n \\ CleanQ_List_Invariants K \\ListRB \\\"\n apply(vcg) using CleanQ_List_enq_n_y_Invariants by blast\n\nend\n\n\n\n", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_ListModel_Simpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2593807164439104}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory SignedWords\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\nsubsection {* Type definition *}\n\ntypedef ('a::len0) signed = \"UNIV :: 'a set\" ..\n\nlemma card_signed [simp]: \"CARD (('a::len0) signed) = CARD('a)\"\n unfolding type_definition.card [OF type_definition_signed]\n by simp\n\ninstantiation signed :: (len0) len0\nbegin\n\ndefinition\n len_signed [simp]: \"len_of (x::'a::len0 signed itself) = len_of TYPE('a)\"\n\ninstance ..\n\nend\n\ninstance signed :: (len) len\n by (intro_classes, simp)\n\ntype_synonym 'a sword = \"('a signed) word\"\ntype_synonym sword8 = \"8 sword\"\ntype_synonym sword16 = \"16 sword\"\ntype_synonym sword32 = \"32 sword\"\ntype_synonym sword64 = \"64 sword\"\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/SignedWords.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.25919102195464}} {"text": "(* Title: OAWN_Convert.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke\n*)\n\nheader \"Transfer standard invariants into open invariants\"\n\ntheory OAWN_Convert\nimports AWN_SOS_Labels AWN_Invariants\n OAWN_SOS OAWN_Invariants\nbegin\n\ndefinition initiali :: \"'i \\ (('i \\ 'g) \\ 'l) set \\ ('g \\ 'l) set \\ bool\"\nwhere \"initiali i OI CI \\ ({(\\ i, p)|\\ p. (\\, p) \\ OI} = CI)\"\n\nlemma initialiI [intro]:\n assumes OICI: \"\\\\ p. (\\, p) \\ OI \\ (\\ i, p) \\ CI\"\n and CIOI: \"\\\\ p. (\\, p) \\ CI \\ \\\\. \\ = \\ i \\ (\\, p) \\ OI\"\n shows \"initiali i OI CI\"\n unfolding initiali_def\n by (intro set_eqI iffI) (auto elim!: OICI CIOI)\n\nlemma open_from_initialiD [dest]:\n assumes \"initiali i OI CI\"\n and \"(\\, p) \\ OI\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ CI\"\n using assms unfolding initiali_def by auto\n\nlemma closed_from_initialiD [dest]:\n assumes \"initiali i OI CI\"\n and \"(\\, p) \\ CI\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ OI\"\n using assms unfolding initiali_def by auto\n\ndefinition\n seql :: \"'i \\ (('s \\ 'l) \\ bool) \\ (('i \\ 's) \\ 'l) \\ bool\"\nwhere\n \"seql i P \\ (\\(\\, p). P (\\ i, p))\"\n\nlemma seqlI [intro]:\n \"P (fst s i, snd s) \\ seql i P s\"\n by (clarsimp simp: seql_def)\n\nlemma same_seql [elim]:\n assumes \"\\j\\{i}. \\' j = \\ j\"\n and \"seql i P (\\', s)\"\n shows \"seql i P (\\, s)\"\n using assms unfolding seql_def by (clarsimp)\n\nlemma seqlsimp:\n \"seql i P (\\, p) = P (\\ i, p)\"\n unfolding seql_def by simp\n\nlemma other_steps_resp_local [intro!, simp]: \"other_steps (other A I) I\"\n by (clarsimp elim!: otherE)\n\nlemma seql_onl_swap:\n \"seql i (onl \\ P) = onl \\ (seql i P)\"\n unfolding seql_def onl_def by simp\n\nlemma oseqp_sos_resp_local_steps [intro!, simp]:\n fixes \\ :: \"'p \\ ('s, 'm, 'p, 'l) seqp\"\n shows \"local_steps (oseqp_sos \\ i) {i}\"\n proof\n fix \\ \\' \\ \\' :: \"nat \\ 's\" and s a s'\n assume tr: \"((\\, s), a, \\', s') \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, s), a, (\\', s')) \\ oseqp_sos \\ i\"\n proof induction\n fix \\ \\' l ms p\n assume \"\\' i = \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n hence \"((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ oseqp_sos \\ i\"\n by (metis obroadcastT singleton_iff)\n with \\\\j\\{i}. \\ j = \\ j\\ show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\\n ((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ \\' :: \"nat \\ 's\" and fmsg :: \"'m \\ 's \\ 's\" and msg l p\n assume *: \"\\' i = fmsg msg (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (\\(i := fmsg msg (\\ i))) j = \\' j\" by clarsimp\n moreover from * **\n have \"((\\, {l}receive(fmsg).p), receive msg, (\\(i := fmsg msg (\\ i)), p)) \\ oseqp_sos \\ i\"\n by (metis fun_upd_same oreceiveT)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\\n ((\\, {l}receive(fmsg).p), receive msg, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\' \\ l p and fas :: \"'s \\ 's\"\n assume *: \"\\' i = fas (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (\\(i := fas (\\ i))) j = \\' j\" by clarsimp\n moreover from * ** have \"((\\, {l}\\fas\\ p), \\, (\\(i := fas (\\ i)), p)) \\ oseqp_sos \\ i\"\n by (metis fun_upd_same oassignT)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, {l}\\fas\\ p), \\, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix g :: \"'s \\ 's set\" and \\ \\' l p\n assume *: \"\\' i \\ g (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (SOME \\'. \\' i = \\' i) j = \\' j\" by simp (metis (lifting, full_types) some_eq_ex)\n moreover with * ** have \"((\\, {l}\\g\\ p), \\, (SOME \\'. \\' i = \\' i, p)) \\ oseqp_sos \\ i\"\n by simp (metis oguardT step_seq_tau)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, {l}\\g\\ p), \\, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ pn a \\' p'\n assume \"((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n and IH: \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, call(pn)), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ p a \\' p' q\n assume \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p \\ q), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ p a \\' q q'\n assume \"((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p \\ q), a, (\\', q')) \\ oseqp_sos \\ i\"\n by blast\n qed (simp_all, (metis ogroupcastT ounicastT onotunicastT osendT odeliverT)+)\n qed\n\nlemma oseqp_sos_subreachable [intro!, simp]:\n assumes \"trans OA = oseqp_sos \\ i\"\n shows \"subreachable OA (other ANY {i}) {i}\"\n by rule (clarsimp simp add: assms(1))+\n\nlemma oseq_step_is_seq_step:\n fixes \\ :: \"ip \\ 's\"\n assumes \"((\\, p), a :: 'm seq_action, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\ i = \\\"\n shows \"\\\\'. \\' i = \\' \\ ((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n using assms proof induction\n fix \\ \\' l ms p\n assume \"\\' i = \\ i\"\n and \"\\ i = \\\"\n hence \"\\' i = \\\" by simp\n have \"((\\, {l}broadcast(ms).p), broadcast (ms \\), (\\, p)) \\ seqp_sos \\\"\n by auto\n with \\\\ i = \\\\ and \\\\' i = \\\\ show \"\\\\'. \\' i = \\'\n \\ ((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ seqp_sos \\\"\n by clarsimp\n next\n fix fmsg :: \"'m \\ 's \\ 's\" and msg :: 'm and \\' \\ l p\n assume \"\\' i = fmsg msg (\\ i)\"\n and \"\\ i = \\\"\n have \"((\\, {l}receive(fmsg).p), receive msg, (fmsg msg \\, p)) \\ seqp_sos \\\"\n by auto\n with \\\\' i = fmsg msg (\\ i)\\ and \\\\ i = \\\\\n show \"\\\\'. \\' i = \\' \\ ((\\, {l}receive(fmsg).p), receive msg, (\\', p)) \\ seqp_sos \\\"\n by clarsimp\n qed (simp_all, (metis assignT choiceT1 choiceT2 groupcastT guardT\n callT unicastT notunicastT sendT deliverT step_seq_tau)+)\n\nlemma reachable_oseq_seqp_sos:\n assumes \"(\\, p) \\ reachable OA I\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n using assms(1) proof (induction rule: reachable_pair_induct)\n fix \\ p\n assume \"(\\, p) \\ init OA\"\n with \\initiali i (init OA) (init A)\\ obtain \\ where \"\\ i = \\\"\n and \"(\\, p) \\ init A\"\n by auto\n from \\(\\, p) \\ init A\\ have \"(\\, p) \\ reachable A I\" ..\n with \\\\ i = \\\\ show \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n by auto\n next\n fix \\ p \\' p' a\n assume \"(\\, p) \\ reachable OA I\"\n and IH: \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n and otr: \"((\\, p), a, (\\', p')) \\ trans OA\"\n and \"I a\"\n from IH obtain \\ where \"\\ i = \\\"\n and cr: \"(\\, p) \\ reachable A I\"\n by clarsimp\n from otr and spo have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n with \\\\ i = \\\\ obtain \\' where \"\\' i = \\'\"\n and \"((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n by (auto dest!: oseq_step_is_seq_step)\n from this(2) and sp have ctr: \"((\\, p), a, (\\', p')) \\ trans A\" by simp\n from \\(\\, p) \\ reachable A I\\ and ctr and \\I a\\\n have \"(\\', p') \\ reachable A I\" ..\n with \\\\' i = \\'\\ show \"\\\\. \\' i = \\ \\ (\\, p') \\ reachable A I\"\n by blast\n qed\n\nlemma reachable_oseq_seqp_sos':\n assumes \"s \\ reachable OA I\"\n and \"initiali i (init OA) (init A)\"\n and \"trans OA = oseqp_sos \\ i\"\n and \"trans A = seqp_sos \\\"\n shows \"\\\\. (fst s) i = \\ \\ (\\, snd s) \\ reachable A I\"\n using assms\n by - (cases s, auto dest: reachable_oseq_seqp_sos)\n\ntext \\\n Any invariant shown in the (simpler) closed semantics can be transferred to an invariant in\n the open semantics.\n\\\n\ntheorem open_seq_invariant [intro]:\n assumes \"A \\ (I \\) P\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"OA \\ (act I, other ANY {i} \\) (seql i P)\"\n proof -\n have \"OA \\ (I \\) (seql i P)\"\n proof (rule invariant_arbitraryI)\n fix s \n assume \"s \\ reachable OA I\"\n with \\initiali i (init OA) (init A)\\ obtain \\ where \"(fst s) i = \\\"\n and \"(\\, snd s) \\ reachable A I\"\n by (auto dest: reachable_oseq_seqp_sos' [OF _ _ spo sp])\n with \\A \\ (I \\) P\\ have \"P (\\, snd s)\" by auto\n with \\(fst s) i = \\\\ show \"seql i P s\" by auto\n qed\n moreover from spo have \"subreachable OA (other ANY {i}) {i}\" ..\n ultimately show ?thesis\n proof (rule open_closed_invariant)\n fix \\ \\' s\n assume \"\\j\\{i}. \\' j = \\ j\"\n and \"seql i P (\\', s)\"\n thus \"seql i P (\\, s)\" ..\n qed\n qed\n\ndefinition\n seqll :: \"'i \\ ((('s \\ 'l) \\ 'a \\ ('s \\ 'l)) \\ bool)\n \\ ((('i \\ 's) \\ 'l) \\ 'a \\ (('i \\ 's) \\ 'l)) \\ bool\"\nwhere\n \"seqll i P \\ (\\((\\, p), a, (\\', p')). P ((\\ i, p), a, (\\' i, p')))\"\n\nlemma same_seqll [elim]:\n assumes \"\\j\\{i}. \\\\<^sub>1' j = \\\\<^sub>1 j\"\n and \"\\j\\{i}. \\\\<^sub>2' j = \\\\<^sub>2 j\"\n and \"seqll i P ((\\\\<^sub>1', s), a, (\\\\<^sub>2', s'))\"\n shows \"seqll i P ((\\\\<^sub>1, s), a, (\\\\<^sub>2, s'))\"\n using assms unfolding seqll_def by (clarsimp)\n\nlemma seqllI [intro!]:\n assumes \"P ((\\ i, p), a, (\\' i, p'))\"\n shows \"seqll i P ((\\, p), a, (\\', p'))\"\n using assms unfolding seqll_def by simp\n\nlemma seqllD [dest]:\n assumes \"seqll i P ((\\, p), a, (\\', p'))\"\n shows \"P ((\\ i, p), a, (\\' i, p'))\"\n using assms unfolding seqll_def by simp\n\nlemma seqllsimp:\n \"seqll i P ((\\, p), a, (\\', p')) = P ((\\ i, p), a, (\\' i, p'))\"\n unfolding seqll_def by simp\n\nlemma seqll_onll_swap:\n \"seqll i (onll \\ P) = onll \\ (seqll i P)\"\n unfolding seqll_def onll_def by simp\n\ntheorem open_seq_step_invariant [intro]:\n assumes \"A \\\\<^sub>A (I \\) P\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"OA \\\\<^sub>A (act I, other ANY {i} \\) (seqll i P)\"\n proof -\n have \"OA \\\\<^sub>A (I \\) (seqll i P)\"\n proof (rule step_invariant_arbitraryI)\n fix \\ p a \\' p'\n assume or: \"(\\, p) \\ reachable OA I\"\n and otr: \"((\\, p), a, (\\', p')) \\ trans OA\"\n and \"I a\"\n from or \\initiali i (init OA) (init A)\\ spo sp obtain \\ where \"\\ i = \\\"\n and cr: \"(\\, p) \\ reachable A I\"\n by - (drule(3) reachable_oseq_seqp_sos', auto)\n from otr and spo have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n with \\\\ i = \\\\ obtain \\' where \"\\' i = \\'\"\n and ctr: \"((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n by (auto dest!: oseq_step_is_seq_step)\n with sp have \"((\\, p), a, (\\', p')) \\ trans A\" by simp\n with \\A \\\\<^sub>A (I \\) P\\ cr have \"P ((\\, p), a, (\\', p'))\" using \\I a\\ ..\n with \\\\ i = \\\\ and \\\\' i = \\'\\ have \"P ((\\ i, p), a, (\\' i, p'))\" by simp\n thus \"seqll i P ((\\, p), a, (\\', p'))\" ..\n qed\n moreover from spo have \"local_steps (trans OA) {i}\" by simp\n moreover have \"other_steps (other ANY {i}) {i}\" ..\n ultimately show ?thesis\n proof (rule open_closed_step_invariant)\n fix \\ \\ a \\' \\' s s'\n assume \"\\j\\{i}. \\ j = \\ j\"\n and \"\\j\\{i}. \\' j = \\' j\"\n and \"seqll i P ((\\, s), a, (\\', s'))\"\n thus \"seqll i P ((\\, s), a, (\\', s'))\" ..\n qed\n qed\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/OAWN_Convert.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.25919102195464}} {"text": "(* Title: OAWN_Invariants.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke\n*)\n\nsection \"Generic open invariants on sequential AWN processes\"\n\ntheory OAWN_Invariants\nimports Invariants OInvariants\n AWN_Cterms AWN_Labels AWN_Invariants\n OAWN_SOS\nbegin\n\nsubsection \"Open invariants via labelled control terms\"\n\nlemma oseqp_sos_subterms:\n assumes \"wellformed \\\"\n and \"\\pn. p \\ subterms (\\ pn)\"\n and \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n shows \"\\pn. p' \\ subterms (\\ pn)\"\n using assms\n proof (induct p)\n fix p1 p2\n assume IH1: \"\\pn. p1 \\ subterms (\\ pn) \\\n ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i \\\n \\pn. p' \\ subterms (\\ pn)\"\n and IH2: \"\\pn. p2 \\ subterms (\\ pn) \\\n ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i \\\n \\pn. p' \\ subterms (\\ pn)\"\n and \"\\pn. p1 \\ p2 \\ subterms (\\ pn)\"\n and \"((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n from \\\\pn. p1 \\ p2 \\ subterms (\\ pn)\\ obtain pn\n where \"p1 \\ subterms (\\ pn)\"\n and \"p2 \\ subterms (\\ pn)\" by auto\n from \\((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\\\n have \"((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\" by auto\n thus \"\\pn. p' \\ subterms (\\ pn)\"\n proof\n assume \"((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n with \\p1 \\ subterms (\\ pn)\\ show ?thesis by (auto intro: IH1)\n next\n assume \"((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n with \\p2 \\ subterms (\\ pn)\\ show ?thesis by (auto intro: IH2)\n qed\n qed auto\n\nlemma oreachable_subterms:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n and \"(\\, p) \\ oreachable A S U\"\n shows \"\\pn. p \\ subterms (\\ pn)\"\n using assms(4)\n proof (induct rule: oreachable_pair_induct)\n fix \\ p\n assume \"(\\, p) \\ init A\"\n with \\control_within \\ (init A)\\ show \"\\pn. p \\ subterms (\\ pn)\" ..\n next\n fix \\ p a \\' p'\n assume \"(\\, p) \\ oreachable A S U\"\n and \"\\pn. p \\ subterms (\\ pn)\"\n and 3: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n moreover from 3 and \\trans A = oseqp_sos \\ i\\\n have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n ultimately show \"\\pn. p' \\ subterms (\\ pn)\"\n using \\wellformed \\\\\n by (auto elim: oseqp_sos_subterms)\n qed\n\nlemma onl_oinvariantI [intro]:\n assumes init: \"\\\\ p l. \\ (\\, p) \\ init A; l \\ labels \\ p \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\ (\\, p) \\ oreachable A S U;\n \\l\\labels \\ p. P (\\, l);\n U \\ \\' \\ \\ \\l\\labels \\ p. P (\\', l)\"\n and step: \"\\\\ p a \\' p' l'.\n \\ (\\, p) \\ oreachable A S U;\n \\l\\labels \\ p. P (\\, l);\n ((\\, p), a, (\\', p')) \\ trans A;\n l' \\ labels \\ p';\n S \\ \\' a \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p\n assume \"(\\, p) \\ init A\"\n hence \"\\l\\labels \\ p. P (\\, l)\" using init by simp\n thus \"onl \\ P (\\, p)\" ..\n next\n fix \\ p a \\' p'\n assume rp: \"(\\, p) \\ oreachable A S U\"\n and \"onl \\ P (\\, p)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n from \\onl \\ P (\\, p)\\ have \"\\l\\labels \\ p. P (\\, l)\" ..\n with rp tr \\S \\ \\' a\\ have \"\\l'\\labels \\ p'. P (\\', l')\" by (auto elim: step)\n thus \"onl \\ P (\\', p')\" ..\n next\n fix \\ \\' p\n assume \"(\\, p) \\ oreachable A S U\"\n and \"onl \\ P (\\, p)\"\n and \"U \\ \\'\"\n from \\onl \\ P (\\, p)\\ have \"\\l\\labels \\ p. P (\\, l)\" by auto\n with \\(\\, p) \\ oreachable A S U\\ have \"\\l\\labels \\ p. P (\\', l)\"\n using \\U \\ \\'\\ by (rule other)\n thus \"onl \\ P (\\', p)\" by auto\n qed\n\nlemma global_oinvariantI [intro]:\n assumes init: \"\\\\ p. (\\, p) \\ init A \\ P \\\"\n and other: \"\\\\ \\' p l. \\ (\\, p) \\ oreachable A S U; P \\; U \\ \\' \\ \\ P \\'\"\n and step: \"\\\\ p a \\' p'.\n \\ (\\, p) \\ oreachable A S U;\n P \\;\n ((\\, p), a, (\\', p')) \\ trans A;\n S \\ \\' a \\ \\ P \\'\"\n shows \"A \\ (S, U \\) (\\(\\, _). P \\)\"\n proof\n fix \\ p\n assume \"(\\, p) \\ init A\"\n thus \"(\\(\\, _). P \\) (\\, p)\"\n by simp (erule init)\n next\n fix \\ p a \\' p'\n assume rp: \"(\\, p) \\ oreachable A S U\"\n and \"(\\(\\, _). P \\) (\\, p)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n from \\(\\(\\, _). P \\) (\\, p)\\ have \"P \\\" by simp\n with rp have \"P \\'\"\n using tr \\S \\ \\' a\\ by (rule step)\n thus \"(\\(\\, _). P \\) (\\', p')\" by simp\n next\n fix \\ \\' p\n assume \"(\\, p) \\ oreachable A S U\"\n and \"(\\(\\, _). P \\) (\\, p)\"\n and \"U \\ \\'\"\n hence \"P \\'\" by simp (erule other)\n thus \"(\\(\\, _). P \\) (\\', p)\" by simp\n qed\n\nlemma onl_oinvariantD [dest]:\n assumes \"A \\ (S, U \\) onl \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n shows \"P (\\, l)\"\n using assms unfolding onl_def by auto\n\nlemma onl_oinvariant_weakenD [dest]:\n assumes \"A \\ (S', U' \\) onl \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n and weakenS: \"\\s s' a. S s s' a \\ S' s s' a\"\n and weakenU: \"\\s s'. U s s' \\ U' s s'\"\n shows \"P (\\, l)\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with \\A \\ (S', U' \\) onl \\ P\\ show \"P (\\, l)\"\n using \\l \\ labels \\ p\\ ..\n qed\n\nlemma onl_oinvariant_initD [dest]:\n assumes invP: \"A \\ (S, U \\) onl \\ P\"\n and init: \"(\\, p) \\ init A\"\n and pnl: \"l \\ labels \\ p\"\n shows \"P (\\, l)\"\n proof -\n from init have \"(\\, p) \\ oreachable A S U\" ..\n with invP show ?thesis using pnl ..\n qed\n\nlemma onl_oinvariant_sterms:\n assumes wf: \"wellformed \\\"\n and il: \"A \\ (S, U \\) onl \\ P\"\n and rp: \"(\\, p) \\ oreachable A S U\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n shows \"P (\\, l)\"\n proof -\n from wf \\p'\\sterms \\ p\\ \\l\\labels \\ p'\\ have \"l\\labels \\ p\"\n by (rule labels_sterms_labels)\n with il rp show \"P (\\, l)\" ..\n qed\n\nlemma onl_oinvariant_sterms_weaken:\n assumes wf: \"wellformed \\\"\n and il: \"A \\ (S', U' \\) onl \\ P\"\n and rp: \"(\\, p) \\ oreachable A S U\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n and weakenS: \"\\\\ \\' a. S \\ \\' a \\ S' \\ \\' a\"\n and weakenU: \"\\\\ \\'. U \\ \\' \\ U' \\ \\'\"\n shows \"P (\\, l)\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with assms(1-2) show ?thesis using assms(4-5)\n by (rule onl_oinvariant_sterms)\n qed\n\nlemma otrans_from_sterms:\n assumes \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n shows \"\\p'\\sterms \\ p. ((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n using assms by (induction p rule: sterms_pinduct [OF \\wellformed \\\\]) auto\n\nlemma otrans_from_sterms':\n assumes \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n and \"p' \\ sterms \\ p\"\n shows \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n using assms by (induction p rule: sterms_pinduct [OF \\wellformed \\\\]) auto\n\nlemma otrans_to_dterms:\n assumes \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n shows \"\\r\\sterms \\ q. r \\ dterms \\ p\"\n using assms by (induction q) auto\n\ntheorem cterms_includes_sterms_of_oseq_reachable:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n shows \"\\(sterms \\ ` snd ` oreachable A S U) \\ cterms \\\"\n proof\n fix qs\n assume \"qs \\ \\(sterms \\ ` snd ` oreachable A S U)\"\n then obtain \\ and q where *: \"(\\, q) \\ oreachable A S U\"\n and **: \"qs \\ sterms \\ q\" by auto\n from * have \"\\x. x \\ sterms \\ q \\ x \\ cterms \\\"\n proof (induction rule: oreachable_pair_induct)\n fix \\ p q\n assume \"(\\, p) \\ init A\"\n and \"q \\ sterms \\ p\"\n from \\control_within \\ (init A)\\ and \\(\\, p) \\ init A\\\n obtain pn where \"p \\ subterms (\\ pn)\" by auto\n with \\wellformed \\\\ show \"q \\ cterms \\\" using \\q\\sterms \\ p\\\n by (rule subterms_sterms_in_cterms)\n next\n fix p \\ a \\' q x\n assume \"(\\, p) \\ oreachable A S U\"\n and IH: \"\\x. x \\ sterms \\ p \\ x \\ cterms \\\"\n and \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"x \\ sterms \\ q\"\n from this(3) and \\trans A = oseqp_sos \\ i\\\n have step: \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n from step \\wellformed \\\\ obtain ps\n where ps: \"ps \\ sterms \\ p\"\n and step': \"((\\, ps), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (rule otrans_from_sterms [THEN bexE])\n from ps have \"ps \\ cterms \\\" by (rule IH)\n moreover from step' \\wellformed \\\\ \\x \\ sterms \\ q\\ have \"x \\ dterms \\ ps\"\n by (rule otrans_to_dterms [rule_format])\n ultimately show \"x \\ cterms \\\" by (rule ctermsDI)\n qed\n thus \"qs \\ cterms \\\" using ** .\n qed\n\ncorollary oseq_reachable_in_cterms:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"p' \\ sterms \\ p\"\n shows \"p' \\ cterms \\\"\n using assms(1-3)\n proof (rule cterms_includes_sterms_of_oseq_reachable [THEN subsetD])\n from assms(4-5) show \"p' \\ \\(sterms \\ ` snd ` oreachable A S U)\"\n by (auto elim!: rev_bexI)\n qed\n\nlemma oseq_invariant_ctermI:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and init: \"\\\\ p l. \\\n (\\, p) \\ init A;\n l\\labels \\ p\n \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\\n (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\p l \\ a q l' \\' pp. \\\n p\\cterms \\;\n l\\labels \\ p;\n P (\\, l);\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp)\\oreachable A S U;\n p\\sterms \\ pp;\n (\\', q)\\oreachable A S U;\n S \\ \\' a\n \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p l\n assume \"(\\, p) \\ init A\"\n and *: \"l \\ labels \\ p\"\n with init show \"P (\\, l)\" by auto\n next\n fix \\ p a \\' q l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and pl: \"\\l\\labels \\ p. P (\\, l)\"\n and tr: \"((\\, p), a, (\\', q)) \\ trans A\"\n and A6: \"l' \\ labels \\ q\"\n and \"S \\ \\' a\"\n thus \"P (\\', l')\"\n proof -\n from sr and tr and \\S \\ \\' a\\ have A7: \"(\\', q) \\ oreachable A S U\"\n by - (rule oreachable_local')\n from tr and sp have tr': \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n then obtain p' where \"p' \\ sterms \\ p\"\n and A4: \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (blast dest: otrans_from_sterms [OF _ wf])\n from wf cw sp sr this(1) have A1: \"p'\\cterms \\\"\n by (rule oseq_reachable_in_cterms)\n from labels_not_empty [OF wf] obtain ll where A2: \"ll\\labels \\ p'\"\n by blast\n with \\p'\\sterms \\ p\\ have \"ll\\labels \\ p\"\n by (rule labels_sterms_labels [OF wf])\n with pl have A3: \"P (\\, ll)\" by simp\n from sr \\p'\\sterms \\ p\\\n obtain pp where A7: \"(\\, pp)\\oreachable A S U\"\n and A8: \"p'\\sterms \\ pp\"\n by auto\n from sr tr \\S \\ \\' a\\ have A9: \"(\\', q)\\oreachable A S U\"\n by - (rule oreachable_local')\n from sp and \\((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\\\n have A5: \"((\\, p'), a, (\\', q)) \\ trans A\" by simp\n from A1 A2 A3 A4 A5 A6 A7 A8 A9 \\S \\ \\' a\\ show ?thesis by (rule local)\n qed\n next\n fix \\ \\' p l\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and \"\\l\\labels \\ p. P (\\, l)\"\n and \"U \\ \\'\"\n show \"\\l\\labels \\ p. P (\\', l)\"\n proof\n fix l\n assume \"l\\labels \\ p\"\n with \\\\l\\labels \\ p. P (\\, l)\\ have \"P (\\, l)\" ..\n with sr and \\l\\labels \\ p\\\n show \"P (\\', l)\" using \\U \\ \\'\\ by (rule other)\n qed\n qed\n\nlemma oseq_invariant_ctermsI:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and init: \"\\\\ p l. \\\n (\\, p) \\ init A;\n l\\labels \\ p\n \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\\n wellformed \\;\n (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\p l \\ a q l' \\' pp pn. \\\n wellformed \\;\n p\\ctermsl (\\ pn);\n not_call p;\n l\\labels \\ p;\n P (\\, l);\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp)\\oreachable A S U;\n p\\sterms \\ pp;\n (\\', q)\\oreachable A S U;\n S \\ \\' a\n \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof (rule oseq_invariant_ctermI [OF wf cw sl sp])\n fix \\ p l\n assume \"(\\, p) \\ init A\"\n and \"l \\ labels \\ p\"\n thus \"P (\\, l)\" by (rule init)\n next\n fix \\ \\' p l\n assume \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n and \"P (\\, l)\"\n and \"U \\ \\'\"\n with wf show \"P (\\', l)\" by (rule other)\n next\n fix p l \\ a q l' \\' pp\n assume \"p \\ cterms \\\"\n and otherassms: \"l \\ labels \\ p\"\n \"P (\\, l)\"\n \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n \"((\\, p), a, (\\', q)) \\ trans A\"\n \"l' \\ labels \\ q\"\n \"(\\, pp) \\ oreachable A S U\"\n \"p \\ sterms \\ pp\"\n \"(\\', q) \\ oreachable A S U\"\n \"S \\ \\' a\"\n from this(1) obtain pn where \"p \\ ctermsl(\\ pn)\"\n and \"not_call p\"\n unfolding cterms_def' [OF wf] by auto\n with wf show \"P (\\', l')\"\n using otherassms by (rule local)\n qed\n\nsubsection \"Open step invariants via labelled control terms\"\n\nlemma onll_ostep_invariantI [intro]:\n assumes *: \"\\\\ p l a \\' p' l'. \\ (\\, p)\\oreachable A S U;\n ((\\, p), a, (\\', p')) \\ trans A;\n S \\ \\' a;\n l \\labels \\ p;\n l'\\labels \\ p' \\\n \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n proof\n fix \\ p \\' p' a\n assume \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n hence \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\" by (auto elim!: *)\n thus \"onll \\ P ((\\, p), a, (\\', p'))\" ..\n qed\n\nlemma onll_ostep_invariantE [elim]:\n assumes \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n and lp: \"l \\labels \\ p\"\n and lp': \"l'\\labels \\ p'\"\n shows \"P ((\\, l), a, (\\', l'))\"\n proof -\n from assms(1-4) have \"onll \\ P ((\\, p), a, (\\', p'))\" ..\n with lp lp' show \"P ((\\, l), a, (\\', l'))\" by auto\n qed\n\nlemma onll_ostep_invariantD [dest]:\n assumes \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n shows \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n using assms by auto\n\nlemma onll_ostep_invariant_weakenD [dest]:\n assumes \"A \\\\<^sub>A (S', U' \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S' \\ \\' a\"\n and weakenS: \"\\s s' a. S s s' a \\ S' s s' a\"\n and weakenU: \"\\s s'. U s s' \\ U' s s'\"\n shows \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with \\A \\\\<^sub>A (S', U' \\) onll \\ P\\ show ?thesis\n using \\((\\, p), a, (\\', p')) \\ trans A\\ and \\S' \\ \\' a\\ ..\n qed\n\nlemma onll_ostep_to_invariantI [intro]:\n assumes sinv: \"A \\\\<^sub>A (S, U \\) onll \\ Q\"\n and wf: \"wellformed \\\"\n and init: \"\\\\ l p. \\ (\\, p) \\ init A; l\\labels \\ p \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l.\n \\ (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\\\ p l \\' l' a.\n \\ (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n Q ((\\, l), a, (\\', l'));\n S \\ \\' a\\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p l\n assume \"(\\, p) \\ init A\" and \"l\\labels \\ p\"\n thus \"P (\\, l)\" by (rule init)\n next\n fix \\ p a \\' p' l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and lp: \"\\l\\labels \\ p. P (\\, l)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n and lp': \"l' \\ labels \\ p'\"\n show \"P (\\', l')\"\n proof -\n from lp obtain l where \"l\\labels \\ p\" and \"P (\\, l)\"\n using labels_not_empty [OF wf] by auto\n from sinv sr tr \\S \\ \\' a\\ this(1) lp' have \"Q ((\\, l), a, (\\', l'))\" ..\n with sr \\l\\labels \\ p\\ \\P (\\, l)\\ show \"P (\\', l')\" using \\S \\ \\' a\\ by (rule local)\n qed\n next\n fix \\ \\' p l\n assume \"(\\, p) \\ oreachable A S U\"\n and \"\\l\\labels \\ p. P (\\, l)\"\n and \"U \\ \\'\"\n show \"\\l\\labels \\ p. P (\\', l)\"\n proof\n fix l\n assume \"l\\labels \\ p\"\n with \\\\l\\labels \\ p. P (\\, l)\\ have \"P (\\, l)\" ..\n with \\(\\, p) \\ oreachable A S U\\ and \\l\\labels \\ p\\\n show \"P (\\', l)\" using \\U \\ \\'\\ by (rule other)\n qed\n qed\n\nlemma onll_ostep_invariant_sterms:\n assumes wf: \"wellformed \\\"\n and si: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and sos: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"l'\\labels \\ q\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n shows \"P ((\\, l), a, (\\', l'))\"\n proof -\n from wf \\p'\\sterms \\ p\\ \\l\\labels \\ p'\\ have \"l\\labels \\ p\"\n by (rule labels_sterms_labels)\n with si sr sos \\S \\ \\' a\\ show \"P ((\\, l), a, (\\', l'))\" using \\l'\\labels \\ q\\ ..\n qed\n\nlemma oseq_step_invariant_sterms:\n assumes inv: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and wf: \"wellformed \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and \"l'\\labels \\ q\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and tr: \"((\\, p'), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"p'\\sterms \\ p\"\n shows \"\\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof\n from assms(3, 6) have \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n hence \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n using wf \\p'\\sterms \\ p\\ by (rule otrans_from_sterms')\n with assms(3) have trp: \"((\\, p), a, (\\', q)) \\ trans A\" by simp\n fix l assume \"l \\ labels \\ p'\"\n with wf inv sr trp \\S \\ \\' a\\ \\l'\\labels \\ q\\ \\p'\\sterms \\ p\\\n show \"P ((\\, l), a, (\\', l'))\"\n by - (erule(7) onll_ostep_invariant_sterms)\n qed\n\nlemma oseq_step_invariant_sterms_weaken:\n assumes inv: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and wf: \"wellformed \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and \"l'\\labels \\ q\"\n and sr: \"(\\, p) \\ oreachable A S' U'\"\n and tr: \"((\\, p'), a, (\\', q)) \\ trans A\"\n and \"S' \\ \\' a\"\n and \"p'\\sterms \\ p\"\n and weakenS: \"\\\\ \\' a. S' \\ \\' a \\ S \\ \\' a\"\n and weakenU: \"\\\\ \\'. U' \\ \\' \\ U \\ \\'\"\n shows \"\\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof -\n from \\S' \\ \\' a\\ have \"S \\ \\' a\" by (rule weakenS)\n from \\(\\, p) \\ oreachable A S' U'\\\n have Ir: \"(\\, p) \\ oreachable A S U\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with assms(1-4) show ?thesis\n using tr \\S \\ \\' a\\ \\p'\\sterms \\ p\\\n by (rule oseq_step_invariant_sterms)\n qed\n\nlemma onll_ostep_invariant_any_sterms:\n assumes wf: \"wellformed \\\"\n and si: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and sos: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"l'\\labels \\ q\"\n shows \"\\p'\\sterms \\ p. \\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n by (intro ballI) (rule onll_ostep_invariant_sterms [OF assms])\n\nlemma oseq_step_invariant_ctermI [intro]:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and local: \"\\p l \\ a q l' \\' pp. \\\n p\\cterms \\;\n l\\labels \\ p;\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp) \\ oreachable A S U;\n p\\sterms \\ pp;\n (\\', q) \\ oreachable A S U;\n S \\ \\' a\n \\ \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n proof\n fix \\ p l a \\' q l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and tr: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and pl: \"l \\ labels \\ p\"\n and A5: \"l' \\ labels \\ q\"\n from this(2) and sp have \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n then obtain p' where \"p' \\ sterms \\ p\"\n and A3: \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (blast dest: otrans_from_sterms [OF _ wf])\n from this(2) and sp have A4: \"((\\, p'), a, (\\', q)) \\ trans A\" by simp\n from wf cw sp sr \\p'\\sterms \\ p\\ have A1: \"p'\\cterms \\\"\n by (rule oseq_reachable_in_cterms)\n from sr \\p'\\sterms \\ p\\\n obtain pp where A6: \"(\\, pp)\\oreachable A S U\"\n and A7: \"p'\\sterms \\ pp\"\n by auto\n from sr tr \\S \\ \\' a\\ have A8: \"(\\', q)\\oreachable A S U\"\n by - (erule(2) oreachable_local')\n from wf cw sp sr have \"\\pn. p \\ subterms (\\ pn)\"\n by (rule oreachable_subterms) \n with sl wf have \"\\p'\\sterms \\ p. l \\ labels \\ p'\"\n using pl by (rule simple_labels_in_sterms)\n with \\p' \\ sterms \\ p\\ have \"l \\ labels \\ p'\" by simp\n with A1 show \"P ((\\, l), a, (\\', l'))\" using A3 A4 A5 A6 A7 A8 \\S \\ \\' a\\\n by (rule local)\n qed\n\nlemma oseq_step_invariant_ctermsI [intro]:\n assumes wf: \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"simple_labels \\\"\n and \"trans A = oseqp_sos \\ i\"\n and local: \"\\p l \\ a q l' \\' pp pn. \\\n wellformed \\;\n p\\ctermsl (\\ pn);\n not_call p;\n l\\labels \\ p;\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp) \\ oreachable A S U;\n p\\sterms \\ pp;\n (\\', q) \\ oreachable A S U;\n S \\ \\' a\n \\ \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n using assms(1-4) proof (rule oseq_step_invariant_ctermI)\n fix p l \\ a q l' \\' pp\n assume \"p \\ cterms \\\"\n and otherassms: \"l \\ labels \\ p\"\n \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n \"((\\, p), a, (\\', q)) \\ trans A\"\n \"l' \\ labels \\ q\"\n \"(\\, pp) \\ oreachable A S U\"\n \"p \\ sterms \\ pp\"\n \"(\\', q) \\ oreachable A S U\"\n \"S \\ \\' a\"\n from this(1) obtain pn where \"p \\ ctermsl(\\ pn)\"\n and \"not_call p\"\n unfolding cterms_def' [OF wf] by auto\n with wf show \"P ((\\, l), a, (\\', l'))\"\n using otherassms by (rule local)\n qed\n\nlemma open_seqp_action [elim]:\n assumes \"wellformed \\\"\n and \"((\\ i, p), a, (\\' i, p')) \\ seqp_sos \\\"\n shows \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n proof -\n from assms obtain ps where \"ps\\sterms \\ p\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n by - (drule trans_from_sterms, auto)\n thus ?thesis\n proof (induction p)\n fix p1 p2\n assume \"\\ ps \\ sterms \\ p1; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\ ps \\ sterms \\ p2; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"ps \\ sterms \\ (p1 \\ p2)\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n with assms(1) show \"((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n by simp (metis oseqp_sos.ochoiceT1 oseqp_sos.ochoiceT2)\n next\n fix l fip fmsg p1 p2\n assume IH1: \"\\ ps \\ sterms \\ p1; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n and IH2: \"\\ ps \\ sterms \\ p2; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"ps \\ sterms \\ ({l}unicast(fip, fmsg). p1 \\ p2)\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n from this(3-4) have \"((\\ i, {l}unicast(fip, fmsg). p1 \\ p2), a, (\\' i, p')) \\ seqp_sos \\\"\n by simp\n thus \"((\\, {l}unicast(fip, fmsg). p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n proof (rule seqp_unicastTE)\n assume \"a = unicast (fip (\\ i)) (fmsg (\\ i))\"\n and \"\\' i = \\ i\"\n and \"p' = p1\"\n thus ?thesis by auto\n next\n assume \"a = \\unicast (fip (\\ i))\"\n and \"\\' i = \\ i\"\n and \"p' = p2\"\n thus ?thesis by auto\n qed\n next\n fix p\n assume \"ps \\ sterms \\ (call(p))\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n with assms(1) have \"((\\, ps), a, (\\', p')) \\ oseqp_sos \\ i\"\n by (cases ps) auto\n with assms(1) \\ps \\ sterms \\ (call(p))\\ have \"((\\, \\ p), a, (\\', p')) \\ oseqp_sos \\ i\"\n by - (rule otrans_from_sterms', simp_all)\n thus \"((\\, call(p)), a, (\\', p')) \\ oseqp_sos \\ i\" by auto\n qed auto\n qed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AWN/OAWN_Invariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.25917279984343794}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_op_rep_par\nimports CSP_F_op_alpha_par CSP_T_op_rep_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*============================================================*\n | |\n | replicated alphabetized parallel |\n | |\n *============================================================*)\n\n(*** Inductive_parallel ***)\n\nlemma in_failures_Inductive_parallel_lm1: \n \"Y Int insert Tick (Ev ` snd a) Un\n Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set PXYs} =\n Union {Ya Int insert Tick (Ev ` X) |X Ya.\n EX P. P = fst a & X = snd a & Ya = Y | ((P, X), Ya) : set PXYs}\"\nby (auto)\n\nlemma in_failures_Inductive_parallel_lm2: \n \"((P, X), Y) : set s ==> X <= Union (snd ` fst ` set s)\"\napply (auto)\napply (rule_tac x=\"((P, X), Y)\" in bexI)\nby (simp_all)\n\nlemma in_failures_Inductive_parallel_lm3:\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs} <=\n insert Tick (Ev ` Union (snd ` fst ` set zs))\"\napply (rule)\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (elim conjE disjE)\napply (simp)\napply (rule disjI2)\napply (auto)\napply (simp add: image_iff)\napply (rule_tac x=\"((P, X), Y)\" in bexI)\napply (auto)\ndone\n\nlemma in_failures_Inductive_parallel_lm4:\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs} Int\n insert Tick (Ev ` Union (snd ` fst ` set zs))\n = Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs}\"\napply (rule Int_subset_eq)\napply (simp add: in_failures_Inductive_parallel_lm3)\ndone\n\n(* main *)\n\nlemma in_failures_Inductive_parallel_lm:\n \"PXs ~= [] --> (ALL f.\n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M)))))))\"\napply (induct_tac PXs)\n\n(* case 0 *)\n apply (simp)\n\n(* case 1 *)\n apply (case_tac \"list = []\")\n apply (simp)\n apply (intro allI)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures)\n apply (rule iffI)\n (* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (erule disjE)\n\n apply (rule_tac x=\"[(a,Y)]\" in exI)\n apply (simp)\n\n apply (rule conjI)\n apply (simp add: Evset_def pair_eq_decompo)\n apply (fast)\n apply (intro allI impI)\n apply (simp add: pair_eq_decompo)\n\n apply (case_tac \"Tick ~: Z\")\n apply (rule_tac x=\"[(a,Y)]\" in exI)\n apply (simp add: Evset_def pair_eq_decompo)\n(* apply (fast) *)\n (* Tick : Z *)\n apply (rule_tac x=\"[(a,insert Tick Y)]\" in exI)\n apply (simp)\n\n apply (simp add: rest_tr_Tick_sett)\n apply (elim conjE exE)\n apply (simp add: pair_eq_decompo)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_T2_T3, simp)\n apply (simp)\n\n (* <= *)\n apply (elim conjE exE)\n apply (simp)\n apply (subgoal_tac \"EX bb. PXYs=[(a,bb)]\")\n apply (elim conjE exE)\n apply (subgoal_tac \"aa rest-tr {} = <> | aa rest-tr {} = \")\n apply (erule disjE)\n\n (* <> *)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp add: pair_eq_decompo)\n\n (* *)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp add: pair_eq_decompo)\n\n apply (simp add: rest_tr_empty)\n apply (force)\n\n(* step case *)\napply (simp add: in_failures_Alpha_parallel)\napply (intro allI impI)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\"(a,Y) # PXYs\" in exI)\n apply (simp add: pair_eq_decompo)\n apply (simp add: in_failures_Inductive_parallel_lm1)\n\n apply (intro allI impI)\n apply (drule_tac x=\"P\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule_tac x=\"Ya\" in spec)\n apply (simp)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n\n apply (rotate_tac -4)\n apply (drule sym)\n apply (simp add: in_failures_Inductive_parallel_lm2)\n\n(* <= *)\n apply (simp)\n apply (elim conjE exE)\n\n apply (subgoal_tac \"EX bb zs. PXYs = (a, bb) # zs & map fst zs = list\")\n apply (elim conjE exE)\n apply (rule_tac x=\"bb\" in exI)\n apply (rule_tac x=\n \"Union {Y Int insert Tick (Ev ` X) |X Y. EX P. ((P, X), Y) : set zs}\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n apply (rotate_tac -1)\n apply (drule sym)\n apply (simp)\n apply (simp add: in_failures_Inductive_parallel_lm4)\n apply (simp add: in_failures_Inductive_parallel_lm1)\n\n apply (rule_tac x=\"zs\" in exI)\n apply (rotate_tac -1)\n apply (drule sym)\n apply (simp add: in_failures_Inductive_parallel_lm4)\n\n apply (intro allI impI)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (simp add: in_failures_Inductive_parallel_lm2)\napply (auto)\ndone\n\n(*** remove ALL ***)\n\nlemma in_failures_Inductive_parallel:\n \"PXs ~= [] ==> \n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M))))))\"\nby (simp add: in_failures_Inductive_parallel_lm)\n\n(*** Semantics for replicated alphabetized parallel on F ***)\n\nlemma failures_Inductive_parallel:\n \"PXs ~= []\n ==> failures([||] PXs) M =\n {f. (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX PXYs. map fst PXYs = PXs &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {(Y Int insert Tick (Ev ` X))|X Y. EX P. ((P,X),Y) : set PXYs} &\n (ALL P X Y. ((P,X),Y) : set PXYs --> ((u rest-tr X), Y) :f failures(P) M))))))}f\"\napply (simp add: in_failures_Inductive_parallel[THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_failures_Inductive_parallel:\n \"[| PXs ~= [] ; (t,X) :f failures([||] PXs) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` set PXs))\"\nby (simp add: in_failures_Inductive_parallel)\n\n(*---------------------------------------------------------*\n | another expression of Inductive_parallel_eval |\n *---------------------------------------------------------*)\n\nlemma in_failures_Inductive_parallel_nth:\n \"PXs ~= [] ==> \n (f :f failures([||] PXs) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` set PXs)) & \n (EX Z. f = (u, Z) &\n (EX Ys. length PXs = length Ys &\n (Z Int insert Tick (Ev ` Union (snd ` set PXs))\n = Union {((Ys!i) Int insert Tick (Ev ` (snd (PXs!i))))|i. i < length PXs} &\n (ALL i. i < length PXs --> ((u rest-tr (snd (PXs!i))), Ys!i) :f \n failures(fst (PXs!i)) M))))))\"\napply (simp add: in_failures_Inductive_parallel)\napply (simp add: set_nth)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"map snd PXYs\" in exI)\n apply (simp)\n apply (rotate_tac 3)\n apply (drule sym)\n apply (simp)\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n\n apply (rule equalityI)\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"map snd PXYs ! i Int\n insert Tick (Ev ` snd (map fst PXYs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"map snd PXYs ! i Int\n insert Tick (Ev ` snd (map fst PXYs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\n \"(snd (PXYs ! i)) Int insert Tick (Ev ` snd (fst (PXYs ! i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (fst (PXYs ! i))\" in exI)\n apply (rule_tac x=\"snd (PXYs ! i)\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\n \"(snd (PXYs ! i)) Int insert Tick (Ev ` snd (fst (PXYs ! i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (fst (PXYs ! i))\" in exI)\n apply (rule_tac x=\"snd (PXYs ! i)\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (intro allI impI)\n apply (drule_tac x=\"fst (fst (PXYs ! i))\" in spec)\n apply (drule_tac x=\"snd (fst (PXYs ! i))\" in spec)\n apply (drule_tac x=\"snd (PXYs ! i)\" in spec)\n apply (simp)\n apply (fast)\n\n (* => *)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"zip PXs Ys\" in exI)\n apply (simp add: map_fst_zip_eq)\n\n apply (rule conjI)\n apply (simp add: pair_eq_decompo)\n\n apply (rule equalityI)\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (PXs ! i)\" in exI)\n apply (rule_tac x=\"Ys ! i\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"snd (PXs ! i)\" in exI)\n apply (rule_tac x=\"Ys ! i\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (elim conjE disjE)\n apply (simp)\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (rule_tac x=\"Ys ! i Int insert Tick (Ev ` snd (PXs ! i))\" in exI)\n apply (simp)\n apply (rule_tac x=\"i\" in exI)\n apply (simp)\n\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (drule_tac x=\"i\" in spec)\n apply (simp add: pair_eq_decompo)\ndone\n\n(*============================================================*\n | |\n | indexed alphabetized parallel |\n | |\n *============================================================*)\n\n(*** failures Inductive_parallel ***)\n\nlemma in_failures_Rep_parallel_lm1:\n \"[| Is isListOf I ; length Ys = length Is |] ==>\n Union {(Ys ! i Int insert Tick (Ev ` snd (map PXf Is ! i))) |i. i < length Ys} =\n Union {(Ys ! (THE n. Is ! n = i & n < length Is) Int\n insert Tick (Ev ` snd (PXf i))) | i. i : I}\"\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\n \"Ys ! (THE n. Is ! n = (Is ! i) & n < length Is) Int\n insert Tick (Ev ` snd (PXf (Is ! i)))\" in exI)\n apply (simp add: isListOf_THE_nth)\n apply (rule_tac x=\"(Is ! i)\" in exI)\n apply (simp add: isListOf_THE_nth)\n apply (simp add: isListOf_nth_in_index)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE, simp)\n apply (simp add: isListOf_THE_nth)\n apply (rule_tac x=\n \"Ys ! n Int insert Tick (Ev ` snd (PXf (Is ! n)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp)\ndone\n\nlemma in_failures_Rep_parallel_lm2:\n \"Is isListOf I ==>\n Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I} =\n Union {(map Yf Is ! i Int insert Tick (Ev ` snd (map PXf Is ! i))) |i. i < length Is}\"\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE exE, simp)\n apply (rule_tac x=\n \"map Yf Is ! n Int insert Tick (Ev ` snd (map PXf Is ! n))\" in exI)\n apply (simp)\n apply (rule_tac x=\"n\" in exI)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x= \"Yf (Is!i) Int insert Tick (Ev ` snd (PXf (Is!i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"(Is!i)\" in exI)\n apply (simp add: isListOf_nth_in_index)\ndone\n\nlemma in_failures_Rep_parallel:\n \"[| I ~= {} ; finite I |]\n ==> (f :f failures ([||]:I PXf) M) =\n (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` PXf ` I)) & \n (EX Z. f = (u, Z) &\n (EX Yf. \n (Z Int insert Tick (Ev ` Union (snd ` PXf ` I))\n = Union {((Yf i) Int insert Tick (Ev ` (snd (PXf i))))|i. i : I} &\n (ALL i:I. ((u rest-tr (snd (PXf i))), Yf i) :f failures(fst (PXf i)) M))))))\"\napply (simp add: Rep_parallel_def)\napply (subgoal_tac \"EX Is. Is isListOf I\")\napply (elim conjE exE)\napply (subgoal_tac \"(map PXf (SOME Is. Is isListOf I)) ~= []\")\napply (simp add: in_failures_Inductive_parallel_nth)\napply (rule someI2)\n apply (simp)\n apply (rule iffI)\n\n (* => *)\n apply (elim conjE exE)\n apply (rename_tac Is' Is u Z Ys)\n apply (rule_tac x=\"u\" in exI)\n apply (simp add: isListOf_set_eq)\n apply (rule_tac x= \"(%i. (Ys!(THE n. (Is!n) = i & n failures ([||]:I PXf) M =\n {f. (EX u. (sett(u) <= insert Tick (Ev ` Union (snd ` PXf ` I)) & \n (EX Z. f = (u, Z) &\n (EX Yf. \n (Z Int insert Tick (Ev ` Union (snd ` PXf ` I))\n = Union {((Yf i) Int insert Tick (Ev ` (snd (PXf i))))|i. i : I} &\n (ALL i:I. ((u rest-tr (snd (PXf i))), Yf i) :f failures(fst (PXf i)) M))))))}f\"\napply (simp add: in_failures_Rep_parallel[THEN sym])\ndone\n\n(************************************\n | traces |\n ************************************)\n\nlemma sett_in_failures_Rep_parallel:\n \"[| I ~= {} ; finite I ; (t,X) :f failures([||]:I PXf) M |] \n ==> sett t <= insert Tick (Ev ` Union (snd ` PXf ` I))\"\nby (simp add: in_failures_Rep_parallel)\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_op_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.25917279984343794}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ExampleSystem\nimports ArchAccess_AC\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n nat_to_bl :: \"nat \\ nat \\ bool list option\"\nwhere\n \"nat_to_bl bits n \\\n if n \\ 2^bits then\n None\n else\n Some $ bin_to_bl bits (of_nat n)\"\n\nlemma nat_to_bl_id [simp]: \"nat_to_bl (size (x :: (('a::len) word))) (unat x) = Some (to_bl x)\"\n apply (clarsimp simp: nat_to_bl_def to_bl_def)\n apply (auto simp: le_def word_size)\n done\n\n\n(*---------------------------------------------------------*)\n\nsubsection \\Purpose\\\n\ntext \\\n\nThis file defines some example systems using the access control\ndefinitions. The aim is a sanity check of the AC definitions, to\nensure they enable to reason about reasonable systems.\n\nIn particular, we want to make sure that\n\n . the function state_objs_to_policy does not connect everything to\n everything (Example 1)\n . we can talk about components sharing cnodes\n . we can talk about components sharing frames\n . we can have more than 1 untrusted component\n . we can have an EP between two untrusted components\n\n\\\n\n(*---------------------------------------------------------*)\n\nsubsection \\Generic functions / lemmas\\\n\n\ntext \\Defining the authority between labels.\n\nIn addition to the intuitive authority we want, we need to add all the\nauthority required to have a wellformed graph. So we define\ncomplete_AgentAuthGraph to add these 'extra' authorities (at least all\nthe ones not depending on the current label). These are:\n\n . self-authority (each label needs all the authorities to itself).\n . if Control edge is present between 2 labels then we add all\n authorities between them.\n . Control authority is transitive: we add an Control edge\n between 2 labels if we can connect them via Control\n edges. Actually we add all authorities because of the second\n clause.\n\n\\\n\n\ndefinition\n complete_AuthGraph :: \"'a auth_graph \\ 'a set \\ 'a auth_graph\"\nwhere\n \"complete_AuthGraph g ls \\\n g \\ {(l,a,l) | a l. l \\ ls}\"\n\ntext \\converting a nat to a bool list of size 10 - for the cnodes\\\n\ndefinition\n the_nat_to_bl :: \"nat \\ nat \\ bool list\"\nwhere\n \"the_nat_to_bl sz n \\ the (nat_to_bl sz n)\"\n\ndefinition\n the_nat_to_bl_10 :: \"nat \\ bool list\"\nwhere\n \"the_nat_to_bl_10 n \\ the_nat_to_bl 10 n\"\n\nlemma tcb_cnode_index_nat_to_bl:\n \"n<10 \\ the_nat_to_bl_10 n \\ tcb_cnode_index n\"\n by (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def\n tcb_cnode_index_def\n nat_to_bl_def to_bl_def bin_to_bl_aux_def)\n\n\n(*---------------------------------------------------------*)\nsubsection \\Example 1\\\n\ntext \\\n\nThis example aims at checking that we can extract a reasonable policy\nfrom the state, i.e. that the function state_objs_to_policy does not connect\neverything to everything.\n\nThis example is a system Sys1 made of 2 main components UT1 and T1,\nconnected through and endpoint EP1. EP1 is made of one single kernel\nobject: obj1_0x9, the endpoint. Both UT1 and T1 contains:\n\n . one TCB (obj1_0xC07 and obj1_0xC08 resp.)\n . one vspace made up of one top-level page table (obj1_BF7 and obj1_0xBF9 resp.)\n . each top-level pt contains a single page table (obj1_0xC00000 and obj1_0xC05000 resp.)\n . one cspace made up of one cnode (obj1_0x6 and obj1_0x7 resp.)\n . each cspace contains 4 caps:\n one to the tcb\n one to the cnode itself\n one to the vspace\n one to the ep\n\nUT1 can send to the ep while T1 can receive from it.\n\nAttempt to ASCII art:\n\n\n -------- ---- ---- --------\n | | | | | | | |\n V | | V S R | V | V\nobj1_0xC07(tcb)-->obj1_0x6(cnode)--->obj1_0x9(ep)<---obj1_0x7(cnode)<--obj1_0xC08(tcb)\n | | | |\n V | | V\nobj1_0xBF7(pt)<----- -------> obj1_0xBF9(pt)\n | |\n V V\nobj1_0xC00000(pt) obj1_0xC05000(pt)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove\n\n pas_refined Sys1PAS s1\n\nwhere Sys1PAS is the label graph defining the AC policy for Sys1 and\ns1 is the state of Sys1 described above.\n\nThis shows that the aag extracted from s1 (by state_objs_to_policy) is\nincluded in the policy graph Sys1PAS.\n\n\\\n\n\nsubsubsection \\Defining the State\\\n\ntext \\We need to define the asids of each pt to ensure that\nthe object is included in the right ASID-label\\\n\ntext \\UT1's ASID\\\n\ndefinition\n asid1_0xBF7 :: asid\nwhere\n \"asid1_0xBF7 \\ 1<T1's ASID\\\n\ndefinition\n asid1_0xBF9 :: asid\nwhere\n \"asid1_0xBF9 \\ 2< asid_high_bits_of asid1_0xBF7\"\nby (simp add: asid1_0xBF7_def asid_high_bits_of_def asid1_0xBF9_def asid_low_bits_def)\n\n\ntext \\UT1's CSpace\\\ndefinition\n caps1_0x6 :: cnode_contents\nwhere\n \"caps1_0x6 \\\n (empty_cnode 10)\n ( (the_nat_to_bl_10 1)\n \\ ThreadCap 0xC07,\n (the_nat_to_bl_10 2)\n \\ CNodeCap 6 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap 0xBF7 (Some (asid1_0xBF7,0))),\n (the_nat_to_bl_10 318)\n \\ EndpointCap 9 0 {AllowSend} )\"\n\n\ndefinition\n obj1_0x6 :: kernel_object\nwhere\n \"obj1_0x6 \\ CNode 10 caps1_0x6\"\n\ntext \\T1's Cspace\\\n\ndefinition\n caps1_0x7 :: cnode_contents\nwhere\n \"caps1_0x7 \\\n (empty_cnode 10)\n ( (the_nat_to_bl_10 1)\n \\ ThreadCap 0xC08,\n (the_nat_to_bl_10 2)\n \\ CNodeCap 7 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap 0xBF9 (Some (asid1_0xBF9,0))),\n (the_nat_to_bl_10 318)\n \\ EndpointCap 9 0 {AllowRecv}) \"\n\ndefinition\n obj1_0x7 :: kernel_object\nwhere\n \"obj1_0x7 \\ CNode 10 caps1_0x7\"\n\n\ntext \\endpoint between UT1 and T1\\\n\ndefinition\n obj1_0x9 :: kernel_object\nwhere\n \"obj1_0x9 \\ Endpoint IdleEP\"\n\n\ntext \\UT1's VSpace\\\n\ndefinition\n pt1_0xC00000 :: pt\nwhere\n \"pt1_0xC00000 \\ (\\_. InvalidPTE)\"\n\ndefinition\n obj1_0xC00000 :: kernel_object\nwhere\n \"obj1_0xC00000 \\ ArchObj (PageTable pt1_0xC00000)\"\n\ndefinition\n pt1_0xBF7 :: pt\nwhere\n \"pt1_0xBF7 \\\n (\\_. InvalidPTE)\n (0 := PageTablePTE\n (ucast (addrFromPPtr 0xC00000 >> pageBits))\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj1_0xBF7 :: kernel_object\nwhere\n \"obj1_0xBF7 \\ ArchObj (PageTable pt1_0xBF7)\"\n\n\ntext \\T1's VSpace\\\n\n\ndefinition\n pt1_0xC05000 :: pt\nwhere\n \"pt1_0xC05000 \\\n (\\_. InvalidPTE)\"\n\n\ndefinition\n obj1_0xC05000 :: kernel_object\nwhere\n \"obj1_0xC05000 \\ ArchObj (PageTable pt1_0xC05000)\"\n\n\ndefinition\n pt1_0xBF9 :: pt\nwhere\n \"pt1_0xBF9 \\\n (\\_. InvalidPTE)\n (0 := PageTablePTE\n (ucast (addrFromPPtr 0xC05000 >> pageBits))\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj1_0xBF9 :: kernel_object\nwhere\n \"obj1_0xBF9 \\ ArchObj (PageTable pt1_0xBF9)\"\n\n\ntext \\UT1's tcb\\\n\ndefinition\n obj1_0xC07 :: kernel_object\nwhere\n \"obj1_0xC07 \\\n TCB \\\n tcb_ctable = CNodeCap 6 undefined undefined,\n tcb_vtable = ArchObjectCap (PageTableCap 0xBF7 (Some (asid1_0xBF7, 0))),\n tcb_reply = ReplyCap 0xC07 True {AllowGrant,AllowWrite}, \\ \\master reply cap to itself\\\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = Running,\n tcb_fault_handler = undefined,\n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\ \\\"\n\n\ntext \\T1's tcb\\\n\ndefinition\n obj1_0xC08 :: kernel_object\nwhere\n \"obj1_0xC08 \\\n TCB \\\n tcb_ctable = CNodeCap 7 undefined undefined,\n tcb_vtable = ArchObjectCap (PageTableCap 0xBF9 (Some (asid1_0xBF9, 0))),\n tcb_reply = ReplyCap 0xC08 True {AllowGrant,AllowWrite}, \\ \\master reply cap to itself\\\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = BlockedOnReceive 9 \\ receiver_can_grant = False \\,\n tcb_fault_handler = undefined,\n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\ndefinition\n \"obj1_10 \\ CNode 10 (Map.empty([] \\ cap.NullCap))\"\n\n\n(* the boolean in BlockedOnReceive is True if the object can receive but not send.\nbut Tom says it only matters if the sender can grant - which is not the case of the UT1 - I think *)\n\ndefinition\n kh1 :: kheap\nwhere\n \"kh1 \\ [0x6 \\ obj1_0x6,\n 0x7 \\ obj1_0x7,\n 0x9 \\ obj1_0x9,\n 0xA \\ obj1_10,\n 0xBF7 \\ obj1_0xBF7,\n 0xBF9 \\ obj1_0xBF9,\n 0xC07 \\ obj1_0xC07,\n 0xC08 \\ obj1_0xC08,\n 0xC00000 \\ obj1_0xC00000,\n 0xC05000 \\ obj1_0xC05000]\"\n\nlemmas kh1_obj_def =\n obj1_0x6_def obj1_0x7_def obj1_0x9_def obj1_10_def obj1_0xBF7_def obj1_0xBF9_def\n obj1_0xC00000_def obj1_0xC05000_def obj1_0xC07_def obj1_0xC08_def\n\ndefinition exst1 :: \"det_ext\" where\n \"exst1 \\ \\work_units_completed_internal = undefined,\n scheduler_action_internal = undefined,\n ekheap_internal = \\x. None,\n domain_list_internal = undefined,\n domain_index_internal = undefined,\n cur_domain_internal = undefined,\n domain_time_internal = undefined,\n ready_queues_internal = undefined,\n cdt_list_internal = undefined\\\"\n\ndefinition\n s1 :: \"det_ext state\"\nwhere\n \"s1 \\ \\\n kheap = kh1,\n cdt = Map.empty,\n is_original_cap = undefined,\n cur_thread = undefined,\n idle_thread = undefined,\n machine_state = undefined,\n interrupt_irq_node = (\\_. 10),\n interrupt_states = undefined,\n arch_state = \\\n riscv_asid_table = (\\_. None),\n riscv_global_pts = undefined,\n riscv_kernel_vspace = undefined\n \\,\n exst = exst1\n \\\"\n\n\nsubsubsection \\Defining the policy graph\\\n\n\ndatatype Sys1Labels =\n UT1 | T1 | EP1 | IRQ1\n\ndefinition\n Sys1AgentMap :: \"Sys1Labels agent_map\"\nwhere\n \"Sys1AgentMap \\\n (\\_. undefined)\n (0x6 := UT1,\n 0x7 := T1,\n 0x9 := EP1,\n 0xA := IRQ1,\n 0xBF7 := UT1,\n 0xBF9 := T1,\n 0xC00000 := UT1,\n 0xC05000 := T1,\n 0xC07 := UT1,\n 0xC08 := T1 )\"\n\nlemma Sys1AgentMap_simps:\n \"Sys1AgentMap 0x6 = UT1\"\n \"Sys1AgentMap 0x7 = T1\"\n \"Sys1AgentMap 0x9 = EP1\"\n \"Sys1AgentMap 0xA = IRQ1\"\n \"Sys1AgentMap 0xBF7 = UT1\"\n \"Sys1AgentMap 0xBF9 = T1\"\n \"Sys1AgentMap 0xC00000 = UT1\"\n \"Sys1AgentMap 0xC05000 = T1\"\n \"Sys1AgentMap 0xC07 = UT1\"\n \"Sys1AgentMap 0xC08 = T1\"\n unfolding Sys1AgentMap_def by simp_all\n\ndefinition\n Sys1AuthGraph_aux :: \"Sys1Labels auth_graph\"\nwhere\n \"Sys1AuthGraph_aux \\\n { (UT1, auth.SyncSend, EP1),\n (UT1, auth.Reset, EP1),\n (T1, auth.Receive, EP1),\n (T1, auth.Reset, EP1) }\"\n\ndefinition\n Sys1AuthGraph:: \"Sys1Labels auth_graph\"\nwhere\n \"Sys1AuthGraph \\ complete_AuthGraph Sys1AuthGraph_aux {T1, UT1}\"\n\n\ndefinition\n Sys1ASIDMap :: \"Sys1Labels agent_asid_map\"\nwhere\n \"Sys1ASIDMap \\\n (\\x. if (asid_high_bits_of x = asid_high_bits_of asid1_0xBF7)\n then UT1\n else if (asid_high_bits_of x = asid_high_bits_of asid1_0xBF9)\n then T1 else undefined)\"\n\ndefinition Sys1PAS :: \"Sys1Labels PAS\" where\n \"Sys1PAS \\ \\ pasObjectAbs = Sys1AgentMap, pasASIDAbs = Sys1ASIDMap, pasIRQAbs = (\\_. IRQ1),\n pasPolicy = Sys1AuthGraph, pasSubject = UT1, pasMayActivate = True,\n pasMayEditReadyQueues = True, pasMaySendIrqs = True, pasDomainAbs = undefined \\\"\n\nsubsubsection \\Proof of pas_refined for Sys1\\\n\nlemma caps1_0x7_well_formed: \"well_formed_cnode_n 10 caps1_0x7\"\n apply (clarsimp simp: caps1_0x7_def well_formed_cnode_n_def)\n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1]\n apply clarsimp\n done\n\nlemma caps1_0x6_well_formed: \"well_formed_cnode_n 10 caps1_0x6\"\n apply (clarsimp simp: caps1_0x6_def well_formed_cnode_n_def)\n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1]\n apply clarsimp\n done\n\n(* clagged from KernelInit_R *)\nlemma empty_cnode_apply[simp]:\n \"(empty_cnode n xs = Some cap) = (length xs = n \\ cap = NullCap)\"\n by (auto simp add: empty_cnode_def)\n\n\nlemma s1_caps_of_state :\n \"caps_of_state s1 p = Some cap \\\n cap = NullCap \\\n (p,cap) \\\n { ((6::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 0xC07),\n ((6::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 6 undefined undefined),\n ((6::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap 0xBF7 (Some (asid1_0xBF7, 0)))),\n ((6::obj_ref,(the_nat_to_bl_10 318)),EndpointCap 9 0 {AllowSend}),\n ((7::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 0xC08),\n ((7::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 7 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap 0xBF9 (Some (asid1_0xBF9, 0)))),\n ((7::obj_ref,(the_nat_to_bl_10 318)),EndpointCap 9 0 {AllowRecv}) ,\n ((0xC07::obj_ref, (tcb_cnode_index 0)), CNodeCap 6 undefined undefined ),\n ((0xC07::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageTableCap 0xBF7 (Some (asid1_0xBF7, 0)))),\n ((0xC07::obj_ref, (tcb_cnode_index 2)), ReplyCap 0xC07 True {AllowGrant,AllowWrite}),\n ((0xC07::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((0xC07::obj_ref, (tcb_cnode_index 4)), NullCap),\n ((0xC08::obj_ref, (tcb_cnode_index 0)), CNodeCap 7 undefined undefined ),\n ((0xC08::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageTableCap 0xBF9 (Some (asid1_0xBF9, 0)))),\n ((0xC08::obj_ref, (tcb_cnode_index 2)), ReplyCap 0xC08 True {AllowGrant,AllowWrite}),\n ((0xC08::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((0xC08::obj_ref, (tcb_cnode_index 4)), NullCap)} \"\n apply (insert caps1_0x7_well_formed)\n apply (insert caps1_0x6_well_formed)\n apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s1_def kh1_def kh1_obj_def)\n apply (case_tac p, clarsimp)\n apply (clarsimp split: if_splits)\n apply (clarsimp simp: cte_wp_at_cases tcb_cap_cases_def\n split: if_split_asm)+\n apply (clarsimp simp: caps1_0x7_def split: if_splits)\n apply (clarsimp simp: caps1_0x6_def cte_wp_at_cases split: if_splits)\n done\n\n\nlemma Sys1_wellformed: \"pas_wellformed Sys1PAS\"\n apply (clarsimp simp: Sys1PAS_def\n policy_wellformed_def\n Sys1AuthGraph_def\n Sys1AuthGraph_aux_def\n complete_AuthGraph_def)\n apply blast\n done\n\nlemma tcb_states_of_state_1:\n \"tcb_states_of_state s1 = [0xC08 \\ thread_state.BlockedOnReceive 9 \\ receiver_can_grant = False \\, 0xC07 \\ thread_state.Running ]\"\n unfolding s1_def tcb_states_of_state_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh1_def kh1_obj_def )\n done\n\nlemma thread_bound_ntfns_1:\n \"thread_bound_ntfns s1 = Map.empty\"\n unfolding s1_def thread_bound_ntfns_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh1_def kh1_obj_def )\n done\n\ndeclare AllowSend_def[simp] AllowRecv_def[simp]\n\nlemma domains_of_state_s1[simp]:\n \"domains_of_state s1 = {}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply clarsimp\n apply (erule domains_of_state_aux.induct)\n apply (simp add: s1_def exst1_def)\n apply simp\n done\n\nlemma vs_refs_aux_empty_pt[simp]:\n \"vs_refs_aux lvl (PageTable empty_pt) = {}\"\n by (clarsimp simp: vs_refs_aux_def graph_of_def pte_ref2_def)\n\nlemma is_aligned_0xC00000[simp]:\n \"ptrFromPAddr (addr_from_ppn (UCAST(64 \\ 52) (addrFromPPtr 0xC00000 >> pageBits))) = 0xC00000\"\n by (subst ptrFromPAddr_addr_from_ppn; fastforce simp: bit_simps is_aligned_mask mask_def)\n\nlemma is_aligned_0xC05000[simp]:\n \"ptrFromPAddr (addr_from_ppn (UCAST(64 \\ 52) (addrFromPPtr 0xC05000 >> pageBits))) = 0xC05000\"\n by (subst ptrFromPAddr_addr_from_ppn; fastforce simp: bit_simps is_aligned_mask mask_def)\n\nlemma \"pas_refined Sys1PAS s1\"\n apply (clarsimp simp: pas_refined_def)\n apply (intro conjI)\n subgoal by (simp add: Sys1_wellformed)\n subgoal by (simp add: irq_map_wellformed_aux_def s1_def Sys1AgentMap_simps Sys1PAS_def)\n subgoal by (simp add: tcb_domain_map_wellformed_aux_def)\n apply (clarsimp simp: auth_graph_map_def Sys1PAS_def state_objs_to_policy_def)+\n apply (erule state_bits_to_policy.cases, simp_all, clarsimp)\n apply (drule s1_caps_of_state, clarsimp)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def)\n apply (elim disjE conjE; solves\\clarsimp simp: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def\\)\n apply (drule s1_caps_of_state, clarsimp)\n apply (elim disjE; solves \\simp add: thread_bound_ntfns_def\\)\n apply (clarsimp simp: state_refs_of_def thread_st_auth_def tcb_states_of_state_1\n Sys1AuthGraph_def Sys1AgentMap_simps\n complete_AuthGraph_def\n Sys1AuthGraph_aux_def\n split: if_splits)\n apply (simp add: thread_bound_ntfns_1)\n apply (simp add: s1_def) (* this is OK because cdt is empty..*)\n apply (simp add: s1_def) (* this is OK because cdt is empty..*)\n apply (fastforce simp: state_vrefs_def vs_refs_aux_def s1_def kh1_def kh1_obj_def\n pt1_0xC00000_def pt1_0xC05000_def pt1_0xBF9_def pt1_0xBF7_def\n Sys1AuthGraph_def Sys1AuthGraph_aux_def Sys1AgentMap_simps\n complete_AuthGraph_def ptr_range_def pte_ref2_def opt_map_def\n dest!: graph_ofD split: if_splits)\n apply (rule subsetI, clarsimp)\n apply (erule state_asids_to_policy_aux.cases)\n apply (drule s1_caps_of_state, clarsimp)\n apply (fastforce simp: Sys1AgentMap_simps Sys1PAS_def Sys1ASIDMap_def Sys1AuthGraph_def\n Sys1AuthGraph_aux_def complete_AuthGraph_def cap_auth_conferred_def\n asid1_0xBF9_def asid1_0xBF7_def asid_low_bits_def asid_high_bits_of_def)\n apply (fastforce simp: state_vrefs_def vs_refs_aux_def s1_def kh1_def kh1_obj_def\n pt1_0xC00000_def pt1_0xC05000_def pt1_0xBF9_def pt1_0xBF7_def\n Sys1AuthGraph_def Sys1AuthGraph_aux_def Sys1AgentMap_simps\n complete_AuthGraph_def ptr_range_def pte_ref2_def opt_map_def\n dest!: graph_ofD split: if_splits)\n apply (clarsimp simp: s1_def)\n apply (rule subsetI, clarsimp)\n apply (erule state_irqs_to_policy_aux.cases)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def Sys1PAS_def Sys1ASIDMap_def)\n apply (drule s1_caps_of_state)\n apply (fastforce simp: Sys1AgentMap_simps Sys1PAS_def Sys1ASIDMap_def Sys1AuthGraph_def\n Sys1AuthGraph_aux_def complete_AuthGraph_def cap_auth_conferred_def\n asid1_0xBF9_def asid1_0xBF7_def asid_low_bits_def asid_high_bits_of_def)\n done\n\n\n(*---------------------------------------------------------*)\nsubsection \\Example 2\\\n\ntext \\\n\nThis example systems Sys2 aims at checking that we can have 2\ncomponents, one untrusted UT2 and one truted T1, sharing a cnode obj2_5.\n\nBoth UT2 and T2 contains:\n\n . one TCB (obj2_0xC07 and obj2_0xC08 resp.)\n . one vspace made up of one top-level page table (obj2_0xBF7 and obj2_0xBF9 resp.)\n . each top-level pt contains a single page table (obj2_0xC00000 and obj2_0xC05000 resp.)\n . one cspace made up of one cnode (obj2_0x6 and obj2_0x7 resp.)\n . each cspace contains 4 caps:\n one to the tcb\n one to the cnode itself\n one to the vspace\n one to obj2_5\n\n\nAttempt to ASCII art:\n\n\n -------- ---- ---- --------\n | | | | | | | |\n V | | V S R | V | V\nobj2_0xC07(tcb)-->obj2_0x6(cnode)--->obj2_5(cnode)<---obj2_0x7(cnode)<--obj2_0xC08(tcb)\n | | | |\n V | | V\nobj2_0xBF7(pt)<----- -------> obj2_0xBF9(pt)\n | |\n V V\nobj2_0xC00000(pt) obj2_0xC05000(pt)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove\n\n pas_refined Sys2PAS s2\n\nwhere Sys2PAS is the label graph defining the AC policy for Sys2 and\ns2 is the state of Sys2 described above.\n\nThis shows that the aag extracted from s2 (by state_objs_to_policy) is\nincluded in the policy graph Sys2PAS.\n\n\\\n\n\nsubsubsection \\Defining the State\\\n\n\n\ntext \\We need to define the asids of each pt to ensure that\nthe object is included in the right ASID-label\\\n\ntext \\UT2's ASID\\\n\ndefinition\n asid2_0xBF7 :: asid\nwhere\n \"asid2_0xBF7 \\ 1<T2's ASID\\\n\ndefinition\n asid2_0xBF9 :: asid\nwhere\n \"asid2_0xBF9 \\ 2< asid_high_bits_of asid2_0xBF7\"\nby (simp add: asid2_0xBF7_def asid_high_bits_of_def asid2_0xBF9_def asid_low_bits_def)\n\n\n\ntext \\the intermediaite CSpace\\\n\ndefinition\n caps2_5 :: cnode_contents\nwhere\n \"caps2_5 \\\n (empty_cnode 10)\"\n\ndefinition\n obj2_5 :: kernel_object\nwhere\n \"obj2_5 \\ CNode 10 caps2_5\"\n\n\n\ntext \\UT2's CSpace\\\n\ndefinition\n caps2_0x6 :: cnode_contents\nwhere\n \"caps2_0x6 \\\n (empty_cnode 10)\n ( (the_nat_to_bl_10 1)\n \\ ThreadCap 0xC07,\n (the_nat_to_bl_10 2)\n \\ CNodeCap 6 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap 0xBF7\n (Some (asid2_0xBF7, 0))),\n (the_nat_to_bl_10 4)\n \\ CNodeCap 5 undefined undefined )\"\n\n\ndefinition\n obj2_0x6 :: kernel_object\nwhere\n \"obj2_0x6 \\ CNode 10 caps2_0x6\"\n\ntext \\T2's Cspace\\\n\ndefinition\n caps2_0x7 :: cnode_contents\nwhere\n \"caps2_0x7 \\\n (empty_cnode 10)\n ( (the_nat_to_bl_10 1)\n \\ ThreadCap 0xC08,\n (the_nat_to_bl_10 2)\n \\ CNodeCap 7 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageTableCap 0xBF9\n (Some (asid2_0xBF9, 0))),\n (the_nat_to_bl_10 4)\n \\ CNodeCap 5 undefined undefined) \"\n\ndefinition\n obj2_0x7 :: kernel_object\nwhere\n \"obj2_0x7 \\ CNode 10 caps2_0x7\"\n\n\ntext \\endpoint between UT2 and T2\\\n\ndefinition\n obj2_0x9 :: kernel_object\nwhere\n \"obj2_0x9 \\ Endpoint IdleEP\"\n\n\ntext \\UT2's VSpace\\\n\ndefinition\n pt2_0xC00000 :: pt\nwhere\n \"pt2_0xC00000 \\ (\\_. InvalidPTE)\"\n\ndefinition\n obj2_0xC00000 :: kernel_object\nwhere\n \"obj2_0xC00000 \\ ArchObj (PageTable pt2_0xC00000)\"\n\n\ndefinition\n pt2_0xBF7 :: pt\nwhere\n \"pt2_0xBF7 \\\n (\\_. InvalidPTE)\n (0 := PageTablePTE\n (ucast (addrFromPPtr 0xC00000 >> pageBits))\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj2_0xBF7 :: kernel_object\nwhere\n \"obj2_0xBF7 \\ ArchObj (PageTable pt2_0xBF7)\"\n\n\ntext \\T1's VSpace\\\n\n\ndefinition\n pt2_0xC05000 :: pt\nwhere\n \"pt2_0xC05000 \\\n (\\_. InvalidPTE)\"\n\ndefinition\n obj2_0xC05000 :: kernel_object\nwhere\n \"obj2_0xC05000 \\ ArchObj (PageTable pt2_0xC05000)\"\n\n\ndefinition\n pt2_0xBF9 :: pt\nwhere\n \"pt2_0xBF9 \\\n (\\_. InvalidPTE)\n (0 := PageTablePTE\n (ucast (addrFromPPtr 0xC05000 >> pageBits))\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj2_0xBF9 :: kernel_object\nwhere\n \"obj2_0xBF9 \\ ArchObj (PageTable pt2_0xBF9)\"\n\n\ntext \\UT1's tcb\\\n\ndefinition\n obj2_0xC07 :: kernel_object\nwhere\n \"obj2_0xC07 \\\n TCB \\\n tcb_ctable = CNodeCap 6 undefined undefined ,\n tcb_vtable = ArchObjectCap (PageTableCap 0xBF7 (Some (asid2_0xBF7, 0))),\n tcb_reply = ReplyCap 0xC07 True {AllowGrant,AllowWrite}, \\ \\master reply cap to itself\\\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = Running,\n tcb_fault_handler = undefined,\n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\n\ntext \\T1's tcb\\\n\ndefinition\n obj2_0xC08 :: kernel_object\nwhere\n \"obj2_0xC08 \\\n TCB \\\n tcb_ctable = CNodeCap 7 undefined undefined ,\n tcb_vtable = ArchObjectCap (PageTableCap 0xBF9 (Some (asid2_0xBF9,0))),\n tcb_reply = ReplyCap 0xC08 True {AllowGrant,AllowWrite}, \\ \\master reply cap to itself\\\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = BlockedOnReceive 9 \\ receiver_can_grant = False \\,\n tcb_fault_handler = undefined,\n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\n(* the boolean in BlockedOnReceive is True if the object can receive but not send.\nbut Tom says it only matters if the sender can grant - which is not the case of the UT1 - I think *)\n\ndefinition\n kh2 :: kheap\nwhere\n \"kh2 \\ [0x6 \\ obj2_0x6,\n 0x7 \\ obj2_0x7,\n 0x9 \\ obj2_0x9,\n 0xBF7 \\ obj2_0xBF7,\n 0xBF9 \\ obj2_0xBF9,\n 0xC00000 \\ obj2_0xC00000,\n 0xC05000 \\ obj2_0xC05000,\n 0xC07 \\ obj2_0xC07,\n 0xC08 \\ obj2_0xC08 ]\"\n\nlemmas kh2_obj_def =\n obj2_0x6_def obj2_0x7_def obj2_0x9_def obj2_0xBF7_def obj2_0xBF9_def\n obj2_0xC00000_def obj2_0xC05000_def obj2_0xC07_def obj2_0xC08_def\n\n\ndefinition\n s2 :: \"det_ext state\"\nwhere\n \"s2 \\ \\\n kheap = kh2,\n cdt = Map.empty,\n is_original_cap = undefined,\n cur_thread = undefined,\n idle_thread = undefined,\n machine_state = undefined,\n interrupt_irq_node = (\\_. 9001),\n interrupt_states = undefined,\n arch_state = \\\n riscv_asid_table = (\\_. None),\n riscv_global_pts = undefined,\n riscv_kernel_vspace = undefined\n \\,\n exst = exst1\n \\\"\n\n\nsubsubsection \\Defining the policy graph\\\n\n\ndatatype Sys2Labels =\n UT2 | T2 | IRQ2\n\ndefinition\n Sys2AgentMap :: \"Sys2Labels agent_map\"\nwhere\n \"Sys2AgentMap \\\n (\\_. undefined)\n (0x5 := UT2,\n 0x6 := UT2,\n 0x7 := T2,\n 0x9 := T2,\n 0xBF7 := UT2,\n 0xBF9 := T2,\n 0xC00000 := UT2,\n 0xC05000 := T2,\n 0xC07 := UT2,\n 0xC08 := T2,\n 9001 := IRQ2 )\"\n\n\ndefinition\n Sys2AuthGraph_aux :: \"Sys2Labels auth_graph\"\nwhere\n \"Sys2AuthGraph_aux \\\n { (T2, Control, UT2) }\"\n\ndefinition\n Sys2AuthGraph:: \"Sys2Labels auth_graph\"\nwhere\n \"Sys2AuthGraph \\ complete_AuthGraph Sys2AuthGraph_aux {T2, UT2}\"\n\n\ndefinition\n Sys2ASIDMap :: \"Sys2Labels agent_asid_map\"\nwhere\n \"Sys2ASIDMap \\\n (\\_. undefined)\n (asid2_0xBF7 := UT2,\n asid2_0xBF9 := T2 )\"\n\ndefinition Sys2PAS :: \"Sys2Labels PAS\" where\n \"Sys2PAS \\ \\ pasObjectAbs = Sys2AgentMap, pasASIDAbs = Sys2ASIDMap,\n pasIRQAbs = (\\_. IRQ2),\n pasPolicy = Sys2AuthGraph, pasSubject = UT2, pasMayActivate = True, pasMayEditReadyQueues = True, pasMaySendIrqs = True, pasDomainAbs = undefined \\\"\n\n\n\nsubsubsection \\Proof of pas_refined for Sys2\\\n\nlemma caps2_0x7_well_formed: \"well_formed_cnode_n 10 caps2_0x7\"\n apply (clarsimp simp: caps2_0x7_def well_formed_cnode_n_def)\n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1]\n apply clarsimp\n done\n\nlemma caps2_0x6_well_formed: \"well_formed_cnode_n 10 caps2_0x6\"\n apply (clarsimp simp: caps2_0x6_def well_formed_cnode_n_def)\n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1]\n apply clarsimp\n done\n\nlemma s2_caps_of_state :\n \"caps_of_state s2 p = Some cap \\\n cap = NullCap \\\n (p,cap) \\\n { ((6::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 0xC07),\n ((6::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 6 undefined undefined),\n ((6::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap 0xBF7 (Some (asid2_0xBF7, 0)))),\n ((6::obj_ref,(the_nat_to_bl_10 4)), CNodeCap 5 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 0xC08),\n ((7::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 7 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageTableCap 0xBF9 (Some (asid2_0xBF9, 0)))),\n ((7::obj_ref,(the_nat_to_bl_10 4)), CNodeCap 5 undefined undefined),\n ((0xC07::obj_ref, (tcb_cnode_index 0)), CNodeCap 6 undefined undefined ),\n ((0xC07::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageTableCap 0xBF7 (Some (asid2_0xBF7, 0)))),\n ((0xC07::obj_ref, (tcb_cnode_index 2)), ReplyCap 0xC07 True {AllowGrant,AllowWrite}),\n ((0xC07::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((0xC07::obj_ref, (tcb_cnode_index 4)), NullCap),\n ((0xC08::obj_ref, (tcb_cnode_index 0)), CNodeCap 7 undefined undefined ),\n ((0xC08::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageTableCap 0xBF9 (Some (asid2_0xBF9, 0)))),\n ((0xC08::obj_ref, (tcb_cnode_index 2)), ReplyCap 0xC08 True {AllowGrant,AllowWrite}),\n ((0xC08::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((0xC08::obj_ref, (tcb_cnode_index 4)), NullCap)} \"\n apply (insert caps2_0x7_well_formed)\n apply (insert caps2_0x6_well_formed)\n apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s2_def kh2_def kh2_obj_def)\n apply (case_tac p, clarsimp)\n apply (clarsimp simp: cte_wp_at_cases split: if_splits)\n apply (clarsimp simp: tcb_cap_cases_def split: if_splits)+\n apply (clarsimp simp: caps2_0x7_def split: if_splits)\n apply (clarsimp simp: caps2_0x6_def cte_wp_at_cases split: if_splits)\n done\n\nlemma Sys2_wellformed: \"pas_wellformed Sys2PAS\"\n apply (clarsimp simp: Sys2PAS_def policy_wellformed_def)\n apply (intro conjI)\n apply (simp_all add: Sys2AuthGraph_def complete_AuthGraph_def\n Sys2AuthGraph_aux_def)\n done\n\nlemma Sys2AgentMap_simps:\n \"Sys2AgentMap 5 = UT2\"\n \"Sys2AgentMap 6 = UT2\"\n \"Sys2AgentMap 7 = T2\"\n \"Sys2AgentMap 9 = T2\"\n \"Sys2AgentMap 0xBF7 = UT2\"\n \"Sys2AgentMap 0xBF9 = T2\"\n \"Sys2AgentMap 0xC00000 = UT2\"\n \"Sys2AgentMap 0xC05000 = T2\"\n \"Sys2AgentMap 0xC07 = UT2\"\n \"Sys2AgentMap 0xC08 = T2\"\n \"Sys2AgentMap 9001 = IRQ2\"\n by (simp_all add: Sys2AgentMap_def)\n\nlemma domains_of_state_s2[simp]:\n \"domains_of_state s2 = {}\"\n apply (rule equalityI)\n apply (rule subsetI)\n apply clarsimp\n apply (erule domains_of_state_aux.induct)\n apply (simp add: s2_def exst1_def)\n apply simp\n done\n\nlemma thread_bound_ntfns_2[simp]:\n \"thread_bound_ntfns s2 = Map.empty\"\n unfolding s2_def thread_bound_ntfns_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh2_def kh2_obj_def)\n done\n\nlemma \"pas_refined Sys2PAS s2\"\n apply (clarsimp simp: pas_refined_def)\n apply (intro conjI)\n apply (simp add: Sys2_wellformed)\n apply (simp add: Sys2PAS_def s2_def Sys2AgentMap_def\n irq_map_wellformed_aux_def)\n apply (clarsimp simp: auth_graph_map_def\n Sys2PAS_def\n state_objs_to_policy_def\n state_bits_to_policy_def tcb_domain_map_wellformed_aux_def)+\n apply (erule state_bits_to_policyp.cases, simp_all)\n apply (drule s2_caps_of_state, clarsimp)\n apply (elim disjE, simp_all add: cap_auth_conferred_def\n Sys2AgentMap_simps\n Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def\n split: if_split_asm)[1]\n apply (drule s2_caps_of_state, clarsimp)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: state_refs_of_def s2_def kh2_def kh2_obj_def\n split: if_splits)\n apply (clarsimp split:if_splits option.splits\n simp: thread_st_auth_def tcb_states_of_state_def\n Sys2AgentMap_simps Sys2AuthGraph_def\n complete_AuthGraph_def Sys2AuthGraph_aux_def\n dest!: get_tcb_SomeD)\n apply (simp add: s2_def) (* this is OK because cdt is empty..*)\n apply (simp add: s2_def) (* this is OK because cdt is empty..*)\n apply (fastforce simp: state_vrefs_def vs_refs_aux_def s2_def kh2_def kh2_obj_def pt2_0xBF9_def\n pt2_0xBF7_def pt2_0xC05000_def pt2_0xC00000_def Sys2AgentMap_simps\n Sys2AuthGraph_def Sys2AuthGraph_aux_def complete_AuthGraph_def\n pte_ref2_def graph_of_def opt_map_def ptr_range_def\n split: if_splits)\n apply clarsimp\n apply (erule state_asids_to_policy_aux.cases)\n apply clarsimp\n apply (fastforce simp: Sys2PAS_def Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def Sys2AgentMap_simps asid_low_bits_def\n Sys2ASIDMap_def asid2_0xBF7_def asid2_0xBF9_def\n dest!: s2_caps_of_state)\n apply (clarsimp simp: state_vrefs_def vs_refs_aux_def s2_def kh2_def kh2_obj_def\n split: if_splits)\n apply (clarsimp simp: s2_def)\n apply (clarsimp)\n apply (erule state_irqs_to_policy_aux.cases)\n apply (fastforce simp: Sys2PAS_def Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def Sys2AgentMap_simps\n Sys2ASIDMap_def asid2_0xBF7_def asid2_0xBF9_def\n dest!: s2_caps_of_state)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/access-control/RISCV64/ExampleSystem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.25905993029561447}} {"text": "theory CoCallFix\nimports CoCallAnalysisSig CoCallAnalysisBinds ArityAnalysisSig \"Launchbury.Env-Nominal\" ArityAnalysisFix\nbegin\n\n\nlocale CoCallArityAnalysis =\n fixes cccExp :: \"exp \\ (Arity \\ AEnv \\ CoCalls)\"\nbegin\n\ndefinition Aexp :: \"exp \\ (Arity \\ AEnv)\"\n where \"Aexp e = (\\ a. fst (cccExp e \\ a))\"\n\nsublocale ArityAnalysis Aexp.\n\nabbreviation Aexp_syn' (\"\\\\<^bsub>_\\<^esub>\") where \"\\\\<^bsub>a\\<^esub> \\ (\\e. Aexp e\\a)\"\nabbreviation Aexp_bot_syn' (\"\\\\<^sup>\\\\<^bsub>_\\<^esub>\") where \"\\\\<^sup>\\\\<^bsub>a\\<^esub> \\ (\\e. fup\\(Aexp e)\\a)\"\n\nlemma Aexp_eq:\n \"\\\\<^bsub>a\\<^esub> e = fst (cccExp e \\ a)\"\n unfolding Aexp_def by (rule beta_cfun) (intro cont2cont)\n\nlemma fup_Aexp_eq:\n \"fup\\(Aexp e)\\a = fst (fup\\(cccExp e)\\a)\"\n by (cases a)(simp_all add: Aexp_eq)\n\n\ndefinition CCexp :: \"exp \\ (Arity \\ CoCalls)\" where \"CCexp \\ = (\\ a. snd (cccExp \\\\a))\"\nlemma CCexp_eq:\n \"CCexp e\\a = snd (cccExp e \\ a)\"\n unfolding CCexp_def by (rule beta_cfun) (intro cont2cont)\n\nlemma fup_CCexp_eq:\n \"fup\\(CCexp e)\\a = snd (fup\\(cccExp e)\\a)\"\n by (cases a)(simp_all add: CCexp_eq)\n\nsublocale CoCallAnalysis CCexp.\n\ndefinition CCfix :: \"heap \\ (AEnv \\ CoCalls) \\ CoCalls\"\n where \"CCfix \\ = (\\ aeG. (\\ G'. ccBindsExtra \\\\(fst aeG , G') \\ snd aeG))\"\n\nlemma CCfix_eq:\n \"CCfix \\\\(ae,G) = (\\ G'. ccBindsExtra \\\\(ae, G') \\ G)\"\n unfolding CCfix_def\n by simp\n\nlemma CCfix_unroll: \"CCfix \\\\(ae,G) = ccBindsExtra \\\\(ae, CCfix \\\\(ae,G)) \\ G\"\n unfolding CCfix_eq\n apply (subst fix_eq)\n apply simp\n done\n\nlemma fup_ccExp_restr_subst': \n assumes \"\\ a. cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n shows \"cc_restr S (fup\\(CCexp e[x::=y])\\a) = cc_restr S (fup\\(CCexp e)\\a)\"\n using assms\n by (cases a) (auto simp del: cc_restr_cc_restr simp add: cc_restr_cc_restr[symmetric])\n\nlemma ccBindsExtra_restr_subst': \n assumes \"\\ x' e a. (x',e) \\ set \\ \\ cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n assumes \"x \\ S\"\n assumes \"y \\ S\"\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (ccBindsExtra \\[x::h=y]\\(ae, G)) \n = cc_restr S (ccBindsExtra \\\\(ae f|` S , cc_restr S G))\"\n apply (simp add: ccBindsExtra_simp ccBinds_eq ccBind_eq Int_absorb2[OF assms(4)] fv_subst_int[OF assms(3,2)])\n apply (intro arg_cong2[where f = \"(\\)\"] refl arg_cong[OF mapCollect_cong])\n apply (subgoal_tac \"k \\ S\")\n apply (auto intro: fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]] simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] ccSquare_def)[1]\n apply (metis assms(4) contra_subsetD domI dom_map_of_conv_domA)\n apply (subgoal_tac \"k \\ S\")\n apply (auto intro: fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]]\n simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] ccSquare_def cc_restr_twist[where S = S] simp del: cc_restr_cc_restr)[1]\n apply (subst fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]], assumption)\n apply (simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] )\n apply (subst fup_ccExp_restr_subst'[OF assms(1)[OF map_of_SomeD]], assumption)\n apply (simp add: fv_subst_int[OF assms(3,2)] fv_subst_int2[OF assms(3,2)] )\n apply (metis assms(4) contra_subsetD domI dom_map_of_conv_domA)\n done\n\nlemma ccBindsExtra_restr:\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (ccBindsExtra \\\\(ae, G)) = cc_restr S (ccBindsExtra \\\\(ae f|` S, cc_restr S G))\"\n using assms\n apply (simp add: ccBindsExtra_simp ccBinds_eq ccBind_eq Int_absorb2)\n apply (intro arg_cong2[where f = \"(\\)\"] refl arg_cong[OF mapCollect_cong])\n apply (subgoal_tac \"k \\ S\")\n apply simp\n apply (metis contra_subsetD domI dom_map_of_conv_domA)\n apply (subgoal_tac \"k \\ S\")\n apply simp\n apply (metis contra_subsetD domI dom_map_of_conv_domA)\n done\n\nlemma CCfix_restr:\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (CCfix \\\\(ae, G)) = cc_restr S (CCfix \\\\(ae f|` S, cc_restr S G))\"\n unfolding CCfix_def\n apply simp\n apply (rule parallel_fix_ind[where P = \"\\ x y . cc_restr S x = cc_restr S y\"])\n apply simp\n apply rule\n apply simp\n apply (subst (1 2) ccBindsExtra_restr[OF assms])\n apply (auto)\n done\n\nlemma ccField_CCfix:\n shows \"ccField (CCfix \\\\(ae, G)) \\ fv \\ \\ ccField G\"\n unfolding CCfix_def\n apply simp\n apply (rule fix_ind[where P = \"\\ x . ccField x \\ fv \\ \\ ccField G\"])\n apply (auto dest!: subsetD[OF ccField_ccBindsExtra])\n done\n\n\nlemma CCfix_restr_subst':\n assumes \"\\ x' e a. (x',e) \\ set \\ \\ cc_restr S (CCexp e[x::=y]\\a) = cc_restr S (CCexp e\\a)\"\n assumes \"x \\ S\"\n assumes \"y \\ S\"\n assumes \"domA \\ \\ S\"\n shows \"cc_restr S (CCfix \\[x::h=y]\\(ae, G)) = cc_restr S (CCfix \\\\(ae f|` S, cc_restr S G))\"\n unfolding CCfix_def\n apply simp\n apply (rule parallel_fix_ind[where P = \"\\ x y . cc_restr S x = cc_restr S y\"])\n apply simp\n apply rule\n apply simp\n apply (subst ccBindsExtra_restr_subst'[OF assms], assumption)\n apply (subst ccBindsExtra_restr[OF assms(4)]) back \n apply (auto)\n done\n\n\nend\n\nlemma Aexp_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.Aexp cccExp e) = CoCallArityAnalysis.Aexp (\\ \\ cccExp) (\\ \\ e)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.Aexp_eq by perm_simp rule\n\nlemma CCexp_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCexp cccExp e) = CoCallArityAnalysis.CCexp (\\ \\ cccExp) (\\ \\ e)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.CCexp_eq by perm_simp rule\n\nlemma CCfix_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCfix cccExp \\) = CoCallArityAnalysis.CCfix (\\ \\ cccExp) (\\ \\ \\)\"\n unfolding CoCallArityAnalysis.CCfix_def by perm_simp (simp_all add: Abs_cfun_eqvt)\n\nlemma ccFix_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.CCfix cccexp1 heap1 = CoCallArityAnalysis.CCfix cccexp2 heap2\"\n unfolding CoCallArityAnalysis.CCfix_def\n apply (rule arg_cong) back\n apply (rule ccBindsExtra_cong)\n apply (auto simp add: CoCallArityAnalysis.CCexp_def)\n done\n\n\ncontext CoCallArityAnalysis\nbegin\ndefinition cccFix :: \"heap \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix \\ = (\\ i. (Afix \\\\(fst i \\ (\\_.up\\0) f|` thunks \\), CCfix \\\\(Afix \\\\(fst i \\ (\\_.up\\0) f|` (thunks \\)), snd i)))\"\n\nlemma cccFix_eq:\n \"cccFix \\\\i = (Afix \\\\(fst i \\ (\\_.up\\0) f|` thunks \\), CCfix \\\\(Afix \\\\(fst i \\ (\\_.up\\0) f|` (thunks \\)), snd i))\"\n unfolding cccFix_def\n by (rule beta_cfun)(intro cont2cont)\nend\n\nlemma cccFix_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix cccExp \\) = CoCallArityAnalysis.cccFix (\\ \\ cccExp) (\\ \\ \\)\"\n apply (rule cfun_eqvtI) unfolding CoCallArityAnalysis.cccFix_eq by perm_simp rule\n\nlemma cccFix_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.cccFix cccexp1 heap1 = CoCallArityAnalysis.cccFix cccexp2 heap2\"\n unfolding CoCallArityAnalysis.cccFix_def\n apply (rule cfun_eqI)\n apply auto\n apply (rule arg_cong[OF Afix_cong], auto simp add: CoCallArityAnalysis.Aexp_def)[1]\n apply (rule arg_cong2[OF ccFix_cong Afix_cong ])\n apply (auto simp add: CoCallArityAnalysis.Aexp_def)\n done\n\n\nsubsubsection \\The non-recursive case\\\n\ndefinition ABind_nonrec :: \"var \\ exp \\ AEnv \\ CoCalls \\ Arity\\<^sub>\\\"\nwhere\n \"ABind_nonrec x e = (\\ i. (if isVal e \\ x--x\\(snd i) then fst i x else up\\0))\"\n\nlemma ABind_nonrec_eq:\n \"ABind_nonrec x e\\(ae,G) = (if isVal e \\ x--x\\G then ae x else up\\0)\"\n unfolding ABind_nonrec_def\n apply (subst beta_cfun)\n apply (rule cont_if_else_above)\n apply auto\n by (metis in_join join_self_below(4))\n\nlemma ABind_nonrec_eqvt[eqvt]: \"\\ \\ (ABind_nonrec x e) = ABind_nonrec (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n apply (case_tac xa, simp)\n unfolding ABind_nonrec_eq\n by perm_simp rule\n\nlemma ABind_nonrec_above_arg:\n \"ae x \\ ABind_nonrec x e \\ (ae, G)\"\nunfolding ABind_nonrec_eq by auto\n\ndefinition Aheap_nonrec where\n \"Aheap_nonrec x e = (\\ i. esing x\\(ABind_nonrec x e\\i))\"\n\nlemma Aheap_nonrec_simp:\n \"Aheap_nonrec x e\\i = esing x\\(ABind_nonrec x e\\i)\"\n unfolding Aheap_nonrec_def by simp\n\nlemma Aheap_nonrec_lookup[simp]:\n \"(Aheap_nonrec x e\\i) x = ABind_nonrec x e\\i\"\n unfolding Aheap_nonrec_simp by simp\n\nlemma Aheap_nonrec_eqvt'[eqvt]:\n \"\\ \\ (Aheap_nonrec x e) = Aheap_nonrec (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding Aheap_nonrec_simp\n by (perm_simp, rule)\n\n\ncontext CoCallArityAnalysis\nbegin\n\n definition Afix_nonrec\n where \"Afix_nonrec x e = (\\ i. fup\\(Aexp e)\\(ABind_nonrec x e \\ i) \\ fst i)\"\n\n lemma Afix_nonrec_eq[simp]:\n \"Afix_nonrec x e \\ i = fup\\(Aexp e)\\(ABind_nonrec x e \\ i) \\ fst i\"\n unfolding Afix_nonrec_def\n by (rule beta_cfun) simp\n\n definition CCfix_nonrec\n where \"CCfix_nonrec x e = (\\ i. ccBind x e \\ (Aheap_nonrec x e\\i, snd i) \\ ccProd (fv e) (ccNeighbors x (snd i) - (if isVal e then {} else {x})) \\ snd i)\"\n\n lemma CCfix_nonrec_eq[simp]:\n \"CCfix_nonrec x e \\ i = ccBind x e\\(Aheap_nonrec x e\\i, snd i) \\ ccProd (fv e) (ccNeighbors x (snd i) - (if isVal e then {} else {x})) \\ snd i\"\n unfolding CCfix_nonrec_def\n by (rule beta_cfun) (intro cont2cont)\n\n definition cccFix_nonrec :: \"var \\ exp \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix_nonrec x e = (\\ i. (Afix_nonrec x e \\i , CCfix_nonrec x e \\i))\"\n\n lemma cccFix_nonrec_eq[simp]:\n \"cccFix_nonrec x e\\i = (Afix_nonrec x e \\i , CCfix_nonrec x e \\i)\"\n unfolding cccFix_nonrec_def\n by (rule beta_cfun) (intro cont2cont)\n\nend\n\n\nlemma AFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.Afix_nonrec cccExp x e) = CoCallArityAnalysis.Afix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.Afix_nonrec_eq\n by perm_simp rule\n\n\nlemma CCFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.CCfix_nonrec cccExp x e) = CoCallArityAnalysis.CCfix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.CCfix_nonrec_eq\n by perm_simp rule\n\nlemma cccFix_nonrec_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix_nonrec cccExp x e) = CoCallArityAnalysis.cccFix_nonrec (\\ \\ cccExp) (\\ \\ x) (\\ \\ e)\"\n apply (rule cfun_eqvtI)\n unfolding CoCallArityAnalysis.cccFix_nonrec_eq\n by perm_simp rule\n\nsubsubsection \\Combining the cases\\\n\ncontext CoCallArityAnalysis\nbegin\n definition cccFix_choose :: \"heap \\ ((AEnv \\ CoCalls) \\ (AEnv \\ CoCalls))\"\n where \"cccFix_choose \\ = (if nonrec \\ then case_prod cccFix_nonrec (hd \\) else cccFix \\)\"\n\n lemma cccFix_choose_simp1[simp]:\n \"\\ nonrec \\ \\ cccFix_choose \\ = cccFix \\\"\n unfolding cccFix_choose_def by simp\n\n lemma cccFix_choose_simp2[simp]:\n \"x \\ fv e \\ cccFix_choose [(x,e)] = cccFix_nonrec x e\"\n unfolding cccFix_choose_def nonrec_def by auto\n\nend\n\nlemma cccFix_choose_eqvt[eqvt]: \"\\ \\ (CoCallArityAnalysis.cccFix_choose cccExp \\) = CoCallArityAnalysis.cccFix_choose (\\ \\ cccExp) (\\ \\ \\)\"\n unfolding CoCallArityAnalysis.cccFix_choose_def \n apply (cases nonrec \\ rule: eqvt_cases[where x = \\])\n apply (perm_simp, rule)\n apply simp\n apply (erule nonrecE)\n apply (simp )\n\n apply simp\n done\n\nlemma cccFix_nonrec_cong[fundef_cong]:\n \"cccexp1 e = cccexp2 e \\ CoCallArityAnalysis.cccFix_nonrec cccexp1 x e = CoCallArityAnalysis.cccFix_nonrec cccexp2 x e\"\n apply (rule cfun_eqI)\n unfolding CoCallArityAnalysis.cccFix_nonrec_eq\n unfolding CoCallArityAnalysis.Afix_nonrec_eq\n unfolding CoCallArityAnalysis.CCfix_nonrec_eq\n unfolding CoCallArityAnalysis.fup_Aexp_eq\n apply (simp only: )\n apply (rule arg_cong[OF ccBind_cong])\n apply simp\n unfolding CoCallArityAnalysis.CCexp_def\n apply simp\n done\n\nlemma cccFix_choose_cong[fundef_cong]:\n \"\\ (\\ e. e \\ snd ` set heap2 \\ cccexp1 e = cccexp2 e); heap1 = heap2 \\\n \\ CoCallArityAnalysis.cccFix_choose cccexp1 heap1 = CoCallArityAnalysis.cccFix_choose cccexp2 heap2\"\n unfolding CoCallArityAnalysis.cccFix_choose_def\n apply (rule cfun_eqI)\n apply (auto elim!: nonrecE)\n apply (rule arg_cong[OF cccFix_nonrec_cong], auto)\n apply (rule arg_cong[OF cccFix_cong], auto)[1]\n done\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CoCallFix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.25905992423747276}} {"text": "theory Friend\nimports \"../Observation_Setup\" Friend_Value_Setup\nbegin\n\n\nsubsection \\Declassification bound\\\n\nfun T :: \"(state,act,out) trans \\ bool\"\nwhere \"T (Trans _ _ _ _) = False\"\n\ntext \\The bound follows the same ``while-or-last-before'' scheme as the bound for post\nconfidentiality (Section~\\ref{sec:post-bound}), alternating between open (\\BO\\) and\nclosed (\\BC\\) phases.\n\nThe access window is initially open, because the two users are known not to exist when the system\nis initialized, so there cannot be friendship between them.\n\nThe bound also incorporates the static knowledge that the friendship status alternates between\n\\False\\ and \\True\\.\\\n\nfun alternatingFriends :: \"value list \\ bool \\ bool\" where\n \"alternatingFriends [] _ = True\"\n| \"alternatingFriends (FrVal st # vl) st' \\ st' = (\\st) \\ alternatingFriends vl st\"\n| \"alternatingFriends (OVal _ # vl) st = alternatingFriends vl st\"\n\ninductive BO :: \"value list \\ value list \\ bool\"\nand BC :: \"value list \\ value list \\ bool\"\nwhere\n BO_FrVal[simp,intro!]:\n \"BO (map FrVal fs) (map FrVal fs)\"\n|BO_BC[intro]:\n \"BC vl vl1 \\\n BO (map FrVal fs @ OVal False # vl) (map FrVal fs @ OVal False # vl1)\"\n(* *)\n|BC_FrVal[simp,intro!]:\n \"BC (map FrVal fs) (map FrVal fs1)\"\n|BC_BO[intro]:\n \"BO vl vl1 \\ (fs = [] \\ fs1 = []) \\ (fs \\ [] \\ last fs = last fs1) \\\n BC (map FrVal fs @ OVal True # vl)\n (map FrVal fs1 @ OVal True # vl1)\"\n\ndefinition \"B vl vl1 \\ BO vl vl1 \\ alternatingFriends vl1 False\"\n\n\nlemma BO_Nil_Nil: \"BO vl vl1 \\ vl = [] \\ vl1 = []\"\nby (cases rule: BO.cases) auto\n\nno_notation relcomp (infixr \"O\" 75)\n\ninterpretation BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nsubsection \\Unwinding proof\\\n\n(* Key lemma: *)\nlemma eqButUID_step_\\_out:\nassumes ss1: \"eqButUID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand \\: \"\\ (Trans s a ou s')\"\nand os: \"open s \\ friendIDs s = friendIDs s1\"\nshows \"ou = ou1\"\nproof -\n from \\ obtain uid where uid: \"userOfA a = Some uid \\ uid \\ UIDs \\ uid \\ UID1 \\ uid \\ UID2\n \\ userOfA a = None\"\n using UID1_UID2_UIDs by (cases \"userOfA a\") auto\n { fix uid\n assume \"uid \\\\ friendIDs s UID1 \\ uid \\\\ friendIDs s UID2\" and \"uid \\ UIDs\"\n with os have \"friendIDs s = friendIDs s1\" unfolding open_def openByF_def by auto\n } note fIDs = this\n { fix uid uid'\n assume uid: \"uid \\ UID1\" \"uid \\ UID2\"\n have \"friendIDs s uid = friendIDs s1 uid\" (is ?f_eq)\n and \"pendingFReqs s uid = pendingFReqs s1 uid\" (is ?pFR_eq)\n and \"uid \\\\ friendIDs s uid' \\ uid \\\\ friendIDs s1 uid'\" (is ?f_iff)\n and \"uid \\\\ pendingFReqs s uid' \\ uid \\\\ pendingFReqs s1 uid'\" (is ?pFR_iff)\n and \"friendReq s uid uid' = friendReq s1 uid uid'\" (is ?FR_eq)\n and \"friendReq s uid' uid = friendReq s1 uid' uid\" (is ?FR_eq')\n proof -\n show ?f_eq ?pFR_eq using uid ss1 UID1_UID2_UIDs unfolding eqButUID_def\n by (auto intro!: eqButUIDf_not_UID)\n show ?f_iff ?pFR_iff using uid ss1 UID1_UID2_UIDs unfolding eqButUID_def\n by (auto intro!: eqButUIDf_not_UID')\n from uid have \"\\ (uid,uid') \\ {(UID1,UID2), (UID2,UID1)}\" by auto\n then show ?FR_eq ?FR_eq' using ss1 UID1_UID2_UIDs unfolding eqButUID_def\n by (auto intro!: eqButUID12_not_UID)\n qed\n } note simps = this eqButUID_def r_defs s_defs c_defs l_defs u_defs d_defs\n note facts = ss1 step step1 uid\n show ?thesis\n proof (cases a)\n case (Ract ra) then show ?thesis using facts by (cases ra) (auto simp add: simps)\n next\n case (Sact sa) then show ?thesis using facts by (cases sa) (auto simp add: simps)\n next\n case (Cact ca) then show ?thesis using facts by (cases ca) (auto simp add: simps)\n next\n case (Lact la)\n then show ?thesis using facts proof (cases la)\n case (lFriends uid p uid')\n with \\ have uid: \"uid \\ UIDs\" using Lact by auto\n then have uid_uid': \"uid \\\\ friendIDs s uid' \\ uid \\\\ friendIDs s1 uid'\"\n using ss1 UID1_UID2_UIDs unfolding eqButUID_def by (intro eqButUIDf_not_UID') auto\n show ?thesis\n proof (cases \"(uid' = UID1 \\ uid' = UID2) \\ uid \\\\ friendIDs s uid'\")\n case True\n with uid have \"friendIDs s = friendIDs s1\" by (intro fIDs) auto\n then show ?thesis using lFriends facts Lact by (auto simp: simps)\n next\n case False\n then show ?thesis using lFriends facts Lact simps(1) uid_uid' by (auto simp: simps)\n qed\n next\n case (lPosts uid p)\n then have o: \"\\PID. owner s PID = owner s1 PID\"\n and n: \"\\PID. post s PID = post s1 PID\"\n and PIDs: \"postIDs s = postIDs s1\"\n and viss: \"vis s = vis s1\"\n and fu: \"\\uid'. uid \\\\ friendIDs s uid' \\ uid \\\\ friendIDs s1 uid'\"\n and e: \"e_listPosts s uid p \\ e_listPosts s1 uid p\"\n using ss1 uid Lact unfolding eqButUID_def l_defs by (auto simp add: simps(3))\n have \"listPosts s uid p = listPosts s1 uid p\"\n unfolding listPosts_def o n PIDs fu viss ..\n with e show ?thesis using Lact lPosts step step1 by auto\n qed (auto simp add: simps)\n next\n case (Uact ua) then show ?thesis using facts by (cases ua) (auto simp add: simps)\n next\n case (Dact da) then show ?thesis using facts by (cases da) (auto simp add: simps)\n qed\nqed\n\n\n(* helper *) lemma toggle_friends12_True:\nassumes rs: \"reach s\"\n and IDs: \"IDsOK s [UID1, UID2] []\"\n and nf12: \"\\friends12 s\"\nobtains al oul\nwhere \"sstep s al = (oul, createFriend s UID1 (pass s UID1) UID2)\"\n and \"al \\ []\" and \"eqButUID s (createFriend s UID1 (pass s UID1) UID2)\"\n and \"friends12 (createFriend s UID1 (pass s UID1) UID2)\"\n and \"O (traceOf s al) = []\" and \"V (traceOf s al) = [FrVal True]\"\nproof cases\n assume \"UID1 \\\\ pendingFReqs s UID2 \\ UID2 \\\\ pendingFReqs s UID1\"\n then show thesis proof\n assume pFR: \"UID1 \\\\ pendingFReqs s UID2\"\n let ?a = \"Cact (cFriend UID2 (pass s UID2) UID1)\"\n let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2\n unfolding createFriend_sym[of \"s\" \"UID1\" \"pass s UID1\" \"UID2\" \"pass s UID2\"]\n by (auto simp add: c_defs)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal True\" and \"friends12 ?s'\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Cact_cFriend_step_eqButUID)\n next\n assume pFR: \"UID2 \\\\ pendingFReqs s UID1\"\n let ?a = \"Cact (cFriend UID1 (pass s UID1) UID2)\"\n let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2 by (auto simp add: c_defs)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal True\" and \"friends12 ?s'\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Cact_cFriend_step_eqButUID)\n qed\nnext\n assume pFR: \"\\(UID1 \\\\ pendingFReqs s UID2 \\ UID2 \\\\ pendingFReqs s UID1)\"\n let ?a1 = \"Cact (cFriendReq UID2 (pass s UID2) UID1 emptyReq)\"\n let ?s1 = \"createFriendReq s UID2 (pass s UID2) UID1 emptyReq\"\n let ?trn1 = \"Trans s ?a1 outOK ?s1\"\n let ?a2 = \"Cact (cFriend UID1 (pass ?s1 UID1) UID2)\"\n let ?s2 = \"createFriend ?s1 UID1 (pass ?s1 UID1) UID2\"\n let ?trn2 = \"Trans ?s1 ?a2 outOK ?s2\"\n have eFR: \"e_createFriendReq s UID2 (pass s UID2) UID1 emptyReq\" using IDs pFR nf12\n using reach_friendIDs_symmetric[OF rs]\n by (auto simp add: c_defs friends12_def)\n then have step1: \"step s ?a1 = (outOK, ?s1)\" by auto\n moreover then have \"\\\\ ?trn1\" and \"\\\\ ?trn1\" using UID1_UID2_UIDs by auto\n moreover have \"eqButUID s ?s1\" by (intro Cact_cFriendReq_step_eqButUID[OF step1]) auto\n moreover have rs1: \"reach ?s1\" using step1 by (intro reach_PairI[OF rs])\n moreover have step2: \"step ?s1 ?a2 = (outOK, ?s2)\" using IDs by (auto simp: c_defs)\n moreover then have \"\\ ?trn2\" and \"f ?trn2 = FrVal True\" and \"friends12 ?s2\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn2\" using UID1_UID2_UIDs by auto\n moreover have \"eqButUID ?s1 ?s2\" by (intro Cact_cFriend_step_eqButUID[OF step2 rs1]) auto\n moreover have \"?s2 = createFriend s UID1 (pass s UID1) UID2\"\n using eFR by (intro createFriendReq_createFriend_absorb)\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a1, ?a2]\" \"[outOK, outOK]\"]) (auto intro: eqButUID_trans)\nqed\n\n(* helper *) lemma toggle_friends12_False:\nassumes rs: \"reach s\"\n and IDs: \"IDsOK s [UID1, UID2] []\"\n and f12: \"friends12 s\"\nobtains al oul\nwhere \"sstep s al = (oul, deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"al \\ []\" and \"eqButUID s (deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"\\friends12 (deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"O (traceOf s al) = []\" and \"V (traceOf s al) = [FrVal False]\"\nproof -\n let ?a = \"Dact (dFriend UID1 (pass s UID1) UID2)\"\n let ?s' = \"deleteFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs f12 UID1_UID2\n by (auto simp add: d_defs friends12_def)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal False\" and \"\\friends12 ?s'\"\n using reach_friendIDs_symmetric[OF rs] by (auto simp: d_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using f12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Dact_dFriend_step_eqButUID)\nqed\n\n\ndefinition \\0 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\0 s vl s1 vl1 \\\n eqButUID s s1 \\ friendIDs s = friendIDs s1 \\ open s \\\n BO vl vl1 \\ alternatingFriends vl1 (friends12 s1)\"\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\ (\\fs fs1.\n eqButUID s s1 \\ \\open s \\\n alternatingFriends vl1 (friends12 s1) \\\n vl = map FrVal fs \\ vl1 = map FrVal fs1)\"\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\ (\\fs fs1 vlr vlr1.\n eqButUID s s1 \\ \\open s \\ BO vlr vlr1 \\\n alternatingFriends vl1 (friends12 s1) \\\n (fs = [] \\ fs1 = []) \\\n (fs \\ [] \\ last fs = last fs1) \\\n (fs = [] \\ friendIDs s = friendIDs s1) \\\n vl = map FrVal fs @ OVal True # vlr \\\n vl1 = map FrVal fs1 @ OVal True # vlr1)\"\n\nlemma \\2_I:\nassumes \"eqButUID s s1\" \"\\open s\" \"BO vlr vlr1\" \"alternatingFriends vl1 (friends12 s1)\"\n \"fs = [] \\ fs1 = []\" \"fs \\ [] \\ last fs = last fs1\"\n \"fs = [] \\ friendIDs s = friendIDs s1\"\n \"vl = map FrVal fs @ OVal True # vlr\"\n \"vl1 = map FrVal fs1 @ OVal True # vlr1\"\nshows \"\\2 s vl s1 vl1\"\nusing assms unfolding \\2_def by blast\n\n\nlemma istate_\\0:\nassumes B: \"B vl vl1\"\nshows \"\\0 istate vl istate vl1\"\nusing assms unfolding \\0_def istate_def B_def open_def openByA_def openByF_def friends12_def\nby auto\n\nlemma unwind_cont_\\0: \"unwind_cont \\0 {\\0,\\1,\\2}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\0 s vl s1 vl1 \\\n \\1 s vl s1 vl1 \\\n \\2 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\0: \"\\0 s vl s1 vl1\"\n then have rs: \"reach s\" and ss1: \"eqButUID s s1\" and fIDs: \"friendIDs s = friendIDs s1\"\n and os: \"open s\" and BO: \"BO vl vl1\" and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n using reachNT_reach unfolding \\0_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n then have vl: \"vl = f ?trn # vl'\" using c by (auto simp: consume_def)\n from BO have ?match proof (cases \"f ?trn\")\n case (FrVal fv)\n with BO vl obtain vl1' where vl1': \"vl1 = f ?trn # vl1'\" and BO': \"BO vl' vl1'\"\n proof (cases rule: BO.cases)\n case (BO_BC vl'' vl1'' fs)\n moreover with vl FrVal obtain fs' where \"fs = fv # fs'\" by (cases fs) auto\n ultimately show ?thesis using FrVal BO_BC vl\n by (intro that[of \"map FrVal fs' @ OVal False # vl1''\"]) auto\n qed auto\n from fIDs have f12: \"friends12 s = friends12 s1\" unfolding friends12_def by auto\n show ?match using \\ step rs FrVal proof (cases rule: \\E)\n case (Friend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\"\n using ss1 unfolding eqButUID_def by auto\n let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = createFriend s UID1 p UID2\"\n using Friend step by (auto simp: createFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Friend\n by (auto intro: Cact_cFriend_step_eqButUID)\n moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal True]\"\n and f12s1': \"friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Friend unfolding f12 by (auto elim: toggle_friends12_True)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Friend(6) f12 unfolding s'\n by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n ultimately have \"\\0 s' vl' ?s1' vl1'\"\n using ss1 BO' aF1 unfolding \\0_def vl1' Friend(3)\n by (auto intro: eqButUID_trans eqButUID_sym)\n moreover have \"\\\\ ?trn\" using Friend UID1_UID2_UIDs by auto\n ultimately show ?match using tr1 vl1' Friend\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n next\n case (Unfriend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\"\n using ss1 unfolding eqButUID_def by auto\n let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = deleteFriend s UID1 p UID2\"\n using Unfriend step by (auto simp: deleteFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Unfriend\n by (auto intro: Dact_dFriend_step_eqButUID)\n moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal False]\"\n and f12s1': \"\\friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Unfriend unfolding f12 by (auto elim: toggle_friends12_False)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: d_defs)\n ultimately have \"\\0 s' vl' ?s1' vl1'\"\n using ss1 BO' aF1 unfolding \\0_def vl1' Unfriend(3)\n by (auto intro: eqButUID_trans eqButUID_sym)\n moreover have \"\\\\ ?trn\" using Unfriend UID1_UID2_UIDs by auto\n ultimately show ?match using tr1 vl1' Unfriend\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n qed auto\n next\n case (OVal ov)\n with BO vl obtain vl1' where vl1': \"vl1 = OVal False # vl1'\"\n and vl': \"vl = OVal False # vl'\"\n and BC: \"BC vl' vl1'\"\n proof (cases rule: BO.cases)\n case (BO_BC vl'' vl1'' fs)\n moreover then have \"fs = []\" using vl unfolding OVal by (cases fs) auto\n ultimately show thesis using vl by (intro that[of vl1'']) auto\n qed auto\n then have \"f ?trn = OVal False\" using vl by auto\n with \\ step rs show ?match proof (cases rule: \\E)\n case (CloseF uid p uid')\n let ?s1' = \"deleteFriend s1 uid p uid'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = deleteFriend s uid p uid'\" using CloseF step by auto\n have step1: \"step s1 a = (outOK, ?s1')\"\n using CloseF step ss1 fIDs unfolding eqButUID_def by (auto simp: d_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"\\open s'\" using CloseF os unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: d_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n using CloseF(2) UID1_UID2_UIDs unfolding friends12_def d_defs by auto\n from BC have \"\\1 s' vl' ?s1' vl1' \\ \\2 s' vl' ?s1' vl1'\"\n proof (cases rule: BC.cases)\n case (BC_FrVal fs fs1)\n then show ?thesis using aF1 os' fIDs' f12s1 s's1' unfolding \\1_def vl1' by auto\n next\n case (BC_BO vlr vlr1 fs fs1)\n then have \"\\2 s' vl' ?s1' vl1'\" using s's1' os' aF1 f12s1 fIDs' unfolding vl1'\n by (intro \\2_I[of _ _ _ _ _ fs fs1]) auto\n then show ?thesis ..\n qed\n moreover have \"open s1\" \"\\open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding CloseF by auto\n ultimately show ?match using step1 vl1' CloseF UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n next\n case (CloseA uid p uid' p')\n let ?s1' = \"createUser s1 uid p uid' p'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = createUser s uid p uid' p'\" using CloseA step by auto\n have step1: \"step s1 a = (outOK, ?s1')\"\n using CloseA step ss1 unfolding eqButUID_def by (auto simp: c_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"\\open s'\" using CloseA os unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: c_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n unfolding friends12_def by (auto simp: c_defs)\n from BC have \"\\1 s' vl' ?s1' vl1' \\ \\2 s' vl' ?s1' vl1'\"\n proof (cases rule: BC.cases)\n case (BC_FrVal fs fs1)\n then show ?thesis using aF1 os' fIDs' f12s1 s's1' unfolding \\1_def vl1' by auto\n next\n case (BC_BO vlr vlr1 fs fs1)\n then have \"\\2 s' vl' ?s1' vl1'\" using s's1' os' aF1 f12s1 fIDs' unfolding vl1'\n by (intro \\2_I[of _ _ _ _ _ fs fs1]) auto\n then show ?thesis ..\n qed\n moreover have \"open s1\" \"\\open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding CloseA by auto\n ultimately show ?match using step1 vl1' CloseA UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n qed auto\n qed\n then show \"?match \\ ?ignore\" ..\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have fIDs': \"friendIDs s' = friendIDs s1'\"\n using eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 True fIDs] .\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n then have \"\\0 s' vl' s1' vl1\" using os fIDs' aF1 BO\n unfolding \\0_def os' f12s1' vl' by auto\n then have ?match\n using step1 n\\' fIDs eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using \\0 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis using BO BO_Nil_Nil by auto\n qed\nqed\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1, \\0}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\0 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 1: \"\\1 s vl s1 vl1\"\n from rsT have rs: \"reach s\" by (intro reachNT_reach)\n from 1 obtain fs fs1\n where ss1: \"eqButUID s s1\" and os: \"\\open s\"\n and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n and vl: \"vl = map FrVal fs\" and vl1: \"vl1 = map FrVal fs1\"\n unfolding \\1_def by auto\n from os have IDs: \"IDsOK s [UID1, UID2] []\" unfolding open_defs by auto\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\" using ss1 unfolding eqButUID_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof cases\n assume fs1: \"fs1 = []\"\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n with vl c obtain fv fs' where vl': \"vl' = map FrVal fs'\" and fv: \"f ?trn = FrVal fv\"\n by (cases fs) (auto simp: consume_def)\n from \\ step rs fv have ss': \"eqButUID s s'\"\n by (elim \\E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n then have \"\\open s'\" using os by (auto simp: eqButUID_open_eq)\n moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have \"\\1 s' vl' s1 vl1\" using aF1 unfolding \\1_def vl' vl1 by auto\n moreover have \"\\\\ ?trn\" using \\ step rs fv UID1_UID2_UIDs by (elim \\E) auto\n ultimately have ?ignore by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n then have \"\\1 s' vl' s1' vl1\" using os aF1 vl vl1\n unfolding \\1_def os' vl' f12s1' by auto\n then have ?match\n using step1 n\\' os eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using 1 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis using fs1 unfolding vl1 by auto\n next\n assume \"fs1 \\ []\"\n then obtain fs1' where fs1: \"fs1 = (\\friends12 s1) # fs1'\"\n and aF1': \"alternatingFriends (map FrVal fs1') (\\friends12 s1)\"\n using aF1 unfolding vl1 by (cases fs1) auto\n obtain al oul s1' where \"sstep s1 al = (oul, s1')\" \"al \\ []\" \"eqButUID s1 s1'\"\n \"friends12 s1' = (\\friends12 s1)\"\n \"O (traceOf s1 al) = []\" \"V (traceOf s1 al) = [FrVal (\\friends12 s1)]\"\n using rs1 IDs1\n by (cases \"friends12 s1\") (auto intro: toggle_friends12_True toggle_friends12_False)\n moreover then have \"\\1 s vl s1' (map FrVal fs1')\"\n using os aF1' vl ss1 unfolding \\1_def by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have ?iact using vl1 unfolding fs1\n by (intro iactionI_ms[of s1 al oul s1'])\n (auto simp: consumeList_def O_Nil_never list_ex_iff_length_V)\n then show ?thesis ..\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2,\\0}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\0 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 2: \"\\2 s vl s1 vl1\"\n from rsT have rs: \"reach s\" by (intro reachNT_reach)\n obtain fs fs1 vlr vlr1\n where ss1: \"eqButUID s s1\" and os: \"\\open s\" and BO: \"BO vlr vlr1\"\n and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n and vl: \"vl = map FrVal fs @ OVal True # vlr\"\n and vl1: \"vl1 = map FrVal fs1 @ OVal True # vlr1\"\n and fs_fs1: \"fs = [] \\ fs1 = []\"\n and last_fs: \"fs \\ [] \\ last fs = last fs1\"\n and fs_fIDs: \"fs = [] \\ friendIDs s = friendIDs s1\"\n using 2 unfolding \\2_def by auto\n from os have IDs: \"IDsOK s [UID1, UID2] []\" unfolding open_defs by auto\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\" using ss1 unfolding eqButUID_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof cases\n assume \"length fs1 > 1\"\n then obtain fs1'\n where fs1: \"fs1 = (\\friends12 s1) # fs1'\" and fs1': \"fs1' \\ []\"\n and last_fs': \"last fs1 = last fs1'\"\n and aF1': \"alternatingFriends (map FrVal fs1' @ OVal True # vlr1) (\\friends12 s1)\"\n using vl1 aF1 by (cases fs1) auto\n obtain al oul s1' where \"sstep s1 al = (oul, s1')\" \"al \\ []\" \"eqButUID s1 s1'\"\n \"friends12 s1' = (\\friends12 s1)\"\n \"O (traceOf s1 al) = []\" \"V (traceOf s1 al) = [FrVal (\\friends12 s1)]\"\n using rs1 IDs1\n by (cases \"friends12 s1\") (auto intro: toggle_friends12_True toggle_friends12_False)\n moreover then have \"\\2 s vl s1' (map FrVal fs1' @ OVal True # vlr1)\"\n using os aF1' vl ss1 fs1' last_fs' fs_fs1 last_fs BO unfolding fs1\n by (intro \\2_I[of _ _ vlr vlr1 _ fs fs1'])\n (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have ?iact using vl1 unfolding fs1\n by (intro iactionI_ms[of s1 al oul s1'])\n (auto simp: consumeList_def O_Nil_never list_ex_iff_length_V)\n then show ?thesis ..\n next\n assume len1_leq_1: \"\\ length fs1 > 1\"\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n show ?thesis proof cases\n assume \"length fs > 1\"\n then obtain fv fs'\n where fs1: \"fs = fv # fs'\" and fs1': \"fs' \\ []\"\n and last_fs': \"last fs = last fs'\"\n using vl by (cases fs) auto\n with \\ c have fv: \"f ?trn = FrVal fv\" and vl': \"vl' = map FrVal fs' @ OVal True # vlr\"\n unfolding vl consume_def by auto\n from \\ step rs fv have ss': \"eqButUID s s'\"\n by (elim \\E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n then have \"\\open s'\" using os by (auto simp: eqButUID_open_eq)\n moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have \"\\2 s' vl' s1 vl1\"\n using aF1 vl' fs1' fs_fs1 last_fs BO unfolding fs1 vl1\n by (intro \\2_I[of _ _ vlr vlr1 _ fs' fs1])\n (auto intro: eqButUID_sym eqButUID_trans)\n moreover have \"\\\\ ?trn\" using \\ step rs fv UID1_UID2_UIDs by (elim \\E) auto\n ultimately have ?ignore by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n next\n assume len_leq_1: \"\\ length fs > 1\"\n show ?thesis proof cases\n assume fs: \"fs = []\"\n then have fs1: \"fs1 = []\" and fIDs: \"friendIDs s = friendIDs s1\"\n using fs_fs1 fs_fIDs by auto\n from fs \\ c have ov: \"f ?trn = OVal True\" and vl': \"vl' = vlr\"\n unfolding vl consume_def by auto\n with \\ step rs have ?match proof (cases rule: \\E)\n case (OpenF uid p uid')\n let ?s1' = \"createFriend s1 uid p uid'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = createFriend s uid p uid'\" using OpenF step by auto\n have \"eqButUIDf (pendingFReqs s) (pendingFReqs s1)\"\n using ss1 unfolding eqButUID_def by auto\n then have \"uid' \\\\ pendingFReqs s uid \\ uid' \\\\ pendingFReqs s1 uid\"\n using OpenF by (intro eqButUIDf_not_UID') auto\n then have step1: \"step s1 a = (outOK, ?s1')\"\n using OpenF step ss1 fIDs unfolding eqButUID_def by (auto simp: c_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"open s'\" using OpenF unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: c_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n using OpenF(2) UID1_UID2_UIDs unfolding friends12_def c_defs by auto\n ultimately have \"\\0 s' vl' ?s1' vlr1\"\n using BO aF1 unfolding \\0_def vl' vl1 fs1 by auto\n moreover have \"\\open s1\" \"open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding OpenF by auto\n ultimately show ?match using step1 vl1 fs1 OpenF UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vlr1]) (auto simp: consume_def)\n qed auto\n then show ?thesis ..\n next\n assume \"fs \\ []\"\n then obtain fv where fs: \"fs = [fv]\" using len_leq_1 by (cases fs) auto\n then have fs1: \"fs1 = [fv]\" using len1_leq_1 fs_fs1 last_fs by (cases fs1) auto\n with aF1 have f12s1: \"friends12 s1 = (\\fv)\" unfolding vl1 by auto\n have fv: \"f ?trn = FrVal fv\" and vl': \"vl' = OVal True # vlr\"\n using c \\ unfolding vl fs by (auto simp: consume_def)\n with \\ step rs have ?match proof (cases rule: \\E)\n case (Friend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\"\n using ss1 unfolding eqButUID_def by auto\n have fv: \"fv = True\" using fv Friend by auto\n let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = createFriend s UID1 p UID2\"\n using Friend step by (auto simp: createFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Friend\n by (auto intro: Cact_cFriend_step_eqButUID)\n moreover then have os': \"\\open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal True]\"\n and f12s1': \"friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Friend f12s1 unfolding fv by (auto elim: toggle_friends12_True)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Friend(6) f12s1 unfolding s' fv\n by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n ultimately have \"\\2 s' vl' ?s1' (OVal True # vlr1)\"\n using BO ss1 aF1 unfolding vl' vl1 fs1 f12s1 fv\n by (intro \\2_I[of _ _ _ _ _ \"[]\" \"[]\"])\n (auto intro: eqButUID_trans eqButUID_sym)\n moreover have \"\\\\ ?trn\" using Friend UID1_UID2_UIDs by auto\n ultimately show ?match using tr1 vl1 Friend unfolding fs1 fv\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n next\n case (Unfriend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] []\"\n using ss1 unfolding eqButUID_def by auto\n have fv: \"fv = False\" using fv Unfriend by auto\n let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = deleteFriend s UID1 p UID2\"\n using Unfriend step by (auto simp: deleteFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Unfriend\n by (auto intro: Dact_dFriend_step_eqButUID)\n moreover then have os': \"\\open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal False]\"\n and f12s1': \"\\friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Unfriend f12s1 unfolding fv by (auto elim: toggle_friends12_False)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Unfriend(6) f12s1 unfolding s' fv\n by (intro eqButUID_deleteFriend12_friendIDs_eq[OF ss1 rs rs1])\n ultimately have \"\\2 s' vl' ?s1' (OVal True # vlr1)\"\n using BO ss1 aF1 unfolding vl' vl1 fs1 f12s1 fv\n by (intro \\2_I[of _ _ _ _ _ \"[]\" \"[]\"])\n (auto intro: eqButUID_trans eqButUID_sym)\n moreover have \"\\\\ ?trn\" using Unfriend UID1_UID2_UIDs by auto\n ultimately show ?match using tr1 vl1 Unfriend unfolding fs1 fv\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n qed auto\n then show ?thesis ..\n qed\n qed\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have \"friendIDs s = friendIDs s1 \\ friendIDs s' = friendIDs s1'\"\n using eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 True] ..\n ultimately have \"\\2 s' vl' s1' vl1\"\n using os' os aF1 BO fs_fs1 last_fs fs_fIDs unfolding f12s1' vl' vl vl1\n by (intro \\2_I) auto\n then have ?match\n using step1 n\\' os eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using 2 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis unfolding vl by auto\n qed\nqed\n\n\ndefinition Gr where\n\"Gr =\n {\n (\\0, {\\0,\\1,\\2}),\n (\\1, {\\1,\\0}),\n (\\2, {\\2,\\0})\n }\"\n\n\ntheorem secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing\nistate_\\0 unwind_cont_\\0 unwind_cont_\\1 unwind_cont_\\2\nunfolding Gr_def by (auto intro: unwind_cont_mono)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMed/Friend_Confidentiality/Friend.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.25899726838774856}} {"text": "(* Title: HOL/Hoare/HeapSyntaxAbort.thy\n Author: Tobias Nipkow\n Copyright 2002 TUM\n*)\n\ntheory HeapSyntaxAbort imports Hoare_Logic_Abort Heap begin\n\nsubsection \"Field access and update\"\n\ntext{* Heap update @{text\"p^.h := e\"} is now guarded against @{term p}\nbeing Null. However, @{term p} may still be illegal,\ne.g. uninitialized or dangling. To guard against that, one needs a\nmore detailed model of the heap where allocated and free addresses are\ndistinguished, e.g. by making the heap a map, or by carrying the set\nof free addresses around. This is needed anyway as soon as we want to\nreason about storage allocation/deallocation. *}\n\nsyntax\n \"_refupdate\" :: \"('a \\ 'b) \\ 'a ref \\ 'b \\ ('a \\ 'b)\"\n (\"_/'((_ \\ _)')\" [1000,0] 900)\n \"_fassign\" :: \"'a ref => id => 'v => 's com\"\n (\"(2_^._ :=/ _)\" [70,1000,65] 61)\n \"_faccess\" :: \"'a ref => ('a ref \\ 'v) => 'v\"\n (\"_^._\" [65,1000] 65)\ntranslations\n \"_refupdate f r v\" == \"f(CONST addr r := v)\"\n \"p^.f := e\" => \"(p \\ CONST Null) \\ (f := _refupdate f p e)\"\n \"p^.f\" => \"f(CONST addr p)\"\n\n\ndeclare fun_upd_apply[simp del] fun_upd_same[simp] fun_upd_other[simp]\n\n\ntext \"An example due to Suzuki:\"\n\nlemma \"VARS v n\n {w = Ref w0 & x = Ref x0 & y = Ref y0 & z = Ref z0 &\n distinct[w0,x0,y0,z0]}\n w^.v := (1::int); w^.n := x;\n x^.v := 2; x^.n := y;\n y^.v := 3; y^.n := z;\n z^.v := 4; x^.n := z\n {w^.n^.n^.v = 4}\"\nby vcg_simp\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Hoare/HeapSyntaxAbort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.2589876956918275}} {"text": "(*\n# Licensed to the Apache Software Foundation (ASF) under one\n# or more contributor license agreements. See the NOTICE file\n# distributed with this work for additional information\n# regarding copyright ownership. The ASF licenses this file\n# to you under the Apache License, Version 2.0 (the\n# \"License\"); you may not use this file except in compliance\n# with the License. You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing,\n# software distributed under the License is distributed on an\n# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n# KIND, either express or implied. See the License for the\n# specific language governing permissions and limitations\n# under the License.\n*)\n\ntheory TrustLevel\n imports Main\nbegin\n\nlocale TrustLevel=\n fixes trusted::'trustlevel\n and untrusted::'trustlevel\n and is_trusted::\"'trustlevel\\bool\"\n assumes TRUSTLEVELHLR1:\"is_trusted trusted\"\n assumes TRUSTLEVELHLR2:\"\\is_trusted untrusted\"\n assumes TRUSTLEVELHLR3:\"(x::'trustlevel)=trusted\\x=untrusted\"\nbegin\n\nlemma TRUSTLEVELHLR4:\"trusted\\untrusted\"\nproof\n assume 0:\"trusted=untrusted\"\n from TRUSTLEVELHLR1 have \"is_trusted untrusted\" by (auto simp: 0)\n from this show \"False\" by (auto simp: TRUSTLEVELHLR2)\nqed\n\nend\n\nprint_locale! TrustLevel\n\nend\n", "meta": {"author": "apache", "repo": "incubator-teaclave-verification", "sha": "566a295590a4d9040a2e330a35f832673aa93365", "save_path": "github-repos/isabelle/apache-incubator-teaclave-verification", "path": "github-repos/isabelle/apache-incubator-teaclave-verification/incubator-teaclave-verification-566a295590a4d9040a2e330a35f832673aa93365/access_control_module/TrustLevel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2589699453660218}} {"text": "(* Title: HOL/IMPP/Misc.thy\n Author: David von Oheimb, TUM\n*)\n\nsection \\Several examples for Hoare logic\\\n\ntheory Misc\nimports Hoare\nbegin\n\noverloading\n newlocs \\ newlocs\n setlocs \\ setlocs\n getlocs \\ getlocs\n update \\ update\nbegin\n\ndefinition newlocs :: locals\n where \"newlocs == %x. undefined\"\n\ndefinition setlocs :: \"state => locals => state\"\n where \"setlocs s l' == case s of st g l => st g l'\"\n\ndefinition getlocs :: \"state => locals\"\n where \"getlocs s == case s of st g l => l\"\n\ndefinition update :: \"state => vname => val => state\"\n where \"update s vn v ==\n case vn of\n Glb gn => (case s of st g l => st (g(gn:=v)) l)\n | Loc ln => (case s of st g l => st g (l(ln:=v)))\"\n\nend\n\n\nsubsection \"state access\"\n\nlemma getlocs_def2: \"getlocs (st g l) = l\"\napply (unfold getlocs_def)\napply simp\ndone\n\nlemma update_Loc_idem2 [simp]: \"s[Loc Y::=s] = s\"\napply (unfold update_def)\napply (induct_tac s)\napply (simp add: getlocs_def2)\ndone\n\nlemma update_overwrt [simp]: \"s[X::=x][X::=y] = s[X::=y]\"\napply (unfold update_def)\napply (induct_tac X)\napply auto\napply (induct_tac [!] s)\napply auto\ndone\n\nlemma getlocs_Loc_update [simp]: \"(s[Loc Y::=k]) = (if Y=Y' then k else s)\"\napply (unfold update_def)\napply (induct_tac s)\napply (simp add: getlocs_def2)\ndone\n\nlemma getlocs_Glb_update [simp]: \"getlocs (s[Glb Y::=k]) = getlocs s\"\napply (unfold update_def)\napply (induct_tac s)\napply (simp add: getlocs_def2)\ndone\n\nlemma getlocs_setlocs [simp]: \"getlocs (setlocs s l) = l\"\napply (unfold setlocs_def)\napply (induct_tac s)\napply auto\napply (simp add: getlocs_def2)\ndone\n\nlemma getlocs_setlocs_lemma: \"getlocs (setlocs s (getlocs s')[Y::=k]) = getlocs (s'[Y::=k])\"\napply (induct_tac Y)\napply (rule_tac [2] ext)\napply auto\ndone\n\n(*unused*)\nlemma classic_Local_valid: \n\"\\v. G|={%Z s. P Z (s[Loc Y::=v]) & s = a (s[Loc Y::=v])}. \n c .{%Z s. Q Z (s[Loc Y::=v])} ==> G|={P}. LOCAL Y:=a IN c .{Q}\"\napply (unfold hoare_valids_def)\napply (simp (no_asm_use) add: triple_valid_def2)\napply clarsimp\napply (drule_tac x = \"s\" in spec)\napply (tactic \"smp_tac \\<^context> 1 1\")\napply (drule spec)\napply (drule_tac x = \"s[Loc Y::=a s]\" in spec)\napply (simp (no_asm_use))\napply (erule (1) notE impE)\napply (tactic \"smp_tac \\<^context> 1 1\")\napply simp\ndone\n\nlemma classic_Local: \"\\v. G|-{%Z s. P Z (s[Loc Y::=v]) & s = a (s[Loc Y::=v])}. \n c .{%Z s. Q Z (s[Loc Y::=v])} ==> G|-{P}. LOCAL Y:=a IN c .{Q}\"\napply (rule export_s)\napply (rule hoare_derivs.Local [THEN conseq1])\napply (erule spec)\napply force\ndone\n\nlemma classic_Local_indep: \"[| Y~=Y'; G|-{P}. c .{%Z s. s = d} |] ==> \n G|-{%Z s. P Z (s[Loc Y::=a s])}. LOCAL Y:=a IN c .{%Z s. s = d}\"\napply (rule classic_Local)\napply clarsimp\napply (erule conseq12)\napply clarsimp\napply (drule sym)\napply simp\ndone\n\nlemma Local_indep: \"[| Y~=Y'; G|-{P}. c .{%Z s. s = d} |] ==> \n G|-{%Z s. P Z (s[Loc Y::=a s])}. LOCAL Y:=a IN c .{%Z s. s = d}\"\napply (rule export_s)\napply (rule hoare_derivs.Local)\napply clarsimp\ndone\n\nlemma weak_Local_indep: \"[| Y'~=Y; G|-{P}. c .{%Z s. s = d} |] ==> \n G|-{%Z s. P Z (s[Loc Y::=a s])}. LOCAL Y:=a IN c .{%Z s. s = d}\"\napply (rule weak_Local)\napply auto\ndone\n\n\nlemma export_Local_invariant: \"G|-{%Z s. Z = s}. LOCAL Y:=a IN c .{%Z s. Z = s}\"\napply (rule export_s)\napply (rule_tac P' = \"%Z s. s'=s & True\" and Q' = \"%Z s. s' = s\" in conseq12)\nprefer 2\napply clarsimp\napply (rule hoare_derivs.Local)\napply clarsimp\napply (rule trueI)\ndone\n\nlemma classic_Local_invariant: \"G|-{%Z s. Z = s}. LOCAL Y:=a IN c .{%Z s. Z = s}\"\napply (rule classic_Local)\napply clarsimp\napply (rule trueI [THEN conseq12])\napply clarsimp\ndone\n\nlemma Call_invariant: \"G|-{P}. BODY pn .{%Z s. Q Z (setlocs s (getlocs s')[X::=s])} ==> \n G|-{%Z s. s'=s & I Z (getlocs (s[X::=k Z])) & P Z (setlocs s newlocs[Loc Arg::=a s])}. \n X:=CALL pn (a) .{%Z s. I Z (getlocs (s[X::=k Z])) & Q Z s}\"\napply (rule_tac s'1 = \"s'\" and\n Q' = \"%Z s. I Z (getlocs (s[X::=k Z])) = I Z (getlocs (s'[X::=k Z])) & Q Z s\" in\n hoare_derivs.Call [THEN conseq12])\napply (simp (no_asm_simp) add: getlocs_setlocs_lemma)\napply force\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/IMPP/Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2589699453660218}} {"text": "theory Kruskal_Impl\n imports Kruskal_Refine \"SeprefTime.IICF_DArray_List\"\n Union_Find_Disjoint_Sets\nbegin\n\ncontext\n fixes t :: \"nat \\ nat\"\nbegin\n definition mop_sortEdges where\n \"mop_sortEdges l = (SPECT (emb (\\(L,n). n= Max (insert 0 (set (map fst L) \\ set (map (snd o snd) L))) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat (t (length l)))))\"\n \n sepref_register \"mop_sortEdges\" \nend\n\nlocale sortMaxnode = \n fixes sortEdges_impl :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) Heap\" \n and sort_time' :: \"nat \\ nat\"\n assumes \n sortEdges_impl[sepref_fr_rules]: \"\\t. (sortEdges_impl, PR_CONST (mop_sortEdges t)) \\\n [\\l. sort_time' (length l) \\ t (length l)]\\<^sub>a\n (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn))\\<^sup>k \\ (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\\\\<^sub>a nat_assn)\"\n\n\n\n \n\n \nlemma set_uprod_nonempty[simp]: \"set_uprod x \\ {}\"\n apply(cases x) by auto\n\n\nlocale Kruskal_intermediate_Impl0 = Kruskal_intermediate E forest connected path weight for E forest connected path \n and weight :: \"nat uprod \\ int\" +\n fixes getEdges :: \"(nat \\ int \\ nat) list nrest\"\n and getEdges_impl :: \"(nat \\ int \\ nat) list Heap\" \n and getEdges_time sort_time :: nat\n(* and sortEdges :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) nrest\"\n and sortEdges_impl :: \"(nat \\ int \\ nat) list \\ ((nat \\ int \\ nat) list * nat) Heap\" *)\n and empty_uf_time indep_test_time insert_uf_time :: nat\n assumes \n E_nonempty: \"E\\{}\"\n and \n getEdges_refine: \"getEdges \\ \\ Id (SPECT (emb (\\L. lst_graph_P' weight L E) (enat getEdges_time)))\"\n and\n getEdges_impl[sepref_fr_rules]: \"(uncurry0 getEdges_impl, uncurry0 getEdges) \\ unit_assn\\<^sup>k \\\\<^sub>a list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\"\n(* and\n sortEdges_refine': \"sortEdges l \\ (SPECT (emb (\\(L,n). n= Max (set (map fst l) \\ set (map (snd o snd) l)) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat sort_time)))\"\n and\n sortEdges_impl[sepref_fr_rules]: \"(sortEdges_impl, sortEdges) \\\n (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn))\\<^sup>k \\\\<^sub>a (list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\\\\<^sub>a nat_assn)\"\n \n*)\n \nbegin\n\nthm conc_fun_br\n\nabbreviation \"sortEdges \\ mop_sortEdges (\\_. sort_time)\"\n\n\n(*\nlemma sortEdges_refine: \n assumes a: \"V = set (map fst l) \\ set (map (snd o snd) l)\"\n shows \"sortEdges l = \\ (br fst (\\(l,n). n= Max V)) (SPECT (emb (\\L. sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l) (enat sort_time)))\"\nproof -\n have gg: \"(\\x. (case x of (l, n) \\ n = Max V) \\ sorted_wrt edges_less_eq (fst x) \\ distinct (fst x) \\ set (fst x) = set l)\n =(\\(L, n). n = Max (set (map fst l) \\ set (map (snd o snd) l)) \\ sorted_wrt edges_less_eq L \\ distinct L \\ set L = set l)\"\n unfolding a by auto\n show ?thesis \n apply(simp only: conc_fun_br gg) by(rule sortEdges_refine')\nqed *)\n\nabbreviation \"insert_time \\ 23\"\nabbreviation \"empty_forest_time \\ 12\"\n\n\nsublocale Kruskal_intermediate_time E forest connected path weight\n empty_forest_time empty_uf_time indep_test_time insert_time insert_uf_time getEdges_time sort_time\n apply unfold_locales .\n\n\n\nterm obtain_sorted_carrier''\n \ndefinition (in -) obtain_sorted_carrier'''_aux where\n \"obtain_sorted_carrier'''_aux gE sE c =\n do {\n l \\ gE;\n ASSERT (length l = card c);\n sE l\n}\" \n\nabbreviation \"obtain_sorted_carrier''' \\ obtain_sorted_carrier'''_aux getEdges sortEdges E\"\n \nlemma distinct_mset_eq:\"distinct a \\ mset a = mset b \\ distinct b\"\n by (metis card_distinct distinct_card set_mset_mset size_mset)\n\nlemma quicksort_by_rel_distinct: \"distinct l \\ distinct (quicksort_by_rel edges_less_eq [] l)\"\n by (auto intro: distinct_mset_eq)\n\ndefinition \"add_size_rel = br fst (\\(l,n). n= Max V)\"\n\n\n\nlemma max_node_is_Max_V: \" E = (\\(a, _, y). Upair a y) ` set la \\ max_node la = Max V\"\nproof -\n assume E: \"E = (\\(a, _, y). Upair a y) ` set la\"\n have pff: \"fst ` set la \\ (\\x. snd (snd x)) ` set la = (\\x\\set la. case x of (x1, x1a, x2a) \\ {x1, x2a})\"\n by (auto simp add: rev_image_eqI) \n have \"V \\ {}\" using E_nonempty V_def by auto\n then have Mo: \"Max V = Max (insert 0 V)\" by auto \n show ?thesis unfolding Mo unfolding V_def\n unfolding E apply simp \n by (auto simp add: max_node_def prod.case_distrib pff ) \nqed\n\nlemma lst_graph_P_V: \"lst_graph_P la E \\ V = (fst ` set la \\ (\\x. snd (snd x)) ` set la)\" \n by (auto simp: emb_eq_Some_conv lst_graph_P_def V_def rev_image_eqI) \n\n \n\nlemma k: \"\\V::nat set. finite V \\ V \\ {} \\ Max V = Max (insert 0 V)\" by auto\n\nlemma *: \"(la::((nat*int*nat) list)) \\ [] \\ Max (insert 0 (fst ` set la \\ (\\x. snd (snd x)) ` set la)) = Max (fst ` set la \\ (\\x. snd (snd x)) ` set la)\"\nproof -\n assume \"la \\ []\"\n then have \"fst ` set la \\ (snd \\ snd) ` set la \\ {}\" by auto\n then show ?thesis apply(intro k[symmetric]) apply simp by simp\nqed\n\n\nlemma obtain_sorted_carrier'''_refine: \"obtain_sorted_carrier''' \\ \\add_size_rel obtain_sorted_carrier''\"\n unfolding obtain_sorted_carrier'''_aux_def add_size_rel_def\n apply(rule bindT_refine') \n apply(rule getEdges_refine) apply safe\n apply(auto simp: emb_eq_Some_conv dest!: split: if_splits)\n unfolding conc_fun_br mop_sortEdges_def \n apply(auto simp: le_fun_def emb'_def dest: lst_graph_P_V split: if_splits)\n apply(rule le_R_ASSERTI)\n apply(rule ASSERT_leI) apply simp\n apply(rule SPECT_refine) apply (auto split: if_splits) \n apply(subst * ) subgoal apply auto using E_nonempty by auto \n by (metis (mono_tags) fst_conv in_br_conv lst_graph_P_V prod_case_simp) \n \n \n\ndefinition (in -) initState''_aux where\n \"initState''_aux mn eft eut\\ do {\n initial_union_find \\ mop_per_init (\\_. eut) (mn + 1);\n ASSERT ( card (Domain initial_union_find) = mn + 1);\n e \\ mop_empty_list (\\_. eft);\n RETURNT (initial_union_find, e) \n }\" \n\n\nabbreviation \"initState'' mn == initState''_aux mn empty_forest_time empty_uf_time\"\n\n definition (in -) \"addEdge''_aux uf a w b T iut it = do {\n uf \\ mop_per_union (\\_. iut) uf a b;\n T' \\ mop_push_list (\\_. it) (a,w,b) T;\n RETURNT (uf, T')\n }\"\n\nabbreviation \"addEdge'' uf a w b T == addEdge''_aux uf a w b T insert_uf_time insert_time\"\n\ndefinition (in -) \"notcompare uf a b itt = do {\n i \\ mop_per_compare (\\_. itt) uf a b;\n RETURNT (\\i)\n }\"\n\n\n definition (in -) kruskal3_aux \n where \"kruskal3_aux E gE sE eft eut iut it itt \\ do {\n (sl,mn) \\ obtain_sorted_carrier'''_aux gE sE E;\n ASSERT (mn = Max (Kruskal_intermediate_defs.V E));\n s \\ initState''_aux mn eft eut ;\n (per, spanning_forest) \\ nfoldli sl (\\_. True)\n (\\(a,w,b) (uf, T). do { \n ASSERT (a \\ Domain uf \\ b \\ Domain uf);\n ASSERT ( card (Domain uf) = Max (Kruskal_intermediate_defs.V E) + 1);\n i \\ notcompare uf a b itt;\n if i then\n do { \n ASSERT ((a,w,b)\\set T);\n addEdge''_aux uf a w b T iut it\n }\n else \n RETURNT (uf,T)\n }) s;\n RETURNT spanning_forest\n }\"\n\nabbreviation \"kruskal3 \\ kruskal3_aux E getEdges sortEdges empty_forest_time empty_uf_time\n insert_uf_time insert_time indep_test_time\"\n\n definition per_supset_rel :: \"('a per \\ 'a per) set\" where\n \"per_supset_rel\n \\ {(p1,p2). p1 \\ Domain p2 \\ Domain p2 = p2 \\ p1 - (Domain p2 \\ Domain p2) \\ Id}\"\n\n definition \"kk_rel n \\ per_supset_rel \\ ({p. Domain p = {0.. UNIV)\"\n\nlemma kk_relD: \"x\\ kk_rel n \\ x\\per_supset_rel\" unfolding kk_rel_def by auto\n\n lemma per_supset_rel_dom: \"(p1, p2) \\ per_supset_rel \\ Domain p1 \\ Domain p2\"\n by (auto simp: per_supset_rel_def)\n \n lemma per_supset_compare:\n \"(p1, p2) \\ per_supset_rel \\ x1\\Domain p2 \\ x2\\Domain p2 \\ per_compare p1 x1 x2 \\ per_compare p2 x1 x2\"\n by (auto simp: per_supset_rel_def)\n \n lemma per_supset_union: \"(p1, p2) \\ per_supset_rel \\ x1\\Domain p2 \\ x2\\Domain p2 \\\n (per_union p1 x1 x2, per_union p2 x1 x2) \\ per_supset_rel\"\n apply (clarsimp simp: per_supset_rel_def per_union_def Domain_unfold )\n apply (intro subsetI conjI)\n apply blast\n apply force\n done\n\n lemma per_kk_rel_union: \n assumes \"(p1, p2) \\ kk_rel n\" and inDom: \"x1\\Domain p2\" \"x2\\Domain p2\"\n shows \"(per_union p1 x1 x2, per_union p2 x1 x2) \\ kk_rel n\"\n proof -\n from assms(1) have \"(p1, p2) \\ per_supset_rel\" by(auto dest: kk_relD)\n with inDom have ss: \"(per_union p1 x1 x2, per_union p2 x1 x2) \\ per_supset_rel\" \n by(auto intro: per_supset_union)\n\n from assms(1) have \"Domain p1 = {0.. per_supset_rel\"\n unfolding per_supset_rel_def per_init'_def per_init_def max_node_def\n by (auto simp: less_Suc_eq_le ) \n\nlemma per_init'_refine: \"SPECT [per_init' (Max V + 1) \\ enat empty_uf_time] \\ \\ per_supset_rel (SPECT [per_init V \\ enat empty_uf_time])\"\n apply(rule SPECT_refine) using per_initN_refine by (auto split: if_splits)\n \nlemma gg: \"{(i, i) |i. i < X} = (\\i. (i,i)) ` {i. i < X}\" by auto\n \n\nlemma ff: \"\\X. card (Domain {(i, i) |i. i < X}) = X\"\n unfolding Domain_fst apply(subst card_image)\n subgoal by (smt fst_conv inj_onI mem_Collect_eq) \n subgoal unfolding gg apply(subst card_image) by auto \n done\n\n\nlemma initState''_refine: \"initState'' (Max V) \\ \\(kk_rel (Max V + 1) \\\\<^sub>r Id) initState'\"\n unfolding initState'_aux_def initState''_aux_def mop_empty_list_def kk_rel_def\n unfolding mop_per_init_def\n apply(rule bindT_refine') apply(rule per_init'_refine)\n\n apply(refine_rcg ) \n subgoal by (auto split: if_splits simp: ff per_init'_def ) \n unfolding conc_fun_RES \n apply(rule T_specifies_I) \n apply(vcg' \\-\\ ) \n apply(rule Sup_upper) by (auto simp: per_init'_def numeral_eq_enat split: if_splits) \n\n \n\nlemma SPECT_bind_RETURNT: \"SPECT [x \\ t] \\ (\\i. RETURNT (f i)) = SPECT [f x \\ t]\"\n unfolding bindT_def by(auto split: nrest.split)\n\ntheorem kruskal3_refine: \"kruskal3 \\ \\ Id kruskal2\"\n unfolding kruskal2_aux_def kruskal3_aux_def Let_def\n apply (refine_rcg obtain_sorted_carrier'''_refine )\n (*supply RELATESI[where R=\"per_supset_rel::(nat per \\ _) set\", refine_dref_RELATES]*)\n supply RELATESI[where R=\"kk_rel (Max V + 1)::(nat per \\ _) set\", refine_dref_RELATES]\n apply refine_dref_type \n subgoal unfolding add_size_rel_def by (auto simp: in_br_conv)\n subgoal apply (simp add: add_size_rel_def in_br_conv )\n using initState''_refine by simp \n apply (auto simp add: add_size_rel_def in_br_conv per_supset_compare\n per_supset_union \n dest: per_supset_rel_dom\n simp del: per_compare_def )\n subgoal by(auto dest!: kk_relD per_supset_rel_dom) \n subgoal by(auto dest!: kk_relD per_supset_rel_dom) \n subgoal by(auto simp: kk_rel_def) \n subgoal apply(auto dest!: kk_relD simp: SPECT_bind_RETURNT le_fun_def notcompare_def mop_per_compare_def)\n by (meson Domain.simps local.per_supset_compare per_compare_def)+ \n subgoal unfolding addEdge'_aux_def addEdge''_aux_def mop_per_union_def mop_push_list_def\n apply(refine_rcg)\n apply refine_dref_type \n subgoal apply (rule SPECT_refine) by (auto split: if_splits intro: per_kk_rel_union)\n subgoal apply (rule RETURNT_refine) by(auto split: if_splits) \n done\n done\n\nend\n\n\n \n\nlocale Kruskal_intermediate_Impl = Kruskal_intermediate_Impl0\n + UnionFind_Impl + sortMaxnode +\n assumes \n [simp]: \"uf_init_time (Suc (Max V)) \\ empty_uf_time\" \n \"uf_cmp_time (Suc (Max V)) \\ indep_test_time\" \n \"uf_union_time (Suc (Max V)) \\ insert_uf_time\" \n \"sort_time' (card E) \\ sort_time\"\nbegin\n\nsection \\Kruskal\\\n\n\n lemma [fcomp_norm_simps]: \"list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: list_assn_pure_conv)\n lemma [fcomp_norm_simps]: \" (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: )\n\n lemma [sepref_import_param]: \"(sort_edges,sort_edges)\\\\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel \\\\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel\" by simp\n lemma [sepref_import_param]: \"(max_node, max_node) \\ \\Id\\\\<^sub>rId\\\\<^sub>rId\\list_rel \\ nat_rel\" by simp\n\n sepref_register \"getEdges\" :: \"(nat \\ int \\ nat) list nrest\"\n sepref_register uf_init :: \"nat \\ uf Heap\"\n sepref_register uf_cmp :: \"uf \\ nat \\ nat \\ bool Heap\"\n sepref_register uf_union :: \"uf \\ nat \\ nat \\ uf Heap\"\n \ndeclare getEdges_impl [sepref_fr_rules]\n\n \n\nsepref_definition kruskal is\n \"uncurry0 kruskal3\" :: \"(unit_assn)\\<^sup>k \\\\<^sub>a da_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn)\"\n unfolding kruskal3_aux_def obtain_sorted_carrier'''_aux_def initState''_aux_def\n addEdge''_aux_def notcompare_def nfoldli_def\n using [[goals_limit = 2]]\n \n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id \n apply sepref_dbg_monadify\n\n apply sepref_dbg_opt_init\n\n apply sepref_dbg_trans \n \n apply sepref_dbg_opt\n apply sepref_dbg_cons_solve \\ \\Frame rule, recovering the invalidated list \n or pure elements, propagating recovery over the list structure\\\n apply sepref_dbg_cons_solve \\ \\Trivial frame rule\\\n apply sepref_dbg_constraints\n done \n\n\n concrete_definition (in -) kruskal' \n uses Kruskal_intermediate_Impl.kruskal_def\n\n\nthm kruskal3_refine kruskal2_refine kruskal1_refine kruskal0_refine minWeightBasis3_refine\n \nthm kruskal.refine kruskal3_refine kruskal2_refine kruskal1_refine kruskal0_refine minWeightBasis3_refine\n\n\nabbreviation \"MST == minBasis\"\n\nterm minWeightBasis3\n\n(* TODO: *) \n\nlemma k3: \"(kruskal3,kruskal2) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal3_refine) \nlemma k2: \"(kruskal2,kruskal1) \\ \\lst_graph_rel\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal2_refine) \nlemma k1: \"(kruskal1,kruskal0) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal1_refine) \nlemma k0: \"(kruskal0,minWeightBasis3) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) by (rule kruskal0_refine) \nlemma kmw: \"(minWeightBasis3,SPECT (emb minBasis (enat minBasis_time))) \\ \\Id\\nrest_rel\"\n apply(rule nrest_relI) \n by (rule minWeightBasis3_refine)\n\nlemmas k_ref_spec = k3[FCOMP k2, FCOMP k1, FCOMP k0, FCOMP kmw]\n\n\n lemma [fcomp_norm_simps]: \"list_assn (nat_assn \\\\<^sub>a int_assn \\\\<^sub>a nat_assn) = id_assn\"\n by (auto simp: list_assn_pure_conv)\nlemmas kruskal_ref_spec = kruskal.refine[FCOMP k_ref_spec]\n\nthm minBasis_time_def\nlemma kruskal_correct_forest:\n shows \"<$ minBasis_time> kruskal <\\r. (\\\\<^sub>Ara. hr_comp (da_assn id_assn) lst_graph_rel ra r * \\ (MST ra))>\\<^sub>t\"\nproof -\n thm extract_cost_ub \n note l= hn_refine_ref[OF _ kruskal_ref_spec[to_hnr] ]\n thm extract_cost_ub[OF l, where Cost_ub=\"minBasis_time\", simplified in_ran_emb_special_case]\n have ht: \" kruskal <\\r. emp * (\\\\<^sub>Ara. hr_comp (da_assn id_assn) lst_graph_rel ra r * \\ (ra \\ dom ((emb MST (enat minBasis_time)))))>\\<^sub>t\"\n apply(rule extract_cost_ub[OF l, where Cost_ub=\"minBasis_time\" ])\n by (auto simp: in_ran_emb_special_case) \n\n from ht show ?thesis by auto \nqed\nthm minBasis_time_def \nend\n(*\nthm extract_cost_ub[where M= \"(emb Pr t)\", no_vars]\n\nlemma \"hn_refine \\ c \\' R (SPECT (emb Pr t)) \\\n<\\ * $ t> c <\\r. \\' * (\\\\<^sub>Ara. R ra r * \\ (Pr ra))>\\<^sub>t\"\nproof -\n assume \"hn_refine \\ c \\' R (SPECT (emb Pr t))\"\n from extract_cost_ub[OF this, of t]\n show ?thesis by (simp add: ran_emb')\nqed\n \n\nlemma array_length_rule_raw [hoare_triple]:\n \"\n array_length p\n <\\r. dyn_array_raw (xs, n) p * \\(r = n)>\"\n unfolding dyn_array'_def array_length_def \n apply(cases p)\n by (sep_auto simp: zero_time) \n \n\nlemma array_max_rule_raw [hoare_triple]:\n \"\n array_max p\n <\\r. dyn_array_raw (xs, n) p * \\(r = length xs)>\"\n unfolding array_max_def \n apply (cases p)\n by (sep_auto heap: length_rule simp: zero_time) \n\n\nlemma double_length_raw_rule2 [hoare_triple]:\n \"length xs = n \\\n \n double_length p\n \\<^sub>t\" \n using double_length_raw_rule[of xs n p] by(simp add: mult.commute) \n\nlemma push_array_raw_rule [hoare_triple]:\n \"n \\ length xs \\\n \n push_array x p\n \\<^sub>t\" \n unfolding \n push_array_def \n apply(sep_auto heap: array_max_rule_raw push_array_basic_raw_rule\n array_length_rule_raw double_length_raw_rule2)\n subgoal apply(subst array_copy_length) by simp_all\n by sep_auto\n\nlemma push_array_rule''' [hoare_triple]:\n \"n \\ length xs \\\n \n push_array x p\n \\<^sub>t\" \n unfolding \n push_array_def\n apply(sep_auto heap: array_max_rule' array_length_rule' push_array_basic_rule')\n apply(sep_auto heap: double_length_rule' )\n using push_array_basic_rule'\n unfolding double_length_fun.simps\n apply(sep_auto simp only: heap: push_array_basic_rule')\n subgoal apply(subst array_copy_length) by simp_all\n by sep_auto\n \nthm array_max_rule'\n\n*)\nend", "meta": {"author": "adrilow", "repo": "Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL", "sha": "293b12752261dac7f741483b62b27891bf4be1cc", "save_path": "github-repos/isabelle/adrilow-Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL", "path": "github-repos/isabelle/adrilow-Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL/Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL-293b12752261dac7f741483b62b27891bf4be1cc/Kruskal_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.25896994536602175}} {"text": "(* Title: RTS/JVM_RTS/JVMSemantics.thy *)\n(* Author: Susannah Mansky, UIUC 2020 *)\n\nsection \"Instantiating @{term Semantics} with Jinja JVM\"\n\ntheory JVMSemantics\nimports \"../Common/Semantics\" JinjaDCI.JVMExec\nbegin\n\nfun JVMsmall :: \"jvm_prog \\ jvm_state \\ jvm_state set\" where\n\"JVMsmall P \\ = { \\'. exec (P, \\) = Some \\' }\"\n\nlemma JVMsmall_prealloc_pres:\nassumes pre: \"preallocated (fst(snd \\))\"\n and \"\\' \\ JVMsmall P \\\"\nshows \"preallocated (fst(snd \\'))\"\nusing exec_prealloc_pres[OF pre] assms by(cases \\, cases \\', auto)\n\nlemma JVMsmall_det: \"JVMsmall P \\ = {} \\ (\\\\'. JVMsmall P \\ = {\\'})\"\nby auto\n\ndefinition JVMendset :: \"jvm_state set\" where\n\"JVMendset \\ { (xp,h,frs,sh). frs = [] \\ (\\x. xp = Some x) }\"\n\nlemma JVMendset_final: \"\\ \\ JVMendset \\ \\P. JVMsmall P \\ = {}\"\n by(auto simp: JVMendset_def)\n\nlemma start_state_nend:\n \"start_state P \\ JVMendset\"\n by(simp add: start_state_def JVMendset_def)\n\ninterpretation JVMSemantics: Semantics JVMsmall JVMendset\n by unfold_locales (auto dest: JVMendset_final)\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regression_Test_Selection/JVM_RTS/JVMSemantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.41111086923216805, "lm_q1q2_score": 0.2589071862703758}} {"text": "theory flash83Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Remote_GetX_NakVsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv83: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_ShWb )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX1VsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX2VsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX1VsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_PutVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Local_PutXVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv83: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv83 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_GetVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv83: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv83 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv83: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv83 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash83Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4339814648038985, "lm_q1q2_score": 0.25884093047351997}} {"text": "subsection \\RightShiftNode Phase\\\n\ntheory RightShiftPhase\n imports\n Common\n Proofs.StampEvalThms\nbegin\n\nphase RightShiftNode\n terminating size\nbegin\n\n(* Value level proofs *)\n(* Has counter-example if x not 32-bit *)\nlemma val_ReturnXOnZeroShift:\n assumes \"val[x >> (IntVal 32 0)] \\ UndefVal\"\n and \"x = IntVal 32 xv\"\n shows \"val[x >> (IntVal 32 0)] = x\" \n using assms apply (cases x; auto)\n sorry\n\n(* Exp level proofs *)\nlemma exp_ReturnXOnZeroShift:\n assumes \"stamp_expr x = IntegerStamp 32 lo hi\"\n and \"wf_stamp x\"\nshows \"exp[x >> const(IntVal 32 0)] \\ exp[x]\" \n apply auto\n subgoal premises p for m p xa\n proof - \n obtain xa where xa: \"[m,p] \\ x \\ xa\"\n using p(1) by auto\n then have 1: \"intval_right_shift xa (IntVal 32 0) \\ UndefVal\"\n using evalDet p(1) p(2) by blast\n then have 2: \"wf_value (IntVal 32 0)\"\n using p(3) by auto\n then have equals: \"xa = val[xa >> (IntVal 32 0)]\"\n using val_ReturnXOnZeroShift apply (cases xa; auto) \n sorry\n then have 3: \"[m,p] \\ x \\ intval_right_shift xa (IntVal (32::nat) (0::64 word))\"\n by (simp add: xa)\n then show ?thesis\n using evalDet p(1) xa by blast\n qed\n done\n\ntext \\Optimisations\\\n(* Need to prove exp_ReturnXOnZeroShift *)\noptimization ReturnXOnZeroShift: \"(x >> const(new_int 32 0)) \\ x when \n ((stamp_expr x = IntegerStamp 32 lo hi) \\ (wf_stamp x))\"\n using exp_ReturnXOnZeroShift by fastforce\n\nend (* End of RightShiftNode *)\n\nend (* End of file *)", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Optimizations/Canonicalizations/RightShiftPhase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961013, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.25874785484305357}} {"text": "theory inEvenData\n\nimports bundle.SB\n begin\n\ntypedef inEven=\"{cin}\"\n by auto\n\n\ninstantiation inEven::\"{somechan,finite}\"\nbegin\ndefinition \"Rep = Rep_inEven\"\ninstance\n apply(standard)\n apply(auto simp add: Rep_inEven_def cEmpty_def)\n apply(auto simp add: ctype_empty_iff)\n using ctype_empty_iff\n apply (metis Rep_inEven cMsg.simps ex_in_conv insertE insert_iff)\n apply (meson Rep_inEven_inject injI) using cMsg.elims Rep_inEven apply simp\n using type_definition.Abs_image type_definition_inEven typedef_finite_UNIV by fastforce\nend\n\ndefinition \"Evenin \\ Abs_inEven cin\"\n\nfree_constructors inEven for \"Evenin\"\n by (metis(full_types) Abs_inEven_cases singletonD)\n\nlemma Andin1_rep [simp]: \"Rep (Evenin) = cin\"\n using Rep_inEven Rep_inEven_def by auto\n\nfun inEvenChan::\"('bool::type \\ 'a::type) \\ 'bool \\ inEven \\ 'a\" where\n\"inEvenChan Cc1 bool Evenin = Cc1 bool\"\n\nabbreviation \"buildEveninSBE \\ inEvenChan (Untimed o \\)\" \n\nlemma buildevenin_ctype: \"buildEveninSBE a c \\ ctype (Rep c)\"\n sorry\n\nlemma buildevenin_inj: \"inj buildEveninSBE\"\n sorry\n\nlemma buildevenin_range: \"range (\\a. buildEveninSBE a c) = ctype (Rep c)\"\n sorry\n\nlemma buildevenin_surj: assumes \"sbElem_well (Some sbe)\"\n shows \"sbe \\ range buildEveninSBE\"\nproof -\n have ctypewell:\"\\ c. sbe c\\ ctype (Rep c)\"\n using assms by auto\n hence \"\\c. sbe c \\ range (\\a. buildEveninSBE a c)\"\n by (simp add: buildevenin_range)\n hence \"\\prod. sbe = buildEveninSBE prod\"\n apply(subst fun_eq_iff,auto)\n sorry\n thus ?thesis\n by auto\nqed\n\nabbreviation \"buildEveninSB \\ inEvenChan (Rep_cfun (smap ((Untimed o \\))))\" \n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/evenA/inEvenData.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.25874784814994234}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: SyntaxTest.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n(*<*)\n\ntheory SyntaxTest imports HeapList VcgCon begin\n\n\nrecord Example1 =\n A :: \"nat list\"\n B :: \"nat\"\n\nlemma \"\\ (length \\A = length \\A) \\ (\\A ! i = \\A ! i) \\ = \n {x. (length (A (fst x)) = length (A (snd x))) \\ \n ((A (fst x))!i = (A (snd x))!i) }\"\nby auto\n\nrecord \"globals\" =\n alloc_' :: \"ref list\"\n free_':: nat\n GA_' :: \"ref list list\"\n next_' :: \"ref \\ ref\"\n cont_' :: \"ref \\ nat\"\n\nrecord localsd = \n n1_' :: \"nat\"\n n2_' :: \"ref \\ nat\"\n\nrecord ('g,'a) vars = \"'g state\" +\n A_' :: \"nat list\"\n AA_' :: \"nat list list\"\n I_' :: nat\n M_' :: nat\n N_' :: nat\n R_' :: int\n R1_' :: \"'a list\"\n S_' :: int\n B_' :: bool\n Abr_':: string\n p_' :: ref\n q_' :: ref\n d_' :: nat\n\nrecord ('g,'a) vars1 = \"'g state\" +\n A_' :: \"nat list\"\n AA_' :: \"nat list list\"\n I_' :: nat\n M_' :: nat\n N_' :: nat\n R_' :: int\n R1_' :: \"'a list\"\n S_' :: int\n B_' :: bool\n Abr_':: string\n p_' :: ref\n q_' :: ref\n d_' :: nat\n\nlemma \"{..<3::nat} = {} \\ False\"\nby (simp add: Iio_eq_empty_iff_nat)\n\n\nlemma Example1:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> (COBEGIN\n SCHEME [0 \\ i < n]\n (SKIP,\n \\\\M = 0\\,\n \\(\\M = \\M)\\\\<^sub>r ,\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))},\n \\ True \\,\n \\ True \\)\n COEND)\n SAT [\\\\M = 0\\, {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))},\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))}, \\ True \\, \\ True \\]\"\napply (rule Parallel)\napply (auto simp add:Pre_def Rely_def Com_def Guar_def Post_def Abr_def)\napply (auto intro!: Conseq)\napply(rule_tac x=\"\\\\M = 0\\\" in exI)\napply simp\napply(rule_tac x=\"{(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))}\" in exI)\napply simp\napply(rule_tac x=\"{(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))}\" in exI)\napply simp\napply(rule_tac x=\"\\\\M = 0\\\" in exI)\napply (subgoal_tac \"lrghoare \\ {} {} SKIP \\\\M = 0\\\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))}\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ (M_' x1= M_' y1))} \\\\M = 0\\ \\\\M = 0\\\")\nprefer 2\nby (auto simp add: Norm_def Sta_def intro!:Skip)\n\nthm Conseq LocalRG_HoareDef.Conseq\nlemma Example2:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> (COBEGIN\n SCHEME [0 \\ i < n]\n (SKIP,\n \\\\M = 0\\,\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)},\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)},\n \\ True \\,\n \\ True \\)\n COEND)\n SAT [\\\\M = 0\\, {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)},\n {(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)}, \\ True \\, \\ True \\]\"\napply (rule Parallel)\napply (auto simp add:Pre_def Rely_def Com_def Guar_def Post_def Abr_def)\napply (auto intro!: Conseq)\napply(rule_tac x=\"\\\\M = 0\\\" in exI)\napply simp\napply(rule_tac x=\"{(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)}\" in exI)\napply simp\napply(rule_tac x=\"{(x,y). (\\x1 y1. x=Normal x1 \\ y=Normal y1 \\ x=y)}\" in exI)\napply simp\napply(rule_tac x=\"\\\\M = 0\\\" in exI)\napply (subgoal_tac \"lrghoare \\ {} {} SKIP \\\\M = 0\\\n {(x, y). (\\x1. x = Normal x1) \\ (\\y1. y = Normal y1) \\ x = y}\n {(x, y). (\\x1. x = Normal x1) \\ (\\y1. y = Normal y1) \\ x = y} \\\\M = 0\\ \\\\M = 0\\\")\nprefer 2\napply (rule Skip)\napply (simp add: Sta_def)\napply (simp add: Norm_def)\napply (simp add: Norm_def)\nby auto\n\n\nlemma Example3:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> (COBEGIN\n SCHEME [0 \\ i < n]\n (SKIP,\n \\ True \\,\n \\True \\,\n \\ True \\,\n \\ True \\,\n \\ True \\)\n COEND)\n SAT [\\ True \\, \\ True \\, \\ True \\, \\ True \\, \\ True \\]\"\napply (auto simp add: Parallel)\napply (rule Parallel)\napply (auto simp add:Pre_def Rely_def Com_def Guar_def Post_def Abr_def)\napply (rule Skip)\napply (auto intro!: Skip simp:Sta_def Norm_def)[1]\nsorry\n\n\n\n(*lemma Example1:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> (COBEGIN\n SCHEME [0 \\ i < n]\n (\\A :== \\A [i := 0],\n \\ n < length \\A \\,\n \\ length \\A = length \\A \\ \\A ! i = \\A ! i \\,\n \\ length \\A = length \\A \\ (\\j j \\ \\A ! j = \\A ! j) \\,\n \\ \\A ! i = 0 \\)\n COEND)\n sat [\\ n < length \\A \\, \\ \\A = \\A \\, \\ True \\, \\ \\i < n. \\A ! i = 0 \\, \\ \\i < n. \\A ! i = 0 \\]\"\n*)\n\n\n\n\nhoarestate h = PA :: nat\n\nhoarestate h1 = h + KA::nat\n v::ref\n q_' :: ref\n free_':: nat\n d_'::nat\n \n\n\nprocedures (imports h1) Foo (q,d|d) = \"\\q :== \\q;;\\free:==0;;\\d:==0\"\n\ncontext Foo_impl\nbegin\nthm Foo_impl\nthm Foo_body_def\nend\ncontext h1\nbegin\nterm \"\\KA :== 3 -1 ;; \\PA:==1\"\nend\n\nterm \"\\n1 :==\\<^sub>g 3 - 1\"\nterm \"\\I :==\\<^sub>g \\free\"\nterm \"\\R :==\\<^sub>g 3 - 1\"\nterm \"\\I :==\\<^sub>g \\A!i\"\nterm \" \\A!i :== j\"\nterm \" \\AA :== \\AA!![i,j]\"\nterm \" \\AA!![i,j] :== \\AA\"\nterm \"\\A!i :==\\<^sub>g j\"\nterm \"\\p :==\\<^sub>g \\GA!i!j\"\nterm \"\\p :==\\<^sub>g \\GA!i!j\"\nterm \"\\GA!i!j :==\\<^sub>g \\p\"\nterm \"\\p :==\\<^sub>g \\p \\ \\next\"\nterm \"\\p \\ \\next :==\\<^sub>g \\p\"\nterm \"\\p \\ \\next \\ \\next :==\\<^sub>g \\p\"\nterm \"\\p :== NEW sz [\\next :== Null,\\cont :== 0]\"\nterm \"\\p\\\\next :==\\<^sub>g NEW sz [\\next :== Null,\\cont :== 0]\"\nterm \"\\p :== NNEW sz [\\next :== Null,\\cont :== 0]\"\nterm \"\\p\\\\next :==\\<^sub>g NNEW sz [\\next :== Null,\\cont :== 0]\"\nterm \"\\B :==\\<^sub>g \\N + 1 < 0 \\ \\M + \\N < n\"\nterm \"\\B :==\\<^sub>g \\N + 1 < 0 \\ \\M + \\N < n\"\nterm \"\\I :==\\<^sub>g \\N mod n\"\nterm \"\\I :==\\<^sub>g \\N div n\"\nterm \"\\R :==\\<^sub>g \\R div n\"\nterm \"\\R :==\\<^sub>g \\R mod n\"\nterm \"\\R :==\\<^sub>g \\R * n\"\nterm \"\\I :==\\<^sub>g \\I - \\N\"\nterm \"\\R :==\\<^sub>g \\R - \\S\"\nterm \"\\R :==\\<^sub>g int \\I\"\nterm \"\\I :==\\<^sub>g nat \\R\"\nterm \"\\R :==\\<^sub>g -\\R\"\nterm \"IF\\<^sub>g \\A!i < \\N THEN c1 ELSE c2 FI\"\nterm \"AWAIT\\<^sub>g \\A!i < \\N (IF True THEN SKIP ELSE SKIP FI)\"\nterm \"WHILE\\<^sub>g \\A!i < \\N DO c OD\"\nterm \"WHILE\\<^sub>g \\A!i < \\N INV \\foo\\ DO c OD\"\nterm \"WHILE\\<^sub>g \\A!i < \\N INV \\foo\\ VAR bar x DO c OD\"\nterm \"WHILE\\<^sub>g \\A!i < \\N INV \\foo\\ VAR bar x DO c OD;;cd\"\nterm \"c;;WHILE\\<^sub>g \\A!i < \\N INV \\foo\\ VAR MEASURE \\N + \\M DO c;;c OD;;c\"\ncontext Foo_impl\nbegin\nterm \"\\q :== CALL Foo(\\p,\\M)\" \nterm \"\\q :== CALL\\<^sub>g Foo(\\p,\\M + 1)\" \nterm \"\\q :== CALL Foo(\\p\\\\next,\\M)\" \nterm \"\\q \\ \\next :== CALL Foo(\\p,\\M)\" \nterm \"COBEGIN (\\q :== CALL Foo(\\p\\\\next,\\M)) \\ (\\q :== CALL Foo(\\p\\\\next,\\M)) COEND\"\nend\n\nend\n\n(*>*) ", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/SyntaxTest.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.25871760111903436}} {"text": "(*<*)\ntheory Preliminaries\nimports Abbrevs\nbegin\n\n\nrecord foorecord = fld\\<^sub>1 :: nat fld\\<^sub>2 ::nat\ndatatype foodatatype = Foo\nnotation (latex output)\nFoo (\"\\<^latex>\\\\\\constructor{Foo}\\\")\n\n(* TODO:\nsetup {*add_constructor_syntax \"latex\" \"Preliminaries.foodatatype\" *}\n*)\n(*>*)\nsection \\Preliminaries \\label{sec:preliminaries}\\\ntext \\\nThe formalization presented in this papaer is mechanized and checked within the generic interactive theorem prover \\emph{Isabelle}\\cite{Paulson:IGTP94}. \nIsabelle is called generic as it provides a framework to formalize various \\emph{object logics} declared via natural deduction style inference rules.\nThe object logic that we employ for our formalization is the higher order logic of \\emph{Isabelle/HOL}\\cite{Nipkow:IHOL02}. \n\nThis article is written using Isabelle's document generation facilities, which guarantees a close correspondence between the presentation and the actual theory files.\nWe distinguish formal entities typographically from other text. \nWe use a sans serif font for types and constants (including functions and predicates), \\eg @{term \"map\"}, a slanted serif font for free variables, \\eg @{term \"x\"}, and a slanted sans serif font for bound variables, \\eg @{term \"Bind x. x\"}.\nSmall capitals are used for data type constructors, \\eg @{term[names_short] \"Foo\"}, and type variables have a leading tick, \\eg @{typ \"'a\"}. HOL keywords are typeset in type-writer font, \\eg \\holkeyword{let}. %We also take the freedom to borrow C notation, \\eg @{term \"UnsgndT\"} when presenting C0.\n\nTo group common premises and to support modular reasoning Isabelle provides \\emph{locales}\\cite{Ballarin:TYPES03-34,Ballarin:MKM06-31}. \nA locale provides a name for a context of fixed parameters and premises, together with an elaborate infrastructure to define new locales by inheriting and extending other locales, prove theorems within locales and interpret (instantiate) locales. In our formalization we employ this infrastructure to separate the memory system from the programming language semantics. \n\nThe logical and mathematical notions follow the standard notational conventions with a bias towards functional programming. \nWe only present the more unconventional parts here. \nWe prefer curried function application, \\eg @{term \"f a b\"} instead of @{term [mode=uncurry] \"f a b\"}.\nIn this setting the latter becomes a function application to \\emph{one} argument, which happens to be a pair.\n\nIsabelle/HOL provides a library of standard types like Booleans, natural numbers, integers, total functions, pairs, lists, and sets. Moreover, there are packages to define new data types and records. \nIsabelle allows polymorphic types, \\eg @{typ \"'a list\"} is the list type with type variable @{typ \"'a\"}. \nIn HOL all functions are total, \\eg @{typ \"nat \\ nat\"} is a total function on natural numbers. \nA function update is @{thm fun_upd_def[of f y v]}.\nTo formalize partial functions the type @{typ \"'a option\"} is used. \nIt is a data type with two constructors, one to inject values of the base type, \\eg @{term \"Some x\"}, and the additional element @{term \"None\"}. \nA base value can be projected with the function @{term \"the\"}, which is defined by the sole equation @{thm option.sel [of x]}. \nSince HOL is a total logic the term @{term \"the None\"} is still a well-defined yet un(der)specified value. \nPartial functions are usually represented by the type \\\\<^latex>\\\\tfreeify{\\'a\\<^latex>\\}\\ \\ \\<^latex>\\\\tfreeify{\\'b\\<^latex>\\}\\ option\\, abbreviated as @{typ \"'a \\ 'b\"}. \nThey are commonly used as \\emph{maps}. \n%With @{term \"map_of xs\"} we construct a map from an association list, \\ie a list of key~/~value pairs. \nWe denote the domain of map @{term \"m\"} by @{term \"dom m\"}. % not used: and to its range by @{term \"ran m\"}. \nA map update is written as @{term \"m(a := Some v)\"}.\n%With @{term \"m\\<^sub>1 ++ m\\<^sub>2\"} we add the map @{term \"m\\<^sub>2\"} to map @{term \"m\\<^sub>1\"}, where entries of @{term \"m\\<^sub>1\"} are overwritten if necessary. \nWe can restrict the domain of a map @{term \"m\"} to a set @{term \"A\"} by @{term \"m |` A\"}. \n%Subsumption of maps is defined as @{thm \"map_le_def\" [of m\\<^sub>1 m\\<^sub>2]} and composition of maps as @{thm \"map_comp_def\" [of m\\<^sub>1 m\\<^sub>2]}.\n\n%\\paragraph{Lists.}\nThe syntax and the operations for lists are similar to functional programming languages like ML or Haskell. \nThe empty list is @{term \"[]\"}, with @{term \"x#xs\"} the element @{term \"x\"} is `consed' to the list @{term \"xs\"}.%, the head of list @{term \"xs\"} is @{term \"hd xs\"} and the remainder, its tail, is @{term \"tl xs\"}. \nWith @{term \"xs@ys\"} list @{term \"ys\"} is appended to list @{term \"xs\"}.\nWith the term @{term \"map f xs\"} the function @{term \"f\"} is applied to all elements in @{term \"xs\"}. \nThe length of a list is @{term \"length xs\"}, the @{term n}-th element of a list can be selected with @{term \"xs!n\"} and can be updated via @{term \"xs[n:=v]\"}. With @{term \"dropWhile P xs\"} the prefix for which all elements satisfy predicate @{term \"P\"} are dropped from list @{term \"xs\"}.\n%With @{term \"set xs\"} we obtain the set of elements in list @{term \"xs\"}.\n%Filtering those elements from a list for which predicate @{term \"P\"} holds is achieved by @{term [eta_contract=false] \"[x\\xs. P x]\"}.\n%With @{term \"replicate n e\"} we denote a list that consists of @{term n} elements @{term e}.\n\n%\\paragraph{Sets.}\nSets come along with the standard operations like union, \\ie @{term \"A \\ B\"}, membership, \\ie @{term \"x \\ A\"} and set inversion, \\ie @{term \"- A\"}.\n\n%intersection, \\ie @{term \"A \\ B\"} and \n%The set image @{term \"f ` A\"} yields a new set by applying function @{term \"f\"} to every element in set @{term \"A\"}.\n\n\n\n\n%\\paragraph{Records.}\n%A record is constructed by assigning all of its fields, \\eg @{term \"\\fld\\<^sub>1 = v\\<^sub>1, fld\\<^sub>2 = v\\<^sub>2\\\"}.\n%Field @{term [names_short]\"fld\\<^sub>1\"} of record @{term \"r\"} is selected by @{term[names_short] \"fld\\<^sub>1 r\"} and updated with a value @{term \"x\"} via @{term[names_short] \"r\\fld\\<^sub>1 := x\\\"}. \n\n%\\paragraph{Tuples.}\n%The first and second component of a pair can be accessed with the functions @{const fst} and @{const snd}. \nTuples with more than two components are pairs nested to the right.\n\n\\\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Store_Buffer_Reduction/Preliminaries.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.25871759406963407}} {"text": "theory MoreCurrAutomation\nimports DataRefinementMore\nbegin\n\n\nthm T_g_specifies_I\n\ndefinition (in -) mm3 where\n \"mm3 t A = (case A of None \\ None | Some t' \\ if t'\\t then Some (t-t') else None)\"\n\n\nlemma Some_le_mm3_Some_conv: \"Some t \\ mm3 t' (Some t'') \\ (t'' \\ t' \\ t \\ (t' - t''))\"\n by (simp add: mm3_def)\n \n\nlemma Some_le_emb'_conv: \"Some t \\ emb' Q ft x \\ Q x \\ t \\ ft x\"\n by (auto simp: emb'_def)\n\n\nlemma Some_eq_emb'_conv: \"Some t = emb' Q ft x \\ Q x \\ t = ft x\"\n \"emb' Q ft x = Some t \\ Q x \\ t = ft x\"\n by (auto simp: emb'_def)\n\ndefinition whileIET :: \"('a \\ bool) \\ ('a \\ 'c) \\ ('a \\ bool)\n \\ ('a \\ ('a,'c::{complete_lattice,plus,zero}) nrest)\n \\ 'a \\ ('a,'c) nrest\" where\n \"\\E c. whileIET I E b c = whileT b c\"\n\n\n\nsubsection \\Progress prover\\\n\n\ndefinition \"progress m \\ \\s' M. m = SPECT M \\ M s' \\ None \\ M s' > Some 0\"\nlemma progressD: \"progress m \\ m=SPECT M \\ M s' \\ None \\ M s' > Some 0\"\n by (auto simp: progress_def)\n\n\nsubsection \\Progress rules\\\n\nnamed_theorems progress_rules\n\nlemma progress_SELECT_iff: \"progress (SELECT P t) \\ t > 0\"\n unfolding progress_def SELECT_def emb'_def by (auto split: option.splits)\n\nlemmas [progress_rules] = progress_SELECT_iff[THEN iffD2]\n\nlemma progress_REST_iff: \"progress (REST [x \\ t]) \\ t>0\"\n by (auto simp: progress_def)\n\nlemmas [progress_rules] = progress_REST_iff[THEN iffD2]\n\nlemma progress_ASSERT_bind[progress_rules]: \"\\\\ \\ progress (f ()) \\ \\ progress (ASSERT \\\\f)\"\n apply (cases \\)\n apply (auto simp: progress_def less_fun_def)\n sorry\n\n\nlemma progress_SPECT_emb[progress_rules]: \"t > 0 \\ progress (SPECT (emb P t))\" by(auto simp: progress_def emb'_def)\n\n\nlemma Sup_Some: \"Sup (S::enat option set) = Some e \\ \\x\\S. (\\i. x = Some i)\"\n unfolding Sup_option_def by (auto split: if_splits)\n\nlemma progress_bind[progress_rules]: assumes \"progress m \\ (\\x. progress (f x))\"\n shows \"progress (m\\f)\"\n sorry\n\nmethod progress methods solver = \n (rule asm_rl[of \"progress _\"] , (simp add: le_fun_def less_fun_def split: prod.splits | intro allI impI conjI | determ \\rule progress_rules\\ | rule disjI1; progress \\solver\\; fail | rule disjI2; progress \\solver\\; fail | solver)+) []\n\n\nsubsection \\VCG splitter\\\n\n\n\nML \\\n\n structure VCG_Case_Splitter = struct\n fun dest_case ctxt t =\n case strip_comb t of\n (Const (case_comb, _), args) =>\n (case Ctr_Sugar.ctr_sugar_of_case ctxt case_comb of\n NONE => NONE\n | SOME {case_thms, ...} =>\n let\n val lhs = Thm.prop_of (hd (case_thms))\n |> HOLogic.dest_Trueprop |> HOLogic.dest_eq |> fst;\n val arity = length (snd (strip_comb lhs));\n (*val conv = funpow (length args - arity) Conv.fun_conv\n (Conv.rewrs_conv (map mk_meta_eq case_thms));*)\n in\n SOME (nth args (arity - 1), case_thms)\n end)\n | _ => NONE;\n \n fun rewrite_with_asm_tac ctxt k =\n Subgoal.FOCUS (fn {context = ctxt', prems, ...} =>\n Local_Defs.unfold0_tac ctxt' [nth prems k]) ctxt;\n \n fun split_term_tac ctxt case_term = (\n case dest_case ctxt case_term of\n NONE => no_tac\n | SOME (arg,case_thms) => let \n val stac = asm_full_simp_tac (put_simpset HOL_basic_ss ctxt addsimps case_thms) \n in \n (*CHANGED o stac\n ORELSE'*)\n (\n Induct.cases_tac ctxt false [[SOME arg]] NONE []\n THEN_ALL_NEW stac\n ) \n end 1\n \n \n )\n\n fun split_tac ctxt = Subgoal.FOCUS_PARAMS (fn {context = ctxt, ...} => ALLGOALS (\n SUBGOAL (fn (t, _) => case Logic.strip_imp_concl t of\n @{mpat \"Trueprop (Some _ \\ T_g _ ?prog)\"} => split_term_tac ctxt prog\n | @{mpat \"Trueprop (progress ?prog)\"} => split_term_tac ctxt prog \n (* | @{mpat \"Trueprop (Case_Labeling.CTXT _ _ _ (valid _ _ ?prog))\"} => split_term_tac ctxt prog *)\n | _ => no_tac\n ))\n ) ctxt \n THEN_ALL_NEW TRY o Hypsubst.hyp_subst_tac ctxt\n\n end\n\\\n\nmethod_setup vcg_split_case = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (CHANGED o (VCG_Case_Splitter.split_tac ctxt)))\\\n\n\nnamed_theorems vcg_rules' \nmethod vcg'_step methods solver uses rules =\n (intro rules vcg_rules' | vcg_split_case \n | (progress simp;fail) | (solver; fail))\n\nmethod vcg' methods solver uses rules = repeat_all_new \\vcg'_step solver rules: rules\\\n\n\n\nlemma T_g_SPECT2_I[vcg_rules']: \n fixes t' :: \"'b\\enat\" (* \"'b:: {complete_lattice,minus,plus,ord}\" *)\n assumes \"(\\ x. X x \\ (Some (t' + t x ) \\ Q x))\"\n shows \"Some t' \\ T_g Q (SPECT (emb' X t))\"\n apply(auto simp: T_g_def)\n apply(rule Inf_greatest) apply auto\n unfolding mii_g_def mm_g_def emb'_def apply (auto split: option.splits)\n subgoal using assms by force\n subgoal for x tx using assms[of x] apply simp \n by (simp add: enat_adjoint le_fun_def) \n subgoal for x tx using assms[of x] apply simp \n by (metis ab_semigroup_add_class.add_ac(1) add.commute le_iff_add) \n done\n\n\nlemma T_g_bindT_I[vcg_rules']: \n \"\\t. Some t \\ T_g (\\y. T_g Q (f y) ) M \\ Some t \\ T_g Q (M \\ f)\"\n sorry\n\n\nlemma T_g_SPECT_I[vcg_rules']: \"\\t. (Some (t' + t ) \\ Q x)\n \\ Some t' \\ T_g Q (SPECT [ x \\ t])\"\n sorry\n\nlemma (in -) While[vcg_rules']:\n fixes I and E :: \"'a \\ 'c::{complete_lattice,minus,zero,order,plus}\" and b C s0\n assumes \"I s0\" \"(\\s. I s \\ b s \\ Some 0 \\ T_g (\\s'. mm3 (E s) (if I s' then Some (E s') else None)) (C s)) \"\n \"(\\s. progress (C s))\"\n \"(\\x. \\ b x \\ I x \\ (E x) \\ (E s0) \\ Some (t + ((E s0) - E x)) \\ Q x)\"\n shows \"Some t \\ T_g Q (whileIET I E b C s0)\"\n sorry\n\nlemma (in -) if_T_g[vcg_rules']: \"(b \\ t \\ T_g Q Ma) \\ (\\b \\ t \\ T_g Q Mb) \\ t \\ T_g Q (if b then Ma else Mb)\"\n by (simp add: split_def)\n\n\nlemma (in -) T_g_ASSERT_I[vcg_rules']: \"(\\ \\ Some t \\ Q ()) \\ \\ \\ Some t \\ T_g Q (ASSERT \\)\"\n sorry\n\n\nlemma (in -) T_SELECT[vcg_rules']: \n assumes \n \"\\x. \\ P x \\ Some tt \\ T_g Q (SPECT [None \\ tf])\"\n and p: \"(\\x. P x \\ Some tt \\ T_g Q (SPECT [Some x \\ tf]) )\"\nshows \"Some tt \\ T_g Q (SELECT P tf)\"\n sorry\n\nlemma (in-) RETURNT_T_I[vcg_rules']: \"t \\ Q x \\ t \\ T_g Q (RETURNT x)\"\n sorry \n\n\nsubsection \\Monotonicity rules for refine_vcg proofs\\\n\n\nlemma RECT_mono[refine_mono]:\n assumes [simp]: \"mono2 B'\"\n assumes LE: \"\\F x. (B' F x) \\ timerefine FF (B F x) \"\n shows \" (RECT B' x) \\ timerefine FF (RECT B x)\"\n unfolding RECT_def\n apply clarsimp \n using LE gfp_mono le_fun_def sorry \n\n\nlemma WHILET_refine:\n assumes R0: \"(x,x')\\R\"\n assumes COND_REF: \"\\x x'. \\ (x,x')\\R \\ \\ b x = b' x'\"\n assumes STEP_REF: \n \"\\x x'. \\ (x,x')\\R; b x; b' x' \\ \\ f x \\ \\R (timerefine F (f' x'))\"\n shows \"whileT b f x \\ \\R (timerefine F (whileT b' f' x'))\"\n sorry\n\nlemma (in -) whileT_mono: \n assumes \"\\x. b x \\ c x \\ timerefine F (c' x)\"\n shows \" (whileT b c x) \\ timerefine F (whileT b c' x)\" (*\n unfolding whileT_def apply(rule RECT_mono)\n subgoal by(refine_mono) \n apply auto apply(rule bindT_mono) using assms by auto *) sorry\n\n\nthm bindT_refine'\n\nlemma bindT_refine_g:\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' (timerefine F M')\"\n assumes R2: \"\\x x' t t'. \\ (x,x')\\R'; \n nofailT M; nofailT M'; inresT2 M x t; inresT2 M' x' t';\n t \\ (\\c. Sum_any (\\a. t' a * F a c)) \n \\ \\ f x \\ \\ R (timerefine F (f' x'))\"\n shows \"bindT M (\\x. f x) \\ \\ R (timerefine F (bindT M' (\\x'. f' x')))\"\n sorry\n\nlemma bindT_refine_g':\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' (timerefine F M')\"\n assumes R2: \"\\x x' t t'. \\ (x,x')\\R'; \n nofailT M; nofailT M'; inresT2 M x t; inresT2 M' x' t';\n t \\ (\\c. Sum_any (\\a. t' a * F a c)) \n \\ \\ f x \\ (timerefine F (f' x'))\"\n shows \"bindT M (\\x. f x) \\ (timerefine F (bindT M' (\\x'. f' x')))\"\n sorry\n\nlemma timerefine_ASSERT: \"(\\' \\ \\) \\ ASSERT \\ \\ timerefine F (ASSERT \\')\"\n by (auto simp: timerefine_def ASSERT_def iASSERT_def RETURNT_def le_fun_def)\n\n\nlemma assumes \"(\\s t. P s = Some t \\ \\s'. Some t \\ Q s' \\ (s, s') \\ R)\"\n shows SPECT_refine: \"SPECT P \\ \\ R (SPECT Q)\"\n sorry\n\nlemma timerefine_SPECT:\n assumes \"\\x. P' x = None \\ P x = None\"\n and \"\\x x2. P' x = Some x2 \\ P x \\ Some (\\cc. Sum_any (\\ac. x2 ac * F ac cc))\"\nshows \"SPECT P \\ timerefine F (SPECT P')\"\n unfolding timerefine_def\n apply (auto split: option.splits simp: le_fun_def)\n using assms by auto\n\nlemma timerefine_RETURNT:\n assumes \"x=x'\"\nshows \"RETURNT x \\ timerefine F (RETURNT x')\"\n unfolding RETURNT_def \n using assms by (auto intro!: timerefine_SPECT simp: le_fun_def) \n\n\nthm SELECT_refine\nlemma SELECT_refine_g:\n fixes T \n assumes \"\\x'. P' x' \\ \\x. P x\"\n assumes \"\\x. P x \\ P' x\"\n assumes \"T \\ (\\cc. Sum_any (\\ac. T' ac * F ac cc))\"\n shows \"SELECT P T \\ timerefine F (SELECT P' T')\"\n unfolding SELECT_def\n apply (auto split: if_splits)\n using assms \n by (auto intro!: timerefine_SPECT simp: emb'_def split: if_splits option.splits)\n (*\nproof -\n have \"SELECT P T \\ SELECT P T'\"\n using s1 assms(3) by auto\n also have \"\\ \\ SELECT P' T'\"\n unfolding s2 apply safe\n using assms(1,2) by auto \n finally show ?thesis .\nqed *)\n\n\n\nlemma If_refine: \"b = b' \\\n (b \\ b' \\ S1 \\ \\ R (timerefine F S1')) \\\n (\\ b \\ \\ b' \\ S2 \\ \\ R (timerefine F S2')) \\ (if b then S1 else S2) \\ \\ R (timerefine F (if b' then S1' else S2'))\"\n by auto\n\nlemma Case_prod_refine: \"(x,x')\\ \\S1,S2\\prod_rel \\\n (\\x x' y y'. (x,x')\\S1 \\ (y,y')\\S2 \\ C x y \\ \\ R (timerefine F (C' x' y')))\n \\ (case x of (a,b) \\ C a b) \\ \\ R (timerefine F (case x' of (a',b') \\ C' a' b'))\"\n by (auto split: prod.split)\n\nlemma case_prod_refine_g2:\n fixes P Q :: \"'a \\ 'b \\ ('c,_) nrest\"\n assumes\n \"\\a b. P a b \\ \\R (timerefine FF (Q a b))\"\n shows\n \"(case x of (a,b) \\ P a b) \\ \\R (timerefine FF (case x of (a,b) \\ Q a b))\"\n using assms \n by (simp add: split_def)\n\nlemma case_prod_refine_g:\n fixes P Q :: \"'a \\ 'b \\ ('c,_) nrest\"\n assumes\n \"\\a b. P a b \\ timerefine FF (Q a b)\"\n shows\n \"(case x of (a,b) \\ P a b) \\ timerefine FF (case x of (a,b) \\ Q a b)\"\n using assms \n by (simp add: split_def)\n\nlemma bindT_mono_g: \n \"m \\ timerefine FF m' \\ (\\x. nofailT m' \\ f x \\ timerefine FF (f' x))\n \\ bindT m f \\ timerefine FF (bindT m' f')\"\n sorry\n\n\nlemma le_ASSERTI_g2:\n fixes M :: \"(_,_) nrest\"\n shows \"(\\ \\ M \\ \\ R ( timerefine FF M' )) \\ M \\ \\ R (timerefine FF (ASSERT \\ \\ (\\_. M')))\"\n sorry\n\nlemma le_ASSERTI_g:\n fixes M :: \"(_,_) nrest\"\n shows \"(\\ \\ M \\ timerefine FF M') \\ M \\ timerefine FF (ASSERT \\ \\ (\\_. M'))\"\n sorry\n\n\nlemma ASSERT_leI2: \n fixes M :: \"(_,_) nrest\"\n shows \"\\ \\ (\\ \\ M \\ \\ R( timerefine FF M')) \\ASSERT \\ \\ (\\_. M) \\ \\ R (timerefine FF M')\"\n sorry\n\nlemma ASSERT_leI: \n fixes M :: \"(_,_) nrest\"\n shows \"\\ \\ (\\ \\ M \\ timerefine FF M') \\ ASSERT \\ \\ (\\_. M) \\ timerefine FF M'\"\n sorry\n\nthm case_option_mono\nlemma case_option_mono_g:\n assumes \"fn \\ timerefine FF fn'\"\n assumes \"\\v. x=Some v \\ fs v \\ timerefine FF (fs' v)\"\n shows \"case_option fn fs x \\ timerefine FF (case_option fn' fs' x)\"\n using assms by (auto split: option.split)\n\n\nlemma case_prod_mono_g: \n \"\\\\a b. p=(a,b) \\ f a b \\ timerefine FF (f' a b)\\ \\ case_prod f p \\ timerefine FF (case_prod f' p)\"\n by (auto split: prod.split)\n\n\nlemma nofailT_ASSERT_bind_g:\n fixes M :: \"(_,_) nrest\"\n shows \"nofailT (ASSERT P \\ (\\_. M)) \\ (P \\ nofailT M)\"\n sorry\n\n\nlemma inresT2_REST:\n \"\\t. inresT2 (REST X) x t \\ (\\t'\\enat o t. X x = Some t')\" \n unfolding inresT2_def \n by auto\n\nlemma inresT2_SPEC[refine_pw_simps]: \"inresT2 (SPEC a b) = (\\x t. a x \\ b x \\ t)\"\n unfolding SPEC_def inresT2_REST\n apply(rule ext)\n by(auto simp: le_fun_def split: if_splits)\n\n\n\nlemma inresT2_SELECT:\n \"inresT2 (SELECT Q tt) x t'\n \\ ((case x of None \\ \\(\\x. Q x) | Some x \\ Q x) \\ (t' \\ tt))\"\n by(auto simp: inresT2_def SELECT_def le_fun_def emb'_def) \n\nlemma pw_inresT2_bindT: \"\\t. inresT2 (bindT m f) r t \\\n (nofailT m \\ (\\r' t' t''. inresT2 m r' t' \\ inresT2 (f r') r t'' \\ t = t' + t''))\"\n sorry\n\n\n\n \n\n\nlemma if_distrib2: \"(if b then x else y) * z = (if b then x * z else y * z)\"\n by(simp add: if_distrib)\n\n\nsection \\Trans rules\\\n\nlemma conc_trans_2:\n assumes A: \"C \\ \\R (timerefine F B)\" and B: \"B \\ \\R' (timerefine F' A)\" \n shows \"C \\ \\R (\\R'(timerefine F (timerefine F' A)))\"\n sorry\n\nsection \\enum setup\\\n\n \n\nlemma (in enum) sum_to_foldr: \"sum f UNIV \n = foldr (\\x a. a + f x) enum 0\"\n (*= sum_list (map f enum_class.enum)\" *)\n unfolding UNIV_enum using enum_distinct\n apply(simp add: sum.distinct_set_conv_list )\n apply(simp only: sum_list.eq_foldr foldr_map) \n by (metis add.commute comp_apply) \n\nlemma (in enum) Sum_any_to_foldr: \"Sum_any f \n = foldr (\\x a. a + f x) enum 0\"\n apply(subst Sum_any.expand_superset[where A=UNIV])\n by (simp_all add: sum_to_foldr)\n\n\n\n\ndefinition nfoldli where\n \"nfoldli l c f s = RECT (\\D (l,s). (case l of \n [] \\ RETURNT s \n | x#ls \\ if c s then do { s\\f x s; D (ls, s)} else RETURNT s\n )) (l, s)\"\n\n\ndefinition nfoldliIE :: \"('d list \\ 'd list \\ 'a \\ bool) \\ ('b::{complete_lattice,plus,zero}) \\ 'd list \\ ('a \\ bool) \\ ('d \\ 'a \\ ('a,'b) nrest) \\ 'a \\ ('a,'b) nrest\" where\n \"nfoldliIE I E l c f s = nfoldli l c f s\"\n\n\n\n\nlemma nfoldliIE_rule:\n assumes I0: \"I [] l0 \\0\"\n assumes IS: \"\\x l1 l2 \\. \\ l0=l1@x#l2; I l1 (x#l2) \\; c \\ \\ \\ f x \\ \\ SPECT (emb (I (l1@[x]) l2) (body_time))\"\n assumes FNC: \"\\l1 l2 \\. \\ l0=l1@l2; I l1 l2 \\; \\c \\ \\ \\ P \\\" \n assumes FC: \"\\\\. \\ I l0 [] \\ \\ \\ P \\\" \n assumes T: \"\\x. (body_time x * (enat (length l0))) \\ t x\"\n shows \"nfoldliIE I body_time l0 c f \\0 \\ SPECT (emb P t)\"\n sorry\n\n\n\n\nlemma T_conseq4:\n assumes \n \"T_g Q' f \\ Some t'\"\n \"\\x t'' M. Q' x = Some t'' \\ (Q x) \\ Some ((t - t') + t'')\" \n shows \"T_g Q f \\ Some t\" sorry\n\nlemma T_conseq6:\n assumes \n \"T_g Q f \\ Some t'\"\n \"\\x t'' M. Q x = Some t'' \\ t' \\ t\" \n shows \"T_g Q f \\ Some (t::'a:: {complete_lattice,minus,plus})\" \n oops\n\n\n \n\ndefinition \"monadic_WHILE b f s \\ do {\n RECT (\\D s. do { \n bv \\ b s;\n if bv then do {\n s \\ f s;\n D s\n } else do {RETURNT s}\n }) s\n}\"\ndefinition monadic_WHILEIE where\n \"monadic_WHILEIE I E bm c s = monadic_WHILE bm c s\" \n\nlemma monadic_WHILE_refine2: \n assumes \n \"(x, x') \\ R\"\n \"\\x x'. (x, x') \\ R \\ bm x \\ \\Id (bm' x')\"\n and \"\\x x' t. (x, x') \\ R \\ nofailT (bm' x') \\ inresT2 (bm' x') True t \\ c x \\ \\R (c' x')\"\n shows \"(monadic_WHILE bm c x) \\ \\R (monadic_WHILE bm' c' x')\"\n sorry\n\n\n\nfun Someplus where\n \"Someplus None _ = None\"\n| \"Someplus _ None = None\"\n| \"Someplus (Some a) (Some b) = Some (a+b)\"\n\n\ndefinition mm22 :: \"( ('a\\ enat) option) \\ ( ('a\\ enat) option) \\ ( ('a\\ enat) option)\" where\n \"mm22 r m = (case m of None \\ Some \\\n | Some mt \\\n (case r of None \\ None | Some rt \\ (if mt \\ rt then Some (rt - mt) else None)))\"\n\n\nlemma \n fixes s0 :: 'a and I :: \"'a \\ bool\" and E :: \"'a \\ ('c \\ nat)\" and t :: \"'c \\ enat\"\n assumes\n step: \"(\\s. I s \\ Some 0 \\ T_g (\\b. if b then T_g (\\s'. if I s' \\ E s' \\ E s\n then Some ((\\x. enat (E s x - E s' x))) else None) (c s)\n else mm22 (Q s) (Someplus (Some t) (mm3 (enat o (E s0)) (Some (enat o (E s)))))) (bm s))\"\n and progress: \"\\s. progress (c s)\"\n and i: \"I s0\"\nshows neueWhile_rule': \"Some t \\ T_g Q (monadic_WHILEIE I E bm c s0)\"\n sorry\n\n\ndefinition \"G b d = (if b then Some d else None)\"\ndefinition \"H Qs t Es0 Es = mm22 Qs (Someplus (Some t) (mm3 (Es0) (Some (Es))))\"\n\n\nlemma \n fixes s0 :: 'a and I :: \"'a \\ bool\" and E :: \"'a \\ ('c \\ nat)\" and t :: \"'c \\ enat\"\n assumes\n step: \"(\\s. I s \\ Some 0 \\ T_g (\\b. if b then T_g (\\s'. G (I s' \\ E s' \\ E s) (E s - E s')) (c s)\n else H (Q s) t (E s0) (E s)) (bm s))\"\n and progress: \"\\s. progress (c s)\"\n and i: \"I s0\"\nshows neueWhile_rule'': \"Some t \\ T_g Q (monadic_WHILEIE I E bm c s0)\"\n apply(rule neueWhile_rule') \n unfolding monadic_WHILEIE_def \n subgoal for s using step[of s] apply (simp add: ) unfolding H_def G_def o_def by (auto cong: if_cong)\n using assms by auto \n\n\n\n\ndefinition [to_relAPP]: \"list_set_rel R \\ \\R\\list_rel O br set distinct\"\n\n\n\nlemma le_ASSERTI_f:\n fixes M :: \"(_,_ \\ enat) nrest\"\n shows \"(\\ \\ M \\ M') \\ M \\ ASSERT \\ \\ (\\_. M')\"\n sorry\n\n\n\n\nsection \"some Monadic Refinement Automation\"\n\n\nML \\\nstructure Refine = struct\n\n structure vcg = Named_Thms\n ( val name = @{binding refine_vcg}\n val description = \"Refinement Framework: \" ^ \n \"Verification condition generation rules (intro)\" )\n\n structure vcg_cons = Named_Thms\n ( val name = @{binding refine_vcg_cons}\n val description = \"Refinement Framework: \" ^\n \"Consequence rules tried by VCG\" )\n\n structure refine0 = Named_Thms\n ( val name = @{binding refine0}\n val description = \"Refinement Framework: \" ^\n \"Refinement rules applied first (intro)\" )\n\n structure refine = Named_Thms\n ( val name = @{binding refine}\n val description = \"Refinement Framework: Refinement rules (intro)\" )\n\n structure refine2 = Named_Thms\n ( val name = @{binding refine2}\n val description = \"Refinement Framework: \" ^\n \"Refinement rules 2nd stage (intro)\" )\n\n (* If set to true, the product splitter of refine_rcg is disabled. *)\n val no_prod_split = \n Attrib.setup_config_bool @{binding refine_no_prod_split} (K false);\n\n fun rcg_tac add_thms ctxt = \n let \n val cons_thms = vcg_cons.get ctxt\n val ref_thms = (refine0.get ctxt \n @ add_thms @ refine.get ctxt @ refine2.get ctxt);\n val prod_ss = (Splitter.add_split @{thm prod.split} \n (put_simpset HOL_basic_ss ctxt));\n val prod_simp_tac = \n if Config.get ctxt no_prod_split then \n K no_tac\n else\n (simp_tac prod_ss THEN' \n REPEAT_ALL_NEW (resolve_tac ctxt @{thms impI allI}));\n in\n REPEAT_ALL_NEW_FWD (DETERM o FIRST' [\n resolve_tac ctxt ref_thms,\n resolve_tac ctxt cons_thms THEN' resolve_tac ctxt ref_thms,\n prod_simp_tac\n ])\n end;\n\n fun post_tac ctxt = REPEAT_ALL_NEW_FWD (FIRST' [\n eq_assume_tac,\n (*match_tac ctxt thms,*)\n SOLVED' (Tagged_Solver.solve_tac ctxt)]) \n \n\nend;\n\\\nsetup \\Refine.vcg.setup\\\nsetup \\Refine.vcg_cons.setup\\\nsetup \\Refine.refine0.setup\\\nsetup \\Refine.refine.setup\\\nsetup \\Refine.refine2.setup\\\n(*setup {* Refine.refine_post.setup *}*)\n\nmethod_setup refine_rcg = \n \\Attrib.thms >> (fn add_thms => fn ctxt => SIMPLE_METHOD' (\n Refine.rcg_tac add_thms ctxt THEN_ALL_NEW_FWD (TRY o Refine.post_tac ctxt)\n ))\\ \n \"Refinement framework: Generate refinement conditions\" \n\nmethod_setup refine_vcg = \n \\Attrib.thms >> (fn add_thms => fn ctxt => SIMPLE_METHOD' (\n Refine.rcg_tac (add_thms @ Refine.vcg.get ctxt) ctxt THEN_ALL_NEW_FWD (TRY o Refine.post_tac ctxt)\n ))\\ \n \"Refinement framework: Generate refinement and verification conditions\"\n\n\n\nsubsection \"setup for refine_vcg\"\n \nlemma If_refine_plain[refine]: \"b = b' \\\n (b \\ b' \\ S1 \\ \\ R S1') \\\n (\\ b \\ \\ b' \\ S2 \\ \\ R S2') \\ (if b then S1 else S2) \\ \\ R (if b' then S1' else S2')\"\n by auto\n\nlemma Case_option_refine[refine]: \"(x,x')\\ \\S\\option_rel \\\n (\\y y'. (y,y')\\S \\ S2 y \\ \\ R (S2' y')) \\ S1 \\ \\ R S1'\n \\ (case x of None \\ S1 | Some y \\ S2 y) \\ \\ R (case x' of None \\ S1' | Some y' \\ S2' y')\"\n by(auto split: option.split)\n\nlemma [refine0]: \"\\S. S \\ \\ Id S\" by simp \nlemma refine_plain_ASSERT_bind[refine0]:\n \"\\ \\ (\\ \\ S \\ \\ R S') \\ ASSERT \\ \\ (\\_. S) \\ \\ R S'\"\n sorry\n\n\nlemma le_R_ASSERTI: \"(\\ \\ M \\ \\ R M') \\ M \\ \\ R (ASSERT \\ \\ (\\_. M'))\"\n sorry\n\ndeclare le_R_ASSERTI [refine0]\n\nthm refine0\n\ndeclare bindT_refine [refine]\ndeclare WHILET_refine [refine]\nthm refine\nthm refine2\nthm refine_vcg\n\nlemma [refine_vcg_cons]: \"m \\ SPECT \\ \\ (\\x. \\ x \\ \\ x) \\ m \\ SPECT \\\"\n by (metis dual_order.trans le_funI nres_order_simps(2)) \nthm refine_vcg_cons\n \n\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/moreCurr/MoreCurrAutomation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.258717594069634}} {"text": "(* Title: HOL/Library/Phantom_Type.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\A generic phantom type\\\n\ntheory Phantom_Type\nimports \"MainRLT\"\nbegin\n\ndatatype ('a, 'b) phantom = phantom (of_phantom: 'b)\n\nlemma type_definition_phantom': \"type_definition of_phantom phantom UNIV\"\nby(unfold_locales) simp_all\n\nlemma phantom_comp_of_phantom [simp]: \"phantom \\ of_phantom = id\"\n and of_phantom_comp_phantom [simp]: \"of_phantom \\ phantom = id\"\nby(simp_all add: o_def id_def)\n\nsyntax \"_Phantom\" :: \"type \\ logic\" (\"(1Phantom/(1'(_')))\")\ntranslations\n \"Phantom('t)\" => \"CONST phantom :: _ \\ ('t, _) phantom\"\n\ntyped_print_translation \\\n let\n fun phantom_tr' ctxt (Type (\\<^type_name>\\fun\\, [_, Type (\\<^type_name>\\phantom\\, [T, _])])) ts =\n list_comb\n (Syntax.const \\<^syntax_const>\\_Phantom\\ $ Syntax_Phases.term_of_typ ctxt T, ts)\n | phantom_tr' _ _ _ = raise Match;\n in [(\\<^const_syntax>\\phantom\\, phantom_tr')] end\n\\\n\nlemma of_phantom_inject [simp]:\n \"of_phantom x = of_phantom y \\ x = y\"\nby(cases x y rule: phantom.exhaust[case_product phantom.exhaust]) simp\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/Library/Phantom_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725051, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.25871759406963396}} {"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System *)\n(* File: Interlocking.thy *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK) *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk *)\n(******************************************************************************)\n(* LAST REVIEWED: 22 Sep 2017 *)\n\nsection {* Interlocking FMU Model *}\n\ntheory Interlocking\nimports Vector Topology utp_hoare_ext\nbegin recall_syntax\n\n(* declare One_nat_def [simp del] *)\n\nlemma inv_subst_weakening_lemma:\n\"`I \\ s \\ I` \\ `I \\ P \\ s \\ I`\"\napply (rel_simp)\ndone\n\nsubsection {* Interlocking State *}\n\nalphabet ilock_state =\n cdv :: \"bool vector\"\n tc :: \"bool vector\"\n relays :: \"bool vector\"\n signals :: \"bool vector\"\n switches :: \"switch vector\"\n\ntext \\Convenience syntax for indexed access of @{const cdv}.\\\n\nabbreviation CDV :: \"nat \\ (bool, ilock_state) uexpr\" (\"CDV[_]\") where\n\"CDV[i] \\ &cdv[i]\\<^sub>u\"\n\ntext \\Convenience syntax for indexed access of @{const tc}.\\\n\nabbreviation TC :: \"nat \\ (bool, ilock_state) uexpr\" (\"TC[_]\") where\n\"TC[i] \\ &tc[i]\\<^sub>u\"\n\ntext \\Convenience syntax for accessing elements of @{const relays}.\\\n\nabbreviation \"R1 \\ &relays[1]\\<^sub>u\"\nabbreviation \"R2 \\ &relays[2]\\<^sub>u\"\nabbreviation \"R3 \\ &relays[3]\\<^sub>u\"\nabbreviation \"R4 \\ &relays[4]\\<^sub>u\"\nabbreviation \"R5 \\ &relays[5]\\<^sub>u\"\n\ntext \\Convenience syntax for accessing elements of @{const switches}.\\\n\nabbreviation \"SW1 \\ &switches[1]\\<^sub>u\"\nabbreviation \"SW2 \\ &switches[2]\\<^sub>u\"\nabbreviation \"SW3 \\ &switches[3]\\<^sub>u\"\nabbreviation \"SW4 \\ &switches[4]\\<^sub>u\"\nabbreviation \"SW5 \\ &switches[5]\\<^sub>u\"\n\nsubsection {* Proof Support *}\n\ntext \\Interpretations for the @{type ilock_state} alphabet type.\\\n\ninterpretation ilock_var_interp1:\n lens_interp \"\\r. (cdv\\<^sub>v r, tc\\<^sub>v r, relays\\<^sub>v r, signals\\<^sub>v r, switches\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation ilock_var_interp2:\n lens_interp \"\\(r, r'). (cdv\\<^sub>v r, cdv\\<^sub>v r', tc\\<^sub>v r, tc\\<^sub>v r', relays\\<^sub>v r, relays\\<^sub>v r',\n signals\\<^sub>v r, signals\\<^sub>v r', switches\\<^sub>v r, switches\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nsubsection {* Initial State *}\n\ndefinition init_ilock :: \"ilock_state hrel\" where [urel_defs]:\n\"init_ilock =\n ((cdv, tc, relays, signals, switches) := (\n mk_vector\\<^sub>u 11 true,\n mk_vector\\<^sub>u 4 false,\n mk_vector\\<^sub>u 5 false,\n mk_vector\\<^sub>u 3 false,\n vector_from_list\\<^sub>u [STRAIGHT, DIVERGING, DIVERGING, STRAIGHT, DIVERGING]))\"\n\nsubsection {* Cyclic Behaviour *}\n\ntext \\We break down the cyclic behaviour into four separate operations.\\\n\nsubsubsection {* Relay Setting *}\n\ndefinition set_relays :: \"ilock_state hrel\" where\n[urel_defs]: \"set_relays =\n ((relays[1] := true) \\ TC[4] \\ \\ TC[3] \\ \\ R2 \\ \\ R4 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[5] \\\\<^sub>r II) ;;\n ((relays[2] := true) \\ TC[3] \\ \\ TC[4] \\ \\ R1 \\ \\ R3 \\ \\ R4 \\ \\ R5 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[8] \\ CDV[9] \\ CDV[10] \\ CDV[1] \\\\<^sub>r II) ;;\n ((relays[4] := true) \\ TC[3] \\ \\ TC[4] \\ \\ R1 \\ \\ R2 \\ \\ R3 \\ \\ R5 \\ (*\\ CDV[3] \\*) CDV[4] \\ CDV[8] \\ CDV[9] \\ CDV[11] \\ CDV[2] \\\\<^sub>r II) ;;\n ((relays[3] := true) \\ TC[1] \\ \\ R2 \\ \\ R4 \\ \\ R5 \\ (*\\ CDV[1] \\*) CDV[10] \\ CDV[9] \\ CDV[8] \\ CDV[7] \\ CDV[6] \\\\<^sub>r II) ;;\n ((relays[5] := true) \\ TC[2] \\ \\ R2 \\ \\ R3 \\ \\ R4 \\ (*\\ CDV[2] \\*) CDV[11] \\ CDV[9] \\ CDV[8] \\ CDV[7] \\ CDV[6] \\\\<^sub>r II)\"\n\nsubsubsection {* Relay Clearing *}\n\ndefinition clear_relays :: \"ilock_state hrel\" where\n[urel_defs]: \"clear_relays =\n ((relays[1] := false) \\ R1 \\ \\ CDV[5] \\\\<^sub>r II) ;;\n ((relays[2] := false) \\ R2 \\ \\ CDV[1] \\\\<^sub>r II) ;;\n ((relays[3] := false) \\ R3 \\ \\ CDV[6] \\\\<^sub>r II) ;;\n ((relays[4] := false) \\ R4 \\ \\ CDV[2] \\\\<^sub>r II) ;;\n ((relays[5] := false) \\ R5 \\ \\ CDV[6] \\\\<^sub>r II)\"\n\nsubsubsection {* Switch Setting *}\n\ndefinition set_switches :: \"ilock_state hrel\" where\n[urel_defs]: \"set_switches = (\n (switches[1] := \\STRAIGHT\\) ;;\n ((switches[2] := \\STRAIGHT\\) \\ R3 \\ R5 \\\\<^sub>r (switches[2] := \\DIVERGING\\)) ;;\n ((switches[3] := \\STRAIGHT\\) \\ R1 \\\\<^sub>r (switches[3] := \\DIVERGING\\)) ;;\n (switches[4] := \\STRAIGHT\\) ;;\n ((switches[5] := \\STRAIGHT\\) \\ R2 \\ R3 \\\\<^sub>r (switches[5] := \\DIVERGING\\)))\"\n\nsubsubsection {* Signal Setting *}\n\ndefinition set_signals :: \"ilock_state hrel\" where\n[urel_defs]: \"set_signals = (\n (signals[1] := (R3 \\ SW5 =\\<^sub>u \\STRAIGHT\\ \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\)) ;;\n (signals[2] := (R5 \\ SW5 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\)) ;;\n (signals[3] := ((R1 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\STRAIGHT\\) \\\n (R2 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\STRAIGHT\\) \\\n (R4 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\DIVERGING\\))))\"\n\nsubsubsection {* Complete Cycle *}\n\ndefinition ilock_cycle :: \"ilock_state hrel\" where [urel_defs]:\n\"ilock_cycle = (set_relays ;; clear_relays ;; set_switches ;; set_signals)\"\n\nsubsection {* Invariants *}\n\ntext \\We next prove several invariants of the interlocking model.\\\n\nsubsubsection {* Type Invariant *}\n\ntext \\The type invariant establishes that all vectors have the correct size.\\\n\ndefinition ilock_type_inv :: \"ilock_state upred\" where [urel_defs]:\n\"ilock_type_inv = (\n #\\<^sub>u(&cdv) =\\<^sub>u 11 \\\n #\\<^sub>u(&tc) =\\<^sub>u 4 \\\n #\\<^sub>u(&relays) =\\<^sub>u 5 \\\n #\\<^sub>u(&signals) =\\<^sub>u 3 \\\n #\\<^sub>u(&switches) =\\<^sub>u 5)\"\n\ntext {* Method for proving the interlocking type invariant. *}\n\nlemma ilock_type_inv_rules:\n\"\\ilock_type_inv\\S\\ilock_type_inv\\\\<^sub>u \\\n \\ilock_type_inv \\ P\\S\\ilock_type_inv\\\\<^sub>u\"\n\"`ilock_type_inv \\ s \\ ilock_type_inv` \\\n `ilock_type_inv \\ P \\ s \\ ilock_type_inv`\"\napply (rel_simp)\napply (erule inv_subst_weakening_lemma)\ndone\n\ntext {* The tactic below is a bit quicker than @{method hoare_auto}. *}\n\nmethod ilock_type_inv_tac =\n (hoare_split_inv add: ilock_type_inv_rules; rel_simp)\n\nlemma init_ilock_type_inv:\n\"\\true\\init_ilock\\ilock_type_inv\\\\<^sub>u\"\napply (rel_simp)\ndone\n\nlemma set_relays_type_inv:\n\"\\ilock_type_inv\\set_relays\\ilock_type_inv\\\\<^sub>u\"\n(* unfolding set_relays_def by (hoare_auto) *)\n unfolding set_relays_def by (ilock_type_inv_tac)\n\nlemma clear_relays_type_inv:\n\"\\ilock_type_inv\\clear_relays\\ilock_type_inv\\\\<^sub>u\"\n(* unfolding clear_relays_def by (hoare_auto) *)\n unfolding clear_relays_def by (ilock_type_inv_tac)\n\nlemma set_switches_type_inv:\n\"\\ilock_type_inv\\set_switches\\ilock_type_inv\\\\<^sub>u\"\n(* unfolding set_switches_def by (hoare_auto) *)\n unfolding set_switches_def by (ilock_type_inv_tac)\n\nlemma set_signals_type_inv:\n\"\\ilock_type_inv\\set_signals\\ilock_type_inv\\\\<^sub>u\"\n(* unfolding set_signals_def by (hoare_auto) *)\n unfolding set_signals_def by (ilock_type_inv_tac)\n\nlemma \"\\ilock_type_inv\\ilock_cycle\\ilock_type_inv\\\\<^sub>u\"\napply (unfold ilock_cycle_def)\napply (hoare_split)\napply (rule set_relays_type_inv)\napply (rule clear_relays_type_inv)\napply (rule set_switches_type_inv)\napply (rule set_signals_type_inv)\ndone\n\nsubsubsection {* Relays Invariant *}\n\ntext \\Ensures that at most one relay can be activated at a time.\\\n\ndefinition relays_inv :: \"ilock_state upred\" where [upred_defs]:\n\"relays_inv = (\n (#\\<^sub>u(&relays) =\\<^sub>u 5) \\\n (R1 \\ \\ R2 \\ \\ R4) \\\n (R2 \\ \\ R1 \\ \\ R3 \\ \\ R4 \\ \\ R5) \\\n (R4 \\ \\ R1 \\ \\ R2 \\ \\ R3 \\ \\ R5) \\\n (R3 \\ \\ R2 \\ \\ R4 \\ \\ R5) \\\n (R5 \\ \\ R2 \\ \\ R3 \\ \\ R4))\"\n\nparagraph {* Proof Support *}\n\ndefinition valid_relay_states :: \"(bool vector) set\" where\n\"valid_relay_states =\n vector_from_list ` {\n [OFF, OFF, OFF, OFF, OFF],\n [ON, OFF, OFF, OFF, OFF],\n [ON, OFF, OFF, OFF, ON],\n [ON, OFF, ON, OFF, OFF],\n [OFF, ON, OFF, OFF, OFF],\n [OFF, OFF, ON, OFF, OFF],\n [ON, OFF, ON, OFF, OFF],\n [OFF, OFF, OFF, ON, OFF],\n [OFF, OFF, OFF, OFF, ON],\n [ON, OFF, OFF, OFF, ON]}\"\n\nlemma eq_vector_from_list_5:\n\"size v = 5 \\\n (v = vector_from_list [b1, b2, b3, b4, b5]) =\n (v\\<^bold>[1\\<^bold>] = b1 \\ v\\<^bold>[2\\<^bold>] = b2 \\ v\\<^bold>[3\\<^bold>] = b3 \\ v\\<^bold>[4\\<^bold>] = b4 \\ v\\<^bold>[5\\<^bold>] = b5)\"\napply (subst vector_equality)\napply (clarsimp)\napply (safe; clarsimp)\napply (subgoal_tac \"i \\ {1, 2, 3, 4, 5}\")\napply (safe; clarsimp)\napply (safe; clarsimp)\ndone\n\nlemma relays_inv_cases:\n\"relays_inv = (&relays \\\\<^sub>u \\valid_relay_states\\)\"\napply (unfold relays_inv_def)\napply (rel_simp)\napply (safe; clarsimp?)\napply (unfold valid_relay_states_def)\napply (simp_all add: eq_vector_from_list_5)\napply (safe; clarsimp)+\ndone\n\nlemma relays_inv_split:\n\"`relays_inv \\ P` = `\\<^bold>\\ v\\\\valid_relay_states\\ \\ P\\\\v\\ / &relays\\`\"\napply (unfold relays_inv_cases)\napply (pred_simp robust)\napply (safe; clarsimp)\ndone\n\nlemma relays_inv_extr:\n\"`relays_inv \\ P \\ Q` = `relays_inv \\ P \\ Q`\"\n by (simp add: impl_alt_def utp_pred_laws.sup.assoc)\n\nlemma hoare_relays_inv_split:\n\"(\\rs. rs \\ valid_relay_states \\ \\ilock_type_inv\\S\\\\rs\\/$relays\\\\I\\\\<^sub>u) \\\n \\ilock_type_inv \\ relays_inv\\S\\I\\\\<^sub>u\"\napply (unfold relays_inv_cases)\napply (rel_simp)\ndone\n\nmethod hoare_relays_inv_tac = (\n (rule hoare_relays_inv_split),\n (unfold valid_relay_states_def),\n (clarsimp; safe))\n\ntext {* Do \\,\\ and \\;\\ have the same precedence? Are they right-associative? *}\n\nmethod ilock_relays_inv_tac =\n (hoare_split_inv; (\n (unfold relays_inv_extr)?,\n (unfold relays_inv_cases),\n (rel_simp);\n (unfold valid_relay_states_def),\n (safe; simp)))\n\nparagraph {* Invariant Preservation *}\n\nlemma init_ilock_relays_inv:\n\"\\true\\init_ilock\\relays_inv\\\\<^sub>u\"\n unfolding init_ilock_def by (rel_simp)\n\nlemma set_relays_relays_inv:\n\"\\relays_inv\\set_relays\\relays_inv\\\\<^sub>u\"\n unfolding set_relays_def by (ilock_relays_inv_tac)\n\nlemma clear_relays_relays_inv:\n\"\\relays_inv\\clear_relays\\relays_inv\\\\<^sub>u\"\n unfolding clear_relays_def by (ilock_relays_inv_tac)\n\nlemma set_switches_relays_inv:\n\"\\relays_inv\\set_switches\\relays_inv\\\\<^sub>u\"\n unfolding set_switches_def by (ilock_relays_inv_tac)\n\nlemma set_signals_relays_inv:\n\"\\relays_inv\\set_signals\\relays_inv\\\\<^sub>u\"\n unfolding set_signals_def by (ilock_relays_inv_tac)\n\nlemma \"\\relays_inv\\ilock_cycle\\relays_inv\\\\<^sub>u\"\napply (unfold ilock_cycle_def)\napply (hoare_split)\napply (rule set_relays_relays_inv)\napply (rule clear_relays_relays_inv)\napply (rule set_switches_relays_inv)\napply (rule set_signals_relays_inv)\ndone\n\nsubsection {* Switches Invariant *}\n\n(*\ndefinition switches_inv :: \"ilock_state upred\" where\n[urel_defs]: \"switches_inv = (\n (#\\<^sub>u(&switches) =\\<^sub>u 5) \\\n (SW1 =\\<^sub>u \\STRAIGHT\\) \\\n ((SW2 =\\<^sub>u \\STRAIGHT\\) \\ R3 \\ R5 \\ (SW2 =\\<^sub>u \\DIVERGING\\)) \\\n ((SW3 =\\<^sub>u \\STRAIGHT\\) \\ R1 \\ (SW3 =\\<^sub>u \\DIVERGING\\)) \\\n (SW4 =\\<^sub>u \\STRAIGHT\\) \\\n ((SW5 =\\<^sub>u \\STRAIGHT\\) \\ R2 \\ R3 \\ (SW5 =\\<^sub>u \\DIVERGING\\))\n)\"\n*)\n\ndefinition switches_inv :: \"ilock_state upred\" where\n[urel_defs]: \"switches_inv = (\n (#\\<^sub>u(&switches) =\\<^sub>u 5) \\\n (R1 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW3 =\\<^sub>u \\STRAIGHT\\) \\\n (R2 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\STRAIGHT\\) \\\n (R3 \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\ \\ SW5 =\\<^sub>u \\STRAIGHT\\) \\\n (R4 \\ SW1 =\\<^sub>u \\STRAIGHT\\ \\ SW2 =\\<^sub>u \\DIVERGING\\ \\ SW3 =\\<^sub>u \\DIVERGING\\ \\ SW5 =\\<^sub>u \\DIVERGING\\) \\\n (R5 \\ SW2 =\\<^sub>u \\STRAIGHT\\ \\ SW4 =\\<^sub>u \\STRAIGHT\\ \\ SW5 =\\<^sub>u \\DIVERGING\\)\n)\"\n\nlemma switches_inv_rules:\n\"`switches_inv \\ s \\ switches_inv` \\\n `switches_inv \\ P \\ s \\ switches_inv`\"\napply (erule inv_subst_weakening_lemma)\ndone\n\nlemma init_ilock_switches_inv:\n\"\\true\\init_ilock\\switches_inv\\\\<^sub>u\"\n unfolding init_ilock_def by (rel_simp)\n\n(***********************)\n(* REVIEWED UNTIL HERE *)\n(***********************)\n\nlemma set_switches_subst_relay_simps:\n\"(switches := e ;; S)\\\\f\\/$relays\\ =\n (switches := e\\\\f\\/&relays\\ ;; (S\\\\f\\/$relays\\))\"\n\"((switches := e1 \\ b \\\\<^sub>r switches := e2) ;; R)\\\\f\\/$relays\\ =\n ((switches := e1\\\\f\\/&relays\\ \\ b\\\\f\\/&relays\\ \\\\<^sub>r switches := e2\\\\f\\/&relays\\) ;; R\\\\f\\/$relays\\)\"\napply (rel_auto)+\napply (blast)+\ndone\n\nlemma switches_assign_lemma:\n\"switches := (&switches(i \\ \\v\\)\\<^sub>u)\\\\e\\/&relays\\ =\n switches := (&switches(i\\\\e\\/&relays\\ \\ \\v\\)\\<^sub>u)\"\napply (rel_auto)\ndone\n\nlemma more_simps:\n\"(s \\ (1::(nat, '\\) uexpr)) = 1\"\n\"(s \\ (2::(nat, '\\) uexpr)) = 2\"\n\"(s \\ (3::(nat, '\\) uexpr)) = 3\"\n\"(s \\ (4::(nat, '\\) uexpr)) = 4\"\n\"(s \\ (5::(nat, '\\) uexpr)) = 5\"\n\"i \\ {1..length l} \\ \\vector_from_list l\\(\\i\\)\\<^sub>a = \\l ! (i - 1)\\\"\n\"(S \\ \\True\\ \\\\<^sub>r T) = S\"\n\"(S \\ \\False \\\\\\<^sub>r T) = T\"\napply (rel_simp)+\ndone\n\nlemma\n\"\\ilock_type_inv\\set_switches\\\\rs\\/$relays\\\\I\\\\<^sub>u =\n \\ilock_type_inv\\set_switches\\\\rs\\/$relays\\\\I\\\\rs\\/&relays\\\\\\<^sub>u\"\napply (rel_simp robust)\nsledgehammer\noops\n\nlemma set_switches_switches_inv:\n\"\\ilock_type_inv \\ relays_inv\\set_switches\\switches_inv\\\\<^sub>u\"\napply (hoare_relays_inv_tac)\napply (unfold set_switches_def)\napply (simp_all only: set_switches_subst_relay_simps)\napply (simp_all add: switches_assign_lemma more_simps usubst unrest)\napply (unfold switches_inv_def)\napply (hoare_split_inv)\n\nprofile (rel_simp robust)+\ndone\n\n(***********************)\n(* REVIEWED UNTIL HERE *)\n(***********************)\n\nsubsection {* Signals Invariant *}\n\ndefinition signals_inv :: \"ilock_state upred\" where [upred_defs]:\n\"signals_inv = (\n (#\\<^sub>u(&signals) =\\<^sub>u 3) \\\n (R3 \\ &signals[1]\\<^sub>u) \\\n (R5 \\ &signals[2]\\<^sub>u) \\\n ((R1 \\ R2 \\ R4) \\ &signals[3]\\<^sub>u))\"\n\nparagraph {* Invariant Preservation *}\n\nlemma init_ilock_signals_inv:\n\"\\true\\init_ilock\\signals_inv\\\\<^sub>u\"\n unfolding init_ilock_def by (rel_simp)\n\ntext {* I think we have to prove the switches invariant first...! *}\n\nlemma set_relays_signals_inv:\n\"\\ilock_type_inv\\set_switches ;; set_signals\\signals_inv\\\\<^sub>u\"\noops\n\nsubsection {* Proof Experiments *}\n\nlemma uvector_from_list_simps [simp]:\n\"i \\ {1..length l} \\ (vector_from_list\\<^sub>u l)[i]\\<^sub>u = \\l ! (i - 1)\\\"\napply (pred_simp)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/Interlocking.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725051, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.25871759406963396}} {"text": "(* Title: HOL/TLA/Memory/Memory.thy\n Author: Stephan Merz, University of Munich\n*)\n\nsection {* RPC-Memory example: Memory specification *}\n\ntheory Memory\nimports MemoryParameters ProcedureInterface\nbegin\n\ntype_synonym memChType = \"(memOp, Vals) channel\"\ntype_synonym memType = \"(Locs => Vals) stfun\" (* intention: MemLocs => MemVals *)\ntype_synonym resType = \"(PrIds => Vals) stfun\"\n\nconsts\n (* state predicates *)\n MInit :: \"memType => Locs => stpred\"\n PInit :: \"resType => PrIds => stpred\"\n (* auxiliary predicates: is there a pending read/write request for\n some process id and location/value? *)\n RdRequest :: \"memChType => PrIds => Locs => stpred\"\n WrRequest :: \"memChType => PrIds => Locs => Vals => stpred\"\n\n (* actions *)\n GoodRead :: \"memType => resType => PrIds => Locs => action\"\n BadRead :: \"memType => resType => PrIds => Locs => action\"\n ReadInner :: \"memChType => memType => resType => PrIds => Locs => action\"\n Read :: \"memChType => memType => resType => PrIds => action\"\n GoodWrite :: \"memType => resType => PrIds => Locs => Vals => action\"\n BadWrite :: \"memType => resType => PrIds => Locs => Vals => action\"\n WriteInner :: \"memChType => memType => resType => PrIds => Locs => Vals => action\"\n Write :: \"memChType => memType => resType => PrIds => Locs => action\"\n MemReturn :: \"memChType => resType => PrIds => action\"\n MemFail :: \"memChType => resType => PrIds => action\"\n RNext :: \"memChType => memType => resType => PrIds => action\"\n UNext :: \"memChType => memType => resType => PrIds => action\"\n\n (* temporal formulas *)\n RPSpec :: \"memChType => memType => resType => PrIds => temporal\"\n UPSpec :: \"memChType => memType => resType => PrIds => temporal\"\n MSpec :: \"memChType => memType => resType => Locs => temporal\"\n IRSpec :: \"memChType => memType => resType => temporal\"\n IUSpec :: \"memChType => memType => resType => temporal\"\n\n RSpec :: \"memChType => resType => temporal\"\n USpec :: \"memChType => temporal\"\n\n (* memory invariant: in the paper, the invariant is hidden in the definition of\n the predicate S used in the implementation proof, but it is easier to verify\n at this level. *)\n MemInv :: \"memType => Locs => stpred\"\n\ndefs\n MInit_def: \"MInit mm l == PRED mm!l = #InitVal\"\n PInit_def: \"PInit rs p == PRED rs!p = #NotAResult\"\n\n RdRequest_def: \"RdRequest ch p l == PRED\n Calling ch p & (arg = #(read l))\"\n WrRequest_def: \"WrRequest ch p l v == PRED\n Calling ch p & (arg = #(write l v))\"\n (* a read that doesn't raise BadArg *)\n GoodRead_def: \"GoodRead mm rs p l == ACT\n #l : #MemLoc & ((rs!p)$ = $(mm!l))\"\n (* a read that raises BadArg *)\n BadRead_def: \"BadRead mm rs p l == ACT\n #l ~: #MemLoc & ((rs!p)$ = #BadArg)\"\n (* the read action with l visible *)\n ReadInner_def: \"ReadInner ch mm rs p l == ACT\n $(RdRequest ch p l)\n & (GoodRead mm rs p l | BadRead mm rs p l)\n & unchanged (rtrner ch ! p)\"\n (* the read action with l quantified *)\n Read_def: \"Read ch mm rs p == ACT (EX l. ReadInner ch mm rs p l)\"\n\n (* similar definitions for the write action *)\n GoodWrite_def: \"GoodWrite mm rs p l v == ACT\n #l : #MemLoc & #v : #MemVal\n & ((mm!l)$ = #v) & ((rs!p)$ = #OK)\"\n BadWrite_def: \"BadWrite mm rs p l v == ACT\n ~ (#l : #MemLoc & #v : #MemVal)\n & ((rs!p)$ = #BadArg) & unchanged (mm!l)\"\n WriteInner_def: \"WriteInner ch mm rs p l v == ACT\n $(WrRequest ch p l v)\n & (GoodWrite mm rs p l v | BadWrite mm rs p l v)\n & unchanged (rtrner ch ! p)\"\n Write_def: \"Write ch mm rs p l == ACT (EX v. WriteInner ch mm rs p l v)\"\n\n (* the return action *)\n MemReturn_def: \"MemReturn ch rs p == ACT\n ( ($(rs!p) ~= #NotAResult)\n & ((rs!p)$ = #NotAResult)\n & Return ch p (rs!p))\"\n\n (* the failure action of the unreliable memory *)\n MemFail_def: \"MemFail ch rs p == ACT\n $(Calling ch p)\n & ((rs!p)$ = #MemFailure)\n & unchanged (rtrner ch ! p)\"\n (* next-state relations for reliable / unreliable memory *)\n RNext_def: \"RNext ch mm rs p == ACT\n ( Read ch mm rs p\n | (EX l. Write ch mm rs p l)\n | MemReturn ch rs p)\"\n UNext_def: \"UNext ch mm rs p == ACT\n (RNext ch mm rs p | MemFail ch rs p)\"\n\n RPSpec_def: \"RPSpec ch mm rs p == TEMP\n Init(PInit rs p)\n & [][ RNext ch mm rs p ]_(rtrner ch ! p, rs!p)\n & WF(RNext ch mm rs p)_(rtrner ch ! p, rs!p)\n & WF(MemReturn ch rs p)_(rtrner ch ! p, rs!p)\"\n UPSpec_def: \"UPSpec ch mm rs p == TEMP\n Init(PInit rs p)\n & [][ UNext ch mm rs p ]_(rtrner ch ! p, rs!p)\n & WF(RNext ch mm rs p)_(rtrner ch ! p, rs!p)\n & WF(MemReturn ch rs p)_(rtrner ch ! p, rs!p)\"\n MSpec_def: \"MSpec ch mm rs l == TEMP\n Init(MInit mm l)\n & [][ EX p. Write ch mm rs p l ]_(mm!l)\"\n IRSpec_def: \"IRSpec ch mm rs == TEMP\n (ALL p. RPSpec ch mm rs p)\n & (ALL l. #l : #MemLoc --> MSpec ch mm rs l)\"\n IUSpec_def: \"IUSpec ch mm rs == TEMP\n (ALL p. UPSpec ch mm rs p)\n & (ALL l. #l : #MemLoc --> MSpec ch mm rs l)\"\n\n RSpec_def: \"RSpec ch rs == TEMP (EEX mm. IRSpec ch mm rs)\"\n USpec_def: \"USpec ch == TEMP (EEX mm rs. IUSpec ch mm rs)\"\n\n MemInv_def: \"MemInv mm l == PRED #l : #MemLoc --> mm!l : #MemVal\"\n\nlemmas RM_action_defs =\n MInit_def PInit_def RdRequest_def WrRequest_def MemInv_def\n GoodRead_def BadRead_def ReadInner_def Read_def\n GoodWrite_def BadWrite_def WriteInner_def Write_def\n MemReturn_def RNext_def\n\nlemmas UM_action_defs = RM_action_defs MemFail_def UNext_def\n\nlemmas RM_temp_defs = RPSpec_def MSpec_def IRSpec_def\nlemmas UM_temp_defs = UPSpec_def MSpec_def IUSpec_def\n\n\n(* The reliable memory is an implementation of the unreliable one *)\nlemma ReliableImplementsUnReliable: \"|- IRSpec ch mm rs --> IUSpec ch mm rs\"\n by (force simp: UNext_def UPSpec_def IUSpec_def RM_temp_defs elim!: STL4E [temp_use] squareE)\n\n(* The memory spec implies the memory invariant *)\nlemma MemoryInvariant: \"|- MSpec ch mm rs l --> [](MemInv mm l)\"\n by (auto_invariant simp: RM_temp_defs RM_action_defs)\n\n(* The invariant is trivial for non-locations *)\nlemma NonMemLocInvariant: \"|- #l ~: #MemLoc --> [](MemInv mm l)\"\n by (auto simp: MemInv_def intro!: necT [temp_use])\n\nlemma MemoryInvariantAll:\n \"|- (ALL l. #l : #MemLoc --> MSpec ch mm rs l) --> (ALL l. [](MemInv mm l))\"\n apply clarify\n apply (auto elim!: MemoryInvariant [temp_use] NonMemLocInvariant [temp_use])\n done\n\n(* The memory engages in an action for process p only if there is an\n unanswered call from p.\n We need this only for the reliable memory.\n*)\n\nlemma Memoryidle: \"|- ~$(Calling ch p) --> ~ RNext ch mm rs p\"\n by (auto simp: Return_def RM_action_defs)\n\n(* Enabledness conditions *)\n\nlemma MemReturn_change: \"|- MemReturn ch rs p --> _(rtrner ch ! p, rs!p)\"\n by (force simp: MemReturn_def angle_def)\n\nlemma MemReturn_enabled: \"!!p. basevars (rtrner ch ! p, rs!p) ==>\n |- Calling ch p & (rs!p ~= #NotAResult)\n --> Enabled (_(rtrner ch ! p, rs!p))\"\n apply (tactic\n {* action_simp_tac @{context} [@{thm MemReturn_change} RSN (2, @{thm enabled_mono}) ] [] 1 *})\n apply (tactic\n {* action_simp_tac (@{context} addsimps [@{thm MemReturn_def}, @{thm Return_def},\n @{thm rtrner_def}]) [exI] [@{thm base_enabled}, @{thm Pair_inject}] 1 *})\n done\n\nlemma ReadInner_enabled: \"!!p. basevars (rtrner ch ! p, rs!p) ==>\n |- Calling ch p & (arg = #(read l)) --> Enabled (ReadInner ch mm rs p l)\"\n apply (case_tac \"l : MemLoc\")\n apply (force simp: ReadInner_def GoodRead_def BadRead_def RdRequest_def\n intro!: exI elim!: base_enabled [temp_use])+\n done\n\nlemma WriteInner_enabled: \"!!p. basevars (mm!l, rtrner ch ! p, rs!p) ==>\n |- Calling ch p & (arg = #(write l v))\n --> Enabled (WriteInner ch mm rs p l v)\"\n apply (case_tac \"l:MemLoc & v:MemVal\")\n apply (force simp: WriteInner_def GoodWrite_def BadWrite_def WrRequest_def\n intro!: exI elim!: base_enabled [temp_use])+\n done\n\nlemma ReadResult: \"|- Read ch mm rs p & (!l. $(MemInv mm l)) --> (rs!p)` ~= #NotAResult\"\n by (force simp: Read_def ReadInner_def GoodRead_def BadRead_def MemInv_def)\n\nlemma WriteResult: \"|- Write ch mm rs p l --> (rs!p)` ~= #NotAResult\"\n by (auto simp: Write_def WriteInner_def GoodWrite_def BadWrite_def)\n\nlemma ReturnNotReadWrite: \"|- (ALL l. $MemInv mm l) & MemReturn ch rs p\n --> ~ Read ch mm rs p & (ALL l. ~ Write ch mm rs p l)\"\n by (auto simp: MemReturn_def dest!: WriteResult [temp_use] ReadResult [temp_use])\n\nlemma RWRNext_enabled: \"|- (rs!p = #NotAResult) & (!l. MemInv mm l)\n & Enabled (Read ch mm rs p | (? l. Write ch mm rs p l))\n --> Enabled (_(rtrner ch ! p, rs!p))\"\n by (force simp: RNext_def angle_def elim!: enabled_mono2\n dest: ReadResult [temp_use] WriteResult [temp_use])\n\n\n(* Combine previous lemmas: the memory can make a visible step if there is an\n outstanding call for which no result has been produced.\n*)\nlemma RNext_enabled: \"!!p. !l. basevars (mm!l, rtrner ch!p, rs!p) ==>\n |- (rs!p = #NotAResult) & Calling ch p & (!l. MemInv mm l)\n --> Enabled (_(rtrner ch ! p, rs!p))\"\n apply (auto simp: enabled_disj [try_rewrite] intro!: RWRNext_enabled [temp_use])\n apply (case_tac \"arg (ch w p)\")\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm Read_def},\n temp_rewrite @{context} @{thm enabled_ex}]) [@{thm ReadInner_enabled}, exI] [] 1 *})\n apply (force dest: base_pair [temp_use])\n apply (erule contrapos_np)\n apply (tactic {* action_simp_tac (@{context} addsimps [@{thm Write_def},\n temp_rewrite @{context} @{thm enabled_ex}])\n [@{thm WriteInner_enabled}, exI] [] 1 *})\n done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/TLA/Memory/Memory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.38861802670584894, "lm_q1q2_score": 0.25859053828942324}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | November 2004 |\n | June 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | April 2006 (modified) |\n | January 2007 (modified) |\n | April 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2007 |\n | January 2008 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | April 2016 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_syntax\nimports Infra\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n\n(* for Isabelle 2016\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\n(*-----------------------------------------------------------*\n | |\n | Process Type Definitions |\n | |\n | 'a proc : type of process expressions |\n | 'n : process name |\n | 'a : event |\n | |\n *-----------------------------------------------------------*)\n\n(*********************************************************************\n process expression\n *********************************************************************)\n\ntype_synonym\n 'a sets_nats = \"('a set set, nat set) sum\"\ntype_synonym\n 'a aset_anat = \"('a set, nat) sum\"\n\ndatatype \n ('p,'a) proc\n = STOP\n\n | SKIP\n\n | DIV\n\n | Act_prefix \"'a\" \"('p,'a) proc\" (\"(1_ /-> _)\" [150,80] 80)\n\n | Ext_pre_choice \"'a set\" \"'a => ('p,'a) proc\"\n (\"(1? :_ /-> _)\" [900,80] 80)\n | Ext_choice \"('p,'a) proc\" \"('p,'a) proc\" \n (\"(1_ /[+] _)\" [72,73] 72)\n | Int_choice \"('p,'a) proc\" \"('p,'a) proc\" \n (\"(1_ /|~| _)\" [64,65] 64)\n | Rep_int_choice \"'a sets_nats\" \"'a aset_anat => ('p,'a) proc\"\n (\"(1!! :_ .. /_)\" [900,68] 68) \n | IF \"bool\" \"('p,'a) proc\" \"('p,'a) proc\"\n (\"(0IF _ /THEN _ /ELSE _)\" [900,88,88] 88)\n(* (\"(0IF _ /THEN _ /ELSE _)\" [900,60,60] 88) *)\n | Parallel \"('p,'a) proc\" \"'a set\" \"('p,'a) proc\" \n (\"(1_ /|[_]| _)\" [76,0,77] 76)\n | Hiding \"('p,'a) proc\" \"'a set\" (\"(1_ /-- _)\" [84,85] 84)\n\n | Renaming \"('p,'a) proc\" \"('a * 'a) set\"\n (\"(1_ /[[_]])\" [84,0] 84)\n(* (\"(1_ /[[_]])\" [84,0] 84) *)\n | Seq_compo \"('p,'a) proc\" \"('p,'a) proc\" \n (\"(1_ /;; _)\" [79,78] 78)\n | Depth_rest \"('p,'a) proc\" \"nat\" \n (\"(1_ /|. _)\" [84,900] 84)\n | Proc_name \"'p\" (\"$_\" [900] 90)\n\n(*--------------------------------------------------------------------*\n | |\n | (1) binding power: |\n | Proc_Name > IF > {Hiding, Renaming, Restriction} > |\n | {Act_prefix, Ext_pre_choice} > Seq_compo > Parallel > |\n | Ext_choice > Rep_int_choice > int_choice |\n | |\n | The binding power 90 is higher than ones of processes ops. |\n | |\n | (2) About (\"(1_ /-> _)\" [150,80] 80) |\n | The nth operator ! has the power 101. |\n | So, 150 > 101 is needed. |\n | |\n | (3) \"selector\" is necessary for having our CSP expressive |\n | with respect to the domain for stable-failures model F. |\n | |\n *--------------------------------------------------------------------*)\n\n(*** external prefix ***)\n\nsyntax\n \"@Ext_pre_choice\" :: \"pttrn => 'a set => ('p,'a) proc \n => ('p,'a) proc\" (\"(1? _:_ /-> _)\" [900,900,80] 80)\n\ntranslations\n \"? x:X -> P\" == \"? :X -> (%x. P)\"\n\n\nsyntax\n \"@Ext_pre_choice_UNIV\" :: \"pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1? _ /-> _)\" [900,80] 80)\ntranslations\n \"? x -> P\" == \"? x:(CONST UNIV) -> P\"\n\n\n(*** replicated internal choice (bound variable, UNIV) ***)\n\nsyntax\n \"@Rep_int_choice\":: \n \"pttrn => 'a sets_nats => ('p,'a) proc => ('p,'a) proc\" \n (\"(1!! _:_ .. /_)\" [900,900,68] 68)\ntranslations\n \"!! c:C .. P\" == \"!! :C .. (%c. P)\"\n\n(* this is not collect *)\n(*\nsyntax\n \"@Rep_int_choice_UNIV\":: \n \"pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1!! _ .. /_)\" [900,68] 68)\n\ntranslations\n \"!! c .. P\" == \"!! c:UNIV .. P\"\n*)\n\n(*** set, nat ***)\n\n(*\nconsts\n Rep_int_choice_set :: \n \"'a set set => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!set :_ .. /_)\" [900,68] 68)\n Rep_int_choice_nat ::\n \"nat set => (nat => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!nat :_ .. /_)\" [900,68] 68)\n\ndefs\n Rep_int_choice_set_def:\n \"!set :Xs .. Pf == !! c:(type1 Xs) .. (Pf ((inv type1) c))\"\n Rep_int_choice_nat_def:\n \"!nat :N .. Pf == !! c:(type2 N) .. (Pf ((inv type2) c))\"\n*)\n\ndefinition\n Rep_int_choice_set :: \n \"'a set set => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!set :_ .. /_)\" [900,68] 68)\n where\n \"!set :Xs .. Pf == !! c:(type1 Xs) .. (Pf ((inv type1) c))\"\n\ndefinition\n Rep_int_choice_nat ::\n \"nat set => (nat => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!nat :_ .. /_)\" [900,68] 68)\n where\n Rep_int_choice_nat_def:\n \"!nat :N .. Pf == !! c:(type2 N) .. (Pf ((inv type2) c))\"\n\n(* bound variable *)\n\nsyntax\n \"@Rep_int_choice_set\" :: \n \"pttrn => ('a set) set => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!set _:_ .. /_)\" [900,900,68] 68)\n \"@Rep_int_choice_nat\" :: \n \"pttrn => nat set => (nat => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!nat _:_ .. /_)\" [900,900,68] 68)\n\ntranslations\n \"!set X:Xs .. P\" == \"!set :Xs .. (%X. P)\"\n \"!nat n:N .. P\" == \"!nat :N .. (%n. P)\"\n\n(* UNIV *)\n\nsyntax\n \"@Rep_int_choice_set_UNIV\" ::\n \"pttrn => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!set _ .. /_)\" [900,68] 68)\n \"@Rep_int_choice_nat_UNIV\" ::\n \"pttrn => (nat => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!nat _ .. /_)\" [900,68] 68)\n\ntranslations\n \"!set X .. P\" == \"!set X:(CONST UNIV) .. P\"\n \"!nat n .. P\" == \"!nat n:(CONST UNIV) .. P\"\n\n(*** com ***)\n(* Isabelle 2013\nconsts\n Rep_int_choice_com :: \"'a set => ('a => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1! :_ .. /_)\" [900,68] 68)\ndefs\n Rep_int_choice_com_def :\n \"! :A .. Pf == !set X:{{a} |a. a : A} .. Pf (the_elem(X))\"\n*)\n\ndefinition\n Rep_int_choice_com :: \"'a set => ('a => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1! :_ .. /_)\" [900,68] 68)\n where\n \"! :A .. Pf == !set X:{{a} |a. a : A} .. Pf (the_elem(X))\"\n\nsyntax\n \"@Rep_int_choice_com\" ::\n \"pttrn => 'a set => ('a => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1! _:_ .. /_)\" [900,900,68] 68)\n \"@Rep_int_choice_com_UNIV\" ::\n \"pttrn => ('a => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1! _ .. /_)\" [900,68] 68)\ntranslations\n \"! x:X .. P\" == \"! :X .. (%x. P)\"\n \"! x .. P\" == \"! x:(CONST UNIV) .. P\"\n\n(*** f ***)\n\n(* Isabelle 2013\nconsts\n Rep_int_choice_f ::\n \"('b => 'a) => 'b set => ('b => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!<_> :_ .. /_)\" [0,900,68] 68)\n\ndefs\n Rep_int_choice_f_def : \n \"! :X .. Pf == ! :(f ` X) .. (%x. (Pf ((inv f) x)))\"\n*)\n\ndefinition\n Rep_int_choice_f ::\n \"('b => 'a) => 'b set => ('b => ('p,'a) proc) => ('p,'a) proc\"\n (\"(1!<_> :_ .. /_)\" [0,900,68] 68)\n where\n \"! :X .. Pf == ! :(f ` X) .. (%x. (Pf ((inv f) x)))\"\n\nsyntax\n \"@Rep_int_choice_f\"::\n \"('b => 'a) => pttrn => 'b set => ('p,'a) proc => ('p,'a) proc\"\n (\"(1!<_> _:_ .. /_)\" [0,900,900,68] 68)\n \"@Rep_int_choice_f_UNIV\"::\n \"('b => 'a) => pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1!<_> _ .. /_)\" [900,900,68] 68)\n\ntranslations\n \"! x:X .. P\" == \"! :X .. (%x. P)\"\n \"! x .. P\" == \"! x:(CONST UNIV) .. P\"\n\nlemmas Rep_int_choice_ss_def =\n Rep_int_choice_set_def\n Rep_int_choice_nat_def\n Rep_int_choice_com_def\n Rep_int_choice_f_def\n\n(*** internal prefix choice ***)\n\n(* 2013\nconsts\n Int_pre_choice :: \"'a set => ('a => ('p,'a) proc) => ('p,'a) proc\" \n (\"(1! :_ /-> _)\" [900,80] 80)\n\ndefs\n Int_pre_choice_def : \"! :X -> Pf == ! :X .. (%x. x -> (Pf x))\"\n*)\n\ndefinition\n Int_pre_choice :: \"'a set => ('a => ('p,'a) proc) => ('p,'a) proc\" \n (\"(1! :_ /-> _)\" [900,80] 80)\n where\n \"! :X -> Pf == ! :X .. (%x. x -> (Pf x))\"\n\nsyntax\n \"@Int_pre_choice\" :: \"pttrn => 'a set => ('p,'a) proc \n => ('p,'a) proc\" (\"(1! _:_ /-> _)\" [900,900,80] 80)\n\n \"@Int_pre_choice_UNIV\" :: \"pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1! _ /-> _)\" [900,80] 80)\n\ntranslations\n \"! x:X -> P\" == \"! :X -> (%x. P)\"\n \"! x -> P\" == \"! x:(CONST UNIV) -> P\"\n\n(*** sending and receiving prefixes ***)\n\n(* Isabelle 2013\nconsts\n Send_prefix :: \"('x => 'a) => 'x => ('p,'a) proc => ('p,'a) proc\" \n (\"(1_ ! _ /-> _)\" [900,1000,80] 80)\n Nondet_send_prefix :: \"('x => 'a) => 'x set => \n ('x => ('p,'a) proc) => ('p,'a) proc\" \n Rec_prefix :: \"('x => 'a) => 'x set => \n ('x => ('p,'a) proc) => ('p,'a) proc\" \n\ndefs\n Send_prefix_def : \n \"a ! x -> P == a x -> P\"\n Nondet_send_prefix_def : \n \"Nondet_send_prefix f X Pf == ! :(f ` X) -> (%x. (Pf ((inv f) x)))\"\n Rec_prefix_def : \n \"Rec_prefix f X Pf == ? :(f ` X) -> (%x. (Pf ((inv f) x)))\"\n*)\n\ndefinition\n Send_prefix :: \"('x => 'a) => 'x => ('p,'a) proc => ('p,'a) proc\" \n (\"(1_ ! _ /-> _)\" [900,1000,80] 80)\n where\n \"a ! x -> P == a x -> P\"\n\ndefinition\n Nondet_send_prefix :: \"('x => 'a) => 'x set => \n ('x => ('p,'a) proc) => ('p,'a) proc\" \n where\n \"Nondet_send_prefix f X Pf == ! :(f ` X) -> (%x. (Pf ((inv f) x)))\"\n\ndefinition\n Rec_prefix :: \"('x => 'a) => 'x set => \n ('x => ('p,'a) proc) => ('p,'a) proc\" \n where\n \"Rec_prefix f X Pf == ? :(f ` X) -> (%x. (Pf ((inv f) x)))\"\n\n(*\nThe sending \"a ! v -> P\" causes syntactical ambiguity.\nSo, it is recommended to directly use \"a v -> P\" instead of \"a ! v -> P\".\n*)\n\nsyntax\n \"@Nondet_send_prefix\" :: \n \"('x => 'a) => pttrn => 'x set => ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ !? _:_ /-> _)\" [900,900,1000,80] 80)\n\n \"@Nondet_send_prefix_UNIV\" :: \n \"('x => 'a) => pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ !? _ /-> _)\" [900,900,80] 80)\n\n \"@Rec_prefix\" :: \n \"('x => 'a) => pttrn => 'x set => ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ ? _:_ /-> _)\" [900,900,1000,80] 80)\n \"@Rec_Prefix_UNIV\" :: \n \"('x => 'a) => pttrn => ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ ? _ /-> _)\" [900,900,80] 80)\n\ntranslations\n \"a !? x:X -> P\" == \"CONST Nondet_send_prefix a X (%x. P)\"\n \"a !? x -> P\" == \"a !? x:(CONST UNIV) -> P\"\n\n \"a ? x:X -> P\" == \"CONST Rec_prefix a X (%x. P)\"\n \"a ? x -> P\" == \"a? x:(CONST UNIV) -> P\"\n\n(*** unfolding syntactic sugar ***)\n\nlemmas csp_prefix_ss_def = Int_pre_choice_def\n Send_prefix_def\n Nondet_send_prefix_def\n Rec_prefix_def\n\n(*** parallel ***)\n\nabbreviation\n Interleave :: \"('p,'a) proc => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /||| _)\" [76,77] 76)\nwhere \"P ||| Q == P |[{}]| Q\"\n\nabbreviation\n Synchro :: \"('p,'a) proc => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /|| _)\" [76,77] 76)\nwhere \"P || Q == P |[UNIV]| Q\"\n\n(*\nsyntax\n \"_Interleave\" :: \"('p,'a) proc => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /||| _)\" [76,77] 76)\n \"_Synchro\" :: \"('p,'a) proc => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /|| _)\" [76,77] 76)\n\ntranslations\n \"P ||| Q\" == \"P |[{}]| Q\"\n \"P || Q\" == \"P |[UNIV]| Q\"\n*)\n\n(* Isabelle 2013\nconsts\n Alpha_parallel :: \"('p,'a) proc => 'a set => 'a set => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /(2|[_,/_]|)/ _)\" [76,0,0,77] 76)\ndefs\n Alpha_parallel_def :\n \"P |[X,Y]| Q == (P |[- X]| SKIP) |[X Int Y]| (Q |[- Y]| SKIP)\"\n*)\n\ndefinition\n Alpha_parallel :: \"('p,'a) proc => 'a set => 'a set => ('p,'a) proc\n => ('p,'a) proc\" (\"(1_ /(2|[_,/_]|)/ _)\" [76,0,0,77] 76)\n where\n \"P |[X,Y]| Q == (P |[- X]| SKIP) |[X Int Y]| (Q |[- Y]| SKIP)\"\n\nprimrec\n Inductive_parallel :: \"(('p,'a) proc * 'a set) list\n => ('p,'a) proc\" (\"(1[||] _)\" [78] 78)\nwhere\n \"[||] [] = SKIP\"\n |\"[||] (PX # PXs) = (fst PX) |[snd PX, Union (snd ` set PXs)]| ([||] PXs)\"\n\n(* Isabelle 2013 \nconsts\n Rep_parallel :: \"'i set => ('i => (('p,'a) proc * 'a set))\n => ('p,'a) proc\" (\"(1[||]:_ /_)\" [90,78] 78)\n\ndefs\n Rep_parallel_def :\n \"[||]:I PXf == [||] (map PXf (SOME Is. Is isListOf I))\"\n*) \n\ndefinition\n Rep_parallel :: \"'i set => ('i => (('p,'a) proc * 'a set))\n => ('p,'a) proc\" (\"(1[||]:_ /_)\" [90,78] 78)\n where\n Rep_parallel_def :\n \"[||]:I PXf == [||] (map PXf (SOME Is. Is isListOf I))\"\n\nsyntax\n \"@Rep_parallel\" :: \n \"pttrn => 'i set => (('p,'a) proc * 'a set)\n => ('p,'a) proc\" (\"(1[||] _:_ .. /_)\" [900,90,78] 78)\n\ntranslations\n \"[||] i:I .. PX\" == \"[||]:I (%i. PX)\"\n\n(************************************\n | empty Index |\n ************************************)\n\nlemma Rep_parallel_empty[simp]: \"I = {} ==> [||]:I PXf = SKIP\"\nby (simp add: Rep_parallel_def)\n\n(************************************\n | one Index |\n ************************************)\n\nlemma Rep_parallel_one: \n \"I = {i} ==> [||]:I PXf = (fst (PXf i)) |[snd (PXf i), {}]| SKIP\"\nby (simp add: Rep_parallel_def)\n\n(*** timeout ***)\n\nabbreviation\n Timeout_abb :: \"('p,'a) proc => ('p,'a) proc \n => ('p,'a) proc\" (\"(1_ /[> _)\" [73,74] 73)\n where \"P [> Q == (P |~| STOP) [+] Q\"\n\n(*\nsyntax\n \"_Timeout\" :: \"('p,'a) proc => ('p,'a) proc \n => ('p,'a) proc\" (\"(1_ /[> _)\" [73,74] 73)\ntranslations\n \"P [> Q\" == \"(P |~| STOP) [+] Q\"\n*)\n\n(*** it is sometimes useful to prevent automatic unfolding [> ***)\n\n(* Isabelle 2013\nconsts\n Timeout :: \"('p,'a) proc => ('p,'a) proc \n => ('p,'a) proc\" (\"(1_ /[>def _)\" [73,74] 73)\ndefs\n Timeout_def : \"P [>def Q == P [> Q\"\n*) \n\ndefinition\n Timeout :: \"('p,'a) proc => ('p,'a) proc \n => ('p,'a) proc\" (\"(1_ /[>def _)\" [73,74] 73)\n where\n Timeout_def : \"P [>def Q == P [> Q\"\n\n\n(************************************\n | Renaming by lists |\n ************************************)\n\nprimrec\n Renaming_List :: \"('p,'a) proc => ('a * 'a) set list => ('p,'a) proc\"\n (\"(1_ /[[ _ ]]*)\" [84,0] 84)\nwhere\n \"P [[ [] ]]* = P\"\n |\"P [[ r#rs ]]* = P[[r]] [[ rs ]]*\"\n\n\n(* --------------------------------------------------- *\n pipe operator (CSP-Prover 5)\n * --------------------------------------------------- *)\n\n(* Isabelle 2013\nconsts\n Pipe :: \"('p,'a) proc => \n ('x => 'a) => ('x => 'a) => ('x => 'a) =>\n ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ /<[_,_,_]> _)\" [76,0,0,0,77] 76)\n\ndefs\n Pipe_def: \n \"P <[left,mid,right]> Q == \n (P[[right<==>mid]] \n |[range left Un range mid, range mid Un range right]| \n Q[[left<==>mid]]) -- (range mid)\"\n*)\n\ndefinition\n Pipe :: \"('p,'a) proc => \n ('x => 'a) => ('x => 'a) => ('x => 'a) =>\n ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ /<[_,_,_]> _)\" [76,0,0,0,77] 76)\n\n where\n \"P <[left,mid,right]> Q == \n (P[[right<==>mid]] \n |[range left Un range mid, range mid Un range right]| \n Q[[left<==>mid]]) -- (range mid)\"\n\n(*===================================================================*\n\n(1) We assume that a process-name-function PNfun is given for \n defining the meaning of each process-name.\n\n When you define a type of process names, you have to define\n the function PNfun by \"overloaded\" as follows:\n\n defs (overloaded)\n PNfun_test_def : \"PNfun == ...\"\n\n(2) There are two kinds of approahes for fixed points, i.e. \n cms and cpo approaches. You can defin the mode for fixed \n points by\n\n defs FPmode = CPOmode \n or\n defs FPmode = CMSmode\n\n In addtion, you can use MIXmode as follows\n\n defs FPmode = CMSmode\n\n It means the least fixed point (in subset order) is used for\n giving the meaning of process names based on cpo approach, and if\n the process function is guarded then cms appoach is also used\n because the least fixed point is the unique fixed point in this\n case.\n\n *==================================================================*)\n\n(* Isabelle 2013\nconsts PNfun :: \"'p => ('p,'a) proc\" (* Definition of process names *)\n*)\n\ntype_synonym ('p,'a) pnfun = \"'p => ('p,'a) proc\"\nconsts PNfun :: \"('p,'a) pnfun\" (* Definition of process names *)\n\ndatatype fpmode = CPOmode | CMSmode | MIXmode\nconsts FPmode :: \"fpmode\"\n\n(* overloading test:\noverloading FP_CPOmode == \n \"FPmode :: fpmode\"\nbegin\n definition \"FPmode == CPOmode\"\nend\n\nlemma \"FPmode = CPOmode\"\napply (simp add:FP_CPOmode_def)\ndone\n*)\n\nlemma CPOmode_or_CMSmode_or_MIXmode_lm: \n \"m = FPmode --> m = CPOmode | m = CMSmode | m = MIXmode\"\napply (induct_tac m)\napply (auto)\ndone\n\nlemma CPOmode_or_CMSmode_or_MIXmode: \n \"FPmode = CPOmode | FPmode = CMSmode | FPmode = MIXmode\"\nby (simp add: CPOmode_or_CMSmode_or_MIXmode_lm)\n\n(*-------*\n | CHAOS |\n *-------*)\n\n(* This CHAOS may cause some error on process definition ... ? *)\n\ndatatype 'a ChaosName = Chaos \"'a set\"\n\nprimrec\n Chaosfun :: \"'a ChaosName => ('a ChaosName, 'a) proc\"\nwhere\n \"Chaosfun (Chaos A) = (! x:A -> $(Chaos A)) |~| STOP\"\n\n(* Isabelle 2013\ndefs (overloaded)\nSet_Chaosfun_def [simp]: \"PNfun == Chaosfun \n*)\n\noverloading Set_Chaosfun == \n \"PNfun :: ('a ChaosName, 'a) pnfun\"\nbegin\n definition \"PNfun (pn::'a ChaosName) == Chaosfun pn\"\nend\n\n(* test of overloading *)\nlemma \"((PNfun pn)::('a ChaosName, 'a) proc) = Chaosfun pn\"\napply (simp add: Set_Chaosfun_def)\ndone\n\n(* Isabelle 2013\nconsts CHAOS :: \"'a set => ('a ChaosName, 'a) proc\"\ndefs CHAOS_def : \"CHAOS == (%A. $(Chaos A))\"\n*)\n\ndefinition\n CHAOS :: \"'a set => ('a ChaosName, 'a) proc\"\n where\n CHAOS_def : \"CHAOS == (%A. $(Chaos A))\"\n\n\n(* --------------------------------------- *\n an example of recursive processes\n\ndatatype AB = A | B\n\nconsts ABfun :: \"AB => (AB,nat) proc\"\n\nprimrec\n \"ABfun A = 0 -> $B\"\n \"ABfun B = 1 -> $A\"\n\ndefs (overloaded)\nPNfun_AB_def : \"PNfun == ABfun\"\n\n * --------------------------------------- *)\n\n(*********************************************************************\n substitution by functions : 'p => ('a,'p) proc\n *********************************************************************)\n\n\nprimrec\n Subst_procfun :: \"('p,'a) proc => ('p => ('q,'a) proc)\n => ('q,'a) proc\" (\"_ <<\" [1000] 1000)\nwhere\n \"STOP< P)< P< Qf)< (Qf a)< ('q,'a) proc) => \n ('q => ('r,'a) proc) => ('p => ('r,'a) proc)\"\n (\"_ <<<\" [1000] 1000)\ndefs\n Subst_procfun_prod_def: \"Pf <<< == (%Qf p. (Pf p)< ('q,'a) proc) => \n ('q => ('r,'a) proc) => ('p => ('r,'a) proc)\"\n (\"_ <<<\" [1000] 1000)\n where\n \"Pf <<< == (%Qf p. (Pf p)< :X .. Qf)< x:X .. (Qf x)< P)< P< Pf x)<(Pf x)< Pf)< (Pf x)< Pf x)<(Pf x)< Q)< (Q< bool\" (* no Proc_name *)\nwhere\n \"noPN STOP = True\"\n |\"noPN SKIP = True\"\n |\"noPN DIV = True\"\n |\"noPN (a -> P) = noPN P\"\n |\"noPN (? :X -> Pf) = (ALL a. noPN (Pf a))\"\n |\"noPN (P [+] Q) = (noPN P & noPN Q)\"\n |\"noPN (P |~| Q) = (noPN P & noPN Q)\"\n |\"noPN (!! :C .. Pf) = (ALL c. noPN (Pf c))\"\n |\"noPN (IF b THEN P ELSE Q) = (noPN P & noPN Q)\"\n |\"noPN (P |[X]| Q) = (noPN P & noPN Q)\"\n |\"noPN (P -- X) = noPN P\"\n |\"noPN (P [[r]]) = noPN P\"\n |\"noPN (P ;; Q) = (noPN P & noPN Q)\"\n |\"noPN (P |. n) = noPN P\"\n |\"noPN ($p) = False\"\n\n(*** gSKIP ***)\n\nprimrec\n gSKIP :: \"('p,'a) proc => bool\" (* guarded SKIP *)\nwhere\n \"gSKIP STOP = True\"\n |\"gSKIP SKIP = False\"\n |\"gSKIP DIV = True\"\n |\"gSKIP (a -> P) = True\"\n |\"gSKIP (? :X -> Pf) = True\"\n |\"gSKIP (P [+] Q) = (gSKIP P & gSKIP Q)\"\n |\"gSKIP (P |~| Q) = (gSKIP P & gSKIP Q)\"\n |\"gSKIP (!! :C .. Pf) = (ALL c. gSKIP (Pf c))\"\n |\"gSKIP (IF b THEN P ELSE Q) = (gSKIP P & gSKIP Q)\"\n |\"gSKIP (P |[X]| Q) = (gSKIP P | gSKIP Q)\"\n |\"gSKIP (P -- X) = False\"\n |\"gSKIP (P [[r]]) = gSKIP P\"\n |\"gSKIP (P ;; Q) = (gSKIP P | gSKIP Q)\"\n |\"gSKIP (P |. n) = (gSKIP P | n=0)\"\n |\"gSKIP ($p) = False\"\n\n(*** no hide ***)\n\nprimrec\n noHide :: \"('p,'a) proc => bool\" (* no Hide *)\nwhere\n \"noHide STOP = True\"\n |\"noHide SKIP = True\"\n |\"noHide DIV = True\"\n |\"noHide (a -> P) = noHide P\"\n |\"noHide (? :X -> Pf) = (ALL a. noHide (Pf a))\"\n |\"noHide (P [+] Q) = (noHide P & noHide Q)\"\n |\"noHide (P |~| Q) = (noHide P & noHide Q)\"\n |\"noHide (!! :C .. Pf) = (ALL c. noHide (Pf c))\"\n |\"noHide (IF b THEN P ELSE Q) = (noHide P & noHide Q)\"\n |\"noHide (P |[X]| Q) = (noHide P & noHide Q)\"\n |\"noHide (P -- X) = noPN P\"\n |\"noHide (P [[r]]) = noHide P\"\n |\"noHide (P ;; Q) = (noHide P & noHide Q)\"\n |\"noHide (P |. n) = (noHide P | n=0)\"\n |\"noHide ($p) = True\"\n\n(*** guarded ***)\n\nprimrec\n guarded:: \"('p,'a) proc => bool\" (* guarded proc *)\nwhere\n \"guarded STOP = True\"\n |\"guarded SKIP = True\"\n |\"guarded DIV = True\"\n |\"guarded (a -> P) = noHide P\"\n |\"guarded (? :X -> Pf) = (ALL a. noHide (Pf a))\"\n |\"guarded (P [+] Q) = (guarded P & guarded Q)\"\n |\"guarded (P |~| Q) = (guarded P & guarded Q)\"\n |\"guarded (!! :C .. Pf) = (ALL c. guarded (Pf c))\"\n |\"guarded (IF b THEN P ELSE Q) = (guarded P & guarded Q)\"\n |\"guarded (P |[X]| Q) = (guarded P & guarded Q)\"\n |\"guarded (P -- X) = noPN P\"\n |\"guarded (P [[r]]) = guarded P\"\n |\"guarded (P ;; Q) = ((guarded P & gSKIP P & noHide Q) | \n (guarded P & guarded Q))\"\n |\"guarded (P |. n) = (guarded P | n=0)\"\n |\"guarded ($p) = False\"\n\n(*** for process function ***)\n\n(*\nconsts\n noPNfun :: \"('p => ('q,'a) proc) => bool\"\n gSKIPfun :: \"('p => ('q,'a) proc) => bool\"\n noHidefun :: \"('p => ('q,'a) proc) => bool\"\n guardedfun:: \"('p => ('q,'a) proc) => bool\"\n\ndefs\n noPNfun_def : \"noPNfun Pf == (ALL p. noPN (Pf p))\"\n gSKIPfun_def : \"gSKIPfun Pf == (ALL p. gSKIP (Pf p))\"\n noHidefun_def : \"noHidefun Pf == (ALL p. noHide (Pf p))\"\n guardedfun_def: \"guardedfun Pf == (ALL p. guarded (Pf p))\"\n*)\n\ndefinition\n noPNfun :: \"('p => ('q,'a) proc) => bool\"\n where \n \"noPNfun Pf == (ALL p. noPN (Pf p))\"\n\ndefinition\n gSKIPfun :: \"('p => ('q,'a) proc) => bool\"\n where\n \"gSKIPfun Pf == (ALL p. gSKIP (Pf p))\"\n\ndefinition\n noHidefun :: \"('p => ('q,'a) proc) => bool\"\n where\n \"noHidefun Pf == (ALL p. noHide (Pf p))\"\n\ndefinition\n guardedfun:: \"('p => ('q,'a) proc) => bool\"\n where\n \"guardedfun Pf == (ALL p. guarded (Pf p))\"\n\n (****** short notations ******)\n\n(* noPN *)\n\nlemma noPN_Rep_int_choice_set[simp]:\n \"noPN (!set :Xs .. Pf) = (ALL X. noPN (Pf X))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma noPN_Rep_int_choice_nat[simp]:\n \"noPN (!nat :N .. Pf) = (ALL n. noPN (Pf n))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma noPN_Rep_int_choice_com[simp]:\n \"noPN (! :X .. Pf) = (ALL a. noPN (Pf a))\"\napply (auto simp add: Rep_int_choice_com_def)\napply (drule_tac x=\"{a}\" in spec)\napply (simp)\ndone\n\nlemma noPN_Rep_int_choice_f[simp]:\n \"[| inj f ; ALL a. noPN (Pf a) |] ==> noPN (! :X .. Pf)\"\nby (simp add: Rep_int_choice_f_def)\n\nlemma noPN_Alpha_parallel[simp]:\n \"noPN (P |[X,Y]| Q) = (noPN P & noPN Q)\"\nby (simp add: Alpha_parallel_def)\n\n(* gSKIP *)\n\nlemma gSKIP_Rep_int_choice_set[simp]:\n \"gSKIP (!set :Xs .. Pf) = (ALL X. gSKIP (Pf X))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma gSKIP_Rep_int_choice_nat[simp]:\n \"gSKIP (!nat :N .. Pf) = (ALL n. gSKIP (Pf n))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma gSKIP_Rep_int_choice_com[simp]:\n \"gSKIP (! :X .. Pf) = (ALL a. gSKIP (Pf a))\"\napply (auto simp add: Rep_int_choice_com_def)\napply (drule_tac x=\"{a}\" in spec)\napply (simp)\ndone\n\nlemma gSKIP_Rep_int_choice_f[simp]:\n \"[| inj f ; ALL a. gSKIP (Pf a) |] ==> gSKIP (! :X .. Pf)\"\nby (simp add: Rep_int_choice_f_def)\n\nlemma gSKIP_Alpha_parallel[simp]:\n \"gSKIP (P |[X,Y]| Q) = (gSKIP P | gSKIP Q)\"\nby (simp add: Alpha_parallel_def)\n\n(* noHide *)\n\nlemma noHide_Rep_int_choice_set[simp]:\n \"noHide (!set :Xs .. Pf) = (ALL X. noHide (Pf X))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma noHide_Rep_int_choice_nat[simp]:\n \"noHide (!nat :N .. Pf) = (ALL n. noHide (Pf n))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma noHide_Rep_int_choice_com[simp]:\n \"noHide (! :X .. Pf) = (ALL a. noHide (Pf a))\"\napply (auto simp add: Rep_int_choice_com_def)\napply (drule_tac x=\"{a}\" in spec)\napply (simp)\ndone\n\nlemma noHide_Rep_int_choice_f[simp]:\n \"[| inj f ; ALL a. noHide (Pf a) |]\n ==> noHide (! :X .. Pf)\"\nby (simp add: Rep_int_choice_f_def)\n\nlemma noHide_Alpha_parallel[simp]:\n \"noHide (P |[X,Y]| Q) = (noHide P & noHide Q)\"\nby (simp add: Alpha_parallel_def)\n\n(* guarded *)\n\nlemma guarded_Rep_int_choice_set[simp]:\n \"guarded (!set :Xs .. Pf) = (ALL X. guarded (Pf X))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma guarded_Rep_int_choice_nat[simp]:\n \"guarded (!nat :N .. Pf) = (ALL n. guarded (Pf n))\"\nby (simp add: Rep_int_choice_ss_def)\n\nlemma guarded_Rep_int_choice_com[simp]:\n \"guarded (! :X .. Pf) = (ALL a. guarded (Pf a))\"\napply (auto simp add: Rep_int_choice_com_def)\napply (drule_tac x=\"{a}\" in spec)\napply (simp)\ndone\n\nlemma guarded_Rep_int_choice_f[simp]:\n \"[| inj f ; ALL a. guarded (Pf a) |] \n ==> guarded (! :X .. Pf)\"\nby (simp add: Rep_int_choice_f_def)\n\nlemma guarded_Alpha_parallel[simp]:\n \"guarded (P |[X,Y]| Q) = (guarded P & guarded Q)\"\nby (simp add: Alpha_parallel_def)\n\n\n(* --------- for sinding and receiving --------- *)\n\n(* noPN *)\n\nlemma noPN_Send_prefix[simp]:\n \"noPN (a ! v -> P) = noPN(P)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noPN_Rec_prefix[simp]:\n \"noPN (a ? x:X -> Pf x) = (ALL x. noPN(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noPN_Int_pre_choice[simp]:\n \"noPN (! :X -> Pf) = (ALL x. noPN(Pf x))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noPN__Nondet_send_prefix[simp]:\n \"noPN (a !? x:X -> Pf x) = (ALL x. noPN(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\n(* gSKIP *)\n\nlemma gSKIP_Send_prefix[simp]:\n \"gSKIP (a ! v -> P)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma gSKIP_Rec_prefix[simp]:\n \"gSKIP (a ? x:X -> Pf x)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma gSKIP_Int_pre_choice[simp]:\n \"gSKIP (! :X -> Pf)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma gSKIP__Nondet_send_prefix[simp]:\n \"gSKIP (a !? x:X -> Pf x)\"\nby (simp add: csp_prefix_ss_def)\n\n(* noHide *)\n\nlemma noHide_Send_prefix[simp]:\n \"noHide (a ! v -> P) = noHide(P)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noHide_Rec_prefix[simp]:\n \"noHide (a ? x:X -> Pf x) = (ALL x. noHide(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noHide_Int_pre_choice[simp]:\n \"noHide (! :X -> Pf) = (ALL x. noHide(Pf x))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma noHide__Nondet_send_prefix[simp]:\n \"noHide (a !? x:X -> Pf x) = (ALL x. noHide(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\n(* guarded *)\n\nlemma guarded_Send_prefix[simp]:\n \"guarded (a ! v -> P) = noHide(P)\"\nby (simp add: csp_prefix_ss_def)\n\nlemma guarded_Rec_prefix[simp]:\n \"guarded (a ? x:X -> Pf x) = (ALL x. noHide(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma guarded_Int_pre_choice[simp]:\n \"guarded (! :X -> Pf) = (ALL x. noHide(Pf x))\"\nby (simp add: csp_prefix_ss_def)\n\nlemma guarded__Nondet_send_prefix[simp]:\n \"guarded (a !? x:X -> Pf x) = (ALL x. noHide(Pf (inv a x)))\"\nby (simp add: csp_prefix_ss_def)\n\n(* --------- for pipe --------- *)\n\n(* noPN *)\n\nlemma noPN_Pipe[simp]:\n \"noPN (P <[left,mid,right]> Q) = ((noPN P) & (noPN Q))\"\nby (simp add: Pipe_def)\n\n(* gSKIP *)\n\nlemma gSKIP_Pipe[simp]:\n \"gSKIP (P <[left,mid,right]> Q) = False\"\nby (simp add: Pipe_def)\n\n(* noHide *)\n\nlemma noHide_Pipe[simp]:\n \"noHide (P <[left,mid,right]> Q) = (noPN P & noPN Q)\"\nby (simp add: Pipe_def)\n\n(* guarded *)\n\nlemma guarded_Pipe[simp]:\n \"guarded (P <[left,mid,right]> Q) = (noPN P & noPN Q)\"\nby (simp add: Pipe_def)\n\n(*-----------------------------------------------------*\n | Substitution |\n *-----------------------------------------------------*)\n\nlemma noPN_Subst_lm: \"noPN P --> noPN (P< noPN (P< noPN (P< noHide (P< noHide (P< gSKIP (P< gSKIP (P< guarded (P< guarded (P< P) : procterm\"\n \"(Pf a, ? :X -> Pf) : procterm\"\n \"(P, P [+] Q) : procterm\"\n \"(Q, P [+] Q) : procterm\"\n \"(P, P |~| Q) : procterm\"\n \"(Q, P |~| Q) : procterm\"\n \"(Pf c, !! :C .. Pf) : procterm\"\n \"(P, IF b THEN P ELSE Q) : procterm\"\n \"(Q, IF b THEN P ELSE Q) : procterm\"\n \"(P, P |[X]| Q) : procterm\"\n \"(Q, P |[X]| Q) : procterm\"\n \"(P, P -- X) : procterm\"\n \"(P, P [[r]]) : procterm\"\n \"(P, P ;; Q) : procterm\"\n \"(Q, P ;; Q) : procterm\"\n \"(P, P |. n) : procterm\"\n*)\n\ninductive_set\n procterm :: \"(('p,'a) proc * ('p,'a) proc) set\"\nwhere\n \"(P, a -> P) : procterm\" |\n \"(Pf a, ? :X -> Pf) : procterm\" |\n \"(P, P [+] Q) : procterm\" |\n \"(Q, P [+] Q) : procterm\" |\n \"(P, P |~| Q) : procterm\" |\n \"(Q, P |~| Q) : procterm\" |\n \"(Pf c, !! :C .. Pf) : procterm\" |\n \"(P, IF b THEN P ELSE Q) : procterm\" |\n \"(Q, IF b THEN P ELSE Q) : procterm\" |\n \"(P, P |[X]| Q) : procterm\" |\n \"(Q, P |[X]| Q) : procterm\" |\n \"(P, P -- X) : procterm\" |\n \"(P, P [[r]]) : procterm\" |\n \"(P, P ;; Q) : procterm\" |\n \"(Q, P ;; Q) : procterm\" |\n \"(P, P |. n) : procterm\"\n\nlemma wf_procterm: \"wf procterm\"\n apply (unfold wf_def)\n apply (intro strip)\n apply (induct_tac x)\n\n apply (erule allE, erule mp, intro strip,\n erule procterm.cases,\n simp, simp, simp, simp, simp, simp,\n simp, simp, simp, simp, simp, simp,\n simp, simp, simp, simp)+\ndone\n\n(* procterm.elims in Isabelle 2005 \n --> procterm.cases in Isabelle 2007 *)\n\n(*-------------------------------------------------------* \n | |\n | decompostion controlled by Not_Decompo_Flag |\n | |\n *-------------------------------------------------------*)\n(* Isabelle 2013\nconsts Not_Decompo_Flag :: bool\ndefs Not_Decompo_Flag_def : \"Not_Decompo_Flag == True\"\n*)\n\ndefinition\n Not_Decompo_Flag :: bool\n where\n Not_Decompo_Flag_def : \"Not_Decompo_Flag == True\"\n\nlemma on_Not_Decompo_Flag: \"Not_Decompo_Flag & R ==> R\"\nby (simp)\n\nlemma off_Not_Decompo_Flag: \"R ==> Not_Decompo_Flag & R\"\nby (simp add: Not_Decompo_Flag_def)\n\nlemma off_Not_Decompo_Flag_True: \"Not_Decompo_Flag\"\nby (simp add: Not_Decompo_Flag_def)\n\n(*\nML_setup {*\n val ON_Not_Decompo_Flag = thms \"on_Not_Decompo_Flag\";\n val OFF_Not_Decompo_Flag = thms \"off_Not_Decompo_Flag\";\n val OFF_Not_Decompo_Flag_True = thms \"off_Not_Decompo_Flag_True\";\n*}\nfor Isabelle 2007\n*)\n\nML {*\n val ON_Not_Decompo_Flag = @{thms on_Not_Decompo_Flag};\n val OFF_Not_Decompo_Flag = @{thms off_Not_Decompo_Flag};\n val OFF_Not_Decompo_Flag_True = @{thms off_Not_Decompo_Flag_True};\n*}\n\n(*-------------------------------------------------------* \n | |\n | rewriting controlled by Not_Rewrite_Flag |\n | CSP-Prover 5 |\n *-------------------------------------------------------*)\n(* Isabelle 2013\nconsts Not_Rewrite_Flag :: bool\ndefs Not_Rewrite_Flag_def : \"Not_Rewrite_Flag == True\"\n*)\n\ndefinition\n Not_Rewrite_Flag :: bool\n where\n \"Not_Rewrite_Flag == True\"\n\nlemma on_Not_Rewrite_Flag: \"Not_Rewrite_Flag & R ==> R\"\nby (simp)\n\nlemma off_Not_Rewrite_Flag: \"R ==> Not_Rewrite_Flag & R\"\nby (simp add: Not_Rewrite_Flag_def)\n\nlemma off_Not_Rewrite_Flag_True: \"Not_Rewrite_Flag\"\nby (simp add: Not_Rewrite_Flag_def)\n\nlemmas off_All_Flag_True = off_Not_Decompo_Flag_True\n off_Not_Rewrite_Flag_True\n\nML {*\n val ON_Not_Rewrite_Flag = @{thms on_Not_Rewrite_Flag};\n val OFF_Not_Rewrite_Flag = @{thms off_Not_Rewrite_Flag};\n val OFF_Not_Rewrite_Flag_True = @{thms off_Not_Rewrite_Flag_True};\n val OFF_All_Flag_True = @{thms off_All_Flag_True};\n*}\n\n(* 0 *)\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP/CSP_syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.38861802670584894, "lm_q1q2_score": 0.25859053313233016}} {"text": "chapter\\Heuristics\\\ntext\\As part of this inference technique, we make use of certain \\emph{heuristics} to abstract away\nconcrete values into registers. This allows us to generalise from examples of behaviour. These\nheuristics are as follows.\n\n\\begin{description}\n \\item [Store and Reuse] - This heuristic aims to recognise when input values are subsequently used\nas an output. Such behaviour is generalised by storing the relevant input in a register, and\nreplacing the literal output with the content of the register. This enables the EFSM to\n\\emph{predict} how the underlying system might behave when faced with unseen inputs.\n \\item [Increment and Reset] - This heuristic is a naive attempt to introduce additive behaviour.\nThe idea here is that if we want to merge two transitions with identical input values and different\nnumeric outputs, for example $\\textit{coin}:1[i_0=50]/o_0:=50$ and $\\textit{coin}:1[i_0=50]/o_0:=100$,\nthen the behaviour must depend on the value of an internal variable. This heuristic works by\ndropping the input guard and adding an update to a fresh register, in this case summing the current\nregister value with the input. A similar principle can be applied to other numeric functions such as\nsubtraction.\n \\item [Same Register] - Because of the way heuristics are applied, it is possible for different\nregisters to be introduced to serve the same purpose. This heuristic attempts to identify when this\nhas happened and merge the two registers.\n \\item [Least Upper Bound] - In certain situations, transitions may produce the same output for\ndifferent inputs. This technique forms the least upper bound of the transition guards\n--- their disjunction --- such that they can be merged into a single behaviour.\n \\item [Distinguishing Guards] - Under certain circumstances, we explicitly do not want to merge\ntwo transitions into one. This heuristic resolves nondeterminism between transitions by attempting\nto find apply mutually exclusive guards to each transition such that their behaviour is distinguished.\n\\end{description}\\\n\nsection\\Store and Reuse\\\ntext\\An obvious candidate for generalisation is the ``store and reuse'' pattern. This manifests\nitself when the input of one transition is subsequently used as the output of another. Recognising\nthis usage pattern allows us to introduce a \\emph{storage register} to abstract away concrete data\nvalues and replace two transitions whose outputs differ with a single transition that outputs the\ncontent of the register.\\\n\ntheory Store_Reuse\nimports \"../Inference\"\nbegin\ndatatype ioTag = In | Out\n\ninstantiation ioTag :: linorder begin\nfun less_ioTag :: \"ioTag \\ ioTag \\ bool\" where\n \"In < Out = True\" |\n \"Out < _ = False\" |\n \"In < In = False\"\n\ndefinition less_eq_ioTag :: \"ioTag \\ ioTag \\ bool\" where\n \"less_eq_ioTag x y = (x < y \\ x = y)\"\ndeclare less_eq_ioTag_def [simp]\n\ninstance\n apply standard\n using less_ioTag.elims(2) apply fastforce\n apply simp\n apply (metis ioTag.exhaust less_eq_ioTag_def)\n using less_eq_ioTag_def less_ioTag.elims(2) apply blast\n by (metis (full_types) ioTag.exhaust less_eq_ioTag_def less_ioTag.simps(1))\nend\n\ntype_synonym index = \"nat \\ ioTag \\ nat\"\n\nfun lookup :: \"index \\ trace \\ value\" where\n \"lookup (actionNo, In, inx) t = (let (_, inputs, _) = nth t actionNo in nth inputs inx)\" |\n \"lookup (actionNo, Out, inx) t = (let (_, _, outputs) = nth t actionNo in nth outputs inx)\"\n\nabbreviation actionNum :: \"index \\ nat\" where\n \"actionNum i \\ fst i\"\n\nabbreviation ioTag :: \"index \\ ioTag\" where\n \"ioTag i \\ fst (snd i)\"\n\nabbreviation inx :: \"index \\ nat\" where\n \"inx i \\ snd (snd i)\"\n\nprimrec index :: \"value list \\ nat \\ ioTag \\ nat \\ index fset\" where\n \"index [] _ _ _ = {||}\" |\n \"index (h#t) actionNo io ind = finsert (actionNo, io, ind) (index t actionNo io (ind + 1))\"\n\ndefinition io_index :: \"nat \\ value list \\ value list \\ index fset\" where\n \"io_index actionNo inputs outputs = (index inputs actionNo In 0) |\\| (index outputs actionNo Out 0)\"\n\ndefinition indices :: \"trace \\ index fset\" where\n \"indices e = foldl (|\\|) {||} (map (\\(actionNo, (label, inputs, outputs)). io_index actionNo inputs outputs) (enumerate 0 e))\"\n\ndefinition get_by_id_intratrace_matches :: \"trace \\ (index \\ index) fset\" where\n \"get_by_id_intratrace_matches e = ffilter (\\(a, b). lookup a e = lookup b e \\ actionNum a \\ actionNum b \\ a \\ b) (indices e |\\| indices e)\"\n\n(*\n If the EFSM is nondeterministic, we need to make sure it chooses the right path so that it recognises\n the input trace.\n*)\ndefinition i_step :: \"execution \\ iEFSM \\ cfstate \\ registers \\ label \\ inputs \\ (transition \\ cfstate \\ tids \\ registers) option\" where\n \"i_step tr e s r l i = (let\n poss_steps = (i_possible_steps e s r l i);\n possibilities = ffilter (\\(u, s', t). recognises_execution (tm e) s' (evaluate_updates t i r) tr) poss_steps in\n case random_member possibilities of\n None \\ None |\n Some (u, s', t) \\\n Some (t, s', u, (evaluate_updates t i r))\n )\"\n\ntype_synonym match = \"(((transition \\ tids) \\ ioTag \\ nat) \\ ((transition \\ tids) \\ ioTag \\ nat))\"\n\ndefinition \"exec2trace t = map (\\(label, inputs, _). (label, inputs)) t\"\nprimrec (nonexhaustive) walk_up_to :: \"nat \\ iEFSM \\ nat \\ registers \\ trace \\ (transition \\ tids)\" where\n \"walk_up_to n e s r (h#t) =\n (case (i_step (exec2trace t) e s r (fst h) (fst (snd h))) of\n (Some (transition, s', uid, updated)) \\ (case n of 0 \\ (transition, uid) | Suc m \\ walk_up_to m e s' updated t)\n )\"\n\ndefinition find_intertrace_matches_aux :: \"(index \\ index) fset \\ iEFSM \\ trace \\ match fset\" where\n \"find_intertrace_matches_aux intras e t = fimage (\\((e1, io1, inx1), (e2, io2, inx2)). (((walk_up_to e1 e 0 <> t), io1, inx1), ((walk_up_to e2 e 0 <> t), io2, inx2))) intras\"\n\ndefinition find_intertrace_matches :: \"log \\ iEFSM \\ match list\" where\n \"find_intertrace_matches l e = filter (\\((e1, io1, inx1), (e2, io2, inx2)). e1 \\ e2) (concat (map (\\(t, m). sorted_list_of_fset (find_intertrace_matches_aux m e t)) (zip l (map get_by_id_intratrace_matches l))))\"\n\ndefinition total_max_input :: \"iEFSM \\ nat\" where\n \"total_max_input e = (case EFSM.max_input (tm e) of None \\ 0 | Some i \\ i)\"\n\ndefinition total_max_reg :: \"iEFSM \\ nat\" where\n \"total_max_reg e = (case EFSM.max_reg (tm e) of None \\ 0 | Some i \\ i)\"\n\ndefinition remove_guard_add_update :: \"transition \\ nat \\ nat \\ transition\" where\n \"remove_guard_add_update t inputX outputX = \\\n Label = (Label t), Arity = (Arity t),\n Guards = (filter (\\g. \\ gexp_constrains g (V (vname.I inputX))) (Guards t)),\n Outputs = (Outputs t),\n Updates = (outputX, (V (vname.I inputX)))#(Updates t)\n \\\"\n\ndefinition generalise_output :: \"transition \\ nat \\ nat \\ transition\" where\n \"generalise_output t regX outputX = \\\n Label = (Label t),\n Arity = (Arity t),\n Guards = (Guards t),\n Outputs = list_update (Outputs t) outputX (V (R regX)),\n Updates = (Updates t)\n \\\"\n\ndefinition is_generalised_output_of :: \"transition \\ transition \\ nat \\ nat \\ bool\" where\n \"is_generalised_output_of t' t r p = (t' = generalise_output t r p)\"\n\nprimrec count :: \"'a \\ 'a list \\ nat\" where\n \"count _ [] = 0\" |\n \"count a (h#t) = (if a = h then 1+(count a t) else count a t)\"\n\ndefinition replaceAll :: \"iEFSM \\ transition \\ transition \\ iEFSM\" where\n \"replaceAll e old new = fimage (\\(uid, (from, dest), t). if t = old then (uid, (from, dest), new) else (uid, (from, dest), t)) e\"\n\nprimrec generalise_transitions :: \"((((transition \\ tids) \\ ioTag \\ nat) \\ (transition \\ tids) \\ ioTag \\ nat) \\\n ((transition \\ tids) \\ ioTag \\ nat) \\ (transition \\ tids) \\ ioTag \\ nat) list \\ iEFSM \\ iEFSM\" where\n \"generalise_transitions [] e = e\" |\n \"generalise_transitions (h#t) e = (let\n ((((orig1, u1), _), (orig2, u2), _), (((gen1, u1'), _), (gen2, u2), _)) = h in\n generalise_transitions t (replaceAll (replaceAll e orig1 gen1) orig2 gen2))\"\n\ndefinition strip_uids :: \"(((transition \\ tids) \\ ioTag \\ nat) \\ (transition \\ tids) \\ ioTag \\ nat) \\ ((transition \\ ioTag \\ nat) \\ (transition \\ ioTag \\ nat))\" where\n \"strip_uids x = (let (((t1, u1), io1, in1), (t2, u2), io2, in2) = x in ((t1, io1, in1), (t2, io2, in2)))\"\n\ndefinition modify :: \"match list \\ tids \\ tids \\ iEFSM \\ iEFSM option\" where\n \"modify matches u1 u2 old = (let relevant = filter (\\(((_, u1'), io, _), (_, u2'), io', _). io = In \\ io' = Out \\ (u1 = u1' \\ u2 = u1' \\ u1 = u2' \\ u2 = u2')) matches;\n newReg = case max_reg old of None \\ 1 | Some r \\ r + 1;\n replacements = map (\\(((t1, u1), io1, inx1), (t2, u2), io2, inx2). (((remove_guard_add_update t1 inx1 newReg, u1), io1, inx1), (generalise_output t2 newReg inx2, u2), io2, inx2)) relevant;\n comparisons = zip relevant replacements;\n stripped_replacements = map strip_uids replacements;\n to_replace = filter (\\(_, s). count (strip_uids s) stripped_replacements > 1) comparisons in\n if to_replace = [] then None else Some ((generalise_transitions to_replace old))\n )\"\n\n(* type_synonym update_modifier = \"transition \\ transition \\ nat \\ iEFSM \\ iEFSM \\ (iEFSM \\ (nat \\ nat) \\ (nat \\ nat)) option\" *)\ndefinition heuristic_1 :: \"log \\ update_modifier\" where\n \"heuristic_1 l t1 t2 s new _ old check = (case modify (find_intertrace_matches l old) t1 t2 new of\n None \\ None |\n Some e \\ if check (tm e) then Some e else None\n )\"\n\nlemma remove_guard_add_update_preserves_outputs:\n \"Outputs (remove_guard_add_update t i r) = Outputs t\"\n by (simp add: remove_guard_add_update_def)\n\nlemma remove_guard_add_update_preserves_label:\n \"Label (remove_guard_add_update t i r) = Label t\"\n by (simp add: remove_guard_add_update_def)\n\nlemma remove_guard_add_update_preserves_arity:\n \"Arity (remove_guard_add_update t i r) = Arity t\"\n by (simp add: remove_guard_add_update_def)\n\nlemmas remove_guard_add_update_preserves = remove_guard_add_update_preserves_label\n remove_guard_add_update_preserves_arity\n remove_guard_add_update_preserves_outputs\n\ndefinition is_generalisation_of :: \"transition \\ transition \\ nat \\ nat \\ bool\" where\n \"is_generalisation_of t' t i r = (t' = remove_guard_add_update t i r \\\n i < Arity t \\\n (\\v. Eq (V (vname.I i)) (L v) \\ set (Guards t)) \\\n r \\ set (map fst (Updates t)))\"\n\nlemma generalise_output_preserves_label:\n \"Label (generalise_output t r p) = Label t\"\n by (simp add: generalise_output_def)\n\nlemma generalise_output_preserves_arity:\n \"Arity (generalise_output t r p) = Arity t\"\n by (simp add: generalise_output_def)\n\nlemma generalise_output_preserves_guard:\n \"Guards (generalise_output t r p) = Guards t\"\n by (simp add: generalise_output_def)\n\nlemma generalise_output_preserves_output_length:\n \"length (Outputs (generalise_output t r p)) = length (Outputs t)\"\n by (simp add: generalise_output_def)\n\nlemma generalise_output_preserves_updates:\n \"Updates (generalise_output t r p) = Updates t\"\n by (simp add: generalise_output_def)\n\nlemmas generalise_output_preserves = generalise_output_preserves_label\n generalise_output_preserves_arity\n generalise_output_preserves_output_length\n generalise_output_preserves_guard\n generalise_output_preserves_updates\n\ndefinition is_proper_generalisation_of :: \"transition \\ transition \\ iEFSM \\ bool\" where\n \"is_proper_generalisation_of t' t e = (\\i \\ total_max_input e. \\ r \\ total_max_reg e.\n is_generalisation_of t' t i r \\\n (\\u \\ set (Updates t). fst u \\ r) \\\n (\\i \\ max_input (tm e). \\u \\ set (Updates t). fst u \\ r)\n )\"\n\n(* Recognising the same input used in multiple guards *)\ndefinition generalise_input :: \"transition \\ nat \\ nat \\ transition\" where\n \"generalise_input t r i = \\\n Label = Label t,\n Arity = Arity t,\n Guards = map (\\g. case g of Eq (V (I i')) (L _) \\ if i = i' then Eq (V (I i)) (V (R r)) else g | _ \\ g) (Guards t),\n Outputs = Outputs t,\n Updates = Updates t\n \\\"\n\nfun structural_count :: \"((transition \\ ioTag \\ nat) \\ (transition \\ ioTag \\ nat)) \\ ((transition \\ ioTag \\ nat) \\ (transition \\ ioTag \\ nat)) list \\ nat\" where\n \"structural_count _ [] = 0\" |\n \"structural_count a (((t1', io1', i1'), (t2', io2', i2'))#t) = (\n let ((t1, io1, i1), (t2, io2, i2)) = a in\n if same_structure t1 t1' \\ same_structure t2 t2' \\\n io1 = io1' \\ io2 = io2' \\\n i1 = i1' \\ i2 = i2'\n then\n 1+(structural_count a t)\n else\n structural_count a t\n )\"\n\ndefinition remove_guards_add_update :: \"transition \\ nat \\ nat \\ transition\" where\n \"remove_guards_add_update t inputX outputX = \\\n Label = (Label t), Arity = (Arity t),\n Guards = [],\n Outputs = (Outputs t),\n Updates = (outputX, (V (vname.I inputX)))#(Updates t)\n \\\"\n\ndefinition modify_2 :: \"match list \\ tids \\ tids \\ iEFSM \\ iEFSM option\" where\n \"modify_2 matches u1 u2 old = (let relevant = filter (\\(((_, u1'), io, _), (_, u2'), io', _). io = In \\ io' = In \\ (u1 = u1' \\ u2 = u1' \\ u1 = u2' \\ u2 = u2')) matches;\n newReg = case max_reg old of None \\ 1 | Some r \\ r + 1;\n replacements = map (\\(((t1, u1), io1, inx1), (t2, u2), io2, inx2).\n (((remove_guards_add_update t1 inx1 newReg, u1), io1, inx1),\n (generalise_input t2 newReg inx2, u2), io2, inx2)) relevant;\n comparisons = zip relevant replacements;\n stripped_replacements = map strip_uids replacements;\n to_replace = filter (\\(_, s). structural_count (strip_uids s) stripped_replacements > 1) comparisons in\n if to_replace = [] then None else Some ((generalise_transitions to_replace old))\n )\"\n\n(* type_synonym update_modifier = \"transition \\ transition \\ nat \\ iEFSM \\ iEFSM \\ (iEFSM \\ (nat \\ nat) \\ (nat \\ nat)) option\" *)\ndefinition heuristic_2 :: \"log \\ update_modifier\" where\n \"heuristic_2 l t1 t2 s new _ old check = (case modify_2 (find_intertrace_matches l old) t1 t2 new of\n None \\ None |\n Some e \\ if check (tm e) then Some e else None\n )\"\nhide_const ioTag.In\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/heuristics/Store_Reuse.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.25843409746310547}} {"text": "(*\n Author: David Sanan \n Maintainer: David Sanan, sanan@ntu.edu.sg\n License: LGPL\n*)\n\n(* Title: Hoare.thy\n Author: Norbert Schirmer, TU Muenchen\n \t David Sanan, NTU Singapore\n\nCopyright (C) 2016-2020 David Sanan, 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Auxiliary Definitions/Lemmas to Facilitate Hoare Logic *}\ntheory Hoare imports LocalRG_HoareDef begin\n\n(*\nsyntax \n\n\"_hoarep_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\ (_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoarep_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoarep_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\ (_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\n\n\"_hoaret_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/\\\\<^sub>t (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/\\\\<^sub>t (_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoaret_noAbr\"::\n\"[('s,'p,'f) body,'f set, ('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoaret_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/\\\\<^sub>t (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/\\\\<^sub>t (_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\nsyntax (ascii)\n\n\"_hoarep_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] \\ bool\"\n (\"(3_,_/|- (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-'/_ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoarep_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-(_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoarep_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-'/_ (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoarep_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-(_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-'/_ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoarep_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-(_/ (_)/ _))\" [61,1000,20,1000]60)\n\n\"_hoaret_emptyFault\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,\n 's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_,_/|-t (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-t'/_ (_/ (_)/ _,/_))\" [61,60,1000,20,1000,1000]60)\n\n\"_hoaret_emptyCtx_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n (\"(3_/|-t(_/ (_)/ _,/_))\" [61,1000,20,1000,1000]60)\n\n\"_hoaret_noAbr\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n 's assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-t'/_ (_/ (_)/ _))\" [61,60,60,1000,20,1000]60)\n\n\"_hoaret_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,('s,'p) quadruple set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_,_/|-t(_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr\"::\n\"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-t'/_ (_/ (_)/ _))\" [61,60,1000,20,1000]60)\n\n\"_hoaret_emptyCtx_noAbr_emptyFaults\"::\n\"[('s,'p,'f) body,'s assn,('s,'p,'f) com, 's assn] => bool\"\n (\"(3_/|-t(_/ (_)/ _))\" [61,1000,20,1000]60)\n*)\n(*\ntranslations\n \n\n \"\\\\ P c Q,A\" == \"\\\\\\<^bsub>/{}\\<^esub> P c Q,A\" \n \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" == \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n \"\\,\\\\ P c Q\" == \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q\" == \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\,\\\\ P c Q,A\" == \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\" \n\n \"\\\\ P c Q\" == \"\\\\\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\\\\\<^bsub>/F\\<^esub> P c Q\" == \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q\"\n \"\\\\\\<^bsub>/F\\<^esub> P c Q\" <= \"\\\\\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\\\ P c Q\" <= \"\\\\ P c Q,{}\"\n\n\n\n\n \"\\\\\\<^sub>t P c Q,A\" == \"\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" == \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n \"\\,\\\\\\<^sub>t P c Q\" == \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" == \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\,\\\\\\<^sub>t P c Q,A\" == \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n \n \"\\\\\\<^sub>t P c Q\" == \"\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" == \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\" <= \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,{}\"\n \"\\\\\\<^sub>t P c Q\" <= \"\\\\\\<^sub>t P c Q,{}\"\n\n\nterm \"\\\\ P c Q\"\nterm \"\\\\ P c Q,A\"\n\nterm \"\\\\\\<^bsub>/F\\<^esub> P c Q\"\nterm \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\nterm \"\\,\\\\ P c Q\"\nterm \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q\"\n\nterm \"\\,\\\\ P c Q,A\"\nterm \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nterm \"\\\\\\<^sub>t P c Q\"\nterm \"\\\\\\<^sub>t P c Q,A\"\n\nterm \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\nterm \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\nterm \"\\,\\\\ P c Q\"\nterm \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q\"\n\nterm \"\\,\\\\ P c Q,A\"\nterm \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n*)\n\nlocale hoare =\n fixes \\::\"('s,'p,'f,'a) body\" \n\n\nprimrec assoc:: \"('a \\'b) list \\ 'a \\ 'b \"\nwhere\n\"assoc [] x = undefined\" |\n\"assoc (p#ps) x = (if fst p = x then (snd p) else assoc ps x)\"\n\nlemma conjE_simp: \"(P \\ Q \\ PROP R) \\ (P \\ Q \\ PROP R)\"\n by rule simp_all\n\nlemma CollectInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma Compl_Collect:\"-(Collect b) = {x. \\(b x)}\"\n by fastforce\n\nlemma Collect_False: \"{s. False} = {}\"\n by simp\n\nlemma Collect_True: \"{s. True} = UNIV\"\n by simp\n\nlemma triv_All_eq: \"\\x. P \\ P\"\n by simp\n\nlemma triv_Ex_eq: \"\\x. P \\ P\"\n by simp\n\nlemma Ex_True: \"\\b. b\"\n by blast\n\nlemma Ex_False: \"\\b. \\b\"\n by blast\n\ndefinition mex::\"('a \\ bool) \\ bool\"\n where \"mex P = Ex P\"\n\ndefinition meq::\"'a \\ 'a \\ bool\"\n where \"meq s Z = (s = Z)\"\n\nlemma subset_unI1: \"A \\ B \\ A \\ B \\ C\" \n by blast\n\nlemma subset_unI2: \"A \\ C \\ A \\ B \\ C\" \n by blast\n\nlemma split_paired_UN: \"(\\p. (P p)) = (\\a b. (P (a,b)))\" \n by auto\n\nlemma in_insert_hd: \"f \\ insert f X\"\n by simp\n \nlemma lookup_Some_in_dom: \"\\ p = Some bdy \\ p \\ dom \\\"\n by auto\n\nlemma unit_object: \"(\\u::unit. P u) = P ()\"\n by auto\n\nlemma unit_ex: \"(\\u::unit. P u) = P ()\"\n by auto\n\nlemma unit_meta: \"(\\(u::unit). PROP P u) \\ PROP P ()\"\n by auto\n\nlemma unit_UN: \"(\\z::unit. P z) = P ()\"\n by auto\n\nlemma subset_singleton_insert1: \"y = x \\ {y} \\ insert x A\"\n by auto\n\nlemma subset_singleton_insert2: \"{y} \\ A \\ {y} \\ insert x A\"\n by auto\n\nlemma in_Specs_simp: \"(\\x\\\\Z. {(P Z, p, Q Z, A Z)}. Prop x) =\n (\\Z. Prop (P Z,p,Q Z,A Z))\"\n by auto\n\nlemma in_set_Un_simp: \"(\\x\\A \\ B. P x) = ((\\x \\ A. P x) \\ (\\x \\ B. P x))\"\n by auto\n\nlemma split_all_conj: \"(\\x. P x \\ Q x) = ((\\x. P x) \\ (\\x. Q x))\"\n by blast\n\nlemma image_Un_single_simp: \"f ` (\\Z. {P Z}) = (\\Z. {f (P Z)}) \"\n by auto\n\n\n\nlemma measure_lex_prod_def': \n \"f <*mlex*> r \\ ({(x,y). (x,y) \\ measure f \\ f x=f y \\ (x,y) \\ r})\"\n by (auto simp add: mlex_prod_def inv_image_def)\n\nlemma in_measure_iff: \"(x,y) \\ measure f = (f x < f y)\"\n by (simp add: measure_def inv_image_def)\n\nlemma in_lex_iff: \n \"((a,b),(x,y)) \\ r <*lex*> s = ((a,x) \\ r \\ (a=x \\ (b,y)\\s))\"\n by (simp add: lex_prod_def)\n\nlemma in_mlex_iff:\n \"(x,y) \\ f <*mlex*> r = (f x < f y \\ (f x=f y \\ (x,y) \\ r))\"\n by (simp add: measure_lex_prod_def' in_measure_iff)\n\nlemma in_inv_image_iff: \"(x,y) \\ inv_image r f = ((f x, f y) \\ r)\" \n by (simp add: inv_image_def)\n\ntext {* This is actually the same as @{thm [source] wf_mlex}. However, this basic\nproof took me so long that I'm not willing to delete it.\n*}\nlemma wf_measure_lex_prod [simp,intro]:\n assumes wf_r: \"wf r\"\n shows \"wf (f <*mlex*> r)\"\nproof (rule ccontr)\n assume \" \\ wf (f <*mlex*> r)\"\n then\n obtain g where \"\\i. (g (Suc i), g i) \\ f <*mlex*> r\"\n by (auto simp add: wf_iff_no_infinite_down_chain)\n hence g: \"\\i. (g (Suc i), g i) \\ measure f \\\n f (g (Suc i)) = f (g i) \\ (g (Suc i), g i) \\ r\"\n by (simp add: measure_lex_prod_def')\n hence le_g: \"\\i. f (g (Suc i)) \\ f (g i)\"\n by (auto simp add: in_measure_iff order_le_less)\n have \"wf (measure f)\"\n by simp\n hence \" \\Q. (\\x. x \\ Q) \\ (\\z\\Q. \\y. (y, z) \\ measure f \\ y \\ Q)\"\n by (simp add: wf_eq_minimal)\n from this [rule_format, of \"g ` UNIV\"]\n have \"\\z. z \\ range g \\ (\\y. (y, z) \\ measure f \\ y \\ range g)\"\n by auto\n then obtain z where \n z: \"z \\ range g\" and\n min_z: \"\\y. f y < f z \\ y \\ range g\"\n by (auto simp add: in_measure_iff)\n from z obtain k where \n k: \"z = g k\"\n by auto\n have \"\\i. k \\ i \\ f (g i) = f (g k)\" \n proof (intro allI impI) \n fix i\n assume \"k \\ i\" then show \"f (g i) = f (g k)\"\n proof (induct i)\n case 0\n have \"k \\ 0\" by fact hence \"k = 0\" by simp\n thus \"f (g 0) = f (g k)\"\n by simp\n next\n case (Suc n)\n have k_Suc_n: \"k \\ Suc n\" by fact\n then show \"f (g (Suc n)) = f (g k)\"\n proof (cases \"k = Suc n\")\n case True\n thus ?thesis by simp\n next\n case False\n with k_Suc_n\n have \"k \\ n\"\n by simp\n with Suc.hyps\n have n_k: \"f (g n) = f (g k)\" by simp\n from le_g have le: \"f (g (Suc n)) \\ f (g n)\"\n by simp\n show ?thesis\n proof (cases \"f (g (Suc n)) = f (g n)\")\n case True with n_k show ?thesis by simp\n next\n case False\n with le have \"f (g (Suc n)) < f (g n)\"\n by simp\n with n_k k have \"f (g (Suc n)) < f z\"\n by simp\n with min_z have \"g (Suc n) \\ range g\"\n by blast\n hence False by simp\n thus ?thesis\n by simp\n qed\n qed\n qed\n qed\n with k [symmetric] have \"\\i. k \\ i \\ f (g i) = f z\" \n by simp\n hence \"\\i. k \\ i \\ f (g (Suc i)) = f (g i)\"\n by simp\n with g have \"\\i. k \\ i \\ (g (Suc i),(g i)) \\ r\"\n by (auto simp add: in_measure_iff order_less_le )\n hence \"\\i. (g (Suc (i+k)),(g (i+k))) \\ r\"\n by simp\n then\n have \"\\f. \\i. (f (Suc i), f i) \\ r\"\n by - (rule exI [where x=\"\\i. g (i+k)\"],simp) \n with wf_r show False\n by (simp add: wf_iff_no_infinite_down_chain)\nqed\n\nlemmas all_imp_to_ex = all_simps (5) \n(*\"!!P Q. (ALL x. P x --> Q) = ((EX x. P x) --> Q)\"\n\n Avoid introduction of existential quantification of states on negative\n position.\n*)\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2584340904811179}} {"text": "section \\Code Generation for SCC-Computation \\label{sec:scc_code}\\\ntheory Gabow_SCC_Code\nimports \n Gabow_SCC \n Gabow_Skeleton_Code\n CAVA_Base.CAVA_Code_Target\nbegin\n\n\nsection \\Automatic Refinement to Efficient Data Structures\\\ncontext fr_graph_impl_loc\nbegin\n schematic_goal last_seg_code_aux: \n \"(?c,last_seg_impl)\\GSi_rel \\ \\\\node_rel\\list_set_rel\\nres_rel\"\n unfolding last_seg_impl_def_opt[abs_def] \n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal,trace))\n done\n concrete_definition (in -) last_seg_code \n uses fr_graph_impl_loc.last_seg_code_aux\n lemmas [autoref_rules] = last_seg_code.refine[OF locale_this]\n\n context begin interpretation autoref_syn .\n\n \n\n schematic_goal compute_SCC_code_aux:\n \"(?c,compute_SCC_impl) \\ \\\\\\node_rel\\list_set_rel\\list_rel\\nres_rel\"\n unfolding compute_SCC_impl_def[abs_def] initial_impl_def GS_initial_impl_def\n unfolding path_is_empty_impl_def is_on_stack_impl_def is_done_impl_def \n is_done_oimpl_def\n unfolding GS.is_on_stack_impl_def GS.is_done_impl_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal,trace))\n done\n\n concrete_definition (in -) compute_SCC_code \n uses fr_graph_impl_loc.compute_SCC_code_aux\n lemmas [autoref_rules] = compute_SCC_code.refine[OF locale_this] \n\n schematic_goal last_seg_tr_aux: \"RETURN ?c \\ last_seg_code s\"\n unfolding last_seg_code_def by refine_transfer\n concrete_definition (in -) last_seg_tr uses fr_graph_impl_loc.last_seg_tr_aux\n lemmas [refine_transfer] = last_seg_tr.refine[OF locale_this]\n\n schematic_goal compute_SCC_tr_aux: \"RETURN ?c \\ compute_SCC_code node_eq_impl node_hash_impl node_def_hash_size g\"\n unfolding compute_SCC_code_def by refine_transfer\n concrete_definition (in -) compute_SCC_tr \n uses fr_graph_impl_loc.compute_SCC_tr_aux\n lemmas [refine_transfer] = compute_SCC_tr.refine[OF locale_this]\nend\n\nexport_code compute_SCC_tr checking SML\n\nsection \\Correctness Theorem\\\n\ntheorem compute_SCC_tr_correct:\n \\ \\Correctness theorem for the constant we extracted to SML\\\n fixes Re and node_rel :: \"('vi \\ 'v) set\"\n fixes G :: \"('v,'more) graph_rec_scheme\"\n assumes A: \n \"(G_impl,G)\\\\Re,node_rel\\g_impl_rel_ext\"\n \"(node_eq_impl, (=)) \\ node_rel \\ node_rel \\ bool_rel\"\n \"is_bounded_hashcode node_rel node_eq_impl node_hash_impl\"\n \"(is_valid_def_hm_size TYPE('vi) node_def_hash_size)\"\n \n assumes C: \"fr_graph G\"\n shows \"RETURN (compute_SCC_tr node_eq_impl node_hash_impl node_def_hash_size G_impl) \n \\ \\(\\\\node_rel\\list_set_rel\\list_rel) (fr_graph.compute_SCC_spec G)\"\nproof -\n from C interpret fr_graph G .\n have I: \"fr_graph_impl_loc Re node_rel node_eq_impl node_hash_impl node_def_hash_size G_impl G\"\n apply unfold_locales using A .\n then interpret fr_graph_impl_loc Re node_rel node_eq_impl node_hash_impl node_def_hash_size G_impl G .\n\n note compute_SCC_tr.refine[OF I]\n also note compute_SCC_code.refine[OF I, THEN nres_relD]\n also note compute_SCC_impl_refine\n also note compute_SCC_correct\n finally show ?thesis using A by simp\nqed\n\nsection \\Extraction of Benchmark Code\\\n\nschematic_goal list_set_of_list_aux: \n \"(?c,set)\\\\nat_rel\\list_rel \\ \\nat_rel\\list_set_rel\"\n by autoref\nconcrete_definition list_set_of_list uses list_set_of_list_aux\n\nterm compute_SCC_tr\n\ndefinition compute_SCC_tr_nat :: \"_ \\ _ \\ _ \\ _ \\ nat list list\"\n where \"compute_SCC_tr_nat \\ compute_SCC_tr\"\n\n(*export_code \n compute_SCC_tr_nat\n succ_of_list_impl\n nat_of_integer\n integer_of_nat\n list_set_of_list\n in SML module_name CSCC_Gabow\n file \"Gabow_Benchmark/cscc_gabow.sml\"\n*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Gabow_SCC/Gabow_SCC_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2584233853947827}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: SmallStepCon.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Small-Step Semantics and Infinite Computations*} \n\ntheory SmallStepCon imports \"EmbSimpl.SmallStep\" \"SemanticCon\" \n \"TerminationCon\"\n (* \"Sep_Algebra.Sep_Heap_Instance\" \n \"Actions.ActionsSemantics\" *)\nbegin\n\ntext {* The redex of a statement is the substatement, which is actually altered\nby the next step in the small-step semantics.\n*}\nprimrec redex:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com\"\nwhere\n\"redex Skip = Skip\" |\n\"redex (Basic f e) = (Basic f e)\" |\n\"redex (Spec r e) = (Spec r e)\" |\n\"redex (Seq c\\<^sub>1 c\\<^sub>2) = redex c\\<^sub>1\" |\n\"redex (Cond b c\\<^sub>1 c\\<^sub>2) = (Cond b c\\<^sub>1 c\\<^sub>2)\" |\n\"redex (While b c) = (While b c)\" |\n\"redex (Call p) = (Call p)\" |\n\"redex (DynCom d) = (DynCom d)\" |\n\"redex (Guard f b c) = (Guard f b c)\" |\n\"redex (Throw) = Throw\" |\n\"redex (Catch c\\<^sub>1 c\\<^sub>2) = redex c\\<^sub>1\" |\n\"redex (Await b c e) = (Await b c e)\"\n\n\n\nsubsection {*Small-Step Computation: @{text \"\\\\\\<^sub>c(c, s) \\ (c', s')\"}*}\ntype_synonym ('s,'p,'f,'e) config = \"('s,'p,'f,'e)com \\ ('s,'f) xstate\"\n\ninductive \n \"step_e\"::\"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('s,'p,'f,'e) body\"\nwhere\nEnv: \"\\\\\\<^sub>c (Ps, Normal s) \\\\<^sub>e (Ps, t)\"\n|Env_n: \"(\\t'. t\\Normal t') \\ \\\\\\<^sub>c (Ps, t) \\\\<^sub>e (Ps, t)\"\n\nlemma etranE: \"\\\\\\<^sub>c c \\\\<^sub>e c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule step_e.cases, blast)\n\ninductive_cases stepe_Normal_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Ps,Normal s) \\\\<^sub>e (Ps,t)\"\n\ninductive_cases stepe_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,t)\"\n\ninductive_cases stepe_not_norm_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,Abrupt t)\"\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,Stuck)\"\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,Fault t)\"\n \"\\\\\\<^sub>c(Ps,s) \\\\<^sub>e (Ps,Normal t)\"\n\nlemma env_c_c'_false:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" \n shows \"~(c=c') \\ P\"\nusing step_m etranE by blast\n\nlemma eenv_normal_s'_normal_s:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', Normal s')\" \n shows \"(\\s1. s\\Normal s1) \\ P\"\nusing step_m \nby (cases, auto)\n\nlemma env_normal_s'_normal_s:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', Normal s') \" \n shows \"\\s1. s= Normal s1\"\nusing step_m \nby (cases, auto)\n\nlemma env_c_c':\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" \n shows \"(c=c')\"\nusing env_c_c'_false step_m by fastforce \n\nlemma env_normal_s:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s') \\ s\\s'\" \n shows \"\\sa. s = Normal sa\"\nusing prod.inject step_e.cases step_m by fastforce\n\nlemma env_not_normal_s:\n assumes a1:\"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" and a2:\"(\\t. s\\Normal t)\" \n shows \"s=s'\"\nusing a1 a2\nby (cases rule:step_e.cases,auto) \n\nlemma env_not_normal_s_not_norma_t:\n assumes a1:\"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" and a2:\"(\\t. s\\Normal t)\" \n shows \"(\\t. s'\\Normal t)\"\nusing a1 a2 env_not_normal_s\nby blast\n\nlemma stepe_not_Fault_f_end:\n assumes step_e: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\\\<^sub>e (c\\<^sub>1', s')\"\n shows \"s'\\ Fault ` f \\ s \\ Fault ` f\"\nproof (cases s) \n case (Fault f')\n assume s'_f:\"s' \\ Fault ` f\" and\n \"s = Fault f'\" \n then have \"s=s'\" using step_e \n using env_normal_s xstate.distinct(3) by blast \n thus ?thesis using s'_f Fault by blast\nqed (auto)\n\ninductive \n \"stepc\"::\"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\/ _)\" [81,81,81] 100) \n for \\::\"('s,'p,'f,'e) body\"\nwhere\n\n Basicc: \"\\\\\\<^sub>c(Basic f e,Normal s) \\ (Skip,Normal (f s))\"\n\n| Specc: \"(s,t) \\ r \\ \\\\\\<^sub>c(Spec r e,Normal s) \\ (Skip,Normal t)\"\n| SpecStuckc: \"\\t. (s,t) \\ r \\ \\\\\\<^sub>c(Spec r e,Normal s) \\ (Skip,Stuck)\"\n\n| Guardc: \"s\\g \\ \\\\\\<^sub>c(Guard f g c,Normal s) \\ (c,Normal s)\"\n \n| GuardFaultc: \"s\\g \\ \\\\\\<^sub>c(Guard f g c,Normal s) \\ (Skip,Fault f)\"\n\n\n| Seqc: \"\\\\\\<^sub>c(c\\<^sub>1,s) \\ (c\\<^sub>1',s')\n \\ \n \\\\\\<^sub>c(Seq c\\<^sub>1 c\\<^sub>2,s) \\ (Seq c\\<^sub>1' c\\<^sub>2, s')\"\n| SeqSkipc: \"\\\\\\<^sub>c(Seq Skip c\\<^sub>2,s) \\ (c\\<^sub>2, s)\"\n| SeqThrowc: \"\\\\\\<^sub>c(Seq Throw c\\<^sub>2,Normal s) \\ (Throw, Normal s)\"\n\n| CondTruec: \"s\\b \\ \\\\\\<^sub>c(Cond b c\\<^sub>1 c\\<^sub>2,Normal s) \\ (c\\<^sub>1,Normal s)\"\n| CondFalsec: \"s\\b \\ \\\\\\<^sub>c(Cond b c\\<^sub>1 c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n\n| WhileTruec: \"\\s\\b\\ \n \\ \n \\\\\\<^sub>c(While b c,Normal s) \\ (Seq c (While b c),Normal s)\"\n\n| WhileFalsec: \"\\s\\b\\ \n \\ \n \\\\\\<^sub>c(While b c,Normal s) \\ (Skip,Normal s)\"\n\n\n| Awaitc: \"\\s\\b; \\1=\\\\<^sub>\\\\<^sub>a ; \\1\\\\ca1,Normal s\\ \\ t; \n \\(\\t'. t = Abrupt t')\\ \\ \n \\\\\\<^sub>c(Await b ca1 e,Normal s) \\ (Skip,t)\"\n\n| AwaitAbruptc: \"\\s\\b; \\1=\\\\<^sub>\\\\<^sub>a ; \\1\\\\ca1,Normal s\\ \\ t; \n t = Abrupt t'\\ \\ \n \\\\\\<^sub>c(Await b ca1 e,Normal s) \\ (Throw,Normal t')\"\n\n| Callc: \"\\\\ p = Some bdy ; bdy\\Call p\\ \\\n \\\\\\<^sub>c(Call p,Normal s) \\ (bdy,Normal s)\"\n\n| CallUndefinedc: \"\\ p=None \\\n \\\\\\<^sub>c(Call p,Normal s) \\ (Skip,Stuck)\"\n\n| DynComc: \"\\\\\\<^sub>c(DynCom c,Normal s) \\ (c s,Normal s)\"\n\n| Catchc: \"\\\\\\\\<^sub>c(c\\<^sub>1,s) \\ (c\\<^sub>1',s')\\\n \\\n \\\\\\<^sub>c(Catch c\\<^sub>1 c\\<^sub>2,s) \\ (Catch c\\<^sub>1' c\\<^sub>2,s')\"\n\n| CatchThrowc: \"\\\\\\<^sub>c(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n| CatchSkipc: \"\\\\\\<^sub>c(Catch Skip c\\<^sub>2,s) \\ (Skip,s)\"\n\n| FaultPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Fault f) \\ (Skip,Fault f)\"\n| StuckPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Stuck) \\ (Skip,Stuck)\"\n| AbruptPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Abrupt f) \\ (Skip,Abrupt f)\"\n \nlemmas stepc_induct = stepc.induct [of _ \"(c,s)\" \"(c',s')\", split_format (complete), case_names\nBasicc Specc SpecStuckc Guardc GuardFaultc Seqc SeqSkipc SeqThrowc CondTruec CondFalsec\nWhileTruec WhileFalsec Awaitc AwaitAbruptc Callc CallUndefinedc DynComc Catchc CatchThrowc CatchSkipc\nFaultPropc StuckPropc AbruptPropc, induct set]\n\n\ninductive_cases stepc_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Skip,s) \\ u\"\n \"\\\\\\<^sub>c(Guard f g c,s) \\ u\"\n \"\\\\\\<^sub>c(Basic f e,s) \\ u\"\n \"\\\\\\<^sub>c(Spec r e,s) \\ u\"\n \"\\\\\\<^sub>c(Seq c1 c2,s) \\ u\"\n \"\\\\\\<^sub>c(Cond b c1 c2,s) \\ u\"\n \"\\\\\\<^sub>c(While b c,s) \\ u\"\n \"\\\\\\<^sub>c(Await b c2 e,s) \\ u\"\n \"\\\\\\<^sub>c(Call p,s) \\ u\"\n \"\\\\\\<^sub>c(DynCom c,s) \\ u\"\n \"\\\\\\<^sub>c(Throw,s) \\ u\"\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ u\"\n\ninductive_cases stepc_not_normal_elim_cases:\n \"\\\\\\<^sub>c(Call p,Abrupt s) \\ (p',s')\"\n \"\\\\\\<^sub>c(Call p, Fault f) \\ (p',s')\"\n \"\\\\\\<^sub>c(Call p, Stuck) \\ (p',s')\"\n \n\nlemma Guardc_not_c:\"Guard f g c \\ c\"\nproof (induct c)\nqed auto\n\nlemma Catch_not_c1:\"Catch c1 c2 \\ c1\"\nproof (induct c1)\nqed auto\n\nlemma Catch_not_c:\"Catch c1 c2 \\ c2\"\nproof (induct c2)\nqed auto\n\nlemma seq_not_eq1: \"Seq c1 c2\\c1\"\n by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\c2\"\n by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\c1\"\n by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\c2\"\n by (induct c2) auto\n\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\nCatch_not_c1 Catch_not_c Catch_not_c1 [THEN not_sym] Catch_not_c[THEN not_sym] \nGuardc_not_c Guardc_not_c[THEN not_sym]\n\ninductive_cases stepc_elim_cases_Seq_Seq:\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (Seq c1' c2,s')\" \n\ninductive_cases stepc_elim_cases_Seq_Seq1:\n\"\\\\\\<^sub>c(Seq c1 c2,Fault f) \\ (q,s')\" \nthm stepc_elim_cases_Seq_Seq1\n\ninductive_cases stepc_elim_cases_Catch_Catch:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Catch c1' c2,s')\" \n\ninductive_cases stepc_elim_cases_Catch_Catch1:\n\"\\\\\\<^sub>c(Seq c1 c2,Fault f) \\ (q,s')\" \n\ninductive_cases stepc_elim_cases_Seq_skip:\n\"\\\\\\<^sub>c(Seq Skip c2,s) \\ u\" \n\"\\\\\\<^sub>c(Seq (Guard f g c1) c2,s) \\ u\"\n\n\ninductive_cases stepc_elim_cases_Catch_skip:\n\"\\\\\\<^sub>c(Catch Skip c2,s) \\ u\"\n\ninductive_cases stepc_elim_cases_Await_skip:\n\"\\\\\\<^sub>c (Await b c e, Normal s) \\ (Skip,t)\"\n\ninductive_cases stepc_elim_cases_Await_throw:\n\"\\\\\\<^sub>c (Await b c e, Normal s) \\ (Throw,t)\"\n\ninductive_cases stepc_elim_cases_Catch_throw:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Catch_skip_c2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s)\"\n\ninductive_cases stepc_Normal_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Skip,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Guard f g c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Basic f e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Spec r e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Seq c1 c2,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Cond b c1 c2,Normal s) \\ u\"\n \"\\\\\\<^sub>c(While b c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Await b c e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Call p,Normal s) \\ u\"\n \"\\\\\\<^sub>c(DynCom c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Throw,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Catch c1 c2,Normal s) \\ u\"\n\n\ntext \\ The final configuration is either of the form @{text \"(Skip,_)\"} for normal\ntermination, or @{term \"(Throw,Normal s)\"} in case the program was started in \na @{term \"Normal\"} state and terminated abruptly. The @{const \"Abrupt\"} state is not used to\nmodel abrupt termination, in contrast to the big-step semantics. Only if the\nprogram starts in an @{const \"Abrupt\"} states it ends in the same @{term \"Abrupt\"}\nstate.\\\n\ndefinition final:: \"('s,'p,'f,'e) config \\ bool\" where\n\"final cfg \\ (fst cfg=Skip \\ ((fst cfg=Throw) \\ (\\s. snd cfg=Normal s)))\"\n\ndefinition final_valid::\"('s,'p,'f,'e) config \\ bool\" where\n\"final_valid cfg = ((fst cfg=Skip \\ fst cfg=Throw) \\ (\\s. snd cfg=Normal s))\"\n\nabbreviation \n \"stepc_rtrancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ ((CONST stepc \\))\\<^sup>*\\<^sup>* cf0 cf1\" \n (* \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ (CONST ((stepc \\) \\ (step_e \\)))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\nabbreviation \n \"stepc_trancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\\\<^sub>c cf0 \\\\<^sup>+ cf1 \\ (CONST stepc \\)\\<^sup>+\\<^sup>+ cf0 cf1\"\n\nlemma \n assumes \n step_a: \"\\\\\\<^sub>c(Await b c e, Normal s) \\ (t,u)\"\n shows step_await_step_c:\"(\\\\<^sub>\\\\<^sub>a)\\(c, Normal s) \\\\<^sup>* (sequential t,u)\" \nusing step_a\nproof cases\n fix t1\n assume\n \"(t, u) = (Skip, t1)\" \"s \\ b\" \"(\\\\<^sub>\\\\<^sub>a)\\ \\c,Normal s\\ \\ t1\" \"\\t'. t1 \\ Abrupt t'\"\n thus ?thesis \n by (cases u) \n (auto intro: exec_impl_steps_Fault exec_impl_steps_Normal exec_impl_steps_Stuck)\nnext\n fix t1\n assume \"(t, u) = (Throw, Normal t1)\" \"s \\ b\" \"(\\\\<^sub>\\\\<^sub>a)\\ \\c,Normal s\\ \\ Abrupt t1\"\n thus ?thesis by (simp add: exec_impl_steps_Normal_Abrupt)\nqed\n\nlemma \n assumes (* exec: \"\\\\\\c,Normal s\\ \\ t\" and\n b: \"s \\ b\" and *)\n step_a: \"\\\\\\<^sub>c(Await b c e, Normal s) \\ u\"\n shows step_await_final1:\"final u\"\nusing step_a \nproof cases\n case (1 t) thus \"final u\" by (simp add: final_def)\nnext\n case (2 t)\n thus \"final u\" by (simp add: exec_impl_steps_Normal_Abrupt final_def)\nqed\n\nlemma step_Abrupt_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Abrupt x \\ s=Abrupt x\"\nusing step\nby induct auto\n\n\nlemma step_Stuck_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Stuck \\ \n s=Stuck \\ \n (\\r x e. redex c\\<^sub>1 = Spec r e \\ s=Normal x \\ (\\t. (x,t)\\r)) \\ \n (\\p x. redex c\\<^sub>1= Call p \\ s=Normal x \\ \\ p = None) \\\n (\\b c x e. redex c\\<^sub>1 = Await b c e \\ s=Normal x \\ x \\ b \\ (\\\\<^sub>\\\\<^sub>a)\\\\c,s\\\\s')\"\nusing step\nby induct auto\n\nlemma step_Fault_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Fault f \\ \n s=Fault f \\ \n (\\g c x. redex c\\<^sub>1 = Guard f g c \\ s=Normal x \\ x \\ g) \\\n (\\b c1 x e. redex c\\<^sub>1 = Await b c1 e \\ s=Normal x \\ x \\ b \\ (\\\\<^sub>\\\\<^sub>a)\\\\c1,s\\\\s')\"\nusing step \nby induct auto\n\nlemma step_not_Fault_f_end:\n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'\\ Fault ` f \\ s \\ Fault ` f\"\nusing step \nby induct auto\n\n \n\ninductive \n \"step_ce\"::\"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('s,'p,'f,'e) body\"\nwhere\nc_step: \"\\\\\\<^sub>c cf0 \\ cf1 \\ \\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1 \"\n|e_step: \"\\\\\\<^sub>c cf0 \\\\<^sub>e cf1 \\ \\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1 \"\n\nlemmas step_ce_induct = step_ce.induct [of _ \"(c,s)\" \"(c',s')\", split_format (complete), case_names\nc_step e_step, induct set]\n\n\ninductive_cases step_ce_elim_cases [cases set]:\n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1\"\n\n\nlemma step_c_normal_normal: assumes a1: \"\\\\\\<^sub>c cf0 \\ cf1\"\n shows \"\\ c\\<^sub>1 s s'. \\cf0 = (c\\<^sub>1,Normal s);cf1=(c\\<^sub>1,s');(\\sa. \\(s'=Normal sa))\\\n \\ P\"\nusing a1 \nby (induct rule: stepc.induct, induct, auto)\n\nlemma normal_not_normal_eq_p: \n assumes a1: \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1\"\n shows \"\\ c\\<^sub>1 s s'. \\cf0 = (c\\<^sub>1,Normal s);cf1=(c\\<^sub>1,s');(\\sa. \\(s'=Normal sa))\\\n \\ \\\\\\<^sub>c cf0 \\\\<^sub>e cf1 \\ \\( \\\\\\<^sub>c cf0 \\ cf1)\"\nby (meson step_c_normal_normal step_e.intros)\n\nlemma call_not_normal_skip_always:\n assumes a0:\"\\\\\\<^sub>c(Call p,s) \\ (p1,s1)\" and\n a1:\"\\sn. s \\ Normal sn\" and\n a2:\"p1\\Skip\"\n shows \"P\" \nproof(cases s)\n case Normal thus ?thesis using a1 by fastforce\nnext\n case Stuck \n then have a0:\"\\\\\\<^sub>c(Call p,Stuck) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(3)[OF a0] by fastforce\nnext\n case (Fault f) \n then have a0:\"\\\\\\<^sub>c(Call p,Fault f) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(2)[OF a0] by fastforce\nnext\n case (Abrupt a)\n then have a0:\"\\\\\\<^sub>c(Call p,Abrupt a) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(1)[OF a0] by fastforce\nqed\n\nlemma call_f_step_not_s_eq_t_false:\n assumes \n a0:\"\\\\\\<^sub>c(P,s) \\ (Q,t)\" and\n a1:\"(redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ ~(s=t)) \\\n (redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ s=t \\ P=Q \\ \\ fn \\ Some (Call fn))\"\n shows \"False\"\nusing a0 a1\nproof (induct rule:stepc_induct)\nqed(fastforce+,auto)\n\nlemma call_f_step_ce_not_s_eq_t_env_step:\n assumes \n a0:\"\\\\\\<^sub>c(P,s) \\\\<^sub>c\\<^sub>e (Q,t)\" and\n a1:\"(redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ ~(s=t)) \\\n (redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ s=t \\ P=Q \\ \\ fn \\ Some (Call fn)) \"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (Q,t)\"\nproof-\n have \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (Q,t) \\ \\\\\\<^sub>c(P,s) \\ (Q,t)\"\n using a0 step_ce_elim_cases by fastforce\n thus ?thesis using call_f_step_not_s_eq_t_false a1 by fastforce\nqed\n\n\n \nabbreviation \n \"stepce_rtrancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e\\<^sup>* cf1 \\ ((CONST step_ce \\))\\<^sup>*\\<^sup>* cf0 cf1\" \n (* \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ (CONST ((stepc \\) \\ (step_e \\)))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\nabbreviation \n \"stepce_trancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sub>c\\<^sub>e\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e\\<^sup>+ cf1 \\ (CONST step_ce \\)\\<^sup>+\\<^sup>+ cf0 cf1\"\n\nsubsection {*Parallel Computation: @{text \"\\\\(c, s) \\\\<^sub>p (c', s')\"}*}\ntype_synonym ('s,'p,'f,'e) par_Simpl = \"('s,'p,'f,'e)com list\" \ntype_synonym ('s,'p,'f,'e) par_config = \"('s,'p,'f,'e) par_Simpl \\ ('s,'f) xstate\"\n\ndefinition final_c:: \"('s,'p,'f,'e) par_config \\ bool\" where\n\"final_c cfg = (\\i. i final ((fst cfg)!i, snd cfg))\"\n\ninductive \n \"step_pe\"::\"[('s,'p,'f,'e) body,('s,'p,'f,'e) par_config,('s,'p,'f,'e) par_config] \\ bool\"\n (\"_\\\\<^sub>p (_ \\\\<^sub>e/ _)\" [81,81,81] 100) \n for \\::\"('s,'p,'f,'e) body\"\nwhere\nParEnv: \"\\\\\\<^sub>p (Ps, Normal s) \\\\<^sub>e (Ps, Normal t)\"\n\n\n\n\nlemma ptranE: \"\\\\\\<^sub>p c \\\\<^sub>e c' \\ (\\P s t. c = (P, s) \\ c' = (P, t) \\ Q) \\ Q\"\n by (induct c, induct c', erule step_pe.cases, blast)\n\ninductive_cases step_pe_Normal_elim_cases [cases set]:\n \"\\\\\\<^sub>p(PS,Normal s) \\\\<^sub>e (Ps,t)\"\n\ninductive_cases step_pe_elim_cases [cases set]:\n \"\\\\\\<^sub>p(PS,s) \\\\<^sub>e (Ps,t)\"\n\ninductive_cases step_pe_not_norm_elim_cases [cases set]:\n \"\\\\\\<^sub>p(Ps,s) \\\\<^sub>e (Ps,Abrupt t)\"\n \"\\\\\\<^sub>p(Ps,s) \\\\<^sub>e (Ps,Stuck)\"\n \"\\\\\\<^sub>p(Ps,s) \\\\<^sub>e (Ps,Fault t)\"\n\nlemma env_pe_c_c'_false:\n assumes step_m: \"\\\\\\<^sub>p (c, s) \\\\<^sub>e (c', s')\" \n shows \"~(c=c') \\ P\"\nusing step_m ptranE by blast\n\nlemma env_pe_c_c':\n assumes step_m: \"\\\\\\<^sub>p (c, s) \\\\<^sub>e (c', s')\" \n shows \"(c=c')\"\nusing env_pe_c_c'_false step_m by fastforce \n\nlemma env_pe_normal_s:\n assumes step_m: \"\\\\\\<^sub>p (c, s) \\\\<^sub>e (c', s') \\ s\\s'\" \n shows \"\\sa. s = Normal sa\"\nusing prod.inject step_pe.cases step_m by fastforce\n\nlemma env_pe_not_normal_s:\n assumes a1:\"\\\\\\<^sub>p (c, s) \\\\<^sub>e (c', s')\" and a2:\"(\\t. s\\Normal t)\" \n shows \"s=s'\"\nusing a1 a2\nby (cases rule:step_pe.cases,auto) \n\nlemma env_pe_not_normal_s_not_norma_t:\n assumes a1:\"\\\\\\<^sub>p (c, s) \\\\<^sub>e (c', s')\" and a2:\"(\\t. s\\Normal t)\" \n shows \"(\\t. s'\\Normal t)\"\nusing a1 a2 env_pe_not_normal_s\nby blast\n\n\ninductive \n\"step_p\"::\"[('s,'p,'f,'e) body, ('s,'p,'f,'e) par_config, \n ('s,'p,'f,'e) par_config] \\ bool\"\n(\"_\\\\<^sub>p (_ \\/ _)\" [81,81,81] 100) \nwhere\n ParComp: \"\\i\\\\<^sub>c(Ps!i,s) \\ (r,s')\\ \\ \n \\\\\\<^sub>p(Ps, s) \\ (Ps[i:=r], s')\"\n\nlemmas steppe_induct = step_p.induct [of _ \"(c,s)\" \"(c',s')\", split_format (complete), case_names\nParComp, induct set]\n\ninductive_cases step_p_elim_cases [cases set]:\n \"\\\\\\<^sub>p(Ps, s) \\ u\"\n\ninductive_cases step_p_pair_elim_cases [cases set]:\n \"\\\\\\<^sub>p(Ps, s) \\ (Qs, t)\"\n\ninductive_cases step_p_Normal_elim_cases [cases set]:\n \"\\\\\\<^sub>p(Ps, Normal s) \\ u\"\n\n\nlemma par_ctranE: \"\\ \\\\<^sub>p c \\ c' \\\n (\\i Ps s r t. c = (Ps, s) \\ c' = (Ps[i := r], t) \\ i < length Ps \\\n \\ \\\\<^sub>c (Ps!i, s) \\ (r, t) \\ P) \\ P\"\nby (induct c, induct c', erule step_p.cases, blast)\n\nsubsection \\Computations\\\nsubsubsection \\Sequential computations\\\n\ntype_synonym ('s,'p,'f,'e) confs = \n \"('s,'p,'f,'e) body \\(('s,'p,'f,'e) config) list\"\n\ninductive_set cptn :: \"(('s,'p,'f,'e) confs) set\"\nwhere\n CptnOne: \" (\\, [(P,s)]) \\ cptn\"\n| CptnEnv: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t); (\\,(P, t)#xs) \\ cptn \\ \\\n (\\,(P,s)#(P,t)#xs) \\ cptn\"\n| CptnComp: \"\\\\\\\\<^sub>c(P,s) \\ (Q,t); (\\,(Q, t)#xs) \\ cptn \\ \\ \n (\\,(P,s)#(Q,t)#xs) \\ cptn\"\n\ninductive_cases cptn_elim_cases [cases set]:\n\"(\\, [(P,s)]) \\ cptn\"\n\"(\\,(P,s)#(Q,t)#xs) \\ cptn\"\n\"(\\,(P,s)#(P,t)#xs) \\ cptn\"\n\ninductive_cases cptn_elim_cases_pair [cases set]:\n\"(\\, [x]) \\ cptn\"\n\"(\\, x#x1#xs) \\ cptn\"\n\nlemma cptn_dest:\"(\\,(P,s)#(Q,t)#xs) \\ cptn \\ (\\,(Q,t)#xs)\\ cptn\"\nby (auto dest: cptn_elim_cases)\n\nlemma cptn_dest_pair:\"(\\,x#x1#xs) \\ cptn \\ (\\,x1#xs)\\ cptn\"\nproof -\n assume \"(\\,x#x1#xs) \\ cptn\"\n thus ?thesis using cptn_dest prod.collapse by metis\nqed\n\nlemma cptn_dest1:\"(\\,(P,s)#(Q,t)#xs) \\ cptn \\ (\\,(P,s)#[(Q,t)])\\ cptn\"\nproof -\n assume a1: \"(\\, (P, s) # (Q, t) # xs) \\ cptn\"\n have \"(\\, [(Q, t)]) \\ cptn\"\n by (meson cptn.CptnOne)\n thus ?thesis \n proof (cases s)\n case (Normal s') \n then have f1: \"(\\, (P, Normal s') # (Q, t) # xs) \\ cptn\"\n using Normal a1 by blast\n have \"(\\, [(P, t)]) \\ cptn \\ (\\, [(P, Normal s'), (P, t)]) \\ cptn\"\n by (simp add: Env cptn.CptnEnv) \n thus ?thesis\n using f1 by (metis (no_types) Normal `(\\, [(Q, t)]) \\ cptn` cptn.CptnComp cptn_elim_cases(2))\n next\n case (Abrupt x) thus ?thesis \n using `(\\, [(Q, t)]) \\ cptn` a1 cptn.CptnComp cptn_elim_cases(2) CptnEnv by metis\n next\n case (Stuck) thus ?thesis \n using `(\\, [(Q, t)]) \\ cptn` a1 cptn.CptnComp cptn_elim_cases(2) CptnEnv by metis\n next \n case (Fault f) thus ?thesis\n using `(\\, [(Q, t)]) \\ cptn` a1 cptn.CptnComp cptn_elim_cases(2) CptnEnv by metis\n qed\nqed\n\nlemma cptn_dest1_pair:\"(\\,x#x1#xs) \\ cptn \\ (\\,x#[x1])\\ cptn\"\nproof -\n assume \"(\\,x#x1#xs) \\ cptn\"\n thus ?thesis using cptn_dest1 prod.collapse by metis\nqed\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\b a. (\\,b#c1)\\cptn \\ (\\,a#c2)\\cptn \\ (b#c1)!length c1=a \\ (\\,b#c1@c2)\\cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\napply (simp add: cptn.CptnEnv)\nby (simp add: cptn.CptnComp)\n\nlemma cptn_dest_2:\n \"(\\,a#xs@ys) \\ cptn \\ (\\,a#xs)\\ cptn\"\nproof (induct \"xs\" arbitrary: a)\n case Nil thus ?case using cptn.simps by fastforce \nnext\n case (Cons x xs') \n then have \"(\\,a#[x])\\cptn\" by (simp add: cptn_dest1_pair)\n also have \"(\\, x # xs') \\ cptn\"\n using Cons.hyps Cons.prems cptn_dest_pair by fastforce \n ultimately show ?case using cptn_append_is_cptn [of \\ a \"[x]\" x xs']\n by force \nqed \n\n\nlemma last_not_F:\nassumes \n a0:\"(\\,xs)\\cptn\" \nshows \"snd (last xs) \\ Fault ` F \\ \\i < length xs. snd (xs!i) \\ Fault ` F\"\nusing a0\nproof(induct) print_cases\n case (CptnOne \\ p s) thus ?case by auto\nnext\n case (CptnEnv \\ P s t xs) \n thus ?case using stepe_not_Fault_f_end\n proof -\n { fix nn :: nat\n have \"snd (last ((P, t) # xs)) \\ Fault ` F\"\n using CptnEnv.prems by force\n then have \"\\ nn < length ((P, s) # (P, t) # xs) \\ snd (((P, s) # (P, t) # xs) ! nn) \\ Fault ` F\"\n by (metis (no_types) CptnEnv.hyps(1) CptnEnv.hyps(3) length_Cons less_Suc_eq_0_disj nth_Cons_0 nth_Cons_Suc snd_conv stepe_not_Fault_f_end) \n }\n then have \"\\n. \\ n < length ((P, s) # (P, t) # xs) \\ snd (((P, s) # (P, t) # xs) ! n) \\ Fault ` F\"\n by meson\n then show ?thesis\n by metis\n qed \nnext\n case (CptnComp \\ P s Q t xs) \n have \"snd (last ((Q, t) # xs)) \\ Fault ` F\"\n using CptnComp.prems by force\n then have all:\"\\i Fault ` F\"\n using CptnComp.hyps by force\n then have \"t \\ Fault ` F\"\n by force\n then have \"s \\ Fault ` F\" using step_not_Fault_f_end\n using CptnComp.hyps(1) by blast\n then have zero:\"snd (P,s) \\ Fault ` F\" by auto\n show ?case \n proof -\n { fix nn :: nat\n have \"\\ nn < length ((P, s) # (Q, t) # xs) \\ snd (((P, s) # (Q, t) # xs) ! nn) \\ Fault ` F\"\n by (metis (no_types) \\\\i Fault ` F\\ \\snd (P, s) \\ Fault ` F\\ diff_Suc_1 length_Cons less_Suc_eq_0_disj nth_Cons') \n }\n then show ?thesis\n by meson\n qed \nqed\n\ndefinition cp :: \"('s,'p,'f,'e) body \\ ('s,'p,'f,'e) com \\ \n ('s,'f) xstate \\ (('s,'p,'f,'e) confs) set\" where\n \"cp \\ P s \\ {(\\1,l). l!0=(P,s) \\ (\\,l) \\ cptn \\ \\1=\\}\" \n\n \n\nlemma cp_sub: \n assumes a0: \"(\\,(x#l0)@l1) \\ cp \\ P s\"\n shows \"(\\,(x#l0)) \\ cp \\ P s\"\nproof -\n have \"(x#l0)!0 = (P,s)\" using a0 unfolding cp_def by auto\n also have \"(\\,(x#l0))\\cptn\" using a0 unfolding cp_def\n using cptn_dest_2 by fastforce\n ultimately show ?thesis using a0 unfolding cp_def by blast\nqed\n\nsubsubsection \\Parallel computations\\\n\ntype_synonym ('s,'p,'f,'e) par_confs = \"('s,'p,'f,'e) body \\(('s,'p,'f,'e) par_config) list\"\n\ninductive_set par_cptn :: \"('s,'p,'f,'e) par_confs set\"\nwhere\n ParCptnOne: \"(\\, [(P,s)]) \\ par_cptn\"\n| ParCptnEnv: \"\\\\\\\\<^sub>p(P,s) \\\\<^sub>e (P,t);(\\,(P, t)#xs) \\ par_cptn \\ \\(\\,(P,s)#(P,t)#xs) \\ par_cptn\"\n| ParCptnComp: \"\\ \\ \\\\<^sub>p(P,s) \\ (Q,t); (\\,(Q,t)#xs) \\ par_cptn \\ \\ (\\,(P,s)#(Q,t)#xs) \\ par_cptn\"\n\ninductive_cases par_cptn_elim_cases [cases set]:\n\"(\\, [(P,s)]) \\ par_cptn\"\n\"(\\,(P,s)#(Q,t)#xs) \\ par_cptn\"\n\nlemma pe_ce: \n assumes a1:\"\\\\\\<^sub>p(P,s) \\\\<^sub>e (P,t)\"\n shows \"\\i\\\\<^sub>c(P!i,s) \\\\<^sub>e (P!i,t)\"\nproof -\n {fix i\n assume \"i< length P\"\n have \"\\\\\\<^sub>c(P!i,s) \\\\<^sub>e (P!i,t)\" using a1\n by (metis Env Env_n env_pe_not_normal_s)\n }\n thus \"\\i\\\\<^sub>c(P!i,s) \\\\<^sub>e (P!i,t)\" by blast\nqed\n\ntype_synonym ('s,'p,'f,'e) par_com = \"('s,'p,'f,'e) com list\"\n\ndefinition par_cp :: \"('s,'p,'f,'e) body \\ ('s,'p,'f,'e) com list \\ ('s,'f) xstate \\ (('s,'p,'f,'e) par_confs) set\" \nwhere\n \"par_cp \\ P s \\ {(\\1,l). l!0=(P,s) \\ (\\,l) \\ par_cptn \\ \\1=\\}\" \n\n(* definition par_cp :: \"('s,'p,'f,'e) body \\ ('s,'p,'f,'e) com list \\ ('s,'f) xstate \\ (('s,'p,'f,'e) par_confs) set\" \nwhere\n \"par_cp \\ P s \\ {(\\1,l). l!0=(P,s) \\ (\\,l) \\ par_cptn \\ \\1=\\}\" *)\n\nlemma par_cptn_dest:\"(\\,(P,s)#(Q,t)#xs) \\ par_cptn \\ (\\,(Q,t)#xs)\\ par_cptn\"\nby (auto dest: par_cptn_elim_cases)\n\n\ntext {*\nlemmas about single step computation\n*}\n\n\n(* ************************************************************************ *)\nsubsection {* Structural Properties of Small Step Computations *}\n(* ************************************************************************ *)\nlemma redex_not_Seq: \"redex c = Seq c1 c2 \\ P\"\n apply (induct c)\n apply auto\n done\nlemma redex_not_Catch: \"redex c = Catch c1 c2 \\ P\"\n apply (induct c)\n apply auto\n done\n\n\n\n\nlemma no_step_final':\n assumes step: \"\\\\\\<^sub>c cfg \\ cfg'\"\n shows \"final cfg \\ P\"\nusing step\n by (cases cfg, cases cfg') (auto intro: no_step_final)\n\n\nlemma step_Abrupt:\n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\x. s=Abrupt x \\ s'=Abrupt x\"\nusing step\nby (induct) auto\n\nlemma step_Fault: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Fault f \\ s'=Fault f\"\nusing step\nby (induct) auto\n\nlemma step_Stuck: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Stuck \\ s'=Stuck\"\nusing step\nby (induct) auto\n\nlemma step_not_normal_not_normal:\n assumes step:\"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\s1. s\\Normal s1 \\ \\s1. s' \\ Normal s1\"\nusing step step_Abrupt step_Stuck step_Fault\nby (induct) auto\n\nlemma step_not_normal_s_eq_t:\n assumes step:\"\\\\\\<^sub>c (c, s) \\ (c', t)\"\n shows \"\\s1. s\\Normal s1 \\ s=t\"\nusing step step_Abrupt step_Stuck step_Fault\nby (induct) auto\n\nlemma ce_not_normal_s:\n assumes a1:\"\\\\\\<^sub>c cf0 \\\\<^sub>c\\<^sub>e cf1\"\n shows \"\\ c\\<^sub>1 c\\<^sub>2 s s'. \\cf0 = (c\\<^sub>1,s);cf1=(c\\<^sub>2,s');(\\sa. (s\\Normal sa))\\\n \\ s=s'\"\nusing a1\napply (clarify, cases rule:step_ce.cases)\nby (metis step_not_normal_s_eq_t env_not_normal_s)+\n\nlemma SeqSteps: \n assumes steps: \"\\\\\\<^sub>c cfg\\<^sub>1\\\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s);cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Seq c\\<^sub>1 c\\<^sub>2,s) \\\\<^sup>* (Seq c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans]) \n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'') \n have step: \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\" using Trans.hyps(1) by blast\n have steps: \"\\\\\\<^sub>c cfg'' \\\\<^sup>* cfg\\<^sub>2\" by fact\n have cfg\\<^sub>1: \"cfg\\<^sub>1 = (c\\<^sub>1, s)\" and cfg\\<^sub>2: \"cfg\\<^sub>2 = (c\\<^sub>1', s')\" by fact+\n obtain c\\<^sub>1'' s'' where cfg'': \"cfg''=(c\\<^sub>1'',s'')\"\n by (cases cfg'') auto\n from step cfg\\<^sub>1 cfg'' \n have \"\\\\\\<^sub>c (c\\<^sub>1,s) \\ (c\\<^sub>1'',s'')\"\n by simp \n hence \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2,s) \\ (Seq c\\<^sub>1'' c\\<^sub>2,s'')\" by (simp add: Seqc) \n also from Trans.hyps (3) [OF cfg'' cfg\\<^sub>2]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1'' c\\<^sub>2, s'') \\\\<^sup>* (Seq c\\<^sub>1' c\\<^sub>2, s')\" .\n finally show ?case .\nqed\n\nlemma CatchSteps: \n assumes steps: \"\\\\\\<^sub>ccfg\\<^sub>1\\\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s); cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Catch c\\<^sub>1 c\\<^sub>2,s) \\\\<^sup>* (Catch c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans])\n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'')\n have step: \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\" by fact\n have steps: \"\\\\\\<^sub>c cfg'' \\\\<^sup>* cfg\\<^sub>2\" by fact\n have cfg\\<^sub>1: \"cfg\\<^sub>1 = (c\\<^sub>1, s)\" and cfg\\<^sub>2: \"cfg\\<^sub>2 = (c\\<^sub>1', s')\" by fact+\n obtain c\\<^sub>1'' s'' where cfg'': \"cfg''=(c\\<^sub>1'',s'')\"\n by (cases cfg'') auto\n from step cfg\\<^sub>1 cfg'' \n have s: \"\\\\\\<^sub>c (c\\<^sub>1,s) \\ (c\\<^sub>1'',s'')\"\n by simp\n hence \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2,s) \\ (Catch c\\<^sub>1'' c\\<^sub>2,s'')\"\n by (rule stepc.Catchc)\n also from Trans.hyps (3) [OF cfg'' cfg\\<^sub>2]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1'' c\\<^sub>2, s'') \\\\<^sup>* (Catch c\\<^sub>1' c\\<^sub>2, s')\" .\n finally show ?case . \nqed\n\nlemma steps_Fault: \"\\\\\\<^sub>c (c, Fault f) \\\\<^sup>* (Skip, Fault f)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Fault f) \\\\<^sup>* (Seq Skip c\\<^sub>2, Fault f)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Fault f) \\ (c\\<^sub>2, Fault f)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Fault f) \\\\<^sup>* (Catch Skip c\\<^sub>2, Fault f)\".\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Fault f) \\ (Skip, Fault f)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\n\nlemma steps_Stuck: \"\\\\\\<^sub>c (c, Stuck) \\\\<^sup>* (Skip, Stuck)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Stuck) \\\\<^sup>* (Seq Skip c\\<^sub>2, Stuck)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Stuck) \\ (c\\<^sub>2, Stuck)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Stuck) \\\\<^sup>* (Catch Skip c\\<^sub>2, Stuck)\" .\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Stuck) \\ (Skip, Stuck)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\nlemma steps_Abrupt: \"\\\\\\<^sub>c (c, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Abrupt s) \\\\<^sup>* (Seq Skip c\\<^sub>2, Abrupt s)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Abrupt s) \\ (c\\<^sub>2, Abrupt s)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Abrupt s) \\\\<^sup>* (Catch Skip c\\<^sub>2, Abrupt s)\".\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Abrupt s) \\ (Skip, Abrupt s)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\nlemma step_Fault_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Fault f \\ s'=Fault f\"\nusing step\nby (induct) auto\n\nlemma step_Abrupt_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\x. s=Abrupt x \\ s'=Abrupt x\"\nusing step\nby (induct) auto\n\nlemma step_Stuck_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"s=Stuck \\ s'=Stuck\"\nusing step\nby (induct) auto\n\nlemma steps_Fault_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Fault f \\ s'=Fault f\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c'' s'')\n thus ?case by (simp add: step_Fault_prop) \nqed\n\nlemma steps_Abrupt_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Abrupt t \\ s'=Abrupt t\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c'' s'')\n thus ?case\n by (auto intro: step_Abrupt_prop)\nqed\n\nlemma steps_Stuck_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Stuck \\ s'=Stuck\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp \nnext\n case (Trans c s c'' s'')\n thus ?case\n by (auto intro: step_Stuck_prop)\nqed\n\nlemma step_seq_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\" and\n c_val: \"c=Seq Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val\nproof (cases s)\n case Normal \n thus \"\\sa. s=Normal sa\" by auto\nnext\n case Abrupt\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto \nnext \n case Stuck\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto\nnext\n case Fault\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto\nqed\n\n\nlemma step_catch_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\" and\n c_val: \"c=Catch Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val\nproof (cases s)\n case Normal \n thus \"\\sa. s=Normal sa\" by auto\nnext\n case Abrupt\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto \nnext \n case Stuck\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto\nnext\n case Fault\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto\nqed\n\nlemma step_normal_to_normal[rule_format]:\nassumes step:\"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\" and\n sn: \"s = Normal sa\" and\n finalc':\"(\\\\\\<^sub>c (c', s') \\\\<^sup>*(c1, s1) \\ (\\sb. s1 = Normal sb))\"\nshows \" (\\sc. s'=Normal sc)\"\nusing step sn finalc' \n proof (induct arbitrary: sa rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl show ?case by (simp add: Refl.prems) \n next \n case (Trans c s c'' s'') thm converse_rtranclpE2 \n thus ?case\n proof (cases s'') \n case (Abrupt a1) thus ?thesis using finalc' by (metis steps_Abrupt_prop Trans.hyps(2)) \n next\n case Stuck thus ?thesis using finalc' by (metis steps_Stuck_prop Trans.hyps(2)) \n next\n case Fault thus ?thesis using finalc' by (metis steps_Fault_prop Trans.hyps(2)) \n next \n case Normal thus ?thesis using Trans.hyps(3) finalc' by blast \n qed \nqed\n\nlemma step_spec_skip_normal_normal:\n assumes a0:\"\\\\\\<^sub>c (c,s) \\ (c',s')\" and\n a1:\"c=Spec r e\" and\n a2: \"s=Normal s1\" and\n a3: \"c'=Skip\" and\n a4: \"(\\t. (s1,t) \\ r)\"\n shows \"\\s1'. s'=Normal s1'\"\nproof (cases s') \n case (Normal u) thus ?thesis by auto\nnext\n case Stuck \n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast\nnext\n case (Fault f) \n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast \nnext\n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast\nqed\n\n\ntext{* if not Normal not environmental *}\n\n(* \n\nNOTE\nCall always change the program now \n\nlemma no_advance_call_inf:\nassumes a0: \"redex p1 = Call f\" and\n a1: \"(\\ f) = Some (Call f)\" \nshows \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nusing a0 a1\nproof (induct p1)\n case (Catch) thus ?case by (simp add: Catchc)\nnext\n case (Seq) thus ?case by (simp add: Seqc)\nnext\n case (Call) thus ?case\n by (simp add: Callc) \nqed(auto) *)\n\nlemma no_advance_seq:\nassumes a0: \"P = Seq p1 p2\" and\n a1: \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nshows \"\\\\\\<^sub>c (P,Normal s) \\ (P, Normal s)\"\nby (simp add: Seqc a0 a1)\n\nlemma no_advance_catch:\nassumes a0: \"P = Catch p1 p2\" and\n a1: \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nshows \"\\\\\\<^sub>c (P,Normal s) \\ (P, Normal s)\"\nby (simp add: Catchc a0 a1)\n\nlemma not_step_c_env: \n\"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c, s') \\ \n (\\sa. \\(s=Normal sa)) \\ \n (\\sa. \\(s'=Normal sa))\"\nby (fastforce elim:stepe_elim_cases)\n\nlemma step_c_env_not_normal_eq_state: \n\"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c, s') \\ \n (\\sa. \\(s=Normal sa)) \\ \n s=s'\"\nby (fastforce elim:stepe_elim_cases)\n\nlemma not_eq_not_env:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"~(c=c') \\ \\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s') \\ P\"\nusing step_m etranE by blast\n\n\nlemma step_ce_not_step_e_step_c:\n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"\\ (\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')) \\(\\\\\\<^sub>c (c, s) \\ (c', s'))\"\nusing step_m step_ce_elim_cases by blast\n\nlemma step_ce_notNormal: \n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" \n shows \"(\\sa. \\(s=Normal sa)) \\ s'=s\"\nusing step_m\nproof (induct rule:step_ce_induct) \n case (e_step a b a' b')\n have \"\\f p pa. \\ f\\\\<^sub>c p \\\\<^sub>e pa \\ (\\c. (\\x. p = (c::('b, 'a, 'c,'d) LanguageCon.com, x)) \\ (\\x. pa = (c, x)))\"\n by (fastforce elim:etranE stepe_elim_cases)\n thus ?case\n using stepe_elim_cases e_step.hyps e_step.prems by blast\nnext\n case (c_step a b a' b')\n thus ?case \n proof (cases b)\n case (Normal) thus ?thesis using c_step.prems by auto \n next\n case (Stuck) thus ?thesis \n using SmallStepCon.step_Stuck_prop c_step.hyps by blast \n next\n case (Fault f) thus ?thesis \n using SmallStepCon.step_Fault_prop c_step.hyps by fastforce\n next\n case (Abrupt a) thus ?thesis\n using SmallStepCon.step_Abrupt_prop c_step.hyps by fastforce \n qed\nqed\n\nlemma steps_ce_not_Normal: \n assumes step_m: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\" \n shows \"\\sa. \\(s=Normal sa) \\ s'=s\"\nusing step_m\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl then show ?case by auto\nnext\n case (Trans a b a' b') \n thus ?case using step_ce_notNormal by blast \nqed\n\nlemma steps_not_normal_ce_c: \n assumes steps: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\"\n shows \"( \\sa. \\(s=Normal sa)) \\ \\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by auto\nnext\n case (Trans a b a' b') \n then have \"b=b'\" using step_ce_notNormal by blast\n then have \"\\\\\\<^sub>c (a', b') \\\\<^sup>* (c', s')\" using `b=b'` Trans.hyps(3) Trans.prems by blast\n then have \"\\\\\\<^sub>c (a, b) \\ (a', b') \\ \\\\\\<^sub>c (a, b) \\\\<^sub>e (a', b')\"\n using Trans.hyps(1) by (fastforce elim: step_ce_elim_cases)\n thus ?case\n proof\n assume \"\\\\\\<^sub>c (a, b) \\ (a', b')\" \n thus ?thesis using `\\\\\\<^sub>c (a', b') \\\\<^sup>* (c', s')` by auto \n next\n assume \"\\\\\\<^sub>c (a, b) \\\\<^sub>e (a', b')\" \n have \"a = a'\"\n by (meson Trans.hyps(1) `\\\\\\<^sub>c (a, b) \\\\<^sub>e (a', b')` not_eq_not_env) \n thus ?thesis using `\\\\\\<^sub>c (a', b') \\\\<^sup>* (c', s')` `b = b'` by force \n qed\nqed\n\nlemma steps_c_ce: \n assumes steps: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by auto\nnext\n case (Trans a b a' b') \n have \"\\\\\\<^sub>c (a, b) \\\\<^sub>c\\<^sub>e (a', b')\"\n using Trans.hyps(1) c_step by blast\n thus ?case\n by (simp add: Trans.hyps(3) converse_rtranclp_into_rtranclp)\nqed\n\nlemma steps_not_normal_c_ce: \n assumes steps: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"( \\sa. \\(s=Normal sa)) \\ \\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\"\nby (simp add: steps steps_c_ce)\n\nlemma steps_not_normal_c_eq_ce:\nassumes normal: \"( \\sa. \\(s=Normal sa))\"\nshows \" \\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s') = \\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\"\nusing normal\nusing steps_c_ce steps_not_normal_ce_c by auto \n\nlemma steps_ce_Fault: \"\\\\\\<^sub>c (c, Fault f) \\\\<^sub>c\\<^sub>e\\<^sup>* (Skip, Fault f)\"\nby (simp add: SmallStepCon.steps_Fault steps_c_ce)\n\nlemma steps_ce_Stuck: \"\\\\\\<^sub>c (c, Stuck) \\\\<^sub>c\\<^sub>e\\<^sup>* (Skip, Stuck)\"\nby (simp add: SmallStepCon.steps_Stuck steps_c_ce)\n\nlemma steps_ce_Abrupt: \"\\\\\\<^sub>c (c, Abrupt a) \\\\<^sub>c\\<^sub>e\\<^sup>* (Skip, Abrupt a)\"\nby (simp add: SmallStepCon.steps_Abrupt steps_c_ce)\n\nlemma step_ce_seq_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" and\n c_val: \"c=Seq Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val not_eq_not_env \n step_ce_not_step_e_step_c step_seq_throw_normal by blast\n\nlemma step_ce_catch_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e (c', s')\" and\n c_val: \"c=Catch Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val not_eq_not_env\n step_ce_not_step_e_step_c step_catch_throw_normal by blast \n\nlemma step_ce_normal_to_normal[rule_format]:\nassumes step:\"\\\\\\<^sub>c (c, s) \\\\<^sub>c\\<^sub>e\\<^sup>* (c', s')\" and\n sn: \"s = Normal sa\" and\n finalc':\"(\\\\\\<^sub>c (c', s') \\\\<^sub>c\\<^sub>e\\<^sup>*(c1, s1) \\ (\\sb. s1 = Normal sb))\"\nshows \" \n (\\sc. s'=Normal sc)\"\nusing step sn finalc' steps_ce_not_Normal by blast \n\nlemma SeqSteps_ce: \n assumes steps: \"\\\\\\<^sub>c cfg\\<^sub>1\\\\<^sub>c\\<^sub>e\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s);cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Seq c\\<^sub>1 c\\<^sub>2,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (Seq c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans]) \n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'') \n then have \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg'' \\ \\\\\\<^sub>c cfg\\<^sub>1 \\\\<^sub>e cfg''\" \n using step_ce_elim_cases by blast\n thus ?case \n proof\n assume a1:\"\\\\\\<^sub>c cfg\\<^sub>1 \\\\<^sub>e cfg''\" \n have \"\\f p pa. \\ f\\\\<^sub>c p \\\\<^sub>e pa \\ (\\c. \n (\\x. p = (c::('a, 'b, 'c,'d) LanguageCon.com, x)) \\ (\\x. pa = (c, x)))\"\n by (meson etranE)\n then obtain cc :: \"('b \\ ('a, 'b, 'c,'d) LanguageCon.com option) \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ \n ('a, 'b, 'c,'d) LanguageCon.com\" and \n xx :: \"('b \\ ('a, 'b, 'c,'d) LanguageCon.com option) \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'c) xstate\" and\n xxa :: \"('b \\ ('a, 'b, 'c,'d) LanguageCon.com option) \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ \n ('a, 'b, 'c,'d) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'c) xstate\" where\n f1: \"\\f p pa. \\ f\\\\<^sub>c p \\\\<^sub>e pa \\ p = (cc f p pa, xx f p pa) \\ pa = (cc f p pa, xxa f p pa)\"\n by (metis (no_types))\n have f2: \"\\f c x xa. \\ f\\\\<^sub>c (c::('a, 'b, 'c,'d) LanguageCon.com, x) \\\\<^sub>e (c, xa) \\ \n (\\a. x = Normal a) \\ (\\a. xa \\ Normal a) \\ x = xa\"\n by (metis stepe_elim_cases)\n have f3: \"(c\\<^sub>1, xxa \\ cfg\\<^sub>1 cfg'') = cfg''\"\n using f1 by (metis Trans.prems(1) a1 fst_conv)\n hence \"\\\\\\<^sub>c (LanguageCon.com.Seq c\\<^sub>1 c\\<^sub>2, xxa \\ cfg\\<^sub>1 cfg'') \\\\<^sub>c\\<^sub>e\\<^sup>* (LanguageCon.com.Seq c\\<^sub>1' c\\<^sub>2, s')\"\n using Trans.hyps(3) Trans.prems(2) by force\n thus ?thesis\n using f3 f2 by (metis (no_types) Env Trans.prems(1) a1 e_step r_into_rtranclp \n rtranclp.rtrancl_into_rtrancl rtranclp_idemp) \n next\n assume \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\"\n thus ?thesis\n proof -\n have \"\\p. \\c x. p = (c::('a, 'b, 'c,'d) LanguageCon.com, x::('a, 'c) xstate)\"\n by auto\n thus ?thesis\n by (metis (no_types) Seqc Trans.hyps(3) Trans.prems(1) Trans.prems(2) \n `\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''` c_step converse_rtranclp_into_rtranclp)\n qed\n qed\nqed\n\n\nlemma CatchSteps_ce: \n assumes steps: \"\\\\\\<^sub>ccfg\\<^sub>1\\\\<^sub>c\\<^sub>e\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s); cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Catch c\\<^sub>1 c\\<^sub>2,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (Catch c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans])\n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'')\nthen have \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg'' \\ \\\\\\<^sub>c cfg\\<^sub>1 \\\\<^sub>e cfg''\" \n using step_ce_elim_cases by blast\n thus ?case \n proof\n assume a1:\"\\\\\\<^sub>c cfg\\<^sub>1 \\\\<^sub>e cfg''\" \n have \"\\f p pa. \\ f\\\\<^sub>c p \\\\<^sub>e pa \\ (\\c. (\\x. p = (c::('a, 'b, 'c,'d) LanguageCon.com, x)) \\ (\\x. pa = (c, x)))\"\n by (meson etranE)\n then obtain cc :: \"('b \\('a, 'b, 'c, 'd) LanguageCon.com option) \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\\n ('a, 'b, 'c, 'd) LanguageCon.com\" and \n xx :: \"('b \\('a, 'b, 'c, 'd) LanguageCon.com option) \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ \n ('a, 'c) xstate\" and \n xxa :: \"('b \\('a, 'b, 'c, 'd) LanguageCon.com option) \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\\n ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'c) xstate\" where\n f1: \"\\f p pa. \\ f\\\\<^sub>c p \\\\<^sub>e pa \\ p = (cc f p pa, xx f p pa) \\ pa = (cc f p pa, xxa f p pa)\"\n by (metis (no_types))\n have f2: \"\\f c x xa. \\ f\\\\<^sub>c (c::('a, 'b, 'c,'d) LanguageCon.com, x) \\\\<^sub>e (c, xa) \\ \n (\\a. x = Normal a) \\ (\\a. xa \\ Normal a) \\ x = xa\"\n by (metis stepe_elim_cases)\n have f3: \"(c\\<^sub>1, xxa \\ cfg\\<^sub>1 cfg'') = cfg''\"\n using f1 by (metis Trans.prems(1) a1 fst_conv)\n hence \"\\\\\\<^sub>c (LanguageCon.com.Catch c\\<^sub>1 c\\<^sub>2, xxa \\ cfg\\<^sub>1 cfg'') \\\\<^sub>c\\<^sub>e\\<^sup>* (LanguageCon.com.Catch c\\<^sub>1' c\\<^sub>2, s')\"\n using Trans.hyps(3) Trans.prems(2) by force\n thus ?thesis\n using f3 f2 by (metis (no_types) Env Trans.prems(1) a1 e_step r_into_rtranclp rtranclp.rtrancl_into_rtrancl rtranclp_idemp) \n next\n assume \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\"\n thus ?thesis\n proof -\n obtain cc :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'b, 'c, 'd) LanguageCon.com\" and xx :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'c) xstate\" where\n f1: \"\\p. p = (cc p, xx p)\"\n by (meson old.prod.exhaust)\n hence \"\\c. \\\\\\<^sub>c (LanguageCon.com.Catch c\\<^sub>1 c, s) \\ (LanguageCon.com.Catch (cc cfg'') c, xx cfg'')\"\n by (metis (no_types) Catchc Trans.prems(1) `\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''`)\n thus ?thesis\n using f1 by (meson Trans.hyps(3) Trans.prems(2) c_step converse_rtranclp_into_rtranclp)\n qed \n qed\nqed\n\nlemma step_change_p_or_eq_Ns: \n assumes step: \"\\\\\\<^sub>c (P,Normal s) \\ (Q,s')\"\n shows \"\\(P=Q)\"\nusing step\nproof (induct P arbitrary: Q s s')\nqed(fastforce elim: stepc_Normal_elim_cases)+\n\n \nlemma step_change_p_or_eq_s: \n assumes step: \"\\\\\\<^sub>c (P,s) \\ (Q,s')\"\n shows \"\\(P=Q)\"\nusing step\nproof (induct P arbitrary: Q s s')\nqed (fastforce elim: stepc_elim_cases)+\n\nsubsection {* Relation between @{term \"stepc_rtrancl\"} and @{term \"cptn\"} *}\n\nlemma stepc_rtrancl_cptn:\n assumes step: \"\\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf,sf)\" \n shows \"\\xs. (\\,(c, s)#xs) \\ cptn \\(cf,sf) = (last ((c,s)#xs))\"\nusing step \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans]) \n case Refl thus ?case using cptn.CptnOne by auto\nnext\n case (Trans c s c' s') \n have \"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s') \\ \\\\\\<^sub>c (c, s) \\ (c', s')\"\n by (meson Trans.hyps(1) step_ce.simps)\n then show ?case\n proof\n assume prem:\"\\\\\\<^sub>c (c, s) \\\\<^sub>e (c', s')\" \n then have ceqc':\"c=c'\" using prem env_c_c'\n by auto \n obtain xs where xs_s:\"(\\, (c', s') # xs) \\ cptn \\ (cf, sf) = last ((c', s') # xs)\"\n using Trans(3) by auto \n then have xs_f: \"(\\, (c, s)#(c', s') # xs) \\ cptn\" \n using cptn.CptnEnv ceqc' prem by fastforce\n also have \"last ((c', s') # xs) = last ((c,s)#(c', s') # xs)\" by auto\n then have \"(cf, sf) = last ((c, s) # (c', s') # xs)\"\n using xs_s by auto\n thus ?thesis\n using xs_f by blast\n next\n assume prem:\"\\\\\\<^sub>c (c, s) \\ (c', s')\" \n obtain xs where xs_s:\"(\\, (c', s') # xs) \\ cptn \\ (cf, sf) = last ((c', s') # xs) \"\n using Trans(3) by auto \n have \"(\\, (c, s) # (c', s') # xs) \\ cptn\" using cptn.CptnComp \n using xs_s prem by blast \n also have \"last ((c', s') # xs) = last ((c,s)#(c', s') # xs)\" by auto\n ultimately show ?thesis using xs_s by fastforce\n qed \nqed\n\n\nlemma cptn_stepc_rtrancl:\n assumes cptn_step: \"(\\,(c, s)#xs) \\ cptn\" and\n cf_last:\"(cf,sf) = (last ((c,s)#xs))\"\n shows \"\\\\\\<^sub>c (c,s) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf,sf)\"\nusing cptn_step cf_last\nproof (induct xs arbitrary: c s) \n case Nil\n thus ?case by simp \nnext\n case (Cons a xs c s) \n then obtain ca sa where eq_pair: \"a=(ca,sa)\" and \"(cf, sf) = last ((ca,sa) # xs) \" \n using Cons by (fastforce) \n have f1: \"\\f p pa. \\ (f::'a \\ ('b, _, 'c,'d) LanguageCon.com option)\\\\<^sub>c p \\ pa \\ f\\\\<^sub>c p \\\\<^sub>c\\<^sub>e pa\"\n by (simp add: c_step)\n have f2: \"(\\, (c, s) # (ca, sa) # xs) \\ cptn\"\n using `(\\, (c, s) # a # xs) \\ cptn` eq_pair by blast\n have f3: \"\\f p pa. \\ (f::'a \\ ('b, _, 'c,'d) LanguageCon.com option)\\\\<^sub>c p \\\\<^sub>e pa \\ f\\\\<^sub>c p \\\\<^sub>c\\<^sub>e pa\"\n using e_step by blast\n have \"\\c x. (\\, (c, x) # xs) \\ cptn \\ (cf, sf) \\ last ((c, x) # xs) \\ \\\\\\<^sub>c (c, x) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf, sf)\"\n using Cons.hyps by blast\n thus ?case\n using f3 f2 f1 by (metis (no_types) `(cf, sf) = last ((ca, sa) # xs)` converse_rtranclp_into_rtranclp cptn_elim_cases(2)) \nqed\n\nlemma three_elems_list:\n assumes a1:\"length l > 2\"\n shows \"\\a0 a1 a2 l1. l=a0#a1#a2#l1\"\nusing a1 by (metis Cons_nth_drop_Suc One_nat_def Suc_1 Suc_leI add_lessD1 drop_0 length_greater_0_conv list.size(3) not_numeral_le_zero one_add_one) \n\nlemma cptn_stepc_rtran:\n assumes cptn_step: \"(\\,x#xs) \\ cptn\" and \n a1:\"Suc i < length (x#xs)\"\n shows \"\\\\\\<^sub>c ((x#xs)!i) \\\\<^sub>c\\<^sub>e ((x#xs)!(Suc i))\"\nusing cptn_step a1\nproof (induct i arbitrary: x xs)\n case 0\n then obtain x1 xs1 where xs:\"xs=x1#xs1\"\n by (metis length_Cons less_not_refl list.exhaust list.size(3)) \n then have \"(x#x1#xs1)!Suc 0 = x1\" by fastforce \n have x_x1_cptn:\"(\\,x#x1#xs1)\\cptn\" using 0 xs by auto \n then have \"(\\,x1#xs1)\\cptn\"\n using cptn_dest_pair by fastforce\n then have \"\\\\\\<^sub>cx \\\\<^sub>e x1 \\ \\\\\\<^sub>cx \\ x1\" \n using cptn_elim_cases_pair x_x1_cptn by blast \n then have \"\\\\\\<^sub>c x \\\\<^sub>c\\<^sub>e x1\"\n by (metis c_step e_step)\n then show ?case \n by (simp add: xs)\nnext\n case (Suc i)\n then have \"Suc i < length xs\" by auto\n moreover then obtain x1 xs1 where xs:\"xs=x1#xs1\"\n by (metis (full_types) list.exhaust list.size(3) not_less0)\n moreover then have \"(\\,x1#xs1) \\ cptn\" using Suc cptn_dest_pair by blast\n ultimately have \"\\\\\\<^sub>c ((x1 # xs1) ! i) \\\\<^sub>c\\<^sub>e ((x1 # xs1) ! Suc i)\" \n using Suc by auto\n thus ?case using Suc xs by auto\nqed \n \n \nlemma cptn_stepconf_rtrancl:\n assumes cptn_step: \"(\\,cfg1#xs) \\ cptn\" and\n cf_last:\"cfg2 = (last (cfg1#xs))\"\n shows \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* cfg2\"\nusing cptn_step cf_last\nby (metis cptn_stepc_rtrancl prod.collapse)\n\nlemma cptn_all_steps_rtrancl:\n assumes cptn_step: \"(\\,cfg1#xs) \\ cptn\" \n shows \"\\i\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* ((cfg1#xs)!i)\"\nusing cptn_step \nproof (induct xs arbitrary: cfg1)\n case Nil thus ?case by auto\nnext\n case (Cons x xs1) thus ?case\n proof -\n have hyp:\"\\i\\\\<^sub>c x \\\\<^sub>c\\<^sub>e\\<^sup>* ((x # xs1) ! i)\"\n using Cons.hyps Cons.prems cptn_dest_pair by blast \n thus ?thesis\n proof\n {\n fix i\n assume a0:\"i\\\\<^sub>c (cfg1 # x # xs1) ! 0 \\\\<^sub>c\\<^sub>e ((cfg1 # x # xs1) ! Suc 0)\"\n using Cons.prems cptn_stepc_rtran by blast\n then have \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e x\" using Cons by simp\n also have \"i < Suc (Suc (length xs1))\"\n using a0 by force\n ultimately have \"\\\\\\<^sub>c cfg1 \\\\<^sub>c\\<^sub>e\\<^sup>* (cfg1 # x # xs1) ! i\" using hyp Cons\n using converse_rtranclp_into_rtranclp hyp less_Suc_eq_0_disj \n by auto \n } thus ?thesis by auto qed\n qed\nqed\n\nlemma cptn_env_same_prog:\nassumes a0: \"(\\, l) \\ cptn\" and\n a1: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a2: \"Suc j < length l\"\nshows \"fst (l!j) = fst (l!0)\"\nusing a0 a1 a2\nproof (induct j arbitrary: l)\n case 0 thus ?case by auto\nnext\n case (Suc j) \n then have \"fst (l!j) = fst (l!0)\" by fastforce\n thus ?case using Suc \n by (metis (no_types) env_c_c' lessI prod.collapse)\nqed\n\nlemma takecptn_is_cptn [rule_format, elim!]:\n \"\\j. (\\,c) \\ cptn \\ (\\, take (Suc j) c) \\ cptn\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j)\n apply simp\n apply(rule CptnOne)\napply simp\napply(force intro:cptn.intros elim:cptn.cases)\ndone\n\n\n\nlemma dropcptn_is_cptn [rule_format,elim!]:\n \"\\j,c) \\ cptn \\ (\\, drop j c) \\ cptn\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j,simp+)\napply(erule cptn.cases)\n apply simp\n apply force\napply force\ndone\n\nlemma takepar_cptn_is_par_cptn [rule_format,elim]:\n \"\\j. (\\,c) \\ par_cptn \\ (\\,take (Suc j) c) \\ par_cptn\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j,simp)\n apply(rule ParCptnOne)\napply(force intro:par_cptn.intros elim:par_cptn.cases)\ndone\n\nlemma droppar_cptn_is_par_cptn [rule_format]:\n \"\\j,c) \\ par_cptn \\ (\\,drop j c) \\ par_cptn\"\napply(induct \"c\")\n apply(force elim: par_cptn.cases)\napply clarify\napply(case_tac j,simp+)\napply(erule par_cptn.cases)\n apply simp\n apply force\napply force\ndone\n\n\nsubsection\\Modular Definition of Computation\\\ndefinition lift :: \"('s,'p,'f,'e) com \\ ('s,'p,'f,'e) config \\ ('s,'p,'f,'e) config\" where\n \"lift Q \\ \\(P, s). ((Seq P Q), s)\" \n\ndefinition lift_catch :: \"('s,'p,'f,'e) com \\ ('s,'p,'f,'e) config \\ ('s,'p,'f,'e) config\" where\n \"lift_catch Q \\ \\(P, s). (Catch P Q, s)\" \n\n\ninductive_set cptn_mod :: \"(('s,'p,'f,'e) confs) set\"\nwhere\n CptnModOne: \"(\\,[(P, s)]) \\ cptn_mod\"\n| CptnModEnv: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t);(\\,(P, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P, s)#(P, t)#xs) \\ cptn_mod\"\n| CptnModSkip: \"\\\\\\\\<^sub>c(P,s) \\ (Skip,t); redex P = P;\n (\\,(Skip, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Skip, t)#xs) \\cptn_mod\"\n\n| CptnModThrow: \"\\\\\\\\<^sub>c(P,s) \\ (Throw,t); redex P = P;\n (\\,(Throw, t)#xs) \\ cptn_mod \\ \\ \n (\\,(P,s)#(Throw, t)#xs) \\cptn_mod\"\n\n| CptnModCondT: \"\\(\\,(P0, Normal s)#ys) \\ cptn_mod; s \\ b \\ \\ \n (\\,((Cond b P0 P1), Normal s)#(P0, Normal s)#ys) \\ cptn_mod\"\n| CptnModCondF: \"\\(\\,(P1, Normal s)#ys) \\ cptn_mod; s \\ b \\ \\ \n (\\,((Cond b P0 P1), Normal s)#(P1, Normal s)#ys) \\ cptn_mod\"\n| CptnModSeq1: \n \"\\(\\,(P0, s)#xs) \\ cptn_mod; zs=map (lift P1) xs \\ \\ \n (\\,((Seq P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModSeq2: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; fst(last ((P0, s)#xs)) = Skip;\n (\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod;\n zs=(map (lift P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (\\,((Seq P0 P1), s)#zs) \\ cptn_mod\"\n(*| CptnModSeq3:\n \"\\ (\\,(P1, s)#xs) \\ cptn_mod\\ \\ (\\,((Seq Skip P1), s)#(P1, s)#xs) \\ cptn_mod\"*)\n\n| CptnModSeq3: \n \"\\(\\, (P0, Normal s)#xs) \\ cptn_mod; \n fst(last ((P0, Normal s)#xs)) = Throw;\n snd(last ((P0, Normal s)#xs)) = Normal s'; \n (\\,(Throw,Normal s')#ys) \\ cptn_mod; \n zs=(map (lift P1) xs)@((Throw,Normal s')#ys) \\ \\\n (\\,((Seq P0 P1), Normal s)#zs) \\ cptn_mod\"\n\n| CptnModWhile1: \n \"\\(\\, (P, Normal s)#xs) \\ cptn_mod; s \\ b; \n zs=map (lift (While b P)) xs \\ \\ \n (\\, ((While b P), Normal s)#\n ((Seq P (While b P)),Normal s)#zs) \\ cptn_mod\"\n\n| CptnModWhile2: \n \"\\ (\\, (P, Normal s)#xs) \\ cptn_mod; \n fst(last ((P, Normal s)#xs))=Skip; s \\ b; \n zs=(map (lift (While b P)) xs)@\n (While b P, snd(last ((P, Normal s)#xs)))#ys; \n (\\,(While b P, snd(last ((P, Normal s)#xs)))#ys) \\ \n cptn_mod\\ \\ \n (\\,(While b P, Normal s)#\n (Seq P (While b P), Normal s)#zs) \\ cptn_mod\"\n\n| CptnModWhile3: \n \"\\ (\\, (P, Normal s)#xs) \\ cptn_mod; \n fst(last ((P, Normal s)#xs))=Throw; s \\ b;\n snd(last ((P, Normal s)#xs)) = Normal s'; \n (\\,(Throw,Normal s')#ys) \\ cptn_mod; \n zs=(map (lift (While b P)) xs)@((Throw,Normal s')#ys)\\ \\ \n (\\,(While b P, Normal s)#\n (Seq P (While b P), Normal s)#zs) \\ cptn_mod\"\n\n| CptnModCall: \"\\(\\,(bdy, Normal s)#ys) \\ cptn_mod;\\ p = Some bdy; bdy\\Call p \\ \\ \n (\\,((Call p), Normal s)#(bdy, Normal s)#ys) \\ cptn_mod\" \n| CptnModDynCom: \"\\(\\,(c s, Normal s)#ys) \\ cptn_mod \\ \\ \n (\\,(DynCom c, Normal s)#(c s, Normal s)#ys) \\ cptn_mod\"\n\n| CptnModGuard: \"\\(\\,(c, Normal s)#ys) \\ cptn_mod; s \\ g \\ \\ \n (\\,(Guard f g c, Normal s)#(c, Normal s)#ys) \\ cptn_mod\"\n\n| CptnModCatch1: \"\\(\\,(P0, s)#xs) \\ cptn_mod; zs=map (lift_catch P1) xs \\\n \\ (\\,((Catch P0 P1), s)#zs) \\ cptn_mod\"\n| CptnModCatch2: \n \"\\(\\, (P0, s)#xs) \\ cptn_mod; fst(last ((P0, s)#xs)) = Skip; \n (\\,(Skip,snd(last ((P0, s)#xs)))#ys) \\ cptn_mod; \n zs=(map (lift_catch P1) xs)@((Skip,snd(last ((P0, s)#xs)))#ys) \\ \\ \n (\\,((Catch P0 P1), s)#zs) \\ cptn_mod\"\n\n| CptnModCatch3: \n \"\\(\\, (P0, Normal s)#xs) \\ cptn_mod; fst(last ((P0, Normal s)#xs)) = Throw; \n snd(last ((P0, Normal s)#xs)) = Normal s';\n (\\,(P1, snd(last ((P0, Normal s)#xs)))#ys) \\ cptn_mod; \n zs=(map (lift_catch P1) xs)@((P1, snd(last ((P0, Normal s)#xs)))#ys) \\ \\ \n (\\,((Catch P0 P1), Normal s)#zs) \\ cptn_mod\"\n\n\nlemmas CptnMod_induct = cptn_mod.induct [of _ \"[(c,s)]\", split_format (complete), case_names\nCptnModOne CptnModEnv CptnModSkip CptnModThrow CptnModCondT CptnModCondF \nCptnModSeq1 CptnModSeq2 CptnModSeq3 CptnModSeq4 CptnModWhile1 CptnModWhile2 CptnModWhile3 CptnModCall CptnModDynCom CptnModGuard \nCptnModCatch1 CptnModCatch2 CptnModCatch3, induct set]\n\ninductive_cases CptnMod_elim_cases [cases set]:\n\"(\\,(Skip, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Guard f g c, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Basic f e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Spec r e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Seq c1 c2, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Cond b c1 c2, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Await b c2 e, s)#u#xs) \\ cptn_mod\"\n\"(\\,(Call p, s)#u#xs) \\ cptn_mod\"\n\"(\\,(DynCom c,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Throw,s)#u#xs) \\ cptn_mod\"\n\"(\\,(Catch c1 c2,s)#u#xs) \\ cptn_mod\"\n\n\ninductive_cases CptnMod_Normal_elim_cases [cases set]:\n\"(\\,(Skip, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Guard f g c, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Basic f e, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Spec r e, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Seq c1 c2, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Cond b c1 c2, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Await b c2 e, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Call p, Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(DynCom c,Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Throw,Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(Catch c1 c2,Normal s)#u#xs) \\ cptn_mod\"\n\"(\\,(P,Normal s)#(P,s')#xs) \\ cptn_mod\"\n\"(\\,(P,Abrupt s)#(P,Abrupt s')#xs) \\ cptn_mod\"\n\"(\\,(P,Stuck)#(P,Stuck)#xs) \\ cptn_mod\"\n\"(\\,(P,Fault f)#(P,Fault f)#xs) \\ cptn_mod\"\n\ninductive_cases CptnMod_env_elim_cases [cases set]:\n\"(\\,(P,Normal s)#(P,s')#xs) \\ cptn_mod\"\n\"(\\,(P,Abrupt s)#(P,Abrupt s')#xs) \\ cptn_mod\"\n\"(\\,(P,Stuck)#(P,Stuck)#xs) \\ cptn_mod\"\n\"(\\,(P,Fault f)#(P,Fault f)#xs) \\ cptn_mod\"\n\n\nsubsection \\Equivalence of small semantics and computational\\\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n by (induct xs) auto\n\ndefinition catch_cond \nwhere\n\"catch_cond zs Q xs P s s'' s' \\ \\ (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P, s)#xs)))#ys)))))\n\"\n\nlemma div_catch: assumes cptn_m:\"(\\,list) \\ cptn_mod\"\nshows \"(\\s P Q zs. list=(Catch P Q, s)#zs \\\n (\\xs s' s''. \n (\\,(P, s)#xs) \\ cptn_mod \\ \n catch_cond zs Q xs P s s'' s' \\)) \n \"\nunfolding catch_cond_def\nusing cptn_m\nproof (induct rule: cptn_mod.induct)\ncase (CptnModOne \\ P s)\n thus ?case using cptn_mod.CptnModOne by blast \nnext\n case (CptnModSkip \\ P s t xs) \n from CptnModSkip.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Skip, t)\" by auto\n from CptnModSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1) by blast \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModSkip.hyps(2) redex_not_Catch by auto\n from CptnModSkip.hyps\n have in_cptn_mod: \"(\\, (Skip, t) # xs) \\ cptn_mod\" by auto \n then show ?case using no_catch by simp\nnext\n case (CptnModThrow \\ P s t xs) \n from CptnModThrow.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Throw, t)\" by auto \n from CptnModThrow.hyps\n have in_cptn_mod: \"(\\, (Throw, t) # xs) \\ cptn_mod\" by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModThrow.hyps(2) redex_not_Catch by auto\n then show ?case by auto\nnext\n case (CptnModCondT \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModCondF \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModCatch1 sa P Q zs)\n thus ?case by blast\nnext\n case (CptnModCatch2 \\ P0 s xs ys zs P1) \n from CptnModCatch2.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact \n then have \"zs = map (lift_catch P1) xs @((Skip,snd(last ((P0, s)#xs)))#ys)\" by (simp add:CptnModCatch2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, s) # zs = (Catch P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto\n then have \"(P0, s) = (P, sa)\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zs = (map (lift_catch Q) xs)@((Skip,snd(last ((P0, s)#xs)))#ys)\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift_catch P1) xs @ ((Skip,snd(last ((P0, s)#xs)))#ys)` \n by force \n then have \"(\\xs s' s''. ((\\,(P, s)#xs) \\ cptn_mod \\ \n ((zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\ys. ((fst(((P, s)#xs)!length xs)=Skip \\ (\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P0, s)#xs)))#ys))))))))\"\n using P0cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last CptnModCatch2.hyps(4) by blast \n } \n thus ?thesis by auto\n qed\nnext\n case (CptnModCatch3 \\ P0 s xs s' P1 ys zs)\n from CptnModCatch3.hyps(3) \n have last:\"fst (((P0, Normal s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n from CptnModCatch3.hyps(4) \n have lastnormal:\"snd (last ((P0, Normal s) # xs)) = Normal s'\"\n by (simp add: last_length)\n have P0cptn:\"(\\, (P0, Normal s) # xs) \\ cptn_mod\" by fact\n from CptnModCatch3.hyps(5) have P1cptn:\"(\\, (P1, snd (((P0, Normal s) # xs) ! length xs)) # ys) \\ cptn_mod\"\n by (simp add: last_length) \n then have \"zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, Normal s) # xs))) # ys\" by (simp add:CptnModCatch3.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, Normal s) # zs = (Catch P Q, Normal sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ Normal s= Normal sa \\ zs=zsa\" by auto \n have \"last ((P0, Normal s) # xs) = ((P, Normal sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last_length)\n then have \"zsa = map (lift_catch Q) xs @ (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` `zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, Normal s) # xs))) # ys` by force\n then have \"(\\, (P, Normal s) # xs) \\ cptn_mod \\ (fst(((P, Normal s)#xs)!length xs)=Throw \\\n snd(last ((P, Normal s)#xs)) = Normal s' \\ \n (\\ys. (\\,(Q, snd(((P, Normal s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, Normal s)#xs)!length xs))#ys)))\" \n using lastnormal P1cptn P0cptn `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last \n by auto \n }note this [of P0 P1 s zs] thus ?thesis by blast qed\nnext\n case (CptnModEnv \\ P s t xs) \n then have step:\"(\\, (P, t) # xs) \\ cptn_mod\" by auto \n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModEnv by auto\n show ?case \n proof (cases P)\n case (Catch P1 P2) \n then have eq_P_Catch:\"(P, t) # xs = (LanguageCon.com.Catch P1 P2, t) # xs\" by auto \n then obtain xsa t' t'' where \n p1:\"(\\, (P1, t) # xsa) \\ cptn_mod\" and p2:\"\n (xs = map (lift_catch P2) xsa \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs =\n map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys.(\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys)))\" \n using CptnModEnv(3) by auto\n have all_step:\"(\\, (P1, s)#((P1, t) # xsa)) \\ cptn_mod\"\n by (metis p1 Env Env_n cptn_mod.CptnModEnv env_normal_s step_e) \n show ?thesis using p2 \n proof \n assume \"xs = map (lift_catch P2) xsa\"\n have \"(P, t) # xs = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: `xs = map (lift_catch P2) xsa` lift_catch_def local.Catch)\n thus ?thesis using all_step eq_P_Catch by fastforce\n next \n assume \n \"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs =\n map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys. (\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys))\" \n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys)\"\n then obtain ys where p2_exec:\"(\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod \\\n xs = map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys\" \n by fastforce\n from a1 obtain t1 where t_normal: \"t=Normal t1\" \n using env_normal_s'_normal_s by blast\n have f1:\"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t)#xsa)) = LanguageCon.com.Throw\"\n using a1 by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xsa)) = Normal t'\"\n by fastforce \n then have p2_long_exec: \"(\\, (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys) \\ cptn_mod \\\n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys\" using p2_exec \n by (simp add: lift_catch_def local.Catch) \n thus ?thesis using a1 f1 last_normal all_step eq_P_Catch \n by (clarify, metis (no_types) list.size(4) not_step_c_env step_e) \n next\n assume \n as1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys. (\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys))\" \n then obtain ys where p1:\"(\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod \\ \n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys)\"\n proof -\n assume a1: \"\\ys. (\\, (LanguageCon.com.Skip, snd (last ((P1, t) # xsa))) # ys) \\ cptn_mod \\ (P, t) # xs = map (lift_catch P2) ((P1, t) # xsa) @ (LanguageCon.com.Skip, snd (last ((P1, t) # xsa))) # ys \\ thesis\"\n have \"(LanguageCon.com.Catch P1 P2, t) # map (lift_catch P2) xsa = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: lift_catch_def)\n thus ?thesis\n using a1 as1 eq_P_Catch by moura\n qed \n from as1 have p2: \"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t) #xsa)) = LanguageCon.com.Skip\"\n by fastforce \n thus ?thesis using p1 all_step eq_P_Catch by fastforce\n qed\n qed\n qed (auto)\nqed(force+)\n\n\ndefinition seq_cond \nwhere\n\"seq_cond zs Q xs P s s'' s' \\ \\ (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (\\,(Throw,Normal s')#ys) \\ cptn_mod \\\n zs=(map (lift Q) xs)@((Throw,Normal s')#ys)))))\n\"\n\nlemma div_seq: assumes cptn_m:\"(\\,list) \\ cptn_mod\"\nshows \"(\\s P Q zs. list=(Seq P Q, s)#zs \\\n (\\xs s' s''. \n (\\,(P, s)#xs) \\ cptn_mod \\ \n seq_cond zs Q xs P s s'' s' \\)) \n \"\nunfolding seq_cond_def\nusing cptn_m\nproof (induct rule: cptn_mod.induct)\n case (CptnModOne \\ P s)\n thus ?case using cptn_mod.CptnModOne by blast \nnext\n case (CptnModSkip \\ P s t xs) \n from CptnModSkip.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Skip, t)\" by auto\n from CptnModSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1) by blast \n have x: \"\\c c1 c2. redex c = Seq c1 c2 \\ False\"\n using redex_not_Seq by blast\n from CptnModSkip.hyps\n have in_cptn_mod: \"(\\, (Skip, t) # xs) \\ cptn_mod\" by auto \n then show ?case using CptnModSkip.hyps(2) SmallStepCon.redex_not_Seq by blast\nnext\n case (CptnModThrow \\ P s t xs)\n from CptnModThrow.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Throw, t)\" by auto \n moreover from CptnModThrow.hyps\n have in_cptn_mod: \"(\\, (Throw, t) # xs) \\ cptn_mod\" by auto \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" using CptnModThrow.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto \nnext \n case (CptnModCondT \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModCondF \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModSeq1 \\ P0 s xs zs P1)\n thus ?case by blast\nnext \n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n from CptnModSeq2.hyps(3) last_length have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(\\, (P0, s) # xs) \\ cptn_mod\" by fact\n from CptnModSeq2.hyps(4) have P1cptn:\"(\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\" by (simp add:CptnModSeq2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, s) # zs = (Seq P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys` \n by force \n then have \"(\\xs s' s''. (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (\\,(Throw,Normal s')#ys) \\ cptn_mod \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))))))\n \" \n using P0cptn P1cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last \n by blast \n } \n thus ?case by auto qed \nnext\n case (CptnModSeq3 \\ P0 s xs s' ys zs P1) \n from CptnModSeq3.hyps(3) \n have last:\"fst (((P0, Normal s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n have P0cptn:\"(\\, (P0, Normal s) # xs) \\ cptn_mod\" by fact\n from CptnModSeq3.hyps(4) \n have lastnormal:\"snd (last ((P0, Normal s) # xs)) = Normal s'\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ ((Throw, Normal s')#ys)\" by (simp add:CptnModSeq3.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, Normal s) # zs = (Seq P Q, Normal sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ Normal s=Normal sa \\ zs=zsa\" by auto\n then have \"(P0, Normal s) = (P, Normal sa)\" by auto \n have \"last ((P0, Normal s) # xs) = ((P, Normal sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last_length)\n then have zsa:\"zsa = (map (lift Q) xs)@((Throw,Normal s')#ys)\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` `zs = map (lift P1) xs @ ((Throw, Normal s')#ys)` \n by force\n then have a1:\"(\\,(Throw,Normal s')#ys) \\ cptn_mod\" using CptnModSeq3.hyps(5) by blast \n have \"(P, Normal sa::('b, 'c) xstate) = (P0, Normal s)\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` by auto \n then have \"(\\xs s'. (\\, (P, Normal sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P,Normal sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, Normal sa)#xs)!length xs)=Throw \\ \n snd(last ((P, Normal sa)#xs)) = Normal s' \\\n (\\ys. (\\,(Throw,Normal s')#ys) \\ cptn_mod \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))))))\"\n using P0cptn zsa a1 last lastnormal \n by blast \n } \n thus ?thesis by auto qed \nnext \n case (CptnModEnv \\ P s t zs) \n then have step:\"(\\, (P, t) # zs) \\ cptn_mod\" by auto\n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModEnv by auto \n show ?case \n proof (cases P)\n case (Seq P1 P2) \n then have eq_P:\"(P, t) # zs = (LanguageCon.com.Seq P1 P2, t) # zs\" by auto \n then obtain xs t' t'' where \n p1:\"(\\, (P1, t) # xs) \\ cptn_mod\" and p2:\"\n (zs = map (lift P2) xs \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs =\n map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\\n t = Normal t'' \\ (\\ys. (\\,(Throw,Normal t')#ys) \\ cptn_mod \\ \n zs =\n map (lift P2) xs @\n ((LanguageCon.com.Throw, Normal t')#ys))) \" \n using CptnModEnv(3) by auto\n have all_step:\"(\\, (P1, s)#((P1, t) # xs)) \\ cptn_mod\"\n by (metis p1 Env Env_n cptn_mod.CptnModEnv env_normal_s step_e) \n show ?thesis using p2 \n proof \n assume \"zs = map (lift P2) xs\"\n have \"(P, t) # zs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: `zs = map (lift P2) xs` lift_def local.Seq)\n thus ?thesis using all_step eq_P by fastforce\n next \n assume \n \"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\\n t = Normal t'' \\ (\\ys. (\\,(Throw,Normal t')#ys) \\ cptn_mod \\ \n zs = map (lift P2) xs @ ((LanguageCon.com.Throw, Normal t')#ys))\"\n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys)\"\n from a1 obtain ys where \n p2_exec:\"(\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zs = map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys\" \n by auto \n have f1:\"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs)) = LanguageCon.com.Skip\"\n using a1 by fastforce \n then have p2_long_exec: \n \"(\\, (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys) \\ cptn_mod \\\n (P, t)#zs = map (lift P2) ((P1, t) # xs) @\n (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys\" \n using p2_exec by (simp add: lift_def local.Seq) \n thus ?thesis using a1 f1 all_step eq_P by blast \n next\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\ t = Normal t'' \\ \n (\\ys. (\\,(Throw,Normal t')#ys) \\ cptn_mod \\ \n zs = map (lift P2) xs @ ((LanguageCon.com.Throw, Normal t')#ys))\" \n then have last_throw:\n \"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t) #xs)) = LanguageCon.com.Throw\" \n by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xs)) = Normal t'\"\n by fastforce\n have seq_lift:\n \"(LanguageCon.com.Seq P1 P2, t) # map (lift P2) xs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: a1 lift_def) \n thus ?thesis using a1 last_throw last_normal all_step eq_P \n by (clarify, metis (no_types, lifting) append_Cons env_normal_s'_normal_s step_e) \n qed\n qed\n qed (auto) \nqed (force)+\n\n\nlemma cptn_onlyif_cptn_mod_aux:\nassumes stepseq:\"\\\\\\<^sub>c (P, s) \\ (Q,t)\" and\n stepmod:\"(\\,(Q,t)#xs) \\ cptn_mod\"\nshows \"(\\,(P,s)#(Q,t)#xs) \\ cptn_mod\"\nusing stepseq stepmod\nproof (induct arbitrary: xs)\n case (Basicc f s) \n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.Basicc)\nnext\n case (Specc s t r)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.Specc) \nnext\n case (SpecStuckc s r)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.SpecStuckc)\nnext\n case (Guardc s g f c)\n thus ?case by (simp add: cptn_mod.CptnModGuard) \nnext\n case (GuardFaultc)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.GuardFaultc)\nnext\n case (Seqc c1 s c1' s' c2)\n have step: \"\\\\\\<^sub>c (c1, s) \\ (c1', s')\" by (simp add: Seqc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1) by blast \n have assum: \"(\\, (Seq c1' c2, s') # xs) \\ cptn_mod\" using Seqc.prems by blast\n have divseq:\"(\\s P Q zs. (Seq c1' c2, s') # xs=(Seq P Q, s)#zs \\\n (\\xs sv' sv''. ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (\\,(Throw,Normal sv')#ys) \\ cptn_mod \\\n zs=(map (lift Q) xs)@((Throw,Normal sv')#ys))\n ))))\n \n ))\" using div_seq [OF assum] unfolding seq_cond_def by auto\n {fix sa P Q zsa\n assume ass:\"(Seq c1' c2, s') # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ s' = sa \\ xs = zsa\" by auto\n then have \"(\\xs sv' sv''. (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (\\,(Throw,Normal sv')#ys) \\ cptn_mod \\\n zsa=(map (lift Q) xs)@((Throw,Normal sv')#ys))))))\" \n using ass divseq by blast\n } note conc=this [of c1' c2 s' xs] \n then obtain xs' sa' sa''\n where split:\"(\\, (c1', s') # xs') \\ cptn_mod \\\n (xs = map (lift c2) xs' \\ \n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (\\,(Throw,Normal sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))\n )))\" by blast\n then have \"(xs = map (lift c2) xs' \\ \n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (\\,(Throw,Normal sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys)))))\" by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift c2) xs'\"\n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Seqc.hyps(2) by blast\n then have \"(Seq c1' c2, s')#xs = map (lift c2) ((c1', s')#xs')\"\n using c1'nonf\n by (simp add: CptnModSeq1 lift_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModSeq1)\n next\n assume \"fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (\\,(Throw,Normal sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))))\" \n thus ?thesis\n proof\n assume assth:\"fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys)\"\n then obtain ys \n where split':\"(\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n by auto \n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Seqc.hyps(2) by blast \n then have seqmap:\"(Seq c1 c2, s)#(Seq c1' c2, s')#xs = map (lift c2) ((c1,s)#(c1', s')#xs') @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using split' \n by (simp add: CptnModSeq2 lift_def) \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Skip\" \n using assth by fastforce \n thus ?thesis \n using seqmap split' last_length cptn_mod.CptnModSeq2 \n induct_step lastc1 lastc1skip \n by fastforce\n next\n assume assm:\"((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (\\,(Throw,Normal sa')#ys) \\ cptn_mod \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))))\"\n then have s'eqsa'': \"s'=Normal sa''\" by auto\n then have snormal: \"\\ns. s=Normal ns\" by (metis Seqc.hyps(1) step_Abrupt_prop step_Fault_prop step_Stuck_prop xstate.exhaust)\n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" using split by blast \n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Seqc.hyps(2) by blast \n then obtain ys where seqmap:\"(Seq c1' c2, s')#xs = (map (lift c2) ((c1', s')#xs'))@((Throw,Normal sa')#ys)\"\n using assm\n proof -\n assume a1: \"\\ys. (LanguageCon.com.Seq c1' c2, s') # xs = map (lift c2) ((c1', s') # xs') @ (LanguageCon.com.Throw, Normal sa') # ys \\ thesis\"\n have \"(LanguageCon.com.Seq c1' c2, Normal sa'') # map (lift c2) xs' = map (lift c2) ((c1', s') # xs')\"\n by (simp add: assm lift_def)\n thus ?thesis\n using a1 assm by moura\n qed \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Throw\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = Normal sa'\"\n using assm by force \n thus ?thesis\n using assm c1'cptn induct_step lastc1skip snormal seqmap s'eqsa'' \n by (auto simp add:cptn_mod.CptnModSeq3)\n qed\n }qed \n \nnext\n case (SeqSkipc c2 s xs)\n have c2incptn:\"(\\, (c2, s) # xs) \\ cptn_mod\" by fact\n then have 1:\"(\\, [(Skip, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then have 2:\"fst(last ([(Skip, s)])) = Skip\" by fastforce\n then have 3:\"(\\,(c2, snd(last [(Skip, s)]))#xs) \\ cptn_mod\" \n using c2incptn by auto \n then have \"(c2,s)#xs=(map (lift c2) [])@(c2, snd(last [(Skip, s)]))#xs\" \n by (auto simp add:lift_def)\n thus ?case using 1 2 3 by (simp add: CptnModSeq2)\nnext\n case (SeqThrowc c2 s xs) \n have \"(\\, [(Throw, Normal s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne) \n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Throw, Normal s)#ys)\\ cptn_mod\"\n by auto\n moreover have \"fst (last ((Throw, Normal s)#ys)) = Throw\" using ys_nil last by auto\n moreover have \"snd (last ((Throw, Normal s)#ys)) = Normal s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case using SeqThrowc.prems cptn_mod.CptnModSeq3 by fastforce \nnext\n case (CondTruec s b c1 c2)\n thus ?case by (simp add: cptn_mod.CptnModCondT)\nnext\n case (CondFalsec s b c1 c2)\n thus ?case by (simp add: cptn_mod.CptnModCondF)\nnext\n case (WhileTruec s1 b c)\n have sinb: \"s1\\b\" by fact\n have SeqcWhile: \"(\\, (Seq c (While b c), Normal s1) # xs) \\ cptn_mod\" by fact \n have divseq:\"(\\s P Q zs. (Seq c (While b c), Normal s1) # xs=(Seq P Q, s)#zs \\\n (\\xs s'. ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal s' \\\n (\\ys. (\\,(Throw,Normal s')#ys) \\ cptn_mod \\\n zs=(map (lift Q) xs)@((Throw,Normal s')#ys)))))) \n ))\" using div_seq [OF SeqcWhile] by (auto simp add: seq_cond_def)\n{fix sa P Q zsa\n assume ass:\"(Seq c (While b c), Normal s1) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c = P \\ (While b c) = Q \\ Normal s1 = sa \\ xs = zsa\" by auto\n then have \"(\\xs s'. (\\, (P, sa) # xs) \\ cptn_mod \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal s' \\\n (\\ys. (\\,(Throw,Normal s')#ys) \\ cptn_mod \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))\n ))))\" \n using ass divseq by auto\n } note conc=this [of c \"While b c\" \"Normal s1\" xs] \n then obtain xs' s' \n where split:\"(\\, (c, Normal s1) # xs') \\ cptn_mod \\\n (xs = map (lift (While b c)) xs' \\\n fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\ \n (\\ys. (\\, ((Throw, Normal s')#ys)) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys)))\" by auto\n then have \"(xs = map (lift (While b c)) xs' \\\n fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (\\, ((Throw, Normal s')#ys)) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys)))\" ..\n thus ?case\n proof{ \n assume 1:\"xs = map (lift (While b c)) xs'\" \n have 3:\"(\\, (c, Normal s1) # xs') \\ cptn_mod\" using split by auto \n then show ?thesis using \"1\" cptn_mod.CptnModWhile1 sinb by fastforce \n next\n assume \"fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (\\, ((Throw, Normal s')#ys)) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys))\"\n thus ?case\n proof\n assume asm:\"fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\"\n then obtain ys \n where asm':\"(\\, (While b c, snd (last ((c, Normal s1) # xs'))) # ys)\n \\ cptn_mod \n \\ xs = map (lift (While b c)) xs' @\n (While b c, snd (last ((c, Normal s1) # xs'))) # ys\" \n by (auto simp add: last_length)\n moreover have 3:\"(\\, (c, Normal s1) # xs') \\ cptn_mod\" using split by auto\n moreover from asm have \"fst (last ((c, Normal s1) # xs')) = Skip\"\n by (simp add: last_length) \n ultimately show ?case using sinb by (auto simp add:CptnModWhile2)\n next\n assume asm:\" fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (\\, ((Throw, Normal s')#ys)) \\ cptn_mod \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys))\" \n moreover have 3:\"(\\, (c, Normal s1) # xs') \\ cptn_mod\" using split by auto\n moreover from asm have \"fst (last ((c, Normal s1) # xs')) = Throw\"\n by (simp add: last_length) \n ultimately show ?case using sinb by (auto simp add:CptnModWhile3)\n qed\n }qed \nnext\n case (WhileFalsec s b c)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.WhileFalsec)\nnext\n case (Awaitc s b c t)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.Awaitc)\nnext\n case (AwaitAbruptc s b c t t')\n thus ?case by (simp add: cptn_mod.CptnModThrow stepc.AwaitAbruptc) \nnext\n case (Callc p bdy s)\n thus ?case by (simp add: cptn_mod.CptnModCall) \nnext\n case (CallUndefinedc p s)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.CallUndefinedc)\nnext\n case (DynComc c s)\n thus ?case by (simp add: cptn_mod.CptnModDynCom) \nnext\n case (Catchc c1 s c1' s' c2)\n have step: \"\\\\\\<^sub>c (c1, s) \\ (c1', s')\" by (simp add: Catchc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1) by blast \n have assum: \"(\\, (Catch c1' c2, s') # xs) \\ cptn_mod\" \n using Catchc.prems by blast\n have divcatch:\"(\\s P Q zs. (Catch c1' c2, s') # xs=(Catch P Q, s)#zs \\\n (\\xs s' s''. ((\\,(P, s)#xs) \\ cptn_mod \\ \n (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P, s)#xs)))#ys)) \n ))))\n ))\" using div_catch [OF assum] by (auto simp add: catch_cond_def)\n {fix sa P Q zsa\n assume ass:\"(Catch c1' c2, s') # xs = (Catch P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ s' = sa \\ xs = zsa\" by auto\n then have \"(\\xs sv' sv''. ((\\,(P, sa)#xs) \\ cptn_mod \\ \n (zsa=(map (lift_catch Q) xs) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\\n snd(last ((P, sa)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (\\,(Q, snd(((P, sa)#xs)!length xs))#ys) \\ cptn_mod \\ \n zsa=(map (lift_catch Q) xs)@((Q, snd(((P, sa)#xs)!length xs))#ys)))) \\\n ((fst(((P, sa)#xs)!length xs)=Skip \\ \n (\\ys. (\\,(Skip,snd(last ((P, sa)#xs)))#ys) \\ cptn_mod \\ \n zsa=(map (lift_catch Q) xs)@((Skip,snd(last ((P, sa)#xs)))#ys))))))\n )\" using ass divcatch by blast\n } note conc=this [of c1' c2 s' xs] \n then obtain xs' sa' sa''\n where split:\n \"(\\, (c1', s') # xs') \\ cptn_mod \\ \n (xs = map (lift_catch c2) xs' \\\n fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift_catch c2) xs' @\n (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys)))\" \n by blast\n then have \"(xs = map (lift_catch c2) xs' \\\n fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs = map (lift_catch c2) xs' @\n (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys)))\" \n by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift_catch c2) xs'\"\n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Catchc.hyps(2) by blast\n then have \"(Catch c1' c2, s')#xs = map (lift_catch c2) ((c1', s')#xs')\"\n using c1'nonf\n by (simp add: CptnModCatch1 lift_catch_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModCatch1)\n next\n assume \"fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys))\" \n thus ?thesis\n proof\n assume assth:\n \"fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys)\"\n then have s'eqsa'': \"s'=Normal sa''\" by auto\n then have snormal: \"\\ns. s=Normal ns\" by (metis Catchc.hyps(1) step_Abrupt_prop step_Fault_prop step_Stuck_prop xstate.exhaust)\n then obtain ys \n where split':\"(\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using assth by auto \n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" \n using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Catchc.hyps(2) by blast \n then have seqmap:\"(Catch c1 c2, s)#(Catch c1' c2, s')#xs = map (lift_catch c2) ((c1,s)#(c1', s')#xs') @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using split' by (simp add: CptnModCatch3 lift_catch_def) \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Throw\" \n using assth by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = Normal sa'\"\n using assth by force\n thus ?thesis using snormal seqmap s'eqsa'' split' last_length cptn_mod.CptnModCatch3 induct_step lastc1 lastc1skip\n by fastforce \n next\n assume assm:\" fst (((c1', s') # xs') ! length xs') = Skip \\ \n (\\ys. (\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys))\"\n then have c1'cptn:\"(\\, (c1', s') # xs') \\ cptn_mod\" using split by blast\n then have induct_step: \"(\\, (c1, s) # (c1', s')#xs') \\ cptn_mod\"\n using Catchc.hyps(2) by blast \n then have \"map (lift_catch c2) ((c1', s') # xs') = (Catch c1' c2, s') # map (lift_catch c2) xs'\" \n by (auto simp add: lift_catch_def)\n then obtain ys \n where seqmap:\"(Catch c1' c2, s')#xs = (map (lift_catch c2) ((c1', s')#xs'))@((Skip,snd(last ((c1', s')#xs')))#ys)\"\n using assm by fastforce\n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Skip\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = snd (last ((c1', s') # xs'))\"\n using assm by force\n thus ?thesis \n using assm c1'cptn induct_step lastc1skip seqmap by (auto simp add:cptn_mod.CptnModCatch2)\n qed\n }qed \nnext\n case (CatchThrowc c2 s)\n have c2incptn:\"(\\, (c2, Normal s) # xs) \\ cptn_mod\" by fact\n then have 1:\"(\\, [(Throw, Normal s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then have 2:\"fst(last ([(Throw, Normal s)])) = Throw\" by fastforce\n then have 3:\"(\\,(c2, snd(last [(Throw, Normal s)]))#xs) \\ cptn_mod\" \n using c2incptn by auto \n then have \"(c2,Normal s)#xs=(map (lift c2) [])@(c2, snd(last [(Throw, Normal s)]))#xs\" \n by (auto simp add:lift_def)\n thus ?case using 1 2 3 by (simp add: CptnModCatch3)\nnext\n case (CatchSkipc c2 s)\n have \"(\\, [(Skip, s)]) \\ cptn_mod\" by (simp add: cptn_mod.CptnModOne)\n then obtain ys where ys_nil:\"ys=[]\" and last:\"(\\, (Skip, s)#ys)\\ cptn_mod\"\n by auto\n moreover have \"fst (last ((Skip, s)#ys)) = Skip\" using ys_nil last by auto\n moreover have \"snd (last ((Skip, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto \n ultimately show ?case using CatchSkipc.prems by simp (simp add: cptn_mod.CptnModCatch2 ys_nil)\nnext\n case (FaultPropc c f)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.FaultPropc) \nnext\n case (AbruptPropc c f)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.AbruptPropc)\nnext\n case (StuckPropc c)\n thus ?case by (simp add: cptn_mod.CptnModSkip stepc.StuckPropc)\nqed\n\nlemma cptn_onlyif_cptn_mod: \nassumes cptn_asm:\"(\\,c) \\ cptn\"\nshows \"(\\,c) \\ cptn_mod\"\nusing cptn_asm\nproof (induct) \n case CptnOne thus ?case by (rule CptnModOne)\nnext\n case (CptnEnv \\ P t xs s) thus ?case by (simp add: cptn_mod.CptnModEnv) \nnext\n case CptnComp thus ?case\n by (simp add: cptn_onlyif_cptn_mod_aux)\nqed\n\nlemma lift_is_cptn: \nassumes cptn_asm:\"(\\,c)\\cptn\"\nshows \"(\\,map (lift P) c) \\ cptn\"\nusing cptn_asm\nproof (induct)\n case CptnOne thus ?case using cptn.simps by fastforce\nnext\n case (CptnEnv \\ P s t xs) thus ?case \n by (cases rule:step_e.cases, \n (simp add: cptn.CptnEnv step_e.Env lift_def), \n (simp add: cptn.CptnEnv step_e.Env_n lift_def))\nnext \n case CptnComp thus ?case by (simp add: Seqc cptn.CptnComp lift_def)\nqed\n\nlemma lift_catch_is_cptn:\nassumes cptn_asm:\"(\\,c)\\cptn\"\nshows \"(\\,map (lift_catch P) c) \\ cptn\"\nusing cptn_asm\nproof (induct)\n case CptnOne thus ?case using cptn.simps by fastforce\nnext\n case CptnEnv thus ?case by (cases rule:step_e.cases, \n (simp add: cptn.CptnEnv step_e.Env lift_catch_def), \n (simp add: cptn.CptnEnv step_e.Env_n lift_catch_def))\nnext\n case CptnComp thus ?case by (simp add: Catchc cptn.CptnComp lift_catch_def)\nqed\n\nlemma last_lift: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=Q\\ \n \\ fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=Seq Q P\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_lift_catch: \"\\xs\\[]; fst(xs!(length xs - (Suc 0)))=Q\\ \n \\ fst((map (lift_catch P) xs)!(length (map (lift_catch P) xs)- (Suc 0)))=Catch Q P\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_catch_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\ \\P a \\ P (x!(length x - (Suc 0)))\" \n by (induct x) simp_all\n\n\nlemma last_fst_esp: \n \"fst(((P,s)#xs)!(length xs))=Skip \\ P\\Skip \\ fst(xs!(length xs - (Suc 0)))=Skip\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\[] \\ \n snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma last_snd_catch: \"xs\\[] \\ \n snd(((map (lift_catch P) xs))!(length (map (lift_catch P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_catch_def)\n\nlemma Cons_lift: \"((Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((P, s) # xs)\"\n by (simp add:lift_def)\nthm last_map eq_snd_iff list.inject list.simps(9) last_length\nlemma Cons_lift_catch: \"((Catch P Q), s) # (map (lift_catch Q) xs) = map (lift_catch Q) ((P, s) # xs)\"\n by (simp add:lift_catch_def)\n\nlemma Cons_lift_append: \n \"((Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((P, s) # xs)@ ys \"\n by (simp add:lift_def)\n\nlemma Cons_lift_catch_append: \n \"((Catch P Q), s) # (map (lift_catch Q) xs) @ ys = map (lift_catch Q) ((P, s) # xs)@ ys \"\n by (simp add:lift_catch_def)\n\nlemma lift_nth: \"i map (lift Q) xs ! i = lift Q (xs! i)\"\n by (simp add:lift_def)\n\nlemma lift_catch_nth: \"i map (lift_catch Q) xs ! i = lift_catch Q (xs! i)\"\n by (simp add:lift_catch_def)\nthm list.simps(9) last_length lift_catch_def Cons_lift_catch\nlemma snd_lift: \"i< length xs \\ snd(lift Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_def)\n\nlemma snd_lift_catch: \"i< length xs \\ snd(lift_catch Q (xs ! i))= snd (xs ! i)\"\n by (cases \"xs!i\") (simp add:lift_catch_def)\n\nlemma Normal_Normal: \nassumes p1:\"(\\, (P, Normal s) # a # as) \\ cptn\" and \n p2:\"(\\sb. snd (last ((P, Normal s) # a # as)) = Normal sb)\"\nshows \"\\sa. snd a = Normal sa\"\nproof -\n obtain la1 la2 where last_prod:\"last ((P, Normal s)# a#as) = (la1,la2)\" by fastforce\n obtain a1 a2 where a_prod:\"a=(a1,a2)\" by fastforce\n from p1 have clos_p_a:\"\\\\\\<^sub>c (P,Normal s) \\\\<^sub>c\\<^sub>e\\<^sup>* (a1, a2)\" using a_prod cptn_elim_cases(2)\n proof -\n have f1: \"(\\, (P, Normal s) # (a1, a2) # as) \\ cptn\"\n using a_prod p1 by fastforce\n have \"last [(a1, a2)] = (a1, a2)\"\n by auto\n thus ?thesis\n using f1 by (metis (no_types) cptn_dest1 cptn_stepconf_rtrancl last_ConsR not_Cons_self2)\n qed \n then have \"\\\\\\<^sub>c (fst a, snd a) \\\\<^sub>c\\<^sub>e\\<^sup>* (la1,la2)\"\n proof -\n from p1 have \"(\\,(a # as)) \\ cptn\" using a_prod cptn_dest by blast\n thus ?thesis by (metis cptn_stepconf_rtrancl last_ConsR last_prod list.distinct(1) prod.collapse) \n qed \n then obtain bb where \"Normal bb = la2\" using last_prod p2 by auto\n thus ?thesis by (metis (no_types) `\\\\\\<^sub>c (fst a, snd a) \\\\<^sub>c\\<^sub>e\\<^sup>* (la1, la2)` steps_ce_not_Normal)\nqed\n \n\nlemma lift_P1: \n assumes map_cptn:\"(\\, map (lift Q) ((P, s) # xs)) \\ cptn\" and\n P_ends:\"fst (last ((P, s) # xs)) = Skip\"\n shows \"(\\, map (lift Q) ((P, s) # xs) @ [(Q, snd (last ((P, s) # xs)))]) \\ cptn\"\nusing map_cptn P_ends\nproof (induct xs arbitrary: P s) \n case Nil\n have P0_skips: \"P=Skip\" using Nil.prems(2) by auto \n have \"(\\,[(Seq Skip Q, s), (Q, s)]) \\ cptn\"\n by (simp add: cptn.CptnComp SeqSkipc cptn.CptnOne)\n then show ?case using P0_skips by (simp add: lift_def)\nnext\n case (Cons a xs)\n have \"(\\, map (lift Q) ((P, s) # a # xs)) \\ cptn\"\n using Cons.prems(1) by blast \n have \"fst (last ( a # xs)) = Skip\" using Cons.prems(2) by auto\n also have seq_PQ:\"(\\,(Seq P Q,s) # (map (lift Q) (a#xs))) \\ cptn\"\n by (metis Cons.prems(1) Cons_lift)\n then have \"(\\,(map (lift Q) (a#xs))) \\ cptn\"\n proof -\n assume a1:\"(\\, (Seq P Q, s) # map (lift Q) (a # xs)) \\ cptn\" \n then obtain a1 a2 xs1 where a2: \"map (lift Q) (a#xs) = ((a1,a2)#xs1)\" by fastforce \n thus ?thesis using cptn_dest using seq_PQ by auto \n qed \n then have \"(\\, map (lift Q) (a#xs) @ [(Q, snd (last ((a#xs))))]) \\ cptn\" \n by (metis Cons.hyps(1) calculation prod.collapse) \n then have t1:\"(\\, (Seq (fst a) Q, (snd a))#map (lift Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))]) \\ cptn\"\n by (simp add: Cons_lift_append)\n then have \"(\\,(Seq P Q,s) # (Seq (fst a) Q, (snd a))#map (lift Q) xs)\\ cptn\"\n using seq_PQ by (simp add: Cons_lift) \n then have t2: \"(\\,(Seq P Q,s) # [(Seq (fst a) Q, (snd a))]) \\ cptn\"\n using cptn_dest1 by blast\n then have\"((Seq P Q,s) # [(Seq (fst a) Q, (snd a))])!length [(Seq (fst a) Q, (snd a))] = (Seq (fst a) Q, (snd a))\"\n by auto \n then have \"(\\,(Seq P Q,s) # [(Seq (fst a) Q, (snd a))]@map (lift Q) xs @ [(Q, snd (last ((P, s)#(a#xs))))])\\ cptn\"\n using cptn_append_is_cptn t1 t2 by blast \n then have \"(\\, map (lift Q) ((P,s)#(fst a, snd a)#xs) @[(Q, snd (last ((P, s)#(a#xs))))])\\cptn\"\n using Cons_lift_append append_Cons append_Nil by metis\n thus ?case by auto \nqed\n\n\nlemma lift_catch_P1: \n assumes map_cptn:\"(\\, map (lift_catch Q) ((P, Normal s) # xs)) \\ cptn\" and\n P_ends:\"fst (last ((P, Normal s) # xs)) = Throw\" and\n P_ends_normal:\"\\p. snd(last ((P, Normal s) # xs)) = Normal p\"\n shows \"(\\, map (lift_catch Q) ((P, Normal s) # xs) @ [(Q, snd (last ((P, Normal s) # xs)))]) \\ cptn\"\nusing map_cptn P_ends P_ends_normal\nproof (induct xs arbitrary: P s) \n case Nil\n have P0_skips: \"P=Throw\" using Nil.prems(2) by auto \n have \"(\\,[(Catch Throw Q, Normal s), (Q, Normal s)]) \\ cptn\"\n by (simp add: cptn.CptnComp CatchThrowc cptn.CptnOne)\n then show ?case using P0_skips by (simp add: lift_catch_def)\nnext\n case (Cons a xs) \n have s1:\"(\\, map (lift_catch Q) ((P, Normal s) # a # xs)) \\ cptn\"\n using Cons.prems(1) by blast \n have s2:\"fst (last ( a # xs)) = Throw\" using Cons.prems(2) by auto\n then obtain p where s3:\"snd(last (a #xs)) = Normal p\" using Cons.prems(3) by auto\n also have seq_PQ:\"(\\,(Catch P Q,Normal s) # (map (lift_catch Q) (a#xs))) \\ cptn\"\n by (metis Cons.prems(1) Cons_lift_catch) thm Cons.hyps\n then have axs_in_cptn:\"(\\,(map (lift_catch Q) (a#xs))) \\ cptn\"\n proof -\n assume a1:\"(\\, (Catch P Q, Normal s) # map (lift_catch Q) (a # xs)) \\ cptn\" \n then obtain a1 a2 xs1 where a2: \"map (lift_catch Q) (a#xs) = ((a1,a2)#xs1)\" by fastforce \n thus ?thesis using cptn_dest using seq_PQ by auto \n qed \n then have \"(\\, map (lift_catch Q) (a#xs) @ [(Q, snd (last ((a#xs))))]) \\ cptn\" \n proof (cases \"xs=[]\")\n case True thus ?thesis using s2 s3 axs_in_cptn by (metis Cons.hyps eq_snd_iff last_ConsL)\n next\n case False \n from seq_PQ have seq:\"(\\,(Catch P Q,Normal s) # (Catch (fst a) Q,snd a)#map (lift_catch Q) xs)\\ cptn\"\n by (simp add: Cons_lift_catch) \n obtain cf sf where last_map_axs:\"(cf,sf)=last (map (lift_catch Q) (a#xs))\" using prod.collapse by blast\n have \"\\p ps. (ps=[] \\ last [p] = p) \\ (ps\\[] \\ last (p#ps) = last ps)\" by simp \n then have tranclos:\"\\\\\\<^sub>c (Catch P Q,Normal s) \\\\<^sub>c\\<^sub>e\\<^sup>* (Catch (fst a) Q,snd a)\" using Cons_lift_catch\n by (metis (no_types) cptn_dest1 cptn_stepc_rtrancl not_Cons_self2 seq)\n have tranclos_a:\"\\\\\\<^sub>c (Catch (fst a) Q,snd a) \\\\<^sub>c\\<^sub>e\\<^sup>* (cf,sf)\"\n by (metis Cons_lift_catch axs_in_cptn cptn_stepc_rtrancl last_map_axs prod.collapse) \n have snd_last:\"snd (last (map (lift_catch Q) (a#xs))) = snd (last (a #xs))\"\n proof - \n have eqslist:\"snd(((map (lift_catch Q) (a#xs)))!(length (map (lift_catch Q) xs)))= snd((a#xs)!(length xs))\" \n using last_snd_catch by fastforce \n have \"(lift_catch Q a)#(map (lift_catch Q) xs) = (map (lift_catch Q) (a#xs))\" by auto\n then have \"(map (lift_catch Q) (a#xs))!(length (map (lift_catch Q) xs)) = last (map (lift_catch Q) (a#xs))\"\n using last_length [of \"(lift_catch Q a)\" \"(map (lift_catch Q) xs)\"] by auto\n thus ?thesis using eqslist by (simp add:last_length)\n qed\n then obtain p1 where \"(snd a) = Normal p1\"\n by (metis tranclos_a last_map_axs s3 snd_conv step_ce_normal_to_normal tranclos) \n moreover obtain a1 a2 where aeq:\"a = (a1,a2)\" by fastforce \n moreover have \"fst (last ((a1,a2) # xs)) = Throw\" using s2 False by auto \n moreover have \"(\\, map (lift_catch Q) ((a1,a2) # xs)) \\ cptn\" using aeq axs_in_cptn False by auto \n moreover have \"\\p. snd (last ((a1,a2) # xs)) = Normal p\" using s3 aeq by auto\n moreover have \"a2 = Normal p1\" using aeq calculation(1) by auto \n ultimately have \"(\\, map (lift_catch Q) ((a1,a2) # xs) @\n [(Q, snd (last ((a1,a2) # xs)))])\\ cptn\" \n using Cons.hyps aeq by blast\n thus ?thesis using aeq by force \n qed \n then have t1:\"(\\, (Catch (fst a) Q, (snd a))#map (lift_catch Q) xs @ [(Q, snd (last ((P, Normal s)#(a#xs))))]) \\ cptn\"\n by (simp add: Cons_lift_catch_append)\n then have \"(\\,(Catch P Q,Normal s) # (Catch (fst a) Q, (snd a))#map (lift_catch Q) xs)\\ cptn\"\n using seq_PQ by (simp add: Cons_lift_catch) \n then have t2: \"(\\,(Catch P Q,Normal s) # [(Catch (fst a) Q, (snd a))]) \\ cptn\"\n using cptn_dest1 by blast\n then have\"((Catch P Q,Normal s) # [(Catch (fst a) Q, (snd a))])!length [(Catch (fst a) Q, (snd a))] = (Catch (fst a) Q, (snd a))\"\n by auto \n then have \"(\\,(Catch P Q,Normal s) # [(Catch (fst a) Q, (snd a))]@map (lift_catch Q) xs @ [(Q, snd (last ((P, Normal s)#(a#xs))))])\\ cptn\"\n using cptn_append_is_cptn t1 t2 by blast\n then have \"(\\, map (lift_catch Q) ((P,Normal s)#(fst a, snd a)#xs) @[(Q, snd (last ((P,Normal s)#(a#xs))))])\\cptn\"\n using Cons_lift_catch_append append_Cons append_Nil by metis\n thus ?case by auto \nqed\n\nlemma seq2:\nassumes \n p1:\"(\\, (P0, s) # xs) \\ cptn_mod\" and\n p2:\"(\\, (P0, s) # xs) \\ cptn\" and\n p3:\"fst (last ((P0, s) # xs)) = Skip\" and\n p4:\"(\\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod\" and\n p5:\"(\\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn\" and\n p6:\"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\nshows \"(\\, (Seq P0 P1, s) # zs) \\ cptn\"\nusing p1 p2 p3 p4 p5 p6\nproof -\nhave last_skip:\"fst (last ((P0, s) # xs)) = Skip\" using p3 by blast \n have \"(\\, (map (lift P1) ((P0, s) # xs))@(P1, snd (last ((P0, s) # xs))) # ys) \\ cptn\"\n proof -\n have \"(\\,map (lift P1) ((P0, s) #xs)) \\ cptn\"\n using p2 lift_is_cptn by blast \n then have \"(\\,map (lift P1) ((P0, s) #xs)@[(P1, snd (last ((P0, s) # xs)))]) \\ cptn\" \n using last_skip lift_P1 by blast \n then have \"(\\,(Seq P0 P1, s) # map (lift P1) xs@[(P1, snd (last ((P0, s) # xs)))]) \\ cptn\"\n by (simp add: Cons_lift_append)\n moreover have \"last ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))]) = (P1, snd (last ((P0, s) # xs)))\" \n by auto \n moreover have \"last ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))]) =\n ((Seq P0 P1, s) # map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))])!length (map (lift P1) xs @[(P1, snd (last ((P0, s) # xs)))])\" \n by (metis last_length) \n ultimately have \"(\\, (Seq P0 P1, s) # map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys)\\ cptn\" \n using cptn_append_is_cptn p5 by fastforce\n thus ?thesis by (simp add: Cons_lift_append)\n qed \n thus ?thesis \n by (simp add: Cons_lift_append p6)\nqed\n\nlemma seq3:\nassumes\n p1:\"(\\, (P0, Normal s) # xs) \\ cptn_mod\" and\n p2:\"(\\, (P0, Normal s) # xs) \\ cptn\" and\n p3:\"fst (last ((P0, Normal s) # xs)) = Throw\" and\n p4:\"snd (last ((P0, Normal s) # xs)) = Normal s'\" and\n p5:\"(\\,(Throw,Normal s')#ys) \\ cptn_mod\" and\n p6:\"(\\,(Throw,Normal s')#ys) \\ cptn\" and\n p7:\"zs = map (lift P1) xs @((Throw,Normal s')#ys)\" \nshows \"(\\, (Seq P0 P1, Normal s) # zs) \\ cptn\"\nusing p1 p2 p3 p4 p5 p6 p7\nproof (induct xs arbitrary: zs P0 s) \n case Nil thus ?case using SeqThrowc cptn.simps by fastforce\nnext\n case (Cons a as)\n then obtain sa where \"snd a = Normal sa\" by (meson Normal_Normal)\n obtain a1 a2 where a_prod:\"a=(a1,a2)\" by fastforce\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\" by fastforce \n then have lasst_aas_last: \"last (a#as) = (last ((P0, Normal s) # a # as))\" by auto \n then have \"la1 = Throw\" using Cons.prems(3) last_prod by force\n have \"la2 = Normal s'\" using Cons.prems(4) last_prod lasst_aas_last by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have f2: \"Normal sa = a2\"\n using `snd a = Normal sa` a_prod by force\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Seq a1 P1, Normal sa) # \n map (lift P1) as @ ((Throw,Normal s')#ys)) \\ cptn\"\n using Cons.hyps Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6) a_prod f1 f2 by fastforce\n thus ?case\n proof -\n have \"(Seq a1 P1, a2) # map (lift P1) as @((Throw,Normal s')#ys) = zs\"\n by (simp add: Cons.prems(7) Cons_lift_append a_prod)\n thus ?thesis\n by (metis (no_types, lifting) Cons.prems(2) Seqc a_prod cptn.CptnComp cptn.CptnEnv Env cptn_elim_cases(2) f2 hyp) \n qed \nqed\n\nlemma cptn_if_cptn_mod: \nassumes cptn_mod_asm:\"(\\,c) \\ cptn_mod\"\nshows \"(\\,c) \\ cptn\"\nusing cptn_mod_asm\nproof (induct)\n case (CptnModOne) thus ?case using cptn.CptnOne by blast\nnext\n case CptnModSkip thus ?case by (simp add: cptn.CptnComp) \nnext\n case CptnModThrow thus ?case by (simp add: cptn.CptnComp) \nnext \n case CptnModCondT thus ?case by (simp add: CondTruec cptn.CptnComp) \nnext\n case CptnModCondF thus ?case by (simp add: CondFalsec cptn.CptnComp)\nnext\n case (CptnModSeq1 \\ P0 s xs zs P1) \n have \"(\\, map (lift P1) ((P0, s) # xs)) \\ cptn\"\n using CptnModSeq1.hyps(2) lift_is_cptn by blast\n thus ?case by (simp add: Cons_lift CptnModSeq1.hyps(3))\nnext\n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n thus ?case by (simp add:seq2)\nnext\n case (CptnModSeq3 \\ P0 s xs s' zs P1) \n thus ?case by (simp add: seq3)\nnext\n case (CptnModWhile1 \\ P s xs b zs) thus ?case by (metis Cons_lift WhileTruec cptn.CptnComp lift_is_cptn)\nnext \n case (CptnModWhile2 \\ P s xs b zs ys) \n then have \"(\\, (Seq P (While b P), Normal s) # zs) \\ cptn\" \n by (simp add:seq2) \n then have \"\\\\\\<^sub>c(While b P,Normal s) \\ (Seq P (While b P),Normal s)\" \n by (simp add: CptnModWhile2.hyps(4) WhileTruec)\n thus ?case\n by (simp add: `(\\, (Seq P (While b P), Normal s) # zs) \\ cptn` cptn.CptnComp) \nnext\n case (CptnModWhile3 \\ P s xs b s' ys zs) \n then have \"(\\,(Seq P (While b P), Normal s) # zs) \\ cptn\"\n by (simp add: seq3) \n then have \"\\\\\\<^sub>c(While b P,Normal s) \\ (Seq P (While b P),Normal s)\" by (simp add: CptnModWhile3.hyps(4) WhileTruec)\n thus ?case by (simp add: `(\\, (Seq P (While b P), Normal s) # zs) \\ cptn` cptn.CptnComp)\nnext \n case (CptnModCall \\ bdy s ys p) thus ?case by (simp add: Callc cptn.CptnComp) \nnext\n case (CptnModDynCom \\ c s ys) thus ?case by (simp add: DynComc cptn.CptnComp)\nnext\n case (CptnModGuard \\ c s ys g f) thus ?case by (simp add: Guardc cptn.CptnComp)\nnext\n case (CptnModCatch1 \\ P0 s xs zs P1)\n have \"(\\, map (lift_catch P1) ((P0, s) # xs)) \\ cptn\"\n using CptnModCatch1.hyps(2) lift_catch_is_cptn by blast\n thus ?case by (simp add: Cons_lift_catch CptnModCatch1.hyps(3))\nnext\n case (CptnModCatch2 \\ P0 s xs ys zs P1)\n thus ?case\n proof (induct xs arbitrary: zs P0 s) \n case Nil thus ?case using CatchSkipc cptn.simps by fastforce\n next\n case (Cons a as)\n then obtain sa where \"snd a = sa\" by auto\n then obtain a1 a2 where a_prod:\"a=(a1,a2)\" and sa_a2: \"a2 =sa\" \n by fastforce\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\" by fastforce \n then have lasst_aas_last: \"last (a#as) = (last ((P0, s) # a # as))\" by auto \n then have \"la1 = Skip\" using Cons.prems(3) last_prod by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Catch a1 P1, a2) # \n map (lift_catch P1) as @ ((Skip, la2)#ys)) \\ cptn\"\n using Cons.hyps Cons.prems a_prod f1 last_prod by fastforce\n thus ?case\n proof -\n have f1:\"(Catch a1 P1, a2) # map (lift_catch P1) as @ ((Skip, la2)#ys) = zs\"\n using Cons.prems(4) Cons_lift_catch_append a_prod last_prod by (simp add: Cons.prems(6)) \n have \"(\\, map (lift_catch P1) ((P0, s) # a # as)) \\ cptn\"\n using Cons.prems(2) lift_catch_is_cptn by blast\n hence \"(\\, (LanguageCon.com.Catch P0 P1, s) # (LanguageCon.com.Catch a1 P1, a2) # map (lift_catch P1) as) \\ cptn\"\n by (metis (no_types) Cons_lift_catch a_prod)\n hence \"(\\, (LanguageCon.com.Catch P0 P1, s) # zs) \\ cptn \\ (\\, (LanguageCon.com.Catch P0 P1, s) # (LanguageCon.com.Catch a1 P1, a2) # map (lift_catch P1) as) \\ cptn \\ (\\ \\\\\\<^sub>c (LanguageCon.com.Catch P0 P1, s) \\\\<^sub>e (LanguageCon.com.Catch P0 P1, a2) \\ (\\, (LanguageCon.com.Catch P0 P1, a2) # map (lift_catch P1) as) \\ cptn \\ LanguageCon.com.Catch a1 P1 \\ LanguageCon.com.Catch P0 P1)\"\n using f1 cptn.CptnEnv hyp by blast\n thus ?thesis\n by (metis (no_types) f1 cptn.CptnComp cptn_elim_cases(2) hyp)\n qed\n qed\nnext \n case (CptnModCatch3 \\ P0 s xs s' P1 ys zs)\n thus ?case\n proof (induct xs arbitrary: zs P0 s) \n case Nil thus ?case using CatchThrowc cptn.simps by fastforce\n next\n case (Cons a as)\n then obtain sa where \"snd a = Normal sa\" by (meson Normal_Normal)\n obtain a1 a2 where a_prod:\"a=(a1,a2)\" by fastforce\n obtain la1 la2 where last_prod:\"last (a#as) = (la1,la2)\" by fastforce \n then have lasst_aas_last: \"last (a#as) = (last ((P0, Normal s) # a # as))\" by auto \n then have \"la1 = Throw\" using Cons.prems(3) last_prod by force\n have \"la2 = Normal s'\" using Cons.prems(4) last_prod lasst_aas_last by force\n have f1: \"(\\, (a1, a2) # as) \\ cptn\"\n using Cons.prems(2) a_prod cptn_dest by blast\n have f2: \"Normal sa = a2\"\n using `snd a = Normal sa` a_prod by force\n have \"(\\, a # as) \\ cptn_mod\"\n using f1 a_prod cptn_onlyif_cptn_mod by blast\n then have hyp:\"(\\, (Catch a1 P1, Normal sa) # \n map (lift_catch P1) as @ (P1, snd (last ((a1, Normal sa) # as))) # ys) \\ cptn\"\n using Cons.hyps Cons.prems a_prod f1 f2 by auto\n thus ?case\n proof -\n have \"\\\\\\<^sub>c (P0, Normal s) \\\\<^sub>e (P0, a2)\"\n by (fastforce intro: step_e.intros)\n then have transit:\"\\\\\\<^sub>c(P0,Normal s) \\\\<^sub>c\\<^sub>e (a1,Normal sa)\" \n by (metis (no_types) Cons.prems(2) a_prod c_step cptn_elim_cases(2) e_step f2)\n then have transit_catch:\"\\\\\\<^sub>c(Catch P0 P1,Normal s) \\\\<^sub>c\\<^sub>e (Catch a1 P1,Normal sa)\"\n by (metis (no_types) Catchc c_step e_step env_c_c' step_ce_elim_cases step_e.intros(1)) \n have \"(Catch a1 P1, a2) # map (lift_catch P1) as @ (P1, la2) # ys = zs\"\n using Cons.prems Cons_lift_catch_append a_prod last_prod by auto \n have \"a=(a1, Normal sa)\" using a_prod f2 by auto\n have \"snd (last ((a1, Normal sa) # as)) = Normal s'\"\n using `a = (a1, Normal sa)` `snd (last ((P0, Normal s) # a # as)) = Normal s'` lasst_aas_last by fastforce\n hence f1: \"snd (last ((a1, Normal sa) # as)) = la2\"\n using `la2 = Normal s'` by blast\n have \"\\\\\\<^sub>c (LanguageCon.com.Catch P0 P1, Normal s) \\\\<^sub>c\\<^sub>e (LanguageCon.com.Catch a1 P1, a2)\"\n using f2 transit_catch by blast\n thus ?thesis\n using f1 `(LanguageCon.com.Catch a1 P1, a2) # map (lift_catch P1) as @ (P1, la2) # ys = zs` \n cptn.CptnComp cptn.CptnEnv f2 hyp not_eq_not_env step_ce_not_step_e_step_c \n by metis\n qed\n qed\nnext \n case (CptnModEnv) thus ?case by (simp add: cptn.CptnEnv)\nqed\n\nlemma cptn_eq_cptn_mod: \nshows \"(x \\cptn_mod) = (x\\cptn)\"\nby (cases x, auto simp add: cptn_if_cptn_mod cptn_onlyif_cptn_mod)\n\nlemma cptn_eq_cptn_mod_set: \nshows \"cptn_mod = cptn\"\nby (auto simp add: cptn_if_cptn_mod cptn_onlyif_cptn_mod)\n\nsubsection \\Computational modular semantic for nested calls\\\ninductive_set cptn_mod_nest_call :: \"(nat\\('s,'p,'f,'e) confs) set\"\nwhere\n CptnModNestOne: \"(n,\\,[(P, s)]) \\ cptn_mod_nest_call\"\n| CptnModNestEnv: \"\\\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t);(n,\\,(P, t)#xs) \\ cptn_mod_nest_call\\ \\ \n (n,\\,(P, s)#(P, t)#xs) \\ cptn_mod_nest_call\"\n| CptnModNestSkip: \"\\\\\\\\<^sub>c(P,s) \\ (Skip,t); redex P = P; \n \\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Skip \\ P \\ Call f );\n (n,\\,(Skip, t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Skip, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestThrow: \"\\\\\\\\<^sub>c(P,s) \\ (Throw,t); redex P = P; \n \\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Throw \\ P \\ Call f );\n (n,\\,(Throw, t)#xs) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(P,s)#(Throw, t)#xs) \\cptn_mod_nest_call\"\n\n| CptnModNestCondT: \"\\(n,\\,(P0, Normal s)#ys) \\ cptn_mod_nest_call; s \\ b \\ \\ \n (n,\\,((Cond b P0 P1), Normal s)#(P0, Normal s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestCondF: \"\\(n,\\,(P1, Normal s)#ys) \\ cptn_mod_nest_call; s \\ b \\ \\ \n (n,\\,((Cond b P0 P1), Normal s)#(P1, Normal s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq1: \n \"\\(n,\\,(P0, s)#xs) \\ cptn_mod_nest_call; zs=map (lift P1) xs \\ \\ \n (n,\\,((Seq P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq2: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, s)#xs)) = Skip;\n (n,\\,(P1, snd(last ((P0, s)#xs)))#ys) \\ cptn_mod_nest_call;\n zs=(map (lift P1) xs)@((P1, snd(last ((P0, s)#xs)))#ys) \\ \\ \n (n,\\,((Seq P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestSeq3: \n \"\\(n,\\, (P0, Normal s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P0, Normal s)#xs)) = Throw;\n snd(last ((P0, Normal s)#xs)) = Normal s'; \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call; \n zs=(map (lift P1) xs)@((Throw,Normal s')#ys) \\ \\\n (n,\\,((Seq P0 P1), Normal s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile1: \n \"\\(n,\\, (P, Normal s)#xs) \\ cptn_mod_nest_call; s \\ b; \n zs=map (lift (While b P)) xs \\ \\ \n (n,\\, ((While b P), Normal s)#\n ((Seq P (While b P)),Normal s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile2: \n \"\\ (n,\\, (P, Normal s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P, Normal s)#xs))=Skip; s \\ b; \n zs=(map (lift (While b P)) xs)@\n (While b P, snd(last ((P, Normal s)#xs)))#ys; \n (n,\\,(While b P, snd(last ((P, Normal s)#xs)))#ys) \\ \n cptn_mod_nest_call\\ \\ \n (n,\\,(While b P, Normal s)#\n (Seq P (While b P), Normal s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestWhile3: \n \"\\ (n,\\, (P, Normal s)#xs) \\ cptn_mod_nest_call; \n fst(last ((P, Normal s)#xs))=Throw; s \\ b;\n snd(last ((P, Normal s)#xs)) = Normal s'; \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call; \n zs=(map (lift (While b P)) xs)@((Throw,Normal s')#ys)\\ \\ \n (n,\\,(While b P, Normal s)#\n (Seq P (While b P), Normal s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCall: \"\\(n,\\,(bdy, Normal s)#ys) \\ cptn_mod_nest_call;\\ p = Some bdy; bdy\\Call p \\ \\ \n (Suc n, \\,((Call p), Normal s)#(bdy, Normal s)#ys) \\ cptn_mod_nest_call\" \n\n| CptnModNestDynCom: \"\\(n,\\,(c s, Normal s)#ys) \\ cptn_mod_nest_call \\ \\ \n (n,\\,(DynCom c, Normal s)#(c s, Normal s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestGuard: \"\\(n,\\,(c, Normal s)#ys) \\ cptn_mod_nest_call; s \\ g \\ \\ \n (n,\\,(Guard f g c, Normal s)#(c, Normal s)#ys) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch1: \"\\(n,\\,(P0, s)#xs) \\ cptn_mod_nest_call; zs=map (lift_catch P1) xs \\\n \\ (n,\\,((Catch P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch2: \n \"\\(n,\\, (P0, s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, s)#xs)) = Skip; \n (n,\\,(Skip,snd(last ((P0, s)#xs)))#ys) \\ cptn_mod_nest_call; \n zs=(map (lift_catch P1) xs)@((Skip,snd(last ((P0, s)#xs)))#ys) \\ \\ \n (n,\\,((Catch P0 P1), s)#zs) \\ cptn_mod_nest_call\"\n\n| CptnModNestCatch3: \n \"\\(n,\\, (P0, Normal s)#xs) \\ cptn_mod_nest_call; fst(last ((P0, Normal s)#xs)) = Throw; \n snd(last ((P0, Normal s)#xs)) = Normal s';\n (n,\\,(P1, snd(last ((P0, Normal s)#xs)))#ys) \\ cptn_mod_nest_call; \n zs=(map (lift_catch P1) xs)@((P1, snd(last ((P0, Normal s)#xs)))#ys) \\ \\ \n (n,\\,((Catch P0 P1), Normal s)#zs) \\ cptn_mod_nest_call\"\n\nlemmas CptnMod_nest_call_induct = cptn_mod_nest_call.induct [of _ _ \"[(c,s)]\", split_format (complete), case_names\nCptnModOne CptnModEnv CptnModSkip CptnModThrow CptnModCondT CptnModCondF \nCptnModSeq1 CptnModSeq2 CptnModSeq3 CptnModSeq4 CptnModWhile1 CptnModWhile2 CptnModWhile3 CptnModCall CptnModDynCom CptnModGuard \nCptnModCatch1 CptnModCatch2 CptnModCatch3, induct set]\n\ninductive_cases CptnModNest_elim_cases [cases set]:\n\"(n,\\,(Skip, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Guard f g c, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Basic f e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Spec r e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Seq c1 c2, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Cond b c1 c2, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Await b c2 e, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Call p, s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(DynCom c,s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Throw,s)#u#xs) \\ cptn_mod_nest_call\"\n\"(n,\\,(Catch c1 c2,s)#u#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases stepc_elim_cases_Seq_Seq':\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (Seq c1' c2',s')\" \n\ninductive_cases stepc_elim_cases_Catch_Catch':\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Catch c1' c2',s')\" \n\ninductive_cases CptnModNest_same_elim_cases [cases set]:\n\"(n,\\,(u, s)#(u,t)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Stuck [cases set]:\n\"(n,\\,(P, Stuck)#(Skip, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Fault [cases set]:\n\"(n,\\,(P, Fault f)#(Skip, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Abrupt [cases set]:\n\"(n,\\,(P, Abrupt as)#(Skip, s)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_Stuck [cases set]:\n\"(n,\\,(Call p, s)#(Skip, Stuck)#xs) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call [cases set]:\n\"(0, \\,((Call p), Normal s)#(bdy, Normal s)#ys) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnEmpty [cases set]:\n\"(n, \\,[]) \\ cptn_mod_nest_call\"\n\ninductive_cases CptnModNest_elim_cases_Call_normal [cases set]:\n\"(Suc n, \\,((Call p), Normal s)#(bdy, Normal s)#ys) \\ cptn_mod_nest_call\"\n\nlemma cptn_mod_nest_mono1: \"(n,\\,cfs) \\ cptn_mod_nest_call \\ (Suc n,\\,cfs)\\ cptn_mod_nest_call\"\nproof (induct rule:cptn_mod_nest_call.induct)\n case (CptnModNestOne) thus ?case using cptn_mod_nest_call.CptnModNestOne by auto\nnext\n case (CptnModNestEnv) thus ?case using cptn_mod_nest_call.CptnModNestEnv by fastforce\nnext\n case (CptnModNestSkip) thus ?case using cptn_mod_nest_call.CptnModNestSkip by fastforce\nnext\n case (CptnModNestThrow) thus ?case using cptn_mod_nest_call.intros(4) by fastforce\nnext\n case (CptnModNestCondT n) thus ?case \n using cptn_mod_nest_call.CptnModNestCondT[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCondF n) thus ?case \n using cptn_mod_nest_call.CptnModNestCondF[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestSeq1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq1[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestSeq2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq2[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestSeq3 n) thus ?case \n using cptn_mod_nest_call.CptnModNestSeq3[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestWhile1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile1[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestWhile2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile2[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestWhile3 n) thus ?case \n using cptn_mod_nest_call.CptnModNestWhile3[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCall) thus ?case \n using cptn_mod_nest_call.CptnModNestCall by fastforce\nnext \n case (CptnModNestDynCom) thus ?case \n using cptn_mod_nest_call.CptnModNestDynCom by fastforce\nnext\n case (CptnModNestGuard n) thus ?case \n using cptn_mod_nest_call.CptnModNestGuard[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCatch1 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch1[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCatch2 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch2[of \"Suc n\"] by fastforce\nnext\n case (CptnModNestCatch3 n) thus ?case \n using cptn_mod_nest_call.CptnModNestCatch3[of \"Suc n\"] by fastforce\nqed\n\nlemma cptn_mod_nest_mono2: \n \"(n,\\,cfs) \\ cptn_mod_nest_call \\ m>n \\\n (m,\\,cfs)\\ cptn_mod_nest_call\"\nproof (induct \"m-n\" arbitrary: m n)\n case 0 thus ?case by auto\nnext\n case (Suc k) \n have \"m - Suc n = k\"\n using Suc.hyps(2) Suc.prems(2) Suc_diff_Suc Suc_inject by presburger\n then show ?case\n using Suc.hyps(1) Suc.prems(1) Suc.prems(2) cptn_mod_nest_mono1 less_Suc_eq by blast \nqed\n\nlemma cptn_mod_nest_mono: \n \"(n,\\,cfs) \\ cptn_mod_nest_call \\ m\\n \\\n (m,\\,cfs)\\ cptn_mod_nest_call\"\nproof (cases \"n=m\")\n assume \"(n, \\, cfs) \\ cptn_mod_nest_call\" and \n \"n = m\" thus ?thesis by auto\nnext\n assume \"(n, \\, cfs) \\ cptn_mod_nest_call\" and \n \"n\\m\" and\n \"n \\ m\" \n thus ?thesis by (auto simp add: cptn_mod_nest_mono2)\nqed\n\nsubsection \\Lemmas on normalization\\\n\n(* lemma step_sequence_flatten:\n assumes exec: \"\\\\\\<^sub>c(P,s) \\ (Q,t)\" \n shows \"\\\\\\<^sub>c(sequence Seq (flatten P),s) \\ (sequence Seq (flatten Q),t)\"\nusing exec\nproof (induct rule: stepc_induct)\n case (Guardc s g f c) thus ?case using stepc.Guardc\n case (Seqc c1 s c2 s' c2')\n then have \" \\\\\\<^sub>c (Seq (LanguageCon.sequence LanguageCon.com.Seq (LanguageCon.flatten c1)) c2', s) \\\n (Seq (LanguageCon.sequence LanguageCon.com.Seq (LanguageCon.flatten c2)) c2', s') \" \n using stepc.Seqc by fastforce \n thus ?case sorry\nqed(auto intro:stepc.intros)+\n\nlemma normalice_step:\n assumes exec:\"\\\\\\<^sub>c(P,s) \\ (Q,t)\" \n shows \"\\\\\\<^sub>c( normalizec P,s) \\ (normalizec Q,t)\"\nusing exec\nproof(induct rule:stepc_induct)\n case (Catchc P s Q t c2)\n thus ?case\n *) \n(* qed(auto intro: stepc.intros) *)\n\nsubsection \\Equivalence of comp mod semantics and comp mod nested\\\n\ndefinition catch_cond_nest\nwhere\n\"catch_cond_nest zs Q xs P s s'' s' \\ n \\ (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P, s)#xs)))#ys)))))\n\"\n\nlemma div_catch_nest: assumes cptn_m:\"(n,\\,list) \\ cptn_mod_nest_call\"\nshows \"(\\s P Q zs. list=(Catch P Q, s)#zs \\\n (\\xs s' s''. \n (n, \\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs P s s'' s' \\ n)) \n \"\nunfolding catch_cond_nest_def\nusing cptn_m\nproof (induct rule: cptn_mod_nest_call.induct)\ncase (CptnModNestOne \\ P s)\n thus ?case using cptn_mod_nest_call.CptnModNestOne by blast \nnext\n case (CptnModNestSkip \\ P s t n xs) \n from CptnModNestSkip.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Skip, t)\" by auto\n from CptnModNestSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1) by blast \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestSkip.hyps(2) redex_not_Catch by auto\n from CptnModNestSkip.hyps\n have in_cptn_mod: \"(n,\\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n then show ?case using no_catch by simp\nnext\n case (CptnModNestThrow \\ P s t n xs) \n from CptnModNestThrow.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Throw, t)\" by auto \n from CptnModNestThrow.hyps\n have in_cptn_mod: \"(n,\\, (Throw, t) # xs) \\ cptn_mod_nest_call\" by auto \n have no_catch: \"\\p1 p2. \\(P=Catch p1 p2)\" using CptnModNestThrow.hyps(2) redex_not_Catch by auto\n then show ?case by auto\nnext\n case (CptnModNestCondT \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModNestCondF \\ P0 s ys b P1)\n thus ?case using CptnModOne by blast\nnext\n case (CptnModNestCatch1 sa P Q zs)\n thus ?case by blast\nnext\n case (CptnModNestCatch2 n \\ P0 s xs ys zs P1) \n from CptnModNestCatch2.hyps(3) \n have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact \n then have \"zs = map (lift_catch P1) xs @((Skip,snd(last ((P0, s)#xs)))#ys)\" by (simp add:CptnModNestCatch2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, s) # zs = (Catch P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto\n then have \"(P0, s) = (P, sa)\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zs = (map (lift_catch Q) xs)@((Skip,snd(last ((P0, s)#xs)))#ys)\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift_catch P1) xs @ ((Skip,snd(last ((P0, s)#xs)))#ys)` \n by force \n then have \"(\\xs s' s''. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n ((zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n (\\ys. ((fst(((P, s)#xs)!length xs)=Skip \\ (n,\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P0, s)#xs)))#ys))))))))\"\n using P0cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last CptnModNestCatch2.hyps(4) by blast \n } \n thus ?thesis by auto\n qed\nnext\n case (CptnModNestCatch3 n \\ P0 s xs s' P1 ys zs)\n from CptnModNestCatch3.hyps(3) \n have last:\"fst (((P0, Normal s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n from CptnModNestCatch3.hyps(4) \n have lastnormal:\"snd (last ((P0, Normal s) # xs)) = Normal s'\"\n by (simp add: last_length)\n have P0cptn:\"(n,\\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestCatch3.hyps(5) \n have P1cptn:\"(n,\\, (P1, snd (((P0, Normal s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call\"\n by (simp add: last_length) \n then have \"zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, Normal s) # xs))) # ys\" \n by (simp add:CptnModNestCatch3.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Catch P0 P1, Normal s) # zs = (Catch P Q, Normal sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ Normal s= Normal sa \\ zs=zsa\" by auto \n have \"last ((P0, Normal s) # xs) = ((P, Normal sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last_length)\n then have \"zsa = map (lift_catch Q) xs @ (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` `zs = map (lift_catch P1) xs @ (P1, snd (last ((P0, Normal s) # xs))) # ys` by force\n then have \"(n,\\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\ (fst(((P, Normal s)#xs)!length xs)=Throw \\\n snd(last ((P, Normal s)#xs)) = Normal s' \\ \n (\\ys. (n,\\,(Q, snd(((P, Normal s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, Normal s)#xs)!length xs))#ys)))\" \n using lastnormal P1cptn P0cptn `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last \n by auto \n }note this [of P0 P1 s zs] thus ?thesis by blast qed\nnext\n case (CptnModNestEnv \\ P s t n xs) \n then have step:\"(n, \\, (P, t) # xs) \\ cptn_mod_nest_call\" by auto \n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModNestEnv by auto\n show ?case \n proof (cases P)\n case (Catch P1 P2) \n then have eq_P_Catch:\"(P, t) # xs = (LanguageCon.com.Catch P1 P2, t) # xs\" by auto \n then obtain xsa t' t'' where \n p1:\"(n,\\, (P1, t) # xsa) \\ cptn_mod_nest_call\" and \n p2:\" (xs = map (lift_catch P2) xsa \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @ (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys.(n,\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys)))\" \n using CptnModNestEnv(3) by auto\n have all_step:\"(n,\\, (P1, s)#((P1, t) # xsa)) \\ cptn_mod_nest_call\"\n using p1 Env Env_n cptn_mod.CptnModEnv env_normal_s step_e\n proof -\n have f1: \"SmallStepCon.redex P = SmallStepCon.redex P1\"\n using local.Catch by auto\n obtain bb :: \"('b, 'c) xstate \\ 'b\" where\n \"\\x2. (\\v5. x2 = Normal v5) = (x2 = Normal (bb x2))\"\n by moura\n then have \"s = t \\ s = Normal (bb s)\"\n by (metis (no_types) env_normal_s step_e)\n then show ?thesis\n using f1 by (metis (no_types) Env Env_n cptn_mod_nest_call.CptnModNestEnv p1)\n qed\n show ?thesis using p2 \n proof \n assume \"xs = map (lift_catch P2) xsa\"\n have \"(P, t) # xs = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: `xs = map (lift_catch P2) xsa` lift_catch_def local.Catch)\n thus ?thesis using all_step eq_P_Catch by fastforce\n next \n assume \n \"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs =\n map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\\n fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys. (n,\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys))\" \n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xsa)) = Normal t' \\\n t = Normal t'' \\\n (\\ys. (n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys)\"\n then obtain ys where p2_exec:\"(n,\\, (P2, snd (((P1, t) # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch P2) xsa @\n (P2, snd (((P1, t) # xsa) ! length xsa)) # ys\" \n by fastforce\n from a1 obtain t1 where t_normal: \"t=Normal t1\" \n using env_normal_s'_normal_s by blast\n have f1:\"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t)#xsa)) = LanguageCon.com.Throw\"\n using a1 by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xsa)) = Normal t'\"\n by fastforce \n then have p2_long_exec: \"(n,\\, (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys) \\ cptn_mod_nest_call \\\n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n (P2, snd (((P1, s)#(P1, t) # xsa) ! length ((P1, s)#xsa))) # ys\" using p2_exec \n by (simp add: lift_catch_def local.Catch) \n thus ?thesis using a1 f1 last_normal all_step eq_P_Catch \n by (clarify, metis (no_types) list.size(4) not_step_c_env step_e) \n next\n assume \n as1:\"fst (((P1, t) # xsa) ! length xsa) = LanguageCon.com.Skip \\\n (\\ys. (n,\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n xs = map (lift_catch P2) xsa @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys))\" \n then obtain ys where p1:\"(n,\\,(Skip,snd(last ((P1, t)#xsa)))#ys) \\ cptn_mod_nest_call \\ \n (P, t)#xs = map (lift_catch P2) ((P1, t) # xsa) @\n ((LanguageCon.com.Skip, snd (last ((P1, t) # xsa)))#ys)\"\n proof -\n assume a1: \"\\ys. (n,\\, (LanguageCon.com.Skip, snd (last ((P1, t) # xsa))) # ys) \\ cptn_mod_nest_call \\ \n (P, t) # xs = map (lift_catch P2) ((P1, t) # xsa) @ \n (LanguageCon.com.Skip, snd (last ((P1, t) # xsa))) # ys \\ \n thesis\"\n have \"(LanguageCon.com.Catch P1 P2, t) # map (lift_catch P2) xsa = map (lift_catch P2) ((P1, t) # xsa)\"\n by (simp add: lift_catch_def)\n thus ?thesis\n using a1 as1 eq_P_Catch by moura\n qed \n from as1 have p2: \"fst (((P1, s)#(P1, t) # xsa) ! length ((P1, t) #xsa)) = LanguageCon.com.Skip\"\n by fastforce \n thus ?thesis using p1 all_step eq_P_Catch by fastforce\n qed\n qed\n qed (auto)\nqed(force+)\n\n\ndefinition seq_cond_nest\nwhere\n\"seq_cond_nest zs Q xs P s s'' s' \\ n \\ (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift Q) xs)@((Throw,Normal s')#ys)))))\n\"\n\nlemma div_seq_nest: assumes cptn_m:\"(n,\\,list) \\ cptn_mod_nest_call\"\nshows \"(\\s P Q zs. list=(Seq P Q, s)#zs \\\n (\\xs s' s''. \n (n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n seq_cond_nest zs Q xs P s s'' s' \\ n)) \n \"\nunfolding seq_cond_nest_def\nusing cptn_m\nproof (induct rule: cptn_mod_nest_call.induct)\n case (CptnModNestOne \\ P s)\n thus ?case using cptn_mod_nest_call.CptnModNestOne \n by blast\nnext\n case (CptnModNestSkip \\ P s t n xs) \n from CptnModNestSkip.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Skip, t)\" by auto\n from CptnModNestSkip.hyps\n have noskip: \"~(P=Skip)\" using stepc_elim_cases(1) by blast \n have x: \"\\c c1 c2. redex c = Seq c1 c2 \\ False\"\n using redex_not_Seq by blast\n from CptnModNestSkip.hyps\n have in_cptn_mod: \"(n,\\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n then show ?case using CptnModNestSkip.hyps(2) SmallStepCon.redex_not_Seq by blast\nnext\n case (CptnModNestThrow \\ P s t xs)\n from CptnModNestThrow.hyps\n have step: \"\\\\\\<^sub>c (P, s) \\ (Throw, t)\" by auto \n moreover from CptnModNestThrow.hyps \n have no_seq: \"\\p1 p2. \\(P=Seq p1 p2)\" using CptnModNestThrow.hyps(2) redex_not_Seq by auto\n ultimately show ?case by auto \nnext \n case (CptnModNestCondT \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModNestCondF \\ P0 s ys b P1)\n thus ?case by auto\nnext\n case (CptnModNestSeq1 n \\ P0 s xs zs P1) thus ?case \n by blast \nnext \n case (CptnModNestSeq2 n \\ P0 s xs P1 ys zs) \n from CptnModNestSeq2.hyps(3) last_length have last:\"fst (((P0, s) # xs) ! length xs) = Skip\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestSeq2.hyps(4) have P1cptn:\"(n,\\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\" by (simp add:CptnModNestSeq2.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, s) # zs = (Seq P Q, sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ s=sa \\ zs=zsa\" by auto \n have \"last ((P0, s) # xs) = ((P, sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last_length)\n then have \"zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys\"\n using `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` `zs = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys` \n by force \n then have \"(\\xs s' s''. (n,\\, (P, sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))))))\n \" \n using P0cptn P1cptn `P0 = P \\ P1 = Q \\ s = sa \\ zs = zsa` last \n by blast \n } \n thus ?case by auto qed \nnext\n case (CptnModNestSeq3 n \\ P0 s xs s' ys zs P1) \n from CptnModNestSeq3.hyps(3) \n have last:\"fst (((P0, Normal s) # xs) ! length xs) = Throw\" \n by (simp add: last_length) \n have P0cptn:\"(n,\\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\" by fact\n from CptnModNestSeq3.hyps(4) \n have lastnormal:\"snd (last ((P0, Normal s) # xs)) = Normal s'\"\n by (simp add: last_length) \n then have \"zs = map (lift P1) xs @ ((Throw, Normal s')#ys)\" by (simp add:CptnModNestSeq3.hyps)\n show ?case\n proof -{\n fix sa P Q zsa \n assume eq:\"(Seq P0 P1, Normal s) # zs = (Seq P Q, Normal sa) # zsa\"\n then have \"P0 =P \\ P1 = Q \\ Normal s=Normal sa \\ zs=zsa\" by auto\n then have \"(P0, Normal s) = (P, Normal sa)\" by auto \n have \"last ((P0, Normal s) # xs) = ((P, Normal sa) # xs) ! length xs\"\n by (simp add: `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` last_length)\n then have zsa:\"zsa = (map (lift Q) xs)@((Throw,Normal s')#ys)\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` `zs = map (lift P1) xs @ ((Throw, Normal s')#ys)` \n by force\n then have a1:\"(n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call\" using CptnModNestSeq3.hyps(5) by blast \n have \"(P, Normal sa::('b, 'c) xstate) = (P0, Normal s)\"\n using `P0 = P \\ P1 = Q \\ Normal s = Normal sa \\ zs = zsa` by auto \n then have \"(\\xs s'. (n,\\, (P, Normal sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P,Normal sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, Normal sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, Normal sa)#xs)!length xs)=Throw \\ \n snd(last ((P, Normal sa)#xs)) = Normal s' \\\n (\\ys. (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))))))\"\n using P0cptn zsa a1 last lastnormal \n by blast \n } \n thus ?thesis by auto qed \nnext \n case (CptnModNestEnv \\ P s t n zs) \n then have step:\"(n,\\, (P, t) # zs) \\ cptn_mod_nest_call\" by auto\n have step_e: \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\" using CptnModNestEnv by auto \n show ?case \n proof (cases P)\n case (Seq P1 P2) \n then have eq_P:\"(P, t) # zs = (LanguageCon.com.Seq P1 P2, t) # zs\" by auto \n then obtain xs t' t'' where \n p1:\"(n,\\, (P1, t) # xs) \\ cptn_mod_nest_call\" and p2:\"\n (zs = map (lift P2) xs \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs =\n map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\\n t = Normal t'' \\ (\\ys. (n,\\,(Throw,Normal t')#ys) \\ cptn_mod_nest_call \\ \n zs =\n map (lift P2) xs @\n ((LanguageCon.com.Throw, Normal t')#ys))) \" \n using CptnModNestEnv(3) by auto\n have all_step:\"(n,\\, (P1, s)#((P1, t) # xs)) \\ cptn_mod_nest_call\" \n using p1 Env Env_n cptn_mod_nest_call.CptnModNestEnv env_normal_s step_e\n proof -\n have \"SmallStepCon.redex P = SmallStepCon.redex P1\"\n by (metis SmallStepCon.redex.simps(4) local.Seq)\n then show ?thesis\n by (metis (no_types) Env Env_n cptn_mod_nest_call.CptnModNestEnv env_normal_s p1 step_e)\n qed \n show ?thesis using p2 \n proof \n assume \"zs = map (lift P2) xs\"\n have \"(P, t) # zs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: `zs = map (lift P2) xs` lift_def local.Seq)\n thus ?thesis using all_step eq_P by fastforce\n next \n assume \n \"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\\n fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\\n t = Normal t'' \\ (\\ys. (n,\\,(Throw,Normal t')#ys) \\ cptn_mod_nest_call \\ \n zs = map (lift P2) xs @ ((LanguageCon.com.Throw, Normal t')#ys))\"\n then show ?thesis \n proof\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (\\ys. (n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @ (P2, snd (((P1, t) # xs) ! length xs)) # ys)\"\n from a1 obtain ys where \n p2_exec:\"(n,\\, (P2, snd (((P1, t) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift P2) xs @\n (P2, snd (((P1, t) # xs) ! length xs)) # ys\" \n by auto \n have f1:\"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs)) = LanguageCon.com.Skip\"\n using a1 by fastforce \n then have p2_long_exec: \n \"(n,\\, (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys) \\ cptn_mod_nest_call \\\n (P, t)#zs = map (lift P2) ((P1, t) # xs) @\n (P2, snd (((P1, s)#(P1, t) # xs) ! length ((P1, t)#xs))) # ys\" \n using p2_exec by (simp add: lift_def local.Seq) \n thus ?thesis using a1 f1 all_step eq_P by blast \n next\n assume \n a1:\"fst (((P1, t) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P1, t) # xs)) = Normal t' \\ t = Normal t'' \\ \n (\\ys. (n,\\,(Throw,Normal t')#ys) \\ cptn_mod_nest_call \\ \n zs = map (lift P2) xs @ ((LanguageCon.com.Throw, Normal t')#ys))\" \n then have last_throw:\n \"fst (((P1, s)#(P1, t) # xs) ! length ((P1, t) #xs)) = LanguageCon.com.Throw\" \n by fastforce\n from a1 have last_normal: \"snd (last ((P1, s)#(P1, t) # xs)) = Normal t'\"\n by fastforce\n have seq_lift:\n \"(LanguageCon.com.Seq P1 P2, t) # map (lift P2) xs = map (lift P2) ((P1, t) # xs)\"\n by (simp add: a1 lift_def) \n thus ?thesis using a1 last_throw last_normal all_step eq_P \n by (clarify, metis (no_types, lifting) append_Cons env_normal_s'_normal_s step_e) \n qed\n qed\n qed (auto) \nqed (force)+\n\nlemma map_lift_eq_xs_xs':\"map (lift a) xs = map (lift a) xs' \\ xs=xs'\" \nproof (induct xs arbitrary: xs')\n case Nil thus ?case by auto\nnext\n case (Cons x xsa)\n then have a0:\"(lift a) x # map (lift a) xsa = map (lift a) (x # xsa)\"\n by fastforce \n also obtain x' xsa' where xs':\"xs' = x'#xsa'\" \n using Cons by auto\n ultimately have a1:\"map (lift a) (x # xsa) =map (lift a) (x' # xsa')\"\n using Cons by auto\n then have xs:\"xsa=xsa'\" using a0 a1 Cons by fastforce\n then have \"(lift a) x' = (lift a) x\" using a0 a1 by auto\n then have \"x' = x\" unfolding lift_def\n by (metis (no_types, lifting) LanguageCon.com.inject(3) \n case_prod_beta old.prod.inject prod.collapse) \n thus ?case using xs xs' by auto\nqed\n\nlemma map_lift_catch_eq_xs_xs':\"map (lift_catch a) xs = map (lift_catch a) xs' \\ xs=xs'\" \nproof (induct xs arbitrary: xs')\n case Nil thus ?case by auto\nnext\n case (Cons x xsa)\n then have a0:\"(lift_catch a) x # map (lift_catch a) xsa = map (lift_catch a) (x # xsa)\"\n by auto \n also obtain x' xsa' where xs':\"xs' = x'#xsa'\" \n using Cons by auto\n ultimately have a1:\"map (lift_catch a) (x # xsa) =map (lift_catch a) (x' # xsa')\"\n using Cons by auto \n then have xs:\"xsa=xsa'\" using a0 a1 Cons by fastforce \n then have \"(lift_catch a) x' = (lift_catch a) x\" using a0 a1 by auto\n then have \"x' = x\" unfolding lift_catch_def\n by (metis (no_types, lifting) LanguageCon.com.inject(9) \n case_prod_beta old.prod.inject prod.collapse) \n thus ?case using xs xs' by auto\nqed\n\nlemma map_lift_all_seq:\n assumes a0:\"zs=map (lift a) xs\" and\n a1:\"ib. fst (zs!i) = Seq b a\"\nusing a0 a1\nproof (induct zs arbitrary: xs i)\n case Nil thus ?case by auto\nnext\n case (Cons z1 zsa) thus ?case unfolding lift_def\n proof -\n assume a1: \"z1 # zsa = map (\\b. case b of (P, s) \\ (LanguageCon.com.Seq P a, s)) xs\"\n have \"\\p c. \\x. \\pa ca xa. \n (pa \\ (ca::('a, 'b, 'c, 'd) LanguageCon.com, xa::('a, 'c) xstate) \\ ca = fst pa) \\ \n ((c::('a, 'b, 'c, 'd) LanguageCon.com) \\ fst p \\ (c, x::('a, 'c) xstate) = p)\"\n by fastforce\n then obtain xx :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate\" where\n \"\\p c x ca pa. (p \\ (c::('a, 'b, 'c, 'd) LanguageCon.com, x::('a, 'c) xstate) \\ c = fst p) \\ (ca \\ fst pa \\ (ca, xx pa ca) = pa)\"\n by (metis (full_types)) \n then show ?thesis\n using a1 \\i < length (z1 # zsa)\\\n by (simp add: Cons.hyps Cons.prems(1) case_prod_beta')\n qed\nqed\n\nlemma map_lift_catch_all_catch:\n assumes a0:\"zs=map (lift_catch a) xs\" and\n a1:\"ib. fst (zs!i) = Catch b a\"\nusing a0 a1\nproof (induct zs arbitrary: xs i)\n case Nil thus ?case by auto\nnext\n case (Cons z1 zsa) thus ?case unfolding lift_catch_def\n proof -\n assume a1: \"z1 # zsa = map (\\b. case b of (P, s) \\ (LanguageCon.com.Catch P a, s)) xs\"\n have \"\\p c. \\x. \\pa ca xa. \n (pa \\ (ca::('a, 'b, 'c, 'd) LanguageCon.com, xa::('a, 'c) xstate) \\ ca = fst pa) \\ \n ((c::('a, 'b, 'c, 'd) LanguageCon.com) \\ fst p \\ (c, x::('a, 'c) xstate) = p)\"\n by fastforce\n then obtain xx :: \"('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate \\ ('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate\" where\n \"\\p c x ca pa. (p \\ (c::('a, 'b, 'c, 'd) LanguageCon.com, x::('a, 'c) xstate) \\ c = fst p) \\ (ca \\ fst pa \\ (ca, xx pa ca) = pa)\"\n by (metis (full_types)) \n then show ?thesis\n using a1 \\i < length (z1 # zsa)\\\n by (simp add: Cons.hyps Cons.prems(1) case_prod_beta')\n qed\nqed\n\nlemma map_lift_some_eq_pos:\n assumes a0:\"map (lift P) xs @ (P1, s1)#ys = \n map (lift P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Seq p0 P\" and\n a2:\"\\p0. P2\\Seq p0 P\" \n shows \"length xs = length xs'\"\nproof -\n {assume ass:\"length xs \\ length xs'\"\n { assume ass:\"length xs < length xs'\"\n then have False using a0 map_lift_all_seq a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n }note l=this\n { assume ass:\"length xs > length xs'\"\n then have False using a0 map_lift_all_seq a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n } then have False using l ass by fastforce\n }\n thus ?thesis by auto\nqed\n\nlemma map_lift_some_eq:\n assumes a0:\"map (lift P) xs @ (P1, s1)#ys = \n map (lift P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Seq p0 P\" and\n a2:\"\\p0. P2\\Seq p0 P\" \n shows \"xs' = xs \\ ys = ys'\"\nproof -\n have \"length xs = length xs'\" using a0 map_lift_some_eq_pos a1 a2 by blast\n also have \"xs' = xs\" using a0 assms calculation map_lift_eq_xs_xs' by fastforce\n ultimately show ?thesis using a0 by fastforce\nqed\n\nlemma map_lift_catch_some_eq_pos:\n assumes a0:\"map (lift_catch P) xs @ (P1, s1)#ys = \n map (lift_catch P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Catch p0 P\" and\n a2:\"\\p0. P2\\Catch p0 P\" \n shows \"length xs = length xs'\"\nproof -\n {assume ass:\"length xs \\ length xs'\"\n { assume ass:\"length xs < length xs'\"\n then have False using a0 map_lift_catch_all_catch a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n }note l=this\n { assume ass:\"length xs > length xs'\"\n then have False using a0 map_lift_catch_all_catch a1 a2\n by (metis (no_types, lifting) fst_conv length_map nth_append nth_append_length)\n } then have False using l ass by fastforce\n }\n thus ?thesis by auto\nqed\n\nlemma map_lift_catch_some_eq:\n assumes a0:\"map (lift_catch P) xs @ (P1, s1)#ys = \n map (lift_catch P) xs'@ (P2, s2)#ys'\" and\n a1:\"\\p0. P1\\Catch p0 P\" and\n a2:\"\\p0. P2\\Catch p0 P\" \n shows \"xs' = xs \\ ys = ys'\"\nproof -\n have \"length xs = length xs'\" using a0 map_lift_catch_some_eq_pos a1 a2 by blast\n also have \"xs' = xs\" using a0 assms calculation map_lift_catch_eq_xs_xs' by fastforce\n ultimately show ?thesis using a0 by fastforce\nqed\n\n\nlemma Seq_P_Not_finish:\n assumes\n a0:\"zs = map (lift Q) xs\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs'\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume \"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs\" using a0 by auto \n thus ?thesis using map_lift_eq_xs_xs' by fastforce\nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal s') # ys)\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys where \n zs:\"zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys\" \n by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs'))) =\n Q\" by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @\n (Q, snd (((P, s) # xs') ! length xs')) # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < \n length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_all_seq\n using seq_and_if_not_eq(4) by fastforce \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal s') # ys)\"\n then obtain ys where \n zs:\"zs = map (lift Q) xs' @ \n (LanguageCon.com.Throw, Normal s') # ys\" by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = Throw\" by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @(LanguageCon.com.Throw, Normal s') # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < \n length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_all_seq\n using seq_and_if_not_eq(4) by fastforce\n } thus ?thesis using l ass by auto\nqed\n\nlemma Seq_P_Ends_Normal:\n assumes\n a0:\"zs = map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" and\n a0':\"fst (last ((P, s) # xs)) = Skip\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume ass:\"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs))) = Q\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift Q) xs @ (Q, snd (last ((P, s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_all_seq\n using seq_and_if_not_eq(4)\n by metis \nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal s') # ys)\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"zs = map (lift Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys' \\\n (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call\" \n by auto \n then have ?thesis\n using map_lift_some_eq[of Q xs Q _ ys xs' Q _ ys'] \n zs a0 seq_and_if_not_eq(4)[of Q] \n by auto \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal s') # ys)\"\n then obtain ys' where \n zs:\"zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal s') # ys' \\\n (m, \\, (LanguageCon.com.Throw, Normal s') # ys') \\ cptn_mod_nest_call\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = Throw\" by (metis fstI nth_append_length) \n have False\n by (metis (no_types) LanguageCon.com.distinct(17) \n LanguageCon.com.distinct(71) \n a0 a0' ass last_length\n map_lift_some_eq seq_and_if_not_eq(4) zs)\n then have ?thesis\n by metis\n } thus ?thesis using l ass by auto\nqed\n\nlemma Seq_P_Ends_Abort:\n assumes\n a0:\"zs = map (lift Q) xs @ (Throw, Normal s') # ys\" and\n a0':\"fst (last ((P, Normal s) # xs)) = Throw\" and\n a0'':\"snd(last ((P, Normal s) # xs)) = Normal s'\" and\n a1:\"(m, \\,(LanguageCon.com.Seq P Q, Normal s) # zs) \\ cptn_mod_nest_call\" and\n a2:\"seq_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call\"\nusing a2 unfolding seq_cond_nest_def \nproof\n assume ass:\"zs= map (lift Q) xs'\"\n then have \"map (lift Q) xs' = \n map (lift Q) xs @ (Throw, Normal s') # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift Q) xs))) = Throw\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift Q) xs @ (Throw, Normal s') # ys)\" \n using a0 by auto\n then have \"(length (map (lift Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_all_seq \n by (metis (no_types) LanguageCon.com.simps(82)) \nnext\n assume \n ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @\n (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\\n fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, Normal s) # xs')) = Normal ns' \\\n Normal s = Normal ns'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal ns') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal ns') # ys)\"\n {assume \n ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @\n (Q, snd (((P, Normal s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys')\n \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ \n (Q, snd (((P, Normal s) # xs') ! length xs')) # ys'\" \n by auto \n then have ?thesis\n using a0 seq_and_if_not_eq(4)[of Q]\n by (metis LanguageCon.com.distinct(17) LanguageCon.com.distinct(71) \n a0' ass last_length map_lift_some_eq) \n }note l = this\n {assume ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, Normal s) # xs')) = Normal ns' \\\n Normal s = Normal ns'' \\\n (\\ys. (m, \\, (LanguageCon.com.Throw, Normal ns') # ys) \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal ns') # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (LanguageCon.com.Throw, Normal ns') # ys') \\ cptn_mod_nest_call \\\n zs = map (lift Q) xs' @ (LanguageCon.com.Throw, Normal ns') # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = Throw\" \n by (metis fstI nth_append_length) \n then have ?thesis using a0 ass map_lift_some_eq by blast \n } thus ?thesis using l ass by auto\nqed\n\nlemma Catch_P_Not_finish:\n assumes\n a0:\"zs = map (lift_catch Q) xs\" and \n a1:\"catch_cond_nest zs Q xs' P s s'' s' \\ m\" \nshows \"xs=xs'\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume \"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs\" using a0 by auto \n thus ?thesis using map_lift_catch_eq_xs_xs' by fastforce\nnext\n assume \n ass:\"\n fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys)\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys)\"\n then obtain ys where \n zs:\"(m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys\" \n by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs'))) = Skip \" \n by (metis fstI nth_append_length) \n have \"length zs = length (map (lift Q) xs' @\n (Q, snd (((P, s) # xs') ! length xs')) # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < \n length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_catch_all_catch\n using seq_and_if_not_eq(12) by fastforce \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys where \n zs:\"zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys\" by auto\n then have zs_while:\n \"fst (zs!(length (map (lift Q) xs'))) = Q\"\n by (metis (no_types) eq_fst_iff length_map nth_append_length zs) \n have \"length zs = length (map (lift Q) xs' @(LanguageCon.com.Throw, Normal s') # ys)\" \n using zs by auto\n then have \"(length (map (lift Q) xs')) < \n length zs\" by auto \n then have ?thesis using a0 zs_while map_lift_catch_all_catch\n by fastforce\n } thus ?thesis using l ass by auto\nqed\n\nlemma Catch_P_Ends_Normal:\n assumes\n a0:\"zs = map (lift_catch Q) xs @ (Q, snd (last ((P, Normal s) # xs))) # ys\" and\n a0':\"fst (last ((P, Normal s) # xs)) = Throw\" and\n a0'':\"snd (last ((P, Normal s) # xs)) = Normal s'\" and\n a1:\"catch_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Q, snd(((P, Normal s)#xs)!length xs))#ys) \\ cptn_mod_nest_call\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume ass:\"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs @ (Q, snd (last ((P, Normal s) # xs))) # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs))) = Q\"\n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift_catch Q) xs @ (Q, snd (last ((P, Normal s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift_catch Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_catch_all_catch\n using seq_and_if_not_eq(12)\n by metis\nnext\n assume \n ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, Normal s) # xs')) = Normal ns' \\\n Normal s = Normal ns'' \\\n (\\ys. (m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\\n fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys)\"\n {assume \n ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, Normal s) # xs'))) # ys'\" \n by auto \n then have ?thesis\n using map_lift_catch_some_eq[of Q xs Q _ ys xs' Skip _ ys'] \n zs a0 seq_and_if_not_eq(12)[of Q]\n by (metis LanguageCon.com.distinct(17) LanguageCon.com.distinct(19) a0' ass last_length) \n }note l = this\n {assume ass:\"fst (((P, Normal s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, Normal s) # xs')) = Normal ns' \\\n Normal s = Normal ns'' \\\n (\\ys. (m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, Normal s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (Q, snd (((P, Normal s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, Normal s) # xs') ! length xs')) # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift_catch Q) xs'))) = Q\" by (metis fstI nth_append_length) \n\n then have ?thesis \n using LanguageCon.com.distinct(17) LanguageCon.com.distinct(71) \n a0 a0' ass last_length map_lift_catch_some_eq[of Q xs Q _ ys xs' Q _ ys'] \n seq_and_if_not_eq(12) zs\n by blast \n } thus ?thesis using l ass by auto\nqed\n \nlemma Catch_P_Ends_Skip:\n assumes\n a0:\"zs = map (lift_catch Q) xs @ (Skip, snd (last ((P, s) # xs))) # ys\" and\n a0':\"fst (last ((P,s) # xs)) = Skip\" and\n a1:\"catch_cond_nest zs Q xs' P s ns'' ns' \\ m\" \nshows \"xs=xs' \\ (m,\\,(Skip,snd(last ((P,s) # xs)))#ys) \\ cptn_mod_nest_call\"\nusing a1 unfolding catch_cond_nest_def \nproof\n assume ass:\"zs= map (lift_catch Q) xs'\"\n then have \"map (lift_catch Q) xs' = \n map (lift_catch Q) xs @ (Skip, snd (last ((P, s) # xs))) # ys\" using a0 by auto \n then have zs_while:\"fst (zs!(length (map (lift_catch Q) xs))) = Skip\" \n by (metis a0 fstI nth_append_length) \n also have \"length zs = \n length (map (lift_catch Q) xs @ (Skip, snd (last ((P, s) # xs))) # ys)\" \n using a0 by auto\n then have \"(length (map (lift_catch Q) xs)) < length zs\" by auto \n then show ?thesis using ass zs_while map_lift_catch_all_catch\n by (metis LanguageCon.com.distinct(19)) \nnext\n assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal ns' \\\n s = Normal ns'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys) \\\n fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys)\"\n {assume \n ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Skip \\\n (\\ys. (m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (LanguageCon.com.Skip, snd (last ((P, s) # xs'))) # ys'\" \n by auto \n then have ?thesis\n using a0 seq_and_if_not_eq(12)[of Q] a0' ass last_length map_lift_catch_some_eq\n using LanguageCon.com.distinct(19) by blast \n }note l = this\n {assume ass:\"fst (((P, s) # xs') ! length xs') = LanguageCon.com.Throw \\\n snd (last ((P, s) # xs')) = Normal ns' \\\n s = Normal ns'' \\\n (\\ys. (m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys)\"\n then obtain ys' where \n zs:\"(m, \\, (Q, snd (((P, s) # xs') ! length xs')) # ys') \\ cptn_mod_nest_call \\\n zs = map (lift_catch Q) xs' @ (Q, snd (((P, s) # xs') ! length xs')) # ys'\" \n by auto\n then have zs_while:\n \"fst (zs!(length (map (lift_catch Q) xs'))) = Q\" \n by (metis fstI nth_append_length) \n then have ?thesis \n using a0 seq_and_if_not_eq(12)[of Q] a0' ass last_length map_lift_catch_some_eq\n by (metis LanguageCon.com.distinct(17) LanguageCon.com.distinct(19)) \n } thus ?thesis using l ass by auto\nqed\n\n\nlemma not_func_redex_cptn_mod_nest_n': \nassumes a0:\"\\\\\\<^sub>c (P,s) \\ (Q, t)\" and\n a1:\"(n,\\,(Q,t)#xs) \\ cptn_mod_nest_call\" and \n a2:\"(\\fn. redex P \\ Call fn) \\ \n (redex P = Call fn \\ \\ fn = None) \\ \n (redex P = Call fn \\ (\\sa. s\\Normal sa))\"\nshows \"(n,\\,(P,s)#(Q,t)#xs) \\ cptn_mod_nest_call\"\nusing a0 a1 a2\nproof (induct arbitrary: xs) \n case (Basicc f s) \n thus ?case by (simp add: Basicc cptn_mod_nest_call.CptnModNestSkip stepc.Basicc)\nnext\n case (Specc s t r)\n thus ?case by (simp add: Specc cptn_mod_nest_call.CptnModNestSkip stepc.Specc)\nnext\n case (SpecStuckc s r)\n thus ?case by (simp add: SpecStuckc cptn_mod_nest_call.CptnModNestSkip stepc.SpecStuckc)\nnext\n case (Guardc s g f c) \n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestGuard) \nnext\n\n case (GuardFaultc s g f c)\n thus ?case by (simp add: GuardFaultc cptn_mod_nest_call.CptnModNestSkip stepc.GuardFaultc)\nnext\ncase (Seqc c1 s c1' s' c2)\n have step: \"\\\\\\<^sub>c (c1, s) \\ (c1', s')\" by (simp add: Seqc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1) by blast \n have assum: \"(n, \\, (Seq c1' c2, s') # xs) \\ cptn_mod_nest_call\" using Seqc.prems by blast\n have divseq:\"(\\s P Q zs. (Seq c1' c2, s') # xs=(Seq P Q, s)#zs \\\n (\\xs sv' sv''. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (n,\\,(Throw,Normal sv')#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift Q) xs)@((Throw,Normal sv')#ys))\n ))))\n \n ))\" using div_seq_nest [OF assum] unfolding seq_cond_nest_def by auto\n {fix sa P Q zsa\n assume ass:\"(Seq c1' c2, s') # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ s' = sa \\ xs = zsa\" by auto\n then have \"(\\xs sv' sv''. (n,\\, (P, sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (n,\\,(Throw,Normal sv')#ys) \\ cptn_mod_nest_call \\\n zsa=(map (lift Q) xs)@((Throw,Normal sv')#ys))))))\" \n using ass divseq by blast\n } note conc=this [of c1' c2 s' xs] \n then obtain xs' sa' sa''\n where split:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call \\\n (xs = map (lift c2) xs' \\ \n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (n,\\,(Throw,Normal sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))\n )))\" by blast\n then have \"(xs = map (lift c2) xs' \\ \n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (n,\\,(Throw,Normal sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys)))))\" \n by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift c2) xs'\"\n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2) SmallStepCon.redex.simps(4) by auto \n then have \"(Seq c1' c2, s')#xs = map (lift c2) ((c1', s')#xs')\"\n using c1'nonf\n by (simp add: lift_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step by (auto simp add: CptnModNestSeq1)\n next\n assume \"fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n ((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys. (n,\\,(Throw,Normal sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))))\" \n thus ?thesis\n proof\n assume assth:\"fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys)\"\n then obtain ys \n where split':\"(n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n by auto \n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2) SmallStepCon.redex.simps(4) by auto \n then have seqmap:\"(Seq c1 c2, s)#(Seq c1' c2, s')#xs = map (lift c2) ((c1,s)#(c1', s')#xs') @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using split' by (simp add: lift_def) \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Skip\" \n using assth by fastforce \n thus ?thesis \n using seqmap split' cptn_mod_nest_call.CptnModNestSeq2\n induct_step lastc1 lastc1skip\n by (metis (no_types) Cons_lift_append ) \n next\n assume assm:\"((fst(((c1', s')#xs')!length xs')=Throw \\ \n snd(last ((c1', s')#xs')) = Normal sa' \\ s'=Normal sa''\\\n (\\ys.(n,\\,(Throw,Normal sa')#ys) \\ cptn_mod_nest_call \\\n xs=(map (lift c2) xs')@((Throw,Normal sa')#ys))))\"\n then have s'eqsa'': \"s'=Normal sa''\" by auto\n then have snormal: \"\\ns. s=Normal ns\" by (metis Seqc.hyps(1) step_Abrupt_prop step_Fault_prop step_Stuck_prop xstate.exhaust)\n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" using split by blast \n then have induct_step: \"(n,\\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Seqc.hyps(2) Seqc.prems(2) SmallStepCon.redex.simps(4) by auto \n then obtain ys where seqmap:\"(Seq c1' c2, s')#xs = (map (lift c2) ((c1', s')#xs'))@((Throw,Normal sa')#ys)\"\n using assm\n proof -\n assume a1: \"\\ys. (LanguageCon.com.Seq c1' c2, s') # xs = map (lift c2) ((c1', s') # xs') @ (LanguageCon.com.Throw, Normal sa') # ys \\ thesis\"\n have \"(LanguageCon.com.Seq c1' c2, Normal sa'') # map (lift c2) xs' = map (lift c2) ((c1', s') # xs')\"\n by (simp add: assm lift_def)\n thus ?thesis\n using a1 assm by moura\n qed \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Throw\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = Normal sa'\"\n using assm by force \n thus ?thesis\n using assm c1'cptn induct_step lastc1skip snormal seqmap s'eqsa'' \n by (auto simp add:cptn_mod_nest_call.CptnModNestSeq3)\n qed\n }qed \nnext\n case (SeqSkipc c2 s xs)\n have c2incptn:\"(n,\\, (c2, s) # xs) \\ cptn_mod_nest_call\" by fact\n then have 1:\"(n,\\, [(Skip, s)]) \\ cptn_mod_nest_call\"\n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then have 2:\"fst(last ([(Skip, s)])) = Skip\" by fastforce\n then have 3:\"(n,\\,(c2, snd(last [(Skip, s)]))#xs) \\ cptn_mod_nest_call\" \n using c2incptn by auto \n then have \"(c2,s)#xs=(map (lift c2) [])@(c2, snd(last [(Skip, s)]))#xs\" \n by (auto simp add:lift_def)\n thus ?case using 1 2 3 by (simp add: CptnModNestSeq2) \nnext\n case (SeqThrowc c2 s xs) \n have \"(n,\\, [(Throw, Normal s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n, \\, (Throw, Normal s)#ys)\\ cptn_mod_nest_call\"\n by auto\n moreover have \"fst (last ((Throw, Normal s)#ys)) = Throw\" using ys_nil last by auto\n moreover have \"snd (last ((Throw, Normal s)#ys)) = Normal s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift c2) ys) = []\" by auto \n ultimately show ?case using SeqThrowc.prems cptn_mod_nest_call.CptnModNestSeq3 by fastforce \n\nnext\n case (CondTruec s b c1 c2)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestCondT)\nnext\n case (CondFalsec s b c1 c2)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestCondF)\nnext\n case (WhileTruec s1 b c)\n have sinb: \"s1\\b\" by fact\n have SeqcWhile: \"(n,\\, (Seq c (While b c), Normal s1) # xs) \\ cptn_mod_nest_call\" \n by fact \n have divseq:\"(\\s P Q zs. (Seq c (While b c), Normal s1) # xs=(Seq P Q, s)#zs \\\n (\\xs s'. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift (Q)) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\ \n snd(last ((P, s)#xs)) = Normal s' \\\n (\\ys. (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift Q) xs)@((Throw,Normal s')#ys)))))) \n ))\" using div_seq_nest [OF SeqcWhile] by (auto simp add: seq_cond_nest_def)\n{fix sa P Q zsa\n assume ass:\"(Seq c (While b c), Normal s1) # xs = (Seq P Q, sa) # zsa\"\n then have eqs:\"c = P \\ (While b c) = Q \\ Normal s1 = sa \\ xs = zsa\" by auto\n then have \"(\\xs s'. (n,\\, (P, sa) # xs) \\ cptn_mod_nest_call \\\n (zsa = map (lift Q) xs \\ \n fst (((P, sa) # xs) ! length xs) = Skip \\\n (\\ys. (n,\\, (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n zsa = map (lift Q) xs @ (Q, snd (((P, sa) # xs) ! length xs)) # ys) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\ \n snd(last ((P, sa)#xs)) = Normal s' \\\n (\\ys. (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\\n zsa=(map (lift Q) xs)@((Throw,Normal s')#ys))\n ))))\" \n using ass divseq by auto\n } note conc=this [of c \"While b c\" \"Normal s1\" xs] \n then obtain xs' s' \n where split:\"(n,\\, (c, Normal s1) # xs') \\ cptn_mod_nest_call \\\n (xs = map (lift (While b c)) xs' \\\n fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\ \n (\\ys. (n,\\, ((Throw, Normal s')#ys)) \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys)))\" by auto\n then have \"(xs = map (lift (While b c)) xs' \\\n fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (n,\\, ((Throw, Normal s')#ys)) \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys)))\" ..\n thus ?case\n proof{ \n assume 1:\"xs = map (lift (While b c)) xs'\" \n have 3:\"(n, \\, (c, Normal s1) # xs') \\ cptn_mod_nest_call\" using split by auto \n then show ?thesis \n using \"1\" cptn_mod_nest_call.CptnModNestWhile1 sinb by fastforce \n next\n assume \"fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys) \\\n fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (n,\\, ((Throw, Normal s')#ys)) \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys))\"\n thus ?case\n proof\n assume asm:\"fst (((c, Normal s1) # xs') ! length xs') = Skip \\\n (\\ys. (n,\\, (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\n \\ cptn_mod_nest_call \\\n xs =\n map (lift (While b c)) xs' @\n (While b c, snd (((c, Normal s1) # xs') ! length xs')) # ys)\"\n then obtain ys \n where asm':\"(n,\\, (While b c, snd (last ((c, Normal s1) # xs'))) # ys)\n \\ cptn_mod_nest_call \n \\ xs = map (lift (While b c)) xs' @\n (While b c, snd (last ((c, Normal s1) # xs'))) # ys\" \n by (auto simp add: last_length)\n moreover have 3:\"(n,\\, (c, Normal s1) # xs') \\ cptn_mod_nest_call\" using split by auto\n moreover from asm have \"fst (last ((c, Normal s1) # xs')) = Skip\"\n by (simp add: last_length) \n ultimately show ?case using sinb by (auto simp add:CptnModNestWhile2)\n next\n assume asm:\" fst (((c, Normal s1) # xs') ! length xs') = Throw \\\n snd (last ((c, Normal s1) # xs')) = Normal s' \\\n (\\ys. (n,\\, ((Throw, Normal s')#ys)) \\ cptn_mod_nest_call \\\n xs = map (lift (While b c)) xs' @ ((Throw, Normal s')#ys))\" \n moreover have 3:\"(n,\\, (c, Normal s1) # xs') \\ cptn_mod_nest_call\" \n using split by auto\n moreover from asm have \"fst (last ((c, Normal s1) # xs')) = Throw\"\n by (simp add: last_length) \n ultimately show ?case using sinb by (auto simp add:CptnModNestWhile3)\n qed\n }qed \nnext\n case (WhileFalsec s b c)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestSkip stepc.WhileFalsec)\nnext\n case (Awaitc s b c t)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestSkip stepc.Awaitc)\nnext\n case (AwaitAbruptc s b c t t')\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestThrow stepc.AwaitAbruptc) \nnext\n case (Callc p bdy s)\n thus ?case using SmallStepCon.redex.simps(7) by auto \nnext\n case (CallUndefinedc p s)\n then have \"p = fn\" by auto\n thus ?case using CallUndefinedc\n proof -\n have \"(LanguageCon.com.Call fn \\\\<^sub>g\\<^sub>s (LanguageCon.com.Skip::('b, 'a, 'c,'d) LanguageCon.com)) \\ Some LanguageCon.com.Skip\"\n by simp\n then show ?thesis\n by (metis (no_types) CallUndefinedc.hyps LanguageCon.com.inject(6) LanguageCon.inter_guards.simps(79) SmallStepCon.redex.simps(7) \\(n, \\, (LanguageCon.com.Skip, Stuck) # xs) \\ cptn_mod_nest_call\\ cptn_mod_nest_call.CptnModNestSkip stepc.CallUndefinedc)\n qed \nnext\n case (DynComc c s)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestDynCom) \nnext\n case (Catchc c1 s c1' s' c2)\n have step: \"\\\\\\<^sub>c (c1, s) \\ (c1', s')\" by (simp add: Catchc.hyps(1))\n then have nsc1: \"c1\\Skip\" using stepc_elim_cases(1) by blast \n have assum: \"(n,\\, (Catch c1' c2, s') # xs) \\ cptn_mod_nest_call\" \n using Catchc.prems by blast\n have divcatch:\"(\\s P Q zs. (Catch c1' c2, s') # xs=(Catch P Q, s)#zs \\\n (\\xs s' s''. ((n,\\,(P, s)#xs) \\ cptn_mod_nest_call \\ \n (zs=(map (lift_catch Q) xs) \\\n ((fst(((P, s)#xs)!length xs)=Throw \\\n snd(last ((P, s)#xs)) = Normal s' \\ s=Normal s''\\\n (\\ys. (n,\\,(Q, snd(((P, s)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Q, snd(((P, s)#xs)!length xs))#ys)))) \\\n ((fst(((P, s)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Skip,snd(last ((P, s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch Q) xs)@((Skip,snd(last ((P, s)#xs)))#ys)) \n ))))\n ))\" using div_catch_nest [OF assum] by (auto simp add: catch_cond_nest_def)\n {fix sa P Q zsa\n assume ass:\"(Catch c1' c2, s') # xs = (Catch P Q, sa) # zsa\"\n then have eqs:\"c1' = P \\ c2 = Q \\ s' = sa \\ xs = zsa\" by auto\n then have \"(\\xs sv' sv''. ((n, \\,(P, sa)#xs) \\ cptn_mod_nest_call \\ \n (zsa=(map (lift_catch Q) xs) \\\n ((fst(((P, sa)#xs)!length xs)=Throw \\\n snd(last ((P, sa)#xs)) = Normal sv' \\ s'=Normal sv''\\\n (\\ys. (n,\\,(Q, snd(((P, sa)#xs)!length xs))#ys) \\ cptn_mod_nest_call \\ \n zsa=(map (lift_catch Q) xs)@((Q, snd(((P, sa)#xs)!length xs))#ys)))) \\\n ((fst(((P, sa)#xs)!length xs)=Skip \\ \n (\\ys. (n,\\,(Skip,snd(last ((P, sa)#xs)))#ys) \\ cptn_mod_nest_call \\ \n zsa=(map (lift_catch Q) xs)@((Skip,snd(last ((P, sa)#xs)))#ys))))))\n )\" using ass divcatch by blast\n } note conc=this [of c1' c2 s' xs] \n then obtain xs' sa' sa''\n where split:\n \"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call \\ \n (xs = map (lift_catch c2) xs' \\\n fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @\n (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod_nest_call \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys)))\" \n by blast\n then have \"(xs = map (lift_catch c2) xs' \\\n fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs = map (lift_catch c2) xs' @\n (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod_nest_call \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys)))\" \n by auto\n thus ?case \n proof{ \n assume c1'nonf:\"xs = map (lift_catch c2) xs'\"\n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n, \\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) SmallStepCon.redex.simps(11) by auto \n then have \"(Catch c1' c2, s')#xs = map (lift_catch c2) ((c1', s')#xs')\"\n using c1'nonf\n by (simp add: CptnModCatch1 lift_catch_def)\n thus ?thesis \n using c1'nonf c1'cptn induct_step \n by (auto simp add: CptnModNestCatch1)\n next\n assume \"fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\\n fst (((c1', s') # xs') ! length xs') = Skip \\\n (\\ys. (n,\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod_nest_call \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys))\" \n thus ?thesis\n proof\n assume assth:\n \"fst (((c1', s') # xs') ! length xs') = Throw \\\n snd (last ((c1', s') # xs')) = Normal sa' \\ s' = Normal sa'' \\\n (\\ys. (n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys)\"\n then have s'eqsa'': \"s'=Normal sa''\" by auto\n then have snormal: \"\\ns. s=Normal ns\" by (metis Catchc.hyps(1) step_Abrupt_prop step_Fault_prop step_Stuck_prop xstate.exhaust)\n then obtain ys \n where split':\"(n,\\, (c2, snd (((c1', s') # xs') ! length xs')) # ys) \\ cptn_mod_nest_call \\\n xs =map (lift_catch c2) xs' @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using assth by auto \n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" \n using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) SmallStepCon.redex.simps(11) by auto \n then have seqmap:\"(Catch c1 c2, s)#(Catch c1' c2, s')#xs = map (lift_catch c2) ((c1,s)#(c1', s')#xs') @ (c2, snd (((c1', s') # xs') ! length xs')) # ys\"\n using split' by (simp add: CptnModCatch3 lift_catch_def) \n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Throw\" \n using assth by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = Normal sa'\"\n using assth by force\n thus ?thesis using snormal seqmap s'eqsa'' split' \n last_length cptn_mod_nest_call.CptnModNestCatch3 \n induct_step lastc1 lastc1skip\n using Cons_lift_catch_append by fastforce \n next\n assume assm:\" fst (((c1', s') # xs') ! length xs') = Skip \\ \n (\\ys. (n,\\,(Skip,snd(last ((c1', s')#xs')))#ys) \\ cptn_mod_nest_call \\ \n xs=(map (lift_catch c2) xs')@((Skip,snd(last ((c1', s')#xs')))#ys))\"\n then have c1'cptn:\"(n,\\, (c1', s') # xs') \\ cptn_mod_nest_call\" using split by blast\n then have induct_step: \"(n,\\, (c1, s) # (c1', s')#xs') \\ cptn_mod_nest_call\"\n using Catchc.hyps(2) Catchc.prems(2) SmallStepCon.redex.simps(11) by auto \n then have \"map (lift_catch c2) ((c1', s') # xs') = (Catch c1' c2, s') # map (lift_catch c2) xs'\" \n by (auto simp add: lift_catch_def)\n then obtain ys \n where seqmap:\"(Catch c1' c2, s')#xs = (map (lift_catch c2) ((c1', s')#xs'))@((Skip,snd(last ((c1', s')#xs')))#ys)\"\n using assm by fastforce\n then have lastc1:\"last ((c1, s) # (c1', s') # xs') = ((c1', s') # xs') ! length xs'\"\n by (simp add: last_length) \n then have lastc1skip:\"fst (last ((c1, s) # (c1', s') # xs')) = Skip\" \n using assm by fastforce\n then have \"snd (last ((c1, s) # (c1', s') # xs')) = snd (last ((c1', s') # xs'))\"\n using assm by force\n thus ?thesis \n using assm c1'cptn induct_step lastc1skip seqmap \n by (auto simp add:cptn_mod_nest_call.CptnModNestCatch2)\n qed\n }qed \nnext\n case (CatchThrowc c2 s)\n have c2incptn:\"(n,\\, (c2, Normal s) # xs) \\ cptn_mod_nest_call\" by fact\n then have 1:\"(n,\\, [(Throw, Normal s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then have 2:\"fst(last ([(Throw, Normal s)])) = Throw\" by fastforce\n then have 3:\"(n,\\,(c2, snd(last [(Throw, Normal s)]))#xs) \\ cptn_mod_nest_call\" \n using c2incptn by auto \n then have \"(c2,Normal s)#xs=(map (lift c2) [])@(c2, snd(last [(Throw, Normal s)]))#xs\" \n by (auto simp add:lift_def)\n thus ?case using 1 2 3 by (simp add: CptnModNestCatch3)\nnext\n case (CatchSkipc c2 s)\n have \"(n,\\, [(Skip, s)]) \\ cptn_mod_nest_call\" \n by (simp add: cptn_mod_nest_call.CptnModNestOne)\n then obtain ys where \n ys_nil:\"ys=[]\" and \n last:\"(n,\\, (Skip, s)#ys)\\ cptn_mod_nest_call\"\n by auto\n moreover have \"fst (last ((Skip, s)#ys)) = Skip\" using ys_nil last by auto\n moreover have \"snd (last ((Skip, s)#ys)) = s\" using ys_nil last by auto\n moreover from ys_nil have \"(map (lift_catch c2) ys) = []\" by auto \n ultimately show ?case using CatchSkipc.prems \n by simp (simp add: cptn_mod_nest_call.CptnModNestCatch2 ys_nil)\nnext\n case (FaultPropc c f)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestSkip stepc.FaultPropc) \nnext\n case (AbruptPropc c f)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestSkip stepc.AbruptPropc)\nnext\n case (StuckPropc c)\n thus ?case by (simp add: cptn_mod_nest_call.CptnModNestSkip stepc.StuckPropc)\nqed\n\n\n\n\nlemma not_func_redex_cptn_mod_nest_n_env: \nassumes a0:\"\\\\\\<^sub>c (P,s) \\\\<^sub>e (P, t)\" and\n a1:\"(n,\\,(P,t)#xs) \\ cptn_mod_nest_call\" \nshows \"(n,\\,(P,s)#(P,t)#xs) \\ cptn_mod_nest_call\"\n by (simp add: a0 a1 cptn_mod_nest_call.CptnModNestEnv)\n\n\nlemma cptn_mod_nest_cptn_mod:\"(n,\\,cfs) \\ cptn_mod_nest_call \\ (\\,cfs)\\ cptn_mod\"\nby (induct rule:cptn_mod_nest_call.induct, (fastforce simp:cptn_mod.intros )+)\n\n\nlemma cptn_mod_cptn_mod_nest: \"(\\,cfs)\\ cptn_mod \\ \\n. (n,\\,cfs) \\ cptn_mod_nest_call\"\nproof (induct rule:cptn_mod.induct)\n case (CptnModSkip \\ P s t xs) \n then obtain n where cptn_nest:\"(n, \\, (Skip, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Skip \\ P \\ Call f )\" \n then have ?case using CptnModNestSkip[OF CptnModSkip(1) CptnModSkip(2) asm cptn_nest] by auto\n }note t1=this\n {assume asm:\"\\ (\\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Skip \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = Normal sn) \\ (\\ f) = Some Skip \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s=Normal sn\" by auto\n then have t_eq_s:\"t=s\" using asm cptn_nest normal_s\n by (metis CptnModSkip.hyps(1) LanguageCon.com.simps(22) \n LanguageCon.inter_guards.simps(79) LanguageCon.inter_guards_Call \n Pair_inject stepc_Normal_elim_cases(9))\n then have \"(Suc n, \\,((Call f), Normal sn)#(Skip, Normal sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce \nnext\n case (CptnModThrow \\ P s t xs) \n then obtain n where cptn_nest:\"(n, \\, (Throw, t) # xs) \\ cptn_mod_nest_call\" by auto \n {assume asm:\"\\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Throw \\ P \\ Call f )\" \n then have ?case using CptnModNestThrow[OF CptnModThrow(1) CptnModThrow(2) asm cptn_nest] by auto\n }note t1=this\n {assume asm:\"\\ (\\f. ((\\sn. s = Normal sn) \\ (\\ f) = Some Throw \\ P \\ Call f))\"\n then obtain f where asm:\"((\\sn. s = Normal sn) \\ (\\ f) = Some Throw \\ P = Call f)\" by auto \n then obtain sn where normal_s:\"s=Normal sn\" by auto\n then have t_eq_s:\"t=s\" using asm cptn_nest normal_s\n by (metis CptnModThrow.hyps(1) LanguageCon.com.simps(22) \n LanguageCon.inter_guards.simps(79) LanguageCon.inter_guards_Call \n Pair_inject stepc_Normal_elim_cases(9))\n then have \"(Suc n, \\,((Call f), Normal sn)#(Throw, Normal sn)#xs) \\ cptn_mod_nest_call\"\n using asm cptn_nest normal_s CptnModNestCall by fastforce \n then have ?case using asm normal_s t_eq_s by fastforce\n }note t2 = this\n then show ?case using t1 t2 by fastforce\nnext\n case (CptnModSeq2 \\ P0 s xs P1 ys zs) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" using CptnModSeq2(2) by auto\n also obtain m where m:\"(m, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using CptnModSeq2(5) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModSeq2 cptn_mod_nest_call.CptnModNestSeq2 by blast\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModSeq2 \n cptn_mod_nest_call.CptnModNestSeq2 le_cases3 by blast \n qed\nnext\n case (CptnModSeq3 \\ P0 s xs s' ys zs P1) \n obtain n where n:\"(n, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\" using CptnModSeq3(2) by auto\n also obtain m where m:\"(m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call\"\n using CptnModSeq3(6) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModSeq3 cptn_mod_nest_call.CptnModNestSeq3\n by fastforce\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModSeq3\n cptn_mod_nest_call.CptnModNestSeq3 le_cases3\n proof -\n have f1: \"\\ n \\ m \\ (m, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\"\n by (metis cptn_mod_nest_mono[of n \\ _ m] n)\n have \"n \\ m\"\n using False by linarith\n then have \"(m, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\"\n using f1 by metis\n then show ?thesis\n by (metis (no_types) CptnModSeq3(3) CptnModSeq3(4) CptnModSeq3(7) \n cptn_mod_nest_call.CptnModNestSeq3 m)\n qed \n qed\nnext\n case (CptnModWhile2 \\ P s xs b zs ys) \n obtain n where n:\"(n, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\" using CptnModWhile2(2) by auto\n also obtain m where \n m:\" (m, \\, (LanguageCon.com.While b P, snd (last ((P, Normal s) # xs))) # ys) \\ \n cptn_mod_nest_call\"\n using CptnModWhile2(7) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n \n CptnModWhile2 cptn_mod_nest_call.CptnModNestWhile2 by metis\n next \n case False \n thus ?thesis \n proof -\n have f1: \"\\ n \\ m \\ (m, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_mono[of n \\ _ m] n by presburger\n have \"n \\ m\"\n using False by linarith\n then have \"(m, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using f1 by metis\n then show ?thesis\n by (metis (no_types) CptnModWhile2(3) CptnModWhile2(4) CptnModWhile2(5) \n cptn_mod_nest_call.CptnModNestWhile2 m)\n qed \n qed\nnext\n case (CptnModWhile3 \\ P s xs b s' ys zs)\n obtain n where n:\"(n, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\" \n using CptnModWhile3(2) by auto\n also obtain m where \n m:\" (m, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call\"\n using CptnModWhile3(7) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n proof -\n have \"(n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call\"\n using True cptn_mod_nest_mono[of m \\ _ n] m by presburger\n then show ?thesis\n by (metis (no_types) CptnModWhile3.hyps(3) CptnModWhile3.hyps(4) \n CptnModWhile3.hyps(5) CptnModWhile3.hyps(8) cptn_mod_nest_call.CptnModNestWhile3 n)\n qed \n next \n case False \n thus ?thesis using m n cptn_mod_nest_call.CptnModNestWhile3 cptn_mod_nest_mono[of n \\ _ m]\n by (metis CptnModWhile3.hyps(3) CptnModWhile3.hyps(4) \n CptnModWhile3.hyps(5) CptnModWhile3.hyps(8) le_cases)\n qed\nnext\n case (CptnModCatch2 \\ P0 s xs ys zs P1) \n obtain n where n:\"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" using CptnModCatch2(2) by auto\n also obtain m where m:\"(m, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using CptnModCatch2(5) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n \n CptnModCatch2 cptn_mod_nest_call.CptnModNestCatch2 by blast\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModCatch2 \n cptn_mod_nest_call.CptnModNestCatch2 le_cases3 by blast \n qed\nnext\n case (CptnModCatch3 \\ P0 s xs s' ys zs P1) \n obtain n where n:\"(n, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\" \n using CptnModCatch3(2) by auto\n also obtain m where m:\"(m, \\, (ys, snd (last ((P0, Normal s) # xs))) # zs) \\ cptn_mod_nest_call\"\n using CptnModCatch3(6) by auto\n ultimately show ?case\n proof (cases \"n\\m\") \n case True thus ?thesis \n using cptn_mod_nest_mono[of m \\ _ n] m n CptnModCatch3 cptn_mod_nest_call.CptnModNestCatch3\n by fastforce\n next \n case False \n thus ?thesis\n using cptn_mod_nest_mono[of n \\ _ m] m n CptnModCatch3 \n cptn_mod_nest_call.CptnModNestCatch3 le_cases3\n proof -\n have f1: \"\\ n \\ m \\ (m, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\"\n using \\\\cfs. \\(n, \\, cfs) \\ cptn_mod_nest_call; n \\ m\\ \\ (m, \\, cfs) \\ cptn_mod_nest_call\\ n by presburger\n have \"n \\ m\"\n using False by auto\n then have \"(m, \\, (P0, Normal s) # xs) \\ cptn_mod_nest_call\"\n using f1 by meson\n then show ?thesis\n by (metis (no_types) \\P1 = map (lift_catch ys) xs @ (ys, snd (last ((P0, Normal s) # xs))) # zs\\ \\fst (last ((P0, Normal s) # xs)) = LanguageCon.com.Throw\\ \\snd (last ((P0, Normal s) # xs)) = Normal s'\\ cptn_mod_nest_call.CptnModNestCatch3 m)\n qed \n qed\nqed(fastforce intro: cptn_mod_nest_call.intros)+\n\nlemma cptn_mod_eq_cptn_mod_nest:\n \"(\\,cfs)\\ cptn_mod \\ (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by auto\n\nlemma cptn_mod_eq_cptn_mod_nest':\n \"\\n. ((\\,cfs)\\ cptn_mod \\ (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_eq_cptn_mod_nest by auto\n\nlemma cptn_mod_eq_cptn_mod_nest1:\n \"(\\,cfs)\\ cptn_mod = (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by auto\n\n\nlemma cptn_eq_cptn_mod_nest:\n \"(\\,cfs)\\ cptn = (\\n. (n,\\,cfs) \\ cptn_mod_nest_call)\"\n using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest cptn_mod_nest_cptn_mod by blast\n\n\nsubsection \\computation on nested calls limit\\\nsubsection \\Elimination theorems\\\nlemma mod_env_not_component:\nshows \"\\ \\\\\\<^sub>c (P, s) \\ (P, t)\"\nproof \n assume a3:\"\\\\\\<^sub>c (P, s) \\ (P, t)\" \n thus False using step_change_p_or_eq_s a3 by fastforce\nqed\n\nlemma elim_cptn_mod_nest_step_c:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" \n shows \"\\\\\\<^sub>c (P,s) \\ (Q,t) \\ \\\\\\<^sub>c (P,s) \\\\<^sub>e (Q,t)\"\nproof-\n have \"(\\,cfg) \\ cptn\" using a0 cptn_mod_nest_cptn_mod\n using cptn_eq_cptn_mod_set by auto \n then have \"\\\\\\<^sub>c (P,s) \\\\<^sub>c\\<^sub>e (Q,t)\" using a1\n by (metis c_step cptn_elim_cases(2) e_step)\n thus ?thesis\n using step_ce_not_step_e_step_c by blast \nqed\n\nlemma elim_cptn_mod_nest_call_env:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(P,t)#cfg1\" and\n a2:\"\\f. \\ f = Some (LanguageCon.com.Call f) \\ \n (\\sn. s = Normal sn) \\ s = t \\ SmallStepCon.redex P \\ LanguageCon.com.Call f\"\n shows \"(n,\\,(P,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 a2\nproof (induct arbitrary: P cfg1 s t rule:cptn_mod_nest_call.induct ) \ncase (CptnModNestSeq1 n \\ P0 sa xs zs P1)\n then obtain xs' where \"xs = (P0, t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1 by fastforce \n have \"(P, t) = lift P1 (P0, t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0, t) # xs'\\ by auto\n then have \"(n, \\, (LanguageCon.com.Seq P0 P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n then show ?case\n using CptnModNestSeq1.prems(1) by fastforce \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"x=(P0,t)\" \n proof-\n have \"zs=(Seq P0 P1,t)#cfg1\" using Cons by fastforce\n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0 P1 \\ snd x = t\"\n by (simp add: \\zs = (LanguageCon.com.Seq P0 P1, t) # cfg1\\ case_prod_beta)\n then show ?thesis\n by fastforce\n qed \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce \n have \"fst (last ((P0, t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) \\x = (P0, t)\\ by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n cptn_mod_nest_call.CptnModNestSeq2 local.step by fastforce\n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"x=(P0,t)\" \n proof-\n have zs:\"zs=(Seq P0 P1,t)#cfg1\" using Cons by fastforce\n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0 P1 \\ snd x = t\"\n using Cons.prems(7) zs by force\n then show ?thesis\n by fastforce \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce \n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0, Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n then have \"fst (last ((P0, Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n then show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3 \n local.step t x by fastforce\n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain xs' where \"xs = (P0, t)#xs'\" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1 by fastforce \n have \"(P, t) = lift_catch P1 (P0, t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) \\xs = (P0, t) # xs'\\ by auto\n then have \"(n, \\, (Catch P0 P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by fastforce \nnext\n case (CptnModNestCatch2 n \\ P0 sa xs ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"x=(P0,t)\" \n proof-\n have zs:\"zs=(Catch P0 P1,t)#cfg1\" using Cons by fastforce\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0 P1 \\ snd x = t\"\n using Cons.prems(6) zs by fastforce \n then show ?thesis\n by fastforce \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce \n have \"fst (last ((P0, t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by auto\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestCatch2.prems(1) \n cptn_mod_nest_call.CptnModNestCatch2 local.step x by fastforce \n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"x=(P0,t)\" \n proof-\n have zs:\"zs=(Catch P0 P1,t)#cfg1\" using Cons by fastforce\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, Normal sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0 P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis\n by fastforce\n qed \n qed\n then have step:\"(n, \\, (P0, t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce\n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case \n proof -\n have \"last ((P0, Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n then have \"fst (last ((P0, Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n then show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestCatch3.prems(1) cptn_mod_nest_call.CptnModNestCatch3 \n local.step t x by fastforce\n qed\n qed \nqed(fastforce+)\n\n\nlemma elim_cptn_mod_nest_not_env_call:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"(\\f. redex P \\ Call f) \\ \n SmallStepCon.redex P = LanguageCon.com.Call fn \\ \\ fn = None \\\n (redex P = Call fn \\ (\\sa. s\\Normal sa))\" \n shows \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 a2\nproof (induct arbitrary: P Q cfg1 s t rule:cptn_mod_nest_call.induct )\ncase (CptnModNestSeq1 n \\ P0 s xs zs P1)\n then obtain P0' xs' where \"xs = (P0', t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1 by fastforce \n have Q:\"(Q, t) = lift P1 (P0', t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0', t) # xs'\\ by auto\n also then have \"(n, \\, (LanguageCon.com.Seq P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n ultimately show ?case\n using CptnModNestSeq1.prems(1)\n by (simp add: Cons_lift Q) \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0'' where zs: \"zs=(Seq P0'' P1,t)#cfg1\" using Cons(7) Cons(8) \n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta') \n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0'' P1 \\ snd x = t\"\n by (simp add: zs case_prod_beta)\n also have \"sa=s\" using Cons by fastforce\n ultimately show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by force\n have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n local.step cptn_mod_nest_call.CptnModNestSeq2[of n \\ P0' t xs' P1 ys] Cons_lift_append\n by (metis (no_types, lifting) last_ConsR list.inject list.simps(3)) \n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\"\n proof-\n obtain P0' where zs:\"zs=(Seq P0' P1,t)#cfg1\" using Cons(8) Cons(9) \n unfolding lift_def\n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta')\n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0' P1 \\ snd x = t\"\n using zs by (simp add: Cons.prems(7)) \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\"\n proof -\n have f1: \"LanguageCon.com.Seq P0 P1 = P \\ Normal sa = s\"\n using CptnModNestSeq3.prems(1) by blast\n then have \"SmallStepCon.redex P = SmallStepCon.redex P0\"\n by (metis SmallStepCon.redex.simps(4))\n then show ?thesis\n using f1 Cons.prems(2) CptnModNestSeq3.prems(2) x by presburger\n qed \n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0', Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n also then have \"fst (last ((P0', Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3[of n \\ P0' t' xs' s' ys] \n local.step t x Cons_lift_append\n by (metis (no_types, lifting) list.sel(3)) \n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where xs:\"xs = (P0', t)#xs'\" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1 by fastforce \n have Q:\"(Q, t) = lift_catch P1 (P0', t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) xs by auto\n then have \"(n, \\, (Catch P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by (simp add:Cons_lift_catch Q)\nnext\n case (CptnModNestCatch2 n \\ P0 sa xs ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n using Cons.prems(6) zs by fastforce \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" \n using Cons.prems(2) CptnModNestCatch2.prems(1) CptnModNestCatch2.prems(2) x by force\n\n have skip:\"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by auto\n show ?case\n proof -\n have \"(P, s) # (Q, t) # cfg1 = (LanguageCon.com.Catch P0 P1, sa) # map (lift_catch P1) (x # xs') @ \n (LanguageCon.com.Skip, snd (last ((P0, sa) # x # xs'))) # ys\"\n using CptnModNestCatch2.prems Cons.prems(6) by auto\n then show ?thesis \n using Cons_lift_catch_append Cons.prems(4) \n cptn_mod_nest_call.CptnModNestCatch2[OF local.step skip] last.simps list.distinct(1)\n x \n by (metis (no_types) list.sel(3) x)\n qed\n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, Normal sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons\n using Cons.prems(2) CptnModNestCatch3.prems(1) CptnModNestCatch3.prems(2) x by force\n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case \n proof -\n have \"last ((P0', Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n also then have \"fst (last ((P0', Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestCatch3.prems(1) cptn_mod_nest_call.CptnModNestCatch3[of n \\ P0' t' xs' s' P1] \n local.step t x by (metis Cons_lift_catch_append list.sel(3)) \n qed\n qed\nnext\ncase (CptnModNestWhile1 n \\ P0 s' xs b zs) \n thus ?case\n using cptn_mod_nest_call.CptnModNestSeq1 list.inject by blast \nnext\n case (CptnModNestWhile2 n \\ P0 s' xs b zs ys) \n have \"(LanguageCon.com.While b P0, Normal s') = (P, s) \\ \n (LanguageCon.com.Seq P0 (LanguageCon.com.While b P0), Normal s') # zs = (Q, t) # cfg1\"\n using CptnModNestWhile2.prems by fastforce\n then show ?case\n using CptnModNestWhile2.hyps(1) CptnModNestWhile2.hyps(3) \n CptnModNestWhile2.hyps(5) CptnModNestWhile2.hyps(6) \n cptn_mod_nest_call.CptnModNestSeq2 by blast\nnext\n case (CptnModNestWhile3 n \\ P0 s' xs b zs) thus ?case\n by (metis (no_types) CptnModNestWhile3.hyps(1) CptnModNestWhile3.hyps(3) CptnModNestWhile3.hyps(5) \n CptnModNestWhile3.hyps(6) CptnModNestWhile3.hyps(8) CptnModNestWhile3.prems \n cptn_mod_nest_call.CptnModNestSeq3 list.inject) \nqed(fastforce+)\n\ninductive_cases stepc_call_skip_normal:\n \"\\\\\\<^sub>c(Call p,Normal s) \\ (Skip,s')\"\n\nlemma elim_cptn_mod_nest_call_n_greater_zero:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,Normal s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ P\\Q\"\n shows \"n>0\" \n using a0 a1 by (induct rule:cptn_mod_nest_call.induct, fastforce+)\n\n\nlemma elim_cptn_mod_nest_call_0_False:\n assumes a0:\"(0,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,Normal s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ P\\Q\"\nshows \"PP\"\nusing a0 a1 elim_cptn_mod_nest_call_n_greater_zero \nby fastforce\n\nlemma elim_cptn_mod_nest_call_n_dec1:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P,Normal s)#(Q,t)#cfg1 \\ P = Call f \\ \\ f = Some Q \\ t= Normal s \\ P\\Q\"\n shows \"(n-1,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 \n by (induct rule:cptn_mod_nest_call.induct,fastforce+)\n\nlemma elim_cptn_mod_nest_call_n_dec:\n assumes a0:\"(n,\\,(Call f,Normal s)#(the (\\ f),Normal s)#cfg1) \\ cptn_mod_nest_call\" and\n a1:\"\\ f = Some Q \" and a2:\"Call f\\the (\\ f)\"\n shows \"(n-1,\\,(the (\\ f),Normal s)#cfg1) \\ cptn_mod_nest_call\"\n using elim_cptn_mod_nest_call_n_dec1\n using a0 a1 a2\n by fastforce\n\n\nlemma elim_cptn_mod_nest_call_n:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg = (P, s)#(Q,t)#cfg1\" \n shows \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\"\n using a0 a1 \nproof (induct arbitrary: P Q cfg1 s t rule:cptn_mod_nest_call.induct )\ncase (CptnModNestCall n \\ bdy sa ys p)\n thus ?case using cptn_mod_nest_mono1 list.inject by blast\nnext \ncase (CptnModNestSeq1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where \"xs = (P0', t)#xs'\" unfolding lift_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestSeq1 by fastforce \n have Q:\"(Q, t) = lift P1 (P0', t) \\ cfg1 = map (lift P1) xs'\"\n using CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(1) \\xs = (P0', t) # xs'\\ by auto\n also then have \"(n, \\, (LanguageCon.com.Seq P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestSeq1 local.step)\n ultimately show ?case\n using CptnModNestSeq1.prems(1)\n by (simp add: Cons_lift Q) \nnext\n case (CptnModNestSeq2 n \\ P0 sa xs P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0'' where zs: \"zs=(Seq P0'' P1,t)#cfg1\" using Cons(7) Cons(8) \n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta') \n thus ?thesis using Cons(7) unfolding lift_def\n proof -\n assume \"zs = map (\\a. case a of (P, s) \\ (LanguageCon.com.Seq P P1, s)) (x # xs') @ \n (P1, snd (last ((P0, sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0'' P1 \\ snd x = t\"\n by (simp add: zs case_prod_beta)\n also have \"sa=s\" using Cons by fastforce\n ultimately show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by force\n have \"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by force\n then show ?case\n using Cons.prems(4) Cons.prems(6) CptnModNestSeq2.prems(1) x \n local.step cptn_mod_nest_call.CptnModNestSeq2[of n \\ P0' t xs' P1 ys] Cons_lift_append\n by (metis (no_types, lifting) last_ConsR list.inject list.simps(3)) \n qed \nnext \n case (CptnModNestSeq3 n \\ P0 sa xs s' ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\"\n proof-\n obtain P0' where zs:\"zs=(Seq P0' P1,t)#cfg1\" using Cons(8) Cons(9) \n unfolding lift_def\n unfolding lift_def by (simp add: Cons_eq_append_conv case_prod_beta')\n have \"(LanguageCon.com.Seq (fst x) P1, snd x) = lift P1 x\"\n by (simp add: lift_def prod.case_eq_if)\n then have \"LanguageCon.com.Seq (fst x) P1 = LanguageCon.com.Seq P0' P1 \\ snd x = t\"\n using zs by (simp add: Cons.prems(7)) \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce \n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case using x Cons(5) Cons(6) cptn_mod_nest_call.CptnModNestSeq3 step\n proof -\n have \"last ((P0', Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n also then have \"fst (last ((P0', Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3[of n \\ P0' t' xs' s' ys] \n local.step t x Cons_lift_append\n by (metis (no_types, lifting) list.sel(3)) \n qed \n qed \nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1) \n then obtain P0' xs' where xs:\"xs = (P0', t)#xs'\" unfolding lift_catch_def by fastforce\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using CptnModNestCatch1 by fastforce \n have Q:\"(Q, t) = lift_catch P1 (P0', t) \\ cfg1 = map (lift_catch P1) xs'\"\n using CptnModNestCatch1.hyps(3) CptnModNestCatch1.prems(1) xs by auto\n then have \"(n, \\, (Catch P0' P1, t) # cfg1) \\ cptn_mod_nest_call\"\n by (meson cptn_mod_nest_call.CptnModNestCatch1 local.step)\n then show ?case\n using CptnModNestCatch1.prems(1) by (simp add:Cons_lift_catch Q)\nnext\n case (CptnModNestCatch2 n \\ P0 sa xs ys zs P1) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs') \n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n have \"(LanguageCon.com.Catch (fst x) P1, snd x) = lift_catch P1 x\"\n by (simp add: lift_catch_def prod.case_eq_if)\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n using Cons.prems(6) zs by fastforce \n then show ?thesis by (meson eq_snd_iff) \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce \n have skip:\"fst (last ((P0', t) # xs')) = LanguageCon.com.Skip\"\n using Cons.prems(3) x by auto\n show ?case\n proof -\n have \"(P, s) # (Q, t) # cfg1 = (LanguageCon.com.Catch P0 P1, sa) # map (lift_catch P1) (x # xs') @ \n (LanguageCon.com.Skip, snd (last ((P0, sa) # x # xs'))) # ys\"\n using CptnModNestCatch2.prems Cons.prems(6) by auto\n then show ?thesis \n using Cons_lift_catch_append Cons.prems(4) \n cptn_mod_nest_call.CptnModNestCatch2[OF local.step skip] last.simps list.distinct(1)\n x \n by (metis (no_types) list.sel(3) x)\n qed\n qed \nnext\n case (CptnModNestCatch3 n \\ P0 sa xs s' P1 ys zs) \n thus ?case \n proof (induct xs)\n case Nil thus ?case using Nil.prems(6) Nil.prems(7) by force\n next\n case (Cons x xs')\n then have x:\"\\P0'. x=(P0',t)\" \n proof-\n obtain P0' where zs:\"zs=(Catch P0' P1,t)#cfg1\" using Cons unfolding lift_catch_def\n by (simp add: case_prod_unfold)\n thus ?thesis using Cons(8) lift_catch_def unfolding lift_def\n proof -\n assume \"zs = map (lift_catch P1) (x # xs') @ (P1, snd (last ((P0, Normal sa) # x # xs'))) # ys\"\n then have \"LanguageCon.com.Catch (fst x) P1 = LanguageCon.com.Catch P0' P1 \\ snd x = t\"\n by (simp add: case_prod_unfold lift_catch_def zs) \n then show ?thesis by (meson eq_snd_iff) \n qed \n qed\n then obtain P0' where x:\"x=(P0',t)\" by auto\n then have step:\"(n, \\, (P0', t) # xs') \\ cptn_mod_nest_call\" using Cons by fastforce\n then obtain t' where t:\"t=Normal t'\" \n using Normal_Normal Cons(2) Cons(5) cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_set x\n by (metis snd_eqD)\n then show ?case \n proof -\n have \"last ((P0', Normal t') # xs') = last ((P0, Normal sa) # x # xs')\"\n using t x by force\n also then have \"fst (last ((P0', Normal t') # xs')) = LanguageCon.com.Throw\"\n using Cons.prems(3) by presburger\n ultimately show ?thesis\n using Cons.prems(4) Cons.prems(5) Cons.prems(7) \n CptnModNestCatch3.prems(1) cptn_mod_nest_call.CptnModNestCatch3[of n \\ P0' t' xs' s' P1] \n local.step t x by (metis Cons_lift_catch_append list.sel(3)) \n qed\n qed\nnext\ncase (CptnModNestWhile1 n \\ P0 s' xs b zs) \n thus ?case\n using cptn_mod_nest_call.CptnModNestSeq1 list.inject by blast \nnext\n case (CptnModNestWhile2 n \\ P0 s' xs b zs ys) \n have \"(LanguageCon.com.While b P0, Normal s') = (P, s) \\ \n (LanguageCon.com.Seq P0 (LanguageCon.com.While b P0), Normal s') # zs = (Q, t) # cfg1\"\n using CptnModNestWhile2.prems by fastforce\n then show ?case\n using CptnModNestWhile2.hyps(1) CptnModNestWhile2.hyps(3) \n CptnModNestWhile2.hyps(5) CptnModNestWhile2.hyps(6) \n cptn_mod_nest_call.CptnModNestSeq2 by blast\nnext\n case (CptnModNestWhile3 n \\ P0 s' xs b zs) thus ?case\n by (metis (no_types) CptnModNestWhile3.hyps(1) CptnModNestWhile3.hyps(3) CptnModNestWhile3.hyps(5) \n CptnModNestWhile3.hyps(6) CptnModNestWhile3.hyps(8) CptnModNestWhile3.prems \n cptn_mod_nest_call.CptnModNestSeq3 list.inject) \nqed (fastforce+) \n\n\n\n\ndefinition min_call where\n\"min_call n \\ cfs \\ (n,\\,cfs) \\ cptn_mod_nest_call \\ (\\m((m,\\,cfs) \\ cptn_mod_nest_call))\"\n\nlemma minimum_nest_call:\n \"(m,\\,cfs) \\ cptn_mod_nest_call \\\n \\n. min_call n \\ cfs\"\nunfolding min_call_def\nproof (induct arbitrary: m rule:cptn_mod_nest_call.induct) \n case (CptnModNestOne) thus ?case using cptn_mod_nest_call.CptnModNestOne by blast \nnext\n case (CptnModNestEnv \\ P s t n xs) \n then have \"\\ \\\\\\<^sub>c (P, s) \\ (P, t)\" \n using mod_env_not_component step_change_p_or_eq_s by blast \n then obtain min_n where min:\"(min_n, \\, (P, t) # xs) \\ cptn_mod_nest_call \\ \n (\\m, (P, t) # xs) \\ cptn_mod_nest_call)\" \n using CptnModNestEnv by blast\n then have \"(min_n, \\, (P,s)#(P, t) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_call.CptnModNestEnv CptnModNestEnv by blast\n also have \"(\\m, (P, s)#(P, t) # xs) \\ cptn_mod_nest_call)\"\n using elim_cptn_mod_nest_call_n min by fastforce \n ultimately show ?case by auto \nnext\n case (CptnModNestSkip \\ P s t n xs) \n then obtain min_n where \n min:\"(min_n, \\, (LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call \\\n (\\m, (LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call)\" \n by auto\n then have \"(min_n, \\, (P,s)#(LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_call.CptnModNestSkip CptnModNestSkip by blast\n also have \"(\\m, (P, s)#(LanguageCon.com.Skip, t) # xs) \\ cptn_mod_nest_call)\"\n using elim_cptn_mod_nest_call_n min by blast \n ultimately show ?case by fastforce \nnext\n case (CptnModNestThrow \\ P s t n xs) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestThrow elim_cptn_mod_nest_call_n) \nnext\n case (CptnModNestCondT n \\ P0 s xs b P1) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestCondT elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestCondF n \\ P1 s xs b P0) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestCondF elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestSeq1 n \\ P s xs zs Q) thus ?case\n by (metis (no_types, lifting) Seq_P_Not_finish cptn_mod_nest_call.CptnModNestSeq1 div_seq_nest)\nnext\n case (CptnModNestSeq2 n \\ P s xs Q ys zs) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestSeq2(5) obtain min_q where\n min_q:\"(min_q, \\, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Q, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (Q, snd (last ((P,s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestSeq2[of min_p \\ P s xs Q ys zs] \n CptnModNestSeq2(6) CptnModNestSeq2(3)\n by blast\n also have \"\\m,(Seq P Q,s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq2.hyps(3) CptnModNestSeq2.hyps(6) Seq_P_Ends_Normal div_seq_nest min_p) \n ultimately show ?thesis by auto\n next\n case False \n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestSeq2[of min_q \\ P s xs Q ys zs] \n CptnModNestSeq2(6) CptnModNestSeq2(3)\n by blast\n also have \"\\m,(Seq P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Seq P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P Q, s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have ?thesis\n using Seq_P_Ends_Normal[OF CptnModNestSeq2(6) CptnModNestSeq2(3) ass]\n min_m min_q \n by (metis last_length) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestSeq3 n \\ P s xs s' ys zs Q) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, Normal s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestSeq3(6) obtain min_q where\n min_q:\"(min_q, \\, (Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (\\m, (Throw, Normal s') # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True \n then have \"(min_p, \\, (Throw, Normal s') # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Seq P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestSeq3[of min_p \\ P s xs s' ys zs Q] \n CptnModNestSeq3(4) CptnModNestSeq3(3) CptnModNestSeq3(7)\n by blast\n also have \"\\m,(Seq P Q,Normal s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq3.hyps(3) CptnModNestSeq3.hyps(4) CptnModNestSeq3.hyps(7) Seq_P_Ends_Abort div_seq_nest min_p)\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Seq P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestSeq3[of min_q \\ P s xs s' ys zs Q] \n CptnModNestSeq3(4) CptnModNestSeq3(3) CptnModNestSeq3(7)\n by blast\n also have \"\\m,(Seq P Q,Normal s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestSeq3.hyps(3) CptnModNestSeq3.hyps(4) CptnModNestSeq3.hyps(7) Seq_P_Ends_Abort div_seq_nest min_q) \n ultimately show ?thesis by auto\n qed \nnext\n case (CptnModNestWhile1 n \\ P s xs b zs) \n then obtain min_n where \n min:\"(min_n, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, Normal s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n then have \"(min_n, \\, (While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n using cptn_mod_nest_call.CptnModNestWhile1[of min_n \\ P s xs b zs] CptnModNestWhile1\n by meson \n also have \"\\m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile1.hyps(4) Seq_P_Not_finish div_seq_nest elim_cptn_mod_nest_call_n min) \n ultimately show ?case by auto\nnext\n case (CptnModNestWhile2 n \\ P s xs b zs ys) \n then obtain min_n_p where \n min_p:\"(min_n_p, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, Normal s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n from CptnModNestWhile2 obtain min_n_w where\n min_w:\"(min_n_w, \\, (LanguageCon.com.While b P, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (LanguageCon.com.While b P, snd (last ((P, Normal s) # xs))) # ys)\n \\ cptn_mod_nest_call)\"\n by auto\n thus ?case \n proof (cases \"min_n_p\\min_n_w\")\n case True \n then have \"(min_n_p, \\, \n (LanguageCon.com.While b P, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_w using cptn_mod_nest_mono by blast \n then have \"(min_n_p, \\, (While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_call.CptnModNestWhile2[of min_n_p \\ P s xs b zs] CptnModNestWhile2\n by blast\n also have \"\\m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile2.hyps(3) CptnModNestWhile2.hyps(5) \n Seq_P_Ends_Normal div_seq_nest elim_cptn_mod_nest_call_n min_p) \n ultimately show ?thesis by auto \n next\n case False\n then have False:\"min_n_p, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_n_w, \\, (While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n using min_w min_p cptn_mod_nest_call.CptnModNestWhile2[of min_n_w \\ P s xs b zs] CptnModNestWhile2\n by blast\n also have \"\\m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\" \n proof -\n {fix m\n assume min_m:\"m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume \"(m, \\,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n then have a1:\"(m, \\,(Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\" \n using elim_cptn_mod_nest_not_env_call by fastforce\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, Normal s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs (While b P) xs' P (Normal s) s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P (LanguageCon.com.While b P), Normal s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs (While b P) xs' P (Normal s) s'' s' \\ m\" by auto\n then have ?thesis unfolding seq_cond_nest_def\n by (metis CptnModNestWhile2.hyps(3) CptnModNestWhile2.hyps(5) Seq_P_Ends_Normal a1 last_length m_cptn min_m min_w) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestWhile3 n \\ P s xs b s' ys zs) \n then obtain min_n_p where \n min_p:\"(min_n_p, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, Normal s) # xs) \\ cptn_mod_nest_call)\" \n by auto\n from CptnModNestWhile3 obtain min_n_w where\n min_w:\"(min_n_w, \\, (Throw, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Throw, snd (last ((P, Normal s) # xs))) # ys)\n \\ cptn_mod_nest_call)\"\n by auto\n thus ?case \n proof (cases \"min_n_p\\min_n_w\")\n case True \n then have \"(min_n_p, \\, \n (Throw, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_w using cptn_mod_nest_mono by blast \n then have \"(min_n_p, \\, (While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_call.CptnModNestWhile3[of min_n_p \\ P s xs b s' ys zs] \n CptnModNestWhile3\n by fastforce\n also have \"\\m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n by (metis CptnModNestWhile3.hyps(3) CptnModNestWhile3.hyps(5) CptnModNestWhile3.hyps(8) \n Seq_P_Ends_Abort div_seq_nest elim_cptn_mod_nest_call_n min_p) \n ultimately show ?thesis by auto \n next\n case False\n then have False:\"min_n_p, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_n_w, \\, (While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n using min_w min_p cptn_mod_nest_call.CptnModNestWhile3[of min_n_w \\ P s xs b s' ys zs] \n CptnModNestWhile3\n by fastforce \n also have \"\\m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume \"(m, \\,(While b P, Normal s) # (Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\"\n then have s1:\"(m, \\,(Seq P (While b P), Normal s) # zs) \\ cptn_mod_nest_call\" \n using elim_cptn_mod_nest_not_env_call by fastforce\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, Normal s) # xs') \\ cptn_mod_nest_call \\ \n seq_cond_nest zs (While b P) xs' P (Normal s) s'' s' \\ m\" \n using \n div_seq_nest[of m \\ \"(LanguageCon.com.Seq P (LanguageCon.com.While b P), Normal s) # zs\"]\n by fastforce\n then have \"seq_cond_nest zs (While b P) xs' P (Normal s) s'' s' \\ m\" by auto\n then have ?thesis unfolding seq_cond_nest_def\n by (metis CptnModNestWhile3.hyps(3) CptnModNestWhile3.hyps(5) CptnModNestWhile3.hyps(8) Seq_P_Ends_Abort s1 m_cptn min_m min_w) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestCall n \\ bdy s xs f) thus ?case\n proof -\n { fix nn :: \"nat \\ nat\"\n obtain nna :: nat where\n ff1: \"(nna, \\, (bdy, Normal s) # xs) \\ cptn_mod_nest_call \\ (\\n. \\ n < nna \\ (n, \\, (bdy, Normal s) # xs) \\ cptn_mod_nest_call)\"\n by (meson CptnModNestCall.hyps(2))\n moreover\n { assume \"(nn (nn (Suc nna)), \\, (bdy, Normal s) # xs) \\ cptn_mod_nest_call\"\n then have \"\\ Suc (nn (nn (Suc nna))) < Suc nna\"\n using ff1 by blast\n then have \"(nn (Suc nna), \\, (LanguageCon.com.Call f, Normal s) # (bdy, Normal s) # xs) \\ cptn_mod_nest_call \\ (\\n. (n, \\, (LanguageCon.com.Call f, Normal s) # (bdy, Normal s) # xs) \\ cptn_mod_nest_call \\ \n (\\ nn n < n \\ (nn n, \\, (LanguageCon.com.Call f, Normal s) # (bdy, Normal s) # xs) \\ cptn_mod_nest_call))\"\n using ff1 by (meson CptnModNestCall.hyps(3) CptnModNestCall.hyps(4) cptn_mod_nest_call.CptnModNestCall less_trans_Suc) }\n ultimately have \"\\n. (n, \\, (LanguageCon.com.Call f, Normal s) # (bdy, Normal s) # xs) \\ cptn_mod_nest_call \\ (\\ nn n < n \\ (nn n, \\, (LanguageCon.com.Call f, Normal s) # (bdy, Normal s) # xs) \\ cptn_mod_nest_call)\"\n by (metis (no_types) CptnModNestCall.hyps(3) CptnModNestCall.hyps(4) cptn_mod_nest_call.CptnModNestCall elim_cptn_mod_nest_call_n) }\n then show ?thesis\n by meson\n qed \nnext \n case (CptnModNestDynCom n \\ c s xs) thus ?case\n by (meson cptn_mod_nest_call.CptnModNestDynCom elim_cptn_mod_nest_call_n)\nnext\n case (CptnModNestGuard n \\ c s xs g f) thus ?case \n by (meson cptn_mod_nest_call.CptnModNestGuard elim_cptn_mod_nest_call_n) \nnext\n case (CptnModNestCatch1 n \\ P s xs zs Q) thus ?case\n by (metis (no_types, lifting) Catch_P_Not_finish cptn_mod_nest_call.CptnModNestCatch1 div_catch_nest)\nnext\n case (CptnModNestCatch2 n \\ P s xs ys zs Q) \n then obtain min_p where \n min_p:\"(min_p, \\, (P, s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestCatch2(5) obtain min_q where\n min_q:\"(min_q, \\, (Skip, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Skip, snd (last ((P, s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (Skip, snd (last ((P,s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestCatch2[of min_p \\ P s xs] \n CptnModNestCatch2(6) CptnModNestCatch2(3)\n by blast\n also have \"\\m,(Catch P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have \"xs=xs'\" \n using Catch_P_Ends_Skip[OF CptnModNestCatch2(6) CptnModNestCatch2(3)] \n by fastforce\n then have \"(m, \\, (P,s) # xs) \\ cptn_mod_nest_call\"\n using m_cptn by auto\n then have False using min_p min_m by fastforce\n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestCatch2[of min_q \\ P s xs ] \n CptnModNestCatch2(6) CptnModNestCatch2(3)\n by blast\n also have \"\\m,(Catch P Q,s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' s' s'' where \n m_cptn:\"(m, \\, (P, s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P s s'' s' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P s s'' s' \\ m\" by auto\n then have ?thesis\n using Catch_P_Ends_Skip[OF CptnModNestCatch2(6) CptnModNestCatch2(3)]\n min_m min_q \n by blast \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed\nnext\n case (CptnModNestCatch3 n \\ P s xs s' Q ys zs ) then obtain min_p where \n min_p:\"(min_p, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call \\\n (\\m, (P, Normal s) # xs) \\ cptn_mod_nest_call)\" \n by auto \n from CptnModNestCatch3(6) CptnModNestCatch3(4) obtain min_q where\n min_q:\"(min_q, \\, (Q, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (\\m, (Q, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call)\"\n by auto\n thus ?case\n proof(cases \"min_p\\min_q\")\n case True\n then have \"(min_p, \\, (Q, snd (last ((P, Normal s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_q using cptn_mod_nest_mono by blast \n then have \"(min_p, \\, (Catch P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_p] cptn_mod_nest_call.CptnModNestCatch3[of min_p \\ P s xs s' Q ys zs] \n CptnModNestCatch3(4) CptnModNestCatch3(3) CptnModNestCatch3(7)\n by fastforce\n also have \"\\m,(Catch P Q,Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q,Normal s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' ns' ns'' where \n m_cptn:\"(m, \\, (P, Normal s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, Normal s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" by auto \n then have \"xs=xs'\" \n using Catch_P_Ends_Normal[OF CptnModNestCatch3(7) CptnModNestCatch3(3) CptnModNestCatch3(4)] \n by fastforce\n then have \"(m, \\, (P,Normal s) # xs) \\ cptn_mod_nest_call\"\n using m_cptn by auto\n then have False using min_p min_m by fastforce\n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\n next\n case False\n then have \"(min_q, \\, (P, Normal s) # xs) \\ cptn_mod_nest_call\"\n using min_p cptn_mod_nest_mono by force \n then have \"(min_q, \\, (Catch P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n using conjunct1[OF min_q] cptn_mod_nest_call.CptnModNestCatch3[of min_q \\ P s xs s' ] \n CptnModNestCatch3(4) CptnModNestCatch3(3) CptnModNestCatch3(7)\n by blast\n also have \"\\m,(Catch P Q,Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {fix m\n assume min_m:\"m,(Catch P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n proof -\n {assume ass:\"(m, \\, (Catch P Q, Normal s) # zs) \\ cptn_mod_nest_call\"\n then obtain xs' ns' ns'' where \n m_cptn:\"(m, \\, (P, Normal s) # xs') \\ cptn_mod_nest_call \\ \n catch_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" \n using \n div_catch_nest[of m \\ \"(Catch P Q, Normal s) # zs\"]\n by fastforce\n then have \"catch_cond_nest zs Q xs' P (Normal s) ns'' ns' \\ m\" by auto\n then have ?thesis\n using Catch_P_Ends_Normal[OF CptnModNestCatch3(7) CptnModNestCatch3(3) CptnModNestCatch3(4)]\n min_m min_q \n by (metis last_length) \n } thus ?thesis by auto\n qed\n }thus ?thesis by auto\n qed \n ultimately show ?thesis by auto\n qed \nqed\n\n lemma elim_cptn_mod_min_nest_call:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"(\\f. redex P \\ Call f) \\ \n SmallStepCon.redex P = LanguageCon.com.Call fn \\ \\ fn = None \\\n (redex P = Call fn \\ (\\sa. s\\Normal sa)) \\\n (redex P = Call fn \\ P=Q)\" \n shows \"min_call n \\ ((Q,t)#cfg1)\"\nproof -\n have a0: \"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a0': \"(\\m, cfg) \\ cptn_mod_nest_call)\"\n using a0 unfolding min_call_def by auto\n then have \"(n,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\" \n using a0 a1 elim_cptn_mod_nest_call_n by blast\n also have \"(\\m, (Q,t)#cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { assume \"\\(\\m, (Q,t)#cfg1) \\ cptn_mod_nest_call)\"\n then obtain m where \n asm0:\"m, (Q,t)#cfg1) \\ cptn_mod_nest_call\"\n by auto\n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" \n using a0 a1 a2 cptn_mod_nest_cptn_mod cptn_if_cptn_mod cptn_mod_nest_call.CptnModNestEnv\n cptn_elim_cases(2) not_func_redex_cptn_mod_nest_n' \n by (metis (no_types, lifting) mod_env_not_component)\n\n then have False using a0' asm0 by auto\n } thus ?thesis by auto qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\n \n\nlemma elim_call_cptn_mod_min_nest_call:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"P = Call f \\ \n \\ f = Some Q \\ (\\sa. s=Normal sa) \\ P\\Q\" \n shows \"min_call (n-1) \\ ((Q,t)#cfg1)\"\nproof -\n obtain s' where a0: \"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a0': \"(\\m, cfg) \\ cptn_mod_nest_call)\" and\n a2': \"s= Normal s'\" \n using a0 a2 unfolding min_call_def by auto \n then have \"(n-1,\\,(Q,t)#cfg1) \\ cptn_mod_nest_call\" \n using a1 a2 a2' elim_cptn_mod_nest_call_n_dec[of n \\ f s' cfg1 Q]\n by (metis (no_types, lifting) SmallStepCon.redex.simps(7) call_f_step_not_s_eq_t_false \n cptn_elim_cases(2) cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod option.sel) \n thus ?thesis\n proof -\n obtain nn :: \"(('b, 'a, 'c, 'd) LanguageCon.com \\ ('b, 'c) xstate) list \\ \n ('a \\ ('b, 'a, 'c, 'd) LanguageCon.com option) \\ nat \\ nat\" where\n \"\\x0 x1 x2. (\\v3 cptn_mod_nest_call) = \n (nn x0 x1 x2 < x2 \\ (nn x0 x1 x2, x1, x0) \\ cptn_mod_nest_call)\"\n by moura\n then have f1: \"\\n f ps. (\\ min_call n f ps \\ (n, f, ps) \\ cptn_mod_nest_call \\ \n (\\na. \\ na < n \\ (na, f, ps) \\ cptn_mod_nest_call)) \\ \n (min_call n f ps \\ (n, f, ps) \\ cptn_mod_nest_call \\ \n nn ps f n < n \\ (nn ps f n, f, ps) \\ cptn_mod_nest_call)\"\n by (meson min_call_def)\n then have f2: \"(n, \\, (P, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call \\ \n (\\na. \\ na < n \\ (na, \\, (P, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n using a1 assms(1) by blast\n obtain bb :: 'b where\n f3: \"s = Normal bb\"\n using a2 by blast\n then have f4: \"(LanguageCon.com.Call f, Normal bb) = (P, s)\"\n using a2 by blast\n have f5: \"n - 1 < n\"\n using f2 by (metis (no_types) Suc_diff_Suc a2 diff_Suc_eq_diff_pred elim_cptn_mod_nest_call_n_greater_zero lessI minus_nat.diff_0)\n have f6: \"(LanguageCon.com.Call f, Normal bb) = (P, s)\"\n using f3 a2 by blast\n have f7: \"Normal bb = t\"\n using f4 f2 by (metis (no_types) SmallStepCon.redex.simps(7) a2 \n call_f_step_not_s_eq_t_false cptn_elim_cases(2) \n cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod)\n have \"(nn ((Q, t) # cfg1) \\ (n - 1), \\, (Q, Normal bb) # cfg1) \\ cptn_mod_nest_call \\ \n (Suc (nn ((Q, t) # cfg1) \\ (n - 1)), \\, \n (LanguageCon.com.Call f, Normal bb) # (Q, Normal bb) # cfg1) \\ cptn_mod_nest_call\"\n using a2 cptn_mod_nest_call.CptnModNestCall by fastforce\n then show ?thesis\n using f7 f6 f5 f2 f1 \\(n - 1, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\\ less_trans_Suc by blast\n qed \n \nqed\n\nlemma redex_not_call_seq_catch:\n assumes a0:\"redex P = Call f \\ P\\Call f\" \n shows \"\\p1 p2. P = Seq p1 p2 \\ P = Catch p1 p2\"\nusing a0 unfolding min_call_def\nproof(induct P)\nqed(fastforce+)\n\nlemma skip_all_skip:\n assumes a0:\"(\\,cfg)\\cptn\" and\n a1:\"cfg = (Skip,s)#cfg1\"\n shows \"\\i,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n moreover have \n xs:\"x # xs = (LanguageCon.com.Skip, s') # xs\" using x by auto\n ultimately show ?case using Cons(1)[OF cptn xs] Cons(3)\n using diff_Suc_1 fstI length_Cons less_Suc_eq_0_disj nth_Cons' by auto \nqed\n\nlemma skip_all_skip_throw:\n assumes a0:\"(\\,cfg)\\cptn\" and\n a1:\"cfg = (Throw,s)#cfg1\"\n shows \"\\i fst(cfg!i) = Throw\"\nusing a0 a1\nproof(induct cfg1 arbitrary:cfg s)\n case Nil thus ?case by auto\nnext\n case (Cons x xs)\n then obtain s' where x:\"x = (Skip,s') \\ x = (Throw, s')\"\n by (metis CptnMod_elim_cases(10) cptn_eq_cptn_mod_set) \n then have cptn:\"(\\,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n show ?case using x\n proof \n assume \"x=(Skip,s')\" thus ?thesis using skip_all_skip Cons(3)\n using cptn fstI length_Cons less_Suc_eq_0_disj nth_Cons' nth_Cons_Suc skip_all_skip \n by fastforce \n next\n assume x:\"x=(Throw,s')\"\n moreover have cptn:\"(\\,x#xs)\\cptn\"\n using Cons.prems(1) Cons.prems(2) cptn_dest_pair by blast\n moreover have \n xs:\"x # xs = (LanguageCon.com.Throw, s') # xs\" using x by auto\n ultimately show ?case using Cons(1)[OF cptn xs] Cons(3)\n using diff_Suc_1 fstI length_Cons less_Suc_eq_0_disj nth_Cons' by auto \n qed \nqed\n\n \nlemma skip_min_nested_call_0:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (Skip,s)#cfg1\"\n shows \"n=0\"\nproof -\n have asm0:\"(n, \\, cfg) \\ cptn_mod_nest_call\" and \n asm1:\"(\\m, cfg) \\ cptn_mod_nest_call)\" \n using a0 unfolding min_call_def by auto \n show ?thesis using a1 asm0 asm1\n proof (induct cfg1 arbitrary: cfg s n)\n case Nil thus ?case\n using cptn_mod_nest_call.CptnModNestOne neq0_conv by blast\n next\n case (Cons x xs)\n then obtain Q s' where cfg:\"cfg = (LanguageCon.com.Skip, s) # (Q,s') # xs\" by force\n then have min_call:\"min_call n \\ cfg\" using Cons unfolding min_call_def by auto\n then have \"(\\f. SmallStepCon.redex Skip \\ LanguageCon.com.Call f)\" by auto\n then have \"min_call n \\ ((Q, s')#xs)\" \n using elim_cptn_mod_min_nest_call[OF min_call cfg] cfg\n by simp\n thus ?case using Cons cfg unfolding min_call_def\n proof -\n assume a1: \"(n, \\, (Q, s') # xs) \\ cptn_mod_nest_call \\ (\\m, (Q, s') # xs) \\ cptn_mod_nest_call)\"\n have \"LanguageCon.com.Skip = Q\"\n by (metis (no_types) \\(n, \\, cfg) \\ cptn_mod_nest_call\\ cfg cptn_dest1_pair cptn_if_cptn_mod cptn_mod_nest_cptn_mod fst_conv last.simps last_length length_Cons lessI not_Cons_self2 skip_all_skip)\n then show ?thesis\n using a1 by (meson Cons.hyps)\n qed \n qed\nqed\n\nlemma throw_min_nested_call_0:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (Throw,s)#cfg1\"\n shows \"n=0\"\nproof -\n have asm0:\"(n, \\, cfg) \\ cptn_mod_nest_call\" and \n asm1:\"(\\m, cfg) \\ cptn_mod_nest_call)\" \n using a0 unfolding min_call_def by auto \n show ?thesis using a1 asm0 asm1\n proof (induct cfg1 arbitrary: cfg s n)\n case Nil thus ?case\n using cptn_mod_nest_call.CptnModNestOne neq0_conv by blast\n next\n case (Cons x xs)\n then obtain s' where x:\"x = (Skip,s') \\ x = (Throw, s')\"\n using CptnMod_elim_cases(10) cptn_eq_cptn_mod_set\n by (metis cptn_mod_nest_cptn_mod) \n then obtain Q where cfg:\"cfg = (LanguageCon.com.Throw, s) # (Q,s') # xs\"\n using Cons by force\n then have min_call:\"min_call n \\ cfg\" using Cons unfolding min_call_def by auto\n then have \"(\\f. SmallStepCon.redex Skip \\ LanguageCon.com.Call f)\" by auto\n then have min_call':\"min_call n \\ ((Q, s')#xs)\" \n using elim_cptn_mod_min_nest_call[OF min_call cfg] cfg\n by simp\n from x show ?case\n proof\n assume \"x=(Skip,s')\"\n thus ?thesis using skip_min_nested_call_0 min_call' Cons(2) cfg by fastforce\n next \n assume \"x=(Throw,s')\"\n thus ?thesis using Cons(1,2) min_call' cfg unfolding min_call_def \n by blast \n qed \n qed\nqed\n\n\n\ntext {* function to calculate that there is not any subsequent where the nested call is n *}\ndefinition cond_seq_1\nwhere \n\"cond_seq_1 n \\ c1 s xs c2 zs ys \\ ((n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last((c1,s)#xs)) = Skip \\\n (n,\\,((c2, snd(last ((c1, s)#xs)))#ys)) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys))\"\n\ndefinition cond_seq_2\nwhere\n\"cond_seq_2 n \\ c1 s xs c2 zs ys s' s'' \\ s= Normal s'' \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Throw \\\n snd(last ((c1, s)#xs)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift c2) xs)@((Throw,Normal s')#ys)\"\n\ndefinition cond_catch_1\nwhere \n\"cond_catch_1 n \\ c1 s xs c2 zs ys \\ ((n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last((c1,s)#xs)) = Skip \\\n (n,\\,((Skip, snd(last ((c1, s)#xs)))#ys)) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((Skip, snd(last ((c1, s)#xs)))#ys))\"\n\ndefinition cond_catch_2\nwhere\n\"cond_catch_2 n \\ c1 s xs c2 zs ys s' s'' \\ s= Normal s'' \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Throw \\\n snd(last ((c1, s)#xs)) = Normal s' \\ \n (n,\\,(c2,Normal s')#ys) \\ cptn_mod_nest_call \\ \n zs=(map (lift_catch c2) xs)@((c2,Normal s')#ys)\"\n\nfun biggest_nest_call :: \"('s,'p,'f,'e)com \\ \n ('s,'f) xstate \\ \n (('s,'p,'f,'e) config) list \\ \n ('s,'p,'f,'e) body \\ \n nat \\ bool\"\nwhere\n \"biggest_nest_call (Seq c1 c2) s zs \\ n = \n (if (\\xs. ((min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift c2) xs))) then\n let xsa = (SOME xs. (min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift c2) xs)) in\n (biggest_nest_call c1 s xsa \\ n)\n else if (\\xs ys. cond_seq_1 n \\ c1 s xs c2 zs ys) then\n let xsa = (SOME xs. \\ys. cond_seq_1 n \\ c1 s xs c2 zs ys);\n ysa = (SOME ys. cond_seq_1 n \\ c1 s xsa c2 zs ys) in\n if (min_call n \\ ((c2, snd(last ((c1, s)#xsa)))#ysa)) then True\n else (biggest_nest_call c1 s xsa \\ n) \n else let xsa = (SOME xs. \\ys s' s''. cond_seq_2 n \\ c1 s xs c2 zs ys s' s'') in\n (biggest_nest_call c1 s xsa \\ n))\" \n|\"biggest_nest_call (Catch c1 c2) s zs \\ n = \n (if (\\xs. ((min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift_catch c2) xs))) then\n let xsa = (SOME xs. (min_call n \\ ((c1,s)#xs)) \\ (zs=map (lift_catch c2) xs)) in\n (biggest_nest_call c1 s xsa \\ n)\n else if (\\xs ys. cond_catch_1 n \\ c1 s xs c2 zs ys) then\n let xsa = (SOME xs. \\ys. cond_catch_1 n \\ c1 s xs c2 zs ys) in \n (biggest_nest_call c1 s xsa \\ n)\n else let xsa = (SOME xs. \\ys s' s''. cond_catch_2 n \\ c1 s xs c2 zs ys s' s'');\n ysa = (SOME ys. \\s' s''. cond_catch_2 n \\ c1 s xsa c2 zs ys s' s'') in\n if (min_call n \\ ((c2, snd(last ((c1, s)#xsa)))#ysa)) then True\n else (biggest_nest_call c1 s xsa \\ n))\"\n|\"biggest_nest_call _ _ _ _ _ = False\"\n\n\nlemma min_call_less_eq_n:\n \"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys) \\\n p\\n \\ q\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_seq_less_eq_n':\n \"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n min_call p \\ ((c1, s)#xs) \\\n p\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_seq2:\n \"min_call n \\ ((Seq c1 c2,s)#zs) \\\n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Skip \\\n (n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs) \\ min_call n \\ ((c2, snd(last ((c1, s)#xs)))#ys)\n \"\nproof -\n assume a0:\"min_call n \\ ((Seq c1 c2,s)#zs)\" and\n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = Skip\" and\n a3:\"(n,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift c2) xs)@((c2, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p q where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call by blast\n then have p_q:\"p\\n \\ q\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p q , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(q,\\,(c2, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\q\")\n case True \n then have q_cptn_c1:\"(q, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(q, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(q,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 CptnModNestSeq2[OF q_cptn_c1 a2 q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c2, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 CptnModNestSeq2[OF q_cptn_c1 a2 q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ q \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_seq3:\n \"min_call n \\ ((Seq c1 c2,s)#zs) \\\n s= Normal s'' \\\n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Throw \\\n snd(last ((c1, s)#xs)) = Normal s' \\\n (n,\\,(Throw, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift c2) xs)@((Throw, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ ((Seq c1 c2,s)#zs)\" and\n a0':\"s= Normal s''\" and\n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = Throw\" and\n a2':\"snd(last ((c1, s)#xs)) = Normal s'\" and\n a3:\"(n,\\,(Throw, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift c2) xs)@((Throw, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call 0 \\ ((Throw, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call throw_min_nested_call_0 by metis\n then have p_q:\"p\\n \\ 0\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p 0 , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(0,\\,(Throw, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\0\")\n case True \n then have q_cptn_c1:\"(0, \\, (c1, Normal s'') # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls a0' unfolding min_call_def \n by blast\n have q_cptn_c2:\"(0, \\, (Throw, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(0,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 a2' a0' CptnModNestSeq3[OF q_cptn_c1 ] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, Normal s'') # xs) \\ cptn_mod_nest_call\" \n using min_calls a0' unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (Throw, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Seq c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 a0' a2' CptnModNestSeq3[OF q_cptn_c1]\n by auto \n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ 0 \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_catch2:\n \"min_call n \\ ((Catch c1 c2,s)#zs) \\ \n (n,\\, (c1, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, s)#xs)) = Skip \\ \n (n,\\,(Skip, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((Skip, snd(last ((c1, s)#xs)))#ys) \\\n min_call n \\ ((c1, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ ((Catch c1 c2,s)#zs)\" and \n a1:\"(n,\\, (c1, s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, s)#xs)) = Skip\" and \n a3:\"(n,\\,(Skip, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift_catch c2) xs)@((Skip, snd(last ((c1, s)#xs)))#ys)\"\n then obtain p where min_calls: \n \"min_call p \\ ((c1, s)#xs) \\ min_call 0 \\ ((Skip, snd(last ((c1, s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call skip_min_nested_call_0 by metis\n then have p_q:\"p\\n \\ 0\\n\" using a0 a1 a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p 0 , (c1, s)#xs) \\ cptn_mod_nest_call\" and\n \"(0,\\,(Skip, snd(last ((c1, s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\0\")\n case True \n then have q_cptn_c1:\"(0, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(0, \\, (Skip, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(0,\\,((Catch c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a4 CptnModNestCatch2[OF q_cptn_c1 ] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (Skip, snd (last ((c1, s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Catch c1 c2,s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 CptnModNestCatch2[OF q_cptn_c1]\n by auto \n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ 0 \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_catch_less_eq_n:\n \"(n,\\, (c1, Normal s)#xs) \\ cptn_mod_nest_call \\ \n (n,\\,(c2, snd(last ((c1, Normal s)#xs)))#ys) \\ cptn_mod_nest_call \\ \n min_call p \\ ((c1, Normal s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, Normal s)#xs)))#ys) \\\n p\\n \\ q\\n\"\nunfolding min_call_def\nusing le_less_linear by blast\n\nlemma min_call_catch3:\n \"min_call n \\ ((Catch c1 c2,Normal s)#zs) \\\n (n,\\, (c1, Normal s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((c1, Normal s)#xs)) = Throw \\\n snd(last ((c1, Normal s)#xs)) = Normal s' \\\n (n,\\,(c2, snd(last ((c1, Normal s)#xs)))#ys) \\ cptn_mod_nest_call \\\n zs=(map (lift_catch c2) xs)@((c2, snd(last ((c1, Normal s)#xs)))#ys) \\\n min_call n \\ ((c1, Normal s)#xs) \\ min_call n \\ ((c2, snd(last ((c1, Normal s)#xs)))#ys)\n \"\nproof -\n assume a0:\"min_call n \\ ((Catch c1 c2,Normal s)#zs)\" and\n a1:\"(n,\\, (c1, Normal s)#xs) \\ cptn_mod_nest_call\" and\n a2:\"fst(last ((c1, Normal s)#xs)) = Throw\" and\n a2':\"snd(last ((c1, Normal s)#xs)) = Normal s'\" and\n a3:\"(n,\\,(c2, snd(last ((c1, Normal s)#xs)))#ys) \\ cptn_mod_nest_call\" and\n a4:\"zs=(map (lift_catch c2) xs)@((c2, snd(last ((c1, Normal s)#xs)))#ys)\"\n then obtain p q where min_calls: \n \"min_call p \\ ((c1, Normal s)#xs) \\ min_call q \\ ((c2, snd(last ((c1, Normal s)#xs)))#ys)\"\n using a1 a3 minimum_nest_call by blast\n then have p_q:\"p\\n \\ q\\n\" \n using a1 a2 a2' a3 a4 min_call_less_eq_n by blast\n {\n assume ass0:\"p q , (c1, Normal s)#xs) \\ cptn_mod_nest_call\" and\n \"(q,\\,(c2, snd(last ((c1, Normal s)#xs)))#ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have ?thesis\n proof (cases \"p\\q\")\n case True \n then have q_cptn_c1:\"(q, \\, (c1,Normal s) # xs) \\ cptn_mod_nest_call\" \n using cptn_mod_nest_mono min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(q, \\, (c2, snd (last ((c1, Normal s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls unfolding min_call_def by auto\n then have \"(q,\\,((Catch c1 c2, Normal s)#zs)) \\cptn_mod_nest_call\"\n using True min_calls a2 a2' a4 CptnModNestCatch3[OF q_cptn_c1 a2 a2' q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n next\n case False\n then have q_cptn_c1:\"(p, \\, (c1, Normal s) # xs) \\ cptn_mod_nest_call\" \n using min_calls unfolding min_call_def \n by blast\n have q_cptn_c2:\"(p, \\, (c2, snd (last ((c1, Normal s) # xs))) # ys) \\ cptn_mod_nest_call\"\n using min_calls False unfolding min_call_def\n by (metis (no_types, lifting) cptn_mod_nest_mono2 not_less)\n then have \"(p,\\,((Catch c1 c2,Normal s)#zs)) \\cptn_mod_nest_call\"\n using False min_calls a2 a4 CptnModNestCatch3[OF q_cptn_c1 a2 a2' q_cptn_c2 a4] \n by auto\n thus ?thesis using ass0 a0 unfolding min_call_def by auto\n qed\n }note l=this\n {\n assume ass0:\"p\\n \\ q \\n\" \n then have ?thesis using p_q min_calls by fastforce\n }\n thus ?thesis using l by fastforce\nqed\n\nlemma min_call_seq_c1_not_finish:\n \"min_call n \\ cfg \\\n cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1 \\\n (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs \\\n min_call n \\ ((P0, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ cfg\" and\n a1:\" cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1\" and\n a2:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and\n a3:\"(Q, t) # cfg1 = map (lift P1) xs\" \n then have \"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" using a2 by auto\n moreover have \"\\m,(P0, s)#xs) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, (P0, s) # xs) \\ cptn_mod_nest_call\"\n then have \"(m,\\,cfg) \\ cptn_mod_nest_call\" \n using a1 a3 CptnModNestSeq1[OF ass1] by auto\n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_seq_not_finish:\n \" min_call n \\ ((P0, s)#xs) \\\n cfg = (LanguageCon.com.Seq P0 P1, s) # cfg1 \\ \n cfg1 = map (lift P1) xs \\\n min_call n \\ cfg \n \"\nproof -\n assume a0:\"min_call n \\ ((P0, s)#xs)\" and\n a1:\" cfg = (LanguageCon.com.Seq P0 P1, s) # cfg1\" and \n a2:\" cfg1 = map (lift P1) xs\" \n then have \"(n, \\,cfg) \\ cptn_mod_nest_call\" \n using a0 a1 a2 CptnModNestSeq1[of n \\ P0 s xs \"cfg1\" P1] unfolding min_call_def \n by auto\n moreover have \"\\m,cfg) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, cfg) \\ cptn_mod_nest_call\"\n then have \"(m,\\,(P0, s)#xs) \\ cptn_mod_nest_call\" \n using a1 a2 by (metis (no_types) Seq_P_Not_finish div_seq_nest) \n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_catch_c1_not_finish:\n \"min_call n \\ cfg \\\n cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1 \\\n (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs \\\n min_call n \\ ((P0, s)#xs)\n \"\nproof -\n assume a0:\"min_call n \\ cfg\" and\n a1:\" cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1\" and\n a2:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and\n a3:\"(Q, t) # cfg1 = map (lift_catch P1) xs\" \n then have \"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" using a2 by auto\n moreover have \"\\m,(P0, s)#xs) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, (P0, s) # xs) \\ cptn_mod_nest_call\"\n then have \"(m,\\,cfg) \\ cptn_mod_nest_call\" \n using a1 a3 CptnModNestCatch1[OF ass1] by auto\n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, (P0, s) # xs) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma min_call_catch_not_finish:\n \" min_call n \\ ((P0, s)#xs) \\\n cfg = (LanguageCon.com.Catch P0 P1, s) # cfg1 \\ \n cfg1 = map (lift_catch P1) xs \\\n min_call n \\ cfg \n \"\nproof -\n assume a0:\"min_call n \\ ((P0, s)#xs)\" and\n a1:\" cfg = (Catch P0 P1, s) # cfg1\" and \n a2:\" cfg1 = map (lift_catch P1) xs\" \n then have \"(n, \\,cfg) \\ cptn_mod_nest_call\" \n using a0 a1 a2 CptnModNestCatch1[of n \\ P0 s xs \"cfg1\" P1] unfolding min_call_def \n by auto\n moreover have \"\\m,cfg) \\ cptn_mod_nest_call\"\n proof-\n {fix m\n assume ass:\"m, cfg) \\ cptn_mod_nest_call\"\n then have \"(m,\\,(P0, s)#xs) \\ cptn_mod_nest_call\" \n using a1 a2 by (metis (no_types) Catch_P_Not_finish div_catch_nest) \n then have False using ass a0 unfolding min_call_def by auto\n }\n then have \"(m, \\, cfg) \\ cptn_mod_nest_call\" by auto\n } then show ?thesis by auto\n qed\n ultimately show ?thesis unfolding min_call_def by auto\nqed\n\nlemma seq_xs_no_empty: assumes\n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\" and\n cfg:\"cfg = (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1\" and\n a0:\"SmallStepCon.redex (LanguageCon.com.Seq P0 P1) = LanguageCon.com.Call f\"\n shows\"\\Q' xs'. Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\nusing seq\nunfolding lift_def seq_cond_nest_def\nproof\n assume \"(Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs\"\n thus ?thesis by auto\nnext\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (LanguageCon.com.Throw, Normal s') # ys)\"\n thus ?thesis\n proof \n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n show ?thesis \n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\" by fastforce\n obtain pps :: \"(('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate) list\" where\n \"(Q, t) # cfg1 = ((case (a, b) of (c, x) \\ (LanguageCon.com.Seq c P1, x)) # map (\\(c, y). \n (LanguageCon.com.Seq c P1, y)) xsa) @ \n (P1, snd (((P0, s) # xs) ! length xs)) # pps\"\n using xa ass local.Cons by moura\n then show ?thesis\n by (simp add: xa local.Cons)\n qed \n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Seq P P1, s)) xs @\n (LanguageCon.com.Throw, Normal s') # ys)\"\n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\" by fastforce\n obtain pps :: \"(('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate) list\" where\n \"(Q, t) # cfg1 = ((case (a, b) of (c, x) \\ (LanguageCon.com.Seq c P1, x)) # map (\\(c, y). \n (LanguageCon.com.Seq c P1, y)) xsa) @ (LanguageCon.com.Throw, Normal s') # pps\"\n using ass local.Cons xa by force\n then show ?thesis\n by (simp add: local.Cons xa)\n qed \n qed\nqed\n\nlemma catch_xs_no_empty: assumes\n seq:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\" and\n cfg:\"cfg = (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1\" and\n a0:\"SmallStepCon.redex (LanguageCon.com.Catch P0 P1) = LanguageCon.com.Call f\"\n shows\"\\Q' xs'. Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\nusing seq\nunfolding lift_catch_def catch_cond_nest_def\nproof\n assume \"(Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs\"\n thus ?thesis by auto\nnext\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\"\n thus ?thesis\n proof \n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n show ?thesis \n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\" by fastforce\n obtain pps :: \"(('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate) list\" where\n \"(Q, t) # cfg1 = ((case (a, b) of (c, x) \\ (LanguageCon.com.Catch c P1, x)) # \n map (\\(c, y). (LanguageCon.com.Catch c P1, y)) xsa) @ \n (P1, snd (((P0, s) # xs) ! length xs)) # pps\"\n using ass local.Cons xa by moura\n then show ?thesis\n by (simp add: local.Cons xa)\n qed \n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 =\n map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\"\n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using cfg a0 ass by auto\n next\n case (Cons xa xsa)\n then obtain a b where xa:\"xa = (a,b)\" by fastforce \n obtain pps :: \"(('a, 'b, 'c, 'd) LanguageCon.com \\ ('a, 'c) xstate) list\" where\n \"(Q, t) # cfg1 = ((case (a, b) of (c, x) \\ \n (LanguageCon.com.Catch c P1, x)) # map (\\(c, y). \n (LanguageCon.com.Catch c P1, y)) xsa) @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # pps\"\n using ass local.Cons xa by force\n then show ?thesis\n by (simp add: local.Cons xa)\n qed \n qed\nqed\n\nlemma redex_call_cptn_mod_min_nest_call_gr_zero:\n assumes a0:\"min_call n \\ cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"redex P = Call f \\ \n \\ f = Some bdy \\ (\\sa. s=Normal sa) \\ t=s\" and\n a3:\"\\\\\\<^sub>c(P,s)\\(Q,t)\"\n shows \"n>0\"\nusing a0 a1 a2 a3\nproof (induct P arbitrary: Q cfg1 cfg s t n)\n case (Call f1) thus ?case\n by (metis SmallStepCon.redex.simps(7) elim_cptn_mod_nest_call_n_greater_zero min_call_def option.distinct(1) stepc_Normal_elim_cases(9))\nnext\n case (Seq P0 P1) \n then obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_seq_nest[of n \\ cfg] unfolding min_call_def by blast\n then obtain m where min:\"min_call m \\ ((P0, s)#xs)\"\n using minimum_nest_call by blast \n have xs':\"\\Q' xs'. Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\n using seq Seq seq_xs_no_empty by auto \n then have \"0,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_catch_nest[of n \\ cfg] unfolding min_call_def by blast\n then obtain m where min:\"min_call m \\ ((P0, s)#xs)\"\n using minimum_nest_call by blast \n obtain Q' xs' where xs':\"Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\n using catch_xs_no_empty[OF seq Catch(4)] Catch by blast\n then have \"0 cfg\" and\n a1:\"cfg = (P,s)#(Q,t)#cfg1\" and\n a2:\"redex P = Call f \\ \n \\ f = Some bdy \\ (\\sa. s=Normal sa) \\ t=s \" and\n a3:\"biggest_nest_call P s ((Q,t)#cfg1) \\ n\" \n shows \"min_call n \\ ((Q,t)#cfg1)\"\nusing a0 a1 a2 a3 \nproof (induct P arbitrary: Q cfg1 cfg s t n) \n case Cond thus ?case by fastforce\nnext\n case (Seq P0 P1) \n then obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n seq:\"seq_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_seq_nest[of n \\ cfg] unfolding min_call_def by blast\n \n show ?case using seq unfolding seq_cond_nest_def \n proof\n assume ass:\"(Q, t) # cfg1 = map (lift P1) xs\" \n then obtain Q' xs' where xs':\"Q=Seq Q' P1 \\ xs=(Q',t)#xs'\"\n unfolding lift_def by fastforce\n then have ctpn_P0:\"(P0, s) # xs = (P0, s) # (Q', t) # xs'\" by auto\n then have min_p0:\"min_call n \\ ((P0, s)#xs)\"\n using min_call_seq_c1_not_finish[OF Seq(3) Seq(4) p0_cptn] ass by auto\n then have ex_xs:\"\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs\" \n using ass by auto\n then have min_xs:\"min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs\" \n using min_p0 ass by auto\n have \"xs= (SOME xs. (min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs))\"\n proof -\n have \"\\xsa. min_call n \\ ((P0, s)#xsa) \\ (Q, t) # cfg1 = map (lift P1) xsa \\ xsa = xs\"\n using xs' ass by (metis map_lift_eq_xs_xs')\n thus ?thesis using min_xs some_equality by (metis (mono_tags, lifting))\n qed\n then have big:\"biggest_nest_call P0 s ((Q', t) # xs') \\ n\" \n using biggest_nest_call.simps(1)[of P0 P1 s \"((Q, t) # cfg1)\" \\ n] \n Seq(6) xs' ex_xs by auto \n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Seq(5) xs' by auto \n have min_call:\"min_call n \\ ((Q', t) # xs')\" \n using Seq(1)[OF min_p0 ctpn_P0 reP0] big xs' ass by auto\n thus ?thesis using min_call_seq_not_finish[OF min_call] ass xs' by blast\n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys)\"\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n have ?thesis \n proof (cases xs)\n case Nil thus ?thesis using Seq ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n seq2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\ \n (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) (xa#xsa) @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n using ass by auto \n then obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using seq2_ass minimum_nest_call p0_cptn by fastforce \n then have mp: \"mq\\n \\ mp1 \\n\"\n using seq2_ass min_call_less_eq_n[of n \\ P0 s xs P1 ys mq mp1] \n Seq(3,4) p0_cptn by (simp add: last_length)\n have min_call:\"min_call n \\ ((P0, s) # xs) \\ \n min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using seq2_ass min_call_seq2[of n \\ P0 P1 s \"(Q, t) # cfg1\" xs ys] \n Seq(3,4) p0_cptn by (simp add: last_length local.Cons) \n from seq2_ass obtain Q' where Q':\"Q=Seq Q' P1 \\ xa=(Q',t)\" \n unfolding lift_def \n by (metis (mono_tags, lifting) fst_conv length_greater_0_conv \n list.simps(3) list.simps(9) nth_Cons_0 nth_append prod.case_eq_if prod.collapse snd_conv) \n then have q'_n_cptn:\"(n,\\,(Q',t)#xsa)\\cptn_mod_nest_call\" using p0_cptn Q' Cons\n using elim_cptn_mod_nest_call_n by blast \n show ?thesis\n proof(cases \"mp1=n\")\n case True\n then have \"min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using min_call_p1 by auto\n then have min_P1:\"min_call n \\ ((P1, snd ((xa # xsa) ! length xsa)) # ys)\"\n using Cons seq2_ass by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have False using min_P1 ass Q' Cons unfolding min_call_def\n proof -\n assume a1: \"(n, \\, (P1, snd ((xa # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call \\ (\\m, (P1, snd ((xa # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call)\"\n have f2: \"\\n f ps. (n, f, ps) \\ cptn_mod_nest_call \\ (\\x c ca psa. ps \\ (LanguageCon.com.Seq (c::('b, 'a, 'c,'d) LanguageCon.com) ca, x) # psa \\ (\\ps b ba. (n, f, (c, x) # ps) \\ cptn_mod_nest_call \\ seq_cond_nest psa ca ps c x ba b f n))\"\n using div_seq_nest by blast\n have f3: \"(P1, snd (last ((Q', t) # xsa))) # ys = (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n by (simp add: Q' last_length local.Cons)\n have \"fst (last ((Q', t) # xsa)) = LanguageCon.com.Skip\"\n by (metis (no_types) Q' last_ConsR last_length list.distinct(1) local.Cons seq2_ass)\n then show ?thesis\n using f3 f2 a1 by (metis (no_types) Cons_lift_append Q' Seq_P_Ends_Normal Q_m ass seq2_ass)\n qed\n } \n } then show ?thesis by auto\n qed \n ultimately show ?thesis unfolding min_call_def by auto\n next\n case False\n then have \"mp1 min_call n \\ ((P1, snd (last ((P0, s) # xs))) # ys)\"\n using min_call_p1 last_length unfolding min_call_def by metis\n then have min_call:\"min_call n \\ ((P0, s) # xs)\" \n using min_call last_length unfolding min_call_def by metis\n then have \"(P0, s) # xs = (P0, s) # xa#xsa\"\n using Cons by auto\n then have big:\"biggest_nest_call P0 s (((Q',t))#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs)\"\n using min_call seq2_ass Cons\n proof -\n have \"min_call n \\ ((LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1)\"\n using Seq.prems(1) Seq.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Seq_P_Not_finish append_Nil2 list.simps(3) \n local.Cons min_call_def same_append_eq seq seq2_ass)\n qed\n moreover have \"\\xs ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys\"\n using seq2_ass p0_cptn unfolding cond_seq_1_def \n by (metis last_length local.Cons) \n moreover have \"(SOME xs. \\ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = xs\" \n proof -\n let ?P = \"\\xsa. \\ys. (n, \\, (P0, s) # xsa) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xsa)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xsa @ (P1, snd (last ((P0, s) # xsa))) # ys\" \n have \"(\\x. \\ys. (n, \\, (P0, s) # x) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # x)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # x))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) x @ (P1, snd (last ((P0, s) # x))) # ys \\\n x = xs)\" \n by (metis Seq_P_Ends_Normal cptn_mod_nest_call.CptnModNestSeq2 seq)\n moreover have \"\\ys. (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n using ass p0_cptn by (simp add: last_length) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_seq_1_def by blast \n qed\n moreover have \"(SOME ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = ys\"\n proof -\n let ?P = \"\\ys. (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n have \"(n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (P1, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (P1, snd (last ((P0, s) # xs))) # ys\"\n using p0_cptn seq2_ass Cons by (simp add: last_length) \n then show ?thesis using some_equality[of ?P ys]\n unfolding cond_seq_1_def by fastforce \n qed\n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using not_min_call_p1_n Seq(6) \n biggest_nest_call.simps(1)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed\n have C:\"(P0, s) # xs = (P0, s) # (Q', t) # xsa\" using Cons Q' by auto\n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s\" using Seq(5) Q' by auto\n then have min_call:\"min_call n \\ ((Q', t) # xsa)\" using Seq(1)[OF min_call C reP0 big]\n by auto\n have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"seq_cond_nest cfg1 P1 xsa' Q' t s1 s1' \\ m\"\n using div_seq_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n then have \"xsa=xsa'\" \n using seq2_ass \n Seq_P_Ends_Normal[of cfg1 P1 xsa Q' t ys m \\ xsa' s1 s1'] Cons\n by (metis Cons_lift_append Q' Q_m last.simps last_length list.inject list.simps(3)) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed\n \n ultimately show ?thesis unfolding min_call_def by auto\n qed \n qed\n }note l=this\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\ (\\ys. (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys)\" \n have ?thesis\n proof (cases \"\\\\\\<^sub>c(LanguageCon.com.Seq P0 P1, s) \\ (Q,t)\")\n case True \n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using Seq ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n seq2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\ (n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift P1) xs @ (LanguageCon.com.Throw, Normal s') # ys\"\n using ass by auto \n then have t_eq:\"t=Normal s''\" using Seq by fastforce\n obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((Throw, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using seq2_ass minimum_nest_call p0_cptn by (metis last_length)\n then have mp1_zero:\"mp1=0\" by (simp add: throw_min_nested_call_0)\n then have min_call: \"min_call n \\ ((P0, s) # xs)\" \n using seq2_ass min_call_seq3[of n \\ P0 P1 s \"(Q, t) # cfg1\" s'' xs s' ys]\n Seq(3,4) p0_cptn by (metis last_length) \n have n_z:\"n>0\" using redex_call_cptn_mod_min_nest_call_gr_zero[OF Seq(3) Seq(4) Seq(5) True]\n by auto \n from seq2_ass obtain Q' where Q':\"Q=Seq Q' P1 \\ xa=(Q',t)\" \n unfolding lift_def using Cons\n proof -\n assume a1: \"\\Q'. Q = LanguageCon.com.Seq Q' P1 \\ xa = (Q', t) \\ thesis\"\n have \"(LanguageCon.com.Seq (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n using seq2_ass unfolding lift_def\n by (simp add: Cons case_prod_unfold)\n then show ?thesis\n using a1 by fastforce\n qed \n have big_call:\"biggest_nest_call P0 s ((Q',t)#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift P1) xs)\"\n using min_call seq2_ass Cons Seq.prems(1) Seq.prems(2)\n by (metis Seq_P_Not_finish append_Nil2 list.simps(3) min_call_def same_append_eq seq)\n moreover have \"\\(\\xs ys. cond_seq_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\" \n using min_call seq2_ass p0_cptn Cons Seq.prems(1) Seq.prems(2) \n unfolding cond_seq_1_def\n by (metis com.distinct(17) com.distinct(71) last_length \n map_lift_some_eq seq_and_if_not_eq(4))\n moreover have \"(SOME xs. \\ys s' s''. cond_seq_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = xs\"\n proof-\n let ?P=\"\\xsa. \\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#xs)) = Throw \\\n snd(last ((P0, s)#xs)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) xs)@((Throw,Normal s')#ys)\"\n have \"(\\x. \\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#x) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#x)) = Throw \\\n snd(last ((P0, s)#x)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) x)@((Throw,Normal s')#ys) \\\n x=xs)\" using map_lift_some_eq seq2_ass by fastforce\n moreover have \"\\ys s' s''. s= Normal s'' \\ \n (n,\\, (P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst(last ((P0, s)#xs)) = Throw \\\n snd(last ((P0, s)#xs)) = Normal s' \\ \n (n,\\,(Throw,Normal s')#ys) \\ cptn_mod_nest_call \\ \n ((Q, t) # cfg1)=(map (lift P1) xs)@((Throw,Normal s')#ys)\" \n using ass p0_cptn by (simp add: last_length Cons)\n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_seq_2_def by blast\n qed\n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using Seq(6) \n biggest_nest_call.simps(1)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed \n have min_call:\"min_call n \\ ((Q',t)#xsa)\" \n using Seq(1)[OF min_call _ _ big_call] Seq(5) Cons Q' by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Seq.prems(1) Seq.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast \n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"seq_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using div_seq_nest[of m \\ \"(Q, t) # cfg1\"] Q' t_eq by blast\n then have \"xsa=xsa'\" \n using seq2_ass \n Seq_P_Ends_Abort[of cfg1 P1 xsa s' ys Q' s'' m \\ xsa' s1 s1' ] Cons Q' Q_m\n by (simp add: Cons_lift_append last_length t_eq) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed \n ultimately show ?thesis unfolding min_call_def by auto\n qed\n next\n case False \n then have env:\"\\\\\\<^sub>c(LanguageCon.com.Seq P0 P1, s) \\\\<^sub>e (Q,t)\" using Seq\n by (meson elim_cptn_mod_nest_step_c min_call_def)\n moreover then have Q:\"Q=Seq P0 P1\" using env_c_c' by blast \n ultimately show ?thesis using Seq\n proof -\n obtain nn :: \"(('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ \n ('a \\ ('b, 'a, 'c,'d) LanguageCon.com option) \\ nat \\ nat\" where\n f1: \"\\x0 x1 x2. (\\v3 cptn_mod_nest_call) = (nn x0 x1 x2 < x2 \\ (nn x0 x1 x2, x1, x0) \\ cptn_mod_nest_call)\"\n by moura\n have f2: \"(n, \\, (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call \\ (\\n. \\ n < n \\ (n, \\, (LanguageCon.com.Seq P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n using local.Seq(3) local.Seq(4) min_call_def by blast\n then have \"\\ nn ((Q, t) # cfg1) \\ n < n \\ (nn ((Q, t) # cfg1) \\ n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using False env env_c_c' not_func_redex_cptn_mod_nest_n_env \n by (metis Seq.prems(1) Seq.prems(2) min_call_def)\n then show ?thesis\n using f2 f1 by (meson elim_cptn_mod_nest_call_n min_call_def)\n qed\n qed \n }\n thus ?thesis using l ass by fastforce\n qed\nnext\n case (Catch P0 P1) \nthen obtain xs s' s'' where \n p0_cptn:\"(n, \\,(P0, s)#xs) \\ cptn_mod_nest_call\" and \n catch:\"catch_cond_nest ((Q,t)#cfg1) P1 xs P0 s s'' s' \\ n\"\n using div_catch_nest[of n \\ cfg] unfolding min_call_def by blast\n \n show ?case using catch unfolding catch_cond_nest_def \n proof\n assume ass:\"(Q, t) # cfg1 = map (lift_catch P1) xs\" \n then obtain Q' xs' where xs':\"Q=Catch Q' P1 \\ xs=(Q',t)#xs'\"\n unfolding lift_catch_def by fastforce\n then have ctpn_P0:\"(P0, s) # xs = (P0, s) # (Q', t) # xs'\" by auto\n then have min_p0:\"min_call n \\ ((P0, s)#xs)\"\n using min_call_catch_c1_not_finish[OF Catch(3) Catch(4) p0_cptn] ass by auto\n then have ex_xs:\"\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs\" \n using ass by auto\n then have min_xs:\"min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs\" \n using min_p0 ass by auto\n have \"xs= (SOME xs. (min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs))\"\n proof -\n have \"\\xsa. min_call n \\ ((P0, s)#xsa) \\ (Q, t) # cfg1 = map (lift_catch P1) xsa \\ xsa = xs\"\n using xs' ass by (metis map_lift_catch_eq_xs_xs')\n thus ?thesis using min_xs some_equality by (metis (mono_tags, lifting))\n qed\n then have big:\"biggest_nest_call P0 s ((Q', t) # xs') \\ n\" \n using biggest_nest_call.simps(2)[of P0 P1 s \"((Q, t) # cfg1)\" \\ n] \n Catch(6) xs' ex_xs by auto \n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Catch(5) xs' by auto \n have min_call:\"min_call n \\ ((Q', t) # xs')\" \n using Catch(1)[OF min_p0 ctpn_P0 reP0] big xs' ass by auto\n thus ?thesis using min_call_catch_not_finish[OF min_call] ass xs' by blast\n next\n assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\\n fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\" \n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (\\ys. (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n have ?thesis \n proof (cases xs)\n case Nil thus ?thesis using Catch ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n catch2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n s = Normal s'' \\\n (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n using ass by auto \n then obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using catch2_ass minimum_nest_call p0_cptn by fastforce \n then have mp: \"mq\\n \\ mp1 \\n\"\n using catch2_ass min_call_less_eq_n \n Catch(3,4) p0_cptn by (metis last_length) \n have min_call:\"min_call n \\ ((P0, s) # xs) \\ \n min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using catch2_ass min_call_catch3[of n \\ P0 P1 s'' \"(Q, t) # cfg1\" xs s' ys] \n Catch(3,4) p0_cptn by (metis last_length) \n from catch2_ass obtain Q' where Q':\"Q=Catch Q' P1 \\ xa=(Q',t)\" \n unfolding lift_catch_def\n proof -\n assume a1: \"\\Q'. Q = LanguageCon.com.Catch Q' P1 \\ xa = (Q', t) \\ thesis\"\n assume \"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Throw \\ snd (last ((P0, s) # xs)) = Normal s' \\ s = Normal s'' \\ (n, \\, (P1, snd (((P0, s) # xs) ! length xs)) # ys) \\ cptn_mod_nest_call \\ (Q, t) # cfg1 = map (\\(P, s). (LanguageCon.com.Catch P P1, s)) xs @ (P1, snd (((P0, s) # xs) ! length xs)) # ys\"\n then have \"(LanguageCon.com.Catch (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n by (simp add: local.Cons prod.case_eq_if)\n then show ?thesis\n using a1 by force\n qed \n then have q'_n_cptn:\"(n,\\,(Q',t)#xsa)\\cptn_mod_nest_call\" using p0_cptn Q' Cons\n using elim_cptn_mod_nest_call_n by blast \n show ?thesis\n proof(cases \"mp1=n\")\n case True\n then have \"min_call n \\ ((P1, snd (((P0, s) # xs) ! length xs)) # ys)\"\n using min_call_p1 by auto\n then have min_P1:\"min_call n \\ ((P1, snd ((xa # xsa) ! length xsa)) # ys)\"\n using Cons catch2_ass by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have t_eq_s:\"t=Normal s''\" using Catch catch2_ass by fastforce \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n catch_cond:\"catch_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using Q_m div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n have fst:\"fst (last ((Q', Normal s'') # xsa)) = LanguageCon.com.Throw\" \n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have cfg:\"cfg1 = map (lift_catch P1) xsa @ (P1, snd (last ((Q', Normal s'') # xsa))) # ys\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have snd:\"snd (last ((Q', Normal s'') # xsa)) = Normal s'\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n then have \"xsa=xsa' \\ \n (m, \\, (P1, snd (((Q', Normal s'') # xsa) ! length xsa)) # ys) \\ cptn_mod_nest_call\" \n using catch2_ass Catch_P_Ends_Normal[OF cfg fst snd catch_cond] Cons\n by auto \n then have False using min_P1 ass Q' t_eq_s unfolding min_call_def by auto \n } \n } then show ?thesis by auto\n qed \n ultimately show ?thesis unfolding min_call_def by auto\n next\n case False\n then have \"mp1 min_call n \\ ((P1, snd (last ((P0, s) # xs))) # ys)\"\n using min_call_p1 last_length unfolding min_call_def by metis\n then have min_call:\"min_call n \\ ((P0, s) # xs)\" \n using min_call last_length unfolding min_call_def by metis\n then have \"(P0, s) # xs = (P0, s) # xa#xsa\"\n using Cons by auto\n then have big:\"biggest_nest_call P0 s (((Q',t))#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs)\"\n using min_call catch2_ass Cons\n proof -\n have \"min_call n \\ ((Catch P0 P1, s) # (Q, t) # cfg1)\"\n using Catch.prems(1) Catch.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Catch_P_Not_finish append_Nil2 list.simps(3) \n same_append_eq catch catch2_ass)\n qed\n moreover have \"\\(\\xs ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\"\n unfolding cond_catch_1_def using catch2_ass \n by (metis Catch_P_Ends_Skip LanguageCon.com.distinct(17) catch last_length)\n moreover have \"\\xs ys. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s''\"\n using catch2_ass p0_cptn unfolding cond_catch_2_def last_length\n by metis \n moreover have \"(SOME xs. \\ys s' s''. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = xs\" \n proof -\n let ?P = \"\\xsa. s = Normal s'' \\\n (n, \\, (P0, s) # xsa) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xsa)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xsa)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xsa @ (P1, Normal s') # ys\" \n have \"(\\x. \\ys s' s''. s = Normal s'' \\\n (n, \\, (P0, s) # x) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # x)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # x)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) x @ (P1, Normal s') # ys \\\n x = xs)\" \n by (metis Catch_P_Ends_Normal catch)\n moreover have \"\\ys. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ys\"\n using ass p0_cptn by (metis (full_types) last_length ) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_catch_2_def by blast \n qed\n moreover have \"(SOME ys. \\s' s''. cond_catch_2 n \\ P0 s xs P1 ((Q, t) # cfg1) ys s' s'') = ys\"\n proof -\n let ?P = \"\\ysa. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ysa) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ysa\"\n have \"(\\x. \\s' s''. s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # x) \\ cptn_mod_nest_call \\ (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # x \\\n x = ys)\" using catch2_ass by auto \n moreover have \"s = Normal s'' \\\n (n, \\, (P0, s) # xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Throw \\\n snd (last ((P0, s) # xs)) = Normal s' \\\n (n, \\, (P1, Normal s') # ys) \\ cptn_mod_nest_call \\ \n (Q, t) # cfg1 = map (lift_catch P1) xs @ (P1, Normal s') # ys\"\n using ass p0_cptn by (metis (full_types) catch2_ass last_length p0_cptn) \n ultimately show ?thesis using some_equality[of ?P ys]\n unfolding cond_catch_2_def by blast\n qed \n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using not_min_call_p1_n Catch(6) \n biggest_nest_call.simps(2)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed\n have C:\"(P0, s) # xs = (P0, s) # (Q', t) # xsa\" using Cons Q' by auto\n have reP0:\"redex P0 = (Call f) \\ \\ f = Some bdy \\ \n (\\saa. s = Normal saa) \\ t = s \" using Catch(5) Q' by auto\n then have min_call:\"min_call n \\ ((Q', t) # xsa)\" using Catch(1)[OF min_call C reP0 big]\n by auto\n have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast\n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then have t_eq_s:\"t=Normal s''\" using Catch catch2_ass by fastforce\n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n catch_cond:\"catch_cond_nest cfg1 P1 xsa' Q' (Normal s'') s1 s1' \\ m\"\n using Q_m div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' by blast\n have fst:\"fst (last ((Q', Normal s'') # xsa)) = LanguageCon.com.Throw\" \n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have cfg:\"cfg1 = map (lift_catch P1) xsa @ (P1, snd (last ((Q', Normal s'') # xsa))) # ys\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n have snd:\"snd (last ((Q', Normal s'') # xsa)) = Normal s'\"\n using catch2_ass Cons Q' by (simp add: last_length t_eq_s)\n then have \"xsa=xsa'\" \n using catch2_ass Catch_P_Ends_Normal[OF cfg fst snd catch_cond] Cons\n by auto \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed\n ultimately show ?thesis unfolding min_call_def by auto\n qed \n qed\n }note l=this\n {assume ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (\\ys. (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys)\"\n have ?thesis\n proof (cases \"\\\\\\<^sub>c(Catch P0 P1, s) \\ (Q,t)\")\n case True \n thus ?thesis\n proof (cases xs)\n case Nil thus ?thesis using Catch ass by fastforce\n next\n case (Cons xa xsa)\n then obtain ys where \n catch2_ass:\"fst (((P0, s) # xs) ! length xs) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys\"\n using ass by auto \n then have t_eq:\"t=s\" using Catch by fastforce\n obtain mq mp1 where \n min_call_q:\"min_call mq \\ ((P0, s) # xs)\" and\n min_call_p1:\"min_call mp1 \\ ((Skip, snd (((P0, s) # xs) ! length xs)) # ys)\" \n using catch2_ass minimum_nest_call p0_cptn by (metis last_length)\n then have mp1_zero:\"mp1=0\" by (simp add: skip_min_nested_call_0)\n then have min_call: \"min_call n \\ ((P0, s) # xs)\" \n using catch2_ass min_call_catch2[of n \\ P0 P1 s \"(Q, t) # cfg1\" xs ys]\n Catch(3,4) p0_cptn by (metis last_length) \n have n_z:\"n>0\" using redex_call_cptn_mod_min_nest_call_gr_zero[OF Catch(3) Catch(4) Catch(5) True]\n by auto \n from catch2_ass obtain Q' where Q':\"Q=Catch Q' P1 \\ xa=(Q',t)\" \n unfolding lift_catch_def using Cons\n proof -\n assume a1: \"\\Q'. Q = Catch Q' P1 \\ xa = (Q', t) \\ thesis\"\n have \"(Catch (fst xa) P1, snd xa) = ((Q, t) # cfg1) ! 0\"\n using catch2_ass unfolding lift_catch_def\n by (simp add: Cons case_prod_unfold)\n then show ?thesis\n using a1 by fastforce\n qed \n have big_call:\"biggest_nest_call P0 s ((Q',t)#xsa) \\ n\"\n proof-\n have \"\\(\\xs. min_call n \\ ((P0, s)#xs) \\ (Q, t) # cfg1 = map (lift_catch P1) xs)\"\n using min_call catch2_ass Cons\n proof -\n have \"min_call n \\ ((Catch P0 P1, s) # (Q, t) # cfg1)\"\n using Catch.prems(1) Catch.prems(2) by blast\n then show ?thesis\n by (metis (no_types) Catch_P_Not_finish append_Nil2 list.simps(3) \n same_append_eq catch catch2_ass)\n qed\n moreover have \"(\\xs ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys)\"\n using catch2_ass p0_cptn unfolding cond_catch_1_def last_length\n by metis\n moreover have \"(SOME xs. \\ys. cond_catch_1 n \\ P0 s xs P1 ((Q, t) # cfg1) ys) = xs\"\n proof -\n let ?P = \"\\xsa. \\ys. (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\ \n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xsa @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xsa))) # ys\"\n have \"\\xsa. \\ys. (n, \\,(P0, s)#xsa) \\ cptn_mod_nest_call \\ \n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xsa))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xsa @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xsa))) # ys \\\n xsa = xs\"\n using Catch_P_Ends_Skip catch catch2_ass map_lift_catch_some_eq by fastforce \n moreover have \"\\ys. (n, \\,(P0, s)#xs) \\ cptn_mod_nest_call \\\n fst (last ((P0, s) # xs)) = LanguageCon.com.Skip \\\n (n, \\, (LanguageCon.com.Skip, \n snd (last ((P0, s) # xs))) # ys) \\ cptn_mod_nest_call \\\n (Q, t) # cfg1 = map (lift_catch P1) xs @ \n (LanguageCon.com.Skip, snd (last ((P0, s) # xs))) # ys\" \n using ass p0_cptn by (simp add: last_length) \n ultimately show ?thesis using some_equality[of ?P xs]\n unfolding cond_catch_1_def by blast \n qed \n ultimately have \"biggest_nest_call P0 s xs \\ n\"\n using Catch(6) \n biggest_nest_call.simps(2)[of P0 P1 s \"(Q, t) # cfg1\" \\ n]\n by presburger\n then show ?thesis using Cons Q' by auto\n qed \n have min_call:\"min_call n \\ ((Q',t)#xsa)\" \n using Catch(1)[OF min_call _ _ big_call] Catch(5) Cons Q' by fastforce \n then have p1_n_cptn:\"(n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using Catch.prems(1) Catch.prems(2) elim_cptn_mod_nest_call_n min_call_def by blast \n also then have \"(\\m, (Q, t) # cfg1) \\ cptn_mod_nest_call)\" \n proof-\n { fix m\n assume ass:\"m, (Q, t) # cfg1) \\ cptn_mod_nest_call\" \n then obtain xsa' s1 s1' where \n p0_cptn:\"(m, \\,(Q', t)#xsa') \\ cptn_mod_nest_call\" and\n seq:\"catch_cond_nest cfg1 P1 xsa' Q' t s1 s1' \\ m\"\n using div_catch_nest[of m \\ \"(Q, t) # cfg1\"] Q' t_eq by blast\n then have \"xsa=xsa'\" \n using catch2_ass \n Catch_P_Ends_Skip[of cfg1 P1 xsa Q' t ys xsa' s1 s1'] \n Cons Q' Q_m \n by (simp add: last_length) \n then have False using min_call p0_cptn ass unfolding min_call_def by auto \n } \n } then show ?thesis by auto qed \n ultimately show ?thesis unfolding min_call_def by auto\n qed\n next\n case False \n then have env:\"\\\\\\<^sub>c(Catch P0 P1, s) \\\\<^sub>e (Q,t)\" using Catch\n by (meson elim_cptn_mod_nest_step_c min_call_def)\n moreover then have Q:\"Q=Catch P0 P1\" using env_c_c' by blast \n ultimately show ?thesis using Catch\n proof -\n obtain nn :: \"(('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ ('a \\ ('b, 'a, 'c,'d) LanguageCon.com option) \\ nat \\ nat\" where\n f1: \"\\x0 x1 x2. (\\v3 cptn_mod_nest_call) = (nn x0 x1 x2 < x2 \\ (nn x0 x1 x2, x1, x0) \\ cptn_mod_nest_call)\"\n by moura\n have f2: \"(n, \\, (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call \\ (\\n. \\ n < n \\ (n, \\, (LanguageCon.com.Catch P0 P1, s) # (Q, t) # cfg1) \\ cptn_mod_nest_call)\"\n using local.Catch(3) local.Catch(4) min_call_def by blast\n then have \"\\ nn ((Q, t) # cfg1) \\ n < n \\ (nn ((Q, t) # cfg1) \\ n, \\, (Q, t) # cfg1) \\ cptn_mod_nest_call\"\n using False env env_c_c' not_func_redex_cptn_mod_nest_n_env \n by (metis Catch.prems(1) Catch.prems(2) min_call_def)\n then show ?thesis\n using f2 f1 by (meson elim_cptn_mod_nest_call_n min_call_def)\n qed\n qed \n }\n thus ?thesis using l ass by fastforce\n qed \nqed (fastforce)+\n\n\nlemma cptn_mod_nest_n_1:\n assumes a0:\"(n,\\,cfs) \\ cptn_mod_nest_call\" and\n a1:\"cfs=(p,s)#cfs'\" and\n a2:\"\\ (min_call n \\ cfs)\"\n shows \"(n-1,\\,cfs) \\ cptn_mod_nest_call\"\nusing a0 a1 a2 \nby (metis (no_types, lifting) Suc_diff_1 Suc_leI cptn_mod_nest_mono less_nat_zero_code min_call_def not_less)\n\nlemma cptn_mod_nest_tl_n_1:\n assumes a0:\"(n,\\,cfs) \\ cptn_mod_nest_call\" and\n a1:\"cfs=(p,s)#(q,t)#cfs'\" and\n a2:\"\\ (min_call n \\ cfs)\"\n shows \"(n-1,\\,(q,t)#cfs') \\ cptn_mod_nest_call\"\n using a0 a1 a2\nby (meson elim_cptn_mod_nest_call_n cptn_mod_nest_n_1) \n\nlemma cptn_mod_nest_tl_not_min:\n assumes a0:\"(n,\\,cfg) \\ cptn_mod_nest_call\" and\n a1:\"cfg=(p,s)#cfg'\" and\n a2:\"\\ (min_call n \\ cfg)\"\n shows \"\\ (min_call n \\ cfg')\"\nproof (cases cfg')\n case Nil \n have \"(\\, []) \\ cptn\"\n using cptn.simps by auto\n then show ?thesis unfolding min_call_def\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod local.Nil by blast \nnext\n case (Cons xa cfga)\n then obtain q t where \"xa = (q,t)\" by fastforce\n then have \"(n-1,\\,cfg') \\ cptn_mod_nest_call\"\n using a0 a1 a2 cptn_mod_nest_tl_n_1 Cons by fastforce\n also then have \"(n,\\,cfg') \\ cptn_mod_nest_call\"\n using cptn_mod_nest_mono Nat.diff_le_self by blast\n ultimately show ?thesis unfolding min_call_def\n using a0 a2 min_call_def by force \nqed\n \n \n\ndefinition cpn :: \"nat \\ ('s,'p,'f,'e) body \\ ('s,'p,'f,'e) com \\ \n ('s,'f) xstate \\ (('s,'p,'f,'e) confs) set\" \nwhere\n \"cpn n \\ P s \\ {(\\1,l). l!0=(P,s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\1=\\}\"\n\n\nlemma cptn_mod_same_n:\n assumes a0:\"(\\,cfs)\\ cptn_mod\" \n shows \"\\n. (n,\\,cfs) \\ cptn_mod_nest_call\"\nproof -\n show ?thesis using cptn_mod_nest_mono cptn_mod_cptn_mod_nest\n by (metis a0 cptn_mod_nest_mono2 leI)\nqed\n\nlemma cptn_mod_same_n1:\n assumes a0:\"(\\,cfs)\\ cptn_mod\" and \n a1:\"(\\,cfs1)\\ cptn_mod\"\n shows \"\\n. (n,\\,cfs) \\ cptn_mod_nest_call \\ (n,\\,cfs1) \\ cptn_mod_nest_call\"\nproof -\n show ?thesis using cptn_mod_nest_mono cptn_mod_cptn_mod_nest\n by (metis a0 a1 cptn_mod_nest_mono2 leI)\nqed\n\n\nlemma dropcptn_is_cptn1 [rule_format,elim!]:\n \"\\j,c) \\ cptn_mod_nest_call \\ (n,\\, drop j c) \\ cptn_mod_nest_call\"\nproof -\n {fix j\n assume \"j (n,\\,c) \\ cptn_mod_nest_call\"\n then have \"(n,\\, drop j c) \\ cptn_mod_nest_call\" \n proof(induction j arbitrary: c)\n case 0 then show ?case by auto\n next\n case (Suc j) \n then obtain a b c' where \"c=a#b#c'\"\n by (metis Cons_nth_drop_Suc Suc_lessE drop_0 less_trans_Suc zero_less_Suc)\n then also have \"j, drop j (b # c')) \\ cptn_mod_nest_call\" using elim_cptn_mod_nest_call_n[of n \\ c] Suc\n by (metis surj_pair) \n ultimately show ?case by auto \n qed\n } thus ?thesis by auto \nqed\n\n \n\nsubsection \\Compositionality of the Semantics\\\n\nsubsubsection \\Definition of the conjoin operator\\\n\ndefinition same_length :: \"('s,'p,'f,'e) par_confs \\ (('s,'p,'f,'e) confs) list \\ bool\" where\n \"same_length c clist \\ (\\ix. snd x) clist\"\n shows \"(\\i (('s,'p,'f,'e) confs) list \\ bool\" where\n \"same_state c clist \\ (\\i jx. snd x) clist\"\n shows \"(\\i j (('s,'p,'f,'e) confs) list \\ bool\" where\n \"same_program c clist \\ (\\jx. fst(nth (snd x) j)) clist)\"\n\nlemma same_program_non_pair:\n assumes a1:\"same_program c clist \" and\n a2:\"clist'=map (\\x. snd x) clist\"\n shows \"(\\jx. fst(nth x j)) clist')\"\nusing a1 a2 by (auto simp add: same_program_def)\n\ndefinition same_functions :: \"('s,'p,'f,'e) par_confs \\ (('s,'p,'f,'e) confs) list \\ bool\" where\n \"same_functions c clist \\ \\i (('s,'p,'f,'e) confs) list \\ bool\" where\n \"compat_label c clist \\ \n (\\j. Suc j \n ( ((fst c)\\\\<^sub>p((snd c)!j) \\ ((snd c)!(Suc j))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)) ))) \\ \n ((fst c)\\\\<^sub>p((snd c)!j) \\\\<^sub>e ((snd c)!(Suc j)) \\ \n (\\i\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j)) )))\"\n\nlemma compat_label_tran_0:\n assumes assm1:\"compat_label c clist \\ length (snd c) > Suc 0\" \n shows \"((fst c)\\\\<^sub>p((snd c)!0) \\ ((snd c)!(Suc 0))) \\ \n ((fst c)\\\\<^sub>p((snd c)!0) \\\\<^sub>e ((snd c)!(Suc 0)))\" \n using assm1 unfolding compat_label_def\n by blast\n \n \ndefinition conjoin :: \"(('s,'p,'f,'e) par_confs) \\ (('s,'p,'f,'e) confs) list \\ bool\" (\"_ \\ _\" [65,65] 64) where\n \"c \\ clist \\ (same_length c clist) \\ (same_state c clist) \\ (same_program c clist) \\ \n (compat_label c clist) \\ (same_functions c clist)\"\n\n\nlemma conjoin_same_length: \n \"c \\ clist \\ \\i < length (snd c). length (fst ((snd c)!i)) = length clist\"\nproof (auto)\n fix i\n assume a1:\"c \\ clist\"\n assume a2:\"i < length (snd c)\"\n then have \"(\\jx. fst(nth (snd x) j)) clist)\"\n using a1 unfolding conjoin_def same_program_def by auto\n thus \"length (fst (snd c ! i)) = length clist\" by (simp add: a2)\nqed\n\nlemma \"c \\ clist \\\n i< length (snd c) \\ j < length (snd c) \\ \n length (fst ((snd c)!i)) = length (fst ((snd c)!j))\"\nusing conjoin_same_length by fastforce\n\nlemma conjoin_same_length_i_suci:\"c \\ clist \\\n Suc i< length (snd c) \\\n length (fst ((snd c)!i)) = length (fst ((snd c)!(Suc i)))\"\nusing conjoin_same_length by fastforce\n\nlemma conjoin_same_program_i:\n \"c \\ clist \\\n j < length (snd c) \\\n i < length clist \\\n fst ((snd (clist!i))!j) = (fst ((snd c)!j))!i\"\nproof -\n assume a0:\"c \\ clist\" and\n a1:\"j < length (snd c)\" and\n a2:\"i < length clist\"\n have \"length (fst ((snd c)!j)) = length clist\"\n using conjoin_same_length a0 a1 by fastforce\n also have \"fst (snd c ! j) = map (\\x. fst (snd x ! j)) clist\"\n using a0 a1 unfolding conjoin_def same_program_def by fastforce\n ultimately show ?thesis using a2 by fastforce\nqed\n\nlemma conjoin_same_program_i_j:\n \"c \\ clist \\\n Suc j < length (snd c) \\\n \\l< length clist. fst ((snd (clist!l))!j) = fst ((snd (clist!l))!(Suc j)) \\\n fst ((snd c)!j) = (fst ((snd c)!(Suc j)))\"\nproof -\n assume a0:\"c \\ clist\" and\n a1:\"Suc j < length (snd c)\" and\n a2:\"\\l< length clist. fst ((snd (clist!l))!j) = fst ((snd (clist!l))!(Suc j))\"\n have \"length (fst ((snd c)!j)) = length clist\"\n using conjoin_same_length a0 a1 by fastforce\n then have \"map (\\x. fst (snd x ! j)) clist = map (\\x. fst (snd x ! (Suc j))) clist\"\n using a2 by (metis (no_types, lifting) in_set_conv_nth map_eq_conv) \n moreover have \"fst (snd c ! j) = map (\\x. fst (snd x ! j)) clist\"\n using a0 a1 unfolding conjoin_def same_program_def by fastforce\n moreover have \"fst (snd c ! Suc j) = map (\\x. fst (snd x ! Suc j)) clist\"\n using a0 a1 unfolding conjoin_def same_program_def by fastforce\n ultimately show ?thesis by fastforce\nqed\n\nlemma conjoin_last_same_state:\n assumes a0: \"(\\,l)\\ clist\" and\n a1: \"i < length clist\" and\n a2: \"(snd (clist!i))\\[]\"\n shows \"snd (last (snd (clist!i))) = snd (last l)\"\nproof -\n have \"length l = length (snd (clist!i))\" \n using a0 a1 unfolding conjoin_def same_length_def by fastforce\n also then have length_l:\"length l \\0\" using a2 by fastforce\n ultimately have \"last (snd (clist!i)) = (snd (clist!i))!((length l)-1)\" \n using a1 a2 \n by (simp add: last_conv_nth)\n thus ?thesis using length_l a0 a1 unfolding conjoin_def same_state_def\n by (simp add: a2 last_conv_nth ) \nqed\n\nlemma list_eq_if [rule_format]: \n \"\\ys. xs=ys \\ (length xs = length ys) \\ (\\i (\\i ys!0=a; ys\\[] \\ \\ ys=(a#(tl ys))\"\n by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\[] \\ ys!0=a \\ P ys \\ P (a#(tl ys))\"\n by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) \\ P ys\"\n by (induct ys) simp_all\n\nlemma nth_tl_eq [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) = P ys\"\n by (induct ys) simp_all\n\nlemma nth_tl_pair: \"\\p=(u,ys); ys!0=a; ys\\[] \\ \\ p=(u,(a#(tl ys)))\"\nby (simp add: SmallStepCon.nth_tl)\n\nlemma nth_tl_eq_Pair [rule_format]: \"p=(u,ys) \\ ys\\[] \\ ys!0=a \\ P ((u,a#(tl ys))) = P (u,ys)\"\n by (induct ys) simp_all\n\n\n\nlemma tl_in_cptn: \"\\ (g,a#xs) \\cptn; xs\\[] \\ \\ (g,xs)\\cptn\"\n by (force elim: cptn.cases)\n\n\nlemma tl_zero[rule_format]: \n \" Suc j P (ys!Suc j) \\ P (tl(ys)!j)\"\n by (simp add: List.nth_tl)\n\nlemma tl_zero1[rule_format]:\n \"Suc jP (tl(ys)!j) \\P (ys!Suc j)\"\n by (simp add: List.nth_tl)\n\nlemma tl_zero_eq [rule_format]:\n \"Suc j (P (tl(ys)!j) = P (ys!Suc j))\"\nby (simp add: List.nth_tl)\n\nlemma tl_zero_eq' :\n \"\\j. Suc j (P (tl(ys)!j) = P (ys!Suc j))\"\nusing tl_zero_eq by blast\n\nlemma tl_zero_pair:\"i < length ys \\ length ys = length zs \\\n Suc j < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!j)\" \n by (simp add: tl_zero_eq)\n\n\nlemma tl_zero_pair':\"\\i < length ys. length ys = length zs \\\n Suc j < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n (P ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!j))\" \nusing tl_zero_pair by blast\n\nlemma tl_zero_pair2:\"i < length ys \\ length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc (Suc j))) ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!(Suc j)) ((snd (zs!i))!j)\" \n by (simp add: tl_zero_eq)\n\nlemma tl_zero_pair2':\"\\i < length ys. length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc (Suc j))) ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!(Suc j)) ((snd (zs!i))!j)\" \nusing tl_zero_pair2 by blast\n\nlemma tl_zero_pair21:\"\\i < length ys. length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc j)) ((snd (ys!i))!(Suc (Suc j)))=\n P ((snd (zs!i))!j) ((snd (zs!i))!(Suc j)) \"\nby (metis SmallStepCon.nth_tl list.size(3) not_less0 nth_Cons_Suc) \n\nlemma tl_pair:\"Suc (Suc j) < length l \\ \n l1 = tl l \\\n P (l!(Suc (Suc j))) (l!(Suc j)) =\n P (l1!(Suc j)) (l1!j)\"\nby (simp add: tl_zero_eq)\n\nlemma list_as_map: \n assumes \n a1:\"length clist > 0\" and \n a2: \"xs = (map (\\x. fst (hd x)) clist)\" and\n a3: \"ys = (map (\\x. tl x) clist)\" and\n a4: \"\\i< length clist. length (clist!i) > 0\" and \n a5: \"\\i < length clist. \\j< length clist. \\ki < length clist. \\j< length clist. \n length (clist!i) = length (clist!j)\" \n shows \"clist = map (\\i. (fst i,snd ((clist!0)!0))#snd i) (zip xs ys)\"\nproof-\n let ?clist'= \"map (\\i. (fst i,snd ((clist!0)!0))#snd i) (zip xs ys)\"\n have lens:\"length clist = length ?clist'\" using a2 a3 by auto \n have \"(\\ii. (fst i,snd ((clist!0)!0))#snd i) ((zip xs ys)!i) = clist !i\" \n proof -\n have f1: \"length xs = length clist\"\n using a2 length_map by blast\n have \"\\ (0::nat) < 0\"\n by (meson less_not_refl)\n thus ?thesis\n using f1 by (metis (lifting) a11 a3 a4 \n fst_conv length_map list.exhaust_sel \n list.size(3) nth_zip prod.collapse \n snd_conv snd_zero xs_clist ys_clist)\n qed \n then have \"clist ! i = ?clist' ! i\" using lens a11 by force\n } \n thus ?thesis by auto \n qed\n thus ?thesis using lens list_eq by blast\nqed\n\nlemma list_as_map': \n assumes \n a1:\"length clist > 0\" and \n a2: \"xs = (map (\\x. hd x) clist)\" and\n a3: \"ys = (map (\\x. tl x) clist)\" and\n a4: \"\\i< length clist. length (clist!i) > 0\"\n shows \"clist = map (\\i. (fst i)#snd i) (zip xs ys)\"\nproof-\n let ?clist'= \"map (\\i.(fst i)#snd i) (zip xs ys)\"\n have lens:\"length clist = length ?clist'\" using a2 a3 by auto \n have \"(\\ii. fst i#snd i) ((zip xs ys)!i) = clist !i\" \n using xs_clist ys_clist a11 a2 a3 a4 by fastforce \n then have \"clist ! i = ?clist' ! i\" using lens a11 by force\n } \n thus ?thesis by auto \n qed\n thus ?thesis using lens list_eq by blast\nqed\n\n\nlemma conjoin_tl: \n assumes \n a1: \"(\\,x#xs) \\ ys\" and\n a2:\"zs = map (\\i. (fst i, tl (snd i))) ys\" \n shows \"(\\,xs) \\ zs\"\nproof -\n have s_p:\"same_program (\\,x#xs) ys\" using a1 unfolding conjoin_def by simp\n have s_l:\"same_length (\\,x#xs) ys\" using a1 unfolding conjoin_def by simp\n have \"\\i,xs) zs\" using a1 a2 unfolding conjoin_def \n by (simp add: same_length_def)\n } moreover note same_len = this\n { \n {\n fix j\n assume a11:\"j, xs))\" \n then have fst_suc:\"fst (snd (\\, xs) ! j) = fst(snd (\\,x#xs)! Suc j)\"\n by auto \n then have \"fst (snd (\\, xs) ! j) = map (\\x. fst (snd x ! j)) zs\" \n proof -\n have s_l_y_z:\"length ys = length zs\" using a2 by fastforce\n have Suc_j_l_ys:\"\\i < length ys. Suc j < length (snd (ys!i))\" \n using a11 s_l unfolding same_length_def by fastforce\n have tail: \"\\i < length ys. snd (zs!i) = tl (snd (ys!i))\" using a2 \n by fastforce \n then have l_xs_zs_eq:\"length (fst (snd (\\, xs) ! j)) = length zs\"\n using fst_suc s_l_y_z s_p a11 unfolding same_program_def by auto \n then have \"\\i, x#xs) ! Suc j)!i = fst (snd (ys!i) ! (Suc j))\"\n using s_p a11 unfolding same_program_def by fastforce\n then have \"\\i, x#xs) ! Suc j)!i = fst (snd (zs!i) ! (j))\"\n using Suc_j_l_ys tail s_l_y_z tl_zero_pair by metis\n then have \"\\i, xs) ! j)!i = map (\\x. fst (snd x ! j)) zs!i\"\n using fst_suc by auto\n also have \"length (fst (snd (\\, xs) ! j)) = \n length (map (\\x. fst (snd x ! j)) zs) \" \n using l_xs_zs_eq by auto\n ultimately show ?thesis using l_xs_zs_eq list_eq by metis\n qed \n }\n then have \"same_program (\\,xs) zs\"\n unfolding conjoin_def same_program_def same_length_def \n by blast \n }moreover note same_prog = this\n {\n have \"same_state (\\,xs) zs\" \n using a1 a2 unfolding conjoin_def same_length_def same_state_def\n apply auto\n by (metis (no_types, hide_lams) List.nth_tl Suc_less_eq diff_Suc_1 length_tl nth_Cons_Suc) \n }moreover note same_sta = this\n {\n have \"same_functions (\\,xs) zs\" \n using a1 a2 unfolding conjoin_def\n apply auto\n apply (simp add: same_functions_def) \n done\n }moreover note same_fun = this\n { {\n fix j\n assume a11:\"Suc j, xs))\"\n have s_l_y_z:\"length ys = length zs\" using a2 by fastforce\n have Suc_j_l_ys:\"\\i < length ys. Suc (Suc j) < length (snd (ys!i))\" \n using a11 s_l unfolding same_length_def by fastforce\n have tail: \"\\i < length ys. snd (zs!i) = tl (snd (ys!i))\" using a2 \n by fastforce \n have same_env: \"\\i < length ys. (fst (ys!i)) = \\\"\n using a1 unfolding conjoin_def same_functions_def by auto\n have fst: \"\\x. fst(\\, x) = \\\" by auto\n then have fun_ys_eq_fun_zs: \"\\i < length ys. (fst (ys!i)) = (fst (zs!i))\"\n using same_env s_l_y_z\n proof -\n have \"\\n. \\ n < length ys \\ fst (zs ! n) = fst (ys ! n)\"\n by (simp add: a2)\n thus ?thesis\n by presburger\n qed\n have suc_j:\"Suc (Suc j) < length (snd (\\, x#xs))\" using a11 by auto \n then have or_compat:\"( (\\ \\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\ ((snd (\\, x#xs))!(Suc (Suc j)))) \\ \n (\\i\\<^sub>c ((snd (ys!i))!(Suc j)) \\ ((snd (ys!i))!(Suc (Suc j)))) \\ \n (\\li \\ (fst (ys!l))\\\\<^sub>c (snd (ys!l))!(Suc j) \\\\<^sub>e ((snd (ys!l))!(Suc (Suc j))) ))) \\ \n (\\\\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\\\<^sub>e ((snd (\\, x#xs))!(Suc (Suc j))) \\ \n (\\i\\<^sub>c (snd (ys!i))!(Suc j) \\\\<^sub>e ((snd (ys!i))!(Suc (Suc j)))))\"\n using suc_j a1 same_env unfolding conjoin_def compat_label_def fst by auto\n then have \n \"( (fst (\\, xs) \\\\<^sub>p((snd (\\, xs))!(j)) \\ ((snd (\\,xs))!((Suc j)))) \\ \n (\\i\\<^sub>c ((snd (zs!i))!( j)) \\ ((snd (zs!i))!( (Suc j)))) \\ \n (\\li \\ (fst (zs!l))\\\\<^sub>c (snd (zs!l))!( j) \\\\<^sub>e (( snd (zs!l))!( (Suc j))) )))\\\n ((fst (\\, xs)\\\\<^sub>p((snd (\\, xs))!(j)) \\\\<^sub>e ((snd (\\, xs))!((Suc j))) \\ \n (\\i\\<^sub>c (snd (zs!i))!(j) \\\\<^sub>e ((snd (zs!i))!((Suc j))) )))\"\n proof \n assume a21:\"( (\\ \\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\ ((snd (\\, x#xs))!(Suc (Suc j)))) \\ \n (\\i\\<^sub>c ((snd (ys!i))!(Suc j)) \\ ((snd (ys!i))!(Suc (Suc j)))) \\ \n (\\li \\ (fst (ys!l))\\\\<^sub>c (snd (ys!l))!(Suc j) \\\\<^sub>e ((snd (ys!l))!(Suc (Suc j))) )))\" \n then obtain i where \n f1:\"( (\\ \\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\ ((snd (\\, x#xs))!(Suc (Suc j)))) \\ \n (i \n ((fst (ys!i))\\\\<^sub>c ((snd (ys!i))!(Suc j)) \\ ((snd (ys!i))!(Suc (Suc j)))) \\ \n (\\li \\ (fst (ys!l))\\\\<^sub>c (snd (ys!l))!(Suc j) \\\\<^sub>e ((snd (ys!l))!(Suc (Suc j))) )))\" \n by auto \n then have \"( (\\ \\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\ ((snd (\\, x#xs))!(Suc (Suc j)))) \\ \n (\\i\\<^sub>c ((snd (zs!i))!( j)) \\ ((snd (zs!i))!( (Suc j)))) \\ \n (\\li \\ (fst (ys!l))\\\\<^sub>c (snd (zs!l))!( j) \\\\<^sub>e (( snd (zs!l))!( (Suc j))) )))\"\n proof -\n have f1: \"\\\\\\<^sub>p snd (\\, x # xs) ! Suc j \\ snd (\\, x # xs) ! Suc (Suc j) \\ i < length ys \\ fst (ys ! i)\\\\<^sub>c snd (ys ! i) ! Suc j \\ snd (ys ! i) ! Suc (Suc j) \\ (\\n. (\\ n < length ys \\ n = i) \\ fst (ys ! n)\\\\<^sub>c snd (ys ! n) ! Suc j \\\\<^sub>e snd (ys ! n) ! Suc (Suc j))\"\n using f1 by blast\n have f2: \"j < length (snd (\\, xs))\"\n by (meson Suc_lessD a11)\n have f3: \"\\n. \\ n < length zs \\ length (snd (zs ! n)) = length (snd (\\, xs))\"\n using same_len same_length_def by blast\n have \"\\n. \\ n < length ys \\ snd (zs ! n) = tl (snd (ys ! n))\"\n using tail by blast\n thus ?thesis\n using f3 f2 f1 by (metis (no_types) List.nth_tl a11 s_l_y_z)\n qed \n then have\"( (\\ \\\\<^sub>p((snd (\\, xs))!(j)) \\ ((snd (\\,xs))!((Suc j)))) \\ \n (\\i\\<^sub>c ((snd (zs!i))!( j)) \\ ((snd (zs!i))!( (Suc j)))) \\ \n (\\li \\ (fst (zs!l))\\\\<^sub>c (snd (zs!l))!( j) \\\\<^sub>e (( snd (zs!l))!( (Suc j))) )))\"\n using same_env s_l_y_z fun_ys_eq_fun_zs by force\n then have\"( (fst (\\, xs) \\\\<^sub>p((snd (\\, xs))!(j)) \\ ((snd (\\,xs))!((Suc j)))) \\ \n (\\i\\<^sub>c ((snd (zs!i))!( j)) \\ ((snd (zs!i))!( (Suc j)))) \\ \n (\\li \\ (fst (zs!l))\\\\<^sub>c (snd (zs!l))!( j) \\\\<^sub>e (( snd (zs!l))!( (Suc j))) )))\"\n by auto\n thus ?thesis\n by auto\n next \n assume a22:\n \"(\\\\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\\\<^sub>e ((snd (\\, x#xs))!(Suc (Suc j))) \\ \n (\\i\\<^sub>c (snd (ys!i))!(Suc j) \\\\<^sub>e ((snd (ys!i))!(Suc (Suc j))) ))\"\n then have \n \"(\\\\\\<^sub>p((snd (\\, x#xs))!(Suc j)) \\\\<^sub>e ((snd (\\, x#xs))!(Suc (Suc j))) \\ \n (\\i\\<^sub>c (snd (zs!i))!(j) \\\\<^sub>e ((snd (zs!i))!((Suc j))) ))\"\n using Suc_j_l_ys tail s_l_y_z tl_zero_pair21 by metis\n then have\n \"(\\\\\\<^sub>p((snd (\\, xs))!(j)) \\\\<^sub>e ((snd (\\, xs))!((Suc j))) \\ \n (\\i\\<^sub>c (snd (zs!i))!(j) \\\\<^sub>e ((snd (zs!i))!((Suc j))) ))\"\n using same_env s_l_y_z fun_ys_eq_fun_zs by fastforce\n thus ?thesis by auto \n qed\n }\n then have \"compat_label (\\,xs) zs\"\n using compat_label_def by blast \n } note same_label = this\n ultimately show ?thesis using conjoin_def by auto\nqed\n\n\n\nlemma clist_tail: \n assumes \n a1:\"length xs = length clist\" and\n a2: \"ys = (map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\n shows \"\\i < length ys. tl (snd (ys!i)) = clist!i \"\nusing a1 a2\nproof - \n show ?thesis using a2\n by (simp add: a1) \nqed \n\n\nlemma clist_map: \n assumes \n a1:\"length xs = length clist\" \n shows \"clist = map ((\\p. tl (snd p)) \\ (\\i. (\\, (fst i, s) # snd i))) (zip xs clist)\"\nproof -\n have f1: \"map snd (zip xs clist) = clist\"\n using a1 map_snd_zip by blast\n have \"map snd (zip xs clist) = map ((\\p. tl (snd p)) \\ (\\p. (\\, (fst p, s) # snd p))) (zip xs clist)\"\n by simp\n thus ?thesis\n using f1 by presburger\nqed\n\n\nlemma clist_map1: \n assumes \n a1:\"length xs = length clist\" \n shows \"clist = map (\\p. tl (snd p)) (map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\nproof -\n have \"clist = map ((\\p. tl (snd p)) \\ (\\i. (\\, (fst i, s) # snd i))) (zip xs clist)\" \n using a1 clist_map by fastforce\n thus ?thesis by auto\nqed\n\nlemma clist_map2:\n \"(clist = map (\\p. tl (snd p)) (l::('a \\'b list) list) ) \\\n clist = map (\\p. (snd p)) (map (\\p. (fst p, tl (snd p))) (l::('a \\'b list) list)) \"\nby auto\n\nlemma map_snd:\n assumes a1: \"y = map (\\x. f x) l\"\n shows \"y=(map snd (map (\\x. (g x, f x)) l)) \"\nby (simp add: assms)\n \nlemmas map_snd_sym = map_snd[THEN sym]\n\nlemma map_snd':\n shows \" map (\\x. f x) l=(map snd (map (\\x. (g x, f x)) l)) \"\nby simp\n\nlemma clist_snd:\n assumes a1: \"(\\, a # ys) \\ map (\\x. (fst x, tl (snd x)))\n (map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist))\" and\n a2: \"length clist > 0 \\ length clist = length xs\"\n shows \"clist = (map snd\n (map (\\x. (\\, (fst x, snd (clist ! 0 ! 0)) # snd x))\n (zip (map (\\x. fst (hd x)) clist) (map tl clist))))\"\nproof -\n let ?concat_zip = \"(\\i. (\\, (fst i, s) # snd i))\" \n let ?clist_ext = \"map ?concat_zip (zip xs clist)\"\n let ?exec_run = \"(xs, s) # a # ys\"\n let ?exec = \"(\\,?exec_run)\"\n let ?exec_ext = \"map (\\x. (fst x, tl (snd x))) ?clist_ext\"\n let ?zip = \"(zip (map (\\x. fst (hd x)) clist) \n (map (\\x. tl x) clist))\"\n have \\_all: \"\\i < length ?clist_ext. fst (?clist_ext !i) = \\\"\n by auto \n have len:\"length xs = length clist\" using a2 by auto\n then have len_clist_exec:\n \"length clist = length ?exec_ext\" \n by fastforce \n then have len_clist_exec_map:\n \"length ?exec_ext = \n length (map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)\" \n by fastforce \n then have clist_snd:\"clist = map (\\x. snd x) ?exec_ext\"\n using clist_map1 [of xs clist \\ s] clist_map2 len by blast \n then have clist_len_eq_ays: \n \"\\i < length clist. length( (clist!i))=length (snd (\\,a#ys))\" \n using len same_length_non_pair a1 conjoin_def\n by blast\n then have clist_gz:\"\\i < length clist. length (clist!i) > 0\" \n by fastforce\n have clist_len_eq: \n \"\\i < length clist. \\j < length clist. \n length (clist ! i) = length (clist ! j)\" \n using clist_len_eq_ays by auto \n have clist_same_state: \n \"\\i < length clist. \\j< length clist. \\ki j, a # ys)). snd((snd (\\, a # ys))!j) = snd( (clist!i)!j))\"\n using len clist_snd conjoin_def a1 conjoin_def same_state_non_pair \n by blast\n thus ?thesis using clist_len_eq_ays by (metis (no_types))\n qed \n then have clist_map:\n \"clist = map (\\i. (fst i,snd ((clist!0)!0))#snd i) ?zip\"\n using list_as_map a2 clist_gz clist_len_eq by blast \n moreover have \"map (\\i. (fst i,snd ((clist!0)!0))#snd i) ?zip =\n map snd (map (\\x. (\\, (fst x, snd (clist ! 0 ! 0)) # snd x))\n (zip (map (\\x. fst (hd x)) clist) (map tl clist)))\"\n using map_snd' by auto\n ultimately show ?thesis by auto \nqed\n\nlemma list_as_zip:\n assumes a1: \"(\\, a # ys) \\ map (\\x. (fst x, tl (snd x)))\n (map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist))\" and\n a2: \"length clist > 0 \\ length clist = length xs\"\n shows \" map (\\x. (fst x, tl (snd x)))\n (map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist)) =\n map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n (zip (map (\\x. fst (hd x)) clist) \n (map (\\x. tl x) clist))\"\nproof -\n let ?concat_zip = \"(\\i. (\\, (fst i, s) # snd i))\" \n let ?clist_ext = \"map ?concat_zip (zip xs clist)\"\n let ?exec_run = \"(xs, s) # a # ys\"\n let ?exec = \"(\\,?exec_run)\"\n let ?exec_ext = \"map (\\x. (fst x, tl (snd x))) ?clist_ext\"\n let ?zip = \"(zip (map (\\x. fst (hd x)) clist) \n (map (\\x. tl x) clist))\"\n have \\_all: \"\\i < length ?clist_ext. fst (?clist_ext !i) = \\\"\n by auto \n have len:\"length xs = length clist\" using a2 by auto\n then have len_clist_exec:\n \"length clist = length ?exec_ext\" \n by fastforce \n then have len_clist_exec_map:\n \"length ?exec_ext = \n length (map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)\" \n by fastforce \n then have clist_snd:\"clist = map (\\x. snd x) ?exec_ext\"\n using clist_map1 [of xs clist \\ s] clist_map2 len by blast \n then have clist_len_eq_ays: \n \"\\i < length clist. length( (clist!i))=length (snd (\\,a#ys))\" \n using len same_length_non_pair a1 conjoin_def\n by blast\n then have clist_gz:\"\\i < length clist. length (clist!i) > 0\" \n by fastforce\n have clist_len_eq: \n \"\\i < length clist. \\j < length clist. \n length (clist ! i) = length (clist ! j)\" \n using clist_len_eq_ays by auto \n have clist_same_state: \n \"\\i < length clist. \\j< length clist. \\ki j, a # ys)). snd((snd (\\, a # ys))!j) = snd( (clist!i)!j))\"\n using len clist_snd conjoin_def a1 conjoin_def same_state_non_pair \n by blast\n thus ?thesis using clist_len_eq_ays by (metis (no_types))\n qed \n then have clist_map:\n \"clist = map (\\i. (fst i,snd ((clist!0)!0))#snd i) ?zip\"\n using list_as_map a2 clist_gz clist_len_eq by blast \n then have \"\\i < length clist. \n clist ! i = (fst (?zip!i),snd ((clist!0)!0)) # snd (?zip!i)\"\n using len nth_map length_map by (metis (no_types, lifting))\n then have \n \"\\i < length clist. \n ?exec_ext ! i = (\\, (fst (?zip!i),snd ((clist!0)!0)) # snd (?zip!i))\" \n using \\_all len by fastforce \n moreover have \"\\i < length clist. \n (\\, (fst (?zip!i),snd ((clist!0)!0)) # snd (?zip!i)) = \n (map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)!i\" \n by auto \n ultimately have \n \"\\i < length clist. \n ?exec_ext ! i =(map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)!i\" \n by auto\n then also have \"length clist = length ?exec_ext\" \n using len by fastforce \n ultimately have exec_ext_eq_clist_map:\n \"\\i < length ?exec_ext. \n ?exec_ext ! i =(map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)!i\" \n by presburger\n then moreover have \"length ?exec_ext = \n length (map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) \n ?zip)\" \n using len clist_map by fastforce \n ultimately show ?thesis\n using list_eq by blast \nqed\n\nlemma hd_nth:\n assumes a1:\"i< length l \\ ( length( (l!i)) > 0)\"\n shows \"f (hd (l!i)) = f (nth (l!i) 0)\"\nusing assms hd_conv_nth by fastforce\n\nlemma map_hd_nth:\n assumes a1:\"(\\i 0)\"\n shows \"map (\\x. f (hd x)) l = map (\\x. f (nth (x) 0)) l\"\nproof - \n have \"\\i < length l. (map (\\x. f (hd x)) l)!i = f (nth (l!i) 0)\"\n using hd_nth a1 by auto\n moreover have \"\\i < length l. (map (\\x. f (nth x 0)) l)!i = f (nth (l!i) 0)\"\n using hd_nth a1 by auto\n ultimately have f1:\"\\i < length l. (map (\\x. f (hd x)) l)!i =(map (\\x. f (nth x 0)) l)!i \"\n by auto\n moreover have f2:\"length (map (\\x. f (hd x)) l) = length l\"\n by auto \n moreover have \"length (map (\\x. f (nth x 0)) l) = length l\" by auto\n ultimately show ?thesis using nth_equalityI by metis\nqed\n\nlemma \"i clist!i = (x1,ys) \\ ys = (map (\\x. (fst (hd (snd x)),s)#tl (snd x)) clist)!i \\\n ys = (map (\\x. (fst x, s)#snd x) \n (zip (map (\\x. fst (hd (snd x))) clist) \n (map (\\x. tl (snd x)) clist)))!i\"\nproof (induct ys)\n case Nil thus ?case by auto\nnext\n case (Cons y ys) \n have \"\\n ps f. \\ n < length ps \\ map f ps ! n = (f (ps ! n::'a \\ ('b \\ 'c) list)::('b \\ 'c) list)\"\n by force\n hence \"y # ys = (fst (hd (snd (clist ! i))), s) # tl (snd (clist ! i))\"\n using Cons.prems(1) Cons.prems(3) by presburger\n thus ?case\n using Cons.prems(1) by auto\nqed\n\n \n\nlemma clist_map_zip:\"xs\\[] \\ (\\,(xs,s)#ys) \\ clist \\ \n clist = map (\\i. (\\,(fst i,s)#(snd i))) (zip xs ((map (\\x. tl (snd x))) clist))\"\nproof -\n let ?clist = \"map snd clist\"\n assume a1: \"xs\\[]\"\n assume a2: \"(\\,(xs,s)#ys) \\ clist\"\n then have all_in_clist_not_empty:\"\\i < length ?clist. (?clist!i) \\ []\"\n unfolding conjoin_def same_length_def by auto\n then have hd_clist:\"\\i < length ?clist. hd (?clist!i) = (?clist!i)!0\" \n by (simp add: hd_conv_nth) \n then have all_xs:\"\\i< length ?clist. fst (hd (?clist!i)) = xs!i\"\n using a2 unfolding conjoin_def same_program_def by auto\n \n then have all_s: \"\\i < length ?clist. snd (hd (?clist!i)) = s\"\n using a2 hd_clist unfolding conjoin_def same_state_def by fastforce\n have fst_clist_\\:\"\\i < length clist. fst (clist!i) = \\\"\n using a2 unfolding conjoin_def same_functions_def by auto \n have p2:\"length xs = length clist\" using conjoin_same_length a2\n by fastforce\n \n \n then have \"\\i< length (map (\\x. fst (hd x)) ?clist). \n (map (\\x. fst (hd x)) ?clist)!i = xs!i\"\n using all_xs by auto\n also have \"length (map (\\x. fst (hd x)) ?clist) = length xs\" using p2 by auto\n ultimately have \"(map (\\x. fst (hd x)) ?clist) = xs\"\n using nth_equalityI by metis\n then have xs_clist:\"map (\\x. fst (hd (snd x))) clist = xs\" by auto\n \n have clist_hd_tl:\"\\i < length ?clist. ?clist!i = hd (?clist!i) # (tl (?clist!i))\"\n using all_in_clist_not_empty list.exhaust_sel by blast \n then have \"\\i < length ?clist. ?clist!i =(fst (hd (?clist!i)),snd (hd (?clist!i)))# (tl (?clist!i))\"\n by auto\n then have \"?clist = map (\\x. (fst (hd x),snd (hd x))#tl x) ?clist\" \n using length_map list_eq_iff_nth_eq list_update_id map_update nth_list_update_eq\n by (metis (no_types, lifting) length_map list_eq_iff_nth_eq list_update_id map_update nth_list_update_eq)\n then have \"?clist = map (\\x. (fst (hd x),s)#tl x) ?clist\"\n using all_s length_map nth_equalityI nth_map\n by (metis (no_types, lifting) ) \n then have map_clist:\"map (\\x. (fst (hd (snd x)),s)#tl (snd x)) clist = ?clist\" \n by auto \n then have \"(map (\\x. (fst x, s)#snd x) \n (zip (map (\\x. fst (hd (snd x))) clist) \n (map (\\x. tl (snd x)) clist))) = ?clist\" \n using map_clist by (auto intro: nth_equalityI) \n then have \"\\i,(map (\\x. (fst x, s)#snd x) \n (zip xs \n (map (\\x. tl (snd x)) clist)))!i)\" \n using xs_clist fst_clist_\\ by auto \n also have \"length clist = length (map (\\i. (\\,(fst i,s)#(snd i))) (zip xs ((map (\\x. tl (snd x))) clist)))\" \n using p2 by auto\n ultimately show \"clist = map (\\i. (\\,(fst i,s)#(snd i))) (zip xs ((map (\\x. tl (snd x))) clist))\" \n using length_map length_zip nth_equalityI nth_map \n by (metis (no_types, lifting)) \nqed\n \nlemma aux_if' : \n assumes a:\"length clist > 0 \\ length clist = length xs \\ \n (\\i,(xs!i,s)#clist!i) \\ cptn) \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\n shows \"(\\,(xs, s)#ys) \\ par_cptn\"\nusing a\nproof (induct ys arbitrary: xs s clist) \n case Nil then show ?case by (simp add: par_cptn.ParCptnOne)\nnext\n case (Cons a ys xs s clist) \n let ?concat_zip = \"(\\i. (\\, (fst i, s) # snd i))\" \n let ?com_clist_xs = \"map ?concat_zip (zip xs clist)\"\n let ?xs_a_ys_run = \"(xs, s) # a # ys\"\n let ?xs_a_ys_run_exec = \"(\\,?xs_a_ys_run)\"\n let ?com_clist' = \"map (\\x. (fst x, tl (snd x))) ?com_clist_xs\"\n let ?xs' = \"(map (\\x. fst (hd x)) clist)\" \n let ?clist' = \"(map (\\x. tl x) clist)\"\n let ?zip_xs'_clist' = \"zip ?xs' \n ?clist'\" \n obtain as sa where a_pair:\"a=(as,sa)\" by fastforce\n let ?comp_clist'_alt = \"map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) ?zip_xs'_clist' \"\n let ?clist'_alt = \"map (\\x. snd x) ?comp_clist'_alt\"\n let ?comp_a_ys = \"(\\, (as,sa) # ys)\" \n have conjoin_hyp1:\n \"(\\, (as,sa) # ys) \\ ?com_clist'\"\n using conjoin_tl using a_pair Cons by blast \n then have conjoin_hyp:\n \"(\\, (as,sa) # ys) \\ map (\\x. (\\, (fst x,snd ((clist!0)!0))#snd x)) ?zip_xs'_clist'\"\n using list_as_zip Cons.prems by fastforce \n have len:\"length xs = length clist\" using Cons by auto \n have clist_snd_map:\n \"(map snd\n (map (\\x. (\\, (fst x, snd (clist ! 0 ! 0)) # snd x))\n (zip (map (\\x. fst (hd x)) clist) (map tl clist)))) = clist\"\n using clist_snd Cons.prems conjoin_hyp1 by fastforce\n have eq_len_clist_clist':\n \"length ?clist' > 0\" using Cons.prems by auto \n have \"(\\i jii 0)\"\n using clist_snd_map conjoin_hyp conjoin_def same_length_non_pair[of ?comp_a_ys ?comp_clist'_alt ?clist'_alt]\n by fastforce \n ultimately have all_i_sa_hd_clist:\"\\i sa = snd ((clist!0)!0)\" \n proof - \n have \"(\\jx. fst(nth x j)) ?clist'_alt)\" \n using conjoin_hyp conjoin_def same_program_non_pair[of ?comp_a_ys ?comp_clist'_alt ?clist'_alt]\n by fast\n then have are_eq:\"fst((snd ?comp_a_ys)!0) = \n map (\\x. fst(nth x 0)) ?clist'_alt\" by fastforce\n have fst_exec_is_as:\"fst((snd ?comp_a_ys)!0) =as\" by auto \n then have \"map (\\x. fst(hd x)) clist=map (\\x. fst(x!0)) clist\"\n using map_hd_nth clist_i_grz by auto \n then have \"map (\\x. fst(nth x 0)) ?clist'_alt =?xs'\" using clist_snd_map map_hd_nth\n by fastforce\n moreover have \"(\\i j, (as,sa) # ys) \\ map (\\x. (\\, (fst x,sa)#snd x))\n (zip as (map tl clist))\"\n using conjoin_hyp by auto\n then have eq_len_as_clist':\n \"length as = length ?clist'\" using Cons.prems as_sa_eq_xs'_s' by auto\n then have len_as_ys_eq:\"length as = length xs\" using Cons.prems by auto\n have \" (\\i, ((as!i),sa)#(map (\\x. tl x) clist)!i) \\ cptn)\" \n using Cons.prems cptn_dest clist_snd_map len \n proof - \n have \"\\ii, (xs ! i, s) # (hd (clist!i))#(tl (clist!i))) \\ cptn)\"\n using Cons.prems by auto\n then have f1:\"(\\i, (hd (clist!i))#(tl (clist!i))) \\ cptn)\"\n by (metis list.distinct(2) tl_in_cptn) \n then have \"(\\i, ((as!i),sa)#(tl (clist!i))) \\ cptn)\"\n using as_sa_eq_xs'_s' all_i_sa_hd_clist by auto \n then have \"(\\i, ((as!i),sa)#(map (\\x. tl x) clist)!i) \\ cptn)\"\n by auto\n thus ?thesis using len clist_i_grz len_as_ys_eq by auto\n qed\n then have a_ys_par_cptn:\"(\\, (as, sa) # ys) \\ par_cptn\" \n using \n conjoin_hyp eq_len_clist_clist' eq_len_as_clist'[THEN sym] Cons.hyps\n by blast \n have \\_all: \"\\i < length ?com_clist_xs. fst (?com_clist_xs !i) = \\\"\n by auto\n have Gamma: \"\\= (fst ?xs_a_ys_run_exec)\" by fastforce \n have exec: \"?xs_a_ys_run = (snd ?xs_a_ys_run_exec)\" by fastforce \n have split_par:\n \"\\\\\\<^sub>p ((xs, s) # a # ys) ! 0 \\ ((a # ys) ! 0) \\\n \\\\\\<^sub>p ((xs, s) # a # ys) ! 0 \\\\<^sub>e ((a # ys) ! 0)\" \n using compat_label_def compat_label_tran_0\n Cons.prems Gamma exec \n compat_label_tran_0[of \"(\\, (xs, s) # a # ys)\" \n \"(map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist))\"] \n unfolding conjoin_def by auto \n {\n assume \"\\\\\\<^sub>p ((xs, s) # a # ys) ! 0 \\ ((a # ys) ! 0)\" \n then have \" (\\, (xs, s) # a # ys) \\ par_cptn\" \n using a_ys_par_cptn a_pair par_cptn.ParCptnComp by fastforce\n } note env_sol=this\n {\n assume \" \\\\\\<^sub>p ((xs, s) # a # ys) ! 0 \\\\<^sub>e ((a # ys) ! 0)\" \n then have env_tran:\" \\\\\\<^sub>p (xs, s) \\\\<^sub>e (as,sa)\" using a_pair by auto\n have \"xs = as\"\n by (meson env_pe_c_c'_false env_tran)\n then have \" (\\, (xs, s) # a # ys) \\ par_cptn\" \n using a_ys_par_cptn a_pair env_tran ParCptnEnv by blast\n }\n then show \"(\\, (xs, s) # a # ys) \\ par_cptn\" using env_sol Cons split_par by fastforce\nqed\n\nlemma mapzip_upd:\" length as = length clist \\\n (map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)\"\nproof - \n assume a2: \"length as = length clist\" \n have \"\\i < length (map (\\j. (as ! j, sa) # clist ! j) [0..j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)!i\" \n using a2\n by auto\n moreover have \"length (map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist))\"\n using a2 by auto \n ultimately have \"(map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)\"\n using nth_equalityI by blast\n thus \"map (\\j. (as ! j, sa) # clist ! j) [0..j. (fst j, sa) # snd j) (zip as clist) \"\n by auto\nqed\n\nlemma aux_if : \n assumes a:\" length clist = length xs \\ \n (\\i,(xs!i,s)#clist!i) \\ cptn) \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\n shows \"(\\,(xs, s)#ys) \\ par_cptn\"\nusing a\nproof (cases \"length clist\")\n case 0 \n then have clist_empty:\"clist = []\" by auto\n then have map_clist_empty:\"map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist) = []\"\n by fastforce\n then have conjoin:\"(\\,(xs, s)#ys) \\ []\" using a by auto \n then have all_eq:\"\\j,(xs, s)#ys)). fst (snd (\\,(xs, s)#ys) ! j) = []\"\n using conjoin_def same_program_def\n by (simp add: conjoin_def same_program_def)\n from conjoin \n show ?thesis using conjoin\n proof (induct ys arbitrary: s xs) \n case Nil then show ?case by (simp add: par_cptn.ParCptnOne)\n next\n case (Cons a ys) \n then have conjoin_ind:\"(\\, (xs, s) # a # ys) \\ []\" by auto\n then have \"(\\,(a # ys)) \\ []\" \n by (auto simp add:conjoin_def same_length_def \n same_state_def same_program_def same_functions_def\n compat_label_def)\n moreover obtain as sa where pair_a: \"a=(as,sa)\" using Cons by fastforce\n ultimately have ays_par_cptn:\"(\\, a # ys) \\ par_cptn\" using Cons.hyps by auto\n have \"\\j. Suc j,(xs, s)#(as,sa)#ys)) \\ \n \\(\\i\\<^sub>c ((snd ([]!i))!j) \\ ((snd ([]!i))!(Suc j))))\"\n using conjoin_def compat_label_def by fastforce\n then have \"(\\j. Suc j,(xs, s)#(as,sa)#ys)) \\ \n ((fst (\\,(xs, s)#(as,sa)#ys))\\\\<^sub>p((snd (\\,(xs, s)#(as,sa)#ys))!j) \\\\<^sub>e ((snd (\\,(xs, s)#(as,sa)#ys))!(Suc j))))\"\n using conjoin_def compat_label_def conjoin_ind pair_a by blast\n then have env_tran:\"\\\\\\<^sub>p (xs, s) \\\\<^sub>e (as,sa)\" by auto \n then show \" (\\, (xs, s) # a # ys) \\ par_cptn\" \n using ays_par_cptn pair_a env_tran ParCptnEnv env_pe_c_c'_false by blast\n qed\nnext\n case Suc\n then have \"length clist > 0\" by auto\n then show ?thesis using a aux_if' by blast\nqed\n\nlemma snormal_enviroment:\"s = Normal nsa \\ s = sa \\ (\\sa. s \\ Normal sa) \\\n \\\\\\<^sub>c (x, s) \\\\<^sub>e (x, sa)\"\nby (metis Env Env_n)\n\nlemma aux_onlyif [rule_format]: \"\\xs s. (\\,(xs, s)#ys) \\ par_cptn \\ \n (\\clist. (length clist = length xs) \\ \n (\\, (xs, s)#ys) \\ map (\\i. (\\, (fst i,s)#(snd i))) (zip xs clist) \\ \n (\\i, (xs!i,s)#(clist!i)) \\ cptn))\"\nproof (induct ys) \n case Nil \n {fix xs s\n assume \"(\\, [(xs, s)]) \\ par_cptn\"\n have f1:\"length (map (\\i. []) [0.., [(xs, s)]) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs (map (\\i. []) [0..i, (xs ! i, s) # (map (\\i. []) [0.. cptn)\"\n by (simp add: cptn.CptnOne)\n note this = conjI[OF h f3]\n }\n thus ?case by blast\nnext\n case (Cons a ys) \n {fix xs s\n assume a1:\"(\\, (xs, s) # a # ys) \\ par_cptn\"\n then obtain as sa where a_pair: \"a=(as,sa)\" by fastforce\n then have par_cptn':\"(\\,( (as,sa)#ys)) \\ par_cptn\"\n using a1 par_cptn_dest by blast \n then obtain clist where hyp: \"\n length clist = length as \\\n (\\, (as, sa) #\n ys) \\ map (\\i. (\\, (fst i, sa) # snd i)) (zip as clist) \\\n (\\i, (as ! i, sa) # clist ! i) \\ cptn)\"\n using Cons.hyps by fastforce\n have a11:\"(\\, (xs, s) # (as,sa) # ys) \\ par_cptn\" using a1 a_pair by auto\n have par_cptn_dest:\"\\\\\\<^sub>p (xs, s) \\\\<^sub>e (as, sa) \\ \\\\\\<^sub>p (xs, s) \\ (as, sa)\"\n using par_cptn_elim_cases par_cptn' a1 a_pair by blast \n {\n assume a1: \"\\\\\\<^sub>p (xs, s) \\\\<^sub>e (as, sa)\" \n then have xs_as_eq:\"xs=as\" by (meson env_pe_c_c'_false)\n then have ce:\"\\i < length xs. \\\\\\<^sub>c (xs!i, s) \\\\<^sub>e (as!i, sa)\" using a1 pe_ce by fastforce\n let ?clist=\"(map (\\j. (xs!j, sa)#(clist!j)) [0..i, (xs ! i, s) # ?clist ! i) \\ cptn)\" \n using a1 hyp CptnEnv xs_as_eq ce by fastforce\n have s3:\"(\\, (xs, s) #\n (as,sa) # ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist)\" \n proof - \n have s_len:\"same_length (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\"\n using hyp conjoin_def same_length_def xs_as_eq a1 by fastforce\n have s_state: \"same_state (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\"\n using hyp\n apply (simp add:hyp conjoin_def same_state_def a1) \n apply clarify\n apply(case_tac j) \n by (simp add: xs_as_eq,simp add: xs_as_eq)\n have s_function: \"same_functions (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\"\n using hyp conjoin_def same_functions_def a1 by fastforce\n have s_program: \"same_program (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\" \n using hyp\n apply (simp add:hyp conjoin_def same_program_def same_length_def a1)\n apply clarify\n apply(case_tac j) \n apply(rule nth_equalityI) \n apply(simp,simp) \n by(rule nth_equalityI, simp add: hyp xs_as_eq, simp add:xs_as_eq)\n have s_compat:\"compat_label (\\, (xs, s) # (xs,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\" \n using hyp a1 pe_ce\n apply (simp add:hyp conjoin_def compat_label_def)\n apply clarify\n apply(case_tac j,simp add: xs_as_eq)\n apply blast\n apply (simp add: xs_as_eq step_e.intros step_pe.intros)\n apply clarify\n apply(erule_tac x=nat in allE,erule impE,assumption) \n apply(erule disjE,simp)\n apply clarify\n apply(rule_tac x=i in exI) \n using hyp by (fastforce)+ \n thus ?thesis using s_len s_program s_state s_function conjoin_def xs_as_eq\n by blast\n qed\n then have \n \"(\\clist.\n length clist = length xs \\\n (\\, (xs, s) #\n a # ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\"\n using s1 s2 a_pair by blast\n } note s1=this\n\n {\n assume a1':\"\\\\\\<^sub>p (xs, s) \\ (as, sa)\"\n then obtain i r where \n inter_tran:\"i < length xs \\ \\\\\\<^sub>c (xs ! i, s) \\ (r, sa) \\ as = xs[i := r]\" \n using step_p_pair_elim_cases by metis \n then have xs_as_eq_len: \"length xs = length as\" by simp\n from inter_tran \n have s_states:\"\\nsa. s=Normal nsa \\ (s=sa \\ (\\sa. (s\\Normal sa)))\"\n using step_not_normal_s_eq_t by blast\n have as_xs:\"\\i' as!i'=r) \\ (as!i'=xs!i')\" \n using xs_as_eq_len by (simp add: inter_tran nth_list_update)\n let ?clist=\"(map (\\j. (as!j, sa)#(clist!j)) [0..i', (xs ! i', s) # ?clist ! i') \\ cptn)\" \n proof -\n {fix i'\n assume a1:\"i' < length xs\" \n have \"(\\, (xs ! i', s) # ?clist ! i') \\ cptn\"\n proof (cases \"i=i'\")\n case True \n thus ?thesis using inter_tran hyp cptn.CptnComp \n apply simp \n by fastforce \n next \n case False \n thus ?thesis using s_states inter_tran False hyp cptn.CptnComp a1\n apply clarify\n apply simp\n apply(erule_tac x=i' in allE)\n apply (simp)\n apply(rule CptnEnv) \n by (auto simp add: Env Env_n)\n qed\n } \n thus ?thesis by fastforce\n qed\n then have s3:\"(\\, (xs, s) #\n (as,sa) # ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist)\"\n proof - \n from hyp have \n len_list:\"length clist = length as\" by auto\n from hyp have same_len:\"same_length (\\, (as, sa) # ys) \n (map (\\i. (\\, (fst i, sa) # snd i)) (zip as clist))\"\n using conjoin_def by auto \n have s_len: \"same_length (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\" \n using \n same_len inter_tran \n unfolding conjoin_def same_length_def\n apply clarify \n apply(case_tac \"i=ia\") \n by (auto simp add: len_list) \n have s_state: \"same_state (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\"\n using hyp inter_tran unfolding conjoin_def same_state_def\n apply clarify\n apply(case_tac j, simp, simp (no_asm_simp))\n apply(case_tac \"i=ia\",simp , simp )\n by (metis (no_types, hide_lams) as_xs nth_list_update_eq xs_as_eq_len) \n have s_function: \"same_functions (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\"\n using hyp conjoin_def same_functions_def a1 by fastforce\n have s_program: \"same_program (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\" \n using hyp inter_tran unfolding conjoin_def same_program_def\n apply clarify\n apply(case_tac j,simp) \n apply(rule nth_equalityI,simp,simp)\n apply simp\n apply(rule nth_equalityI,simp,simp)\n apply(erule_tac x=nat and P=\"\\j. H j \\ (fst (a j))=((b j))\" for H a b in allE)\n apply(case_tac nat)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n by(case_tac \"i=ia\",simp,simp) \n have s_compat:\"compat_label (\\, (xs, s) # (as,sa) # ys) \n (map (\\i. (\\, (fst i, s) # snd i))\n (zip xs ?clist))\" \n using inter_tran hyp s_states\n unfolding conjoin_def compat_label_def\n apply clarify\n apply(case_tac j)\n apply(rule conjI,simp)\n apply(erule ParComp,assumption)\n apply clarify\n apply(rule exI[where x=i],simp)\n apply clarify\n apply (rule snormal_enviroment,assumption)\n apply simp\n apply(erule_tac x=nat and P=\"\\j. H j \\ (P j \\ Q j)\" for H P Q in allE,simp)\n apply (thin_tac \"s = Normal nsa \\ s = sa \\ (\\sa. s \\ Normal sa)\")\n apply(erule disjE )\n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(rule conjI)\n apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=l\",simp)\n apply(case_tac \"l=ia\",simp,simp)\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply simp\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply clarify\n apply (thin_tac \" \\ia, (xs[i := r] ! ia, sa) # clist ! ia) \\ cptn\")\n apply(erule_tac x=ia and P=\"\\j. H j \\ (P j)\" for H P in allE, erule impE, assumption)\n by(case_tac \"i=ia\",simp,simp) \n thus ?thesis using s_len s_program s_state s_function conjoin_def \n by blast\n qed \n then have \"(\\clist.\n length clist = length xs \\\n (\\, (xs, s) #\n a # ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\"\n using s1 s2 a_pair by blast\n } \n then have \n \"(\\clist.\n length clist = length xs \\\n (\\, (xs, s) #\n a # ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\"\n using s1 par_cptn_dest by fastforce\n } \n thus ?case by auto\nqed \n\nlemma one_iff_aux_if:\"xs\\[] \\ (\\ys. ((\\,((xs, s)#ys)) \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#(snd i))) (zip xs clist)) \\ \n (\\i,(xs!i,s)#(clist!i)) \\ cptn))) \\\n (par_cp \\ (xs) s = {(\\1,c). \\clist. (length clist)=(length xs) \\\n (\\i cp \\ (xs!i) s) \\ (\\,c) \\ clist \\ \\1=\\})\"\nproof\n assume a1:\"xs\\[]\"\n assume a2:\"\\ys. ((\\, (xs, s) # ys) \\ par_cptn) =\n (\\clist.\n length clist = length xs \\\n (\\,\n (xs, s) #\n ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\" \n show \"par_cp \\ xs s \\ \n {(\\1, c). \\clist.\n length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \\ \\1 = \\}\"\n proof-{ \n fix x\n let ?show = \"x\\ {(\\1, c). \\clist.\n length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \\ \\1 = \\}\"\n assume a3:\"x\\par_cp \\ xs s\" \n then obtain y where x_pair: \"x=(\\,y)\"\n unfolding par_cp_def by auto \n have ?show \n proof (cases y)\n case Nil then \n show ?show using a1 a2 a3 x_pair\n unfolding par_cp_def cp_def\n by (force elim:par_cptn.cases)\n next \n case (Cons a list) then\n show ?show using a1 a2 a3 x_pair\n unfolding par_cp_def cp_def \n by(auto, rule_tac x=\"map (\\i. (\\,(fst i, s) # snd i)) (zip xs clist)\" in exI,simp)\n qed\n } thus ?thesis using a1 a2 by auto \n qed\n { \n show \"{(\\1, c). \\clist.\n length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \\ \\1 = \\} \\ par_cp \\ xs s\" using a1 a2 \n proof-\n { \n fix x\n assume a3:\"x\\{(\\1, c). \\clist.\n length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \\ \\1 = \\}\"\n then obtain c where x_pair: \"x=(\\,c)\" by auto\n then obtain clist where \n props:\"length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \" using a3 by auto\n then have \"x\\par_cp \\ xs s\"\n proof (cases c)\n case Nil \n have clist_0: \n \"clist ! 0 \\ cp \\ (xs ! 0) s\" using props a1 \n by auto\n thus \"x\\par_cp \\ xs s\" \n using a1 a2 props Nil x_pair\n unfolding cp_def conjoin_def same_length_def \n apply clarify \n by(erule cptn.cases,fastforce,fastforce,fastforce)\n next\n case (Cons a ys) \n then obtain a1 a2 where a_pair: \"a=(a1,a2)\" \n using props by fastforce \n from a2 have \n a2:\"(((\\, (xs, s) # ys) \\ par_cptn) =\n (\\clist. length clist = length xs \\\n (\\, (xs, s) # ys) \\ map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn)))\" by auto\n have a2_s:\"a2=s\" using a1 props a_pair Cons\n unfolding conjoin_def same_state_def cp_def \n by force\n have a1_xs:\"a1 = xs\"\n using props a_pair Cons \n unfolding par_cp_def conjoin_def same_program_def cp_def \n apply clarify\n apply(erule_tac x=0 and P=\"\\j. H j \\ (fst (s j))=((t j))\" for H s t in allE) \n by(rule nth_equalityI,auto) \n then have conjoin_clist_xs:\"(\\, (xs,s)#ys) \\ clist\" \n using a1 props a_pair Cons a1_xs a2_s by auto\n also then have \"clist = map (\\i. (\\,(fst i,s)#(snd i))) (zip xs ((map (\\x. tl (snd x))) clist))\" \n using clist_map_zip a1 by fastforce\n ultimately have conjoin_map:\"(\\, (xs, s) # ys) \\ map (\\i. (\\, (fst i, s) # snd i)) (zip xs ((map (\\x. tl (snd x))) clist))\"\n using props x_pair Cons a_pair a1_xs a2_s by auto \n have \"\\n. \\ n < length xs \\ clist ! n \\ {(f, ps). ps ! 0 = (xs ! n, a2) \\ (\\, ps) \\ cptn \\ f = \\}\"\n using a1_xs a2_s props cp_def by fastforce\n then have clist_cptn:\"(\\i) \\ \n (\\, snd (clist!i)) \\ cptn \\\n (snd (clist!i))!0 = (xs!i,s))\"\n using a1_xs a2_s props by fastforce \n \n {fix i\n assume a4: \"i) \\ \n (\\, snd (clist!i)) \\ cptn \\\n (snd (clist!i))!0 = (xs!i,s)\"\n using props clist_cptn by fastforce \n from a4 props have a4':\"i0\" \n using conjoin_clist_xs a4'\n unfolding conjoin_def same_length_def \n by auto\n then have clist_hd_tl:\"snd (clist!i) = hd (snd (clist!i)) # tl (snd (clist ! i))\"\n by auto \n also have \" hd (snd (clist!i)) = (snd (clist!i))!0\"\n using a4' lengz by (simp add: hd_conv_nth)\n ultimately have clist_i_tl:\"snd (clist!i) = (xs!i,s) # tl (snd (clist ! i))\"\n using clist_i_cptn by fastforce\n also have \"tl (snd (clist ! i)) = map (\\x. tl (snd x)) clist!i\"\n using nth_map a4' \n by auto\n ultimately have snd_clist:\"snd (clist!i) = (xs ! i, s) # map (\\x. tl (snd x)) clist ! i\"\n by auto\n also have \"(clist!i) = (fst (clist!i),snd (clist!i))\"\n by auto\n ultimately have \"(clist!i) =(\\, (xs ! i, s) # map (\\x. tl (snd x)) clist ! i)\"\n using clist_i_cptn by auto\n then have \"(\\, (xs ! i, s) # map (\\x. tl (snd x)) clist ! i) \\ cptn\" \n using clist_i_cptn by auto\n } \n then have clist_in_cptn:\"(\\i, (xs ! i, s) # ((map (\\x. tl (snd x))) clist) ! i) \\ cptn)\"\n by auto\n have same_length_clist_xs:\"length ((map (\\x. tl (snd x))) clist) = length xs\"\n using props by auto\n then have \"(\\clist. length clist = length xs \\\n (\\, (xs, s) # ys) \\ map (\\i. (\\, (fst i, s) # snd i)) (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\"\n using a1 props x_pair a_pair Cons a1_xs a2_s conjoin_clist_xs clist_in_cptn\n conjoin_map clist_map by blast \n then have \"(\\, c) \\ par_cptn\" using a1 a2 props x_pair a_pair Cons a1_xs a2_s\n unfolding par_cp_def by simp \n thus \"x\\par_cp \\ xs s\" \n using a1 a2 props x_pair a_pair Cons a1_xs a2_s\n unfolding par_cp_def conjoin_def same_length_def same_program_def same_state_def same_functions_def compat_label_def \n by simp \n qed\n }\n thus ?thesis using a1 a2 by auto \n qed\n } \nqed\n\n\n\nlemma one_iff_aux_only_if:\"xs\\[] \\ \n (par_cp \\ (xs) s = {(\\1,c). \\clist. (length clist)=(length xs) \\\n (\\i cp \\ (xs!i) s) \\ (\\,c) \\ clist \\ \\1=\\}) \\\n(\\ys. ((\\,((xs, s)#ys)) \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#(snd i))) (zip xs clist)) \\ \n (\\i,(xs!i,s)#(clist!i)) \\ cptn)))\"\nproof\n fix ys\n assume a1: \"xs\\[]\"\n assume a2: \"par_cp \\ xs s =\n {(\\1, c).\n \\clist.\n length clist = length xs \\\n (\\i cp \\ (xs ! i) s) \\\n (\\, c) \\ clist \\ \\1 = \\}\"\n from a1 a2 show\n \"((\\, (xs, s) # ys) \\ par_cptn) =\n (\\clist.\n length clist = length xs \\\n (\\,\n (xs, s) #\n ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn))\"\n proof auto\n {assume a3:\"(\\, (xs, s) # ys) \\ par_cptn\"\n then show \"\\clist.\n length clist = length xs \\\n (\\,\n (xs, s) #\n ys) \\ map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist) \\\n (\\i, (xs ! i, s) # clist ! i) \\ cptn)\"\n using a1 a2 by (simp add: aux_onlyif)\n }\n {fix clist ::\"(('a, 'b, 'c, 'd) LanguageCon.com \\\n ('a, 'c) xstate) list list\"\n assume a3: \"length clist = length xs\"\n assume a4:\"(\\, (xs, s) # ys) \\ \n map (\\i. (\\, (fst i, s) # snd i))\n (zip xs clist)\"\n assume a5: \"\\i, (xs ! i, s) # clist ! i)\n \\ cptn\"\n show \"(\\, (xs, s) # ys) \\ par_cptn\" \n using a3 a4 a5 using aux_if by blast \n }\n qed\nqed\n\nlemma one_iff_aux: \"xs\\[] \\ (\\ys. ((\\,((xs, s)#ys)) \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#(snd i))) (zip xs clist)) \\ \n (\\i,(xs!i,s)#(clist!i)) \\ cptn))) = \n (par_cp \\ (xs) s = {(\\1,c). \\clist. (length clist)=(length xs) \\\n (\\i cp \\ (xs!i) s) \\ (\\,c) \\ clist \\ \\1=\\})\"\nproof \n assume a1:\"xs\\[]\"\n {assume a2:\"(\\ys. ((\\,((xs, s)#ys)) \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#(snd i))) (zip xs clist)) \\ \n (\\i,(xs!i,s)#(clist!i)) \\ cptn)))\"\n then show \"(par_cp \\ (xs) s = {(\\1,c). \\clist. (length clist)=(length xs) \\\n (\\i cp \\ (xs!i) s) \\ (\\,c) \\ clist \\ \\1=\\})\"\n by (auto simp add: a1 a2 one_iff_aux_if)\n }\n {assume a2:\"(par_cp \\ (xs) s = {(\\1,c). \\clist. (length clist)=(length xs) \\\n (\\i cp \\ (xs!i) s) \\ (\\,c) \\ clist \\ \\1=\\})\" \n then show \"(\\ys. ((\\,((xs, s)#ys)) \\ par_cptn) = \n (\\clist. length clist= length xs \\ \n ((\\,(xs, s)#ys) \\ map (\\i. (\\,(fst i,s)#(snd i))) (zip xs clist)) \\ \n (\\i,(xs!i,s)#(clist!i)) \\ cptn)))\"\n by (auto simp add: a1 a2 one_iff_aux_only_if)\n }\nqed\n \n\n\ntheorem one: \n\"xs\\[] \\ \n par_cp \\ xs s = \n {(\\1,c). \\clist. (length clist)=(length xs) \\ \n (\\i cp \\ (xs!i) s) \\ \n (\\,c) \\ clist \\ \\1=\\}\"\n\napply(frule one_iff_aux)\napply(drule sym)\napply(erule iffD2)\napply clarify\napply(rule iffI) \n apply(erule aux_onlyif)\napply clarify\napply(force intro:aux_if)\ndone\n\n(************************************************************************ *)\n(* subsection {* Equivalence between Small-Step and Big-Step Semantics *} *)\n(* ************************************************************************ *)\n \n(* \n\n?\\\\\\<^sub>c (LanguageCon.com.Seq ?c1.0 ?c2.0, ?s) \\\n (LanguageCon.com.Seq ?c1' ?c2.0,\n ?s') \\\n(?\\\\\\<^sub>c (?c1.0, ?s) \\ (?c1', ?s') \\ ?P) \\\n?P\n\nlemma \n assumes \n step_a: \"\\\\\\<^sub>c(Await b c, Normal s) \\ (t,u)\"\n shows step_await_step_c:\"(\\\\<^sub>\\\\<^sub>a)\\(c, Normal s) \\\\<^sup>* (sequential t,u)\" \nusing step_a\nproof cases\n fix t1\n assume\n \"(t, u) = (Skip, t1)\" \"s \\ b\" \"\\\\ \\c,Normal s\\ \\ t1\" \"\\t'. t1 \\ Abrupt t'\"\n thus ?thesis \n by (cases u) \n (auto intro: exec_impl_steps_Fault exec_impl_steps_Normal exec_impl_steps_Stuck)\nnext\n fix t1\n assume \"(t, u) = (Throw, Normal t1)\" \"s \\ b\" \"\\\\ \\c,Normal s\\ \\ Abrupt t1\"\n thus ?thesis by (simp add: exec_impl_steps_Normal_Abrupt)\nqed\n\nlemma \n assumes (* exec: \"\\\\\\c,Normal s\\ \\ t\" and\n b: \"s \\ b\" and *)\n step_a: \"\\\\\\<^sub>c(Await b c, Normal s) \\ u\"\n shows step_await_final1:\"final u\"\nusing step_a \nproof cases\n case (1 t) thus \"final u\" by (simp add: final_def)\nnext\n case (2 t)\n thus \"final u\" by (simp add: exec_impl_steps_Normal_Abrupt final_def)\nqed\n\nlemma step_Abrupt_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Abrupt x \\ s=Abrupt x\"\nusing step\nby induct auto\n\n\nlemma step_Stuck_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Stuck \\ \n s=Stuck \\ \n (\\r x. redex c\\<^sub>1 = Spec r \\ s=Normal x \\ (\\t. (x,t)\\r)) \\ \n (\\p x. redex c\\<^sub>1= Call p \\ s=Normal x \\ \\ p = None) \\\n (\\b c x. redex c\\<^sub>1 = Await b c \\ s=Normal x \\ x \\ b \\ \\\\\\c,s\\\\s')\"\nusing step\nby induct auto\n\nlemma step_Fault_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Fault f \\ \n s=Fault f \\ \n (\\g c x. redex c\\<^sub>1 = Guard f g c \\ s=Normal x \\ x \\ g) \\\n (\\b c1 x. redex c\\<^sub>1 = Await b c1 \\ s=Normal x \\ x \\ b \\ \\\\\\c1,s\\\\s')\"\nusing step \nby induct auto\n\n\n\n(* ************************************************************************ *)\nsubsection {* Infinite Computations: @{text \"\\\\(c, s) \\ \\(\\)\"}*}\n(* ************************************************************************ *)\n\ndefinition inf_c:: \"('s,'p,'f,'e) body \\ ('s,'p,'f,'e) config \\ bool\"\n (\"_\\\\<^sub>c _ \\ \\'(\\')\" [60,80] 100) where\n\"\\\\\\<^sub>c cfg \\ \\(\\) \\ (\\f. f (0::nat) = cfg \\ (\\i. \\\\\\<^sub>cf i \\ f (i+1)))\" \n\nlemma not_infI: \"\\\\f. \\f 0 = cfg; \\i. \\\\\\<^sub>cf i \\ f (Suc i)\\ \\ False\\ \n \\ \\\\\\\\<^sub>c cfg \\ \\(\\)\"\n by (auto simp add: inf_c_def)\n\n(* ************************************************************************ *)\nsubsection {* Equivalence between Termination and the Absence of Infinite Computations*}\n(* ************************************************************************ *)\n\n\nlemma step_preserves_termination: \n assumes step: \"\\\\(c,s) \\ (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\" \nusing step\nproof (induct)\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case SpecStuck thus ?case by (fastforce intro: terminates.intros)\nnext\n case Guard thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2) thus ?case\n apply (cases s)\n apply (cases s')\n apply (fastforce intro: terminates.intros step_extend \n elim: terminates_Normal_elim_cases)\n apply (fastforce intro: terminates.intros dest: step_Abrupt_prop \n step_Fault_prop step_Stuck_prop)+\n done\nnext\n case (SeqSkip c\\<^sub>2 s) \n thus ?case \n apply (cases s)\n apply (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )+\n done\nnext\n case (SeqThrow c\\<^sub>2 s) \n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case CondTrue \n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case CondFalse \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case WhileTrue\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case WhileFalse \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case Call \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case CallUndefined\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case DynCom\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case (Catch c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2) thus ?case\n apply (cases s)\n apply (cases s')\n apply (fastforce intro: terminates.intros step_extend \n elim: terminates_Normal_elim_cases)\n apply (fastforce intro: terminates.intros dest: step_Abrupt_prop \n step_Fault_prop step_Stuck_prop)+\n done\nnext\n case CatchThrow\n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case (CatchSkip c\\<^sub>2 s) \n thus ?case \n by (cases s) (fastforce intro: terminates.intros)+\nnext\n case FaultProp thus ?case by (fastforce intro: terminates.intros)\nnext\n case StuckProp thus ?case by (fastforce intro: terminates.intros)\nnext\n case AbruptProp thus ?case by (fastforce intro: terminates.intros)\nnext \n case Await thus ?case using terminates_Skip' by blast \nnext \n case AwaitAbrupt thus ?case by (fastforce intro: terminates.intros)\nqed\n\nlemma steps_preserves_termination: \n assumes steps: \"\\\\(c,s) \\\\<^sup>* (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\"\nusing steps\nproof (induct rule: rtranclp_induct2 [consumes 1, case_names Refl Trans])\n case Refl thus ?case .\nnext\n case Trans\n thus ?case\n by (blast dest: step_preserves_termination)\nqed\n\nML {*\n ML_Thms.bind_thm (\"tranclp_induct2\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(aa,ab)\"), (((\"b\", 0), Position.none), \"(ba,bb)\")] []\n @{thm tranclp_induct}));\n*}\n\nthm tranclp_induct2 tranclp_induct\n\nlemma steps_preserves_termination': \n assumes steps: \"\\\\(c,s) \\\\<^sup>+ (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\"\nusing steps\nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case Step thus ?case by (blast intro: step_preserves_termination)\nnext\n case Trans\n thus ?case\n by (blast dest: step_preserves_termination)\nqed\n\n\n\ndefinition head_com:: \"('s,'p,'f,'e) com \\ ('s,'p,'f,'e) com\"\nwhere\n\"head_com c =\n (case c of\n Seq c\\<^sub>1 c\\<^sub>2 \\ c\\<^sub>1\n | Catch c\\<^sub>1 c\\<^sub>2 \\ c\\<^sub>1\n | _ \\ c)\"\n\n \ndefinition head:: \"('s,'p,'f,'e) config \\ ('s,'p,'f,'e) config\"\n where \"head cfg = (head_com (fst cfg), snd cfg)\"\n\nlemma le_Suc_cases: \"\\\\i. \\i < k\\ \\ P i; P k\\ \\ \\i<(Suc k). P i\"\n apply clarify\n apply (case_tac \"i=k\")\n apply auto\n done\n\nlemma redex_Seq_False: \"\\c' c''. (redex c = Seq c'' c') = False\"\n by (induct c) auto\n\nlemma redex_Catch_False: \"\\c' c''. (redex c = Catch c'' c') = False\"\n by (induct c) auto\n\n\nlemma infinite_computation_extract_head_Seq:\n assumes inf_comp: \"\\i::nat. \\\\f i \\ f (i+1)\"\n assumes f_0: \"f 0 = (Seq c\\<^sub>1 c\\<^sub>2,s)\"\n assumes not_fin: \"\\i final (head (f i))\"\n shows \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s')) \\ \n \\\\head (f i) \\ head (f (i+1))\"\n (is \"\\ii final (head (f i))\" by fact\n from this[rule_format] have not_fin_k: \n \"\\i final (head (f i))\" \n apply clarify\n apply (subgoal_tac \"i < Suc k\")\n apply blast\n apply simp\n done\n\n from Suc.hyps [OF this]\n have hyp: \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s')) \\ \n \\\\ head (f i) \\ head (f (i + 1))\".\n show ?case\n proof (rule le_Suc_cases)\n fix i \n assume \"i < k\"\n then show \"?P i\"\n by (rule hyp [rule_format])\n next\n show \"?P k\"\n proof -\n from hyp [rule_format, of \"k - 1\"] f_0\n obtain c' fs' L' s' where f_k: \"f k = (Seq c' c\\<^sub>2, s')\"\n by (cases k) auto\n from inf_comp [rule_format, of k] f_k\n have \"\\\\(Seq c' c\\<^sub>2, s') \\ f (k + 1)\"\n by simp\n moreover\n from not_fin_Suc [rule_format, of k] f_k\n have \"\\ final (c',s')\"\n by (simp add: final_def head_def head_com_def)\n ultimately\n obtain c'' s'' where\n \"\\\\(c', s') \\ (c'', s'')\" and\n \"f (k + 1) = (Seq c'' c\\<^sub>2, s'')\"\n by cases (auto simp add: redex_Seq_False final_def)\n with f_k\n show ?thesis\n by (simp add: head_def head_com_def)\n qed\n qed\nqed\n\nlemma infinite_computation_extract_head_Catch:\n assumes inf_comp: \"\\i::nat. \\\\f i \\ f (i+1)\"\n assumes f_0: \"f 0 = (Catch c\\<^sub>1 c\\<^sub>2,s)\"\n assumes not_fin: \"\\i final (head (f i))\"\n shows \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s')) \\ \n \\\\head (f i) \\ head (f (i+1))\"\n (is \"\\ii final (head (f i))\" by fact\n from this[rule_format] have not_fin_k: \n \"\\i final (head (f i))\" \n apply clarify\n apply (subgoal_tac \"i < Suc k\")\n apply blast\n apply simp\n done\n\n from Suc.hyps [OF this]\n have hyp: \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s')) \\ \n \\\\ head (f i) \\ head (f (i + 1))\".\n show ?case\n proof (rule le_Suc_cases)\n fix i \n assume \"i < k\"\n then show \"?P i\"\n by (rule hyp [rule_format])\n next\n show \"?P k\"\n proof -\n from hyp [rule_format, of \"k - 1\"] f_0\n obtain c' fs' L' s' where f_k: \"f k = (Catch c' c\\<^sub>2, s')\"\n by (cases k) auto\n from inf_comp [rule_format, of k] f_k\n have \"\\\\(Catch c' c\\<^sub>2, s') \\ f (k + 1)\"\n by simp\n moreover\n from not_fin_Suc [rule_format, of k] f_k\n have \"\\ final (c',s')\"\n by (simp add: final_def head_def head_com_def)\n ultimately\n obtain c'' s'' where\n \"\\\\(c', s') \\ (c'', s'')\" and\n \"f (k + 1) = (Catch c'' c\\<^sub>2, s'')\"\n by cases (auto simp add: redex_Catch_False final_def)+\n with f_k\n show ?thesis\n by (simp add: head_def head_com_def)\n qed\n qed\nqed\n\nlemma no_inf_Throw: \"\\ \\\\(Throw,s) \\ \\(\\)\"\nproof \n assume \"\\\\ (Throw, s) \\ \\(\\)\"\n then obtain f where\n step [rule_format]: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Throw, s)\"\n by (auto simp add: inf_def)\n from step [of 0, simplified f_0] step [of 1]\n show False\n by cases (auto elim: step_elim_cases)\nqed\n\nlemma split_inf_Seq: \n assumes inf_comp: \"\\\\(Seq c\\<^sub>1 c\\<^sub>2,s) \\ \\(\\)\"\n shows \"\\\\(c\\<^sub>1,s) \\ \\(\\) \\ \n (\\s'. \\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s') \\ \\\\(c\\<^sub>2,s') \\ \\(\\))\"\nproof -\n from inf_comp obtain f where\n step: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Seq c\\<^sub>1 c\\<^sub>2, s)\"\n by (auto simp add: inf_def)\n from f_0 have head_f_0: \"head (f 0) = (c\\<^sub>1,s)\" \n by (simp add: head_def head_com_def)\n show ?thesis\n proof (cases \"\\i. final (head (f i))\")\n case True\n def k\\\"(LEAST i. final (head (f i)))\"\n have less_k: \"\\i final (head (f i))\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply auto\n done\n from infinite_computation_extract_head_Seq [OF step f_0 this]\n obtain step_head: \"\\i\\ head (f i) \\ head (f (i + 1))\" and\n conf: \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s'))\"\n by blast \n from True\n have final_f_k: \"final (head (f k))\"\n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n moreover\n from f_0 conf [rule_format, of \"k - 1\"]\n obtain c' s' where f_k: \"f k = (Seq c' c\\<^sub>2,s')\"\n by (cases k) auto\n moreover\n from step_head have steps_head: \"\\\\head (f 0) \\\\<^sup>* head (f k)\"\n proof (induct k)\n case 0 thus ?case by simp\n next\n case (Suc m)\n have step: \"\\i\\ head (f i) \\ head (f (i + 1))\" by fact\n hence \"\\i\\ head (f i) \\ head (f (i + 1))\"\n by auto\n hence \"\\\\ head (f 0) \\\\<^sup>* head (f m)\"\n by (rule Suc.hyps)\n also from step [rule_format, of m]\n have \"\\\\ head (f m) \\ head (f (m + 1))\" by simp\n finally show ?case by simp\n qed\n {\n assume f_k: \"f k = (Seq Skip c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k\n obtain \"\\\\(Seq Skip c\\<^sub>2,s') \\ (c\\<^sub>2,s')\" and\n f_Suc_k: \"f (k + 1) = (c\\<^sub>2,s')\"\n by (fastforce elim: step.cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (c\\<^sub>2,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(c\\<^sub>2,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n ultimately\n have ?thesis\n by auto\n }\n moreover\n {\n fix x\n assume s': \"s'=Normal x\" and f_k: \"f k = (Seq Throw c\\<^sub>2, s')\"\n from step [rule_format, of k] f_k s'\n obtain \"\\\\(Seq Throw c\\<^sub>2,s') \\ (Throw,s')\" and\n f_Suc_k: \"f (k + 1) = (Throw,s')\"\n by (fastforce elim: step_elim_cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (Throw,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(Throw,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n with no_inf_Throw\n have ?thesis\n by auto\n }\n ultimately \n show ?thesis\n by (auto simp add: final_def head_def head_com_def)\n next\n case False\n then have not_fin: \"\\i. \\ final (head (f i))\"\n by blast\n have \"\\i. \\\\head (f i) \\ head (f (i + 1))\"\n proof \n fix k\n from not_fin \n have \"\\i<(Suc k). \\ final (head (f i))\"\n by simp\n \n from infinite_computation_extract_head_Seq [OF step f_0 this ]\n show \"\\\\ head (f k) \\ head (f (k + 1))\" by simp\n qed\n with head_f_0 have \"\\\\(c\\<^sub>1,s) \\ \\(\\)\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma split_inf_Catch: \n assumes inf_comp: \"\\\\(Catch c\\<^sub>1 c\\<^sub>2,s) \\ \\(\\)\"\n shows \"\\\\(c\\<^sub>1,s) \\ \\(\\) \\ \n (\\s'. \\\\(c\\<^sub>1,s) \\\\<^sup>* (Throw,Normal s') \\ \\\\(c\\<^sub>2,Normal s') \\ \\(\\))\"\nproof -\n from inf_comp obtain f where\n step: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Catch c\\<^sub>1 c\\<^sub>2, s)\"\n by (auto simp add: inf_def)\n from f_0 have head_f_0: \"head (f 0) = (c\\<^sub>1,s)\" \n by (simp add: head_def head_com_def)\n show ?thesis\n proof (cases \"\\i. final (head (f i))\")\n case True\n def k\\\"(LEAST i. final (head (f i)))\"\n have less_k: \"\\i final (head (f i))\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply auto\n done\n from infinite_computation_extract_head_Catch [OF step f_0 this]\n obtain step_head: \"\\i\\ head (f i) \\ head (f (i + 1))\" and\n conf: \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s'))\"\n by blast \n from True\n have final_f_k: \"final (head (f k))\"\n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n moreover\n from f_0 conf [rule_format, of \"k - 1\"]\n obtain c' s' where f_k: \"f k = (Catch c' c\\<^sub>2,s')\"\n by (cases k) auto\n moreover\n from step_head have steps_head: \"\\\\head (f 0) \\\\<^sup>* head (f k)\"\n proof (induct k)\n case 0 thus ?case by simp\n next\n case (Suc m)\n have step: \"\\i\\ head (f i) \\ head (f (i + 1))\" by fact\n hence \"\\i\\ head (f i) \\ head (f (i + 1))\"\n by auto\n hence \"\\\\ head (f 0) \\\\<^sup>* head (f m)\"\n by (rule Suc.hyps)\n also from step [rule_format, of m]\n have \"\\\\ head (f m) \\ head (f (m + 1))\" by simp\n finally show ?case by simp\n qed\n {\n assume f_k: \"f k = (Catch Skip c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k\n obtain \"\\\\(Catch Skip c\\<^sub>2,s') \\ (Skip,s')\" and\n f_Suc_k: \"f (k + 1) = (Skip,s')\"\n by (fastforce elim: step.cases intro: step.intros)\n from step [rule_format, of \"k+1\", simplified f_Suc_k]\n have ?thesis\n by (rule no_step_final') (auto simp add: final_def)\n }\n moreover\n {\n fix x\n assume s': \"s'=Normal x\" and f_k: \"f k = (Catch Throw c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Throw,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k s'\n obtain \"\\\\(Catch Throw c\\<^sub>2,s') \\ (c\\<^sub>2,s')\" and\n f_Suc_k: \"f (k + 1) = (c\\<^sub>2,s')\"\n by (fastforce elim: step_elim_cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (c\\<^sub>2,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(c\\<^sub>2,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n ultimately\n have ?thesis\n using s'\n by auto\n }\n ultimately \n show ?thesis\n by (auto simp add: final_def head_def head_com_def)\n next\n case False\n then have not_fin: \"\\i. \\ final (head (f i))\"\n by blast\n have \"\\i. \\\\head (f i) \\ head (f (i + 1))\"\n proof \n fix k\n from not_fin \n have \"\\i<(Suc k). \\ final (head (f i))\"\n by simp\n \n from infinite_computation_extract_head_Catch [OF step f_0 this ]\n show \"\\\\ head (f k) \\ head (f (k + 1))\" by simp\n qed\n with head_f_0 have \"\\\\(c\\<^sub>1,s) \\ \\(\\)\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma Skip_no_step: \"\\\\(Skip,s) \\ cfg \\ P\"\n apply (erule no_step_final')\n apply (simp add: final_def)\n done\n\nlemma not_inf_Stuck: \"\\ \\\\(c,Stuck) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Stuck)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Stuck) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Stuck_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Stuck) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Stuck_prop)\n qed \nnext \n case (Await b c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\nlemma not_inf_Fault: \"\\ \\\\(c,Fault x) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Fault x)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Fault x) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Fault_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Fault x) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Fault_prop)\n qed \nnext\n case (Await b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\nlemma not_inf_Abrupt: \"\\ \\\\(c,Abrupt s) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Abrupt s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Abrupt s) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Abrupt_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Abrupt s) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Abrupt_prop)\n qed \ncase (Await b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\n\ntheorem terminates_impl_no_infinite_computation:\n assumes termi: \"\\\\c \\ s\"\n shows \"\\ \\\\(c,s) \\ \\(\\)\"\nusing termi\nproof (induct)\n case (Skip s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Normal s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Normal s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Normal s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard s g c m)\n have g: \"s \\ g\" by fact\n have hyp: \"\\ \\\\ (c, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Normal s)\" \n from f_step [of 0] f_0 g\n have \"f 1 = (c,Normal s)\"\n by (fastforce elim: step_elim_cases)\n with f_step\n have \"\\\\ (c, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False ..\n qed\nnext\n case (GuardFault s g m c)\n have g: \"s \\ g\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Normal s)\" \n from g f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Fault c m) \n thus ?case\n by (rule not_inf_Fault)\nnext\n case (Seq c\\<^sub>1 s c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto intro: steps_Skip_impl_exec)\n qed\nnext\n case (CondTrue s b c1 c2)\n have b: \"s \\ b\" by fact\n have hyp_c1: \"\\ \\\\ (c1, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c1 c2, Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = (c1,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (c1, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c1 show False by simp\n qed \nnext\n case (CondFalse s b c2 c1)\n have b: \"s \\ b\" by fact\n have hyp_c2: \"\\ \\\\ (c2, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c1 c2, Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = (c2,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (c2, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c2 show False by simp\n qed\nnext \n case (WhileTrue s b c)\n have b: \"s \\ b\" by fact\n have hyp_c: \"\\ \\\\ (c, Normal s) \\ \\(\\)\" by fact\n have hyp_w: \"\\s'. \\\\ \\c,Normal s\\ \\ s' \\ \n \\\\While b c \\ s' \\ \\ \\\\ (While b c, s') \\ \\(\\)\" by fact\n have not_inf_Seq: \"\\ \\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n proof \n assume \"\\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n from split_inf_Seq [OF this] hyp_c hyp_w show False\n by (auto intro: steps_Skip_impl_exec)\n qed\n show ?case\n proof \n assume \"\\\\ (While b c, Normal s) \\ \\(\\)\"\n then obtain f where\n f_step: \"\\i. \\\\f i \\ f (Suc i)\" and\n f_0: \"f 0 = (While b c, Normal s)\" \n by (auto simp add: inf_def)\n from f_step [of 0] f_0 b\n have \"f 1 = (Seq c (While b c),Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with not_inf_Seq show False by simp\n qed\nnext\n case (WhileFalse s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Normal s)\" \n from b f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p bdy s)\n have bdy: \"\\ p = Some bdy\" by fact\n have hyp: \"\\ \\\\ (bdy, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Normal s)\" \n from bdy f_step [of 0] f_0\n have \"f 1 = (bdy,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (bdy, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False by simp\n qed \nnext\n case (CallUndefined p s)\n have no_bdy: \"\\ p = None\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Normal s)\" \n from no_bdy f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Stuck c)\n show ?case\n by (rule not_inf_Stuck)\nnext\n case (DynCom c s)\n have hyp: \"\\ \\\\ (c s, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom c, Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = (c s, Normal s)\"\n by (auto elim: step_elim_cases)\n with f_step have \"\\\\ (c s, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp\n show False by simp\n qed\nnext (\\,c) \\ clist\n case (Throw s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Normal s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: step_elim_cases)\n qed \nnext\n case (Abrupt c)\n show ?case\n by (rule not_inf_Abrupt)\nnext\n case (Catch c\\<^sub>1 s c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto intro: steps_Throw_impl_exec)\n qed\nnext\n case (AwaitTrue s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Normal s)\" \n from b f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\n\ndefinition\n termi_call_steps :: \"('s,'p,'f,'e) body \\ (('s \\ 'p) \\ ('s \\ 'p))set\"\nwhere\n\"termi_call_steps \\ =\n {((t,q),(s,p)). \\\\Call p\\Normal s \\ \n (\\c. \\\\(Call p,Normal s) \\\\<^sup>+ (c,Normal t) \\ redex c = Call q)}\"\n\n\nprimrec subst_redex:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com\"\nwhere\n\"subst_redex Skip c = c\" |\n\"subst_redex (Basic f) c = c\" |\n\"subst_redex (Spec r) c = c\" |\n\"subst_redex (Seq c\\<^sub>1 c\\<^sub>2) c = Seq (subst_redex c\\<^sub>1 c) c\\<^sub>2\" |\n\"subst_redex (Cond b c\\<^sub>1 c\\<^sub>2) c = c\" |\n\"subst_redex (While b c') c = c\" |\n\"subst_redex (Await b c') c = c\" |\n\"subst_redex (Call p) c = c\" |\n\"subst_redex (DynCom d) c = c\" |\n\"subst_redex (Guard f b c') c = c\" |\n\"subst_redex (Throw) c = c\" |\n\"subst_redex (Catch c\\<^sub>1 c\\<^sub>2) c = Catch (subst_redex c\\<^sub>1 c) c\\<^sub>2\"\n\nlemma subst_redex_redex:\n \"subst_redex c (redex c) = c\"\n by (induct c) auto\n\nlemma redex_subst_redex: \"redex (subst_redex c r) = redex r\"\n by (induct c) auto\n \nlemma step_redex':\n shows \"\\\\(redex c,s) \\ (r',s') \\ \\\\(c,s) \\ (subst_redex c r',s')\"\nby (induct c) (auto intro: step.Seq step.Catch)\n\n\nlemma step_redex:\n shows \"\\\\(r,s) \\ (r',s') \\ \\\\(subst_redex c r,s) \\ (subst_redex c r',s')\"\nby (induct c) (auto intro: step.Seq step.Catch)\n\nlemma steps_redex:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. \\\\(subst_redex c r,s) \\\\<^sup>* (subst_redex c r',s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl \n show \"\\\\ (subst_redex c r', s') \\\\<^sup>* (subst_redex c r', s')\"\n by simp\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" by fact\n from step_redex [OF this]\n have \"\\\\ (subst_redex c r, s) \\ (subst_redex c r'', s'')\".\n also \n have \"\\\\ (subst_redex c r'', s'') \\\\<^sup>* (subst_redex c r', s')\" by fact\n finally show ?case .\nqed\n\nML {*\n ML_Thms.bind_thm (\"trancl_induct2\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(aa, ab)\"), (((\"b\", 0), Position.none), \"(ba, bb)\")] []\n @{thm trancl_induct}));\n*}\n\nlemma steps_redex':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. \\\\(subst_redex c r,s) \\\\<^sup>+ (subst_redex c r',s')\"\nusing steps\nproof (induct rule: tranclp_induct2 [consumes 1,case_names Step Trans])\n case (Step r' s')\n have \"\\\\ (r, s) \\ (r', s')\" by fact\n then have \"\\\\ (subst_redex c r, s) \\ (subst_redex c r', s')\"\n by (rule step_redex)\n then show \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r', s')\"..\nnext\n case (Trans r' s' r'' s'')\n have \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r', s')\" by fact\n also\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n hence \"\\\\ (subst_redex c r', s') \\ (subst_redex c r'', s'')\"\n by (rule step_redex)\n finally show \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r'', s'')\" .\nqed\n\nprimrec seq:: \"(nat \\ ('s,'p,'f,'e)com) \\ 'p \\ nat \\ ('s,'p,'f,'e)com\"\nwhere\n\"seq c p 0 = Call p\" |\n\"seq c p (Suc i) = subst_redex (seq c p i) (c i)\"\n\n\nlemma renumber':\n assumes f: \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r\" \n assumes a_b: \"(a,b) \\ r\\<^sup>*\" \n shows \"b = f 0 \\ (\\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r))\"\nusing a_b\nproof (induct rule: converse_rtrancl_induct [consumes 1])\n assume \"b = f 0\"\n with f show \"\\f. f 0 = b \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by blast\nnext\n fix a z\n assume a_z: \"(a, z) \\ r\" and \"(z, b) \\ r\\<^sup>*\" \n assume \"b = f 0 \\ \\f. f 0 = z \\ (\\i. (f i, f (Suc i)) \\ r)\"\n \"b = f 0\"\n then obtain f where f0: \"f 0 = z\" and seq: \"\\i. (f i, f (Suc i)) \\ r\"\n by iprover\n {\n fix i have \"((\\i. case i of 0 \\ a | Suc i \\ f i) i, f i) \\ r\"\n using seq a_z f0\n by (cases i) auto\n }\n then\n show \"\\f. f 0 = a \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by - (rule exI [where x=\"\\i. case i of 0 \\ a | Suc i \\ f i\"],simp)\nqed\n\nlemma renumber:\n \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r \n \\ \\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r)\"\n by (blast dest:renumber')\n\nlemma lem:\n \"\\y. r\\<^sup>+\\<^sup>+ a y \\ P a \\ P y \n \\ ((b,a) \\ {(y,x). P x \\ r x y}\\<^sup>+) = ((b,a) \\ {(y,x). P x \\ r\\<^sup>+\\<^sup>+ x y})\"\napply(rule iffI)\n apply clarify\n apply(erule trancl_induct)\n apply blast\n apply(blast intro:tranclp_trans)\napply clarify\napply(erule tranclp_induct)\n apply blast\napply(blast intro:trancl_trans)\ndone\n\ncorollary terminates_impl_no_infinite_trans_computation:\n assumes terminates: \"\\\\c\\s\"\n shows \"\\(\\f. f 0 = (c,s) \\ (\\i. \\\\f i \\\\<^sup>+ f(Suc i)))\"\nproof -\n have \"wf({(y,x). \\\\(c,s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n proof (rule wf_trancl)\n show \"wf {(y, x). \\\\(c,s) \\\\<^sup>* x \\ \\\\x \\ y}\"\n proof (simp only: wf_iff_no_infinite_down_chain,clarify,simp)\n fix f\n assume \"\\i. \\\\(c,s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f (0::nat) = (c,s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from terminates_impl_no_infinite_computation [OF terminates]\n have \"\\ (\\f. f (0::nat) = (c, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (simp add: inf_def)\n ultimately show False\n by simp\n qed\n qed\n hence \"\\ (\\f. \\i. (f (Suc i), f i)\n \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n by (simp add: wf_iff_no_infinite_down_chain)\n thus ?thesis\n proof (rule contrapos_nn)\n assume \"\\f. f (0::nat) = (c, s) \\ (\\i. \\\\f i \\\\<^sup>+ f (Suc i))\"\n then obtain f where\n f0: \"f 0 = (c, s)\" and\n seq: \"\\i. \\\\f i \\\\<^sup>+ f (Suc i)\"\n by iprover\n show \n \"\\f. \\i. (f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof (rule exI [where x=f],rule allI)\n fix i\n show \"(f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof - \n {\n fix i have \"\\\\(c,s) \\\\<^sup>* f i\"\n proof (induct i)\n case 0 show \"\\\\(c, s) \\\\<^sup>* f 0\"\n by (simp add: f0)\n next\n case (Suc n)\n have \"\\\\(c, s) \\\\<^sup>* f n\" by fact\n with seq show \"\\\\(c, s) \\\\<^sup>* f (Suc n)\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n qed\n }\n hence \"\\\\(c,s) \\\\<^sup>* f i\"\n by iprover\n with seq have\n \"(f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\\\<^sup>+ y}\"\n by clarsimp\n moreover \n have \"\\y. \\\\f i \\\\<^sup>+ y\\\\\\(c, s) \\\\<^sup>* f i\\\\\\(c, s) \\\\<^sup>* y\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n ultimately \n show ?thesis \n by (subst lem )\n qed\n qed\n qed\nqed\n\ntheorem wf_termi_call_steps: \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix f\n assume inf: \"\\i. (\\(t, q) (s, p).\n \\\\Call p \\ Normal s \\\n (\\c. \\\\ (Call p, Normal s) \\\\<^sup>+ (c, Normal t) \\ redex c = Call q))\n (f (Suc i)) (f i)\"\n def s\\\"\\i::nat. fst (f i)\" \n def p\\\"\\i::nat. snd (f i)::'b\"\n from inf\n have inf': \"\\i. \\\\Call (p i) \\ Normal (s i) \\\n (\\c. \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c, Normal (s (i+1))) \\ \n redex c = Call (p (i+1)))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply (auto simp add: s_def p_def)\n done\n show False\n proof -\n from inf'\n have \"\\c. \\i. \\\\Call (p i) \\ Normal (s i) \\\n \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i+1))) \\ \n redex (c i) = Call (p (i+1))\"\n apply -\n apply (rule choice)\n by blast\n then obtain c where\n termi_c: \"\\i. \\\\Call (p i) \\ Normal (s i)\" and\n steps_c: \"\\i. \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i+1)))\" and\n red_c: \"\\i. redex (c i) = Call (p (i+1))\"\n by auto\n def g\\\"\\i. (seq c (p 0) i,Normal (s i)::('a,'c) xstate)\"\n from red_c [rule_format, of 0]\n have \"g 0 = (Call (p 0), Normal (s 0))\"\n by (simp add: g_def)\n moreover\n {\n fix i\n have \"redex (seq c (p 0) i) = Call (p i)\"\n by (induct i) (auto simp add: redex_subst_redex red_c)\n from this [symmetric]\n have \"subst_redex (seq c (p 0) i) (Call (p i)) = (seq c (p 0) i)\"\n by (simp add: subst_redex_redex)\n } note subst_redex_seq = this\n have \"\\i. \\\\ (g i) \\\\<^sup>+ (g (i+1))\"\n proof \n fix i\n from steps_c [rule_format, of i]\n have \"\\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i + 1)))\".\n from steps_redex' [OF this, of \"(seq c (p 0) i)\"]\n have \"\\\\ (subst_redex (seq c (p 0) i) (Call (p i)), Normal (s i)) \\\\<^sup>+\n (subst_redex (seq c (p 0) i) (c i), Normal (s (i + 1)))\" .\n hence \"\\\\ (seq c (p 0) i, Normal (s i)) \\\\<^sup>+ \n (seq c (p 0) (i+1), Normal (s (i + 1)))\"\n by (simp add: subst_redex_seq)\n thus \"\\\\ (g i) \\\\<^sup>+ (g (i+1))\"\n by (simp add: g_def)\n qed\n moreover\n from terminates_impl_no_infinite_trans_computation [OF termi_c [rule_format, of 0]]\n have \"\\ (\\f. f 0 = (Call (p 0), Normal (s 0)) \\ (\\i. \\\\ f i \\\\<^sup>+ f (Suc i)))\" .\n ultimately show False\n by auto\n qed\nqed\n\n\nlemma no_infinite_computation_implies_wf: \n assumes not_inf: \"\\ \\\\ (c, s) \\ \\(\\)\"\n shows \"wf {(c2,c1). \\ \\ (c,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nproof (simp only: wf_iff_no_infinite_down_chain,clarify, simp)\n fix f\n assume \"\\i. \\\\(c, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (c, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from not_inf\n have \"\\ (\\f. f 0 = (c, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (simp add: inf_def)\n ultimately show False\n by simp\nqed\n\nlemma not_final_Stuck_step: \"\\ final (c,Stuck) \\ \\c' s'. \\\\ (c, Stuck) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Abrupt_step: \n \"\\ final (c,Abrupt s) \\ \\c' s'. \\\\ (c, Abrupt s) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Fault_step: \n \"\\ final (c,Fault f) \\ \\c' s'. \\\\ (c, Fault f) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Normal_step: \n \"\\ final (c,Normal s) \\ ((\\b c1. redex c = Await b c1) \\ \\\\c \\ Normal s) \\ \\c' s'. \\\\ (c, Normal s) \\ (c',s')\"\nproof (induct c) \n case Skip thus ?case by (simp add: final_def)\nnext\n case Basic thus ?case by (meson step.Basic)\nnext\n case (Spec r)\n thus ?case by (meson step.Spec step.SpecStuck) \nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n thus ?case by (metis SeqSkip SeqThrow final_def fst_conv redex.simps(4) step.Seq terminates_Normal_elim_cases(5))\nnext\n case (Cond b c1 c2)\n show ?case\n by (cases \"s \\ b\") (fastforce intro: step.intros)+\nnext\n case (While b c)\n show ?case\n by (cases \"s \\ b\") (fastforce intro: step.intros)+\nnext\n case (Call p)\n show ?case\n by (cases \"\\ p\") (fastforce intro: step.intros)+\nnext\n case DynCom thus ?case by (fastforce intro: step.intros)\nnext\n case (Guard f g c)\n show ?case\n by (cases \"s \\ g\") (fastforce intro: step.intros)+\nnext\n case Throw\n thus ?case by (fastforce intro: step.intros simp add: final_def)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n thus ?case\n by (cases \"final (c\\<^sub>1,Normal s)\") (fastforce intro: step.intros elim: terminates_Normal_elim_cases simp add: final_def)+\nnext\n case (Await b c) \n then obtain ba c1 where x:\"(\\ba c1. redex (Await b c) = Await ba c1)\" by simp\n then have \"\\\\Await b c \\ Normal s\" using x Await.prems by blast \n also have \"s \\ b\" by (meson `\\\\Await b c \\ Normal s` terminates_Normal_elim_cases(12))\n moreover have \"\\t. \\\\\\c, Normal s\\ \\ t\" by (meson calculation terminates_Normal_elim_cases(12) terminates_implies_exec) \n ultimately show ?case using AwaitAbrupt step.Await by fastforce\nqed\n\nlemma final_termi:\n\"final (c,s) \\ \\\\c\\s\"\n by (cases s) (auto simp add: final_def terminates.intros)\n\nlemma split_computation: \nassumes steps: \"\\\\ (c, s) \\\\<^sup>* (c\\<^sub>f, s\\<^sub>f)\"\nassumes not_final: \"\\ final (c,s)\"\nassumes final: \"final (c\\<^sub>f,s\\<^sub>f)\"\nshows \"\\c' s'. \\\\ (c, s) \\ (c',s') \\ \\\\ (c', s') \\\\<^sup>* (c\\<^sub>f, s\\<^sub>f)\"\nusing steps not_final final\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c' s')\n thus ?case by auto\nqed\n\n\nlemma wf_implies_termi_reach_step_case:\nassumes hyp: \"\\c' s'. \\\\ (c, Normal s) \\ (c', s')\\ \\\\c' \\ s'\" and\n hyp1:\"(\\b c1. (redex c = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\nshows \"\\\\c \\ Normal s\"\nusing hyp hyp1\nproof (induct c)\n case Skip show ?case by (fastforce intro: terminates.intros)\nnext\n case Basic show ?case by (fastforce intro: terminates.intros)\nnext\n case (Spec r)\n show ?case\n by (cases \"\\t. (s,t)\\r\") (fastforce intro: terminates.intros)+\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nusing Seq.prems by blast \n have hyp': \"(\\b c1. (redex (Seq c\\<^sub>1 c\\<^sub>2) = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\" by fact \n show ?case \n proof (rule terminates.Seq)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\" \n assume red: \"(\\b c1. (redex c\\<^sub>1 = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c' c\\<^sub>2, s')\"\n by (simp add: step.Seq) \n from hyp [OF this]\n have \"\\\\Seq c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Seq.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using terminates_Skip' by (simp add: hyp') \n next\n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2 \\ s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ s'\"\n show \"\\\\c\\<^sub>2 \\ s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n hence \"c\\<^sub>1=Skip \\ c\\<^sub>1=Throw\"\n by (simp add: final_def)\n thus ?thesis\n proof\n assume Skip: \"c\\<^sub>1=Skip\"\n have s1:\"\\\\(Seq Skip c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s) \\\\ (\\b c1. Seq c\\<^sub>1 c\\<^sub>2 = Await b c1)\"\n by (simp add: step.SeqSkip) \n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Skip s1 by blast \n moreover from exec_c\\<^sub>1 Skip\n have \"s'=Normal s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n assume Throw: \"c\\<^sub>1=Throw\"\n with exec_c\\<^sub>1 have \"s'=Abrupt s\"\n by (auto elim: exec_Normal_elim_cases)\n thus ?thesis\n by auto\n qed\n next\n case False \n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (c\\<^sub>f, t)\" and\n fin:\"(case s' of\n Abrupt x \\ c\\<^sub>f = Throw \\ t = Normal x\n | _ \\ c\\<^sub>f = Skip \\ t = s')\"\n by (fastforce split: xstate.splits)\n with fin have final: \"final (c\\<^sub>f,t)\"\n by (cases s') (auto simp add: final_def)\n from split_computation [OF steps_c\\<^sub>1 False this]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (c\\<^sub>f, t)\" \n by blast\n from step.Seq [OF first]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this]\n have termi_s'': \"\\\\Seq c'' c\\<^sub>2 \\ s''\".\n show ?thesis\n proof (cases s'')\n case (Normal x)\n from termi_s'' [simplified Normal]\n have termi_c\\<^sub>2: \"\\t. \\\\ \\c'',Normal x\\ \\ t \\ \\\\c\\<^sub>2 \\ t\"\n by cases\n show ?thesis\n proof (cases \"\\x'. s'=Abrupt x'\")\n case False\n with fin obtain \"c\\<^sub>f=Skip\" \"t=s'\"\n by (cases s') auto\n from steps_Skip_impl_exec [OF rest [simplified this]] Normal\n have \"\\\\ \\c'',Normal x\\ \\ s'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this]\n show \"\\\\c\\<^sub>2 \\ s'\" .\n next\n case True\n with fin obtain x' where s': \"s'=Abrupt x'\" and \"c\\<^sub>f=Throw\" \"t=Normal x'\"\n by auto\n from steps_Throw_impl_exec [OF rest [simplified this]] Normal \n have \"\\\\ \\c'',Normal x\\ \\ Abrupt x'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this] s'\n show \"\\\\c\\<^sub>2 \\ s'\" by simp\n qed\n next\n case (Abrupt x)\n from steps_Abrupt_prop [OF rest this]\n have \"t=Abrupt x\" by simp\n with fin have \"s'=Abrupt x\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case (Fault f)\n from steps_Fault_prop [OF rest this]\n have \"t=Fault f\" by simp\n with fin have \"s'=Fault f\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case Stuck\n from steps_Stuck_prop [OF rest this]\n have \"t=Stuck\" by simp\n with fin have \"s'=Stuck\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n qed\n qed\n qed\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nby (simp add: Cond.prems(1)) \n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>1, Normal s) \"\n by (simp add: step.CondTrue) \n from hyp [OF this] have \"\\\\c\\<^sub>1 \\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>2, Normal s)\"\n by (simp add: step.CondFalse)\n from hyp [OF this] have \"\\\\c\\<^sub>2 \\ Normal s\".\n with False show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c)\n have hyp: \"\\c' s'. \\\\ (While b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (While b c, Normal s) \\ (Seq c (While b c), Normal s)\"\n by (simp add: step.WhileTrue)\n from hyp [OF this] have \"\\\\(Seq c (While b c)) \\ Normal s\".\n with True show ?thesis\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Call p)\n have hyp: \"\\c' s'. \\\\ (Call p, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: Call.prems)\n show ?case\n proof (cases \"\\ p\")\n case None\n thus ?thesis\n by (auto intro: terminates.intros)\n next\n case (Some bdy)\n then have \"\\\\ (Call p, Normal s) \\ (bdy, Normal s)\"\n by (simp add: step.Call)\n from hyp [OF this] have \"\\\\bdy \\ Normal s\".\n with Some show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (DynCom c)\n have hyp: \"\\c' s'. \\\\ (DynCom c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have \"\\\\ (DynCom c, Normal s) \\ (c s, Normal s)\"\n by (simp add: step.DynCom)\n from hyp [OF this] have \"\\\\c s \\ Normal s\".\n then show ?case\n by (auto intro: terminates.intros)\nnext\n case (Guard f g c)\n have hyp: \"\\c' s'. \\\\ (Guard f g c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\g\")\n case True\n then have \"\\\\ (Guard f g c, Normal s) \\ (c, Normal s) \"\n by (simp add: step.Guard) thm step.Guard\n from hyp [OF this] have \"\\\\c\\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext \n case Throw show ?case by (auto intro: terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have hyp': \"(\\b c1. (redex (Catch c\\<^sub>1 c\\<^sub>2) = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\" by fact\n show ?case\n proof (rule terminates.Catch)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"(\\b c1. (redex c\\<^sub>1 = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c' c\\<^sub>2, s') \"\n by (simp add: step.Catch)\n from hyp [OF this]\n have \"\\\\Catch c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Catch.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using terminates_Skip' by (simp add: hyp')\n next \n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s' \\ \\\\c\\<^sub>2 \\ Normal s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s'\"\n show \"\\\\c\\<^sub>2 \\ Normal s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n with exec_c\\<^sub>1\n have Throw: \"c\\<^sub>1=Throw\"\n by (auto simp add: final_def elim: exec_Normal_elim_cases)\n have s1: \"\\\\(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n by (simp add: step.CatchThrow)\n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Throw s1 by blast \n moreover from exec_c\\<^sub>1 Throw\n have \"s'=s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n case False\n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (Throw, Normal s')\" \n by (fastforce split: xstate.splits)\n from split_computation [OF steps_c\\<^sub>1 False]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (Throw, Normal s')\" \n by (auto simp add: final_def)\n from step.Catch [OF first]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this] \n have \"\\\\Catch c'' c\\<^sub>2 \\ s''\".\n moreover\n from steps_Throw_impl_exec [OF rest]\n have \"\\\\ \\c'',s''\\ \\ Abrupt s'\".\n moreover\n from rest obtain x where \"s''=Normal x\"\n by (cases s'')\n (auto dest: steps_Fault_prop steps_Abrupt_prop steps_Stuck_prop)\n ultimately show ?thesis\n by (fastforce elim: terminates_elim_cases)\n qed\n qed\n qed\nnext\n case (Await b c) \n have hyp':\"\\ba c1. redex (Await b c) = Await ba c1 \\ \\\\c1 \\ Normal s \\ s \\ ba\" by fact \n have hyp: \"\\c' s'. \\\\ (Await b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: final_termi step_await_final1)\n have red:\"redex (Await b c) = Await b c\" by auto \n then have \"\\b1 c1. (redex (Await b c) = Await b1 c1) \\ b1=b \\ c1 = c\" by simp\n then have \" \\\\c \\ Normal s \\ s \\ b\" by (simp add: Await.prems(2))\n show ?case\n by (simp add: `\\\\c \\ Normal s \\ s \\ b` terminates.AwaitTrue) \nqed\n\n\nlemma wf_implies_termi_reach_step_case':\nassumes hyp: \"\\c' s'. \\\\ (c, Normal s) \\ (c', s')\\ \\\\c' \\ s'\" and\n hyp1:\"~(\\b c1. redex c = Await b c1)\"\nshows \"\\\\c \\ Normal s\"\nusing hyp hyp1\nproof (induct c)\n case Skip show ?case by (fastforce intro: terminates.intros)\nnext\n case Basic show ?case by (fastforce intro: terminates.intros)\nnext\n case (Spec r)\n show ?case\n by (cases \"\\t. (s,t)\\r\") (fastforce intro: terminates.intros)+\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nusing Seq.prems by blast\n have hyp': \"~(\\b c1. redex (Seq c\\<^sub>1 c\\<^sub>2) = Await b c1)\" by fact\n show ?case \n proof (rule terminates.Seq)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"~(\\b c1. redex c\\<^sub>1 = Await b c1)\" \n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c' c\\<^sub>2, s')\"\n by (simp add: step.Seq) \n from hyp [OF this]\n have \"\\\\Seq c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Seq.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\"using hyp' by force \n next\n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2 \\ s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ s'\"\n show \"\\\\c\\<^sub>2 \\ s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n hence \"c\\<^sub>1=Skip \\ c\\<^sub>1=Throw\"\n by (simp add: final_def)\n thus ?thesis\n proof\n assume Skip: \"c\\<^sub>1=Skip\"\n have s1:\"\\\\(Seq Skip c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s) \\\\ (\\b c1. Seq c\\<^sub>1 c\\<^sub>2 = Await b c1)\"\n by (simp add: step.SeqSkip) \n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Skip s1 by blast \n moreover from exec_c\\<^sub>1 Skip\n have \"s'=Normal s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n assume Throw: \"c\\<^sub>1=Throw\"\n with exec_c\\<^sub>1 have \"s'=Abrupt s\"\n by (auto elim: exec_Normal_elim_cases)\n thus ?thesis\n by auto\n qed\n next\n case False \n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (c\\<^sub>f, t)\" and\n fin:\"(case s' of\n Abrupt x \\ c\\<^sub>f = Throw \\ t = Normal x\n | _ \\ c\\<^sub>f = Skip \\ t = s')\"\n by (fastforce split: xstate.splits)\n with fin have final: \"final (c\\<^sub>f,t)\"\n by (cases s') (auto simp add: final_def)\n from split_computation [OF steps_c\\<^sub>1 False this]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (c\\<^sub>f, t)\" \n by blast\n from step.Seq [OF first]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this]\n have termi_s'': \"\\\\Seq c'' c\\<^sub>2 \\ s''\".\n show ?thesis\n proof (cases s'')\n case (Normal x)\n from termi_s'' [simplified Normal]\n have termi_c\\<^sub>2: \"\\t. \\\\ \\c'',Normal x\\ \\ t \\ \\\\c\\<^sub>2 \\ t\"\n by cases\n show ?thesis\n proof (cases \"\\x'. s'=Abrupt x'\")\n case False\n with fin obtain \"c\\<^sub>f=Skip\" \"t=s'\"\n by (cases s') auto\n from steps_Skip_impl_exec [OF rest [simplified this]] Normal\n have \"\\\\ \\c'',Normal x\\ \\ s'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this]\n show \"\\\\c\\<^sub>2 \\ s'\" .\n next\n case True\n with fin obtain x' where s': \"s'=Abrupt x'\" and \"c\\<^sub>f=Throw\" \"t=Normal x'\"\n by auto\n from steps_Throw_impl_exec [OF rest [simplified this]] Normal \n have \"\\\\ \\c'',Normal x\\ \\ Abrupt x'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this] s'\n show \"\\\\c\\<^sub>2 \\ s'\" by simp\n qed\n next\n case (Abrupt x)\n from steps_Abrupt_prop [OF rest this]\n have \"t=Abrupt x\" by simp\n with fin have \"s'=Abrupt x\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case (Fault f)\n from steps_Fault_prop [OF rest this]\n have \"t=Fault f\" by simp\n with fin have \"s'=Fault f\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case Stuck\n from steps_Stuck_prop [OF rest this]\n have \"t=Stuck\" by simp\n with fin have \"s'=Stuck\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n qed\n qed\n qed\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nby (simp add: Cond.prems(1)) \n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>1, Normal s) \"\n by (simp add: step.CondTrue) \n from hyp [OF this] have \"\\\\c\\<^sub>1 \\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>2, Normal s)\"\n by (simp add: step.CondFalse)\n from hyp [OF this] have \"\\\\c\\<^sub>2 \\ Normal s\".\n with False show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c)\n have hyp: \"\\c' s'. \\\\ (While b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (While b c, Normal s) \\ (Seq c (While b c), Normal s)\"\n by (simp add: step.WhileTrue)\n from hyp [OF this] have \"\\\\(Seq c (While b c)) \\ Normal s\".\n with True show ?thesis\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Call p)\n have hyp: \"\\c' s'. \\\\ (Call p, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: Call.prems)\n show ?case\n proof (cases \"\\ p\")\n case None\n thus ?thesis\n by (auto intro: terminates.intros)\n next\n case (Some bdy)\n then have \"\\\\ (Call p, Normal s) \\ (bdy, Normal s)\"\n by (simp add: step.Call)\n from hyp [OF this] have \"\\\\bdy \\ Normal s\".\n with Some show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (DynCom c)\n have hyp: \"\\c' s'. \\\\ (DynCom c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have \"\\\\ (DynCom c, Normal s) \\ (c s, Normal s)\"\n by (simp add: step.DynCom)\n from hyp [OF this] have \"\\\\c s \\ Normal s\".\n then show ?case\n by (auto intro: terminates.intros)\nnext\n case (Guard f g c)\n have hyp: \"\\c' s'. \\\\ (Guard f g c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\g\")\n case True\n then have \"\\\\ (Guard f g c, Normal s) \\ (c, Normal s) \"\n by (simp add: step.Guard) thm step.Guard\n from hyp [OF this] have \"\\\\c\\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext \n case Throw show ?case by (auto intro: terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have hyp': \"~(\\b c1. redex (Catch c\\<^sub>1 c\\<^sub>2) = Await b c1)\" by fact\n show ?case\n proof (rule terminates.Catch)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"~(\\b c1. redex c\\<^sub>1 = Await b c1)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c' c\\<^sub>2, s') \"\n by (simp add: step.Catch)\n from hyp [OF this]\n have \"\\\\Catch c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Catch.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using hyp' by force\n next \n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s' \\ \\\\c\\<^sub>2 \\ Normal s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s'\"\n show \"\\\\c\\<^sub>2 \\ Normal s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n with exec_c\\<^sub>1\n have Throw: \"c\\<^sub>1=Throw\"\n by (auto simp add: final_def elim: exec_Normal_elim_cases)\n have s1: \"\\\\(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n by (simp add: step.CatchThrow)\n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Throw s1 by blast \n moreover from exec_c\\<^sub>1 Throw\n have \"s'=s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n case False\n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (Throw, Normal s')\" \n by (fastforce split: xstate.splits)\n from split_computation [OF steps_c\\<^sub>1 False]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (Throw, Normal s')\" \n by (auto simp add: final_def)\n from step.Catch [OF first]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this] \n have \"\\\\Catch c'' c\\<^sub>2 \\ s''\".\n moreover\n from steps_Throw_impl_exec [OF rest]\n have \"\\\\ \\c'',s''\\ \\ Abrupt s'\".\n moreover\n from rest obtain x where \"s''=Normal x\"\n by (cases s'')\n (auto dest: steps_Fault_prop steps_Abrupt_prop steps_Stuck_prop)\n ultimately show ?thesis\n by (fastforce elim: terminates_elim_cases)\n qed\n qed\n qed\nnext\n case (Await b c) \n show ?case\n using Await.prems(2) by auto \nqed\n\n\nlemma Await_finish:\"\\c2 s2 b c. \\\\ (Await b c, s1) \\ (c2, s2) \\ \\\\c2 \\ s2\"\nby (metis Abrupt Fault Stuck final_termi step_await_final1 step_preserves_termination xstate.exhaust)\n\n \nlemma wf_implies_termi_reach:\nassumes wf: \"wf {(cfg2,cfg1). \\ \\ (c,s) \\\\<^sup>* cfg1 \\ \\ \\ cfg1 \\ cfg2}\"\nshows \"\\c1 s1. \\\\ \\ (c,s) \\\\<^sup>* cfg1; cfg1=(c1,s1)\\\\ \\\\c1\\s1\"\nusing wf \nproof (induct cfg1,simp)\n fix c1 s1\n assume reach: \"\\\\ (c, s) \\\\<^sup>* (c1, s1)\"\n assume hyp_raw: \"\\y c2 s2.\n \\\\\\ (c1, s1) \\ (c2, s2); \\\\ (c, s) \\\\<^sup>* (c2, s2); y = (c2, s2)\\\n \\ \\\\c2 \\ s2\"\n have hyp: \"\\c2 s2. \\\\ (c1, s1) \\ (c2, s2) \\ \\\\c2 \\ s2\"\n apply -\n apply (rule hyp_raw)\n apply assumption\n using reach \n apply simp\n apply (rule refl)\n done\n \n show \"\\\\c1 \\ s1\"\n proof (cases s1) \n case (Normal s1') \n with wf_implies_termi_reach_step_case' [OF hyp [simplified Normal]] \n show ?thesis\n by auto\n qed (auto intro: terminates.intros)\nqed\n\ntheorem no_infinite_computation_impl_terminates:\n assumes not_inf: \"\\ \\\\ (c, s) \\ \\(\\)\"\n shows \"\\\\c\\s\"\nproof -\n from no_infinite_computation_implies_wf [OF not_inf]\n have wf: \"wf {(c2, c1). \\\\(c, s) \\\\<^sup>* c1 \\ \\\\c1 \\ c2}\".\n show ?thesis\n by (rule wf_implies_termi_reach [OF wf]) auto\nqed\n\ncorollary terminates_iff_no_infinite_computation: \n \"\\\\c\\s = (\\ \\\\ (c, s) \\ \\(\\))\"\n apply (rule)\n apply (erule terminates_impl_no_infinite_computation)\n apply (erule no_infinite_computation_impl_terminates)\n done\n\n(* ************************************************************************* *)\nsubsection {* Generalised Redexes *} \n(* ************************************************************************* *)\n\ntext {*\nFor an important lemma for the completeness proof of the Hoare-logic for\ntotal correctness we need a generalisation of @{const \"redex\"} that not only\nyield the redex itself but all the enclosing statements as well.\n*}\n\nprimrec redexes:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com set\"\nwhere\n\"redexes Skip = {Skip}\" |\n\"redexes (Basic f) = {Basic f}\" |\n\"redexes (Spec r) = {Spec r}\" |\n\"redexes (Seq c\\<^sub>1 c\\<^sub>2) = {Seq c\\<^sub>1 c\\<^sub>2} \\ redexes c\\<^sub>1\" |\n\"redexes (Cond b c\\<^sub>1 c\\<^sub>2) = {Cond b c\\<^sub>1 c\\<^sub>2}\" |\n\"redexes (While b c) = {While b c}\" |\n\"redexes (Call p) = {Call p}\" |\n\"redexes (DynCom d) = {DynCom d}\" |\n\"redexes (Guard f b c) = {Guard f b c}\" |\n\"redexes (Throw) = {Throw}\" |\n\"redexes (Catch c\\<^sub>1 c\\<^sub>2) = {Catch c\\<^sub>1 c\\<^sub>2} \\ redexes c\\<^sub>1\" |\n\"redexes (Await b c) = {Await b c}\"\n\nlemma root_in_redexes: \"c \\ redexes c\"\n apply (induct c)\n apply auto\n done\n\nlemma redex_in_redexes: \"redex c \\ redexes c\"\n apply (induct c)\n apply auto\n done\n\nlemma redex_redexes: \"\\c'. \\c' \\ redexes c; redex c' = c'\\ \\ redex c = c'\" \n apply (induct c)\n apply auto\n done\n\nlemma step_redexes:\n shows \"\\r r'. \\\\\\(r,s) \\ (r',s'); r \\ redexes c\\ \n \\ \\c'. \\\\(c,s) \\ (c',s') \\ r' \\ redexes c'\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case Basic thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case Spec thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have \"r \\ redexes (Seq c\\<^sub>1 c\\<^sub>2)\" by fact\n hence r: \"r = Seq c\\<^sub>1 c\\<^sub>2 \\ r \\ redexes c\\<^sub>1\"\n by simp\n have step_r: \"\\\\ (r, s) \\ (r', s')\" by fact\n from r show ?case\n proof \n assume \"r = Seq c\\<^sub>1 c\\<^sub>2\"\n with step_r\n show ?case\n by (auto simp add: root_in_redexes)\n next\n assume r: \"r \\ redexes c\\<^sub>1\"\n from Seq.hyps (1) [OF step_r this] \n obtain c' where \n step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, s) \\ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n from step.Seq [OF step_c\\<^sub>1]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, s) \\ (Seq c' c\\<^sub>2, s')\".\n with r'\n show ?case\n by auto\n qed\nnext\n case Cond \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case While \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Call thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case DynCom thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Guard thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Throw thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"r \\ redexes (Catch c\\<^sub>1 c\\<^sub>2)\" by fact\n hence r: \"r = Catch c\\<^sub>1 c\\<^sub>2 \\ r \\ redexes c\\<^sub>1\"\n by simp\n have step_r: \"\\\\ (r, s) \\ (r', s')\" by fact\n from r show ?case\n proof \n assume \"r = Catch c\\<^sub>1 c\\<^sub>2\"\n with step_r\n show ?case\n by (auto simp add: root_in_redexes)\n next\n assume r: \"r \\ redexes c\\<^sub>1\"\n from Catch.hyps (1) [OF step_r this] \n obtain c' where \n step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, s) \\ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n from step.Catch [OF step_c\\<^sub>1]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, s) \\ (Catch c' c\\<^sub>2, s')\".\n with r'\n show ?case\n by auto\n qed\nnext case (Await b c) \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nqed \n\nlemma steps_redexes:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. r \\ redexes c \\ \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ r' \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then\n show \"\\c'. \\\\ (c, s') \\\\<^sup>* (c', s') \\ r' \\ redexes c'\"\n by auto\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"r \\ redexes c\" by fact+\n from step_redexes [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"r'' \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"r' \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\n\n\nlemma steps_redexes':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. r \\ redexes c \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ r' \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"r \\ redexes c'\" by fact+\n from step_redexes [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"r'' \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma step_redexes_Seq:\n assumes step: \"\\\\(r,s) \\ (r',s')\"\n assumes Seq: \"Seq r c\\<^sub>2 \\ redexes c\"\n shows \"\\c'. \\\\(c,s) \\ (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nproof -\n from step.Seq [OF step]\n have \"\\\\ (Seq r c\\<^sub>2, s) \\ (Seq r' c\\<^sub>2, s')\".\n from step_redexes [OF this Seq] \n show ?thesis .\nqed\n\nlemma steps_redexes_Seq:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. Seq r c\\<^sub>2 \\ redexes c \\ \n \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then show ?case\n by (auto)\n\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"Seq r c\\<^sub>2 \\ redexes c\" by fact+\n from step_redexes_Seq [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"Seq r'' c\\<^sub>2 \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"Seq r' c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\nlemma steps_redexes_Seq':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. Seq r c\\<^sub>2 \\ redexes c \n \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"Seq r c\\<^sub>2 \\ redexes c'\" by fact+\n from step_redexes_Seq [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"Seq r' c\\<^sub>2 \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes_Seq [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"Seq r'' c\\<^sub>2 \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma step_redexes_Catch:\n assumes step: \"\\\\(r,s) \\ (r',s')\"\n assumes Catch: \"Catch r c\\<^sub>2 \\ redexes c\"\n shows \"\\c'. \\\\(c,s) \\ (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nproof -\n from step.Catch [OF step]\n have \"\\\\ (Catch r c\\<^sub>2, s) \\ (Catch r' c\\<^sub>2, s')\".\n from step_redexes [OF this Catch] \n show ?thesis .\nqed\n\nlemma steps_redexes_Catch:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. Catch r c\\<^sub>2 \\ redexes c \\ \n \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then show ?case\n by (auto)\n\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"Catch r c\\<^sub>2 \\ redexes c\" by fact+\n from step_redexes_Catch [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"Catch r'' c\\<^sub>2 \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"Catch r' c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\nlemma steps_redexes_Catch':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. Catch r c\\<^sub>2 \\ redexes c \n \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"Catch r c\\<^sub>2 \\ redexes c'\" by fact+\n from step_redexes_Catch [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"Catch r' c\\<^sub>2 \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes_Catch [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"Catch r'' c\\<^sub>2 \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma redexes_subset:\"\\c'. c' \\ redexes c \\ redexes c' \\ redexes c\"\n by (induct c) auto\n\nlemma redexes_preserves_termination:\n assumes termi: \"\\\\c\\s\"\n shows \"\\c'. c' \\ redexes c \\ \\\\c'\\s\" \nusing termi\nby induct (auto intro: terminates.intros)\n\n*)\nend", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSimpl/SmallStepCon.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.25842338539478266}} {"text": "(* Title: HOL/Auth/Guard/Guard_Shared.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\lemmas on guarded messages for protocols with symmetric keys\\\n\ntheory Guard_Shared imports Guard GuardK \"../Shared\" begin\n\nsubsection\\Extensions to Theory \\Shared\\\\\n\ndeclare initState.simps [simp del]\n\nsubsubsection\\a little abbreviation\\\n\nabbreviation\n Ciph :: \"agent => msg => msg\" where\n \"Ciph A X == Crypt (shrK A) X\"\n\nsubsubsection\\agent associated to a key\\\n\ndefinition agt :: \"key => agent\" where\n\"agt K == SOME A. K = shrK A\"\n\nlemma agt_shrK [simp]: \"agt (shrK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection\\basic facts about \\<^term>\\initState\\\\\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X \\ parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X \\ analz (initState A)\"\nby auto\n\nlemma no_shrK_in_analz_init [simp]: \"A \\ bad\n\\ Key (shrK A) \\ analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma shrK_notin_initState_Friend [simp]: \"A \\ Friend C\n\\ Key (shrK A) \\ parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection\\sets of symmetric keys\\\n\ndefinition shrK_set :: \"key set => bool\" where\n\"shrK_set Ks \\ \\K. K \\ Ks \\ (\\A. K = shrK A)\"\n\nlemma in_shrK_set: \"[| shrK_set Ks; K \\ Ks |] ==> \\A. K = shrK A\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set1 [iff]: \"shrK_set {shrK A}\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set2 [iff]: \"shrK_set {shrK A, shrK B}\"\nby (simp add: shrK_set_def)\n\nsubsubsection\\sets of good keys\\\n\ndefinition good :: \"key set \\ bool\" where\n\"good Ks \\ \\K. K \\ Ks \\ agt K \\ bad\"\n\nlemma in_good: \"[| good Ks; K \\ Ks |] ==> agt K \\ bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A \\ bad \\ good {shrK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A \\ bad; B \\ bad |] ==> good {shrK A, shrK B}\"\nby (simp add: good_def)\n\n\nsubsection\\Proofs About Guarded Messages\\\n\nsubsubsection\\small hack\\\n\nlemma shrK_is_invKey_shrK: \"shrK A = invKey (shrK A)\"\nby simp\n\nlemmas shrK_is_invKey_shrK_substI = shrK_is_invKey_shrK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n \\ parts {X} \\ Crypt (shrK A) X \\ guard n {shrK A}\"\napply (rule shrK_is_invKey_shrK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection\\guardedness results on nonces\\\n\nlemma guard_ciph [simp]: \"shrK A \\ Ks \\ Ciph A X \\ guard n Ks\"\nby (rule Guard_Nonce, simp)\n\nlemma guardK_ciph [simp]: \"shrK A \\ Ks \\ Ciph A X \\ guardK n Ks\"\nby (rule Guard_Key, simp)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n \\ used evs\n\\ Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\guardedness results on keys\\\n\nlemma GuardK_init [simp]: \"n \\ range shrK \\ GuardK n Ks (initState B)\"\nby (induct B, auto simp: GuardK_def initState.simps)\n\nlemma GuardK_knows_max': \"[| GuardK n A (knows_max' C evs); n \\ range shrK |]\n==> GuardK n A (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Key_not_used_GuardK_spies [dest]: \"Key n \\ used evs\n\\ GuardK n A (spies evs)\"\nby (auto simp: GuardK_def dest: not_used_not_known parts_sub)\n\nlemma Key_not_used_GuardK [dest]: \"[| evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_used parts_trans)\n\nlemma Key_not_used_GuardK_max [dest]: \"[| evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_max_used parts_trans)\n\nlemma Key_not_used_GuardK_max' [dest]: \"[| evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in GuardK_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\regular protocols\\\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p \\ \\evs A. evs \\ p \\ (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\n\nlemma shrK_parts_iff_bad [simp]: \"[| evs \\ p; regular p |] ==>\n(Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\nby (auto simp: regular_def)\n\nlemma shrK_analz_iff_bad [simp]: \"[| evs \\ p; regular p |] ==>\n(Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs \\ p;\nshrK_set Ks; good Ks; regular p |] ==> Nonce n \\ analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_shrK_set, simp+, clarify)\napply (frule_tac A=A in shrK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nlemma GuardK_Key_analz:\n assumes \"GuardK n Ks (spies evs)\" \"evs \\ p\" \"shrK_set Ks\"\n \"good Ks\" \"regular p\" \"n \\ range shrK\"\n shows \"Key n \\ analz (spies evs)\"\nproof (rule ccontr)\n assume \"\\ Key n \\ analz (knows Spy evs)\"\n then have *: \"Key n \\ analz (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp)\n from \\GuardK n Ks (spies evs)\\\n have \"GuardK n Ks (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp) \n then have \"GuardK n Ks (spies' evs)\"\n and \"finite (spies' evs)\" \"keyset (initState Spy)\"\n by simp_all\n moreover have \"Key n \\ initState Spy\"\n using \\n \\ range shrK\\ by (simp add: image_iff initState_Spy)\n ultimately obtain K\n where \"K \\ Ks\" and **: \"Key K \\ analz (spies' evs \\ initState Spy)\"\n using * by (auto dest: GuardK_invKey_keyset)\n from \\K \\ Ks\\ and \\good Ks\\ have \"agt K \\ bad\"\n by (auto dest: in_good)\n from \\K \\ Ks\\ \\shrK_set Ks\\ obtain A\n where \"K = shrK A\"\n by (auto dest: in_shrK_set)\n then have \"agt K \\ bad\"\n using ** \\evs \\ p\\ \\regular p\\ shrK_analz_iff_bad [of evs p \"agt K\"]\n by (simp add: knows_decomp)\n with \\agt K \\ bad\\ show False by simp\nqed\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Guard/Guard_Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2582924724987522}} {"text": "(* Title: HOL/Auth/TLS.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1997 University of Cambridge\n\nInductive relation \"tls\" for the TLS (Transport Layer Security) protocol.\nThis protocol is essentially the same as SSL 3.0.\n\nAbstracted from \"The TLS Protocol, Version 1.0\" by Tim Dierks and Christopher\nAllen, Transport Layer Security Working Group, 21 May 1997,\nINTERNET-DRAFT draft-ietf-tls-protocol-03.txt. Section numbers below refer\nto that memo.\n\nAn RSA cryptosystem is assumed, and X.509v3 certificates are abstracted down\nto the trivial form {A, publicKey(A)}privateKey(Server), where Server is a\nglobal signing authority.\n\nA is the client and B is the server, not to be confused with the constant\nServer, who is in charge of all public keys.\n\nThe model assumes that no fraudulent certificates are present, but it does\nassume that some private keys are to the spy.\n\nREMARK. The event \"Notes A {|Agent B, Nonce PMS|}\" appears in ClientKeyExch,\nCertVerify, ClientFinished to record that A knows M. It is a note from A to\nherself. Nobody else can see it. In ClientKeyExch, the Spy can substitute\nhis own certificate for A's, but he cannot replace A's note by one for himself.\n\nThe Note event avoids a weakness in the public-key model. Each\nagent's state is recorded as the trace of messages. When the true client (A)\ninvents PMS, he encrypts PMS with B's public key before sending it. The model\ndoes not distinguish the original occurrence of such a message from a replay.\nIn the shared-key model, the ability to encrypt implies the ability to\ndecrypt, so the problem does not arise.\n\nProofs would be simpler if ClientKeyExch included A's name within\nCrypt KB (Nonce PMS). As things stand, there is much overlap between proofs\nabout that message (which B receives) and the stronger event\nNotes A {|Agent B, Nonce PMS|}.\n*)\n\nsection{*The TLS Protocol: Transport Layer Security*}\n\ntheory TLS imports Public \"~~/src/HOL/Library/Nat_Bijection\" begin\n\ndefinition certificate :: \"[agent,key] => msg\" where\n \"certificate A KA == Crypt (priSK Server) {|Agent A, Key KA|}\"\n\ntext{*TLS apparently does not require separate keypairs for encryption and\nsignature. Therefore, we formalize signature as encryption using the\nprivate encryption key.*}\n\ndatatype role = ClientRole | ServerRole\n\nconsts\n (*Pseudo-random function of Section 5*)\n PRF :: \"nat*nat*nat => nat\"\n\n (*Client, server write keys are generated uniformly by function sessionK\n to avoid duplicating their properties. They are distinguished by a\n tag (not a bool, to avoid the peculiarities of if-and-only-if).\n Session keys implicitly include MAC secrets.*)\n sessionK :: \"(nat*nat*nat) * role => key\"\n\nabbreviation\n clientK :: \"nat*nat*nat => key\" where\n \"clientK X == sessionK(X, ClientRole)\"\n\nabbreviation\n serverK :: \"nat*nat*nat => key\" where\n \"serverK X == sessionK(X, ServerRole)\"\n\n\nspecification (PRF)\n inj_PRF: \"inj PRF\"\n --{*the pseudo-random function is collision-free*}\n apply (rule exI [of _ \"%(x,y,z). prod_encode(x, prod_encode(y,z))\"])\n apply (simp add: inj_on_def prod_encode_eq)\n done\n\nspecification (sessionK)\n inj_sessionK: \"inj sessionK\"\n --{*sessionK is collision-free; also, no clientK clashes with any serverK.*}\n apply (rule exI [of _ \n \"%((x,y,z), r). prod_encode(case_role 0 1 r, \n prod_encode(x, prod_encode(y,z)))\"])\n apply (simp add: inj_on_def prod_encode_eq split: role.split) \n done\n\naxiomatization where\n --{*sessionK makes symmetric keys*}\n isSym_sessionK: \"sessionK nonces \\ symKeys\" and\n\n --{*sessionK never clashes with a long-term symmetric key \n (they don't exist in TLS anyway)*}\n sessionK_neq_shrK [iff]: \"sessionK nonces \\ shrK A\"\n\n\ninductive_set tls :: \"event list set\"\n where\n Nil: --{*The initial, empty trace*}\n \"[] \\ tls\"\n\n | Fake: --{*The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.*}\n \"[| evsf \\ tls; X \\ synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf \\ tls\"\n\n | SpyKeys: --{*The spy may apply @{term PRF} and @{term sessionK}\n to available nonces*}\n \"[| evsSK \\ tls;\n {Nonce NA, Nonce NB, Nonce M} <= analz (spies evsSK) |]\n ==> Notes Spy {| Nonce (PRF(M,NA,NB)),\n Key (sessionK((NA,NB,M),role)) |} # evsSK \\ tls\"\n\n | ClientHello:\n --{*(7.4.1.2)\n PA represents @{text CLIENT_VERSION}, @{text CIPHER_SUITES} and @{text COMPRESSION_METHODS}.\n It is uninterpreted but will be confirmed in the FINISHED messages.\n NA is CLIENT RANDOM, while SID is @{text SESSION_ID}.\n UNIX TIME is omitted because the protocol doesn't use it.\n May assume @{term \"NA \\ range PRF\"} because CLIENT RANDOM is \n 28 bytes while MASTER SECRET is 48 bytes*}\n \"[| evsCH \\ tls; Nonce NA \\ used evsCH; NA \\ range PRF |]\n ==> Says A B {|Agent A, Nonce NA, Number SID, Number PA|}\n # evsCH \\ tls\"\n\n | ServerHello:\n --{*7.4.1.3 of the TLS Internet-Draft\n PB represents @{text CLIENT_VERSION}, @{text CIPHER_SUITE} and @{text COMPRESSION_METHOD}.\n SERVER CERTIFICATE (7.4.2) is always present.\n @{text CERTIFICATE_REQUEST} (7.4.4) is implied.*}\n \"[| evsSH \\ tls; Nonce NB \\ used evsSH; NB \\ range PRF;\n Says A' B {|Agent A, Nonce NA, Number SID, Number PA|}\n \\ set evsSH |]\n ==> Says B A {|Nonce NB, Number SID, Number PB|} # evsSH \\ tls\"\n\n | Certificate:\n --{*SERVER (7.4.2) or CLIENT (7.4.6) CERTIFICATE.*}\n \"evsC \\ tls ==> Says B A (certificate B (pubK B)) # evsC \\ tls\"\n\n | ClientKeyExch:\n --{*CLIENT KEY EXCHANGE (7.4.7).\n The client, A, chooses PMS, the PREMASTER SECRET.\n She encrypts PMS using the supplied KB, which ought to be pubK B.\n We assume @{term \"PMS \\ range PRF\"} because a clash betweem the PMS\n and another MASTER SECRET is highly unlikely (even though\n both items have the same length, 48 bytes).\n The Note event records in the trace that she knows PMS\n (see REMARK at top). *}\n \"[| evsCX \\ tls; Nonce PMS \\ used evsCX; PMS \\ range PRF;\n Says B' A (certificate B KB) \\ set evsCX |]\n ==> Says A B (Crypt KB (Nonce PMS))\n # Notes A {|Agent B, Nonce PMS|}\n # evsCX \\ tls\"\n\n | CertVerify:\n --{*The optional Certificate Verify (7.4.8) message contains the\n specific components listed in the security analysis, F.1.1.2.\n It adds the pre-master-secret, which is also essential!\n Checking the signature, which is the only use of A's certificate,\n assures B of A's presence*}\n \"[| evsCV \\ tls;\n Says B' A {|Nonce NB, Number SID, Number PB|} \\ set evsCV;\n Notes A {|Agent B, Nonce PMS|} \\ set evsCV |]\n ==> Says A B (Crypt (priK A) (Hash{|Nonce NB, Agent B, Nonce PMS|}))\n # evsCV \\ tls\"\n\n --{*Finally come the FINISHED messages (7.4.8), confirming PA and PB\n among other things. The master-secret is PRF(PMS,NA,NB).\n Either party may send its message first.*}\n\n | ClientFinished:\n --{*The occurrence of Notes A {|Agent B, Nonce PMS|} stops the\n rule's applying when the Spy has satisfied the \"Says A B\" by\n repaying messages sent by the true client; in that case, the\n Spy does not know PMS and could not send ClientFinished. One\n could simply put @{term \"A\\Spy\"} into the rule, but one should not\n expect the spy to be well-behaved.*}\n \"[| evsCF \\ tls;\n Says A B {|Agent A, Nonce NA, Number SID, Number PA|}\n \\ set evsCF;\n Says B' A {|Nonce NB, Number SID, Number PB|} \\ set evsCF;\n Notes A {|Agent B, Nonce PMS|} \\ set evsCF;\n M = PRF(PMS,NA,NB) |]\n ==> Says A B (Crypt (clientK(NA,NB,M))\n (Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|}))\n # evsCF \\ tls\"\n\n | ServerFinished:\n --{*Keeping A' and A'' distinct means B cannot even check that the\n two messages originate from the same source. *}\n \"[| evsSF \\ tls;\n Says A' B {|Agent A, Nonce NA, Number SID, Number PA|}\n \\ set evsSF;\n Says B A {|Nonce NB, Number SID, Number PB|} \\ set evsSF;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSF;\n M = PRF(PMS,NA,NB) |]\n ==> Says B A (Crypt (serverK(NA,NB,M))\n (Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|}))\n # evsSF \\ tls\"\n\n | ClientAccepts:\n --{*Having transmitted ClientFinished and received an identical\n message encrypted with serverK, the client stores the parameters\n needed to resume this session. The \"Notes A ...\" premise is\n used to prove @{text Notes_master_imp_Crypt_PMS}.*}\n \"[| evsCA \\ tls;\n Notes A {|Agent B, Nonce PMS|} \\ set evsCA;\n M = PRF(PMS,NA,NB);\n X = Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|};\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evsCA;\n Says B' A (Crypt (serverK(NA,NB,M)) X) \\ set evsCA |]\n ==>\n Notes A {|Number SID, Agent A, Agent B, Nonce M|} # evsCA \\ tls\"\n\n | ServerAccepts:\n --{*Having transmitted ServerFinished and received an identical\n message encrypted with clientK, the server stores the parameters\n needed to resume this session. The \"Says A'' B ...\" premise is\n used to prove @{text Notes_master_imp_Crypt_PMS}.*}\n \"[| evsSA \\ tls;\n A \\ B;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSA;\n M = PRF(PMS,NA,NB);\n X = Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|};\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evsSA;\n Says A' B (Crypt (clientK(NA,NB,M)) X) \\ set evsSA |]\n ==>\n Notes B {|Number SID, Agent A, Agent B, Nonce M|} # evsSA \\ tls\"\n\n | ClientResume:\n --{*If A recalls the @{text SESSION_ID}, then she sends a FINISHED\n message using the new nonces and stored MASTER SECRET.*}\n \"[| evsCR \\ tls;\n Says A B {|Agent A, Nonce NA, Number SID, Number PA|}: set evsCR;\n Says B' A {|Nonce NB, Number SID, Number PB|} \\ set evsCR;\n Notes A {|Number SID, Agent A, Agent B, Nonce M|} \\ set evsCR |]\n ==> Says A B (Crypt (clientK(NA,NB,M))\n (Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|}))\n # evsCR \\ tls\"\n\n | ServerResume:\n --{*Resumption (7.3): If B finds the @{text SESSION_ID} then he can \n send a FINISHED message using the recovered MASTER SECRET*}\n \"[| evsSR \\ tls;\n Says A' B {|Agent A, Nonce NA, Number SID, Number PA|}: set evsSR;\n Says B A {|Nonce NB, Number SID, Number PB|} \\ set evsSR;\n Notes B {|Number SID, Agent A, Agent B, Nonce M|} \\ set evsSR |]\n ==> Says B A (Crypt (serverK(NA,NB,M))\n (Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|})) # evsSR\n \\ tls\"\n\n | Oops:\n --{*The most plausible compromise is of an old session key. Losing\n the MASTER SECRET or PREMASTER SECRET is more serious but\n rather unlikely. The assumption @{term \"A\\Spy\"} is essential: \n otherwise the Spy could learn session keys merely by \n replaying messages!*}\n \"[| evso \\ tls; A \\ Spy;\n Says A B (Crypt (sessionK((NA,NB,M),role)) X) \\ set evso |]\n ==> Says A Spy (Key (sessionK((NA,NB,M),role))) # evso \\ tls\"\n\n(*\nProtocol goals:\n* M, serverK(NA,NB,M) and clientK(NA,NB,M) will be known only to the two\n parties (though A is not necessarily authenticated).\n\n* B upon receiving CertVerify knows that A is present (But this\n message is optional!)\n\n* A upon receiving ServerFinished knows that B is present\n\n* Each party who has received a FINISHED message can trust that the other\n party agrees on all message components, including PA and PB (thus foiling\n rollback attacks).\n*)\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\ntext{*Automatically unfold the definition of \"certificate\"*}\ndeclare certificate_def [simp]\n\ntext{*Injectiveness of key-generating functions*}\ndeclare inj_PRF [THEN inj_eq, iff]\ndeclare inj_sessionK [THEN inj_eq, iff]\ndeclare isSym_sessionK [simp]\n\n\n(*** clientK and serverK make symmetric keys; no clashes with pubK or priK ***)\n\nlemma pubK_neq_sessionK [iff]: \"publicKey b A \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare pubK_neq_sessionK [THEN not_sym, iff]\n\nlemma priK_neq_sessionK [iff]: \"invKey (publicKey b A) \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare priK_neq_sessionK [THEN not_sym, iff]\n\nlemmas keys_distinct = pubK_neq_sessionK priK_neq_sessionK\n\n\nsubsection{*Protocol Proofs*}\n\ntext{*Possibility properties state that some traces run the protocol to the\nend. Four paths and 12 rules are considered.*}\n\n\n(** These proofs assume that the Nonce_supply nonces\n (which have the form @ N. Nonce N \\ used evs)\n lie outside the range of PRF. It seems reasonable, but as it is needed\n only for the possibility theorems, it is not taken as an axiom.\n**)\n\n\ntext{*Possibility property ending with ClientAccepts.*}\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\SID M. \\evs \\ tls.\n Notes A {|Number SID, Agent A, Agent B, Nonce M|} \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ClientFinished, THEN tls.ServerFinished,\n THEN tls.ClientAccepts], possibility, blast+)\ndone\n\n\ntext{*And one for ServerAccepts. Either FINISHED message may come first.*}\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\SID NA PA NB PB M. \\evs \\ tls.\n Notes B {|Number SID, Agent A, Agent B, Nonce M|} \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ServerFinished, THEN tls.ClientFinished, \n THEN tls.ServerAccepts], possibility, blast+)\ndone\n\n\ntext{*Another one, for CertVerify (which is optional)*}\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\NB PMS. \\evs \\ tls.\n Says A B (Crypt (priK A) (Hash{|Nonce NB, Agent B, Nonce PMS|})) \n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.CertVerify], possibility, blast+)\ndone\n\n\ntext{*Another one, for session resumption (both ServerResume and ClientResume).\n NO tls.Nil here: we refer to a previous session, not the empty trace.*}\nlemma \"[| evs0 \\ tls;\n Notes A {|Number SID, Agent A, Agent B, Nonce M|} \\ set evs0;\n Notes B {|Number SID, Agent A, Agent B, Nonce M|} \\ set evs0;\n \\evs. (@ N. Nonce N \\ used evs) \\ range PRF;\n A \\ B |]\n ==> \\NA PA NB PB X. \\evs \\ tls.\n X = Hash{|Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B|} &\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evs &\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.ClientHello\n [THEN tls.ServerHello,\n THEN tls.ServerResume, THEN tls.ClientResume], possibility, blast+)\ndone\n\n\nsubsection{*Inductive proofs about tls*}\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\ntext{*Spy never sees a good agent's private key!*}\nlemma Spy_see_priK [simp]:\n \"evs \\ tls ==> (Key (privateKey b A) \\ parts (spies evs)) = (A \\ bad)\"\nby (erule tls.induct, force, simp_all, blast)\n\nlemma Spy_analz_priK [simp]:\n \"evs \\ tls ==> (Key (privateKey b A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_priK_D [dest!]:\n \"[|Key (privateKey b A) \\ parts (knows Spy evs); evs \\ tls|] ==> A \\ bad\"\nby (blast dest: Spy_see_priK)\n\n\ntext{*This lemma says that no false certificates exist. One might extend the\n model to include bogus certificates for the agents, but there seems\n little point in doing so: the loss of their private keys is a worse\n breach of security.*}\nlemma certificate_valid:\n \"[| certificate B KB \\ parts (spies evs); evs \\ tls |] ==> KB = pubK B\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast) \ndone\n\nlemmas CX_KB_is_pubKB = Says_imp_spies [THEN parts.Inj, THEN certificate_valid]\n\n\nsubsubsection{*Properties of items found in Notes*}\n\nlemma Notes_Crypt_parts_spies:\n \"[| Notes A {|Agent B, X|} \\ set evs; evs \\ tls |]\n ==> Crypt (pubK B) X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, \n frule_tac [7] CX_KB_is_pubKB, force, simp_all)\napply (blast intro: parts_insertI)\ndone\n\ntext{*C may be either A or B*}\nlemma Notes_master_imp_Crypt_PMS:\n \"[| Notes C {|s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))|} \\ set evs;\n evs \\ tls |]\n ==> Crypt (pubK B) (Nonce PMS) \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt{*Fake*}\napply (blast intro: parts_insertI)\ntxt{*Client, Server Accept*}\napply (blast dest!: Notes_Crypt_parts_spies)+\ndone\n\ntext{*Compared with the theorem above, both premise and conclusion are stronger*}\nlemma Notes_master_imp_Notes_PMS:\n \"[| Notes A {|s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))|} \\ set evs;\n evs \\ tls |]\n ==> Notes A {|Agent B, Nonce PMS|} \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt{*ServerAccepts*}\napply blast\ndone\n\n\nsubsubsection{*Protocol goal: if B receives CertVerify, then A sent it*}\n\ntext{*B can check A's signature if he has received A's certificate.*}\nlemma TrustCertVerify_lemma:\n \"[| X \\ parts (spies evs);\n X = Crypt (priK A) (Hash{|nb, Agent B, pms|});\n evs \\ tls; A \\ bad |]\n ==> Says A B X \\ set evs\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext{*Final version: B checks X using the distributed KA instead of priK A*}\nlemma TrustCertVerify:\n \"[| X \\ parts (spies evs);\n X = Crypt (invKey KA) (Hash{|nb, Agent B, pms|});\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Says A B X \\ set evs\"\nby (blast dest!: certificate_valid intro!: TrustCertVerify_lemma)\n\n\ntext{*If CertVerify is present then A has chosen PMS.*}\nlemma UseCertVerify_lemma:\n \"[| Crypt (priK A) (Hash{|nb, Agent B, Nonce PMS|}) \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Notes A {|Agent B, Nonce PMS|} \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext{*Final version using the distributed KA instead of priK A*}\nlemma UseCertVerify:\n \"[| Crypt (invKey KA) (Hash{|nb, Agent B, Nonce PMS|})\n \\ parts (spies evs);\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Notes A {|Agent B, Nonce PMS|} \\ set evs\"\nby (blast dest!: certificate_valid intro!: UseCertVerify_lemma)\n\n\nlemma no_Notes_A_PRF [simp]:\n \"evs \\ tls ==> Notes A {|Agent B, Nonce (PRF x)|} \\ set evs\"\napply (erule tls.induct, force, simp_all)\ntxt{*ClientKeyExch: PMS is assumed to differ from any PRF.*}\napply blast\ndone\n\n\nlemma MS_imp_PMS [dest!]:\n \"[| Nonce (PRF (PMS,NA,NB)) \\ parts (spies evs); evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt{*Fake*}\napply (blast intro: parts_insertI)\ntxt{*Easy, e.g. by freshness*}\napply (blast dest: Notes_Crypt_parts_spies)+\ndone\n\n\n\n\nsubsubsection{*Unicity results for PMS, the pre-master-secret*}\n\ntext{*PMS determines B.*}\nlemma Crypt_unique_PMS:\n \"[| Crypt(pubK B) (Nonce PMS) \\ parts (spies evs);\n Crypt(pubK B') (Nonce PMS) \\ parts (spies evs);\n Nonce PMS \\ analz (spies evs);\n evs \\ tls |]\n ==> B=B'\"\napply (erule rev_mp, erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra, force, simp_all (no_asm_simp))\ntxt{*Fake, ClientKeyExch*}\napply blast+\ndone\n\n\n(** It is frustrating that we need two versions of the unicity results.\n But Notes A {|Agent B, Nonce PMS|} determines both A and B. Sometimes\n we have only the weaker assertion Crypt(pubK B) (Nonce PMS), which\n determines B alone, and only if PMS is secret.\n**)\n\ntext{*In A's internal Note, PMS determines A and B.*}\nlemma Notes_unique_PMS:\n \"[| Notes A {|Agent B, Nonce PMS|} \\ set evs;\n Notes A' {|Agent B', Nonce PMS|} \\ set evs;\n evs \\ tls |]\n ==> A=A' & B=B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt{*ClientKeyExch*}\napply (blast dest!: Notes_Crypt_parts_spies)\ndone\n\n\nsubsection{*Secrecy Theorems*}\n\ntext{*Key compromise lemma needed to prove @{term analz_image_keys}.\n No collection of keys can help the spy get new private keys.*}\nlemma analz_image_priK [rule_format]:\n \"evs \\ tls\n ==> \\KK. (Key(priK B) \\ analz (Key`KK Un (spies evs))) =\n (priK B \\ KK | B \\ bad)\"\napply (erule tls.induct)\napply (simp_all (no_asm_simp)\n del: image_insert\n add: image_Un [THEN sym]\n insert_Key_image Un_assoc [THEN sym])\ntxt{*Fake*}\napply spy_analz\ndone\n\n\ntext{*slightly speeds up the big simplification below*}\nlemma range_sessionkeys_not_priK:\n \"KK <= range sessionK ==> priK B \\ KK\"\nby blast\n\n\ntext{*Lemma for the trivial direction of the if-and-only-if*}\nlemma analz_image_keys_lemma:\n \"(X \\ analz (G Un H)) --> (X \\ analz H) ==>\n (X \\ analz (G Un H)) = (X \\ analz H)\"\nby (blast intro: analz_mono [THEN subsetD])\n\n(** Strangely, the following version doesn't work:\n\\Z. (Nonce N \\ analz (Key`(sessionK`Z) Un (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\n**)\n\nlemma analz_image_keys [rule_format]:\n \"evs \\ tls ==>\n \\KK. KK <= range sessionK -->\n (Nonce N \\ analz (Key`KK Un (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (safe del: iffI)\napply (safe del: impI iffI intro!: analz_image_keys_lemma)\napply (simp_all (no_asm_simp) (*faster*)\n del: image_insert imp_disjL (*reduces blow-up*)\n add: image_Un [THEN sym] Un_assoc [THEN sym]\n insert_Key_singleton\n range_sessionkeys_not_priK analz_image_priK)\napply (simp_all add: insert_absorb)\ntxt{*Fake*}\napply spy_analz\ndone\n\ntext{*Knowing some session keys is no help in getting new nonces*}\nlemma analz_insert_key [simp]:\n \"evs \\ tls ==>\n (Nonce N \\ analz (insert (Key (sessionK z)) (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\nby (simp del: image_insert\n add: insert_Key_singleton analz_image_keys)\n\n\nsubsubsection{*Protocol goal: serverK(Na,Nb,M) and clientK(Na,Nb,M) remain secure*}\n\n(** Some lemmas about session keys, comprising clientK and serverK **)\n\n\ntext{*Lemma: session keys are never used if PMS is fresh.\n Nonces don't have to agree, allowing session resumption.\n Converse doesn't hold; revealing PMS doesn't force the keys to be sent.\n THEY ARE NOT SUITABLE AS SAFE ELIM RULES.*}\nlemma PMS_lemma:\n \"[| Nonce PMS \\ parts (spies evs);\n K = sessionK((Na, Nb, PRF(PMS,NA,NB)), role);\n evs \\ tls |]\n ==> Key K \\ parts (spies evs) & (\\Y. Crypt K Y \\ parts (spies evs))\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB) \napply (force, simp_all (no_asm_simp))\ntxt{*Fake*}\napply (blast intro: parts_insertI)\ntxt{*SpyKeys*}\napply blast\ntxt{*Many others*}\napply (force dest!: Notes_Crypt_parts_spies Notes_master_imp_Crypt_PMS)+\ndone\n\nlemma PMS_sessionK_not_spied:\n \"[| Key (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) \\ parts (spies evs);\n evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\nlemma PMS_Crypt_sessionK_not_spied:\n \"[| Crypt (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) Y\n \\ parts (spies evs); evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\ntext{*Write keys are never sent if M (MASTER SECRET) is secure.\n Converse fails; betraying M doesn't force the keys to be sent!\n The strong Oops condition can be weakened later by unicity reasoning,\n with some effort.\n NO LONGER USED: see @{text clientK_not_spied} and @{text serverK_not_spied}*}\nlemma sessionK_not_spied:\n \"[| \\A. Says A Spy (Key (sessionK((NA,NB,M),role))) \\ set evs;\n Nonce M \\ analz (spies evs); evs \\ tls |]\n ==> Key (sessionK((NA,NB,M),role)) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake, SpyKeys*}\napply blast+\ndone\n\n\ntext{*If A sends ClientKeyExch to an honest B, then the PMS will stay secret.*}\nlemma Spy_not_see_PMS:\n \"[| Notes A {|Agent B, Nonce PMS|} \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Nonce PMS \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake*}\napply spy_analz\ntxt{*SpyKeys*}\napply force\napply (simp_all add: insert_absorb) \ntxt{*ClientHello, ServerHello, ClientKeyExch: mostly freshness reasoning*}\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\ntxt{*ClientAccepts and ServerAccepts: because @{term \"PMS \\ range PRF\"}*}\napply force+\ndone\n\n\ntext{*If A sends ClientKeyExch to an honest B, then the MASTER SECRET\n will stay secret.*}\nlemma Spy_not_see_MS:\n \"[| Notes A {|Agent B, Nonce PMS|} \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Nonce (PRF(PMS,NA,NB)) \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake*}\napply spy_analz\ntxt{*SpyKeys: by secrecy of the PMS, Spy cannot make the MS*}\napply (blast dest!: Spy_not_see_PMS)\napply (simp_all add: insert_absorb)\ntxt{*ClientAccepts and ServerAccepts: because PMS was already visible;\n others, freshness etc.*}\napply (blast dest: Notes_Crypt_parts_spies Spy_not_see_PMS \n Notes_imp_knows_Spy [THEN analz.Inj])+\ndone\n\n\n\nsubsubsection{*Weakening the Oops conditions for leakage of clientK*}\n\ntext{*If A created PMS then nobody else (except the Spy in replays)\n would send a message using a clientK generated from that PMS.*}\nlemma Says_clientK_unique:\n \"[| Says A' B' (Crypt (clientK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A {|Agent B, Nonce PMS|} \\ set evs;\n evs \\ tls; A' \\ Spy |]\n ==> A = A'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt{*ClientFinished, ClientResume: by unicity of PMS*}\napply (blast dest!: Notes_master_imp_Notes_PMS \n intro: Notes_unique_PMS [THEN conjunct1])+\ndone\n\n\ntext{*If A created PMS and has not leaked her clientK to the Spy,\n then it is completely secure: not even in parts!*}\nlemma clientK_not_spied:\n \"[| Notes A {|Agent B, Nonce PMS|} \\ set evs;\n Says A Spy (Key (clientK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad;\n evs \\ tls |]\n ==> Key (clientK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*ClientKeyExch*}\napply blast \ntxt{*SpyKeys*}\napply (blast dest!: Spy_not_see_MS)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_sessionK_not_spied)\ntxt{*Oops*}\napply (blast intro: Says_clientK_unique)\ndone\n\n\nsubsubsection{*Weakening the Oops conditions for leakage of serverK*}\n\ntext{*If A created PMS for B, then nobody other than B or the Spy would\n send a message using a serverK generated from that PMS.*}\nlemma Says_serverK_unique:\n \"[| Says B' A' (Crypt (serverK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A {|Agent B, Nonce PMS|} \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad; B' \\ Spy |]\n ==> B = B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt{*ServerResume, ServerFinished: by unicity of PMS*}\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\ntext{*If A created PMS for B, and B has not leaked his serverK to the Spy,\n then it is completely secure: not even in parts!*}\nlemma serverK_not_spied:\n \"[| Notes A {|Agent B, Nonce PMS|} \\ set evs;\n Says B Spy (Key(serverK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad; evs \\ tls |]\n ==> Key (serverK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake*}\napply blast \ntxt{*SpyKeys*}\napply (blast dest!: Spy_not_see_MS)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_sessionK_not_spied)\ntxt{*Oops*}\napply (blast intro: Says_serverK_unique)\ndone\n\n\nsubsubsection{*Protocol goals: if A receives ServerFinished, then B is present\n and has used the quoted values PA, PB, etc. Note that it is up to A\n to compare PA with what she originally sent.*}\n\ntext{*The mention of her name (A) in X assures A that B knows who she is.*}\nlemma TrustServerFinished [rule_format]:\n \"[| X = Crypt (serverK(Na,Nb,M))\n (Hash{|Number SID, Nonce M,\n Nonce Na, Number PA, Agent A,\n Nonce Nb, Number PB, Agent B|});\n M = PRF(PMS,NA,NB);\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs -->\n Notes A {|Agent B, Nonce PMS|} \\ set evs -->\n X \\ parts (spies evs) --> Says B A X \\ set evs\"\napply (erule ssubst)+\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake: the Spy doesn't have the critical session key!*}\napply (blast dest: serverK_not_spied)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ndone\n\ntext{*This version refers not to ServerFinished but to any message from B.\n We don't assume B has received CertVerify, and an intruder could\n have changed A's identity in all other messages, so we can't be sure\n that B sends his message to A. If CLIENT KEY EXCHANGE were augmented\n to bind A's identity with PMS, then we could replace A' by A below.*}\nlemma TrustServerMsg [rule_format]:\n \"[| M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs -->\n Notes A {|Agent B, Nonce PMS|} \\ set evs -->\n Crypt (serverK(Na,Nb,M)) Y \\ parts (spies evs) -->\n (\\A'. Says B A' (Crypt (serverK(Na,Nb,M)) Y) \\ set evs)\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp) add: ex_disj_distrib)\ntxt{*Fake: the Spy doesn't have the critical session key!*}\napply (blast dest: serverK_not_spied)\ntxt{*ClientKeyExch*}\napply (clarify, blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt{*ServerResume, ServerFinished: by unicity of PMS*}\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\nsubsubsection{*Protocol goal: if B receives any message encrypted with clientK\n then A has sent it*}\n\ntext{*ASSUMING that A chose PMS. Authentication is\n assumed here; B cannot verify it. But if the message is\n ClientFinished, then B can then check the quoted values PA, PB, etc.*}\n\nlemma TrustClientMsg [rule_format]:\n \"[| M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs -->\n Notes A {|Agent B, Nonce PMS|} \\ set evs -->\n Crypt (clientK(Na,Nb,M)) Y \\ parts (spies evs) -->\n Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt{*Fake: the Spy doesn't have the critical session key!*}\napply (blast dest: clientK_not_spied)\ntxt{*ClientKeyExch*}\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt{*ClientFinished, ClientResume: by unicity of PMS*}\napply (blast dest!: Notes_master_imp_Notes_PMS dest: Notes_unique_PMS)+\ndone\n\n\nsubsubsection{*Protocol goal: if B receives ClientFinished, and if B is able to\n check a CertVerify from A, then A has used the quoted\n values PA, PB, etc. Even this one requires A to be uncompromised.*}\nlemma AuthClientFinished:\n \"[| M = PRF(PMS,NA,NB);\n Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs;\n Says A' B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs;\n certificate A KA \\ parts (spies evs);\n Says A'' B (Crypt (invKey KA) (Hash{|nb, Agent B, Nonce PMS|}))\n \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\nby (blast intro!: TrustClientMsg UseCertVerify)\n\n(*22/9/97: loads in 622s, which is 10 minutes 22 seconds*)\n(*24/9/97: loads in 672s, which is 11 minutes 12 seconds [stronger theorems]*)\n(*29/9/97: loads in 481s, after removing Certificate from ClientKeyExch*)\n(*30/9/97: loads in 476s, after removing unused theorems*)\n(*30/9/97: loads in 448s, after fixing ServerResume*)\n\n(*08/9/97: loads in 189s (pike), after much reorganization,\n back to 621s on albatross?*)\n\n(*10/2/99: loads in 139s (pike)\n down to 433s on albatross*)\n\n(*5/5/01: conversion to Isar script\n loads in 137s (perch)\n the last ML version loaded in 122s on perch, a 600MHz machine:\n twice as fast as pike. No idea why it's so much slower!\n The Isar script is slower still, perhaps because simp_all simplifies\n the assumptions be default.\n*)\n\n(*20/11/11: loads in 5.8s elapses time, 9.3s CPU time on dual-core laptop*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/TLS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943805178139, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.2582370552716372}} {"text": "theory SafeSubRename\n imports WTLemma SubstExp\nbegin\n \n\ndefinition rename_use_env where\n \"rename_use_env r_s x y = (add_use_env (rem_use_env r_s x) y (r_s x))\" \n \nlemma rename_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\\n leq_use_env (rename_use_env r_x x y) (rename_use_env r_s x y)\"\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: rem_use_env_def)\n done\n \nlemma rename_ereq_use_env: \"ereq_use_env y tau = rename_use_env (ereq_use_env x tau) x y\"\n apply (case_tac \"\\ x'. ereq_use_env y tau x' = rename_use_env (ereq_use_env x tau) x y x'\")\n apply (auto)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_ereq_use_env2: \"\\ z \\ x ; z \\ y\\ \\ ereq_use_env z tau = rename_use_env (ereq_use_env z tau) x y\" \n apply (case_tac \"\\ x'. ereq_use_env z tau x' = rename_use_env (ereq_use_env z tau) x y x'\")\n apply (auto)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"z = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done \n \nlemma rename_req_use_env: \"req_use_env y tau = rename_use_env (req_use_env x tau) x y\"\n apply (case_tac \"\\ x'. req_use_env y tau x' = rename_use_env (req_use_env x tau) x y x'\")\n apply (auto)\n apply (simp add: req_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_req_use_env2: \"\\ z \\ x ; z \\ y\\ \\ req_use_env z tau = rename_use_env (req_use_env z tau) x y\" \n apply (case_tac \"\\ x'. req_use_env z tau x' = rename_use_env (req_use_env z tau) x y x'\")\n apply (auto)\n apply (simp add: req_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"z = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_add_use_env: \"add_use_env (rename_use_env r_s x y) y r = rename_use_env (add_use_env r_s x r) x y\" \n apply (case_tac \"\\ x'. add_use_env (rename_use_env r_s x y) y r x' = rename_use_env (add_use_env r_s x r) x y x'\")\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def) \n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n\nlemma rename_add_use_env2: \"\\ z \\ x; z \\ y \\ \\ add_use_env (rename_use_env r_s x y) z r = rename_use_env (add_use_env r_s z r) x y\" \n apply (case_tac \"\\ x'. add_use_env (rename_use_env r_s x y) z r x' = rename_use_env (add_use_env r_s z r) x y x'\") \n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def) \n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"z = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_add_use_env3: \"\\ r_s x = NoPerm \\ \\ add_use_env r_s y r = rename_use_env (add_use_env r_s x r) x y\"\n apply (case_tac \"\\ x'. add_use_env r_s y r x' = rename_use_env (add_use_env r_s x r) x y x'\")\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_comp_use_env: \"comp_use_env (rename_use_env r_x x y) (rename_use_env r_s x y) = rename_use_env (comp_use_env r_x r_s) x y\" \n apply (case_tac \"\\ x'. comp_use_env (rename_use_env r_x x y) (rename_use_env r_s x y) x' = rename_use_env (comp_use_env r_x r_s) x y x'\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_diff_use_env: \"diff_use_env (rename_use_env r_x x y) (rename_use_env r_s x y) = rename_use_env (diff_use_env r_x r_s) x y\" \n apply (case_tac \"\\ x'. diff_use_env (rename_use_env r_x x y) (rename_use_env r_s x y) x' = rename_use_env (diff_use_env r_x r_s) x y x'\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma rename_lift_use_env: \"lift_use_env (rename_use_env r_s x y) r = rename_use_env (lift_use_env r_s r) x y\" \n apply (case_tac \"\\ x'. lift_use_env (rename_use_env r_s x y) r x' = rename_use_env (lift_use_env r_s r) x y x'\")\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = x'\")\n apply (auto)\n done\n \nlemma aff_rename_use_env: \"\\ aff_use_env r_s a \\ \\ aff_use_env (rename_use_env r_s x y) a\" \n apply (simp add: aff_use_env_def)\n apply (case_tac a)\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = xa\")\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: null_use_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: rem_use_env_def)\n done\n (*\nlemma safe_lift_rename_use_env: \"\\ safe_use_lift r_s r \\ \\ safe_use_lift (rename_use_env r_s x y) r\"\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac r)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"x = xa\")\n apply (auto)\n done*)\n\nlemma disj_rename_use_env: \"\\ disj_use_env r_x r_s \\ \\ disj_use_env (rename_use_env r_x x y) (rename_use_env r_s x y)\"\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (auto)\n done\n \n \nlemma artp_var_case1: \"\\y \\ x; add_env env (Var x) t (Var x) = Some tau_x; leq_use_env (ereq_use_env (Var x) tau_x) r_s1;\n leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x) tau_x) r_ex)); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (diff_use_env (ereq_use_env (Var x) tau_x) (comp_use_env (ereq_use_env (Var x) tau_x) r_ex)) rx\\\n \\ \\r_ex tau_x.\n add_env env (Var y) t (Var y) = Some tau_x \\\n leq_use_env (ereq_use_env (Var y) tau_x) (rename_use_env r_s1 (Var x) (Var y)) \\\n leq_use_env (rename_use_env r_s2 (Var x) (Var y))\n (diff_use_env (rename_use_env r_s1 (Var x) (Var y)) (comp_use_env (ereq_use_env (Var y) tau_x) r_ex)) \\\n leq_use_env (rename_use_env rx (Var x) (Var y)) (rename_use_env r_s2 (Var x) (Var y)) \\\n leq_use_env r_ex (rename_use_env r_s1 (Var x) (Var y)) \\\n leq_use_env (diff_use_env (ereq_use_env (Var y) tau_x) (comp_use_env (ereq_use_env (Var y) tau_x) r_ex)) (rename_use_env rx (Var x) (Var y))\"\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"\\ leq_perm (end_req_perm tau_x) (r_s1 (Var x))\")\n apply (cut_tac r_x=\"ereq_use_env (Var x) tau_x\" and r_s=\"r_s1\" and x=\"Var x\" in spec_leq_perm)\n apply (simp)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (cut_tac x=\"Var x\" and y=\"Var y\" and tau=\"tau_x\" in rename_ereq_use_env)\n apply (simp)\n apply (case_tac \"\\ comp_use_env (ereq_use_env (Var y) tau_x) (rename_use_env r_ex (Var x) (Var y)) =\n rename_use_env (comp_use_env (ereq_use_env (Var x) tau_x) r_ex) (Var x) (Var y)\")\n apply (cut_tac r_x=\"ereq_use_env (Var x) tau_x\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (simp)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s1\" and r_s=\"comp_use_env (ereq_use_env (Var x) tau_x) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"ereq_use_env (Var x) tau_x\" and r_s=\"comp_use_env (ereq_use_env (Var x) tau_x) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n done\n\n \nlemma artp_var_case2: \"\\Var y \\ xa; add_env env (Var x) t xa = Some tau_x; leq_use_env (ereq_use_env xa tau_x) r_s1;\n leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env xa tau_x) r_ex)); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (diff_use_env (ereq_use_env xa tau_x) (comp_use_env (ereq_use_env xa tau_x) r_ex)) rx; Var x \\ xa\\\n \\ leq_use_env (ereq_use_env xa tau_x) (rename_use_env r_s1 (Var x) (Var y)) \\\n (\\r_ex. leq_use_env (rename_use_env r_s2 (Var x) (Var y))\n (diff_use_env (rename_use_env r_s1 (Var x) (Var y)) (comp_use_env (ereq_use_env xa tau_x) r_ex)) \\\n leq_use_env (rename_use_env rx (Var x) (Var y)) (rename_use_env r_s2 (Var x) (Var y)) \\\n leq_use_env r_ex (rename_use_env r_s1 (Var x) (Var y)) \\\n leq_use_env (diff_use_env (ereq_use_env xa tau_x) (comp_use_env (ereq_use_env xa tau_x) r_ex)) (rename_use_env rx (Var x) (Var y)))\"\n apply (auto)\n apply (case_tac \"\\ leq_use_env (ereq_use_env xa tau_x) (rename_use_env r_s1 (Var x) (Var y)) = \n leq_use_env (rename_use_env (ereq_use_env xa tau_x) (Var x) (Var y)) (rename_use_env r_s1 (Var x) (Var y))\")\n apply (cut_tac z=\"xa\" and x=\"Var x\" and y=\"Var y\" and tau=\"tau_x\" in rename_ereq_use_env2)\n apply (simp_all)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (case_tac \"\\ rename_use_env (ereq_use_env xa tau_x) (Var x) (Var y) = ereq_use_env xa tau_x\")\n apply (cut_tac z=\"xa\" and x=\"Var x\" and y=\"Var y\" and tau=\"tau_x\" in rename_ereq_use_env2)\n apply (simp_all)\n apply (cut_tac r_x=\"ereq_use_env xa tau_x\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (simp_all)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s1\" and r_s=\"comp_use_env (ereq_use_env xa tau_x) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp_all)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"ereq_use_env xa tau_x\" and r_s=\"comp_use_env (ereq_use_env xa tau_x) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp_all)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n done\n \nlemma alpha_rename_type_preserve: \"\\ well_typed (add_env env (Var x) t) r_s1 e tau r_s2 rx; (*env x = None;*)\n y \\ free_vars e; y \\ lam_vars e \\ \\\n well_typed (add_env env (Var y) t) (rename_use_env r_s1 (Var x) (Var y)) (deep_alpha_rename e x y) tau\n (rename_use_env r_s2 (Var x) (Var y)) (rename_use_env rx (Var x) (Var y))\"\n apply (induct e arbitrary: env tau t r_s1 r_s2 rx)\n apply (auto)\n (* const + op cases *)\n apply (rule_tac x=\"Var x\" in rename_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"Var x\" in rename_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"Var x\" in rename_leq_use_env)\n apply (simp_all)\n apply (rule_tac x=\"Var x\" in rename_leq_use_env)\n apply (simp_all)\n (* var case. *)\n apply (case_tac \"xa = VarType x\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (rule_tac artp_var_case1)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (rule_tac artp_var_case2)\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (rule_tac artp_var_case2)\n apply (auto)\n apply (simp add: add_env_def)\n (* pair case *)\n apply (cut_tac r_s=\"rx1\" and x=\"Var x\" and y=\"Var y\" and r=\"r\" in rename_lift_use_env)\n apply (cut_tac r_s=\"rx2\" and x=\"Var x\" and y=\"Var y\" and r=\"r\" in rename_lift_use_env)\n apply (rule_tac x=\"rename_use_env r_s2a (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s3 (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env rx1 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env rx2 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)(*\n apply (rule_tac safe_lift_rename_use_env)\n apply (simp)\n apply (rule_tac safe_lift_rename_use_env)\n apply (simp)*)\n apply (rule_tac disj_rename_use_env)\n apply (simp)\n apply (cut_tac r_x=\"r_s3\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: pair_req_def)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n apply (simp add: rename_comp_use_env)\n apply (simp add: rename_diff_use_env)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n (* if case *)\n apply (rule_tac x=\"rename_use_env rx' (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s2a (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env rx1 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env rx2 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"rx1\" and r_s=\"rx2\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (auto)\n (* lam case p1. *)(*\n apply (cut_tac y=\"Var y\" and x=\"Var x\" and e=\"e\" in rename_ref_vars2)\n apply (auto)*)\n apply (rule_tac x=\"rename_use_env rxa (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env r_end (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s' (Var x) (Var y)\" in exI)\n apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (cut_tac env=\"env\" and x=\"Var y\" and t=\"t\" and t'=\"t1\" in double_add_env)\n apply (cut_tac r_s=\"rxa\" and x=\"Var x\" and y=\"Var y\" and r=\"r\" in rename_add_use_env)\n apply (simp)\n apply (rule_tac aff_rename_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s1\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"rxa\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n (* lam case p2. *)(*\n apply (cut_tac z=\"x1a\" and x=\"Var x\" and y=\"Var y\" and e=\"e\" in rename_ref_vars1)\n apply (auto)*)\n apply (rule_tac x=\"rename_use_env rxa (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env r_end (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s' (Var x) (Var y)\" in exI)\n apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Var x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n apply (simp_all)\n apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Var y\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n apply (simp_all)\n apply (cut_tac r_s=\"rxa\" and x=\"Var x\" and y=\"Var y\" and z=\"Var x1a\" and r=\"r\" in rename_add_use_env2)\n apply (simp_all)\n apply (rule_tac aff_rename_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s1\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"rxa\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"rename_use_env r_s2a (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env rx1 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env rx2 (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s3 (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"rx2\" and x=\"Var x\" and y=\"Var y\" and r=\"r\" in rename_lift_use_env)\n apply (simp)\n apply (cut_tac r_x=\"rx1\" and r_s=\"lift_use_env rx2 r\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (cut_tac r_x=\"comp_use_env rx1 (lift_use_env rx2 r)\" and r_s=\"r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (rule_tac x=\"rename_use_env r_ex (Var x) (Var y)\" in exI)\n apply (auto)\n apply (cut_tac r_x=\"r_s3\" and r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)(*\n apply (rule_tac safe_lift_rename_use_env)\n apply (simp)*)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac disj_rename_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (cut_tac r_x=\"rx1\" and r_s=\"rx2\" and x=\"Var x\" and y=\"Var y\" in rename_comp_use_env)\n apply (simp)\n apply (cut_tac r_x=\"comp_use_env rx1 rx2\" and r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" and x=\"Var x\" and y=\"Var y\" in rename_diff_use_env)\n apply (simp)\n apply (rule_tac rename_leq_use_env)\n apply (simp)\n done\n \n\nlemma alpha_rename_free_var_id: \"\\ x \\ y \\ \\ x \\ free_vars (deep_alpha_rename e x y)\"\n apply (induct e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"x = x1\")\n apply (auto)\n done \n\nlemma alpha_rename_free_var_none: \"\\ a \\ free_vars e; a \\ y \\ \\ a \\ free_vars (deep_alpha_rename e x y)\" \n apply (induction e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"x = x1\")\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"a\" and y=\"y\" in alpha_rename_free_var_id)\n apply (auto)\n done\n \nlemma alpha_rename_lam_var_none: \"\\ a \\ lam_vars e; a \\ y \\ \\ a \\ lam_vars (deep_alpha_rename e x y)\" \n apply (induct e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"x = x1\")\n apply (auto)\n done\n \nlemma lam_var_remove_free_var_none: \"\\ x \\ free_vars e \\ \\ x \\ free_vars (lam_var_remove e a b)\" \n apply (induct e)\n apply (auto)\n apply (case_tac \"x \\ b\")\n apply (cut_tac e=\"e\" and a=\"x\" and x=\"a\" and y=\"b\" in alpha_rename_free_var_none)\n apply (auto)\n apply (case_tac \"x \\ b\")\n apply (cut_tac e=\"e\" and x=\"x\" and y=\"b\" in alpha_rename_free_var_id)\n apply (auto)\n done\n\nlemma lam_var_remove_lam_var_none: \"\\ x \\ lam_vars e; x \\ b \\ \\ x \\ lam_vars (lam_var_remove e a b)\" \n apply (induct e) \n apply (auto)\n apply (cut_tac a=\"x\" and e=\"e\" and x=\"a\" and y=\"b\" in alpha_rename_lam_var_none)\n apply (auto)\n done \n \nlemma lam_var_remove_type_preserve: \"\\ well_typed env r_s1 e tau r_s2 rx; y \\ free_vars e; y \\ lam_vars e \\ \\\n well_typed env r_s1 (lam_var_remove e x y) tau r_s2 rx\"\n apply (induct e arbitrary: env tau r_s1 r_s2 rx)\n apply (auto)\n (* pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n (* lam case p1. *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"rename_use_env r_end (Var x) (Var y)\" in exI)\n apply (rule_tac x=\"rename_use_env r_s' (Var x) (Var y)\" in exI)\n apply (rule_tac ?r_s1.0=\"rem_use_env (add_use_env rxa (Var y) r) (Var x)\" in well_typed_incr_start_perm)\n apply (cut_tac r_s=\"rxa\" and x=\"Var y\" and y=\"Var x\" and r=\"r\" in almost_comm_rem_add_use_env)\n apply (simp_all)\n apply (case_tac \"\\ add_use_env (rem_use_env rxa (Var x)) (Var y) r = rename_use_env (add_use_env rxa (Var x) r) (Var x) (Var y)\")\n apply (case_tac \"\\ (\\ x'. add_use_env (rem_use_env rxa (Var x)) (Var y) r x' = rename_use_env (add_use_env rxa (Var x) r) (Var x) (Var y) x')\")\n apply (auto)\n apply (simp add: rename_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac \"Var y = x'\")\n apply (auto)\n apply (simp add: rem_use_env_def)\n apply (case_tac \"Var x = x'\")\n apply (auto)\n apply (rule_tac alpha_rename_type_preserve)\n apply (simp_all)\n apply (rule_tac self_rem_leq_use_env)\n (* lam case p2. *)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_end\" in exI)\n apply (rule_tac x=\"r_s'\" in exI)\n apply (auto)\n (* app case *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n done \n \n (* basically, we want to make sure that when we replace a var, we dont end up with the post_vars of vl overlapping with\n any of the ref vars of e. in other words, that we arent changing any of the ref vars. now the thing is, when we do lam var remove,\n we dont expect any of the ref vars to change actually *)\nlemma lam_var_list_remove_type_preserve: \"\\ well_typed env r_s1 e tau r_s2 rx; unique_post_vars vl;(* pre_vars vl \\ lam_vars e;*)\n post_vars vl \\ (free_vars e \\ lam_vars e) = {} \\ \\ well_typed env r_s1 (lam_var_list_remove e vl) tau r_s2 rx\"\n apply (induct vl arbitrary: e)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"a\" and y=\"b\" in lam_var_remove_type_preserve)\n apply (auto)\n apply (case_tac \"\\ post_vars vl \\ (free_vars (lam_var_remove e a b) \\ lam_vars (lam_var_remove e a b)) = {}\")\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"x\" and a=\"a\" and b=\"b\" in lam_var_remove_free_var_none)\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"x\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n apply (auto)\n done \n \n \nlemma alpha_rename_free_var_some: \"\\ x \\ free_vars e; x \\ a; x \\ b \\ \\ x \\ free_vars (deep_alpha_rename e a b)\" \n apply (induct e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n done\n \nlemma lam_var_remove_free_var_some: \"\\ x \\ free_vars e; x \\ b \\ \\ x \\ free_vars (lam_var_remove e a b)\" \n apply (induct e)\n apply (auto)\n apply (rule_tac alpha_rename_free_var_some)\n apply (auto)\n done \n \nlemma lam_var_list_remove_free_var_some: \"\\ x \\ free_vars e; x \\ post_vars vl \\ \\ x \\ free_vars (lam_var_list_remove e vl)\" \n apply (induct vl arbitrary: e)\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_free_var_some)\n apply (auto)\n done \n \nlemma lam_var_list_remove_lam_var_none1: \"\\ x \\ lam_vars e; x \\ post_vars vl \\ \\ x \\ lam_vars (lam_var_list_remove e vl)\" \n apply (induct vl arbitrary: e)\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"x\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n apply (auto)\n done\n \nlemma alpha_rename_lam_var_none2: \"\\ x \\ b \\ \\ x \\ lam_vars (deep_alpha_rename e x b)\" \n apply (induct e)\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n apply (case_tac \"x = x1\")\n apply (auto)\n done\n \nlemma lam_var_remove_lam_var_none2: \"\\ x \\ b \\ \\ x \\ lam_vars (lam_var_remove e x b)\" \n apply (induct e)\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"x\" and b=\"b\" in alpha_rename_lam_var_none2)\n apply (auto)\n done \n \nlemma lam_var_list_remove_lam_var_none2: \"\\ x \\ pre_vars vl; x \\ post_vars vl \\ \\ x \\ lam_vars (lam_var_list_remove e vl)\" \n apply (induct vl arbitrary: e)\n apply (auto)\n apply (cut_tac e=\"e\" and x=\"x\" and b=\"b\" in lam_var_remove_lam_var_none2)\n apply (auto)\n apply (cut_tac e=\"lam_var_remove e x b\" and x=\"x\" and vl=\"vl\" in lam_var_list_remove_lam_var_none1)\n apply (auto)\n done \n \nlemma lam_var_list_remove_free_var_some_rev: \"\\ x \\ free_vars (lam_var_list_remove e vl) \\ \\ x \\ free_vars e\"\n apply (induction vl arbitrary: e)\n apply (auto)\n apply (case_tac \"x \\ free_vars e\")\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_free_var_none)\n apply (auto)\n done\n \nlemma lam_var_list_remove_free_var_none: \"\\ x \\ free_vars e \\ \\ x \\ free_vars (lam_var_list_remove e vl)\" \n apply (case_tac \"x \\ free_vars (lam_var_list_remove e vl)\")\n apply (auto)\n apply (cut_tac x=\"x\" and e=\"e\" and vl=\"vl\" in lam_var_list_remove_free_var_some_rev)\n apply (auto)\n done \n\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/SafeSubRename.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.2581694375402049}} {"text": "theory UPPAAL_State_Networks_Impl\n imports TA_Impl.Normalized_Zone_Semantics_Impl UPPAAL_State_Networks\nbegin\n\nchapter \\Implementation of UPPAAL Style Networks\\\n\nno_notation OR (infix \"or\" 60)\n\nlemma step_resets:\n \"\\ c \\ set r'. \\ x pc. Some (INSTR (STOREC c x)) = P pc\"\n if \"stepc cmd u (pc, st, s, f, r) = Some (pc', st', s', f', r')\"\n \"\\ c \\ set r. \\ x pc. Some (INSTR (STOREC c x)) = P pc\" \"P pc = Some cmd\"\n using that\n apply -\n apply (erule stepc.elims)\n by (auto split: option.splits if_splits elim!: step.elims) metis+\n\nlemma step_resets':\n \"\\ c \\ set r'. \\ x pc. Some (INSTR (STOREC c x)) = P pc\"\n if \"step instr (pc, st, s, f, r) = Some (pc', st', s', f', r')\"\n \"\\ c \\ set r. \\ x pc. Some (INSTR (STOREC c x)) = P pc\" \"P pc = Some (INSTR instr)\"\n using that\n by (auto split: option.splits if_splits elim!: step.elims) metis+\n\nlemma step_resets'':\n \"\\ c \\ set r'. \\ x pc. Some (STOREC c x) = P pc\"\n if \"step instr (pc, st, s, f, r) = Some (pc', st', s', f', r')\"\n \"\\ c \\ set r. \\ x pc. Some (STOREC c x) = P pc\" \"P pc = Some instr\"\n using that\n by (auto split: option.splits if_splits elim!: step.elims) metis+\n\nlemma steps_reset:\n \"\\ c \\ set r'. \\ x pc. Some (STOREC c x) = P pc\"\n if \"steps P n (pc, st, s, f, r) (pc', st', s', f', r')\" \"\\ c \\ set r. \\ x pc. Some (STOREC c x) = P pc\"\n using that\n by (induction P \\ P n \"(pc, st, s, f, r :: nat list)\" \"(pc', st', s', f', r')\" arbitrary: pc st s f r rule: steps.induct)\n (auto dest!: step_resets''[where P = P])\n\nlemma exec_reset:\n \"\\ c \\ set r'. \\ x pc. Some (STOREC c x) = P pc\"\n if \"Some ((pc', st', s', f', r'), pcs') = exec P n (pc, st, s, f, []) pcs\"\n using exec_steps[OF that[symmetric]] steps_reset by force\n\nlemma exec_pointers:\n \"\\ pc \\ set pcs'. \\ pc instr. Some instr = P pc\"\n if \"Some ((pc', st', s', f', r'), pcs') = exec P n (pc, st, s, f, r) pcs\"\n \"\\ pc \\ set pcs. \\ pc instr. Some instr = P pc\"\n using that\n apply (induction rule: exec.induct)\n by (auto split: option.splits if_splits) metis+\n\nlemma exec_pointers':\n \"\\ pc \\ set pcs'. \\ pc instr. Some instr = P pc\"\n if \"Some ((pc', st', s', f', r'), pcs') = exec P n (pc, st, s, f, r) []\"\n using that exec_pointers by fastforce\n\ncontext Prod_TA_Defs\nbegin\n\nlemma finite_range_I':\n assumes \"\\A\\{0..A\\{0.. defs.states' s\"\n using that\n using Product_TA_Defs.states_length defs.N_s_def state_ta_def by fastforce\n\n\n\n lemma [simp]:\n \"defs.p = p\"\n unfolding defs.p_def by simp\n\nlemma P_Storec_iff:\n \"(Some (INSTR (STOREC x xa)) = P pc) \\ (Some (STOREC x xa) = PF pc)\"\n unfolding stripfp_def apply (cases \"P pc\")\n apply force\n subgoal for a\n by (cases a) auto\n done\n\n(* XXX Unused but is explaining what is going on below *)\nlemma product_trans_i_resets:\n \"collect_clkvt (Product_TA_Defs.product_trans_i (defs.N_s s))\n \\ {c. \\ x pc. Some (INSTR (STOREC c x)) = P pc}\"\n unfolding collect_clkvt_def\n unfolding Product_TA_Defs.product_trans_i_def\n apply clarsimp\n unfolding defs.N_s_def\n unfolding trans_of_def\n unfolding defs.T_s_def\n unfolding state_ta_def\n unfolding state_trans_t_def\n unfolding make_f_def\n apply (clarsimp split: option.split_asm)\n by (auto dest: exec_reset simp: P_Storec_iff)\n\n(* XXX Unused but is explaining what is going on below *)\nlemma product_trans_s_resets:\n \"collect_clkvt (Product_TA_Defs.product_trans_s (defs.N_s s))\n \\ {c. \\ x pc. Some (INSTR (STOREC c x)) = P pc}\"\n unfolding collect_clkvt_def\n unfolding Product_TA_Defs.product_trans_s_def\n apply clarsimp\n unfolding defs.N_s_def\n unfolding trans_of_def\n unfolding defs.T_s_def\n unfolding state_ta_def\n unfolding state_trans_t_def\n unfolding make_f_def\n apply (clarsimp split: option.split_asm)\n by (auto dest: exec_reset simp: P_Storec_iff)\n\nlemma product_trans_resets:\n \"collect_clkvt (\\s. defs.T' s) \\ {c. \\ x pc. Some (INSTR (STOREC c x)) = P pc}\"\n unfolding trans_of_def\n unfolding Product_TA_Defs.product_ta_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n unfolding collect_clkvt_def\n apply safe\n unfolding Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n apply clarsimp_all\n unfolding defs.N_s_def\n unfolding trans_of_def\n unfolding defs.T_s_def\n unfolding state_ta_def\n unfolding state_trans_t_def\n unfolding make_f_def\n apply (clarsimp_all split: option.split_asm)\n by (auto dest: exec_reset simp: P_Storec_iff)\n\nlemma product_trans_guards:\n \"Timed_Automata.collect_clkt (\\s. defs.T' s)\n \\ {constraint_pair ac | ac. \\ pc. Some (CEXP ac) = P pc}\"\n unfolding trans_of_def\n unfolding Product_TA_Defs.product_ta_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n unfolding Timed_Automata.collect_clkt_def collect_clock_pairs_def\n apply safe\n unfolding Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n apply clarsimp_all\n unfolding defs.N_s_def\n unfolding trans_of_def\n unfolding defs.T_s_def\n unfolding state_ta_def\n unfolding state_trans_t_def\n unfolding make_g_def\n apply (clarsimp_all split: option.split_asm)\n subgoal premises prems\n using prems(1,3-)\n unfolding set_map_filter\n by - (drule exec_pointers'; auto split: option.splits; auto split: instrc.split_asm; metis)\n subgoal premises prems\n using prems(1,2,4-)\n apply safe\n unfolding set_map_filter\n by (drule exec_pointers'; auto split: option.splits; auto split: instrc.split_asm; metis)+\n done\n\nend\n\ndatatype bexp =\n not bexp | \"and\" bexp bexp | or bexp bexp | imply bexp bexp | \\ \\Boolean connectives\\\n loc nat nat | \\ \\Is process p in location l?\\\n eq nat int \\ \\Does var i equal x?\\ |\n le nat int |\n lt nat int |\n ge nat int |\n gt nat int\n\nfun check_bexp :: \"bexp \\ nat list \\ int list \\ bool\" where\n \"check_bexp (not a) L s \\ \\ check_bexp a L s\" |\n \"check_bexp (and a b ) L s \\ check_bexp a L s \\ check_bexp b L s\" |\n \"check_bexp (or a b ) L s \\ check_bexp a L s \\ check_bexp b L s\" |\n \"check_bexp (imply a b ) L s \\ (check_bexp a L s \\ check_bexp b L s)\" |\n \"check_bexp (loc p l) L _ \\ L ! p = l\" |\n \"check_bexp (eq i x) _ s \\ s ! i = x\" |\n \"check_bexp (le i x) _ s \\ s ! i \\ x\" |\n \"check_bexp (lt i x) _ s \\ s ! i < x\" |\n \"check_bexp (ge i x) _ s \\ s ! i \\ x\" |\n \"check_bexp (gt i x) _ s \\ s ! i > x\"\n\ndatatype formula =\n EX bexp | EG bexp | AX bexp | AG bexp | Leadsto bexp bexp\n\nabbreviation \"repeat x n \\ map (\\ _. x) [0.. map_option (map_instrc real_of_int) (P pc)\"\nabbreviation \"conv_A' \\ \\ (T, I). (T, conv_cc o I)\"\n\nfun hd_of_formula :: \"formula \\ nat list \\ int list \\ bool\" where\n \"hd_of_formula (formula.EX \\) = check_bexp \\\" |\n \"hd_of_formula (EG \\) = check_bexp \\\" |\n \"hd_of_formula (AX \\) = Not oo check_bexp \\\" |\n \"hd_of_formula (AG \\) = Not oo check_bexp \\\" |\n \"hd_of_formula (Leadsto \\ _) = check_bexp \\\"\n\nsubsection \\Pre-compiled networks with states and clocks as natural numbers\\\nlocale UPPAAL_Reachability_Problem_precompiled_defs =\n fixes p :: nat \\ \\Number of processes\\\n and m :: nat \\ \\Number of clocks\\\n (*\n and k :: \"nat list list\"\n -- \"Clock ceiling. Maximal constant appearing in automaton for each state\"\n *)\n and max_steps :: nat \\ \\Maximal number of execution for steps of programs in the automaton\\\n and inv :: \"(nat, int) cconstraint list list\" \\ \\Clock invariants on locations per process\\\n and pred :: \"addr list list\" \\ \\State invariants on locations per process\\\n and trans :: \"(addr * nat act * addr * nat) list list list\"\n \\ \\Transitions between states per process\\\n and prog :: \"int instrc option list\"\n and formula :: formula \\ \\Model checking formula\\\n and bounds :: \"(int * int) list\"\nbegin\n definition \"clkp_set' \\\n \\ (collect_clock_pairs ` set (concat inv))\n \\ {constraint_pair ac | ac. Some (CEXP ac) \\ set prog}\"\n definition clk_set'_def: \"clk_set' =\n (fst ` clkp_set' \\ {c. \\ x. Some (INSTR (STOREC c x)) \\ set prog})\"\n\n text \\Definition of the corresponding network\\\n definition \"I i l \\ if l < length (inv ! i) then inv ! i ! l else []\"\n definition \"T i \\\n {(l, trans ! i ! l ! j) | l j. l < length (trans ! i) \\ j < length (trans ! i ! l)}\"\n definition \"P \\ map (\\ P l. P ! l) pred\"\n definition \"PROG pc \\ (if pc < length prog then prog ! pc else None)\"\n definition N :: \"(nat, int, nat) unta\" where\n \"N \\ (PROG, map (\\ i. (T i, I i)) [0.. repeat (0::nat) p\"\n definition \"F \\ hd_of_formula formula\"\n\n sublocale equiv: Equiv_TA_Defs N max_steps .\n\n thm equiv.defs.prod_trans_i_alt_def\n\n abbreviation \"EA \\ equiv.state_ta\"\n\n abbreviation \"A \\ equiv.defs.prod_ta\"\n\n lemma [simp]:\n \"equiv.p = p\"\n unfolding equiv.p_def N_def Equiv_TA_Defs.p_def by simp\n\n lemma [simp]:\n \"length (equiv.defs.N_s s) = p\"\n unfolding equiv.defs.N_s_def by simp\n\n lemma length_N[simp]:\n \"length equiv.defs.N = p\"\n by simp\n\n lemma\n \"equiv.defs.I' s L = concat (map (\\ q. if q < p then I q (L ! q) else []) [0.. i. (f i, g i)) = g\"\n by auto\n\nlocale UPPAAL_Reachability_Problem_precompiled =\n UPPAAL_Reachability_Problem_precompiled_defs +\n assumes process_length: \"length inv = p\" \"length trans = p\" \"length pred = p\"\n and lengths:\n \"\\ i < p. length (pred ! i) = length (trans ! i) \\ length (inv ! i) = length (trans ! i)\"\n and state_set: \"\\ T \\ set trans. \\ xs \\ set T. \\ (_, _, _, l) \\ set xs. l < length T\"\n assumes consts_nats: \"snd ` clkp_set' \\ \\\"\n (* XXX This could also be subset for now but is left like this as an input sanity check right now *)\n assumes clock_set: \"clk_set' = {1..m}\"\n and p_gt_0: \"p > 0\"\n and m_gt_0: \"m > 0\"\n (* XXX Can get rid of these two? *)\n and processes_have_trans: \"\\ i < p. trans ! i \\ []\" \\ \\Necessary for refinement\\\n and start_has_trans: \"\\ q < p. trans ! q ! 0 \\ []\" \\ \\Necessary for refinement\\\n (* XXX Do not need this but a useful cautious check for the user? *)\n assumes resets_zero: \"\\ x c. Some (INSTR (STOREC c x)) \\ set prog \\ x = 0\"\n\n(*\nlocale UPPAAL_Reachability_Problem_precompiled =\n UPPAAL_Reachability_Problem_precompiled_raw +\n assumes discrete_state_finite: \"\\ i < p. \\ l < length (trans ! i). finite {s. (pred ! i ! l) s}\"\n*)\nbegin\n\n lemma consts_nats':\n \"\\ I \\ set inv. \\ cc \\ set I. \\ (c, d) \\ collect_clock_pairs cc. d \\ \\\"\n (* \"\\ T \\ set trans. \\ xs \\ set T. \\ (g, _) \\ set xs. \\ (c, d) \\ collect_clock_pairs g. d \\ \\\" *)\n \"\\ ac. Some (CEXP ac) \\ set prog \\ (snd (constraint_pair ac) \\ \\)\"\n using consts_nats unfolding clkp_set'_def by force+\n\n thm equiv.defs.collect_clkt_prod_trans_subs\n thm equiv.defs.collect_clki_prod_invariant[of init]\n thm equiv.defs.collect_clkvt_prod_trans_subs\n\n term \"range (snd (equiv.defs.N ! p))\" term \"snd (equiv.defs.N ! p)\"\n term \"set inv\" term \"set (concat inv)\"\n term \"equiv.defs.N\"\n\n lemma clk_pairs_N_inv:\n \"\\ (collect_clock_pairs ` range (snd x)) \\ \\ (collect_clock_pairs ` set (concat inv))\"\n if \"x \\ set equiv.defs.N\" for x\n using that process_length(1)\n unfolding equiv.state_ta_def equiv.state_inv_def equiv.p_def\n unfolding N_def I_def\n by clarsimp (auto split: if_split_asm dest: nth_mem)+\n\n lemma clkp_set_simp_1:\n \"\\ (collect_clock_pairs ` set (concat inv)) \\ Timed_Automata.collect_clki (snd A)\"\n unfolding equiv.defs.prod_ta_def inv_of_def\n apply (rule subset_trans)\n apply simp\n apply (rule equiv.defs.collect_clki_prod_invariant')\n unfolding Timed_Automata.collect_clki_def using clk_pairs_N_inv nth_mem by blast\n\n lemma clk_set_simp_2:\n \"{c. \\ x. Some (INSTR (STOREC c x)) \\ set prog} \\ collect_clkvt (trans_of A)\"\n unfolding equiv.defs.prod_ta_def trans_of_def\n apply (rule subset_trans)\n apply simp\n apply (rule equiv.defs.collect_clkvt_prod_trans_subs)\n apply (rule subset_trans)\n apply (rule equiv.product_trans_resets)\n unfolding N_def PROG_def by (auto dest!: nth_mem) metis\n\n lemma clkp_set_simp_3:\n \"{constraint_pair ac | ac. Some (CEXP ac) \\ set prog} \\ Timed_Automata.collect_clkt (trans_of A)\"\n unfolding equiv.defs.prod_ta_def trans_of_def\n apply (rule subset_trans)\n apply simp\n apply (rule equiv.defs.collect_clkt_prod_trans_subs)\n apply (rule subset_trans)\n apply (rule equiv.product_trans_guards)\n unfolding N_def PROG_def by (auto dest!: nth_mem)\n\n lemma clkp_set'_subs:\n \"Timed_Automata.clkp_set A \\ clkp_set'\"\n using clkp_set_simp_1 clkp_set_simp_3\n by (auto simp add: clkp_set'_def Timed_Automata.clkp_set_def inv_of_def)\n\n lemma clk_set'_subs:\n \"clk_set A \\ clk_set'\"\n using clkp_set'_subs clk_set_simp_2 by (auto simp: clk_set'_def)\n\n lemma clk_set:\n \"clk_set A \\ {1..m}\"\n using clock_set m_gt_0 clk_set'_subs by auto\n\n lemma\n \"\\(_, d)\\Timed_Automata.clkp_set A. d \\ \\\"\n unfolding Ints_def by auto\n\n lemma clkp_set'_consts_nat:\n \"\\(_, d)\\clkp_set'. d \\ \\\"\n using consts_nats' unfolding clkp_set'_def\n apply auto\n apply force\n by (metis snd_conv)\n\n lemma clkp_set_consts_nat:\n \"\\(_, d)\\Timed_Automata.clkp_set A. d \\ \\\"\n using clkp_set'_subs clkp_set'_consts_nat by auto\n\n lemma finite_clkp_set':\n \"finite clkp_set'\"\n unfolding clkp_set'_def\n using [[simproc add: finite_Collect]]\n by (auto simp: inj_on_def intro!: finite_vimageI)\n\n lemma finite_clkp_set_A[intro, simp]:\n \"finite (Timed_Automata.clkp_set A)\"\n using clkp_set'_subs finite_clkp_set' by (rule finite_subset)\n\n lemma clkp_set'_bounds:\n \"a \\ {Suc 0..m}\" if \"(a, b) \\ clkp_set'\"\n using that clock_set unfolding clk_set'_def by auto\n\n lemma finite_range_inv_of_A[intro, simp]:\n \"finite (range (inv_of A))\"\n unfolding inv_of_def equiv.defs.prod_ta_def\n apply simp\n apply (rule equiv.defs.finite_rangeI)\n apply simp\n unfolding Equiv_TA_Defs.state_ta_def\n apply simp\n unfolding equiv.state_inv_def\n unfolding N_def\n unfolding I_def\n by (auto intro: finite_subset[where B = \"{[]}\"])\n\n (* XXX Interesting for finiteness *)\n (* XXX Move *)\n lemma Collect_fold_pair:\n \"{f a b | a b. P a b} = (\\ (a, b). f a b) ` {(a, b). P a b}\" for P\n by auto\n\n lemma finite_T[intro, simp]:\n \"finite (trans_of A)\"\n unfolding trans_of_def equiv.defs.prod_ta_def\n proof (simp, rule equiv.defs.finite_prod_trans, goal_cases)\n case (1 s)\n show \"\\l q. q < equiv.defs.p \\ (equiv.defs.P ! q) l s \\ (bounded equiv.B) s\"\n apply simp\n unfolding equiv.state_ta_def equiv.state_pred_def\n by (simp split: option.split)\n next\n case 2\n show \"finite {s. bounded equiv.B s}\" by (rule equiv.bounded_finite)\n next\n case 3\n show ?case\n proof\n fix A assume A: \"A \\ set equiv.defs.N\"\n have\n \"{(l, j). l < length (trans ! i) \\ j < length (trans ! i ! l)}\n = \\ ((\\ l. {(l, j) | j. j < length (trans ! i ! l)}) ` {l. l < length (trans ! i)})\" for i\n by auto\n then have \"finite (T q)\" if \"q < p\" for q\n using that unfolding T_def by (fastforce simp: Collect_fold_pair)\n then have \"finite (fst (equiv.N ! q))\" if \"q < p\" for q\n using that unfolding N_def by simp\n then have \"finite (equiv.state_trans q)\" if \"q < p\" for q\n using that\n unfolding Equiv_TA_Defs.state_trans_t_def\n using [[simproc add: finite_Collect]]\n by auto\n then show \"finite (fst A)\" using A unfolding Equiv_TA_Defs.state_ta_def by auto\n qed\n qed (auto simp: p_gt_0)\n\n sublocale TA_Start_No_Ceiling A \"(init, s\\<^sub>0)\" m\n using clkp_set_consts_nat clk_set m_gt_0 by - (standard; blast)\n\n(*\n sublocale Reachability_Problem_no_ceiling A \"(init, s\\<^sub>0)\" \"PR_CONST (\\ (l, s). F l s)\" m\n using clkp_set_consts_nat clk_set m_gt_0 by - (standard; blast)\n*)\n\n lemma [simp]:\n \"length P = p\"\n unfolding P_def using process_length(3) by simp\n\n lemma [simp]:\n \"length equiv.I = p\"\n unfolding N_def by simp\n\n lemma [simp]:\n \"length equiv.N = p\"\n unfolding N_def by simp\n\nend (* End of locale *)\n\n(*\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n (*definition \"clkp_set'' \\\n \\ (collect_clock_pairs ` set (concat inv))\n \\ {constraint_pair ac | ac. Some (CEXP ac) \\ set prog}\"\n*)\n\n definition \"clkp_set'' i l \\\n collect_clock_pairs (inv ! i ! l) \\ \\ ((\\ (g, _). collect_clock_pairs g) ` set (trans ! i ! l))\"\n\nend\n*)\n\n(*\nlocale UPPAAL_Reachability_Problem_precompiled_ceiling =\n UPPAAL_Reachability_Problem_precompiled +\n fixes k :: \"nat list list list\"\n (*\n and k_length: \"length k = p\" \"\\ l \\ set k. length l = m + 1\"\n -- \\Zero entry is just a dummy for the zero clock\\\n (* XXX Make this an abbreviation? *)\n assumes k_ceiling:\n (* \"\\ c \\ {1..m}. k ! c = Max ({d. (c, d) \\ clkp_set'} \\ {0})\" *)\n \"\\ (c, d) \\ clkp_set'. int (k ! c) \\ d\"\n \"k ! 0 = 0\"\n *)\nbegin\n\n definition\n \"k_fun \\ \\ (l, s). \\ c. if 0 < c \\ c \\ m then Max {k ! i ! (l ! i) ! c | i. i < p} else 0\"\n\n lemma [intro, simp]:\n \"k_fun st 0 = 0\"\n unfolding k_fun_def by (simp split: prod.split)\n\n lemma [intro, simp]:\n \"k_fun st i = 0\" if \"i > m\"\n unfolding k_fun_def using that by (simp split: prod.split)\n\n lemma [intro]:\n \"b \\ int (k_fun a)\" if \"(a, b) \\ clkp_set A\"\n using that k_ceiling clkp_set'_subs k_length clkp_set'_bounds unfolding k_fun_def by force\n\n sublocale Reachability_Problem \"(init, s\\<^sub>0)\" \"PR_CONST (\\ (l, s). F l s)\" m A k_fun\n using clkp_set_consts_nat clk_set m_gt_0 apply - apply standard\n prefer 4 apply simp\n prefer 3 apply simp\n oops\n\nend (* End of locale *)\n*)\n\nend (* End of theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Uppaal_Networks/UPPAAL_State_Networks_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.2581694313878645}} {"text": "theory Modelica_Blocks_Core\n imports \"../Modelica_Core\"\nbegin\n \nconsts\n eps\\<^sub>m :: real\n \ntype_synonym ('a, 'l, 'c) mcon = \"('a \\ ('l, 'c) mst_scheme)\"\n \ntranslations\n (type) \"('a, 'l, 'c) mcon\" <= (type) \"('a \\ ('l, 'c) mst_scheme)\"\n \ndatatype ('l, 'c) mevgrd =\n TimeEvent (ofTimeEvent: \"real \\ bool\") | StateEvent (ofStateEvent: \"(real, 'l, 'c) mexpr\")\n \nrecord (overloaded) ('l, 'c) mblock = \n mieqs :: \"('l, 'c) mst_scheme upred\" -- {* Initial Equations *}\n mdeqs :: \"('l, 'c) mrel\" -- {* Differential Equations *}\n maeqs :: \"('l, 'c) mst_scheme upred\" -- {* Algebraic Equations *}\n mqeqs :: \"('l, 'c) mst_scheme upred\" -- {* Discrete Equations *}\n mreqs :: \"('l, 'c) mst_scheme hrel set\" -- {* Reset Equations *}\n mzcfs :: \"(real, ('l, 'c) mst_scheme) uexpr set\" -- {* Zero Crossing Expressions *}\n mtevs :: \"real \\ bool\" -- {* Time Event Expressions *}\n \ndefinition \"EvInv eps z = (\\z\\\\<^sub>< >\\<^sub>u -eps \\ \\z\\\\<^sub>> >\\<^sub>u -eps)\"\ndefinition \"EvExit eps z = (\\z\\\\<^sub>< >\\<^sub>u 0 \\ \\z\\\\<^sub>> \\\\<^sub>u 0)\"\n \ndefinition interleave_r :: \"'a hrel set \\ 'a hrel\" (\"|||\\<^sub>r _\") where\n\"interleave_r A = (\\ xs\\{xs. set(xs) = A} \\ (;; p : xs \\ p))\" \n \ndefinition svid_fst :: \"'a \\ 'a \\ 'b\" (\"\\<^bold>v\\<^sub>0\") where\n[lens_defs]: \"svid_fst = fst\\<^sub>L\"\n\ndefinition svid_snd :: \"'b \\ 'a \\ 'b\" (\"\\<^bold>v\\<^sub>1\") where\n[lens_defs]: \"svid_snd = snd\\<^sub>L\"\n\nsyntax\n \"_svid_fst\" :: \"svid\" (\"\\<^bold>v\\<^sub>0\")\n \"_svid_snd\" :: \"svid\" (\"\\<^bold>v\\<^sub>1\") \n \ntranslations\n \"_svid_fst\" == \"CONST svid_fst\"\n \"_svid_snd\" == \"CONST svid_snd\"\n \nlemma skip_lens_ext_fst:\n \"II \\\\<^sub>p (\\<^bold>v\\<^sub>0 \\\\<^sub>L \\<^bold>v\\<^sub>0) = ($\\<^bold>v\\<^sub>0\\ =\\<^sub>u $\\<^bold>v\\<^sub>0)\"\n by (rel_auto)\n \nlemma fst_snd_eq_skip: \n \"($\\<^bold>v\\<^sub>0\\ =\\<^sub>u $\\<^bold>v\\<^sub>0 \\ $\\<^bold>v\\<^sub>1\\ =\\<^sub>u $\\<^bold>v\\<^sub>1) = II\"\n by (rel_auto)\n \nlemma iterate_skip_lemma_1: \n \"($\\<^bold>v\\<^sub>0\\ =\\<^sub>u $\\<^bold>v\\<^sub>0 \\ $\\<^bold>v\\<^sub>1\\ =\\<^sub>u $\\<^bold>v\\<^sub>0) ;; (II \\ &\\<^bold>v\\<^sub>0 =\\<^sub>u &\\<^bold>v\\<^sub>1 \\\\<^sub>r X) = \\<^bold>v\\<^sub>1 := &\\<^bold>v\\<^sub>0\"\n by (rel_auto)\n \ndefinition iterate :: \"'a hrel \\ 'a hrel\" where\n\"iterate P = (\\ $\\<^bold>v\\<^sub>1;$\\<^bold>v\\<^sub>1\\ \\ (\\ X \\ (P \\\\<^sub>p (\\<^bold>v\\<^sub>0 \\\\<^sub>L \\<^bold>v\\<^sub>0) \\ $\\<^bold>v\\<^sub>1\\ =\\<^sub>u $\\<^bold>v\\<^sub>0) ;; (II \\ &\\<^bold>v\\<^sub>0 =\\<^sub>u &\\<^bold>v\\<^sub>1 \\\\<^sub>r X))) \\\\<^sub>e (\\<^bold>v\\<^sub>0 \\\\<^sub>L \\<^bold>v\\<^sub>0)\"\n \nlemma iterate_II: \"iterate II = II\"\n by (simp add: iterate_def skip_lens_ext_fst iterate_skip_lemma_1 lfp_const, rel_auto)\n\ndefinition mblock_comp :: \"('l,'c) mblock \\ ('l,'c) mblock \\ ('l,'c) mblock\" (infixr \"\\\\<^sub>m\" 85) where\n[upred_defs, mo_defs]:\n\"A \\\\<^sub>m B = \\ mieqs = (mieqs A \\ mieqs B)\n , mdeqs = (mdeqs A \\ mdeqs B)\n , maeqs = (maeqs A \\ maeqs B)\n , mqeqs = (mqeqs A \\ mqeqs B)\n , mreqs = (mreqs A \\ mreqs B)\n , mzcfs = (mzcfs A \\ mzcfs B)\n , mtevs = (\\ t. mtevs A t \\ mtevs B t) \\\"\n \n(* FIXME: Take account of time events here too. *)\n \ndefinition mblock_sem :: \n \"_ \\ _ \\ _ \\ ('l::t2_space,'c::t2_space) mblock \\ ('l,'c) mrel\" (\"'(_,_,_') \\ \\_\\\\<^sub>m\") where\n[upred_defs, mo_defs]:\n\"(\\, s, q) \\ \\M\\\\<^sub>m = \n (let I = mieqs M; D = mdeqs M; A = maeqs M; Q = mqeqs M; R = mreqs M; Z = mzcfs M; T = mtevs M in\n \\<^bold>R\\<^sub>s(true\\<^sub>r \\ false \\ [I \\ Q \\ A]\\<^sub>C\\<^sub>>) ;;\n (\\\\<^sub>R X \\ ([D \\ \\\\A\\\\<^sub>>\\\\<^sub>h \\ q \\\\<^sub>h $q]\\<^sub>H \n inv (\\ \\T\\($mtime\\)\\<^sub>a) \\ (\\ z\\Z \\ EvInv \\ z) \n until\\<^sub>H ((\\T\\($mtime\\)\\<^sub>a) \\ (\\ z\\Z \\ EvExit \\ z))) ;;\n \\<^bold>R\\<^sub>s(true\\<^sub>r \\ false \\ [iterate($s\\ =\\<^sub>u $s \\ \\Q\\\\<^sub>> \\ \\A\\\\<^sub>>) ;; |||\\<^sub>r R]\\<^sub>C) ;; X))\"\n\n(*\ndefinition timeGuards :: \"('l, 'c) mblock \\ ((real \\ bool) \\ ('l, 'c) mrel) list\" where\n[upred_defs, mo_defs]:\n\"timeGuards M = map (\\ (g, e). (ofTimeEvent g, e)) (filter (is_TimeEvent \\ fst) (mgrds M))\"\n\ndefinition stateGuards :: \"('l, 'c) mblock \\ ((real, 'l, 'c) mexpr \\ ('l, 'c) mrel) list\" where\n[upred_defs, mo_defs]:\n\"stateGuards M = map (\\ (g, e). (ofStateEvent g, e)) (filter (Not \\ is_TimeEvent \\ fst) (mgrds M))\"\n\ntext {* A time event is triggered whenever the internal clock hits one of the instants in\n the given set of real number. *}\n \ndefinition ti_event :: \"(real \\ bool) \\ ('l, 'c) mst_scheme hrel\" where\n[upred_defs, mo_defs]: \"ti_event P = (\\P\\($time\\)\\<^sub>a)\"\n \ntext {* State events are recorded whenever the given function crosses zero. A zero crossing event \n is registered at some non-deterministically chosen instant when the function $zcf$ was previously \n $\\ge eps$ and it becomes less than $eps$. There is not one point which satisifies this specification \n and then event can occur at any $t$ when $zcf(t) \\in [0,eps)$ *}\n \ndefinition zc_event :: \"(real, ('l, 'c) mst_scheme) uexpr \\ ('l, 'c) mst_scheme hrel \\ ('l, 'c) mst_scheme hrel\" where\n[upred_defs, mo_defs]: \"zc_event zcf = (\\zcf\\\\<^sub>> \\\\<^sub>u 0, (\\zcf \\\\<^sub>u \\eps\\<^sub>m\\\\\\<^sub>< \\ \\zcf <\\<^sub>u \\eps\\<^sub>m\\\\\\<^sub>>))\"\n \ntext {* When the zero-crossing function was previously close to 0, but now it is sufficiently far\n away ($> eps$), a \"phantom\" event iteration executes which simply resets the previous value\n of the zero crossing function to that point so that any correspondonding when statement is\n re-enabled. *}\n\ndefinition zc_restore :: \"(real, ('l, 'c) mst_scheme) uexpr \\ ('l, 'c) mst_scheme hrel\" where\n[upred_defs, mo_defs]: \"zc_restore zcf = (\\zcf <\\<^sub>u \\eps\\<^sub>m\\\\\\<^sub>< \\ \\zcf \\\\<^sub>u \\eps\\<^sub>m\\\\\\<^sub>>)\"\n\ndefinition minvs :: \"('l, 'c) mblock \\ ('l, 'c) mst_scheme hrel\" where\n[upred_defs, mo_defs]: \n \"minvs M = foldr (op \\) (map (fst \\ zc_event \\ fst) (stateGuards M)) true\"\n\ndefinition mconds :: \"('l, 'c) mblock \\ ('l, 'c) mst_scheme hrel\" where\n[upred_defs, mo_defs]: \n \"mconds M = (foldr (op \\) (map (snd \\ zc_event \\ fst) (stateGuards M)) false \\\n foldr (op \\) (map (zc_restore \\ fst) (stateGuards M)) false \\ \n foldr (op \\) (map (ti_event \\ fst) (timeGuards M)) false)\"\n \ntext {* For discrete events, we first execute each time event up to once, and then enter iteration\n for the state events. *}\n \ndefinition mdeqs :: \"('l::t2_space,'c::t2_space) mblock \\ ('l,'c) mrel\" where\n[upred_defs, mo_defs]: \"mdeqs M = \n (foldr (op ;;) (map (\\ (R, dq). dq \\ \\R\\(&\\<^bold>c:time)\\<^sub>a \\\\<^sub>R II\\<^sub>R) (timeGuards M)) II\\<^sub>R) ;;\n (\\\\<^sub>R X \\ foldr \n (\\ (zcf, dq) q. \n (dq ;; X) \\ (\\zcf\\\\<^sub>< \\\\<^sub>u \\eps\\<^sub>m\\)\\&\\<^bold>d/&\\<^bold>c\\ \\ (\\zcf\\\\<^sub>< <\\<^sub>u \\eps\\<^sub>m\\) \\\\<^sub>R q) (stateGuards M) II\\<^sub>R)\"\n (* zcf previously not satisfied ---^ ^--- now it is *)\n\ndefinition CoreTime :: \"('l::t2_space,'c::t2_space) mblock\" where\n[upred_defs, mo_defs]:\n \"CoreTime = \\ minit = (&time =\\<^sub>u 0), mceqs = &time \\\\<^sub>h ($time + \\ti\\), mgrds = [] \\\"\n\ndefinition mblock_comp :: \"('l,'c) mblock \\ ('l,'c) mblock \\ ('l,'c) mblock\" (infixr \"\\\\<^sub>m\" 85) where\n[upred_defs, mo_defs]:\n\"A \\\\<^sub>m B = \\ minit = (minit A \\ minit B)\n , mceqs = (mceqs A \\ mceqs B)\n , mgrds = (mgrds A @ mgrds B) \\\"\n \ndefinition mblock_sem :: \"('l::t2_space,'c::t2_space) mblock \\ ('l,'c) mrel\" (\"\\_\\\\<^sub>m\") where\n[upred_defs, mo_defs]:\n\"\\M\\\\<^sub>m = (let M' = CoreTime \\\\<^sub>m M in\n \\<^bold>R\\<^sub>s(true\\<^sub>r \\ false \\ [minit M']\\<^sub>C\\<^sub>>) ;; \n (\\\\<^sub>R X \\ \\<^bold>d :=\\<^sub>R &\\<^bold>c ;; ([mceqs M']\\<^sub>H [minvs M' | mconds M']\\<^sub>H\\<^sup>+ (mdeqs M')) ;; X))\"\n*)\n \ndefault_sort t2_space\n\nend\n", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/modelica/noncomp/Modelica_Blocks_Core.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.39606816627404173, "lm_q1q2_score": 0.2579809214808927}} {"text": "theory Cell\n imports Simpl.Vcg \"Rust-Verification.Rust_Semantics\"\nbegin\n\ntext \\Formalization of Cell. In this theory, we interpret &Cell as\na SharedReadWrite pointer to the location.\\\n\nrecord cell_env = globals_ram +\n self :: tagged_ref\n return :: tagged_ref\n\nrecord cell_set_env = cell_env +\n val :: tagged_ref\n\nrecord cell_swap_env = cell_env +\n other :: tagged_ref\n tmp :: tagged_ref \\ \\inlining local variable for ptr::swap\\\n\n(* TODO: Current definition demands only read grant of argument, but it should be owner grant\n * because Cell::set moves the argument.\n *)\ndefinition cell_set_body :: \"(cell_set_env, 'p, rust_error) com\" where\n \"cell_set_body == copy_betw_places val self\"\n\n(* TODO: We need to define a \"calling convention\" for handling arguments/return value.\n *)\ndefinition cell_get_body :: \"(cell_env, 'p, rust_error) com\" where\n \"cell_get_body == copy_betw_places self return\"\n\ntext \\The implementation of Cell::swap is basically along the following lines\n(inlining ptr::swap):\n\n``` rust\nif ptr::eq(self, other) {\n return\n}\n\nlet tmp = uninit();\n*tmp = *self;\n*self = *other;\n*other = *tmp;\n```\n\naccording to \\<^url>\\https://doc.rust-lang.org/src/core/cell.rs.html#364-375\\ and\n\\<^url>\\https://doc.rust-lang.org/src/core/ptr/mod.rs.html#373-388\\.\n\\\n\ndefinition cell_swap_body :: \"(cell_swap_env, 'p, rust_error) com\" where\n \"cell_swap_body ==\n IFR {s. ptr_eq (self s) (other s)}\n THEN\n Skip\n ELSE\n \\ \\Initializing tmp with uninit\\\n Basic (\\s. (let (r, s') = heap_new uninit s in s'\\ tmp := r \\));;\n\n \\ \\*tmp = *self\\\n copy_betw_places self tmp;;\n \\ \\*self = *other\\\n copy_betw_places other self;;\n \\ \\*self = *tmp\\\n copy_betw_places tmp other\n FI\n\"\n\nlemma cell_set_value_safety: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ readable (val s) s}\n cell_set_body\n {s. True}\"\n unfolding cell_set_body_def\n apply vcg\n by (auto simp add: Let_def)\n\n\\ \\A proof that shows self and val have the same value after Cell::set.\\\nlemma cell_set_value: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ readable (val s) s}\n cell_set_body\n {s. memread (self s) s = memread (val s) s}\"\n unfolding cell_set_body_def\n apply vcg\n apply (auto simp add: Let_def)\n by (metis nth_list_update_eq nth_list_update_neq)\n\nlemma cell_get_value_safety: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ writable (return s) s}\n cell_get_body\n {s. True}\"\n unfolding cell_get_body_def\n apply vcg\n by (auto simp add: Let_def)\n\n\\ \\A proof that shows self and return have the same value after Cell::get.\\\nlemma cell_get_value: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ writable (return s) s}\n cell_get_body\n {s. memread (self s) s = memread (return s) s}\"\n unfolding cell_get_body_def\n apply vcg\n apply (auto simp add: Let_def)\n by (metis nth_list_update_eq nth_list_update_neq)\n\nlemma cell_swap_safety: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ permission_is SharedReadWrite (other s) s}\n cell_swap_body\n {s. True}\"\n unfolding cell_swap_body_def\n apply vcg\n apply (auto simp add: Let_def nth_append)\n using permission_is_imp_writable writable_pop_tags by auto\n\n\\ \\A proof that shows Cell::swap(self, other) swaps the value in the memory.\\\nlemma cell_swap_correctness: \"\\ \\\\<^sub>t\n {s. wf_heap s\n \\ permission_is SharedReadWrite (self s) s\n \\ permission_is SharedReadWrite (other s) s\n \\ memread (self s) s = x\n \\ memread (other s) s = y}\n cell_swap_body\n {s. memread (self s) s = y \\ memread (other s) s = x}\"\n unfolding cell_swap_body_def\n apply vcg\n apply (auto simp add: Let_def nth_append)\n using permission_is_imp_writable writable_pop_tags by auto\n\nend", "meta": {"author": "pandaman64", "repo": "sabi", "sha": "a5de6b33cb0e5b9e6f0e610de0a3536236d1a694", "save_path": "github-repos/isabelle/pandaman64-sabi", "path": "github-repos/isabelle/pandaman64-sabi/sabi-a5de6b33cb0e5b9e6f0e610de0a3536236d1a694/Rustv/Tests/ex/Cell.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2578294935052086}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection \\ICING variant\\\ntext\\We abstract and simplify from the protocol ICING in several ways. First, we only consider \nProofs of Consent (PoC), not Proofs of Provenance (PoP). Our framework does not support proving the\npath validation properties that PoPs provide, and it also currently does not support XOR, and \ndynamically changing hop fields.\nThus, instead of embedding $A_i \\oplus PoP_{0,1}$, we embed $A_i$ directly.\nWe also remove the payload from the Hash that is included in each packet.\n\nWe offer three versions of this protocol:\n\\begin{itemize}\n\\item @{text \"ICING\"}, which contains our best effort at modeling the protocol as accurately as \npossible.\n\\item @{text \"ICING_variant\"}, in which we strip down the protocol to what is required to obtain the\nsecurity guarantees and remove unnecessary fields.\n\\item @{text \"ICING_variant2\"}, in which we furthermore simplify the protocol. The key of the MAC in\nthis protocol is only the key of the AS, as opposed to a key derived specifically for this hop field.\nIn order to prove that this scheme is secure, we have to assume that ASes only occur once on an\nauthorized path, since otherwise the MAC for two different hop fields (by the same AS) would be the\nsame, and the AS could not distinguish the hop fields based on the MAC.\n\\end{itemize}\\\ntheory ICING_variant\n imports\n \"../Parametrized_Dataplane_3_undirected\"\nbegin\n\nlocale icing_defs = network_assums_undirect _ _ _ auth_seg0 \n for auth_seg0 :: \"(msgterm \\ ahi list) set\"\nbegin\n\n(******************************************************************************)\nsubsection \\Hop validation check and extract functions\\\n(******************************************************************************)\ntype_synonym ICING_HF = \"(unit, unit) HF\"\n\ntext\\The term @{term \"sntag\"} is a key that is derived from the key of an AS and a specific\nhop field. We use it in the computation of @{term \"hf_valid\"}.\\\n\nfun sntag :: \"ahi \\ msgterm\" where\n \"sntag \\UpIF = upif, DownIF = downif, ASID = asid\\ = \\macKey asid,\\if2term upif,if2term downif\\\\\"\n\nlemma sntag_eq: \"sntag ahi2 = sntag ahi1 \\ ahi2 = ahi1\"\n by(cases ahi1,cases ahi2) auto\n\ntext\\The predicate @{term \"hf_valid\"} is given to the concrete parametrized model as a parameter.\nIt ensures the authenticity of the hop authenticator in the hop field. The predicate takes an \nexpiration timestamp (in this model always a numeric value, hence the matching on \n@{term \"Num PoC_i_expire\"}), the entire segment and the hop field to be validated.\\\nfun hf_valid :: \"msgterm \\ msgterm\n \\ ICING_HF list\n \\ ICING_HF \n \\ bool\" where \n \"hf_valid (Num PoC_i_expire) uinfo hfs \\AHI = ahi, UHI = uhi, HVF = x\\ \\ uhi = () \\ \n x = Mac[sntag ahi] (L ((Num PoC_i_expire)#(map (hf2term o AHI) hfs))) \\ uinfo = \\\"\n| \"hf_valid _ _ _ _ = False\"\n\ntext\\We can extract the entire path (past and future) from the hvf field.\\\nfun extr :: \"msgterm \\ ahi list\" where\n \"extr (Mac[_] (L hfs))\n = map term2hf (tl hfs)\"\n| \"extr _ = []\"\n\ntext\\Extract the authenticated info field from a hop validation field.\\\nfun extr_ainfo :: \"msgterm \\ msgterm\" where \n \"extr_ainfo (Mac[_] (L (Num ts # xs))) = Num ts\"\n| \"extr_ainfo _ = \\\"\n\nabbreviation term_ainfo :: \"msgterm \\ msgterm\" where\n \"term_ainfo \\ id\"\n\ntext\\An authenticated info field is always a number (corresponding to a timestamp). The \n unauthenticated info field is set to the empty term @{term \"\\\"}.\\\ndefinition auth_restrict where \n \"auth_restrict ainfo uinfo l \\ (\\ts. ainfo = Num ts) \\ (uinfo = \\)\"\n\ntext\\When observing a hop field, an attacker learns the HVF. UHI is empty and the AHI only contains \npublic information that are not terms.\\\nfun terms_hf :: \"ICING_HF \\ msgterm set\" where \n \"terms_hf hf = {HVF hf}\"\n\nabbreviation terms_uinfo :: \"msgterm \\ msgterm set\" where \n \"terms_uinfo x \\ {x}\"\n\nabbreviation no_oracle where \"no_oracle \\ (\\ _ _. True)\"\n\ntext\\We now define useful properties of the above definition.\\\nlemma hf_valid_invert:\n \"hf_valid tsn uinfo hfs hf \\\n(\\ ts ahi. tsn = Num ts \\ ahi = AHI hf \\\nUHI hf = () \\\nHVF hf = Mac[sntag ahi] (L ((Num ts)#(map (hf2term o AHI) hfs))) \\ uinfo = \\)\"\n apply(cases hf) by(auto elim!: hf_valid.elims)\n\nlemma hf_valid_auth_restrict[dest]: \"hf_valid ainfo uinfo hfs hf \\ auth_restrict ainfo uinfo l\"\n by(auto simp add: hf_valid_invert auth_restrict_def)\n\nlemma auth_restrict_ainfo[dest]: \"auth_restrict ainfo uinfo l \\ \\ts. ainfo = Num ts\"\n by(auto simp add: auth_restrict_def)\nlemma auth_restrict_uinfo[dest]: \"auth_restrict ainfo uinfo l \\ uinfo = \\\"\n by(auto simp add: auth_restrict_def)\n\n\nlemma info_hvf: \n assumes \"hf_valid ainfo uinfo hfs m\" \"hf_valid ainfo' uinfo' hfs' m'\" \n \"HVF m = HVF m'\" \"m \\ set hfs\" \"m' \\ set hfs'\"\n shows \"ainfo' = ainfo\" \"m' = m\"\n using assms\n apply(auto simp add: hf_valid_invert intro: ahi_eq)\n apply(cases m,cases m')\n by(auto intro: sntag_eq)\n\n\n(******************************************************************************)\nsubsection\\Definitions and properties of the added intruder knowledge\\\n(******************************************************************************)\ntext\\Here we define a @{text \"ik_add\"} and @{text \"ik_oracle\"} as being empty, as these features are\nnot used in this instance model.\\\nprint_locale dataplane_3_undirected_defs\nsublocale dataplane_3_undirected_defs _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo \n term_ainfo terms_hf terms_uinfo no_oracle\n by unfold_locales\n\ndeclare parts_singleton[dest]\n\nabbreviation ik_add :: \"msgterm set\" where \"ik_add \\ {}\"\n\nabbreviation ik_oracle :: \"msgterm set\" where \"ik_oracle \\ {}\"\n\nlemma uinfo_empty[dest]: \"(ainfo, hfs) \\ auth_seg2 uinfo \\ uinfo = \\\"\n by(auto simp add: auth_seg2_def auth_restrict_def)\n\n(******************************************************************************)\nsubsection\\Properties of the intruder knowledge, including @{text \"ik_add\"} and @{text \"ik_oracle\"}\\\n (******************************************************************************)\ntext\\We now instantiate the parametrized model's definition of the intruder knowledge, using the\ndefinitions of @{text \"ik_add\"} and @{text \"ik_oracle\"} from above. We then prove the properties \nthat we need to instantiate the @{text \"dataplane_3_undirected\"} locale.\\\nprint_locale dataplane_3_undirected_ik_defs\nsublocale\n dataplane_3_undirected_ik_defs _ _ _ auth_seg0 terms_uinfo no_oracle hf_valid auth_restrict extr \n extr_ainfo term_ainfo terms_hf ik_add ik_oracle\n by unfold_locales\n\nlemma ik_hfs_form: \"t \\ parts ik_hfs \\ \\ t' . t = Hash t'\"\n apply auto apply(drule parts_singleton)\n by(auto simp add: auth_seg2_def hf_valid_invert)\n\ndeclare ik_hfs_def[simp del]\n\nlemma parts_ik_hfs[simp]: \"parts ik_hfs = ik_hfs\"\n by (auto intro!: parts_Hash ik_hfs_form)\n\ntext\\This lemma allows us not only to expand the definition of @{term \"ik_hfs\"}, but also \nto obtain useful properties, such as a term being a Hash, and it being part of a valid hop field.\\\nlemma ik_hfs_simp: \n \"t \\ ik_hfs \\ (\\t' . t = Hash t') \\ (\\hf . t = HVF hf\n \\ (\\hfs. hf \\ set hfs \\ (\\ainfo uinfo. (ainfo, hfs) \\ auth_seg2 uinfo\n \\ hf_valid ainfo uinfo hfs hf)))\" (is \"?lhs \\ ?rhs\")\nproof \n assume asm: \"?lhs\" \n then obtain ainfo uinfo hf hfs where \n dfs: \"hf \\ set hfs\" \"(ainfo, hfs) \\ auth_seg2 uinfo\" \"t = HVF hf\"\n by(auto simp add: ik_hfs_def)\n then obtain uinfo where \"hfs_valid_prefix ainfo uinfo [] hfs = hfs\" \"(ainfo, AHIS hfs) \\ auth_seg0\"\n by(auto simp add: auth_seg2_def)\n then show \"?rhs\" using asm dfs\n by (auto 3 4 simp add: auth_seg2_def intro!: ik_hfs_form exI[of _ hf]) \nqed(auto simp add: ik_hfs_def)\n\nlemma ik_uinfo_empty[simp]: \"ik_uinfo = {\\}\" \n by(auto simp add: ik_uinfo_def auth_seg2_def auth_restrict_def intro!: exI[of _ \"[]\"])\ndeclare ik_uinfo_def[simp del]\n\n(******************************************************************************)\nsubsubsection \\Properties of Intruder Knowledge\\\n(******************************************************************************)\nlemma auth_ainfo[dest]: \"\\(ainfo, hfs) \\ auth_seg2 uinfo\\ \\ \\ ts . ainfo = Num ts\"\n by(auto simp add: auth_seg2_def)\n\nlemma Num_ik[intro]: \"Num ts \\ ik\"\n by(auto simp add: ik_def auth_seg2_def auth_restrict_def intro!: exI[of _ \"[]\"])\n\ntext \\There are no ciphertexts (or signatures) in @{term \"parts ik\"}. Thus, @{term \"analz ik\"}\nand @{term \"parts ik\"} are identical.\\\nlemma analz_parts_ik[simp]: \"analz ik = parts ik\"\n by(rule no_crypt_analz_is_parts)\n (auto simp add: ik_def auth_seg2_def ik_hfs_simp auth_restrict_def)\n\nlemma parts_ik[simp]: \"parts ik = ik\"\n by(auto 3 4 simp add: ik_def auth_seg2_def auth_restrict_def dest!: parts_singleton_set)\n\nlemma sntag_synth_bad: \"sntag ahi \\ synth ik \\ ASID ahi \\ bad\"\n apply(cases ahi)\n by(auto simp add: ik_def ik_hfs_simp)\n\n(******************************************************************************)\nsubsection\\Direct proof goals for interpretation of @{text \"dataplane_3_undirected\"}\\\n(******************************************************************************)\n\nlemma COND_honest_hf_analz:\n assumes \"ASID (AHI hf) \\ bad\" \"hf_valid ainfo uinfo hfs hf\" \"terms_hf hf \\ synth (analz ik)\"\n \"no_oracle ainfo uinfo\" \"hf \\ set hfs\"\n shows \"terms_hf hf \\ analz ik\"\nproof-\n from assms(3) have hf_synth_ik: \"HVF hf \\ synth ik\" by auto\n then have \"\\hfs uinfo. hf \\ set hfs \\ (ainfo, hfs) \\ auth_seg2 uinfo\"\n using assms(1,2,4,5) \n apply(auto simp add: ik_def hf_valid_invert ik_hfs_simp)\n subgoal for ts' hf' hfs'\n using HF.equality by (fastforce dest!: sntag_eq intro: exI[of _ hfs'])\n by(auto simp add: ik_hfs_simp ik_def hf_valid_invert sntag_synth_bad)\n then have \"HVF hf \\ ik\"\n using assms(2)\n by(auto simp add: ik_hfs_def intro!: ik_ik_hfs intro!: exI) \n then show ?thesis by auto\nqed\n\nlemma COND_terms_hf: \n assumes \"hf_valid ainfo uinfo hfs hf\" and \"HVF hf \\ ik\" and \"no_oracle ainfo uinfo\" and \"hf \\ set hfs\"\n shows \"\\hfs. hf \\ set hfs \\ (\\uinfo' . (ainfo, hfs) \\ auth_seg2 uinfo')\"\n using assms apply(auto 3 4 simp add: hf_valid_invert ik_hfs_simp ik_def dest: ahi_eq)\n apply(frule sntag_eq)\n apply(auto simp add: ik_def ik_hfs_simp)\n by (metis (mono_tags, lifting) HF.surjective old.unit.exhaust)\n\nlemma COND_extr:\n \"\\hf_valid ainfo uinfo l hf\\ \\ extr (HVF hf) = AHIS l\"\n by(auto simp add: hf_valid_invert)\n\nlemma COND_hf_valid_uinfo:\n \"\\hf_valid ainfo uinfo l hf; hf_valid ainfo' uinfo' l' hf\\ \n \\ uinfo' = uinfo\"\n by(auto simp add: hf_valid_invert)\n\n(******************************************************************************)\nsubsection\\Instantiation of @{text \"dataplane_3_undirected\"} locale\\\n(******************************************************************************)\nprint_locale dataplane_3_undirected\nsublocale\n dataplane_3_undirected _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo term_ainfo terms_uinfo ik_add terms_hf \n ik_oracle no_oracle\n apply unfold_locales\n using COND_terms_hf COND_honest_hf_analz COND_extr COND_hf_valid_uinfo by auto\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/instances/ICING_variant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.4493926344647596, "lm_q1q2_score": 0.2578068443095664}} {"text": "theory Bisim_Struct_Cong\n imports Bisim_Pres Sim_Struct_Cong Structural_Congruence\nbegin\n\ncontext env begin\n\nlemma bisim_par_comm:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n \n shows \"\\ \\ P \\ Q \\ Q \\ P\"\nproof -\n let ?X = \"{((\\::'b), \\\\*xvec\\((P::('a, 'b, 'c) psi) \\ Q), \\\\*xvec\\(Q \\ P)) | xvec \\ P Q. xvec \\* \\}\"\n \n have \"eqvt ?X\"\n by(force simp add: eqvt_def pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n\n have \"(\\, P \\ Q, Q \\ P) \\ ?X\"\n apply auto by(rule_tac x=\"[]\" in exI) auto\n thus ?thesis\n proof(coinduct rule: bisim_weak_coinduct)\n case(c_stat_eq \\ PQ QP)\n from `(\\, PQ, QP) \\ ?X`\n obtain xvec P Q where P_frQ: \"PQ = \\\\*xvec\\(P \\ Q)\" and Q_frP: \"QP = \\\\*xvec\\(Q \\ P)\" and \"xvec \\* \\\"\n by auto\n\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* Q\"\n by(rule_tac C=\"(\\, Q)\" in fresh_frame) auto\n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\\<^sub>P\"\n by(rule_tac C=\"(\\, A\\<^sub>P, \\\\<^sub>P)\" in fresh_frame) auto\n from FrQ `A\\<^sub>Q \\* A\\<^sub>P` `A\\<^sub>P \\* Q` have \"A\\<^sub>P \\* \\\\<^sub>Q\" by(force dest: extract_frame_fresh_chain)\n have \"\\(xvec@A\\<^sub>P@A\\<^sub>Q), \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q\\ \\\\<^sub>F \\(xvec@A\\<^sub>Q@A\\<^sub>P), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>P\\\"\n by(simp add: frame_chain_append)\n (metis frame_res_chain_pres frame_res_chain_comm frame_nil_stat_eq composition_sym Associativity Commutativity Frame_stat_eq_trans)\n with FrP FrQ P_frQ Q_frP `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>P` `A\\<^sub>Q \\* A\\<^sub>P` `xvec \\* \\` `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\`\n show ?case by(auto simp add: frame_chain_append)\n next\n case(c_sim \\ PQ QP)\n from `(\\, PQ, QP) \\ ?X` \n obtain xvec P Q where P_frQ: \"PQ = \\\\*xvec\\(P \\ Q)\" and Q_frP: \"QP = \\\\*xvec\\(Q \\ P)\"\n and \"xvec \\* \\\"\n by auto\n moreover have \"\\ \\ \\\\*xvec\\(P \\ Q) \\[?X] \\\\*xvec\\(Q \\ P)\"\n proof -\n have \"\\ \\ P \\ Q \\[?X] Q \\ P\"\n proof -\n\tnote `eqvt ?X`\n\tmoreover have \"\\\\ P Q. (\\, P \\ Q, Q \\ P) \\ ?X\"\n\t apply auto by(rule_tac x=\"[]\" in exI) auto\n\tmoreover have \"\\\\ P Q xvec. \\(\\, P, Q) \\ ?X; xvec \\* \\\\ \\ (\\, \\\\*xvec\\P, \\\\*xvec\\Q) \\ ?X\"\n\t apply(induct xvec, auto)\n\t by(rule_tac x=\"xvec@xveca\" in exI) (auto simp add: res_chain_append)\n\tultimately show ?thesis by(rule sim_par_comm) \n qed\n moreover note `eqvt ?X` `xvec \\* \\`\n moreover have \"\\\\ P Q x. \\(\\, P, Q) \\ ?X; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ ?X\"\n\tapply auto\n\tby(rule_tac x=\"x#xvec\" in exI) auto\n ultimately show ?thesis by(rule res_chain_pres) \n qed\n ultimately show ?case by simp\n next\n case(c_ext \\ PQ QP \\')\n from `(\\, PQ, QP) \\ ?X`\n obtain xvec P Q where P_frQ: \"PQ = \\\\*xvec\\(P \\ Q)\" and Q_frP: \"QP = \\\\*xvec\\(Q \\ P)\"\n and \"xvec \\* \\\"\n by auto\n \n obtain p where \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* P\"\n and \"(p \\ xvec) \\* Q\"\n and \"(p \\ xvec) \\* \\'\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinct_perm p\"\n by(rule_tac c=\"(\\, P, Q, \\')\" in name_list_avoiding) auto\n\n from `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` S have \"\\\\*xvec\\(P \\ Q) = \\\\*(p \\ xvec)\\(p \\ (P \\ Q))\"\n by(subst res_chain_alpha) auto\n hence P_q_alpha: \"\\\\*xvec\\(P \\ Q) = \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ Q))\"\n by(simp add: eqvts)\n\n from `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` S have \"\\\\*xvec\\(Q \\ P) = \\\\*(p \\ xvec)\\(p \\ (Q \\ P))\"\n by(subst res_chain_alpha) auto\n hence Q_p_alpha: \"\\\\*xvec\\(Q \\ P) = \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ P))\"\n by(simp add: eqvts)\n\n from `(p \\ xvec) \\* \\` `(p \\ xvec) \\* \\'` have \"(\\ \\ \\', \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ Q)), \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ P))) \\ ?X\"\n by auto\n with P_frQ Q_frP P_q_alpha Q_p_alpha show ?case by simp\n next\n case(c_sym \\ PR QR)\n thus ?case by blast\n qed\nqed\n\nlemma bisim_res_comm:\n fixes x :: name\n and \\ :: 'b\n and y :: name\n and P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ \\\\x\\(\\\\y\\P) \\ \\\\y\\(\\\\x\\P)\"\nproof(cases \"x=y\")\n case True\n thus ?thesis by(blast intro: bisim_reflexive)\nnext\n case False\n {\n fix x::name and y::name and P::\"('a, 'b, 'c) psi\"\n assume \"x \\ \\\" and \"y \\ \\\"\n let ?X = \"{((\\::'b), \\\\x\\(\\\\y\\(P::('a, 'b, 'c) psi)), \\\\y\\(\\\\x\\P)) | \\ x y P. x \\ \\ \\ y \\ \\}\"\n from `x \\ \\` `y \\ \\` have \"(\\, \\\\x\\(\\\\y\\P), \\\\y\\(\\\\x\\P)) \\ ?X\" by auto\n hence \"\\ \\ \\\\x\\(\\\\y\\P) \\ \\\\y\\(\\\\x\\P)\"\n proof(coinduct rule: bisim_coinduct)\n case(c_stat_eq \\ xyP yxP)\n from `(\\, xyP, yxP) \\ ?X` obtain x y P where \"x \\ \\\" and \"y \\ \\\" and \"xyP = \\\\x\\(\\\\y\\P)\" and \"yxP = \\\\y\\(\\\\x\\P)\" by auto\n moreover obtain A\\<^sub>P \\\\<^sub>P where \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"x \\ A\\<^sub>P\" and \"y \\ A\\<^sub>P\"\n\tby(rule_tac C=\"(x, y, \\)\" in fresh_frame) auto\n ultimately show ?case by(force intro: frame_res_comm Frame_stat_eq_trans)\n next\n case(c_sim \\ xyP yxP)\n from `(\\, xyP, yxP) \\ ?X` obtain x y P where \"x \\ \\\" and \"y \\ \\\" and \"xyP = \\\\x\\(\\\\y\\P)\" and \"yxP = \\\\y\\(\\\\x\\P)\" by auto\n note `x \\ \\` `y \\ \\`\n moreover have \"eqvt ?X\" by(force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n hence \"eqvt(?X \\ bisim)\" by auto\n moreover have \"\\\\ P. (\\, P, P) \\ ?X \\ bisim\" by(blast intro: bisim_reflexive)\n moreover have \"\\\\ x y P. \\x \\ \\; y \\ \\\\ \\ (\\, \\\\x\\(\\\\y\\P), \\\\y\\(\\\\x\\P)) \\ ?X \\ bisim\" by auto\n ultimately have \"\\ \\ \\\\x\\(\\\\y\\P) \\[(?X \\ bisim)] \\\\y\\(\\\\x\\P)\" by(rule res_comm)\n with `xyP = \\\\x\\(\\\\y\\P)` `yxP = \\\\y\\(\\\\x\\P)` show ?case\n\tby simp\n next\n case(c_ext \\ xyP yxP \\')\n from `(\\, xyP, yxP) \\ ?X` obtain x y P where \"x \\ \\\" and \"y \\ \\\" and xy_peq: \"xyP = \\\\x\\(\\\\y\\P)\" and yx_peq: \"yxP = \\\\y\\(\\\\x\\P)\" by auto\n show ?case\n proof(case_tac \"x=y\")\n\tassume \"x = y\"\n\twith xy_peq yx_peq show ?case\n\t by(blast intro: bisim_reflexive)\n next\n\tassume \"x \\ y\"\n\tobtain x' where \"x' \\ \\\" and \"x' \\ \\'\" and \"x' \\ x\" and \"x' \\ y\" and \"x' \\ P\" by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\tobtain y' where \"y' \\ \\\" and \"y' \\ \\'\" and \"y' \\ x\" and \"x' \\ y'\" and \"y' \\ y\" and \"y' \\ P\" by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\twith xy_peq `y' \\ P` `x' \\ P` `x \\ y` `x' \\ y` `y' \\ x` have \"\\\\x\\(\\\\y\\P) = \\\\x'\\(\\\\y'\\([(x, x')] \\ [(y, y')] \\ P))\"\n\t apply(subst alpha_res[of x']) apply(simp add: abs_fresh) by(subst alpha_res[of y' _ y]) (auto simp add: eqvts calc_atm)\n\tmoreover with yx_peq `y' \\ P` `x' \\ P` `x \\ y` `x' \\ y` `y' \\ x` `x' \\ y'` have \"\\\\y\\(\\\\x\\P) = \\\\y'\\(\\\\x'\\([(y, y')] \\ [(x, x')] \\ P))\"\n\t apply(subst alpha_res[of y']) apply(simp add: abs_fresh) by(subst alpha_res[of x' _ x]) (auto simp add: eqvts calc_atm)\n\twith `x \\ y` `x' \\ y` `y' \\ y` `x' \\ x` `y' \\ x` `x' \\ y'` have \"\\\\y\\(\\\\x\\P) = \\\\y'\\(\\\\x'\\([(x, x')] \\ [(y, y')] \\ P))\"\n\t by(subst perm_compose) (simp add: calc_atm)\n\tmoreover from `x' \\ \\` `x' \\ \\'` `y' \\ \\` `y' \\ \\'` have \"(\\ \\ \\', \\\\x'\\(\\\\y'\\([(x, x')] \\ [(y, y')] \\ P)), \\\\y'\\(\\\\x'\\([(x, x')] \\ [(y, y')] \\ P))) \\ ?X\"\n\t by auto\n\tultimately show ?case using xy_peq yx_peq by simp\n qed\n next\n case(c_sym \\ xyP yxP)\n thus ?case by auto\n qed\n }\n moreover obtain x'::name where \"x' \\ \\\" and \"x' \\ P\" and \"x' \\ x\" and \"x' \\ y\"\n by(generate_fresh \"name\") auto\n moreover obtain y'::name where \"y' \\ \\\" and \"y' \\ P\" and \"y' \\ x\" and \"y' \\ y\" and \"y' \\ x'\"\n by(generate_fresh \"name\") auto\n ultimately have \"\\ \\ \\\\x'\\(\\\\y'\\([(y, y'), (x, x')] \\ P)) \\ \\\\y'\\(\\\\x'\\([(y, y'), (x, x')] \\ P))\" by auto\n thus ?thesis using `x' \\ P` `x' \\ x` `x' \\ y` `y' \\ P` `y' \\ x` `y' \\ y` `y' \\ x'` `x \\ y`\n apply(subst alpha_res[where x=x and y=x' and P=P], auto)\n apply(subst alpha_res[where x=y and y=y' and P=P], auto)\n apply(subst alpha_res[where x=x and y=x' and P=\"\\\\y'\\([(y, y')] \\ P)\"], auto simp add: abs_fresh fresh_left)\n apply(subst alpha_res[where x=y and y=y' and P=\"\\\\x'\\([(x, x')] \\ P)\"], auto simp add: abs_fresh fresh_left)\n by(subst perm_compose) (simp add: eqvts calc_atm)\nqed\n\nlemma bisim_res_comm':\n fixes x :: name\n and \\ :: 'b\n and xvec :: \"name list\"\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ \\\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\x\\(\\\\*xvec\\P) \\ \\\\*xvec\\(\\\\x\\P)\"\nusing assms\nby(induct xvec) (auto intro: bisim_res_comm bisim_reflexive bisim_res_pres bisim_transitive)\n\nlemma bisim_scope_ext:\n fixes x :: name\n and \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ P\"\n\n shows \"\\ \\ \\\\x\\(P \\ Q) \\ P \\ \\\\x\\Q\"\nproof -\n {\n fix x::name and Q :: \"('a, 'b, 'c) psi\"\n assume \"x \\ \\\" and \"x \\ P\"\n let ?X1 = \"{((\\::'b), \\\\*xvec\\(\\\\x\\((P::('a, 'b, 'c) psi) \\ Q)), \\\\*xvec\\(P \\ \\\\x\\Q)) | \\ xvec x P Q. x \\ \\ \\ x \\ P \\ xvec \\* \\}\"\n let ?X2 = \"{((\\::'b), \\\\*xvec\\((P::('a, 'b, 'c) psi) \\ \\\\x\\Q), \\\\*xvec\\(\\\\x\\(P \\ Q))) | \\ xvec x P Q. x \\ \\ \\ x \\ P \\ xvec \\* \\}\"\n let ?X = \"?X1 \\ ?X2\"\n\n from `x \\ \\` `x \\ P` have \"(\\, \\\\x\\(P \\ Q), P \\ \\\\x\\Q) \\ ?X\"\n by(auto, rule_tac x=\"[]\" in exI) (auto simp add: fresh_list_nil)\n moreover have \"eqvt ?X\"\n by(rule eqvt_union)\n (force simp add: eqvt_def eqvts pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] pt_fresh_bij[OF pt_name_inst, OF at_name_inst])+\n ultimately have \"\\ \\ \\\\x\\(P \\ Q) \\ P \\ \\\\x\\Q\"\n proof(coinduct rule: transitive_coinduct)\n case(c_stat_eq \\ R T)\n show ?case\n proof(case_tac \"(\\, R, T) \\ ?X1\")\n\tassume \"(\\, R, T) \\ ?X1\"\n\tthen obtain xvec x P Q where \"R = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and \"T = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\tmoreover obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"x \\ A\\<^sub>P\" and \"A\\<^sub>P \\* Q\"\n\t by(rule_tac C=\"(\\, x, Q)\" in fresh_frame) auto\n\tmoreover obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"x \\ A\\<^sub>Q\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\\<^sub>P\"\n\t by(rule_tac C=\"(\\, x, A\\<^sub>P, \\\\<^sub>P)\" in fresh_frame) auto\n\tmoreover from FrQ `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>Q\"\n\t by(drule_tac extract_frame_fresh_chain) auto\n\tmoreover from `x \\ P` `x \\ A\\<^sub>P` FrP have \"x \\ \\\\<^sub>P\" by(drule_tac extract_frame_fresh) auto\n\tultimately show ?case\n\t by(force simp add: frame_chain_append intro: frame_res_comm' Frame_stat_eq_trans frame_res_chain_pres)\n next\n\tassume \"(\\, R, T) \\ ?X1\"\n\twith `(\\, R, T) \\ ?X` have \"(\\, R, T) \\ ?X2\" by blast\n\tthen obtain xvec x P Q where \"T = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and \"R = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\tmoreover obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"x \\ A\\<^sub>P\" and \"A\\<^sub>P \\* Q\"\n\t by(rule_tac C=\"(\\, x, Q)\" in fresh_frame) auto\n\tmoreover obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"x \\ A\\<^sub>Q\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\\<^sub>P\"\n\t by(rule_tac C=\"(\\, x, A\\<^sub>P, \\\\<^sub>P)\" in fresh_frame) auto\n\tmoreover from FrQ `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>Q\"\n\t by(drule_tac extract_frame_fresh_chain) auto\n\tmoreover from `x \\ P` `x \\ A\\<^sub>P` FrP have \"x \\ \\\\<^sub>P\" by(drule_tac extract_frame_fresh) auto\n\tultimately show ?case\n\t apply auto\n\t by(force simp add: frame_chain_append intro: frame_res_comm' Frame_stat_eq_trans frame_res_chain_pres Frame_stat_eq_sym)\n qed\n next\n case(c_sim \\ R T)\n let ?Y = \"{(\\, P, Q) | \\ P P' Q' Q. \\ \\ P \\ P' \\ ((\\, P', Q') \\ ?X \\ \\ \\ P' \\ Q') \\ \\ \\ Q' \\ Q}\"\n from `eqvt ?X` have \"eqvt ?Y\" by blast\n have C1: \"\\\\ R T y. \\(\\, R, T) \\ ?Y; (y::name) \\ \\\\ \\ (\\, \\\\y\\R, \\\\y\\T) \\ ?Y\"\n proof -\n\tfix \\ R T y\n\tassume \"(\\, R, T) \\ ?Y\"\n\tthen obtain R' T' where \"\\ \\ R \\ R'\" and \"(\\, R', T') \\ (?X \\ bisim)\" and \"\\ \\ T' \\ T\" by force\n\tassume \"(y::name) \\ \\\" \n\tshow \"(\\, \\\\y\\R, \\\\y\\T) \\ ?Y\"\n\tproof(case_tac \"(\\, R', T') \\ ?X\")\n\t assume \"(\\, R', T') \\ ?X\"\n\t show ?thesis\n\t proof(case_tac \"(\\, R', T') \\ ?X1\")\n\t assume \"(\\, R', T') \\ ?X1\"\n\t then obtain xvec x P Q where R'eq: \"R' = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and T'eq: \"T' = \\\\*xvec\\(P \\ \\\\x\\Q)\"\n and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\t from `\\ \\ R \\ R'` `y \\ \\` have \"\\ \\ \\\\y\\R \\ \\\\y\\R'\" by(rule bisim_res_pres)\n\t moreover from `xvec \\* \\` `y \\ \\` `x \\ P` `x \\ \\` have \"(\\, \\\\*(y#xvec)\\\\\\x\\(P \\ Q), \\\\*(y#xvec)\\(P \\ \\\\x\\Q)) \\ ?X1\"\n\t by(force simp del: res_chain.simps)\n\t with R'eq T'eq have \"(\\, \\\\y\\R', \\\\y\\T') \\ ?X \\ bisim\" by simp\n\t moreover from `\\ \\ T' \\ T` `y \\ \\` have \"\\ \\ \\\\y\\T' \\ \\\\y\\T\" by(rule bisim_res_pres)\n\t ultimately show ?thesis by blast\n\t next\n\t assume \"(\\, R', T') \\ ?X1\"\n\t with `(\\, R', T') \\ ?X` have \"(\\, R', T') \\ ?X2\" by blast\n\t then obtain xvec x P Q where T'eq: \"T' = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and R'eq: \"R' = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\t from `\\ \\ R \\ R'` `y \\ \\` have \"\\ \\ \\\\y\\R \\ \\\\y\\R'\" by(rule bisim_res_pres)\n\t moreover from `xvec \\* \\` `y \\ \\` `x \\ P` `x \\ \\` have \"(\\, \\\\*(y#xvec)\\(P \\ \\\\x\\Q), \\\\*(y#xvec)\\(\\\\x\\(P \\ Q))) \\ ?X2\"\n\t by(force simp del: res_chain.simps)\n\t with R'eq T'eq have \"(\\, \\\\y\\R', \\\\y\\T') \\ ?X \\ bisim\" by simp\n\t moreover from `\\ \\ T' \\ T` `y \\ \\` have \"\\ \\ \\\\y\\T' \\ \\\\y\\T\" by(rule bisim_res_pres)\n\t ultimately show ?thesis by blast\n\t qed\n\tnext\n\t assume \"(\\, R', T') \\ ?X\"\n\t with `(\\, R', T') \\ ?X \\ bisim` have \"\\ \\ R' \\ T'\" by blast\n\t with `\\ \\ R \\ R'` `\\ \\ T' \\ T` `y \\ \\` show ?thesis\n\t by(blast dest: bisim_res_pres)\n\tqed\n qed\n \n show ?case\n proof(case_tac \"(\\, R, T) \\ ?X1\")\n\tassume \"(\\, R, T) \\ ?X1\"\n\tthen obtain xvec x P Q where Req: \"R = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and Teq: \"T = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\thave \"\\ \\ \\\\*xvec\\(\\\\x\\(P \\ Q)) \\[?Y] \\\\*xvec\\(P \\ \\\\x\\Q)\"\n\tproof -\n\t have \"\\ \\ \\\\x\\(P \\ Q) \\[?Y] P \\ \\\\x\\Q\"\n\t proof -\n\t note `x \\ P` `x \\ \\` `eqvt ?Y`\n\t moreover have \"\\\\ P. (\\, P, P) \\ ?Y\" by(blast intro: bisim_reflexive)\n\t moreover have \"\\x \\ P Q xvec. \\x \\ \\; x \\ P; xvec \\* \\\\ \\ (\\, \\\\x\\(\\\\*xvec\\(P \\ Q)), \\\\*xvec\\(P \\ \\\\x\\Q)) \\ ?Y\"\n\t proof -\n\t fix x \\ P Q xvec\n\t assume \"(x::name) \\ (\\::'b)\" and \"x \\ (P::('a, 'b, 'c) psi)\" and \"(xvec::name list) \\* \\\"\n\t from `x \\ \\` `xvec \\* \\` have \"\\ \\ \\\\x\\(\\\\*xvec\\(P \\ Q)) \\ \\\\*xvec\\(\\\\x\\(P \\ Q))\"\n\t\tby(rule bisim_res_comm')\n\t moreover from `xvec \\* \\` `x \\ \\` `x \\ P` have \"(\\, \\\\*xvec\\(\\\\x\\(P \\ Q)), \\\\*xvec\\(P \\ \\\\x\\Q)) \\ ?X \\ bisim\"\n\t\tby blast\n\t ultimately show \"(\\, \\\\x\\(\\\\*xvec\\(P \\ Q)), \\\\*xvec\\(P \\ \\\\x\\Q)) \\ ?Y\" \n\t\tby(blast intro: bisim_reflexive)\n\t qed\n\t moreover have \"\\\\ xvec P x. \\x \\ \\; xvec \\* \\\\ \\ (\\, \\\\x\\(\\\\*xvec\\P), \\\\*xvec\\(\\\\x\\P)) \\ ?Y\"\n\t by(blast intro: bisim_res_comm' bisim_reflexive)\n\t ultimately show ?thesis by(rule scope_ext_left)\n\t qed\n\t thus ?thesis using `eqvt ?Y` `xvec \\* \\` C1 \n\t by(rule res_chain_pres)\n\tqed\n\twith Req Teq show ?case by simp\n next\n\tassume \"(\\, R, T) \\ ?X1\"\n\twith `(\\, R, T) \\ ?X` have \"(\\, R, T) \\ ?X2\" by blast\n\tthen obtain xvec x P Q where Teq: \"T = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and Req: \"R = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\thave \"\\ \\ \\\\*xvec\\(P \\ \\\\x\\Q) \\[?Y] \\\\*xvec\\(\\\\x\\(P \\ Q))\"\n\tproof -\n\t have \"\\ \\ P \\ \\\\x\\Q \\[?Y] \\\\x\\(P \\ Q)\"\n\t proof -\n\t note `x \\ P` `x \\ \\` `eqvt ?Y`\n\t moreover have \"\\\\ P. (\\, P, P) \\ ?Y\" by(blast intro: bisim_reflexive)\n\t moreover have \"\\x \\ P Q xvec. \\x \\ \\; x \\ P; xvec \\* \\\\ \\ (\\, \\\\*xvec\\(P \\ \\\\x\\Q), \\\\x\\(\\\\*xvec\\(P \\ Q))) \\ ?Y\"\n\t proof -\n\t fix x \\ P Q xvec\n\t assume \"(x::name) \\ (\\::'b)\" and \"x \\ (P::('a, 'b, 'c) psi)\" and \"(xvec::name list) \\* \\\"\n\t from `xvec \\* \\` `x \\ \\` `x \\ P` have \"(\\, \\\\*xvec\\(P \\ \\\\x\\Q), \\\\*xvec\\(\\\\x\\(P \\ Q))) \\ ?X \\ bisim\"\n\t\tby blast\n\t moreover from `x \\ \\` `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(\\\\x\\(P \\ Q)) \\ \\\\x\\(\\\\*xvec\\(P \\ Q))\"\n\t\tby(blast intro: bisim_res_comm' bisimE)\n\t ultimately show \"(\\, \\\\*xvec\\(P \\ \\\\x\\Q), \\\\x\\(\\\\*xvec\\(P \\ Q))) \\ ?Y\" \n\t\tby(blast intro: bisim_reflexive)\n\t qed\n\t ultimately show ?thesis by(rule scope_ext_right)\n\t qed\n\t thus ?thesis using `eqvt ?Y` `xvec \\* \\` C1 \n\t by(rule res_chain_pres)\n\tqed\n\twith Req Teq show ?case by simp\n qed\n next\n case(c_ext \\ R T \\')\n show ?case\n proof(case_tac \"(\\, R, T) \\ ?X1\")\n\tassume \"(\\, R, T) \\ ?X1\"\n\tthen obtain xvec x P Q where Req: \"R = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and Teq: \"T = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\tobtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ xvec\" and \"y \\ \\\" and \"y \\ \\'\"\n\t by(generate_fresh \"name\", auto simp add: fresh_prod)\n\n\tobtain p where \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\'\"\n and \"x \\ (p \\ xvec)\" and \"y \\ (p \\ xvec)\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinct_perm p\"\n\t by(rule_tac c=\"(\\, P, Q, x, y, \\')\" in name_list_avoiding) auto\n\t\n\t\n\tfrom `y \\ P` have \"(p \\ y) \\ (p \\ P)\" by(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n\twith S `y \\ xvec` `y \\ (p \\ xvec)` have \"y \\ (p \\ P)\" by simp\n\twith `(p \\ xvec) \\* \\` `y \\ \\` `(p \\ xvec) \\* \\'` `y \\ \\'`\n\thave \"(\\ \\ \\', \\\\*(p \\ xvec)\\(\\\\y\\((p \\ P) \\ (p \\ [(x, y)] \\ Q))), \\\\*(p \\ xvec)\\((p \\ P) \\ (\\\\y\\(p \\ [(x, y)] \\ Q)))) \\ ?X\"\n\t by auto\n\tmoreover from Req `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `y \\ xvec` `y \\ (p \\ xvec)` `x \\ (p \\ xvec)` `y \\ P` `y \\ Q` `x \\ P` S\n\thave \"R = \\\\*(p \\ xvec)\\(\\\\y\\((p \\ P) \\ (p \\ [(x, y)] \\ Q)))\"\n\t apply(erule_tac rev_mp)\n\t apply(subst alpha_res[of y])\n\t apply(clarsimp simp add: eqvts)\n\t apply(subst res_chain_alpha[of p])\n\t by(auto simp add: eqvts)\n\tmoreover from Teq `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `y \\ xvec` `y \\ (p \\ xvec)` `x \\ (p \\ xvec)` `y \\ P` `y \\ Q` `x \\ P` S\n\thave \"T = \\\\*(p \\ xvec)\\((p \\ P) \\ \\\\y\\(p \\ [(x, y)] \\ Q))\"\n\t apply(erule_tac rev_mp)\n\t apply(subst alpha_res[of y])\n\t apply(clarsimp simp add: eqvts)\n\t apply(subst res_chain_alpha[of p])\n\t by(auto simp add: eqvts)\n\tultimately show ?case\n\t by blast\n next\n\tassume \"(\\, R, T) \\ ?X1\"\n\twith `(\\, R, T) \\ ?X` have \"(\\, R, T) \\ ?X2\" by blast\n\tthen obtain xvec x P Q where Teq: \"T = \\\\*xvec\\(\\\\x\\(P \\ Q))\" and Req: \"R = \\\\*xvec\\(P \\ \\\\x\\Q)\" and \"xvec \\* \\\" and \"x \\ P\" and \"x \\ \\\"\n\t by auto\n\tobtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ xvec\" and \"y \\ \\\" and \"y \\ \\'\"\n\t by(generate_fresh \"name\", auto simp add: fresh_prod)\n\n\tobtain p where \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\'\"\n and \"x \\ (p \\ xvec)\" and \"y \\ (p \\ xvec)\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinct_perm p\"\n\t by(rule_tac c=\"(\\, P, Q, x, y, \\')\" in name_list_avoiding) auto\n\t\n\tfrom `y \\ P` have \"(p \\ y) \\ (p \\ P)\" by(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n\twith S `y \\ xvec` `y \\ (p \\ xvec)` have \"y \\ (p \\ P)\" by simp\n\twith `(p \\ xvec) \\* \\` `y \\ \\` `(p \\ xvec) \\* \\'` `y \\ \\'`\n\thave \"(\\ \\ \\', \\\\*(p \\ xvec)\\((p \\ P) \\ \\\\y\\(p \\ [(x, y)] \\ Q)), \\\\*(p \\ xvec)\\(\\\\y\\((p \\ P) \\ (p \\ [(x, y)] \\ Q)))) \\ ?X2\"\n\t by auto\n\tmoreover from Teq `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `y \\ xvec` `y \\ (p \\ xvec)` `x \\ (p \\ xvec)` `y \\ P` `y \\ Q` `x \\ P` S\n\thave \"T = \\\\*(p \\ xvec)\\(\\\\y\\((p \\ P) \\ (p \\ [(x, y)] \\ Q)))\"\n\t apply(erule_tac rev_mp)\n\t apply(subst alpha_res[of y])\n\t apply(clarsimp simp add: eqvts)\n\t apply(subst res_chain_alpha[of p])\n\t by(auto simp add: eqvts)\n\tmoreover from Req `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `y \\ xvec` `y \\ (p \\ xvec)` `x \\ (p \\ xvec)` `y \\ P` `y \\ Q` `x \\ P` S\n\thave \"R = \\\\*(p \\ xvec)\\((p \\ P) \\ \\\\y\\(p \\ [(x, y)] \\ Q))\"\n\t apply(erule_tac rev_mp)\n\t apply(subst alpha_res[of y])\n\t apply(clarsimp simp add: eqvts)\n\t apply(subst res_chain_alpha[of p])\n\t by(auto simp add: eqvts)\n\tultimately show ?case\n\t by blast\n qed\n next\n case(c_sym \\ P Q)\n thus ?case\n\tby(blast dest: bisimE)\n qed\n }\n moreover obtain y::name where \"y \\ \\\" and \"y \\ P\" \"y \\ Q\"\n by(generate_fresh \"name\") auto\n ultimately have \"\\ \\ \\\\y\\(P \\ ([(x, y)] \\ Q)) \\ P \\ \\\\y\\([(x, y)] \\ Q)\" by auto\n thus ?thesis using assms `y \\ P` `y \\ Q`\n apply(subst alpha_res[where x=x and y=y and P=Q], auto)\n by(subst alpha_res[where x=x and y=y and P=\"P \\ Q\"]) auto\nqed\n\nlemma bisim_scope_ext_chain:\n fixes xvec :: \"name list\"\n and \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"xvec \\* \\\"\n and \"xvec \\* P\"\n\n shows \"\\ \\ \\\\*xvec\\(P \\ Q) \\ P \\ (\\\\*xvec\\Q)\"\nusing assms\nby(induct xvec) (auto intro: bisim_scope_ext bisim_reflexive bisim_transitive bisim_res_pres) \n\n(* only used for bisim up-to\nlemma par_assoc_right:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"eqvt Rel\"\n and C1: \"\\\\' S T U. (\\, S \\ (T \\ U),(S \\ T) \\ U) \\ Rel\"\n and C2: \"\\xvec \\' S T U. \\xvec \\* \\'; xvec \\* S\\ \\ (\\', S \\ (\\\\*xvec\\(T \\ U)), \\\\*xvec\\((S \\ T) \\ U)) \\ Rel\"\n and C3: \"\\xvec \\' S T U. \\xvec \\* \\'; xvec \\* U\\ \\ (\\', \\\\*xvec\\(S \\ (T \\ U)), (\\\\*xvec\\(S \\ T)) \\ U) \\ Rel\"\n and C4: \"\\\\' S T xvec. \\(\\', S, T) \\ Rel; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel\"\n\n shows \"\\ \\ P \\ (Q \\ R) \\[Rel] (P \\ Q) \\ R\"\nusing `eqvt Rel`\nproof(induct rule: simI[of _ _ _ _ \"()\"])\n case(c_sim \\ PQR) \n from `bn \\ \\* (P \\ Q \\ R)` have \"bn \\ \\* P\" and \"bn \\ \\* Q\" and \"bn \\ \\* R\" by simp+\n hence \"bn \\ \\* (P \\ Q)\" by simp\n from `\\ \\ (P \\ Q) \\ R \\\\ \\ PQR` `bn \\ \\* \\` `bn \\ \\* (P \\ Q)` `bn \\ \\* R`\n show ?case using `bn \\ \\* subject \\` \n proof(induct rule: par_cases[where C = \"(\\, P, Q, R, \\)\"])\n case(c_par2 R' A\\<^sub>P\\<^sub>Q \\\\<^sub>P\\<^sub>Q)\n from `A\\<^sub>P\\<^sub>Q \\* (\\, P, Q, R, \\)` have \"A\\<^sub>P\\<^sub>Q \\* Q\" and \"A\\<^sub>P\\<^sub>Q \\* R\" \"A\\<^sub>P\\<^sub>Q \\* P\"\n by simp+\n with `extract_frame(P \\ Q) = \\A\\<^sub>P\\<^sub>Q, \\\\<^sub>P\\<^sub>Q\\` `distinct A\\<^sub>P\\<^sub>Q`\n obtain A\\<^sub>Q \\\\<^sub>Q A\\<^sub>P \\\\<^sub>P where \"A\\<^sub>P\\<^sub>Q = A\\<^sub>P@A\\<^sub>Q\" and \"\\\\<^sub>P\\<^sub>Q = \\\\<^sub>P \\ \\\\<^sub>Q\" and FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"A\\<^sub>Q \\* \\\\<^sub>P\" and \"A\\<^sub>P \\* \\\\<^sub>Q\"\n by(rule_tac merge_frameE) (auto dest: extract_frame_fresh_chain)\n from `A\\<^sub>P\\<^sub>Q = A\\<^sub>P@A\\<^sub>Q` `A\\<^sub>P\\<^sub>Q \\* \\` `A\\<^sub>P\\<^sub>Q \\* P` `A\\<^sub>P\\<^sub>Q \\* Q` `A\\<^sub>P\\<^sub>Q \\* R` `A\\<^sub>P\\<^sub>Q \\* \\`\n have \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>Q \\* P\" and \"A\\<^sub>P \\* P\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>P \\* Q\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* R\" and \"A\\<^sub>Q \\* R\"\n by simp+\n from `\\ \\ \\\\<^sub>P\\<^sub>Q \\ R \\\\ \\ R'` `\\\\<^sub>P\\<^sub>Q = \\\\<^sub>P \\ \\\\<^sub>Q` have \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\\\ \\ R'\"\n by(metis stat_eq_transition Associativity Commutativity Composition)\n hence \"\\ \\ \\\\<^sub>P \\ Q \\ R \\\\ \\ (Q \\ R')\" using FrQ `bn \\ \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>P` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* \\`\n by(rule_tac Par2) auto\n hence \"\\ \\ P \\ (Q \\ R) \\\\ \\ P \\ (Q \\ R')\" using FrP `bn \\ \\* P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* R` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* \\`\n by(rule_tac Par2) auto\n moreover have \"(\\, P \\ (Q \\ R'),(P \\ Q) \\ R') \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case(c_par1 PQ A\\<^sub>R \\\\<^sub>R)\n from `A\\<^sub>R \\* (\\, P, Q, R, \\)` have \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* \\\"\n by simp+\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with `bn \\ \\* R` `A\\<^sub>R \\* \\` have \"bn \\ \\* \\\\<^sub>R\" by(auto dest: extract_frame_fresh_chain)\n with `bn \\ \\* \\` have \"bn \\ \\* (\\ \\ \\\\<^sub>R)\" by force\n with `\\ \\ \\\\<^sub>R \\ P \\ Q \\\\ \\ PQ`\n show ?case using `bn \\ \\* P` `bn \\ \\* Q` `bn \\ \\* subject \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q`\n proof(induct rule: par_cases_subject[where C = \"(A\\<^sub>R, \\\\<^sub>R, P, Q, R, \\)\"])\n case(c_par1 P' A\\<^sub>Q \\\\<^sub>Q)\n from `A\\<^sub>Q \\* (A\\<^sub>R, \\\\<^sub>R, P, Q, R, \\)` have \"A\\<^sub>Q \\* A\\<^sub>R\" and \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>Q \\* \\\\<^sub>R\" and \"A\\<^sub>Q \\* \\\"\n\tby simp+\n from `A\\<^sub>R \\* Q` `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>Q \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>Q\"\n by(drule_tac extract_frame_fresh_chain) auto\n from `(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\\\ \\ P'` have \"\\ \\ (\\\\<^sub>Q \\ \\\\<^sub>R) \\ P \\\\ \\ P'\" \n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n hence \"\\ \\ P \\ (Q \\ R) \\\\ \\ P' \\ (Q \\ R)\"\n using `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\` `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>R \\* \\\\<^sub>Q` `bn \\ \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* \\` `bn \\ \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\`\n by(rule_tac Par1[where A\\<^sub>Q=\"A\\<^sub>Q@A\\<^sub>R\"]) auto\n moreover have \"(\\, P' \\ (Q \\ R),(P' \\ Q) \\ R) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case(c_par2 Q' A\\<^sub>P \\\\<^sub>P)\n from `A\\<^sub>P \\* (A\\<^sub>R, \\\\<^sub>R, P, Q, R, \\)` have \"A\\<^sub>P \\* A\\<^sub>R\" and \"A\\<^sub>P \\* R\" and \"A\\<^sub>P \\* P\" and \"A\\<^sub>P \\* Q\" and \"A\\<^sub>P \\* \\\\<^sub>R\" and \"A\\<^sub>P \\* \\\"\n\tby simp+\n have FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" by fact\n from `A\\<^sub>R \\* P` FrP `A\\<^sub>P \\* A\\<^sub>R` have \"A\\<^sub>R \\* \\\\<^sub>P\"\n\tby(drule_tac extract_frame_fresh_chain) auto\n from `(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ Q \\\\ \\ Q'`\n have \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\\\ \\ Q'\"\n by(rule stat_eq_transition) (rule associativity_sym)\n hence \"\\ \\ \\\\<^sub>P \\ Q \\ R \\\\ \\ Q' \\ R\"\n using `extract_frame R = \\A\\<^sub>R,\\\\<^sub>R\\` `bn \\ \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* \\`\n\tby(rule_tac Par1) auto\n hence \"\\ \\ P \\ (Q \\ R) \\\\ \\ P \\ (Q' \\ R)\"\n using `extract_frame P = \\A\\<^sub>P,\\\\<^sub>P\\` `bn \\ \\* P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>P \\* \\`\n by(rule_tac Par2) auto\n moreover have \"(\\, P \\ (Q' \\ R),(P \\ Q') \\ R) \\ Rel\" by(rule C1)\n ultimately show ?case by blast\n next\n case(c_comm1 \\\\<^sub>Q M N Q' A\\<^sub>P \\\\<^sub>P K xvec R' A\\<^sub>Q) \n from `A\\<^sub>Q \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)`\n have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>Q \\* R\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\\<^sub>P\" and \"A\\<^sub>Q \\* \\\" by simp+\n from `A\\<^sub>R \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\" by simp+\n from `xvec \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)` have \"xvec \\* A\\<^sub>P\" and \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* \\\" by simp+\n\n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n with `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>Q\"\n\tby(drule_tac extract_frame_fresh_chain) auto\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with `A\\<^sub>P \\* R` `A\\<^sub>R \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>R\"\n\tby(drule_tac extract_frame_fresh_chain) auto\n from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\K\\\\*xvec\\\\N\\ \\ R'` `A\\<^sub>P \\* R` `xvec \\* A\\<^sub>P` `xvec \\* K` `distinct xvec` have \"A\\<^sub>P \\* N\" \n\tby(rule_tac output_fresh_chain_derivative) auto\n\n from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\M\\N\\ \\ Q'` have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ Q \\M\\N\\ \\ Q'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ Q \\M\\N\\ \\ (P \\ Q')\" using FrP `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* N`\n\tby(rule_tac Par2) auto\n moreover from FrP FrQ `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>Q \\* A\\<^sub>P` `A\\<^sub>Q \\* \\\\<^sub>P` have \"extract_frame(P \\ Q) = \\(A\\<^sub>P@A\\<^sub>Q), \\\\<^sub>P \\ \\\\<^sub>Q\\\"\n\tby simp\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\K\\\\*xvec\\\\N\\ \\ R'` have \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ R \\K\\\\*xvec\\\\N\\ \\ R'\"\n\tby(metis stat_eq_transition Associativity)\n moreover note `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\`\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ \\\\<^sub>R \\ M \\ K` have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ M \\ K\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ \\\\*xvec\\((P \\ Q') \\ R')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>R \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>Q \\* P` `A\\<^sub>R \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* Q` `A\\<^sub>R \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* R`\n `A\\<^sub>P \\* M` `A\\<^sub>Q \\* M` `A\\<^sub>R \\* K` `A\\<^sub>R \\* A\\<^sub>P` `A\\<^sub>Q \\* A\\<^sub>R` `xvec \\* P` `xvec \\* Q`\n\tby(rule_tac Comm1) (assumption | simp)+\n moreover from `xvec \\* \\` `xvec \\* P` have \"(\\, \\\\*xvec\\((P \\ Q') \\ R'), P \\ (\\\\*xvec\\(Q' \\ R'))) \\ Rel\"\n\tby(rule C2)\n ultimately show ?case by blast\n next\n case(c_comm2 \\\\<^sub>R M xvec N Q' A\\<^sub>Q \\\\<^sub>Q K R' A\\<^sub>R) \n from `A\\<^sub>Q \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)`\n have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>Q \\* R\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* \\\\<^sub>P\" by simp+\n from `A\\<^sub>R \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)` have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" and \"A\\<^sub>R \\* A\\<^sub>P\"and \"A\\<^sub>R \\* \\\" by simp+\n from `xvec \\* (A\\<^sub>P, \\\\<^sub>P, P, Q, R, \\)` have \"xvec \\* A\\<^sub>P\" and \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* \\\" by simp+\n\n have FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n with `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>Q\"\n\tby(drule_tac extract_frame_fresh_chain) auto\n have FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with `A\\<^sub>P \\* R` `A\\<^sub>R \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>R\"\n\tby(drule_tac extract_frame_fresh_chain) auto\n\n from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\M\\\\*xvec\\\\N\\ \\ Q'` `A\\<^sub>P \\* Q` `xvec \\* A\\<^sub>P` `xvec \\* M` `distinct xvec` have \"A\\<^sub>P \\* N\" \n\tby(rule_tac output_fresh_chain_derivative) auto\n\n from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\M\\\\*xvec\\\\N\\ \\ Q'` have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ Q \\M\\\\*xvec\\\\N\\ \\ Q'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ Q \\M\\\\*xvec\\\\N\\ \\ (P \\ Q')\" using FrP `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* N` `xvec \\* P` `xvec \\* A\\<^sub>P`\n\tby(rule_tac Par2) auto\n moreover from FrP FrQ `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>Q \\* A\\<^sub>P` `A\\<^sub>Q \\* \\\\<^sub>P` have \"extract_frame(P \\ Q) = \\(A\\<^sub>P@A\\<^sub>Q), \\\\<^sub>P \\ \\\\<^sub>Q\\\"\n\tby simp+\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\K\\N\\ \\ R'` have \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ R \\K\\N\\ \\ R'\"\n\tby(metis stat_eq_transition Associativity)\n moreover note `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\`\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ \\\\<^sub>R \\ K \\ M` have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ K \\ M\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ \\\\*xvec\\((P \\ Q') \\ R')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>R \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>Q \\* P` `A\\<^sub>R \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* Q` `A\\<^sub>R \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* R`\n `A\\<^sub>P \\* M` `A\\<^sub>Q \\* M` `A\\<^sub>R \\* K` `A\\<^sub>R \\* A\\<^sub>P` `A\\<^sub>Q \\* A\\<^sub>R` `xvec \\* R`\n\tby(rule_tac Comm2) (assumption | simp)+\n moreover from `xvec \\* \\` `xvec \\* P` have \"(\\, \\\\*xvec\\((P \\ Q') \\ R'), P \\ (\\\\*xvec\\(Q' \\ R'))) \\ Rel\"\n\tby(rule C2)\n ultimately show ?case by blast\n qed\n next\n case(c_comm1 \\\\<^sub>Q\\<^sub>R M N P' A\\<^sub>P \\\\<^sub>P K xvec QR' A\\<^sub>Q\\<^sub>R)\n from `xvec \\* (\\, P, Q, R, \\)` have \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n from `A\\<^sub>Q\\<^sub>R \\* (\\, P, Q, R, \\)` have \"A\\<^sub>Q\\<^sub>R \\* Q\" and \"A\\<^sub>Q\\<^sub>R \\* R\" and \"A\\<^sub>Q\\<^sub>R \\* \\\" by simp+\n from `A\\<^sub>P \\* (Q \\ R)` have \"A\\<^sub>P \\* Q\" and \"A\\<^sub>P \\* R\" by simp+\n have P_trans: \"\\ \\ \\\\<^sub>Q\\<^sub>R \\ P \\M\\N\\ \\ P'\" and FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and MeqK: \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q\\<^sub>R \\ M \\ K\" by fact+\n note `\\ \\ \\\\<^sub>P \\ Q \\ R \\K\\\\*xvec\\\\N\\ \\ QR'` \n moreover from `xvec \\* \\` `xvec \\* \\\\<^sub>P` have \"xvec \\* (\\ \\ \\\\<^sub>P)\" by force\n moreover note `xvec \\* Q``xvec \\* R` `xvec \\* K`\n `extract_frame(Q \\ R) = \\A\\<^sub>Q\\<^sub>R, \\\\<^sub>Q\\<^sub>R\\` `distinct A\\<^sub>Q\\<^sub>R` \n moreover from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* \\\\<^sub>P` have \"A\\<^sub>Q\\<^sub>R \\* (\\ \\ \\\\<^sub>P)\" by force\n ultimately show ?case using `A\\<^sub>Q\\<^sub>R \\* Q` `A\\<^sub>Q\\<^sub>R \\* R` `A\\<^sub>Q\\<^sub>R \\* K`\n proof(induct rule: par_cases_output_frame)\n case(c_par1 Q' A\\<^sub>Q \\\\<^sub>Q A\\<^sub>R \\\\<^sub>R)\n have Aeq: \"A\\<^sub>Q\\<^sub>R = A\\<^sub>Q@A\\<^sub>R\" and \\eq: \"\\\\<^sub>Q\\<^sub>R = \\\\<^sub>Q \\ \\\\<^sub>R\" by fact+\n from P_trans \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\M\\N\\ \\ P'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover note FrP\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'` have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover note `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\`\n moreover from MeqK \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n moreover from `A\\<^sub>P \\* R` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` Aeq `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\` have \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>R\"\n\tby(auto dest: extract_frame_fresh_chain)\n moreover from `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>Q\\<^sub>R \\* \\` Aeq have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* \\\" by simp+\n ultimately have \"\\ \\ \\\\<^sub>R \\ P \\ Q \\\\ \\ \\\\*xvec\\(P' \\ Q')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* K` `xvec \\* P`\n\tby(rule_tac Comm1) (assumption | force)+\n moreover from `A\\<^sub>Q\\<^sub>R \\* \\` Aeq have \"A\\<^sub>R \\* \\\" by simp\n moreover from `A\\<^sub>Q\\<^sub>R \\* P` Aeq have \"A\\<^sub>R \\* P\" by simp\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ (\\\\*xvec\\(P' \\ Q')) \\ R\" using `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\` `A\\<^sub>R \\* Q`\n\tby(rule_tac Par1) (assumption | simp)+\n moreover from `xvec \\* \\` `xvec \\* R` have \"(\\, (\\\\*xvec\\(P' \\ Q')) \\ R, \\\\*xvec\\(P' \\ (Q' \\ R))) \\ Rel\"\n\tby(rule C3)\n ultimately show ?case by blast\n next\n case(c_par2 R' A\\<^sub>Q \\\\<^sub>Q A\\<^sub>R \\\\<^sub>R)\n have Aeq: \"A\\<^sub>Q\\<^sub>R = A\\<^sub>Q@A\\<^sub>R\" and \\eq: \"\\\\<^sub>Q\\<^sub>R = \\\\<^sub>Q \\ \\\\<^sub>R\" by fact+\n from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>Q\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` Aeq have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>P \\* A\\<^sub>R\" and \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* P\" by simp+\n from `A\\<^sub>Q\\<^sub>R \\* \\` Aeq have \"A\\<^sub>Q \\* \\\" by simp\n from `A\\<^sub>Q\\<^sub>R \\* P` Aeq have \"A\\<^sub>Q \\* P\" by simp\n from `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` Aeq FrP have \"A\\<^sub>Q \\* \\\\<^sub>P\" by(auto dest: extract_frame_fresh_chain)\n from `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\` `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` Aeq `A\\<^sub>P \\* Q` `A\\<^sub>P \\* R` have \"A\\<^sub>P \\* \\\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>R\" by(auto dest: extract_frame_fresh_chain)\n have R_trans: \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\K\\\\*xvec\\\\N\\ \\ R'\" and FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact+\n then obtain K' where Keq_k': \"((\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ K' \\ K\" and \"A\\<^sub>P \\* K'\" and \"A\\<^sub>Q \\* K'\"\n using `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* K` `distinct A\\<^sub>R` `xvec \\* K` `distinct xvec`\n\tby(rule_tac B=\"A\\<^sub>P@A\\<^sub>Q\" in obtain_output_prefix) (assumption | force)+\n from P_trans \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\M\\N\\ \\ P'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover then obtain M' where Meq_m': \"((\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ M \\ M'\" and \"A\\<^sub>Q \\* M'\" and \"A\\<^sub>R \\* M'\"\n using `A\\<^sub>Q \\* P` `A\\<^sub>R \\* P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>P \\* P` `A\\<^sub>P \\* M` `distinct A\\<^sub>P` `extract_frame P = \\A\\<^sub>P,\\\\<^sub>P\\`\n by(rule_tac B=\"A\\<^sub>Q@A\\<^sub>R\" in obtain_input_prefix) (assumption | force)+\n note `((\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ M \\ M'`\n moreover hence \"((\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ M \\ M'\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n moreover with MeqK Keq_k' \\eq have Meq_k': \"((\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ K' \\ M'\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition chan_eq_trans)\n ultimately have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\K'\\N\\ \\ P'\" using FrP `distinct A\\<^sub>P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>P \\* M` `A\\<^sub>P \\* K'` `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>P \\* \\\\<^sub>R` `(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\M\\N\\ \\ P'`\n\tby(rule_tac input_rename_subject) auto\n moreover from `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>Q\\<^sub>R \\* N` Aeq have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* N\" by simp+\n ultimately have \"\\ \\ \\\\<^sub>R \\ P \\ Q \\K'\\N\\ \\ P' \\ Q\" using `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* K'` `A\\<^sub>Q \\* \\`\n\tby(rule_tac Par1) (assumption | force)+\n moreover from FrP `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>P`\n have \"extract_frame(P \\ Q) = \\(A\\<^sub>P@A\\<^sub>Q), \\\\<^sub>P \\ \\\\<^sub>Q\\\" by simp+\n moreover have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ R \\M'\\\\*xvec\\\\N\\ \\ R'\"\n proof -\n from R_trans have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ R \\K\\\\*xvec\\\\N\\ \\ R'\" by(metis Associativity stat_eq_transition)\n moreover from MeqK have \"(\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q)) \\ \\\\<^sub>R \\ M \\ K\" using \\eq\n\t by(metis stat_eq_ent Associativity Commutativity Composition)\n moreover from Meq_m' have \"(\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q)) \\ \\\\<^sub>R \\ M \\ M'\" using \\eq\n\t by(metis stat_eq_ent Associativity Commutativity Composition)\n moreover note `extract_frame R = \\A\\<^sub>R,\\\\<^sub>R\\` `distinct A\\<^sub>R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* K` `A\\<^sub>R \\* M'`\n ultimately show ?thesis\n by(rule_tac output_rename_subject) auto\n qed\n moreover note FrR\n moreover from Meq_k' have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ K' \\ M'\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ \\\\*xvec\\((P' \\ Q) \\ R')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>Q \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>P \\* K'` `A\\<^sub>Q \\* K'` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R`\n `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* M'` `xvec \\* P` `xvec \\* Q`\n\tby(rule_tac Comm1) (assumption | simp)+\n moreover from `xvec \\* \\` have \"(\\, \\\\*xvec\\((P' \\ Q) \\ R'), \\\\*xvec\\(P' \\ (Q \\ R'))) \\ Rel\"\n\tby(metis C1 C4)\n ultimately show ?case by blast\n qed\n next\n case(c_comm2 \\\\<^sub>Q\\<^sub>R M xvec N P' A\\<^sub>P \\\\<^sub>P K QR' A\\<^sub>Q\\<^sub>R)\n from `A\\<^sub>Q\\<^sub>R \\* (\\, P, Q, R, \\)` have \"A\\<^sub>Q\\<^sub>R \\* Q\" and \"A\\<^sub>Q\\<^sub>R \\* R\" and \"A\\<^sub>Q\\<^sub>R \\* \\\" by simp+\n from `A\\<^sub>P \\* (Q \\ R)` `xvec \\* (Q \\ R)` have \"A\\<^sub>P \\* Q\" and \"A\\<^sub>P \\* R\" and \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n have P_trans: \"\\ \\ \\\\<^sub>Q\\<^sub>R \\ P \\M\\\\*xvec\\\\N\\ \\ P'\" and FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and MeqK: \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q\\<^sub>R \\ K \\ M\" by fact+\n note `\\ \\ \\\\<^sub>P \\ Q \\ R \\K\\N\\ \\ QR'` `extract_frame(Q \\ R) = \\A\\<^sub>Q\\<^sub>R, \\\\<^sub>Q\\<^sub>R\\` `distinct A\\<^sub>Q\\<^sub>R` \n moreover from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* \\\\<^sub>P` have \"A\\<^sub>Q\\<^sub>R \\* (\\ \\ \\\\<^sub>P)\" by force\n ultimately show ?case using `A\\<^sub>Q\\<^sub>R \\* Q` `A\\<^sub>Q\\<^sub>R \\* R` `A\\<^sub>Q\\<^sub>R \\* K`\n proof(induct rule: par_cases_input_frame)\n case(c_par1 Q' A\\<^sub>Q \\\\<^sub>Q A\\<^sub>R \\\\<^sub>R)\n have Aeq: \"A\\<^sub>Q\\<^sub>R = A\\<^sub>Q@A\\<^sub>R\" and \\eq: \"\\\\<^sub>Q\\<^sub>R = \\\\<^sub>Q \\ \\\\<^sub>R\" by fact+\n from P_trans \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover note FrP\n moreover from `(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R \\ Q \\K\\N\\ \\ Q'` have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ Q \\K\\N\\ \\ Q'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover note `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\`\n moreover from MeqK \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ K \\ M\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)\n moreover from `A\\<^sub>P \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` Aeq `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\`\n have \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>R\" by(auto dest: extract_frame_fresh_chain)\n moreover from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* P` Aeq have \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* P\" by simp+\n ultimately have \"\\ \\ \\\\<^sub>R \\ P \\ Q \\\\ \\ \\\\*xvec\\(P' \\ Q')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* M` `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* K` `xvec \\* Q`\n\tby(rule_tac Comm2) (assumption | force)+\n moreover from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* P` Aeq have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" by simp+\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ (\\\\*xvec\\(P' \\ Q')) \\ R\" using `extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\` `A\\<^sub>R \\* Q`\n\tby(rule_tac Par1) (assumption | simp)+\n moreover from `xvec \\* \\` `xvec \\* R` have \"(\\, (\\\\*xvec\\(P' \\ Q')) \\ R, \\\\*xvec\\(P' \\ (Q' \\ R))) \\ Rel\"\n\tby(rule C3)\n ultimately show ?case by blast\n next\n case(c_par2 R' A\\<^sub>Q \\\\<^sub>Q A\\<^sub>R \\\\<^sub>R)\n have Aeq: \"A\\<^sub>Q\\<^sub>R = A\\<^sub>Q@A\\<^sub>R\" and \\eq: \"\\\\<^sub>Q\\<^sub>R = \\\\<^sub>Q \\ \\\\<^sub>R\" by fact+\n from `A\\<^sub>Q\\<^sub>R \\* \\` `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>Q\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` Aeq \n have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>P \\* A\\<^sub>R\" and \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* \\\\<^sub>P\" by simp+\n have R_trans: \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ R \\K\\N\\ \\ R'\" and FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact+\n then obtain K' where Keq_k': \"((\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ K \\ K'\" and \"A\\<^sub>P \\* K'\" and \"A\\<^sub>Q \\* K'\"\n using `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* R` `A\\<^sub>R \\* K` `distinct A\\<^sub>R`\n\tby(rule_tac B=\"A\\<^sub>P@A\\<^sub>Q\" in obtain_input_prefix) (assumption | force)+\n from P_trans \\eq have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n\tby(metis stat_eq_transition Associativity Commutativity Composition)\n moreover from MeqK Keq_k' \\eq have Meq_k': \"((\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ K \\ K'\" and Meq_k: \"((\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ K \\ M\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition)+\n moreover from `A\\<^sub>P \\* R` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* A\\<^sub>Q\\<^sub>R` FrR `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` Aeq have \"A\\<^sub>P \\* \\\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>R\"\n\tby(auto dest: extract_frame_fresh_chain)\n ultimately have \"(\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q \\ P \\K'\\\\*xvec\\\\N\\ \\ P'\" using FrP `distinct A\\<^sub>P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>P \\* M` `A\\<^sub>P \\* K'`\n\tby(rule_tac output_rename_subject) auto\n moreover from `A\\<^sub>Q\\<^sub>R \\* P` `A\\<^sub>Q\\<^sub>R \\* N` `A\\<^sub>Q\\<^sub>R \\* xvec` Aeq have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* N\" and \"A\\<^sub>Q \\* xvec\" by simp+\n ultimately have \"\\ \\ \\\\<^sub>R \\ P \\ Q \\K'\\\\*xvec\\\\N\\ \\ (P' \\ Q)\" using `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>Q \\* K'` `xvec \\* Q` `A\\<^sub>Q \\* \\`\n\tby(rule_tac Par1) (assumption | force)+\n moreover from FrP `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>P \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>P`\n have \"extract_frame(P \\ Q) = \\(A\\<^sub>P@A\\<^sub>Q), \\\\<^sub>P \\ \\\\<^sub>Q\\\" by simp+\n moreover from R_trans have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ R \\K\\N\\ \\ R'\" by(metis Associativity stat_eq_transition)\n moreover note FrR\n moreover from Keq_k' have \"\\ \\ (\\\\<^sub>P \\ \\\\<^sub>Q) \\ \\\\<^sub>R \\ K \\ K'\"\n\tby(metis stat_eq_ent Associativity Commutativity Composition chan_eq_trans)\n ultimately have \"\\ \\ (P \\ Q) \\ R \\\\ \\ \\\\*xvec\\((P' \\ Q) \\ R')\"\n\tusing `A\\<^sub>P \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>P \\* P` `A\\<^sub>Q \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* Q` `A\\<^sub>P \\* R` `A\\<^sub>Q \\* R` `A\\<^sub>P \\* K'` `A\\<^sub>Q \\* K'` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R`\n `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* R` `A\\<^sub>R \\* K` `xvec \\* R`\n\tby(rule_tac Comm2) (assumption | simp)+\n moreover from `xvec \\* \\` have \"(\\, \\\\*xvec\\((P' \\ Q) \\ R'), \\\\*xvec\\(P' \\ (Q \\ R'))) \\ Rel\"\n\tby(metis C1 C4)\n ultimately show ?case by blast\n qed\n qed\nqed\n*)\nlemma bisim_par_assoc:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ (P \\ Q) \\ R \\ P \\ (Q \\ R)\"\nproof -\n let ?X = \"{(\\, \\\\*xvec\\((P \\ Q) \\ R), \\\\*xvec\\(P \\ (Q \\ R))) | \\ xvec P Q R. xvec \\* \\}\"\n let ?Y = \"{(\\, P, Q) | \\ P P' Q' Q. \\ \\ P \\ P' \\ (\\, P', Q') \\ ?X \\ \\ \\ Q' \\ Q}\"\n\n have \"(\\, (P \\ Q) \\ R, P \\ (Q \\ R)) \\ ?X\"\n by(auto, rule_tac x=\"[]\" in exI) auto\n moreover have \"eqvt ?X\" by(force simp add: eqvt_def simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n ultimately show ?thesis\n proof(coinduct rule: weak_transitive_coinduct')\n case(c_stat_eq \\ PQR PQR')\n from `(\\, PQR, PQR') \\ ?X` obtain xvec P Q R where \"xvec \\* \\\" and \"PQR = \\\\*xvec\\((P \\ Q) \\ R)\" and \"PQR' = \\\\*xvec\\(P \\ (Q \\ R))\"\n by auto\n moreover obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* Q\" and \"A\\<^sub>P \\* R\"\n by(rule_tac C=\"(\\, Q, R)\" in fresh_frame) auto\n moreover obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* A\\<^sub>P\" and \"A\\<^sub>Q \\* \\\\<^sub>P\" and \"A\\<^sub>Q \\* R\"\n by(rule_tac C=\"(\\, A\\<^sub>P, \\\\<^sub>P, R)\" in fresh_frame) auto\n moreover obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>R \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* \\\\<^sub>Q\"\n by(rule_tac C=\"(\\, A\\<^sub>P, \\\\<^sub>P, A\\<^sub>Q, \\\\<^sub>Q)\" in fresh_frame) auto\n moreover from FrQ `A\\<^sub>P \\* Q` `A\\<^sub>Q \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>Q\"\n by(drule_tac extract_frame_fresh_chain) auto\n moreover from FrR `A\\<^sub>P \\* R` `A\\<^sub>R \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>R\"\n by(drule_tac extract_frame_fresh_chain) auto\n moreover from FrR `A\\<^sub>Q \\* R` `A\\<^sub>R \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>R\"\n by(drule_tac extract_frame_fresh_chain) auto\n ultimately show ?case using fresh_comp_chain\n by auto (metis frame_chain_append composition_sym Associativity frame_nil_stat_eq frame_res_chain_pres)\n next\n case(c_sim \\ T S)\n from `(\\, T, S) \\ ?X` obtain xvec P Q R where \"xvec \\* \\\" and T_eq: \"T = \\\\*xvec\\((P \\ Q) \\ R)\"\n and S_eq: \"S = \\\\*xvec\\(P \\ (Q \\ R))\"\n by auto\n from `eqvt ?X`have \"eqvt ?Y\" by blast\n have C1: \"\\\\ T S yvec. \\(\\, T, S) \\ ?Y; yvec \\* \\\\ \\ (\\, \\\\*yvec\\T, \\\\*yvec\\S) \\ ?Y\"\n proof -\n fix \\ T S yvec\n assume \"(\\, T, S) \\ ?Y\"\n then obtain T' S' where \"\\ \\ T \\ T'\" and \"(\\, T', S') \\ ?X\" and \"\\ \\ S' \\ S\" by force\n assume \"(yvec::name list) \\* \\\" \n from `(\\, T', S') \\ ?X` obtain xvec P Q R where T'eq: \"T' = \\\\*xvec\\((P \\ Q) \\ R)\" and S'eq: \"S' = \\\\*xvec\\(P \\ (Q \\ R))\"\n and \"xvec \\* \\\"\n\tby auto\n from `\\ \\ T \\ T'` `yvec \\* \\` have \"\\ \\ \\\\*yvec\\T \\ \\\\*yvec\\T'\" by(rule bisim_res_chain_pres)\n moreover from `xvec \\* \\` `yvec \\* \\` have \"(\\, \\\\*(yvec@xvec)\\((P \\ Q) \\ R), \\\\*(yvec@xvec)\\(P \\ (Q \\ R))) \\ ?X\"\n\tby force\n with T'eq S'eq have \"(\\, \\\\*yvec\\T', \\\\*yvec\\S') \\ ?X\" by(simp add: res_chain_append)\n moreover from `\\ \\ S' \\ S` `yvec \\* \\` have \"\\ \\ \\\\*yvec\\S' \\ \\\\*yvec\\S\" by(rule bisim_res_chain_pres)\n ultimately show \"(\\, \\\\*yvec\\T, \\\\*yvec\\S) \\ ?Y\" by blast\n qed\n have C2: \"\\\\ T S y. \\(\\, T, S) \\ ?Y; y \\ \\\\ \\ (\\, \\\\y\\T, \\\\y\\S) \\ ?Y\"\n by(drule_tac yvec2=\"[y]\" in C1) auto\n\n have \"\\ \\ \\\\*xvec\\((P \\ Q) \\ R) \\[?Y] \\\\*xvec\\(P \\ (Q \\ R))\"\n proof -\n have \"\\ \\ (P \\ Q) \\ R \\[?Y] P \\ (Q \\ R)\" \n proof -\n\tnote `eqvt ?Y`\n\tmoreover have \"\\\\ P Q R. (\\, (P \\ Q) \\ R, P \\ (Q \\ R)) \\ ?Y\"\n\tproof -\n\t fix \\ P Q R\n\t have \"(\\::'b, ((P::('a, 'b, 'c) psi) \\ Q) \\ R, P \\ (Q \\ R)) \\ ?X\"\n\t by(auto, rule_tac x=\"[]\" in exI) auto\n\t thus \"(\\, (P \\ Q) \\ R, P \\ (Q \\ R)) \\ ?Y\"\n\t by(blast intro: bisim_reflexive)\n\tqed\n\tmoreover have \"\\xvec \\ P Q R. \\xvec \\* \\; xvec \\* P\\ \\ (\\, \\\\*xvec\\((P \\ Q) \\ R), P \\ (\\\\*xvec\\(Q \\ R))) \\ ?Y\"\n\tproof -\n\t fix xvec \\ P Q R\n\t assume \"(xvec::name list) \\* (\\::'b)\" and \"xvec \\* (P::('a, 'b, 'c) psi)\"\n\t from `xvec \\* \\` have \"(\\, \\\\*xvec\\((P \\ Q) \\ R), \\\\*xvec\\(P \\ (Q \\ R))) \\ ?X\" by blast\n\t moreover from `xvec \\* \\` `xvec \\* P` have \"\\ \\ \\\\*xvec\\(P \\ (Q \\ R)) \\ P \\ (\\\\*xvec\\(Q \\ R))\"\n\t by(rule bisim_scope_ext_chain)\n\t ultimately show \"(\\, \\\\*xvec\\((P \\ Q) \\ R), P \\ (\\\\*xvec\\(Q \\ R))) \\ ?Y\"\n\t by(blast intro: bisim_reflexive)\n\tqed\n\tmoreover have \"\\xvec \\ P Q R. \\xvec \\* \\; xvec \\* R\\ \\ (\\, (\\\\*xvec\\(P \\ Q)) \\ R, \\\\*xvec\\(P \\ (Q \\ R))) \\ ?Y\"\n\tproof -\n\t fix xvec \\ P Q R\n\t assume \"(xvec::name list) \\* (\\::'b)\" and \"xvec \\* (R::('a, 'b, 'c) psi)\"\n\t have \"\\ \\ (\\\\*xvec\\(P \\ Q)) \\ R \\ R \\ (\\\\*xvec\\(P \\ Q))\" by(rule bisim_par_comm)\n\t moreover from `xvec \\* \\` `xvec \\* R` have \"\\ \\ \\\\*xvec\\(R \\ (P \\ Q)) \\ R \\ (\\\\*xvec\\(P \\ Q))\" by(rule bisim_scope_ext_chain)\n\t hence \"\\ \\ R \\ (\\\\*xvec\\(P \\ Q)) \\ \\\\*xvec\\(R \\ (P \\ Q))\" by(rule bisimE)\n\t moreover from `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(R \\ (P \\ Q)) \\ \\\\*xvec\\((P \\ Q) \\ R)\"\n\t by(metis bisim_res_chain_pres bisim_par_comm)\n\t moreover from `xvec \\* \\` have \"(\\, \\\\*xvec\\((P \\ Q) \\ R), \\\\*xvec\\(P \\ (Q \\ R))) \\ ?X\" by blast\n\t ultimately show \"(\\, (\\\\*xvec\\(P \\ Q)) \\ R, \\\\*xvec\\(P \\ (Q \\ R))) \\ ?Y\" by(blast dest: bisim_transitive intro: bisim_reflexive)\n\tqed\n\tultimately show ?thesis using C1\n\t by(rule par_assoc_left)\n qed\n thus ?thesis using `eqvt ?Y` `xvec \\* \\` C2\n\tby(rule res_chain_pres)\n qed\n with T_eq S_eq show ?case by simp\n next\n case(c_ext \\ T S \\')\n from `(\\, T, S) \\ ?X` obtain xvec P Q R where \"xvec \\* \\\" and T_eq: \"T = \\\\*xvec\\((P \\ Q) \\ R)\"\n and S_eq: \"S = \\\\*xvec\\(P \\ (Q \\ R))\"\n by auto\n obtain p where \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* R\" and \"(p \\ xvec) \\* \\'\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinct_perm p\"\n by(rule_tac c=\"(\\, P, Q, R, \\')\" in name_list_avoiding) auto\n\n from `(p \\ xvec) \\* \\` `(p \\ xvec) \\* \\'` have \"(\\ \\ \\', \\\\*(p \\ xvec)\\(((p \\ P) \\ (p \\ Q)) \\ (p \\ R)), \\\\*(p \\ xvec)\\((p \\ P) \\ ((p \\ Q) \\ (p \\ R)))) \\ ?X\"\n by auto\n moreover from T_eq `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `(p \\ xvec) \\* R` S have \"T = \\\\*(p \\ xvec)\\(((p \\ P) \\ (p \\ Q)) \\ (p \\ R))\"\n apply auto by(subst res_chain_alpha[of p]) auto\n moreover from S_eq `(p \\ xvec) \\* P` `(p \\ xvec) \\* Q` `(p \\ xvec) \\* R` S have \"S = \\\\*(p \\ xvec)\\((p \\ P) \\ ((p \\ Q) \\ (p \\ R)))\"\n apply auto by(subst res_chain_alpha[of p]) auto\n ultimately show ?case by simp\n next\n case(c_sym \\ T S)\n from `(\\, T, S) \\ ?X` obtain xvec P Q R where \"xvec \\* \\\" and T_eq: \"T = \\\\*xvec\\((P \\ Q) \\ R)\"\n and S_eq: \"\\\\*xvec\\(P \\ (Q \\ R)) = S\"\n by auto\n \n from `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(P \\ (Q \\ R)) \\ \\\\*xvec\\((R \\ Q) \\ P)\"\n by(metis bisim_par_comm bisim_par_pres bisim_transitive bisim_res_chain_pres)\n moreover from `xvec \\* \\` have \"(\\, \\\\*xvec\\((R \\ Q) \\ P), \\\\*xvec\\(R \\ (Q \\ P))) \\ ?X\" by blast\n moreover from `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(R \\ (Q \\ P)) \\ \\\\*xvec\\((P \\ Q) \\ R)\"\n by(metis bisim_par_comm bisim_par_pres bisim_transitive bisim_res_chain_pres)\n ultimately show ?case using T_eq S_eq by(blast dest: bisim_transitive)\n qed\nqed \n\nlemma bisim_par_nil:\n fixes P :: \"('a, 'b, 'c) psi\"\n\n shows \"\\ \\ P \\ \\ \\ P\"\nproof -\n let ?X1 = \"{(\\, P \\ \\, P) | \\ P. True}\"\n let ?X2 = \"{(\\, P, P \\ \\) | \\ P. True}\"\n let ?X = \"?X1 \\ ?X2\"\n have \"eqvt ?X\" by(auto simp add: eqvt_def)\n have \"(\\, P \\ \\, P) \\ ?X\" by simp\n thus ?thesis\n proof(coinduct rule: bisim_weak_coinduct)\n case(c_stat_eq \\ Q R)\n show ?case\n proof(case_tac \"(\\, Q, R) \\ ?X1\")\n assume \"(\\, Q, R) \\ ?X1\"\n then obtain P where \"Q = P \\ \\\" and \"R = P\" by auto\n moreover obtain A\\<^sub>P \\\\<^sub>P where \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\"\n\tby(rule fresh_frame)\n ultimately show ?case\n\tapply auto by(metis frame_res_chain_pres frame_nil_stat_eq Identity Associativity Assertion_stat_eq_trans Commutativity)\n next\n assume \"(\\, Q, R) \\ ?X1\"\n with `(\\, Q, R) \\ ?X` have \"(\\, Q, R) \\ ?X2\" by blast\n then obtain P where \"Q = P\" and \"R = P \\ \\\" by auto\n moreover obtain A\\<^sub>P \\\\<^sub>P where \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\"\n\tby(rule fresh_frame)\n ultimately show ?case\n\tapply auto by(metis frame_res_chain_pres frame_nil_stat_eq Identity Associativity Assertion_stat_eq_trans Assertion_stat_eq_sym Commutativity)\n qed\n next\n case(c_sim \\ Q R)\n thus ?case using `eqvt ?X`\n by(auto intro: par_nil_left par_nil_right)\n next\n case(c_ext \\ Q R \\')\n thus ?case by auto\n next\n case(c_sym \\ Q R)\n thus ?case by auto\n qed\nqed\n\nlemma bisim_res_nil:\n fixes x :: name\n and \\ :: 'b\n \n shows \"\\ \\ \\\\x\\\\ \\ \\\"\nproof -\n {\n fix x::name\n assume \"x \\ \\\"\n have \"\\ \\ \\\\x\\\\ \\ \\\"\n proof -\n let ?X1 = \"{(\\, \\\\x\\\\, \\) | \\ x. x \\ \\}\"\n let ?X2 = \"{(\\, \\, \\\\x\\\\) | \\ x. x \\ \\}\"\n let ?X = \"?X1 \\ ?X2\"\n\n from `x \\ \\` have \"(\\, \\\\x\\\\, \\) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisim_weak_coinduct)\n\tcase(c_stat_eq \\ P Q)\n\tthus ?case using fresh_comp by(force intro: frame_res_fresh Frame_stat_eq_sym)\n next\n\tcase(c_sim \\ P Q)\n\tthus ?case\n\t by(force intro: res_nil_left res_nil_right)\n next\n\tcase(c_ext \\ P Q \\')\n\tobtain y where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ x\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\tshow ?case\n\tproof(case_tac \"(\\, P, Q) \\ ?X1\")\n\t assume \"(\\, P, Q) \\ ?X1\"\n\t then obtain x where \"P = \\\\x\\\\\" and \"Q = \\\" by auto\n\t moreover have \"\\\\x\\\\ = \\\\y\\ \\\" by(subst alpha_res) auto\n\t ultimately show ?case using `y \\ \\` `y \\ \\'` by auto\n\tnext\n\t assume \"(\\, P, Q) \\ ?X1\"\n\t with `(\\, P, Q) \\ ?X` have \"(\\, P, Q) \\ ?X2\" by auto\n\t then obtain x where \"Q = \\\\x\\\\\" and \"P = \\\" by auto\n\t moreover have \"\\\\x\\\\ = \\\\y\\ \\\" by(subst alpha_res) auto\n\t ultimately show ?case using `y \\ \\` `y \\ \\'` by auto\n\tqed\n next\n\tcase(c_sym \\ P Q)\n\tthus ?case by auto\n qed\n qed\n }\n moreover obtain y::name where \"y \\ \\\" by(generate_fresh \"name\") auto\n ultimately have \"\\ \\ \\\\y\\\\ \\ \\\" by auto\n thus ?thesis by(subst alpha_res[where x=x and y=y]) auto\nqed\n\nlemma bisim_output_push_res:\n fixes x :: name\n and \\ :: 'b\n and M :: 'a\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ M\"\n and \"x \\ N\"\n\n shows \"\\ \\ \\\\x\\(M\\N\\.P) \\ M\\N\\.\\\\x\\P\"\nproof -\n {\n fix x::name and P::\"('a, 'b, 'c) psi\"\n assume \"x \\ \\\" and \"x \\ M\" and \"x \\ N\"\n let ?X1 = \"{(\\, \\\\x\\(M\\N\\.P), M\\N\\.\\\\x\\P) | \\ x M N P. x \\ \\ \\ x \\ M \\ x \\ N}\"\n let ?X2 = \"{(\\, M\\N\\.\\\\x\\P, \\\\x\\(M\\N\\.P)) | \\ x M N P. x \\ \\ \\ x \\ M \\ x \\ N}\"\n let ?X = \"?X1 \\ ?X2\"\n \n have \"eqvt ?X\" by(rule_tac eqvt_union) (force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst] eqvts)+\n from `x \\ \\` `x \\ M` `x \\ N` have \"(\\, \\\\x\\(M\\N\\.P), M\\N\\.\\\\x\\P) \\ ?X\" by auto\n hence \"\\ \\ \\\\x\\(M\\N\\.P) \\ M\\N\\.\\\\x\\P\"\n proof(coinduct rule: bisim_coinduct)\n case(c_stat_eq \\ Q R)\n thus ?case using fresh_comp by(force intro: frame_res_fresh Frame_stat_eq_sym)\n next\n case(c_sim \\ Q R)\n thus ?case using `eqvt ?X`\n\tby(force intro: output_push_res_left output_push_res_right bisim_reflexive)\n next\n case(c_ext \\ Q R \\')\n show ?case\n proof(case_tac \"(\\, Q, R) \\ ?X1\")\n\tassume \"(\\, Q, R) \\ ?X1\"\n\tthen obtain x M N P where Qeq: \"Q = \\\\x\\(M\\N\\.P)\" and Req: \"R = M\\N\\.\\\\x\\P\" and \"x \\ \\\" and \"x \\ M\" and \"x \\ N\" by auto\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ M\" and \"y \\ N\" and \"y \\ P\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\t\n\tmoreover hence \"(\\ \\ \\', \\\\y\\(M\\N\\.([(x, y)] \\ P)), M\\N\\.\\\\y\\([(x, y)] \\ P)) \\ ?X\" by auto\n\tmoreover from Qeq `x \\ M` `y \\ M` `x \\ N` `y \\ N` `y \\ P` have \"Q = \\\\y\\(M\\N\\.([(x, y)] \\ P))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tmoreover from Req `y \\ P` have \"R = M\\N\\.\\\\y\\([(x, y)] \\ P)\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tultimately show ?case by blast\n next\n\tassume \"(\\, Q, R) \\ ?X1\"\n\twith `(\\, Q, R) \\ ?X` have \"(\\, Q, R) \\ ?X2\" by blast\n\tthen obtain x M N P where Req: \"R = \\\\x\\(M\\N\\.P)\" and Qeq: \"Q = M\\N\\.\\\\x\\P\" and \"x \\ \\\" and \"x \\ M\" and \"x \\ N\" by auto\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ M\" and \"y \\ N\" and \"y \\ P\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\t\n\tmoreover hence \"(\\ \\ \\', \\\\y\\(M\\N\\.([(x, y)] \\ P)), M\\N\\.\\\\y\\([(x, y)] \\ P)) \\ ?X\" by auto\n\tmoreover from Req `x \\ M` `y \\ M` `x \\ N` `y \\ N` `y \\ P` have \"R = \\\\y\\(M\\N\\.([(x, y)] \\ P))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tmoreover from Qeq `y \\ P` have \"Q = M\\N\\.\\\\y\\([(x, y)] \\ P)\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tultimately show ?case by blast\n qed\n next\n case(c_sym \\ R Q)\n thus ?case by blast\n qed\n }\n moreover obtain y::name where \"y \\ \\\" and \"y \\ M\" and \"y \\ N\" \"y \\ P\"\n by(generate_fresh \"name\") auto\n ultimately have \"\\ \\ \\\\y\\(M\\N\\.([(x, y)] \\ P)) \\ M\\N\\.\\\\y\\([(x, y)] \\ P)\" by auto\n thus ?thesis using assms `y \\ P` `y \\ M` `y \\ N`\n apply(subst alpha_res[where x=x and y=y and P=P], auto)\n by(subst alpha_res[where x=x and y=y and P=\"M\\N\\.P\"]) auto\nqed\n\nlemma bisim_input_push_res:\n fixes x :: name\n and \\ :: 'b\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ M\"\n and \"x \\ xvec\"\n and \"x \\ N\"\n\n shows \"\\ \\ \\\\x\\(M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.\\\\x\\P\"\nproof -\n {\n fix x::name and P::\"('a, 'b, 'c) psi\"\n assume \"x \\ \\\" and \"x \\ M\" and \"x \\ N\" and \"x \\ xvec\"\n let ?X1 = \"{(\\, \\\\x\\(M\\\\*xvec N\\.P), M\\\\*xvec N\\.\\\\x\\P) | \\ x M xvec N P. x \\ \\ \\ x \\ M \\ x \\ xvec \\ x \\ N}\"\n let ?X2 = \"{(\\, M\\\\*xvec N\\.\\\\x\\P, \\\\x\\(M\\\\*xvec N\\.P)) | \\ x M xvec N P. x \\ \\ \\ x \\ M \\ x \\ xvec \\ x \\ N}\"\n let ?X = \"?X1 \\ ?X2\"\n \n have \"eqvt ?X\" by(rule_tac eqvt_union) (force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst] eqvts)+\n\n from `x \\ \\` `x \\ M` `x \\ xvec` `x \\ N` have \"(\\, \\\\x\\(M\\\\*xvec N\\.P), M\\\\*xvec N\\.\\\\x\\P) \\ ?X\" by blast\n hence \"\\ \\ \\\\x\\(M\\\\*xvec N\\.P) \\ M\\\\*xvec N\\.\\\\x\\P\"\n proof(coinduct rule: bisim_coinduct)\n case(c_stat_eq \\ Q R)\n thus ?case using fresh_comp by(force intro: frame_res_fresh Frame_stat_eq_sym)\n next\n case(c_sim \\ Q R)\n thus ?case using `eqvt ?X`\n by(auto intro!: input_push_res_left input_push_res_right intro: bisim_reflexive)\n next\n case(c_ext \\ Q R \\')\n show ?case\n proof(case_tac \"(\\, Q, R) \\ ?X1\")\n\tassume \"(\\, Q, R) \\ ?X1\"\n\tthen obtain x M xvec N P where Qeq: \"Q = \\\\x\\(M\\\\*xvec N\\.P)\" and Req: \"R = M\\\\*xvec N\\.\\\\x\\P\" and \"x \\ \\\"\n and \"x \\ M\" and \"x \\ xvec\" and \"x \\ N\" by auto\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ M\" and \"y \\ N\" and \"y \\ P\" and \"y \\ xvec\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\t\n\tmoreover hence \"(\\ \\ \\', \\\\y\\(M\\\\*xvec N\\.([(x, y)] \\ P)), M\\\\*xvec N\\.\\\\y\\([(x, y)] \\ P)) \\ ?X\" by force\n\tmoreover from Qeq `x \\ M` `y \\ M` `x \\ xvec` `y \\ xvec` `x \\ N` `y \\ N` `y \\ P` have \"Q = \\\\y\\(M\\\\*xvec N\\.([(x, y)] \\ P))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts input_chain_fresh)\n\tmoreover from Req `y \\ P` have \"R = M\\\\*xvec N \\.\\\\y\\([(x, y)] \\ P)\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tultimately show ?case by blast\n next\n\tassume \"(\\, Q, R) \\ ?X1\"\n\twith `(\\, Q, R) \\ ?X` have \"(\\, Q, R) \\ ?X2\" by blast\n\tthen obtain x M xvec N P where Req: \"R = \\\\x\\(M\\\\*xvec N\\.P)\" and Qeq: \"Q = M\\\\*xvec N\\.\\\\x\\P\" and \"x \\ \\\"\n and \"x \\ M\" and \"x \\ xvec\" and \"x \\ N\" by auto\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ M\" and \"y \\ N\" and \"y \\ P\" and \"y \\ xvec\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\n\tmoreover hence \"(\\ \\ \\', \\\\y\\(M\\\\*xvec N\\.([(x, y)] \\ P)), M\\\\*xvec N\\.\\\\y\\([(x, y)] \\ P)) \\ ?X\" by force\n\tmoreover from Req `x \\ M` `y \\ M` `x \\ xvec` `y \\ xvec` `x \\ N` `y \\ N` `y \\ P` have \"R = \\\\y\\(M\\\\*xvec N\\.([(x, y)] \\ P))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts input_chain_fresh)\n\tmoreover from Qeq `y \\ P` have \"Q = M\\\\*xvec N \\.\\\\y\\([(x, y)] \\ P)\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tultimately show ?case by blast\n qed\n next\n case(c_sym \\ R Q)\n thus ?case by blast\n qed\n }\n moreover obtain y::name where \"y \\ \\\" and \"y \\ M\" and \"y \\ N\" and \"y \\ P\" and \"y \\ xvec\"\n by(generate_fresh \"name\") auto\n ultimately have \"\\ \\ \\\\y\\(M\\\\*xvec N\\.([(x, y)] \\ P)) \\ M\\\\*xvec N\\.\\\\y\\([(x, y)] \\ P)\" by auto\n thus ?thesis using assms `y \\ P` `y \\ M` `y \\ N` `y \\ xvec`\n apply(subst alpha_res[where x=x and y=y and P=P], auto)\n by(subst alpha_res[where x=x and y=y and P=\"M\\\\*xvec N\\.P\"]) (auto simp add: input_chain_fresh eqvts)\nqed\n\nlemma bisim_case_push_res:\n fixes x :: name\n and \\ :: 'b\n and Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes \"x \\ (map fst Cs)\"\n\n shows \"\\ \\ \\\\x\\(Cases Cs) \\ Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)\"\nproof -\n {\n fix x::name and Cs::\"('c \\ ('a, 'b, 'c) psi) list\"\n assume \"x \\ \\\" and \"x \\ (map fst Cs)\"\n let ?X1 = \"{(\\, \\\\x\\(Cases Cs), Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)) | \\ x Cs. x \\ \\ \\ x \\ (map fst Cs)}\"\n let ?X2 = \"{(\\, Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs), \\\\x\\(Cases Cs)) | \\ x Cs. x \\ \\ \\ x \\ (map fst Cs)}\"\n let ?X = \"?X1 \\ ?X2\"\n \n have \"eqvt ?X\" apply(rule_tac eqvt_union) \n apply(auto simp add: eqvt_def eqvts)\n apply(rule_tac x=\"p \\ x\" in exI)\n apply(rule_tac x=\"p \\ Cs\" in exI)\n apply(perm_extend_simp)\n apply(auto simp add: eqvts)\n apply(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n apply(simp add: eqvts)\n apply(perm_extend_simp)\n apply(simp add: eqvts)\n apply(rule_tac x=\"p \\ x\" in exI)\n apply(rule_tac x=\"p \\ Cs\" in exI)\n apply auto\n apply(perm_extend_simp)\n apply(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n apply(simp add: eqvts)\n apply(perm_extend_simp)\n by(simp add: eqvts) \n \n from `x \\ \\` `x \\ map fst Cs` have \"(\\, \\\\x\\(Cases Cs), Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)) \\ ?X\" by auto\n hence \"\\ \\ \\\\x\\(Cases Cs) \\ Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)\"\n proof(coinduct rule: bisim_coinduct)\n case(c_stat_eq \\ Q R)\n thus ?case using fresh_comp by(force intro: frame_res_fresh Frame_stat_eq_sym)\n next\n case(c_sim \\ Q R)\n thus ?case using `eqvt ?X`\n\tby(force intro: case_push_res_left case_push_res_right bisim_reflexive)\n next\n case(c_ext \\ Q R \\')\n show ?case\n proof(case_tac \"(\\, Q, R) \\ ?X1\")\n\tassume \"(\\, Q, R) \\ ?X1\"\n\tthen obtain x Cs where Qeq: \"Q = \\\\x\\(Cases Cs)\" and Req: \"R = Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)\"\n and \"x \\ \\\" and \"x \\ (map fst Cs)\" by blast\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ Cs\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\tfrom `y \\ Cs` `x \\ (map fst Cs)` have \"y \\ map fst ([(x, y)] \\ Cs)\" by(induct Cs) (auto simp add: fresh_list_cons fresh_list_nil)\n\n\tmoreover with `y \\ \\` `y \\ \\'` have \"(\\ \\ \\', \\\\y\\(Cases ([(x, y)] \\ Cs)), Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs))) \\ ?X\"\n\t by auto\n\tmoreover from Qeq `y \\ Cs` have \"Q = \\\\y\\(Cases([(x, y)] \\ Cs))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tmoreover from Req `y \\ Cs` `x \\ (map fst Cs)` have \"R = Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs))\" \n\t by(induct Cs arbitrary: R) (auto simp add: fresh_list_cons fresh_prod alpha_res)\n\tultimately show ?case by blast\n next\n\tassume \"(\\, Q, R) \\ ?X1\"\n\twith `(\\, Q, R) \\ ?X` have \"(\\, Q, R) \\ ?X2\" by blast\n\tthen obtain x Cs where Req: \"R = \\\\x\\(Cases Cs)\" and Qeq: \"Q = Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)\"\n and \"x \\ \\\" and \"x \\ (map fst Cs)\" by blast\n\tobtain y::name where \"y \\ \\\" and \"y \\ \\'\" and \"y \\ Cs\"\n\t by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\tfrom `y \\ Cs` `x \\ (map fst Cs)` have \"y \\ map fst ([(x, y)] \\ Cs)\" by(induct Cs) (auto simp add: fresh_list_cons fresh_list_nil)\n\t\n\tmoreover with `y \\ \\` `y \\ \\'` have \"(\\ \\ \\', \\\\y\\(Cases ([(x, y)] \\ Cs)), Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs))) \\ ?X\"\n\t by auto\n\tmoreover from Req `y \\ Cs` have \"R = \\\\y\\(Cases([(x, y)] \\ Cs))\"\n\t apply auto by(subst alpha_res[of y]) (auto simp add: eqvts)\n\tmoreover from Qeq `y \\ Cs` `x \\ (map fst Cs)` have \"Q = Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs))\" \n\t by(induct Cs arbitrary: Q) (auto simp add: fresh_list_cons fresh_prod alpha_res)\n\tultimately show ?case by blast\n qed\n next\n case(c_sym \\ R Q)\n thus ?case by blast\n qed\n }\n moreover obtain y::name where \"y \\ \\\" and \"y \\ Cs\" by(generate_fresh \"name\") auto\n moreover from `x \\ map fst Cs` have \"y \\ map fst([(x, y)] \\ Cs)\" \n by(induct Cs) (auto simp add: fresh_left calc_atm)\n ultimately have \"\\ \\ \\\\y\\(Cases ([(x, y)] \\ Cs)) \\ Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs))\"\n by auto\n moreover from `y \\ Cs` have \"\\\\y\\(Cases ([(x, y)] \\ Cs)) = \\\\x\\(Cases Cs)\"\n by(simp add: alpha_res eqvts)\n moreover from `x \\ map fst Cs` `y \\ Cs` have \"Cases(map (\\(\\, P). (\\, \\\\y\\P)) ([(x, y)] \\ Cs)) = Cases(map (\\(\\, P). (\\, \\\\x\\P)) Cs)\"\n by(induct Cs) (auto simp add: alpha_res)\n ultimately show ?thesis by auto\nqed\n\nlemma bang_ext:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n \n assumes \"guarded P\"\n\n shows \"\\ \\ !P \\ P \\ !P\"\nproof -\n let ?X = \"{(\\, !P, P \\ !P) | \\ P. guarded P} \\ {(\\, P \\ !P, !P) | \\ P. guarded P}\"\n from `guarded P` have \"(\\, !P, P \\ !P) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisim_coinduct)\n case(c_stat_eq \\ Q R)\n from `(\\, Q, R) \\ ?X` obtain P where Eq: \"(Q = !P \\ R = P \\ !P) \\ (Q = P \\ !P \\ R = !P)\" and \"guarded P\"\n by auto\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" by(rule fresh_frame)\n from FrP `guarded P` have \"\\\\<^sub>P \\ S_bottom'\" by(blast dest: guarded_stat_eq)\n from `\\\\<^sub>P \\ S_bottom'` have \"\\ \\ S_bottom' \\ \\ \\ \\\\<^sub>P \\ S_bottom'\" by(metis Identity Composition Assertion_stat_eq_trans Commutativity Assertion_stat_eq_sym)\n hence \"\\A\\<^sub>P, \\ \\ S_bottom'\\ \\\\<^sub>F \\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ S_bottom'\\\"\n by(force intro: frame_res_chain_pres)\n moreover from `A\\<^sub>P \\* \\` have \"\\\\, \\ \\ S_bottom'\\ \\\\<^sub>F \\A\\<^sub>P, \\ \\ S_bottom'\\\"\n by(rule_tac Frame_stat_eq_sym) (force intro: frame_res_fresh_chain)\n ultimately show ?case using Eq `A\\<^sub>P \\* \\` FrP\n by auto (blast dest: Frame_stat_eq_trans Frame_stat_eq_sym)+\n next\n case(c_sim \\ Q R)\n thus ?case by(auto intro: bang_ext_left bang_ext_right bisim_reflexive)\n next\n case(c_ext \\ Q R)\n thus ?case by auto\n next\n case(c_sym \\ Q R)\n thus ?case by auto\n qed\nqed\n \nlemma bisim_par_pres_sym:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ R \\ P \\ R \\ Q\"\nusing assms\nby(metis bisim_par_comm bisim_par_pres bisim_transitive)\n\nlemma bisim_scope_ext_sym:\n fixes x :: name\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"x \\ \\\"\n and \"x \\ Q\"\n\n shows \"\\ \\ \\\\x\\(P \\ Q) \\ (\\\\x\\P) \\ Q\"\nusing assms\nby(metis bisim_scope_ext bisim_transitive bisim_par_comm bisim_symmetric bisim_res_pres)\n\nlemma bisim_scope_ext_chain_sym:\n fixes xvec :: \"name list\"\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"xvec \\* \\\"\n and \"xvec \\* Q\"\n\n shows \"\\ \\ \\\\*xvec\\(P \\ Q) \\ (\\\\*xvec\\P) \\ Q\"\nusing assms\nby(induct xvec) (auto intro: bisim_scope_ext_sym bisim_reflexive bisim_transitive bisim_res_pres)\n\nlemma bisim_par_pres_aux_sym:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and \"extract_frame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n\n shows \"\\ \\ R \\ P \\ R \\ Q\"\nusing assms\nby(metis bisim_par_comm bisim_par_pres_aux bisim_transitive)\n\nlemma bang_nontau_derivative:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ !P \\\\ @ \\ \\ P'\"\n and \"\\ \\ P \\ Q\"\n and \"bn \\ \\* \\\"\n and \"bn \\ \\* P\"\n and \"bn \\ \\* Q\"\n and \"bn \\ \\* subject \\\"\n and \"guarded Q\"\n and \"\\ \\ \\\"\n\n obtains \\' Q' R T where \"\\ \\ !Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ !P\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and \"((supp R)::name set) \\ supp P'\" and \"((supp T)::name set) \\ supp Q'\"\nproof -\n from `\\ \\ !P \\\\ @ \\ \\ P'` have \"guarded P\" apply - by(ind_cases \"\\ \\ !P \\\\ @ \\ \\ P'\") (auto simp add: psi.inject)\n assume \"\\\\' Q' R T. \\\\ \\ !Q \\\\' @ \\ \\ Q'; \\ \\ P' \\ R \\ !P; \\ \\ Q' \\ T \\ !Q; \\ \\ R \\ T; ((supp R)::name set) \\ supp P';\n ((supp T)::name set) \\ supp Q'\\ \\ thesis\"\n moreover from `\\ \\ !P \\\\ @ \\ \\ P'` `bn \\ \\* subject \\` `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* Q` `\\ \\ P \\ Q` `guarded Q` `\\ \\ \\`\n have \"\\Q' \\' T R . \\ \\ !Q \\\\' @ \\ \\ Q' \\ \\ \\ P' \\ R \\ !P \\ \\ \\ Q' \\ T \\ !Q \\ \\ \\ R \\ T \\\n ((supp R)::name set) \\ supp P' \\ ((supp T)::name set) \\ supp Q'\"\n proof(nominal_induct avoiding: Q rule: bang_induct')\n case(c_alpha \\ \\ P' p Q)\n moreover have \"\\ \\ \\\" using `(p\\\\) \\ \\`\n by(subst perm_bool[where pi=p,symmetric]) (simp add: eqvts)\n ultimately obtain Q' \\' T R where Q_trans: \"\\ \\ !Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ (P \\ !P)\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P'\" and suppT: \"((supp T)::name set) \\ supp Q'\"\n by blast\n from Q_trans have \"distinct(bn \\)\" by(rule bound_output_distinct)\n have S: \"set p \\ set(bn \\) \\ set(bn(p \\ \\))\" by fact\n from Q_trans `bn(p \\ \\) \\* Q` `bn(p \\ \\) \\* \\` `bn \\ \\* subject \\` `distinct(bn \\)` have \"bn(p \\ \\) \\* Q'\"\n by(drule_tac free_fresh_chain_derivative) simp+\n with Q_trans `bn(p \\ \\) \\* \\` S `bn \\ \\* subject \\` have \"\\ \\ !Q \\\\' @ (p \\ \\) \\ (p \\ Q')\"\n by(force simp add: residual_alpha)\n moreover from `\\ \\ P' \\ R \\ (P \\ !P)` have \"(p \\ \\) \\ (p \\ P') \\ (p \\ (R \\ (P \\ !P)))\"\n by(rule bisim_closed)\n with `bn \\ \\* \\` `bn \\ \\* P` `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* P` S have \"\\ \\ (p \\ P') \\ (p \\ R) \\ (P \\ !P)\"\n by(simp add: eqvts)\n moreover from `\\ \\ Q' \\ T \\ !Q` have \"(p \\ \\) \\ (p \\ Q') \\ (p \\ (T \\ !Q))\"\n by(rule bisim_closed)\n with `bn \\ \\* \\` `bn \\ \\* Q` `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* Q` S have \"\\ \\ (p \\ Q') \\ (p \\ T) \\ !Q\"\n by(simp add: eqvts)\n moreover from `\\ \\ R \\ T` have \"(p \\ \\) \\ (p \\ R) \\ (p \\ T)\"\n by(rule bisim_closed)\n with `bn \\ \\* \\` `bn(p \\ \\) \\* \\` S have \"\\ \\ (p \\ R) \\ (p \\ T)\"\n by(simp add: eqvts)\n moreover from suppR have \"((supp(p \\ R))::name set) \\ supp(p \\ P')\"\n apply(erule_tac rev_mp)\n by(subst subset_closed[of p, symmetric]) (simp add: eqvts)\n moreover from suppT have \"((supp(p \\ T))::name set) \\ supp(p \\ Q')\"\n apply(erule_tac rev_mp)\n by(subst subset_closed[of p, symmetric]) (simp add: eqvts)\n ultimately show ?case by blast\n next\n case(c_par1 \\ \\ P' Q)\n from `\\ \\ P \\ Q` `\\ \\ P \\\\ @ \\ \\ P'` `bn \\ \\* \\` `bn \\ \\* Q` \n obtain \\' Q' where Q_trans: \"\\ \\ Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ Q'\"\n by(blast dest: bisimE simE)\n from Q_trans have \"\\ \\ S_bottom' \\ Q \\\\' @ \\ \\ Q'\" by(metis stat_eq_transition Identity Assertion_stat_eq_sym)\n hence \"\\ \\ Q \\ !Q \\\\' @ \\ \\ (Q' \\ !Q)\" using `bn \\ \\* Q`\n by(drule_tac Par1[where Q=\"!Q\"]) (assumption|simp add: option.map_ident)+\n hence \"\\ \\ !Q \\map_option (F_assert o push_prov) \\' @ \\ \\ (Q' \\ !Q)\" using `guarded Q` by(rule Bang)\n moreover from `guarded P` have \"\\ \\ P' \\ !P \\ P' \\ (P \\ !P)\" by(metis bang_ext bisim_par_pres_sym)\n moreover have \"\\ \\ Q' \\ !Q \\ Q' \\ !Q\" by(rule bisim_reflexive)\n ultimately show ?case using `\\ \\ P' \\ Q'` by(force simp add: psi.supp)\n next\n case(c_par2 \\ \\ P' A\\<^sub>P \\\\<^sub>P Q)\n then obtain Q' \\' T R where Q_trans: \"\\ \\ !Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ !P\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P'\" and suppT: \"((supp T)::name set) \\ supp Q'\"\n by blast\n note Q_trans\n from `\\ \\ P' \\ R \\ !P` have \"\\ \\ P \\ P' \\ R \\ (P \\ !P)\"\n by(metis bisim_par_pres_sym bisim_par_comm bisim_transitive bisim_par_assoc)\n with Q_trans show ?case using `\\ \\ Q' \\ T \\ !Q` `\\ \\ R \\ T` suppR suppT\n by(force simp add: psi.supp)\n next\n case(c_comm1 M N P' K xvec A\\<^sub>P \\\\<^sub>P yvec zvec P'' Q)\n thus ?case by blast\n next\n case(c_comm2 M xvec N P' K P'' Q)\n thus ?case by blast\n next\n case(c_bang \\ \\ P' Q)\n then obtain Q' \\' T R where Q_trans: \"\\ \\ !Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ (P \\ !P)\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P'\" and suppT: \"((supp T)::name set) \\ supp Q'\"\n by blast\n from `\\ \\ P' \\ R \\ (P \\ !P)` `guarded P` have \"\\ \\ P' \\ R \\ !P\" by(metis bang_ext bisim_par_pres_sym bisim_transitive bisim_symmetric)\n with Q_trans show ?case using `\\ \\ Q' \\ T \\ !Q` `\\ \\ R \\ T` suppR suppT\n by blast\n qed\n ultimately show ?thesis by blast\nqed\n\nlemma bang_tau_derivative:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ !P \\\\ @ \\ \\ P'\"\n and \"\\ \\ P \\ Q\"\n and \"guarded Q\"\n\n obtains Q' R T where \"\\ \\ !Q \\None @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ !P\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and \"((supp R)::name set) \\ supp P'\" and \"((supp T)::name set) \\ supp Q'\"\nproof -\n from `\\ \\ !P \\\\ @ \\ \\ P'` have \"guarded P\" apply - by(ind_cases \"\\ \\ !P \\\\ @ \\ \\ P'\") (auto simp add: psi.inject)\n assume \"\\Q' R T. \\\\ \\ !Q \\None @ \\ \\ Q'; \\ \\ P' \\ R \\ !P; \\ \\ Q' \\ T \\ !Q; \\ \\ R \\ T; ((supp R)::name set) \\ supp P';\n ((supp T)::name set) \\ supp Q'\\ \\ thesis\"\n moreover from tau_no_provenance'[OF `\\ \\ !P \\\\ @ \\ \\ P'`] `\\ \\ P \\ Q` `guarded Q` \n have \"\\Q' T R . \\ \\ !Q \\None @ \\ \\ Q' \\ \\ \\ P' \\ R \\ !P \\ \\ \\ Q' \\ T \\ !Q \\ \\ \\ R \\ T \\\n ((supp R)::name set) \\ supp P' \\ ((supp T)::name set) \\ supp Q'\"\n proof(nominal_induct avoiding: Q rule: bang_tau_induct)\n case(c_par1 P' Q)\n have \"bn(\\) \\* \\\" and \"bn(\\) \\* Q\" by simp_all\n with `\\ \\ P \\ Q` `\\ \\ P \\None @ \\ \\ P'`\n obtain \\' Q' where Q_trans: \"\\ \\ Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ Q'\"\n by(blast dest: bisimE simE)\n from Q_trans have \"\\ \\ S_bottom' \\ Q \\\\' @ \\ \\ Q'\" by(metis stat_eq_transition Identity Assertion_stat_eq_sym)\n hence \"\\ \\ Q \\ !Q \\\\' @ \\ \\ (Q' \\ !Q)\"\n by(drule_tac Par1[where Q=\"!Q\"]) (assumption|simp add: option.map_ident)+\n hence \"\\ \\ !Q \\map_option (F_assert o push_prov) \\' @ \\ \\ (Q' \\ !Q)\" using `guarded Q` by(rule Bang)\n hence \"\\ \\ !Q \\None @ \\ \\ (Q' \\ !Q)\"\n by(metis tau_no_provenance')\n moreover from `guarded P` have \"\\ \\ P' \\ !P \\ P' \\ (P \\ !P)\" by(metis bang_ext bisim_par_pres_sym)\n moreover have \"\\ \\ Q' \\ !Q \\ Q' \\ !Q\" by(rule bisim_reflexive)\n ultimately show ?case using `\\ \\ P' \\ Q'` by(force simp add: psi.supp)\n next\n case(c_par2 P')\n then obtain Q' T R where Q_trans: \"\\ \\ !Q \\None @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ !P\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P'\" and suppT: \"((supp T)::name set) \\ supp Q'\"\n by blast\n note Q_trans\n from `\\ \\ P' \\ R \\ !P` have \"\\ \\ P \\ P' \\ R \\ (P \\ !P)\"\n by(metis bisim_par_pres_sym bisim_par_comm bisim_transitive bisim_par_assoc)\n with tau_no_provenance'[OF Q_trans] show ?case using `\\ \\ Q' \\ T \\ !Q` `\\ \\ R \\ T` suppR suppT\n by(force simp add: psi.supp)\n next\n case(c_comm1 M N P' K xvec A\\<^sub>P \\\\<^sub>P yvec zvec P'' Q)\n from `\\ \\ P \\ Q` have \"\\ \\ Q \\[bisim] P\" by(metis bisimE)\n with `\\ \\ P \\Some (\\A\\<^sub>P; yvec, K\\) @ M\\N\\ \\ P'` obtain \\ Q' where Q_trans: \"\\ \\ Q \\\\ @ M\\N\\ \\ Q'\" and \"\\ \\ Q' \\ P'\"\n by(force dest: simE)\n from Q_trans have \"\\ \\ S_bottom' \\ Q \\\\ @ M\\N\\ \\ Q'\" by(metis stat_eq_transition Identity Assertion_stat_eq_sym)\n from Q_trans obtain A\\<^sub>Q \\\\<^sub>Q tvec K' where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>Q \\* M\" and \"A\\<^sub>Q \\* N\" and \"A\\<^sub>Q \\* xvec\" and \"A\\<^sub>Q \\* yvec\" and \"A\\<^sub>Q \\* zvec\" and \"A\\<^sub>Q \\* tvec\" and \"tvec \\* \\\" and \"tvec \\* Q\" and \"tvec \\* P\" and \"tvec \\* M\" and \"tvec \\* N\" and \"tvec \\* xvec\" and \"tvec \\* yvec\" and \"tvec \\* zvec\" and \"distinct tvec\" and \"distinct A\\<^sub>Q\" and \\: \"\\ = Some(\\A\\<^sub>Q; tvec, K'\\)\" and \"\\ \\ \\\\<^sub>Q \\ M \\ K'\"\n by(drule_tac C=\"(\\, Q, M, P, xvec, yvec, zvec)\" in input_provenance) auto\n have \"tvec \\* \\\\<^sub>Q\" using `tvec \\* Q` `A\\<^sub>Q \\* tvec` FrQ\n by(auto dest: extract_frame_fresh_chain)\n have \"zvec \\* \\\\<^sub>Q\" using `zvec \\* Q` `A\\<^sub>Q \\* zvec` FrQ\n by(auto dest: extract_frame_fresh_chain)\n have \"zvec \\* K'\" using `zvec \\* Q` Q_trans `A\\<^sub>Q \\* zvec` `tvec \\* zvec`\n unfolding \\\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"xvec \\* K'\" using `xvec \\* Q` Q_trans `A\\<^sub>Q \\* xvec` `tvec \\* xvec`\n unfolding \\\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n note FrQ\n moreover from FrQ `guarded Q` have \"\\\\<^sub>Q \\ S_bottom'\" by(blast dest: guarded_stat_eq)\n have \"\\ \\ \\\\<^sub>Q \\ \\ \\ M \\ K'\" using `\\ \\ \\\\<^sub>Q \\ M \\ K'`\n by (metis Assertion_stat_eq_def Associativity Identity stat_eq_ent)\n from `\\ \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K\\\\*xvec\\\\N\\ \\ P''` `\\\\<^sub>Q \\ S_bottom'`\n have \"\\ \\ \\\\<^sub>Q \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K\\\\*xvec\\\\N\\ \\ P''\"\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym) \n hence \"\\ \\ \\\\<^sub>Q \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K'\\\\*xvec\\\\N\\ \\ P''\"\n using `\\ \\ \\\\<^sub>Q \\ \\ \\ M \\ K'` `zvec \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* M`\n `distinct zvec` `zvec \\* P` `A\\<^sub>Q \\* zvec` `zvec \\* \\\\<^sub>Q` `zvec \\* K'`\n apply(subst frame_res_chainbase[symmetric])\n by(rule_tac comm1_aux[where A\\<^sub>P=A\\<^sub>Q]) (auto intro!: Frame_stat_imp_refl)\n hence \"\\ \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K'\\\\*xvec\\\\N\\ \\ P''\" using `\\\\<^sub>Q \\ S_bottom'`\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym)\n with `xvec \\* K'` `\\ \\ P \\ Q` `xvec \\* \\` `xvec \\* P` `xvec \\* Q` `guarded Q`\n obtain Q'' \\' T R where Q_trans': \"\\ \\ !Q \\\\' @ K'\\\\*xvec\\\\N\\ \\ Q''\" and \"\\ \\ P'' \\ R \\ !P\" and \"\\ \\ Q'' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P''\" and suppT: \"((supp T)::name set) \\ supp Q''\"\n by(rule_tac bang_nontau_derivative) auto\n from Q_trans' `\\\\<^sub>Q \\ S_bottom'` have \"\\ \\ \\\\<^sub>Q \\ !Q \\\\' @ K'\\\\*xvec\\\\N\\ \\ Q''\"\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym)\n then obtain uvec M' where \"uvec \\* \\\" and \"uvec \\* Q\" and \"uvec \\* P\" and \"uvec \\* M\" and \"uvec \\* N\" and \"uvec \\* xvec\" and \"uvec \\* yvec\" and \"uvec \\* zvec\" and \"uvec \\* tvec\" and \"distinct uvec\" and \\': \"\\' = Some(\\([]); uvec, M'\\)\" and \"(\\ \\ \\\\<^sub>Q) \\ \\ \\ M' \\ K'\" and \"uvec \\* A\\<^sub>Q\"\n unfolding residual_inject\n by(drule_tac C=\"(\\, \\\\<^sub>Q,Q, M, P, xvec, yvec, zvec,tvec,A\\<^sub>Q)\" in output_provenance) auto\n hence \"\\ \\ \\ \\ \\\\<^sub>Q \\ M' \\ K'\"\n by(metis Associativity associativity_sym stat_eq_ent)\n have \"A\\<^sub>Q \\* M'\" using `A\\<^sub>Q \\* Q` Q_trans' `uvec \\* A\\<^sub>Q`\n unfolding \\'\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'' frame_chain_fresh_chain) \n have \"tvec \\* M'\" using `tvec \\* Q` Q_trans' `uvec \\* tvec`\n unfolding \\'\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'' frame_chain_fresh_chain)\n with `\\ \\ S_bottom' \\ Q \\\\ @ M\\N\\ \\ Q'` FrQ `distinct A\\<^sub>Q` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* \\` `distinct tvec` `A\\<^sub>Q \\* tvec` `tvec \\* \\` `\\ \\ \\ \\ \\\\<^sub>Q \\ M' \\ K'` `A\\<^sub>Q \\* M'` `tvec \\* Q`\n have \"\\ \\ S_bottom' \\ Q \\\\ @ M'\\N\\ \\ Q'\"\n unfolding \\\n by(rule_tac comm2_aux[where A\\<^sub>Q=\"[]\" and A\\<^sub>P=\"[]\"]) (assumption|auto)+\n moreover from `(\\ \\ \\\\<^sub>Q) \\ \\ \\ M' \\ K'` `\\\\<^sub>Q \\ S_bottom'` have \"\\ \\ \\\\<^sub>Q \\ \\ \\ M' \\ K'\" by(metis stat_eq_ent Identity composition_sym Assertion_stat_eq_sym)\n ultimately have \"\\ \\ Q \\ !Q \\None @ \\ \\ (\\\\*xvec\\(Q' \\ Q''))\" using `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* M` `xvec \\* Q` `\\ \\ \\\\<^sub>Q \\ !Q \\\\' @ K'\\\\*xvec\\\\N\\ \\ Q''` `tvec \\* \\` `tvec \\* \\\\<^sub>Q` `tvec \\* Q`\n `uvec \\* \\` `uvec \\* Q`\n unfolding \\ \\'\n by(rule_tac Comm1) (assumption | simp)+\n hence \"\\ \\ !Q \\None @ \\ \\ (\\\\*xvec\\(Q' \\ Q''))\" using `guarded Q` by(drule_tac Bang) auto\n moreover from `\\ \\ P'' \\ R \\ !P` `guarded P` `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(P' \\ P'') \\ \\\\*xvec\\((P' \\ R) \\ (P \\ !P))\"\n by(metis bisim_par_pres_sym bang_ext bisim_transitive bisim_par_assoc bisim_symmetric bisim_res_chain_pres)\n with `xvec \\* \\` `xvec \\* P` have \"\\ \\ \\\\*xvec\\(P' \\ P'') \\ (\\\\*xvec\\(P' \\ R)) \\ (P \\ !P)\"\n by(metis bisim_scope_ext_chain_sym bisim_transitive psi_fresh_vec)\n moreover from `\\ \\ Q'' \\ T \\ !Q` `xvec \\* \\` `xvec \\* Q` have \"\\ \\ \\\\*xvec\\(Q' \\ Q'') \\ (\\\\*xvec\\(Q' \\ T)) \\ !Q\"\n by(metis bisim_par_pres_sym bisim_transitive bisim_par_assoc bisim_symmetric bisim_res_chain_pres bisim_scope_ext_chain_sym psi_fresh_vec)\n moreover from `\\ \\ R \\ T` `\\ \\ Q' \\ P'` `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(P' \\ R) \\ \\\\*xvec\\(Q' \\ T)\"\n by(metis bisim_par_pres_sym bisim_transitive bisim_res_chain_pres bisim_par_comm bisimE(4))\n moreover from suppR have \"((supp(\\\\*xvec\\(P' \\ R)))::name set) \\ supp((\\\\*xvec\\(P' \\ P'')))\"\n by(auto simp add: psi.supp res_chain_supp)\n moreover from suppT have \"((supp(\\\\*xvec\\(Q' \\ T)))::name set) \\ supp((\\\\*xvec\\(Q' \\ Q'')))\"\n by(auto simp add: psi.supp res_chain_supp)\n ultimately show ?case by blast\n next\n case(c_comm2 M xvec N P' K A\\<^sub>P \\\\<^sub>P yvec zvec P'' Q)\n from `\\ \\ P \\ Q` have \"\\ \\ Q \\[bisim] P\" by(metis bisimE)\n with `\\ \\ P \\Some (\\A\\<^sub>P; yvec, K\\) @ M\\\\*xvec\\\\N\\ \\ P'` `xvec \\* \\` `xvec \\* Q`\n obtain \\ Q' where Q_trans: \"\\ \\ Q \\\\ @ M\\\\*xvec\\\\N\\ \\ Q'\" and \"\\ \\ Q' \\ P'\"\n by(force dest: simE)\n from Q_trans have \"\\ \\ S_bottom' \\ Q \\\\ @ M\\\\*xvec\\\\N\\ \\ Q'\" by(metis stat_eq_transition Identity Assertion_stat_eq_sym)\n from Q_trans obtain A\\<^sub>Q \\\\<^sub>Q tvec K' where FrQ: \"extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* Q\" and \"A\\<^sub>Q \\* M\" and \"A\\<^sub>Q \\* N\" and \"A\\<^sub>Q \\* xvec\" and \"A\\<^sub>Q \\* yvec\" and \"A\\<^sub>Q \\* zvec\" and \"A\\<^sub>Q \\* tvec\" and \"tvec \\* \\\" and \"tvec \\* Q\" and \"tvec \\* P\" and \"tvec \\* M\" and \"tvec \\* N\" and \"tvec \\* xvec\" and \"tvec \\* yvec\" and \"tvec \\* zvec\" and \"distinct tvec\" and \"distinct A\\<^sub>Q\" and \\: \"\\ = Some(\\A\\<^sub>Q; tvec, K'\\)\" and \"\\ \\ \\\\<^sub>Q \\ K' \\ M\"\n unfolding residual_inject\n by(drule_tac C=\"(\\, Q, M, P, xvec, yvec, zvec)\" in output_provenance) auto\n have \"tvec \\* \\\\<^sub>Q\" using `tvec \\* Q` `A\\<^sub>Q \\* tvec` FrQ\n by(auto dest: extract_frame_fresh_chain)\n have \"zvec \\* \\\\<^sub>Q\" using `zvec \\* Q` `A\\<^sub>Q \\* zvec` FrQ\n by(auto dest: extract_frame_fresh_chain)\n have \"zvec \\* K'\" using `zvec \\* Q` Q_trans `A\\<^sub>Q \\* zvec` `tvec \\* zvec`\n unfolding \\\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"xvec \\* K'\" using `xvec \\* Q` Q_trans `A\\<^sub>Q \\* xvec` `tvec \\* xvec`\n unfolding \\\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n note FrQ\n moreover from FrQ `guarded Q` have \"\\\\<^sub>Q \\ S_bottom'\" by(blast dest: guarded_stat_eq)\n have \"\\ \\ \\\\<^sub>Q \\ \\ \\ K' \\ M\" using `\\ \\ \\\\<^sub>Q \\ K' \\ M`\n by (metis Assertion_stat_eq_def Associativity Identity stat_eq_ent)\n from `\\ \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K\\N\\ \\ P''` `\\\\<^sub>Q \\ S_bottom'`\n have \"\\ \\ \\\\<^sub>Q \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K\\N\\ \\ P''\"\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym) \n hence \"\\ \\ \\\\<^sub>Q \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K'\\N\\ \\ P''\"\n using `\\ \\ \\\\<^sub>Q \\ \\ \\ K' \\ M` `zvec \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* M`\n `distinct zvec` `zvec \\* P` `A\\<^sub>Q \\* zvec` `zvec \\* \\\\<^sub>Q` `zvec \\* K'`\n apply(subst frame_res_chainbase[symmetric])\n by(rule_tac comm2_aux[where A\\<^sub>P=A\\<^sub>Q]) (auto intro!: Frame_stat_imp_refl)\n hence \"\\ \\ !P \\ Some (\\\\, \\zvec, M\\\\) @ K'\\N\\ \\ P''\" using `\\\\<^sub>Q \\ S_bottom'`\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym)\n with `xvec \\* K'` `\\ \\ P \\ Q` `xvec \\* \\` `xvec \\* P` `xvec \\* Q` `guarded Q`\n obtain Q'' \\' T R where Q_trans': \"\\ \\ !Q \\\\' @ K'\\N\\ \\ Q''\" and \"\\ \\ P'' \\ R \\ !P\" and \"\\ \\ Q'' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P''\" and suppT: \"((supp T)::name set) \\ supp Q''\"\n by(rule_tac bang_nontau_derivative) auto\n from Q_trans' `\\\\<^sub>Q \\ S_bottom'` have \"\\ \\ \\\\<^sub>Q \\ !Q \\\\' @ K'\\N\\ \\ Q''\"\n by(metis stat_eq_transition Identity composition_sym Assertion_stat_eq_sym)\n then obtain uvec M' where \"uvec \\* \\\" and \"uvec \\* Q\" and \"uvec \\* P\" and \"uvec \\* M\" and \"uvec \\* N\" and \"uvec \\* xvec\" and \"uvec \\* yvec\" and \"uvec \\* zvec\" and \"uvec \\* tvec\" and \"distinct uvec\" and \\': \"\\' = Some(\\([]); uvec, M'\\)\" and \"(\\ \\ \\\\<^sub>Q) \\ \\ \\ K' \\ M'\" and \"uvec \\* A\\<^sub>Q\"\n by(drule_tac C=\"(\\, \\\\<^sub>Q,Q, M, P, xvec, yvec, zvec,tvec,A\\<^sub>Q)\" in input_provenance) auto\n hence \"\\ \\ \\ \\ \\\\<^sub>Q \\ K' \\ M'\"\n by(metis Associativity associativity_sym stat_eq_ent)\n have \"A\\<^sub>Q \\* M'\" using `A\\<^sub>Q \\* Q` Q_trans' `uvec \\* A\\<^sub>Q`\n unfolding \\'\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'' frame_chain_fresh_chain) \n have \"tvec \\* M'\" using `tvec \\* Q` Q_trans' `uvec \\* tvec`\n unfolding \\'\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'' frame_chain_fresh_chain)\n with `\\ \\ S_bottom' \\ Q \\\\ @ M\\\\*xvec\\\\N\\ \\ Q'` FrQ `distinct A\\<^sub>Q` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* \\` `distinct tvec` `A\\<^sub>Q \\* tvec` `tvec \\* \\` `\\ \\ \\ \\ \\\\<^sub>Q \\ K' \\ M'` `A\\<^sub>Q \\* M'` `tvec \\* Q`\n have \"\\ \\ S_bottom' \\ Q \\\\ @ M'\\\\*xvec\\\\N\\ \\ Q'\"\n unfolding \\\n by(rule_tac comm1_aux[where A\\<^sub>Q=\"[]\" and A\\<^sub>P=\"[]\"]) (assumption|auto)+\n moreover from `(\\ \\ \\\\<^sub>Q) \\ \\ \\ K' \\ M'` `\\\\<^sub>Q \\ S_bottom'` have \"\\ \\ \\\\<^sub>Q \\ \\ \\ K' \\ M'\" by(metis stat_eq_ent Identity composition_sym Assertion_stat_eq_sym)\n ultimately have \"\\ \\ Q \\ !Q \\None @ \\ \\ (\\\\*xvec\\(Q' \\ Q''))\" using `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* M` `xvec \\* Q` `\\ \\ \\\\<^sub>Q \\ !Q \\\\' @ K'\\N\\ \\ Q''` `tvec \\* \\` `tvec \\* \\\\<^sub>Q` `tvec \\* Q`\n `uvec \\* \\` `uvec \\* Q`\n unfolding \\ \\'\n by(rule_tac Comm2) (assumption | simp)+\n hence \"\\ \\ !Q \\None @ \\ \\ (\\\\*xvec\\(Q' \\ Q''))\" using `guarded Q` by(drule_tac Bang) auto\n moreover from `\\ \\ P'' \\ R \\ !P` `guarded P` `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(P' \\ P'') \\ \\\\*xvec\\((P' \\ R) \\ (P \\ !P))\"\n by(metis bisim_par_pres_sym bang_ext bisim_transitive bisim_par_assoc bisim_symmetric bisim_res_chain_pres)\n with `xvec \\* \\` `xvec \\* P` have \"\\ \\ \\\\*xvec\\(P' \\ P'') \\ (\\\\*xvec\\(P' \\ R)) \\ (P \\ !P)\"\n by(metis bisim_scope_ext_chain_sym bisim_transitive psi_fresh_vec)\n moreover from `\\ \\ Q'' \\ T \\ !Q` `xvec \\* \\` `xvec \\* Q` have \"\\ \\ \\\\*xvec\\(Q' \\ Q'') \\ (\\\\*xvec\\(Q' \\ T)) \\ !Q\"\n by(metis bisim_par_pres_sym bisim_transitive bisim_par_assoc bisim_symmetric bisim_res_chain_pres bisim_scope_ext_chain_sym psi_fresh_vec)\n moreover from `\\ \\ R \\ T` `\\ \\ Q' \\ P'` `xvec \\* \\` have \"\\ \\ \\\\*xvec\\(P' \\ R) \\ \\\\*xvec\\(Q' \\ T)\"\n by(metis bisim_par_pres_sym bisim_transitive bisim_res_chain_pres bisim_par_comm bisimE(4))\n moreover from suppR have \"((supp(\\\\*xvec\\(P' \\ R)))::name set) \\ supp((\\\\*xvec\\(P' \\ P'')))\"\n by(auto simp add: psi.supp res_chain_supp)\n moreover from suppT have \"((supp(\\\\*xvec\\(Q' \\ T)))::name set) \\ supp((\\\\*xvec\\(Q' \\ Q'')))\"\n by(auto simp add: psi.supp res_chain_supp)\n ultimately show ?case by blast\n next\n case(c_bang P' Q)\n then obtain Q' T R where Q_trans: \"\\ \\ !Q \\None @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ (P \\ !P)\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and suppR: \"((supp R)::name set) \\ supp P'\" and suppT: \"((supp T)::name set) \\ supp Q'\"\n by blast\n from `\\ \\ P' \\ R \\ (P \\ !P)` `guarded P` have \"\\ \\ P' \\ R \\ !P\" by(metis bang_ext bisim_par_pres_sym bisim_transitive bisim_symmetric)\n with Q_trans show ?case using `\\ \\ Q' \\ T \\ !Q` `\\ \\ R \\ T` suppR suppT\n by blast\n qed\n ultimately show ?thesis by blast\nqed\n\nlemma bang_derivative:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ !P \\\\ @ \\ \\ P'\"\n and \"\\ \\ P \\ Q\"\n and \"bn \\ \\* \\\"\n and \"bn \\ \\* P\"\n and \"bn \\ \\* Q\"\n and \"bn \\ \\* subject \\\"\n and \"guarded Q\"\n\n obtains \\' Q' R T where \"\\ \\ !Q \\\\' @ \\ \\ Q'\" and \"\\ \\ P' \\ R \\ !P\" and \"\\ \\ Q' \\ T \\ !Q\" and \"\\ \\ R \\ T\"\n and \"((supp R)::name set) \\ supp P'\" and \"((supp T)::name set) \\ supp Q'\"\n using assms\n by(cases \"\\ = \\\") (auto intro: bang_nontau_derivative bang_tau_derivative)\n\nlemma struct_cong_bisim:\n fixes P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"P \\\\<^sub>s Q\"\n\n shows \"P \\ Q\"\nusing assms\nby(induct rule: struct_cong.induct)\n (auto intro: bisim_reflexive bisim_symmetric bisim_transitive bisim_par_comm bisim_par_assoc bisim_par_nil bisim_res_nil bisim_res_comm bisim_scope_ext bisim_case_push_res bisim_input_push_res bisim_output_push_res bang_ext)\n\nlemma bisim_bang_pres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ Q\"\n and \"guarded P\"\n and \"guarded Q\"\n\n shows \"\\ \\ !P \\ !Q\"\nproof -\n let ?X = \"{(\\, R \\ !P, R \\ !Q) | \\ P Q R. \\ \\ P \\ Q \\ guarded P \\ guarded Q}\"\n let ?Y = \"{(\\, P, Q) | \\ P P' Q' Q. \\ \\ P \\ P' \\ (\\, P', Q') \\ ?X \\ \\ \\ Q' \\ Q}\"\n from assms have \"(\\, \\ \\ !P, \\ \\ !Q) \\ ?X\" by(blast intro: bisim_reflexive)\n\n moreover have \"eqvt ?X\" \n apply(auto simp add: eqvt_def)\n apply(drule_tac p=p in bisim_closed)\n by force\n ultimately have \"\\ \\ \\ \\ !P \\ \\ \\ !Q\"\n proof(coinduct rule: weak_transitive_coinduct)\n case(c_stat_eq \\ P Q)\n thus ?case by auto\n next\n case(c_sim \\ RP RQ)\n from `(\\, RP, RQ) \\ ?X` obtain P Q R where \"\\ \\ P \\ Q\" and \"guarded P\" and \"guarded Q\"\n and \"RP = R \\ !P\" and \"RQ = R \\ !Q\"\n by auto\n note `\\ \\ P \\ Q` \n moreover from `eqvt ?X` have \"eqvt ?Y\" by blast\n moreover note `guarded P` `guarded Q` bisimE(2) bisimE(3) bisimE(4) stat_eq_bisim bisim_closed bisim_par_assoc[THEN bisim_symmetric] \n bisim_par_pres bisim_par_pres_aux_sym bisim_res_chain_pres bisim_scope_ext_chain_sym bisim_transitive\n moreover have \"\\\\ P Q R T. \\\\ \\ P \\ Q; (\\, Q, R) \\ ?Y; \\ \\ R \\ T\\ \\ (\\, P, T) \\ ?Y\"\n by auto (metis bisim_transitive)\n moreover have \"\\\\ P Q R. \\\\ \\ P \\ Q; guarded P; guarded Q\\ \\ (\\, R \\ !P, R \\ !Q) \\ ?Y\" by(blast intro: bisim_reflexive)\n moreover have \"\\\\ P \\ \\ P' Q. \\\\ \\ !P \\\\ @ \\ \\ P'; \\ \\ P \\ Q; bn \\ \\* \\; bn \\ \\* P; bn \\ \\* Q; guarded Q; bn \\ \\* subject \\\\ \\\n \\\\' Q' R T. \\ \\ !Q \\\\' @ \\ \\ Q' \\ \\ \\ P' \\ R \\ !P \\ \\ \\ Q' \\ T \\ !Q \\\n \\ \\ R \\ T \\ ((supp R)::name set) \\ supp P' \\ \n ((supp T)::name set) \\ supp Q'\"\n by(blast elim: bang_derivative)\n ultimately have \"\\ \\ R \\ !P \\[?Y] R \\ !Q\"\n by(rule bang_pres)\n with `RP = R \\ !P` `RQ = R \\ !Q` show ?case\n by blast\n next\n case(c_ext \\ RP RQ \\')\n thus ?case by(blast dest: bisimE)\n next\n case(c_sym \\ RP RQ)\n thus ?case by(blast dest: bisimE)\n qed\n thus ?thesis\n by(metis bisim_transitive bisim_par_nil bisim_symmetric bisim_par_comm)\nqed\n\nend\n\nend\n\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Bisim_Struct_Cong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.257774190440236}} {"text": "theory FOR_Check_Impl\n imports FOR_Check\n Regular_Tree_Relations.Regular_Relation_Impl\n NF_Impl\nbegin\n\nsection \\Inference checking implementation\\\n\n(* we define epsilon free agtt/gtt constructions *)\ndefinition \"ftrancl_eps_free_closures \\ = eps_free_automata (eps \\) \\\"\nabbreviation \"ftrancl_eps_free_reg \\ \\ Reg (fin \\) (ftrancl_eps_free_closures (ta \\))\"\n\nlemma ftrancl_eps_free_ta_derI:\n \"(eps \\)|\\<^sup>+| = eps \\ \\ ta_der (ftrancl_eps_free_closures \\) (term_of_gterm t) = ta_der \\ (term_of_gterm t)\"\n using eps_free[of \\] ta_res_eps_free[of \\]\n by (auto simp add: ftrancl_eps_free_closures_def)\n\nlemma \\_ftrancl_eps_free_closuresI:\n \"(eps (ta \\))|\\<^sup>+| = eps (ta \\) \\ \\ (ftrancl_eps_free_reg \\) = \\ \\\"\n using ftrancl_eps_free_ta_derI[of \"ta \\\"]\n unfolding \\_def by (auto simp: gta_lang_def gta_der_def)\n\ndefinition \"root_step R \\ \\ (let (TA1, TA2) = agtt_grrstep R \\ in\n (ftrancl_eps_free_closures TA1, TA2))\"\n\ndefinition AGTT_trancl_eps_free :: \"('q, 'f) gtt \\ ('q + 'q, 'f) gtt\" where\n \"AGTT_trancl_eps_free \\ = (let (\\, \\) = AGTT_trancl \\ in\n (ftrancl_eps_free_closures \\, \\))\"\n\ndefinition GTT_trancl_eps_free where\n \"GTT_trancl_eps_free \\ = (let (\\, \\) = GTT_trancl \\ in\n (ftrancl_eps_free_closures \\,\n ftrancl_eps_free_closures \\))\"\n\ndefinition AGTT_comp_eps_free where\n \"AGTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2 = (let (\\, \\) = AGTT_comp' \\\\<^sub>1 \\\\<^sub>2 in\n (ftrancl_eps_free_closures \\, \\))\"\n\ndefinition GTT_comp_eps_free where\n \"GTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2 =(let (\\, \\) = GTT_comp' \\\\<^sub>1 \\\\<^sub>2 in\n (ftrancl_eps_free_closures \\, ftrancl_eps_free_closures \\))\"\n\n(* epsilon free proves *)\nlemma eps_free_relable [simp]:\n \"is_gtt_eps_free (relabel_gtt \\) = is_gtt_eps_free \\\"\n by (auto simp: is_gtt_eps_free_def relabel_gtt_def fmap_states_gtt_def fmap_states_ta_def)\n\nlemma eps_free_prod_swap:\n \"is_gtt_eps_free (\\, \\) \\ is_gtt_eps_free (\\, \\)\"\n by (auto simp: is_gtt_eps_free_def)\n\nlemma eps_free_root_step:\n \"is_gtt_eps_free (root_step R \\)\"\n by (auto simp add: case_prod_beta is_gtt_eps_free_def root_step_def pair_at_to_agtt'_def ftrancl_eps_free_closures_def)\n\nlemma eps_free_AGTT_trancl_eps_free:\n \"is_gtt_eps_free \\ \\ is_gtt_eps_free (AGTT_trancl_eps_free \\)\"\n by (auto simp: case_prod_beta is_gtt_eps_free_def AGTT_trancl_def Let_def\n AGTT_trancl_eps_free_def ftrancl_eps_free_closures_def)\n\nlemma eps_free_GTT_trancl_eps_free:\n \"is_gtt_eps_free \\ \\ is_gtt_eps_free (GTT_trancl_eps_free \\)\"\n by (auto simp: case_prod_beta is_gtt_eps_free_def GTT_trancl_eps_free_def ftrancl_eps_free_closures_def)\n\nlemma eps_free_AGTT_comp_eps_free:\n \"is_gtt_eps_free \\\\<^sub>2 \\ is_gtt_eps_free (AGTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2)\"\n by (auto simp: case_prod_beta is_gtt_eps_free_def AGTT_comp_eps_free_def\n ftrancl_eps_free_closures_def AGTT_comp_def fmap_states_gtt_def fmap_states_ta_def)\n\nlemma eps_free_GTT_comp_eps_free:\n \"is_gtt_eps_free (GTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2)\"\n by (auto simp: case_prod_beta is_gtt_eps_free_def GTT_comp_eps_free_def ftrancl_eps_free_closures_def)\n\nlemmas eps_free_const =\n eps_free_prod_swap\n eps_free_root_step\n eps_free_AGTT_trancl_eps_free\n eps_free_GTT_trancl_eps_free\n eps_free_AGTT_comp_eps_free\n eps_free_GTT_comp_eps_free\n\n(* lang preserve proofs *)\nlemma agtt_lang_derI:\n assumes \"\\ t. ta_der (fst \\) (term_of_gterm t) = ta_der (fst \\) (term_of_gterm t)\"\n and \"\\ t. ta_der (snd \\) (term_of_gterm t) = ta_der (snd \\) (term_of_gterm t)\"\n shows \"agtt_lang \\ = agtt_lang \\\" using assms\n by (auto simp: agtt_lang_def gta_der_def)\n\nlemma agtt_lang_root_step_conv:\n \"agtt_lang (root_step R \\) = agtt_lang (agtt_grrstep R \\)\"\n using ftrancl_eps_free_ta_derI[OF agtt_grrstep_eps_trancl(1), of R \\]\n by (auto simp: case_prod_beta root_step_def intro!: agtt_lang_derI)\n\nlemma agtt_lang_AGTT_trancl_eps_free_conv:\n assumes \"is_gtt_eps_free \\\"\n shows \"agtt_lang (AGTT_trancl_eps_free \\) = agtt_lang (AGTT_trancl \\)\"\nproof -\n let ?eps = \"eps (fst (AGTT_trancl \\))\"\n have \"?eps |O| ?eps = {||}\" using assms\n by (auto simp: AGTT_trancl_def is_gtt_eps_free_def Let_def fmap_states_ta_def)\n from ftrancl_eps_free_ta_derI[OF frelcomp_empty_ftrancl_simp[OF this]]\n show ?thesis\n by (auto simp: case_prod_beta AGTT_trancl_eps_free_def intro!: agtt_lang_derI)\nqed\n\nlemma agtt_lang_GTT_trancl_eps_free_conv:\n assumes \"is_gtt_eps_free \\\"\n shows \"agtt_lang (GTT_trancl_eps_free \\) = agtt_lang (GTT_trancl \\)\"\nproof -\n have \"(eps (fst (GTT_trancl \\)))|\\<^sup>+| = eps (fst (GTT_trancl \\))\"\n \"(eps (snd (GTT_trancl \\)))|\\<^sup>+| = eps (snd (GTT_trancl \\))\" using assms\n by (auto simp: GTT_trancl_def Let_def is_gtt_eps_free_def \\_trancl_inv)\n from ftrancl_eps_free_ta_derI[OF this(1)] ftrancl_eps_free_ta_derI[OF this(2)]\n show ?thesis\n by (auto simp: case_prod_beta GTT_trancl_eps_free_def intro!: agtt_lang_derI)\nqed\n\nlemma agtt_lang_AGTT_comp_eps_free_conv:\n assumes \"is_gtt_eps_free \\\\<^sub>1\" \"is_gtt_eps_free \\\\<^sub>2\"\n shows \"agtt_lang (AGTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2) = agtt_lang (AGTT_comp' \\\\<^sub>1 \\\\<^sub>2)\"\nproof -\n have \"(eps (fst (AGTT_comp' \\\\<^sub>1 \\\\<^sub>2)))|\\<^sup>+| = eps (fst (AGTT_comp' \\\\<^sub>1 \\\\<^sub>2))\" using assms\n by (auto simp: is_gtt_eps_free_def fmap_states_gtt_def fmap_states_ta_def\n case_prod_beta AGTT_comp_def gtt_interface_def \\_def intro!: frelcomp_empty_ftrancl_simp)\n from ftrancl_eps_free_ta_derI[OF this] show ?thesis\n by (auto simp: case_prod_beta AGTT_comp_eps_free_def intro!: agtt_lang_derI)\nqed\n\nlemma agtt_lang_GTT_comp_eps_free_conv:\n assumes \"is_gtt_eps_free \\\\<^sub>1\" \"is_gtt_eps_free \\\\<^sub>2\"\n shows \"agtt_lang (GTT_comp_eps_free \\\\<^sub>1 \\\\<^sub>2) = agtt_lang (GTT_comp' \\\\<^sub>1 \\\\<^sub>2)\"\nproof -\n have \"(eps (fst (GTT_comp' \\\\<^sub>1 \\\\<^sub>2)))|\\<^sup>+| = eps (fst (GTT_comp' \\\\<^sub>1 \\\\<^sub>2))\"\n \"(eps (snd (GTT_comp' \\\\<^sub>1 \\\\<^sub>2)))|\\<^sup>+| = eps (snd (GTT_comp' \\\\<^sub>1 \\\\<^sub>2))\" using assms\n by (auto simp: is_gtt_eps_free_def fmap_states_gtt_def fmap_states_ta_def \\\\<^sub>\\_fmember\n case_prod_beta GTT_comp_def gtt_interface_def \\_def dest!: ground_ta_der_statesD\n intro!: frelcomp_empty_ftrancl_simp)\n from ftrancl_eps_free_ta_derI[OF this(1)] ftrancl_eps_free_ta_derI[OF this(2)]\n show ?thesis\n by (auto simp: case_prod_beta GTT_comp_eps_free_def intro!: agtt_lang_derI)\nqed\n\nfun gtt_of_gtt_rel_impl :: \"('f \\ nat) fset \\ ('f :: linorder, 'v) fin_trs list \\ ftrs gtt_rel \\ (nat, 'f) gtt option\" where\n \"gtt_of_gtt_rel_impl \\ Rs (ARoot is) = liftO1 (\\R. relabel_gtt (root_step R \\)) (is_to_trs' Rs is)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (GInv g) = liftO1 prod.swap (gtt_of_gtt_rel_impl \\ Rs g)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (AUnion g1 g2) = liftO2 (\\g1 g2. relabel_gtt (AGTT_union' g1 g2)) (gtt_of_gtt_rel_impl \\ Rs g1) (gtt_of_gtt_rel_impl \\ Rs g2)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (ATrancl g) = liftO1 (relabel_gtt \\ AGTT_trancl_eps_free) (gtt_of_gtt_rel_impl \\ Rs g)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (GTrancl g) = liftO1 GTT_trancl_eps_free (gtt_of_gtt_rel_impl \\ Rs g)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (AComp g1 g2) = liftO2 (\\g1 g2. relabel_gtt (AGTT_comp_eps_free g1 g2)) (gtt_of_gtt_rel_impl \\ Rs g1) (gtt_of_gtt_rel_impl \\ Rs g2)\"\n| \"gtt_of_gtt_rel_impl \\ Rs (GComp g1 g2) = liftO2 (\\g1 g2. relabel_gtt (GTT_comp_eps_free g1 g2)) (gtt_of_gtt_rel_impl \\ Rs g1) (gtt_of_gtt_rel_impl \\ Rs g2)\"\n\nlemma gtt_of_gtt_rel_impl_is_gtt_eps_free:\n \"gtt_of_gtt_rel_impl \\ Rs g = Some g' \\ is_gtt_eps_free g'\"\nproof (induct g arbitrary: g')\n case (AUnion g1 g2)\n then show ?case\n by (auto simp: is_gtt_eps_free_def AGTT_union_def fmap_states_gtt_def fmap_states_ta_def ta_union_def relabel_gtt_def)\nqed (auto simp: eps_free_const)\n\nlemma gtt_of_gtt_rel_impl_gtt_of_gtt_rel:\n \"gtt_of_gtt_rel_impl \\ Rs g \\ None \\ gtt_of_gtt_rel \\ Rs g \\ None\" (is \"?Ls \\ ?Rs\")\nproof -\n have \"?Ls \\ ?Rs\" by (induct g) auto\n moreover have \"?Rs \\ ?Ls\" by (induct g) auto\n ultimately show ?thesis by blast\nqed\n\nlemma gtt_of_gtt_rel_impl_sound:\n \"gtt_of_gtt_rel_impl \\ Rs g = Some g' \\ gtt_of_gtt_rel \\ Rs g = Some g'' \\ agtt_lang g' = agtt_lang g''\"\nproof (induct g arbitrary: g' g'')\n case (ARoot x)\n then show ?case by (simp add: agtt_lang_root_step_conv)\nnext\n case (GInv g)\n then have \"agtt_lang (prod.swap g') = agtt_lang (prod.swap g'')\" by auto\n then show ?case\n by (metis converse_agtt_lang converse_converse)\nnext\n case (AUnion g1 g2)\n then show ?case\n by simp (metis AGTT_union'_sound option.sel)\nnext\n case (ATrancl g)\n then show ?case\n using agtt_lang_AGTT_trancl_eps_free_conv[OF gtt_of_gtt_rel_impl_is_gtt_eps_free, of \\ Rs g]\n by simp (metis AGTT_trancl_sound option.sel)\nnext\n case (GTrancl g)\n then show ?case\n using agtt_lang_GTT_trancl_eps_free_conv[OF gtt_of_gtt_rel_impl_is_gtt_eps_free, of \\ Rs g]\n by simp (metis GTT_trancl_alang option.sel) \nnext\n case (AComp g1 g2)\n then show ?case\n using agtt_lang_AGTT_comp_eps_free_conv[OF gtt_of_gtt_rel_impl_is_gtt_eps_free, of \\ Rs g\n \"the (gtt_of_gtt_rel_impl \\ Rs g1)\" \"the (gtt_of_gtt_rel_impl \\ Rs g2)\"]\n by simp (metis AGTT_comp'_sound agtt_lang_AGTT_comp_eps_free_conv gtt_of_gtt_rel_impl_is_gtt_eps_free option.sel) \nnext\n case (GComp g1 g2)\n then show ?case\n using agtt_lang_GTT_comp_eps_free_conv[OF gtt_of_gtt_rel_impl_is_gtt_eps_free, of \\ Rs g\n \"the (gtt_of_gtt_rel_impl \\ Rs g1)\" \"the (gtt_of_gtt_rel_impl \\ Rs g2)\"]\n by simp (metis agtt_lang_GTT_comp_eps_free_conv gtt_comp'_alang gtt_of_gtt_rel_impl_is_gtt_eps_free option.sel) \nqed\n\n(* eps free closure constructions *)\nlemma \\_eps_free_nhole_ctxt_closure_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (ftrancl_eps_free_reg (nhole_ctxt_closure_reg \\ \\)) = \\ (nhole_ctxt_closure_reg \\ \\)\"\nproof -\n have \"eps (ta (nhole_ctxt_closure_reg \\ \\)) |O| eps (ta (nhole_ctxt_closure_reg \\ \\)) = {||}\" using assms\n by (auto simp: nhole_ctxt_closure_reg_def gen_nhole_ctxt_closure_reg_def\n gen_nhole_ctxt_closure_automaton_def ta_union_def reflcl_over_nhole_ctxt_ta_def\n fmap_states_reg_def is_ta_eps_free_def fmap_states_ta_def reg_Restr_Q\\<^sub>f_def)\n from frelcomp_empty_ftrancl_simp[OF this] show ?thesis\n by (intro \\_ftrancl_eps_free_closuresI) simp\nqed\n\nlemma \\_eps_free_ctxt_closure_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (ftrancl_eps_free_reg (ctxt_closure_reg \\ \\)) = \\ (ctxt_closure_reg \\ \\)\"\nproof -\n have \"eps (ta (ctxt_closure_reg \\ \\)) |O| eps (ta (ctxt_closure_reg \\ \\)) = {||}\" using assms\n by (auto simp: ctxt_closure_reg_def gen_ctxt_closure_reg_def Let_def\n gen_ctxt_closure_automaton_def ta_union_def reflcl_over_single_ta_def\n fmap_states_reg_def is_ta_eps_free_def fmap_states_ta_def reg_Restr_Q\\<^sub>f_def)\n from frelcomp_empty_ftrancl_simp[OF this] show ?thesis\n by (intro \\_ftrancl_eps_free_closuresI) simp\nqed\n\nlemma \\_eps_free_parallel_closure_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (ftrancl_eps_free_reg (parallel_closure_reg \\ \\)) = \\ (parallel_closure_reg \\ \\)\"\nproof -\n have \"eps (ta (parallel_closure_reg \\ \\)) |O| eps (ta (parallel_closure_reg \\ \\)) = {||}\" using assms\n by (auto simp: parallel_closure_reg_def gen_parallel_closure_automaton_def Let_def ta_union_def\n refl_over_states_ta_def fmap_states_reg_def is_ta_eps_free_def fmap_states_ta_def reg_Restr_Q\\<^sub>f_def)\n from frelcomp_empty_ftrancl_simp[OF this] show ?thesis\n by (intro \\_ftrancl_eps_free_closuresI) simp\nqed\n\nabbreviation \"eps_free_reg' S R \\ Reg (fin R) (eps_free_automata S (ta R))\"\n\ndefinition \"eps_free_mctxt_closure_reg \\ \\ =\n (let \\ = mctxt_closure_reg \\ \\ in\n eps_free_reg' ((\\ p. (fst p, Inr cl_state)) |`| (eps (ta \\)) |\\| eps (ta \\)) \\)\"\n\ndefinition \"eps_free_nhole_mctxt_reflcl_reg \\ \\ =\n (let \\ = nhole_mctxt_reflcl_reg \\ \\ in\n eps_free_reg' ((\\ p. (fst p, Inl (Inr cl_state))) |`| (eps (ta \\)) |\\| eps (ta \\)) \\)\"\n\ndefinition \"eps_free_nhole_mctxt_closure_reg \\ \\ =\n (let \\ = nhole_mctxt_closure_reg \\ \\ in\n eps_free_reg' ((\\ p. (fst p, (Inr cl_state))) |`| (eps (ta \\)) |\\| eps (ta \\)) \\)\"\n\nlemma \\_eps_free_reg'I:\n \"(eps (ta \\))|\\<^sup>+| = S \\ \\ (eps_free_reg' S \\) = \\ \\\"\n by (auto simp: \\_def gta_lang_def gta_der_def ta_res_eps_free simp flip: eps_free) \n\nlemma \\_eps_free_mctxt_closure_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (eps_free_mctxt_closure_reg \\ \\) = \\ (mctxt_closure_reg \\ \\)\" using assms\n unfolding eps_free_mctxt_closure_reg_def Let_def\n apply (intro \\_eps_free_reg'I)\n apply (auto simp: comp_def mctxt_closure_reg_def is_ta_eps_free_def Let_def\n gen_nhole_mctxt_closure_automaton_def reflcl_over_nhole_mctxt_ta_def ta_union_def\n reflcl_over_nhole_ctxt_ta_def gen_mctxt_closure_reg_def reg_Restr_Q\\<^sub>f_def\n fmap_states_reg_def fmap_states_ta_def dest: ftranclD ftranclD2)\n by (meson fimageI finsert_iff finterI fr_into_trancl ftrancl_into_trancl)\n\nlemma \\_eps_free_nhole_mctxt_reflcl_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (eps_free_nhole_mctxt_reflcl_reg \\ \\) = \\ (nhole_mctxt_reflcl_reg \\ \\)\" using assms\n unfolding eps_free_nhole_mctxt_reflcl_reg_def Let_def\n apply (intro \\_eps_free_reg'I)\n apply (auto simp: comp_def nhole_mctxt_reflcl_reg_def is_ta_eps_free_def Let_def\n nhole_mctxt_closure_reg_def gen_nhole_mctxt_closure_reg_def reg_union_def ta_union_def\n gen_nhole_mctxt_closure_automaton_def reflcl_over_nhole_mctxt_ta_def\n reflcl_over_nhole_ctxt_ta_def reg_Restr_Q\\<^sub>f_def fmap_states_reg_def fmap_states_ta_def dest: ftranclD ftranclD2)\n by (meson fimageI finsert_iff finterI fr_into_trancl ftrancl_into_trancl)\n\nlemma \\_eps_free_nhole_mctxt_closure_reg:\n assumes \"is_ta_eps_free (ta \\)\"\n shows \"\\ (eps_free_nhole_mctxt_closure_reg \\ \\) = \\ (nhole_mctxt_closure_reg \\ \\)\" using assms\n unfolding eps_free_nhole_mctxt_closure_reg_def Let_def\n apply (intro \\_eps_free_reg'I)\n apply (auto simp: comp_def nhole_mctxt_closure_reg_def is_ta_eps_free_def Let_def\n gen_nhole_mctxt_closure_reg_def reg_Restr_Q\\<^sub>f_def fmap_states_reg_def fmap_states_ta_def\n gen_nhole_mctxt_closure_automaton_def reflcl_over_nhole_mctxt_ta_def ta_union_def\n reflcl_over_nhole_ctxt_ta_def dest: ftranclD ftranclD2)\n by (meson fimageI finsert_iff finterI fr_into_trancl ftrancl_into_trancl)\n\nfun rr1_of_rr1_rel_impl :: \"('f \\ nat) fset \\ ('f :: linorder, 'v) fin_trs list \\ ftrs rr1_rel \\ (nat, 'f) reg option\"\nand rr2_of_rr2_rel_impl :: \"('f \\ nat) fset \\ ('f, 'v) fin_trs list \\ ftrs rr2_rel \\ (nat, 'f option \\ 'f option) reg option\" where\n \"rr1_of_rr1_rel_impl \\ Rs R1Terms = Some (relabel_reg (term_reg \\))\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1NF is) = liftO1 (\\R. (simplify_reg (nf_reg (fst |`| R) \\))) (is_to_trs' Rs is)\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1Inf r) = liftO1 (\\R.\n let \\ = trim_reg R in\n simplify_reg (proj_1_reg (Inf_reg_impl \\))\n ) (rr2_of_rr2_rel_impl \\ Rs r)\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1Proj i r) = (case i of 0 \\\n liftO1 (trim_reg \\ proj_1_reg) (rr2_of_rr2_rel_impl \\ Rs r)\n | _ \\ liftO1 (trim_reg \\ proj_2_reg) (rr2_of_rr2_rel_impl \\ Rs r))\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1Union s1 s2) =\n liftO2 (\\ x y. relabel_reg (reg_union x y)) (rr1_of_rr1_rel_impl \\ Rs s1) (rr1_of_rr1_rel_impl \\ Rs s2)\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1Inter s1 s2) =\n liftO2 (\\ x y. simplify_reg (reg_intersect x y)) (rr1_of_rr1_rel_impl \\ Rs s1) (rr1_of_rr1_rel_impl \\ Rs s2)\"\n| \"rr1_of_rr1_rel_impl \\ Rs (R1Diff s1 s2) = liftO2 (\\ x y. relabel_reg (trim_reg (difference_reg x y))) (rr1_of_rr1_rel_impl \\ Rs s1) (rr1_of_rr1_rel_impl \\ Rs s2)\"\n\n| \"rr2_of_rr2_rel_impl \\ Rs (R2GTT_Rel g w x) =\n (case w of PRoot \\\n (case x of ESingle \\ liftO1 (simplify_reg \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EParallel \\ liftO1 (simplify_reg \\ reflcl_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EStrictParallel \\ liftO1 (simplify_reg \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g))\n | PNonRoot \\\n (case x of ESingle \\ liftO1 (simplify_reg \\ ftrancl_eps_free_reg \\ nhole_ctxt_closure_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EParallel \\ liftO1 (simplify_reg \\ eps_free_nhole_mctxt_reflcl_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EStrictParallel \\ liftO1 (simplify_reg \\ eps_free_nhole_mctxt_closure_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g))\n | PAny \\\n (case x of ESingle \\ liftO1 (simplify_reg \\ ftrancl_eps_free_reg \\ ctxt_closure_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EParallel \\ liftO1 (simplify_reg \\ ftrancl_eps_free_reg \\ parallel_closure_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)\n | EStrictParallel \\ liftO1 (simplify_reg \\ eps_free_mctxt_closure_reg (lift_sig_RR2 |`| \\) \\ GTT_to_RR2_root_reg) (gtt_of_gtt_rel_impl \\ Rs g)))\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Diag s) =\n liftO1 (\\ x. fmap_funs_reg (\\f. (Some f, Some f)) x) (rr1_of_rr1_rel_impl \\ Rs s)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Prod s1 s2) =\n liftO2 (\\ x y. simplify_reg (pair_automaton_reg x y)) (rr1_of_rr1_rel_impl \\ Rs s1) (rr1_of_rr1_rel_impl \\ Rs s2)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Inv r) = liftO1 (fmap_funs_reg prod.swap) (rr2_of_rr2_rel_impl \\ Rs r)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Union r1 r2) =\n liftO2 (\\ x y. relabel_reg (reg_union x y)) (rr2_of_rr2_rel_impl \\ Rs r1) (rr2_of_rr2_rel_impl \\ Rs r2)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Inter r1 r2) =\n liftO2 (\\ x y. simplify_reg (reg_intersect x y)) (rr2_of_rr2_rel_impl \\ Rs r1) (rr2_of_rr2_rel_impl \\ Rs r2)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Diff r1 r2) = liftO2 (\\ x y. simplify_reg (difference_reg x y)) (rr2_of_rr2_rel_impl \\ Rs r1) (rr2_of_rr2_rel_impl \\ Rs r2)\"\n| \"rr2_of_rr2_rel_impl \\ Rs (R2Comp r1 r2) = liftO2 (\\ x y. simplify_reg (rr2_compositon \\ x y))\n (rr2_of_rr2_rel_impl \\ Rs r1) (rr2_of_rr2_rel_impl \\ Rs r2)\"\n\nlemmas ta_simp_unfold = simplify_reg_def relabel_reg_def trim_reg_def relabel_ta_def term_reg_def\nlemma is_ta_eps_free_trim_reg [intro!]:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (trim_reg R))\"\n by (simp add: is_ta_eps_free_def trim_reg_def trim_ta_def ta_restrict_def)\n\nlemma is_ta_eps_free_relabel_reg [intro!]:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (relabel_reg R))\"\n by (simp add: is_ta_eps_free_def relabel_reg_def relabel_ta_def fmap_states_ta_def)\n\nlemma is_ta_eps_free_simplify_reg [intro!]:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (simplify_reg R))\"\n by (simp add: is_ta_eps_free_def ta_simp_unfold fmap_states_ta_def trim_ta_def ta_restrict_def)\n\nlemma is_ta_emptyI [simp]:\n \"is_ta_eps_free (TA R {||}) \\ True\"\n by (simp add: is_ta_eps_free_def)\n\nlemma is_ta_empty_trim_reg:\n \"is_ta_eps_free (ta A) \\ eps (ta (trim_reg A)) = {||}\"\n by (auto simp: is_ta_eps_free_def trim_reg_def trim_ta_def ta_restrict_def)\n\nlemma is_proj_ta_eps_empty:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (proj_1_reg R))\"\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (proj_2_reg R))\"\n by (auto simp: is_ta_eps_free_def proj_1_reg_def proj_2_reg_def collapse_automaton_reg_def collapse_automaton_def\n fmap_funs_reg_def fmap_funs_ta_def trim_reg_def trim_ta_def ta_restrict_def)\n\nlemma is_pod_ta_eps_empty:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta L) \\ is_ta_eps_free (ta (reg_intersect R L))\"\n by (auto simp: reg_intersect_def prod_ta_def prod_epsRp_def prod_epsLp_def is_ta_eps_free_def)\n\nlemma is_fmap_funs_reg_eps_empty:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (fmap_funs_reg f R))\"\n by (auto simp: fmap_funs_reg_def fmap_funs_ta_def is_ta_eps_free_def)\n\nlemma is_collapse_automaton_reg_eps_empty:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta (collapse_automaton_reg R))\"\n by (auto simp: collapse_automaton_reg_def collapse_automaton_def is_ta_eps_free_def)\n\nlemma is_pair_automaton_reg_eps_empty:\n \"is_ta_eps_free (ta R) \\ is_ta_eps_free (ta L) \\ is_ta_eps_free (ta (pair_automaton_reg R L))\"\n by (auto simp: pair_automaton_reg_def pair_automaton_def is_ta_eps_free_def)\n\nlemma is_reflcl_automaton_eps_free:\n \"is_ta_eps_free A \\ is_ta_eps_free (reflcl_automaton (lift_sig_RR2 |`| \\) A)\"\n by (auto simp: is_ta_eps_free_def reflcl_automaton_def ta_union_def gen_reflcl_automaton_def Let_def fmap_states_ta_def)\n\nlemma is_GTT_to_RR2_root_eps_empty:\n \"is_gtt_eps_free \\ \\ is_ta_eps_free (GTT_to_RR2_root \\)\"\n by (auto simp: is_gtt_eps_free_def GTT_to_RR2_root_def pair_automaton_def is_ta_eps_free_def)\n\nlemma is_term_automata_eps_empty:\n \"is_ta_eps_free (ta (term_reg \\)) \\ True\"\n by (auto simp: is_ta_eps_free_def term_reg_def term_automaton_def)\n\nlemma is_ta_eps_free_eps_free_automata [simp]:\n \" is_ta_eps_free (eps_free_automata S R) \\ True\"\n by (auto simp: eps_free_automata_def is_ta_eps_free_def)\n\nlemma rr2_of_rr2_rel_impl_eps_free:\n shows \"\\ A. rr1_of_rr1_rel_impl \\ Rs r1 = Some A \\ is_ta_eps_free (ta A)\"\n \"\\ A. rr2_of_rr2_rel_impl \\ Rs r2 = Some A \\ is_ta_eps_free (ta A)\"\nproof (induct r1 and r2)\ncase R1Terms\n then show ?case\n by (auto simp: is_ta_eps_free_def term_automaton_def fmap_states_ta_def ta_simp_unfold)\nnext\n case (R1NF x)\n then show ?case\n by (auto simp: nf_reg_def nf_ta_def)\nnext\n case (R1Inf x)\n then show ?case\n by (auto simp: Inf_reg_impl_def Let_def Inf_reg_def Inf_automata_def is_ta_empty_trim_reg intro!: is_proj_ta_eps_empty)\nnext\n case (R1Proj n x2)\n then show ?case\n by (cases n) (auto intro!: is_proj_ta_eps_empty)\nnext\n case (R1Union x1 x2)\n then show ?case\n by (simp add: reg_union_def ta_union_def fmap_states_ta_def is_ta_eps_free_def relabel_reg_def relabel_ta_def)\nnext\n case (R1Inter x1 x2)\n then show ?case\n by (auto intro: is_pod_ta_eps_empty)\nnext\n case (R1Diff x1 x2)\n then show ?case\n by (auto simp: difference_reg_def Let_def complement_reg_def ps_reg_def ps_ta_def intro!: is_pod_ta_eps_empty)\nnext\n case (R2GTT_Rel x1 x2 x3)\n then show ?case \n by (cases x2; cases x3) (auto simp: GTT_to_RR2_root_reg_def ftrancl_eps_free_closures_def\n eps_free_nhole_mctxt_closure_reg_def eps_free_nhole_mctxt_reflcl_reg_def Let_def\n eps_free_mctxt_closure_reg_def reflcl_reg_def\n dest: gtt_of_gtt_rel_impl_is_gtt_eps_free\n intro!: is_GTT_to_RR2_root_eps_empty is_reflcl_automaton_eps_free)\nnext\n case (R2Diag x)\n then show ?case by (auto simp: fmap_funs_reg_def fmap_funs_ta_def is_ta_eps_free_def)\nnext\n case (R2Prod x1 x2)\n then show ?case by (auto intro: is_pair_automaton_reg_eps_empty)\nnext\n case (R2Inv x)\n then show ?case by (auto simp: fmap_funs_reg_def fmap_funs_ta_def is_ta_eps_free_def)\nnext\n case (R2Union x1 x2)\n then show ?case by (simp add: reg_union_def ta_union_def fmap_states_ta_def is_ta_eps_free_def relabel_reg_def relabel_ta_def)\nnext\n case (R2Inter x1 x2)\n then show ?case by (auto intro: is_pod_ta_eps_empty)\nnext\n case (R2Diff x1 x2)\n then show ?case by (auto simp: difference_reg_def Let_def complement_reg_def ps_reg_def ps_ta_def intro!: is_pod_ta_eps_empty)\nnext\n case (R2Comp x1 x2)\n then show ?case by (auto simp: is_term_automata_eps_empty rr2_compositon_def Let_def\n intro!: is_pod_ta_eps_empty is_fmap_funs_reg_eps_empty is_collapse_automaton_reg_eps_empty is_pair_automaton_reg_eps_empty)\nqed\n\nlemma rr_of_rr_rel_impl_complete:\n \"rr1_of_rr1_rel_impl \\ Rs r1 \\ None \\ rr1_of_rr1_rel \\ Rs r1 \\ None\"\n \"rr2_of_rr2_rel_impl \\ Rs r2 \\ None \\ rr2_of_rr2_rel \\ Rs r2 \\ None\"\nproof (induct r1 and r2)\n case (R1Proj n x2)\n then show ?case by (cases n) auto\nnext\n case (R2GTT_Rel x1 n p)\n then show ?case using gtt_of_gtt_rel_impl_gtt_of_gtt_rel[of \\ Rs]\n by (cases p; cases n) auto\nqed auto\n\nlemma \\_fmap_funs_reg [simp]:\n \"\\\\<^sub>r (fmap_funs_reg f \\) = \\\\<^sub>r \\\"\n by (auto simp: fmap_funs_reg_def)\n\nlemma ta_reachable_fmap_funs_reg [simp]:\n \"ta_reachable (ta (fmap_funs_reg f \\)) = ta_reachable (ta \\)\"\n by (auto simp: fmap_funs_reg_def)\n\nlemma collapse_reg_cong:\n \"\\\\<^sub>r \\ |\\| ta_reachable (ta \\) \\ \\\\<^sub>r \\ |\\| ta_reachable (ta \\) \\ \\ \\ = \\ \\ \\ \\ (collapse_automaton_reg \\) = \\ (collapse_automaton_reg \\)\"\n by (auto simp: collapse_automaton_reg_def \\_def collapse_automaton')\n\nlemma \\_fmap_funs_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ (fmap_funs_reg h \\) = \\ (fmap_funs_reg h \\)\"\n by (auto simp: fmap_funs_\\)\n\nlemma \\_pair_automaton_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ \\ = \\ \\ \\ \\ (pair_automaton_reg \\ \\) = \\ (pair_automaton_reg \\ \\)\"\n by (auto simp: pair_automaton')\n\nlemma \\_nhole_ctxt_closure_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (nhole_ctxt_closure_reg \\ \\) = \\ (nhole_ctxt_closure_reg \\ \\)\"\n by (auto simp: nhole_ctxtcl_lang)\n\nlemma \\_nhole_mctxt_closure_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (nhole_mctxt_closure_reg \\ \\) = \\ (nhole_mctxt_closure_reg \\ \\)\"\n by (auto simp: nhole_gmctxt_closure_lang)\n\nlemma \\_ctxt_closure_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (ctxt_closure_reg \\ \\) = \\ (ctxt_closure_reg \\ \\)\"\n by (auto simp: gctxt_closure_lang)\n\nlemma \\_parallel_closure_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (parallel_closure_reg \\ \\) = \\ (parallel_closure_reg \\ \\)\"\n by (auto simp: parallelcl_gmctxt_lang)\n\nlemma \\_mctxt_closure_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (mctxt_closure_reg \\ \\) = \\ (mctxt_closure_reg \\ \\)\"\n by (auto simp: gmctxt_closure_lang)\n\nlemma \\_nhole_mctxt_reflcl_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ = \\ \\ \\ (nhole_mctxt_reflcl_reg \\ \\) = \\ (nhole_mctxt_reflcl_reg \\ \\)\"\n unfolding nhole_mctxt_reflcl_lang\n by (intro arg_cong2[where ?f = \"(\\)\"] \\_nhole_mctxt_closure_reg_cong) auto\n\ndeclare equalityI[rule del]\ndeclare fsubsetI[rule del]\nlemma \\_proj_1_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ (proj_1_reg \\) = \\ (proj_1_reg \\)\"\n by (auto simp: proj_1_reg_def \\_trim intro!: collapse_reg_cong \\_fmap_funs_reg_cong)\n\nlemma \\_proj_2_reg_cong:\n \"\\ \\ = \\ \\ \\ \\ (proj_2_reg \\) = \\ (proj_2_reg \\)\"\n by (auto simp: proj_2_reg_def \\_trim intro!: collapse_reg_cong \\_fmap_funs_reg_cong)\n\nlemma rr2_of_rr2_rel_impl_sound:\n assumes \"\\R \\ set Rs. lv_trs (fset R) \\ ffunas_trs R |\\| \\\"\n shows \"\\ A B. rr1_of_rr1_rel_impl \\ Rs r1 = Some A \\ rr1_of_rr1_rel \\ Rs r1 = Some B \\ \\ A = \\ B\"\n \"\\ A B. rr2_of_rr2_rel_impl \\ Rs r2 = Some A \\ rr2_of_rr2_rel \\ Rs r2 = Some B \\ \\ A = \\ B\"\nproof (induct r1 and r2)\n case (R1Inf r)\n then obtain C D where inf: \"rr2_of_rr2_rel_impl \\ Rs r = Some C\" \"rr2_of_rr2_rel \\ Rs r = Some D\"\n \"\\ C = \\ D\" by auto\n have spec: \"RR2_spec C (eval_rr2_rel (fset \\) (map fset Rs) r)\" \"RR2_spec D (eval_rr2_rel (fset \\) (map fset Rs) r)\"\n using rr12_of_rr12_rel_correct(2)[OF assms, rule_format, OF inf(2)] inf(3)\n by (auto simp: RR2_spec_def)\n then have trim_spec: \"RR2_spec (trim_reg C) (eval_rr2_rel (fset \\) (map fset Rs) r)\"\n \"RR2_spec (trim_reg D) (eval_rr2_rel (fset \\) (map fset Rs) r)\"\n by (auto simp: RR2_spec_def \\_trim)\n let ?C = \"Inf_reg (trim_reg C) (Q_infty (ta (trim_reg C)) \\)\" let ?D = \"Inf_reg (trim_reg D) (Q_infty (ta (trim_reg D)) \\)\" \n from spec have *: \"\\ (Inf_reg_impl (trim_reg C)) = \\ ?C\"\n using eval_rr12_rel_sig(2)[of \"fset \\\" \"map fset Rs\" r]\n by (intro Inf_reg_impl_sound) (auto simp: RR2_spec_def \\_trim \\\\<^sub>G_equivalent_def)\n from spec have **: \"\\ (Inf_reg_impl (trim_reg D)) = \\ ?D\"\n using eval_rr12_rel_sig(2)[of \"fset \\\" \"map fset Rs\" r]\n by (intro Inf_reg_impl_sound) (auto simp: RR2_spec_def \\_trim \\\\<^sub>G_equivalent_def)\n then have C: \"RR2_spec ?C {(s, t) | s t. gpair s t \\ \\ ?C}\" and\n D: \"RR2_spec ?D {(s, t) | s t. gpair s t \\ \\ ?D}\"\n using subset_trans[OF Inf_automata_subseteq[of \"trim_reg C\" \\], of \"\\ C\"] spec\n using subset_trans[OF Inf_automata_subseteq[of \"trim_reg D\" \\], of \"\\ D\"]\n using eval_rr12_rel_sig(2)[of \"fset \\\" \"map fset Rs\" r]\n by (auto simp: RR2_spec_def \\_trim \\\\<^sub>G_equivalent_def intro!: equalityI fsubsetI)\n from * ** have r: \"\\ (proj_1_reg (Inf_reg_impl (trim_reg C))) = \\ (proj_1_reg ?C)\"\n \"\\ (proj_1_reg (Inf_reg_impl (trim_reg D))) = \\ (proj_1_reg ?D)\"\n by (auto intro: \\_proj_1_reg_cong)\n from \\_Inf_reg[OF trim_spec(1), of \\] \\_Inf_reg[OF trim_spec(2), of \\]\n show ?case using R1Inf eval_rr12_rel_sig(2)[of \"fset \\\" \"map fset Rs\" r]\n by (auto simp: liftO1_def r inf \\\\<^sub>G_equivalent_def \\_proj(1)[OF C] \\_proj(1)[OF D])\nnext\n case (R1Proj n x2)\n then show ?case by (cases n)\n (auto simp: liftO1_def \\_trim proj_1_reg_def proj_2_reg_def intro!: fsubsetI \\_fmap_funs_reg_cong collapse_reg_cong, (meson fin_mono trim_reg_reach)+)\nnext\n case (R2GTT_Rel g p n) note IH = this\n note ass = R2GTT_Rel\n consider (a) \"\\ A. gtt_of_gtt_rel_impl \\ Rs g = Some A\" | (b) \"gtt_of_gtt_rel_impl \\ Rs g = None\" by blast\n then show ?case\n proof cases\n case a then obtain C D where gtt [simp]: \"gtt_of_gtt_rel_impl \\ Rs g = Some C\"\n \"gtt_of_gtt_rel \\ Rs g = Some D\" using gtt_of_gtt_rel_impl_gtt_of_gtt_rel by blast\n from gtt_of_gtt_rel_impl_sound[OF this]\n have spec [simp]: \"agtt_lang C = agtt_lang D\" by auto\n have eps [simp]: \"is_ta_eps_free (ta (GTT_to_RR2_root_reg C))\"\n using gtt_of_gtt_rel_impl_is_gtt_eps_free[OF gtt(1)]\n by (auto simp: GTT_to_RR2_root_reg_def GTT_to_RR2_root_def pair_automaton_def is_ta_eps_free_def is_gtt_eps_free_def)\n have lang: \"\\ (GTT_to_RR2_root_reg C) = \\ (GTT_to_RR2_root_reg D)\"\n by (metis (no_types, lifting) GTT_to_RR2_root RR2_spec_def spec)\n show ?thesis\n proof (cases p)\n case PRoot\n then show ?thesis using IH spec lang\n by (cases n) (auto simp: \\_eps_free \\_reflcl_reg)\n next\n case PNonRoot\n then show ?thesis using IH\n by (cases n) (auto simp: \\_eps_free \\_eps_free_nhole_ctxt_closure_reg[OF eps]\n \\_eps_free_nhole_mctxt_reflcl_reg[OF eps] \\_eps_free_nhole_mctxt_closure_reg[OF eps]\n lang intro: \\_nhole_ctxt_closure_reg_cong \\_nhole_mctxt_reflcl_reg_cong \\_nhole_mctxt_closure_reg_cong)\n next\n case PAny\n then show ?thesis using IH\n by (cases n) (auto simp: \\_eps_free \\_eps_free_ctxt_closure_reg[OF eps]\n \\_eps_free_parallel_closure_reg[OF eps] \\_eps_free_mctxt_closure_reg[OF eps] lang\n intro!: \\_ctxt_closure_reg_cong \\_parallel_closure_reg_cong \\_mctxt_closure_reg_cong)\n qed\n next\n case b then show ?thesis using IH\n by (cases p; cases n) auto\n qed\nnext\n case (R2Comp x1 x2)\n then show ?case\n by (auto simp: liftO1_def rr2_compositon_def \\_trim \\_intersect Let_def\n intro!: \\_pair_automaton_reg_cong \\_fmap_funs_reg_cong collapse_reg_cong arg_cong2[where ?f = \"(\\)\"])\nqed (auto simp: liftO1_def \\_intersect \\_union \\_trim \\_difference_reg intro!: \\_fmap_funs_reg_cong \\_pair_automaton_reg_cong)\ndeclare equalityI[intro!]\ndeclare fsubsetI[intro!]\n\nlemma rr12_of_rr12_rel_impl_correct:\n assumes \"\\R \\ set Rs. lv_trs (fset R) \\ ffunas_trs R |\\| \\\"\n shows \"\\ta1. rr1_of_rr1_rel_impl \\ Rs r1 = Some ta1 \\ RR1_spec ta1 (eval_rr1_rel (fset \\) (map fset Rs) r1)\"\n \"\\ta2. rr2_of_rr2_rel_impl \\ Rs r2 = Some ta2 \\ RR2_spec ta2 (eval_rr2_rel (fset \\) (map fset Rs) r2)\"\n using rr12_of_rr12_rel_correct(1)[OF assms, of r1]\n using rr12_of_rr12_rel_correct(2)[OF assms, of r2]\n using rr2_of_rr2_rel_impl_sound(1)[OF assms, of r1]\n using rr2_of_rr2_rel_impl_sound(2)[OF assms, of r2]\n using rr_of_rr_rel_impl_complete(1)[of \\ Rs r1]\n using rr_of_rr_rel_impl_complete(2)[of \\ Rs r2]\n by (force simp: RR1_spec_def RR2_spec_def)+\n\nlemma check_inference_rrn_impl_correct:\n assumes sig: \"\\\\<^sub>G (fset \\) \\ {}\" and Rs: \"\\R \\ set Rs. lv_trs (fset R) \\ ffunas_trs R |\\| \\\"\n assumes infs: \"\\fvA. fvA \\ set infs \\ formula_spec (fset \\) (map fset Rs) (fst (snd fvA)) (snd (snd fvA)) (fst fvA)\"\n assumes inf: \"check_inference rr1_of_rr1_rel_impl rr2_of_rr2_rel_impl \\ Rs infs (l, step, fm, is) = Some (fm', vs, A')\"\n shows \"l = length infs \\ fm = fm' \\ formula_spec (fset \\) (map fset Rs) vs A' fm'\"\n using check_inference_correct[where ?rr1c = rr1_of_rr1_rel_impl and ?rr2c = rr2_of_rr2_rel_impl, OF assms]\n using rr12_of_rr12_rel_impl_correct[OF Rs]\n by auto\n\ndefinition check_sig_nempty where\n \"check_sig_nempty \\ = (0 |\\| snd |`| \\)\"\n\ndefinition check_trss where\n \"check_trss \\ \\ = list_all (\\ R. lv_trs (fset R) \\ funas_trs (fset R) \\ fset \\) \\\"\n\nlemma check_sig_nempty:\n \"check_sig_nempty \\ \\ \\\\<^sub>G (fset \\) \\ {}\" (is \"?Ls \\ ?Rs\")\nproof -\n {assume ?Ls then obtain a where \"(a, 0) |\\| \\\" by (auto simp: check_sig_nempty_def)\n then have \"GFun a [] \\ \\\\<^sub>G (fset \\)\"\n by (intro const) (simp add: fmember_iff_member_fset)\n then have ?Rs by blast}\n moreover\n {assume ?Rs then obtain s where \"s \\ \\\\<^sub>G (fset \\)\" by blast\n then obtain a where \"(a, 0) |\\| \\\" unfolding fmember_iff_member_fset\n by (induct s) (auto, force)\n then have ?Ls unfolding check_sig_nempty_def\n by (auto simp: fimage_iff fBex_def)}\n ultimately show ?thesis by blast\nqed\n\nlemma check_trss:\n \"check_trss \\ \\ \\ (\\ R \\ set \\. lv_trs (fset R) \\ ffunas_trs R |\\| \\)\"\n unfolding check_trss_def list_all_iff\n by (auto simp: fmember_iff_member_fset ffunas_trs.rep_eq less_eq_fset.rep_eq)\n\nfun check_inference_list :: \"('f \\ nat) fset \\ ('f :: {compare,linorder}, 'v) fin_trs list\n \\ (nat \\ ftrs inference \\ ftrs formula \\ info list) list\n \\ (ftrs formula \\ nat list \\ (nat, 'f option list) reg) list option\" where\n \"check_inference_list \\ Rs infs = do {\n guard (check_sig_nempty \\);\n guard (check_trss Rs \\);\n foldl (\\ tas inf. do {\n tas' \\ tas;\n r \\ check_inference rr1_of_rr1_rel_impl rr2_of_rr2_rel_impl \\ Rs tas' inf;\n Some (tas' @ [r])\n })\n (Some []) infs\n }\"\n\nlemma check_inference_list_correct:\n assumes \"check_inference_list \\ Rs infs = Some fvAs\"\n shows \"length infs = length fvAs \\ (\\ i < length fvAs. fst (snd (snd (infs ! i))) = fst (fvAs ! i)) \\\n (\\ i < length fvAs. formula_spec (fset \\) (map fset Rs) (fst (snd (fvAs ! i))) (snd (snd (fvAs ! i))) (fst (fvAs ! i)))\"\n using assms\nproof (induct infs arbitrary: fvAs rule: rev_induct)\n note [simp] = bind_eq_Some_conv guard_simps\n {case Nil\n then show ?case by auto\n next\n case (snoc a infs)\n have inv: \"\\\\<^sub>G (fset \\) \\ {}\" \"\\R\\set Rs. lv_trs (fset R) \\ ffunas_trs R |\\| \\\"\n using snoc(2) by (auto simp: check_sig_nempty check_trss)\n from snoc(2) obtain fvAs' l steps fm fm' is' vs A' where\n ch: \"check_inference_list \\ Rs infs = Some fvAs'\" \"a = (l, steps, fm, is')\"\n \"check_inference rr1_of_rr1_rel_impl rr2_of_rr2_rel_impl \\ Rs fvAs' (l, steps, fm, is') = Some (fm', vs, A')\" \"fvAs = fvAs' @ [(fm', vs, A')]\"\n by (auto simp del: check_inference.simps) (metis prod_cases4)\n from snoc(1)[OF ch(1)] have \"fvA \\ set fvAs' \\ formula_spec (fset \\) (map fset Rs) (fst (snd fvA)) (snd (snd fvA)) (fst fvA)\" for fvA\n by (auto dest: in_set_idx)\n from check_inference_rrn_impl_correct[OF inv this, of fvAs'] this\n show ?case using snoc(1)[OF ch(1)] ch\n by (auto simp del: check_inference.simps simp: nth_append)\n }\nqed\n\nfun check_certificate where\n \"check_certificate \\ Rs A fm (Certificate infs claim n) = do {\n guard (n < length infs);\n guard (A \\ claim = Nonempty);\n guard (fm = fst (snd (snd (infs ! n))));\n fvA \\ check_inference_list \\ Rs (take (Suc n) infs);\n (let E = reg_empty (snd (snd (last fvA))) in\n case claim of Empty \\ Some E\n | _ \\ Some (\\ E))\n }\"\n\ndefinition formula_unsatisfiable where\n \"formula_unsatisfiable \\ Rs fm \\ (formula_satisfiable \\ Rs fm = False)\"\n\ndefinition correct_certificate where\n \"correct_certificate \\ Rs claim infs n \\\n (claim = Empty \\ (formula_unsatisfiable (fset \\) (map fset Rs) (fst (snd (snd (infs ! n))))) \\\n claim = Nonempty \\ formula_satisfiable (fset \\) (map fset Rs) (fst (snd (snd (infs ! n)))))\"\n\nlemma check_certificate_sound:\n assumes \"check_certificate \\ Rs A fm (Certificate infs claim n) = Some B\"\n shows \"fm = fst (snd (snd (infs ! n)))\" \"A \\ claim = Nonempty\"\n using assms by (auto simp: bind_eq_Some_conv guard_simps)\n\nlemma check_certificate_correct:\n assumes \"check_certificate \\ Rs A fm (Certificate infs claim n) = Some B\"\n shows \"(B = True \\ correct_certificate \\ Rs claim infs n) \\\n (B = False \\ correct_certificate \\ Rs (case_claim Nonempty Empty claim) infs n)\"\nproof -\n note [simp] = bind_eq_Some_conv guard_simps\n from assms obtain fvAs where inf: \"check_inference_list \\ Rs (take (Suc n) infs) = Some fvAs\"\n by auto\n from assms have len: \"n < length infs\" by auto\n from check_inference_list_correct[OF inf] have\n inv: \"length fvAs = n + 1\"\n \"fst (snd (snd (infs ! n))) = fst (fvAs ! n)\"\n \"formula_spec (fset \\) (map fset Rs) (fst (snd (last fvAs))) (snd (snd (last fvAs))) (fst (last fvAs))\"\n using len last_conv_nth[of fvAs] by force+\n have nth: \"fst (last fvAs) = fst (fvAs ! n)\" using inv(1)\n using len last_conv_nth[of fvAs] by force\n note spec = formula_spec_empty[OF _ inv(3)] formula_spec_nt_empty_form_sat[OF _ inv(3)]\n consider (a) \"claim = Empty\" | (b) \"claim = Nonempty\" using claim.exhaust by blast\n then show ?thesis\n proof cases\n case a\n then have *: \"B = reg_empty (snd (snd (last fvAs)))\" using inv\n using assms len last_conv_nth[of fvAs]\n by (auto simp: inf simp del: check_inference_list.simps)\n show ?thesis using a inv spec unfolding *\n by (auto simp: formula_satisfiable_def nth correct_certificate_def formula_unsatisfiable_def simp del: reg_empty)\n next\n case b\n then have *: \"B \\ \\ (reg_empty (snd (snd (last fvAs))))\" using inv\n using assms len last_conv_nth[of fvAs]\n by (auto simp: inf simp del: check_inference_list.simps)\n show ?thesis using b inv spec unfolding *\n by (auto simp: formula_satisfiable_def nth formula_unsatisfiable_def correct_certificate_def simp del: reg_empty)\n qed\nqed\n\n\ndefinition check_certificate_string ::\n \"(integer list \\ fvar) fset \\\n ((integer list, integer list) Term.term \\ (integer list, integer list) Term.term) fset list \\\n bool \\ ftrs formula \\ ftrs certificate \\ bool option\"\n where \"check_certificate_string = check_certificate\"\n\n\n(***********************************)\nexport_code check_certificate_string Var Fun fset_of_list nat_of_integer Certificate\n R2GTT_Rel R2Eq R2Reflc R2Step R2StepEq R2Steps R2StepsEq R2StepsNF R2ParStep R2RootStep\n R2RootStepEq R2RootSteps R2RootStepsEq R2NonRootStep R2NonRootStepEq R2NonRootSteps\n R2NonRootStepsEq R2Meet R2Join\n ARoot GSteps PRoot ESingle Empty Size EDistribAndOr\n R1Terms R1Fin\n FRR1 FRestrict FTrue FFalse\n IRR1 Fwd in Haskell module_name FOR\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FO_Theory_Rewriting/FOR_Check_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.25773132209900823}} {"text": "theory Sep_Generic_Wp\nimports \n \"../lib/Sep_Algebra_Add\" \n \"../lib/Frame_Infer\"\n \"../lib/Monad\"\n \"HOL-Library.Extended_Nat\" (* TODO: This gives us Complex_Main. Too much for this theory! *)\n \"../basic/kernel/LLVM_Shallow\" (* TODO: Just used for acostC datatype. Move this datatype! *)\n \"../cost/Enat_Cost\"\nbegin\n\n\n (* TODO: Move, to Sep_Lift *) \n text \\Lifting Assertions over Product\\\n definition FST :: \"('a \\ bool) \\ 'a \\ 'b::zero \\ bool\" \n where \"FST P \\ \\(a,b). P a \\ b=0\"\n \n definition SND :: \"('b \\ bool) \\ 'a::zero \\ 'b \\ bool\" \n where \"SND P \\ \\(a,b). a=0 \\ P b\"\n \n \n lemma FST_project_frame: \"(FST P \\* F) (a, b) \\ (P ** (\\a. F (a,b))) a\"\n unfolding sep_conj_def\n by (force simp add: sep_algebra_simps FST_def) \n\n lemma SND_project_frame: \"(SND P \\* F) (a, b) \\ (P ** (\\b. F (a,b))) b\"\n unfolding sep_conj_def\n by (force simp add: sep_algebra_simps SND_def) \n \n \n lemma FST_conj_conv: \"(FST P ** FST Q) = FST (P**Q)\" \n unfolding sep_conj_def\n by (force simp add: sep_algebra_simps FST_def) \n\n lemma SND_conj_conv: \"(SND P ** SND Q) = SND (P**Q)\" \n unfolding sep_conj_def\n by (force simp add: sep_algebra_simps SND_def) \n \n \n lemma FST_apply[sep_algebra_simps]: \"FST P (a,b) \\ P a \\ b=0\"\n unfolding FST_def by auto\n \n lemma SND_apply[sep_algebra_simps]: \"SND P (a,b) \\ P b \\ a=0\"\n unfolding SND_def by auto\n\n\n\ndeclare [[coercion_enabled = false]]\nhide_const (open) Transcendental.pi\n\n\nsection \\General VCG Setup for Separation Logic\\\n\n(* TODO: Move to Library *)\n\nlocale generic_wp_defs =\n fixes wp :: \"'c \\ ('r \\ 's \\ bool) \\ 's \\ bool\"\nbegin\n definition \"htripleF \\ F P c Q \\ (\\s. (P**F) (\\ s) \\\n wp c (\\r s'. (Q r ** F) (\\ s')) s)\"\n\n definition \"htriple \\ P c Q \\ (\\F s. (P**F) (\\ s) \\\n wp c (\\r s'. (Q r ** F) (\\ s')) s)\"\n\n lemma htriple_as_F_eq: \"htriple \\ P c Q = (\\F. htripleF \\ F P c Q)\" \n unfolding htriple_def htripleF_def by blast\n \nend\n\n\nlocale generic_wp = generic_wp_defs wp\n for wp :: \"'c \\ ('r \\ 's \\ bool) \\ 's \\ bool\" +\n assumes wp_comm_inf: \"inf (wp c Q) (wp c Q') = wp c (inf Q Q')\"\nbegin\n\n lemma wp_comm_conj: \"wp c (\\r. Q r and Q' r) s \\ wp c Q s \\ wp c Q' s\"\n using wp_comm_inf[of c Q Q']\n unfolding inf_fun_def inf_bool_def by metis\n\n lemma wp_comm_conjI: \"\\ wp c Q s; wp c Q' s \\ \\ wp c (\\r s. Q r s \\ Q' r s) s\"\n using wp_comm_inf[of c Q Q']\n unfolding inf_fun_def inf_bool_def by metis\n\n\n lemma wp_mono: \"Q\\Q' \\ wp c Q \\ wp c Q'\"\n by (metis (mono_tags) antisym_conv le_inf_iff order_refl wp_comm_inf)\n\n lemma wp_monoI:\n assumes \"wp c Q s\"\n assumes \"\\r x. Q r x \\ Q' r x\"\n shows \"wp c Q' s\"\n using assms wp_mono[of Q Q' c] by auto\n \n lemma htripleI: \n assumes \"\\F s. (P**F) (\\ s) \\ wp c (\\r s'. (Q r ** F) (\\ s')) s\"\n shows \"htriple \\ P c Q\"\n using assms by (auto simp: htriple_def)\n\n lemma htripleFI: \n assumes \"\\s. (P**F) (\\ s) \\ wp c (\\r s'. (Q r ** F) (\\ s')) s\"\n shows \"htripleF \\ F P c Q\"\n using assms by (auto simp: htripleF_def)\n \n lemma htripleD: \n assumes \"htriple \\ P c Q\"\n assumes \"(P**F) (\\ s)\"\n shows \"wp c (\\r s'. (Q r ** F) (\\ s')) s\"\n using assms by (auto simp: htriple_def)\n \n lemma htriple_triv[simp, intro!]: \"htriple \\ sep_false c Q\"\n by (auto simp: htriple_def)\n \n lemma frame_rule: \"htriple \\ P c Q \\ htriple \\ (P ** F) c (\\r. Q r ** F)\"\n unfolding htriple_def\n by (fastforce)\n\n lemma cons_rule:\n assumes \"htriple \\ P c Q\"\n assumes \"\\s. P' s \\ P s\"\n assumes \"\\r s. Q r s \\ Q' r s\"\n shows \"htriple \\ P' c Q'\"\n unfolding htriple_def\n proof clarsimp\n fix F s\n assume \"(P' \\* F) (\\ s)\"\n with assms(2) have \"(P \\* F) (\\ s)\"\n using sep_conj_impl1 by blast\n with assms(1) have \"wp c (\\r s'. (Q r \\* F) (\\ s')) s\"\n unfolding htriple_def by auto\n thus \"wp c (\\r s'. (Q' r \\* F) (\\ s')) s\"\n apply (rule wp_monoI)\n using assms(3)\n using sep_conj_impl1 by blast\n qed\n\n lemma cons_post_rule:\n assumes \"htriple \\ P c Q\"\n assumes \"\\r s. Q r s \\ Q' r s\"\n shows \"htriple \\ P c Q'\"\n using cons_rule assms by blast\n \n \n lemma htriple_alt:\n \"htriple \\ P c Q \n = (\\p s f. p##f \\ \\ s = p + f \\ P p \\ wp c (\\r s'. \\p'. p'##f \\ \\ s'=p'+f \\ Q r p') s)\"\n proof (rule iffI, goal_cases)\n case 1\n show ?case\n using htripleD[OF 1, where F=\"EXACT x\" for x]\n by (auto simp: sep_conj_def)\n \n next\n case 2\n show ?case proof (rule htripleI)\n fix F s \n assume \"(P \\* F) (\\ s)\"\n then obtain p f where \"p##f\" \"P p\" \"F f\" \"\\ s = p+f\"\n by (blast elim: sep_conjE)\n with 2 have \"wp c (\\r s'. \\p'. p' ## f \\ \\ s' = p' + f \\ Q r p') s\" by blast\n then show \"wp c (\\r s'. (Q r \\* F) (\\ s')) s\"\n apply (rule wp_monoI)\n using \\F f\\ by (auto intro: sep_conjI)\n qed\n qed\n \n lemma htripleI': \n assumes \"\\p s f. \\ p##f; \\ s = p + f; P p\\ \\ wp c (\\r s'. \\p'. p'##f \\ \\ s'=p'+f \\ Q r p') s\"\n shows \"htriple \\ P c Q\"\n using assms by (auto simp: htriple_alt)\n\n lemma htripleD': \n assumes \"htriple \\ P c Q\"\n assumes \"p##f\" \"\\ s = p + f\" \"P p\"\n shows \"wp c (\\r s'. \\p'. p'##f \\ \\ s'=p'+f \\ Q r p') s\"\n using assms by (auto simp: htriple_alt)\n \n \n \n lemma htriple_extract_pre_pure: \n \"htriple \\ (\\\\**P) c Q \\ \\ \\ htriple \\ P c Q\" \n by (cases \\) (auto simp: sep_algebra_simps)\n \n (*\n lemma htriple_extract_pre_EXS: \n assumes \"\\x s. \\ x \\ P s \\ f x ## s\"\n shows \"htriple \\ (EXS x. \\\\ x ** EXACT (f x) ** P) c Q \\ (\\x. \\ x \\ htriple \\ (EXACT (f x) ** P) c Q)\"\n apply rule\n *) \n \n thm htripleD\n \n thm option.simps\n \n lemma sv_htripleD:\n assumes \"htriple \\ P c Q\"\n assumes \"(P**F) (\\ s)\"\n assumes \"\\r s. (Q r ** F) (\\ s) \\ Q' r s\"\n shows \"wp c Q' s\"\n using assms \n by (force simp: htriple_def intro: wp_monoI)\n \n lemma sv_htripleFD:\n assumes \"htripleF \\ F P c Q\"\n assumes \"(P**F) (\\ s)\"\n assumes \"\\r s. (Q r ** F) (\\ s) \\ Q' r s\"\n shows \"wp c Q' s\"\n using assms \n by (force simp: htripleF_def intro: wp_monoI)\n \n \n lemma htriple_conj_pure:\n fixes \\\n assumes \"htriple \\ P c Q\"\n assumes \"htriple \\ P c (\\r. \\\\ r ** sep_true)\"\n shows \"htriple \\ P c (\\r. \\\\ r ** Q r)\"\n proof (rule htripleI) \n fix F s\n assume \"(P**F) (\\ s)\"\n from wp_comm_conjI[OF assms[THEN htripleD,OF this]]\n show \"wp c (\\r s'. ((\\\\ r \\* Q r) \\* F) (\\ s')) s\"\n apply (rule wp_monoI)\n using and_pure_true unfolding entails_def by blast\n \n qed \n\n \n text \\With garbage collection\\\n abbreviation \"htriple_gc GC \\ P c Q \\ htriple \\ P c (\\r. Q r ** GC)\"\n \n lemma htriple_to_gc: \"\\ \\\\GC; htriple \\ P c Q \\ \\ htriple_gc GC \\ P c Q\"\n apply (erule cons_rule)\n apply simp\n by (metis abel_semigroup.commute entails_def sep.mult.abel_semigroup_axioms sep_conj_empty sep_globalise)\n \n \nend\n\n\n\nexperiment begin\n text \\Precondition defined by semantics relation:\n \\<^item> \\T c s\\ command terminates in state \\s\\\n \\<^item> \\R c s r s'\\ command yields result \\r\\ and new state \\s'\\\n \\\n \n definition \"my_wp T (R::_ \\ 's\\_\\'s\\bool) c Q s \\ T c s \\ (\\r s'. R c s r s' \\ Q r s')\"\n \n\n interpretation generic_wp \"my_wp T R\" \n apply unfold_locales\n unfolding my_wp_def\n by auto\n \n\nend\n\n\n\n\ndefinition STATE :: \"('s \\ 'a::sep_algebra) \\ ('a \\ bool) \\ 's \\ bool\" \n where \"STATE \\ P s \\ P (\\ s)\"\n\nlemma STATE_assn_cong[fri_extract_congs]: \"P\\P' \\ STATE \\ P s \\ STATE \\ P' s\" by simp\n \nlemma STATE_extract[vcg_normalize_simps]:\n \"STATE \\ (\\\\) h \\ \\ \\ STATE \\ \\ h\"\n \"STATE \\ (\\\\ ** P) h \\ \\ \\ STATE \\ P h\"\n \"STATE \\ (EXS x. Q x) h \\ (\\x. STATE \\ (Q x) h)\"\n \"STATE \\ (\\_. False) h \\ False\"\n \"STATE \\ ((\\_. False) ** P) h \\ False\"\n by (auto simp: STATE_def sep_algebra_simps pred_lift_extract_simps)\n \n\ndefinition POSTCOND :: \"('s \\ 'a::sep_algebra) \\ ('a \\ bool) \\ 's \\ bool\" \n where [vcg_tag_defs]: \"POSTCOND \\ \\ STATE \\\"\n \nlemma POSTCONDI:\n \"STATE \\ A h \\ POSTCOND \\ A h\"\n by (auto simp add: POSTCOND_def)\nlemma POSTCOND_cong[vcg_normalize_congs]: \"POSTCOND \\ A = POSTCOND \\ A\" ..\n\nlemma POSTCOND_triv_simps[vcg_normalize_simps]:\n \"POSTCOND \\ sep_true h\"\n \"\\POSTCOND \\ sep_false h\"\n unfolding POSTCOND_def STATE_def by auto\n \nlemma start_entailsE:\n assumes \"STATE \\ P h\"\n assumes \"ENTAILS P P'\"\n shows \"STATE \\ P' h\"\n using assms unfolding STATE_def ENTAILS_def entails_def\n by auto\n\ndeclaration \\\n K (Basic_VCG.add_xformer (@{thms POSTCONDI},@{binding postcond_xformer},\n fn ctxt => eresolve_tac ctxt @{thms start_entailsE}\n ))\n\\\n\n\nnamed_theorems htriple_vcg_intros\nnamed_theorems htriple_vcg_intro_congs\ndefinition [vcg_tag_defs]: \"DECOMP_HTRIPLE \\ \\ \\\"\nlemma DECOMP_HTRIPLEI: \"\\ \\ DECOMP_HTRIPLE \\\" unfolding vcg_tag_defs by simp\n\n \ncontext generic_wp begin\n thm frame_rule\n thm cons_rule \n \n lemma htriple_vcg_frame_erule[vcg_frame_erules]:\n assumes S: \"STATE \\ P' s\"\n assumes F: \"PRECOND (FRAME P' P F)\"\n assumes HT: \"htriple \\ P c Q\" \n assumes P: \"\\r s. STATE \\ (Q r ** F) s \\ PRECOND (EXTRACT (Q' r s))\"\n shows \"wp c Q' s\"\n proof -\n from S F have \"(P \\* F) (\\ s)\"\n unfolding vcg_tag_defs\n by (metis (no_types) FRAME_def entails_def STATE_def)\n with P show ?thesis\n unfolding vcg_tag_defs\n by (metis (no_types) STATE_def sv_htripleD[OF HT])\n \n qed\n\n lemma htripleF_vcg_frame_erule[vcg_frame_erules]:\n assumes S: \"STATE \\ P' s\"\n assumes F: \"PRECOND (FRAME P' P F)\"\n assumes HT: \"htripleF \\ F P c Q\" \n assumes P: \"\\r s. STATE \\ (Q r ** F) s \\ PRECOND (EXTRACT (Q' r s))\"\n shows \"wp c Q' s\"\n proof -\n from S F have \"(P \\* F) (\\ s)\"\n unfolding vcg_tag_defs\n by (metis (no_types) FRAME_def entails_def STATE_def)\n with P show ?thesis\n unfolding vcg_tag_defs\n by (metis (no_types) STATE_def sv_htripleFD[OF HT])\n \n qed\n \n \n \n lemma htriple_vcgI': \n assumes \"\\F s. STATE \\ (P**F) s \\ wp c (\\r. POSTCOND \\ (Q r ** F)) s\"\n shows \"htriple \\ P c Q\"\n apply (rule htripleI)\n using assms unfolding vcg_tag_defs STATE_def .\n \n lemma htriple_vcgI[htriple_vcg_intros]: \n assumes \"\\F s. STATE \\ (P**F) s \\ EXTRACT (wp c (\\r. POSTCOND \\ (Q r ** F)) s)\"\n shows \"htriple \\ P c Q\"\n apply (rule htripleI)\n using assms unfolding vcg_tag_defs STATE_def .\n\n lemma htripleF_vcgI[htriple_vcg_intros]: \n assumes \"\\s. STATE \\ (P**F) s \\ EXTRACT (wp c (\\r. POSTCOND \\ (Q r ** F)) s)\"\n shows \"htripleF \\ F P c Q\"\n apply (rule htripleFI)\n using assms unfolding vcg_tag_defs STATE_def .\n \n \n lemma htriple_decompI[vcg_decomp_rules]: \n \"DECOMP_HTRIPLE (htriple \\ P c Q) \\ htriple \\ P c Q\"\n \"DECOMP_HTRIPLE (htripleF \\ F P c Q) \\ htripleF \\ F P c Q\"\n unfolding vcg_tag_defs by auto\n\n lemma htriple_assn_cong[htriple_vcg_intro_congs]: \n \"P\\P' \\ Q\\Q' \\ htriple \\ P c Q \\ htriple \\ P' c Q'\" by simp\n\n lemma htripleF_assn_cong[htriple_vcg_intro_congs]: \n \"P\\P' \\ Q\\Q' \\ htripleF \\ F P c Q \\ htripleF \\ F P' c Q'\" by simp\n \n lemma htriple_ent_pre:\n \"P\\P' \\ htriple \\ P' c Q \\ htriple \\ P c Q\"\n unfolding entails_def\n apply (erule cons_rule) by blast+\n \n lemma htriple_ent_post:\n \"\\\\r. Q r \\ Q' r\\ \\ htriple \\ P c Q \\ htriple \\ P c Q'\"\n unfolding entails_def\n apply (erule cons_rule) by blast+\n \n lemma htriple_pure_preI: \"\\pure_part P \\ htriple \\ P c Q\\ \\ htriple \\ P c Q\" \n by (meson htriple_def pure_partI sep_conjE)\n \n \nend\n\n\ndeclaration \\\n K (Basic_VCG.add_xformer (@{thms DECOMP_HTRIPLEI},@{binding decomp_htriple_xformer},\n fn ctxt => \n (full_simp_tac (put_simpset HOL_basic_ss ctxt \n addsimps (Named_Theorems.get ctxt @{named_theorems vcg_tag_defs})\n |> fold Simplifier.add_cong (Named_Theorems.get ctxt @{named_theorems htriple_vcg_intro_congs})\n ))\n THEN' resolve_tac ctxt (Named_Theorems.get ctxt @{named_theorems htriple_vcg_intros})\n ))\n\\\n\n\n\nsection \\a General framework for abstract and concrete costs\\\n\ntext \\This locale fixes a type of concrete costs \\'cc\\ which is used in \\mres\\ and a type for\n abstract costs \\'ca\\ which should be used in the separation logic with (resource) credits. \n There is some invariant that has to hold between the credits currently available \"on the heap\"\n and the resources spent in the computation, \\I\\ captures that.\n Also it needs to be possible to deduct the resources used by the computation from the credits,\n this is captured by \\minus\\.\n \\\n\nlocale cost_framework =\n fixes\n I :: \"'cc::{monoid_add} \\ 'ca \\ bool\"\n and minus :: \"'ca \\ 'cc \\ 'ca\" \\ \\takes abstract credits, and returns the effect of consuming\n the concrete resources\\\nassumes minus_0[simp]: \"\\y. minus y 0 = y\"\n and I_0[simp,intro!]: \"I 0 cr\"\n and minus_minus_add: \"\\a b c. minus (minus a b) c = minus a (b + c)\"\n \\ \\TODO: maybe some of these are redundant\\\n and I1: \"\\a b c. I (a + b) c \\ I b (minus c a)\"\n and I2: \"\\a b c. I (a + b) c \\ I a c\"\n and I3: \"\\a b c. I a (minus c b) \\ I b c \\ I (b + a) c\"\nbegin\n\n\n definition wp :: \"('d, 'e, _, 'a, 'f) M \\ _ \\ _\" where\n \"wp m Q \\ \\(s,cr). mwp (run m s) bot bot bot (\\r c s. Q r (s,minus cr c) \\ I c cr)\"\n\n(*\n term \"\\ x \\ y \\ x \\ \\ y\" \n*)\n \n interpretation generic_wp wp\n apply unfold_locales\n unfolding wp_def fun_eq_iff inf_fun_def inf_bool_def mwp_def\n by (auto split: mres.split)\n\n\n lemma wp_return: \"wp (return x) Q s \\ Q x s\"\n by (auto simp: wp_def run_simps minus_0 I_0)\n\n lemma wp_fail: \"\\ wp (fail x) Q s\"\n by (auto simp: wp_def run_simps)\n\n lemma wp_fcheck: \"wp (fcheck e \\) Q s \\ \\ \\ Q () s\"\n by (auto simp: wp_def run_simps minus_0 I_0 split: if_splits)\n\n (* TODO: refactor that proof, should not need to unfold mwp_def at that stage *)\n lemma wp_bind: \"wp (m\\f) Q s = wp m (\\x. wp (f x) Q) s\"\n apply (auto simp: wp_def run_simps split: prod.splits)\n unfolding mwp_def apply (auto split: mres.splits simp add: minus_minus_add)\n subgoal\n by (metis I1)\n subgoal\n by (metis I2)\n subgoal\n by (metis I3)\n done\n \n lemma wp_consume: \"wp (consume c) Q (s,cr) \\ I c cr \\ Q () (s,minus cr c)\" \n unfolding wp_def mwp_def consume_def by (auto split: mres.split)\n \nend\n\n\n\ninterpretation nat: cost_framework \"\\(c::nat) (cr::nat). cr-c+c=cr\" \"(-)\"\n apply standard\n by auto\n\ninterpretation int: cost_framework \"\\(c::int) (cr::int). True\" \"(-)\"\n apply standard\n by auto\n\nlocale cost_framework2 = cost_framework I minus for I :: \"'cc::{monoid_add} \\ 'ca::{plus} \\ bool\" and minus +\n assumes I_left_mono: \"\\x c d. I x c \\ I x (c+d)\" \\ \\@{thm ordered_comm_monoid_add_class.add_increasing2}\\\n assumes minus_add_assoc2: \"\\x c d. I x c \\ minus (c + d) x = minus c x + d\" \\ \\@{thm ordered_cancel_comm_monoid_diff_class.diff_add_assoc2}\\\nbegin\n\n\nend\n\nlocale cost_framework3 = cost_framework2 I minus for I :: \"'cc::{monoid_add} \\ 'ca::{plus} \\ bool\" and minus +\n fixes lift :: \"'cc \\ 'ca\"\n assumes I_add1: \"\\c cr. I c (lift c + cr)\" \\ \\@{thm le_add1}\\\n assumes add_minus_cancel: \"\\c cr. minus (lift c + cr) c = cr\" \\ \\@{thm Extended_Nat.add_diff_cancel_enat}\\\nbegin\n\n\nend\n\n\n\n\n \nterm acostC \n \n\n\ncontext cost_framework begin \n\nabbreviation \"I_fun \\ (\\cc ca. \\x. I (the_acost cc x) (the_acost ca x))\"\nabbreviation \"minus_fun \\ (\\ca cc. acostC (\\x. minus (the_acost ca x) (the_acost cc x)))\"\n\n lemma fun_cost_framework: \"cost_framework I_fun minus_fun\"\n apply unfold_locales\n apply (simp_all add: zero_acost_def I_0 minus_0 minus_minus_add fun_eq_iff)\n subgoal for a b c by (cases a;cases b;cases c; auto)\n subgoal for a b c by (cases a;cases b;cases c; auto simp: I1)\n subgoal for a b c by (cases a;cases b;cases c; auto intro: I2)\n subgoal for a b c by (cases a;cases b;cases c; auto simp: I3)\n done\nend\n\ncontext cost_framework3\nbegin\n\n\nlemma fun_cost_framework2: \"cost_framework2 I_fun minus_fun\"\n unfolding cost_framework2_def\n apply safe apply (fact fun_cost_framework)\n apply unfold_locales\n subgoal for x c d by(cases x; cases c; cases d) (auto intro: I_left_mono)\n subgoal for x c d by(cases x; cases c; cases d) (auto intro: minus_add_assoc2)\n done\n\n\nabbreviation \"lift_fun \\ (\\cc. acostC (\\x. lift (the_acost cc x)))\"\n\nlemma fun_cost_framework3: \"cost_framework3 I_fun minus_fun lift_fun\"\n unfolding cost_framework3_def\n apply safe apply (fact fun_cost_framework2)\n apply unfold_locales\n subgoal for c cr by(cases c; cases cr) (auto intro: I_add1)\n subgoal for c cr by(cases c; cases cr) (auto intro: add_minus_cancel)\n done\n\n\nend\n\n\nsection \\Setup for mres-Monad\\\n\n lemma \"cr-c+c=(cr::nat) \\ cr\\c\" by auto\n lemma \"cr-c+c=(cr::int) \\ True\" by auto\n\n\n lemma enat_diff_diff: \"a - enat b - enat c = a - enat (b + c)\"\n apply(cases a) by auto\n lemma enat_aux1: \"c - enat (a + b) + enat (a + b) = c \\ c - enat a + enat a = c\"\n apply(cases c) by auto\n \n definition le_cost_ecost :: \"cost \\ ecost \\ bool\" \n where \"le_cost_ecost cc ca \\ \\x. enat (the_acost cc x) \\ (the_acost ca x)\"\n\n definition minus_ecost_cost :: \"ecost \\ cost \\ ecost\"\n where \"minus_ecost_cost ca cc \\ acostC (\\x. (the_acost ca x) - enat (the_acost cc x))\"\n \n interpretation cost_framework le_cost_ecost minus_ecost_cost\n unfolding le_cost_ecost_def minus_ecost_cost_def\n apply (rule cost_framework.fun_cost_framework)\n apply standard\n apply (auto simp flip: zero_enat_def)\n subgoal by (metis enat_diff_diff)\n subgoal\n by (smt add.commute add_diff_cancel_enat add_right_mono enat.distinct(1) enat_aux1 eq_iff le_iff_add linear of_nat_add of_nat_eq_enat)\n subgoal\n by (meson enat_ord_simps(1) le_add1 order_subst2)\n subgoal\n by (metis add_diff_cancel_enat add_left_mono enat.simps(3) le_iff_add plus_enat_simps(1))\n done\n\n \n (* \n term pi \n interpretation cost_framework \"\\(c::nat) (cr::enat). cr-c+c=cr\" \"(-)\"\n apply standard\n apply (auto simp: zero_enat_def)\n subgoal\n by (metis enat_diff_diff)\n subgoal\n by (metis enat_diff_diff add_diff_assoc_enat add_diff_cancel_left' enat_ord_simps(1)\n idiff_enat_enat le_add_same_cancel1 zero_le)\n subgoal\n by (metis enat_aux1)\n subgoal\n by (metis enat_diff_diff add.assoc add.commute plus_enat_simps(1))\n done\n *)\n\n (*\n lemma enat_nat_I_conv: \"cr - enat c + enat c = cr \\ cr \\ c\"\n by (cases cr; cases c; auto)\n *)\n\n (* Definition for presentation *)\n lemma natenat_alt: \"wp m Q = (\\(s, cr). mwp (run m s) bot bot bot (\\r c s. Q r (s, minus_ecost_cost cr c) \\ le_cost_ecost c cr))\" unfolding wp_def ..\n\n (* Definition for presentation in paper *)\n lemma wp_alt: \"wp m Q (s,cr::ecost) = (\\r (c::cost) s'. run m s = SUCC r c s' \\ Q r (s', minus_ecost_cost cr c) \\ le_cost_ecost c cr )\"\n unfolding wp_def mwp_def by (fastforce split: mres.splits)\n\n interpretation generic_wp wp \n apply unfold_locales \n unfolding wp_def fun_eq_iff inf_fun_def inf_bool_def mwp_def\n by (auto split: mres.split)\n\n declare wp_return[vcg_normalize_simps]\n\n declare wp_fail[vcg_normalize_simps]\n\n declare wp_fcheck[vcg_normalize_simps]\n\n declare wp_bind[vcg_normalize_simps]\n\n thm vcg_normalize_simps\n\n \n \n (* TODO: Move *)\n instantiation enat :: stronger_sep_algebra begin\n definition \"(_::enat) ## _ \\ True\"\n \n instance\n apply standard\n apply (simp_all add: sep_disj_enat_def)\n done\n \n end\n \n \n instantiation acost :: (type,stronger_sep_algebra) stronger_sep_algebra begin\n definition \"f1 ## f2 \\ (\\x. the_acost f1 x ## the_acost f2 x)\"\n (*definition [simp]: \"(f1 + f2) = acostC (\\x. the_acost f1 x + the_acost f2 x)\"\n definition [simp]: \"0 x \\ 0\"\n *)\n \n instance\n apply standard\n unfolding sep_disj_acost_def plus_acost_alt zero_acost_def\n apply (auto simp: sep_algebra_simps split: acost.splits)\n done \n \n end\n \n \n\ndefinition time_credits_assn :: \"ecost \\ (_ \\ ecost \\ bool)\" (\"$_\" [900] 900) where \"($c) \\ SND (EXACT c)\"\n\nterm \"a ** $c\"\nterm \"c ** $a\"\n\ndefinition \"GC \\ SND sep_true\"\n \nlemma GC_absorb[simp]: \"(GC ** GC) = GC\" by (auto simp: GC_def sep_algebra_simps SND_conj_conv)\n\nlemma entails_GC: \"$c \\ GC\" unfolding GC_def time_credits_assn_def\n by (auto simp: entails_def SND_def) (* TODO: Monotonicity of FST,SND as lemmas? *)\n\nlemma \"$0 = \\\" oops \n \nlemma empty_ent_GC: \"\\\\GC\" unfolding GC_def time_credits_assn_def\n by (auto simp: entails_def SND_def sep_algebra_simps) \n\n\nlemma dollar_aux_conv: \"($c) (aa, ba) = (aa=0 \\ ba=c)\"\n unfolding time_credits_assn_def EXACT_def SND_def\n by auto\n\n\nlemma \"F \\ GC ** G \\ $c ** F \\ GC ** G\"\n by (metis (no_types, lifting) GC_absorb conj_entails_mono entails_GC sep_conj_assoc)\n \nlemma htriple_to_GC: \"\\ htriple \\ P c Q \\ \\ htriple_gc GC \\ P c Q\"\n using htriple_to_gc[OF empty_ent_GC] .\n \nlemma time_credits_add: \"($A ** $B) = $(A+B)\" \n by (simp add: EXACT_split SND_conj_conv sep_disj_acost_def sep_disj_enat_def time_credits_assn_def) \n\n \n\n(* For presentation *)\nlemma \"($c) (s,c') \\ s=0 \\ c'=c\"\n unfolding time_credits_assn_def by (simp add: sep_algebra_simps SND_def) (* TODO: Lemmas for SND! *)\n \nlemma \"($c) a \\ a=(0,c)\" \n unfolding time_credits_assn_def by (cases a) (simp add: sep_algebra_simps SND_def)\n \ndefinition \"lift_\\_cost \\ \\ \\(s,c). (\\ s,c)\" \n\n\nlemma cost_ecost_minus_add_assoc2: \"le_cost_ecost x c \\ minus_ecost_cost (c + d) x = minus_ecost_cost c x + d\"\n apply(cases x; cases c; cases d) apply(auto simp: minus_ecost_cost_def le_cost_ecost_def)\n by (simp add: add.commute add_diff_assoc_enat)\n\nlemma cost_ecost_add_increasing2: \"le_cost_ecost x c \\ le_cost_ecost x (c + d)\" \n apply(cases x; cases c; cases d) apply (auto simp: le_cost_ecost_def) \n by (simp add: add_increasing2) \n\nlemma cost_ecost_add1: \"le_cost_ecost c (lift_acost c + cr')\" \n apply(cases cr') by (auto simp: le_cost_ecost_def lift_acost_def )\n\nlemma cost_ecost_add_minus_cancel: \"minus_ecost_cost (lift_acost c + cr') c = cr'\" \n apply(cases cr') by (auto simp: minus_ecost_cost_def lift_acost_def )\n \nlemma consume_rule_aux: \"htriple (lift_\\_cost \\) ($(lift_acost c)) (consume c) (\\_. \\)\" \n apply (rule htripleI)\n apply clarify\n apply (simp add: wp_consume time_credits_assn_def lift_\\_cost_def)\nproof (rule conjI)\n fix F s cr\n assume \"(SND (EXACT (lift_acost c)) \\* F) ((\\ s, cr))\"\n from this have \"(EXACT (lift_acost c) \\* (\\b. F (\\ s, b))) cr\" by (simp add: SND_project_frame)\n then obtain cr' where [simp]: \"lift_acost c ## cr'\" \"cr = lift_acost c + cr'\" and F: \"F (\\ s, cr')\"\n by (rule sep_conjE) (simp add: sep_algebra_simps)\n have \"0 \\ cr'\"\n by (simp add: sep_substate_def) \n show \"le_cost_ecost c cr\" by (simp add: cost_ecost_add1)\n \n show \"F (\\ s, minus_ecost_cost cr c)\" using F by (simp add: cost_ecost_add_minus_cancel)\nqed \n \nlemmas consume_rule = htriple_to_GC[OF consume_rule_aux]\n\n \nsection \\experiment: Hoare-triple without Time\\ \n \n \n \n \n \n \n \n \n \n \n \n \n text \\Weakest precondition without time\\\n definition \"wpn m Q s \\ mwp (run m s) bot bot bot (\\r c s'. c=0 \\ Q r s')\"\n \n lemma wpn_def': \"wpn m Q s = (\\r s'. run m s = SUCC r 0 s' \\ Q r s')\"\n unfolding wpn_def mwp_def\n by (auto split: mres.split)\n \n (* TODO: Move *) \n lemma le_cost_zero_conv[simp]: \"le_cost_ecost c 0 \\ c=0\"\n unfolding le_cost_ecost_def by (cases c; auto simp: zero_acost_def zero_enat_def)\n \n \n lemma wpn_alt: \"wpn m Q s = wp m (FST o Q) (s,0)\"\n unfolding wp_def wpn_def mwp_def\n by (auto split: mres.split simp: zero_enat_def FST_def)\n\n lemma wpn_alt': \"wpn m Q s = wp m (\\r (s,c). Q r s \\ c=0) (s,0)\"\n unfolding wp_def wpn_def mwp_def\n by (auto split: mres.split simp: zero_enat_def FST_def)\n \n \n interpretation notime: generic_wp wpn \n apply unfold_locales \n unfolding wpn_def fun_eq_iff inf_fun_def inf_bool_def mwp_def\n by (auto split: mres.split)\n\n \n lemma wpn_return[vcg_normalize_simps]: \"wpn (return x) Q s \\ Q x s\"\n by (auto simp: wpn_def run_simps)\n\n lemma wpn_fail[vcg_normalize_simps]: \"\\ wpn (fail x) Q s\"\n by (auto simp: wpn_def run_simps)\n\n lemma wpn_fcheck[vcg_normalize_simps]: \"wpn (fcheck e \\) Q s \\ \\ \\ Q () s\"\n by (auto simp: wpn_def run_simps split: if_splits)\n\n (* TODO: refactor that proof, should not need to unfold mwp_def at that stage *)\n (* TODO: Intuitively, want equality here: BUT, equality only holds if costs cannot be negative! *)\n lemma wpn_bind[vcg_decomp_rules]: \"wpn m (\\x. wpn (f x) Q) s \\ wpn (m\\f) Q s\"\n apply (auto simp: wpn_def[abs_def] run_simps split: prod.splits)\n unfolding mwp_def \n by (auto \n split: mres.splits \n simp add: minus_minus_add dest!: addcost_SUCC_D)\n \n (* \n lemma wpn_bind: \"wpn (m\\f) Q s = wpn m (\\x. wpn (f x) Q) s\"\n apply (auto simp: wpn_def run_simps split: prod.splits)\n unfolding mwp_def \n apply (auto \n split: mres.splits \n simp add: minus_minus_add dest!: addcost_SUCC_D)\n xxx. ctd here: need positive costs, \n otherwise negatove+positive can cancel out.\n \n *)\n \n \n lemma notime_return_rule: \"notime.htriple \\ P (return x) (\\r. \\(r=x)**P)\" for \\\n by vcg\n \n \n text \\Transfer of Hoare-Triples\\\n \n (* TODO: Move *)\n lemma wp_time_mono: \"wp m Q (s,c) \\ wp m (\\r (s',c'). \\cc'. c'=cc'+d \\ Q r (s',cc')) (s,c+d)\"\n unfolding wp_def mwp_def\n apply (auto simp add: algebra_simps sep_algebra_simps SND_def sep_conj_def split: mres.split)\n subgoal by (intro exI conjI; assumption?) (rule cost_ecost_minus_add_assoc2)\n subgoal by (rule cost_ecost_add_increasing2)\n done\n \n lemma notime_to_htriple:\n fixes c :: \"('a, 'b, cost, 'd, 'e) M\"\n assumes H: \"notime.htriple \\ P c Q\"\n shows \"htriple (lift_\\_cost \\) (FST P) c (FST o Q)\"\n unfolding lift_\\_cost_def\n apply (rule htripleI)\n apply clarify\n proof -\n fix F a and b :: ecost\n assume \"(FST P \\* F) (\\ a, b)\"\n hence \"(P ** (\\a. F (a,b))) (\\ a)\"\n by (simp add: sep_algebra_simps FST_project_frame)\n from notime.htripleD[OF H this] have \"wpn c (\\r s'. (Q r \\* (\\a. F (a, b))) (\\ s')) a\" .\n then have \"wp c (\\x (a, ba). (Q x \\* (\\a. F (a, b))) (\\ a) \\ ba = 0) (a, 0)\"\n unfolding wpn_alt FST_def comp_def by simp\n from wp_time_mono[OF this, of b] have \"wp c (\\r (s', c'). c' = b \\ (Q r \\* (\\a. F (a, b))) (\\ s')) (a, b)\"\n by simp\n then show \"wp c (\\r s'. ((FST \\ Q) r \\* F) (case s' of (s, x) \\ (\\ s, x))) (a, b)\" \n apply (rule wp_monoI)\n apply (auto simp: FST_project_frame)\n done\n qed \n\n lemma htriple_to_notime:\n assumes H: \"htriple (lift_\\_cost \\) (FST P) c (FST o Q)\"\n shows \"notime.htriple \\ P c Q\"\n apply (rule notime.htripleI)\n unfolding wpn_alt\n proof - \n fix F s\n assume A: \"(P \\* F) (\\ s)\"\n \n show \"wp c (FST \\ (\\r s'. (Q r \\* F) (\\ s'))) (s, 0)\"\n apply (rule wp_monoI)\n apply (rule htripleD[OF H, where F=\"FST F\"])\n unfolding lift_\\_cost_def\n apply (auto simp: FST_conj_conv sep_algebra_simps A)\n done\n qed \n \n lemma notime_htriple_eq: \"notime.htriple \\ P c Q = htriple (lift_\\_cost \\) (FST P) c (FST o Q)\"\n by (blast intro: notime_to_htriple htriple_to_notime)\n \n\n definition \"wlp c Q s \\ mwp (run c s) top top top (\\r c s. Q r s)\"\n lemma wlp_true[simp, intro!]:\n \"wlp c (\\_ _. True) s\"\n \"wlp c top s\"\n by (auto simp: wlp_def mwp_def split: mres.splits)\n \n lemma wlp_return[simp]: \"wlp (return x) Q s = Q x s\"\n by (auto simp: wlp_def run_simps)\n \n \nsection \\experiment: cost type for Space\\\n\n\ndatatype space_cost = Space_Cost (sca: nat) (scb: nat) (* highest point, how far below that mark at the moment *)\n\n\n(*\n\n mm_alloc n \\ \\(m,c). (max m (c+n),c+n)\n mm_free n \\ \\(m,c). assert(n\\c), (m,c-n)\n\n\n*)\n\n\nfun max_cost where \"max_cost (Space_Cost h _) = h\"\nfun curr_cost where \"curr_cost (Space_Cost h c) = int h - int c\"\n\ndefinition \"new_h m1 c1 m2 c2 \\ (max (int m1) (((int m1 - int c1)+int m2)))\"\ndefinition \"new_c m1 c1 m2 c2 \\ (new_h m1 c1 m2 c2 - ((int m1 - int c1)+(int m2 - int c2)))\"\n\nlemma new_h_nonneg: \"new_h m1 c1 m2 c2 \\ 0\"\n by (auto simp: new_h_def)\n\nlemma new_c_nonneg: \"new_c m1 c1 m2 c2 \\ 0\"\n by (auto simp: new_c_def new_h_def)\n\ninstantiation space_cost :: plus\nbegin\n lemma fixes m1 c1 m2 c2 :: nat\n shows \"(max (int m1) (((int m1 - int c1)+int m2))) - ((int m1 - int c1)+(int m2 - int c2)) \\ 0\"\n by auto\n\nlemma \"new_h m1 c1 m2 c2 - ((int m1 - int c1)+(int m2 - int c2)) \\ 0\"\n by (auto simp: new_h_def)\n\n fun plus_space_cost :: \"space_cost \\ space_cost \\ space_cost\" where\n \"plus_space_cost (Space_Cost m1 c1) (Space_Cost m2 c2) =\n Space_Cost (nat (new_h m1 c1 m2 c2)) (nat (new_c m1 c1 m2 c2))\"\n\n instance ..\nend\n\n\ninstantiation space_cost :: monoid_add\nbegin\n definition zero_space_cost :: space_cost where \"zero_space_cost = Space_Cost 0 0\"\n\n instance\n apply standard\n subgoal for a b c\n apply(cases a; cases b; cases c)\n apply (simp add: new_h_nonneg new_c_nonneg) apply safe\n subgoal for m1 c1 m2 c2 m3 c3\n apply(subst (2) new_h_def)\n apply(simp add: new_c_nonneg new_h_nonneg)\n apply(subst (4) new_h_def)\n apply(simp add: new_c_nonneg new_h_nonneg)\n by (auto simp: new_h_def new_c_def max.assoc)\n subgoal for m1 c1 m2 c2 m3 c3\n apply(subst (3) new_c_def)\n apply(simp add: new_c_nonneg new_h_nonneg)\n apply(subst (3) new_c_def)\n apply(subst (3) new_h_def)\n apply(simp add: new_c_nonneg new_h_nonneg)\n apply(subst (2) new_c_def)\n apply(simp add: new_c_nonneg new_h_nonneg)\n by (auto simp: new_h_def new_c_def max.assoc)\n done\n subgoal for a apply(cases a)\n subgoal for m c\n by (auto simp: new_h_def new_c_def zero_space_cost_def)\n done\n subgoal for a apply(cases a)\n subgoal for m c\n by (auto simp: new_h_def new_c_def zero_space_cost_def)\n done\n done\nend\n\n\ntext \\the Invariant denotes, that maximum space \\m\\ is at most the number of space_credits \\n\\\\\n\nfun space_I :: \"space_cost \\ nat \\ bool\" where\n \"space_I (Space_Cost m c) n \\ m\\n\"\n\nfun space_minus :: \"nat \\ space_cost \\ nat\" where\n \"space_minus n (Space_Cost m c) = n - m + c\"\n\\ \\if space_I holds, this is n - (m-c), i.e. credits minus newly occupied space\\\n\ninterpretation space: cost_framework \"space_I\" \"space_minus\"\n apply standard\n subgoal for a by(simp add: zero_space_cost_def)\n subgoal for cr apply (simp add: zero_space_cost_def) done\n subgoal for a b c apply(cases b; cases c) by (simp add: new_c_def new_h_def)\n subgoal for a b c apply(cases a; cases b) by (simp add: new_c_def new_h_def)\n subgoal for a b c apply(cases a; cases b) by (simp add: new_c_def new_h_def)\n subgoal for a b c apply(cases a; cases b) by (simp add: new_c_def new_h_def)\n done\n\n\nlemma space_minus_aux: \"space_I b 0 \\ Space_Cost 0 (space_minus 0 b) = b\"\n apply(cases b) by simp\n\n\ntext \\The test \\sm\\cr\\ makes sure that the maximum of space \\sm\\ used does not exceed \n the allowed space by the \"space-credits\" cr.\n When before executing \\m\\ there are \\cr\\ credits, after the execution there will be\n \\cr - (sm-c)\\, i.e. the credits before minus the number of consumed space,\n see @{const curr_cost}.\\\n\nlemma \"space.wp m Q (s,cr) = (\\r sm c s'. run m s = SUCC r (Space_Cost sm c) s'\n \\ Q r (s', cr - sm + c) \\ sm\\cr )\"\n unfolding space.wp_def mwp_def\n apply (auto split: mres.splits)\n subgoal for a b c apply(cases b)\n by simp\n done\n\n\n(* TODO: again clash with type class lifting with prod for sep_algebra!\ninstantiation prod :: (monoid_add,monoid_add) monoid_add\nbegin\n\nend\n\nlemma\n assumes \"cost_framework I1 minus1\"\n and \"cost_framework I2 minus2\"\n shows \"cost_framework (\\(a,b) (c,d). I1 a c \\ I2 b d) (\\(a,b) (c,d). (minus1 a c, minus2 b d))\"\n*)\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/vcg/Sep_Generic_Wp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.25773132209900823}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory SimpStrategy\nimports Main\nbegin\n\ntext \\\nSupport for defining alternative simplifier strategies for some parts of terms\nor some premises of rewrite rules. The \"name\" parameter to the simp_strategy\nconstant is used to identify which simplification strategy should be used on\nthis term. Note that, although names have type nat, it is safe for them to all\nbe defined as 0. The important thing is that the simplifier doesn't know they're\nequal.\n\\\n\ndefinition\n simp_strategy :: \"nat \\ ('a :: {}) \\ 'a\"\nwhere\n \"simp_strategy name x \\ x\"\n\ntext \\\nThis congruence rule forbids the simplifier from simplifying the arguments of\nsimp_strategy normally.\n\\\n\nlemma simp_strategy_cong[cong]:\n \"simp_strategy name x = simp_strategy name x\"\n by simp\n\ntext \\\nThis strategy, or rather lack thereof, can be used to forbid simplification.\n\\\n\ndefinition\n NoSimp :: nat\nwhere \"NoSimp = 0\"\n\ntext \\\nThis strategy indicates that a boolean subterm should be simplified only by\nusing explicit assumptions of the simpset.\n\\\n\ndefinition\n ByAssum :: nat\nwhere \"ByAssum = 0\"\n\nlemma Eq_TrueI_ByAssum:\n \"P \\ simp_strategy ByAssum P \\ True\"\n by (simp add: simp_strategy_def)\n\nsimproc_setup simp_strategy_ByAssum (\"simp_strategy ByAssum b\") =\n \\K (fn ss => fn ct => let\n val b = Thm.dest_arg ct\n val t = Thm.instantiate ([],[(((\"P\",0),@{typ bool}), b)])\n @{thm Eq_TrueI_ByAssum}\n val prems = Raw_Simplifier.prems_of ss\n in get_first (try (fn p => p RS t)) prems end)\\\n\nlemma ByAssum:\n \"simp_strategy ByAssum P \\ P\"\n by (simp add: simp_strategy_def)\n\nlemma simp_ByAssum_test:\n \"P \\ simp_strategy ByAssum P\"\n by simp\n\ntext \\\nGeneric framework for instantiating a simproc which simplifies within a\nsimp_strategy with a given simpset.\n\nThe boolean determines whether simp_strategy Name True should be rewritten\nto True.\n\\\n\nlemma simp_strategy_Eq_True:\n \"simp_strategy name True \\ True\"\n by (simp add: simp_strategy_def)\n\nML \\\nfun simp_strategy_True_conv ct = case Thm.term_of ct of\n (Const (@{const_name simp_strategy}, _) $ _ $ @{term True})\n => Thm.instantiate ([], [(((\"name\",0), @{typ nat}), Thm.dest_arg1 ct)])\n @{thm simp_strategy_Eq_True}\n | _ => Conv.all_conv ct\n\nfun new_simp_strategy thy (name : term) ss rewr_True =\nlet\n val ctxt = Proof_Context.init_global thy;\n val ss = Simplifier.make_simproc ctxt (\"simp_strategy_\" ^ fst (dest_Const name))\n {lhss = [@{term simp_strategy} $ name $ @{term x}],\n proc = (fn _ => fn ctxt' => fn ct =>\n ct\n |> (Conv.arg_conv (Simplifier.rewrite (put_simpset ss ctxt'))\n then_conv (if rewr_True then simp_strategy_True_conv\n else Conv.all_conv))\n |> (fn c => if Thm.is_reflexive c then NONE else SOME c))\n }\nin\n ss\nend\n\\\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/SimpStrategy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.25762128574129756}} {"text": "(* Title: JinjaThreads/J/WellType.thy\n Author: Tobias Nipkow, Andreas Lochbihler\n*)\n\nsection \\Well-typedness of Jinja expressions\\\n\ntheory WellType\nimports\n Expr\n State\n \"../Common/ExternalCallWF\"\n \"../Common/WellForm\"\n \"../Common/SemiType\"\nbegin\n\ndeclare Listn.lesub_list_impl_same_size[simp del]\ndeclare listE_length [simp del]\n\ntype_synonym \n env = \"vname \\ ty\"\n\ninductive\n WT :: \"(ty \\ ty \\ ty \\ bool) \\ 'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_,_ \\ _ :: _\" [51,51,51,51]50)\n and WTs :: \"(ty \\ ty \\ ty \\ bool) \\ 'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" \n (\"_,_,_ \\ _ [::] _\" [51,51,51,51]50)\n for is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n and P :: \"'addr J_prog\"\nwhere\n\n WTNew:\n \"is_class P C \\\n is_lub,P,E \\ new C :: Class C\"\n\n| WTNewArray:\n \"\\ is_lub,P,E \\ e :: Integer; is_type P (T\\\\) \\ \\\n is_lub,P,E \\ newA T\\e\\ :: T\\\\\"\n\n| WTCast:\n \"\\ is_lub,P,E \\ e :: T; P \\ U \\ T \\ P \\ T \\ U; is_type P U \\\n \\ is_lub,P,E \\ Cast U e :: U\"\n\n| WTInstanceOf:\n \"\\ is_lub,P,E \\ e :: T; P \\ U \\ T \\ P \\ T \\ U; is_type P U; is_refT U \\\n \\ is_lub,P,E \\ e instanceof U :: Boolean\"\n\n| WTVal:\n \"typeof v = Some T \\\n is_lub,P,E \\ Val v :: T\"\n\n| WTVar:\n \"E V = Some T \\\n is_lub,P,E \\ Var V :: T\"\n\n| WTBinOp:\n \"\\ is_lub,P,E \\ e1 :: T1; is_lub,P,E \\ e2 :: T2; P \\ T1\\bop\\T2 :: T \\\n \\ is_lub,P,E \\ e1\\bop\\e2 :: T\"\n\n| WTLAss:\n \"\\ E V = Some T; is_lub,P,E \\ e :: T'; P \\ T' \\ T; V \\ this \\\n \\ is_lub,P,E \\ V:=e :: Void\"\n\n| WTAAcc:\n \"\\ is_lub,P,E \\ a :: T\\\\; is_lub,P,E \\ i :: Integer \\\n \\ is_lub,P,E \\ a\\i\\ :: T\"\n\n| WTAAss:\n \"\\ is_lub,P,E \\ a :: T\\\\; is_lub,P,E \\ i :: Integer; is_lub,P,E \\ e :: T'; P \\ T' \\ T \\\n \\ is_lub,P,E \\ a\\i\\ := e :: Void\"\n\n| WTALength:\n \"is_lub,P,E \\ a :: T\\\\ \\ is_lub,P,E \\ a\\length :: Integer\"\n\n| WTFAcc:\n \"\\ is_lub,P,E \\ e :: U; class_type_of' U = \\C\\; P \\ C sees F:T (fm) in D \\\n \\ is_lub,P,E \\ e\\F{D} :: T\"\n\n| WTFAss:\n \"\\ is_lub,P,E \\ e\\<^sub>1 :: U; class_type_of' U = \\C\\; P \\ C sees F:T (fm) in D; is_lub,P,E \\ e\\<^sub>2 :: T'; P \\ T' \\ T \\\n \\ is_lub,P,E \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 :: Void\"\n\n| WTCAS:\n \"\\ is_lub,P,E \\ e1 :: U; class_type_of' U = \\C\\; P \\ C sees F:T (fm) in D; volatile fm; \n is_lub,P,E \\ e2 :: T'; P \\ T' \\ T; is_lub,P,E \\ e3 :: T''; P \\ T'' \\ T \\\n \\ is_lub,P,E \\ e1\\compareAndSwap(D\\F, e2, e3) :: Boolean\"\n\n| WTCall:\n \"\\ is_lub,P,E \\ e :: U; class_type_of' U = \\C\\; P \\ C sees M:Ts \\ T = meth in D;\n is_lub,P,E \\ es [::] Ts'; P \\ Ts' [\\] Ts \\\n \\ is_lub,P,E \\ e\\M(es) :: T\"\n\n| WTBlock:\n \"\\ is_type P T; is_lub,P,E(V \\ T) \\ e :: T'; case vo of None \\ True | \\v\\ \\ \\T'. typeof v = \\T'\\ \\ P \\ T' \\ T \\\n \\ is_lub,P,E \\ {V:T=vo; e} :: T'\"\n\n| WTSynchronized:\n \"\\ is_lub,P,E \\ o' :: T; is_refT T; T \\ NT; is_lub,P,E \\ e :: T' \\\n \\ is_lub,P,E \\ sync(o') e :: T'\"\n\n\\ \\Note that insync is not statically typable.\\\n\n| WTSeq:\n \"\\ is_lub,P,E \\ e\\<^sub>1::T\\<^sub>1; is_lub,P,E \\ e\\<^sub>2::T\\<^sub>2 \\\n \\ is_lub,P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n\n| WTCond:\n \"\\ is_lub,P,E \\ e :: Boolean; is_lub,P,E \\ e\\<^sub>1::T\\<^sub>1; is_lub,P,E \\ e\\<^sub>2::T\\<^sub>2; \\ lub(T\\<^sub>1, T\\<^sub>2) = T \\\n \\ is_lub,P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile:\n \"\\ is_lub,P,E \\ e :: Boolean; is_lub,P,E \\ c::T \\\n \\ is_lub,P,E \\ while (e) c :: Void\"\n\n| WTThrow:\n \"\\ is_lub,P,E \\ e :: Class C; P \\ C \\\\<^sup>* Throwable \\ \\ \n is_lub,P,E \\ throw e :: Void\"\n\n| WTTry:\n \"\\ is_lub,P,E \\ e\\<^sub>1 :: T; is_lub,P,E(V \\ Class C) \\ e\\<^sub>2 :: T; P \\ C \\\\<^sup>* Throwable \\\n \\ is_lub,P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n\n| WTNil: \"is_lub,P,E \\ [] [::] []\"\n\n| WTCons: \"\\ is_lub,P,E \\ e :: T; is_lub,P,E \\ es [::] Ts \\ \\ is_lub,P,E \\ e#es [::] T#Ts\"\n\nabbreviation WT' :: \"'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_ \\ _ :: _\" [51,51,51] 50)\nwhere \"WT' P \\ WT (TypeRel.is_lub P) P\"\n\nabbreviation WTs' :: \"'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" (\"_,_ \\ _ [::] _\" [51,51,51] 50)\nwhere \"WTs' P \\ WTs (TypeRel.is_lub P) P\"\n\ndeclare WT_WTs.intros[intro!]\n\ninductive_simps WTs_iffs [iff]:\n \"is_lub',P,E \\ [] [::] Ts\"\n \"is_lub',P,E \\ e#es [::] T#Ts\"\n \"is_lub',P,E \\ e#es [::] Ts\"\n\nlemma WTs_conv_list_all2: \n fixes is_lub \n shows \"is_lub,P,E \\ es [::] Ts = list_all2 (WT is_lub P E) es Ts\"\nby(induct es arbitrary: Ts)(auto simp add: list_all2_Cons1 elim: WTs.cases)\n\nlemma WTs_append [iff]: \"\\is_lub Ts. (is_lub,P,E \\ es\\<^sub>1 @ es\\<^sub>2 [::] Ts) =\n (\\Ts\\<^sub>1 Ts\\<^sub>2. Ts = Ts\\<^sub>1 @ Ts\\<^sub>2 \\ is_lub,P,E \\ es\\<^sub>1 [::] Ts\\<^sub>1 \\ is_lub,P,E \\ es\\<^sub>2[::]Ts\\<^sub>2)\"\nby(auto simp add: WTs_conv_list_all2 list_all2_append1 dest: list_all2_lengthD[symmetric])\n\ninductive_simps WT_iffs [iff]:\n \"is_lub',P,E \\ Val v :: T\"\n \"is_lub',P,E \\ Var V :: T\"\n \"is_lub',P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n \"is_lub',P,E \\ {V:T=vo; e} :: T'\"\n\ninductive_cases WT_elim_cases[elim!]:\n \"is_lub',P,E \\ V :=e :: T\"\n \"is_lub',P,E \\ sync(o') e :: T\"\n \"is_lub',P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ while (e) c :: T\"\n \"is_lub',P,E \\ throw e :: T\"\n \"is_lub',P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ Cast D e :: T\"\n \"is_lub',P,E \\ e instanceof U :: T\"\n \"is_lub',P,E \\ a\\F{D} :: T\"\n \"is_lub',P,E \\ a\\F{D} := v :: T\"\n \"is_lub',P,E \\ e\\compareAndSwap(D\\F, e', e'') :: T\"\n \"is_lub',P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ new C :: T\"\n \"is_lub',P,E \\ newA T\\e\\ :: T'\"\n \"is_lub',P,E \\ a\\i\\ := e :: T\"\n \"is_lub',P,E \\ a\\i\\ :: T\"\n \"is_lub',P,E \\ a\\length :: T\"\n \"is_lub',P,E \\ e\\M(ps) :: T\"\n \"is_lub',P,E \\ sync(o') e :: T\"\n \"is_lub',P,E \\ insync(a) e :: T\"\n\nlemma fixes is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes is_lub_unique: \"\\T1 T2 T3 T4. \\ \\ lub(T1, T2) = T3; \\ lub(T1, T2) = T4 \\ \\ T3 = T4\"\n shows WT_unique: \"\\ is_lub,P,E \\ e :: T; is_lub,P,E \\ e :: T' \\ \\ T = T'\"\n and WTs_unique: \"\\ is_lub,P,E \\ es [::] Ts; is_lub,P,E \\ es [::] Ts' \\ \\ Ts = Ts'\"\napply(induct arbitrary: T' and Ts' rule: WT_WTs.inducts)\napply blast\napply blast\napply blast\napply blast\napply fastforce\napply fastforce\napply(fastforce dest: WT_binop_fun)\napply fastforce\napply fastforce\napply fastforce\napply fastforce\napply(fastforce dest: sees_field_fun)\napply(fastforce dest: sees_field_fun)\napply blast\napply(fastforce dest: sees_method_fun)\napply fastforce\napply fastforce\napply fastforce\napply(blast dest: is_lub_unique)\napply fastforce\napply fastforce\napply blast\napply fastforce\napply fastforce\ndone\n\nlemma fixes is_lub\n shows wt_env_mono: \"is_lub,P,E \\ e :: T \\ (\\E'. E \\\\<^sub>m E' \\ is_lub,P,E' \\ e :: T)\"\n and wts_env_mono: \"is_lub,P,E \\ es [::] Ts \\ (\\E'. E \\\\<^sub>m E' \\ is_lub,P,E' \\ es [::] Ts)\"\napply(induct rule: WT_WTs.inducts)\napply(simp add: WTNew)\napply(simp add: WTNewArray)\napply(fastforce simp: WTCast)\napply(fastforce simp: WTInstanceOf)\napply(fastforce simp: WTVal)\napply(simp add: WTVar map_le_def dom_def)\napply(fastforce simp: WTBinOp)\napply(force simp:map_le_def)\napply(simp add: WTAAcc)\napply(simp add: WTAAss, fastforce)\napply(simp add: WTALength, fastforce)\napply(fastforce simp: WTFAcc)\napply(fastforce simp: WTFAss del:WT_WTs.intros WT_elim_cases)\napply blast\napply(fastforce)\napply(fastforce simp: map_le_def WTBlock)\napply(fastforce simp: WTSynchronized)\napply(fastforce simp: WTSeq)\napply(fastforce simp: WTCond)\napply(fastforce simp: WTWhile)\napply(fastforce simp: WTThrow)\napply(fastforce simp: WTTry map_le_def dom_def)\napply(fastforce)+\ndone\n\nlemma fixes is_lub\n shows WT_fv: \"is_lub,P,E \\ e :: T \\ fv e \\ dom E\"\n and WT_fvs: \"is_lub,P,E \\ es [::] Ts \\ fvs es \\ dom E\"\napply(induct rule:WT_WTs.inducts)\napply(simp_all del: fun_upd_apply)\napply fast+\ndone\n\nlemma fixes is_lub\n shows WT_expr_locks: \"is_lub,P,E \\ e :: T \\ expr_locks e = (\\ad. 0)\"\n and WTs_expr_lockss: \"is_lub,P,E \\ es [::] Ts \\ expr_lockss es = (\\ad. 0)\"\nby(induct rule: WT_WTs.inducts)(auto)\n\nlemma\n fixes is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes is_lub_is_type: \"\\T1 T2 T3. \\ \\ lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ is_type P T3\"\n and wf: \"wf_prog wf_md P\"\n shows WT_is_type: \"\\ is_lub,P,E \\ e :: T; ran E \\ types P \\ \\ is_type P T\"\n and WTs_is_type: \"\\ is_lub,P,E \\ es [::] Ts; ran E \\ types P \\ \\ set Ts \\ types P\"\napply(induct rule: WT_WTs.inducts)\napply simp\napply simp\napply simp\napply simp\napply (simp add:typeof_lit_is_type)\napply (fastforce intro:nth_mem simp add: ran_def)\napply(simp add: WT_binop_is_type)\napply(simp)\napply(simp del: is_type_array add: is_type_ArrayD)\napply(simp)\napply(simp)\napply(simp add:sees_field_is_type[OF _ wf])\napply(simp)\napply simp\napply(fastforce dest: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)\napply(fastforce simp add: ran_def split: if_split_asm)\napply(simp add: is_class_Object[OF wf])\napply(simp)\napply(simp)\napply(fastforce intro: is_lub_is_type)\napply(simp)\napply(simp)\napply simp\napply simp\napply simp\ndone\n\nlemma\n fixes is_lub1 :: \"ty \\ ty \\ ty \\ bool\" (\"\\1 lub'((_,/ _)') = _\" [51,51,51] 50)\n and is_lub2 :: \"ty \\ ty \\ ty \\ bool\" (\"\\2 lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes wf: \"wf_prog wf_md P\"\n and is_lub1_into_is_lub2: \"\\T1 T2 T3. \\ \\1 lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ \\2 lub(T1, T2) = T3\"\n and is_lub2_is_type: \"\\T1 T2 T3. \\ \\2 lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ is_type P T3\"\n shows WT_change_is_lub: \"\\ is_lub1,P,E \\ e :: T; ran E \\ types P \\ \\ is_lub2,P,E \\ e :: T\"\n and WTs_change_is_lub: \"\\ is_lub1,P,E \\ es [::] Ts; ran E \\ types P \\ \\ is_lub2,P,E \\ es [::] Ts\"\nproof(induct rule: WT_WTs.inducts)\n case (WTBlock U E V e' T vo)\n from \\is_type P U\\ \\ran E \\ types P\\\n have \"ran (E(V \\ U)) \\ types P\" by(auto simp add: ran_def)\n hence \"is_lub2,P,E(V \\ U) \\ e' :: T\" by(rule WTBlock)\n with \\is_type P U\\ show ?case\n using \\case vo of None \\ True | \\v\\ \\ \\T'. typeof v = \\T'\\ \\ P \\ T' \\ U\\ by auto\nnext\n case (WTCond E e e1 T1 e2 T2 T)\n from \\ran E \\ types P\\ have \"is_lub2,P,E \\ e :: Boolean\" \"is_lub2,P,E \\ e1 :: T1\" \"is_lub2,P,E \\ e2 :: T2\"\n by(rule WTCond)+\n moreover from is_lub2_is_type wf \\is_lub2,P,E \\ e1 :: T1\\ \\ran E \\ types P\\\n have \"is_type P T1\" by(rule WT_is_type)\n from is_lub2_is_type wf \\is_lub2,P,E \\ e2 :: T2\\ \\ran E \\ types P\\\n have \"is_type P T2\" by(rule WT_is_type)\n with \\\\1 lub(T1, T2) = T\\ \\is_type P T1\\\n have \"\\2 lub(T1, T2) = T\" by(rule is_lub1_into_is_lub2)\n ultimately show ?case ..\nnext\n case (WTTry E e1 T V C e2)\n from \\ran E \\ types P\\ have \"is_lub2,P,E \\ e1 :: T\" by(rule WTTry)\n moreover from \\P \\ C \\\\<^sup>* Throwable\\ have \"is_class P C\"\n by(rule is_class_sub_Throwable[OF wf])\n with \\ran E \\ types P\\ have \"ran (E(V \\ Class C)) \\ types P\"\n by(auto simp add: ran_def)\n hence \"is_lub2,P,E(V \\ Class C) \\ e2 :: T\" by(rule WTTry)\n ultimately show ?case using \\P \\ C \\\\<^sup>* Throwable\\ ..\nqed auto\n\nsubsection \\Code generator setup\\\n\nlemma WTBlock_code:\n \"\\is_lub. \\ is_type P T; is_lub,P,E(V \\ T) \\ e :: T'; \n case vo of None \\ True | \\v\\ \\ case typeof v of None \\ False | Some T' \\ P \\ T' \\ T \\\n \\ is_lub,P,E \\ {V:T=vo; e} :: T'\"\nby(auto)\n\nlemmas [code_pred_intro] =\n WTNew WTNewArray WTCast WTInstanceOf WTVal WTVar WTBinOp WTLAss WTAAcc WTAAss WTALength WTFAcc WTFAss WTCAS WTCall \ndeclare \n WTBlock_code [code_pred_intro WTBlock']\nlemmas [code_pred_intro] =\n WTSynchronized WTSeq WTCond WTWhile WTThrow WTTry\n WTNil WTCons\n\ncode_pred\n (modes:\n (i \\ i \\ o \\ bool) \\ i \\ i \\ i \\ o \\ bool, \n (i \\ i \\ o \\ bool) \\ i \\ i \\ i \\ i \\ bool)\n [detect_switches, skip_proof]\n WT\nproof -\n case WT\n from WT.prems show thesis\n proof cases\n case (WTBlock T V e vo)\n thus thesis using WT.WTBlock'[OF refl refl refl, of V T vo e] by(auto)\n qed(assumption|erule WT.that[OF refl refl refl]|rule refl)+\nnext\n case WTs\n from WTs.prems WTs.that show thesis by cases blast+\nqed\n\ninductive is_lub_sup :: \"'m prog \\ ty \\ ty \\ ty \\ bool\"\nfor P T1 T2 T3\nwhere\n \"sup P T1 T2 = OK T3 \\ is_lub_sup P T1 T2 T3\"\n\ncode_pred\n (modes: i \\ i \\ i \\ o \\ bool, i \\ i \\ i \\ i \\ bool)\n is_lub_sup\n.\n\ndefinition WT_code :: \"'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_ \\ _ ::'' _\" [51,51,51] 50)\nwhere \"WT_code P \\ WT (is_lub_sup P) P\"\n\ndefinition WTs_code :: \"'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" (\"_,_ \\ _ [::''] _\" [51,51,51] 50)\nwhere \"WTs_code P \\ WTs (is_lub_sup P) P\"\n\nlemma assumes wf: \"wf_prog wf_md P\"\n shows WT_code_into_WT: \n \"\\ P,E \\ e ::' T; ran E \\ types P \\ \\ P,E \\ e :: T\"\n\n and WTs_code_into_WTs:\n \"\\ P,E \\ es [::'] Ts; ran E \\ types P \\ \\ P,E \\ es [::] Ts\"\nproof -\n assume ran: \"ran E \\ types P\"\n { assume wt: \"P,E \\ e ::' T\"\n show \"P,E \\ e :: T\"\n by(rule WT_change_is_lub[OF wf _ _ wt[unfolded WT_code_def] ran])(blast elim!: is_lub_sup.cases intro: sup_is_lubI[OF wf] is_lub_is_type[OF wf])+ }\n { assume wts: \"P,E \\ es [::'] Ts\"\n show \"P,E \\ es [::] Ts\"\n by(rule WTs_change_is_lub[OF wf _ _ wts[unfolded WTs_code_def] ran])(blast elim!: is_lub_sup.cases intro: sup_is_lubI[OF wf] is_lub_is_type[OF wf])+ }\nqed\n\nlemma assumes wf: \"wf_prog wf_md P\"\n shows WT_into_WT_code: \n \"\\ P,E \\ e :: T; ran E \\ types P \\ \\ P,E \\ e ::' T\"\n\n and WT_into_WTs_code_OK:\n \"\\ P,E \\ es [::] Ts; ran E \\ types P \\ \\ P,E \\ es [::'] Ts\"\nproof -\n assume ran: \"ran E \\ types P\"\n { assume wt: \"P,E \\ e :: T\"\n show \"P,E \\ e ::' T\" unfolding WT_code_def\n by(rule WT_change_is_lub[OF wf _ _ wt ran])(blast intro!: is_lub_sup.intros intro: is_lub_subD[OF wf] sup_is_type[OF wf] elim!: is_lub_sup.cases)+ }\n { assume wts: \"P,E \\ es [::] Ts\"\n show \"P,E \\ es [::'] Ts\" unfolding WTs_code_def\n by(rule WTs_change_is_lub[OF wf _ _ wts ran])(blast intro!: is_lub_sup.intros intro: is_lub_subD[OF wf] sup_is_type[OF wf] elim!: is_lub_sup.cases)+ }\nqed\n\ntheorem WT_eq_WT_code:\n assumes \"wf_prog wf_md P\"\n and \"ran E \\ types P\"\n shows \"P,E \\ e :: T \\ P,E \\ e ::' T\"\nusing assms by(blast intro: WT_code_into_WT WT_into_WT_code)\n\ncode_pred\n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n [inductify]\n WT_code \n.\n\ncode_pred\n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n [inductify]\n WTs_code \n.\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/J/WellType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2575686968300846}} {"text": "theory sas_analysis\nimports \"sas\" \"DFP.DFP_law_DFtick\"\nbegin\n\n\n\ndeclare inj_def [simp add]\ndeclare Let_def [simp add]\n\ndeclare Rec_prefix_def [simp add]\ndeclare Send_prefix_def [simp add]\n\nlemma rawPosition_Int_adjust_eq_empty [simp]: \"{| rawPosition i |}\\<^sub>c \\ {| adjust i |}\\<^sub>c = {}\"\n by (auto)\n\n\nlemma rawPosition_Int_servoCmd_eq_empty [simp]: \"{| rawPosition i |}\\<^sub>c \\ {| servoCmd i |}\\<^sub>c = {}\"\n by (auto)\n\n\nlemma adjust_DONT_Renames_rawPosition [simp]: \"a \\ {| rawPosition i |}\\<^sub>c \\\n {x::Events \\ {| rawPosition i |}\\<^sub>c.\n (x, a) \\ ehsvOutput i<==adjust i} = { a }\"\n apply (simp add: Renaming2_channel_def Renaming2_channel_fun_def fun_to_rel_def Image_def)\n by (auto)\n\n\nlemma adjust_DONT_Renames_servoCmd [simp]: \"a \\ {| servoCmd i |}\\<^sub>c \\\n {x::Events \\ {| servoCmd i |}\\<^sub>c.\n (x, a) \\ ehsvOutput i<==adjust i} = { a }\"\n apply (simp add: Renaming2_channel_def Renaming2_channel_fun_def fun_to_rel_def Image_def)\n by (auto)\n\n\nlemma unwind_EHSV : \"$EHSV i [[ ehsvOutput i <== adjust i ]] =F\n ? p:{| rawPosition(i) |}\\<^sub>c -> ? e:{| servoCmd(i) |}\\<^sub>c -> ? f:{ adjust(i) ((inv (rawPosition i) p) - disp (dOmega (inv (servoCmd i) e))) } -> $EHSV i [[ ehsvOutput i <== adjust i ]]\"\n apply (cspF_unwind_left, simp_all, cspF_ren_left)\n by (rule cspF_decompo, simp, cspF_step_left, cspF_step_left, cspF_ren_left)+\n\n\nlemma unwind_Raw : \"$Raw i p0 =F ? p:{ rawPosition(i) p0 } -> (? p:{ rawPosition(i) p0 } -> $Raw i p0\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) ))\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) )\"\n apply (cspF_unwind_left, cspF_hsf_left)\n apply (rule cspF_decompo, simp)\n apply (rule cspF_decompo, simp)\n by (cspF_unwind_left)\n\n\nlemma feedbackPos_DONT_Renames_rawPosition [simp]: \"a \\ {| rawPosition i |}\\<^sub>c \\\n {x::Events \\ {| rawPosition i |}\\<^sub>c.\n (x, a) \\ lvdtOutput i<==feedbackPos i} = { a }\"\n apply (simp add: Renaming2_channel_def Renaming2_channel_fun_def fun_to_rel_def Image_def)\n by (auto)\n\n\nlemma rawPosition_Renaming_coreMoved_simp [simp]: \"a \\ {| rawPosition i |}\\<^sub>c \\\n {x::Events \\ {| coreMoved i |}\\<^sub>c.\n (x, a) \\ coreMoved i<==rawPosition i} = { coreMoved i (inv (rawPosition i) a) }\"\n apply (simp add: Renaming2_channel_def Renaming2_channel_fun_def fun_to_rel_def Image_def)\n by (auto)\n\nlemma unwind_LVDT : \"$LVDT i [[coreMoved i<==rawPosition i]] [[lvdtOutput i<==feedbackPos i]] =F\n ? p:{| rawPosition(i) |}\\<^sub>c \\ ? f:{ feedbackPos i (inv (rawPosition i) p) } \\ $LVDT i [[ coreMoved i <== rawPosition i ]] [[ lvdtOutput i <== feedbackPos i ]]\"\n apply (cspF_unwind_left, cspF_step_left, cspF_step_left)\n apply (rule cspF_decompo, simp, erule rangeE)\n by (cspF_step_left)+\n\n\n\nlemma unwind_PCU : \"PCU i p0 =F (\n ? p:{| rawPosition(i) |}\\<^sub>c -> ? e:{| servoCmd(i) |}\\<^sub>c -> ? f:{ adjust(i) ((inv (rawPosition i) p) - disp (dOmega (inv (servoCmd i) e))) } -> $EHSV i [[ ehsvOutput i <== adjust i ]]\n |[ {| rawPosition i, adjust i |}\\<^sub>c ]|\n ( ? p:{ rawPosition(i) p0 } -> (? p:{ rawPosition(i) p0 } -> $Raw i p0\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) ))\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) ))\n )\n |[ {| rawPosition i |}\\<^sub>c ]|\n ( ? p:{| rawPosition(i) |}\\<^sub>c \\ (? f:{ feedbackPos(i) (modulate (senseVoltage (inv (rawPosition i) p))) } -> ($LVDT i [[ coreMoved i <== rawPosition i ]] [[ lvdtOutput i <== feedbackPos i ]])) )\"\n\n apply (simp add: PCU_def)\n apply (rule cspF_decompo, simp)\n apply (rule cspF_decompo, simp)\n apply (rule unwind_EHSV)\n apply (rule unwind_Raw)\n apply (rule unwind_LVDT)\n done\n\n\nlemma unwind_ACE : \"$ACE i =F (? p:{| controlCmd(i) |}\\<^sub>c -> ? f:{| feedbackPos(i) |}\\<^sub>c ->\n ? x:{ servoCmd(i) (saturate((inv (controlCmd i) p) - (inv (feedbackPos i) f))) } -> $ACE i)\"\n by (cspF_auto)\n\n\n\n\n\n\nlemma unwind_ACE_PCU :\n \"ACE_PCU i p0 =F\n (? p:{| controlCmd(i) |}\\<^sub>c -> ? f:{| feedbackPos(i) |}\\<^sub>c ->\n ? x:{ servoCmd(i) (saturate((inv (controlCmd i) p) - (inv (feedbackPos i) f))) } -> $ACE i)\n |[ {| servoCmd i, feedbackPos i |}\\<^sub>c ]|\n ((? p:{| rawPosition(i) |}\\<^sub>c -> ? e:{| servoCmd(i) |}\\<^sub>c -> ? f:{ adjust(i) ((inv (rawPosition i) p) - disp (dOmega (inv (servoCmd i) e))) } -> $EHSV i [[ ehsvOutput i <== adjust i ]]\n |[ {| rawPosition i, adjust i |}\\<^sub>c ]|\n ( ? p:{ rawPosition(i) p0 } -> (? p:{ rawPosition(i) p0 } -> $Raw i p0\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) ))\n [+] (? adj:{| adjust(i) |}\\<^sub>c \\ $Raw i (saturate (p0 + (inv (adjust i) adj))) ))\n )\n |[ {| rawPosition i |}\\<^sub>c ]|\n ( ? p:{| rawPosition(i) |}\\<^sub>c \\ (? f:{ feedbackPos(i) (modulate (senseVoltage (inv (rawPosition i) p))) } -> ($LVDT i [[ coreMoved i <== rawPosition i ]] [[ lvdtOutput i <== feedbackPos i ]])) ))\"\n\n apply (simp add: ACE_PCU_def)\n apply (rule cspF_rw_left, rule cspF_decompo, simp, rule unwind_ACE)\n apply (rule unwind_PCU)\n by (cspF_hsf)\n\n\n\n\n\n\n\n\ndefinition PCUadj\nwhere \"PCUadj i aa adj ==\n ? x:{adjust i adj} \n -> ( ($EHSV i [[ehsvOutput i<==adjust i]] \n |[{| rawPosition i, adjust i |}\\<^sub>c]|\n $Raw i (saturate (aa + inv (adjust i) x)) \n |[{| rawPosition i |}\\<^sub>c]|\n $LVDT i [[coreMoved i<==rawPosition i]] [[lvdtOutput i<==feedbackPos i]]))\"\n\n\ndefinition ACE_PCUadj\nwhere \"ACE_PCUadj i aa adj == $ACE i |[{| servoCmd i, feedbackPos i |}\\<^sub>c]| PCUadj i aa adj\"\n\n\n\nlemma unwind_ACE_PCUadj :\n \"$ACE i |[{| servoCmd i, feedbackPos i |}\\<^sub>c]| PCUadj i aa adj =F \n (? p:{| controlCmd(i) |}\\<^sub>c -> ? f:{| feedbackPos(i) |}\\<^sub>c ->\n ? x:{ servoCmd(i) (saturate((inv (controlCmd i) p) - (inv (feedbackPos i) f))) } -> $ACE i)\n |[{| servoCmd i, feedbackPos i |}\\<^sub>c]|\n ? x:{adjust i adj} -> (($EHSV i [[ehsvOutput i<==adjust i]] \n |[{| rawPosition i, adjust i |}\\<^sub>c]|\n $Raw i (saturate (aa + inv (adjust i) x)) \n |[{| rawPosition i |}\\<^sub>c]|\n $LVDT i [[coreMoved i<==rawPosition i]] [[lvdtOutput i<==feedbackPos i]]))\"\n \n apply (rule cspF_decompo, simp)\n apply (rule unwind_ACE)\n apply (simp add: PCUadj_def)\n done\n\n\n\ndeclare inj_def [simp del]\ndeclare Let_def [simp del]\n\ndeclare Rec_prefix_def [simp del]\ndeclare Send_prefix_def [simp del]\n\n\nend", "meta": {"author": "jbjj", "repo": "jbjj.github.io", "sha": "1b7e124895eb11189cc92b3cc3f7ad2565d3ed3c", "save_path": "github-repos/isabelle/jbjj-jbjj.github.io", "path": "github-repos/isabelle/jbjj-jbjj.github.io/jbjj.github.io-1b7e124895eb11189cc92b3cc3f7ad2565d3ed3c/publications/sbmf2022/sas_analysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878696277514, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.25753538999531306}} {"text": "theory Review_RAut_NCPC_PAut\nimports \"../Observation_Setup\" Review_Value_Setup \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\Confidentiality from users who are not the review's author, a PC member, or an author of the paper\\\n\ntext \\We verify the following property:\n\n\\ \\\\\nA group of users UIDs learn nothing\nabout the various updates to the N'th review of a paper PID\n(save for the inexistence of any updates) unless/until\n\\begin{itemize}\n\\item a user in UIDs is the review's author, or\n\\item a user in UIDs becomes a PC member in the paper's conference\nhaving no conflict with that paper and the\nconference moves to the discussion phase, or\n\\item a user in UIDs become a PC member in the paper's conference\nor an author of the paper and the conference moves to the notification phase\n\\end{itemize}\n\\\n\ntype_synonym \"value\" = rcontent\n\nfun f :: \"(state,act,out) trans \\ value\" where\n\"f (Trans _ (Uact (uReview cid uid p pid n rc)) _ _) = rc\"\n|\n\"f (Trans _ (UUact (uuReview cid uid p pid n rc)) _ _) = rc\"\n\nfun T :: \"(state,act,out) trans \\ bool\" where\n\"T (Trans _ _ ou s') =\n (\\ uid \\ UIDs.\n isREVNth s' uid PID N\n \\\n (\\ cid. PID \\\\ paperIDs s' cid \\ isPC s' cid uid \\ pref s' uid PID \\ Conflict \\ phase s' cid \\ disPH)\n \\\n (\\ cid. PID \\\\ paperIDs s' cid \\ isPC s' cid uid \\ phase s' cid \\ notifPH)\n \\\n isAUT s' uid PID \\ (\\ cid. PID \\\\ paperIDs s' cid \\ phase s' cid \\ notifPH)\n )\"\n\ndeclare T.simps [simp del]\n\ndefinition B :: \"value list \\ value list \\ bool\" where\n\"B vl vl1 \\ vl \\ []\"\n\ninterpretation BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nlemma reachNT_non_isPC_isChair:\nassumes \"reachNT s\" and \"uid \\ UIDs\"\nshows\n\"\\ isRevNth s cid uid PID N \\\n (PID \\\\ paperIDs s cid \\ isPC s cid uid \\\n (pref s uid PID = Conflict \\ phase s cid < disPH) \\ phase s cid < notifPH) \\\n (PID \\\\ paperIDs s cid \\ isChair s cid uid \\\n (pref s uid PID = Conflict \\ phase s cid < disPH) \\ phase s cid < notifPH) \\\n (isAut s cid uid PID \\ phase s cid < notifPH)\"\nusing assms apply induct\napply (auto simp: istate_def)[]\napply(intro conjI)\n subgoal for trn apply(cases trn, simp add: T.simps reachNT_reach isAUT_def isREVNth_def)[] .\n subgoal for trn apply(cases trn, simp add: T.simps reachNT_reach isAUT_def isREVNth_def)[]\n apply (metis not_less) .\n subgoal for trn apply(cases trn, simp add: T.simps reachNT_reach isAUT_def isREVNth_def)[]\n apply (metis isChair_isPC not_less reachNT_reach reach_PairI) .\n subgoal for trn apply(cases trn, simp add: T.simps reachNT_reach isAUT_def isREVNth_def)[]\n apply (metis isAut_paperIDs not_less reachNT_reach reach_PairI) .\ndone\n\nlemma T_\\_\\:\nassumes 1: \"reachNT s\" and 2: \"step s a = (ou,s')\" \"\\ (Trans s a ou s')\"\nshows \"\\ \\ (Trans s a ou s')\"\nusing reachNT_non_isPC_isChair[OF 1] 2 unfolding T.simps \\_def2\napply (auto simp: u_defs uu_defs isRev_imp_isRevNth_getReviewIndex)\nby (metis isRev_imp_isRevNth_getReviewIndex)+\n\n(* major *) lemma eqExcPID_N_step_out:\nassumes s's1': \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sT: \"reachNT s\" and s1: \"reach s1\"\nand PID: \"PID \\\\ paperIDs s cid\"\nand UIDs: \"userOfA a \\ UIDs\"\nshows \"ou = ou1\"\nproof-\n note s = reachNT_reach[OF sT]\n note Inv = reachNT_non_isPC_isChair[OF sT UIDs]\n note eqs = eqExcPID_N_imp[OF s's1']\n note eqs' = eqExcPID_N_imp1[OF s's1']\n note eqss = eqExcPID_N_imp2[OF s's1'] eqExcPID_N_imp3'[OF s s's1']\n\n note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_N_def eeqExcPID_N_def eqExcD\n note * = step step1 eqs eqs' eqss s s1 UIDs PID paperIDs_equals[OF s] Inv\n\n show ?thesis\n proof (cases a)\n case (Cact x1)\n with * show ?thesis by (cases x1; auto)\n next\n case (Uact x2)\n with * show ?thesis by (cases x2; auto)\n next\n case (UUact x3)\n with * show ?thesis by (cases x3; auto)\n next\n case (Ract x4)\n with * show ?thesis\n proof (cases x4)\n case (rMyReview x81 x82 x83 x84)\n with Ract * show ?thesis\n by clarsimp (metis getRevRole_Some_Rev_isRevNth)\n next\n case (rReviews x91 x92 x93 x94)\n with Ract * show ?thesis\n by clarsimp (metis not_less)\n next\n case (rFinalReviews x121 x122 x123 x124)\n with Ract * show ?thesis\n by clarsimp (metis not_less)\n qed auto\n next\n case (Lact x5)\n with * show ?thesis by (cases x5; auto; presburger)\n qed\nqed\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < revPH) \\ s = s1 \\ B vl vl1\"\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\\n \\ cid.\n PID \\\\ paperIDs s cid \\ phase s cid = revPH \\\n \\ (\\ uid. isREVNth s uid PID N) \\\n s = s1 \\ B vl vl1\"\n\n(* Note: In the similar property from discussion confidentiality we have only 3 non-exit phases\ninstead of 4, not having a phase like \\2: this is because there the agent affecting the documents (chairs),\nmust have been assigned in a previous phase; here reviewers are assigned in the same phase\nin which they can edit. *)\n\ndefinition \\3 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\3 s vl s1 vl1 \\\n \\ cid uid. PID \\\\ paperIDs s cid \\ phase s cid = revPH \\ isREVNth s uid PID N \\ eqExcPID_N s s1\"\n\ndefinition \\4 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\4 s vl s1 vl1 \\\n \\ cid. PID \\\\ paperIDs s cid \\ phase s cid > revPH \\ eqExcPID_N s s1 \\ vl1 = []\"\n\ndefinition \\e :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\e s vl s1 vl1 \\\n vl \\ [] \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid > revPH \\ \\ (\\ uid. isREVNth s uid PID N))\"\n\nlemma istate_\\1:\nassumes B: \"B vl vl1\"\nshows \"\\1 istate vl istate vl1\"\nusing B unfolding \\1_def B_def istate_def by auto\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1,\\2,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\2 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\1 s vl s1 vl1\"\n hence rs: \"reach s\" and ss1: \"s1 = s\" and vl: \"vl \\ []\"\n and PID_ph: \"\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < revPH\"\n using reachNT_reach unfolding \\1_def B_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have \\: \"\\ \\ ?trn\"\n apply(cases a)\n subgoal by simp\n subgoal for x2 apply(cases x2) using step PID_ph by (fastforce simp: u_defs)+\n subgoal for x3 apply(cases x3) using step PID_ph by (fastforce simp: uu_defs)+\n by simp_all\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\ by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1\"\n proof(cases \"\\ cid. PID \\\\ paperIDs s cid\")\n case False note PID = False\n have PID_ph': \"\\ cid. PID \\\\ paperIDs s' cid \\ phase s' cid < revPH\" using PID step rs\n apply(cases a)\n subgoal for _ x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for _ x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for _ x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using PID_ph' vl by auto\n thus ?thesis by auto\n next\n case True\n then obtain CID where PID: \"PID \\\\ paperIDs s CID\" by auto\n hence ph: \"phase s CID < revPH\" using PID_ph by auto\n have PID': \"PID \\\\ paperIDs s' CID\" by (metis PID paperIDs_mono step)\n show ?thesis\n proof(cases \"phase s' CID < revPH\")\n case True note ph' = True\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using vl ph' PID' apply auto\n by (metis reach_PairI paperIDs_equals rs step)\n thus ?thesis by auto\n next\n case False note ph' = False\n have \"\\ (\\ uid. isRevNth s CID uid PID N)\" using rs ph isRevNth_geq_revPH by fastforce\n hence ph_isRev': \"phase s' CID = revPH \\ \\ (\\ uid. isRevNth s' CID uid PID N)\"\n using ph' ph PID step rs\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n hence \"\\ (\\ uid. isREVNth s' uid PID N)\"\n by (metis PID' isREVNth_imp_isRevNth reach_PairI rs1 ss1 step)\n hence \"\\2 s' vl' s' vl1\"\n unfolding \\2_def B_def isREVNth_def vl' using vl ph' PID' ph_isRev' by auto\n thus ?thesis by auto\n qed\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by auto\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2,\\3,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\3 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\2 s vl s1 vl1\"\n then obtain CID where rs: \"reach s\" and ph: \"phase s CID = revPH\" (is \"?ph = _\")\n and PID: \"PID \\\\ paperIDs s CID\" and ss1: \"s1 = s\"\n and vl: \"vl \\ []\" and uid: \"\\ (\\ uid. isREVNth s uid PID N)\"\n using reachNT_reach unfolding \\2_def B_def by auto\n hence uid: \"\\ (\\ uid. isRevNth s CID uid PID N)\" by (metis isREVNth_def)\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have \\: \"\\ \\ ?trn\"\n apply(cases a)\n subgoal by simp\n subgoal for x2 apply(cases x2)\n using step ph uid apply (auto simp: u_defs isRev_def3)\n by (metis PID paperIDs_equals rs)\n subgoal for x3 apply(cases x3)\n using step ph apply (auto simp: uu_defs)\n by (metis PID n_not_Suc_n paperIDs_equals rs)\n by simp_all\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n have PID': \"PID \\\\ paperIDs s' CID\" by (metis paperIDs_mono step PID)\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\ by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1\"\n proof(cases \"?ph' = revPH\")\n case True note ph' = True\n show ?thesis\n proof(cases \"\\ uid. isRevNth s' CID uid PID N\")\n case False\n hence \"\\ (\\ uid. isREVNth s' uid PID N)\"\n by (metis reach_PairI PID' isREVNth_imp_isRevNth rs1 ss1 step)\n hence \"\\2 s' vl' s' vl1\" unfolding \\2_def B_def vl' using vl ph' PID' by auto\n thus ?thesis by auto\n next\n case True hence \"\\ uid. isREVNth s' uid PID N\" by (metis isREVNth_def)\n hence \"\\3 s' vl' s' vl1\" unfolding \\3_def vl' using vl ph' PID' by auto\n thus ?thesis by auto\n qed\n next\n case False hence 1: \"?ph' > revPH \\ \\ (\\ uid. isRevNth s' CID uid PID N)\"\n using PID ph uid step rs\n apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n hence \"\\ (\\ uid. isREVNth s' uid PID N)\"\n by (metis reach_PairI PID' isREVNth_imp_isRevNth rs1 ss1 step)\n hence \"\\e s' vl' s' vl1\" unfolding \\e_def vl' using vl PID' 1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by simp\n qed\nqed\n\nlemma unwind_cont_\\3: \"unwind_cont \\3 {\\3,\\4,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\3 s vl s1 vl1 \\ \\4 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\3 s vl s1 vl1\"\n then obtain CID uid where uuid: \"isREVNth s uid PID N\"\n and rs: \"reach s\" and ph: \"phase s CID = revPH\" (is \"?ph = _\") and ss1: \"eqExcPID_N s s1\"\n and PID: \"PID \\\\ paperIDs s CID\" using reachNT_reach unfolding \\3_def by blast\n hence uid: \"isRevNth s CID uid PID N\" by (metis isREVNth_imp_isRevNth)\n hence uid_notin: \"uid \\ UIDs\" using reachNT_non_isPC_isChair[OF rsT] by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vl1') note vl1 = Cons\n have uid1: \"isRevNth s CID uid PID N\" using ss1 uid unfolding eqExcPID_N_def by auto\n define a1 where \"a1 \\ Uact (uReview CID uid (pass s uid) PID N v1)\"\n obtain s1' ou1 where step1: \"step s1 a1 = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have s1s1': \"eqExcPID_N s1 s1'\" using a1_def step1 uReview_uuReview_step_eqExcPID_N by blast\n have ss1': \"eqExcPID_N s s1'\" using eqExcPID_N_trans[OF ss1 s1s1'] .\n hence many_s1': \"PID \\\\ paperIDs s1' CID\" \"isRevNth s1' CID uid PID N\"\n \"phase s1' CID = revPH\" \"pass s1' uid = pass s uid\"\n using uid PID ph unfolding eqExcPID_N_def by auto\n hence more_s1': \"uid \\\\ userIDs s1'\" \"CID \\\\ confIDs s1'\"\n by (metis paperIDs_confIDs reach_PairI roles_userIDs rs1 step1 many_s1'(1))+\n have f: \"f ?trn1 = v1\" unfolding a1_def by simp\n have rs1': \"reach s1'\" using rs1 step1 by (auto intro: reach_PairI)\n have ou1: \"ou1 = outOK\"\n using step1 uid1 ph unfolding a1_def apply ( simp add: u_defs uu_defs many_s1' more_s1' isRev_def2)\n by (metis isRevNth_getReviewIndex many_s1' rs1)\n have ?iact proof\n show \"step s1 a1 = (ou1,s1')\" by fact\n next\n show \\: \"\\ ?trn1\" using ou1 unfolding a1_def by simp\n thus \"consume ?trn1 vl1 vl1'\" using f unfolding consume_def vl1 by simp\n next\n show \"\\ \\ ?trn1\" by (simp add: a1_def uid_notin)\n next\n have \"\\3 s vl s1' vl1'\" unfolding \\3_def using ph PID ss1' uuid by auto\n thus \"?\\ s vl s1' vl1'\" by simp\n qed\n thus ?thesis by auto\n next\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have uid': \"isRevNth s' CID uid PID N\"\n using uid step rs ph PID isRevNth_persistent by auto\n have uuid': \"isREVNth s' uid PID N\" by (metis isREVNth_def uid')\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case False note \\ = False\n have vl: \"vl' = vl\" using c \\ unfolding consume_def by (cases vl) auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID_N s' s1'\" using eqExcPID_N_step[OF ss1 step step1] .\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID_N_step_\\[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_N_step_out[OF ss1 step step1 rsT rs1 PID] by simp\n next\n show \"?\\ s' vl' s1' vl1\"\n proof(cases \"?ph' = revPH\")\n case True\n hence \"\\3 s' vl' s1' vl1\" using PID' s's1' uuid' unfolding \\3_def by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > revPH\"\n using ph rs step by (metis le_less phase_increases2 prod.sel(2))\n hence \"\\4 s' vl' s1' vl1\" using s's1' PID' unfolding \\4_def vl1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by simp\n next\n case True note \\ = True\n have s's: \"eqExcPID_N s' s\" using eqExcPID_N_sym[OF \\_step_eqExcPID_N[OF \\ step]] .\n have s's1: \"eqExcPID_N s' s1\" using eqExcPID_N_trans[OF s's ss1] .\n have ?ignore proof\n show \"\\ \\ ?trn\" using T_\\_\\ \\ rsT step by auto\n next\n show \"?\\ s' vl' s1 vl1\"\n proof(cases \"?ph' = revPH\")\n case True\n hence \"\\3 s' vl' s1 vl1\" using s's1 PID' uuid' unfolding \\3_def by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > revPH\"\n using ph rs step using eqExcPID_N_def s's by auto\n hence \"\\4 s' vl' s1 vl1\" using s's1 PID' unfolding \\4_def vl1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by auto\n qed\n qed\n thus ?thesis using vl1 by auto\n qed\nqed\n\nlemma unwind_cont_\\4: \"unwind_cont \\4 {\\4,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\4 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\4 s vl s1 vl1\"\n then obtain CID where rs: \"reach s\" and ph: \"phase s CID > revPH\" (is \"?ph > _\")\n and PID: \"PID \\\\ paperIDs s CID\" and ss1: \"eqExcPID_N s s1\" and vl1: \"vl1 = []\"\n using reachNT_reach unfolding \\4_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have \"?react\"\n proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have ph': \"phase s' CID > revPH\" using ph rs by (meson less_le_trans local.step phase_increases)\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case False note \\ = False\n have vl: \"vl' = vl\" using c \\ unfolding consume_def by (cases vl) auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID_N s' s1'\" using eqExcPID_N_step[OF ss1 step step1] .\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID_N_step_\\[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_N_step_out[OF ss1 step step1 rsT rs1 PID] by simp\n next\n have \"\\4 s' vl' s1' vl1\" using ph' PID' s's1' unfolding \\4_def vl1 by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n next\n case True note \\ = True\n have s's: \"eqExcPID_N s' s\" using eqExcPID_N_sym[OF \\_step_eqExcPID_N[OF \\ step]] .\n have s's1: \"eqExcPID_N s' s1\" using eqExcPID_N_trans[OF s's ss1] .\n have ?ignore proof\n show \"\\ \\ ?trn\" using T_\\_\\ \\ rsT step by auto\n next\n have \"\\4 s' vl' s1 vl1\" using s's1 PID' ph' vl1 unfolding \\4_def by auto\n thus \"?\\ s' vl' s1 vl1\" by auto\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\n(* Exit arguments: *)\ndefinition K1exit where\n\"K1exit cid s \\ PID \\\\ paperIDs s cid \\ phase s cid > revPH \\ \\ (\\ uid. isRevNth s cid uid PID N)\"\n\nlemma invarNT_K1exit: \"invarNT (K1exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n subgoal for _ a apply(cases a)\n subgoal for x1 apply(cases x1) apply (fastforce simp add: c_defs K1exit_def geq_noPH_confIDs)+ .\n subgoal for x2 apply(cases x2) apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)+ .\n subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K1exit_def)+ .\n by auto\n done\n\nlemma noVal_K1exit: \"noVal (K1exit cid) v\"\napply(rule no\\_noVal)\nunfolding no\\_def apply safe\n subgoal for _ a apply(cases a)\n subgoal by (fastforce simp add: c_defs K1exit_def)\n subgoal for x2 apply(cases x2) apply (auto simp add: u_defs K1exit_def)\n apply (metis less_not_refl paperIDs_equals reachNT_reach) .\n subgoal for x3 apply(cases x3) apply (auto simp add: uu_defs K1exit_def)\n apply (metis isRev_def3 paperIDs_equals reachNT_reach) .\n by auto\n done\n\nlemma unwind_exit_\\e: \"unwind_exit \\e\"\nproof\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\e: \"\\e s vl s1 vl1\"\n hence vl: \"vl \\ []\" using reachNT_reach unfolding \\e_def by auto\n then obtain CID where \"K1exit CID s\" using \\e unfolding K1exit_def \\e_def isREVNth_def by auto\n thus \"vl \\ [] \\ exit s (hd vl)\" apply(simp add: vl)\n by (metis rsT exitI2 invarNT_K1exit noVal_K1exit)\nqed\n\ntheorem secure: secure\napply(rule unwind_decomp4_secure[of \\1 \\2 \\e \\3 \\4])\nusing\nistate_\\1\nunwind_cont_\\1 unwind_cont_\\2 unwind_cont_\\3 unwind_cont_\\4\nunwind_exit_\\e\nby auto\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Review_Confidentiality/Review_RAut_NCPC_PAut.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2574799024313704}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory ArrayAssertion\n\nimports\n ArchArraysMemInstance\n \"StructSupport\"\n\nbegin\n\nlemma array_tag_n_eq:\n \"(array_tag_n n :: ('a :: c_type['b :: finite]) field_desc typ_desc) =\n TypDesc (TypAggregate\n (map (\\n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..<(card (UNIV :: 'b :: finite set))]))\n (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @ nat_to_bin_string (card (UNIV :: 'b :: finite set)))\"\n by (simp add: typ_info_array array_tag_def array_tag_n_eq)\n\ndefinition\n \"uinfo_array_tag_n_m (v :: 'a itself) n m = TypDesc\n (TypAggregate (map (\\i. DTPair (typ_uinfo_t TYPE('a)) (replicate i CHR ''1'')) [0 ..< n]))\n (typ_name (typ_uinfo_t TYPE('a :: c_type)) @ ''_array_'' @ nat_to_bin_string m)\"\n\nlemma map_td_list_map:\n \"map_td_list f = map (map_td_pair f)\"\n by (rule ext, rename_tac x) (induct_tac x, simp_all)\n\nlemma uinfo_array_tag_n_m_eq:\n \"n \\ CARD('b)\n \\ export_uinfo (array_tag_n n :: (('a :: wf_type)['b :: finite]) field_desc typ_desc)\n = uinfo_array_tag_n_m TYPE ('a) n (CARD('b))\"\n apply (clarsimp simp: uinfo_array_tag_n_m_def array_tag_n_eq map_td_list_map\n o_def adjust_ti_def map_td_map typ_uinfo_t_def export_uinfo_def)\n apply (fastforce intro: map_td_extI simp: field_norm_blah)\n done\n\nlemma typ_uinfo_array_tag_n_m_eq:\n \"typ_uinfo_t TYPE (('a :: wf_type)['b :: finite])\n = uinfo_array_tag_n_m TYPE ('a) (CARD('b)) (CARD('b))\"\n by (simp add: typ_uinfo_t_def typ_info_array array_tag_def uinfo_array_tag_n_m_eq)\n\ntext \\Alternative to h_t_valid for arrays. This allows reasoning\nabout arrays of variable width.\\\ndefinition h_t_array_valid :: \"heap_typ_desc \\ ('a :: c_type) ptr \\ nat \\ bool\" where\n \"h_t_array_valid htd ptr n = valid_footprint htd (ptr_val ptr) (uinfo_array_tag_n_m TYPE ('a) n n)\"\n\ntext \\Assertion that pointer p is within an array that continues for at least n more elements.\\\ndefinition\n \"array_assertion (p :: ('a :: c_type) ptr) n htd\n = (\\q i j. h_t_array_valid htd q j\n \\ p = CTypesDefs.ptr_add q (int i) \\ i < j \\ i + n \\ j)\"\n\nlemma array_assertion_shrink_right:\n \"array_assertion p n htd \\ n' \\ n \\ array_assertion p n' htd\"\n by (fastforce simp: array_assertion_def)\n\nlemma array_assertion_shrink_leftD:\n \"array_assertion p n htd \\ j < n \\ array_assertion (CTypesDefs.ptr_add p (int j)) (n - j) htd\"\n apply (clarsimp simp: array_assertion_def)\n apply (rule exI, rule_tac x=\"i + j\" in exI, rule exI, erule conjI)\n apply (simp add: CTypesDefs.ptr_add_def field_simps)\n done\n\nlemma array_assertion_shrink_leftI:\n \"array_assertion (CTypesDefs.ptr_add p (- (int j))) (n + j) htd\n \\ n \\ 0 \\ array_assertion p n htd\"\n apply (drule_tac j=j in array_assertion_shrink_leftD, simp)\n apply (simp add: CTypesDefs.ptr_add_def)\n done\n\nlemma h_t_array_valid:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ h_t_array_valid htd (ptr_coerce p :: 'a ptr) (CARD('b))\"\n by (clarsimp simp: h_t_valid_def h_t_array_valid_def typ_uinfo_array_tag_n_m_eq)\n\nlemma array_ptr_valid_array_assertionD:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ array_assertion (ptr_coerce p :: 'a ptr) (CARD('b)) htd\"\n apply (clarsimp simp: array_assertion_def dest!: h_t_array_valid)\n apply (fastforce intro: exI[where x=0])\n done\n\nlemma array_ptr_valid_array_assertionI:\n \"h_t_valid htd gd (q :: (('a :: wf_type)['b :: finite]) ptr)\n \\ q = ptr_coerce p\n \\ n \\ CARD('b)\n \\ array_assertion (p :: 'a ptr) n htd\"\n by (auto dest: array_ptr_valid_array_assertionD\n simp: array_assertion_shrink_right)\n\nlemma h_t_array_valid_array_assertion:\n \"h_t_array_valid htd ptr n \\ 0 < n\n \\ array_assertion ptr n htd\"\n apply (simp add: array_assertion_def)\n apply (fastforce intro: exI[where x=0])\n done\n\ntext \\Derived from array_assertion, an appropriate assertion for performing\na pointer addition, or for dereferencing a pointer addition (the strong case).\n\nIn either case, there must be an array connecting the two ends of the pointer\ntransition, with the caveat that the last address can be just out of the array\nif the pointer is not dereferenced, thus the strong/weak distinction.\n\nIf the pointer doesn't actually move, nothing is learned.\n\\\ndefinition ptr_add_assertion :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\" where\n \"ptr_add_assertion ptr offs strong htd \\\n offs = 0 \\\n array_assertion (if offs < 0 then CTypesDefs.ptr_add ptr offs else ptr)\n (if offs < 0 then nat (- offs) else if strong then Suc (nat offs) else nat offs)\n htd\"\n\nlemma ptr_add_assertion_positive:\n \"offs \\ 0 \\ ptr_add_assertion ptr offs strong htd\n = (offs = 0 \\ array_assertion ptr (case strong of True \\ Suc (nat offs)\n | False \\ nat offs) htd)\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_negative:\n \"offs < 0 \\ ptr_add_assertion ptr offs strong htd\n = array_assertion (CTypesDefs.ptr_add ptr offs) (nat (- offs)) htd\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_uint[simp]:\n \"ptr_add_assertion ptr (uint offs) strong htd\n = (offs = 0 \\ array_assertion ptr\n (case strong of True \\ Suc (unat offs) | False \\ unat offs) htd)\"\n by (metis ptr_add_assertion_positive uint_nonnegative unat_def unsigned_eq_0_iff)\n\ntext \\Ignore char and void pointers. The C standard specifies that arithmetic on\nchar and void pointers doesn't create any special checks.\\\n\ndefinition ptr_add_assertion' :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\" where\n \"ptr_add_assertion' ptr offs strong htd =\n (typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE(word8)\n \\ typ_uinfo_t TYPE ('a) = typ_uinfo_t TYPE(unit)\n \\ ptr_add_assertion ptr offs strong htd)\"\n\n(* Useful for clearing away these assumptions. *)\nlemma td_diff_from_typ_name:\n \"typ_name td \\ typ_name td' \\ td \\ td'\"\n by clarsimp\n\nlemma typ_name_void:\n \"typ_name (typ_uinfo_t TYPE(unit)) = ''unit''\"\n by (simp add: typ_uinfo_t_def)\n\nlemmas ptr_add_assertion' = ptr_add_assertion'_def td_diff_from_typ_name typ_name_void\n\ntext \\Mechanism for retyping a range of memory to a non-constant array size.\\\n\ndefinition ptr_arr_retyps :: \"nat \\ ('a :: c_type) ptr \\ heap_typ_desc \\ heap_typ_desc\" where\n \"ptr_arr_retyps n p \\\n htd_update_list (ptr_val p)\n (map (\\i. list_map (typ_slice_t (uinfo_array_tag_n_m TYPE('a) n n) i))\n [0.. ptr_arr_retyps n (p :: ('c :: wf_type) ptr) = ptr_retyp (ptr_coerce p :: ('c['b]) ptr)\"\n by (auto simp: ptr_arr_retyps_def ptr_retyp_def typ_slices_def typ_uinfo_array_tag_n_m_eq)\n\nlemma size_td_uinfo_array_tag_n_m[simp]:\n \"size_td (uinfo_array_tag_n_m (t :: 'a :: c_type itself) n m)\n = size_of (TYPE('a)) * n\"\n apply (induct n)\n apply (simp add: uinfo_array_tag_n_m_def)\n apply (simp add: uinfo_array_tag_n_m_def size_of_def)\n done\n\nlemma typ_slice_list_array:\n \"x < size_td td * n\n \\ typ_slice_list (map (\\i. DTPair td (nm i)) [0.. k < n\n \\ gd (p +\\<^sub>p int k)\n \\ h_t_valid htd gd (p +\\<^sub>p int k)\"\n supply if_split[split del]\n apply (clarsimp simp: h_t_array_valid_def h_t_valid_def valid_footprint_def\n size_of_def[symmetric, where t=\"TYPE('a)\"] Let_def)\n apply (drule_tac x=\"k * size_of TYPE('a) + y\" in spec)\n apply (drule mp)\n apply (frule_tac k=\"size_of TYPE('a)\" in mult_le_mono1[where j=n, OF Suc_leI])\n apply (simp add: mult.commute)\n apply (clarsimp simp: ptr_add_def add.assoc)\n apply (erule map_le_trans[rotated])\n apply (clarsimp simp: uinfo_array_tag_n_m_def)\n apply (subst typ_slice_list_array)\n apply (frule_tac k=\"size_of TYPE('a)\" in mult_le_mono1[where j=n, OF Suc_leI])\n apply (simp add: mult.commute size_of_def)\n apply (simp add: size_of_def list_map_mono)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/ArrayAssertion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832804, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2574691872223809}} {"text": "theory CoronaAppThree\n imports InfrastructureThree\nbegin\nlocale scenarioCoronaThree = scenarioCoronaTwo +\n\nfixes corona_actorsR :: \"identity set\"\ndefines corona_actorsR_def: \"corona_actorsR \\ {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n\nfixes corona_locationsR :: \"location set\"\ndefines corona_locationsR_def: \"corona_locationsR \\ {Location 0, Location 1}\"\nfixes pubR :: \"location\"\ndefines pubR_def: \"pubR \\ Location 0\"\nfixes shopR :: \"location\"\ndefines shopR_def: \"shopR \\ Location 1\"\n\nfixes identifiableR' :: \"[efid, (identity * efid)set] \\ bool\"\ndefines identifiableR'_def: \"identifiableR' eid A \\ is_singleton{(Id,Eid). (Id, Eid) \\ A \\ Eid = eid}\"\n\nfixes global_policyR'' :: \"[infrastructure, efid] \\ bool\"\ndefines global_policyR''_def: \"global_policyR'' I eid \\ \n \\(identifiableR' eid \n ((\\ (kgra(graphI I)(''Eve'')`(nodes(graphI I))))\n - {(x,y). x = ''Eve''}))\"\n\n(* The intersection above might be empty yet there could be individual l: nodes (graphI I)\n for which identifiability is given*)\nfixes global_policyR' :: \"[infrastructure, efid] \\ bool\"\ndefines global_policyR'_def: \"global_policyR' I eid \\ \n \\ l \\ nodes(graphI I). \\(identifiableR' eid \n (kgra(graphI I)(''Eve'') l - {(x,y). x = ''Eve''}))\"\n\n(* The strongest one and the one we need is the following policy. *)\nfixes global_policyR :: \"[infrastructure, efid] \\ bool\"\ndefines global_policyR_def: \"global_policyR I eid \\ \n \\ L. 0 < card L \\ L \\ nodes(graphI I) \\ (\\(identifiableR' eid \n ((\\ (kgra(graphI I)(''Eve'')`L)\n - {(x,y). x = ''Eve''}))))\"\n\nfixes ex_credsR :: \"identity \\ efidlist\"\ndefines ex_credsR_def: \n \"ex_credsR \\ (\\ x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\ n. Efid (2^(n+1)))) else \n (if x = ''Bob'' then (Efids (Efid 2) 0 (\\ n. Efid (3^(n+1)))) else \n (if x = ''Charly'' then (Efids (Efid 3) 0 (\\ n. Efid (5^(n+1)))) else\n (if x = ''David'' then (Efids (Efid 4) 0 (\\ n. Efid (7^(n+1)))) else\n (if x = ''Eve'' then (Efids (Efid 5) 0 (\\ n. Efid (11^(n+1)))) else \n (if x = ''Flo'' then (Efids (Efid 6) 0 (\\ n. Efid (13^(n+1)))) else\n (Efids (Efid 0) 0 (\\ n. Efid (17^(n+1))))))))))\"\n(*\nfixes ex_credsR' :: \"identity \\ efidlist\"\ndefines ex_credsR'_def: \n \"ex_credsR' \\ (\\ x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\ n. Efid (2^(n+1)))) else \n (if x = ''Bob'' then (Efids (Efid 2) 1 (\\ n. Efid (3^(n+1)))) else \n (if x = ''Charly'' then (Efids (Efid 3) 0 (\\ n. Efid (5^(n+1)))) else\n (if x = ''David'' then (Efids (Efid 4) 0 (\\ n. Efid (7^(n+1)))) else\n (if x = ''Eve'' then (Efids (Efid 5) 0 (\\ n. Efid (11^(n+1)))) else \n (Efids (Efid 0) 0 (\\ n. Efid (13^(n+1)))))))))\"\n\nfixes ex_credsR'' :: \"identity \\ efidlist\"\ndefines ex_credsR''_def: \n \"ex_credsR'' \\ (\\ x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\ n. Efid (2^(n+1)))) else \n (if x = ''Bob'' then (Efids (Efid 2) 1 (\\ n. Efid (3^(n+1)))) else \n (if x = ''Charly'' then (Efids (Efid 3) 0 (\\ n. Efid (5^(n+1)))) else\n (if x = ''David'' then (Efids (Efid 4) 0 (\\ n. Efid (7^(n+1)))) else\n (if x = ''Eve'' then (Efids (Efid 5) 1 (\\ n. Efid (11^(n+1)))) else \n (Efids (Efid 0) 0 (\\ n. Efid (13^(n+1)))))))))\"\n*)\nfixes ex_locsR :: \"location \\ string * (dlm * data) set\"\ndefines \"ex_locsR \\ (\\ x. ('''',{}))\"\n\nfixes ex_loc_assR :: \"location \\ identity set\"\ndefines ex_loc_assR_def: \"ex_loc_assR \\\n (\\ x. if x = pubR then {''Alice'', ''Bob'', ''Eve''} \n else (if x = shopR then {''Charly'', ''David'', ''Flo''} \n else {}))\"\n(*\nfixes ex_loc_assR' :: \"location \\ identity set\"\ndefines ex_loc_assR'_def: \"ex_loc_assR' \\\n (\\ x. if x = pubR then {''Alice'', ''Eve''} \n else (if x = shopR then { ''Bob'', ''Charly'', ''David''} \n else {}))\"\nfixes ex_loc_assR'' :: \"location \\ identity set\"\ndefines ex_loc_assR''_def: \"ex_loc_assR'' \\\n (\\ x. if x = pubR then {''Alice''} \n else (if x = shopR then {''Eve'', ''Bob'', ''Charly'', ''David''} \n else {}))\"\n*)\nfixes ex_efidsR :: \"location \\ efid set\"\ndefines ex_efidsR_def: \"ex_efidsR \\ \n (\\ x. if x = pubR then {Efid 2, Efid 3, Efid 11}\n else (if x = shopR then {Efid 5, Efid 7, Efid 13}\n else {}))\"\n(*\nfixes ex_efidsR' :: \"location \\ efid set\"\ndefines ex_efidsR'_def: \"ex_efidsR' \\ \n (\\ x. if x = pubR then {Efid 2, Efid 11}\n else (if x = shopR then {Efid 9, Efid 5, Efid 7}\n else {}))\"\n\nfixes ex_efidsR'' :: \"location \\ efid set\"\ndefines ex_efidsR''_def: \"ex_efidsR'' \\ \n (\\ x. if x = pubR then {Efid 2}\n else (if x = shopR then {Efid 121, Efid 3, Efid 5, Efid 7}\n else {}))\"\n*)\nfixes ex_knosR :: \"identity \\ location \\ (identity * efid) set\"\ndefines ex_knosR_def: \"ex_knosR \\ (\\ x :: identity. \n (if x = ''Eve'' then (\\ l :: location. {} :: (identity * efid) set) \n else (\\ l :: location. {} :: (identity * efid) set)))\"\n(*\nfixes ex_knosR' :: \"identity \\ location \\ (identity * efid) set\"\ndefines ex_knosR'_def: \"ex_knosR' \\ (\\ x :: identity. \n (if x = ''Eve'' then \n (\\ l :: location.\n (if l = pubR then \n ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n else {})) \n else (\\ l :: location. {} :: (identity * efid) set)))\"\n\nfixes ex_knosR'' :: \"identity \\ location \\ (identity * efid) set\"\ndefines ex_knosR''_def: \"ex_knosR'' \\ (\\ x :: identity. \n (if x = ''Eve'' then \n (\\ l :: location.\n (if l = pubR then \n ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n else (if l = shopR then \n ({(''Eve'', Efid 121),(''Eve'', Efid 9),(''Eve'', Efid 5),(''Eve'', Efid 7),\n (''Bob'', Efid 121),(''Bob'', Efid 9),(''Bob'', Efid 5),(''Bob'', Efid 7), \n (''Charly'', Efid 121),(''Charly'', Efid 9),(''Charly'', Efid 5),(''Charly'', Efid 7),\n (''David'', Efid 121),(''David'', Efid 9),(''David'', Efid 5),(''David'', Efid 7)})\n else {})))\n else (\\ l :: location. {} :: (identity * efid) set)))\"\n*)\n(* The nicer representation with case suffers from\n not so nice presentation in the cases (need to unfold the syntax) \nfixes ex_loc_ass_alt :: \"location \\ identity set\"\ndefines ex_loc_ass_alt_def: \"ex_loc_ass_alt \\\n (\\ x. (case x of \n Location (Suc 0) \\ {''Alice'', ''Bob'', ''Eve''} \n | Location (Suc (Suc 0)) \\ {''Charly'', ''David''} \n | _ \\ {}))\"\n*)\n(* Alternative attack that persisted even in Level Two: \n Bob gets isolated by Alice leaving pub so he's alone with Eve.\n Here in level 3 it should not persist any more because we have the number of actors\n restriction in the locations. *)\nfixes ex_credsRi :: \"identity \\ efidlist\"\ndefines ex_credsRi_def: \n \"ex_credsRi \\ (\\ x. if x = ''Alice'' then (Efids (Efid 1) 1 (\\ n. Efid (2^(n+1)))) else \n (if x = ''Bob'' then (Efids (Efid 2) 0 (\\ n. Efid (3^(n+1)))) else \n (if x = ''Charly'' then (Efids (Efid 3) 0 (\\ n. Efid (5^(n+1)))) else\n (if x = ''David'' then (Efids (Efid 4) 0 (\\ n. Efid (7^(n+1)))) else\n (if x = ''Eve'' then (Efids (Efid 5) 0 (\\ n. Efid (11^(n+1)))) else \n (if x = ''Flo'' then (Efids (Efid 6) 0 (\\ n. Efid (13^(n+1)))) else \n (Efids (Efid 0) 0 (\\ n. Efid (17^(n+1))))))))))\"\n\nfixes ex_loc_assRi :: \"location \\ identity set\"\ndefines ex_loc_assRi_def: \"ex_loc_assRi \\\n (\\ x. if x = pubR then {''Bob'', ''Eve''} \n else (if x = shopR then {''Alice'', ''Charly'', ''David'',''Flo''} \n else {}))\"\n\nfixes ex_efidsRi :: \"location \\ efid set\"\ndefines ex_efidsRi_def: \"ex_efidsRi \\ \n (\\ x. if x = pubR then {Efid 3, Efid 11}\n else (if x = shopR then {Efid 4, Efid 5, Efid 7, Efid 13}\n else {}))\"\n\nfixes ex_knosRi :: \"identity \\ location \\ (identity * efid) set\"\ndefines ex_knosRi_def: \"ex_knosRi \\(\\ x :: identity. \n (if x = ''Eve'' then \n (\\ l :: location.\n (if l = pubR then \n ({(''Bob'', Efid 3),(''Bob'', Efid 11),\n (''Eve'', Efid 3),(''Eve'', Efid 11)})\n else {})) \n else (\\ l :: location. {} :: (identity * efid) set)))\"\n\n\n(* initial *)\nfixes ex_graphR :: \"igraph\"\ndefines ex_graphR_def: \"ex_graphR \\ Lgraph {(pubR, shopR)} ex_loc_assR ex_credsR ex_locsR ex_efidsR ex_knosR\"\n\n(* Eve gets the ex_knos \nfixes ex_graphR' :: \"igraph\"\ndefines ex_graphR'_def: \"ex_graphR' \\ Lgraph {(pubR, shopR)} ex_loc_assR ex_credsR ex_locsR ex_efidsR ex_knosR'\"\n*)\n(* Bob goes to shop \nfixes ex_graphR'' :: \"igraph\"\ndefines ex_graphR''_def: \"ex_graphR'' \\ Lgraph {(pubR, shopR)} ex_loc_assR' ex_credsR ex_locsR ex_efidsR' ex_knosR'\"\n*)\n(* Eve goes to shop \nfixes ex_graphR''' :: \"igraph\"\ndefines ex_graphR'''_def: \"ex_graphR''' \\ Lgraph {(pubR, shopR)} ex_loc_assR'' ex_credsR ex_locsR ex_efidsR'' ex_knosR'\"\n*)\n(* Eve gets ex_knos at shop \nfixes ex_graphR'''' :: \"igraph\"\ndefines ex_graphR''''_def: \"ex_graphR'''' \\ Lgraph {(pubR, shopR)} ex_loc_assR'' ex_credsR ex_locsR ex_efidsR'' ex_knosR''\"\n*)\n(* Same as above: the nicer representation with case suffers from\n not so nice presentation in the cases (need to unfold the syntax) \nfixes local_policies_alt :: \"[igraph, location] \\ policy set\"\ndefines local_policies_alt_def: \"local_policies_alt G \\ \n (\\ x. case x of \n Location (Suc 0) \\ {(\\ y. True, {put,get,move,eval})}\n | Location 0 \\ {((\\ y. has G (y, ''PIN'')), {put,get,move,eval})} \n | Location (Suc (Suc (Suc 0))) \\ {(\\ y. True, {put,get,move,eval})}\n | Location (Suc (Suc 0)) \\\n {((\\ y. (\\ n. (n @\\<^bsub>G\\<^esub> hospital) \\ Actor n = y \\ \n has G (y, ''skey''))), {put,get,move,eval})} \n | _ \\ {})\"\n*)\n(* Second attack: Alice goes and then Bob is alone with Eve, so Eve can get and make the identification *)\n(* Alice goes to shop*)\nfixes ex_graphRi :: \"igraph\"\ndefines ex_graphRi_def: \"ex_graphRi \\ Lgraph {(pubR, shopR)} ex_loc_assRi ex_credsRi ex_locsT ex_efidsRi ex_knosR\"\n\n(* Eve gets the ex_knos *)\nfixes ex_graphRii :: \"igraph\"\ndefines ex_graphRii_def: \"ex_graphRii \\ Lgraph {(pubR, shopR)} ex_loc_assRi ex_credsRi ex_locsR ex_efidsRi ex_knosRi\"\n\nfixes local_policiesR :: \"[igraph, location] \\ policy set\"\ndefines local_policiesR_def: \"local_policiesR G \\ \n (\\ x. if x = pubR then {(\\ y. True, {get,move})}\n else (if x = shopR then {(\\ y. True, {get,move})} \n else {}))\"\n\n(* problems with case in locales?\ndefines local_policies_def: \"local_policies G x \\ \n (case x of \n home \\ {(\\ y. True, {put,get,move,eval})}\n | sphone \\ {((\\ y. has G (y, ''PIN'')), {put,get,move,eval})} \n | cloud \\ {(\\ y. True, {put,get,move,eval})}\n | hospital \\ {((\\ y. (\\ n. (n @\\<^bsub>G\\<^esub> hospital) \\ Actor n = y \\ \n has G (y, ''skey''))), {put,get,move,eval})} \n | _ \\ {})\"\n*)\n\nfixes rmapR :: \"InfrastructureThree.infrastructure \\ InfrastructureTwo.infrastructure\"\ndefines rmapR_def:\n\"rmapR I \\ InfrastructureThree.ref_map I local_policiesT\"\n\nfixes corona_scenarioR :: \"infrastructure\"\ndefines corona_scenarioR_def:\n\"corona_scenarioR \\ Infrastructure ex_graphR local_policiesR\"\nfixes IcoronaR :: \"infrastructure set\"\ndefines IcoronaR_def:\n \"IcoronaR \\ {corona_scenarioR}\"\n\n(* other states of scenario *)\n(* First step: Bob goes to shop *)\n(*\nfixes corona_scenarioR' :: \"infrastructure\"\ndefines corona_scenarioR'_def: \"corona_scenarioR' \\ Infrastructure ex_graphR' local_policiesR\"\nfixes CoronaR' :: \"infrastructure set\"\ndefines CoronaR'_def: \"CoronaR' \\ {corona_scenarioR'}\"\nfixes corona_scenarioR'' :: \"infrastructure\"\ndefines corona_scenarioR''_def: \"corona_scenarioR'' \\ Infrastructure ex_graphR'' local_policiesR\"\nfixes CoronaR'' :: \"infrastructure set\"\ndefines Corona''_def: \"CoronaR'' \\ {corona_scenarioR''}\"\nfixes corona_scenarioR''' :: \"infrastructure\"\ndefines corona_scenarioR'''_def: \"corona_scenarioR''' \\ Infrastructure ex_graphR''' local_policiesR\"\nfixes CoronaR''' :: \"infrastructure set\"\ndefines CoronaR'''_def: \"CoronaR''' \\ {corona_scenarioR'''}\"\nfixes corona_scenarioR'''' :: \"infrastructure\"\ndefines corona_scenarioR''''_def: \"corona_scenarioR'''' \\ Infrastructure ex_graphR'''' local_policiesR\"\nfixes CoronaR'''' :: \"infrastructure set\"\ndefines CoronaR''''_def: \"CoronaR'''' \\ {corona_scenarioR''''}\"\n*)\n(* Second attack where Alice leaves *)\nfixes corona_scenarioRi :: \"infrastructure\"\ndefines corona_scenarioRi_def: \"corona_scenarioRi \\ Infrastructure ex_graphRi local_policiesR\"\nfixes CoronaRi :: \"infrastructure set\"\ndefines CoronaRi_def: \"CoronaRi \\ {corona_scenarioRi}\" \nfixes corona_scenarioRii :: \"infrastructure\" \ndefines corona_scenarioRii_def: \"corona_scenarioRii \\ Infrastructure ex_graphRii local_policiesR\" \nfixes CoronaRii :: \"infrastructure set\"\ndefines CoronaRii_def: \"CoronaRii \\ {corona_scenarioRii}\"\n\nfixes corona_statesR\ndefines corona_statesR_def: \"corona_statesR \\ { I. corona_scenarioR \\\\<^sub>i* I }\"\nfixes corona_KripkeR\ndefines \"corona_KripkeR \\ Kripke corona_statesR IcoronaR\"\nfixes scoronaR \ndefines \"scoronaR \\ {x. \\ n. \\ global_policyR'' x (Efid n)}\" \nfixes scoronaR' \ndefines \"scoronaR' \\ {x. \\ n. \\ global_policyR x (Efid n)}\" \n(* *)\nbegin\n(* actor invariants for example *)\nlemma all_actors: \"actors_graph(graphI corona_scenarioR) = corona_actorsR\"\nproof (simp add: corona_scenarioR_def corona_actorsR_def ex_graphR_def actors_graph_def nodes_def\n ex_loc_assR_def, rule equalityI)\n show \"{x. \\y. (y = shopR \\\n (shopR = pubR \\ x = ''Alice'' \\ x = ''Bob'' \\ x = ''Eve'') \\\n (shopR \\ pubR \\ x = ''Charly'' \\ x = ''David'' \\ x = ''Flo'')) \\\n (y \\ shopR \\\n (y = pubR \\ (\\y. y = shopR \\ y = pubR \\ pubR = shopR) \\ (x = ''Alice'' \\ x = ''Bob'' \\ x = ''Eve'')) \\\n y = pubR)}\n \\ {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n by fastforce\nnext show \"{''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\n \\ {x. \\y. (y = shopR \\\n (shopR = pubR \\ x = ''Alice'' \\ x = ''Bob'' \\ x = ''Eve'') \\\n (shopR \\ pubR \\ x = ''Charly'' \\ x = ''David'' \\ x = ''Flo'')) \\\n (y \\ shopR \\\n (y = pubR \\ (\\y. y = shopR \\ y = pubR \\ pubR = shopR) \\ (x = ''Alice'' \\ x = ''Bob'' \\ x = ''Eve'')) \\\n y = pubR)}\"\n using pubR_def shopR_def by auto\nqed\n\nlemma all_corona_actors: \"(corona_scenarioR, y) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ actors_graph(graphI y) = corona_actorsR\"\n using all_actors same_actors by auto\n\nlemma numbers_acors_inv_corona_scenarioR: \"l \\ nodes (graphI corona_scenarioR) \\\ncard (agra (graphI corona_scenarioR) l) \\ 2\"\n by (simp add: corona_scenarioR_def corona_actorsR_def ex_graphR_def actors_graph_def nodes_def\n ex_loc_assR_def shopR_def pubR_def, force)\n\nlemma numbers_actors_inv_corona_scenarioR: \"l \\ nodes (graphI corona_scenarioR) \\\ncard (agra (graphI corona_scenarioR) l) \\ 3\"\n by (simp add: corona_scenarioR_def corona_actorsR_def ex_graphR_def actors_graph_def nodes_def\n ex_loc_assR_def shopR_def pubR_def, force)\n\nlemma actors_unique_init_lem: \"\\a l l'.\n l \\ InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) \\\n a \\ InfrastructureThree.agra (InfrastructureThree.graphI corona_scenarioR) l \\\n a \\ InfrastructureThree.agra (InfrastructureThree.graphI corona_scenarioR) l' \\ l = l'\"\n by (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def ex_knosR_def ex_locsR_def actors_graph_def)\n\n\n(* nodes invariants *)\nlemma same_nodes: \"(corona_scenarioR, s) \\ {(x::InfrastructureThree.infrastructure, y::InfrastructureThree.infrastructure). x \\\\<^sub>n y}\\<^sup>*\n\\ InfrastructureThree.nodes (graphI corona_scenarioR) = InfrastructureThree.nodes (graphI s)\"\n using InfrastructureThree.same_nodes by blast\n\n\n(* efids invariants *)\n\nlemma isthere_lem00: \" a \\ agra (graphI corona_scenarioR) l \\ l \\ nodes (graphI corona_scenarioR) \\\n efids_cur (cgra (graphI corona_scenarioR) a) \\ egra (graphI corona_scenarioR) l\"\n apply (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def)\n by (smt (z3) One_nat_def Zero_not_Suc char.inject insertE list.inject location.inject shopR_def singleton_iff)\n\n\nlemma efids_root_lem: \"a \\ actors_graph (InfrastructureThree.graphI corona_scenarioR) \\ \n a' \\ actors_graph (InfrastructureThree.graphI corona_scenarioR) \\\n a \\ a' \\\n efids_root (cgra (InfrastructureThree.graphI corona_scenarioR) a) \\ \n efids_root (cgra (InfrastructureThree.graphI corona_scenarioR) a')\"\n apply (simp add: rmapR_def ref_map_def move_graph_a_def corona_scenarioR_def)\n apply (simp add: repl_efr_def ex_graphR_def ex_credsR_def)\n by (smt CollectD InfrastructureThree.actors_graph_def InfrastructureThree.agra.simps InfrastructureThree.gra.simps InfrastructureThree.nodes_def ex_loc_assR_def insertE prod.inject singletonD)\n\n(*\nlemma efids_root_minus: \"(corona_scenarioR, I) \\ {(x::infrastructure, y::infrastructure). x \\\\<^sub>n y}\\<^sup>* \n \\ a \\ InfrastructureThree.agra (InfrastructureThree.graphI I) l \n \\ l \\ InfrastructureThree.nodes (InfrastructureThree.graphI I) \\\n(\\x. efids_root (InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) `\n (InfrastructureThree.agra (InfrastructureThree.graphI I) l - {a}) =\n (\\a. efids_root (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) `\n InfrastructureThree.agra (InfrastructureThree.graphI I) l -\n {efids_root (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)}\"\n apply auto\n apply (frule InfrastructureThree.eroots_inj_on_inv)\n sorry\n using efids_root_lem inj_on_def apply blast\n by (metis (mono_tags, lifting) InfrastructureThree.actors_graph_def inj_on_def mem_Collect_eq)\n*)\n(* efids_list initial invariants*)\n\nlemma efid_in_range_corona_scenarioR: \"(\\ l \\ nodes (graphI corona_scenarioR).\n (\\ e \\ (egra (InfrastructureThree.graphI corona_scenarioR) l).\n (\\ a \\ actors_graph (graphI corona_scenarioR). \n e \\ range (efids_list (InfrastructureThree.cgra (graphI corona_scenarioR) a)))))\"\n apply (simp add: corona_scenarioR_def ex_graphR_def nodes_def)\n apply (rule allI)\n apply (rule impI)+\n apply (rule ballI)\n apply (simp add: ex_efidsR_def actors_graph_def ex_loc_assR_def)\n apply (erule exE)\n apply (erule disjE)\n apply (simp add: pubR_def shopR_def ex_credsR_def nodes_def)\n apply (erule disjE)\n apply (rule_tac x = \"''Alice''\" in exI)\n apply simp\n apply blast\n apply (erule disjE)\n apply (rule_tac x = \"''Bob''\" in exI)\n apply simp\n apply blast\n apply (rule_tac x = \"''Eve''\" in exI)\n apply simp\n apply blast\n apply (simp add: pubR_def shopR_def ex_credsR_def nodes_def)\n apply (erule disjE)\n apply (rule_tac x = \"''Charly''\" in exI)\n apply simp\n apply (erule disjE)\n apply (rule_tac x = \"''David''\" in exI)\n apply simp\n apply (rule_tac x = \"''Flo''\" in exI)\n by simp\n\nlemma efid_kgra_in_range_corona_scenarioR: \"(\\ l \\ InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR). \n (\\ h \\ InfrastructureThree.actors_graph(InfrastructureThree.graphI corona_scenarioR).\n (\\ e \\ (snd`((InfrastructureThree.kgra (InfrastructureThree.graphI corona_scenarioR) h l))).\n (\\ a \\ InfrastructureThree.actors_graph (InfrastructureThree.graphI corona_scenarioR). \n e \\ range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI corona_scenarioR) a))))))\"\n by (simp add: corona_scenarioR_def ex_graphR_def nodes_def\n ex_credsR_def ex_locsR_def ex_efidsR_def ex_knosR_def pubR_def shopR_def)\n\nlemma efid_eq_efid_cur_corona_scenarioR: \"lb \\ InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) \\\n e \\ InfrastructureThree.egra (InfrastructureThree.graphI corona_scenarioR) lb \\\n \\a\\InfrastructureThree.agra (InfrastructureThree.graphI corona_scenarioR) lb.\n e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI corona_scenarioR) a)\"\n apply (simp add: corona_scenarioR_def ex_graphR_def nodes_def ex_loc_assR_def \n ex_credsR_def ex_locsR_def ex_efidsR_def ex_knosR_def pubR_def shopR_def)\n using shopR_def by fastforce\n\n\nlemma not_ex_elem_empty_int: \"\\(\\ x. (x \\ A \\ x \\ B)) \\ A \\ B = {}\"\n by (rule no_elem_inter_disjoint)\n\nlemma range_disjoint_corona_scenarioR[rule_format]: \"\\a\\InfrastructureThree.actors_graph (InfrastructureThree.graphI corona_scenarioR).\n \\a'\\InfrastructureThree.actors_graph (InfrastructureThree.graphI corona_scenarioR).\n a \\ a' \\\n range\n (InfrastructureThree.efids_list\n (InfrastructureThree.cgra (InfrastructureThree.graphI corona_scenarioR) a)) \\\n range\n (InfrastructureThree.efids_list\n (InfrastructureThree.cgra (InfrastructureThree.graphI corona_scenarioR) a')) =\n {}\"\nproof (unfold corona_scenarioR_def ex_graphR_def ex_credsR_def, simp)\n show \" \\a\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a = ''Flo'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Eve'' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''David'' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\\n ''Flo'' \\ a' \\ range (\\x. Efid (13 * 13 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''Flo'' \\\n (a = ''Eve'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''David'' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\\n ''Eve'' \\ a' \\ range (\\x. Efid (11 * 11 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''Eve'' \\\n (a = ''David'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''Eve'' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\\n ''David'' \\ a' \\ range (\\x. Efid (7 * 7 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''David'' \\\n (a = ''Charly'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''Eve'' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''David'' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\\n ''Charly'' \\ a' \\ range (\\x. Efid (5 * 5 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''Charly'' \\\n (a = ''Bob'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''Eve'' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''David'' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\\n ''Bob'' \\ a' \\ range (\\x. Efid (3 * 3 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''Bob'' \\\n (a = ''Alice'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''Eve'' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''David'' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n ''Alice'' \\ a' \\ range (\\x. Efid (2 * 2 ^ x)) \\ range (\\x. Efid (17 * 17 ^ x)) = {}))))))) \\\n (a \\ ''Alice'' \\\n (\\a'\\InfrastructureThree.actors_graph\n (InfrastructureThree.igraph.Lgraph {(pubR, shopR)} ex_loc_assR\n (\\x. if x = ''Alice'' then Efids (Efid 1) 0 (\\n. Efid (2 ^ (n + 1)))\n else if x = ''Bob'' then Efids (Efid 2) 0 (\\n. Efid (3 ^ (n + 1)))\n else if x = ''Charly'' then Efids (Efid 3) 0 (\\n. Efid (5 ^ (n + 1)))\n else if x = ''David'' then Efids (Efid 4) 0 (\\n. Efid (7 ^ (n + 1)))\n else if x = ''Eve'' then Efids (Efid 5) 0 (\\n. Efid (11 ^ (n + 1)))\n else if x = ''Flo'' then Efids (Efid 6) 0 (\\n. Efid (13 ^ (n + 1)))\n else Efids (Efid 0) 0 (\\n. Efid (17 ^ (n + 1))))\n ex_locsR ex_efidsR ex_knosR).\n (a' = ''Flo'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (13 * 13 ^ x)) = {}) \\\n (a' \\ ''Flo'' \\\n (a' = ''Eve'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (11 * 11 ^ x)) = {}) \\\n (a' \\ ''Eve'' \\\n (a' = ''David'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (7 * 7 ^ x)) = {}) \\\n (a' \\ ''David'' \\\n (a' = ''Charly'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (5 * 5 ^ x)) = {}) \\\n (a' \\ ''Charly'' \\\n (a' = ''Bob'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (3 * 3 ^ x)) = {}) \\\n (a' \\ ''Bob'' \\\n (a' = ''Alice'' \\ range (\\x. Efid (17 * 17 ^ x)) \\ range (\\x. Efid (2 * 2 ^ x)) = {}) \\\n (a' \\ ''Alice'' \\ a = a')))))))))))))\"\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_11, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_7, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_5, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_3, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_2, simp, simp)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_13_17, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_13, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_7, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_5, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_3, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_2, arith, arith)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_11_17, simp, simp)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_13, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_11, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_5, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_3, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_2, arith, arith)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_7_17, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_13, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_11, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_7, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_3, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_2, arith, arith)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_5_17, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_13, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_11, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_7, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_5, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_2, arith, arith)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_3_17, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_13, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_11, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_7, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_5, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_3, arith, arith)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_2_17, arith, arith)\n apply (rule impI)+\n apply (rule ballI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_13, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_11, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_7, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_5, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_3, arith, arith)\n apply (rule impI)+\n apply (rule conjI)\n apply (rule impI)+\n apply (rule coprime_range_disjointOO)\n apply (rule coprime_17_2, arith, arith)\n apply (rule impI)+\n by (smt (z3) InfrastructureThree.actors_graph_def InfrastructureThree.agra.simps all_not_in_conv ex_loc_assR_def insertE mem_Collect_eq)\nqed\n\n\n(* initially inj *)\nlemma inj_efids_list_init_lem: \" \\a\\InfrastructureThree.actors_graph (InfrastructureThree.graphI corona_scenarioR).\n inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI corona_scenarioR) a))\"\n apply (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def ex_knosR_def ex_locsR_def actors_graph_def)\n apply (rule allI)\nby (simp add: inj_def)\n\n(* Initial kgra invariant *)\nlemma kgra_init_lem: \"\\l a. InfrastructureThree.kgra (InfrastructureThree.graphI corona_scenarioR) a l = {}\"\n apply (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def)\n using ex_knosR_def by force\n\n(* Initial finiteness invariants needed in the \"pea-counting\" lemma last_lem *)\nlemma finite_egra_init_lem: \"\\l\\InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR).\n finite (InfrastructureThree.egra (InfrastructureThree.graphI corona_scenarioR) l)\"\n by (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def)\n\nlemma finite_agra_init_lem: \"\\l\\InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR).\n finite (InfrastructureThree.agra (InfrastructureThree.graphI corona_scenarioR) l)\"\n by (simp add: corona_scenarioR_def ex_graphR_def ex_loc_assR_def nodes_def ex_credsR_def ex_efidsR_def\n shopR_def pubR_def)\n\n\ntext \\Other invariants are that the efids at egra l are in fact efids of the actors at\n that location, i.e. \n e \\ egra G l = (\\! a \\ agra G l. e \\ efid_list (cgra G a) (for InfrastructureThree))\n ..... /\\ e = efid_root (cgra G a) \n \\\n\nlemma rtrancl_imp_step: \"(I \\\\<^sub>n y) \\ (I, y) \\ {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\\\<^sub>n y}\\<^sup>* \"\n by (simp add: r_into_rtrancl) \n \nlemma rtrancl_imp_two_step: \"(I \\\\<^sub>n y) \\ (y \\\\<^sub>n z) \\ (I, z) \\ {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\\\<^sub>n y}\\<^sup>* \"\n by (simp add: converse_rtrancl_into_rtrancl)\n\n\n\nlemma refmapThree_lem: \"\\s::InfrastructureThree.infrastructure.\n (corona_scenarioR, s) \\ {(x::InfrastructureThree.infrastructure, y::InfrastructureThree.infrastructure). x \\\\<^sub>n y}\\<^sup>* \\\n (\\s'::InfrastructureThree.infrastructure. s \\\\<^sub>n s' \\ (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>*)\"\nproof (clarify, frule same_nodes, frule init_state_policy, erule state_transition_in.cases)\n(* move case *)\n show \"\\s s' G I a l l' I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n l' \\ InfrastructureThree.nodes G \\\n a \\ InfrastructureThree.actors_graph G \\\n InfrastructureThree.enables I l' (Actor a) move \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.move_graph_a a l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>*\"\n proof (case_tac \"l = l'\")\n show \"\\s s' G I a l l' I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n l' \\ InfrastructureThree.nodes G \\\n a \\ InfrastructureThree.actors_graph G \\\n InfrastructureThree.enables I l' (Actor a) move \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.move_graph_a a l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n l = l' \\ (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>*\"\n using InfrastructureThree.move_graph_eq InfrastructureThree.ref_map_def rmapR_def by force\n next show \"\\s s' G I a l l' I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n l' \\ InfrastructureThree.nodes G \\\n a \\ InfrastructureThree.actors_graph G \\\n InfrastructureThree.enables I l' (Actor a) move \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.move_graph_a a l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n l \\ l' \\ (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \"\n apply (case_tac \"4 \\ card (InfrastructureThree.agra (InfrastructureThree.graphI I) l) \")\n prefer 2\n apply (subgoal_tac \"s = s'\")\n apply force\n apply (simp add: move_graph_a_def)\n apply (smt (verit, del_insts) InfrastructureThree.delta.simps InfrastructureThree.graphI.simps InfrastructureThree.infrastructure.exhaust InfrastructureThree.move_graph_a_def InfrastructureThree.move_graph_eq)\n(* *)\n apply (rule_tac I = \"rmapR s\" and y = \"rmapR s'\" in rtrancl_imp_step)\n apply (rule_tac I = \"rmapR s\" and I' = \"rmapR s'\" and l = l and l' = l' \n and a = a \n in InfrastructureTwo.state_transition_in.move)\n apply (rule refl)\n apply (simp add: InfrastructureThree.atI_def InfrastructureThree.ref_map_def InfrastructureTwo.atI_def rmapR_def)\n apply (simp add: nodes_def InfrastructureThree.atI_def InfrastructureThree.ref_map_def InfrastructureTwo.atI_def rmapR_def)\n apply (simp add: InfrastructureTwo.nodes_def)\n apply (simp add: InfrastructureThree.nodes_def InfrastructureThree.ref_map_def InfrastructureTwo.nodes_def rmapR_def)\n apply (simp add: rmapR_def InfrastructureThree.ref_map_def InfrastructureTwo.actors_graph_def \n InfrastructureThree.actors_graph_def InfrastructureTwo.nodes_def InfrastructureThree.nodes_def) \n apply (simp add: rmapR_def InfrastructureThree.ref_map_def \n InfrastructureThree.enables_def InfrastructureTwo.enables_def local_policiesT_def shopT_def pubT_def)\n apply (metis InfrastructureThree.delta.simps One_nat_def corona_scenarioR_def empty_iff local_policiesR_def pubR_def shopR_def)\n (* Only remaining subgoal \"rmapR s' =\n InfrastructureTwo.infrastructure.Infrastructure\n (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI (rmapR s))) (InfrastructureTwo.delta (rmapR s))\n We need to provide an invariant that proves that for all reachable state the additions restrictions\n on numbers of actors is preserved.\n*)\n(* apply (subgoal_tac \"3 \\ card (InfrastructureThree.agra (InfrastructureThree.graphI I) l') \")\n prefer 2 \n using numbers_actors_inv_corona_scenarioR numbers_actors_inv_refl apply blast *)\n(* apply (subgoal_tac \"2 \\ card (InfrastructureThree.agra (InfrastructureThree.graphI I) l) \")\n prefer 2 \n using numbers_acors_inv_corona_scenarioR numbers_actors_inv_refl apply blast *)\n apply (simp add: InfrastructureTwo.move_graph_a_def InfrastructureThree.move_graph_a_def\n rmapR_def InfrastructureThree.ref_map_def \n local_policiesT_def shopT_def pubT_def)\n(* here *)\n apply (rule conjI)\n apply (rule impI)+\n apply (rule conjI)\n apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureThree.efids_inc_ind_def) \n apply (simp add: InfrastructureTwo.efids_cur_def InfrastructureThree.efids_cur_def\n InfrastructureTwo.efids_inc_ind_def InfrastructureThree.efids_inc_ind_def)\n apply force\n using numbers_actors_inv_corona_scenarioR numbers_actors_inv_refl by presburger \n(* by (simp add: InfrastructureTwo.efids_cur_def InfrastructureThree.efids_cur_def\n InfrastructureTwo.efids_inc_ind_def InfrastructureThree.efids_inc_ind_def) *) \nqed\nnext show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n InfrastructureThree.enables I l (Actor a) get \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n ((InfrastructureThree.kgra G)\n (a := (InfrastructureThree.kgra G a)\n (l := {(x, y). x \\ InfrastructureThree.agra G l \\ y \\ InfrastructureThree.egra G l}))))\n (InfrastructureThree.delta I) \\\n (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>*\"\n proof (rule rtrancl_imp_step, rule_tac I = \"rmapR s\" and I' = \"rmapR s'\" and l = l and a = a \n in InfrastructureTwo.state_transition_in.get, \n rule refl, simp add: rmapR_def ref_map_def atI_def InfrastructureTwo.atI_def\n local_policiesT_def InfrastructureTwo.nodes_def shopT_def pubT_def)\n show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n InfrastructureThree.enables I l (Actor a) get \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n ((InfrastructureThree.kgra G)\n (a := (InfrastructureThree.kgra G a)\n (l := {(x, y). x \\ InfrastructureThree.agra G l \\ y \\ InfrastructureThree.egra G l}))))\n (InfrastructureThree.delta I) \\\n l \\ InfrastructureTwo.nodes (InfrastructureTwo.graphI (rmapR s))\"\n apply (simp add: rmapR_def local_policiesT_def ref_map_def)\n using InfrastructureTwo.nodes_def InfrastructureThree.nodes_def by fastforce\n next show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n InfrastructureThree.enables I l (Actor a) get \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n ((InfrastructureThree.kgra G)\n (a := (InfrastructureThree.kgra G a)\n (l := {(x, y). x \\ InfrastructureThree.agra G l \\ y \\ InfrastructureThree.egra G l}))))\n (InfrastructureThree.delta I) \\\n InfrastructureTwo.enables (rmapR s) l (Actor a) get\"\n proof (simp add: rmapR_def ref_map_def nodes_def enables_def InfrastructureTwo.enables_def\n local_policiesT_def InfrastructureTwo.nodes_def shopT_def pubT_def)\n show \"\\s s' G I a l I'.\n (corona_scenarioR, I) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n {x. \\y. (x, y) \\ InfrastructureThree.gra (InfrastructureThree.graphI corona_scenarioR) \\\n (y, x) \\ InfrastructureThree.gra (InfrastructureThree.graphI corona_scenarioR)} =\n {x. \\y. (x, y) \\ InfrastructureThree.gra (InfrastructureThree.graphI I) \\\n (y, x) \\ InfrastructureThree.gra (InfrastructureThree.graphI I)} \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta I \\\n s = I \\\n s' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra (InfrastructureThree.graphI I))\n (InfrastructureThree.agra (InfrastructureThree.graphI I))\n (InfrastructureThree.cgra (InfrastructureThree.graphI I))\n (InfrastructureThree.lgra (InfrastructureThree.graphI I))\n (InfrastructureThree.egra (InfrastructureThree.graphI I))\n ((InfrastructureThree.kgra (InfrastructureThree.graphI I))\n (a := (InfrastructureThree.kgra (InfrastructureThree.graphI I) a)\n (l := InfrastructureThree.agra (InfrastructureThree.graphI I) l \\\n InfrastructureThree.egra (InfrastructureThree.graphI I) l))))\n (InfrastructureThree.delta I) \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>InfrastructureThree.graphI I\\<^esub> l \\\n \\y. (l, y) \\ InfrastructureThree.gra (InfrastructureThree.graphI I) \\\n (y, l) \\ InfrastructureThree.gra (InfrastructureThree.graphI I) \\\n \\x\\InfrastructureThree.delta I (InfrastructureThree.graphI I) l. case x of (p, e) \\ get \\ e \\ p (Actor a) \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra (InfrastructureThree.graphI I))\n (InfrastructureThree.agra (InfrastructureThree.graphI I))\n (InfrastructureThree.cgra (InfrastructureThree.graphI I))\n (InfrastructureThree.lgra (InfrastructureThree.graphI I))\n (InfrastructureThree.egra (InfrastructureThree.graphI I))\n ((InfrastructureThree.kgra (InfrastructureThree.graphI I))\n (a := (InfrastructureThree.kgra (InfrastructureThree.graphI I) a)\n (l := InfrastructureThree.agra (InfrastructureThree.graphI I) l \\\n InfrastructureThree.egra (InfrastructureThree.graphI I) l))))\n (InfrastructureThree.delta I) \\\n l \\ Location (Suc 0) \\ l = Location 0\"\n by (metis InfrastructureThree.delta.simps One_nat_def corona_scenarioR_def empty_iff local_policiesR_def pubR_def shopR_def)\n qed\n next show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n l \\ InfrastructureThree.nodes G \\\n InfrastructureThree.enables I l (Actor a) get \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n ((InfrastructureThree.kgra G)\n (a := (InfrastructureThree.kgra G a)\n (l := {(x, y). x \\ InfrastructureThree.agra G l \\ y \\ InfrastructureThree.egra G l}))))\n (InfrastructureThree.delta I) \\\n rmapR s' =\n InfrastructureTwo.infrastructure.Infrastructure\n (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI (rmapR s)))\n (InfrastructureTwo.agra (InfrastructureTwo.graphI (rmapR s)))\n (InfrastructureTwo.cgra (InfrastructureTwo.graphI (rmapR s)))\n (InfrastructureTwo.lgra (InfrastructureTwo.graphI (rmapR s)))\n (InfrastructureTwo.egra (InfrastructureTwo.graphI (rmapR s)))\n ((InfrastructureTwo.kgra (InfrastructureTwo.graphI (rmapR s)))\n (a := (InfrastructureTwo.kgra (InfrastructureTwo.graphI (rmapR s)) a)\n (l := {(x, y).\n x \\ InfrastructureTwo.agra (InfrastructureTwo.graphI (rmapR s)) l \\\n y \\ InfrastructureTwo.egra (InfrastructureTwo.graphI (rmapR s)) l}))))\n (InfrastructureTwo.delta (rmapR s))\"\nby (simp add: rmapR_def ref_map_def)\nqed\nnext show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n InfrastructureThree.enables I l (Actor a) put \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>n y}\\<^sup>*\"\n proof (rule rtrancl_imp_step, rule_tac I = \"rmapR s\" and I' = \"rmapR s'\" and l = l \n and a = a \n in InfrastructureTwo.state_transition_in.put, rule refl, simp add: rmapR_def ref_map_def atI_def InfrastructureTwo.atI_def\n ,simp add: rmapR_def ref_map_def nodes_def enables_def InfrastructureTwo.enables_def\n local_policiesT_def InfrastructureTwo.nodes_def shopT_def pubT_def)\n show \"\\s s' G I a l I'.\n (corona_scenarioR, I) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n {x. \\y. (x, y) \\ InfrastructureThree.gra (InfrastructureThree.graphI corona_scenarioR) \\\n (y, x) \\ InfrastructureThree.gra (InfrastructureThree.graphI corona_scenarioR)} =\n {x. \\y. (x, y) \\ InfrastructureThree.gra (InfrastructureThree.graphI I) \\\n (y, x) \\ InfrastructureThree.gra (InfrastructureThree.graphI I)} \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta I \\\n s = I \\\n s' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>InfrastructureThree.graphI I\\<^esub> l \\\n \\x\\InfrastructureThree.delta I (InfrastructureThree.graphI I) l. case x of (p, e) \\ put \\ e \\ p (Actor a) \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n l \\ Location (Suc 0) \\ l = Location 0\"\n using all_not_in_conv corona_scenarioR_def local_policiesR_def pubR_def shopR_def by fastforce\n next show \"\\s s' G I a l I'.\n (corona_scenarioR, s) \\ {(x, y). x \\\\<^sub>n y}\\<^sup>* \\\n InfrastructureThree.nodes (InfrastructureThree.graphI corona_scenarioR) =\n InfrastructureThree.nodes (InfrastructureThree.graphI s) \\\n InfrastructureThree.delta corona_scenarioR = InfrastructureThree.delta s \\\n s = I \\\n s' = I' \\\n G = InfrastructureThree.graphI I \\\n a @\\<^bsub>G\\<^esub> l \\\n InfrastructureThree.enables I l (Actor a) put \\\n I' =\n InfrastructureThree.infrastructure.Infrastructure\n (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\\n rmapR s' =\n InfrastructureTwo.infrastructure.Infrastructure\n (InfrastructureTwo.put_graph_efid a l (InfrastructureTwo.graphI (rmapR s))) (InfrastructureTwo.delta (rmapR s))\"\n apply (simp add: rmapR_def ref_map_def)\n apply (simp add: put_graph_efid_def InfrastructureTwo.put_graph_efid_def)\n apply (rule conjI)\n apply (rule ext, simp add: InfrastructureThree.efids_inc_ind_def InfrastructureTwo.efids_inc_ind_def)\n apply (rule ext, simp)\n apply (rule impI)\n by (simp add: InfrastructureThree.efids_cur_def InfrastructureTwo.efids_cur_def\n InfrastructureThree.efids_inc_ind_def InfrastructureTwo.efids_inc_ind_def)\nqed\nqed\n\n\ntheorem refmapThree: \"corona_KripkeT \\\\<^sub>rmapR corona_KripkeR\"\nproof (rule strong_mt'', simp add: corona_KripkeR_def corona_KripkeT_def corona_statesR_def corona_statesT_def state_transition_refl_def, rule conjI)\n show \"IcoronaR \\ {I. (corona_scenarioR, I) \\ {(x, y). x \\\\<^sub>i y}\\<^sup>*}\"\n using IcoronaR_def by fastforce\nnext show \"IcoronaT \\ {I. (corona_scenarioT, I) \\ {(x, y). x \\\\<^sub>i y}\\<^sup>*} \\\n rmapR ` IcoronaR \\ IcoronaT \\\n (\\s. (\\s0\\IcoronaR. (s0, s) \\ {(x, y). x \\\\<^sub>i y}\\<^sup>*) \\\n (\\s'. s \\\\<^sub>i s' \\ (rmapR s, rmapR s') \\ {(x, y). x \\\\<^sub>i y}\\<^sup>*)) \"\n apply (rule conjI)\n using IcoronaT_def apply blast\n apply (rule conjI)\n apply (simp add: rmapR_def ref_map_def IcoronaT_def IcoronaR_def corona_scenarioT_def corona_scenarioR_def\n ex_graphT_def ex_graphR_def pubT_def pubR_def ex_loc_assR_def\n ex_loc_assT_def ext ex_credsT_def ex_credsR_def ex_locsT_def ex_locsR_def \n ex_efidsR_def ex_efidsT_def shopT_def shopR_def\n ex_knosR_def ex_knosT_def repl_efr_def)\n using IcoronaR_def InfrastructureTwo.state_transition_infra_def InfrastructureThree.state_transition_infra_def refmapThree_lem by auto\nqed\n\nlemma step1: \"corona_scenarioR \\\\<^sub>n corona_scenarioR'\"\n oops\n\nlemma step1r: \"corona_scenarioR \\\\<^sub>n* corona_scenarioR'\"\n oops\n\n(* These lemmas are all now on unreachable states\n\n\nlemma step2r: \"corona_scenarioR' \\\\<^sub>n* corona_scenarioR''\"\n oops\n\nlemma step3: \"corona_scenarioR'' \\\\<^sub>n corona_scenarioR'''\"\n oops\n\nlemma step3r: \"corona_scenarioR'' \\\\<^sub>n* corona_scenarioR'''\"\n oops\n\nlemma step4: \"corona_scenarioR''' \\\\<^sub>n corona_scenarioR''''\"\n oops\n\nlemma step4r: \"corona_scenarioR''' \\\\<^sub>n* corona_scenarioR''''\"\n oops\n*)\n\n(*\nlemma corona_refR: \"[\\\\<^bsub>(IcoronaR,scoronaR)\\<^esub>] \\\\<^sub>\\\\<^bsup>(IcoronaR,scoronaR)\\<^esup> \\\n ([\\\\<^bsub>(IcoronaR,CoronaR')\\<^esub>, \\\\<^bsub>(CoronaR',CoronaR'')\\<^esub>, \\\\<^bsub>(CoronaR'',CoronaR''')\\<^esub>, \\\\<^bsub>(CoronaR''',scoronaR)\\<^esub>] \\\\<^sub>\\\\<^bsup>(IcoronaR,scoronaR)\\<^esup>)\"\n oops\n\nlemma att_coronaR: \"\\([\\\\<^bsub>(IcoronaR,CoronaR')\\<^esub>, \\\\<^bsub>(CoronaR',CoronaR'')\\<^esub>, \\\\<^bsub>(CoronaR'',CoronaR''')\\<^esub>, \\\\<^bsub>(CoronaR''',scoronaR)\\<^esub>] \\\\<^sub>\\\\<^bsup>(IcoronaR,scoronaR)\\<^esup>)\"\n oops\n*)\n\nlemma corona_abs_attR: \"\\\\<^sub>V([\\\\<^bsub>(IcoronaR,scoronaR)\\<^esub>] \\\\<^sub>\\\\<^bsup>(IcoronaR,scoronaR)\\<^esup>)\"\n oops\n\nlemma corona_attR: \"corona_KripkeR \\ EF {x. \\ n. \\(global_policyR'' x (Efid n))}\"\n oops\n\ntheorem corona_EFR: \"corona_KripkeR \\ EF scoronaR\"\n oops\n\ntheorem corona_ATT: \"\\ A. \\ A \\ attack A = (IcoronaR,scoronaR)\"\n oops\n\ntheorem corona_EFR': \"corona_KripkeR \\ EF scoronaR\"\n oops\n\n thm contrapos_corr\n\n(* As at level Two, global_policyR'' holds *)\nlemma kgra_disj_imp_not_identifiable: \n\"''Eve'' \\ actors_graph (graphI I) \\\n\\ l \\ nodes (graphI I). \\ l' \\ nodes (graphI I). l \\ l' \\\n(\\ a \\ actors_graph (graphI I).\n (\\ l \\ nodes (graphI I). \\ l' \\ nodes (graphI I). \n (l \\ l' \\ (kgra (graphI I) a l) \\ kgra(graphI I) a l' = {})))\n\\ global_policyR'' I eid \"\n apply (simp add: global_policyR''_def identifiableR'_def)\n apply (erule bexE)+\n apply (subgoal_tac \"{(Id, Eid).\n (\\x\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' x) \\\n Id \\ ''Eve'' \\ Eid = eid} = {}\")\n apply (erule ssubst)\n apply (simp add: is_singleton_def)\n by (smt (verit, ccfv_threshold) IntI case_prodI2 case_prod_conv empty_Collect_eq empty_iff split_part)\n\n\n(* Proof idea for global_policyR and global_policyR' is again that all intersections are empty\n and thus for any subset of intersections we have that policy holds (the single set being the\n special care global_policyR')\nlemma global_policy_strength: \"global_policyR I eid \\ global_policyR'' I eid\"\n\n using global_policyR''_def global_policyR_def by blast\n*)\nthm bspec\nthm ballI\n\nlemma set_spec: \"\\ L\\ S. P L \\ L' \\ S \\ P L'\"\n by simp\n\nlemma set_allI: \"(\\ L'. L' \\ S \\ P L') \\ \\ L\\ S. P L \"\n by simp\n\n(*\nlemma global_policy_strengthO: \"global_policyR I eid \\ global_policyR' I eid\"\nproof (simp add: global_policyR_def global_policyR'_def)\n show \"\\L\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n \\ identifiableR' eid\n (\\ (InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' ` L) - {(x, y). x = ''Eve''}) \\\n \\l\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n \\ identifiableR' eid (InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l - {(x, y). x = ''Eve''})\"\n apply (rule ballI)\n apply (drule_tac L' = \"{l}\" in set_spec)\n by simp+\nqed\n\nlemma global_policy_strengthOO: \"global_policyR'' I eid \\ global_policyR' I eid \\ global_policyR I eid\"\nproof (simp add: global_policyR_def global_policyR'_def global_policyR''_def)\n show \"\\ identifiableR' eid\n (\\ (InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' `\n InfrastructureThree.nodes (InfrastructureThree.graphI I)) -\n {(x, y). x = ''Eve''}) \\\n \\l\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n \\ identifiableR' eid\n (InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l - {(x, y). x = ''Eve''}) \\\n \\L\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n \\ identifiableR' eid\n (\\ (InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' ` L) - {(x, y). x = ''Eve''})\"\n apply (rule set_allI)\n apply (unfold identifiableR'_def)\n apply (simp add: is_singleton_def)\n apply (rule allI)+\n\n\n oops\n*)\n\n\n(* We can already establish non-identifiability for subsets L with more than 2 elements.\n This should follow simply from disjointness of the kgra set intersections for all pairs of \n locations. *)\nlemma card_two_two_not_eq_elem: \"2 \\ card L \\ \\l\\L. \\l'\\L. l \\ l'\"\n apply (subgoal_tac \"L \\ {}\")\n prefer 2\n apply force\n apply (subgoal_tac \"\\ x. x \\ L\")\n prefer 2\n apply auto[1]\n apply (erule exE)\n apply (subgoal_tac \"L - {x} \\ {}\")\n prefer 2\n apply (metis Suc_n_not_le_n card.empty card.infinite card_Suc_Diff1 not_numeral_le_zero numeral_2_eq_2)\n apply (subgoal_tac \"\\ y. y \\ (L - {x})\")\n prefer 2\n apply auto[1]\n apply (rule_tac x = x in bexI)\n apply (erule exE)\n apply (rule_tac x = y in bexI)\n apply force\n apply simp\n by assumption\n\n\nlemma all_kgra_disj_imp_greater_two_inv: \"(\\ a \\ actors_graph (graphI I). \n (\\ l \\ nodes (graphI I). \\ l' \\ nodes (graphI I). \n (l \\ l' \\ (kgra (graphI I) a l) \\ kgra(graphI I) a l' = {}))) \\\n L \\ nodes(graphI I) \\ card L \\ 2 \\ \n ''Eve'' \\ actors_graph (graphI I) \\\n (\\(identifiableR' eid \n ((\\ (kgra(graphI I)(''Eve'')`L))\n - {(x,y). x = ''Eve''})))\"\n apply (simp add: identifiableR'_def) \n apply (subgoal_tac \" {(Id, Eid).\n (\\x\\L. (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' x) \\\n Id \\ ''Eve'' \\ Eid = eid} = {}\")\n apply (rotate_tac -1)\n apply (erule ssubst)\n apply (simp add: is_singleton_def)\n apply (rule equalityI)\n prefer 2\n apply simp\n apply (rule subsetI)\n apply simp\n apply (case_tac x)\n apply simp\n apply (subgoal_tac \"\\ l \\ L. (\\ l' \\ L. l \\ l')\")\n apply (erule bexE)+\n apply (erule conjE)\n apply (frule_tac x = l in bspec, assumption)\n apply (drule_tac x = l' in bspec, assumption)\n apply (drule_tac x = \"''Eve''\" in bspec)\n prefer 2\n apply (meson disjoint_iff in_mono)\n apply assumption\nby (erule card_two_two_not_eq_elem)\n\nlemma empty_kgra: \"kgra (graphI I)(''Eve'')` {} = {}\"\n by (rule image_empty)\n\n(* The remaining case: empty or just one l *)\nlemma \"\\ ({{}}) = {}\"\n by (rule cInf_singleton)\n\nlemma empty_minus: \"({} - {(x, y). x = ''Eve''}) = {}\"\n by (rule empty_Diff)\n\nlemma \"card {} = 0\"\n by (rule card.empty)\n\nlemma \"finite S \\ I \\ S \\ card (insert I S) = Suc (card S)\"\n by(rule card_insert_disjoint)\n\nlemma \"card {l :: location} = 1\"\n by simp\n\nlemma \"(l:: location) \\ L \\ card L < (2 :: nat) \\ L = {l}\"\n apply (subgoal_tac \"card L = 1\")\n apply (metis card_1_singletonE empty_iff insertE)\n apply (subgoal_tac \"card L > 0\")\n apply linarith\n apply (subgoal_tac \"finite L\")\n using card_gt_0_iff apply blast\n oops\n\n\nlemma all_kgra_disj_imp_less_two_inv: \n \"L \\ nodes(graphI I) \\ card L < 2 \\ \n ''Eve'' \\ actors_graph (graphI I) \\ 0 < card L \\\n\\l\\InfrastructureThree.nodes (InfrastructureThree.graphI I).\n {(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\ Id \\ ''Eve'' \\ Eid = eid} \\\n {} \\\n 2 \\ card {(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\\n Id \\ ''Eve'' \\ Eid = eid} \\\n (\\(identifiableR' eid \n (((\\ (kgra(graphI I)(''Eve'')`L)\n - {(x,y). x = ''Eve''})))))\"\n apply (subgoal_tac \"finite L\")\n prefer 2\n using card_gt_0_iff apply blast\n apply (subgoal_tac \"card L = 1\")\n prefer 2\n apply linarith\n apply (subgoal_tac \"\\ l. L = {l}\")\n prefer 2\n apply (meson card_1_singletonE)\n apply (erule exE)\n apply simp\n apply (simp add: identifiableR'_def)\n apply (subgoal_tac \"{(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\ Id \\ ''Eve'' \\ Eid = eid} = {} \n\\\ncard({(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\ Id \\ ''Eve'' \\ Eid = eid}) \\ 2\")\n apply (erule disjE)\n apply (rotate_tac -1)\n apply (erule ssubst)\n apply (simp add: is_singleton_def)+\n apply force\n apply (case_tac \"{(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\ Id \\ ''Eve'' \\ Eid = eid} = {}\")\n apply simp\n apply (rule disjI2)\nby simp\n\n(* putting the previous two cases together *)\nlemma all_kgra_disj_imp_inv: \"''Eve'' \\ InfrastructureThree.actors_graph (InfrastructureThree.graphI I) \\\n (\\ a \\ actors_graph (graphI I).\n (\\ l \\ nodes (graphI I). \\ l' \\ nodes (graphI I). \n (l \\ l' \\ (kgra (graphI I) a l) \\ kgra(graphI I) a l' = {}))) \\\n (\\ l \\ nodes (graphI I). {(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\ Id \\ ''Eve'' \\ Eid = eid} \\\n {} \\\n ( 2 \\ card {(Id, Eid).\n (Id, Eid) \\ InfrastructureThree.kgra (InfrastructureThree.graphI I) ''Eve'' l \\\n Id \\ ''Eve'' \\ Eid = eid})) \\ global_policyR I eid\"\n apply (unfold global_policyR_def)\n apply (rule allI)\n apply (rule impI)+\n apply (subgoal_tac \"(0 < card L \\ card L < 2) \\ card L \\ 2\")\n prefer 2\n apply arith\n apply (erule disjE)\n apply (rule all_kgra_disj_imp_less_two_inv, assumption, simp, assumption, simp, assumption)\n using all_kgra_disj_imp_greater_two_inv by presburger\n\n(* *)\n\n(* Should be the same as the global_policy and the intersection should follow *)\nlemma global_policy_valid: \"(corona_scenarioR \\\\<^sub>n* y) \\ global_policyR y eid\"\n apply (rule all_kgra_disj_imp_inv)\n apply (simp add: InfrastructureThree.state_transition_in_refl_def all_corona_actors corona_actorsR_def)\n apply (rule theoremAOO, simp add: state_transition_in_refl_def)\n apply (simp add: kgra_init_lem)\n apply (simp add: inj_efids_list_init_lem)\n apply (simp add: actors_unique_init_lem)\n apply (simp add: range_disjoint_corona_scenarioR)\n apply (simp add: efid_eq_efid_cur_corona_scenarioR)\n apply (rule last_lemOO)\n apply (simp add: state_transition_in_refl_def)\n using kgra_init_lem apply blast\n using range_disjoint_corona_scenarioR apply blast\n apply (smt (verit, best) InfrastructureThree.efids_cur_in_efids_listO disjoint_iff inj_onI range_disjoint_corona_scenarioR)\n using inj_efids_list_init_lem apply blast\n using actors_unique_init_lem apply blast\n using local.isthere_lem00 apply blast\n apply (rule finite_egra_init_lem) \n apply (rule finite_agra_init_lem)\n using numbers_actors_inv_corona_scenarioR by blast \n\n\nlemma AG_all_sO_n: \"(\\y. (x,y)\\ {(x,y). state_transition_in x y}\\<^sup>* \\ y \\ s) \\ x \\ AG s\"\n apply (rule AG_all_sO)\n by (smt (verit) Collect_cong InfrastructureThree.state_transition_infra_def split_cong state_transition_refl_def)\n\ntheorem RR_cycle_succeeds: \"corona_KripkeR \\ AG {x. \\ n. global_policyR x (Efid n)}\"\n apply (simp add: check_def)\n apply (rule subsetI)\n apply (simp add: corona_KripkeR_def IcoronaR_def corona_statesR_def)\n apply (rule conjI)\n using EF_lem2a EF_step_star_rev apply blast\n apply (rule AG_all_sO_n)\n apply (rule allI)\n apply (rule impI)\n apply (rule CollectI, rule allI)\n apply (rule global_policy_valid)\nby (simp add: state_transition_in_refl_def)\n \n\nend\nend\n", "meta": {"author": "flokam", "repo": "CoronaApp", "sha": "6258178b8f9d10f43e0825d99cbb0126ee51612c", "save_path": "github-repos/isabelle/flokam-CoronaApp", "path": "github-repos/isabelle/flokam-CoronaApp/CoronaApp-6258178b8f9d10f43e0825d99cbb0126ee51612c/IsabelleCorona/CoronaAppThree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.25746918114417666}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: LocalRG_HoareDef.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\ntheory LocalRG_HoareDef \nimports \"SmallStepCon\" \"EmbSimpl.HoarePartialProps\" \"HOL-Library.Countable\"\nbegin\nsection \\Validity of Correctness Formulas\\\n\nsubsection \\Aux\\\n\nabbreviation (input)\n set_fun :: \"'a set \\ 'a \\ bool\" (\"_\\<^sub>f\") where\n \"set_fun s \\ \\v. v\\s\"\n\nabbreviation (input)\n fun_set :: \"('a \\ bool) \\ 'a set\" (\"_\\<^sub>s\") where\n \"fun_set f \\ {\\. f \\}\"\n\n\nlemma tl_pair:\"Suc (Suc j) < length l \\ \n l1 = tl l \\\n P (l!(Suc j)) (l!(Suc (Suc j)))=\n P (l1!j) (l1!(Suc j))\"\nby (simp add: tl_zero_eq)\n\nlemma for_all_k_sublist:\nassumes a0:\"Suc (Suc j)k < j. P ((tl l)!k) ((tl l)!(Suc k)))\" and\n a2:\"P (l!0) (l!(Suc 0))\" \nshows \"(\\k < Suc j. P (l!k) (l!(Suc k)))\"\nproof -\n {fix k\n assume aa0:\"k < Suc j\"\n have \"P (l!k) (l!(Suc k))\"\n proof (cases k)\n case 0 thus ?thesis using a2 by auto\n next\n case (Suc k1) thus ?thesis using aa0 a0 a1 a2\n by (metis SmallStepCon.nth_tl Suc_less_SucD dual_order.strict_trans length_greater_0_conv nth_Cons_Suc zero_less_Suc)\n qed\n } thus ?thesis by auto\nqed\n\n\nsubsection \\Validity for Component Programs.\\\n\ntype_synonym ('s,'f) tran = \"('s,'f) xstate \\ ('s,'f) xstate\"\ntype_synonym ('s,'p,'f,'e) rgformula = \n \"(('s,'p,'f,'e) com \\ \n ('s set) \\ \n (('s,'f) tran) set \\\n (('s,'f) tran) set \\\n ('s set) \\ \n ('s set))\" (* A *)\n \ntype_synonym ('s,'p,'f,'e) sextuple = \n \"('p \\ \n ('s set) \\ \n (('s,'f) tran) set \\ \n (('s,'f) tran) set \\ \n ('s set) \\\n ('s set))\" (* A *) \n\ndefinition Sta :: \"'s set \\ (('s,'f) tran) set \\ bool\" where\n \"Sta \\ \\f g. (\\x y x'. x' \\ f \\ x=Normal x' \\ (x,y)\\ g \\ (\\y'. y=Normal y' \\ y' \\ f))\"\n\nlemma Sta_intro:\"Sta a R \\ Sta b R \\ Sta (a \\ b) R\"\nunfolding Sta_def by fastforce\n\nlemma Sta_assoc:\"Sta (a \\ (b \\ c)) R = Sta ((a\\b)\\c) R\"\nunfolding Sta_def by fastforce\n\nlemma Sta_comm:\"Sta (a \\ b) R = Sta (b \\ a) R\" \nunfolding Sta_def by fastforce\n\nlemma Sta_add:\"Sta (a \\ b) R \\ Sta (a \\ c) R \\\n Sta (a \\ b \\ c) R\"\nunfolding Sta_def by fastforce\n\nlemma Sta_tran:\"Sta a R \\ a = b \\ Sta b R\"\nby auto\n\ndefinition Norm:: \"(('s,'f) tran) set \\ bool\" where\n \"Norm \\ \\g. (\\x y. (x, y) \\ g \\ (\\x' y'. x=Normal x' \\ y=Normal y'))\"\n\ndefinition env_tran::\n \"('p \\ ('s, 'p, 'f,'e) LanguageCon.com option)\n \\ ('s set)\n \\ (('s, 'p, 'f,'e) LanguageCon.com \\ ('s, 'f) xstate) list\n \\ ('s,'f) tran set \\ bool\"\nwhere\n\"env_tran \\ q l rely \\ snd(l!0) \\ Normal ` q \\ (\\i. Suc i \n \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ rely)\n\"\n\ndefinition env_tran_right::\n \"('p \\ ('s, 'p, 'f,'e) LanguageCon.com option) \n \\ (('s, 'p, 'f,'e) LanguageCon.com \\ ('s, 'f) xstate) list\n \\ ('s,'f) tran set \\ bool\"\nwhere\n\"env_tran_right \\ l rely \\ \n (\\i. Suc i \n \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ rely)\n\"\n\nlemma env_tran_tail:\"env_tran_right \\ (x#l) R \\ env_tran_right \\ l R\"\nunfolding env_tran_right_def\nby fastforce\n\nlemma env_tran_subr:\nassumes a0:\"env_tran_right \\ (l1@l2) R\"\nshows \"env_tran_right \\ l1 R\"\nunfolding env_tran_right_def\nproof -\n {fix i\n assume a1:\"Suc i< length l1\"\n assume a2:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n then have \"Suc i < length (l1@l2)\" using a1 by fastforce\n also then have \"\\\\\\<^sub>c (l1@l2) ! i \\\\<^sub>e (l1@l2) ! Suc i\" \n proof -\n show ?thesis\n by (simp add: Suc_lessD a1 a2 nth_append)\n qed\n ultimately have f1:\"(snd ((l1@l2)! i), snd ((l1@l2) ! Suc i)) \\ R\"\n using a0 unfolding env_tran_right_def by auto\n then have \"(snd (l1! i), snd (l1 ! Suc i)) \\ R\"\n using a1\nproof -\n have \"\\ps psa n. if n < length ps then (ps @ psa) ! n = (ps ! n::('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) \n else (ps @ psa) ! n = psa ! (n - length ps)\"\n by (meson nth_append)\n then show ?thesis\n using f1 \\Suc i < length l1\\ by force\nqed \n } then show \n \"\\i. Suc i < length l1 \\\n \\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i \\\n (snd (l1 ! i), snd (l1 ! Suc i)) \\ R\"\n by blast\nqed\n\ndefinition Satis where \"Satis \\ True\"\n\ndefinition sep_conj where \"sep_conj \\ True\"\n\nlemma env_tran_subl:\"env_tran_right \\ (l1@l2) R \\ env_tran_right \\ l2 R\"\nproof (induct \"l1\")\n case Nil thus ?case by auto\nnext\n case (Cons a l1) thus ?case by (fastforce intro:append_Cons env_tran_tail )\nqed\n\nlemma env_tran_R_R':\"env_tran_right \\ l R \\ \n (R \\ R') \\\n env_tran_right \\ l R'\"\nunfolding env_tran_right_def Satis_def sep_conj_def\napply clarify\napply (erule allE)\napply auto\ndone\n\n\nlemma env_tran_normal:\nassumes a0:\"env_tran_right \\ l rely \\ Sta q rely \\ snd(l!i) = Normal s1 \\ s1\\q\" and\n a1:\"Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\nshows \"\\s1 s2. snd(l!i) = Normal s1 \\ snd(l!(Suc i)) = Normal s2 \\ s2\\q\"\nusing a0 a1 unfolding env_tran_right_def Sta_def by fastforce\n\nlemma no_env_tran_not_normal:\nassumes a0:\"env_tran_right \\ l rely \\ Sta q rely \\ snd(l!i) = Normal s1 \\ s1\\q\" and\n a1:\"Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a2:\"(\\s1. \\ (snd(l!i) = Normal s1)) \\ (\\s2. \\ (snd (l!Suc i) = Normal s2))\"\nshows \"P\"\nusing a0 a1 a2 unfolding env_tran_right_def Sta_def by fastforce \n \ndefinition assum :: \n \"('s set \\ ('s,'f) tran set) \\ (('s,'p,'f,'e) confs) set\" where\n \"assum \\ \\(pre, rely). \n {c. snd((snd c)!0) \\ Normal ` pre \\ \n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ rely)}\"\n\ndefinition assum1 :: \n \"('s set \\ ('s,'f) tran set) \\\n 'f set \\\n (('s,'p,'f,'e) confs) set\" where\n \"assum1 \\ \\(pre, rely) F. \n {(\\,comp). snd(comp!0) \\ Normal ` pre \\ \n (\\i. Suc i \n \\\\\\<^sub>c(comp!i) \\\\<^sub>e (comp!(Suc i)) \\ \n (snd(comp!i), snd(comp!(Suc i))) \\ rely)}\"\n\n\nlemma assum_R_R': \n \"(\\, l) \\ assum(p, R) \\\n snd(l!0) \\ Normal ` p' \\\n R \\ R' \\ \n (\\, l) \\ assum(p', R')\"\nproof -\nassume a0:\"(\\, l) \\ assum(p, R)\" and\n a1:\"snd(l!0) \\ Normal ` p'\" and\n a2: \" R \\ R'\"\n then have \"env_tran_right \\ l R\" \n unfolding assum_def using env_tran_right_def\n by force\n then have \"env_tran_right \\ l R'\" \n using a2 env_tran_R_R' by blast\n thus ?thesis using a1 unfolding assum_def unfolding env_tran_right_def\n by fastforce\nqed\n\n\nlemma same_prog_p:\n \"(\\,(P,s)#(P,t)#l)\\cptn \\\n (\\,(P,s)#(P,t)#l) \\ assum (p,R) \\\n Sta p R \\\n \\t1. t=Normal t1 \\ t1 \\ p\n \" \nproof -\nassume a0: \"(\\,(P,s)#(P,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(P,t)#l) \\ assum (p,R)\" and\n a2: \"Sta p R\"\n then have \"Suc 0 < length ((P,s)#(P,t)#l)\" \n by fastforce\n then have \"\\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\\\<^sub>c\\<^sub>e (((P,s)#(P,t)#l)!(Suc 0))\" \n using a0 cptn_stepc_rtran by fastforce \n then have step_ce:\"\\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\\\<^sub>e (((P,s)#(P,t)#l)!(Suc 0)) \\\n \\\\\\<^sub>c(((P,s)#(P,t)#l)!0) \\ (((P,s)#(P,t)#l)!(Suc 0))\"\n using step_ce_elim_cases by blast \n then obtain s1 where s:\"s=Normal s1 \\ s1 \\ p\" \n using a1 unfolding assum_def\n by fastforce\n have \"\\t1. t=Normal t1 \\ t1 \\ p \"\n using step_ce\n proof\n {assume step_e:\"\\\\\\<^sub>c ((P, s) # (P, t) # l) ! 0 \\\\<^sub>e\n ((P, s) # (P, t) # l) ! Suc 0\"\n have ?thesis \n using a2 a1 s unfolding Sta_def assum_def \n proof -\n have \"(Suc 0 < length ((P, s) # (P, t) # l))\"\n by fastforce\n then have assm:\"(s, t) \\ R\"\n using s a1 step_e\n unfolding assum_def by fastforce\n then obtain t1 s2 where s_t:\"s= Normal s2 \\ t = Normal t1\" \n using a2 s unfolding Sta_def by fastforce \n then have R:\"(s,t)\\R\" \n using assm unfolding Satis_def by fastforce\n then have \"s2=s1\" using s s_t by fastforce\n then have \"t1\\p\" \n using a2 s s_t R unfolding Sta_def Norm_def by blast\n thus ?thesis using s_t by blast\n qed thus ?thesis by auto\n } \n next\n { \n assume step:\"\\\\\\<^sub>c ((P, s) # (P, t) # l) ! 0 \\\n ((P, s) # (P, t) # l) ! Suc 0\"\n then have \"P\\P \\ s=t\"\n proof -\n have \"\\\\\\<^sub>c (P, s) \\ (P, t)\"\n using local.step by force\n then show ?thesis\n using step_change_p_or_eq_s by blast\n qed\n then show ?thesis using s by fastforce\n }\n qed thus ?thesis by auto\nqed\n\nlemma tl_of_assum_in_assum:\n \"(\\,(P,s)#(P,t)#l)\\cptn \\\n (\\,(P,s)#(P,t)#l) \\ assum (p,R) \\\n Sta p R \\\n (\\,(P,t)#l) \\ assum (p,R)\n \" \nproof -\n assume a0: \"(\\,(P,s)#(P,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(P,t)#l) \\ assum (p,R)\" and\n a2: \"Sta p R \"\n \n then obtain t1 where t1:\"t=Normal t1 \\ t1 \\p\" \n using same_prog_p by blast\n then have \"env_tran_right \\ ((P,s)#(P,t)#l) R\"\n using env_tran_right_def a1 unfolding assum_def\n by force\n then have \"env_tran_right \\ ((P,t)#l) R\"\n using env_tran_tail by auto\n thus ?thesis using t1 unfolding assum_def env_tran_right_def by auto\nqed\n\nlemma tl_of_assum_in_assum1:\n \"(\\,(P,s)#(Q,t)#l)\\cptn \\\n (\\,(P,s)#(Q,t)#l) \\ assum (p,R) \\\n t \\ Normal ` q \\\n (\\,(Q,t)#l) \\ assum (q,R) \n \" \nproof -\n assume a0: \"(\\,(P,s)#(Q,t)#l)\\cptn\" and\n a1: \"(\\,(P,s)#(Q,t)#l) \\ assum (p,R)\" and\n a2: \"t \\ Normal ` q\" \n then have \"env_tran_right \\ ((P,s)#(Q,t)#l) R\"\n using env_tran_right_def a1 unfolding assum_def\n by force\n then have \"env_tran_right \\ ((Q,t)#l) R\"\n using env_tran_tail by auto\n thus ?thesis using a2 unfolding assum_def env_tran_right_def by auto\nqed\n \nlemma sub_assum:\n assumes a0: \"(\\,(x#l0)@l1) \\ assum (p,R)\"\n shows \"(\\,x#l0) \\ assum (p,R)\" \nproof -\n {have p0:\"snd x \\ Normal ` p\" \n using a0 unfolding assum_def by force\n then have \"env_tran_right \\ ((x#l0)@l1) R\"\n using a0 unfolding assum_def \n by (auto simp add: env_tran_right_def)\n then have env:\"env_tran_right \\ (x#l0) R\" \n using env_tran_subr by blast \n also have \"snd ((x#l0)!0) \\ Normal ` p\" \n using p0 by fastforce\n ultimately have \"snd ((x#l0)!0) \\ Normal ` p \\ \n (\\i. Suc i \n \\\\\\<^sub>c((x#l0)!i) \\\\<^sub>e ((x#l0)!(Suc i)) \\ \n (snd((x#l0)!i), snd((x#l0)!(Suc i))) \\ R)\"\n unfolding env_tran_right_def by auto\n } \n then show ?thesis unfolding assum_def by auto\nqed \n\nlemma sub_assum_r:\n assumes a0: \"(\\,l0@x1#l1) \\ assum (p,R)\" and\n a1: \"(snd x1) \\ Normal ` q\"\n shows \"(\\,x1#l1) \\ assum (q,R)\"\nproof -\n have \"env_tran_right \\ (l0@x1#l1) R\"\n using a0 unfolding assum_def env_tran_right_def\n by fastforce\n then have \"env_tran_right \\ (x1#l1) R\"\n using env_tran_subl by auto\n thus ?thesis using a1 unfolding assum_def env_tran_right_def by fastforce\nqed\n\ndefinition comm :: \n \"(('s,'f) tran) set \\ \n ('s set \\ 's set) \\\n 'f set \\ \n (('s,'p,'f,'e) confs) set\" where\n \"comm \\ \\(guar, (q,a)) F. \n {c. snd (last (snd c)) \\ Fault ` F \\ \n (\\i. \n Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\ ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ guar) \\ \n (final (last (snd c)) \\ \n ((fst (last (snd c)) = Skip \\ \n snd (last (snd c)) \\ Normal ` q)) \\\n (fst (last (snd c)) = Throw \\ \n snd (last (snd c)) \\ Normal ` a))}\"\n\ndefinition comm1 :: \n \"(('s,'f) tran) set \\ \n ('s set \\ 's set) \\\n 'f set \\ \n (('s,'p,'f,'e) confs) set\" where\n \"comm1 \\ \\(guar, (q,a)) F. \n {(\\,comp). snd (last comp) \\ Fault ` F \\ \n (\\i. \n Suc i \n \\\\\\<^sub>c(comp!i) \\ (comp!(Suc i)) \\ \n (snd(comp!i), snd(comp!(Suc i))) \\ guar) \\ \n (final (last comp) \\ \n ((fst (last comp) = Skip \\ \n snd (last comp) \\ Normal ` q)) \\\n (fst (last comp) = Throw \\ \n snd (last comp) \\ Normal ` a))}\"\n\nlemma comm_dest:\n\"(\\, l)\\ comm (G,(q,a)) F \\\n snd (last l) \\ Fault ` F \\\n (\\i. Suc i\n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\nunfolding comm_def\napply clarify\napply (drule mp)\napply fastforce\napply (erule conjE)\napply (erule allE)\nby auto\n\nlemma comm_dest1:\n\"(\\, l)\\ comm (G,(q,a)) F \\\n snd (last l) \\ Fault ` F \\\n Suc i\n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\\n(snd(l!i), snd(l!(Suc i))) \\ G\"\nunfolding comm_def\napply clarify\napply (drule mp)\napply fastforce\napply (erule conjE)\napply (erule allE)\nby auto\n\nlemma comm_dest2:\n assumes a0: \"(\\, l)\\ comm (G,(q,a)) F\" and\n a1: \"final (last l)\" and\n a2: \"snd (last l) \\ Fault ` F\" \n shows \" ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\nproof -\n show ?thesis using a0 a1 a2 unfolding comm_def by auto\nqed\n\nlemma comm_des3:\n assumes a0: \"(\\, l)\\ comm (G,(q,a)) F\" and\n a1: \"snd (last l) \\ Fault ` F\"\n shows \"final (last l) \\ ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\nusing a0 a1 unfolding comm_def by auto\n\nlemma commI:\n assumes a0:\"snd (last l) \\ Fault ` F \\\n (\\i. \n Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G) \\ \n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\nshows \"(\\,l)\\comm (G, (q,a)) F\"\nusing a0 unfolding comm_def\napply clarify\nby simp\n\nlemma comm_conseq:\n \"(\\,l) \\ comm(G', (q',a')) F \\\n G' \\ G \\\n q' \\ q \\\n a' \\ a \\\n (\\,l) \\ comm (G,(q,a)) F\"\nproof -\n assume a0:\"(\\,l) \\ comm(G', (q',a')) F\" and\n a1:\" G' \\ G \\\n q' \\ q \\\n a' \\ a\"\n {\n assume a:\"snd (last l) \\ Fault ` F \"\n have l:\"(\\i. \n Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a00:\"Suc i\\\\<^sub>c(l!i) \\ (l!(Suc i))\" \n have \"(snd(l!i), snd(l!(Suc i))) \\ G\" \n proof -\n have \"(snd(l!i), snd(l!(Suc i))) \\ G'\"\n using comm_dest1 [OF a0 a a00 a11] by auto\n thus ?thesis using a1 unfolding Satis_def sep_conj_def by fastforce\n qed\n } thus ?thesis by auto\n qed \n have \"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof -\n {assume a33:\"final (last l)\"\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q')) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a')\"\n using comm_dest2[OF a0 a33 a] by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\"\n using a1 by fastforce\n } thus ?thesis by auto\n qed\n note res1 = conjI[OF l this] \n } thus ?thesis unfolding comm_def by simp\nqed \n\nlemma no_comp_tran_no_final_comm:\n assumes a0:\"\\i final (l!i)\" and\n a1:\"\\i0\"\n shows \"(\\,l)\\comm(G, (q,a)) F\"\nproof-\n have n_comp:\"\\i. Suc i < length l \\ \\ (\\\\\\<^sub>c (l!i) \\ (l!Suc i))\" using a1\n by (metis Suc_lessD mod_env_not_component prod.collapse)\n {assume a00:\"snd (last l) \\ Fault ` F\" \n {fix i\n assume \"Suc i< length(l)\" and \n \"\\\\\\<^sub>c(l!i) \\ (l!(Suc i))\" \n then have False using n_comp by auto\n }\n moreover {\n assume \"final (last l)\"\n then have False using a0 a2\n using last_conv_nth by force\n }\n ultimately have ?thesis unfolding comm_def using a00 by auto\n } thus ?thesis unfolding comm_def by auto \nqed\n\ndefinition com_validity :: \n \"('s,'p,'f,'e) body \\ 'f set \\ ('s,'p,'f,'e) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ bool\" \n (\"_ \\\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n \\s. cp \\ Pr s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n\ndefinition com_cvalidity::\n \"('s,'p,'f,'e) body \\\n ('s,'p,'f,'e) sextuple set \\\n 'f set \\\n ('s,'p,'f,'e) com \\ \n 's set \\ \n (('s,'f) tran) set \\ \n (('s,'f) tran) set \\ \n 's set \\ \n 's set \\\n bool\" \n (\"_,_ \\\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \n \\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\ndefinition com_validityn :: \n \"('s,'p,'f,'e) body \\ nat \\ 'f set \\ ('s,'p,'f,'e) com \\ \n 's set \\ (('s,'f) tran) set \\ (('s,'f) tran) set \\ \n 's set \\ 's set \\ bool\" \n (\"_ \\_\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,0,60,0,0,0,0,0,0] 45) where\n \"\\ \\n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n \\s. cpn n \\ Pr s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n\ndefinition com_cvalidityn::\n \"('s,'p,'f,'e) body \\\n ('s,'p,'f,'e) sextuple set \\ nat \\\n 'f set \\\n ('s,'p,'f,'e) com \\ \n 's set \\ \n (('s,'f) tran) set \\ \n (('s,'f) tran) set \\ \n 's set \\ \n 's set \\\n bool\" \n (\"_,_ \\_\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,0,0,0,0,0,0,0] 45) where\n \"\\,\\ \\n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \n \\ \\n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\n\nlemma com_valid_iff_nvalid:\"(\\ \\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]) = (\\n. \\ \\n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])\"\n apply (simp only: com_validity_def com_validityn_def cp_def cpn_def cptn_eq_cptn_mod_nest)\n by fast\n\nlemma com_cnvalid_to_cvalid: \"(\\n. (\\,\\\\n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])) \\ (\\,\\\\\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])\"\n apply (unfold com_cvalidityn_def com_cvalidity_def com_valid_iff_nvalid [THEN eq_reflection])\n by fast\n\n\nlemma etran_in_comm:\n \"(\\,(P, t) # xs) \\ comm(G, (q,a)) F \\ \n \\ (\\\\\\<^sub>c((P,s)) \\ ((P,t))) \\\n (\\,(P, s) # (P, t) # xs) \\ cptn \\ \n (\\,(P, s) # (P, t) # xs) \\ comm(G, (q,a)) F\" \nproof -\n assume a1:\"(\\,(P, t) # xs) \\ comm(G, (q,a)) F\" and\n a2:\"\\ \\\\\\<^sub>c((P,s)) \\ ((P,t))\" and\n a3:\"(\\,(P, s) # (P, t) # xs) \\ cptn\"\n show ?thesis using comm_def a1 a2 a3\n proof -\n {\n let ?l1 = \"(P, t) # xs\"\n let ?l = \"(P, s) # ?l1\"\n assume a00:\"snd (last ?l) \\ Fault ` F\"\n have concl:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have p1:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(?l1!i) \\ (?l1!(Suc i)) \\ \n (snd(?l1!i), snd(?l1!(Suc i))) \\ G)\"\n using a1 a3 a00 unfolding comm_def by auto\n have \"(snd (?l ! i), snd (?l ! Suc i)) \\ G\" \n proof (cases i)\n case 0 \n have \"\\\\\\<^sub>c (P, s) \\ (P, t)\" using a12 0 by auto\n thus ?thesis using a2 by auto \n next\n case (Suc n) thus ?thesis\n proof -\n have f1: \"\\\\\\<^sub>c ((P, t) # xs) ! n \\ ((P, t) # xs) ! Suc n\"\n using Suc a12 by fastforce\n have f2: \"Suc n < length ((P, t) # xs)\"\n using Suc a11 by fastforce \n have \"snd (last ((P, t) # xs)) \\ Fault ` F\"\n by (metis (no_types) a00 last.simps list.distinct(1))\n hence \"(snd (((P, t) # xs) ! n), snd (((P, t) # xs) ! Suc n)) \\ G\"\n using f2 f1 a1 comm_dest1 by blast \n thus ?thesis\n by (simp add: Suc)\n qed \n qed\n } thus ?thesis by auto\n qed\n have concr:\"(final (last ?l) \\ \n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q)) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a))\"\n using a1 a00 unfolding comm_def by auto\n note res1=conjI[OF concl concr] } \n thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma ctran_in_comm: \n \" (Normal s,Normal s) \\ G \\\n (\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F \\ \n (\\,(P, Normal s) # (Q, Normal s) # xs) \\ comm(G, (q,a)) F\"\nproof -\n assume a1:\"(Normal s,Normal s) \\ G\" and\n a2:\"(\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F\" \n show ?thesis using comm_def a1 a2\n proof -\n {\n let ?l1 = \"(Q, Normal s) # xs\"\n let ?l = \"(P, Normal s) # ?l1\"\n assume a00:\"snd (last ?l) \\ Fault ` F\"\n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have p1:\"(\\i. Suc i \n \\\\\\<^sub>c(?l1!i) \\ (?l1!(Suc i)) \\ \n (snd(?l1!i), snd(?l1!(Suc i))) \\ G)\"\n using a2 a00 unfolding comm_def by auto\n have \"(snd (?l ! i), snd (?l ! Suc i)) \\ G\" \n proof (cases i)\n case 0 \n then have \"snd (((P, Normal s) # (Q, Normal s) # xs) ! i) = Normal s \\ \n snd (((P, Normal s) # (Q, Normal s) # xs) ! (Suc i)) = Normal s\" \n by fastforce\n also have \"(Normal s, Normal s) \\ G\"\n using Satis_def a1 by blast\n ultimately show ?thesis using a1 Satis_def by auto \n next\n case (Suc n) thus ?thesis using p1 a2 a11 a12 \n proof -\n have f1: \"\\\\\\<^sub>c ((Q, Normal s) # xs) ! n \\ ((Q, Normal s) # xs) ! Suc n\"\n using Suc a12 by fastforce\n have f2: \"Suc n < length ((Q, Normal s) # xs)\"\n using Suc a11 by fastforce\n thus ?thesis using Suc f1 nth_Cons_Suc p1 by auto \n qed \n qed\n } thus ?thesis by auto\n qed\n have concr:\"(final (last ?l) \\ \n snd (last ?l) \\ Fault ` F \\\n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q)) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a))\"\n using a2 unfolding comm_def by auto\n note res=conjI[OF concl concr]}\n thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma not_final_in_comm:\n \"(\\,(Q, Normal s) # xs) \\ comm(G, (q,a)) F \\\n \\ final (last ((Q, Normal s) # xs)) \\\n (\\,(Q, Normal s) # xs) \\ comm(G, (q',a')) F\"\nunfolding comm_def by force\n\nlemma comm_union:\n assumes \n a0: \"(\\,xs) \\ comm(G, (q,a)) F\" and\n a1: \"(\\,ys) \\ comm(G, (q',a')) F\" and\n a2: \"xs\\[] \\ ys\\[]\" and\n a3: \"( snd (last xs),snd (ys!0)) \\ G\" and\n a4: \"(\\,xs@ys) \\ cptn\"\n shows \"(\\,xs@ys) \\ comm(G, (q',a')) F\" \nproof -\n{\n let ?l=\"xs@ys\" \n assume a00:\"snd (last (xs@ys)) \\ Fault ` F\"\n have last_ys:\"last (xs@ys) = last ys\" using a2 by fastforce\n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(?l!i) \\ (?l!(Suc i)) \\ \n (snd(?l!i), snd(?l!(Suc i))) \\ G)\"\n proof -\n {fix i ns ns'\n assume a11:\"Suc i < length ?l\" and\n a12:\"\\\\\\<^sub>c (?l ! i) \\ ( ?l ! Suc i)\" \n have all_ys:\"\\i\\length xs. (xs@ys)!i = ys!(i-(length xs))\"\n by (simp add: nth_append) \n have all_xs:\"\\i G\"\n proof (cases \"Suc i>length xs\")\n case True \n have \"Suc (i - (length xs)) < length ys\" using a11 True by fastforce\n moreover have \"\\\\\\<^sub>c (ys ! (i-(length xs))) \\ ( ys ! ((Suc i)-(length xs)))\" \n using a12 all_ys True by fastforce \n moreover have \"snd (last ys) \\ Fault ` F\" using last_ys a00 by fastforce \n ultimately have \"(snd(ys!(i-(length xs))), snd(ys!Suc (i-(length xs)))) \\ G\" \n using a1 comm_dest1[of \\ ys G q' a' F \"i-length xs\"] True Suc_diff_le by fastforce \n thus ?thesis using True all_ys Suc_diff_le by fastforce\n next\n case False note F1=this thus ?thesis \n proof (cases \"Suc i < length xs\")\n case True \n then have \"snd ((xs@ys)!(length xs -1)) \\ Fault ` F\"\n using a00 a2 a4 \n by (simp add: last_not_F ) \n then have \"snd (last xs) \\ Fault ` F\" using all_xs a2 by (simp add: last_conv_nth ) \n moreover have \"\\\\\\<^sub>c (xs ! i) \\ ( xs ! Suc i)\" \n using True all_xs a12 by fastforce \n ultimately have\"(snd(xs!i), snd(xs!(Suc i))) \\ G\"\n using a0 comm_dest1[of \\ xs G q a F i] True by fastforce\n thus ?thesis using True all_xs by fastforce\n next\n case False\n then have suc_i:\"Suc i = length xs\" using F1 by fastforce\n then have i:\"i=length xs -1\" using a2 by fastforce \n then show ?thesis using a3 \n by (simp add: a2 all_xs all_ys last_conv_nth ) \n qed\n qed\n } thus ?thesis by auto \n qed\n have concr:\"(final (last ?l) \\ \n ((fst (last ?l) = Skip \\ \n snd (last ?l) \\ Normal ` q')) \\\n (fst (last ?l) = Throw \\ \n snd (last ?l) \\ Normal ` a'))\"\n using a1 last_ys a00 a2 comm_des3 by fastforce\n note res=conjI[OF concl concr]}\n thus ?thesis unfolding comm_def by auto \nqed\n\n\n\nlemma cpn_rule1:\"(\\s. cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F) \\\n (\\s l. (\\,l)\\cpn n \\ P s \\ (\\,l)\\ assum (p, R) \\ (\\,l) \\ comm(G, (q,a)) F)\"\nproof-\n assume a0:\"\\s. cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n {fix s l \n assume a00:\"(\\,l)\\cpn n \\ P s \\ (\\,l)\\ assum (p, R)\" \n then have \"cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F\" using a0 by auto \n then have \"(\\,l) \\ comm(G, (q,a)) F\" using a00 unfolding cpn_def assum_def comm_def\n by blast\n } then show ?thesis by auto\n qed\n\nlemma cpn_rule2:\"(\\s l. (\\,l)\\cpn n \\ P s \\ (\\,l)\\ assum (p, R) \\ (\\,l) \\ comm(G, (q,a)) F) \\\n (\\s. cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F)\"\nproof-\n assume a0:\"\\s l. (\\,l)\\cpn n \\ P s \\ (\\,l)\\ assum (p, R) \\ (\\,l) \\ comm(G, (q,a)) F\"\n {fix s l\n assume a00:\"(\\,l)\\ cpn n \\ P s \\ (\\,l)\\assum(p, R)\" \n then have \"(\\,l) \\ comm(G, (q,a)) F\" using a0 unfolding cpn_def assum_def comm_def\n by blast\n } then show ?thesis unfolding cpn_def by fastforce\n qed\n\nlemma cpn_rule:\"(\\s l. (\\,l)\\cpn n \\ P s \\ (\\,l)\\ assum (p, R) \\ (\\,l) \\ comm(G, (q,a)) F) =\n (\\s. cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F)\"\n using cpn_rule1 cpn_rule2\n by metis\n\nlemma split_list_i:\"i\n \\l1 l2. l = l1@(l!i#l2)\"\nproof(induct l arbitrary: i)\n case Nil\n then show ?case by auto\nnext\n case (Cons a l)\n then show ?case\n using id_take_nth_drop by blast\nqed\n\nlemma sub_assum1:\n assumes a0: \"(\\,l0@l1) \\ assum (p,R)\" and a1:\"l0\\[]\"\n shows \"(\\,l0) \\ assum (p,R)\"\n by (metis a0 a1 append_self_conv2 id_take_nth_drop length_greater_0_conv sub_assum take_0) \n \n\n\n(* text{* \n@{text rel_safe} specifies that the relation leaves unmodifed any fragment out of the \nstate\n*}\ndefinition rel_safe:: \"(('l::sep_algebra,'g::sep_algebra) transition \\ bool) \\ bool\"\nwhere\n\"rel_safe R \\ \\h h1 h2 t. R (h1,t) \\ ((h1 \\\\<^sub>p h2) h) \\ R (h, t \\ h2)\"\n\ndefinition mem_safe::\n\"(('l::sep_algebra,'g::sep_algebra) state,'p,'f) body \\ \n (('l,'g) state,'p,'f) com \\ \n (('l,'g) transition \\ bool) \\ \n bool\"\nwhere\n \"mem_safe \\ f R \\ \\h h1 h2 t1. \n ((\\c\\ cp \\ f (Normal h1). \n final_valid(last (snd c)) \\ (Normal t1 = snd (last (snd c))) \\\n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ \n (case_prod (\\x y. (Normal x, Normal y))) ` (R))) \\ \n (h1 \\\\<^sub>p h2) h \\\n (\\c\\ cp \\ f (Normal h). \n final_valid(last (snd c)) \\\n (\\i. Suc i \n (fst c)\\\\<^sub>c((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ \n (case_prod (\\x y. (Normal x, Normal y))) ` (R)) \\\n (Normal (t1 \\ h2) = snd (last (snd c))))) \n \" \n *)\n\n \nsubsection \\Validity for Parallel Programs.\\\ndefinition All_End :: \"('s,'p,'f,'e) par_config \\ bool\" where\n \"All_End xs \\ fst xs \\[] \\ (\\i \n (('s,'f) tran) set) \\\n (('s,'p,'f,'e) par_confs) set\" where\n \"par_assum \\ \n \\(pre, rely). {c. \n snd((snd c)!0) \\ Normal ` pre \\ (\\i. Suc i \n (fst c)\\\\<^sub>p((snd c)!i) \\\\<^sub>e ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ rely)}\"\n \ndefinition par_comm :: \n \"((('s,'f) tran) set \\ \n ('s set \\ 's set)) \\ \n 'f set \\\n (('s,'p,'f,'e) par_confs) set\" where\n \"par_comm \\ \n \\(guar, (q,a)) F. \n {c. snd (last (snd c)) \\ Fault ` F \\ \n (\\i. \n Suc i \n (fst c)\\\\<^sub>p((snd c)!i) \\ ((snd c)!(Suc i)) \\ \n (snd((snd c)!i), snd((snd c)!(Suc i))) \\ guar) \\ \n (All_End (last (snd c)) \\ \n (\\j \n snd (last (snd c)) \\ Normal ` a) \\\n (\\j\n snd (last (snd c)) \\ Normal ` q))}\"\n\ndefinition par_com_validity :: \n \"('s,'p,'f,'e) body \\ \n 'f set \\\n ('s,'p,'f,'e) par_com \\ \n ('s set) \\ \n ((('s,'f) tran) set) \\ \n ((('s,'f) tran) set) \\ \n ('s set) \\\n ('s set) \\ \n bool\" \n(\"_ \\\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\ \\\\<^bsub>/F\\<^esub> Ps SAT [pre, R, G, q,a] \\ \n \\s. par_cp \\ Ps s \\ par_assum(pre, R) \\ par_comm(G, (q,a)) F\"\n \ndefinition par_com_cvalidity :: \n \"('s,'p,'f,'e) body \\\n ('s,'p,'f,'e) sextuple set \\\n 'f set \\\n ('s,'p,'f,'e) par_com \\ \n ('s set) \\ \n ((('s,'f) tran) set) \\ \n ((('s,'f) tran) set) \\ \n ('s set) \\\n ('s set) \\ \n bool\" \n(\"_,_ \\\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a] \\ \n (\\(c,p,R,G,q,a)\\ \\. (\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])) \\\n \\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a]\"\n \ndeclare Un_subset_iff [simp del] sup.bounded_iff [simp del]\n\ninductive\nlrghoare :: \"[('s,'p,'f,'e) body,\n ('s,'p,'f,'e) sextuple set,\n 'f set,\n ('s,'p,'f,'e) com, \n ('s set), \n (('s,'f) tran) set, (('s,'f) tran) set,\n 's set,\n 's set] \\ bool\"\n (\"_,_ \\\\<^bsub>'/_\\<^esub> _ sat [_, _, _, _,_]\" [61,61,60,60,0,0,0,0] 45)\nwhere\n Skip: \"\\ Sta q R; (\\s. (Normal s, Normal s) \\ G) \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [q, R, G, q,a] \"\n\n|Spec: \"\\Sta p R;Sta q R;\n (\\s t. s\\p \\ (s,t)\\r \\ (Normal s,Normal t) \\ G);\n p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)} \\ \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> (Spec r e) sat [p, R, G, q,a]\"\n\n| Basic: \"\\ Sta p R;Sta q R;\n (\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G);\n p \\ {s. f s \\ q} \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Basic f e) sat [p, R, G, q,a]\"\n\n| If: \"\\Sta p R; (\\s. (Normal s, Normal s) \\ G); \n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]; \n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p, R, G, q,a]\"\n\n| While: \"\\ Sta p R; Sta (p \\ (-b)) R; Sta a R; (\\s. (Normal s,Normal s) \\ G);\n \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (While b c) sat [p, R, G, p \\ (-b),a]\"\n\n| Seq: \"\\Sta a R; Sta p R; (\\s. (Normal s,Normal s) \\ G); \n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]; \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\n\n| Await: \"\\ Sta p R; Sta q R; Sta a R;\n \\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Await b c e) sat [p, R, G, q,a]\"\n\n| Guard: \"\\Sta (p \\ g) R; (\\s. (Normal s, Normal s) \\ G); \n \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ g, R, G, q,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c) sat [p \\ g, R, G, q,a]\"\n\n| Guarantee: \"\\ Sta p R; (\\s. (Normal s, Normal s) \\ G); f\\F;\n \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p \\ g, R, G, q,a] \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Guard f g c) sat [p, R, G, q,a]\"\n\n| CallRec: \"\\(c,p,R,G,q,a) \\ Specs; \n \\(c,p,R,G,q,a)\\ Specs. c \\ dom \\ \\ \n Sta p R \\ (\\s. (Normal s,Normal s) \\ G)\\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p, R, G, q,a];\n Sta p R; (\\s. (Normal s, Normal s) \\ G)\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| Asm: \"\\(c,p,R,G,q,a) \\ \\\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| Call: \"\\\n Sta p R; (\\s. (Normal s, Normal s) \\ G);c \\ dom \\; \n \\,\\ \\\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p, R, G, q,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| DynCom: \"\\(Sta p R) \\ (Sta q R) \\ (Sta a R) \\\n (\\s. (Normal s,Normal s) \\ G);\n (\\s \\ p. (\\,\\\\\\<^bsub>/F\\<^esub> (c s) sat [p, R, G, q,a]))\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> (DynCom c) sat [p, R, G, q,a]\"\n\n| Throw: \"\\Sta a R; (\\s. (Normal s, Normal s) \\ G) \\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> Throw sat [a, R, G, q,a] \"\n\n| Catch: \"\\Sta q R; (\\s. (Normal s, Normal s) \\ G); \n \\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]; \n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\\ \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\n\n| Conseq: \"\\s \\ p. \n (\\p' R' G' q' a' \\'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\ \n (\\,\\'\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) ) \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n\n| Conj_post: \" \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a] \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q \\ q',a \\ a']\"\n \n| Conj_Inter: \"sa\\({}::nat set) \\ \n \\i\\sa. \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G,\\i\\sa. q i,a]\" \n\n \ninductive_cases hoare_elim_cases [cases set]:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\nthm hoare_elim_cases\n(*\nlemma \"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a] \\ \n \\s \\ p. \n (\\p' R' G' q' a'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n (\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\ p'=q' \\ Sta q' R' \\ Norm R' \\ (\\s. (Normal s, Normal s) \\ G'))\"\nproof -\n assume a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\" \n {\n fix s\n assume a01:\"s\\p\"\n have \"(\\p' R' G' q' a'. \n (s\\ p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \n (\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\ p'=q' \\ Sta q' R' \\ Norm R' \\ (\\s. (Normal s, Normal s) \\ G'))\"\n proof (cases \"p=q\")\n case True thus ?thesis using hoare_elim_cases sorry\n next\n case False thus ?thesis sorry\n qed\n } thus ?thesis by fastforce\nqed*)\n\n(* lemma \"\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,r] \\\n c\\Throw \\\n Sta p R\"\nsorry *)\n(*\n| Env: \"\\noawaits c; \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> (p ) (sequential c) q,(a)\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p, sep_empty, Emp, Emp, q,a]\"\n \n| Hide: \"\\\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, (I \\* I'), (R \\* R'), (G \\* G'), q,a]; \n (I \\ R); \n (I \\ G)\n \\ \\ \n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p, I, R, G, q,a]\" \n\n|Frame: \"\\\n \\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, I, R, G , q,a]; \n I' \\ R'; I' \\ G';\n Sta r (R'\\*tran_Id);\n (\\s t. (r imp (I'\\*sep_true))(s,t));\n (rel_safe R); (rel_safe (G\\*tran_True)) \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> c sat [p\\*r, I \\* I', R \\* R', G \\* G', q\\*r,a\\*r]\"\n*)\n\n\ndefinition Pre :: \" ('s,'p,'f,'e)rgformula \\ ('s set)\" where\n \"Pre x \\ fst(snd x)\"\n\ndefinition Post :: \"('s,'p,'f,'e) rgformula \\ ('s set)\" where\n \"Post x \\ fst(snd(snd(snd(snd x))))\"\n\ndefinition Abr :: \"('s,'p,'f,'e) rgformula \\ ('s set)\" where\n \"Abr x \\ snd(snd(snd(snd(snd x))))\"\n\ndefinition Rely :: \"('s,'p,'f,'e) rgformula \\ (('s,'f) tran) set\" where\n \"Rely x \\ fst(snd(snd x))\"\n\ndefinition Guar :: \"('s,'p,'f,'e) rgformula \\ (('s,'f) tran) set\" where\n \"Guar x \\ fst(snd(snd(snd x)))\"\n\ndefinition Com :: \"('s,'p,'f,'e) rgformula \\ ('s ,'p,'f,'e) com\" where\n \"Com x \\ fst x\"\n\n\ninductive\n par_rghoare :: \"[('s,'p,'f,'e) body,\n ('s,'p,'f,'e) sextuple set,\n 'f set,\n ( ('s,'p,'f,'e) rgformula) list, \n 's set, \n (('s,'f) tran) set, (('s,'f) tran) set,\n 's set,\n 's set] \\ bool\"\n (\"_,_ \\\\<^bsub>'/_\\<^esub> _ SAT [_, _, _, _,_]\" [61,60,60,0,0,0,0] 45)\nwhere\n Parallel:\n \"\\ \\i (\\j\\{j. j j\\i}. (Guar(xs!j))) \\ (Rely(xs!i));\n (\\j G;\n p \\ (\\ii q;\n (\\i a; \n \\i,\\ \\\\<^bsub>/F\\<^esub> Com(xs!i) sat [Pre(xs!i),Rely(xs!i),Guar(xs!i),Post(xs!i),Abr(xs!i)] \\\n \\ \\,\\ \\\\<^bsub>/F\\<^esub> xs SAT [p, R, G, q,a]\" \n \nsection {* Soundness *}\n\nlemma skip_suc_i:\n assumes a1:\"(\\, l) \\ cptn \\ fst (l!i) = Skip\" \n assumes a2:\"i+1 < length l\"\n shows \"fst (l!(i+1)) = Skip\"\nproof -\n from a2 a1 obtain l1 ls where \"l=l1#ls\" \n by (metis list.exhaust list.size(3) not_less0) \n then have \"\\\\\\<^sub>c (l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n by fastforce \n thus ?thesis using a1 a2 step_ce_elim_cases\n by (metis (no_types) Suc_eq_plus1 not_eq_not_env prod.collapse stepc_elim_cases(1))\nqed \n\nlemma throw_suc_i:\n assumes a1:\"(\\, l) \\ cptn \\ (fst(l!i) = Throw \\ snd(l!i) = Normal s1)\" \n assumes a2:\"Suc i < length l\"\n assumes a3:\"env_tran_right \\ l rely \\ Sta q rely \\ s1 \\ q\"\n shows \"fst (l!(Suc i)) = Throw \\ (\\s2. snd(l!(Suc i)) = Normal s2 \\ s2 \\q)\"\nproof -\n have fin:\"final (l!i)\" using a1 unfolding final_def by auto \n from a2 a1 obtain l1 ls where \"l=l1#ls\" \n by (metis list.exhaust list.size(3) not_less0) \n then have \"\\\\\\<^sub>c (l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n by fastforce then have \"\\\\\\<^sub>c (l!i) \\ (l!(Suc i)) \\ \\\\\\<^sub>c (l!i) \\\\<^sub>e (l!(Suc i))\"\n using step_ce_elim_cases by blast\n thus ?thesis proof \n assume \"\\\\\\<^sub>c (l!i) \\ (l!(Suc i))\" thus ?thesis using fin no_step_final' by blast\n next\n assume \"\\\\\\<^sub>c (l!i) \\\\<^sub>e (l!(Suc i))\" thus ?thesis \n using a1 a3 a2 env_tran_normal by (metis (no_types, lifting) env_c_c' prod.collapse) \n qed \nqed \n\nlemma i_skip_all_skip:assumes a1:\"(\\, l) \\ cptn \\ fst (l!i) = Skip\"\n assumes a2: \"i\\j \\ j < (length l)\"\n assumes a3:\"n=j-i\"\n (* assumes a4:\"env_tran_right \\ l rely\" *)\n shows \"fst (l!j) = Skip\"\nusing a1 a2 a3\nproof (induct n arbitrary: i j)\n case 0\n then have \"Suc i = Suc j\" by simp \n thus ?case using \"0.prems\" skip_suc_i by fastforce\nnext\n case (Suc n) \n then have \"length l > Suc i\" by auto \n then have \"i, l) \\ cptn \\ (fst (l!i) = Throw \\ snd (l!i) = Normal s1)\"\n assumes a2: \"i\\j \\ j < (length l)\"\n assumes a3:\"n=j-i\"\n assumes a4:\"env_tran_right \\ l rely \\ Sta q rely \\ s1\\q\" \n shows \"fst (l!j) = Throw \\ (\\s2. snd(l!j) = Normal s2 \\ s2\\q)\"\nusing a1 a2 a3 a4\nproof (induct n arbitrary: i j s1)\n case 0\n then have \"Suc i = Suc j\" by simp \n thus ?case using \"0.prems\" skip_suc_i by fastforce\nnext\n case (Suc n) \n then have l_suc:\"length l > Suc i\" by linarith \n then have \"ii < j\\ Suc(4))\n ultimately obtain s2 where \"fst (l ! (j-1)) = LanguageCon.com.Throw \\ snd (l ! (j-1)) = Normal s2 \\ s2\\q\"\n using Suc(1)[of i s1 \"j-1\"] Suc(2) Suc(5)\n by (metis (no_types, lifting) Suc_diff_Suc diff_Suc_eq_diff_pred diff_zero less_imp_Suc_add not_le not_less_eq_eq zero_less_Suc) \n also have \"Suc (j - 1) < length l\" using Suc by arith\n ultimately have \"fst (l ! (j)) = LanguageCon.com.Throw \\ (\\s2. snd(l!j) = Normal s2 \\ s2\\q)\" \n using Suc(2-5) throw_suc_i[of \\ l \"j-1\" s2 rely q] a4\n by fastforce\n also have \"j=j\" using Cons using Suc.prems(2) by linarith \n ultimately show ?case using Suc by (metis (no_types))\nqed \n\nlemma only_one_component_tran_j:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Skip \\ fst (l!i) = Throw \" and \n a1': \"snd (l!i) = Normal x \\ x \\ q\" and\n a2: \"i\\j \\ Suc j < length l\" and\n a3: \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and \n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\"\nproof - \n have \"fst (l!j) = Skip \\ (fst (l!i) = Throw \\ snd(l!i) = Normal x)\" \n using a0 a1 a1' a2 a3 a4 i_skip_all_skip by fastforce \n also have \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" using a3 by fastforce \n ultimately show ?thesis\nby (meson SmallStepCon.final_def SmallStepCon.no_step_final' Suc_lessD a0 a2 a4 i_throw_all_throw a1') \nqed \n\nlemma only_one_component_tran_all_j:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Skip \\ (fst (l!i) = Throw \\ snd(l!i) = Normal s1)\" and \n a1': \"snd (l!i) = Normal x \\ x \\ q\" and\n a2: \"Suc ij. i\\j \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\" \nusing a0 a1 a2 a3 a4 a1' only_one_component_tran_j \nby (metis lessI less_Suc_eq_le) \n\n\nlemma zero_skip_all_skip: \n assumes a1:\"(\\, l) \\ cptn \\ fst (l!0) = Skip \\ i < length l\"\n shows \"fst (l!i) = Skip\"\nusing a1 i_skip_all_skip by blast\n\nlemma all_skip:\n assumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = (Skip,s)\"\nshows \"(\\i, l) \\ cptn \\ fst (l!0) = Throw \\ \n snd(l!0) = Normal s1 \\ i < length l \\ s1\\q\"\n assumes a2: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"fst (l!i) = Throw \\ (\\s2. snd (l!i) = Normal s2)\"\nusing a1 a2 i_throw_all_throw by (metis le0) \n\nlemma only_one_component_tran_0:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"(fst (l!0) = Skip) \\ (fst (l!0) = Throw)\" and \n a1': \"snd (l!0) = Normal x \\ x \\ q\" and\n a2: \"Suc j < length l\" and\n a3: \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\" \n shows \"P\" \n proof-\n have a2':\"0\\j \\ Suc j, l) \\ cptn\" and\n a1: \"(Suc jk < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n shows \"(\\k < j. ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\"\nproof -\n {fix k\n assume asm: \"k\\\\<^sub>c(l!k) \\\\<^sub>c\\<^sub>e (l!(Suc k)))\" using a0 cptn_stepc_rtran\n proof -\n obtain nn :: \"nat \\ nat \\ nat\" where\n f1: \"\\x0 x1. (\\v2>x1. x0 = Suc v2) = (x1 < nn x0 x1 \\ x0 = Suc (nn x0 x1))\"\n by moura\n obtain pp :: \"nat \\ (('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ \n ('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate\" and \n pps :: \"nat \\ (('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list \\ \n (('b, 'a, 'c,'d) LanguageCon.com \\ ('b, 'c) xstate) list\" where\n \"\\x0 x1. (\\v2 v3. x1 = v2 # v3 \\ length v3 = x0) = (x1 = pp x0 x1 # pps x0 x1 \\ length (pps x0 x1) = x0)\"\n by moura\n then have f2: \"l = pp (nn (length l) k) l # pps (nn (length l) k) l \\ length (pps (nn (length l) k) l) = nn (length l) k\"\n using f1 by (meson Suc_lessE \\Suc k < length l\\ length_Suc_conv)\n then have f3: \"Suc k < length (pp (nn (length l) k) l # pps (nn (length l) k) l)\"\n by (metis \\Suc k < length l\\)\n have \"(\\, pp (nn (length l) k) l # pps (nn (length l) k) l) \\ cptn\"\n using f2 a0 by presburger\n then have \"\\\\\\<^sub>c (pp (nn (length l) k) l # pps (nn (length l) k) l) ! k \\\\<^sub>c\\<^sub>e (pp (nn (length l) k) l # pps (nn (length l) k) l) ! Suc k\"\n using f3 by (meson cptn_stepc_rtran)\n then show ?thesis\n using f2 by auto\n qed \n also have \"\\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k))))\" using a2 asm by auto\n ultimately have \"((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" using step_ce_elim_cases by blast\n } thus ?thesis by auto\nqed\n\nlemma cptn_i_env_same_prog:\nassumes a0: \"(\\, l) \\ cptn\" and\n a1: \"\\k < j. k\\i \\ (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a2: \"i\\j \\ j < length l\"\nshows \"fst (l!j) = fst (l!i)\"\nusing a0 a1 a2\nproof (induct \"j-i\" arbitrary: l j i)\n case 0 thus ?case by auto \nnext\n case (Suc n) \n then have lenl:\"length l>Suc 0\" by fastforce \n have \"j>0\" using Suc by linarith\n then obtain j1 where prev:\"j=Suc j1\" \n using not0_implies_Suc by blast \n then obtain a0 a1 l1 where l:\"l=a0#l1@[a1]\" \n using Suc lenl by (metis add.commute add.left_neutral length_Cons list.exhaust list.size(3) not_add_less1 rev_exhaust) \n then have al1_cptn:\"(\\,a0#l1)\\ cptn\"\n using Suc.prems(1) Suc.prems(3) tl_in_cptn cptn_dest_2\n by blast\n have i_j:\"i\\j1\" using Suc prev by auto\n have \"\\k < j1. k\\i \\ (\\\\\\<^sub>c((a0#l1)!k) \\\\<^sub>e ((a0#l1)!(Suc k)))\"\n proof -\n {fix k\n assume a0:\"k k\\i\"\n then have \"(\\\\\\<^sub>c((a0#l1)!k) \\\\<^sub>e ((a0#l1)!(Suc k)))\" \n using l Suc(4) prev lenl Suc(5)\n proof - \n have suc_k_j:\"Suc k < j\" using a0 prev by blast\n have j1_l_l1:\"j1 < Suc (length l1)\" \n using Suc.prems(3) l prev by auto\n have \"k < Suc j1\"\n using `k < j1 \\ i \\ k` less_Suc_eq by blast\n hence f3: \"k < j\"\n using prev by blast\n hence ksuc:\"k < Suc (Suc j1)\"\n using less_Suc_eq prev by blast\n hence f4: \"k < Suc (length l1)\"\n using prev Suc.prems(3) l a0 j1_l_l1 less_trans \n by blast \n have f6: \"\\\\\\<^sub>c l ! k \\\\<^sub>e (l ! Suc k)\"\n using f3 Suc(4) a0 by blast\n have k_l1:\"k < length l1\"\n using f3 Suc.prems(3) i_j l suc_k_j by auto \n thus ?thesis\n proof (cases k)\n case 0 thus ?thesis using f6 l k_l1\n by (simp add: nth_append)\n next \n case (Suc k1) thus ?thesis \n using f6 f4 l k_l1 \n by (simp add: nth_append)\n qed\n qed\n }thus ?thesis by auto\n qed\n then have fst:\"fst ((a0#l1)!i)=fst ((a0#l1)!j1)\"\n using Suc(1)[of j1 i \"a0#l1\"] \n Suc(2) Suc(3) Suc(4) Suc(5) prev al1_cptn i_j\n by (metis (mono_tags, lifting) Suc_diff_le Suc_less_eq diff_Suc_1 l length_Cons length_append_singleton)\n have len_l:\"length l = Suc (length (a0#l1))\" using l by auto\n then have f1:\"i, l) \\ cptn \\ i + 1 < length l\"\n shows \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\"\nproof -\n from a1\n obtain a1 l1 where \"l=a1#l1\" using cptn.simps by blast\n thus ?thesis using a1 cptn_stepc_rtran by fastforce\nqed\n\nlemma zero_final_always_env_0: \n assumes a1:\"(\\, l) \\ cptn\" and\n a2: \"fst (l!0) = Skip \\ fst (l!0) = Throw\" and\n a2': \"snd(l!0) = Normal s1 \\ s1\\q\" and\n a3: \"Suc i < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta q rely\"\n shows \"\\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\nproof -\n have \"\\\\\\<^sub>c(l!i) \\\\<^sub>c\\<^sub>e (l!(Suc i))\" using a1 a2 a3 cptn_tran_ce_i by auto \n also have \"\\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" using a1 a2 a3 a4 a2'\n using only_one_component_tran_0 by metis \n ultimately show ?thesis by (simp add: step_ce.simps) \nqed\n\nlemma final_always_env_i: \n assumes a1:\"(\\, l) \\ cptn\" and\n a2: \"fst (l!0) = Skip \\ fst (l!0) = Throw\" and\n a2': \"snd(l!0) = Normal s1 \\ s1\\q\" and\n a3: \"j\\i \\ Suc j l rely \\ Sta q rely\"\n shows \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof -\n have ce_tran:\"\\\\\\<^sub>c(l!j) \\\\<^sub>c\\<^sub>e (l!(Suc j))\" using a1 a2 a3 a4 cptn_tran_ce_i by auto \n then have \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)) \\ \\\\\\<^sub>c(l!j) \\ (l!(Suc j))\" \n using step_ce_elim_cases by blast\n thus ?thesis\n proof\n assume \"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\" then show ?thesis by auto\n next\n assume a01:\"\\\\\\<^sub>c(l!j) \\ (l!(Suc j))\"\n then have \"\\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" \n using a1 a2 a3 a4 a2' only_one_component_tran_j [OF a1] \n by blast\n then show ?thesis using a01 ce_tran by (simp add: step_ce.simps) \n qed\nqed\n\n\nsubsection {*Skip Sound*}\n\nlemma stable_q_r_q: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2:\"(snd(l!i), snd(l!(Suc i))) \\ R\"\n shows \"snd(l!(Suc i)) \\ Normal ` q\"\nusing a0 a1 a2 \nunfolding Sta_def by fastforce \n\nlemma stability:\nassumes a0:\"Sta q R\" and \n a1: \"snd(l!j) \\ Normal ` q\" and\n a2: \"j\\k \\ k < (length l)\" and\n a3: \"n=k-j\" and\n a4: \"\\i. j\\i \\ i < k \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a5:\"env_tran_right \\ l R \"\n shows \"snd (l!k) \\ Normal ` q \\ fst (l!j) = fst (l!k)\"\nusing a0 a1 a2 a3 a4 a5 \nproof (induct n arbitrary: j k)\n case 0\n thus ?case by auto\nnext\n case (Suc n) \n then have \"length l > j + 1\" by arith \n moreover then have \"k-1< length l\" using Suc by fastforce \n moreover then have \"(k - 1) - j = n\" using Suc by fastforce\n moreover then have \"j\\k-1\" using Suc by arith \n moreover have \"\\i. j \\ i \\ i < k-1 \\ \\\\\\<^sub>c (l ! i) \\\\<^sub>e (l ! Suc i)\"\n using Suc by fastforce \n ultimately have induct:\"snd (l! (k-1)) \\ Normal ` q \\ fst (l!j) = fst (l!(k-1))\" using Suc\n by blast \n also have j_1:\"k-1+1=k\" using Cons Suc.prems(4) by auto \n have f1:\"\\i. j\\i \\ i < k \\ (snd((snd (\\,l))!i), snd((snd (\\,l))!(Suc i))) \\ R\"\n using Suc unfolding env_tran_right_def by fastforce\n have k1:\"k - 1 < k\"\n by (metis (no_types) Suc_eq_plus1 j_1 lessI) \n then have \"(snd((snd (\\,l))!(k-1)), snd((snd (\\,l))!(Suc (k-1)))) \\ R\" \n using `j \\ k - 1` f1 by blast \n ultimately have \"snd (l!k) \\ Normal ` q\" using stable_q_r_q Suc(2) Suc(5) by fastforce\n also have \"fst (l!j) = fst (l!k)\"\n proof -\n have \"\\\\\\<^sub>c (l ! (k-1)) \\\\<^sub>e (l ! k)\" using Suc(6) k1 `j\\k-1` by fastforce\n thus ?thesis using k1 prod.collapse env_c_c' induct by metis\n qed\n ultimately show ?case by meson\nqed\n\nlemma stable_only_env_i_j: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2: \"i j < (length l)\" and\n a3: \"n=j-i-1\" and\n a4: \"\\k\\i. k < j \\ \\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))\" and\n a5: \"env_tran_right \\ l R\"\n shows \"snd (l!j) \\ Normal ` q\"\nusing a0 a1 a2 a3 a4 a5 by (meson less_imp_le_nat stability)\n\n \nlemma stable_only_env_1: \n assumes a0:\"Sta q R\" and \n a1: \"snd(l!i) \\ Normal ` q\" and\n a2: \"i j < (length l)\" and\n a3: \"n=j-i-1\" and\n a4: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a5: \"env_tran_right \\ l R\"\n shows \"snd (l!j) \\ Normal ` q\"\nusing a0 a1 a2 a3 a4 a5 \nby (meson stable_only_env_i_j less_trans_Suc)\n\n\nlemma stable_only_env_q: \n assumes a0:\"Sta q R\" and \n a1: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" and\n a2: \"env_tran \\ q l R\"\n shows \"\\i. i < length l \\ snd (l!i) \\ Normal ` q\"\nproof (cases \"0 < length l\")\n case False thus ?thesis using a2 unfolding env_tran_def by fastforce \nnext\n case True \n thus ?thesis \n proof - {\n fix i\n assume aa1:\"i < length l\"\n have post_0:\"snd (l ! 0) \\ Normal ` q \" \n using a2 unfolding env_tran_def by auto\n then have \"snd (l ! i) \\ Normal ` q\" \n proof (cases i) \n case 0 thus ?thesis using post_0 by auto\n next\n case (Suc n) \n \n have \"env_tran_right \\ l R\" \n using a2 env_tran_right_def unfolding env_tran_def by auto\n also have \"0s. (Normal s, Normal s) \\ G)\" and\n a10:\"c \\ cp \\ Skip s\" and\n a11:\"c \\ assum(q, R)\" \n shows \"c \\ comm (G, (q,a)) F\"\nproof - \n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce \n { \n assume \"snd (last l) \\ Fault ` F\"\n have cp:\"l!0=(Skip,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce \n have assum:\"snd(l!0) \\ Normal ` q \\ (\\i. Suc i\n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix i\n assume asuc:\"Suc i (\\1\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n by (metis Suc_lessD cp prod.collapse prod.sel(1) stepc_elim_cases(1) zero_skip_all_skip)\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n then have fst_last_skip:\"fst (last l) = Skip\" \n by (metis `0 < length l` cp diff_less fst_conv zero_less_one zero_skip_all_skip) \n have last_q: \"snd (last l) \\ Normal ` q\" \n proof -\n have env: \"env_tran \\ q l R\" using env_tran_def assum cp by blast\n have env_right:\"env_tran_right \\ l R \" using a0 env_tran_right_def assum cp by metis\n also obtain s1 where \"snd(l!0) = Normal s1 \\ s1\\q\" \n using assum by auto\n ultimately have all_tran_env: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\n using final_always_env_i cp zero_final_always_env_0 a0\n by fastforce\n then have \"\\i. i < length l \\ snd (l!i) \\ Normal ` q\"\n using stable_only_env_q a0 env by fastforce\n thus ?thesis using last_l using len_l by fastforce \n qed\n note res = conjI [OF fst_last_skip last_q]\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr] \n } thus ?thesis using c_prod unfolding comm_def by auto \nqed\n\n\nlemma Skip_sound: \n \"Sta q R \\ \n (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> Skip sat [q,R, G, q,a]\" \nproof-\n assume\n a0:\"Sta q R\" and \n a1:\"(\\s. (Normal s, Normal s) \\ G)\"\n {\n fix s\n have ass:\"cpn n \\ Skip s \\ assum(q, R) \\ comm(G, (q,a)) F\"\n proof- \n { fix c\n assume a10:\"c \\ cpn n \\ Skip s\" and a11:\"c \\ assum(q, R)\"\n then have a10:\"c\\cp \\ Skip s\"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n have \"c\\comm(G, (q,a)) F\" using Skip_sound1[OF a0 a1 a10 a11] by auto \n } thus ?thesis by auto\n qed \n } \n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma Throw_sound1: \n assumes a1:\"Sta a R\" and\n a2:\"(\\s. (Normal s, Normal s) \\ G)\" and\n a10:\"c \\ cp \\ Throw s\" and\n a11:\"c \\ assum(a, R)\"\nshows \"c \\ comm (G, (q,a)) F\"\nproof - \n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce \n {\n assume \"snd (last l) \\ Fault ` F\"\n have cp:\"l!0=(Throw,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (a) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ (R))\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran_right \\ l R\" using cp env_tran_right_def by auto\n obtain a1 where a_normal:\"snd(l!0) = Normal a1 \\ a1 \\ a\"\n using assum by auto\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ (G))\"\n proof -\n { fix i\n assume asuc:\"Suc i (\\s2. snd (l ! i) = Normal s2)\" \n using cp a1 assum a_normal env_tran asuci zero_throw_all_throw\n by fastforce\n then have \"\\ (\\1\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n by (meson SmallStepCon.final_def SmallStepCon.no_step_final') \n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n then have fst_last_skip:\"fst (last l) = Throw\"\n by (metis a1 a_normal cp diff_less env_tran fst_conv len_l zero_less_one zero_throw_all_throw) \n have last_q: \"snd (last l) \\ Normal ` (a)\" \n proof -\n have env: \"env_tran \\ a l R\" using env_tran_def assum cp by blast\n have env_right:\"env_tran_right \\ l R\" using env_tran_right_def assum cp by metis\n then have all_tran_env: \"\\i. Suc i < length l \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\"\n using final_always_env_i a1 assum cp zero_final_always_env_0 by fastforce \n then have \"\\i. i < length l \\ snd (l!i) \\ Normal ` (a)\"\n using stable_only_env_q a1 env by fastforce\n thus ?thesis using last_l using len_l by fastforce \n qed \n note res = conjI [OF fst_last_skip last_q]\n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto \nqed \n\nlemma Throw_sound: \n \"Sta a R \\\n (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> Throw sat [a, R, G, q,a]\"\nproof - \n assume \n a1:\"Sta a R\" and\n a2:\" (\\s. (Normal s, Normal s) \\ G)\" {\n fix s\n have ass:\"cpn n \\ Throw s \\ assum(a, R) \\ comm(G, (q,a)) F\"\n proof- \n { fix c\n assume a10:\"c \\ cpn n \\ Throw s\" and a11:\"c \\ assum(a, R)\"\n then have a10:\"c\\cp \\ Throw s\"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n have \"c\\comm(G, (q,a)) F\" using Throw_sound1[OF a1 a2 a10 a11] by auto \n } thus ?thesis by auto\n qed \n } \n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma no_comp_tran_before_i_0_g:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c \" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n (c1=Skip) \\ (c1=Throw \\ (\\s21. s2 = Normal s21))\" and \n a6: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\n proof -\n have \"Suc j < length l\" using a0 a1 a2 a3 a4 by fastforce\n then have \"fst (l!j) = c\" \n using a0 a1 a2 a3 a4 cptn_env_same_prog[of \\ l j] by fastforce\n then obtain s s1 c1 where l_0: \"l!j = (c, s) \\ l!(Suc j) = (c1,s1)\" \n by (metis (no_types) prod.collapse) \n moreover have \"snd (l!j) \\ Normal ` p\" using a4 stability[of p rely l 0 j j] a6 a3 a2\n proof -\n have \"\\B r ps n na nb f. \\ Sta B r \\ snd (ps ! n) \\ Normal ` B \\ \\ n \\ na \\ \\ na < length ps \\ na - n \\ nb \\ (\\nb\\n. nb < na \\ \\ f\\\\<^sub>c ps ! nb \\\\<^sub>e ps ! Suc nb) \\ \\ env_tran_right f ps r \\ snd (ps ! na) \\ Normal ` B \\ (fst (ps ! n)::('b, 'a, 'c,'d) LanguageCon.com) = fst (ps ! na)\"\n using stability by blast\n then show ?thesis\n using Suc_lessD \\Suc j < length l\\ a4 a6 by blast\n qed \n then have suc_0_skip: \"(fst (l!Suc j) = Skip \\ fst (l!Suc j) = Throw) \\ \n (\\s2. snd(l!Suc j) = Normal s2 ) \" \n using a5 a6 a3 SmallStepCon.step_Stuck_prop using fst_conv imageE l_0 snd_conv by auto \n thus ?thesis using only_one_component_tran_j\n proof -\n have \"\\n na. \\ n < na \\ Suc n \\ na\"\n using Suc_leI by satx \n thus ?thesis using only_one_component_tran_j[OF a0] suc_0_skip a6 a0 a2 a3\n using imageE by blast \n qed\nqed\n\nlemma no_comp_tran_before_i:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n (c1=Skip) \\ (c1=Throw \\ (\\s21. s2 = Normal s21))\" and \n a6: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct k arbitrary: l i j)\n case 0 thus ?thesis using no_comp_tran_before_i_0_g by blast\nnext\n case (Suc n) \n then obtain a1 l1 where l: \"l=a1#l1\"\n by (metis less_nat_zero_code list.exhaust list.size(3))\n then have l1notempty:\"l1\\[]\" using Suc by force \n then obtain i' where i': \"i=Suc i'\" using Suc \n using less_imp_Suc_add by blast\n then obtain j' where j': \"j=Suc j'\" using Suc\n using Suc_le_D by blast \n have \"(\\,l1)\\cptn\" using Suc l\n using tl_in_cptn l1notempty by blast\n moreover have \"fst (l1 ! n) = c\"\n using Suc l l1notempty by force \n moreover have \"Suc i' < length l1 \\ n \\ i' \\ \\\\\\<^sub>c l1 ! i' \\ (l1 ! Suc i')\"\n using Suc l l1notempty i' by auto\n moreover have \"n \\ j' \\ j' < i' \\ \\\\\\<^sub>c l1 ! j' \\ (l1 ! Suc j')\"\n using Suc l l1notempty i' j' by auto\n moreover have \"\\k\\\\<^sub>c l1 ! k \\\\<^sub>e (l1 ! Suc k)\"\n using Suc l l1notempty j' by auto \n moreover have \"env_tran_right \\ l1 rely \\ Sta q rely \\ Sta p rely \\ snd (l1!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l1!Suc j') \\ Normal ` q\" \n proof -\n have suc0:\"Suc 0 < length l\" using Suc by auto\n have \"j>0\" using j' by auto\n then have \"\\\\\\<^sub>c(l!0) \\\\<^sub>e (l!(Suc 0))\" using Suc(6) by blast\n then have \"(snd(l!Suc 0) \\ Normal ` p)\" \n using Suc(8) suc0 unfolding Sta_def env_tran_right_def by blast\n also have \"snd (l!Suc j) \\ Normal ` q\" using Suc(8) by auto\n ultimately show ?thesis using Suc(8) l by (metis env_tran_tail j' nth_Cons_Suc) \n qed\n ultimately show ?case using Suc(1)[of l1 i' j' ] Suc(7) Suc(8) j' l by auto\nqed\n\nlemma exists_first_occ: \"P (n::nat) \\ \\m. P m \\ (\\i P i)\"\nproof (induct n)\n case 0 thus ?case by auto\nnext\n case (Suc n) thus ?case\n by (metis ex_least_nat_le not_less0) \nqed\n\nlemma exist_first_comp_tran':\nassumes a1: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" \nshows \"\\j. (Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ (\\k < j. \\\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n let ?P = \"(\\n. Suc n (\\\\\\<^sub>c(l!n) \\ (l!(Suc n))))\"\n show ?thesis using exists_first_occ[of ?P i] a1 by auto \nqed\n\nlemma exist_first_comp_tran:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" \nshows \"\\j. j\\i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\nproof -\n obtain j where pj:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\(Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n using a1 exist_first_comp_tran' by blast\n then have \"j\\i\" using a1 pj by (cases \"j\\i\", auto)\n moreover have \"\\\\\\<^sub>c(l!j) \\ (l!(Suc j))\" using pj by auto\n moreover have \"(\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" \n proof -\n {fix k\n assume kj:\"k length l \\ \\ ( (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))) \" using pj by auto\n then have \"(\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n proof\n {assume \"length l \\ Suc k\" \n thus ?thesis using kj pj by auto\n }\n {assume \"\\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n also have \"k + 1 < length l\" using kj pj by auto\n ultimately show ?thesis\n using a0 cptn_tran_ce_i step_ce_elim_cases by blast\n }\n qed\n } thus ?thesis by auto\n qed\n ultimately show ?thesis by auto\nqed\n\n\nlemma skip_com_all_skip:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1:\"fst (l!i) = Skip\" and\n a2:\"ij. j\\i \\ j fst (l!j) = Skip\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n case 0 thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n case (Suc n)\n then have l:\"Suc i < length l\" by arith\n have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n then have \"\\\\\\<^sub>c l ! i \\\\<^sub>c\\<^sub>e l ! Suc i\" using cptn_tran_ce_i Suc\n by (metis (no_types) Suc.hyps(2) a0 cptn_tran_ce_i zero_less_Suc zero_less_diff)\n then have \"\\\\\\<^sub>c l ! i \\ l ! Suc i \\ \\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n using step_ce_elim_cases by blast \n then have or:\"fst(l!Suc i) = Skip\" \n proof\n {assume \"\\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n thus ?thesis using Suc(4) by (metis env_c_c' prod.collapse)\n }\n next\n {assume step:\"\\\\\\<^sub>c l ! i \\ l ! Suc i\" \n {assume \"fst(l!i) = Skip\" \n then have ?thesis using step\n using SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }note left = this\n {assume \"fst(l!i) = Throw\"\n then have ?thesis using step stepc_elim_cases\n proof -\n have \"\\x. l ! Suc i = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) \\fst (l ! i) = LanguageCon.com.Throw\\ local.step stepc_elim_cases(11) surjective_pairing)\n then show ?thesis\n by fastforce\n qed \n } then show ?thesis using Suc(4) left by auto\n }\n qed\n show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) by (metis le_less_Suc_eq not_le) \nqed\n\nlemma terminal_com_all_term:\nassumes a0:\"(\\, l) \\ cptn\" and\n a1:\"fst (l!i) = Skip \\ fst (l!i) = Throw\" and\n a2:\"ij. j\\i \\ j fst (l!j) = Skip \\ fst (l!j) = Throw\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n case 0 thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n case (Suc n)\n then have l:\"Suc i < length l\" by arith\n have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n then have \"\\\\\\<^sub>c l ! i \\\\<^sub>c\\<^sub>e l ! Suc i\" using cptn_tran_ce_i Suc\n by (metis (no_types) Suc.hyps(2) a0 cptn_tran_ce_i zero_less_Suc zero_less_diff)\n then have \"\\\\\\<^sub>c l ! i \\ l ! Suc i \\ \\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n using step_ce_elim_cases by blast \n then have or:\"fst(l!Suc i) = Skip \\ fst(l!Suc i) = Throw\" \n proof\n {assume \"\\\\\\<^sub>c l ! i \\\\<^sub>e l ! Suc i\" \n thus ?thesis using Suc(4) by (metis env_c_c' prod.collapse)\n }\n next\n {assume step:\"\\\\\\<^sub>c l ! i \\ l ! Suc i\" \n {assume \"fst(l!i) = Skip\" \n then have ?thesis using step\n using SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }note left = this\n {assume \"fst(l!i) = Throw\"\n then have ?thesis using step stepc_elim_cases\n proof -\n have \"\\x. l ! Suc i = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) \\fst (l ! i) = LanguageCon.com.Throw\\ local.step stepc_elim_cases(11) surjective_pairing)\n then show ?thesis\n by fastforce\n qed \n } then show ?thesis using Suc(4) left by auto\n }\n qed\n show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) by (metis le_less_Suc_eq not_le) \nqed\n\nlemma only_one_c_comp_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c\" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"i < j \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"(\\k < i. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n shows \"P\"\nproof - \n have fst:\"fst (l!i) = c\" using a0 a1 a5\n by (simp add: a2 cptn_env_same_prog)\n then have suci:\"fst (l!Suc i) = Skip \\ fst (l!Suc i) = Throw\" \n using a4 by (metis a2 surjective_pairing) \n then have \"fst (l!j) = Skip \\ fst (l!j) = Throw\" \n proof -\n have \"Suc i \\ j\"\n using Suc_leI a3 by presburger\n then show ?thesis\n using Suc_lessD terminal_com_all_term[OF a0 suci] a2 a3 by blast\n qed \n thus ?thesis\n proof \n {assume \"fst (l ! j) = Skip\"\n then show ?thesis using a3 SmallStepCon.final_def SmallStepCon.no_step_final' by blast\n }\n next\n {assume asm:\"fst (l ! j) = Throw\"\n then show ?thesis \n proof (cases \"snd (l!i)\")\n case Normal \n thus ?thesis using a3 a2 fst asm\n by (metis SmallStepCon.final_def SmallStepCon.no_step_final') \n next\n case Abrupt thus ?thesis using a3 a2 fst asm skip_com_all_skip\n suci by (metis Suc_leI Suc_lessD a0 mod_env_not_component prod.collapse)\n \n next \n case Fault thus ?thesis using a3 a2 fst asm skip_com_all_skip \n suci by (metis Suc_leI Suc_lessD a0 mod_env_not_component prod.collapse)\n next \n case Stuck thus ?thesis using a3 a2 fst asm skip_com_all_skip \n suci by (metis Suc_leI Suc_lessD a0 mod_env_not_component prod.collapse)\n qed\n } \n qed\nqed\n\nlemma only_one_component_tran1:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = c\" and \n a2: \"Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q \"\n shows \"P\"\nproof (cases \"j=i\")\n case True thus ?thesis using a3 by auto\nnext\n case False note j_neq_i=this \n thus ?thesis\n proof (cases \"j ('b \\ ('b, 'c) xstate) \\ ('b, 'c) xstate \\ 'b\" where\n \"\\x0 x1 x2. (\\v3. x2 = x1 v3 \\ v3 \\ x0) = (x2 = x1 (bb x0 x1 x2) \\ bb x0 x1 x2 \\ x0)\"\n by moura\n then have f1: \"\\x f B. x \\ f ` B \\ x = f (bb B f x) \\ bb B f x \\ B\"\n by (meson imageE)\n then have \"\\\\\\<^sub>c (c, snd (l ! j)) \\ (fst (l ! Suc j), Normal (bb q Normal (snd (l ! Suc j))))\"\n by (metis (no_types) a3 a5 surjective_pairing)\n then show ?thesis\n using f1 by (meson Suc_leI a0 a2 a4 a5 True only_one_component_tran_j)\n qed \n next\n case False \n obtain j1 \n where all_ev:\"j1\\i \\ \n (\\\\\\<^sub>c(l!j1) \\ (l!(Suc j1))) \\ \n (\\k < j1. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a0 a2 a3 exist_first_comp_tran by blast\n then have fst:\"fst (l!j1) = c\" \n using a0 a1 a2 cptn_env_same_prog le_imp_less_Suc less_trans_Suc by blast\n have suc:\"Suc j1 < length l \\ \\\\\\<^sub>c l ! j1 \\ l ! Suc j1\" using all_ev a2\n using Suc_lessD le_eq_less_or_eq less_trans_Suc by linarith\n have evs:\"(\\k < j1. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\" using all_ev by auto\n have j:\"j1 < j \\ Suc j < length l \\ \\\\\\<^sub>c l ! j \\ l ! Suc j \\ fst (l ! j) = c\"\n using a3 all_ev False by auto\n then show ?thesis \n using only_one_c_comp_tran[OF a0 a1 suc j a4 evs] by auto \n qed\nqed \n \nlemma only_one_component_tran_i:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = c\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw)) \" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q \"\n shows \"P\"\nusing a0 a1 a2 a3 a4 a5\nproof (induct k arbitrary: l i j p q)\n case 0 show ?thesis using only_one_component_tran1[OF 0(1) 0(2) ] 0 by blast\nnext\n case (Suc n) \n then obtain a1 l1 where l: \"l=a1#l1\"\n by (metis less_nat_zero_code list.exhaust list.size(3))\n then have l1notempty:\"l1\\[]\" using Suc by force \n then obtain i' where i': \"i=Suc i'\" using Suc \n using less_imp_Suc_add using Suc_le_D by meson \n then obtain j' where j': \"j=Suc j'\" using Suc\n using Suc_le_D by meson \n have a0:\"(\\,l1)\\cptn\" using Suc l\n using tl_in_cptn l1notempty by meson\n moreover have a1:\"fst (l1 ! n) = c\"\n using Suc l l1notempty by force \n moreover have a2:\"Suc i' < length l1 \\ n \\ i' \\ \\\\\\<^sub>c l1 ! i' \\ (l1 ! Suc i')\"\n using Suc l l1notempty i' by auto\n moreover have a3:\"n \\ j' \\ j' \\ i' \\ Suc j' < length l1 \\ \\\\\\<^sub>c l1 ! j' \\ (l1 ! Suc j') \\ fst (l1!j') = c\"\n using Suc l l1notempty i' j' by auto\n moreover have a4:\"env_tran_right \\ l1 rely \\\n Sta p rely \\ snd (l1!n) \\ Normal ` p \\ \n Sta q rely \\ snd (l1 ! Suc j') \\ Normal ` q \" \n using Suc(7) l j' unfolding env_tran_right_def by fastforce\n show ?case using Suc(1)[OF a0 a1 a2 a3 Suc(6) a4] by auto\nqed\n\nlemma only_one_component_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"\\s1 s2 c1. \\\\\\<^sub>c(c,s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nusing a0 a1 a2 a3 a4 a5 only_one_component_tran_i\nproof -\n {assume \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\ \\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n then have \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n proof\n assume \"\\\\\\<^sub>c l ! j \\ (l ! Suc j)\" \n then have j:\"Suc j k\\j \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" using a3 by auto\n show ?thesis using only_one_component_tran_i[OF a0 a1 j a2 a4 a5] \n by blast \n next\n assume \"\\ \\\\\\<^sub>c l ! j \\ (l ! Suc j)\"\n thus ?thesis\n by (metis Suc_eq_plus1 a0 a3 cptn_tran_ce_i step_ce_elim_cases)\n qed\n } thus ?thesis by auto\nqed\n \nlemma only_one_component_tran_all_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"\\s1 s2 c1. \\\\\\<^sub>c(c,s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n {fix j\n assume ass:\"k\\j \\ j\\i \\ Suc j < (length l)\"\n then have a2:\"k \\ i \\ i \\ j \\ Suc i < length l \\ \\\\\\<^sub>c l ! i \\ l ! Suc i \\ fst (l ! i) = c\"\n using a2 by auto\n then have \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\" \n using only_one_component_tran[OF a0 a1 ] a2 a3 ass a4 by blast\n } thus ?thesis by auto\nqed\n\nlemma only_one_component_tran_all_not_comp:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = c\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = c\" and\n a3: \"\\s1 s2 c1. \\\\\\<^sub>c(c, s1) \\ ((c1,s2)) \\ \n ((c1=Skip) \\ (c1=Throw))\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q \"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n {fix j\n assume ass:\"k\\j \\ j\\i \\ Suc j < (length l)\"\n then have \"\\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" \n using a0 a1 a2 a3 a4 only_one_component_tran_i ass by blast \n } thus ?thesis by auto\nqed\n\nlemma final_exist_component_tran1:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = c\" and \n a2: \"env_tran \\ q l R \\ Sta q R\" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" and \n a5: \"c\\Skip \\ c\\Throw\"\n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n {assume \"\\k. k\\i \\ k \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" \n then have \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n by (metis (no_types, lifting) Suc_eq_plus1 a0 a3 cptn_tran_ce_i less_trans_Suc step_ce_elim_cases)\n then have \"fst (l!j) = fst (l!i)\" using cptn_i_env_same_prog a0 a3 by blast \n then have False using a3 a1 a5 unfolding final_def by auto\n } \n thus ?thesis by auto\nqed \n\nlemma final_exist_component_tran:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = c\" and \n a2: \"i\\j \\ j < length l \\ final (l!j)\" and \n a3: \"c\\Skip \\ c\\Throw\"\n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n {assume \"\\k. k\\i \\ k \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" \n then have \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\"\n by (metis (no_types, lifting) Suc_eq_plus1 a0 a2 cptn_tran_ce_i less_trans_Suc step_ce_elim_cases)\n then have \"fst (l!j) = fst (l!i)\" using cptn_i_env_same_prog a0 a2 by blast \n then have False using a2 a1 a3 unfolding final_def by auto\n } \n thus ?thesis by auto\nqed\n\nlemma suc_not_final_final_c_tran:\n assumes a0: \"(\\, l) \\ cptn \" and \n a1: \"Suc j< length l \\ \\final (l!j) \\ final (l!Suc j)\"\n shows \"(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n obtain x xs where l:\"l = x#xs\" using a0 cptn.simps by blast\n obtain c1 s1 c2 s2 where l1:\"l!j = (c1,s1) \\ l!(Suc j) = (c2,s2)\" using a1 by fastforce\n have \"\\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\" \n proof -\n { assume a:\"\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\n then have eq_fst:\"fst (l!j) = fst (l!Suc j)\" by (metis env_c_c' prod.collapse)\n { assume \"fst (l!Suc j) = Skip\"\n then have \"False\" using a1 eq_fst unfolding final_def by fastforce\n }note p1=this\n { assume \"fst (l!Suc j) = Throw \\ (\\s. snd (l!Suc j) = Normal s)\" \n then have \"False\" using a1 eq_fst unfolding final_def\n by (metis a eenv_normal_s'_normal_s local.l1 snd_conv)\n }\n then have False using a1 p1 unfolding final_def by fastforce\n } thus ?thesis by auto\n qed\n also have \"\\\\\\<^sub>c(l!j) \\\\<^sub>c\\<^sub>e (l!(Suc j))\" using l cptn_stepc_rtran a0 a1 by fastforce \n ultimately show ?thesis using step_ce_not_step_e_step_c local.l1 by fastforce \nqed\n \nlemma final_exist_component_tran_final:\n assumes a0:\"(\\, l) \\ cptn\" and \n a2: \"i\\j \\ j < length l \\ final (l!j)\" and \n a3: \"\\final(l!i)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final(l!(Suc k))\"\nproof -\n let ?P = \"\\j. i\\j \\ j < length l \\ final (l!j)\"\n obtain k where k:\"?P k \\ (\\i ?P i)\" using a2 exists_first_occ[of ?P j] by auto\n then have i_k_not_final:\"\\i'i \\ \\final (l!i')\" using a2 by fastforce\n have i_eq_j:\"i\\\\<^sub>c(l!pre_k) \\ (l!k)\"\n proof -\n have \"pre_k \\i\" using pre_k i_eq_j using a3 k le_Suc_eq by blast \n then have \"\\(final (l!pre_k))\" using i_k_not_final pre_k by auto \n thus ?thesis using suc_not_final_final_c_tran a0 a2 pre_k k by fastforce\n qed\n thus ?thesis using pre_k by (metis a2 a3 i_k_not_final k le_Suc_eq not_less_eq)\nqed \n\n\nsubsection {* Basic Sound *}\n\nlemma basic_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e, s1) \\ ((c1,s2)) \\ c1=Skip\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2))\" \n then have \"c1=Skip\" using stepc_elim_cases(3) by blast \n } thus ?thesis by auto \nqed \n\nlemma no_comp_tran_before_i_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and \n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by fastforce \n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Basic f e\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed \n\nlemma only_one_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f e\" and \n a2: \" k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f e\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f e\" and \n a2: \"k\\i \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\"\n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have b: \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n show ?thesis \n by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_basic) \nqed \n\nlemma only_one_component_tran_all_not_comp_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Basic f e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Basic f e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Basic f e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. f s \\ q}\"\n \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Basic f e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using basic_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Basic f e\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n then have \"snd (l!Suc j) \\ Normal ` q\" using a4 first prg_j\n proof -\n obtain s where \"snd (l!j) = Normal s \\ s\\p\" using sta_j by fastforce\n moreover then have \"fst(l!Suc j) = Skip \\ snd(l!Suc j) = Normal (f s)\" using first\n by (metis fst_conv prg_j snd_conv stepc_Normal_elim_cases(3) surjective_pairing)\n ultimately show ?thesis using a4 by fastforce\n qed\n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_basic[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast \n moreover then have \"k=j\" using a2 by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_basic_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Basic f e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. f s \\ q}\" \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof - \n have \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n using one_component_tran_basic[OF a0 a1 a2 a3 a4] by auto\n thus ?thesis using a0 \n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases)\nqed\n\nlemma final_exist_component_tran_basic:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Basic f e\" and \n a2: \"env_tran \\ q l R\" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof - \n show ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \n\n(*lemma assumes a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a]\"\n shows \"\\,\\ \\n\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a]\"\nproof-\n { \n assume a01:\"\\(b,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call b) sat [p, R, G, q,a]\"\n have \"\\ \\n\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a]\"\n proof-\n {fix s l\n assume a02:\"(\\,l)\\cpn n \\ c s\" and\n a03:\"(\\,l)\\assum(p, R)\"\n have \"(\\,l)\\comm(G, (q,a)) F\" \n proof-\n have cpn_cp:\"(\\,l)\\cp \\ c s\" using a02\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce\n qed\n } then show ?thesis unfolding com_validityn_def cpn_def by auto\n qed\n } then show ?thesis unfolding com_cvalidityn_def by auto\nqed *)\n\nlemma Basic_sound1: \n assumes a0:\"p \\ {s. f s \\ q}\" and\n a1:\"(\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" and\n a10:\"c \\ cp \\ (Basic f e) s\" and a11:\"c \\ assum(p, R)\"\n shows \"c\\comm(G, (q,a)) F\"\nproof - \n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=(Basic f e,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n then have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_basic_env[of \\ l f e k R] a0 a00 a11 a2 a3 assum cp \n env_tran_right fst_conv\n by metis\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 by fastforce\n then have k_basic:\"fst(l!k) = Basic f e \\ snd (l!k) \\ Normal ` (p)\" \n using cp env_tran_right a2 assum a00 a11 stability[of p R l 0 k k \\]\n by force\n have suc_k_skip_q:\"fst(l!Suc k) = Skip \\ snd (l!(Suc k)) \\ Normal ` q\"\n proof \n show suc_skip: \"fst(l!Suc k) = Skip\"\n using a0 a00 a11 k_basic by (metis basic_skip surjective_pairing) \n next\n obtain s' where k_s: \"snd (l!k)=Normal s' \\ s' \\ (p)\" \n using a00 a11 k_basic by auto\n then have \"snd (l!(Suc k)) = Normal (f s')\" \n using a00 a11 k_basic stepc_Normal_elim_cases(3)\n by (metis prod.inject surjective_pairing) \n then show \"snd (l!(Suc k)) \\ Normal ` q\" using a0 k_s by blast\n qed\n obtain s' s'' where \n ss:\"snd (l!k) = Normal s' \\ s' \\ (p) \\ \n snd (l!(Suc k)) = Normal s'' \\ s'' \\ q\"\n using suc_k_skip_q k_basic by fastforce \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using a0 a1 a2\n by (metis Pair_inject a11 k_basic prod.exhaust_sel stepc_Normal_elim_cases(3))\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ \n snd (last l) \\ Fault ` F \\\n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Basic f e\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_basic env_tran a2 by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by auto\n moreover then have \"Suc k < length l\" by auto\n ultimately have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_basic_env[of \\ l f e k R] a0 a11 a2 a3 assum cp \n env_tran_right fst_conv by metis \n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then have k_basic:\"fst(l!k) = Basic f e \\ snd (l!k) \\ Normal ` (p)\" \n using cp env_tran_right a2 assum k_comp_tran stability[of p R l 0 k k \\]\n by force\n have suc_k_skip_q:\"fst(l!Suc k) = Skip \\ snd (l!(Suc k)) \\ Normal ` q\"\n proof \n show suc_skip: \"fst(l!Suc k) = Skip\"\n using a0 k_comp_tran k_basic by (metis basic_skip surjective_pairing) \n next\n obtain s' where k_s: \"snd (l!k)=Normal s' \\ s' \\ (p)\" \n using k_comp_tran k_basic by auto\n then have \"snd (l!(Suc k)) = Normal (f s')\" \n using k_comp_tran k_basic stepc_Normal_elim_cases(3)\n by (metis prod.inject surjective_pairing) \n then show \"snd (l!(Suc k)) \\ Normal ` q\" using a0 using k_s by blast\n qed\n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n then have fst_last_skip:\"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\"\n using a2 last_l len_l cp env_tran_right a3 suc_k_skip_q assum k_comp_tran \n stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by fastforce \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n thus ?thesis using c_prod unfolding comm_def by auto \n qed\n\n\nlemma Basic_sound: \n \"p \\ {s. f s \\ q} \\\n (\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G) \\ \n Sta p R \\\n Sta q R \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Basic f e) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"p \\ {s. f s \\ q}\" and\n a1:\"(\\s t. s\\p \\ (t=f s) \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R \" and\n a3:\"Sta q R\" \n{\n fix s\n have \"cpn n \\ (Basic f e) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Basic f e) s\" and a11:\"c \\ assum(p, R)\"\n then have a10:\"c\\cp \\ (Basic f e) s\"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n have \"c\\comm(G, (q,a)) F\" using Basic_sound1[OF a0 a1 a2 a3 a10 a11] by auto \n } thus ?thesis by auto\n qed \n } \n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nsubsection {* Spec Sound *}\n\nlemma spec_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ c1=Skip\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2))\" \n then have \"c1=Skip\" using stepc_elim_cases(4) by force \n } thus ?thesis by auto \nqed \n\n\nlemma no_comp_tran_before_i_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Spec r e\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed \n\nlemma only_one_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r e\" and \n a2: \"k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r e\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r e\" and \n a2: \"k\\i \\ Suc i(\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_spec) \nqed \n\nlemma only_one_component_tran_all_not_comp_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Spec r e\" and \n a2: \"k\\i \\ Suc i(\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Spec r e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Spec r e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\"\n \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!Suc j))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Spec r e\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n then have \"snd (l!Suc j) \\ Normal ` q\" using a4 first prg_j\n proof -\n obtain s where s:\"snd (l!j) = Normal s \\ s\\p\" using sta_j by fastforce \n then have suc_skip: \"fst (l!Suc j) = Skip\"\n using spec_skip first prg_j a4 by (metis (no_types, lifting) prod.collapse)\n moreover obtain s' where \"snd (l!Suc j) = Normal s' \\ (s,s')\\r\" \n proof -\n { have f1:\"(\\\\\\<^sub>c(fst(l!j),snd(l!j)) \\ (fst(l!Suc j),snd(l!Suc j)))\" using first by auto\n obtain t where \"snd (l!Suc j) = Normal t\"\n using step_spec_skip_normal_normal[of \\ \"fst(l!j)\" \"snd(l!j)\" \"fst(l!Suc j)\" \"snd(l!Suc j)\" r] \n suc_skip prg_j s a4 f1 by blast\n moreover then have \"(s,t)\\r\" using a4 s prg_j f1 suc_skip stepc_Normal_elim_cases(4)\n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) prod.inject xstate.distinct(5) xstate.inject(1))\n ultimately have \"\\t. snd (l!Suc j)= Normal t \\ (s,t)\\r\" by auto\n }\n then show \"(\\s'. snd (l ! Suc j) = Normal s' \\ (s, s') \\ r \\ thesis) \\ thesis\" ..\n qed \n then show ?thesis using a4 sta_j s by auto\n qed\n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_spec[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast\n moreover then have \"k=j\" using a2 by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_spec_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Spec r e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely\" and\n a4:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\" \n shows \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j))\"\nproof - \n have \"\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\n using one_component_tran_spec[OF a0 a1 a2 a3 a4] by auto\n thus ?thesis using a0 \n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases)\nqed\n\nlemma final_exist_component_tran_spec:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Spec r e\" and \n a2: \"env_tran \\ q l R \" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Spec r e,s1) \\ ((c1,s2)) \\ (c1=Skip)\" \n using spec_skip by blast\n thus ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \nlemma Spec_sound1: \n \"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)} \\\n (\\s t. s\\p \\ (s,t)\\r \\ (Normal s, Normal t) \\ G) \\ \n Sta p R \\\n Sta q R \\ \n c \\ cp \\ (Spec r e) s \\\n c \\ assum(p, R) \\\n c \\ comm (G, (q,a)) F\" \nproof - \n assume\n a0:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\" and\n a1:\"(\\s t. s\\p \\ (s,t)\\r \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" and \n a10:\"c \\ cp \\ (Spec r e) s\" and\n a11:\"c \\ assum(p, R)\"\n\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=(Spec r e,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using a11 by fastforce\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n then have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 one_component_tran_spec_env[of \\ l r e k R] \n env_tran_right fst_conv a0 a2 a3 cp len_l assum\n by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using a00 a11 by fastforce\n then have k_basic:\"ck = Spec r e \\ sk \\ Normal ` (p)\" \n using cp env_tran_right a2 assum a00 a11 stability[of p R l 0 k k \\] tran_pair\n by force\n have suc_skip: \"csk = Skip\"\n using a0 a00 k_basic tran_pair spec_skip by blast\n obtain s' where ss:\"sk = Normal s' \\ s' \\ (p)\" \n using k_basic by fastforce\n obtain s'' where suc_k_skip_q:\"ssk = Normal s'' \\ (s',s'')\\r \" \n proof - \n {from ss obtain t where \"ssk = Normal t\" \n using step_spec_skip_normal_normal[of \\1 ck sk csk ssk r e s'] \n k_basic tran_pair a0 suc_skip\n by blast \n moreover then have \"(s',t)\\r\" using a0 k_basic ss a11 suc_skip \n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) tran_pair prod.inject xstate.distinct(5) xstate.inject(1)) \n ultimately have \"\\t. ssk= Normal t \\ (s',t)\\r\" by auto\n } \n then show \"(\\s''. ssk = Normal s'' \\ (s',s'')\\r\\ thesis) \\ thesis\" ..\n qed \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a1 tran_pair by force\n } thus ?thesis by auto qed\n have concr:\"(final (last l) \\ ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\"\n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Spec r e\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_spec env_tran by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by auto\n then obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using cp by fastforce\n moreover then have \"Suc k < length l\" using k_comp_tran by auto\n ultimately have all_event:\"\\j. 0\\j \\ j \\ k \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using one_component_tran_spec_env[of \\ l r e k R] a0 a11 a2 a3 assum cp \n env_tran_right fst_conv \n by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then have k_basic:\"ck = Spec r e \\ sk \\ Normal ` (p)\" \n using cp env_tran_right a2 assum tran_pair k_comp_tran stability[of p R l 0 k k \\] tran_pair\n by force\n have suc_skip: \"csk = Skip\"\n using a0 k_basic tran_pair spec_skip by blast\n have suc_k_skip_q:\"ssk \\ Normal ` q\" \n proof - \n obtain s' where k_s: \"sk =Normal s' \\ s' \\ (p)\" \n using k_basic by auto\n then obtain t where \"ssk = Normal t\" \n using step_spec_skip_normal_normal[of \\1 ck sk csk ssk r] k_basic tran_pair a0 suc_skip\n by blast \n then obtain t where \"ssk= Normal t\" by fastforce\n then have \"(s',t)\\r\" using k_basic k_s a11 suc_skip \n by (metis (no_types, lifting) stepc_Normal_elim_cases(4) tran_pair prod.inject xstate.distinct(5) xstate.inject(1))\n thus \"ssk \\ Normal ` q\" using a0 k_s `ssk = Normal t` by blast \n qed \n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n then have fst_last_skip:\"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\"\n using l tran_pair suc_skip last_l len_l cp \n env_tran_right a3 suc_k_skip_q \n assum k_comp_tran stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by (metis One_nat_def Suc_eq_plus1 Suc_leI Suc_mono diff_Suc_1 lessI list.size(4)) \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n thus ?thesis using c_prod unfolding comm_def by auto \n qed\n \nlemma Spec_sound: \n \"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)} \\\n (\\s t. s\\p \\ (s,t)\\r \\ (Normal s, Normal t) \\ G) \\ \n Sta p R \\\n Sta q R \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Spec r e) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"p \\ {s. (\\t. (s,t)\\r \\ t \\ q) \\ (\\t. (s,t) \\ r)}\" and\n a1:\"(\\s t. s\\p \\ (s,t)\\r \\ (Normal s,Normal t) \\ G)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" \n{\n fix s\n have \"cpn n \\ (Spec r e) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Spec r e) s\" and a11:\"c \\ assum(p, R)\"\n then have a10:\"c\\cp \\ (Spec r e) s\"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n have \"c\\comm(G, (q,a)) F\" using Spec_sound1[OF a0 a1 a2 a3 a10 a11] by auto \n } thus ?thesis by auto\n qed \n } \n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nsubsection {* Await Sound *}\n\nlemma await_skip:\n \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\"\nproof -\n {fix s1 s2 c1\n assume \"\\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2))\" \n then have \"c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" using stepc_elim_cases(8) by blast \n } thus ?thesis by auto \nqed \n\nlemma no_comp_tran_before_i_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j < i \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\" and\n a4: \"\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))\" and\n a5: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\"\n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ c1=Skip \\ (c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\" and\n a3: \"k\\j \\ j \\ i \\ Suc j < length l \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ fst (l!j) = Await b c e\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc j) \\ Normal ` q\" \n shows \"P\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran_i by blast\nqed \n\nlemma only_one_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c e\" and \n a2: \" k\\i \\ i \\ j \\ Suc i (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c e\" and\n a3: \"k\\j \\ Suc j < length l\" and\n a4: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"(\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed \n\nlemma only_one_component_tran_all_env_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\nproof -\n have a:\"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw)\" \n using await_skip by blast\n thus ?thesis by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_await)\nqed\n \n\nlemma only_one_component_tran_all_not_comp_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!k) = Await b c e\" and \n a2: \"Suc i k\\i \\ (\\\\\\<^sub>c(l!i) \\ (l!(Suc i))) \\ fst (l!i) = Await b c e\" and \n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!k) \\ Normal ` p \\ \n Sta q rely \\ snd (l!Suc i) \\ Normal ` q\" \n shows \"\\j. k\\j \\ j\\i \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 only_one_component_tran_all_not_comp by blast\nqed \n\nlemma one_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Await b c e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\\n Sta a rely\" and\n a4:\"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c\n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a5:\"snd (last l) \\ Fault ` F\"\n \n shows \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\\n (\\s s'. fst (l!k) = Await b c e \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\nproof -\n have suc_skip:\"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\ (c1=Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n also obtain j where first:\"(Suc j (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\k < j. \\((\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))))\"\n by (metis (no_types) a2 exist_first_comp_tran')\n moreover then have prg_j:\"fst (l!j) = Await b c e\" using a1 a0\n by (metis cptn_env_same_prog not_step_comp_step_env)\n moreover have sta_j:\"snd (l!j) \\ Normal ` p\"\n proof -\n have a0':\"0\\j \\ j<(length l)\" using first by auto\n have a1':\"(\\k. 0\\k \\ k < j \\ ((\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k)))))\" \n using first not_step_comp_step_env a0 by fastforce \n thus ?thesis using stability first a3 a1' a0' by blast \n qed \n from sta_j obtain s where \n k_basic:\"fst (l!j) = Await b c e \\ snd (l!j) = Normal s \\ s \\ p \\ snd(l!j) \\ Normal ` p\" \n using sta_j prg_j by fastforce\n then have conc:\"snd (l!Suc j) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc j) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n proof - \n have \"\\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {s}) c \n ({s'. (Normal s, Normal s') \\ G} \\ q),\n ({s'. (Normal s, Normal s') \\ G} \\ a)\"\n using a4 hoare_sound by fastforce\n then have e_auto:\"\\\\<^sub>\\\\<^sub>a\\\\<^bsub>/F\\<^esub> (p \\ b \\ {s}) c \n ({s'. (Normal s, Normal s') \\ G} \\ q),\n ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n unfolding cvalid_def by auto \n have f': \"\\\\\\<^sub>c(fst (l!j), snd(l!j)) \\ (fst(l!(Suc j)), snd(l!(Suc j)))\" \n using first by auto\n have step_await:\"Suc j \\\\\\<^sub>c (Await b c e,snd(l!j)) \\ (fst(l!(Suc j)), snd(l!(Suc j)))\"\n using f' k_basic first by fastforce \n then have s'_in_bp:\"s\\ b \\ s \\ p\" using k_basic stepc_Normal_elim_cases(8) by metis\n then have \"s \\ (p \\ b)\" by fastforce\n moreover have test:\n \"\\t. \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ t \\ \n ((\\t'. t =Abrupt t' \\ snd(l!Suc j) = Normal t') \\\n (\\t'. t \\ Abrupt t' \\ snd(l!Suc j)=t))\"\n proof -\n fix t \n { assume \"fst(l!Suc j) = Skip\"\n then have step:\"\\\\\\<^sub>c (Await b c e,Normal s) \\ (Skip, snd(l!Suc j))\"\n using step_await k_basic by fastforce\n have s'_b:\"s\\b\" using s'_in_bp by fastforce\n note step = stepc_elim_cases_Await_skip[OF step]\n have h:\"(s \\ b \\ \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ snd(l!Suc j) \\ \\t'. snd(l!Suc j) \\ Abrupt t' \\\n \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ snd(l!Suc j) \\ (\\t'. snd(l!Suc j) \\ Abrupt t'))\" by auto\n have ?thesis \n using step[OF h] by fastforce\n } note left = this\n { assume \"fst(l!Suc j)= Throw \\ (\\s1. snd(l!Suc j) = Normal s1)\"\n then obtain s1 where step:\"fst(l!Suc j)= Throw \\ snd(l!Suc j) = Normal s1\"\n by fastforce\n then have step: \"\\\\\\<^sub>c (Await b c e,Normal s) \\ (Throw, snd(l!Suc j))\"\n using step_await k_basic by fastforce\n have s'_b:\"s\\b\" using s'_in_bp by fastforce\n note step = stepc_elim_cases_Await_throw[OF step]\n have h:\"(\\t'. snd(l!Suc j) = Normal t' \\ s \\ b \\ \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ Abrupt t' \\ \n \\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ Abrupt t' \\ snd(l!Suc j) = Normal t')\"\n by auto \n have ?thesis using step[OF h] by blast \n } thus ?thesis using suc_skip left step_await suc_skip by blast \n qed\n then obtain t where e_step:\"\\\\<^sub>\\\\<^sub>a\\ \\c,Normal s\\ \\ t \\ \n ((\\t'. t =Abrupt t' \\ snd(l!Suc j) = Normal t') \\\n (\\t'. t \\ Abrupt t' \\ snd(l!Suc j)=t)) \" by fastforce\n moreover have \"t \\ Fault ` F\" \n proof - \n {assume a10:\"t \\ Fault ` F\"\n then obtain tf where \"t=Fault tf \\ tf\\F\" by fastforce\n then have \"snd(l!Suc j) = Fault tf \\ tf\\F\" using e_step by fastforce\n also have \"snd(l!Suc j) \\ Fault ` F\" \n using last_not_F[of \\ l F] a5 a1 step_await a0 by blast\n ultimately have False by auto\n } thus ?thesis by auto\n qed\n ultimately have t_q_a:\"t \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\q) \\ \n Abrupt ` ({s'. (Normal s, Normal s') \\ G} \\ a)\" \n using e_auto unfolding valid_def by fastforce\n thus ?thesis using e_step t_q_a by blast \n qed \n then have \"\\i. 0\\i \\ i\\j \\ Suc i < (length l) \\ \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using only_one_component_tran_all_not_comp_await[OF a0 a1] first a3 \n a0 a1 calculation(1) only_one_component_tran1 prg_j by blast \n moreover then have k:\"k=j\" using a2 by fastforce\n ultimately have \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\(\\\\\\<^sub>c(l!j) \\ (l!(Suc j))))\" by auto \n also from conc k k_basic have \n \"(\\s s'. fst (l!k) = Await b c e \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n by fastforce\n ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_await_env:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!0) = Await b c e\" and \n a2: \"Suc k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\" and\n a3: \"env_tran_right \\ l rely \\ Sta p rely \\ snd (l!0) \\ Normal ` p \\ \n Sta q rely \\\n Sta a rely\" and\n a4:\"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) c\n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a5:\"snd (last l) \\ Fault ` F\" \n shows \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))) \\ \n (\\s s'. fst (l!k) = Await b c e \\ snd (l!k) \\ Normal ` (p) \\ \n snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\" \nproof - \n have \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j)))) \\ \n (\\s s'. fst (l!k) = Await b c e \\ snd (l!k) \\ Normal ` (p) \\ \n snd (l!k) = Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using one_component_tran_await[OF a0 a1 a2 a3 a4 a5] by auto\n thus ?thesis using a0\n by (metis Suc_eq_plus1 cptn_tran_ce_i step_ce_elim_cases) \nqed\n\nlemma final_exist_component_tran_await:\n assumes a0:\"(\\, l) \\ cptn\" and\n a1: \"fst (l!i) = Await b c e\" and \n a2: \"env_tran \\ q l R \" and\n a3: \"i\\j \\ j < length l \\ final (l!j)\" \n shows \"\\k. k\\i \\ k (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\nproof -\n have \"\\s1 s2 c1. \\\\\\<^sub>c(Await b c e,s1) \\ ((c1,s2)) \\ (c1=Skip)\\(c1 = Throw \\ (\\s21. s2 =Normal s21 ))\" \n using await_skip by blast\n thus ?thesis using a0 a1 a2 a3 final_exist_component_tran by blast\nqed \n\ninductive_cases stepc_elim_cases_Await_Fault:\n\"\\\\\\<^sub>c (Await b c e, Normal s) \\ (u,Fault f)\"\n\nlemma Await_sound1: \n \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a) \\ \n Sta p R \\ Sta q R \\ Sta a R \\ \n c \\ cp \\ (Await b e e1) s \\\n c \\ assum(p, R) \\\n c \\ comm (G, (q,a)) F\"\nproof - \n assume\n a0: \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" and\n a4:\"Sta a R\" and \n a10:\"c \\ cp \\ (Await b e e1) s\" and\n a11:\"c \\ assum(p, R)\"\n\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n {assume last_fault:\"snd (last l) \\ Fault ` F\"\n have cp:\"l!0=(Await b e e1,s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10 cp_def c_prod by fastforce\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k1\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n then have all_event:\n \"(\\s s'. fst (l!k) = Await b e e1 \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = \n Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using a00 a11 one_component_tran_await_env[of \\ l b e e1 k R p q a F G] env_tran_right cp len_l\n using a0 a2 a3 a4 assum fst_conv last_fault by auto \n then obtain s' s'' where ss:\n \"snd (l!k) = Normal s' \\ s' \\ (p) \\ snd (l!Suc k) = Normal s'' \n \\ (s'' \\ (({s. (Normal s', Normal s) \\ G} \\ q)) \\ \n s''\\ (({s. (Normal s', Normal s) \\ G} \\ a)))\"\n by fastforce \n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using a2 by force\n } thus ?thesis using c_prod by auto qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n have env_tran:\"env_tran \\ p l R\" using assum env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n proof - \n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Await b e e1\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_await env_tran by blast \n qed\n then obtain k where k_comp_tran: \"k\\0 \\ Suc k < length l \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n by fastforce\n then obtain ck sk csk ssk where tran_pair:\n \"\\1\\\\<^sub>c (ck,sk) \\ (csk, ssk) \\ (ck = fst (l!k)) \\ (sk = snd (l!k)) \\ (csk = fst (l!(Suc k))) \\ (ssk = snd (l!(Suc k)))\" \n using cp by fastforce \n have all_event:\n \"(\\j. 0\\j \\ j\\k \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))) \\\n (\\s s'. fst (l!k) = Await b e e1 \\ snd (l!k) \\ Normal ` (p) \\ snd (l!k) = \n Normal s \\ snd (l!Suc k) = Normal s' \\ \n (snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ q) \\ \n snd (l!Suc k) \\ Normal ` ({s'. (Normal s, Normal s') \\ G} \\ a)))\"\n using one_component_tran_await_env[of \\ l b e e1 k R p q a F G] a0 a11 a2 a3 a4 assum cp \n env_tran_right len_l fst_conv last_fault k_comp_tran by fastforce\n then have before_k_all_evn:\"\\j. 0\\j \\ j < k \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using k_comp_tran by fastforce\n then obtain s' where k_basic:\"ck = Await b e e1 \\ sk \\ Normal ` (p) \\ sk = Normal s'\" \n using cp env_tran_right a2 assum tran_pair k_comp_tran stability[of p R l 0 k k \\] tran_pair\n by force \n have \"\\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {s'}) e \n ({s. (Normal s', Normal s) \\ G} \\ q),\n ({s. (Normal s', Normal s) \\ G} \\ a)\"\n using a0 hoare_sound k_basic\n by fastforce\n then have e_auto:\"\\\\<^sub>\\\\<^sub>a\\\\<^bsub>/F\\<^esub> (p \\ b \\ {s'}) e \n ({s. (Normal s', Normal s) \\ G} \\ q),\n ({s. (Normal s', Normal s) \\ G} \\ a)\" \n unfolding cvalid_def by auto \n have after_k_all_evn:\"\\j. (Suc k)\\j \\ Suc j < (length l) \\ (\\\\\\<^sub>c(l!j) \\\\<^sub>e (l!(Suc j)))\"\n using all_event k_comp_tran by fastforce \n have suc_skip: \"csk = Skip \\ (csk = Throw \\ (\\s1. ssk = Normal s1))\"\n using a0 k_basic tran_pair await_skip by blast\n moreover {\n assume at:\"csk = Skip\" \n then have atom_tran:\"\\\\<^sub>\\\\<^sub>a\\\\e,sk\\ \\ ssk\"\n using k_basic tran_pair k_basic cp stepc_elim_cases_Await_skip\n by metis\n have sk_in_normal_pb:\"sk \\ Normal ` (p \\ b)\" \n using k_basic tran_pair at cp stepc_elim_cases_Await_skip\n by (metis (no_types, lifting) IntI image_iff) \n then have \"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q\" \n proof (cases ssk)\n case (Normal t) \n then have \"ssk \\ Normal ` q\" \n using sk_in_normal_pb k_basic e_auto Normal atom_tran unfolding valid_def\n by blast\n thus ?thesis\n using at l tran_pair last_l len_l cp \n env_tran_right a3 after_k_all_evn \n assum k_comp_tran stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\]\n by (metis (no_types, hide_lams) Suc_leI diff_Suc_eq_diff_pred diff_less less_one zero_less_diff) \n next\n case (Abrupt t)\n thus ?thesis \n using at k_basic tran_pair k_basic cp stepc_elim_cases_Await_skip\n by metis \n next\n case (Fault f1) \n then have \"ssk \\ Normal ` q \\ ssk \\ Fault ` F\" \n using k_basic sk_in_normal_pb e_auto Fault atom_tran unfolding valid_def by auto \n thus ?thesis\n proof\n assume \"ssk \\ Normal ` q\" thus ?thesis using Fault by auto\n next\n assume suck_fault:\"ssk \\ Fault ` F\"\n have \"\\i Fault ` F\" \n using last_not_F[of \\ l F] last_fault cp by auto\n thus ?thesis \n using cp tran_pair a11 k_comp_tran suck_fault\n by (meson diff_less len_l less_imp_Suc_add less_one less_trans_Suc) \n qed\n next \n case (Stuck) \n then have \"ssk \\ Normal ` q\" \n using k_basic sk_in_normal_pb e_auto Stuck atom_tran unfolding valid_def\n by blast\n thus ?thesis using Stuck by auto \n qed \n }\n moreover {\n assume at:\"(csk = Throw \\ (\\t. ssk = Normal t))\"\n then obtain t where ssk_normal:\"ssk=Normal t\" by auto\n then have atom_tran:\"\\\\<^sub>\\\\<^sub>a\\\\e,sk\\ \\ Abrupt t\"\n using at k_basic tran_pair k_basic ssk_normal cp stepc_elim_cases_Await_throw xstate.inject(1)\n by metis \n also have \"sk \\ Normal ` (p \\ b)\" \n using k_basic tran_pair k_basic ssk_normal at cp stepc_elim_cases_Await_throw\n by (metis (no_types, lifting) IntI imageE image_eqI stepc_elim_cases_Await_throw) \n then have \"ssk \\ Normal ` a\" \n using e_auto k_basic ssk_normal atom_tran unfolding valid_def\n by blast\n then have \"(fst (last l) = Throw \\ snd (last l) \\ Normal ` (a))\"\n using at l tran_pair last_l len_l cp \n env_tran_right a4 after_k_all_evn\n assum k_comp_tran stability [of a R l \"Suc k\" \"((length l) - 1)\" _ \\] \n by (metis (no_types, hide_lams) Suc_leI diff_Suc_eq_diff_pred diff_less less_one zero_less_diff) \n }\n ultimately have \"fst (last l) = Skip \\ \n snd ((last l)) \\ Normal ` q \\\n (fst (last l) = Throw \\ snd (last l) \\ Normal ` (a))\"\n by blast \n } thus ?thesis by auto qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto \nqed \nsubsection {* If sound *}\n\nlemma cptn_assum_induct:\nassumes\n a0: \"(\\,l) \\ (cp \\ c s) \\ ((\\,l) \\ assum(p, R))\" and\n a1: \"k < length l \\ l!k=(c1,Normal s') \\ s' \\ p1\"\nshows \"(\\,drop k l)\\ ((cp \\ c1 (Normal s')) \\ assum(p1, R) )\"\nproof -\n have drop_k_s:\"(drop k l)!0 = (c1,Normal s')\" using a1 by fastforce\n have p1:\"s' \\ p1\" using a1 by auto\n have k_l:\"k < length l\" using a1 by auto\n show ?thesis\n proof\n show \"(\\, drop k l) \\ cp \\ c1 (Normal s')\" \n unfolding cp_def \n using dropcptn_is_cptn a0 a1 drop_k_s cp_def \n by fastforce\n next\n let ?c= \"(\\,drop k l)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` p1\"\n using p1 drop_k_s by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R \"\n using a0 unfolding assum_def using a00 a11 by auto\n } thus \"(\\, drop k l) \\ assum (p1, R)\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma Await_sound: \n \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a) \\ \n Sta p R \\ Sta q R \\ Sta a R \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Await b e e1) sat [p, R, G, q,a]\"\nproof - \n assume\n a0: \"\\V. \\\\<^sub>\\\\<^sub>a,{}\\\\<^bsub>/F\\<^esub> \n (p \\ b \\ {V}) e \n ({s. (Normal V, Normal s) \\ G} \\ q),\n ({s. (Normal V, Normal s) \\ G} \\ a)\" and\n a2:\"Sta p R\" and\n a3:\"Sta q R\" and\n a4:\"Sta a R\" \n{\n fix s\n have \"cpn n \\ (Await b e e1) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Await b e e1) s\" and a11:\"c \\ assum(p, R)\"\n then have a10:\"c\\cp \\ (Await b e e1) s\"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n have \"c\\comm(G, (q,a)) F\" using Await_sound1[OF a0 a2 a3 a4 a10 a11] by auto \n } thus ?thesis by auto\n qed \n } \n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\nlemma cptn_comm_induct:\nassumes\n a0: \"(\\,l) \\ (cp \\ c s)\" and\n a1: \"l1 = drop j l \\ (\\, l1)\\ comm(G, (q,a)) F\" and\n a2: \"k \\ j \\ j < length l\" \nshows \"snd (last (l)) \\ Fault ` F \\ ((Suc k < length l \\\n \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd(l!k), snd(l!(Suc k))) \\ G) \n \\ (final (last (l)) \\ \n ((fst (last (l)) = Skip \\ \n snd (last (l)) \\ Normal ` q)) \\\n (fst (last (l)) = Throw \\ \n snd (last (l)) \\ Normal ` (a))))\"\nproof - \n have pair_\\l:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce \n have a03:\"snd (last (l1)) \\ Fault ` F \\(\\i. \n Suc i, l1)) \\ \n fst (\\, l1)\\\\<^sub>c((snd (\\, l1))!i) \\ ((snd (\\, l1))!(Suc i)) \\ \n (snd((snd (\\, l1))!i), snd((snd (\\, l1))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l1))) \\ \n snd (last (snd (\\, l1))) \\ Fault ` F \\\n ((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n have last_l:\"last l1 = last l\" using a1 a2 by fastforce\n show ?thesis \n proof -\n {\n assume \" snd (last l) \\ Fault ` F\" \n then have l1_f:\"snd (last l1) \\ Fault ` F\" \n using a03 a1 a2 by force \n { assume \"Suc k < length l\"\n then have a2: \"k \\ j \\ Suc k < length l\" using a2 by auto\n have \"k \\ length l\" using a2 by fastforce\n then have l1_l:\"(l!k = l1! (k - j) ) \\ (l!Suc k = l1!Suc (k - j))\"\n using a1 a2 by fastforce \n have a00:\"Suc (k - j) < length l1\" using a1 a2 by fastforce\n have \"\\\\\\<^sub>c(l1!(k-j)) \\ (l1!(Suc (k-j))) \\ \n (snd((snd (\\, l1))!(k-j)), snd((snd (\\, l1))!(Suc (k-j)))) \\ G\"\n using pair_\\l a00 l1_f a03 by presburger\n then have \" \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G \" \n using l1_l last_l by auto\n } then have l_side:\"Suc k < length l \\\n \\\\\\<^sub>c l ! k \\ l ! Suc k \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G\" by auto \n { \n assume a10:\"final (last (l))\" \n then have final_eq: \"final (last (l1))\"\n using a10 a1 a2 by fastforce\n also have \"snd (last (l1)) \\ Fault ` F\"\n using last_l l1_f by fastforce\n ultimately have \"((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a))\"\n using pair_\\l a03 by presburger\n then have \"((fst (last (snd (\\, l))) = Skip \\ \n snd (last (snd (\\, l))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l))) = Throw \\ \n snd (last (snd (\\, l))) \\ Normal ` (a))\"\n using final_eq a1 a2 by auto \n } then have \n r_side: \n \"SmallStepCon.final (last l) \\ \n fst (last l) = LanguageCon.com.Skip \\ snd (last l) \\ Normal ` q \\\n fst (last l) = LanguageCon.com.Throw \\ snd (last l) \\ Normal ` a\"\n by fastforce\n note res=conjI[OF l_side r_side] \n } thus ?thesis by auto\n qed\nqed\n\nlemma cpn_assum_induct:\nassumes\n a0: \"(\\,l) \\ (cpn n \\ c s) \\ ((\\,l) \\ assum(p, R))\" and\n a1: \"k < length l \\ l!k=(c1,Normal s') \\ s' \\ p1\"\nshows \"(\\,drop k l)\\ ((cpn n \\ c1 (Normal s')) \\ assum(p1, R) )\"\nproof -\n have drop_k_s:\"(drop k l)!0 = (c1,Normal s')\" using a1 by fastforce\n have p1:\"s' \\ p1\" using a1 by auto\n have k_l:\"k < length l\" using a1 by auto\n show ?thesis\n proof\n show \"(\\, drop k l) \\ cpn n \\ c1 (Normal s')\" \n unfolding cp_def \n using a0 a1 \n by (simp add: cpn_def dropcptn_is_cptn1) \n next\n let ?c= \"(\\,drop k l)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` p1\"\n using p1 drop_k_s by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R \"\n using a0 unfolding assum_def using a00 a11 by auto\n } thus \"(\\, drop k l) \\ assum (p1, R)\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma cpn_comm_induct:\n assumes\n a1: \"l1 = drop j l \\ (\\, l1)\\ comm(G, (q,a)) F\" and\n a2: \"k \\ j \\ j < length l\" \nshows \"snd (last (l)) \\ Fault ` F \\ ((Suc k < length l \\\n \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd(l!k), snd(l!(Suc k))) \\ G) \n \\ (final (last (l)) \\ \n ((fst (last (l)) = Skip \\ \n snd (last (l)) \\ Normal ` q)) \\\n (fst (last (l)) = Throw \\ \n snd (last (l)) \\ Normal ` (a))))\"\nproof - \n have pair_\\l:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce \n have a03:\"snd (last (l1)) \\ Fault ` F \\(\\i. \n Suc i, l1)) \\ \n fst (\\, l1)\\\\<^sub>c((snd (\\, l1))!i) \\ ((snd (\\, l1))!(Suc i)) \\ \n (snd((snd (\\, l1))!i), snd((snd (\\, l1))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l1))) \\ \n snd (last (snd (\\, l1))) \\ Fault ` F \\\n ((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n have last_l:\"last l1 = last l\" using a1 a2 by fastforce\n show ?thesis \n proof -\n {\n assume \" snd (last l) \\ Fault ` F\" \n then have l1_f:\"snd (last l1) \\ Fault ` F\" \n using a03 a1 a2 by force \n { assume \"Suc k < length l\"\n then have a2: \"k \\ j \\ Suc k < length l\" using a2 by auto\n have \"k \\ length l\" using a2 by fastforce\n then have l1_l:\"(l!k = l1! (k - j) ) \\ (l!Suc k = l1!Suc (k - j))\"\n using a1 a2 by fastforce \n have a00:\"Suc (k - j) < length l1\" using a1 a2 by fastforce\n have \"\\\\\\<^sub>c(l1!(k-j)) \\ (l1!(Suc (k-j))) \\ \n (snd((snd (\\, l1))!(k-j)), snd((snd (\\, l1))!(Suc (k-j)))) \\ G\"\n using pair_\\l a00 l1_f a03 by presburger\n then have \" \\\\\\<^sub>c(l!k) \\ (l!(Suc k)) \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G \" \n using l1_l last_l by auto\n } then have l_side:\"Suc k < length l \\\n \\\\\\<^sub>c l ! k \\ l ! Suc k \\ \n (snd (l ! k), snd (l ! Suc k)) \\ G\" by auto \n { \n assume a10:\"final (last (l))\" \n then have final_eq: \"final (last (l1))\"\n using a10 a1 a2 by fastforce\n also have \"snd (last (l1)) \\ Fault ` F\"\n using last_l l1_f by fastforce\n ultimately have \"((fst (last (snd (\\, l1))) = Skip \\ \n snd (last (snd (\\, l1))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l1))) = Throw \\ \n snd (last (snd (\\, l1))) \\ Normal ` (a))\"\n using pair_\\l a03 by presburger\n then have \"((fst (last (snd (\\, l))) = Skip \\ \n snd (last (snd (\\, l))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l))) = Throw \\ \n snd (last (snd (\\, l))) \\ Normal ` (a))\"\n using final_eq a1 a2 by auto \n } then have \n r_side: \n \"SmallStepCon.final (last l) \\ \n fst (last l) = LanguageCon.com.Skip \\ snd (last l) \\ Normal ` q \\\n fst (last l) = LanguageCon.com.Throw \\ snd (last l) \\ Normal ` a\"\n by fastforce\n note res=conjI[OF l_side r_side] \n } thus ?thesis by auto\n qed\nqed\n\n\nlemma If_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a] \\\n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]) \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a] \\\n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]) \\ \n Sta p R \\ (\\s. (Normal s, Normal s) \\ G) \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]\" and\n a1:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]\" and \n a2: \"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]\" and\n a3: \"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]\" and\n a4: \"Sta p R\" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a3:\"\\ \\n\\<^bsub>/F\\<^esub> c2 sat [p \\ (-b), R, G, q,a]\" \n using a3 com_cvalidityn_def by fastforce \n have a2:\"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, q,a]\"\n using a2 all_call com_cvalidityn_def by fastforce \n have \"cpn n \\ (Cond b c1 c2) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Cond b c1 c2) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (Cond b c1 c2) s\" unfolding cp_def cpn_def\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n \n have cp:\"l!0=((Cond b c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (Cond b c1 c2) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" using before_k_all_evnt k_basic pair_j\n by (metis prod.collapse snd_conv stepc_Normal_elim_cases(6)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def \n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" \n using a5 by blast\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n have l_suc:\"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j ssj_normal_s\n by fastforce\n have l_k:\"jb \\ s'\\b\" by auto \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n proof\n assume a000:\"s'\\b\"\n then have cj:\"csj=c1\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ b)\" using a000 ss by blast \n moreover have \"cpn n \\ csj ssj \\ assum((p \\ b), R) \\ comm(G, (q,a)) F\"\n using calculation a2 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cpn_assum_induct[of \\ l n \"(LanguageCon.com.Cond b c1 c2)\" s p R \"Suc j\" c1 s' \"(p \\ b)\"]\n by blast \n show ?thesis \n using l_k drop_comm a00 a21 a10 \\1 l_f \n cpn_comm_induct\n by fastforce \n next\n assume a000:\"s'\\b\"\n then have cj:\"csj=c2\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ (-b))\" using a000 ss by fastforce\n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ (-b)), R) \\ comm(G, (q,a)) F\"\n using a3 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cpn_assum_induct[of \\ l n \"(LanguageCon.com.Cond b c1 c2)\" s p R \"Suc j\" c2 s' \"(p \\ (-b))\"]\n by fastforce \n show ?thesis \n using l_k drop_comm a00 a21 a10 \\1 l_f\n cpn_comm_induct\n unfolding Satis_def by fastforce\n qed\n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n assume not_fault: \"snd (last l) \\ Fault ` F\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce\n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = LanguageCon.com.Cond b c1 c2\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Cond b c1 c2) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\]\n by fastforce\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" using before_k_all_evnt k_basic pair_j\n by (metis prod.collapse snd_conv stepc_Normal_elim_cases(6)) \n have l_suc:\"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j ssj_normal_s\n by fastforce\n have \"s'\\b \\ s'\\b\" by auto \n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof\n assume a000:\"s'\\b\"\n then have cj:\"csj=c1\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s' \\ (p \\ b)\" using a000 ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ b), R) \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cpn_assum_induct[of \\ l n \"(LanguageCon.com.Cond b c1 c2)\" s p R \"Suc j\" c1 s' \"(p \\ b)\"]\n by blast \n thus ?thesis \n using j_length drop_comm a10 \\1 cpn_comm_induct valid not_fault \n by blast\n next\n assume a000:\"s'\\b\"\n then have cj:\"csj=c2\" using k_basic pair_j ss \n by (metis (no_types) fst_conv stepc_Normal_elim_cases(6))\n moreover have p1:\"s'\\(p \\ (-b))\" using a000 ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ (-b)), R) \\ comm(G, (q,a)) F\"\n using a3 com_validityn_def cj by blast \n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using l_suc j_length a10 a11 \\1 ssj_normal_s\n cpn_assum_induct[of \\ l n \"(LanguageCon.com.Cond b c1 c2)\" s p R \"Suc j\" c2 s' \"(p \\ (-b))\"]\n by blast \n thus ?thesis \n using j_length drop_comm a10 \\1 cpn_comm_induct valid not_fault \n by blast\n qed\n } thus ?thesis using l_f by fastforce qed\n note res = conjI [OF concl concr] \n } \n thus ?thesis using c_prod unfolding comm_def by auto qed \n } thus ?thesis by auto qed \n} thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\nlemma Asm_sound:\n \"(c, p, R, G, q, a) \\ \\ \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\n \"\nproof -\n assume\n a0:\"(c, p, R, G, q, a) \\ \\\" \n { fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have \"\\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" using a0 by auto\n } thus ?thesis unfolding com_cvalidityn_def by auto\nqed\n\nlemma events_p:\n assumes a0:\"(\\,cfg#l)\\cptn\" and\n a1:\"(\\,cfg#l) \\ assum (p,R)\" and\n a2:\"ik\\i. fst ((cfg#l)!k) = fst cfg\" and\n a4:\"Sta p R \" \n shows \"\\t1. snd((cfg#l)!i)=Normal t1 \\ t1 \\ p\" \n using a2 a3\nproof(induct i)\n case 0\n then show ?case using a1 a2 unfolding assum_def by auto\nnext\n case (Suc n)\n then have \"\\t1. snd ((cfg # l) ! n) = Normal t1 \\ t1 \\ p\" by auto \n moreover have \"\\\\\\<^sub>c ((cfg#l)!n) \\\\<^sub>e ((cfg#l)!(Suc n))\" using Suc a0\n by (metis Env calculation less_Suc_eq_le less_not_refl nat_le_linear prod.collapse)\n then have \"(snd ((cfg#l)!n),snd ((cfg#l)!(Suc n)))\\R\" using a1 Suc(2) \n unfolding assum_def by auto\n ultimately show ?case using a4 unfolding Sta_def by auto\nqed\n\n\nlemma not_val_zero:\"c \\ dom \\ \\ Sta p R \\ \\ \\0\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof-\n assume a0:\" c \\ dom \\\"\n assume a1:\"Sta p R\"\n {fix l s\n assume a01:\"(\\,l) \\ cpn 0 \\ (Call c) s \\ (\\,l)\\ assum(p, R)\" \n then have \"length l \\ 1\" unfolding cpn_def using CptnEmpty\n by (metis (no_types, lifting) One_nat_def Product_Type.Collect_case_prodD Suc_leI length_greater_0_conv snd_conv)\n moreover {assume a02:\"length l = 1\"\n then have \"l = [(Call c,s)]\" \n proof -\n have \"l ! 0 = (LanguageCon.com.Call c, s)\" using a01 unfolding cpn_def\n by fastforce\n then show ?thesis using a02\n by (metis One_nat_def Suc_leI impossible_Cons length_greater_0_conv list.size(3) neq_Nil_conv nth_Cons_0 zero_neq_one) \n qed \n then have \"(\\,l) \\ comm(G, (q,a)) F\" unfolding comm_def final_def by auto\n }\n moreover {assume a02:\"length l > 1\"\n then obtain a1 ls where l:\"l =(Call c, s)#a1#ls\" using a01 unfolding cpn_def\n apply auto\n by (metis (no_types, hide_lams) One_nat_def Suc_eq_plus1 less_not_refl list.exhaust list.size(3) list.size(4) not_less_zero nth_Cons_0 prod.collapse) \n have l_cptn:\"(\\,l)\\cptn\" using a01 unfolding cpn_def\n using cptn_eq_cptn_mod_nest by blast\n then obtain m where min_call:\"min_call m \\ l\"\n using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest minimum_nest_call by blast\n { assume a03:\"\\i,l) \\ comm(G, (q,a)) F\" \n using no_comp_tran_no_final_comm[OF _ a03] a02 unfolding final_def\n by fastforce \n }\n moreover { assume a03:\"\\ (\\i fst (l!i) \\ Call c)\"\n by auto\n then obtain j where cfg_j:\"fst (l!j) \\ Call c \\ (\\ki. fst (l!i) \\ Call c\" i])\n moreover have j:\"j>0 \\ j\\\\<^sub>c (l!(j-1)) \\ (l!j))\"\n using l l_cptn\n by (metis One_nat_def Suc_pred cptn_stepc_rtran diff_less not_eq_not_env prod.collapse \n step_ce_elim_cases zero_less_one)\n moreover obtain s' where j_1_cfg:\"snd (l!(j-1)) = Normal s' \\ s' \\ p\"\n using cfg_j l a01[simplified l] j[simplified l] i a1 events_p[OF l_cptn[simplified l] _ _ _ a1, of \"j-1\"]\n by force\n then have j_cfg:\"l!j = (the (\\ c), Normal s')\" using cfg_j a0\n stepc_Normal_elim_cases(9) calculation\n by (metis diff_less domIff j option.sel prod.collapse zero_less_one) \n ultimately have False\n proof-\n have \"(0,\\, drop (j-1) l) \\ cptn_mod_nest_call\" \n using a01 unfolding cpn_def \n by (simp add: dropcptn_is_cptn1 j less_imp_diff_less) \n then show ?thesis \n using redex_call_cptn_mod_min_nest_call_gr_zero j j_cfg j_1_cfg cfg_j step a0\n by (metis Cons_nth_drop_Suc One_nat_def SmallStepCon.redex.simps(7) Suc_pred \n diff_less domIff less_imp_diff_less min_call_def not_less_zero prod.collapse \n stepc_Normal_elim_cases(9) zero_less_one) \n qed \n }\n ultimately have \"(\\,l) \\ comm(G, (q,a)) F\" by auto\n }\n ultimately have \"(\\,l)\\comm(G, (q,a)) F\" by fastforce\n } then show ?thesis unfolding com_validityn_def cpn_def by auto \nqed\n\nlemma Call_sound: \n \"f \\ dom \\ \\ \n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> (the (\\ f)) sat [p, R, G, q,a] \\ \n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> (Call f) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"f \\ dom \\\" and\n a2:\"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> (the (\\ f)) sat [p, R, G, q,a]\" and \n a3: \"Sta p R\" and\n a4: \"(\\s. (Normal s, Normal s) \\ G)\" \n obtain bdy where a0:\"\\ f = Some bdy\" using a0 by auto\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a2:\"\\ \\n\\<^bsub>/F\\<^esub> bdy sat [p, R, G, q,a]\" \n using a0 a2 com_cvalidityn_def by fastforce\n have \"cpn n \\ (Call f) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Call f) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (Call f) s\" \n unfolding cpn_def cp_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Call f),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (Call f) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis not_None_eq snd_conv stepc_Normal_elim_cases(9)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 \n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" \n using a4 by fastforce \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=bdy\" using k_basic pair_j ss a0\n by (metis fst_conv option.distinct(1) option.sel stepc_Normal_elim_cases(9)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum(p, R) \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s \n by (meson contra_subsetD cpn_assum_induct) \n then show ?thesis \n using a00 a21 \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"Call f\" s _ \"Suc j\" G q a F k ] \n Suc_leI a10' by blast \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = Call f\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Call f) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis not_None_eq snd_conv stepc_Normal_elim_cases(9))\n have cj:\"csj=bdy\" using k_basic pair_j ss a0\n by (metis fst_conv option.distinct(1) option.sel stepc_Normal_elim_cases(9)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum(p, R) \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s \n by (meson contra_subsetD cpn_assum_induct) \n thus ?thesis \n using j_length l_f drop_comm a10' \\1 cptn_comm_induct[of \\ l \"Call f\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n \nlemma CallRec_sound:\n \"(c, p, R, G, q, a) \\ Specs \\\n \\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n (\\x. \\,\\ \\ Specs \\x \\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]) \\\n Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof -\n assume a0: \"(c, p, R, G, q, a) \\ Specs\" and\n a1: \n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ \n \\,\\ \\ Specs \\\\<^bsub>/F\\<^esub> the (\\ c) sat [p, R, G, q,a] \\ \n (\\x. \\,\\ \\ Specs \\x \\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a])\"\n then have a1': \"c \\ dom \\\" and \n a1'': \"\\,\\ \\ Specs \\n \\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a]\" using a0 by auto \n from a1 have \n valid_body:\n \"\\(c, p, R, G, q, a)\\Specs.\n c \\ dom \\ \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\ \n (\\x. \\,\\ \\ Specs \\x \\<^bsub>/F\\<^esub> the (\\ c) sat [p,R, G, q,a])\" by fastforce\n assume a5: \"Sta p R\" and\n a6: \"(\\s. (Normal s,Normal s) \\ G)\" \n obtain bdy where \\bdy:\"\\ c = Some bdy\" using a1' by auto\n have theta_specs: \n \"\\(c, p, R, G, q, a)\\\\. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\\n \\(c, p, R, G, q, a)\\Specs. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n proof(induct n)\n case 0 \n show \"\\(c, p, R, G, a, d)\\Specs. \\ \\0\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, a,d]\"\n proof-\n {fix c p R G a d\n assume a00:\"(c, p, R, G, a, d) \\ Specs\"\n then have \"c\\dom \\ \\ Sta p R\" using a1 by auto\n then have \" \\ \\0\\<^bsub>/F\\<^esub> (LanguageCon.com.Call c) sat [p,R, G, a,d]\"\n using not_val_zero by fastforce\n } then show ?thesis by auto \n qed \n next\n case (Suc n)\n have hyp:\"\\(c, p, R, G, q, a)\\\\. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\\n \\(c, p, R, G, q, a)\\Specs. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\" by fact\n have body:\"\\(c, p, R, G, q, a)\\\\. \\ \\Suc n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\" by fact\n then show ?case\n proof-\n { fix c p R G q a\n assume a000:\"(c, p, R, G, q, a) \\ Specs\"\n have ctxt_m:\"\\(c, p, R, G, q, a)\\\\. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n using body cptn_mod_nest_mono unfolding com_validityn_def cpn_def\n by (fastforce simp add: cpn_rule)\n then have valid_Proc:\"\\(c, p, R, G, q, a)\\Specs. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n using hyp by auto\n have Sta:\"Sta p R\" using a1 a000 by auto\n have c_dom:\" c \\ dom \\\" using a1 a000 by auto\n have guar:\"\\s. (Normal s,Normal s)\\G\" using a1 a000 by auto\n let ?\\'= \"\\ \\ Specs\"\n from valid_Proc ctxt_m\n have \"\\(c, p, R, G, q, a)\\?\\'. \\ \\n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n by fastforce\n with valid_body\n have valid_body_m: \n \"\\(c, p, R, G, q, a)\\Specs. \\ \\n\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p,R, G, q,a]\"\n by (fastforce simp:com_cvalidityn_def) \n then have valid_body:\"\\ \\n\\<^bsub>/F\\<^esub> (the (\\ c)) sat [p,R, G, q,a]\" using a000 by auto\n then have \"\\ \\Suc n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n proof-\n { fix l s \n assume a01:\"(\\,l)\\cpn (Suc n) \\ (Call c) s \\ (\\,l)\\ assum(p, R)\"\n then have \"length l \\ 1\" unfolding cpn_def using CptnEmpty\n by (metis (no_types, lifting) One_nat_def Product_Type.Collect_case_prodD Suc_leI length_greater_0_conv snd_conv)\n moreover {\n assume a02:\"length l = 1\"\n then have \"l = [(Call c,s)]\" \n proof -\n have \"l ! 0 = (LanguageCon.com.Call c, s)\" using a01 unfolding cpn_def\n by fastforce\n then show ?thesis using a02\n by (metis One_nat_def Suc_leI impossible_Cons \n length_greater_0_conv list.size(3) neq_Nil_conv nth_Cons_0 zero_neq_one) \n qed \n then have \"(\\,l) \\ comm(G, (q,a)) F\" unfolding comm_def final_def by auto\n }\n moreover {assume a02:\"length l > 1\"\n then obtain a1 ls where l:\"l =(Call c, s)#a1#ls\" using a01 unfolding cpn_def\n apply auto\n by (metis (no_types, hide_lams) One_nat_def Suc_eq_plus1 less_not_refl list.exhaust list.size(3) list.size(4) not_less_zero nth_Cons_0 prod.collapse) \n have l_cptn:\"(\\,l)\\cptn\" using a01 unfolding cpn_def\n using cptn_eq_cptn_mod_nest by blast\n then obtain m where min_call:\"min_call m \\ l\"\n using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest minimum_nest_call by blast\n { assume a03:\"\\i,l) \\ comm(G, (q,a)) F\" \n using no_comp_tran_no_final_comm[OF _ a03] a02 unfolding final_def\n by fastforce \n } \n moreover{\n assume a03:\"\\(\\i fst (l!i) \\ Call c)\"\n by auto\n then obtain j where cfg_j:\"fst (l!j) \\ Call c \\ (\\ki. fst (l!i) \\ Call c\" i])\n moreover have j:\"j>0 \\ j\\\\<^sub>c (l!(j-1)) \\ (l!j))\"\n using l l_cptn\n by (metis One_nat_def Suc_pred cptn_stepc_rtran diff_less not_eq_not_env prod.collapse \n step_ce_elim_cases zero_less_one)\n then obtain s' where j_1_cfg:\"snd (l!(j-1)) = Normal s' \\ s' \\ p\"\n using cfg_j l a01[simplified l] j[simplified l] i Sta events_p[OF l_cptn[simplified l] _ _ _ Sta, of \"j-1\"]\n by force\n then have j_cfg:\"l!j = (the (\\ c), Normal s')\" \n using cfg_j c_dom stepc_Normal_elim_cases(9) step\n by (metis diff_less domIff j option.sel prod.collapse zero_less_one) \n then have suc_n_call:\"(Suc n,\\, drop (j-1) l) \\ cptn_mod_nest_call\" \n using a01 unfolding cpn_def\n by (simp add: dropcptn_is_cptn1 j less_imp_diff_less)\n have \"(n,\\, drop j l) \\ cptn_mod_nest_call\" \n proof-\n have \"\\ (\\\\\\<^sub>c (l!(j-1)) \\\\<^sub>e (l!j))\" using step\n by (metis etranE mod_env_not_component)\n then have \"(Suc n,\\, (Call c, Normal s')#(the (\\ c),Normal s')#(drop (j+1) l)) \\ cptn_mod_nest_call\"\n using a01 j step cfg_j j_cfg j_1_cfg suc_n_call\n by (metis (no_types, lifting) Cons_nth_drop_Suc One_nat_def Suc_eq_plus1 \n Suc_less_eq Suc_pred diff_less less_SucI prod.collapse zero_less_one) \n then have \"(n,\\, (the (\\ c),Normal s')#(drop (j+1) l)) \\ cptn_mod_nest_call\"\n using cfg_j j_cfg elim_cptn_mod_nest_call_n_dec[OF _ ] c_dom by fastforce\n then show ?thesis\n by (metis Cons_nth_drop_Suc Suc_eq_plus1 j j_cfg)\n qed\n moreover have \"(\\, drop j l) \\ assum(p,R)\" \n proof- \n have \"(\\, take j l @ l ! j # drop (Suc j) l) \\ assum (p, R)\"\n using conjunct2[OF a01] id_take_nth_drop[OF conjunct2[OF j]] by auto \n then show ?thesis \n using sub_assum_r[OF ] j_1_cfg l j_cfg j\n by (metis Cons_nth_drop_Suc image_eqI snd_conv) \n qed \n ultimately have comm_drop:\"(\\, drop j l)\\ comm(G, (q,a)) F\"\n using valid_body j_cfg j unfolding com_validityn_def cpn_def \n by fastforce\n have \"(\\,l) \\ comm(G, (q,a)) F\" \n proof-\n have h:\"\\j,take j l) \\ comm(G, (q,a)) F\"\n using no_comp_tran_no_final_comm[of \"take j l\" \"Call c\"] j_1_cfg l j_cfg j cfg_j \n unfolding final_def by auto \n moreover have \"(snd (last (take j l)), snd (drop j l ! 0)) \\ G\"\n proof-\n have \"length (take j l) = j\"using l j_1_cfg j j_cfg by auto\n moreover have \"(take j l)!(j-1) = l!(j-1)\"\n using l j_1_cfg j j_cfg by auto\n ultimately have \"last (take j l) = l!(j-1)\"\n using j by (metis last_conv_nth less_numeral_extra(3) list.size(3)) \n then show ?thesis using l j_1_cfg j j_cfg guar by auto\n qed \n ultimately show ?thesis using j_1_cfg j_cfg j cfg_j j l_cptn\n comm_union[OF comm_take comm_drop] by fastforce\n qed \n } ultimately have \"(\\,l)\\comm(G, (q,a)) F\" by auto\n }ultimately have \"(\\,l)\\comm(G, (q,a)) F\" by fastforce \n } thus ?thesis unfolding com_validityn_def using cpn_rule2 by blast \n qed\n } thus ?case by fastforce\n qed\n qed \n then show ?thesis using a0 unfolding com_cvalidityn_def by auto \nqed\n\nlemma Seq_env_P:assumes a0:\"\\\\\\<^sub>c(Seq P Q,s) \\\\<^sub>e (Seq P Q,t)\"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t)\"\nusing a0\nby (metis env_not_normal_s snormal_enviroment)\n\nlemma map_eq_state:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Seq c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\\\<^sub>e l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\\\<^sub>e (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (metis Env_n env_c_c' env_not_normal_s step_e.Env)\n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\\\<^sub>e (l2 ! Suc i)\" \n using a4 l1prod l2prod \n by (metis Env_n LanguageCon.com.inject(3) env_c_c' env_not_normal_s step_e.Env) \n }\n qed\n } \n thus ?thesis by auto\nqed\n\n\n\nlemma same_comp_seq_c:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Seq c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\ l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\ (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (simp add: Seqc) \n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\ l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Seq c2i c2) \\ c1si = (Seq c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_seq_c l1prod\n by (metis Suc_lessD fst_conv length_map)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (metis Suc_lessD nth_map snd_conv snd_lift) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\ (l2 ! Suc i)\" \n using a4 l1prod l2prod stepc_elim_cases_Seq_Seq\n by auto \n }\n qed\n } \n thus ?thesis by auto\nqed\n\nlemma assum_map:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s) \\ ((\\,l1) \\ assum(p, R))\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"((\\,l2) \\ assum(p, R))\"\nproof -\n have a3: \"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \n using a0 a1 a2 same_env_seq_c by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n obtain s' where normal_s:\"s = Normal s'\" \n using a0 unfolding cp_def assum_def by fastforce\n then have p1:\"s'\\p\" using a0 unfolding cp_def assum_def by fastforce \n show ?thesis \n proof - \n let ?c= \"(\\,l2)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` (p)\"\n using p1 drop_k_s a1 normal_s unfolding cp_def by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R\"\n using a0 a1 a2 a3 map_eq_state unfolding assum_def \n using a00 a11 eq_length by fastforce\n } thus \"(\\, l2) \\ assum (p, R)\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma comm_map':\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\(Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (fst (last l1) = (Seq c c2) \\ final (c, snd (last l1)) \\ \n (fst (last l1) = (Seq Skip c2) \\ \n (snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Seq Throw c2) \\ \n snd (last l1) \\ Normal ` (a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_seq_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto \n then have len0:\"length l1>0\" using a0 unfolding cp_def \n using Collect_case_prodD drop_k_s eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed\n then have \"snd (last l1) \\ Fault ` F \\\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis Suc_lessD a0 a1 a2 map_eq_state)\n } note l=this\n {\n assume a00: \"fst (last l1) = (Seq c c2) \\ final (c, snd (last l1))\" and\n a01:\"snd (last (l1)) \\ Fault ` F\"\n then have c:\"c=Skip \\ c = Throw\"\n unfolding final_def by auto \n then have fst_last_l2:\"fst (last l2) = c\" \n using last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift \n by fastforce \n also have last_eq:\"snd (last l2) = snd (last l1)\" \n using l2_not_empty a2 last_conv_nth last_lenl1 last_snd \n by fastforce\n ultimately have \"final (fst (last l2),snd (last l2))\" \n using a00 by auto\n then have \"final (last l2)\" by auto\n also have \"snd (last (l2)) \\ Fault ` F\"\n using last_eq a01 by auto\n ultimately have \"(fst (last l2)) = Skip \\ \n snd (last l2) \\ Normal ` q \\\n (fst (last l2) = Throw \\ \n snd (last l2) \\ Normal ` (a))\"\n using a03 by auto\n then have \"(fst (last l1) = (Seq Skip c2) \\ \n snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Seq Throw c2) \\ \n snd (last l1) \\ Normal ` (a))\"\n using last_eq fst_last_l2 a00 by force\n }\n thus ?thesis using l by auto qed\nqed\n\nlemma comm_map'':\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\ ((Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (final (last l1) \\ \n (fst (last l1) = Skip \\ \n (snd (last l1) \\ Normal ` r) \\\n (fst (last l1) = Throw \\ \n snd (last l1) \\ Normal ` (a)))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_seq_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto \n then have len0:\"length l1>0\" using a0 unfolding cp_def \n using Collect_case_prodD drop_k_s eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce \n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed \n then have \"\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift)\n } note l= this\n {\n assume a00: \"final (last l1)\" \n then have c:\"fst (last l1)=Skip \\ fst (last l1) = Throw\"\n unfolding final_def by auto \n moreover have \"fst (last l1) = Seq (fst (last l2)) c2\" \n using a2 last_lenl1 eq_length\n proof -\n have \"last l2 = l2 ! (length l2 - 1)\"\n using l2_not_empty last_conv_nth by blast\n then show ?thesis\n by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift)\n qed\n ultimately have False by simp \n } thus ?thesis using l by auto qed\nqed\n\nlemma comm_map:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Seq c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift c2) l2\" \nshows\n \"(\\, l1)\\ comm(G, (r,a)) F\"\nproof - \n {fix i \n have \"snd (last l1) \\ Fault ` F \\(Suc i < length (l1) \\\n \\\\\\<^sub>c (l1 ! i) \\ (l1 ! (Suc i)) \\ \n (snd (l1 ! i), snd (l1 ! Suc i)) \\ G) \\\n (SmallStepCon.final (last l1) \\ \n fst (last l1) = LanguageCon.com.Skip \\\n snd (last l1) \\ Normal ` r \\\n fst (last l1) = LanguageCon.com.Throw \\\n snd (last l1) \\ Normal ` a) \"\n using comm_map''[of \\ l1 c1 c2 s l2 G q a F i r] a0 a1 a2 \n by fastforce\n } then show ?thesis using comm_def unfolding comm_def by force \nqed\n(* declare[[show_types]]\nlemma \"(SOME e. e\\{1::nat,2,3}) = 1 \\ (SOME e. e\\{1::nat,2,3}) = 2 \\ (SOME e. e\\{1::nat,2,3}) = 3\"\n apply auto\n by (metis (mono_tags, lifting) someI)*)\n\n\nlemma Seq_sound1:\nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"\\ final (last x)\" and\n a4:\"env_tran_right \\ x rely\" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely \" and \n a6: \"\\ \\n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\" \nshows\n \"\\xs. (\\,xs) \\ cpn n \\ P s \\ x = map (lift Q) xs\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: P s p) \n case (CptnModNestOne n \\ C s1)\n then have \"(\\, [(P,s)]) \\ cpn n \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]\"\n unfolding cpn_def lift_def\n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C s1 t1 n xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n have \"\\xs. (\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModNestEnv(5) by fastforce\n moreover have \"\\ SmallStepCon.final (last ((C, t1) # xsa))\" using CptnModNestEnv(6) \n by fastforce\n moreover have \"snd (((C, t1) # xsa) ! 0) \\ Normal ` p\" \n using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately show ?thesis\n using CptnModNestEnv(3) CptnModNestEnv(7) CptnModNestEnv(8) CptnModNestEnv(9) env_tran_tail by blast\n qed \n then obtain xs where hi:\"(\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModNestEnv unfolding cpn_def by auto\n obtain xsa' where xs:\"xs=((P,t1)#xsa') \\ (n, \\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')\" \n using hi unfolding cpn_def by fastforce \n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModNestEnv Seq_env_P by (metis fst_conv nth_Cons_0) \n then have \"(n, \\,(P,s1)#(P,t1)#xsa')\\cptn_mod_nest_call\" \n using xs env_tran cptn_mod_nest_call.CptnModNestEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cpn n \\ P s\" \n using cpn_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')\"\n using xs C unfolding lift_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestSeq1 n \\ P0 sa xsa zs P1)\n then have a1:\"LanguageCon.com.Seq P Q = LanguageCon.com.Seq P0 P1\"\n by fastforce \n have f1: \"sa = s\"\n using CptnModNestSeq1.prems(1) by force\n have f2: \"P = P0 \\ Q = P1\" using a1 by auto \n hence \"(\\, (P0, sa) # xsa) \\ cpn n \\ P s\"\n using f2 f1 CptnModNestSeq1.hyps(1) by (simp add: cpn_def)\n thus ?case\n using Cons_lift CptnModNestSeq1.hyps(3) a1 by fastforce \nnext\n case (CptnModNestSeq2 n \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModNestSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModNestSeq2(8) zs by auto\nnext\n case (CptnModNestSeq3 n \\ P1 sa xsa s' ys zs Q1 ) \n have s'_a:\"s' \\ a\" \n proof -\n have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cpn n \\ P1 (Normal sa)\" \n using CptnModNestSeq3.hyps(1) unfolding cpn_def by fastforce\n then have cpP1':\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\"\n using CptnModNestSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod \n unfolding cp_def by fastforce \n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely)\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModNestSeq3.hyps(7) CptnModNestSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModNestSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cpn n \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModNestSeq3(7) CptnModNestSeq3.hyps(1) cptn_mod_nest_call.CptnModNestSeq1\n unfolding cpn_def by fastforce \n then have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModNestSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod.CptnModSeq1 cptn_mod_nest_cptn_mod \n unfolding cp_def by fastforce \n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely)\" \n using assum_map map cpP1' by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpP1 CptnModNestSeq3(13) CptnModNestSeq3.prems(1) unfolding com_validityn_def by auto\n thus ?thesis \n using CptnModNestSeq3(3) CptnModNestSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have \"final (last ((LanguageCon.com.Throw, Normal s')# ys))\"\n proof -\n have cptn_mod:\"(n, \\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call\" \n using CptnModNestSeq3(5) by (simp add: cptn_eq_cptn_mod_set)\n then have cptn:\"(\\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn\"\n using cptn_eq_cptn_mod_nest by auto\n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw \\ \n snd (last ((LanguageCon.com.Throw, Normal s') # ys)) = Normal st'\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"(length ((Throw, Normal s') # ys))-1\" a rely]\n s'_a CptnModNestSeq3(11) CptnModNestSeq3(12) by fastforce \n thus ?thesis using CptnModNestSeq3(10) final_def by blast\n qed\n thus ?case using CptnModNestSeq3(10) CptnModNestSeq3(7)\n by force\nqed (auto)\n\nlemma Seq_sound2: \nassumes\n a0:\"(\\,x)\\cptn_mod\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst (last x) = Throw \\ snd (last x) = Normal s'\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs s' ys. (\\,xs) \\ cp \\ P s \\ x = ((map (lift Q) xs)@((Throw, Normal s')#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s s')\n case (CptnModOne \\ C s1)\n then have \"(\\, [(P,s)]) \\ cp \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]@[(Throw, Normal s')]\"\n unfolding cp_def lift_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModEnv \\ C s1 t1 xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n have \"\\xs s' ys. (\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s')#ys)\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = Throw \\ snd (last ((C, t1) # xsa)) = Normal s'\" using CptnModEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModEnv(3) CptnModEnv(7) env_tran_tail by blast \n qed \n then obtain xs s'' ys where hi:\"(\\, xs) \\ cp \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s'')#ys)\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModEnv unfolding cp_def by auto\n have \"\\xsa' s'' ys. xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\" \n using hi unfolding cp_def\n proof -\n have \"(\\,xs)\\cptn \\ xs!0 = (P,t1)\" using hi unfolding cp_def by fastforce\n moreover then have \"xs\\[]\" using cptn.simps by fastforce \n ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n thus ?thesis\n using hi using \\(\\, xs) \\ cptn \\ xs ! 0 = (P, t1)\\ by auto \n qed\n then obtain xsa' s'' ys where xs:\"xs=((P,t1)#xsa') \\ (\\,((P,t1)#xsa'))\\cptn \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n by fastforce\n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModEnv Seq_env_P by (metis fst_conv nth_Cons_0) \n then have \"(\\,(P,s1)#(P,t1)#xsa')\\cptn\" using xs env_tran CptnEnv by fastforce \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cp \\ P s\" \n using cp_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n using xs C unfolding lift_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModSeq1 \\ P0 sa xsa zs P1) \n thus ?case \n proof -\n have a1:\"\\c p. fst (case p of (ca::('s, 'a, 'd,'e) LanguageCon.com, x::('s, 'd) xstate) \\ \n (LanguageCon.com.Seq ca c, x)) = LanguageCon.com.Seq (fst p) c\"\n by simp\n then have \"[] = xsa\" \n proof -\n have \"[] \\ zs\"\n using CptnModSeq1 by force\n then show ?thesis\n by (metis (no_types) LanguageCon.com.distinct(71) One_nat_def CptnModSeq1(3,6) \n last.simps last_conv_nth last_lift)\n qed \n then have \"\\c. Throw = c \\ [] = zs\"\n using CptnModSeq1(3) by fastforce\n then show ?thesis\n using CptnModSeq1.prems(3) by force\n qed \nnext\n case (CptnModSeq2 \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModSeq2(8) zs by auto\nnext \n case (CptnModSeq3 \\ P0 sa xsa s'' ys zs P1) \n then have \"P0 = P \\ P1 = Q \\ s=Normal sa\" by auto \n moreover then have \"(\\, (P0, Normal sa) # xsa)\\ cp \\ P s\" \n using CptnModSeq3(1)\n by (simp add: cp_def cptn_eq_cptn_mod_set) \n moreover have \"last zs=(Throw, Normal s')\" using CptnModSeq3(10) CptnModSeq3.hyps(7) \n by (simp add: prod_eqI) \n ultimately show ?case using CptnModSeq3(7)\n using Cons_lift_append by blast \nqed (auto)\n\n\nlemma Seq_sound2': \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst (last x) = Throw \\ snd (last x) = Normal s'\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs s' ys. (\\,xs) \\ cpn n \\ P s \\ x = ((map (lift Q) xs)@((Throw, Normal s')#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s s')\n case (CptnModNestOne n \\ C s1)\n then have \"(\\, [(P,s)]) \\ cpn n \\ P s \\ [(C, s1)] = map (lift Q) [(P,s)]@[(Throw, Normal s')]\"\n unfolding cp_def lift_def by (simp add: cptn.CptnOne) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C s1 t1 n xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n have \"\\xs s' ys. (\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s')#ys)\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModNestEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = Throw \\ snd (last ((C, t1) # xsa)) = Normal s'\" \n using CptnModNestEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModNestEnv(3) CptnModNestEnv(7) env_tran_tail by blast \n qed \n then obtain xs s'' ys where hi:\"(\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift Q) xs@((Throw, Normal s'')#ys)\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModNestEnv unfolding cp_def by auto\n have \"\\xsa' s'' ys. xs=((P,t1)#xsa') \\ (n, \\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\" \n using hi unfolding cp_def\n proof -\n have \"(n, \\,xs)\\cptn_mod_nest_call \\ xs!0 = (P,t1)\" using hi unfolding cpn_def by fastforce\n moreover then have \"xs\\[]\" using cptn_mod_nest_call.simps by fastforce \n ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n thus ?thesis\n using hi using \\(n, \\, xs) \\ cptn_mod_nest_call \\ xs ! 0 = (P, t1)\\ by auto \n qed\n then obtain xsa' s'' ys where xs:\"xs=((P,t1)#xsa') \\ (n, \\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ \n (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n by fastforce\n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModNestEnv Seq_env_P by (metis fst_conv nth_Cons_0) \n then have \"(n, \\,(P,s1)#(P,t1)#xsa')\\cptn_mod_nest_call\" using xs env_tran cptn_mod_nest_call.CptnModNestEnv by blast \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cpn n \\ P s\" \n using cpn_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')@((Throw, Normal s'')#ys)\"\n using xs C unfolding lift_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestSeq1 n \\ P0 sa xsa zs P1) \n thus ?case \n proof -\n have a1:\"\\c p. fst (case p of (ca::('s, 'a, 'd,'e) LanguageCon.com, x::('s, 'd) xstate) \\ \n (LanguageCon.com.Seq ca c, x)) = LanguageCon.com.Seq (fst p) c\"\n by simp\n then have \"[] = xsa\" \n proof -\n have \"[] \\ zs\"\n using CptnModNestSeq1 by force\n then show ?thesis\n by (metis (no_types) LanguageCon.com.distinct(71) One_nat_def CptnModNestSeq1(3,6) \n last.simps last_conv_nth last_lift)\n qed \n then have \"\\c. Throw = c \\ [] = zs\"\n using CptnModNestSeq1(3) by fastforce\n then show ?thesis\n using CptnModNestSeq1.prems(3) by force\n qed \nnext\n case (CptnModNestSeq2 n \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModNestSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModNestSeq2(8) zs by auto\nnext \n case (CptnModNestSeq3 n \\ P0 sa xsa s'' ys zs P1) \n then have \"P0 = P \\ P1 = Q \\ s=Normal sa\" by auto \n moreover then have \"(\\, (P0, Normal sa) # xsa)\\ cpn n \\ P s\" \n using CptnModNestSeq3(1)\n by (simp add: cpn_def) \n moreover have \"last zs=(Throw, Normal s')\" using CptnModNestSeq3(10) CptnModNestSeq3.hyps(7) \n by (simp add: prod_eqI) \n ultimately show ?case using CptnModNestSeq3(7)\n using Cons_lift_append by blast \nqed (auto)\n\nlemma Last_Skip_Exist_Final: \nassumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Skip\" \nshows \n \"\\c s' i. i x!i = (Seq c Q,s') \\ final (c,s')\"\nusing a0 a1 a2 a3 \nproof (induct arbitrary: P s)\n case (CptnOne \\ c s1) thus ?case by fastforce \nnext\n case (CptnEnv \\ C st t xsa) \n thus ?case \n proof - \n have \"LanguageCon.com.Seq P Q = C\"\n using CptnEnv.prems(1) by auto\n then show ?thesis\n using CptnEnv.hyps(3) CptnEnv.prems(2) CptnEnv.prems(3) by fastforce\n qed\nnext\n case (CptnComp \\ C st C' st' xsa) \n then have c_seq:\"C = (Seq P Q) \\ st = s\" by force\n from CptnComp show ?case proof(cases)\n case (Seqc P1 P1' P2) \n then have \"\\c s' i. i < length ((C', st') # xsa) \\ \n ((C', st') # xsa) ! i = (LanguageCon.com.Seq c Q, s') \\ \n SmallStepCon.final (c, s')\"\n using CptnComp last.simps by fastforce\n thus ?thesis by fastforce \n next\n case (SeqThrowc C2 s') \n thus ?thesis \n proof -\n have \"LanguageCon.com.Seq LanguageCon.com.Throw Q = C\"\n using \\C = LanguageCon.com.Seq LanguageCon.com.Throw C2\\ c_seq by blast\n then show ?thesis\n using \\st = Normal s'\\ unfolding final_def by force\n qed\n next\n case (FaultPropc) thus ?thesis \n using c_seq redex_not_Seq by blast\n next\n case (StuckPropc) thus ?thesis \n using c_seq redex_not_Seq by blast\n next \n case (AbruptPropc) thus ?thesis\n using c_seq redex_not_Seq by blast \n qed (auto)\nqed\n\nlemma Seq_sound3: \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Skip\" and\n a4:\"env_tran_right \\ x rely \" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely\" and\n a6: \"\\ \\n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n \"False\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: P s p) (* p) *)\n case (CptnModNestOne n \\ C s1) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C s1 t1 n xsa)\n then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n thus ?case\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModNestEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = LanguageCon.com.Skip\" using CptnModNestEnv(6)\n by (simp add: SmallStepCon.final_def) \n moreover have \"snd (((C, t1) # xsa) ! 0) \\ Normal ` p\" \n using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately show ?thesis\n using CptnModNestEnv(3) CptnModNestEnv(7) CptnModNestEnv(8) CptnModNestEnv(9) env_tran_tail\n by blast\n qed \nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestSeq1 n \\ P0 sa xsa zs P1)\n obtain cl where \"fst (last ((LanguageCon.com.Seq P0 P1, sa) # zs)) = Seq cl P1\"\n using CptnModNestSeq1(3) by (metis One_nat_def fst_conv last.simps last_conv_nth last_lift map_is_Nil_conv)\n thus ?case using CptnModNestSeq1(6) by auto\nnext\n case (CptnModNestSeq2 n \\ P0 sa xsa P1 ys zs) \n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" using CptnModNestSeq2\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n thus ?case using CptnModNestSeq2(8) zs by auto \nnext\n case (CptnModNestSeq3 n \\ P1 sa xsa s' ys zs Q1 ) \n have s'_a:\"s' \\ a\" \n proof -\n have cpnP1:\"(\\, (P1, Normal sa) # xsa) \\ cpn n \\ P1 (Normal sa)\" \n using CptnModNestSeq3.hyps(1) unfolding cpn_def\n by fastforce \n then have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\" \n using CptnModNestSeq3.hyps(1) cptn_mod_nest_cptn_mod cptn_if_cptn_mod unfolding cp_def cpn_def\n by fastforce \n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModNestSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely)\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModNestSeq3.hyps(7) CptnModNestSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModNestSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cpn n \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModNestSeq3.hyps(1) \n CptnModNestSeq1\n unfolding cpn_def by fastforce \n then have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModNestSeq3.hyps(1) cp_def cptn_eq_cptn_mod_set \n cptn_mod.CptnModSeq1 cptn_mod_nest_cptn_mod by fastforce\n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely)\" \n using assum_map map cpP1 by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpnP1 CptnModNestSeq3(13) CptnModNestSeq3.prems(1) unfolding com_validityn_def by auto\n thus ?thesis \n using CptnModNestSeq3(3) CptnModNestSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw\"\n proof -\n have cptn:\"(\\, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn\" \n using CptnModNestSeq3(5)\n using cptn_eq_cptn_mod_nest by blast \n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((LanguageCon.com.Throw, Normal s') # ys)) = Throw \\ \n snd (last ((LanguageCon.com.Throw, Normal s') # ys)) = Normal st'\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"(length ((Throw, Normal s') # ys))-1\" a rely]\n s'_a CptnModNestSeq3(11) CptnModNestSeq3(12) by fastforce \n thus ?thesis using CptnModNestSeq3(10) final_def by blast\n qed\n thus ?case using CptnModNestSeq3(10) CptnModNestSeq3(7)\n by force\nqed(auto)\n\nlemma map_xs_ys:\n assumes\n a0:\"(\\, (P0, sa) # xsa) \\ cptn_mod\" and \n a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n a2:\"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod\" and\n a3:\"zs = map (lift P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n a4:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Seq P Q, s)\" and\n a5:\"i < length ((LanguageCon.com.Seq P0 P1, sa) # zs) \\ ((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = (Q, sj)\" and\n a6:\"\\j Q\"\nshows \n \"\\xs ys. (\\, xs) \\ cp \\ P s \\\n (\\, ys) \\ cp \\ Q (snd (xs ! (i - 1))) \\ (LanguageCon.com.Seq P0 P1, sa) # zs = map (lift Q) xs @ ys\"\nproof -\n let ?P0 = \"(P0, sa) # xsa\"\n have P_Q:\"P=P0 \\ s=sa \\ Q = P1\" using a4 by force\n have i:\"i=(length ((P0, sa) # xsa))\" \n proof (cases \"i=(length ((P0, sa) # xsa))\")\n case True thus ?thesis by auto\n next\n case False \n then have i:\"i<(length ((P0, sa) # xsa)) \\ i > (length ((P0, sa) # xsa))\" by auto\n {\n assume i:\"i<(length ((P0, sa) # xsa))\"\n then have eq_map:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = map (lift P1) ((P0, sa) # xsa) ! i\" \n using a3 Cons_lift_append by (metis (no_types, lifting) length_map nth_append) \n then have \"\\ci si. map (lift P1) ((P0, sa) # xsa) ! i = (Seq ci P1,si)\" \n using i unfolding lift_def\n proof -\n have \"map (\\(c, y). (LanguageCon.com.Seq c P1, y)) ((P0, sa) # xsa) ! i = (case ((P0, sa) # xsa) ! i of (c, x) \\ (LanguageCon.com.Seq c P1, x))\"\n by (meson \\i < length ((P0, sa) # xsa)\\ nth_map)\n then show \"\\c x. map (\\(c, x). (LanguageCon.com.Seq c P1, x)) ((P0, sa) # xsa) ! i = (LanguageCon.com.Seq c P1, x)\"\n by (simp add: case_prod_beta)\n qed \n then have \"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i \\ (Q, sj)\" \n using P_Q eq_map by fastforce\n then have ?thesis using a5 by auto\n }note l=this\n {\n assume i:\"i>(length ((P0, sa) # xsa))\"\n have \"fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n using a3 P_Q Cons_lift_append by (metis fstI length_map nth_append_length) \n then have ?thesis using a6 i by auto\n }\n thus ?thesis using l i by auto\n qed\n then have \"(\\, (P0, sa) # xsa) \\ cp \\ P s\" \n using a0 cptn_eq_cptn_mod P_Q unfolding cp_def by fastforce\n also have \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cp \\ Q (snd (?P0 ! ((length ?P0) -1)))\" \n using a3 cptn_eq_cptn_mod P_Q unfolding cp_def\n proof -\n have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod\"\n using a2 P_Q by blast\n then have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\ (\\, ps) \\ cptn \\ f = \\}\"\n by (simp add: cptn_eq_cptn_mod last_length)\n then show \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\ (\\, ps) \\ cptn \\ f = \\}\"\n using P_Q by force\n qed \n ultimately show ?thesis using a3 P_Q i using Cons_lift_append by blast\nqed\n\nlemma map_xs_ys':\n assumes\n a0:\"(n, \\, (P0, sa) # xsa) \\ cptn_mod_nest_call\" and \n a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n a2:\"(n,\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod_nest_call\" and\n a3:\"zs = map (lift P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n a4:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Seq P Q, s)\" and\n a5:\"i < length ((LanguageCon.com.Seq P0 P1, sa) # zs) \\ ((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = (Q, sj)\" and\n a6:\"\\j Q\"\nshows \n \"\\xs ys. (\\, xs) \\ cpn n \\ P s \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i - 1))) \\ (LanguageCon.com.Seq P0 P1, sa) # zs = map (lift Q) xs @ ys\"\nproof -\n let ?P0 = \"(P0, sa) # xsa\"\n have P_Q:\"P=P0 \\ s=sa \\ Q = P1\" using a4 by force\n have i:\"i=(length ((P0, sa) # xsa))\" \n proof (cases \"i=(length ((P0, sa) # xsa))\")\n case True thus ?thesis by auto\n next\n case False \n then have i:\"i<(length ((P0, sa) # xsa)) \\ i > (length ((P0, sa) # xsa))\" by auto\n {\n assume i:\"i<(length ((P0, sa) # xsa))\"\n then have eq_map:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = map (lift P1) ((P0, sa) # xsa) ! i\" \n using a3 Cons_lift_append by (metis (no_types, lifting) length_map nth_append) \n then have \"\\ci si. map (lift P1) ((P0, sa) # xsa) ! i = (Seq ci P1,si)\" \n using i unfolding lift_def\n proof -\n have \"map (\\(c, y). (LanguageCon.com.Seq c P1, y)) ((P0, sa) # xsa) ! i = (case ((P0, sa) # xsa) ! i of (c, x) \\ (LanguageCon.com.Seq c P1, x))\"\n by (meson \\i < length ((P0, sa) # xsa)\\ nth_map)\n then show \"\\c x. map (\\(c, x). (LanguageCon.com.Seq c P1, x)) ((P0, sa) # xsa) ! i = (LanguageCon.com.Seq c P1, x)\"\n by (simp add: case_prod_beta)\n qed \n then have \"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i \\ (Q, sj)\" \n using P_Q eq_map by fastforce\n then have ?thesis using a5 by auto\n }note l=this\n {\n assume i:\"i>(length ((P0, sa) # xsa))\"\n have \"fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n using a3 P_Q Cons_lift_append by (metis fstI length_map nth_append_length) \n then have ?thesis using a6 i by auto\n }\n thus ?thesis using l i by auto\n qed\n then have \"(\\, (P0, sa) # xsa) \\ cpn n \\ P s\" \n using a0 P_Q unfolding cpn_def by fastforce\n also have \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cpn n \\ Q (snd (?P0 ! ((length ?P0) -1)))\" \n using a3 cptn_eq_cptn_mod P_Q unfolding cpn_def\n proof -\n have \"(n, \\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod_nest_call\"\n using a2 P_Q by blast\n then have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\ \n (n, \\, ps) \\ cptn_mod_nest_call \\ f = \\}\"\n by (simp add: cptn_eq_cptn_mod last_length)\n then show \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\ (n,\\, ps) \\ cptn_mod_nest_call \\ f = \\}\"\n using P_Q by force\n qed \n ultimately show ?thesis using a3 P_Q i using Cons_lift_append by blast\nqed\n\n\n\nlemma Seq_sound4: \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Seq P Q),s)\" and\n a2:\"i x!i=(Q,sj)\" and\n a3:\"\\jQ\" and \n a4:\"env_tran_right \\ x rely\" and\n a5:\"snd (x!0)\\ Normal ` p \\ Sta p rely \\ Sta a rely\" and\n a6: \"\\ \\n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n \"\\xs ys. (\\,xs) \\ (cpn n \\ P s) \\ (\\,ys) \\ (cpn n \\ Q (snd (xs!(i-1)))) \\ x = (map (lift Q) xs)@ys\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: i sj P s p) \n case (CptnModNestOne \\ C s1) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C st t n xsa) \n have a1:\"Seq P Q \\ Q\" by simp \n then have C_seq:\"C=(Seq P Q)\" using CptnModNestEnv by fastforce\n then have \"fst(((C, st) # (C, t) # xsa)!0) \\Q\" using CptnEnv a1 by auto\n moreover have n_q:\"fst(((C, st) # (C, t) # xsa)!1) \\Q\" using CptnModNestEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnModNestEnv by auto\n ultimately have i_suc: \"i> (Suc 0)\" \n by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n then have i_minus:\"i'=i-1\" by auto\n have c_init:\"((C, t) # xsa) ! 0 = ((Seq P Q), t)\"\n using CptnModNestEnv by auto \n moreover have \"i'< length ((C,t)#xsa) \\ ((C,t)#xsa)!i' = (Q,sj)\"\n using i' CptnModNestEnv(5) by force\n moreover have \"\\j Q\"\n using i' CptnModNestEnv(6) by force\n moreover have \"snd (((C, t) # xsa) ! 0) \\ Normal ` p\" \n using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n unfolding env_tran_right_def Sta_def by fastforce \n ultimately have hyp:\"\\xs ys.\n (\\, xs) \\ cpn n \\ P t \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift Q) xs @ ys\"\n using CptnModNestEnv(3) env_tran_tail CptnModNestEnv(8) CptnModNestEnv(9) \n CptnModNestEnv.prems(4) by blast \n then obtain xs ys where xs_cp:\"(\\, xs) \\ cpn n \\ P t \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift Q) xs @ ys\"\n by fast\n have \"(\\, (P,s)#xs) \\ cpn n \\ P s\"\n proof -\n have \"xs!0 = (P,t)\" \n using xs_cp unfolding cpn_def by blast\n moreover have \"xs\\[]\"\n using xs_cp n_q c_init unfolding cpn_def by auto \n ultimately obtain xs' where xs':\"(n, \\, (P,t)#xs') \\ cptn_mod_nest_call \\ xs=(P,t)#xs'\" \n using SmallStepCon.nth_tl xs_cp unfolding cpn_def by force\n thus ?thesis \n proof -\n have \"(LanguageCon.com.Seq P Q, s) = (C, st)\"\n using CptnModNestEnv.prems(1) by auto\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\"\n using Seq_env_P CptnModNestEnv(1) by blast\n then show ?thesis\n by (simp add:xs' cpn_def cptn_mod_nest_call.CptnModNestEnv)\n qed\n qed\n thus ?case \n using i_suc Cons_lift_append CptnModNestEnv.prems(1) i' i_minus xs_cp\n by fastforce \nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestSeq1 n \\ P0 sa xsa zs P1) \n then have P1_Q:\"P1 = Q\" by auto\n let ?x = \"(LanguageCon.com.Seq P0 P1, sa) # zs\"\n have \"\\jc s. ?x!j = (Seq c P1,s)\" using CptnModNestSeq1(3)\n proof (induct xsa arbitrary: zs P0 P1 sa)\n case Nil thus ?case by auto\n next\n case (Cons a xsa) \n then obtain ac as where \"a=(ac,as)\" by fastforce\n then have zs:\"zs = (Seq ac P1,as)#(map (lift P1) xsa)\" \n using Cons(2) \n unfolding lift_def by auto\n have zs_eq:\"(map (lift P1) xsa)=(map (lift P1) xsa)\" by auto\n note hyp=Cons(1)[OF zs_eq] \n note hyp[of ac as]\n thus ?case using zs Cons(2) by (metis One_nat_def diff_Suc_Suc diff_zero length_Cons less_Suc_eq_0_disj nth_Cons') \n qed \n thus ?case using P1_Q CptnModNestSeq1(5) using fstI seq_not_eq2 by auto\nnext\n case (CptnModNestSeq2 n \\ P0 sa xsa P1 ys zs) \n then show ?case using map_xs_ys'[OF CptnModNestSeq2(1) CptnModNestSeq2(3) CptnModNestSeq2(4) CptnModNestSeq2(6)\n CptnModNestSeq2(7) CptnModNestSeq2(8) CptnModNestSeq2(9)] by blast\nnext \n case (CptnModNestSeq3 n \\ P1 sa xsa s' ys zs Q1 ) \n then have P_Q:\"P=P1 \\ Q = Q1\" by force\n thus ?case\n proof (cases \"Q1 = Throw\")\n case True thus ?thesis using map_xs_ys'[of n \\ P1 \"Normal sa\" xsa Throw Throw ys zs] \n CptnModNestSeq3 by fastforce\n next \n case False note q_not_throw=this\n have \"\\x. x< length ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) \\\n ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\"\n proof -\n {\n fix x\n assume x_less:\"x< length ((LanguageCon.com.Seq P1 Q1, Normal sa) # zs)\"\n have \"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\"\n proof (cases \"x < length ((LanguageCon.com.Seq P1 Q1, Normal sa)#map (lift Q1) xsa)\")\n case True \n then have eq_map:\"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x = map (lift Q1) ((P1, Normal sa) # xsa) ! x\" \n by (metis (no_types) Cons_lift Cons_lift_append CptnModNestSeq3.hyps(7) True nth_append)\n then have \"\\ci si. map (lift Q1) ((P1, Normal sa) # xsa) ! x = (Seq ci Q1,si)\" \n using True unfolding lift_def\n proof -\n have \"x < length ((P1, Normal sa) # xsa)\"\n using True by auto\n then have \"map (\\(c, y). (LanguageCon.com.Seq c Q1, y)) ((P1, Normal sa) # xsa) ! x = (case ((P1, Normal sa) # xsa) ! x of (c, x) \\ (LanguageCon.com.Seq c Q1, x))\"\n using nth_map by blast\n then show \"\\c x1. map (\\(c, x1). (LanguageCon.com.Seq c Q1, x1)) ((P1, Normal sa) # xsa) ! x = (LanguageCon.com.Seq c Q1, x1)\"\n by (simp add: case_prod_beta')\n qed \n then have \"((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x \\ (Q, sj)\" \n using P_Q eq_map by fastforce \n thus ?thesis using CptnModNestSeq3(10) by auto \n next\n case False \n have s'_a:\"s' \\ a\" \n proof -\n have cpP1:\"(\\, (P1, Normal sa) # xsa) \\ cpn n \\ P1 (Normal sa)\" \n using CptnModNestSeq3.hyps(1) cptn_eq_cptn_mod_set unfolding cpn_def by fastforce\n then have cpP1':\"(\\, (P1, Normal sa) # xsa) \\ cp \\ P1 (Normal sa)\" \n unfolding cpn_def cp_def\n using cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce \n have map:\"((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa) = map (lift Q1) ((P1, Normal sa) # xsa) \"\n using CptnModSeq3 by (simp add: Cons_lift) \n then \n have \"(\\,((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa))) \\ assum (p,rely)\"\n proof - \n have \"env_tran_right \\ ((LanguageCon.com.Seq P1 Q1, Normal sa) # (map (lift Q1) xsa)) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) map\n by (metis (no_types) Cons_lift_append CptnModNestSeq3.hyps(7) CptnModNestSeq3.prems(4) env_tran_subr) \n thus ?thesis using CptnModNestSeq3(12) \n unfolding assum_def env_tran_right_def by fastforce \n qed\n moreover have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cpn n \\ (Seq P1 Q1) (Normal sa)\"\n using CptnModNestSeq3(7) CptnModNestSeq3.hyps(1) cptn_eq_cptn_mod_set cptn_mod_nest_call.CptnModNestSeq1 \n unfolding cpn_def by fastforce \n then have \"(\\,((Seq P1 Q1), Normal sa)#(map (lift Q1) xsa)) \\ cp \\ (Seq P1 Q1) (Normal sa)\"\n unfolding cpn_def cp_def\n by (simp add: cptn_if_cptn_mod cptn_mod_nest_cptn_mod)\n ultimately have \"(\\, (P1, Normal sa) # xsa) \\ assum (p,rely)\" \n using assum_map map cpP1' by fastforce\n then have \"(\\, (P1, Normal sa) # xsa) \\ comm (G,(q,a)) F\" \n using cpP1 CptnModNestSeq3(13) CptnModNestSeq3.prems(1) unfolding com_validityn_def by auto\n thus ?thesis \n using CptnModNestSeq3(3) CptnModNestSeq3(4)\n unfolding comm_def final_def by fastforce\n qed\n have all_throw:\"\\i, (LanguageCon.com.Throw, Normal s') # ys) \\ cptn_mod_nest_call\" \n using CptnModNestSeq3(5) by auto\n moreover have throw_0:\"((LanguageCon.com.Throw, Normal s') # ys)!0 = (Throw, Normal s') \\ 0 < length((LanguageCon.com.Throw, Normal s') # ys)\"\n by force \n moreover have last:\"last ((LanguageCon.com.Throw, Normal s') # ys) = ((LanguageCon.com.Throw, Normal s') # ys)!((length ((LanguageCon.com.Throw, Normal s') # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((LanguageCon.com.Throw, Normal s') # ys) rely\" \n using CptnModNestSeq3(11) CptnModNestSeq3(7) env_tran_subl env_tran_tail by blast \n ultimately have \n \"fst (((LanguageCon.com.Throw, Normal s')# ys)!i) = Throw\" \n using zero_throw_all_throw[of \\ \"((Throw, Normal s') # ys)\" \"s'\" \"i\" a rely]\n s'_a CptnModNestSeq3(12) i\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by auto\n } \n thus ?thesis using CptnModNestSeq3(10) final_def by blast \n qed \n then have \n \"\\x\\ length ((LanguageCon.com.Seq P1 Q1, Normal sa) # map (lift Q1) xsa). \n x\n fst (((LanguageCon.com.Seq P1 Q1, Normal sa) # zs) ! x) = Throw\" \n proof-\n {\n fix x \n assume a1:\"x\\ length ((LanguageCon.com.Seq P1 Q1, Normal sa) # map (lift Q1) xsa)\" and\n a2:\"x\\\\<^sub>c(Seq c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Seq_skip_c2:\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (c2,s)\"\n\n\nlemma seq_skip_throw:\n \"\\\\\\<^sub>c(Seq c1 c2,s) \\ (c2,s) \\ c1= Skip \\ (c1=Throw \\ (\\s2'. s=Normal s2'))\"\napply (rule stepc_elim_cases_Seq_skip_c2)\napply fastforce\napply (auto)+\napply (fastforce intro:redex_not_Seq)+\ndone\n\nlemma Seq_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\\n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\\n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\ \n Sta a R \\ Sta p R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n a1:\"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n a2:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and \n a3: \"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and \n a4: \"Sta a R \\ Sta p R\" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a1:\"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" \n using a1 com_cvalidityn_def by fastforce \n then have a3: \"\\ \\n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\"\n using a3 com_cvalidityn_def all_call by fastforce \n have \"cpn n \\ (Seq c1 c2) s \\ assum(p, R) \\ comm(G, (r,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Seq c1 c2) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (Seq c1 c2) s\" unfolding cpn_def cp_def\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((Seq c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce\n have cptn_nest:\"l!0=((Seq c1 c2),s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\=\\1\" using a10 cpn_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have \"c \\ comm(G, (r,a)) F\" \n proof - \n {\n assume l_f:\"snd (last l) \\ Fault ` F\" \n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\\\n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof (cases \"\\i c2\")\n case True \n then have no_c2:\"\\i c2\" by assumption\n show ?thesis\n proof (cases \"final (last l)\")\n case True\n then obtain s' where \"fst (last l) = Skip \\ (fst (last l) = Throw \\ snd (last l) = Normal s')\" \n using final_def by fast \n thus ?thesis\n proof\n assume \"fst (last l) = LanguageCon.com.Skip\" \n then have \"False\" \n using no_c2 env_tran_right cptn_nest cptn_eq_cptn_mod_set Seq_sound3 a4 a1 assum\n by blast\n thus ?thesis by auto\n next \n assume asm0:\"fst (last l) = LanguageCon.com.Throw \\ snd (last l) = Normal s'\"\n then obtain lc1 s1' ys where cpn_lc1:\"(\\,lc1) \\ cpn n \\ c1 s \\ l = ((map (lift c2) lc1)@((Throw, Normal s1')#ys))\"\n using Seq_sound2'[of n \\ l c1 c2 s s'] cptn_nest cptn_eq_cptn_mod_set env_tran_right no_c2 by blast\n then have cp_lc1:\"(\\,lc1) \\ cp \\ c1 s\"\n using cptn_if_cptn_mod cptn_mod_nest_cptn_mod split_conv \n unfolding cp_def cpn_def by blast\n let ?m_lc1 = \"map (lift c2) lc1\"\n let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" \n have lc1_not_empty:\"lc1 \\ []\"\n using \\1 a10 cpn_lc1 cp by auto \n then have map_cpn:\"(\\,?m_lc1) \\ cpn n \\ (Seq c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (n,\\, lc1) \\ cptn_mod_nest_call \\ \\ = \\\"\n using cpn_lc1 cpn_def by blast\n then have f2: \"(n, \\, ?m_lc1) \\ cptn_mod_nest_call\" \n by (metis (no_types) Cons_lift cptn_mod_nest_call.CptnModNestSeq1 f1 lc1_not_empty list.exhaust nth_Cons_0) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cpn_def lift_def)\n qed\n then have map_cp:\"(\\,?m_lc1) \\ cp \\ (Seq c1 c2) s\"\n by (metis (no_types, lifting) cp_def cp_lc1 cpn_def lift_is_cptn mem_Collect_eq split_conv) \n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R)\"\n using sub_assum a10 a11 \\1 cpn_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 assum_map cp_lc1 by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,a)) F\" \n using a1 cpn_lc1 unfolding com_validityn_def by blast\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,a)) F\"\n using map_cp map_assum comm_map cp_lc1 by fastforce\n then have last_m_lc1:\"last (?m_lc1) = (Seq (fst (last lc1)) c2,snd (last lc1))\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n using Cons_lift by force\n then show ?thesis\n by (simp add: last_map a000 lc1_not_empty)\n qed\n then have last_length:\"last (?m_lc1) = ?last_m_lc1\" \n using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n using cpn_lc1\n by (simp add:lc1_not_empty nth_append)\n then have lm_lc1:\"l!(?lm_lc1) = (Throw, Normal s1')\"\n using cpn_lc1 by (meson nth_append_length) \n then have step:\"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\ (l!(?lm_lc1))\"\n proof -\n have \"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift c2) lc1)\"\n by (meson length_greater_0_conv)\n then have \"length (map (lift c2) lc1) - 1 + 1 < length (map (lift c2) lc1 @ (LanguageCon.com.Throw, Normal s1') # ys)\"\n by simp\n then show ?thesis\n using f2 f1\n by (metis Suc_pred' cp cpn_lc1 cptn_tran_ce_i)\n qed\n moreover have \"\\\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>e (l!(?lm_lc1))\"\n using last_m_lc1 last_length l_map\n proof -\n have \"(LanguageCon.com.Seq (fst (last lc1)) c2, snd (last lc1)) = l ! (length (map (lift c2) lc1) - 1)\"\n using l_map last_m_lc1 local.last_length by presburger\n then show ?thesis\n by (metis (no_types) LanguageCon.com.distinct(71) \\l ! length (map (lift c2) lc1) = (LanguageCon.com.Throw, Normal s1')\\ env_c_c')\n qed\n ultimately show ?thesis using step_ce_elim_cases by blast \n qed\n then have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = snd (l!?lm_lc1) \\ fst (l!(?lm_lc1-1)) = Seq Throw c2\"\n using lm_lc1 stepc_elim_cases_Seq_throw\n by (metis One_nat_def asm0 append_is_Nil_conv cpn_lc1 diff_Suc_less fst_conv l_map last_conv_nth last_m_lc1 length_greater_0_conv list.simps(3) local.last_length no_c2 snd_conv) \n then have a_normal:\"snd (l!?lm_lc1) \\ Normal ` (a)\" \n proof\n have last_lc1:\"fst (last lc1) = Throw \\ snd (last lc1) = Normal s1'\" \n using last_length l_map lm_lc1 last_m_lc1 last_lc1_suc\n by (metis LanguageCon.com.inject(3) fst_conv snd_conv) \n have \"final (last lc1)\" using last_lc1 final_def \n by blast\n moreover have \"snd (last lc1)\\ Fault ` F\" \n using last_lc1 by fastforce\n ultimately have \"(fst (last lc1) = Throw \\ \n snd (last lc1) \\ Normal ` (a))\" \n using lc1_comm last_lc1 unfolding comm_def by force\n thus ?thesis using l_map last_lc1_suc last_m_lc1 last_length by auto\n qed \n have concl:\"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n then have i_m_l:\"\\i []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (no_types) cpn_lc1 nth_append)\n qed\n have last_not_F:\"snd (last ?m_lc1) \\ Fault ` F\" \n using l_map last_lc1_suc lm_lc1 last_length by auto \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< ?lm_lc1\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis\n by (metis (no_types) True a21 i_m_l zero_less_diff)\n qed \n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' m_lc1_comm True comm_dest1 l_f last_not_F by fastforce\n thus ?thesis using i_m_l using True by fastforce\n next\n case False \n then have \"(Suc k=?lm_lc1) \\ (Suc k>?lm_lc1)\" by auto\n thus ?thesis \n proof\n {assume suck:\"(Suc k=?lm_lc1)\"\n then have k:\"k=?lm_lc1-1\" by auto\n have G_s1':\"(Normal s1', Normal s1')\\G\" \n using a5 by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\" \n proof -\n have \"snd (l!Suc k) = Normal s1'\" \n using lm_lc1 suck by fastforce \n then show ?thesis using suck k G_s1' last_lc1_suc by fastforce\n qed\n }\n next\n { \n assume a001:\"Suc k>?lm_lc1\"\n have \"\\i. i\\(length lc1) \\ (Suc i < length l) \\ \n \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using lm_lc1 lc1_not_empty\n proof -\n have \"env_tran_right \\ l R\"\n by (metis env_tran_right)\n then show ?thesis \n using a_normal cp fst_conv length_map \n lm_lc1 only_one_component_tran_j[of \\ l ?lm_lc1 s1' a k R] snd_conv a21 a001 a00\n a4 by auto\n qed\n then have \"\\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using a00 a001 by auto \n then show ?thesis using a21 by fastforce \n }\n qed \n qed\n } thus ?thesis by auto \n qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\" \n proof -\n have l_t:\"fst (last l) = Throw\" \n using lm_lc1 by (simp add: asm0)\n have \"?lm_lc1 \\ length l -1\" using cpn_lc1 by fastforce\n then have \"snd (l ! (length l - 1)) \\ Normal ` a\"\n using cp a_normal a4 fst_conv lm_lc1 snd_conv \n env_tran_right i_throw_all_throw[of \\ l ?lm_lc1 s1' \"(length l -1)\" _ R a ]\n by (metis (no_types, lifting) One_nat_def diff_is_0_eq diff_less diff_less_Suc diff_zero image_iff length_greater_0_conv lessI less_antisym list.size(3) xstate.inject(1)) \n thus ?thesis using l_t \n by (simp add: cpn_lc1 last_conv_nth)\n qed\n note res = conjI [OF concl concr]\n then show ?thesis using \\1 c_prod unfolding comm_def by auto\n qed \n next\n case False\n then obtain lc1 where cpn_lc1:\"(\\,lc1) \\ cpn n \\ c1 s \\ l = map (lift c2) lc1\" \n using Seq_sound1 assum False no_c2 env_tran_right cptn_nest cptn_eq_cptn_mod_set a4 a1 \n by blast \n then have cp_lc1:\"(\\,lc1) \\ cp \\ c1 s \"\n using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce \n then have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 cpn_lc1 a10' a11 assum_map by blast\n then have \"(\\, lc1)\\ comm(G, (q,a)) F\" using cpn_lc1 a1\n by (meson IntI com_validityn_def contra_subsetD)\n then have \"(\\, l)\\ comm(G, (r,a)) F\"\n using comm_map a10' \\1 cp_lc1 cpn_lc1 by blast\n then show ?thesis using l_f\n unfolding comm_def by auto\n qed\n next \n case False \n then obtain k where k_len:\"k fst (l ! k) = c2\"\n by blast \n then have \"\\m. (m < length l \\ fst (l ! m) = c2) \\\n (\\i (i < length l \\ fst (l ! i) = c2))\" \n using a0 exists_first_occ[of \"(\\i. i fst (l ! i) = c2)\" k] \n by blast\n then obtain i where a0:\"i fst (l !i) = c2 \\\n (\\j c2))\"\n by fastforce \n then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n then obtain lc1 lc2 where cp_lc1:\"(\\,lc1) \\ (cpn n \\ c1 s) \\ \n (\\,lc2) \\ (cpn n \\ c2 (snd (lc1!(i-1)))) \\ \n l = (map (lift c2) lc1)@lc2\"\n using Seq_sound4[of n \\ l c1 c2 s] a0 env_tran_right a4 a1 cptn_nest assum by blast \n then have cp_lc1':\"(\\,lc1) \\ (cp \\ c1 s) \\ \n (\\,lc2) \\ (cp \\ c2 (snd (lc1!(i-1))))\"\n unfolding cp_def cpn_def cptn_eq_cptn_mod_nest by fastforce\n have \"\\i < length l. snd (l!i) \\ Fault ` F\"\n using cp l_f last_not_F[of \\ l F] by blast \n then have i_not_fault:\"snd (l!i) \\ Fault ` F\" using a0 by blast\n have length_c1_map:\"length lc1 = length (map (lift c2) lc1)\" \n by fastforce \n then have i_map:\"i=length lc1\" \n using cp_lc1 li a0 unfolding lift_def\n proof -\n assume a1: \"(\\, lc1) \\ cpn n \\ c1 s \\ (\\, lc2) \\ cpn n \\ c2 (snd (lc1 ! (i - 1))) \\ l = map (\\(P, s). (LanguageCon.com.Seq P c2, s)) lc1 @ lc2\"\n have f2: \"i < length l \\ fst (l ! i) = c2 \\ (\\n. \\ n < i \\ fst (l ! n) \\ c2)\"\n using a0 by blast\n have f3: \"(LanguageCon.com.Seq (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift c2 (lc1 ! i)\"\n by (simp add: case_prod_unfold lift_def) \n then have \"fst (l ! length lc1) = c2\"\n using a1 by (simp add: cpn_def nth_append)\n thus ?thesis\n using f3 f2 by (metis (no_types) nth_append cp_lc1 \n fst_conv length_map lift_nth linorder_neqE_nat seq_and_if_not_eq(4))\n qed \n have lc2_l:\"\\j []\"\n using cp cp_lc1 unfolding cpn_def by fastforce \n have lc2_not_empty:\"lc2 \\ []\"\n using a0 cp_lc1 i_map by auto \n have l_is:\"s2= snd (last lc1)\"\n using cp_lc1 li a0 lc1_not_empty i_map unfolding cpn_def\n by (auto simp add: last_conv_nth lc2_l) \n let ?m_lc1 = \"map (lift c2) lc1\"\n (* let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *) \n have last_m_lc1:\"l!(i-1) = (Seq (fst (last lc1)) c2,s2)\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n using Cons_lift by force\n have \"length (map (lift c2) lc1) = i\"\n using i_map by fastforce\n then show ?thesis\n by (metis (no_types) One_nat_def l_is a000 cp_lc1 diff_less last_conv_nth last_map \n lc1_not_empty length_c1_map length_greater_0_conv less_Suc0 nth_append) \n qed \n have last_mcl1_not_F:\"snd (last ?m_lc1) \\ Fault ` F\" \n proof -\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (full_types) One_nat_def i_not_fault l_is last_conv_nth last_snd lc1_not_empty li snd_conv)\n qed \n have map_cp:\"(\\,?m_lc1) \\ cpn n \\ (Seq c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (n,\\, lc1) \\ cptn_mod_nest_call \\ \\ = \\\"\n using cp_lc1 cpn_def by blast\n then have f2: \"(n,\\, ?m_lc1) \\ cptn_mod_nest_call\" using lc1_not_empty\n by (metis Cons_lift SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestSeq1)\n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cpn_def lift_def)\n qed\n then have map_cp':\"(\\,?m_lc1) \\ cp \\ (Seq c1 c2) s\"\n unfolding cpn_def cp_def\n using cptn_eq_cptn_mod_nest by fastforce\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R)\" \n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 assum_map using assum_map cp_lc1' by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,a)) F\" \n using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,a)) F\"\n using map_cp' map_assum comm_map cp_lc1' by fastforce \n then have i_step:\"\\\\\\<^sub>c(l!(i-1)) \\ (l!i)\"\n proof -\n have \"\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>c\\<^sub>e (l!(i))\"\n proof -\n have f1: \"\\n na. \\ n < na \\ Suc (na - Suc n) = na - n\"\n by (meson Suc_diff_Suc)\n have \"map (lift c2) lc1 \\ []\"\n by (metis lc1_not_empty map_is_Nil_conv)\n then have f2: \"0 < length (map (lift c2) lc1)\"\n by (meson length_greater_0_conv) \n then have \"length (map (lift c2) lc1) - 1 + 1 < length (map (lift c2) lc1 @ lc2)\"\n using f2 lc2_not_empty by simp\n then show ?thesis\n using f2 f1\n proof -\n have \"0 < i\"\n using f2 i_map by blast\n then show ?thesis\n by (metis (no_types) One_nat_def Suc_diff_1 a0 add.right_neutral add_Suc_right cp cptn_tran_ce_i)\n qed \n qed \n moreover have \"\\\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>e (l!i)\" \n using li last_m_lc1\n by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(4))\n ultimately show ?thesis using step_ce_elim_cases by blast\n qed \n then have step:\"\\\\\\<^sub>c(Seq (fst (last lc1)) c2,s2) \\ (c2, s2)\"\n using last_m_lc1 li by fastforce\n then obtain s2' where \n last_lc1:\"fst (last lc1) = Skip \\ \n fst (last lc1) = Throw \\ (s2 = Normal s2')\" \n using seq_skip_throw by blast \n have final:\"final (last lc1)\" \n using last_lc1 l_is unfolding final_def by auto\n(* look here for the property *******************************************************************************)\n have normal_last:\"fst (last lc1) = Skip \\ snd (last lc1) \\ Normal ` q \\\n fst (last lc1) = Throw \\ snd (last lc1) \\ Normal ` (a)\" \n proof - \n have \"snd (last lc1) \\ Fault ` F\"\n using i_not_fault l_is li by auto\n then show ?thesis\n using final comm_dest2 lc1_comm by blast\n qed\n obtain s2' where lastlc1_normal:\"snd (last lc1) = Normal s2'\" \n using normal_last by blast\n then have Normals2:\"s2 = Normal s2'\" by (simp add: l_is ) \n have Gs2':\"(Normal s2', Normal s2')\\G\" using a5 by auto \n have concl:\n \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k \n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have i_m_l:\"\\j []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis \n using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append) \n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< i\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis using True a21 i_m_l by force \n qed \n have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' last_mcl1_not_F m_lc1_comm True i_map length_c1_map \n comm_dest1[of \\]\n by blast\n thus ?thesis using i_m_l using True by fastforce \n next\n case False \n have \"(Suc k=i) \\ (Suc k>i)\" using False by auto\n thus ?thesis \n proof\n { assume suck:\"(Suc k=i)\" \n then have k:\"k=i-1\" by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\" \n proof -\n have \"snd (l!Suc k) = Normal s2'\" \n using Normals2 suck li by auto \n moreover have \"snd (l ! k) = Normal s2'\" \n using Normals2 k last_m_lc1 by fastforce \n moreover have \"\\p. p \\ G \"\n by (meson case_prod_conv mem_Collect_eq Gs2')\n ultimately show ?thesis using suck k Normals2\n using Gs2' by force \n qed\n }\n next\n { \n assume a001:\"Suc k>i\"\n then have k:\"k\\i\" by fastforce\n then obtain k' where k':\"k=i+k'\" \n using add.commute le_Suc_ex by blast\n {assume throw:\"c2=Throw \\ fst (last lc1) = Throw\"\n then have s2_in:\"s2' \\ a\" \n using Normals2 i_map normal_last li lastlc1_normal \n using image_iff snd_conv xstate.inject(1) by auto\n \n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a21 a001 a00 a4\n a0 throw env_tran_right only_one_component_tran_j snd_conv \n by (metis cp env_tran_right)\n then have ?thesis using a21 a001 k a00 by blast \n } note left=this\n {assume \"\\(c2=Throw \\ fst (last lc1) = Throw)\"\n then have \"fst (last lc1) = Skip\"\n using last_m_lc1 last_lc1\n by (metis step a0 l_is li prod.collapse stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(5)) \n then have s2_normal:\"s2 \\ Normal ` q\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (q,R)\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` q\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\"\n \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cpn n \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce \n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (r,a)) F\"\n using a3 unfolding com_validityn_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce\n have suck':\"Suc k' < length lc2\" \n using k' a00 length_lc2 by arith\n moreover then have \"\\\\\\<^sub>c(lc2!k') \\ (lc2!(Suc k'))\" \n using k' lc2_l a21 by fastforce\n ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\ G\"\n using comm_lc2 lc2_last_f comm_dest1[of \\ lc2 G r a F k'] \n by blast\n then have ?thesis using suck' lc2_l k' by fastforce\n } \n then show ?thesis using left by auto \n }\n qed \n qed\n } thus ?thesis by auto \n qed note left=this\n have right:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a))\"\n proof -\n { assume final_l:\"final (last l)\" \n have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n then have final_lc2:\"final (last lc2)\" using final_l by auto\n {\n assume lst_lc1_throw:\"fst (last lc1) = Throw\" \n then have c2_throw:\"c2 = Throw\" \n using lst_lc1_throw step lastlc1_normal stepc_elim_cases_Seq_skip_c2\n by fastforce \n have s2_a:\"s2 \\ Normal ` (a)\"\n using normal_last \n by (simp add: lst_lc1_throw l_is)\n have all_ev:\"\\ki \\ (Suc k < length l) \\ \n \\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))\"\n proof -\n have s2_in:\"s2' \\ a\" \n using Normals2 i_map normal_last li lastlc1_normal \n using image_iff snd_conv xstate.inject(1) lst_lc1_throw by auto\n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a4\n a0 c2_throw env_tran_right only_one_component_tran_j snd_conv \n by (metis cp env_tran_right) \n thus ?thesis by (metis Suc_eq_plus1 cp cptn_tran_ce_i step_ce_elim_cases) \n qed \n then have Throw:\"fst (l!(length l - 1)) = Throw\"\n using cp c2_throw a0 cptn_i_env_same_prog[of \\ l \"((length l)-1)\" i] \n by fastforce \n then have \"snd (l!(length l - 1)) \\ Normal ` (a) \\ fst (l!(length l - 1)) = Throw\"\n using all_ev a0 s2_a li a4 env_tran_right stability[of a R l i \"(length l) -1\" _ \\] Throw \n by (metis One_nat_def Suc_pred length_greater_0_conv \n lessI linorder_not_less list.size(3) \n not_less0 not_less_eq_eq snd_conv) \n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using a0 by (metis last_conv_nth list.size(3) not_less0) \n } note left = this\n { assume \"fst (last lc1) = Skip\" \n then have s2_normal:\"s2 \\ Normal ` q\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (q,R)\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` q\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\" \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cpn n \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (r,a)) F\"\n using a3 unfolding com_validityn_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce \n then have \"((fst (last lc2) = Skip \\ \n snd (last lc2) \\ Normal ` r)) \\\n (fst (last lc2) = Throw \\ \n snd (last lc2) \\ Normal ` a)\" \n using final_lc2 comm_lc2 unfolding comm_def by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\" \n using eq_last_lc2_l by auto\n }\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` r)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` a)\" \n using left using last_lc1 by auto\n } thus ?thesis by auto qed \n thus ?thesis using left l_f \\1 unfolding comm_def by force \n qed \n } thus ?thesis using \\1 unfolding comm_def by auto qed\n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma Catch_env_P:assumes a0:\"\\\\\\<^sub>c(Catch P Q,s) \\\\<^sub>e (Catch P Q,t)\"\n shows \"\\\\\\<^sub>c(P,s) \\\\<^sub>e (P,t)\"\nusing a0\nby (metis env_not_normal_s snormal_enviroment)\n\nlemma map_catch_eq_state:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n \"\\i,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Catch c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\\\<^sub>e l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod \n by (simp add: lift_catch_def) \n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\\\<^sub>e (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (metis Env_n env_c_c' env_not_normal_s step_e.Env)\n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\\\<^sub>e l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod\n by (simp add: lift_catch_def)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\\\<^sub>e (l2 ! Suc i)\" \n using a4 l1prod l2prod \n by (metis Env_n LanguageCon.com.inject(9) env_c_c' env_not_normal_s step_e.Env) \n }\n qed\n } \n thus ?thesis by auto\nqed\n\n\nlemma same_comp_catch_c:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \nproof -\n have a0a:\"(\\,l1) \\cptn \\ l1!0 = ((Catch c1 c2),s)\" \n using a0 unfolding cp_def by blast\n have a1a: \"(\\,l2) \\cptn \\ l2!0 = (c1,s)\"\n using a1 unfolding cp_def by blast\n {\n fix i\n assume a3:\"Suc i< length l2\"\n have \"\\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\"\n proof\n {\n assume a4:\"\\\\\\<^sub>c l2 ! i \\ l2 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 map_eq_catch_c l1prod\n by (simp add: lift_catch_def)\n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod map_eq_state l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l1 ! i \\ (l1 ! Suc i)\" \n using a4 l1prod l2prod\n by (simp add: Catchc) \n } \n {\n assume a4:\"\\\\\\<^sub>c l1 ! i \\ l1 ! Suc i\"\n obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\ l1!Suc i = (c1si,s1si)\"\n by fastforce\n obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\ l2!Suc i = (c2si,s2si)\"\n by fastforce\n then have \"c1i = (Catch c2i c2) \\ c1si = (Catch c2si c2)\"\n using a0 a1 a2 a3 a4 l1prod\n by (simp add: lift_catch_def) \n also have \"s2i=s1i \\ s2si=s1si\"\n using a0 a1 a4 a2 a3 l2prod l1prod\n by (simp add: lift_catch_def) \n ultimately show \"\\\\\\<^sub>c l2 ! i \\ (l2 ! Suc i)\" \n using a4 l1prod l2prod stepc_elim_cases_Catch_Catch Catch_not_c\n by (metis (no_types))\n }\n qed\n } \n thus ?thesis by auto\nqed\n\nlemma assum_map_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s) \\ ((\\,l1) \\ assum(p, R))\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"((\\,l2) \\ assum(p, R))\"\nproof -\n have a3: \"\\i. Suc i \\\\\\<^sub>c(l2!i) \\\\<^sub>e (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\\\<^sub>e (l1!(Suc i))\" \n using a0 a1 a2 same_env_catch_c by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n obtain s' where normal_s:\"s = Normal s'\" \n using a0 unfolding cp_def assum_def by fastforce\n then have p1:\"s'\\p\" using a0 unfolding cp_def assum_def by fastforce \n show ?thesis \n proof - \n let ?c= \"(\\,l2)\"\n have l:\"snd((snd ?c!0)) \\ Normal ` (p)\"\n using p1 drop_k_s a1 normal_s unfolding cp_def by auto\n {fix i\n assume a00:\"Suc i\\<^sub>c((snd ?c)!i) \\\\<^sub>e ((snd ?c)!(Suc i))\"\n have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\ R\"\n using a0 a1 a2 a3 map_catch_eq_state unfolding assum_def \n using a00 a11 eq_length by fastforce\n } thus \"(\\, l2) \\ assum (p, R)\" \n using l unfolding assum_def by fastforce \n qed \nqed\n\nlemma comm_map'_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\(Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (fst (last l1) = (Catch c c2) \\ final (c, snd (last l1)) \\ \n (fst (last l1) = (Catch Skip c2) \\ \n (snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Catch Throw c2) \\ \n snd (last l1) \\ Normal ` (a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_catch_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n have len0:\"length l2>0\" using a1 unfolding cp_def \n using cptn.simps by fastforce \n then have len0:\"length l1>0\" using eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_catch_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed\n then have \"snd (last l1) \\ Fault ` F \\\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis Suc_lessD a0 a1 a2 map_catch_eq_state)\n } note l=this\n {\n assume a00: \"fst (last l1) = (Catch c c2) \\ final (c, snd (last l1))\" and\n a01:\"snd (last (l1)) \\ Fault ` F\"\n then have c:\"c=Skip \\ c = Throw\"\n unfolding final_def by auto \n then have fst_last_l2:\"fst (last l2) = c\" \n using last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift_catch \n by fastforce \n also have last_eq:\"snd (last l2) = snd (last l1)\" \n using l2_not_empty a2 last_conv_nth last_lenl1 last_snd_catch\n by fastforce\n ultimately have \"final (fst (last l2),snd (last l2))\" \n using a00 by auto\n then have \"final (last l2)\" by auto\n also have \"snd (last (l2)) \\ Fault ` F\"\n using last_eq a01 by auto\n ultimately have \"(fst (last l2)) = Skip \\ \n snd (last l2) \\ Normal ` q \\\n (fst (last l2) = Throw \\ \n snd (last l2) \\ Normal ` (a))\"\n using a03 by auto\n then have \"(fst (last l1) = (Catch Skip c2) \\ \n snd (last l1) \\ Normal ` q) \\\n (fst (last l1) = (Catch Throw c2) \\ \n snd (last l1) \\ Normal ` (a))\"\n using last_eq fst_last_l2 a00 by force\n }\n thus ?thesis using l by auto qed\nqed\n\nlemma comm_map''_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"snd (last l1) \\ Fault ` F \\ ((Suc k < length l1 \\\n \\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd(l1!k), snd(l1!(Suc k))) \\ G) \\ \n (final (last l1) \\ \n (fst (last l1) = Skip \\ \n (snd (last l1) \\ Normal ` r) \\\n (fst (last l1) = Throw \\ \n snd (last l1) \\ Normal ` a))))\n \"\nproof -\n have a3:\"\\i. Suc i \\\\\\<^sub>c(l2!i) \\ (l2!(Suc i)) = \n \\\\\\<^sub>c(l1!i) \\ (l1!(Suc i))\" \n using a0 a1 a2 same_comp_catch_c\n by fastforce\n have pair_\\l1:\"fst (\\,l1) = \\ \\ snd (\\,l1) = l1\" by fastforce\n have pair_\\l2:\"fst (\\,l2) = \\ \\ snd (\\,l2) = l2\" by fastforce\n have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n have eq_length:\"length l1 = length l2\" using a2 by auto\n have len0:\"length l2>0\" using a1 unfolding cp_def \n using cptn.simps by fastforce \n then have len0:\"length l1>0\" using eq_length by auto\n then have l1_not_empty:\"l1\\[]\" by auto\n then have l2_not_empty:\"l2 \\ []\" using a2 by blast \n have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n using last_conv_nth l1_not_empty by auto\n have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n using last_conv_nth l2_not_empty by auto \n have a03:\"snd (last l2) \\ Fault ` F \\(\\i ns ns'. \n Suc i, l2)) \\ \n fst (\\, l2)\\\\<^sub>c((snd (\\, l2))!i) \\ ((snd (\\, l2))!(Suc i)) \\ \n (snd((snd (\\, l2))!i), snd((snd (\\, l2))!(Suc i))) \\ G) \\ \n (final (last (snd (\\, l2))) \\ \n ((fst (last (snd (\\, l2))) = Skip \\ \n snd (last (snd (\\, l2))) \\ Normal ` q)) \\\n (fst (last (snd (\\, l2))) = Throw \\ \n snd (last (snd (\\, l2))) \\ Normal ` (a)))\"\n using a1 unfolding comm_def by fastforce\n show ?thesis unfolding comm_def \n proof -\n { fix k ns ns'\n assume a00a:\"snd (last l1) \\ Fault ` F\"\n assume a00:\"Suc k < length l1\" \n then have \"k \\ length l1\" using a2 by fastforce \n have a00:\"Suc k < length l2\" using eq_length a00 by fastforce \n then have a00a:\"snd (last l2) \\ Fault ` F\"\n proof-\n have \"snd (l1!((length l1) -1)) = snd (l2!((length l2) -1))\" \n using a2 a1 a0 map_catch_eq_state eq_length l2_not_empty last_snd \n by fastforce \n then have \"snd(last l2) = snd (last l1)\"\n using last_lenl1 last_lenl2 by auto\n thus ?thesis using a00a by auto\n qed \n then have \"\\\\\\<^sub>c(l1!k) \\ (l1!(Suc k)) \\ \n (snd((snd (\\, l1))!k), snd((snd (\\, l1))!(Suc k))) \\ G\"\n using pair_\\l1 pair_\\l2 a00 a03 a3 eq_length a00a\n by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift_catch)\n } note l= this\n {\n assume a00: \"final (last l1)\" \n then have c:\"fst (last l1)=Skip \\ fst (last l1) = Throw\"\n unfolding final_def by auto \n moreover have \"fst (last l1) = Catch (fst (last l2)) c2\" \n using a2 last_lenl1 eq_length\n proof -\n have \"last l2 = l2 ! (length l2 - 1)\"\n using l2_not_empty last_conv_nth by blast\n then show ?thesis\n by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift_catch)\n qed\n ultimately have False by simp \n } thus ?thesis using l by auto qed\nqed\n\nlemma comm_map_catch:\nassumes \n a0:\"(\\,l1) \\ (cp \\ (Catch c1 c2) s)\" and\n a1:\"(\\,l2) \\ (cp \\ c1 s) \\ (\\, l2)\\ comm(G, (q,a)) F\" and\n a2:\"l1=map (lift_catch c2) l2\" \nshows\n \"(\\, l1)\\ comm(G, (r,a)) F\"\nproof - \n {fix i ns ns'\n have \"snd (last l1) \\ Fault ` F \\(Suc i < length (l1) \\\n \\\\\\<^sub>c (l1 ! i) \\ (l1 ! (Suc i)) \\ \n (snd (l1 ! i), snd (l1 ! Suc i)) \\ G) \\\n (SmallStepCon.final (last l1) \\ \n fst (last l1) = LanguageCon.com.Skip \\\n snd (last l1) \\ Normal ` r \\\n fst (last l1) = LanguageCon.com.Throw \\\n snd (last l1) \\ Normal ` a) \"\n using comm_map''_catch[of \\ l1 c1 c2 s l2 G q a F i r] a0 a1 a2 \n by fastforce\n } then show ?thesis using comm_def unfolding comm_def by force \nqed\n\nlemma Catch_sound1: \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"\\ final (last x)\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs. (\\,xs) \\ cpn n \\ P s \\ x = map (lift_catch Q) xs\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnModNestOne n \\ C s1)\n then have \"(\\, [(P,s)]) \\ cpn n \\ P s \\ [(C, s1)] = map (lift_catch Q) [(P,s)]\"\n unfolding cpn_def lift_catch_def\n by (simp add: cptn_mod_nest_call.CptnModNestOne) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C s1 t1 n xsa)\n then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n have \"\\xs. (\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (Catch P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModNestEnv(5) by fastforce\n moreover have \"\\ SmallStepCon.final (last ((C, t1) # xsa))\" using CptnModNestEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModNestEnv(3) CptnModNestEnv(7) env_tran_tail by blast \n qed \n then obtain xs where hi:\"(\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModNestEnv unfolding cpn_def by auto\n obtain xsa' where xs:\"xs=((P,t1)#xsa') \\ (n,\\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ \n (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')\" \n using hi unfolding cpn_def by fastforce\n \n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModNestEnv Catch_env_P by (metis fst_conv nth_Cons_0) \n then have \"(n,\\,(P,s1)#(P,t1)#xsa')\\cptn_mod_nest_call\" using xs env_tran \n using cptn_mod_nest_call.CptnModNestEnv by blast \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cpn n \\ P s\" \n using cpn_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')\"\n using xs C unfolding lift_catch_def by fastforce\n ultimately show ?case by auto\nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModNestCatch1 n \\ P0 sa xsa zs P1)\n then have a1:\"LanguageCon.com.Catch P Q = LanguageCon.com.Catch P0 P1\"\n by fastforce \n have f1: \"sa = s\"\n using CptnModNestCatch1.prems(1) by force\n have f2: \"P = P0 \\ Q = P1\" using a1 by auto\n have \"(n,\\, (P0, sa) # xsa) \\ cptn_mod_nest_call\"\n by (metis CptnModNestCatch1.hyps(1))\n hence \"(\\, (P0, sa) # xsa) \\ cpn n \\ P s\"\n using f2 f1 by (simp add: cpn_def)\n thus ?case\n using Cons_lift_catch CptnModNestCatch1.hyps(3) a1 by blast \nnext\n case (CptnModNestCatch2 n \\ P1 sa xsa ys zs Q1)\n have \"final (last ((Skip, sa)# ys))\"\n proof -\n have cptn:\"(n, \\, (Skip,snd (last ((P1, sa) # xsa))) # ys) \\ cptn_mod_nest_call\" \n using CptnModNestCatch2(4) by (simp add: cptn_eq_cptn_mod_set)\n then have cptn':\"(\\, (Skip,snd (last ((P1, sa) # xsa))) # ys) \\ cptn\"\n using cptn_eq_cptn_mod_nest by blast \n moreover have throw_0:\"((Skip,snd (last ((P1, sa) # xsa))) # ys)!0 = (Skip, snd (last ((P1, sa) # xsa))) \\ 0 < length((Skip, snd (last ((P1, sa) # xsa))) # ys)\"\n by force \n moreover have last:\"last ((Skip,snd (last ((P1, sa) # xsa))) # ys) = \n ((Skip,snd (last ((P1, sa) # xsa))) # ys)!((length ((Skip,snd (last ((P1, sa) # xsa))) # ys)) - 1)\"\n using last_conv_nth by auto\n moreover have env_tran:\"env_tran_right \\ ((Skip,snd (last ((P1, sa) # xsa))) # ys) rely\" \n using CptnModNestCatch2.hyps(6) CptnModNestCatch2.prems(4) env_tran_subl env_tran_tail by blast \n ultimately obtain st' where \"fst (last ((Skip,snd (last ((P1, sa) # xsa))) # ys)) = Skip \\ \n snd (last ((Skip,snd (last ((P1, sa) # xsa))) # ys)) = Normal st'\" \n using CptnModNestCatch2 zero_skip_all_skip[of \\ \"((Skip,snd (last ((P1, sa) # xsa))) # ys)\" \"(length ((Skip,snd (last ((P1, sa) # xsa))) # ys))-1\"]\n by (metis (no_types, hide_lams) SmallStepCon.final_def append_Cons diff_less fst_conv \n last_appendR list.simps(3) zero_less_one) \n thus ?thesis using final_def by (metis fst_conv last.simps) \n qed\n thus ?case \n by (metis (no_types, lifting) CptnModNestCatch2.hyps(3) CptnModNestCatch2.hyps(6) \n CptnModNestCatch2.prems(3) SmallStepCon.final_def append_is_Nil_conv last.simps \n last_appendR list.simps(3) prod.collapse) \nnext\n case (CptnModNestCatch3 n \\ P0 sa xsa sa' P1 ys zs)\n then have \"P0 = P \\ P1 = Q\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" \n using CptnModNestCatch3\n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have \"Suc i< length ((Catch P0 P1,Normal sa)#zs)\" by fastforce\n then have \"fst (((Catch P0 P1, Normal sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModNestCatch3(9) zs by auto\nqed (auto)\n\nlemma Catch_sound2: \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst (last x) = Skip\" and\n a4:\"env_tran_right \\ x rely\"\nshows\n \"\\xs ys. (\\,xs) \\ cpn n \\ P s \\ x = ((map (lift_catch Q) xs)@((Skip,snd(last xs))#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnModNestOne n \\ C s1) \n thus ?case by fastforce\nnext\n case (CptnModNestEnv \\ C s1 t1 n xsa)\n then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n have \"\\xs ys. (\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = \n map (lift_catch Q) xs@((Skip, snd(last xs))#ys)\"\n proof -\n have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Catch P Q, t1)\" using C by auto\n moreover have \"\\i Q\"\n using CptnModNestEnv(5) by fastforce\n moreover have \"fst (last ((C, t1) # xsa)) = Skip\" using CptnModNestEnv(6) \n by fastforce\n ultimately show ?thesis\n using CptnModNestEnv(3) CptnModNestEnv(7) env_tran_tail by blast \n qed \n then obtain xs ys where hi:\"(\\, xs) \\ cpn n \\ P t1 \\ (C, t1) # xsa = map (lift_catch Q) xs@((Skip,snd(last ((P, t1)#xs)))#ys)\"\n by fastforce\n have s1_s:\"s1=s\" using CptnModNestEnv unfolding cp_def by auto\n have \"\\xsa' ys. xs=((P,t1)#xsa') \\ (n,\\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')@((Skip, snd(last xs))#ys)\" \n using hi unfolding cp_def\n proof -\n have \"(n,\\,xs)\\cptn_mod_nest_call \\ xs!0 = (P,t1)\" using hi unfolding cpn_def by fastforce\n moreover then have \"xs\\[]\" using CptnEmpty calculation by blast \n moreover obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl calculation by fastforce \n ultimately show ?thesis\n using hi by auto\n qed\n then obtain xsa' ys where xs:\"xs=((P,t1)#xsa') \\ (n,\\,((P,t1)#xsa'))\\cptn_mod_nest_call \\ (C, t1) # xsa = \n map (lift_catch Q) ((P,t1)#xsa')@((Skip,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n by fastforce\n have env_tran:\"\\\\\\<^sub>c(P,s1) \\\\<^sub>e (P,t1)\" using CptnModNestEnv Catch_env_P by (metis fst_conv nth_Cons_0) \n then have \"(n,\\,(P,s1)#(P,t1)#xsa')\\cptn_mod_nest_call\" using xs env_tran CptnEnv \n by (simp add: cptn_mod_nest_call.CptnModNestEnv) \n then have \"(\\,(P,s1)#(P,t1)#xsa') \\ cpn n \\ P s\" \n using cpn_def s1_s by fastforce\n moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')@((Skip,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n using xs C unfolding lift_catch_def\n by auto\n ultimately show ?case by fastforce \nnext\n case (CptnModNestSkip)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModNestThrow)\n thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n case (CptnModNestCatch1 n \\ P0 sa xsa zs P1) \n thus ?case\n proof -\n have \"\\c x. (LanguageCon.com.Catch c P1, x) # zs = map (lift_catch P1) ((c, x) # xsa)\"\n using Cons_lift_catch CptnModNestCatch1.hyps(3) by blast\n then have \"(P0, sa) # xsa = []\"\n by (metis (no_types) CptnModNestCatch1.prems(3) LanguageCon.com.distinct(19) One_nat_def last_conv_nth last_lift_catch map_is_Nil_conv)\n then show ?thesis\n by force\n qed \nnext\n case (CptnModNestCatch2 n \\ P1 sa xsa ys zs Q1) \n then have \"P1 = P \\ Q1 = Q \\ sa = s\" by auto \n moreover then have \"(\\, (P1,sa) # xsa)\\ cpn n \\ P s\" \n using CptnModNestCatch2(1)\n by (simp add: cpn_def cptn_eq_cptn_mod_set) \n moreover obtain s' where \"last zs=(Skip, s')\" \n proof -\n assume a1: \"\\s'. last zs = (LanguageCon.com.Skip, s') \\ thesis\"\n have \"\\x. last zs = (LanguageCon.com.Skip, x)\"\n by (metis (no_types) CptnModNestCatch2.hyps(6) CptnModNestCatch2.prems(3) append_is_Nil_conv last_ConsR list.simps(3) prod.exhaust_sel)\n then show ?thesis\n using a1 by metis\n qed \n ultimately show ?case \n using Cons_lift_catch_append CptnModNestCatch2.hyps(6) by fastforce \nnext \n case (CptnModNestCatch3 n \\ P0 sa xsa sa' P1 ys zs) \n then have \"P0 = P \\ P1 = Q \\ s=Normal sa\" by auto\n then obtain i where zs:\"fst (zs!i) = Q \\ (i< (length zs))\" \n using CptnModNestCatch3 \n by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff) \n then have si:\"Suc i< length ((Catch P0 P1,Normal sa)#zs)\" by fastforce\n then have \"fst (((Seq P0 P1, Normal sa) # zs)!Suc i) = Q\" using zs by fastforce \n thus ?case using CptnModNestCatch3(9) zs\n by (metis si nth_Cons_Suc)\nqed (auto)\n\nlemma Catch_sound3: \nassumes\n a0:\"(\\,x)\\cptn\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"\\i Q\" and\n a3:\"fst(last x) = Throw\" and\n a4:\"env_tran_right \\ x rely \"\nshows\n \"False\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n case (CptnOne \\ C s1) thus ?case by auto\nnext\n case (CptnEnv \\ C st t xsa) \n thus ?case\n proof -\n have f1: \"env_tran_right \\ ((C, t) # xsa) rely\"\n using CptnEnv.prems(4) env_tran_tail by blast\n have \"LanguageCon.com.Catch P Q = C\"\n using CptnEnv.prems(1) by auto\n then show ?thesis\n using f1 CptnEnv.hyps(3) CptnEnv.prems(2) CptnEnv.prems(3) by moura\n qed\nnext \n case (CptnComp \\ C st C' st' xsa)\n then have c_catch:\"C = (Catch P Q) \\ st = s\" by force\n from CptnComp show ?case proof(cases)\n case (Catchc P1 P1' P2) thus ?thesis\n proof -\n have f1: \"env_tran_right \\ ((C', st') # xsa) rely\"\n using CptnComp.prems(4) env_tran_tail by blast\n have \"Q = P2\"\n using c_catch Catchc(1) by blast\n then show ?thesis\n using f1 CptnComp.hyps(3) CptnComp.prems(2) CptnComp.prems(3) Catchc(2) by moura\n qed\n next\n case (CatchSkipc) thus ?thesis\n proof -\n have \"fst (((C', st') # xsa) ! 0) = LanguageCon.com.Skip\"\n by (simp add: local.CatchSkipc(2))\n then show ?thesis\n by (metis (no_types) CptnComp.hyps(2) CptnComp.prems(3) LanguageCon.com.distinct(17) \n last_ConsR last_length length_Cons lessI list.simps(3) zero_skip_all_skip)\n qed \n next\n case (SeqThrowc C2 s') thus ?thesis\n by (simp add: c_catch) \n next\n case (FaultPropc) thus ?thesis \n using c_catch redex_not_Catch by blast \n next\n case (StuckPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n next\n case (AbruptPropc) thus ?thesis \n using c_catch redex_not_Catch by blast\n qed (auto)\nqed\n\nlemma catch_map_xs_ys':\n assumes\n a0:\"(n, \\, (P0, sa) # xsa) \\ cptn_mod_nest_call\" and \n a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n a2:\"(n,\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod_nest_call\" and\n a3:\"zs = map (lift_catch P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n a4:\"((LanguageCon.com.Catch P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Catch P Q, s)\" and\n a5:\"i < length ((LanguageCon.com.Catch P0 P1, sa) # zs) \\ ((LanguageCon.com.Catch P0 P1, sa) # zs) ! i = (Q, sj)\" and\n a6:\"\\j Q\"\nshows \n \"\\xs ys. (\\, xs) \\ cpn n \\ P s \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i - 1))) \\ (LanguageCon.com.Catch P0 P1, sa) # zs = map (lift_catch Q) xs @ ys\"\nproof -\n let ?P0 = \"(P0, sa) # xsa\"\n have P_Q:\"P=P0 \\ s=sa \\ Q = P1\" using a4 by force\n have i:\"i=(length ((P0, sa) # xsa))\" \n proof (cases \"i=(length ((P0, sa) # xsa))\")\n case True thus ?thesis by auto\n next\n case False \n then have i:\"i<(length ((P0, sa) # xsa)) \\ i > (length ((P0, sa) # xsa))\" by auto\n {\n assume i:\"i<(length ((P0, sa) # xsa))\"\n then have eq_map:\"((LanguageCon.com.Catch P0 P1, sa) # zs) ! i = map (lift_catch P1) ((P0, sa) # xsa) ! i\" \n using a3 Cons_lift_catch_append\n by (metis (no_types, lifting) length_map nth_append) \n then have \"\\ci si. map (lift_catch P1) ((P0, sa) # xsa) ! i = (Catch ci P1,si)\" \n using i unfolding lift_catch_def\n by (metis a5 eq_map fst_conv length_map map_lift_catch_all_catch)\n then have \"((LanguageCon.com.Catch P0 P1, sa) # zs) ! i \\ (Q, sj)\" \n using P_Q eq_map by fastforce\n then have ?thesis using a5 by auto\n }note l=this\n {\n assume i:\"i>(length ((P0, sa) # xsa))\"\n have \"fst (((LanguageCon.com.Catch P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n using a3 P_Q Cons_lift_catch_append by (metis fstI length_map nth_append_length) \n then have ?thesis using a6 i by auto\n }\n thus ?thesis using l i by auto\n qed\n then have \"(\\, (P0, sa) # xsa) \\ cpn n \\ P s\" \n using a0 P_Q unfolding cpn_def by fastforce\n also have \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ cpn n \\ Q (snd (?P0 ! ((length ?P0) -1)))\" \n using a3 cptn_eq_cptn_mod P_Q unfolding cpn_def\n proof -\n have \"(n, \\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ cptn_mod_nest_call\"\n using a2 P_Q by blast\n then have \"(\\, (Q, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\ \n (n, \\, ps) \\ cptn_mod_nest_call \\ f = \\}\"\n by (simp add: cptn_eq_cptn_mod last_length)\n then show \"(\\, (P1, snd (last ((P0, sa) # xsa))) # ys) \\ {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\ (n,\\, ps) \\ cptn_mod_nest_call \\ f = \\}\"\n using P_Q by force\n qed \n ultimately show ?thesis using a3 P_Q i using Cons_lift_catch_append by blast\nqed\n\n\nlemma Catch_sound4: \nassumes\n a0:\"(n,\\,x)\\cptn_mod_nest_call\" and\n a1:\"x!0 = ((Catch P Q),s)\" and\n a2:\"i x!i=(Q,sj)\" and\n a3:\"\\jQ\" and \n a4:\"env_tran_right \\ x rely \"\nshows\n \"\\xs ys. (\\,xs) \\ (cpn n \\ P s) \\ (\\,ys) \\ (cpn n \\ Q (snd (xs!(i-1)))) \\ x = (map (lift_catch Q) xs)@ys\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: i sj P s)\n case (CptnModNestEnv \\ C st t n xsa) \n have a1:\"Catch P Q \\ Q\" by simp \n then have C_catch:\"C=(Catch P Q)\" using CptnModNestEnv by fastforce\n then have \"fst(((C, st) # (C, t) # xsa)!0) \\Q\" using CptnEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!1) \\Q\" using CptnModNestEnv a1 by auto\n moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnModNestEnv by auto\n ultimately have i_suc: \"i> (Suc 0)\" using CptnModNestEnv \n by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n then have i_minus:\"i'=i-1\" by auto \n have \"((C, t) # xsa) ! 0 = ((Catch P Q), t)\"\n using CptnModNestEnv by auto \n moreover have \"i'< length ((C,t)#xsa) \\ ((C,t)#xsa)!i' = (Q,sj)\"\n using i' CptnModNestEnv(5) by force\n moreover have \"\\j Q\"\n using i' CptnModNestEnv(6) by force\n ultimately have hyp:\"\\xs ys.\n (\\, xs) \\ cpn n \\ P t \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n using CptnModNestEnv(3) env_tran_tail CptnModNestEnv.prems(4) by blast \n then obtain xs ys where xs_cp:\"(\\, xs) \\ cpn n \\ P t \\\n (\\, ys) \\ cpn n \\ Q (snd (xs ! (i'-1))) \\ (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n by fast\n have \"(\\, (P, s)#xs) \\ cpn n \\ P s\"\n proof -\n have \"xs!0 = (P,t)\" \n using xs_cp unfolding cpn_def by blast\n moreover have \"xs\\[]\"\n using cpn_def CptnEmpty xs_cp by blast \n ultimately obtain xs' where xs':\"(n,\\, (P,t)#xs') \\ cptn_mod_nest_call \\ xs=(P,t)#xs'\" \n using SmallStepCon.nth_tl xs_cp unfolding cpn_def by force\n thus ?thesis using cpn_def \n proof -\n have \"(Catch P Q, s) = (C, st)\"\n using CptnModNestEnv.prems(1) by auto\n then have \"\\\\\\<^sub>c (P, s) \\\\<^sub>e (P, t)\"\n using Catch_env_P CptnModNestEnv(1) by blast\n then show ?thesis\n by (simp add: cpn_def cptn_mod_nest_call.CptnModNestEnv xs')\n qed\n qed\n thus ?case \n using i_suc Cons_lift_catch_append CptnModNestEnv.prems(1) i' i_minus xs_cp\n by fastforce \nnext\n case (CptnModNestSkip \\ P s t n xs)\n then show ?case\n by (metis (no_types) CptnModNestSkip.hyps(2) CptnModNestSkip.prems(1) \n fst_conv nth_Cons_0 redex_not_Catch)\nnext\n case (CptnModNestThrow \\ P s t n xs)\n then show ?case \n by (metis (no_types) CptnModNestThrow.hyps(2) CptnModNestThrow.prems(1) \n fst_conv nth_Cons_0 redex_not_Catch)\nnext\n case (CptnModNestCatch1 n \\ P0 s xs zs P1)\n then show ?case\n by (metis Catch_not_c Cons_lift_catch LanguageCon.com.inject(9) \n fst_conv map_lift_catch_all_catch nth_Cons_0)\nnext\n case (CptnModNestCatch2 n \\ P1 sa xsa ys zs Q1) \n then have P_Q:\"P=P1 \\ Q = Q1\" by force\n thus ?case\n proof (cases \"Q1 = Skip\")\n case True thus ?thesis using catch_map_xs_ys' \n CptnModNestCatch2 by blast\n next \n case False note q_not_throw=this\n have \"\\x. x< length ((LanguageCon.com.Catch P1 Q1, sa) # zs) \\\n ((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x \\ (Q, sj)\" using CptnModNestCatch2\n proof -\n {\n fix x\n assume x_less:\"x< length ((LanguageCon.com.Catch P1 Q1, sa) # zs)\"\n have \"((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x \\ (Q, sj)\"\n proof (cases \"x < length ((LanguageCon.com.Catch P1 Q1, sa)#map (lift_catch Q1) xsa)\")\n case True \n then have eq_map:\"((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x = map (lift_catch Q1) ((P1, sa) # xsa) ! x\" \n by (metis (no_types) Cons_lift_catch Cons_lift_catch_append CptnModNestCatch2(6) True nth_append)\n then have \"\\ci si. map (lift_catch Q1) ((P1, sa) # xsa) ! x = (Catch ci Q1,si)\" \n using True unfolding lift_catch_def\n by (metis Cons_lift_catch True eq_map map_lift_catch_all_catch surjective_pairing)\n then have \"((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x \\ (Q, sj)\" \n using P_Q eq_map by fastforce \n thus ?thesis using CptnModNestCatch2(10) by auto \n next\n case False \n let ?s' = \"snd (last ((P1, sa) # xsa))\" \n have all_throw:\"\\ix\\ length ((LanguageCon.com.Catch P1 Q1, sa) # map (lift_catch Q1) xsa). \n x\n fst (((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x) = Skip\" \n using Cons_lift_catch Cons_lift_catch_append CptnModNestCatch2.hyps(1) CptnModNestCatch2.hyps(3) \n CptnModNestCatch2.hyps(4) CptnModNestCatch2.hyps(6) cptn_eq_cptn_mod_set \n cptn_mod_nest_call.CptnModNestCatch2 cptn_mod_nest_cptn_mod skip_com_all_skip \n proof-\n {\n fix x \n assume a1:\"x\\ length ((Catch P1 Q1, sa) # map (lift_catch Q1) xsa)\" and\n a2:\"x P1 sa xsa ys zs Q1)\n then show ?case using catch_map_xs_ys'[OF CptnModNestCatch3(1) CptnModNestCatch3(3) CptnModNestCatch3(5)\n CptnModNestCatch3(7) CptnModNestCatch3(8) CptnModNestCatch3(9)] \n by blast\nqed(auto) \n\ninductive_cases stepc_elim_cases_Catch_throw:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Catch_skip_c2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s)\"\n\ninductive_cases stepc_elim_cases_Catch_skip_2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Skip, s)\"\n\nlemma catch_skip_throw:\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s) \\ (c2= Skip \\ c1=Skip) \\ (c1=Throw \\ (\\s2'. s=Normal s2'))\"\napply (rule stepc_elim_cases_Catch_skip_c2)\napply fastforce\napply (auto)+\nusing redex_not_Catch apply auto\ndone\n\nlemma catch_skip_throw1:\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Skip,s) \\ (c1=Skip) \\ (c1=Throw \\ (\\s2'. s=Normal s2') \\ c2 = Skip)\"\napply (rule stepc_elim_cases_Catch_skip_2)\nusing redex_not_Catch apply auto\nusing redex_not_Catch by auto\n\n\nlemma Catch_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r] \\\n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a] \\\n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a] \\ \n Sta q R \\ (\\s. (Normal s,Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n a1:\"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n a2:\"\\,\\ \\\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and \n a3: \"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and \n a4: \"Sta q R \" and\n a5: \"(\\s. (Normal s, Normal s) \\ G)\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n then have a1:\"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" \n using a1 com_cvalidityn_def by fastforce \n then have a3: \"\\ \\n\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\"\n using a3 com_cvalidityn_def all_call by fastforce \n have \"cpn n \\ (Catch c1 c2) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Catch c1 c2) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (Catch c1 c2) s\"\n unfolding cpn_def cp_def\n using cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((Catch c1 c2),s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\=\\1\" \n using a10 cpn_def c_prod by fastforce\n then have cp':\"l!0=((Catch c1 c2),s) \\ (\\,l) \\ cptn \\ \\=\\1\"\n using cptn_eq_cptn_mod_nest by auto \n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {\n assume l_f:\"snd (last l) \\ Fault ` F\" \n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\\\n (final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof (cases \"\\i c2\")\n case True \n then have no_c2:\"\\i c2\" by assumption\n show ?thesis\n proof (cases \"final (last l)\")\n case True\n then obtain s' where \"fst (last l) = Skip \\ (fst (last l) = Throw \\ snd (last l) = Normal s')\" \n using final_def by fast \n thus ?thesis\n proof\n assume \"fst (last l)= LanguageCon.com.Throw \\ snd (last l) = Normal s'\" \n then have \"False\" using no_c2 env_tran_right cp' cptn_eq_cptn_mod_set Catch_sound3\n by blast\n thus ?thesis by auto\n next \n assume asm0:\"fst (last l) = Skip\" \n then obtain lc1 ys where cp_lc1:\"(\\,lc1) \\ cpn n \\ c1 s \\ l = ((map (lift_catch c2) lc1)@((Skip,snd(last lc1))#ys))\"\n using Catch_sound2 cp cptn_eq_cptn_mod_set env_tran_right no_c2 by blast\n then have cp_lc1':\"(\\,lc1) \\ cp \\ c1 s\"\n unfolding cpn_def cp_def\n using cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce \n let ?m_lc1 = \"map (lift_catch c2) lc1\"\n let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" \n have lc1_not_empty:\"lc1 \\ []\"\n using \\1 a10' cpn_def cp_lc1 cp by auto \n then have map_cp:\"(\\,?m_lc1) \\ cpn n \\ (Catch c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (n, \\, lc1) \\ cptn_mod_nest_call \\ \\ = \\\"\n using cp_lc1 unfolding cpn_def by blast\n then have f2: \"(n,\\, ?m_lc1) \\ cptn_mod_nest_call\" using lc1_not_empty\n by (metis Cons_lift_catch SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestCatch1)\n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cpn_def lift_catch_def)\n qed\n then have map_cp':\"(\\,?m_lc1) \\ cp \\ (Catch c1 c2) s\" \n unfolding cp_def cpn_def\n using cp_def cp_lc1' lift_catch_is_cptn by fastforce\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R)\"\n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 assum_map_catch cp_lc1' by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,r)) F\" \n using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,r)) F\"\n using map_cp map_assum comm_map_catch cp_lc1' map_cp' by blast\n then have last_m_lc1:\"last (?m_lc1) = (Catch (fst (last lc1)) c2,snd (last lc1))\"\n proof -\n have a000:\"\\p c. (LanguageCon.com.Catch (fst p) c, snd p) = lift_catch c p\"\n using Cons_lift_catch by force\n then show ?thesis\n by (simp add: last_map a000 lc1_not_empty)\n qed\n then have last_length:\"last (?m_lc1) = ?last_m_lc1\" \n using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n using cp_lc1\n by (simp add:lc1_not_empty nth_append)\n then have lm_lc1:\"l!(?lm_lc1) = (Skip, snd (last lc1))\"\n using cp_lc1 by (meson nth_append_length) \n then have step:\"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\ (l!(?lm_lc1))\"\n proof -\n have \"\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n proof -\n have f1: \"0 \\ length ys\"\n by blast\n moreover have \"Suc (length (map (lift_catch c2) lc1) + length ys) = \n length (map (lift_catch c2) lc1 @ (LanguageCon.com.Skip, snd (last lc1)) # ys)\"\n by force\n ultimately show ?thesis\n by (metis (no_types) Suc_diff_1 Suc_eq_plus1 cp' cp_lc1 cptn_tran_ce_i \n lc1_not_empty le_add_same_cancel1 length_greater_0_conv \n less_Suc_eq_le list.map_disc_iff)\n qed \n moreover have \"\\\\\\\\<^sub>c(l!(?lm_lc1-1)) \\\\<^sub>e (l!(?lm_lc1))\"\n using last_m_lc1 last_length l_map\n proof -\n have \"(LanguageCon.com.Catch (fst (last lc1)) c2, snd (last lc1)) = l ! (length (map (lift_catch c2) lc1) - 1)\"\n using l_map last_m_lc1 local.last_length by presburger\n then show ?thesis\n by (metis LanguageCon.com.simps(30) env_c_c' lm_lc1) \n qed\n ultimately show ?thesis using step_ce_elim_cases by blast \n qed\n have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = snd (l!?lm_lc1)\"\n using l_map last_m_lc1 lm_lc1 local.last_length by force\n then have step_catch:\"\\\\\\<^sub>c(Catch (fst (last lc1)) c2,snd (last lc1)) \\ (Skip, snd (last lc1))\" \n using l_map last_m_lc1 lm_lc1 local.last_length local.step \n by presburger \n then obtain s2' where \n last_lc1:\"fst (last lc1) = Skip \\ \n fst (last lc1) = Throw \\ (snd (last lc1) = Normal s2') \\ c2 = Skip\"\n using catch_skip_throw1 by fastforce \n then have last_lc1_skip:\"fst (last lc1) = Skip\" \n proof \n assume \"fst (last lc1) = LanguageCon.com.Throw \\\n snd (last lc1) = Normal s2' \\ c2 = LanguageCon.com.Skip\"\n thus ?thesis using no_c2 asm0 \n by (simp add: cp_lc1 last_conv_nth ) \n qed auto \n have last_not_F:\"snd (last ?m_lc1) \\ Fault ` F\"\n proof -\n have \"snd ?last_m_lc1 = snd (l!(?lm_lc1-1))\"\n using l_map by auto \n have \"(?lm_lc1-1)< length l\"using cp_lc1 by fastforce\n also then have \"snd (l!(?lm_lc1-1))\\ Fault ` F\"\n using cp' cp_lc1 l_f last_not_F[of \\ l F]\n by fastforce\n ultimately show ?thesis using l_map last_length by fastforce\n qed\n then have q_normal:\"snd (l!?lm_lc1) \\ Normal ` q \" \n proof -\n have last_lc1:\"fst (last lc1) = Skip\" \n using last_lc1_skip by fastforce \n have \"final (last lc1)\" using last_lc1 final_def \n by blast \n then show ?thesis \n using lc1_comm last_lc1 last_not_F \n unfolding comm_def\n using last_lc1_suc comm_dest2 l_map lm_lc1 local.last_length\n by force\n qed \n then obtain s1' where normal_lm_lc1:\"snd (l!?lm_lc1) = Normal s1' \\ s1' \\q\" \n by auto\n have concl:\"(\\i ns ns'. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n then have i_m_l:\"\\i []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis\n by (metis (no_types) cp_lc1 nth_append)\n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< ?lm_lc1\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis\n by (metis (no_types) True a21 i_m_l zero_less_diff)\n qed \n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' m_lc1_comm True comm_dest1 l_f last_not_F by fastforce\n thus ?thesis using i_m_l True by auto \n next\n case False \n then have \"(Suc k=?lm_lc1) \\ (Suc k>?lm_lc1)\" by auto\n thus ?thesis \n proof\n {assume suck:\"(Suc k=?lm_lc1)\"\n then have k:\"k=?lm_lc1-1\" by auto\n then obtain s1' where s1'_normal:\"snd(l!?lm_lc1) = Normal s1'\"\n using q_normal by fastforce\n have G_s1':\"(Normal s1', Normal s1')\\ G\" using a5 by auto\n then show \"(snd (l!k), snd (l!Suc k)) \\ G\"\n proof -\n have \"snd (l ! k) = Normal s1'\"\n using k last_lc1_suc s1'_normal by presburger\n then show ?thesis\n using G_s1' s1'_normal suck by force\n qed \n }\n next\n { \n assume a001:\"Suc k>?lm_lc1\"\n have \"\\i. i\\(length lc1) \\ (Suc i < length l) \\ \n \\(\\\\\\<^sub>c(l!i) \\ (l!(Suc i)))\"\n using lm_lc1 lc1_not_empty\n proof -\n have \"env_tran_right \\1 l R\"\n by (metis cp env_tran_right)\n then show ?thesis \n using cp' fst_conv length_map lm_lc1 a001 a21 a00 a4\n normal_lm_lc1 \n by (metis (no_types) only_one_component_tran_j)\n qed\n then have \"\\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using a00 a001 by auto \n then show ?thesis using a21 by fastforce \n }\n qed \n qed\n } thus ?thesis by auto \n qed \n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\" \n proof -\n have l_t:\"fst (last l) = Skip\" \n using lm_lc1 by (simp add: asm0)\n have \"?lm_lc1 \\ length l -1\" using cp_lc1 by fastforce \n also have \"\\i. ?lm_lc1 \\i \\ i<(length l -1) \\ \\\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i))\" \n using cp' fst_conv length_map lm_lc1 a4\n normal_lm_lc1 only_one_component_tran_j[of \\ l ?lm_lc1 s1' q ]\n by (metis Suc_eq_plus1 cptn_tran_ce_i env_tran_right less_diff_conv step_ce_elim_cases) \n ultimately have \"snd (l ! (length l - 1)) \\ Normal ` q\"\n using cp_lc1 q_normal a4 env_tran_right stability[of q R l ?lm_lc1 \"(length l) -1\" _ \\] \n by fastforce \n thus ?thesis using l_t \n by (simp add: cp_lc1 last_conv_nth)\n qed\n note res = conjI [OF concl concr]\n then show ?thesis using \\1 c_prod unfolding comm_def by auto\n qed \n next\n case False\n then obtain lc1 where cp_lc1:\"(\\,lc1) \\ cpn n \\ c1 s \\ l = map (lift_catch c2) lc1\" \n using Catch_sound1 False no_c2 env_tran_right cp cptn_eq_cptn_mod_set \n by blast \n then have cp_lc1':\"(\\,lc1) \\ cp \\ c1 s\" \n unfolding cpn_def cp_def\n using cptn_eq_cptn_mod_nest by fastforce\n then have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 a10' a11 assum_map_catch cp_lc1\n by blast\n then have \"(\\, lc1)\\ comm(G, (q,r)) F\" using cp_lc1 a1\n by (meson IntI com_validityn_def contra_subsetD)\n then have \"(\\, l)\\ comm(G, (q,r)) F\"\n using comm_map_catch a10' \\1 cp_lc1 cp_lc1' by fastforce\n then show ?thesis using l_f False\n unfolding comm_def by fastforce\n qed\n next \n case False \n then obtain k where k_len:\"k fst (l ! k) = c2\"\n by blast \n then have \"\\m. (m < length l \\ fst (l ! m) = c2) \\\n (\\i (i < length l \\ fst (l ! i) = c2))\" \n using a0 exists_first_occ[of \"(\\i. i fst (l ! i) = c2)\" k] \n by blast\n then obtain i where a0:\"i fst (l !i) = c2 \\\n (\\j c2))\"\n by fastforce \n then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n then obtain lc1 lc2 where cp_lc1:\"(\\,lc1) \\ (cpn n \\ c1 s) \\ \n (\\,lc2) \\ (cpn n \\ c2 (snd (lc1!(i-1)))) \\ \n l = (map (lift_catch c2) lc1)@lc2\"\n using Catch_sound4 a0 cp env_tran_right by blast \n then have cp_lc1':\"(\\,lc1) \\ (cp \\ c1 s) \\ \n (\\,lc2) \\ (cp \\ c2 (snd (lc1!(i-1))))\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by fastforce\n have i_not_fault:\"snd (l!i) \\ Fault ` F\" using a0 cp' l_f last_not_F[of \\ l F] by blast\n have length_c1_map:\"length lc1 = length (map (lift_catch c2) lc1)\" \n by fastforce \n then have i_map:\"i=length lc1\" \n using cp_lc1 li a0 unfolding lift_catch_def \n proof -\n assume a1: \"(\\, lc1) \\ cpn n \\ c1 s \\ (\\, lc2) \\ cpn n \\ c2 (snd (lc1 ! (i - 1))) \\ l = map (\\(P, s). (Catch P c2, s)) lc1 @ lc2\"\n have f2: \"i < length l \\ fst (l ! i) = c2 \\ (\\n. \\ n < i \\ fst (l ! n) \\ c2)\"\n using a0 by blast\n have f3: \"(Catch (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift_catch c2 (lc1 ! i)\"\n by (simp add: case_prod_unfold lift_catch_def) \n then have \"fst (l ! length lc1) = c2\"\n using a1 by (simp add: cpn_def nth_append)\n thus ?thesis\n using f3 f2\n by (metis (no_types, lifting) Pair_inject a0 cp_lc1 f3 \n length_c1_map li linorder_neqE_nat nth_append nth_map seq_and_if_not_eq(12))\n qed \n have lc2_l:\"\\j []\"\n using cp cp_lc1 unfolding cpn_def by fastforce \n have lc2_not_empty:\"lc2 \\ []\"\n using cpn_def cp_lc1 a0 i_map by force \n have l_is:\"s2= snd (last lc1)\"\n using cp_lc1 li a0 lc1_not_empty unfolding cpn_def\n by (auto simp add: i_map last_conv_nth lc2_l)\n let ?m_lc1 = \"map (lift_catch c2) lc1\"\n (* let ?lm_lc1 = \"(length ?m_lc1)\"\n let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *) \n have last_m_lc1:\"l!(i-1) = (Catch (fst (last lc1)) c2,s2)\"\n using i_map cp_lc1 l_is last_lift_catch last_snd_catch lc1_not_empty length_c1_map \n by (metis (no_types, lifting) One_nat_def diff_Suc_less last_conv_nth length_greater_0_conv nth_append prod.collapse)\n have last_mcl1_not_F:\"snd (last ?m_lc1) \\ Fault ` F\"\n by (metis One_nat_def i_not_fault l_is last_conv_nth last_snd_catch li list.map_disc_iff snd_conv) \n have map_cp:\"(\\,?m_lc1) \\ cpn n \\ (Catch c1 c2) s\" \n proof -\n have f1: \"lc1 ! 0 = (c1, s) \\ (n,\\, lc1) \\ cptn_mod_nest_call \\ \\ = \\\"\n using cp_lc1 cpn_def by blast\n then have f2: \"(n, \\, ?m_lc1) \\ cptn_mod_nest_call\" using lc1_not_empty\n by (metis Cons_lift_catch SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestCatch1) \n then show ?thesis\n using f2 f1 lc1_not_empty by (simp add: cpn_def lift_catch_def)\n qed\n then have map_cp':\"(\\,?m_lc1) \\ cp \\ (Catch c1 c2) s\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by fastforce\n also have map_assum:\"(\\,?m_lc1) \\ assum (p,R)\"\n using sub_assum a10 a11 \\1 cp_lc1 lc1_not_empty \n by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n ultimately have \"((\\,lc1) \\ assum(p, R))\" \n using \\1 assum_map_catch using assum_map cp_lc1 cp_lc1' by blast \n then have lc1_comm:\"(\\,lc1) \\ comm(G, (q,r)) F\" \n using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n then have m_lc1_comm:\"(\\,?m_lc1) \\ comm(G, (q,r)) F\"\n using map_cp' map_assum comm_map_catch cp_lc1 cp_lc1' by blast \n then have \"\\\\\\<^sub>c(l!(i-1)) \\ (l!i)\"\n proof -\n have \"\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>c\\<^sub>e (l!(i))\"\n by (metis Suc_eq_plus1 Suc_pred' a0 cp' cptn_tran_ce_i i_map \n lc1_not_empty length_greater_0_conv)\n moreover have \"\\\\\\\\<^sub>c(l!(i-1)) \\\\<^sub>e (l!i)\" \n using li last_m_lc1\n by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(12))\n ultimately show ?thesis using step_ce_elim_cases by blast\n qed \n then have step:\"\\\\\\<^sub>c(Catch (fst (last lc1)) c2,s2) \\ (c2, s2)\"\n using last_m_lc1 li by fastforce\n then obtain s2' where \n last_lc1:\"(fst (last lc1) = Skip \\ c2 = Skip) \\ \n fst (last lc1) = Throw \\ (s2 = Normal s2')\" \n using catch_skip_throw by blast \n have final:\"final (last lc1)\" \n using last_lc1 l_is unfolding final_def by auto\n have normal_last:\"fst (last lc1) = Skip \\ snd (last lc1) \\ Normal ` q \\\n fst (last lc1) = Throw \\ snd (last lc1) \\ Normal ` r\"\n proof - \n have \"snd (last lc1) \\ Fault ` F\"\n using i_not_fault l_is li by auto\n then show ?thesis\n using final comm_dest2 lc1_comm by blast\n qed\n obtain s2' where lastlc1_normal:\"snd (last lc1) = Normal s2'\" \n using normal_last by blast\n then have Normals2:\"s2 = Normal s2'\" by (simp add: l_is) \n have Gs2':\" (Normal s2', Normal s2')\\G\" using a5 by auto \n have concl:\n \"(\\i. Suc i \n \\\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof-\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n have i_m_l:\"\\j []\"\n by (meson lc1_not_empty list.map_disc_iff)\n then show ?thesis \n using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append) \n qed \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n proof (cases \"Suc k< i\")\n case True \n then have a11': \"\\\\\\<^sub>c(?m_lc1!k) \\ (?m_lc1!(Suc k))\" \n using a11 i_m_l True\n proof -\n have \"\\n na. \\ 0 < n - Suc na \\ na < n \"\n using diff_Suc_eq_diff_pred zero_less_diff by presburger\n then show ?thesis using True a21 i_m_l by force \n qed \n have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\ G\"\n using a11' last_mcl1_not_F m_lc1_comm True i_map length_c1_map comm_dest1[of \\] \n by blast\n thus ?thesis using i_m_l True by auto \n next\n case False \n have \"(Suc k=i) \\ (Suc k>i)\" using False by auto\n thus ?thesis \n proof\n { assume suck:\"(Suc k=i)\" \n then have k:\"k=i-1\" by auto \n then show \"(snd (l!k), snd (l!Suc k)) \\ G\"\n using Gs2' Normals2 last_m_lc1 li suck by auto \n }\n next\n { \n assume a001:\"Suc k>i\"\n then have k:\"k\\i\" by fastforce\n then obtain k' where k':\"k=i+k'\" \n using add.commute le_Suc_ex by blast\n {assume skip:\"c2=Skip\"\n then have \"\\k. k\\i \\ (Suc k < length l) \\ \n \\(\\\\\\<^sub>c(l!k) \\ (l!(Suc k)))\"\n using Normals2 li lastlc1_normal a21 a001 a00 a4\n a0 skip env_tran_right cp'\n by (metis SmallStepCon.final_def SmallStepCon.no_step_final' Suc_lessD skip_com_all_skip) \n then have ?thesis using a21 a001 k a00 by blast\n } note left=this\n {assume \"c2\\Skip\"\n then have \"fst (last lc1) = Throw\"\n using last_m_lc1 last_lc1 by simp \n then have s2_normal:\"s2 \\ Normal ` r\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (r,R)\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` r\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\" \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cpn n \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce \n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (q,a)) F\"\n using a3 unfolding com_validityn_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce\n have suck':\"Suc k' < length lc2\" \n using k' a00 length_lc2 by arith\n moreover then have \"\\\\\\<^sub>c(lc2!k') \\ (lc2!(Suc k'))\" \n using k' lc2_l a21 by fastforce \n ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\ G\"\n using comm_lc2 lc2_last_f comm_dest1[of \\ lc2 G q a F k'] \n by blast\n then have ?thesis using suck' lc2_l k' by fastforce\n } \n then show ?thesis using left by auto \n }\n qed \n qed\n } thus ?thesis by auto \n qed note left=this\n have right:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof -\n { assume final_l:\"final (last l)\" \n have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n then have final_lc2:\"final (last lc2)\" using final_l by auto\n {\n assume lst_lc1_skip:\"fst (last lc1) = Skip\" \n then have c2_skip:\"c2 = Skip\" \n using step lastlc1_normal LanguageCon.com.distinct(17) last_lc1 \n by auto \n have Skip:\"fst (l!(length l - 1)) = Skip\"\n using li Normals2 env_tran_right cp' c2_skip a0\n i_skip_all_skip[of \\ l i \"(length l) - 1\" _] \n by fastforce \n have s2_a:\"s2 \\ Normal ` q\"\n using normal_last \n by (simp add: lst_lc1_skip l_is)\n then have \"\\ia. i \\ ia \\ ia < length l - 1 \\ \\\\\\<^sub>c l ! ia \\\\<^sub>e l ! Suc ia\"\n using c2_skip li Normals2 a0 cp' env_tran_right final_def\n by (metis (no_types, hide_lams) One_nat_def SmallStepCon.no_step_final' \n Suc_lessD add.right_neutral add_Suc_right \n cptn_tran_ce_i i_skip_all_skip less_diff_conv step_ce_elim_cases) \n then have \"snd (l!(length l - 1)) \\ Normal ` q \\ fst (l!(length l - 1)) = Skip\" \n using a0 s2_a li a4 env_tran_right stability[of q R l i \"(length l) -1\" _ \\] Skip \n by (metis One_nat_def Suc_pred length_greater_0_conv lessI linorder_not_less list.size(3) \n not_less0 not_less_eq_eq snd_conv)\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using a0 by (metis last_conv_nth list.size(3) not_less0) \n } note left = this\n { assume \"fst (last lc1) = Throw\" \n then have s2_normal:\"s2 \\ Normal ` r\" \n using normal_last lastlc1_normal Normals2\n by fastforce\n have length_lc2:\"length l=i+length lc2\" \n using i_map cp_lc1 by fastforce\n have \"(\\,lc2) \\ assum (r,R)\" \n proof -\n have left:\"snd (lc2!0) \\ Normal ` r\" \n using li lc2_l s2_normal lc2_not_empty by fastforce \n {\n fix j\n assume j_len:\"Suc j\\\\<^sub>c(lc2!j) \\\\<^sub>e (lc2!(Suc j))\"\n \n then have suc_len:\"Suc (i + j)\\\\<^sub>c(l!(i+j)) \\\\<^sub>e (l! (Suc (i+ j)))\"\n using lc2_l j_step j_len by fastforce\n ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\ R\"\n using assum suc_len lc2_l j_len cp by fastforce \n }\n then show ?thesis using left \n unfolding assum_def by fastforce\n qed\n also have \"(\\,lc2) \\ cpn n \\ c2 s2\"\n using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n ultimately have comm_lc2:\"(\\,lc2) \\ comm (G, (q,a)) F\"\n using a3 unfolding com_validityn_def by auto\n have lc2_last_f:\"snd (last lc2)\\ Fault ` F\" \n using lc2_l lc2_not_empty l_f cp_lc1 by fastforce \n then have \"((fst (last lc2) = Skip \\ \n snd (last lc2) \\ Normal ` q)) \\\n (fst (last lc2) = Throw \\ \n snd (last lc2) \\ Normal ` (a))\" \n using final_lc2 comm_lc2 unfolding comm_def by auto\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using eq_last_lc2_l by auto\n }\n then have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\" \n using left using last_lc1 by auto\n } thus ?thesis by auto qed \n thus ?thesis using left l_f \\1 unfolding comm_def by force \n qed \n } thus ?thesis using \\1 unfolding comm_def by auto qed\n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\n\nlemma DynCom_sound: \n \"(\\s \\ p. ((\\,\\\\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\ \n (\\n. (\\,\\ \\n\\<^bsub>/F\\<^esub> (c1 s) sat [p,R, G, q,a])))) \\\n (\\s. (Normal s, Normal s) \\ G) \\\n (Sta p R) \\ (Sta q R) \\ (Sta a R) \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (DynCom c1) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"(\\s \\ p. ((\\,\\\\\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\ \n (\\n. (\\,\\ \\n\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]))))\" and \n a1:\"\\s. (Normal s, Normal s) \\ G\" and \n a2: \"(Sta p R) \\ (Sta q R) \\ (Sta a R)\" \n { \n fix s\n assume all_DynCom:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a0:\"(\\s \\ p. (\\ \\n\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]))\"\n using a0 unfolding com_cvalidityn_def by fastforce \n have \"cpn n \\(DynCom c1) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (DynCom c1) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (DynCom c1) s\"\n unfolding cp_def cpn_def\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=(DynCom c1,s) \\ (\\,l) \\ cptn \\ \\=\\1\" \n using a10' cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n obtain ns where s_normal:\"s=Normal ns \\ ns\\ p\" \n using cp assum by fastforce \n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj = (DynCom c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt a2 cp env_tran_right assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis snd_conv stepc_Normal_elim_cases(10)) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s')\\G\" using a1 by fastforce\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have p1:\"s'\\p \\ ssj=Normal s'\" using ss ssj_normal_s by fastforce\n then have c1_valid:\"(\\ \\n\\<^bsub>/F\\<^esub> (c1 s') sat [p, R, G, q,a])\"\n using a0 by fastforce\n have cj:\"csj= (c1 s')\" using k_basic pair_j ss a0 s_normal\n proof -\n have \"\\\\\\<^sub>c (LanguageCon.com.DynCom c1, Normal s') \\ (csj, ssj)\"\n using k_basic pair_j ss by force\n then have \"(csj, ssj) = (c1 s', Normal s')\"\n by (meson stepc_Normal_elim_cases(10))\n then show ?thesis\n by blast\n qed \n moreover then have \"cpn n \\ csj ssj \\ assum(p, R) \\ comm(G, (q,a)) F\"\n using a2 com_validityn_def cj p1 c1_valid by blast \n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using p1 j_length a11 \\1 ssj_normal_s \n using a10 cpn_assum_induct by fastforce \n then show ?thesis \n using a00 a21 a10' \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"DynCom c1\" s _ \"Suc j\" G q a F k ]\n unfolding Satis_def by fastforce \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = DynCom c1\" using cp by auto\n ultimately show ?thesis \n using a2 cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (DynCom c1) \\ sj \\ Normal ` (p)\" \n using a2 pair_j before_k_all_evnt cp env_tran_right assum stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 \n by (metis snd_conv stepc_Normal_elim_cases(10))\n have cj:\"csj=c1 s'\" using k_basic pair_j ss a0\n by (metis fst_conv stepc_Normal_elim_cases(10)) \n moreover have p1:\"s'\\p\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum(p, R) \\ comm(G, (q,a)) F\"\n using a0 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s \n by (meson contra_subsetD cpn_assum_induct) \n thus ?thesis \n using j_length l_f drop_comm a10' \\1 cptn_comm_induct[of \\ l \"DynCom c1\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (auto simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma Guard_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a] \\\n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]) \\ \n Sta (p \\ g) R \\ (\\s. (Normal s, Normal s) \\ G) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p \\ g, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ g) , R, G, q,a]\" and\n a1:\"(\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a])\" and \n a2: \"Sta (p \\ g) R\" and\n a3: \"\\s. (Normal s, Normal s) \\ G\"\n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" \n using a1 com_cvalidityn_def by fastforce\n have \"cpn n \\ (Guard f g c1) s \\ assum(p \\ g, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Guard f g c1) s\" and a11:\"c \\ assum(p \\ g, R)\"\n then have a10':\"c \\ cp \\ (Guard f g c1) s\" \n unfolding cpn_def cp_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Guard f g c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p \\ g) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ (p \\ g) l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto\n have concl:\"(\\i. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of \"p \\ g\" R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p \\ g)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a0 stepc_Normal_elim_cases(2)\n by (metis (no_types, lifting) IntD2 prod.inject) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \" (Normal s', Normal s')\\G\" using a3 by auto \n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) IntD2 fst_conv stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum(p \\ g, R) \\ comm(G, (q,a)) F\"\n using a1 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s\n cpn_assum_induct\n by fastforce \n then show ?thesis \n using a00 a21 a10' \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k ]\n unfolding Satis_def by fastforce \n qed \n qed \n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n then have k_basic:\"cj = (Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of \"p \\ g\" R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p \\ g)\" by auto \n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a1\n by (metis (no_types, lifting) IntD2 Pair_inject stepc_Normal_elim_cases(2)) \n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ g), R) \\ comm(G, (q,a)) F\"\n using a1 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s cpn_assum_induct\n by fastforce \n thus ?thesis \n using j_length l_f drop_comm a10' \\1 cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\nlemma Guarantee_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [(p \\ g), R, G, q,a] \\\n \\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a] \\ \n Sta p R \\ \n f\\F \\\n (\\s. (Normal s, Normal s) \\ G) \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p, R, G, q,a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" and\n a1:\"\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" and \n a2: \"Sta p R\" and\n a3: \"(\\s. (Normal s, Normal s) \\ G)\" and\n a4: \"f\\F\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ g, R, G, q,a]\" \n using a1 com_cvalidityn_def by fastforce\n have \"cpn n \\ (Guard f g c1) s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n { \n fix c \n assume a10:\"c \\ cpn n \\ (Guard f g c1) s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c \\ cp \\ (Guard f g c1) s\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fast\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have \"c \\ comm(G, (q,a)) F\" \n proof - \n {assume l_f:\"snd (last l) \\ Fault ` F\" \n have cp:\"l!0=((Guard f g c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n have assum:\"snd(l!0) \\ Normal ` (p) \\ (\\i. Suc i \n (\\1)\\\\<^sub>c(l!i) \\\\<^sub>e (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ R)\" \n using a11 c_prod unfolding assum_def by simp\n then have env_tran:\"env_tran \\ p l R\" using env_tran_def cp by blast\n then have env_tran_right: \"env_tran_right \\ l R\" \n using env_tran env_tran_right_def unfolding env_tran_def by auto \n have concl:\"(\\i ns ns'. Suc i \n \\1\\\\<^sub>c(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G)\"\n proof -\n { fix k ns ns'\n assume a00:\"Suc k\\\\<^sub>c(l!k) \\ (l!(Suc k))\" \n obtain j where before_k_all_evnt:\"j\\k \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n have or:\"s'\\ (g \\ (-g))\" by fastforce\n {assume \"s' \\ g\"\n then have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using ss k_basic by fastforce\n then have ss: \"sj = Normal s' \\ s'\\ (p \\ g)\"\n using ss by fastforce\n have ssj_normal_s:\"ssj = Normal s'\" \n using ss before_k_all_evnt k_basic pair_j a0 stepc_Normal_elim_cases(2)\n by (metis (no_types, lifting) IntD2 prod.inject) \n have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using ss a2 unfolding Satis_def\n proof (cases \"k=j\") \n case True \n have \"(Normal s', Normal s') \\ G\" using a3 by auto\n thus \"(snd (l ! k), snd (l ! Suc k)) \\ G\"\n using pair_j k_basic True ss ssj_normal_s by auto\n next\n case False \n have j_k:\"j G\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s' \\ (p \\ g)\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ g), R) \\ comm(G, (q,a)) F\"\n using a1 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s cpn_assum_induct\n by fastforce \n then show ?thesis \n using a3 a00 a21 a10' \\1 j_k j_length l_f\n cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k]\n unfolding Satis_def by fastforce \n qed \n qed\n } note p1=this\n {(* assume \"s' \\ (Collect (not (set_fun g)))\"\n then have \"s'\\g\" by fastforce *)\n assume \"s'\\g\"\n then have csj_skip:\"csj= Skip \\ ssj=Fault f\" using k_basic ss pair_j \n by (meson Pair_inject stepc_Normal_elim_cases(2))\n then have \"snd (last l) = Fault f\" using pair_j\n proof -\n have \"j = k\" \n proof -\n have f1: \"k < length l\"\n using a00 by linarith\n have \"\\ SmallStepCon.final (l ! k)\"\n by (metis SmallStepCon.no_step_final' a21)\n then have \"\\ Suc j \\ k\"\n using f1 SmallStepCon.final_def cp csj_skip i_skip_all_skip pair_j by blast\n then show ?thesis\n by (metis Suc_leI before_k_all_evnt le_eq_less_or_eq)\n qed\n then have False\n using pair_j csj_skip by (metis a00 a4 cp image_eqI l_f last_not_F)\n then show ?thesis\n by metis\n qed\n then have False using a4 l_f by auto \n }\n then have \"(snd(l!k), snd(l!(Suc k))) \\ G\"\n using p1 or by fastforce\n } thus ?thesis by (simp add: c_prod cp) qed\n have concr:\"(final (last l) \\ \n ((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a)))\"\n proof-\n { \n assume valid:\"final (last l)\" \n have \"\\k. k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n proof - \n have len_l:\"length l > 0\" using cp using cptn.simps by blast \n then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n have last_l:\"last l = l!(length l-1)\"\n using last_length [of a1 l1] l by fastforce \n have final_0:\"\\final(l!0)\" using cp unfolding final_def by auto\n have \"0\\ (length l-1)\" using len_l last_l by auto\n moreover have \"(length l-1) < length l\" using len_l by auto\n moreover have \"final (l!(length l-1))\" using valid last_l by auto\n moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n ultimately show ?thesis \n using cp final_exist_component_tran_final env_tran_right final_0 \n by blast \n qed\n then obtain k where a21: \"k\\0 \\ k<((length l) - 1) \\ (\\\\\\<^sub>c(l!k) \\ (l!(Suc k))) \\ final (l!(Suc k))\"\n by auto\n then have a00:\"Suc kk \\ (\\\\\\<^sub>c(l!j) \\ (l!(Suc j))) \\ (\\k < j. (\\\\\\<^sub>c(l!k) \\\\<^sub>e (l!(Suc k))))\"\n using a00 a21 exist_first_comp_tran cp by blast\n then obtain cj sj csj ssj where pair_j:\"(\\\\\\<^sub>c(cj,sj) \\ (csj,ssj)) \\ cj = fst (l!j) \\ sj = snd (l!j) \\ csj = fst (l!(Suc j)) \\ ssj = snd(l!(Suc j))\"\n by fastforce \n have \"((fst (last l) = Skip \\ \n snd (last l) \\ Normal ` q)) \\\n (fst (last l) = Throw \\ \n snd (last l) \\ Normal ` (a))\"\n proof -\n have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p)\" \n using pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\]\n by force\n then obtain s' where ss:\"sj = Normal s' \\ s'\\ (p)\" by auto \n have or:\"s'\\ (g \\ (-g))\" by fastforce\n {assume \"s' \\ g\"\n then have k_basic:\"cj =(Guard f g c1) \\ sj \\ Normal ` (p \\ g)\" \n using ss k_basic by fastforce\n then have ss: \"sj = Normal s' \\ s'\\ (p \\ g)\"\n using ss by fastforce\n then have ssj_normal_s:\"ssj = Normal s'\" \n using before_k_all_evnt k_basic pair_j a1\n by (metis (no_types, lifting) Pair_inject IntD2 stepc_Normal_elim_cases(2)) \n have cj:\"csj=c1\" using k_basic pair_j ss a0\n by (metis (no_types, lifting) fst_conv IntD2 stepc_Normal_elim_cases(2)) \n moreover have p1:\"s'\\(p \\ g)\" using ss by blast \n moreover then have \"cpn n \\ csj ssj \\ assum((p \\ g), R) \\ comm(G, (q,a)) F\"\n using a1 com_validityn_def cj by blast\n moreover then have \"l!(Suc j) = (csj, Normal s')\" \n using before_k_all_evnt pair_j cj ssj_normal_s\n by fastforce\n ultimately have drop_comm:\"((\\, drop (Suc j) l))\\ comm(G, (q,a)) F\"\n using j_length a10 a11 \\1 ssj_normal_s cpn_assum_induct\n by fastforce \n then have ?thesis \n using j_length l_f drop_comm a10' \\1 \n cptn_comm_induct[of \\ l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"] valid \n by blast\n }note left=this \n {\n (* assume \"s' \\ (Collect (not (set_fun g)))\"\n then have \"s'\\g\" by fastforce *)\n assume \"s'\\g\"\n then have \"csj= Skip \\ ssj=Fault f\" using k_basic ss pair_j \n by (meson Pair_inject stepc_Normal_elim_cases(2))\n then have \"snd (last l) = Fault f\" using pair_j\n by (metis a4 cp imageI j_length l_f last_not_F) \n then have False using a4 l_f by auto \n }\n thus ?thesis using or left by auto qed\n } thus ?thesis by auto \n qed\n note res = conjI [OF concl concr]} \n thus ?thesis using c_prod unfolding comm_def by force qed \n } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\nlemma WhileNone: \n \"\\\\\\<^sub>c (While b c1, s1) \\ (LanguageCon.com.Skip, t1) \\ \n (n,\\, (Skip, t1) # xsa) \\ cptn_mod_nest_call \\ \n \\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b,R, G, p,a] \\\n Sta p R \\\n Sta (p \\ (-b)) R \\\n Sta a R \\\n (\\s. (Normal s, Normal s) \\ G) \\ \n (\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ assum (p, R) \\ \n (\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ comm (G,(p \\ (-b)),a) F\"\nproof -\n assume a0:\"\\\\\\<^sub>c (While b c1, s1) \\ (LanguageCon.com.Skip, t1)\" and\n a1:\"(n,\\, (Skip, t1) # xsa) \\ cptn_mod_nest_call\" and\n a2:\" \\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b,R, G, p,a]\" and\n a3:\"Sta p R\" and\n a4:\"Sta (p \\ (-b)) R\" and\n a5:\"Sta a R\" and\n a6:\"\\s. (Normal s, Normal s) \\ G\" and\n a7:\"(\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\ assum (p, R)\" \n obtain s1' where s1N:\"s1=Normal s1' \\ s1'\\p\" using a7 unfolding assum_def by fastforce\n then have s1_t1:\"s1'\\ b \\ t1=s1\" using a0\n using LanguageCon.com.distinct(5) prod.inject \n by (fastforce elim:stepc_Normal_elim_cases(7))\n then have t1_Normal_post:\"t1\\ Normal ` (p \\ (-b))\"\n using s1N by fastforce\n also have \"(\\, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa)\\cptn\"\n using a1 a0 cptn.simps\n using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n ultimately have assum_skip:\n \"(\\,(LanguageCon.com.Skip, t1) # xsa) \\ assum (( p \\ (-b)), R)\"\n using a1 a7 tl_of_assum_in_assum1 t1_Normal_post by fastforce\n have skip_comm:\"(\\,(LanguageCon.com.Skip, t1) # xsa) \\ \n comm (G,(( p \\ (-b)),a)) F\" \n proof- \n obtain \\ where \"(\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p , R, G, q,a])\" by auto\n moreover have \"\\,\\ \\n\\<^bsub>/F\\<^esub> Skip sat [( p \\ (-b)), R, G, ( p \\ (-b)),a]\"\n using Skip_sound[of \"(p \\ - b)\"] a4 a6 by blast\n ultimately show ?thesis\n using assum_skip a1 unfolding com_cvalidityn_def com_validityn_def cpn_def\n by fastforce\n qed \n have G_ref:\"(Normal s1', Normal s1')\\G\" using a6 by fastforce\n thus ?thesis using skip_comm ctran_in_comm[of s1'] s1N s1_t1 by blast\nqed \n\nlemma while1:\n \"(n,\\, ((c, Normal s1) # xs1)) \\ cptn_mod_nest_call \\ \n s1 \\ b \\\n xsa = map (lift (While b c)) xs1 \\\n \\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a] \\ \n (\\, (While b c, Normal s1) #\n (Seq c (LanguageCon.com.While b c), Normal s1) # xsa)\n \\ assum (p, R) \\ \n \\s. (Normal s, Normal s) \\ G \\ \n (\\, (LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) # xsa)\n \\ comm (G, p\\(-b), a) F\"\nproof -\nassume \n a0:\"(n,\\, ((c, Normal s1) # xs1)) \\ cptn_mod_nest_call\" and\n a1:\"s1 \\ b\" and\n a2:\"xsa = map (lift (While b c)) xs1\" and\n a3:\"\\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a]\" and\n a4:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R) \" and \n a5:\"\\s. (Normal s,Normal s) \\ G\" \n have seq_map:\"(Seq c (While b c), Normal s1) # xsa=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a1\n WhileTruec by fastforce\n have s1_normal:\"s1 \\ p \\ s1 \\ b \" using a4 a1 unfolding assum_def by fastforce\n then have G_ref:\"(Normal s1, Normal s1) \\ G\" using a5 by fastforce \n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(\\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn\" \n using a2 cptn_eq_cptn_mod_nest lift_is_cptn a0 by blast \n then have cptn_seq:\"(\\,(Seq c (While b c), Normal s1) # xsa) \\cptn\" \n using seq_map by auto\n then have \"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa) \\ cptn\"\n using step by (simp add: cptn.CptnComp) \n then have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # xsa)\\assum (p, R)\"\n using a4 tl_of_assum_in_assum1 s1_collect_p by fastforce\n have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cpn n \\ c (Normal s1))\"\n using a0 unfolding cpn_def by fastforce\n then have cp_c':\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by fastforce \n also have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # xsa) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cp_def by fastforce\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R)\" \n using assum_map assum_seq seq_map by fastforce \n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R)\"\n unfolding assum_def using s1_collect_p by fastforce\n then have \"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a3 cp_c unfolding com_validityn_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # xsa) \\ comm(G,(p,a)) F\"\n using cp_seq cp_c' comm_map seq_map by fastforce\n then have \"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n also have \"\\ final (last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # xsa))\"\n using seq_map unfolding final_def lift_def by (simp add: case_prod_beta' last_map) \n ultimately show ?thesis using not_final_in_comm[of \\] by blast\nqed\n\nlemma while2:\n \" (n,\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa) \\cptn_mod_nest_call \\\n (n, \\, (c, Normal s1) # xs1) \\ cptn_mod_nest_call \\\n fst (last ((c, Normal s1) # xs1)) = LanguageCon.com.Skip \\\n s1 \\ b \\\n xsa = map (lift (While b c)) xs1 @\n (While b c, snd (last ((c, Normal s1) # xs1))) # ys \\\n (n, \\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ cptn_mod_nest_call \\\n (\\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a] \\ \n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R) \\\n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ comm (G, p \\ (-b), a) F) \\\n \\ \\n\\<^bsub>/F\\<^esub> c sat [ p \\ b, R, G, p,a] \\\n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R) \\\n \\s. (Normal s,Normal s) \\ G \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ comm (G,( p \\ (-b), a)) F\"\nproof -\nassume a00:\"(n, \\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa) \\cptn_mod_nest_call\" and\n a0:\"(n,\\, (c, Normal s1) # xs1) \\ cptn_mod_nest_call\" and\n a1:\" fst (last ((c, Normal s1) # xs1)) = LanguageCon.com.Skip\" and\n a2:\"s1 \\ b\" and\n a3:\"xsa = map (lift (While b c)) xs1 @\n (While b c, snd (last ((c, Normal s1) # xs1))) # ys\" and\n a4:\"(n,\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ cptn_mod_nest_call\" and\n a5:\"\\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]\" and \n a6:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\n \\ assum (p, R)\" and\n a7:\"(\\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a] \\ \n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R) \\\n (\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ comm (G,p \\ (-b), a) F)\" and\n a8:\"\\s. (Normal s, Normal s) \\ G\" \n let ?l= \"(While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa\"\n let ?sub_l=\"((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)\"\n {\n assume final_not_fault:\"snd (last ?l) \\ Fault ` F\"\n have a0':\"(\\, (c, Normal s1) # xs1) \\ cptn\"\n using cptn_eq_cptn_mod_nest using a0 by auto\n have a4:\"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys) \\ cptn\" \n using cptn_eq_cptn_mod_nest using a4 by blast\n have seq_map:\"(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a2\n WhileTruec by fastforce\n have s1_normal:\"s1\\p \\ s1 \\ b \" using a6 a2 unfolding assum_def by fastforce\n have G_ref:\"(Normal s1, Normal s1)\\G \" \n using a8 by blast\n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(\\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn\" \n using a2 cptn_eq_cptn_mod lift_is_cptn a0' by fastforce\n then have cptn_seq:\"(\\,(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\cptn\" \n using seq_map by auto\n then have \"(\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ cptn\"\n using step by (simp add: cptn.CptnComp) \n also have \"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) #\n map (lift (While b c)) xs1)\n \\ assum (p, R)\"\n using a6 a3 sub_assum by force \n ultimately have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ assum (p, R)\"\n using a6 tl_of_assum_in_assum1 s1_collect_p \n tl_of_assum_in_assum by fastforce\n have cpn_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cpn n \\ c (Normal s1))\"\n using a0 unfolding cpn_def by fastforce\n have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n using a0' unfolding cp_def by fastforce \n also have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cp_def by fastforce\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R) \" \n using assum_map assum_seq seq_map by fastforce \n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R) \"\n unfolding assum_def using s1_collect_p by fastforce\n then have c_comm:\"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a5 cpn_c unfolding com_validityn_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using cp_seq cp_c comm_map seq_map by fastforce\n then have comm_while:\"(\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n have final_last_c:\"final (last ((c,Normal s1)#xs1))\"\n using a1 a3 unfolding final_def by fastforce\n have last_while1:\"snd (last (map (lift (While b c)) ((c,Normal s1)#xs1))) = snd (last ((c, Normal s1) # xs1))\"\n unfolding lift_def by (simp add: case_prod_beta' last_map)\n have last_while2:\"(last (map (lift (While b c)) ((c,Normal s1)#xs1))) =\n last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1)\"\n using seq_map by fastforce\n have not_fault_final_last_c:\n \"snd (last ( (c,Normal s1)#xs1)) \\ Fault ` F\"\n proof - \n have \"(length ?sub_l) - 1 < length ?l\" \n using a3 by fastforce\n then have \"snd (?l!((length ?sub_l) - 1))\\ Fault ` F\"\n using final_not_fault a3 a00 last_not_F[of \\ ?l F]\n cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by blast \n thus ?thesis using last_while2 last_while1 seq_map\n by (metis (no_types) Cons_lift_append a3 diff_Suc_1 last_length length_Cons lessI nth_Cons_Suc nth_append)\n qed\n then have last_c_normal:\"snd (last ( (c,Normal s1)#xs1)) \\ Normal ` (p)\"\n using c_comm a1 unfolding comm_def final_def by fastforce \n then obtain sl where sl:\"snd (last ( (c,Normal s1)#xs1)) = Normal sl\" by fastforce\n have while_comm:\"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys) \\ comm(G,(p\\(-b),a)) F\"\n proof -\n have assum_while: \"(\\, (While b c, snd (last ((c, Normal s1) # xs1))) # ys)\n \\ assum (p, R)\"\n using last_c_normal a3 a6 sub_assum_r[of \\ ?sub_l \"(While b c, snd (last ((c, Normal s1) # xs1)))\" ys p R p] \n by fastforce\n thus ?thesis using a5 a7 by fastforce\n qed \n have \"sl\\p\" using last_c_normal sl by fastforce\n then have G1_ref:\"(Normal sl, Normal sl)\\G\" using a8 by auto\n also have \"snd (last ?sub_l) = Normal sl\"\n using last_while1 last_while2 sl by fastforce\n ultimately have ?thesis \n using cptn_eq_cptn_mod_nest a00 a3 sl while_comm comm_union[OF comm_while] \n by fastforce \n } note p1 =this\n {\n assume final_not_fault:\"\\ (snd (last ?l) \\ Fault ` F)\"\n then have ?thesis unfolding comm_def by fastforce\n } thus ?thesis using p1 by fastforce\nqed\n\nlemma while3:\n \"(n, \\, (c, Normal s1) # xs1) \\ cptn_mod_nest_call \\ \n fst (last ((c, Normal s1) # xs1)) = Throw \\\n s1 \\ b \\\n snd (last ((c, Normal s1) # xs1)) = Normal sl \\\n (n,\\, (Throw, Normal sl) # ys) \\ cptn_mod_nest_call \\\n \\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b,R, G, p,a] \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n (map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))\n \\ assum (p, R) \\ \n Sta p R \\\n Sta a R \\ \\s. (Normal s, Normal s) \\ G \\ \n (\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n ((map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))) \\ comm (G, p\\ (-b), a) F\n\"\nproof -\nassume a0:\"(n,\\, (c, Normal s1) # xs1) \\ cptn_mod_nest_call\" and\n a1:\"fst (last ((c, Normal s1) # xs1)) = Throw\" and\n a2:\"s1 \\ b\" and\n a3:\"snd (last ((c, Normal s1) # xs1)) = Normal sl\" and\n a4:\"(n,\\, (Throw, Normal sl) # ys) \\ cptn_mod_nest_call\" and\n a5:\"\\ \\n\\<^bsub>/F\\<^esub> c sat [p \\ b, R, G, p,a]\" and\n a6:\"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n (map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))\n \\ assum (p, R)\" and \n a7: \"Sta p R\" and\n a8: \"Sta a R\" and \n a10:\"\\s. (Normal s,Normal s) \\ G\" \n have seq_map:\"(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1=\n map (lift (While b c)) ((c,Normal s1)#xs1)\"\n using a2 unfolding lift_def by fastforce\n have step:\"\\\\\\<^sub>c(While b c,Normal s1) \\ (Seq c (While b c),Normal s1)\" using a2\n WhileTruec by fastforce\n have s1_normal:\"s1\\p \\ s1 \\ b \" using a6 a2 unfolding assum_def by fastforce\n then have G_ref:\"(Normal s1, Normal s1)\\G\" using a10 by auto\n have s1_collect_p: \"Normal s1\\ Normal ` (p \\ b)\" using s1_normal by fastforce\n have \"(n, \\, map (lift (While b c)) ((c,Normal s1)#xs1))\\cptn_mod_nest_call\" \n using a2 lift_is_cptn a0\n by (metis cptn_mod_nest_call.CptnModNestSeq1 seq_map) \n then have cptn_seq:\"(n,\\,(Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\cptn_mod_nest_call\" \n using seq_map by auto\n then have cptn:\"(n,\\, (While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ cptn_mod_nest_call\"\n by (meson a0 a2 cptn_mod_nest_call.CptnModNestWhile1) \n also have \"(\\, (LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1)\n \\ assum (p, R) \"\n using a6 sub_assum by force \n ultimately have assum_seq:\"(\\,(Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1) \\ assum (p, R)\"\n using a6 tl_of_assum_in_assum1 s1_collect_p \n tl_of_assum_in_assum cptn_eq_cptn_mod_nest by fast\n have cpn_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cpn n \\ c (Normal s1))\"\n using a0 unfolding cpn_def by fastforce\n then have cp_c:\"(\\, ((c, Normal s1) # xs1)) \\ (cp \\ c (Normal s1))\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n moreover have cp_seq:\"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ (cpn n \\ (Seq c (While b c)) (Normal s1))\"\n using cptn_seq unfolding cpn_def by fastforce\n then have cp_seq':\"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ (cp \\ (Seq c (While b c)) (Normal s1))\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n ultimately have \"(\\, ((c, Normal s1) # xs1)) \\ assum(p,R)\" \n using assum_map assum_seq seq_map by fastforce\n then have \"(\\, ((c, Normal s1) # xs1)) \\ assum((p \\ b),R)\"\n unfolding assum_def using s1_collect_p by fastforce\n then have c_comm:\"(\\, ((c, Normal s1) # xs1)) \\ comm(G,(p,a)) F\"\n using a5 cpn_c unfolding com_validityn_def by fastforce\n then have \"(\\, (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using cp_seq' cp_c comm_map seq_map by fastforce\n then have comm_while:\"(\\, (While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1) \\ comm(G,(p,a)) F\"\n using G_ref ctran_in_comm by fastforce\n have final_last_c:\"final (last ((c,Normal s1)#xs1))\"\n using a1 a3 unfolding final_def by fastforce\n have not_fault_final_last_c:\n \"snd (last ( (c,Normal s1)#xs1)) \\ Fault ` F\"\n using a3 by fastforce\n then have sl_a:\"Normal sl \\ Normal ` (a)\" \n using final_last_c a1 c_comm unfolding comm_def\n using a3 comm_dest2 \n by auto\n have last_while1:\"snd (last (map (lift (While b c)) ((c,Normal s1)#xs1))) = snd (last ((c, Normal s1) # xs1))\"\n unfolding lift_def by (simp add: case_prod_beta' last_map)\n have last_while2:\"(last (map (lift (While b c)) ((c,Normal s1)#xs1))) =\n last ((While b c, Normal s1) # (Seq c (While b c), Normal s1) # map (lift (While b c)) xs1)\"\n using seq_map by fastforce\n have throw_comm:\"(\\, (Throw, Normal sl) # ys) \\ comm(G,(p\\(-b),a)) F\"\n proof -\n have assum_throw: \"(\\, (Throw, Normal sl) # ys) \\ assum (a,R)\"\n using sl_a a6 sub_assum_r[of _ \"(LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1\" \"(Throw, Normal sl)\" ] \n by fastforce\n also have \"(\\,(Throw, Normal sl) # ys) \\ cpn n \\ Throw (Normal sl)\" \n unfolding cpn_def using a4 by fastforce\n ultimately show ?thesis using Throw_sound[of a R G \\] a10 a8 \n unfolding com_cvalidityn_def com_validityn_def by fast\n qed \n have p1:\"(LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1 \\\n [] \\\n (LanguageCon.com.Throw, Normal sl) # ys \\ []\" by auto \n have \"sl \\ a\" using sl_a by fastforce\n then have G1_ref:\"(Normal sl, Normal sl) \\ G\" using a10 by auto\n moreover have \"snd (last ((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)) = Normal sl\"\n using last_while1 last_while2 a3 by fastforce\n moreover have \"snd (((LanguageCon.com.Throw, Normal sl) # ys) ! 0) = Normal sl\"\n by (metis nth_Cons_0 snd_conv)\n ultimately have G:\"(snd (last ((While b c, Normal s1) # \n (Seq c (While b c), Normal s1) # \n map (lift (While b c)) xs1)),\n snd (((LanguageCon.com.Throw, Normal sl) # ys) ! 0)) \\ G\" by auto\n have cptn:\"(\\, ((LanguageCon.com.While b c, Normal s1) #\n (LanguageCon.com.Seq c (LanguageCon.com.While b c), Normal s1) #\n map (lift (LanguageCon.com.While b c)) xs1) @\n (LanguageCon.com.Throw, Normal sl) # ys)\n \\ cptn\" using cptn a4 a0 a1 a3 a4 cptn_eq_cptn_mod_set cptn_mod.CptnModWhile3 s1_normal \n cptn_eq_cptn_mod_nest by (metis append_Cons)\n show ?thesis using a0 comm_union[OF comm_while throw_comm p1 G cptn] by auto \nqed\n\n\ninductive_cases stepc_elim_cases_while_throw [cases set]:\n \"\\\\\\<^sub>c(While b c, s) \\ (Throw, t)\"\n\n\nlemma WhileSound_aux:\n \"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \\\n Sta p R \\\n Sta (p \\ (-b)) R \\ \n Sta a R \\ \n (n, \\,x)\\ cptn_mod_nest_call \\ \n \\s. (Normal s, Normal s) \\ G \\\n \\s xs. x = ((While b c1),s)#xs \\ \n (\\,x)\\assum(p,R) \\ \n (\\,x) \\ comm (G,(( p \\ (-b)),a)) F\"\nproof -\n assume a0: \"\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \" and\n a1: \"Sta p R\" and\n a2: \"Sta (p \\ (-b)) R\" and\n a3: \"Sta a R\" and\n a4: \"(n,\\,x)\\ cptn_mod_nest_call\" and\n a5: \"\\s. (Normal s, Normal s) \\ G\" \n {fix xs s \n assume while_xs:\"x=((While b c1),s)#xs\" and\n x_assum:\"(\\,x)\\assum(p,R)\"\n have \"(\\,x) \\ comm (G,(( p \\ (-b)),a)) F\"\n using a4 a0 while_xs x_assum\n proof (induct arbitrary: xs s c1 rule:cptn_mod_nest_call.induct)\n case (CptnModNestOne \\ C s1) thus ?case \n using CptnModOne unfolding comm_def final_def\n by auto\n next\n case (CptnModNestEnv \\ C s1 t1 n xsa) \n then have c_while:\"C = While b c1\" by fastforce\n have \"(\\, (C, t1) # xsa) \\ assum (p, R) \\\n (\\, (C, t1) # xsa) \\ comm (G, p \\ (-b), a) F\" \n using CptnModNestEnv by fastforce \n moreover have\"(n,\\,(C, s1)#(C, t1) # xsa) \\ cptn_mod_nest_call\"\n using CptnModNestEnv(1,2) CptnModNestEnv.hyps(1) CptnModNestEnv.hyps(2)\n using cptn_mod_nest_call.CptnModNestEnv by blast\n then have cptn_mod:\"(\\,(C, s1)#(C, t1) # xsa) \\ cptn\" \n using cptn_eq_cptn_mod_nest by blast \n then have \"(\\, (C, t1) # xsa) \\ assum (p, R)\" \n using tl_of_assum_in_assum CptnModNestEnv(6) a1 a2 a3 a4 a5\n by blast\n ultimately have \"(\\, (C, t1) # xsa) \\ comm (G, p \\ (-b), a) F\"\n by auto\n also have \" \\ (\\\\\\<^sub>c((C,s1)) \\ ((C,t1)))\"\n by (simp add: mod_env_not_component) \n ultimately show ?case \n using cptn_mod etran_in_comm by blast\n next \n case (CptnModNestSkip \\ C s1 t1 n xsa) \n then have \"C=While b c1\" by auto\n also have \"(n,\\, (LanguageCon.com.Skip, t1) # xsa) \\ cptn_mod_nest_call\"\n using cptn_eq_cptn_mod_set CptnModNestSkip(4) by fastforce\n thus ?case using WhileNone CptnModNestSkip a1 a2 a3 a4 a5 by blast\n next\n case (CptnModNestThrow \\ C s1 t1 n xsa) \n then have \"C = While b c1\" by auto \n thus ?case using stepc_elim_cases_while_throw CptnModNestThrow(1) \n by blast\n next \n case (CptnModNestWhile1 n \\ c s1 xs1 b1 xsa zs) \n then have \"b=b1 \\ c=c1 \\ s=Normal s1\" by auto \n thus ?case\n using a4 a5 CptnModNestWhile1 while1[of n \\] by blast\n next \n case (CptnModNestWhile2 n \\ c s1 xs1 b1 xsa ys zs)\n then have a00: \"(n,\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # xsa)\\cptn_mod_nest_call\" \n using cptn_mod_nest_call.CptnModNestWhile2 by fast \n then have eqs:\"b=b1 \\ c=c1 \\ s=Normal s1\"using CptnModNestWhile2 by auto\n thus ?case using a00 a4 a5 CptnModNestWhile2 while2[of n \\ b c s1 xsa xs1 ys F p R G a] \n by blast \n next\n case (CptnModNestWhile3 n \\ c s1 xs1 b1 sl ys zs) \n then have eqs:\"b=b1 \\ c=c1 \\ s=Normal s1\" by auto \n then have \"(\\, (While b c, Normal s1) #\n (Seq c (While b c), Normal s1) # \n ((map (lift (While b c)) xs1 @\n (Throw, Normal sl) # ys))) \\ comm (G, p\\(-b), a) F\" \n using a1 a3 a4 a5 CptnModNestWhile3 while3[of n \\ c s1 xs1 b sl ys F p R G a] \n by fastforce \n thus ?case using eqs CptnModNestWhile3 by auto\n qed (auto)\n }\n then show ?thesis by auto \nqed\n\n\nlemma While_sound: \n \"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a] \\\n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]) \\ \n Sta p R \\ \n Sta (p \\ (-b)) R \\ Sta a R \\ \\s. (Normal s, Normal s) \\ G \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> (While b c1) sat [p, R, G, p \\ (-b),a]\"\nproof - \n assume\n a0:\"\\,\\ \\\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]\" and\n a1:\"\\n. \\,\\ \\n \\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a]\" and \n a2: \"Sta p R\" and\n a3: \"Sta (p \\ (-b)) R\" and\n a4: \"Sta a R\" and\n a5: \"\\s. (Normal s, Normal s) \\ G\" \n { \n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n then have a1:\"(\\ \\n\\<^bsub>/F\\<^esub> c1 sat [p \\ b, R, G, p,a])\" \n using a1 com_cvalidityn_def by fastforce\n have \"cpn n \\ (While b c1) s \\ assum(p, R) \\ comm(G, (p \\ (-b),a)) F\"\n proof-\n {fix c \n assume a10:\"c \\ cpn n \\ (While b c1) s\" and a11:\"c \\ assum(p, R)\"\n then have a10': \"c \\ cp \\ (While b c1) s\"\n unfolding cp_def cpn_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=((While b c1),s) \\ (\\,l) \\ cptn \\ \\=\\1\" using a10' cp_def c_prod by fastforce \n have \\1:\"(\\, l) = c\" using c_prod cp by blast\n obtain xs where \"l=((While b c1),s)#xs\" using cp\n proof -\n assume a1: \"\\xs. l = (LanguageCon.com.While b c1, s) # xs \\ thesis\"\n have \"[] \\ l\"\n using cp cptn.simps by auto\n then show ?thesis\n using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n qed \n moreover have \"(n,\\,l)\\cptn_mod_nest_call\" using a10\n using \\1 cpn_def by fastforce \n ultimately have \"c \\ comm(G, (p \\ (-b),a)) F\"\n using a1 a2 a3 a4 WhileSound_aux a11 \\1 a5 \n by blast\n } thus ?thesis by auto qed\n }\n thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed\n\n\nlemma Conseq_sound:\n \"(\\s\\ p.\n \\p' R' G' q' a' I' \\'.\n s \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\\n \\,\\' \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\ \n (\\n. \\,\\' \\n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a]\" \nproof -\n assume \n a0: \"(\\s\\ p.\n \\p' R' G' q' a' I' \\'.\n s \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\\n \\,\\' \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\ \n (\\n. \\,\\' \\n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\"\n {\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n have \"cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n proof -\n {\n fix c\n assume a10:\"c \\ cpn n \\ P s\" and a11:\"c \\ assum(p, R)\"\n then have a10':\"c\\cp \\ P s\" unfolding cp_def cpn_def cptn_eq_cptn_mod_nest by auto\n obtain \\1 l where c_prod:\"c=(\\1,l)\" by fastforce\n have cp:\"l!0=(P,s) \\ (n,\\,l) \\ cptn_mod_nest_call \\ \\=\\1\" using a10 cpn_def c_prod by fastforce\n have \\1:\"(\\, l) = c\" using c_prod cp by blast \n obtain xs where \"l=(P,s)#xs\" using cp\n proof -\n assume a1: \"\\xs. l = (P, s) # xs \\ thesis\"\n have \"[] \\ l\"\n using cp cptn.simps\n using CptnEmpty by force\n then show ?thesis\n using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n qed\n obtain ns where s:\"(s = Normal ns)\" using a10 a11 unfolding assum_def cpn_def by fastforce\n then have \"ns \\ p\" using a10 a11 unfolding assum_def cpn_def by fastforce\n then have ns:\"ns\\p\" by auto\n then have\n \"\\s. s \\ p \\ (\\p' R' G' q' a' \\'. (s\\p') \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\\n (\\,\\' \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\ \n (\\n. \\,\\' \\n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\" using a0 by auto\n then have \n \"ns \\ p \\ (\\p' R' G' q' a' \\'. (ns \\ p' ) \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\\n (\\,\\' \\\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\ \n (\\n. \\,\\' \\n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\" apply (rule allE) by auto \n then obtain p' R' G' q' a' \\' where\n rels:\n \"ns \\ p' \\\n R \\ R' \\ \n G' \\ G \\ \n q' \\ q \\\n a' \\ a \\ \\' \\ \\ \\ \n (\\n. \\,\\' \\n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])\" using ns by auto\n then have \"s \\ Normal ` p'\" using s by fastforce\n then have \"(\\,l) \\ assum(p', R')\"\n using a11 rels cp a11 c_prod assum_R_R'[of \\ l p R p' R'] \n by fastforce\n then have \"(\\,l) \\ comm(G',(q',a')) F\" \n using rels all_call a10 c_prod cp unfolding com_cvalidityn_def com_validityn_def \n by blast\n then have \"(\\,l) \\ comm(G, (q,a)) F\" \n using c_prod cp comm_conseq[of \\ l G' q' a' F G q a] rels by fastforce\n then have \"c \\ comm(G, (q,a)) F\" using c_prod cp by fastforce\n } \n thus ?thesis unfolding comm_def by force qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed \n\nlemma Conj_post_sound:\n \"\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\ \n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]) \\ \n \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\ \n (\\n. \\,\\ \\n \\<^bsub>/F\\<^esub> P sat [p, R, G, q',a']) \\\n \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p,R, G, q \\ q' ,a \\ a']\" \nproof -\nassume a0: \"\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\ \n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a])\" and\n a1: \" \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\ \n (\\n. \\,\\ \\n \\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'])\"\n{\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n with a0 have a0:\"cpn n \\ P s \\ assum(p, R) \\ comm(G, (q,a)) F\"\n unfolding com_cvalidityn_def com_validityn_def by auto\n with a1 all_call have a1:\"cpn n \\ P s \\ assum(p, R) \\ comm(G, (q',a')) F\"\n unfolding com_cvalidityn_def com_validityn_def by auto\n have \"cpn n \\ P s \\ assum(p, R) \\ comm(G, (q\\q',a\\a')) F\"\n proof -\n {\n fix c\n assume a10:\"c \\ cpn n \\ P s\" and a11:\"c \\ assum(p, R)\"\n then have \"c \\ comm(G,(q,a)) F \\ c \\ comm(G,(q',a')) F\"\n using a0 a1 by auto\n then have \"c\\comm(G, (q\\q',a\\a')) F\"\n unfolding comm_def by fastforce\n } \n thus ?thesis unfolding comm_def by force qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed \n \nlemma x91:\"sa\\{} \\ c\\comm(G, (\\i\\sa. q i,a)) F = (\\i\\sa. c\\comm(G, q i,a) F)\" \n unfolding comm_def apply (auto simp add: Ball_def) \n apply (frule spec , force)\n by (frule spec, force)\n\n \n \nlemma conj_inter_sound:\n\"sa \\ {} \\ \n \\i\\sa. \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\ (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p,R, G, q i,a]) \\ \n \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p,R, G, \\i\\sa. q i,a]\"\nproof -\n assume a0':\"sa\\{}\" and \n a0: \"\\i\\sa. \\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\ \n (\\n. \\,\\ \\n\\<^bsub>/F\\<^esub> P sat [p,R, G, q i,a])\" \n{\n fix s\n assume all_call:\"\\(c,p,R,G,q,a)\\ \\. \\ \\n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n with a0 have a0:\"\\i\\sa. cpn n \\ P s \\ assum(p, R) \\ comm(G, (q i,a)) F\"\n unfolding com_cvalidityn_def com_validityn_def by auto \n have \"cpn n \\ P s \\ assum(p, R) \\ comm(G, (\\i\\sa. q i,a)) F\"\n proof -\n {\n fix c\n assume a10:\"c \\ cpn n \\ P s\" and a11:\"c \\ assum(p, R)\" \n then have \"(\\i\\sa. c\\comm(G, q i,a) F)\" \n using a0 by fastforce\n then have \"c\\comm(G, (\\i\\sa. q i,a)) F\" using x91[OF a0'] by blast\n } \n thus ?thesis unfolding comm_def by force qed \n } thus ?thesis by (simp add: com_validityn_def[of \\] com_cvalidityn_def) \nqed \n\nlemma localRG_sound: \"\\,\\ \\\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a] \\ (\\n. \\,\\ \\n \\<^bsub>/F\\<^esub> c sat [p, R, G, q,a])\"\nproof (induct rule:lrghoare.induct)\n case Skip \n thus ?case by (simp add: Skip_sound)\nnext\n case Spec\n thus ?case by (simp add: Spec_sound)\nnext\n case Basic\n thus ?case by (simp add: Basic_sound)\nnext\n case Await\n thus ?case by (simp add: Await_sound)\nnext\n case Throw thus ?case by (simp add: Throw_sound)\nnext \n case If thus ?case using If_sound by (simp add: If_sound)\nnext\n case Asm thus ?case by (simp add: Asm_sound)\nnext \n case CallRec thus ?case by (simp add: CallRec_sound)\nnext\n case Call thus ?case using Call_sound by (simp add: Call_sound)\nnext\n case Seq thus ?case by (simp add: Seq_sound)\nnext\n case Catch thus ?case by (simp add: Catch_sound)\nnext\n case DynCom thus ?case by (simp add: DynCom_sound)\nnext\n case Guard thus ?case by (simp add: Guard_sound)\nnext\n case Guarantee thus ?case by (simp add: Guarantee_sound)\nnext\n case While thus ?case by (simp add: While_sound)\nnext\n case (Conseq p R G q a \\ \\ F P) thus ?case \n using Conseq_sound by simp\nnext \n case (Conj_post \\ \\ F P p' R' G' q a q' a') thus ?case\n using Conj_post_sound[of \\ \\] by simp\nnext\n case (Conj_Inter sa \\ \\ F P p' R' G' q a ) \n thus ?case using conj_inter_sound[of sa \\ \\] by simp \nqed \n\n\ndefinition ParallelCom :: \"('s,'p,'f,'e) rgformula list \\ ('s,'p,'f,'e) par_com\"\nwhere\n\"ParallelCom Ps \\ map fst Ps\"\n\nlemma ParallelCom_Com:\"i (ParallelCom xs)!i = Com (xs!i)\"\nunfolding ParallelCom_def Com_def by fastforce\n\n\nlemma etran_ctran_eq_p_normal_s: \"\\\\\\<^sub>c s1 \\ s1' \\\n \\\\\\<^sub>c s1 \\\\<^sub>e s1' \\\n fst s1 = fst s1' \\ snd s1 = snd s1' \\ (\\ns1. snd s1 = Normal ns1)\"\nproof -\n assume a0: \"\\\\\\<^sub>c s1 \\ s1'\" and\n a1: \"\\\\\\<^sub>c s1 \\\\<^sub>e s1'\"\n then obtain ps1 ss1 ps1' ss1' where prod:\"s1 = (ps1,ss1) \\ s1' = (ps1', ss1')\"\n by fastforce\n then have \"ps1=ps1'\" using a1 etranE by fastforce\n thus ?thesis using prod a0 by (simp add: mod_env_not_component)\nqed\n\nlemma step_e_step_c_eq:\"\\ \n (\\,l) \\ clist;\n Suc m < length l;\n i < length clist; \n (fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m); \n (fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m);\n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\n \\ \\ \n l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\nproof -\n assume a0:\"(\\,l) \\ clist\" and\n a1:\"Suc m < length l\" and\n a2:\"i < length clist\" and\n a3:\"(fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m)\" and\n a4:\"(fst (clist!i))\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m)\" and\n a5:\"(\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\"\n obtain fp fs sp ss \n where prod_step: \" \n \\\\\\<^sub>c (fp, fs) \\ (sp,ss) \\ \n fp = fst (((snd (clist!i))!m)) \\ fs = snd (((snd (clist!i))!m)) \\ \n sp = fst ((snd (clist!i))!(Suc m)) \\ ss = snd((snd (clist!i))!(Suc m)) \\\n \\ = fst (clist!i)\"\n using a0 a2 a1 a4 unfolding conjoin_def same_functions_def by fastforce \n have snd_lj:\"(snd (l!m)) = snd ((snd (clist!i))!m)\"\n using a0 a1 a2 unfolding conjoin_def same_state_def\n by fastforce \n have fst_clist_\\:\"\\i\" \n using a0 unfolding conjoin_def same_functions_def by fastforce\n have all_env: \"\\l\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m))\"\n using a3 a5 a2 fst_clist_\\ by fastforce\n then have allP:\"\\l< length clist. fst ((snd (clist!l))!m) = fst ((snd (clist!l))!(Suc m))\"\n by (fastforce elim:etranE) \n then have \"fst (l!m) = (fst (l!(Suc m)))\"\n using a0 conjoin_same_program_i_j [of \"(\\,l)\"] a1 by fastforce\n also have snd_l_normal:\"snd (l!m) = snd (l!(Suc m)) \\ (\\ns. snd (l!m) = Normal ns )\"\n proof - \n have \"(snd (l!Suc m)) = snd ((snd (clist!i))!(Suc m))\"\n using a0 a1 a2 unfolding conjoin_def same_state_def\n by fastforce\n also have \"fs = ss \\ \n (\\ns. (snd ((snd (clist!i))!m) = Normal ns ))\"\n using a1 a2 all_env prod_step allP\n by (metis step_change_p_or_eq_s) \n ultimately show ?thesis using snd_lj prod_step a1 by fastforce\n qed \n ultimately show ?thesis using prod_eq_iff by blast \nqed\n\nlemma two': \n \"\\ \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l)\\par_assum (p, R) ;\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\"\nproof -\n assume a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a3: \"length xs=length clist\" and\n a4: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a5: \"(\\,l)\\par_assum (p, R)\" and\n a6: \"\\icp \\ (Com(xs!i)) s\" and\n a7: \"(\\,l) \\ clist\" and\n a8: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and \n a9: \"snd (last l) \\ Fault ` F\"\n{\n assume a10:\"\\i j ns ns'. \n i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n \\(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\"\n then obtain j where \n a10:\"\\i ns ns'. \n i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\\n \\(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i)\" by fastforce\n let ?P = \"\\j. \\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\ \n (\\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Rely(xs!i))\" \n obtain m where fist_occ:\"(?P m) \\ (\\i ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n then have \"?P m\" by fastforce\n then obtain i where\n fst_occ:\"i Suc m\n \\\\\\<^sub>c((snd (clist!i))!m) \\\\<^sub>e ((snd (clist!i))!Suc m) \\ \n (\\ (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\ Rely(xs!i))\"\n by fastforce\n have notP:\"(\\i ?P i)\" using fist_occ by blast \n have fst_clist_\\:\"\\i\" \n using a7 unfolding conjoin_def same_functions_def by fastforce\n have compat:\"(\\\\\\<^sub>p(l!m) \\ (l!(Suc m))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!m) \\ ((snd (clist!i))!(Suc m))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))) \\ \n (\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m)) \\ \n (\\i\\<^sub>c (snd (clist!i))!m \\\\<^sub>e ((snd (clist!i))!(Suc m))))\"\n using a7 fst_occ unfolding conjoin_def compat_label_def by simp\n {\n assume a20: \"(\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m)) \\ \n (\\i\\<^sub>c (snd (clist!i))!m \\\\<^sub>e ((snd (clist!i))!(Suc m))))\"\n then have \"(snd (l!m),snd (l!(Suc m))) \\ R\" \n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd(l!m), snd(l!(Suc m))) \\ Rely(xs!i)\"\n using fst_occ a3 a0 by fastforce\n then have \"(snd ((snd (clist!i))!m), snd ((snd (clist!i))!(Suc m)) ) \\ Rely(xs!i)\" \n using a7 fst_occ unfolding conjoin_def same_state_def by fastforce \n then have False using fst_occ by auto\n }note l = this\n {\n assume a20:\"(\\\\\\<^sub>p(l!m) \\ (l!(Suc m))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!m) \\ ((snd (clist!i))!(Suc m))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m))))\"\n then obtain i' \n where i':\"i' \n ((fst (clist!i'))\\\\<^sub>c ((snd (clist!i'))!m) \\ ((snd (clist!i'))!(Suc m))) \\ \n (\\li' \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!m \\\\<^sub>e ((snd (clist!l))!(Suc m)))\"\n by fastforce\n then have eq_\\:\"\\ = fst (clist!i')\" using a7 unfolding conjoin_def same_functions_def by fastforce\n obtain fp fs sp ss \n where prod_step: \" \n \\\\\\<^sub>c (fp, fs) \\ (sp,ss) \\ \n fp = fst (((snd (clist!i'))!m)) \\ fs = snd (((snd (clist!i'))!m)) \\ \n sp = fst ((snd (clist!i'))!(Suc m)) \\ ss = snd((snd (clist!i'))!(Suc m)) \\\n \\ = fst (clist!i') \"\n using a7 i' unfolding conjoin_def same_functions_def by fastforce \n then have False\n proof (cases \"i = i'\")\n case True \n then have \"l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\n using step_e_step_c_eq[OF a7] i' fst_occ eq_\\ by blast\n then have \"\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m))\" \n using step_pe.ParEnv by (metis prod.collapse) \n then have \"(snd (l ! m), snd (l ! Suc m)) \\ R \"\n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd (l ! m), snd (l ! Suc m)) \\ Rely (xs ! i)\"\n using a0 a3 fst_occ by fastforce\n then show ?thesis using fst_occ a7\n unfolding conjoin_def same_state_def \n by fastforce \n next\n case False note not_eq = this \n thus ?thesis \n proof (cases \"fp = sp\")\n case True \n then have \"fs = ss \\ (\\ns. fs=Normal ns)\" \n using prod_step prod_step\n using step_change_p_or_eq_s by blast \n \n then have \"\\\\\\<^sub>c (fp, fs) \\\\<^sub>e (sp, ss)\" using True step_e.Env \n by fastforce\n then have \"l!m = l!(Suc m) \\ (\\ns. snd (l!m) = Normal ns )\"\n using step_e_step_c_eq[OF a7] prod_step i' fst_occ prod.collapse by auto\n then have \"\\\\\\<^sub>p(l!m) \\\\<^sub>e (l!(Suc m))\" \n using step_pe.ParEnv by (metis prod.collapse) \n then have \"(snd (l ! m), snd (l ! Suc m)) \\ R \"\n using fst_occ a5 unfolding par_assum_def by fastforce\n then have \"(snd (l ! m), snd (l ! Suc m)) \\ Rely (xs ! i)\"\n using a0 a3 fst_occ by fastforce\n then show ?thesis using fst_occ a7\n unfolding conjoin_def same_state_def \n by fastforce \n next\n case False \n let ?l1 = \"take (Suc (Suc m)) (snd(clist!i'))\"\n have clist_cptn:\"(\\,snd(clist!i')) \\ cptn\" using a6 i' unfolding cp_def by fastforce\n have sucm_len:\"Suc m < length (snd (clist!i'))\" \n using i' fst_occ a7 unfolding conjoin_def same_length_def by fastforce \n then have summ_lentake:\"Suc m < length ?l1\" by fastforce\n have len_l: \"0[]\" \n using i' a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have \"snd (last (snd (clist ! i'))) = snd (last l)\"\n using a7 i' conjoin_last_same_state by fastforce\n then have last_i_notF:\"snd (last (snd(clist!i'))) \\ Fault ` F\" \n using a9 by auto \n have \"\\i Fault ` F \" \n using last_not_F[OF clist_cptn last_i_notF] by auto \n also have suc_m_i':\"Suc m < length (snd (clist !i'))\"\n using fst_occ i' a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have last_take_not_f:\"snd (last (take (Suc (Suc m)) (snd(clist!i')))) \\ Fault ` F\"\n by (simp add: take_Suc_conv_app_nth) \n have not_env_step:\"\\ \\\\\\<^sub>c snd (clist ! i') ! m \\\\<^sub>e snd (clist ! i') ! Suc m\"\n using False etran_ctran_eq_p_normal_s i' prod_step by blast \n then have \"snd ((snd(clist!i'))!0)\\ Normal ` p\" \n using len_l a7 i' a5 unfolding conjoin_def same_state_def par_assum_def by fastforce\n then have \"snd ((snd(clist!i'))!0)\\ Normal ` (Pre (xs ! i'))\"\n using a1 i' a3 by fastforce\n then have \"snd ((take (Suc (Suc m)) (snd(clist!i')))!0)\\ Normal `(Pre (xs ! i'))\" \n by fastforce \n moreover have \n \"\\j. Suc j < Suc (Suc m) \\\n \\\\\\<^sub>c snd (clist ! i') ! j \\\\<^sub>e snd (clist ! i') ! Suc j \\\n (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\ Rely (xs ! i')\" \n using not_env_step fst_occ Suc_less_eq fist_occ i' less_SucE less_trans_Suc by auto\n then have \"\\j. Suc j < length (take (Suc (Suc m)) (snd(clist!i'))) \\\n \\\\\\<^sub>c snd (clist ! i') ! j \\\\<^sub>e snd (clist ! i') ! Suc j \\\n (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\ Rely (xs ! i')\"\n by fastforce \n ultimately have \"(\\, (take (Suc (Suc m)) (snd(clist!i')))) \\ \n assum ((Pre (xs ! i')),Rely (xs ! i'))\"\n unfolding assum_def by fastforce \n moreover have \"(\\,snd(clist!i')) \\ cptn\" using a6 i' unfolding cp_def by fastforce\n then have \"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ cptn\"\n by (simp add: takecptn_is_cptn) \n then have \"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ cp \\ (Com(xs!i')) s\"\n using i' a3 a6 unfolding cp_def by fastforce \n ultimately have t:\"(\\,take (Suc (Suc m)) (snd(clist!i'))) \\ \n comm (Guar (xs ! i'), (Post (xs ! i'),Abr (xs ! i'))) F \"\n using a8 a2 a3 i' unfolding com_cvalidity_def com_validity_def by fastforce \n have \"(snd(take (Suc (Suc m)) (snd(clist!i'))!m), \n snd(take (Suc (Suc m)) (snd(clist!i'))!(Suc m))) \\ Guar (xs ! i')\"\n using eq_\\ i' comm_dest1[OF t last_take_not_f summ_lentake] by fastforce\n \n then have \"(snd( (snd(clist!i'))!m), \n snd((snd(clist!i'))!(Suc m))) \\ Guar (xs ! i')\"\n by fastforce\n then have \"(snd( (snd(clist!i))!m), \n snd((snd(clist!i))!(Suc m))) \\ Guar (xs ! i')\"\n using a7 fst_occ unfolding conjoin_def same_state_def by (metis Suc_lessD i' snd_conv) \n then have \"(snd( (snd(clist!i))!m), \n snd((snd(clist!i))!(Suc m))) \\ Rely (xs ! i)\"\n using not_eq a0 i' a3 fst_occ by auto \n then have \"False\" using fst_occ by auto\n then show ?thesis by auto\n qed\n qed\n } \n then have False using compat l by auto\n} thus ?thesis by auto\nqed\n\nlemma two: \n \"\\ \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l)\\par_assum (p, R);\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i) \"\nproof -\n assume a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a3: \"length xs=length clist\" and\n a4: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a5: \"(\\,l)\\par_assum (p, R)\" and\n a6: \"\\icp \\ (Com(xs!i)) s\" and\n a7: \"(\\,l) \\ clist\" and\n a8: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and \n a9: \"snd (last l) \\ Fault ` F\"\n {\n assume a10:\"(\\i j. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)) \"\n then obtain j where a10: \"\\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)\"\n by fastforce\n let ?P = \"\\j. \\i. i Suc j\n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n \\ (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ Guar(xs!i)\" \n obtain m where fist_occ:\"?P m \\ (\\i ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n then have P:\"?P m\" by fastforce\n then have notP:\"(\\i ?P i)\" using fist_occ by blast\n obtain i ns ns' where fst_occ:\"i Suc m \n \\\\\\<^sub>c((snd (clist!i))!m) \\ ((snd (clist!i))!Suc m) \\ \n (\\ (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\ Guar(xs!i))\"\n using P by fastforce\n have fst_clist_i: \"fst (clist!i) = \\\" \n using a7 fst_occ unfolding conjoin_def same_functions_def \n by fastforce\n have \"clist!i\\cp \\ (Com(xs!i)) s\" using a6 fst_occ by fastforce\n then have clistcp:\"(\\, snd (clist!i))\\cp \\ (Com(xs!i)) s\" \n using fst_occ a7 unfolding conjoin_def same_functions_def by fastforce\n let ?li=\"take (Suc (Suc m)) (snd (clist!i))\" \n have \"\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\"\n using a8 a2 a3 fst_occ unfolding com_cvalidity_def by fastforce\n moreover have take_in_ass:\"(\\, take (Suc (Suc m)) (snd (clist!i))) \\ assum (Pre(xs!i), Rely(xs!i))\" \n proof -\n have length_take_length_l:\"length (take (Suc (Suc m)) (snd (clist!i))) \\ length l\"\n using a7 fst_occ unfolding conjoin_def same_length_def by auto\n have \"snd((?li!0)) \\ Normal ` Pre(xs!i)\" \n proof -\n have \"(take (Suc (Suc m)) (snd (clist!i)))!0 = (snd (clist!i))!0\" by fastforce\n moreover have \"snd (snd(clist!i)!0) = snd (l!0)\" \n using a7 fst_occ unfolding conjoin_def same_state_def by fastforce\n moreover have \"snd (l!0) \\ Normal ` p\" \n using a5 unfolding par_assum_def by fastforce\n ultimately show ?thesis using a1 a3 fst_occ by fastforce \n qed note left=this\n thus ?thesis \n using two'[OF a0 a1 a2 a3 a4 a5 a6 a7 a8 a9] fst_occ unfolding assum_def by fastforce\n qed \n moreover have \"(\\,take (Suc (Suc m)) (snd (clist!i))) \\ cp \\ (Com(xs!i)) s\"\n using takecptn_is_cptn clistcp unfolding cp_def by fastforce \n ultimately have comm:\"(\\, take (Suc (Suc m)) (snd (clist!i)))\\comm(Guar(xs!i),(Post (xs ! i),Abr (xs ! i))) F\" \n unfolding com_validity_def by fastforce \n also have not_fault:\"snd (last (take (Suc (Suc m)) (snd (clist!i)))) \\ Fault ` F\"\n proof - \n have cptn:\"(\\, snd (clist!i)) \\ cptn\" \n using fst_clist_i a6 fst_occ unfolding cp_def by fastforce \n then have \"(snd (clist!i))\\[]\" \n using cptn.simps list.simps(3) \n by fastforce \n then have \"snd (last (snd (clist!i))) = snd (last l)\"\n using conjoin_last_same_state fst_occ a7 by fastforce\n then have \"snd (last (snd (clist!i))) \\ Fault ` F\" using a9\n by simp\n also have sucm:\"Suc m < length (snd (clist!i))\" \n using fst_occ a7 unfolding conjoin_def same_length_def by fastforce\n ultimately have sucm_not_fault:\"snd ((snd (clist!i))!(Suc m)) \\ Fault ` F\"\n using last_not_F cptn by blast \n have \"length (take (Suc (Suc m)) (snd (clist!i))) = Suc (Suc m)\" \n using sucm by fastforce\n then have \"last (take (Suc (Suc m)) (snd (clist!i))) = (take (Suc (Suc m)) (snd (clist!i)))!(Suc m)\"\n by (metis Suc_diff_1 Suc_inject last_conv_nth list.size(3) old.nat.distinct(2) zero_less_Suc)\n moreover have \"(take (Suc (Suc m)) (snd (clist!i)))!(Suc m) = (snd (clist!i))!(Suc m)\" \n by fastforce \n ultimately show ?thesis using sucm_not_fault by fastforce\n qed\n then have \" (Suc m < length (snd (clist ! i)) ) \\\n (\\\\\\<^sub>c (snd (clist ! i)) ! m \\ (snd (clist ! i)) ! Suc m) \\ \n (snd ((snd (clist ! i)) ! m), snd ((snd (clist ! i)) ! Suc m)) \\ Guar(xs!i)\"\n using comm_dest [OF comm not_fault] by auto \n then have \"False\" using fst_occ using a7 unfolding conjoin_def same_length_def by fastforce\n } thus ?thesis by fastforce\nqed\n\nlemma par_cptn_env_comp:\n \"(\\,l) \\ par_cptn \\ Suc i \n \\\\\\<^sub>p l!i \\\\<^sub>e (l!(Suc i)) \\ \\ \\\\<^sub>p l!i \\ (l!(Suc i))\"\nproof -\n assume a0:\"(\\,l) \\ par_cptn \\ Suc i l!(Suc i) = (c2,s2)\" by fastforce\n obtain xs ys where l:\"l= xs@((l!i)#(l!(Suc i))#ys)\" using a0\n by (metis Cons_nth_drop_Suc Suc_less_SucD id_take_nth_drop less_SucI)\n moreover then have \"(drop (length xs) l) = ((l!i)#(l!(Suc i))#ys)\"\n by (metis append_eq_conv_conj) \n moreover then have \"length xs < length l\" using leI by fastforce \n ultimately have \"(\\,((l!i)#(l!(Suc i))#ys))\\par_cptn\" \n using a0 droppar_cptn_is_par_cptn by fastforce\n also then have \"(\\,(l!(Suc i))#ys)\\par_cptn\" using par_cptn_dest li by fastforce\n ultimately show ?thesis using li par_cptn_elim_cases(2)\n by metis\nqed\n\n\nlemma three:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n length xs=length clist; (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R);\n \\icp \\ (Com(xs!i)) s; (\\,l) \\ clist; (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ \\j i. i Suc j \\\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j) \\\n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n (R \\ (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j))))\"\nproof -\n assume a0:\"xs\\[]\" and\n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2: \"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a4: \"length xs=length clist\" and\n a5: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a6: \"(\\,l) \\ par_assum(p, R)\" and\n a7: \"\\icp \\ (Com(xs!i)) s\" and\n a8: \"(\\,l) \\ clist\" and\n a9: \"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and\n 10: \"snd (last l) \\ Fault ` F\" \n {\n fix j i ns ns'\n assume a00:\"i Suc j\\\\<^sub>c((snd (clist!i))!j) \\\\<^sub>e ((snd (clist!i))!Suc j)\" \n then have two:\"\\j i ns ns'. i Suc j \n \\\\\\<^sub>c((snd (clist!i))!j) \\ ((snd (clist!i))!Suc j) \\ \n (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ (Guar(xs!i))\"\n using two[OF a1 a2 a3 a4 a5 a6 a7 a8 a9 10] by auto\n then have j_lenl:\"Suc j i:\"\\i\" using a8 unfolding conjoin_def same_functions_def by fastforce\n have \"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ (fst (clist!l))\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))) \\ \n (\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\"\n using a8 a00 unfolding conjoin_def compat_label_def by simp\n then have compat_label:\"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))) \\ \n (\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\"\n using fst_clist_\\ by blast\n then have \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n (R \\ (\\j\\{j. j < length xs \\ j \\ i}. Guar (xs ! j)))\" \n proof \n assume a10:\"(\\\\\\<^sub>p(l!j) \\ (l!(Suc j))) \\ \n (\\i\\\\<^sub>c ((snd (clist!i))!j) \\ ((snd (clist!i))!(Suc j))) \\ \n (\\li \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j))))\" \n then obtain i' where \n a20:\"i' \n (\\\\\\<^sub>c ((snd (clist!i'))!j) \\ ((snd (clist!i'))!(Suc j))) \\ \n (\\li' \\ \\\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))\" by blast \n thus ?thesis \n proof (cases \"i'=i\")\n case True note eq_i = this \n then obtain P S1 S2 where P:\"(snd (clist!i'))!j=(P,S1) \\ ((snd (clist!i'))!(Suc j)) = (P,S2)\" \n using a11 by (fastforce elim:etranE) \n thus ?thesis \n proof (cases \"S1 = S2\")\n case True \n have snd_lj:\"(snd (l!j)) = snd ((snd (clist!i'))!j)\"\n using a8 a20 a00 unfolding conjoin_def same_state_def\n by fastforce \n have all_e:\"(\\l\\\\<^sub>c (snd (clist!l))!j \\\\<^sub>e ((snd (clist!l))!(Suc j)))\"\n using a11 a20 eq_i by fastforce\n then have allP:\"\\l< length clist. fst ((snd (clist!l))!j) = fst ((snd (clist!l))!(Suc j))\"\n by (fastforce elim:etranE)\n then have \"fst (l!j) = (fst (l!(Suc j)))\"\n using a8 conjoin_same_program_i_j [of \"(\\,l)\"] a00 by fastforce\n also have \"snd (l!j) = snd (l!(Suc j))\"\n proof - \n have \"(snd (l!Suc j)) = snd ((snd (clist!i'))!(Suc j))\"\n using a8 a20 a00 unfolding conjoin_def same_state_def\n by fastforce\n then show ?thesis using snd_lj P True by auto\n qed \n ultimately have \"l!j = l!(Suc j)\" by (simp add: prod_eq_iff) \n moreover have ns1:\"\\ns1. S1=Normal ns1\" \n using P a20 step_change_p_or_eq_s by fastforce \n ultimately have \"\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j))\" \n using P step_pe.ParEnv snd_lj by (metis prod.collapse snd_conv) \n then have \"(snd (l ! j), snd (l ! Suc j)) \\ R \"\n using a00 a6 unfolding par_assum_def by fastforce\n then show ?thesis using a8 a00 \n unfolding conjoin_def same_state_def \n by fastforce\n next\n case False thus ?thesis \n using a20 P a11 step_change_p_or_eq_s by fastforce\n qed\n next\n case False \n have i'_clist:\"i' < length clist\" using a20 by fastforce\n then have clist_i'_Guardxs:\"(snd((snd (clist!i'))!j), snd((snd (clist!i'))!Suc j)) \\ Guar(xs!i')\"\n using two a00 False a8 unfolding conjoin_def same_state_def\n by (metis a20)\n have \"snd((snd (clist!i))!j) = snd (l!j) \\ snd((snd (clist!i))!Suc j) = snd (l!Suc j)\" \n using a00 a20 a8 unfolding conjoin_def same_state_def by fastforce\n also have \"snd((snd (clist!i'))!j) = snd (l!j) \\ snd((snd (clist!i'))!Suc j) = snd (l!Suc j)\"\n using j_lenl a20 a8 unfolding conjoin_def same_state_def by fastforce\n ultimately have \"snd((snd (clist!i))!j) = snd((snd (clist!i'))!j) \\ \n snd((snd (clist!i))!Suc j) = snd((snd (clist!i'))!Suc j)\" \n by fastforce\n then have clist_i_Guardxs:\n \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\ \n Guar(xs!i')\" \n using clist_i'_Guardxs by fastforce \n thus ?thesis \n using False a20 a4 by fastforce \n qed\n next\n assume a10:\"(\\\\\\<^sub>p(l!j) \\\\<^sub>e (l!(Suc j)) \\ \n (\\i\\\\<^sub>c (snd (clist!i))!j \\\\<^sub>e ((snd (clist!i))!(Suc j))))\" \n then have \"(snd (l ! j), snd (l ! Suc j)) \\ R\"\n using a00 a10 a6 unfolding par_assum_def by fastforce\n then show ?thesis using a8 a00 \n unfolding conjoin_def same_state_def\n by fastforce\n qed\n } thus ?thesis by blast\nqed\n\ndefinition tran_True where \"tran_True \\ True\"\n\ndefinition after where \"after \\ True\"\n\nlemma four:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n (\\j (G);\n p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R); Suc i < length l;\n \\\\\\<^sub>p (l!i) \\ (l!(Suc i));\n (\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]);\n snd (last l) \\ Fault ` F\\\n \\ (snd (l ! i), snd (l ! Suc i)) \\ G\"\nproof -\n assume a0:\"xs\\[]\" and\n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2:\"(\\j (G)\" and\n a3:\"p \\ (\\ii,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\" and\n a5:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a6:\"(\\,l) \\ par_assum(p, R)\" and\n a7: \"Suc i < length l\" and\n a8:\"\\\\\\<^sub>p (l!i) \\ (l!(Suc i))\" and \n a10:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\" and\n a11:\"snd (last l) \\ Fault ` F\"\n have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def by fastforce \n then have \"(ParallelCom xs)\\[]\" using a0 by fastforce \n then have \"(\\,l) \\{(\\1,c). \\clist. (length clist)=(length (ParallelCom xs)) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,c) \\ clist \\ \\1=\\}\"\n using one a5 by fastforce\n then obtain clist where \"(length clist)=(length xs) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,l) \\ clist\"\n using length_par_xs by auto\n then have conjoin:\"(length clist)=(length xs) \\ \n (\\i cp \\ (Com (xs ! i)) s) \\ (\\,l) \\ clist\"\n using ParallelCom_Com by fastforce\n then have length_xs_clist:\"length xs = length clist\" by auto \n have clist_cp:\"\\i cp \\ (Com (xs ! i)) s\" using conjoin by auto\n have conjoin:\"(\\,l) \\ clist\" using conjoin by auto \n have l_not_empty:\"l\\[]\" using a5 par_cptn.simps unfolding par_cp_def by fastforce\n then have l_g0:\"0i< length l. fst (l!i) = map (\\x. fst ((snd x)!i)) clist\"\n using conjoin unfolding conjoin_def same_program_def by fastforce\n obtain Ps si Ps' ssi where li:\"l!i = (Ps,si) \\ l!(Suc i) = (Ps', ssi)\" by fastforce\n then have \"\\j r. j Ps' = Ps[j:=r] \\ (\\\\\\<^sub>c((Ps!j),si) \\ (r, ssi))\" \n using a8 par_ctranE by fastforce\n then obtain j r where step_c:\"j Ps' = Ps[j:=r] \\ (\\\\\\<^sub>c((Ps!j),si) \\ (r, ssi))\"\n by auto \n have length_Ps_clist:\n \"length Ps = length clist \\ length Ps = length Ps'\" \n using conjoin a7 conjoin_same_length li step_c by fastforce\n have from_step:\"(snd (clist!j))!i = ((Ps!j),si) \\ (snd (clist!j))!(Suc i) = (Ps'!j,ssi)\" \n proof - \n have f2: \"Ps = fst (snd (\\, l) ! i)\" and f2':\"Ps' = fst (snd (\\, l) ! (Suc i))\"\n using li by auto\n have f3:\"si = snd (snd (\\, l) ! i) \\ ssi = snd (snd (\\, l) ! (Suc i))\"\n by (simp add: li)\n then have \"(snd (clist!j))!i = ((Ps!j),si)\"\n using f2 conjoin a7 step_c unfolding conjoin_def same_program_def same_state_def by force \n moreover have \"(snd (clist!j))!(Suc i) = (Ps'!j,ssi)\"\n using f2' f3 conjoin a7 step_c length_Ps_clist \n unfolding conjoin_def same_program_def same_state_def \n by auto\n ultimately show ?thesis by auto\n qed \n then have step_clist:\"\\\\\\<^sub>c(snd (clist!j))!i \\ (snd (clist!j))!(Suc i)\" \n using from_step step_c by fastforce\n have j_xs:\"ji j ns ns'. j < length clist \\ Suc i < length l \\\n \\\\\\<^sub>c snd (clist ! j) ! i \\ snd (clist ! j) ! Suc i \\ \n (snd (snd (clist ! j) ! i), snd (snd (clist ! j) ! Suc i)) \\ Guar (xs ! j)\"\n using two[OF a1 a3 a4 length_xs_clist a5 a6 clist_cp conjoin a10 a11] by auto\n ultimately have \"(snd (snd (clist ! j) ! i), snd (snd (clist ! j) ! Suc i)) \\ Guar (xs ! j)\"\n using a7 step_c length_Ps_clist step_clist by metis \n then have \"(snd (l!i), snd (l!(Suc i)))\\ Guar (xs ! j)\"\n using from_step a2 length_xs_clist step_c li by fastforce\n then show ?thesis using a2 j_xs\n unfolding sep_conj_def tran_True_def after_def Satis_def by fastforce\nqed\n\nlemma same_program_last:\"l\\[] \\ (\\,l) \\ clist \\ ifst (last (snd (clist!i))) = fst (last l) ! i\" \nproof -\n assume l_not_empty:\"l\\[]\" and\n conjoin: \"(\\,l) \\ clist\" and\n i_clist: \"iix. fst (snd x ! ((length l)-1))) clist\"\n using l_not_empty last_l conjoin unfolding conjoin_def same_program_def by auto\n also have \"(map (\\x. fst (snd x ! ((length l)-1))) clist)!i = \n fst ((snd (clist!i))! ((length l)-1))\" using i_clist by fastforce\n also have \"fst ((snd (clist!i))! ((length l)-1)) = \n fst ((snd (clist!i))! ((length (snd (clist!i)))-1))\" \n using conjoin i_clist unfolding conjoin_def same_length_def by fastforce\n also then have \"fst ((snd (clist!i))! ((length (snd (clist!i)))-1)) = fst (last (snd (clist!i)))\"\n using i_clist l_not_empty conjoin last_clist_eq_l last_conv_nth unfolding conjoin_def same_length_def\n by presburger\n finally show ?thesis by auto\nqed\n\n\n\nlemma five:\n \"\\xs\\[]; \\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i));\n p \\ (\\ii q;\n (\\i a ;\n \\i < length xs.\n \\,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)];\n (\\,l) \\ par_cp \\ (ParallelCom xs) s; (\\,l) \\ par_assum(p, R);\n All_End (last l); snd (last l) \\ Fault ` F;(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\ \\ \n (\\j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\"\nproof-\n assume a0:\"xs\\[]\" and \n a1:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a2:\"p \\ (\\ii q\" and\n a4:\"(\\i a\" and\n a5:\"\\i < length xs.\n \\,\\ \\\\<^bsub>/F\\<^esub> Com (xs ! i) sat [Pre (xs!i), \n Rely (xs ! i), Guar (xs ! i), \n Post (xs ! i),Abr (xs ! i)]\" and\n a6:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" and\n a7:\"(\\,l) \\ par_assum(p, R)\"and\n a8:\"All_End (last l)\" and\n a9:\"snd (last l) \\ Fault ` F\" and\n a10:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\"\n have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def by fastforce \n then have \"(ParallelCom xs)\\[]\" using a0 by fastforce\n then have \"(\\,l) \\{(\\1,c). \\clist. (length clist)=(length (ParallelCom xs)) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,c) \\ clist \\ \\1=\\}\"\n using one a6 by fastforce\n then obtain clist where \"(length clist)=(length xs) \\ \n (\\i cp \\ ((ParallelCom xs)!i) s) \\ (\\,l) \\ clist\"\n using length_par_xs by auto\n then have conjoin:\"(length clist)=(length xs) \\ \n (\\i cp \\ (Com (xs ! i)) s) \\ (\\,l) \\ clist\"\n using ParallelCom_Com by fastforce\n then have length_xs_clist:\"length xs = length clist\" by auto\n (*have length_l_clist: \"length l = length clist\" \n using conjoin unfolding conjoin_def same_length_def *)\n have clist_cp:\"\\i cp \\ (Com (xs ! i)) s\" using conjoin by auto\n have conjoin:\"(\\,l) \\ clist\" using conjoin by auto\n have l_not_empty:\"l\\[]\" using a6 par_cptn.simps unfolding par_cp_def by fastforce\n then have l_g0:\"0i assum (Pre (xs!i),Rely (xs!i))\" \n proof -\n { fix i\n assume i_length:\"i1 li where clist:\"clist!i=(\\1,li)\" by fastforce \n then have \\eq:\"\\1=\\\" \n using conjoin i_length unfolding conjoin_def same_functions_def by fastforce\n have \"(\\1,li) \\ assum (Pre (xs!i),Rely (xs!i))\"\n proof-\n have l:\"snd (li!0) \\ Normal ` ( (Pre (xs!i)))\"\n proof - \n have snd_l:\"snd (\\,l) = l\" by fastforce \n have \"snd (l!0) \\ Normal ` (p)\" \n using a7 unfolding par_assum_def by fastforce \n also have \"snd (l!0) = snd (li!0)\" \n using i_length conjoin l_g0 clist \n unfolding conjoin_def same_state_def by fastforce\n finally show ?thesis using a2 i_length length_xs_clist\n by auto \n qed \n have r:\"(\\j. Suc j < length li \\ \n \\\\\\<^sub>c(li!j) \\\\<^sub>e (li!(Suc j)) \\ \n (snd(li!j), snd(li!(Suc j))) \\ Rely (xs!i))\" \n using three[OF a0 a1 a2 a5 length_xs_clist a6 a7 clist_cp conjoin a10 a9] \n i_length conjoin a1 length_xs_clist clist \n unfolding assum_def conjoin_def same_length_def by fastforce \n show ?thesis using l r \\eq unfolding assum_def by fastforce\n qed \n then have \"clist!i \\ assum (Pre (xs!i),Rely (xs!i))\" using clist by auto \n } thus ?thesis by auto\n qed\n then have clist_com:\"\\i comm (Guar (xs!i),(Post(xs!i),Abr (xs!i))) F\"\n using a5 unfolding com_cvalidity_def \n using a10 unfolding com_validity_def using clist_cp length_xs_clist\n by force \n have last_clist_eq_l:\"\\iiiij snd (last l) \\ Normal ` q)\"\n proof -\n {fix j\n assume aj:\"ji Normal ` Post(xs!i)\"\n proof-\n {fix i \n assume a20:\"i Fault ` F\"\n using a9 last_clist_l a20 by fastforce\n have \"fst (last l) ! i = Skip\" \n using a20 ac1 conjoin_same_length[OF conjoin]\n by (simp add: l_not_empty last_l ) \n also have \"fst (last l) ! i=fst (last (snd (clist!i)))\"\n using same_program_last[OF l_not_empty conjoin a20] by auto\n finally have \"fst (last (snd (clist!i))) = Skip\" .\n then have \"snd (last (snd (clist!i))) \\ Normal ` Post(xs!i)\" \n using clist_com last_clist_not_F a20\n unfolding comm_def final_def by fastforce\n } thus ?thesis by auto \n qed \n then have \"\\i Normal ` Post(xs!i)\" \n using last_clist_l length_xs_clist by fastforce\n then have \"\\ix\\( Post(xs!i)). snd (last l) = Normal x\"\n by fastforce\n moreover have \"\\t. (\\i Post (xs ! i))\\ t\\ q\" using a3\n by fastforce \n ultimately have \"(\\x\\ q. snd (last l) = Normal x)\" using a0\n by (metis (mono_tags, lifting) length_greater_0_conv xstate.inject(1)) \n then have \"snd (last l) \\ Normal ` q\" by fastforce \n then have \"fst (last l) ! j = LanguageCon.com.Skip \\ snd (last l) \\ Normal ` q\"\n using aj ac1 by fastforce\n } thus ?thesis by auto\n qed \n thus ?thesis by auto\n next\n assume \"\\ (\\i fst (last l)!i \\ Skip\" \n by fastforce\n then have last_i_throw:\"fst (last l)!i = Throw \\ (\\n. snd (last l) = Normal n)\" \n using a8 unfolding All_End_def final_def by fastforce \n have \"length (fst (last l)) = length clist\" \n using conjoin_same_length[OF conjoin] l_not_empty last_l\n by simp\n then have i_length:\"i Fault ` F\"\n using a9 last_clist_l i_length by fastforce\n then have \"fst (last (snd (clist!i))) = fst (last l) ! i\" \n using i_length same_program_last [OF l_not_empty conjoin] by fastforce\n then have \"fst (last (snd (clist!i))) = Throw\"\n using last_i_throw by fastforce\n then have \"snd (last (snd (clist!i))) \\ Normal ` Abr(xs!i)\" \n using clist_com last_clist_not_F i_length last_i_throw snd_last\n unfolding comm_def final_def by fastforce\n then have \"snd (last l)\\ Normal ` Abr(xs!i)\" using last_clist_l i_length\n by fastforce\n then have \"snd (last l)\\ Normal ` (a)\" using a4 a0 i_length length_xs_clist by fastforce\n then have \"\\j snd (last l) \\ Normal ` a\"\n using last_i_throw a20 by fastforce\n thus ?thesis by auto\n qed \nqed\n\n\nlemma ParallelEmpty [rule_format]:\n \"\\i s. (\\,l) \\ par_cp \\ (ParallelCom []) s \\\n Suc i < length l \\ \\ (\\ \\\\<^sub>p (l!i) \\ (l!Suc i))\"\napply(induct_tac l)\n apply simp\napply clarify\napply(case_tac list,simp,simp)\napply(case_tac i)\n apply(simp add:par_cp_def ParallelCom_def) \n apply(erule par_ctranE,simp)\napply(simp add:par_cp_def ParallelCom_def)\napply clarify\napply(erule par_cptn.cases,simp)\n apply simp\nby (metis list.inject list.size(3) not_less0 step_p_pair_elim_cases)\n\nlemma ParallelEmpty2:\n assumes a0:\"(\\,l) \\ par_cp \\ (ParallelCom []) s\" and\n a1: \"i < length l\" \n shows \"fst (l!i) = []\"\nproof -\n have paremp:\"ParallelCom [] = []\" unfolding ParallelCom_def by auto\n then have l0:\"l!0 =([],s)\" using a0 unfolding par_cp_def by auto\n then have \"(\\,l) \\ par_cptn\" using a0 unfolding par_cp_def by fastforce\n thus ?thesis using l0 a1\n proof (induct arbitrary: i s) \n case ParCptnOne thus ?case by auto\n next\n case (ParCptnEnv \\ P s1 t xs i s)\n thus ?case\n proof -\n have f1: \"i < Suc (Suc (length xs))\"\n using ParCptnEnv.prems(2) by auto\n have \"(P, s1) = ([], s)\"\n using ParCptnEnv.prems(1) by auto\n then show ?thesis\n using f1 by (metis (no_types) ParCptnEnv.hyps(3) diff_Suc_1 fst_conv length_Cons less_Suc_eq_0_disj nth_Cons')\n qed \n next\n case (ParCptnComp \\ P s1 Q t xs) \n have \"(\\, (P,s1)#(Q, t) # xs) \\ par_cp \\ (ParallelCom []) s1\" \n using ParCptnComp(4) ParCptnComp(1) step_p_elim_cases by fastforce\n then have \"\\ \\\\\\<^sub>p (P, s1) \\ (Q, t)\" using ParallelEmpty ParCptnComp by fastforce\n thus ?case using ParCptnComp by auto\n qed\nqed \n\nlemma parallel_sound: \n \"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i)) \\\n (\\j G \\\n p \\ (\\i\n (\\i q \\\n (\\i a \\ \n \\i,\\ \\\\<^bsub>/F\\<^esub> Com (xs !i) sat [Pre (xs !i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> ParallelCom xs SAT [p, R, G, q,a]\n \"\nproof -\n assume \n a0:\"\\i (\\j\\{j. j < length xs \\ j \\ i}. (Guar (xs ! j)))\n \\ (Rely (xs ! i))\" and\n a1:\"(\\j G\" and\n a2:\"p \\ (\\ii q\" and\n a4:\"(\\i a\" and\n a5:\"\\i,\\ \\\\<^bsub>/F\\<^esub> Com (xs !i) sat [Pre (xs !i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i),Abr (xs ! i)]\"\n { \n assume a00:\"(\\(c,p,R,G,q,a)\\ \\. \\ \\\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a])\"\n { fix s l\n assume a10: \"(\\,l) \\ par_cp \\ (ParallelCom xs) s \\ (\\,l) \\ par_assum(p, R)\" \n then have c_par_cp:\"(\\,l) \\ par_cp \\ (ParallelCom xs) s\" by auto\n have c_par_assum: \"(\\,l) \\ par_assum(p, R)\" using a10 by auto\n { fix i ns ns'\n assume a20:\"snd (last l) \\ Fault ` F\"\n {\n assume a30:\"Suc i\\\\<^sub>p(l!i) \\ (l!(Suc i))\" \n have xs_not_empty:\"xs\\[]\" \n proof -\n {\n assume \"xs = []\"\n then have \"\\ (\\ \\\\<^sub>p (l!i) \\ (l!Suc i))\" \n using a30 a10 ParallelEmpty by fastforce\n then have False using a31 by auto\n } thus ?thesis by auto\n qed \n then have \"(snd(l!i), snd(l!(Suc i))) \\ G\"\n using four[OF xs_not_empty a0 a1 a2 a5 c_par_cp c_par_assum a30 a31 a00 a20] by blast\n \n } then have \"Suc i \n \\\\\\<^sub>p(l!i) \\ (l!(Suc i)) \\ \n (snd(l!i), snd(l!(Suc i))) \\ G \" by auto \n note l = this\n { assume a30:\"All_End (last l)\"\n then have xs_not_empty:\"xs\\[]\" \n proof - \n { assume xs_emp:\"xs=[]\"\n have lenl:\"0j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\"\n using five[OF xs_not_empty a0 a2 a3 a4 a5 c_par_cp c_par_assum a30 a20 a00] by blast\n } then have \"All_End (last l) \\ \n (\\j \n snd (last l) \\ Normal ` (a)) \\\n (\\j\n snd (last l) \\ Normal ` q)\" by auto \n note res1 = conjI[OF l this] \n }\n then have \"(\\,l) \\ par_comm(G, (q,a)) F\" unfolding par_comm_def by auto \n } \n then have \"\\ \\\\<^bsub>/F\\<^esub> (ParallelCom xs) SAT [p, R, G, q,a]\" \n unfolding par_com_validity_def par_cp_def by fastforce\n } thus ?thesis using par_com_cvalidity_def by fastforce\nqed\n\n\ntheorem \n par_rgsound:\"\\,\\ \\\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a] \\\n \\,\\ \\\\<^bsub>/F\\<^esub> (ParallelCom Ps) SAT [p, R, G, q,a]\"\nproof (induction rule:par_rghoare.induct)\n case (Parallel xs R G p q a \\ \\ F)\n thus ?case using localRG_sound com_cnvalid_to_cvalid parallel_sound[of xs R G p q a \\ \\ F] \n by fast\nqed\nlemma Conseq':\"\\s. s\\p \\\n (\\p' q' a' R' G'. \n (\\Z. \\,\\\\\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)]) \\\n (\\ Z. s\\p' Z \\ (q' Z \\ q) \\ (a' Z \\ a) \\ (G' Z \\ G) \\ (R \\ R' Z)))\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n apply (rule Conseq)\n by (meson order_refl)\n\nlemma conseq:\"\\\\Z. \\,\\'\\\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)]; \\' \\ \\ ;\n \\s. s \\ p \\ (\\ Z. s\\p' Z \\ (q' Z \\ q) \\ (a' Z \\ a) \\ (G' Z \\ G) \\ (R \\ R' Z))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule Conseq) (meson order_refl)\n\nlemma conseqPrePost[trans]:\n \"\\,\\'\\\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'] \\ \\' \\ \\ \\\n p\\p' \\ q' \\ q \\ a' \\ a \\ G' \\ G \\ R \\ R' \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\" \nby (rule conseq) auto\n\nlemma conseqPre[trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p', R, G, q,a] \\\n p\\p' \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule conseq) auto\n\nlemma conseqPost[trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \\\n q'\\q \\ a'\\a \\\n \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n by (rule conseq) auto\n \nlemma shows x:\"\\(sa'::nat set). (\\x. (x\\ sa) = ((to_nat x) \\ sa'))\"\n by (metis (mono_tags, hide_lams) from_nat_to_nat imageE image_eqI)\n\n\nlemma not_empty_set_countable: \n assumes a0:\"sa\\({}::('a::countable) set)\" \n shows \"{i. ((\\i. i\\ sa) o from_nat) i}\\{}\"\n by (metis (full_types) Collect_empty_eq_bot assms comp_apply empty_def equals0I from_nat_to_nat)\n\nlemma eq_set_countable:\"(\\i\\{i. ((\\i. i\\ sa) o from_nat) i}. (q o from_nat) i) = ((\\i\\sa. q i))\" \n apply auto\n by (metis (no_types) from_nat_to_nat)\n \nlemma conj_inter_countable[trans]: \n assumes a0:\"sa\\({}::('a::countable) set)\" and\n a1:\"\\i\\sa. \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a]\"\n shows\"\\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G,(\\i\\sa. q i),a]\" \nproof-\n have \"\\i\\{i. ((\\i. i\\ sa) o from_nat) i}. \\,\\\\\\<^bsub>/F\\<^esub> P sat [p, R, G,(q o from_nat) i,a]\" \n using a1 by auto\n then have \"\\,\\ \\\\<^bsub>/F\\<^esub> P sat [p, R, G,\\i\\{i. ((\\i. i\\ sa) o from_nat) i}. (q o from_nat) i,a]\"\n using Conj_Inter[OF not_empty_set_countable[OF a0]] by auto \n thus ?thesis using eq_set_countable\n by metis \nqed\n \nlemma all_Post[trans]:\n assumes a0:\"\\p_n::('a::countable). \\,\\\\\\<^bsub>/F\\<^esub> C sat [P, R, G, Q p_n, Qa]\" \n shows\"\\,\\\\\\<^bsub>/F\\<^esub> C sat [P, R, G,{s. \\p_n. s\\Q p_n},Qa]\" \nproof- \n have \"\\,\\\\\\<^bsub>/F\\<^esub> C sat [P, R, G,(\\p_n. Q p_n),Qa]\"\n using a0 conj_inter_countable[of UNIV] by auto \n moreover have s1:\"\\P. {s. \\p_n. s\\P p_n} = (\\p_n. P p_n)\"\n by auto \n ultimately show ?thesis\n by (simp add: s1)\nqed \n \nlemma all_Pre[trans]:\n assumes a0:\"\\p_n. \\,\\\\\\<^bsub>/F\\<^esub> C sat [P p_n, R, G, Q, Qa]\" \n shows\"\\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,Q,Qa]\"\nproof-\n {fix p_n \n have \"\\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,Q,Qa]\" \n proof-\n have \"{v. \\n. v \\ P n} \\ P p_n\" by force\n then show ?thesis by (meson a0 LocalRG_HoareDef.conseqPrePost subset_eq)\n qed\n } thus ?thesis by auto \nqed\n \nlemma Pre_Post_all:\n assumes a0:\"\\p_n::('a::countable). \\,\\\\\\<^bsub>/F\\<^esub> C sat [P p_n, R, G, Q p_n, Qa]\" \n shows\"\\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,{s. \\p_n. s\\Q p_n},Qa]\" \nproof-\n {fix p_n\n \n have \"\\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,Q p_n,Qa]\" \n proof-\n have \"{v. \\n. v \\ P n} \\ P p_n\" by force\n then show ?thesis by (meson a0 LocalRG_HoareDef.conseqPrePost subset_eq)\n qed\n }\n then have f3:\"\\p_n. \\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,Q p_n,Qa]\"\n by auto\n then have \"\\p_n. \\,\\\\\\<^bsub>/F\\<^esub> C sat [{s. \\p_n. s\\P p_n}, R, G,{s. \\p_n. s\\Q p_n},Qa]\" \n using all_Post by auto\n moreover have s1:\"\\P. {s. \\p_n. s\\P p_n} = (\\p_n. P p_n)\"\n by auto \n ultimately show ?thesis\n by (simp add: s1)\nqed \n \n \ninductive_cases hoare_elim_skip_cases [cases set]:\n\"\\,\\\\\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\n\n\n(* abbreviation \n \"stepc_rtrancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f) config,('s,'p,'f) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ ((CONST stepc \\))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\n\nend\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSimpl/LocalRG_HoareDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.25746918114417666}} {"text": "(* Author: Pascal Stoop, ETH Zurich\n Author: Andreas Lochbihler, Digital Asset *)\n\nsection \\Lazy types in generated code\\\n\ntheory Code_Lazy\nimports Case_Converter\nkeywords\n \"code_lazy_type\"\n \"activate_lazy_type\"\n \"deactivate_lazy_type\"\n \"activate_lazy_types\"\n \"deactivate_lazy_types\"\n \"print_lazy_types\" :: thy_decl\nbegin\n\ntext \\\n This theory and the CodeLazy tool described in @{cite \"LochbihlerStoop2018\"}.\n\n It hooks into Isabelle's code generator such that the generated code evaluates a user-specified\n set of type constructors lazily, even in target languages with eager evaluation.\n The lazy type must be algebraic, i.e., values must be built from constructors and a\n corresponding case operator decomposes them. Every datatype and codatatype is algebraic\n and thus eligible for lazification.\n\\\n\nsubsection \\The type \\lazy\\\\\n\ntypedef 'a lazy = \"UNIV :: 'a set\" ..\nsetup_lifting type_definition_lazy\nlift_definition delay :: \"(unit \\ 'a) \\ 'a lazy\" is \"\\f. f ()\" .\nlift_definition force :: \"'a lazy \\ 'a\" is \"\\x. x\" .\n\ncode_datatype delay\nlemma force_delay [code]: \"force (delay f) = f ()\" by transfer (rule refl)\nlemma delay_force: \"delay (\\_. force s) = s\" by transfer (rule refl)\n\ndefinition termify_lazy2 :: \"'a :: typerep lazy \\ term\"\n where \"termify_lazy2 x =\n Code_Evaluation.App (Code_Evaluation.Const (STR ''Code_Lazy.delay'') (TYPEREP((unit \\ 'a) \\ 'a lazy)))\n (Code_Evaluation.Const (STR ''Pure.dummy_pattern'') (TYPEREP((unit \\ 'a))))\"\n\ndefinition termify_lazy ::\n \"(String.literal \\ 'typerep \\ 'term) \\\n ('term \\ 'term \\ 'term) \\\n (String.literal \\ 'typerep \\ 'term \\ 'term) \\\n 'typerep \\ ('typerep \\ 'typerep \\ 'typerep) \\ ('typerep \\ 'typerep) \\\n ('a \\ 'term) \\ 'typerep \\ 'a :: typerep lazy \\ 'term \\ term\"\n where \"termify_lazy _ _ _ _ _ _ _ _ x _ = termify_lazy2 x\"\n\ndeclare [[code drop: \"Code_Evaluation.term_of :: _ lazy \\ _\"]]\n\nlemma term_of_lazy_code [code]:\n \"Code_Evaluation.term_of x \\\n termify_lazy\n Code_Evaluation.Const Code_Evaluation.App Code_Evaluation.Abs\n TYPEREP(unit) (\\T U. typerep.Typerep (STR ''fun'') [T, U]) (\\T. typerep.Typerep (STR ''Code_Lazy.lazy'') [T])\n Code_Evaluation.term_of TYPEREP('a) x (Code_Evaluation.Const (STR '''') (TYPEREP(unit)))\"\n for x :: \"'a :: {typerep, term_of} lazy\"\n by (rule term_of_anything)\n\ntext \\\n The implementations of \\<^typ>\\_ lazy\\ using language primitives cache forced values.\n\n Term reconstruction for lazy looks into the lazy value and reconstructs it to the depth it has been evaluated.\n This is not done for Haskell as we do not know of any portable way to inspect whether a lazy value\n has been evaluated to or not.\n\\\n\ncode_printing code_module Lazy \\ (SML)\n\\signature LAZY =\nsig\n type 'a lazy;\n val lazy : (unit -> 'a) -> 'a lazy;\n val force : 'a lazy -> 'a;\n val peek : 'a lazy -> 'a option\n val termify_lazy : \n (string -> 'typerep -> 'term) -> \n ('term -> 'term -> 'term) -> \n (string -> 'typerep -> 'term -> 'term) ->\n 'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->\n ('a -> 'term) -> 'typerep -> 'a lazy -> 'term -> 'term;\nend;\n\nstructure Lazy : LAZY = \nstruct\n\ndatatype 'a content =\n Delay of unit -> 'a\n | Value of 'a \n | Exn of exn;\n\ndatatype 'a lazy = Lazy of 'a content ref;\n\nfun lazy f = Lazy (ref (Delay f));\n\nfun force (Lazy x) = case !x of\n Delay f => (\n let val res = f (); val _ = x := Value res; in res end\n handle exn => (x := Exn exn; raise exn))\n | Value x => x\n | Exn exn => raise exn;\n\nfun peek (Lazy x) = case !x of\n Value x => SOME x\n | _ => NONE;\n\nfun termify_lazy const app abs unitT funT lazyT term_of T x _ =\n app (const \"Code_Lazy.delay\" (funT (funT unitT T) (lazyT T))) \n (case peek x of SOME y => abs \"_\" unitT (term_of y)\n | _ => const \"Pure.dummy_pattern\" (funT unitT T));\n\nend;\\ for type_constructor lazy constant delay force termify_lazy\n| type_constructor lazy \\ (SML) \"_ Lazy.lazy\"\n| constant delay \\ (SML) \"Lazy.lazy\"\n| constant force \\ (SML) \"Lazy.force\"\n| constant termify_lazy \\ (SML) \"Lazy.termify'_lazy\"\n\ncode_reserved SML Lazy\n\ncode_printing \\ \\For code generation within the Isabelle environment, we reuse the thread-safe\n implementation of lazy from \\<^file>\\~~/src/Pure/Concurrent/lazy.ML\\\\\n code_module Lazy \\ (Eval) \\\\ for constant undefined\n| type_constructor lazy \\ (Eval) \"_ Lazy.lazy\"\n| constant delay \\ (Eval) \"Lazy.lazy\"\n| constant force \\ (Eval) \"Lazy.force\"\n| code_module Termify_Lazy \\ (Eval)\n\\structure Termify_Lazy = struct\nfun termify_lazy\n (_: string -> typ -> term) (_: term -> term -> term) (_: string -> typ -> term -> term)\n (_: typ) (_: typ -> typ -> typ) (_: typ -> typ)\n (term_of: 'a -> term) (T: typ) (x: 'a Lazy.lazy) (_: term) =\n Const (\"Code_Lazy.delay\", (HOLogic.unitT --> T) --> Type (\"Code_Lazy.lazy\", [T])) $\n (case Lazy.peek x of\n SOME (Exn.Res x) => absdummy HOLogic.unitT (term_of x)\n | _ => Const (\"Pure.dummy_pattern\", HOLogic.unitT --> T));\nend;\\ for constant termify_lazy\n| constant termify_lazy \\ (Eval) \"Termify'_Lazy.termify'_lazy\"\n\ncode_reserved Eval Termify_Lazy\n\ncode_printing\n type_constructor lazy \\ (OCaml) \"_ Lazy.t\"\n| constant delay \\ (OCaml) \"Lazy.from'_fun\"\n| constant force \\ (OCaml) \"Lazy.force\"\n| code_module Termify_Lazy \\ (OCaml)\n\\module Termify_Lazy : sig\n val termify_lazy :\n (string -> 'typerep -> 'term) ->\n ('term -> 'term -> 'term) ->\n (string -> 'typerep -> 'term -> 'term) ->\n 'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->\n ('a -> 'term) -> 'typerep -> 'a Lazy.t -> 'term -> 'term\nend = struct\n\nlet termify_lazy const app abs unitT funT lazyT term_of ty x _ =\n app (const \"Code_Lazy.delay\" (funT (funT unitT ty) (lazyT ty)))\n (if Lazy.is_val x then abs \"_\" unitT (term_of (Lazy.force x))\n else const \"Pure.dummy_pattern\" (funT unitT ty));;\n\nend;;\\ for constant termify_lazy\n| constant termify_lazy \\ (OCaml) \"Termify'_Lazy.termify'_lazy\"\n\ncode_reserved OCaml Lazy Termify_Lazy\n\n\ncode_printing\n code_module Lazy \\ (Haskell) \\\nmodule Lazy(Lazy, delay, force) where\n\nnewtype Lazy a = Lazy a\ndelay f = Lazy (f ())\nforce (Lazy x) = x\\ for type_constructor lazy constant delay force\n| type_constructor lazy \\ (Haskell) \"Lazy.Lazy _\"\n| constant delay \\ (Haskell) \"Lazy.delay\"\n| constant force \\ (Haskell) \"Lazy.force\"\n\ncode_reserved Haskell Lazy\n\ncode_printing\n code_module Lazy \\ (Scala) \n\\object Lazy {\n final class Lazy[A] (f: Unit => A) {\n var evaluated = false;\n lazy val x: A = f(())\n\n def get() : A = {\n evaluated = true;\n return x\n }\n }\n\n def force[A] (x: Lazy[A]) : A = {\n return x.get()\n }\n\n def delay[A] (f: Unit => A) : Lazy[A] = {\n return new Lazy[A] (f)\n }\n\n def termify_lazy[Typerep, Term, A] (\n const: String => Typerep => Term,\n app: Term => Term => Term,\n abs: String => Typerep => Term => Term,\n unitT: Typerep,\n funT: Typerep => Typerep => Typerep,\n lazyT: Typerep => Typerep,\n term_of: A => Term,\n ty: Typerep,\n x: Lazy[A],\n dummy: Term) : Term = {\n if (x.evaluated)\n app(const(\"Code_Lazy.delay\")(funT(funT(unitT)(ty))(lazyT(ty))))(abs(\"_\")(unitT)(term_of(x.get())))\n else\n app(const(\"Code_Lazy.delay\")(funT(funT(unitT)(ty))(lazyT(ty))))(const(\"Pure.dummy_pattern\")(funT(unitT)(ty)))\n }\n}\\ for type_constructor lazy constant delay force termify_lazy\n| type_constructor lazy \\ (Scala) \"Lazy.Lazy[_]\"\n| constant delay \\ (Scala) \"Lazy.delay\"\n| constant force \\ (Scala) \"Lazy.force\"\n| constant termify_lazy \\ (Scala) \"Lazy.termify'_lazy\"\n\ncode_reserved Scala Lazy\n\ntext \\Make evaluation with the simplifier respect \\<^term>\\delay\\s.\\\n\nlemma delay_lazy_cong: \"delay f = delay f\" by simp\nsetup \\Code_Simp.map_ss (Simplifier.add_cong @{thm delay_lazy_cong})\\ \n\nsubsection \\Implementation\\\n\nML_file \\code_lazy.ML\\\n\nsetup \\\n Code_Preproc.add_functrans (\"lazy_datatype\", Code_Lazy.transform_code_eqs)\n\\\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Library/Code_Lazy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.25730724104350416}} {"text": "theory Simple_Network_Language_Renaming\n imports Simple_Network_Language_Model_Checking\nbegin\n\nunbundle no_library_syntax\n\ntext \\Helpful methods and theorems to work with tags:\\\n\nlemmas TAG_cong = arg_cong[where f = \"TAG t\" for t]\n\nlemma TAG_mp:\n assumes \"TAG t x\" \"x \\ y\"\n shows \"TAG t y\"\n using assms unfolding TAG_def by blast\n\nlemma TAG_mp':\n assumes \"TAG t x\" \"x \\ y\"\n shows y\n using assms unfolding TAG_def by blast\n\nmethod tag uses keep = (determ \\tags del: TAG keep: keep\\, (simp only: TAG_def)?)\n\nmethod auto_tag uses keep = match conclusion in \"TAG t _\" (cut) for t \\ \\tag keep: TAG[of t] keep\\\n\nlemmas all_mono_rule = all_mono[THEN mp, OF impI, rotated]\n\nlemma imp_mono_rule:\n assumes \"P1 \\ P2\"\n and \"Q1 \\ P1\"\n and \"Q1 \\ P2 \\ Q2\"\n shows \"Q1 \\ Q2\"\n using assms by blast\n\nlemma Ball_mono:\n assumes \"\\x \\ S. P x\" \"\\x. x \\ S \\ P x \\ Q x\"\n shows \"\\x \\ S. Q x\"\n using assms by blast\n\nmethod prop_monos =\n erule all_mono_rule\n | erule (1) imp_mono_rule\n | erule disj_mono[rule_format, rotated 2]\n\nlocale Prod_TA_Defs_urge =\n fixes A :: \"('a, 's, 'c, 't :: {zero}, 'x, 'v :: linorder) nta\" and urge :: 'c\nbegin\n\ndefinition\n \"add_reset \\ \\(C, U, T, I).\n (C, {}, (\\(l, b, g, a, f, r, l'). (l, b, g, a, f, urge # r, l')) ` T, I)\"\n\ndefinition\n \"add_inv \\ \\(C, U, T, I). (C, U, T,\n (\\l. if l \\ U then acconstraint.LE urge 0 # I l else I l))\"\n\ndefinition \"A_urge \\\n (fst A, map add_reset (map add_inv (fst (snd A))), snd (snd A))\"\n\ndefinition\n \"N_urge i \\ map add_reset (map add_inv (fst (snd A))) ! i\"\n\nend\n\nlocale Prod_TA_sem_urge =\n Prod_TA_Defs_urge A urge + Prod_TA_sem A\n for A :: \"('a, 's, 'c, 't :: {zero, time}, 'x, 'v :: linorder) nta\" and urge :: 'c +\n assumes urge_not_in_invariants:\n \"\\(_, _, _, I) \\ set (fst (snd A)). \\l. urge \\ constraint_clk ` set (I l)\"\n assumes urge_not_in_guards:\n \"\\(_, _, T, _) \\ set (fst (snd A)). \\(l, b, g, a, f, r, l') \\ T. urge \\ constraint_clk ` set g\"\n assumes urge_not_in_resets:\n \"\\(_, _, T, _) \\ set (fst (snd A)). \\(l, b, g, a, f, r, l') \\ T. urge \\ set r\"\nbegin\n\nlemma N_urge_simp:\n \"N_urge i = add_reset (add_inv (N i))\" if \"i < n_ps\"\n using that unfolding N_urge_def N_def by (simp add: n_ps_def)\n\nlemma inv_add_reset:\n \"inv (add_reset A') = inv A'\"\n unfolding inv_def add_reset_def by (simp split: prod.splits)\n\nlemma inv_add_inv:\n \"inv (add_inv (C, U, T, I)) = (\\l. if l \\ U then acconstraint.LE urge 0 # I l else I l)\"\n unfolding add_inv_def inv_def by simp\n\ndefinition\n \"is_urgent L \\ \\p urgent (N p)\"\n\nlemma map_nth':\n \"map ((!) xs) [0..l. if l \\ urgent A' then acconstraint.LE urge 0 # inv A' l else inv A' l)\"\n apply (cases A')\n apply (simp add: inv_add_inv urgent_def)\n unfolding inv_def\n apply auto\n done\n\nlemma A_split':\n \"A = (fst A, fst (snd A), snd (snd A))\"\n by auto\n\nlemma is_urgent_simp:\n \"(\\p urgent (map N [0.. is_urgent L\"\n unfolding is_urgent_def by auto\n\nlemma urgent_N_urge:\n \"urgent (N_urge p) = {}\" if \"p < n_ps\"\n using that unfolding N_def N_urge_def n_ps_def urgent_def add_reset_def add_inv_def\n by (auto split: prod.split_asm)\n\nlemma committed_N_urge:\n \"committed (N_urge p) = committed (N p)\" if \"p < n_ps\"\n using that unfolding N_def N_urge_def n_ps_def committed_def add_reset_def add_inv_def\n by (auto split: prod.split)\n\nlemma is_urgent_simp2:\n \"(\\p urgent (map N_urge [0.. False\"\n unfolding is_urgent_def by (auto simp: urgent_N_urge)\n\nlemma inv_add_invI1:\n \"u \\ inv (add_inv (N p)) (L ! p)\" if \"u \\ inv (N p) (L ! p)\" \"\\ is_urgent L\" \"p < n_ps\"\n using that unfolding inv_add_inv' is_urgent_def by simp\n\nlemma inv_add_invI2:\n \"u \\ inv (add_inv (N p)) (L ! p)\" if \"u \\ inv (N p) (L ! p)\" \"u urge \\ 0\" \"p < n_ps\"\n using that unfolding inv_add_inv' is_urgent_def by (auto elim: guard_consI[rotated])\n\nlemma inv_add_invD:\n \"u \\ inv A' l\" if \"u \\ inv (add_inv A') l\"\n using that unfolding inv_add_inv' by (auto split: if_split_asm simp: clock_val_def)\n\nlemma inv_N_urge:\n \"inv (N_urge p) = inv (add_inv (N p))\" if \"p < n_ps\"\n using that by (simp add: N_urge_simp inv_add_reset)\n\nlemma N_urge_trans_simp:\n \"trans (N_urge i) = (\\(l, b, g, a, f, r, l'). (l, b, g, a, f, urge # r, l')) ` (trans (N i))\"\n if \"i < n_ps\"\n unfolding N_urge_simp[OF that] add_inv_def add_reset_def trans_def by (simp split: prod.splits)\n\nlemma trans_N_urgeD:\n \"(l, b, g, a, f, urge # r, l') \\ trans (N_urge p)\"\n if \"(l, b, g, a, f, r, l') \\ trans (N p)\" \"p < n_ps\"\n using that by (force simp add: N_urge_trans_simp)\n\nlemma trans_N_urgeE:\n assumes \"(l, b, g, a, f, r, l') \\ trans (N_urge p)\" \"p < n_ps\"\n obtains \"(l, b, g, a, f, tl r, l') \\ trans (N p)\" \"r = urge # tl r\"\n using assms by (force simp add: N_urge_trans_simp)\n\nlemma urge_not_in_inv:\n \"urge \\ constraint_clk ` set (inv (N p) l)\" if \"p < n_ps\"\n using urge_not_in_invariants that unfolding N_def inv_def n_ps_def by (fastforce dest! :nth_mem)\n\nlemma urge_not_in_guards':\n assumes \"(l, b, g, a, f, r, l') \\ trans (N p)\" \"p < n_ps\"\n shows \"urge \\ constraint_clk ` set g\"\n using urge_not_in_guards assms unfolding N_def trans_def n_ps_def by (fastforce dest! :nth_mem)\n\nlemma urge_not_in_resets':\n assumes \"(l, b, g, a, f, r, l') \\ trans (N p)\" \"p < n_ps\"\n shows \"urge \\ set r\"\n using urge_not_in_resets assms unfolding N_def trans_def n_ps_def by (fastforce dest! :nth_mem)\n\nlemma clk_upd_clock_val_a_simp:\n \"u(c := d) \\\\<^sub>a ac \\ u \\\\<^sub>a ac\" if \"c \\ constraint_clk ac\"\n using that by (cases ac) auto\n\nlemma clk_upd_clock_val_simp:\n \"u(c := d) \\ cc \\ u \\ cc\" if \"c \\ constraint_clk ` set cc\"\n using that unfolding clock_val_def list_all_def\n by (force simp: image_def clk_upd_clock_val_a_simp)\n\nlemma inv_N_urgeI:\n assumes \"u \\ inv (N p) l\" \"p < n_ps\"\n shows \"u(urge := 0) \\ inv (N_urge p) l\"\n using assms urge_not_in_inv[of p]\n by (auto simp: inv_N_urge inv_add_inv' clk_upd_clock_val_simp intro!: guard_consI)\n\nlemma inv_N_urge_updI:\n assumes \"u \\ inv (N p) l\" \"p < n_ps\"\n shows \"u(urge := d) \\ inv (N p) l\"\n using assms urge_not_in_inv[of p] by (auto simp: clk_upd_clock_val_simp)\n\nlemma inv_N_urge_upd_simp:\n assumes \"p < n_ps\"\n shows \"u(urge := d) \\ inv (N p) l \\ u \\ inv (N p) l\"\n using assms urge_not_in_inv[of p] by (auto simp: clk_upd_clock_val_simp)\n\nlemma inv_N_urge_updD:\n assumes \"u(urge := d) \\ inv (N p) l\" \"p < n_ps\"\n shows \"u \\ inv (N p) l\"\n using assms urge_not_in_inv[of p] by (auto simp: clk_upd_clock_val_simp)\n\nlemma inv_N_urgeD:\n assumes \"u \\ inv (N_urge p) l\" \"p < n_ps\"\n shows \"u(urge := d) \\ inv (N p) l\"\n using assms urge_not_in_inv[of p]\n by (auto simp: inv_N_urge inv_add_inv' clk_upd_clock_val_simp split: if_split_asm elim: guard_consE)\n\nlemma inv_N_urge_urges:\n assumes \"\\p d \\ inv (N_urge p) (L ! p)\" \"is_urgent L\"\n shows \"d \\ 0\"\nproof -\n from \\is_urgent L\\ obtain p where \"p < n_ps\" \"L ! p \\ urgent (N p)\"\n unfolding is_urgent_def by auto\n then have \"acconstraint.LE urge 0 \\ set (inv (N_urge p) (L ! p))\"\n by (simp add: inv_N_urge inv_add_inv')\n with assms \\p < n_ps \\ have \"u(urge := 0) \\ d \\\\<^sub>a acconstraint.LE urge 0\"\n unfolding clock_val_def list_all_iff by auto\n then show ?thesis\n by (auto simp: cval_add_def)\nqed\n\nlemma trans_urge_upd_iff:\n assumes \"(l, b, g, a, f, r, l') \\ trans (N p)\" \"p < n_ps\"\n shows \"u(urge := d) \\ g \\ u \\ g\"\n using assms urge_not_in_guards' by (auto simp: clk_upd_clock_val_simp)\n\nlemma cval_add_0[simp]:\n \"u \\ (0 :: 'tt :: time) = u\"\n unfolding cval_add_def by simp\n\nlemma clock_val_reset_delay:\n \"u(c := 0) \\ (d :: 'tt :: time) = (u \\ d)(c := d)\"\n unfolding cval_add_def by auto\n\nlemma clock_set_upd_simp:\n \"[r \\ d]u(c := d') = [r \\ d]u\" if \"c \\ set r\"\n using that\n apply (induction r arbitrary: u)\n apply auto\n oops\n\nlemma fun_upd_twist2:\n \"f(a := x, b := x) = f(b := x, a := x)\"\n by auto\n\nlemma clock_set_upd_simp:\n \"[c # r \\ d]u(c := d') = [c # r \\ d]u\"\n apply (induction r arbitrary: u)\n apply simp\n apply simp\n apply (subst fun_upd_twist2)\n apply auto\n done\n\nlemma clock_set_commute_single:\n \"[r \\ d]u(c := d') = ([r \\ d]u)(c := d')\" if \"c \\ set r\"\n using that by (induction r) auto\n\nlemma clock_set_upd_simp2:\n \"([xs @ c # ys \\ d]u)(c := d') = ([xs @ ys \\ d]u)(c := d')\"\n apply (induction xs)\n apply (auto; fail)\n apply (intro ext)\n subgoal for a xs x\n by (drule fun_cong[where x = x]) auto\n done\n\nlemma clock_set_upd_simp3:\n \"([xs \\ d]u)(c := d') = ([filter (\\x. x \\ c) xs \\ d]u)(c := d')\"\n apply (induction xs)\n apply (auto; fail)\n apply (rule ext)\n apply auto\n subgoal for xs x\n by (drule fun_cong[where x = x]) auto\n subgoal for a xs x\n by (drule fun_cong[where x = x]) auto\n done\n\ninterpretation urge: Prod_TA_sem A_urge .\n\nlemma urge_n_ps_eq:\n \"urge.n_ps = n_ps\"\n unfolding urge.n_ps_def n_ps_def unfolding A_urge_def by simp\n\nlemma urge_N_simp[simp]:\n \"urge.N = N_urge\"\n unfolding urge.N_def N_urge_def unfolding A_urge_def by simp\n\nlemma urge_states_eq:\n \"urge.states = states\"\n unfolding states_def urge.states_def urge_n_ps_eq\n by (auto simp add: N_urge_trans_simp split: prod.splits)\n\ninterpretation Bisimulation_Invariant\n \"\\(L, s, u) (L', s', u'). step_u' A L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). step_u' A_urge L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = L \\ s' = s \\ u' = u(urge := 0)\"\n \"\\(L, s, u). L \\ states\" \"\\(L, s, u). True\"\nproof ((standard; clarsimp), goal_cases)\n case (1 L s u L' s' u')\n then show ?case\n proof cases\n case steps: (1 L'' s'' u'' a)\n have *: \"(u \\ d)(urge := (u \\ d) urge - u urge) = u(urge := 0) \\ d\" for d\n by (auto simp: cval_add_def)\n from steps(1) \\L \\ states\\ have \"L'' \\ states\"\n by (rule states_inv)\n then have [simp]: \"length L'' = n_ps\"\n by (rule states_lengthD)\n from steps(1) have\n \"A_urge \\ \\L, s, u(urge := 0)\\ \\\\<^bsub>Del\\<^esub> \\L'', s'', u''(urge := u'' urge - u urge)\\\"\n apply cases\n apply (subst A_urge_split)\n apply (subst (asm) A_split)\n apply (drule sym)\n apply simp\n unfolding TAG_def[of \"''urgent''\"]\n apply (simp add: is_urgent_simp *)\n apply (rule step_u.intros)\n apply auto_tag\n apply simp\n subgoal\n by (cases \"is_urgent L\")\n (auto 4 3\n intro: inv_N_urge_updI inv_add_invI1 inv_add_invI2\n simp: inv_N_urge clock_val_reset_delay)\n by (auto_tag, simp add: is_urgent_simp2)+\n moreover from steps(3,2) have\n \"A_urge \\ \\L'', s'', u''(urge := u'' urge - u urge)\\ \\\\<^bsub>a\\<^esub> \\L', s', u'(urge := 0)\\\"\n apply (cases; subst A_urge_split; subst (asm) A_split)\n apply (all \\drule sym\\)\n subgoal delay\n by simp\n subgoal internal for l b g a' f r l' N p B broadcast\n unfolding TAG_def[of \"''range''\"]\n apply simp\n apply (rule step_u.intros)\n apply (auto_tag, drule (1) trans_N_urgeD, subst nth_map, simp, simp; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (tag keep: TAG[of \"''guard''\"] TAG[of \"TRANS _\"]; auto simp: trans_urge_upd_iff;\n fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeI\\)\n subgoal\n unfolding clock_set.simps(2)[symmetric] clock_set_upd_simp ..\n done\n subgoal binary for a' broadcast' l1 b1 g1 f1 r1 l1' N' p l2 b2 g2 f2 r2 l2' q s'' B\n unfolding TAG_def[of \"RECV ''range''\"] TAG_def[of \"SEND ''range''\"]\n apply simp\n apply (rule step_u.intros)\n apply (auto_tag; simp; fail)\n apply (auto_tag, drule (1) trans_N_urgeD, subst nth_map, simp, simp; fail)\n apply (auto_tag, drule (1) trans_N_urgeD, subst nth_map, simp, simp; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (auto_tag; fail)\n apply (tag keep: TAG[of \"''guard''\"] TAG[of \"TRANS _\"]; auto simp: trans_urge_upd_iff; fail)\n apply (tag keep: TAG[of \"''guard''\"] TAG[of \"TRANS _\"]; auto simp: trans_urge_upd_iff; fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeI\\)\n unfolding clock_set.simps(2)[symmetric] clock_set_upd_simp\n apply (simp add: clock_set_upd_simp2)\n done\n subgoal broadcast for a' broadcast' l b g f r l' N' p ps bs gs fs rs ls' s'' B\n unfolding TAG_def[of \"SEL ''range''\"] TAG_def[of \"SEND ''range''\"]\n apply (simp add: subset_nat_0_atLeastLessThan_conv)\n apply (rule step_u.intros)\n apply (auto_tag; simp; fail)\n apply (auto_tag, drule (1) trans_N_urgeD, subst nth_map, simp, simp; fail)\n apply (auto_tag, auto 4 3 dest: trans_N_urgeD; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (auto_tag; fail)\n apply (tag keep: TAG[of \"''guard''\"] TAG[of \"TRANS _\"]; auto simp: trans_urge_upd_iff; fail)\n apply (tag keep: TAG[of \"''guard''\"] TAG[of \"TRANS _\"]; auto simp: trans_urge_upd_iff; fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeI\\)\n apply (erule (1) trans_N_urgeE, force simp: trans_urge_upd_iff)\n subgoal\n unfolding clock_set.simps(2)[symmetric] clock_set_upd_simp\n apply simp\n apply (subst (2) clock_set_upd_simp3)\n apply (subst clock_set_upd_simp3)\n apply (simp add: filter_concat comp_def)\n done\n done\n done\n ultimately show \"A_urge \\ \\L, s, u(urge := 0)\\ \\ \\L', s', u'(urge := 0)\\\"\n using \\a \\ _\\ by (intro step_u'.intros)\n qed\nnext\n case (2 L s u L' s' u')\n then show ?case\n proof cases\n case steps: (1 L'' s'' u'' a)\n have *: \"(u(urge := 0) \\ d)(urge := (u(urge := 0) \\ d) urge + u urge) = u \\ d\" for d\n unfolding cval_add_def by auto\n from steps(1) \\L \\ states\\ have \"L'' \\ states\"\n by (rule urge.states_inv[unfolded urge_states_eq])\n then have [simp]: \"length L'' = n_ps\"\n by (rule states_lengthD)\n have 1: \"([r\\0]u'') urge = 0\" if \"r = urge # xs\" for r xs\n by (subst that) simp\n have 2: \"filter (\\x. x \\ urge) r = filter (\\x. x \\ urge) (tl r)\" if \"r = urge # tl r\" for r\n by (subst that) simp\n from steps(3,2) have \"u' urge = 0\"\n apply (cases; subst (asm) A_urge_split)\n apply (all \\drule sym\\)\n apply (simp; fail)\n subgoal delay\n by (tag keep: TAG[of \"''new valuation''\"] TAG[of \"TRANS _\"] TAG[of \"''range''\"])\n (auto elim!: trans_N_urgeE simp: 1; fail)\n subgoal binary for a' broadcast' l1 b1 g1 f1 r1 l1' N p l2 b2 g2 f2 r2 l2' q s'' B\n by (tag keep: TAG[of \"''new valuation''\"] TAG[of \"TRANS _\"] TAG[of \"RECV ''range''\"])\n (auto elim!: trans_N_urgeE simp: 1[of _ \"tl r1 @ r2\"])\n subgoal broadcast for a' broadcast' l b g f r l' N p ps bs gs fs rs ls' s'a B\n by (tag keep: TAG[of \"''new valuation''\"] TAG[of \"TRANS _\"] TAG[of \"SEND ''range''\"])\n (auto elim!: trans_N_urgeE simp: 1[of _ \"tl r @ concat (map rs ps)\"])\n done\n have **: \"\n ([r\\0]u'')(urge := u'' urge + u urge) = ([tl r\\0]u'')(urge := u'' urge + u urge)\"\n if \"r = urge # tl r\" for r\n by (subst that) simp\n from steps(1) have \"A \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L'', s'', u''(urge := u'' urge + u urge)\\\"\n apply cases\n apply (subst (asm) A_urge_split)\n apply (subst A_split)\n apply (drule sym)\n apply simp\n unfolding TAG_def[of \"''urgent''\"]\n apply (simp add: is_urgent_simp *)\n apply (rule step_u.intros)\n subgoal\n by auto_tag(auto dest!: inv_add_invD inv_N_urge_updD simp: inv_N_urge clock_val_reset_delay)\n apply auto_tag\n apply (tag keep: TAG[of \"''target invariant''\"] TAG[of \"''nonnegative''\"])\n apply (auto simp add: is_urgent_simp2 is_urgent_simp dest: inv_N_urge_urges)\n done\n moreover from steps(3,2) have\n \"A \\ \\L'', s'', u''(urge := u'' urge + u urge)\\ \\\\<^bsub>a\\<^esub> \\L', s', u'(urge := u'' urge + u urge)\\\"\n apply (cases; subst (asm) A_urge_split; subst A_split)\n apply (all \\drule sym\\)\n subgoal delay\n by simp\n subgoal internal for l b g a' f r l' N p B broadcast\n unfolding TAG_def[of \"''range''\"]\n apply simp\n apply (rule step_u.intros)\n apply (auto_tag, erule (1) trans_N_urgeE, subst nth_map, simp, simp; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (auto_tag keep: TAG[of \"TRANS _\"];\n auto intro: trans_N_urgeE simp: trans_urge_upd_iff; fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeD; fail | succeed\\)\n apply (auto_tag keep: TAG[of \"TRANS _\"], erule (1) trans_N_urgeE,\n subst clock_set_commute_single, rule urge_not_in_resets', (simp add: **)+; fail)\n done\n subgoal binary for a' broadcast' l1 b1 g1 f1 r1 l1' Na p l2 b2 g2 f2 r2 l2' q s'' B\n unfolding TAG_def[of \"RECV ''range''\"] TAG_def[of \"SEND ''range''\"]\n apply simp\n apply (rule step_u.intros)\n apply (auto_tag; simp; fail)\n apply (auto_tag, erule (1) trans_N_urgeE, subst nth_map, simp, simp; fail)\n apply (auto_tag, erule (1) trans_N_urgeE, subst nth_map, simp, simp; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (auto_tag; fail)\n apply (auto_tag keep: TAG[of \"TRANS _\"];\n auto intro: trans_N_urgeE simp: trans_urge_upd_iff; fail)\n apply (auto_tag keep: TAG[of \"TRANS _\"];\n auto intro: trans_N_urgeE simp: trans_urge_upd_iff; fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeD; fail | succeed\\)\n apply (auto_tag keep: TAG[of \"TRANS _\"], erule (1) trans_N_urgeE, erule (1) trans_N_urgeE)\n apply simp\n apply (subst clock_set_upd_simp3)\n apply (subst clock_set_commute_single)\n apply (simp; rule conjI; erule (1) urge_not_in_resets')\n apply (rule arg_cong)\n subgoal premises prems\n using urge_not_in_resets'[OF prems(7) \\p < n_ps\\] urge_not_in_resets'[OF prems(9) \\q < n_ps\\]\n by (subst \\r1 = _\\, subst \\r2 = _\\, simp) (subst filter_True, auto)+\n done\n subgoal broadcast for a' broadcast' l b g f r l' N' p ps bs gs fs rs ls' s2 B\n unfolding TAG_def[of \"SEL ''range''\"] TAG_def[of \"SEND ''range''\"]\n apply (simp add: subset_nat_0_atLeastLessThan_conv)\n apply (rule step_u.intros)\n apply (auto_tag; simp; fail)\n apply (auto_tag, erule (1) trans_N_urgeE, subst nth_map, simp, simp; fail)\n apply (auto_tag, auto 4 3 elim: trans_N_urgeE; fail)\n apply (auto_tag, subst nth_map, simp, simp add: committed_N_urge; fail)\n apply (auto_tag; fail)\n apply (auto_tag; fail)\n apply (auto_tag keep: TAG[of \"TRANS _\"]; auto elim: trans_N_urgeE simp: trans_urge_upd_iff; fail)\n apply (all \\auto_tag; auto intro: inv_N_urgeD; fail | succeed\\)\n subgoal guards\n by (auto_tag keep: TAG[of \"TRANS _\"]; auto elim!: trans_N_urgeE simp: trans_urge_upd_iff)\n subgoal maximal\n by (auto_tag, force simp: trans_urge_upd_iff dest: trans_N_urgeD)\n subgoal new_valuation\n apply (auto_tag keep: TAG[of \"TRANS _\"])\n apply (subst clock_set_upd_simp3)\n apply (simp add: filter_concat comp_def)\n apply (subst clock_set_commute_single[symmetric], (simp; fail))\n apply (rule arg_cong)\n apply (fo_rule arg_cong2)\n subgoal\n apply (auto simp: 2 urge_not_in_resets' filter_id_conv elim!: trans_N_urgeE)\n done\n subgoal\n apply (fo_rule arg_cong)\n apply (fastforce elim: trans_N_urgeE simp: 2 urge_not_in_resets' filter_id_conv)+\n done\n done\n done\n done\n ultimately show ?thesis\n using \\a \\ _\\ \\u' urge = 0\\ by (intros add: step_u'.intros) auto\n qed\nnext\n case (3 L s u L' s' u')\n then show ?case\n by (elim step_u'_elims states_inv)\nqed\n\nlemmas urge_bisim = Bisimulation_Invariant_axioms\n\nend (* Prod TA sem urge *)\n\n\n(* XXX All this stuff is duplicated *)\ncontext Simple_Network_Impl_Defs\nbegin\n\nlemma N_eq:\n \\N i = automaton_of (automata ! i)\\ if \\i < n_ps\\\n using that unfolding N_def n_ps_def fst_conv snd_conv by (intro nth_map; simp)\n\n(* XXX Remove? *)\nlemma covn_N_eq:\n \\N i = automaton_of (automata ! i)\\ if \\i < n_ps\\\n using that unfolding N_def n_ps_def fst_conv snd_conv by (intro nth_map; simp)\n\nend\n\ncontext Simple_Network_Impl_Defs\nbegin\n\nlemma dom_bounds: \"dom bounds = fst ` set bounds'\"\n unfolding bounds_def by (simp add: dom_map_of_conv_image_fst)\n\nlemma mem_trans_N_iff:\n \"t \\ Simple_Network_Language.trans (N i) \\ t \\ set (fst (snd (snd (automata ! i))))\"\n if \"i < n_ps\"\n unfolding N_eq[OF that] by (auto split: prod.splits simp: automaton_of_def trans_def)\n\nlemma length_automata_eq_n_ps:\n \"length automata = n_ps\"\n unfolding n_ps_def by simp\n\nlemma N_p_trans_eq:\n \"Simple_Network_Language.trans (N p) = set (fst (snd (snd (automata ! p))))\" if \"p < n_ps\"\n using mem_trans_N_iff[OF that] by auto\n\nlemma loc_set_compute:\n \"loc_set = \\ ((\\(_, _, t, _). \\ ((\\(l, _, _, _, _, _, l'). {l, l'}) ` set t)) ` set automata)\"\n unfolding loc_set_def setcompr_eq_image\n apply (auto simp: N_p_trans_eq n_ps_def)\n apply (drule nth_mem, erule bexI[rotated], force)+\n apply (drule mem_nth, force)+\n done\n\nlemma var_set_compute:\n \"var_set =\n (\\S \\ (\\t. (fst \\ snd) ` set t) ` ((\\(_, _, t, _). t) ` set automata). \\b \\ S. vars_of_bexp b) \\\n (\\S \\ (\\t. (fst \\ snd o snd \\ snd \\ snd) ` set t) ` ((\\(_, _, t, _). t) ` set automata).\n \\f \\ S. \\ (x, e) \\ set f. {x} \\ vars_of_exp e)\"\n unfolding var_set_def setcompr_eq_image\n by (rule arg_cong2[where f = \"(\\)\"]; auto simp: N_p_trans_eq n_ps_def,\n (drule nth_mem, erule bexI[rotated],\n metis (no_types, lifting) insert_iff mem_case_prodI prod.collapse)+,\n (drule mem_nth, force)+)\n\nlemma states_loc_setD:\n \"set L \\ loc_set\" if \"L \\ states\"\n using states_loc_set that by auto\n\nend (* Simple Network Impl Defs *)\n\n\ncontext Simple_Network_Impl\nbegin\n\nlemma sem_bounds_eq: \"sem.bounds = bounds\"\n unfolding sem.bounds_def bounds_def unfolding sem_def by simp\n\nlemma n_ps_eq[simp]:\n \"sem.n_ps = n_ps\"\n unfolding n_ps_def sem.n_ps_def unfolding sem_def by auto\n\nlemma sem_loc_set_eq:\n \"sem.loc_set = loc_set\"\n unfolding sem.loc_set_def loc_set_def n_ps_eq setcompr_eq_image\n apply (simp add: sem_N_eq N_eq)\n apply (rule arg_cong2[where f = \"(\\)\"])\n apply (auto;\n force split: prod.splits simp: conv_automaton_def trans_def automaton_of_def n_ps_def)+\n done\n\nlemma sem_states_eq:\n \"sem.states = states\"\n unfolding sem.states_def states_def n_ps_eq setcompr_eq_image\n by (auto simp: sem_N_eq N_eq;\n force simp: conv_automaton_def trans_def automaton_of_def n_ps_def split: prod.splits)+\n\nend (* Simple Network Impl *)\n\n\nlocale Simple_Network_Rename_Defs =\n Simple_Network_Impl_Defs automata broadcast bounds' for automata ::\n \"('s list \\ 's list \\ (('a :: countable) act, 's, 'c, 't, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, 't) cconstraint) list) list\"\n and broadcast bounds' +\n fixes renum_acts :: \"'a \\ nat\"\n and renum_vars :: \"'x \\ nat\"\n and renum_clocks :: \"'c \\ nat\"\n and renum_states :: \"nat \\ 's \\ nat\"\nbegin\n\ndefinition\n \"map_cconstraint f g xs = map (map_acconstraint f g) xs\"\n\ndefinition\n \"renum_cconstraint = map_cconstraint renum_clocks id\"\n\ndefinition\n \"renum_act = map_act renum_acts\"\n\ndefinition\n \"renum_bexp = map_bexp renum_vars\"\n\ndefinition\n \"renum_exp = map_exp renum_vars\"\n\ndefinition\n \"renum_upd = map (\\(x, upd). (renum_vars x, renum_exp upd))\"\n\ndefinition\n \"renum_reset = map renum_clocks\"\n\ndefinition renum_automaton where\n \"renum_automaton i \\ \\(committed, urgent, trans, inv). let\n committed' = map (renum_states i) committed;\n urgent' = map (renum_states i) urgent;\n trans' = map (\\(l, b, g, a, upd, r, l').\n (renum_states i l, renum_bexp b, renum_cconstraint g, renum_act a, renum_upd upd,\n renum_reset r, renum_states i l')\n ) trans;\n inv' = map (\\(l, g). (renum_states i l, renum_cconstraint g)) inv\n in (committed', urgent', trans', inv')\n\"\n\ndefinition\n \"vars_inv \\ the_inv renum_vars\"\n\ndefinition\n \"map_st \\ \\(L, s). (map_index renum_states L, s o vars_inv)\"\n\ndefinition\n \"clocks_inv \\ the_inv renum_clocks\"\n\ndefinition\n \"map_u u = u o clocks_inv\"\n\nlemma map_u_add[simp]:\n \"map_u (u \\ d) = map_u u \\ d\"\n by (auto simp: map_u_def cval_add_def)\n\ndefinition renum_label where\n \"renum_label = map_label renum_acts\"\n\nsublocale renum: Simple_Network_Impl_Defs\n \"map_index renum_automaton automata\"\n \"map renum_acts broadcast\"\n \"map (\\(a,p). (renum_vars a, p)) bounds'\"\n .\n\nlemma renum_n_ps_simp[simp]:\n \"renum.n_ps = n_ps\"\n unfolding n_ps_def renum.n_ps_def by simp\n\nend (* Simple Network Rename Defs *)\n\n\nlocale Simple_Network_Rename_Defs_int =\n Simple_Network_Rename_Defs automata +\n Simple_Network_Impl automata\n for automata ::\n \"('s list \\ 's list \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\"\nbegin\n\nsublocale renum: Simple_Network_Impl\n \"map_index renum_automaton automata\"\n \"map renum_acts broadcast\"\n \"map (\\(a,p). (renum_vars a, p)) bounds'\"\n .\n\nend (* Simple Network Rename Defs int *)\n\nlemma\n fixes f :: \"'b :: countable \\ nat\"\n assumes \"inj_on f S\" \"finite S\" \"infinite (UNIV :: 'b set)\"\n shows extend_bij_inj: \"inj (extend_bij f S)\" and extend_bij_surj: \"surj (extend_bij f S)\"\n and extend_bij_extends: \"\\x \\ S. extend_bij f S x = f x\"\nproof -\n have \"infinite (\\ :: nat set)\"\n unfolding Nats_def by simp\n from assms this have \"bij (extend_bij f S)\"\n by (intro extend_bij_bij) auto\n then show \"inj (extend_bij f S)\" and \"surj (extend_bij f S)\"\n unfolding bij_def by fast+\n from assms \\infinite \\\\ show \"\\x \\ S. extend_bij f S x = f x\"\n by (intro extend_bij_extends) auto\nqed\n\nlemma default_map_of_map:\n \"default_map_of y (map (\\(a, b). (f a, g b)) xs) (f a) = g (default_map_of x xs a)\"\n if \"inj f\" \"y = g x\"\n using that unfolding default_map_of_alt_def\n by (auto 4 4 dest: injD[OF that(1)] map_of_SomeD simp: map_of_eq_None_iff map_of_mapk_SomeI)\n\nlemma default_map_of_map_2:\n \"default_map_of y (map (\\(a, b). (a, g b)) xs) a = g (default_map_of x xs a)\" if \"y = g x\"\n unfolding default_map_of_alt_def using that by (auto simp: map_of_map)\n\nlemma map_of_map':\n \"map_of (map (\\(k, v). (k, f k v)) xs)\n = (\\k. case map_of xs k of Some v \\ Some (f k v) | _ \\ None)\"\n by (induct xs) (auto simp: fun_eq_iff)\n\nlemma default_map_of_map_3:\n \"default_map_of y (map (\\(a, b). (a, g a b)) xs) a = g a (default_map_of x xs a)\"\n if \"\\k. y = g k x\"\n unfolding default_map_of_alt_def using that by (auto simp: map_of_map')\n\nlemma dom_map_of_map:\n \"dom (map_of (map (\\ (a, b). (f a, g b)) xs)) = f ` fst ` set xs\"\n unfolding dom_map_of_conv_image_fst by (auto 4 3)\n\nlemma inj_image_eqI:\n \"S = T\" if \"inj f\" \"f ` S = f ` T\"\n using that by (meson inj_image_eq_iff)\n\n(* XXX Add this *)\nlemmas [finite_intros] = finite_set\n\nlemma map_of_NoneI:\n \"map_of xs x = None\" if \"x \\ fst ` set xs\"\n by (simp add: map_of_eq_None_iff that)\n\nlemma bij_f_the_inv_f:\n \"f (the_inv f x) = x\" if \"bij f\"\n using that f_the_inv_f unfolding bij_def by (simp add: f_the_inv_f)\n\n\nfun map_sexp ::\n \"(nat \\ 's \\ 's1) \\ ('a \\ 'a1) \\ ('b \\ 'b1) \\ (nat, 's, 'a, 'b) sexp\n \\ (nat, 's1, 'a1, 'b1) sexp\"\n where\n \"map_sexp _ _ _ sexp.true = sexp.true\" |\n \"map_sexp f g h (not e) = not (map_sexp f g h e)\" |\n \"map_sexp f g h (and e1 e2) = and (map_sexp f g h e1) (map_sexp f g h e2)\" |\n \"map_sexp f g h (sexp.or e1 e2) = sexp.or (map_sexp f g h e1) (map_sexp f g h e2)\" |\n \"map_sexp f g h (imply e1 e2) = imply (map_sexp f g h e1) (map_sexp f g h e2)\" |\n \"map_sexp f g h (eq i x) = eq (g i) (h x)\" |\n \"map_sexp f g h (lt i x) = lt (g i) (h x)\" |\n \"map_sexp f g h (le i x) = le (g i) (h x)\" |\n \"map_sexp f g h (ge i x) = ge (g i) (h x)\" |\n \"map_sexp f g h (gt i x) = gt (g i) (h x)\" |\n \"map_sexp f g h (loc i x) = loc i (f i x)\"\n\nfun map_formula ::\n \"(nat \\ 's \\ 's1) \\ ('a \\ 'a1) \\ ('b \\ 'b1)\n \\ (nat, 's, 'a, 'b) formula \\ (nat, 's1, 'a1, 'b1) formula\"\nwhere\n \"map_formula f g h (formula.EX \\) = formula.EX (map_sexp f g h \\)\" |\n \"map_formula f g h (EG \\) = EG (map_sexp f g h \\)\" |\n \"map_formula f g h (AX \\) = AX (map_sexp f g h \\)\" |\n \"map_formula f g h (AG \\) = AG (map_sexp f g h \\)\" |\n \"map_formula f g h (Leadsto \\ \\) = Leadsto (map_sexp f g h \\) (map_sexp f g h \\)\"\n\n\nlocale Simple_Network_Impl_real =\n fixes automata ::\n \"('s list \\ 's list \\ ('a act, 's, 'c, real, 'x, int) transition list\n \\ ('s \\ ('c, real) cconstraint) list) list\"\n and broadcast :: \"'a list\"\n and bounds' :: \"('x \\ (int \\ int)) list\"\nbegin\n\nsublocale Simple_Network_Impl_Defs automata broadcast bounds' .\n\nabbreviation \"sem \\ (set broadcast, map automaton_of automata, map_of bounds')\"\n\nsublocale Prod_TA_sem \"(set broadcast, map automaton_of automata, map_of bounds')\" .\n\nend\n\ncontext Simple_Network_Impl\nbegin\n\nlemma sem_state_guard_eq:\n \"(fst \\ snd) ` trans (sem.N p) = (fst \\ snd) ` trans (N p)\" if \"p < n_ps\"\n unfolding sem_N_eq[OF \\p < n_ps\\] N_eq[OF \\p < n_ps\\]\n unfolding automaton_of_def conv_automaton_def trans_def\n by (force split: prod.splits)\n\nlemma sem_state_update_eq:\n \"(fst \\ snd \\ snd \\ snd \\ snd) ` trans (sem.N p) = (fst \\ snd \\ snd \\ snd \\ snd) ` trans (N p)\"\n if \"p < n_ps\"\n unfolding sem_N_eq[OF \\p < n_ps\\] N_eq[OF \\p < n_ps\\]\n unfolding automaton_of_def conv_automaton_def trans_def\n by (force split: prod.splits)\n\nlemma sem_var_set_eq:\n \"sem.var_set = var_set\"\n unfolding sem.var_set_def var_set_def n_ps_eq using sem_state_guard_eq sem_state_update_eq\n by (simp cong: image_cong_simp add: setcompr_eq_image)\n\nend\n\nlocale Simple_Network_Rename_Defs_real =\n Simple_Network_Rename_Defs automata +\n Simple_Network_Impl_real automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, real, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, real) cconstraint) list) list\"\nbegin\n\nsublocale renum: Simple_Network_Impl_real\n \"map_index renum_automaton automata\"\n \"map renum_acts broadcast\"\n \"map (\\(a,p). (renum_vars a, p)) bounds'\"\n .\n\nend (* Simple Network Rename Defs *)\n\nlocale Simple_Network_Rename' =\n Simple_Network_Rename_Defs where automata = automata for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, 't, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, 't) cconstraint) list) list\" +\n assumes bij_renum_clocks: \"bij renum_clocks\"\n and renum_states_inj: \"\\p 's list\n \\ (('a :: countable) act, 's, 'c, real, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, real) cconstraint) list) list\" +\n assumes urgency_removed: \"\\i < n_ps. urgent (N i) = {}\"\nbegin\n\nlemma aux_1:\n \"(\\x. case case x of\n (l, g) \\ (renum_states p l, renum_cconstraint g) of\n (s, cc) \\ (s, map conv_ac cc))\n = (\\ (l, g). (renum_states p l, map conv_ac (renum_cconstraint g)))\n\"\n by auto\n\nlemma clocks_inv_inv:\n \"clocks_inv (renum_clocks a) = a\"\n unfolding clocks_inv_def by (subst the_inv_f_f; rule bij_renum_clocks[THEN bij_is_inj] HOL.refl)\n\nlemma map_u_renum_cconstraint_clock_valI:\n \"map_u u \\ renum_cconstraint cc\" if \"u \\ cc\"\n using that\n unfolding clock_val_def list_all_length\n unfolding renum_cconstraint_def map_cconstraint_def\n unfolding map_u_def\n apply clarsimp\n subgoal for n\n by (cases \"cc ! n\") (auto 4 4 simp: clocks_inv_inv split: acconstraint.split)\n done\n\nlemma map_u_renum_cconstraint_clock_valD:\n \"u \\ cc\" if \"map_u u \\ renum_cconstraint cc\"\n using that\n unfolding clock_val_def list_all_length\n unfolding renum_cconstraint_def map_cconstraint_def\n unfolding map_u_def\n apply clarsimp\n subgoal for n\n by (cases \"cc ! n\") (auto 4 4 simp: clocks_inv_inv split: acconstraint.split)\n done\n\nlemma inj_renum_states: \"inj (renum_states p)\" if \"p < n_ps\"\n using renum_states_inj \\p < n_ps\\ by blast\n\nlemma inv_renum_sem_I:\n assumes\n \"u \\ Simple_Network_Language.inv (N p) l\" \"p < n_ps\" \"l \\ loc_set\"\n shows\n \"map_u u \\ Simple_Network_Language.inv (renum.N p) (renum_states p l)\"\n using assms\n unfolding inv_def\n apply -\n apply (subst (asm) N_eq, assumption)\n apply (subst renum.N_eq, subst renum_n_ps_simp, assumption)\n apply (subst nth_map_index, simp add: n_ps_def)\n unfolding conv_automaton_def automaton_of_def\n apply (auto split: prod.split_asm simp: renum_automaton_def comp_def)\n unfolding aux_1\n apply (subst default_map_of_map[where x = \"[]\"])\n subgoal\n by (intro inj_renum_states \\p < n_ps\\)\n apply (simp add: renum_cconstraint_def map_cconstraint_def; fail)\n apply (erule map_u_renum_cconstraint_clock_valI)\n done\n\nlemma inv_renum_sem_D:\n assumes\n \"map_u u \\ Simple_Network_Language.inv (renum.N p) (renum_states p l)\" \"p < n_ps\" \"l \\ loc_set\"\n shows\n \"u \\ Simple_Network_Language.inv (N p) l\"\n using assms\n unfolding inv_def\n apply -\n apply (subst N_eq, assumption)\n apply (subst (asm) renum.N_eq, subst renum_n_ps_simp, assumption)\n apply (subst (asm) nth_map_index, simp add: n_ps_def)\n unfolding conv_automaton_def automaton_of_def\n apply (auto split: prod.split simp: renum_automaton_def comp_def)\n unfolding aux_1\n apply (subst (asm) default_map_of_map[where x = \"[]\"])\n subgoal\n by (intro inj_renum_states \\p < n_ps\\)\n apply (simp add: renum_cconstraint_def map_cconstraint_def; fail)\n apply (erule map_u_renum_cconstraint_clock_valD)\n done\n\nlemma dom_the_inv_comp:\n \"dom (m o the_inv f) = f ` dom m\" if \"inj f\" \"range f = UNIV\"\n unfolding dom_def\n apply auto\n subgoal for x y\n apply (subgoal_tac \"f (the_inv f x) = x\")\n apply force\n using that by (auto intro: f_the_inv_f)\n subgoal for x y\n using that by (auto simp: the_inv_f_f)\n done\n\nlemma inj_renum_vars:\n \"inj renum_vars\"\n using bij_renum_vars unfolding bij_def ..\n\nlemma surj_renum_vars:\n \"surj renum_vars\"\n using bij_renum_vars unfolding bij_def ..\n\nlemma map_of_inv_map:\n \"map_of xs (the_inv f x) = map_of (map (\\ (a, b). (f a, b)) xs) x\"\n if \"inj f\" \"surj f\" \"the_inv f x \\ dom (map_of xs)\"\n apply (subgoal_tac \"x = f (the_inv f x)\")\n subgoal premises prems\n using domD[OF that(3)] \\inj f\\\n apply (subst (2) prems)\n apply safe\n apply (subst map_of_mapk_SomeI; assumption)\n done\n subgoal\n apply (rule sym, rule f_the_inv_f)\n using that by auto\n done\n\nlemma dom_vars_invD:\n assumes \"x \\ dom (s \\ vars_inv)\"\n shows \"x \\ renum_vars ` dom s\" (is ?A) and \"the_inv renum_vars x \\ dom s\" (is ?B)\nproof -\n show ?A\n using assms unfolding vars_inv_def dom_the_inv_comp[OF inj_renum_vars surj_renum_vars] .\n then show ?B\n apply (elim imageE)\n apply simp\n apply (subst the_inv_f_f, rule inj_renum_vars, assumption)\n done\nqed\n\nlemma bounded_renumI:\n assumes \"bounded (map_of bounds') s\"\n shows \"bounded (map_of (map (\\(a, y). (renum_vars a, y)) bounds')) (s o vars_inv)\"\n using assms unfolding bounded_def\n apply elims\n apply intros\n subgoal\n unfolding dom_map_of_conv_image_fst vars_inv_def\n by (auto intro!: image_cong simp: dom_the_inv_comp[OF inj_renum_vars surj_renum_vars] image_comp)\n subgoal for x\n apply (frule dom_vars_invD)\n apply (frule dom_vars_invD(2))\n apply (drule bspec, assumption)\n apply (auto simp: map_of_inv_map[OF inj_renum_vars surj_renum_vars] vars_inv_def)\n done\n subgoal for x\n apply (frule dom_vars_invD)\n apply (frule dom_vars_invD(2))\n apply (drule bspec, assumption)\n apply (auto simp: map_of_inv_map[OF inj_renum_vars surj_renum_vars] vars_inv_def)\n done\n done\n\nlemma map_of_renum_vars_simp:\n assumes\n \"dom (s o vars_inv)\n = dom (map_of (map (\\(a, y). (renum_vars a, y)) bounds'))\"\n \"x \\ dom s\" \"dom s \\ var_set\"\n shows \"map_of (map (\\(a, y). (renum_vars a, y)) bounds') (renum_vars x) = map_of bounds' x\"\nproof -\n have *:\n \"map (\\(a, y). (renum_vars a, y)) bounds' = map (\\(a, y). (renum_vars a, y)) bounds'\"\n by auto\n have \"x \\ dom (map_of bounds')\"\n unfolding dom_map_of_conv_image_fst\n using assms\n unfolding vars_inv_def\n apply -\n apply (subst (asm) dom_the_inv_comp, rule inj_renum_vars, rule surj_renum_vars)\n apply (subst (asm) dom_map_of_map)\n apply auto\n apply (subst (asm) inj_on_image_eq_iff[OF inj_renum_vars])\n by auto\n then obtain y where \"map_of bounds' x = Some y\"\n by auto\n then show ?thesis\n by (subst map_of_mapk_SomeI) (auto intro: inj_renum_vars)\nqed\n\nlemma bounded_renumD:\n assumes\n \"Simple_Network_Language.bounded\n (map_of (map (\\(a, y). (renum_vars a, y)) bounds')) (s o vars_inv)\"\n and \"dom s \\ var_set\"\n shows \"Simple_Network_Language.bounded (map_of bounds') s\"\nproof -\n show ?thesis\n using assms(1)\n unfolding bounded_def\n apply elims\n apply intros\n subgoal\n unfolding vars_inv_def\n apply (subst (asm) dom_the_inv_comp[OF inj_renum_vars surj_renum_vars])\n apply (subst (asm) dom_map_of_map)\n apply (rule inj_image_eqI[OF inj_renum_vars], simp add: dom_map_of_conv_image_fst)\n done\n subgoal for x\n using assms(2) unfolding vars_inv_def\n apply (subst (asm) (2) dom_the_inv_comp[OF inj_renum_vars surj_renum_vars])\n apply (drule bspec, erule imageI)\n apply (simp add: the_inv_f_f[OF inj_renum_vars] map_of_renum_vars_simp[unfolded vars_inv_def])\n done\n subgoal for x\n using assms(2) unfolding vars_inv_def\n apply (subst (asm) (2) dom_the_inv_comp[OF inj_renum_vars surj_renum_vars])\n apply (drule bspec, erule imageI)\n apply (simp add: the_inv_f_f[OF inj_renum_vars] map_of_renum_vars_simp[unfolded vars_inv_def])\n done\n done\nqed\n\nlemma dom_bounds_var_set: \"dom bounds = var_set\"\n unfolding dom_bounds using bounds'_var_set .\n\nlemma sem_states_loc_setD: \"L ! p \\ loc_set\" if \"p < length automata\" \"L \\ states\" for L p\n using that states_loc_set by (force simp: n_ps_def)\n\nlemma trans_N_renumD:\n assumes \"(l, b, g, a, f, r, l') \\ Simple_Network_Language.trans (N p)\" \"p < n_ps\"\n shows \"(renum_states p l, renum_bexp b, renum_cconstraint g, renum_act a, renum_upd f, renum_reset r, renum_states p l')\n \\ Simple_Network_Language.trans (renum.N p)\"\n using assms\n unfolding mem_trans_N_iff[OF assms(2)] renum.mem_trans_N_iff[unfolded renum_n_ps_simp, OF assms(2)]\n by (force split: prod.split simp: renum_automaton_def n_ps_def)\n\nlemma match_assumption2:\n assumes \"P a1 b1\" \"a1 = a\" \"b1 = b\" shows \"P a b\"\n using assms by auto\n\nlemma inj_pair:\n assumes \"inj f\" \"inj g\"\n shows \"inj (\\(a, b). (f a, g b))\"\n using assms unfolding inj_on_def by auto\n\nlemma injective_functions:\n \"inj renum_reset\" \"inj renum_upd\" \"inj renum_act\" \"inj renum_cconstraint\" \"inj renum_bexp\"\n \"\\p. p < length automata \\ inj (renum_states p)\"\n subgoal\n unfolding renum_reset_def using bij_renum_clocks[THEN bij_is_inj] by simp\n subgoal\n unfolding renum_upd_def renum_exp_def using bij_renum_vars[THEN bij_is_inj]\n by (intro inj_pair exp.inj_map inj_mapI)\n subgoal\n unfolding renum_act_def using inj_renum_acts by (rule act.inj_map)\n subgoal\n unfolding renum_cconstraint_def map_cconstraint_def\n by (intro inj_mapI acconstraint.inj_map bij_renum_clocks bij_is_inj bij_id)\n subgoal\n unfolding renum_bexp_def by (intro bexp.inj_map inj_renum_vars)\n subgoal\n by (rule inj_renum_states, simp add: n_ps_def)\n done\n\nlemma trans_N_renumI:\n assumes \"(\n renum_states p l, renum_bexp b, renum_cconstraint g, renum_act a, renum_upd f, renum_reset r,\n renum_states p l')\n \\ trans (renum.N p)\" \"p < n_ps\"\n shows \"(l, b, g, a, f, r, l') \\ trans (N p)\"\n using assms\n unfolding mem_trans_N_iff[OF assms(2)] renum.mem_trans_N_iff[unfolded renum_n_ps_simp, OF assms(2)]\n apply (clarsimp split: prod.split_asm simp: renum_automaton_def n_ps_def)\n apply (fo_rule match_assumption2, assumption)\n apply (auto elim!: injD[rotated, THEN sym] intro: injective_functions)\n done\n\nlemma renum_acconstraint_eq_convD:\n assumes \"map_acconstraint renum_clocks id g = conv_ac g'\"\n obtains g1 where \"g = conv_ac g1\" \"g' = map_acconstraint renum_clocks id g1\"\n subgoal premises\n using assms\n apply (cases g'; cases g; clarsimp)\n subgoal for m c\n by (rule that[of \"acconstraint.LT c m\"]; simp)\n subgoal for m c\n by (rule that[of \"acconstraint.LE c m\"]; simp)\n subgoal for m c\n by (rule that[of \"acconstraint.EQ c m\"]; simp)\n subgoal for m c\n by (rule that[of \"acconstraint.GT c m\"]; simp)\n subgoal for m c\n by (rule that[of \"acconstraint.GE c m\"]; simp)\n done\n done\n\nlemma renum_cconstraint_eq_convD:\n assumes \"renum_cconstraint g = conv_cc g'\"\n obtains g1 where \"g = conv_cc g1\" \"g' = renum_cconstraint g1\"\nproof -\n let ?f = \"\\(ac, ac'). SOME ac1. ac = conv_ac ac1 \\ ac' = map_acconstraint renum_clocks id ac1\"\n let ?g = \"map ?f (zip g g')\"\n from assms have \"length g = length g'\"\n unfolding renum_cconstraint_def map_cconstraint_def by -(drule arg_cong[where f = length], simp)\n then have \"g = conv_cc ?g \\ g' = renum_cconstraint ?g\"\n using assms\n by (simp add: comp_def renum_cconstraint_def map_cconstraint_def)\n (induction rule: list_induct2; simp; elim conjE renum_acconstraint_eq_convD; smt someI)\n then show ?thesis\n by (blast intro: that)\nqed\n\nlemma trans_sem_N_renumI:\n assumes \"(\n renum_states p l, renum_bexp b, renum_cconstraint g, renum_act a, renum_upd f, renum_reset r,\n renum_states p l')\n \\ trans (renum.N p)\" \"p < n_ps\"\n shows \"(l, b, g, a, f, r, l') \\ trans (N p)\"\n using assms(1) \\p < n_ps\\ by (simp add: trans_N_renumI)\n\nlemma trans_sem_N_renumI':\n assumes \"(renum_states p l, b, g, a, f, r, l') \\ trans (renum.N p)\" \"p < n_ps\"\n shows \"\\ b' g' a' f' r' l1.\n (l, b', g', a', f', r', l1) \\ Simple_Network_Language.trans (N p)\n \\ b = renum_bexp b' \\ g = renum_cconstraint g' \\ a = renum_act a' \\ f = renum_upd f'\n \\ r = renum_reset r' \\ l' = renum_states p l1\"\nproof -\n obtain b' g' a' f' r' l1 where \"b = renum_bexp b'\" \"g = renum_cconstraint g'\" \"f = renum_upd f'\"\n \"a = renum_act a'\" \"r = renum_reset r'\" \"l' = renum_states p l1\"\n using assms\n unfolding N_eq[OF assms(2)] renum.N_eq[unfolded renum_n_ps_simp, OF assms(2)]\n apply (subst (asm) nth_map_index)\n subgoal\n by (simp add: n_ps_def)\n unfolding renum_automaton_def automaton_of_def trans_def by (auto split: prod.split_asm)\n with assms show ?thesis\n by (fastforce dest!: trans_sem_N_renumI)\nqed\n\nlemma committed_renum_eq:\n \"committed (renum.N p) = renum_states p ` committed (N p)\" if \"p < n_ps\"\n unfolding\n committed_def N_eq[OF \\p < n_ps\\] renum.N_eq[unfolded renum_n_ps_simp, OF \\p < n_ps\\]\n apply (subst nth_map_index)\n subgoal\n using \\p < n_ps\\ by (simp add: n_ps_def)\n unfolding automaton_of_def conv_automaton_def renum_automaton_def by (simp split: prod.split)\n\nlemma urgent_renum_eq:\n \"urgent (renum.N p) = renum_states p ` urgent (N p)\" if \"p < n_ps\"\n unfolding\n urgent_def N_eq[OF \\p < n_ps\\] renum.N_eq[unfolded renum_n_ps_simp, OF \\p < n_ps\\]\n apply (subst nth_map_index)\n subgoal\n using \\p < n_ps\\ by (simp add: n_ps_def)\n unfolding automaton_of_def conv_automaton_def renum_automaton_def by (simp split: prod.split)\n\nlemma renum_urgency_removed:\n \"\\i < n_ps. urgent (renum.N i) = {}\"\n using urgency_removed\n apply intros\n apply (simp only: urgent_renum_eq)\n apply simp\n done\n\nlemma check_bexp_renumD:\n \"check_bexp s b bv \\ check_bexp (s o vars_inv) (renum_bexp b) bv\"\nand is_val_renumD:\n \"is_val s e v \\ is_val (s o vars_inv) (renum_exp e) v\"\n apply (induction rule: check_bexp_is_val.inducts)\n apply (auto\n intro: check_bexp_is_val.intros\n simp: renum_bexp_def renum_exp_def vars_inv_def the_inv_f_f[OF inj_renum_vars])\n using is_val.simps apply fastforce+\n done\n\nmethod solve_case =\n auto \n intro: check_bexp_is_val.intros\n simp: renum_bexp_def renum_exp_def vars_inv_def the_inv_f_f[OF inj_renum_vars];\n fail\n| use is_val.simps in fastforce\n\nlemma check_bexp_renumI:\n \"check_bexp (s o vars_inv) (renum_bexp b) bv \\ check_bexp s b bv\"\n and is_val_renumI:\n \"is_val (s o vars_inv) (renum_exp e) v \\ is_val s e v\"\n apply (induction\n \"s o vars_inv\" \"renum_bexp b\" bv and \"s o vars_inv\" \"renum_exp e\" _\n arbitrary: b and e rule: check_bexp_is_val.inducts)\n subgoal for b\n by (cases b; solve_case)\n subgoal for e bv b\n by (cases b; solve_case)\n subgoal for e1 a e2 bv b\n by (cases b; solve_case)\n subgoal for e1 a e2 bv b\n by (cases b; solve_case)\n subgoal for e1 a e2 bv b\n by (cases b; solve_case)\n subgoal for a v bv x b\n by (cases b; solve_case)\n subgoal for a v bv x b\n by (cases b; solve_case)\n subgoal for a v bv x b\n by (cases b; solve_case)\n subgoal for a v bv x b\n by (cases b; solve_case)\n subgoal for a v bv x b\n by (cases b; solve_case)\n subgoal for c e\n by (cases e; solve_case)\n subgoal for x v e\n by (cases e; solve_case)\n subgoal for e1 v1 e2 v2 b bv e\n by (auto simp: renum_bexp_def renum_exp_def; cases e; solve_case)\n subgoal for e1 v1 e2 v2 f e\n by (auto simp: renum_bexp_def renum_exp_def; cases e; solve_case)\n subgoal for e1 v f e\n by (cases e; solve_case)\n done\n\nlemma renum_reset_map_u:\n \"[renum_reset r\\0]map_u u = map_u ([r\\0]u)\"\n unfolding map_u_def\n apply (rule ext)\n subgoal for x\n apply (cases \"clocks_inv x \\ set r\"; simp add: clocks_inv_def)\n subgoal\n using bij_renum_clocks[THEN bij_is_surj]\n by (auto\n simp: renum_reset_def f_the_inv_f[OF bij_is_inj, OF bij_renum_clocks]\n dest: imageI[where f = renum_clocks]\n )\n subgoal\n by (subst clock_set_id)\n (auto simp: renum_reset_def the_inv_f_f[OF bij_is_inj, OF bij_renum_clocks])\n done\n done\n\nlemma bounded_renumI':\n assumes \"bounded bounds s'\"\n shows \"bounded renum.bounds (s' o vars_inv)\"\n using assms unfolding renum.bounds_def bounds_def by (simp add: bounded_renumI)\n\nlemma bounded_renumD':\n assumes \"bounded renum.bounds (s' o vars_inv)\" \"dom s' \\ var_set\"\n shows \"bounded bounds s'\"\n using assms unfolding renum.bounds_def bounds_def by (simp add: bounded_renumD)\n\nlemma is_upd_renumD:\n assumes \"is_upd s f s'\"\n shows \"is_upd (s o vars_inv) (renum_upd f) (s' o vars_inv)\"\n using assms\n unfolding is_upd_def\n apply clarsimp\n subgoal for xs\n apply (inst_existentials \"map (\\(x,v). (renum_vars x, v)) xs\")\n apply (clarsimp elim!: list_all2_mono is_val_renumD simp: list.rel_map renum_upd_def; fail)\n apply (rule ext)\n subgoal premises prems for a\n apply (induction xs arbitrary: s)\n apply (simp; fail)\n apply simp\n apply (fo_rule arg_cong2)\n apply (auto 4 4\n simp: bij_f_the_inv_f[OF bij_renum_vars] the_inv_f_f[OF inj_renum_vars] vars_inv_def)\n done\n done\n done\n\nlemma is_upds_renumD:\n assumes \"is_upds s1 ps s'\"\n shows \"is_upds (s1 o vars_inv) (map renum_upd ps) (s' o vars_inv)\"\n using assms by induction (auto intro: is_upds.intros simp: comp_def dest!: is_upd_renumD)\n\nlemma Ball_mono:\n assumes \"\\x \\ S. P x\" \"\\x. x \\ S \\ P x \\ Q x\"\n shows \"\\x \\ S. Q x\"\n using assms by blast\n\nlemma atLeastLessThan_upperD:\n assumes \"S \\ {l.. S\"\n shows \"x < u\"\n using assms by auto\n\nlemma imp_mono_rule:\n assumes \"P1 \\ P2\"\n and \"Q1 \\ P1\"\n and \"Q1 \\ P2 \\ Q2\"\n shows \"Q1 \\ Q2\"\n using assms by blast\n\nlemma inj_id:\n \"inj id\"\n by auto\n\nlemma step_single_renumD:\n assumes \"step_u sem L s u a L' s' u'\" \"L \\ states\" \"dom s \\ var_set\"\n shows \"step_u renum.sem\n (map_index renum_states L) (s o vars_inv) (map_u u)\n (renum_label a)\n (map_index renum_states L') (s' o vars_inv) (map_u u')\"\n using assms(1-3)\n apply (cases a)\n\n supply [simp del] = map_map_index set_map\n (* to keep the simplifier from breaking through locale abstractions *)\n\n(* Delay *)\n subgoal\n supply [simp] = length_automata_eq_n_ps L_len\n apply (subst (asm) A_split)\n apply (subst renum.A_split)\n apply (simp only: renum_label_def label.map renum_n_ps_simp)\n apply (erule step_u_elims')\n apply simp\n apply (rule step_u.intros)\n subgoal\n by auto_tag (auto 4 3 simp: dest: inv_renum_sem_I[OF _ _ sem_states_loc_setD])\n subgoal\n by assumption\n subgoal\n using renum_urgency_removed by - (tag, auto)\n subgoal\n by auto_tag (rule bounded_renumI')\n done\n\n(* Internal *)\n subgoal for a'\n supply [simp] = length_automata_eq_n_ps L_len\n apply (subst (asm) A_split)\n apply (subst renum.A_split)\n apply (simp only: renum_label_def label.map renum_n_ps_simp)\n apply (erule step_u_elims')\n unfolding TAG_def[of \"''range''\"]\n apply simp\n apply (rule step_u.intros)\n apply (auto_tag, drule (1) trans_N_renumD, subst nth_map, (simp add: renum_act_def)+; fail)\n subgoal\n by auto_tag (auto simp: committed_renum_eq dest!: inj_renum_states[THEN injD, rotated])\n subgoal\n by auto_tag (erule check_bexp_renumD)\n subgoal\n by auto_tag (rule map_u_renum_cconstraint_clock_valI)\n subgoal\n apply (auto_tag keep: TAG[of \"''new loc''\"] TAG[of \"TRANS ''silent''\"])\n apply clarsimp\n apply (rule inv_renum_sem_I[OF _ _ sem_states_loc_setD[OF _ state_preservation_updI]])\n apply fastforce+\n done\n apply (auto_tag, simp; fail)\n apply (auto_tag, simp; fail)\n apply (auto_tag, rule map_index_update; fail)\n apply (auto_tag, simp add: renum_reset_map_u; fail)\n subgoal\n by (auto_tag, erule is_upd_renumD)\n apply (auto_tag, erule bounded_renumI'; fail)\n done\n\n(* Binary *)\n subgoal for a'\n supply [simp] = length_automata_eq_n_ps L_len\n apply (subst (asm) A_split)\n apply (subst renum.A_split)\n apply (simp only: renum_label_def label.map renum_n_ps_simp)\n apply (erule step_u_elims')\n unfolding TAG_def[of \"RECV ''range''\"] TAG_def[of \"SEND ''range''\"]\n apply simp\n apply (rule step_u.intros)\n subgoal\n apply auto_tag\n unfolding renum.broadcast_def\n apply (clarsimp simp: set_map)\n apply (drule injD[OF inj_renum_acts])\n apply (subst (asm) broadcast_def, simp)\n done\n\n apply (auto_tag, drule (1) trans_N_renumD, subst nth_map, (simp add: renum_act_def)+; fail)\n apply (auto_tag, drule (1) trans_N_renumD, subst nth_map, (simp add: renum_act_def)+; fail)\n subgoal\n by auto_tag (auto simp: committed_renum_eq dest!: inj_renum_states[THEN injD, rotated])\n\n subgoal\n by auto_tag (erule check_bexp_renumD)\n\n subgoal\n by auto_tag (erule check_bexp_renumD)\n\n subgoal\n by auto_tag (rule map_u_renum_cconstraint_clock_valI)\n\n subgoal\n by auto_tag (rule map_u_renum_cconstraint_clock_valI)\n\n subgoal\n apply (auto_tag keep: TAG[of \"''new loc''\"] TAG[of \"TRANS _\"])\n apply clarsimp\n apply (rule inv_renum_sem_I[OF _ _ sem_states_loc_setD[OF _ state_preservation_updI]])\n apply (fastforce intro!: state_preservation_updI)+\n done\n apply (all \\auto_tag\\)\n apply (simp; fail)+\n apply (simp add: map_index_update; fail)\n apply (simp add: renum_reset_map_u[symmetric] renum_reset_def; fail)\n apply (erule is_upd_renumD; fail)\n apply (erule is_upd_renumD; fail)\n apply (erule bounded_renumI'; fail)\n done\n\n\n(* Broadcast *)\n subgoal for a'\n supply [simp] = length_automata_eq_n_ps L_len\n apply (subst (asm) A_split)\n apply (subst renum.A_split)\n apply (simp only: renum_label_def label.map renum_n_ps_simp)\n apply (erule step_u_elims')\n apply simp\n unfolding TAG_def[of \"SEND ''range''\"]\n\n apply (rule step_u.intros)\n\n(* Action is broadcast *)\n subgoal\n apply (tag keep: TAG[of \"''broadcast''\"])\n unfolding renum.broadcast_def by (subst (asm) broadcast_def, simp add: set_map)\n\n apply (auto_tag, simp, drule (1) trans_N_renumD, subst nth_map, (simp add: renum_act_def)+; fail)\n\n apply (tag keep: TAG[of \"TRANS ''in''\"] TAG[of \"SEL _\"])\n apply (auto dest!: trans_N_renumD simp add: renum_act_def atLeastLessThan_upperD; fail)\n\n(* Condition for committed locations *)\n subgoal\n apply (tag keep: TAG[of \"SEL _\"] TAG[of \"''committed''\"])\n apply (simp add: committed_renum_eq)\n apply (erule disj_mono[rule_format, rotated 2], (simp; fail))\n apply (erule disj_mono[rule_format, rotated 2])\n subgoal\n apply clarify\n apply (rule rev_bexI, assumption)\n apply (auto simp: committed_renum_eq)\n done\n apply (auto simp: committed_renum_eq dest!: inj_renum_states[THEN injD, rotated]; fail)\n done\n\n apply (tag keep: TAG[of \"''bexp''\"], erule check_bexp_renumD; fail)\n apply (tag keep: TAG[of \"''bexp''\"], auto elim: check_bexp_renumD; fail)\n apply (tag keep: TAG[of \"''guard''\"], erule map_u_renum_cconstraint_clock_valI; fail)\n apply (tag keep: TAG[of \"''guard''\"], auto elim: map_u_renum_cconstraint_clock_valI; fail)\n\n(* Set of broadcast receivers is maximal *)\n subgoal\n apply (tag keep: TAG[of \"''maximal''\"])\n apply simp\n apply (erule all_mono[THEN mp, OF impI, rotated])\n apply (erule (1) imp_mono_rule)\n apply (erule (1) imp_mono_rule)\n apply clarify\n apply (drule trans_sem_N_renumI', assumption)\n apply (clarsimp simp: renum_act_def)\n apply (drule check_bexp_renumI)\n apply (drule InD2[OF inj_renum_acts])\n apply (fastforce dest!: map_u_renum_cconstraint_clock_valD)\n done\n\n(* Target invariant *)\n subgoal for l b g f r l' p ps bs gs fs rs ls' s'\n apply (tag keep: TAG[of \"''target invariant''\"] TAG[of \"SEL _\"] TAG[of \"''new loc''\"] TAG[of \"TRANS _\"])\n apply (subgoal_tac \"fold (\\p L. L[p := ls' p]) ps L \\ states\")\n subgoal\n apply simp\n apply (erule all_mono[THEN mp, OF impI, rotated], erule (1) imp_mono_rule, drule (1) inv_renum_sem_I)\n subgoal\n apply (rule sem_states_loc_setD, simp)\n apply (rule state_preservation_updI)\n subgoal\n by blast\n .\n subgoal\n apply (fo_rule match_assumption2[where P = clock_val], assumption, rule HOL.refl)\n apply (drule states_lengthD, simp)\n done\n done\n subgoal\n apply (rule state_preservation_fold_updI)\n apply (erule Ball_mono)\n apply (simp add: atLeastLessThan_upperD; blast)\n by simp\n done\n apply (tag keep: TAG[of \"SEND ''loc''\"], simp add: TAG_def; fail)\n apply (tag, simp add: TAG_def; fail)\n apply (tag keep: TAG[of \"SEL _\"], simp add: TAG_def; fail)\n apply (tag keep: TAG[of \"SEL _\"], simp add: TAG_def; fail)\n apply (auto_tag; fail)\n apply (auto_tag; fail)\n\n apply (tag keep: TAG[of \"''new loc''\"])\n apply (simp add: map_trans_broad_aux1[symmetric] map_index_update; fail)\n apply (tag keep: TAG[of \"''new valuation''\"])\n apply (simp add: renum_reset_map_u[symmetric] renum_reset_def map_concat comp_def; fail)\n apply (tag keep: TAG[of \"''upd''\"], erule is_upd_renumD; fail)\n apply (tag keep: TAG[of \"''upds''\"], drule is_upds_renumD, simp add: comp_def; fail)\n apply (tag keep: TAG[of \"''bounded''\"], erule bounded_renumI'; fail)\n done\n done\n\nlemma inj_the_inv:\n \"inj (the_inv f)\" if \"bij f\"\n by (auto simp: bij_f_the_inv_f[OF that] dest: arg_cong[where f = f] intro!: injI)\n\nlemma inj_vars_inv:\n \"inj vars_inv\"\n using bij_renum_vars unfolding vars_inv_def by (rule inj_the_inv)\n\nlemma comp_vars_inv_upd_commute:\n \"(s o vars_inv)(x \\ y) = s(vars_inv x \\ y) o vars_inv\"\n by (intro ext) (auto dest: injD[OF inj_vars_inv])\n\nlemma is_upd_renumI:\n assumes \"is_upd (s o vars_inv) (renum_upd f) s'\"\n shows \"is_upd s f (s' o renum_vars)\"\n using assms\n unfolding is_upd_def\n apply clarsimp\n subgoal for xs\n apply (inst_existentials \"map (\\(x,v). (vars_inv x, v)) xs\")\n apply (clarsimp elim!: list_all2_mono dest!: is_val_renumI simp: list.rel_map renum_upd_def,\n simp add: the_inv_f_f[OF inj_renum_vars] vars_inv_def; fail)\n apply (rule ext)\n subgoal premises prems for a\n apply (induction xs arbitrary: s)\n apply (simp add: the_inv_f_f[OF inj_renum_vars] vars_inv_def; fail)\n apply (auto simp: comp_vars_inv_upd_commute)\n done\n done\n done\n\nlemma is_upd_renumI':\n assumes \"is_upd (s o vars_inv) (renum_upd f) s'\"\n obtains s1 where \"is_upd s f s1\" \"s1 = s' o renum_vars\"\n by (simp add: assms is_upd_renumI)\n\nlemma is_upd_renumI'':\n assumes \"is_upd s (renum_upd f) s'\"\n shows \"is_upd (s o renum_vars) f (s' o renum_vars)\"\nproof -\n have \"s = (s o renum_vars) o vars_inv\"\n by (intro ext) (auto simp: bij_f_the_inv_f[OF bij_renum_vars] vars_inv_def)\n with assms show ?thesis\n by (intro is_upd_renumI) simp\nqed\n\nlemma is_upds_renumI:\n assumes \"is_upds (s o vars_inv) (map renum_upd upds) s'\"\n shows \"\\s1. is_upds s upds s1 \\ s1 = s' o renum_vars\"\n using assms apply (induction \"s o vars_inv\" \"map renum_upd upds\" s' arbitrary: upds s)\n subgoal for upds s\n apply auto\n apply (subgoal_tac \"s o vars_inv o renum_vars = s\")\n apply (auto intro: is_upds.intros simp: comp_def)\n apply (rule ext)\n apply (simp add: vars_inv_def the_inv_f_f[OF inj_renum_vars])\n done\n\n apply clarsimp\n apply (erule is_upd_renumI')\n apply (auto simp: vars_inv_def bij_f_the_inv_f[OF bij_renum_vars] comp_def intro!: is_upds.intros)\n done\n\nlemma is_upds_renumI'':\n assumes \"is_upds s (map renum_upd ps) s'\"\n shows \"is_upds (s o renum_vars) ps (s' o renum_vars)\"\n using assms\n by (induction \"map renum_upd ps\" s' arbitrary: ps) (auto intro: is_upd_renumI'' is_upds.intros)\n\nlemma bounded_renumD1:\n assumes \"bounded renum.bounds s'\" \"dom (s' \\ renum_vars) \\ var_set\"\n shows \"bounded bounds (s' o renum_vars)\"\n using assms\n by (intro bounded_renumD') (auto simp: vars_inv_def bij_f_the_inv_f[OF bij_renum_vars] comp_def)\n\nlemma renum_reset_append:\n \"renum_reset xs @ renum_reset ys = renum_reset (xs @ ys)\"\n unfolding renum_reset_def by simp\n\nlemma if_eq_distrib:\n \"(if i = j then f i a else f j b) = (f j (if i = j then a else b))\"\n by auto\n\nlemma dom_comp_eq_vimage:\n \"dom (s o f) = f -` dom s\"\n unfolding dom_def by auto\n\nlemma dom_comp_vars_inv_eqD:\n assumes \"dom s' = dom (s o vars_inv)\"\n shows \"dom (s' o renum_vars) = dom s\"\n using assms inj_renum_vars surj_renum_vars unfolding vars_inv_def\n by (subst (asm) dom_the_inv_comp) (auto simp: dom_comp_eq_vimage dest: injD)\n\nlemma sem_trans_upd_domD:\n assumes \"(L ! p, b, g', a, f, r, l1) \\ trans (N p)\" \"p < n_ps\"\n shows \"fst ` set f \\ var_set\"\nproof -\n from assms have \"fst ` set f \\ var_set\"\n unfolding var_set_def\n apply -\n apply (rule semilattice_sup_class.sup.coboundedI2)\n apply clarsimp\n apply (inst_existentials \"(fst \\ snd \\ snd \\ snd \\ snd) ` trans (N p)\" p)\n apply force+\n done\n then show ?thesis .\nqed\n\nlemma SilD:\n fixes map_action\n assumes \"Sil a = map_act map_action a1\"\n obtains a' where \"a1 = Sil a'\" \"a = map_action a'\"\n using assms by (cases a1) auto\n\nlemma InD:\n fixes map_action\n assumes \"In a = map_act map_action a1\"\n obtains a' where \"a1 = In a'\" \"a = map_action a'\"\n using assms by (cases a1) auto\n\nlemma OutD:\n fixes map_action\n assumes \"Out a = map_act map_action a1\"\n obtains a' where \"a1 = Out a'\" \"a = map_action a'\"\n using assms by (cases a1) auto\n\nlemma In_OutD:\n assumes \"In a = renum_act a1\" \"Out a = renum_act a2\"\n obtains a' where \"a = renum_acts a'\" \"a1 = In a'\" \"a2 = Out a'\"\n using assms unfolding renum_act_def by (elim InD OutD) (auto simp: injD[OF inj_renum_acts])\n\nlemma renum_sem_broadcast_eq:\n \"renum.broadcast = renum_acts ` set broadcast\"\n unfolding renum.broadcast_def by simp\n\nlemma inj_eq_iff:\n \"f x = f y \\ x = y\" if \"inj f\"\n using that unfolding inj_def by auto\n\nlemma trans_sem_N_renum_broadcastI:\n assumes\n \"\\p\\set ps. (renum_states p (L ! p), bs p, gs p, In a, fs p, rs p, ls p) \\ trans (renum.N p)\"\n \"set ps \\ {0..p\\set ps. (L ! p, bs' p, gs' p, In a', fs' p, rs' p, ls' p) \\ trans (N p)\"\n \"\\p\\set ps. bs p = renum_bexp (bs' p)\"\n \"\\p\\set ps. gs p = renum_cconstraint (gs' p)\"\n \"ps \\ [] \\ a = renum_acts a'\"\n \"\\p\\set ps. fs p = renum_upd (fs' p)\"\n \"\\p\\set ps. rs p = renum_reset (rs' p)\"\n \"\\p\\set ps. ls p = renum_states p (ls' p)\"\nproof -\n define t where\n \"t p \\ SOME (b', g', a', f', r', l1). (L ! p, b', g', a', f', r', l1) \\ trans (N p)\n \\ bs p = renum_bexp b' \\ gs p = renum_cconstraint g' \\ In a = renum_act a' \\ fs p = renum_upd f'\n \\ rs p = renum_reset r' \\ ls p = renum_states p l1\" for p\n define bs' where \"bs' p \\ case t p of (b', g', a', f', r', l1) \\ b'\" for p\n define gs' where \"gs' p \\ case t p of (b', g', a', f', r', l1) \\ g'\" for p\n define as' where \"as' p \\ case t p of (b', g', a', f', r', l1) \\ a'\" for p\n define fs' where \"fs' p \\ case t p of (b', g', a', f', r', l1) \\ f'\" for p\n define rs' where \"rs' p \\ case t p of (b', g', a', f', r', l1) \\ r'\" for p\n define ls' where \"ls' p \\ case t p of (b', g', a', f', r', l1) \\ l1\" for p\n\n have *: \"case t p of (b', g', a', f', r', l1) \\\n (L ! p, b', g', a', f', r', l1) \\ trans (N p)\n \\ bs p = renum_bexp b' \\ gs p = renum_cconstraint g' \\ In a = renum_act a' \\ fs p = renum_upd f'\n \\ rs p = renum_reset r' \\ ls p = renum_states p l1\" if \"p \\ set ps\" for p\n using assms(1)\n apply -\n apply (drule bspec[OF _ that])\n apply (drule trans_sem_N_renumI')\n subgoal\n using assms(2) that by auto\n unfolding t_def by (elims, fo_rule someI, auto)\n\n show ?thesis\n proof (cases \"ps\")\n case Nil\n then show ?thesis\n by (auto intro: that)\n next\n case (Cons p ps')\n then have \"p \\ set ps\"\n by auto\n define a' where \"a' = as' p\"\n have 1: \"as' q = a'\" and \"In a = renum_act a'\" if \"q \\ set ps\" for q\n unfolding as'_def a'_def using *[OF that] *[OF \\p \\ set ps\\]\n by (auto dest: injD[OF injective_functions(3)])\n then obtain a1 where \"a' = In a1\" \"a = renum_acts a1\"\n using \\p \\ set ps\\ unfolding renum_act_def by (auto elim!: InD)\n then show ?thesis\n apply -\n apply (rule that[of bs' gs' a1 fs' rs' ls'])\n unfolding bs'_def gs'_def fs'_def rs'_def ls'_def\n apply ((intros, frule *)?, auto simp: as'_def dest: 1; fail)+\n done\n qed\nqed\n\nlemmas all_mono_rule = all_mono[THEN mp, OF impI, rotated]\n\nmethod prop_monos =\n erule all_mono_rule\n | erule (1) imp_mono_rule\n | erule disj_mono[rule_format, rotated 2]\n\nlemma inv_sem_N_renum_broadcastI:\n assumes\n\"\\pa0]map_u u\n \\ inv (renum.N pa)\n ((fold (\\p L. L[p := ls p]) ps (map_index renum_states L)) [p := renum_states p l1] ! pa)\"\n\"\\p\\set ps. rs p = renum_reset (rs' p)\"\n\"\\p\\set ps. ls p = renum_states p (ls' p)\"\n\"\\p\\set ps. ls' p \\ (\\(l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\"\n\"l1 \\ (\\(l, b, g, a, r, u, l') \\ trans (N p). {l, l'})\"\n\"L \\ states\"\nshows\n\"\\pa0]u \\ inv (N pa) ((fold (\\p L. L[p := ls' p]) ps L) [p := l1] ! pa)\"\nproof -\n have [simp]: \"renum_reset r @ concat (map rs ps) = renum_reset (r @ concat (map rs' ps))\"\n using assms(2) by (simp cong: map_cong add: map_concat renum_reset_def)\n have [simp]: \"length L = n_ps\"\n using \\L \\ states\\ by auto\n have [simp]:\n \"((fold (\\p L. L[p := ls p]) ps (map_index renum_states L)) [p := renum_states p l1] ! q)\n = renum_states q ((fold (\\p L. L[p := ls' p]) ps L) [p := l1] ! q)\"\n if \"q < n_ps\" for q\n using assms(4-) that\n apply (cases \"p = q\")\n apply (simp add: fold_upds_aux_length)\n apply (simp\n add: assms(3) map_trans_broad_aux1[symmetric] fold_upds_aux_length\n cong: fold_cong)\n done\n have \"(fold (\\p L. L[p := ls' p]) ps L)[p := l1] ! q \\ loc_set\" if \"q < n_ps\" for q\n using assms(4-)\n apply (intro sem_states_loc_setD)\n subgoal\n using that by (simp add: n_ps_def)\n apply (erule state_preservation_updI)\n by (rule state_preservation_fold_updI)\n then show ?thesis\n using assms\n by (auto dest: inv_renum_sem_D simp: renum_reset_map_u simp del: map_map_index set_map)\nqed\n\nmethod solve_triv =\n assumption\n | erule (1) bounded_renumD'; fail\n | rule inv_renum_sem_D[OF _ _ sem_states_loc_setD]; simp; fail\n | rule check_bexp_renumI; simp; fail\n | rule map_u_renum_cconstraint_clock_valD; simp; fail\n | rule is_upd_renumI is_upd_renumI'' is_upds_renumI'', simp; fail\n | simp; fail\n | simp add:\n vars_inv_def bij_f_the_inv_f[OF bij_renum_vars] renum_reset_map_u[symmetric] map_index_update\n renum_reset_append;\n fail\n | subst nth_map, (simp; fail)+; fail\n | (rule state_preservation_updI, blast)+, simp; fail\n\nlemma trans_sem_upd_domI:\n assumes \"(L ! p, b', g', a, f', r', l1) \\ trans (N p)\" \"dom s = var_set\" \"p < n_ps\"\n shows \"\\(x, _)\\set (renum_upd f'). x \\ dom (s o vars_inv)\"\n unfolding renum_upd_def using assms\n by (auto simp: dom_comp_eq_vimage vars_inv_def the_inv_f_f[OF inj_renum_vars]\n dest!: sem_trans_upd_domD)\n\nlemma step_single_renumI:\n assumes\n \"step_u renum.sem\n (map_index renum_states L) (s o vars_inv) (map_u u) a L' s' u'\"\n \"L \\ states\" \"dom s \\ var_set\" \"dom s = var_set\"\n shows \"\\ a1 L1 s1 u1. step_u sem L s u a1 L1 s1 u1 \\ renum_label a1 = a \\\n L' = map_index renum_states L1 \\ s' = s1 o vars_inv \\ u' = map_u u1\"\n using assms(1-3)\n supply [simp] = length_automata_eq_n_ps L_len\n supply [simp del] = map_map_index set_map\n apply (subst A_split)\n apply (subst (asm) renum.A_split)\n apply (simp only: renum_label_def label.map renum_n_ps_simp)\n\n using [[goals_limit=2]]\n\n apply (cases a)\n\n(* Delay *)\n subgoal\n apply (simp only:)\n apply (erule step_u_elims')\n apply intros\n apply (rule step_u.intros)\n apply (auto_tag keep: TAG[of \"''nonnegative''\"], simp, prop_monos+, solve_triv+)\n subgoal\n using urgency_removed by - (tag, auto)\n apply auto_tag\n apply (auto_tag?, solve_triv)+\n done\n\n(* Internal *)\n subgoal for a'\n apply (simp only:)\n apply (erule step_u_elims')\n unfolding TAG_def\n apply (drule sym[of \"map_index renum_states L ! _\"])\n apply simp\n apply (drule (1) trans_sem_N_renumI')\n apply elims\n unfolding renum_act_def\n apply (rule SilD, assumption)\n\n apply intros\n apply (rule step_u.intros(2), unfold TAG_def)\n apply solve_triv\n\n apply (prop_monos; auto simp: committed_renum_eq dest: injD[OF inj_renum_states]; fail)\n\n apply solve_triv\n apply solve_triv\n\n(* Target invariant is satisified *)\n apply (simp add: map_index_update[symmetric] renum_reset_map_u, prop_monos+, rule inv_renum_sem_D[OF _ _ sem_states_loc_setD], solve_triv+; fail)\n\n apply solve_triv+\n\n(* Resulting state is bounded *)\n apply (erule bounded_renumD1)\n subgoal\n apply (drule is_upd_dom)\n subgoal\n apply (simp add: dom_comp_eq_vimage)\n unfolding renum_upd_def\n apply (clarsimp simp: vars_inv_def the_inv_f_f[OF inj_renum_vars] set_map)\n apply (drule (1) sem_trans_upd_domD)\n using assms(4)\n apply auto\n done\n apply (drule dom_comp_vars_inv_eqD, simp)\n done\n\n apply solve_triv\n\n apply solve_triv\n\n(* or: auto *)\n apply (rule ext)\n apply solve_triv+\n done\n\n\n(* Binary *)\n subgoal for a'\n apply (simp only:)\n apply (erule step_u_elims')\n unfolding TAG_def\n apply (drule sym[of \"map_index renum_states L ! _\"])+\n apply simp\n apply (drule (1) trans_sem_N_renumI')\n apply (drule (1) trans_sem_N_renumI')\n apply elims\n apply (rule In_OutD, assumption, assumption)\n\n apply intros\n apply (rule step_u.intros(3), unfold TAG_def)\n\n prefer 2\n apply solve_triv\n\n apply (clarsimp simp: renum_sem_broadcast_eq broadcast_def; fail)\n\n apply solve_triv\n\n subgoal\n by (auto simp: committed_renum_eq inj_eq_iff[OF inj_renum_states])\n\n apply solve_triv+\n\n(* Target invariant is satisified *)\n apply (simp add: map_index_update[symmetric] renum_reset_map_u renum_reset_append, prop_monos+, rule inv_renum_sem_D[OF _ _ sem_states_loc_setD], solve_triv+; fail)\n\n apply solve_triv+\n\n(* Resulting state is bounded *)\n apply (erule bounded_renumD1)\n subgoal premises prems\n using prems(2,11-)\n apply -\n apply (drule is_upd_dom)\n subgoal\n using assms(4) by - (drule trans_sem_upd_domI; simp split: prod.splits)\n apply (drule is_upd_dom)\n subgoal\n using assms(4) by - (drule trans_sem_upd_domI; simp split: prod.splits)\n apply (simp, drule dom_comp_vars_inv_eqD, simp)\n done\n apply (solve_triv, solve_triv)\n apply (rule ext; solve_triv)\n apply solve_triv\n done\n\n(* Broadcast *)\n subgoal for a'\n apply (simp only:)\n apply (erule step_u_elims')\n unfolding TAG_def[of \"SEND ''range''\"] TAG_def[of \"TRANS ''out''\"]\n apply (drule TAG_mp[of \"SEND ''loc''\"], rotate_tac -1, erule sym, unfold TAG_def[of \"SEND ''loc''\"])\n apply simp\n apply (frule (1) trans_sem_N_renumI')\n apply elims\n subgoal for l b g f r l' p ps bs gs fs rs ls' s'a b' g' a'a f' r' l1\n unfolding renum_act_def\n unfolding TAG_def[of \"TRANS ''in''\"] TAG_def[of \"SEL _\"]\n apply (rule OutD, assumption)\n\n apply (simp add: atLeastLessThan_upperD)\n\n apply (erule(1) trans_sem_N_renum_broadcastI)\n apply (subgoal_tac \"map fs ps = map renum_upd (map fs' ps)\")\n defer\n apply (simp; fail)\n\n subgoal for a1 bs' gs' fs' rs' ls1 a2\n\n apply intros\n apply (rule step_u.intros(4)[where ps = ps])\n\n prefer 2\n apply (tag keep: TAG[of \"TRANS ''out''\"], solve_triv)\n\n apply (auto_tag, clarsimp simp: renum_sem_broadcast_eq inj_eq_iff[OF inj_renum_acts] broadcast_def; fail)\n\n apply (auto_tag, cases \"ps = []\"; simp add: atLeastLessThan_upperD inj_eq_iff[OF inj_renum_acts]; fail)\n\n apply (auto_tag, prop_monos)\n\n subgoal\n by (auto simp: committed_renum_eq inj_eq_iff[OF inj_renum_states])\n\n apply prop_monos\n\n subgoal\n by (clarsimp simp: committed_renum_eq inj_eq_iff[OF inj_renum_states] atLeastLessThan_upperD, fast)\n\n subgoal premises prems\n using prems(38-) (* last premise only *)\n by (auto simp: inj_eq_iff[OF inj_renum_states] committed_renum_eq)\n\n apply (auto_tag, solve_triv)\n\n apply (auto_tag, erule Ball_mono, solve_triv; fail)\n\n apply (auto_tag, solve_triv)\n\n apply (auto_tag, erule Ball_mono, solve_triv)\n\n(* Set of broadcast receivers is maximal *)\n subgoal\n apply (tag keep: TAG[of \"''maximal''\"])\n apply simp\n apply prop_monos+\n apply clarify\n apply (drule (1) trans_N_renumD)+\n apply (simp add: renum_act_def)\n apply (drule check_bexp_renumD)\n apply (drule map_u_renum_cconstraint_clock_valI)\n apply blast\n done\n\n(* Target invariant is satisified *)\n apply (tag keep: TAG[of \"''target invariant''\"] TAG[of \"''new loc''\"] TAG[of \"''new valuation''\"])\n apply (simp add: atLeastLessThan_upperD)\n apply (erule (2) inv_sem_N_renum_broadcastI, blast, fast, solve_triv; fail)\n\n apply (auto_tag, solve_triv?; fail)+\n\n subgoal\n apply (tag keep: TAG[of \"''bounded''\"] TAG[of \"''upd''\"] TAG[of \"''upds''\"])\n (* Resulting state is bounded *)\n apply (erule bounded_renumD1)\n\n apply (drule is_upd_dom)\n subgoal\n using assms(4) by (intro trans_sem_upd_domI)\n\n apply (drule is_upds_dom)\n subgoal\n using assms(4)\n apply (simp add: set_map)\n apply (drule trans_sem_upd_domI, assumption, assumption)\n apply (erule Ball_mono, drule trans_sem_upd_domI, assumption, (simp add: atLeastLessThan_upperD; fail))\n apply simp\n done\n apply (simp, drule dom_comp_vars_inv_eqD, simp)\n done\n\n apply solve_triv\n\n apply (tag keep: TAG[of \"''new loc''\"], simp add: map_trans_broad_aux1 map_index_update cong: fold_cong; fail)\n\n apply (determ \\tags del: TAG\\, unfold TAG_def)\n apply (auto simp: vars_inv_def bij_f_the_inv_f[OF bij_renum_vars]; fail)\n\n apply (tag keep: TAG[of \"''new valuation''\"], simp add: renum_reset_map_u[symmetric] renum_reset_def map_concat comp_def cong: map_cong; fail)\n done\n done\n done\n done\n\nlemma step_u_var_set_invariant:\n assumes \"step_u sem L s u a L' s' u'\" \"dom s = var_set\"\n shows \"dom s' = var_set\"\n using assms dom_bounds_var_set by (auto 4 4 dest!: bounded_inv simp: bounded_def)\n\nlemmas step_u_invariants = states_inv step_u_var_set_invariant\n\ninterpretation single: Bisimulation_Invariant\n \"\\(L, s, u) (L', s', u'). \\ a. step_u sem L s u a L' s' u'\"\n \"\\(L, s, u) (L', s', u'). \\ a. step_u renum.sem L s u a L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = map_index renum_states L \\ s' = s o vars_inv \\ u' = map_u u\"\n \"\\ (L, s, u). L \\ states \\ dom s = var_set\" \"\\_. True\"\n apply standard\n supply [simp del] = map_map_index set_map\n apply clarsimp\n subgoal for L s u L' s' u' a\n by (drule (1) step_single_renumD, auto)\n subgoal\n by clarsimp (drule step_single_renumI[rotated]; blast)\n subgoal\n by clarsimp (intro conjI; elim step_u_invariants)\n subgoal\n .\n done\n\ninterpretation Bisimulation_Invariant\n \"\\(L, s, u) (L', s', u'). step_u' sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). step_u' renum.sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = map_index renum_states L \\ s' = s o vars_inv \\ u' = map_u u\"\n \"\\ (L, s, u). L \\ states \\ dom s = var_set\" \"\\_. True\"\nproof -\n define rsem where \"rsem = renum.sem\"\n note step_single_renumD = step_single_renumD[folded rsem_def]\n show \"Bisimulation_Invariant\n (\\(L, s, u) (L', s', u'). sem \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\(L, s, u) (L', s', u'). renum.sem \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\(L, s, u) (L', s', u').\n L' = map_index renum_states L \\\n s' = (s o vars_inv) \\\n u' = map_u u)\n (\\(L, s, u). L \\ states \\ dom s = var_set) (\\_. True)\"\n unfolding rsem_def[symmetric]\n proof ((standard; clarsimp split: prod.splits), goal_cases)\n case (1 L s u L' s' u')\n from 1(1) guess L1 s1 u1 a\n by (elim step_u'_elims)\n with 1(2-) show ?case\n apply -\n apply (rule step_u'.intros[where a = \"renum_label a\"])\n apply (erule (1) step_single_renumD[where a = Del, unfolded renum_label_def, simplified], blast)\n apply (cases a; simp add: renum_label_def; fail)\n apply (erule step_single_renumD)\n apply (blast dest: step_u_invariants)+\n done\n next\n case (2 L s u L' s' u')\n from 2(3) guess L1 s1 u1 a\n by (elim step_u'_elims)\n with 2(1,2) show ?case\n apply -\n apply (drule (1) step_single_renumI[folded rsem_def], blast)\n apply safe\n subgoal for a1\n apply (drule step_single_renumI[folded rsem_def])\n apply (blast dest: step_u_invariants)+\n apply (subgoal_tac \"a1 = Del\")\n apply clarsimp\n apply intros\n apply (erule step_u'.intros)\n apply auto\n apply (cases a1; simp add: renum_label_def)\n done\n done\n next\n case (3 x1 x1a x2a x1b x1c x2c)\n then show ?case\n by (elim step_u'_elims) (auto 4 4 dest: step_u_invariants)\n qed\nqed\n\nlemmas renum_bisim = Bisimulation_Invariant_axioms\n\nend\n\nlocale Simple_Network_Impl_Formula_real =\n Simple_Network_Rename_real where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, real, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, real) cconstraint) list) list\" +\n fixes \\ :: \"(nat, 's, 'x, int) formula\"\n and s\\<^sub>0 :: \"('x \\ int) list\"\n and L\\<^sub>0 :: \"'s list\"\nbegin\n\ndefinition \\' where\n \"\\' = map_formula renum_states renum_vars id \\\"\n\ndefinition a\\<^sub>0 where\n \"a\\<^sub>0 = (L\\<^sub>0, map_of s\\<^sub>0, \\_. 0)\"\n\ndefinition a\\<^sub>0' where\n \"a\\<^sub>0' = (map_index renum_states L\\<^sub>0, map_of (map (\\(x, v). (renum_vars x, v)) s\\<^sub>0), \\_. 0)\"\n\ncontext\n assumes L\\<^sub>0_states: \"L\\<^sub>0 \\ states\"\n assumes s\\<^sub>0_dom: \"fst ` set s\\<^sub>0 = var_set\" and s\\<^sub>0_distinct: \"distinct (map fst s\\<^sub>0)\"\nbegin\n\n(* Refine to subset of var_set? *)\nlemma state_eq_aux:\n assumes \"x \\ renum_vars ` var_set\"\n shows \"vars_inv x \\ var_set\"\n unfolding vars_inv_def\nproof clarsimp\n assume \"the_inv renum_vars x \\ var_set\"\n then have \"renum_vars (the_inv renum_vars x) = x\"\n by (intro f_the_inv_f inj_renum_vars) (simp add: surj_renum_vars)\n with assms \\_ \\ var_set\\ show False\n by force\nqed\n\nlemma state_eq:\n assumes \"fst ` set s\\<^sub>0 = var_set\" \"distinct (map fst s\\<^sub>0)\"\n shows \"map_of (map (\\(x, y). (renum_vars x, y)) s\\<^sub>0) = (map_of s\\<^sub>0 \\\\\\ the_inv_into) UNIV renum_vars\"\n (is \"?l = ?r\")\nproof (rule ext)\n fix x\n show \"?l x = ?r x\"\n proof (cases \"x \\ renum_vars ` fst ` set s\\<^sub>0\")\n case True\n then show ?thesis\n apply clarsimp\n apply (subst map_of_mapk_SomeI')\n subgoal\n using inj_renum_vars by (auto intro: inj_on_subset)\n apply (rule map_of_is_SomeI, rule assms, assumption)\n apply (simp add: the_inv_f_f[OF inj_renum_vars] s\\<^sub>0_distinct)\n done\n next\n case False\n then have \"vars_inv x \\ fst ` set s\\<^sub>0\"\n using state_eq_aux assms(1) unfolding vars_inv_def by auto\n with False show ?thesis\n apply -\n apply (frule map_of_NoneI)\n apply (simp add: vars_inv_def)\n apply (auto simp: map_of_eq_None_iff)\n done\n qed\nqed\n\ninterpretation Bisimulation_Invariant\n \"\\(L, s, u) (L', s', u'). step_u' sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). step_u' renum.sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = map_index renum_states L \\ s' = s o vars_inv \\ u' = map_u u\"\n \"\\ (L, s, u). L \\ states \\ dom s = var_set\" \"\\_. True\"\n by (rule renum_bisim)\n\nlemma start_equiv:\n \"A_B.equiv' a\\<^sub>0 a\\<^sub>0'\"\n unfolding A_B.equiv'_def a\\<^sub>0_def a\\<^sub>0'_def\n apply (clarsimp simp: vars_inv_def, intro conjI)\n subgoal\n by (intro state_eq s\\<^sub>0_dom s\\<^sub>0_distinct)\n subgoal\n unfolding map_u_def by auto\n subgoal\n by (rule L\\<^sub>0_states)\n subgoal\n using s\\<^sub>0_dom dom_map_of_conv_image_fst[of s\\<^sub>0] by fastforce\n done\n\nlemma check_sexp_equiv:\n assumes \"A_B.equiv' (L, s, u) (L', s', u')\" \"locs_of_sexp e \\ {0.. s) \\\n check_sexp (map_sexp renum_states renum_vars id e) L' (the \\ s')\"\n using assms unfolding A_B.equiv'_def\n by (induction e)\n (simp add: inj_eq states_lengthD renum_states_inj vars_inv_def the_inv_f_f[OF inj_renum_vars])+\n\nlemma models_iff:\n \"sem,a\\<^sub>0 \\ \\ = renum.sem,a\\<^sub>0' \\ \\'\" if \"locs_of_formula \\ \\ {0..) (ctl_of \\')\"\n using that unfolding \\'_def\n by (cases \\; auto simp: check_sexp_equiv prop_of_def rel_fun_def)\n with start_equiv show ?thesis\n by (simp add: models_ctl_iff CTL_compatible[THEN rel_funD, symmetric])\nqed\n\nlemma has_deadlock_iff:\n \"has_deadlock sem a\\<^sub>0 \\ has_deadlock renum.sem a\\<^sub>0'\"\n unfolding has_deadlock_def using start_equiv by (intro deadlock_iff, unfold A_B.equiv'_def) auto\n\nend (* Context for assumptions *)\n\nend (* Simple Network Rename real *)\n\n\n(* XXX Move *)\nlemma Bisimulation_Invariants_Bisimulation_Invariant:\n assumes \"Bisimulation_Invariants A B sim PA PA PB PB\"\n shows \"Bisimulation_Invariant A B sim PA PB\"\nproof -\n interpret Bisimulation_Invariants A B sim PA PA PB PB\n by (rule assms)\n show ?thesis\n by (standard; blast intro: A_B_step B_A_step)\nqed\n\n(* XXX Move *)\nlemma Bisimulation_Invariants_Bisimulation_Invariant_iff:\n \"Bisimulation_Invariants A B sim PA PA PB PB \\ Bisimulation_Invariant A B sim PA PB\"\n using\n Bisimulation_Invariants_Bisimulation_Invariant Bisimulation_Invariant_Bisimulation_Invariants\n by blast\n\nlemmas Bisimulation_Invariant_composition =\n Bisimulation_Invariant_Invariants_composition[\n THEN Bisimulation_Invariants_Bisimulation_Invariant,\n OF _ Bisimulation_Invariant_Bisimulation_Invariants]\n\nlemma Bisimulation_Invariant_refl:\n \"Bisimulation_Invariant A A (=) P P\" if \"\\a b. P a \\ A a b \\ P b\"\n by (rule Bisimulation_Invariant.intro) (auto intro: that)\n\n\nlocale Simple_Network_Rename_int =\n Simple_Network_Rename_Defs_int where automata = automata +\n Simple_Network_Rename' where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\" +\n assumes urgency_removed: \"\\ (_, U, _, _) \\ set automata. U = []\"\nbegin\n\nlemma n_ps_eq1:\n \"Prod_TA_Defs.n_ps\n (set broadcast, map automaton_of (map conv_automaton automata),\n map_of bounds') = n_ps\"\n unfolding n_ps_def Prod_TA_Defs.n_ps_def by simp\n\nlemma var_set_eq1:\n \"Prod_TA_Defs.var_set\n (set broadcast, map automaton_of (map conv_automaton automata),\n map_of bounds') = var_set\"\n unfolding sem_def sem_var_set_eq[symmetric] by simp\n\nlemma urgency_removed':\n \"\\i(L, s, u) (L', s', u'). step_u' sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). step_u' renum.sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = map_index renum_states L \\ s' = s o vars_inv \\ u' = map_u u\"\n \"\\ (L, s, u). L \\ sem.states \\ dom s = var_set\" \"\\_. True\"\n apply (rule Bisimulation_Invariant_sim_replace)\n apply (rule Bisimulation_Invariant_composition)\n apply (rule real.renum_bisim[unfolded sem_unfold1 sem_unfold2 sem_var_set_eq])\n apply (rule Bisimulation_Invariant_refl)\n apply auto\n done\n\nlemmas renum_bisim = renum_bisim.Bisimulation_Invariant_axioms\n\nend\n\nlocale Simple_Network_Rename_Start' =\n Simple_Network_Rename' where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, 't, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, 't) cconstraint) list) list\" +\n fixes s\\<^sub>0 :: \"('x \\ int) list\"\n and L\\<^sub>0 :: \"'s list\"\n assumes L\\<^sub>0_states: \"L\\<^sub>0 \\ states\"\n assumes s\\<^sub>0_dom: \"fst ` set s\\<^sub>0 = var_set\" and s\\<^sub>0_distinct: \"distinct (map fst s\\<^sub>0)\"\nbegin\n\nend\n\nlocale Simple_Network_Rename_Start_int =\n Simple_Network_Rename_int where automata = automata +\n Simple_Network_Rename_Start' where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\"\nbegin\n\ndefinition a\\<^sub>0 where\n \"a\\<^sub>0 = (L\\<^sub>0, map_of s\\<^sub>0, \\_. 0)\"\n\ndefinition a\\<^sub>0' where\n \"a\\<^sub>0' = (map_index renum_states L\\<^sub>0, map_of (map (\\(x, v). (renum_vars x, v)) s\\<^sub>0), \\_. 0)\"\n\n(* Refine to subset of var_set? *)\nlemma state_eq_aux:\n assumes \"x \\ renum_vars ` var_set\"\n shows \"vars_inv x \\ var_set\"\n unfolding vars_inv_def\nproof clarsimp\n assume \"the_inv renum_vars x \\ var_set\"\n then have \"renum_vars (the_inv renum_vars x) = x\"\n by (intro f_the_inv_f real.inj_renum_vars) (simp add: real.surj_renum_vars)\n with assms \\_ \\ var_set\\ show False\n by force\nqed\n\nlemma state_eq:\n assumes \"fst ` set s\\<^sub>0 = var_set\" \"distinct (map fst s\\<^sub>0)\"\n shows \"map_of (map (\\(x, y). (renum_vars x, y)) s\\<^sub>0) = (map_of s\\<^sub>0 \\\\\\ the_inv_into) UNIV renum_vars\"\n (is \"?l = ?r\")\nproof (rule ext)\n fix x\n show \"?l x = ?r x\"\n proof (cases \"x \\ renum_vars ` fst ` set s\\<^sub>0\")\n case True\n then show ?thesis\n apply clarsimp\n apply (subst map_of_mapk_SomeI')\n subgoal\n using real.inj_renum_vars by (auto intro: inj_on_subset)\n apply (rule map_of_is_SomeI, rule assms, assumption)\n apply (simp add: the_inv_f_f[OF real.inj_renum_vars] s\\<^sub>0_distinct)\n done\n next\n case False\n then have \"vars_inv x \\ fst ` set s\\<^sub>0\"\n using state_eq_aux assms(1) unfolding vars_inv_def by auto\n with False show ?thesis\n apply -\n apply (frule map_of_NoneI)\n apply (simp add: vars_inv_def)\n apply (auto simp: map_of_eq_None_iff)\n done\n qed\nqed\n\nlemma start_equiv:\n \"renum_bisim.A_B.equiv' a\\<^sub>0 a\\<^sub>0'\"\n unfolding renum_bisim.A_B.equiv'_def a\\<^sub>0_def a\\<^sub>0'_def\n apply (clarsimp simp: vars_inv_def, intro conjI)\n subgoal\n by (intro state_eq s\\<^sub>0_dom s\\<^sub>0_distinct)\n subgoal\n unfolding map_u_def by auto\n subgoal\n unfolding sem_states_eq by (rule L\\<^sub>0_states)\n subgoal\n using s\\<^sub>0_dom dom_map_of_conv_image_fst[of s\\<^sub>0] by fastforce\n done\n\nlemma check_sexp_equiv:\n assumes \"renum_bisim.A_B.equiv' (L, s, u) (L', s', u')\" \"locs_of_sexp e \\ {0.. s) \\\n check_sexp (map_sexp renum_states renum_vars id e) L' (the \\ s')\"\n using assms unfolding renum_bisim.A_B.equiv'_def\n by (induction e)\n (simp add:\n inj_eq sem.states_lengthD renum_states_inj vars_inv_def the_inv_f_f[OF real.inj_renum_vars])+\n\nlemma check_sexp_compatible:\n assumes \"locs_of_sexp e \\ {0..(L, s, u). check_sexp e L (the \\ s))\n (\\(L', s', u'). check_sexp (map_sexp renum_states renum_vars id e) L' (the \\ s'))\"\n using check_sexp_equiv[OF _ assms] by auto\n\nlemma has_deadlock_iff:\n \"has_deadlock sem a\\<^sub>0 \\ has_deadlock renum.sem a\\<^sub>0'\"\n unfolding has_deadlock_def using start_equiv\n by (intro renum_bisim.deadlock_iff, unfold renum_bisim.A_B.equiv'_def) auto\n\nlemma state_formula_compatible:\n \"(\\x \\ set_state_formula \\. locs_of_sexp x) \\ {0..\n rel_state_formula renum_bisim.compatible\n (map_state_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\n (map_state_formula (\\P (L, s, _).\n check_sexp (map_sexp (\\p. renum_states p) renum_vars id P) L (the o s))\n \\)\" and path_formula_compatible:\n \"(\\x \\ set_path_formula \\. locs_of_sexp x) \\ {0..\n rel_path_formula renum_bisim.compatible\n (map_path_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\n (map_path_formula (\\P (L, s, _).\n check_sexp (map_sexp (\\p. renum_states p) renum_vars id P) L (the o s))\n \\)\"\n by (induction \\ and \\) (auto simp: check_sexp_equiv prop_of_def rel_fun_def)\n\nlemmas models_state_compatible = renum_bisim.models_state_compatible[OF state_formula_compatible]\n\nend\n\nlocale Simple_Network_Rename_Formula_int =\n Simple_Network_Rename_Start_int where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\" +\n fixes \\ :: \"(nat, 's, 'x, int) formula\"\nbegin\n\ndefinition \\' where\n \"\\' = map_formula renum_states renum_vars id \\\"\n\nlemma models_iff:\n \"sem,a\\<^sub>0 \\ \\ = renum.sem,a\\<^sub>0' \\ \\'\" if \"locs_of_formula \\ \\ {0..) (ctl_of \\')\"\n using that unfolding \\'_def\n by (cases \\; auto simp: check_sexp_equiv prop_of_def rel_fun_def)\n with start_equiv show ?thesis\n by (simp add: models_ctl_iff renum_bisim.CTL_compatible[THEN rel_funD, symmetric])\nqed\n\nend (* Simple Network Rename Formula int *)\n\n\n\n(* XXX Move *)\nlemma vars_of_bexp_finite[finite_intros]:\n \"finite (vars_of_bexp (b::('a, 'b) bexp))\"\nand vars_of_exp_finite[finite_intros]:\n \"finite (vars_of_exp (e::('a, 'b) exp))\"\n by (induction b and e) auto\n\nlemma set_bexp_vars_of_bexp:\n \"set_bexp (b::('a, 'b) bexp) = vars_of_bexp b\"\nand set_exp_vars_of_exp:\n \"set_exp (e::('a, 'b) exp) = vars_of_exp e\"\n by (induction b and e) auto\n\ndefinition (in Prod_TA_Defs)\n \"act_set \\ (\\ p \\ {0.. (l, e, g, a, _) \\ trans (N p). act.set_act a) \\ broadcast\"\n\nlemma (in Simple_Network_Impl) act_set_compute:\n \"act_set =\n \\ ((\\(_, _, t, _). \\ ((\\(l, e, g, a, _). act.set_act a) ` set t)) ` set automata) \\ set broadcast\"\n unfolding act_set_def\n apply (fo_rule arg_cong2)\n apply (auto simp: N_p_trans_eq n_ps_def act_set_def broadcast_def)\n apply (drule nth_mem, erule bexI[rotated], force)+\n apply (drule mem_nth, force)+\n done\n\nlemma set1_acconstraint_elim:\n assumes \"c \\ set1_acconstraint ac\"\n obtains x where \"(c, x) = constraint_pair ac\"\n using assms by (cases ac) auto\n\nlemma (in Simple_Network_Impl)\n assumes \"(x1, x2, T, I) \\ set automata\" \"(l, b, g, a, f, r, l') \\ set T\"\n shows clk_set'I1[intro]: \"c \\ set r \\ c \\ clk_set'\"\n and clk_set'I2[intro]: \"ac \\ set g \\ c \\ set1_acconstraint ac \\ c \\ clk_set'\"\n and loc_setI1[intro]: \"l \\ loc_set\" and loc_setI2[intro]: \"l' \\ loc_set\"\n and act_setI[intro]: \"a' \\ set_act a \\ a' \\ act_set\"\n and var_setI1[intro]: \"v \\ set_bexp b \\ v \\ var_set\"\n and var_setI2[intro]: \"(x, e) \\ set f \\ x \\ var_set\"\n and var_setI3[intro]: \"(x, e) \\ set f \\ v \\ set_exp e \\ v \\ var_set\"\n using assms unfolding\n loc_set_compute act_set_compute var_set_compute set_bexp_vars_of_bexp set_exp_vars_of_exp\n clk_set'_def\n apply -\n apply force\n apply (fastforce elim: set1_acconstraint_elim simp: clkp_set'_def collect_clock_pairs_def)\n apply (simp; blast)+\n done\n\nlemma (in Simple_Network_Impl) clk_set'I3[intro]:\n assumes \"(x1, x2, T, I) \\ set automata\"\n shows \"(l, g') \\ set I \\ ac \\ set g' \\ c \\ set1_acconstraint ac \\ c \\ clk_set'\"\n using assms unfolding clk_set'_def clkp_set'_def collect_clock_pairs_def\n by (force elim!: set1_acconstraint_elim)\n\n\ndefinition\n \"find_remove P = map_option (\\(xs, x, ys). (x, xs @ ys)) o List.extract P\"\n\nfun merge_pairs :: \"('a \\ 'b list) list \\ ('a \\ 'b list) list \\ ('a \\ 'b list) list\" where\n \"merge_pairs [] ys = ys\" |\n \"merge_pairs ((k, v) # xs) ys = (case find_remove (\\(k', _). k' = k) ys of\n None \\ (k, v) # merge_pairs xs ys\n | Some ((_, v'), ys) \\ (k, v @ v') # merge_pairs xs ys\n )\"\n\n(*\ndefinition\n \"conv_urge urge \\ \\(committed, urgent, trans, inv).\n (committed,\n [],\n map (\\(l, b, g, a, f, r, l'). (l, b, g, a, f, urge # r, l')) trans,\n map (\\(l, cc). (l, if l \\ set urgent then acconstraint.LE urge 0 # cc else cc)) inv)\"\n*)\n\ndefinition\n \"conv_urge urge \\ \\(committed, urgent, trans, inv).\n (committed,\n [],\n map (\\(l, b, g, a, f, r, l'). (l, b, g, a, f, urge # r, l')) trans,\n merge_pairs (map (\\l. (l, [acconstraint.LE urge 0])) urgent) inv)\"\n\n(* XXX Generalized version. Move to library *)\nlemma map_of_distinct_upd2:\n assumes \"x \\ set (map fst xs)\"\n shows \"map_of (xs @ (x,y) # ys) = (map_of (xs @ ys))(x \\ y)\"\n using assms by (induction xs) auto\n\n(* XXX Generalized version. Move to library *)\nlemma map_of_distinct_lookup:\n assumes \"x \\ set (map fst xs)\"\n shows \"map_of (xs @ (x,y) # ys) x = Some y\"\n using map_of_distinct_upd2[OF assms] by auto\n\nlemma find_remove_SomeD:\n assumes \"find_remove P xs = Some (x, ys)\"\n shows \"\\as bs. xs = as @ x # bs \\ ys = as @ bs \\ (\\x \\ set as. \\ P x) \\ P x\"\n using assms unfolding find_remove_def by (auto dest: extract_SomeE)\n\nlemma find_map:\n \"find Q (map f xs) = map_option f (find P xs)\" if \"\\x \\ set xs. Q (f x) \\ P x\"\n using that by (induction xs) auto\n\nlemma find_remove_map:\n \"find_remove Q (map f xs) = map_option (\\(x, xs). (f x, map f xs)) (find_remove P xs)\"\n if \"\\x \\ set xs. Q (f x) \\ P x\"\n using that\n by (induction xs)\n (auto simp: find_remove_def extract_Nil_code extract_Cons_code split: option.split)\n\nlemma map_merge_pairs2:\n \"map (\\(k, v). (g k, map f v)) (merge_pairs xs ys)\n = merge_pairs (map (\\(k, v). (g k, map f v)) xs) (map (\\(k, v). (g k, map f v)) ys)\"\n if inj: \"inj_on g (fst ` (set xs \\ set ys))\"\nproof -\n have *:\n \"find_remove (\\(k', _). k' = g k) (map (\\(k, v). (g k, map f v)) ys)\n = map_option\n (\\((k, v), ys). ((g k, map f v), map (\\(k, v). (g k, map f v)) ys))\n (find_remove (\\(k', _). k' = k) ys)\"\n if \"inj_on g (fst ` (set xs \\ set ys))\" \"k \\ fst ` set xs\" for k xs ys\n using that\n by (subst find_remove_map[where P = \"(\\(k', _). k' = k)\"])\n (auto elim: inj_onD[rotated, where A = \"fst ` (set xs \\ set ys)\"]\n intro!: arg_cong2[where f = map_option])\n show ?thesis\n using inj\n proof (induction xs arbitrary: ys)\n case Nil\n then show ?case\n by simp\n next\n case (Cons x xs)\n then show ?case\n apply (auto split: prod.split option.split simp: *[OF Cons(2)])\n apply (subst Cons.IH)\n apply (drule find_remove_SomeD)\n apply auto\n done\n qed\nqed\n\nlemma map_merge_pairs:\n \"map (\\(k, v). (k, map f v)) (merge_pairs xs ys)\n = merge_pairs (map (\\(k, v). (k, map f v)) xs) (map (\\(k, v). (k, map f v)) ys)\"\n using map_merge_pairs2[where g = id] by auto\n\nlemma map_map_commute:\n \"map f (map g xs) = map g (map f xs)\" if \"\\x \\ set xs. f (g x) = g (f x)\"\n using that by simp\n\nlemma conv_automaton_conv_urge_commute:\n \"conv_automaton (conv_urge c A) = conv_urge c (conv_automaton A)\"\n unfolding comp_def conv_automaton_def conv_urge_def\n by (simp split: prod.split add: map_merge_pairs comp_def)\n\nlemma conv_automaton_conv_urge_commute':\n \"conv_automaton o conv_urge c = conv_urge c o conv_automaton\"\n unfolding comp_def conv_automaton_conv_urge_commute ..\n\nlocale Simple_Network_Rename_Defs_int_urge =\n Simple_Network_Rename_Defs_int where automata = automata for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\"\n + fixes urge :: 'c\n\nlemma (in Simple_Network_Rename_Defs) conv_automaton_of:\n \"Simple_Network_Language.conv_A (automaton_of A) = automaton_of (conv_automaton A)\"\n unfolding automaton_of_def conv_automaton_def\n Simple_Network_Language.conv_A_def\n by (force\n simp: default_map_of_alt_def map_of_map Simple_Network_Language.conv_t_def split: prod.splits\n )\n\nlocale Simple_Network_Rename =\n Simple_Network_Rename_Defs_int_urge where automata = automata for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\" +\n assumes renum_states_inj:\n \"\\ix\\loc_set. \\y\\loc_set. renum_states i x = renum_states i y \\ x = y\"\n and renum_clocks_inj: \"inj_on renum_clocks (insert urge clk_set')\"\n and renum_vars_inj: \"inj_on renum_vars var_set\"\n and renum_acts_inj: \"inj_on renum_acts act_set\"\n and infinite_types:\n \"infinite (UNIV :: 'c set)\" \"infinite (UNIV :: 'x set)\" \"infinite (UNIV :: 's set)\"\n \"infinite (UNIV :: 'a set)\"\n and bounds'_var_set: \"fst ` set bounds' = var_set\"\n and loc_set_invs: \"\\ ((\\g. fst ` set g) ` set (map (snd o snd o snd) automata)) \\ loc_set\"\n and loc_set_committed: \"\\ ((set o fst) ` set automata) \\ loc_set\"\n and loc_set_urgent: \"\\ ((set o (fst o snd)) ` set automata) \\ loc_set\"\n and urge_not_in_clk_set: \"urge \\ clk_set'\"\nbegin\n\nlemma clk_set'_finite:\n \"finite clk_set'\"\n unfolding clk_set'_def unfolding clkp_set'_def by (intro finite_intros) auto\n\n(* XXX Move *)\nlemmas [finite_intros] = trans_N_finite\n\nlemma set_act_finite[finite_intros]:\n \"finite (set_act a)\"\n by (cases a) auto\n\nlemma loc_set_finite:\n \"finite loc_set\"\n unfolding loc_set_def by (auto intro!: finite_intros)\n\n(* XXX Move *)\nlemma var_set_finite[finite_intros]:\n \"finite var_set\"\n unfolding var_set_def by (auto intro!: finite_intros)\n\nlemma act_set_finite:\n \"finite act_set\"\n unfolding act_set_def broadcast_def by (auto intro!: finite_intros)\n\nlemma bij_extend_bij_renum_clocks:\n \"bij (extend_bij renum_clocks (insert urge clk_set'))\"\n by (intro extend_bij_bij renum_clocks_inj clk_set'_finite infinite_types finite.insertI) simp\n\nlemma renum_vars_bij_extends[simp]:\n \"extend_bij renum_vars var_set x = renum_vars x\" if \"x \\ var_set\"\n by (intro extend_bij_extends[rule_format] renum_vars_inj var_set_finite infinite_types that)\n\nlemma bij_extend_bij_renum_states:\n \"bij (extend_bij renum_vars var_set)\"\n by (intro extend_bij_bij renum_vars_inj var_set_finite infinite_types) simp\n\nlemma inj_extend_bij_renum_states: \"inj (extend_bij (renum_states p) loc_set)\" if \"p < n_ps\"\n using renum_states_inj infinite_types loc_set_finite \\p < n_ps\\\n by (intro extend_bij_inj) (auto intro!: inj_onI)\n\nlemma renum_states_extend:\n \"extend_bij (renum_states p) loc_set l = renum_states p l\" if \"l \\ loc_set\" \"p < n_ps\"\n using renum_states_inj infinite_types loc_set_finite \\p < n_ps\\ \\l \\ loc_set\\\n by (intro extend_bij_extends[rule_format]) (auto intro!: inj_onI)\n\nlemma renum_acts_bij_extends[simp]:\n \"extend_bij renum_acts act_set x = renum_acts x\" if \"x \\ act_set\"\n by (intro extend_bij_extends[rule_format] renum_acts_inj act_set_finite infinite_types that)\n\nlemma inj_extend_bij_renum_acts: \"inj (extend_bij renum_acts act_set)\"\n using renum_acts_inj infinite_types act_set_finite by (intro extend_bij_inj) auto\n\nlemma constraint_clk_conv_ac:\n \"constraint_clk (conv_ac ac) = constraint_clk ac\"\n by (cases ac) auto\n\ninterpretation urge: Prod_TA_sem_urge\n \"(set broadcast, map (Simple_Network_Language.conv_A o automaton_of) automata, map_of bounds')\"\n urge\n apply (standard; clarsimp)\n subgoal\n using urge_not_in_clk_set\n unfolding conv_automaton_of\n unfolding automaton_of_def conv_automaton_def\n apply (clarsimp split: prod.split_asm)\n apply (drule default_map_of_in_listD)\n unfolding clk_set'_def clkp_set'_def collect_clock_pairs_def\n apply clarsimp\n subgoal premises prems\n using prems(1,7,8,10)\n unfolding constraint_clk_conv_ac unfolding constraint_clk_constraint_pair\n by force\n done\n subgoal\n using urge_not_in_clk_set\n unfolding conv_automaton_of\n unfolding automaton_of_def conv_automaton_def\n apply (clarsimp split: prod.split_asm)\n unfolding clk_set'_def clkp_set'_def collect_clock_pairs_def\n unfolding constraint_clk_conv_ac unfolding constraint_clk_constraint_pair\n apply force\n done\n\n subgoal\n using urge_not_in_clk_set\n unfolding conv_automaton_of\n unfolding automaton_of_def conv_automaton_def\n apply (clarsimp split: prod.split_asm)\n unfolding clk_set'_def clkp_set'_def collect_clock_pairs_def\n apply force\n done\n done\n\n\nsublocale rename: Simple_Network_Rename_Defs_int\n broadcast bounds'\n \"extend_bij renum_acts act_set\"\n \"extend_bij renum_vars var_set\"\n \"extend_bij renum_clocks (insert urge clk_set')\"\n \"\\p. extend_bij (renum_states p) loc_set\"\n \"map (conv_urge urge) automata\"\n .\n\nsublocale rename: Simple_Network_Rename_int\n broadcast bounds'\n \"extend_bij renum_acts act_set\"\n \"extend_bij renum_vars var_set\"\n \"extend_bij renum_clocks (insert urge clk_set')\"\n \"\\p. extend_bij (renum_states p) loc_set\"\n \"map (conv_urge urge) automata\"\n apply (standard;\n (intro allI impI bij_extend_bij_renum_clocks inj_extend_bij_renum_states\n inj_extend_bij_renum_acts bij_extend_bij_renum_states bounds'_var_set)?)\n apply (simp add: Prod_TA_Defs.n_ps_def; fail)\n subgoal\n unfolding bounds'_var_set rename.var_set_compute var_set_compute unfolding conv_urge_def\n by (fo_rule arg_cong2; fastforce)\n subgoal\n unfolding conv_urge_def by auto\n done\n\ndefinition\n \"renum_upd' = map (\\(x, upd). (renum_vars x, map_exp renum_vars upd))\"\n\ndefinition\n \"renum_reset' = map renum_clocks\"\n\ndefinition renum_automaton' where\n \"renum_automaton' i \\ \\(committed, trans, inv). let\n committed' = map (renum_states i) committed;\n trans' = map (\\(l, g, a, upd, r, l').\n (renum_states i l,\n map_cconstraint renum_clocks id g, renum_act a, renum_upd' upd, map renum_clocks r, \n renum_states i l')\n ) trans;\n inv' = map (\\(l, g). (renum_states i l, map_cconstraint renum_clocks id g)) inv\n in (committed', trans', inv')\n\"\n\nlemmas renum_automaton'_alt_def = renum_automaton'_def[unfolded\n renum_reset'_def renum_upd'_def map_cconstraint_def renum_act_def\n ]\n\nlemma renum_automaton_eq:\n \"rename.renum_automaton p (automata ! p) = renum_automaton p (automata ! p)\"\n if \"p < n_ps\"\nproof -\n have renum_clocks: \"extend_bij renum_clocks (insert urge clk_set') c = renum_clocks c\"\n if \"c \\ clk_set'\" for c\n apply (rule extend_bij_extends[rule_format])\n apply (rule renum_clocks_inj clk_set'_finite finite.insertI)+\n using that infinite_types by auto\n have renum_cconstraint: \"rename.renum_cconstraint g = renum_cconstraint g\"\n if \"\\ (set1_acconstraint ` (set g)) \\ clk_set'\" for g\n unfolding rename.renum_cconstraint_def renum_cconstraint_def map_cconstraint_def\n apply (rule map_cong, rule HOL.refl)\n apply (rule acconstraint.map_cong_pred, rule HOL.refl)\n using that\n apply (auto intro: renum_clocks[simplified] simp: pred_acconstraint_def)\n done\n show ?thesis\n using that[folded length_automata_eq_n_ps]\n unfolding rename.renum_automaton_def renum_automaton_def\n apply (clarsimp split: prod.split)\n apply safe\n subgoal committed\n using loc_set_committed\n by (subst renum_states_extend) (auto 4 3 simp: n_ps_def dest!: nth_mem)\n subgoal urgent\n using loc_set_urgent\n by (subst renum_states_extend) (auto 4 3 simp: n_ps_def dest!: nth_mem)\n subgoal start_locs\n by (subst renum_states_extend) (auto simp: n_ps_def dest!: nth_mem)\n subgoal state\n unfolding rename.renum_bexp_def renum_bexp_def\n by (auto dest!: nth_mem intro!: renum_vars_bij_extends bexp.map_cong_pred simp: pred_bexp_def)\n subgoal guards\n by (auto dest!: nth_mem intro!: renum_cconstraint)\n subgoal actions\n unfolding rename.renum_act_def renum_act_def\n by (auto simp: pred_act_def dest!: nth_mem intro!: renum_acts_bij_extends act.map_cong_pred)\n subgoal upds\n unfolding renum_upd_def rename.renum_upd_def rename.renum_exp_def renum_exp_def\n by (auto dest!: nth_mem intro!: renum_vars_bij_extends exp.map_cong_pred simp: pred_exp_def)\n subgoal clock_resets\n unfolding rename.renum_reset_def renum_reset_def by (auto dest!: nth_mem intro!: renum_clocks)\n subgoal dest_locs\n by (subst renum_states_extend) (auto simp: n_ps_def dest!: nth_mem)\n subgoal inv_locs\n using loc_set_invs\n by (subst renum_states_extend) (auto 4 4 simp: n_ps_def dest!: nth_mem)\n subgoal renum_clocks\n by (auto dest!: nth_mem intro!: renum_cconstraint)\n done\nqed\n\nlemma renum_urge_automaton_eq1:\n \"renum_automaton p (conv_urge urge (automata ! p))\n = conv_urge (renum_clocks urge) (renum_automaton p (automata ! p))\" if \"p < n_ps\"\n unfolding renum_automaton_def conv_urge_def\n apply (simp split: prod.split)\n apply safe\n subgoal\n unfolding renum_reset_def by simp\n unfolding renum_cconstraint_def map_cconstraint_def\n apply (subst map_merge_pairs2)\n subgoal\n using loc_set_urgent loc_set_invs \\p < n_ps\\ unfolding inj_on_def n_ps_def\n by (auto; force\n elim!: renum_states_inj[unfolded n_ps_def, simplified, rule_format, rotated -1]\n intro: nth_mem)\n apply (fo_rule arg_cong2; simp)\n done\n\nlemma renum_urge_automaton_eq2:\n \"rename.real.renum_automaton p (conv_urge urge (automata ! p))\n = conv_urge\n (extend_bij renum_clocks (insert urge clk_set') urge)\n (rename.renum_automaton p (automata ! p))\"\n if \"p < n_ps\"\n unfolding rename.renum_automaton_def conv_urge_def\n apply (simp split: prod.split)\n apply safe\n subgoal\n unfolding rename.renum_reset_def by simp\n unfolding rename.renum_cconstraint_def map_cconstraint_def\n apply (subst map_merge_pairs2)\n subgoal\n by (rule inj_extend_bij_renum_states that subset_UNIV inj_on_subset)+\n apply (fo_rule arg_cong2)\n apply simp+\n done\n\nlemma renum_urge_automaton_eq:\n \"rename.real.renum_automaton p (conv_urge urge (automata ! p)) =\n renum_automaton p (conv_urge urge (automata ! p))\" if \"p < n_ps\"\n using that\n unfolding renum_urge_automaton_eq1[OF that] renum_urge_automaton_eq2[OF that]\n apply (fo_rule arg_cong2)\n subgoal\n by (intro\n extend_bij_extends[rule_format] renum_clocks_inj clk_set'_finite finite.insertI infinite_types\n ) auto\n by (rule renum_automaton_eq)\n\nlemma rename_N_eq_sem:\n \"rename.renum.sem =\n Simple_Network_Language_Model_Checking.N\n (map renum_acts broadcast)\n (map_index renum_automaton (map (conv_urge urge) automata))\n (map (\\(a,p). (renum_vars a,p)) bounds')\n \"\n unfolding rename.renum.sem_def\n unfolding Simple_Network_Language.conv_def\n apply simp\n apply (intro conjI)\n subgoal\n by (rule image_cong; intro HOL.refl renum_acts_bij_extends; simp add: act_set_def broadcast_def)\n subgoal\n apply (rule map_index_cong)\n unfolding conv_automaton_of\n apply safe\n apply (fo_rule arg_cong)+\n apply (erule renum_urge_automaton_eq[folded length_automata_eq_n_ps])\n done\n subgoal\n using bounds'_var_set by - (fo_rule arg_cong, auto intro: renum_vars_bij_extends)\n done\n\nlemma map_of_merge_pairs:\n \"map_of (merge_pairs xs ys) = (\\x.\n (if x \\ fst ` set xs \\ x \\ fst ` set ys then Some (the (map_of xs x) @ the (map_of ys x))\n else if x \\ fst ` set xs then map_of xs x\n else map_of ys x))\"\nproof -\n have 1: False if \"find_remove (\\(k', _). k' = k) ys = None\" \"(k, x) \\ set ys\" for k x ys\n using that unfolding find_remove_def by (auto simp: extract_None_iff)\n have 2: \"map_of xs k = Some x\" if\n \"find_remove (\\(k', _). k' = k) xs = Some ((k', x), ys)\" for k k' x xs ys\n using that\n by (auto 4 4 split: option.split dest: map_of_SomeD find_remove_SomeD simp: map_add_def)\n show ?thesis\n apply (rule ext)\n apply (induction xs arbitrary: ys)\n apply (simp; fail)\n apply (clarsimp split: if_split_asm option.split)\n apply (auto 4 3 split: option.split simp: map_add_def dest: find_remove_SomeD 2 1)\n done\nqed\n\nlemma default_map_of_merge_pairs:\n \"default_map_of [] (merge_pairs xs ys) = (\\x.\n (if x \\ fst ` set xs then the (map_of xs x) @ default_map_of [] ys x\n else default_map_of [] ys x))\"\n unfolding default_map_of_alt_def map_of_merge_pairs\n by (rule ext) (auto 4 3 dest: map_of_SomeD weak_map_of_SomeI split: if_split_asm)\n\nlemma automaton_of_conv_urge_commute:\n \"automaton_of (conv_urge urge A) = urge.add_reset (urge.add_inv (automaton_of A))\"\n unfolding conv_urge_def urge.add_reset_def urge.add_inv_def automaton_of_def\n apply (clarsimp split: prod.splits)\n apply (rule ext)\n unfolding default_map_of_merge_pairs\n apply auto\n subgoal premises prems for _ urgent _ _ l\n proof -\n have *: \"map_of (map (\\x. (x, [acconstraint.LE urge 0])) urgent)\n = (\\l. if l \\ set urgent then Some [acconstraint.LE urge 0] else None)\"\n using map_of_map_keys[where\n m = \"\\l. if l \\ set urgent then Some [acconstraint.LE urge 0] else None\"]\n by (force cong: map_cong simp: dom_def)\n from \\l \\ set urgent\\ show ?thesis\n by (subst *) auto\n qed\n done\n\nlemma urge_commute:\n \"rename.sem = urge.A_urge\"\n unfolding rename.sem_def urge.A_urge_def\n apply simp\n unfolding conv_automaton_conv_urge_commute conv_automaton_of automaton_of_conv_urge_commute\n by fast\n\nlemma conv_automaton_of':\n \"automaton_of \\ conv_automaton = Simple_Network_Language.conv_A o automaton_of\"\n unfolding comp_def conv_automaton_of ..\n\nsublocale urge_bisim: Bisimulation_Invariant\n \"\\(L, s, u) (L', s', u'). step_u' sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). step_u' rename.sem L s u L' s' u'\"\n \"\\(L, s, u) (L', s', u'). L' = L \\ s' = s \\ u' = u(urge := 0)\"\n \"\\ (L, s, u). L \\ states\" \"\\(L, s, u). True\"\n unfolding urge_commute sem_def conv_automaton_of' by (rule urge.urge_bisim[unfolded conv_states])\n\nlemma check_sexp_equiv:\n assumes \"urge_bisim.A_B.equiv' (L, s, u) (L', s', u')\"\n shows \"check_sexp e L (the o s) = check_sexp e L' (the o s')\"\n using assms unfolding urge_bisim.A_B.equiv'_def by simp\n\ncontext\n fixes a\\<^sub>0 :: \"'s list \\ ('x \\ int option) \\ ('c \\ real)\"\n assumes start: \"fst a\\<^sub>0 \\ states\" \"snd (snd a\\<^sub>0) urge = 0\"\nbegin\n\nlemma start_equiv: \"urge_bisim.A_B.equiv' a\\<^sub>0 a\\<^sub>0\"\n using start unfolding urge_bisim.A_B.equiv'_def by auto\n\nlemma urge_models_iff:\n \"sem,a\\<^sub>0 \\ \\ \\ rename.sem,a\\<^sub>0 \\ \\\"\nproof -\n have \"rel_ctl_formula urge_bisim.compatible (ctl_of \\) (ctl_of \\)\"\n by (cases \\) (auto simp: prop_of_def rel_fun_def check_sexp_equiv)\n with start_equiv show ?thesis\n by (simp only: models_ctl_iff urge_bisim.CTL_compatible[THEN rel_funD, symmetric])\nqed\n\nlemma urge_has_deadlock_iff:\n \"has_deadlock sem a\\<^sub>0 \\ has_deadlock rename.sem a\\<^sub>0\"\n unfolding has_deadlock_def using start_equiv\n by (intro urge_bisim.deadlock_iff, unfold urge_bisim.A_B.equiv'_def) auto\n\nlemma state_formula_compatible:\n \"(\\x \\ set_state_formula \\. locs_of_sexp x) \\ {0..\n rel_state_formula urge_bisim.compatible\n (map_state_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\n (map_state_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\" and path_formula_compatible:\n \"(\\x \\ set_path_formula \\. locs_of_sexp x) \\ {0..\n rel_path_formula urge_bisim.compatible\n (map_path_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\n (map_path_formula (\\P (L, s, _). check_sexp P L (the o s)) \\)\"\n by (induction \\ and \\) (auto simp: check_sexp_equiv prop_of_def rel_fun_def)\n\nlemmas urge_models_state_compatible =\n urge_bisim.models_state_compatible[OF state_formula_compatible]\n\nend (* Start State *)\n\nend (* Simple_Network_Rename *)\n\n\nlocale Simple_Network_Rename_Start =\n Simple_Network_Rename where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\" +\n fixes s\\<^sub>0 :: \"('x \\ int) list\"\n and L\\<^sub>0 :: \"'s list\"\n assumes L\\<^sub>0_states: \"L\\<^sub>0 \\ states\"\n and s\\<^sub>0_dom: \"fst ` set s\\<^sub>0 = var_set\" and s\\<^sub>0_distinct: \"distinct (map fst s\\<^sub>0)\"\nbegin\n\nlemma rename_n_ps_eq:\n \"rename.n_ps = n_ps\"\n unfolding rename.length_automata_eq_n_ps[symmetric] n_ps_def by simp\n\nlemma rename_states_eq:\n \"rename.states = states\"\n unfolding rename.states_def states_def rename_n_ps_eq\n by (simp add: rename.N_eq[unfolded rename_n_ps_eq] N_eq n_ps_def del: map_map)\n (auto simp: automaton_of_def conv_urge_def trans_def split: prod.splits)\n\nlemma state_eq:\n \"map_of (map (\\(x, y). (extend_bij renum_vars var_set x, y)) s\\<^sub>0) =\n map_of (map (\\(x, y). (renum_vars x, y)) s\\<^sub>0)\"\n using s\\<^sub>0_dom by - (rule arg_cong, auto intro: renum_vars_bij_extends)\n\nlemma sexp_eq:\n assumes\n \\vars_of_sexp e \\ var_set\\\n \\set2_sexp e \\ loc_set\\\n \\locs_of_sexp e \\ {0..\n shows \\map_sexp (\\p. extend_bij (renum_states p) loc_set) (extend_bij renum_vars var_set) id e =\n map_sexp renum_states renum_vars id e\\\n using assms by (induction e; clarsimp simp: renum_states_extend)\n\nlemma L\\<^sub>0_dom:\n \"length L\\<^sub>0 = n_ps\" \"set L\\<^sub>0 \\ loc_set\"\n using L\\<^sub>0_states by (auto intro!: states_loc_setD)\n\ndefinition\n \"a\\<^sub>0 = (L\\<^sub>0, map_of s\\<^sub>0, \\_. 0)\"\n\ndefinition\n \"a\\<^sub>0' = (\n map_index (\\p. renum_states p) L\\<^sub>0,\n map_of (map (\\(x, y). (renum_vars x, y)) s\\<^sub>0),\n \\_. 0)\"\n\nsublocale rename: Simple_Network_Rename_Start_int\n broadcast bounds'\n \"extend_bij renum_acts act_set\"\n \"extend_bij renum_vars var_set\"\n \"extend_bij renum_clocks (insert urge clk_set')\"\n \"\\p. extend_bij (renum_states p) loc_set\"\n s\\<^sub>0 L\\<^sub>0\n \"map (conv_urge urge) automata\"\n apply (standard; (rule L\\<^sub>0_states[folded rename_states_eq] s\\<^sub>0_distinct)?)\n unfolding s\\<^sub>0_dom rename.bounds'_var_set[symmetric] bounds'_var_set ..\n\nlemma rename_a\\<^sub>0_eq:\n \"rename.a\\<^sub>0 = a\\<^sub>0\"\n unfolding rename.a\\<^sub>0_def a\\<^sub>0_def ..\n\nlemma rename_a\\<^sub>0'_eq:\n \"rename.a\\<^sub>0' = a\\<^sub>0'\"\n unfolding a\\<^sub>0'_def rename.a\\<^sub>0'_def\n apply (clarsimp, rule conjI)\n subgoal\n using L\\<^sub>0_dom by (auto intro!: map_index_cong renum_states_extend)\n subgoal\n unfolding vars_inv_def using s\\<^sub>0_dom s\\<^sub>0_distinct\n by (auto simp: state_eq Simple_Network_Rename_Defs.vars_inv_def)\n done\n\nlemma has_deadlock_iff:\n \"has_deadlock rename.renum.sem a\\<^sub>0' \\ has_deadlock sem a\\<^sub>0\"\nproof -\n have \"has_deadlock sem a\\<^sub>0 \\ has_deadlock rename.sem a\\<^sub>0\"\n by (rule urge_has_deadlock_iff) (auto intro: L\\<^sub>0_states simp: a\\<^sub>0_def)\n also have \"\\ \\ has_deadlock rename.renum.sem a\\<^sub>0'\"\n by (rule rename.has_deadlock_iff[unfolded rename_a\\<^sub>0_eq rename_a\\<^sub>0'_eq])\n finally show ?thesis ..\nqed\n\nlemma N_eq_sem:\n \"Simple_Network_Language_Model_Checking.N broadcast automata bounds' = sem\"\n unfolding conv_alt_def sem_def\n by safe (rule nth_equalityI; simp add: conv_N_eq N_eq sem_N_eq conv_automaton_of n_ps_def)\n\nlemma rename_N_eq_sem':\n \"Simple_Network_Language_Model_Checking.N\n (map renum_acts broadcast)\n (map_index renum_automaton automata)\n (map (\\(a,p). (renum_vars a,p)) bounds')\n = renum.sem\"\n unfolding renum.sem_def\n unfolding renum.conv_alt_def\n by safe (rule nth_equalityI; simp add: conv_N_eq N_eq sem_N_eq conv_automaton_of n_ps_def)\n\nlemmas has_deadlock_iff' =\n has_deadlock_iff[unfolded rename_N_eq_sem, folded N_eq_sem, unfolded a\\<^sub>0_def a\\<^sub>0'_def]\n\nlemmas start_equiv = start_equiv[of a\\<^sub>0, unfolded a\\<^sub>0_def, simplified, OF L\\<^sub>0_states]\n\nlemmas urge_models_state_compatible =\n urge_models_state_compatible[THEN rel_funD, OF _ _ _ start_equiv,\n of a\\<^sub>0, unfolded a\\<^sub>0_def, simplified, OF L\\<^sub>0_states]\n\nlemmas rename_models_state_compatible =\n rename.models_state_compatible[THEN rel_funD, OF _ rename.start_equiv,\n unfolded rename_a\\<^sub>0_eq a\\<^sub>0_def rename_n_ps_eq rename_a\\<^sub>0'_eq a\\<^sub>0'_def]\n\nlemmas models_state_compatible =\n transp_equality[THEN transpD, OF urge_models_state_compatible rename_models_state_compatible]\n\nlemmas models_state_compatible' = models_state_compatible[unfolded rename_N_eq_sem, folded N_eq_sem]\n\nend\n\nlocale Simple_Network_Rename_Formula =\n Simple_Network_Rename_Start where automata = automata\n for automata ::\n \"('s list \\ 's list\n \\ (('a :: countable) act, 's, 'c, int, 'x :: countable, int) transition list\n \\ (('s :: countable) \\ ('c :: countable, int) cconstraint) list) list\" +\n fixes \\ :: \"(nat, 's, 'x, int) formula\"\n assumes formula_dom:\n \"set2_formula \\ \\ loc_set\"\n \"locs_of_formula \\ \\ {0.. \\ var_set\"\nbegin\n\nsublocale rename: Simple_Network_Rename_Formula_int\n broadcast bounds'\n \"extend_bij renum_acts act_set\"\n \"extend_bij renum_vars var_set\"\n \"extend_bij renum_clocks (insert urge clk_set')\"\n \"\\p. extend_bij (renum_states p) loc_set\"\n s\\<^sub>0 L\\<^sub>0\n \"map (conv_urge urge) automata\"\n apply (standard; (rule L\\<^sub>0_states[folded rename_states_eq] s\\<^sub>0_distinct)?)\n unfolding s\\<^sub>0_dom rename.bounds'_var_set[symmetric] bounds'_var_set .\n\ndefinition\n \"\\' = map_formula (\\p. renum_states p) renum_vars id \\\"\n\nlemma rename_\\'_eq:\n \"rename.\\' = \\'\"\n using formula_dom unfolding rename.\\'_def \\'_def by (induction \\; clarsimp simp: sexp_eq)\n\nlemma models_iff1:\n \"rename.renum.sem,a\\<^sub>0' \\ \\' \\ rename.sem,a\\<^sub>0 \\ \\\"\n by (intro rename.models_iff[unfolded rename_a\\<^sub>0_eq rename_a\\<^sub>0'_eq rename_\\'_eq rename_n_ps_eq]\n formula_dom sym)\n\nlemma models_iff2:\n \"rename.sem,a\\<^sub>0 \\ \\ \\ sem,a\\<^sub>0 \\ \\\"\n by (rule sym, intro urge_models_iff formula_dom) (auto intro: formula_dom L\\<^sub>0_states simp: a\\<^sub>0_def)\n\nlemma models_iff:\n \"rename.renum.sem,a\\<^sub>0' \\ \\' \\ sem,a\\<^sub>0 \\ \\\"\n unfolding models_iff1 models_iff2 ..\n\nlemmas models_iff' =\n models_iff[unfolded rename_N_eq_sem, folded N_eq_sem, unfolded a\\<^sub>0_def a\\<^sub>0'_def \\'_def]\n\nend (* Simple_Network_Rename_Formula *)\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/Simple_Network_Language_Renaming.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2573072410435041}} {"text": "theory Rename_Cfg\nimports \"../RefPoint/SM_Cfg\"\n Type_System SM_Finite_Reachable Gen_Cfg_Bisim\n \"HOL-Library.IArray\"\nbegin\n\n(* TODO: Move *)\nlemma set_list_bind[simp]: \"set (List.bind m f) = Set.bind (set m) (\\x. set (f x))\"\n by (auto simp: List.bind_def)\n\nlemma rel_mset_of_mapI:\n assumes \"\\x\\set l. R (f x) (g x)\"\n shows \"rel_mset R (mset (map f l)) (mset (map g l))\"\n using assms\n apply (induction l)\n apply (auto simp: rel_mset_Zero rel_mset_Plus)\n done\n\n\n(* TODO: Move? *)\nlemma finite_max1_elemI:\n assumes \"(\\x y. x\\S \\ y\\S \\ x=y)\" \n shows \"finite S\"\nproof (cases \"S={}\")\n case False \n with assms obtain x where \"S={x}\" by auto\n thus ?thesis by auto\nqed auto\n\n\nlemma left_unique_finite_sngI: \n assumes \"left_unique R\" \n shows \"finite {a. R a b}\"\nproof (rule finite_subset)\n { \n fix x y\n assume \"x\\{a. R a b}\" \"y\\{a. R a b}\"\n hence \"x=y\" using assms\n by (auto dest: left_uniqueD)\n } thus \"finite {a. R a b}\"\n by (blast intro: finite_max1_elemI)\nqed auto \n\n\n\nfunction approx_reachable_list_aux :: \"cmd \\ cmd list\" where\n \"approx_reachable_list_aux (Assign c x e) = [Assign c x e, Skip]\"\n| \"approx_reachable_list_aux (Assign_local c x e) = [Assign_local c x e, Skip]\"\n| \"approx_reachable_list_aux (Assign_global c x e) = [Assign_global c x e, Skip]\"\n| \"approx_reachable_list_aux (Test e) = [Test e, Skip]\"\n| \"approx_reachable_list_aux (Skip) = [Skip]\"\n| \"approx_reachable_list_aux (Seq c1 c2) = (approx_reachable_list_aux c2) @ (do { c1\\approx_reachable_list_aux c1; [Seq c1 c2] })\"\n| \"approx_reachable_list_aux (Or c1 c2) = (Or c1 c2) # (approx_reachable_list_aux c1 @ approx_reachable_list_aux c2)\"\n| \"approx_reachable_list_aux (Break) = [Break,Invalid]\"\n| \"approx_reachable_list_aux (Continue) = [Continue,Invalid]\"\n| \"approx_reachable_list_aux (Iterate c1 c2) = Skip #\n (do { c1\\approx_reachable_list_aux c1; [Iterate c1 c2] })\n @ (do { c2'\\approx_reachable_list_aux c2; [Iterate c2' c2] })\"\n| \"approx_reachable_list_aux Invalid = [Invalid]\"\nby pat_completeness auto\n\ntermination\n apply (relation \"reachable_term_order_aux <*mlex*> measure size\")\n apply (metis wf_measure wf_mlex)\n apply (auto simp: mlex_prod_def)\n done\n\nlemma approx_reachable_list_aux_refine: \n \"set (approx_reachable_list_aux c) = approx_reachable c\"\n apply (induction c rule: approx_reachable.induct)\n apply (simp_all)\n done\n\ndefinition \"cfg_V0 prog \\ proc_decl.body ` set (program.processes prog)\"\ndefinition \"cfg_V0_list prog \\ remdups (map proc_decl.body (program.processes prog))\"\n\nlemma cfg_V0_list_invar: \"distinct (cfg_V0_list prog)\"\n unfolding cfg_V0_list_def by auto\n\nlemma cfg_V0_list_refine: \"set (cfg_V0_list prog) = cfg_V0 prog\"\n unfolding cfg_V0_list_def cfg_V0_def by auto\n\n\ndefinition \"approx_reachable_list prog \\ \n remdups (concat (map approx_reachable_list_aux (cfg_V0_list prog)))\"\n\ndefinition \"approx_reachable_prog prog \\ \\(approx_reachable`(cfg_V0 prog))\"\n\n\nlemma approx_reachable_list_invar: \"distinct (approx_reachable_list prog)\"\n unfolding approx_reachable_list_def\n by auto\n\nlemma approx_reachable_list_refine: \n \"set (approx_reachable_list prog) = approx_reachable_prog prog\"\n unfolding approx_reachable_list_def approx_reachable_prog_def\n by (auto simp: approx_reachable_list_aux_refine cfg_V0_list_refine)\n\ntext \\CFG successors\\\nprimrec cfg_succ :: \"cmd \\ ((action+brk_ctd) \\ cmd) set\" where\n \"cfg_succ (Assign c x e) = {((Inl (AAssign c x e)), Skip)}\"\n| \"cfg_succ (Assign_local c x e) = {((Inl (AAssign_local c x e)), Skip)}\"\n| \"cfg_succ (Assign_global c x e) = {((Inl (AAssign_global c x e)), Skip)}\"\n| \"cfg_succ (Test e) = {((Inl (ATest e)), Skip)}\"\n| \"cfg_succ (Seq c1 c2) =\n ( if c1=Skip then \n {((Inl ASkip), c2)}\n else\n { (e,if c1'=Skip then c2 else Seq c1' c2) | c1' e. (e,c1')\\cfg_succ c1}\n )\"\n| \"cfg_succ (Or c1 c2) = cfg_succ c1 \\ cfg_succ c2\"\n| \"cfg_succ (Break) = {(Inr AIBreak, Invalid)}\"\n| \"cfg_succ (Continue) = {(Inr AIContinue, Invalid)}\"\n| cfg_succ_iterate: \n \"cfg_succ (Iterate c cb) =\n (if c=Skip then {(Inl ASkip, Iterate cb cb)} else {})\n \\ (\n \\ (Inl e,c') \\ (Inl e, if c'=Skip then Iterate cb cb else Iterate c' cb)\n | (Inr AIBreak,_) \\ (Inl ASkip,Skip)\n | (Inr AIContinue,_) \\ (Inl ASkip, Iterate cb cb)\n )`cfg_succ c\"\n| \"cfg_succ Skip = {}\"\n| \"cfg_succ Invalid = {}\"\n\n\ndeclare cfg_succ_iterate[simp del]\nlemma cfg_succ_iterate'[simp]: \"cfg_succ (Iterate c cb) = \n (if c=Skip then {(Inl ASkip, Iterate cb cb)} else {})\n \\ { (Inl e, if c'=Skip then Iterate cb cb else Iterate c' cb) | e c'. (Inl e, c') \\ cfg_succ c }\n \\ (if \\c'. (Inr AIBreak,c')\\ cfg_succ c then { (Inl ASkip, Skip)} else {})\n \\ (if \\c'. (Inr AIContinue,c')\\ cfg_succ c then { (Inl ASkip, Iterate cb cb)} else {})\"\n unfolding cfg_succ_iterate\n apply (rule sym)\n apply (cases \"c=Skip\")\n apply simp\n apply safe\n apply simp_all\n apply force\n apply (force split: if_split_asm)\n apply (force split: if_split_asm)\n apply (auto split: if_split_asm sum.splits brk_ctd.splits)\n done\n\nlemma cfg_succ_iff_cfg: \"(a,c')\\cfg_succ c \\ cfg c a c'\"\n apply rule\n apply (induction c arbitrary: a c')\n apply ((auto intro: cfg.intros split: if_split_asm) [])+\n \n apply (induction rule: cfg.induct)\n apply auto\n done\n\ntheorem cfg_succ_correct: \"cfg_succ c = {(a,c'). cfg c a c'}\"\n using cfg_succ_iff_cfg by auto\n\nlemma cfg_succ_finite[simp, intro!]: \"finite (cfg_succ c)\"\n apply (induction c)\n using [[simproc add: finite_Collect]]\n apply (simp_all del: cfg_succ_iterate' add: cfg_succ_iterate)\n done\n \n\nprimrec cfg_succ_list :: \"cmd \\ ((action+brk_ctd) \\ cmd) list\" where\n \"cfg_succ_list (Assign ge x e) = [((Inl (AAssign ge x e)), Skip)]\"\n| \"cfg_succ_list (Assign_local ge x e) = [((Inl (AAssign_local ge x e)), Skip)]\"\n| \"cfg_succ_list (Assign_global ge x e) = [((Inl (AAssign_global ge x e)), Skip)]\"\n| \"cfg_succ_list (Test e) = [((Inl (ATest e)), Skip)]\"\n| \"cfg_succ_list (Seq c1 c2) =\n ( if c1=Skip then \n [((Inl ASkip), c2)] \n else \n map (\\(e,c1'). (e,if c1'=Skip then c2 else Seq c1' c2)) (cfg_succ_list c1)\n )\"\n| \"cfg_succ_list (Or c1 c2) = remdups (cfg_succ_list c1 @ cfg_succ_list c2)\"\n| \"cfg_succ_list (Break) = [(Inr AIBreak, Invalid)]\"\n| \"cfg_succ_list (Continue) = [(Inr AIContinue, Invalid)]\"\n| cfg_succ_list_iterate: \n \"cfg_succ_list (Iterate c cb) =\n (if c=Skip then [(Inl ASkip, Iterate cb cb)] else [])\n @ remdups (map (\n \\ (Inl e,c') \\ (Inl e, if c'=Skip then Iterate cb cb else Iterate c' cb)\n | (Inr AIBreak,_) \\ (Inl ASkip,Skip)\n | (Inr AIContinue,_) \\ (Inl ASkip, Iterate cb cb)\n ) (cfg_succ_list c))\"\n| \"cfg_succ_list Skip = []\"\n| \"cfg_succ_list Invalid = []\"\n\n(* FIXME: Strange, the simplifier should know such lemmas!? *)\nlemma Seq_ne_structural[simp]:\n \"Seq a b \\ a\"\n \"Seq a b \\ b\"\n \"a \\ Seq a b\"\n \"b \\ Seq a b\"\nproof -\n show G1: \"Seq a b \\ a\"\n by (induction a arbitrary: b) auto\n show G2: \"Seq a b \\ b\"\n by (induction b arbitrary: a) auto\n show \"a \\ Seq a b\" using G1 by simp\n show \"b \\ Seq a b\" using G2 by simp\nqed\n\nlemma cfg_succ_list_invar: \"distinct (cfg_succ_list c)\"\n apply (induction c)\n apply (auto simp: distinct_map)\n apply (rule inj_onI)\n apply (auto split: if_split_asm ) []\n done \n\nlemma cfg_succ_list_refine: \"set (cfg_succ_list c) = cfg_succ c\"\n apply (induction c)\n apply (simp_all only: cfg_succ.simps cfg_succ_list.simps \n if_distrib[of set] if_same_eq set_map)\n apply (simp_all)\n apply (auto, force+) []\n done\n\ndefinition \"cfg'_succ_list c \\ map (map_prod projl id) (filter (isl o fst) (cfg_succ_list c))\"\n\nlemma cfg'_succ_list_invar: \"distinct (cfg'_succ_list c)\"\n unfolding cfg'_succ_list_def\n apply (auto simp: distinct_map cfg_succ_list_invar intro!: inj_onI)\n apply (rename_tac a a' foo)\n apply (case_tac a, simp_all)\n done\n \nlemma cfg'_succ_list_refine: \"set (cfg'_succ_list c) = {(a,c'). cfg' c a c'}\"\n unfolding cfg'_succ_list_def\n by (force simp: cfg_succ_list_refine cfg'_def cfg_succ_correct)\n\n\n\n\n\ndefinition \"index_of l x \\ \n if \\i l!i=x)\n else None\"\n\nlemma index_of_Some_conv:\n assumes \"distinct l\"\n shows \"index_of l x = Some i \\ i < length l \\ l ! i = x\"\nproof safe\n show \"index_of l x = Some i \\ i < length l\"\n using assms unfolding index_of_def distinct_conv_nth\n by (metis (mono_tags, lifting) option.distinct(1) option.inject theI)\n show \"index_of l x = Some i \\ l ! i = x\"\n using assms unfolding index_of_def distinct_conv_nth\n by (metis (mono_tags, lifting) option.distinct(1) option.inject theI)\n show \"i < length l \\ x = l ! i \\ index_of l (l ! i) = Some i\"\n using assms unfolding index_of_def distinct_conv_nth by auto\nqed\n\nlemma dom_index_of: \"dom (index_of l) = set l\"\n by (auto simp: index_of_def in_set_conv_nth split: if_split_asm)\n\nlemma index_of_None_conv: \"index_of l x = None \\ x\\set l\"\n using dom_index_of[of l] by auto\n\nlemma index_of_Nil: \"index_of [] x = None\"\n by (auto simp: index_of_None_conv)\n\nlemma index_of_Cons: \"distinct (a#l) \n \\ index_of (a#l) x = (if x=a then Some 0 else map_option Suc (index_of l x))\"\n apply (auto simp: index_of_Some_conv)\n apply (cases \"index_of (a # l) x\")\n apply (simp_all only: )\n apply (cases \"index_of l x\")\n apply (simp_all only: ) [2]\n apply (auto simp: index_of_Some_conv index_of_None_conv) [2]\n apply (cases \"index_of l x\")\n apply (simp_all only: )\n apply (auto simp: index_of_Some_conv index_of_None_conv \n in_set_conv_nth nth_Cons nth_eq_iff_index_eq split: nat.splits)\n done\n\nprimrec cr_index_of where\n \"cr_index_of [] x = None\"\n| \"cr_index_of (a#l) x = (if x=a then Some 0 else map_option Suc (cr_index_of l x))\"\n\nlemma cr_index_of_eq: \"distinct l \\ cr_index_of l = index_of l\"\n apply (induction l)\n apply (auto simp: index_of_Nil index_of_Cons)\n done\n\nlocale sl_graph = asystem +\n fixes rlist and succ_list\n assumes rl_distinct: \"distinct rlist\"\n assumes rl_reachable: \"E\\<^sup>* `` V0 \\ set rlist\"\n assumes rl_closed: \"\\c c'. \\c\\set rlist; (c, c') \\ step\\ \\ c'\\set rlist\"\n assumes sl_distinct: \"c\\set rlist \\ distinct (succ_list c)\"\n assumes sl_succs: \"set (succ_list c) = {(a,c'). astep c a c'}\"\nbegin\n definition \"succs_tab \\ map succ_list rlist\"\n\n lemma astep_succs_tab_conv:\n assumes R: \"c\\set rlist\"\n shows \"astep c a c' \\ (\\i (a,c')\\set (succs_tab!i))\"\n proof -\n from R obtain i where \"ij. \\c = rlist!j; j \\ i=j\" \n proof -\n fix j\n assume \"c = rlist!j\" \"ji \\j] \n show \"i=j\" by simp\n qed\n\n from 1 show ?thesis using sl_succs \n by (auto dest: AUX)\n qed\n\n lemma succs_tab_invar: \"i distinct (succs_tab!i)\"\n unfolding succs_tab_def \n using rl_reachable sl_distinct\n by auto\n\n lemma succs_tab_rl: \"\\iset (succs_tab!i)\\ \n \\ c' \\ set rlist\"\n unfolding succs_tab_def\n apply (simp add: sl_succs)\n apply (rule rl_closed[rotated])\n unfolding step_def\n apply blast\n apply simp\n done\n\n definition \"mapped_succs_tab \\ IArray (\n map (map (\\(a,c'). (a,the (cr_index_of rlist c')))) succs_tab)\"\n\n \n\n definition \"\\ c \\ the (cr_index_of rlist c)\"\n definition \"\\ i \\ rlist!i\"\n definition \"succ_impl ci \\ \n if ci (a,c')\\set (succ_impl c)\"\n\n lemma astep_succ_finite[simp, intro!]: \n \"finite {(a,c'). astep_impl c a c'}\"\n unfolding astep_impl_def\n by auto\n\n lemma astep_succ_finite_c[simp, intro!]:\n \"finite ({c'. \\a. astep_impl c a c'})\"\n proof -\n have \"{c'. \\a. astep_impl c a c'} = snd`{(a,c'). astep_impl c a c'}\"\n by auto\n also have \"finite \\\" by auto\n finally show ?thesis .\n qed \n\n lemma \\_inj: \"inj_on \\ {0.._def nth_eq_iff_index_eq[OF rl_distinct])\n\n lemma \\_inj: \"inj_on \\ (set rlist)\"\n using rl_reachable\n apply (auto intro!: inj_onI \n simp: \\_def rl_distinct \n cr_index_of_eq)\n by (metis index_of_None_conv index_of_Some_conv not_None_eq \n option.sel rl_distinct)\n \n lemma \\_\\_inverse: \"i \\ (\\ i) = i\" \n unfolding \\_def \\_def\n apply (auto simp: cr_index_of_eq[OF rl_distinct])\n apply (cases \"index_of rlist (rlist ! i)\", simp_all)\n apply (auto simp: index_of_None_conv index_of_Some_conv[OF rl_distinct]\n simp: nth_eq_iff_index_eq[OF rl_distinct])\n done\n \n lemma \\_\\_inverse: \"c\\set rlist \\ \\ (\\ c) = c\" \n unfolding \\_def \\_def\n apply (auto simp: cr_index_of_eq[OF rl_distinct])\n apply (cases \"index_of rlist c\", simp_all)\n apply (auto simp: index_of_None_conv index_of_Some_conv[OF rl_distinct]\n simp: nth_eq_iff_index_eq[OF rl_distinct])\n done\n\n lemma \\_invar: \"c\\set rlist \\ \\ c < length rlist\"\n apply (auto simp: \\_def cr_index_of_eq rl_distinct)\n by (metis index_of_None_conv index_of_Some_conv \n not_None_eq option.sel rl_distinct)\n\n lemma \\_invar: \"i \\ i \\ set rlist\"\n unfolding \\_def by simp \n\n definition \"invar i \\ i brp \\ invar\" \n definition \"reli \\ brp \\ (\\x. x\\set rlist)\" \n\n lemma bi_unique_rel: \"bi_unique rel\"\n apply (intro bi_uniqueI left_uniqueI right_uniqueI)\n by (auto simp: rel_def build_relp_def invar_def\n inj_onD[OF \\_inj])\n\n lemma bi_unique_reli: \"bi_unique reli\"\n apply (intro bi_uniqueI left_uniqueI right_uniqueI)\n by (auto simp: reli_def build_relp_def \n inj_onD[OF \\_inj])\n\n lemma rel_inv_eq_reli: \"rel\\\\ = reli\"\n by (auto \n intro!: ext \n simp: rel_def reli_def build_relp_def invar_def\n simp: \\_\\_inverse \\_\\_inverse \\_invar \\_invar\n )\n\n corollary reli_inv_eq_rel: \"reli\\\\ = rel\"\n using arg_cong[where f=\"\\r. r\\\\\", OF rel_inv_eq_reli, simplified]\n by simp\n\n lemma rel_unfold1: \"c\\set rlist \\ rel i c \\ i = \\ c\" \n unfolding reli_inv_eq_rel[symmetric]\n by (simp add: reli_def build_relp_def)\n\n lemma is_reachable_criE:\n assumes R: \"c \\ E\\<^sup>* `` V0\"\n obtains i where \"cr_index_of rlist c = Some i\"\n proof -\n from R have IS: \"c\\set rlist\" using rl_reachable by auto\n\n show ?thesis\n using IS\n by (auto \n simp: cr_index_of_eq[OF rl_distinct] index_of_Some_conv[OF rl_distinct]\n simp: in_set_conv_nth\n intro: that)\n qed\n\n lemma sim1i: \"\\ astep c1 a c2; reli c1 c1' \\ \\ \\c2'. reli c2 c2' \\ astep_impl c1' a c2'\"\n apply (auto simp: reli_def build_relp_def)\n apply (rule rl_closed, auto simp: step_def) []\n proof -\n assume R: \"c1\\set rlist\" and S: \"astep c1 a c2\"\n then obtain i where L: \"iset (succs_tab!i)\"\n by (auto simp: astep_succs_tab_conv)\n\n have [simp]: \"i c1 = i\" \n unfolding \\_def\n apply (cases \"cr_index_of rlist c1\")\n apply simp_all\n apply (auto simp: cr_index_of_eq[OF rl_distinct] \n index_of_Some_conv[OF rl_distinct] index_of_None_conv \n nth_eq_iff_index_eq[OF rl_distinct]) \n done\n\n show \"astep_impl (\\ c1) a (\\ c2)\" \n using AC'\n apply (auto simp: astep_impl_def succ_impl_def mapped_succs_tab_def)\n apply (auto simp: \\_def)\n done\n qed\n\n lemma sim2i: \"\\ astep_impl c1' a c2'; reli c1 c1' \\ \\ \\c2. reli c2 c2' \\ astep c1 a c2\"\n proof -\n assume \"reli c1 c1'\"\n hence R: \"c1\\set rlist\" and [simp]: \"c1'=\\ c1\" \n by (auto simp: reli_def build_relp_def)\n \n hence [simp]: \"\\ c1 < length rlist\"\n unfolding \\_def using rl_reachable\n apply (cases \"cr_index_of rlist c1\", simp_all)\n apply (auto simp: \\_def cr_index_of_eq[OF rl_distinct] \n index_of_None_conv index_of_Some_conv[OF rl_distinct])\n done\n\n have [simp]: \"rlist!\\ c1 = c1\"\n unfolding \\_def[symmetric]\n by (simp add: \\_\\_inverse R)\n\n assume \"astep_impl c1' a c2'\"\n then obtain c2 where \"(a, c2) \\ set (succs_tab ! \\ c1)\" and [simp]: \"c2' = \\ c2\"\n apply (auto simp: astep_impl_def succ_impl_def mapped_succs_tab_def)\n apply (auto simp: \\_def)\n done\n with astep_succs_tab_conv[THEN iffD2, OF R, OF exI, of c1' a c2]\n have \"astep c1 a c2\" by auto\n moreover hence \"c2\\set rlist\" \n using rl_closed[OF R, of c2] by (auto simp: step_def)\n hence \"reli c2 c2'\"\n by (auto simp: reli_def build_relp_def)\n ultimately show \"\\c2. reli c2 c2' \\ astep c1 a c2\" by blast \n qed \n\n corollary sim1: \"\\ astep_impl c1' a c2'; rel c1' c1 \\ \\ \\c2. rel c2' c2 \\ astep c1 a c2\"\n using sim2i unfolding reli_inv_eq_rel[symmetric] by simp\n\n corollary sim2: \"\\ astep c1 a c2; rel c1' c1 \\ \\ \\c2'. rel c2' c2 \\ astep_impl c1' a c2'\"\n using sim1i unfolding reli_inv_eq_rel[symmetric] by simp\n\n\n lemma succ_impl_invar: \"distinct (succ_impl ci)\"\n unfolding succ_impl_def mapped_succs_tab_def invar_def\n using succs_tab_invar[of ci]\n apply (clarsimp simp: distinct_map)\n apply (fold \\_def)\n apply (rule inj_onI)\n apply clarsimp (* TODO: This proof is not particular clean *)\n apply (drule (1) succs_tab_rl[rotated])\n apply (drule (1) succs_tab_rl[rotated])\n by (metis \\_\\_inverse local.\\_def)\n \n lemma succ_impl_invarc: \"\\invar c; (a,c')\\set (succ_impl c)\\ \\ invar c'\"\n unfolding succ_impl_def mapped_succs_tab_def invar_def\n apply (clarsimp)\n by (metis \\_def \\_invar succs_tab_rl)\n \n lemma astep_impl_invarc: \"\\invar c; astep_impl c a c'\\ \\ invar c'\" \n unfolding astep_impl_def\n by (auto intro: succ_impl_invarc)\n\nend\n\nlemma path'_path_conv:\n \"li'.cs.path c p c' \\ cfg_lts.path c (map Inl p) c'\"\n by (induction p arbitrary: c) (auto simp: cfg'_def)\n\nlemma approx_reachable_approx': \"li'.cs.reachable c c' \\ c' \\ approx_reachable c\"\n using approx_reachable_approx[of c c']\n by (auto simp: LTS.reachable_def path'_path_conv)\n\n(* TODO: Move *)\nlemma approx_reachable_closed':\n assumes \"c\\approx_reachable c0\"\n assumes \"cfg' c a c'\"\n shows \"c'\\approx_reachable c0\"\n using assms\n unfolding cfg'_def\n using approx_reachable_closed\n by blast\n\ntype_synonym cmdc = nat\ntype_synonym local_config = \"(cmdc, local_state) Gen_Scheduler.local_config\"\ntype_synonym global_config = \"(cmdc, local_state, global_state) Gen_Scheduler.global_config\"\n\nlocale cprog = \n fixes prog :: program\nbegin\n sublocale comp: asystem \"\\x. x\\cfg_V0 prog\" cfg' .\n\n sublocale comp: sl_graph \n \"\\x. x\\cfg_V0 prog\" cfg' \n \"approx_reachable_list prog\" \"cfg'_succ_list\" \n apply unfold_locales\n apply (simp_all \n add: approx_reachable_list_invar approx_reachable_list_refine\n add: cfg'_succ_list_invar cfg'_succ_list_refine\n add: approx_reachable_prog_def \n ) \n using approx_reachable_approx'\n apply (auto simp: comp.step_path_conv LTS.reachable_def) []\n\n using approx_reachable_closed' unfolding comp.step_def\n by blast\n\n abbreviation \"cfgc \\ comp.astep_impl\"\n\n definition init_pc :: \"proc_decl \\ local_config\" where\n \"init_pc pd \\ \\\n local_config.command = comp.\\ (proc_decl.body pd),\n local_config.state = \\\n local_state.variables = init_valuation (proc_decl.local_vars pd)\n \\\n \\\"\n \n definition init_gc :: \"global_config\" where\n \"init_gc \\ \\\n global_config.processes = mset (map init_pc (program.processes prog)),\n global_config.state = \\\n global_state.variables = init_valuation (program.global_vars prog)\n \\\n \\\"\n\n\n sublocale lih': Gen_Scheduler'_linit \n cfgc la_en' la_ex' \n \"{init_gc}\" global_config.state .\n\n sublocale hc_bisim: Gen_Cfg_Bisim_Pre comp.rel\n cfgc cfg' la_en' la_ex'\n apply unfold_locales\n apply (blast dest: comp.sim1)\n apply (blast dest: comp.sim2)\n done\n\n lemma approx_reachable_prog0: \"p \\ set (program.processes prog) \\\n body p \\ approx_reachable_prog prog\" \n unfolding approx_reachable_prog_def\n by (auto simp: cfg_V0_def intro!: bexI)\n\n\n sublocale hc_bisim: Gen_Cfg_LBisim comp.rel\n cfgc \"{init_gc}\" global_config.state\n cfg' \"{SM_Semantics.init_gc prog}\" global_config.state la_en' la_ex'\n apply unfold_locales\n apply (auto \n simp: init_gc_def SM_Semantics.init_gc_def \n simp: init_pc_def SM_Semantics.init_pc_def \n simp: hc_bisim.rel_gc_def hc_bisim.rel_lc_def\n simp del: mset_map simp: mset_map[symmetric]\n intro!: rel_mset_of_mapI)\n\n apply (subst comp.rel_unfold1)\n apply (unfold approx_reachable_list_refine)\n apply (simp add: approx_reachable_prog0)\n apply simp\n\n apply (subst comp.rel_unfold1)\n apply (unfold approx_reachable_list_refine)\n apply (simp add: approx_reachable_prog0)\n apply simp\n done\n \n lemma lih'_accept_eq_li': \"lih'.sa.accept = li'.sa.accept prog\" \n by (rule hc_bisim.accept_bisim)\n\n\n definition \"lc_\\ lc \\ \\\n local_config.command = comp.\\ (local_config.command lc),\n local_config.state = local_config.state lc\n \\\"\n definition \"lc_invar lc \\ comp.invar (local_config.command lc)\"\n\n lemma hc_bisim_rel_lc_brp_conv: \"hc_bisim.rel_lc = brp lc_\\ lc_invar\"\n apply (intro ext)\n unfolding hc_bisim.rel_lc_def \n unfolding comp.rel_def lc_\\_def lc_invar_def build_relp_def\n by auto\n \n definition \"gc_\\ gc \\ \\\n global_config.processes = image_mset lc_\\ (global_config.processes gc),\n global_config.state = global_config.state gc\n \\\"\n definition \"gc_invar gc \\ \\lc. lc \\# global_config.processes gc \\ lc_invar lc\"\n\n lemma hc_bisim_rel_gc_brp_conv: \"hc_bisim.rel_gc = brp gc_\\ gc_invar\"\n apply (intro ext)\n unfolding hc_bisim.rel_gc_def hc_bisim_rel_lc_brp_conv\n unfolding comp.rel_def gc_\\_def gc_invar_def\n apply (auto simp: rel_mset_brp)\n apply (auto simp: build_relp_def)\n done\n\n lemmas bi_unique_rel_gc = hc_bisim.bi_unique_rel_gcI[OF comp.bi_unique_rel] \n lemmas bi_unique_rel_lc = hc_bisim.bi_unique_rel_lcI[OF comp.bi_unique_rel] \n\n lemma run_sim_lih'_li: \"lih'.sa.is_run r \\ li'.sa.is_run prog (gc_\\ o r)\"\n apply (rule hc_bisim.s1.br_run_sim)\n unfolding hc_bisim_rel_gc_brp_conv\n by auto\n\n lemmas lih'_reachable_finite_sim = hc_bisim.s1.reachable_finite_sim\n\nend\n\ncontext well_typed_prog begin \n sublocale cprog .\n\n lemma lih'_accept_eq: \"lih'.sa.accept = ref_accept prog\" \n by (simp add: lih'_accept_eq_li' li'.accept_eq)\n\n lemma lih'_is_run_sim: \"lih'.sa.is_run r \\ ref_is_run prog (Some o gc_\\ o r)\"\n apply (drule run_sim_lih'_li)\n unfolding li'.is_run_conv \n by (auto simp: o_def)\n\n lemma lih'_finite_reachable: \"finite ((g_E lih'.system_automaton)\\<^sup>* `` g_V0 lih'.system_automaton)\"\n apply (rule lih'_reachable_finite_sim)\n apply (rule li'_finite_reachable)\n unfolding rel_of_pred_def\n apply simp\n apply (rule left_unique_finite_sngI)\n using bi_unique_rel_gc\n apply (simp add: bi_unique_alt_def)\n done\n \nend\n\n(* Executable *)\ntype_synonym comp_info = \"(cmd list \\ (action \\ nat) list iarray)\"\n(* TODO: Using a list is slow. Could use a hashmap to map commands to\n their indices *)\n\ndefinition comp_info_of :: \"program \\ comp_info\" where\n \"comp_info_of prog \\ let\n rlist = approx_reachable_list prog;\n succs_tab = map cfg'_succ_list rlist;\n mapped_succs_tab = IArray (\n map (map (\\(a,c'). (a,the (cr_index_of rlist c')))) succs_tab)\nin\n (rlist,mapped_succs_tab)\"\n\ndefinition ccfg_succ_impl \n :: \"comp_info \\ nat \\ (action \\ nat) list\"\nwhere\n \"ccfg_succ_impl cinf c \\ \n let mst=snd cinf in \n if c_impl :: \"comp_info \\ cmd \\ cmdc\" where\n \"comp_\\_impl cinf c \\ the (cr_index_of (fst cinf) c)\"\n\nlemma (in cprog) comp_\\_impl: \"comp_\\_impl (comp_info_of prog) = comp.\\\"\n apply (intro ext)\n unfolding comp.\\_def\n unfolding comp_\\_impl_def comp_info_of_def\n by simp\n \n\nexport_code comp_info_of ccfg_succ_impl comp_\\_impl checking SML\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/Rename_Cfg.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.257291241538743}} {"text": "theory flash85Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Local_PutXAcksDoneVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_NakVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Remote_GetX_NakVsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv85: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv85: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv85 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_ReplaceShrVldVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_WbVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX1VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX2VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX1VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX2VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX3VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX4VsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_GetVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_PutVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_PutXVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_ReplaceVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Remote_GetVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv85: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv85 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv85: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv85 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash85Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.257291241538743}} {"text": "theory flash90Rev imports flashPub\nbegin\nsection{*Main defintions*}\n \n \n\nlemma lemmaOnPtrAtGetX[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv2 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv2 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\n\n\nlemma lemmaOnPtrAtGet[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv3 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv3 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\nlemma lemmaOnPtr1[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_Get )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGet)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr2[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGetX)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr3[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n\nabbreviation N::\"nat\" where \"N\\ M\"\nlemma NI_FAckVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n have allCases:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s \\formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Nak_HomeVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P3 s\" \n \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\" \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) \n (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iRule2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iRule2)) ) ) \" in exI)\n apply(rule conjI,simp)\n apply force\n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P3 s\" \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) \n ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P3 s\" \n\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) \n (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n \n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n \n have \"?P3 s\"\n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) \n ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iRule2)) ) ) \" in exI,auto)\n \n done\n\n \n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast \n\n \n\n \n \n \n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_GetX )) ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv2) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ) ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) \n (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iRule2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iRule2)) ) ) \" in exI,rule conjI,simp,force)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv1)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_Get )) (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2)) ) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_Get )) \n ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iRule2)) ) ) \" in exI,simp)\n by force\n \n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Put2VsInv90: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv90: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv90: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv90 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash90Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.257291241538743}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | May 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | October 2005 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_law_rep_par\nimports CSP_T_law_alpha_par CSP_T_op_rep_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*****************************************************************\n\n 1. associativity of [||]:I\n 2. commutativity of [||]:I\n 3. \n 4. \n\n *****************************************************************)\n\n(*****************************************************\n replace an index set with another equal index set\n *****************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Rep_parallel_index_eq:\n \"[| finite I1 ;\n EX f. I2 = f ` I1 & inj_on f I1 &\n (ALL i:I1. PXf2 (f i) = PXf1 i) |]\n ==> [||]:I1 PXf1 =T[M,M] [||]:I2 PXf2\"\napply (simp add: cspT_semantics)\n\napply (case_tac \"I1 = {}\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_traces_par)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (simp add: Union_index_fun)\n\n (* => *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_traces_par)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (simp add: Union_index_fun)\ndone\n\n(*********************************************************\n [||]:I PXf ==> [||] PXs\n *********************************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Index_to_Inductive_parallel:\n \"[| finite I ; Is isListOf I |] ==>\n [||]:I PXf =T[M,M] [||] (map PXf Is)\"\napply (simp add: cspT_semantics)\n\napply (case_tac \"I = {}\")\napply (simp)\n\napply (case_tac \"map PXf Is = []\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_traces_Rep_parallel)\n apply (simp add: in_traces_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (drule_tac x=\"Is!i\" in bspec)\n apply (simp add: isListOf_nth_in_index)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp add: in_traces_Rep_parallel)\n apply (simp add: in_traces_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (intro ballI)\n apply (elim conjE)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim exE conjE)\n apply (drule_tac x=\"n\" in spec, simp)\ndone\n\n(************************************\n | [||]:I PXf and SKIP |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_SKIP_Rep_parallel_right:\n \"finite I ==>\n (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP) =T[M,M]\n ([||]:I PXf)\"\napply (case_tac \"I={}\")\napply (simp add: cspT_SKIP_Alpha_parallel)\n\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces_par)\n\n apply (intro ballI)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces_par in_traces)\n apply (simp add: rest_tr_empty)\n\n apply (intro ballI)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\ndone\n\n(************************************\n | SKIP and [||]:I PXf |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_SKIP_Rep_parallel_left:\n \"finite I ==>\n (SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =T[M,M]\n ([||]:I PXf)\"\napply (subgoal_tac \n \"(SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =T[M,M]\n (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP)\")\napply (rule cspT_trans)\napply (simp)\napply (simp add: cspT_SKIP_Rep_parallel_right)\napply (simp add: cspT_Alpha_parallel_commut)\ndone\n\n(*** left and right ***)\n\nlemmas cspT_SKIP_Rep_parallel = cspT_SKIP_Rep_parallel_left\n cspT_SKIP_Rep_parallel_right\n\n(************************************\n | associativity |\n ************************************)\n\n(*------------------*\n | csp law |\n *------------------*)\n\nlemma cspT_Rep_parallel_assoc:\n \"[| I1 Int I2 = {} ; finite I1 ; finite I2 |] ==>\n [||]:(I1 Un I2) PXf =T[M,M]\n [||]:I1 PXf |[Union (snd ` PXf ` I1), Union (snd ` PXf ` I2)]| [||]:I2 PXf\"\n\napply (case_tac \"I1 = {}\")\napply (case_tac \"I2 = {}\")\napply (rule cspT_sym)\napply (simp add: cspT_SKIP_Alpha_parallel)\napply (rule cspT_sym)\napply (simp add: cspT_SKIP_Rep_parallel)\n\napply (case_tac \"I2 = {}\")\napply (rule cspT_sym)\napply (simp add: cspT_SKIP_Rep_parallel)\n\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_traces_par)\n apply (simp add: Union_snd_Un)\n apply (elim conjE)\n apply (rule conjI)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_traces_par)\n apply (simp add: Union_snd_Un)\n apply (elim conjE)\n\n apply (intro ballI)\n apply (simp)\n apply (erule disjE)\n\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\ndone\n\n(************************************\n | induct |\n ************************************)\n\n(*------------------*\n | csp law |\n | (derivable) |\n *------------------*)\n\nlemma cspT_Rep_parallel_induct:\n \"[| finite I ; i ~: I |] ==>\n [||]:(insert i I) PXf =T[M,M]\n fst (PXf i) |[snd (PXf i), Union (snd ` PXf ` I)]| [||]:I PXf\"\napply (insert cspT_Rep_parallel_assoc[of \"{i}\" I PXf M])\napply (simp add: Rep_parallel_one)\napply (rule cspT_trans)\napply (simp)\n\napply (insert cspT_Alpha_parallel_assoc\n [of \"fst (PXf i)\" \"snd (PXf i)\" \"{}\" \"SKIP\" \"Union (snd ` PXf ` I)\" \"[||]:I PXf\" M])\napply (rule cspT_trans)\napply (simp)\n\napply (rule cspT_decompo_Alpha_parallel)\napply (simp_all)\n\napply (simp add: cspT_SKIP_Rep_parallel)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\nend\n\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_T/CSP_T_law_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.257291241538743}} {"text": "(* Title: ZF/UNITY/SubstAx.thy\n Author: Sidi O Ehmety, Computer Laboratory\n Copyright 2001 University of Cambridge\n\nTheory ported from HOL.\n*)\n\nsection\\Weak LeadsTo relation (restricted to the set of reachable states)\\\n\ntheory SubstAx\nimports WFair Constrains\nbegin\n\ndefinition\n (* The definitions below are not `conventional', but yield simpler rules *)\n Ensures :: \"[i,i] \\ i\" (infixl \\Ensures\\ 60) where\n \"A Ensures B \\ {F \\ program. F \\ (reachable(F) \\ A) ensures (reachable(F) \\ B) }\"\n\ndefinition\n LeadsTo :: \"[i, i] \\ i\" (infixl \\\\w\\ 60) where\n \"A \\w B \\ {F \\ program. F:(reachable(F) \\ A) \\ (reachable(F) \\ B)}\"\n\n\n(*Resembles the previous definition of LeadsTo*)\n\n(* Equivalence with the HOL-like definition *)\nlemma LeadsTo_eq:\n\"st_set(B)\\ A \\w B = {F \\ program. F:(reachable(F) \\ A) \\ B}\"\n unfolding LeadsTo_def\napply (blast dest: psp_stable2 leadsToD2 constrainsD2 intro: leadsTo_weaken)\ndone\n\nlemma LeadsTo_type: \"A \\w B <=program\"\nby (unfold LeadsTo_def, auto)\n\n(*** Specialized laws for handling invariants ***)\n\n(** Conjoining an Always property **)\nlemma Always_LeadsTo_pre: \"F \\ Always(I) \\ (F:(I \\ A) \\w A') \\ (F \\ A \\w A')\"\nby (simp add: LeadsTo_def Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\n\nlemma Always_LeadsTo_post: \"F \\ Always(I) \\ (F \\ A \\w (I \\ A')) \\ (F \\ A \\w A')\"\n unfolding LeadsTo_def\napply (simp add: Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\ndone\n\n(* Like 'Always_LeadsTo_pre RS iffD1', but with premises in the good order *)\nlemma Always_LeadsToI: \"\\F \\ Always(C); F \\ (C \\ A) \\w A'\\ \\ F \\ A \\w A'\"\nby (blast intro: Always_LeadsTo_pre [THEN iffD1])\n\n(* Like 'Always_LeadsTo_post RS iffD2', but with premises in the good order *)\nlemma Always_LeadsToD: \"\\F \\ Always(C); F \\ A \\w A'\\ \\ F \\ A \\w (C \\ A')\"\nby (blast intro: Always_LeadsTo_post [THEN iffD2])\n\n(*** Introduction rules \\ Basis, Trans, Union ***)\n\nlemma LeadsTo_Basis: \"F \\ A Ensures B \\ F \\ A \\w B\"\nby (auto simp add: Ensures_def LeadsTo_def)\n\nlemma LeadsTo_Trans:\n \"\\F \\ A \\w B; F \\ B \\w C\\ \\ F \\ A \\w C\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply (blast intro: leadsTo_Trans)\ndone\n\nlemma LeadsTo_Union:\n\"\\(\\A. A \\ S \\ F \\ A \\w B); F \\ program\\\\F \\ \\(S) \\w B\"\napply (simp add: LeadsTo_def)\napply (subst Int_Union_Union2)\napply (rule leadsTo_UN, auto)\ndone\n\n(*** Derived rules ***)\n\nlemma leadsTo_imp_LeadsTo: \"F \\ A \\ B \\ F \\ A \\w B\"\napply (frule leadsToD2, clarify)\napply (simp (no_asm_simp) add: LeadsTo_eq)\napply (blast intro: leadsTo_weaken_L)\ndone\n\n(*Useful with cancellation, disjunction*)\nlemma LeadsTo_Un_duplicate: \"F \\ A \\w (A' \\ A') \\ F \\ A \\w A'\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_Un_duplicate2:\n \"F \\ A \\w (A' \\ C \\ C) \\ F \\ A \\w (A' \\ C)\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_UN:\n \"\\(\\i. i \\ I \\ F \\ A(i) \\w B); F \\ program\\\n \\F:(\\i \\ I. A(i)) \\w B\"\napply (simp add: LeadsTo_def)\napply (simp (no_asm_simp) del: UN_simps add: Int_UN_distrib)\napply (rule leadsTo_UN, auto)\ndone\n\n(*Binary union introduction rule*)\nlemma LeadsTo_Un:\n \"\\F \\ A \\w C; F \\ B \\w C\\ \\ F \\ (A \\ B) \\w C\"\napply (subst Un_eq_Union)\napply (rule LeadsTo_Union)\napply (auto dest: LeadsTo_type [THEN subsetD])\ndone\n\n(*Lets us look at the starting state*)\nlemma single_LeadsTo_I:\n \"\\(\\s. s \\ A \\ F:{s} \\w B); F \\ program\\\\F \\ A \\w B\"\napply (subst UN_singleton [symmetric], rule LeadsTo_UN, auto)\ndone\n\nlemma subset_imp_LeadsTo: \"\\A \\ B; F \\ program\\ \\ F \\ A \\w B\"\napply (simp (no_asm_simp) add: LeadsTo_def)\napply (blast intro: subset_imp_leadsTo)\ndone\n\nlemma empty_LeadsTo: \"F \\ 0 \\w A \\ F \\ program\"\nby (auto dest: LeadsTo_type [THEN subsetD]\n intro: empty_subsetI [THEN subset_imp_LeadsTo])\ndeclare empty_LeadsTo [iff]\n\nlemma LeadsTo_state: \"F \\ A \\w state \\ F \\ program\"\nby (auto dest: LeadsTo_type [THEN subsetD] simp add: LeadsTo_eq)\ndeclare LeadsTo_state [iff]\n\nlemma LeadsTo_weaken_R: \"\\F \\ A \\w A'; A'<=B'\\ \\ F \\ A \\w B'\"\n unfolding LeadsTo_def\napply (auto intro: leadsTo_weaken_R)\ndone\n\nlemma LeadsTo_weaken_L: \"\\F \\ A \\w A'; B \\ A\\ \\ F \\ B \\w A'\"\n unfolding LeadsTo_def\napply (auto intro: leadsTo_weaken_L)\ndone\n\nlemma LeadsTo_weaken: \"\\F \\ A \\w A'; B<=A; A'<=B'\\ \\ F \\ B \\w B'\"\nby (blast intro: LeadsTo_weaken_R LeadsTo_weaken_L LeadsTo_Trans)\n\nlemma Always_LeadsTo_weaken:\n\"\\F \\ Always(C); F \\ A \\w A'; C \\ B \\ A; C \\ A' \\ B'\\\n \\ F \\ B \\w B'\"\napply (blast dest: Always_LeadsToI intro: LeadsTo_weaken Always_LeadsToD)\ndone\n\n(** Two theorems for \"proof lattices\" **)\n\nlemma LeadsTo_Un_post: \"F \\ A \\w B \\ F:(A \\ B) \\w B\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_Un subset_imp_LeadsTo)\n\nlemma LeadsTo_Trans_Un: \"\\F \\ A \\w B; F \\ B \\w C\\\n \\ F \\ (A \\ B) \\w C\"\napply (blast intro: LeadsTo_Un subset_imp_LeadsTo LeadsTo_weaken_L LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\ndone\n\n(** Distributive laws **)\nlemma LeadsTo_Un_distrib: \"(F \\ (A \\ B) \\w C) \\ (F \\ A \\w C \\ F \\ B \\w C)\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_L)\n\nlemma LeadsTo_UN_distrib: \"(F \\ (\\i \\ I. A(i)) \\w B) \\ (\\i \\ I. F \\ A(i) \\w B) \\ F \\ program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_UN LeadsTo_weaken_L)\n\nlemma LeadsTo_Union_distrib: \"(F \\ \\(S) \\w B) \\ (\\A \\ S. F \\ A \\w B) \\ F \\ program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n intro: LeadsTo_Union LeadsTo_weaken_L)\n\n(** More rules using the premise \"Always(I)\" **)\n\nlemma EnsuresI: \"\\F:(A-B) Co (A \\ B); F \\ transient (A-B)\\ \\ F \\ A Ensures B\"\napply (simp add: Ensures_def Constrains_eq_constrains)\napply (blast intro: ensuresI constrains_weaken transient_strengthen dest: constrainsD2)\ndone\n\nlemma Always_LeadsTo_Basis: \"\\F \\ Always(I); F \\ (I \\ (A-A')) Co (A \\ A');\n F \\ transient (I \\ (A-A'))\\\n \\ F \\ A \\w A'\"\napply (rule Always_LeadsToI, assumption)\napply (blast intro: EnsuresI LeadsTo_Basis Always_ConstrainsD [THEN Constrains_weaken] transient_strengthen)\ndone\n\n(*Set difference: maybe combine with leadsTo_weaken_L??\n This is the most useful form of the \"disjunction\" rule*)\nlemma LeadsTo_Diff:\n \"\\F \\ (A-B) \\w C; F \\ (A \\ B) \\w C\\ \\ F \\ A \\w C\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken)\n\nlemma LeadsTo_UN_UN:\n \"\\(\\i. i \\ I \\ F \\ A(i) \\w A'(i)); F \\ program\\\n \\ F \\ (\\i \\ I. A(i)) \\w (\\i \\ I. A'(i))\"\napply (rule LeadsTo_Union, auto)\napply (blast intro: LeadsTo_weaken_R)\ndone\n\n(*Binary union version*)\nlemma LeadsTo_Un_Un:\n \"\\F \\ A \\w A'; F \\ B \\w B'\\ \\ F:(A \\ B) \\w (A' \\ B')\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_R)\n\n(** The cancellation law **)\n\nlemma LeadsTo_cancel2: \"\\F \\ A \\w(A' \\ B); F \\ B \\w B'\\ \\ F \\ A \\w (A' \\ B')\"\nby (blast intro: LeadsTo_Un_Un subset_imp_LeadsTo LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\n\nlemma Un_Diff: \"A \\ (B - A) = A \\ B\"\nby auto\n\nlemma LeadsTo_cancel_Diff2: \"\\F \\ A \\w (A' \\ B); F \\ (B-A') \\w B'\\ \\ F \\ A \\w (A' \\ B')\"\napply (rule LeadsTo_cancel2)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Un_Diff)\ndone\n\nlemma LeadsTo_cancel1: \"\\F \\ A \\w (B \\ A'); F \\ B \\w B'\\ \\ F \\ A \\w (B' \\ A')\"\napply (simp add: Un_commute)\napply (blast intro!: LeadsTo_cancel2)\ndone\n\nlemma Diff_Un2: \"(B - A) \\ A = B \\ A\"\nby auto\n\nlemma LeadsTo_cancel_Diff1: \"\\F \\ A \\w (B \\ A'); F \\ (B-A') \\w B'\\ \\ F \\ A \\w (B' \\ A')\"\napply (rule LeadsTo_cancel1)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Diff_Un2)\ndone\n\n(** The impossibility law **)\n\n(*The set \"A\" may be non-empty, but it contains no reachable states*)\nlemma LeadsTo_empty: \"F \\ A \\w 0 \\ F \\ Always (state -A)\"\napply (simp (no_asm_use) add: LeadsTo_def Always_eq_includes_reachable)\napply (cut_tac reachable_type)\napply (auto dest!: leadsTo_empty)\ndone\n\n(** PSP \\ Progress-Safety-Progress **)\n\n(*Special case of PSP \\ Misra's \"stable conjunction\"*)\nlemma PSP_Stable: \"\\F \\ A \\w A'; F \\ Stable(B)\\\\ F:(A \\ B) \\w (A' \\ B)\"\napply (simp add: LeadsTo_def Stable_eq_stable, clarify)\napply (drule psp_stable, assumption)\napply (simp add: Int_ac)\ndone\n\nlemma PSP_Stable2: \"\\F \\ A \\w A'; F \\ Stable(B)\\ \\ F \\ (B \\ A) \\w (B \\ A')\"\napply (simp (no_asm_simp) add: PSP_Stable Int_ac)\ndone\n\nlemma PSP: \"\\F \\ A \\w A'; F \\ B Co B'\\\\ F \\ (A \\ B') \\w ((A' \\ B) \\ (B' - B))\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains)\napply (blast dest: psp intro: leadsTo_weaken)\ndone\n\nlemma PSP2: \"\\F \\ A \\w A'; F \\ B Co B'\\\\ F:(B' \\ A) \\w ((B \\ A') \\ (B' - B))\"\nby (simp (no_asm_simp) add: PSP Int_ac)\n\nlemma PSP_Unless:\n\"\\F \\ A \\w A'; F \\ B Unless B'\\\\ F:(A \\ B) \\w ((A' \\ B) \\ B')\"\n unfolding op_Unless_def\napply (drule PSP, assumption)\napply (blast intro: LeadsTo_Diff LeadsTo_weaken subset_imp_LeadsTo)\ndone\n\n(*** Induction rules ***)\n\n(** Meta or object quantifier ????? **)\nlemma LeadsTo_wf_induct: \"\\wf(r);\n \\m \\ I. F \\ (A \\ f-``{m}) \\w\n ((A \\ f-``(converse(r) `` {m})) \\ B);\n field(r)<=I; A<=f-``I; F \\ program\\\n \\ F \\ A \\w B\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply auto\napply (erule_tac I = I and f = f in leadsTo_wf_induct, safe)\napply (drule_tac [2] x = m in bspec, safe)\napply (rule_tac [2] A' = \"reachable (F) \\ (A \\ f -`` (converse (r) ``{m}) \\ B) \" in leadsTo_weaken_R)\napply (auto simp add: Int_assoc)\ndone\n\n\nlemma LessThan_induct: \"\\\\m \\ nat. F:(A \\ f-``{m}) \\w ((A \\ f-``m) \\ B);\n A<=f-``nat; F \\ program\\ \\ F \\ A \\w B\"\napply (rule_tac A1 = nat and f1 = \"\\x. x\" in wf_measure [THEN LeadsTo_wf_induct])\napply (simp_all add: nat_measure_field)\napply (simp add: ltI Image_inverse_lessThan vimage_def [symmetric])\ndone\n\n\n(******\n To be ported ??? I am not sure.\n\n integ_0_le_induct\n LessThan_bounded_induct\n GreaterThan_bounded_induct\n\n*****)\n\n(*** Completion \\ Binary and General Finite versions ***)\n\nlemma Completion: \"\\F \\ A \\w (A' \\ C); F \\ A' Co (A' \\ C);\n F \\ B \\w (B' \\ C); F \\ B' Co (B' \\ C)\\\n \\ F \\ (A \\ B) \\w ((A' \\ B') \\ C)\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains Int_Un_distrib)\napply (blast intro: completion leadsTo_weaken)\ndone\n\nlemma Finite_completion_aux:\n \"\\I \\ Fin(X);F \\ program\\\n \\ (\\i \\ I. F \\ (A(i)) \\w (A'(i) \\ C)) \\\n (\\i \\ I. F \\ (A'(i)) Co (A'(i) \\ C)) \\\n F \\ (\\i \\ I. A(i)) \\w ((\\i \\ I. A'(i)) \\ C)\"\napply (erule Fin_induct)\napply (auto simp del: INT_simps simp add: Inter_0)\napply (rule Completion, auto)\napply (simp del: INT_simps add: INT_extend_simps)\napply (blast intro: Constrains_INT)\ndone\n\nlemma Finite_completion:\n \"\\I \\ Fin(X); \\i. i \\ I \\ F \\ A(i) \\w (A'(i) \\ C);\n \\i. i \\ I \\ F \\ A'(i) Co (A'(i) \\ C);\n F \\ program\\\n \\ F \\ (\\i \\ I. A(i)) \\w ((\\i \\ I. A'(i)) \\ C)\"\nby (blast intro: Finite_completion_aux [THEN mp, THEN mp])\n\nlemma Stable_completion:\n \"\\F \\ A \\w A'; F \\ Stable(A');\n F \\ B \\w B'; F \\ Stable(B')\\\n \\ F \\ (A \\ B) \\w (A' \\ B')\"\n unfolding Stable_def\napply (rule_tac C1 = 0 in Completion [THEN LeadsTo_weaken_R])\n prefer 5\n apply blast\napply auto\ndone\n\nlemma Finite_stable_completion:\n \"\\I \\ Fin(X);\n (\\i. i \\ I \\ F \\ A(i) \\w A'(i));\n (\\i. i \\ I \\F \\ Stable(A'(i))); F \\ program\\\n \\ F \\ (\\i \\ I. A(i)) \\w (\\i \\ I. A'(i))\"\n unfolding Stable_def\napply (rule_tac C1 = 0 in Finite_completion [THEN LeadsTo_weaken_R], simp_all)\napply (rule_tac [3] subset_refl, auto)\ndone\n\nML \\\n(*proves \"ensures/leadsTo\" properties when the program is specified*)\nfun ensures_tac ctxt sact =\n SELECT_GOAL\n (EVERY [REPEAT (Always_Int_tac ctxt 1),\n eresolve_tac ctxt @{thms Always_LeadsTo_Basis} 1\n ORELSE (*subgoal may involve LeadsTo, leadsTo or ensures*)\n REPEAT (ares_tac ctxt [@{thm LeadsTo_Basis}, @{thm leadsTo_Basis},\n @{thm EnsuresI}, @{thm ensuresI}] 1),\n (*now there are two subgoals: co \\ transient*)\n simp_tac (ctxt addsimps (Named_Theorems.get ctxt \\<^named_theorems>\\program\\)) 2,\n Rule_Insts.res_inst_tac ctxt\n [(((\"act\", 0), Position.none), sact)] [] @{thm transientI} 2,\n (*simplify the command's domain*)\n simp_tac (ctxt addsimps [@{thm domain_def}]) 3,\n (* proving the domain part *)\n clarify_tac ctxt 3,\n dresolve_tac ctxt @{thms swap} 3, force_tac ctxt 4,\n resolve_tac ctxt @{thms ReplaceI} 3, force_tac ctxt 3, force_tac ctxt 4,\n asm_full_simp_tac ctxt 3, resolve_tac ctxt @{thms conjI} 3, simp_tac ctxt 4,\n REPEAT (resolve_tac ctxt @{thms state_update_type} 3),\n constrains_tac ctxt 1,\n ALLGOALS (clarify_tac ctxt),\n ALLGOALS (asm_full_simp_tac (ctxt addsimps [@{thm st_set_def}])),\n ALLGOALS (clarify_tac ctxt),\n ALLGOALS (asm_lr_simp_tac ctxt)]);\n\\\n\nmethod_setup ensures = \\\n Args.goal_spec -- Scan.lift Parse.embedded_inner_syntax >>\n (fn (quant, s) => fn ctxt => SIMPLE_METHOD'' quant (ensures_tac ctxt s))\n\\ \"for proving progress properties\"\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/UNITY/SubstAx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.2572912415387429}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepFrame\nimports SepTactic\nbegin\n\nclass heap_state_type'\n\ninstance heap_state_type' \\ type ..\n\nconsts\n hst_mem :: \"'a::heap_state_type' \\ heap_mem\"\n hst_mem_update :: \"(heap_mem \\ heap_mem) \\ 'a::heap_state_type' \\ 'a\"\n hst_htd :: \"'a::heap_state_type' \\ heap_typ_desc\"\n hst_htd_update :: \"(heap_typ_desc \\ heap_typ_desc) \\ 'a::heap_state_type' \\ 'a\"\n\nclass heap_state_type = heap_state_type' +\n assumes hst_htd_htd_update [simp]: \"hst_htd (hst_htd_update d s) = d (hst_htd s)\"\n assumes hst_mem_mem_update [simp]: \"hst_mem (hst_mem_update h s) = h (hst_mem s)\"\n assumes hst_htd_mem_update [simp]: \"hst_htd (hst_mem_update h s) = hst_htd s\"\n assumes hst_mem_htd_update [simp]: \"hst_mem (hst_htd_update d s) = hst_mem s\"\n\ntranslations\n \"s\\ hst_mem := x\\\" <= \"CONST hst_mem_update (K_record x) s\"\n \"s\\ hst_htd := x\\\" <= \"CONST hst_htd_update (K_record x) s\"\n\ndefinition lift_hst :: \"'a::heap_state_type' \\ heap_state\" where\n \"lift_hst s \\ lift_state (hst_mem s,hst_htd s)\"\n\ndefinition point_eq_mod :: \"('a \\ 'b) \\ ('a \\ 'b) \\ 'a set \\ bool\" where\n \"point_eq_mod f g X \\ \\x. x \\ X \\ f x = g x\"\n\ndefinition exec_fatal :: \"('s,'b,'c) com \\ ('s,'b,'c) body \\ 's \\ bool\" where\n \"exec_fatal C \\ s \\ (\\f. \\ \\ \\C,Normal s\\ \\ Fault f) \\ (\\ \\ \\C,Normal s\\ \\ Stuck)\"\n\ndefinition restrict_htd :: \"'s::heap_state_type' \\ s_addr set \\ 's\" where\n \"restrict_htd s X \\ s\\ hst_htd := restrict_s (hst_htd s) X \\\"\n\ndefinition restrict_safe_OK ::\n \"'s \\ 's \\ ('s \\ ('s,'c) xstate) \\ s_addr set \\ ('s::heap_state_type','b,'c) com \\\n ('s,'b,'c) body \\ bool\" where\n \"restrict_safe_OK s t f X C \\ \\\n \\ \\ \\C,(Normal (restrict_htd s X))\\ \\ f (restrict_htd t X) \\\n point_eq_mod (lift_state (hst_mem t,hst_htd t)) (lift_state (hst_mem s,hst_htd s)) X\"\n\ndefinition restrict_safe ::\n \"'s \\ ('s,'c) xstate \\ ('s::heap_state_type','b,'c) com \\ ('s,'b,'c) body \\ bool\" where\n \"restrict_safe s t C \\ \\\n \\X. (case t of\n Normal t' \\ restrict_safe_OK s t' Normal X C \\\n | Abrupt t' \\ restrict_safe_OK s t' Abrupt X C \\\n | _ \\ False) \\\n exec_fatal C \\ (restrict_htd s X)\"\n\ndefinition mem_safe :: \"('s::{heap_state_type',type},'b,'c) com \\ ('s,'b,'c) body \\ bool\" where\n \"mem_safe C \\ \\ \\s t. \\ \\ \\C,Normal s\\ \\ t \\ restrict_safe s t C \\\"\n\ndefinition point_eq_mod_safe ::\n \"'s::{heap_state_type',type} set \\ ('s \\ 's) \\ ('s \\ s_addr \\ 'c) \\ bool\" where\n \"point_eq_mod_safe P f g \\ \\s X. restrict_htd s X \\ P \\ point_eq_mod (g (f s)) (g s) X\"\n\ndefinition comm_restrict :: \"('s::{heap_state_type',type} \\ 's) \\ 's \\ s_addr set \\ bool\" where\n \"comm_restrict f s X \\ f (restrict_htd s X) = restrict_htd (f s) X\"\n\ndefinition comm_restrict_safe :: \"'s set \\ ('s::{heap_state_type',type} \\ 's) \\ bool\" where\n \"comm_restrict_safe P f \\ \\s X. restrict_htd s X \\ P \\ comm_restrict f s X\"\n\ndefinition htd_ind :: \"('a::{heap_state_type',type} \\ 'b) \\ bool\" where\n \"htd_ind f \\ \\x s. f s = f (hst_htd_update x s)\"\n\ndefinition mono_guard :: \"'s::{heap_state_type',type} set \\ bool\" where\n \"mono_guard P \\ \\s X. restrict_htd s X \\ P \\ s \\ P\"\n\ndefinition expr_htd_ind :: \"'s::{heap_state_type',type} set \\ bool\" where\n \"expr_htd_ind P \\ \\d s. s\\ hst_htd := d \\ \\ P = (s \\ P)\"\n\nprimrec intra_safe :: \"('s::heap_state_type','b,'c) com \\ bool\"\nwhere\n \"intra_safe Skip = True\"\n| \"intra_safe (Basic f) = (comm_restrict_safe UNIV f \\\n point_eq_mod_safe UNIV f (\\s. lift_state (hst_mem s,hst_htd s)))\"\n| \"intra_safe (Spec r) = (\\\\. mem_safe (Spec r) (\\ :: ('s,'b,'c) body))\"\n| \"intra_safe (Seq C D) = (intra_safe C \\ intra_safe D)\"\n| \"intra_safe (Cond P C D) = (expr_htd_ind P \\ intra_safe C \\ intra_safe D)\"\n| \"intra_safe (While P C) = (expr_htd_ind P \\ intra_safe C)\"\n| \"intra_safe (Call p) = True\"\n| \"intra_safe (DynCom f) = (htd_ind f \\ (\\s. intra_safe (f s)))\"\n| \"intra_safe (Guard f P C) = (mono_guard P \\ (case C of\n Basic g \\ comm_restrict_safe P g \\\n point_eq_mod_safe P g (\\s. lift_state (hst_mem s,hst_htd s))\n | _ \\ intra_safe C))\"\n| \"intra_safe Throw = True\"\n| \"intra_safe (Catch C D) = (intra_safe C \\ intra_safe D)\"\n\ninstance state_ext :: (heap_state_type',type) heap_state_type' ..\n\noverloading\n hs_mem_state \\ hst_mem\n hs_mem_update_state \\ hst_mem_update\n hs_htd_state \\ hst_htd\n hs_htd_update_state \\ hst_htd_update\nbegin\n definition hs_mem_state [simp]: \"hs_mem_state \\ hst_mem \\ globals\"\n definition hs_mem_update_state [simp]: \"hs_mem_update_state \\ globals_update \\ hst_mem_update\"\n definition hs_htd_state[simp]: \"hs_htd_state \\ hst_htd \\ globals\"\n definition hs_htd_update_state [simp]: \"hs_htd_update_state \\ globals_update \\ hst_htd_update\"\nend\n\ninstance state_ext :: (heap_state_type,type) heap_state_type\n by intro_classes auto\n\nprimrec\n intra_deps :: \"('s','b,'c) com \\ 'b set\"\nwhere\n \"intra_deps Skip = {}\"\n| \"intra_deps (Basic f) = {}\"\n| \"intra_deps (Spec r) = {}\"\n| \"intra_deps (Seq C D) = (intra_deps C \\ intra_deps D)\"\n| \"intra_deps (Cond P C D) = (intra_deps C \\ intra_deps D)\"\n| \"intra_deps (While P C) = intra_deps C\"\n| \"intra_deps (Call p) = {p}\"\n| \"intra_deps (DynCom f) = \\{intra_deps (f s) | s. True}\"\n| \"intra_deps (Guard f P C) = intra_deps C\"\n| \"intra_deps Throw = {}\"\n| \"intra_deps (Catch C D) = (intra_deps C \\ intra_deps D)\"\n\n\ninductive_set\n proc_deps :: \"('s','b,'c) com \\ ('s,'b,'c) body \\ 'b set\"\n for \"C\" :: \"('s','b,'c) com\"\n and \"\\\" :: \"('s,'b,'c) body\"\nwhere\n \"x \\ intra_deps C \\ x \\ proc_deps C \\\"\n| \"\\ x \\ proc_deps C \\; \\ x = Some D; y \\ intra_deps D \\ \\ y \\ proc_deps C \\\"\n\ntext \\----\\\n\nlemma point_eq_mod_refl [simp]:\n \"point_eq_mod f f X\"\n by (simp add: point_eq_mod_def)\n\nlemma point_eq_mod_subs:\n \"\\ point_eq_mod f g Y; Y \\ X \\ \\ point_eq_mod f g X\"\n by (force simp: point_eq_mod_def)\n\nlemma point_eq_mod_trans:\n \"\\ point_eq_mod x y X; point_eq_mod y z X \\ \\ point_eq_mod x z X\"\n by (force simp: point_eq_mod_def)\n\nlemma mem_safe_NormalD:\n \"\\ \\ \\ \\C,Normal s\\ \\ Normal t; mem_safe C \\;\n \\ exec_fatal C \\ (restrict_htd s X) \\ \\\n (\\ \\ \\C,(Normal (restrict_htd s X))\\ \\ Normal (restrict_htd t X) \\\n point_eq_mod (lift_state (hst_mem t,hst_htd t))\n (lift_state (hst_mem s,hst_htd s)) X)\"\n by (force simp: mem_safe_def restrict_safe_def restrict_safe_OK_def)\n\nlemma mem_safe_AbruptD:\n \"\\ \\ \\ \\C,Normal s\\ \\ Abrupt t; mem_safe C \\;\n \\ exec_fatal C \\ (restrict_htd s X) \\ \\\n (\\ \\ \\C,(Normal (restrict_htd s X))\\ \\ Abrupt (restrict_htd t X) \\\n point_eq_mod (lift_state (hst_mem t,hst_htd t))\n (lift_state (hst_mem s,hst_htd s)) X)\"\n by (force simp: mem_safe_def restrict_safe_def restrict_safe_OK_def)\n\nlemma mem_safe_FaultD:\n \"\\ \\ \\ \\C,Normal s\\ \\ Fault f; mem_safe C \\ \\ \\\n exec_fatal C \\ (restrict_htd s X)\"\n by (force simp: mem_safe_def restrict_safe_def)\n\nlemma mem_safe_StuckD:\n \"\\ \\ \\ \\C,Normal s\\ \\ Stuck; mem_safe C \\ \\ \\\n exec_fatal C \\ (restrict_htd s X)\"\n by (force simp: mem_safe_def restrict_safe_def)\n\nlemma lift_state_d_restrict [simp]:\n \"lift_state (h,(restrict_s d X)) = lift_state (h,d) |` X\"\n by (auto simp: lift_state_def restrict_map_def restrict_s_def split: s_heap_index.splits)\n\nlemma dom_merge_restrict [simp]:\n \"(x ++ y) |` dom y = y\"\n by (rule map_add_restrict_dom_right)\n\nlemma dom_compl_restrict [simp]:\n \"x |` (UNIV - dom x) = Map.empty\"\n by (force simp: restrict_map_def)\n\nlemma lift_state_point_eq_mod:\n \"\\ point_eq_mod (lift_state (h,d)) (lift_state (h',d')) X \\ \\\n lift_state (h,d) |` (UNIV - X) =\n lift_state (h',d') |` (UNIV - X)\"\n by (auto simp: point_eq_mod_def restrict_map_def)\n\nlemma htd_'_update_ind [simp]:\n \"htd_ind f \\ f (hst_htd_update x s) = f s\"\n by (simp add: htd_ind_def)\n\nlemma sep_frame':\n assumes orig_spec: \"\\s. \\ \\ \\s. P (f \\(\\x. x)) (lift_hst \\(\\x. x))\\\n C\n \\Q (g s \\(\\x. x)) (lift_hst \\(\\x. x))\\\"\n and hi_f: \"htd_ind f\" and hi_g: \"htd_ind g\"\n and hi_g': \"\\s. htd_ind (g s)\"\n and safe: \"mem_safe (C::('s::heap_state_type,'b,'c) com) \\\"\n shows \"\\s. \\ \\ \\s. (P (f \\(\\x. x)) \\\\<^sup>* R (h \\(\\x. x))) (lift_hst \\(\\x. x))\\\n C\n \\(Q (g s \\(\\x. x)) \\\\<^sup>* R (h s)) (lift_hst \\(\\x. x))\\\"\nproof (rule, rule hoare_complete, simp only: valid_def, clarify)\n fix ta x\n assume ev: \"\\\\ \\C,Normal x\\ \\ ta\" and\n pre: \"(P (f x) \\\\<^sup>* R (h x)) (lift_hst x)\"\n then obtain s\\<^sub>0 and s\\<^sub>1 where pre_P: \"P (f x) s\\<^sub>0\" and pre_R: \"R (h x) s\\<^sub>1\" and\n disj: \"s\\<^sub>0 \\ s\\<^sub>1\" and m: \"lift_hst x = s\\<^sub>1 ++ s\\<^sub>0\"\n by (clarsimp simp: sep_conj_def map_ac_simps)\n with orig_spec hi_f have nofault: \"\\ exec_fatal C \\\n (restrict_htd x (dom s\\<^sub>0))\"\n by (force simp: exec_fatal_def image_def lift_hst_def cvalid_def valid_def\n restrict_htd_def\n dest: hoare_sound)\n show \"ta \\ Normal ` {t. (Q (g x t) \\\\<^sup>* R (h x)) (lift_hst t)}\"\n proof (cases ta)\n case (Normal s)\n moreover from this ev safe nofault have ev': \"\\ \\\n \\C,Normal (x\\ hst_htd := (restrict_s (hst_htd x) (dom s\\<^sub>0)) \\)\\ \\\n Normal (s\\ hst_htd := (restrict_s (hst_htd s) (dom s\\<^sub>0)) \\)\" and\n \"point_eq_mod (lift_state (hst_mem s,hst_htd s))\n (lift_state (hst_mem x,hst_htd x)) (dom s\\<^sub>0)\"\n by (auto simp: restrict_htd_def dest: mem_safe_NormalD)\n moreover from this m disj have \"s\\<^sub>1 = lift_hst s |` (UNIV - dom s\\<^sub>0)\"\n apply(clarsimp simp: lift_hst_def)\n apply(subst lift_state_point_eq_mod)\n apply(fastforce dest: sym)\n apply(simp add: lift_hst_def lift_state_point_eq_mod map_add_restrict)\n apply(subst restrict_map_subdom, auto dest: map_disjD)\n done\n ultimately show ?thesis using orig_spec hi_f hi_g hi_g' pre_P pre_R m\n by (force simp: cvalid_def valid_def image_def lift_hst_def\n map_disj_def\n intro: sep_conjI dest: hoare_sound)\n next\n case (Abrupt s) with ev safe nofault orig_spec pre_P hi_f m show ?thesis\n by - (simp, drule spec, drule hoare_sound, drule_tac X=\"dom s\\<^sub>0\" in\n mem_safe_AbruptD, assumption+,\n force simp: valid_def cvalid_def lift_hst_def restrict_htd_def)\n next\n case (Fault f) with ev safe nofault show ?thesis\n by (force dest: mem_safe_FaultD)\n next\n case Stuck with ev safe nofault show ?thesis\n by (force dest: mem_safe_StuckD)\n qed\nqed\n\nlemma sep_frame:\n \"\\ k = (\\s. (hst_mem s,hst_htd s));\n \\s. \\ \\ \\s. P (f \\(\\x. x)) (lift_state (k \\(\\x. x)))\\\n C\n \\Q (g s \\(\\x. x)) (lift_state (k \\(\\x. x)))\\;\n htd_ind f; htd_ind g; \\s. htd_ind (g s);\n mem_safe (C::('s::heap_state_type,'b,'c) com) \\ \\ \\\n \\s. \\ \\ \\s. (P (f \\(\\x. x)) \\\\<^sup>* R (h \\(\\x. x))) (lift_state (k \\(\\x. x)))\\\n C\n \\(Q (g s \\(\\x. x)) \\\\<^sup>* R (h s)) (lift_state (k \\(\\x. x)))\\\"\n apply(simp only:)\n apply(fold lift_hst_def)\n apply(erule (4) sep_frame')\n done\n\n\nlemma point_eq_mod_safe [simp]:\n \"\\ point_eq_mod_safe P f g; restrict_htd s X \\ P; x \\ X \\ \\\n g (f s) x = (g s) x\"\n apply(simp add: point_eq_mod_safe_def point_eq_mod_def)\n apply(case_tac x, force)\n done\n\nlemma comm_restrict_safe [simp]:\n \"\\ comm_restrict_safe P f; restrict_htd s X \\ P \\ \\\n restrict_htd (f s ) X = f (restrict_htd s X)\"\n by (simp add: comm_restrict_safe_def comm_restrict_def)\n\nlemma mono_guardD:\n \"\\ mono_guard P; restrict_htd s X \\ P \\ \\ s \\ P\"\n by (unfold mono_guard_def, fast)\n\nlemma expr_htd_ind:\n \"expr_htd_ind P \\ restrict_htd s X \\ P = (s \\ P)\"\n by (simp add: expr_htd_ind_def restrict_htd_def)\n\n(* exec.intros without those already declared as [intro] *)\nlemmas exec_other_intros = exec.intros(1-3) exec.intros(5-14) exec.intros(16-17) exec.intros(19-)\n\nlemma exec_fatal_Seq:\n \"exec_fatal C \\ s \\ exec_fatal (C;;D) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma exec_fatal_Seq2:\n \"\\ \\ \\ \\C,Normal s\\ \\ Normal t; exec_fatal D \\ t \\ \\ exec_fatal (C;;D) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma exec_fatal_Cond:\n \"exec_fatal (Cond P C D) \\ s = (if s \\ P then exec_fatal C \\ s else\n exec_fatal D \\ s)\"\n by (force simp: exec_fatal_def intro: exec_other_intros\n elim: exec_Normal_elim_cases)\n\nlemma exec_fatal_While:\n \"\\ exec_fatal C \\ s; s \\ P \\ \\ exec_fatal (While P C) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros\n elim: exec_Normal_elim_cases)\n\nlemma exec_fatal_While2:\n \"\\ exec_fatal (While P C) \\ t; \\ \\ \\C,Normal s\\ \\ Normal t; s \\ P \\ \\\n exec_fatal (While P C) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros\n elim: exec_Normal_elim_cases)\n\nlemma exec_fatal_Call:\n \"\\ \\ p = Some C; exec_fatal C \\ s \\ \\ exec_fatal (Call p) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma exec_fatal_DynCom:\n \"exec_fatal (f s) \\ s \\ exec_fatal (DynCom f) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma exec_fatal_Guard:\n \"exec_fatal (Guard f P C) \\ s = (s \\ P \\ exec_fatal C \\ s)\"\nproof (cases \"s \\ P\")\n case True thus ?thesis\n by (force simp: exec_fatal_def intro: exec_other_intros\n elim: exec_Normal_elim_cases)\nnext\n case False thus ?thesis\n by (force simp: exec_fatal_def intro: exec_other_intros)\nqed\n\nlemma restrict_safe_Guard:\n assumes restrict: \"restrict_safe s t C \\\"\n shows \"restrict_safe s t (Guard f P C) \\\"\nproof (cases t)\n case (Normal s) with restrict show ?thesis\n by (force simp: restrict_safe_def restrict_safe_OK_def exec_fatal_Guard\n intro: exec_other_intros)\nnext\n case (Abrupt s) with restrict show ?thesis\n by (force simp: restrict_safe_def restrict_safe_OK_def exec_fatal_Guard\n intro: exec_other_intros)\nnext\n case (Fault f) with restrict show ?thesis\n by (force simp: restrict_safe_def exec_fatal_Guard)\nnext\n case Stuck with restrict show ?thesis\n by (force simp: restrict_safe_def exec_fatal_Guard)\nqed\n\nlemma restrict_safe_Guard2:\n \"\\ s \\ P; mono_guard P \\ \\ restrict_safe s (Fault f) (Guard f P C) \\\"\n by (force simp: restrict_safe_def exec_fatal_def intro: exec_other_intros\n dest: mono_guardD)\n\nlemma exec_fatal_Catch:\n \"exec_fatal C \\ s \\ exec_fatal (TRY C CATCH D END) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma exec_fatal_Catch2:\n \"\\ \\ \\ \\C,Normal s\\ \\ Abrupt t; exec_fatal D \\ t \\ \\\n exec_fatal (TRY C CATCH D END) \\ s\"\n by (force simp: exec_fatal_def intro: exec_other_intros)\n\nlemma intra_safe_restrict [rule_format]:\n assumes safe_env: \"\\n C. \\ n = Some C \\ intra_safe C\" and\n exec: \"\\ \\ \\C,s\\ \\ t\"\n shows \"\\s'. s = Normal s' \\ intra_safe C \\ restrict_safe s' t C \\\"\nusing exec\nproof induct\n case (Skip s) thus ?case\n by (force simp: restrict_safe_def restrict_safe_OK_def intro: exec_other_intros)\nnext\n case (Guard s' P C t f) show ?case\n proof (cases \"\\g. C = Basic g\")\n case False with Guard show ?thesis\n by - (clarsimp, split com.splits, auto dest: restrict_safe_Guard)\n next\n case True with Guard show ?thesis\n by (cases t) (force simp: restrict_safe_def restrict_safe_OK_def\n point_eq_mod_safe_def exec_fatal_Guard\n intro: exec_other_intros\n elim: exec_Normal_elim_cases,\n (fast elim: exec_Normal_elim_cases)+)\n qed\nnext\n case (GuardFault C f P s) thus ?case\n by (force dest: restrict_safe_Guard2)\nnext\n case (FaultProp C f) thus ?case by simp\nnext\n case (Basic f s) thus ?case\n by (force simp: restrict_safe_def restrict_safe_OK_def point_eq_mod_safe_def\n intro: exec_other_intros)\nnext\n case (Spec r s t) thus ?case\n by (fastforce simp: mem_safe_def intro: exec.Spec)\nnext\n case (SpecStuck r s) thus ?case\n by (simp add: exec.SpecStuck mem_safe_StuckD restrict_safe_def)\nnext\n case (Seq C s sa D ta) show ?case\n proof (cases sa)\n case (Normal s') with Seq show ?thesis\n by (cases ta)\n (clarsimp simp: restrict_safe_def restrict_safe_OK_def,\n (drule_tac x=X in spec)+, auto intro: exec_other_intros point_eq_mod_trans\n exec_fatal_Seq exec_fatal_Seq2)+\n next\n case (Abrupt s') with Seq show ?thesis\n by (force simp: restrict_safe_def restrict_safe_OK_def\n intro: exec_other_intros dest: exec_fatal_Seq\n elim: exec_Normal_elim_cases)\n next\n case (Fault f) with Seq show ?thesis\n by (force simp: restrict_safe_def dest: exec_fatal_Seq\n elim: exec_Normal_elim_cases)\n next\n case Stuck with Seq show ?thesis\n by (force simp: restrict_safe_def dest: exec_fatal_Seq\n elim: exec_Normal_elim_cases)\n qed\nnext\n case (CondTrue s P C t D) thus ?case\n by (cases t)\n (auto simp: restrict_safe_def restrict_safe_OK_def exec_fatal_Cond\n intro: exec_other_intros dest: expr_htd_ind split: if_split_asm)\nnext\n case (CondFalse s P C t D) thus ?case\n by (cases t)\n (auto simp: restrict_safe_def restrict_safe_OK_def exec_fatal_Cond\n intro: exec_other_intros dest: expr_htd_ind split: if_split_asm)\nnext\n case (WhileTrue P C s s' t) show ?case\n proof (cases s')\n case (Normal sa) with WhileTrue show ?thesis\n by (cases t)\n (clarsimp simp: restrict_safe_def restrict_safe_OK_def,\n (drule_tac x=X in spec)+, auto simp: expr_htd_ind intro: exec_other_intros\n point_eq_mod_trans exec_fatal_While exec_fatal_While2)+\n next\n case (Abrupt sa) with WhileTrue show ?thesis\n by (force simp: restrict_safe_def restrict_safe_OK_def expr_htd_ind\n intro: exec_other_intros exec_fatal_While\n elim: exec_Normal_elim_cases)\n next\n case (Fault f) with WhileTrue show ?thesis\n by (force simp: restrict_safe_def expr_htd_ind intro: exec_fatal_While)\n next\n case Stuck with WhileTrue show ?thesis\n by (force simp: restrict_safe_def expr_htd_ind intro: exec_fatal_While)\n qed\nnext\n case (WhileFalse P C s) thus ?case\n by (force simp: restrict_safe_def restrict_safe_OK_def expr_htd_ind\n intro: exec_other_intros)\nnext\n case (Call C p s t) with safe_env show ?case\n by (cases t)\n (auto simp: restrict_safe_def restrict_safe_OK_def\n intro: exec_fatal_Call exec_other_intros)\nnext\n case (CallUndefined p s) thus ?case\n by (force simp: restrict_safe_def exec_fatal_def intro: exec_other_intros)\n\nnext\n case (StuckProp C) thus ?case by simp\nnext\n case (DynCom f s t) thus ?case\n by (cases t)\n (auto simp: restrict_safe_def restrict_safe_OK_def\n restrict_htd_def\n intro!: exec_other_intros exec_fatal_DynCom)\nnext\n case (Throw s) thus ?case\n by (force simp: restrict_safe_def restrict_safe_OK_def intro: exec_other_intros)\nnext\n case (AbruptProp C s) thus ?case by simp\nnext\n case (CatchMatch C D s s' t) thus ?case\n by (cases t)\n (clarsimp simp: restrict_safe_def, drule_tac x=X in spec,\n auto simp: restrict_safe_OK_def intro: exec_other_intros point_eq_mod_trans\n dest: exec_fatal_Catch exec_fatal_Catch2)+\nnext\n case (CatchMiss C s t D) thus ?case\n by (cases t)\n (clarsimp simp: restrict_safe_def, drule_tac x=X in spec,\n auto simp: restrict_safe_OK_def intro: exec_other_intros\n dest: exec_fatal_Catch)+\nqed\n\nlemma intra_mem_safe:\n \"\\ \\n C. \\ n = Some C \\ intra_safe C; intra_safe C \\ \\ mem_safe C \\\"\n by (force simp: mem_safe_def intro: intra_safe_restrict)\n\nlemma point_eq_mod_safe_triv:\n \"(\\s. g (f s) = g s) \\ point_eq_mod_safe P f g\"\n by (simp add: point_eq_mod_safe_def point_eq_mod_def)\n\nlemma comm_restrict_safe_triv:\n \"(\\s X. f (s\\ hst_htd := restrict_s (hst_htd s) X \\) =\n (f s)\\ hst_htd := restrict_s (hst_htd (f s)) X \\) \\ comm_restrict_safe P f\"\n by (force simp: comm_restrict_safe_def comm_restrict_def restrict_htd_def)\n\nlemma mono_guard_UNIV [simp]:\n \"mono_guard UNIV\"\n by (force simp: mono_guard_def)\n\nlemma mono_guard_triv:\n \"(\\s X. s\\ hst_htd := X \\ \\ g \\ s \\ g) \\ mono_guard g\"\n by (unfold mono_guard_def, unfold restrict_htd_def, fast)\n\nlemma mono_guard_triv2:\n \"(\\s X. s\\ hst_htd := X \\ \\ g = ((s::'a::heap_state_type') \\ g)) \\\n mono_guard g\"\n by (unfold mono_guard_def, unfold restrict_htd_def, fast)\n\nlemma dom_restrict_s:\n \"x \\ dom_s (restrict_s d X) \\ x \\ dom_s d \\ x \\ X\"\n by (auto simp: restrict_s_def dom_s_def split: if_split_asm)\n\nlemma mono_guard_ptr_safe:\n \"\\ \\s. d s = hst_htd (s::'a::heap_state_type); htd_ind p \\ \\\n mono_guard {s. ptr_safe (p s) (d s)}\"\n by (auto simp: mono_guard_def ptr_safe_def restrict_htd_def dest: subsetD dom_restrict_s)\n\nlemma point_eq_mod_safe_ptr_safe_update:\n \"\\ d = (hst_htd::'a::heap_state_type \\ heap_typ_desc);\n m = (\\s. hst_mem_update (heap_update (p s) ((v s)::'b::mem_type)) s);\n h = hst_mem; k = (\\s. lift_state (h s,d s)); htd_ind p \\ \\\n point_eq_mod_safe {s. ptr_safe (p s) (d s)} m k\"\n apply (clarsimp simp: point_eq_mod_safe_def point_eq_mod_def ptr_safe_def heap_update_def\n restrict_htd_def lift_state_def\n intro!: heap_update_nmem_same\n split: s_heap_index.splits)\n apply(subgoal_tac \"(a,SIndexVal) \\ s_footprint (p s)\")\n apply(drule (1) subsetD)\n apply(drule dom_restrict_s, clarsimp)\n apply(drule intvlD, clarsimp)\n apply(erule s_footprintI2)\n done\n\nlemma field_ti_s_sub_typ:\n \"field_lookup (export_uinfo (typ_info_t TYPE('b::mem_type))) f 0 = Some (typ_uinfo_t TYPE('a),b) \\\n s_footprint ((Ptr &(p\\f))::'a::mem_type ptr) \\ s_footprint (p::'b ptr)\"\n by (drule field_ti_s_sub) (simp add: s_footprint_def)\n\nlemma ptr_safe_mono:\n \"\\ ptr_safe (p::'a::mem_type ptr) d; field_lookup (typ_info_t TYPE('a)) f 0\n = Some (t,n); export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n ptr_safe ((Ptr &(p\\f))::'b::mem_type ptr) d\"\n unfolding ptr_safe_def\n by (drule field_lookup_export_uinfo_Some) (auto dest: field_ti_s_sub_typ)\n\nlemma point_eq_mod_safe_ptr_safe_update_fl:\n \"\\ d = (hst_htd::'a::heap_state_type \\ heap_typ_desc);\n m = (\\s. hst_mem_update (heap_update (Ptr &((p s)\\f)) ((v s)::'b::mem_type)) s);\n h = hst_mem; k = (\\s. lift_state (h s,d s)); htd_ind p;\n field_lookup (typ_info_t TYPE('c)) f 0 = Some (t,n);\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n point_eq_mod_safe {s. ptr_safe ((p::'a \\ 'c::mem_type ptr) s) (d s)} m k\"\n apply(drule (3) point_eq_mod_safe_ptr_safe_update)\n apply(fastforce simp: htd_ind_def)\n apply(fastforce simp: point_eq_mod_safe_def intro!: ptr_safe_mono)\n done\n\ncontext\nbegin\n\nprivate method m =\n (clarsimp simp: ptr_retyp_d_eq_snd ptr_retyp_footprint list_map_eq,\n erule notE,\n drule intvlD, clarsimp,\n (rule s_footprintI; assumption?),\n subst (asm) unat_of_nat,\n (subst (asm) mod_less; assumption?),\n subst len_of_addr_card,\n erule less_trans,\n simp)\n\nlemma point_eq_mod_safe_ptr_safe_tag:\n \"\\ d = (hst_htd::'a::heap_state_type \\ heap_typ_desc); h = hst_mem;\n m = (\\s. hst_htd_update (ptr_retyp (p s)) s);\n k = (\\s. lift_state (h s,d s));\n htd_ind p \\ \\\n point_eq_mod_safe {s. ptr_safe ((p s)::'b::mem_type ptr) (d s)} m k\"\n supply if_split_asm[split]\n apply(clarsimp simp: point_eq_mod_safe_def point_eq_mod_def ptr_safe_def)\n apply(subgoal_tac \"(a,b) \\ s_footprint (p (restrict_htd s X))\")\n prefer 2\n apply(fastforce simp: restrict_htd_def dest: dom_restrict_s)\n apply(clarsimp simp: restrict_htd_def lift_state_def split: s_heap_index.split option.splits)\n apply (safe; m?)\n apply(fastforce simp: ptr_retyp_d_eq_fst dest!: intvlD dest: s_footprintI2)\n apply(fastforce simp: ptr_retyp_d_eq_fst)\n apply(subst (asm) ptr_retyp_d_eq_snd, clarsimp)\n done\n\nend\n\nlemma comm_restrict_safe_ptr_safe_tag:\n fixes d::\"'a::heap_state_type \\ heap_typ_desc\"\n assumes\n fun_d: \"d = hst_htd\" and\n fun_upd: \"m = (\\s. hst_htd_update (ptr_retyp (p s)) s)\" and\n ind: \"htd_ind p\" and\n upd: \"\\d d' (s::'a).\n hst_htd_update (d s) (hst_htd_update (d' s) s) = hst_htd_update ((d s) \\ (d' s)) s\"\n shows \"comm_restrict_safe {s. ptr_safe ((p s)::'b::mem_type ptr) (d s)} m\"\nproof (simp only: comm_restrict_safe_def comm_restrict_def, auto)\n fix s X\n assume \"ptr_safe (p (restrict_htd s X)) (d (restrict_htd s X))\"\n moreover from ind\n have p: \"p (restrict_htd s X) = p s\"\n by (simp add: restrict_htd_def)\n ultimately\n have \"ptr_retyp (p s) (restrict_s (hst_htd s) X) = restrict_s (ptr_retyp (p s) (hst_htd s)) X\"\n using fun_d\n apply -\n apply(rule ext)\n apply(clarsimp simp: point_eq_mod_safe_def point_eq_mod_def ptr_safe_def restrict_htd_def)\n apply(case_tac \"x \\ {ptr_val (p s)..+size_of TYPE('b)}\")\n apply(clarsimp simp: ptr_retyp_d restrict_map_def restrict_s_def)\n apply(subst ptr_retyp_d; simp)\n apply(clarsimp simp: ptr_retyp_footprint restrict_map_def restrict_s_def)\n apply(subst ptr_retyp_footprint, simp)\n apply(rule conjI)\n apply(subgoal_tac \"(x,SIndexVal) \\ s_footprint (p s)\")\n apply(fastforce simp: dom_s_def)\n apply(fastforce dest: intvlD elim: s_footprintI2)\n apply(rule ext)\n apply(clarsimp simp: map_add_def list_map_eq)\n apply(subgoal_tac \"(x,SIndexTyp y) \\ s_footprint (p s)\")\n apply(fastforce simp: dom_s_def split: if_split_asm)\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI; assumption?)\n apply(metis len_of_addr_card less_trans max_size mod_less word_unat.eq_norm)\n done\n hence \"((ptr_retyp (p s) \\ (\\x _. x) (restrict_s (hst_htd s) X)::heap_typ_desc \\ heap_typ_desc) =\n (\\x _. x) (restrict_s (ptr_retyp (p s) (hst_htd s)) X))\"\n by - (rule ext, simp)\n moreover from upd have \"hst_htd_update (ptr_retyp (p s))\n (hst_htd_update ((\\x _. x) (restrict_s (hst_htd s) X)) s) =\n hst_htd_update (((ptr_retyp (p s)) \\ ((\\x _. x) (restrict_s (hst_htd s) X)))) s\" .\n moreover from upd\n have\n \"hst_htd_update ((\\x _. x) (restrict_s (ptr_retyp (p s) (hst_htd s)) X))\n (hst_htd_update (ptr_retyp (p s)) s) =\n hst_htd_update (((\\x _. x) (restrict_s ((ptr_retyp (p s) (hst_htd s))) X)) \\ (ptr_retyp (p s))) s\" .\n ultimately show \"m (restrict_htd s X) = restrict_htd (m s) X\" using fun_d fun_upd upd p\n by (simp add: restrict_htd_def o_def)\nqed\n\nlemmas intra_sc = hrs_comm comp_def hrs_htd_update_htd_update\n point_eq_mod_safe_triv comm_restrict_safe_triv mono_guard_triv2\n mono_guard_ptr_safe point_eq_mod_safe_ptr_safe_update\n point_eq_mod_safe_ptr_safe_tag comm_restrict_safe_ptr_safe_tag\n point_eq_mod_safe_ptr_safe_update_fl\n\ndeclare expr_htd_ind_def [iff]\ndeclare htd_ind_def [iff]\n\nlemma proc_deps_Skip [simp]:\n \"proc_deps Skip \\ = {}\"\n by (force elim: proc_deps.induct)\n\nlemma proc_deps_Basic [simp]:\n \"proc_deps (Basic f) \\ = {}\"\n by (force elim: proc_deps.induct)\n\nlemma proc_deps_Spec [simp]:\n \"proc_deps (Spec r) \\ = {}\"\n by (force elim: proc_deps.induct)\n\nlemma proc_deps_Seq [simp]:\n \"proc_deps (Seq C D) \\ = proc_deps C \\ \\ proc_deps D \\\"\nproof\n show \"proc_deps (C;; D) \\ \\ proc_deps C \\ \\ proc_deps D \\\"\n by - (rule, erule proc_deps.induct, auto intro: proc_deps.intros)\nnext\n show \"proc_deps C \\ \\ proc_deps D \\ \\ proc_deps (C;; D) \\\"\n by auto (erule proc_deps.induct, auto intro: proc_deps.intros)+\nqed\n\nlemma proc_deps_Cond [simp]:\n \"proc_deps (Cond P C D) \\ = proc_deps C \\ \\ proc_deps D \\\"\nproof\n show \"proc_deps (Cond P C D) \\ \\ proc_deps C \\ \\ proc_deps D \\\"\n by (rule, erule proc_deps.induct, auto intro: proc_deps.intros)\nnext\n show \"proc_deps C \\ \\ proc_deps D \\ \\ proc_deps (Cond P C D) \\\"\n by auto (erule proc_deps.induct, auto intro: proc_deps.intros)+\nqed\n\nlemma proc_deps_While [simp]:\n \"proc_deps (While P C) \\ = proc_deps C \\\"\n by auto (erule proc_deps.induct, auto intro: proc_deps.intros)+\n\nlemma proc_deps_Guard [simp]:\n \"proc_deps (Guard f P C) \\ = proc_deps C \\\"\n by auto (erule proc_deps.induct, auto intro: proc_deps.intros)+\n\nlemma proc_deps_Throw [simp]:\n \"proc_deps Throw \\ = {}\"\n by (force elim: proc_deps.induct)\n\nlemma proc_deps_Catch [simp]:\n \"proc_deps (Catch C D) \\ = proc_deps C \\ \\ proc_deps D \\\"\nproof\n show \"proc_deps (Catch C D) \\ \\ proc_deps C \\ \\ proc_deps D \\\"\n by (rule, erule proc_deps.induct, auto intro: proc_deps.intros)\nnext\n show \"proc_deps C \\ \\ proc_deps D \\ \\ proc_deps (Catch C D) \\\"\n by auto (erule proc_deps.induct, auto intro: proc_deps.intros)+\nqed\n\nlemma proc_deps_Call [simp]:\n \"proc_deps (Call p) \\ = {p} \\ (case \\ p of Some C \\\n proc_deps C (\\(p := None)) | _ \\ {})\" (is \"?X = ?Y \\ ?Z\")\nproof\n note proc_deps.intros[intro]\n show \"?X \\ ?Y \\ ?Z\"\n by (rule subsetI, erule proc_deps.induct, fastforce)\n (rename_tac x D y, case_tac \"x = p\"; fastforce split: option.splits)\nnext\n show \"?Y \\ ?Z \\ ?X\"\n proof (clarsimp, rule)\n show \"p \\ ?X\" by (force intro: proc_deps.intros)\n next\n show \"?Z \\ ?X\"\n by (split option.splits, rule, force intro: proc_deps.intros)\n (clarify, erule proc_deps.induct;\n force intro: proc_deps.intros split: if_split_asm)\n qed\nqed\n\nlemma proc_deps_DynCom [simp]:\n \"proc_deps (DynCom f) \\ = \\{proc_deps (f s) \\ | s. True}\"\n by (rule equalityI; clarsimp; erule proc_deps.induct; force intro: proc_deps.intros)\n\nlemma proc_deps_restrict:\n \"proc_deps C \\ \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\"\nproof\n fix xa\n assume mem: \"xa \\ proc_deps C \\\"\n hence \"\\p. xa \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\" (is \"?X\")\n using mem\n proof induct\n fix x\n assume \"x \\ intra_deps C\"\n thus \"\\p. x \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\"\n by (force intro: proc_deps.intros)\n next\n fix D x y\n assume x:\n \"x \\ proc_deps C \\\"\n \"x \\ proc_deps C \\ \\ \\p. x \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\"\n \"\\ x = Some D\"\n \"y \\ intra_deps D\"\n \"y \\ proc_deps C \\\"\n show \"\\p. y \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\"\n proof clarify\n fix p\n assume y: \"y \\ proc_deps (Call p) \\\"\n show \"y \\ proc_deps C (\\(p := None))\"\n proof (cases \"x=p\")\n case True with x y show ?thesis\n by (force intro: proc_deps.intros)\n next\n case False with x y show ?thesis\n by (clarsimp, drule_tac x=p in spec)\n (auto intro: proc_deps.intros split: option.splits)\n qed\n qed\n qed\n thus \"xa \\ proc_deps C (\\(p := None)) \\ proc_deps (Call p) \\\" by simp\nqed\n\nlemma exec_restrict:\n assumes exec: \"\\' \\ \\C,s\\ \\ t\"\n shows \"\\\\ X. \\ \\' = \\ |` X; proc_deps C \\ \\ X \\ \\ \\ \\ \\C,s\\ \\ t\"\nusing exec\nproof induct\n case (Call p C s t)\n thus ?case\n using proc_deps_restrict [of C \\ p] by (force intro: exec_other_intros)\nqed (force intro: exec_other_intros)+\n\nlemma exec_restrict2:\n assumes exec: \"\\ \\ \\C,s\\ \\ t\"\n shows \"\\X. proc_deps C \\ \\ X \\ \\ |` X \\ \\C,s\\ \\ t\"\nusing exec\nproof induct\n case (Call p C s t) thus ?case\n using proc_deps_restrict [of C \\ p]\n by (auto intro!: exec_other_intros split: option.splits)\nnext\n case (DynCom f s t) thus ?case\n by - (rule exec.intros, simp, blast)\nqed (auto intro: exec_other_intros)\n\nlemma exec_restrict_eq:\n \"\\ |` proc_deps C \\ \\ \\C,s\\ \\ t = \\ \\ \\C,s\\ \\ t\"\n by (fast intro: exec_restrict exec_restrict2)\n\nlemma mem_safe_restrict:\n \"mem_safe C \\ = mem_safe C (\\ |` proc_deps C \\)\"\n by (auto simp: mem_safe_def restrict_safe_def restrict_safe_OK_def\n exec_restrict_eq exec_fatal_def\n split: xstate.splits)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/SepFrame.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.25720631918841336}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n \"~~/src/HOL/Word/WordBitwise\"\n WordBitwise_Signed\n Hex_Words\n Norm_Words\n Word_Type_Syntax\nbegin\n\ntext \\Additional bit and type syntax that forces word types.\\\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n wordNOT :: \"'a::len0 word \\ 'a word\" (\"~~ _\" [70] 71)\nwhere\n \"~~ x == NOT x\"\n\nabbreviation\n wordAND :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"&&\" 64)\nwhere\n \"a && b == a AND b\"\n\nabbreviation\n wordOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"||\" 59)\nwhere\n \"a || b == a OR b\"\n\nabbreviation\n wordXOR :: \"'a::len0 word \\ 'a word \\ 'a word\" (infixr \"xor\" 59)\nwhere\n \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n \"0 < n \\ bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n by (cases n; simp)\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/lib/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.4804786780479071, "lm_q1q2_score": 0.25710338561202667}} {"text": "section \\System specification\\\n\ntext \\This section formalizes the CoCon system as an I/O automaton.\nWe call the inputs ``actions''.\\\n\ntheory System_Specification\nimports Prelim\nbegin\n\nsubsection \\System state\\\n\n\ntext \\The superuser of the system is called ``voronkov'',\nas a form acknowledgement for our inspiration from EasyChair\nwhen creating CoCon.\n\\\n\nrecord state =\n confIDs :: \"confID list\"\n conf :: \"confID \\ conf\"\n (* *)\n userIDs :: \"userID list\"\n pass :: \"userID \\ password\"\n user :: \"userID \\ user\"\n roles :: \"confID \\ userID \\ role list\"\n (* *)\n paperIDs :: \"confID \\ paperID list\"\n paper :: \"paperID \\ paper\"\n (* *)\n pref :: \"userID \\ paperID \\ preference\" (* preference, including eventual conflicts *)\n (* *)\n voronkov :: \"userID\"\n (* *)\n news :: \"confID \\ string list\"\n phase :: \"confID \\ phase\" (* the current phase *)\n (* *)\n\n\n(* Note: Some of the fields are redundant, e.g., paperIDs can in principle be recovered from \"roles\";\nhowever, this and other redundant fields are used very often, so it is efficient to keep them *)\n\n\n(* Various discriminators (\"is\") and selectors (\"get\") on the database: *)\nabbreviation isPC :: \"state \\ confID \\ userID \\ bool\" (* program committee (PC) membership *) where\n\"isPC s confID uID \\ PC \\\\ roles s confID uID\"\nabbreviation isChair :: \"state \\ confID \\ userID \\ bool\" (* being one of the conference chairs *) where\n\"isChair s confID uID \\ Chair \\\\ roles s confID uID\"\nabbreviation isAut :: \"state \\ confID \\ userID \\ paperID \\ bool\" (* authorship of a certain paper *) where\n\"isAut s confID uID papID \\ Aut papID \\\\ roles s confID uID\"\ndefinition isAutSome :: \"state \\ confID \\ userID \\ bool\" (* authorship of some paper *) where\n\"isAutSome s confID uID \\ list_ex (isAut s confID uID) (paperIDs s confID)\"\n(* all the authors of a given paper: *)\ndefinition authors :: \"state \\ confID \\ paperID \\ userID list\" where\n\"authors s confID papID \\ filter (\\ uID. isAut s confID uID papID) (userIDs s)\"\nabbreviation isRevNth :: \"state \\ confID \\ userID \\ paperID \\ nat \\ bool\" (* paper reviewer (nth review) *)\nwhere\n\"isRevNth s confID uID papID n \\ Rev papID n \\\\ roles s confID uID\"\ndefinition isRev :: \"state \\ confID \\ userID \\ paperID \\ bool\" (* paper reviewer *) where\n\"isRev s confID uID papID \\ list_ex (isRevRoleFor papID) (roles s confID uID)\"\n(* Get the reviewer role for a certain triple (user, conference, paper), if any: *)\ndefinition getRevRole :: \"state \\ confID \\ userID \\ paperID \\ role option\" where\n\"getRevRole s confID uID papID \\ List.find (isRevRoleFor papID) (roles s confID uID)\"\n(* get the n-th review of a paper *)\ndefinition getNthReview :: \"state \\ paperID \\ nat \\ review\" where\n\"getNthReview s papID n \\ (reviewsPaper (paper s papID))!n\"\n(* get all the paper IDs (for all conferences) from the system: *)\ndefinition getAllPaperIDs :: \"state \\ paperID list\" where\n\"getAllPaperIDs s \\ concat [paperIDs s confID. confID \\ confIDs s]\"\ndefinition getReviewIndex :: \"state \\ confID \\ userID \\ paperID \\ nat\" where\n\"getReviewIndex s confID uID papID \\\n case getRevRole s confID uID papID of Some (Rev papID' n) \\ n\"\n(* get, for a conference and a paper, the reviews together with the IDs of the reviewers: *)\ndefinition getReviewersReviews :: \"state \\ confID \\ paperID \\ (userID * review) list\" where\n\"getReviewersReviews s confID papID \\\n [(uID, getNthReview s papID (getReviewIndex s confID uID papID)).\n uID \\ userIDs s,\n isRev s confID uID papID\n ]\"\n\n(* Not used in the implementation: *)\ndefinition isAUT :: \"state \\ userID \\ paperID \\ bool\" where\n\"isAUT s uID papID \\ \\ confID. isAut s confID uID papID\"\ndefinition isREVNth :: \"state \\ userID \\ paperID \\ nat \\ bool\" where\n\"isREVNth s uID papID n \\ \\ confID. isRevNth s confID uID papID n\"\n\n\nlemma isRev_getRevRole:\nassumes \"isRev s confID uID papID\"\nshows \"getRevRole s confID uID papID \\ None\"\nusing assms list_ex_find unfolding isRev_def getRevRole_def by auto\n\nlemma getRevRole_Some:\nassumes \"getRevRole s confID uID papID = Some role\"\nshows \"\\ n. role = Rev papID n\"\nusing assms unfolding getRevRole_def unfolding find_Some_iff apply (cases role, auto)\nby (metis isRevRoleFor.simps)+\n\nlemma isRev_getRevRole2:\nassumes \"isRev s confID uID papID\"shows \"\\ n. getRevRole s confID uID papID = Some (Rev papID n)\"\nusing assms getRevRole_Some by (cases \"getRevRole s confID uID papID\") (auto simp: isRev_getRevRole)\n\nlemma isRev_imp_isRevNth_getReviewIndex:\nassumes \"isRev s confID uID papID\"\nshows \"isRevNth s confID uID papID (getReviewIndex s confID uID papID)\"\nproof-\n obtain n where 1: \"getRevRole s confID uID papID = Some (Rev papID n)\"\n using isRev_getRevRole2[OF assms] by auto\n hence \"isRevNth s confID uID papID n\"\n unfolding getRevRole_def unfolding find_Some_iff by auto\n moreover have \"getReviewIndex s confID uID papID = n\" using 1 unfolding getReviewIndex_def by simp\n ultimately show ?thesis by auto\nqed\n\n(* nonexecutable, but more useful version of the definition: *)\nlemma isRev_def2:\n\"isRev s confID uID papID \\ (\\ n. isRevNth s confID uID papID n)\" (is \"?A \\ ?B\")\nproof\n assume ?A thus ?B using isRev_imp_isRevNth_getReviewIndex by blast\nnext\n assume ?B thus ?A unfolding isRev_def list_ex_iff by force\nqed\n\n(* more precise definition, but not always needed: *)\nlemma isRev_def3:\n\"isRev s confID uID papID \\ isRevNth s confID uID papID (getReviewIndex s confID uID papID)\"\nby (metis isRev_def2 isRev_imp_isRevNth_getReviewIndex)\n\nlemma getFreshPaperID_getAllPaperIDs[simp]:\n assumes \"confID \\\\ confIDs s\"\n shows \"\\ getFreshPaperID (getAllPaperIDs s) \\\\ paperIDs s confID\"\n using assms getFreshPaperID[of \"getAllPaperIDs s\"]\n by (auto simp: getAllPaperIDs_def)\n\nlemma getRevRole_Some_Rev:\n\"getRevRole s cid uid pid = Some (Rev pid' n) \\ pid' = pid\"\nby (metis getRevRole_Some role.inject)\n\nlemma getRevRole_Some_Rev_isRevNth:\n\"getRevRole s cid uid pid = Some (Rev pid' n) \\ isRevNth s cid uid pid n\"\n unfolding getRevRole_def find_Some_iff\n apply (elim exE)\n subgoal for i\n apply(cases \"roles s cid uid ! i\")\n apply auto\n by (metis nth_mem)\n done\n\n(* This assumes that the list of conference IDs has exactly one element: *)\ndefinition IDsOK :: \"state \\ confID list \\ userID list \\ paperID list \\ bool\"\nwhere\n\"IDsOK s cIDs uIDs papIDs \\\n list_all (\\ confID. confID \\\\ confIDs s) cIDs \\\n list_all (\\ uID. uID \\\\ userIDs s) uIDs \\\n list_all (\\ papID. papID \\\\ paperIDs s (hd cIDs)) papIDs\"\n\n\nsubsection \\The actions\\\n\nsubsubsection\\Initialization of the system\\\n\ndefinition istate :: state\nwhere\n\"istate \\\n \\\n confIDs = [],\n conf = (\\ confID. emptyConf),\n userIDs = [voronkovUserID],\n pass = (\\ uID. emptyPass),\n user = (\\ uID. emptyUser),\n roles = (\\ confID uID. []),\n paperIDs = (\\ confID. []),\n paper = (\\ papID. emptyPaper),\n pref = (\\ uID papID. NoPref),\n voronkov = voronkovUserID,\n news = (\\ confID. []),\n phase = (\\ confID. noPH)\n \\\"\n\n\n\nsubsubsection\\Actions unbound by any existing conference (with its phases)\\\n\n(* Create new user (user) in the system: *)\n(* if given user ID already taken, generate a fresh one *)\ndefinition createUser :: \"state \\ userID \\ password \\ string \\ string \\ string \\ state\"\nwhere\n\"createUser s uID p name info email \\\n let uIDs = userIDs s\n in\n s \\userIDs := uID # uIDs,\n user := (user s) (uID := User name info email),\n pass := (pass s) (uID := p)\\\"\n(* the the web interface, one should prompt the user multiple times for entering\n an unused ID *)\n\ndefinition e_createUser :: \"state \\ userID \\ password \\ string \\ string \\ string \\ bool\" where\n\"e_createUser s uID p name info email \\\n \\ uID \\\\ userIDs s\"\n\n(* updates information for user (himself), including password: *)\ndefinition updateUser :: \"state \\ userID \\ password \\ password \\ string \\ string \\ string \\ state\"\nwhere\n\"updateUser s uID p p' name info email \\\n s \\user := (user s) (uID := User name info email),\n pass := (pass s) (uID := p')\\\"\n\ndefinition e_updateUser :: \"state \\ userID \\ password \\ password \\ string \\ string \\ string \\ bool\"\nwhere\n\"e_updateUser s uID p p' name info email \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n\n(* read if the current user is the voronkov: *)\ndefinition readAmIVoronkov :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"readAmIVoronkov s uID p \\\n uID = voronkov s \"\n\ndefinition e_readAmIVoronkov :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_readAmIVoronkov s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n(* Read the name and info of a user (except for password): *)\n(* There are several needs for this primitive action:\n -- either I read my own info\n -- or I am an author, and therefore I read the PC members' name and info to declare a conflict\n -- or I am a chair, and therefore I read all PC members's info to assign papers for reviewing\n -- or I am an author and need to add coauthors\n*)\ndefinition readUser :: \"state \\ userID \\ password \\ userID \\ string * string * string\"\nwhere\n\"readUser s uID p uID' \\\n case user s uID' of User name info email \\ (name, info, email)\"\n\ndefinition e_readUser :: \"state \\ userID \\ password \\ userID \\ bool\"\nwhere\n\"e_readUser s uID p uID' \\\n IDsOK s [] [uID,uID'] [] \\ pass s uID = p\"\n\n(* Request for a new conference *)\n\n(* The request takes place by creating a new conference with ID assigned as above for users.\nThe conference will remain in the default \"noPH\" phase until aproval.\nThe creator becomes a chair (a fortiori a PC member). *)\ndefinition createConf :: \"state \\ confID \\ userID \\ password \\ string \\ string \\ state\"\nwhere\n\"createConf s confID uID p name info \\\n let confIDs = confIDs s\n in\n s \\confIDs := confID # confIDs,\n conf := (conf s) (confID := Conf name info),\n roles := fun_upd2 (roles s) confID uID [PC,Chair]\n \\\"\n(* again, in the web interface the user will be prompted repeatedly until he gets it right *)\n\ndefinition e_createConf :: \"state \\ confID \\ userID \\ password \\ string \\ string \\ bool\"\nwhere\n\"e_createConf s confID uID p name info \\\n IDsOK s [] [uID] [] \\ pass s uID = p \\\n \\ confID \\\\ confIDs s\"\n\n(* Read the info of a conference: any user can do it *)\ndefinition readConf :: \"state \\ confID \\ userID \\ password \\ string * string * (role list) * phase\"\nwhere\n\"readConf s confID uID p \\\n (nameConf (conf s confID), infoConf (conf s confID),\n [rl \\ roles s confID uID. \\ isRevRole rl], phase s confID)\"\n\ndefinition e_readConf :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_readConf s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p\"\n\n(* list all conferences: *)\ndefinition listConfs :: \"state \\ userID \\ password \\ confID list\"\nwhere\n\"listConfs s uID p \\\n confIDs s\"\n\ndefinition e_listConfs :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listConfs s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p \\\n uID = voronkov s\"\n\n(* list conferences awaiting approval: *)\ndefinition listAConfs :: \"state \\ userID \\ password \\ confID list\"\nwhere\n\"listAConfs s uID p \\\n [confID. confID \\ confIDs s, phase s confID = noPH]\"\n\ndefinition e_listAConfs :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listAConfs s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p \\\n uID = voronkov s\"\n\n(* list conferences in the submission phase: any user can see this *)\ndefinition listSConfs :: \"state \\ userID \\ password \\ confID list\"\nwhere\n\"listSConfs s uID p \\\n [confID. confID \\ confIDs s, phase s confID = subPH]\"\n\ndefinition e_listSConfs :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listSConfs s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n(* list my conferences: *)\ndefinition listMyConfs :: \"state \\ userID \\ password \\ confID list\"\nwhere\n\"listMyConfs s uID p \\\n [confID. confID \\ confIDs s , roles s confID uID \\ []]\"\n\ndefinition e_listMyConfs :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listMyConfs s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n(* list all users of the system (useful when assigning coauthors to papers): *)\ndefinition listAllUsers :: \"state \\ userID \\ password \\ userID list\"\nwhere\n\"listAllUsers s uID p \\\n userIDs s\"\n\ndefinition e_listAllUsers :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listAllUsers s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n(* list all paper IDs of the system (useful whn generating a fresh paper ID): *)\ndefinition listAllPapers :: \"state \\ userID \\ password \\ paperID list\"\nwhere\n\"listAllPapers s uID p \\\n getAllPaperIDs s\"\n\ndefinition e_listAllPapers :: \"state \\ userID \\ password \\ bool\"\nwhere\n\"e_listAllPapers s uID p \\\n IDsOK s [] [uID] [] \\ pass s uID = p\"\n\n\nsubsubsection\\Actions available in the noPH phase\\\n\n(* Approving a new conference should be done by the voronkov, and happens by changing\nthe phase from noPH to setPH.\nThis is an update action: it updates the conference approval status\nNote that, after approval, the voronkov should not have further access to the conference:\nhe can only act if the phase is noPH. *)\ndefinition updateConfA :: \"state \\ confID \\ userID \\ password \\ state\"\nwhere\n\"updateConfA s confID uID p \\\n s \\phase := (phase s) (confID := setPH)\\\"\n\ndefinition e_updateConfA :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_updateConfA s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n uID = voronkov s \\ phase s confID = noPH\"\n\n\nsubsubsection\\Actions available in the setPH phase\\\n\n(* make a user a PC member *)\ndefinition createPC :: \"state \\ confID \\ userID \\ password \\ userID \\ state\"\nwhere\n\"createPC s confID uID p uID' \\\n let rls = roles s confID uID'\n in\n s \\roles := fun_upd2 (roles s) confID uID' (List.insert PC rls)\\\"\n\ndefinition e_createPC :: \"state \\ confID \\ userID \\ password \\ userID \\ bool\"\nwhere\n\"e_createPC s confID uID p uID' \\\n let uIDs = userIDs s\n in\n IDsOK s [confID] [uID,uID'] [] \\ pass s uID = p \\\n phase s confID = setPH \\ isChair s confID uID\"\n\n(* make a user a chair (a fortiori a PC member) *)\ndefinition createChair :: \"state \\ confID \\ userID \\ password \\ userID \\ state\"\nwhere\n\"createChair s confID uID p uID' \\\n let rls = roles s confID uID'\n in\n s \\roles := fun_upd2 (roles s) confID uID' (List.insert PC (List.insert Chair rls))\\\"\n\ndefinition e_createChair :: \"state \\ confID \\ userID \\ password \\ userID \\ bool\"\nwhere\n\"e_createChair s confID uID p uID' \\\n let uIDs = userIDs s\n in\n IDsOK s [confID] [uID,uID'] [] \\ pass s uID = p \\\n phase s confID = setPH \\ isChair s confID uID\"\n\n\nsubsubsection\\Actions available starting from the setPH phase\\\n\ndefinition updatePhase :: \"state \\ confID \\ userID \\ password \\ phase \\ state\" where\n\"updatePhase s confID uID p ph \\\n s \\phase := (phase s) (confID := ph)\\\"\n\ndefinition e_updatePhase :: \"state \\ confID \\ userID \\ password \\ phase \\ bool\" where\n\"e_updatePhase s confID uID p ph \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ setPH \\ phase s confID < closedPH \\ isChair s confID uID \\\n ph = SucPH (phase s confID)\"\n(* The phase move is only allowed if the indicated phase is the successor of the current phase.\n Yet, in the kernel we also require the explicit indication of the phase for being able to track\n it for verification. *)\n(* In the web interface, the user is prompted with the question\n\"Are you sure you want to move to the next phase?\" *)\n\n(* Add an event, i.e., undestructively update the news: *)\ndefinition uupdateNews :: \"state \\ confID \\ userID \\ password \\ string \\ state\"\nwhere\n\"uupdateNews s confID uID p ev \\\n let evs = news s confID\n in\n s \\news := (news s) (confID := ev # evs)\\\"\n\ndefinition e_uupdateNews :: \"state \\ confID \\ userID \\ password \\ string \\ bool\"\nwhere\n\"e_uupdateNews s confID uID p ev \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ setPH \\ phase s confID < closedPH \\ isChair s confID uID\"\n\ndefinition readNews :: \"state \\ confID \\ userID \\ password \\ string list\"\nwhere\n\"readNews s confID uID p \\\n news s confID\"\n\ndefinition e_readNews :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_readNews s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ setPH \\ isPC s confID uID\"\n\n(* list the committee members: *)\ndefinition listPC :: \"state \\ confID \\ userID \\ password \\ userID list\"\nwhere\n\"listPC s confID uID p \\\n [uID. uID \\ userIDs s, isPC s confID uID]\"\n\ndefinition e_listPC :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_listPC s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n (phase s confID \\ subPH \\ (phase s confID \\ setPH \\ isChair s confID uID))\"\n\n(* list the chairs: *)\ndefinition listChair :: \"state \\ confID \\ userID \\ password \\ userID list\"\nwhere\n\"listChair s confID uID p \\\n [uID. uID \\ userIDs s, isChair s confID uID]\"\n\ndefinition e_listChair :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_listChair s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n (phase s confID \\ subPH \\ (phase s confID \\ setPH \\ isChair s confID uID))\"\n\n\nsubsubsection\\Actions available in the subPH phase\\\n\n(* create new paper: *)\ndefinition createPaper :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ string \\ state\"\nwhere\n\"createPaper s confID uID p papID title abstract \\\n let papIDs = paperIDs s confID;\n rls = roles s confID uID\n in\n s \\paperIDs := (paperIDs s) (confID := papID # papIDs),\n paper := (paper s) (papID := Paper title abstract NoPContent [] (Dis []) []),\n roles := fun_upd2 (roles s) confID uID (List.insert (Aut papID) rls),\n pref := fun_upd2 (pref s) uID papID Conflict\\\"\n(* this contains an update to the preference too, to make sure that a user does not end up\nreviewing his own paper! note that preference can be set even if the author is not a reviewer,\nwhich is OK*)\n\ndefinition e_createPaper :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ string \\ bool\"\nwhere\n\"e_createPaper s confID uID p papID name info \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID = subPH \\\n \\ papID \\\\ getAllPaperIDs s\"\n\n(* add author to a paper: only an author can do this *)\ndefinition createAuthor :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ state\"\nwhere\n\"createAuthor s confID uID p papID uID' \\\n let rls = roles s confID uID'\n in\n s \\roles := fun_upd2 (roles s) confID uID' (List.insert (Aut papID) rls),\n pref := fun_upd2 (pref s) uID' papID Conflict\\\"\n(* again, preference is set to Conflict *)\n\ndefinition e_createAuthor :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ bool\"\nwhere\n\"e_createAuthor s confID uID p papID uID' \\\n IDsOK s [confID] [uID,uID'] [papID] \\ pass s uID = p \\\n phase s confID = subPH \\ isAut s confID uID papID \\ uID \\ uID'\"\n\n(* update name (title) and info of paper: *)\ndefinition updatePaperTA :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ string \\ state\"\nwhere\n\"updatePaperTA s confID uID p papID title abstract \\\n case paper s papID of Paper title' abstract' pc reviews dis decs \\\n s \\paper := (paper s) (papID := Paper title abstract pc reviews dis decs)\\\"\n\ndefinition e_updatePaperTA :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ string \\ bool\"\nwhere\n\"e_updatePaperTA s confID uID p papID name info \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = subPH \\ isAut s confID uID papID\"\n\n(* upload new version of paper content: *)\ndefinition updatePaperC :: \"state \\ confID \\ userID \\ password \\ paperID \\ pcontent \\ state\"\nwhere\n\"updatePaperC s confID uID p papID pc \\\n case paper s papID of Paper title abstract pc' reviews dis decs \\\n s \\paper := (paper s) (papID := Paper title abstract pc reviews dis decs)\\\"\n\ndefinition e_updatePaperC :: \"state \\ confID \\ userID \\ password \\ paperID \\ pcontent \\ bool\"\nwhere\n\"e_updatePaperC s confID uID p papID pc \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = subPH \\ isAut s confID uID papID\"\n\n(* declare conflict of the authored paper with a committee member*)\ndefinition createConflict :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ state\"\nwhere\n\"createConflict s confID uID p papID uID' \\\n s \\pref := fun_upd2 (pref s) uID' papID Conflict\\\"\n\ndefinition e_createConflict :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ bool\"\nwhere\n\"e_createConflict s confID uID p papID uID' \\\n IDsOK s [confID] [uID,uID'] [papID] \\ pass s uID = p \\\n phase s confID = subPH \\ isAut s confID uID papID \\ isPC s confID uID'\"\n\n\nsubsubsection\\Actions available starting from the subPH phase\\\n\n(* read a paper's title, abstract and authors: *)\ndefinition readPaperTAA :: \"state \\ confID \\ userID \\ password \\ paperID \\\n (string * string * userID list)\"\nwhere\n\"readPaperTAA s confID uID p papID \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n (title, abstract, [uID. uID \\ userIDs s , isAut s confID uID papID])\"\n\ndefinition e_readPaperTAA :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readPaperTAA s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ subPH \\ (isAut s confID uID papID \\ isPC s confID uID)\"\n\n(* read a paper's content: *)\ndefinition readPaperC :: \"state \\ confID \\ userID \\ password \\ paperID \\ pcontent\"\nwhere\n\"readPaperC s confID uID p papID \\\n case paper s papID of Paper title abstract pc reviews dis decs \\ pc\"\n\ndefinition e_readPaperC :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readPaperC s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n (\n phase s confID \\ subPH \\ isAut s confID uID papID \\\n phase s confID \\ bidPH \\ isPC s confID uID\n )\"\n\n(* Note that the difference between the enabledness of readPaperTAA and that of readPaperC is\nthat the latter is allowed for the PC members only in the bidding phase. *)\n\n(* list all papers associated to a conference (with which the committee member does not have conflict): *)\ndefinition listPapers :: \"state \\ confID \\ userID \\ password \\ paperID list\"\nwhere\n\"listPapers s confID uID p \\\n let paps = paper s in\n [papID. papID \\ paperIDs s confID]\"\n\ndefinition e_listPapers :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_listPapers s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ subPH \\ isPC s confID uID\"\n\n(* list my (authored) papers: *)\ndefinition listMyPapers :: \"state \\ confID \\ userID \\ password \\ paperID list\"\nwhere\n\"listMyPapers s confID uID p \\\n let paps = paper s in\n [papID. papID \\ paperIDs s confID, isAut s confID uID papID]\"\n\ndefinition e_listMyPapers :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_listMyPapers s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ subPH\"\n\n\nsubsubsection\\Actions available in the bidPH phase\\\n\n(* update (my) preference: *)\ndefinition updatePref :: \"state \\ confID \\ userID \\ password \\ paperID \\ preference \\ state\"\nwhere\n\"updatePref s confID uID p papID pr \\\n s \\pref := fun_upd2 (pref s) uID papID pr\\\"\n\ndefinition e_updatePref :: \"state \\ confID \\ userID \\ password \\ paperID \\ preference \\ bool\"\nwhere\n\"e_updatePref s confID uID p papID pr \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = bidPH \\ isPC s confID uID \\\n \\ isAut s confID uID papID\"\n(* note: if an author of the paper, conflict was marked in the first place,\n and updating is not allowed *)\n\n\nsubsubsection\\Actions available starting from the bidPH phase\\\n\n(* read (my) preference: *)\ndefinition readPref :: \"state \\ confID \\ userID \\ password \\ paperID \\ preference\"\nwhere\n\"readPref s confID uID p papID \\\n pref s uID papID\"\n\ndefinition e_readPref :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readPref s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ bidPH \\ isPC s confID uID\"\n\n\nsubsubsection\\Actions available in the revPH phase\\\n\n(* read preferences of a committee member (useful for the chair to read the preferences of the\ncommittee members: *)\n\ndefinition readPrefOfPC :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ preference\"\nwhere\n\"readPrefOfPC s confID uID p papID uID' \\\n pref s uID' papID\"\n\ndefinition e_readPrefOfPC :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID\\ bool\"\nwhere\n\"e_readPrefOfPC s confID uID p papID uID' \\\n IDsOK s [confID] [uID,uID'] [papID] \\ pass s uID = p \\\n (phase s confID \\ bidPH \\ isChair s confID uID \\ isPC s confID uID'\n \\\n phase s confID = subPH \\ isAut s confID uID papID)\"\n(* unique violation of monotonicity for read actions: an author can read the preferences of the PC chair\n in the submission phase, but not later, as later they will have been updated by the chairs *)\n\n(* create a review and assign a reviewer: *)\ndefinition createReview :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ state\"\nwhere\n\"createReview s confID uID p papID uID' \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n let rls = roles s confID uID'; n = length (reviewsPaper (paper s papID));\n reviews' = reviews @ [emptyReview]\n in\n s \\roles := fun_upd2 (roles s) confID uID' (List.insert (Rev papID n) rls),\n paper := fun_upd (paper s) papID (Paper title abstract pc reviews' dis decs)\n \\\"\n(* note: the new review is added at the end, in order not to disrupt the indexing of the other reviews *)\n\ndefinition e_createReview :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID \\ bool\"\nwhere\n\"e_createReview s confID uID p papID uID' \\\n IDsOK s [confID] [uID,uID'] [papID] \\ pass s uID = p \\\n phase s confID = revPH \\\n isChair s confID uID \\ pref s uID papID \\ Conflict \\\n isPC s confID uID' \\ \\ isRev s confID uID' papID \\ pref s uID' papID \\ Conflict\"\n\n(* update the review that I write: *)\ndefinition updateReview ::\n\"state \\ confID \\ userID \\ password \\ paperID \\ nat \\ rcontent \\ state\"\nwhere\n\"updateReview s confID uID p papID n rc \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n let review = [rc]; reviews' = list_update reviews n review\n in\n s \\paper := fun_upd (paper s) papID (Paper title abstract pc reviews' dis decs)\\\"\n\ndefinition e_updateReview ::\n\"state \\ confID \\ userID \\ password \\ paperID \\ nat \\ rcontent \\ bool\"\nwhere\n\"e_updateReview s confID uID p papID n rc \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = revPH \\ isRev s confID uID papID \\\n getReviewIndex s confID uID papID = n\"\n\n\nsubsubsection\\Actions available starting from the revPH phase\\\n\n(* read the review that I write: *)\ndefinition readMyReview :: \"state \\ confID \\ userID \\ password \\ paperID \\ nat * review\"\nwhere\n\"readMyReview s confID uID p papID \\\n case getRevRole s confID uID papID of\n Some (Rev papID' n) \\ (n, getNthReview s papID n)\"\n\ndefinition e_readMyReview :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readMyReview s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ revPH \\ isRev s confID uID papID\"\n\n(* list my assigned papers: *)\ndefinition listMyAssignedPapers :: \"state \\ confID \\ userID \\ password \\ paperID list\"\nwhere\n\"listMyAssignedPapers s confID uID p \\\n let paps = paper s in\n [papID. papID \\ paperIDs s confID, isRev s confID uID papID]\"\n\ndefinition e_listMyAssignedPapers :: \"state \\ confID \\ userID \\ password \\ bool\"\nwhere\n\"e_listMyAssignedPapers s confID uID p \\\n IDsOK s [confID] [uID] [] \\ pass s uID = p \\\n phase s confID \\ revPH \\ isPC s confID uID\"\n\n\ndefinition listAssignedReviewers :: \"state \\ confID \\ userID \\ password \\ paperID \\ userID list\"\nwhere\n\"listAssignedReviewers s confID uID p papID \\\n [uID \\ userIDs s. isRev s confID uID papID]\"\n\ndefinition e_listAssignedReviewers :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_listAssignedReviewers s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ revPH \\\n isChair s confID uID \\ pref s uID papID \\ Conflict\"\n\n\nsubsubsection\\Actions available in the disPH phase\\\n\n(* undestructively update the discussion with a comment: *)\ndefinition uupdateDis :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ state\"\nwhere\n\"uupdateDis s confID uID p papID comm \\\n case paper s papID of Paper title abstract pc reviews (Dis comments) decs \\\n s \\paper := fun_upd (paper s) papID (Paper title abstract pc reviews (Dis (comm # comments)) decs)\\\"\n\ndefinition e_uupdateDis :: \"state \\ confID \\ userID \\ password \\ paperID \\ string \\ bool\"\nwhere\n\"e_uupdateDis s confID uID p papID comm \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = disPH \\ isPC s confID uID \\ pref s uID papID \\ Conflict\"\n\n(* correct my review during the discussion\n(instance of a undestructive update) *)\ndefinition uupdateReview ::\n\"state \\ confID \\ userID \\ password \\ paperID \\ nat \\ rcontent \\ state\"\nwhere\n\"uupdateReview s confID uID p papID n rc \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n let review = rc # (reviews ! n); reviews' = list_update reviews n review\n in\n s \\paper := fun_upd (paper s) papID (Paper title abstract pc reviews' dis decs)\\\"\n\ndefinition e_uupdateReview ::\n\"state \\ confID \\ userID \\ password \\ paperID \\ nat \\ rcontent \\ bool\"\nwhere\n\"e_uupdateReview s confID uID p papID n rc \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = disPH \\ isRev s confID uID papID \\\n getReviewIndex s confID uID papID = n\"\n\n(* update the decision for a paper (again undestructive update) : *)\ndefinition uupdateDec :: \"state \\ confID \\ userID \\ password \\ paperID \\ decision \\ state\"\nwhere\n\"uupdateDec s confID uID p papID dec \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n s \\paper := fun_upd (paper s) papID (Paper title abstract pc reviews dis (dec # decs))\\\"\n\ndefinition e_uupdateDec :: \"state \\ confID \\ userID \\ password \\ paperID \\ decision \\ bool\"\nwhere\n\"e_uupdateDec s confID uID p papID dec \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID = disPH \\ isChair s confID uID \\ pref s uID papID \\ Conflict\"\n\n\nsubsubsection\\Actions available starting from the disPH phase\\\n\n(* read all the reviews to a paper (including all the updates) with the IDs of the reviewers: *)\ndefinition readReviews :: \"state \\ confID \\ userID \\ password \\ paperID \\ (userID * review) list\"\nwhere\n\"readReviews s confID uID p papID \\\n getReviewersReviews s confID papID\"\n\ndefinition e_readReviews :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readReviews s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ disPH \\ isPC s confID uID \\ pref s uID papID \\ Conflict\"\n\n(* read the decisions (i.e., the decision history) for a paper: *)\ndefinition readDecs :: \"state \\ confID \\ userID \\ password \\ paperID \\ decision list\"\nwhere\n\"readDecs s confID uID p papID \\\n case paper s papID of Paper title abstract pc reviews dis decs \\ decs\"\n\ndefinition e_readDecs :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readDecs s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ disPH \\ isPC s confID uID \\ pref s uID papID \\ Conflict\"\n\n(* read the discussion to a paper: *)\ndefinition readDis :: \"state \\ confID \\ userID \\ password \\ paperID \\ string list\"\nwhere\n\"readDis s confID uID p papID \\\n case paper s papID of Paper title abstract pc reviews (Dis comments) decs \\ comments\"\n\ndefinition e_readDis :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readDis s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ disPH \\ isPC s confID uID \\ pref s uID papID \\ Conflict\"\n\n\n\nsubsubsection\\Actions available starting from the notifPH phase\\\n\n(* read final reviews to a paper: available to the authors and all non-conflicted PC members *)\ndefinition readFinalReviews :: \"state \\ confID \\ userID \\ password \\ paperID \\ review list\"\nwhere\n\"readFinalReviews s confID uID p papID \\\n map (\\ rev. case rev of [] \\ [(NoExp,NoScore,emptyStr)]\n |((exp,score,comm) # rv) \\ [(exp,score,comm)])\n (reviewsPaper (paper s papID))\"\n\ndefinition e_readFinalReviews :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readFinalReviews s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ notifPH \\ (isAut s confID uID papID \\ (isPC s confID uID \\ pref s uID papID \\ Conflict))\"\n\n(* read the final decision for a paper available to the authors and all PC members (including conflicted PC members):*)\ndefinition readFinalDec :: \"state \\ confID \\ userID \\ password \\ paperID \\ decision\"\nwhere\n\"readFinalDec s confID uID p papID \\\n case paper s papID of Paper title abstract pc reviews dis decs \\\n case decs of [] \\ NoDecision | dec # decs \\ dec\"\n\ndefinition e_readFinalDec :: \"state \\ confID \\ userID \\ password \\ paperID \\ bool\"\nwhere\n\"e_readFinalDec s confID uID p papID \\\n IDsOK s [confID] [uID] [papID] \\ pass s uID = p \\\n phase s confID \\ notifPH \\ (isAut s confID uID papID \\ isPC s confID uID)\"\n\n\nsubsection\\The step function\\\n\ndatatype out =\n outOK | outErr | (* OK and error, outputs for list, update and u-update actions *)\n outBool bool|\n outSTRT \"string * string * string\" | outSTRL \"string list\" | outCONF \"string * string * role list * phase\" |\n outPREF preference |\n outCON pcontent |\n outNREV \"nat * review\" | outREVL \"review list\" | outRREVL \"(userID * review) list\" |\n outDEC \"decision\" | outDECL \"decision list\" |\n outCIDL \"confID list\" | outUIDL \"userID list\" | outPIDL \"paperID list\"|\n outSTRPAL \"string * string * userID list\"\n\ndatatype cAct =\n cUser userID password string string string\n |cConf confID userID password string string\n |cPC confID userID password userID\n |cChair confID userID password userID\n |cPaper confID userID password paperID string string\n |cAuthor confID userID password paperID userID\n |cConflict confID userID password paperID userID\n |cReview confID userID password paperID userID\n\nlemmas c_defs =\ne_createUser_def createUser_def\ne_createConf_def createConf_def\ne_createPC_def createPC_def\ne_createChair_def createChair_def\ne_createAuthor_def createAuthor_def\ne_createConflict_def createConflict_def\ne_createPaper_def createPaper_def\ne_createReview_def createReview_def\n\nfun cStep :: \"state \\ cAct \\ out * state\" where\n\"cStep s (cUser uID p name info email) =\n (if e_createUser s uID p name info email\n then (outOK, createUser s uID p name info email)\n else (outErr, s))\"\n|\n\"cStep s (cConf confID uID p name info) =\n (if e_createConf s confID uID p name info\n then (outOK, createConf s confID uID p name info)\n else (outErr, s))\"\n|\n\"cStep s (cPC confID uID p uID') =\n (if e_createPC s confID uID p uID'\n then (outOK, createPC s confID uID p uID')\n else (outErr, s))\"\n|\n\"cStep s (cChair confID uID p uID') =\n (if e_createChair s confID uID p uID'\n then (outOK, createChair s confID uID p uID')\n else (outErr, s))\"\n|\n\"cStep s (cPaper confID uID p papID name info) =\n (if e_createPaper s confID uID p papID name info\n then (outOK, createPaper s confID uID p papID name info)\n else (outErr, s))\"\n|\n\"cStep s (cAuthor confID uID p papID uID') =\n (if e_createAuthor s confID uID p papID uID'\n then (outOK, createAuthor s confID uID p papID uID')\n else (outErr, s))\"\n|\n\"cStep s (cConflict confID uID p papID uID') =\n (if e_createConflict s confID uID p papID uID'\n then (outOK, createConflict s confID uID p papID uID')\n else (outErr, s))\"\n|\n\"cStep s (cReview confID uID p papID uID') =\n (if e_createReview s confID uID p papID uID'\n then (outOK, createReview s confID uID p papID uID')\n else (outErr, s))\"\n\n\ndatatype uAct =\n uUser userID password password string string string\n |uConfA confID userID password\n |uPhase confID userID password phase\n |uPaperTA confID userID password paperID string string\n |uPaperC confID userID password paperID pcontent\n |uPref confID userID password paperID preference\n |uReview confID userID password paperID nat rcontent\n\nlemmas u_defs =\ne_updateUser_def updateUser_def\ne_updateConfA_def updateConfA_def\ne_updatePhase_def updatePhase_def\ne_updatePaperTA_def updatePaperTA_def\ne_updatePaperC_def updatePaperC_def\ne_updatePref_def updatePref_def\ne_updateReview_def updateReview_def\n\nfun uStep :: \"state \\ uAct \\ out * state\" where\n\"uStep s (uUser uID p p' name info email) =\n (if e_updateUser s uID p p' name info email\n then (outOK, updateUser s uID p p' name info email)\n else (outErr, s))\"\n|\n\"uStep s (uConfA confID uID p) =\n (if e_updateConfA s confID uID p\n then (outOK, updateConfA s confID uID p)\n else (outErr, s))\"\n|\n\"uStep s (uPhase confID uID p ph) =\n (if e_updatePhase s confID uID p ph\n then (outOK, updatePhase s confID uID p ph)\n else (outErr, s))\"\n|\n\"uStep s (uPaperTA confID uID p papID name info) =\n (if e_updatePaperTA s confID uID p papID name info\n then (outOK, updatePaperTA s confID uID p papID name info)\n else (outErr, s))\"\n|\n\"uStep s (uPaperC confID uID p papID pc) =\n (if e_updatePaperC s confID uID p papID pc\n then (outOK, updatePaperC s confID uID p papID pc)\n else (outErr, s))\"\n|\n\"uStep s (uPref confID uID p papID pr) =\n (if e_updatePref s confID uID p papID pr\n then (outOK, updatePref s confID uID p papID pr)\n else (outErr, s))\"\n|\n\"uStep s (uReview confID uID p papID n rc) =\n (if e_updateReview s confID uID p papID n rc\n then (outOK, updateReview s confID uID p papID n rc)\n else (outErr, s))\"\n\n\ndatatype uuAct =\n uuNews confID userID password string\n |uuDis confID userID password paperID string\n |uuReview confID userID password paperID nat rcontent\n |uuDec confID userID password paperID decision\n\nlemmas uu_defs =\ne_uupdateNews_def uupdateNews_def\ne_uupdateDis_def uupdateDis_def\ne_uupdateReview_def uupdateReview_def\nuupdateDec_def e_uupdateDec_def\n\nfun uuStep :: \"state \\ uuAct \\ out * state\" where\n\"uuStep s (uuNews confID uID p ev) =\n (if e_uupdateNews s confID uID p ev\n then (outOK, uupdateNews s confID uID p ev)\n else (outErr, s))\"\n|\n\"uuStep s (uuDis confID uID p papID comm) =\n (if e_uupdateDis s confID uID p papID comm\n then (outOK, uupdateDis s confID uID p papID comm)\n else (outErr, s))\"\n|\n\"uuStep s (uuReview confID uID p papID n rc) =\n (if e_uupdateReview s confID uID p papID n rc\n then (outOK, uupdateReview s confID uID p papID n rc)\n else (outErr, s))\"\n|\n\"uuStep s (uuDec confID uID p papID dec) =\n (if e_uupdateDec s confID uID p papID dec\n then (outOK, uupdateDec s confID uID p papID dec)\n else (outErr, s))\"\n\ndatatype rAct =\n rAmIVoronkov userID password\n |rUser userID password userID\n |rConf confID userID password\n |rNews confID userID password\n |rPaperTAA confID userID password paperID\n |rPaperC confID userID password paperID\n |rPref confID userID password paperID\n |rMyReview confID userID password paperID\n |rReviews confID userID password paperID\n |rDecs confID userID password paperID\n |rDis confID userID password paperID\n |rFinalReviews confID userID password paperID\n |rFinalDec confID userID password paperID\n |rPrefOfPC confID userID password paperID userID\n\nlemmas r_defs =\n readAmIVoronkov_def e_readAmIVoronkov_def\n readUser_def e_readUser_def\n readConf_def e_readConf_def\n readNews_def e_readNews_def\n readPaperTAA_def e_readPaperTAA_def\n readPaperC_def e_readPaperC_def\n readPref_def e_readPref_def\n readMyReview_def e_readMyReview_def\n readReviews_def e_readReviews_def\n readDecs_def e_readDecs_def\n readDis_def e_readDis_def\n readFinalReviews_def e_readFinalReviews_def\n readFinalDec_def e_readFinalDec_def\n readPrefOfPC_def e_readPrefOfPC_def\n\nfun rObs :: \"state \\ rAct \\ out\" where\n\"rObs s (rAmIVoronkov uID p) =\n (if e_readAmIVoronkov s uID p then outBool (readAmIVoronkov s uID p) else outErr)\"\n|\n\"rObs s (rUser uID p uID') =\n (if e_readUser s uID p uID' then outSTRT (readUser s uID p uID') else outErr)\"\n|\n\"rObs s (rConf confID uID p) =\n (if e_readConf s confID uID p then outCONF (readConf s confID uID p) else outErr)\"\n|\n\"rObs s (rNews confID uID p) =\n (if e_readNews s confID uID p then outSTRL (readNews s confID uID p) else outErr)\"\n|\n\"rObs s (rPaperTAA confID uID p papID) =\n (if e_readPaperTAA s confID uID p papID then outSTRPAL (readPaperTAA s confID uID p papID) else outErr)\"\n|\n\"rObs s (rPaperC confID uID p papID) =\n (if e_readPaperC s confID uID p papID then outCON (readPaperC s confID uID p papID) else outErr)\"\n|\n\"rObs s (rPref confID uID p papID) =\n (if e_readPref s confID uID p papID then outPREF (readPref s confID uID p papID) else outErr)\"\n|\n\"rObs s (rMyReview confID uID p papID) =\n (if e_readMyReview s confID uID p papID then outNREV (readMyReview s confID uID p papID) else outErr)\"\n|\n\"rObs s (rReviews confID uID p papID) =\n (if e_readReviews s confID uID p papID then outRREVL (readReviews s confID uID p papID) else outErr)\"\n|\n\"rObs s (rDecs confID uID p papID) =\n (if e_readDecs s confID uID p papID then outDECL (readDecs s confID uID p papID) else outErr)\"\n|\n\"rObs s (rDis confID uID p papID) =\n (if e_readDis s confID uID p papID then outSTRL (readDis s confID uID p papID) else outErr)\"\n|\n\"rObs s (rFinalReviews confID uID p papID) =\n (if e_readFinalReviews s confID uID p papID then outREVL (readFinalReviews s confID uID p papID) else outErr)\"\n|\n\"rObs s (rFinalDec confID uID p papID) =\n (if e_readFinalDec s confID uID p papID then outDEC (readFinalDec s confID uID p papID) else outErr)\"\n|\n\"rObs s (rPrefOfPC confID uID p papID uID') =\n (if e_readPrefOfPC s confID uID p papID uID' then outPREF (readPrefOfPC s confID uID p papID uID') else outErr)\"\n\ndatatype lAct =\n lConfs userID password\n |lAConfs userID password\n |lSConfs userID password\n |lMyConfs userID password\n |lAllUsers userID password\n |lAllPapers userID password\n |lPC confID userID password\n |lChair confID userID password\n |lPapers confID userID password\n |lMyPapers confID userID password\n |lMyAssignedPapers confID userID password\n |lAssignedReviewers confID userID password paperID\n\nlemmas l_defs =\n listConfs_def e_listConfs_def\n listAConfs_def e_listAConfs_def\n listSConfs_def e_listSConfs_def\n listMyConfs_def e_listMyConfs_def\n listAllUsers_def e_listAllUsers_def\n listAllPapers_def e_listAllPapers_def\n listPC_def e_listPC_def\n listChair_def e_listChair_def\n listPapers_def e_listPapers_def\n listMyPapers_def e_listMyPapers_def\n listMyAssignedPapers_def e_listMyAssignedPapers_def\n listAssignedReviewers_def e_listAssignedReviewers_def\n\nfun lObs :: \"state \\ lAct \\ out\" where\n\"lObs s (lConfs uID p) =\n (if e_listConfs s uID p then outCIDL (listConfs s uID p) else outErr)\"\n|\n\"lObs s (lAConfs uID p) =\n (if e_listAConfs s uID p then outCIDL (listAConfs s uID p) else outErr)\"\n|\n\"lObs s (lSConfs uID p) =\n (if e_listSConfs s uID p then outCIDL (listSConfs s uID p) else outErr)\"\n|\n\"lObs s (lMyConfs uID p) =\n (if e_listMyConfs s uID p then outCIDL (listMyConfs s uID p) else outErr)\"\n|\n\"lObs s (lAllUsers uID p) =\n (if e_listAllUsers s uID p then outUIDL (listAllUsers s uID p) else outErr)\"\n|\n\"lObs s (lAllPapers uID p) =\n (if e_listAllPapers s uID p then outPIDL (listAllPapers s uID p) else outErr)\"\n|\n\"lObs s (lPC confID uID p) =\n (if e_listPC s confID uID p then outUIDL (listPC s confID uID p) else outErr)\"\n|\n\"lObs s (lChair confID uID p) =\n (if e_listChair s confID uID p then outUIDL (listChair s confID uID p) else outErr)\"\n|\n\"lObs s (lPapers confID uID p) =\n (if e_listPapers s confID uID p then outPIDL (listPapers s confID uID p) else outErr)\"\n|\n\"lObs s (lMyPapers confID uID p) =\n (if e_listMyPapers s confID uID p then outPIDL (listMyPapers s confID uID p) else outErr)\"\n|\n\"lObs s (lMyAssignedPapers confID uID p) =\n (if e_listMyAssignedPapers s confID uID p then outPIDL (listMyAssignedPapers s confID uID p) else outErr)\"\n|\n\"lObs s (lAssignedReviewers confID uID p papID) =\n (if e_listAssignedReviewers s confID uID p papID\n then outUIDL (listAssignedReviewers s confID uID p papID) else outErr)\"\n\ndatatype act =\n(* 3 kinds of effects: creation, update and undestructive update *)\n Cact cAct | Uact uAct | UUact uuAct |\n(* 2 kinds of observations: reading and listing (the latter mainly printing IDs) *)\n Ract rAct | Lact lAct\n\nfun step :: \"state \\ act \\ out * state\" where\n\"step s (Cact ca) = cStep s ca\"\n|\n\"step s (Uact ua) = uStep s ua\"\n|\n\"step s (UUact uua) = uuStep s uua\"\n|\n\"step s (Ract ra) = (rObs s ra, s)\"\n|\n\"step s (Lact la) = (lObs s la, s)\"\n\nexport_code step istate getFreshPaperID in Scala\n\n\ntext \\Some action selectors, used for verification:\\\n\n(* The user (subject) of an action: *)\nfun cUserOfA :: \"cAct \\ userID\" where\n\"cUserOfA (cUser uID p name info email) = uID\" (* time when a uID appears is an action of uID itself *)\n|\n\"cUserOfA (cConf confID uID p name info) = uID\"\n|\n\"cUserOfA (cPC confID uID p uID') = uID\"\n|\n\"cUserOfA (cChair confID uID p uID') = uID\"\n|\n\"cUserOfA (cPaper confID uID p papID name info) = uID\"\n|\n\"cUserOfA (cAuthor confID uID p papID uID') = uID\"\n|\n\"cUserOfA (cConflict confID uID p papID uID') = uID\"\n|\n\"cUserOfA (cReview confID uID p papID uID') = uID\"\n\nfun uUserOfA :: \"uAct \\ userID\" where\n\"uUserOfA (uUser uID p p' name info email) = uID\"\n|\n\"uUserOfA (uConfA confID uID p) = uID\"\n|\n\"uUserOfA (uPhase confID uID p ph) = uID\"\n|\n\"uUserOfA (uPaperTA confID uID p papID name info) = uID\"\n|\n\"uUserOfA (uPaperC confID uID p papID pc) = uID\"\n|\n\"uUserOfA (uPref confID uID p papID pr) = uID\"\n|\n\"uUserOfA (uReview confID uID p papID n rc) = uID\"\n\nfun uuUserOfA :: \"uuAct \\ userID\" where\n\"uuUserOfA (uuNews confID uID p ev) = uID\"\n|\n\"uuUserOfA (uuDis confID uID p papID comm) = uID\"\n|\n\"uuUserOfA (uuReview confID uID p papID n rc) = uID\"\n|\n\"uuUserOfA (uuDec confID uID p papID dec) = uID\"\n\nfun rUserOfA :: \"rAct \\ userID\" where\n\"rUserOfA (rAmIVoronkov uID p) = uID\"\n|\n\"rUserOfA (rUser uID p uID') = uID\"\n|\n\"rUserOfA (rConf confID uID p) = uID\"\n|\n\"rUserOfA (rNews confID uID p) = uID\"\n|\n\"rUserOfA (rPaperTAA confID uID p papID) = uID\"\n|\n\"rUserOfA (rPaperC confID uID p papID) = uID\"\n|\n\"rUserOfA (rPref confID uID p papID) = uID\"\n|\n\"rUserOfA (rMyReview confID uID p papID) = uID\"\n|\n\"rUserOfA (rReviews confID uID p papID) = uID\"\n|\n\"rUserOfA (rDecs confID uID p papID) = uID\"\n|\n\"rUserOfA (rDis confID uID p papID) = uID\"\n|\n\"rUserOfA (rFinalReviews confID uID p papID) = uID\"\n|\n\"rUserOfA (rFinalDec confID uID p papID) = uID\"\n|\n\"rUserOfA (rPrefOfPC confID uID p papID uID') = uID\"\n\nfun lUserOfA :: \"lAct \\ userID\" where\n\"lUserOfA (lConfs uID p) = uID\"\n|\n\"lUserOfA (lAConfs uID p) = uID\"\n|\n\"lUserOfA (lSConfs uID p) = uID\"\n|\n\"lUserOfA (lMyConfs uID p) = uID\"\n|\n\"lUserOfA (lAllUsers uID p) = uID\"\n|\n\"lUserOfA (lAllPapers uID p) = uID\"\n|\n\"lUserOfA (lPC confID uID p) = uID\"\n|\n\"lUserOfA (lChair confID uID p) = uID\"\n|\n\"lUserOfA (lPapers confID uID p) = uID\"\n|\n\"lUserOfA (lMyPapers confID uID p) = uID\"\n|\n\"lUserOfA (lMyAssignedPapers confID uID p) = uID\"\n|\n\"lUserOfA (lAssignedReviewers confID uID p papID) = uID\"\n\nfun userOfA :: \"act \\ userID\" where\n\"userOfA (Cact ca) = cUserOfA ca\"\n|\n\"userOfA (Uact ua) = uUserOfA ua\"\n|\n\"userOfA (UUact uua) = uuUserOfA uua\"\n|\n\"userOfA (Ract ra) = rUserOfA ra\"\n|\n\"userOfA (Lact la) = lUserOfA la\"\n\n\n(* The conference (framework, context) of an action: *)\nfun cConfOfA :: \"cAct \\ confID option\" where\n\"cConfOfA (cUser uID p name info email) = None\"\n|\n\"cConfOfA (cConf confID uID p name info) = Some confID\"\n(* time when a confID appears is an action bearing its ID *)\n|\n\"cConfOfA (cPC confID uID p uID') = Some confID\"\n|\n\"cConfOfA (cChair confID uID p uID') = Some confID\"\n|\n\"cConfOfA (cPaper confID uID p papID name info) = Some confID\"\n|\n\"cConfOfA (cAuthor confID uID p papID uID') = Some confID\"\n|\n\"cConfOfA (cConflict confID uID p papID uID') = Some confID\"\n|\n\"cConfOfA (cReview confID uID p papID uID') = Some confID\"\n\nfun uConfOfA :: \"uAct \\ confID option\" where\n\"uConfOfA (uUser uID p p' name info email) = None\"\n|\n\"uConfOfA (uConfA confID uID p) = Some confID\"\n|\n\"uConfOfA (uPhase confID uID p ph) = Some confID\"\n|\n\"uConfOfA (uPaperTA confID uID p papID name info) = Some confID\"\n|\n\"uConfOfA (uPaperC confID uID p papID pc) = Some confID\"\n|\n\"uConfOfA (uPref confID uID p papID pr) = Some confID\"\n|\n\"uConfOfA (uReview confID uID p papID n rc) = Some confID\"\n\nfun uuConfOfA :: \"uuAct \\ confID option\" where\n\"uuConfOfA (uuNews confID uID p ev) = Some confID\"\n|\n\"uuConfOfA (uuDis confID uID p papID comm) = Some confID\"\n|\n\"uuConfOfA (uuReview confID uID p papID n rc) = Some confID\"\n|\n\"uuConfOfA (uuDec confID uID p papID dec) = Some confID\"\n\nfun rConfOfA :: \"rAct \\ confID option\" where\n\"rConfOfA (rAmIVoronkov uID p) = None\"\n|\n\"rConfOfA (rUser uID p uID') = None\"\n|\n\"rConfOfA (rConf confID uID p) = Some confID\"\n|\n\"rConfOfA (rNews confID uID p) = Some confID\"\n|\n\"rConfOfA (rPaperTAA confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rPaperC confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rPref confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rMyReview confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rReviews confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rDecs confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rDis confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rFinalReviews confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rFinalDec confID uID p papID) = Some confID\"\n|\n\"rConfOfA (rPrefOfPC confID uID p papID uID') = Some confID\"\n\n\nfun lConfOfA :: \"lAct \\ confID option\" where\n\"lConfOfA (lConfs uID p) = None\"\n|\n\"lConfOfA (lAConfs uID p) = None\"\n|\n\"lConfOfA (lSConfs uID p) = None\"\n|\n\"lConfOfA (lMyConfs uID p) = None\"\n|\n\"lConfOfA (lAllUsers uID p) = None\"\n|\n\"lConfOfA (lAllPapers uID p) = None\"\n|\n\"lConfOfA (lPC confID uID p) = Some confID\"\n|\n\"lConfOfA (lChair confID uID p) = Some confID\"\n|\n\"lConfOfA (lPapers confID uID p) = Some confID\"\n|\n\"lConfOfA (lMyPapers confID uID p) = Some confID\"\n|\n\"lConfOfA (lMyAssignedPapers confID uID p) = Some confID\"\n|\n\"lConfOfA (lAssignedReviewers confID uID p papID) = Some confID\"\n\nfun confOfA :: \"act \\ confID option\" where\n\"confOfA (Cact ca) = cConfOfA ca\"\n|\n\"confOfA (Uact ua) = uConfOfA ua\"\n|\n\"confOfA (UUact uua) = uuConfOfA uua\"\n|\n\"confOfA (Ract ra) = rConfOfA ra\"\n|\n\"confOfA (Lact la) = lConfOfA la\"\n\n\n(* The paper of an action: *)\nfun cPaperOfA :: \"cAct \\ paperID option\" where\n\"cPaperOfA (cUser uID p name info email) = None\"\n|\n\"cPaperOfA (cPaper confID uID p papID name info) = Some papID\"\n(* time when a paperID appears is an action bearing its ID *)\n|\n\"cPaperOfA (cPC confID uID p uID') = None\"\n|\n\"cPaperOfA (cChair confID uID p uID') = None\"\n|\n\"cPaperOfA (cConf confID uID p name info) = None\"\n|\n\"cPaperOfA (cAuthor confID uID p papID uID') = Some papID\"\n|\n\"cPaperOfA (cConflict confID uID p papID uID') = Some papID\"\n|\n\"cPaperOfA (cReview confID uID p papID uID') = Some papID\"\n\nfun uPaperOfA :: \"uAct \\ paperID option\" where\n\"uPaperOfA (uUser uID p p' name info email) = None\"\n|\n\"uPaperOfA (uConfA confID uID p) = None\"\n|\n\"uPaperOfA (uPhase confID uID p ph) = None\"\n|\n\"uPaperOfA (uPaperTA confID uID p papID name info) = Some papID\"\n|\n\"uPaperOfA (uPaperC confID uID p papID pc) = Some papID\"\n|\n\"uPaperOfA (uPref confID uID p papID pr) = Some papID\"\n|\n\"uPaperOfA (uReview confID uID p papID n rc) = Some papID\"\n\nfun uuPaperOfA :: \"uuAct \\ paperID option\" where\n\"uuPaperOfA (uuNews confID uID p ev) = None\"\n|\n\"uuPaperOfA (uuDis confID uID p papID comm) = Some papID\"\n|\n\"uuPaperOfA (uuReview confID uID p papID n rc) = Some papID\"\n|\n\"uuPaperOfA (uuDec confID uID p papID dec) = Some papID\"\n\nfun rPaperOfA :: \"rAct \\ paperID option\" where\n\"rPaperOfA (rAmIVoronkov uID p) = None\"\n|\n\"rPaperOfA (rUser uID p uID') = None\"\n|\n\"rPaperOfA (rConf confID uID p) = None\"\n|\n\"rPaperOfA (rNews confID uID p) = None\"\n|\n\"rPaperOfA (rPaperTAA confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rPaperC confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rPref confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rMyReview confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rReviews confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rDecs confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rDis confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rFinalReviews confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rFinalDec confID uID p papID) = Some papID\"\n|\n\"rPaperOfA (rPrefOfPC confID uID p papID uID') = Some papID\"\n\nfun lPaperOfA :: \"lAct \\ paperID option\" where\n\"lPaperOfA (lConfs uID p) = None\"\n|\n\"lPaperOfA (lAConfs uID p) = None\"\n|\n\"lPaperOfA (lSConfs uID p) = None\"\n|\n\"lPaperOfA (lMyConfs uID p) = None\"\n|\n\"lPaperOfA (lAllUsers uID p) = None\"\n|\n\"lPaperOfA (lAllPapers uID p) = None\"\n|\n\"lPaperOfA (lPC confID uID p) = None\"\n|\n\"lPaperOfA (lChair confID uID p) = None\"\n|\n\"lPaperOfA (lPapers confID uID p) = None\"\n|\n\"lPaperOfA (lMyPapers confID uID p) = None\"\n|\n\"lPaperOfA (lMyAssignedPapers confID uID p) = None\"\n|\n\"lPaperOfA (lAssignedReviewers confID uID p papID) = Some papID\"\n\nfun paperOfA :: \"act \\ paperID option\" where\n\"paperOfA (Cact ca) = cPaperOfA ca\"\n|\n\"paperOfA (Uact ua) = uPaperOfA ua\"\n|\n\"paperOfA (UUact uua) = uuPaperOfA uua\"\n|\n\"paperOfA (Ract ra) = rPaperOfA ra\"\n|\n\"paperOfA (Lact la) = lPaperOfA la\"\n\n(* Note: unlike confOfA and paperOfA which may be \"None\", userOfA always returns a user ID. *)\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/System_Specification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2571033856120266}} {"text": "(*\n * Copyright (C) 2014 NICTA\n * All rights reserved.\n *)\n\n(* Author: David Cock - David.Cock@nicta.com.au *)\n\nheader {* Continuity and Induction for Loops*}\n\ntheory LoopInduction imports Healthiness Continuity begin\n\ntext {* Showing continuity for loops requires a stronger induction principle than we have used\nso far, which in turn relies on the continuity of loops (inductively). Thus, the proofs are\nintertwined, and broken off from the main set of continuity proofs. This result is also\nessential in showing the sublinearity of loops. *}\n\ntext {* A loop step is monotonic. *}\nlemma wp_loop_step_mono_trans:\n fixes body::\"'s prog\"\n assumes sP: \"sound P\"\n and hb: \"healthy (wp body)\"\n shows \"mono_trans (\\Q s. \\ G \\ s * wp body Q s + \\ \\ G \\ s * P s)\"\nproof(intro mono_transI le_funI, simp)\n fix Q R::\"'s expect\" and s::'s\n assume sQ: \"sound Q\" and sR: \"sound R\" and le: \"Q \\ R\"\n hence \"wp body Q \\ wp body R\"\n by(rule mono_transD[OF healthy_monoD, OF hb])\n thus \"\\G\\ s * wp body Q s \\ \\G\\ s * wp body R s\"\n by(auto dest:le_funD intro:mult_left_mono)\nqed\n\ntext {* We can therefore apply the standard fixed-point lemmas to unfold it: *}\nlemma lfp_wp_loop_unfold:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and sP: \"sound P\"\n shows \"lfp_exp (\\Q s. \\G\\ s * wp body Q s + \\\\ G\\ s * P s) =\n (\\s. \\G\\ s * wp body (lfp_exp (\\Q s. \\G\\ s * wp body Q s + \\\\ G\\ s * P s)) s +\n \\\\ G\\ s * P s)\"\nproof(rule lfp_exp_unfold)\n from assms show \"mono_trans (\\Q s. \\G\\ s * wp body Q s + \\\\ G\\ s * P s)\"\n by(blast intro:wp_loop_step_mono_trans)\n from assms show \"\\s. \\G\\ s * wp body (\\s. bound_of P) s + \\\\ G\\ s * P s \\ \\s. bound_of P\"\n by(blast intro:lfp_loop_fp)\n from sP show \"sound (\\s. bound_of P)\"\n by(auto)\n fix Q::\"'s expect\"\n assume \"sound Q\"\n with assms show \"sound (\\s. \\G\\ s * wp body Q s + \\\\ G\\ s * P s)\"\n by(intro wp_loop_step_sound[unfolded wp_eval, simplified, folded negate_embed], auto)\nqed\n\n\n\n from uP uwQ have \"wp body Q s \\ 1\" \"P s \\ 1\" by(auto)\n hence \"\\G\\ s * wp body Q s + \\\\ G\\ s * P s \\ \\G\\ s * 1 + \\\\ G\\ s * 1\"\n by(blast intro:add_mono mult_left_mono)\n also have \"... = 1\" by(simp add:negate_embed)\n finally show \"\\G\\ s * wp body Q s + \\\\ G\\ s * P s \\ 1\" .\nqed\n\nlemma lfp_loop_unitary:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and uP: \"unitary P\"\n shows \"unitary (lfp_exp (\\Q s. \\G\\ s * wp body Q s + \\\\ G\\ s * P s))\"\n using assms by(blast intro:lfp_exp_unitary wp_loop_step_unitary)\n\ntext {* From the lattice structure on transformers, we establish a transfinite induction\n principle for loops. We use this to show a number of properties, particularly\n subdistributivity, for loops. This proof follows the pattern of lemma lfp\\_ordinal\\_induct\n in HOL/Inductive. *}\nlemma loop_induct:\n fixes body::\"'s prog\"\n assumes hwp: \"healthy (wp body)\"\n and hwlp: \"nearly_healthy (wlp body)\"\n -- \"The body must be healthy, both in strict and liberal semantics.\"\n and Limit: \"\\S. \\ \\x\\S. P (fst x) (snd x); \\x\\S. feasible (fst x);\n \\x\\S. \\Q. unitary Q \\ unitary (snd x Q) \\ \\\n P (Sup_trans (fst ` S)) (Inf_utrans (snd ` S))\"\n -- \"The property holds at limit points.\"\n and IH: \"\\t u. \\ P t u; feasible t; \\Q. unitary Q \\ unitary (u Q) \\ \\\n P (wp (body ;; Embed t \\<^bsub>\\ G \\\\<^esub>\\ Skip))\n (wlp (body ;; Embed u \\<^bsub>\\ G \\\\<^esub>\\ Skip))\"\n -- \"The inductive step. The property is preserved by a single loop iteration.\"\n and P_equiv: \"\\t t' u u'. \\ P t u; equiv_trans t t'; equiv_utrans u u' \\ \\ P t' u'\"\n -- \"The property must be preserved by equivalence\"\n shows \"P (wp (do G \\ body od)) (wlp (do G \\ body od))\"\n -- \"The property can refer to both interpretations simultaneously. The unifier will happily\n apply the rule to just one or the other, however.\"\nproof(simp add:wp_eval)\n let \"?X t\" = \"wp (body ;; Embed t \\<^bsub>\\ G \\\\<^esub>\\ Skip)\"\n let \"?Y t\" = \"wlp (body ;; Embed t \\<^bsub>\\ G \\\\<^esub>\\ Skip)\"\n\n let ?M = \"{x. P (fst x) (snd x) \\\n feasible (fst x) \\\n (\\Q. unitary Q \\ unitary (snd x Q)) \\\n le_trans (fst x) (lfp_trans ?X) \\\n le_utrans (gfp_trans ?Y) (snd x)}\"\n\n have fSup: \"feasible (Sup_trans (fst ` ?M))\"\n proof(intro feasibleI bounded_byI2 nnegI2)\n fix Q::\"'s expect\" and b::real\n assume nQ: \"nneg Q\" and bQ: \"bounded_by b Q\"\n show \"Sup_trans (fst ` ?M) Q \\ \\s. b\"\n unfolding Sup_trans_def\n using nQ bQ by(auto intro!:Sup_exp_least)\n show \"\\s. 0 \\ Sup_trans (fst ` ?M) Q\"\n proof(cases)\n assume empty: \"?M = {}\"\n show ?thesis by(simp add:Sup_trans_def Sup_exp_def empty)\n next\n assume ne: \"?M \\ {}\"\n hence \"\\x. x \\ ?M\" by(rule nonempty_witness)\n then obtain x where xin: \"x \\ ?M\" by(rule exE)\n hence ffx: \"feasible (fst x)\" by(simp)\n with nQ bQ have \"\\s. 0 \\ fst x Q\" by(auto)\n also from xin have \"fst x Q \\ Sup_trans (fst ` ?M) Q\"\n apply(intro Sup_trans_upper2[OF imageI _ nQ bQ], assumption)\n apply(clarsimp, blast intro: sound_nneg[OF feasible_sound] feasible_boundedD)\n done\n finally show \"\\s. 0 \\ Sup_trans (fst ` ?M) Q\" .\n qed\n qed\n\n have uInf: \"\\P. unitary P \\ unitary (Inf_utrans (snd ` ?M) P)\"\n proof(cases \"?M = {}\")\n fix P\n assume empty: \"?M = {}\"\n show \"?thesis P\" by(simp only:empty, simp add:Inf_utrans_def)\n next\n fix P::\"'s expect\"\n assume uP: \"unitary P\"\n and ne: \"?M \\ {}\"\n show \"?thesis P\"\n proof(intro unitaryI2 nnegI2 bounded_byI2)\n from nonempty_witness[OF ne] obtain x where xin: \"x \\ ?M\" by(iprover)\n hence sxin: \"snd x \\ snd ` ?M\" by(simp)\n hence \"le_utrans (Inf_utrans (snd ` ?M)) (snd x)\"\n by(intro Inf_utrans_lower, auto)\n with uP\n have \"Inf_utrans (snd ` ?M) P \\ snd x P\" by(auto)\n also {\n from xin uP have \"unitary (snd x P)\" by(simp)\n hence \"snd x P \\ \\s. 1\" by(auto)\n }\n finally show \"Inf_utrans (snd ` ?M) P \\ \\s. 1\" .\n\n have \"\\s. 0 \\ Inf_trans (snd ` ?M) P\"\n unfolding Inf_trans_def\n proof(rule Inf_exp_greatest)\n from sxin show \"{t P |t. t \\ snd ` ?M} \\ {}\" by(auto)\n show \"\\P\\{t P |t. t \\ snd ` ?M}. \\s. 0 \\ P\"\n proof(clarsimp)\n fix t::\"'s trans\"\n assume \"\\Q. unitary Q \\ unitary (t Q)\"\n with uP have \"unitary (t P)\" by(auto)\n thus \"\\s. 0 \\ t P\" by(auto)\n qed\n qed\n also {\n from ne have X: \"(snd ` ?M = {}) = False\" by(simp)\n have \"Inf_trans (snd ` ?M) P = Inf_utrans (snd ` ?M) P\"\n unfolding Inf_utrans_def by(subst X, simp)\n }\n finally show \"\\s. 0 \\ Inf_utrans (snd ` ?M) P\" .\n qed\n qed\n\n have wp_loop_mono: \"\\t u. \\ le_trans t u; \\P. sound P \\ sound (t P);\n \\P. sound P \\ sound (u P) \\ \\ le_trans (?X t) (?X u)\"\n proof(intro le_transI le_funI, simp add:wp_eval)\n fix t u::\"'s trans\" and P::\"'s expect\" and s::'s\n assume le: \"le_trans t u\"\n and st: \"\\P. sound P \\ sound (t P)\"\n and su: \"\\P. sound P \\ sound (u P)\"\n and sP: \"sound P\"\n hence \"sound (t P)\" \"sound (u P)\" by(auto)\n with healthy_monoD[OF hwp] le sP have \"wp body (t P) \\ wp body (u P)\" by(auto)\n hence \"wp body (t P) s \\ wp body (u P) s\" by(auto)\n thus \"\\G\\ s * wp body (t P) s \\ \\G\\ s * wp body (u P) s\" by(auto intro:mult_left_mono)\n qed\n\n have wlp_loop_mono: \"\\t u. \\ le_utrans t u; \\P. unitary P \\ unitary (t P);\n \\P. unitary P \\ unitary (u P) \\ \\ le_utrans (?Y t) (?Y u)\"\n proof(intro le_utransI le_funI, simp add:wp_eval)\n fix t u::\"'s trans\" and P::\"'s expect\" and s::'s\n assume le: \"le_utrans t u\"\n and ut: \"\\P. unitary P \\ unitary (t P)\"\n and uu: \"\\P. unitary P \\ unitary (u P)\"\n and uP: \"unitary P\"\n hence \"unitary (t P)\" \"unitary (u P)\" by(auto)\n with le uP have \"wlp body (t P) \\ wlp body (u P)\"\n by(auto intro:nearly_healthy_monoD[OF hwlp])\n hence \"wlp body (t P) s \\ wlp body (u P) s\" by(auto)\n thus \"\\G\\ s * wlp body (t P) s \\ \\G\\ s * wlp body (u P) s\"\n by(auto intro:mult_left_mono)\n qed\n\n from hwp have hX: \"\\t. healthy t \\ healthy (?X t)\"\n by(auto intro:healthy_intros)\n\n from hwlp have hY: \"\\t. nearly_healthy t \\ nearly_healthy (?Y t)\"\n by(auto intro!:healthy_intros)\n \n have PLimit: \"P (Sup_trans (fst ` ?M)) (Inf_utrans (snd ` ?M))\"\n by(auto intro:Limit)\n\n have feasible_lfp_loop:\n \"feasible (lfp_trans ?X)\"\n proof(intro feasibleI bounded_byI2 nnegI2,\n simp_all add:wp_Loop1[unfolded wp_eval] soundI2 hwp)\n fix P::\"'s expect\" and b::real\n assume bP: \"bounded_by b P\" and nP: \"nneg P\"\n hence sP: \"sound P\" by(auto)\n show \"lfp_exp (\\Q s. \\ G \\ s * wp body Q s + \\ \\ G \\ s * P s) \\ \\s. b\"\n proof(intro lfp_exp_lowerbound le_funI)\n fix s::'s\n from bP nP have nnb: \"0 \\ b\" by(auto)\n hence \"sound (\\s. b)\" \"bounded_by b (\\s. b)\" by(auto)\n with hwp have \"bounded_by b (wp body (\\s. b))\" by(auto)\n with bP have \"wp body (\\s. b) s \\ b\" \"P s \\ b\" by(auto)\n hence \"\\G\\ s * wp body (\\s. b) s + \\\\ G\\ s * P s \\ \\G\\ s * b + \\\\ G\\ s * b\"\n by(auto intro:add_mono mult_left_mono)\n thus \"\\G\\ s * wp body (\\s. b) s + \\\\ G\\ s * P s \\ b\"\n by(simp add:negate_embed algebra_simps)\n from nnb show \"sound (\\s. b)\" by(auto)\n qed\n from hwp sP show \"\\s. 0 \\ lfp_exp (\\Q s. \\ G \\ s * wp body Q s + \\ \\ G \\ s * P s)\"\n by(blast intro!:lfp_exp_greatest lfp_loop_fp)\n qed\n\n have unitary_gfp:\n \"\\P. unitary P \\ unitary (gfp_trans ?Y P)\"\n proof(intro unitaryI2 nnegI2 bounded_byI2,\n simp_all add:wlp_Loop1[unfolded wp_eval] hwlp)\n fix P::\"'s expect\"\n assume uP: \"unitary P\"\n show \"\\s. 0 \\ gfp_exp (\\Q s. \\ G \\ s * wlp body Q s + \\ \\ G \\ s * P s)\"\n proof(rule gfp_exp_upperbound[OF le_funI])\n fix s::\"'s\"\n from hwlp uP have \"0 \\ wlp body (\\s. 0) s\" \"0 \\ P s\" by(auto dest!:unitary_sound)\n thus \"0 \\ \\G\\ s * wlp body (\\s. 0) s + \\\\ G\\ s * P s\"\n by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n show \"unitary (\\s. 0)\" by(auto)\n qed\n show \"gfp_exp (\\Q s. \\ G \\ s * wlp body Q s + \\ \\ G \\ s * P s) \\ \\s. 1\"\n by(auto intro:gfp_exp_least)\n qed\n\n have fX:\n \"\\t. feasible t \\ feasible (?X t)\"\n proof(intro feasibleI nnegI bounded_byI, simp_all add:wp_eval)\n fix t::\"'s trans\" and Q::\"'s expect\" and b::real and s::'s\n assume ft: \"feasible t\" and bQ: \"bounded_by b Q\" and nQ: \"nneg Q\"\n hence \"nneg (t Q)\" \"bounded_by b (t Q)\" by(auto)\n moreover hence stQ: \"sound (t Q)\" by(auto)\n ultimately have \"wp body (t Q) s \\ b\" using hwp by(auto)\n moreover from bQ have \"Q s \\ b\" by(auto)\n ultimately have \"\\G\\ s * wp body (t Q) s + (1 - \\G\\ s) * Q s \\\n \\G\\ s * b + (1 - \\ G \\ s) * b\"\n by(auto intro:add_mono mult_left_mono)\n thus \"\\G\\ s * wp body (t Q) s + (1 - \\G\\ s) * Q s \\ b\"\n by(simp add:algebra_simps)\n\n from nQ stQ hwp have \"0 \\ wp body (t Q) s\" \"0 \\ Q s\" by(auto)\n thus \"0 \\ \\G\\ s * wp body (t Q) s + (1 - \\G\\ s) * Q s\"\n by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n qed\n\n have uY:\n \"\\t P. (\\P. unitary P \\ unitary (t P)) \\ unitary P \\ unitary (?Y t P)\"\n proof(intro unitaryI2 nnegI bounded_byI, simp_all add:wp_eval)\n fix t::\"'s trans\" and P::\"'s expect\" and s::'s\n assume ut: \"\\P. unitary P \\ unitary (t P)\"\n and uP: \"unitary P\"\n hence utP: \"unitary (t P)\" by(auto)\n with hwlp have ubtP: \"unitary (wlp body (t P))\" by(auto)\n with uP have \"0 \\ P s\" \"0 \\ wlp body (t P) s\" by(auto)\n thus \"0 \\ \\G\\ s * wlp body (t P) s + (1-\\G\\ s) * P s\"\n by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n\n from uP ubtP have \"P s \\ 1\" \"wlp body (t P) s \\ 1\" by(auto)\n hence \"\\G\\ s * wlp body (t P) s + (1-\\G\\ s) * P s \\ \\G\\ s * 1 + (1-\\G\\ s) * 1\"\n by(blast intro:add_mono mult_left_mono)\n also have \"... = 1\" by(simp add:algebra_simps)\n finally show \"\\G\\ s * wlp body (t P) s + (1-\\G\\ s) * P s \\ 1\" .\n qed\n\n have fw_lfp: \"le_trans (Sup_trans (fst ` ?M)) (lfp_trans ?X)\"\n using feasible_nnegD[OF feasible_lfp_loop]\n by(intro le_transI[OF Sup_trans_least2], blast+)\n hence \"le_trans (?X (Sup_trans (fst ` ?M))) (?X (lfp_trans ?X))\"\n by(auto intro:wp_loop_mono feasible_sound[OF fSup]\n feasible_sound[OF feasible_lfp_loop])\n also have \"equiv_trans ... (lfp_trans ?X)\"\n proof(rule iffD1[OF equiv_trans_comm, OF lfp_trans_unfold], iprover intro:wp_loop_mono)\n fix t::\"'s trans\" and P::\"'s expect\"\n assume st: \"\\Q. sound Q \\ sound (t Q)\"\n and sP: \"sound P\"\n show \"sound (?X t P)\"\n proof(intro soundI2 bounded_byI nnegI, simp_all add:wp_eval)\n fix s::'s\n from sP st hwp have \"0 \\ P s\" \"0 \\ wp body (t P) s\" by(auto)\n thus \"0 \\ \\G\\ s * wp body (t P) s + (1 - \\G\\ s) * P s\"\n by(blast intro:add_nonneg_nonneg mult_nonneg_nonneg)\n from sP st have \"bounded_by (bound_of (t P)) (t P)\" by(auto)\n with sP st hwp have \"bounded_by (bound_of (t P)) (wp body (t P))\" by(auto)\n hence \"wp body (t P) s \\ bound_of (t P)\" by(auto)\n moreover from sP st hwp have \"P s \\ bound_of P\" by(auto)\n moreover have \"\\G\\ s \\ 1\" \"1 - \\G\\ s \\ 1\" by(auto)\n moreover from sP st hwp have \"0 \\ wp body (t P) s\" \"0 \\ P s\" by(auto)\n moreover have \"(0::real) \\ 1\" by(simp)\n ultimately show \"\\G\\ s * wp body (t P) s + (1 - \\G\\ s) * P s \\\n 1 * bound_of (t P) + 1 * bound_of P\"\n by(blast intro:add_mono mult_mono)\n qed\n next\n let \"?fp\" = \"\\R s. bound_of R\"\n show \"le_trans (?X ?fp) ?fp\" by(auto intro:healthy_intros hwp)\n fix P::\"'s expect\" assume \"sound P\"\n thus \"sound (?fp P)\" by(auto)\n qed\n finally have le_lfp: \"le_trans (?X (Sup_trans (fst ` ?M))) (lfp_trans ?X)\" .\n\n have fw_gfp: \"le_utrans (gfp_trans ?Y) (Inf_utrans (snd ` ?M))\"\n by(auto intro:Inf_utrans_greatest unitary_gfp)\n\n have \"equiv_utrans (gfp_trans ?Y) (?Y (gfp_trans ?Y))\"\n by(auto intro!:gfp_trans_unfold wlp_loop_mono uY)\n also from fw_gfp have \"le_utrans (?Y (gfp_trans ?Y)) (?Y (Inf_utrans (snd ` ?M)))\"\n by(auto intro:wlp_loop_mono uInf unitary_gfp)\n finally have ge_gfp: \"le_utrans (gfp_trans ?Y) (?Y (Inf_utrans (snd ` ?M)))\" .\n from PLimit fX uY fSup uInf have \"P (?X (Sup_trans (fst ` ?M))) (?Y (Inf_utrans (snd ` ?M)))\"\n by(iprover intro:IH)\n moreover from fSup have \"feasible (?X (Sup_trans (fst ` ?M)))\" by(rule fX)\n moreover have \"\\P. unitary P \\ unitary (?Y (Inf_utrans (snd ` ?M)) P)\"\n by(auto intro:uY uInf)\n moreover note le_lfp ge_gfp\n ultimately have pair_in: \"(?X (Sup_trans (fst ` ?M)), ?Y (Inf_utrans (snd ` ?M))) \\ ?M\"\n by(simp)\n\n have \"?X (Sup_trans (fst ` ?M)) \\ fst ` ?M\"\n by(rule imageI[OF pair_in, of fst, simplified])\n hence \"le_trans (?X (Sup_trans (fst ` ?M))) (Sup_trans (fst ` ?M))\"\n proof(rule le_transI[OF Sup_trans_upper2[where t=\"?X (Sup_trans (fst ` ?M))\"\n and S=\"fst ` ?M\"]])\n fix P::\"'s expect\"\n assume sP: \"sound P\"\n thus \"nneg P\" by(auto)\n from sP show \"bounded_by (bound_of P) P\" by(auto)\n from sP show \"\\u\\fst ` ?M. \\Q. nneg Q \\ bounded_by (bound_of P) Q \\\n nneg (u Q) \\ bounded_by (bound_of P) (u Q)\"\n by(auto)\n qed\n hence \"le_trans (lfp_trans ?X) (Sup_trans (fst ` ?M))\"\n by(auto intro:lfp_trans_lowerbound feasible_sound[OF fSup])\n with fw_lfp have eqt: \"equiv_trans (Sup_trans (fst ` ?M)) (lfp_trans ?X)\"\n by(rule le_trans_antisym)\n\n have \"?Y (Inf_utrans (snd ` ?M)) \\ snd ` ?M\"\n by(rule imageI[OF pair_in, of snd, simplified])\n hence \"le_utrans (Inf_utrans (snd ` ?M)) (?Y (Inf_utrans (snd ` ?M)))\"\n by(intro Inf_utrans_lower, auto)\n hence \"le_utrans (Inf_utrans (snd ` ?M)) (gfp_trans ?Y)\"\n by(blast intro:gfp_trans_upperbound uInf)\n with fw_gfp have equ: \"equiv_utrans (Inf_utrans (snd ` ?M)) (gfp_trans ?Y)\"\n by(auto intro:le_utrans_antisym)\n from PLimit eqt equ show \"P (lfp_trans ?X) (gfp_trans ?Y)\" by(rule P_equiv)\nqed\n\nsubsection {* The Limit of Iterates *}\n\ntext {* The iterates of a loop are its sequence of finite unrollings. We show shortly that this\nconverges on the least fixed point. This is enormously useful, as we can appeal to various\nproperties of the finite iterates (which will follow by finite induction), which we can then\ntransfer to the limit. *}\ndefinition iterates :: \"'s prog \\ ('s \\ bool) \\ nat \\ 's trans\"\nwhere \"iterates body G i = ((\\x. wp (body ;; Embed x \\<^bsub>\\ G \\\\<^esub>\\ Skip)) ^^ i) (\\P s. 0)\"\n\nlemma iterates_0[simp]:\n \"iterates body G 0 = (\\P s. 0)\"\n by(simp add:iterates_def)\n\nlemma iterates_Suc[simp]:\n \"iterates body G (Suc i) = wp (body ;; Embed (iterates body G i) \\<^bsub>\\G\\\\<^esub>\\ Skip)\"\n by(simp add:iterates_def)\n\ntext {* All iterates are healthy. *}\nlemma iterates_healthy:\n \"healthy (wp body) \\ healthy (iterates body G i)\"\n by(induct i, auto intro:healthy_intros)\n\ntext {* The iterates are an ascending chain. *}\nlemma iterates_increasing:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n shows \"le_trans (iterates body G i) (iterates body G (Suc i))\"\nproof(induct i)\n show \"le_trans (iterates body G 0) (iterates body G (Suc 0))\"\n proof(simp add:iterates_def, rule le_transI)\n fix P::\"'s expect\"\n assume \"sound P\"\n with hb have \"sound (wp (body ;; Embed (\\P s. 0) \\<^bsub>\\ G \\\\<^esub>\\ Skip) P)\"\n by(auto intro!:wp_loop_step_sound)\n thus \"\\s. 0 \\ wp (body ;; Embed (\\P s. 0) \\<^bsub>\\ G \\\\<^esub>\\ Skip) P\"\n by(auto)\n qed\n\n fix i\n assume IH: \"le_trans (iterates body G i) (iterates body G (Suc i))\"\n have \"equiv_trans (iterates body G (Suc i))\n (wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip))\"\n by(simp)\n also from iterates_healthy[OF hb]\n have \"le_trans ... (wp (body ;; Embed (iterates body G (Suc i)) \\<^bsub>\\ G \\\\<^esub>\\ Skip))\"\n by(blast intro:wp_loop_step_mono[OF hb IH])\n also have \"equiv_trans ... (iterates body G (Suc (Suc i)))\"\n by(simp)\n finally show \"le_trans (iterates body G (Suc i)) (iterates body G (Suc (Suc i)))\" .\nqed\n\nlemma wp_loop_step_bounded:\n fixes t::\"'s trans\" and Q::\"'s expect\"\n assumes nQ: \"nneg Q\"\n and bQ: \"bounded_by b Q\"\n and ht: \"healthy t\"\n and hb: \"healthy (wp body)\"\n shows \"bounded_by b (wp (body ;; Embed t \\<^bsub>\\ G \\\\<^esub>\\ Skip) Q)\"\nproof(rule bounded_byI, simp add:wp_eval)\n fix s::'s\n from nQ bQ have sQ: \"sound Q\" by(auto)\n with bQ ht have \"sound (t Q)\" \"bounded_by b (t Q)\" by(auto)\n with hb have \"bounded_by b (wp body (t Q))\" by(auto)\n with bQ have \"wp body (t Q) s \\ b\" \"Q s \\ b\" by(auto)\n hence \"\\G\\ s * wp body (t Q) s + (1-\\G\\ s) * Q s \\\n \\G\\ s * b + (1-\\G\\ s) * b\"\n by(auto intro:add_mono mult_left_mono)\n also have \"... = b\" by(simp add:algebra_simps)\n finally show \"\\G\\ s * wp body (t Q) s + (1-\\G\\ s) * Q s \\ b\" .\nqed\n\ntext {* This is the key result: The loop is equivalent to the supremum of its iterates. This\nproof follows the pattern of lemma continuous\\_lfp in HOL/Library/Continuity. *}\nlemma lfp_iterates:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and cb: \"bd_cts (wp body)\"\n shows \"equiv_trans (wp (do G \\ body od)) (Sup_trans (range (iterates body G)))\"\n (is \"equiv_trans ?X ?Y\")\nproof(rule le_trans_antisym)\n let ?F = \"\\x. wp (body ;; Embed x \\<^bsub>\\ G \\\\<^esub>\\ Skip)\"\n let ?bot = \"\\(P::'s \\ real) s::'s. 0::real\"\n\n have HF: \"\\i. healthy ((?F ^^ i) ?bot)\"\n proof -\n fix i from hb show \"(?thesis i)\"\n by(induct i, simp_all add:healthy_intros)\n qed\n\n from iterates_healthy[OF hb]\n have \"\\i. feasible (iterates body G i)\" by(auto)\n hence fSup: \"feasible (Sup_trans (range (iterates body G)))\"\n by(auto intro:feasible_Sup_trans)\n\n {\n fix i\n have \"le_trans ((?F ^^ i) ?bot) ?X\"\n proof(induct i)\n show \"le_trans ((?F ^^ 0) ?bot) ?X\"\n proof(simp, intro le_transI)\n fix P::\"'s expect\"\n assume \"sound P\"\n with hb healthy_wp_loop\n have \"sound (wp (\\ x. body ;; x \\<^bsub>\\ G \\\\<^esub>\\ Skip) P)\"\n by(auto)\n thus \"\\s. 0 \\ wp (\\ x. body ;; x \\<^bsub>\\ G \\\\<^esub>\\ Skip) P\"\n by(auto)\n qed\n fix i\n assume IH: \"le_trans ((?F ^^ i) ?bot) ?X\"\n have \"equiv_trans ((?F ^^ (Suc i)) ?bot) (?F ((?F ^^ i) ?bot))\" by(simp)\n also have \"le_trans ... (?F ?X)\"\n proof(rule wp_loop_step_mono[OF hb IH])\n fix P::\"'s expect\"\n assume sP: \"sound P\"\n with hb healthy_wp_loop\n show \"sound (wp (\\ x. body ;; x \\<^bsub>\\ G \\\\<^esub>\\ Skip) P)\"\n by(auto)\n from sP show \"sound ((?F ^^ i) ?bot P)\"\n by(rule healthy_sound[OF HF])\n qed\n also {\n from hb have X: \"le_trans (wp (body ;; Embed (\\P s. bound_of P) \\<^bsub>\\ G \\\\<^esub>\\ Skip))\n (\\P s. bound_of P)\"\n by(intro le_transI, simp add:wp_eval, auto intro: lfp_loop_fp[unfolded negate_embed])\n have \"equiv_trans (?F ?X) ?X\"\n unfolding wp_eval\n by(intro iffD1[OF equiv_trans_comm, OF lfp_trans_unfold]\n wp_loop_step_mono[OF hb] wp_loop_step_sound[OF hb], (blast|rule X)+)\n }\n finally show \"le_trans ((?F ^^ (Suc i)) ?bot) ?X\" .\n qed\n }\n hence \"\\i. le_trans (iterates body G i) (wp do G \\ body od)\"\n by(simp add:iterates_def)\n thus \"le_trans ?Y ?X\"\n by(auto intro!:le_transI[OF Sup_trans_least2] sound_nneg\n healthy_sound[OF iterates_healthy, OF hb]\n healthy_bounded_byD[OF iterates_healthy, OF hb]\n healthy_sound[OF healthy_wp_loop] hb)\n\n show \"le_trans ?X ?Y\"\n unfolding wp_eval\n proof(rule lfp_trans_lowerbound)\n from hb cb have \"bd_cts_tr ?F\" by(rule cts_wp_loopstep)\n with iterates_increasing[OF hb] iterates_healthy[OF hb]\n have \"equiv_trans (?F ?Y) (Sup_trans (range (?F o (iterates body G))))\"\n by(auto intro!:healthy_feasibleD bd_cts_trD)\n also have \"le_trans (Sup_trans (range (?F o (iterates body G)))) ?Y\"\n proof(rule le_transI)\n fix P::\"'s expect\"\n assume sP: \"sound P\"\n show \"(Sup_trans (range (?F o (iterates body G)))) P \\ ?Y P\"\n proof(rule Sup_trans_least2, clarsimp)\n show \"\\u\\range ((\\x. wp (body ;; Embed x \\<^bsub>\\ G \\\\<^esub>\\ Skip)) \\ iterates body G).\n \\R. nneg R \\ bounded_by (bound_of P) R \\\n nneg (u R) \\ bounded_by (bound_of P) (u R)\"\n proof(clarsimp, intro conjI)\n fix Q::\"'s expect\" and i\n assume nQ: \"nneg Q\" and bQ: \"bounded_by (bound_of P) Q\"\n hence \"sound Q\" by(auto)\n moreover from iterates_healthy[OF hb]\n have \"\\P. sound P \\ sound (iterates body G i P)\" by(auto)\n moreover note hb\n ultimately have \"sound (wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) Q)\"\n by(iprover intro:wp_loop_step_sound)\n thus \"nneg (wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) Q)\"\n by(auto)\n from nQ bQ iterates_healthy[OF hb] hb\n show \"bounded_by (bound_of P) (wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) Q)\"\n by(rule wp_loop_step_bounded)\n qed\n from sP show \"nneg P\" \"bounded_by (bound_of P) P\" by(auto)\n next\n fix Q::\"'s expect\"\n assume nQ: \"nneg Q\" and bQ: \"bounded_by (bound_of P) Q\"\n hence \"sound Q\" by(auto)\n with fSup have \"sound (Sup_trans (range (iterates body G)) Q)\" by(auto)\n thus \"nneg (Sup_trans (range (iterates body G)) Q)\" by(auto)\n\n fix i\n show \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) Q \\\n Sup_trans (range (iterates body G)) Q\"\n proof(rule Sup_trans_upper2[OF _ _ nQ bQ])\n from iterates_healthy[OF hb]\n show \"\\u\\range (iterates body G).\n \\R. nneg R \\ bounded_by (bound_of P) R \\\n nneg (u R) \\ bounded_by (bound_of P) (u R)\"\n by(auto)\n have \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) = iterates body G (Suc i)\"\n by(simp)\n also have \"... \\ range (iterates body G)\"\n by(blast)\n finally show \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip) \\\n range (iterates body G)\" .\n qed\n qed\n qed\n finally show \"le_trans (?F ?Y) ?Y\" .\n\n fix P::\"'s expect\"\n assume \"sound P\"\n with fSup show \"sound (?Y P)\" by(auto)\n qed\nqed\n\ntext {* Therefore, evaluated at a given point (state), the sequence of iterates gives a sequence\nof real values that converges on that of the loop itself. *}\ncorollary loop_iterates:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and cb: \"bd_cts (wp body)\"\n and sP: \"sound P\"\n shows \"(\\i. iterates body G i P s) ----> wp (do G \\ body od) P s\"\nproof -\n let ?X = \"{f s |f. f \\ {t P |t. t \\ range (iterates body G)}}\"\n have closure_Sup: \"Sup ?X \\ closure ?X\"\n proof(rule closure_contains_Sup, simp, clarsimp)\n fix i\n from sP have \"bounded_by (bound_of P) P\" by(auto)\n with iterates_healthy[OF hb] sP have \"\\j. bounded_by (bound_of P) (iterates body G j P)\"\n by(auto)\n thus \"iterates body G i P s \\ bound_of P\" by(auto) \n qed\n\n have \"(\\i. iterates body G i P s) ----> Sup {f s |f. f \\ {t P |t. t \\ range (iterates body G)}}\"\n proof(rule LIMSEQ_I)\n fix r::real assume posr: \"0 < r\"\n with closure_Sup obtain y where yin: \"y \\ ?X\" and ey: \"dist y (Sup ?X) < r\"\n by(simp only:closure_approachable, blast)\n from yin obtain i where yit: \"y = iterates body G i P s\" by(auto)\n {\n fix j\n have \"i \\ j \\ le_trans (iterates body G i) (iterates body G j)\"\n proof(induct j, simp, clarify)\n fix k\n assume IH: \"i \\ k \\ le_trans (iterates body G i) (iterates body G k)\"\n and le: \"i \\ Suc k\"\n show \"le_trans (iterates body G i) (iterates body G (Suc k))\"\n proof(cases \"i = Suc k\", simp)\n assume \"i \\ Suc k\"\n with le have \"i \\ k\" by(auto)\n with IH have \"le_trans (iterates body G i) (iterates body G k)\" by(auto)\n also note iterates_increasing[OF hb]\n finally show \"le_trans (iterates body G i) (iterates body G (Suc k))\" .\n qed\n qed\n }\n with sP have \"\\j\\i. iterates body G i P s \\ iterates body G j P s\"\n by(auto)\n moreover {\n from sP have \"bounded_by (bound_of P) P\" by(auto)\n with iterates_healthy[OF hb] sP have \"\\j. bounded_by (bound_of P) (iterates body G j P)\"\n by(auto)\n hence \"\\j. iterates body G j P s \\ bound_of P\" by(auto)\n hence \"\\j. iterates body G j P s \\ Sup ?X\"\n by(intro cSup_upper bdd_aboveI, auto)\n }\n ultimately have \"\\j. i \\ j \\\n norm (iterates body G j P s - Sup ?X) \\\n norm (iterates body G i P s - Sup ?X)\"\n by(auto)\n also from ey yit have \"norm (iterates body G i P s - Sup ?X) < r\"\n by(simp add:dist_real_def)\n finally show \"\\no. \\n\\no. norm (iterates body G n P s -\n Sup {f s |f. f \\ {t P |t. t \\ range (iterates body G)}}) < r\"\n by(auto)\n qed\n moreover\n from hb cb sP have \"wp do G \\ body od P s = Sup_trans (range (iterates body G)) P s\"\n by(simp add:equiv_transD[OF lfp_iterates])\n moreover have \"... = Sup {f s |f. f \\ {t P |t. t \\ range (iterates body G)}}\"\n by(simp add:Sup_trans_def Sup_exp_def)\n ultimately show ?thesis by(simp)\nqed\n\ntext {* The iterates themselves are all continuous. *}\nlemma cts_iterates:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and cb: \"bd_cts (wp body)\"\n shows \"bd_cts (iterates body G i)\"\nproof(induct i, simp_all)\n have \"range (\\(n::nat) (s::'s). 0::real) = {\\s. 0::real}\"\n by(auto)\n thus \"bd_cts (\\P (s::'s). 0)\"\n by(intro bd_ctsI, simp add:o_def Sup_exp_def)\nnext\n fix i\n assume IH: \"bd_cts (iterates body G i)\"\n thus \"bd_cts (wp (body ;; Embed (iterates body G i) \\<^bsub>\\ G \\\\<^esub>\\ Skip))\"\n by(blast intro:cts_wp_PC cts_wp_Seq cts_wp_Embed cts_wp_Skip\n healthy_intros iterates_healthy cb hb)\nqed\n\ntext {* Therefore so is the loop itself. *}\nlemma cts_wp_loop:\n fixes body::\"'s prog\"\n assumes hb: \"healthy (wp body)\"\n and cb: \"bd_cts (wp body)\"\n shows \"bd_cts (wp do G \\ body od)\"\nproof(rule bd_ctsI)\n fix M::\"nat \\ 's expect\" and b::real\n assume chain: \"\\i. M i \\ M (Suc i)\"\n and sM: \"\\i. sound (M i)\"\n and bM: \"\\i. bounded_by b (M i)\"\n\n from sM bM iterates_healthy[OF hb]\n have \"\\j i. bounded_by b (iterates body G i (M j))\" by(blast)\n hence iB: \"\\j i s. iterates body G i (M j) s \\ b\" by(auto)\n\n from sM bM have sSup: \"sound (Sup_exp (range M))\"\n by(auto intro:Sup_exp_sound)\n with lfp_iterates[OF hb cb]\n have \"wp do G \\ body od (Sup_exp (range M)) =\n Sup_trans (range (iterates body G)) (Sup_exp (range M))\"\n by(simp add:equiv_transD)\n also {\n from chain sM bM\n have \"\\i. iterates body G i (Sup_exp (range M)) = Sup_exp (range (iterates body G i o M))\"\n by(blast intro:bd_ctsD cts_iterates[OF hb cb])\n hence \"{t (Sup_exp (range M)) |t. t \\ range (iterates body G)} =\n {Sup_exp (range (t o M)) |t. t \\ range (iterates body G)}\"\n by(auto intro:sym)\n hence \"Sup_trans (range (iterates body G)) (Sup_exp (range M)) =\n Sup_exp {Sup_exp (range (t \\ M)) |t. t \\ range (iterates body G)}\"\n by(simp add:Sup_trans_def)\n }\n also {\n have \"\\s. {f s |f. \\t. f = (\\s. Sup {f s |f. f \\ range (t \\ M)}) \\\n t \\ range (iterates body G)} =\n range (\\i. Sup (range (\\j. iterates body G i (M j) s)))\"\n (is \"\\s. ?X s = ?Y s\")\n proof(intro antisym subsetI)\n fix s x\n assume \"x \\ ?X s\"\n then obtain t where rwx: \"x = Sup {f s |f. f \\ range (t \\ M)}\"\n and \"t \\ range (iterates body G)\" by(auto)\n then obtain i where \"t = iterates body G i\" by(auto)\n with rwx have \"x = Sup {f s |f. f \\ range (\\j. iterates body G i (M j))}\"\n by(simp add:o_def)\n moreover have \"{f s |f. f \\ range (\\j. iterates body G i (M j))} =\n range (\\j. iterates body G i (M j) s)\" by(auto)\n ultimately have \"x = Sup (range (\\j. iterates body G i (M j) s))\"\n by(simp)\n thus \"x \\ range (\\i. Sup (range (\\j. iterates body G i (M j) s)))\"\n by(auto)\n next\n fix s x\n assume \"x \\ ?Y s\"\n then obtain i where A: \"x = Sup (range (\\j. iterates body G i (M j) s))\"\n by(auto)\n\n have \"\\s. {f s |f. f \\ range (\\j. iterates body G i (M j))} =\n range (\\j. iterates body G i (M j) s)\" by(auto)\n hence B: \"(\\s. Sup (range (\\j. iterates body G i (M j) s))) =\n (\\s. Sup {f s |f. f \\ range (iterates body G i o M)})\"\n by(simp add:o_def)\n\n have C: \"iterates body G i \\ range (iterates body G)\" by(auto)\n\n have \"\\f. x = f s \\\n (\\t. f = (\\s. Sup {f s |f. f \\ range (t \\ M)}) \\\n t \\ range (iterates body G))\"\n by(iprover intro:A B C)\n thus \"x \\ ?X s\" by(simp)\n qed\n hence \"Sup_exp {Sup_exp (range (t \\ M)) |t. t \\ range (iterates body G)} = \n (\\s. Sup (range (\\i. Sup (range (\\j. iterates body G i (M j) s)))))\"\n by(simp add:Sup_exp_def)\n }\n also have \"(\\s. Sup (range (\\i. Sup (range (\\j. iterates body G i (M j) s))))) =\n (\\s. Sup (range (\\(i,j). iterates body G i (M j) s)))\"\n (is \"?X = ?Y\")\n proof(rule ext, rule antisym)\n fix s::'s\n show \"?Y s \\ ?X s\"\n proof(rule cSup_least, blast, clarify)\n fix i j::nat\n from iB have \"iterates body G i (M j) s \\ Sup (range (\\j. iterates body G i (M j) s))\"\n by(intro cSup_upper bdd_aboveI, auto)\n also from iB have \"... \\ Sup (range (\\i. Sup (range (\\j. iterates body G i (M j) s))))\"\n by(intro cSup_upper cSup_least bdd_aboveI, (blast intro:cSup_least)+)\n finally show \"iterates body G i (M j) s \\\n Sup (range (\\i. Sup (range (\\j. iterates body G i (M j) s))))\" .\n qed\n have \"\\i j. iterates body G i (M j) s \\\n Sup (range (\\(i, j). iterates body G i (M j) s))\"\n by(rule cSup_upper, auto intro:iB)\n thus \"?X s \\ ?Y s\"\n by(intro cSup_least, blast, clarify, simp del:Sup_image_eq, blast intro:cSup_least)\n qed\n also have \"... = (\\s. Sup (range (\\j .Sup (range (\\i. iterates body G i (M j) s)))))\"\n (is \"?X = ?Y\")\n proof(rule ext, rule antisym)\n fix s::'s\n have \"\\i j. iterates body G i (M j) s \\\n Sup (range (\\(i, j). iterates body G i (M j) s))\"\n by(rule cSup_upper, auto intro:iB)\n thus \"?Y s \\ ?X s\"\n by(intro cSup_least, blast, clarify, simp del:Sup_image_eq, blast intro:cSup_least)\n show \"?X s \\ ?Y s\"\n proof(rule cSup_least, blast, clarify)\n fix i j::nat\n from iB have \"iterates body G i (M j) s \\ Sup (range (\\i. iterates body G i (M j) s))\"\n by(intro cSup_upper bdd_aboveI, auto)\n also from iB have \"... \\ Sup (range (\\j. Sup (range (\\i. iterates body G i (M j) s))))\"\n by(intro cSup_upper cSup_least bdd_aboveI, blast, blast intro:cSup_least)\n finally show \"iterates body G i (M j) s \\\n Sup (range (\\j. Sup (range (\\i. iterates body G i (M j) s))))\" .\n qed\n qed\n also {\n have \"\\s. range (\\j. Sup (range (\\i. iterates body G i (M j) s))) =\n {f s |f. f \\ range ((\\P s. Sup {f s |f. \\t. f = t P \\\n t \\ range (iterates body G)}) \\ M)}\" (is \"\\s. ?X s = ?Y s\")\n proof(intro antisym subsetI)\n fix s x\n assume \"x \\ ?X s\"\n then obtain j where rwx: \"x = Sup (range (\\i. iterates body G i (M j) s))\" by(auto)\n moreover {\n have \"\\s. range (\\i. iterates body G i (M j) s) =\n {f s |f. \\t. f = t (M j) \\ t \\ range (iterates body G)}\"\n by(auto)\n hence \"(\\s. Sup (range (\\i. iterates body G i (M j) s))) \\\n range ((\\P s. Sup {f s |f.\n \\t. f = t P \\ t \\ range (iterates body G)}) \\ M)\"\n by(simp add:o_def)\n }\n ultimately show \"x \\ ?Y s\" by(auto)\n next\n fix s x\n assume \"x \\ ?Y s\"\n then obtain P where rwx: \"x = P s\"\n and Pin: \"P \\ range ((\\P s. Sup {f s |f.\n \\t. f = t P \\ t \\ range (iterates body G)}) \\ M)\"\n by(auto)\n then obtain j where \"P = (\\s. Sup {f s |f. \\t. f = t (M j) \\\n t \\ range (iterates body G)})\"\n by(auto)\n also {\n have \"\\s. {f s |f. \\t. f = t (M j) \\ t \\ range (iterates body G)} =\n range (\\i. iterates body G i (M j) s)\" by(auto)\n hence \"(\\s. Sup {f s |f. \\t. f = t (M j) \\ t \\ range (iterates body G)}) =\n (\\s. Sup (range (\\i. iterates body G i (M j) s)))\"\n by(simp)\n }\n finally have \"x = Sup (range (\\i. iterates body G i (M j) s))\"\n by(simp add:rwx)\n thus \"x \\ ?X s\" by(simp)\n qed\n hence \"(\\s. Sup (range (\\j .Sup (range (\\i. iterates body G i (M j) s))))) =\n Sup_exp (range (Sup_trans (range (iterates body G)) o M))\"\n by(simp add:Sup_exp_def Sup_trans_def)\n }\n also have \"Sup_exp (range (Sup_trans (range (iterates body G)) o M)) =\n Sup_exp (range (wp do G \\ body od o M))\"\n by(simp add:o_def equiv_transD[OF lfp_iterates, OF hb cb, OF sM])\n finally show \"wp do G \\ body od (Sup_exp (range M)) =\n Sup_exp (range (wp do G \\ body od o M))\" .\nqed\n\nlemmas cts_intros =\n cts_wp_Abort cts_wp_Skip\n cts_wp_Seq cts_wp_PC\n cts_wp_DC cts_wp_Embed\n cts_wp_Apply cts_wp_SetDC\n cts_wp_SetPC cts_wp_Bind\n cts_wp_repeat\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/pGCL/LoopInduction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2571033784876165}} {"text": "(* Title: HOL/Auth/Guard/Guard_Shared.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\lemmas on guarded messages for protocols with symmetric keys\\\n\ntheory Guard_Shared imports Guard GuardK \"../Shared\" begin\n\nsubsection\\Extensions to Theory \\Shared\\\\\n\ndeclare initState.simps [simp del]\n\nsubsubsection\\a little abbreviation\\\n\nabbreviation\n Ciph :: \"agent => msg => msg\" where\n \"Ciph A X == Crypt (shrK A) X\"\n\nsubsubsection\\agent associated to a key\\\n\ndefinition agt :: \"key => agent\" where\n\"agt K == SOME A. K = shrK A\"\n\nlemma agt_shrK [simp]: \"agt (shrK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection\\basic facts about \\<^term>\\initState\\\\\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X \\ parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X \\ analz (initState A)\"\nby auto\n\nlemma no_shrK_in_analz_init [simp]: \"A \\ bad\n\\ Key (shrK A) \\ analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma shrK_notin_initState_Friend [simp]: \"A \\ Friend C\n\\ Key (shrK A) \\ parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection\\sets of symmetric keys\\\n\ndefinition shrK_set :: \"key set => bool\" where\n\"shrK_set Ks \\ \\K. K \\ Ks \\ (\\A. K = shrK A)\"\n\nlemma in_shrK_set: \"\\shrK_set Ks; K \\ Ks\\ \\ \\A. K = shrK A\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set1 [iff]: \"shrK_set {shrK A}\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set2 [iff]: \"shrK_set {shrK A, shrK B}\"\nby (simp add: shrK_set_def)\n\nsubsubsection\\sets of good keys\\\n\ndefinition good :: \"key set \\ bool\" where\n\"good Ks \\ \\K. K \\ Ks \\ agt K \\ bad\"\n\nlemma in_good: \"\\good Ks; K \\ Ks\\ \\ agt K \\ bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A \\ bad \\ good {shrK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"\\A \\ bad; B \\ bad\\ \\ good {shrK A, shrK B}\"\nby (simp add: good_def)\n\n\nsubsection\\Proofs About Guarded Messages\\\n\nsubsubsection\\small hack\\\n\nlemma shrK_is_invKey_shrK: \"shrK A = invKey (shrK A)\"\nby simp\n\nlemmas shrK_is_invKey_shrK_substI = shrK_is_invKey_shrK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n \\ parts {X} \\ Crypt (shrK A) X \\ guard n {shrK A}\"\napply (rule shrK_is_invKey_shrK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection\\guardedness results on nonces\\\n\nlemma guard_ciph [simp]: \"shrK A \\ Ks \\ Ciph A X \\ guard n Ks\"\nby (rule Guard_Nonce, simp)\n\nlemma guardK_ciph [simp]: \"shrK A \\ Ks \\ Ciph A X \\ guardK n Ks\"\nby (rule Guard_Key, simp)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n\\ Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n \\ used evs\n\\ Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"\\evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p\\ \\ Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"\\evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p\\ \\ Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"\\evs \\ p; Nonce n \\ used evs;\nGets_correct p; one_step p\\ \\ Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\guardedness results on keys\\\n\nlemma GuardK_init [simp]: \"n \\ range shrK \\ GuardK n Ks (initState B)\"\nby (induct B, auto simp: GuardK_def initState.simps)\n\nlemma GuardK_knows_max': \"\\GuardK n A (knows_max' C evs); n \\ range shrK\\\n\\ GuardK n A (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Key_not_used_GuardK_spies [dest]: \"Key n \\ used evs\n\\ GuardK n A (spies evs)\"\nby (auto simp: GuardK_def dest: not_used_not_known parts_sub)\n\nlemma Key_not_used_GuardK [dest]: \"\\evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p\\ \\ GuardK n A (knows (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_used parts_trans)\n\nlemma Key_not_used_GuardK_max [dest]: \"\\evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p\\ \\ GuardK n A (knows_max (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_max_used parts_trans)\n\nlemma Key_not_used_GuardK_max' [dest]: \"\\evs \\ p; Key n \\ used evs;\nGets_correct p; one_step p\\ \\ GuardK n A (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in GuardK_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\regular protocols\\\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p \\ \\evs A. evs \\ p \\ (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\n\nlemma shrK_parts_iff_bad [simp]: \"\\evs \\ p; regular p\\ \\\n(Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\nby (auto simp: regular_def)\n\nlemma shrK_analz_iff_bad [simp]: \"\\evs \\ p; regular p\\ \\\n(Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"\\Guard n Ks (spies evs); evs \\ p;\nshrK_set Ks; good Ks; regular p\\ \\ Nonce n \\ analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_shrK_set, simp+, clarify)\napply (frule_tac A=A in shrK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nlemma GuardK_Key_analz:\n assumes \"GuardK n Ks (spies evs)\" \"evs \\ p\" \"shrK_set Ks\"\n \"good Ks\" \"regular p\" \"n \\ range shrK\"\n shows \"Key n \\ analz (spies evs)\"\nproof (rule ccontr)\n assume \"\\ Key n \\ analz (knows Spy evs)\"\n then have *: \"Key n \\ analz (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp)\n from \\GuardK n Ks (spies evs)\\\n have \"GuardK n Ks (spies' evs \\ initState Spy)\"\n by (simp add: knows_decomp) \n then have \"GuardK n Ks (spies' evs)\"\n and \"finite (spies' evs)\" \"keyset (initState Spy)\"\n by simp_all\n moreover have \"Key n \\ initState Spy\"\n using \\n \\ range shrK\\ by (simp add: image_iff initState_Spy)\n ultimately obtain K\n where \"K \\ Ks\" and **: \"Key K \\ analz (spies' evs \\ initState Spy)\"\n using * by (auto dest: GuardK_invKey_keyset)\n from \\K \\ Ks\\ and \\good Ks\\ have \"agt K \\ bad\"\n by (auto dest: in_good)\n from \\K \\ Ks\\ \\shrK_set Ks\\ obtain A\n where \"K = shrK A\"\n by (auto dest: in_shrK_set)\n then have \"agt K \\ bad\"\n using ** \\evs \\ p\\ \\regular p\\ shrK_analz_iff_bad [of evs p \"agt K\"]\n by (simp add: knows_decomp)\n with \\agt K \\ bad\\ show False by simp\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/Guard_Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2569915265990344}} {"text": "subsection \\1-out-of-4 OT to GMW\\\n\ntext\\We prove security for the gates of the GMW protocol in the semi honest model. We assume security on\n1-out-of-4 OT.\\\n\ntheory GMW imports\n OT14\nbegin\n\ntype_synonym share_1 = bool \ntype_synonym share_2 = bool\n\ntype_synonym shares_1 = \"bool list\"\ntype_synonym shares_2 = \"bool list\"\n\ntype_synonym msgs_14_OT = \"(bool \\ bool \\ bool \\ bool)\"\ntype_synonym choice_14_OT = \"(bool \\ bool)\"\n\ntype_synonym share_wire = \"(share_1 \\ share_2)\"\n\nlocale gmw_base =\n fixes S1_14_OT :: \"msgs_14_OT \\ unit \\ 'v_14_OT1 spmf\" \\ \\simulated view for party 1 of OT14\\\n and R1_14_OT :: \"msgs_14_OT \\ choice_14_OT \\ 'v_14_OT1 spmf\" \\ \\real view for party 1 of OT14\\\n and S2_14_OT :: \"choice_14_OT \\ bool \\ 'v_14_OT2 spmf\" \n and R2_14_OT :: \"msgs_14_OT \\ choice_14_OT \\ 'v_14_OT2 spmf\"\n and protocol_14_OT :: \"msgs_14_OT \\ choice_14_OT \\ (unit \\ bool) spmf\"\n and adv_14_OT :: real\n assumes P1_OT_14_adv_bound: \"sim_det_def.adv_P1 R1_14_OT S1_14_OT funct_14_OT M C D \\ adv_14_OT\" \\ \\bound the advantage of party 1 in the 1-out-of-4 OT\\\n and P2_OT_12_inf_theoretic: \"sim_det_def.perfect_sec_P2 R2_14_OT S2_14_OT funct_14_OT M C\" \\ \\information theoretic security for party 2 in the 1-out-of-4 OT\\\n and correct_14: \"funct_OT_14 msgs C = protocol_14_OT msgs C\" \\ \\correctness of the 1-out-of-4 OT\\\n and lossless_R1_14_OT: \"lossless_spmf (R1_14_OT (m1,m2,m3,m4) (c0,c1))\"\n and lossless_R2_14_OT: \"lossless_spmf (R2_14_OT (m1,m2,m3,m4) (c0,c1))\"\n and lossless_S1_14_OT: \"lossless_spmf (S1_14_OT (m1,m2,m3,m4) ())\"\n and lossless_S2_14_OT: \"lossless_spmf (S2_14_OT (c0,c1) b)\"\n and lossless_protocol_14_OT: \"lossless_spmf (protocol_14_OT S C)\" \n and lossless_funct_14_OT: \"lossless_spmf (funct_14_OT M C)\"\nbegin\n\nlemma funct_14: \"funct_OT_14 (m00,m01,m10,m11) (c0,c1) \n = return_spmf ((),if c0 then (if c1 then m11 else m10) else (if c1 then m01 else m00))\"\n by(simp add: funct_OT_14_def)\n\nsublocale OT_14_sim: sim_det_def R1_14_OT S1_14_OT R2_14_OT S2_14_OT funct_14_OT protocol_14_OT\n unfolding sim_det_def_def \n by(simp add: lossless_R1_14_OT lossless_S1_14_OT lossless_funct_14_OT lossless_R2_14_OT lossless_S2_14_OT)\n\nlemma inf_th_14_OT_P4: \"R2_14_OT msgs C = (funct_OT_14 msgs C \\ (\\ (s1, s2). S2_14_OT C s2))\" \n using P2_OT_12_inf_theoretic sim_det_def.perfect_sec_P2_def OT_14_sim.perfect_sec_P2_def by auto\n\nlemma ass_adv_14_OT: \"\\spmf (bind_spmf (S1_14_OT msgs ()) (\\ view. (D view))) True - \n spmf (bind_spmf (R1_14_OT msgs (c0,c1)) (\\ view. (D view))) True \\ \\ adv_14_OT\"\n (is \"?lhs \\ adv_14_OT\")\nproof-\n have \"funct_OT_14 (m0,m1,m2,m3) (c0, c1) \\ (\\(o1, o2). S1_14_OT (m0,m1,m2,m3) () \\ D) = S1_14_OT (m0,m1,m2,m3) () \\ D\" \n for m0 m1 m2 m3 by(simp add: funct_14)\n hence funct: \"funct_OT_14 msgs (c0, c1) \\ (\\(o1, o2). S1_14_OT msgs () \\ D) = S1_14_OT msgs () \\ D\" \n by (metis prod_cases4)\n have \"?lhs = \\spmf (bind_spmf (R1_14_OT msgs (c0,c1)) (\\ view. (D view))) True \n - spmf (bind_spmf (S1_14_OT msgs ()) (\\ view. (D view))) True\\\"\n by linarith\n hence \"... = \\(spmf (R1_14_OT msgs (c0,c1) \\ (\\ view. D view)) True) \n - spmf (funct_OT_14 msgs (c0,c1) \\ (\\ (o1, o2). S1_14_OT msgs o1 \\ (\\ view. D view))) True\\\" \n by(simp add: funct)\n thus ?thesis using P1_OT_14_adv_bound sim_det_def.adv_P1_def \n by (simp add: OT_14_sim.adv_P1_def abs_minus_commute)\nqed\n\ntext \\The sharing scheme\\\n\ndefinition share :: \"bool \\ share_wire spmf\"\n where \"share x = do {\n a\\<^sub>1 \\ coin_spmf;\n let b\\<^sub>1 = x \\ a\\<^sub>1;\n return_spmf (a\\<^sub>1, b\\<^sub>1)}\" \n\nlemma lossless_share [simp]: \"lossless_spmf (share x)\" \n by(simp add: share_def)\n\ndefinition reconstruct :: \"(share_1 \\ share_2) \\ bool spmf\"\n where \"reconstruct shares = do {\n let (a,b) = shares;\n return_spmf (a \\ b)}\"\n\nlemma lossless_reconstruct [simp]: \"lossless_spmf (reconstruct s)\" \n by(simp add: reconstruct_def split_def)\n\nlemma reconstruct_share : \"(bind_spmf (share x) reconstruct) = (return_spmf x)\"\nproof-\n have \"y = (y = x) = x\" for y by auto\n thus ?thesis \n by(auto simp add: share_def reconstruct_def bind_spmf_const eq_commute) \nqed\n\nlemma \"(reconstruct (s1,s2) \\ (\\ rec. share rec \\ (\\ shares. reconstruct shares))) = return_spmf (s1 \\ s2)\"\n apply(simp add: reconstruct_share reconstruct_def share_def)\n apply(cases s1; cases s2) by(auto simp add: bind_spmf_const)\n\ndefinition xor_evaluate :: \"bool \\ bool \\ bool spmf\"\n where \"xor_evaluate A B = return_spmf (A \\ B)\"\n\ndefinition xor_funct :: \"share_wire \\ share_wire \\ (bool \\ bool) spmf\"\n where \"xor_funct A B = do {\n let (a1, b1) = A;\n let (a2,b2) = B;\n return_spmf (a1 \\ a2, b1 \\ b2)}\"\n\nlemma lossless_xor_funct: \"lossless_spmf (xor_funct A B)\"\n by(simp add: xor_funct_def split_def)\n\ndefinition xor_protocol :: \"share_wire \\ share_wire \\ (bool \\ bool) spmf\"\n where \"xor_protocol A B = do {\n let (a1, b1) = A;\n let (a2,b2) = B;\n return_spmf (a1 \\ a2, b1 \\ b2)}\"\n\nlemma lossless_xor_protocol: \"lossless_spmf (xor_protocol A B)\"\n by(simp add: xor_protocol_def split_def)\n\nlemma share_xor_reconstruct: \n shows \"share x \\ (\\ w1. share y \\ (\\ w2. xor_protocol w1 w2 \n \\ (\\ (a, b). reconstruct (a, b)))) = xor_evaluate x y\"\nproof-\n have \"(ya = (\\ yb)) = ((x = (\\ ya)) = (y = (\\ yb))) = (x = (\\ y))\" for ya yb\n by auto\n then show ?thesis\n by(simp add: share_def xor_protocol_def reconstruct_def xor_evaluate_def bind_spmf_const)\nqed\n\ndefinition R1_xor :: \"(bool \\ bool) \\ (bool \\ bool) \\ (bool \\ bool) spmf\"\n where \"R1_xor A B = return_spmf A\"\n\nlemma lossless_R1_xor: \"lossless_spmf (R1_xor A B)\" \n by(simp add: R1_xor_def)\n\ndefinition S1_xor :: \"(bool \\ bool) \\ bool \\ (bool \\ bool) spmf\"\n where \"S1_xor A out = return_spmf A\"\n\nlemma lossless_S1_xor: \"lossless_spmf (S1_xor A out)\" \n by(simp add: S1_xor_def)\n\nlemma P1_xor_inf_th: \"R1_xor A B = xor_funct A B \\ (\\ (out1, out2). S1_xor A out1)\"\n by(simp add: R1_xor_def xor_funct_def S1_xor_def split_def)\n\ndefinition R2_xor :: \"(bool \\ bool) \\ (bool \\ bool) \\ (bool \\ bool) spmf\"\n where \"R2_xor A B = return_spmf B\"\n\nlemma lossless_R2_xor: \"lossless_spmf (R2_xor A B)\" \n by(simp add: R2_xor_def)\n\ndefinition S2_xor :: \"(bool \\ bool) \\ bool \\ (bool \\ bool) spmf\"\n where \"S2_xor B out = return_spmf B\"\n\nlemma lossless_S2_xor: \"lossless_spmf (S2_xor A out)\" \n by(simp add: S2_xor_def)\n\nlemma P2_xor_inf_th: \"R2_xor A B = xor_funct A B \\ (\\ (out1, out2). S2_xor B out2)\"\n by(simp add: R2_xor_def xor_funct_def S2_xor_def split_def)\n\nsublocale xor_sim_det: sim_det_def R1_xor S1_xor R2_xor S2_xor xor_funct xor_protocol \n unfolding sim_det_def_def\n by(simp add: lossless_R1_xor lossless_S1_xor lossless_R2_xor lossless_S2_xor lossless_xor_funct)\n\nlemma \"xor_sim_det.perfect_sec_P1 m1 m2\"\n by(simp add: xor_sim_det.perfect_sec_P1_def P1_xor_inf_th)\n\nlemma \"xor_sim_det.perfect_sec_P2 m1 m2\"\n by(simp add: xor_sim_det.perfect_sec_P2_def P2_xor_inf_th)\n\ndefinition and_funct :: \"(share_1 \\ share_2) \\ (share_1 \\ share_2) \\ share_wire spmf\"\n where \"and_funct A B = do {\n let (a1, a2) = A;\n let (b1,b2) = B;\n \\ \\ coin_spmf;\n return_spmf (\\, \\ \\ ((a1 \\ b1) \\ (a2 \\ b2)))}\"\n\nlemma lossless_and_funct: \"lossless_spmf (and_funct A B)\"\n by(simp add: and_funct_def split_def)\n\ndefinition and_evaluate :: \"bool \\ bool \\ bool spmf\"\n where \"and_evaluate A B = return_spmf (A \\ B)\"\n\ndefinition and_protocol :: \"share_wire \\ share_wire \\ share_wire spmf\"\n where \"and_protocol A B = do {\n let (a1, b1) = A;\n let (a2,b2) = B;\n \\ \\ coin_spmf;\n let s0 = \\ \\ ((a1 \\ False) \\ (b1 \\ False)); \n let s1 = \\ \\ ((a1 \\ False) \\ (b1 \\ True)); \n let s2 = \\ \\ ((a1 \\ True) \\ (b1 \\ False)); \n let s3 = \\ \\ ((a1 \\ True) \\ (b1 \\ True)); \n (_, s) \\ protocol_14_OT (s0,s1,s2,s3) (a2,b2);\n return_spmf (\\, s)}\" \n\nlemma lossless_and_protocol: \"lossless_spmf (and_protocol A B)\"\n by(simp add: and_protocol_def split_def lossless_protocol_14_OT)\n\nlemma and_correct: \"and_protocol (a1, b1) (a2,b2) = and_funct (a1, b1) (a2,b2)\"\n apply(simp add: and_protocol_def and_funct_def correct_14[symmetric] funct_14)\n by(cases b2 ; cases b1; cases a1; cases a2; auto)\n\nlemma share_and_reconstruct: \n shows \"share x \\ (\\ (a1,a2). share y \\ (\\ (b1,b2).\n and_protocol (a1,b1) (a2,b2) \\ (\\ (a, b). reconstruct (a, b)))) = and_evaluate x y\"\nproof-\n have \"(yc = (\\ (if x = (\\ ya) then if snd (snd (ya, x = (\\ ya)), snd (yb, y = (\\ yb))) then yc \n = (fst (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))) \\ snd (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))))\n else yc = (fst (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))) \\ \\ snd (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))))\n else if snd (snd (ya, x = (\\ ya)), snd (yb, y = (\\ yb))) then yc = (fst (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))) \n \\ snd (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))))\n else yc = (fst (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))) \n \\ \\ snd (fst (ya, x = (\\ ya)), fst (yb, y = (\\ yb))))))) = (x \\ y)\"\n for yc yb ya by auto\n then show ?thesis \n by(auto simp add: share_def reconstruct_def and_protocol_def and_evaluate_def split_def correct_14[symmetric] funct_14 bind_spmf_const Let_def)\nqed\n\ndefinition and_R1 :: \"(share_1 \\ share_1) \\ (share_2 \\ share_2) \\ (((share_1 \\ share_1) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) spmf\"\n where \"and_R1 A B = do {\n let (a1, a2) = A;\n let (b1,b2) = B;\n \\ \\ coin_spmf;\n let s0 = \\ \\ ((a1 \\ False) \\ (a2 \\ False)); \n let s1 = \\ \\ ((a1 \\ False) \\ (a2 \\ True)); \n let s2 = \\ \\ ((a1 \\ True) \\ (a2 \\ False)); \n let s3 = \\ \\ ((a1 \\ True) \\ (a2 \\ True)); \n V \\ R1_14_OT (s0,s1,s2,s3) (b1,b2);\n (_, s) \\ protocol_14_OT (s0,s1,s2,s3) (b1,b2);\n return_spmf (((a1,a2), \\, V), (\\, s))}\"\n\nlemma lossless_and_R1: \"lossless_spmf (and_R1 A B)\"\n apply(simp add: and_R1_def split_def lossless_R1_14_OT lossless_protocol_14_OT Let_def)\n by (metis prod.collapse lossless_R1_14_OT)\n\ndefinition S1_and :: \"(share_1 \\ share_1) \\ bool \\ (((bool \\ bool) \\ bool \\ 'v_14_OT1)) spmf\"\n where \"S1_and A \\ = do {\n let (a1,a2) = A;\n let s0 = \\ \\ ((a1 \\ False) \\ (a2 \\ False)); \n let s1 = \\ \\ ((a1 \\ False) \\ (a2 \\ True)); \n let s2 = \\ \\ ((a1 \\ True) \\ (a2 \\ False)); \n let s3 = \\ \\ ((a1 \\ True) \\ (a2 \\ True)); \n V \\ S1_14_OT (s0,s1,s2,s3) ();\n return_spmf ((a1,a2), \\, V)}\"\n\ndefinition out1 :: \"(share_1 \\ share_1) \\ (share_2 \\ share_2) \\ bool \\ (share_1 \\ share_2) spmf\"\n where \"out1 A B \\ = do {\n let (a1,a2) = A;\n let (b1,b2) = B;\n return_spmf (\\, \\ \\ ((a1 \\ b1) \\ (a2 \\ b2)))}\"\n\ndefinition S1_and' :: \"(share_1 \\ share_1) \\ (share_2 \\ share_2) \\ bool \\ (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) spmf\"\n where \"S1_and' A B \\ = do {\n let (a1,a2) = A;\n let (b1,b2) = B;\n let s0 = \\ \\ ((a1 \\ False) \\ (a2 \\ False)); \n let s1 = \\ \\ ((a1 \\ False) \\ (a2 \\ True)); \n let s2 = \\ \\ ((a1 \\ True) \\ (a2 \\ False)); \n let s3 = \\ \\ ((a1 \\ True) \\ (a2 \\ True)); \n V \\ S1_14_OT (s0,s1,s2,s3) ();\n return_spmf (((a1,a2), \\, V), (\\, \\ \\ ((a1 \\ b1) \\ (a2 \\ b2))))}\"\n\nlemma sec_ex_P1_and: \n shows \"\\ (A :: 'v_14_OT1 \\ bool \\ bool spmf).\n \\spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True - spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True\\ =\n \\spmf (coin_spmf \\ (\\ \\. S1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) () \n \\ (\\ view. A view \\))) True \n - spmf (coin_spmf \\ (\\ \\. R1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) (b1, b2) \n \\ (\\ view. A view \\))) True\\\"\n including monad_normalisation\nproof-\n define A' where \"A' == \\ view \\. (D (((a1,a2), \\, view), (\\, \\ \\ ((a1 \\ b1) \\ (a2 \\ b2)))))\" \n have \"\\spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True - \n spmf ((and_R1 (a1, a2) (b1,b2)) \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (bool \\ bool)) \\ bool spmf)) True\\ =\n \\spmf (coin_spmf \\ (\\ \\ :: bool. S1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) () \n \\ (\\ view. A' view \\))) True - spmf (coin_spmf \\ (\\ \\. R1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) (b1, b2) \n \\ (\\ view. A' view \\))) True\\\"\n by(auto simp add: S1_and'_def A'_def and_funct_def and_R1_def Let_def split_def correct_14[symmetric] funct_14; cases a1; cases a2; cases b1; cases b2; auto)\n then show ?thesis by auto\nqed\n\nlemma bound_14_OT:\n \"\\spmf (coin_spmf \\ (\\ \\. S1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) () \n \\ (\\ view. (A :: 'v_14_OT1 \\ bool \\ bool spmf) view \\))) True - spmf (coin_spmf \\ (\\ \\. R1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) (b1, b2) \n \\ (\\ view. A view \\))) True\\ \\ adv_14_OT\"\n (is \"?lhs \\ adv_14_OT\")\nproof-\n have int1: \"integrable (measure_spmf coin_spmf) (\\x. spmf (S1_14_OT (x \\ (a1 \\ False \\ a2 \\ False), x \\ (a1 \\ False \\ a2 \\ True), x \\ (a1 \\ True \\ a2 \\ False), x \\ (a1 \\ True \\ a2 \\ True)) () \\ (\\view. A view x)) True)\"\n and int2: \"integrable (measure_spmf coin_spmf) (\\x. spmf (R1_14_OT (x \\ (a1 \\ False \\ a2 \\ False), x \\ (a1 \\ False \\ a2 \\ True), x \\ (a1 \\ True \\ a2 \\ False), x \\ (a1 \\ True \\ a2 \\ True)) (b1, b2) \\ (\\view. A view x)) True)\"\n by(rule measure_spmf.integrable_const_bound[where B=1]; simp add: pmf_le_1)+\n have \"?lhs = \\LINT x|measure_spmf coin_spmf.\n spmf (S1_14_OT (x \\ (a1 \\ False \\ a2 \\ False), x \\ (a1 \\ False \\ a2 \\ True), x \\ (a1 \\ True \\ a2 \\ False), x \\ (a1 \\ True \\ a2 \\ True)) () \\ (\\view. A view x)) True -\n spmf (R1_14_OT (x \\ (a1 \\ False \\ a2 \\ False), x \\ (a1 \\ False \\ a2 \\ True), x \\ (a1 \\ True \\ a2 \\ False), x \\ (a1 \\ True \\ a2 \\ True)) (b1, b2) \\ (\\view. A view x)) True\\\"\n apply(subst (1 2) spmf_bind) using int1 int2 by simp\n also have \"... \\ LINT x|measure_spmf coin_spmf. \\spmf (S1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) () \\ (\\view. A view x)) True \n - spmf (R1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) (b1, b2) \\ (\\view. A view x)) True\\\"\n by(rule integral_abs_bound[THEN order_trans]; simp add: split_beta)\n ultimately have \"?lhs \\ LINT x|measure_spmf coin_spmf. \\spmf (S1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) () \\ (\\view. A view x)) True \n - spmf (R1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) (b1, b2) \\ (\\view. A view x)) True\\\"\n by simp\n also have \"LINT x|measure_spmf coin_spmf. \\spmf (S1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) () \\ (\\view. A view x)) True \n - spmf (R1_14_OT (x = (a1 \\ \\ a2), x = (a1 \\ a2), x = (a1 \\ \\ a2), x = (a1 \\ a2)) (b1, b2) \\ (\\view. A view x)) True\\ \\ adv_14_OT\"\n apply(rule integral_mono[THEN order_trans]) \n apply(rule measure_spmf.integrable_const_bound[where B=2])\n apply clarsimp\n apply(rule abs_triangle_ineq4[THEN order_trans])\n apply(cases a1) apply(cases a2) \n subgoal for M\n using pmf_le_1[of \"R1_14_OT (\\ M, M, M, M) (b1,b2) \\ (\\ view. A view M)\" \"Some True\"]\n pmf_le_1[of \"S1_14_OT (\\ M, M, M, M) () \\ (\\ view. A view M)\" \"Some True\"] \n by simp\n subgoal for M \n using pmf_le_1[of \"R1_14_OT (M, \\ M, M, M) (b1,b2) \\ (\\ view. A view M)\" \"Some True\"] \n pmf_le_1[of \"S1_14_OT (M, \\ M, M, M) () \\ (\\ view. A view M)\" \"Some True\"] \n by simp\n apply(cases a2) apply(auto)\n subgoal for M\n using pmf_le_1[of \"R1_14_OT (M, M, \\ M, M) (b1,b2) \\ (\\ view. A view M)\" \"Some True\"] \n pmf_le_1[of \"S1_14_OT (M, M, \\ M, M) () \\ (\\ view. A view M)\" \"Some True\"] \n by(simp)\n subgoal for M\n using pmf_le_1[of \"R1_14_OT (M, M, M, \\ M) (b1,b2) \\ (\\ view. A view M)\" \"Some True\"] \n pmf_le_1[of \"S1_14_OT (M, M, M, \\ M) () \\ (\\ view. A view M)\" \"Some True\"] \n by(simp)\n using ass_adv_14_OT by fast\n ultimately show ?thesis by simp\nqed\n\nlemma security_and_P1:\n shows \"\\spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True - \n spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True\\ \\ adv_14_OT\"\nproof-\n obtain A :: \"'v_14_OT1 \\ bool \\ bool spmf\" where A: \n \"\\spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \\ D)) True - spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True\\ =\n \\spmf (coin_spmf \\ (\\ \\. S1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) () \n \\ (\\ view. A view \\))) True - spmf (coin_spmf \n \\ (\\ \\. R1_14_OT ((\\ \\ ((a1 \\ False) \\ (a2 \\ False))), (\\ \\ ((a1 \\ False) \\ (a2 \\ True))), (\\ \\ ((a1 \\ True) \\ (a2 \\ False))), (\\ \\ ((a1 \\ True) \\ (a2 \\ True)))) (b1, b2)\n \\ (\\ view. A view \\))) True\\\" \n using sec_ex_P1_and by blast\n then show ?thesis using bound_14_OT[of \"a1\" \"a2\" \"A\" \"b1\" \"b2\" ] by metis\nqed\n\nlemma security_and_P1':\n shows \"\\spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True - \n spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True\\ \\ adv_14_OT\"\nproof-\n have \"\\spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True - \n spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True\\ =\n \\spmf ((and_funct (a1, a2) (b1,b2)) \\ (\\ (s1, s2). (S1_and' (a1,a2) (b1,b2) s1) \n \\ (D :: (((bool \\ bool) \\ bool \\ 'v_14_OT1) \\ (share_1 \\ share_2)) \\ bool spmf))) True - \n spmf ((and_R1 (a1, a2) (b1,b2)) \\ D) True\\\" using abs_minus_commute by blast\n thus ?thesis using security_and_P1 by simp\nqed\n\ndefinition and_R2 :: \"(share_1 \\ share_2) \\ (share_2 \\ share_1) \\ (((bool \\ bool) \\ 'v_14_OT2) \\ (share_1 \\ share_2)) spmf\"\n where \"and_R2 A B = do {\n let (a1, a2) = A;\n let (b1,b2) = B;\n \\ \\ coin_spmf;\n let s0 = \\ \\ ((a1 \\ False) \\ (a2 \\ False)); \n let s1 = \\ \\ ((a1 \\ False) \\ (a2 \\ True)); \n let s2 = \\ \\ ((a1 \\ True) \\ (a2 \\ False)); \n let s3 = \\ \\ ((a1 \\ True) \\ (a2 \\ True)); \n (_, s) \\ protocol_14_OT (s0,s1,s2,s3) B;\n V \\ R2_14_OT (s0,s1,s2,s3) B;\n return_spmf ((B, V), (\\, s))}\"\n\nlemma lossless_and_R2: \"lossless_spmf (and_R2 A B)\"\n apply(simp add: and_R2_def split_def lossless_R2_14_OT lossless_protocol_14_OT Let_def) \n by (metis lossless_R2_14_OT prod.collapse)\n\ndefinition S2_and :: \"(share_1 \\ share_2) \\ bool \\ (((bool \\ bool) \\ 'v_14_OT2)) spmf\"\n where \"S2_and B s2 = do {\n let (a2,b2) = B;\n V :: 'v_14_OT2 \\ S2_14_OT (a2,b2) s2;\n return_spmf ((B, V))}\"\n\ndefinition out2 :: \"(share_1 \\ share_2) \\ (share_1 \\ share_2) \\ bool \\ (share_1 \\ share_2) spmf\"\n where \"out2 B A s2 = do {\n let (a1, b1) = A;\n let (a2,b2) = B;\n let s1 = s2 \\ ((a1 \\ a2) \\ (b1 \\ b2));\n return_spmf (s1, s2)}\"\n\ndefinition S2_and' :: \"(share_1 \\ share_2) \\ (share_1 \\ share_2) \\ bool \\ (((bool \\ bool) \\ 'v_14_OT2) \\ (share_1 \\ share_2)) spmf\"\n where \"S2_and' B A s2 = do {\n let (a1, a2) = A;\n let (b1,b2) = B;\n V :: 'v_14_OT2 \\ S2_14_OT B s2;\n let s1 = s2 \\ ((a1 \\ b1) \\ (a2 \\ b2));\n return_spmf ((B, V), s1, s2)}\"\n\nlemma lossless_S2_and: \"lossless_spmf (S2_and B s2)\"\n apply(simp add: S2_and_def split_def)\n by(metis prod.collapse lossless_S2_14_OT) \n\nsublocale and_secret_sharing: sim_non_det_def and_R1 S1_and out1 and_R2 S2_and out2 and_funct .\n\nlemma ideal_S1_and: \"and_secret_sharing.Ideal1 (a1, b1) (a2, b2) s2 = S1_and' (a1, b1) (a2, b2) s2\"\n by(simp add: Let_def and_secret_sharing.Ideal1_def S1_and'_def split_def out1_def S1_and_def)\n\nlemma and_P2_security: \"and_secret_sharing.perfect_sec_P2 m1 m2\"\nproof-\n have \"and_R2 (a1, b1) (a2, b2) = and_funct (a1, b1) (a2, b2) \\ (\\(s1, s2). and_secret_sharing.Ideal2 (a2, b2) (a1, b1) s2)\"\n for a1 a2 b1 b2\n apply(auto simp add: split_def inf_th_14_OT_P4 S2_and'_def and_R2_def and_funct_def Let_def correct_14[symmetric] and_secret_sharing.Ideal2_def S2_and_def out2_def)\n apply(simp only: funct_14) \n apply auto\n by(cases b1;cases b2; cases a1; cases a2; auto) \n thus ?thesis\n by(simp add: and_secret_sharing.perfect_sec_P2_def; metis prod.collapse)\nqed\n\nlemma and_P1_security: \"and_secret_sharing.adv_P1 m1 m2 D \\ adv_14_OT\"\nproof-\n have \"\\spmf (and_R1 (a1, a2) (b1, b2) \\ D) True -\n spmf (and_funct (a1, a2) (b1, b2) \\ (\\(s1, s2). \n and_secret_sharing.Ideal1 (a1, a2) (b1, b2) s1 \\ D)) True\\\n \\ adv_14_OT\" for a1 a2 b1 b2 \n using security_and_P1' ideal_S1_and prod.collapse by simp \n thus ?thesis \n by(simp add: and_secret_sharing.adv_P1_def; metis prod.collapse)\nqed\n\ndefinition \"F = {and_evaluate, xor_evaluate}\"\n\nlemma share_reconstruct_xor: \"share x \\ (\\(a1, a2). share y \\ (\\(b1, b2). \n xor_protocol (a1, b1) (a2, b2) \\ (\\(a, b). \n reconstruct (a, b)))) = xor_evaluate x y\"\nproof-\n have \"(((ya = (x = ya)) = (yb = (y = (\\ yb))))) = (x = (\\ y))\" for ya yb by auto\n thus ?thesis\n by(simp add: xor_protocol_def share_def reconstruct_def xor_evaluate_def bind_spmf_const)\nqed\n\nsublocale share_correct: secret_sharing_scheme share reconstruct F .\n\nlemma \"share_correct.sharing_correct input\"\n by(simp add: share_correct.sharing_correct_def reconstruct_share) \n\nlemma \"share_correct.correct_share_eval input1 input2\"\n unfolding share_correct.correct_share_eval_def\n apply(auto simp add: F_def) \n using share_and_reconstruct apply auto \n using share_reconstruct_xor by force\n\nend \n\nlocale gmw_asym =\n fixes S1_14_OT :: \"nat \\ msgs_14_OT \\ unit \\ 'v_14_OT1 spmf\"\n and R1_14_OT :: \"nat \\ msgs_14_OT \\ choice_14_OT \\ 'v_14_OT1 spmf\"\n and S2_14_OT :: \"nat \\ choice_14_OT \\ bool \\ 'v_14_OT2 spmf\" \n and R2_14_OT :: \"nat \\ msgs_14_OT \\ choice_14_OT \\ 'v_14_OT2 spmf\"\n and protocol_14_OT :: \"nat \\ msgs_14_OT \\ choice_14_OT \\ (unit \\ bool) spmf\"\n and adv_14_OT :: \"nat \\ real\"\n assumes gmw_base: \"\\ (n::nat). gmw_base (S1_14_OT n) (R1_14_OT n) (S2_14_OT n) (R2_14_OT n) (protocol_14_OT n) (adv_14_OT n)\"\nbegin\n\nsublocale gmw_base \"(S1_14_OT n)\" \"(R1_14_OT n)\" \"(S2_14_OT n)\" \"(R2_14_OT n)\" \"(protocol_14_OT n)\" \"(adv_14_OT n)\"\n by (simp add: gmw_base)\n\nlemma \"xor_sim_det.perfect_sec_P1 m1 m2\" \n by (simp add: P1_xor_inf_th xor_sim_det.perfect_sec_P1_def)\n\nlemma \"xor_sim_det.perfect_sec_P2 m1 m2\"\n by (simp add: P2_xor_inf_th xor_sim_det.perfect_sec_P2_def)\n\nlemma and_P1_adv_negligible:\n assumes \"negligible (\\ n. adv_14_OT n)\"\n shows \"negligible (\\ n. and_secret_sharing.adv_P1 n m1 m2 D)\" \nproof-\n have \"and_secret_sharing.adv_P1 n m1 m2 D \\ adv_14_OT n\" for n\n by (simp add: and_P1_security)\n thus ?thesis \n using and_secret_sharing.adv_P1_def assms negligible_le by auto\nqed\n\nlemma and_P2_security: \"and_secret_sharing.perfect_sec_P2 n m1 m2\" \n by (simp add: and_P2_security)\n\nend\n\nend\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Multi_Party_Computation/GMW.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565327, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2569915265990344}} {"text": "(* Title: OAWN_Invariants.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke\n*)\n\nheader \"Generic open invariants on sequential AWN processes\"\n\ntheory OAWN_Invariants\nimports Invariants OInvariants\n AWN_Cterms AWN_Labels AWN_Invariants\n OAWN_SOS\nbegin\n\nsubsection \"Open invariants via labelled control terms\"\n\nlemma oseqp_sos_subterms:\n assumes \"wellformed \\\"\n and \"\\pn. p \\ subterms (\\ pn)\"\n and \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n shows \"\\pn. p' \\ subterms (\\ pn)\"\n using assms\n proof (induct p)\n fix p1 p2\n assume IH1: \"\\pn. p1 \\ subterms (\\ pn) \\\n ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i \\\n \\pn. p' \\ subterms (\\ pn)\"\n and IH2: \"\\pn. p2 \\ subterms (\\ pn) \\\n ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i \\\n \\pn. p' \\ subterms (\\ pn)\"\n and \"\\pn. p1 \\ p2 \\ subterms (\\ pn)\"\n and \"((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n from \\\\pn. p1 \\ p2 \\ subterms (\\ pn)\\ obtain pn\n where \"p1 \\ subterms (\\ pn)\"\n and \"p2 \\ subterms (\\ pn)\" by auto\n from \\((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\\\n have \"((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\" by auto\n thus \"\\pn. p' \\ subterms (\\ pn)\"\n proof\n assume \"((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n with \\p1 \\ subterms (\\ pn)\\ show ?thesis by (auto intro: IH1)\n next\n assume \"((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n with \\p2 \\ subterms (\\ pn)\\ show ?thesis by (auto intro: IH2)\n qed\n qed auto\n\nlemma oreachable_subterms:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n and \"(\\, p) \\ oreachable A S U\"\n shows \"\\pn. p \\ subterms (\\ pn)\"\n using assms(4)\n proof (induct rule: oreachable_pair_induct)\n fix \\ p\n assume \"(\\, p) \\ init A\"\n with \\control_within \\ (init A)\\ show \"\\pn. p \\ subterms (\\ pn)\" ..\n next\n fix \\ p a \\' p'\n assume \"(\\, p) \\ oreachable A S U\"\n and \"\\pn. p \\ subterms (\\ pn)\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n moreover from this(3) and \\trans A = oseqp_sos \\ i\\\n have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n ultimately show \"\\pn. p' \\ subterms (\\ pn)\"\n using \\wellformed \\\\\n by (auto elim: oseqp_sos_subterms)\n qed\n\nlemma onl_oinvariantI [intro]:\n assumes init: \"\\\\ p l. \\ (\\, p) \\ init A; l \\ labels \\ p \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\ (\\, p) \\ oreachable A S U;\n \\l\\labels \\ p. P (\\, l);\n U \\ \\' \\ \\ \\l\\labels \\ p. P (\\', l)\"\n and step: \"\\\\ p a \\' p' l'.\n \\ (\\, p) \\ oreachable A S U;\n \\l\\labels \\ p. P (\\, l);\n ((\\, p), a, (\\', p')) \\ trans A;\n l' \\ labels \\ p';\n S \\ \\' a \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p\n assume \"(\\, p) \\ init A\"\n hence \"\\l\\labels \\ p. P (\\, l)\" using init by simp\n thus \"onl \\ P (\\, p)\" ..\n next\n fix \\ p a \\' p'\n assume rp: \"(\\, p) \\ oreachable A S U\"\n and \"onl \\ P (\\, p)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n from \\onl \\ P (\\, p)\\ have \"\\l\\labels \\ p. P (\\, l)\" ..\n with rp tr \\S \\ \\' a\\ have \"\\l'\\labels \\ p'. P (\\', l')\" by (auto elim: step)\n thus \"onl \\ P (\\', p')\" ..\n next\n fix \\ \\' p\n assume \"(\\, p) \\ oreachable A S U\"\n and \"onl \\ P (\\, p)\"\n and \"U \\ \\'\"\n from \\onl \\ P (\\, p)\\ have \"\\l\\labels \\ p. P (\\, l)\" by auto\n with \\(\\, p) \\ oreachable A S U\\ have \"\\l\\labels \\ p. P (\\', l)\"\n using \\U \\ \\'\\ by (rule other)\n thus \"onl \\ P (\\', p)\" by auto\n qed\n\nlemma global_oinvariantI [intro]:\n assumes init: \"\\\\ p. (\\, p) \\ init A \\ P \\\"\n and other: \"\\\\ \\' p l. \\ (\\, p) \\ oreachable A S U; P \\; U \\ \\' \\ \\ P \\'\"\n and step: \"\\\\ p a \\' p'.\n \\ (\\, p) \\ oreachable A S U;\n P \\;\n ((\\, p), a, (\\', p')) \\ trans A;\n S \\ \\' a \\ \\ P \\'\"\n shows \"A \\ (S, U \\) (\\(\\, _). P \\)\"\n proof\n fix \\ p\n assume \"(\\, p) \\ init A\"\n thus \"(\\(\\, _). P \\) (\\, p)\"\n by simp (erule init)\n next\n fix \\ p a \\' p'\n assume rp: \"(\\, p) \\ oreachable A S U\"\n and \"(\\(\\, _). P \\) (\\, p)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n from \\(\\(\\, _). P \\) (\\, p)\\ have \"P \\\" by simp\n with rp have \"P \\'\"\n using tr \\S \\ \\' a\\ by (rule step)\n thus \"(\\(\\, _). P \\) (\\', p')\" by simp\n next\n fix \\ \\' p\n assume \"(\\, p) \\ oreachable A S U\"\n and \"(\\(\\, _). P \\) (\\, p)\"\n and \"U \\ \\'\"\n hence \"P \\'\" by simp (erule other)\n thus \"(\\(\\, _). P \\) (\\', p)\" by simp\n qed\n\nlemma onl_oinvariantD [dest]:\n assumes \"A \\ (S, U \\) onl \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n shows \"P (\\, l)\"\n using assms unfolding onl_def by auto\n\nlemma onl_oinvariant_weakenD [dest]:\n assumes \"A \\ (S', U' \\) onl \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n and weakenS: \"\\s s' a. S s s' a \\ S' s s' a\"\n and weakenU: \"\\s s'. U s s' \\ U' s s'\"\n shows \"P (\\, l)\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with \\A \\ (S', U' \\) onl \\ P\\ show \"P (\\, l)\"\n using \\l \\ labels \\ p\\ ..\n qed\n\nlemma onl_oinvariant_initD [dest]:\n assumes invP: \"A \\ (S, U \\) onl \\ P\"\n and init: \"(\\, p) \\ init A\"\n and pnl: \"l \\ labels \\ p\"\n shows \"P (\\, l)\"\n proof -\n from init have \"(\\, p) \\ oreachable A S U\" ..\n with invP show ?thesis using pnl ..\n qed\n\nlemma onl_oinvariant_sterms:\n assumes wf: \"wellformed \\\"\n and il: \"A \\ (S, U \\) onl \\ P\"\n and rp: \"(\\, p) \\ oreachable A S U\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n shows \"P (\\, l)\"\n proof -\n from wf \\p'\\sterms \\ p\\ \\l\\labels \\ p'\\ have \"l\\labels \\ p\"\n by (rule labels_sterms_labels)\n with il rp show \"P (\\, l)\" ..\n qed\n\nlemma onl_oinvariant_sterms_weaken:\n assumes wf: \"wellformed \\\"\n and il: \"A \\ (S', U' \\) onl \\ P\"\n and rp: \"(\\, p) \\ oreachable A S U\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n and weakenS: \"\\\\ \\' a. S \\ \\' a \\ S' \\ \\' a\"\n and weakenU: \"\\\\ \\'. U \\ \\' \\ U' \\ \\'\"\n shows \"P (\\, l)\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with assms(1-2) show ?thesis using assms(4-5)\n by (rule onl_oinvariant_sterms)\n qed\n\nlemma otrans_from_sterms:\n assumes \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n shows \"\\p'\\sterms \\ p. ((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n using assms by (induction p rule: sterms_pinduct [OF \\wellformed \\\\]) auto\n\nlemma otrans_from_sterms':\n assumes \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n and \"p' \\ sterms \\ p\"\n shows \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n using assms by (induction p rule: sterms_pinduct [OF \\wellformed \\\\]) auto\n\nlemma otrans_to_dterms:\n assumes \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n and \"wellformed \\\"\n shows \"\\r\\sterms \\ q. r \\ dterms \\ p\"\n using assms by (induction q) auto\n\ntheorem cterms_includes_sterms_of_oseq_reachable:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n shows \"\\(sterms \\ ` snd ` oreachable A S U) \\ cterms \\\"\n proof\n fix qs\n assume \"qs \\ \\(sterms \\ ` snd ` oreachable A S U)\"\n then obtain \\ and q where *: \"(\\, q) \\ oreachable A S U\"\n and **: \"qs \\ sterms \\ q\" by auto\n from * have \"\\x. x \\ sterms \\ q \\ x \\ cterms \\\"\n proof (induction rule: oreachable_pair_induct)\n fix \\ p q\n assume \"(\\, p) \\ init A\"\n and \"q \\ sterms \\ p\"\n from \\control_within \\ (init A)\\ and \\(\\, p) \\ init A\\\n obtain pn where \"p \\ subterms (\\ pn)\" by auto\n with \\wellformed \\\\ show \"q \\ cterms \\\" using \\q\\sterms \\ p\\\n by (rule subterms_sterms_in_cterms)\n next\n fix p \\ a \\' q x\n assume \"(\\, p) \\ oreachable A S U\"\n and IH: \"\\x. x \\ sterms \\ p \\ x \\ cterms \\\"\n and \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"x \\ sterms \\ q\"\n from this(3) and \\trans A = oseqp_sos \\ i\\\n have step: \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n from step \\wellformed \\\\ obtain ps\n where ps: \"ps \\ sterms \\ p\"\n and step': \"((\\, ps), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (rule otrans_from_sterms [THEN bexE])\n from ps have \"ps \\ cterms \\\" by (rule IH)\n moreover from step' \\wellformed \\\\ \\x \\ sterms \\ q\\ have \"x \\ dterms \\ ps\"\n by (rule otrans_to_dterms [rule_format])\n ultimately show \"x \\ cterms \\\" by (rule ctermsDI)\n qed\n thus \"qs \\ cterms \\\" using ** .\n qed\n\ncorollary oseq_reachable_in_cterms:\n assumes \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"trans A = oseqp_sos \\ i\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"p' \\ sterms \\ p\"\n shows \"p' \\ cterms \\\"\n using assms(1-3)\n proof (rule cterms_includes_sterms_of_oseq_reachable [THEN set_mp])\n from assms(4-5) show \"p' \\ \\(sterms \\ ` snd ` oreachable A S U)\"\n by (auto elim!: rev_bexI)\n qed\n\nlemma oseq_invariant_ctermI:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and init: \"\\\\ p l. \\\n (\\, p) \\ init A;\n l\\labels \\ p\n \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\\n (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\p l \\ a q l' \\' pp. \\\n p\\cterms \\;\n l\\labels \\ p;\n P (\\, l);\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp)\\oreachable A S U;\n p\\sterms \\ pp;\n (\\', q)\\oreachable A S U;\n S \\ \\' a\n \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p l\n assume \"(\\, p) \\ init A\"\n and *: \"l \\ labels \\ p\"\n with init show \"P (\\, l)\" by auto\n next\n fix \\ p a \\' q l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and pl: \"\\l\\labels \\ p. P (\\, l)\"\n and tr: \"((\\, p), a, (\\', q)) \\ trans A\"\n and A6: \"l' \\ labels \\ q\"\n and \"S \\ \\' a\"\n thus \"P (\\', l')\"\n proof -\n from sr and tr and \\S \\ \\' a\\ have A7: \"(\\', q) \\ oreachable A S U\"\n by - (rule oreachable_local')\n from tr and sp have tr': \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n then obtain p' where \"p' \\ sterms \\ p\"\n and A4: \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (blast dest: otrans_from_sterms [OF _ wf])\n from wf cw sp sr this(1) have A1: \"p'\\cterms \\\"\n by (rule oseq_reachable_in_cterms)\n from labels_not_empty [OF wf] obtain ll where A2: \"ll\\labels \\ p'\"\n by blast\n with \\p'\\sterms \\ p\\ have \"ll\\labels \\ p\"\n by (rule labels_sterms_labels [OF wf])\n with pl have A3: \"P (\\, ll)\" by simp\n from sr \\p'\\sterms \\ p\\\n obtain pp where A7: \"(\\, pp)\\oreachable A S U\"\n and A8: \"p'\\sterms \\ pp\"\n by auto\n from sr tr \\S \\ \\' a\\ have A9: \"(\\', q)\\oreachable A S U\"\n by - (rule oreachable_local')\n from sp and \\((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\\\n have A5: \"((\\, p'), a, (\\', q)) \\ trans A\" by simp\n from A1 A2 A3 A4 A5 A6 A7 A8 A9 \\S \\ \\' a\\ show ?thesis by (rule local)\n qed\n next\n fix \\ \\' p l\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and \"\\l\\labels \\ p. P (\\, l)\"\n and \"U \\ \\'\"\n show \"\\l\\labels \\ p. P (\\', l)\"\n proof\n fix l\n assume \"l\\labels \\ p\"\n with \\\\l\\labels \\ p. P (\\, l)\\ have \"P (\\, l)\" ..\n with sr and \\l\\labels \\ p\\\n show \"P (\\', l)\" using \\U \\ \\'\\ by (rule other)\n qed\n qed\n\nlemma oseq_invariant_ctermsI:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and init: \"\\\\ p l. \\\n (\\, p) \\ init A;\n l\\labels \\ p\n \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l. \\\n wellformed \\;\n (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\p l \\ a q l' \\' pp pn. \\\n wellformed \\;\n p\\ctermsl (\\ pn);\n not_call p;\n l\\labels \\ p;\n P (\\, l);\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp)\\oreachable A S U;\n p\\sterms \\ pp;\n (\\', q)\\oreachable A S U;\n S \\ \\' a\n \\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof (rule oseq_invariant_ctermI [OF wf cw sl sp])\n fix \\ p l\n assume \"(\\, p) \\ init A\"\n and \"l \\ labels \\ p\"\n thus \"P (\\, l)\" by (rule init)\n next\n fix \\ \\' p l\n assume \"(\\, p) \\ oreachable A S U\"\n and \"l \\ labels \\ p\"\n and \"P (\\, l)\"\n and \"U \\ \\'\"\n with wf show \"P (\\', l)\" by (rule other)\n next\n fix p l \\ a q l' \\' pp\n assume \"p \\ cterms \\\"\n and otherassms: \"l \\ labels \\ p\"\n \"P (\\, l)\"\n \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n \"((\\, p), a, (\\', q)) \\ trans A\"\n \"l' \\ labels \\ q\"\n \"(\\, pp) \\ oreachable A S U\"\n \"p \\ sterms \\ pp\"\n \"(\\', q) \\ oreachable A S U\"\n \"S \\ \\' a\"\n from this(1) obtain pn where \"p \\ ctermsl(\\ pn)\"\n and \"not_call p\"\n unfolding cterms_def' [OF wf] by auto\n with wf show \"P (\\', l')\"\n using otherassms by (rule local)\n qed\n\nsubsection \"Open step invariants via labelled control terms\"\n\nlemma onll_ostep_invariantI [intro]:\n assumes *: \"\\\\ p l a \\' p' l'. \\ (\\, p)\\oreachable A S U;\n ((\\, p), a, (\\', p')) \\ trans A;\n S \\ \\' a;\n l \\labels \\ p;\n l'\\labels \\ p' \\\n \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n proof\n fix \\ p \\' p' a\n assume \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n hence \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\" by (auto elim!: *)\n thus \"onll \\ P ((\\, p), a, (\\', p'))\" ..\n qed\n\nlemma onll_ostep_invariantE [elim]:\n assumes \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n and lp: \"l \\labels \\ p\"\n and lp': \"l'\\labels \\ p'\"\n shows \"P ((\\, l), a, (\\', l'))\"\n proof -\n from assms(1-4) have \"onll \\ P ((\\, p), a, (\\', p'))\" ..\n with lp lp' show \"P ((\\, l), a, (\\', l'))\" by auto\n qed\n\nlemma onll_ostep_invariantD [dest]:\n assumes \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n shows \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n using assms by auto\n\nlemma onll_ostep_invariant_weakenD [dest]:\n assumes \"A \\\\<^sub>A (S', U' \\) onll \\ P\"\n and \"(\\, p) \\ oreachable A S U\"\n and \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S' \\ \\' a\"\n and weakenS: \"\\s s' a. S s s' a \\ S' s s' a\"\n and weakenU: \"\\s s'. U s s' \\ U' s s'\"\n shows \"\\l\\labels \\ p. \\l'\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof -\n from \\(\\, p) \\ oreachable A S U\\ have \"(\\, p) \\ oreachable A S' U'\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with \\A \\\\<^sub>A (S', U' \\) onll \\ P\\ show ?thesis\n using \\((\\, p), a, (\\', p')) \\ trans A\\ and \\S' \\ \\' a\\ ..\n qed\n\nlemma onll_ostep_to_invariantI [intro]:\n assumes sinv: \"A \\\\<^sub>A (S, U \\) onll \\ Q\"\n and wf: \"wellformed \\\"\n and init: \"\\\\ l p. \\ (\\, p) \\ init A; l\\labels \\ p \\ \\ P (\\, l)\"\n and other: \"\\\\ \\' p l.\n \\ (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n U \\ \\' \\ \\ P (\\', l)\"\n and local: \"\\\\ p l \\' l' a.\n \\ (\\, p) \\ oreachable A S U;\n l\\labels \\ p;\n P (\\, l);\n Q ((\\, l), a, (\\', l'));\n S \\ \\' a\\ \\ P (\\', l')\"\n shows \"A \\ (S, U \\) onl \\ P\"\n proof\n fix \\ p l\n assume \"(\\, p) \\ init A\" and \"l\\labels \\ p\"\n thus \"P (\\, l)\" by (rule init)\n next\n fix \\ p a \\' p' l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and lp: \"\\l\\labels \\ p. P (\\, l)\"\n and tr: \"((\\, p), a, (\\', p')) \\ trans A\"\n and \"S \\ \\' a\"\n and lp': \"l' \\ labels \\ p'\"\n show \"P (\\', l')\"\n proof -\n from lp obtain l where \"l\\labels \\ p\" and \"P (\\, l)\"\n using labels_not_empty [OF wf] by auto\n from sinv sr tr \\S \\ \\' a\\ this(1) lp' have \"Q ((\\, l), a, (\\', l'))\" ..\n with sr \\l\\labels \\ p\\ \\P (\\, l)\\ show \"P (\\', l')\" using \\S \\ \\' a\\ by (rule local)\n qed\n next\n fix \\ \\' p l\n assume \"(\\, p) \\ oreachable A S U\"\n and \"\\l\\labels \\ p. P (\\, l)\"\n and \"U \\ \\'\"\n show \"\\l\\labels \\ p. P (\\', l)\"\n proof\n fix l\n assume \"l\\labels \\ p\"\n with \\\\l\\labels \\ p. P (\\, l)\\ have \"P (\\, l)\" ..\n with \\(\\, p) \\ oreachable A S U\\ and \\l\\labels \\ p\\\n show \"P (\\', l)\" using \\U \\ \\'\\ by (rule other)\n qed\n qed\n\nlemma onll_ostep_invariant_sterms:\n assumes wf: \"wellformed \\\"\n and si: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and sos: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"l'\\labels \\ q\"\n and \"p'\\sterms \\ p\"\n and \"l\\labels \\ p'\"\n shows \"P ((\\, l), a, (\\', l'))\"\n proof -\n from wf \\p'\\sterms \\ p\\ \\l\\labels \\ p'\\ have \"l\\labels \\ p\"\n by (rule labels_sterms_labels)\n with si sr sos \\S \\ \\' a\\ show \"P ((\\, l), a, (\\', l'))\" using \\l'\\labels \\ q\\ ..\n qed\n\nlemma oseq_step_invariant_sterms:\n assumes inv: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and wf: \"wellformed \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and \"l'\\labels \\ q\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and tr: \"((\\, p'), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"p'\\sterms \\ p\"\n shows \"\\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof\n from assms(3, 6) have \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n hence \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n using wf \\p'\\sterms \\ p\\ by (rule otrans_from_sterms')\n with assms(3) have trp: \"((\\, p), a, (\\', q)) \\ trans A\" by simp\n fix l assume \"l \\ labels \\ p'\"\n with wf inv sr trp \\S \\ \\' a\\ \\l'\\labels \\ q\\ \\p'\\sterms \\ p\\\n show \"P ((\\, l), a, (\\', l'))\"\n by - (erule(7) onll_ostep_invariant_sterms)\n qed\n\nlemma oseq_step_invariant_sterms_weaken:\n assumes inv: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and wf: \"wellformed \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and \"l'\\labels \\ q\"\n and sr: \"(\\, p) \\ oreachable A S' U'\"\n and tr: \"((\\, p'), a, (\\', q)) \\ trans A\"\n and \"S' \\ \\' a\"\n and \"p'\\sterms \\ p\"\n and weakenS: \"\\\\ \\' a. S' \\ \\' a \\ S \\ \\' a\"\n and weakenU: \"\\\\ \\'. U' \\ \\' \\ U \\ \\'\"\n shows \"\\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n proof -\n from \\S' \\ \\' a\\ have \"S \\ \\' a\" by (rule weakenS)\n from \\(\\, p) \\ oreachable A S' U'\\\n have Ir: \"(\\, p) \\ oreachable A S U\"\n by (rule oreachable_weakenE)\n (erule weakenS, erule weakenU)\n with assms(1-4) show ?thesis\n using tr \\S \\ \\' a\\ \\p'\\sterms \\ p\\\n by (rule oseq_step_invariant_sterms)\n qed\n\nlemma onll_ostep_invariant_any_sterms:\n assumes wf: \"wellformed \\\"\n and si: \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n and sr: \"(\\, p) \\ oreachable A S U\"\n and sos: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and \"l'\\labels \\ q\"\n shows \"\\p'\\sterms \\ p. \\l\\labels \\ p'. P ((\\, l), a, (\\', l'))\"\n by (intro ballI) (rule onll_ostep_invariant_sterms [OF assms])\n\nlemma oseq_step_invariant_ctermI [intro]:\n assumes wf: \"wellformed \\\"\n and cw: \"control_within \\ (init A)\"\n and sl: \"simple_labels \\\"\n and sp: \"trans A = oseqp_sos \\ i\"\n and local: \"\\p l \\ a q l' \\' pp. \\\n p\\cterms \\;\n l\\labels \\ p;\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp) \\ oreachable A S U;\n p\\sterms \\ pp;\n (\\', q) \\ oreachable A S U;\n S \\ \\' a\n \\ \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n proof\n fix \\ p l a \\' q l'\n assume sr: \"(\\, p) \\ oreachable A S U\"\n and tr: \"((\\, p), a, (\\', q)) \\ trans A\"\n and \"S \\ \\' a\"\n and pl: \"l \\ labels \\ p\"\n and A5: \"l' \\ labels \\ q\"\n from this(2) and sp have \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\" by simp\n then obtain p' where \"p' \\ sterms \\ p\"\n and A3: \"((\\, p'), a, (\\', q)) \\ oseqp_sos \\ i\"\n by (blast dest: otrans_from_sterms [OF _ wf])\n from this(2) and sp have A4: \"((\\, p'), a, (\\', q)) \\ trans A\" by simp\n from wf cw sp sr \\p'\\sterms \\ p\\ have A1: \"p'\\cterms \\\"\n by (rule oseq_reachable_in_cterms)\n from sr \\p'\\sterms \\ p\\\n obtain pp where A6: \"(\\, pp)\\oreachable A S U\"\n and A7: \"p'\\sterms \\ pp\"\n by auto\n from sr tr \\S \\ \\' a\\ have A8: \"(\\', q)\\oreachable A S U\"\n by - (erule(2) oreachable_local')\n from wf cw sp sr have \"\\pn. p \\ subterms (\\ pn)\"\n by (rule oreachable_subterms) \n with sl wf have \"\\p'\\sterms \\ p. l \\ labels \\ p'\"\n using pl by (rule simple_labels_in_sterms)\n with \\p' \\ sterms \\ p\\ have \"l \\ labels \\ p'\" by simp\n with A1 show \"P ((\\, l), a, (\\', l'))\" using A3 A4 A5 A6 A7 A8 \\S \\ \\' a\\\n by (rule local)\n qed\n\nlemma oseq_step_invariant_ctermsI [intro]:\n assumes wf: \"wellformed \\\"\n and \"control_within \\ (init A)\"\n and \"simple_labels \\\"\n and \"trans A = oseqp_sos \\ i\"\n and local: \"\\p l \\ a q l' \\' pp pn. \\\n wellformed \\;\n p\\ctermsl (\\ pn);\n not_call p;\n l\\labels \\ p;\n ((\\, p), a, (\\', q)) \\ oseqp_sos \\ i;\n ((\\, p), a, (\\', q)) \\ trans A;\n l'\\labels \\ q;\n (\\, pp) \\ oreachable A S U;\n p\\sterms \\ pp;\n (\\', q) \\ oreachable A S U;\n S \\ \\' a\n \\ \\ P ((\\, l), a, (\\', l'))\"\n shows \"A \\\\<^sub>A (S, U \\) onll \\ P\"\n using assms(1-4) proof (rule oseq_step_invariant_ctermI)\n fix p l \\ a q l' \\' pp\n assume \"p \\ cterms \\\"\n and otherassms: \"l \\ labels \\ p\"\n \"((\\, p), a, (\\', q)) \\ oseqp_sos \\ i\"\n \"((\\, p), a, (\\', q)) \\ trans A\"\n \"l' \\ labels \\ q\"\n \"(\\, pp) \\ oreachable A S U\"\n \"p \\ sterms \\ pp\"\n \"(\\', q) \\ oreachable A S U\"\n \"S \\ \\' a\"\n from this(1) obtain pn where \"p \\ ctermsl(\\ pn)\"\n and \"not_call p\"\n unfolding cterms_def' [OF wf] by auto\n with wf show \"P ((\\, l), a, (\\', l'))\"\n using otherassms by (rule local)\n qed\n\nlemma open_seqp_action [elim]:\n assumes \"wellformed \\\"\n and \"((\\ i, p), a, (\\' i, p')) \\ seqp_sos \\\"\n shows \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n proof -\n from assms obtain ps where \"ps\\sterms \\ p\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n by - (drule trans_from_sterms, auto)\n thus ?thesis\n proof (induction p)\n fix p1 p2\n assume \"\\ ps \\ sterms \\ p1; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\ ps \\ sterms \\ p2; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"ps \\ sterms \\ (p1 \\ p2)\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n with assms(1) show \"((\\, p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n by simp (metis oseqp_sos.ochoiceT1 oseqp_sos.ochoiceT2)\n next\n fix l fip fmsg p1 p2\n assume IH1: \"\\ ps \\ sterms \\ p1; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p1), a, (\\', p')) \\ oseqp_sos \\ i\"\n and IH2: \"\\ ps \\ sterms \\ p2; ((\\ i, ps), a, \\' i, p') \\ seqp_sos \\ \\\n \\ ((\\, p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"ps \\ sterms \\ ({l}unicast(fip, fmsg). p1 \\ p2)\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n from this(3-4) have \"((\\ i, {l}unicast(fip, fmsg). p1 \\ p2), a, (\\' i, p')) \\ seqp_sos \\\"\n by simp\n thus \"((\\, {l}unicast(fip, fmsg). p1 \\ p2), a, (\\', p')) \\ oseqp_sos \\ i\"\n proof (rule seqp_unicastTE)\n assume \"a = unicast (fip (\\ i)) (fmsg (\\ i))\"\n and \"\\' i = \\ i\"\n and \"p' = p1\"\n thus ?thesis by auto\n next\n assume \"a = \\unicast (fip (\\ i))\"\n and \"\\' i = \\ i\"\n and \"p' = p2\"\n thus ?thesis by auto\n qed\n next\n fix p\n assume \"ps \\ sterms \\ (call(p))\"\n and \"((\\ i, ps), a, (\\' i, p')) \\ seqp_sos \\\"\n with assms(1) have \"((\\, ps), a, (\\', p')) \\ oseqp_sos \\ i\"\n by (cases ps) auto\n with assms(1) \\ps \\ sterms \\ (call(p))\\ have \"((\\, \\ p), a, (\\', p')) \\ oseqp_sos \\ i\"\n by - (rule otrans_from_sterms', simp_all)\n thus \"((\\, call(p)), a, (\\', p')) \\ oseqp_sos \\ i\" by auto\n qed auto\n qed\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/OAWN_Invariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.25699152659903435}} {"text": "section {*FUNCTION\\_\\_DPDA\\_RNE\\_\\_DPDA\\_REMOVE\\_NEUTRAL\\_EDGES*}\ntheory\n FUNCTION__DPDA_RNE__DPDA_REMOVE_NEUTRAL_EDGES\n\nimports\n PRJ_12_04_04_02__ENTRY\n\nbegin\n\ndefinition neutral_edges_removed :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"neutral_edges_removed G \\\n \\ (\\e \\ epda_delta G. FB_neutral_edge e)\"\n\ndefinition F_DPDA_RNE__edge__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\"\n where\n \"F_DPDA_RNE__edge__RL e \\\n \\edge_src = case edge_src e of cons_state_or_edge_old q \\ q,\n edge_event = edge_event e,\n edge_pop = edge_pop e,\n edge_push = edge_push e,\n edge_trg = case edge_trg e of cons_state_or_edge_old q \\ q\\\"\n\ndefinition F_DPDA_RNE__conf_old__LR :: \"\n ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf_old__LR c \\\n \\epdaS_conf_state = cons_state_or_edge_old (epdaS_conf_state c),\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\"\n\ndefinition F_DPDA_RNE__conf__RL :: \"\n (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf__RL c \\\n case epdaS_conf_state c of cons_state_or_edge_old q\n \\ \\epdaS_conf_state = q,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\n | cons_state_or_edge_new e\n \\ \\epdaS_conf_state = edge_trg e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = drop (Suc 0) (epdaS_conf_stack c)\\\"\n\nlemma F_DPDA_RNE__preserves_epda: \"\n valid_dpda G\n \\ PB \\ epda_gamma G\n \\ valid_epda (F_DPDA_RNE G PB)\"\n apply(simp add: valid_epda_def valid_pda_def valid_dpda_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(force)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule_tac\n x=\"xa\"\n and P=\"\\xa. edge_src xa \\ epda_states G \\ edge_trg xa \\ epda_states G \\ option_to_set (edge_event xa) \\ epda_events G \\ edge_pop xa \\ may_terminated_by (epda_gamma G) (epda_box G) \\ edge_push xa \\ may_terminated_by (epda_gamma G) (epda_box G) \\ (edge_pop xa \\ must_terminated_by (epda_gamma G) (epda_box G)) = (edge_push xa \\ must_terminated_by (epda_gamma G) (epda_box G))\"\n in ballE)\n apply(rename_tac x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x xa)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rule conjI)\n apply(rename_tac xa)(*strict*)\n apply(simp add: option_to_set_def)\n apply(rename_tac xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa)(*strict*)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa a aa)(*strict*)\n apply(erule_tac\n P=\"edge_pop xa = a @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"a\"\n in exI)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa aa)(*strict*)\n apply(rule_tac\n x=\"edge_pop xa\"\n in exI)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa)(*strict*)\n apply(simp add: may_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa a aa)(*strict*)\n apply(erule_tac\n P=\"edge_pop xa = a @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"PB#a\"\n in exI)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa aa)(*strict*)\n apply(rule_tac\n x=\"PB#edge_pop xa\"\n in exI)\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(clarsimp)\n apply(simp add: must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa a)(*strict*)\n apply(case_tac a)\n apply(rename_tac xa a)(*strict*)\n apply(force)\n apply(rename_tac xa a aa list)(*strict*)\n apply(subgoal_tac \"\\w' x'. a = w' @ [x']\")\n apply(rename_tac xa a aa list)(*strict*)\n prefer 2\n apply(rule NonEmptyListHasTailElem)\n apply(force)\n apply(rename_tac xa a aa list)(*strict*)\n apply(thin_tac \"a=aa#list\")\n apply(clarsimp)\n apply(rename_tac xa w' x')(*strict*)\n apply(case_tac w')\n apply(rename_tac xa w' x')(*strict*)\n apply(force)\n apply(rename_tac xa w' x' a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(simp add: option_to_set_def)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa a aa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa a aa)(*strict*)\n apply(rule_tac\n x=\"[PB]\"\n in exI)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: valid_epda_step_label_def)\n apply(erule_tac\n x=\"xa\"\n and P=\"\\xa. edge_src xa \\ epda_states G \\ edge_trg xa \\ epda_states G \\ option_to_set (edge_event xa) \\ epda_events G \\ edge_pop xa \\ may_terminated_by (epda_gamma G) (epda_box G) \\ edge_push xa \\ may_terminated_by (epda_gamma G) (epda_box G) \\ (edge_pop xa \\ must_terminated_by (epda_gamma G) (epda_box G)) = (edge_push xa \\ must_terminated_by (epda_gamma G) (epda_box G))\"\n in ballE)\n apply(rename_tac xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac xa)(*strict*)\n apply(simp add: may_terminated_by_def must_terminated_by_def kleene_star_def append_language_def)\n apply(clarsimp)\n apply(rename_tac xa a aa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa a aa)(*strict*)\n apply(erule_tac\n P=\"edge_pop xa = a @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab)(*strict*)\n apply(rule_tac\n x=\"a\"\n in exI)\n apply(clarsimp)\n apply(rename_tac xa a aa ab x)(*strict*)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa aa)(*strict*)\n apply(rule_tac\n x=\"edge_pop xa\"\n in exI)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(rule conjI)\n apply(rename_tac xa a aa)(*strict*)\n apply(erule_tac\n P=\"edge_pop xa = a @ [epda_box G]\"\n in disjE)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab)(*strict*)\n apply(rule_tac\n x=\"ab\"\n in exI)\n apply(clarsimp)\n apply(rename_tac xa a aa ab x)(*strict*)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa aa)(*strict*)\n apply(rule_tac\n x=\"edge_push xa\"\n in exI)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(rule order_antisym)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab)(*strict*)\n apply(force)\n apply(rename_tac xa a aa)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa a aa ab)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__preserves_PDA: \"\n valid_dpda G\n \\ PB \\ epda_gamma G\n \\ valid_pda (F_DPDA_RNE G PB)\"\n apply(simp add: valid_pda_def)\n apply(rule conjI)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(force)\n apply(clarsimp)\n apply(simp add: valid_epda_def valid_pda_def valid_dpda_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac e x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n done\n\ntheorem F_DPDA_RNE__preserves_read_edges_seperated: \"\n valid_dpda G\n \\ read_edges_seperated G\n \\ PB \\ epda_gamma G\n \\ read_edges_seperated (F_DPDA_RNE G PB)\"\n apply(simp add: read_edges_seperated_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: strict_executing_edge_def FB_neutral_edge_def FB_executing_edge_def F_DPDA_RNE__edge_then_def)\n apply(clarsimp)\n apply(rename_tac e x y)(*strict*)\n apply(erule disjE)\n apply(rename_tac e x y)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac e x y)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac e)(*strict*)\n apply(simp add: strict_executing_edge_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: FB_executing_edge_def)\n done\n\ntheorem F_DPDA_RNE__produces_neutral_edges_removed: \"\n valid_dpda G\n \\ PB \\ epda_gamma G\n \\ neutral_edges_removed (F_DPDA_RNE G PB)\"\n apply(simp add: neutral_edges_removed_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule disjE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: FB_neutral_edge_def FB_executing_edge_def F_DPDA_RNE__edge_then_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: FB_neutral_edge_def)\n done\n\ndefinition F_DPDA_RNE__relation_structure__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_structure__LR G1 G2 \\\n valid_dpda G1\n \\ G2 = F_DPDA_RNE G1 (F_FRESH (epda_gamma G1))\"\n\ndefinition F_DPDA_RNE__relation_configuration__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_configuration__LR G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RNE__conf_old__LR c1\"\n\ndefinition F_DPDA_RNE__relation_initial_configuration__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_configuration__LR G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RNE__conf_old__LR c1\"\n\ndefinition F_DPDA_RNE__relation_effect__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_effect__LR G1 G2 w1 w2 \\\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ w1 = w2\"\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RNE__relation_structure__LR G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ valid_epda G2)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(rename_tac G1)(*strict*)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1)(*strict*)\n apply(force)\n apply(rename_tac G1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\ndefinition F_DPDA_RNE__conf_new__LR :: \"\n ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ 'stack DT_symbol\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf_new__LR c e PB \\\n \\epdaS_conf_state = cons_state_or_edge_new e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = [PB] @ epdaS_conf_stack c\\\"\n\ndefinition F_DPDA_RNE__relation_step_simulation__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ((('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label, (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_step_simulation__LR G1 G2 c1 e c1' c2 d \\\n if FB_neutral_edge e\n then d = der3\n (F_DPDA_RNE__conf_old__LR c1)\n (F_DPDA_RNE__edge_then_1 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__conf_new__LR c1 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__edge_then_2 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__conf_old__LR c1')\n else d = der2\n (F_DPDA_RNE__conf_old__LR c1)\n (F_DPDA_RNE__edge_else e)\n (F_DPDA_RNE__conf_old__LR c1')\"\n\ndefinition F_DPDA_RNE__relation_initial_simulation__LR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ((('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label, (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_simulation__LR G1 G2 c1 d \\\n d = der1 (F_DPDA_RNE__conf_old__LR c1)\"\n\nlemma F_DPDA_RNE__conf_old__LR_preserves_configurations: \"\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RNE__conf_old__LR c1 \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(force)\n done\n\nlemma F_DPDA_RNE__conf_old__LR_preserves_initial_configurations: \"\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RNE__conf_old__LR c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RNE__conf_old__LR_preserves_marking_configurations: \"\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_marking_configurations G1\n \\ F_DPDA_RNE__conf_old__LR c1 \\ epdaS_marking_configurations G2\"\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE_def)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RNE__initial_simulation_preserves_derivation: \"\n F_DPDA_RNE__relation_structure__LR G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ epdaS.derivation_initial G2 (der1 (F_DPDA_RNE__conf_old__LR c1))\"\n apply(rule epdaS.derivation_initialI)\n apply(rule epdaS.der1_is_derivation)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(clarsimp)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_initial_configurations)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RNE__relation_initial_configuration__LR G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RNE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__LR G1 G2 c1 (the (get_configuration (d2 n))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_simulation__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule F_DPDA_RNE__initial_simulation_preserves_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_configuration__LR_def)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def valid_pda_def valid_dpda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__relation_step_simulation__LR_maps_to_derivation: \"\n F_DPDA_RNE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RNE__relation_configuration__LR G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(clarsimp)\n apply(rule epdaS.der3_is_derivation)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__conf_new__LR_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(rule conjI)\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def FB_executing_edge_def)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI1)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__conf_new__LR_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(rule conjI)\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def FB_neutral_edge_def)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI1)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR_def F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def F_DPDA_RNE__relation_structure__LR_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI2)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RNE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__LR G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__LR_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der3_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis (full_types) epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: der3_def get_configuration_def F_DPDA_RNE__relation_configuration__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc(Suc 0)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac der3_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(simp add: der3_def get_configuration_def F_DPDA_RNE__relation_configuration__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__LR_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis (full_types) epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: get_configuration_def der2_def F_DPDA_RNE__relation_configuration__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp (no_asm) add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_configuration__LR F_DPDA_RNE__relation_structure__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_RNoOp_StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimLR\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__LR\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation_marking_condition: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RNE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf_old__LR ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(subgoal_tac \"c=c1'\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_def)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc deri1n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n apply(rule_tac\n x=\"deri2n+n\"\n in exI)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf_old__LR c1'\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i-deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RNE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR_def)\n apply(clarsimp)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf_old__LR ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der1_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_configuration__LR F_DPDA_RNE__relation_structure__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation_marking_condition)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__LR G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RNE__relation_step_simulation__LR G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RNE__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RNE__relation_initial_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation_marked_effect: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__LR G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RNE__relation_initial_simulation__LR G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RNE__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__LR_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RNE__relation_initial_configuration__LR_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RNE__conf_old__LR_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_DPDA_RNE__relation_configuration__LR F_DPDA_RNE__relation_initial_configuration__LR F_DPDA_RNE__relation_effect__LR F_DPDA_RNE__relation_structure__LR F_DPDA_RNE__relation_initial_simulation__LR F_DPDA_RNE__relation_step_simulation__LR\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimLR.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulation_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimLR.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulation_marked_effect)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimLR\" : ATS_Simulation_Configuration_Weak_Marked_Effect\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__LR\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__LR\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__LR\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__LR\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__LR\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__LR\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms )\n done\n\nlemma F_DPDA_RNE__preserves_lang1: \"\n valid_dpda (G :: ('state, 'event, 'list DT_symbol) epda)\n \\ epdaS.marked_language G \\ epdaS.marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(rule_tac\n t=\"epdaS.marked_language G\"\n and s=\"epdaS.finite_marked_language G\"\n in subst)\n apply(rule epdaS.AX_marked_language_finite)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaS.marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n and s=\"epdaS.finite_marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n in ssubst)\n apply(rule sym)\n apply(rule epdaS.AX_marked_language_finite)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(force)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(subgoal_tac \"left_total_on (F_DPDA_RNE__relation_effect__LR SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule_tac\n ?G1.0=\"G\"\n in epdaS_epdaS_RNoOp_StateSimLR.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_DPDA_RNE__relation_structure__LR_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(erule_tac\n x=\"x\"\n in ballE)\n apply(rename_tac x)(*strict*)\n apply(clarsimp)\n apply(rename_tac x b)(*strict*)\n prefer 2\n apply(rename_tac x)(*strict*)\n apply(force)\n apply(rename_tac x b)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__LR_def)\n done\n\ndefinition F_DPDA_RNE__relation_structure__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_structure__RL G1 G2 \\\n valid_dpda G2\n \\ G1 = F_DPDA_RNE G2 (F_FRESH (epda_gamma G2))\"\n\ndefinition F_DPDA_RNE__relation_configuration__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_configuration__RL G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RNE__conf__RL c1\"\n\ndefinition F_DPDA_RNE__relation_initial_configuration__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_configuration__RL G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RNE__conf__RL c1\"\n\ndefinition F_DPDA_RNE__relation_effect__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_effect__RL G1 G2 w1 w2 \\\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ w1 = w2\"\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RNE__relation_structure__RL G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G2)(*strict*)\n apply(force)\n apply(rename_tac G2)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ valid_epda G2)\"\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply (metis valid_dpda_def valid_pda_def)\n done\n\ndefinition F_DPDA_RNE__relation_step_simulation__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event , 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event , 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) epda_step_label, ('state, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_step_simulation__RL G1 G2 c1 e c1' c2 d \\\n case edge_trg e of cons_state_or_edge_old q\n \\ (case edge_src e of cons_state_or_edge_old q\n \\ d = der2\n (F_DPDA_RNE__conf__RL c1)\n (F_DPDA_RNE__edge__RL e)\n (F_DPDA_RNE__conf__RL c1')\n | cons_state_or_edge_new e\n \\ d = der1 (F_DPDA_RNE__conf__RL c1))\n | cons_state_or_edge_new e\n \\ d = der2\n (F_DPDA_RNE__conf__RL c1)\n e\n (F_DPDA_RNE__conf__RL c1')\"\n\ndefinition F_DPDA_RNE__relation_initial_simulation__RL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event , 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event , 'stack DT_symbol) epda_step_label, ('state, 'event , 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_simulation__RL G1 G2 c1 d \\\n d = der1 (F_DPDA_RNE__conf__RL c1)\"\n\ndefinition pseudo_box_top :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event , 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"pseudo_box_top G c \\\n case epdaS_conf_state c of cons_state_or_edge_old q\n \\ F_FRESH (epda_gamma G) \\ set (epdaS_conf_stack c)\n | cons_state_or_edge_new e\n \\ \\w. F_FRESH (epda_gamma G) \\ set w\n \\ [F_FRESH (epda_gamma G)] @ w = epdaS_conf_stack c\"\n\nlemma RNoOp_create_no_pseudo_box_in_the_configuration: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ epdaS.derivation_initial G1 d\n \\ d i = Some (pair e c1)\n \\ pseudo_box_top G2 c1\"\n apply(simp add: pseudo_box_top_def)\n apply(induct i arbitrary: e c1)\n apply(rename_tac e c1)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c1)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac c1)(*strict*)\n apply(subgoal_tac \"epda_box G2 \\ epda_gamma G2\")\n apply(rename_tac c1)(*strict*)\n apply(force)\n apply(rename_tac c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac c1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i e c1)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c1)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac i e c1)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1a\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"valid_epda_step_label G1 e2\")\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n prefer 2\n apply(subgoal_tac \"valid_epda G1\")\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac i c1 e1 e2 c1a q)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w)(*strict*)\n apply(case_tac \"edge_src e2\")\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(subgoal_tac \"set (edge_push x) \\ epda_gamma G2\")\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(rule epda_edge_in_gamma)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(case_tac \"edge_pop e2\")\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(case_tac \"epdaS_conf_state c1a\")\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n done\n\nlemma RNoOp_create_no_pseudo_box_in_the_configuration_prime: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ pseudo_box_top G2 c1\"\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac d i e)(*strict*)\n apply(rule RNoOp_create_no_pseudo_box_in_the_configuration)\n apply(rename_tac d i e)(*strict*)\n apply(force)+\n done\n\nlemma F_DPDA_RNE__conf__RL_preserves_configurations: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RNE__conf__RL c1 \\ epdaS_configurations G2\"\n apply(subgoal_tac \"case (epdaS_conf_state c1) of cons_state_or_edge_old q \\ (F_FRESH (epda_gamma G2) \\ set (epdaS_conf_stack c1)) | cons_state_or_edge_new e \\ (\\w. F_FRESH (epda_gamma G2) \\ set w \\ ([F_FRESH (epda_gamma G2)]@w) = epdaS_conf_stack c1)\")\n apply(simp (no_asm) add: epdaS_configurations_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(rename_tac q i s)(*strict*)\n apply(erule disjE)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(erule disjE)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(clarsimp)\n apply(rename_tac w i x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G2 x\"\n in ballE)\n apply(rename_tac w i x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w i x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w i x)(*strict*)\n apply(force)\n apply(fold pseudo_box_top_def)\n apply(rule RNoOp_create_no_pseudo_box_in_the_configuration_prime)\n apply(force)+\n done\n\nlemma F_DPDA_RNE__conf__RL_preserves_initial_configurations: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RNE__conf__RL c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE__relation_structure__RL_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RNE__relation_initial_configuration__RL G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RNE__relation_initial_simulation__RL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__RL G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_simulation__RL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rule F_DPDA_RNE__conf__RL_preserves_initial_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_initial_configuration__RL_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__relation_step_simulation__RL_maps_to_derivation: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ F_DPDA_RNE__relation_step_simulation__RL G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RNE__relation_configuration__RL G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac q qa)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf__RL_def F_DPDA_RNE__edge__RL_def)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: FB_neutral_edge_def)\n apply(case_tac x)\n apply(rename_tac q qa w x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(rename_tac e)\n apply(rename_tac e)(*strict*)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(rename_tac e w)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac e w)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac e w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(rename_tac e w)(*strict*)\n apply(clarsimp)\n apply(rename_tac e w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac e w x)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac e w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(clarsimp)\n apply(rename_tac e w)(*strict*)\n apply(simp add: FB_neutral_edge_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_step_relation_step_simulation: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RNE__relation_step_simulation__RL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__RL G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__RL_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR.AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RNE__relation_structure__LR_def F_DPDA_RNE__relation_structure__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule F_DPDA_RNE__conf__RL_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RNE__conf__RL_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE_def epda_step_labels_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext w x)(*strict*)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_exta w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_exta w x)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(simp add: option_to_list_def)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_exta w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' q epda_step_label_exta w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac G2 c1 e1 c1' q epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' q epda_step_label_ext w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__RL_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLR.AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RNE__relation_structure__LR_def F_DPDA_RNE__relation_structure__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_preserves_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_configuration__RL F_DPDA_RNE__relation_structure__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation epdaS_epdaS_RNoOp_StateSimRL_step_relation_step_simulation\n epdaS_epdaS_RNoOp_StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs\n epdaS_epdaS_RNoOp_StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimRL\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__RL\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__RL\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__RL\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__RL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\nlemma F_DPDA_RNE__conf__RL_preserves_marking_configurations: \"\n F_DPDA_RNE__relation_structure__RL G1 G2\n \\ c1 \\ epdaS_marking_configurations G1\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ F_DPDA_RNE__conf__RL c1 \\ epdaS_marking_configurations G2\"\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(force)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac epda_step_label_ext q)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext epda_step_label_exta)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rule F_DPDA_RNE__conf__RL_preserves_configurations)\n apply(force)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_step_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RNE__relation_step_simulation__RL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf__RL ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n t=\"ca\"\n and s=\"the (get_configuration (derivation_append deri1 (der2 c1 e1 c1') deri1n i))\"\n in ssubst)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(subgoal_tac \"c=c1'\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_def)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc deri1n\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n apply(rule_tac\n x=\"deri2n+n\"\n in exI)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf__RL c1'\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(rule_tac\n x=\"derivation_append deri1 (der2 c1 e1 c1') deri1n \"\n in exI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply (metis epdaS.derivation_initial_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(simp add: derivation_append_fit_def)\n apply(case_tac \"deri1 deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c option b)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n apply(rule_tac\n x=\"Suc deri1n\"\n in exI)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def der2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>Suc deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der2_def)\n apply(case_tac \"i-deri1n\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation_marking_condition: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RNE__relation_initial_simulation__RL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: epdaS_marking_condition_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i\\deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(simp add: derivation_append_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_def)\n apply(clarsimp)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL.simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(clarsimp)\n apply(case_tac y)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule_tac\n x=\"f i\"\n in exI)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(rule_tac\n x=\"c\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n t=\"c\"\n and s=\"F_DPDA_RNE__conf__RL ca\"\n in ssubst)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def derivation_append_def get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_preserves_marking_configurations)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(subgoal_tac \"i=deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(case_tac \"i>deri1n\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n apply(clarsimp)\n apply(simp add: derivation_append_def der1_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms: \"\n ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_configuration__RL F_DPDA_RNE__relation_structure__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL\"\n apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimRL_inst_relation_step_simulation_marking_condition)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation_marking_condition)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_step_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__RL G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. F_DPDA_RNE__relation_step_simulation__RL G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RNE__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__RL_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RNE__relation_initial_configuration__RL_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca q)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation_marked_effect: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. F_DPDA_RNE__relation_initial_simulation__RL G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ (\\deri1. epdaS.derivation_initial G1 deri1 \\ (\\deri1n. maximum_of_domain deri1 deri1n \\ (\\deri2. epdaS.derivation_initial G2 deri2 \\ (\\deri2n. maximum_of_domain deri2 deri2n \\ F_DPDA_RNE__relation_initial_configuration__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\ derivation_append_fit deri1 (der1 c1) deri1n \\ derivation_append_fit deri2 d2 deri2n \\ Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\ left_total_on (F_DPDA_RNE__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n apply(rename_tac f)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(rule_tac\n x=\"a\"\n in bexI)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__RL_def)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n apply(simp add: epdaS_marked_effect_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(subgoal_tac \"\\c. deri2 0 = Some (pair None c)\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n apply(simp add: derivation_append_def F_DPDA_RNE__relation_initial_configuration__RL_def)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(simp add: F_DPDA_RNE__conf__RL_def)\n apply(case_tac \"epdaS_conf_state c\")\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca q)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n apply(rule_tac\n M=\"G2\"\n in epdaS.some_position_has_details_at_0)\n apply (metis epdaS.derivation_initial_is_derivation)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms: \"\n ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_DPDA_RNE__relation_configuration__RL F_DPDA_RNE__relation_initial_configuration__RL F_DPDA_RNE__relation_effect__RL F_DPDA_RNE__relation_structure__RL F_DPDA_RNE__relation_initial_simulation__RL F_DPDA_RNE__relation_step_simulation__RL\"\n apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n apply(rule conjI)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimRL.relation_step_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimRL_inst_relation_step_simulation_marked_effect)\n apply(clarsimp)\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(rule epdaS_epdaS_RNoOp_StateSimRL.relation_initial_simulation_preservation_PROVE2)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 d1' d2')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(thin_tac \"epdaS_epdaS_RNoOp_StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n apply(metis epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulation_marked_effect)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimRL\" : ATS_Simulation_Configuration_Weak_Marked_Effect\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__RL\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__RL\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__RL\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__RL\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__RL\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__RL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms)\n done\n\nlemma F_DPDA_RNE__preserves_lang2: \"\n valid_dpda (G :: ('state, 'event, 'stack DT_symbol) epda)\n \\ epdaS.marked_language G \\ epdaS.marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(rule_tac\n t=\"epdaS.marked_language G\"\n and s=\"epdaS.finite_marked_language G\"\n in subst)\n apply(rule epdaS.AX_marked_language_finite)\n apply(simp add: valid_dpda_def valid_pda_def)\n apply(rule_tac\n t=\"epdaS.marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n and s=\"epdaS.finite_marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n in ssubst)\n apply(rule sym)\n apply(rule epdaS.AX_marked_language_finite)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(force)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(subgoal_tac \"left_total_on (F_DPDA_RNE__relation_effect__RL SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n prefer 2\n apply(rule_tac\n ?G2.0=\"G\"\n in epdaS_epdaS_RNoOp_StateSimRL.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_effect__RL_def)\n done\n\ntheorem F_DPDA_RNE__preserves_lang: \"\n valid_dpda G\n \\ epdaS.marked_language G = epdaS.marked_language (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(rule order_antisym)\n apply (metis F_DPDA_RNE__preserves_lang1)\n apply (metis F_DPDA_RNE__preserves_lang2)\n done\n\nlemma F_DPDA_RNE__conf__RL_reflects_steps2: \"\n x \\ epda_delta G\n \\ epdaS_step_relation (F_DPDA_RNE G PB) c (F_DPDA_RNE__edge_else x) c1\n \\ epdaS_step_relation G (F_DPDA_RNE__conf__RL c) x (F_DPDA_RNE__conf__RL c1)\"\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE__edge_else_def)\n done\n\nlemma F_DPDA_RNE__conf__RL_reflects_steps1: \"\n x \\ epda_delta G\n \\ epdaS_step_relation (F_DPDA_RNE G PB) c (F_DPDA_RNE__edge_then_1 x PB) c1\n \\ epdaS_step_relation G (F_DPDA_RNE__conf__RL c) x (F_DPDA_RNE__conf__RL c1)\"\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def F_DPDA_RNE__edge_then_1_def)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac w xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: FB_neutral_edge_def)\n apply(rename_tac w xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w xa)(*strict*)\n apply(simp add: FB_neutral_edge_def F_DPDA_RNE__edge_else_def)\n done\n\nlemma PseudoBox_is_translated_backwards: \"\n valid_dpda G2\n \\ e1 \\ epda_step_labels (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2)))\n \\ c1' \\ epdaS_configurations (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2)))\n \\ epdaS_step_relation (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2))) c1' e1 c1\n \\ pseudo_box_top G2 c1\n \\ pseudo_box_top G2 c1'\"\n apply(simp add: pseudo_box_top_def)\n apply(case_tac \"epdaS_conf_state c1'\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q qa)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(simp add: epda_step_labels_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(simp add: F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_then_1_def)\n apply(erule disjE)\n apply(rename_tac q qa w x)(*strict*)\n apply(force)\n apply(rename_tac q qa w x)(*strict*)\n apply(force)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac w x)(*strict*)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac w x)(*strict*)\n apply(force)\n apply(rename_tac w x)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac w x)(*strict*)\n apply(rule_tac\n A=\"set (edge_pop x)\"\n in set_mp)\n apply(rename_tac w x)(*strict*)\n apply(rule valid_epda_pop_in_gamma)\n apply(rename_tac w x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac w x)(*strict*)\n apply(force)\n apply(rename_tac w x)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac q epda_step_label_ext w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac q epda_step_label_ext w wa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_then_1_def epda_step_labels_def)\n apply(rename_tac q epda_step_label_exta w wa)(*strict*)\n apply(subgoal_tac \"\\x\\ epda_delta G2 \\ Collect FB_neutral_edge. e1 = \\edge_src = cons_state_or_edge_old (edge_src x), edge_event = None, edge_pop = edge_pop x, edge_push = F_FRESH (epda_gamma G2) # edge_pop x, edge_trg = cons_state_or_edge_new x\\ \\ e1 = \\edge_src = cons_state_or_edge_new x, edge_event = None, edge_pop = [F_FRESH (epda_gamma G2)], edge_push = [], edge_trg = cons_state_or_edge_old (edge_trg x)\\\")\n prefer 2\n apply(force)\n apply(rename_tac q epda_step_label_exta w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(erule_tac\n P=\"F_FRESH (epda_gamma G2) \\ set (edge_pop e1)\"\n in disjE)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(erule disjE)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(clarsimp)\n apply(force)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(erule disjE)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_exta w wa x)(*strict*)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac epda_step_label_ext q)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext q w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_then_1_def epda_step_labels_def)\n apply(rename_tac epda_step_label_exta q w)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext epda_step_label_exta)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext epda_step_label_exta w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_then_1_def epda_step_labels_def)\n apply(rename_tac epda_step_label_exta epda_step_label_extaa w wa)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__conf__RL_preserves_configurations2: \"\n valid_dpda G2\n \\ c1' \\ epdaS_configurations (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2)))\n \\ pseudo_box_top G2 c1'\n \\ F_DPDA_RNE__conf__RL c1' \\ epdaS_configurations G2\"\n apply(simp add: F_DPDA_RNE__conf__RL_def epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(case_tac q)\n apply(rename_tac q i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(simp add: pseudo_box_top_def F_DPDA_RNE_def)\n apply(erule disjE)\n apply(rename_tac i s qa)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac i s qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s x xa)(*strict*)\n apply(force)\n apply(rename_tac q i s epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac i s epda_step_label_ext)(*strict*)\n apply(simp add: pseudo_box_top_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac i epda_step_label_ext w)(*strict*)\n apply(erule disjE)\n apply(rename_tac i epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i w x)(*strict*)\n apply(subgoal_tac \"valid_epda_step_label G2 x\")\n apply(rename_tac i w x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(rename_tac i w x xa)(*strict*)\n apply(force)\n apply(rename_tac i w x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma F_DPDA_RNE__preserves_epdaS_step_relation: \"\n c1' \\ epdaS_configurations (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2)))\n \\ epdaS_step_relation (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2))) c1' e1 c1\n \\ valid_dpda G2\n \\ c1 \\ epdaS_configurations (F_DPDA_RNE G2 (F_FRESH (epda_gamma G2)))\n \\ pseudo_box_top G2 c1'\n \\ pseudo_box_top G2 c1\n \\ edge_trg e1 = cons_state_or_edge_new e\n \\ epdaS_step_relation G2 (F_DPDA_RNE__conf__RL c1') e (F_DPDA_RNE__conf__RL c1)\"\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac w x)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL_def option_to_list_def pseudo_box_top_def FB_neutral_edge_def)\n apply(rename_tac w x)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac w)(*strict*)\n apply(clarsimp)\n apply(rename_tac w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n done\n\ntheorem F_DPDA_RNE__preserves_is_forward_edge_deterministic_accessible: \"\n valid_dpda (G :: ('state, 'event, 'stack DT_symbol) epda)\n \\ epdaS.is_forward_edge_deterministic_accessible (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e1 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"edge_src e2 = epdaS_conf_state c\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e1)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 w wa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (option_to_list (edge_event e2)) (epdaS_conf_scheduler c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e1) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"prefix (edge_pop e2) (epdaS_conf_stack c)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: prefix_def)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e1 \\ epda_delta (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"e2 \\ epda_delta (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"epdaS.is_forward_edge_deterministic_accessible G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: valid_dpda_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n apply(erule_tac\n x=\"F_DPDA_RNE__conf__RL c\"\n in ballE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n x=\"F_DPDA_RNE__conf__RL c1\"\n in allE)\n apply(erule_tac\n x=\"F_DPDA_RNE__conf__RL c2\"\n in allE)\n apply(subgoal_tac \"(\\x\\ epda_delta G \\ Collect FB_neutral_edge. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G))) \\ (\\x\\ epda_delta G \\ {e. \\ FB_neutral_edge e}. e1 = F_DPDA_RNE__edge_else x)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE_def)\n apply(blast)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G \\ Collect FB_neutral_edge. e2 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G))) \\ (\\x\\ epda_delta G \\ {e. \\ FB_neutral_edge e}. e2 = F_DPDA_RNE__edge_else x)\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE_def)\n apply(blast)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G \\ Collect FB_neutral_edge. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G))\"\n in disjE)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e1 e2 x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule_tac\n P=\"e1 = F_DPDA_RNE__edge_then_1 x (F_FRESH (epda_gamma G))\"\n in disjE)\n apply(rename_tac c c1 c2 e1 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps1)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps1)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps1)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps2)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps2)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps1)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e2 x xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def epdaS_step_relation_def)\n apply(rename_tac c c1 c2 e2 x)(*strict*)\n apply(clarsimp)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule_tac\n x=\"xa\"\n in allE)\n apply(erule impE)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule conjI)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps2)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL_reflects_steps2)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 x xa)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(subgoal_tac \"F_DPDA_RNE__conf__RL c \\ epdaS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(force)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(thin_tac \"F_DPDA_RNE__conf__RL c \\ epdaS.get_accessible_configurations G\")\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(rule_tac\n ?c1.0=\"c\"\n in epdaS_epdaS_RNoOp_StateSimRL.get_accessible_configurations_transfer)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply (metis (full_types) F_DPDA_RNE__conf__RL_preserves_configurations2 RNoOp_create_no_pseudo_box_in_the_configuration_prime F_DPDA_RNE__relation_structure__RL_def epdaS.get_accessible_configurations_are_configurations2 epdaS_epdaS_RNoOp_StateSimRL.AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL_def)\n apply(rename_tac c c1 c2 e1 e2 cA cB)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL_def)\n apply(rename_tac c c1 c2 e1 e2)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__preserves_DPDA: \"\n valid_dpda G\n \\ valid_dpda (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(simp (no_asm) add: valid_dpda_def)\n apply(rule conjI)\n apply(rule F_DPDA_RNE__preserves_PDA)\n apply(force)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply (metis F_DPDA_RNE__preserves_is_forward_edge_deterministic_accessible)\n done\n\ndefinition F_DPDA_RNE__edge__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epda_step_label\n \\ ('state, 'event, 'stack) epda_step_label\"\n where\n \"F_DPDA_RNE__edge__RL2 e \\\n \\edge_src = case edge_src e of cons_state_or_edge_old q \\ q,\n edge_event = edge_event e,\n edge_pop = edge_pop e,\n edge_push = edge_push e,\n edge_trg = case edge_trg e of cons_state_or_edge_old q \\ q\\\"\n\ndefinition F_DPDA_RNE__conf_old__LR2 :: \"\n ('state, 'event, 'stack) epdaS_conf\n \\ (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf_old__LR2 c \\\n \\epdaS_conf_state = cons_state_or_edge_old (epdaS_conf_state c),\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\"\n\ndefinition F_DPDA_RNE__conf__RL2 :: \"\n (('state, 'event, 'stack) DT_state_or_edge, 'event, 'stack) epdaS_conf\n \\ ('state, 'event, 'stack) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf__RL2 c \\\n case epdaS_conf_state c of cons_state_or_edge_old q\n \\ \\epdaS_conf_state = q,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = epdaS_conf_stack c\\\n | cons_state_or_edge_new e\n \\ \\epdaS_conf_state = edge_src e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = drop (Suc 0) (epdaS_conf_stack c)\\\"\n\ndefinition F_DPDA_RNE__relation_structure__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_structure__LR2 G1 G2 \\\n valid_dpda G1\n \\ G2 = F_DPDA_RNE G1 (F_FRESH (epda_gamma G1))\"\n\ndefinition F_DPDA_RNE__relation_configuration__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RNE__conf_old__LR2 c1\"\n\ndefinition F_DPDA_RNE__relation_initial_configuration__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_configuration__LR2 G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RNE__conf_old__LR2 c1\"\n\ndefinition F_DPDA_RNE__relation_effect__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_effect__LR2 G1 G2 w1 w2 \\\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ w1 = w2\"\n\nlemma epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RNE__relation_structure__LR2 G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR2 G1 G2 \\ valid_epda G2)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(rename_tac G1)(*strict*)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1)(*strict*)\n apply(force)\n apply(rename_tac G1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\ndefinition F_DPDA_RNE__conf_new__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ 'stack DT_symbol\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\"\n where\n \"F_DPDA_RNE__conf_new__LR2 c e PB \\\n \\epdaS_conf_state = cons_state_or_edge_new e,\n epdaS_conf_scheduler = epdaS_conf_scheduler c,\n epdaS_conf_stack = [PB] @ epdaS_conf_stack c\\\"\n\ndefinition F_DPDA_RNE__relation_step_simulation__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ((('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label, (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_step_simulation__LR2 G1 G2 c1 e c1' c2 d \\\n if FB_neutral_edge e\n then d = der3\n (F_DPDA_RNE__conf_old__LR2 c1)\n (F_DPDA_RNE__edge_then_1 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__conf_new__LR2 c1 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__edge_then_2 e (F_FRESH (epda_gamma G1)))\n (F_DPDA_RNE__conf_old__LR2 c1')\n else d = der2\n (F_DPDA_RNE__conf_old__LR2 c1)\n (F_DPDA_RNE__edge_else e)\n (F_DPDA_RNE__conf_old__LR2 c1')\"\n\ndefinition F_DPDA_RNE__relation_initial_simulation__LR2 :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ ((('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label, (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_simulation__LR2 G1 G2 c1 d \\\n d = der1 (F_DPDA_RNE__conf_old__LR2 c1)\"\n\nlemma F_DPDA_RNE__conf_old__LR2_preserves_configurations: \"\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RNE__conf_old__LR2 c1 \\ epdaS_configurations G2\"\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(force)\n done\n\nlemma F_DPDA_RNE__conf_old__LR2_preserves_initial_configurations: \"\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RNE__conf_old__LR2 c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(rule F_DPDA_RNE__conf_old__LR2_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RNE__conf_old__LR2_preserves_marking_configurations: \"\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS_marking_configurations G1\n \\ F_DPDA_RNE__conf_old__LR2 c1 \\ epdaS_marking_configurations G2\"\n apply(simp add: epdaS_marking_configurations_def)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE_def)\n apply(rule F_DPDA_RNE__conf_old__LR2_preserves_configurations)\n apply(force)\n apply(force)\n done\n\nlemma F_DPDA_RNE__initial_simulation_preserves_derivationX: \"\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ epdaS.derivation_initial G2 (der1 (F_DPDA_RNE__conf_old__LR2 c1))\"\n apply(rule epdaS.derivation_initialI)\n apply(rule epdaS.der1_is_derivation)\n apply(clarsimp)\n apply(rename_tac c)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(clarsimp)\n apply(rule F_DPDA_RNE__conf_old__LR2_preserves_initial_configurations)\n apply(force)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulationX: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__LR2 G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RNE__relation_initial_configuration__LR2 G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RNE__relation_initial_simulation__LR2 G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 (the (get_configuration (d2 n))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_simulation__LR2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule F_DPDA_RNE__initial_simulation_preserves_derivationX)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_configuration__LR2_def)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def valid_pda_def valid_dpda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__relation_step_simulation__LR2_maps_to_derivation: \"\n F_DPDA_RNE__relation_step_simulation__LR2 G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(clarsimp)\n apply(rule epdaS.der3_is_derivation)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__conf_new__LR2_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(rule conjI)\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def FB_executing_edge_def)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI1)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__conf_new__LR2_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(rule conjI)\n apply(rename_tac w)(*strict*)\n prefer 2\n apply(simp add: option_to_list_def FB_neutral_edge_def)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI1)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf_old__LR2_def F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE_def)\n apply(rule_tac\n x=\"e1\"\n in bexI_image_disjI2)\n apply(blast)\n apply(rename_tac w)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulationX: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__LR2 G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RNE__relation_step_simulation__LR2 G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__LR2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der3_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR2_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis (full_types) epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: der3_def get_configuration_def F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc(Suc 0)\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac der3_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(simp add: der3_def get_configuration_def F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__LR2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule F_DPDA_RNE__conf_old__LR2_preserves_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n apply (metis (full_types) epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: get_configuration_def der2_def F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp (no_asm) add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(rule epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__LR2 F_DPDA_RNE__relation_initial_configuration__LR2 F_DPDA_RNE__relation_structure__LR2 F_DPDA_RNE__relation_initial_simulation__LR2 F_DPDA_RNE__relation_step_simulation__LR2\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_relation_initial_simulationX epdaS_epdaS_RNoOp_StateSimLR_inst_relation_step_simulationX\n epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs\n epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimLRX\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__LR2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__LR2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__LR2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__LR2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__LR2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__LR2\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX)\n done\n\ndefinition F_DPDA_RNE__relation_structure__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_structure__RL2 G1 G2 \\\n valid_dpda G2\n \\ G1 = F_DPDA_RNE G2 (F_FRESH (epda_gamma G2))\"\n\ndefinition F_DPDA_RNE__relation_configuration__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c2 = F_DPDA_RNE__conf__RL2 c1\"\n\ndefinition F_DPDA_RNE__relation_initial_configuration__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_configuration__RL2 G1 G2 c1 c2 \\\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ c2 = F_DPDA_RNE__conf__RL2 c1\"\n\ndefinition F_DPDA_RNE__relation_effect__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ 'event list\n \\ 'event list\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_effect__RL2 G1 G2 w1 w2 \\\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ w1 = w2\"\n\nlemma epdaS_epdaS_RNoOp_StateSimRLX_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n (\\G1. Ex (F_DPDA_RNE__relation_structure__RL2 G1) \\ valid_epda G1)\"\n apply(clarsimp)\n apply(rename_tac G1 G2)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G2)(*strict*)\n apply(force)\n apply(rename_tac G2)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRLX_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL2 G1 G2 \\ valid_epda G2)\"\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(rename_tac G2)(*strict*)\n apply (metis valid_dpda_def valid_pda_def)\n done\n\ndefinition F_DPDA_RNE__relation_step_simulation__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event , 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event , 'stack DT_symbol) epdaS_conf\n \\ ('state, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event, 'stack DT_symbol) epda_step_label, ('state, 'event, 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_step_simulation__RL2 G1 G2 c1 e c1' c2 d \\\n case edge_trg e of cons_state_or_edge_old q\n \\ (case edge_src e of cons_state_or_edge_old q\n \\ d = der2\n (F_DPDA_RNE__conf__RL2 c1)\n (F_DPDA_RNE__edge__RL2 e)\n (F_DPDA_RNE__conf__RL2 c1')\n | cons_state_or_edge_new e\n \\ d = der2\n (F_DPDA_RNE__conf__RL2 c1)\n e\n (F_DPDA_RNE__conf__RL2 c1'))\n | cons_state_or_edge_new e\n \\ d = der1 (F_DPDA_RNE__conf__RL2 c1)\"\n\ndefinition F_DPDA_RNE__relation_initial_simulation__RL2 :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event , 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epdaS_conf\n \\ (('state, 'event , 'stack DT_symbol) epda_step_label, ('state, 'event , 'stack DT_symbol) epdaS_conf) derivation\n \\ bool\"\n where\n \"F_DPDA_RNE__relation_initial_simulation__RL2 G1 G2 c1 d \\\n d = der1 (F_DPDA_RNE__conf__RL2 c1)\"\n\nlemma RNoOp_create_no_pseudo_box_in_the_configurationX: \"\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ epdaS.derivation_initial G1 d\n \\ d i = Some (pair e c1)\n \\ pseudo_box_top G2 c1\"\n apply(simp add: pseudo_box_top_def)\n apply(induct i arbitrary: e c1)\n apply(rename_tac e c1)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac c1)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac c1)(*strict*)\n apply(subgoal_tac \"epda_box G2 \\ epda_gamma G2\")\n apply(rename_tac c1)(*strict*)\n apply(force)\n apply(rename_tac c1)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac c1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i e c1)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d i = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac i e c1)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac i e c1)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(force)\n apply(rename_tac i e c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(erule_tac\n x=\"e1\"\n in meta_allE)\n apply(erule_tac\n x=\"c1a\"\n in meta_allE)\n apply(clarsimp)\n apply(subgoal_tac \"valid_epda_step_label G1 e2\")\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n prefer 2\n apply(subgoal_tac \"valid_epda G1\")\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply (rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 e2 c1a)(*strict*)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac i c1 e1 e2 c1a q)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w)(*strict*)\n apply(case_tac \"edge_src e2\")\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q w qa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q w qa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w qa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(clarsimp)\n apply(subgoal_tac \"F_FRESH (epda_gamma G2) \\ epda_gamma G2\")\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(subgoal_tac \"set (edge_push x) \\ epda_gamma G2\")\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(rule epda_edge_in_gamma)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(force)\n apply(rename_tac i c1 e1 c1a w x)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q w epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(case_tac \"edge_pop e2\")\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a q epda_step_label_ext wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a q epda_step_label_ext wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a q w epda_step_label_ext wa a list)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(case_tac \"epdaS_conf_state c1a\")\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q)(*strict*)\n apply(clarsimp)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext q w)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext q w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac i c1 e1 e2 c1a epda_step_label_ext epda_step_label_exta w wa)(*strict*)\n apply(clarsimp)\n apply(rename_tac i c1 e1 c1a epda_step_label_ext epda_step_label_exta w wa x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n done\n\nlemma RNoOp_create_no_pseudo_box_in_the_configuration_primeX: \"\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ pseudo_box_top G2 c1\"\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac d i)(*strict*)\n apply(case_tac \"d i\")\n apply(rename_tac d i)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac d i option b)(*strict*)\n apply(rename_tac e c)\n apply(rename_tac d i e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac d i e)(*strict*)\n apply(rule RNoOp_create_no_pseudo_box_in_the_configurationX)\n apply(rename_tac d i e)(*strict*)\n apply(force)+\n done\n\nlemma F_DPDA_RNE__conf__RL2_preserves_configurationsX: \"\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ c1 \\ epdaS.get_accessible_configurations G1\n \\ c1 \\ epdaS_configurations G1\n \\ F_DPDA_RNE__conf__RL2 c1 \\ epdaS_configurations G2\"\n apply(subgoal_tac \"case (epdaS_conf_state c1) of cons_state_or_edge_old q \\ (F_FRESH (epda_gamma G2) \\ set (epdaS_conf_stack c1)) | cons_state_or_edge_new e \\ (\\w. F_FRESH (epda_gamma G2) \\ set w \\ ([F_FRESH (epda_gamma G2)]@w) = epdaS_conf_stack c1)\")\n apply(simp (no_asm) add: epdaS_configurations_def)\n apply(case_tac \"epdaS_conf_state c1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf__RL2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac q i s)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(rename_tac q i s)(*strict*)\n apply(erule disjE)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac q i s)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(erule disjE)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(force)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(clarsimp)\n apply(rename_tac w i x)(*strict*)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(clarsimp)\n apply(erule_tac\n x=\"x\"\n and P=\"\\x. valid_epda_step_label G2 x\"\n in ballE)\n apply(rename_tac w i x)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac w i x)(*strict*)\n apply(simp add: valid_epda_step_label_def)\n apply(rename_tac epda_step_label_ext w i)(*strict*)\n apply(clarsimp)\n apply(rename_tac epda_step_label_ext w i x)(*strict*)\n apply(force)\n apply(fold pseudo_box_top_def)\n apply(rule RNoOp_create_no_pseudo_box_in_the_configuration_primeX)\n apply(force)+\n done\n\nlemma F_DPDA_RNE__conf__RL2_preserves_initial_configurations: \"\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ c1 \\ epdaS_initial_configurations G1\n \\ F_DPDA_RNE__conf__RL2 c1 \\ epdaS_initial_configurations G2\"\n apply(simp add: epdaS_initial_configurations_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule conjI)\n apply(simp add: F_DPDA_RNE__conf__RL2_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(simp add: epdaS_configurations_def)\n apply(clarsimp)\n apply(rename_tac i)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL2_def F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def)\n apply(clarsimp)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulationX: \"\n (\\G1 G2. F_DPDA_RNE__relation_structure__RL2 G1 G2 \\ (\\c1. c1 \\ epdaS_initial_configurations G1 \\ (\\d2. epdaS.derivation_initial G2 d2 \\ F_DPDA_RNE__relation_initial_configuration__RL2 G1 G2 c1 (the (get_configuration (d2 0))) \\ F_DPDA_RNE__relation_initial_simulation__RL2 G1 G2 c1 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_initial_simulation__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.derivation_initialI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rule F_DPDA_RNE__conf__RL2_preserves_initial_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_initial_configuration__RL2_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule epdaS.initial_configurations_are_get_accessible_configurations)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1)(*strict*)\n apply(force)\n done\n\nlemma F_DPDA_RNE__relation_step_simulation__RL2_maps_to_derivation: \"\n F_DPDA_RNE__relation_structure__RL2 G1 G2\n \\ F_DPDA_RNE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2 d2\n \\ F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2\n \\ epdaS_step_relation G1 c1 e1 c1'\n \\ epdaS.derivation G2 d2\"\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac q qa)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf__RL2_def F_DPDA_RNE__edge__RL2_def)\n apply(clarsimp)\n apply(rename_tac q qa w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac q qa w)(*strict*)\n apply(clarsimp)\n apply(rename_tac q qa w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: FB_neutral_edge_def)\n apply(case_tac x)\n apply(rename_tac q qa w x edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n apply(force)\n apply(rename_tac q epda_step_label_ext)(*strict*)\n prefer 2\n apply(rename_tac epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac q epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rename_tac e)\n apply(rename_tac q e)(*strict*)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ Collect FB_neutral_edge. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G2))) \\ (\\x\\ epda_delta G2 \\ {e. \\ FB_neutral_edge e}. e1 = F_DPDA_RNE__edge_else x)\")\n apply(rename_tac q e)(*strict*)\n prefer 2\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(simp add: F_DPDA_RNE_def)\n apply(blast)\n apply(rename_tac q e)(*strict*)\n apply(erule disjE)\n apply(rename_tac q e)(*strict*)\n apply(clarsimp)\n apply(rename_tac q e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac q e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac q e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n prefer 2\n apply(rename_tac q e)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac e)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def F_DPDA_RNE__conf__RL2_def)\n apply(rule conjI)\n apply(rename_tac e)(*strict*)\n apply(simp add: FB_neutral_edge_def)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac e)(*strict*)\n apply(clarsimp)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(rename_tac e x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rename_tac x)(*strict*)\n prefer 2\n apply(rename_tac e)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(blast)\n apply(rename_tac x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(simp add: epdaS.get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac x d i)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac x d i)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac x d i a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d i option)(*strict*)\n apply(case_tac i)\n apply(rename_tac x d i option)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(clarsimp)\n apply(rename_tac x d)(*strict*)\n apply(simp add: epdaS_initial_configurations_def)\n apply(rename_tac x d i option nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d option nat)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d nat = Some (pair e1 c1) \\ SSd (Suc SSn) = Some (pair (Some e2) c2) \\ epdaS_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n apply(rename_tac x d option nat)(*strict*)\n prefer 2\n apply(rule epdaS.step_detail_before_some_position)\n apply(rename_tac x d option nat)(*strict*)\n apply(simp add: epdaS.derivation_initial_def)\n apply(force)\n apply(rename_tac x d option nat)(*strict*)\n apply(force)\n apply(rename_tac x d option nat)(*strict*)\n apply(force)\n apply(rename_tac x d option nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d nat e1 e2 c1a)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac x d nat e1 e2 c1a w)(*strict*)\n apply(erule disjE)\n apply(rename_tac x d nat e1 e2 c1a w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d nat e1 e2 c1a w xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def FB_neutral_edge_def)\n apply(rename_tac x d nat e1 e2 c1a w xa)(*strict*)\n apply(clarsimp)\n apply(erule disjE)\n apply(rename_tac x d nat e1 e2 c1a w)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d nat e1 e2 c1a w xa)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def FB_neutral_edge_def)\n apply(rename_tac x d nat e1 e2 c1a w xa)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__edge_else_def FB_neutral_edge_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_step_relation_step_simulationX: \"\n \\G1 G2. F_DPDA_RNE__relation_structure__RL2 G1 G2 \\ (\\c1 c2. F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2 \\ (\\e1. e1 \\ epda_step_labels G1 \\ (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\ (\\d2. epdaS.derivation G2 d2 \\ epdaS.belongs G2 d2 \\ the (get_configuration (d2 0)) = c2 \\ F_DPDA_RNE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2 d2 \\ (\\n. maximum_of_domain d2 n \\ F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q)(*strict*)\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__RL2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE__relation_structure__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule F_DPDA_RNE__conf__RL2_preserves_configurationsX)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply (metis)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q qa)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.der1_is_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.der1_belongs)\n apply(rule F_DPDA_RNE__conf__RL2_preserves_configurationsX)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule_tac\n x=\"0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__conf__RL2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext)(*strict*)\n apply(simp add: epdaS_step_relation_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(clarsimp)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext w)(*strict*)\n apply(simp add: F_DPDA_RNE_def epda_step_labels_def)\n apply(clarsimp)\n apply(erule disjE)\n prefer 2\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_exta w x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(simp add: option_to_list_def)\n apply(rename_tac G2 c1 e1 c1' epda_step_label_ext w)(*strict*)\n apply(clarsimp)\n apply(rename_tac G2 c1 c1' epda_step_label_ext w x)(*strict*)\n apply(erule disjE)\n apply(force)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_DPDA_RNE__relation_step_simulation__RL2_maps_to_derivation)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_belongs_prime)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply (metis epdaS_epdaS_RNoOp_StateSimLRX_inst_AX_TSstructure_relation_TSstructure1_belongs F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE__relation_structure__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_DPDA_RNE__conf__RL2_preserves_configurationsX)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule_tac\n A=\"epdaS.get_accessible_configurations G1\"\n in set_mp)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.get_accessible_configurations_are_configurations)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: get_configuration_def der2_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp (no_asm) add: der2_def get_configuration_def)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(rule_tac\n ?e1.0=\"e1\"\n in epdaS.der2_preserves_get_accessible_configurations)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac G1 G2 c1 c2 e1 c1' q epda_step_label_ext)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(force)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX: \"\n ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__RL2 F_DPDA_RNE__relation_initial_configuration__RL2 F_DPDA_RNE__relation_structure__RL2 F_DPDA_RNE__relation_initial_simulation__RL2 F_DPDA_RNE__relation_step_simulation__RL2\"\n apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def epdaS_epdaS_RNoOp_StateSimRL_inst_relation_initial_simulationX epdaS_epdaS_RNoOp_StateSimRL_step_relation_step_simulationX epdaS_epdaS_RNoOp_StateSimRLX_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_RNoOp_StateSimRLX_inst_AX_TSstructure_relation_TSstructure2_belongs)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimRLX\" : ATS_Simulation_Configuration_Weak\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__RL2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__RL2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__RL2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__RL2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__RL2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__RL2\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX)\n done\n\ndefinition RNoOpX_relation_labelsLR :: \"\n ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label\n \\ bool\"\n where\n \"RNoOpX_relation_labelsLR G1 G2 e1 e2 \\\n F_DPDA_RNE__relation_structure__LR2 G1 G2\n \\ e1 \\ F_DPDA_DRE__revert_F_DPDA_RNE G1 (F_FRESH (epda_gamma G1)) {e2}\"\n\nlemma ATS_Simulation_Configuration_WeakReach_axioms_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n ATS_Simulation_Configuration_WeakReach_axioms epda_step_labels epdaS_step_relation epdaS_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__LR2 F_DPDA_RNE__relation_structure__LR2 F_DPDA_RNE__relation_step_simulation__LR2 RNoOpX_relation_labelsLR\"\n apply(simp add: ATS_Simulation_Configuration_WeakReach_axioms_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n)(*strict*)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(rule_tac\n x=\"1\"\n in exI)\n apply(simp add: der3_def epda_step_labels_def F_DPDA_RNE__edge_then_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n)(*strict*)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(rule_tac\n x=\"1\"\n in exI)\n apply(simp add: der2_def epda_step_labels_def F_DPDA_RNE__edge_then_def)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimLRX\" : ATS_Simulation_Configuration_WeakReach\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__LR2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__LR2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__LR2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__LR2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__LR2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__LR2\"\n (* relation_labelsLR *)\n \"RNoOpX_relation_labelsLR\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX ATS_Simulation_Configuration_WeakReach_axioms_inst_ATS_Simulation_Configuration_Weak_axioms)\n done\n\ndefinition RNoOpX_relation_labelsRL :: \"\n (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda\n \\ ('state, 'event, 'stack DT_symbol) epda\n \\ (('state, 'event, 'stack DT_symbol) DT_state_or_edge, 'event, 'stack DT_symbol) epda_step_label\n \\ ('state, 'event, 'stack DT_symbol) epda_step_label\n \\ bool\"\n where\n \"RNoOpX_relation_labelsRL G2 G1 e2 e1 \\\n F_DPDA_RNE__relation_structure__RL2 G2 G1\n \\ e1 \\ F_DPDA_DRE__revert_F_DPDA_RNE G1 (F_FRESH (epda_gamma G1)) {e2}\"\n\nlemma RNoOp_ATS_Simulation_Configuration_WeakReach_axioms_inst_ATS_Simulation_Configuration_WeakRL_axioms: \"\n ATS_Simulation_Configuration_WeakReach_axioms epda_step_labels epdaS_step_relation epdaS_configurations epda_step_labels epdaS_step_relation F_DPDA_RNE__relation_configuration__RL2 F_DPDA_RNE__relation_structure__RL2 F_DPDA_RNE__relation_step_simulation__RL2 RNoOpX_relation_labelsRL\"\n apply(simp add: ATS_Simulation_Configuration_WeakReach_axioms_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. FB_neutral_edge e}. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G2))) \\ (\\x\\ epda_delta G2 \\ {e. (\\ FB_neutral_edge e)}. e1 = F_DPDA_RNE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def epda_step_labels_def)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. FB_neutral_edge e}. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G2))\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n t=\"epda_delta G2\"\n and s=\"epda_step_labels G2\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n i=\"Suc 0\"\n in epdaS.belongs_step_labels)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE__edge__RL2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"(der1 (F_DPDA_RNE__conf__RL2 c1))\"\n in epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"(der1 (F_DPDA_RNE__conf__RL2 c1))\"\n in epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(thin_tac \"the (get_configuration (der1 (F_DPDA_RNE__conf__RL2 c1') 0)) = F_DPDA_RNE__conf__RL2 c1'\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"\\edge_src = cons_state_or_edge_old (edge_src x), edge_event = None, edge_pop = edge_pop x, edge_push = F_FRESH (epda_gamma G2) # edge_pop x, edge_trg = cons_state_or_edge_new x\\ \\ epda_step_labels G1\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"maximum_of_domain (der1 (F_DPDA_RNE__conf__RL2 c1')) 0\")\n apply(thin_tac \"epdaS.belongs G2 (der1 (F_DPDA_RNE__conf__RL2 c1'))\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"epdaS.derivation G2 (der1 (F_DPDA_RNE__conf__RL2 c1'))\")\n apply(erule_tac\n x=\"der2 (F_DPDA_RNE__conf__RL2 c1) x ((F_DPDA_RNE__conf__RL2 c1')\\epdaS_conf_state:=edge_trg x\\)\"\n in allE)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(simp add: get_configuration_def der2_def der1_def)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(erule impE)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(rule epdaS.der2_is_derivation)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: F_DPDA_RNE__conf__RL2_def FB_neutral_edge_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(subgoal_tac \"maximum_of_domain (der2 (F_DPDA_RNE__conf__RL2 c1) x (F_DPDA_RNE__conf__RL2 c1'\\epdaS_conf_state := edge_trg x\\)) (Suc 0)\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(rule der2_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(clarsimp)\n apply(erule_tac\n x=\"Suc 0\"\n in allE)\n apply(erule_tac\n x=\"x\"\n in allE)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(simp add: RNoOpX_relation_labelsRL_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimRLX\" : ATS_Simulation_Configuration_WeakReach\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__RL2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__RL2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__RL2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__RL2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__RL2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__RL2\"\n (* relation_labelsRL *)\n \"RNoOpX_relation_labelsRL\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX RNoOp_ATS_Simulation_Configuration_WeakReach_axioms_inst_ATS_Simulation_Configuration_WeakRL_axioms)\n done\n\ndefinition F_DPDA_RNE__SpecInput :: \"\n ('state, 'event, 'stack) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__SpecInput G \\\n valid_dpda G\n \\ read_edges_seperated G\"\n\ndefinition F_DPDA_RNE__SpecOutput :: \"\n ('stateA, 'event, 'stackA) epda\n \\ ('stateB, 'event, 'stackB) epda\n \\ bool\"\n where\n \"F_DPDA_RNE__SpecOutput Gi Go \\\n valid_dpda Go\n \\ epdaS.marked_language Gi = epdaS.marked_language Go\n \\ neutral_edges_removed Go\n \\ read_edges_seperated Go\"\n\nlemma F_DPDA_RNE__SOUND: \"\n F_DPDA_RNE__SpecInput G\n \\ F_DPDA_RNE__SpecOutput G (F_DPDA_RNE G (F_FRESH (epda_gamma G)))\"\n apply(simp add: F_DPDA_RNE__SpecInput_def F_DPDA_RNE__SpecOutput_def)\n apply(rule context_conjI)\n apply(rule F_DPDA_RNE__preserves_DPDA)\n apply(force)\n apply(rule conjI)\n apply (rule F_DPDA_RNE__preserves_lang)\n apply(force)\n apply(rule context_conjI)\n apply(rule F_DPDA_RNE__produces_neutral_edges_removed)\n apply(force)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(rule F_DPDA_RNE__preserves_read_edges_seperated)\n apply(force)\n apply(force)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n done\n\nlemma F_DPDA_DRE__revert_F_DPDA_RNE_SOUND_scheduled_case: \"\n F_DPDA_RNE__SpecInput G'\n \\ F_DPDA_DRE__revert_F_DPDA_RNE G' (F_FRESH (epda_gamma G')) (epdaS_accessible_edges (F_DPDA_RNE (G') (F_FRESH (epda_gamma (G'))))) = epdaS_accessible_edges G'\"\n apply(rule order_antisym)\n apply(simp add: epdaS_accessible_edges_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac x p d n c)(*strict*)\n prefer 2\n apply(simp add: epdaS_accessible_edges_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rename_tac x d n c)(*strict*)\n apply(subgoal_tac \"\\d2 n2 e2 c2. epdaS.derivation_initial SSG2 d2 \\ d2 n2 = Some (pair e2 c2) \\ (case SSe1 of None \\ True | Some e1' \\ \\k d2'. epdaS.derivation SSG2 d2' \\ the (get_configuration (d2' 0)) = the (get_configuration (d2 n2)) \\ (case get_label (derivation_append d2 d2' n2 k) of None \\ False | Some e2' \\ RNoOpX_relation_labelsLR SSG1 SSG2 e1' e2'))\" for SSe1 SSG1 SSG2)\n apply(rename_tac x d n c)(*strict*)\n prefer 2\n apply(rule_tac\n ?G1.0=\"G'\"\n and ?d1.0=\"d\"\n and ?G2.0=\"F_DPDA_RNE G' (F_FRESH (epda_gamma G'))\"\n in epdaS_epdaS_RNoOp_StateSimLRX.ATS_Simulation_Configuration_WeakReach_exists)\n apply(rename_tac x d n c)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(force)\n apply(rename_tac x d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(case_tac \"(get_label (derivation_append d2 d2' n2 k))\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(rule_tac\n x=\"a\"\n in exI)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(case_tac \"derivation_append d2 d2' n2 k\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"\\c. d2' 0 = Some (pair None c)\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"epdaS.derivation_initial (F_DPDA_RNE G' (F_FRESH (epda_gamma G'))) (derivation_append d2 d2' n2)\")\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_DPDA_RNE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n t=\"epda_delta (F_DPDA_RNE G' (F_FRESH (epda_gamma G')))\"\n and s=\"epda_step_labels (F_DPDA_RNE G' (F_FRESH (epda_gamma G')))\"\n in ssubst)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n i=\"k\"\n and d=\"derivation_append d2 d2' n2\"\n in epdaS.belongs_step_labels)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: F_DPDA_RNE__SpecInput_def valid_dpda_def valid_pda_def valid_epda_def)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"derivation_append d2 d2' n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"k\"\n in exI)\n apply(clarsimp)\n apply(rename_tac x p d n c)(*strict*)\n apply(subgoal_tac \"\\d2 n2 e2 c2. epdaS.derivation_initial SSG2 d2 \\ d2 n2 = Some (pair e2 c2) \\ (case SSe1 of None \\ True | Some e1' \\ \\k d2'. epdaS.derivation SSG2 d2' \\ the (get_configuration (d2' 0)) = the (get_configuration (d2 n2)) \\ (case get_label (derivation_append d2 d2' n2 k) of None \\ False | Some e2' \\ RNoOpX_relation_labelsRL SSG1 SSG2 e1' e2'))\" for SSG2 SSe1 SSG1)\n apply(rename_tac x p d n c)(*strict*)\n prefer 2\n apply(rule_tac\n ?G2.0=\"G'\"\n and ?d1.0=\"d\"\n and ?G1.0=\"F_DPDA_RNE G' (F_FRESH (epda_gamma G'))\"\n in epdaS_epdaS_RNoOp_StateSimRLX.ATS_Simulation_Configuration_WeakReach_exists)\n apply(rename_tac x p d n c)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(rename_tac x p d n c)(*strict*)\n apply(force)\n apply(rename_tac x p d n c)(*strict*)\n apply(force)\n apply(rename_tac x p d n c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(case_tac \"(get_label (derivation_append d2 d2' n2 k))\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2')(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(clarsimp)\n apply(simp add: get_label_def)\n apply(case_tac \"derivation_append d2 d2' n2 k\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a aa)(*strict*)\n apply(clarsimp)\n apply(case_tac aa)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a aa option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"\\c. d2' 0 = Some (pair None c)\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply (metis epdaS.some_position_has_details_at_0)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b ca)(*strict*)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(subgoal_tac \"epdaS.derivation_initial G' (derivation_append d2 d2' n2)\")\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n prefer 2\n apply(rule epdaS.derivation_append_preserves_derivation_initial)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__SpecInput_def valid_dpda_def valid_pda_def)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_append_preserves_derivation)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule epdaS.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"derivation_append d2 d2' n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(force)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(rule_tac\n x=\"k\"\n in exI)\n apply(clarsimp)\n apply(simp add: RNoOpX_relation_labelsRL_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(clarsimp)\n apply(erule_tac\n P=\"p \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G'))\"\n in disjE)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(erule disjE)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def)\n apply(erule_tac\n P=\"p = \\edge_src = cons_state_or_edge_old (edge_src x), edge_event = None, edge_pop = edge_pop x, edge_push = F_FRESH (epda_gamma G') # edge_pop x, edge_trg = cons_state_or_edge_new x\\\"\n in disjE)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(erule disjE)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(clarsimp)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac x d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac x p d n c d2 n2 e2 k c2 d2' a b)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_else_def)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_configuration_compatible_with_marking_configurations: \"\n(\\G1 G2.\n F_DPDA_RNE__relation_structure__LR2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2 \\\n c1 \\ epdaS_marking_configurations G1 \\ c2 \\ epdaS_marking_configurations G2))\"\n apply(clarsimp)\n apply(simp add: epdaS_marking_configurations_def)\n apply(subgoal_tac \"c2 \\ epdaS_configurations G2\")\n prefer 2\n apply(simp add: F_DPDA_RNE__relation_configuration__LR2_def)\n apply(clarsimp)\n apply (metis F_DPDA_RNE__conf_old__LR2_preserves_configurations)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def F_DPDA_RNE_def F_DPDA_RNE__relation_configuration__LR2_def F_DPDA_RNE__conf_old__LR2_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant: \"\n (\\G1 G2.\n F_DPDA_RNE__relation_structure__LR2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. F_DPDA_RNE__relation_step_simulation__LR2 G1 G2 c1 e1 c1' c2\n d2 \\\n maximum_of_domain d2 0 \\\n c1' \\ epdaS_marking_configurations G1)))))\"\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der1_def der2_def der3_def)\n apply(simp add: maximum_of_domain_def der1_def der2_def der3_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_step_simulationReach: \"\n (\\G1 G2.\n F_DPDA_RNE__relation_structure__LR2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. epdaS.derivation G2 d2 \\\n epdaS.belongs G2 d2 \\\n the (get_configuration (d2 0)) = c2 \\\n F_DPDA_RNE__relation_step_simulation__LR2 G1 G2 c1 e1 c1' c2\n d2 \\\n (\\n. maximum_of_domain d2 n \\\n F_DPDA_RNE__relation_configuration__LR2 G1 G2 c1'\n (the (get_configuration (d2 n))) \\\n (\\k e2. (\\c2. d2 k = Some (pair (Some e2) c2)) \\\n RNoOpX_relation_labelsLR G1 G2 e1 e2) \\\n n = 0 \\\n (\\e2. Ex (epdaS_step_relation G2 c2 e2) \\\n RNoOpX_relation_labelsLR G1 G2 e1 e2)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__LR2_def)\n apply(case_tac \"FB_neutral_edge e1\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n)(*strict*)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(rule_tac\n x=\"1\"\n in exI)\n apply(simp add: der3_def epda_step_labels_def F_DPDA_RNE__edge_then_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' n)(*strict*)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(rule_tac\n x=\"1\"\n in exI)\n apply(simp add: der2_def epda_step_labels_def F_DPDA_RNE__edge_then_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimLRRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms: \"\nATS_Simulation_Configuration_WeakRequired_axioms epda_step_labels epdaS_step_relation\n epdaS_configurations epda_step_labels epdaS_step_relation\n F_DPDA_RNE__relation_configuration__LR2 F_DPDA_RNE__relation_structure__LR2\n F_DPDA_RNE__relation_step_simulation__LR2 RNoOpX_relation_labelsLR\n epdaS_marking_configurations epdaS_marking_configurations\"\n apply(simp add: ATS_Simulation_Configuration_WeakRequired_axioms_def epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_step_simulationReach epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant epdaS_epdaS_RNoOp_StateSimLRRequired__inst__AX_relation_configuration_compatible_with_marking_configurations)\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimLRRequired\" : ATS_Simulation_Configuration_WeakRequired\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__LR2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__LR2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__LR2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__LR2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__LR2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__LR2\"\n (* relation_labelsLR *)\n \"RNoOpX_relation_labelsLR\"\n (* marking_configurations1 *)\n \"epdaS_marking_configurations\"\n (* marking_configurations2 *)\n \"epdaS_marking_configurations\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimLR_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RNoOp_StateSimLRRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_configuration_compatible_with_marking_configurations: \"\n(\\G1 G2.\n F_DPDA_RNE__relation_structure__RL2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2 \\\n c1 \\ epdaS_marking_configurations G1 \\ c2 \\ epdaS_marking_configurations G2))\"\n apply(clarsimp)\n apply(simp add: epdaS_marking_configurations_def)\n apply(subgoal_tac \"c2 \\ epdaS_configurations G2\")\n prefer 2\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply (metis (full_types) F_DPDA_RNE__conf__RL2_preserves_configurationsX)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def F_DPDA_RNE__relation_configuration__RL2_def F_DPDA_RNE__conf__RL2_def)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant: \"\n (\\G1 G2.\n F_DPDA_RNE__relation_structure__RL2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. F_DPDA_RNE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2\n d2 \\\n maximum_of_domain d2 0 \\\n c1' \\ epdaS_marking_configurations G1)))))\"\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(case_tac \"edge_trg e1\")\n apply(clarsimp)\n apply(case_tac \"edge_src e1\")\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der1_def der2_def der3_def)\n apply(simp add: maximum_of_domain_def der1_def der2_def der3_def)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def der1_def der2_def der3_def)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE__relation_configuration__RL2_def F_DPDA_RNE_def epdaS_step_relation_def epdaS_marking_configurations_def)\n apply(clarsimp)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_step_simulationReach: \"\n (\\G1 G2.\n F_DPDA_RNE__relation_structure__RL2 G1 G2 \\\n (\\c1 c2.\n F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1 c2 \\\n (\\e1. e1 \\ epda_step_labels G1 \\\n (\\c1'. epdaS_step_relation G1 c1 e1 c1' \\\n (\\d2. epdaS.derivation G2 d2 \\\n epdaS.belongs G2 d2 \\\n the (get_configuration (d2 0)) = c2 \\\n F_DPDA_RNE__relation_step_simulation__RL2 G1 G2 c1 e1 c1' c2\n d2 \\\n (\\n. maximum_of_domain d2 n \\\n F_DPDA_RNE__relation_configuration__RL2 G1 G2 c1'\n (the (get_configuration (d2 n))) \\\n (\\k e2. (\\c2. d2 k = Some (pair (Some e2) c2)) \\\n RNoOpX_relation_labelsRL G1 G2 e1 e2) \\\n n = 0 \\\n (\\e2. Ex (epdaS_step_relation G2 c2 e2) \\\n RNoOpX_relation_labelsRL G1 G2 e1 e2)))))))\"\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_step_simulation__RL2_def)\n apply(subgoal_tac \"(\\x\\ epda_delta G2 \\ {e. FB_neutral_edge e}. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G2))) \\ (\\x\\ epda_delta G2 \\ {e. (\\ FB_neutral_edge e)}. e1 = F_DPDA_RNE__edge_else x)\")\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def epda_step_labels_def)\n apply(force)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(erule_tac\n P=\"\\x\\ epda_delta G2 \\ {e. FB_neutral_edge e}. e1 \\ F_DPDA_RNE__edge_then x (F_FRESH (epda_gamma G2))\"\n in disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_else_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule conjI)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n t=\"epda_delta G2\"\n and s=\"epda_step_labels G2\"\n in ssubst)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(simp add: epda_step_labels_def)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n i=\"Suc 0\"\n in epdaS.belongs_step_labels)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_else_def F_DPDA_RNE__edge__RL2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n prefer 2\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"(der1 (F_DPDA_RNE__conf__RL2 c1))\"\n in epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(erule disjE)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n prefer 2\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' n x)(*strict*)\n apply(rule_tac\n x=\"Suc 0\"\n in exI)\n apply(simp add: der2_def RNoOpX_relation_labelsRL_def F_DPDA_DRE__revert_F_DPDA_RNE_def epda_step_labels_def)\n apply(rule disjI1)\n apply(simp add: F_DPDA_RNE__edge_then_def)\n apply(rule disjI2)\n apply(simp add: F_DPDA_RNE__edge_then_2_def)\n apply(rename_tac G1 G2 c1 e1 c1' d2 n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(simp add: F_DPDA_RNE__edge_then_1_def)\n apply(subgoal_tac \"n=0\")\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"(der1 (F_DPDA_RNE__conf__RL2 c1))\"\n in epdaS.maximum_of_domainUnique)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' d2 n x)(*strict*)\n apply(clarsimp)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(subgoal_tac \"False\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(force)\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def)\n apply(clarsimp)\n apply(thin_tac \"the (get_configuration (der1 (F_DPDA_RNE__conf__RL2 c1') 0)) = F_DPDA_RNE__conf__RL2 c1'\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"\\edge_src = cons_state_or_edge_old (edge_src x), edge_event = None, edge_pop = edge_pop x, edge_push = F_FRESH (epda_gamma G2) # edge_pop x, edge_trg = cons_state_or_edge_new x\\ \\ epda_step_labels G1\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"maximum_of_domain (der1 (F_DPDA_RNE__conf__RL2 c1')) 0\")\n apply(thin_tac \"epdaS.belongs G2 (der1 (F_DPDA_RNE__conf__RL2 c1'))\")\n apply(rename_tac G1 G2 c1 c1' x)(*strict*)\n apply(thin_tac \"epdaS.derivation G2 (der1 (F_DPDA_RNE__conf__RL2 c1'))\")\n apply(erule_tac x=\"x\" in allE)\n apply(erule disjE)\n apply(erule_tac x=\"((F_DPDA_RNE__conf__RL2 c1')\\epdaS_conf_state:=edge_trg x\\)\" in allE)\n apply(simp add: F_DPDA_RNE__conf__RL2_def FB_neutral_edge_def)\n apply(simp add: epdaS_step_relation_def)\n apply(simp add: RNoOpX_relation_labelsRL_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(simp add: F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def)\n done\n\nlemma epdaS_epdaS_RNoOp_StateSimRLRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms: \"\nATS_Simulation_Configuration_WeakRequired_axioms epda_step_labels epdaS_step_relation\n epdaS_configurations epda_step_labels epdaS_step_relation\n F_DPDA_RNE__relation_configuration__RL2 F_DPDA_RNE__relation_structure__RL2\n F_DPDA_RNE__relation_step_simulation__RL2 RNoOpX_relation_labelsRL\n epdaS_marking_configurations epdaS_marking_configurations\"\n apply(simp add: ATS_Simulation_Configuration_WeakRequired_axioms_def\n epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_configuration_compatible_with_marking_configurations\n epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_step_simulation_no_reach_marking_with_empty_simulant\n epdaS_epdaS_RNoOp_StateSimRLRequired__inst__AX_relation_step_simulationReach\n )\n done\n\ninterpretation \"epdaS_epdaS_RNoOp_StateSimRLRequired\" : ATS_Simulation_Configuration_WeakRequired\n (* TSstructure1 *)\n \"valid_epda\"\n (* configurations1 *)\n \"epdaS_configurations\"\n (* initial_configurations1 *)\n \"epdaS_initial_configurations\"\n (* step_labels1 *)\n \"epda_step_labels\"\n (* step_relation1 *)\n \"epdaS_step_relation\"\n (* effects1 *)\n \"epda_effects\"\n (* marking_condition1 *)\n \"epdaS_marking_condition\"\n (* marked_effect1 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect1 *)\n \"epdaS_unmarked_effect\"\n (* TSstructure2 *)\n \"valid_epda\"\n (* configurations2 *)\n \"epdaS_configurations\"\n (* initial_configurations2 *)\n \"epdaS_initial_configurations\"\n (* step_labels2 *)\n \"epda_step_labels\"\n (* step_relation2 *)\n \"epdaS_step_relation\"\n (* effects2 *)\n \"epda_effects\"\n (* marking_condition2 *)\n \"epdaS_marking_condition\"\n (* marked_effect2 *)\n \"epdaS_marked_effect\"\n (* unmarked_effect2 *)\n \"epdaS_unmarked_effect\"\n (* relation_configuration *)\n \"F_DPDA_RNE__relation_configuration__RL2\"\n (* relation_initial_configuration *)\n \"F_DPDA_RNE__relation_initial_configuration__RL2\"\n (* relation_effect *)\n \"F_DPDA_RNE__relation_effect__RL2\"\n (* relation_TSstructure *)\n \"F_DPDA_RNE__relation_structure__RL2\"\n (* relation_initial_simulation *)\n \"F_DPDA_RNE__relation_initial_simulation__RL2\"\n (* relation_step_simulation *)\n \"F_DPDA_RNE__relation_step_simulation__RL2\"\n (* relation_labelsRL *)\n \"RNoOpX_relation_labelsRL\"\n (* marking_configurations1 *)\n \"epdaS_marking_configurations\"\n (* marking_configurations2 *)\n \"epdaS_marking_configurations\"\n apply(simp add: LOCALE_DEFS epda_interpretations)\n apply(simp add: epdaS_epdaS_RNoOp_StateSimRL_inst_ATS_Simulation_Configuration_Weak_axiomsX epdaS_epdaS_RNoOp_StateSimRLRequired__inst__ATS_Simulation_Configuration_WeakRequired_axioms)\n done\n\nlemma F_DPDA_DRE__revert_F_DPDA_RNE_SOUND_scheduled_case_epdaS_required_edges: \"\n F_DPDA_RNE__SpecInput G'\n \\ F_DPDA_DRE__revert_F_DPDA_RNE G' (F_FRESH (epda_gamma G')) (epdaS_required_edges (F_DPDA_RNE (G') (F_FRESH (epda_gamma (G'))))) = epdaS_required_edges G'\"\n apply(rule order_antisym)\n apply(simp add: epdaS_required_edges_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(clarsimp)\n apply(subgoal_tac \"\\m. n+m=k\")\n prefer 2\n apply(rule_tac x=\"k-n\" in exI)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?G1.0=\"F_DPDA_RNE G' (F_FRESH (epda_gamma G'))\" and ?G2.0=\"G'\" and ?n1'=\"n+m\" in epdaS_epdaS_RNoOp_StateSimRLRequired.ATS_Simulation_Configuration_WeakRequired_exists_ALT)\n apply(simp add: F_DPDA_RNE__relation_structure__RL2_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(clarsimp)\n apply (metis epdaS.is_forward_deterministic_accessible_def epdaS_dependency_between_determinism_properties valid_dpda_def valid_pda_def)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"d2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2\" in exI)\n apply(clarsimp)\n apply(simp add: RNoOpX_relation_labelsRL_def)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(clarsimp)\n apply(rule conjI)\n prefer 2\n apply(rule_tac x=\"n2'\" in exI)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__relation_configuration__RL2_def epdaS_marking_configurations_def)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?c1.0=\"ca\" in\n F_DPDA_RNE__conf__RL2_preserves_configurationsX)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__conf__RL2_def F_DPDA_RNE_def)\n apply(case_tac \"epdaS_conf_state ca\")\n apply(clarsimp)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE_def)\n apply(erule disjE)\n apply(clarsimp)\n apply(simp add: F_DPDA_RNE__SpecInput_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_else_def epdaS_marking_configurations_def F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def F_DPDA_RNE__relation_configuration__RL2_def FB_neutral_edge_def epdaS_configurations_def)\n apply(clarsimp)\n apply(force)\n apply(simp add: F_DPDA_RNE__SpecInput_def F_DPDA_RNE__edge_then_def F_DPDA_RNE__edge_then_1_def F_DPDA_RNE__edge_then_2_def F_DPDA_RNE__edge_else_def epdaS_marking_configurations_def F_DPDA_RNE__relation_structure__RL2_def F_DPDA_RNE_def F_DPDA_RNE__relation_configuration__RL2_def FB_neutral_edge_def epdaS_configurations_def)\n apply(clarsimp)\n apply(simp add: epdaS_required_edges_def)\n apply(clarsimp)\n apply(simp add: F_DPDA_DRE__revert_F_DPDA_RNE_def)\n apply(subgoal_tac \"\\m. n+m=k\")\n prefer 2\n apply(rule_tac x=\"k-n\" in exI)\n apply(force)\n apply(clarsimp)\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule_tac ?G2.0=\"F_DPDA_RNE G' (F_FRESH (epda_gamma G'))\" and ?G1.0=\"G'\" and ?n1'=\"n+m\" in epdaS_epdaS_RNoOp_StateSimLRRequired.ATS_Simulation_Configuration_WeakRequired_exists_ALT)\n apply(simp add: F_DPDA_RNE__relation_structure__LR2_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(clarsimp)\n apply(simp add: epdaS.is_forward_deterministic_accessible_def)\n apply(rule conjI)\n prefer 2\n apply(rule F_DPDA_RNE__preserves_is_forward_edge_deterministic_accessible)\n apply(force)\n apply(rule epdaS_is_forward_target_deterministic_accessible)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"e2\" in exI)\n apply(rule conjI)\n apply(rule_tac\n t=\"epda_delta SSX\" \n and s=\"epda_step_labels SSX\" for SSX\n in ssubst)\n apply(simp add: epda_step_labels_def)\n apply(rule_tac\n i=\"n2\" and d=\"d2\"\n in epdaS.belongs_step_labels)\n prefer 2\n apply(force)\n apply(rule epdaS.derivation_initial_belongs)\n apply(rule F_DPDA_RNE__preserves_epda)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(simp add: F_DPDA_RNE__SpecInput_def)\n apply(rule F_FRESH_is_fresh)\n apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n apply(force)\n apply(rule conjI)\n apply(rule_tac x=\"d2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2\" in exI)\n apply(clarsimp)\n apply(rule_tac x=\"n2'\" in exI)\n apply(clarsimp)\n apply (metis (erased, hide_lams) F_DPDA_RNE__relation_configuration__LR2_def epdaS_epdaS_RNoOp_StateSimLRRequired.AX_relation_configuration_compatible_with_marking_configurations)\n apply(simp add: RNoOpX_relation_labelsLR_def F_DPDA_DRE__revert_F_DPDA_RNE_def)\n done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_04_02/FUNCTION__DPDA_RNE__DPDA_REMOVE_NEUTRAL_EDGES.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.25699151989250296}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory word_abs_options imports \"AutoCorres.AutoCorres\" begin\n\nexternal_file \"word_abs_options.c\"\ninstall_C_file \"word_abs_options.c\"\n\nautocorres [\n ts_rules = nondet,\n unsigned_word_abs = usum2, no_signed_word_abs = isum1\n ] \"word_abs_options.c\"\n\ncontext word_abs_options begin\n\nlemma \"\\ \\ \\ isum1' (a :: sword32) (b :: sword32) \\ \\r _. r = a + b \\\"\n unfolding isum1'_def\n apply (wp refl)\n done\n\nlemma \"\\ \\ \\ isum2' (a :: int) (b :: int) \\ \\r _. r = a + b \\\"\n unfolding isum2'_def\n apply (wp refl)\n done\n\nlemma \"\\ \\ \\ usum1' (a :: word32) (b :: word32) \\ \\r _. r = a + b \\\"\n unfolding usum1'_def\n apply (wp refl)\n done\n\nlemma \"\\ \\ \\ usum2' (a :: nat) (b :: nat) \\ \\r _. r = a + b \\\"\n unfolding usum2'_def\n apply (wp refl)\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/autocorres/tests/proof-tests/word_abs_options.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.25686843524451275}} {"text": "theory Theorem611\n imports Complex_Main LearningTheory\nbegin\n\ntext \"This document contains a collection of (mostly failed) attempts at gathering subproofs and\n important lemmata for theorem 6.11. It may help proving the theorem in the future and serves\n no other purpose.\"\n\n\n (*measure_pmf.jensens_inequality*)\n\nlemma \"AE x in measure_pmf M. X' x \\ UNIV\"\n by simp\n\nlemma \"convex_on UNIV abs\"\nunfolding convex_on_def\n apply (simp)\n by (metis (mono_tags, hide_lams) abs_mult abs_of_nonneg abs_triangle_ineq add.commute mult.commute)\n\nlemma \"integrable (measure_pmf M) abs\"\n oops\n\n(*for lemma A.3*)\nlemma \"measure_pmf.expectation p (abs \\ f)\n \\ infsetsum (\\i. (a::real) * (Suc i) * (measure_pmf.prob p {x. (abs \\ f) x > a * i})) UNIV\"\n oops\n\nlemma \"abs (infsetsum f A) \\ infsetsum (abs \\ f) A\"\n oops\n\n\n\n\nlemma \"\\x. f x \\ {-1<..<1::real} \\ f \\ borel_measurable borel\"\n oops\n\n\nlemma \"\\x. f x \\ {-1<..<1::real} \\ simple_function (measure_pmf M) f\"\n oops\n\nlemma \"\\x. f x \\ {-1<..<1} \\ integrable (measure_pmf M) f\"\n oops\n\nlemma \"emeasure (measure_pmf M) {(y::real) \\ space M. id y \\ 0} \\ \\\"\n by simp \n\nlemma \"integrable (measure_pmf M) (id::(real\\real))\" \n oops\n\nlemma if_summable: \"f abs_summable_on A \\ (\\x. if P x then f x else 0) abs_summable_on A\"\n by (simp add: abs_summable_on_comparison_test)\n\nlemma \"(\\x. if h x \\ f x then pmf D x else 0) abs_summable_on A\"\n using pmf_abs_summable[of \"D\"] if_summable[of \"pmf D\"] by auto\n\nlemma exp_to_prob: \"measure_pmf.expectation pr (\\x. if P x then 1::real else 0)\n = measure_pmf.prob pr {x. P x}\"\nproof -\n have \"measure_pmf.expectation pr (\\x. if P x then 1::real else 0)\n = infsetsum (\\x. if P x then pmf pr x else 0) UNIV\"\n by (smt infsetsum_cong mult_cancel_left2 mult_not_zero pmf_expectation_eq_infsetsum)\n also have \"... = ... - infsetsum (\\x. if P x then pmf pr x else 0) {x. \\ P x}\"\n by (smt infsetsum_all_0 mem_Collect_eq)\n also have \"... = infsetsum (\\x. if P x then pmf pr x else 0) (UNIV - {x. \\ P x})\"\n by (simp add: if_summable infsetsum_Diff pmf_abs_summable)\n also have \"... = infsetsum (\\x. if P x then pmf pr x else 0) {x. P x}\"\n proof -\n have \"UNIV - {x. \\ P x} = {x. P x}\"\n by blast\n then show ?thesis by auto\n qed \n also have \"... = infsetsum (pmf pr) {x. P x}\"\n by (smt infsetsum_cong mem_Collect_eq)\n finally show ?thesis\n by (simp add: measure_pmf_conv_infsetsum) \nqed\n\nlemma \"((g:: 'c \\ real) y) * measure_pmf.expectation D f = measure_pmf.expectation D (\\x. (g y) * f x)\"\n by simp\n\nlemma \"measure_pmf.expectation D f - (a::real) = measure_pmf.expectation D (\\x. f x - a)\"\nproof -\n have \"measure_pmf.expectation D f - (a::real) = (\\\\<^sub>ax. pmf D x * f x) - (\\\\<^sub>ax. pmf D x * a)\"\n using pmf_expectation_eq_infsetsum infsetsum_pmf_eq_1\n proof -\n have \"\\p. integral\\<^sup>L (count_space (UNIV::'c set)) (pmf p) = 1\"\n by (metis (no_types) infsetsum_def measure_pmf_UNIV measure_pmf_conv_infsetsum)\n then show ?thesis sorry\n qed \n show ?thesis sorry\nqed\n\n\nlemma assumes \"card I > 0\"\n and \"(\\x. pmf D x * f x) abs_summable_on UNIV\"\n shows stichprobenmittel: \"measure_pmf.expectation (Pi_pmf I undefined (\\_. D)) (\\S. sum (f \\ S) I / card I)\n = measure_pmf.expectation D f\"\nproof -\n(*\n have \"measure_pmf.expectation (Pi_pmf I undefined (\\_. D)) (\\S. sum (f \\ S) I / card I)\n = sum (\\_.(measure_pmf.expectation D f)) I / card I\"\n *)\n have \"i\\I \\ sum (f \\ S) (insert i I) / (card I + 1) \n = sum (f \\ S) I / (card I + 1) + (f \\ S) i / (card I + 1)\"\n sorry\n (* by (metis add.commute add_divide_distrib assms card.infinite not_less0 sum.insert_if) *)\n \n have \"measure_pmf.expectation (Pi_pmf (insert i I) undefined (\\_. D)) (\\S. sum (f \\ S) (insert i I) / (card I + 1))\n = measure_pmf.expectation (Pi_pmf (insert i I) undefined (\\_. D)) (\\S. sum (f \\ S) I / (card I + 1) + f (S i) / (card I + 1))\"\n \n sorry\n show ?thesis sorry\nqed\n\nlemma assumes \"card I > 0\"\n shows \"measure_pmf.expectation (Pi_pmf I undefined (\\_. D)) (\\S. sum (\\i. if h (S i) \\ f (S i) then 1::real else 0) I / card I)\n = measure_pmf.expectation D (\\x. if h x \\ f x then 1::real else 0)\"\n sorry\n\n(*for Jensens*)\nlemma \"abs (measure_pmf.expectation p f) \\ measure_pmf.expectation p (abs \\ f)\"\n using pmf_expectation_eq_infsetsum abs_triangle_ineq sorry\n\n(*Theorem 6.11*)\nlemma assumes \"set_pmf D \\ X\"\n and \"f ` X = Y\"\n and \"\\\\{x.0x<1}\"\n shows theorem611: \"measure_pmf.prob (Samples m D f) {S. \\h\\H. abs(PredErr D f h - TrainErr S {0.. (4+sqrt(ln(real(growth (2*m)))))/(\\ * sqrt(2*m))} \\ 1 - \\\"\nproof -\n (* replace max with sup? *)\n have \"measure_pmf.expectation (Samples m D f) (\\S. (Max(image (\\h. abs(PredErr D f h - TrainErr S {0.. (4+sqrt(ln(real(growth (2*m)))))/(\\ * sqrt(2*m))\" sorry\n (* have \"\\h\\H. measure_pmf.expectation D (\\x. if h x \\ f x then 1::real else 0) = (\\\\<^sub>ax. pmf D x * (\\x. if h x \\ f x then 1::real else 0) x)\"\n using pmf_expectation_eq_infsetsum by auto\n have \"\\h\\H. (\\\\<^sub>ax. pmf D x * (\\x. if h x \\ f x then 1::real else 0) x) = (\\\\<^sub>ax. (if h x \\ f x then pmf D x else 0))\"\n by (smt infsetsum_cong mult_cancel_left1 mult_cancel_right1)\n have \"\\h A.(\\x. if h x \\ f x then pmf D x else 0) abs_summable_on A\"\n using pmf_abs_summable[of \"D\"] if_summable[of \"pmf D\"] by auto\n then have \"\\h\\H. infsetsum (\\x. if h x \\ f x then pmf D x else 0) (UNIV - {x. h x = f x})\n = (\\\\<^sub>ax. (if h x \\ f x then pmf D x else 0)) - infsetsum (\\x. if h x \\ f x then pmf D x else 0) {x. h x = f x}\"\n by (simp add: infsetsum_Diff)\n have \"\\h\\H. infsetsum (\\x. if h x \\ f x then pmf D x else 0) {x. h x = f x} = 0\"\n by (smt infsetsum_all_0 mem_Collect_eq)\n have \"\\h\\H. infsetsum (\\x. if h x \\ f x then pmf D x else 0) (UNIV - {x. h x = f x}) = infsetsum (pmf D) {x. h x \\ f x}\"\n by (smt Diff_iff UNIV_I infsetsum_Diff infsetsum_all_0 infsetsum_cong infsetsum_def mem_Collect_eq pmf_abs_summable subsetI)\n \n*)fix h I\n have \"PredErr D f h = measure_pmf.expectation D (\\x. if h x \\ f x then 1::real else 0)\"\n unfolding PredErr_def using exp_to_prob[of D \"(\\x. h x \\ f x)\"]\n by (smt Collect_cong)\n moreover assume \"card I > 0\"\n moreover have \"(\\x. pmf D x * (\\x. if h x \\ f x then 1::real else 0) x) abs_summable_on UNIV\"\n using pmf_abs_summable[of \"D\"] if_summable[of \"pmf D\"]\n by (smt abs_summable_on_comparison_test mult_cancel_left1 mult_not_zero zero_less_norm_iff)\n ultimately have \"measure_pmf.expectation (Pi_pmf I undefined (\\_. D))\n (\\S. sum (\\i. if h (S i) \\ f (S i) then 1::real else 0) I / card I)\n = PredErr D f h\"\n using stichprobenmittel by auto\n have \"\\h\\H. (PredErr D f h) = measure_pmf.expectation (Samples m D f) (\\S. TrainErr S {0..m} h)\"\n unfolding PredErr_def TrainErr_def Samples_def \n sorry\n show ?thesis sorry\nqed\n", "meta": {"author": "Quickblink", "repo": "verML", "sha": "bb7d4d1e154efb0e5464aa0a41a89f0411a6a0f8", "save_path": "github-repos/isabelle/Quickblink-verML", "path": "github-repos/isabelle/Quickblink-verML/verML-bb7d4d1e154efb0e5464aa0a41a89f0411a6a0f8/Theorem611.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.25686843524451275}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2004 |\n | April 2005 |\n | June 2005 (modified) |\n | September 2005 (modified) |\n | |\n | CSP-Prover on Isabelle2005 |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_F_op_alpha_par\nimports CSP_F_domain CSP_T_op_alpha_par\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = <>) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*********************************************************\n Alphabetized Parallel eval\n *********************************************************)\n\nlemma in_failures_Parallel_SKIP_lm1: \n \"[| Y - insert Tick (Ev ` X) = Z - insert Tick (Ev ` X) ; \n (Tick ~: Z | Z <= Evset) |]\n ==> Z - Y <= Ev ` X\"\nby (auto simp add: Evset_def)\n\nlemma in_failures_Parallel_SKIP_lm2: \n \"Y - insert Tick (Ev ` X) = Z - insert Tick (Ev ` X) \n ==> Z - insert Tick Y <= Ev ` X\"\nby (auto)\n\n(* Para SKIP *)\n\nlemma in_failures_Parallel_SKIP:\n \"(f :f failures(P |[X]| SKIP) M) = \n (EX u Y Z. f = (u, Y Un Z) & (u, Y) :f failures(P) M & \n sett(u) Int (Ev ` X) = {} & Z <= Ev ` X)\"\napply (simp add: in_failures)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE)\n apply (erule disjE)\n\n (* t = <> *)\n apply (simp add: par_tr_nil)\n apply (elim conjE, simp)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z - Y\" in exI)\n apply (simp add: in_failures_Parallel_SKIP_lm1)\n\n (* t = *)\n apply (simp add: par_tr_Tick)\n apply (elim conjE, simp)\n apply (case_tac \"Tick ~: Z\")\n\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z - Y\" in exI)\n apply (simp add: in_failures_Parallel_SKIP_lm1)\n\n (* Tick : Z *)\n apply (rule_tac x=\"insert Tick Y\" in exI)\n apply (rule_tac x=\"(Z - insert Tick Y)\" in exI)\n apply (rule conjI, force)\n apply (simp add: Tick_in_sett)\n apply (erule exE)\n apply (rule conjI)\n apply (simp)\n apply (rule proc_T2_T3)\n apply (simp)\n apply (simp)\n apply (simp add: in_failures_Parallel_SKIP_lm2)\n\n(* <= *)\n apply (elim conjE exE)\n apply (case_tac \"Tick ~: sett u\")\n\n (* t = <> *)\n apply (rule_tac x=\"u\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z Un (Y - {Tick})\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (fast)\n apply (rule conjI)\n apply (fast)\n apply (rule_tac x=\"u\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil)\n apply (simp add: Evset_def)\n apply (force)\n\n (* t = *)\n apply (rule_tac x=\"u\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z Un Y\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (fast)\n apply (rule conjI)\n apply (fast)\n apply (rule_tac x=\"u\" in exI)\n apply (rule_tac x=\"\" in exI)\n apply (simp add: par_tr_Tick)\ndone\n\n(*** complement ***)\n\nlemma in_failures_Parallel_SKIP_comp:\n \"(f :f failures(P |[- X]| SKIP) M) =\n (EX u Y Z. f = (u, Y Un Z) & (u, Y) :f failures(P) M & \n sett(u) <= insert Tick (Ev ` X) & Z Int insert Tick (Ev ` X) = {})\"\napply (simp add: in_failures_Parallel_SKIP)\napply (auto)\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (simp)\napply (rule conjI)\n apply (rule subsetI)\n apply (case_tac \"x : Ev ` (- X)\")\n apply (fast)\n apply (simp add: notin_Ev_set)\n apply (erule disjE, simp)\n apply (force)\napply (force)\n\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (auto)\napply (case_tac \"x = Tick\", simp)\napply (simp add: not_Tick_to_Ev)\napply (auto)\ndone\n\n(*** Alpha_parallel_evalF ***)\n\nlemma in_failures_Alpha_parallel_lm1:\n \"[| Tick ~: Za ; Za Int Ev ` X1 = {}; \n Tick ~: Zb ; Zb Int Ev ` X2 = {};\n Ya Un Za - insert Tick (Ev ` (X1 Int X2)) =\n Yb Un Zb - insert Tick (Ev ` (X1 Int X2)) |]\n ==>\n (Ya Un Za Un (Yb Un Zb)) Int insert Tick (Ev ` (X1 Un X2)) =\n (Ya Int insert Tick (Ev ` X1)) Un\n (Yb Int insert Tick (Ev ` X2))\"\nby (auto)\n\nlemma in_failures_Alpha_parallel_lm2:\n \"X Int insert Tick (Ev ` (X1 Un X2)) <= Y Un Z\n ==> X = X Int Ev ` (X1 - X2) Un X Int Y Int insert Tick (Ev ` (X1 Int X2)) Un\n (X - insert Tick (Ev ` X1)) Un\n (X Int Ev ` (X2 - X1) Un X Int Z Int insert Tick (Ev ` (X1 Int X2)) Un\n (X - insert Tick (Ev ` X2)))\"\nby (auto)\n\nlemma in_failures_Alpha_parallel_lm3:\n \"X Int Ev ` (X1 - X2) Un X Int Y Int insert Tick (Ev ` (X1 Int X2)) Un\n (X - insert Tick (Ev ` X1)) -\n insert Tick (Ev ` (X1 Int X2)) =\n X Int Ev ` (X2 - X1) Un X Int Z Int insert Tick (Ev ` (X1 Int X2)) Un\n (X - insert Tick (Ev ` X2)) -\n insert Tick (Ev ` (X1 Int X2))\"\nby (auto)\n\n(* F *)\n\nlemma in_failures_Alpha_parallel:\n \"(f :f failures(P |[X1,X2]| Q) M) =\n (EX u X.\n f = (u, X) &\n (EX Y Z.\n X Int insert Tick (Ev ` (X1 Un X2)) =\n Y Int insert Tick (Ev ` X1) Un Z Int insert Tick (Ev ` X2) &\n (u rest-tr X1, Y) :f failures(P) M &\n (u rest-tr X2, Z) :f failures(Q) M & \n sett u <= insert Tick (Ev ` (X1 Un X2))))\"\napply (simp add: Alpha_parallel_def)\napply (simp add: in_failures_Parallel[of _ _ \"X1 Int X2\"])\napply (simp add: in_failures_Parallel_SKIP_comp)\napply (rule iffI)\n\n(* => *)\n apply (elim conjE exE)\n apply (simp add: par_tr_rest_tr)\n apply (rule_tac x=\"Ya\" in exI, simp)\n apply (rule_tac x=\"Yb\" in exI, simp)\n apply (simp add: in_failures_Alpha_parallel_lm1)\n\n(* <= *)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\n \"(X Int (Ev ` (X1 - X2))) Un \n (X Int Y Int insert Tick (Ev ` (X1 Int X2))) Un\n (X - insert Tick (Ev ` X1))\" in exI)\n apply (rule_tac x=\n \"(X Int (Ev ` (X2 - X1))) Un \n (X Int Z Int insert Tick (Ev ` (X1 Int X2))) Un\n (X - insert Tick (Ev ` X2))\" in exI)\n\n(* X = Y' Un Z' *)\n apply (rule conjI)\n apply (rule in_failures_Alpha_parallel_lm2)\n apply (fast)\n\n(* Parallel condition *)\n apply (rule conjI)\n apply (simp add: in_failures_Alpha_parallel_lm3)\n\n(* failures *)\n apply (rule_tac x=\"u rest-tr X1\" in exI)\n apply (rule_tac x=\"u rest-tr X2\" in exI)\n apply (simp add: par_tr_rest_tr_if)\n\n apply (rule conjI)\n apply (rule_tac x=\n \"(X Int (Ev ` (X1 - X2))) Un \n (X Int Y Int insert Tick (Ev ` (X1 Int X2)))\" in exI)\n apply (rule_tac x= \"(X - insert Tick (Ev ` X1))\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (rule memF_F2)\n apply (simp)\n apply (force)\n apply (force)\n\n apply (rule_tac x=\n \"(X Int (Ev ` (X2 - X1))) Un \n (X Int Z Int insert Tick (Ev ` (X1 Int X2)))\" in exI)\n apply (rule_tac x= \"(X - insert Tick (Ev ` X2))\" in exI)\n apply (simp)\n apply (rule conjI)\n apply (rule memF_F2)\n apply (simp)\n apply (force)\n apply (force)\ndone\n\n(*** Semantics for alphabetized parallel on F ***)\n\nlemma failures_Alpha_parallel:\n \"failures(P |[X1,X2]| Q) = (%M.\n {f. (EX u X. f = (u, X) &\n (EX Y Z.\n X Int insert Tick (Ev ` (X1 Un X2)) =\n Y Int insert Tick (Ev ` X1) Un Z Int insert Tick (Ev ` X2) &\n (u rest-tr X1, Y) :f failures(P) M &\n (u rest-tr X2, Z) :f failures(Q) M &\n sett u <= insert Tick (Ev ` (X1 Un X2))))}f)\"\napply (simp only: in_failures_Alpha_parallel[THEN sym])\napply (simp)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_op_alpha_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.25674050566027795}} {"text": "theory Decode_Correct imports MIPS MIPS_Model begin\n\nprimrec not_jb :: \\inst \\ bool\\ where\n \\not_jb (Inst_ALU_R _ _ _ _) = True\\ |\n \\not_jb (Inst_ALU_I _ _ _ _) = True\\ |\n \\not_jb (Inst_Shift_R _ _ _ _) = True\\ |\n \\not_jb (Inst_Shift_I _ _ _ _) = True\\ |\n \\not_jb (Inst_LUI _ _) = True\\ |\n \\not_jb (Inst_J _) = False\\ |\n \\not_jb (Inst_JAL _) = False\\ |\n \\not_jb (Inst_JR _) = False\\ |\n \\not_jb (Inst_JALR _ _) = False\\ |\n \\not_jb (Inst_Branch _ _ _ _) = False\\ |\n \\not_jb (Inst_Branch1 _ _ _) = False\\ |\n \\not_jb (Inst_Load _ _ _ _ _) = True\\ |\n \\not_jb (Inst_Store _ _ _ _) = True\\ |\n \\not_jb Inst_Undef = False\\\n\nlemma decode_not_jb_next_pc_sel:\n \\not_jb (mips.decode inst) \\ DecodedInst_next_pc_sel (decode inst) = NextPC_NoJump\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun is_jump_imm :: \\inst \\ bool\\ where\n \\is_jump_imm (Inst_J _) = True\\ |\n \\is_jump_imm (Inst_JAL _) = True\\ |\n \\is_jump_imm _ = False\\\n\nlemma decode_jump_imm_pc_sel:\n \\is_jump_imm (mips.decode inst) \\ DecodedInst_next_pc_sel (decode inst) = NextPC_J\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun is_jump_reg :: \\inst \\ bool\\ where\n \\is_jump_reg (Inst_JR _) = True\\ |\n \\is_jump_reg (Inst_JALR _ _) = True\\ |\n \\is_jump_reg _ = False\\\n\nlemma decode_jump_reg_pc_sel:\n \\is_jump_reg (mips.decode inst) \\ DecodedInst_next_pc_sel (decode inst) = NextPC_RS\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun br_cond :: \\inst \\ 2 word option\\ where\n \\br_cond (Inst_Branch EQ _ _ _) = Some CondEQ\\ |\n \\br_cond (Inst_Branch NE _ _ _) = Some CondNE\\ |\n \\br_cond (Inst_Branch1 LEZ _ _) = Some CondLEZ\\ |\n \\br_cond (Inst_Branch1 GTZ _ _) = Some CondGTZ\\ |\n \\br_cond _ = None\\\n\nlemma decode_br_pc_sel:\n \\br_cond (mips.decode inst) = Some cond \\ DecodedInst_next_pc_sel (decode inst) = NextPC_B\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_cond_sel:\n \\br_cond (mips.decode inst) = Some cond \\ DecodedInst_cond_sel (decode inst) = cond\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec not_ls :: \\inst \\ bool\\ where\n \\not_ls (Inst_ALU_R _ _ _ _) = True\\ |\n \\not_ls (Inst_ALU_I _ _ _ _) = True\\ |\n \\not_ls (Inst_Shift_R _ _ _ _) = True\\ |\n \\not_ls (Inst_Shift_I _ _ _ _) = True\\ |\n \\not_ls (Inst_LUI _ _) = True\\ |\n \\not_ls (Inst_J _) = True\\ |\n \\not_ls (Inst_JAL _) = True\\ |\n \\not_ls (Inst_JR _) = True\\ |\n \\not_ls (Inst_JALR _ _) = True\\ |\n \\not_ls (Inst_Branch _ _ _ _) = True\\ |\n \\not_ls (Inst_Branch1 _ _ _) = True\\ |\n \\not_ls (Inst_Load _ _ _ _ _) = False\\ |\n \\not_ls (Inst_Store _ _ _ _) = False\\ |\n \\not_ls Inst_Undef = False\\\n\nfun is_ls :: \\inst \\ bool\\ where\n \\is_ls (Inst_Load _ _ _ _ _) = True\\ |\n \\is_ls (Inst_Store _ _ _ _) = True\\ |\n \\is_ls _ = False\\\n\nlemma decode_not_ls_dm_en:\n \\not_ls (mips.decode inst) \\ \\ DecodedInst_dm_en (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_ls_dm_en:\n \\is_ls (mips.decode inst) \\ DecodedInst_dm_en (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec read_rs :: \\inst \\ 5 word\\ where\n \\read_rs (Inst_ALU_R op rd rs rt) = rs\\ |\n \\read_rs (Inst_ALU_I op rd rs imm) = rs\\ |\n \\read_rs (Inst_Shift_R op rd rt rs) = rs\\ |\n \\read_rs (Inst_Shift_I op rd rt shamt) = 0\\ |\n \\read_rs (Inst_LUI _ _) = 0\\ |\n \\read_rs (Inst_J _) = 0\\ |\n \\read_rs (Inst_JAL _) = 0\\ |\n \\read_rs (Inst_JR rs) = rs\\ |\n \\read_rs (Inst_JALR rd rs) = rs\\ |\n \\read_rs (Inst_Branch op rs rt imm) = rs\\ |\n \\read_rs (Inst_Branch1 op rs imm) = rs\\ |\n \\read_rs (Inst_Load sz sign rt rs imm) = rs\\ |\n \\read_rs (Inst_Store sz rt rs imm) = rs\\ |\n \\read_rs Inst_Undef = undefined\\\n\nlemma decode_rf_ra1:\n \\mips.decode inst \\ Inst_Undef \\ read_rs (mips.decode inst) = rs \\ DecodedInst_rf_ra1 (decode inst) = rs\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec read_rt :: \\inst \\ 5 word\\ where\n \\read_rt (Inst_ALU_R op rd rs rt) = rt\\ |\n \\read_rt (Inst_ALU_I op rd rs imm) = 0\\ |\n \\read_rt (Inst_Shift_R op rd rt rs) = rt\\ |\n \\read_rt (Inst_Shift_I op rd rt shamt) = rt\\ |\n \\read_rt (Inst_LUI _ _) = 0\\ |\n \\read_rt (Inst_J _) = 0\\ |\n \\read_rt (Inst_JAL _) = 0\\ |\n \\read_rt (Inst_JR rs) = 0\\ |\n \\read_rt (Inst_JALR rd rs) = 0\\ |\n \\read_rt (Inst_Branch op rs rt imm) = rt\\ |\n \\read_rt (Inst_Branch1 op rs imm) = 0\\ |\n \\read_rt (Inst_Load sz sign rt rs imm) = 0\\ |\n \\read_rt (Inst_Store sz rt rs imm) = rt\\ |\n \\read_rt Inst_Undef = undefined\\\n\nlemma decode_rf_ra2:\n \\mips.decode inst \\ Inst_Undef \\ read_rt (mips.decode inst) = rt \\ DecodedInst_rf_ra2 (decode inst) = rt\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec write_r :: \\inst \\ 5 word\\ where\n \\write_r (Inst_ALU_R op rd rs rt) = rd\\ |\n \\write_r (Inst_ALU_I op rd rs imm) = rd\\ |\n \\write_r (Inst_Shift_R op rd rt rs) = rd\\ |\n \\write_r (Inst_Shift_I op rd rt shamt) = rd\\ |\n \\write_r (Inst_LUI rd imm) = rd\\ |\n \\write_r (Inst_J imm) = 0\\ |\n \\write_r (Inst_JAL imm) = 31\\ |\n \\write_r (Inst_JR rs) = 0\\ |\n \\write_r (Inst_JALR rd rs) = rd\\ |\n \\write_r (Inst_Branch op rs rt imm) = 0\\ |\n \\write_r (Inst_Branch1 op rs imm) = 0\\ |\n \\write_r (Inst_Load sz sign rt rs imm) = rt\\ |\n \\write_r (Inst_Store sign rt rs imm) = 0\\ |\n \\write_r Inst_Undef = undefined\\\n\nlemma decode_rf_wa:\n \\mips.decode inst \\ Inst_Undef \\ write_r (mips.decode inst) = r \\ DecodedInst_rf_wa (decode inst) = r\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec convert_alu_op :: \\ALU_op \\ 4 word\\ where\n \\convert_alu_op OP_ADD = ALU_ADD\\ |\n \\convert_alu_op OP_SUB = ALU_SUB\\ |\n \\convert_alu_op OP_AND = ALU_AND\\ |\n \\convert_alu_op OP_OR = ALU_OR \\ |\n \\convert_alu_op OP_XOR = ALU_XOR\\ |\n \\convert_alu_op OP_NOR = ALU_NOR\\ |\n \\convert_alu_op OP_SLT = ALU_SLT\\ |\n \\convert_alu_op OP_SLTU = ALU_ULT\\\n\nfun alu_op :: \\inst \\ ALU_op option\\ where\n \\alu_op (Inst_ALU_R op _ _ _) = Some op\\ |\n \\alu_op (Inst_ALU_I op _ _ _) = Some op\\ |\n \\alu_op (Inst_LUI _ _) = Some OP_ADD\\ | (* could be any op satisfying \\0 \\ x = x\\ *)\n \\alu_op (Inst_Load _ _ _ _ _) = Some OP_ADD\\ |\n \\alu_op (Inst_Store _ _ _ _) = Some OP_ADD\\ |\n \\alu_op _ = None\\\n\nfun shifter_op :: \\inst \\ shift_op option\\ where\n \\shifter_op (Inst_Shift_R op _ _ _) = Some op\\ |\n \\shifter_op (Inst_Shift_I op _ _ _) = Some op\\ |\n \\shifter_op _ = None\\\n\nfun rf_in_is_alu_out where\n \\rf_in_is_alu_out (Inst_ALU_R _ _ _ _) = True\\ |\n \\rf_in_is_alu_out (Inst_ALU_I _ _ _ _) = True\\ |\n \\rf_in_is_alu_out (Inst_LUI _ _) = True\\ |\n \\rf_in_is_alu_out _ = False\\\n\nlemma decode_alu_rf_in_sel:\n \\rf_in_is_alu_out (mips.decode inst) \\ DecodedInst_rf_in_sel (decode inst) = ALU_Out\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_shifter_rf_in_sel:\n \\shifter_op (mips.decode inst) = Some op \\ DecodedInst_rf_in_sel (decode inst) = ShifterOut\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_load_rf_in_sel:\n \\mips.decode inst = Inst_Load sz sign rt rs imm \\ DecodedInst_rf_in_sel (decode inst) = DM_Out\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_alu_op:\n \\alu_op (mips.decode inst) = Some op \\ DecodedInst_alu_op (decode inst) = convert_alu_op op\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_ALU_R_alu_b_imm:\n \\mips.decode inst = Inst_ALU_R op rd rs rt \\ \\ DecodedInst_alu_b_imm (decode inst)\\\n apply(simp add: mips.decode_def decode_def Let_def)\n by unat_arith\n\nfun alu_b_imm :: \\inst \\ bool\\ where\n \\alu_b_imm (Inst_ALU_I _ _ _ _) = True\\ |\n \\alu_b_imm (Inst_LUI _ _) = True\\ |\n \\alu_b_imm (Inst_Load _ _ _ _ _) = True\\ |\n \\alu_b_imm (Inst_Store _ _ _ _) = True\\ |\n \\alu_b_imm _ = False\\\n\nlemma decode_alu_b_imm:\n \\alu_b_imm (mips.decode inst) \\ DecodedInst_alu_b_imm (decode inst)\\\n apply(simp add: mips.decode_def decode_def Let_def)\n by unat_arith\n\nprimrec convert_shift_op :: \\shift_op \\ 2 word\\ where\n \\convert_shift_op OP_SLL = SHL\\ |\n \\convert_shift_op OP_SRL = LSHR\\ |\n \\convert_shift_op OP_SRA = ASHR\\\n\nlemma decode_shifter_op:\n \\shifter_op (mips.decode inst) = Some op \\ DecodedInst_shifter_op (decode inst) = convert_shift_op op\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_ALU_I_bitwise_imm_ext_method:\n \\mips.decode inst = Inst_ALU_I op rt rs imm \\ is_bitwise_op op \\ DecodedInst_imm_ext_method (decode inst) = ZeroExt\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_ALU_I_non_bitwise_imm_ext_method:\n \\mips.decode inst = Inst_ALU_I op rt rs imm \\ \\ is_bitwise_op op \\ DecodedInst_imm_ext_method (decode inst) = SignExt\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n done\n\nlemma decode_LUI_imm_ext_method:\n \\mips.decode inst = Inst_LUI rt imm \\ DecodedInst_imm_ext_method (decode inst) = LUI_Ext\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun get_imm16 :: \\inst \\ 16 word option\\ where\n \\get_imm16 (Inst_ALU_I op rd rs imm) = Some imm\\ |\n \\get_imm16 (Inst_Branch op rs rt imm) = Some imm\\ |\n \\get_imm16 (Inst_Branch1 op rs imm) = Some imm\\ |\n \\get_imm16 (Inst_LUI rt imm) = Some imm\\ |\n \\get_imm16 (Inst_Load _ _ _ _ imm) = Some imm\\ |\n \\get_imm16 (Inst_Store _ _ _ imm) = Some imm\\ |\n \\get_imm16 _ = None\\\n\nlemma decode_imm16:\n \\get_imm16 (mips.decode inst) = Some imm \\ ucast inst = imm\\\n apply(simp add: mips.decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_Shift_I_shamt_imm:\n \\mips.decode inst = Inst_Shift_I op rd rt shamt \\ DecodedInst_shamt_imm (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_Shift_I_shamt:\n \\mips.decode inst = Inst_Shift_I op rd rt shamt \\ slice 6 inst = shamt\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_Shift_R_shamt_imm:\n \\mips.decode inst = Inst_Shift_R op rd rt rs \\ \\ DecodedInst_shamt_imm (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun is_jr :: \\inst \\ bool\\ where\n \\is_jr (Inst_JR _) = True\\ |\n \\is_jr (Inst_JALR _ _) = True\\ |\n \\is_jr _ = False\\\n\nlemma decode_jr_next_pc_sel:\n \\is_jr (mips.decode inst) \\ DecodedInst_next_pc_sel (decode inst) = NextPC_RS\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun is_jal :: \\inst \\ bool\\ where\n \\is_jal (Inst_JAL _) = True\\ |\n \\is_jal (Inst_JALR _ _) = True\\ |\n \\is_jal _ = False\\\n\nlemma decode_jal_rf_in_sel:\n \\is_jal (mips.decode inst) \\ DecodedInst_rf_in_sel (decode inst) = PC_plus8\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nfun get_imm26 :: \\inst \\ 26 word option\\ where\n \\get_imm26 (Inst_J imm) = Some imm\\ |\n \\get_imm26 (Inst_JAL imm) = Some imm\\ |\n \\get_imm26 _ = None\\\n\nlemma decode_imm26:\n \\get_imm26 (mips.decode inst) = Some imm \\ ucast inst = imm\\\n apply(simp add: mips.decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nprimrec convert_mem_req_size where\n \\convert_mem_req_size BYTE = Byte\\ |\n \\convert_mem_req_size HALF = Half\\ |\n \\convert_mem_req_size WORD = Word\\\n\nfun ls_size where\n \\ls_size (Inst_Load sz _ _ _ _) = Some sz\\ |\n \\ls_size (Inst_Store sz _ _ _) = Some sz\\ |\n \\ls_size _ = None\\\n\nlemma decode_dm_req_size:\n \\ls_size (mips.decode inst) = Some sz \\ DecodedInst_dm_req_size (decode inst) = convert_mem_req_size sz\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nterm DecodedInst_dm_ext_sign\nlemma decode_mem_data_sign_ext:\n \\mips.decode inst = Inst_Load sz sign rt rs imm \\ DecodedInst_mem_data_sign_ext (decode inst) = sign\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_load_dm_wr:\n \\mips.decode inst = Inst_Load sz sign rt rs imm \\ \\ DecodedInst_dm_wr (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_store_dm_wr:\n \\mips.decode inst = Inst_Store sz rt rs imm \\ DecodedInst_dm_wr (decode inst)\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0 :: 6 word)\\; simp)\n apply(cases \\UCAST(32\\6) inst = 0\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 2\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 3\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 4\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 6\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 7\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 8\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 9\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x20\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x21\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x22\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x23\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x24\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x25\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x26\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x27\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2a\\; simp add: ucast_slice)\n apply(cases \\UCAST(32\\6) inst = 0x2b\\; simp add: ucast_slice)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n apply(cases \\slice 26 inst = (32::6 word)\\; simp)\n apply(cases \\slice 26 inst = (33::6 word)\\; simp)\n apply(cases \\slice 26 inst = (34::6 word)\\; simp)\n apply(cases \\slice 26 inst = (36::6 word)\\; simp)\n apply(cases \\slice 26 inst = (37::6 word)\\; simp)\n apply(cases \\slice 26 inst = (40::6 word)\\; simp)\n apply(cases \\slice 26 inst = (41::6 word)\\; simp)\n apply(cases \\slice 26 inst = (43::6 word)\\; simp)\n done\n\nlemma decode_ls_imm_ext_method:\n \\is_ls (mips.decode inst) \\ DecodedInst_imm_ext_method (decode inst) = SignExt\\\n apply(simp add: mips.decode_def decode_def)\n apply(cases \\slice 26 inst = (0::6 word)\\; simp)\n apply(cases \\slice 26 inst = (2::6 word)\\; simp)\n apply(cases \\slice 26 inst = (3::6 word)\\; simp)\n apply(cases \\slice 26 inst = (4::6 word)\\; simp)\n apply(cases \\slice 26 inst = (5::6 word)\\; simp)\n apply(cases \\slice 26 inst = (6::6 word)\\; simp)\n apply(cases \\slice 26 inst = (7::6 word)\\; simp)\n apply(cases \\slice 26 inst = (8::6 word)\\; simp)\n apply(cases \\slice 26 inst = (9::6 word)\\; simp)\n apply(cases \\slice 26 inst = (10::6 word)\\; simp)\n apply(cases \\slice 26 inst = (11::6 word)\\; simp)\n apply(cases \\slice 26 inst = (12::6 word)\\; simp)\n apply(cases \\slice 26 inst = (13::6 word)\\; simp)\n apply(cases \\slice 26 inst = (14::6 word)\\; simp)\n apply(cases \\slice 26 inst = (15::6 word)\\; simp)\n done\n\nend\n", "meta": {"author": "wildptr", "repo": "vsmips", "sha": "ce076e17e31556ef1a98beb88afa0811c083620c", "save_path": "github-repos/isabelle/wildptr-vsmips", "path": "github-repos/isabelle/wildptr-vsmips/vsmips-ce076e17e31556ef1a98beb88afa0811c083620c/Decode_Correct.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.2567405056602779}} {"text": "section {*L\\_ATS\\_Simulation\\_Configuration\\_WeakLRReach*}\ntheory\n L_ATS_Simulation_Configuration_WeakLRReach\n\nimports\n L_ATS_Simulation_Configuration_Weak\n\nbegin\n\nlocale ATS_Simulation_Configuration_WeakReach =\n ATS_Simulation_Configuration_Weak\n \"TSstructure1 :: 'TSstructure1 \\ bool\"\n \"configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"initial_configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"step_labels1 :: 'TSstructure1 \\ 'label1 set\"\n \"step_relation1 :: 'TSstructure1 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ bool\"\n \"effects1 :: 'TSstructure1 \\ 'event1 set\"\n \"marking_condition1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ bool\"\n \"marked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"unmarked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"TSstructure2 :: 'TSstructure2 \\ bool\"\n \"configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"initial_configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"step_labels2 :: 'TSstructure2 \\ 'label2 set\"\n \"step_relation2 :: 'TSstructure2 \\ 'conf2 \\ 'label2 \\ 'conf2 \\ bool\"\n \"effects2 :: 'TSstructure2 \\ 'event2 set\"\n \"marking_condition2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ bool\"\n \"marked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"unmarked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"relation_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_initial_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_effect :: 'TSstructure1 \\ 'TSstructure2 \\ 'event1 \\ 'event2 \\ bool\"\n \"relation_TSstructure :: 'TSstructure1 \\ 'TSstructure2 \\ bool\"\n \"relation_initial_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n \"relation_step_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ 'conf2 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n for\n TSstructure1 configurations1 initial_configurations1 step_labels1 step_relation1 effects1 marking_condition1 marked_effect1 unmarked_effect1 TSstructure2 configurations2 initial_configurations2 step_labels2 step_relation2 effects2 marking_condition2 marked_effect2 unmarked_effect2 relation_configuration relation_initial_configuration relation_effect relation_TSstructure relation_initial_simulation relation_step_simulation\n +\n\nfixes relation_labelsLR :: \"'TSstructure1 \\ 'TSstructure2 \\ 'label1 \\ 'label2 \\ bool\"\n\nassumes AX_relation_step_simulationReach: \"\n relation_TSstructure G1 G2\n \\ relation_configuration G1 G2 c1 c2\n \\ e1 \\ step_labels1 G1\n \\ step_relation1 G1 c1 e1 c1'\n \\ GR.derivation G2 d2\n \\ GR.belongs G2 d2\n \\ the(get_configuration(d2 0)) = c2\n \\ relation_step_simulation G1 G2 c1 e1 c1' c2 d2\n \\ maximum_of_domain d2 n\n \\ relation_configuration G1 G2 c1' (the(get_configuration(d2 n)))\n \\ (\\k e2 c2.\n d2 k = Some (pair (Some e2) c2)\n \\ relation_labelsLR G1 G2 e1 e2)\n \\ (n=0\n \\ (\\d2' n2'.\n GR.derivation G2 d2'\n \\ the(get_configuration(d2' 0)) = c2\n \\ maximum_of_domain d2' n2'\n \\ (\\k e2 c2.\n d2' k = Some (pair (Some e2) c2)\n \\ relation_labelsLR G1 G2 e1 e2)))\"\n\ncontext ATS_Simulation_Configuration_WeakReach begin\n\nlemma ATS_Simulation_Configuration_WeakReach_simulation_derivation_exists_witness_EXTENDED_Reach: \"\n relation_TSstructure G1 G2\n \\ GL.derivation_initial G1 d1\n \\ d1 x = Some (pair e1 c1)\n \\ \\d2 n2 f.\n GR.derivation_initial G2 d2\n \\ maximum_of_domain d2 n2\n \\ relation_initial_configuration G1 G2 (the (get_configuration (d1 0))) (the (get_configuration (d2 0)))\n \\ relation_configuration G1 G2 c1 (the (get_configuration (d2 n2)))\n \\ simulating_derivation G1 G2 d1 x d2 n2 f\n \\ (\\i\\x. \\e1 c1. d1 i = Some (pair e1 c1) \\ (case e1 of None \\ True | Some e1' \\ \\k d2'.\n GR.derivation G2 d2'\n \\ the(get_configuration(d2' 0)) = the(get_configuration(d2 (f i)))\n \\ (case ((get_label (derivation_append d2 d2' (f i) k))) of None \\ False | Some e2' \\ relation_labelsLR G1 G2 e1' e2')))\"\n apply(induct x arbitrary: e1 c1)\n apply(rename_tac e1 c1)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"c1 \\ initial_configurations1 G1\")\n apply(rename_tac e1 c1)(*strict*)\n prefer 2\n apply(simp add: GL.derivation_initial_def)\n apply(rename_tac e1 c1)(*strict*)\n apply(subgoal_tac \"\\d2 n. GR.derivation_initial G2 d2 \\ relation_initial_configuration G1 G2 c1 (the(get_configuration(d2 0))) \\ relation_initial_simulation G1 G2 c1 d2 \\ maximum_of_domain d2 n \\ relation_configuration G1 G2 c1 (the(get_configuration(d2 n)))\")\n apply(rename_tac e1 c1)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation)\n apply(rename_tac e1 c1)(*strict*)\n apply(force)\n apply(rename_tac e1 c1)(*strict*)\n apply(force)\n apply(rename_tac e1 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"n\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(rule_tac\n x=\"\\x. n\"\n in exI)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: simulating_derivation_def)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: simulating_derivation_I_def)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: get_configuration_def)\n apply (metis GR.derivation_take_id_prime_prime GR.derivation_initial_is_derivation eq_imp_le)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: maximum_of_domain_def derivation_take_def get_configuration_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: simulating_derivation_S_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: simulating_derivation_DEF_def)\n apply(rule conjI)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac e1 c1 d2 n)(*strict*)\n apply(simp add: GL.derivation_initial_def)\n apply(rename_tac x e1 c1)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d1 x = Some (pair e1 c1) \\ d1 (Suc x) = Some (pair (Some e2) c2) \\ step_relation1 G1 c1 e2 c2\")\n apply(rename_tac x e1 c1)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc x\"\n in GL.step_detail_before_some_position)\n apply(rename_tac x e1 c1)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x e1 c1)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac x e1 c1)(*strict*)\n apply(force)\n apply(rename_tac x e1 c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a)(*strict*)\n apply(erule_tac\n x=\"e1a\"\n in meta_allE)\n apply(erule_tac\n x=\"c1a\"\n in meta_allE)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 xa)(*strict*)\n apply(rename_tac f)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n apply(subgoal_tac \"\\e c. d2 n2 = Some (pair e c)\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n prefer 2\n apply(rule GR.some_position_has_details_before_max_dom)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply(subgoal_tac \"\\d2 n. GR.derivation G2 d2 \\ GR.belongs G2 d2 \\ the(get_configuration(d2 0)) = c \\ relation_step_simulation G1 G2 c1a e2 c1 c d2 \\ maximum_of_domain d2 n \\ relation_configuration G1 G2 c1 (the(get_configuration(d2 n)))\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e c)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n)(*strict*)\n apply(rule_tac\n x=\"derivation_append d2 d2a n2\"\n in exI)\n apply(subgoal_tac \"\\c. d2a 0 = Some (pair None c)\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation_initial)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply (metis AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply (metis GR.derivation_initial_is_derivation)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule_tac\n x=\"n2+n\"\n in exI)\n apply(rule context_conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply (metis concat_has_max_dom)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule context_conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def derivation_append_def)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(rule_tac\n x=\"\\z. if z f x\")\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i y)(*strict*)\n prefer 2\n apply(rule_tac\n d=\"d2\"\n in GR.allPreMaxDomSome_prime)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i y)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i y)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i y)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i y)(*strict*)\n apply(simp add: derivation_append_def)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c)(*strict*)\n apply(erule disjE)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c)(*strict*)\n apply(simp add: derivation_append_def maximum_of_domain_def)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c)(*strict*)\n apply(subgoal_tac \"get_configuration(derivation_append d2 d2a (f x) (f x + n)) = get_configuration(d2a n)\")\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c)(*strict*)\n apply(simp add: derivation_append_def)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: simulating_derivation_S_def)\n apply(erule conjE)+\n apply(rule allI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n apply(case_tac \"i n2\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n prefer 2\n apply(simp add: simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na)(*strict*)\n apply(erule_tac\n x=\"i\"\n and P=\"\\i. i \\ x \\ (\\y. d2 (f i) = Some y) \\ relation_configuration G1 G2 (the (get_configuration (d1 i))) (the (get_configuration (d2 (f i))))\"\n in allE)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in GR.allPreMaxDomSome_prime)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n apply(rule_tac\n t=\"derivation_append d2 d2a n2 (f i)\"\n and s=\"d2 (f i)\"\n in ssubst)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n apply(simp add: derivation_append_def get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n apply(rule conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2')(*strict*)\n apply(erule conjE)+\n apply(erule exE)+\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(erule conjE)+\n apply(rule_tac\n x=\"na\"\n in exI)\n apply(rule conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(rule conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(subgoal_tac \"f i+na \\ n2\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n prefer 2\n apply(simp add: simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na)(*strict*)\n apply(erule_tac\n x=\"Suc i\"\n and P=\"\\i. i \\ x \\ (\\y. d2 (f i) = Some y) \\ relation_configuration G1 G2 (the (get_configuration (d1 i))) (the (get_configuration (d2 (f i))))\"\n in allE)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(rule_tac\n d=\"d2\"\n in GR.allPreMaxDomSome_prime)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 f e d2a n c i ei ci ei' ci' na y)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' d2' na)(*strict*)\n apply(clarsimp)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' na)(*strict*)\n apply(rule ext)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci' na xa)(*strict*)\n apply(simp add: derivation_take_def derivation_drop_def derivation_append_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n apply(rule conjI)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n apply(rule impI)\n apply(rule impI)\n apply(subgoal_tac \"i=x\")\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i)(*strict*)\n apply(thin_tac \"\\ i < x\")\n apply(thin_tac \"\\ i < x\")\n apply(thin_tac \"i < Suc x\")\n apply(rule allI)+\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c i ei ci ei' ci')(*strict*)\n apply(rule impI)\n apply(clarsimp)\n apply(rename_tac x d2 n2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(subgoal_tac \"f x=n2\")\n apply(rename_tac x d2 n2 f e d2a n c ei ci ei' ci')(*strict*)\n prefer 2\n apply(simp add: simulating_derivation_DEF_def)\n apply(rename_tac x d2 n2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(clarsimp)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(rule_tac\n t=\"(the (get_configuration (derivation_append d2 d2a (f x) (f x))))\"\n and s=\"(the (get_configuration (Some (pair None c))))\"\n in ssubst)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(simp add: get_configuration_def derivation_append_def)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(rule_tac\n t=\"derivation_take (derivation_drop (derivation_append d2 d2a (f x)) (f x)) n\"\n and s=\"d2a\"\n in ssubst)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(rule ext)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci' xa)(*strict*)\n apply(simp add: derivation_take_def derivation_drop_def derivation_append_def)\n apply(simp add: get_configuration_def)\n apply(clarsimp)\n apply (metis GR.allPreMaxDomSome_prime)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(rule conjI)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(force)\n apply(rename_tac x d2 f e d2a n c ei ci ei' ci')(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n prefer 2\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n)(*strict*)\n apply (metis GR.some_position_has_details_at_0)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(subgoal_tac \"(\\k e2' c2'. d2a k = Some (pair (Some e2') c2') \\ relation_labelsLR G1 G2 e2 e2') \\ (n=0 \\ (\\d2' n2'. GR.derivation G2 d2' \\ the(get_configuration(d2' 0)) = SSc \\ maximum_of_domain d2' n2' \\ (\\k e2' c2'. d2' k = Some (pair (Some e2') c2' ) \\ relation_labelsLR G1 G2 e2 e2')))\" for SSc)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulationReach)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n prefer 2\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rename_tac x c1 e1a e2 c1a d2 n2 f e d2a n c)(*strict*)\n apply(force)\n apply(rule allI)\n apply(case_tac \"i\\x\")\n apply(erule_tac x=\"i\" in allE)\n apply(clarsimp)\n apply(case_tac e1)\n apply(force)\n apply(clarsimp)\n apply(erule disjE)\n apply(clarsimp)\n apply(subgoal_tac \"f i\\n2\")\n apply(rule_tac x=\"k\" in exI)\n apply(rule_tac x=\"d2'\" in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(rule conjI)\n apply(force)\n apply(force)\n apply(simp add: simulating_derivation_def simulating_derivation_DEF_def)\n apply(clarsimp)\n apply (metis GR.allPreMaxDomSome_prime GR.derivation_initial_is_derivation option.distinct(1))\n apply(clarsimp)\n apply(subgoal_tac \"f i\\n2\")\n apply(case_tac \"k\\f i\")\n apply(rule_tac x=\"k\" in exI)\n apply(rule_tac x=\"d2'\" in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(rule_tac x=\"k\" in exI)\n apply(rule_tac x=\"d2'\" in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(simp add: get_configuration_def derivation_append_def get_label_def)\n apply(simp add: simulating_derivation_def simulating_derivation_DEF_def)\n apply(clarsimp)\n apply (metis GR.allPreMaxDomSome_prime GR.derivation_initial_is_derivation option.distinct(1))\n apply(rule impI)\n apply(subgoal_tac \"i=Suc x\")\n prefer 2\n apply(force)\n apply(erule_tac x=\"x\" in allE)\n apply(clarsimp)\n apply(subgoal_tac \"n2= f x\")\n prefer 2\n apply(simp add: simulating_derivation_def simulating_derivation_DEF_def)\n apply(clarsimp)\n apply(erule disjE)\n apply(clarsimp)\n apply(rule_tac\n x=\"f x+k\"\n in exI)\n apply(rule_tac\n x=\"der1 (the (get_configuration (derivation_append d2 d2a (f x) ((f x) + n))))\"\n in exI)\n apply(rule conjI)\n apply(rule GR.der1_is_derivation)\n apply(rule conjI)\n apply(simp add: der1_def get_configuration_def get_label_def derivation_append_def)\n apply(simp add: get_configuration_def get_label_def derivation_append_def)\n apply(case_tac k)\n apply(clarsimp)\n apply(clarsimp)\n apply(case_tac n)\n apply(clarsimp)\n apply(subgoal_tac \"False\")\n apply(force)\n apply (metis GR.derivationNoFromNone_prime GR.noSomeAfterMaxDom less_Suc_eq_0_disj)\n apply(clarsimp)\n apply(simp add: der1_def)\n apply(subgoal_tac \"nat>nata\")\n prefer 2\n apply(force)\n apply(clarsimp)\n apply(rule_tac\n m=\"Suc nat\"\n and d=\"d2a\"\n in GR.no_some_beyond_maximum_of_domain)\n apply(force)\n apply(force)\n apply(force)\n apply(force)\n apply(clarsimp)\n apply(rule_tac\n x=\"f x+k\"\n in exI)\n apply(rule_tac\n x=\"d2'\"\n in exI)\n apply(clarsimp)\n apply(rule conjI)\n apply(simp add: get_configuration_def)\n apply(simp add: derivation_append_def)\n apply(simp add: derivation_append_def)\n apply(case_tac k)\n apply(clarsimp)\n apply (metis GR.initialNotEdgeSome_prime)\n apply(clarsimp)\n apply(simp add: get_label_def)\n done\n\nlemma ATS_Simulation_Configuration_WeakReach_simulation_derivation_exists_witness: \"\n relation_TSstructure G1 G2\n \\ GL.derivation_initial G1 d1\n \\ d1 x = Some (pair e1 c1)\n \\ \\d2 n2 f.\n GR.derivation_initial G2 d2\n \\ maximum_of_domain d2 n2\n \\ relation_initial_configuration G1 G2 (the (get_configuration (d1 0))) (the (get_configuration (d2 0)))\n \\ relation_configuration G1 G2 c1 (the (get_configuration (d2 n2)))\n \\ simulating_derivation G1 G2 d1 x d2 n2 f\n \\ (case e1 of None \\ True | Some e1' \\ \\k d2'.\n GR.derivation G2 d2'\n \\ the(get_configuration(d2' 0)) = the(get_configuration(d2 n2))\n \\ (case ((get_label (derivation_append d2 d2' n2 k))) of None \\ False | Some e2' \\ relation_labelsLR G1 G2 e1' e2'))\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule ATS_Simulation_Configuration_WeakReach_simulation_derivation_exists_witness_EXTENDED_Reach)\n apply(force)\n apply(force)\n apply(force)\n apply(erule exE)+\n apply(rule_tac x=\"d2\" in exI)\n apply(rule_tac x=\"n2\" in exI)\n apply(rule_tac x=\"f\" in exI)\n apply(clarsimp)\n apply(erule_tac x=\"x\" in allE)\n apply(clarsimp)\n apply(case_tac e1)\n apply(force)\n apply(clarsimp)\n apply(rule_tac x=\"k\" in exI)\n apply(rule_tac x=\"d2'\" in exI)\n apply(clarsimp)\n apply(subgoal_tac \"n2=f x\")\n apply(clarsimp)\n apply(simp add: simulating_derivation_def simulating_derivation_DEF_def)\n done\n\ntheorem ATS_Simulation_Configuration_WeakReach_exists: \"\n relation_TSstructure G1 G2\n \\ GL.derivation_initial G1 d1\n \\ d1 x = Some (pair e1 c1)\n \\ \\d2 n2 e2 c2.\n GR.derivation_initial G2 d2\n \\ d2 n2 = Some (pair e2 c2)\n \\ (case e1 of None \\ True\n | Some e1' \\\n \\k d2'.\n GR.derivation G2 d2'\n \\ the(get_configuration(d2' 0)) = the(get_configuration(d2 n2))\n \\ (case ((get_label (derivation_append d2 d2' n2 k))) of\n None \\ False\n | Some e2' \\ relation_labelsLR G1 G2 e1' e2'))\"\n apply(subgoal_tac \"\\d2 n2 f. GR.derivation_initial G2 d2 \\ maximum_of_domain d2 n2 \\ relation_initial_configuration G1 G2 (the (get_configuration (d1 0))) (the (get_configuration (d2 0))) \\ relation_configuration G1 G2 c1 (the (get_configuration (d2 n2))) \\ simulating_derivation G1 G2 d1 x d2 n2 f \\ (case e1 of None \\ True | Some e1' \\ \\k d2'. GR.derivation G2 d2' \\ the(get_configuration(d2' 0)) = the(get_configuration(d2 n2)) \\ (case ((get_label (derivation_append d2 d2' n2 k))) of None \\ False | Some e2' \\ relation_labelsLR G1 G2 e1' e2'))\")\n prefer 2\n apply(rule ATS_Simulation_Configuration_WeakReach_simulation_derivation_exists_witness)\n apply(force)\n apply(force)\n apply(force)\n apply(erule exE)+\n apply(rename_tac d2 n2 f)(*strict*)\n apply(erule conjE)+\n apply(case_tac e1)\n apply(rename_tac d2 n2 f)(*strict*)\n apply(clarsimp)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(simp add: maximum_of_domain_def)\n apply(clarsimp)\n apply(rename_tac d2 n2 f y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d2 n2 f y option b)(*strict*)\n apply(force)\n apply(rename_tac d2 n2 f a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 f a k d2')(*strict*)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"n2\"\n in exI)\n apply(rule conjI)\n apply(rename_tac d2 n2 f a k d2')(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(clarsimp)\n apply(rename_tac d2 n2 f a k d2' y)(*strict*)\n apply(case_tac y)\n apply(rename_tac d2 n2 f a k d2' y option b)(*strict*)\n apply(force)\n apply(rename_tac d2 n2 f a k d2')(*strict*)\n apply(rule_tac\n x=\"k\"\n in exI)\n apply(rule_tac\n x=\"d2'\"\n in exI)\n apply(clarsimp)\n done\n\ntheorem ATS_Simulation_Configuration_WeakReach_exists_ALT: \"\n relation_TSstructure G1 G2\n \\ GL.derivation_initial G1 d1\n \\ d1 x = Some (pair (Some e1) c1)\n \\ \\d2 n2 e2 c2.\n GR.derivation_initial G2 d2\n \\ d2 n2 = Some (pair (Some e2) c2)\n \\ relation_labelsLR G1 G2 e1 e2\"\n apply(subgoal_tac \"X\" for X)\n prefer 2\n apply(rule ATS_Simulation_Configuration_WeakReach_exists)\n apply(force)\n apply(force)\n apply(force)\n apply(erule exE)+\n apply(rename_tac d2 n2 e2 c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(rule_tac x=\"derivation_append d2 d2' n2\" in exI)\n apply(rule conjI)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(rule GR.derivation_append_preserves_derivation_initial)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply (metis AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(force)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(rule GR.derivation_append_preserves_derivation)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(simp add: GR.derivation_initial_def)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(force)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d2' 0\")\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 k d2')(*strict*)\n apply(simp add: GR.derivation_def GR.derivation_initial_def)\n apply(clarsimp)\n apply(erule_tac x=\"0\" in allE)+\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2' a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 k d2' a)(*strict*)\n apply(case_tac a)\n apply(rename_tac d2 n2 e2 k d2' a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 k d2' option conf)(*strict*)\n apply(case_tac option)\n apply(rename_tac d2 n2 e2 k d2' option conf)(*strict*)\n apply(force)\n apply(rename_tac d2 n2 e2 k d2' option conf a)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 k d2' conf a)(*strict*)\n apply(simp add: GR.derivation_def GR.derivation_initial_def)\n apply(clarsimp)\n apply(erule_tac x=\"0\" in allE)+\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(rule_tac x=\"k\" in exI)\n apply(simp add: get_label_def)\n apply(case_tac \"derivation_append d2 d2' n2 k\")\n apply(rename_tac d2 n2 e2 c2 k d2')(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2' a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac d2 n2 e2 c2 k d2' a option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2' option conf)(*strict*)\n apply(case_tac option)\n apply(rename_tac d2 n2 e2 c2 k d2' option conf)(*strict*)\n apply(clarsimp)\n apply(rename_tac d2 n2 e2 c2 k d2' option conf a)(*strict*)\n apply(clarsimp)\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Simulation_Configuration_WeakLRReach.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.2567404996563762}} {"text": "\n(* Title: Jinja/JVM/JVMExecInstrInductive.thy\n Author: Susannah Mansky\n 2018, UIUC\n*)\n\nsection {* Inductive Program Execution in the JVM *}\n\ntheory JVMExecInstrInductive\nimports JVMExec\nbegin\n\ndatatype step_input = StepI instr | StepC cname | StepT addr\n\n\ninductive exec_step_ind :: \"[step_input, jvm_prog, heap, val list, val list,\n cname, mname, pc, init_call_status, frame list, sheap,jvm_state] \\ bool\"\nwhere\n exec_step_ind_Load:\n\"exec_step_ind (StepI (Load n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, ((loc ! n) # stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_Store:\n\"exec_step_ind (StepI (Store n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (tl stk, loc[n:=hd stk], C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_Push:\n\"exec_step_ind (StepI (Push v)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (v # stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_NewOOM_Called:\n\"new_Addr h = None\n \\ exec_step_ind (StepI (New C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc Called frs sh\n (\\addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, No_ics)#frs, sh)\"\n\n| exec_step_ind_NewOOM_Done:\n\"\\ sh C = Some(obj, Done); new_Addr h = None; ics \\ Called \\\n \\ exec_step_ind (StepI (New C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_New_Called:\n\"new_Addr h = Some a\n \\ exec_step_ind (StepI (New C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc Called frs sh\n (None, h(a\\blank P C), (Addr a#stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, No_ics)#frs, sh)\"\n\n| exec_step_ind_New_Done:\n\"\\ sh C = Some(obj, Done); new_Addr h = Some a; ics \\ Called \\\n \\ exec_step_ind (StepI (New C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h(a\\blank P C), (Addr a#stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_New_Init:\n\"\\ \\obj. sh C \\ Some(obj, Done); ics \\ Called \\\n \\ exec_step_ind (StepI (New C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, Calling C)#frs, sh)\"\n\n| exec_step_ind_Getfield_Null:\n\"hd stk = Null\n \\ exec_step_ind (StepI (Getfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getfield_NoField:\n\"\\ v = hd stk; (D,fs) = the(h(the_Addr v)); v \\ Null; \\(\\t b. P \\ D has F,b:t in C) \\\n \\ exec_step_ind (StepI (Getfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchFieldError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getfield_Static:\n\"\\ v = hd stk; (D,fs) = the(h(the_Addr v)); v \\ Null; P \\ D has F,Static:t in C \\\n \\ exec_step_ind (StepI (Getfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getfield:\n\"\\ v = hd stk; (D,fs) = the(h(the_Addr v)); (D',b,t) = field P C F; v \\ Null;\n P \\ D has F,NonStatic:t in C \\\n \\ exec_step_ind (StepI (Getfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (the(fs(F,C))#(tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc+1, ics)#frs, sh)\"\n\n| exec_step_ind_Getstatic_NoField:\n\"\\(\\t b. P \\ C has F,b:t in D)\n \\ exec_step_ind (StepI (Getstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchFieldError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getstatic_NonStatic:\n\"P \\ C has F,NonStatic:t in D\n \\ exec_step_ind (StepI (Getstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getstatic_Called:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D;\n the(sh D') = (sfs,i);\n v = the (sfs F) \\\n \\ exec_step_ind (StepI (Getstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc Called frs sh\n (None, h, (v#stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, No_ics)#frs, sh)\"\n\n| exec_step_ind_Getstatic_Done:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D;\n ics \\ Called; sh D' = Some(sfs,Done);\n v = the (sfs F) \\\n \\ exec_step_ind (StepI (Getstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (v#stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_Getstatic_Init:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D;\n \\sfs. sh D' \\ Some(sfs,Done); ics \\ Called \\\n \\ exec_step_ind (StepI (Getstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, Calling D')#frs, sh)\"\n\n| exec_step_ind_Putfield_Null:\n\"hd(tl stk) = Null\n \\ exec_step_ind (StepI (Putfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Putfield_NoField:\n\"\\ r = hd(tl stk); a = the_Addr r; (D,fs) = the (h a); r \\ Null; \\(\\t b. P \\ D has F,b:t in C) \\\n \\ exec_step_ind (StepI (Putfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchFieldError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Putfield_Static:\n\"\\ r = hd(tl stk); a = the_Addr r; (D,fs) = the (h a); r \\ Null; P \\ D has F,Static:t in C \\\n \\ exec_step_ind (StepI (Putfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Putfield:\n\"\\ v = hd stk; r = hd(tl stk); a = the_Addr r; (D,fs) = the (h a); (D',b,t) = field P C F;\n r \\ Null; P \\ D has F,NonStatic:t in C \\\n \\ exec_step_ind (StepI (Putfield F C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h(a \\ (D, fs((F,C) \\ v))), (tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc+1, ics)#frs, sh)\"\n\n| exec_step_ind_Putstatic_NoField:\n\"\\(\\t b. P \\ C has F,b:t in D)\n \\ exec_step_ind (StepI (Putstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchFieldError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Putstatic_NonStatic:\n\"P \\ C has F,NonStatic:t in D\n \\ exec_step_ind (StepI (Putstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Putstatic_Called:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D; the(sh D') = (sfs, i) \\\n \\ exec_step_ind (StepI (Putstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc Called frs sh\n (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, No_ics)#frs, sh(D':=Some ((sfs(F \\ hd stk)), i)))\"\n\n| exec_step_ind_Putstatic_Done:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D;\n ics \\ Called; sh D' = Some (sfs, Done) \\\n \\ exec_step_ind (StepI (Putstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh(D':=Some ((sfs(F \\ hd stk)), Done)))\"\n\n| exec_step_ind_Putstatic_Init:\n\"\\ (D',b,t) = field P D F; P \\ C has F,Static:t in D;\n \\sfs. sh D' \\ Some (sfs, Done); ics \\ Called \\\n \\ exec_step_ind (StepI (Putstatic C F D)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, Calling D')#frs, sh)\"\n\n| exec_step_ind_Checkcast:\n\"cast_ok P C h (hd stk)\n \\ exec_step_ind (StepI (Checkcast C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_Checkcast_Error:\n\"\\cast_ok P C h (hd stk)\n \\ exec_step_ind (StepI (Checkcast C)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt ClassCast\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invoke_Null:\n\"stk!n = Null\n \\ exec_step_ind (StepI (Invoke M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invoke_NoMethod:\n\"\\ r = stk!n; C = fst(the(h(the_Addr r))); r \\ Null;\n \\(\\Ts T m D b. P \\ C sees M,b:Ts \\ T = m in D) \\\n \\ exec_step_ind (StepI (Invoke M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchMethodError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invoke_Static:\n\"\\ r = stk!n; C = fst(the(h(the_Addr r)));\n (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt)= method P C M; r \\ Null;\n P \\ C sees M,Static:Ts \\ T = m in D \\\n \\ exec_step_ind (StepI (Invoke M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invoke:\n\"\\ ps = take n stk; r = stk!n; C = fst(the(h(the_Addr r)));\n (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt)= method P C M; r \\ Null;\n P \\ C sees M,NonStatic:Ts \\ T = m in D;\n f' = ([],[r]@(rev ps)@(replicate mxl\\<^sub>0 undefined),D,M,0,No_ics) \\\n \\ exec_step_ind (StepI (Invoke M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, f'#(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invokestatic_NoMethod:\n\"\\ (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt)= method P C M; \\(\\Ts T m D b. P \\ C sees M,b:Ts \\ T = m in D) \\\n \\ exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NoSuchMethodError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invokestatic_NonStatic:\n\"\\ (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt)= method P C M; P \\ C sees M,NonStatic:Ts \\ T = m in D \\\n \\ exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt IncompatibleClassChangeError\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invokestatic_Called:\n\"\\ ps = take n stk; (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt) = method P C M;\n P \\ C sees M,Static:Ts \\ T = m in D;\n f' = ([],(rev ps)@(replicate mxl\\<^sub>0 undefined),D,M,0,No_ics) \\\n \\ exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc Called frs sh\n (None, h, f'#(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, No_ics)#frs, sh)\"\n\n| exec_step_ind_Invokestatic_Done:\n\"\\ ps = take n stk; (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt) = method P C M;\n P \\ C sees M,Static:Ts \\ T = m in D;\n ics \\ Called; sh D = Some (sfs, Done);\n f' = ([],(rev ps)@(replicate mxl\\<^sub>0 undefined),D,M,0,No_ics) \\\n \\ exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, f'#(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Invokestatic_Init:\n\"\\ (D,b,Ts,T,mxs,mxl\\<^sub>0,ins,xt) = method P C M;\n P \\ C sees M,Static:Ts \\ T = m in D;\n \\sfs. sh D \\ Some (sfs, Done); ics \\ Called \\\n \\ exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, Calling D)#frs, sh)\"\n\n| exec_step_ind_Return_Last_Init:\n \"exec_step_ind (StepI Return) P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 clinit pc ics [] sh\n (None, h, [], sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Done)))\"\n\n| exec_step_ind_Return_Last:\n \"M\\<^sub>0 \\ clinit\n \\ exec_step_ind (StepI Return) P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc ics [] sh (None, h, [], sh)\"\n\n| exec_step_ind_Return_Init:\n \"\\ (D,b,Ts,T,m) = method P C\\<^sub>0 clinit \\\n \\ exec_step_ind (StepI Return) P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 clinit pc ics ((stk',loc',C',m',pc',ics')#frs') sh\n (None, h, (stk',loc',C',m',pc',ics')#frs', sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Done)))\"\n\n| exec_step_ind_Return_NonStatic:\n \"\\ (D,NonStatic,Ts,T,m) = method P C\\<^sub>0 M\\<^sub>0; M\\<^sub>0 \\ clinit \\\n \\ exec_step_ind (StepI Return) P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc ics ((stk',loc',C',m',pc',ics')#frs') sh\n (None, h, ((hd stk\\<^sub>0)#(drop (length Ts + 1) stk'),loc',C',m',Suc pc',ics')#frs', sh)\"\n\n| exec_step_ind_Return_Static:\n \"\\ (D,Static,Ts,T,m) = method P C\\<^sub>0 M\\<^sub>0; M\\<^sub>0 \\ clinit \\\n \\ exec_step_ind (StepI Return) P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc ics ((stk',loc',C',m',pc',ics')#frs') sh\n (None, h, ((hd stk\\<^sub>0)#(drop (length Ts) stk'),loc',C',m',Suc pc',ics')#frs', sh)\"\n\n| exec_step_ind_Pop:\n\"exec_step_ind (StepI Pop) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_IAdd:\n\"exec_step_ind (StepI IAdd) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (Intg (the_Intg (hd (tl stk)) + the_Intg (hd stk))#(tl (tl stk)), loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_IfFalse_False:\n\"hd stk = Bool False\n \\ exec_step_ind (StepI (IfFalse i)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, nat(int pc+i), ics)#frs, sh)\"\n\n| exec_step_ind_IfFalse_nFalse:\n\"hd stk \\ Bool False\n \\ exec_step_ind (StepI (IfFalse i)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_CmpEq:\n\"exec_step_ind (StepI CmpEq) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (Bool (hd (tl stk) = hd stk) # tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, Suc pc, ics)#frs, sh)\"\n\n| exec_step_ind_Goto:\n\"exec_step_ind (StepI (Goto i)) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, nat(int pc+i), ics)#frs, sh)\"\n\n| exec_step_ind_Throw:\n\"hd stk \\ Null\n \\ exec_step_ind (StepI Throw) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\the_Addr (hd stk)\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Throw_Null:\n\"hd stk = Null\n \\ exec_step_ind (StepI Throw) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (\\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Init_None_Called:\n\"\\ sh C = None; ics = Called \\\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, Calling C)#frs, sh(C := Some (sblank P C, Prepared)))\"\n\n| exec_step_ind_Init_None_nCalled:\n\"\\ sh C = None; ics \\ Called \\\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ICalling C)#frs, sh(C := Some (sblank P C, Prepared)))\"\n\n| exec_step_ind_Init_Done:\n\"sh C = Some (sfs, Done)\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Init_Processing:\n\"sh C = Some (sfs, Processing)\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Init_Error:\n\"\\ sh C = Some (sfs, Error); (stk',loc',D',M',pc',ics') = create_init_frame P C \\\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk',loc',D',M',pc',Throwing (addr_of_sys_xcpt NoClassDefFoundError))\n #(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh)\"\n\n| exec_step_ind_Init_Prepared_Object:\n\"\\ sh C = Some (sfs, Prepared);\n sh' = sh(C:=Some(fst(the(sh C)), Processing));\n C = Object \\\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, create_init_frame P C#(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh')\"\n\n| exec_step_ind_Init_Prepared_nObject:\n\"\\ sh C = Some (sfs, Prepared); (stk',loc',C',m',pc',ics') = create_init_frame P C;\n sh' = sh(C:=Some(fst(the(sh C)), Processing));\n C \\ Object; D = fst(the(class P C)) \\\n \\ exec_step_ind (StepC C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh\n (None, h, (stk',loc',C',m',pc',ICalling D)#(stk, loc, C\\<^sub>0, M\\<^sub>0, pc, ics)#frs, sh')\"\n\n| exec_step_ind_InitThrow_Init:\n\"ics' \\ Called\n \\ exec_step_ind (StepT a) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics ((stk',loc',C',clinit,pc',ics')#frs') sh\n (None, h, (stk',loc',C',clinit,pc',Throwing a)#frs', (sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Error))))\"\n\n| exec_step_ind_InitThrow_Called:\n\"exec_step_ind (StepT a) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics ((stk',loc',C',m',pc',Called)#frs') sh\n (\\a\\, h, (stk',loc',C',m',pc',No_ics)#frs', (sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Error))))\"\n\n| exec_step_ind_InitThrow_Other:\n\"\\ ics' \\ Called; m' \\ clinit \\\n \\ exec_step_ind (StepT a) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics ((stk',loc',C',m',pc',ics')#frs') sh\n (\\a\\, h, (stk',loc',C',m',pc',ics')#frs', (sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Error))))\"\n\n| exec_step_ind_InitThrow_Last:\n\"exec_step_ind (StepT a) P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics [] sh\n (\\a\\, h, [], (sh(C\\<^sub>0:=Some(fst(the(sh C\\<^sub>0)), Error))))\"\n\n(** ******* **)\n\ninductive_cases exec_step_ind_cases [cases set]:\n \"exec_step_ind (StepI (Load n)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Store n)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Push v)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (New C)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Getfield F C)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Getstatic C F D)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Putfield F C)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Putstatic C F D)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Checkcast C)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Invoke M n)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Invokestatic C M n)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI Return) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI Pop) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI IAdd) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (IfFalse i)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI CmpEq) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI (Goto i)) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepI Throw) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepC C) P h stk loc C M pc ics frs sh \\\"\n \"exec_step_ind (StepT a) P h stk loc C M pc ics frs sh \\\"\n\n(* HERE: MOVE *)\nfun exec_step_input :: \"[jvm_prog, cname, mname, pc, init_call_status]\n \\ step_input \\ init_call_status\" where\n\"exec_step_input P C M pc (Calling C') = (StepC C', Called)\" |\n\"exec_step_input P C M pc (ICalling C') = (StepC C', No_ics)\" |\n\"exec_step_input P C M pc (Throwing a) = (StepT a, Throwing a)\" |\n\"exec_step_input P C M pc ics = (StepI (instrs_of P C M ! pc), ics)\"\n\nlemma exec_step_imp_exec_step_ind:\nassumes \"exec_step P h stk loc C M pc ics frs sh = (xp', h', frs', sh')\"\n and \"exec_step_input P C M pc ics = (si, ics')\"\nshows \"exec_step_ind si P h stk loc C M pc ics' frs sh (xp', h', frs', sh')\"\nproof(cases si)\n case (StepT a)\n then have exec_Throwing: \n \"exec_Throwing a P h stk loc C M pc (Throwing a) frs sh = (xp', h', frs', sh')\"\n \"ics = ics'\" using assms by(cases ics, auto)+\n then obtain stk' loc' C' m' pc' ics' where lets: \"(stk',loc',C',m',pc',ics') = hd frs\"\n by(cases \"hd frs\", simp)\n then show ?thesis using exec_step_ind_InitThrow_Init exec_step_ind_InitThrow_Called\n exec_step_ind_InitThrow_Other exec_step_ind_InitThrow_Last StepT exec_Throwing\n by(cases frs; cases \"m' = clinit\"; cases ics', auto)\nnext\n case (StepC C1)\n obtain D b Ts T m where lets: \"method P C1 clinit = (D,b,Ts,T,m)\" by(cases \"method P C1 clinit\")\n then obtain mxs mxl\\<^sub>0 ins xt where m: \"m = (mxs,mxl\\<^sub>0,ins,xt)\" by(cases m)\n show ?thesis\n proof(cases \"sh C1\")\n case None then show ?thesis\n using exec_step_ind_Init_None_Called exec_step_ind_Init_None_nCalled StepC assms\n by(cases ics, auto)\n next\n case (Some a)\n then obtain sfs i where sfsi: \"a = (sfs,i)\" by(cases a)\n then show ?thesis using exec_step_ind_Init_Done exec_step_ind_Init_Processing\n exec_step_ind_Init_Error m lets Some StepC assms\n proof(cases i)\n case Prepared\n show ?thesis\n using exec_step_ind_Init_Prepared_Object[where P=P] exec_step_ind_Init_Prepared_nObject\n sfsi m lets Prepared Some StepC assms by(cases ics, auto split: if_split_asm)\n qed(cases ics, auto)+\n qed\nnext\n case (StepI i)\n then have exec_instr: \"exec_instr i P h stk loc C M pc ics' frs sh = (xp', h', frs', sh')\"\n \"ics = ics'\" using assms by(cases ics, auto)+\n show ?thesis\n proof(cases i)\n case (Load x1) then show ?thesis using exec_instr exec_step_ind_Load StepI by auto\n next\n case (Store x2) then show ?thesis using exec_instr exec_step_ind_Store StepI by auto\n next\n case (Push x3) then show ?thesis using exec_instr exec_step_ind_Push StepI by auto\n next\n case (New C1)\n then obtain sfs i where sfsi: \"the(sh C1) = (sfs,i)\" by(cases \"the(sh C1)\")\n then show ?thesis using exec_step_ind_New_Called exec_step_ind_NewOOM_Called\n exec_step_ind_New_Done exec_step_ind_NewOOM_Done\n exec_step_ind_New_Init sfsi New StepI exec_instr by(cases ics; cases i, auto)\n next\n case (Getfield F1 C1)\n then obtain D fs D' b t where lets: \"the(h(the_Addr (hd stk))) = (D,fs)\"\n \"field P C1 F1 = (D',b,t)\" by(cases \"the(h(the_Addr (hd stk)))\", cases \"field P C1 F1\")\n then have \"\\b' t'. P \\ D has F1,b':t' in C1 \\ (D', b, t) = (C1, b', t')\"\n using field_def2 has_field_idemp has_field_sees by fastforce\n then show ?thesis using exec_step_ind_Getfield_Null exec_step_ind_Getfield_NoField\n exec_step_ind_Getfield_Static lets Getfield StepI exec_instr\n by(cases b, auto split: if_split_asm) (metis Suc_eq_plus1 exec_step_ind_Getfield)+\n next\n case (Getstatic C1 F1 D1)\n then obtain D' b t where lets: \"field P D1 F1 = (D',b,t)\" by(cases \"field P D1 F1\")\n then have field: \"\\b' t'. P \\ C1 has F1,b':t' in D1 \\ (D', b, t) = (D1, b', t')\"\n using field_def2 has_field_idemp has_field_sees by fastforce\n show ?thesis\n proof(cases b)\n case NonStatic then show ?thesis\n using exec_step_ind_Getstatic_NoField exec_step_ind_Getstatic_NonStatic\n field lets Getstatic exec_instr StepI by(auto split: if_split_asm) fastforce\n next\n case Static show ?thesis\n proof(cases \"ics = Called\")\n case True then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Called exec_step_ind_Getstatic_Init\n Static field lets Getstatic exec_instr StepI\n by(cases \"the(sh D1)\", cases ics, auto split: if_split_asm) metis\n next\n case False\n then have nCalled: \"ics \\ Called\" by simp\n show ?thesis\n proof(cases \"sh D1\")\n case None\n then have nDone: \"\\sfs. sh D1 \\ Some(sfs, Done)\" by simp\n then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n field lets None False Static Getstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case (Some a)\n then obtain sfs i where sfsi: \"a=(sfs,i)\" by(cases a)\n show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Init sfsi False Static Some field lets Getstatic exec_instr\n proof(cases \"i = Done\")\n case True then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Done[OF _ _ nCalled] exec_step_ind_Getstatic_Init\n sfsi False Static Some field lets Getstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case nD: False\n then have nDone: \"\\sfs. sh D1 \\ Some(sfs, Done)\" using sfsi Some by simp\n show ?thesis using nD\n proof(cases i)\n case Processing then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Getstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case Prepared then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Getstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case Error then show ?thesis using exec_step_ind_Getstatic_NoField\n exec_step_ind_Getstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Getstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n qed(simp)\n qed\n qed\n qed\n qed\n next\n case (Putfield F1 C1)\n then obtain D fs D' b t where lets: \"the(h(the_Addr (hd(tl stk)))) = (D,fs)\"\n \"field P C1 F1 = (D',b,t)\" by(cases \"the(h(the_Addr (hd(tl stk))))\", cases \"field P C1 F1\")\n then have \"\\b' t'. P \\ D has F1,b':t' in C1 \\ (D', b, t) = (C1, b', t')\"\n using field_def2 has_field_idemp has_field_sees by fastforce\n then show ?thesis using exec_step_ind_Putfield_Null exec_step_ind_Putfield_NoField\n exec_step_ind_Putfield_Static lets Putfield exec_instr StepI\n by(cases b, auto split: if_split_asm) (metis Suc_eq_plus1 exec_step_ind_Putfield)+\n next\n case (Putstatic C1 F1 D1)\n then obtain D' b t where lets: \"field P D1 F1 = (D',b,t)\" by(cases \"field P D1 F1\")\n then have field: \"\\b' t'. P \\ C1 has F1,b':t' in D1 \\ (D', b, t) = (D1, b', t')\"\n using field_def2 has_field_idemp has_field_sees by fastforce\n show ?thesis\n proof(cases b)\n case NonStatic then show ?thesis\n using exec_step_ind_Putstatic_NoField exec_step_ind_Putstatic_NonStatic\n field lets Putstatic exec_instr StepI by(auto split: if_split_asm) fastforce\n next\n case Static show ?thesis\n proof(cases \"ics = Called\")\n case True then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Called exec_step_ind_Putstatic_Init\n Static field lets Putstatic exec_instr StepI\n by(cases \"the(sh D1)\", cases ics, auto split: if_split_asm) metis\n next\n case False\n then have nCalled: \"ics \\ Called\" by simp\n show ?thesis\n proof(cases \"sh D1\")\n case None\n then have nDone: \"\\sfs. sh D1 \\ Some(sfs, Done)\" by simp\n then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n field lets None False Static Putstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case (Some a)\n then obtain sfs i where sfsi: \"a=(sfs,i)\" by(cases a)\n show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Init sfsi False Static Some field lets Putstatic exec_instr\n proof(cases \"i = Done\")\n case True then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Done[OF _ _ nCalled] exec_step_ind_Putstatic_Init\n sfsi False Static Some field lets Putstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case nD: False\n then have nDone: \"\\sfs. sh D1 \\ Some(sfs, Done)\" using sfsi Some by simp\n show ?thesis using nD\n proof(cases i)\n case Processing then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Putstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case Prepared then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Putstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n next\n case Error then show ?thesis using exec_step_ind_Putstatic_NoField\n exec_step_ind_Putstatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some field lets Putstatic exec_instr StepI\n by(cases ics, auto split: if_split_asm) metis+\n qed(simp)\n qed\n qed\n qed\n qed\n next\n case (Checkcast x9) then show ?thesis\n using exec_step_ind_Checkcast exec_step_ind_Checkcast_Error exec_instr StepI\n by(auto split: if_split_asm)\n next\n case (Invoke M1 n) show ?thesis\n proof(cases \"stk!n = Null\")\n case True then show ?thesis using exec_step_ind_Invoke_Null Invoke exec_instr StepI\n by clarsimp\n next\n case False\n let ?C = \"cname_of h (the_Addr (stk ! n))\"\n obtain D b Ts T m where method: \"method P ?C M1 = (D,b,Ts,T,m)\" by(cases \"method P ?C M1\")\n then obtain mxs mxl\\<^sub>0 ins xt where \"m = (mxs,mxl\\<^sub>0,ins,xt)\" by(cases m)\n then show ?thesis using exec_step_ind_Invoke_NoMethod\n exec_step_ind_Invoke_Static exec_step_ind_Invoke method False Invoke exec_instr StepI\n by(cases b; auto split: if_split_asm)\n qed\n next\n case (Invokestatic C1 M1 n)\n obtain D b Ts T m where lets: \"method P C1 M1 = (D,b,Ts,T,m)\" by(cases \"method P C1 M1\")\n then obtain mxs mxl\\<^sub>0 ins xt where m: \"m = (mxs,mxl\\<^sub>0,ins,xt)\" by(cases m)\n have method: \"\\b' Ts' t' m' D'. P \\ C1 sees M1,b':Ts' \\ t' = m' in D'\n \\ (D,b,Ts,T,m) = (D',b',Ts',t',m')\" using lets by auto\n show ?thesis\n proof(cases b)\n case NonStatic then show ?thesis\n using exec_step_ind_Invokestatic_NoMethod exec_step_ind_Invokestatic_NonStatic\n m method lets Invokestatic exec_instr StepI by(auto split: if_split_asm)\n next\n case Static show ?thesis\n proof(cases \"ics = Called\")\n case True then show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Called exec_step_ind_Invokestatic_Init\n Static m method lets Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n next\n case False\n then have nCalled: \"ics \\ Called\" by simp\n show ?thesis\n proof(cases \"sh D\")\n case None\n then have nDone: \"\\sfs. sh D \\ Some(sfs, Done)\" by simp\n show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Init[where sh=sh, OF _ _ nDone nCalled]\n method m lets None False Static Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n next\n case (Some a)\n then obtain sfs i where sfsi: \"a=(sfs,i)\" by(cases a)\n show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Init sfsi False Static Some method lets Invokestatic exec_instr\n proof(cases \"i = Done\")\n case True then show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Done[OF _ _ _ nCalled] exec_step_ind_Invokestatic_Init\n sfsi False Static Some m method lets Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n next\n case nD: False\n then have nDone: \"\\sfs. sh D \\ Some(sfs, Done)\" using sfsi Some by simp\n show ?thesis using nD\n proof(cases i)\n case Processing then show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some m method lets Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n next\n case Prepared then show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some m method lets Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n next\n case Error then show ?thesis using exec_step_ind_Invokestatic_NoMethod\n exec_step_ind_Invokestatic_Init[where sh=sh, OF _ _ nDone nCalled]\n sfsi False Static Some m method lets Invokestatic exec_instr StepI\n by(cases ics, auto split: if_split_asm)\n qed(simp)\n qed\n qed\n qed\n qed\n next\n case Return\n obtain D b Ts T m where method: \"method P C M = (D,b,Ts,T,m)\" by(cases \"method P C M\")\n then obtain mxs mxl\\<^sub>0 ins xt where \"m = (mxs,mxl\\<^sub>0,ins,xt)\" by(cases m)\n then show ?thesis using exec_step_ind_Return_Last_Init exec_step_ind_Return_Last\n exec_step_ind_Return_Init exec_step_ind_Return_NonStatic exec_step_ind_Return_Static\n method Return exec_instr StepI\n by(cases b; cases frs; cases \"M = clinit\"; cases ics, auto split: if_split_asm)\n next\n case Pop then show ?thesis using exec_instr StepI exec_step_ind_Pop by auto\n next\n case IAdd then show ?thesis using exec_instr StepI exec_step_ind_IAdd by auto\n next\n case (Goto x15) then show ?thesis using exec_instr StepI exec_step_ind_Goto by auto\n next\n case CmpEq then show ?thesis using exec_instr StepI exec_step_ind_CmpEq by auto\n next\n case (IfFalse x17) then show ?thesis using exec_instr StepI exec_step_ind_IfFalse_nFalse\n proof(cases \"hd stk\")\n case (Bool b) then show ?thesis using exec_step_ind_IfFalse_False\n exec_step_ind_IfFalse_nFalse IfFalse exec_instr StepI by(cases b, auto)\n qed(auto)\n next\n case Throw then show ?thesis\n using exec_instr StepI exec_step_ind_Throw exec_step_ind_Throw_Null\n by(cases \"hd stk = Null\", auto)\n qed\nqed\n\nlemma exec_step_ind_imp_exec_step:\nassumes \"exec_step_ind si P h stk loc C M pc ics' frs sh (xp', h', frs', sh')\"\nshows \"\\ics. exec_step_input P C M pc ics = (si, ics')\n \\ exec_step P h stk loc C M pc ics frs sh = (xp', h', frs', sh')\"\nusing assms\nproof(induct rule: exec_step_ind.induct)\n case (exec_step_ind_NewOOM_Done sh C obj h ics P stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_New_Done sh C obj h a ics P stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_New_Init sh C ics P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases \"snd(the(sh C))\"; cases ics, auto)\nnext\n case (exec_step_ind_Getfield_NoField v stk D fs h P F C loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"the (h (the_Addr (hd stk)))\", cases ics, auto)\nnext\n case (exec_step_ind_Getfield_Static v stk D fs h P F t C loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case\n by(cases \"the (h (the_Addr (hd stk)))\", cases \"field P C F\", cases \"fst(snd(field P C F))\",\n cases ics, auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Getfield v stk D fs h D' b t P C F loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"the (h (the_Addr (hd stk)))\", cases \"field P C F\",\n cases ics, auto) (fastforce dest: has_field_sees[OF has_field_idemp])+\nnext\n case (exec_step_ind_Getstatic_NonStatic P C F t D h stk loc C\\<^sub>0 M\\<^sub>0 pc ics1 frs sh)\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\";\n cases ics, auto) (fastforce dest: has_field_sees[OF has_field_idemp])+\nnext\n case (exec_step_ind_Getstatic_Called D' b t P D F C ics ics' v h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\",\n cases ics, auto) (fastforce dest: has_field_sees[OF has_field_idemp])+\nnext\n case (exec_step_ind_Getstatic_Done D' b t P D F C ics sh sfs v h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\"; cases ics,\n auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Getstatic_Init D' b t P D F C sh ics h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case\n by(cases \"field P D F\", cases \"fst(snd(field P D F))\"; cases ics; cases \"snd(the(sh D'))\",\n auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Putfield_NoField r stk a D fs h P F C loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"the (h (the_Addr (hd(tl stk))))\", cases ics, auto)\nnext\n case (exec_step_ind_Putfield_Static r stk a D fs h P F t C loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case\n by(cases \"the (h (the_Addr (hd(tl stk))))\", cases \"field P C F\", cases \"fst(snd(field P C F))\",\n cases ics, auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Putfield v stk r a D fs h D' b t P C F loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"the (h (the_Addr (hd(tl stk))))\", cases \"field P C F\",\n cases ics, auto) (fastforce dest: has_field_sees[OF has_field_idemp])+\nnext\n case (exec_step_ind_Putstatic_NonStatic P C F t D h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\";\n cases ics, auto) (fastforce dest: has_field_sees[OF has_field_idemp])+\nnext\n case (exec_step_ind_Putstatic_Called D' b t P D F C sh sfs i h stk loc C\\<^sub>0 M\\<^sub>0 pc frs ics')\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\",\n cases ics', auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Putstatic_Done D' b t P D F C ics sh sfs h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases \"field P D F\", cases \"fst(snd(field P D F))\"; cases ics,\n auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Putstatic_Init D' b t P D F C sh ics h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case\n by(cases \"field P D F\", cases \"fst(snd(field P D F))\"; cases ics; cases \"snd(the(sh D'))\",\n auto dest: has_field_sees[OF has_field_idemp])\nnext\n case (exec_step_ind_Invoke ps n stk r C h D b Ts T mxs mxl\\<^sub>0 ins xt P M m f' loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, fastforce+)\nnext\n case (exec_step_ind_Invokestatic_Called ps n stk D b Ts T mxs mxl\\<^sub>0 ins xt P C M m ics ics' sh)\n then show ?case by(cases ics, fastforce+)\nnext\n case (exec_step_ind_Invokestatic_Done ps n stk D b Ts T mxs mxl\\<^sub>0 ins xt P C M m ics sh sfs f')\n then show ?case by(cases ics, auto) fastforce+\nnext\n case (exec_step_ind_Invokestatic_Init D b Ts T mxs mxl\\<^sub>0 ins xt P C M m sh ics n h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases ics; cases \"snd(the(sh D))\", auto) fastforce+\nnext\n case (exec_step_ind_Return_Last ics P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Return_NonStatic D Ts T m P C\\<^sub>0 M\\<^sub>0 ics h stk\\<^sub>0 loc\\<^sub>0 pc stk' loc' C' m' pc' ics' frs' sh)\n then show ?case by(cases \"method P C\\<^sub>0 M\\<^sub>0\", cases ics, auto)\nnext\n case (exec_step_ind_Return_Static D Ts T m P C\\<^sub>0 M\\<^sub>0 ics h stk\\<^sub>0 loc\\<^sub>0 pc stk' loc' C' m' pc' ics' frs' sh)\n then show ?case by(cases \"method P C\\<^sub>0 M\\<^sub>0\", cases ics, auto)\nnext\n case (exec_step_ind_IfFalse_nFalse stk i P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"hd stk\"; cases ics, auto)\nnext\n case (exec_step_ind_Throw_Null stk P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases \"hd stk\"; cases ics, auto)\nnext\n case (exec_step_ind_Init_None_nCalled sh C ics P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Init_Error sh C sfs stk' loc' D' M' pc' ics' P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs)\n then show ?case by(cases \"method P C clinit\", cases ics, auto)\nnext\n case (exec_step_ind_Init_Prepared_nObject sh C sfs stk' loc' C' m' pc' ics' P sh' D h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs)\n then show ?case by(cases \"method P C clinit\", cases ics, auto)\nnext\n case (exec_step_ind_InitThrow_Other ics' a P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics stk' loc' C' m' pc' frs' sh)\n then show ?case by(cases ics; cases ics', auto)\nnext\n case (exec_step_ind_InitThrow_Init ics' a P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics stk' loc' C' pc' frs' sh)\n then show ?case by(cases ics'; cases ics, auto)\nnext\n case (exec_step_ind_InitThrow_Called a P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics stk' loc' C' m' pc' frs' sh ics')\n then show ?case by(cases ics', auto)\n(***)\nnext\n case (exec_step_ind_Load n P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Store n P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Push v P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_NewOOM_Called h C P stk loc C\\<^sub>0 M\\<^sub>0 pc frs sh ics')\n then show ?case by(cases ics', auto)\nnext\n case (exec_step_ind_New_Called h a C P stk loc C\\<^sub>0 M\\<^sub>0 pc frs sh ics')\n then show ?case by(cases ics', auto)\nnext\n case (exec_step_ind_Getfield_Null stk F C P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Getstatic_NoField P C F D h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Putfield_Null stk F C P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Putstatic_NoField P C F D h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Checkcast P C h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Checkcast_Error P C h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Invoke_Null stk n M P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Invoke_NoMethod r stk n C h P M loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Invoke_Static r stk n C h D b Ts T mxs mxl\\<^sub>0 ins xt P M m loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Invokestatic_NoMethod D b Ts T mxs mxl\\<^sub>0 ins xt P C M n h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Invokestatic_NonStatic D b Ts T mxs mxl\\<^sub>0 ins xt P C M m n h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Return_Last_Init P h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Return_Init D b Ts T m P C\\<^sub>0 M\\<^sub>0 h stk\\<^sub>0 loc\\<^sub>0 pc stk' loc' C' m' pc' ics' frs' sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Pop P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_IAdd P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_IfFalse_False stk i P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_CmpEq P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Goto i P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Throw stk a P h loc C\\<^sub>0 M\\<^sub>0 pc ics frs sh)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Init_None_Called sh C ics P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Init_Done sh C sfs P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Init_Processing sh C sfs P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_Init_Prepared_Object sh C sfs sh' P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics frs)\n then show ?case by(cases ics, auto)\nnext\n case (exec_step_ind_InitThrow_Last a P h stk loc C\\<^sub>0 M\\<^sub>0 pc ics sh)\n then show ?case by(cases ics, auto)\nqed\n\nlemma exec_step_ind_equiv:\n \"exec_step_input P C M pc ics = (si, ics')\n \\ exec_step P h stk loc C M pc ics frs sh = (xp', h', frs', sh')\n = exec_step_ind si P h stk loc C M pc ics' frs sh (xp', h', frs', sh')\"\n using exec_step_imp_exec_step_ind exec_step_ind_imp_exec_step by meson\n\nend\n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/JVM/JVMExecInstrInductive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.25673128776194737}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2015-2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Typed_Model.thy\n Author: Andreas Viktor Hess, DTU\n*)\n\nsection \\The Typed Model\\\ntheory Typed_Model\nimports Lazy_Intruder\nbegin\n\ntext \\Term types\\\ntype_synonym ('f,'v) term_type = \"('f,'v) term\"\n\ntext \\Constructors for term types\\\nabbreviation (input) TAtom::\"'v \\ ('f,'v) term_type\" where\n \"TAtom a \\ Var a\"\n\nabbreviation (input) TComp::\"['f, ('f,'v) term_type list] \\ ('f,'v) term_type\" where\n \"TComp f T \\ Fun f T\"\n\n\ntext \\\n The typed model extends the intruder model with a typing function \\\\\\ that assigns types to terms.\n\\\nlocale typed_model = intruder_model arity public Ana\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,'var) term \\ (('fun,'var) term list \\ ('fun,'var) term list)\"\n +\n fixes \\::\"('fun,'var) term \\ ('fun,'atom::finite) term_type\"\n assumes const_type: \"\\c. arity c = 0 \\ \\a. \\T. \\ (Fun c T) = TAtom a\"\n and fun_type: \"\\f T. arity f > 0 \\ \\ (Fun f T) = TComp f (map \\ T)\"\n and infinite_typed_consts: \"\\a. infinite {c. \\ (Fun c []) = TAtom a \\ public c}\"\n and \\_wf: \"\\t f T. TComp f T \\ \\ t \\ arity f > 0\"\n \"\\x. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ (Var x))\"\n and no_private_funs[simp]: \"\\f. arity f > 0 \\ public f\"\nbegin\n\nsubsection \\Definitions\\\ntext \\The set of atomic types\\\nabbreviation \"\\\\<^sub>a \\ UNIV::('atom set)\"\n\ntext \\Well-typed substitutions\\\ndefinition wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t where\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ (\\v. \\ (Var v) = \\ (\\ v))\"\n\ntext \\The set of sub-message patterns (SMP)\\\ninductive_set SMP::\"('fun,'var) terms \\ ('fun,'var) terms\" for M where\n MP[intro]: \"t \\ M \\ t \\ SMP M\"\n| Subterm[intro]: \"\\t \\ SMP M; t' \\ t\\ \\ t' \\ SMP M\"\n| Substitution[intro]: \"\\t \\ SMP M; wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\; wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\\ \\ (t \\ \\) \\ SMP M\"\n| Ana[intro]: \"\\t \\ SMP M; Ana t = (K,T); k \\ set K\\ \\ k \\ SMP M\"\n\ntext \\\n Type-flaw resistance for sets:\n Unifiable sub-message patterns must have the same type (unless they are variables)\n\\\ndefinition tfr\\<^sub>s\\<^sub>e\\<^sub>t where\n \"tfr\\<^sub>s\\<^sub>e\\<^sub>t M \\ (\\s \\ SMP M - (Var`\\). \\t \\ SMP M - (Var`\\). (\\\\. Unifier \\ s t) \\ \\ s = \\ t)\"\n\ntext \\\n Type-flaw resistance for strand steps:\n - The terms in a satisfiable equality step must have the same types\n - Inequality steps must satisfy the conditions of the \"inequality lemma\"\\\nfun tfr\\<^sub>s\\<^sub>t\\<^sub>p where\n \"tfr\\<^sub>s\\<^sub>t\\<^sub>p (Equality a t t') = ((\\\\. Unifier \\ t t') \\ \\ t = \\ t')\"\n| \"tfr\\<^sub>s\\<^sub>t\\<^sub>p (Inequality X F) = (\n (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\a. \\ (Var x) = TAtom a) \\\n (\\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X)))\"\n| \"tfr\\<^sub>s\\<^sub>t\\<^sub>p _ = True\"\n\ntext \\\n Type-flaw resistance for strands:\n - The set of terms in strands must be type-flaw resistant\n - The steps of strands must be type-flaw resistant\n\\\ndefinition tfr\\<^sub>s\\<^sub>t where\n \"tfr\\<^sub>s\\<^sub>t S \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S) \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n\n\nsubsection \\Small Lemmata\\\nlemma tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def:\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S \\\n ((\\a t t'. Equality a t t' \\ set S \\ (\\\\. Unifier \\ t t') \\ \\ t = \\ t') \\\n (\\X F. Inequality X F \\ set S \\ \n (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\a. \\ (Var x) = TAtom a)\n \\ (\\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))))\"\n (is \"?P S \\ ?Q S\")\nproof\n show \"?P S \\ ?Q S\"\n proof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\n qed simp\n\n show \"?Q S \\ ?P S\"\n proof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\n qed simp\nqed\n\n\nlemma \\_wf': \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ t)\"\nproof (induction t)\n case (Fun f T)\n hence *: \"arity f = length T\" \"\\t. t \\ set T \\ wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ t)\" unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n { assume \"arity f = 0\" hence ?case using const_type[of f] by auto }\n moreover\n { assume \"arity f > 0\" hence ?case using fun_type[of f] * by force }\n ultimately show ?case by auto \nqed (metis \\_wf(2))\n\nlemma fun_type_inv: assumes \"\\ t = TComp f T\" shows \"arity f > 0\" \"public f\"\nusing \\_wf(1)[of f T t] assms by simp_all\n\nlemma fun_type_inv_wf: assumes \"\\ t = TComp f T\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" shows \"arity f = length T\"\nusing \\_wf'[OF assms(2)] assms(1) unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n\nlemma const_type_inv: \"\\ (Fun c X) = TAtom a \\ arity c = 0\"\nby (rule ccontr, simp add: fun_type)\n\nlemma const_type_inv_wf: assumes \"\\ (Fun c X) = TAtom a\" and \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun c X)\" shows \"X = []\"\nby (metis assms const_type_inv length_0_conv subtermeqI' wf\\<^sub>t\\<^sub>r\\<^sub>m_def)\n\nlemma const_type': \"\\c \\ \\. \\a \\ \\\\<^sub>a. \\X. \\ (Fun c X) = TAtom a\" using const_type by simp\nlemma fun_type': \"\\f \\ \\\\<^sub>f. \\X. \\ (Fun f X) = TComp f (map \\ X)\" using fun_type by simp\n\nlemma infinite_public_consts[simp]: \"infinite {c. public c \\ arity c = 0}\"\nproof -\n fix a::'atom\n define A where \"A \\ {c. \\ (Fun c []) = TAtom a \\ public c}\"\n define B where \"B \\ {c. public c \\ arity c = 0}\"\n\n have \"arity c = 0\" when c: \"c \\ A\" for c\n using c const_type_inv unfolding A_def by blast\n hence \"A \\ B\" unfolding A_def B_def by blast\n hence \"infinite B\"\n using infinite_typed_consts[of a, unfolded A_def[symmetric]]\n by (metis infinite_super)\n thus ?thesis unfolding B_def by blast\nqed\n\nlemma infinite_fun_syms[simp]:\n \"infinite {c. public c \\ arity c > 0} \\ infinite \\\\<^sub>f\"\n \"infinite \\\" \"infinite \\\\<^sub>p\\<^sub>u\\<^sub>b\" \"infinite (UNIV::'fun set)\"\nby (metis \\\\<^sub>f_unfold finite_Collect_conjI,\n metis infinite_public_consts finite_Collect_conjI,\n use infinite_public_consts \\pub_unfold in \\force simp add: Collect_conj_eq\\,\n metis UNIV_I finite_subset subsetI infinite_public_consts(1))\n\nlemma id_univ_proper_subset[simp]: \"\\\\<^sub>f \\ UNIV\" \"(\\f. arity f > 0) \\ \\ \\ UNIV\"\nby (metis finite.emptyI inf_top.right_neutral top.not_eq_extremum disjoint_fun_syms\n infinite_fun_syms(2) inf_commute)\n (metis top.not_eq_extremum UNIV_I const_arity_eq_zero less_irrefl)\n\nlemma exists_fun_notin_funs_term: \"\\f::'fun. f \\ funs_term t\"\nby (metis UNIV_eq_I finite_fun_symbols infinite_fun_syms(4))\n\nlemma exists_fun_notin_funs_terms:\n assumes \"finite M\" shows \"\\f::'fun. f \\ \\(funs_term ` M)\"\nby (metis assms finite_fun_symbols infinite_fun_syms(4) ex_new_if_finite finite_UN)\n\nlemma exists_notin_funs\\<^sub>s\\<^sub>t: \"\\f. f \\ funs\\<^sub>s\\<^sub>t (S::('fun,'var) strand)\"\nby (metis UNIV_eq_I finite_funs\\<^sub>s\\<^sub>t infinite_fun_syms(4))\n\nlemma infinite_typed_consts': \"infinite {c. \\ (Fun c []) = TAtom a \\ public c \\ arity c = 0}\"\nproof -\n { fix c assume \"\\ (Fun c []) = TAtom a\" \"public c\"\n hence \"arity c = 0\" using const_type[of c] fun_type[of c \"[]\"] by auto\n } hence \"{c. \\ (Fun c []) = TAtom a \\ public c \\ arity c = 0} =\n {c. \\ (Fun c []) = TAtom a \\ public c}\"\n by auto\n thus \"infinite {c. \\ (Fun c []) = TAtom a \\ public c \\ arity c = 0}\"\n using infinite_typed_consts[of a] by metis\nqed\n\nlemma atypes_inhabited: \"\\c. \\ (Fun c []) = TAtom a \\ wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun c []) \\ public c \\ arity c = 0\"\nproof -\n obtain c where \"\\ (Fun c []) = TAtom a\" \"public c\" \"arity c = 0\"\n using infinite_typed_consts'(1)[of a] not_finite_existsD by blast\n thus ?thesis using const_type_inv[OF \\\\ (Fun c []) = TAtom a\\] unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\nqed\n\nlemma atype_ground_term_ex: \"\\t. fv t = {} \\ \\ t = TAtom a \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing atypes_inhabited[of a] by force\n\nlemma fun_type_id_eq: \"\\ (Fun f X) = TComp g Y \\ f = g\"\nby (metis const_type fun_type neq0_conv \"term.inject\"(2) \"term.simps\"(4))\n\nlemma fun_type_length_eq: \"\\ (Fun f X) = TComp g Y \\ length X = length Y\"\nby (metis fun_type fun_type_id_eq fun_type_inv(1) length_map term.inject(2))\n\nlemma type_ground_inhabited: \"\\t'. fv t' = {} \\ \\ t = \\ t'\"\nproof -\n { fix \\::\"('fun, 'atom) term_type\" assume \"\\f T. Fun f T \\ \\ \\ 0 < arity f\"\n hence \"\\t'. fv t' = {} \\ \\ = \\ t'\"\n proof (induction \\)\n case (Fun f T)\n hence \"arity f > 0\" by auto\n \n from Fun.IH Fun.prems(1) have \"\\Y. map \\ Y = T \\ (\\x \\ set Y. fv x = {})\"\n proof (induction T)\n case (Cons x X)\n hence \"\\g Y. Fun g Y \\ Fun f X \\ 0 < arity g\" by auto\n hence \"\\Y. map \\ Y = X \\ (\\x\\set Y. fv x = {})\" using Cons by auto\n moreover have \"\\t'. fv t' = {} \\ x = \\ t'\" using Cons by auto\n ultimately obtain y Y where\n \"fv y = {}\" \"\\ y = x\" \"map \\ Y = X\" \"\\x\\set Y. fv x = {}\" \n using Cons by moura\n hence \"map \\ (y#Y) = x#X \\ (\\x\\set (y#Y). fv x = {})\" by auto\n thus ?case by meson \n qed simp\n then obtain Y where \"map \\ Y = T\" \"\\x \\ set Y. fv x = {}\" by metis\n hence \"fv (Fun f Y) = {}\" \"\\ (Fun f Y) = TComp f T\" using fun_type[OF \\arity f > 0\\] by auto\n thus ?case by (metis exI[of \"\\t. fv t = {} \\ \\ t = TComp f T\" \"Fun f Y\"])\n qed (metis atype_ground_term_ex)\n }\n thus ?thesis by (metis \\_wf(1))\nqed\n\nlemma type_wfttype_inhabited:\n assumes \"\\f T. Fun f T \\ \\ \\ 0 < arity f\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m \\\"\n shows \"\\t. \\ t = \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing assms\nproof (induction \\)\n case (Fun f Y)\n have IH: \"\\t. \\ t = y \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t\" when y: \"y \\ set Y \" for y\n proof -\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m y\"\n using Fun y unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def\n by (metis Fun_param_is_subterm term.le_less_trans) \n moreover have \"Fun g Z \\ y \\ 0 < arity g\" for g Z\n using Fun y by auto\n ultimately show ?thesis using Fun.IH[OF y] by auto\n qed\n\n from Fun have \"arity f = length Y\" \"arity f > 0\" unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by force+\n moreover from IH have \"\\X. map \\ X = Y \\ (\\x \\ set X. wf\\<^sub>t\\<^sub>r\\<^sub>m x)\"\n by (induct Y, simp_all, metis list.simps(9) set_ConsD)\n ultimately show ?case by (metis fun_type length_map wf_trmI)\nqed (use atypes_inhabited wf\\<^sub>t\\<^sub>r\\<^sub>m_def in blast)\n\nlemma type_pgwt_inhabited: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\t'. \\ t = \\ t' \\ public_ground_wf_term t'\"\nproof -\n assume \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n { fix \\ assume \"\\ t = \\\"\n hence \"\\t'. \\ t = \\ t' \\ public_ground_wf_term t'\" using \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\\n proof (induction \\ arbitrary: t)\n case (Var a t)\n then obtain c where \"\\ t = \\ (Fun c [])\" \"arity c = 0\" \"public c\"\n using const_type_inv[of _ \"[]\" a] infinite_typed_consts(1)[of a] not_finite_existsD\n by force\n thus ?case using PGWT[OF \\public c\\, of \"[]\"] by auto\n next\n case (Fun f Y t)\n have *: \"arity f > 0\" \"public f\" \"arity f = length Y\"\n using fun_type_inv[OF \\\\ t = TComp f Y\\] fun_type_inv_wf[OF \\\\ t = TComp f Y\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\]\n by auto\n have \"\\y. y \\ set Y \\ \\t'. y = \\ t' \\ public_ground_wf_term t'\"\n using Fun.prems(1) Fun.IH \\_wf(1)[of _ _ t] \\_wf'[OF \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\] type_wfttype_inhabited\n by (metis Fun_param_is_subterm term.order_trans wf_trm_subtermeq) \n hence \"\\X. map \\ X = Y \\ (\\x \\ set X. public_ground_wf_term x)\"\n by (induct Y, simp_all, metis list.simps(9) set_ConsD)\n then obtain X where X: \"map \\ X = Y\" \"\\x. x \\ set X \\ public_ground_wf_term x\" by moura\n hence \"arity f = length X\" using *(3) by auto\n have \"\\ t = \\ (Fun f X)\" \"public_ground_wf_term (Fun f X)\"\n using fun_type[OF *(1), of X] Fun.prems(1) X(1) apply simp\n using PGWT[OF *(2) \\arity f = length X\\ X(2)] by metis\n thus ?case by metis\n qed\n }\n thus ?thesis using \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\ by auto\nqed\n\nlemma pgwt_type_map: \n assumes \"public_ground_wf_term t\"\n shows \"\\ t = TAtom a \\ \\f. t = Fun f []\" \"\\ t = TComp g Y \\ \\X. t = Fun g X \\ map \\ X = Y\"\nproof -\n let ?A = \"\\ t = TAtom a \\ (\\f. t = Fun f [])\"\n let ?B = \"\\ t = TComp g Y \\ (\\X. t = Fun g X \\ map \\ X = Y)\"\n have \"?A \\ ?B\"\n proof (cases \"\\ t\")\n case (Var a)\n obtain f X where \"t = Fun f X\" \"arity f = length X\"\n using pgwt_fun[OF assms(1)] pgwt_arity[OF assms(1)] by fastforce+\n thus ?thesis using const_type_inv \\\\ t = TAtom a\\ by auto\n next\n case (Fun g Y)\n obtain f X where *: \"t = Fun f X\" using pgwt_fun[OF assms(1)] by force\n hence \"f = g\" \"map \\ X = Y\"\n using fun_type_id_eq \\\\ t = TComp g Y\\ fun_type[OF fun_type_inv(1)[OF \\\\ t = TComp g Y\\]]\n by fastforce+\n thus ?thesis using *(1) \\\\ t = TComp g Y\\ by auto \n qed\n thus \"\\ t = TAtom a \\ \\f. t = Fun f []\" \"\\ t = TComp g Y \\ \\X. t = Fun g X \\ map \\ X = Y\"\n by auto\nqed \n\nlemma wt_subst_Var[simp]: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" by (metis wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n\nlemma wt_subst_trm: \"(\\v. v \\ fv t \\ \\ (Var v) = \\ (\\ v)) \\ \\ t = \\ (t \\ \\)\"\nproof (induction t)\n case (Fun f X)\n hence *: \"\\x. x \\ set X \\ \\ x = \\ (x \\ \\)\" by auto\n show ?case\n proof (cases \"f \\ \\\\<^sub>f\")\n case True\n hence \"\\X. \\ (Fun f X) = TComp f (map \\ X)\" using fun_type' by auto\n thus ?thesis using * by auto\n next\n case False\n hence \"\\a \\ \\\\<^sub>a. \\X. \\ (Fun f X) = TAtom a\" using const_type' by auto\n thus ?thesis by auto\n qed\nqed auto\n\nlemma wt_subst_trm': \"\\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\; \\ s = \\ t\\ \\ \\ (s \\ \\) = \\ (t \\ \\)\"\nby (metis wt_subst_trm wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n\nlemma wt_subst_trm'': \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ \\ t = \\ (t \\ \\)\"\nby (metis wt_subst_trm wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n\nlemma wt_subst_compose:\n assumes \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\)\"\nproof -\n have \"\\v. \\ (\\ v) = \\ (\\ v \\ \\)\" using wt_subst_trm \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by metis\n moreover have \"\\v. \\ (Var v) = \\ (\\ v)\" using \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\\ unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by metis\n ultimately have \"\\v. \\ (Var v) = \\ (\\ v \\ \\)\" by metis\n thus ?thesis unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def subst_compose_def by metis\nqed\n\nlemma wt_subst_TAtom_Var_cases:\n assumes \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and x: \"\\ (Var x) = TAtom a\"\n shows \"(\\y. \\ x = Var y) \\ (\\c. \\ x = Fun c [])\"\nproof (cases \"(\\y. \\ x = Var y)\")\n case False\n then obtain c T where c: \"\\ x = Fun c T\"\n by (cases \"\\ x\") simp_all\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun c T)\"\n using \\(2) by fastforce\n hence \"T = []\"\n using const_type_inv_wf[of c T a] x c wt_subst_trm''[OF \\(1), of \"Var x\"]\n by fastforce\n thus ?thesis\n using c by blast\nqed simp\n\nlemma wt_subst_TAtom_fv:\n assumes \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"\\x. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\"\n and \"\\x \\ fv t - X. \\a. \\ (Var x) = TAtom a\"\n shows \"\\x \\ fv (t \\ \\) - fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` X). \\a. \\ (Var x) = TAtom a\"\nusing assms(3)\nproof (induction t)\n case (Var x) thus ?case\n proof (cases \"x \\ X\")\n case False\n with Var obtain a where \"\\ (Var x) = TAtom a\" by moura\n hence *: \"\\ (\\ x) = TAtom a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" using \\ unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n show ?thesis\n proof (cases \"\\ x\")\n case (Var y) thus ?thesis using * by auto\n next\n case (Fun f T)\n hence \"T = []\" using * const_type_inv[of f T a] unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n thus ?thesis using Fun by auto\n qed\n qed auto\nqed fastforce\n\nlemma wt_subst_TAtom_subterms_subst:\n assumes \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"\\x \\ fv t. \\a. \\ (Var x) = TAtom a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\ ` fv t)\"\n shows \"subterms (t \\ \\) = subterms t \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms(2,3)\nproof (induction t)\n case (Var x)\n obtain a where a: \"\\ (Var x) = TAtom a\" using Var.prems(1) by moura\n hence \"\\ (\\ x) = TAtom a\" using wt_subst_trm''[OF assms(1), of \"Var x\"] by simp\n hence \"(\\y. \\ x = Var y) \\ (\\c. \\ x = Fun c [])\"\n using const_type_inv_wf Var.prems(2) by (cases \"\\ x\") auto\n thus ?case by auto\nnext\n case (Fun f T)\n have \"subterms (t \\ \\) = subterms t \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" when \"t \\ set T\" for t\n using that Fun.prems(1,2) Fun.IH[OF that]\n by auto\n thus ?case by auto\nqed\n\nlemma wt_subst_TAtom_subterms_set_subst: \n assumes \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. \\a. \\ (Var x) = TAtom a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\ ` fv\\<^sub>s\\<^sub>e\\<^sub>t M)\"\n shows \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\) = subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof\n show \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n proof\n fix t assume \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n then obtain s where s: \"s \\ M\" \"t \\ subterms (s \\ \\)\" by auto\n thus \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using assms(2,3) wt_subst_TAtom_subterms_subst[OF assms(1), of s]\n by auto\n qed\n\n show \"subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n proof\n fix t assume \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n then obtain s where s: \"s \\ M\" \"t \\ subterms s \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" by auto\n thus \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using assms(2,3) wt_subst_TAtom_subterms_subst[OF assms(1), of s]\n by auto\n qed\nqed\n\nlemma wt_subst_subst_upd:\n assumes \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"\\ (Var x) = \\ t\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\(x := t))\"\nusing assms unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def\nby (metis fun_upd_other fun_upd_same)\n\nlemma wt_subst_const_fv_type_eq:\n assumes \"\\x \\ fv t. \\a. \\ (Var x) = TAtom a\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"\\x \\ fv (t \\ \\). \\y \\ fv t. \\ (Var x) = \\ (Var y)\"\nusing assms(1)\nproof (induction t)\n case (Var x)\n then obtain a where a: \"\\ (Var x) = TAtom a\" by moura\n show ?case\n proof (cases \"\\ x\")\n case (Fun f T)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\" \"\\ (Fun f T) = TAtom a\"\n using a wt_subst_trm''[OF \\(1), of \"Var x\"] \\(2) by fastforce+\n thus ?thesis using const_type_inv_wf Fun by fastforce\n qed (use a wt_subst_trm''[OF \\(1), of \"Var x\"] in simp)\nqed fastforce\n\nlemma TComp_term_cases:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ t = TComp f T\"\n shows \"(\\v. t = Var v) \\ (\\T'. t = Fun f T' \\ T = map \\ T' \\ T' \\ [])\"\nproof (cases \"\\v. t = Var v\")\n case False\n then obtain T' where T': \"t = Fun f T'\" \"T = map \\ T'\"\n using assms fun_type[OF fun_type_inv(1)[OF assms(2)]] fun_type_id_eq\n by (cases t) force+\n thus ?thesis using assms fun_type_inv(1) fun_type_inv_wf by fastforce\nqed metis\n\nlemma TAtom_term_cases:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ t = TAtom \\\"\n shows \"(\\v. t = Var v) \\ (\\f. t = Fun f [])\"\nusing assms const_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by (cases t) auto\n\nlemma subtermeq_imp_subtermtypeeq:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"s \\ t\"\n shows \"\\ s \\ \\ t\"\nusing assms(2,1)\nproof (induction t)\n case (Fun f T) thus ?case\n proof (cases \"s = Fun f T\")\n case False\n then obtain x where x: \"x \\ set T\" \"s \\ x\" using Fun.prems(1) by auto\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m x\" using wf_trm_subtermeq[OF Fun.prems(2)] Fun_param_is_subterm[of _ T f] by auto\n hence \"\\ s \\ \\ x\" using Fun.IH[OF x] by simp\n moreover have \"arity f > 0\" using x fun_type_inv_wf Fun.prems\n by (metis length_pos_if_in_set term.order_refl wf\\<^sub>t\\<^sub>r\\<^sub>m_def)\n ultimately show ?thesis using x Fun.prems fun_type[of f T] by auto\n qed simp\nqed simp\n\nlemma subterm_funs_term_in_type:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"Fun f T \\ t\" \"\\ (Fun f T) = TComp f (map \\ T)\"\n shows \"f \\ funs_term (\\ t)\"\nusing assms(2,1,3)\nproof (induction t)\n case (Fun f' T')\n hence [simp]: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\" by (metis wf_trm_subtermeq)\n { fix a assume \\: \"\\ (Fun f' T') = TAtom a\"\n hence \"Fun f T = Fun f' T'\" using Fun TAtom_term_cases subtermeq_Var_const by metis\n hence False using Fun.prems(3) \\ by simp\n }\n moreover\n { fix g S assume \\: \"\\ (Fun f' T') = TComp g S\"\n hence \"g = f'\" \"S = map \\ T'\"\n using Fun.prems(2) fun_type_id_eq[OF \\] fun_type[OF fun_type_inv(1)[OF \\]]\n by auto\n hence \\': \"\\ (Fun f' T') = TComp f' (map \\ T')\" using \\ by auto\n hence \"g \\ funs_term (\\ (Fun f' T'))\" using \\ by auto\n moreover {\n assume \"Fun f T \\ Fun f' T'\"\n then obtain x where \"x \\ set T'\" \"Fun f T \\ x\" using Fun.prems(1) by auto\n hence \"f \\ funs_term (\\ x)\"\n using Fun.IH[OF _ _ _ Fun.prems(3), of x] wf_trm_subtermeq[OF \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f' T')\\, of x]\n by force\n moreover have \"\\ x \\ set (map \\ T')\" using \\' \\x \\ set T'\\ by auto\n ultimately have \"f \\ funs_term (\\ (Fun f' T'))\" using \\' by auto\n }\n ultimately have ?case by (cases \"Fun f T = Fun f' T'\") (auto simp add: \\g = f'\\)\n }\n ultimately show ?case by (cases \"\\ (Fun f' T')\") auto\nqed simp\n\nlemma wt_subst_fv_termtype_subterm:\n assumes \"x \\ fv (\\ y)\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ y)\"\n shows \"\\ (Var x) \\ \\ (Var y)\"\nusing subtermeq_imp_subtermtypeeq[OF assms(3) var_is_subterm[OF assms(1)]]\n wt_subst_trm''[OF assms(2), of \"Var y\"]\nby auto\n\nlemma wt_subst_fv\\<^sub>s\\<^sub>e\\<^sub>t_termtype_subterm:\n assumes \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` Y)\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"\\y \\ Y. \\ (Var x) \\ \\ (Var y)\"\nusing wt_subst_fv_termtype_subterm[OF _ assms(2), of x] assms(1,3)\nby fastforce\n\nlemma funs_term_type_iff:\n assumes t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n and f: \"arity f > 0\"\n shows \"f \\ funs_term (\\ t) \\ (f \\ funs_term t \\ (\\x \\ fv t. f \\ funs_term (\\ (Var x))))\"\n (is \"?P t \\ ?Q t\")\nusing t\nproof (induction t)\n case (Fun g T)\n hence IH: \"?P s \\ ?Q s\" when \"s \\ set T\" for s\n using that wf_trm_subterm[OF _ Fun_param_is_subterm]\n by blast\n have 0: \"arity g = length T\" using Fun.prems unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n show ?case\n proof (cases \"f = g\")\n case True thus ?thesis using fun_type[OF f] by simp\n next\n case False\n have \"?P (Fun g T) \\ (\\s \\ set T. ?P s)\"\n proof\n assume *: \"?P (Fun g T)\"\n hence \"\\ (Fun g T) = TComp g (map \\ T)\"\n using const_type[of g] fun_type[of g] by force\n thus \"\\s \\ set T. ?P s\" using False * by force\n next\n assume *: \"\\s \\ set T. ?P s\"\n hence \"\\ (Fun g T) = TComp g (map \\ T)\"\n using 0 const_type[of g] fun_type[of g] by force\n thus \"?P (Fun g T)\" using False * by force\n qed\n thus ?thesis using False f IH by auto\n qed\nqed simp\n\nlemma funs_term_type_iff':\n assumes M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and f: \"arity f > 0\"\n shows \"f \\ \\(funs_term ` \\ ` M) \\\n (f \\ \\(funs_term ` M) \\ (\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. f \\ funs_term (\\ (Var x))))\" (is \"?A \\ ?B\")\nproof\n assume ?A\n then obtain t where \"t \\ M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"f \\ funs_term (\\ t)\" using M by moura\n thus ?B using funs_term_type_iff[OF _ f, of t] by auto\nnext\n assume ?B\n then obtain t where \"t \\ M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"f \\ funs_term t \\ (\\x \\ fv t. f \\ funs_term (\\ (Var x)))\"\n using M by auto\n thus ?A using funs_term_type_iff[OF _ f, of t] by blast\nqed\n\nlemma Ana_subterm_type:\n assumes \"Ana t = (K,M)\"\n and \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n and \"m \\ set M\"\n shows \"\\ m \\ \\ t\"\nproof -\n have \"m \\ t\" using Ana_subterm[OF assms(1)] assms(3) by auto\n thus ?thesis using subtermeq_imp_subtermtypeeq[OF assms(2)] by simp\nqed\n\nlemma wf_trm_TAtom_subterms:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ t = TAtom \\\"\n shows \"subterms t = {t}\"\nusing assms const_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by (cases t) force+\n\nlemma wf_trm_TComp_subterm:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"t \\ s\"\n obtains f T where \"\\ s = TComp f T\"\nproof (cases s)\n case (Var x) thus ?thesis using \\t \\ s\\ by simp\nnext\n case (Fun g S)\n hence \"length S > 0\" using assms Fun_subterm_inside_params[of t g S] by auto\n hence \"arity g > 0\" by (metis \\wf\\<^sub>t\\<^sub>r\\<^sub>m s\\ \\s = Fun g S\\ term.order_refl wf\\<^sub>t\\<^sub>r\\<^sub>m_def) \n thus ?thesis using fun_type \\s = Fun g S\\ that by auto\nqed\n\nlemma SMP_empty[simp]: \"SMP {} = {}\"\nproof (rule ccontr)\n assume \"SMP {} \\ {}\"\n then obtain t where \"t \\ SMP {}\" by auto\n thus False by (induct t rule: SMP.induct) auto\nqed\n\nlemma SMP_I:\n assumes \"s \\ M\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"t \\ s \\ \\\" \"\\v. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ v)\"\n shows \"t \\ SMP M\"\nusing SMP.Substitution[OF SMP.MP[OF assms(1)] assms(2)] SMP.Subterm[of \"s \\ \\\" M t] assms(3,4)\nby (cases \"t = s \\ \\\") simp_all\n\nlemma SMP_wf_trm:\n assumes \"t \\ SMP M\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing assms(1)\nby (induct t rule: SMP.induct)\n (use assms(2) in blast,\n use wf_trm_subtermeq in blast,\n use wf_trm_subst in blast,\n use Ana_keys_wf' in blast)\n\nlemma SMP_ikI[intro]: \"t \\ ik\\<^sub>s\\<^sub>t S \\ t \\ SMP (trms\\<^sub>s\\<^sub>t S)\" by force\n\nlemma MP_setI[intro]: \"x \\ set S \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ trms\\<^sub>s\\<^sub>t S\" by force\n\nlemma SMP_setI[intro]: \"x \\ set S \\ trms\\<^sub>s\\<^sub>t\\<^sub>p x \\ SMP (trms\\<^sub>s\\<^sub>t S)\" by force\n\nlemma SMP_subset_I:\n assumes M: \"\\t \\ M. \\s \\. s \\ N \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\n shows \"SMP M \\ SMP N\"\nproof\n fix t show \"t \\ SMP M \\ t \\ SMP N\"\n proof (induction t rule: SMP.induct)\n case (MP t)\n then obtain s \\ where s: \"s \\ N\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t = s \\ \\\"\n using M by moura\n show ?case using SMP_I[OF s(1,2), of \"s \\ \\\"] s(3,4) wf_trm_subst_range_iff by fast\n qed (auto intro!: SMP.Substitution[of _ N])\nqed\n\nlemma SMP_union: \"SMP (A \\ B) = SMP A \\ SMP B\"\nproof\n show \"SMP (A \\ B) \\ SMP A \\ SMP B\"\n proof\n fix t assume \"t \\ SMP (A \\ B)\"\n thus \"t \\ SMP A \\ SMP B\" by (induct rule: SMP.induct) blast+\n qed\n\n { fix t assume \"t \\ SMP A\" hence \"t \\ SMP (A \\ B)\" by (induct rule: SMP.induct) blast+ }\n moreover { fix t assume \"t \\ SMP B\" hence \"t \\ SMP (A \\ B)\" by (induct rule: SMP.induct) blast+ }\n ultimately show \"SMP A \\ SMP B \\ SMP (A \\ B)\" by blast\nqed\n\nlemma SMP_append[simp]: \"SMP (trms\\<^sub>s\\<^sub>t (S@S')) = SMP (trms\\<^sub>s\\<^sub>t S) \\ SMP (trms\\<^sub>s\\<^sub>t S')\" (is \"?A = ?B\")\nusing SMP_union by simp\n\nlemma SMP_mono: \"A \\ B \\ SMP A \\ SMP B\"\nproof -\n assume \"A \\ B\"\n then obtain C where \"B = A \\ C\" by moura\n thus \"SMP A \\ SMP B\" by (simp add: SMP_union)\nqed\n\nlemma SMP_Union: \"SMP (\\m \\ M. f m) = (\\m \\ M. SMP (f m))\"\nproof\n show \"SMP (\\m\\M. f m) \\ (\\m\\M. SMP (f m))\"\n proof\n fix t assume \"t \\ SMP (\\m\\M. f m)\"\n thus \"t \\ (\\m\\M. SMP (f m))\" by (induct t rule: SMP.induct) force+\n qed\n show \"(\\m\\M. SMP (f m)) \\ SMP (\\m\\M. f m)\"\n proof\n fix t assume \"t \\ (\\m\\M. SMP (f m))\"\n then obtain m where \"m \\ M\" \"t \\ SMP (f m)\" by moura\n thus \"t \\ SMP (\\m\\M. f m)\" using SMP_mono[of \"f m\" \"\\m\\M. f m\"] by auto\n qed\nqed\n\nlemma SMP_singleton_ex:\n \"t \\ SMP M \\ (\\m \\ M. t \\ SMP {m})\"\n \"m \\ M \\ t \\ SMP {m} \\ t \\ SMP M\"\nusing SMP_Union[of \"\\t. {t}\" M] by auto\n\nlemma SMP_Cons: \"SMP (trms\\<^sub>s\\<^sub>t (x#S)) = SMP (trms\\<^sub>s\\<^sub>t [x]) \\ SMP (trms\\<^sub>s\\<^sub>t S)\"\nusing SMP_append[of \"[x]\" S] by auto\n\nlemma SMP_Nil[simp]: \"SMP (trms\\<^sub>s\\<^sub>t []) = {}\" \nproof -\n { fix t assume \"t \\ SMP (trms\\<^sub>s\\<^sub>t [])\" hence False by induct auto }\n thus ?thesis by blast\nqed\n\nlemma SMP_subset_union_eq: assumes \"M \\ SMP N\" shows \"SMP N = SMP (M \\ N)\"\nproof -\n { fix t assume \"t \\ SMP (M \\ N)\" hence \"t \\ SMP N\"\n using assms by (induction rule: SMP.induct) blast+\n }\n thus ?thesis using SMP_union by auto\nqed\n\nlemma SMP_subterms_subset: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t M \\ SMP M\"\nproof\n fix t assume \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t M\"\n then obtain m where \"m \\ M\" \"t \\ m\" by auto\n thus \"t \\ SMP M\" using SMP_I[of _ _ Var] by auto\nqed\n\nlemma SMP_SMP_subset: \"N \\ SMP M \\ SMP N \\ SMP M\"\nby (metis SMP_mono SMP_subset_union_eq Un_commute Un_upper2)\n\nlemma wt_subst_rm_vars: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (rm_vars X \\)\"\nusing rm_vars_dom unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n\nlemma wt_subst_SMP_subset:\n assumes \"trms\\<^sub>s\\<^sub>t S \\ SMP S'\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"trms\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>t \\) \\ SMP S'\"\nproof\n fix t assume *: \"t \\ trms\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>t \\)\"\n show \"t \\ SMP S'\" using trm_strand_subst_cong(2)[OF *]\n proof\n assume \"\\t'. t = t' \\ \\ \\ t' \\ trms\\<^sub>s\\<^sub>t S\"\n thus \"t \\ SMP S'\" using assms SMP.Substitution by auto\n next\n assume \"\\X F. Inequality X F \\ set S \\ (\\t'\\trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F. t = t' \\ rm_vars (set X) \\)\"\n then obtain X F t' where **:\n \"Inequality X F \\ set S\" \"t'\\trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\" \"t = t' \\ rm_vars (set X) \\\"\n by force\n then obtain s where s: \"s \\ trms\\<^sub>s\\<^sub>t\\<^sub>p (Inequality X F)\" \"t = s \\ rm_vars (set X) \\\" by moura\n hence \"s \\ SMP (trms\\<^sub>s\\<^sub>t S)\" using **(1) by force\n hence \"t \\ SMP (trms\\<^sub>s\\<^sub>t S)\"\n using SMP.Substitution[OF _ wt_subst_rm_vars[OF assms(2)] wf_trms_subst_rm_vars'[OF assms(3)]]\n unfolding s(2) by blast\n thus \"t \\ SMP S'\" by (metis SMP_union SMP_subset_union_eq UnCI assms(1))\n qed\nqed\n\nlemma MP_subset_SMP: \"\\(trms\\<^sub>s\\<^sub>t\\<^sub>p ` set S) \\ SMP (trms\\<^sub>s\\<^sub>t S)\" \"trms\\<^sub>s\\<^sub>t S \\ SMP (trms\\<^sub>s\\<^sub>t S)\" \"M \\ SMP M\"\nby auto\n\nlemma SMP_fun_map_snd_subset: \"SMP (trms\\<^sub>s\\<^sub>t (map Send X)) \\ SMP (trms\\<^sub>s\\<^sub>t [Send (Fun f X)])\"\nproof\n fix t assume \"t \\ SMP (trms\\<^sub>s\\<^sub>t (map Send X))\" thus \"t \\ SMP (trms\\<^sub>s\\<^sub>t [Send (Fun f X)])\"\n proof (induction t rule: SMP.induct)\n case (MP t)\n hence \"t \\ set X\" by auto\n hence \"t \\ Fun f X\" by (metis subtermI')\n thus ?case using SMP.Subterm[of \"Fun f X\" \"trms\\<^sub>s\\<^sub>t [Send (Fun f X)]\" t] using SMP.MP by auto\n qed blast+\nqed\n\nlemma SMP_wt_subst_subset:\n assumes \"t \\ SMP (M \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"t \\ SMP M\"\nusing assms wf_trm_subst_range_iff[of \\] by (induct t rule: SMP.induct) blast+\n\nlemma SMP_wt_instances_subset:\n assumes \"\\t \\ M. \\s \\ N. \\\\. t = s \\ \\ \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and \"t \\ SMP M\"\n shows \"t \\ SMP N\"\nproof -\n obtain m where m: \"m \\ M\" \"t \\ SMP {m}\" using SMP_singleton_ex(1)[OF assms(2)] by blast\n then obtain n \\ where n: \"n \\ N\" \"m = n \\ \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using assms(1) by fast\n\n have \"t \\ SMP (N \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" using n(1,2) SMP_singleton_ex(2)[of m \"N \\\\<^sub>s\\<^sub>e\\<^sub>t \\\", OF _ m(2)] by fast\n thus ?thesis using SMP_wt_subst_subset[OF _ n(3,4)] by blast\nqed\n\nlemma SMP_consts:\n assumes \"\\t \\ M. \\c. t = Fun c []\"\n and \"\\t \\ M. Ana t = ([], [])\"\n shows \"SMP M = M\"\nproof\n show \"SMP M \\ M\"\n proof\n fix t show \"t \\ SMP M \\ t \\ M\"\n apply (induction t rule: SMP.induct)\n by (use assms in auto)\n qed\nqed auto\n\nlemma SMP_subterms_eq:\n \"SMP (subterms\\<^sub>s\\<^sub>e\\<^sub>t M) = SMP M\"\nproof\n show \"SMP M \\ SMP (subterms\\<^sub>s\\<^sub>e\\<^sub>t M)\" using SMP_mono[of M \"subterms\\<^sub>s\\<^sub>e\\<^sub>t M\"] by blast\n show \"SMP (subterms\\<^sub>s\\<^sub>e\\<^sub>t M) \\ SMP M\"\n proof\n fix t show \"t \\ SMP (subterms\\<^sub>s\\<^sub>e\\<^sub>t M) \\ t \\ SMP M\" by (induction t rule: SMP.induct) blast+\n qed\nqed\n\nlemma SMP_funs_term:\n assumes t: \"t \\ SMP M\" \"f \\ funs_term t \\ (\\x \\ fv t. f \\ funs_term (\\ (Var x)))\"\n and f: \"arity f > 0\"\n and M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and Ana_f: \"\\s K T. Ana s = (K,T) \\ f \\ \\(funs_term ` set K) \\ f \\ funs_term s\"\n shows \"f \\ \\(funs_term ` M) \\ (\\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t M. f \\ funs_term (\\ (Var x)))\"\nusing t\nproof (induction t rule: SMP.induct)\n case (Subterm t t')\n thus ?case by (metis UN_I vars_iff_subtermeq funs_term_subterms_eq(1) term.order_trans)\nnext\n case (Substitution t \\)\n show ?case\n using M SMP_wf_trm[OF Substitution.hyps(1)] wf_trm_subst[of \\ t, OF Substitution.hyps(3)]\n funs_term_type_iff[OF _ f] wt_subst_trm''[OF Substitution.hyps(2), of t]\n Substitution.prems Substitution.IH\n by metis\nnext\n case (Ana t K T t')\n thus ?case\n using Ana_f[OF Ana.hyps(2)] Ana_keys_fv[OF Ana.hyps(2)]\n by fastforce\nqed auto\n\nlemma id_type_eq:\n assumes \"\\ (Fun f X) = \\ (Fun g Y)\"\n shows \"f \\ \\ \\ g \\ \\\" \"f \\ \\\\<^sub>f \\ g \\ \\\\<^sub>f\"\nusing assms const_type' fun_type' id_union_univ(1)\nby (metis UNIV_I UnE \"term.distinct\"(1))+\n\n\n\nlemma fun_type_arg_cong':\n assumes \"f \\ \\\\<^sub>f\" \"g \\ \\\\<^sub>f\" \"\\ (Fun f (X@x#X')) = \\ (Fun g (Y@y#Y'))\" \"length X = length Y\"\n shows \"\\ x = \\ y\"\nusing assms\nproof (induction X arbitrary: Y)\n case Nil thus ?case using fun_type_arg_cong(1)[of f g x X' y Y'] by auto\nnext\n case (Cons x' X Y'')\n then obtain y' Y where \"Y'' = y'#Y\" by (metis length_Suc_conv)\n hence \"\\ (Fun f (X@x#X')) = \\ (Fun g (Y@y#Y'))\" \"length X = length Y\"\n using Cons.prems(3,4) fun_type_arg_cong(2)[OF Cons.prems(1,2), of x' \"X@x#X'\"] by auto\n thus ?thesis using Cons.IH[OF Cons.prems(1,2)] by auto\nqed\n\nlemma fun_type_param_idx: \"\\ (Fun f T) = Fun g S \\ i < length T \\ \\ (T ! i) = S ! i\"\nby (metis fun_type fun_type_id_eq fun_type_inv(1) nth_map term.inject(2))\n\nlemma fun_type_param_ex:\n assumes \"\\ (Fun f T) = Fun g (map \\ S)\" \"t \\ set S\"\n shows \"\\s \\ set T. \\ s = \\ t\"\nusing fun_type_length_eq[OF assms(1)] length_map[of \\ S] assms(2)\n fun_type_param_idx[OF assms(1)] nth_map in_set_conv_nth\nby metis\n\nlemma tfr_stp_all_split:\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (x#S) \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p [x]\"\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (x#S) \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S') \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S') \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\"\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@x#S') \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\"\nby fastforce+\n\nlemma tfr_stp_all_append:\n assumes \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\"\n shows \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\"\nusing assms by fastforce\n\nlemma tfr_stp_all_wt_subst_apply:\n assumes \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n \"bvars\\<^sub>s\\<^sub>t S \\ range_vars \\ = {}\"\n shows \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S \\\\<^sub>s\\<^sub>t \\)\"\nusing assms(1,4)\nproof (induction S)\n case (Cons x S)\n hence IH: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S \\\\<^sub>s\\<^sub>t \\)\"\n using tfr_stp_all_split(2)[of x S]\n unfolding range_vars_alt_def by fastforce\n thus ?case\n proof (cases x)\n case (Equality a t t')\n hence \"(\\\\. Unifier \\ t t') \\ \\ t = \\ t'\" using Cons.prems by auto\n hence \"(\\\\. Unifier \\ (t \\ \\) (t' \\ \\)) \\ \\ (t \\ \\) = \\ (t' \\ \\)\"\n by (metis Unifier_comp' wt_subst_trm'[OF assms(2)])\n moreover have \"(x#S) \\\\<^sub>s\\<^sub>t \\ = Equality a (t \\ \\) (t' \\ \\)#(S \\\\<^sub>s\\<^sub>t \\)\"\n using \\x = Equality a t t'\\ by auto\n ultimately show ?thesis using IH by auto\n next\n case (Inequality X F)\n let ?\\ = \"rm_vars (set X) \\\"\n let ?G = \"F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\\"\n\n let ?P = \"\\F X. \\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\a. \\ (Var x) = TAtom a\"\n let ?Q = \"\\F X.\n \\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X)\"\n\n have 0: \"set X \\ range_vars ?\\ = {}\"\n using Cons.prems(2) Inequality rm_vars_img_subset[of \"set X\"]\n by (auto simp add: subst_domain_def range_vars_alt_def)\n\n have 1: \"?P F X \\ ?Q F X\" using Inequality Cons.prems by simp\n\n have 2: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (?\\ ` set X) = set X\" by auto\n\n have \"?P ?G X\" when \"?P F X\" using that\n proof (induction F)\n case (Cons g G)\n obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n \n have \"\\x \\ (fv (t \\ ?\\) \\ fv (t' \\ ?\\)) - set X. \\a. \\ (Var x) = Var a\"\n proof -\n have *: \"\\x \\ fv t - set X. \\a. \\ (Var x) = Var a\"\n \"\\x \\ fv t' - set X. \\a. \\ (Var x) = Var a\"\n using g Cons.prems by simp_all\n\n have **: \"\\x. wf\\<^sub>t\\<^sub>r\\<^sub>m (?\\ x)\"\n using \\(2) wf_trm_subst_range_iff[of \\] wf_trm_subst_rm_vars'[of \\ _ \"set X\"] by simp\n\n show ?thesis\n using wt_subst_TAtom_fv[OF wt_subst_rm_vars[OF \\(1)] ** *(1)]\n wt_subst_TAtom_fv[OF wt_subst_rm_vars[OF \\(1)] ** *(2)]\n wt_subst_trm'[OF wt_subst_rm_vars[OF \\(1), of \"set X\"]] 2\n by blast\n qed\n moreover have \"\\x\\fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) - set X. \\a. \\ (Var x) = Var a\"\n using Cons by auto\n ultimately show ?case using g by (auto simp add: subst_apply_pairs_def)\n qed (simp add: subst_apply_pairs_def)\n hence \"?P ?G X \\ ?Q ?G X\"\n using 1 ineq_subterm_inj_cond_subst[OF 0, of \"trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\"] trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst[of F ?\\]\n by presburger\n moreover have \"(x#S) \\\\<^sub>s\\<^sub>t \\ = Inequality X (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\)#(S \\\\<^sub>s\\<^sub>t \\)\"\n using \\x = Inequality X F\\ by auto\n ultimately show ?thesis using IH by simp\n qed auto\nqed simp\n\nlemma tfr_stp_all_same_type:\n \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@Equality a t t'#S') \\ Unifier \\ t t' \\ \\ t = \\ t'\"\nby force+\n\nlemma tfr_subset:\n \"\\A B. tfr\\<^sub>s\\<^sub>e\\<^sub>t (A \\ B) \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\"\n \"\\A B. tfr\\<^sub>s\\<^sub>e\\<^sub>t B \\ A \\ B \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\"\n \"\\A B. tfr\\<^sub>s\\<^sub>e\\<^sub>t B \\ SMP A \\ SMP B \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\"\nproof -\n show 1: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (A \\ B) \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\" for A B\n using SMP_union[of A B] unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by simp\n\n fix A B assume B: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t B\"\n\n show \"A \\ B \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\"\n proof -\n assume \"A \\ B\"\n then obtain C where \"B = A \\ C\" by moura\n thus ?thesis using B 1 by blast\n qed\n\n show \"SMP A \\ SMP B \\ tfr\\<^sub>s\\<^sub>e\\<^sub>t A\"\n proof -\n assume \"SMP A \\ SMP B\"\n then obtain C where \"SMP B = SMP A \\ C\" by moura\n thus ?thesis using B unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n qed\nqed\n\nlemma tfr_empty[simp]: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t {}\"\nunfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by simp\n\nlemma tfr_consts_mono:\n assumes \"\\t \\ M. \\c. t = Fun c []\"\n and \"\\t \\ M. Ana t = ([], [])\"\n and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t N\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (N \\ M)\"\nproof -\n { fix s t\n assume *: \"s \\ SMP (N \\ M) - range Var\" \"t \\ SMP (N \\ M) - range Var\" \"\\\\. Unifier \\ s t\"\n hence **: \"is_Fun s\" \"is_Fun t\" \"s \\ SMP N \\ s \\ M\" \"t \\ SMP N \\ t \\ M\"\n using assms(3) SMP_consts[OF assms(1,2)] SMP_union[of N M] by auto\n moreover have \"\\ s = \\ t\" when \"s \\ SMP N\" \"t \\ SMP N\"\n using that assms(3) *(3) **(1,2) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n moreover have \"\\ s = \\ t\" when st: \"s \\ M\" \"t \\ M\"\n proof -\n obtain c d where \"s = Fun c []\" \"t = Fun d []\" using st assms(1) by moura\n hence \"s = t\" using *(3) by fast\n thus ?thesis by metis\n qed\n moreover have \"\\ s = \\ t\" when st: \"s \\ SMP N\" \"t \\ M\"\n proof -\n obtain c where \"t = Fun c []\" using st assms(1) by moura\n hence \"s = t\" using *(3) **(1,2) by auto\n thus ?thesis by metis\n qed\n moreover have \"\\ s = \\ t\" when st: \"s \\ M\" \"t \\ SMP N\"\n proof -\n obtain c where \"s = Fun c []\" using st assms(1) by moura\n hence \"s = t\" using *(3) **(1,2) by auto\n thus ?thesis by metis\n qed\n ultimately have \"\\ s = \\ t\" by metis\n } thus ?thesis by (metis tfr\\<^sub>s\\<^sub>e\\<^sub>t_def)\nqed\n\nlemma dual\\<^sub>s\\<^sub>t_tfr\\<^sub>s\\<^sub>t\\<^sub>p: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S \\ list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (dual\\<^sub>s\\<^sub>t S)\"\nproof (induction S)\n case (Cons x S)\n have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Cons.prems by simp\n hence IH: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (dual\\<^sub>s\\<^sub>t S)\" using Cons.IH by metis\n from Cons show ?case\n proof (cases x)\n case (Equality a t t')\n hence \"(\\\\. Unifier \\ t t') \\ \\ t = \\ t'\" using Cons by auto\n thus ?thesis using Equality IH by fastforce\n next\n case (Inequality X F)\n have \"set (dual\\<^sub>s\\<^sub>t (x#S)) = insert x (set (dual\\<^sub>s\\<^sub>t S))\" using Inequality by auto\n moreover have \"(\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\a. \\ (Var x) = Var a) \\\n (\\f T. Fun f T \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ T = [] \\ (\\s \\ set T. s \\ Var ` set X))\" \n using Cons.prems Inequality by auto\n ultimately show ?thesis using Inequality IH by auto\n qed auto\nqed simp\n\nlemma subst_var_inv_wt:\n assumes \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (subst_var_inv \\ X)\"\nusing assms f_inv_into_f[of _ \\ X]\nunfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def subst_var_inv_def\nby presburger\n\nlemma subst_var_inv_wf_trms:\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (subst_var_inv \\ X))\"\nusing f_inv_into_f[of _ \\ X]\nunfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def subst_var_inv_def\nby auto\n\nlemma unify_list_wt_if_same_type:\n assumes \"Unification.unify E B = Some U\" \"\\(s,t) \\ set E. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\ s = \\ t\"\n and \"\\(v,t) \\ set B. \\ (Var v) = \\ t\"\n shows \"\\(v,t) \\ set U. \\ (Var v) = \\ t\"\nusing assms\nproof (induction E B arbitrary: U rule: Unification.unify.induct)\n case (2 f X g Y E B U)\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun g Y)\" \"\\ (Fun f X) = \\ (Fun g Y)\" by auto\n\n from \"2.prems\"(1) obtain E' where *: \"decompose (Fun f X) (Fun g Y) = Some E'\"\n and [simp]: \"f = g\" \"length X = length Y\" \"E' = zip X Y\"\n and **: \"Unification.unify (E'@E) B = Some U\"\n by (auto split: option.splits)\n \n have \"\\(s,t) \\ set E'. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\ s = \\ t\"\n proof -\n { fix s t assume \"(s,t) \\ set E'\"\n then obtain X' X'' Y' Y'' where \"X = X'@s#X''\" \"Y = Y'@t#Y''\" \"length X' = length Y'\"\n using zip_arg_subterm_split[of s t X Y] \\E' = zip X Y\\ by metis\n hence \"\\ (Fun f (X'@s#X'')) = \\ (Fun g (Y'@t#Y''))\" by (metis \\\\ (Fun f X) = \\ (Fun g Y)\\)\n \n from \\E' = zip X Y\\ have \"\\(s,t) \\ set E'. s \\ Fun f X \\ t \\ Fun g Y\"\n using zip_arg_subterm[of _ _ X Y] by blast\n with \\(s,t) \\ set E'\\ have \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using wf_trm_subterm \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\ \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun g Y)\\ by (blast,blast)\n moreover have \"f \\ \\\\<^sub>f\"\n proof (rule ccontr)\n assume \"f \\ \\\\<^sub>f\"\n hence \"f \\ \\\" \"arity f = 0\" using const_arity_eq_zero[of f] by simp_all\n thus False using \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\ * \\(s,t) \\ set E'\\ unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n qed\n hence \"\\ s = \\ t\"\n using fun_type_arg_cong' \\f \\ \\\\<^sub>f\\ \\\\ (Fun f (X'@s#X'')) = \\ (Fun g (Y'@t#Y''))\\\n \\length X' = length Y'\\ \\f = g\\\n by metis\n ultimately have \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ s = \\ t\" by metis+\n }\n thus ?thesis by blast\n qed\n moreover have \"\\(s,t) \\ set E. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t \\ \\ s = \\ t\" using \"2.prems\"(2) by auto\n ultimately show ?case using \"2.IH\"[OF * ** _ \"2.prems\"(3)] by fastforce\nnext\n case (3 v t E B U)\n hence \"\\ (Var v) = \\ t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by auto\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (subst v t)\"\n and *: \"\\(v, t) \\ set ((v,t)#B). \\ (Var v) = \\ t\"\n \"\\t t'. (t,t') \\ set E \\ \\ t = \\ t'\"\n using \"3.prems\"(2,3) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def subst_def by auto\n\n show ?case\n proof (cases \"t = Var v\")\n assume \"t = Var v\" thus ?case using 3 by auto\n next\n assume \"t \\ Var v\"\n hence \"v \\ fv t\" using \"3.prems\"(1) by auto\n hence **: \"Unification.unify (subst_list (subst v t) E) ((v, t)#B) = Some U\"\n using Unification.unify.simps(3)[of v t E B] \"3.prems\"(1) \\t \\ Var v\\ by auto\n \n have \"\\(s, t) \\ set (subst_list (subst v t) E). wf\\<^sub>t\\<^sub>r\\<^sub>m s \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using wf_trm_subst_singleton[OF _ \\wf\\<^sub>t\\<^sub>r\\<^sub>m t\\] \"3.prems\"(2)\n unfolding subst_list_def subst_def by auto\n moreover have \"\\(s, t) \\ set (subst_list (subst v t) E). \\ s = \\ t\"\n using *(2)[THEN wt_subst_trm'[OF \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (subst v t)\\]] by (simp add: subst_list_def)\n ultimately show ?thesis using \"3.IH\"(2)[OF \\t \\ Var v\\ \\v \\ fv t\\ ** _ *(1)] by auto\n qed\nnext\n case (4 f X v E B U)\n hence \"\\ (Var v) = \\ (Fun f X)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" by auto\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (subst v (Fun f X))\"\n and *: \"\\(v, t) \\ set ((v,(Fun f X))#B). \\ (Var v) = \\ t\"\n \"\\t t'. (t,t') \\ set E \\ \\ t = \\ t'\"\n using \"4.prems\"(2,3) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def subst_def by auto\n\n have \"v \\ fv (Fun f X)\" using \"4.prems\"(1) by force\n hence **: \"Unification.unify (subst_list (subst v (Fun f X)) E) ((v, (Fun f X))#B) = Some U\"\n using Unification.unify.simps(3)[of v \"Fun f X\" E B] \"4.prems\"(1) by auto\n \n have \"\\(s, t) \\ set (subst_list (subst v (Fun f X)) E). wf\\<^sub>t\\<^sub>r\\<^sub>m s \\ wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using wf_trm_subst_singleton[OF _ \\wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\] \"4.prems\"(2)\n unfolding subst_list_def subst_def by auto\n moreover have \"\\(s, t) \\ set (subst_list (subst v (Fun f X)) E). \\ s = \\ t\"\n using *(2)[THEN wt_subst_trm'[OF \\wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (subst v (Fun f X))\\]] by (simp add: subst_list_def)\n ultimately show ?case using \"4.IH\"[OF \\v \\ fv (Fun f X)\\ ** _ *(1)] by auto\nqed auto\n\nlemma mgu_wt_if_same_type:\n assumes \"mgu s t = Some \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ s = \\ t\"\n shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\nproof -\n let ?fv_disj = \"\\v t S. \\(\\(v',t') \\ S - {(v,t)}. (insert v (fv t)) \\ (insert v' (fv t')) \\ {})\"\n\n from assms(1) obtain \\' where \"Unification.unify [(s,t)] [] = Some \\'\" \"subst_of \\' = \\\"\n by (auto split: option.splits)\n hence \"\\(v,t) \\ set \\'. \\ (Var v) = \\ t\" \"distinct (map fst \\')\"\n using assms(2,3,4) unify_list_wt_if_same_type unify_list_distinct[of \"[(s,t)]\"] by auto\n thus \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" using \\subst_of \\' = \\\\ unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def\n proof (induction \\' arbitrary: \\ rule: List.rev_induct)\n case (snoc tt \\' \\)\n then obtain v t where tt: \"tt = (v,t)\" by (metis surj_pair)\n hence \\: \"\\ = subst v t \\\\<^sub>s subst_of \\'\" using snoc.prems(3) by simp\n \n have \"\\(v,t) \\ set \\'. \\ (Var v) = \\ t\" \"distinct (map fst \\')\" using snoc.prems(1,2) by auto\n then obtain \\'' where \\'': \"subst_of \\' = \\''\" \"\\v. \\ (Var v) = \\ (\\'' v)\" by (metis snoc.IH)\n hence \"\\ t = \\ (t \\ \\'')\" for t using wt_subst_trm by blast\n hence \"\\ (Var v) = \\ (\\'' v)\" \"\\ t = \\ (t \\ \\'')\" using \\''(2) by auto\n moreover have \"\\ (Var v) = \\ t\" using snoc.prems(1) tt by simp\n moreover have \\2: \"\\ = Var(v := t) \\\\<^sub>s \\'' \" using \\ \\''(1) unfolding subst_def by simp\n ultimately have \"\\ (Var v) = \\ (\\ v)\" unfolding subst_compose_def by simp\n\n have \"subst_domain (subst v t) \\ {v}\" unfolding subst_def by (auto simp add: subst_domain_def)\n hence *: \"subst_domain \\ \\ insert v (subst_domain \\'')\"\n using tt \\ \\''(1) snoc.prems(2) subst_domain_compose[of _ \\'']\n by (auto simp add: subst_domain_def)\n \n have \"v \\ set (map fst \\')\" using tt snoc.prems(2) by auto\n hence \"v \\ subst_domain \\''\" using \\''(1) subst_of_dom_subset[of \\'] by auto\n\n { fix w assume \"w \\ subst_domain \\''\"\n hence \"\\ w = \\'' w\" using \\2 \\''(1) \\v \\ subst_domain \\''\\ unfolding subst_compose_def by auto\n hence \"\\ (Var w) = \\ (\\ w)\" using \\''(2) by simp\n }\n thus ?case using \\\\ (Var v) = \\ (\\ v)\\ * by force\n qed simp\nqed\n\nlemma wt_Unifier_if_Unifier:\n assumes s_t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"\\ s = \\ t\"\n and \\: \"Unifier \\ s t\"\n shows \"\\\\. Unifier \\ s t \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\nusing mgu_always_unifies[OF \\] mgu_gives_MGU[THEN MGU_is_Unifier[of s _ t]]\n mgu_wt_if_same_type[OF _ s_t] mgu_wf_trm[OF _ s_t(1,2)] wf_trm_subst_range_iff\nby fast\n\nend\n\n\nsubsection \\Automatically Proving Type-Flaw Resistance\\\nsubsubsection \\Definitions: Variable Renaming\\\nabbreviation \"max_var t \\ Max (insert 0 (snd ` fv t))\"\nabbreviation \"max_var_set X \\ Max (insert 0 (snd ` X))\"\n\ndefinition \"var_rename n v \\ Var (fst v, snd v + Suc n)\"\ndefinition \"var_rename_inv n v \\ Var (fst v, snd v - Suc n)\"\n\n\nsubsubsection \\Definitions: Computing a Finite Representation of the Sub-Message Patterns\\\ntext \\A sufficient requirement for a term to be a well-typed instance of another term\\\ndefinition is_wt_instance_of_cond where\n \"is_wt_instance_of_cond \\ t s \\ (\n \\ t = \\ s \\ (case mgu t s of\n None \\ False\n | Some \\ \\ inj_on \\ (fv t) \\ (\\x \\ fv t. is_Var (\\ x))))\"\n\ndefinition has_all_wt_instances_of where\n \"has_all_wt_instances_of \\ N M \\ \\t \\ N. \\s \\ M. is_wt_instance_of_cond \\ t s\"\n\ntext \\This function computes a finite representation of the set of sub-message patterns\\\ndefinition SMP0 where\n \"SMP0 Ana \\ M \\ let\n f = \\t. Fun (the_Fun (\\ t)) (map Var (zip (args (\\ t)) [0.. t))]));\n g = \\M'. map f (filter (\\t. is_Var t \\ is_Fun (\\ t)) M')@\n concat (map (fst \\ Ana) M')@concat (map subterms_list M');\n h = remdups \\ g\n in while (\\A. set (h A) \\ set A) h M\"\n\ntext \\These definitions are useful to refine an SMP representation set\\\nfun generalize_term where\n \"generalize_term _ _ n (Var x) = (Var x, n)\"\n| \"generalize_term \\ p n (Fun f T) = (let \\ = \\ (Fun f T)\n in if p \\ then (Var (\\, n), Suc n)\n else let (T',n') = foldr (\\t (S,m). let (t',m') = generalize_term \\ p m t in (t'#S,m'))\n T ([],n)\n in (Fun f T', n'))\"\n\ndefinition generalize_terms where\n \"generalize_terms \\ p \\ map (fst \\ generalize_term \\ p 0)\"\n\ndefinition remove_superfluous_terms where\n \"remove_superfluous_terms \\ T \\\n let\n f = \\S t R. \\s \\ set S - R. s \\ t \\ is_wt_instance_of_cond \\ t s;\n g = \\S t (U,R). if f S t R then (U, insert t R) else (t#U, R);\n h = \\S. remdups (fst (foldr (g S) S ([],{})))\n in while (\\S. h S \\ S) h T\"\n\n\nsubsubsection \\Definitions: Checking Type-Flaw Resistance\\\ndefinition is_TComp_var_instance_closed where\n \"is_TComp_var_instance_closed \\ M \\ \\x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). is_Fun (\\ (Var x)) \\\n list_ex (\\t. is_Fun t \\ \\ t = \\ (Var x) \\ list_all is_Var (args t) \\ distinct (args t)) M\"\n\ndefinition finite_SMP_representation where\n \"finite_SMP_representation arity Ana \\ M \\\n list_all (wf\\<^sub>t\\<^sub>r\\<^sub>m' arity) M \\\n has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M) \\\n has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M) \\\n is_TComp_var_instance_closed \\ M\"\n\ndefinition comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t where\n \"comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M \\\n finite_SMP_representation arity Ana \\ M \\\n (let \\ = var_rename (max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)))\n in \\s \\ set M. \\t \\ set M. is_Fun s \\ is_Fun t \\ \\ s \\ \\ t \\ mgu s (t \\ \\) = None)\"\n\nfun comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p where\n \"comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p \\ (\\_: t \\ t'\\\\<^sub>s\\<^sub>t) = (mgu t t' \\ None \\ \\ t = \\ t')\"\n| \"comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p \\ (\\X\\\\\\: F\\\\<^sub>s\\<^sub>t) = (\n (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. is_Var (\\ (Var x))) \\\n (\\u \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F).\n is_Fun u \\ (args u = [] \\ (\\s \\ set (args u). s \\ Var ` set X))))\"\n| \"comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p _ _ = True\"\n\ndefinition comp_tfr\\<^sub>s\\<^sub>t where\n \"comp_tfr\\<^sub>s\\<^sub>t arity Ana \\ M S \\\n list_all (comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p \\) S \\\n list_all (wf\\<^sub>t\\<^sub>r\\<^sub>m' arity) (trms_list\\<^sub>s\\<^sub>t S) \\\n has_all_wt_instances_of \\ (trms\\<^sub>s\\<^sub>t S) (set M) \\\n comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M\"\n\n\nsubsubsection \\Small Lemmata\\\nlemma less_Suc_max_var_set:\n assumes z: \"z \\ X\"\n and X: \"finite X\"\n shows \"snd z < Suc (max_var_set X)\"\nproof -\n have \"snd z \\ snd ` X\" using z by simp\n hence \"snd z \\ Max (insert 0 (snd ` X))\" using X by simp\n thus ?thesis using X by simp\nqed\n\nlemma (in typed_model) finite_SMP_representationD:\n assumes \"finite_SMP_representation arity Ana \\ M\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n and \"is_TComp_var_instance_closed \\ M\"\nusing assms unfolding finite_SMP_representation_def list_all_iff wf\\<^sub>t\\<^sub>r\\<^sub>m_code by blast+\n\nlemma (in typed_model) is_wt_instance_of_condD:\n assumes t_instance_s: \"is_wt_instance_of_cond \\ t s\"\n obtains \\ where\n \"\\ t = \\ s\" \"mgu t s = Some \\\"\n \"inj_on \\ (fv t)\" \"\\ ` (fv t) \\ range Var\"\nusing t_instance_s unfolding is_wt_instance_of_cond_def Let_def by (cases \"mgu t s\") fastforce+\n\nlemma (in typed_model) is_wt_instance_of_condD':\n assumes t_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n and s_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\n and t_instance_s: \"is_wt_instance_of_cond \\ t s\"\n shows \"\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = s \\ \\\"\nproof -\n obtain \\ where s:\n \"\\ t = \\ s\" \"mgu t s = Some \\\"\n \"inj_on \\ (fv t)\" \"\\ ` (fv t) \\ range Var\"\n by (metis is_wt_instance_of_condD[OF t_instance_s])\n\n have 0: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" using s(1) t_wf_trm s_wf_trm by auto\n\n note 1 = mgu_wt_if_same_type[OF s(2) 0 s(1)]\n\n note 2 = conjunct1[OF mgu_gives_MGU[OF s(2)]]\n\n show ?thesis\n using s(1) inj_var_ran_unifiable_has_subst_match[OF 2 s(3,4)]\n wt_subst_compose[OF 1 subst_var_inv_wt[OF 1, of \"fv t\"]]\n wf_trms_subst_compose[OF mgu_wf_trms[OF s(2) 0] subst_var_inv_wf_trms[of \\ \"fv t\"]]\n by auto\nqed\n\nlemma (in typed_model) is_wt_instance_of_condD'':\n assumes s_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\n and t_instance_s: \"is_wt_instance_of_cond \\ t s\"\n and t_var: \"t = Var x\"\n shows \"\\y. s = Var y \\ \\ (Var y) = \\ (Var x)\"\nproof -\n obtain \\ where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" and s: \"Var x = s \\ \\\"\n using is_wt_instance_of_condD'[OF _ s_wf_trm t_instance_s] t_var by auto\n obtain y where y: \"s = Var y\" using s by (cases s) auto\n show ?thesis using wt_subst_trm''[OF \\] s y by metis\nqed\n\nlemma (in typed_model) has_all_wt_instances_ofD:\n assumes N_instance_M: \"has_all_wt_instances_of \\ N M\"\n and t_in_N: \"t \\ N\"\n obtains s \\ where\n \"s \\ M\" \"\\ t = \\ s\" \"mgu t s = Some \\\"\n \"inj_on \\ (fv t)\" \"\\ ` (fv t) \\ range Var\"\nby (metis t_in_N N_instance_M is_wt_instance_of_condD has_all_wt_instances_of_def)\n\nlemma (in typed_model) has_all_wt_instances_ofD':\n assumes N_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and M_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and N_instance_M: \"has_all_wt_instances_of \\ N M\"\n and t_in_N: \"t \\ N\"\n shows \"\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t \\ M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms is_wt_instance_of_condD' unfolding has_all_wt_instances_of_def by fast\n\nlemma (in typed_model) has_all_wt_instances_ofD'':\n assumes N_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and M_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and N_instance_M: \"has_all_wt_instances_of \\ N M\"\n and t_in_N: \"Var x \\ N\"\n shows \"\\y. Var y \\ M \\ \\ (Var y) = \\ (Var x)\"\nusing assms is_wt_instance_of_condD'' unfolding has_all_wt_instances_of_def by fast\n \nlemma (in typed_model) has_all_instances_of_if_subset:\n assumes \"N \\ M\"\n shows \"has_all_wt_instances_of \\ N M\"\nusing assms inj_onI mgu_same_empty\nunfolding has_all_wt_instances_of_def is_wt_instance_of_cond_def\nby (smt option.case_eq_if option.discI option.sel subsetD term.discI(1) term.inject(1))\n\nlemma (in typed_model) SMP_I':\n assumes N_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s N\"\n and M_wf_trms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n and N_instance_M: \"has_all_wt_instances_of \\ N M\"\n and t_in_N: \"t \\ N\"\n shows \"t \\ SMP M\"\nusing has_all_wt_instances_ofD'[OF N_wf_trms M_wf_trms N_instance_M t_in_N]\n SMP.Substitution[OF SMP.MP[of _ M]]\nby blast\n\n\nsubsubsection \\Lemma: Proving Type-Flaw Resistance\\\nlocale typed_model' = typed_model arity public Ana \\\n for arity::\"'fun \\ nat\"\n and public::\"'fun \\ bool\"\n and Ana::\"('fun,(('fun,'atom::finite) term_type \\ nat)) term\n \\ (('fun,(('fun,'atom) term_type \\ nat)) term list\n \\ ('fun,(('fun,'atom) term_type \\ nat)) term list)\"\n and \\::\"('fun,(('fun,'atom) term_type \\ nat)) term \\ ('fun,'atom) term_type\"\n +\n assumes \\_Var_fst: \"\\\\ n m. \\ (Var (\\,n)) = \\ (Var (\\,m))\"\n and Ana_const: \"\\c T. arity c = 0 \\ Ana (Fun c T) = ([],[])\"\n and Ana_subst'_or_Ana_keys_subterm:\n \"(\\f T \\ K R. Ana (Fun f T) = (K,R) \\ Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\,R \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)) \\\n (\\t K R k. Ana t = (K,R) \\ k \\ set K \\ k \\ t)\"\nbegin\n\nlemma var_rename_inv_comp: \"t \\ (var_rename n \\\\<^sub>s var_rename_inv n) = t\"\nproof (induction t)\n case (Fun f T)\n hence \"map (\\t. t \\ var_rename n \\\\<^sub>s var_rename_inv n) T = T\" by (simp add: map_idI) \n thus ?case by (metis subst_apply_term.simps(2)) \nqed (simp add: var_rename_def var_rename_inv_def)\n\nlemma var_rename_fv_disjoint:\n \"fv s \\ fv (t \\ var_rename (max_var s)) = {}\"\nproof -\n have 1: \"\\v \\ fv s. snd v \\ max_var s\" by simp\n have 2: \"\\v \\ fv (t \\ var_rename n). snd v > n\" for n unfolding var_rename_def by (induct t) auto\n show ?thesis using 1 2 by force\nqed\n\nlemma var_rename_fv_set_disjoint:\n assumes \"finite M\" \"s \\ M\"\n shows \"fv s \\ fv (t \\ var_rename (max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t M))) = {}\"\nproof -\n have 1: \"\\v \\ fv s. snd v \\ max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t M)\" using assms\n proof (induction M rule: finite_induct)\n case (insert t M) thus ?case\n proof (cases \"t = s\")\n case False\n hence \"\\v \\ fv s. snd v \\ max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t M)\" using insert by simp\n moreover have \"max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t M) \\ max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t (insert t M))\"\n using insert.hyps(1) insert.prems\n by force\n ultimately show ?thesis by auto\n qed simp\n qed simp\n\n have 2: \"\\v \\ fv (t \\ var_rename n). snd v > n\" for n unfolding var_rename_def by (induct t) auto\n\n show ?thesis using 1 2 by force\nqed\n\nlemma var_rename_fv_set_disjoint':\n assumes \"finite M\"\n shows \"fv\\<^sub>s\\<^sub>e\\<^sub>t M \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (N \\\\<^sub>s\\<^sub>e\\<^sub>t var_rename (max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t M))) = {}\"\nusing var_rename_fv_set_disjoint[OF assms] by auto\n\nlemma var_rename_is_renaming[simp]:\n \"subst_range (var_rename n) \\ range Var\"\n \"subst_range (var_rename_inv n) \\ range Var\"\nunfolding var_rename_def var_rename_inv_def by auto\n\nlemma var_rename_wt[simp]:\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (var_rename n)\"\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (var_rename_inv n)\"\nby (auto simp add: var_rename_def var_rename_inv_def wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def \\_Var_fst)\n\n\n\nlemma var_rename_wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_range[simp]:\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (var_rename n))\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (var_rename_inv n))\"\nusing var_rename_is_renaming by fastforce+\n\nlemma Fun_range_case:\n \"(\\f T. Fun f T \\ M \\ P f T) \\ (\\u \\ M. case u of Fun f T \\ P f T | _ \\ True)\"\n \"(\\f T. Fun f T \\ M \\ P f T) \\ (\\u \\ M. is_Fun u \\ P (the_Fun u) (args u))\"\nby (auto split: \"term.splits\")\n\nlemma is_TComp_var_instance_closedD:\n assumes x: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\" \"\\ (Var x) = TComp f T\"\n and closed: \"is_TComp_var_instance_closed \\ M\"\n shows \"\\g U. Fun g U \\ set M \\ \\ (Fun g U) = \\ (Var x) \\ (\\u \\ set U. is_Var u) \\ distinct U\"\nusing assms unfolding is_TComp_var_instance_closed_def list_all_iff list_ex_iff by fastforce\n\nlemma is_TComp_var_instance_closedD':\n assumes \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\" \"TComp f T \\ \\ (Var x)\"\n and closed: \"is_TComp_var_instance_closed \\ M\"\n and wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n shows \"\\g U. Fun g U \\ set M \\ \\ (Fun g U) = TComp f T \\ (\\u \\ set U. is_Var u) \\ distinct U\"\nusing assms(1,2)\nproof (induction \"\\ (Var x)\" arbitrary: x)\n case (Fun g U)\n note IH = Fun.hyps(1)\n have g: \"arity g > 0\" \"public g\" using Fun.hyps(2) fun_type_inv[of \"Var x\"] \\_Var_fst by simp_all\n then obtain V where V:\n \"Fun g V \\ set M\" \"\\ (Fun g V) = \\ (Var x)\" \"\\v \\ set V. \\x. v = Var x\"\n \"distinct V\" \"length U = length V\"\n using is_TComp_var_instance_closedD[OF Fun.prems(1) Fun.hyps(2)[symmetric] closed(1)]\n by (metis Fun.hyps(2) fun_type_id_eq fun_type_length_eq is_VarE)\n hence U: \"U = map \\ V\" using fun_type[OF g(1), of V] Fun.hyps(2) by simp\n hence 1: \"\\ v \\ set U\" when v: \"v \\ set V\" for v using v by simp\n\n have 2: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var z) = \\ (Var y)\" when z: \"Var z \\ set V\" for z\n using V(1) fv_subset_subterms Fun_param_in_subterms[OF z] by fastforce\n\n show ?case\n proof (cases \"TComp f T = \\ (Var x)\")\n case False\n then obtain u where u: \"u \\ set U\" \"TComp f T \\ u\"\n using Fun.prems(2) Fun.hyps(2) by moura\n then obtain y where y: \"Var y \\ set V\" \"\\ (Var y) = u\" using U V(3) \\_Var_fst by auto\n show ?thesis using IH[OF _ 2[OF y(1)]] u y(2) by metis\n qed (use V in fastforce)\nqed simp\n\nlemma TComp_var_instance_wt_subst_exists:\n assumes gT: \"\\ (Fun g T) = TComp g (map \\ U)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun g T)\"\n and U: \"\\u \\ set U. \\y. u = Var y\" \"distinct U\"\n shows \"\\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ Fun g T = Fun g U \\ \\\"\nproof -\n define the_i where \"the_i \\ \\y. THE x. x < length U \\ U ! x = Var y\"\n define \\ where \\: \"\\ \\ \\y. if Var y \\ set U then T ! the_i y else Var y\"\n\n have g: \"arity g > 0\" using gT(1,2) fun_type_inv(1) by blast\n\n have UT: \"length U = length T\" using fun_type_length_eq gT(1) by fastforce\n\n have 1: \"the_i y < length U \\ U ! the_i y = Var y\" when y: \"Var y \\ set U\" for y\n using theI'[OF distinct_Ex1[OF U(2) y]] unfolding the_i_def by simp\n\n have 2: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using \\ 1 gT(1) fun_type[OF g] UT\n unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def\n by (metis (no_types, lifting) nth_map term.inject(2))\n\n have \"\\i \\ = T ! i\"\n using \\ 1 U(1) UT distinct_Ex1[OF U(2)] in_set_conv_nth\n by (metis (no_types, lifting) subst_apply_term.simps(1))\n hence \"T = map (\\t. t \\ \\) U\" by (simp add: UT nth_equalityI)\n hence 3: \"Fun g T = Fun g U \\ \\\" by simp\n\n have \"subst_range \\ \\ set T\" using \\ 1 U(1) UT by (auto simp add: subst_domain_def)\n hence 4: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" using gT(2) wf_trm_param by auto\n\n show ?thesis by (metis 2 3 4)\nqed\n\nlemma TComp_var_instance_closed_has_Var:\n assumes closed: \"is_TComp_var_instance_closed \\ M\"\n and wf_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and wf_\\x: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\"\n and y_ex: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\"\n and t: \"t \\ \\ x\"\n and \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n shows \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var y) = \\ t\"\nproof (cases \"\\ (Var x)\")\n case (Var a)\n hence \"t = \\ x\"\n using t wf_\\x \\_wt\n by (metis (full_types) const_type_inv_wf fun_if_subterm subtermeq_Var_const(2) wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n thus ?thesis using y_ex wt_subst_trm''[OF \\_wt, of \"Var x\"] by fastforce\nnext\n case (Fun f T)\n hence \\_\\x: \"\\ (\\ x) = TComp f T\" using wt_subst_trm''[OF \\_wt, of \"Var x\"] by auto\n\n show ?thesis\n proof (cases \"t = \\ x\")\n case False\n hence t_subt_\\x: \"t \\ \\ x\" using t(1) \\_\\x by fastforce\n\n obtain T' where T': \"\\ x = Fun f T'\" using \\_\\x t_subt_\\x fun_type_id_eq by (cases \"\\ x\") auto\n \n obtain g S where gS: \"Fun g S \\ \\ x\" \"t \\ set S\" using Fun_ex_if_subterm[OF t_subt_\\x] by blast\n \n have gS_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun g S)\" by (rule wf_trm_subtermeq[OF wf_\\x gS(1)])\n hence \"arity g > 0\" using gS(2) by (metis length_pos_if_in_set wf_trm_arity) \n hence gS_\\: \"\\ (Fun g S) = TComp g (map \\ S)\" using fun_type by blast\n \n obtain h U where hU:\n \"Fun h U \\ set M\" \"\\ (Fun h U) = Fun g (map \\ S)\" \"\\u \\ set U. is_Var u\"\n using is_TComp_var_instance_closedD'[OF y_ex _ closed wf_M]\n subtermeq_imp_subtermtypeeq[OF wf_\\x] gS \\_\\x Fun gS_\\\n by metis\n \n obtain y where y: \"Var y \\ set U\" \"\\ (Var y) = \\ t\"\n using hU(3) fun_type_param_ex[OF hU(2) gS(2)] by fast\n \n have \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" using hU(1) y(1) by force\n thus ?thesis using y(2) closed by metis\n qed (metis y_ex Fun \\_\\x)\nqed\n\nlemma TComp_var_instance_closed_has_Fun:\n assumes closed: \"is_TComp_var_instance_closed \\ M\"\n and wf_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and wf_\\x: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\"\n and y_ex: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\"\n and t: \"t \\ \\ x\"\n and \\_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n and t_\\: \"\\ t = TComp g T\"\n and t_fun: \"is_Fun t\"\n shows \"\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\ \\ is_Fun m\"\nproof -\n obtain T'' where T'': \"t = Fun g T''\" using t_\\ t_fun fun_type_id_eq by blast\n\n have g: \"arity g > 0\" using t_\\ fun_type_inv[of t] by simp_all\n\n have \"TComp g T \\ \\ (Var x)\" using \\_wt t t_\\\n by (metis wf_\\x subtermeq_imp_subtermtypeeq wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def) \n then obtain U where U:\n \"Fun g U \\ set M\" \"\\ (Fun g U) = TComp g T\" \"\\u \\ set U. \\y. u = Var y\"\n \"distinct U\" \"length T'' = length U\"\n using is_TComp_var_instance_closedD'[OF y_ex _ closed wf_M]\n by (metis t_\\ T'' fun_type_id_eq fun_type_length_eq is_VarE)\n hence UT': \"T = map \\ U\" using fun_type[OF g, of U] by simp\n\n show ?thesis\n using TComp_var_instance_wt_subst_exists UT' T'' U(1,3,4) t t_\\ wf_\\x wf_trm_subtermeq\n by (metis term.disc(2))\nqed\n\nlemma TComp_var_and_subterm_instance_closed_has_subterms_instances:\n assumes M_var_inst_cl: \"is_TComp_var_instance_closed \\ M\"\n and M_subterms_cl: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and t: \"t \\\\<^sub>s\\<^sub>e\\<^sub>t set M\"\n and s: \"s \\ t \\ \\\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n shows \"\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ s = m \\ \\\"\nusing subterm_subst_unfold[OF s]\nproof\n assume \"\\s'. s' \\ t \\ s = s' \\ \\\"\n then obtain s' where s': \"s' \\ t\" \"s = s' \\ \\\" by blast\n then obtain \\ where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"s' \\ set M \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using t has_all_wt_instances_ofD'[OF wf_trms_subterms[OF M_wf] M_wf M_subterms_cl]\n term.order_trans[of s' t]\n by blast\n then obtain m where m: \"m \\ set M\" \"s' = m \\ \\\" by blast\n\n have \"s = m \\ (\\ \\\\<^sub>s \\)\" using s'(2) m(2) by simp\n thus ?thesis\n using m(1) wt_subst_compose[OF \\(1) \\(1)] wf_trms_subst_compose[OF \\(2) \\(2)] by blast\nnext\n assume \"\\x \\ fv t. s \\ \\ x\"\n then obtain x where x: \"x \\ fv t\" \"s \\ \\ x\" \"s \\ \\ x\" by blast\n\n note 0 = TComp_var_instance_closed_has_Var[OF M_var_inst_cl M_wf]\n note 1 = has_all_wt_instances_ofD''[OF wf_trms_subterms[OF M_wf] M_wf M_subterms_cl]\n\n have \\x_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" and s_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\n using \\(2) wf_trm_subterm[OF _ x(2)] by fastforce+\n\n have x_fv_ex: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\"\n using x(1) s fv_subset_subterms[OF t] by auto\n\n obtain y where y: \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" \"\\ (Var y) = \\ s\"\n using 0[of \\ x s, OF \\x_wf x_fv_ex x(3) \\(1)] by metis\n then obtain z where z: \"Var z \\ set M\" \"\\ (Var z) = \\ s\"\n using 1[of y] vars_iff_subtermeq_set[of y \"set M\"] by metis\n\n define \\ where \"\\ \\ Var(z := s)::('fun, ('fun, 'atom) term \\ nat) subst\"\n\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"s = Var z \\ \\\"\n using z(2) s_wf_trm unfolding \\_def wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by force+\n thus ?thesis using z(1) by blast\nqed\n\ncontext\nbegin\nprivate lemma SMP_D_aux1:\n assumes \"t \\ SMP (set M)\"\n and closed: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n \"is_TComp_var_instance_closed \\ M\"\n and wf_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n shows \"\\x \\ fv t. \\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var y) = \\ (Var x)\"\nusing assms(1)\nproof (induction t rule: SMP.induct)\n case (MP t) show ?case\n proof\n fix x assume x: \"x \\ fv t\"\n hence \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" using MP.hyps vars_iff_subtermeq by fastforce\n then obtain \\ s where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and s: \"s \\ set M\" \"Var x = s \\ \\\"\n using has_all_wt_instances_ofD'[OF wf_trms_subterms[OF wf_M] wf_M closed(1)] by blast\n then obtain y where y: \"s = Var y\" by (cases s) auto\n thus \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var y) = \\ (Var x)\"\n using s wt_subst_trm''[OF \\(1), of \"Var y\"] by force\n qed\nnext\n case (Subterm t t')\n hence \"fv t' \\ fv t\" using subtermeq_vars_subset by auto\n thus ?case using Subterm.IH by auto\nnext\n case (Substitution t \\)\n note IH = Substitution.IH\n show ?case\n proof\n fix x assume x: \"x \\ fv (t \\ \\)\"\n then obtain y where y: \"y \\ fv t\" \"\\ (Var x) \\ \\ (Var y)\"\n using Substitution.hyps(2,3)\n by (metis subst_apply_img_var subtermeqI' subtermeq_imp_subtermtypeeq\n vars_iff_subtermeq wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def wf_trm_subst_rangeD)\n let ?P = \"\\x. \\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var y) = \\ (Var x)\"\n show \"?P x\" using y IH\n proof (induction \"\\ (Var y)\" arbitrary: y t)\n case (Var a)\n hence \"\\ (Var x) = \\ (Var y)\" by auto\n thus ?case using Var(2,4) by auto\n next\n case (Fun f T)\n obtain z where z: \"\\w \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var z) = \\ (Var w)\" \"\\ (Var z) = \\ (Var y)\"\n using Fun.prems(1,3) by blast\n show ?case\n proof (cases \"\\ (Var x) = \\ (Var y)\")\n case True thus ?thesis using Fun.prems by auto\n next\n case False\n then obtain \\ where \\: \"\\ \\ set T\" \"\\ (Var x) \\ \\\" using Fun.prems(2) Fun.hyps(2) by auto\n then obtain U where U:\n \"Fun f U \\ set M\" \"\\ (Fun f U) = \\ (Var z)\" \"\\u \\ set U. \\v. u = Var v\" \"distinct U\"\n using is_TComp_var_instance_closedD'[OF z(1) _ closed(2) wf_M] Fun.hyps(2) z(2)\n by (metis fun_type_id_eq subtermeqI' is_VarE)\n hence 1: \"\\x \\ fv (Fun f U). \\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var y) = \\ (Var x)\" by force\n\n have \"arity f > 0\" using U(2) z(2) Fun.hyps(2) fun_type_inv(1) by metis\n hence \"\\ (Fun f U) = TComp f (map \\ U)\" using fun_type by auto\n then obtain u where u: \"Var u \\ set U\" \"\\ (Var u) = \\\"\n using \\(1) U(2,3) z(2) Fun.hyps(2) by auto\n show ?thesis\n using Fun.hyps(1)[of u \"Fun f U\"] u \\ 1\n by force\n qed\n qed\n qed\nnext\n case (Ana t K T k)\n have \"fv k \\ fv t\" using Ana_keys_fv[OF Ana.hyps(2)] Ana.hyps(3) by auto\n thus ?case using Ana.IH by auto\nqed\n\nprivate lemma SMP_D_aux2:\n fixes t::\"('fun, ('fun, 'atom) term \\ nat) term\"\n assumes t_SMP: \"t \\ SMP (set M)\"\n and t_Var: \"\\x. t = Var x\"\n and M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n shows \"\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\\"\nproof -\n have M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\" \n and M_var_inst_cl: \"is_TComp_var_instance_closed \\ M\"\n and M_subterms_cl: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and M_Ana_cl: \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n using finite_SMP_representationD[OF M_SMP_repr] by blast+\n\n have M_Ana_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\ ((set \\ fst \\ Ana) ` set M))\"\n proof\n fix k assume \"k \\ \\((set \\ fst \\ Ana) ` set M)\"\n then obtain m where m: \"m \\ set M\" \"k \\ set (fst (Ana m))\" by force\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m k\" using M_wf Ana_keys_wf'[of m \"fst (Ana m)\" _ k] surjective_pairing by blast\n qed\n\n note 0 = has_all_wt_instances_ofD'[OF wf_trms_subterms[OF M_wf] M_wf M_subterms_cl]\n note 1 = has_all_wt_instances_ofD'[OF M_Ana_wf M_wf M_Ana_cl]\n\n obtain x y where x: \"t = Var x\" and y: \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" \"\\ (Var y) = \\ (Var x)\"\n using t_Var SMP_D_aux1[OF t_SMP M_subterms_cl M_var_inst_cl M_wf] by fastforce\n then obtain m \\ where m: \"m \\ set M\" \"m \\ \\ = Var y\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using 0[of \"Var y\"] vars_iff_subtermeq_set[of y \"set M\"] by fastforce\n obtain z where z: \"m = Var z\" using m(2) by (cases m) auto\n\n define \\ where \"\\ \\ Var(z := Var x)::('fun, ('fun, 'atom) term \\ nat) subst\"\n\n have \"\\ (Var z) = \\ (Var x)\" using y(2) m(2) z wt_subst_trm''[OF \\, of m] by argo\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" unfolding \\_def wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by force+\n moreover have \"t = m \\ \\\" using x z unfolding \\_def by simp\n ultimately show ?thesis using m(1) by blast\nqed\n\nprivate lemma SMP_D_aux3:\n assumes hyps: \"t' \\ t\" and wf_t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" and prems: \"is_Fun t'\"\n and IH:\n \"((\\f. t = Fun f []) \\ (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\)) \\\n (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\ \\ is_Fun m)\"\n and M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n shows \"((\\f. t' = Fun f []) \\ (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t' = m \\ \\)) \\\n (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t' = m \\ \\ \\ is_Fun m)\"\nproof (cases \"\\f. t = Fun f [] \\ t' = Fun f []\")\n case True\n have M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\" \n and M_var_inst_cl: \"is_TComp_var_instance_closed \\ M\"\n and M_subterms_cl: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and M_Ana_cl: \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n using finite_SMP_representationD[OF M_SMP_repr] by blast+\n\n note 0 = has_all_wt_instances_ofD'[OF wf_trms_subterms[OF M_wf] M_wf M_subterms_cl]\n note 1 = TComp_var_instance_closed_has_Fun[OF M_var_inst_cl M_wf]\n note 2 = TComp_var_and_subterm_instance_closed_has_subterms_instances[\n OF M_var_inst_cl M_subterms_cl M_wf]\n\n have wf_t': \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" using hyps wf_t wf_trm_subterm by blast\n\n obtain c where \"t = Fun c [] \\ t' = Fun c []\" using True by moura\n thus ?thesis\n proof\n assume c: \"t' = Fun c []\"\n show ?thesis\n proof (cases \"\\f. t = Fun f []\")\n case True\n hence \"t = t'\" using c hyps by force\n thus ?thesis using IH by fast\n next\n case False\n note F = this\n then obtain m \\ where m: \"m \\ set M\" \"t = m \\ \\\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using IH by blast\n\n show ?thesis using subterm_subst_unfold[OF hyps[unfolded m(2)]]\n proof\n assume \"\\m'. m' \\ m \\ t' = m' \\ \\\"\n then obtain m' where m': \"m' \\ m\" \"t' = m' \\ \\\" by moura\n obtain n \\ where n: \"n \\ set M\" \"m' = n \\ \\\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using 0[of m'] m(1) m'(1) by blast\n have \"t' = n \\ (\\ \\\\<^sub>s \\)\" using m'(2) n(2) by auto\n thus ?thesis\n using c n(1) wt_subst_compose[OF \\(1) \\(1)] wf_trms_subst_compose[OF \\(2) \\(2)] by blast\n next\n assume \"\\x \\ fv m. t' \\ \\ x\"\n then obtain x where x: \"x \\ fv m\" \"t' \\ \\ x\" \"t' \\ \\ x\" by moura\n have \\x_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" using \\(2) by fastforce\n \n have x_fv_ex: \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\" using x m by auto\n\n show ?thesis\n proof (cases \"\\ t'\")\n case (Var a)\n show ?thesis\n using c m 2[OF _ hyps[unfolded m(2)] \\]\n by fast\n next\n case (Fun g S)\n show ?thesis\n using c 1[of \\ x t', OF \\x_wf x_fv_ex x(3) \\(1) Fun]\n by blast\n qed\n qed\n qed\n qed (use IH hyps in simp)\nnext\n case False\n note F = False\n then obtain m \\ where m:\n \"m \\ set M\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"t = m \\ \\\" \"is_Fun m\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using IH by moura\n obtain f T where fT: \"t' = Fun f T\" \"arity f > 0\" \"\\ t' = TComp f (map \\ T)\"\n using F prems fun_type wf_trm_subtermeq[OF wf_t hyps]\n by (metis is_FunE length_greater_0_conv subtermeqI' wf\\<^sub>t\\<^sub>r\\<^sub>m_def)\n\n have closed: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n \"is_TComp_var_instance_closed \\ M\"\n using M_SMP_repr unfolding finite_SMP_representation_def by metis+\n\n have M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\" \n using finite_SMP_representationD[OF M_SMP_repr] by blast\n\n show ?thesis\n proof (cases \"\\x \\ fv m. t' \\ \\ x\")\n case True\n then obtain x where x: \"x \\ fv m\" \"t' \\ \\ x\" by moura\n have 1: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" using m(1) x(1) by auto\n have 2: \"is_Fun (\\ x)\" using prems x(2) by auto\n have 3: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\ x)\" using m(5) by (simp add: wf_trm_subst_rangeD)\n have \"\\(\\f. \\ x = Fun f [])\" using F x(2) by auto\n hence \"\\f T. \\ (Var x) = TComp f T\" using 2 3 m(2)\n by (metis (no_types) fun_type is_FunE length_greater_0_conv subtermeqI' wf\\<^sub>t\\<^sub>r\\<^sub>m_def wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def)\n moreover have \"\\f T. \\ t' = Fun f T\"\n using False prems wf_trm_subtermeq[OF wf_t hyps]\n by (metis (no_types) fun_type is_FunE length_greater_0_conv subtermeqI' wf\\<^sub>t\\<^sub>r\\<^sub>m_def)\n ultimately show ?thesis\n using TComp_var_instance_closed_has_Fun 1 x(2) m(2) prems closed 3 M_wf\n by metis\n next\n case False\n then obtain m' where m': \"m' \\ m\" \"t' = m' \\ \\\" \"is_Fun m'\"\n using hyps m(3) subterm_subst_not_img_subterm\n by blast\n then obtain \\ m'' where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"m'' \\ set M\" \"m' = m'' \\ \\\"\n using m(1) has_all_wt_instances_ofD'[OF wf_trms_subterms[OF M_wf] M_wf closed(1)] by blast\n hence t'_m'': \"t' = m'' \\ \\ \\\\<^sub>s \\\" using m'(2) by fastforce\n\n note \\\\ = wt_subst_compose[OF \\(1) m(2)] wf_trms_subst_compose[OF \\(2) m(5)]\n\n show ?thesis\n proof (cases \"is_Fun m''\")\n case True thus ?thesis using \\(3,4) m'(2,3) m(4) fT t'_m'' \\\\ by blast\n next\n case False\n then obtain x where x: \"m'' = Var x\" by moura\n hence \"\\y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M). \\ (Var x) = \\ (Var y)\" \"t' \\ (\\ \\\\<^sub>s \\) x\"\n \"\\ (Var x) = Fun f (map \\ T)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m ((\\ \\\\<^sub>s \\) x)\"\n using \\\\ t'_m'' \\(3) fv_subset[OF \\(3)] fT(3) subst_apply_term.simps(1)[of x \"\\ \\\\<^sub>s \\\"]\n wt_subst_trm''[OF \\\\(1), of \"Var x\"]\n by (fastforce, blast, argo, fastforce)\n thus ?thesis\n using x TComp_var_instance_closed_has_Fun[\n of M \"\\ \\\\<^sub>s \\\" x t' f \"map \\ T\", OF closed(2) M_wf _ _ _ \\\\(1) fT(3) prems]\n by blast\n qed\n qed\nqed\n\nlemma SMP_D:\n assumes \"t \\ SMP (set M)\" \"is_Fun t\"\n and M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n shows \"((\\f. t = Fun f []) \\ (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\)) \\\n (\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\ \\ is_Fun m)\"\nproof -\n have wf_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and closed: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n \"is_TComp_var_instance_closed \\ M\"\n using finite_SMP_representationD[OF M_SMP_repr] by blast+\n\n show ?thesis using assms(1,2)\n proof (induction t rule: SMP.induct)\n case (MP t)\n moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" \"t = t \\ Var\" by simp_all\n ultimately show ?case by blast \n next\n case (Subterm t t')\n hence t_fun: \"is_Fun t\" by auto\n note * = Subterm.hyps(2) SMP_wf_trm[OF Subterm.hyps(1) wf_M(1)]\n Subterm.prems Subterm.IH[OF t_fun] M_SMP_repr\n show ?case by (rule SMP_D_aux3[OF *])\n next\n case (Substitution t \\)\n have wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by (metis Substitution.hyps(1) wf_M(1) SMP_wf_trm)\n hence wf': \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\ \\)\" using Substitution.hyps(3) wf_trm_subst by blast\n show ?case\n proof (cases \"\\ t\")\n case (Var a)\n hence 1: \"\\ (t \\ \\) = TAtom a\" using Substitution.hyps(2) by (metis wt_subst_trm'') \n then obtain c where c: \"t \\ \\ = Fun c []\"\n using TAtom_term_cases[OF wf' 1] Substitution.prems by fastforce\n hence \"(\\x. t = Var x) \\ t = t \\ \\\" by (cases t) auto\n thus ?thesis\n proof\n assume t_Var: \"\\x. t = Var x\"\n then obtain x where x: \"t = Var x\" \"\\ x = Fun c []\" \"\\ (Var x) = TAtom a\"\n using c 1 wt_subst_trm''[OF Substitution.hyps(2), of t] by force\n \n obtain m \\ where m: \"m \\ set M\" \"t = m \\ \\\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using SMP_D_aux2[OF Substitution.hyps(1) t_Var M_SMP_repr] by moura\n\n have \"m \\ (\\ \\\\<^sub>s \\) = Fun c []\" using c m(2) by auto\n thus ?thesis\n using c m(1) wt_subst_compose[OF \\(1) Substitution.hyps(2)]\n wf_trms_subst_compose[OF \\(2) Substitution.hyps(3)]\n by metis\n qed (use c Substitution.IH in auto)\n next\n case (Fun f T)\n hence 1: \"\\ (t \\ \\) = TComp f T\" using Substitution.hyps(2) by (metis wt_subst_trm'')\n have 2: \"\\(\\f. t = Fun f [])\" using Fun TComp_term_cases[OF wf] by auto\n obtain T'' where T'': \"t \\ \\ = Fun f T''\"\n using 1 2 fun_type_id_eq Fun Substitution.prems\n by fastforce\n have f: \"arity f > 0\" \"public f\" using fun_type_inv[OF 1] by metis+\n \n show ?thesis\n proof (cases t)\n case (Fun g U)\n then obtain m \\ where m:\n \"m \\ set M\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"t = m \\ \\\" \"is_Fun m\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using Substitution.IH Fun 2 by moura\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\)\" \"t \\ \\ = m \\ (\\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\"\n using wt_subst_compose[OF m(2) Substitution.hyps(2)] m(3)\n wf_trms_subst_compose[OF m(5) Substitution.hyps(3)]\n by auto\n thus ?thesis using m(1,4) by metis\n next\n case (Var x)\n then obtain y where y: \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" \"\\ (Var y) = \\ (Var x)\"\n using SMP_D_aux1[OF Substitution.hyps(1) closed(1,3) wf_M] Fun\n by moura\n hence 3: \"\\ (Var y) = TComp f T\" using Var Fun \\_Var_fst by simp\n \n obtain h V where V:\n \"Fun h V \\ set M\" \"\\ (Fun h V) = \\ (Var y)\" \"\\u \\ set V. \\z. u = Var z\" \"distinct V\"\n by (metis is_VarE is_TComp_var_instance_closedD[OF _ 3 closed(3)] y(1))\n moreover have \"length T'' = length V\" using 3 V(2) fun_type_length_eq 1 T'' by metis\n ultimately have TV: \"T = map \\ V\"\n by (metis fun_type[OF f(1)] 3 fun_type_id_eq term.inject(2))\n \n obtain \\ where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t \\ \\ = Fun h V \\ \\\"\n using TComp_var_instance_wt_subst_exists 1 3 T'' TV V(2,3,4) wf'\n by (metis fun_type_id_eq)\n \n have 9: \"\\ (Fun h V) = \\ (\\ x)\" using y(2) Substitution.hyps(2) V(2) 1 3 Var by auto\n \n show ?thesis using Var \\ 9 V(1) by force\n qed\n qed\n next\n case (Ana t K T k)\n have 1: \"is_Fun t\" using Ana.hyps(2,3) by auto\n then obtain f U where U: \"t = Fun f U\" by moura\n \n have 2: \"fv k \\ fv t\" using Ana_keys_fv[OF Ana.hyps(2)] Ana.hyps(3) by auto\n \n have wf_t: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n using SMP_wf_trm[OF Ana.hyps(1)] wf\\<^sub>t\\<^sub>r\\<^sub>m_code wf_M\n by auto\n hence wf_k: \"wf\\<^sub>t\\<^sub>r\\<^sub>m k\"\n using Ana_keys_wf'[OF Ana.hyps(2)] wf\\<^sub>t\\<^sub>r\\<^sub>m_code Ana.hyps(3)\n by auto\n \n have wf_M_keys: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\((set \\ fst \\ Ana) ` set M))\"\n proof\n fix t assume \"t \\ (\\((set \\ fst \\ Ana) ` set M))\"\n then obtain s where s: \"s \\ set M\" \"t \\ (set \\ fst \\ Ana) s\" by blast\n obtain K R where KR: \"Ana s = (K,R)\" by (metis surj_pair)\n hence \"t \\ set K\" using s(2) by simp\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Ana_keys_wf'[OF KR] wf_M s(1) by blast\n qed\n \n show ?case using Ana_subst'_or_Ana_keys_subterm\n proof\n assume \"\\t K T k. Ana t = (K, T) \\ k \\ set K \\ k \\ t\"\n hence *: \"k \\ t\" using Ana.hyps(2,3) by auto\n show ?thesis by (rule SMP_D_aux3[OF * wf_t Ana.prems Ana.IH[OF 1] M_SMP_repr])\n next\n assume Ana_subst':\n \"\\f T \\ K M. Ana (Fun f T) = (K, M) \\ Ana (Fun f T \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\, M \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\n \n have \"arity f > 0\" using Ana_const[of f U] U Ana.hyps(2,3) by fastforce\n hence \"U \\ []\" using wf_t U unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by force\n then obtain m \\ where m: \"m \\ set M\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t = m \\ \\\" \"is_Fun m\"\n using Ana.IH[OF 1] U by auto\n hence \"Ana (t \\ \\) = (K \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\,T \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\" using Ana_subst' U Ana.hyps(2) by auto\n obtain Km Tm where Ana_m: \"Ana m = (Km,Tm)\" by moura\n hence \"Ana (m \\ \\) = (Km \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\,Tm \\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\)\"\n using Ana_subst' U m(4) is_FunE[OF m(5)] Ana.hyps(2)\n by metis\n then obtain km where km: \"km \\ set Km\" \"k = km \\ \\\" using Ana.hyps(2,3) m(4) by auto\n then obtain \\ km' where \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n and km': \"km' \\ set M\" \"km = km' \\ \\\"\n using Ana_m m(1) has_all_wt_instances_ofD'[OF wf_M_keys wf_M closed(2), of km] by force\n \n have k\\\\: \"k = km' \\ \\ \\\\<^sub>s \\\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\ \\\\<^sub>s \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\ \\\\<^sub>s \\))\"\n using km(2) km' wt_subst_compose[OF \\(1) m(2)] wf_trms_subst_compose[OF \\(2) m(3)]\n by auto\n \n show ?case\n proof (cases \"is_Fun km'\")\n case True thus ?thesis using k\\\\ km'(1) by blast\n next\n case False\n note F = False\n then obtain x where x: \"km' = Var x\" by auto\n hence 3: \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" using fv_subset[OF km'(1)] by auto\n obtain kf kT where kf: \"k = Fun kf kT\" using Ana.prems by auto\n show ?thesis\n proof (cases \"kT = []\")\n case True thus ?thesis using k\\\\(1) k\\\\(2) k\\\\(3) kf km'(1) by blast\n next\n case False\n hence 4: \"arity kf > 0\" using wf_k kf TAtom_term_cases const_type by fastforce\n then obtain kT' where kT': \"\\ k = TComp kf kT'\" by (simp add: fun_type kf) \n then obtain V where V:\n \"Fun kf V \\ set M\" \"\\ (Fun kf V) = \\ (Var x)\" \"\\u \\ set V. \\v. u = Var v\"\n \"distinct V\" \"is_Fun (Fun kf V)\"\n using is_TComp_var_instance_closedD[OF _ _ closed(3), of x]\n x m(2) k\\\\(1) 3 wt_subst_trm''[OF k\\\\(2)]\n by (metis fun_type_id_eq term.disc(2) is_VarE)\n have 5: \"kT' = map \\ V\"\n using fun_type[OF 4] x kT' k\\\\ m(2) V(2)\n by (metis term.inject(2) wt_subst_trm'')\n thus ?thesis\n using TComp_var_instance_wt_subst_exists wf_k kf 4 V(3,4) kT' V(1,5)\n by metis\n qed\n qed\n qed\n qed\nqed\n\nlemma SMP_D':\n fixes M\n defines \"\\ \\ var_rename (max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)))\"\n assumes M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n and s: \"s \\ SMP (set M)\" \"is_Fun s\" \"\\f. s = Fun f []\"\n and t: \"t \\ SMP (set M)\" \"is_Fun t\" \"\\f. t = Fun f []\"\n obtains \\ s0 \\ t0\n where \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"s0 \\ set M\" \"is_Fun s0\" \"s = s0 \\ \\\" \"\\ s = \\ s0\"\n and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t0 \\ set M\" \"is_Fun t0\" \"t = t0 \\ \\ \\ \\\" \"\\ t = \\ t0\"\nproof -\n obtain \\ s0 where\n s0: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"s0 \\ set M\" \"s = s0 \\ \\\" \"is_Fun s0\"\n using s(3) SMP_D[OF s(1,2) M_SMP_repr] unfolding \\_def by metis\n\n obtain \\ t0 where t0:\n \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t0 \\ set M\" \"t = t0 \\ \\ \\ \\\" \"is_Fun t0\"\n using t(3) SMP_D[OF t(1,2) M_SMP_repr] var_rename_wt'[of _ t]\n wf_trms_subst_compose_Var_range(1)[OF _ var_rename_is_renaming(2)]\n unfolding \\_def by metis\n\n have \"\\ s = \\ s0\" \"\\ t = \\ (t0 \\ \\)\" \"\\ (t0 \\ \\) = \\ t0\"\n using s0 t0 wt_subst_trm'' by (metis, metis, metis \\_def var_rename_wt(1))\n thus ?thesis using s0 t0 that by simp\nqed\n\nlemma SMP_D'':\n fixes t::\"('fun, ('fun, 'atom) term \\ nat) term\"\n assumes t_SMP: \"t \\ SMP (set M)\"\n and M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n shows \"\\m \\ set M. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ t = m \\ \\\"\nproof (cases \"(\\x. t = Var x) \\ (\\c. t = Fun c [])\")\n case True\n have M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\" \n and M_var_inst_cl: \"is_TComp_var_instance_closed \\ M\"\n and M_subterms_cl: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and M_Ana_cl: \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n using finite_SMP_representationD[OF M_SMP_repr] by blast+\n\n have M_Ana_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\ ((set \\ fst \\ Ana) ` set M))\"\n proof\n fix k assume \"k \\ \\((set \\ fst \\ Ana) ` set M)\"\n then obtain m where m: \"m \\ set M\" \"k \\ set (fst (Ana m))\" by force\n thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m k\" using M_wf Ana_keys_wf'[of m \"fst (Ana m)\" _ k] surjective_pairing by blast\n qed\n\n show ?thesis using True\n proof\n assume \"\\x. t = Var x\"\n then obtain x y where x: \"t = Var x\" and y: \"y \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" \"\\ (Var y) = \\ (Var x)\"\n using SMP_D_aux1[OF t_SMP M_subterms_cl M_var_inst_cl M_wf] by fastforce\n then obtain m \\ where m: \"m \\ set M\" \"m \\ \\ = Var y\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\"\n using has_all_wt_instances_ofD'[OF wf_trms_subterms[OF M_wf] M_wf M_subterms_cl, of \"Var y\"]\n vars_iff_subtermeq_set[of y \"set M\"]\n by fastforce\n\n obtain z where z: \"m = Var z\" using m(2) by (cases m) auto\n\n define \\ where \"\\ \\ Var(z := Var x)::('fun, ('fun, 'atom) term \\ nat) subst\"\n\n have \"\\ (Var z) = \\ (Var x)\" using y(2) m(2) z wt_subst_trm''[OF \\, of m] by argo\n hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" unfolding \\_def wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by force+\n moreover have \"t = m \\ \\\" using x z unfolding \\_def by simp\n ultimately show ?thesis using m(1) by blast\n qed (use SMP_D[OF t_SMP _ M_SMP_repr] in blast)\nqed (use SMP_D[OF t_SMP _ M_SMP_repr] in blast)\nend\n\nlemma tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t:\n assumes \"comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (set M)\"\nproof -\n let ?\\ = \"var_rename (max_var_set (fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)))\"\n have M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n by (metis comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def assms)\n\n have M_finite: \"finite (set M)\"\n using assms card_gt_0_iff unfolding comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n\n show ?thesis\n proof (unfold tfr\\<^sub>s\\<^sub>e\\<^sub>t_def; intro ballI impI)\n fix s t assume \"s \\ SMP (set M) - Var`\\\" \"t \\ SMP (set M) - Var`\\\"\n hence st: \"s \\ SMP (set M)\" \"is_Fun s\" \"t \\ SMP (set M)\" \"is_Fun t\" by auto\n have \"\\(\\\\. Unifier \\ s t)\" when st_type_neq: \"\\ s \\ \\ t\"\n proof (cases \"\\f. s = Fun f [] \\ t = Fun f []\")\n case False\n then obtain \\ s0 \\ t0 where\n s0: \"s0 \\ set M\" \"is_Fun s0\" \"s = s0 \\ \\\" \"\\ s = \\ s0\"\n and t0: \"t0 \\ set M\" \"is_Fun t0\" \"t = t0 \\ ?\\ \\ \\\" \"\\ t = \\ t0\"\n using SMP_D'[OF M_SMP_repr st(1,2) _ st(3,4)] by metis\n hence \"\\(\\\\. Unifier \\ s0 (t0 \\ ?\\))\"\n using assms mgu_None_is_subst_neq st_type_neq wt_subst_trm''[OF var_rename_wt(1)]\n unfolding comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def Let_def by metis\n thus ?thesis\n using vars_term_disjoint_imp_unifier[OF var_rename_fv_set_disjoint[OF M_finite]] s0(1) t0(1)\n unfolding s0(3) t0(3) by (metis (no_types, opaque_lifting) subst_subst_compose)\n qed (use st_type_neq st(2,4) in auto)\n thus \"\\ s = \\ t\" when \"\\\\. Unifier \\ s t\" by (metis that)\n qed\nqed\n\nlemma tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t':\n assumes \"let N = SMP0 Ana \\ M in set M \\ set N \\ comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ N\"\n shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (set M)\"\nby (rule tfr_subset(2)[\n OF tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t[OF conjunct2[OF assms[unfolded Let_def]]]\n conjunct1[OF assms[unfolded Let_def]]])\n\nlemma tfr\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p: \"tfr\\<^sub>s\\<^sub>t\\<^sub>p a = comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p \\ a\"\nproof (cases a)\n case (Equality ac t t')\n thus ?thesis\n using mgu_always_unifies[of t _ t'] mgu_gives_MGU[of t t']\n by auto\nnext\n case (Inequality X F)\n thus ?thesis\n using tfr\\<^sub>s\\<^sub>t\\<^sub>p.simps(2)[of X F]\n comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p.simps(2)[of \\ X F]\n Fun_range_case(2)[of \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F)\"] \n unfolding is_Var_def\n by auto\nqed auto\n\nlemma tfr\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>t:\n assumes \"comp_tfr\\<^sub>s\\<^sub>t arity Ana \\ M S\"\n shows \"tfr\\<^sub>s\\<^sub>t S\"\nunfolding tfr\\<^sub>s\\<^sub>t_def\nproof\n have comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_M: \"comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t arity Ana \\ M\"\n using assms unfolding comp_tfr\\<^sub>s\\<^sub>t_def by blast\n \n have wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_M: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\"\n and wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_S: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n and S_trms_instance_M: \"has_all_wt_instances_of \\ (trms\\<^sub>s\\<^sub>t S) (set M)\"\n using assms wf\\<^sub>t\\<^sub>r\\<^sub>m_code trms_list\\<^sub>s\\<^sub>t_is_trms\\<^sub>s\\<^sub>t\n unfolding comp_tfr\\<^sub>s\\<^sub>t_def comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_def finite_SMP_representation_def list_all_iff\n by blast+\n\n show \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\"\n using tfr_subset(3)[OF tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t[OF comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t_M] SMP_SMP_subset]\n SMP_I'[OF wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_S wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_M S_trms_instance_M]\n by blast\n\n have \"list_all (comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p \\) S\" by (metis assms comp_tfr\\<^sub>s\\<^sub>t_def)\n thus \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" by (induct S) (simp_all add: tfr\\<^sub>s\\<^sub>t\\<^sub>p_is_comp_tfr\\<^sub>s\\<^sub>t\\<^sub>p)\nqed\n\nlemma tfr\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>t':\n assumes \"comp_tfr\\<^sub>s\\<^sub>t arity Ana \\ (SMP0 Ana \\ (trms_list\\<^sub>s\\<^sub>t S)) S\"\n shows \"tfr\\<^sub>s\\<^sub>t S\"\nby (rule tfr\\<^sub>s\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>t[OF assms])\n\n\n\nsubsubsection \\Lemmata for Checking Ground SMP (GSMP) Disjointness\\\ncontext\nbegin\nprivate lemma ground_SMP_disjointI_aux1:\n fixes M::\"('fun, ('fun, 'atom) term \\ nat) term set\"\n assumes f_def: \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and g_def: \"g \\ \\M. {t \\ M. fv t = {}}\"\n shows \"f (SMP M) = g (SMP M)\"\nproof\n have \"t \\ f (SMP M)\" when t: \"t \\ SMP M\" \"fv t = {}\" for t\n proof -\n define \\ where \"\\ \\ Var::('fun, ('fun, 'atom) term \\ nat) subst\"\n have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\" \"t = t \\ \\\"\n using subst_apply_term_empty[of t] that(2) wt_subst_Var wf_trm_subst_range_Var\n unfolding \\_def by auto\n thus ?thesis using SMP.Substitution[OF t(1), of \\] t(2) unfolding f_def by fastforce\n qed\n thus \"g (SMP M) \\ f (SMP M)\" unfolding g_def by blast\nqed (use f_def g_def in blast)\n\nprivate lemma ground_SMP_disjointI_aux2:\n fixes M::\"('fun, ('fun, 'atom) term \\ nat) term list\"\n assumes f_def: \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and M_SMP_repr: \"finite_SMP_representation arity Ana \\ M\"\n shows \"f (set M) = f (SMP (set M))\"\nproof\n have M_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set M)\" \n and M_var_inst_cl: \"is_TComp_var_instance_closed \\ M\"\n and M_subterms_cl: \"has_all_wt_instances_of \\ (subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)) (set M)\"\n and M_Ana_cl: \"has_all_wt_instances_of \\ (\\((set \\ fst \\ Ana) ` set M)) (set M)\"\n using finite_SMP_representationD[OF M_SMP_repr] by blast+\n\n show \"f (SMP (set M)) \\ f (set M)\"\n proof\n fix t assume \"t \\ f (SMP (set M))\"\n then obtain s \\ where s: \"t = s \\ \\\" \"s \\ SMP (set M)\" \"fv (s \\ \\) = {}\"\n and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n unfolding f_def by blast\n\n have t_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using SMP_wf_trm[OF s(2) M_wf] s(1) wf_trm_subst[OF \\(2)] by blast \n\n obtain m \\ where m: \"m \\ set M\" \"s = m \\ \\\" and \\: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using SMP_D''[OF s(2) M_SMP_repr] by blast\n\n have \"t = m \\ (\\ \\\\<^sub>s \\)\" \"fv (m \\ (\\ \\\\<^sub>s \\)) = {}\" using s(1,3) m(2) by simp_all\n thus \"t \\ f (set M)\"\n using m(1) wt_subst_compose[OF \\(1) \\(1)] wf_trms_subst_compose[OF \\(2) \\(2)]\n unfolding f_def by blast\n qed\nqed (auto simp add: f_def)\n\nprivate lemma ground_SMP_disjointI_aux3:\n fixes A B C::\"('fun, ('fun, 'atom) term \\ nat) term set\"\n defines \"P \\ \\t s. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ Unifier \\ t s\"\n assumes f_def: \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and Q_def: \"Q \\ \\t. intruder_synth' public arity {} t\"\n and R_def: \"R \\ \\t. \\u \\ C. is_wt_instance_of_cond \\ t u\"\n and AB: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s A\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s B\" \"fv\\<^sub>s\\<^sub>e\\<^sub>t A \\ fv\\<^sub>s\\<^sub>e\\<^sub>t B = {}\"\n and C: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s C\"\n and ABC: \"\\t \\ A. \\s \\ B. P t s \\ (Q t \\ Q s) \\ (R t \\ R s)\"\n shows \"f A \\ f B \\ f C \\ {m. {} \\\\<^sub>c m}\"\nproof\n fix t assume \"t \\ f A \\ f B\"\n then obtain ta tb \\a \\b where\n ta: \"t = ta \\ \\a\" \"ta \\ A\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\a)\" \"fv (ta \\ \\a) = {}\"\n and tb: \"t = tb \\ \\b\" \"tb \\ B\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\b\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\b)\" \"fv (tb \\ \\b) = {}\"\n unfolding f_def by blast\n\n have ta_tb_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m ta\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m tb\" \"fv ta \\ fv tb = {}\" \"\\ ta = \\ tb\"\n using ta(1,2) tb(1,2) AB fv_subset_subterms\n wt_subst_trm''[OF ta(3), of ta] wt_subst_trm''[OF tb(3), of tb]\n by (fast, fast, blast, simp)\n\n obtain \\ where \\: \"Unifier \\ ta tb\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\)\"\n using vars_term_disjoint_imp_unifier[OF ta_tb_wf(3), of \\a \\b]\n ta(1) tb(1) wt_Unifier_if_Unifier[OF ta_tb_wf(1,2,4)]\n by blast\n hence \"(Q ta \\ Q tb) \\ (R ta \\ R tb)\" using ABC ta(2) tb(2) unfolding P_def by blast+\n thus \"t \\ f C \\ {m. {} \\\\<^sub>c m}\"\n proof\n show \"Q ta \\ Q tb \\ ?thesis\"\n using ta(1) pgwt_ground[of ta] pgwt_is_empty_synth[of ta] subst_ground_ident[of ta \\a]\n unfolding Q_def f_def intruder_synth_code[symmetric] by simp\n next\n assume \"R ta \\ R tb\"\n then obtain ua \\a where ua: \"ta = ua \\ \\a\" \"ua \\ C\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\a)\"\n using \\ ABC ta_tb_wf(1,2) ta(2) tb(2) C is_wt_instance_of_condD'\n unfolding P_def R_def by metis\n \n have \"t = ua \\ (\\a \\\\<^sub>s \\a)\" \"fv t = {}\"\n using ua(1) ta(1,5) tb(1,5) by auto\n thus ?thesis\n using ua(2) wt_subst_compose[OF ua(3) ta(3)] wf_trms_subst_compose[OF ua(4) ta(4)]\n unfolding f_def by blast\n qed\nqed\n\nlemma ground_SMP_disjointI:\n fixes A B::\"('fun, ('fun, 'atom) term \\ nat) term list\" and C\n defines \"f \\ \\M. {t \\ \\ | t \\. t \\ M \\ wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ fv (t \\ \\) = {}}\"\n and \"g \\ \\M. {t \\ M. fv t = {}}\"\n and \"Q \\ \\t. intruder_synth' public arity {} t\"\n and \"R \\ \\t. \\u \\ C. is_wt_instance_of_cond \\ t u\"\n assumes AB_fv_disj: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set A) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (set B) = {}\"\n and A_SMP_repr: \"finite_SMP_representation arity Ana \\ A\"\n and B_SMP_repr: \"finite_SMP_representation arity Ana \\ B\"\n and C_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s C\"\n and ABC: \"\\t \\ set A. \\s \\ set B. \\ t = \\ s \\ mgu t s \\ None \\ (Q t \\ Q s) \\ (R t \\ R s)\"\n shows \"g (SMP (set A)) \\ g (SMP (set B)) \\ f C \\ {m. {} \\\\<^sub>c m}\"\nproof -\n have AB_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set A)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (set B)\"\n using A_SMP_repr B_SMP_repr\n unfolding finite_SMP_representation_def wf\\<^sub>t\\<^sub>r\\<^sub>m_code list_all_iff\n by blast+\n\n let ?P = \"\\t s. \\\\. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\ \\ wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\) \\ Unifier \\ t s\"\n have ABC': \"\\t \\ set A. \\s \\ set B. ?P t s \\ (Q t \\ Q s) \\ (R t \\ R s)\"\n by (metis (no_types) ABC mgu_None_is_subst_neq wt_subst_trm'')\n\n show ?thesis\n using ground_SMP_disjointI_aux1[OF f_def g_def, of \"set A\"]\n ground_SMP_disjointI_aux1[OF f_def g_def, of \"set B\"]\n ground_SMP_disjointI_aux2[OF f_def A_SMP_repr]\n ground_SMP_disjointI_aux2[OF f_def B_SMP_repr]\n ground_SMP_disjointI_aux3[OF f_def Q_def R_def AB_wf AB_fv_disj C_wf ABC']\n by argo\nqed\n\nend\n\nend\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Stateful_Protocol_Composition_and_Typing", "sha": "34755583e50bc8a2e3eb0f91350c0b8510422a16", "save_path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing", "path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing/Stateful_Protocol_Composition_and_Typing-34755583e50bc8a2e3eb0f91350c0b8510422a16/Stateful_Protocol_Composition_and_Typing/Typed_Model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.542863297964157, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.25660251101133164}} {"text": "chapter \\Forward Analysis on DBMs\\\n\ntheory DBM_Operations\n imports DBM_Basics\nbegin\n\nsection \\Auxiliary\\\n\nlemmas [trans] = finite_subset\n\nlemma finite_vimageI2: \"finite (h -` F)\" if \"finite F\" \"inj_on h {x. h x \\ F}\"\nproof -\n have \"h -` F = h -` F \\ {x. h x \\ F}\"\n by auto\n from that show ?thesis\n by(subst \\h -` F = _\\) (rule finite_vimage_IntI[of F h \"{x. h x \\ F}\"])\nqed\n\nlemma gt_swap:\n fixes a b c :: \"'t :: time\"\n assumes \"c < a + b\"\n shows \"c < b + a\"\nby (simp add: add.commute assms)\n\nlemma le_swap:\n fixes a b c :: \"'t :: time\"\n assumes \"c \\ a + b\"\n shows \"c \\ b + a\"\nby (simp add: add.commute assms)\n\nabbreviation clock_numbering :: \"('c \\ nat) \\ bool\"\nwhere\n \"clock_numbering v \\ \\ c. v c > 0\"\n\nlemma DBM_triv:\n \"u \\\\<^bsub>v,n\\<^esub> \\i j. \\\"\n unfolding DBM_val_bounded_def by (auto simp: dbm_le_def)\n\nsection \\Time Lapse\\\n\ndefinition\n up :: \"('t::linordered_cancel_ab_semigroup_add) DBM \\ 't DBM\"\nwhere\n \"up M \\\n \\ i j. if i > 0 then if j = 0 then \\ else min (dbm_add (M i 0) (M 0 j)) (M i j) else M i j\"\n\nlemma dbm_entry_dbm_lt:\n assumes \"dbm_entry_val u (Some c1) (Some c2) a\" \"a \\ b\"\n shows \"dbm_entry_val u (Some c1) (Some c2) b\"\nusing assms\nproof (cases, auto, goal_cases)\n case 1 thus ?case by (cases, auto)\nnext\n case 2 thus ?case by (cases, auto)\nqed\n\nlemma dbm_entry_dbm_min2:\n assumes \"dbm_entry_val u None (Some c) (min a b)\"\n shows \"dbm_entry_val u None (Some c) b\"\nusing dbm_entry_val_mono_2[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min3:\n assumes \"dbm_entry_val u (Some c) None (min a b)\"\n shows \"dbm_entry_val u (Some c) None b\"\nusing dbm_entry_val_mono_3[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min:\n assumes \"dbm_entry_val u (Some c1) (Some c2) (min a b)\"\n shows \"dbm_entry_val u (Some c1) (Some c2) b\"\nusing dbm_entry_val_mono_1[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min3':\n assumes \"dbm_entry_val u (Some c) None (min a b)\"\n shows \"dbm_entry_val u (Some c) None a\"\nusing dbm_entry_val_mono_3[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min2':\n assumes \"dbm_entry_val u None (Some c) (min a b)\"\n shows \"dbm_entry_val u None (Some c) a\"\nusing dbm_entry_val_mono_2[folded less_eq, OF assms] by auto\n\nlemma dbm_entry_dbm_min':\n assumes \"dbm_entry_val u (Some c1) (Some c2) (min a b)\"\n shows \"dbm_entry_val u (Some c1) (Some c2) a\"\nusing dbm_entry_val_mono_1[folded less_eq, OF assms] by auto\n\nlemma DBM_up_complete': \"clock_numbering v \\ u \\ ([M]\\<^bsub>v,n\\<^esub>)\\<^sup>\\ \\ u \\ [up M]\\<^bsub>v,n\\<^esub>\"\nunfolding up_def DBM_zone_repr_def DBM_val_bounded_def zone_delay_def\nproof (safe, goal_cases)\n case prems: (2 u d c)\n hence *: \"dbm_entry_val u None (Some c) (M 0 (v c))\" by auto\n thus ?case\n proof (cases, goal_cases)\n case (1 d')\n have \"- (u c + d) \\ - u c\" using \\d \\ 0\\ by simp\n with 1(2) have \"- (u c + d)\\ d'\" by (blast intro: order.trans)\n thus ?case unfolding cval_add_def using 1 by fastforce\n next\n case (2 d')\n have \"- (u c + d) \\ - u c\" using \\d \\ 0\\ by simp\n with 2(2) have \"- (u c + d) < d'\" by (blast intro: order_le_less_trans)\n thus ?case unfolding cval_add_def using 2 by fastforce\n qed auto\nnext\n case prems: (4 u d c1 c2)\n then have\n \"dbm_entry_val u (Some c1) None (M (v c1) 0)\" \"dbm_entry_val u None (Some c2) (M 0 (v c2))\"\n by auto\n from dbm_entry_val_add_4[OF this] prems have\n \"dbm_entry_val u (Some c1) (Some c2) (min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2)))\"\n by (auto split: split_min)\n with prems(1) show ?case\n by (cases \"min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2))\", auto simp: cval_add_def)\nqed auto\n\nfun theLe :: \"('t::time) DBMEntry \\ 't\" where\n \"theLe (Le d) = d\" |\n \"theLe (Lt d) = d\" |\n \"theLe \\ = 0\"\n\nlemma DBM_up_sound':\n assumes \"clock_numbering' v n\" \"u \\ [up M]\\<^bsub>v,n\\<^esub>\"\n shows \"u \\ ([M]\\<^bsub>v,n\\<^esub>)\\<^sup>\\\"\nunfolding DBM_zone_repr_def zone_delay_def using assms\nproof (clarsimp, goal_cases)\n case A: 1\n obtain S_Max_Le where S_Max_Le:\n \"S_Max_Le = {d - u c | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d}\"\n by auto\n obtain S_Max_Lt where S_Max_Lt:\n \"S_Max_Lt = {d - u c | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d}\"\n by auto\n obtain S_Min_Le where S_Min_Le:\n \"S_Min_Le = {- d - u c| c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d}\"\n by auto\n obtain S_Min_Lt where S_Min_Lt:\n \"S_Min_Lt = {- d - u c | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d}\"\n by auto\n have \"finite {c. 0 < v c \\ v c \\ n}\" (is \"finite ?S\")\n proof -\n have \"?S \\ v -` {1..n}\"\n by auto\n also have \"finite \\\"\n using assms(1) by (auto intro!: finite_vimageI2 inj_onI)\n finally show ?thesis .\n qed\n then have \"\\ f. finite {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\" by auto\n moreover have\n \"\\ f K. {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n \\ {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\"\n by auto\n ultimately have 1:\n \"\\ f K. finite {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" using finite_subset\n by fast\n have \"\\ f K. theLe o K = id \\ finite {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (safe, goal_cases)\n case prems: (1 f K)\n then have\n \"{(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n = (\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 a b)\n then have \"(a, K b) \\ {(c, K d) |c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" by auto\n moreover from 1(1) have \"theLe (K b) = b\" by (simp add: pointfree_idE)\n ultimately show ?case by force\n qed\n moreover from 1 have\n \"finite ((\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n ultimately show ?case by auto\n qed\n then have finI:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n\n have\n \"finite ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d})\"\n by (rule finI, auto)\n moreover have\n \"S_Min_Le = ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Le d})\"\n using S_Min_Le by auto\n ultimately have fin_min_le: \"finite S_Min_Le\" by auto\n\n have\n \"finite ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d})\"\n by (rule finI, auto)\n moreover have\n \"S_Min_Lt = ((\\(c,d). - d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M 0 (v c) = Lt d})\"\n using S_Min_Lt by auto\n ultimately have fin_min_lt: \"finite S_Min_Lt\" by auto\n\n have \"finite ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d})\"\n by (rule finI, auto)\n moreover have\n \"S_Max_Le = ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Le d})\"\n using S_Max_Le by auto\n ultimately have fin_max_le: \"finite S_Max_Le\" by auto\n\n have\n \"finite ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d})\"\n by (rule finI, auto)\n moreover have\n \"S_Max_Lt = ((\\(c,d). d - u c) ` {(c,d) | c d. 0 < v c \\ v c \\ n \\ M (v c) 0 = Lt d})\"\n using S_Max_Lt by auto\n ultimately have fin_max_lt: \"finite S_Max_Lt\" by auto\n\n { fix x assume \"x \\ S_Min_Le\"\n hence \"x \\ 0\" unfolding S_Min_Le\n proof (safe, goal_cases)\n case (1 c d)\n with A(1) have \"- u c \\ d\" unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n thus ?case by (simp add: minus_le_iff)\n qed\n } note Min_Le_le_0 = this\n have Min_Lt_le_0: \"x < 0\" if \"x \\ S_Min_Lt\" for x using that unfolding S_Min_Lt\n proof (safe, goal_cases)\n case (1 c d)\n with A(1) have \"- u c < d\" unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n thus ?case by (simp add: minus_less_iff)\n qed\n text \\\n The following basically all use the same proof.\n Only the first is not completely identical but nearly identical.\n\\\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n with S_Min_Le S_Max_Le have \"l \\ r\"\n proof (safe, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c \\ d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) \\ d'\" by (simp add: add_diff_eq diff_le_eq)\n hence \"- u c - d \\ d' - u c'\" by (simp add: add.commute le_diff_eq)\n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n with S_Min_Le S_Max_Le have \"l \\ r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c \\ d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) \\ d'\" by (simp add: add_diff_eq diff_le_eq)\n hence \"- u c - d \\ d' - u c'\" by (simp add: add.commute le_diff_eq)\n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Le\"\n with S_Min_Lt S_Max_Le have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq)\n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note LE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Lt\"\n with S_Min_Le S_Max_Lt have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq)\n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note EL = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Lt\"\n with S_Min_Lt S_Max_Lt have \"l < r\"\n proof (auto, goal_cases)\n case (1 c c' d d')\n note G1 = this\n hence *:\"(up M) (v c') (v c) = min (dbm_add (M (v c') 0) (M 0 (v c))) (M (v c') (v c))\"\n using A unfolding up_def by (auto split: split_min)\n have \"dbm_entry_val u (Some c') (Some c) ((up M) (v c') (v c))\"\n using A G1 unfolding DBM_zone_repr_def DBM_val_bounded_def by fastforce\n hence \"dbm_entry_val u (Some c') (Some c) (dbm_add (M (v c') 0) (M 0 (v c)))\"\n using dbm_entry_dbm_min' * by auto\n hence \"u c' - u c < d' + d\" using G1 by auto\n hence \"u c' + (- u c - d) < d'\" by (simp add: add_diff_eq diff_less_eq)\n hence \"- u c - d < d' - u c'\" by (simp add: add.commute less_diff_eq)\n thus ?case by (metis add_uminus_conv_diff uminus_add_conv_diff)\n qed\n } note LL = this\n obtain m where m: \"\\ t \\ S_Min_Le. m \\ t\" \"\\ t \\ S_Min_Lt. m > t\"\n \"\\ t \\ S_Max_Le. m \\ t\" \"\\ t \\ S_Max_Lt. m < t\" \"m \\ 0\"\n proof -\n assume m:\"(\\m. \\t\\S_Min_Le. t \\ m \\\n \\t\\S_Min_Lt. t < m \\ \\t\\S_Max_Le. m \\ t \\ \\t\\S_Max_Lt. m < t \\ m \\ 0 \\ thesis)\"\n let ?min_le = \"Max S_Min_Le\"\n let ?min_lt = \"Max S_Min_Lt\"\n let ?max_le = \"Min S_Max_Le\"\n let ?max_lt = \"Min S_Max_Lt\"\n show thesis\n proof (cases \"S_Min_Le = {} \\ S_Min_Lt = {}\")\n case True\n note T = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True T by (intro m[of ?d']) auto\n next\n case False\n let ?d =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n obtain a :: \"'b\" where a: \"a < 0\" using non_trivial_neg by auto\n let ?d' = \"min 0 (?d + a)\"\n { fix x assume \"x \\ S_Max_Le\"\n with fin_max_le a have \"min 0 (Min S_Max_Le + a) \\ x\"\n by (metis Min_le add_le_same_cancel1 le_less_trans less_imp_le min.cobounded2 not_less)\n then have \"min 0 (Min S_Max_Le + a) \\ x\" by auto\n } note 1 = this\n { fix x assume x: \"x \\ S_Max_Lt\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < ?max_lt\"\n by (meson a add_less_same_cancel1 min.cobounded1 min.strict_coboundedI2 order.strict_trans2)\n also from fin_max_lt x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < x\" .\n } note 2 = this\n { fix x assume x: \"x \\ S_Max_Le\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ ?max_le\"\n by (metis le_add_same_cancel1 linear not_le a min_le_iff_disj)\n also from fin_max_le x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ x\" .\n } note 3 = this\n show thesis using False T a 1 2 3\n proof ((intro m[of ?d']), auto, goal_cases)\n case 1 then show ?case\n by (metis Min.coboundedI add_less_same_cancel1 dual_order.strict_trans2 fin_max_lt\n min.boundedE not_le)\n qed\n qed\n next\n case False\n note F = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True Min_Le_le_0 Min_Lt_le_0 by (intro m[of ?d']) auto\n next\n case False\n let ?r =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n\n have 1: \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" if \"x \\ S_Min_Le\" for x\n using that fin_min_le by (simp add: max.coboundedI2)+\n\n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LE[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt \\ x\" by auto\n } note 3 = this\n\n have 4: \"?min_le \\ x\" if \"x \\ S_Max_Le\" \"y \\ S_Min_Le\" for x y\n using EE[OF Max_in[OF fin_min_le], OF _ that(1)] that by auto\n\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LL[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt < x\" by auto\n } note 5 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from EL[OF Max_in[OF fin_min_le], OF this, OF x(1)] have \"?min_le < x\" by auto\n } note 6 = this\n {\n fix x y assume x: \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from Min_Le_le_0[OF Max_in[OF fin_min_le], OF this] have \"?min_le \\ 0\" by auto\n } note 7 = this\n {\n fix x y assume x: \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from Min_Lt_le_0[OF Max_in[OF fin_min_lt], OF this] have \"?min_lt < 0\" \"?min_lt \\ 0\" by auto\n } note 8 = this\n show thesis\n proof (cases \"?l < ?r\")\n case False\n then have *: \"S_Max_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n with \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ obtain y where y:\"y \\ S_Max_Lt\" by auto\n note 1 = 1 this\n { fix x y assume A: \"x \\ S_Min_Le\" \"y \\ S_Max_Lt\"\n with EL[OF Max_in[OF fin_min_le] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Le < Min S_Max_Lt\" by auto\n } note ** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n show ?case\n proof (cases \"S_Min_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Min_Lt \\ {}\")\n case True\n then show False using 1 T True ** *** by auto\n next\n case False with 1 T ** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Min_Le = {} \\ S_Min_Lt = {})\\ show ?thesis by auto\n qed\n qed\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Le\"\n with LE[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_le]]\n have \"Max S_Min_Lt < Min S_Max_Le\" by auto\n } note **** = this\n from F False have **: \"S_Min_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n show ?case\n proof (cases \"S_Max_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Max_Lt \\ {}\")\n case True\n then show False using 1 T True **** *** by auto\n next\n case False with 1 T **** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ show ?thesis by auto\n qed\n qed\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI2)\n also have \"?min_lt < ?min_le\"\n proof (rule ccontr, goal_cases)\n case 1\n with x ** have 1: \"?l = ?min_lt\" by (auto simp: max.absorb1)\n have 2: \"?min_lt < ?max_le\" using * ****[OF x] by auto\n show False\n proof (cases \"S_Max_Lt = {}\")\n case False\n then have \"?min_lt < ?max_lt\" using * ***[OF x] by auto\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n next\n case True\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n qed\n qed\n finally have \"x < max ?min_lt ?min_le\" by (simp add: max.strict_coboundedI2)\n } note 2 = this\n show thesis using F False 1 2 3 4 5 6 7 8 * ** by ((intro m[of ?l]), auto)\n next\n case True\n then obtain d where d: \"?l < d\" \"d < ?r\" using dense by auto\n let ?d' = \"min 0 d\"\n {\n fix t assume \"t \\ S_Min_Le\"\n then have \"t \\ ?l\" using 1 by auto\n with d have \"t \\ d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Min_Lt\"\n then have \"t \\ max ?min_lt ?min_le\" using fin_min_lt by (simp add: max.coboundedI1)\n with t Min_Lt_le_0 have \"t \\ ?l\" using fin_min_lt by auto\n with d have \"t < d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Le\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_le by (simp add: min.coboundedI2)\n then have \"?r \\ t\" using fin_max_le t by auto\n with d have \"d \\ t\" by auto\n then have \"min 0 d \\ t\" by (simp add: min.coboundedI2)\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Lt\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_lt by (simp add: min.coboundedI1)\n then have \"?r \\ t\" using fin_max_lt t by auto\n with d have \"d < t\" by auto\n then have \"min 0 d < t\" by (simp add: min.strict_coboundedI2)\n }\n ultimately show thesis using Min_Le_le_0 Min_Lt_le_0 by ((intro m[of ?d']), auto)\n qed\n qed\n qed\n qed\n obtain u' where \"u' = (u \\ m)\" by blast\n hence u': \"u = (u' \\ (-m))\" unfolding cval_add_def by force\n have \"DBM_val_bounded v u' M n\" unfolding DBM_val_bounded_def\n proof (auto, goal_cases)\n case 1 with A(1,2) show ?case unfolding DBM_zone_repr_def DBM_val_bounded_def up_def by auto\n next\n case (3 c)\n thus ?case\n proof (cases \"M (v c) 0\", goal_cases)\n case (1 x1)\n hence \"m \\ x1 - u c\" using m(3) S_Max_Le A(2) by blast\n hence \"u c + m \\ x1\" by (simp add: add.commute le_diff_eq)\n thus ?case using u' 1(2) unfolding cval_add_def by auto\n next\n case (2 x2)\n hence \"m < x2 - u c\" using m(4) S_Max_Lt A(2) by blast\n hence \"u c + m < x2\" by (metis add_less_cancel_left diff_add_cancel gt_swap)\n thus ?case using u' 2(2) unfolding cval_add_def by auto\n next\n case 3 thus ?case by auto\n qed\n next\n case (2 c) thus ?case\n proof (cases \"M 0 (v c)\", goal_cases)\n case (1 x1)\n hence \"- x1 - u c \\ m\" using m(1) S_Min_Le A(2) by blast\n hence \"- u c - m \\ x1\" using diff_le_eq neg_le_iff_le by fastforce\n thus ?case using u' 1(2) unfolding cval_add_def by auto\n next\n case (2 x2)\n hence \"- x2 - u c < m\" using m(2) S_Min_Lt A(2) by blast\n hence \"- u c - m < x2\" using diff_less_eq neg_less_iff_less by fastforce\n thus ?case using u' 2(2) unfolding cval_add_def by auto\n next\n case 3 thus ?case by auto\n qed\n next\n case (4 c1 c2)\n from A(2) have \"v c1 > 0\" \"v c2 \\ 0\" by auto\n then have B: \"(up M) (v c1) (v c2) = min (dbm_add (M (v c1) 0) (M 0 (v c2))) (M (v c1) (v c2))\"\n unfolding up_def by simp\n\n show ?case\n proof (cases \"(dbm_add (M (v c1) 0) (M 0 (v c2))) < (M (v c1) (v c2))\")\n case False\n with B have \"(up M) (v c1) (v c2) = M (v c1) (v c2)\" by (auto split: split_min)\n with A(1) 4 have\n \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding DBM_zone_repr_def unfolding DBM_val_bounded_def by fastforce\n thus ?thesis using u' by cases (auto simp add: cval_add_def)\n next\n case True\n with B have \"(up M) (v c1) (v c2) = dbm_add (M (v c1) 0) (M 0 (v c2))\" by (auto split: split_min)\n with A(1) 4 have\n \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) 0) (M 0 (v c2)))\"\n unfolding DBM_zone_repr_def unfolding DBM_val_bounded_def by fastforce\n with True dbm_entry_dbm_lt have\n \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding less by fast\n thus ?thesis using u' by cases (auto simp add: cval_add_def)\n qed\n qed\n with m(5) u' show ?case by fastforce\nqed\n\n\nsection \\Zone Intersection\\\n\nfun And :: \"('t :: {linordered_cancel_ab_monoid_add}) DBM \\ 't DBM \\ 't DBM\" where\n \"And M1 M2 = (\\ i j. min (M1 i j) (M2 i j))\"\n\nlemma DBM_and_complete:\n assumes \"DBM_val_bounded v u M1 n\" \"DBM_val_bounded v u M2 n\"\n shows \"DBM_val_bounded v u (And M1 M2) n\"\n using assms unfolding DBM_val_bounded_def by (auto simp: min_def)\n\nlemma DBM_and_sound1:\n assumes \"DBM_val_bounded v u (And M1 M2) n\"\n shows \"DBM_val_bounded v u M1 n\"\n using assms unfolding DBM_val_bounded_def\n apply safe\n apply (simp add: less_eq[symmetric]; fail)\n apply (auto 4 3 intro: dbm_entry_val_mono[folded less_eq])\n done\n\nlemma DBM_and_sound2:\n assumes \"DBM_val_bounded v u (And M1 M2) n\"\n shows \"DBM_val_bounded v u M2 n\"\n using assms unfolding DBM_val_bounded_def\n apply safe\n apply (simp add: less_eq[symmetric]; fail)\n apply (auto 4 3 intro: dbm_entry_val_mono[folded less_eq])\n done\n\nlemma And_correct:\n \"[M1]\\<^bsub>v,n\\<^esub> \\ [M2]\\<^bsub>v,n\\<^esub> = [And M1 M2]\\<^bsub>v,n\\<^esub>\"\n using DBM_and_sound1 DBM_and_sound2 DBM_and_complete unfolding DBM_zone_repr_def by blast\n\n\nsection \\Clock Reset\\\n\ndefinition\n DBM_reset :: \"('t :: time) DBM \\ nat \\ nat \\ 't \\ 't DBM \\ bool\"\nwhere\n \"DBM_reset M n k d M' \\\n (\\ j \\ n. 0 < j \\ k \\ j\\ M' k j = \\ \\ M' j k = \\) \\ M' k 0 = Le d \\ M' 0 k = Le (- d)\n \\ M' k k = M k k\n \\ (\\i \\ n. \\j \\ n.\n i \\ k \\ j \\ k \\ M' i j = min (dbm_add (M i k) (M k j)) (M i j))\"\n\n\nlemma DBM_reset_mono:\n assumes \"DBM_reset M n k d M'\" \"i \\ n\" \"j \\ n\" \"i \\ k\" \"j \\ k\"\n shows \"M' i j \\ M i j\"\nusing assms unfolding DBM_reset_def by auto\n\nlemma DBM_reset_len_mono:\n assumes \"DBM_reset M n k d M'\" \"k \\ set xs\" \"i \\ k\" \"j \\ k\" \"set (i # j # xs) \\ {0..n}\"\n shows \"len M' i j xs \\ len M i j xs\"\nusing assms by (induction xs arbitrary: i) (auto intro: add_mono DBM_reset_mono)\n\nlemma DBM_reset_neg_cycle_preservation:\n assumes \"DBM_reset M n k d M'\" \"len M i i xs < Le 0\" \"set (k # i # xs) \\ {0..n}\"\n shows \"\\ j. \\ ys. set (j # ys) \\ {0..n} \\ len M' j j ys < Le 0\"\nproof (cases \"xs = []\")\n case Nil: True\n show ?thesis\n proof (cases \"k = i\")\n case True\n with Nil assms have \"len M' i i [] < Le 0\" unfolding DBM_reset_def by auto\n moreover from assms have \"set (i # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n next\n case False\n with Nil assms DBM_reset_mono have \"len M' i i [] < Le 0\" by fastforce\n moreover from assms have \"set (i # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n qed\nnext\n case False\n with assms obtain j ys where cycle:\n \"len M j j ys < Le 0\" \"distinct (j # ys)\" \"j \\ set (i # xs)\" \"set ys \\ set xs\"\n by (metis negative_len_shortest neutral)\n show ?thesis\n proof (cases \"k \\ set (j # ys)\")\n case False\n with cycle assms have \"len M' j j ys \\ len M j j ys\" by - (rule DBM_reset_len_mono, auto)\n moreover from cycle assms have \"set (j # ys) \\ {0..n}\" by auto\n ultimately show ?thesis using cycle(1) by fastforce\n next\n case True\n then obtain l where l: \"(l, k) \\ set (arcs j j ys)\"\n proof (cases \"j = k\", goal_cases)\n case True\n show ?thesis\n proof (cases \"ys = []\")\n case T: True\n with True show ?thesis by (auto intro: that)\n next\n case False\n then obtain z zs where \"ys = zs @ [z]\" by (metis append_butlast_last_id)\n from arcs_decomp[OF this] True show ?thesis by (auto intro: that)\n qed\n next\n case False\n from arcs_set_elem2[OF False True] show ?thesis by (blast intro: that)\n qed\n show ?thesis\n proof (cases \"ys = []\")\n case False\n from cycle_rotate_2'[OF False l, of M] cycle(1) obtain zs where rotated:\n \"len M l l (k # zs) < Le 0\" \"set (l # k # zs) = set (j # ys)\" \"1 + length zs = length ys\"\n by auto\n with length_eq_distinct[OF this(2)[symmetric] cycle(2)] have \"distinct (l # k # zs)\" by auto\n note rotated = rotated(1,2) this\n from this(2) cycle(3,4) assms(3) have n_bound: \"set (l # k # zs) \\ {0..n}\" by auto\n then have \"l \\ n\" by auto\n show ?thesis\n proof (cases zs)\n case Nil\n with rotated have \"M l k + M k l < Le 0\" \"l \\ k\" by auto\n with assms(1) \\l \\ n\\ have \"M' l l < Le 0\" unfolding DBM_reset_def add min_def by auto\n with \\l \\ n\\ have \"len M' l l [] < Le 0\" \"set [l] \\ {0..n}\" by auto\n then show ?thesis by blast\n next\n case (Cons w ws)\n with n_bound have *: \"set (w # l # ws) \\ {0..n}\" by auto\n from Cons n_bound rotated(3) have \"w \\ n\" \"w \\ k\" \"l \\ k\" by auto\n with assms(1) \\l \\ n\\ have\n \"M' l w \\ M l k + M k w\"\n unfolding DBM_reset_def add min_def by auto\n moreover from Cons rotated assms * have\n \"len M' w l ws \\ len M w l ws\"\n by - (rule DBM_reset_len_mono, auto)\n ultimately have\n \"len M' l l zs \\ len M l l (k # zs)\"\n using Cons by (auto intro: add_mono simp add: add.assoc[symmetric])\n with n_bound rotated(1) show ?thesis by fastforce\n qed\n next\n case T: True\n with True cycle have \"M j j < Le 0\" \"j = k\" by auto\n with assms(1) have \"len M' k k [] < Le 0\" unfolding DBM_reset_def by simp\n moreover from assms(3) have \"set (k # []) \\ {0..n}\" by auto\n ultimately show ?thesis by blast\n qed\n qed\nqed\n\ntext \\Implementation of DBM reset\\\n\ndefinition\n reset :: \"('t::{linordered_cancel_ab_semigroup_add,uminus}) DBM \\ nat \\ nat \\ 't \\ 't DBM\"\nwhere\n \"reset M n k d =\n (\\ i j.\n if i = k \\ j = 0 then Le d\n else if i = 0 \\ j = k then Le (-d)\n else if i = k \\ j \\ k then \\\n else if i \\ k \\ j = k then \\\n else if i = k \\ j = k then M k k\n else min (dbm_add (M i k) (M k j)) (M i j)\n )\"\n\nfun\n reset' ::\n \"('t::{linordered_cancel_ab_semigroup_add,uminus}) DBM\n \\ nat \\ 'c list \\ ('c \\ nat) \\ 't \\ 't DBM\"\nwhere\n \"reset' M n [] v d = M\" |\n \"reset' M n (c # cs) v d = reset (reset' M n cs v d) n (v c) d\"\n\nlemma DBM_reset_reset:\n \"0 < k \\ k \\ n \\ DBM_reset M n k d (reset M n k d)\"\nunfolding DBM_reset_def by (auto simp: reset_def)\n\nlemma DBM_reset_complete:\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M n\"\n shows \"DBM_val_bounded v (u(c := d)) M' n\"\nunfolding DBM_val_bounded_def using assms\nproof (auto, goal_cases)\n case 1\n then have *: \"M 0 0 \\ Le 0\" unfolding DBM_val_bounded_def less_eq by auto\n from 1 have **: \"M' 0 0 = min (M 0 (v c) + M (v c) 0) (M 0 0)\"\n unfolding DBM_reset_def add by auto\n show ?case\n proof (cases \"M 0 (v c) + M (v c) 0 \\ M 0 0\")\n case False\n with * ** show ?thesis unfolding min_def less_eq by auto\n next\n case True\n have \"dbm_entry_val u (Some c) (Some c) (M (v c) 0 + M 0 (v c))\"\n by (metis DBM_val_bounded_def assms(2,4) dbm_entry_val_add_4 add)\n then have \"M (v c) 0 + M 0 (v c) \\ Le 0\"\n unfolding less_eq dbm_le_def by (cases \"M (v c) 0 + M 0 (v c)\") auto\n with True ** have \"M' 0 0 \\ Le 0\" by (simp add: comm)\n then show ?thesis unfolding less_eq .\n qed\nnext\n case (2 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n hence F:\"v c' \\ v c\" using 2 by metis\n hence *:\"M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c'))\"\n using F 2(1,2,4,6) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M 0 (v c)) (M (v c) (v c')) < M 0 (v c')\")\n case False\n with * have \"M' 0 (v c') = M 0 (v c')\" by (auto split: split_min)\n hence \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n using 2(3,6) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' 0 (v c') = dbm_add (M 0 (v c)) (M (v c) (v c'))\" by (auto split: split_min)\n from 2 have \"dbm_entry_val u None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u (Some c) (Some c') (M (v c) (v c'))\"\n unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"- u c' \\ d + d'\"\n by (metis diff_minus_eq_add less_diff_eq less_le_trans minus_diff_eq minus_le_iff not_le)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G1(3) have \"u c - u c' - u c < d + d'\" using add_le_less_mono by fastforce\n hence \"- u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G2(3) have \"u c - u c' - u c < d' + d\" using add_le_less_mono by fastforce\n hence \"- u c' < d' + d\" by simp\n hence \"- u c' < d + d'\"\n by (metis (hide_lams, no_types) diff_0_right diff_minus_eq_add minus_add_distrib minus_diff_eq)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G2(3) have \"u c - u c' - u c < d + d'\" using add_strict_mono by fastforce\n hence \"- u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with 2 show ?thesis unfolding DBM_reset_def by auto\n qed\nnext\n case (3 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n hence F:\"v c' \\ v c\" using 3 by metis\n hence *:\"M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0)\"\n using F 3(1,2,4,6) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M (v c') (v c)) (M (v c) 0) < M (v c') 0\")\n case False\n with * have \"M' (v c') 0 = M (v c') 0\" by (auto split: split_min)\n hence \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n using 3(3,6) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' (v c') 0 = dbm_add (M (v c') (v c)) (M (v c) 0)\" by (auto split: split_min)\n from 3 have \"dbm_entry_val u (Some c') (Some c) (M (v c') (v c))\"\n \"dbm_entry_val u (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"u c' \\ d + d'\" using ordered_ab_semigroup_add_class.add_mono\n by fastforce\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G1(3) have \"u c + u c' - u c < d + d'\" using add_le_less_mono by fastforce\n hence \"u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G2(3) have \"u c + u c' - u c < d' + d\" using add_le_less_mono by fastforce\n hence \"u c' < d' + d\" by simp\n hence \"u c' < d + d'\"\n by (metis (hide_lams, no_types) diff_0_right diff_minus_eq_add minus_add_distrib minus_diff_eq)\n thus ?case using 1 \\c \\ c'\\ by fastforce\n next\n case (2 d')\n from this(2) G2(3) have \"u c + u c' - u c < d + d'\" using add_strict_mono by fastforce\n hence \"u c' < d + d'\" by simp\n thus ?case using 2 \\c \\ c'\\ by fastforce\n next\n case 3 thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with 3 show ?thesis unfolding DBM_reset_def by auto\n qed\nnext\n case (4 c1 c2)\n show ?case\n proof (cases \"c = c1\")\n case False\n note F1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with F1 4 have F: \"v c \\ v c1\" \"v c \\ v c2\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n hence *:\"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using 4(1,2,6,7) unfolding DBM_reset_def by simp\n show ?thesis\n proof (cases \"dbm_add (M (v c1) (v c)) (M (v c) (v c2)) < M (v c1) (v c2)\")\n case False\n with * have \"M' (v c1) (v c2) = M (v c1) (v c2)\" by (auto split: split_min)\n hence \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n using 4(3,6,7) unfolding DBM_val_bounded_def by auto\n thus ?thesis using F by cases fastforce+\n next\n case True\n with * have **:\"M' (v c1) (v c2) = dbm_add (M (v c1) (v c)) (M (v c) (v c2))\" by (auto split: split_min)\n from 4 have \"dbm_entry_val u (Some c1) (Some c) (M (v c1) (v c))\"\n \"dbm_entry_val u (Some c) (Some c2) (M (v c) (v c2))\" unfolding DBM_val_bounded_def by auto\n thus ?thesis\n proof (cases, auto simp add: **, goal_cases)\n case (1 d)\n note G1 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n from this(2) G1(3) have \"u c1 - u c2 \\ d + d'\"\n by (metis (hide_lams, no_types) ab_semigroup_add_class.add_ac(1) add_le_cancel_right\n add_left_mono diff_add_cancel dual_order.refl dual_order.trans)\n thus ?case using 1 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (2 d')\n from add_less_le_mono[OF this(2) G1(3)] have \"- u c2 + u c1 < d' + d\" by simp\n hence \"u c1 - u c2 < d + d'\" by (simp add: add.commute)\n thus ?case using 2 \\c \\ c1\\ \\c \\ c2\\ by fastforce\n next\n case (3) thus ?case by auto\n qed\n next\n case (2 d)\n note G2 = this\n from this(2) show ?case\n proof (cases, goal_cases)\n case (1 d')\n with add_less_le_mono[OF G2(3) this(2)] \\c \\ c1\\ \\c \\ c2\\ show ?case\n by auto\n next\n case (2 d')\n with add_strict_mono[OF this(2) G2(3)] \\c \\ c1\\ \\c \\ c2\\ show ?case\n by (auto simp: add.commute)\n next\n case (3) thus ?case by auto\n qed\n qed\n qed\n next\n case True\n with F1 4 have F: \"v c \\ v c1\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n thus ?thesis using 4(1,2,4,6,7) True unfolding DBM_reset_def by auto\n qed\n next\n case True\n note T1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with T1 4 have F: \"v c \\ v c2\" \"v c1 \\ 0\" \"v c2 \\ 0\" by force+\n thus ?thesis using 4(1,2,7) True unfolding DBM_reset_def by auto\n next\n case True\n then have *: \"M' (v c1) (v c1) = M (v c1) (v c1)\"\n using T1 4 unfolding DBM_reset_def by auto\n from 4(1,3) True T1 have \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by auto\n then show ?thesis by (cases rule: dbm_entry_val.cases, auto simp: * True[symmetric] T1)\n qed\n qed\nqed\n\nlemma DBM_reset_sound_empty:\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\"\n \"\\ u . \\ DBM_val_bounded v u M' n\"\n shows \"\\ DBM_val_bounded v u M n\"\nusing assms DBM_reset_complete by metis\n\nlemma DBM_reset_diag_preservation:\n \"\\k\\n. M k k \\ 0 \\ DBM_reset M n i d M' \\ \\k\\n. M' k k \\ 0\"\n apply auto\n apply (case_tac \"k = i\")\n apply (simp add: DBM_reset_def less[symmetric])\n apply (case_tac \"k = 0\")\nby (auto simp add: DBM_reset_def less[symmetric] neutral split: split_min)\n\nlemma FW_diag_preservation:\n \"\\k\\n. M k k \\ 0 \\ \\k\\n. (FW M n) k k \\ 0\"\nproof clarify\n fix k assume A: \"\\k\\n. M k k \\ 0\" \"k \\ n\"\n then have \"M k k \\ 0\" by auto\n with fw_mono[of k n k M n] A show \"FW M n k k \\ 0\" by auto\nqed\n\nlemma DBM_reset_not_cyc_free_preservation:\n assumes \"\\ cyc_free M n\" \"DBM_reset M n k d M'\" \"k \\ n\"\n shows \"\\ cyc_free M' n\"\nproof -\n from assms(1) obtain i xs where \"i \\ n\" \"set xs \\ {0..n}\" \"len M i i xs < Le 0\"\n unfolding neutral by auto\n with DBM_reset_neg_cycle_preservation[OF assms(2) this(3)] assms(3) obtain j ys where\n \"set (j # ys) \\ {0..n}\" \"len M' j j ys < Le 0\"\n by auto\n then show ?thesis unfolding neutral by force\nqed\n\nlemma DBM_reset_complete_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\" \"k \\ n\"\n \"DBM_reset M n k d M'\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n from assms(5) have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n from empty_not_cyc_free[OF _ this] have \"\\ cyc_free M n\" using assms(2) by auto\n from DBM_reset_not_cyc_free_preservation[OF this assms(4,3)] have \"\\ cyc_free M' n\" by auto\n then obtain i xs where \"i \\ n\" \"set xs \\ {0..n}\" \"len M' i i xs < 0\" by auto\n from DBM_val_bounded_neg_cycle[OF _ this assms(1)] show ?thesis by fast\nqed\n\nlemma DBM_reset_complete_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\"\n \"DBM_reset (FW M n) n (v c) d M'\" \"\\ u . \\ DBM_val_bounded v u (FW M n) n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n note A = assms\n from A(4) have \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_detects_empty_zone[OF A(1), of M] A(2)\n obtain i where i: \"i \\ n\" \"FW M n i i < Le 0\" by blast\n with A(3,4) have \"M' i i < Le 0\"\n unfolding DBM_reset_def by (cases \"i = v c\", auto split: split_min)\n with fw_mono[of i n i M' n] i have \"FW M' n i i < Le 0\" by auto\n with FW_detects_empty_zone[OF A(1), of M'] A(2) i\n have \"[FW M' n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_zone_equiv[OF A(1)] show ?thesis by (auto simp: DBM_zone_repr_def)\nqed\n\nlemma DBM_reset_complete_empty1:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering v\"\n \"DBM_reset (FW M n) n (v c) d M'\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ DBM_val_bounded v u M' n\"\nproof -\n from assms have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_zone_equiv[OF assms(1)] have\n \"\\ u . \\ DBM_val_bounded v u (FW M n) n\"\n unfolding DBM_zone_repr_def by auto\n from DBM_reset_complete_empty[OF assms(1-3) this] show ?thesis by auto\nqed\n\ntext \\\n Lemma \\FW_canonical_id\\ allows us to prove correspondences between reset and canonical,\n like for the two below.\n Can be left out for the rest because of the triviality of the correspondence.\n\\\n\nlemma DBM_reset_empty'':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset M n (v c) d M'\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nproof\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M' n\"\n using DBM_reset_complete_empty'[OF assms(1) _ assms(3,4)] assms(2) by auto\n thus \"[M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n assume \"[M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M' n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M n\" using DBM_reset_sound_empty[OF assms(2-4)] by auto\n thus \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset (FW M n) n (v c) d M'\"\n shows \"[FW M n]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nproof\n assume A: \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u (FW M n) n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u M' n\"\n using DBM_reset_complete_empty[of n v M, OF assms(1) _ assms(4)] assms(2,3) by auto\n thus \"[M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n assume \"[M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M' n\" unfolding DBM_zone_repr_def by auto\n hence \"\\ u . \\ DBM_val_bounded v u (FW M n) n\" using DBM_reset_sound_empty[OF assms(2-)] by auto\n thus \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset_empty':\n assumes \"canonical M n\" \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"DBM_reset (FW M n) n (v c) d M'\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [M']\\<^bsub>v,n\\<^esub> = {}\"\nusing FW_canonical_id[OF assms(1)] DBM_reset_empty[OF assms(2-)] by simp\n\nlemma DBM_reset_sound':\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M' n\"\n \"DBM_val_bounded v u'' M n\"\n obtains d' where \"DBM_val_bounded v (u(c := d')) M n\"\nusing assms\nproof (auto, goal_cases)\n case 1\n note A = this\n obtain S_Min_Le where S_Min_Le:\n \"S_Min_Le = {u c' - d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = Le d}\n \\ {-d | d. M 0 (v c) = Le d}\" by auto\n obtain S_Min_Lt where S_Min_Lt:\n \"S_Min_Lt = {u c' - d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = Lt d}\n \\ {-d | d. M 0 (v c) = Lt d}\" by auto\n obtain S_Max_Le where S_Max_Le:\n \"S_Max_Le = {u c' + d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = Le d}\n \\ {d | d. M (v c) 0 = Le d}\" by auto\n obtain S_Max_Lt where S_Max_Lt:\n \"S_Max_Lt = {u c' + d | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = Lt d}\n \\ {d | d. M (v c) 0 = Lt d}\" by auto\n\n have \"finite {c. 0 < v c \\ v c \\ n}\" using A(6,7)\n proof (induction n)\n case 0\n then have \"{c. 0 < v c \\ v c \\ 0} = {}\" by auto\n then show ?case by (metis finite.emptyI)\n next\n case (Suc n)\n then have \"finite {c. 0 < v c \\ v c \\ n}\" by auto\n moreover have \"{c. 0 < v c \\ v c \\ Suc n} = {c. 0 < v c \\ v c \\ n} \\ {c. v c = Suc n}\" by auto\n moreover have \"finite {c. v c = Suc n}\"\n proof (cases \"{c. v c = Suc n} = {}\", auto)\n fix c assume \"v c = Suc n\"\n then have \"{c. v c = Suc n} = {c}\" using Suc.prems(2) by auto\n then show ?thesis by auto\n qed\n ultimately show ?case by auto\n qed\n then have \"\\ f. finite {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\" by auto\n moreover have\n \"\\ f K. {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n \\ {(c,b) | c b. 0 < v c \\ v c \\ n \\ f M (v c) = b}\"\n by auto\n ultimately have B:\n \"\\ f K. finite {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n using finite_subset by fast\n have \"\\ f K. theLe o K = id \\ finite {(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto, goal_cases)\n case (1 f K)\n then have\n \"{(c,d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\n = (\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 a b)\n then have \"(a, K b) \\ {(c, K d) |c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d}\" by auto\n moreover from 1(1) have \"theLe (K b) = b\" by (simp add: pointfree_idE)\n ultimately show ?case by force\n qed\n moreover from B have\n \"finite ((\\ (c,b). (c, theLe b)) ` {(c,K d) | c d. 0 < v c \\ v c \\ n \\ f M (v c) = K d})\"\n by auto\n ultimately show ?case by auto\n qed\n then have finI:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ f M (v c') = K d})\"\n by auto\n have finI1:\n \"\\ f g K. theLe o K = id \\ finite (g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ f M (v c') = K d})\"\n proof goal_cases\n case (1 f g K)\n have\n \"g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ f M (v c') = K d}\n \\ g ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ f M (v c') = K d}\"\n by auto\n from finite_subset[OF this finI[OF 1, of g f]] show ?case .\n qed\n have \"\\ f. finite {b. f M (v c) = b}\" by auto\n moreover have \"\\ f K. {K d | d. f M (v c) = K d} \\ {b. f M (v c) = b}\" by auto\n ultimately have B: \"\\ f K. finite {K d | d. f M (v c) = K d}\" using finite_subset by fast\n\n have \"\\ f K. theLe o K = id \\ finite {d | d. f M (v c) = K d}\"\n proof (auto, goal_cases)\n case (1 f K)\n then have \"{d | d. f M (v c) = K d} = theLe ` {K d | d. f M (v c) = K d}\"\n proof (auto simp add: pointfree_idE, goal_cases)\n case (1 x)\n have \"K x \\ {K d |d. K x = K d}\" by auto\n moreover from 1 have \"theLe (K x) = x\" by (simp add: pointfree_idE)\n ultimately show ?case by auto\n qed\n moreover from B have \"finite {K d |d. f M (v c) = K d}\" by auto\n ultimately show ?case by auto\n qed\n then have C: \"\\ f g K. theLe o K = id \\ finite (g ` {d | d. f M (v c) = K d})\" by auto\n have finI2: \"\\ f g K. theLe o K = id \\ finite ({g d | d. f M (v c) = K d})\"\n proof goal_cases\n case (1 f g K)\n have \"{g d |d. f M (v c) = K d} = g ` {d | d. f M (v c) = K d}\" by auto\n with C 1 show ?case by auto\n qed\n\n { fix K :: \"'b \\ 'b DBMEntry\" assume A: \"theLe o K = id\"\n then have\n \"finite ((\\(c,d). u c - d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d})\"\n by (intro finI1, auto)\n moreover have\n \"{u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\n = ((\\(c,d). u c - d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d})\"\n by auto\n ultimately have \"finite {u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\"\n by auto\n moreover have \"finite {- d |d. M 0 (v c) = K d}\" using A by (intro finI2, auto)\n ultimately have\n \"finite ({u c' - d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c') (v c) = K d}\n \\ {- d |d. M 0 (v c) = K d})\"\n by (auto simp: S_Min_Le)\n } note fin1 = this\n have fin_min_le: \"finite S_Min_Le\" unfolding S_Min_Le by (rule fin1, auto)\n have fin_min_lt: \"finite S_Min_Lt\" unfolding S_Min_Lt by (rule fin1, auto)\n\n { fix K :: \"'b \\ 'b DBMEntry\" assume A: \"theLe o K = id\"\n then have \"finite ((\\(c,d). u c + d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d})\"\n by (intro finI1, auto)\n moreover have\n \"{u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\n = ((\\(c,d). u c + d) ` {(c',d) | c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d})\"\n by auto\n ultimately have \"finite {u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\"\n by auto\n moreover have \"finite {d |d. M (v c) 0 = K d}\" using A by (intro finI2, auto)\n ultimately have\n \"finite ({u c' + d |c' d. 0 < v c' \\ v c' \\ n \\ c \\ c' \\ M (v c) (v c') = K d}\n \\ {d |d. M (v c) 0 = K d})\"\n by (auto simp: S_Min_Le)\n } note fin2 = this\n have fin_max_le: \"finite S_Max_Le\" unfolding S_Max_Le by (rule fin2, auto)\n have fin_max_lt: \"finite S_Max_Lt\" unfolding S_Max_Lt by (rule fin2, auto)\n\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Le\"\n then have \"l \\ r\"\n proof (auto simp: S_Min_Le S_Max_Le, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have\n \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have\n \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have\n \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by auto\n with 1 have \"u c1 - u c2 \\ d1 + d2\" by auto\n thus ?case\n by (metis (hide_lams, no_types) add_diff_cancel_left diff_0_right diff_add_cancel diff_eq_diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' \\ d + r\" by auto\n thus ?case by (metis add_diff_cancel_left add_le_cancel_right diff_0_right diff_add_cancel)\n next\n case (3 d c' d')\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' \\ d + d'\" by auto\n thus ?case\n by (metis add_uminus_conv_diff diff_le_eq minus_add_distrib minus_le_iff)\n next\n case (4 d)\n text \\\n Here is the reason we need the assumption that the zone was not empty before the reset.\n We cannot deduce anything from the current value of \\c\\ itself because we reset it.\n We can only ensure that we can reset the value of \\c\\ by using the value from the\n alternative assignment.\n This case is only relevant if the tightest bounds for \\d\\ were given by its original\n lower and upper bounds. If they would overlap, the original zone would be empty.\n \\\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c \\ r\" by auto\n thus ?case by (metis minus_le_iff order.trans)\n qed\n } note EE = this\n { fix l r assume \"l \\ S_Min_Le\" \"r \\ S_Max_Lt\"\n then have \"l < r\"\n proof (auto simp: S_Min_Le S_Max_Lt, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n then show ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis add.commute diff_less_eq uminus_add_conv_diff)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c < r\" by auto\n thus ?case by (metis minus_le_iff neq_iff not_le order.strict_trans)\n qed\n } note EL = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Le\"\n then have \"l < r\"\n proof (auto simp: S_Min_Lt S_Max_Le, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n thus ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis add.commute diff_less_eq uminus_add_conv_diff)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c < d\" \"u'' c \\ r\" by auto\n thus ?case by (meson less_le_trans minus_less_iff)\n qed\n } note LE = this\n { fix l r assume \"l \\ S_Min_Lt\" \"r \\ S_Max_Lt\"\n then have \"l < r\"\n proof (auto simp: S_Min_Lt S_Max_Lt, goal_cases)\n case (1 c1 d1 c2 d2)\n with A have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by presburger\n moreover have \"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(3,7) 1 unfolding DBM_reset_def by metis\n ultimately have \"dbm_entry_val u (Some c1) (Some c2) (dbm_add (M (v c1) (v c)) (M (v c) (v c2)))\"\n using dbm_entry_dbm_min' by fastforce\n with 1 have \"u c1 - u c2 < d1 + d2\" by auto\n then show ?case by (metis add.assoc add.commute diff_less_eq)\n next\n case (2 c' d)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0\\ M' i 0 = min (dbm_add (M i (v c)) (M (v c) 0)) (M i 0))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0))\"\n using 2 by blast\n moreover from A 2 have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u (Some c') None (dbm_add (M (v c') (v c)) (M (v c) 0))\"\n using dbm_entry_dbm_min3' by fastforce\n with 2 have \"u c' < d + r\" by auto\n thus ?case by (metis add_less_imp_less_right diff_add_cancel gt_swap)\n next\n case (3 d c' da)\n with A have\n \"(\\i\\n. i \\ v c \\ i > 0 \\ M' 0 i = min (dbm_add (M 0 (v c)) (M (v c) i)) (M 0 i))\"\n \"v c' \\ v c\"\n unfolding DBM_reset_def by auto\n hence \"(M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c')))\"\n using 3 by blast\n moreover from A 3 have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by presburger\n ultimately have \"dbm_entry_val u None (Some c') (dbm_add (M 0 (v c)) (M (v c) (v c')))\"\n using dbm_entry_dbm_min2' by fastforce\n with 3 have \"-u c' < d + da\" by auto\n thus ?case by (metis ab_group_add_class.ab_diff_conv_add_uminus add.commute diff_less_eq)\n next\n case (4 d)\n from A(2,5) have\n \"dbm_entry_val u'' None (Some c) (M 0 (v c))\"\n \"dbm_entry_val u'' (Some c) None (M (v c) 0)\"\n unfolding DBM_val_bounded_def by auto\n with 4 have \"- u'' c \\ d\" \"u'' c < r\" by auto\n thus ?case by (metis minus_le_iff neq_iff not_le order.strict_trans)\n qed\n } note LL = this\n\n obtain d' where d':\n \"\\ t \\ S_Min_Le. d' \\ t\" \"\\ t \\ S_Min_Lt. d' > t\"\n \"\\ t \\ S_Max_Le. d' \\ t\" \"\\ t \\ S_Max_Lt. d' < t\"\n proof -\n assume m:\n \"\\d'. \\\\t\\S_Min_Le. t \\ d'; \\t\\S_Min_Lt. t < d'; \\t\\S_Max_Le. d' \\ t; \\t\\S_Max_Lt. d' < t\\\n \\ thesis\"\n let ?min_le = \"Max S_Min_Le\"\n let ?min_lt = \"Max S_Min_Lt\"\n let ?max_le = \"Min S_Max_Le\"\n let ?max_lt = \"Min S_Max_Lt\"\n\n show thesis\n proof (cases \"S_Min_Le = {} \\ S_Min_Lt = {}\")\n case True\n note T = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?d' = \"0 :: 't :: time\"\n show thesis using True T by (intro m[of ?d']) auto\n next\n case False\n let ?d =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n obtain a :: \"'b\" where a: \"a < 0\" using non_trivial_neg by auto\n let ?d' = \"min 0 (?d + a)\"\n { fix x assume \"x \\ S_Max_Le\"\n with fin_max_le a have \"min 0 (Min S_Max_Le + a) \\ x\"\n by (metis Min.boundedE add_le_same_cancel1 empty_iff less_imp_le min.coboundedI2)\n then have \"min 0 (Min S_Max_Le + a) \\ x\" by auto\n } note 1 = this\n { fix x assume x: \"x \\ S_Max_Lt\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < ?max_lt\"\n by (meson a add_less_same_cancel1 min.cobounded1 min.strict_coboundedI2 order.strict_trans2)\n also from fin_max_lt x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) < x\" .\n } note 2 = this\n { fix x assume x: \"x \\ S_Max_Le\"\n have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ ?max_le\"\n by (metis le_add_same_cancel1 linear not_le a min_le_iff_disj)\n also from fin_max_le x have \"\\ \\ x\" by auto\n finally have \"min 0 (min (Min S_Max_Lt) (Min S_Max_Le) + a) \\ x\" .\n } note 3 = this\n show thesis using False T a 1 2 3\n proof ((intro m[of ?d']), auto, goal_cases)\n case 1 then show ?case\n by (metis Min.coboundedI add_less_same_cancel1 fin_max_lt min.boundedE min.orderE not_less)\n qed\n qed\n next\n case False\n note F = this\n show thesis\n proof (cases \"S_Max_Le = {} \\ S_Max_Lt = {}\")\n case True\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n obtain a :: \"'b\" where \"a < 0\" using non_trivial_neg by blast\n then have a: \"-a > 0\" using non_trivial_neg by simp\n then obtain a :: \"'b\" where a: \"a > 0\" by blast\n let ?d' = \"?l + a\"\n {\n fix x assume x: \"x \\ S_Min_Le\"\n then have \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" using fin_min_le by (simp add: max.coboundedI2)+\n then have \"x \\ max ?min_lt ?min_le + a\" \"x \\ ?min_le + a\" using a by (simp add: add_increasing2)+\n } note 1 = this\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI1)+\n then have \"x < ?d'\" using a x by (auto simp add: add.commute add_strict_increasing)\n } note 2 = this\n show thesis using True F a 1 2 by ((intro m[of ?d']), auto)\n next\n case False\n let ?r =\n \"if S_Max_Le \\ {}\n then if S_Max_Lt \\ {} then min ?max_lt ?max_le else ?max_le\n else ?max_lt\"\n let ?l =\n \"if S_Min_Le \\ {}\n then if S_Min_Lt \\ {} then max ?min_lt ?min_le else ?min_le\n else ?min_lt\"\n have 1: \"x \\ max ?min_lt ?min_le\" \"x \\ ?min_le\" if \"x \\ S_Min_Le\" for x\n by (simp add: max.coboundedI2 that fin_min_le)+\n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LE[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt \\ x\" by auto\n } note 3 = this\n {\n fix x y assume x: \"x \\ S_Max_Le\" \"y \\ S_Min_Le\"\n with EE[OF Max_in[OF fin_min_le], OF _ x(1)] have \"?min_le \\ x\" by auto\n } note 4 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Lt\"\n then have \"S_Min_Lt \\ {}\" by auto\n from LL[OF Max_in[OF fin_min_lt], OF this, OF x(1)] have \"?min_lt < x\" by auto\n } note 5 = this\n {\n fix x y assume x: \"x \\ S_Max_Lt\" \"y \\ S_Min_Le\"\n then have \"S_Min_Le \\ {}\" by auto\n from EL[OF Max_in[OF fin_min_le], OF this, OF x(1)] have \"?min_le < x\" by auto\n } note 6 = this\n\n show thesis\n proof (cases \"?l < ?r\")\n case False\n then have *: \"S_Max_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n with \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ obtain y where y:\"y \\ S_Max_Lt\" by auto\n note 1 = 1 this\n { fix x y assume A: \"x \\ S_Min_Le\" \"y \\ S_Max_Lt\"\n with EL[OF Max_in[OF fin_min_le] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Le < Min S_Max_Lt\" by auto\n } note ** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n show ?case\n proof (cases \"S_Min_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Min_Lt \\ {}\")\n case True\n then show False using 1 T True ** *** by auto\n next\n case False with 1 T ** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Min_Le = {} \\ S_Min_Lt = {})\\ show ?thesis by auto\n qed\n qed\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Lt\"\n with LL[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_lt]]\n have \"Max S_Min_Lt < Min S_Max_Lt\" by auto\n } note *** = this\n { fix x y assume A: \"x \\ S_Min_Lt\" \"y \\ S_Max_Le\"\n with LE[OF Max_in[OF fin_min_lt] Min_in[OF fin_max_le]]\n have \"Max S_Min_Lt < Min S_Max_Le\" by auto\n } note **** = this\n from F False have **: \"S_Min_Le \\ {}\"\n proof (auto, goal_cases)\n case 1\n show ?case\n proof (cases \"S_Max_Le \\ {}\")\n case True\n note T = this\n show ?thesis\n proof (cases \"S_Max_Lt \\ {}\")\n case True\n then show False using 1 T True **** *** by auto\n next\n case False with 1 T **** show False by auto\n qed\n next\n case False\n with 1 False *** \\\\ (S_Max_Le = {} \\ S_Max_Lt = {})\\ show ?thesis by auto\n qed\n qed\n {\n fix x assume x: \"x \\ S_Min_Lt\"\n then have \"x \\ ?min_lt\" using fin_min_lt by (simp add: max.coboundedI2)\n also have \"?min_lt < ?min_le\"\n proof (rule ccontr, goal_cases)\n case 1\n with x ** have 1: \"?l = ?min_lt\" by (auto simp: max.absorb1)\n have 2: \"?min_lt < ?max_le\" using * ****[OF x] by auto\n show False\n proof (cases \"S_Max_Lt = {}\")\n case False\n then have \"?min_lt < ?max_lt\" using * ***[OF x] by auto\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n next\n case True\n with 1 2 have \"?l < ?r\" by auto\n with \\\\ ?l < ?r\\ show False by auto\n qed\n qed\n finally have \"x < max ?min_lt ?min_le\" by (simp add: max.strict_coboundedI2)\n } note 2 = this\n show thesis using F False 1 2 3 4 5 6 * ** by ((intro m[of ?l]), auto)\n next\n case True\n then obtain d where d: \"?l < d\" \"d < ?r\" using dense by auto\n let ?d' = \"d\"\n {\n fix t assume \"t \\ S_Min_Le\"\n then have \"t \\ ?l\" using 1 by auto\n with d have \"t \\ d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Min_Lt\"\n then have \"t \\ max ?min_lt ?min_le\" using fin_min_lt by (simp add: max.coboundedI1)\n with t have \"t \\ ?l\" using fin_min_lt by auto\n with d have \"t < d\" by auto\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Le\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_le by (simp add: min.coboundedI2)\n then have \"?r \\ t\" using fin_max_le t by auto\n with d have \"d \\ t\" by auto\n then have \"d \\ t\" by (simp add: min.coboundedI2)\n }\n moreover {\n fix t assume t: \"t \\ S_Max_Lt\"\n then have \"min ?max_lt ?max_le \\ t\" using fin_max_lt by (simp add: min.coboundedI1)\n then have \"?r \\ t\" using fin_max_lt t by auto\n with d have \"d < t\" by auto\n then have \"d < t\" by (simp add: min.strict_coboundedI2)\n }\n ultimately show thesis by ((intro m[of ?d']), auto)\n qed\n qed\n qed\n qed\n have \"DBM_val_bounded v (u(c := d')) M n\" unfolding DBM_val_bounded_def\n proof (auto, goal_cases)\n case 1\n with A show ?case unfolding DBM_reset_def DBM_val_bounded_def by auto\n next\n case (2 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n with A(2,7) have \"v c \\ v c'\" by auto\n hence *:\"M' 0 (v c') = min (dbm_add (M 0 (v c)) (M (v c) (v c'))) (M 0 (v c'))\"\n using A(2,3,6,7) 2 unfolding DBM_reset_def by auto\n from 2 A(2,4) have \"dbm_entry_val u None (Some c') (M' 0 (v c'))\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min2 * have \"dbm_entry_val u None (Some c') (M 0 (v c'))\" by auto\n thus ?thesis using False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M 0 (v c)\", goal_cases)\n case (1 t)\n hence \"-t \\ S_Min_Le\" unfolding S_Min_Le by force\n hence \"d' \\ -t\" using d' by auto\n thus ?case using 1 by (auto simp: minus_le_iff)\n next\n case (2 t)\n hence \"-t \\ S_Min_Lt\" unfolding S_Min_Lt by force\n hence \"d' > -t\" using d' by auto\n thus ?case using 2 by (auto simp: minus_less_iff)\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case (3 c')\n show ?case\n proof (cases \"c = c'\")\n case False\n with A(2,7) have \"v c \\ v c'\" by auto\n hence *:\"M' (v c') 0 = min (dbm_add (M (v c') (v c)) (M (v c) 0)) (M (v c') 0)\"\n using A(2,3,6,7) 3 unfolding DBM_reset_def by auto\n from 3 A(2,4) have \"dbm_entry_val u (Some c') None (M' (v c') 0)\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min3 * have \"dbm_entry_val u (Some c') None (M (v c') 0)\" by auto\n thus ?thesis using False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M (v c) 0\", goal_cases)\n case (1 t)\n hence \"t \\ S_Max_Le\" unfolding S_Max_Le by force\n hence \"d' \\ t\" using d' by auto\n thus ?case using 1 by (auto simp: minus_le_iff)\n next\n case (2 t)\n hence \"t \\ S_Max_Lt\" unfolding S_Max_Lt by force\n hence \"d' < t\" using d' by auto\n thus ?case using 2 by (auto simp: minus_less_iff)\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case (4 c1 c2)\n show ?case\n proof (cases \"c = c1\")\n case False\n note F1 = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n with A(2,6,7) F1 have \"v c \\ v c1\" \"v c \\ v c2\" by auto\n hence *:\"M' (v c1) (v c2) = min (dbm_add (M (v c1) (v c)) (M (v c) (v c2))) (M (v c1) (v c2))\"\n using A(2,3,6,7) 4 unfolding DBM_reset_def by auto\n from 4 A(2,4) have \"dbm_entry_val u (Some c1) (Some c2) (M' (v c1) (v c2))\"\n unfolding DBM_val_bounded_def by auto\n with dbm_entry_dbm_min * have \"dbm_entry_val u (Some c1) (Some c2) (M (v c1) (v c2))\" by auto\n thus ?thesis using F1 False by cases auto\n next\n case True\n show ?thesis\n proof (simp add: True[symmetric], cases \"M (v c1) (v c)\", goal_cases)\n case (1 t)\n hence \"u c1 - t \\ S_Min_Le\" unfolding S_Min_Le using A F1 4 by blast\n hence \"d' \\ u c1 - t\" using d' by auto\n hence \"t + d' \\ u c1\" by (metis le_swap add_le_cancel_right diff_add_cancel)\n hence \"u c1 - d' \\ t\" by (metis add_le_imp_le_right diff_add_cancel)\n thus ?case using 1 F1 by auto\n next\n case (2 t)\n hence \"u c1 - t \\ S_Min_Lt\" unfolding S_Min_Lt using A 4 F1 by blast\n hence \"d' > u c1 - t\" using d' by auto\n hence \"d' + t > u c1\" by (metis add_strict_right_mono diff_add_cancel)\n hence \"u c1 - d' < t\" by (metis gt_swap add_less_cancel_right diff_add_cancel)\n thus ?case using 2 F1 by auto\n next\n case 3 thus ?case by auto\n qed\n qed\n next\n case True\n note T = this\n show ?thesis\n proof (cases \"c = c2\")\n case False\n show ?thesis\n proof (cases \"M (v c) (v c2)\", goal_cases)\n case (1 t)\n hence \"u c2 + t \\ S_Max_Le\" unfolding S_Max_Le using A 4 False by blast\n hence \"d' \\ u c2 + t\" using d' by auto\n hence \"d' - u c2 \\ t\"\n by (metis (hide_lams, no_types) add_diff_cancel_left add_ac(1) add_le_cancel_right\n add_right_cancel diff_add_cancel)\n thus ?case using 1 T False by auto\n next\n case (2 t)\n hence \"u c2 + t \\ S_Max_Lt\" unfolding S_Max_Lt using A 4 False by blast\n hence \"d' < u c2 + t\" using d' by auto\n hence \"d' - u c2 < t\" by (metis gt_swap add_less_cancel_right diff_add_cancel)\n thus ?case using 2 T False by force\n next\n case 3 thus ?case using T by auto\n qed\n next\n case True\n from A 4 have *:\"dbm_entry_val u'' (Some c1) (Some c1) (M (v c1) (v c1))\"\n unfolding DBM_val_bounded_def by auto\n show ?thesis using True T\n proof (simp add: True T, cases \"M (v c1) (v c1)\", goal_cases)\n case (1 t)\n with * have \"0 \\ t\" by auto\n thus ?case using 1 by auto\n next\n case (2 t)\n with * have \"0 < t\" by auto\n thus ?case using 2 by auto\n next\n case 3 thus ?case by auto\n qed\n qed\n qed\n qed\n thus ?thesis using A(1) by blast\nqed\n\nlemma DBM_reset_sound2:\n assumes \"v c \\ n\" \"DBM_reset M n (v c) d M'\" \"DBM_val_bounded v u M' n\"\n shows \"u c = d\"\nusing assms unfolding DBM_val_bounded_def DBM_reset_def\nby fastforce\n\nlemma DBM_reset_sound'':\n fixes M v c n d\n defines \"M' \\ reset M n (v c) d\"\n assumes \"clock_numbering' v n\" \"v c \\ n\" \"DBM_val_bounded v u M' n\"\n \"DBM_val_bounded v u'' M n\"\n obtains d' where \"DBM_val_bounded v (u(c := d')) M n\"\nproof -\n assume A:\"\\d'. DBM_val_bounded v (u(c := d')) M n \\ thesis\"\n from assms DBM_reset_reset[of \"v c\" n M d]\n have *:\"DBM_reset M n (v c) d M'\" by (auto simp add: M'_def)\n with DBM_reset_sound'[of v n c M d M', OF _ _ this] assms obtain d' where\n \"DBM_val_bounded v (u(c := d')) M n\" by auto\n with A show thesis by auto\nqed\n\nlemma DBM_reset_sound:\n fixes M v c n d\n defines \"M' \\ reset M n (v c) d\"\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"v c \\ n\"\n \"u \\ [M']\\<^bsub>v,n\\<^esub>\"\n obtains d' where \"u(c := d') \\[M]\\<^bsub>v,n\\<^esub>\"\nproof (cases \"[M]\\<^bsub>v,n\\<^esub> = {}\")\n case False\n then obtain u' where \"DBM_val_bounded v u' M n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset_sound''[OF assms(3-4) _ this] assms(1,5) that show ?thesis\n unfolding DBM_zone_repr_def by auto\nnext\n case True\n with DBM_reset_complete_empty'[OF assms(2) _ _ DBM_reset_reset, of \"v c\" M u d] assms show ?thesis\n unfolding DBM_zone_repr_def by simp\nqed\n\nlemma DBM_reset'_complete':\n assumes \"DBM_val_bounded v u M n\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"\\ u'. DBM_val_bounded v u' (reset' M n cs v d) n\"\nusing assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n let ?M' = \"reset' M n cs v d\"\n let ?M'' = \"reset ?M' n (v c) d\"\n from Cons obtain u' where u': \"DBM_val_bounded v u' ?M' n\" by fastforce\n from Cons(3,4) have \"0 < v c\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this] have **: \"DBM_reset ?M' n (v c) d ?M''\" by fast\n from Cons(4) have \"v c \\ n\" by auto\n from DBM_reset_complete[of v n c ?M' d ?M'', OF Cons(3) this ** u']\n have \"DBM_val_bounded v (u'(c := d)) (reset (reset' M n cs v d) n (v c) d) n\" by fast\n thus ?case by auto\nqed\n\nlemma DBM_reset'_complete:\n assumes \"DBM_val_bounded v u M n\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"DBM_val_bounded v ([cs \\ d]u) (reset' M n cs v d) n\"\nusing assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n let ?M' = \"reset' M n cs v d\"\n let ?M'' = \"reset ?M' n (v c) d\"\n from Cons have *: \"DBM_val_bounded v ([cs\\d]u) (reset' M n cs v d) n\" by fastforce\n from Cons(3,4) have \"0 < v c\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this] have **: \"DBM_reset ?M' n (v c) d ?M''\" by fast\n from Cons(4) have \"v c \\ n\" by auto\n from DBM_reset_complete[of v n c ?M' d ?M'', OF Cons(3) this ** *]\n have ***:\"DBM_val_bounded v ([c#cs\\d]u) (reset (reset' M n cs v d) n (v c) d) n\" by simp\n have \"reset' M n (c#cs) v d = reset (reset' M n cs v d) n (v c) d\" by auto\n with *** show ?case by presburger\nqed\n\nlemma DBM_reset'_sound_empty:\n assumes \"clock_numbering' v n\" \"\\c \\ set cs. v c \\ n\"\n \"\\ u . \\ DBM_val_bounded v u (reset' M n cs v d) n\"\n shows \"\\ DBM_val_bounded v u M n\"\nusing assms DBM_reset'_complete by metis\n\nfun set_clocks :: \"'c list \\ 't::time list\\ ('c,'t) cval \\ ('c,'t) cval\"\nwhere\n \"set_clocks [] _ u = u\" |\n \"set_clocks _ [] u = u\" |\n \"set_clocks (c#cs) (t#ts) u = (set_clocks cs ts (u(c:=t)))\"\n\nlemma DBM_reset'_sound':\n fixes M v c n d cs\n assumes \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n \"DBM_val_bounded v u (reset' M n cs v d) n\" \"DBM_val_bounded v u'' M n\"\n shows \"\\ts. DBM_val_bounded v (set_clocks cs ts u) M n\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil\n hence \"DBM_val_bounded v (set_clocks [] [] u) M n\" by auto\n thus ?case by blast\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from DBM_reset'_complete[OF Cons(5) Cons(2)] Cons(3)\n have u'': \"DBM_val_bounded v ([cs\\d]u'') ?M'' n\" by fastforce\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound''[OF Cons(2) this u'']\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" by blast\n from Cons.IH[OF Cons.prems(1) _ ** Cons.prems(4)] Cons.prems(2)\n obtain ts where ts:\"DBM_val_bounded v (set_clocks cs ts (u(c' := d'))) M n\" by fastforce\n hence \"DBM_val_bounded v (set_clocks (c' # cs) (d'#ts) u) M n\" by auto\n thus ?case by fast\nqed\n\nlemma DBM_reset'_resets:\n fixes M v c n d cs\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n \"DBM_val_bounded v u (reset' M n cs v d) n\"\n shows \"\\c \\ set cs. u c = d\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil thus ?case by auto\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from Cons(4,5) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound2[OF this(1) _ Cons(5), of ?M'' d] DBM_reset_reset[OF _ this(1), of ?M'' d] Cons(3)\n have c':\"u c' = d\" by auto\n from Cons(4,5) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n with DBM_reset_sound[OF Cons.prems(1,2) this(1)]\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" unfolding DBM_zone_repr_def by blast\n from Cons.IH[OF Cons.prems(1,2) _ **] Cons.prems(3) have \"\\c\\set cs. (u(c' := d')) c = d\" by auto\n thus ?case using c'\n apply safe\n apply (rename_tac c)\n apply (case_tac \"c = c'\")\n by auto\nqed\n\nlemma DBM_reset'_resets':\n fixes M :: \"('t :: time) DBM\" and v c n d cs\n assumes \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\" \"DBM_val_bounded v u (reset' M n cs v d) n\"\n \"DBM_val_bounded v u'' M n\"\n shows \"\\c \\ set cs. u c = d\"\nusing assms\nproof (induction cs arbitrary: M u)\n case Nil thus ?case by auto\nnext\n case (Cons c' cs)\n let ?M' = \"reset' M n (c' # cs) v d\"\n let ?M'' = \"reset' M n cs v d\"\n from DBM_reset'_complete[OF Cons(5) Cons(2)] Cons(3)\n have u'': \"DBM_val_bounded v ([cs\\d]u'') ?M'' n\" by fastforce\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound2[OF this(1) _ Cons(4), of ?M'' d] DBM_reset_reset[OF _ this(1), of ?M'' d] Cons(2)\n have c':\"u c' = d\" by auto\n from Cons(3,4) have \"v c' \\ n\" \"DBM_val_bounded v u (reset ?M'' n (v c') d) n\" by auto\n from DBM_reset_sound''[OF Cons(2) this u'']\n obtain d' where **:\"DBM_val_bounded v (u(c' := d')) ?M'' n\" by blast\n from Cons.IH[OF Cons.prems(1) _ ** Cons.prems(4)] Cons.prems(2)\n have \"\\c\\set cs. (u(c' := d')) c = d\" by auto\n thus ?case using c'\n apply safe\n apply (rename_tac c)\n apply (case_tac \"c = c'\")\n by auto\nqed\n\nlemma DBM_reset'_neg_diag_preservation':\n fixes M :: \"('t :: time) DBM\"\n assumes \"k\\n\" \"M k k < 0\" \"clock_numbering v\" \"\\ c \\ set cs. v c \\ n\"\n shows \"reset' M n cs v d k k < 0\" using assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n then have IH: \"reset' M n cs v d k k < 0\" by auto\n from Cons.prems have \"v c > 0\" \"v c \\ n\" by auto\n from DBM_reset_reset[OF this, of \"reset' M n cs v d\" d] \\k \\ n\\\n have \"reset (reset' M n cs v d) n (v c) d k k \\ reset' M n cs v d k k\" unfolding DBM_reset_def\n by (cases \"v c = k\", simp add: less[symmetric], case_tac \"k = 0\", auto simp: less[symmetric])\n with IH show ?case by auto\nqed\n\nlemma DBM_reset'_complete_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n \"\\ c \\ set cs. v c \\ n\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ u . \\ DBM_val_bounded v u (reset' M n cs v d) n\" using assms\nproof (induction cs)\n case Nil then show ?case by simp\nnext\n case (Cons c cs)\n then have \"\\u. \\ DBM_val_bounded v u (reset' M n cs v d) n\" by auto\n from Cons.prems(2,3) DBM_reset_complete_empty'[OF Cons.prems(1) _ _ DBM_reset_reset this]\n show ?case by auto\nqed\n\nlemma DBM_reset'_complete_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n \"\\ c \\ set cs. v c \\ n\" \"\\ u . \\ DBM_val_bounded v u M n\"\n shows \"\\ u . \\ DBM_val_bounded v u (reset' (FW M n) n cs v d) n\" using assms\nproof -\n note A = assms\n from A(4) have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n with FW_zone_equiv[OF A(1)] have \"[FW M n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_detects_empty_zone[OF A(1)] A(2) obtain i where i: \"i \\ n\" \"FW M n i i < Le 0\" by blast\n with DBM_reset'_neg_diag_preservation' A(2,3) have\n \"reset' (FW M n) n cs v d i i < Le 0\"\n by (auto simp: neutral)\n with fw_mono[of i n i \"reset' (FW M n) n cs v d\" n] i\n have \"FW (reset' (FW M n) n cs v d) n i i < Le 0\" by auto\n with FW_detects_empty_zone[OF A(1), of \"reset' (FW M n) n cs v d\"] A(2,3) i\n have \"[FW (reset' (FW M n) n cs v d) n]\\<^bsub>v,n\\<^esub> = {}\" by auto\n with FW_zone_equiv[OF A(1), of \"reset' (FW M n) n cs v d\"] A(3,4)\n show ?thesis by (auto simp: DBM_zone_repr_def)\nqed\n\nlemma DBM_reset'_empty':\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [reset' (FW M n) n cs v d]\\<^bsub>v,n\\<^esub> = {}\"\nproof\n let ?M' = \"reset' (FW M n) n cs v d\"\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n with DBM_reset'_complete_empty[OF assms] show \"[?M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n let ?M' = \"reset' (FW M n) n cs v d\"\n assume A: \"[?M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u ?M' n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset'_sound_empty[OF assms(2,3) this] have \"\\ u. \\ DBM_val_bounded v u (FW M n) n\" by auto\n with FW_zone_equiv[OF assms(1)] show \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset'_empty:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\" \"\\ c \\ set cs. v c \\ n\"\n shows \"[M]\\<^bsub>v,n\\<^esub> = {} \\ [reset' M n cs v d]\\<^bsub>v,n\\<^esub> = {}\"\nproof\n let ?M' = \"reset' M n cs v d\"\n assume A: \"[M]\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u M n\" unfolding DBM_zone_repr_def by auto\n with DBM_reset'_complete_empty'[OF assms] show \"[?M']\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nnext\n let ?M' = \"reset' M n cs v d\"\n assume A: \"[?M']\\<^bsub>v,n\\<^esub> = {}\"\n hence \"\\ u . \\ DBM_val_bounded v u ?M' n\" unfolding DBM_zone_repr_def by auto\n from DBM_reset'_sound_empty[OF assms(2,3) this] have \"\\ u. \\ DBM_val_bounded v u M n\" by auto\n with FW_zone_equiv[OF assms(1)] show \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\nqed\n\nlemma DBM_reset'_sound:\n assumes \"\\k\\n. k > 0 \\ (\\c. v c = k)\" \"clock_numbering' v n\"\n and \"\\c\\set cs. v c \\ n\"\n and \"u \\ [reset' M n cs v d]\\<^bsub>v,n\\<^esub>\"\n shows \"\\ts. set_clocks cs ts u \\ [M]\\<^bsub>v,n\\<^esub>\"\nproof -\n from DBM_reset'_empty[OF assms(1-3)] assms(4) obtain u' where \"u' \\ [M]\\<^bsub>v,n\\<^esub>\" by blast\n with DBM_reset'_sound'[OF assms(2,3)] assms(4) show ?thesis unfolding DBM_zone_repr_def by blast\nqed\n\nsection \\Misc Preservation Lemmas\\\n\nlemma get_const_sum[simp]:\n \"a \\ \\ \\ b \\ \\ \\ get_const a \\ \\ \\ get_const b \\ \\ \\ get_const (a + b) \\ \\\"\nby (cases a) (cases b, auto simp: add)+\n\nlemma sum_not_inf_dest:\n assumes \"a + b \\ (\\ :: _ DBMEntry)\"\n shows \"a \\ (\\ :: _ DBMEntry) \\ b \\ (\\ :: _ DBMEntry)\"\nusing assms by (cases a; cases b; simp add: add)\n\nlemma sum_not_inf_int:\n assumes \"a + b \\ (\\ :: _ DBMEntry)\" \"get_const a \\ \\\" \"get_const b \\ \\\"\n shows \"get_const (a + b) \\ \\\"\nusing assms sum_not_inf_dest by fastforce\n\nlemma int_fw_upd:\n \"\\ i \\ n. \\ j \\ n. m i j \\ \\ \\ get_const (m i j) \\ \\ \\ k \\ n \\ i \\ n \\ j \\ n\n \\ i' \\ n \\ j' \\ n \\ (fw_upd m k i j i' j') \\ \\\n \\ get_const (fw_upd m k i j i' j') \\ \\\"\nproof (goal_cases)\n case 1\n show ?thesis\n proof (cases \"i = i' \\ j = j'\")\n case True\n with 1 show ?thesis by (fastforce simp: fw_upd_def upd_def min_def dest: sum_not_inf_dest)\n next\n case False\n with 1 show ?thesis by (auto simp : fw_upd_def upd_def)\n qed\nqed\n\nabbreviation \"dbm_int M n \\ \\ i\\n. \\ j\\n. M i j \\ \\ \\ get_const (M i j) \\ \\\"\n\nabbreviation \"dbm_int_all M \\ \\ i. \\ j. M i j \\ \\ \\ get_const (M i j) \\ \\\"\n\nlemma dbm_intI:\n \"dbm_int_all M \\ dbm_int M n\"\nby auto\n\nlemma fwi_int_preservation:\n \"dbm_int (fwi M n k i j) n\" if \"dbm_int M n\" \"k \\ n\"\n apply (induction _ \"(i, j)\" arbitrary: i j rule: wf_induct[of \"less_than <*lex*> less_than\"])\n apply (auto; fail)\n subgoal for i j\n using that\n by (cases i; cases j) (auto 4 3 dest: sum_not_inf_dest simp: min_def fw_upd_def upd_def)\n done\n\nlemma fw_int_preservation:\n \"dbm_int (fw M n k) n\" if \"dbm_int M n\" \"k \\ n\"\n using \\k \\ n\\ apply (induction k)\n using that apply simp\n apply (rule fwi_int_preservation; auto; fail)\n using that by (simp) (rule fwi_int_preservation; auto)\n\nlemma FW_int_preservation:\n assumes \"dbm_int M n\"\n shows \"dbm_int (FW M n) n\"\n using fw_int_preservation[OF assms(1)] by auto\n\nlemma FW_int_all_preservation:\n assumes \"dbm_int_all M\"\n shows \"dbm_int_all (FW M n)\"\nusing assms\n apply clarify\n subgoal for i j\n apply (cases \"i \\ n\")\n apply (cases \"j \\ n\")\n by (auto simp: FW_int_preservation[OF dbm_intI[OF assms(1)]] FW_out_of_bounds1 FW_out_of_bounds2)\ndone\n\nlemma And_int_all_preservation[intro]:\n assumes \"dbm_int_all M1\" \"dbm_int_all M2\"\n shows \"dbm_int_all (And M1 M2)\"\nusing assms by (auto simp: min_def)\n\nlemma And_int_preservation:\n assumes \"dbm_int M1 n\" \"dbm_int M2 n\"\n shows \"dbm_int (And M1 M2) n\"\nusing assms by (auto simp: min_def)\n\nlemma up_int_all_preservation:\n \"dbm_int_all (M :: (('t :: {time, ring_1}) DBM)) \\ dbm_int_all (up M)\"\nunfolding up_def min_def\n apply safe\n apply (case_tac \"i = 0\")\n apply fastforce\n apply (case_tac \"j = 0\")\n apply fastforce\n apply auto\nunfolding add[symmetric] by (auto dest: sum_not_inf_dest)\n\nlemma up_int_preservation:\n \"dbm_int (M :: (('t :: {time, ring_1}) DBM)) n \\ dbm_int (up M) n\"\nunfolding up_def min_def\n apply safe\n apply (case_tac \"i = 0\")\n apply fastforce\n apply (case_tac \"j = 0\")\n apply fastforce\n apply auto\nunfolding add[symmetric] by (auto dest: sum_not_inf_dest)\n\n(* Definitely a candidate for cleaning *)\nlemma DBM_reset_int_preservation':\n assumes \"dbm_int M n\" \"DBM_reset M n k d M'\" \"d \\ \\\" \"k \\ n\"\n shows \"dbm_int M' n\"\nproof clarify\n fix i j\n assume A: \"i \\ n\" \"j \\ n\" \"M' i j \\ \\\"\n from assms(2) show \"get_const (M' i j) \\ \\\" unfolding DBM_reset_def\n apply (cases \"i = k\"; cases \"j = k\")\n apply simp\n using A assms(1,4) apply presburger\n apply (cases \"j = 0\")\n using assms(3) apply simp\n using A apply simp\n apply simp\n apply (cases \"i = 0\")\n using assms(3) apply simp\n using A apply simp\n using A apply simp\n apply (simp split: split_min, safe)\n subgoal\n proof goal_cases\n case 1\n then have *: \"M i k + M k j \\ \\\" unfolding add min_def by meson\n with sum_not_inf_dest have \"M i k \\ \\\" \"M k j \\ \\\" by auto\n with 1(3,4) assms(1,4) have \"get_const (M i k) \\ \\\" \"get_const (M k j) \\ \\\" by auto\n with sum_not_inf_int[folded add, OF *] show ?case unfolding add by auto\n qed\n subgoal\n proof goal_cases\n case 1\n then have *: \"M i j \\ \\\" unfolding add min_def by meson\n with 1(3,4) assms(1,4) show ?case by auto\n qed\n done\nqed\n\nlemma DBM_reset_int_preservation:\n fixes M :: \"('t :: {time,ring_1}) DBM\"\n assumes \"dbm_int M n\" \"d \\ \\\" \"0 < k\" \"k \\ n\"\n shows \"dbm_int (reset M n k d) n\"\nusing assms(3-) DBM_reset_int_preservation'[OF assms(1) DBM_reset_reset assms(2)] by blast\n\nlemma DBM_reset_int_all_preservation:\n fixes M :: \"('t :: {time,ring_1}) DBM\"\n assumes \"dbm_int_all M\" \"d \\ \\\"\n shows \"dbm_int_all (reset M n k d)\"\nusing assms\n apply clarify\n subgoal for i j\n by (cases \"i = k\"; cases \"j = k\";\n auto simp: reset_def min_def add[symmetric] dest!: sum_not_inf_dest\n )\ndone\n\nlemma DBM_reset'_int_all_preservation:\n fixes M :: \"('t :: {time, ring_1}) DBM\"\n assumes \"dbm_int_all M\" \"d \\ \\\"\n shows \"dbm_int_all (reset' M n cs v d)\" using assms\nby (induction cs) (simp | rule DBM_reset_int_all_preservation)+\n\nlemma DBM_reset'_int_preservation:\n fixes M :: \"('t :: {time, ring_1}) DBM\"\n assumes \"dbm_int M n\" \"d \\ \\\" \"\\c. v c > 0\" \"\\ c \\ set cs. v c \\ n\"\n shows \"dbm_int (reset' M n cs v d) n\" using assms\nproof (induction cs)\n case Nil then show ?case by simp\nnext\n case (Cons c cs)\n from Cons.IH[OF Cons.prems(1,2,3)] Cons.prems(4) have \"dbm_int (reset' M n cs v d) n\"\n by fastforce\n from DBM_reset_int_preservation[OF this Cons.prems(2), of \"v c\"] Cons.prems(3,4) show ?case\n by auto\nqed\n\nlemma reset_set1:\n \"\\c \\ set cs. ([cs\\d]u) c = d\"\nby (induction cs) auto\n\nlemma reset_set11:\n \"\\c. c \\ set cs \\ ([cs\\d]u) c = u c\"\nby (induction cs) auto\n\nlemma reset_set2:\n \"\\c. c \\ set cs \\ (set_clocks cs ts u)c = u c\"\nproof (induction cs arbitrary: ts u)\n case Nil then show ?case by auto\nnext\n case Cons then show ?case\n proof (cases ts, goal_cases)\n case Nil then show ?thesis by simp\n next\n case (2 a') then show ?case by auto\n qed\nqed\n\nlemma reset_set:\n assumes \"\\ c \\ set cs. u c = d\"\n shows \"[cs\\d](set_clocks cs ts u) = u\"\nproof\n fix c\n show \"([cs\\d]set_clocks cs ts u) c = u c\"\n proof (cases \"c \\ set cs\")\n case True\n hence \"([cs\\d]set_clocks cs ts u) c = d\" using reset_set1 by fast\n also have \"d = u c\" using assms True by auto\n finally show ?thesis by auto\n next\n case False\n hence \"([cs\\d]set_clocks cs ts u) c = set_clocks cs ts u c\" by (simp add: reset_set11)\n also with False have \"\\ = u c\" by (simp add: reset_set2)\n finally show ?thesis by auto\n qed\nqed\n\n\nsubsection \\Unused theorems\\\n\n\n\nlemma canonical_cyc_free2:\n \"canonical M n \\ cyc_free M n \\ (\\i \\ n. M i i \\ 0)\"\n apply safe\n apply (simp add: cyc_free_diag_dest')\nusing canonical_cyc_free by blast\n\nlemma DBM_reset'_diag_preservation:\n fixes M :: \"('t :: time) DBM\"\n assumes \"\\k\\n. M k k \\ 0\" \"clock_numbering v\" \"\\ c \\ set cs. v c \\ n\"\n shows \"\\k\\n. reset' M n cs v d k k \\ 0\" using assms\nproof (induction cs)\n case Nil thus ?case by auto\nnext\n case (Cons c cs)\n then have IH: \"\\k\\n. reset' M n cs v d k k \\ 0\" by auto\n from Cons.prems have \"v c > 0\" \"v c \\ n\" by auto\n from DBM_reset_diag_preservation[of n \"reset' M n cs v d\", OF IH DBM_reset_reset, of \"v c\", OF this]\n show ?case by simp\nqed\n\nend\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/DBM/DBM_Operations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.25660250401956225}} {"text": "theory LaunchburyAddBH\nimports LaunchburyCombinedTaggedMap\nbegin \n\nnominal_primrec varOf :: \"exp \\ var option\" where\n \"varOf (Var x) = Some x\" |\n \"varOf (Lam [_]. _) = None\" |\n \"varOf (App e x) = None\" |\n \"varOf (Let as body) = None\"\n unfolding eqvt_def varOf_graph_aux_def\n apply (rule)\n apply simp_all\n apply (metis exp_assn.exhaust(1))\n done\ntermination (eqvt) by lexicographic_order\n\nnominal_primrec dep :: \"exp \\ var option\" where\n \"dep (Var x) = Some x\" |\n \"dep (App e y) = varOf e\" |\n \"dep (Lam [_]. _) = None\" |\n \"dep (Let as body) = None\"\n unfolding eqvt_def dep_graph_aux_def\n apply (rule)\n apply simp_all\n apply (metis exp_assn.exhaust(1))\n done\ntermination (eqvt) by lexicographic_order\n\nlemma isLam_dep[simp]: \"isLam e \\ dep e = None\"\n by (cases e rule: exp_assn.exhaust(1)) auto\n\nfun depRel :: \"Heap \\ var \\ var \\ bool\" where\n \"depRel \\ x y \\ Option.bind (lookup \\ x) dep = Some y\"\n\nlemma depRel_cong':\n \"lookup \\ a = lookup \\ a \\ depRel \\ a b \\ depRel \\ a b\"\n by auto\n\nlemma depRel_cong:\n \"lookup \\ a = lookup \\ a \\ depRel \\ a b = depRel \\ a b\"\n by auto\n\nlemma depRel_fmap_upd[simp]: \"depRel (\\(x f\\ e)) x y \\ dep e = Some y\"\n by auto\n\nlemma depRel_fmap_upd_Not[simp]: \"a \\ x \\ depRel (\\(x f\\ e)) a b \\ depRel \\ a b\"\n by simp\n\nlemma depRel_dom: \"depRel \\ y x \\ y \\ fdom \\\"\n by (metis depRel.simps bind_lzero fdomIff option.distinct(1))\n\nlemma depRelTransDom:\n \"(depRel \\)\\<^sup>+\\<^sup>+ a b \\ a \\ fdom \\\"\n by (metis (full_types) depRel_dom tranclpD)\n\nlemma depRel_fmap_upd_trans[simp]: \"lookup \\ x = Some e \\ dep e = None \\ (depRel \\)\\<^sup>+\\<^sup>+ x y \\ False\"\n by (auto elim: tranclp_induct)\n\ndefinition cycle where \"cycle \\ x \\ (depRel \\)\\<^sup>+\\<^sup>+ x x\"\n\nlemma lookup_eq_split: \"lookup (f(a f\\ b)) x = Some r \\ ((x = a \\ r = b) \\ (x \\ a \\ lookup f x = Some r))\"\n by transfer auto\n\nlemma varOf_Some[dest!]: \"varOf e = Some b \\ e = Var b\"\n by (cases e rule:exp_assn.exhaust(1)) auto\n\nlemma depRelAppE:\n \"depRel (\\(x f\\ App e y)) a b \\ x = a \\ e = Var b \\ x \\ a \\ depRel \\ a b\"\n by (cases \"x=a\") auto\n\nlemma depRelTransIndirect: \n assumes \"(depRel (\\(x f\\ App e y)))\\<^sup>+\\<^sup>+ a b\"\n assumes \"atom n \\ \\(x f\\ App e y)\"\n shows \"(depRel (\\(x f\\ App (Var n) y)(n f\\ e)))\\<^sup>+\\<^sup>+ a b\"\nusing assms\nproof (induction rule:tranclp_trans_induct[consumes 1, case_names base step])\n case (base a b)\n note depRel_dom[OF `depRel (\\(x f\\ App e y)) a b`]\n with `atom n \\ \\(x f\\ App e y)`\n have \"n \\ a\" by (metis fresh_fdom)\n\n from depRelAppE[OF base(1)]\n show ?case\n proof(elim conjE disjE)\n assume \"x = a\" and \"e = Var b\"\n\n have \"(depRel (\\(a f\\ App (Var n) y)(n f\\ Var b)))\\<^sup>+\\<^sup>+ a n\" using `n \\ a` by auto\n also\n have \"(depRel (\\(a f\\ App (Var n) y)(n f\\ Var b)))\\<^sup>+\\<^sup>+ n b\" by auto\n finally\n show ?thesis unfolding `x = a` `e = Var b`.\n next\n assume \"x \\ a \" and \"depRel \\ a b\" thus ?thesis using `n \\ a` by auto\n qed\n next\n case (step a b c)\n thus ?case by auto\nqed\n\nlemma cycleIndirect: \n assumes \"cycle (\\(x f\\ App e y)) z\"\n assumes \"atom n \\ \\(x f\\ App e y)\"\n shows \"cycle (\\(x f\\ App (Var n) y)(n f\\ e)) z\"\nby (metis depRelTransIndirect cycle_def assms)\n\ninductive validStack :: \"Heap \\ var \\ var list \\ bool\"\n for \\ where\n ValidStackNil: \"validStack \\ x []\"\n | ValidStackCons: \"(depRel \\)\\<^sup>+\\<^sup>+ y x \\ validStack \\ y S \\ validStack \\ x (y#S)\"\n\nlemma validStackIndirect:\n \"validStack (\\(x f\\ App e y)) z S \\ atom n \\ \\(x f\\ App e y) \\\n validStack (\\(x f\\ App (Var n) y)(n f\\ e)) z S\"\nby (induction z S rule:validStack.induct)\n (auto intro: ValidStackNil ValidStackCons depRelTransIndirect)\n\nlemma depRel_unique:\n \"depRel \\ a b \\ depRel \\ a c \\ b = c\"\n by (auto elim!: depRel.cases)\n\nlemma validStack_to_top:\n \"validStack \\ x S \\ y \\ set S \\ (depRel \\)\\<^sup>+\\<^sup>+ y x\"\nby (induction x S rule:validStack.induct) auto\n\nlemma validStack_cycle:\n \"validStack \\ x S \\ x \\ set S \\ cycle \\ x\"\nby (metis validStack_to_top cycle_def)\n\nlemma depRel_via:\n assumes \"(depRel \\)\\<^sup>+\\<^sup>+ a z\"\n assumes \"depRel \\ a b\"\n shows \"b = z \\ (depRel \\)\\<^sup>+\\<^sup>+ b z\"\nusing assms\nby (induction a z rule:tranclp_trans_induct[consumes 1, case_names base step])\n (auto dest: depRel_unique tranclp_trans)\n\nlemma validStack_cong:\n assumes \"validStack \\ z S\"\n assumes cong: \"\\ x. (depRel \\)\\<^sup>+\\<^sup>+ x z \\ lookup \\ x = lookup \\ x\"\n shows \"validStack \\ z S\"\nusing assms\nproof(induction z S rule:validStack.induct)\n case (ValidStackNil y) thus ?case by (intro validStack.intros)\nnext\n case (ValidStackCons y x S)\n from `(depRel \\)\\<^sup>+\\<^sup>+ y x` ValidStackCons.prems\n have \"(depRel \\)\\<^sup>+\\<^sup>+ y x\"\n proof (induction y x rule:tranclp_trans_induct[consumes 1, case_names base step])\n case (base x' y)\n hence \"lookup \\ x' = lookup \\ x'\" by auto\n with base(1)\n have \"depRel \\ x' y\" by (simp cong: depRel_cong)\n thus ?case by auto\n next\n case step thus ?case by (metis tranclp_trans)\n qed\n moreover\n have \"validStack \\ y S\"\n proof(rule ValidStackCons.IH)\n fix x'\n assume \"(depRel \\)\\<^sup>+\\<^sup>+ x' y\" with `(depRel \\)\\<^sup>+\\<^sup>+ y x`\n have \"(depRel \\)\\<^sup>+\\<^sup>+ x' x\" by auto\n thus \" lookup \\ x' = lookup \\ x'\"\n by (rule ValidStackCons)\n qed\n ultimately\n show \"validStack \\ x (y # S)\"\n by (rule validStack.intros)\nqed\n\n\nlemma cycle_depRel:\n assumes \"cycle \\ x\"\n assumes \"depRel \\ x n\"\n shows \"cycle \\ n\"\nby (metis assms depRel_via cycle_def tranclp.simps)\n\ntheorem\n assumes \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>x#S\\<^esub> \\\"\n assumes \"validStack \\ x S\"\n shows \"\\ cycle \\ x\" and \"validStack \\ x S\"\n and add_blackholing: \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>\\\\<^bsub>x#S\\<^esub> \\\"\n (* The third conclusion does not need the others, but inductive proofs compose so badly. *)\nusing assms\nproof(induction \\ i u b \"x#S\" \\ arbitrary: x S rule:reds.induct )\ncase (Lambda \\ x y e i u b S)\n case 1 show ?case by (auto simp add: cycle_def)\n case 2 thus ?case .\n case 3 show ?case using Lambda by (rule reds.Lambda)\nnext\ncase (Application n \\ x e y S \\ z \\ e' u b)\n case 2\n from Application(1) have \"n \\ x\" \"n \\ set S\"\n by (simp_all add: fresh_Pair fresh_at_base fresh_at_base_list)\n hence \"(depRel (\\(x f\\ App (Var n) y)(n f\\ e)))\\<^sup>+\\<^sup>+ x n\" by auto\n moreover\n from Application(1) have \"atom n \\ \\(x f\\ App e y)\"\n by (simp add: fresh_Pair fresh_fmap_upd_eq fresh_fmap_delete_subset)\n with `validStack (\\(x f\\ App e y)) x S`\n have \"validStack (\\(x f\\ App (Var n) y)(n f\\ e)) x S\" by (rule validStackIndirect)\n ultimately\n have IH1: \"validStack (\\(x f\\ App (Var n) y)(n f\\ e)) n (x # S)\" by (rule ValidStackCons)\n hence \"validStack \\ n (x # S)\" by (rule Application.hyps)\n hence \"validStack \\ x S\" by (cases)\n hence IH2: \"validStack ((fmap_delete n \\)(x f\\ e'[z::=y])) x S\"\n proof(rule validStack_cong)\n from stack_unchanged[OF Application.hyps(8)[OF IH1]] `n \\ x`\n have \"lookup \\ x = Some (App (Var n) y)\" by auto\n hence \"depRel \\ x n\" by auto\n\n fix x'\n assume \"(depRel \\)\\<^sup>+\\<^sup>+ x' x\"\n moreover\n from `lookup \\ n = Some (Lam [z]. e')`\n have \"\\ (depRel \\)\\<^sup>+\\<^sup>+ n x\" by auto\n moreover\n hence \"\\ (depRel \\)\\<^sup>+\\<^sup>+ x x\" using `depRel \\ x n`\n by (metis depRel_via)\n ultimately\n have \"x' \\ x\" \"x' \\ n\" by auto\n thus \"lookup \\ x' = lookup (fmap_delete n \\(x f\\ e'[z::=y])) x'\" by simp\n qed\n thus \"validStack \\ x S\"\n by (rule Application.hyps)\n case 1\n from Application.hyps(6)[OF IH1]\n show ?case\n proof(rule contrapos_nn)\n assume \"cycle (\\(x f\\ App e y)) x\"\n hence \"cycle (\\(x f\\ App (Var n) y)(n f\\ e)) x\"\n by (rule cycleIndirect[OF _ `atom n \\ \\(x f\\ App e y)`])\n thus \"cycle (\\(x f\\ App (Var n) y)(n f\\ e)) n\" using `n \\ x` by (auto elim!: cycle_depRel)\n qed\n case 3\n from Application.hyps(1,2,3,4)\n Application.hyps(8)[OF IH1]\n Application.hyps(12)[OF IH2]\n show ?case by (rule reds.Application)\nnext\ncase (ApplicationInd n \\ x e y S z \\ e' u b \\)\ncase 2\n from ApplicationInd(1) have \"n \\ x\" by (simp add: fresh_Pair fresh_at_base)\n hence \"(depRel (\\(x f\\ App (Var n) y)(n f\\ e)))\\<^sup>+\\<^sup>+ x n\" by auto\n moreover\n from ApplicationInd(1) have \"atom n \\ \\(x f\\ App e y)\"\n by (simp add: fresh_Pair fresh_fmap_upd_eq fresh_fmap_delete_subset)\n with `validStack (\\(x f\\ App e y)) x S`\n have \"validStack (\\(x f\\ App (Var n) y)(n f\\ e)) x S\" by (rule validStackIndirect)\n ultimately\n have IH1: \"validStack (\\(x f\\ App (Var n) y)(n f\\ e)) n (x # S)\" by (rule ValidStackCons)\n hence \"validStack \\ n (x # S)\" by (rule ApplicationInd.hyps)\n hence \"validStack \\ x S\" by (cases)\n hence IH2: \"validStack (\\(z f\\ Var y)(x f\\ e')) x S\"\n proof(rule validStack_cong)\n from stack_unchanged[OF ApplicationInd.hyps(8)[OF IH1]] `n \\ x`\n have \"depRel \\ x n\" by auto\n\n fix x'\n assume as: \"(depRel \\)\\<^sup>+\\<^sup>+ x' x\"\n moreover\n from `lookup \\ n = Some (Lam [z]. e')`\n have \"\\ (depRel \\)\\<^sup>+\\<^sup>+ n x\" by auto\n moreover\n hence \"\\ (depRel \\)\\<^sup>+\\<^sup>+ x x\" using `depRel \\ x n`\n by (metis depRel_via)\n ultimately\n have \"x' \\ x\" \"x' \\ n\" by auto\n moreover\n from as `x' \\ n`\n have \"x' \\ fdom \\\" by (metis (hide_lams, no_types) converse_tranclpE depRel_dom)\n with ApplicationInd(2)\n have \"x' \\ z\" by (auto simp add: fresh_Pair)\n ultimately\n show \"lookup \\ x' = lookup (\\(z f\\ Var y)(x f\\ e')) x'\" by simp\n qed\n thus \"validStack \\ x S\"\n by (rule ApplicationInd.hyps)\n case 1\n from ApplicationInd.hyps(6)[OF IH1]\n show ?case\n proof(rule contrapos_nn)\n assume \"cycle (\\(x f\\ App e y)) x\"\n hence \"cycle (\\(x f\\ App (Var n) y)(n f\\ e)) x\"\n by (rule cycleIndirect[OF _ `atom n \\ \\(x f\\ App e y)`])\n thus \"cycle (\\(x f\\ App (Var n) y)(n f\\ e)) n\" using `n \\ x`\n by (auto elim!: cycle_depRel)\n qed\n case 3\n from ApplicationInd.hyps(1-4)\n ApplicationInd.hyps(8)[OF IH1]\n ApplicationInd.hyps(12)[OF IH2]\n show ?case by (rule reds.ApplicationInd)\nnext\ncase (Variable y x S \\ i \\)\n hence \"y \\ x\" by simp\n\n have \"(depRel (\\(x f\\ Var y)))\\<^sup>+\\<^sup>+ x y\" by auto \n moreover\n assume \"validStack (\\(x f\\ Var y)) x S\"\n ultimately\n have \"validStack (\\(x f\\ Var y)) y (x # S)\"\n by (rule ValidStackCons)\n note hyps = Variable(4-6)[OF this]\n\n from stack_unchanged[OF hyps(3)] `y \\ x`\n have \"lookup \\ x = Some (Var y)\" by simp\n hence \"depRel \\ x y\" by auto\n\n from result_evaluated[OF hyps(3)]\n have \"isLam (\\ f! y)\" by simp\n hence \"\\ Domainp (depRel \\) y\" apply auto by (metis bind_lunit bind_lzero isLam_dep not_None_eq the.simps)\n\n from `validStack \\ y (x # S)` \n have \"validStack \\ x S\" by cases\n thus \"validStack (fmap_copy \\ y x) x S\"\n proof (rule validStack_cong)\n fix x'\n assume \"(depRel \\)\\<^sup>+\\<^sup>+ x' x\"\n moreover\n from `\\ Domainp (depRel \\) y`\n have \" \\(depRel \\)\\<^sup>+\\<^sup>+ y x\" by (metis Domainp.DomainI converse_tranclpE)\n hence \" \\(depRel \\)\\<^sup>+\\<^sup>+ x x\" using `depRel \\ x y` by (metis depRel_via)\n ultimately\n have \"x' \\ x\" by auto\n thus \"lookup \\ x' = lookup (fmap_copy \\ y x) x'\" by simp\n qed\n\n from hyps(1)\n show \"\\ cycle (\\(x f\\ Var y)) x\"\n by (auto elim!: contrapos_nn cycle_depRel)\n\n from Variable(1-3) \n show \"\\(x f\\ Var y) \\\\<^sup>i\\<^sup>\\\\<^sup>\\\\<^bsub>x # S\\<^esub> fmap_copy \\ y x\"\n by (rule reds.Variable)\nnext\ncase (VariableNoBH x \\ y i S \\)\n have \"(depRel (\\(x f\\ Var y)))\\<^sup>+\\<^sup>+ x y\" by auto \n moreover\n assume \"validStack (\\(x f\\ Var y)) x S\"\n ultimately\n have \"validStack (\\(x f\\ Var y)) y (x # S)\"\n by (rule ValidStackCons)\n note hyps = VariableNoBH(3-5)[OF this]\n\n from hyps(1) `(depRel (\\(x f\\ Var y)))\\<^sup>+\\<^sup>+ x y`\n have \"y \\ x\" by (auto simp add: cycle_def)\n\n from stack_unchanged[OF hyps(3)] `y \\ x`\n have \"lookup \\ x = Some (Var y)\" by simp\n hence \"depRel \\ x y\" by auto\n\n from result_evaluated[OF hyps(3)]\n have \"isLam (\\ f! y)\" by simp\n hence \"\\ Domainp (depRel \\) y\" apply auto by (metis bind_lunit bind_lzero isLam_dep not_None_eq the.simps)\n\n from `validStack \\ y (x # S)` \n have \"validStack \\ x S\" by cases\n thus \"validStack (fmap_copy \\ y x) x S\"\n proof (rule validStack_cong)\n fix x'\n assume \"(depRel \\)\\<^sup>+\\<^sup>+ x' x\"\n moreover\n from `\\ Domainp (depRel \\) y`\n have \" \\(depRel \\)\\<^sup>+\\<^sup>+ y x\" by (metis Domainp.DomainI converse_tranclpE)\n hence \" \\(depRel \\)\\<^sup>+\\<^sup>+ x x\" using `depRel \\ x y` by (metis depRel_via)\n ultimately\n have \"x' \\ x\" by auto\n thus \"lookup \\ x' = lookup (fmap_copy \\ y x) x'\" by simp\n qed\n\n from hyps(1)\n show \"\\ cycle (\\(x f\\ Var y)) x\"\n by (auto elim!: contrapos_nn cycle_depRel)\n\n from hyps(1) `validStack (\\(x f\\ Var y)) y (x#S)`\n have \"y \\ set (x # S)\"\n by (metis validStack_cycle)\n\n from this VariableNoBH.hyps(1) hyps(3)\n show \"\\(x f\\ Var y) \\\\<^sup>i\\<^sup>\\\\<^sup>\\\\<^bsub>x # S\\<^esub> fmap_copy \\ y x\"\n by (rule reds.Variable)\nnext\ncase (Let as \\ x S body i u b \\)\n assume \"validStack (\\(x f\\ Terms.Let as body)) x S\"\n\n hence \"validStack (\\(x f\\ body) f++ fmap_of (asToHeap as)) x S\"\n proof (rule validStack_cong)\n fix x'\n assume as: \"(depRel (\\(x f\\ Terms.Let as body)))\\<^sup>+\\<^sup>+ x' x\"\n hence \"x' \\ x\" by auto\n with as have \"x' \\ fdom \\\"\n by (auto dest:depRelTransDom)\n with Let(1)\n have \"atom x' \\ set (bn as)\" by (auto simp add: fresh_star_def fresh_Pair)\n hence \"x' \\ fdom (fmap_of (asToHeap as))\" \n by (metis (full_types) fdom_fmap_of_conv_heapVars imageI set_bn_to_atom_heapVars)\n with `x' \\ x`\n show \"lookup (\\(x f\\ Terms.Let as body)) x' =\n lookup (\\(x f\\ body) f++ fmap_of (asToHeap as)) x'\"\n by simp\n qed\n note hyps = Let(4-6)[OF this]\n\n case 1\n show ?case by (auto simp add: cycle_def)\n\n case 2\n from hyps(2)\n show ?case.\n\n case 3\n note Let(1-2) hyps(3)\n thus ?case..\nqed\n\nlemma remove_blackholing:\n assumes \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>\\\\<^bsub>S\\<^esub> \\\"\n shows \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>S\\<^esub> \\\"\nusing assms\napply (cases b, simp)\napply (induction \\ i u \"\\\" S \\ rule:reds.induct )\napply (blast intro:reds.intros)+\ndone\n\nlemma second_stack_element_unchanged:\n assumes \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>x#y#S\\<^esub> \\\"\n assumes \"x \\ y\"\n assumes \"depRel \\ y x\"\n shows \"lookup \\ y = lookup \\ y\"\nproof-\n from shorten_stack[OF assms(1), where n = 1]\n have \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>[x,y]\\<^esub> \\\" by simp\n moreover\n from assms(3)\n have \"validStack \\ x [y]\" by (fastforce intro: validStack.intros)\n ultimately\n have \"\\ \\\\<^sup>i\\<^sup>u\\<^sup>\\\\<^bsub>[x,y]\\<^esub> \\\" by (rule add_blackholing)\n from stack_unchanged[OF this, where x = y] assms(2)\n show ?thesis by auto\nqed\n\nlemma Application_x_unchanged:\n assumes \"\\(x f\\ App (Var n) y)(n f\\ e) \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>n # x # S\\<^esub> \\\"\n and \"n \\ x\"\n shows \"lookup \\ x = Some (App (Var n) y)\"\n using second_stack_element_unchanged[OF assms] assms(2) by auto\n\nlemma var_not_self:\n shows \"\\ (\\(x f\\ Var x) \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>x # S\\<^esub> \\)\"\nproof\n assume \"\\(x f\\ Var x) \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>x # S\\<^esub> \\\"\n from shorten_stack[OF this, where n = 0]\n have \"\\(x f\\ Var x) \\\\<^sup>i\\<^sup>u\\<^sup>b\\<^bsub>[x]\\<^esub> \\\" by simp\n hence \"\\(x f\\ Var x) \\\\<^sup>i\\<^sup>u\\<^sup>\\\\<^bsub>[x]\\<^esub> \\\" by (rule add_blackholing[OF _ ValidStackNil])\n thus False by cases (auto dest: fmap_upd_eqD1)\nqed\n\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/LaunchburyAddBH.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.25660249702779286}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\Derived Hoare Rules for Partial Correctness\\\n\ntheory HoarePartial imports HoarePartialProps begin\n\nlemma conseq_no_aux:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P' c Q',A';\n \\s. s \\ P \\ (s\\P' \\ (Q' \\ Q) \\ (A' \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule conseq [where P'=\"\\Z. P'\" and Q'=\"\\Z. Q'\" and A'=\"\\Z. A'\"]) auto\n\n\nlemma conseq_exploit_pre:\n \"\\\\s \\ P. \\,\\\\\\<^bsub>/F\\<^esub> ({s} \\ P) c Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply clarify\n apply (rule_tac x=\"{s} \\ P\" in exI) \n apply (rule_tac x=\"Q\" in exI) \n apply (rule_tac x=\"A\" in exI) \n by simp\n\n\nlemma conseq:\"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n \\s. s \\ P \\ (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule Conseq') blast\n\nlemma Lem: \"\\\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n P \\ {s. \\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A)}\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (unfold lem_def) \n apply (erule conseq)\n apply blast\n done\n\nlemma LemAnno:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq: \"P \\ {s. \\Z. s\\P' Z \\ (\\t. t \\ Q' Z \\ t \\ Q)}\"\nassumes lem: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n apply (rule Lem [OF lem])\n using conseq\n by blast\n\nlemma TrivPost: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n \\\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma conseq_under_new_pre:\"\\\\,\\\\\\<^bsub>/F \\<^esub>P' c Q',A';\n \\s \\ P. s \\ P' \\ Q' \\ Q \\ A' \\ A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P c Q,A\"\napply (rule conseq)\napply (rule allI)\napply assumption\napply auto\ndone\n\n\n\nlemma DynComConseq:\n assumes \"P \\ {s. \\P' Q' A'. \\,\\\\\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\ P \\ P' \\ Q' \\ Q \\ A' \\ A}\" \n shows \"\\,\\\\\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n using assms\n apply -\n apply (rule DynCom)\n apply clarsimp\n apply (rule Conseq)\n apply clarsimp\n apply blast\n done\n\nlemma SpecAnno: \n assumes consequence: \"P \\ {s. (\\ Z. s\\P' Z \\ (Q' Z \\ Q) \\ (A' Z \\ A))}\"\n assumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant: \"\\Z. c Z = c undefined\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n from spec bdy_constant\n have \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> ((P' Z)) (c undefined) (Q' Z),(A' Z)\"\n apply - \n apply (rule allI)\n apply (erule_tac x=Z in allE)\n apply (erule_tac x=Z in allE)\n apply simp\n done\n with consequence show ?thesis\n apply (simp add: specAnno_def)\n apply (erule conseq)\n apply blast\n done\nqed\n\nlemma SpecAnno': \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q) \\ (\\t. t \\ A' Z \\ t \\ A)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\n\nlemma SpecAnnoNoAbrupt: \n \"\\P \\ {s. \\ Z. s\\P' Z \\ \n (\\t. t \\ Q' Z \\ t \\ Q)};\n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n \\Z. c Z = c undefined\n \\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\ Q \\ \\,\\\\\\<^bsub>/F\\<^esub> P Skip Q,A\"\n by (rule hoarep.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\ {s. (f s) \\ Q} \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n by (rule hoarep.Basic [THEN conseqPre])\n\nlemma BasicCond: \n \"\\P \\ {s. (b s \\ f s\\Q) \\ (\\ b s \\ g s\\Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Basic (\\s. if b s then f s else g s) Q,A\"\n apply (rule Basic)\n apply auto\n done\n\nlemma Spec: \"P \\ {s. (\\t. (s,t) \\ r \\ t \\ Q) \\ (\\t. (s,t) \\ r)} \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoarep.Spec [THEN conseqPre])\n\nlemma SpecIf: \n \"\\P \\ {s. (b s \\ f s \\ Q) \\ (\\ b s \\ g s \\ Q \\ h s \\ Q)}\\ \\\n \\,\\\\\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n apply (rule Spec)\n apply (auto simp add: if_rel_def)\n done\n\n\nlemma Seq [trans, intro?]: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (rule hoarep.Seq)\n\nlemma SeqSwap: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c1 R,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Seq c1 c2) Q,A\"\n by (rule Seq)\n\nlemma BSeq:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n by (unfold bseq_def) (rule Seq)\n\n\nlemma Cond: \n assumes wp: \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoarep.Cond [THEN conseqPre])\n from deriv_c1 \n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ b) c\\<^sub>1 Q,A\"\n by (rule conseqPre) blast\nnext\n from deriv_c2 \n show \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. (s \\ b \\ s \\ P\\<^sub>1) \\ (s \\ b \\ s \\ P\\<^sub>2)} \\ - b) c\\<^sub>2 Q,A\"\n by (rule conseqPre) blast\nnext\n show \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" by (rule wp)\nqed \n\n\nlemma CondSwap: \n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A; P \\ {s. (s\\b \\ s\\P1) \\ (s\\b \\ s\\P2)}\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond)\n\nlemma Cond': \n \"\\P \\ {s. (b \\ P1) \\ (- b \\ P2)};\\,\\\\\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P2 c2 Q,A\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule CondSwap) blast+\n\nlemma CondInv: \n assumes wp: \"P \\ Q\" \n assumes inv: \"Q \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from wp inv\n have \"P \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\"\n by blast\n from Cond [OF this deriv_c1 deriv_c2]\n show ?thesis .\nqed\n\nlemma CondInv': \n assumes wp: \"P \\ I\" \n assumes inv: \"I \\ {s. (s\\b \\ s\\P\\<^sub>1) \\ (s\\b \\ s\\P\\<^sub>2)}\" \n assumes wp': \"I \\ Q\" \n assumes deriv_c1: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n from CondInv [OF wp inv deriv_c1 deriv_c2]\n have \"\\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\".\n from conseqPost [OF this wp' subset_refl]\n show ?thesis .\nqed\n \n\nlemma switchNil:\n \"P \\ Q \\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n by (simp add: Skip)\n \nlemma switchCons:\n \"\\P \\ {s. (v s \\ V \\ s \\ P\\<^sub>1) \\ (v s \\ V \\ s \\ P\\<^sub>2)}; \n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n \\,\\\\\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\\n\\ \\,\\\\\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n by (simp add: Cond)\n\nlemma Guard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guard)\n\nlemma Guarantee:\n \"\\P \\ {s. s \\ g \\ s \\ R}; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\ g \\ s \\ R}\"])\napply assumption\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ {s. s \\ g \\ s \\ R}; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule Guarantee)\n\nlemma GuardStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\P \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ R; f \\ F\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\P \\ g \\ R; \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (unfold guaranteeStrip_def) (rule Guard)\n\n\nlemma GuaranteeAsGuardSwap:\n \"\\ \\,\\\\\\<^bsub>/F\\<^esub> R c Q,A; P \\ g \\ R\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While: \n assumes P_I: \"P \\ I\" \n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> (I \\ b) c I,A\"\n assumes I_Q: \"I \\ -b \\ Q\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n from deriv_body P_I I_Q\n show ?thesis\n apply (simp add: whileAnno_def)\n apply (erule conseqPrePost [OF HoarePartialDef.While]) \n apply simp_all\n done\nqed\n\ntext \\@{term \"J\"} will be instantiated by tactic with @{term \"gs' \\ I\"} for\n those guards that are not stripped.\\ \nlemma WhileAnnoG:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnno b J V (Seq c (guards gs Skip)))) Q,A \n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n by (simp add: whileAnnoG_def whileAnno_def while_def)\n\n\ntext \\This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"}\\\n\n\n\n\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n \"\\,\\\\\\<^bsub>/F\\<^esub> P (guards gs \n (whileAnnoFix b J V (\\Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n using whileAnnoFix\n by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n assumes adapt: \"P \\ {s. s \\ P' s}\" \n assumes c: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (bind e c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\napply (rule allI)\napply (unfold bind_def)\napply (rule DynCom)\napply (rule ballI)\napply simp\napply (rule conseqPre)\napply (rule c [rule_format])\napply blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ init s \\ P' Z}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ R Z t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule bdy [rule_format])\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma BlockSwap:\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\nusing adapt bdy c \n by (rule Block)\n\n\nlemma BlockSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes bdy: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\Z. {s. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\" and Q'=\"\\Z. Q\" and \nA'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ R s t}\" in SeqSwap )\napply (rule_tac P'=\"\\Z'. {t. t=Z' \\ return s t \\ R s t}\" and \n Q'=\"\\Z'. Q\" and A'=\"\\Z'. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply (clarsimp)\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\ A}\" in Catch)\napply (rule_tac R=\"{i. i \\ P' Z}\" in Seq)\napply (rule Basic)\napply clarsimp\napply simp\napply (rule conseq [OF bdy])\napply clarsimp\napply blast\napply (rule SeqSwap)\napply (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma Throw: \"P \\ A \\ \\,\\\\\\<^bsub>/F\\<^esub> P Throw Q,A\"\n by (rule hoarep.Throw [THEN conseqPre])\n\nlemmas Catch = hoarep.Catch\nlemma CatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n by (rule hoarep.Catch)\n\nlemma raise: \"P \\ {s. f s \\ A} \\ \\,\\\\\\<^bsub>/F\\<^esub> P raise f Q,A\"\n apply (simp add: raise_def)\n apply (rule Seq)\n apply (rule Basic)\n apply (assumption)\n apply (rule Throw)\n apply (rule subset_refl)\n done\n\nlemma condCatch: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A));\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n apply (simp add: condCatch_def)\n apply (rule Catch)\n apply assumption\n apply (rule CondSwap)\n apply (assumption)\n apply (rule hoarep.Throw)\n apply blast\n done\n\nlemma condCatchSwap: \"\\\\,\\\\\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A;\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\ R) \\ (-b \\ A))\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n by (rule condCatch)\n\n\nlemma ProcSpec:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def) \nby (rule BlockSpec)\n\nlemma ProcSpec':\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t \\ Q' Z. return s t \\ R s t) \\\n (\\t \\ A' Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\nlemma ProcSpecNoAbrupt:\n assumes adapt: \"P \\ {s. \\Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall: \n\"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return (\\s t. c (result t))) Q,A\n\\ \\,\\\\\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n by (simp add: fcall_def)\n\n\nlemma ProcRec:\n assumes deriv_bodies: \n \"\\p\\Procs. \n \\Z. \\,\\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n by (intro strip)\n (rule CallRec' \n [OF _ Procs_defined deriv_bodies],\n simp_all)\n\nlemma ProcRec':\n assumes ctxt: \"\\' = \\\\(\\p\\Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\"\n assumes deriv_bodies: \n \"\\p\\Procs. \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes Procs_defined: \"Procs \\ dom \\\"\n shows \"\\p\\Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using ctxt deriv_bodies\n apply simp\n apply (erule ProcRec [OF _ Procs_defined])\n done\n\n\nlemma ProcRecList:\n assumes deriv_bodies: \n \"\\p\\set Procs. \n \\Z. \\,\\\\(\\p\\set Procs. \\Z. {(P p Z,p,Q p Z,A p Z)})\n \\\\<^bsub>/F\\<^esub> (P p Z) (the (\\ p)) (Q p Z),(A p Z)\"\n assumes dist: \"distinct Procs\"\n assumes Procs_defined: \"set Procs \\ dom \\\"\n shows \"\\p\\set Procs. \\Z. \\,\\\\\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n using deriv_bodies Procs_defined\n by (rule ProcRec)\n\nlemma ProcRecSpecs:\n \"\\\\(P,p,Q,A) \\ Specs. \\,\\\\Specs\\\\<^bsub>/F\\<^esub> P (the (\\ p)) Q,A;\n \\(P,p,Q,A) \\ Specs. p \\ dom \\\\\n \\ \\(P,p,Q,A) \\ Specs. \\,\\\\\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (auto intro: CallRec)\ndone\n\n\nlemma ProcRec1:\n assumes deriv_body: \n \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n from deriv_body p_defined\n have \"\\p\\{p}. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n by - (rule ProcRec [where A=\"\\p. A\" and P=\"\\p. P\" and Q=\"\\p. Q\"],\n simp_all)\n thus ?thesis\n by simp\nqed\n\nlemma ProcNoRec1:\n assumes deriv_body: \n \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n assumes p_def: \"p \\ dom \\\"\n shows \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\nfrom deriv_body\n have \"\\Z. \\,\\\\(\\Z. {(P Z,p,Q Z,A Z)})\n \\\\<^bsub>/F\\<^esub> (P Z) (the (\\ p)) (Q Z),(A Z)\"\n by (blast intro: hoare_augment_context)\n from this p_def\n show ?thesis \n by (rule ProcRec1)\nqed\n\nlemma ProcBody:\n assumes WP: \"P \\ P'\"\n assumes deriv_body: \"\\,\\\\\\<^bsub>/F\\<^esub> P' body Q,A\" \n assumes body: \"\\ p = Some body\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\Z. P'\" and Q=\"\\Z. Q\" and A=\"\\Z. A\"]) \napply (insert body)\napply simp\napply (rule hoare_augment_context [OF deriv_body])\napply blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\ {s. init s \\ P' s}\"\nassumes bdy: \"\\s. \\,\\\\\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\ R s t},{t. return s t \\ A}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\ p = Some body\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\=\\, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoarePartialProps.ProcModifyReturn \nlemmas ProcModifyReturnSameFaults = HoarePartialProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\nlemma ProcModifyReturnNoAbrSameFaults:\n assumes spec: \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes result_conform:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc: \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\Z. {s. s=Z \\ s \\ P}\"\n and Q'=\"\\Z. Q\" and A'=\"\\Z. A\"])\nprefer 2\nusing adapt\napply blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule DynCom)\napply clarsimp\napply (rule DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply (rule CatchSwap)\napply (rule SeqSwap)\napply (rule Throw) \napply (rule subset_refl)\napply (rule Basic)\napply (rule subset_refl)\napply (rule_tac R=\"{i. i \\ P' Z Z'}\" in Seq)\napply (rule Basic) \napply clarsimp\napply simp\napply (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply clarsimp\napply simp\napply clarsimp\napply (rule_tac P'=\"\\Z''. {t. t=Z'' \\ return Z t \\ R Z t}\" and \n Q'=\"\\Z''. Q\" and A'=\"\\Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply clarsimp\napply (rule SeqSwap)\napply (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc': \n assumes adapt: \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t \\ Q' s Z. return s t \\ R s t) \\\n (\\t \\ A' s Z. return s t \\ A)}\"\n assumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n assumes p: \"\\s\\ P. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n from adapt have \"P \\ {s. \\Z. init s \\ P' s Z \\\n (\\t. t \\ Q' s Z \\ return s t \\ R s t) \\\n (\\t. t \\ A' s Z \\ return s t \\ A)}\"\n by blast\n from this c p show ?thesis\n by (rule DynProc)\nqed\n\n\nlemma DynProcStaticSpec: \nassumes adapt: \"P \\ {s. s \\ S \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\s\\S. \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from adapt have P_S: \"P \\ S\"\n by blast\n have \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ S) (dynCall init p return c) Q,A\"\n apply (rule DynProc [where P'=\"\\s Z. P' Z\" and Q'=\"\\s Z. Q' Z\" \n and A'=\"\\s Z. A' Z\", OF _ c])\n apply clarsimp\n apply (frule in_mono [rule_format, OF adapt])\n apply clarsimp\n using spec\n apply clarsimp\n done\n thus ?thesis\n by (rule conseqPre) (insert P_S,blast)\nqed\n\n\nlemma DynProcProcPar: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\) \\\n (\\\\. \\ \\ A' Z \\ return s \\ \\ A))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n using spec\n apply simp\n done\n\n\nlemma DynProcProcParNoAbrupt: \nassumes adapt: \"P \\ {s. p s = q \\ (\\Z. init s \\ P' Z \\ \n (\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\))}\"\nassumes c: \"\\s t. \\,\\\\\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof - \n have \"P \\ {s. p s = q \\ (\\ Z. init s \\ P' Z \\ \n (\\t. t \\ Q' Z \\ return s t \\ R s t) \\\n (\\t. t \\ {} \\ return s t \\ A))}\"\n (is \"P \\ ?P'\")\n proof \n fix s\n assume P: \"s\\P\"\n with adapt obtain Z where\n Pre: \"p s = q \\ init s \\ P' Z\" and\n adapt_Norm: \"\\\\. \\ \\ Q' Z \\ return s \\ \\ R s \\\" \n by blast\n from adapt_Norm \n have \"\\t. t \\ Q' Z \\ return s t \\ R s t\"\n by auto\n then\n show \"s\\?P'\"\n using Pre by blast\n qed\n note P = this\n show ?thesis\n apply -\n apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n apply (insert spec)\n apply auto\n done\nqed\n\n\nlemma DynProcModifyReturnNoAbr: \n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then \n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturn)\nqed\n\n\nlemma ProcDynModifyReturnNoAbrSameFaults: \n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from ret_nrm_modif\n have \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by iprover\n then\n have ret_nrm_modif': \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n by simp\n have ret_abr_modif': \"\\s t. t \\ {} \n \\ return' s t = return s t\"\n by simp\n from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n by (rule dynProcModifyReturnSameFaults)\nqed\n\n\nlemma ProcProcParModifyReturn: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturn) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes ret_abr_modif: \"\\s t. t \\ (ModifAbr (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call q (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n ret_abr_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnNoAbr: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma ProcProcParModifyReturnNoAbrSameFaults: \n assumes q: \"P \\ {s. p s = q} \\ P'\"\n \\\\@{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n first conjunction in @{term P'}, so the vcg can simplify it.\\\n assumes to_prove: \"\\,\\\\\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n assumes ret_nrm_modif: \"\\s t. t \\ (Modif (init s)) \n \\ return' s t = return s t\"\n assumes modif_clause: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call q) (Modif \\),{}\"\n shows \"\\,\\\\\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n from to_prove have \n \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return' c) Q,A\"\n by (rule conseqPre) blast\n from this ret_nrm_modif \n have \"\\,\\\\\\<^bsub>/F\\<^esub> ({s. p s = q} \\ P') (dynCall init p return c) Q,A\"\n by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n from this q show ?thesis\n by (rule conseqPre) \nqed\n\nlemma MergeGuards_iff: \"\\,\\\\\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip': \n assumes deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n from deriv_strip_triv have deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n by (auto intro: hoare_augment_context)\n from deriv_strip [simplified c'']\n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n by (rule MarkGuardsD)\n with deriv \n have \"\\,\\\\\\<^bsub>/{}\\<^esub> P c' Q,A\"\n by (rule CombineStrip)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n by (rule MarkGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n by (rule MergeGuardsI)\n hence \"\\,\\\\\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n by (simp add: c)\n thus ?thesis\n by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'': \n assumes deriv: \"\\,\\\\\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n assumes deriv_strip_triv: \"\\,{}\\\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n shows \"\\,\\\\\\<^bsub>/{}\\<^esub> P c Q,A\"\n apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c]) \n apply (insert c'')\n apply (subgoal_tac \"- {True} = {False}\")\n apply auto\n done\n\nlemma AsmUN:\n \"(\\Z. {(P Z, p, Q Z,A Z)}) \\ \\ \n \\ \n \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n by (blast intro: hoarep.Asm)\n\nlemma augment_context': \n \"\\\\ \\ \\'; \\Z. \\,\\\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \n \\ \\Z. \\,\\'\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_augment_context)\n\n\nlemma hoarep_strip: \n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z); F' \\ -F\\ \\ \n \\Z. strip F' \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (iprover intro: hoare_strip_\\)\n\nlemma augment_emptyFaults:\n \"\\\\Z. \\,{}\\\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\\\Z. \\,{}\\\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\ \\ \n \\Z. \\,{}\\\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI)\n\nlemma PostConjI' :\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \n \\ \\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\n by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]: \n assumes conj: \"\\,\\\\\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\" \n assumes E: \"\\\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A; \\,\\\\\\<^bsub>/F\\<^esub> P c R,B\\ \\ S\"\n shows \"S\"\nproof -\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n moreover\n from conj have \"\\,\\\\\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n ultimately show \"S\" \n by (rule E)\nqed\n\n\nsubsection \\Rules for Single-Step Proof \\label{sec:hoare-isar}\\\n\ntext \\\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar. \n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates. Reversed order is supported as well.\n\\\n\nlemma annotateI [trans]:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A; c = anno\\ \\ \\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\" \n by simp\n\nlemma annotate_normI:\n assumes deriv_anno: \"\\,\\\\\\<^bsub>/F\\<^esub>P anno Q,A\" \n assumes norm_eq: \"normalize c = normalize anno\" \n shows \"\\,\\\\\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n from NormalizeI [OF deriv_anno] norm_eq\n have \"\\,\\\\\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n by simp\n from NormalizeD [OF this]\n show ?thesis .\nqed\n\nlemma annotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\\\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\ \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\ P \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P' c Q,A\"\n by (rule conseqPre)\n \nlemma [trans]: \"Q \\ Q' \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P c Q',A\"\n by (rule conseqPost) blast+\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ (\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"(\\s. P' s \\ P s) \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n by (rule conseqPre) auto\n\nlemma [trans]:\n \"\\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ (\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [trans]:\n \"(\\s. Q s \\ Q' s) \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q s},A \\ \\,\\\\\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n by (rule conseqPost) auto\n\nlemma [intro?]: \"\\,\\\\\\<^bsub>/F\\<^esub> P Skip P,A\"\n by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\\\n \\\n \\,\\\\\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n by (rule Cond) auto\n \nlemma CondConj [trans, intro?]:\n \"\\\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c1 Q,A; \\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ \\ b s} c2 Q,A\\\n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n by (rule Cond) auto\n \nlemma WhileInvInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A \\ \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b P V c) (P \\ -b),A\"\n by (rule While) auto\n\nlemma WhileInt [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> (P \\ b) c P,A \n \\ \n \\,\\\\\\<^bsub>/F\\<^esub> P (whileAnno b {s. undefined} V c) (P \\ -b),A\"\n by (unfold whileAnno_def) \n (rule HoarePartialDef.While [THEN conseqPrePost],auto)\n\nlemma WhileInvConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\ \\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. P s} V c) {s. P s \\ \\ b s},A\"\n by (simp add: While Collect_conj_eq Collect_neg_eq)\n\nlemma WhileConj [intro?]:\n \"\\,\\\\\\<^bsub>/F\\<^esub> {s. P s \\ b s} c {s. P s},A\n \\ \n\\,\\\\\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. undefined} V c) {s. P s \\ \\ b s},A\"\n by (unfold whileAnno_def) \n (simp add: HoarePartialDef.While [THEN conseqPrePost] \n Collect_conj_eq Collect_neg_eq)\n\n(* FIXME: Add rules for guarded while *)\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoarePartial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2566024970277928}} {"text": "section {*L\\_ATS\\_determHIST\\_SDB*}\ntheory\n L_ATS_determHIST_SDB\n\nimports\n L_ATS_determHIST_DB\n L_ATS_determHIST_SB\n\nbegin\n\nlocale ATS_determHIST_SDB =\n ATS_SchedF_SDB\n \"TSstructure :: 'TSstructure \\ bool\"\n \"configurations :: 'TSstructure \\ 'conf set\"\n \"initial_configurations :: 'TSstructure \\ 'conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"step_relation :: 'TSstructure \\ 'conf \\ 'label \\ 'conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event set\"\n \"marking_condition :: 'TSstructure \\ ('label, 'conf) derivation \\ bool\"\n \"marked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"unmarked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"fixed_schedulers :: 'TSstructure \\ 'fixed_scheduler set\"\n \"empty_fixed_scheduler :: 'TSstructure \\ 'fixed_scheduler\"\n \"fixed_scheduler_extendable :: 'TSstructure \\ 'fixed_scheduler \\ bool\"\n \"get_fixed_scheduler :: 'conf \\ 'fixed_scheduler\"\n \"get_fixed_scheduler_DB :: 'TSstructure \\ ('label, 'conf) derivation \\ nat \\ 'fixed_scheduler\"\n +\n ATS_determHIST_SB\n \"TSstructure :: 'TSstructure \\ bool\"\n \"configurations :: 'TSstructure \\ 'conf set\"\n \"initial_configurations :: 'TSstructure \\ 'conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"step_relation :: 'TSstructure \\ 'conf \\ 'label \\ 'conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event set\"\n \"marking_condition :: 'TSstructure \\ ('label, 'conf) derivation \\ bool\"\n \"marked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"unmarked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"histories :: 'TSstructure \\ 'history set\"\n \"history_fragments :: 'TSstructure \\ 'history_fragment set\"\n \"empty_history :: 'TSstructure \\ 'history\"\n \"empty_history_fragment :: 'TSstructure \\ 'history_fragment\"\n \"set_history :: 'conf \\ 'history \\ 'conf\"\n \"extend_history :: 'history \\ 'history_fragment \\ 'history\"\n \"join_history_fragments :: 'history_fragment \\ 'history_fragment \\ 'history_fragment\"\n \"get_history :: 'conf \\ 'history\"\n \"fixed_schedulers :: 'TSstructure \\ 'fixed_scheduler set\"\n \"empty_fixed_scheduler :: 'TSstructure \\ 'fixed_scheduler\"\n \"fixed_scheduler_extendable :: 'TSstructure \\ 'fixed_scheduler \\ bool\"\n \"get_fixed_scheduler :: 'conf \\ 'fixed_scheduler\"\n +\n ATS_determHIST_DB\n \"TSstructure :: 'TSstructure \\ bool\"\n \"configurations :: 'TSstructure \\ 'conf set\"\n \"initial_configurations :: 'TSstructure \\ 'conf set\"\n \"step_labels :: 'TSstructure \\ 'label set\"\n \"step_relation :: 'TSstructure \\ 'conf \\ 'label \\ 'conf \\ bool\"\n \"effects :: 'TSstructure \\ 'event set\"\n \"marking_condition :: 'TSstructure \\ ('label, 'conf) derivation \\ bool\"\n \"marked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"unmarked_effect :: 'TSstructure \\ ('label, 'conf) derivation \\ 'event set\"\n \"histories :: 'TSstructure \\ 'history set\"\n \"history_fragments :: 'TSstructure \\ 'history_fragment set\"\n \"empty_history :: 'TSstructure \\ 'history\"\n \"empty_history_fragment :: 'TSstructure \\ 'history_fragment\"\n \"set_history :: 'conf \\ 'history \\ 'conf\"\n \"extend_history :: 'history \\ 'history_fragment \\ 'history\"\n \"join_history_fragments :: 'history_fragment \\ 'history_fragment \\ 'history_fragment\"\n \"get_history :: 'conf \\ 'history\"\n \"fixed_schedulers :: 'TSstructure \\ 'fixed_scheduler set\"\n \"empty_fixed_scheduler :: 'TSstructure \\ 'fixed_scheduler\"\n \"fixed_scheduler_extendable :: 'TSstructure \\ 'fixed_scheduler \\ bool\"\n \"get_fixed_scheduler_DB :: 'TSstructure \\ ('label, 'conf) derivation \\ nat \\ 'fixed_scheduler\"\n for\n TSstructure configurations initial_configurations step_labels step_relation effects marking_condition marked_effect unmarked_effect fixed_schedulers empty_fixed_scheduler fixed_scheduler_extendable get_fixed_scheduler get_fixed_scheduler_DB histories history_fragments empty_history empty_history_fragment set_history extend_history join_history_fragments get_history\n\ncontext ATS_determHIST_SDB begin\n\nlemma AX_is_forward_edge_deterministic_correspond_DB_SB: \"\n TSstructure G\n \\ is_forward_edge_deterministicHist_SB_long G = is_forward_edge_deterministicHist_DB_long G\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(simp add: is_forward_edge_deterministicHist_SB_long_def is_forward_edge_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(erule_tac\n x=\"c\"\n in ballE)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"e2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"w1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"w2\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e1 c1) n) (Suc n)) = ((get_fixed_scheduler c1))\")\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e2 c2) n) (Suc n)) = ((get_fixed_scheduler c2))\")\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n apply(simp add: get_accessible_configurations_def)\n apply(simp add: is_forward_edge_deterministicHist_SB_long_def is_forward_edge_deterministicHist_DB_long_def get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(erule_tac\n x=\"e1\"\n in allE)\n apply(erule_tac\n x=\"e2\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"w1\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"w2\"\n in allE)\n apply(clarsimp)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e1 c1) i) (Suc i)) = ((get_fixed_scheduler c1))\")\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e2 c2) i) (Suc i)) = ((get_fixed_scheduler c2))\")\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d c1 c2 e1 e2 i w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n done\n\nlemma AX_is_forward_target_deterministic_correspond_DB_SB: \"\n TSstructure G\n \\ is_forward_target_deterministicHist_SB_long G = is_forward_target_deterministicHist_DB_long G\"\n apply(rule order_antisym)\n apply(clarsimp)\n apply(simp add: is_forward_target_deterministicHist_SB_long_def is_forward_target_deterministicHist_DB_long_def)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(erule_tac\n x=\"c\"\n in ballE)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"w1\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"w2\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e c1) n) (Suc n)) = ((get_fixed_scheduler c1))\")\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e c2) n) (Suc n)) = ((get_fixed_scheduler c2))\")\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d n c1 c2 e w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d n\")\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d n c1 c2 e w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d n c1 c2 e w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d n c1 c2 e w1 w2)(*strict*)\n apply(simp add: get_accessible_configurations_def)\n apply(simp add: is_forward_target_deterministicHist_SB_long_def is_forward_target_deterministicHist_DB_long_def get_accessible_configurations_def)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(erule_tac\n x=\"c\"\n in allE)\n apply(erule_tac\n x=\"d\"\n in allE)\n apply(erule_tac\n x=\"i\"\n in allE)\n apply(clarsimp)\n apply(erule_tac\n x=\"c1\"\n in allE)\n apply(erule_tac\n x=\"c2\"\n in allE)\n apply(erule impE)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule_tac\n x=\"e\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"w1\"\n in exI)\n apply(clarsimp)\n apply(rule_tac\n x=\"w2\"\n in exI)\n apply(clarsimp)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e c1) i) (Suc i)) = ((get_fixed_scheduler c1))\")\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(subgoal_tac \"(get_fixed_scheduler_DB G (derivation_append d (der2 c e c2) i) (Suc i)) = ((get_fixed_scheduler c2))\")\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 i e w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 i e w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule AX_state_based_vs_derivation_based_get_fixed_scheduler)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation_initial)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_append_preserves_derivation)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(rule der2_is_derivation)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(case_tac \"d i\")\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(force)\n apply(rename_tac c d c1 c2 i e w1 w2 a)(*strict*)\n apply(clarsimp)\n apply(case_tac a)\n apply(rename_tac c d c1 c2 i e w1 w2 a option b)(*strict*)\n apply(clarsimp)\n apply(rename_tac c d c1 c2 i e w1 w2 option)(*strict*)\n apply(simp add: der2_def)\n apply(rename_tac c d c1 c2 i e w1 w2)(*strict*)\n apply(simp add: derivation_append_def der2_def)\n done\n\nlemma is_forward_deterministic_correspond_DB_SB: \"\n TSstructure G\n \\ is_forward_deterministicHist_SB G = is_forward_deterministicHist_DB G\"\n apply (metis AX_is_forward_edge_deterministic_correspond_DB_SB AX_is_forward_target_deterministic_correspond_DB_SB is_forward_deterministicHist_DB_def is_forward_deterministicHist_SB_def)\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_04/L_ATS_determHIST_SDB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.3960681662740417, "lm_q1q2_score": 0.25657224691369834}} {"text": "theory flash110Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX10VsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX10_homeVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX11VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv110: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_WbVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX1VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_I )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' Home) ) ( Const true )) ) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''procCmd'' Home) ) ( Const NODE_None )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Local_PutXVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv110: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv110 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_GetVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv110: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv110 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv110: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv110 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash110Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.25655460727394686}} {"text": "theory RCU_Lems imports OpSem_ProofRules \"HOL-Hoare_Parallel.OG_Syntax\"\nbegin\n\n\n(*\nlemma d_obs_diff_false [simp]:\n assumes \"[x =\\<^sub>t u] \\\"\nand \"[x =\\<^sub>t' v] \\\"\nand \"u \\ v\"\nshows \"False\"\n using assms\n by (simp add: d_obs_def d_obs_t_def) \n*)\n\nlemma p_obs_contradiction_2 :\n assumes \"wfs \\\"\n and \"\\ [x \\\\<^sub>t v] \\\"\n and \" getVW \\ t' y = w\"\nshows \"\\ [x \\\\<^sub>t v] (read_trans t' b w \\)\"\n using OpSemExtProof.p_obs_contradiction assms(1) assms(2) assms(3) by blast\n\n\nlemma not_p_obs_other_value :\n assumes \"wfs \\\"\n and \"\\[x \\\\<^sub>t u] \\\"\n and \"var w = x\"\n and \"ts' = getTS \\ w\"\n and \"u \\ v\"\n and \"t \\ t'\"\n shows \"\\[x \\\\<^sub>t u] (write_trans t' b w v \\ ts')\"\n using assms\n apply simp\n apply(unfold write_trans_def rev_app_def update_wa_def update_thrView_def update_modView_def update_mods_def)\n apply simp\n apply (unfold p_obs_def)\n apply safe\n apply(simp add: value_def)\n\n apply(case_tac \"a = var w \\ ba = getTS \\ w\", simp_all)\n apply(simp add: visible_writes_def)\n unfolding writes_on_def apply clarsimp \n by blast\n\nlemma c_obs_same_var_read_pres[simp]:\n assumes \"wfs \\\"\nand \" [x = u]\\x =\\<^sub>t u\\ \\\"\nand \"w = getVW \\ t' y\"\nshows \"[x = u]\\x =\\<^sub>t u\\ (read_trans t' b w \\)\"\n using assms\n apply (case_tac \"x \\ y\")\n apply(simp add: c_obs_def visible_writes_def value_def d_obs_def)\n apply(simp add: read_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n apply(case_tac \"x = var (getVW \\ t y)\", simp_all)\n apply (simp add: getVW_var)\n apply safe\n apply(simp_all add:releasing_def)\n apply (smt fun_upd_other order.trans ts_oride_def)\n apply (smt fun_upd_other order.trans ts_oride_def)\n apply (smt fun_upd_other order.trans ts_oride_def)\n apply(simp add: c_obs_def visible_writes_def value_def d_obs_def)\n apply(simp add: read_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n apply safe\n apply(simp_all add:releasing_def visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n apply (smt CollectD dual_order.trans getVW_in_vw ts_oride_same_var visible_writes_def)\n by (simp add: getVW_var)+\n\n(*\"x = var w\"*)\nlemma c_obs_same_var_write_pres[simp]:\n assumes \"wfs \\\"\nand \"[x =\\<^sub>t u] \\\"\nand \"\\ [x \\\\<^sub>t' u] \\\"\nand \"w = getVWNC \\ t x\" \nand \"ts' = getTS \\ w\"\nshows \"[x = u]\\x =\\<^sub>t' u\\ (write_trans t b w u \\ ts')\"\n using assms\n apply(simp add: c_obs_def visible_writes_def value_def d_obs_def)\n apply(simp add: write_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n by (metis d_obs_def d_obs_t_def lastWr_visible p_obs_def)\n\n\n\nlemma c_obs_same_var_write_pres_diff[simp]:\n assumes \"wfs \\\"\nand \"[x =\\<^sub>t v] \\\"\nand \"\\ [x \\\\<^sub>t' u] \\\"\nand \"getVWNC \\ t x = w\"\nand \"ts' = getTS \\ w\"\nshows \"[x = u]\\x =\\<^sub>t' u\\ (write_trans t True w u \\ ts')\"\nproof - \n from assms have a1: \"[x =\\<^sub>t u] (write_trans t True w u \\ ts')\"\n using OpSemExtProof.ext_d_obs_d_obs by blast\n show ?thesis\n using assms a1\n apply(simp add: c_obs_def p_obs_def d_obs_t_def visible_writes_def value_def d_obs_def)\n apply(simp add: write_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n apply safe\n apply (simp_all add: getVW_var releasing_def)\n apply auto[2]\n apply (metis (no_types, lifting) assms(2) d_obs_def d_obs_t_def dual_order.trans getTS_w_greater_tst_w getVWNC_lastWr less_eq_rat_def snd_conv)\n apply (metis (no_types, lifting) assms(2) d_obs_def d_obs_t_def dual_order.trans getTS_w_greater_tst_w getVWNC_lastWr less_eq_rat_def snd_conv)\n by blast+\nqed\n\n\n\n\nlemma c_obs_same_var_write_same_var_pres[simp]:\n assumes \"wfs \\\"\nand \" [x = u]\\x =\\<^sub>t u\\ \\\"\nand \"w = getVWNC \\ t' x\"\nand \"ts' = getTS \\ w\"\nand \"[x =\\<^sub>t' z] \\\"\nand \"v \\ u\"\nand \"z \\ u\"\nshows \"[x = u]\\x =\\<^sub>t u\\ (write_trans t' b w v \\ ts')\"\n using assms\n apply(simp add: c_obs_def visible_writes_def value_def d_obs_def d_obs_t_def)\n apply(simp add: write_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n apply(case_tac \"x \\ var (getVWNC \\ t' x)\", simp_all)\n apply (simp add: getVWNC_var)\n apply(case_tac \"t = t'\", simp_all)\n apply(simp_all add: releasing_def)\n apply(intro conjI impI allI)\n apply (metis (no_types, lifting) assms(5) d_obs_def d_obs_t_def dual_order.strict_trans getVWNC_in_writes_on getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 not_le_imp_less order.not_eq_order_implies_strict) \n apply (metis (no_types, lifting) assms(5) d_obs_def d_obs_t_def dual_order.strict_trans getVWNC_in_writes_on getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 not_le_imp_less order.not_eq_order_implies_strict)\n apply (metis (no_types, lifting) assms(5) d_obs_def d_obs_t_def dual_order.strict_trans getVWNC_in_writes_on getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 not_le_imp_less order.not_eq_order_implies_strict)\n by (metis (no_types, lifting) assms(5) d_obs_def d_obs_t_def dual_order.strict_trans getVWNC_in_writes_on getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 not_le_imp_less order.not_eq_order_implies_strict)\n\n\n\nlemma c_obs_write_diff_var_pres[simp]:\n assumes \"wfs \\\"\nand \" [x = u]\\x =\\<^sub>t u\\ \\\"\nand \" y \\x\"\nand \"w = getVWNC \\ t' y\"\nand \"ts' = getTS \\ w\"\nshows \"[x = u]\\x =\\<^sub>t u\\ (write_trans t' b w v \\ ts')\"\n using assms\n apply(simp add: c_obs_def visible_writes_def value_def d_obs_def d_obs_t_def)\n apply(simp add: write_trans_def rev_app_def)\n apply(unfold writes_on_def lastWr_def, simp)\n apply(simp add: update_wa_def update_thrView_def update_mods_def update_modView_def)\n apply(case_tac \"x \\ var (getVWNC \\ t' x)\", simp_all)\n apply (simp add: getVWNC_var)\n apply(case_tac \"t = t'\", simp_all)\n apply(simp_all add: releasing_def)\n apply(intro conjI impI allI)\n apply (simp_all add: getVWNC_var) \n apply (metis fst_conv)\n apply (smt Collect_cong fst_conv)\n apply (metis fst_conv)\n apply (smt Collect_cong fst_conv)\n by (smt Collect_cong fst_conv)\n\n \nlemma no_val_maintain:\n assumes \"wfs \\\"\nand \"[\\\\<^sub>x u]\\<^sub>i \\\"\nand \"getVWNC \\ t y = w\"\nand \"y \\ x\"\nand \"getTS \\ w = ts'\"\nshows \"[\\\\<^sub>x u]\\<^sub>i (write_trans t b w v \\ ts')\"\n using assms\n apply(simp add: no_val_def p_vorder_def value_def mo_def init_val_def)\n apply(elim conjE impE exE)\n apply (simp add: write_trans_def)\n apply safe\n apply(subgoal_tac \"var w = y\", simp)\n prefer 2\n apply (simp add: getVWNC_var)\n apply (simp add: rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n apply (unfold writes_on_def, clarsimp)\n apply metis\n apply (simp add: rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n apply (clarsimp) \n by (simp add: getVWNC_var)\n\nlemma d_order_stable:\n assumes \"wfs \\\"\nand \"[i \\\\<^sub>x u] \\\"\nshows \"[i \\\\<^sub>x u] (read_trans t' b w \\)\"\n using assms\n by(simp add: d_vorder_def p_vorder_def value_def)\n\n(*\nlemma dvorder_intro:\n assumes \"wfs \\\"\n and \"[\\\\<^sub>x u] \\\"\n and \"[\\\\<^sub>x v]\\<^sub>i \\\"\nand \"[x =\\<^sub>t u] \\\"\nand \"w = getVWNC \\ t x\"\nand \"ts' = getTS \\ w\"\nand \"v \\ u\"\nand \"i \\ u\"\nand \"i \\ v\"\nshows \"[u \\\\<^sub>x v] (write_trans t b w v \\ ts')\"\n*)\n\nlemma no_val_d_order:\n assumes \"wfs \\\"\nand \"[x =\\<^sub>t i] \\\"\nand \"[\\\\<^sub>x u]\\<^sub>i \\\"\nand \"getVWNC \\ t x = w\"\nand \"getTS \\ w = ts'\"\nand \"u \\ i\"\nshows \"[i \\\\<^sub>x u] (write_trans t b w u \\ ts')\"\nproof - \n have a1: \"[en x i]\\<^sub>t \\\"\n using assms\n apply(simp add: no_val_def enc_t_def enc_def value_def mo_def init_val_def d_vorder_def d_obs_t_def d_obs_def)\n by (metis eq_iff less_imp_le sndI wfs_def) \n show ?thesis\n using assms a1\n apply(subgoal_tac \"var w = x\") \n defer\n using getVWNC_var apply blast\n apply(simp add: d_obs_def no_val_def init_val_def enc_t_def enc_def amo_def d_vorder_def p_vorder_def mo_def d_obs_t_def)\n apply(intro conjI allI impI)\n apply (metis w_in_writes_on_var)\n apply(elim conjE exE)\n apply (unfold writes_on_def value_def, clarsimp)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n apply (case_tac \"a = x \\ ba = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply (case_tac \"aa = x \\ baa = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply (metis dual_order.strict_trans fst_conv getTS_w_greater_tst_w getVWNC_lastWr in_writes_onI last_write_max2 less_linear)\n apply blast\n apply(elim conjE exE)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n by (metis dual_order.strict_trans2 getVWNC_lastWr getts_greater_than leD)\nqed\n\n\n\nlemma d_order_write_twice:\n assumes \"wfs \\\"\nand \"[u \\\\<^sub>x v] \\\"\nand \"[x =\\<^sub>t v] \\\"\nand \"getVWNC \\ t x = w\"\nand \"getTS \\ w = ts'\"\nshows \"[u \\\\<^sub>x v] (write_trans t b w v \\ ts')\"\n using assms \n apply(subgoal_tac \"var w = x\") \n defer\n using getVWNC_var apply blast\n apply(unfold d_obs_def no_val_def init_val_def enc_t_def enc_def amo_def d_vorder_def p_vorder_def mo_def d_obs_t_def)\n apply(intro conjI allI impI)\n apply(elim conjE exE)\n apply (metis writes_on_var)\n apply (unfold writes_on_def value_def, clarsimp)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n apply (case_tac \"baa = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply (case_tac \"ba = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply blast \n apply (metis fst_conv getVWNC_lastWr getts_greater_than less_le_not_le less_trans modView_lte_last neqE own_ModView sndI)\n apply (case_tac \"ba = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply blast\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n by (metis fst_conv in_writes_onI w_not_in_writes_on)\n\n\nlemma no_val_d_order_one:\n assumes \"wfs \\\"\nand \"[\\\\<^sub>x i] \\\"\nand \"[\\\\<^sub>x u]\\<^sub>i \\\"\nand \"getVWNC \\ t x = w\"\nand \"getTS \\ w = ts'\"\nand \"u \\ i\"\nshows \"[i \\\\<^sub>x u] (write_trans t b w u \\ ts')\"\nproof - \n have a1: \"[en x i]\\<^sub>t \\\"\n using assms\n apply(simp add: no_val_def enc_t_def enc_def value_def mo_def init_val_def d_vorder_def)\n by (metis eq_iff less_imp_le sndI wfs_def) \n show ?thesis\n using assms a1\n apply(subgoal_tac \"var w = x\") \n defer\n using getVWNC_var apply blast\n apply(simp add: d_obs_def no_val_def init_val_def enc_t_def enc_def amo_def d_vorder_def p_vorder_def mo_def d_obs_t_def)\n apply(intro conjI allI impI)\n apply (metis w_in_writes_on_var)\n apply(elim conjE exE)\n apply (unfold writes_on_def value_def, clarsimp)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n apply (case_tac \"a = x \\ ba = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply (case_tac \"aa = x \\ baa = getTS \\ (getVWNC \\ t x)\", simp_all)\n apply (smt CollectD getTS_w_greater_tst_w getVWNC_in_visible_writes less_le_trans not_le visible_writes_def)\n apply blast\n apply(elim conjE exE)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n by (metis Set.basic_monos(7) getTS_w_greater_tst_w getVWNC_in_visible_writes le_less_trans less_eq_rat_def prod.exhaust_sel visible_writes_in_writes)\nqed\n(*\n sledgehammer\n apply (simp add: w_in_writes_on_var)\n sorry\n apply (metis dual_order.trans getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 less_eq_rat_def not_less_iff_gr_or_eq)\n apply (meson w_in_writes_on_var)\n apply(simp add: value_def)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n apply(case_tac \"a = x \\\n ba = getTS \\ (getVWNC \\ t x)\", simp)\n apply(case_tac \"aa = x \\\n baa = getTS \\ (getVWNC \\ t x)\", simp) \n apply (metis getVWNC_lastWr getts_greater_than last_write_max2)\n apply simp \n apply (metis w_in_writes_on_var w_is)\n apply (simp add: value_def)\n apply(rule_tac x = x in exI)\n apply simp\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n by (metis getVWNC_in_writes_on getVWNC_lastWr getts_greater_than w_is)\n*)\n\n(*\n\n [0 \\\\<^sub>x Suc 0] \\ xa \\ [x =\\<^sub>3 0] \\ xa \\\n wfs (\\ xa) \\\n w \\ x \\\n r xa = Suc 0 \\\n \\j. 0 < j \\ j \\ Suc 0 \\ \\ [x \\\\<^sub>2 j] \\ xa \\\n [en x Suc 0]\\<^sub>2 \\ xa \\\n j \\ Suc 0 \\\n [x \\\\<^sub>2 j] \\ xa \\ [x =\\<^sub>3 Suc 0] \\ xa \\ False\n*)\n\nlemma d_vorder_not_pobs: \n assumes \"wfs \\\"\nand \"[u \\\\<^sub>x v] \\\"\nand \"[en x v]\\<^sub>t \\\"\nshows \"\\ [x \\\\<^sub>t u] \\\"\n using assms \n apply(simp add: p_obs_def enc_def enc_t_def d_vorder_def p_vorder_def) \n by (metis (mono_tags) dual_order.trans leD mem_Collect_eq mo_def snd_conv visible_writes_def writes_on_def)\n\n\nlemma c_obs_pres_write_diff_var_ext_2 :\n assumes \"wfs \\\"\n and \"[x = u]\\y =\\<^sub>t v\\ \\\"\n and \"getVWNC \\ t' z = w\"\n and \"x \\ z\"\n and \"y \\ z\" \n and \"t \\ t'\"\n and \" getTS \\ w = ts'\"\n shows \"[x = u]\\y =\\<^sub>t v\\ (write_trans t' b w v' \\ ts')\"\n using assms\n apply(simp add: p_obs_def d_obs_def d_obs_t_def c_obs_def visible_writes_def value_def)\n apply(intro conjI impI allI, elim conjE)\n apply (unfold writes_on_def write_trans_def rev_app_def update_wa_def\n update_mods_def getVWNC_var lastWr_def update_modView_def update_thrView_def value_def, simp)\n apply safe[1]\n using getVWNC_var apply (blast+)[3]\n using getVWNC_var apply (blast+)[3]\n apply (case_tac \"x = var (getVWNC \\ t' z) \\ ba = getTS \\ (getVWNC \\ t' z)\", simp_all)\n apply (metis eq_fst_iff)\n apply (metis eq_fst_iff)\n apply safe[1]\n using getVWNC_var apply (blast+)[3]\n apply (case_tac \"x = var (getVWNC \\ t' z) \\ ba = getTS \\ (getVWNC \\ t' z)\", simp_all)\n using getVWNC_var apply (blast+)[2]\n apply (case_tac \"x = var (getVWNC \\ t' z) \\ ba = getTS \\ (getVWNC \\ t' z)\", simp_all)\n using getVWNC_var apply blast\n apply (smt Collect_cong fst_conv)\n apply (case_tac \"x = var (getVWNC \\ t' z) \\ ba = getTS \\ (getVWNC \\ t' z)\", simp_all)\n using getVWNC_var apply blast\n apply (smt Collect_cong fst_conv getVWNC_var)\n apply safe[1]\n using getVWNC_var apply blast\n apply (case_tac \"x = var (getVWNC \\ t' z) \\ ba = getTS \\ (getVWNC \\ t' z)\", simp_all)\n using getVWNC_var apply blast\n apply (clarsimp)\n by (metis (no_types, lifting) Pair_inject fun_upd_same fun_upd_triv fun_upd_twist releasing_def surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(4) surrey_state.update_convs(5))\n\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RCU_Lems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.4073334000459302, "lm_q1q2_score": 0.25652823209663056}} {"text": "theory flash89Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n have allCases:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s \\formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak2VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak3VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_PutX1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak2VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak3VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put2VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Nak_ClearVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv89: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_GetXVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_PutXVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv89: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv89: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv89 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash89Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381372136564, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.25630571394485524}} {"text": "theory List_Less\n imports\n \"HOL-Library.List_Lexorder\"\n \"Isabelle_LLVM.LLVM_DS_Array_List\"\n \"../Setup\"\n \"../Separation_Logic_Solver/Methods\"\n Arl_Ext\n \"../Bool_Assn_Setup\"\nbegin\n\n\npartial_function (M) list_le'\n :: \"(8 word, 'l::len2) array_list \\ (8 word, 'l) array_list \\ 'l word \\ 1 word llM\" where\n \"list_le' xs ys i =\n doM {\n len_left \\ arl_len xs;\n len_right \\ arl_len ys;\n\n if i < len_right\n then if i < len_left\n then doM {\n x \\ arl_nth xs i;\n y \\ arl_nth ys i;\n le \\ ll_icmp_ult x y;\n if le = 1\n then Mreturn ll_True\n else doM {\n ge \\ ll_icmp_ult y x;\n if ge = 1 \n then Mreturn ll_False\n else list_le' xs ys (i+1)\n }\n }\n else Mreturn ll_True\n else Mreturn ll_False\n }\n\"\n\n\nabbreviation \"string_assn str (stri:: (8 word, 'l::len2) array_list) \\\n \\(LENGTH('l) > 4) ** (EXS ws. \\arl_assn ws stri ** \\(length ws = length str) **\n \\(\\i < length str. \\\\<^sub>punat.assn (str ! i) (ws ! i)))\"\n\n(*\nabbreviation \"string_assn str (stri:: (8 word, 'l::len2) array_list) \\ arl_elem_assn snat.assn str stri\"\n*)\n\nlemma postfix_le: \n \"\\i < length xs; i < length ys\\ \\ drop i xs < drop i ys = (xs ! i < ys ! i \\ xs ! i = ys ! i \\ drop (i+1) xs < drop (i+1) ys)\" \n by (auto simp add: drop_Suc_nth)\n\n\nlemma arl_length_snat_bound: \n \"pure_part (\\arl_assn xs (xsi :: ('a::llvm_rep, 'l::len2) array_list))\n \\ length xs < 2 ^ (LENGTH('l)-1)\"\n unfolding arl_assn_def dr_assn_prefix_def mk_assn_def\n unfolding arl_assn'_def mk_assn_def\n apply (cases xsi)\n apply simp\nproof -\n fix li ci ai\n assume \"pure_part (\\s. \\c l a. (\\snat.assn l (li::'l word) \\*\n \\snat.assn c (ci::'l word) \\*\n \\narray_assn a ai \\*\n \\(4 < LENGTH('l) \\ l \\ c \\ c = length a \\ xs = take l a)) s)\"\n\n then obtain c l a where pp: \"pure_part (\\snat.assn l li \\*\n \\snat.assn c ci \\*\n \\narray_assn a ai \\*\n \\(4 < LENGTH('l) \\ l \\ c \\ c = length a \\ xs = take l a))\"\n unfolding pure_part_def\n by auto\n\n from pp have \"xs = take l a\"\n by (auto dest!: pure_part_split_conj)\n\n hence length_le: \"length xs \\ l\" by simp\n\n from pp have \"\\\\<^sub>psnat.assn l li\"\n apply (auto dest!: pure_part_split_conj)\n by (simp add: snat.assn_def)\n hence \"l \\ snats LENGTH('l)\"\n by (simp add: snat.assn_def)\n hence \"l < 2 ^ (LENGTH('l)-1)\"\n unfolding snats_def by blast\n\n with length_le show \"length xs < 2 ^ (LENGTH('l) - Suc 0)\" \n by simp\nqed\n\n\n\n\n\nlemma [simp]: \"i < length xs \\ [] < drop i xs\" by simp\n\n\nlemma list_le'_rule:\n \"\n llvm_htriple\n (string_assn xs xsi ** string_assn ys ysi ** \\snat.assn i ii)\n (list_le' xsi ysi ii)\n (\\r. \\bool.assn (drop i xs < drop i ys) r ** string_assn xs xsi ** string_assn ys ysi )\n\"\nproof(induction \"min (length xs) (length ys) - i\" arbitrary: i ii)\n case 0\n then show ?case\n apply (subst list_le'.simps)\n apply vcg\n subgoal by simp (*unreachable recursive path*)\n apply vcg\n done\n\nnext\n case (Suc x)\n from Suc(2) have precond: \"x = min (length xs) (length ys) - (i+1)\" by simp\n\n note Suc(1)[OF precond, vcg_rules]\n\n show ?case\n apply (subst list_le'.simps)\n apply vcg\n subgoal for asf x xa r ra s\n apply vcg_rl back\n apply vcg_compat\n apply (sep isep_intro: pure_pure_asm_prefixI | find_sep)+\n apply (auto simp add: SOLVE_AUTO_DEFER_def)\n apply vcg_solve\n apply vcg \n apply vcg_compat\n\n apply (sepE isep_intro: pure_pure_asm_prefixI | find_sep)+\n apply (auto simp add: postfix_le)\n apply vcg_solve\n apply vcg\n apply vcg_rl back \n apply vcg_compat\n apply (sepwith \\auto\\ isep_intro: pure_pure_asm_prefixI) \n apply vcg_solve\n apply vcg\n apply vcg_rl\n apply vcg_compat\n apply (sepEwith simp isep_intro: pure_pure_asm_prefixI)\n apply simp_all\n subgoal \n unfolding dr_assn_pure_asm_prefix_def snat.assn_def snat_invar_def\n apply (rule conjI)\n apply simp_all\n by (smt (verit) Suc_eq_plus1 less_trans_Suc linorder_not_less msb_unat_big snat_eq_unat(1) unat_1 unat_plus_if' unsigned_less)\n apply isep_intro_ex\n apply (sepwith simp)\n apply vcg_solve+\n done\n subgoal by vcg\n subgoal by vcg\n done\nqed\n\n\nunbundle monad_syntax_M\n\n\npartial_function (M) list_le''\n :: \"(8 word, 'l::len2) array_list \\ (8 word, 'l) array_list \\ 'l word \\ 1 word llM\" where\n \"list_le'' xs ys i =\n do {\n len_left \\ arl_len xs;\n len_right \\ arl_len ys;\n\n if i < len_right\n then if i < len_left\n then do {\n x \\ arl_nth xs i;\n y \\ arl_nth ys i;\n le \\ ll_icmp_ult x y;\n if le = 1\n then return ll_True\n else do {\n ge \\ ll_icmp_ult y x;\n if ge = 1 \n then return ll_False\n else do {ip1 \\ ll_add i 1; list_le'' xs ys ip1}\n }\n }\n else return ll_True\n else return ll_False\n }\n\"\n\n\nlemmas list_le''.simps[llvm_code]\n\n\nlemma list_le''_rule:\n \"\n llvm_htriple\n (string_assn xs xsi ** string_assn ys ysi ** \\snat.assn i ii)\n (list_le'' xsi ysi ii)\n (\\r. \\bool.assn (drop i xs < drop i ys) r ** string_assn xs xsi ** string_assn ys ysi )\n\"\nproof(induction \"min (length xs) (length ys) - i\" arbitrary: i ii)\n case 0\n then show ?case \n apply (subst list_le''.simps)\n apply vcg\n subgoal by simp (*unreachable recursive path*)\n apply vcg\n done\nnext\n case (Suc x)\n show ?case\n apply (subst list_le''.simps)\n apply vcg\n subgoal for asf x xa r ra s\n apply vcg_rl back\n apply vcg_compat\n apply (sep isep_intro: pure_pure_asm_prefixI | find_sep)+\n apply (auto simp add: SOLVE_AUTO_DEFER_def)\n apply vcg_solve\n apply vcg\n apply vcg_compat\n apply (sepE isep_intro: pure_pure_asm_prefixI | find_sep)+\n apply (auto simp add: postfix_le)\n apply vcg_solve\n apply vcg\n apply vcg_rl back\n apply vcg_compat\n apply (sepwith auto isep_intro: pure_pure_asm_prefixI)\n apply vcg_solve\n apply vcg\n supply Suc(1)[vcg_rules]\n apply vcg\n subgoal using Suc(2) by simp\n apply vcg\n done\n subgoal by vcg\n subgoal by vcg\n done\nqed\n\n\ndefinition \"list_le xsi ysi \\ list_le'' xsi ysi 0\"\n\n\nlemmas list_le_def[llvm_code, llvm_inline]\n\n\nlemma list_le_rule:\n \"\n llvm_htriple\n (string_assn xs xsi ** string_assn ys ysi)\n (list_le xsi ysi)\n (\\r. \\bool.assn (xs < ys) r ** string_assn xs xsi ** string_assn ys ysi )\n\"\n unfolding list_le_def\n supply list_le''_rule[vcg_rules]\n by vcg\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Example/List_Less.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.25617102833393324}} {"text": "theory PF_Predicates\n imports\n \"../PF_Primitives\"\n PF_Matching_Ternary\nbegin\nfun all_match :: \"('a \\ bool) \\ 'a match_expr \\ bool\" where\n\"all_match _ MatchAny = True\" |\n\"all_match P (MatchNot m) = all_match P m\" |\n\"all_match P (MatchAnd m1 m2) = (all_match P m1 \\ all_match P m2)\" |\n\"all_match P (Match m) = P m\"\n\ndefinition no_ipv6 :: \"common_primitive match_expr \\ bool\" where\n\"no_ipv6 mexpr =\nall_match (\\m. (case m of\n(Src (Hostspec (Address (IPv6 _)))) \\ False\n| (Dst (Address (IPv6 _))) \\ False\n| _ \\ True)) mexpr\"\n\ndefinition no_af :: \"common_primitive match_expr \\ bool\" where\n\"no_af mexpr = all_match (\\m. (case m of (Address_Family _) \\ False| _ \\ True)) mexpr\"\n\ndefinition no_anyhost :: \"common_primitive match_expr \\ bool\" where\n\"no_anyhost mexpr = all_match (\\m. (case m of (Src (Hostspec AnyHost)) \\ False\n | (Dst AnyHost) \\ False\n | _ \\ True)) mexpr\"\n\ndefinition good_match_expr :: \"pfcontext \\ common_primitive match_expr \\ bool\" where\n\"good_match_expr ctx mexpr = all_match (good_primitive ctx) mexpr\"\n\nfun all_AnchorRules_P :: \"('a anchor_rule \\ bool) \\ 'a ruleset \\ bool\" where\n\"all_AnchorRules_P P rs = (\\ l \\ set rs. (case l of (Anchor r b) \\ P r \\ all_AnchorRules_P P b | _ \\ True))\"\n\nfun all_AnchorRules_P' :: \"('a anchor_rule \\ bool) \\ 'a ruleset \\ bool\" where\n\"all_AnchorRules_P' _ [] \\ True\" |\n\"all_AnchorRules_P' P ((PfRule r)#ls) \\ all_AnchorRules_P' P ls\" |\n\"all_AnchorRules_P' P ((Anchor r b)#ls) \\ P r \\ all_AnchorRules_P' P b \\ all_AnchorRules_P' P ls\"\n\nlemma \"all_AnchorRules_P P l= all_AnchorRules_P' P l\"\n by (induction P l rule: all_AnchorRules_P'.induct) auto\n\nlemma all_AnchorRules_P_append[simp]:\n \"all_AnchorRules_P P (xs @ ys) \\ all_AnchorRules_P P xs \\ all_AnchorRules_P P ys\"\n by (induction P xs rule: all_AnchorRules_P.induct) auto\n\ndefinition no_anchors' :: \"'a ruleset \\ bool\" where\n\"no_anchors' rs = all_AnchorRules_P (\\r. False) rs\"\n\nlemma no_anchors_no_anchors'_eq:\n \"no_anchors rs \\ no_anchors' rs\"\n unfolding no_anchors'_def\n by (induction rs) (auto split:line.splits)\n\n\ndefinition no_unknown_anchors :: \"('a,'p) match_tac \\ 'a ruleset \\ bool\" where\n\"no_unknown_anchors \\ rs = all_AnchorRules_P\n (\\r. (\\ p. ternary_ternary_eval (map_match_tac (fst \\) p (anchor_rule.get_match r)) \\ TernaryUnknown))\n rs\"\n\n\nfun all_PfRules_P :: \"('a pf_rule \\ bool) \\ 'a ruleset \\ bool\" where\n\"all_PfRules_P P rs = (\\ l \\ set rs. (case l of (PfRule r) \\ P r | (Anchor r b) \\ all_PfRules_P P b))\"\n\nfun all_PfRules_P' :: \"('a pf_rule \\ bool) \\ 'a ruleset \\ bool\" where\n\"all_PfRules_P' _ [] \\ True\" |\n\"all_PfRules_P' P ((PfRule r)#ls) \\ P r \\ all_PfRules_P' P ls\" |\n\"all_PfRules_P' P ((Anchor r b)#ls) \\ all_PfRules_P' P b \\ all_PfRules_P' P ls\"\n\nlemma \"all_PfRules_P P l= all_PfRules_P' P l\"\n by (induction P l rule: all_PfRules_P'.induct) auto\n\nlemma all_PfRules_P_append[simp]:\n \"all_PfRules_P P (xs @ ys) \\ all_PfRules_P P xs \\ all_PfRules_P P ys\"\n by (induction P xs rule: all_PfRules_P.induct) auto\n\ndefinition no_match_quick :: \"'a ruleset \\ bool\" where\n\"no_match_quick rs = all_PfRules_P (\\r. \\((pf_rule.get_action r) = ActionMatch \\ pf_rule.get_quick r)) rs\"\n\n\ndefinition wf_ruleset :: \"pfcontext \\ common_primitive ruleset \\ bool\" where\n\"wf_ruleset ctx rs = (all_PfRules_P (\\r. good_match_expr ctx (pf_rule.get_match r)) rs \\ all_AnchorRules_P (\\a. good_match_expr ctx (anchor_rule.get_match a)) rs)\"\n\nlemma wf_ruleset_append[simp]:\n\"wf_ruleset ctx (xs @ ys) \\ wf_ruleset ctx xs \\ wf_ruleset ctx ys\"\n unfolding wf_ruleset_def\n using all_PfRules_P_append[of \"(\\r. good_match_expr ctx (pf_rule.get_match r))\" xs ys]\n all_AnchorRules_P_append[of \"(\\r. good_match_expr ctx (anchor_rule.get_match r))\" xs ys]\n by blast\n\ndefinition no_tables :: \"common_primitive match_expr \\ bool\" where\n\"no_tables mexpr = all_match\n (\\m. (case m of\n (Src (Hostspec (Table _))) \\ False\n |(Dst (Table _)) \\ False\n | _ \\ True))\n mexpr\"\n\ndefinition no_tables_rs :: \"common_primitive ruleset \\ bool\" where\n\"no_tables_rs = all_PfRules_P (\\r. no_tables (pf_rule.get_match r))\"\n\ndefinition normalized_ports :: \"common_primitive match_expr \\ bool\" where\n\"normalized_ports mexpr =\nall_match\n(\\m. (case m of\n(Src_Ports (L4Ports _ (Binary bop))) \\ is_RangeIncl bop\n| (Src_Ports (L4Ports _ (Unary _))) \\ False\n| (Dst_Ports (L4Ports _ (Binary bop))) \\ is_RangeIncl bop\n| (Dst_Ports (L4Ports _ (Unary _))) \\ False\n| _ \\ True))\nmexpr\"\n\ndefinition normalized_ports_rs :: \"common_primitive ruleset \\ bool\" where\n\"normalized_ports_rs = all_PfRules_P (\\r. normalized_ports (pf_rule.get_match r))\"\n\ndefinition no_ipv6_rs :: \"common_primitive ruleset \\ bool\" where\n\"no_ipv6_rs = all_PfRules_P (\\r. no_ipv6 (pf_rule.get_match r))\"\n\ndefinition no_af_rs :: \"common_primitive ruleset \\ bool\" where\n\"no_af_rs = all_PfRules_P (\\r. no_af (pf_rule.get_match r))\"\n\ndefinition no_anyhost_rs :: \"common_primitive ruleset \\ bool\" where\n\"no_anyhost_rs = all_PfRules_P (\\r. no_anyhost (pf_rule.get_match r))\"\n\nend", "meta": {"author": "Sohalt", "repo": "pf-verification", "sha": "328f850913723dee6c9f6be069fbbc22a3762354", "save_path": "github-repos/isabelle/Sohalt-pf-verification", "path": "github-repos/isabelle/Sohalt-pf-verification/pf-verification-328f850913723dee6c9f6be069fbbc22a3762354/SemanticsTernary/PF_Predicates.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.3998116407397951, "lm_q1q2_score": 0.25613367224028083}} {"text": "section \\Generic Block Allocator --- Resoning Setup\\\ntheory Sep_Block_Allocator_RS\nimports Sep_Lift \"../basic/LLVM_Basic_Main\"\nbegin\n\n lemma list\\_at_len: \"list\\ \\ xs (length xs) = 0\"\n by (auto simp: list\\_def)\n \n lemma list\\_gt_len: \"i\\length xs \\ list\\ \\ xs i = 0\"\n by (auto simp: list\\_def)\n \n lemma list\\_snoc: \"list\\ \\ (xs@[x]) = 0(length xs := \\ x) + list\\ \\ xs\"\n apply (rule ext)\n apply (auto simp: list\\_def nth_append)\n done\n \n lemma list\\_in_range: \"list\\ \\ xs i \\ 0 \\ i_def split: if_splits)\n \n lemma list\\_in_rangeD: \"list\\ \\ xs = x \\ x i \\ 0 \\ i_def split: if_splits)\n\n lemma list\\_splitE:\n assumes \"list\\ \\ xs = fun_upd 0 i p + fun_upd f i 0\" \n assumes \"p\\0\"\n obtains \"i (xs!i) = p\"\n using assms \n by (auto simp: list\\_def fun_eq_iff split: if_splits)\n \n lemma option\\_splitE: \n assumes \"option\\ \\ v = p\"\n assumes \"p\\0\"\n obtains x where \"v=Some x\" \"\\ x = p\"\n using assms by (cases v) auto\n\n locale block_allocator2 = block_allocator1 static_err mem_err bload bstore bcheck_addr\n for static_err :: 'err\n and mem_err :: 'err\n and bload :: \"'baddr::this_addr \\ ('val,_,'block,'err) M\"\n and bstore :: \"'val \\ 'baddr \\ (unit,_,'block,'err) M\"\n and bcheck_addr :: \"'baddr \\ (unit,_,'block,'err) M\"\n \n + fixes \\b :: \"'block \\ 'ablock::unique_zero_sep_algebra\"\n and bpto :: \"'val \\ 'baddr \\ 'ablock \\ bool\"\n and tag_of :: \"'block \\ 'tag\"\n and is_complete_tag :: \"'ablock \\ 'tag \\ bool\"\n \n assumes bload_rule: \"\\x a. htriple \\b (bpto x a) (bload a) (\\r. \\(r=x) ** bpto x a)\"\n and bstore_rule: \"\\x xx a. htriple \\b (bpto xx a) (bstore x a) (\\_. bpto x a)\"\n and bload_pres_tag: \"\\s a. wlp (bload a) (\\_ s'. tag_of s' = tag_of s) s\"\n and bstore_pres_tag: \"\\s a x. wlp (bstore a x) (\\_ s'. tag_of s' = tag_of s) s\"\n and complete_tag: \n \"\\f. \\is_complete_tag ablock (tag_of cblock); ablock ## f; \\b cblock = ablock + f\\ \\ f=0\"\n and bpto_notZ: \"\\x a. \\bpto x a 0\"\n begin\n \n definition \\tag :: \"'block \\ 'tag tsa_opt\" where \"\\tag blk \\ TRIV (tag_of blk)\"\n definition \\ :: \"'block memory \\ nat \\ 'ablock \\ 'tag tsa_opt\" \n where \"\\ \\ \\MEMORY blocks \\ list\\ (option\\ (\\x. (\\b x, \\tag x))) blocks\"\n definition pto :: \"'val \\ 'baddr addr rptr \\ (nat \\ 'ablock \\ 'tag tsa_opt) \\ bool\" \n where \"pto x \\ \\RP_ADDR (ADDR bi ba) \\ \\s. \\ablk. s=0(bi:=(ablk,0)) \\ bpto x ba ablk | _ \\ sep_false\"\n \n definition tag :: \"'tag \\ 'baddr addr rptr \\ (nat \\ 'ablock \\ 'tag tsa_opt) \\ bool\" \n where \"tag t \\ \\RP_ADDR (ADDR bi ba) \\ EXACT (0(bi:=(0,TRIV t))) ** \\(ba=this_addr \\ t\\range tag_of) | _ \\ sep_false\"\n definition block :: \"'ablock \\ 'baddr addr rptr \\ (nat \\ 'ablock \\ 'tag tsa_opt) \\ bool\"\n where \"block b \\ \\RP_ADDR (ADDR bi ba) \\ EXACT (0(bi:=(b,0))) ** \\(ba=this_addr) | _ \\ sep_false\"\n \n \n lemma alloc_rule: \"htriple \\ \\ (alloc b) (\\r. block (\\b b) r ** tag (tag_of b) r)\"\n apply (rule htripleI')\n apply (auto simp: alloc_def wp_def run_simps sep_algebra_simps split: option.splits)\n proof -\n fix s :: \"'block memory\"\n obtain blocks where [simp]: \"s = MEMORY blocks\" by (cases s)\n \n show \"\\p'. p' ## \\ s \\\n \\ (put' memory.the_memory\\<^sub>L (get' memory.the_memory\\<^sub>L s @ [Some b]) s) = p' + \\ s \\\n (block (\\b b) (RP_ADDR (ADDR (length (get' memory.the_memory\\<^sub>L s)) this_addr)) \\*\n tag (tag_of b) (RP_ADDR (ADDR (length (get' memory.the_memory\\<^sub>L s)) this_addr)))\n p'\"\n apply (rule exI[where x=\"0(length blocks := (\\b b, TRIV (tag_of b)))\"]; intro conjI)\n apply (clarsimp_all simp: \\_def block_def tag_def \\tag_def sep_algebra_simps list\\_at_len)\n subgoal by (simp add: list\\_snoc)\n subgoal\n apply (subst EXACT_split[symmetric])\n apply (auto simp: sep_algebra_simps)\n done\n done\n qed\n \n lemma complete_splitE:\n assumes C: \"is_complete_tag blk t\"\n assumes DISJ: \"f i ## (blk, TRIV t)\"\n assumes AEQ: \"list\\ (option\\ (\\x. (\\b x, \\tag x))) xs = f + fun_upd 0 i (blk, TRIV t)\"\n obtains cblk where \n \"ib cblk\" \"t = tag_of cblk\" \"f i = 0\"\n proof -\n have [simp]: \"i_in_rangeD[OF AEQ])\n apply (auto simp: sep_algebra_simps DISJ)\n done\n\n obtain fib fit where [simp]: \"f i = (fib,fit)\" by (cases \"f i\")\n \n from DISJ have [simp]: \"blk ## fib\" \"fit = 0\" \n by (auto simp: sep_algebra_simps)\n\n \n obtain cblk where [simp]: \"xs!i = Some cblk\" \"\\b cblk = blk + fib\" \"t = tag_of cblk\"\n using fun_cong[OF AEQ, of i]\n apply (cases \"xs!i\")\n apply (auto simp: list\\_def sep_algebra_simps if_splits \\tag_def)\n done\n \n from complete_tag[OF C[simplified], of fib, simplified] have [simp]: \"fib=0\" .\n \n show ?thesis\n apply (rule that[of cblk])\n apply (auto simp: sep_algebra_simps)\n done\n qed \n \n lemma free_rule: \"htriple \\ (block blk a ** tag t a ** \\(is_complete_tag blk t)) (free a) (\\_. \\)\"\n apply (rule htripleI')\n subgoal for p s f\n apply (cases s)\n apply (auto simp: free_def wp_def run_simps sep_algebra_simps split: option.splits addr.splits rptr.splits)\n apply (auto simp: block_def tag_def sep_algebra_simps pred_lift_extract_simps)\n apply (all \\subst (asm) EXACT_split[symmetric] sep_disj_fun_def; clarsimp simp: sep_algebra_simps\\)\n apply (auto simp: \\_def sep_algebra_simps merge_fun_singleton split_fun_upd_0)\n subgoal \n apply (erule (2) complete_splitE)\n by auto\n subgoal \n apply (erule (2) complete_splitE)\n by auto\n subgoal for xs i\n by (force simp: sep_algebra_simps dest: sep_disj_funD[where x=i] list\\_in_rangeD[where i=i])\n subgoal \n apply (erule (2) complete_splitE)\n by auto\n done \n done\n \n \n definition \"block_lifter bi \\ \\ \n sep_lifter.lift = \\x. (0(bi:=(x,0))),\n sep_lifter.project = (\\f. fst (f bi)),\n sep_lifter.carve = (\\f. f(bi:=(0,snd (f bi)))),\n sep_lifter.splittable = (\\f. True),\n sep_lifter.L = lens_of_bi bi,\n sep_lifter.\\b = \\,\n sep_lifter.\\s = \\b,\n sep_lifter.tyb = \\_. (),\n sep_lifter.tys = tag_of\n \\\"\n \n lemma block_lifter_simps[simp]: \n \"sep_lifter.lift (block_lifter bi) = (\\x. (0(bi:=(x,0))))\"\n \"sep_lifter.project (block_lifter bi) = (\\f. fst (f bi))\"\n \"sep_lifter.carve (block_lifter bi) = (\\f. f(bi:=(0,snd (f bi))))\"\n \"sep_lifter.splittable (block_lifter bi) = (\\f. True)\"\n \"sep_lifter.L (block_lifter bi) = lens_of_bi bi\"\n \"sep_lifter.\\b (block_lifter bi) = \\\"\n \"sep_lifter.\\s (block_lifter bi) = \\b\"\n \"sep_lifter.tyb (block_lifter bi) = (\\_. ())\"\n \"sep_lifter.tys (block_lifter bi) = tag_of\"\n unfolding block_lifter_def by auto\n \n sublocale block_lifter: sep_lifter \"block_lifter bi\"\n proof -\n\n have aux1[intro]: \"a ## fst b \\ b ## (a, 0)\" for a b\n by (cases b) (auto simp: sep_algebra_simps )\n \n show \"sep_lifter (block_lifter bi)\"\n apply unfold_locales\n apply (auto simp: sep_algebra_simps sep_disj_funD[where x=bi])\n apply (auto \n simp: lens_of_bi_def \\_def list\\_def option\\_alt \\tag_def sep_algebra_simps\n split: memory.splits if_splits option.splits\n del: ext intro!: ext)\n done \n qed \n \n lemma pto_null_eq[simp]: \"pto x RP_NULL = sep_false\" by (auto simp: pto_def)\n \n lemma pto_addr_eq[simp]: \"pto x (RP_ADDR (ADDR bi ba)) = block_lifter.lift_assn bi (bpto x ba)\"\n unfolding pto_def block_lifter.lift_assn_def\n apply (rule ext)\n apply (auto simp: sep_algebra_simps)\n by (metis (no_types, hide_lams) fun_upd_same fun_upd_triv fun_upd_upd prod_Z_lower(1) surjective_pairing zero_fun_def)\n \n \n fun rptr_cases where \"rptr_cases (RP_NULL) = ()\" | \"rptr_cases (RP_ADDR (ADDR _ _)) = ()\"\n \n lemma load_rule: \"htriple \\ (pto x a) (load a) (\\r. \\(x=r) ** pto x a)\"\n unfolding load_def\n apply (cases a rule: rptr_cases.cases; simp)\n apply (rule cons_post_rule)\n apply (rule block_lifter.lift_operation[simplified, OF _ _ bload_rule])\n apply (simp add: bpto_notZ)\n apply (rule bload_pres_tag)\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n done\n \n lemma store_rule: \"htriple \\ (pto xx a) (store x a) (\\_. pto x a)\" \n unfolding store_def\n apply (cases a rule: rptr_cases.cases; simp)\n apply (rule cons_post_rule)\n apply (rule block_lifter.lift_operation[simplified, OF _ _ bstore_rule])\n apply (simp add: bpto_notZ)\n apply (rule bstore_pres_tag)\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n done\n \n end\n\n\nsubsection \\Address Arithmetic\\ \n \n (*\n ptr ~ ptr :: bool same base\n \n ptr - ptr :: int if same base\n ptr + int :: ptr\n \n\n ~ is equivalence relation\n p ~ p\n p\\<^sub>1 ~ p\\<^sub>2 \\ p\\<^sub>2 ~ p\\<^sub>1\n p\\<^sub>1~p\\<^sub>2 \\ p\\<^sub>2~p\\<^sub>3 \\ p\\<^sub>1~p\\<^sub>3 \n \n p + i\\<^sub>1 + i\\<^sub>2 = p + (i\\<^sub>1+i\\<^sub>2)\n p + 0 = p\n p ~ p+i\n \n p\\<^sub>1~p\\<^sub>2 \\ p\\<^sub>2 + (p\\<^sub>1-p\\<^sub>2) = p\\<^sub>1\n *)\n\n term \"a+b\"\n \n class addr_algebra =\n fixes abase :: \"'a \\ bool\"\n and acompat :: \"'a \\ 'a \\ bool\" (infix \"~\\<^sub>a\" 50)\n and adiff :: \"'a \\ 'a \\ int\" (infix \"-\\<^sub>a\" 65)\n and aidx :: \"'a \\ int \\ 'a\" (infixl \"+\\<^sub>a\" 65)\n assumes \n \\ \\Compatibility is equivalence relation over base pointers\\\n acompat_equiv: \"part_equivp acompat\" \n and acompat_dom: \"a\\<^sub>1 ~\\<^sub>a a\\<^sub>2 \\ abase a\\<^sub>1 \\ abase a\\<^sub>2\"\n \n \\ \\Indexing properties\\\n and aidx_Z[simp]: \"a +\\<^sub>a 0 = a\" \\ \\Indexing by zero extended to non-base pointers\\\n and aidx_plus[simp]: \"abase a \\ a +\\<^sub>a i\\<^sub>1 +\\<^sub>a i\\<^sub>2 = a +\\<^sub>a (i\\<^sub>1 + i\\<^sub>2)\"\n and aidx_inj[simp]: \"abase a \\ a +\\<^sub>a i = a +\\<^sub>a j \\ i=j\"\n (*and abase_idx[simp, intro!]: \"abase a \\ abase (a +\\<^sub>a i)\"*)\n and abase_idx[simp]: \"abase (a +\\<^sub>a i) \\ abase a\"\n \n \\ \\Difference\\\n and adiff_same[simp]: \"a -\\<^sub>a a = 0\" \\ \\Reflexive difference extended to non-base pointers\\\n and aidx_compat[simp]: \"abase a \\ a ~\\<^sub>a a+\\<^sub>ai\"\n and adiff_idx[simp]: \"a ~\\<^sub>a b \\ a +\\<^sub>a (b -\\<^sub>a a) = b\"\n \n begin\n lemma acompat_trans[trans]: \"a ~\\<^sub>a b \\ b ~\\<^sub>a c \\ a ~\\<^sub>a c\"\n using acompat_equiv by (meson part_equivp_transp)\n \n lemma acompat_sym[sym, intro]: \"a ~\\<^sub>a b \\ b ~\\<^sub>a a\"\n using acompat_equiv by (meson part_equivp_symp)\n\n (*lemma acompat_sym_iff[simp]: \"p~\\<^sub>ap' \\ p'~\\<^sub>ap\"\n using acompat_sym by auto\n *)\n \n \n lemma acompat_refl[simp]: \"a ~\\<^sub>a a \\ abase a\" \n using acompat_sym acompat_trans local.acompat_dom local.aidx_compat by blast\n \n lemma aidx_compat'[simp]: \n \"abase b \\ a ~\\<^sub>a b +\\<^sub>a i \\ a ~\\<^sub>a b\" \n \"abase a \\ a +\\<^sub>a i ~\\<^sub>a b \\ a ~\\<^sub>a b\" \n using acompat_sym acompat_trans local.aidx_compat by blast+\n \n lemma diff_Z_iff_eq[simp]: \"a\\<^sub>1 ~\\<^sub>a a\\<^sub>2 \\ a\\<^sub>1 -\\<^sub>a a\\<^sub>2 = 0 \\ a\\<^sub>1=a\\<^sub>2\" \n by (metis acompat_sym acompat_trans local.adiff_idx local.adiff_same)\n \n lemma diff_Z_iff_eq'[simp]: \"a\\<^sub>2 ~\\<^sub>a a\\<^sub>1 \\ a\\<^sub>1 -\\<^sub>a a\\<^sub>2 = 0 \\ a\\<^sub>1=a\\<^sub>2\" \n by (metis acompat_sym acompat_trans local.adiff_idx local.adiff_same)\n \n lemma adiff_idx'[simp]: \"b ~\\<^sub>a a \\ a +\\<^sub>a (b -\\<^sub>a a) = b\"\n using acompat_sym local.adiff_idx by blast\n \n\n lemma idx_diff_distrib[simp]: \"p~\\<^sub>ap' \\ (p+\\<^sub>ai)-\\<^sub>ap' = (p-\\<^sub>ap')+i\"\n by (metis acompat_dom adiff_idx' aidx_compat aidx_inj aidx_plus)\n lemma idx_diff_distrib'[simp]: \"p'~\\<^sub>ap \\ (p+\\<^sub>ai)-\\<^sub>ap' = (p-\\<^sub>ap')+i\"\n by (metis acompat_dom adiff_idx' aidx_compat aidx_inj aidx_plus)\n \n lemma adiff_idx_idx[simp]:\n \"p~\\<^sub>ap' \\ p +\\<^sub>a (p' -\\<^sub>a p + i) = p' +\\<^sub>a i\"\n \"p'~\\<^sub>ap \\ p +\\<^sub>a (p' -\\<^sub>a p + i) = p' +\\<^sub>a i\"\n apply (metis acompat_dom adiff_idx aidx_plus)\n by (metis acompat_dom adiff_idx' aidx_plus)\n \n lemma acompat_dom'[simp, intro]:\n \"p~\\<^sub>ap' \\ abase p\"\n \"p~\\<^sub>ap' \\ abase p'\"\n apply (simp_all add: acompat_dom)\n done\n \n end \n\n instantiation rptr :: (addr_algebra) addr_algebra begin\n fun abase_rptr where \"abase_rptr (RP_ADDR a) \\ abase a\" | \"abase_rptr RP_NULL \\ False\"\n\n lemma abase_rptr_alt: \"abase p \\ (case p of (RP_ADDR a) \\ abase a | RP_NULL \\ False)\"\n by (cases p; simp)\n \n fun acompat_rptr where\n \"acompat_rptr (RP_ADDR a\\<^sub>1) (RP_ADDR a\\<^sub>2) \\ a\\<^sub>1 ~\\<^sub>a a\\<^sub>2\"\n | \"acompat_rptr _ _ \\ False\"\n \n lemma acompat_rptr_alt: \"p\\<^sub>1 ~\\<^sub>a p\\<^sub>2 \\ (case (p\\<^sub>1,p\\<^sub>2) of (RP_ADDR a\\<^sub>1, RP_ADDR a\\<^sub>2) \\ a\\<^sub>1 ~\\<^sub>a a\\<^sub>2 | _ \\ False)\"\n by (cases p\\<^sub>1; cases p\\<^sub>2; simp)\n \n fun adiff_rptr where\n \"adiff_rptr (RP_ADDR a\\<^sub>1) (RP_ADDR a\\<^sub>2) = (a\\<^sub>1 -\\<^sub>a a\\<^sub>2)\"\n | \"adiff_rptr (RP_NULL) (RP_NULL) = 0\"\n | \"adiff_rptr _ _ = undefined\"\n\n lemma adiff_rptr_alt: \"p\\<^sub>1 -\\<^sub>a p\\<^sub>2 = (case (p\\<^sub>1,p\\<^sub>2) of (RP_ADDR a\\<^sub>1, RP_ADDR a\\<^sub>2) \\ a\\<^sub>1 -\\<^sub>a a\\<^sub>2 | (RP_NULL,RP_NULL) \\ 0 | _ \\ undefined)\"\n by (cases p\\<^sub>1; cases p\\<^sub>2; simp)\n \n fun aidx_rptr where\n \"aidx_rptr (RP_ADDR a) i = RP_ADDR (a +\\<^sub>a i)\"\n | \"aidx_rptr RP_NULL _ = RP_NULL\"\n\n lemma aidx_rptr_alt: \"p\\<^sub>1 +\\<^sub>a i = (case p\\<^sub>1 of RP_ADDR a\\<^sub>1 \\ RP_ADDR (a\\<^sub>1 +\\<^sub>a i) | _ \\ RP_NULL)\"\n by (cases p\\<^sub>1; simp)\n \n lemma ptr_neq_null_conv: \"p\\RP_NULL \\ (\\a. p=RP_ADDR a)\" by (cases p) (auto)\n \n instance\n apply standard\n apply (intro part_equivpI sympI transpI)\n apply (meson acompat_equiv acompat_rptr.simps(1) part_equivp_def)\n apply (auto \n simp: acompat_rptr_alt aidx_rptr_alt adiff_rptr_alt acompat_dom\n split: rptr.splits\n intro!: sympI transpI reflpI\n intro: acompat_sym acompat_trans)\n done\n \n end\n \n fun rptr_the_block_index where\n \"rptr_the_block_index (RP_ADDR (ADDR bi _)) = bi\" | \"rptr_the_block_index _ = undefined\"\n \n \n instantiation addr :: (addr_algebra) addr_algebra begin\n fun abase_addr where \"abase_addr (ADDR bi ba) \\ abase ba\"\n fun acompat_addr where \"ADDR bi\\<^sub>1 ba\\<^sub>1 ~\\<^sub>a ADDR bi\\<^sub>2 ba\\<^sub>2 \\ bi\\<^sub>1=bi\\<^sub>2 \\ ba\\<^sub>1~\\<^sub>aba\\<^sub>2\"\n fun aidx_addr where \"ADDR bi ba +\\<^sub>a i = ADDR bi (ba +\\<^sub>a i)\"\n fun adiff_addr where \"ADDR bi\\<^sub>1 ba\\<^sub>1 -\\<^sub>a ADDR bi\\<^sub>2 ba\\<^sub>2 = ba\\<^sub>1 -\\<^sub>a ba\\<^sub>2\"\n \n lemma abase_addr_alt: \"abase = (\\(ADDR bi ba) \\ abase ba)\" by (intro ext) (auto split: addr.splits)\n lemma acomp_addr_alt: \"(~\\<^sub>a) = (\\ADDR bi\\<^sub>1 ba\\<^sub>1 \\ \\ADDR bi\\<^sub>2 ba\\<^sub>2 \\ bi\\<^sub>1=bi\\<^sub>2 \\ ba\\<^sub>1~\\<^sub>aba\\<^sub>2)\" by (intro ext) (auto split: addr.splits)\n lemma aidx_addr_alt: \"(+\\<^sub>a) = (\\ADDR bi ba \\ \\i. ADDR bi (ba +\\<^sub>a i))\" by (intro ext) (auto split: addr.splits)\n lemma adiff_addr_alt: \"(-\\<^sub>a) = (\\ADDR bi\\<^sub>1 ba\\<^sub>1 \\ \\ADDR bi\\<^sub>2 ba\\<^sub>2 \\ ba\\<^sub>1 -\\<^sub>a ba\\<^sub>2)\" by (intro ext) (auto split: addr.splits)\n\n instance\n apply standard\n apply (intro part_equivpI sympI transpI)\n apply (meson acompat_equiv acompat_addr.simps(1) part_equivp_def)\n apply (auto \n simp: abase_addr_alt acomp_addr_alt aidx_addr_alt adiff_addr_alt acompat_dom\n split: addr.splits \n intro: acompat_sym acompat_trans) \n done\n \n end\n \n \n \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/vcg/Sep_Block_Allocator_RS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2561336722402808}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference_Base_Refinement\nimports Noninterference_Base\n Noninterference_Base_Alternatives\nbegin\n\n(* we assume the same initial state for both systems *)\nlocale noninterference_refinement =\n abs?: complete_unwinding_system A s0 dom uwr policy out schedDomain +\n conc?: noninterference_system C s0 dom uwr policy out schedDomain\n for A :: \"('a,'s,'e) data_type\"\n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\"\n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\"\n and out :: \"'d \\ 's \\ 'p\"\n and schedDomain :: \"'d\"\n and C :: \"('c,'s,'e) data_type\" +\n assumes refines: \"refines C A\"\n\ncontext noninterference_refinement begin\n\nlemma reachable:\n \"conc.reachable s \\ abs.reachable s\"\n apply(simp add: conc.reachable_def abs.reachable_def)\n using refines by (fastforce simp: refines_def)\n\n\nlemma Step:\n \"conc.Step a \\ abs.Step a\"\n apply(simp add: conc.Step_def abs.Step_def)\n using refines by(fastforce simp: refines_def)\n\nlemma confidentiality_u_refinement_closed:\n \"abs.confidentiality_u \\ conc.confidentiality_u\"\n apply(simp add: abs.confidentiality_u_def)\n apply(subst conc.confidentiality_u_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\nlemma confidentiality_u_weak_refinement_closed:\n \"abs.confidentiality_u_weak \\ conc.confidentiality_u_weak\"\n apply(simp add: abs.confidentiality_u_weak_def)\n apply(subst conc.confidentiality_u_weak_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\nlemma integrity_u_refinement_closed:\n \"abs.integrity_u \\ conc.integrity_u\"\n apply(simp add: abs.integrity_u_def)\n apply(subst conc.integrity_u_def)\n apply(blast intro: subsetD[OF Step] reachable)\n done\n\n\nlemma xources_subset:\n \"abs.confidentiality_u \\ abs.xources as s u \\ conc.xources as s u\"\n apply(induct as arbitrary: s u)\n apply(simp add: abs.xources.xources_Nil conc.xources.xources_Nil)\n apply(simp add: abs.xources.xources_Cons conc.xources.xources_Cons)\n apply(rule conjI)\n apply(rule subsetI)\n apply(rule UnI1)\n apply(blast dest: subsetD[OF Step])\n apply(rule subsetI)\n apply(rule UnI2)\n apply(blast dest: subsetD[OF Step])\n done\n\n\nlemma uwr_equiv:\n \"abs.uwr_equiv s as t bs u \\ conc.uwr_equiv s as t bs u\"\n apply(insert refines)\n apply(fastforce simp: abs.uwr_equiv_def conc.uwr_equiv_def simp: refines_def dest: subsetD)\n done\n\nlemma xNonleakage_gen_refinement_closed:\n \"abs.xNonleakage_gen \\ conc.xNonleakage_gen\"\n apply(frule abs.xNonleakage_gen_confidentiality_u)\n apply(frule xources_subset)\n apply(clarsimp simp: abs.xNonleakage_gen_def conc.xNonleakage_gen_def)\n apply(drule (1) sameFor_subset_dom[OF _ xources_subset])\n apply(blast dest: reachable uwr_equiv)\n done\n\nend\n\n\nlocale complete_noninterference_refinement = noninterference_refinement A s0 dom uwr policy out schedDomain C\n for A :: \"('a,'s,'e) data_type\"\n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\"\n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\"\n and out :: \"'d \\ 's \\ 'p\"\n and schedDomain :: \"'d\"\n and C :: \"('c,'s,'e) data_type\" +\n assumes Step_C: \"Step_system C s0\"\n\nsublocale complete_noninterference_refinement \\ conc: complete_unwinding_system C s0 dom uwr policy out schedDomain\n apply(unfold_locales)\n using Step_C apply(fastforce simp: Step_system_def)\n using Step_C apply(fastforce simp: Step_system_def)\n apply(rule policy_refl)\n done\n\ncontext complete_noninterference_refinement begin\nlemma Noninfluence_strong_uwr_refinement_closed:\n \"abs.Noninfluence_strong_uwr \\\n conc.Noninfluence_strong_uwr\"\n apply(frule abs.Noninfluence_strong_uwr_confidentiality_u_weak)\n apply(drule abs.Noninfluence_strong_uwr_integrity_u)\n apply(drule confidentiality_u_weak_refinement_closed)\n apply(drule integrity_u_refinement_closed)\n apply(blast intro: conc.Noninfluence_strong_uwr)\n done\n\nlemma Nonleakage_gen_refinement_closed:\n \"abs.Nonleakage_gen \\\n conc.Nonleakage_gen\"\n apply(simp add: abs.Nonleakage_gen_equiv_confidentiality_u conc.Nonleakage_gen_equiv_confidentiality_u)\n apply(erule confidentiality_u_refinement_closed)\n done\n\nlemma Noninfluence_strong_quasi_refinement_closed:\n \"\\abs.confidentiality_u_weak; abs.integrity_u;\n output_consistent\\ \\\n conc.Noninfluence_strong\"\n apply(rule conc.Noninfluence_strong)\n apply(erule confidentiality_u_weak_refinement_closed)\n apply assumption\n apply(erule integrity_u_refinement_closed)\n done\n\nlemma Noninfluence_strong_uwr_quasi_refinement_closed:\n \"\\abs.Noninfluence_strong_uwr;\n output_consistent\\ \\\n conc.Noninfluence_strong\"\n apply(rule conc.Noninfluence_strong)\n apply(rule confidentiality_u_weak_refinement_closed)\n apply(erule abs.Noninfluence_strong_uwr_confidentiality_u_weak)\n apply assumption\n apply(rule integrity_u_refinement_closed)\n apply(erule abs.Noninfluence_strong_uwr_integrity_u)\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/Noninterference_Base_Refinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.2561246051294886}} {"text": "section\\Contrived Example\\\ntheory Contrived_Example\nimports \n \"../../Primitive_Matchers/Parser\"\nbegin\n\n(*\n internal network: 131.159.21.0/24\n DMZ: 131.159.15.240/28\n DMZ must not connect to internal\n*)\n\nparse_iptables_save example_fw=\"iptables-save\"\n\nthm example_fw_def\nthm example_fw_FORWARD_default_policy_def\n\n\nlemma \"map common_primitive_rule_toString\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD example_fw_FORWARD_default_policy\n (map_of_string_ipv4 example_fw)))) =\n[''-i lo -j ACCEPT'',\n ''! -i lo -s 127.0.0.0/8 -j DROP'',\n ''-i inteneral -s 131.159.21.0/24 -j ACCEPT'',\n ''-d 131.159.21.0/24 -s 131.159.15.240/28 -j DROP'',\n ''-p tcp -d 131.159.15.240/28 -j ACCEPT'',\n ''-i dmz -p tcp -s 131.159.15.240/28 -j ACCEPT'',\n '' -j DROP'']\" by eval\n\n\nlemma \"map simple_rule_ipv4_toString\n (to_simple_firewall (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD example_fw_FORWARD_default_policy\n (map_of_string_ipv4 example_fw))))))) =\n[''ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 in: lo '',\n ''ACCEPT all -- 131.159.21.0/24 0.0.0.0/0 in: inteneral '',\n ''DROP all -- 131.159.15.240/28 131.159.21.0/24 '',\n ''ACCEPT tcp -- 0.0.0.0/0 131.159.15.240/28 '',\n ''ACCEPT tcp -- 131.159.15.240/28 0.0.0.0/0 in: dmz '',\n ''DROP all -- 0.0.0.0/0 0.0.0.0/0 '']\" by eval\n\n\nlemma \"map simple_rule_ipv4_toString\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD example_fw_FORWARD_default_policy\n (map_of_string_ipv4 example_fw))))))) =\n[''ACCEPT all -- 127.0.0.0/8 0.0.0.0/0 '',\n ''ACCEPT all -- 131.159.21.0/24 0.0.0.0/0 '',\n ''DROP all -- 131.159.15.240/28 131.159.21.0/24 '',\n ''ACCEPT tcp -- 0.0.0.0/0 131.159.15.240/28 '',\n ''ACCEPT tcp -- 131.159.15.240/28 0.0.0.0/0 '',\n ''DROP all -- 0.0.0.0/0 0.0.0.0/0 '']\" by eval\n\n\n\nlemma \"access_matrix_pretty_ipv4 parts_connection_ssh\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD example_fw_FORWARD_default_policy\n (map_of_string_ipv4 example_fw))))))) =\n([(''131.159.21.0'', ''{131.159.21.0 .. 131.159.21.255}''),\n (''131.159.15.240'', ''{131.159.15.240 .. 131.159.15.255}''),\n (''127.0.0.0'', ''{127.0.0.0 .. 127.255.255.255}''),\n (''0.0.0.0'', ''{0.0.0.0 .. 126.255.255.255} u {128.0.0.0 .. 131.159.15.239} u {131.159.16.0 .. 131.159.20.255} u {131.159.22.0 .. 255.255.255.255}'')],\n\n [(''131.159.21.0'', ''131.159.21.0''), (''131.159.21.0'', ''131.159.15.240''),\n (''131.159.21.0'', ''127.0.0.0''), (''131.159.21.0'', ''0.0.0.0''),\n (''131.159.15.240'', ''131.159.15.240''), (''131.159.15.240'', ''127.0.0.0''),\n (''131.159.15.240'', ''0.0.0.0''), (''127.0.0.0'', ''131.159.21.0''), (''127.0.0.0'', ''131.159.15.240''),\n (''127.0.0.0'', ''127.0.0.0''), (''127.0.0.0'', ''0.0.0.0''), (''0.0.0.0'', ''131.159.15.240'')])\"\nby eval\n\n(*\na |-> {131.159.21.0 .. 131.159.21.255}\nb |-> {131.159.15.240 .. 131.159.15.255}\nc |-> {127.0.0.0 .. 127.255.255.255}\nd |-> {0.0.0.0 .. 126.255.255.255} \\ {128.0.0.0 .. 131.159.15.239} \\ {131.159.16.0 .. 131.159.20.255} \\ {131.159.22.0 .. 255.255.255.255}\n\n(a,a)\n(a,b)\n(a,c)\n(a,d)\n(b,b)\n(b,c)\n(b,d)\n(c,a)\n(c,b)\n(c,c)\n(c,d)\n(d,b)\n\n*)\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Examples/Contrived/Contrived_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.25608757770996315}} {"text": "(* Title: HOL/Auth/Guard/Proto.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\Other Protocol-Independent Results\\\n\ntheory Proto imports Guard_Public begin\n\nsubsection\\protocols\\\n\ntype_synonym rule = \"event set * event\"\n\nabbreviation\n msg' :: \"rule => msg\" where\n \"msg' R == msg (snd R)\"\n\ntype_synonym proto = \"rule set\"\n\ndefinition wdef :: \"proto => bool\" where\n\"wdef p \\ \\R k. R \\ p \\ Number k \\ parts {msg' R}\n\\ Number k \\ parts (msg`(fst R))\"\n\nsubsection\\substitutions\\\n\nrecord subs =\n agent :: \"agent => agent\"\n nonce :: \"nat => nat\"\n nb :: \"nat => msg\"\n key :: \"key => key\"\n\nprimrec apm :: \"subs => msg => msg\" where\n \"apm s (Agent A) = Agent (agent s A)\"\n| \"apm s (Nonce n) = Nonce (nonce s n)\"\n| \"apm s (Number n) = nb s n\"\n| \"apm s (Key K) = Key (key s K)\"\n| \"apm s (Hash X) = Hash (apm s X)\"\n| \"apm s (Crypt K X) = (\nif (\\A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)\nelse if (\\A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)\nelse Crypt (key s K) (apm s X))\"\n| \"apm s \\X,Y\\ = \\apm s X, apm s Y\\\"\n\nlemma apm_parts: \"X \\ parts {Y} \\ apm s X \\ parts {apm s Y}\"\napply (erule parts.induct, simp_all, blast)\napply (erule parts.Fst)\napply (erule parts.Snd)\nby (erule parts.Body)+\n\nlemma Nonce_apm [rule_format]: \"Nonce n \\ parts {apm s X} \\\n(\\k. Number k \\ parts {X} \\ Nonce n \\ parts {nb s k}) \\\n(\\k. Nonce k \\ parts {X} \\ nonce s k = n)\"\nby (induct X, simp_all, blast)\n\nlemma wdef_Nonce: \"\\Nonce n \\ parts {apm s X}; R \\ p; msg' R = X; wdef p;\nNonce n \\ parts (apm s `(msg `(fst R)))\\ \\\n(\\k. Nonce k \\ parts {X} \\ nonce s k = n)\"\napply (erule Nonce_apm, unfold wdef_def)\napply (drule_tac x=R in spec, drule_tac x=k in spec, clarsimp)\napply (drule_tac x=x in bspec, simp)\napply (drule_tac Y=\"msg x\" and s=s in apm_parts, simp)\nby (blast dest: parts_parts)\n\nprimrec ap :: \"subs \\ event \\ event\" where\n \"ap s (Says A B X) = Says (agent s A) (agent s B) (apm s X)\"\n| \"ap s (Gets A X) = Gets (agent s A) (apm s X)\"\n| \"ap s (Notes A X) = Notes (agent s A) (apm s X)\"\n\nabbreviation\n ap' :: \"subs \\ rule \\ event\" where\n \"ap' s R \\ ap s (snd R)\"\n\nabbreviation\n apm' :: \"subs \\ rule \\ msg\" where\n \"apm' s R \\ apm s (msg' R)\"\n\nabbreviation\n priK' :: \"subs \\ agent \\ key\" where\n \"priK' s A \\ priK (agent s A)\"\n\nabbreviation\n pubK' :: \"subs \\ agent \\ key\" where\n \"pubK' s A \\ pubK (agent s A)\"\n\nsubsection\\nonces generated by a rule\\\n\ndefinition newn :: \"rule \\ nat set\" where\n\"newn R \\ {n. Nonce n \\ parts {msg (snd R)} \\ Nonce n \\ parts (msg`(fst R))}\"\n\nlemma newn_parts: \"n \\ newn R \\ Nonce (nonce s n) \\ parts {apm' s R}\"\nby (auto simp: newn_def dest: apm_parts)\n\nsubsection\\traces generated by a protocol\\\n\ndefinition ok :: \"event list \\ rule \\ subs \\ bool\" where\n\"ok evs R s \\ ((\\x. x \\ fst R \\ ap s x \\ set evs)\n\\ (\\n. n \\ newn R \\ Nonce (nonce s n) \\ used evs))\"\n\ninductive_set\n tr :: \"proto => event list set\"\n for p :: proto\nwhere\n\n Nil [intro]: \"[] \\ tr p\"\n\n| Fake [intro]: \"\\evsf \\ tr p; X \\ synth (analz (spies evsf))\\\n \\ Says Spy B X # evsf \\ tr p\"\n\n| Proto [intro]: \"\\evs \\ tr p; R \\ p; ok evs R s\\ \\ ap' s R # evs \\ tr p\"\n\nsubsection\\general properties\\\n\nlemma one_step_tr [iff]: \"one_step (tr p)\"\napply (unfold one_step_def, clarify)\nby (ind_cases \"ev # evs \\ tr p\" for ev evs, auto)\n\ndefinition has_only_Says' :: \"proto => bool\" where\n\"has_only_Says' p \\ \\R. R \\ p \\ is_Says (snd R)\"\n\nlemma has_only_Says'D: \"\\R \\ p; has_only_Says' p\\\n\\ (\\A B X. snd R = Says A B X)\"\nby (unfold has_only_Says'_def is_Says_def, blast)\n\nlemma has_only_Says_tr [simp]: \"has_only_Says' p \\ has_only_Says (tr p)\"\nunfolding has_only_Says_def\napply (rule allI, rule allI, rule impI)\napply (erule tr.induct)\napply (auto simp: has_only_Says'_def ok_def)\nby (drule_tac x=a in spec, auto simp: is_Says_def)\n\nlemma has_only_Says'_in_trD: \"\\has_only_Says' p; list @ ev # evs1 \\ tr p\\\n\\ (\\A B X. ev = Says A B X)\"\nby (drule has_only_Says_tr, auto)\n\nlemma ok_not_used: \"\\Nonce n \\ used evs; ok evs R s;\n\\x. x \\ fst R \\ is_Says x\\ \\ Nonce n \\ parts (apm s `(msg `(fst R)))\"\napply (unfold ok_def, clarsimp)\napply (drule_tac x=x in spec, drule_tac x=x in spec)\nby (auto simp: is_Says_def dest: Says_imp_spies not_used_not_spied parts_parts)\n\nlemma ok_is_Says: \"\\evs' @ ev # evs \\ tr p; ok evs R s; has_only_Says' p;\nR \\ p; x \\ fst R\\ \\ is_Says x\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=x in spec, simp)\napply (subgoal_tac \"one_step (tr p)\")\napply (drule trunc, simp, drule one_step_Cons, simp)\napply (drule has_only_SaysD, simp+)\nby (clarify, case_tac x, auto)\n\nsubsection\\types\\\n\ntype_synonym keyfun = \"rule \\ subs \\ nat \\ event list \\ key set\"\n\ntype_synonym secfun = \"rule \\ nat \\ subs \\ key set \\ msg\"\n\nsubsection\\introduction of a fresh guarded nonce\\\n\ndefinition fresh :: \"proto \\ rule \\ subs \\ nat \\ key set \\ event list\n\\ bool\" where\n\"fresh p R s n Ks evs \\ (\\evs1 evs2. evs = evs2 @ ap' s R # evs1\n\\ Nonce n \\ used evs1 \\ R \\ p \\ ok evs1 R s \\ Nonce n \\ parts {apm' s R}\n\\ apm' s R \\ guard n Ks)\"\n\nlemma freshD: \"fresh p R s n Ks evs \\ (\\evs1 evs2.\nevs = evs2 @ ap' s R # evs1 \\ Nonce n \\ used evs1 \\ R \\ p \\ ok evs1 R s\n\\ Nonce n \\ parts {apm' s R} \\ apm' s R \\ guard n Ks)\"\n unfolding fresh_def by blast\n\nlemma freshI [intro]: \"\\Nonce n \\ used evs1; R \\ p; Nonce n \\ parts {apm' s R};\nok evs1 R s; apm' s R \\ guard n Ks\\\n\\ fresh p R s n Ks (list @ ap' s R # evs1)\"\n unfolding fresh_def by blast\n\nlemma freshI': \"\\Nonce n \\ used evs1; (l,r) \\ p;\nNonce n \\ parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r) \\ guard n Ks\\\n\\ fresh p (l,r) s n Ks (evs2 @ ap s r # evs1)\"\nby (drule freshI, simp+)\n\nlemma fresh_used: \"\\fresh p R' s' n Ks evs; has_only_Says' p\\\n\\ Nonce n \\ used evs\"\napply (unfold fresh_def, clarify)\napply (drule has_only_Says'D)\nby (auto intro: parts_used_app)\n\nlemma fresh_newn: \"\\evs' @ ap' s R # evs \\ tr p; wdef p; has_only_Says' p;\nNonce n \\ used evs; R \\ p; ok evs R s; Nonce n \\ parts {apm' s R}\\\n\\ \\k. k \\ newn R \\ nonce s k = n\"\napply (drule wdef_Nonce, simp+)\napply (frule ok_not_used, simp+)\napply (clarify, erule ok_is_Says, simp+)\napply (clarify, rule_tac x=k in exI, simp add: newn_def)\napply (clarify, drule_tac Y=\"msg x\" and s=s in apm_parts)\napply (drule ok_not_used, simp+)\nby (clarify, erule ok_is_Says, simp_all)\n\nlemma fresh_rule: \"\\evs' @ ev # evs \\ tr p; wdef p; Nonce n \\ used evs;\nNonce n \\ parts {msg ev}\\ \\ \\R s. R \\ p \\ ap' s R = ev\"\napply (drule trunc, simp, ind_cases \"ev # evs \\ tr p\", simp)\nby (drule_tac x=X in in_sub, drule parts_sub, simp, simp, blast+)\n\nlemma fresh_ruleD: \"\\fresh p R' s' n Ks evs; keys R' s' n evs \\ Ks; wdef p;\nhas_only_Says' p; evs \\ tr p; \\R k s. nonce s k = n \\ Nonce n \\ used evs \\\nR \\ p \\ k \\ newn R \\ Nonce n \\ parts {apm' s R} \\ apm' s R \\ guard n Ks \\\napm' s R \\ parts (spies evs) \\ keys R s n evs \\ Ks \\ P\\ \\ P\"\napply (frule fresh_used, simp)\napply (unfold fresh_def, clarify)\napply (drule_tac x=R' in spec)\napply (drule fresh_newn, simp+, clarify)\napply (drule_tac x=k in spec)\napply (drule_tac x=s' in spec)\napply (subgoal_tac \"apm' s' R' \\ parts (spies (evs2 @ ap' s' R' # evs1))\")\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (rule_tac Y=\"apm s' X\" in parts_parts, blast)\nby (rule parts.Inj, rule Says_imp_spies, simp, blast)\n\nsubsection\\safe keys\\\n\ndefinition safe :: \"key set \\ msg set \\ bool\" where\n\"safe Ks G \\ \\K. K \\ Ks \\ Key K \\ analz G\"\n\nlemma safeD [dest]: \"\\safe Ks G; K \\ Ks\\ \\ Key K \\ analz G\"\n unfolding safe_def by blast\n\nlemma safe_insert: \"safe Ks (insert X G) \\ safe Ks G\"\n unfolding safe_def by blast\n\nlemma Guard_safe: \"\\Guard n Ks G; safe Ks G\\ \\ Nonce n \\ analz G\"\nby (blast dest: Guard_invKey)\n\nsubsection\\guardedness preservation\\\n\ndefinition preserv :: \"proto \\ keyfun \\ nat \\ key set \\ bool\" where\n\"preserv p keys n Ks \\ (\\evs R' s' R s. evs \\ tr p \\\nGuard n Ks (spies evs) \\ safe Ks (spies evs) \\ fresh p R' s' n Ks evs \\\nkeys R' s' n evs \\ Ks \\ R \\ p \\ ok evs R s \\ apm' s R \\ guard n Ks)\"\n\nlemma preservD: \"\\preserv p keys n Ks; evs \\ tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; R \\ p; ok evs R s;\nkeys R' s' n evs \\ Ks\\ \\ apm' s R \\ guard n Ks\"\n unfolding preserv_def by blast\n\nlemma preservD': \"\\preserv p keys n Ks; evs \\ tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X) \\ p;\nok evs (l,Says A B X) s; keys R' s' n evs \\ Ks\\ \\ apm s X \\ guard n Ks\"\nby (drule preservD, simp+)\n\nsubsection\\monotonic keyfun\\\n\ndefinition monoton :: \"proto => keyfun => bool\" where\n\"monoton p keys \\ \\R' s' n ev evs. ev # evs \\ tr p \\\nkeys R' s' n evs \\ keys R' s' n (ev # evs)\"\n\nlemma monotonD [dest]: \"\\keys R' s' n (ev # evs) \\ Ks; monoton p keys;\nev # evs \\ tr p\\ \\ keys R' s' n evs \\ Ks\"\n unfolding monoton_def by blast\n\nsubsection\\guardedness theorem\\\n\nlemma Guard_tr [rule_format]: \"\\evs \\ tr p; has_only_Says' p;\npreserv p keys n Ks; monoton p keys; Guard n Ks (initState Spy)\\ \\\nsafe Ks (spies evs) \\ fresh p R' s' n Ks evs \\ keys R' s' n evs \\ Ks \\\nGuard n Ks (spies evs)\"\napply (erule tr.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply (clarify, drule freshD, clarsimp)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, blast)\n(* evs2 = aa # list *)\napply (clarsimp, rule conjI)\napply (blast dest: safe_insert)\n(* X:guard n Ks *)\napply (rule in_synth_Guard, simp, rule Guard_analz)\napply (blast dest: safe_insert)\napply (drule safe_insert, simp add: safe_def)\n(* Proto *)\napply (clarify, drule freshD, clarify)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (frule_tac R=R' in has_only_Says'D, simp)\napply (case_tac R', clarsimp, blast)\n(* evs2 = ab # list *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, rule conjI)\napply (drule Proto, simp+, blast dest: safe_insert)\n(* apm s X:guard n Ks *)\napply (frule Proto, simp+)\napply (erule preservD', simp+)\napply (blast dest: safe_insert)\napply (blast dest: safe_insert)\nby (blast, simp, simp, blast)\n\nsubsection\\useful properties for guardedness\\\n\nlemma newn_neq_used: \"\\Nonce n \\ used evs; ok evs R s; k \\ newn R\\\n\\ n \\ nonce s k\"\nby (auto simp: ok_def)\n\nlemma ok_Guard: \"\\ok evs R s; Guard n Ks (spies evs); x \\ fst R; is_Says x\\\n\\ apm s (msg x) \\ parts (spies evs) \\ apm s (msg x) \\ guard n Ks\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=\"Says A B X\" in spec, simp)\nby (drule Says_imp_spies, auto intro: parts_parts)\n\nlemma ok_parts_not_new: \"\\Y \\ parts (spies evs); Nonce (nonce s n) \\ parts {Y};\nok evs R s\\ \\ n \\ newn R\"\nby (auto simp: ok_def dest: not_used_not_spied parts_parts)\n\nsubsection\\unicity\\\n\ndefinition uniq :: \"proto \\ secfun \\ bool\" where\n\"uniq p secret \\ \\evs R R' n n' Ks s s'. R \\ p \\ R' \\ p \\\nn \\ newn R \\ n' \\ newn R' \\ nonce s n = nonce s' n' \\\nNonce (nonce s n) \\ parts {apm' s R} \\ Nonce (nonce s n) \\ parts {apm' s' R'} \\\napm' s R \\ guard (nonce s n) Ks \\ apm' s' R' \\ guard (nonce s n) Ks \\\nevs \\ tr p \\ Nonce (nonce s n) \\ analz (spies evs) \\\nsecret R n s Ks \\ parts (spies evs) \\ secret R' n' s' Ks \\ parts (spies evs) \\\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniqD: \"\\uniq p secret; evs \\ tr p; R \\ p; R' \\ p; n \\ newn R; n' \\ newn R';\nnonce s n = nonce s' n'; Nonce (nonce s n) \\ analz (spies evs);\nNonce (nonce s n) \\ parts {apm' s R}; Nonce (nonce s n) \\ parts {apm' s' R'};\nsecret R n s Ks \\ parts (spies evs); secret R' n' s' Ks \\ parts (spies evs);\napm' s R \\ guard (nonce s n) Ks; apm' s' R' \\ guard (nonce s n) Ks\\ \\\nsecret R n s Ks = secret R' n' s' Ks\"\n unfolding uniq_def by blast\n\ndefinition ord :: \"proto \\ (rule \\ rule \\ bool) \\ bool\" where\n\"ord p inff \\ \\R R'. R \\ p \\ R' \\ p \\ \\ inff R R' \\ inff R' R\"\n\nlemma ordD: \"\\ord p inff; \\ inff R R'; R \\ p; R' \\ p\\ \\ inff R' R\"\n unfolding ord_def by blast\n\ndefinition uniq' :: \"proto \\ (rule \\ rule \\ bool) \\ secfun \\ bool\" where\n\"uniq' p inff secret \\ \\evs R R' n n' Ks s s'. R \\ p \\ R' \\ p \\\ninff R R' \\ n \\ newn R \\ n' \\ newn R' \\ nonce s n = nonce s' n' \\\nNonce (nonce s n) \\ parts {apm' s R} \\ Nonce (nonce s n) \\ parts {apm' s' R'} \\\napm' s R \\ guard (nonce s n) Ks \\ apm' s' R' \\ guard (nonce s n) Ks \\\nevs \\ tr p \\ Nonce (nonce s n) \\ analz (spies evs) \\\nsecret R n s Ks \\ parts (spies evs) \\ secret R' n' s' Ks \\ parts (spies evs) \\\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniq'D: \"\\uniq' p inff secret; evs \\ tr p; inff R R'; R \\ p; R' \\ p; n \\ newn R;\nn' \\ newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) \\ analz (spies evs);\nNonce (nonce s n) \\ parts {apm' s R}; Nonce (nonce s n) \\ parts {apm' s' R'};\nsecret R n s Ks \\ parts (spies evs); secret R' n' s' Ks \\ parts (spies evs);\napm' s R \\ guard (nonce s n) Ks; apm' s' R' \\ guard (nonce s n) Ks\\ \\\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq'_def, blast)\n\nlemma uniq'_imp_uniq: \"\\uniq' p inff secret; ord p inff\\ \\ uniq p secret\"\nunfolding uniq_def\napply (rule allI)+\napply (case_tac \"inff R R'\")\napply (blast dest: uniq'D)\nby (auto dest: ordD uniq'D intro: sym)\n\nsubsection\\Needham-Schroeder-Lowe\\\n\ndefinition a :: agent where \"a == Friend 0\"\ndefinition b :: agent where \"b == Friend 1\"\ndefinition a' :: agent where \"a' == Friend 2\"\ndefinition b' :: agent where \"b' == Friend 3\"\ndefinition Na :: nat where \"Na == 0\"\ndefinition Nb :: nat where \"Nb == 1\"\n\nabbreviation\n ns1 :: rule where\n \"ns1 == ({}, Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\))\"\n\nabbreviation\n ns2 :: rule where\n \"ns2 == ({Says a' b (Crypt (pubK b) \\Nonce Na, Agent a\\)},\n Says b a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\))\"\n\nabbreviation\n ns3 :: rule where\n \"ns3 == ({Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\),\n Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)},\n Says a b (Crypt (pubK b) (Nonce Nb)))\"\n\ninductive_set ns :: proto where\n [iff]: \"ns1 \\ ns\"\n| [iff]: \"ns2 \\ ns\"\n| [iff]: \"ns3 \\ ns\"\n\nabbreviation (input)\n ns3a :: event where\n \"ns3a == Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\)\"\n\nabbreviation (input)\n ns3b :: event where\n \"ns3b == Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\"\n\ndefinition keys :: \"keyfun\" where\n\"keys R' s' n evs == {priK' s' a, priK' s' b}\"\n\nlemma \"monoton ns keys\"\nby (simp add: keys_def monoton_def)\n\ndefinition secret :: \"secfun\" where\n\"secret R n s Ks ==\n(if R=ns1 then apm s (Crypt (pubK b) \\Nonce Na, Agent a\\)\nelse if R=ns2 then apm s (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\nelse Number 0)\"\n\ndefinition inf :: \"rule => rule => bool\" where\n\"inf R R' == (R=ns1 | (R=ns2 & R'~=ns1) | (R=ns3 & R'=ns3))\"\n\nlemma inf_is_ord [iff]: \"ord ns inf\"\napply (unfold ord_def inf_def)\napply (rule allI)+\napply (rule impI)\napply (simp add: split_paired_all)\nby (rule impI, erule ns.cases, simp_all)+\n\nsubsection\\general properties\\\n\nlemma ns_has_only_Says' [iff]: \"has_only_Says' ns\"\napply (unfold has_only_Says'_def)\napply (rule allI, rule impI)\napply (simp add: split_paired_all)\nby (erule ns.cases, auto)\n\nlemma newn_ns1 [iff]: \"newn ns1 = {Na}\"\nby (simp add: newn_def)\n\nlemma newn_ns2 [iff]: \"newn ns2 = {Nb}\"\nby (auto simp: newn_def Na_def Nb_def)\n\nlemma newn_ns3 [iff]: \"newn ns3 = {}\"\nby (auto simp: newn_def)\n\nlemma ns_wdef [iff]: \"wdef ns\"\nby (auto simp: wdef_def elim: ns.cases)\n\nsubsection\\guardedness for NSL\\\n\nlemma \"uniq ns secret \\ preserv ns keys n Ks\"\nunfolding preserv_def\napply (rule allI)+\napply (rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule fresh_ruleD, simp, simp, simp, simp)\napply (rule allI)+\napply (rule impI, rule impI, rule impI)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* fresh with NS1 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Na = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Na = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* fresh with NS2 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Nb = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Nb = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* fresh with NS3 *)\nby simp\n\nsubsection\\unicity for NSL\\\n\nlemma \"uniq' ns inf secret\"\napply (unfold uniq'_def)\napply (rule allI)+\napply (simp add: split_paired_all)\napply (rule impI, erule ns.cases)\n(* R = ns1 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp)\napply (drule ok_parts_not_new, simp, simp, simp)\napply (clarify, drule ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (simp add: secret_def)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Na in ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns3 *)\napply simp\n(* R = ns2 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (simp only: inf_def, blast)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (simp add: secret_def)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\napply (erule disjE, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\nby (simp_all add: secret_def)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/Proto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118791767282, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2558895393851212}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory L2Opt\nimports L2Defs L2Peephole\nbegin\n\nML {*\nstructure L2FlowThms =\n Named_Thms (\n val name = Binding.name \"L2flow\"\n val description = \"Flow-sensitive optimisations carried out after L2 monadic conversion.\"\n )\n*}\n\nattribute_setup L2flow = {*\n Attrib.add_del\n (Thm.declaration_attribute L2FlowThms.add_thm)\n (Thm.declaration_attribute L2FlowThms.del_thm) *}\n \"Peephole optimisations carried out after L2 monadic conversion.\"\n\n(*\n * The monads \"A\" and \"B\" are equivalent under precondition \"P\".\n * Additionally, under this precondition, they always leave the\n * postcondition \"Q\" (normally) or \"E\" (if an exception occurs).\n *)\ndefinition\n \"monad_equiv P A B Q E \\ (\\s. P s \\ A s = B s) \\ \\ P \\ A \\ Q \\, \\ E \\\"\n\nlemma monad_equivI [intro]:\n \"\\ \\s. P s \\ A s = B s; \\ P \\ A \\ Q \\, \\ E \\ \\ \\ monad_equiv P A B Q E\"\n apply (clarsimp simp: monad_equiv_def)\n done\n\nlemma monad_equiv_eqI [intro]:\n \"\\ \\ P \\ A \\ Q \\, \\ E \\ \\ \\ monad_equiv P A A Q E\"\n apply (clarsimp simp: monad_equiv_def)\n done\n\nlemma monad_equiv_eq:\n \"monad_equiv (\\_. True) A B X Y \\ A = B\"\n apply (rule ext)\n apply (clarsimp simp: monad_equiv_def)\n done\n\nlemma monad_equiv_triv [L2flow]:\n \"monad_equiv P A A (\\_ _. \\s. P s) (\\_ _. \\s. P s)\"\n apply rule\n apply wp\n apply force\n done\n\nlemma monad_equiv_symmetric:\n \"monad_equiv P A B X Y = monad_equiv P B A X Y\"\n apply (clarsimp simp: monad_equiv_def validE_def2 Ball_def split: sum.splits)\n apply force\n done\n\nlemma monad_equivD: \"\\ monad_equiv P A B R E; P s \\ \\ A s = B s\"\n apply (clarsimp simp: monad_equiv_def)\n done\n\n(*\n * Show that under condition \"P\", the values \"A\" and \"B\" are equal.\n *\n * We use this to simplify expressions inside our monads in a (somewhat)\n * controlled fashion.\n *)\ndefinition \"simp_expr P A B \\ P \\ A = B\"\n\nlemma simp_expr_triv: \"simp_expr P A A\"\n apply (clarsimp simp: simp_expr_def)\n done\n\nlemma simp_expr_P_cong:\n \"\\ P = P' \\ \\ simp_expr P A B = simp_expr P' A B\"\n apply (clarsimp simp: simp_expr_def)\n done\n\nlemma simp_expr_rhs_cong [cong]:\n \"\\ P = P'; P' \\ B = B' \\ \\ simp_expr P A B = simp_expr P' A B'\"\n apply (clarsimp simp: simp_expr_def simp_implies_def)\n done\n\nlemma simp_expr_weaken:\n \"\\ simp_expr P A B; Q \\ P \\ \\ simp_expr Q A B\"\n apply (clarsimp simp: simp_expr_def)\n done\n\n(*\n * Monad simplification rules.\n *)\n\nlemma monad_equiv_gets [L2flow]:\n \"simp_expr True v v' \\ monad_equiv P (L2_gets (\\s. v s) n) (L2_gets (\\s. v' s) n)\n (\\r s. P s \\ r = v' s) (\\_ _. False)\"\n apply rule\n apply (clarsimp simp: L2_defs simp_expr_def)+\n done\n\nlemma monad_equiv_throw [L2flow]:\n \"simp_expr True v v' \\\n monad_equiv P (L2_throw v n) (L2_throw v' n) (\\_ _. False) (\\r s. P s \\ r = v')\"\n apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n apply wp\n apply force\n done\n\nlemma monad_equiv_guard:\n \"\\ \\s. simp_expr (P s) (G s) (G' s) \\ \\\n monad_equiv P (L2_guard (\\s. G s)) (L2_guard (\\s. G' s)) (\\r s. P s \\ G' s \\ r = ()) (\\_ _. False)\"\n apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n apply rule\n apply (clarsimp simp: liftE_def guard_def bind_def in_return snd_return)\n apply wp\n apply force\n done\n\n(* We use this weaker form of guard simplification to prevent bound\n * variables being expanded inside of guard statements. *)\nlemma monad_equiv_guard' [L2flow]:\n \"\\ \\s. simp_expr True (G s) (G' s) \\ \\\n monad_equiv P (L2_guard G) (L2_guard G') (\\r s. P s \\ G' s \\ r = ()) (\\_ _. False)\"\n apply (rule monad_equiv_guard)\n apply (rule simp_expr_weaken)\n apply assumption\n apply simp\n done\n\nlemma monad_equiv_guard_False [L2flow]:\n \"\\ \\s. simp_expr (P s) False (G s) \\\n \\ monad_equiv P (L2_guard G) (L2_fail) (\\_ _. False) (\\_ _. False)\"\n apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def validE_def2)\n done\n\nlemma monad_equiv_guard_True [L2flow]:\n \"\\ \\s. simp_expr (P s) True (G s) \\\n \\ monad_equiv P (L2_guard G) L2_skip (\\r s. P s \\ r = ()) (\\_ _. False)\"\n apply (auto simp: L2_defs simp_expr_def guard_def liftE_def return_def returnOk_def bind_def validE_def valid_def)\n done\n\nlemma monad_equiv_guard_conj [L2flow]:\n \"\\ monad_equiv P (L2_guard G1) G1' R1 E1;\n monad_equiv (\\s. R1 () s) (L2_guard G2) G2' R2 E2 \\ \\\n monad_equiv P (L2_guard (\\s. G1 s \\ G2 s)) (L2_seq G1' (\\_. G2')) (\\r s. R2 () s) (\\_ _. False)\"\n apply (subst (asm) (1 2) monad_equiv_symmetric)\n apply (subst monad_equiv_symmetric)\n apply rule\n apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 Bex_def Ball_def split: sum.splits)\n apply fast\n apply (monad_eq simp: monad_equiv_def L2_defs validE_def2 Ball_def split: sum.splits)\n apply fast\n done\n\nlemma monad_equiv_unknown [L2flow]:\n \"monad_equiv P (L2_unknown name) (L2_unknown name) (\\r s. P s) (\\_ _. False)\"\n apply (clarsimp simp: monad_equiv_def L2_defs)\n apply (wp select_wp)\n apply force\n done\n\nlemma monad_equiv_modify [L2flow]:\n \"\\ \\s. simp_expr True (m s) (m' s) \\ \\\n monad_equiv P (L2_modify (\\s. m s)) (L2_modify (\\s. m' s)) (\\r s'. \\s. P s \\ m' s = s' \\ r = ()) (\\_ _. False)\"\n apply rule\n apply (clarsimp simp: L2_defs simp_expr_def liftE_def modify_def put_def get_def bind_def)\n apply (clarsimp simp: L2_defs simp_expr_def)\n apply force\n done\n\nlemma monad_equiv_spec [L2flow]:\n \"\\ \\s s'. simp_expr True ((s, s') \\ S) (S' s s') \\ \\\n monad_equiv P (L2_spec S) (L2_spec ({(s, s'). S' s s'})) (\\r s. \\s. P s) (\\_ _. False)\"\n apply rule\n apply (clarsimp simp: L2_defs simp_expr_def liftE_def spec_def bind_def)\n apply (clarsimp simp: L2_defs)\n apply wp\n apply force\n done\n\nlemma monad_equiv_fail [L2flow]:\n \"monad_equiv P L2_fail L2_fail (\\_ _. False) (\\_ _. False)\"\n apply (clarsimp simp: monad_equiv_def L2_defs)\n done\n\nlemma monad_equiv_condition [L2flow]:\n \"\\ \\s. simp_expr True (C s) (C' s);\n monad_equiv (\\s. P s \\ C' s) L L' QL EL;\n monad_equiv (\\s. P s \\ \\ C' s) R R' QR ER \\ \\\n monad_equiv P (L2_condition (\\s. C s) L R) (L2_condition (\\s. C' s) L' R')\n (\\r s. \\s. P s) (* Deliberately weak to avoid exponential growth. *)\n (\\r s. \\s. P s)\"\n apply rule\n apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def split: condition_splits)\n apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 split: condition_splits sum.splits)\n apply force\n done\n\nlemma monad_equiv_condition_True [L2flow]:\n \"\\ \\s. simp_expr (P s) (C s) True;\n monad_equiv P L L' QL EL \\ \\\n monad_equiv P (L2_condition C L R) L' QL EL\"\n unfolding L2_defs condition_def\n apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n done\n\nlemma monad_equiv_condition_False [L2flow]:\n \"\\ \\s. simp_expr (P s) (C s) False;\n monad_equiv P R R' QR ER \\ \\\n monad_equiv P (L2_condition C L R) R' QR ER\"\n unfolding L2_defs condition_def\n apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n done\n\n(* C-parser sometimes generates boolean expressions like\n if P then (if P then 1 else 0) else Q\n This simplifies the branches. *)\nlemma monad_equiv_gets_if [L2flow]:\n \"\\ \\s. simp_expr (P s) True (b s) \\ \\\n monad_equiv P (L2_gets (\\s. if (b s) then L else R) f)\n (L2_gets (\\s. L) f) (%r s. P s) (\\r s. False)\"\n \"\\ \\s. simp_expr (P s) False (b s) \\ \\\n monad_equiv P (L2_gets (\\s. if (b s) then L else R) f)\n (L2_gets (\\s. R) f) (%r s. P s) (\\r s. False)\"\n apply (monad_eq simp: L2_defs simp_expr_def monad_equiv_def\n validE_def valid_def split: sum.splits)+\n done\n\nlemma monad_equiv_seq [L2flow]:\n \"\\ monad_equiv P A A' Q E;\n \\x. monad_equiv (Q x) (B x) (B' x) (R x) (E2 x) \\ \\\n monad_equiv P (L2_seq A (\\x. B x)) (L2_seq A' (\\x. B' x)) (\\r s. \\r'. R r' r s) (\\r s. \\s. P s)\"\n apply rule\n apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n apply (rule bindE_apply_cong)\n apply simp\n apply (clarsimp simp: validE_def valid_def)\n apply force\n apply (clarsimp simp: monad_equiv_def L2_defs\n validE_def valid_def in_bindE simp_expr_def split: sum.splits)\n apply (erule allE, erule (1) impE)+\n apply fastforce\n done\n\nlemma monad_equiv_catch [L2flow]:\n \"\\ monad_equiv P A A' Q E;\n \\x. monad_equiv (E x) (B x) (B' x) (Q' x) (E2 x) \\ \\\n monad_equiv P (L2_catch A (\\x. B x)) (L2_catch A' (\\x. B' x)) (\\r s. \\s. P s) (\\r s. \\r'. E2 r' r s)\"\n apply rule\n apply atomize\n apply (clarsimp simp: simp_expr_def L2_defs monad_equiv_def)\n apply (erule allE, erule impE, assumption)\n apply (clarsimp simp: validE_def2 split: sum.splits)\n apply (erule allE, erule impE, assumption)\n apply (rule monad_state_eqI)\n apply (clarsimp simp: in_handleE')\n apply force\n apply (clarsimp simp: in_handleE')\n apply force\n apply (fastforce simp: snd_handleE')\n apply (clarsimp simp: monad_equiv_def L2_defs\n validE_def valid_def simp_expr_def in_handleE' split: sum.splits)\n apply (erule allE, erule (1) impE)+\n apply fastforce\n done\n\nlemma monad_equiv_cong:\n \"\\ \\s. P s = P' s;\n \\s. P s \\ A s = A' s;\n \\s. P s \\ B s = B' s;\n \\s s' r. P s \\ Q r s' = Q' r s';\n \\s s' r. P s \\ R r s' = R' r s' \\ \\\n monad_equiv P A B Q R = monad_equiv P' A' B' Q' R'\"\n apply atomize\n apply (clarsimp simp: monad_equiv_def validE_def valid_def split: sum.splits)\n apply (rule iffI)\n apply clarsimp\n apply fastforce\n apply clarsimp\n apply fastforce\n done\n\nlemma monad_equiv_while [L2flow]:\n assumes cond_simp: \"\\s r. simp_expr True (c r s) (c' r s)\"\n assumes body_equiv: \"\\r. monad_equiv (\\s. (\\s'. P s') \\ c' r s) (B r) (B' r) (Q r) (E r)\"\n assumes init_simp: \"\\s r. simp_expr True x x'\"\n shows \"monad_equiv P (L2_while (\\r s. c r s) B x n) (L2_while (\\r s. c' r s) B' x' n) (\\r s. \\ c' r s \\ (\\x. P x)) (\\r s. \\x. E x r s)\"\n apply (insert cond_simp [unfolded simp_expr_def] init_simp [unfolded simp_expr_def])\n apply rule\n apply (clarsimp simp: L2_while_def)\n apply (rule whileLoopE_cong [THEN fun_cong, THEN fun_cong])\n apply force\n apply (cut_tac r=r in body_equiv)\n apply (clarsimp simp: monad_equiv_def)\n apply (erule allE, erule impE, auto)[1]\n apply simp\n apply (clarsimp simp: L2_while_def)\n apply (rule validE_whileLoopE [where I=\"\\r s. \\s. P s\"])\n apply force\n apply (cut_tac r=r in body_equiv)\n apply (clarsimp simp: validE_def valid_def monad_equiv_def split: sum.splits)\n apply blast\n apply simp\n done\n\nlemma monad_equiv_recguard [L2flow]:\n \"\\ monad_equiv P B B' Q E \\ \\\n monad_equiv P (L2_recguard a B) (L2_recguard a B') Q E\"\n apply rule\n apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def\n split: sum.splits condition_splits)\n apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def in_fail\n split: sum.splits condition_splits)\n done\n\nlemma monad_equiv_unreachable' [L2flow]:\n \"monad_equiv (\\_. False) L (L2_gets (\\_. undefined) [''L2Opt_internal_var'']) Q R\"\n apply (monad_eq simp: monad_equiv_def L2_defs simp_expr_def valid_def validE_def)\n done\n\nlemma monad_equiv_split [L2flow]:\n \"\\ \\a b. monad_equiv (P (a, b)) (X a b) (Y a b) (Q a b) (E a b) \\ \\\n monad_equiv (P x) (case x of (a, b) \\ X a b) (case x of (a, b) \\ Y a b)\n (case x of (a, b) \\ Q a b) (case x of (a, b) \\ E a b)\"\n apply (clarsimp simp: monad_equiv_def validE_def valid_def split_def)\n done\n\nlemma simp_expr_solve_constant: \"\\ A \\ B = C \\ \\ simp_expr A B C\"\n by (clarsimp simp: simp_expr_def)\n\nlemma monad_equiv_weaken_pre':\n \"\\ \\s. P' s \\ P s; monad_equiv P L R Q E \\ \\ monad_equiv P' L R Q E\"\n by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nlemma monad_equiv_weaken_pre'':\n \"\\ P' \\ P; monad_equiv P L R Q E \\ \\ monad_equiv P' L R Q E\"\n by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/L2Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2558895318781671}} {"text": "\nsection \"Algebraic laws for abrupt designs\"\ntheory algebraic_laws_abrupt\nimports algebraic_laws_abrupt_aux\n\nbegin\n(*TODO: add laws for assigns when composed with try catch...*)\nsubsection\"Simpset configuration\"\n\ndeclare urel_comp [uabr_comp]\ndeclare urel_cond [uabr_cond]\n\nsubsection\"Throw\"\n\nlemma throw_cpa_left_zero_true_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; true) = (true)\"\n by rel_auto\n\nlemma throw_cpa_left_zero_true_lift_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; \\true\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma throw_cpa_left_zero_false_lift_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; \\false\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\false\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma throw_cpa_left_zero_skip_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (THROW\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma throw_cpa_left_zero_assigns_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) = (THROW\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\n(*lemma throw_cpa_left_zero_top_abr[uabr_comp]:\n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; \\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto*)\n\nlemma not_abrupt_left_zero_throw_abr[uabr_comp]: \n \"(($x) ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) = ($x)\" \n by rel_auto \n\nlemma abrupt_left_zero_throw_abr[uabr_comp]: \n \"($aburpt ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) = $aburpt\" \n by rel_auto \n\nlemma bot_left_zero_throw_abr[uabr_comp]: \n \"(\\\\<^sub>A\\<^sub>B\\<^sub>R ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\<^sub>A\\<^sub>B\\<^sub>R)\" \n by rel_auto\n\n(*lemma throw_abr_idem [uabr_comp]: \n \"(THROW\\<^sub>A\\<^sub>B\\<^sub>R ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) = THROW\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto*)\n\nlemma throw_abr_right_zero_skip_abr[uabr_comp]: \n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; THROW\\<^sub>A\\<^sub>B\\<^sub>R) = THROW\\<^sub>A\\<^sub>B\\<^sub>R\" \n by rel_auto \n\n(*lemma assigns_abr_throw_abr_right[uabr_comp]:\n \"\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R;; THROW\\<^sub>A\\<^sub>B\\<^sub>R = (C3_abr(\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ ($abrupt\\ \\ \\\\\\\\\\<^sub>a\\\\<^sub>A\\<^sub>B\\<^sub>R)))\"\n by rel_auto\n\nlemma assigns_abr_throw_abr_right[uabr_comp]:\n \"\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R;; THROW\\<^sub>A\\<^sub>B\\<^sub>R = (C3_abr(\\\\\\\\<^sub>s\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ ($abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R))))\"\n by rel_auto*)\n\nsubsection\"Skip\"\n\ntext{*In this section we introduce the algebraic laws of programming related to the SKIP\n statement.*}\n\nlemma true_left_zero_skip_cpa_abr[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; true) = (true)\"\n by rel_auto\n\nlemma true_lift_abr_left_zero_skip_abr[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; \\true\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma false_lift_abr_left_zero_skip_abr[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; \\false\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\false\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma skip_abr_left_unit_assigns_abr[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; \\\\\\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma skip_abr_top_abr_left_zero[uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; \\\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\<^sub>A\\<^sub>B\\<^sub>R)\"\n by rel_auto\n\nlemma skip_abr_abrupt_left_zero[uabr_comp]: \n \"($x ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = $x\" \n by rel_auto \n\nlemma skip_abr_bot_left_zero[uabr_comp]: \n \"(\\\\<^sub>A\\<^sub>B\\<^sub>R ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (\\\\<^sub>A\\<^sub>B\\<^sub>R)\" \n by rel_auto\n\nlemma skip_abr_idem [uabr_comp]:\n \"(SKIP\\<^sub>A\\<^sub>B\\<^sub>R ;; SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\"\n by rel_auto\n\nlemma skip_abr_alpha_eq:\n \"SKIP\\<^sub>A\\<^sub>B\\<^sub>R = Simpl\\<^sub>A\\<^sub>B\\<^sub>R (\\$abrupt\\ \\ ($\\\\<^sub>A\\<^sub>B\\<^sub>R\\ =\\<^sub>u $\\\\<^sub>A\\<^sub>B\\<^sub>R))\"\n by (simp add: skip_lift_cpa_def skip_abr_def)\n\nlemma simpl_pre_skip_abr_post:\n \"(Simpl\\<^sub>A\\<^sub>B\\<^sub>R \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>< \\ SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (SKIP\\<^sub>A\\<^sub>B\\<^sub>R \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R \\b\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>>)\"\n by rel_auto \n\nlemma simpl_pre_skip_abr_var:\n fixes x :: \"(bool, ('b) cpa) uvar\"\n shows \"(Simpl\\<^sub>A\\<^sub>B\\<^sub>R $x \\ SKIP\\<^sub>A\\<^sub>B\\<^sub>R) = (SKIP\\<^sub>A\\<^sub>B\\<^sub>R \\ Simpl\\<^sub>A\\<^sub>B\\<^sub>R $x\\)\"\n by rel_auto\n\nlemma skip_abr_post_left_unit[uabr_comp]:\n \"(S \\ (SKIP\\<^sub>A\\<^sub>B\\<^sub>R;; Q)) = (S \\ Q)\"\n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma simpl_post_left_unit[uabr_comp]:\n \"(S \\ (Simpl\\<^sub>A\\<^sub>B\\<^sub>R (\\$abrupt\\ \\ \\II\\\\<^sub>A\\<^sub>B\\<^sub>R);; Q)) = (S \\ Q)\"\n apply pred_simp \n apply rel_simp\n apply transfer\n apply auto\ndone\n\n\nsubsection {*Assignment Laws*}\ntext{*In this section we introduce the algebraic laws of programming related to the assignment\n statement.*}\n\nlemma [urel_cond]:\n \"S \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\R\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\) ;; P \\ \\ $abrupt \\ Q) = \n S \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\R\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\);; Q)\"\n apply pred_simp\n apply fastforce \ndone\n\nlemma [urel_cond]:\n \"S \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\R\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\) ;; P \\ $abrupt \\ Q) = \n S \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\R\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\);; P)\"\n apply pred_simp\n apply fastforce \ndone\n\nlemma not_abrupt_assigns_abr_L6_left_des[urel_cond]:\n \"((S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; (P \\ $abrupt \\ Q))) \\ \\ $abrupt \\ R) = \n ((S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; Q)) \\ \\ $abrupt \\ R)\"\n unfolding assigns_abr_def \n apply pred_simp \n apply fastforce\ndone\n\nlemma abrupt_assigns_abr_L6_left_des[urel_cond]:\n \"((S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; (P \\ \\ $abrupt \\ Q))) \\ $abrupt \\ R) = \n ((S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; Q)) \\ $abrupt \\ R)\"\n unfolding assigns_abr_def \n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma not_abrupt_assigns_abr_L6_right_des[urel_cond]:\n \"(R \\ \\ $abrupt \\ (S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; (P \\ $abrupt \\ Q))) ) = \n ( R \\ \\ $abrupt \\ (S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; P)))\"\n unfolding assigns_abr_def \n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma abrupt_assigns_abr_L6_right_des[urel_cond]:\n \"( R \\ $abrupt \\ (S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; (P \\ \\ $abrupt \\ Q))) ) = \n ( R \\ $abrupt \\ (S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; P)) )\"\n apply pred_simp \n apply rel_simp\n apply fastforce\ndone\n\nlemma not_abrupt_left_assigns_abr_post_des[urel_cond]:\n \"R \\ \\ $abrupt \\ (S \\ (\\a\\\\<^sub>A\\<^sub>B\\<^sub>R;; P)) = \n R \\ \\ $abrupt \\ (S \\ (\\true\\\\<^sub>A\\<^sub>B\\<^sub>R \\ (\\II\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\) ;; P))\"\n unfolding assigns_abr_def \n apply pred_simp \n apply rel_simp\ndone\n\nlemma not_abrupt_left_throw_abr_post_des[urel_cond]:\n \"R \\ \\ $abrupt \\ (S \\ (THROW\\<^sub>A\\<^sub>B\\<^sub>R;; P)) = \n R \\ \\ $abrupt \\ (S \\ ((\\$abrupt) \\ (\\II\\\\<^sub>A\\<^sub>B\\<^sub>R \\ $abrupt\\) ;; P))\" \n unfolding assigns_abr_def \n apply pred_simp \n apply rel_simp\ndone\n\nlemma usubst_abr_cancel [usubst]: \n assumes 1:\"weak_lens v\" \n shows \"($v)\\\\expr\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>= \\expr\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub><\"\n using 1\n by rel_auto\n\nlemma usubst_abr_lift_cancel[usubst]: \n assumes 1:\"weak_lens v\" \n shows \"\\($v)\\\\expr\\\\<^sub>\\\\<^sub>A\\<^sub>B\\<^sub>R= \\expr\\\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub><\"\n using 1\n by rel_auto\n\nlemma assigns_abr_id [uabr_simpl]: \"SKIP\\<^sub>A\\<^sub>B\\<^sub>R = \\id\\\\<^sub>A\\<^sub>B\\<^sub>R\"\n unfolding skip_abr_def assigns_abr_def\n by (rel_auto)\n\nlemma assign_test[uabr_comp]:\n assumes 1:\"mwb_lens x\" \n shows \"(x \\ \\u\\ ;; x \\ \\v\\) = (x \\ \\v\\)\"\n using 1 \n by (simp add: usubst uabr_comp )\n\nlemma assign_abr_left_comp_subst[uabr_comp]: \n \"(x \\ u ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R(\\P\\\\<^sub>A\\<^sub>B\\<^sub>R \\ \\Q\\\\<^sub>A\\<^sub>B\\<^sub>R)) = Simpl\\<^sub>A\\<^sub>B\\<^sub>R(\\P\\\\u\\\\<^sub>\\\\<^sub>A\\<^sub>B\\<^sub>R \\ \\Q\\\\u\\\\<^sub>\\\\<^sub>A\\<^sub>B\\<^sub>R)\" \n by (simp add: uabr_comp usubst)\n\nlemma assign_abr_twice[uabr_comp]: \n assumes \"mwb_lens x\" and \"x \\ f\" \n shows \"(x \\ e ;; x \\ f) = (x \\ f)\" \n using assms\n by (simp add: uabr_comp usubst)\n \nlemma assign_abr_commute:\n assumes \"x \\ y\" \"x \\ f\" \"y \\ e\"\n shows \"(x \\ e ;; y \\ f) = (y \\ f ;; x \\ e)\"\n using assms\n by (simp add: uabr_comp usubst usubst_upd_comm)\n\nlemma assign_abr_cond_abr[uabr_comp]: (*needs more laws to be automatic*)\n fixes x :: \"('a, '\\) uvar\"\n shows \"(x \\ e ;; (bif b then Simpl\\<^sub>A\\<^sub>B\\<^sub>R P else Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q eif)) = \n (bif (b\\e/x\\) then (x \\ e ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R P) else (x \\ e ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R Q) eif)\"\n apply (simp add: usubst uabr_comp)\n apply rel_auto\ndone\n\nlemma assign_c_uop1[uabr_comp]: \n assumes 1: \"mwb_lens v\"\n shows \"(v \\ e1 ;; v \\ (uop F (&v))) = (v \\ (uop F e1))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_bop1[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v \\ e1 ;; v \\(bop bp (&v) e2)) = (v \\ (bop bp e1 e2))\"\n by (simp add: usubst uabr_comp assms)\n \nlemma assign_c_bop2[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\"\n shows \"(v \\ e1 ;; v \\ (bop bp e2 (&v))) = (v \\ (bop bp e2 e1))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_trop1[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp (&v) e2 e3)) = \n (v \\ (trop tp e1 e2 e3))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_trop2[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp e2 (&v) e3)) = \n (v \\ (trop tp e2 e1 e3))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_trop3[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\"\n shows \"(v \\ e1 ;; v \\ (trop tp e2 e3 (&v))) = \n (v \\ (trop tp e2 e3 e1))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_qtop1[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp (&v) e2 e3 e4)) = \n (v \\ (qtop tp e1 e2 e3 e4))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_qtop2[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 (&v) e3 e4)) = \n (v \\ (qtop tp e2 e1 e3 e4))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_qtop3[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 e3 (&v) e4)) = \n (v \\ (qtop tp e2 e3 e1 e4))\"\n by (simp add: usubst uabr_comp assms)\n\nlemma assign_c_qtop4[uabr_comp]: \n assumes 1: \"mwb_lens v\" and 2:\"v \\ e2\" and 3:\"v \\ e3\" and 4:\"v \\ e4\"\n shows \"(v \\ e1 ;; v \\ (qtop tp e2 e3 e4 (&v))) = \n (v \\ (qtop tp e2 e3 e4 e1))\"\n by (simp add: usubst uabr_comp assms)\n \ntext {*In the sequel we define assignment laws proposed by Hoare*}\n\nlemma assign_abr_vwb_skip_abr[uabr_comp]:\n assumes 1: \"vwb_lens v\"\n shows \"(v \\ &v) = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp add: assms usubst uabr_simpl)\n\nlemma assign_c_simultaneous:\n assumes 1: \"vwb_lens var2\"\n and 2: \"var1 \\ var2\"\n shows \"var1, var2 \\ exp, &var2 = var1 \\ exp\"\n by (simp add: assms usubst_upd_comm usubst)\n\nlemma assign_c_seq[uabr_comp]:\n assumes 1: \"vwb_lens var2\"\n shows\"(var1 \\ exp);; (var2 \\ &var2) = (var1 \\ exp)\"\n by (simp add: assms usubst uabr_comp)\n\nlemma assign_c_cond_c_uop[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\"\n shows \"bif uop F exp then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif uop F (&v) then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_bop1[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\"\n shows \"bif bop bp exp exp2 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif bop bp (&v) exp2 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_bop2[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\"\n shows \"bif bop bp exp2 exp then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif bop bp exp2 (&v) then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_cond_trop1[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp exp2 exp3 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif trop bp (&v) exp2 exp3 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_cond_trop2[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp2 exp exp3 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif trop bp exp2 (&v) exp3 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_cond_trop3[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\"\n shows \"bif trop bp exp2 exp3 exp then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;;Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif trop bp exp2 exp3 (&v) then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_cond_qtop1[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp exp2 exp3 exp4 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif qtop bp (&v) exp2 exp3 exp4 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_qtop2[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4:\"v \\ exp4\"\n shows \"bif qtop bp exp2 exp exp3 exp4 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif qtop bp exp2 (&v) exp3 exp4 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_qtop3[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp2 exp3 exp exp4 then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif qtop bp exp2 exp3 (&v) exp4 then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl )\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_qtop4[uabr_comp]: (*needs more laws to be automatic*)\n assumes 1: \"weak_lens v\" and 2: \"v \\ exp2\" and 3: \"v \\ exp3\" and 4: \"v \\ exp4\"\n shows \"bif qtop bp exp2 exp3 exp4 exp then (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1) else (v \\ exp ;; Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2) eif = \n v \\ exp ;; bif qtop bp exp2 exp3 exp4 (&v) then Simpl\\<^sub>A\\<^sub>B\\<^sub>R C1 else Simpl\\<^sub>A\\<^sub>B\\<^sub>R C2 eif\"\n apply (simp add: assms usubst uabr_comp uabr_simpl)\n apply pred_simp\n apply rel_simp\n apply auto\n apply (metis assms unrest_upred.rep_eq weak_lens.put_get)+\ndone\n\nlemma assign_c_cond_If [uabr_cond]: \n \"(bif bexp then (v \\ exp1) else (v \\ exp2) eif) = \n (v \\ (exp1 \\ bexp \\ exp2))\" \n by rel_auto\n\nsubsection {*While laws*}\ntext{*In this section we introduce the algebraic laws of programming related to the while\n statement.*}\n\ntheorem while_unfold:\n \"while b do P od = (bif b then (P ;; while b do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\nproof -\n have m:\"mono (\\X. bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (auto intro: monoI seqr_mono if_mono)\n have \"(while b do P od) = (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (simp add: While_def)\n also have \"... = (bif b then (P ;; (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (subst lfp_unfold,simp_all add:m )\n also have \"... = (bif b then (P ;; while b do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (simp add: While_def)\n finally show ?thesis .\nqed\n\n\n(*lemma while_true:\n shows \"(while true do P od) = \\\\<^sub>A\\<^sub>B\\<^sub>R\"\n apply (simp add: While_def alpha)\n apply (rule antisym)\n apply (simp_all)\n apply (rule conjI)\n apply (rule lfp_lowerbound)\n apply (simp add: C3_abr_def design_def cond_def)\n apply rel_auto\n apply (frule cond_mono)\ndone*)\n\nlemma while_false:\n shows \"(while false do P od) = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\"\nproof -\n have \"(while false do P od) = bif false then (P ;; while false do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif\" \n using while_unfold[of _ P] by simp\n also have \"... = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\" by rel_blast\n finally show ?thesis . \nqed\n\nlemma while_inv_unfold:\n \"while b invr p do P od = (bif b then (P ;; while b invr p do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n unfolding While_inv_def using while_unfold\n by auto\n\ntheorem while_bot_unfold:\n \"while\\<^sub>\\ b do P od = (bif b then (P ;; while\\<^sub>\\ b do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\nproof -\n have m:\"mono (\\X. bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (auto intro: monoI seqr_mono if_mono)\n have \"(while\\<^sub>\\ b do P od) = (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (simp add: While_bot_def)\n also have \"... = (bif b then (P ;; (\\ X \\ bif b then (P ;; X) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (subst gfp_unfold, simp_all add: m)\n also have \"... = (bif b then (P ;; while\\<^sub>\\ b do P od) else SKIP\\<^sub>A\\<^sub>B\\<^sub>R eif)\"\n by (simp add: While_bot_def)\n finally show ?thesis .\nqed\n\nterm \"while\\<^sub>\\ b do P od\"\n\ntheorem while_bot_false: \"while\\<^sub>\\ false do P od = SKIP\\<^sub>A\\<^sub>B\\<^sub>R\"\n by (simp add: While_bot_def mu_const alpha)\n\ntheorem while_bot_true: \"while\\<^sub>\\ true do P od = (\\ X \\ (P ;; X))\"\n by (simp add: While_bot_def alpha)\n\nsubsection {*assume laws*}\n\nlemma assume_twice[uabr_comp]: \"(b\\<^sup>\\\\<^sup>C ;; c\\<^sup>\\\\<^sup>C) = (b \\ c)\\<^sup>\\\\<^sup>C\"\n apply pred_simp \n apply auto\n apply (rel_simp)+\n apply blast\n apply (rel_simp)+\n apply (metis (full_types))\ndone\n\nlemma assert_twice[uabr_comp]: \"(b\\<^sub>\\\\<^sub>C ;; c\\<^sub>\\\\<^sub>C) = (b \\ c)\\<^sub>\\\\<^sub>C\" \n apply pred_simp \n apply auto\n apply (rel_simp)+\n apply blast\n apply (rel_simp)+\n apply (metis (full_types))\ndone\n\nsubsection {*Try Catch laws*}\n(*see utp_hoare_helper*)\n\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/AlgebraicLaws/Abrupt/algebraic_laws_abrupt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25588953187816704}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Bisim_Pres\n imports Bisimulation Sim_Pres\nbegin\n\ncontext env begin\n\nlemma bisimInputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n\n assumes \"\\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]\"\n\n shows \"\\ \\ M\\\\*xvec N\\.P \\ M\\\\*xvec N\\.Q\"\nproof -\n let ?X = \"{(\\, M\\\\*xvec N\\.P, M\\\\*xvec N\\.Q) | \\ M xvec N P Q. \\Tvec. length xvec = length Tvec \\ \\ \\ P[xvec::=Tvec] \\ Q[xvec::=Tvec]}\"\n\n from assms have \"(\\, M\\\\*xvec N\\.P, M\\\\*xvec N\\.Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ P Q)\n thus ?case by auto\n next\n case(cSim \\ P Q)\n thus ?case by(blast intro: inputPres)\n next\n case(cExt \\ P Q \\')\n thus ?case by(blast dest: bisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n \nlemma bisimOutputPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n\n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ M\\N\\.P \\ M\\N\\.Q\"\nproof -\n let ?X = \"{(\\, M\\N\\.P, M\\N\\.Q) | \\ M N P Q. \\ \\ P \\ Q}\"\n from `\\ \\ P \\ Q` have \"(\\, M\\N\\.P, M\\N\\.Q) \\ ?X\" by auto\n thus ?thesis\n by(coinduct rule: bisimCoinduct, auto) (blast intro: outputPres dest: bisimE)+\nqed\n\nlemma bisimCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes \"\\\\ P. (\\, P) mem CsP \\ \\Q. (\\, Q) mem CsQ \\ guarded Q \\ \\ \\ P \\ Q\"\n and \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q\"\n\n shows \"\\ \\ Cases CsP \\ Cases CsQ\"\nproof -\n let ?X = \"{(\\, Cases CsP, Cases CsQ) | \\ CsP CsQ. (\\\\ P. (\\, P) mem CsP \\ (\\Q. (\\, Q) mem CsQ \\ guarded Q \\ \\ \\ P \\ Q)) \\\n (\\\\ Q. (\\, Q) mem CsQ \\ (\\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q))}\"\n from assms have \"(\\, Cases CsP, Cases CsQ) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ P Q)\n thus ?case by auto\n next\n case(cSim \\ CasesP CasesQ)\n then obtain CsP CsQ where C1: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ \\ \\ P \\ Q\"\n and A: \"CasesP = Cases CsP\" and B: \"CasesQ = Cases CsQ\"\n by auto\n note C1\n moreover have \"\\\\ P Q. \\ \\ P \\ Q \\ \\ \\ P \\[bisim] Q\" by(rule bisimE)\n moreover have \"bisim \\ ?X \\ bisim\" by blast\n ultimately have \"\\ \\ Cases CsP \\[(?X \\ bisim)] Cases CsQ\"\n by(rule casePres)\n thus ?case using A B by blast\n next\n case(cExt \\ P Q)\n thus ?case by(blast dest: bisimE)\n next\n case(cSym \\ P Q)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n \n assumes \"\\ \\ P \\ Q\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\ \\\\x\\Q\"\nproof -\n let ?X = \"{(\\, \\\\x\\P, \\\\x\\Q) | \\ x P Q. \\ \\ P \\ Q \\ x \\ \\}\"\n \n from assms have \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ xP xQ)\n from `(\\, xP, xQ) \\ ?X` obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n moreover from `\\ \\ P \\ Q` have PeqQ: \"insertAssertion(extractFrame P) \\ \\\\<^sub>F insertAssertion(extractFrame Q) \\\"\n by(rule bisimE)\n ultimately show ?case by(auto intro: frameResPres)\n next\n case(cSim \\ xP xQ)\n from `(\\, xP, xQ) \\ ?X` obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n from `\\ \\ P \\ Q` have \"\\ \\ P \\[bisim] Q\" by(rule bisimE)\n moreover have \"eqvt ?X\"\n by(force simp add: eqvt_def bisimClosed pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n hence \"eqvt(?X \\ bisim)\" by auto\n moreover note `x \\ \\`\n moreover have \"bisim \\ ?X \\ bisim\" by auto\n moreover have \"\\\\ P Q x. \\(\\, P, Q) \\ bisim; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n by auto\n ultimately have \"\\ \\ \\\\x\\P \\[(?X \\ bisim)] \\\\x\\Q\"\n by(rule resPres)\n with `xP = \\\\x\\P` `xQ = \\\\x\\Q` show ?case\n by simp\n next\n case(cExt \\ xP xQ \\')\n from `(\\, xP, xQ) \\ ?X` obtain x P Q where \"\\ \\ P \\ Q\" and \"x \\ \\\" and \"xP = \\\\x\\P\" and \"xQ = \\\\x\\Q\"\n by auto\n obtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ \\\" and \"y \\ \\'\"\n by(generate_fresh \"name\", auto simp add: fresh_prod)\n from `\\ \\ P \\ Q` have \"\\ \\ ([(x, y)] \\ \\') \\ P \\ Q\"\n by(rule bisimE)\n hence \"([(x, y)] \\ (\\ \\ ([(x, y)] \\ \\'))) \\ ([(x, y)] \\ P) \\ ([(x, y)] \\ Q)\"\n by(rule bisimClosed)\n with `x \\ \\` `y \\ \\` have \"\\ \\ \\' \\ ([(x, y)] \\ P) \\ ([(x, y)] \\ Q)\"\n by(simp add: eqvts)\n with `y \\ \\` `y \\ \\'` have \"(\\ \\ \\', \\\\y\\([(x, y)] \\ P), \\\\y\\([(x, y)] \\ Q)) \\ ?X\"\n by auto\n moreover from `y \\ P` `y \\ Q` have \"\\\\x\\P = \\\\y\\([(x, y)] \\ P)\" and \"\\\\x\\Q = \\\\y\\([(x, y)] \\ Q)\"\n by(simp add: alphaRes)+\n ultimately show ?case using `xP = \\\\x\\P` `xQ = \\\\x\\Q` by simp\n next\n case(cSym \\ P Q)\n thus ?case\n by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\ Q\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\*xvec\\P \\ \\\\*xvec\\Q\"\nusing assms\nby(induct xvec) (auto intro: bisimResPres)\n\nlemma bisimParPresAux:\n fixes \\ :: 'b\n and \\\\<^sub>R :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>R :: \"name list\"\n \n assumes \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nproof -\n let ?X = \"{(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) | xvec \\ P Q R. xvec \\* \\ \\ (\\A\\<^sub>R \\\\<^sub>R. (extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* \\ \\ A\\<^sub>R \\* P \\ A\\<^sub>R \\* Q) \\\n \\ \\ \\\\<^sub>R \\ P \\ Q)}\"\n {\n fix xvec :: \"name list\"\n and \\ :: 'b \n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assume \"xvec \\* \\\"\n and \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n\n hence \"(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) \\ ?X\"\n apply auto\n by blast\n }\n\n note XI = this\n {\n fix xvec :: \"name list\"\n and \\ :: 'b \n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assume \"xvec \\* \\\"\n and A: \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q; A\\<^sub>R \\* C\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n\n from `xvec \\* \\` have \"(\\, \\\\*xvec\\(P \\ R), \\\\*xvec\\(Q \\ R)) \\ ?X\"\n proof(rule XI)\n fix A\\<^sub>R \\\\<^sub>R\n assume FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n obtain p::\"name prm\" where \"(p \\ A\\<^sub>R) \\* \\\" and \"(p \\ A\\<^sub>R) \\* P\" and \"(p \\ A\\<^sub>R) \\* Q\" and \"(p \\ A\\<^sub>R) \\* R\" and \"(p \\ A\\<^sub>R) \\* C\"\n and \"(p \\ A\\<^sub>R) \\* \\\\<^sub>R\" and S: \"(set p) \\ (set A\\<^sub>R) \\ (set(p \\ A\\<^sub>R))\" and \"distinctPerm p\"\n by(rule_tac c=\"(\\, P, Q, R, \\\\<^sub>R, C)\" in name_list_avoiding) auto\n from FrR `(p \\ A\\<^sub>R) \\* \\\\<^sub>R` S have \"extractFrame R = \\(p \\ A\\<^sub>R), p \\ \\\\<^sub>R\\\" by(simp add: frameChainAlpha')\n\n moreover assume \"A\\<^sub>R \\* \\\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `A\\<^sub>R \\* \\` `(p \\ A\\<^sub>R) \\* \\` S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n moreover assume \"A\\<^sub>R \\* P\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `A\\<^sub>R \\* P` `(p \\ A\\<^sub>R) \\* P` S have \"(p \\ A\\<^sub>R) \\* P\" by simp\n moreover assume \"A\\<^sub>R \\* Q\"\n hence \"(p \\ A\\<^sub>R) \\* (p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `A\\<^sub>R \\* Q` `(p \\ A\\<^sub>R) \\* Q` S have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n ultimately have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" using `(p \\ A\\<^sub>R) \\* C` A by blast\n hence \"(p \\ (\\ \\ (p \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with `A\\<^sub>R \\* \\` `(p \\ A\\<^sub>R) \\* \\` `A\\<^sub>R \\* P` `(p \\ A\\<^sub>R) \\* P` `A\\<^sub>R \\* Q` `(p \\ A\\<^sub>R) \\* Q` S `distinctPerm p`\n show \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(simp add: eqvts)\n qed\n }\n note XI' = this\n\n have \"eqvt ?X\"\n apply(auto simp add: eqvt_def)\n apply(rule_tac x=\"p \\ xvec\" in exI)\n apply(rule_tac x=\"p \\ P\" in exI)\n apply(rule_tac x=\"p \\ Q\" in exI)\n apply(rule_tac x=\"p \\ R\" in exI)\n apply(simp add: eqvts)\n apply(simp add: fresh_star_bij)\n apply(clarify)\n apply(erule_tac x=\"(rev p) \\ A\\<^sub>R\" in allE)\n apply(erule_tac x=\"(rev p) \\ \\\\<^sub>R\" in allE)\n apply(drule mp)\n apply(rule conjI)\n apply(rule_tac pi=p in pt_bij4[OF pt_name_inst, OF at_name_inst])\n apply(simp add: eqvts)\n defer\n apply(drule_tac p=p in bisimClosed)\n apply(simp add: eqvts)\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n apply simp\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n apply simp\n apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n by simp\n\n moreover have Res: \"\\\\ P Q x. \\(\\, P, Q) \\ ?X \\ bisim; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n proof -\n fix \\ P Q x\n assume \"(\\, P, Q) \\ ?X \\ bisim\" and \"(x::name) \\ \\\"\n show \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X \\ bisim\"\n proof(case_tac \"(\\, P, Q) \\ ?X\")\n assume \"(\\, P, Q) \\ ?X\"\n with `x \\ \\` have \"(\\, \\\\x\\P, \\\\x\\Q) \\ ?X\"\n apply auto\n by(rule_tac x=\"x#xvec\" in exI) auto\n thus ?thesis by simp\n next\n assume \"\\(\\, P, Q) \\ ?X\"\n with `(\\, P, Q) \\ ?X \\ bisim` have \"\\ \\ P \\ Q\"\n by blast\n hence \"\\ \\ \\\\x\\P \\ \\\\x\\Q\" using `x \\ \\`\n by(rule bisimResPres)\n thus ?thesis\n by simp\n qed\n qed\n\n have \"(\\, P \\ R, Q \\ R) \\ ?X\" \n proof -\n {\n fix A\\<^sub>R' :: \"name list\"\n and \\\\<^sub>R' :: 'b\n\n assume FrR': \"extractFrame R = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\"\n and \"A\\<^sub>R' \\* P\"\n and \"A\\<^sub>R' \\* Q\"\n\n obtain p where \"(p \\ A\\<^sub>R') \\* A\\<^sub>R\" and \"(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\" and \"(p \\ A\\<^sub>R') \\* \\\" and \"(p \\ A\\<^sub>R') \\* P\" and \"(p \\ A\\<^sub>R') \\* Q\"\n and Sp: \"(set p) \\ (set A\\<^sub>R') \\ (set(p \\ A\\<^sub>R'))\" and \"distinctPerm p\"\n by(rule_tac c=\"(A\\<^sub>R, \\, \\\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n \n from FrR' `(p \\ A\\<^sub>R') \\* \\\\<^sub>R'` Sp have \"extractFrame R = \\(p \\ A\\<^sub>R'), p \\ \\\\<^sub>R'\\\"\n by(simp add: frameChainAlpha eqvts)\n with FrR `(p \\ A\\<^sub>R') \\* A\\<^sub>R` obtain q::\"name prm\" \n where Sq: \"set q \\ set(p \\ A\\<^sub>R') \\ set A\\<^sub>R\" and \"distinctPerm q\" and \"\\\\<^sub>R = q \\ p \\ \\\\<^sub>R'\"\n by(force elim: frameChainEq)\n\n from `\\ \\ \\\\<^sub>R \\ P \\ Q` `\\\\<^sub>R = q \\ p \\ \\\\<^sub>R'` have \"\\ \\ (q \\ p \\ \\\\<^sub>R') \\ P \\ Q\" by simp\n hence \"(q \\ (\\ \\ (q \\ p \\ \\\\<^sub>R'))) \\ (q \\ P) \\ (q \\ Q)\" by(rule bisimClosed)\n with Sq `A\\<^sub>R \\* \\` `(p \\ A\\<^sub>R') \\* \\` `A\\<^sub>R \\* P` `(p \\ A\\<^sub>R') \\* P` `A\\<^sub>R \\* Q` `(p \\ A\\<^sub>R') \\* Q` `distinctPerm q`\n have \"\\ \\ (p \\ \\\\<^sub>R') \\ P \\ Q\" by(simp add: eqvts)\n hence \"(p \\ (\\ \\ (p \\ \\\\<^sub>R'))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with Sp `A\\<^sub>R' \\* \\` `(p \\ A\\<^sub>R') \\* \\` `A\\<^sub>R' \\* P` `(p \\ A\\<^sub>R') \\* P` `A\\<^sub>R' \\* Q` `(p \\ A\\<^sub>R') \\* Q` `distinctPerm p`\n have \"\\ \\ \\\\<^sub>R' \\ P \\ Q\" by(simp add: eqvts)\n }\n thus ?thesis\n apply auto\n apply(rule_tac x=\"[]\" in exI)\n by auto blast\n qed\n thus ?thesis\n proof(coinduct rule: bisimCoinduct)\n case(cStatEq \\ PR QR)\n from `(\\, PR, QR) \\ ?X`\n obtain xvec P Q R A\\<^sub>R \\\\<^sub>R where PFrR: \"PR = \\\\*xvec\\(P \\ R)\" and QFrR: \"QR = \\\\*xvec\\(Q \\ R)\"\n and \"xvec \\* \\\" and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and PSimQ: \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and \"A\\<^sub>R \\* xvec\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\"\n apply auto\n apply(subgoal_tac \"\\A\\<^sub>R \\\\<^sub>R. extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* (xvec, \\, P, Q, R)\")\n apply auto\n apply(rule_tac F=\"extractFrame R\" and C=\"(xvec, \\, P, Q, R)\" in freshFrame)\n by auto\n\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* A\\<^sub>R\" and \"A\\<^sub>P \\* \\\\<^sub>R\"\n by(rule_tac C=\"(\\, A\\<^sub>R, \\\\<^sub>R)\" in freshFrame) auto\n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* A\\<^sub>R\" and \"A\\<^sub>Q \\* \\\\<^sub>R\"\n by(rule_tac C=\"(\\, A\\<^sub>R, \\\\<^sub>R)\" in freshFrame) auto\n from `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R` FrP FrQ have \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>Q\"\n by(force dest: extractFrameFreshChain)+\n \n have \"\\(A\\<^sub>P@A\\<^sub>R), \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>Q@A\\<^sub>R), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P\\\"\n by(metis frameResChainPres frameNilStatEq Associativity Commutativity AssertionStatEqTrans Composition)\n moreover from PSimQ have \"insertAssertion(extractFrame P) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insertAssertion(extractFrame Q) (\\ \\ \\\\<^sub>R)\"\n by(rule bisimE)\n with FrP FrQ freshCompChain `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\\\<^sub>R` have \"\\A\\<^sub>P, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by auto\n moreover have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(metis frameResChainPres frameNilStatEq Associativity Commutativity AssertionStatEqTrans Composition)\n ultimately have \"\\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(blast intro: FrameStatEqTrans)\n hence \"\\(A\\<^sub>R@A\\<^sub>P), \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>R@A\\<^sub>Q), \\ \\ \\\\<^sub>Q \\ \\\\<^sub>R\\\"\n by(drule_tac frameResChainPres) (simp add: frameChainAppend)\n thus ?thesis\n apply(simp add: frameChainAppend)\n by(metis frameResChainComm FrameStatEqTrans)\n qed\n moreover from `A\\<^sub>P \\* \\` `A\\<^sub>R \\* \\` have \"(A\\<^sub>P@A\\<^sub>R) \\* \\\" by simp\n moreover from `A\\<^sub>Q \\* \\` `A\\<^sub>R \\* \\` have \"(A\\<^sub>Q@A\\<^sub>R) \\* \\\" by simp\n ultimately have PFrRQR: \"insertAssertion(extractFrame(P \\ R)) \\ \\\\<^sub>F insertAssertion(extractFrame(Q \\ R)) \\\"\n using FrP FrQ FrR `A\\<^sub>P \\* A\\<^sub>R` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>Q \\* A\\<^sub>R` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>R \\* \\\\<^sub>Q`\n by simp\n \n from `xvec \\* \\` have \"insertAssertion (extractFrame(\\\\*xvec\\P \\ R)) \\ \\\\<^sub>F \\\\*xvec\\(insertAssertion (extractFrame(P \\ R)) \\)\"\n by(rule insertAssertionExtractFrameFresh)\n moreover from PFrRQR have \"\\\\*xvec\\(insertAssertion (extractFrame(P \\ R)) \\) \\\\<^sub>F \\\\*xvec\\(insertAssertion (extractFrame(Q \\ R)) \\)\"\n by(induct xvec) (auto intro: frameResPres)\n moreover from `xvec \\* \\` have \"\\\\*xvec\\(insertAssertion (extractFrame(Q \\ R)) \\) \\\\<^sub>F insertAssertion (extractFrame(\\\\*xvec\\Q \\ R)) \\\"\n by(rule FrameStatEqSym[OF insertAssertionExtractFrameFresh])\n ultimately show ?case using PFrR QFrR\n by(blast intro: FrameStatEqTrans)\n next\n case(cSim \\ PR QR)\n {\n fix \\ P Q R xvec\n assume \"\\A\\<^sub>R \\\\<^sub>R. \\extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\; A\\<^sub>R \\* \\; A\\<^sub>R \\* P; A\\<^sub>R \\* Q\\ \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n moreover have \"eqvt bisim\" by simp\n moreover from `eqvt ?X` have \"eqvt(?X \\ bisim)\" by auto\n moreover from bisimE(1) have \"\\\\ P Q. \\ \\ P \\ Q \\ insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P) \\\" by(simp add: FrameStatEq_def)\n moreover note bisimE(2) bisimE(3)\n moreover \n {\n fix \\ P Q A\\<^sub>R \\\\<^sub>R R\n assume PSimQ: \"\\ \\ \\\\<^sub>R \\ P \\ Q\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n hence \"(\\, P \\ R, Q \\ R) \\ ?X\"\n proof -\n have \"P \\ R = \\\\*[]\\(P \\ R)\" by simp\n moreover have \"Q \\ R = \\\\*[]\\(Q \\ R)\" by simp\n moreover have \"([]::name list) \\* \\\" by simp\n moreover \n {\n fix A\\<^sub>R' \\\\<^sub>R'\n\n assume FrR': \"extractFrame R = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\"\n and \"A\\<^sub>R' \\* P\"\n and \"A\\<^sub>R' \\* Q\"\n obtain p where \"(p \\ A\\<^sub>R') \\* A\\<^sub>R\"\n and \"(p \\ A\\<^sub>R') \\* \\\\<^sub>R'\"\n and \"(p \\ A\\<^sub>R') \\* \\\"\n and \"(p \\ A\\<^sub>R') \\* P\"\n and \"(p \\ A\\<^sub>R') \\* Q\"\n and S: \"(set p) \\ (set A\\<^sub>R') \\ (set(p \\ A\\<^sub>R'))\" and \"distinctPerm p\"\n by(rule_tac c=\"(A\\<^sub>R, \\, \\\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n\n\n from `(p \\ A\\<^sub>R') \\* \\\\<^sub>R'` S have \"\\A\\<^sub>R', \\\\<^sub>R'\\ = \\p \\ A\\<^sub>R', p \\ \\\\<^sub>R'\\\"\n by(simp add: frameChainAlpha)\n\n with FrR' have FrR'': \"extractFrame R = \\p \\ A\\<^sub>R', p \\ \\\\<^sub>R'\\\" by simp\n with FrR `(p \\ A\\<^sub>R') \\* A\\<^sub>R`\n obtain q where \"p \\ \\\\<^sub>R' = (q::name prm) \\ \\\\<^sub>R\" and S': \"set q \\ (set A\\<^sub>R) \\ set(p \\ A\\<^sub>R')\" and \"distinctPerm q\"\n apply auto\n apply(drule_tac sym) apply simp\n by(drule_tac frameChainEq) auto\n from PSimQ have \"(q \\ (\\ \\ \\\\<^sub>R)) \\ (q \\ P) \\ (q \\ Q)\"\n by(rule bisimClosed)\n with `A\\<^sub>R \\* \\` `A\\<^sub>R \\* P` `A\\<^sub>R \\* Q` `(p \\ A\\<^sub>R') \\* \\` `(p \\ A\\<^sub>R') \\* P` `(p \\ A\\<^sub>R') \\* Q` S'\n have \"\\ \\ (q \\ \\\\<^sub>R) \\ P \\ Q\" by(simp add: eqvts)\n hence \"(p \\ (\\ \\ (q \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\" by(rule bisimClosed)\n with `A\\<^sub>R' \\* \\` `A\\<^sub>R' \\* P` `A\\<^sub>R' \\* Q` `(p \\ A\\<^sub>R') \\* \\` `(p \\ A\\<^sub>R') \\* P` `(p \\ A\\<^sub>R') \\* Q` S `distinctPerm p` `(p \\ \\\\<^sub>R') = q \\ \\\\<^sub>R` \n have \"\\ \\ \\\\<^sub>R' \\ P \\ Q\"\n by(drule_tac sym) (simp add: eqvts)\n }\n ultimately show ?thesis\n by blast\n qed\n hence \"(\\, P \\ R, Q \\ R) \\ ?X \\ bisim\"\n by simp\n }\n moreover have \"\\\\ P Q xvec. \\(\\, P, Q) \\ ?X \\ bisim; (xvec::name list) \\* \\\\ \\ (\\, \\\\*xvec\\P, \\\\*xvec\\Q) \\ ?X \\ bisim\"\n proof -\n fix \\ P Q xvec\n assume \"(\\, P, Q) \\ ?X \\ bisim\"\n assume \"(xvec::name list) \\* \\\"\n thus \"(\\, \\\\*xvec\\P, \\\\*xvec\\Q) \\ ?X \\ bisim\"\n proof(induct xvec)\n case Nil\n thus ?case using `(\\, P, Q) \\ ?X \\ bisim` by simp\n next\n case(Cons x xvec)\n thus ?case by(simp only: resChain.simps) (rule_tac Res, auto)\n qed\n qed\n ultimately have \"\\ \\ P \\ R \\[(?X \\ bisim)] Q \\ R\" using statEqBisim\n by(rule parPres)\n moreover assume \"(xvec::name list) \\* \\\"\n moreover from `eqvt ?X` have \"eqvt(?X \\ bisim)\" by auto\n ultimately have \"\\ \\ \\\\*xvec\\(P \\ R) \\[(?X \\ bisim)] \\\\*xvec\\(Q \\ R)\" using Res\n by(rule_tac resChainPres)\n }\n with `(\\, PR, QR) \\ ?X` show ?case by blast\n next\n case(cExt \\ PR QR \\')\n\n from `(\\, PR, QR) \\ ?X`\n obtain xvec P Q R A\\<^sub>R \\\\<^sub>R where PFrR: \"PR = \\\\*xvec\\(P \\ R)\" and QFrR: \"QR = \\\\*xvec\\(Q \\ R)\"\n and \"xvec \\* \\\" and A: \"\\A\\<^sub>R \\\\<^sub>R. (extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\ \\ A\\<^sub>R \\* \\ \\ A\\<^sub>R \\* P \\ A\\<^sub>R \\* Q) \\ \\ \\ \\\\<^sub>R \\ P \\ Q\"\n by auto\n \n obtain p where \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* P\"\n and \"(p \\ xvec) \\* Q\"\n and \"(p \\ xvec) \\* R\"\n and \"(p \\ xvec) \\* \\'\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\" and \"distinctPerm p\"\n by(rule_tac c=\"(\\, P, Q, R, \\')\" in name_list_avoiding) auto\n\n from `(p \\ xvec) \\* P` `(p \\ xvec) \\* R` S have \"\\\\*xvec\\(P \\ R) = \\\\*(p \\ xvec)\\(p \\ (P \\ R))\"\n by(subst resChainAlpha) auto\n hence PRAlpha: \"\\\\*xvec\\(P \\ R) = \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ R))\"\n by(simp add: eqvts)\n\n from `(p \\ xvec) \\* Q` `(p \\ xvec) \\* R` S have \"\\\\*xvec\\(Q \\ R) = \\\\*(p \\ xvec)\\(p \\ (Q \\ R))\"\n by(subst resChainAlpha) auto\n hence QRAlpha: \"\\\\*xvec\\(Q \\ R) = \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ R))\"\n by(simp add: eqvts)\n\n from `(p \\ xvec) \\* \\` `(p \\ xvec) \\* \\'` have \"(\\ \\ \\', \\\\*(p \\ xvec)\\((p \\ P) \\ (p \\ R)), \\\\*(p \\ xvec)\\((p \\ Q) \\ (p \\ R))) \\ ?X\"\n proof(rule_tac C2=\"(\\, (p \\ P), (p \\ Q), R, \\', xvec, p \\ xvec)\" in XI', auto)\n fix A\\<^sub>R \\\\<^sub>R\n assume FrR: \"extractFrame (p \\ R) = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* \\'\" and \"A\\<^sub>R \\* (p \\ P)\" and \"A\\<^sub>R \\* (p \\ Q)\"\n from FrR have \"(p \\ (extractFrame (p \\ R))) = (p \\ \\A\\<^sub>R, \\\\<^sub>R\\)\" by simp\n with `distinctPerm p` have \"extractFrame R = \\p \\ A\\<^sub>R, p \\ \\\\<^sub>R\\\" by(simp add: eqvts)\n moreover from `A\\<^sub>R \\* \\` have \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n moreover from `A\\<^sub>R \\* (p \\ P)` have \"(p \\ A\\<^sub>R) \\* (p \\ p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `distinctPerm p` have \"(p \\ A\\<^sub>R) \\* P\" by simp\n moreover from `A\\<^sub>R \\* (p \\ Q)` have \"(p \\ A\\<^sub>R) \\* (p \\ p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with `distinctPerm p` have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n ultimately have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" using A by blast\n hence \"(\\ \\ (p \\ \\\\<^sub>R)) \\ (p \\ \\') \\ P \\ Q\" by(rule bisimE)\n moreover have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ (p \\ \\') \\ (\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R)\"\n by(metis Associativity Commutativity Composition AssertionStatEqTrans AssertionStatEqSym)\n ultimately have \"(\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" \n by(rule statEqBisim)\n hence \"(p \\ ((\\ \\ (p \\ \\')) \\ (p \\ \\\\<^sub>R))) \\ (p \\ P) \\ (p \\ Q)\"\n by(rule bisimClosed)\n with `distinctPerm p` `xvec \\* \\` `(p \\ xvec) \\* \\` S show \"(\\ \\ \\') \\ \\\\<^sub>R \\ (p \\ P) \\ (p \\ Q)\"\n by(simp add: eqvts)\n qed\n with PFrR QFrR PRAlpha QRAlpha show ?case by simp\n next\n case(cSym \\ PR QR)\n thus ?case by(blast dest: bisimE)\n qed\nqed\n\nlemma bisimParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\ Q\"\n\n shows \"\\ \\ P \\ R \\ Q \\ R\"\nproof -\n obtain A\\<^sub>R \\\\<^sub>R where \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\"\n by(rule_tac C=\"(\\, P, Q)\" in freshFrame) auto\n moreover from `\\ \\ P \\ Q` have \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(rule bisimE)\n ultimately show ?thesis by(rule_tac bisimParPresAux)\nqed\n\nend\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25588953187816704}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory TraceProperties\n\nimports \n \"CHERI-abstraction.CheriAbstraction\"\n \"CompartmentAuthority\"\nbegin\n\n(*>*)\nsection \\Trace based security properties\\\n\nsubsection \\Traces\\\n\ntype_synonym Trace = \"AbstractStep list\"\n\nprimrec TracePreservesDomain :: \"Trace \\ bool\" where\n \"TracePreservesDomain [] = True\" |\n \"TracePreservesDomain (h # t) = (PreservesDomain h \\ TracePreservesDomain t)\"\n\nlemma TracePreservesDomainE:\n assumes \"TracePreservesDomain trace\"\n and \"step \\ set trace\"\n shows \"PreservesDomain step\"\nusing assms\nby (induct trace) auto\n\nprimrec IsTrace :: \"Semantics \\ state \\ Trace \\ state \\ bool\" where\n \"IsTrace sem s [] s' = (s = s')\" \n| \"IsTrace sem s (h # t) s' = (\\x. IsTrace sem s t x \\ (h, s') \\ sem x)\"\n\ndefinition Traces :: \"Semantics \\ state \\ (Trace \\ state) set\" where\n \"Traces sem s = {(trace, s')| trace s'. IsTrace sem s trace s'}\" \n\nlemma Traces_member_simp [simp]:\nshows \"(trace, s') \\ Traces sem s = IsTrace sem s trace s'\"\nunfolding Traces_def \nby simp\n\nsubsection \\Transitively valid state\\\n\nlemma TraceInvarianceStateIsValid:\n assumes abstraction: \"CanBeSimulated sem\"\n and valid: \"getStateIsValid s\"\n and trace: \"(trace, s') \\ Traces sem s\"\n shows \"getStateIsValid s'\"\nusing trace\nproof (induct trace arbitrary: s')\n case Nil\n thus ?case\n using valid by simp\nnext\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n show ?case\n using Cons(1)[OF r\\<^sub>1]\n using CanBeSimulatedE_ValidState[OF abstraction r\\<^sub>2]\n by auto\nqed\n\nsubsection \\Transitively available capabilities\\\n\ninductive_set\n AvailableCaps :: \"state \\ Capability set\" for s where\n\nReg:\n \"\\RegisterIsAlwaysAccessible r;\n getTag (getCapReg r s)\\ \\ \n getCapReg r s \\ AvailableCaps s\"\n\n| Memory:\n \"\\cap \\ AvailableCaps s;\n \\ getSealed cap;\n Permit_Load_Capability (getPerms cap);\n addr \\ getTranslateCapAddresses (RegionOfCap cap) LOAD s;\n getTag (getMemCap addr s)\\ \\ \n getMemCap addr s \\ AvailableCaps s\"\n\n| Restrict:\n \"\\cap \\ AvailableCaps s;\n cap' \\ cap;\n getTag cap'\\ \\ \n cap' \\ AvailableCaps s\"\n\n| Seal:\n \"\\cap \\ AvailableCaps s;\n \\ getSealed cap;\n sealer \\ AvailableCaps s;\n \\ getSealed sealer;\n Permit_Seal (getPerms sealer);\n ucast t \\ RegionOfCap sealer\\ \\ \n setType (setSealed (cap, True), t) \\ AvailableCaps s\"\n\n| Unseal:\n \"\\cap \\ AvailableCaps s; \n getSealed cap;\n unsealer \\ AvailableCaps s;\n \\ getSealed unsealer;\n Permit_Unseal (getPerms unsealer);\n ucast (getType cap) \\ RegionOfCap unsealer\\ \\ \n setType (setSealed (cap, False), 0) \\ AvailableCaps s\"\n\nlemma AvailableCaps_getTag [elim!]:\n assumes \"cap \\ AvailableCaps s\"\n shows \"getTag cap\"\nusing assms \nby (rule AvailableCaps.induct) auto\n\nlemma AvailableCaps_PCC [intro!]:\n assumes \"getTag (getPCC s)\"\n shows \"getPCC s \\ AvailableCaps s\"\nusing Reg[where r=RegPCC] assms\nby auto\n\nlemma AvailableCaps_BranchToPCC [intro!]:\n assumes \"getTag (getBranchToPccCap s)\"\n shows \"getBranchToPccCap s \\ AvailableCaps s\"\nusing Reg[where r=RegBranchToPCC] assms\nby auto\n\nlemma AvailableCaps_BranchDelayPCC [intro!]:\n assumes tag: \"getTag (getBranchDelayPccCap s)\"\n shows \"getBranchDelayPccCap s \\ AvailableCaps s\"\nusing Reg[where r=RegBranchDelayPCC]\nusing assms\nby auto\n\nlemma AvailableCaps_Capr [intro!]:\n assumes \"getTag (getCAPR cd s)\"\n shows \"getCAPR cd s \\ AvailableCaps s\"\nusing Reg[where r=\"RegGeneral cd\"]\nusing assms\nby auto\n\nlemma AvailableCaps_DDC [intro!]:\n assumes \"getTag (getDDC s)\"\n shows \"getDDC s \\ AvailableCaps s\"\nusing Reg[where r=\"RegSpecial 0\"]\nusing assms\nby auto\n\nlemma AvailableCaps_TLSC [intro!]:\n assumes \"getTag (getTLSC s)\"\n shows \"getTLSC s \\ AvailableCaps s\"\nusing Reg[where r=\"RegSpecial 1\"]\nusing assms\nby auto\n\nlemma AvailableCaps_SCapr [elim]:\n assumes abstraction: \"CanBeSimulated sem\"\n and suc: \"(PreserveDomain actions, s') \\ sem s\"\n and action: \"action \\ actions\"\n and reg: \"cd \\ SpecialRegisterParameters action\"\n and no_sys: \"\\ Access_System_Registers (getPerms (getPCC s))\"\n and valid: \"getStateIsValid s\"\n and tag: \"getTag (getSCAPR cd s)\"\n shows \"getSCAPR cd s \\ AvailableCaps s\"\nproof -\n have \"RegisterIsAlwaysAccessible (RegSpecial cd)\"\n unfolding RegisterIsAlwaysAccessible_def\n using CanBeSimulatedE_SystemRegister[OF abstraction suc _ _ _ _ valid]\n using reg action no_sys\n by auto\n from Reg[OF this]\n show ?thesis\n using tag by auto\nqed\n\nlemma AvailableCaps_CapReg [elim]:\n assumes abstraction: \"CanBeSimulated sem\"\n and suc: \"(PreserveDomain actions, s') \\ sem s\"\n and action: \"action \\ actions\"\n and reg: \"case r of RegSpecial cd \\ cd \\ SpecialRegisterParameters action | _ \\ True\"\n and no_sys: \"\\ Access_System_Registers (getPerms (getPCC s))\"\n and valid: \"getStateIsValid s\"\n and tag: \"getTag (getCapReg r s)\"\n shows \"getCapReg r s \\ AvailableCaps s\"\nusing assms AvailableCaps_SCapr\nby (cases r) auto\n\nsubsection \\Transitively usable capabilities\\\n\ndefinition TransUsableCaps where\n \"TransUsableCaps s \\ {cap. cap \\ AvailableCaps s \\ \\ getSealed cap}\"\n\nlemma TransUsableCapsI [intro]:\n assumes \"cap \\ AvailableCaps s\"\n and \"\\ getSealed cap\"\n shows \"cap \\ TransUsableCaps s\"\nusing assms\nunfolding TransUsableCaps_def\nby simp\n\nlemma TransUsableCapsE [elim!]:\n assumes \"cap \\ TransUsableCaps s\"\n shows \"getTag cap\"\n and \"\\ getSealed cap\"\n and \"cap \\ AvailableCaps s\"\nusing assms\nunfolding TransUsableCaps_def\nby auto\n\nlemma TransUsableCapsPcc [intro!]:\n assumes \"getTag (getPCC s)\"\n and \"\\ getSealed (getPCC s)\"\n shows \"getPCC s \\ TransUsableCaps s\"\nusing assms\nby auto\n\nsubsection \\Transitively available permissions\\\n\ndefinition AvailableAuthority :: \"state \\ CompartmentAuthority\" where\n \"AvailableAuthority s \\ GetAuthorityOfCaps (TransUsableCaps s)\"\n\nlemma GetAuthority_AvailableAuthority_le [elim!]:\n assumes \"cap \\ TransUsableCaps s\"\n shows \"GetAuthority cap \\ AvailableAuthority s\"\nunfolding AvailableAuthority_def GetAuthorityOfCaps_def\nusing assms\nby (intro Sup_upper) auto\n\nlemma getPCC_AvailableAuthority_le [intro]:\n assumes \"getTag (getPCC s)\"\n and \"\\ getSealed (getPCC s)\"\n shows \"GetAuthority (getPCC s) \\ AvailableAuthority s\"\nproof -\n have \"getPCC s \\ TransUsableCaps s\"\n using assms\n by auto\n thus ?thesis by auto\nqed\n\nlemma AvailableCaps_AvailableAuthority_le [elim!]:\n assumes \"AvailableCaps s \\ AvailableCaps s'\"\n shows \"AvailableAuthority s \\ AvailableAuthority s'\"\nunfolding AvailableAuthority_def\nusing assms\nby (intro GetAuthorityOfCaps_subset) auto\n\nlemma SystemRegisterAccess_PCC:\n assumes abstraction: \"CanBeSimulated sem\"\n and suc: \"(label, s') \\ sem s\"\n and no_ex: \"label \\ SwitchDomain RaiseException\" \n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"\\ Access_System_Registers (getPerms (getPCC s))\"\nproof -\n have valid_pcc: \"getTag (getPCC s)\" \"\\ getSealed (getPCC s)\"\n using CanBeSimulatedE_Execute[OF abstraction suc no_ex valid]\n by auto\n hence \"GetAuthority (getPCC s) \\ AvailableAuthority s\" \n by auto\n from SystemRegisterAccess_le[OF this]\n show \"\\ Access_System_Registers (getPerms (getPCC s))\"\n using no_sys valid_pcc\n by (auto simp: GetAuthority_accessors)\nqed\n\nlemma AvailableAuthority_AddressTranslation:\n assumes abstraction: \"CanBeSimulated sem\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n and suc: \"(step, s') \\ sem s\"\n and no_ex: \"step \\ SwitchDomain RaiseException\"\n shows \"getTranslateAddr a s' = getTranslateAddr a s\"\nproof -\n have valid_pcc: \"getTag (getPCC s)\" \"\\ getSealed (getPCC s)\"\n using CanBeSimulatedE_Execute[OF abstraction suc no_ex valid]\n by auto\n hence \"GetAuthority (getPCC s) \\ AvailableAuthority s\" \n by auto\n from SystemRegisterAccess_le[OF this]\n have \"\\ Access_System_Registers (getPerms (getPCC s))\"\n using no_sys valid_pcc\n by (auto simp: GetAuthority_accessors)\n thus ?thesis\n using CanBeSimulatedE_AddressTranslation[OF abstraction suc no_ex _ valid]\n by auto\nqed\n\nsubsection \\Readable capabilities\\\n\nlemma ReadableCapsAreAvailable [elim!]:\n assumes readable: \"cap \\ ReadableCaps (AvailableAuthority s) s\"\n shows \"cap \\ AvailableCaps s\"\nproof -\n obtain loc where [simp]: \"cap = getCap loc s\"\n and loc: \"loc \\ ReadableLocations (AvailableAuthority s) s\"\n using readable by auto\n have tag: \"getTag cap\"\n using readable by auto\n show ?thesis\n proof (cases loc)\n case (LocReg r)\n hence \"RegisterIsAlwaysAccessible r\"\n using loc by auto\n from Reg[OF this]\n show ?thesis\n using tag LocReg\n by auto\n next\n case (LocMem a)\n thus ?thesis\n using Memory[where addr=a and s=s]\n using LocMem tag loc\n unfolding AvailableAuthority_def TransUsableCaps_def\n by (auto simp: getTranslateCapAddresses_distrib_Union GetAuthority_accessors\n split: if_splits)\n qed\nqed\n\ndefinition InvokableCapsNotUnsealable :: \"CompartmentAuthority \\ state \\ bool\" where\n \"InvokableCapsNotUnsealable perm s \\\n \\cap\\ReadableCaps perm s.\n Permit_CCall (getPerms cap) \\\n getSealed cap \\\n getType cap \\ UnsealableTypes perm\"\n\nlemma InvokableCapsNotUnsealableE [elim]:\n assumes \"InvokableCapsNotUnsealable perm s\"\n and \"cap \\ ReadableCaps perm s\"\n and \"Permit_CCall (getPerms cap)\"\n shows \"getSealed cap\"\n and \"getType cap \\ UnsealableTypes perm\"\nusing assms\nunfolding InvokableCapsNotUnsealable_def\nby auto\n\nlemma InvokableCapsNotUnsealable_le:\n assumes \"p \\ q\"\n and \"InvokableCapsNotUnsealable q s\"\n shows \"InvokableCapsNotUnsealable p s\"\nusing assms(2) \nusing ReadableCaps_le[OF assms(1)]\nusing UnsealableTypes_le[OF assms(1)]\nunfolding InvokableCapsNotUnsealable_def\nby auto\n\nlemma AvailableInvokableCapsAreReadable:\n assumes available: \"cap \\ AvailableCaps s\"\n and ccall: \"Permit_CCall (getPerms cap)\"\n and base: \"InvokableCapsNotUnsealable (AvailableAuthority s) s\"\n shows \"cap \\ ReadableCaps (AvailableAuthority s) s\"\nproof -\n have \"cap \\ ReadableCaps (AvailableAuthority s) s \\\n getSealed cap \\ \n getType cap \\ UnsealableTypes (AvailableAuthority s)\"\n using available ccall\n proof induct\n case (Reg r)\n hence \"getCapReg r s \\ ReadableCaps (AvailableAuthority s) s\"\n using Reg\n by (auto intro: ReadableCapsI[where loc=\"LocReg r\"])\n thus ?case\n using Reg\n using InvokableCapsNotUnsealableE[OF base, where cap=\"getCapReg r s\"]\n by auto\n next\n case (Memory cap addr)\n hence \"cap \\ TransUsableCaps s\"\n by auto\n note gperm = GetAuthority_AvailableAuthority_le[OF this]\n have \"addr \\ getTranslateCapAddresses (CapLoadableAddresses (GetAuthority cap)) LOAD s\"\n using Memory AvailableCaps_getTag\n by (auto simp: GetAuthority_accessors)\n hence \"addr \\ getTranslateCapAddresses (CapLoadableAddresses (AvailableAuthority s)) LOAD s\"\n using getTranslateCapAddresses_le[OF CapLoadableAddresses_le[OF gperm]]\n by auto\n hence \"getMemCap addr s \\ ReadableCaps (AvailableAuthority s) s\"\n using Memory\n by (auto intro: ReadableCapsI[where loc=\"LocMem addr\"])\n thus ?case\n using Memory\n using InvokableCapsNotUnsealableE[OF base, where cap=\"getMemCap addr s\"]\n by auto\n next\n case (Restrict cap cap')\n hence \"getPerms cap' \\ getPerms cap\"\n using less_eq_CapabilityE_getPerms\n by auto\n hence \"Permit_CCall (getPerms cap)\"\n unfolding less_eq_Perms_ext_alt\n using Restrict\n by auto\n hence \"getSealed cap\"\n using Restrict by auto\n hence \"getSealed cap'\"\n using less_eq_CapabilityE_getSealed\n using Restrict by auto\n hence \"cap' = cap\"\n using less_eq_CapabilityE_IsSealed\n using Restrict by auto\n thus ?case \n using Restrict\n by auto\n next\n case (Seal cap sealer t)\n thus ?case by auto\n next\n case (Unseal cap unsealer)\n hence \"unsealer \\ TransUsableCaps s\"\n by auto\n note gperm = GetAuthority_AvailableAuthority_le[OF this]\n have \"getType cap \\ UnsealableTypes (GetAuthority unsealer)\"\n using Unseal\n by (auto simp: GetAuthority_accessors)\n hence False\n using UnsealableTypes_le[OF gperm]\n using Unseal\n by auto\n thus ?case by simp\n qed\n thus ?thesis\n by auto\nqed\n\nsubsection \\Closed permissions\\\n\ndefinition PermIsClosed where\n \"PermIsClosed perm s \\\n \\cap\\ReadableCaps perm s.\n (\\ getSealed cap \\ getType cap \\ UnsealableTypes perm) \\\n GetAuthority cap \\ perm\"\n\nlemma PermIsClosedE [elim]:\n assumes \"PermIsClosed perm s\"\n and \"cap \\ ReadableCaps perm s\"\n and \"getSealed cap \\ getType cap \\ UnsealableTypes perm\"\n shows \"GetAuthority cap \\ perm\"\nusing assms\nunfolding PermIsClosed_def\nby auto\n\nlemma TransUsableCapsInClosedPerm:\n assumes closed: \"PermIsClosed perm s\"\n and usable: \"cap \\ TransUsableCaps s\"\n shows \"GetAuthority cap \\ perm\"\nproof -\n have available: \"cap \\ AvailableCaps s\" and\n type: \"getSealed cap \\ getType cap \\ UnsealableTypes perm\"\n using usable\n unfolding TransUsableCaps_def\n by auto\n thus ?thesis\n proof induct\n case (Reg r)\n hence \"LocReg r \\ ReadableLocations perm s\" \n by auto\n thus ?case\n using Reg \n using PermIsClosedE[OF closed, OF ReadableCapsI[where loc=\"LocReg r\"]]\n by auto\n next\n case (Memory cap addr)\n hence \"GetAuthority cap \\ perm\"\n by auto\n from CapLoadableAddresses_le[OF this]\n have \"CapLoadableAddresses (GetAuthority cap) \\ CapLoadableAddresses perm\"\n by auto\n from getTranslateCapAddresses_le[OF this]\n have \"addr \\ getTranslateCapAddresses (CapLoadableAddresses perm) LOAD s\"\n using Memory AvailableCaps_getTag\n by (auto simp: GetAuthority_accessors)\n hence \"LocMem addr \\ ReadableLocations perm s\" \n by auto\n thus ?case\n using Memory \n using PermIsClosedE[OF closed, OF ReadableCapsI[where loc=\"LocMem addr\"]]\n by auto\n next\n case (Restrict cap cap')\n hence \"GetAuthority cap' \\ GetAuthority cap\"\n by auto\n thus ?case \n using less_eq_CapabilityE_getSealed[OF `cap' \\ cap`]\n using less_eq_CapabilityE_getType[OF `cap' \\ cap`]\n using Restrict \n by auto\n next\n case (Seal cap sealer t)\n thus ?case by simp\n next\n case (Unseal cap unsealer)\n hence \"GetAuthority unsealer \\ perm\" \n by auto\n from UnsealableTypes_le[OF this]\n have \"getType cap \\ UnsealableTypes perm\"\n using Unseal \n by (auto simp: GetAuthority_accessors)\n thus ?case \n using Unseal by auto\n qed\nqed\n\nlemma AvailableAuthorityInClosedPerm:\n assumes \"PermIsClosed perm s\"\n shows \"AvailableAuthority s \\ perm\"\nusing TransUsableCapsInClosedPerm[OF assms]\nunfolding AvailableAuthority_def GetAuthorityOfCaps_def TransUsableCaps_def\nunfolding Sup_le_iff\nby auto\n\nsubsection \\Monotonicity of available capabilities\\\n\nlemma NewCapsAreAvailable:\n assumes abstraction: \"CanBeSimulated sem\"\n and suc: \"(PreserveDomain actions, s') \\ sem s\"\n and no_sys: \"\\ Access_System_Registers (getPerms (getPCC s))\"\n and valid: \"getStateIsValid s\"\n and tag: \"getTag (getCap loc s')\"\n shows \"getCap loc s' \\ AvailableCaps s \\\n getCap loc s' = getCap loc s\"\nproof -\n obtain parentLoc where \"parentLoc \\ ProvenanceParents actions loc\"\n using ProvenanceParentExists by auto\n thus ?thesis\n proof (cases rule: ProvenanceCases)\n case Unchanged\n hence \"getCap loc s' = getCap loc s\"\n using CanBeSimulatedE_CapabilityInvariant[OF abstraction suc _ _ valid]\n by simp\n thus ?thesis by auto\n next\n case (StoreData auth a l)\n hence \"getMemCap (GetCapAddress a) s' = getMemCap (GetCapAddress a) s\"\n using CanBeSimulatedE_StoreData[OF abstraction suc _ StoreData(1) valid]\n using tag\n by auto\n thus ?thesis\n using StoreData\n by auto\n next\n case (RestrictedReg r r')\n have le: \"getCapReg r' s' \\ getCapReg r s\"\n using RestrictedReg\n using CanBeSimulatedE_RestrictRegCap[OF abstraction suc _ RestrictedReg(1) valid]\n by auto\n have tag_original: \"getTag (getCapReg r s)\"\n using le tag RestrictedReg by auto\n have \"getCapReg r s \\ AvailableCaps s\"\n using AvailableCaps_CapReg[OF abstraction suc RestrictedReg(1) _ no_sys valid tag_original]\n by (cases r) auto\n from AvailableCaps.Restrict[OF this le]\n show ?thesis\n using RestrictedReg tag\n by auto\n next\n case (Loaded auth a cd)\n have \"LoadCapProp s (PreserveDomain actions) s'\"\n using CanBeSimulatedE[OF abstraction suc]\n by auto\n from LoadCapPropE_mem[OF this _ Loaded(1) valid, where a'=\"ExtendCapAddress a\"]\n obtain vAddr where \"vAddr \\ RegionOfCap (getCapReg auth s)\" \n \"getTranslateAddr (vAddr, LOAD) s = Some (ExtendCapAddress a)\"\n by auto\n hence le: \"getCAPR cd s' \\ getMemCap a s\"\n and tag_auth: \"getTag (getCapReg auth s)\"\n and segment: \"a \\ getTranslateCapAddresses (RegionOfCap (getCapReg auth s)) LOAD s\"\n and unsealed: \"\\ getSealed (getCapReg auth s)\"\n and perm: \"Permit_Load_Capability (getPerms (getCapReg auth s))\"\n using CanBeSimulatedE_LoadCap[OF abstraction suc _ Loaded(1) valid]\n by auto\n have auth: \"getCapReg auth s \\ AvailableCaps s\"\n using AvailableCaps_CapReg[OF abstraction suc Loaded(1) _ no_sys valid tag_auth]\n by (cases auth) auto\n hence \"getTag (getMemCap a s)\"\n using le tag Loaded by auto\n hence \"getMemCap a s \\ AvailableCaps s\"\n using Memory[OF auth unsealed perm segment]\n by auto\n from AvailableCaps.Restrict[OF this le]\n show ?thesis \n using Loaded tag\n by auto\n next\n case (Stored auth cd a)\n have le: \"getMemCap a s' \\ getCAPR cd s\"\n using CanBeSimulatedE_StoreCap[OF abstraction suc _ Stored(1) valid]\n by auto\n hence \"getTag (getCAPR cd s)\"\n using tag Stored by auto\n note AvailableCaps_Capr[OF this]\n from AvailableCaps.Restrict[OF this le]\n show ?thesis \n using Stored tag\n by auto\n next\n case (Sealed auth cd cd')\n define t :: ObjectType where \n \"t \\ ucast (getBase (getCapReg auth s)) + ucast (getOffset (getCapReg auth s))\"\n have tag_cd: \"getTag (getCAPR cd s)\" \n and tag_auth: \"getTag (getCapReg auth s)\"\n using CanBeSimulatedE_SealCap[OF abstraction suc _ Sealed(1) valid]\n using tag Sealed\n by auto\n have \"getCapReg auth s \\ AvailableCaps s\"\n using AvailableCaps_CapReg[OF abstraction suc Sealed(1) _ no_sys valid tag_auth]\n by (cases auth) auto\n hence \"setType (setSealed (getCAPR cd s, True), t) \\ AvailableCaps s\"\n using CanBeSimulatedE_SealCap[OF abstraction suc _ Sealed(1) valid]\n using tag_cd\n unfolding t_def\n by (intro AvailableCaps.Seal[where sealer=\"getCapReg auth s\"]) auto\n thus ?thesis\n using CanBeSimulatedE_SealCap[OF abstraction suc _ Sealed(1) valid]\n using Sealed \n unfolding t_def\n by auto\n next\n case (Unsealed auth cd cd')\n have tag_cd: \"getTag (getCAPR cd s)\"\n and tag_auth: \"getTag (getCapReg auth s)\"\n using TagOfGreaterCap[OF _ tag, where cap'=\"setType (setSealed (getCAPR cd s, False), 0)\"]\n using CanBeSimulatedE_UnsealCap[OF abstraction suc _ Unsealed(1) valid]\n using Unsealed\n by auto\n have \"getCapReg auth s \\ AvailableCaps s\"\n using AvailableCaps_CapReg[OF abstraction suc Unsealed(1) _ no_sys valid tag_auth]\n by (cases auth) auto\n hence \"setType (setSealed (getCAPR cd s, False), 0) \\ AvailableCaps s\"\n using CanBeSimulatedE_UnsealCap[OF abstraction suc _ Unsealed(1) valid]\n using tag_cd\n by (intro AvailableCaps.Unseal[where unsealer=\"getCapReg auth s\"]) auto\n from AvailableCaps.Restrict[OF this _ tag]\n show ?thesis\n using CanBeSimulatedE_UnsealCap[OF abstraction suc _ Unsealed(1) valid]\n using Unsealed\n by auto\n qed\nqed\n\nlemma MonotonicityAvailableCaps_Step:\n assumes abstraction: \"CanBeSimulated sem\"\n and suc: \"(PreserveDomain actions, s') \\ sem s\"\n and no_sys: \"\\ Access_System_Registers (getPerms (getPCC s))\"\n and valid: \"getStateIsValid s\"\n shows \"AvailableCaps s' \\ AvailableCaps s\"\nproof \n fix cap\n assume \"cap \\ AvailableCaps s'\"\n thus \"cap \\ AvailableCaps s\"\n proof (induct rule: AvailableCaps.inducts)\n case (Reg r)\n thus ?case\n using NewCapsAreAvailable[OF abstraction suc no_sys valid, where loc=\"LocReg r\"]\n using Reg AvailableCaps.Reg\n by auto\n next\n case (Memory cap' a)\n have \"getTranslateAddr (v, LOAD) s' = getTranslateAddr (v, LOAD) s\" for v\n using CanBeSimulatedE_AddressTranslation[OF abstraction suc _ no_sys valid]\n by auto\n hence \"getTranslateCapAddresses addrs LOAD s' = getTranslateCapAddresses addrs LOAD s\" for addrs\n unfolding getTranslateCapAddresses_def\n unfolding getTranslateAddresses_def\n by simp\n thus ?case \n using NewCapsAreAvailable[OF abstraction suc no_sys valid, where loc=\"LocMem a\"]\n using Memory AvailableCaps.Memory\n by auto\n next\n case Restrict\n thus ?case\n using AvailableCaps.Restrict\n by auto\n next\n case Seal\n thus ?case\n using AvailableCaps.Seal\n by auto\n next\n case Unseal\n thus ?case \n using AvailableCaps.Unseal\n by auto\n qed\nqed\n\ntheorem MonotonicityAvailableCaps:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"AvailableCaps s' \\ AvailableCaps s\"\nusing trace intra\nproof (induct trace arbitrary: s')\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n have ih: \"AvailableCaps r \\ AvailableCaps s\" \n using Cons(1)[OF r\\<^sub>1]\n using Cons(3)\n by simp\n have intra: \"PreservesDomain step\"\n using Cons(3) by auto\n hence no_ex: \"step \\ SwitchDomain RaiseException\" \n by auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have no_sys2: \"\\ SystemRegisterAccess (AvailableAuthority r)\"\n using AvailableCaps_AvailableAuthority_le[OF ih]\n using SystemRegisterAccess_le no_sys \n by auto\n have \"\\ Access_System_Registers (getPerms (getPCC r))\"\n using SystemRegisterAccess_PCC[OF abstraction r\\<^sub>2 no_ex no_sys2 valid2]\n by auto\n hence \"AvailableCaps s' \\ AvailableCaps r\"\n using MonotonicityAvailableCaps_Step[OF abstraction _ _ valid2, where s'=s']\n using r\\<^sub>2 intra\n by (cases step) auto\n thus ?case\n using ih by simp\nqed simp\n\ncorollary MonotonicityTransUsableCaps:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"TransUsableCaps s' \\ TransUsableCaps s\"\nusing MonotonicityAvailableCaps[OF abstraction trace intra no_sys valid]\nby auto\n\ncorollary MonotonicityAvailableAuthority:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"AvailableAuthority s' \\ AvailableAuthority s\"\nusing MonotonicityTransUsableCaps[OF abstraction trace intra no_sys valid]\nunfolding AvailableAuthority_def\nby auto\n\nsubsection \\Invariance of address translation\\\n\nlemma TraceInvarianceAddressTranslation:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"getTranslateAddr addr s' = getTranslateAddr addr s\"\nusing trace intra\nproof (induct trace arbitrary: s')\n case Nil\n thus ?case by simp\nnext\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n have intra2: \"TracePreservesDomain trace\"\n using Cons by auto\n hence ih: \"getTranslateAddr addr r = getTranslateAddr addr s\"\n using Cons(1)[OF r\\<^sub>1] \n by auto\n have no_ex: \"step \\ SwitchDomain RaiseException\"\n using Cons by auto\n note MonotonicityAvailableAuthority[OF abstraction r\\<^sub>1 intra2 no_sys valid]\n from SystemRegisterAccess_le[OF this]\n have no_sys2: \"\\ SystemRegisterAccess (AvailableAuthority r)\"\n using no_sys\n by auto\n thus ?case\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n using AvailableAuthority_AddressTranslation[OF abstraction _ _ r\\<^sub>2 no_ex]\n using ih\n by auto\nqed\n\nsubsection \\Invariance of system registers\\\n\nlemma SpecialCapRegisterInvariant_aux:\n assumes abstraction: \"CanBeSimulated sem\"\n and no_access: \"\\ Access_System_Registers (getPerms (getPCC s))\"\n and system: \"cd \\ 0\" \"cd \\ 1\"\n and valid: \"getStateIsValid s\"\n and suc: \"(step, s') \\ sem s\"\n and no_ex: \"step \\ SwitchDomain RaiseException\"\n shows \"getSCAPR cd s' = getSCAPR cd s\"\nproof (cases \"PreservesDomain step\")\n case False\n then obtain crossing where \"step = SwitchDomain crossing\"\n by (cases step) auto\n then obtain cd cd' where \"step = SwitchDomain (InvokeCapability cd cd')\"\n using no_ex\n by (cases crossing) auto\n hence \"(SwitchDomain (InvokeCapability cd cd'), s') \\ sem s\"\n using suc by auto\n from CanBeSimulatedE_InvokeCap[OF abstraction this _ valid]\n show ?thesis\n by auto\nnext\n case True\n then obtain actions where \"step = PreserveDomain actions\"\n by (cases step) auto\n hence intra_suc: \"(PreserveDomain actions, s') \\ sem s\"\n using suc\n by auto\n have \"cd \\ \\ (SpecialRegisterParameters ` actions)\"\n using CanBeSimulatedE_SystemRegister[OF abstraction intra_suc _ _ system valid]\n using no_access\n by auto\n hence \"\\prov. prov \\ actions \\ LocReg (RegSpecial cd) \\ ActionTargets prov\"\n unfolding SpecialRegisterParameters_def\n by auto\n from CanBeSimulatedE_CapabilityInvariant\n [OF abstraction intra_suc _ this valid]\n show ?thesis by auto\nqed\n\nlemma SpecialCapRegisterInvariant_intra:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_access: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and system: \"cd \\ 0\" \"cd \\ 1\"\n and valid: \"getStateIsValid s\"\n shows \"getSCAPR cd s' = getSCAPR cd s\"\nusing trace intra\nproof (induct trace arbitrary: s')\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n have ih: \"getSCAPR cd r = getSCAPR cd s\"\n using Cons(1)[OF r\\<^sub>1] Cons(3)\n by auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have no_ex2: \"step \\ SwitchDomain RaiseException\"\n using Cons(3)\n by auto\n have \"AvailableAuthority r \\ AvailableAuthority s\"\n using MonotonicityAvailableAuthority[OF abstraction r\\<^sub>1 _ no_access valid]\n using Cons(3)\n by auto\n from SystemRegisterAccess_le[OF this]\n have no_access2: \"\\ SystemRegisterAccess (AvailableAuthority r)\"\n using no_access by auto\n note pcc = CanBeSimulatedE_Execute[OF abstraction r\\<^sub>2 no_ex2 valid2]\n hence \"getPCC r \\ TransUsableCaps r\"\n by auto\n hence \"GetAuthority (getPCC r) \\ AvailableAuthority r\"\n by auto\n from SystemRegisterAccess_le[OF this]\n have \"\\ SystemRegisterAccess (GetAuthority (getPCC r))\"\n using no_access2 by auto\n hence \"\\ Access_System_Registers (getPerms (getPCC r))\"\n using pcc\n by (auto simp: GetAuthority_accessors)\n hence \"getSCAPR cd s' = getSCAPR cd r\" \n using SpecialCapRegisterInvariant_aux[OF abstraction _ system valid2 r\\<^sub>2 no_ex2]\n by auto\n thus ?case\n using ih by auto\nqed simp\n\ntheorem SpecialCapRegisterInvariant:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(step # trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and inter: \"\\ PreservesDomain step\"\n and no_access: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and system: \"cd \\ 0\" \"cd \\ 1\" \n and non_eppc: \"cd \\ 31\"\n and valid: \"getStateIsValid s\"\n shows \"getSCAPR cd s' = getSCAPR cd s\"\nproof -\n obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n using trace by auto\n obtain crossing where step: \"step = SwitchDomain crossing\"\n using inter by (cases step) auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have \"getSCAPR cd s' = getSCAPR cd r\"\n proof (cases crossing)\n case RaiseException\n hence \"(SwitchDomain RaiseException, s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_Exception[OF abstraction this _ valid2]\n have \"getSCAPR cd s' = SignalExceptionSCAPR cd r\"\n by auto\n thus ?thesis\n unfolding SignalExceptionSCAPR_def\n using non_eppc\n by auto\n next\n case (InvokeCapability cd cd')\n hence \"(SwitchDomain (InvokeCapability cd cd'), s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_InvokeCap[OF abstraction this _ valid2]\n show ?thesis by auto\n qed\n have \"getSCAPR cd r = getSCAPR cd s\"\n using SpecialCapRegisterInvariant_intra[OF abstraction r\\<^sub>1 intra no_access system valid]\n by simp\n thus ?thesis\n using `getSCAPR cd s' = getSCAPR cd r`\n by auto\nqed\n\nsubsection \\Invariance of capabilities in memory\\\n\nlemma MemCapInvariant_intra:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_access: \"a \\ StorablePhysCapAddresses (AvailableAuthority s) s\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"getMemCap a s' = getMemCap a s\"\nusing trace intra\nproof (induct trace arbitrary: s')\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n have intra2: \"TracePreservesDomain trace\"\n using Cons by auto\n have ih: \"getMemCap a r = getMemCap a s\"\n using Cons(1)[OF r\\<^sub>1] intra2\n by auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have no_ex2: \"step \\ SwitchDomain RaiseException\"\n using Cons(3)\n by auto\n have perms: \"AvailableAuthority r \\ AvailableAuthority s\"\n using MonotonicityAvailableAuthority[OF abstraction r\\<^sub>1 intra2 no_sys valid]\n by auto\n from SystemRegisterAccess_le[OF this]\n have no_sys2: \"\\ SystemRegisterAccess (AvailableAuthority r)\"\n using no_sys by auto\n have no_sys_pcc: \"\\ Access_System_Registers (getPerms (getPCC r))\"\n using SystemRegisterAccess_PCC[OF abstraction r\\<^sub>2 no_ex2 no_sys2 valid2]\n by auto\n have addrTrans: \"getTranslateAddr a r = getTranslateAddr a s\" for a\n using TraceInvarianceAddressTranslation[OF abstraction r\\<^sub>1 intra2 no_sys valid]\n by auto\n from StorablePhysCapAddresses_le[OF perms]\n have no_access2: \"a \\ StorablePhysCapAddresses (AvailableAuthority r) r\"\n using getTranslateCapAddresses_eqI_getTranslateAddr[OF addrTrans]\n using no_access\n unfolding StorablePhysCapAddresses_def\n by auto\n hence \"getMemCap a s' = getMemCap a r\"\n proof -\n obtain actions where \"step = PreserveDomain actions\"\n using Cons(3)\n by (cases step) auto\n hence intra_suc: \"(PreserveDomain actions, s') \\ sem r\"\n using r\\<^sub>2\n by auto\n have \"\\ (\\action. action \\ actions \\\n LocMem a \\ ActionTargets action)\" \n proof (clarify)\n fix action\n assume action: \"action \\ actions\" \n and target: \"LocMem a \\ ActionTargets action\"\n thus False\n proof (cases action)\n case (StoreDataAction auth a' l)\n hence \"StoreDataAction auth a' l \\ actions\"\n using action \n by auto\n note restrict = \n CanBeSimulatedE_StoreData[OF abstraction intra_suc _ this valid2]\n have a: \"a = GetCapAddress a'\"\n using target StoreDataAction\n by auto\n have \"getCapReg auth r \\ AvailableCaps r\"\n using AvailableCaps_CapReg\n [OF abstraction intra_suc action _ no_sys_pcc valid2, where r=auth]\n using restrict StoreDataAction\n by (cases auth) auto\n hence \"getCapReg auth r \\ TransUsableCaps r\"\n using restrict \n by auto\n hence gperm: \"GetAuthority (getCapReg auth r) \\ AvailableAuthority r\"\n by auto\n have \"StoreDataProp r (PreserveDomain actions) s'\"\n using CanBeSimulatedE[OF abstraction intra_suc]\n by auto\n from StoreDataPropE_mem\n [OF this _ _ valid2, \n where a=a' and a'=a' and auth=auth and l=l and actions=actions]\n obtain vAddr where \"vAddr \\ RegionOfCap (getCapReg auth r)\" \n \"getTranslateAddr (vAddr, STORE) r = Some a'\"\n using action StoreDataAction target restrict\n by auto\n hence \"a \\ getTranslateCapAddresses (StorableAddresses (GetAuthority (getCapReg auth r))) STORE r\"\n using a restrict\n by (auto simp: GetAuthority_accessors \n intro: getTranslateCapAddressesI)\n hence \"a \\ getTranslateCapAddresses (StorableAddresses (AvailableAuthority r)) STORE r\"\n using getTranslateCapAddresses_le[OF StorableAddresses_le[OF gperm]]\n by auto\n thus False\n using no_access2\n unfolding StorablePhysCapAddresses_def Let_def\n unfolding getTranslateCapAddresses_distrib_union\n by simp\n next\n case (StoreCapAction auth cd a')\n hence \"StoreCapAction auth cd a \\ actions\"\n using action target\n by auto\n note store = CanBeSimulatedE_StoreCap[OF abstraction intra_suc _ this valid2]\n have \"getCapReg auth r \\ AvailableCaps r\"\n using AvailableCaps_CapReg\n [OF abstraction intra_suc action _ no_sys_pcc valid2, where r=auth]\n using store StoreCapAction\n by (cases auth) auto\n hence \"getCapReg auth r \\ TransUsableCaps r\"\n using store \n by auto\n hence gperm: \"GetAuthority (getCapReg auth r) \\ AvailableAuthority r\"\n by auto\n have \"StoreCapProp r (PreserveDomain actions) s'\"\n using CanBeSimulatedE[OF abstraction intra_suc]\n by auto\n from StoreCapPropE_mem\n [OF this _ _ valid2, \n where a=a and a'=\"ExtendCapAddress a\" and actions=actions]\n obtain vAddr where \"vAddr \\ RegionOfCap (getCapReg auth r)\" \n \"getTranslateAddr (vAddr, STORE) r = Some (ExtendCapAddress a)\"\n using action StoreCapAction target\n by auto\n from getTranslateCapAddressesI_word_cat[OF this(2) this(1)]\n have \"a \\ getTranslateCapAddresses (StorableAddresses (GetAuthority (getCapReg auth r))) STORE r\"\n using store\n unfolding word_size\n by (auto simp: GetAuthority_accessors\n intro: getTranslateCapAddressesI)\n hence \"a \\ getTranslateCapAddresses (StorableAddresses (AvailableAuthority r)) STORE r\"\n using getTranslateCapAddresses_le[OF StorableAddresses_le[OF gperm]]\n by auto\n thus False\n using no_access2\n unfolding StorablePhysCapAddresses_def Let_def\n unfolding getTranslateCapAddresses_distrib_union\n by simp\n qed simp_all\n qed\n hence \"\\prov. prov \\ actions \\ LocMem a \\ ActionTargets prov\"\n by auto\n from CanBeSimulatedE_CapabilityInvariant[OF abstraction intra_suc _ this valid2]\n show ?thesis by auto\n qed\n thus ?case using ih by auto\nqed simp\n\ntheorem MemCapInvariant:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(step # trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and inter: \"\\ PreservesDomain step\"\n and no_access: \"a \\ StorablePhysCapAddresses (AvailableAuthority s) s\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"getMemCap a s' = getMemCap a s\"\nproof -\n obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n using trace by auto\n obtain crossing where step: \"step = SwitchDomain crossing\"\n using inter by (cases step) auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have \"getMemCap a s' = getMemCap a r\"\n proof (cases crossing)\n case RaiseException\n hence \"(SwitchDomain RaiseException, s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_Exception[OF abstraction this _ valid2]\n show ?thesis\n unfolding getMemCap_def\n by auto\n next\n case (InvokeCapability cd cd')\n hence \"(SwitchDomain (InvokeCapability cd cd'), s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_InvokeCap[OF abstraction this _ valid2]\n show ?thesis\n unfolding getMemCap_def\n by auto\n qed\n have \"getMemCap a r = getMemCap a s\"\n using MemCapInvariant_intra[OF abstraction r\\<^sub>1 intra no_access no_sys valid]\n by simp\n thus ?thesis\n using `getMemCap a s' = getMemCap a r`\n by auto\nqed\n\nsubsection \\Invariance of data\\\n\nlemma MemoryInvariant_intra:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and no_access: \"a \\ StorablePhysAddresses (AvailableAuthority s) s\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"getMemByte a s' = getMemByte a s\"\nusing trace intra\nproof (induct trace arbitrary: s')\n case (Cons step trace)\n then obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n by auto\n have intra2: \"TracePreservesDomain trace\"\n using Cons by auto\n have ih: \"getMemByte a r = getMemByte a s\"\n using Cons(1)[OF r\\<^sub>1] Cons(3)\n by auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have no_ex2: \"step \\ SwitchDomain RaiseException\"\n using Cons(3)\n by auto\n have perms: \"AvailableAuthority r \\ AvailableAuthority s\"\n using MonotonicityAvailableAuthority[OF abstraction r\\<^sub>1 intra2 no_sys valid]\n by auto\n from SystemRegisterAccess_le[OF this]\n have no_sys2: \"\\ SystemRegisterAccess (AvailableAuthority r)\"\n using no_sys by auto\n have no_sys_pcc: \"\\ Access_System_Registers (getPerms (getPCC r))\"\n using SystemRegisterAccess_PCC[OF abstraction r\\<^sub>2 no_ex2 no_sys2 valid2]\n by auto\n have addrTrans: \"getTranslateAddr a r = getTranslateAddr a s\" for a\n using TraceInvarianceAddressTranslation[OF abstraction r\\<^sub>1 intra2 no_sys valid]\n by auto\n from StorablePhysAddresses_le[OF perms]\n have no_access2: \"a \\ StorablePhysAddresses (AvailableAuthority r) r\"\n using getTranslateAddresses_eqI_getTranslateAddr[OF addrTrans]\n using no_access\n unfolding StorablePhysAddresses_def\n by auto\n hence \"getMemByte a s' = getMemByte a r\"\n proof -\n obtain actions where \"step = PreserveDomain actions\"\n using Cons(3)\n by (cases step) auto\n hence intra_suc: \"(PreserveDomain actions, s') \\ sem r\"\n using r\\<^sub>2\n by auto\n have no_store_data: \n \"\\ (\\auth a' l. StoreDataAction auth a' l \\ actions \\ a \\ Region a' l)\" \n proof (clarify)\n fix auth a' l\n assume prov: \"StoreDataAction auth a' l \\ actions\" \n and addr: \"a \\ Region a' l \"\n hence \"l \\ 0\"\n by auto\n note store = CanBeSimulatedE_StoreData[OF abstraction intra_suc _ prov valid2]\n have *: \"a \\ getTranslateAddresses (StorableAddresses (GetAuthority (getCapReg auth r))) STORE r\"\n using store addr\n by (auto simp: GetAuthority_accessors intro: getTranslateAddressesI)\n have \"getCapReg auth r \\ AvailableCaps r\"\n using AvailableCaps_CapReg\n [OF abstraction intra_suc prov _ no_sys_pcc valid2, where r=auth]\n using store `l \\ 0`\n by (cases auth) auto\n hence \"getCapReg auth r \\ TransUsableCaps r\"\n using store \n by auto\n hence \"GetAuthority (getCapReg auth r) \\ AvailableAuthority r\"\n by auto\n note StorableAddresses_le[OF this]\n from getTranslateAddresses_le[OF this]\n show False\n using no_access2 *\n unfolding StorablePhysAddresses_def\n by auto\n qed\n have no_store_cap: \n \"\\ (\\auth cd a'. StoreCapAction auth cd a' \\ actions \\ \n a \\ Region (ExtendCapAddress a') 32)\" \n proof (clarify)\n fix auth cd a'\n assume prov: \"StoreCapAction auth cd a' \\ actions\" \n and addr: \"a \\ Region (ExtendCapAddress a') 32\"\n note store = CanBeSimulatedE_StoreCap[OF abstraction intra_suc _ prov valid2]\n have *: \"a \\ getTranslateAddresses (StorableAddresses (GetAuthority (getCapReg auth r))) STORE r\"\n using store addr\n by (auto simp: GetAuthority_accessors intro: getTranslateAddressesI)\n have \"getCapReg auth r \\ AvailableCaps r\"\n using AvailableCaps_CapReg\n [OF abstraction intra_suc prov _ no_sys_pcc valid2, where r=auth]\n using store\n by (cases auth) auto\n hence \"getCapReg auth r \\ TransUsableCaps r\"\n using store \n by auto\n hence \"GetAuthority (getCapReg auth r) \\ AvailableAuthority r\"\n by auto\n note StorableAddresses_le[OF this]\n from getTranslateAddresses_le[OF this]\n show False\n using no_access2 *\n unfolding StorablePhysAddresses_def\n by auto\n qed\n have \"\\prov. prov \\ actions \\ a \\ WrittenAddresses prov\"\n unfolding WrittenAddresses_def\n using no_store_data no_store_cap\n by (auto split: DomainAction.splits)\n from CanBeSimulatedE_MemoryInvariant[OF abstraction intra_suc _ this valid2]\n show ?thesis \n by auto\n qed\n thus ?case\n using ih by auto\nqed simp\n\ntheorem MemoryInvariant:\n assumes abstraction: \"CanBeSimulated sem\"\n and trace: \"(step # trace, s') \\ Traces sem s\"\n and intra: \"TracePreservesDomain trace\"\n and inter: \"\\ PreservesDomain step\"\n and no_access: \"a \\ StorablePhysAddresses (AvailableAuthority s) s\"\n and no_sys: \"\\ SystemRegisterAccess (AvailableAuthority s)\"\n and valid: \"getStateIsValid s\"\n shows \"getMemByte a s' = getMemByte a s\"\nproof -\n obtain r where r\\<^sub>1: \"(trace, r) \\ Traces sem s\"\n and r\\<^sub>2: \"(step, s') \\ sem r\"\n using trace by auto\n obtain crossing where step: \"step = SwitchDomain crossing\"\n using inter by (cases step) auto\n have valid2: \"getStateIsValid r\"\n using TraceInvarianceStateIsValid[OF abstraction valid r\\<^sub>1]\n by auto\n have \"getMemByte a s' = getMemByte a r\"\n proof (cases crossing)\n case RaiseException\n hence \"(SwitchDomain RaiseException, s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_Exception[OF abstraction this _ valid2]\n show ?thesis\n unfolding getMemByte_def\n by auto\n next\n case (InvokeCapability cd cd')\n hence \"(SwitchDomain (InvokeCapability cd cd'), s') \\ sem r\"\n using r\\<^sub>2 step by auto\n from CanBeSimulatedE_InvokeCap[OF abstraction this _ valid2]\n show ?thesis\n unfolding getMemByte_def\n by auto\n qed\n have \"getMemByte a r = getMemByte a s\"\n using MemoryInvariant_intra[OF abstraction r\\<^sub>1 intra no_access no_sys valid]\n by metis\n thus ?thesis\n using `getMemByte a s' = getMemByte a r`\n by auto\nqed\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/properties/TraceProperties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.2558729098168784}} {"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\Limits and colimits\\\ntheory CZH_UCAT_Limit\n imports \n CZH_UCAT_Universal\n CZH_Elementary_Categories.CZH_ECAT_Cone\n CZH_Elementary_Categories.CZH_ECAT_Small_Cone\nbegin\n\n\n\nsubsection\\Background\\\n\nnamed_theorems cat_lim_cs_simps\nnamed_theorems cat_lim_cs_intros\n\n\n\nsubsection\\Limit and colimit\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\\nThe concept of a limit is introduced in Chapter III-4 in\n\\<^cite>\\\"mac_lane_categories_2010\"\\; the concept of a colimit is introduced in\nChapter III-3 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\nlocale is_cat_limit = is_cat_cone \\ r \\ \\ \\ u for \\ \\ \\ \\ r u + \n assumes cat_lim_ua_fo: \"\\u' r'. u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n\nsyntax \"_is_cat_limit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_limit \\ \\ \\ \\ r u\"\n\nlocale is_cat_colimit = is_cat_cocone \\ r \\ \\ \\ u for \\ \\ \\ \\ r u +\n assumes cat_colim_ua_of: \"\\u' r'. u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n\nsyntax \"_is_cat_colimit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_colimit \\ \\ \\ \\ r u\"\n\n\ntext\\Rules.\\\n\nlemma (in is_cat_limit) is_cat_limit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_limit_axioms)\n\nmk_ide rf is_cat_limit_def[unfolded is_cat_limit_axioms_def]\n |intro is_cat_limitI|\n |dest is_cat_limitD[dest]|\n |elim is_cat_limitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_limitD(1)\n\nlemma (in is_cat_colimit) is_cat_colimit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_colimit_axioms)\n\nmk_ide rf is_cat_colimit_def[unfolded is_cat_colimit_axioms_def]\n |intro is_cat_colimitI|\n |dest is_cat_colimitD[dest]|\n |elim is_cat_colimitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_colimitD(1)\n\n\ntext\\Limits, colimits and universal arrows.\\\n\nlemma (in is_cat_limit) cat_lim_is_universal_arrow_fo:\n \"universal_arrow_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u)\"\nproof(intro is_functor.universal_arrow_foI)\n\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def \\_Limit_\\\\ \\_\\_\\\\ \\_def \\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n\n show \"\\\\<^sub>C\\<^sub>F \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_FUNCT \\ \\ \\\"\n by \n (\n intro \n \\ \\\\\n cf_diagonal_is_functor \n NTDom.HomDom.category_axioms \n NTDom.HomCod.category_axioms\n )\n\n show \"r \\\\<^sub>\\ \\\\Obj\\\" by (intro cat_cone_obj)\n then show \"ntcf_arrow u : \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\r\\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> cf_map \\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n\n fix r' u' assume prems: \n \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\r'\\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> cf_map \\\"\n from prems(1) have [cat_cs_simps]: \n \"cf_of_cf_map \\ \\ (cf_map \\) = \\\"\n \"cf_of_cf_map \\ \\ (cf_map (cf_const \\ \\ r')) = cf_const \\ \\ r'\"\n by (cs_concl cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros)+\n from prems(2,1) have\n \"u' : cf_map (cf_const \\ \\ r') \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> cf_map \\\"\n by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n note u'[unfolded cat_cs_simps] = cat_FUNCT_is_arrD[OF this]\n\n from cat_lim_ua_fo[OF is_cat_coneI[OF u'(1) prems(1)]] obtain f \n where f: \"f : r' \\\\<^bsub>\\\\<^esub> r\"\n and [symmetric, cat_cs_simps]: \n \"ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n and f_unique: \n \"\\\n f' : r' \\\\<^bsub>\\\\<^esub> r;\n ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\n \\ \\ f' = f\"\n for f'\n by metis\n\n show \"\\!f'.\n f' : r' \\\\<^bsub>\\\\<^esub> r \\\n u' = umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n show \"f : r' \\\\<^bsub>\\\\<^esub> r\" by (rule f)\n with \\\\ cat_cone_obj show u'_def: \n \"u' = umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by \n (\n cs_concl\n cs_simp: u'(2)[symmetric] cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n fix f' assume prems': \n \"f' : r' \\\\<^bsub>\\\\<^esub> r\"\n \"u' = umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n from prems'(2) \\\\ f prems' cat_cone_obj have u'_def':\n \"u' = ntcf_arrow (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n from prems'(1) have \"ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by \n (\n cs_concl \n cs_simp: cat_FUNCT_cs_simps u'_def' cs_intro: cat_cs_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\" .\n\n qed\n\nqed\n\nlemma (in is_cat_cone) cat_cone_is_cat_limit:\n assumes \"universal_arrow_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\)\"\n shows \"\\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def \\_Limit_\\\\ \\_\\_\\\\ \\_def \\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n\n show ?thesis\n proof(intro is_cat_limitI is_cat_cone_axioms)\n fix u' c' assume prems: \"u' : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n\n interpret u': is_cat_cone \\ c' \\ \\ \\ u' by (rule prems)\n\n from u'.cat_cone_obj have u'_is_arr:\n \"ntcf_arrow u' : \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\c'\\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> cf_map \\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n \n from is_functor.universal_arrow_foD(3)\n [\n OF\n cf_diagonal_is_functor[\n OF \\ \\\\ NTDom.HomDom.category_axioms NTDom.HomCod.category_axioms\n ]\n assms\n u'.cat_cone_obj\n u'_is_arr\n ]\n obtain f where f: \"f : c' \\\\<^bsub>\\\\<^esub> c\"\n and u'_def': \"ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f\\\"\n and f'_unique:\n \"\\\n f' : c' \\\\<^bsub>\\\\<^esub> c;\n ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f'\\\n \\ \\ f' = f\"\n for f'\n by metis\n\n from u'_def' \\\\ f cat_cone_obj have u'_def: \n \"u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n \n show \"\\!f'. f' : c' \\\\<^bsub>\\\\<^esub> c \\ u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n proof(intro ex1I conjI; (elim conjE)?, (rule f)?, (rule u'_def)?)\n fix f'' assume prems': \n \"f'' : c' \\\\<^bsub>\\\\<^esub> c\" \"u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f''\"\n from \\\\ prems' have \n \"ntcf_arrow u' = \n umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f''\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n from f'_unique[OF prems'(1) this] show \"f'' = f\".\n qed\n\n qed\n \nqed\n\nlemma (in is_cat_colimit) cat_colim_is_universal_arrow_of:\n \"universal_arrow_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u)\"\nproof(intro is_functor.universal_arrow_ofI)\n\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def \\_Limit_\\\\ \\_\\_\\\\ \\_def \\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n\n show \"\\\\<^sub>C\\<^sub>F \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_FUNCT \\ \\ \\\"\n by \n (\n intro \n \\ \\\\\n cf_diagonal_is_functor \n NTDom.HomDom.category_axioms \n NTDom.HomCod.category_axioms\n )\n\n show \"r \\\\<^sub>\\ \\\\Obj\\\" by (intro cat_cocone_obj)\n\n then show \"ntcf_arrow u : cf_map \\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\r\\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n\n fix r' u' assume prems: \n \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : cf_map \\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\r'\\\"\n from prems(1) have [cat_cs_simps]: \n \"cf_of_cf_map \\ \\ (cf_map \\) = \\\"\n \"cf_of_cf_map \\ \\ (cf_map (cf_const \\ \\ r')) = cf_const \\ \\ r'\"\n by (cs_concl cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros)+\n from prems(2,1) have\n \"u' : cf_map \\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> cf_map (cf_const \\ \\ r')\"\n by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n note u'[unfolded cat_cs_simps] = cat_FUNCT_is_arrD[OF this]\n\n from cat_colim_ua_of[OF is_cat_coconeI[OF u'(1) prems(1)]] obtain f \n where f: \"f : r \\\\<^bsub>\\\\<^esub> r'\"\n and [symmetric, cat_cs_simps]: \n \"ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n and f_unique: \n \"\\\n f' : r \\\\<^bsub>\\\\<^esub> r';\n ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\n \\ \\ f' = f\"\n for f'\n by metis\n\n show \" \\!f'. \n f' : r \\\\<^bsub>\\\\<^esub> r' \\ \n u' = umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n \n show \"f : r \\\\<^bsub>\\\\<^esub> r'\" by (rule f)\n with \\\\ cat_cocone_obj show u'_def: \n \"u' = umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by \n (\n cs_concl\n cs_simp: u'(2)[symmetric] cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n \n fix f' assume prems':\n \"f' : r \\\\<^bsub>\\\\<^esub> r'\"\n \"u' = umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n from prems'(2) \\\\ f prems' cat_cocone_obj have u'_def':\n \"u' = ntcf_arrow (ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u)\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n from prems'(1) have \"ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_FUNCT_cs_simps u'_def' cs_intro: cat_cs_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\" .\n\n qed\n\nqed\n\nlemma (in is_cat_cocone) cat_cocone_is_cat_colimit:\n assumes \"universal_arrow_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\)\"\n shows \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m c : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def \\_Limit_\\\\ \\_\\_\\\\ \\_def \\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n\n show ?thesis\n proof(intro is_cat_colimitI is_cat_cocone_axioms)\n \n fix u' c' assume prems: \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n\n interpret u': is_cat_cocone \\ c' \\ \\ \\ u' by (rule prems)\n\n from u'.cat_cocone_obj have u'_is_arr:\n \"ntcf_arrow u' : cf_map \\ \\\\<^bsub>cat_FUNCT \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F \\ \\ \\\\ObjMap\\\\c'\\\"\n by\n (\n cs_concl cs_shallow \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n\n from is_functor.universal_arrow_ofD(3)\n [\n OF\n cf_diagonal_is_functor[\n OF \\ \\\\ NTDom.HomDom.category_axioms NTDom.HomCod.category_axioms\n ]\n assms\n u'.cat_cocone_obj\n u'_is_arr\n ]\n obtain f where f: \"f : c \\\\<^bsub>\\\\<^esub> c'\"\n and u'_def': \"ntcf_arrow u' =\n umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f\\\"\n and f'_unique:\n \"\\\n f' : c \\\\<^bsub>\\\\<^esub> c';\n ntcf_arrow u' =\n umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f'\\\n \\ \\ f' = f\"\n for f'\n by metis\n\n from u'_def' \\\\ f cat_cocone_obj have u'_def: \n \"u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n \n show \"\\!f'. f' : c \\\\<^bsub>\\\\<^esub> c' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n proof(intro ex1I conjI; (elim conjE)?, (rule f)?, (rule u'_def)?)\n fix f'' assume prems': \n \"f'' : c \\\\<^bsub>\\\\<^esub> c'\" \"u' = ntcf_const \\ \\ f'' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n from \\\\ prems' have \n \"ntcf_arrow u' = \n umap_of (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f''\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n from f'_unique[OF prems'(1) this] show \"f'' = f\".\n qed\n\n qed\n \nqed\n\n\ntext\\Duality.\\\n\nlemma (in is_cat_limit) is_cat_colimit_op:\n \"op_ntcf u : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\nproof(intro is_cat_colimitI)\n show \"op_ntcf u : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_shallow cs_simp: cs_intro: cat_op_intros)\n fix u' r' assume prems: \n \"u' : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n interpret u': is_cat_cocone \\ r' \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ u' \n by (rule prems)\n from cat_lim_ua_fo[OF u'.is_cat_cone_op[unfolded cat_op_simps]] obtain f \n where f: \"f : r' \\\\<^bsub>\\\\<^esub> r\"\n and op_u'_def: \"op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n and f_unique: \n \"\\ f' : r' \\\\<^bsub>\\\\<^esub> r; op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f' \\ \\\n f' = f\"\n for f'\n by metis\n from op_u'_def have \"op_ntcf (op_ntcf u') = op_ntcf (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f)\"\n by simp\n from this f have u'_def: \n \"u' = ntcf_const (op_cat \\) (op_cat \\) f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n show \"\\!f'. \n f' : r \\\\<^bsub>op_cat \\\\<^esub> r' \\ \n u' = ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n proof(intro ex1I conjI; (elim conjE)?, (unfold cat_op_simps)?)\n fix f' assume prems': \n \"f' : r' \\\\<^bsub>\\\\<^esub> r\"\n \"u' = ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n from prems'(2) have \n \"op_ntcf u' = op_ntcf (ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u)\"\n by simp\n from this prems'(1) have \"op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by \n (\n cs_prems\n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\". \n qed (intro u'_def f)+\nqed\n\nlemma (in is_cat_limit) is_cat_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_cat_colimit_op)\n\nlemmas [cat_op_intros] = is_cat_limit.is_cat_colimit_op'\n\nlemma (in is_cat_colimit) is_cat_limit_op:\n \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\nproof(intro is_cat_limitI)\n show \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_shallow cs_simp: cs_intro: cat_op_intros)\n fix u' r' assume prems: \n \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n interpret u': is_cat_cone \\ r' \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ u' \n by (rule prems)\n from cat_colim_ua_of[OF u'.is_cat_cocone_op[unfolded cat_op_simps]] obtain f \n where f: \"f : r \\\\<^bsub>\\\\<^esub> r'\"\n and op_u'_def: \"op_ntcf u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n and f_unique: \n \"\\ f' : r \\\\<^bsub>\\\\<^esub> r'; op_ntcf u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u \\ \\\n f' = f\"\n for f'\n by metis\n from op_u'_def have \"op_ntcf (op_ntcf u') = op_ntcf (ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u)\"\n by simp\n from this f have u'_def: \n \"u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f\"\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n show \"\\!f'. \n f' : r' \\\\<^bsub>op_cat \\\\<^esub> r \\ \n u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n proof(intro ex1I conjI; (elim conjE)?, (unfold cat_op_simps)?)\n fix f' assume prems': \n \"f' : r \\\\<^bsub>\\\\<^esub> r'\"\n \"u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n from prems'(2) have \n \"op_ntcf u' = op_ntcf (op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f')\"\n by simp\n from this prems'(1) have \"op_ntcf u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\". \n qed (intro u'_def f)+\nqed\n\nlemma (in is_cat_colimit) is_cat_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\' : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_cat_limit_op)\n\nlemmas [cat_op_intros] = is_cat_colimit.is_cat_colimit_op'\n\n\nsubsubsection\\Universal property\\\n\nlemma (in is_cat_limit) cat_lim_unique_cone':\n assumes \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ (\\j\\\\<^sub>\\\\\\Obj\\. u'\\NTMap\\\\j\\ = u\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f')\"\n by (fold helper_cat_cone_Comp_ntcf_vcomp_iff[OF assms(1)])\n (intro cat_lim_ua_fo assms)\n\nlemma (in is_cat_limit) cat_lim_unique:\n assumes \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by (intro cat_lim_ua_fo[OF is_cat_limitD(1)[OF assms]])\n\nlemma (in is_cat_limit) cat_lim_unique':\n assumes \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ (\\j\\\\<^sub>\\\\\\Obj\\. u'\\NTMap\\\\j\\ = u\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f')\"\n by (intro cat_lim_unique_cone'[OF is_cat_limitD(1)[OF assms]])\n\nlemma (in is_cat_colimit) cat_colim_unique_cocone:\n assumes \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\nproof-\n interpret u': is_cat_cocone \\ r' \\ \\ \\ u' by (rule assms(1))\n from u'.cat_cocone_obj have op_r': \"r' \\\\<^sub>\\ op_cat \\\\Obj\\\"\n unfolding cat_op_simps by simp\n from \n is_cat_limit.cat_lim_ua_fo[\n OF is_cat_limit_op u'.is_cat_cone_op, folded op_ntcf_ntcf_const\n ]\n obtain f' where f': \"f' : r' \\\\<^bsub>op_cat \\\\<^esub> r\"\n and [cat_cs_simps]: \n \"op_ntcf u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf (ntcf_const \\ \\ f')\"\n and unique: \n \"\\\n f'' : r' \\\\<^bsub>op_cat \\\\<^esub> r;\n op_ntcf u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf (ntcf_const \\ \\ f'')\n \\ \\ f'' = f'\" \n for f''\n by metis\n show ?thesis\n proof(intro ex1I conjI; (elim conjE)?)\n from f' show f': \"f' : r \\\\<^bsub>\\\\<^esub> r'\" unfolding cat_op_simps by simp\n show \"u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (rule eq_op_ntcf_iff[THEN iffD1], insert f')\n (cs_concl cs_intro: cat_cs_intros cs_simp: cat_cs_simps cat_op_simps)+\n fix f'' assume prems: \"f'' : r \\\\<^bsub>\\\\<^esub> r'\" \"u' = ntcf_const \\ \\ f'' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n from prems(1) have \"f'' : r' \\\\<^bsub>op_cat \\\\<^esub> r\" unfolding cat_op_simps by simp\n moreover from prems(1) have \n \"op_ntcf u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf (ntcf_const \\ \\ f'')\"\n unfolding prems(2)\n by (cs_concl cs_intro: cat_cs_intros cs_simp: cat_cs_simps cat_op_simps)\n ultimately show \"f'' = f'\" by (rule unique)\n qed\nqed\n\nlemma (in is_cat_colimit) cat_colim_unique_cocone':\n assumes \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ (\\j\\\\<^sub>\\\\\\Obj\\. u'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> u\\NTMap\\\\j\\)\"\n by (fold helper_cat_cocone_Comp_ntcf_vcomp_iff[OF assms(1)])\n (intro cat_colim_unique_cocone assms)\n\nlemma (in is_cat_colimit) cat_colim_unique:\n assumes \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (intro cat_colim_unique_cocone[OF is_cat_colimitD(1)[OF assms]])\n\nlemma (in is_cat_colimit) cat_colim_unique':\n assumes \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows\n \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ (\\j\\\\<^sub>\\\\\\Obj\\. u'\\NTMap\\\\j\\ = f' \\\\<^sub>A\\<^bsub>\\\\<^esub> u\\NTMap\\\\j\\)\"\nproof-\n interpret u': is_cat_colimit \\ \\ \\ \\ r' u' by (rule assms(1))\n show ?thesis\n by (fold helper_cat_cocone_Comp_ntcf_vcomp_iff[OF u'.is_cat_cocone_axioms])\n (intro cat_colim_unique assms)\nqed\n\nlemma cat_lim_ex_is_iso_arr:\n assumes \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains f where \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" and \"u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\nproof-\n interpret u: is_cat_limit \\ \\ \\ \\ r u by (rule assms(1))\n interpret u': is_cat_limit \\ \\ \\ \\ r' u' by (rule assms(2))\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def u.\\_Limit_\\\\ u.\\_\\_\\\\ \\_def u.\\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n have \\: \"\\\\<^sub>C\\<^sub>F \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_FUNCT \\ \\ \\\"\n by \n (\n intro \n \\ \\\\\n cf_diagonal_is_functor \n u.NTDom.HomDom.category_axioms \n u.NTDom.HomCod.category_axioms\n )\n then interpret \\: is_functor \\ \\ \\cat_FUNCT \\ \\ \\\\ \\\\\\<^sub>C\\<^sub>F \\ \\ \\\\ by simp\n from is_functor.cf_universal_arrow_fo_ex_is_iso_arr[\n OF \\ u.cat_lim_is_universal_arrow_fo u'.cat_lim_is_universal_arrow_fo\n ]\n obtain f where f: \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\"\n and u': \"ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by auto\n from f have \"f : r' \\\\<^bsub>\\\\<^esub> r\" by auto\n from u' this have \"u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by\n (\n cs_prems \n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n with f that show ?thesis by simp\nqed\n\nlemma cat_lim_ex_is_iso_arr':\n assumes \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains f where \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" \n and \"\\j. j \\\\<^sub>\\ \\\\Obj\\ \\ u'\\NTMap\\\\j\\ = u\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\nproof-\n interpret u: is_cat_limit \\ \\ \\ \\ r u by (rule assms(1))\n interpret u': is_cat_limit \\ \\ \\ \\ r' u' by (rule assms(2))\n from assms obtain f \n where iso_f: \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" and u'_def: \"u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by (rule cat_lim_ex_is_iso_arr)\n then have f: \"f : r' \\\\<^bsub>\\\\<^esub> r\" by auto\n then have \"u'\\NTMap\\\\j\\ = u\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\" if \"j \\\\<^sub>\\ \\\\Obj\\\" for j\n by \n (\n intro u.helper_cat_cone_ntcf_vcomp_Comp[\n OF u'.is_cat_cone_axioms f u'_def that\n ]\n )\n with iso_f that show ?thesis by simp\nqed\n\nlemma cat_colim_ex_is_iso_arr:\n assumes \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains f where \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" and \"u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\nproof-\n interpret u: is_cat_colimit \\ \\ \\ \\ r u by (rule assms(1))\n interpret u': is_cat_colimit \\ \\ \\ \\ r' u' by (rule assms(2))\n obtain f where f: \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>op_cat \\\\<^esub> r\"\n and [cat_cs_simps]: \n \"op_ntcf u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f\"\n by \n (\n elim cat_lim_ex_is_iso_arr[\n OF u.is_cat_limit_op u'.is_cat_limit_op\n ]\n )\n from f have iso_f: \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" unfolding cat_op_simps by simp\n then have f: \"f : r \\\\<^bsub>\\\\<^esub> r'\" by auto\n have \"u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (rule eq_op_ntcf_iff[THEN iffD1], insert f)\n (cs_concl cs_intro: cat_cs_intros cs_simp: cat_cs_simps cat_op_simps)+\n from iso_f this that show ?thesis by simp\nqed\n\nlemma cat_colim_ex_is_iso_arr':\n assumes \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains f where \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\"\n and \"\\j. j \\\\<^sub>\\ \\\\Obj\\ \\ u'\\NTMap\\\\j\\ = f \\\\<^sub>A\\<^bsub>\\\\<^esub> u\\NTMap\\\\j\\\"\nproof-\n interpret u: is_cat_colimit \\ \\ \\ \\ r u by (rule assms(1))\n interpret u': is_cat_colimit \\ \\ \\ \\ r' u' by (rule assms(2))\n from assms obtain f \n where iso_f: \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" and u'_def: \"u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (rule cat_colim_ex_is_iso_arr)\n then have f: \"f : r \\\\<^bsub>\\\\<^esub> r'\" by auto\n then have \"u'\\NTMap\\\\j\\ = f \\\\<^sub>A\\<^bsub>\\\\<^esub> u\\NTMap\\\\j\\\" if \"j \\\\<^sub>\\ \\\\Obj\\\" for j\n by \n (\n intro u.helper_cat_cocone_ntcf_vcomp_Comp[\n OF u'.is_cat_cocone_axioms f u'_def that\n ]\n )\n with iso_f that show ?thesis by simp\nqed\n\n\nsubsubsection\\Further properties\\\n\nlemma (in is_cat_limit) cat_lim_is_cat_limit_if_is_iso_arr:\n assumes \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\"\n shows \"u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n note f = is_iso_arrD(1)[OF assms(1)]\n from f(1) interpret u': is_cat_cone \\ r' \\ \\ \\ \\u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\\ \n by (cs_concl cs_intro: cat_lim_cs_intros cat_cs_intros)\n define \\ where \"\\ = \\ + \\\"\n have \\: \"\\ \\\" and \\\\: \"\\ \\\\<^sub>\\ \\\"\n by (simp_all add: \\_def \\_Limit_\\\\ \\_\\_\\\\ \\_def \\_\\_\\\\)\n then interpret \\: \\ \\ by simp \n show ?thesis\n proof\n (\n intro u'.cat_cone_is_cat_limit, \n rule is_functor.universal_arrow_fo_if_universal_arrow_fo,\n rule cf_diagonal_is_functor[OF \\ \\\\],\n rule NTDom.HomDom.category_axioms,\n rule NTDom.HomCod.category_axioms,\n rule cat_lim_is_universal_arrow_fo\n )\n show \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" by (rule assms(1))\n from \\\\ f show\n \"ntcf_arrow (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f) =\n umap_fo (\\\\<^sub>C\\<^sub>F \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n )\n qed\nqed\n\nlemma (in is_cat_colimit) cat_colim_is_cat_colimit_if_is_iso_arr:\n assumes \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\" \n shows \"ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n note f = is_iso_arrD[OF assms(1)]\n from f(1) interpret u': is_cat_cocone \\ r' \\ \\ \\ \\ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\\ \n by (cs_concl cs_intro: cat_lim_cs_intros cat_cs_intros)\n from f have [symmetric, cat_op_simps]:\n \"op_ntcf (ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u) =\n op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f\"\n by\n (\n cs_concl cs_shallow \n cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros\n )\n show ?thesis\n by \n (\n rule is_cat_limit.is_cat_colimit_op\n [\n OF is_cat_limit.cat_lim_is_cat_limit_if_is_iso_arr[\n OF is_cat_limit_op, unfolded cat_op_simps, OF assms(1)\n ],\n unfolded cat_op_simps\n ]\n )\nqed\n\nlemma ntcf_cf_comp_is_cat_limit_if_is_iso_functor:\n assumes \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> \\\"\n shows \"u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_cat_limitI)\n interpret u: is_cat_limit \\ \\ \\ \\ r u by (rule assms(1)) \n interpret \\: is_iso_functor \\ \\ \\ \\ by (rule assms(2))\n note [cf_cs_simps] = is_iso_functor_is_iso_arr(2,3)\n show u\\: \"u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (intro is_cat_coneI)\n (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n fix u' r' assume prems: \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret u': is_cat_cone \\ r' \\ \\ \\\\ \\\\<^sub>C\\<^sub>F \\\\ u' by simp\n have \"u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\ : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (intro is_cat_coneI)\n (\n cs_concl\n cs_simp: cat_cs_simps cf_cs_simps\n cs_intro: cat_cs_intros cf_cs_intros\n )\n from is_cat_limit.cat_lim_ua_fo[OF assms(1) this] obtain f \n where f: \"f : r' \\\\<^bsub>\\\\<^esub> r\"\n and u'_\\: \"u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\ = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n and f'f:\n \"\\\n f' : r' \\\\<^bsub>\\\\<^esub> r; \n u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\ = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f' \n \\ \\ f' = f\"\n for f'\n by metis\n from u'_\\ have u'_inv\\_\\:\n \"(u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\) \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ = (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f) \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\\"\n by simp\n show \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n proof(intro ex1I conjI; (elim conjE)?)\n show \"f : r' \\\\<^bsub>\\\\<^esub> r\" by (rule f)\n from u'_inv\\_\\ f show \"u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by\n (\n cs_prems \n cs_simp:\n cf_cs_simps cat_cs_simps\n ntcf_cf_comp_ntcf_cf_comp_assoc \n ntcf_vcomp_ntcf_cf_comp[symmetric]\n cs_intro: cat_cs_intros cf_cs_intros\n )\n fix f' assume prems:\n \"f' : r' \\\\<^bsub>\\\\<^esub> r\" \"u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n from prems(2) have \n \"u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\ = \n (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f') \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\\"\n by simp\n from this f prems(1) have \"u' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf \\ = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by\n (\n cs_prems \n cs_simp:\n cat_cs_simps cf_cs_simps\n ntcf_vcomp_ntcf_cf_comp[symmetric]\n ntcf_cf_comp_ntcf_cf_comp_assoc\n cs_intro: cf_cs_intros cat_cs_intros\n )\n then show \"f' = f\" by (intro f'f prems(1))\n qed\nqed\n\nlemma ntcf_cf_comp_is_cat_limit_if_is_iso_functor'[cat_lim_cs_intros]:\n assumes \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = \\ \\\\<^sub>C\\<^sub>F \\\"\n shows \"u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) \n unfolding assms(3)\n by (rule ntcf_cf_comp_is_cat_limit_if_is_iso_functor)\n\n\n\nsubsection\\Small limit and small colimit\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\\nThe concept of a limit is introduced in Chapter III-4 in\n\\<^cite>\\\"mac_lane_categories_2010\"\\; the concept of a colimit is introduced in\nChapter III-3 in \\<^cite>\\\"mac_lane_categories_2010\"\\. The definitions of small\nlimits were tailored for ZFC in HOL.\n\\\n\nlocale is_tm_cat_limit = is_tm_cat_cone \\ r \\ \\ \\ u for \\ \\ \\ \\ r u + \n assumes tm_cat_lim_ua_fo: \n \"\\u' r'. u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n\nsyntax \"_is_tm_cat_limit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m _ :/ _ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_tm_cat_limit \\ \\ \\ \\ r u\"\n\nlocale is_tm_cat_colimit = is_tm_cat_cocone \\ r \\ \\ \\ u for \\ \\ \\ \\ r u +\n assumes tm_cat_colim_ua_of: \n \"\\u' r'. u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n\nsyntax \"_is_tm_cat_colimit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m _ :/ _ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_tm_cat_colimit \\ \\ \\ \\ r u\"\n\n\ntext\\Rules.\\\n\nlemma (in is_tm_cat_limit) is_tm_cat_limit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\' : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_tm_cat_limit_axioms)\n\nmk_ide rf is_tm_cat_limit_def[unfolded is_tm_cat_limit_axioms_def]\n |intro is_tm_cat_limitI|\n |dest is_tm_cat_limitD[dest]|\n |elim is_tm_cat_limitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_tm_cat_limitD(1)\n\nlemma (in is_tm_cat_colimit) is_tm_cat_colimit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_tm_cat_colimit_axioms)\n\nmk_ide rf is_tm_cat_colimit_def[unfolded is_tm_cat_colimit_axioms_def]\n |intro is_tm_cat_colimitI|\n |dest is_tm_cat_colimitD[dest]|\n |elim is_tm_cat_colimitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_tm_cat_colimitD(1)\n\nlemma is_tm_cat_limitI':\n assumes \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n and \"\\u' r'. u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n shows \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(rule is_tm_cat_limitI, rule assms(1))\n interpret is_tm_cat_cone \\ r \\ \\ \\ u by (rule assms(1)) \n fix r' u' assume prems: \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret u': is_cat_cone \\ r' \\ \\ \\ u' . \n have \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by\n (\n intro\n is_tm_cat_coneI \n NTCod.is_tm_functor_axioms\n u'.cat_cone_obj \n u'.is_ntcf_axioms\n )\n then show \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by (rule assms(2))\nqed\n\nlemma is_tm_cat_colimitI':\n assumes \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n and \"\\u' r'. u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\ \\\n \\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n shows \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_cat_colimitI, rule assms(1))\n interpret is_tm_cat_cocone \\ r \\ \\ \\ u by (rule assms(1))\n fix r' u' assume prems: \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret u': is_cat_cocone \\ r' \\ \\ \\ u' . \n have \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by\n (\n intro\n is_tm_cat_coconeI \n NTDom.is_tm_functor_axioms\n u'.cat_cocone_obj \n u'.is_ntcf_axioms\n )\n then show \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (rule assms(2))\nqed\n\n\ntext\\Elementary properties.\\\n\nsublocale is_tm_cat_limit \\ is_cat_limit\n by (intro is_cat_limitI, rule is_cat_cone_axioms, rule tm_cat_lim_ua_fo)\n\nsublocale is_tm_cat_colimit \\ is_cat_colimit\n by (intro is_cat_colimitI, rule is_cat_cocone_axioms, rule tm_cat_colim_ua_of)\n\nlemma (in is_cat_limit) cat_lim_is_tm_cat_limit:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n shows \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \nproof(intro is_tm_cat_limitI)\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms) \n show \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (intro is_tm_cat_coneI assms is_ntcf_axioms cat_cone_obj)\n fix u' r' assume prems: \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n show \"\\!f'. f' : r' \\\\<^bsub>\\\\<^esub> r \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by (rule cat_lim_ua_fo[OF prems])\nqed\n\nlemma (in is_cat_colimit) cat_colim_is_tm_cat_colimit:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n shows \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \nproof(intro is_tm_cat_colimitI)\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms) \n show \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (intro is_tm_cat_coconeI assms is_ntcf_axioms cat_cocone_obj)\n fix u' r' assume prems: \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n show \"\\!f'. f' : r \\\\<^bsub>\\\\<^esub> r' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by (rule cat_colim_ua_of[OF prems])\nqed\n\n\ntext\\Limits, colimits and universal arrows.\\\n\nlemma (in is_tm_cat_limit) tm_cat_lim_is_universal_arrow_fo:\n \"universal_arrow_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u)\"\nproof(intro is_functor.universal_arrow_foI)\n\n show \"\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Funct \\ \\ \\\"\n by \n (\n intro \n tm_cf_diagonal_is_functor \n NTCod.HomDom.tiny_category_axioms\n NTDom.HomCod.category_axioms\n )\n\n show \"r \\\\<^sub>\\ \\\\Obj\\\" by (intro cat_cone_obj)\n then show \"ntcf_arrow u : \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\r\\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> cf_map \\\"\n by \n (\n cs_concl\n cs_simp: cat_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n\n fix r' u' assume prems: \n \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\r'\\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> cf_map \\\"\n from prems(1) have [cat_cs_simps]: \n \"cf_of_cf_map \\ \\ (cf_map \\) = \\\"\n \"cf_of_cf_map \\ \\ (cf_map (cf_const \\ \\ r')) = cf_const \\ \\ r'\"\n by (cs_concl cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros)+\n from prems(2,1) have \n \"u' : cf_map (cf_const \\ \\ r') \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> cf_map \\\"\n by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n note u'[unfolded cat_cs_simps] = cat_Funct_is_arrD[OF this]\n\n from \n tm_cat_lim_ua_fo[\n OF is_cat_coneI[OF is_tm_ntcfD(1)[OF u'(1)] prems(1)]\n ] \n obtain f \n where f: \"f : r' \\\\<^bsub>\\\\<^esub> r\"\n and [symmetric, cat_cs_simps]: \n \"ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n and f_unique: \n \"\\\n f' : r' \\\\<^bsub>\\\\<^esub> r;\n ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\n \\ \\ f' = f\"\n for f'\n by metis\n\n show \"\\!f'.\n f' : r' \\\\<^bsub>\\\\<^esub> r \\\n u' = umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n show \"f : r' \\\\<^bsub>\\\\<^esub> r\" by (rule f)\n with cat_cone_obj show u'_def: \n \"u' = umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by \n (\n cs_concl \n cs_simp: u'(2)[symmetric] cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n fix f' assume prems': \n \"f' : r' \\\\<^bsub>\\\\<^esub> r\"\n \"u' = umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n from prems'(2) f prems' cat_cone_obj have u'_def':\n \"u' = ntcf_arrow (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from prems'(1) have \"ntcf_of_ntcf_arrow \\ \\ u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by (cs_concl cs_simp: cat_FUNCT_cs_simps u'_def' cs_intro: cat_cs_intros)\n from f_unique[OF prems'(1) this] show \"f' = f\" .\n\n qed\n\nqed\n\nlemma (in is_tm_cat_cone) tm_cat_cone_is_tm_cat_limit:\n assumes \"universal_arrow_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\)\"\n shows \"\\ : c <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_cat_limitI' is_tm_cat_cone_axioms)\n\n fix u' c' assume prems: \"u' : c' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n\n interpret u': is_tm_cat_cone \\ c' \\ \\ \\ u' by (rule prems)\n\n from u'.tm_cat_cone_obj have u'_is_arr:\n \"ntcf_arrow u' : \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\c'\\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> cf_map \\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n\n from is_functor.universal_arrow_foD(3)\n [\n OF\n tm_cf_diagonal_is_functor[\n OF NTCod.HomDom.tiny_category_axioms NTDom.HomCod.category_axioms\n ]\n assms\n u'.cat_cone_obj\n u'_is_arr\n ]\n obtain f where f: \"f : c' \\\\<^bsub>\\\\<^esub> c\"\n and u'_def': \"ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f\\\"\n and f'_unique:\n \"\\\n f' : c' \\\\<^bsub>\\\\<^esub> c;\n ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f'\\\n \\ \\ f' = f\"\n for f'\n by metis\n\n from u'_def' f cat_cone_obj have u'_def: \"u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by\n (\n cs_prems \n cs_simp: cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n\n show \"\\!f'. f' : c' \\\\<^bsub>\\\\<^esub> c \\ u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n proof(intro ex1I conjI; (elim conjE)?, (rule f)?, (rule u'_def)?)\n fix f'' assume prems': \n \"f'' : c' \\\\<^bsub>\\\\<^esub> c\" \"u' = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f''\"\n from prems' have \n \"ntcf_arrow u' =\n umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f''\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from f'_unique[OF prems'(1) this] show \"f'' = f\".\n qed\n\nqed\n\nlemma (in is_tm_cat_colimit) tm_cat_colim_is_universal_arrow_of:\n \"universal_arrow_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u)\"\nproof(intro is_functor.universal_arrow_ofI)\n\n show \"\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> cat_Funct \\ \\ \\\"\n by \n (\n intro \n tm_cf_diagonal_is_functor \n NTDom.HomDom.tiny_category_axioms \n NTDom.HomCod.category_axioms\n )\n\n show \"r \\\\<^sub>\\ \\\\Obj\\\" by (intro cat_cocone_obj)\n\n then show \"ntcf_arrow u : cf_map \\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\r\\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n\n fix r' u' assume prems: \n \"r' \\\\<^sub>\\ \\\\Obj\\\" \"u' : cf_map \\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\r'\\\"\n from prems(1) have [cat_cs_simps]: \n \"cf_of_cf_map \\ \\ (cf_map \\) = \\\"\n \"cf_of_cf_map \\ \\ (cf_map (cf_const \\ \\ r')) = cf_const \\ \\ r'\"\n by (cs_concl cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros)+\n from prems(2,1) have\n \"u' : cf_map \\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> cf_map (cf_const \\ \\ r')\"\n by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n note u'[unfolded cat_cs_simps] = cat_Funct_is_arrD[OF this]\n\n from cat_colim_ua_of[OF is_cat_coconeI[OF is_tm_ntcfD(1)[OF u'(1)] prems(1)]]\n obtain f \n where f: \"f : r \\\\<^bsub>\\\\<^esub> r'\"\n and [symmetric, cat_cs_simps]: \n \"ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n and f_unique:\n \"\\\n f' : r \\\\<^bsub>\\\\<^esub> r';\n ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\n \\ \\ f' = f\"\n for f'\n by metis\n\n show \" \\!f'.\n f' : r \\\\<^bsub>\\\\<^esub> r' \\\n u' = umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n proof(intro ex1I conjI; (elim conjE)?)\n \n show \"f : r \\\\<^bsub>\\\\<^esub> r'\" by (rule f)\n\n with cat_cocone_obj show u'_def:\n \"u' = umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by \n (\n cs_concl\n cs_simp: u'(2)[symmetric] cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n \n fix f' assume prems':\n \"f' : r \\\\<^bsub>\\\\<^esub> r'\"\n \"u' = umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f'\\\"\n from prems'(2) f prems' cat_cocone_obj have u'_def':\n \"u' = ntcf_arrow (ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u)\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from prems'(1) have \"ntcf_of_ntcf_arrow \\ \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_FUNCT_cs_simps u'_def' cs_intro: cat_cs_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\" .\n\n qed\n\nqed\n\nlemma (in is_tm_cat_cocone) tm_cat_cocone_is_tm_cat_colimit:\n assumes \"universal_arrow_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\)\"\n shows \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m c : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_cat_colimitI' is_tm_cat_cocone_axioms)\n \n fix u' c' assume prems: \"u' : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e c' : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n\n interpret u': is_tm_cat_cocone \\ c' \\ \\ \\ u' by (rule prems)\n\n from u'.tm_cat_cocone_obj have u'_is_arr:\n \"ntcf_arrow u' : cf_map \\ \\\\<^bsub>cat_Funct \\ \\ \\\\<^esub> \\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\\\ObjMap\\\\c'\\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n\n from is_functor.universal_arrow_ofD(3)\n [\n OF\n tm_cf_diagonal_is_functor[\n OF NTDom.HomDom.tiny_category_axioms NTDom.HomCod.category_axioms\n ]\n assms\n u'.cat_cocone_obj\n u'_is_arr\n ]\n obtain f where f: \"f : c \\\\<^bsub>\\\\<^esub> c'\"\n and u'_def': \"ntcf_arrow u' =\n umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f\\\"\n and f'_unique:\n \"\\\n f' : c \\\\<^bsub>\\\\<^esub> c';\n ntcf_arrow u' =\n umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f'\\\n \\ \\ f' = f\"\n for f'\n by metis\n\n from u'_def' f cat_cocone_obj have u'_def: \"u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n \n show \"\\!f'. f' : c \\\\<^bsub>\\\\<^esub> c' \\ u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n proof(intro ex1I conjI; (elim conjE)?, (rule f)?, (rule u'_def)?)\n fix f'' assume prems': \n \"f'' : c \\\\<^bsub>\\\\<^esub> c'\" \"u' = ntcf_const \\ \\ f'' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n from prems' have \n \"ntcf_arrow u' =\n umap_of (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) c (ntcf_arrow \\) c'\\ArrVal\\\\f''\\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps\n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n from f'_unique[OF prems'(1) this] show \"f'' = f\".\n qed\n\nqed\n \n\ntext\\Duality.\\\n\nlemma (in is_tm_cat_limit) is_tm_cat_colimit_op:\n \"op_ntcf u : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\nproof(intro is_tm_cat_colimitI')\n show \"op_ntcf u : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_shallow cs_simp: cs_intro: cat_op_intros)\n fix u' r' assume prems: \n \"u' : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e r' : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\n interpret u': is_tm_cat_cocone \\ r' \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ u' \n by (rule prems)\n from tm_cat_lim_ua_fo[OF u'.is_cat_cone_op[unfolded cat_op_simps]] obtain f \n where f: \"f : r' \\\\<^bsub>\\\\<^esub> r\"\n and op_u'_def: \"op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n and f_unique: \n \"\\ f' : r' \\\\<^bsub>\\\\<^esub> r; op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f' \\ \\\n f' = f\"\n for f'\n by metis\n from op_u'_def have \"op_ntcf (op_ntcf u') = op_ntcf (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f)\"\n by simp\n from this f have u'_def: \n \"u' = ntcf_const (op_cat \\) (op_cat \\) f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n show \"\\!f'. \n f' : r \\\\<^bsub>op_cat \\\\<^esub> r' \\ \n u' = ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n proof(intro ex1I conjI; (elim conjE)?, (unfold cat_op_simps)?)\n fix f' assume prems': \n \"f' : r' \\\\<^bsub>\\\\<^esub> r\"\n \"u' = ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u\"\n from prems'(2) have \"op_ntcf u' =\n op_ntcf (ntcf_const (op_cat \\) (op_cat \\) f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf u)\"\n by simp\n from this prems'(1) have \"op_ntcf u' = u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\". \n qed (intro u'_def f)+\nqed\n\nlemma (in is_tm_cat_limit) is_tm_cat_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_tm_cat_colimit_op)\n\nlemmas [cat_op_intros] = is_tm_cat_limit.is_tm_cat_colimit_op'\n\nlemma (in is_tm_cat_colimit) is_tm_cat_limit_op:\n \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\nproof(intro is_tm_cat_limitI')\n show \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_shallow cs_simp: cs_intro: cat_op_intros)\n fix u' r' assume prems: \n \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> op_cat \\\"\n interpret u': is_tm_cat_cone \\ r' \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ u' \n by (rule prems)\n from tm_cat_colim_ua_of[OF u'.is_cat_cocone_op[unfolded cat_op_simps]] obtain f \n where f: \"f : r \\\\<^bsub>\\\\<^esub> r'\"\n and op_u'_def: \"op_ntcf u' = ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n and f_unique: \n \"\\ f' : r \\\\<^bsub>\\\\<^esub> r'; op_ntcf u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u \\ \\ f' = f\"\n for f'\n by metis\n from op_u'_def have \"op_ntcf (op_ntcf u') = op_ntcf (ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u)\"\n by simp\n from this f have u'_def: \n \"u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f\"\n by (cs_prems cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n show \"\\!f'. \n f' : r' \\\\<^bsub>op_cat \\\\<^esub> r \\ \n u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n proof(intro ex1I conjI; (elim conjE)?, (unfold cat_op_simps)?)\n fix f' assume prems': \n \"f' : r \\\\<^bsub>\\\\<^esub> r'\"\n \"u' = op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f'\"\n from prems'(2) have \"op_ntcf u' =\n op_ntcf (op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f')\"\n by simp\n from this prems'(1) have \"op_ntcf u' = ntcf_const \\ \\ f' \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\"\n by\n (\n cs_prems\n cs_simp: cat_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_op_intros\n )\n from f_unique[OF prems'(1) this] show \"f' = f\". \n qed (intro u'_def f)+\nqed\n\nlemma (in is_tm_cat_colimit) is_tm_cat_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\' : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_tm_cat_limit_op)\n\nlemmas [cat_op_intros] = is_tm_cat_colimit.is_tm_cat_colimit_op'\n\n\nsubsubsection\\Further properties\\\n\nlemma (in is_tm_cat_limit) tm_cat_lim_is_tm_cat_limit_if_iso_arr:\n assumes \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\"\n shows \"u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n note f = is_iso_arrD(1)[OF assms]\n from f(1) interpret u': is_tm_cat_cone \\ r' \\ \\ \\ \\u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\\ \n by (cs_concl cs_intro: cat_small_cs_intros cat_cs_intros)\n show ?thesis\n proof\n (\n intro u'.tm_cat_cone_is_tm_cat_limit,\n rule is_functor.universal_arrow_fo_if_universal_arrow_fo,\n rule tm_cf_diagonal_is_functor,\n rule NTCod.HomDom.tiny_category_axioms,\n rule NTDom.HomCod.category_axioms,\n rule tm_cat_lim_is_universal_arrow_fo\n )\n show \"f : r' \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r\" by (rule assms)\n from f show \"ntcf_arrow (u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f) =\n umap_fo (\\\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m \\ \\ \\) (cf_map \\) r (ntcf_arrow u) r'\\ArrVal\\\\f\\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cat_FUNCT_cs_simps \n cs_intro: cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n )\n qed\nqed\n\nlemma (in is_tm_cat_colimit) tm_cat_colim_is_tm_cat_colimit_if_iso_arr:\n assumes \"f : r \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> r'\"\n shows \"ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r' : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n note f = is_iso_arrD(1)[OF assms]\n from f(1) interpret u': \n is_tm_cat_cocone \\ r' \\ \\ \\ \\ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u\\ \n by (cs_concl cs_intro: cat_small_cs_intros cat_cs_intros)\n from f have [symmetric, cat_op_simps]:\n \"op_ntcf (ntcf_const \\ \\ f \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F u) =\n op_ntcf u \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (op_cat \\) (op_cat \\) f\"\n by\n (\n cs_concl cs_shallow \n cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros\n )\n show ?thesis\n by \n (\n rule is_tm_cat_limit.is_tm_cat_colimit_op\n [\n OF is_tm_cat_limit.tm_cat_lim_is_tm_cat_limit_if_iso_arr[\n OF is_tm_cat_limit_op, unfolded cat_op_simps, OF assms(1)\n ],\n unfolded cat_op_simps\n ]\n )\nqed\n\n\n\nsubsection\\Finite limit and finite colimit\\\n\nlocale is_cat_finite_limit = \n is_cat_limit \\ \\ \\ \\ r u + NTDom.HomDom: finite_category \\ \\\n for \\ \\ \\ \\ r u\n\nsyntax \"_is_cat_finite_limit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_finite_limit \\ \\ \\ \\ r u\"\n\nlocale is_cat_finite_colimit = \n is_cat_colimit \\ \\ \\ \\ r u + NTDom.HomDom: finite_category \\ \\\n for \\ \\ \\ \\ r u\n\nsyntax \"_is_cat_finite_colimit\" :: \"V \\ V \\ V \\ V \\ V \\ V \\ bool\"\n (\\(_ :/ _ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n _ :/ _ \\\\\\<^sub>C\\ _)\\ [51, 51, 51, 51, 51] 51)\ntranslations \"u : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n r : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \\ \n \"CONST is_cat_finite_colimit \\ \\ \\ \\ r u\"\n\n\ntext\\Rules.\\\n\nlemma (in is_cat_finite_limit) is_cat_finite_limit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n \\' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_finite_limit_axioms)\n\nmk_ide rf is_cat_finite_limit_def\n |intro is_cat_finite_limitI|\n |dest is_cat_finite_limitD[dest]|\n |elim is_cat_finite_limitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_finite_limitD\n\nlemma (in is_cat_finite_colimit) \n is_cat_finite_colimit_axioms'[cat_lim_cs_intros]:\n assumes \"\\' = \\\" and \"r' = r\" and \"\\' = \\\" and \"\\' = \\\" and \"\\' = \\\"\n shows \"u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n r' : \\' \\\\\\<^sub>C\\<^bsub>\\'\\<^esub> \\'\"\n unfolding assms by (rule is_cat_finite_colimit_axioms)\n\nmk_ide rf is_cat_finite_colimit_def[unfolded is_cat_colimit_axioms_def]\n |intro is_cat_finite_colimitI|\n |dest is_cat_finite_colimitD[dest]|\n |elim is_cat_finite_colimitE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_finite_colimitD\n\n\ntext\\Duality.\\\n\nlemma (in is_cat_finite_limit) is_cat_finite_colimit_op:\n \"op_ntcf u : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n r : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by\n (\n cs_concl cs_shallow\n cs_intro: is_cat_finite_colimitI cat_op_intros cat_small_cs_intros\n )\n\nlemma (in is_cat_finite_limit) is_cat_finite_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : \\' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n r : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_cat_finite_colimit_op)\n\nlemmas [cat_op_intros] = is_cat_finite_limit.is_cat_finite_colimit_op'\n\nlemma (in is_cat_finite_colimit) is_cat_finite_limit_op:\n \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by \n (\n cs_concl cs_shallow \n cs_intro: is_cat_finite_limitI cat_op_intros cat_small_cs_intros\n )\n\nlemma (in is_cat_finite_colimit) is_cat_finite_colimit_op'[cat_op_intros]:\n assumes \"\\' = op_cf \\\" and \"\\' = op_cat \\\" and \"\\' = op_cat \\\"\n shows \"op_ntcf u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m\\<^sub>.\\<^sub>f\\<^sub>i\\<^sub>n \\' : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n unfolding assms by (rule is_cat_finite_limit_op)\n\nlemmas [cat_op_intros] = is_cat_finite_colimit.is_cat_finite_colimit_op'\n\n\ntext\\Elementary properties.\\\n\nsublocale is_cat_finite_limit \\ is_tm_cat_limit\n by\n (\n intro \n is_tm_cat_limitI \n is_tm_cat_coneI \n is_ntcf_axioms \n cat_lim_ua_fo \n cat_cone_obj \n NTCod.cf_is_tm_functor_if_HomDom_finite_category[\n OF NTDom.HomDom.finite_category_axioms\n ]\n )\n\nsublocale is_cat_finite_colimit \\ is_tm_cat_colimit\n by\n (\n intro \n is_tm_cat_colimitI \n is_tm_cat_coconeI \n is_ntcf_axioms \n cat_colim_ua_of \n cat_cocone_obj \n NTDom.cf_is_tm_functor_if_HomDom_finite_category[\n OF NTDom.HomDom.finite_category_axioms\n ]\n )\n\n\n\nsubsection\\Creation of limits\\\n\n\ntext\\See Chapter V-1 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cf_creates_limits :: \"V \\ V \\ V \\ bool\"\n where \"cf_creates_limits \\ \\ \\ =\n (\n \\\\ b.\n \\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\ \\\n (\n (\n \\!\\a. \\\\ a. \\a = \\\\, a\\ \\\n \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\ \\\n \\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\n b = \\\\ObjMap\\\\a\\\n ) \\\n (\n \\\\ a.\n \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\ \\\n \\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\n b = \\\\ObjMap\\\\a\\ \\\n \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\\n )\n )\n )\"\n\n\ntext\\Rules.\\\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nmk_ide rf cf_creates_limits_def[\n where \\=\\ and \\=\\ and \\=\\, unfolded cat_cs_simps\n ]\n |intro cf_creates_limitsI|\n |dest cf_creates_limitsD'|\n |elim cf_creates_limitsE'|\n\nend\n\nlemmas cf_creates_limitsD[dest!] = cf_creates_limitsD'[rotated 2]\n and cf_creates_limitsE[elim!] = cf_creates_limitsE'[rotated 2]\n\nlemma cf_creates_limitsE'':\n assumes \"cf_creates_limits \\ \\ \\\"\n and \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains \\ r where \"\\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n and \"b = \\\\ObjMap\\\\r\\\"\nproof-\n note cflD = cf_creates_limitsD[OF assms]\n from conjunct1[OF cflD] obtain \\ r\n where \\: \"\\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\_def: \"\\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n and b_def: \"b = \\\\ObjMap\\\\r\\\"\n by metis\n moreover have \"\\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (rule conjunct2[OF cflD, rule_format, OF \\ \\_def b_def])\n ultimately show ?thesis using that by auto\nqed\n\n\n\nsubsection\\Preservation of limits and colimits\\\n\n\nsubsubsection\\Definitions and elementary properties\\\n\n\ntext\\See Chapter V-4 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cf_preserves_limits :: \"V \\ V \\ V \\ bool\"\n where \"cf_preserves_limits \\ \\ \\ =\n (\n \\\\ a.\n \\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\ \\\n \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\a\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\\n )\"\n\ndefinition cf_preserves_colimits :: \"V \\ V \\ V \\ bool\"\n where \"cf_preserves_colimits \\ \\ \\ =\n (\n \\\\ a.\n \\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m a : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\ \\\n \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>C\\<^sub>F \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m \\\\ObjMap\\\\a\\ : \\\\HomDom\\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomCod\\\n )\"\n\n\ntext\\Rules.\\\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nmk_ide rf cf_preserves_limits_def[\n where \\=\\ and \\=\\ and \\=\\, unfolded cat_cs_simps\n ]\n |intro cf_preserves_limitsI|\n |dest cf_preserves_limitsD'|\n |elim cf_preserves_limitsE'|\n\nmk_ide rf cf_preserves_colimits_def[\n where \\=\\ and \\=\\ and \\=\\, unfolded cat_cs_simps\n ]\n |intro cf_preserves_colimitsI|\n |dest cf_preserves_colimitsD'|\n |elim cf_preserves_colimitsE'|\n\nend\n\nlemmas cf_preserves_limitsD[dest!] = cf_preserves_limitsD'[rotated 2]\n and cf_preserves_limitsE[elim!] = cf_preserves_limitsE'[rotated 2]\n\nlemmas cf_preserves_colimitsD[dest!] = cf_preserves_colimitsD'[rotated 2]\n and cf_preserves_colimitsE[elim!] = cf_preserves_colimitsE'[rotated 2]\n\n\ntext\\Duality.\\\n\nlemma cf_preserves_colimits_op[cat_op_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"cf_preserves_colimits \\ (op_cf \\) (op_cf \\) \\\n cf_preserves_limits \\ \\ \\\"\nproof\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n\n show \"cf_preserves_limits \\ \\ \\\"\n if \"cf_preserves_colimits \\ (op_cf \\) (op_cf \\)\"\n proof(rule cf_preserves_limitsI, rule assms(1), rule assms(2))\n fix \\ r assume \"\\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_cat_limit \\ \\ \\ \\ r \\ .\n show \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\r\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by \n (\n rule is_cat_colimit.is_cat_limit_op\n [\n OF cf_preserves_colimitsD\n [\n OF that \\.is_cat_colimit_op \\.is_functor_op \\.is_functor_op,\n folded op_cf_cf_comp op_ntcf_cf_ntcf_comp\n ],\n unfolded cat_op_simps\n ]\n )\n qed\n\n show \"cf_preserves_colimits \\ (op_cf \\) (op_cf \\)\"\n if \"cf_preserves_limits \\ \\ \\\"\n proof\n (\n rule cf_preserves_colimitsI, \n rule \\.is_functor_op, \n rule \\.is_functor_op, \n unfold cat_op_simps\n )\n fix \\ r assume \"\\ : op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n then interpret \\: is_cat_colimit \\ \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ r \\ . \n show \"op_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ :\n op_cf \\ \\\\<^sub>C\\<^sub>F op_cf \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m \\\\ObjMap\\\\r\\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by \n (\n rule is_cat_limit.is_cat_colimit_op\n [\n OF cf_preserves_limitsD[\n OF that \\.is_cat_limit_op[unfolded cat_op_simps] assms(1,2)\n ],\n unfolded cat_op_simps\n ]\n )\n qed\n\nqed\n\nlemma cf_preserves_limits_op[cat_op_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \n \"cf_preserves_limits \\ (op_cf \\) (op_cf \\) \\\n cf_preserves_colimits \\ \\ \\\"\nproof\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n\n show \"cf_preserves_colimits \\ \\ \\\" \n if \"cf_preserves_limits \\ (op_cf \\) (op_cf \\)\"\n proof(rule cf_preserves_colimitsI, rule assms(1), rule assms(2))\n fix \\ r assume \"\\ : \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n then interpret \\: is_cat_colimit \\ \\ \\ \\ r \\ .\n show \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\ \\\\<^sub>C\\<^sub>F \\ >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m \\\\ObjMap\\\\r\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by \n (\n rule is_cat_limit.is_cat_colimit_op\n [\n OF cf_preserves_limitsD\n [\n OF that \\.is_cat_limit_op \\.is_functor_op \\.is_functor_op,\n folded op_cf_cf_comp op_ntcf_cf_ntcf_comp\n ],\n unfolded cat_op_simps\n ]\n )\n qed\n\n show \"cf_preserves_limits \\ (op_cf \\) (op_cf \\)\"\n if \"cf_preserves_colimits \\ \\ \\\"\n proof\n (\n rule cf_preserves_limitsI, \n rule \\.is_functor_op, \n rule \\.is_functor_op, \n unfold cat_op_simps\n )\n fix \\ r assume \"\\ : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n then interpret \\: is_cat_limit \\ \\op_cat \\\\ \\op_cat \\\\ \\op_cf \\\\ r \\ . \n show \"op_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ :\n \\\\ObjMap\\\\r\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\ \\\\<^sub>C\\<^sub>F op_cf \\ : op_cat \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by \n (\n rule is_cat_colimit.is_cat_limit_op\n [\n OF cf_preserves_colimitsD[\n OF that \\.is_cat_colimit_op[unfolded cat_op_simps] assms(1,2)\n ],\n unfolded cat_op_simps\n ]\n )\n qed\n \nqed\n\n\nsubsubsection\\Further properties\\\n\nlemma cf_preserves_limits_if_cf_creates_limits:\n \\\\See Theorem 2 in Chapter V-4 in \\cite{mac_lane_categories_2010}.\\\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : b <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"cf_creates_limits \\ \\ \\\"\n shows \"cf_preserves_limits \\ \\ \\\"\nproof-\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_cat_limit \\ \\ \\ \\\\ \\\\<^sub>C\\<^sub>F \\\\ b \\\n by (intro is_cat_limit.cat_lim_is_tm_cat_limit assms(3,4))\n\n show ?thesis\n proof\n (\n intro cf_preserves_limitsI,\n rule \\.is_functor_axioms,\n rule \\.is_functor_axioms\n )\n\n fix \\ a assume prems: \"\\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_cat_limit \\ \\ \\ \\ a \\ .\n\n obtain \\ A\n where \\: \"\\ : A <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\_def: \"\\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\\"\n and b_def: \"b = \\\\ObjMap\\\\A\\\"\n by \n (\n rule cf_creates_limitsE''\n [\n OF \n assms(4) \n \\.is_cat_limit_axioms\n \\.is_functor_axioms\n \\.is_functor_axioms\n ] \n )\n from \\ interpret \\: is_cat_limit \\ \\ \\ \\ A \\ .\n\n from cat_lim_ex_is_iso_arr[OF \\.is_cat_limit_axioms prems] obtain f\n where f: \"f : a \\\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> A\" and \\_def: \"\\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f\"\n by auto\n\n note f = f is_iso_arrD(1)[OF f]\n\n from f(2) have \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\a\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (intro is_cat_coneI)\n (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\n from \\_def have \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f)\" \n by simp\n also from f(2) have \"\\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\)\"\n by (cs_concl_step cf_ntcf_comp_ntcf_vcomp)\n (\n cs_concl\n cs_simp: cat_cs_simps \\_def[symmetric] cs_intro: cat_cs_intros\n )\n finally have \\\\: \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ = \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\)\" .\n\n show \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\a\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by \n (\n rule \\.cat_lim_is_cat_limit_if_is_iso_arr\n [\n OF \\.cf_ArrMap_is_iso_arr[OF f(1), folded b_def], \n folded \\\\\n ]\n )\n \n qed\n \nqed\n\n\n\nsubsection\\Continuous and cocontinuous functor\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\ndefinition is_cf_continuous :: \"V \\ V \\ bool\"\n where \"is_cf_continuous \\ \\ \\\n (\\\\ \\. \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomDom\\ \\ cf_preserves_limits \\ \\ \\)\"\n\ndefinition is_cf_cocontinuous :: \"V \\ V \\ bool\"\n where \"is_cf_cocontinuous \\ \\ \\\n (\\\\ \\. \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\\HomDom\\ \\ cf_preserves_colimits \\ \\ \\)\"\n\n\ntext\\Rules.\\\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nmk_ide rf is_cf_continuous_def[where \\=\\ and \\=\\, unfolded cat_cs_simps]\n |intro is_cf_continuousI|\n |dest is_cf_continuousD'|\n |elim is_cf_continuousE'|\n\nmk_ide rf is_cf_cocontinuous_def[where \\=\\ and \\=\\, unfolded cat_cs_simps]\n |intro is_cf_cocontinuousI|\n |dest is_cf_cocontinuousD'|\n |elim is_cf_cocontinuousE'|\n\nend\n\nlemmas is_cf_continuousD[dest!] = is_cf_continuousD'[rotated]\n and is_cf_continuousE[elim!] = is_cf_continuousE'[rotated]\n\nlemmas is_cf_cocontinuousD[dest!] = is_cf_cocontinuousD'[rotated]\n and is_cf_cocontinuousE[elim!] = is_cf_cocontinuousE'[rotated]\n\n\ntext\\Duality.\\\n\nlemma is_cf_continuous_op[cat_op_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"is_cf_continuous \\ (op_cf \\) \\ is_cf_cocontinuous \\ \\\"\nproof\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n show \"is_cf_cocontinuous \\ \\\" if \"is_cf_continuous \\ (op_cf \\)\"\n proof(intro is_cf_cocontinuousI, rule assms)\n fix \\ \\ assume prems': \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_functor \\ \\ \\ \\ .\n show \"cf_preserves_colimits \\ \\ \\\"\n by \n (\n rule cf_preserves_limits_op\n [\n THEN iffD1, \n OF\n prems' \n assms(1) \n is_cf_continuousD[OF that \\.is_functor_op \\.is_functor_op] \n ]\n )\n qed\n show \"is_cf_continuous \\ (op_cf \\)\" if \"is_cf_cocontinuous \\ \\\"\n proof(intro is_cf_continuousI, rule \\.is_functor_op)\n fix \\ \\ assume prems': \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n then interpret \\: is_functor \\ \\ \\op_cat \\\\ \\ .\n from that assms have op_op_bundle:\n \"is_cf_cocontinuous \\ (op_cf (op_cf \\))\"\n \"op_cf (op_cf \\) : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n unfolding cat_op_simps .\n show \"cf_preserves_limits \\ (op_cf \\) \\\"\n by \n (\n rule cf_preserves_colimits_op\n [\n THEN iffD1, \n OF\n \\.is_functor_axioms \n \\.is_functor_op \n is_cf_cocontinuousD\n [\n OF\n op_op_bundle(1) \n \\.is_functor_op[unfolded cat_op_simps] \n op_op_bundle(2)\n ]\n ]\n )\n qed\nqed\n\nlemma is_cf_cocontinuous_op[cat_op_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"is_cf_cocontinuous \\ (op_cf \\) \\ is_cf_continuous \\ \\\"\nproof\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n show \"is_cf_continuous \\ \\\" if \"is_cf_cocontinuous \\ (op_cf \\)\"\n proof(intro is_cf_continuousI, rule assms)\n fix \\ \\ assume prems': \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_functor \\ \\ \\ \\ .\n show \"cf_preserves_limits \\ \\ \\\"\n by \n (\n rule cf_preserves_colimits_op\n [\n THEN iffD1, \n OF\n prems' \n assms(1) \n is_cf_cocontinuousD[OF that \\.is_functor_op \\.is_functor_op] \n ]\n )\n qed\n show \"is_cf_cocontinuous \\ (op_cf \\)\" if \"is_cf_continuous \\ \\\"\n proof(intro is_cf_cocontinuousI, rule \\.is_functor_op)\n fix \\ \\ assume prems': \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n then interpret \\: is_functor \\ \\ \\op_cat \\\\ \\ .\n from that assms have op_op_bundle:\n \"is_cf_continuous \\ (op_cf (op_cf \\))\"\n \"op_cf (op_cf \\) : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n unfolding cat_op_simps .\n show \"cf_preserves_colimits \\ (op_cf \\) \\\"\n by \n (\n rule cf_preserves_limits_op\n [\n THEN iffD1, \n OF\n \\.is_functor_axioms \n \\.is_functor_op \n is_cf_continuousD\n [\n OF\n op_op_bundle(1) \n \\.is_functor_op[unfolded cat_op_simps] \n op_op_bundle(2)\n ]\n ]\n )\n qed\nqed\n\n\nsubsubsection\\Category isomorphisms are continuous and cocontinuous\\\n\nlemma (in is_iso_functor) iso_cf_is_cf_continuous: \"is_cf_continuous \\ \\\"\nproof(intro is_cf_continuousI)\n fix \\ \\ assume prems: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_functor \\ \\ \\ \\ .\n show \"cf_preserves_limits \\ \\ \\\"\n proof(intro cf_preserves_limitsI)\n fix a \\ assume \"\\ : a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_cat_limit \\ \\ \\ \\ a \\ .\n show \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ : \\\\ObjMap\\\\a\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n proof(intro is_cat_limitI)\n fix r' \\ assume \"\\ : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n then interpret \\: is_cat_cone \\ r' \\ \\ \\\\ \\\\<^sub>C\\<^sub>F \\\\ \\ .\n note [cat_cs_simps] = cf_comp_assoc_helper[\n where \\=\\inv_cf \\\\ and \\=\\ and \\=\\ and \\=\\cf_id \\\\\n ]\n have inv_\\: \"inv_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ :\n inv_cf \\\\ObjMap\\\\r'\\ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cf_cs_simps\n cs_intro: cat_cs_intros cf_cs_intros\n )\n from is_cat_limit.cat_lim_unique_cone'[OF \\.is_cat_limit_axioms inv_\\]\n obtain f where f: \"f : inv_cf \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> a\"\n and f_up: \"\\j. j \\\\<^sub>\\ \\\\Obj\\ \\\n (inv_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\)\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n and f_unique:\n \"\\\n f' : inv_cf \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> a;\n \\j. j \\\\<^sub>\\ \\\\Obj\\ \\ \n (inv_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\)\\NTMap\\\\j\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\n \\ \\ f' = f\"\n for f'\n by metis\n have [cat_cs_simps]: \"\\\\ArrMap\\\\\\\\NTMap\\\\j\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\f\\ = \\\\NTMap\\\\j\\\"\n if \"j \\\\<^sub>\\ \\\\Obj\\\" for j\n proof-\n from f_up[OF that] that have \n \"inv_cf \\\\ArrMap\\\\\\\\NTMap\\\\j\\\\ = \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n then have \n \"\\\\ArrMap\\\\inv_cf \\\\ArrMap\\\\\\\\NTMap\\\\j\\\\\\ =\n \\\\ArrMap\\\\\\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\\\"\n by simp\n from this that f show ?thesis \n by \n (\n cs_prems cs_shallow \n cs_simp: cat_cs_simps cf_cs_simps cs_intro: cat_cs_intros\n ) \n simp\n qed\n show \"\\!f'.\n f' : r' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\ \\ \\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n proof(intro ex1I conjI; (elim conjE)?)\n from f have \n \"\\\\ArrMap\\\\f\\ : \\\\ObjMap\\\\inv_cf \\\\ObjMap\\\\r'\\\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n then show \"\\\\ArrMap\\\\f\\ : r' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by (cs_prems cs_shallow cs_simp: cf_cs_simps cs_intro: cat_cs_intros)\n show \"\\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\)\"\n proof(rule ntcf_eqI, rule \\.is_ntcf_axioms)\n from f show \"\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\) :\n cf_const \\ \\ r' \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by\n (\n cs_concl\n cs_simp: cat_cs_simps cf_cs_simps cs_intro: cat_cs_intros\n )\n then have dom_rhs:\n \"\\\\<^sub>\\ ((\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\))\\NTMap\\) = \n \\\\Obj\\\"\n by (cs_concl cs_simp: cat_cs_simps)\n show \n \"\\\\NTMap\\ = (\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\))\\NTMap\\\"\n proof(rule vsv_eqI, unfold \\.ntcf_NTMap_vdomain dom_rhs)\n fix j assume \"j \\\\<^sub>\\ \\\\Obj\\\"\n with f show \"\\\\NTMap\\\\j\\ =\n (\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ (\\\\ArrMap\\\\f\\))\\NTMap\\\\j\\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n qed (cs_concl cs_intro: V_cs_intros cat_cs_intros)+\n qed simp_all\n fix f' assume prems': \n \"f' : r' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n \"\\ = \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f'\"\n have \\j_def: \"\\\\NTMap\\\\j\\ = \\\\ArrMap\\\\\\\\NTMap\\\\j\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n if \"j \\\\<^sub>\\ \\\\Obj\\\" for j\n proof-\n from prems'(2) have\n \"\\\\NTMap\\\\j\\ = (\\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\ \\\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\ \\ f')\\NTMap\\\\j\\\"\n by simp\n from this prems'(1) that show ?thesis\n by (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n qed\n have \"inv_cf \\\\ArrMap\\\\f'\\ = f\"\n proof(rule f_unique)\n from prems'(1) show \n \"inv_cf \\\\ArrMap\\\\f'\\ : inv_cf \\\\ObjMap\\\\r'\\ \\\\<^bsub>\\\\<^esub> a\"\n by\n (\n cs_concl \n cs_simp: cf_cs_simps cs_intro: cat_cs_intros cf_cs_intros\n )\n fix j assume \"j \\\\<^sub>\\ \\\\Obj\\\"\n from this prems'(1) show \n \"(inv_cf \\ \\\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\)\\NTMap\\\\j\\ = \n \\\\NTMap\\\\j\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> inv_cf \\\\ArrMap\\\\f'\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cf_cs_simps \\j_def\n cs_intro: cat_cs_intros cf_cs_intros\n )\n qed\n then have \"\\\\ArrMap\\\\inv_cf \\\\ArrMap\\\\f'\\\\ = \\\\ArrMap\\\\f\\\" by simp\n from this prems'(1) show \"f' = \\\\ArrMap\\\\f\\\"\n by \n (\n cs_prems cs_shallow \n cs_simp: cat_cs_simps cf_cs_simps cs_intro: cat_cs_intros\n )\n qed\n qed (cs_concl cs_intro: cat_cs_intros cat_lim_cs_intros)\n qed (intro prems is_functor_axioms)+\nqed (rule is_functor_axioms)\n\nlemma (in is_iso_functor) iso_cf_is_cf_cocontinuous: \"is_cf_cocontinuous \\ \\\"\n using is_iso_functor.iso_cf_is_cf_continuous[OF is_iso_functor_op] \n by (cs_prems cs_shallow cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n\n\n\nsubsection\\Tiny-continuous and tiny-cocontinuous functor\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\ndefinition is_tm_cf_continuous :: \"V \\ V \\ bool\"\n where \"is_tm_cf_continuous \\ \\ =\n (\\\\ \\. \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\\HomDom\\ \\ cf_preserves_limits \\ \\ \\)\"\n\n\ntext\\Rules.\\\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nmk_ide rf is_tm_cf_continuous_def[where \\=\\ and \\=\\, unfolded cat_cs_simps]\n |intro is_tm_cf_continuousI|\n |dest is_tm_cf_continuousD'|\n |elim is_tm_cf_continuousE'|\n\nend\n\nlemmas is_tm_cf_continuousD[dest!] = is_tm_cf_continuousD'[rotated]\n and is_tm_cf_continuousE[elim!] = is_tm_cf_continuousE'[rotated]\n\n\ntext\\Elementary properties.\\\n\nlemma (in is_functor) cf_continuous_is_tm_cf_continuous:\n assumes \"is_cf_continuous \\ \\\"\n shows \"is_tm_cf_continuous \\ \\\"\nproof(intro is_tm_cf_continuousI, rule is_functor_axioms)\n fix \\' \\ assume \"\\' : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n then interpret \\': is_tm_functor \\ \\ \\ \\'.\n show \"cf_preserves_limits \\ \\ \\'\"\n by \n (\n intro is_cf_continuousD[OF assms(1) _ is_functor_axioms], \n rule \\'.is_functor_axioms\n )\nqed\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Universal_Constructions/czh_ucategories/CZH_UCAT_Limit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5, "lm_q1q2_score": 0.2558583023520827}} {"text": "theory flash25Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv25: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv25: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv25: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv25 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash25Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.25579585854250353}} {"text": "theory Agent\n imports Subst_Term\nbegin\n\nnominal_datatype ('term, 'assertion, 'condition) psi = \n Psi_nil (\"\\\" 190)\n\n\n| Output \"'term::fs_name\" 'term \"('term, 'assertion::fs_name, 'condition::fs_name) psi\" (\"_\\_\\._\" [120, 120, 110] 110)\n| Input 'term \"('term, 'assertion, 'condition) input\" (\"_\\_\" [120, 120] 110)\n| Case \"(('term, 'assertion, 'condition) psi_case)\" (\"Case _\" [120] 120)\n| Par \"('term, 'assertion, 'condition) psi\" \"('term, 'assertion, 'condition) psi\" (infixl \"\\\" 90)\n| Res \"\\name\\(('term, 'assertion, 'condition) psi)\" (\"\\\\_\\_\" [120, 120] 110)\n| Assert 'assertion (\"\\_\\\" [120] 120)\n| Bang \"('term, 'assertion, 'condition) psi\" (\"!_\" [110] 110)\n\nand ('term, 'assertion, 'condition) input = \n Trm 'term \"(('term, 'assertion, 'condition) psi)\" (\"\\_._\" [130, 130] 130)\n| Bind \"\\name\\(('term, 'assertion, 'condition) input)\" (\"\\__\" [120, 120] 120)\n\nand ('term, 'assertion, 'condition) psi_case = \n Empty_case (\"\\\\<^sub>c\" 120)\n| Cond 'condition \"(('term, 'assertion, 'condition) psi)\"\n \"(('term, 'assertion, 'condition) psi_case)\" (\"\\ _ \\ _ _ \" [120, 120, 120] 120)\n\nlemma psi_fresh_set[simp]:\n fixes X :: \"name set\"\n and M :: \"'a::fs_name\"\n and N :: 'a\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n and \\ :: 'b\n and \\ :: 'c\n\n shows \"X \\* (M\\N\\.P) = (X \\* M \\ X \\* N \\ X \\* P)\"\n and \"X \\* M\\I = (X \\* M \\ X \\* I)\"\n and \"X \\* Case C = X \\* C\"\n and \"X \\* (P \\ Q) = (X \\* P \\ X \\* Q)\"\n and \"X \\* \\\\x\\P = (X \\* [x].P)\"\n and \"X \\* \\\\\\ = X \\* \\\"\n and \"X \\* !P = X \\* P\"\n and \"X \\* \\\"\n and \"X \\* Trm N P = (X \\* N \\ X \\* P)\"\n and \"X \\* Bind x I = X \\* ([x].I)\"\n\n and \"X \\* \\\\<^sub>c\"\n and \"X \\* \\ \\ \\ P C = (X \\* \\ \\ X \\* P \\ X \\* C)\"\nby(auto simp add: fresh_star_def psi.fresh)+\n\nlemma psi_fresh_vec[simp]:\n fixes xvec :: \"name list\"\n\n shows \"xvec \\* (M\\N\\.P) = (xvec \\* M \\ xvec \\* N \\ xvec \\* P)\"\n and \"xvec \\* M\\I = (xvec \\* M \\ xvec \\* I)\"\n and \"xvec \\* Case C = xvec \\* C\"\n and \"xvec \\* (P \\ Q) = (xvec \\* P \\ xvec \\* Q)\"\n and \"xvec \\* \\\\x\\P = (xvec \\* [x].P)\"\n and \"xvec \\* \\\\\\ = xvec \\* \\\"\n and \"xvec \\* !P = xvec \\* P\"\n and \"xvec \\* \\\"\n\n and \"xvec \\* Trm N P = (xvec \\* N \\ xvec \\* P)\"\n and \"xvec \\* Bind x I = xvec \\* ([x].I)\"\n\n and \"xvec \\* \\\\<^sub>c\"\n and \"xvec \\* \\ \\ \\ P C = (xvec \\* \\ \\ xvec \\* P \\ xvec \\* C)\"\nby(auto simp add: fresh_star_def)\n\nfun psi_cases :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list \\ ('a, 'b, 'c) psi_case\"\nwhere \n base: \"psi_cases [] = \\\\<^sub>c\"\n| step: \"psi_cases ((\\, P)#xs) = Cond \\ P (psi_cases xs)\"\n\nlemma psi_cases_eqvt[eqvt]:\n fixes p :: \"name prm\"\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n\n shows \"(p \\ (psi_cases Cs)) = psi_cases(p \\ Cs)\"\nby(induct Cs) auto\n\nlemma psi_cases_fresh[simp]:\n fixes x :: name\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n \n shows \"x \\ psi_cases Cs = x \\ Cs\"\nby(induct Cs)\n (auto simp add: fresh_list_nil fresh_list_cons)\n\nlemma psi_cases_fresh_chain[simp]:\n fixes xvec :: \"name list\"\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and Xs :: \"name set\"\n \n shows \"(xvec \\* psi_cases Cs) = xvec \\* Cs\"\n and \"(Xs \\* psi_cases Cs) = Xs \\* Cs\"\nby(auto simp add: fresh_star_def)\n\nabbreviation\n psi_cases_judge (\"Cases _\" [80] 80) where \"Cases Cs \\ Case(psi_cases Cs)\"\n\nfun res_chain :: \"name list \\ ('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ ('a, 'b, 'c) psi\"\nwhere\n res_chainbase: \"res_chain [] P = P\"\n| res_chainstep: \"res_chain (x#xs) P = \\\\x\\(res_chain xs P)\"\n\nnotation res_chain (\"\\\\*_\\_\" [80, 80] 80)\n\nlemma res_chain_eqvt[eqvt]:\n fixes perm :: \"name prm\"\n and lst :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"perm \\ (\\\\*xvec\\P) = \\\\*(perm \\ xvec)\\(perm \\ P)\"\nby(induct_tac xvec, auto)\n\nlemma res_chain_supp:\n fixes xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"supp(\\\\*xvec\\P) = (supp P) - set xvec\"\nby(induct xvec) (auto simp add: psi.supp abs_supp)\n\nlemma res_chain_fresh: \n fixes x :: name\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"x \\ \\\\*xvec\\P = (x \\ set xvec \\ x \\ P)\"\nby (induct xvec) (simp_all add: abs_fresh)\n\nlemma res_chain_fresh_set: \n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"Xs \\* (\\\\*xvec\\P) = (\\x\\Xs. x \\ set xvec \\ x \\ P)\"\n and \"yvec \\* (\\\\*xvec\\P) = (\\x\\(set yvec). x \\ set xvec \\ x \\ P)\"\nby (simp add: fresh_star_def res_chain_fresh)+\n\nlemma res_chain_fresh_simps[simp]:\n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n\n shows \"Xs \\* xvec \\ Xs \\* (\\\\*xvec\\P) = (Xs \\* P)\"\n and \"yvec \\* xvec \\ yvec \\* (\\\\*xvec\\P) = (yvec \\* P)\"\n and \"xvec \\* (\\\\*xvec\\P)\"\napply(simp add: res_chain_fresh_set) apply(force simp add: fresh_star_def name_list_supp fresh_def)\napply(simp add: res_chain_fresh_set) apply(force simp add: fresh_star_def name_list_supp fresh_def)\nby(simp add: res_chain_fresh_set)\n \nlemma res_chain_alpha:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes xvec_freshP: \"(p \\ xvec) \\* P\"\n and S: \"set p \\ set xvec \\ set (p \\ xvec)\"\n\n shows \"\\\\*xvec\\P = \\\\*(p \\ xvec)\\(p \\ P)\"\nproof -\n note pt_name_inst at_name_inst S\n moreover have \"set xvec \\* (\\\\*xvec\\P)\"\n by (simp add: res_chain_fresh_set)\n moreover from xvec_freshP have \"set (p \\ xvec) \\* (\\\\*xvec\\P)\"\n by (simp add: res_chain_fresh_set) (simp add: fresh_star_def)\n ultimately have \"\\\\*xvec\\P = p \\ (\\\\*xvec\\P)\"\n by (rule_tac pt_freshs_freshs [symmetric])\n then show ?thesis by(simp add: eqvts)\nqed\n\nlemma res_chain_append:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"\\\\*(xvec@yvec)\\P = \\\\*xvec\\(\\\\*yvec\\P)\"\nby(induct xvec) auto\n\nlemma res_chain_simps[dest]:\n fixes xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n\n shows \"((\\\\*xvec\\(P \\ Q)) = P' \\ Q') \\ (P = P' \\ Q = Q')\"\n and \"(P \\ Q = \\\\*xvec\\(P' \\ Q')) \\ (P = P' \\ Q = Q')\"\nby(case_tac xvec, simp_all add: psi.inject)+\n\nfun input_chain :: \"name list \\ 'a::fs_name \\ ('a, 'b::fs_name, 'c::fs_name) psi \\ ('a, 'b, 'c) input\"\nwhere\n input_chainbase: \"input_chain [] N P = \\(N).P\"\n| input_chainstep: \"input_chain (x#xs) N P = \\ x (input_chain xs N P)\"\n\nabbreviation\n input_chain_judge (\"_\\\\*_ _\\._\" [80, 80, 80, 80] 80) where \"M\\\\*xvec N\\.P \\ M\\(input_chain xvec N P)\"\n\nlemma input_chain_eqvt[eqvt]:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"p \\ (input_chain xvec N P) = input_chain (p \\ xvec) (p \\ N) (p \\ P)\"\nby(induct_tac xvec) auto\n\nlemma input_chain_fresh: \n fixes x :: name\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"x \\ (input_chain xvec N P) = (x \\ set xvec \\ (x \\ N \\ x \\ P))\"\nby (induct xvec) (simp_all add: abs_fresh)\n\nlemma induct_chain_simps[simp]:\n fixes xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"xvec \\* (input_chain xvec N P)\"\nby(induct xvec) (auto simp add: abs_fresh abs_fresh_star fresh_star_def)\n\nlemma input_chain_fresh_set: \n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"Xs \\* (input_chain xvec N P) = (\\x\\Xs. x \\ set xvec \\ (x \\ N \\ x \\ P))\"\nby (simp add: fresh_star_def input_chain_fresh)\n\nlemma input_chain_alpha:\n fixes p :: \"name prm\"\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n\n assumes Xs_freshP: \"Xs \\* (input_chain xvec N P)\"\n and Ys_freshN: \"Ys \\* N\"\n and Ys_freshP: \"Ys \\* P\"\n and S: \"set p \\ Xs \\ Ys\"\n\n shows \"(input_chain xvec N P) = (input_chain (p \\ xvec) (p \\ N) (p \\ P))\"\nproof -\n note pt_name_inst at_name_inst Xs_freshP S\n moreover from Ys_freshN Ys_freshP have \"Ys \\* (input_chain xvec N P)\"\n by (simp add: input_chain_fresh_set) (simp add: fresh_star_def)\n ultimately have \"(input_chain xvec N P) = p \\ (input_chain xvec N P)\"\n by (rule_tac pt_freshs_freshs [symmetric])\n then show ?thesis by(simp add: eqvts)\nqed\n\nlemma input_chain_alpha':\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes xvec_freshP: \"(p \\ xvec) \\* P\"\n and xvec_freshN: \"(p \\ xvec) \\* N\"\n and S: \"set p \\ set xvec \\ set (p \\ xvec)\"\n\n shows \"(input_chain xvec N P) = (input_chain (p \\ xvec) (p \\ N) (p \\ P))\"\nproof -\n note pt_name_inst at_name_inst S\n moreover have \"set xvec \\* (input_chain xvec N P)\"\n by (simp add: input_chain_fresh_set)\n ultimately show ?thesis using xvec_freshN xvec_freshP \n by(rule_tac input_chain_alpha) (simp add: fresh_star_def)+\nqed\n\nlemma alpha_res:\n fixes M :: \"'a::fs_name\"\n and x :: name\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and y :: name\n\n assumes y_freshP: \"y \\ P\"\n\n shows \"\\\\x\\P = \\\\y\\([(x, y)] \\ P)\"\nproof(cases \"x = y\")\n assume \"x=y\"\n thus ?thesis by simp\nnext\n assume \"x \\ y\"\n with y_freshP show ?thesis\n by(perm_simp add: psi.inject alpha calc_atm fresh_left)\nqed\n\nlemma alpha_input:\n fixes x :: name\n and I :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input\"\n and c :: name\n\n assumes A1: \"c \\ I\"\n\n shows \"\\ x I = \\ c([(x, c)] \\ I)\"\nproof(cases \"x = c\")\n assume \"x=c\"\n thus ?thesis by simp\nnext\n assume \"x \\ c\"\n with A1 show ?thesis\n by(perm_simp add: input.inject alpha calc_atm fresh_left)\nqed\n\nlemma input_chain_length_eq:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes \"length xvec = length yvec\"\n and \"xvec \\* yvec\"\n and \"distinct yvec\"\n and \"yvec \\* M\"\n and \"yvec \\* P\"\n\n obtains N Q where \"input_chain xvec M P = input_chain yvec N Q\"\nproof -\n assume \"\\N Q. input_chain xvec M P = input_chain yvec N Q \\ thesis\"\n moreover obtain n where \"n = length xvec\" by auto\n with assms have \"\\N Q. input_chain xvec M P = input_chain yvec N Q\"\n proof(induct n arbitrary: xvec yvec M P)\n case 0\n thus ?case by auto\n next\n case(Suc n xvec yvec M P)\n from `Suc n = length xvec`\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n with `length xvec = length yvec`\n obtain y yvec' where \"yvec = y#yvec'\" by(case_tac yvec) auto\n from `yvec = y#yvec'` `xvec=x#xvec'` `xvec \\* yvec` `distinct yvec` `length xvec = length yvec` `yvec \\* M` `yvec \\* P`\n have \"length xvec' = length yvec'\" and \"xvec' \\* yvec'\" and \"distinct yvec'\" and \"yvec' \\* M\" and \"yvec' \\* P\"\n by simp+\n then obtain N Q where Eq: \"input_chain xvec' M P = input_chain yvec' N Q\" using `length xvec' = n`\n by(drule_tac Suc) auto\n moreover from `distinct yvec` `yvec = y#yvec'` have \"y \\ yvec'\" by auto\n moreover from `xvec \\* yvec` `xvec = x#xvec'` `yvec=y#yvec'` have \"x \\ y\" and \"x \\ yvec'\"\n by auto\n moreover from `yvec \\* M` `yvec \\* P` `yvec = y#yvec'` have \"y \\ M\" and \"y \\ P\" by auto\n hence \"y \\ input_chain xvec' M P\" by(simp add: input_chain_fresh)\n with Eq have \"y \\ input_chain yvec' N Q\" by(simp add: input_chain_fresh)\n ultimately have \"\\ x (input_chain xvec' M P) = \\ y (input_chain yvec' ([(x, y)] \\ N) ([(x, y)] \\ Q))\"\n by(simp add: input.inject alpha' eqvts name_swap)\n thus ?case using `xvec = x#xvec'` `yvec=y#yvec'` by force\n qed\n ultimately show ?thesis\n by blast\nqed\n\nlemma input_chain_eq:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"input_chain xvec M P = input_chain yvec N Q\"\n and \"xvec \\* yvec\"\n and \"distinct xvec\"\n and \"distinct yvec\"\n\n obtains p where \"(set p) \\ (set xvec) \\ set (p \\ xvec)\" and \"distinct_perm p\" and \"yvec = p \\ xvec\" and \"N = p \\ M\" and \"Q = p \\ P\"\nproof -\n assume \"\\p. \\set p \\ set xvec \\ set (p \\ xvec); distinct_perm p; yvec = p \\ xvec; N = p \\ M; Q = p \\ P\\ \\ thesis\"\n moreover obtain n where \"n = length xvec\" by auto\n with assms have \"\\p. (set p) \\ (set xvec) \\ set (yvec) \\ distinct_perm p \\ yvec = p \\ xvec \\ N = p \\ M \\ Q = p \\ P\"\n proof(induct n arbitrary: xvec yvec M N P Q)\n case(0 xvec yvec M N P Q)\n have Eq: \"input_chain xvec M P = input_chain yvec N Q\" by fact\n from `0 = length xvec` have \"xvec = []\" by auto\n moreover with Eq have \"yvec = []\"\n by(case_tac yvec) auto\n ultimately show ?case using Eq\n by(simp add: input.inject)\n next\n case(Suc n xvec yvec M N P Q)\n from `Suc n = length xvec`\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n from `input_chain xvec M P = input_chain yvec N Q` `xvec = x # xvec'`\n obtain y yvec' where \"input_chain (x#xvec') M P = input_chain (y#yvec') N Q\"\n and \"yvec = y#yvec'\"\n by(case_tac yvec) auto\n hence EQ: \"\\ x (input_chain xvec' M P) = \\ y (input_chain yvec' N Q)\"\n by simp\n from `xvec = x#xvec'` `yvec=y#yvec'` `xvec \\* yvec`\n have \"x \\ y\" and \"xvec' \\* yvec'\" and \"x \\ yvec'\" and \"y \\ xvec'\"\n by(auto simp add: fresh_list_cons)\n from `distinct xvec` `distinct yvec` `xvec=x#xvec'` `yvec=y#yvec'` have \"x \\ xvec'\" and \"y \\ yvec'\" and \"distinct xvec'\" and \"distinct yvec'\"\n by simp+\n have IH: \"\\xvec yvec M N P Q. \\input_chain xvec (M::'a) (P::('a, 'b, 'c) psi) = input_chain yvec (N::'a) (Q::('a, 'b, 'c) psi); xvec \\* yvec; distinct xvec; distinct yvec; n = length xvec\\ \\ \\p. (set p) \\ (set xvec) \\ (set yvec) \\ distinct_perm p \\ yvec = p \\ xvec \\ N = p \\ M \\ Q = p \\ P\"\n by fact\n from EQ `x \\ y` `x \\ yvec'` `y \\ yvec'` have \"input_chain xvec' M P = input_chain yvec' ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n by(simp add: input.inject alpha eqvts)\n with `xvec' \\* yvec'` `distinct xvec'` `distinct yvec'` `length xvec' = n` IH\n obtain p where S: \"(set p) \\ (set xvec') \\ (set yvec')\" and \"distinct_perm p\" and \"yvec' = p \\ xvec'\" and \"([(x, y)] \\ N) = p \\ M\" and \"([(x, y)] \\ Q) = p \\ P\"\n by metis\n from S have \"set((x, y)#p) \\ set(x#xvec') \\ set(y#yvec')\" by auto\n moreover from `x \\ xvec'` `x \\ yvec'` `y \\ xvec'` `y \\ yvec'` S have \"x \\ p\" and \"y \\ p\"\n apply(induct p)\n by(auto simp add: fresh_list_nil fresh_list_cons fresh_prod name_list_supp) (auto simp add: fresh_def) \n\n with S `distinct_perm p` `x \\ y` have \"distinct_perm((x, y)#p)\" by auto\n moreover from `yvec' = p \\ xvec'` `x \\ p` `y \\ p` `x \\ xvec'` `y \\ xvec'` have \"(y#yvec') = ((x, y)#p) \\ (x#xvec')\"\n by(simp add: calc_atm fresh_chain_simps)\n moreover from `([(x, y)] \\ N) = p \\ M` have \"([(x, y)] \\ [(x, y)] \\ N) = [(x, y)] \\ p \\ M\"\n by(simp add: pt_bij)\n hence \"N = ((x, y)#p) \\ M\" by simp\n moreover from `([(x, y)] \\ Q) = p \\ P` have \"([(x, y)] \\ [(x, y)] \\ Q) = [(x, y)] \\ p \\ P\"\n by(simp add: pt_bij)\n hence \"Q = ((x, y)#p) \\ P\" by simp\n ultimately show ?case using `xvec=x#xvec'` `yvec=y#yvec'`\n by blast\n qed\n ultimately show ?thesis by blast\nqed\n\nlemma input_chain_eq_length:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"input_chain xvec M P = input_chain yvec N Q\"\n\n shows \"length xvec = length yvec\"\nproof -\n obtain n where \"n = length xvec\" by auto\n with assms show ?thesis\n proof(induct n arbitrary: xvec yvec M P N Q)\n case(0 xvec yvec M P N Q)\n from `0 = length xvec` have \"xvec = []\" by auto\n moreover with `input_chain xvec M P = input_chain yvec N Q` have \"yvec = []\"\n by(case_tac yvec) auto\n ultimately show ?case by simp\n next\n case(Suc n xvec yvec M P N Q)\n from `Suc n = length xvec`\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n from `input_chain xvec M P = input_chain yvec N Q` `xvec = x # xvec'`\n obtain y yvec' where \"input_chain (x#xvec') M P = input_chain (y#yvec') N Q\"\n and \"yvec = y#yvec'\"\n by(case_tac yvec) auto\n hence EQ: \"\\ x (input_chain xvec' M P) = \\ y (input_chain yvec' N Q)\"\n by simp\n have IH: \"\\xvec yvec M P N Q. \\input_chain xvec (M::'a) (P::('a, 'b, 'c) psi) = input_chain yvec N Q; n = length xvec\\ \\ length xvec = length yvec\"\n by fact\n show ?case\n proof(case_tac \"x = y\")\n assume \"x = y\"\n with EQ have \"input_chain xvec' M P = input_chain yvec' N Q\"\n\tby(simp add: alpha input.inject)\n with IH `length xvec' = n` have \"length xvec' = length yvec'\"\n\tby blast\n with `xvec = x#xvec'` `yvec=y#yvec'`\n show ?case by simp\n next\n assume \"x \\ y\"\n with EQ have \"input_chain xvec' M P = input_chain ([(x, y)] \\ yvec') ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n\tby(simp add: alpha input.inject eqvts)\n with IH `length xvec' = n` have \"length xvec' = length ([(x, y)] \\ yvec')\"\n\tby blast\n hence \"length xvec' = length yvec'\"\n\tby simp\n with `xvec = x#xvec'` `yvec=y#yvec'`\n show ?case by simp\n qed\n qed\nqed\n\nlemma alpha_input_chain:\n fixes yvec :: \"name list\"\n and xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes \"length xvec = length yvec\"\n and \"yvec \\* M\"\n and \"yvec \\* P\"\n and \"yvec \\* xvec\"\n and \"distinct yvec\"\n\n shows \"input_chain xvec M P = input_chain yvec ([xvec yvec] \\\\<^sub>v M) ([xvec yvec] \\\\<^sub>v P)\"\nusing assms\nproof(induct rule: compose_perm_induct)\n case c_base\n show ?case by simp\nnext\n case(c_step x xvec y yvec)\n thus ?case \n apply auto\n by(subst alpha_input[of y]) (auto simp add: input_chain_fresh eqvts)\nqed\n\nlemma input_chain_inject[simp]:\n\n shows \"(input_chain xvec M P = input_chain xvec N Q) = ((M = N) \\ (P = Q))\"\nby(induct xvec) (auto simp add: input.inject alpha)\n\nlemma alpha_input_distinct:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes Eq: \"input_chain xvec M P = input_chain yvec N Q\"\n and xvec_dist: \"distinct xvec\"\n and Mem: \"\\x. x \\ set xvec \\ x \\ supp M\"\n and xvec_freshyvec: \"xvec \\* yvec\"\n and xvec_freshN: \"xvec \\* N\"\n and xvec_freshQ: \"xvec \\* Q\"\n\n shows \"distinct yvec\"\nproof -\n from Eq have \"length xvec = length yvec\"\n by(rule input_chain_eq_length)\n with assms show ?thesis\n proof(induct n==\"length xvec\" arbitrary: xvec yvec N Q rule: nat.induct)\n case(zero xvec yvec N Q)\n thus ?case by simp\n next\n case(Suc n xvec yvec N Q)\n have L: \"length xvec = length yvec\" and \"Suc n = length xvec\" by fact+\n then obtain x xvec' y yvec' where x_eq: \"xvec = x#xvec'\" and y_eq: \"yvec = y#yvec'\"\n and L': \"length xvec' = length yvec'\"\n by(cases xvec, auto, cases yvec, auto)\n have xvec_freshyvec: \"xvec \\* yvec\" and xvec_dist: \"distinct xvec\" by fact+\n with x_eq y_eq have xineqy: \"x \\ y\" and xvec'_freshyvec': \"xvec' \\* yvec'\"\n and xvec'_dist: \"distinct xvec'\" and x_freshxvec': \"x \\ xvec'\"\n and x_freshyvec': \"x \\ yvec'\" and y_freshxvec': \"y \\ xvec'\"\n by(auto simp add: fresh_list_cons)\n have Eq: \"input_chain xvec M P = input_chain yvec N Q\" by fact\n with x_eq y_eq xineqy have Eq': \"input_chain xvec' M P = input_chain ([(x, y)] \\ yvec') ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n by(simp add: input.inject alpha eqvts) \n moreover have Mem:\"\\x. x \\ set xvec \\ x \\ supp M\" by fact\n with x_eq have \"\\x. x \\ set xvec' \\ x \\ supp M\" by simp\n moreover have xvec_freshN: \"xvec \\* N\" by fact\n with x_eq x_freshxvec' y_freshxvec' have \"xvec' \\* ([(x, y)] \\ N)\" by simp\n moreover have xvec_freshQ: \"xvec \\* Q\" by fact\n with x_eq x_freshxvec' y_freshxvec' have \"xvec' \\* ([(x, y)] \\ Q)\" by simp\n moreover have \"Suc n = length xvec\" by fact\n with x_eq have \"n = length xvec'\" by simp\n moreover from xvec'_freshyvec' x_freshxvec' y_freshxvec' have \"xvec' \\* ([(x, y)] \\ yvec')\"\n by simp\n moreover from L' have \"length xvec' = length([(x, y)] \\ yvec')\" by simp\n moreover have \"\\xvec yvec N Q.\n \\n = length xvec; input_chain xvec (M::'a) (P::('a, 'b, 'c) psi) = input_chain yvec N Q; distinct xvec; \\x. x \\ set xvec \\ x \\ supp M; xvec \\* yvec;\n xvec \\* N; xvec \\* Q; length xvec = length yvec\\\n \\ distinct yvec\" by fact\n ultimately have \"distinct([(x, y)] \\ yvec')\" using xvec'_dist\n by blast\n hence \"distinct yvec'\" by simp\n from Mem x_eq have x_suppM: \"x \\ supp M\" by simp\n from L xvec_freshyvec xvec_dist xvec_freshN xvec_freshQ\n have \"input_chain yvec N Q = input_chain xvec ([yvec xvec] \\\\<^sub>v N) ([yvec xvec] \\\\<^sub>v Q)\"\n by(simp add: alpha_input_chain)\n with Eq have \"M = [yvec xvec] \\\\<^sub>v N\" by auto\n with x_eq y_eq have \"M = [(y, x)] \\ [yvec' xvec'] \\\\<^sub>v N\"\n by simp\n with x_suppM have y_suppN: \"y \\ supp([yvec' xvec'] \\\\<^sub>v N)\"\n by(drule_tac pi=\"[(x, y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\n (simp add: calc_atm eqvts name_swap)\n have \"y \\ yvec'\"\n proof(simp add: fresh_def, rule notI)\n assume \"y \\ supp yvec'\"\n hence \"y mem yvec'\"\n\tby(induct yvec') (auto simp add: supp_list_nil supp_list_cons supp_atm)\n moreover from xvec_freshN x_eq x_freshxvec' have \"xvec' \\* N\" by simp\n ultimately have \"y \\ [yvec' xvec'] \\\\<^sub>v N\" using L' xvec'_freshyvec' xvec'_dist\n\tby(force intro: fresh_chain_perm simp add: fresh_chain_sym)\n with y_suppN show \"False\" by(simp add: fresh_def)\n qed\n with `distinct yvec'` y_eq show ?case by simp\n qed\nqed\n\nlemma psi_cases_inject[simp]:\n fixes CsP :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n shows \"(psi_cases CsP = psi_cases CsQ) = (CsP = CsQ)\"\nproof(induct CsP arbitrary: CsQ)\n case(Nil CsQ)\n thus ?case by(case_tac CsQ) (auto)\nnext\n case(Cons a CsP CsQ)\n thus ?case\n by(case_tac a, case_tac CsQ) (clarsimp simp add: psi_case.inject)+\nqed\n\nlemma cases_inject[simp]:\n fixes CsP :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n shows \"(Cases CsP = Cases CsQ) = (CsP = CsQ)\"\napply(induct CsP)\napply(auto simp add: psi_case.inject)\napply(case_tac CsQ)\napply(simp add: psi_case.inject psi.inject)\napply(force simp add: psi_case.inject psi.inject)\napply(case_tac CsQ)\napply(force simp add: psi_case.inject psi.inject)\napply(auto simp add: psi_case.inject psi.inject)\napply(simp only: psi_cases.simps[symmetric])\napply(simp only: psi_cases_inject)\napply simp\napply(case_tac CsQ)\nby(auto simp add: psi_case.inject psi.inject)\n\nnominal_primrec\n guarded :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ bool\"\n and guarded' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input \\ bool\"\n and guarded'' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi_case \\ bool\"\n\nwhere\n \"guarded (\\) = True\"\n| \"guarded (M\\N\\.P) = True\"\n| \"guarded (M\\I) = True\"\n| \"guarded (Case C) = guarded'' C\"\n| \"guarded (P \\ Q) = ((guarded P) \\ (guarded Q))\"\n| \"guarded (\\\\x\\P) = (guarded P)\"\n| \"guarded (\\\\\\) = False\"\n| \"guarded (!P) = guarded P\"\n\n| \"guarded' (Trm M P) = False\"\n| \"guarded' (\\ y I) = False\"\n\n| \"guarded'' (\\\\<^sub>c) = True\"\n| \"guarded'' (\\\\ \\ P C) = (guarded P \\ guarded'' C)\"\napply(finite_guess)+\napply(rule TrueI)+\nby(fresh_guess add: fresh_bool)+\n\nlemma guarded_eqvt[eqvt]:\n fixes p :: \"name prm\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n shows \"(p \\ (guarded P)) = guarded (p \\ P)\"\n and \"(p \\ (guarded' I)) = guarded' (p \\ I)\"\n and \"(p \\ (guarded'' C)) = guarded'' (p \\ C)\"\nby(nominal_induct P and I and C rule: psi_input_psi_case.strong_inducts)\n (simp add: eqvts)+\n\nlemma guarded_closed[simp]:\n fixes P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and p :: \"name prm\"\n\n assumes \"guarded P\"\n\n shows \"guarded(p \\ P)\"\nproof -\n from `guarded P` have \"p \\ (guarded P)\"\n by(simp add: perm_bool)\n thus ?thesis by(simp add: eqvts)\nqed\n\nlocale subst_psi =\n subst_term: strong_subst_type subst_term +\n subst_assert: subst_type subst_assert +\n subst_cond: subst_type subst_cond\n\n for subst_term :: \"('a::fs_name) \\ name list \\ 'a::fs_name list \\ 'a\"\n and subst_assert :: \"('b::fs_name) \\ name list \\ 'a::fs_name list \\ 'b\"\n and subst_cond :: \"('c::fs_name) \\ name list \\ 'a::fs_name list \\ 'c\"\nbegin\n\nnominal_primrec \n subs :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ name list \\ 'a list \\ ('a, 'b, 'c) psi\"\nand subs' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input \\ name list \\ 'a list \\ ('a, 'b, 'c) input\"\nand subs'' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi_case \\ name list \\ 'a list \\ ('a, 'b, 'c) psi_case\"\n\nwhere\n \"subs (\\) xvec Tvec = \\\"\n| \"(subs (M\\N\\.P) xvec Tvec) = (subst_term M xvec Tvec)\\(subst_term N xvec Tvec)\\.(subs P xvec Tvec)\"\n| \"(subs (M\\I) xvec Tvec) = (subst_term M xvec Tvec)\\(subs' I xvec Tvec)\"\n\n| \"(subs (Case C) xvec Tvec) = (Case (subs'' C xvec Tvec))\"\n| \"(subs (P \\ Q) xvec Tvec) = (subs P xvec Tvec) \\ (subs Q xvec Tvec)\"\n| \"\\y \\ xvec; y \\ Tvec\\ \\ (subs (\\\\y\\P) xvec Tvec) = \\\\y\\(subs P xvec Tvec)\"\n| \"(subs (\\\\\\) xvec Tvec) = \\(subst_assert \\ xvec Tvec)\\\"\n| \"(subs (!P) xvec Tvec) = !(subs P xvec Tvec)\"\n\n| \"(subs' ((Trm M P)::('a::fs_name, 'b::fs_name, 'c::fs_name) input) xvec Tvec) = (\\(subst_term M xvec Tvec).(subs P xvec Tvec))\"\n| \"\\y \\ xvec; y \\ Tvec\\ \\ (subs' (\\ y I) xvec Tvec) = (\\ y (subs' I xvec Tvec))\"\n\n| \"(subs'' (\\\\<^sub>c::('a::fs_name, 'b::fs_name, 'c::fs_name) psi_case) xvec Tvec) = \\\\<^sub>c\"\n| \"(subs'' (\\\\ \\ P C) xvec Tvec) = (\\(subst_cond \\ xvec Tvec) \\ (subs P xvec Tvec) (subs'' C xvec Tvec))\"\napply(finite_guess add: subst_term.fs subst_assert.fs subst_cond.fs)+\napply(rule TrueI)+\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\ndone\n\nlemma subst_eqvt[eqvt]:\n fixes p :: \"name prm\"\n and P :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n shows \"(p \\ (subs P xvec Tvec)) = subs (p \\ P) (p \\ xvec) (p \\ Tvec)\"\n and \"(p \\ (subs' I xvec Tvec)) = subs' (p \\ I) (p \\ xvec) (p \\ Tvec)\"\n and \"(p \\ (subs'' C xvec Tvec)) = subs'' (p \\ C) (p \\ xvec) (p \\ Tvec)\"\napply(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts)\napply(auto simp add: eqvts)\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply simp\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\nby simp\n(*\nlemma subst1:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and x :: name\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n and \"x \\ xvec\"\n\n shows \"x \\ (subs P xvec Tvec) \\ x \\ P\"\n and \"x \\ (subs' I xvec Tvec) \\ x \\ I\"\n and \"x \\ (subs'' C xvec Tvec) \\ x \\ C\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.subst1 subst_cond.subst1 subst_assert.subst1 simp add: abs_fresh)\n\nlemma subst1_chain:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and Xs :: \"name set\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n and \"Xs \\* xvec\"\n\n shows \"Xs \\* (subs P xvec Tvec) \\ Xs \\* P\"\n and \"Xs \\* (subs' I xvec Tvec) \\ Xs \\* I\"\n and \"Xs \\* (subs'' C xvec Tvec) \\ Xs \\* C\"\nusing assms\nby(auto intro: subst1 simp add: fresh_star_def)\n*)\nlemma subst2[intro]:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and x :: name\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"x \\ Tvec\"\n and \"x \\ xvec\"\n\n shows \"x \\ P \\ x \\ (subs P xvec Tvec)\"\n and \"x \\ I \\ x \\ (subs' I xvec Tvec)\"\n and \"x \\ C \\ x \\ (subs'' C xvec Tvec)\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.subst2 subst_cond.subst2 subst_assert.subst2 simp add: abs_fresh)\n\nlemma subst2_chain[intro]:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and Xs :: \"name set\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"Xs \\* xvec\"\n and \"Xs \\* Tvec\"\n\n shows \"Xs \\* P \\ Xs \\* (subs P xvec Tvec)\"\n and \"Xs \\* I \\ Xs \\* (subs' I xvec Tvec)\"\n and \"Xs \\* C \\ Xs \\* (subs'' C xvec Tvec)\"\nusing assms\nby(auto intro: subst2 simp add: fresh_star_def)\n(*\nlemma subst4:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a ,'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n\n shows \"\\xvec \\* P\\ \\ (subs P xvec Tvec) = P\"\n and \"\\xvec \\* I\\ \\ (subs' I xvec Tvec) = I\"\n and \"\\xvec \\* C\\ \\ (subs'' C xvec Tvec) = C\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.subst4 subst_cond.subst4 subst_assert.subst4 simp add: psi.inject input.inject psi_case.inject)\n\nlemma subst5:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and yvec :: \"name list\"\n and Tvec' :: \"'a list\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a ,'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n and \"length yvec = length Tvec'\"\n and \"distinct yvec\"\n and \"yvec \\* xvec\"\n and \"yvec \\* Tvec\"\n\n shows \"(subs P (xvec@yvec) (Tvec@Tvec')) = subs (subs P xvec Tvec) yvec Tvec'\"\n and \"(subs' I (xvec@yvec) (Tvec@Tvec')) = subs' (subs' I xvec Tvec) yvec Tvec'\"\n and \"(subs'' C (xvec@yvec) (Tvec@Tvec')) = subs'' (subs'' C xvec Tvec) yvec Tvec'\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec yvec Tvec' rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.subst5 subst_cond.subst5 subst_assert.subst5 simp add: psi.inject input.inject psi_case.inject fresh_list_append)\n*)\nlemma renaming:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and p :: \"name prm\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a ,'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"set p \\ set xvec \\ set (p \\ xvec)\"\n and \"distinct_perm p\"\n\n shows \"\\(p \\ xvec) \\* P\\ \\ (subs P xvec Tvec) = subs (p \\ P) (p \\ xvec) Tvec\"\n and \"\\(p \\ xvec) \\* I\\ \\ (subs' I xvec Tvec) = subs' (p \\ I) (p \\ xvec) Tvec\"\n and \"\\(p \\ xvec) \\* C\\ \\ (subs'' C xvec Tvec) = subs'' (p \\ C) (p \\ xvec) Tvec\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec p Tvec rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.renaming subst_cond.renaming subst_assert.renaming simp add: fresh_chain_simps psi.inject input.inject psi_case.inject)\n\nlemma subst4_chain:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n and \"xvec \\* Tvec\"\n\n shows \"xvec \\* (subs P xvec Tvec)\"\n and \"xvec \\* (subs' I xvec Tvec)\"\n and \"xvec \\* (subs'' C xvec Tvec)\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts)\n (auto intro: subst_term.subst4_chain subst_cond.subst4_chain subst_assert.subst4_chain simp add: abs_fresh)\n(*\nlemma subst_empty[simp]:\n fixes P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n\n shows \"(subs P [] []) = P\"\n and \"(subs' I [] []) = I\"\n and \"(subs'' C [] []) = C\"\nusing assms\nby(nominal_induct P and I and C rule: psi_input_psi_case.strong_inducts) auto\n*)\nlemma guarded_subst[simp]:\n fixes P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psi_case\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n shows \"guarded P \\ guarded(subs P xvec Tvec)\"\n and \"guarded' I \\ guarded'(subs' I xvec Tvec)\"\n and \"guarded'' C \\ guarded''(subs'' C xvec Tvec)\"\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psi_case.strong_inducts) auto\n\ndefinition seq_subs :: \"('a, 'b, 'c) psi \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) psi\" (\"_[<_>]\" [80, 80] 130)\n where \"P[<\\>] \\ foldl (\\Q. \\(xvec, Tvec). subs Q xvec Tvec) P \\\"\n\ndefinition seq_subs' :: \"('a, 'b, 'c) input \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) input\" \n where \"seq_subs' I \\ \\ foldl (\\Q. \\(xvec, Tvec). subs' Q xvec Tvec) I \\\"\n\ndefinition seq_subs'' :: \"('a, 'b, 'c) psi_case \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) psi_case\"\n where \"seq_subs'' C \\ \\ foldl (\\Q. \\(xvec, Tvec). subs'' Q xvec Tvec) C \\\"\n\nlemma subst_input_chain[simp]:\n fixes xvec :: \"name list\"\n and N :: \"'a\"\n and P :: \"('a, 'b, 'c) psi\"\n and yvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n assumes \"xvec \\* yvec\"\n and \"xvec \\* Tvec\"\n\n shows \"subs' (input_chain xvec N P) yvec Tvec = input_chain xvec (subst_term N yvec Tvec) (subs P yvec Tvec)\"\nusing assms\nby(induct xvec) (auto simp add: psi.inject)\n\nfun case_list_subst :: \"('c \\ ('a, 'b, 'c) psi) list \\ name list \\ 'a list \\ ('c \\ ('a, 'b, 'c) psi) list\"\nwhere\n \"case_list_subst [] _ _ = []\"\n| \"case_list_subst ((\\, P)#Cs) xvec Tvec = (subst_cond \\ xvec Tvec, (subs P xvec Tvec))#(case_list_subst Cs xvec Tvec)\"\n\nlemma subst_cases[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n shows \"subs (Cases Cs) xvec Tvec = Cases(case_list_subst Cs xvec Tvec)\"\nby(induct Cs) (auto simp add: psi.inject)\n\nlemma subst_cases'[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n shows \"(subs'' (psi_cases Cs) xvec Tvec) = psi_cases(case_list_subst Cs xvec Tvec)\"\nby(induct Cs) auto\n\nlemma seq_subst_simps[simp]:\n shows \"seq_subs (\\) \\ = \\\"\n and \"(seq_subs (M\\N\\.P) \\) = (subst_term.seq_subst M \\)\\(subst_term.seq_subst N \\)\\.(seq_subs P \\)\"\n and \"(seq_subs (M\\I) \\) = (subst_term.seq_subst M \\)\\(seq_subs' I \\)\"\n\n and \"(seq_subs (Case C) \\) = (Case (seq_subs'' C \\))\"\n and \"(seq_subs (P \\ Q) \\) = (seq_subs P \\) \\ (seq_subs Q \\)\"\n and \"\\y \\ \\\\ \\ (seq_subs (\\\\y\\P) \\) = \\\\y\\(seq_subs P \\)\"\n and \"(seq_subs (\\\\\\) \\) = \\(subst_assert.seq_subst \\ \\)\\\"\n and \"(seq_subs (!P) \\) = !(seq_subs P \\)\"\n \n and \"(seq_subs' ((Trm M P)::('a::fs_name, 'b::fs_name, 'c::fs_name) input) \\) = (\\(subst_term.seq_subst M \\).(seq_subs P \\))\"\n and \"\\y \\ \\\\ \\ (seq_subs' (\\ y I) \\) = (\\ y (seq_subs' I \\))\"\n \n and \"(seq_subs'' (\\\\<^sub>c::('a::fs_name, 'b::fs_name, 'c::fs_name) psi_case) \\) = \\\\<^sub>c\"\n and \"(seq_subs'' (\\\\ \\ P C) \\) = (\\(subst_cond.seq_subst \\ \\) \\ (seq_subs P \\) (seq_subs'' C \\))\"\nby(induct \\ arbitrary: M N P I C Q \\ \\, auto simp add: seq_subs_def seq_subs'_def seq_subs''_def)\n\nlemma seq_subs_nil[simp]:\n \"seq_subs P [] = P\"\nby(simp add: seq_subs_def)\n\nlemma seq_subs_cons[simp]:\n shows \"seq_subs P ((xvec, Tvec)#\\) = seq_subs(subs P xvec Tvec) \\\"\n by(simp add: seq_subs_def)\n\nlemma seq_subs_term_append[simp]:\n shows \"seq_subs P (\\@\\') = seq_subs (seq_subs P \\) \\'\"\nby(induct \\) (auto simp add: seq_subs_def)\n\nfun case_list_seq_subst :: \"('c \\ ('a, 'b, 'c) psi) list \\ (name list \\ 'a list) list \\ ('c \\ ('a, 'b, 'c) psi) list\"\nwhere\n \"case_list_seq_subst [] _ = []\"\n| \"case_list_seq_subst ((\\, P)#Cs) \\ = (subst_cond.seq_subst \\ \\, (seq_subs P \\))#(case_list_seq_subst Cs \\)\"\n\nlemma seq_subst_cases[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n shows \"seq_subs (Cases Cs) \\ = Cases(case_list_seq_subst Cs \\)\"\nby(induct Cs) (auto simp add: psi.inject)\n\nlemma seq_subst_cases'[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n shows \"(seq_subs'' (psi_cases Cs) \\) = psi_cases(case_list_seq_subst Cs \\)\"\nby(induct Cs) auto\n\nlemma seq_subst_eqvt[eqvt]:\n fixes P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n and p :: \"name prm\"\n\n shows \"(p \\ (P[<\\>])) = (p \\ P)[<(p \\ \\)>]\"\nby(induct \\ arbitrary: P) (auto simp add: eqvts seq_subs_def)\n\n\nlemma guarded_seq_subst:\n assumes \"guarded P\"\n\n shows \"guarded(seq_subs P \\)\"\nusing assms\n by(induct \\ arbitrary: P) (auto dest: guarded_subst)\n\nend\n\nlemma inter_eqvt:\n shows \"(pi::name prm) \\ ((X::name set) \\ Y) = (pi \\ X) \\ (pi \\ Y)\"\nby(auto simp add: perm_set_def perm_bij)\n\nlemma delete_eqvt:\n fixes p :: \"name prm\"\n and X :: \"name set\"\n and Y :: \"name set\"\n\n shows \"p \\ (X - Y) = (p \\ X) - (p \\ Y)\"\nby(auto simp add: perm_set_def perm_bij)\n\nlemma perm_singleton[simp]:\n shows \"(p::name prm) \\ {(x::name)} = {p \\ x}\"\nby(auto simp add: perm_set_def)\n\nend", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Agent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25559067413455916}} {"text": "theory IICF_List_List\nimports \n \"../../Sepref\"\nbegin\n\n\n context begin\n private abbreviation (input) \"LR A \\ \\\\A\\list_rel\\list_rel\"\n\n sepref_decl_op list_list_lempty: \"\\n. replicate n []\" :: \"nat_rel \\ LR A\" .\n sepref_decl_op list_list_push_back: \"\\xss i x. xss[i:=xss!i@[x]]\" \n :: \"[\\((xss,i),_). if (LR A \\\\<^sub>r nat_rel) \\\\<^sub>r A \\ LR A\" .\n\n sepref_decl_op list_list_pop_back: \"\\xss i. (last (xss!i), xss[i:=butlast (xss!i)])\" \n :: \"[\\(xss,i). i xss!i\\[]]\\<^sub>f (LR A \\\\<^sub>r nat_rel)\\ A \\\\<^sub>r LR A\" \n unfolding conv_to_is_Nil short_circuit_conv\n by parametricity\n \n sepref_decl_op list_list_upd: \"\\xss i j x. xss[i:=(xss!i)[j:=x]]\" \n :: \"[\\(((xss,i),j),x). i jf (((LR A \\\\<^sub>r nat_rel) \\\\<^sub>r nat_rel) \\\\<^sub>r A) \\ LR A\" \n unfolding short_circuit_conv\n by parametricity\n \n sepref_decl_op list_list_idx: \"\\xss i j. xss!i!j\" :: \"[\\((xss,i),j). i jf ((LR A \\\\<^sub>r nat_rel) \\\\<^sub>r nat_rel) \\ A\" \n unfolding short_circuit_conv\n by parametricity\n \n sepref_decl_op list_list_llen: \"\\xss i. length (xss!i)\" :: \"[\\(xss,i). if LR A \\\\<^sub>r nat_rel \\ nat_rel\" .\n (* TODO: list_list is a proper subtype of list. So share operations! length, empty, ... *)\n sepref_decl_op list_list_len: \"length :: _ list list \\ _\" :: \"LR A \\ nat_rel\" .\n \n sepref_decl_op list_list_take: \"\\xss i l. (xss[i:=take l (xss!i)])\" \n :: \"[\\((xss,i),l). i l\\length (xss!i)]\\<^sub>f ((LR A \\\\<^sub>r nat_rel) \\\\<^sub>r nat_rel)\\ LR A\" \n unfolding conv_to_is_Nil short_circuit_conv\n by parametricity\n \n end\n\n locale list_list_custom_empty = \n fixes rel empty PRE and op_custom_empty :: \"nat \\ 'a list list\"\n assumes customize_hnr_aux: \"(empty,(RETURN o (op_list_list_lempty::nat \\ 'a list list))) \\ [PRE]\\<^sub>a snat_assn\\<^sup>k \\ rel\"\n assumes op_custom_empty_def: \"op_custom_empty = op_list_list_lempty\"\n begin\n sepref_register op_custom_empty :: \"nat \\ 'c list list\"\n \n lemma fold_custom_empty:\n \"replicate n [] = op_custom_empty n\"\n \"op_list_list_lempty = op_custom_empty\"\n \"mop_list_list_lempty n = RETURN (op_custom_empty n)\"\n unfolding op_custom_empty_def by simp_all\n \n lemmas custom_hnr[sepref_fr_rules] = customize_hnr_aux[folded op_custom_empty_def]\n end\n\n\n text \\Fold lemmas for manual folding.\\\n (* TODO: Why not use interface and op-id for that? *)\n lemma fold_op_list_list_push_back: \"xss[i:=xss!i@[x]] = op_list_list_push_back xss i x\" by simp\n lemma fold_op_list_list_pop_back: \"(last (xss!i), xss[i:=butlast (xss!i)]) = op_list_list_pop_back xss i\" by simp\n lemma fold_op_list_list_upd: \"xss[i:=(xss!i)[j:=x]] = op_list_list_upd xss i j x\" by simp\n lemma fold_op_list_list_idx: \"xs!i!j = op_list_list_idx xs i j\" by simp\n lemma fold_op_list_list_llen: \"length (xs!i) = op_list_list_llen xs i\" by simp\n lemma fold_op_list_list_take: \"xss[i:=take n (xss!i)] = op_list_list_take xss i n\" by simp\n\n lemmas fold_op_list_list = \n fold_op_list_list_push_back\n fold_op_list_list_pop_back \n fold_op_list_list_upd\n fold_op_list_list_idx\n fold_op_list_list_llen\n fold_op_list_list_take \n \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/IICF/Intf/IICF_List_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25559067413455916}} {"text": "theory flash7Rev imports flashPub\nbegin\nsection{*Main defintions*}\n\n\nlemma lemmaOnPtrAtGetX[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv2 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv2 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\n\n\nlemma lemmaOnPtrAtGet[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \"\n shows \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n proof(rule ccontr)\n assume b0:\"\\formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n have b1:\"formEval (inv3 iInv1 iInv2) s\"\n apply(cut_tac a7)\n \n apply(drule_tac x=\"inv3 iInv1 iInv2\" in spec)\n apply(cut_tac a7 a2 a3 a4,simp)\n done\n with b0 a5 a6 show False\n by auto\nqed \n\nlemma lemmaOnPtr1[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_Get )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGet)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr2[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGetX)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n\n\nlemma lemmaOnPtr3[intro]:\n assumes a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) s\" and\n a6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) s \" and\n a7:\"\\f. f \\ (invariants N) \\ formEval f s \" and\n b2:\"iInv1' \\ N\" and b3:\"iInv2' \\ N\" and b4:\"iInv1'~=iInv2' \" \n and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') ) ( Const UNI_GetX )) s\" and\n b6:\"formEval ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') ) (Const iInv2')) s \" and\n b7:\"iInv2\\iInv2'\"\n shows False\n proof -\n have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2) ) s\"\n by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv2') ) s\"\n by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7 show False\n by auto\nqed \n \n\nabbreviation N::\"nat\" where \"N\\ M\"\nlemma NI_FAckVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_InvVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_1VsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv7Aux: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule'' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n \n have \"invHoldForRule3' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" \n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n then have \"?P3 s\"\n by(rule weak3)\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"invHoldForRule3' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" \n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n\n then have \"?P3 s\"\n by(rule weak3)\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"invHoldForRule3' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n then have \"?P3 s\"\n by(rule weak3)\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"invHoldForRule3' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_Get )) ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) ) (Const iInv2)) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) ) ( Const UNI_GetX )) ) ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) ) (Const iInv2)) ) ) \" in exI,auto)\n \n \n done\n then have \"?P3 s\"\n by(rule weak3)\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P3 s\"\n proof( unfold invHoldForRule3''_def,simp only:Let_def,( rule impI)+, rule ccontr)\n assume c1:\"\\f'. f' \\ invariants N \\ formEval f' s\" and c2:\"formEval (pre (NI_Remote_GetX_PutX iRule1 iRule2)) s \"\n and c3:\"\\ formEval (substFormByStatement (inv7 iInv1 iInv2) (act (NI_Remote_GetX_PutX iRule1 iRule2))) s\"\n have d1:\" formEval (eqn (IVar (Para ''UniMsg_Cmd'' iInv1)) (Const UNI_Get)) s\" by(cut_tac b1 c2 c3, auto)\n have d2:\"formEval (eqn (IVar (Para ''UniMsg_Cmd'' iRule1)) (Const UNI_GetX)) s\" by(cut_tac b1 c2 c3, auto)\n have d3:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iInv1)) (Const iInv2)) s\" by(cut_tac b1 c2 c3, auto)\n have d4:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iRule1)) (Const iRule2)) s\" by(cut_tac b1 c2 c3, auto)\n show False thm lemmaOnPtr2\n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 c1 c2 c3 d1 d2 d3 d4,blast )\n done\n qed\n \n \n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\")\nby (metis NI_Remote_GetX_PutXVsInv7Aux a2 a3 a4 a5 a6 local.a1 strengthEn) \n \nlemma NI_Remote_GetX_PutX_HomeVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Put2VsInv7: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_ReplaceVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv7: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv7: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv7 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash7Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25559067413455916}} {"text": "section \\ Circus State Machine Semantics \\\n\ntheory Circus_SM_Semantics\n imports \"RoboChart.RoboChart\" Actions\nbegin recall_syntax\n\nsubsection \\ Alphabet \\\n\nalphabet robochart_ctrl =\n rc_ctrl :: ID \n\ntype_synonym 's rcst = \"'s robochart_ctrl_scheme\"\ntype_synonym ('s, 'e) RoboAction = \"('s robochart_ctrl_scheme, 'e) Actions.Action\"\ntype_synonym 's RoboPred = \"'s robochart_ctrl_scheme upred\"\n\ntranslations\n (type) \"'s rcst\" <= (type) \"'s robochart_ctrl_scheme\"\n (type) \"('s, 'e) RoboAction\" <= (type) \"('s rcst, 'e) Action\"\n (type) \"'s RoboPred\" <= (type) \"'s rcst upred\"\n\nabbreviation \"rc_state \\ robochart_ctrl.more\\<^sub>L\"\n\nnotation rc_state (\"\\<^bold>r\")\n\nsyntax\n \"_svid_rc_state\" :: \"svid\" (\"\\<^bold>r\")\n\ntranslations\n \"_svid_rc_state\" == \"CONST rc_state\"\n \"_svid_dot \\<^bold>r x\" <= \"x ;\\<^sub>L \\<^bold>r\"\n\ntype_synonym ('s, 'e) RTransition = \"('s upred, ('s, 'e) Action, unit) STransition\"\ntype_synonym ('s, 'e) RNode = \"('s upred, ('s, 'e) Action, unit) SNode\"\ntype_synonym ('s, 'e) RStateMachine = \"('s upred, ('s, 'e) Action, unit) SStateMachine\"\n\nsubsection \\ State Machine Semantics \\\n\nnamed_theorems sm_sem\n\nabbreviation \"trigger_semantics t \\ \n (case tn_trigger t of \n Some e \\ e | \n None \\ skip)\"\n\ndefinition tn_condition :: \"('s, 'e) RTransition \\ 's upred\" where\n[sm_sem]: \"tn_condition t = case_option true_upred id (tn_cond t)\"\n\ndefinition tn_action :: \"('s, 'e) RTransition \\ ('s, 'e) Action\" where\n[sm_sem]: \"tn_action t = case_option skip id (tn_act t)\"\n\nno_utp_lift tn_condition\n\ndefinition tr_semantics :: \"('s, 'e) RTransition \\ (unit, 'e) chan \\ ('s, 'e) RoboAction\" (\"\\_\\\\<^sub>T\") where\n[sm_sem]: \"tr_semantics t \\ \\ \n let tsem = trigger_semantics t ; tn_action t\n in\n tn_condition t \\\\<^sub>p rc_state \\<^bold>& \n rc_state:[if productive tsem then tsem else tsem ; sync \\]\\<^sub>A\\<^sup>+ ; rc_ctrl := \\tn_target t\\\"\n\ndefinition [sm_sem]: \"n_entry_sem n = case_option skip id (n_entry n)\"\n\ndefinition [sm_sem]: \"n_exit_sem n = case_option skip id (n_exit n)\"\n\ndefinition node_semantics :: \n \"('s, 'e) RStateMachine \\ (unit, 'e) chan \\ ('s, 'e) RNode \\ ('s, 'e) RoboAction\" (\"_;_ \\ \\_\\\\<^sub>N\" [10,0,0] 10) where\n[sm_sem]: \"node_semantics M \\ node = \n (rc_state:[n_entry_sem node]\\<^sub>A\\<^sup>+ ;\n (foldr (\\) (map (\\ t. \\t\\\\<^sub>T \\) (the (Tmap\\<^bsub>M\\<^esub> (n_name node)))) stop) ;\n rc_state:[n_exit_sem node]\\<^sub>A\\<^sup>+)\"\n\ndataspace stm_context =\n channels null_event :: unit \n\ncontext stm_context\nbegin\n\nnotation null_event (\"\\\")\n\nend\n\ndefinition sm_semantics :: \"('st, 'ch) RStateMachine \\ _ \\ ('st, 'ch) RoboAction\" (\"\\_\\\\<^sub>M\") where\n[sm_sem]:\n\"sm_semantics M null_event =\n (rc_ctrl := \\sm_initial M\\ ;\n iteration (map (\\ n. (&rc_ctrl =\\<^sub>u \\n_name n\\, M;null_event \\ \\n\\\\<^sub>N)) (sm_inters M)))\"\n\nlemma tr_semantics_subst_ctrl: \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ (\\a\\\\<^sub>T null_event) = \\a\\\\<^sub>T null_event\"\n by (simp add: tr_semantics_def action_simp action_subst usubst unrest frame_asubst Let_unfold)\n\nlemma tr_choice_subst_ctrl:\n \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ foldr (\\) (map (\\t. \\t\\\\<^sub>T null_event) ts) stop = foldr (\\) (map (\\t. \\t\\\\<^sub>T null_event) ts) stop\"\n by (induct ts, simp_all add: action_simp action_subst usubst tr_semantics_subst_ctrl)\n\nlemma sm_semantics_subst_ctrl:\n \"[&rc_ctrl \\\\<^sub>s \\k\\] \\ node_semantics M null_event node = node_semantics M null_event node\"\n by (simp add: node_semantics_def action_simp action_subst frame_asubst tr_choice_subst_ctrl unrest)\n\n(* Tests *)\n\ndefinition \"circus_predT stT = Type @{type_name upred} [stT]\"\ndefinition \"circus_actionT stT evT = Type @{type_name Action} [stT, evT]\"\ndefinition \"circus_probT stT = @{typ unit}\"\ndefinition \"actionN = STR ''action''\"\n\ndefinition \"action_eq = \n mk_equals (free actionN) (const @{const_name sm_semantics} $ free machineN $ free STR ''null_event'')\"\n\ndefinition \"add_stm_context smd = \n smd\\ uses := STR ''stm_context'' # uses smd \\\"\n\ncode_reflect RC_Circus_Semantics\n functions circus_predT circus_actionT circus_probT action_eq add_stm_context\n\nsetup \\\n let open RC_Compiler; open RC_Circus_Semantics; open Specification\n val cont = snd o definition NONE [] [] ((Binding.empty, []), action_eq)\n val circus_types = RCTypes_ext (circus_predT, @{nonterminal utp_expr}, circus_actionT, @{nonterminal \"raction\"}, circus_probT, @{nonterminal utp_expr}, ())\n val circus_semantics = \n stm_sem_update (K (context_Stm_Semantics cont o add_stm_context)) null_RCSem_Proc\n |> rctypes_update (K circus_types)\n in\n Stm_Sem.put circus_semantics\n end\n\\\n\nlemma entry_basic_Node [simp]: \"n_entry_sem (basic_Node n) = skip\"\n by (simp add: n_entry_sem_def basic_Node_def)\n\nlemma exit_basic_Node [simp]: \"n_exit_sem (basic_Node n) = skip\"\n by (simp add: n_exit_sem_def basic_Node_def)\n\nlemma basic_Node_sem:\n \"(M;\\ \\ \\basic_Node n\\\\<^sub>N) = foldr (\\) (map (\\t. \\t\\\\<^sub>T \\) (the (Tmap\\<^bsub>M\\<^esub> n))) stop\"\n by (simp add: node_semantics_def action_simp)\n\nend", "meta": {"author": "isabelle-utp", "repo": "RoboChart-Isabelle", "sha": "4d7306d6791c195c081a918e5e249c3a9712be5c", "save_path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle", "path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle/RoboChart-Isabelle-4d7306d6791c195c081a918e5e249c3a9712be5c/Semantics/Circus_Semantics/Circus_SM_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25559067413455916}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | December 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory CSP_T_law_step_ext\nimports CSP_T_law_basic\nbegin\n\n(*****************************************************************\n\n 1. step laws\n 2.\n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n Parallel expansion & distribution\n *********************************************************)\n\nlemma cspT_Parallel_Timeout_split:\n \"((? :Y -> Pf) [> P) |[X]| ((? :Z -> Qf) [> Q) =T[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| ((? :Z -> Qf) [> Q)) |~|\n (((? :Y -> Pf) [> P) |[X]| Q)))\"\napply (fold Timeout_def)\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (force)\n apply (force)\n apply (force)\n apply (force)\n\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim conjE exE disjE)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (force)\n apply (force)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: in_traces)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces_IF)\n apply (case_tac \"a : Z\")\n\n (* a : Z *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Z *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces_IF)\n apply (case_tac \"a : Y\")\n\n (* a : Y *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~:Y *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n\n apply (simp add: par_tr_nil_left)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_nil_left)\n apply (force)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* *)\n apply (force)\n apply (force)\n apply (force)\n apply (force)\n apply (force)\n apply (force)\ndone\n\n(*********************************************************\n Parallel expansion & distribution 2\n *********************************************************)\n\nlemma cspT_Parallel_Timeout_input_l: \n \"((? :Y -> Pf) [> P) |[X]| (? :Z -> Qf) =T[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n |~| (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n ELSE (((? x:Y -> Pf x) [> P) |[X]| Qf x))\n [> (((P |[X]| (? :Z -> Qf))))\"\napply (fold Timeout_def)\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: par_tr_nil_left)\n apply (rule disjI1)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (elim conjE)\n apply (simp add: image_iff)\n apply (case_tac \"a:Y\")\n apply (simp)\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp add: par_tr_nil_left)\n\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp add: par_tr_nil_left)\n\n apply (simp add: par_tr_nil_right)\n apply (rule disjI1)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (elim conjE)\n apply (simp add: image_iff)\n apply (case_tac \"a:Z\")\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n\n apply (force)\n\n apply (simp add: par_tr_head_Ev_Ev)\n apply (elim conjE exE disjE)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (simp)\n apply (rule disjI1)\n apply (rule_tac x=\"c\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (force)\n\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: in_traces)\n apply (elim conjE exE)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces_IF)\n apply (case_tac \"a : Z\")\n\n (* a : Z *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~: Z *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: in_traces_IF)\n apply (case_tac \"a : Y\")\n\n (* a : Y *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (simp add: par_tr_nil_right)\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp add: par_tr_nil_right)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (simp add: par_tr_nil_left)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_nil_left)\n apply (force)\n\n apply (rule_tac x=\" ^^^ sb\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* a ~:Y *)\n apply (simp add: in_traces_Timeout in_traces)\n apply (elim conjE exE disjE)\n\n apply (simp add: par_tr_nil_left)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_nil_left)\n apply (force)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\" ^^^ ta\" in exI)\n apply (simp add: par_tr_head)\n\n (* *)\n apply (force)\n apply (force)\ndone\n\nlemma cspT_Parallel_Timeout_input_r: \n \"(? :Y -> Pf) |[X]| ((? :Z -> Qf) [> Q) =T[M,M]\n (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n -> IF (x : X) THEN (Pf x |[X]| Qf x)\n ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n |~| ((? x:Y -> Pf x) |[X]| Qf x))\n ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [> Q))\n ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n [> ((((? :Y -> Pf) |[X]| Q)))\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\n\napply (rule cspT_rw_left)\napply (rule cspT_Parallel_Timeout_input_l)\n\napply (rule cspT_decompo)\napply (rule cspT_decompo)\napply (rule cspT_decompo)\napply (force)\n\napply (case_tac \"a : X\")\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_commut)\n\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\n\napply (case_tac \"(a : Z & a : Y)\")\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\n\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_decompo)\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (simp)\n\napply (simp (no_asm_simp))\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (subgoal_tac \"~(a : Y & a : Z)\")\napply (simp (no_asm_simp))\napply (rule cspT_rw_right)\napply (rule cspT_IF)\n\napply (case_tac \"a : Z\")\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_commut)\napply (simp)\napply (rule cspT_rw_left)\napply (rule cspT_IF)\napply (rule cspT_rw_right)\napply (rule cspT_IF)\napply (rule cspT_commut)\n\napply (fast)\napply (simp)\napply (rule cspT_commut)\ndone\n\nlemmas cspT_Parallel_Timeout_input = \n cspT_Parallel_Timeout_input_l\n cspT_Parallel_Timeout_input_r\n\n(*** cspT_step_ext ***)\n\nlemmas cspT_step_ext = cspT_Parallel_Timeout_split\n cspT_Parallel_Timeout_input\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_step_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25559067413455916}} {"text": "(* Title: HOL/Bali/Type.thy\n Author: David von Oheimb\n*)\n\nsubsection \\Java types\\\n\ntheory Type imports Name begin\n\ntext \\\nsimplifications:\n\\begin{itemize}\n\\item only the most important primitive types\n\\item the null type is regarded as reference type\n\\end{itemize}\n\\\n\ndatatype prim_ty \\ \\primitive type, cf. 4.2\\\n = Void \\ \\result type of void methods\\\n | Boolean\n | Integer\n\n\ndatatype ref_ty \\ \\reference type, cf. 4.3\\\n = NullT \\ \\null type, cf. 4.1\\\n | IfaceT qtname \\ \\interface type\\\n | ClassT qtname \\ \\class type\\\n | ArrayT ty \\ \\array type\\\n\nand ty \\ \\any type, cf. 4.1\\\n = PrimT prim_ty \\ \\primitive type\\\n | RefT ref_ty \\ \\reference type\\\n\nabbreviation \"NT == RefT NullT\"\nabbreviation \"Iface I == RefT (IfaceT I)\"\nabbreviation \"Class C == RefT (ClassT C)\"\nabbreviation Array :: \"ty \\ ty\" (\"_.[]\" [90] 90)\n where \"T.[] == RefT (ArrayT T)\"\n\ndefinition\n the_Class :: \"ty \\ qtname\"\n where \"the_Class T = (SOME C. T = Class C)\" (** primrec not possible here **)\n \nlemma the_Class_eq [simp]: \"the_Class (Class C)= C\"\nby (auto simp add: the_Class_def)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Bali/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2555669675777183}} {"text": "section \\ Experiment in creating Circus with a Refusal Testing Semantics \\\n\ntheory utp_rcircus\n imports Refusal_Tests \"UTP1-Reactive-Designs.utp_rea_designs\"\nbegin\n\nrecall_syntax\n\nsubsection \\ Refusal Syntax\\\n\nsyntax\n \"_urmember\" :: \"logic \\ logic \\ logic\" (\"(_/ \\\\<^sup>\\ _)\" [51, 51] 50)\n \"_urnot_member\" :: \"logic \\ logic \\ logic\" (\"(_/ \\\\<^sup>\\ _)\" [51, 51] 50)\n \"_urevevent\" :: \"logic \\ logic\" (\"revent\\<^sub>u'(_')\")\n\nterm not_upred\n\ntranslations \n \"(x \\\\<^sup>\\ A)\" == \"CONST bop (CONST rmember) x A\"\n \"(x \\\\<^sup>\\ A)\" == \"CONST not_upred (x \\\\<^sup>\\ A)\"\n \"revent\\<^sub>u(a)\" == \"CONST uop CONST revent a\"\n\nsubsection \\ Refusal Circus Alphabet \\\n\nalphabet ('\\, '\\) rcsp_vars = \"('\\ list, '\\) rsp_vars\" +\n rref :: \"'\\ refusal\"\n\n\ntype_synonym ('\\,'\\) raction = \"('\\,'\\) rcsp_vars hrel\"\n \ntext \\ There is some slight imprecision with the translations, in that we don't bother to check\n if the trace event type and refusal set event types are the same. Essentially this is because\n its very difficult to construct processes where this would be the case. However, it may\n be better to add a proper ML print translation in the future. \\\n \nsubsection \\ Basic laws \\\n\nlemma R2c_tr_ext: \"R2c (U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><])) = U($tr\\ = $tr @ [\\a\\\\<^sub>S\\<^sub><])\"\n by (rel_auto)\n\nlemma circus_alpha_bij_lens:\n \"bij_lens ({$ok,$ok\\,$wait,$wait\\,$tr,$tr\\,$st,$st\\,$rref,$rref\\}\\<^sub>\\ :: _ \\ ('s,'e) rcsp_vars \\ ('s,'e) rcsp_vars)\"\n by (unfold_locales, lens_simp+)\n\nsubsection \\ Unrestriction laws \\\n\nlemma pre_unrest_ref [unrest]: \"$rref \\ P \\ $rref \\ pre\\<^sub>R(P)\"\n by (simp add: pre\\<^sub>R_def unrest)\n\nlemma peri_unrest_ref [unrest]: \"$rref \\ P \\ $rref \\ peri\\<^sub>R(P)\"\n by (simp add: peri\\<^sub>R_def unrest)\n\nlemma post_unrest_ref [unrest]: \"$rref \\ P \\ $rref \\ post\\<^sub>R(P)\"\n by (simp add: post\\<^sub>R_def unrest)\n\nlemma cmt_unrest_ref [unrest]: \"$rref \\ P \\ $rref \\ cmt\\<^sub>R(P)\"\n by (simp add: cmt\\<^sub>R_def unrest)\n\nlemma st_lift_unrest_ref' [unrest]: \"$rref\\ \\ \\b\\\\<^sub>S\\<^sub><\"\n by (rel_auto)\n\nlemma RHS_design_ref_unrest [unrest]:\n \"\\$rref \\ P; $rref \\ Q \\ \\ $rref \\ (\\<^bold>R\\<^sub>s(P \\ Q))\\false/$wait\\\"\n by (simp add: RHS_def R1_def R2c_def R2s_def R3h_def design_def usubst unrest)\n\nlemma R1_ref_unrest [unrest]: \"$rref \\ P \\ $rref \\ R1(P)\"\n by (simp add: R1_def unrest)\n\nlemma R2c_ref_unrest [unrest]: \"$rref \\ P \\ $rref \\ R2c(P)\"\n by (simp add: R2c_def unrest)\n\nlemma R1_ref'_unrest [unrest]: \"$rref\\ \\ P \\ $rref\\ \\ R1(P)\"\n by (simp add: R1_def unrest)\n\nlemma R2c_ref'_unrest [unrest]: \"$rref\\ \\ P \\ $rref\\ \\ R2c(P)\"\n by (simp add: R2c_def unrest)\n\nlemma R2s_notin_rref': \"R2s(\\\\x\\\\\\<^sub>S\\<^sub>< \\\\<^sup>\\ $rref\\) = (\\\\x\\\\\\<^sub>S\\<^sub>< \\\\<^sup>\\ $rref\\)\"\n by (pred_auto)\n\nlemma unrest_circus_alpha:\n fixes P :: \"('e, 't) raction\"\n assumes \n \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$tr \\ P\" \n \"$tr\\ \\ P\" \"$st \\ P\" \"$st\\ \\ P\" \"$rref \\ P\" \"$rref\\ \\ P\"\n shows \"\\ \\ P\"\n by (rule bij_lens_unrest_all[OF circus_alpha_bij_lens], simp add: unrest assms)\n\nlemma unrest_all_circus_vars:\n fixes P :: \"('s, 'e) raction\"\n assumes \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$rref \\ P\" \"\\ \\ r'\" \"\\ \\ s\" \"\\ \\ s'\" \"\\ \\ t\" \"\\ \\ t'\"\n shows \"\\ \\ [$rref\\ \\\\<^sub>s r', $st \\\\<^sub>s s, $st\\ \\\\<^sub>s s', $tr \\\\<^sub>s t, $tr\\ \\\\<^sub>s t'] \\ P\"\n using assms\n by (simp add: bij_lens_unrest_all_eq[OF circus_alpha_bij_lens] unrest_plus_split plus_vwb_lens)\n (simp add: unrest usubst closure)\n\nlemma unrest_all_circus_vars_st_st':\n fixes P :: \"('s, 'e) raction\"\n assumes \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$rref \\ P\" \"$rref\\ \\ P\" \"\\ \\ s\" \"\\ \\ s'\" \"\\ \\ t\" \"\\ \\ t'\"\n shows \"\\ \\ [$st \\\\<^sub>s s, $st\\ \\\\<^sub>s s', $tr \\\\<^sub>s t, $tr\\ \\\\<^sub>s t'] \\ P\"\n using assms\n by (simp add: bij_lens_unrest_all_eq[OF circus_alpha_bij_lens] unrest_plus_split plus_vwb_lens)\n (simp add: unrest usubst closure)\n\nlemma unrest_all_circus_vars_st:\n fixes P :: \"('s, 'e) raction\"\n assumes \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$rref \\ P\" \"$rref\\ \\ P\" \"$st\\ \\ P\" \"\\ \\ s\" \"\\ \\ t\" \"\\ \\ t'\"\n shows \"\\ \\ [$st \\\\<^sub>s s, $tr \\\\<^sub>s t, $tr\\ \\\\<^sub>s t'] \\ P\"\n using assms\n by (simp add: bij_lens_unrest_all_eq[OF circus_alpha_bij_lens] unrest_plus_split plus_vwb_lens)\n (simp add: unrest usubst closure)\n\nlemma unrest_any_circus_var:\n fixes P :: \"('s, 'e) raction\"\n assumes \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$rref \\ P\" \"$rref\\ \\ P\" \"\\ \\ s\" \"\\ \\ s'\" \"\\ \\ t\" \"\\ \\ t'\"\n shows \"x \\ [$st \\\\<^sub>s s, $st\\ \\\\<^sub>s s', $tr \\\\<^sub>s t, $tr\\ \\\\<^sub>s t'] \\ P\" \n by (simp add: unrest_all_var unrest_all_circus_vars_st_st' assms)\n\nlemma unrest_any_circus_var_st:\n fixes P :: \"('s, 'e) raction\"\n assumes \"$ok \\ P\" \"$ok\\ \\ P\" \"$wait \\ P\" \"$wait\\ \\ P\" \"$rref \\ P\" \"$rref\\ \\ P\" \"$st\\ \\ P\" \"\\ \\ s\" \"\\ \\ t\" \"\\ \\ t'\"\n shows \"x \\ [$st \\\\<^sub>s s, $tr \\\\<^sub>s t, $tr\\ \\\\<^sub>s t'] \\ P\"\n by (simp add: unrest_all_var unrest_all_circus_vars_st assms)\n\nsubsection \\ Basic Actions \\\n\n\nlemma rref_closure_1 [closure]: \"($tr\\ =\\<^sub>u $tr \\ $rref\\ =\\<^sub>u \\\\<^bold>\\\\) is RR\"\n apply (rel_auto)\n by (simp add: zero_list_def)\n\nlemma rref_closure_2 [closure]: \"$tr\\ =\\<^sub>u $tr \\ $st\\ =\\<^sub>u $st is RR\"\n apply (rel_auto)\n using minus_zero_eq by blast\n\nlemma rref_closure_3 [closure]: \"($tr\\ =\\<^sub>u $tr \\ \\a\\\\<^sub>S\\<^sub>< \\\\<^sup>\\ $rref\\) is RR\"\n by (rel_auto, simp add: zero_list_def)\n \nlemma rref_closure_4 [closure]: \"(\\<^bold>\\ e \\ U($tr\\ = $tr @ [\\e\\] \\ \\revent(e)\\ = \\a\\\\<^sub>S\\<^sub>< \\ $st\\ = $st)) is RR\"\n by (rel_auto)\n\nlemma rref_closure_5 [closure]: \"(\\<^bold>\\ e \\ U($tr\\ = $tr @ [\\e\\] \\ \\revent(e)\\ = \\a\\\\<^sub>S\\<^sub>< \\ $rref\\ = \\\\<^bold>\\\\)) is RR\"\n by (rel_auto)\n\ndefinition Stop :: \"('s, 'e) raction\" where\n[upred_defs, rdes_def]: \"Stop = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ ($tr\\ =\\<^sub>u $tr) \\ false)\"\n\ndefinition Skip :: \"('s, 'e) raction\" where\n[upred_defs, rdes_def]: \"Skip = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ U($tr\\ = $tr \\ $rref\\ = \\<^bold>\\) \\ U($tr\\ = $tr \\ $st\\ = $st))\"\n\ndefinition Do :: \"('e, 's) uexpr \\ ('s, 'e) raction\" where\n[upred_defs, rdes_def]: \n\"Do(a) = \\<^bold>R\\<^sub>s(true\\<^sub>r \\ (U($tr\\ = $tr \\ \\a\\\\<^sub>S\\<^sub>< \\\\<^sup>\\ $rref\\) \\ U(\\ e. $tr\\ = $tr @ [\\e\\] \\ \\revent(e)\\ = \\a\\\\<^sub>S\\<^sub>< \\ $rref\\ = \\<^bold>\\))\n \\ U(\\ e. $tr\\ = $tr @ [\\e\\] \\ \\revent(e)\\ = \\a\\\\<^sub>S\\<^sub>< \\ $st\\ = $st))\"\n\nlemma \"Skip ;; Stop = Stop\"\n by (rdes_eq)\n\nlemma \"Skip ;; Chaos = Chaos\"\n apply (rdes_eq_split)\n apply (rel_auto)\n oops -- {* Not true *}\n\nlemma \"Stop ;; Skip = Stop\"\n by (rdes_eq)\n\nlemma \"Skip ;; Do(a) = Do(a)\"\n by (rdes_eq)\n\nlemma \"Do(a) ;; Skip = Do(a)\"\n by (rdes_eq)\n\nlemma \"Stop ;; Do(a) = Stop\"\n by (rdes_eq)\n\nterm UINF\n\ndefinition ResolveR :: \"'a set \\ ('a \\ ('s, 'e) raction) \\ ('a \\ ('s, 'e) raction) \\ ('s, 'e) raction\" where\n\"ResolveR A P Q = (\\<^bold>\\ (e, t) \\ (\\ i\\A \\ ((P i)\\U([]),U([\\e\\]@\\t\\)/$tr,$tr\\\\)) \n \\ (\\ i\\A \\ ((Q i)\\U([]),U([]),U(\\rrefusal(e)\\)/$tr,$tr\\,$rref\\\\))\n \\ $tr\\ =\\<^sub>u $tr ^\\<^sub>u \\t\\)\"\n\nsyntax\n \"_ResolveR\" :: \"pttrn \\ logic \\ logic \\ logic \\ logic \\ logic\" (\"resolve _ \\ _ \\ '(_, _')\" [0, 10] 10)\n\ntranslations\n \"resolve x \\ A \\ (F, G)\" => \"CONST ResolveR A (\\ x. F) (\\ x. G)\"\n\ndefinition \n \"ExtChoice A P = \\<^bold>R\\<^sub>s((\\ i\\A \\ pre\\<^sub>R(P i)) \\ \n (R5(\\ i\\A \\ peri\\<^sub>R(P(i))) \\ (resolve i\\A \\ (peri\\<^sub>R(P(i)), peri\\<^sub>R(P(i))))) \\ \n (R5(\\ i\\A \\ post\\<^sub>R(P(i))) \\ (resolve i\\A \\ (peri\\<^sub>R(P(i)), post\\<^sub>R(P(i))))))\"\n\nlemma \"ExtChoice {} P = Stop\"\n by (simp add: ExtChoice_def ResolveR_def rpred, rel_auto)\n\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/rcircus/utp_rcircus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2554216220352411}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Cong_Sim_Pres\n imports Weak_Sim_Pres Weak_Cong_Simulation\nbegin\n\ncontext env begin\n\nlemma caseWeakSimPres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and M :: 'a\n and N :: 'a\n\n assumes PRelQ: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ Eq \\ P Q\"\n and Sim: \"\\\\' P Q. (\\', P, Q) \\ Rel \\ \\' \\ P \\ Q\"\n and EqRel: \"\\\\' P Q. Eq \\' P Q \\ (\\', P, Q) \\ Rel\"\n and EqSim: \"\\\\' P Q. Eq \\' P Q \\ \\' \\ P \\\\Rel\\ Q\"\n\n shows \"\\ \\ Cases CsP \\ Cases CsQ\"\nproof(induct rule: weakSimI2)\n case(cAct \\' \\ Q')\n from \\bn \\ \\* (Cases CsP)\\ have \"bn \\ \\* CsP\" by auto\n from \\\\ \\ Cases CsQ \\\\ \\ Q'\\\n show ?case\n proof(induct rule: caseCases)\n case(cCase \\ Q)\n from \\(\\, Q) mem CsQ\\ obtain P where \"(\\, P) mem CsP\" and \"guarded P\" and \"Eq \\ P Q\"\n by(metis PRelQ)\n from \\Eq \\ P Q\\ have \"\\ \\ P \\ Q\" by(metis EqRel Sim)\n moreover note \\\\ \\ Q \\\\ \\ Q'\\ \\bn \\ \\* \\\\\n moreover from \\bn \\ \\* CsP\\ \\(\\, P) mem CsP\\ have \"bn \\ \\* P\" by(auto dest: memFreshChain)\n ultimately obtain P'' P' where PTrans: \"\\ : Q \\ P \\\\ \\ P''\"\n and P''Chain: \"\\ \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" and P'RelQ': \"(\\ \\ \\', P', Q') \\ Rel\"\n using \\\\ \\ \\\\\n by(blast dest: weakSimE)\n note PTrans \\(\\, P) mem CsP\\ \\\\ \\ \\\\ \\guarded P\\\n moreover from \\guarded Q\\ have \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n by(rule insertGuardedAssertion)\n hence \"insertAssertion (extractFrame(Cases CsQ)) \\ \\\\<^sub>F insertAssertion (extractFrame Q) \\\"\n by(auto simp add: FrameStatEq_def)\n moreover from Identity have \"insertAssertion (extractFrame(Cases CsQ)) \\ \\\\<^sub>F \\\\, \\\\\"\n by(auto simp add: AssertionStatEq_def)\n ultimately have \"\\ : (Cases CsQ) \\ Cases CsP \\\\ \\ P''\"\n by(rule weakCase)\n with P''Chain P'RelQ' show ?case by blast\n qed\nnext\n case(cTau Q')\n from \\\\ \\ Cases CsQ \\\\ \\ Q'\\ show ?case\n proof(induct rule: caseCases)\n case(cCase \\ Q)\n from \\(\\, Q) mem CsQ\\ obtain P where \"(\\, P) mem CsP\" and \"guarded P\" and \"Eq \\ P Q\"\n by(metis PRelQ)\n from \\Eq \\ P Q\\ \\\\ \\ Q \\\\ \\ Q'\\\n obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: EqSim weakCongSimE)\n from PChain \\(\\, P) mem CsP\\ \\\\ \\ \\\\ \\guarded P\\ have \"\\ \\ Cases CsP \\\\<^sub>\\ P'\"\n by(rule tauStepChainCase)\n hence \"\\ \\ Cases CsP \\\\<^sup>^\\<^sub>\\ P'\" by(simp add: trancl_into_rtrancl)\n with P'RelQ' show ?case by blast\n qed\nqed\n\nlemma weakCongSimCasePres:\n fixes \\ :: 'b\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and M :: 'a\n and N :: 'a\n\n assumes PRelQ: \"\\\\ Q. (\\, Q) mem CsQ \\ \\P. (\\, P) mem CsP \\ guarded P \\ Eq \\ P Q\"\n and EqSim: \"\\\\' P Q. Eq \\' P Q \\ \\' \\ P \\\\Rel\\ Q\"\n\n shows \"\\ \\ Cases CsP \\\\Rel\\ Cases CsQ\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ Cases CsQ \\\\ \\ Q'\\ show ?case\n proof(induct rule: caseCases)\n case(cCase \\ Q)\n from \\(\\, Q) mem CsQ\\ obtain P where \"(\\, P) mem CsP\" and \"guarded P\" and \"Eq \\ P Q\"\n by(metis PRelQ)\n from \\Eq \\ P Q\\ \\\\ \\ Q \\\\ \\ Q'\\\n obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\"\n by(blast dest: EqSim weakCongSimE)\n from PChain \\(\\, P) mem CsP\\ \\\\ \\ \\\\ \\guarded P\\ have \"\\ \\ Cases CsP \\\\<^sub>\\ P'\"\n by(rule tauStepChainCase)\n with P'RelQ' show ?case by blast\n qed\nqed\n\nlemma weakCongSimResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes PSimQ: \"\\ \\ P \\\\Rel\\ Q\"\n and \"eqvt Rel'\"\n and \"x \\ \\\"\n and \"Rel \\ Rel'\"\n and C1: \"\\\\' R S x. \\(\\', R, S) \\ Rel; x \\ \\'\\ \\ (\\', \\\\x\\R, \\\\x\\S) \\ Rel'\"\n\n shows \"\\ \\ \\\\x\\P \\\\Rel'\\ \\\\x\\Q\"\nproof(induct rule: weakCongSimI)\n case(cTau Q')\n from \\\\ \\ \\\\x\\Q \\\\ \\ Q'\\ have \"x \\ Q'\" by(auto dest: tauFreshDerivative simp add: abs_fresh) \n with \\\\ \\ \\\\x\\Q \\\\ \\ Q'\\ \\x \\ \\\\ show ?case\n proof(induct rule: resTauCases)\n case(cRes Q')\n from PSimQ \\\\ \\ Q \\\\ \\ Q'\\ obtain P' where PChain: \"\\ \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\, P', Q') \\ Rel\" \n by(blast dest: weakCongSimE)\n from PChain \\x \\ \\\\ have \"\\ \\ \\\\x\\P \\\\<^sub>\\ \\\\x\\P'\" by(rule tauStepChainResPres)\n moreover from P'RelQ' \\x \\ \\\\ have \"(\\, \\\\x\\P', \\\\x\\Q') \\ Rel'\" by(rule C1)\n ultimately show ?case by blast\n qed\nqed\n\nlemma weakCongSimResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes PSimQ: \"\\ \\ P \\\\Rel\\ Q\"\n and \"eqvt Rel\"\n and \"xvec \\* \\\"\n and C1: \"\\\\' R S xvec. \\(\\', R, S) \\ Rel; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\R, \\\\*xvec\\S) \\ Rel\"\n\n shows \"\\ \\ \\\\*xvec\\P \\\\Rel\\ \\\\*xvec\\Q\"\nusing \\xvec \\* \\\\\nproof(induct xvec)\n case Nil\n from PSimQ show ?case by simp\nnext\n case(Cons x xvec)\n from \\(x#xvec) \\* \\\\ have \"x \\ \\\" and \"xvec \\* \\\" by simp+\n from \\xvec \\* \\ \\ \\ \\ \\\\*xvec\\P \\\\Rel\\ \\\\*xvec\\Q\\ \\xvec \\* \\\\\n have \"\\ \\ \\\\*xvec\\P \\\\Rel\\ \\\\*xvec\\Q\" by simp\n moreover note \\eqvt Rel\\ \\x \\ \\\\\n moreover have \"Rel \\ Rel\" by simp\n moreover have \"\\\\ P Q x. \\(\\, P, Q) \\ Rel; x \\ \\\\ \\ (\\, \\\\*[x]\\P, \\\\*[x]\\Q) \\ Rel\"\n by(rule_tac xvec=\"[x]\" in C1) auto\n hence \"\\\\ P Q x. \\(\\, P, Q) \\ Rel; x \\ \\\\ \\ (\\, \\\\x\\P, \\\\x\\Q) \\ Rel\"\n by simp\n ultimately have \"\\ \\ \\\\x\\(\\\\*xvec\\P) \\\\Rel\\ \\\\x\\(\\\\*xvec\\Q)\"\n by(rule weakCongSimResPres)\n thus ?case by simp\nqed\n\nlemma weakCongSimParPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n \n assumes PSimQ: \"\\\\'. \\' \\ P \\\\Rel\\ Q\"\n and PSimQ': \"\\\\'. \\' \\ P \\ Q\"\n and StatImp: \"\\\\'. \\' \\ Q \\ P\"\n\n and \"eqvt Rel\"\n and \"eqvt Rel'\"\n\n and Sym: \"\\\\' S T. \\(\\', S, T) \\ Rel\\ \\ (\\', T, S) \\ Rel\"\n and Ext: \"\\\\' S T \\''. \\(\\', S, T) \\ Rel\\ \\ (\\' \\ \\'', S, T) \\ Rel\"\n\n and C1: \"\\\\' S T A\\<^sub>U \\\\<^sub>U U. \\(\\' \\ \\\\<^sub>U, S, T) \\ Rel; extractFrame U = \\A\\<^sub>U, \\\\<^sub>U\\; A\\<^sub>U \\* \\'; A\\<^sub>U \\* S; A\\<^sub>U \\* T\\ \\ (\\', S \\ U, T \\ U) \\ Rel'\"\n and C2: \"\\\\' S T xvec. \\(\\', S, T) \\ Rel'; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel'\"\n and C3: \"\\\\' S T \\''. \\(\\', S, T) \\ Rel; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel\"\n\n shows \"\\ \\ P \\ R \\\\Rel'\\ Q \\ R\"\nproof(induct rule: weakCongSimI)\n case(cTau QR)\n from \\\\ \\ Q \\ R \\\\ \\ QR\\ show ?case\n proof(induct rule: parTauCases[where C=\"(P, R)\"])\n case(cPar1 Q' A\\<^sub>R \\\\<^sub>R)\n from \\A\\<^sub>R \\* (P, R)\\ have \"A\\<^sub>R \\* P\"\n by simp+\n have FrR: \" extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n with \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ have \"\\ \\ \\\\<^sub>R \\ P \\\\Rel\\ Q\"\n by(rule_tac PSimQ)\n moreover have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\\\ \\ Q'\" by fact\n ultimately obtain P' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sub>\\ P'\" and P'RelQ': \"(\\ \\ \\\\<^sub>R, P', Q') \\ Rel\"\n by(rule weakCongSimE)\n from PChain QTrans \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ have \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R \\* Q'\"\n by(force dest: freeFreshChainDerivative tauStepChainFreshChain)+\n from PChain FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ have \"\\ \\ P \\ R \\\\<^sub>\\ (P' \\ R)\"\n by(rule tauStepChainPar1)\n moreover from P'RelQ' FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P'\\ \\A\\<^sub>R \\* Q'\\ have \"(\\, P' \\ R, Q' \\ R) \\ Rel'\" by(rule C1)\n ultimately show ?case by blast\n next\n case(cPar2 R' A\\<^sub>Q \\\\<^sub>Q)\n from \\A\\<^sub>Q \\* (P, R)\\ have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, R)\"\n by(rule freshFrame)\n hence \"A\\<^sub>P \\* \\\" and \"A\\<^sub>P \\* A\\<^sub>Q\" and \"A\\<^sub>P \\* \\\\<^sub>Q\" and \"A\\<^sub>P \\* R\"\n by simp+\n \n have FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from \\A\\<^sub>Q \\* P\\ FrP \\A\\<^sub>P \\* A\\<^sub>Q\\ have \"A\\<^sub>Q \\* \\\\<^sub>P\"\n by(drule_tac extractFrameFreshChain) auto\n \n obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* (\\, P, Q, A\\<^sub>Q, A\\<^sub>P, \\\\<^sub>Q, \\\\<^sub>P, R)\" and \"distinct A\\<^sub>R\"\n by(rule freshFrame)\n then have \"A\\<^sub>R \\* \\\" and \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>R \\* \\\\<^sub>P\"\n and \"A\\<^sub>R \\* R\"\n by simp+\n \n from \\A\\<^sub>Q \\* R\\ FrR \\A\\<^sub>R \\* A\\<^sub>Q\\ have \"A\\<^sub>Q \\* \\\\<^sub>R\" by(drule_tac extractFrameFreshChain) auto\n from \\A\\<^sub>P \\* R\\ \\A\\<^sub>R \\* A\\<^sub>P\\ FrR have \"A\\<^sub>P \\* \\\\<^sub>R\" by(drule_tac extractFrameFreshChain) auto\n \n moreover from \\\\ \\ \\\\<^sub>Q \\ R \\\\ \\ R'\\ FrR \\distinct A\\<^sub>R\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* R\\\n obtain \\' A\\<^sub>R' \\\\<^sub>R' where \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and FrR': \"extractFrame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"A\\<^sub>R' \\* \\\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\"\n by(rule_tac C=\"(\\, P, Q, R)\" in expandTauFrame) (assumption | simp)+\n\n from FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\\n obtain P' P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and QimpP': \"insertAssertion(extractFrame Q) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insertAssertion(extractFrame P') (\\ \\ \\\\<^sub>R)\"\n and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ P''\"\n and P'RelQ: \"((\\ \\ \\\\<^sub>R) \\ \\', P'', Q) \\ Rel\"\n by(metis StatImp weakStatImp_def Sym)\n obtain A\\<^sub>P' \\\\<^sub>P' where FrP': \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"A\\<^sub>P' \\* \\\" and \"A\\<^sub>P' \\* \\\\<^sub>R\" and \"A\\<^sub>P' \\* \\\\<^sub>Q\"\n and \"A\\<^sub>P' \\* A\\<^sub>Q\" and \"A\\<^sub>P' \\* R\" and \"A\\<^sub>P' \\* A\\<^sub>R\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, \\\\<^sub>Q, A\\<^sub>Q, R, A\\<^sub>R)\" in freshFrame) auto\n\n from PChain P'Chain \\A\\<^sub>R \\* P\\ \\A\\<^sub>Q \\* P\\ \\A\\<^sub>R' \\* P\\ have \"A\\<^sub>Q \\* P'\" and \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R' \\* P'\" and \"A\\<^sub>R' \\* P''\"\n by(force intro: tauChainFreshChain)+\n from \\A\\<^sub>R \\* P'\\ \\A\\<^sub>P' \\* A\\<^sub>R\\ \\A\\<^sub>Q \\* P'\\ \\A\\<^sub>P' \\* A\\<^sub>Q\\ FrP' have \"A\\<^sub>Q \\* \\\\<^sub>P'\" and \"A\\<^sub>R \\* \\\\<^sub>P'\"\n by(force dest: extractFrameFreshChain)+\n \n from PChain FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P' \\ R\" by(rule tauChainPar1)\n moreover have RTrans: \"\\ \\ \\\\<^sub>P' \\ R \\\\ \\ R'\"\n proof -\n have \"\\ \\ \\\\<^sub>Q \\ R \\\\ \\ R'\" by fact\n moreover have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\"\n by(metis frameIntAssociativity Commutativity FrameStatEqTrans frameIntCompositionSym FrameStatEqSym)\n moreover with FrP' FrQ QimpP' \\A\\<^sub>P' \\* \\\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>P' \\* \\\\<^sub>R\\ \\A\\<^sub>Q \\* \\\\<^sub>R\\\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\\" using freshCompChain\n by simp\n moreover have \"\\A\\<^sub>P', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\A\\<^sub>P', (\\ \\ \\\\<^sub>P') \\ \\\\<^sub>R\\\"\n by(metis frameIntAssociativity Commutativity FrameStatEqTrans frameIntCompositionSym frameIntAssociativity[THEN FrameStatEqSym])\n ultimately show ?thesis\n by(rule FrameStatEqImpCompose)\n qed\n ultimately show ?thesis\n using \\A\\<^sub>P' \\* \\\\ \\A\\<^sub>P' \\* \\\\<^sub>Q\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>Q \\* \\\\<^sub>P'\\ \\A\\<^sub>P' \\* R\\ \\A\\<^sub>Q \\* R\\ \n \\A\\<^sub>P' \\* A\\<^sub>R\\ \\A\\<^sub>R \\* A\\<^sub>Q\\ \\A\\<^sub>R \\* \\\\<^sub>P'\\ \\A\\<^sub>R \\* \\\\<^sub>Q\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* \\\\<^sub>P'\\ \\A\\<^sub>Q \\* \\\\<^sub>P'\\ FrR \\distinct A\\<^sub>R\\\n by(force intro: transferTauFrame)\n qed\n hence \"\\ \\ P' \\ R \\\\ \\ (P' \\ R')\" using FrP' \\A\\<^sub>P' \\* \\\\ \\A\\<^sub>P' \\* R\\\n by(rule_tac Par2) auto\n moreover from P'Chain have \"\\ \\ \\\\<^sub>R \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ P''\"\n by(metis tauChainStatEq Associativity)\n with \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\ have \"\\ \\ \\\\<^sub>R' \\ P' \\\\<^sup>^\\<^sub>\\ P''\" \n by(rule_tac tauChainStatEq, auto) (metis compositionSym)\n hence \"\\ \\ P' \\ R' \\\\<^sup>^\\<^sub>\\ P'' \\ R'\" using FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P'\\ by(rule_tac tauChainPar1)\n ultimately have \"\\ \\ P \\ R \\\\<^sub>\\ (P'' \\ R')\"\n by(drule_tac tauActTauStepChain) auto\n \n moreover from P'RelQ \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\ have \"(\\ \\ \\\\<^sub>R', P'', Q) \\ Rel\" by(blast intro: C3 Associativity compositionSym)\n with FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P''\\ \\A\\<^sub>R' \\* Q\\ have \"(\\, P'' \\ R', Q \\ R') \\ Rel'\" by(rule_tac C1) \n ultimately show ?case by blast\n next\n case(cComm1 \\\\<^sub>R M N Q' A\\<^sub>Q \\\\<^sub>Q K xvec R' A\\<^sub>R)\n have FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from \\A\\<^sub>Q \\* (P, R)\\ have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n \n have FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from \\A\\<^sub>R \\* (P, R)\\ have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* R\" by simp+\n from \\xvec \\* (P, R)\\ have \"xvec \\* P\" and \"xvec \\* R\" by simp+\n \n have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\M\\N\\ \\ Q'\" and RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\K\\\\*xvec\\\\N\\ \\ R'\"\n and MeqK: \"\\ \\ \\\\<^sub>Q \\ \\\\<^sub>R \\ M \\K\" by fact+\n\n from RTrans FrR \\distinct A\\<^sub>R\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* xvec\\ \\xvec \\* R\\ \\xvec \\* Q\\ \\xvec \\* \\\\ \\xvec \\* \\\\<^sub>Q\\ \\A\\<^sub>R \\* Q\\\n \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* \\\\<^sub>Q\\ \\xvec \\* K\\ \\A\\<^sub>R \\* K\\ \\A\\<^sub>R \\* R\\ \\xvec \\* R\\ \\A\\<^sub>R \\* P\\ \\xvec \\* P\\\n \\A\\<^sub>Q \\* A\\<^sub>R\\ \\A\\<^sub>Q \\* xvec\\ \\A\\<^sub>R \\* K\\ \\A\\<^sub>R \\* N\\ \\xvec \\* K\\ \\distinct xvec\\\n obtain p \\' A\\<^sub>R' \\\\<^sub>R' where S: \"set p \\ set xvec \\ set(p \\ xvec)\" and FrR': \"extractFrame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\"\n and \"(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\" and \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\\\<^sub>Q\" and \"(p \\ xvec) \\* K\" and \"(p \\ xvec) \\* R\"\n and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* A\\<^sub>Q\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* N\"\n by(rule_tac C=\"(\\, Q, \\\\<^sub>Q, K, R, P, A\\<^sub>Q)\" and C'=\"(\\, Q, \\\\<^sub>Q, K, R, P, A\\<^sub>Q)\" in expandFrame) (assumption | simp)+\n\n from \\A\\<^sub>R \\* \\\\ have \"(p \\ A\\<^sub>R) \\* (p \\ \\)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ S have \"(p \\ A\\<^sub>R) \\* \\\" by simp\n from \\A\\<^sub>R \\* P\\ have \"(p \\ A\\<^sub>R) \\* (p \\ P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* P\\ \\(p \\ xvec) \\* P\\ S have \"(p \\ A\\<^sub>R) \\* P\" by simp\n from \\A\\<^sub>R \\* Q\\ have \"(p \\ A\\<^sub>R) \\* (p \\ Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* Q\\ \\(p \\ xvec) \\* Q\\ S have \"(p \\ A\\<^sub>R) \\* Q\" by simp\n from \\A\\<^sub>R \\* R\\ have \"(p \\ A\\<^sub>R) \\* (p \\ R)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* R\\ \\(p \\ xvec) \\* R\\ S have \"(p \\ A\\<^sub>R) \\* R\" by simp\n from \\A\\<^sub>R \\* K\\ have \"(p \\ A\\<^sub>R) \\* (p \\ K)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n with \\xvec \\* K\\ \\(p \\ xvec) \\* K\\ S have \"(p \\ A\\<^sub>R) \\* K\" by simp\n \n from \\A\\<^sub>Q \\* xvec\\ \\(p \\ xvec) \\* A\\<^sub>Q\\ \\A\\<^sub>Q \\* M\\ S have \"A\\<^sub>Q \\* (p \\ M)\" by(simp add: freshChainSimps)\n from \\A\\<^sub>Q \\* xvec\\ \\(p \\ xvec) \\* A\\<^sub>Q\\ \\A\\<^sub>Q \\* A\\<^sub>R\\ S have \"A\\<^sub>Q \\* (p \\ A\\<^sub>R)\" by(simp add: freshChainSimps)\n \n from QTrans S \\xvec \\* Q\\ \\(p \\ xvec) \\* Q\\ have \"(p \\ (\\ \\ \\\\<^sub>R)) \\ Q \\ (p \\ M)\\N\\ \\ Q'\"\n by(rule_tac inputPermFrameSubject) (assumption | auto simp add: fresh_star_def)+\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ S have QTrans: \"(\\ \\ (p \\ \\\\<^sub>R)) \\ Q \\ (p \\ M)\\N\\ \\ Q'\"\n by(simp add: eqvts)\n from FrR have \"(p \\ extractFrame R) = p \\ \\A\\<^sub>R, \\\\<^sub>R\\\" by simp\n with \\xvec \\* R\\ \\(p \\ xvec) \\* R\\ S have FrR: \"extractFrame R = \\(p \\ A\\<^sub>R), (p \\ \\\\<^sub>R)\\\"\n by(simp add: eqvts)\n \n from MeqK have \"(p \\ (\\ \\ \\\\<^sub>Q \\ \\\\<^sub>R)) \\ (p \\ M) \\ (p \\ K)\" by(rule chanEqClosed)\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ \\xvec \\* \\\\<^sub>Q\\ \\(p \\ xvec) \\* \\\\<^sub>Q\\ \\xvec \\* K\\ \\(p \\ xvec) \\* K\\ S\n have MeqK: \"\\ \\ \\\\<^sub>Q \\ (p \\ \\\\<^sub>R) \\ (p \\ M) \\ K\" by(simp add: eqvts)\n \n have \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\ Q\" by(rule PSimQ')\n\n with QTrans obtain P' P'' where PTrans: \"\\ \\ (p \\ \\\\<^sub>R) : Q \\ P \\(p \\ M)\\N\\ \\ P''\"\n and P''Chain: \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\"\n and P'RelQ': \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\', P', Q') \\ Rel\"\n by(fastforce dest: weakSimE)\n from PTrans QTrans \\A\\<^sub>R' \\* P\\ \\A\\<^sub>R' \\* Q\\ \\A\\<^sub>R' \\* N\\ have \"A\\<^sub>R' \\* P''\" and \"A\\<^sub>R' \\* Q'\"\n by(blast dest: weakInputFreshChainDerivative inputFreshChainDerivative)+\n\n from PTrans obtain P''' where PChain: \"\\ \\ (p \\ \\\\<^sub>R) \\ P \\\\<^sup>^\\<^sub>\\ P'''\"\n and QimpP''': \"insertAssertion (extractFrame Q) (\\ \\ (p \\ \\\\<^sub>R)) \\\\<^sub>F insertAssertion (extractFrame P''') (\\ \\ (p \\ \\\\<^sub>R))\"\n and P'''Trans: \"\\ \\ (p \\ \\\\<^sub>R) \\ P''' \\(p \\ M)\\N\\ \\ P''\"\n by(rule weakTransitionE)\n \n from PChain \\xvec \\* P\\ \\(p \\ A\\<^sub>R) \\* P\\ \\A\\<^sub>R' \\* P\\ have \"xvec \\* P'''\" and \"(p \\ A\\<^sub>R) \\* P'''\" and \"A\\<^sub>R' \\* P'''\"\n by(force intro: tauChainFreshChain)+\n from P'''Trans \\A\\<^sub>R' \\* P'''\\ \\A\\<^sub>R' \\* N\\ have \"A\\<^sub>R' \\* P''\" by(force dest: inputFreshChainDerivative)\n \n obtain A\\<^sub>P''' \\\\<^sub>P''' where FrP''': \"extractFrame P''' = \\A\\<^sub>P''', \\\\<^sub>P'''\\\" and \"A\\<^sub>P''' \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, p \\ A\\<^sub>R, p \\ \\\\<^sub>R, p \\ M, N, K, R, P''', xvec)\" and \"distinct A\\<^sub>P'''\"\n by(rule freshFrame)\n hence \"A\\<^sub>P''' \\* \\\" and \"A\\<^sub>P''' \\* A\\<^sub>Q\" and \"A\\<^sub>P''' \\* \\\\<^sub>Q\" and \"A\\<^sub>P''' \\* (p \\ M)\" and \"A\\<^sub>P''' \\* R\"\n and \"A\\<^sub>P''' \\* N\" and \"A\\<^sub>P''' \\* K\" and \"A\\<^sub>P''' \\* (p \\ A\\<^sub>R)\" and \"A\\<^sub>P''' \\* P'''\" and \"A\\<^sub>P''' \\* xvec\" and \"A\\<^sub>P''' \\* (p \\ \\\\<^sub>R)\"\n by simp+\n\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ (p \\ \\\\<^sub>R)\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ (p \\ \\\\<^sub>R)) \\ \\\\<^sub>Q\\\" \n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n moreover with QimpP''' FrP''' FrQ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>P''' \\* (p \\ \\\\<^sub>R)\\ \\A\\<^sub>Q \\* \\\\<^sub>R\\ \\A\\<^sub>Q \\* xvec\\ \\(p \\ xvec) \\* A\\<^sub>Q\\ S\n have \"\\A\\<^sub>Q, (\\ \\ (p \\ \\\\<^sub>R)) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ (p \\ \\\\<^sub>R)) \\ \\\\<^sub>P'''\\\" using freshCompChain\n by(simp add: freshChainSimps)\n moreover have \"\\A\\<^sub>P''', (\\ \\ (p \\ \\\\<^sub>R)) \\ \\\\<^sub>P'''\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ (p \\ \\\\<^sub>R)\\\"\n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n ultimately have QImpP''': \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ (p \\ \\\\<^sub>R)\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ (p \\ \\\\<^sub>R)\\\"\n by(rule FrameStatEqImpCompose)\n \n from PChain FrR \\(p \\ A\\<^sub>R) \\* \\\\ \\(p \\ A\\<^sub>R) \\* P\\ have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P''' \\ R\" by(rule tauChainPar1)\n moreover from RTrans FrR P'''Trans MeqK QImpP''' FrP''' FrQ \\distinct A\\<^sub>P'''\\ \\distinct A\\<^sub>R\\ \\A\\<^sub>P''' \\* (p \\ A\\<^sub>R)\\ \\A\\<^sub>Q \\* (p \\ A\\<^sub>R)\\\n \\(p \\ A\\<^sub>R) \\* \\\\ \\(p \\ A\\<^sub>R) \\* P'''\\ \\(p \\ A\\<^sub>R) \\* Q\\ \\(p \\ A\\<^sub>R) \\* R\\ \\(p \\ A\\<^sub>R) \\* K\\ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>P''' \\* R\\\n \\A\\<^sub>P''' \\* P'''\\ \\A\\<^sub>P''' \\* (p \\ M)\\ \\A\\<^sub>Q \\* R\\ \\A\\<^sub>Q \\* (p \\ M)\\ \n obtain K' where \"\\ \\ \\\\<^sub>P''' \\ R \\K'\\\\*xvec\\\\N\\ \\ R'\" and \"\\ \\ \\\\<^sub>P''' \\ (p \\ \\\\<^sub>R) \\ (p \\ M) \\ K'\" and \"(p \\ A\\<^sub>R) \\* K'\"\n by(rule_tac comm1Aux) (assumption | simp)+\n \n with P'''Trans FrP''' have \"\\ \\ P''' \\ R \\\\ \\ \\\\*xvec\\(P'' \\ R')\" using FrR \\(p \\ A\\<^sub>R) \\* \\\\ \\(p \\ A\\<^sub>R) \\* P'''\\ \\(p \\ A\\<^sub>R) \\* R\\\n \\xvec \\* P'''\\ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>P''' \\* P'''\\ \\A\\<^sub>P''' \\* R\\ \\A\\<^sub>P''' \\* (p \\ M)\\ \\(p \\ A\\<^sub>R) \\* K'\\ \\A\\<^sub>P''' \\* (p \\ A\\<^sub>R)\\\n by(rule_tac Comm1)\n \n moreover from P''Chain \\A\\<^sub>R' \\* P''\\ have \"A\\<^sub>R' \\* P'\" by(rule tauChainFreshChain)\n from \\(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\\ have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ \\ \\ \\\\<^sub>R'\"\n by(metis Associativity AssertionStatEqTrans AssertionStatEqSym compositionSym)\n with P''Chain have \"\\ \\ \\\\<^sub>R' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauChainStatEq)\n hence \"\\ \\ P'' \\ R' \\\\<^sup>^\\<^sub>\\ P' \\ R'\" using FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P''\\ by(rule tauChainPar1)\n hence \"\\ \\ \\\\*xvec\\(P'' \\ R') \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" using \\xvec \\* \\\\ by(rule tauChainResChainPres)\n ultimately have \"\\ \\ P \\ R \\\\<^sub>\\ \\\\*xvec\\(P' \\ R')\"\n by(drule_tac tauActTauStepChain) auto\n moreover from P'RelQ' \\(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\\ have \"(\\ \\ \\\\<^sub>R', P', Q') \\ Rel\" by(metis C3 Associativity compositionSym)\n with FrR' \\A\\<^sub>R' \\* P'\\ \\A\\<^sub>R' \\* Q'\\ \\A\\<^sub>R' \\* \\\\ have \"(\\, P' \\ R', Q' \\ R') \\ Rel'\" by(rule_tac C1)\n with \\xvec \\* \\\\ have \"(\\, \\\\*xvec\\(P' \\ R'), \\\\*xvec\\(Q' \\ R')) \\ Rel'\"\n by(rule_tac C2)\n ultimately show ?case by blast\n next\n case(cComm2 \\\\<^sub>R M xvec N Q' A\\<^sub>Q \\\\<^sub>Q K R' A\\<^sub>R)\n have FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n from \\A\\<^sub>Q \\* (P, R)\\ have \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* R\" by simp+\n \n have FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from \\A\\<^sub>R \\* (P, R)\\ have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* R\" by simp+\n from \\xvec \\* (P, R)\\ have \"xvec \\* P\" and \"xvec \\* R\" by simp+\n \n have QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\M\\\\*xvec\\\\N\\ \\ Q'\" and RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\K\\N\\ \\ R'\"\n and MeqK: \"\\ \\ \\\\<^sub>Q \\ \\\\<^sub>R \\ M \\K\" by fact+\n\n from RTrans FrR \\distinct A\\<^sub>R\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* Q'\\ \\A\\<^sub>R \\* N\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* xvec\\ \\A\\<^sub>R \\* K\\\n obtain \\' A\\<^sub>R' \\\\<^sub>R' where ReqR': \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and FrR': \"extractFrame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" \n and \"A\\<^sub>R' \\* \\\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q'\" and \"A\\<^sub>R' \\* N\" and \"A\\<^sub>R' \\* xvec\"\n by(rule_tac C=\"(\\, P, Q', N, xvec)\" and C'=\"(\\, P, Q', N, xvec)\" in expandFrame) auto\n \n have \"\\ \\ \\\\<^sub>R \\ P \\ Q\" by(rule PSimQ')\n \n with QTrans \\xvec \\* \\\\ \\xvec \\* \\\\<^sub>R\\ \\xvec \\* P\\\n obtain P'' P' where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\M\\\\*xvec\\\\N\\ \\ P''\"\n and P''Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\"\n and P'RelQ': \"((\\ \\ \\\\<^sub>R) \\ \\', P', Q') \\ Rel\"\n by(fastforce dest: weakSimE)\n\n from PTrans obtain P''' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P'''\"\n and QimpP''': \"insertAssertion (extractFrame Q) (\\ \\ \\\\<^sub>R) \\\\<^sub>F insertAssertion (extractFrame P''') (\\ \\ \\\\<^sub>R)\"\n and P'''Trans: \"\\ \\ \\\\<^sub>R \\ P''' \\M\\\\*xvec\\\\N\\ \\ P''\"\n by(rule weakTransitionE)\n \n from PChain \\A\\<^sub>R \\* P\\ have \"A\\<^sub>R \\* P'''\" by(rule tauChainFreshChain)\n\n obtain A\\<^sub>P''' \\\\<^sub>P''' where FrP''': \"extractFrame P''' = \\A\\<^sub>P''', \\\\<^sub>P'''\\\" and \"A\\<^sub>P''' \\* (\\, A\\<^sub>Q, \\\\<^sub>Q, A\\<^sub>R, \\\\<^sub>R, M, N, K, R, P''', xvec)\" and \"distinct A\\<^sub>P'''\"\n by(rule freshFrame)\n hence \"A\\<^sub>P''' \\* \\\" and \"A\\<^sub>P''' \\* A\\<^sub>Q\" and \"A\\<^sub>P''' \\* \\\\<^sub>Q\" and \"A\\<^sub>P''' \\* M\" and \"A\\<^sub>P''' \\* R\"\n and \"A\\<^sub>P''' \\* N\" and \"A\\<^sub>P''' \\* K\" and \"A\\<^sub>P''' \\* A\\<^sub>R\" and \"A\\<^sub>P''' \\* P'''\" and \"A\\<^sub>P''' \\* xvec\" and \"A\\<^sub>P''' \\* \\\\<^sub>R\"\n by simp+\n\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\\" \n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n moreover with QimpP''' FrP''' FrQ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>Q \\* \\\\ \\A\\<^sub>P''' \\* \\\\<^sub>R\\ \\A\\<^sub>Q \\* \\\\<^sub>R\\\n have \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'''\\\" using freshCompChain\n by simp\n moreover have \"\\A\\<^sub>P''', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P'''\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ \\\\<^sub>R\\\"\n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n ultimately have QImpP''': \"\\A\\<^sub>Q, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P''', (\\ \\ \\\\<^sub>P''') \\ \\\\<^sub>R\\\"\n by(rule FrameStatEqImpCompose)\n\n from PChain FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ have \"\\ \\ P \\ R \\\\<^sup>^\\<^sub>\\ P''' \\ R\" by(rule tauChainPar1)\n moreover from RTrans FrR P'''Trans MeqK QImpP''' FrP''' FrQ \\distinct A\\<^sub>P'''\\ \\distinct A\\<^sub>R\\ \\A\\<^sub>P''' \\* A\\<^sub>R\\ \\A\\<^sub>Q \\* A\\<^sub>R\\\n \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P'''\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* K\\ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>P''' \\* R\\\n \\A\\<^sub>P''' \\* P'''\\ \\A\\<^sub>P''' \\* M\\ \\A\\<^sub>Q \\* R\\ \\A\\<^sub>Q \\* M\\ \\A\\<^sub>R \\* xvec\\ \\xvec \\* M\\\n obtain K' where \"\\ \\ \\\\<^sub>P''' \\ R \\K'\\N\\ \\ R'\" and \"\\ \\ \\\\<^sub>P''' \\ \\\\<^sub>R \\ M \\ K'\" and \"A\\<^sub>R \\* K'\"\n by(rule_tac comm2Aux) (assumption | simp)+\n \n with P'''Trans FrP''' have \"\\ \\ P''' \\ R \\\\ \\ \\\\*xvec\\(P'' \\ R')\" using FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P'''\\ \\A\\<^sub>R \\* R\\\n \\xvec \\* R\\ \\A\\<^sub>P''' \\* \\\\ \\A\\<^sub>P''' \\* P'''\\ \\A\\<^sub>P''' \\* R\\ \\A\\<^sub>P''' \\* M\\ \\A\\<^sub>R \\* K'\\ \\A\\<^sub>P''' \\* A\\<^sub>R\\\n by(rule_tac Comm2)\n moreover from P'''Trans \\A\\<^sub>R \\* P'''\\ \\A\\<^sub>R \\* xvec\\ \\xvec \\* M\\ \\distinct xvec\\ have \"A\\<^sub>R \\* P''\"\n by(rule_tac outputFreshChainDerivative) auto\n\n from PChain \\A\\<^sub>R' \\* P\\ have \"A\\<^sub>R' \\* P'''\" by(rule tauChainFreshChain)\n with P'''Trans \\xvec \\* M\\ \\distinct xvec\\ have \"A\\<^sub>R' \\* P''\" using \\A\\<^sub>R' \\* xvec\\\n by(rule_tac outputFreshChainDerivative) auto\n \n with P''Chain have \"A\\<^sub>R' \\* P'\" by(rule tauChainFreshChain)\n from \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\ have \"(\\ \\ \\\\<^sub>R) \\ \\' \\ \\ \\ \\\\<^sub>R'\"\n by(metis Associativity AssertionStatEqTrans AssertionStatEqSym compositionSym)\n with P''Chain have \"\\ \\ \\\\<^sub>R' \\ P'' \\\\<^sup>^\\<^sub>\\ P'\" by(rule tauChainStatEq)\n hence \"\\ \\ P'' \\ R' \\\\<^sup>^\\<^sub>\\ P' \\ R'\" using FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P''\\ \n by(rule tauChainPar1)\n hence \"\\ \\ \\\\*xvec\\(P'' \\ R') \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" \n using \\xvec \\* \\\\ by(rule tauChainResChainPres)\n ultimately have \"\\ \\ P \\ R \\\\<^sub>\\ \\\\*xvec\\(P' \\ R')\" by(drule_tac tauActTauStepChain) auto\n moreover from P'RelQ' \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\ have \"(\\ \\ \\\\<^sub>R', P', Q') \\ Rel\" by(metis C3 Associativity compositionSym)\n with FrR' \\A\\<^sub>R' \\* P'\\ \\A\\<^sub>R' \\* Q'\\ \\A\\<^sub>R' \\* \\\\ have \"(\\, P' \\ R', Q' \\ R') \\ Rel'\" by(rule_tac C1)\n with \\xvec \\* \\\\ have \"(\\, \\\\*xvec\\(P' \\ R'), \\\\*xvec\\(Q' \\ R')) \\ Rel'\"\n by(rule_tac C2)\n ultimately show ?case by blast\n qed\nqed\nno_notation relcomp (infixr \"O\" 75)\n\nlemma weakCongSimBangPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Rel' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Rel'' :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes PEqQ: \"Eq P Q\"\n and PRelQ: \"(\\, P, Q) \\ Rel\"\n and \"guarded P\"\n and \"guarded Q\"\n and Rel'Rel: \"Rel' \\ Rel\"\n and FrameParPres: \"\\\\' \\\\<^sub>U S T U A\\<^sub>U. \\(\\' \\ \\\\<^sub>U, S, T) \\ Rel; extractFrame U = \\A\\<^sub>U, \\\\<^sub>U\\; A\\<^sub>U \\* \\'; A\\<^sub>U \\* S; A\\<^sub>U \\* T\\ \\\n (\\', U \\ S, U \\ T) \\ Rel\"\n and C1: \"\\\\' S T U. \\(\\', S, T) \\ Rel; guarded S; guarded T\\ \\ (\\', U \\ !S, U \\ !T) \\ Rel''\"\n and Closed: \"\\\\' S T p. (\\', S, T) \\ Rel \\ ((p::name prm) \\ \\', p \\ S, p \\ T) \\ Rel\"\n and Closed': \"\\\\' S T p. (\\', S, T) \\ Rel' \\ ((p::name prm) \\ \\', p \\ S, p \\ T) \\ Rel'\"\n and StatEq: \"\\\\' S T \\''. \\(\\', S, T) \\ Rel; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel\"\n and StatEq': \"\\\\' S T \\''. \\(\\', S, T) \\ Rel'; \\' \\ \\''\\ \\ (\\'', S, T) \\ Rel'\"\n and Trans: \"\\\\' S T U. \\(\\', S, T) \\ Rel; (\\', T, U) \\ Rel\\ \\ (\\', S, U) \\ Rel\"\n and Trans': \"\\\\' S T U. \\(\\', S, T) \\ Rel'; (\\', T, U) \\ Rel'\\ \\ (\\', S, U) \\ Rel'\"\n and EqSim: \"\\\\' S T. Eq S T \\ \\' \\ S \\\\Rel\\ T\"\n and cSim: \"\\\\' S T. (\\', S, T) \\ Rel \\ \\' \\ S \\ T\"\n and cSym: \"\\\\' S T. (\\', S, T) \\ Rel \\ (\\', T, S) \\ Rel\"\n and cSym': \"\\\\' S T. (\\', S, T) \\ Rel' \\ (\\', T, S) \\ Rel'\"\n and cExt: \"\\\\' S T \\''. (\\', S, T) \\ Rel \\ (\\' \\ \\'', S, T) \\ Rel\"\n and cExt': \"\\\\' S T \\''. (\\', S, T) \\ Rel' \\ (\\' \\ \\'', S, T) \\ Rel'\"\n and ParPres: \"\\\\' S T U. (\\', S, T) \\ Rel \\ (\\', S \\ U, T \\ U) \\ Rel\"\n and ParPres': \"\\\\' S T U. (\\', S, T) \\ Rel' \\ (\\', U \\ S, U \\ T) \\ Rel'\"\n and ParPres2: \"\\\\' S T. Eq S T \\ Eq (S \\ S) (T \\ T)\"\n and ResPres: \"\\\\' S T xvec. \\(\\', S, T) \\ Rel; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel\"\n and ResPres': \"\\\\' S T xvec. \\(\\', S, T) \\ Rel'; xvec \\* \\'\\ \\ (\\', \\\\*xvec\\S, \\\\*xvec\\T) \\ Rel'\"\n and Assoc: \"\\\\' S T U. (\\', S \\ (T \\ U), (S \\ T) \\ U) \\ Rel\"\n and Assoc': \"\\\\' S T U. (\\', S \\ (T \\ U), (S \\ T) \\ U) \\ Rel'\"\n and ScopeExt: \"\\xvec \\' T S. \\xvec \\* \\'; xvec \\* T\\ \\ (\\', \\\\*xvec\\(S \\ T), (\\\\*xvec\\S) \\ T) \\ Rel\"\n and ScopeExt': \"\\xvec \\' T S. \\xvec \\* \\'; xvec \\* T\\ \\ (\\', \\\\*xvec\\(S \\ T), (\\\\*xvec\\S) \\ T) \\ Rel'\"\n and Compose: \"\\\\' S T U O. \\(\\', S, T) \\ Rel; (\\', T, U) \\ Rel''; (\\', U, O) \\ Rel'\\ \\ (\\', S, O) \\ Rel''\"\n and rBangActE: \"\\\\' S \\ S'. \\\\' \\ !S \\\\ \\ S'; guarded S; bn \\ \\* S; \\ \\ \\; bn \\ \\* subject \\\\ \\ \\T. \\' \\ S \\\\ \\ T \\ (\\, S', T \\ !S) \\ Rel'\"\n and rBangTauE: \"\\\\' S S'. \\\\' \\ !S \\\\ \\ S'; guarded S\\ \\ \\T. \\' \\ S \\ S \\\\ \\ T \\ (\\, S', T \\ !S) \\ Rel'\"\n and rBangTauI: \"\\\\' S S'. \\\\' \\ S \\ S \\\\<^sub>\\ S'; guarded S\\ \\ \\T. \\' \\ !S \\\\<^sub>\\ T \\ (\\', T, S' \\ !S) \\ Rel'\"\n shows \"\\ \\ R \\ !P \\\\Rel''\\ R \\ !Q\"\nproof(induct rule: weakCongSimI)\n case(cTau RQ')\n from \\\\ \\ R \\ !Q \\\\ \\ RQ'\\ show ?case\n proof(induct rule: parTauCases[where C=\"(P, Q, R)\"])\n case(cPar1 R' A\\<^sub>Q \\\\<^sub>Q)\n from \\extractFrame (!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\\\ have \"A\\<^sub>Q = []\" and \"\\\\<^sub>Q = SBottom'\" by simp+\n with \\\\ \\ \\\\<^sub>Q \\ R \\\\ \\ R'\\ \\\\\\<^sub>Q = SBottom'\\\n have \"\\ \\ R \\ !P \\\\ \\ (R' \\ !P)\" by(rule_tac Par1) (assumption | simp)+\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ R' \\ !P\" by auto\n moreover from \\(\\, P, Q) \\ Rel\\ have \"(\\, R' \\ !P, R' \\ !Q) \\ Rel''\" using \\guarded P\\ \\guarded Q\\ \n by(rule C1)\n ultimately show ?case by blast\n next\n case(cPar2 Q' A\\<^sub>R \\\\<^sub>R)\n from \\A\\<^sub>R \\* (P, Q, R)\\ have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n have FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n \n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* \\\\<^sub>R\" and \"A\\<^sub>Q \\* A\\<^sub>R\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R)\" in freshFrame) auto\n from FrQ \\guarded Q\\ have \"\\\\<^sub>Q \\ \\\" and \"supp \\\\<^sub>Q = ({}::name set)\" by(blast dest: guardedStatEq)+\n hence \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>Q \\* \\\\<^sub>Q\" by(auto simp add: fresh_star_def fresh_def)\n\n from \\\\ \\ \\\\<^sub>R \\ !Q \\\\ \\ Q'\\ \\guarded Q\\ \n obtain T where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\ Q \\\\ \\ T\" and \"(\\, Q', T \\ !Q) \\ Rel'\" \n by(blast dest: rBangTauE)\n \n from \\Eq P Q\\ have \"Eq (P \\ P) (Q \\ Q)\" by(rule ParPres2)\n with QTrans \n obtain S where PTrans: \"\\ \\ \\\\<^sub>R \\ P \\ P \\\\<^sub>\\ S\" and SRelT: \"(\\ \\ \\\\<^sub>R, S, T) \\ Rel\"\n by(blast dest: EqSim weakCongSimE)\n from PTrans \\guarded P\\ obtain U where PChain: \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ U\" and \"(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel'\"\n by(blast dest: rBangTauI)\n from PChain \\A\\<^sub>R \\* P\\ have \"A\\<^sub>R \\* U\" by(force dest: tauStepChainFreshChain)\n from \\\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ U\\ FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\ have \"\\ \\ R \\ !P \\\\<^sub>\\ R \\ U\"\n by(rule_tac tauStepChainPar2) auto\n moreover from PTrans \\A\\<^sub>R \\* P\\ have \"A\\<^sub>R \\* S\" by(force dest: tauStepChainFreshChain)\n from QTrans \\A\\<^sub>R \\* Q\\ have \"A\\<^sub>R \\* T\" by(force dest: tauFreshChainDerivative)\n have \"(\\, R \\ U, R \\ Q') \\ Rel''\"\n proof -\n from \\(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel'\\ Rel'Rel have \"(\\ \\ \\\\<^sub>R, U, S \\ !P) \\ Rel\"\n by auto\n hence \"(\\, R \\ U, R \\ (S \\ !P)) \\ Rel\" using FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* U\\ \\A\\<^sub>R \\* S\\ \\A\\<^sub>R \\* P\\\n by(rule_tac FrameParPres) auto\n\n moreover from \\(\\ \\ \\\\<^sub>R, S, T) \\ Rel\\ FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* S\\ \\A\\<^sub>R \\* T\\ have \"(\\, R \\ S, R \\ T) \\ Rel\"\n by(rule_tac FrameParPres) auto\n hence \"(\\, R \\ T, R \\ S) \\ Rel\" by(rule cSym)\n hence \"(\\, (R \\ T) \\ !P, (R \\ S) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, (R \\ S) \\ !P, (R \\ T) \\ !P) \\ Rel\" by(rule cSym)\n hence \"(\\, R \\ (S \\ !P), (R \\ T) \\ !P) \\ Rel\" by(metis Trans Assoc)\n ultimately have \"(\\, R \\ U, (R \\ T) \\ !P) \\ Rel\" by(rule Trans)\n moreover from \\(\\, P, Q) \\ Rel\\ have \"(\\, (R \\ T) \\ !P, (R \\ T) \\ !Q) \\ Rel''\" using \\guarded P\\ \\guarded Q\\ by(rule C1)\n moreover from \\(\\, Q', T \\ !Q) \\ Rel'\\ have \"(\\ \\ \\, Q', T \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', T \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity AssertionStatEqSym Commutativity AssertionStatEqTrans)\n hence \"(\\, R \\ Q', R \\ (T \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R \\ Q', (R \\ T) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R \\ T) \\ !Q, R \\ Q') \\ Rel'\" by(rule cSym')\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n next\n case(cComm1 \\\\<^sub>Q M N R' A\\<^sub>R \\\\<^sub>R K xvec Q' A\\<^sub>Q)\n from \\A\\<^sub>R \\* (P, Q, R)\\ have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n from \\xvec \\* (P, Q, R)\\ have \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n have FrQ: \"extractFrame(!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n have FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from \\\\ \\ \\\\<^sub>Q \\ R \\M\\N\\ \\ R'\\ FrR \\distinct A\\<^sub>R\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* N\\ \\A\\<^sub>R \\* xvec\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* M\\\n obtain A\\<^sub>R' \\\\<^sub>R' \\' where FrR': \"extractFrame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" and \"\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\"\n by(rule_tac C=\"(\\, xvec, P, Q)\" and C'=\"(\\, xvec, P, Q)\" in expandFrame) auto\n from \\(\\, P, Q) \\ Rel\\ have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n moreover from \\\\ \\ \\\\<^sub>R \\ !Q \\K\\\\*xvec\\\\N\\ \\ Q'\\ \\guarded Q\\ \\xvec \\* Q\\ \\xvec \\* K\\\n obtain S where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\K\\\\*xvec\\\\N\\ \\ S\" and \"(\\, Q', S \\ !Q) \\ Rel'\"\n by(fastforce dest: rBangActE)\n ultimately obtain P' T where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\K\\\\*xvec\\\\N\\ \\ P'\" and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\\\<^sup>^\\<^sub>\\ T\" and \"((\\ \\ \\\\<^sub>R) \\ \\', T, S) \\ Rel\"\n using \\xvec \\* \\\\ \\xvec \\* \\\\<^sub>R\\ \\xvec \\* P\\\n by(fastforce dest: cSim weakSimE)\n\n from PTrans \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* xvec\\ \\A\\<^sub>R' \\* P\\ \\A\\<^sub>R' \\* xvec\\ \\xvec \\* K\\ \\distinct xvec\\\n have \"A\\<^sub>R \\* P'\" and \"A\\<^sub>R' \\* P'\"\n by(force dest: weakOutputFreshChainDerivative)+\n with P'Chain have \"A\\<^sub>R' \\* T\" by(force dest: tauChainFreshChain)+\n from QTrans \\A\\<^sub>R' \\* Q\\ \\A\\<^sub>R' \\* xvec\\ \\xvec \\* K\\ \\distinct xvec\\ \n have \"A\\<^sub>R' \\* S\" by(force dest: outputFreshChainDerivative)\n\n obtain A\\<^sub>Q' \\\\<^sub>Q' where FrQ': \"extractFrame Q = \\A\\<^sub>Q', \\\\<^sub>Q'\\\" and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* \\\\<^sub>R\" and \"A\\<^sub>Q' \\* A\\<^sub>R\" and \"A\\<^sub>Q' \\* M\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* K\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R, K, M, R)\" in freshFrame) auto\n from FrQ' \\guarded Q\\ have \"\\\\<^sub>Q' \\ \\\" and \"supp \\\\<^sub>Q' = ({}::name set)\" by(blast dest: guardedStatEq)+\n hence \"A\\<^sub>Q' \\* \\\\<^sub>Q'\" by(auto simp add: fresh_star_def fresh_def)\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and NilImpP'': \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F insertAssertion (extractFrame P'') (\\ \\ \\\\<^sub>R)\"\n and P''Trans: \"\\ \\ \\\\<^sub>R \\ P'' \\K\\\\*xvec\\\\N\\ \\ P'\"\n using FrQ' \\A\\<^sub>Q' \\* \\\\ \\A\\<^sub>Q' \\* \\\\<^sub>R\\ freshCompChain\n by(drule_tac weakTransitionE) auto\n\n from PChain have \"\\ \\ R \\ !P \\\\<^sub>\\ \\\\*xvec\\(R' \\ (P' \\ !P))\"\n proof(induct rule: tauChainCases)\n case TauBase\n from \\\\ \\ \\\\<^sub>Q \\ R \\M\\N\\ \\ R'\\ FrQ have \"\\ \\ \\ \\ R \\M\\N\\ \\ R'\" by simp\n moreover note FrR\n moreover from P''Trans \\P = P''\\ have \"\\ \\ \\\\<^sub>R \\ P \\K\\\\*xvec\\\\N\\ \\ P'\" by simp\n hence \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\K\\\\*xvec\\\\N\\ \\ P'\" by(rule statEqTransition) (metis Identity AssertionStatEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using \\xvec \\* \\\\ \\xvec \\* \\\\<^sub>R\\ \\xvec \\* P\\\n by(force intro: Par1)\n hence \"\\ \\ \\\\<^sub>R \\ !P \\K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using \\guarded P\\ by(rule Bang)\n moreover from \\\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\\ FrQ have \"\\ \\ \\\\<^sub>R \\ \\ \\ M \\ K\" by simp\n ultimately have \"\\ \\ R \\ !P \\\\ \\ \\\\*xvec\\(R' \\ (P' \\ !P))\" using \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* M\\ \\xvec \\* R\\\n by(force intro: Comm1)\n thus ?case by(rule tauActTauStepChain)\n next\n case TauStep\n obtain A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* K\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* P\"\n and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"distinct A\\<^sub>P''\"\n by(rule_tac C=\"(\\, K, A\\<^sub>R, \\\\<^sub>R, R, P'', P)\" in freshFrame) auto\n from PChain \\A\\<^sub>R \\* P\\ have \"A\\<^sub>R \\* P''\" by(drule_tac tauChainFreshChain) auto\n with FrP'' \\A\\<^sub>P'' \\* A\\<^sub>R\\ have \"A\\<^sub>R \\* \\\\<^sub>P''\" by(drule_tac extractFrameFreshChain) auto\n from \\\\ \\ \\\\<^sub>R \\ P \\\\<^sub>\\ P''\\ have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\<^sub>\\ P''\" by(rule tauStepChainStatEq) (metis Identity AssertionStatEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\<^sub>\\ P'' \\ !P\" by(rule_tac tauStepChainPar1) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ P'' \\ !P\" using \\guarded P\\ by(rule tauStepChainBang)\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ R \\ (P'' \\ !P)\" using FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\\n by(rule_tac tauStepChainPar2) auto\n moreover have \"\\ \\ R \\ (P'' \\ !P) \\\\ \\ \\\\*xvec\\(R' \\ (P' \\ !P))\"\n proof -\n from FrQ \\\\\\<^sub>Q' \\ \\\\ \\\\ \\ \\\\<^sub>Q \\ R \\M\\N\\ \\ R'\\ have \"\\ \\ \\\\<^sub>Q' \\ R \\M\\N\\ \\ R'\"\n by simp (metis statEqTransition AssertionStatEqSym compositionSym)\n moreover from P''Trans have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P'' \\K\\\\*xvec\\\\N\\ \\ P'\"\n by(rule statEqTransition) (metis Identity AssertionStatEqSym)\n hence P''PTrans: \"\\ \\ \\\\<^sub>R \\ P'' \\ !P \\K\\\\*xvec\\\\N\\ \\ (P' \\ !P)\" using \\xvec \\* P\\\n by(rule_tac Par1) auto\n moreover from FrP'' have FrP''P: \"extractFrame(P'' \\ !P) = \\A\\<^sub>P'', \\\\<^sub>P'' \\ \\\\\"\n by auto\n moreover from FrQ \\\\\\<^sub>Q' \\ \\\\ \\\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\\ have \"\\ \\ \\\\<^sub>Q' \\ \\\\<^sub>R \\ M \\ K\"\n by simp (metis statEqEnt Composition AssertionStatEqSym Commutativity)\n hence \"\\ \\ \\\\<^sub>Q' \\ \\\\<^sub>R \\ K \\ M\" by(rule chanEqSym)\n moreover have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ (\\\\<^sub>P'' \\ \\)) \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\\"\n by(rule_tac frameResChainPres, simp)\n (metis Associativity Commutativity Composition AssertionStatEqTrans AssertionStatEqSym)\n moreover from NilImpP'' FrQ FrP'' \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* \\\\<^sub>R\\ freshCompChain have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\\"\n by auto\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R\\\"\n by(rule frameResChainPres, simp) \n (metis Identity AssertionStatEqSym Associativity Commutativity Composition AssertionStatEqTrans)\n ultimately show ?thesis by(rule FrameStatEqImpCompose)\n qed\n ultimately obtain M' where RTrans: \"\\ \\ \\\\<^sub>P'' \\ \\ \\ R \\M'\\N\\ \\ R'\" and \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ K \\ M'\" and \"A\\<^sub>R \\* M'\"\n using FrR FrQ' \\distinct A\\<^sub>R\\ \\distinct A\\<^sub>P''\\ \\A\\<^sub>P'' \\* A\\<^sub>R\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P''\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* M\\ \\A\\<^sub>Q' \\* R\\ \\A\\<^sub>Q' \\* K\\ \\A\\<^sub>Q' \\* A\\<^sub>R\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>P'' \\* P\\ \\A\\<^sub>R \\* xvec\\\n \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* R\\ \\A\\<^sub>P'' \\* P''\\ \\A\\<^sub>P'' \\* K\\ \\xvec \\* K\\ \\distinct xvec\\\n by(rule_tac A\\<^sub>Q=\"A\\<^sub>Q'\" and Q=\"Q\" in comm2Aux) (assumption | simp)+\n\n note RTrans FrR P''PTrans FrP''P\n moreover from \\\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ K \\ M'\\ have \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ M' \\ K\" by(rule chanEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ \\\\<^sub>P'' \\ \\ \\ M' \\ K\" by(metis statEqEnt Composition AssertionStatEqSym Commutativity)\n ultimately show ?thesis using \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* P''\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* M'\\ \\A\\<^sub>P'' \\* A\\<^sub>R\\ \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* R\\ \\A\\<^sub>P'' \\* P''\\ \\A\\<^sub>P'' \\* P\\ \\A\\<^sub>P'' \\* K\\ \\xvec \\* R\\\n by(rule_tac Comm1) (assumption | simp)+\n qed\n ultimately show ?thesis\n by(drule_tac tauActTauStepChain) auto\n qed\n\n moreover from P'Chain have \"((\\ \\ \\\\<^sub>R) \\ \\') \\ \\ \\ P' \\\\<^sup>^\\<^sub>\\ T\"\n by(rule tauChainStatEq) (metis Identity AssertionStatEqSym)\n hence \"(\\ \\ \\\\<^sub>R) \\ \\' \\ P' \\ !P \\\\<^sup>^\\<^sub>\\ T \\ !P\"\n by(rule_tac tauChainPar1) auto\n hence \"\\ \\ \\\\<^sub>R \\ \\' \\ P' \\ !P \\\\<^sup>^\\<^sub>\\ T \\ !P\"\n by(rule tauChainStatEq) (metis Associativity)\n hence \"\\ \\ \\\\<^sub>R' \\ P' \\ !P\\\\<^sup>^\\<^sub>\\ T \\ !P\" using \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\\n by(rule_tac tauChainStatEq) (auto intro: compositionSym)\n hence \"\\ \\ R' \\ (P' \\ !P) \\\\<^sup>^\\<^sub>\\ R' \\ (T \\ !P)\" using FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P\\ \\A\\<^sub>R' \\* P'\\\n by(rule_tac tauChainPar2) auto\n hence \"\\ \\ \\\\*xvec\\(R' \\ (P' \\ !P)) \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ (T \\ !P))\" using \\xvec \\* \\\\\n by(rule tauChainResChainPres)\n ultimately have \"\\ \\ R \\ !P \\\\<^sub>\\ \\\\*xvec\\(R' \\ (T \\ !P))\"\n by auto\n moreover have \"(\\, \\\\*xvec\\(R' \\ (T \\ !P)), \\\\*xvec\\(R' \\ Q')) \\ Rel''\"\n proof -\n from \\((\\ \\ \\\\<^sub>R) \\ \\', T, S) \\ Rel\\ have \"(\\ \\ \\\\<^sub>R \\ \\', T, S) \\ Rel\"\n by(rule StatEq) (metis Associativity)\n hence \"(\\ \\ \\\\<^sub>R', T, S) \\ Rel\" using \\\\\\<^sub>R \\ \\' \\ \\\\<^sub>R'\\\n by(rule_tac StatEq) (auto dest: compositionSym)\n\n with FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* S\\ \\A\\<^sub>R' \\* T\\ have \"(\\, R' \\ T, R' \\ S) \\ Rel\"\n by(rule_tac FrameParPres) auto\n hence \"(\\, (R' \\ T) \\ !P, (R' \\ S) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, \\\\*xvec\\((R' \\ T) \\ !P), \\\\*xvec\\((R' \\ S) \\ !P)) \\ Rel\" using \\xvec \\* \\\\\n by(rule ResPres)\n hence \"(\\, \\\\*xvec\\(R' \\ T) \\ !P, (\\\\*xvec\\(R' \\ S)) \\ !P) \\ Rel\" using \\xvec \\* \\\\ \\xvec \\* P\\\n by(force intro: Trans ScopeExt)\n hence \"(\\, \\\\*xvec\\(R' \\ (T \\ !P)), (\\\\*xvec\\(R' \\ S)) \\ !P) \\ Rel\" using \\xvec \\* \\\\\n by(force intro: Trans ResPres Assoc)\n\n moreover from \\(\\, P, Q) \\ Rel\\ \\guarded P\\ \\guarded Q\\ have \"(\\, (\\\\*xvec\\(R' \\ S)) \\ !P, (\\\\*xvec\\(R' \\ S)) \\ !Q) \\ Rel''\"\n by(rule C1)\n moreover from \\(\\, Q', S \\ !Q) \\ Rel'\\ have \"(\\ \\ \\, Q', S \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', S \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity AssertionStatEqSym Commutativity AssertionStatEqTrans)\n hence \"(\\, R' \\ Q', R' \\ (S \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R' \\ Q', (R' \\ S) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R' \\ S) \\ !Q, R' \\ Q') \\ Rel'\" by(rule cSym')\n hence \"(\\, \\\\*xvec\\((R' \\ S) \\ !Q), \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using \\xvec \\* \\\\\n by(rule ResPres')\n hence \"(\\, (\\\\*xvec\\(R' \\ S)) \\ !Q, \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using \\xvec \\* \\\\ \\xvec \\* Q\\\n by(force intro: Trans' ScopeExt'[THEN cSym'])\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n next\n case(cComm2 \\\\<^sub>Q M xvec N R' A\\<^sub>R \\\\<^sub>R K Q' A\\<^sub>Q)\n from \\A\\<^sub>R \\* (P, Q, R)\\ have \"A\\<^sub>R \\* P\" and \"A\\<^sub>R \\* Q\" and \"A\\<^sub>R \\* R\" by simp+\n from \\xvec \\* (P, Q, R)\\ have \"xvec \\* P\" and \"xvec \\* Q\" and \"xvec \\* R\" by simp+\n have FrQ: \"extractFrame(!Q) = \\A\\<^sub>Q, \\\\<^sub>Q\\\" by fact\n have FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" by fact\n from \\\\ \\ \\\\<^sub>Q \\ R \\M\\\\*xvec\\\\N\\ \\ R'\\ FrR \\distinct A\\<^sub>R\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* N\\ \\A\\<^sub>R \\* xvec\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* \\\\ \\xvec \\* R\\ \\xvec \\* \\\\ \\xvec \\* P\\ \\xvec \\* Q\\ \\xvec \\* M\\ \\distinct xvec\\ \\A\\<^sub>R \\* M\\\n obtain p A\\<^sub>R' \\\\<^sub>R' \\' where FrR': \"extractFrame R' = \\A\\<^sub>R', \\\\<^sub>R'\\\" and \"(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* P\" and \"A\\<^sub>R' \\* Q\" and \"A\\<^sub>R' \\* \\\" and S: \"set p \\ set xvec \\ set(p \\ xvec)\" and \"distinctPerm p\" and \"(p \\ xvec) \\* N\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* R'\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* \\\" and \"A\\<^sub>R' \\* N\" and \"A\\<^sub>R' \\* xvec\" and \"A\\<^sub>R' \\* (p \\ xvec)\"\n by(rule_tac C=\"(\\, P, Q)\" and C'=\"(\\, P, Q)\" in expandFrame) (assumption | simp)+\n\n from \\\\ \\ \\\\<^sub>Q \\ R \\M\\\\*xvec\\\\N\\ \\ R'\\ S \\(p \\ xvec) \\* N\\ \\(p \\ xvec) \\* R'\\\n have RTrans: \"\\ \\ \\\\<^sub>Q \\ R \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n by(simp add: boundOutputChainAlpha'' residualInject)\n from \\(\\, P, Q) \\ Rel\\ have \"(\\ \\ \\\\<^sub>R, P, Q) \\ Rel\" by(rule cExt)\n moreover from \\\\ \\ \\\\<^sub>R \\ !Q \\K\\N\\ \\ Q'\\ S \\(p \\ xvec) \\* Q\\ \\xvec \\* Q\\ \\distinctPerm p\\\n have \"\\ \\ \\\\<^sub>R \\ !Q \\K\\(p \\ N)\\ \\ (p \\ Q')\" by(rule_tac inputAlpha) auto\n then obtain S where QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\K\\(p \\ N)\\ \\ S\" and \"(\\, (p \\ Q'), S \\ !Q) \\ Rel'\" \n using \\guarded Q\\\n by(fastforce dest: rBangActE)\n ultimately obtain P' T where PTrans: \"\\ \\ \\\\<^sub>R : Q \\ P \\K\\(p \\ N)\\ \\ P'\" \n and P'Chain: \"(\\ \\ \\\\<^sub>R) \\ (p \\ \\') \\ P' \\\\<^sup>^\\<^sub>\\ T\" \n and \"((\\ \\ \\\\<^sub>R) \\ (p \\ \\'), T, S) \\ Rel\"\n by(fastforce dest: cSim weakSimE)\n\n from \\A\\<^sub>R' \\* N\\ \\A\\<^sub>R' \\* xvec\\ \\A\\<^sub>R' \\* (p \\ xvec)\\ S have \"A\\<^sub>R' \\* (p \\ N)\"\n by(simp add: freshChainSimps)\n with PTrans \\A\\<^sub>R' \\* P\\ have \"A\\<^sub>R' \\* P'\" by(force dest: weakInputFreshChainDerivative)\n with P'Chain have \"A\\<^sub>R' \\* T\" by(force dest: tauChainFreshChain)+\n from QTrans \\A\\<^sub>R' \\* Q\\ \\A\\<^sub>R' \\* (p \\ N)\\ have \"A\\<^sub>R' \\* S\" by(force dest: inputFreshChainDerivative)\n\n obtain A\\<^sub>Q' \\\\<^sub>Q' where FrQ': \"extractFrame Q = \\A\\<^sub>Q', \\\\<^sub>Q'\\\" and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* \\\\<^sub>R\" and \"A\\<^sub>Q' \\* A\\<^sub>R\" and \"A\\<^sub>Q' \\* M\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* K\"\n by(rule_tac C=\"(\\, \\\\<^sub>R, A\\<^sub>R, K, M, R)\" in freshFrame) auto\n from FrQ' \\guarded Q\\ have \"\\\\<^sub>Q' \\ \\\" and \"supp \\\\<^sub>Q' = ({}::name set)\" by(blast dest: guardedStatEq)+\n hence \"A\\<^sub>Q' \\* \\\\<^sub>Q'\" by(auto simp add: fresh_star_def fresh_def)\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>R \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and NilImpP'': \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F insertAssertion (extractFrame P'') (\\ \\ \\\\<^sub>R)\"\n and P''Trans: \"\\ \\ \\\\<^sub>R \\ P'' \\K\\(p \\ N)\\ \\ P'\"\n using FrQ' \\A\\<^sub>Q' \\* \\\\ \\A\\<^sub>Q' \\* \\\\<^sub>R\\ freshCompChain\n by(drule_tac weakTransitionE) auto\n\n from \\(p \\ xvec) \\* P\\ \\xvec \\* P\\ PChain have \"(p \\ xvec) \\* P''\" and \"xvec \\* P''\" \n by(force dest: tauChainFreshChain)+\n from \\(p \\ xvec) \\* N\\ \\distinctPerm p\\ have \"xvec \\* (p \\ N)\"\n by(subst pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst, where pi=p, symmetric]) simp\n with P''Trans \\xvec \\* P''\\ have \"xvec \\* P'\" by(force dest: inputFreshChainDerivative)\n hence \"(p \\ xvec) \\* (p \\ P')\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n\n from PChain have \"\\ \\ R \\ !P \\\\<^sub>\\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\"\n proof(induct rule: tauChainCases)\n case TauBase\n from RTrans FrQ have \"\\ \\ \\ \\ R \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\" by simp\n moreover note FrR\n moreover from P''Trans \\P = P''\\ have \"\\ \\ \\\\<^sub>R \\ P \\K\\(p \\ N)\\\\ P'\" by simp\n hence \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\K\\(p \\ N)\\ \\ P'\" \n by(rule statEqTransition) (metis Identity AssertionStatEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\K\\(p \\ N)\\ \\ (P' \\ !P)\" by(force intro: Par1)\n hence \"\\ \\ \\\\<^sub>R \\ !P \\K\\(p \\ N)\\ \\ (P' \\ !P)\" using \\guarded P\\ by(rule Bang)\n moreover from \\\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\\ FrQ have \"\\ \\ \\\\<^sub>R \\ \\ \\ M \\ K\" by simp\n ultimately have \"\\ \\ R \\ !P \\\\ \\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\" using \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* M\\ \\(p \\ xvec) \\* P\\\n by(force intro: Comm2)\n thus ?case by(rule tauActTauStepChain)\n next\n case TauStep\n obtain A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* K\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* P\"\n and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"distinct A\\<^sub>P''\"\n by(rule_tac C=\"(\\, K, A\\<^sub>R, \\\\<^sub>R, R, P'', P)\" in freshFrame) auto\n from PChain \\A\\<^sub>R \\* P\\ have \"A\\<^sub>R \\* P''\" by(drule_tac tauChainFreshChain) auto\n with FrP'' \\A\\<^sub>P'' \\* A\\<^sub>R\\ have \"A\\<^sub>R \\* \\\\<^sub>P''\" by(drule_tac extractFrameFreshChain) auto\n from \\\\ \\ \\\\<^sub>R \\ P \\\\<^sub>\\ P''\\ have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P \\\\<^sub>\\ P''\" by(rule tauStepChainStatEq) (metis Identity AssertionStatEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ P \\ !P \\\\<^sub>\\ P'' \\ !P\" by(rule_tac tauStepChainPar1) auto\n hence \"\\ \\ \\\\<^sub>R \\ !P \\\\<^sub>\\ P'' \\ !P\" using \\guarded P\\ by(rule tauStepChainBang)\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ R \\ (P'' \\ !P)\" using FrR \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P\\\n by(rule_tac tauStepChainPar2) auto\n moreover have \"\\ \\ R \\ (P'' \\ !P) \\\\ \\ \\\\*(p \\ xvec)\\((p \\ R') \\ (P' \\ !P))\"\n proof -\n from FrQ \\\\\\<^sub>Q' \\ \\\\ RTrans have \"\\ \\ \\\\<^sub>Q' \\ R \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\"\n by simp (metis statEqTransition AssertionStatEqSym compositionSym)\n moreover from P''Trans have \"(\\ \\ \\\\<^sub>R) \\ \\ \\ P'' \\K\\(p \\ N)\\ \\ P'\"\n by(rule statEqTransition) (metis Identity AssertionStatEqSym)\n hence P''PTrans: \"\\ \\ \\\\<^sub>R \\ P'' \\ !P \\K\\(p \\ N)\\ \\ (P' \\ !P)\"\n by(rule_tac Par1) auto\n moreover from FrP'' have FrP''P: \"extractFrame(P'' \\ !P) = \\A\\<^sub>P'', \\\\<^sub>P'' \\ \\\\\"\n by auto\n moreover from FrQ \\\\\\<^sub>Q' \\ \\\\ \\\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\\ have \"\\ \\ \\\\<^sub>Q' \\ \\\\<^sub>R \\ M \\ K\"\n by simp (metis statEqEnt Composition AssertionStatEqSym Commutativity)\n hence \"\\ \\ \\\\<^sub>Q' \\ \\\\<^sub>R \\ K \\ M\" by(rule chanEqSym)\n moreover have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ (\\\\<^sub>P'' \\ \\)) \\ \\\\<^sub>R\\\"\n proof -\n have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>Q') \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\\"\n by(rule_tac frameResChainPres, simp)\n (metis Associativity Commutativity Composition AssertionStatEqTrans AssertionStatEqSym)\n moreover from NilImpP'' FrQ FrP'' \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* \\\\<^sub>R\\ freshCompChain have \"\\A\\<^sub>Q', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q'\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\\"\n by auto\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R\\\"\n by(rule frameResChainPres, simp) \n (metis Identity AssertionStatEqSym Associativity Commutativity Composition AssertionStatEqTrans)\n ultimately show ?thesis by(rule FrameStatEqImpCompose)\n qed\n ultimately obtain M' where RTrans: \"\\ \\ \\\\<^sub>P'' \\ \\ \\ R \\M'\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ R')\" and \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ K \\ M'\" and \"A\\<^sub>R \\* M'\"\n using FrR FrQ' \\distinct A\\<^sub>R\\ \\distinct A\\<^sub>P''\\ \\A\\<^sub>P'' \\* A\\<^sub>R\\ \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* P''\\ \\A\\<^sub>R \\* Q\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* M\\ \\A\\<^sub>Q' \\* R\\ \\A\\<^sub>Q' \\* K\\ \\A\\<^sub>Q' \\* A\\<^sub>R\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>P'' \\* P\\\n \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* R\\ \\A\\<^sub>P'' \\* P''\\ \\A\\<^sub>P'' \\* K\\\n by(rule_tac A\\<^sub>Q=\"A\\<^sub>Q'\" and Q=\"Q\" in comm1Aux) (assumption | simp)+\n\n note RTrans FrR P''PTrans FrP''P\n moreover from \\\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ K \\ M'\\ have \"\\ \\ (\\\\<^sub>P'' \\ \\) \\ \\\\<^sub>R \\ M' \\ K\" by(rule chanEqSym)\n hence \"\\ \\ \\\\<^sub>R \\ \\\\<^sub>P'' \\ \\ \\ M' \\ K\" by(metis statEqEnt Composition AssertionStatEqSym Commutativity)\n ultimately show ?thesis using \\A\\<^sub>R \\* \\\\ \\A\\<^sub>R \\* R\\ \\A\\<^sub>R \\* P''\\ \\A\\<^sub>R \\* P\\ \\A\\<^sub>R \\* M'\\ \\A\\<^sub>P'' \\* A\\<^sub>R\\ \\A\\<^sub>P'' \\* \\\\ \\A\\<^sub>P'' \\* R\\ \\A\\<^sub>P'' \\* P''\\ \\A\\<^sub>P'' \\* P\\ \\A\\<^sub>P'' \\* K\\ \\(p \\ xvec) \\* P''\\ \\(p \\ xvec) \\* P\\\n by(rule_tac Comm2) (assumption | simp)+\n qed\n ultimately show ?thesis\n by(drule_tac tauActTauStepChain) auto\n qed\n hence \"\\ \\ R \\ !P \\\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ P') \\ !P))\" \n using \\xvec \\* P\\ \\(p \\ xvec) \\* P\\ \\(p \\ xvec) \\* (p \\ P')\\ \\(p \\ xvec) \\* R'\\ S \\distinctPerm p\\\n by(subst resChainAlpha[where p=p]) auto\n moreover from P'Chain have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\'))) \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\"\n by(rule tauChainEqvt)\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ S \\distinctPerm p\\\n have \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\" by(simp add: eqvts)\n hence \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\') \\ \\ \\ (p \\ P') \\\\<^sup>^\\<^sub>\\ (p \\ T)\"\n by(rule tauChainStatEq) (metis Identity AssertionStatEqSym)\n hence \"(\\ \\ (p \\ \\\\<^sub>R)) \\ \\' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\"\n by(rule_tac tauChainPar1) auto\n hence \"\\ \\ (p \\ \\\\<^sub>R) \\ \\' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\"\n by(rule tauChainStatEq) (metis Associativity)\n hence \"\\ \\ \\\\<^sub>R' \\ (p \\ P') \\ !P \\\\<^sup>^\\<^sub>\\ (p \\ T) \\ !P\" using \\(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\\\n by(rule_tac tauChainStatEq) (auto intro: compositionSym)\n hence \"\\ \\ R' \\ ((p \\ P') \\ !P) \\\\<^sup>^\\<^sub>\\ R' \\ ((p \\ T) \\ !P)\" \n using FrR' \\A\\<^sub>R' \\* \\\\ \\A\\<^sub>R' \\* P\\ \\A\\<^sub>R' \\* P'\\ \\A\\<^sub>R' \\* xvec\\ \\A\\<^sub>R' \\* (p \\ xvec)\\ S\n by(rule_tac tauChainPar2) (auto simp add: freshChainSimps)\n hence \"\\ \\ \\\\*xvec\\(R' \\ ((p \\ P') \\ !P)) \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ T) \\ !P))\" using \\xvec \\* \\\\\n by(rule tauChainResChainPres)\n ultimately have \"\\ \\ R \\ !P \\\\<^sub>\\ \\\\*xvec\\(R' \\ ((p \\ T) \\ !P))\"\n by auto\n moreover have \"(\\, \\\\*xvec\\(R' \\ ((p \\ T) \\ !P)), \\\\*xvec\\(R' \\ Q')) \\ Rel''\"\n proof -\n from \\((\\ \\ \\\\<^sub>R) \\ (p \\ \\'), T, S) \\ Rel\\ \n have \"(p \\ ((\\ \\ \\\\<^sub>R) \\ (p \\ \\')), (p \\ T), (p \\ S)) \\ Rel\"\n by(rule Closed)\n with \\xvec \\* \\\\ \\(p \\ xvec) \\* \\\\ \\distinctPerm p\\ S\n have \"((\\ \\ (p \\ \\\\<^sub>R)) \\ \\', p \\ T, p \\ S) \\ Rel\"\n by(simp add: eqvts)\n hence \"(\\ \\ (p \\ \\\\<^sub>R) \\ \\', p \\ T, p \\ S) \\ Rel\"\n by(rule StatEq) (metis Associativity)\n hence \"(\\ \\ \\\\<^sub>R', p \\ T, p \\ S) \\ Rel\" using \\(p \\ \\\\<^sub>R) \\ \\' \\ \\\\<^sub>R'\\\n by(rule_tac StatEq) (auto dest: compositionSym)\n moreover from \\A\\<^sub>R' \\* S\\ \\A\\<^sub>R' \\* T\\ \\A\\<^sub>R' \\* xvec\\ \\A\\<^sub>R' \\* (p \\ xvec)\\ S\n have \"A\\<^sub>R' \\* (p \\ S)\" and \"A\\<^sub>R' \\* (p \\ T)\"\n by(simp add: freshChainSimps)+\n ultimately have \"(\\, R' \\ (p \\ T), R' \\ (p \\ S)) \\ Rel\" using FrR' \\A\\<^sub>R' \\* \\\\\n by(rule_tac FrameParPres) auto\n hence \"(\\, (R' \\ (p \\ T)) \\ !P, (R' \\ (p \\ S)) \\ !P) \\ Rel\" by(rule ParPres)\n hence \"(\\, \\\\*xvec\\((R' \\ (p \\ T)) \\ !P), \\\\*xvec\\((R' \\ (p \\ S)) \\ !P)) \\ Rel\" \n using \\xvec \\* \\\\\n by(rule ResPres)\n hence \"(\\, \\\\*xvec\\(R' \\ (p \\ T)) \\ !P, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P) \\ Rel\" \n using \\xvec \\* \\\\ \\xvec \\* P\\\n by(force intro: Trans ScopeExt)\n hence \"(\\, \\\\*xvec\\(R' \\ ((p \\ T) \\ !P)), (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P) \\ Rel\"\n using \\xvec \\* \\\\\n by(force intro: Trans ResPres Assoc)\n moreover from \\(\\, P, Q) \\ Rel\\ \\guarded P\\ \\guarded Q\\ \n have \"(\\, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !P, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !Q) \\ Rel''\"\n by(rule C1)\n moreover from \\(\\, (p \\ Q'), S \\ !Q) \\ Rel'\\ \n have \"(p \\ \\, p \\ p \\ Q', p \\ (S \\ !Q)) \\ Rel'\" by(rule Closed')\n with \\xvec \\* Q\\ \\(p \\ xvec) \\* Q\\ S \\distinctPerm p\\ \n have \"(\\, Q', (p \\ S) \\ !Q) \\ Rel'\" by(simp add: eqvts)\n hence \"(\\ \\ \\, Q', (p \\ S) \\ !Q) \\ Rel'\" by(rule cExt')\n hence \"(\\, Q', (p \\ S) \\ !Q) \\ Rel'\" \n by(rule StatEq') (metis Identity AssertionStatEqSym Commutativity AssertionStatEqTrans)\n hence \"(\\, R' \\ Q', R' \\ ((p \\ S) \\ !Q)) \\ Rel'\" by(rule ParPres')\n hence \"(\\, R' \\ Q', (R' \\ (p \\ S)) \\ !Q) \\ Rel'\" by(metis Trans' Assoc')\n hence \"(\\, (R' \\ (p \\ S)) \\ !Q, R' \\ Q') \\ Rel'\" by(rule cSym')\n hence \"(\\, \\\\*xvec\\((R' \\ (p \\ S)) \\ !Q), \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using \\xvec \\* \\\\\n by(rule ResPres')\n hence \"(\\, (\\\\*xvec\\(R' \\ (p \\ S))) \\ !Q, \\\\*xvec\\(R' \\ Q')) \\ Rel'\" using \\xvec \\* \\\\ \\xvec \\* Q\\\n by(force intro: Trans' ScopeExt'[THEN cSym'])\n ultimately show ?thesis by(rule_tac Compose)\n qed\n ultimately show ?case by blast\n qed\nqed\nnotation relcomp (infixr \"O\" 75)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weak_Cong_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.25523478461707483}} {"text": "section {*L\\_ATS\\_Simulation\\_Configuration\\_WeakLR\\_Marked\\_Effect*}\ntheory\n L_ATS_Simulation_Configuration_WeakLR_Marked_Effect\n\nimports\n L_ATS_Simulation_Configuration_WeakLR_Marking_Condition\n\nbegin\n\nlocale ATS_Simulation_Configuration_Weak_Marked_Effect =\n ATS_Simulation_Configuration_WeakLR_Marking_Condition\n \"TSstructure1 :: 'TSstructure1 \\ bool\"\n \"configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"initial_configurations1 :: 'TSstructure1 \\ 'conf1 set\"\n \"step_labels1 :: 'TSstructure1 \\ 'label1 set\"\n \"step_relation1 :: 'TSstructure1 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ bool\"\n \"effects1 :: 'TSstructure1 \\ 'event1 set\"\n \"marking_condition1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ bool\"\n \"marked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"unmarked_effect1 :: 'TSstructure1 \\ ('label1,'conf1)derivation \\ 'event1 set\"\n \"TSstructure2 :: 'TSstructure2 \\ bool\"\n \"configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"initial_configurations2 :: 'TSstructure2 \\ 'conf2 set\"\n \"step_labels2 :: 'TSstructure2 \\ 'label2 set\"\n \"step_relation2 :: 'TSstructure2 \\ 'conf2 \\ 'label2 \\ 'conf2 \\ bool\"\n \"effects2 :: 'TSstructure2 \\ 'event2 set\"\n \"marking_condition2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ bool\"\n \"marked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"unmarked_effect2 :: 'TSstructure2 \\ ('label2,'conf2)derivation \\ 'event2 set\"\n \"relation_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_initial_configuration :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'conf2 \\ bool\"\n \"relation_effect :: 'TSstructure1 \\ 'TSstructure2 \\ 'event1 \\ 'event2 \\ bool\"\n \"relation_TSstructure :: 'TSstructure1 \\ 'TSstructure2 \\ bool\"\n \"relation_initial_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n \"relation_step_simulation :: 'TSstructure1 \\ 'TSstructure2 \\ 'conf1 \\ 'label1 \\ 'conf1 \\ 'conf2 \\ (nat \\ ('label2, 'conf2) derivation_configuration option) \\ bool\"\n for\n TSstructure1 configurations1 initial_configurations1 step_labels1 step_relation1 effects1 marking_condition1 marked_effect1 unmarked_effect1 TSstructure2 configurations2 initial_configurations2 step_labels2 step_relation2 effects2 marking_condition2 marked_effect2 unmarked_effect2 relation_configuration relation_initial_configuration relation_effect relation_TSstructure relation_initial_simulation relation_step_simulation\n +\n\nassumes AX_relation_step_simulation_preserves_marked_effect: \"\n relation_step_simulation_preservation G1 G2 d1' d2'\n \\ left_total_on\n (relation_effect G1 G2)\n (marked_effect1 G1 d1')\n (marked_effect2 G2 d2')\"\n\nassumes AX_relation_initial_simulation_preserves_marked_effect: \"\n relation_initial_simulation_preservation G1 G2 d1' d2'\n \\ left_total_on\n (relation_effect G1 G2)\n (marked_effect1 G1 d1')\n (marked_effect2 G2 d2')\"\n\ncontext ATS_Simulation_Configuration_Weak_Marked_Effect begin\n\ntheorem ATS_Simulation_Configuration_Weak_Marked_Effect_sound: \"\n relation_TSstructure G1 G2\n \\ left_total_on (relation_effect G1 G2) (GL.finite_marked_language G1) (GR.finite_marked_language G2)\"\n apply(simp add: left_total_on_def)\n apply(clarsimp)\n apply(rename_tac a)(*strict*)\n apply(simp add: GL.finite_marked_language_def)\n apply(clarsimp)\n apply(rename_tac a d x)(*strict*)\n apply(case_tac x)\n apply(rename_tac a d x)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d)(*strict*)\n apply(subgoal_tac \"\\c. d 0 = Some (pair None c)\")\n apply(rename_tac a d)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c)(*strict*)\n apply(rename_tac c1)\n apply(rename_tac a d c1)(*strict*)\n apply(subgoal_tac \"c1 \\ initial_configurations1 G1\")\n apply(rename_tac a d c1)(*strict*)\n prefer 2\n apply(simp add: GL.derivation_initial_def)\n apply(rename_tac a d c1)(*strict*)\n apply(subgoal_tac \"\\d2 n. GR.derivation_initial G2 d2 \\ relation_initial_configuration G1 G2 c1 (the(get_configuration(d2 0))) \\ relation_initial_simulation G1 G2 c1 d2 \\ maximum_of_domain d2 n \\ relation_configuration G1 G2 c1 (the(get_configuration(d2 n)))\")\n apply(rename_tac a d c1)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation)\n apply(rename_tac a d c1)(*strict*)\n apply(force)\n apply(rename_tac a d c1)(*strict*)\n apply(force)\n apply(rename_tac a d c1)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 d2 n)(*strict*)\n apply(subgoal_tac \"\\c2. d2 0 = Some (pair None c2)\")\n apply(rename_tac a d c1 d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 (derivation_append (der1 c1) (der1 c1) 0)) (marked_effect2 G2 (derivation_append (der1 (the(get_configuration(d2 0)))) d2 0))\")\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation_preserves_marked_effect)\n apply(rule_tac\n ?d1.0=\"der1 c1\"\n and ?d2.0=\"der1 (the(get_configuration(d2 0)))\"\n and ?n1.0=\"0\"\n and ?n2.0=\"0\"\n and ds=\"d2\"\n and f=\"\\x. n\"\n in relation_initial_simulation_preservation_PROVE)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 13\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 12\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: GL.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule GL.der1_is_derivation)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: GR.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule GR.der1_is_derivation)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n t=\"derivation_append (der1 c1) (der1 c1) 0\"\n and s=\"der1 c1\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n t=\"derivation_append (der1 (the (get_configuration (d2 0)))) d2 0\"\n and s=\"d2\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def get_configuration_def der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(clarsimp)\n apply(simp add: simulating_derivation_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: simulating_derivation_I_def)\n apply(simp add: der1_def)\n apply(simp add: get_configuration_def)\n apply(rule_tac\n t=\"derivation_take d2 n\"\n and s=\"d2\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_take_def)\n apply(clarsimp)\n apply(rule sym)\n apply(rule GR.none_position_after_max_dom)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: simulating_derivation_S_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: simulating_derivation_DEF_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: get_configuration_def der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 d) (marked_effect2 G2 d2)\")\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"d\"\n and s=\"derivation_append (der1 c1) (der1 c1) 0\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def)\n apply(clarsimp)\n apply (metis GL.derivation_initial_is_derivation GL.noSomeAfterMaxDom)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n t=\"d2\"\n and s=\"derivation_append (der1 (the (get_configuration (Some (pair None c2))))) d2 0\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(thin_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 (derivation_append (der1 c1) (der1 c1) 0)) (marked_effect2 G2 (derivation_append (der1 (the (get_configuration (d2 0)))) d2 0))\")\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(subgoal_tac \"marking_condition2 G2 (derivation_append SSderi2 d2 0)\" for SSderi2)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_initial_simulation_preserves_marking_condition)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n ds=\"d2\"\n and ?d1.0=\"der1 c1\"\n and ?d2.0=\"der1 (the(get_configuration(d2 0)))\"\n and ?n1.0=\"0\"\n and ?n2.0=\"0\"\n and f=\"\\x. n\"\n in relation_initial_simulation_preservation_PROVE)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 12\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 12\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: GL.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule GL.der1_is_derivation)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: GR.derivation_initial_def)\n apply(rule conjI)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule GR.der1_is_derivation)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule der1_maximum_of_domain)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n t=\"Some (pair None c2)\"\n and s=\"d2 0\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule simulating_derivation_exist_initial)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule_tac\n t=\"(derivation_append (der1 c1) (der1 c1) 0)\"\n and s=\"d\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def)\n apply(clarsimp)\n apply(rule sym)\n apply(rule GL.none_position_after_max_dom)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(subgoal_tac \"marking_condition2 G2 d2\")\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"d2\"\n and s=\"derivation_append (der1 (the (get_configuration (Some (pair None c2))))) d2 0\"\n in ssubst)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d c1 d2 n c2 x)(*strict*)\n apply(simp add: derivation_append_def der1_def get_configuration_def)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(thin_tac \"marking_condition2 G2 (derivation_append (der1 (the (get_configuration (Some (pair None c2))))) d2 0)\")\n apply(simp add: left_total_on_def)\n apply(erule_tac\n x=\"a\"\n in ballE)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d c1 d2 n c2 b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in bexI)\n apply(rename_tac a d c1 d2 n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n c2 b)(*strict*)\n apply(simp add: GR.finite_marked_language_def)\n apply(rule_tac\n x=\"d2\"\n in exI)\n apply(clarsimp)\n apply(force)\n apply(rename_tac a d c1 d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d c1 d2 n)(*strict*)\n apply (metis GR.derivation_initial_is_derivation GR.some_position_has_details_at_0)\n apply(rename_tac a d)(*strict*)\n apply (metis GL.derivation_initial_is_derivation GL.some_position_has_details_at_0)\n apply(rename_tac a d x nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d nat)(*strict*)\n apply(rename_tac x)\n apply(rename_tac a d x)(*strict*)\n apply(subgoal_tac \"\\e1 e2 c1 c2. d x = Some (pair e1 c1) \\ d (Suc x) = Some (pair (Some e2) c2) \\ step_relation1 G1 c1 e2 c2\")\n apply(rename_tac a d x)(*strict*)\n prefer 2\n apply(rule_tac\n m=\"Suc x\"\n in GL.step_detail_before_some_position)\n apply(rename_tac a d x)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x)(*strict*)\n apply(simp add: maximum_of_domain_def)\n apply(rename_tac a d x)(*strict*)\n apply(force)\n apply(rename_tac a d x)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e1 e2 c1 c2)(*strict*)\n apply(rename_tac e0 e1 c1 c1')\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(subgoal_tac \"\\deri2 deri2n f. GR.derivation_initial G2 deri2 \\ maximum_of_domain deri2 deri2n \\ relation_initial_configuration G1 G2 (the(get_configuration(d 0))) (the(get_configuration(deri2 0))) \\ relation_configuration G1 G2 c1 (the(get_configuration(deri2 deri2n))) \\ simulating_derivation G1 G2 d x deri2 deri2n f\")\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n prefer 2\n apply(rule ATS_Simulation_Configuration_Weak_simulation_derivation_exists_witness)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1')(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n xa)(*strict*)\n apply(rename_tac f)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(subgoal_tac \"\\e c. deri2 deri2n = Some (pair e c)\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c)(*strict*)\n apply(rename_tac c2)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply(subgoal_tac \"\\d2 n. GR.derivation G2 d2 \\ GR.belongs G2 d2 \\ the(get_configuration(d2 0)) = c2 \\ relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\ maximum_of_domain d2 n \\ relation_configuration G1 G2 c1' (the(get_configuration(d2 n)))\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n)(*strict*)\n apply(subgoal_tac \"\\c2. d2 0 = Some (pair None c2)\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 (derivation_append (derivation_take d x) (der2 c1 e1 c1') x)) (marked_effect2 G2 (derivation_append deri2 d2 deri2n))\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation_preserves_marked_effect)\n apply(rule_tac\n f=\"\\a. if a \\ x then f a else f x + n\"\n in relation_step_simulation_preservation_PROVE)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply (metis GL.derivation_take_preserves_derivation_initial)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply (metis GL.derivationNoFromNone GL.derivation_initial_is_derivation maximum_of_domain_derivation_take)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: get_configuration_def derivation_take_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def derivation_take_def der2_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule simulating_derivation_exist_step)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)+\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(subgoal_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 d) (marked_effect2 G2 (derivation_append deri2 d2 deri2n))\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 2\n apply(rule_tac\n t=\"d\"\n and s=\"(derivation_append (derivation_take d x) (der2 c1 e1 c1') x)\"\n in ssubst)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(simp add: derivation_append_def derivation_take_def der2_def)\n apply(case_tac \"xa-x\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(subgoal_tac \"Suc x=xa\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n apply(subgoal_tac \"xa=x+Suc(Suc nata)\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(rule GL.none_position_after_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(thin_tac \"left_total_on (relation_effect G1 G2) (marked_effect1 G1 (derivation_append (derivation_take d x) (der2 c1 e1 c1') x)) (marked_effect2 G2 (derivation_append deri2 d2 deri2n))\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(subgoal_tac \"marking_condition2 G2 (derivation_append deri2 d2 deri2n)\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 2\n apply(rule AX_relation_step_simulation_preserves_marking_condition)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule_tac\n ?d1.0=\"derivation_take d x\"\n and ?d2.0=\"deri2\"\n and ?n1.0=\"x\"\n and ?n2.0=\"deri2n\"\n and f=\"\\a. if a \\ x then f a else f x + n\"\n in relation_step_simulation_preservation_PROVE)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 14\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 3\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 2\n apply (metis GL.belongs_step_labels GL.derivation_initial_belongs AX_TSstructure_relation_TSstructure1_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply (metis GL.derivation_take_preserves_derivation_initial)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply (metis GL.derivationNoFromNone GL.derivation_initial_is_derivation maximum_of_domain_derivation_take)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: get_configuration_def derivation_take_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def derivation_take_def der2_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: derivation_append_fit_def get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule_tac\n t=\"derivation_append (derivation_take d x) (der2 c1 e1 c1') x\"\n and s=\"d\"\n in ssubst)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(simp add: derivation_append_def derivation_take_def der2_def)\n apply(case_tac \"xa-x\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(case_tac nat)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(subgoal_tac \"Suc x=xa\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nat nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n apply(subgoal_tac \"xa=x+Suc(Suc nata)\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa nata)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(rule sym)\n apply(rule GL.none_position_after_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nata)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule_tac\n t=\"d\"\n and s=\"(derivation_append (derivation_take d x) (der2 c1 e1 c1') x)\"\n in ssubst)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(simp add: der2_def derivation_take_def derivation_append_def)\n apply(rule conjI)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"xa=Suc x\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"\\a. x+Suc a=xa\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n prefer 2\n apply(rule_tac\n x=\"xa-x-Suc 0\"\n in exI)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 aa)(*strict*)\n apply(case_tac aa)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 aa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 aa nat)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat)(*strict*)\n apply(case_tac \"d (Suc (Suc (x + nat)))\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat aa)(*strict*)\n apply(rule_tac\n m=\"(Suc (Suc (x + nat)))\"\n and d=\"d\"\n in GL.no_some_beyond_maximum_of_domain)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat aa)(*strict*)\n apply(simp add: GL.derivation_initial_def)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat aa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat aa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 nat aa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule simulating_derivation_exist_step)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule_tac\n t=\"(derivation_append (derivation_take d x) (der2 c1 e1 c1') x)\"\n and s=\"d\"\n in ssubst)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(rule ext)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(simp add: derivation_take_def derivation_append_def der1_def der2_def)\n apply(rule conjI)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(subgoal_tac \"xa=Suc x\")\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n prefer 2\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(clarsimp)\n apply(rule sym)\n apply(rule GL.none_position_after_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(rule GL.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 xa)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(simp add: left_total_on_def)\n apply(erule_tac\n x=\"a\"\n in ballE)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(clarsimp)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(rule_tac\n x=\"b\"\n in bexI)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(simp add: GR.finite_marked_language_def)\n apply(rule_tac\n x=\"derivation_append deri2 d2 deri2n\"\n in exI)\n apply(clarsimp)\n apply(rule context_conjI)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation_initial)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply (metis AX_TSstructure_relation_TSstructure2_belongs)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(rule GR.derivation_append_preserves_derivation)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(clarsimp)\n apply(simp add: get_configuration_def)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2 b)(*strict*)\n apply(rule_tac\n x=\"deri2n+n\"\n in exI)\n apply (metis concat_has_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n c2)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f e d2 n)(*strict*)\n apply (metis GR.some_position_has_details_at_0)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(rule GR.some_position_has_details_before_max_dom)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(rule GR.derivation_initial_is_derivation)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(force)\n apply(rename_tac a d x e0 e1 c1 c1' deri2 deri2n f)(*strict*)\n apply(force)\n done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Simulation_Configuration_WeakLR_Marked_Effect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.2551992413172257}} {"text": "section\\The Needham-Schroeder Public-Key Protocol against the General Attacker\\\n\ntheory NS_Public_Bad_GA imports PublicGA begin\n\ninductive_set ns_public :: \"event list set\"\n where\n\n Nil: \"[] \\ ns_public\"\n\n | Fake: \"\\evsf \\ ns_public; X \\ synth (analz (knows A evsf))\\\n \\ Says A B X # evsf \\ ns_public\"\n\n | Reception: \"\\ evsr \\ ns_public; Says A B X \\ set evsr \\\n \\ Gets B X # evsr \\ ns_public\"\n\n | NS1: \"\\evs1 \\ ns_public; Nonce NA \\ used evs1\\\n \\ Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\)\n # evs1 \\ ns_public\"\n\n | NS2: \"\\evs2 \\ ns_public; Nonce NB \\ used evs2;\n Gets B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs2\\\n \\ Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\)\n # evs2 \\ ns_public\"\n\n | NS3: \"\\evs3 \\ ns_public;\n Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs3;\n Gets A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs3\\\n \\ Says A B (Crypt (pubEK B) (Nonce NB)) # evs3 \\ ns_public\"\n\n\nlemma NS_no_Notes:\n \"evs \\ ns_public \\ Notes A X \\ set evs\"\napply (erule ns_public.induct)\napply (simp_all)\ndone\n\ntext\\Confidentiality treatment in separate theory file\\\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Inductive_Confidentiality/GeneralAttacker/NS_Public_Bad_GA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832804, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.2551640048848337}} {"text": "(* Title: Service_Matrix.thy\n Authors: Cornelius Diekmann, Max Haslbeck\n*)\n(*IPPartitioning.thy\n Original Author: Max Haslbeck, 2015*)\nsection\\Service Matrices\\\ntheory Service_Matrix\nimports \"Common/List_Product_More\"\n \"Common/IP_Partition_Preliminaries\"\n \"Common/GroupF\"\n \"Common/IP_Addr_WordInterval_toString\"\n \"Primitives/Primitives_toString\"\n \"SimpleFw_Semantics\"\n \"../IP_Addresses/WordInterval_Sorted\"\nbegin\n\n\nsubsection\\IP Address Space Partition\\\n\n(* could be generalized more *)\nfun extract_IPSets_generic0\n :: \"('i::len simple_match \\ 'i word \\ nat) \\ 'i simple_rule list \\ ('i wordinterval) list\"\n where\n \"extract_IPSets_generic0 _ [] = []\" |\n \"extract_IPSets_generic0 sel ((SimpleRule m _)#ss) = (ipcidr_tuple_to_wordinterval (sel m)) #\n (extract_IPSets_generic0 sel ss)\"\n\nlemma extract_IPSets_generic0_length: \"length (extract_IPSets_generic0 sel rs) = length rs\"\n by(induction rs rule: extract_IPSets_generic0.induct) (simp_all)\n\n\n(*\nThe order in which extract_IPSets returns the collected IP ranges heavily influences the running time\nof the subsequent algorithms.\nFor example:\n1) iterating through the ruleset and collecting all source and destination ips:\n 10:10:49 elapsed time, 38:41:17 cpu time, factor 3.80\n2) iterating through the ruleset and first returning all source ips and iterating again and then return all destination ips:\n 3:39:56 elapsed time, 21:08:34 cpu time, factor 5.76\n\nTo get a more deterministic runtime, we are sorting the output. As a performance optimization, we also remove duplicate entries.\nWe use mergesort_remdups, which does a mergesort (i.e sorts!) and removes duplicates and mergesort_by_rel which does a mergesort\n(without removing duplicates) and allows to specify the relation we use to sort.\nIn theory, the largest ip ranges (smallest prefix length) should be put first, the following evaluation shows that this may not\nbe the fastest solution. The reason might be that access_matrix_pretty_ipv4 picks (almost randomly) one IP from the result and\nthere are fast and slower choices. The faster choices are the ones where the firewall ruleset has a decision very early. \nTherefore, the running time is still a bit unpredictable.\n\nHere is the data:\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs))))\n (2:47:04 elapsed time, 17:08:01 cpu time, factor 6.15)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_remdups ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs)))\n (2:41:03 elapsed time, 16:56:46 cpu time, factor 6.31)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs)))\n (5:52:28 elapsed time, 41:50:10 cpu time, factor 7.12)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (op \\)\n ((map (src \\ match_sel) rs) @ (map (dst \\ match_sel) rs))))\n (3:10:57 elapsed time, 19:12:25 cpu time, factor 6.03)\n\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups\n (extract_src_dst_ips rs [])))\n (2:49:57 elapsed time, 17:10:49 cpu time, factor 6.06)\n\nmap ipcidr_tuple_to_wordinterval ((mergesort_remdups (extract_src_dst_ips rs [])))\n (2:43:44 elapsed time, 16:57:49 cpu time, factor 6.21)\n\nmap ipcidr_tuple_to_wordinterval (mergesort_by_rel (\\ (a1,a2) (b1, b2). (a2, a1) \\ (b2, b1)) (mergesort_remdups (extract_src_dst_ips rs [])))\n (2:47:37 elapsed time, 16:54:47 cpu time, factor 6.05)\n\nThere is a clear looser: not using mergesort_remdups\nThere is no clear winner. We will just stick to mergesort_remdups.\n\n*)\n\n(*check the the order of mergesort_remdups did not change*)\nlemma \"mergesort_remdups [(1::ipv4addr, 2::nat), (8,0), (8,1), (2,2), (2,4), (1,2), (2,2)] =\n [(1, 2), (2, 2), (2, 4), (8, 0), (8, 1)]\" by eval\n\n\n(*a tail-recursive implementation*)\nfun extract_src_dst_ips\n :: \"'i::len simple_rule list \\ ('i word \\ nat) list \\ ('i word \\ nat) list\" where\n \"extract_src_dst_ips [] ts = ts\" |\n \"extract_src_dst_ips ((SimpleRule m _)#ss) ts = extract_src_dst_ips ss (src m # dst m # ts)\"\n\nlemma extract_src_dst_ips_length: \"length (extract_src_dst_ips rs acc) = 2*length rs + length acc\"\nproof(induction rs arbitrary: acc)\ncase (Cons r rs) thus ?case by(cases r, simp)\nqed(simp)\n\ndefinition extract_IPSets\n :: \"'i::len simple_rule list \\ ('i wordinterval) list\" where\n \"extract_IPSets rs \\ map ipcidr_tuple_to_wordinterval (mergesort_remdups (extract_src_dst_ips rs []))\"\nlemma extract_IPSets:\n \"set (extract_IPSets rs) = set (extract_IPSets_generic0 src rs) \\ set (extract_IPSets_generic0 dst rs)\"\nproof -\n { fix acc\n have \"ipcidr_tuple_to_wordinterval ` set (extract_src_dst_ips rs acc) =\n ipcidr_tuple_to_wordinterval ` set acc \\ set (extract_IPSets_generic0 src rs) \\\n set (extract_IPSets_generic0 dst rs)\"\n proof(induction rs arbitrary: acc)\n case (Cons r rs ) thus ?case\n apply(cases r)\n apply(simp)\n by fast\n qed(simp)\n } thus ?thesis unfolding extract_IPSets_def by(simp_all add: extract_IPSets_def mergesort_remdups_correct)\nqed\n\nlemma \"(a::nat) div 2 + a mod 2 \\ a\" by fastforce\n\nlemma merge_length: \"length (merge l1 l2) \\ length l1 + length l2\"\nby(induction l1 l2 rule: merge.induct) auto\n\nlemma merge_list_length: \"length (merge_list as ls) \\ length (concat (as @ ls))\"\nproof(induction as ls rule: merge_list.induct)\ncase (5 l1 l2 acc2 ls)\n have \"length (merge l2 acc2) \\ length l2 + length acc2\" using merge_length by blast\n with 5 show ?case by simp\nqed(simp_all)\n\nlemma mergesort_remdups_length: \"length (mergesort_remdups as) \\ length as\"\nunfolding mergesort_remdups_def\nproof -\n have \"concat ([] @ (map (\\x. [x]) as)) = as\" by simp\n with merge_list_length show \"length (merge_list [] (map (\\x. [x]) as)) \\ length as\" by metis\nqed\n\nlemma extract_IPSets_length: \"length (extract_IPSets rs) \\ 2 * length rs\"\napply(simp add: extract_IPSets_def)\nusing extract_src_dst_ips_length mergesort_remdups_length by (metis add.right_neutral list.size(3)) \n\n\n(*\nexport_code extract_IPSets in SML\nwhy you no work?\n*)\n\n\nlemma extract_equi0:\n \"set (map wordinterval_to_set (extract_IPSets_generic0 sel rs)) =\n (\\(base,len). ipset_from_cidr base len) ` sel ` match_sel ` set rs\"\n proof(induction rs)\n case (Cons r rs) thus ?case\n apply(cases r, simp)\n using wordinterval_to_set_ipcidr_tuple_to_wordinterval by fastforce\n qed(simp)\n\nlemma src_ipPart_motivation:\nfixes rs\ndefines \"X \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs\"\nassumes \"\\A \\ X. B \\ A \\ B \\ A = {}\" and \"s1 \\ B\" and \"s2 \\ B\"\nshows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\"\nproof -\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\ ?thesis\"\n proof(induction rs)\n case Nil thus ?case by simp\n next\n case (Cons r rs)\n { fix m\n from \\s1 \\ B\\ \\s2 \\ B\\ have \n \"B \\ (case src m of (x, xa) \\ ipset_from_cidr x xa) \\ B \\ (case src m of (x, xa) \n \\ ipset_from_cidr x xa) = {} \\\n simple_matches m (p\\p_src := s1\\) \\ simple_matches m (p\\p_src := s2\\)\"\n apply(cases m)\n apply(rename_tac iiface oiface srca dst proto sports dports)\n apply(case_tac srca)\n apply(simp add: simple_matches.simps)\n by blast\n } note helper=this\n from Cons[simplified] show ?case\n apply(cases r, rename_tac m a)\n apply(simp)\n apply(case_tac a)\n using helper apply force+\n done\n qed\n with assms show ?thesis by blast\nqed\n\n \nlemma src_ipPart:\n assumes \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 src rs))) A\"\n \"B \\ A\" \"s1 \\ B\" \"s2 \\ B\"\n shows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\"\nproof -\n from src_ipPart_motivation[OF _ assms(3) assms(4)]\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` src ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\\n simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\)\" by fast\n thus ?thesis using assms(1) assms(2)\n unfolding ipPartition_def\n by (metis (full_types) Int_commute extract_equi0)\nqed\n \n(*basically a copy of src_ipPart*)\nlemma dst_ipPart:\n assumes \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 dst rs))) A\"\n \"B \\ A\" \"s1 \\ B\" \"s2 \\ B\"\n shows \"simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\nproof -\n have \"\\A \\ (\\(base,len). ipset_from_cidr base len) ` dst ` match_sel ` set rs. B \\ A \\ B \\ A = {} \\\n simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\n proof(induction rs)\n case Nil thus ?case by simp\n next\n case (Cons r rs)\n { fix m\n from \\s1 \\ B\\ \\s2 \\ B\\ have\n \"B \\ (case dst m of (x, xa) \\ ipset_from_cidr x xa) \\ B \\ (case dst m of (x, xa) \n \\ ipset_from_cidr x xa) = {} \\\n simple_matches m (p\\p_dst := s1\\) \\ simple_matches m (p\\p_dst := s2\\)\"\n apply(cases m)\n apply(rename_tac iiface oiface src dsta proto sports dports)\n apply(case_tac dsta)\n apply(simp add: simple_matches.simps)\n by blast\n } note helper=this\n from Cons show ?case\n apply(simp)\n apply(case_tac r, rename_tac m a)\n apply(simp)\n apply(case_tac a)\n using helper apply force+\n done\n qed\n thus ?thesis using assms(1) assms(2)\n unfolding ipPartition_def\n by (metis (full_types) Int_commute extract_equi0)\nqed\n\n\n\n(* OPTIMIZED PARTITIONING *)\n\ndefinition wordinterval_list_to_set :: \"'a::len wordinterval list \\ 'a::len word set\" where\n \"wordinterval_list_to_set ws = \\ set (map wordinterval_to_set ws)\"\n\nlemma wordinterval_list_to_set_compressed:\n \"wordinterval_to_set (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)) =\n wordinterval_list_to_set xs\"\n proof(induction xs)\n qed(simp_all add: wordinterval_compress wordinterval_list_to_set_def)\n\nfun partIps :: \"'a::len wordinterval \\ 'a::len wordinterval list \n \\ 'a::len wordinterval list\" where\n \"partIps _ [] = []\" |\n \"partIps s (t#ts) = (if wordinterval_empty s then (t#ts) else\n (if wordinterval_empty (wordinterval_intersection s t)\n then (t#(partIps s ts))\n else\n (if wordinterval_empty (wordinterval_setminus t s)\n then (t#(partIps (wordinterval_setminus s t) ts))\n else (wordinterval_intersection t s)#((wordinterval_setminus t s)#\n (partIps (wordinterval_setminus s t) ts)))))\"\n\n\nlemma \"partIps (WordInterval (1::ipv4addr) 1) [WordInterval 0 1] = [WordInterval 1 1, WordInterval 0 0]\" by eval\n\nlemma partIps_length: \"length (partIps s ts) \\ (length ts) * 2\"\nproof(induction ts arbitrary: s)\ncase Cons thus ?case \n apply(simp)\n using le_Suc_eq by blast\nqed(simp)\n\nfun partitioningIps :: \"'a::len wordinterval list \\ 'a::len wordinterval list \\\n 'a::len wordinterval list\" where\n \"partitioningIps [] ts = ts\" |\n \"partitioningIps (s#ss) ts = partIps s (partitioningIps ss ts)\"\n\n\nlemma partitioningIps_length: \"length (partitioningIps ss ts) \\ (2^length ss) * length ts\"\nproof(induction ss)\ncase Nil thus ?case by simp\nnext\ncase (Cons s ss)\n have \"length (partIps s (partitioningIps ss ts)) \\ length (partitioningIps ss ts) * 2\"\n using partIps_length by fast\n with Cons show ?case by force\nqed\n\nlemma partIps_equi: \"map wordinterval_to_set (partIps s ts) = \n partList4 (wordinterval_to_set s) (map wordinterval_to_set ts)\"\n proof(induction ts arbitrary: s)\n qed(simp_all)\n\nlemma partitioningIps_equi: \"map wordinterval_to_set (partitioningIps ss ts)\n = (partitioning1 (map wordinterval_to_set ss) (map wordinterval_to_set ts))\"\n apply(induction ss arbitrary: ts)\n apply(simp; fail)\n apply(simp add: partIps_equi)\n done\n\n \ndefinition getParts :: \"'i::len simple_rule list \\ 'i wordinterval list\" where\n \"getParts rs = partitioningIps (extract_IPSets rs) [wordinterval_UNIV]\"\n\nlemma partitioningIps_foldr: \"partitioningIps ss ts = foldr partIps ss ts\"\n by(induction ss) (simp_all)\n\nlemma getParts_foldr: \"getParts rs = foldr partIps (extract_IPSets rs) [wordinterval_UNIV]\"\n by(simp add: getParts_def partitioningIps_foldr)\n\nlemma getParts_length: \"length (getParts rs) \\ 2^(2 * length rs)\"\nproof -\n from partitioningIps_length[where ss=\"extract_IPSets rs\" and ts=\"[wordinterval_UNIV]\"] have\n 1: \"length (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]) \\ 2 ^ length (extract_IPSets rs)\" by simp\n from extract_IPSets_length have \"(2::nat) ^ length (extract_IPSets rs) \\ 2 ^ (2 * length rs)\" by simp\n with 1 have \"length (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]) \\ 2 ^ (2 * length rs)\" by linarith\n thus ?thesis by(simp add: getParts_def) \nqed\n\nlemma getParts_ipPartition: \"ipPartition (set (map wordinterval_to_set (extract_IPSets rs)))\n (set (map wordinterval_to_set (getParts rs)))\"\nproof -\n have hlp_rule: \"{} \\ set (map wordinterval_to_set ts) \\ disjoint_list (map wordinterval_to_set ts) \\ \n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\ \n ipPartition (set (map wordinterval_to_set ss)) \n (set (map wordinterval_to_set (partitioningIps ss ts)))\" for ts ss::\"'a wordinterval list\"\n by (metis ipPartitioning_helper_opt partitioningIps_equi wordinterval_list_to_set_def)\n have \"disjoint_list [UNIV]\" by(simp add: disjoint_list_def disjoint_def)\n have \"ipPartition (set (map wordinterval_to_set ss)) \n (set (map wordinterval_to_set (partitioningIps ss [wordinterval_UNIV])))\"\n for ss::\"'a wordinterval list\"\n apply(rule hlp_rule)\n apply(simp_all add: wordinterval_list_to_set_def \\disjoint_list [UNIV]\\)\n done\n thus ?thesis\n unfolding getParts_def by blast\nqed\n\n\nlemma getParts_complete: \"wordinterval_list_to_set (getParts rs) = UNIV\"\n proof -\n have \"{} \\ set (map wordinterval_to_set ts) \\\n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\ \n wordinterval_list_to_set (partitioningIps ss ts) = (wordinterval_list_to_set ts)\"\n for ss ts::\"'a wordinterval list\"\n using complete_helper by (metis partitioningIps_equi wordinterval_list_to_set_def)\n hence \"wordinterval_list_to_set (getParts rs) = wordinterval_list_to_set [wordinterval_UNIV]\"\n unfolding getParts_def by(simp add: wordinterval_list_to_set_def)\n also have \"\\ = UNIV\" by (simp add: wordinterval_list_to_set_def)\n finally show ?thesis .\nqed\n\ntheorem getParts_samefw: \n assumes \"A \\ set (map wordinterval_to_set (getParts rs))\" \"s1 \\ A\" \"s2 \\ A\" \n shows \"simple_fw rs (p\\p_src:=s1\\) = simple_fw rs (p\\p_src:=s2\\) \\\n simple_fw rs (p\\p_dst:=s1\\) = simple_fw rs (p\\p_dst:=s2\\)\"\nproof -\n let ?X=\"(set (map wordinterval_to_set (getParts rs)))\"\n from getParts_ipPartition have \"ipPartition (set (map wordinterval_to_set (extract_IPSets rs))) ?X\" .\n hence \"ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 src rs))) ?X \\\n ipPartition (set (map wordinterval_to_set (extract_IPSets_generic0 dst rs))) ?X\"\n by(simp add: extract_IPSets ipPartitionUnion image_Un)\n thus ?thesis using assms dst_ipPart src_ipPart by blast\nqed\n\n\nlemma partIps_nonempty: \"ts \\ [] \\ partIps s ts \\ []\"\n by(induction ts arbitrary: s) simp_all\nlemma partitioningIps_nonempty: \"ts \\ [] \\ partitioningIps ss ts \\ []\"\nproof(induction ss arbitrary: ts)\n case Nil thus ?case by simp\n next\n case (Cons s ss) thus ?case\n apply(cases ts)\n apply(simp; fail)\n apply(simp)\n using partIps_nonempty by blast\nqed\n\n(*\nlemma partIps_nonempty: \"\\t \\ set ts. \\ wordinterval_empty t \n \\ {} \\ set (map wordinterval_to_set (partIps s ts))\"\n apply(induction ts arbitrary: s)\n apply(simp; fail)\n apply(simp)\n by blast\n*)\n\nlemma getParts_nonempty: \"getParts rs \\ []\" by(simp add: getParts_def partitioningIps_nonempty)\nlemma getParts_nonempty_elems: \"\\w\\set (getParts rs). \\ wordinterval_empty w\"\n unfolding getParts_def\n proof -\n have partitioning_nonempty: \"\\t \\ set ts. \\ wordinterval_empty t \\\n {} \\ set (map wordinterval_to_set (partitioningIps ss ts))\"\n for ts ss::\"'a wordinterval list\"\n proof(induction ss arbitrary: ts)\n case Nil thus ?case by auto\n case Cons thus ?case by (simp add: partIps_equi partList4_empty)\n qed\n have \"\\t \\ set [wordinterval_UNIV].\\ wordinterval_empty t\" by(simp)\n with partitioning_nonempty have\n \"{} \\ set (map wordinterval_to_set (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]))\" \n by blast\n thus \"\\w\\set (partitioningIps (extract_IPSets rs) [wordinterval_UNIV]). \\ wordinterval_empty w\" by auto\n qed\n\n(* HELPER FUNCTIONS UNIFICATION *)\n\nfun getOneIp :: \"'a::len wordinterval \\ 'a::len word\" where\n \"getOneIp (WordInterval b _) = b\" |\n \"getOneIp (RangeUnion r1 r2) = (if wordinterval_empty r1 then getOneIp r2\n else getOneIp r1)\"\n\nlemma getOneIp_elem: \"\\ wordinterval_empty W \\ wordinterval_element (getOneIp W) W\"\n by (induction W) simp_all\n\nrecord parts_connection = pc_iiface :: string\n pc_oiface :: string\n pc_proto :: primitive_protocol\n pc_sport :: \"16 word\"\n pc_dport :: \"16 word\"\n\n\n\n(* SAME FW DEFINITIONS AND PROOFS *)\n\n\n\ndefinition same_fw_behaviour :: \"(*'pkt_ext itself \\*) 'i::len word \\ 'i word \\ 'i simple_rule list \\ bool\" where\n \"same_fw_behaviour (*TYPE('pkt_ext)*) a b rs \\\n \\(p:: 'i::len simple_packet).\n simple_fw rs (p\\p_src:=a\\) = simple_fw rs (p\\p_src:=b\\) \\\n simple_fw rs (p\\p_dst:=a\\) = simple_fw rs (p\\p_dst:=b\\)\"\n\nlemma getParts_same_fw_behaviour:\n \"A \\ set (map wordinterval_to_set (getParts rs)) \\ s1 \\ A \\ s2 \\ A \\ \n same_fw_behaviour s1 s2 rs\"\n unfolding same_fw_behaviour_def\n using getParts_samefw by blast\n\ndefinition \"runFw s d c rs = simple_fw rs \\p_iiface=pc_iiface c,p_oiface=pc_oiface c,\n p_src=s,p_dst=d,\n p_proto=pc_proto c,\n p_sport=pc_sport c,p_dport=pc_dport c,\n p_tcp_flags={TCP_SYN},\n p_payload=''''\\\"\n\ntext{*We use @{const runFw} for executable code, but in general, everything applies to generic packets*}\ndefinition runFw_scheme :: \"'i::len word \\ 'i word \\ 'b parts_connection_scheme \\\n ('i, 'a) simple_packet_scheme \\ 'i simple_rule list \\ state\"\n where\n\"runFw_scheme s d c p rs = simple_fw rs\n (p\\p_iiface:=pc_iiface c,\n p_oiface:=pc_oiface c,\n p_src:=s,\n p_dst:=d,\n p_proto:=pc_proto c,\n p_sport:=pc_sport c,\n p_dport:=pc_dport c\\)\"\n\nlemma runFw_scheme: \"runFw s d c rs = runFw_scheme s d c p rs\"\n apply(simp add: runFw_def runFw_scheme_def)\n apply(case_tac p)\n apply(simp)\n apply(thin_tac _, simp)\nproof(induction rs)\n case Nil thus ?case by(simp; fail)\nnext\n case(Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r) simp\n from simple_matches_extended_packet[symmetric, of _ \"pc_iiface c\" \"pc_oiface c\"\n s d \"pc_proto c\" \"pc_sport c\" \"pc_dport c\" _ _ _ \"{TCP_SYN}\" \"[]\"]\n have pext: \"simple_matches m\n \\p_iiface = pc_iiface c, p_oiface = pc_oiface c, p_src = s, p_dst = d, p_proto = pc_proto c, p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = tcp_flags2, p_payload = payload2, \\ = aux\\ =\n simple_matches m\n \\p_iiface = pc_iiface c, p_oiface = pc_oiface c, p_src = s, p_dst = d, p_proto = pc_proto c, p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = {TCP_SYN}, p_payload = []\\\" for tcp_flags2 payload2 and aux::'c by fast\n show ?case\n apply(simp add: r, cases a, simp)\n using Cons.IH by(simp add: pext)+\nqed \n\n\nlemma has_default_policy_runFw: \"has_default_policy rs \\ runFw s d c rs = Decision FinalAllow \\ runFw s d c rs = Decision FinalDeny\"\n by(simp add: runFw_def has_default_policy)\n\ndefinition same_fw_behaviour_one :: \"'i::len word \\ 'i word \\ 'a parts_connection_scheme \\ 'i simple_rule list \\ bool\" where\n \"same_fw_behaviour_one ip1 ip2 c rs \\\n \\d s. runFw ip1 d c rs = runFw ip2 d c rs \\ runFw s ip1 c rs = runFw s ip2 c rs\"\n\n\n\ntext\\Is an equivalence relation\\\nlemma same_fw_behaviour_one_equi:\n \"same_fw_behaviour_one x x c rs\"\n \"same_fw_behaviour_one x y c rs = same_fw_behaviour_one y x c rs\"\n \"same_fw_behaviour_one x y c rs \\ same_fw_behaviour_one y z c rs \\ same_fw_behaviour_one x z c rs\"\n unfolding same_fw_behaviour_one_def by metis+\n\nlemma same_fw_behaviour_equi:\n \"same_fw_behaviour x x rs\"\n \"same_fw_behaviour x y rs = same_fw_behaviour y x rs\"\n \"same_fw_behaviour x y rs \\ same_fw_behaviour y z rs \\ same_fw_behaviour x z rs\"\n unfolding same_fw_behaviour_def by auto\n\nlemma runFw_sameFw_behave: \n fixes W :: \"'i::len word set set\"\n shows\n \"\\A \\ W. \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs \\ \\ W = UNIV \\\n \\B \\ W. \\b \\ B. runFw ip1 b c rs = runFw ip2 b c rs \\\n \\B \\ W. \\b \\ B. runFw b ip1 c rs = runFw b ip2 c rs \\\n same_fw_behaviour_one ip1 ip2 c rs\"\nproof -\n assume a1: \"\\A \\ W. \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs\"\n and a2: \"\\ W = UNIV \"\n and a3: \"\\B \\ W. \\b \\ B. runFw ip1 b c rs = runFw ip2 b c rs\"\n and a4: \"\\B \\ W. \\b \\ B. runFw b ip1 c rs = runFw b ip2 c rs\"\n\n \n have relation_lem: \"\\D \\ W. \\d1 \\ D. \\d2 \\ D. \\s. f s d1 = f s d2 \\ \\ W = UNIV \\\n \\B \\ W. \\b \\ B. f s1 b = f s2 b \\\n f s1 d = f s2 d\" for W and f::\"'c \\ 'b \\ 'd\" and s1 d s2\n by (metis UNIV_I Union_iff)\n\n from a1 have a1':\"\\A\\W. \\a1\\A. \\a2\\A. \\s. runFw s a1 c rs = runFw s a2 c rs\"\n unfolding same_fw_behaviour_one_def by fast\n from relation_lem[OF a1' a2 a3] have s1: \"\\ d. runFw ip1 d c rs = runFw ip2 d c rs\" by simp\n\n from a1 have a1'':\"\\A\\W. \\a1\\A. \\a2\\A. \\d. runFw a1 d c rs = runFw a2 d c rs\"\n unfolding same_fw_behaviour_one_def by fast\n from relation_lem[OF a1'' a2 a4] have s2: \"\\ s. runFw s ip1 c rs = runFw s ip2 c rs\" by simp\n from s1 s2 show \"same_fw_behaviour_one ip1 ip2 c rs\"\n unfolding same_fw_behaviour_one_def by fast\nqed\n\nlemma sameFw_behave_sets:\n \"\\w\\set A. \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs \\\n \\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs \\\n \\w1\\set A. \\w2\\set A.\n \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n assume a1: \"\\w\\set A. \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs\" and\n \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n from this have \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n using same_fw_behaviour_one_equi(3) by metis\n from a1 this show \"\\w1\\set A. \\w2\\set A. \\a1\\w1. \\a2\\w2. same_fw_behaviour_one a1 a2 c rs\"\n using same_fw_behaviour_one_equi(3) by metis\nqed\n \n\n\n\ndefinition groupWIs :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs c rs = (let W = getParts rs in \n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp W))) in\n groupF f W))\"\n\n\n\nlemma groupWIs_not_empty: \"groupWIs c rs \\ []\"\n proof -\n have \"getParts rs \\ []\" by(simp add: getParts_def partitioningIps_nonempty)\n with groupF_empty have \"\\f. groupF f (getParts rs) \\ []\" by blast\n thus ?thesis by(simp add: groupWIs_def Let_def) blast\n qed\nlemma groupWIs_not_empty_elem: \"V \\ set (groupWIs c rs) \\ V \\ []\"\n by(simp add: groupWIs_def Let_def groupF_empty_elem)\nlemma groupWIs_not_empty_elems: \n assumes V: \"V \\ set (groupWIs c rs)\" and w: \"w \\ set V\"\n shows \"\\ wordinterval_empty w\"\n proof -\n have \"\\w\\set (concat (groupWIs c rs)). \\ wordinterval_empty w\"\n apply(subst groupWIs_def)\n apply(subst Let_def)+\n apply(subst groupF_concat_set)\n using getParts_nonempty_elems by blast\n from this V w show ?thesis by auto\n qed\n\nlemma groupParts_same_fw_wi0:\n assumes \"V \\ set (groupWIs c rs)\"\n shows \"\\w \\ set (map wordinterval_to_set V). \\a1 \\ w. \\a2 \\ w. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n have \"\\A\\set (map wordinterval_to_set (concat (groupWIs c rs))). \n \\a1\\A. \\a2\\A. same_fw_behaviour_one a1 a2 c rs\"\n apply(subst groupWIs_def)\n apply(subst Let_def)+\n apply(subst set_map)\n apply(subst groupF_concat_set)\n using getParts_same_fw_behaviour same_fw_spec by fastforce\n from this assms show ?thesis by force\nqed\n\nlemma groupWIs_same_fw_not: \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n A \\ B \\\n \\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\nproof -\n assume asm: \"A \\ set (groupWIs c rs)\" \"B \\ set (groupWIs c rs)\" \"A \\ B\"\n from this have b1: \"\\aw \\ set A. \\bw \\ set B.\n (map (\\d. runFw (getOneIp aw) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp aw) c rs) (map getOneIp (getParts rs))) \\\n (map (\\d. runFw (getOneIp bw) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp bw) c rs) (map getOneIp (getParts rs)))\"\n apply(simp add: groupWIs_def Let_def)\n using groupF_nequality by fastforce\n have same_behave_runFw_not:\n \"(map (\\d. runFw x1 d c rs) W, map (\\s. runFw s x1 c rs) W) \\\n (map (\\d. runFw x2 d c rs) W, map (\\s. runFw s x2 c rs) W) \\\n \\ same_fw_behaviour_one x1 x2 c rs\" for x1 x2 W\n by (simp add: same_fw_behaviour_one_def) (blast)\n have \"\\C \\ set (groupWIs c rs). \\c \\ set C. getOneIp c \\ wordinterval_to_set c\"\n apply(simp add: groupWIs_def Let_def)\n using getParts_nonempty_elems groupF_set getOneIp_elem by fastforce\n from this b1 asm have\n \"\\aw \\ set (map wordinterval_to_set A). \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. (map (\\d. runFw a d c rs) (map getOneIp (getParts rs)), map (\\s. runFw s a c rs) (map getOneIp (getParts rs))) \\\n (map (\\d. runFw b d c rs) (map getOneIp (getParts rs)), map (\\s. runFw s b c rs) (map getOneIp (getParts rs)))\"\n by (simp) (blast)\n from this same_behave_runFw_not asm\n have \" \\aw \\ set (map wordinterval_to_set A). \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\" by fast\n from this groupParts_same_fw_wi0[of A c rs] groupParts_same_fw_wi0[of B c rs] asm\n have \"\\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\n apply(simp) using same_fw_behaviour_one_equi(3) by blast\n from this groupParts_same_fw_wi0[of A c rs] groupParts_same_fw_wi0[of B c rs] asm\n show \"\\aw \\ set (map wordinterval_to_set A).\n \\bw \\ set (map wordinterval_to_set B).\n \\a \\ aw. \\b \\ bw. \\ same_fw_behaviour_one a b c rs\"\n apply(simp) using same_fw_behaviour_one_equi(3) by fast\nqed\n\n\n\n\n\n(*beginning is copy&paste of previous proof*)\nlemma groupParts_same_fw_wi1:\n \"V \\ set (groupWIs c rs) \\ \\w1 \\ set V. \\w2 \\ set V.\n \\a1 \\ wordinterval_to_set w1. \\a2 \\ wordinterval_to_set w2. same_fw_behaviour_one a1 a2 c rs\"\nproof -\n assume asm: \"V \\ set (groupWIs c rs)\"\n from getParts_same_fw_behaviour same_fw_spec\n have b1: \"\\A \\ set (map wordinterval_to_set (getParts rs)) . \\a1 \\ A. \\a2 \\ A.\n same_fw_behaviour_one a1 a2 c rs\" by fast\n from getParts_complete have complete: \"\\set (map wordinterval_to_set (getParts rs)) = UNIV\"\n by(simp add: wordinterval_list_to_set_def)\n from getParts_nonempty_elems have nonempty: \"\\w\\set (getParts rs). \\ wordinterval_empty w\" by simp\n\n { fix W x1 x2\n assume a1: \"\\A \\ set (map wordinterval_to_set W). \\a1 \\ A. \\a2 \\ A. same_fw_behaviour_one a1 a2 c rs\"\n and a2: \"wordinterval_list_to_set W = UNIV\"\n and a3: \"\\w \\ set W. \\ wordinterval_empty w\"\n and a4: \"(map (\\d. runFw x1 d c rs) (map getOneIp W), map (\\s. runFw s x1 c rs) (map getOneIp W)) =\n (map (\\d. runFw x2 d c rs) (map getOneIp W), map (\\s. runFw s x2 c rs) (map getOneIp W))\"\n from a3 a4 getOneIp_elem\n have b1: \"\\B \\ set (map wordinterval_to_set W). \\b \\ B. runFw x1 b c rs = runFw x2 b c rs\"\n by fastforce\n from a3 a4 getOneIp_elem\n have b2: \"\\B \\ set (map wordinterval_to_set W). \\b \\ B. runFw b x1 c rs = runFw b x2 c rs\"\n by fastforce\n from runFw_sameFw_behave[OF a1 _ b1 b2] a2[unfolded wordinterval_list_to_set_def] have\n \"same_fw_behaviour_one x1 x2 c rs\" by simp\n } note same_behave_runFw=this\n\n from same_behave_runFw[OF b1 getParts_complete nonempty]\n groupF_equality[of \"(\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp (getParts rs))))\"\n \"(getParts rs)\"] asm\n have b2: \"\\a1\\set V. \\a2\\set V. same_fw_behaviour_one (getOneIp a1) (getOneIp a2) c rs\"\n apply(subst (asm) groupWIs_def)\n apply(subst (asm) Let_def)+\n by fast\n from groupWIs_not_empty_elems asm have \"\\w \\ set V. \\ wordinterval_empty w\" by blast\n from this b2 getOneIp_elem\n have b3: \"\\w1\\set (map wordinterval_to_set V). \\w2\\set (map wordinterval_to_set V). \n \\ip1\\ w1. \\ip2\\w2.\n same_fw_behaviour_one ip1 ip2 c rs\" by (simp) (blast)\n from groupParts_same_fw_wi0 asm \n have \"\\A\\set (map wordinterval_to_set V). \\a1\\ A. \\a2\\ A. same_fw_behaviour_one a1 a2 c rs\" \n by metis\n from sameFw_behave_sets[OF this b3]\n show \"\\w1 \\ set V. \\w2 \\ set V.\n \\a1 \\ wordinterval_to_set w1. \\a2 \\ wordinterval_to_set w2. same_fw_behaviour_one a1 a2 c rs\"\n by force\nqed\n\nlemma groupParts_same_fw_wi2: \"V \\ set (groupWIs c rs) \\\n \\ip1 \\ wordinterval_list_to_set V.\n \\ip2 \\ wordinterval_list_to_set V.\n same_fw_behaviour_one ip1 ip2 c rs\"\n using groupParts_same_fw_wi0 groupParts_same_fw_wi1\n apply (simp add: wordinterval_list_to_set_def)\n by fast\n\nlemma groupWIs_same_fw_not2: \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n A \\ B \\\n \\ip1 \\ wordinterval_list_to_set A.\n \\ip2 \\ wordinterval_list_to_set B.\n \\ same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: wordinterval_list_to_set_def)\n using groupWIs_same_fw_not by fastforce\n\n(*I like this version -- corny*)\nlemma \"A \\ set (groupWIs c rs) \\ B \\ set (groupWIs c rs) \\ \n \\ip1 \\ wordinterval_list_to_set A.\n \\ip2 \\ wordinterval_list_to_set B. same_fw_behaviour_one ip1 ip2 c rs\n \\ A = B\"\nusing groupWIs_same_fw_not2 by blast\n\n\nlemma groupWIs_complete: \"(\\x\\ set (groupWIs c rs). wordinterval_list_to_set x) = (UNIV::'i::len word set)\"\n proof -\n have \"(\\ y \\ (\\x\\ set (groupWIs c rs). set x). wordinterval_to_set y) = (UNIV::'i word set)\"\n apply(simp add: groupWIs_def Let_def groupF_Union_set)\n using getParts_complete wordinterval_list_to_set_def by fastforce\n thus ?thesis by(simp add: wordinterval_list_to_set_def)\nqed\n\n\n(*begin groupWIs1 and groupWIs2 optimization*)\n definition groupWIs1 :: \"'a parts_connection_scheme \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs1 c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) W,\n map (\\s. runFw s (getOneIp wi) c rs) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P)))))\"\n \n lemma groupWIs_groupWIs1_equi: \"groupWIs1 c rs = groupWIs c rs\"\n apply(subst groupWIs1_def)\n apply(subst groupWIs_def)\n using groupF_tuple by metis\n \n definition simple_conn_matches :: \"'i::len simple_match \\ parts_connection \\ bool\" where\n \"simple_conn_matches m c \\\n (match_iface (iiface m) (pc_iiface c)) \\\n (match_iface (oiface m) (pc_oiface c)) \\\n (match_proto (proto m) (pc_proto c)) \\\n (simple_match_port (sports m) (pc_sport c)) \\\n (simple_match_port (dports m) (pc_dport c))\"\n \n lemma simple_conn_matches_simple_match_any: \"simple_conn_matches simple_match_any c\"\n apply(simp add: simple_conn_matches_def)\n apply(simp add: simple_match_any_def match_ifaceAny)\n apply(subgoal_tac \"(65535::16 word) = max_word\")\n apply(simp)\n by(simp add: max_word_def)\n \n lemma has_default_policy_simple_conn_matches:\n \"has_default_policy rs \\ has_default_policy [r\\rs . simple_conn_matches (match_sel r) c]\"\n apply(induction rs rule: has_default_policy.induct)\n apply(simp; fail)\n apply(simp add: simple_conn_matches_simple_match_any; fail)\n apply(simp)\n apply(intro conjI)\n apply(simp split: if_split_asm; fail)\n apply(simp add: has_default_policy_fst split: if_split_asm)\n done\n \n \n lemma filter_conn_fw_lem: \n \"runFw s d c (filter (\\r. simple_conn_matches (match_sel r) c) rs) = runFw s d c rs\"\n apply(simp add: runFw_def simple_conn_matches_def match_sel_def)\n apply(induction rs \"\\p_iiface = pc_iiface c, p_oiface = pc_oiface c,\n p_src = s, p_dst = d, p_proto = pc_proto c, \n p_sport = pc_sport c, p_dport = pc_dport c,\n p_tcp_flags = {TCP_SYN},p_payload=''''\\\"\n rule: simple_fw.induct)\n apply(simp add: simple_matches.simps)+\n done\n \n \n (*performance: despite optimization, this function takes quite long and can be optimized*)\n definition groupWIs2 :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs2 c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let filterW = (filter (\\r. simple_conn_matches (match_sel r) c) rs) in\n (let f = (\\wi. (map (\\d. runFw (getOneIp wi) d c filterW) W,\n map (\\s. runFw s (getOneIp wi) c filterW) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P))))))\"\n \n lemma groupWIs1_groupWIs2_equi: \"groupWIs2 c rs = groupWIs1 c rs\"\n by(simp add: groupWIs2_def groupWIs1_def filter_conn_fw_lem)\n \n \n lemma groupWIs_code[code]: \"groupWIs c rs = groupWIs2 c rs\"\n using groupWIs1_groupWIs2_equi groupWIs_groupWIs1_equi by metis\n(*end groupWIs1 and groupWIs2 optimization*)\n\n\n(*begin groupWIs3 optimization*)\n fun matching_dsts :: \"'i::len word \\ 'i simple_rule list \\ 'i wordinterval \\ 'i wordinterval\" where\n \"matching_dsts _ [] _ = Empty_WordInterval\" |\n \"matching_dsts s ((SimpleRule m Accept)#rs) acc_dropped =\n (if simple_match_ip (src m) s then\n wordinterval_union (wordinterval_setminus (ipcidr_tuple_to_wordinterval (dst m)) acc_dropped) (matching_dsts s rs acc_dropped)\n else\n matching_dsts s rs acc_dropped)\" |\n \"matching_dsts s ((SimpleRule m Drop)#rs) acc_dropped =\n (if simple_match_ip (src m) s then\n matching_dsts s rs (wordinterval_union (ipcidr_tuple_to_wordinterval (dst m)) acc_dropped)\n else\n matching_dsts s rs acc_dropped)\"\n \n lemma matching_dsts_pull_out_accu:\n \"wordinterval_to_set (matching_dsts s rs (wordinterval_union a1 a2)) = wordinterval_to_set (matching_dsts s rs a2) - wordinterval_to_set a1\"\n apply(induction s rs a2 arbitrary: a1 a2 rule: matching_dsts.induct)\n apply(simp_all)\n by blast+\n \n (*a copy of matching_dsts*)\n fun matching_srcs :: \"'i::len word \\ 'i simple_rule list \\ 'i wordinterval \\ 'i wordinterval\" where\n \"matching_srcs _ [] _ = Empty_WordInterval\" |\n \"matching_srcs d ((SimpleRule m Accept)#rs) acc_dropped =\n (if simple_match_ip (dst m) d then\n wordinterval_union (wordinterval_setminus (ipcidr_tuple_to_wordinterval (src m)) acc_dropped) (matching_srcs d rs acc_dropped)\n else\n matching_srcs d rs acc_dropped)\" |\n \"matching_srcs d ((SimpleRule m Drop)#rs) acc_dropped =\n (if simple_match_ip (dst m) d then\n matching_srcs d rs (wordinterval_union (ipcidr_tuple_to_wordinterval (src m)) acc_dropped)\n else\n matching_srcs d rs acc_dropped)\"\n \n lemma matching_srcs_pull_out_accu:\n \"wordinterval_to_set (matching_srcs d rs (wordinterval_union a1 a2)) = wordinterval_to_set (matching_srcs d rs a2) - wordinterval_to_set a1\"\n apply(induction d rs a2 arbitrary: a1 a2 rule: matching_srcs.induct)\n apply(simp_all)\n by blast+\n \n \n lemma matching_dsts: \"\\r \\ set rs. simple_conn_matches (match_sel r) c \\\n wordinterval_to_set (matching_dsts s rs Empty_WordInterval) = {d. runFw s d c rs = Decision FinalAllow}\"\n proof(induction rs)\n case Nil thus ?case by (simp add: runFw_def)\n next\n case (Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r, blast)\n \n from Cons.prems r have simple_match_ip_Accept: \"\\d. simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m Accept # rs) = Decision FinalAllow \\ simple_match_ip (dst m) d \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n { fix d a\n have \"\\ simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m a # rs) = Decision FinalAllow \\ runFw s d c rs = Decision FinalAllow\"\n apply(cases a)\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)+\n } note not_simple_match_ip=this\n \n from Cons.prems r have simple_match_ip_Drop: \"\\d. simple_match_ip (src m) s \\\n runFw s d c (SimpleRule m Drop # rs) = Decision FinalAllow \\ \\ simple_match_ip (dst m) d \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n show ?case\n proof(cases a)\n case Accept with r Cons show ?thesis\n apply(simp, intro conjI impI)\n apply(simp add: simple_match_ip_Accept wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n next\n case Drop with r Cons show ?thesis\n apply(simp,intro conjI impI)\n apply(simp add: simple_match_ip_Drop matching_dsts_pull_out_accu wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n qed\n qed\n lemma matching_srcs: \"\\r \\ set rs. simple_conn_matches (match_sel r) c \\\n wordinterval_to_set (matching_srcs d rs Empty_WordInterval) = {s. runFw s d c rs = Decision FinalAllow}\"\n proof(induction rs)\n case Nil thus ?case by (simp add: runFw_def)\n next\n case (Cons r rs)\n obtain m a where r: \"r = SimpleRule m a\" by(cases r, blast)\n \n from Cons.prems r have simple_match_ip_Accept: \"\\s. simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m Accept # rs) = Decision FinalAllow \\\n simple_match_ip (src m) s \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n { fix s a\n have \"\\ simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m a # rs) = Decision FinalAllow \\ runFw s d c rs = Decision FinalAllow\"\n apply(cases a)\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)+\n } note not_simple_match_ip=this\n \n from Cons.prems r have simple_match_ip_Drop: \"\\s. simple_match_ip (dst m) d \\\n runFw s d c (SimpleRule m Drop # rs) = Decision FinalAllow \\\n \\ simple_match_ip (src m) s \\ runFw s d c rs = Decision FinalAllow\"\n by(simp add: simple_conn_matches_def runFw_def simple_matches.simps)\n \n show ?case\n proof(cases a)\n case Accept with r Cons show ?thesis\n apply(simp, intro conjI impI)\n apply(simp add: simple_match_ip_Accept wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n next\n case Drop with r Cons show ?thesis\n apply(simp,intro conjI impI)\n apply(simp add: simple_match_ip_Drop matching_srcs_pull_out_accu wordinterval_to_set_ipcidr_tuple_to_wordinterval_simple_match_ip_set)\n apply blast\n apply(simp add: not_simple_match_ip; fail)\n done\n qed\n qed\n \n \n \n (*TODO: if we can get wordinterval_element to log runtime ...*)\n definition groupWIs3_default_policy :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs3_default_policy c rs = (let P = getParts rs in\n (let W = map getOneIp P in \n (let filterW = (filter (\\r. simple_conn_matches (match_sel r) c) rs) in\n (let f = (\\wi. let mtch_dsts = (matching_dsts (getOneIp wi) filterW Empty_WordInterval);\n mtch_srcs = (matching_srcs (getOneIp wi) filterW Empty_WordInterval) in \n (map (\\d. wordinterval_element d mtch_dsts) W,\n map (\\s. wordinterval_element s mtch_srcs) W)) in\n map (map fst) (groupF snd (map (\\x. (x, f x)) P))))))\"\n \n \n lemma groupWIs3_default_policy_groupWIs2:\n fixes rs :: \"'i::len simple_rule list\"\n assumes \"has_default_policy rs\"\n shows \"groupWIs2 c rs = groupWIs3_default_policy c rs\"\n proof -\n { fix filterW s d\n from matching_dsts[where c=c] have \"filterW = filter (\\r. simple_conn_matches (match_sel r) c) rs \\\n wordinterval_element d (matching_dsts s filterW Empty_WordInterval) \\ runFw s d c filterW = Decision FinalAllow\"\n by force\n } note matching_dsts_filterW=this[simplified]\n \n { fix filterW s d\n from matching_srcs[where c=c] have \"filterW = filter (\\r. simple_conn_matches (match_sel r) c) rs \\\n wordinterval_element s (matching_srcs d filterW Empty_WordInterval) \\ runFw s d c filterW = Decision FinalAllow\"\n by force\n } note matching_srcs_filterW=this[simplified]\n \n { fix W and rs :: \"'i::len simple_rule list\"\n assume assms': \"has_default_policy rs\"\n have \"groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs = Decision FinalAllow) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs = Decision FinalAllow) (map getOneIp W))) W =\n groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp W),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp W))) W\"\n proof -\n { (*unused fresh generic variables. 'a is used for the tuple already*)\n fix f1::\"'w \\ 'u \\ 'v\" and f2::\" 'w \\ 'u \\ 'x\" and x and y and g1::\"'w \\ 'u \\ 'y\" and g2::\"'w \\ 'u \\ 'z\" and W::\"'u list\"\n assume 1: \"\\w \\ set W. (f1 x) w = (f1 y) w \\ (f2 x) w = (f2 y) w\"\n and 2: \"\\w \\ set W. (g1 x) w = (g1 y) w \\ (g2 x) w = (g2 y) w\"\n have \"\n ((map (f1 x) W, map (g1 x) W) = (map (f1 y) W, map (g1 y) W)) \n \\\n ((map (f2 x) W, map (g2 x) W) = (map (f2 y) W, map (g2 y) W))\"\n proof -\n from 1 have p1: \"(map (f1 x) W = map (f1 y) W \\ map (f2 x) W = map (f2 y) W)\" by(induction W)(simp_all)\n from 2 have p2: \"(map (g1 x) W = map (g1 y) W \\ map (g2 x) W = map (g2 y) W)\" by(induction W)(simp_all)\n from p1 p2 show ?thesis by fast\n qed\n } note map_over_tuples_equal_helper=this\n \n show ?thesis\n apply(rule groupF_cong)\n apply(intro ballI)\n apply(rule map_over_tuples_equal_helper)\n using has_default_policy_runFw[OF assms'] by metis+\n qed\n } note has_default_policy_groupF=this[simplified]\n \n from assms show ?thesis\n apply(simp add: groupWIs3_default_policy_def groupWIs_code[symmetric])\n apply(subst groupF_tuple[symmetric])\n apply(simp add: Let_def)\n apply(simp add: matching_srcs_filterW matching_dsts_filterW)\n apply(subst has_default_policy_groupF)\n apply(simp add: has_default_policy_simple_conn_matches; fail)\n apply(simp add: groupWIs_def Let_def filter_conn_fw_lem)\n done\n qed\n \n \n definition groupWIs3 :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list list\" where\n \"groupWIs3 c rs = (if has_default_policy rs then groupWIs3_default_policy c rs else groupWIs2 c rs)\"\n \n lemma groupWIs3: \"groupWIs3 = groupWIs\"\n by(simp add: fun_eq_iff groupWIs3_def groupWIs_code groupWIs3_default_policy_groupWIs2) \n\n(*end groupWIs3 optimization*)\n\n(*construct partitions. main function!*)\ndefinition build_ip_partition :: \"parts_connection \\ 'i::len simple_rule list \\ 'i wordinterval list\" where\n \"build_ip_partition c rs = map\n (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)))\n (groupWIs3 c rs)\"\n\n\ntheorem build_ip_partition_same_fw: \"V \\ set (build_ip_partition c rs) \\\n \\ip1::'i::len word \\ wordinterval_to_set V.\n \\ip2::'i::len word \\ wordinterval_to_set V.\n same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: build_ip_partition_def groupWIs3)\n using wordinterval_list_to_set_compressed groupParts_same_fw_wi2 wordinterval_sort by blast\n\ntheorem build_ip_partition_same_fw_min: \"A \\ set (build_ip_partition c rs) \\ B \\ set (build_ip_partition c rs) \\ \n A \\ B \\\n \\ip1::'i::len word \\ wordinterval_to_set A.\n \\ip2::'i::len word \\ wordinterval_to_set B.\n \\ same_fw_behaviour_one ip1 ip2 c rs\"\n apply(simp add: build_ip_partition_def groupWIs3)\n using groupWIs_same_fw_not2 wordinterval_list_to_set_compressed wordinterval_sort by blast\n\ntheorem build_ip_partition_complete: \"(\\x\\set (build_ip_partition c rs). wordinterval_to_set x) = (UNIV :: 'i::len word set)\"\n proof -\n have \"wordinterval_to_set (foldr wordinterval_union x Empty_WordInterval) = (\\set (map wordinterval_to_set x))\"\n for x::\"'i wordinterval list\"\n by(induction x) simp_all\n thus ?thesis\n apply(simp add: build_ip_partition_def groupWIs3 wordinterval_compress wordinterval_sort)\n using groupWIs_complete[simplified wordinterval_list_to_set_def] by simp\n qed\n\n\n\nlemma build_ip_partition_no_empty_elems: \"wi \\ set (build_ip_partition c rs) \\ \\ wordinterval_empty wi\"\n proof -\n assume \"wi \\ set (build_ip_partition c rs)\"\n hence assm: \"wi \\ (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval))) ` set (groupWIs c rs)\"\n by(simp add: build_ip_partition_def groupWIs3)\n from assm obtain wi_orig where 1: \"wi_orig \\ set (groupWIs c rs)\" and\n 2: \"wi = wordinterval_sort (wordinterval_compress (foldr wordinterval_union wi_orig Empty_WordInterval))\" by blast\n from 1 groupWIs_not_empty_elem have i1: \"wi_orig \\ []\" by blast\n from 1 groupWIs_not_empty_elems have i2: \"\\w. w \\ set wi_orig \\ \\ wordinterval_empty w\" by simp\n from i1 i2 have \"wordinterval_to_set (foldr wordinterval_union wi_orig Empty_WordInterval) \\ {}\"\n by(induction wi_orig) simp_all\n with 2 show ?thesis by(simp add: wordinterval_compress wordinterval_sort)\n qed\n\n\nlemma build_ip_partition_disjoint: \n \"V1 \\ set (build_ip_partition c rs) \\ V2 \\ set (build_ip_partition c rs) \\\n V1 \\ V2 \\\n wordinterval_to_set V1 \\ wordinterval_to_set V2 = {}\"\n by (meson build_ip_partition_same_fw_min int_not_emptyD same_fw_behaviour_one_equi(1))\n\n\nlemma map_wordinterval_to_set_distinct:\n assumes distinct: \"distinct xs\"\n and disjoint: \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2 = {})\" \n and notempty: \"\\x \\ set xs. \\ wordinterval_empty x\"\n shows \"distinct (map wordinterval_to_set xs)\"\n proof -\n have \"\\ wordinterval_empty x1 \\ \n wordinterval_to_set x1 \\ wordinterval_to_set x2 = {} \\ \n wordinterval_to_set x1 \\ wordinterval_to_set x2\" for x1::\"('b::len) wordinterval\" and x2\n by auto\n with disjoint notempty have \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2)\"\n by force\n with distinct show \"distinct (map wordinterval_to_set xs)\"\n proof(induction xs)\n case Cons thus ?case by simp fast\n qed(simp)\n qed\n\nlemma map_getOneIp_distinct: assumes\n distinct: \"distinct xs\"\n and disjoint: \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ wordinterval_to_set x1 \\ wordinterval_to_set x2 = {})\" \n and notempty: \"\\x \\ set xs. \\ wordinterval_empty x\"\n shows \"distinct (map getOneIp xs)\"\n proof -\n have \"\\ wordinterval_empty x \\ \\ wordinterval_empty xa \\ \n wordinterval_to_set x \\ wordinterval_to_set xa = {} \\ getOneIp x \\ getOneIp xa\"\n for x xa::\"'b::len wordinterval\"\n by(fastforce dest: getOneIp_elem)\n with disjoint notempty have \"(\\x1 \\ set xs. \\x2 \\ set xs. x1 \\ x2 \\ getOneIp x1 \\ getOneIp x2)\"\n by metis\n with distinct show ?thesis\n proof(induction xs)\n case Cons thus ?case by simp fast\n qed(simp)\n qed\n\n\nlemma getParts_disjoint_list: \"disjoint_list (map wordinterval_to_set (getParts rs))\"\nproof-\n have disjoint_list_partitioningIps: \n \"{} \\ set (map wordinterval_to_set ts) \\ disjoint_list (map wordinterval_to_set ts) \\ \n (wordinterval_list_to_set ss) \\ (wordinterval_list_to_set ts) \\\n disjoint_list (map wordinterval_to_set (partitioningIps ss ts))\"\n for ts::\"'a::len wordinterval list\" and ss\n by (simp add: partitioning1_disjoint_list partitioningIps_equi wordinterval_list_to_set_def)\n have \"{} \\ set (map wordinterval_to_set [wordinterval_UNIV])\"\n and \"disjoint_list (map wordinterval_to_set [wordinterval_UNIV])\"\n and \"wordinterval_list_to_set (extract_IPSets rs) \\ wordinterval_list_to_set [wordinterval_UNIV]\"\n by(simp add: wordinterval_list_to_set_def disjoint_list_def disjoint_def)+\n thus ?thesis\n unfolding getParts_def by(rule disjoint_list_partitioningIps)\nqed\n\nlemma build_ip_partition_distinct: \"distinct (map wordinterval_to_set (build_ip_partition c rs))\"\nproof -\n have \n \"(wordinterval_to_set \\ (\\xs. wordinterval_sort (wordinterval_compress (foldr wordinterval_union xs Empty_WordInterval)))) ws\n = \\ set (map wordinterval_to_set ws)\" for ws::\"'a::len wordinterval list\"\n proof(induction ws)\n qed(simp_all add: wordinterval_compress wordinterval_sort)\n hence hlp1: \"map wordinterval_to_set (build_ip_partition c rs) =\n map (\\x. \\ set (map wordinterval_to_set x)) (groupWIs c rs)\"\n unfolding build_ip_partition_def groupWIs3 by auto\n\n --\"generic rule\"\n have \"\\x \\ set xs. \\ wordinterval_empty x \\\n disjoint_list (map wordinterval_to_set xs) \\\n distinct (map (\\x. \\set (map wordinterval_to_set x)) (groupF f xs))\"\n for f::\"'x::len wordinterval \\ 'y\" and xs::\"'x::len wordinterval list\"\n proof(induction f xs rule: groupF.induct)\n case 1 thus ?case by simp\n next\n case (2 f x xs)\n have hlp_internal:\n \"\\ (set (map (\\x. \\ set (map wordinterval_to_set x)) (groupF f xs))) =\n \\ set (map wordinterval_to_set xs)\" for f::\"'x wordinterval \\ 'y\" and xs\n by(induction f xs rule: groupF.induct) (auto)\n\n from 2(2,3) have \"wordinterval_to_set x \\ \\(wordinterval_to_set ` set xs) = {}\"\n by(auto simp add: disjoint_def disjoint_list_def)\n hence \"\\ (wordinterval_to_set x) \\ \\(wordinterval_to_set ` set xs)\" using 2(2) by auto\n hence \"\\ wordinterval_to_set x \\ \\set (map wordinterval_to_set [y\\xs . f x \\ f y])\" by auto\n hence \"\\ wordinterval_to_set x \\ (\\x\\{xa \\ set xs. f x = f xa}.\n wordinterval_to_set x) \\ \\ (set (map (\\x. \\ set (map wordinterval_to_set x)) (groupF f [y\\xs . f x \\ f y])))\" \n unfolding hlp_internal by blast\n hence g1: \"wordinterval_to_set x \\ (\\x\\{xa \\ set xs. f x = f xa}. wordinterval_to_set x)\n \\ (\\x. \\x\\set x. wordinterval_to_set x) ` set (groupF f [y\\xs . f x \\ f y])\" by force\n \n from 2(3) have \"distinct (map wordinterval_to_set [y\\xs . f x \\ f y])\"\n by (simp add: disjoint_list_def distinct_map_filter) \n moreover from 2 have \"disjoint (wordinterval_to_set ` {xa \\ set xs. f x \\ f xa})\"\n by(simp add: disjoint_def disjoint_list_def)\n ultimately have g2: \"distinct (map (\\x. \\x\\set x. wordinterval_to_set x) (groupF f [y\\xs . f x \\ f y]))\"\n using 2(1,2) unfolding disjoint_list_def by(simp)\n\n from g1 g2 show ?case by simp\n qed\n with getParts_disjoint_list getParts_nonempty_elems have\n \"distinct\n (map (\\x. \\set (map wordinterval_to_set x))\n (groupF (\\wi. (map (\\d. runFw (getOneIp wi) d c rs) (map getOneIp (getParts rs)),\n map (\\s. runFw s (getOneIp wi) c rs) (map getOneIp (getParts rs))))\n (getParts rs)))\" by blast\n\n thus ?thesis unfolding hlp1 groupWIs_def Let_def by presburger\nqed\n\nlemma build_ip_partition_distinct': \"distinct (build_ip_partition c rs)\"\n using build_ip_partition_distinct distinct_mapI by blast\n\n\nsubsection\\Service Matrix over an IP Address Space Partition\\\n\n\ndefinition simple_firewall_without_interfaces :: \"'i::len simple_rule list \\ bool\" where\n \"simple_firewall_without_interfaces rs \\ \\m \\ match_sel ` set rs. iiface m = ifaceAny \\ oiface m = ifaceAny\"\n\nlemma simple_fw_no_interfaces:\n assumes no_ifaces: \"simple_firewall_without_interfaces rs\"\n shows \"simple_fw rs p = simple_fw rs (p\\ p_iiface:= x, p_oiface:= y\\)\"\nproof -\n from no_ifaces have \"\\r\\set rs. iiface (match_sel r) = ifaceAny \\ oiface (match_sel r) = ifaceAny\"\n by(simp add: simple_firewall_without_interfaces_def)\n thus ?thesis apply(induction rs p rule:simple_fw.induct)\n by(simp_all add: simple_matches.simps match_ifaceAny)\nqed\n \nlemma runFw_no_interfaces:\n assumes no_ifaces: \"simple_firewall_without_interfaces rs\"\n shows \"runFw s d c rs = runFw s d (c\\ pc_iiface:= x, pc_oiface:= y\\) rs\"\n apply(simp add: runFw_def)\n apply(subst simple_fw_no_interfaces[OF no_ifaces])\n by(simp)\n\n\n\n(*only defined for simple_firewall_without_interfaces*)\ndefinition access_matrix \n :: \"parts_connection \\ 'i::len simple_rule list \\ ('i word \\ 'i wordinterval) list \\ ('i word \\ 'i word) list\" \n where\n \"access_matrix c rs \\\n (let W = build_ip_partition c rs;\n R = map getOneIp W\n in\n (zip R W, [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_nodes_defined:\n \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ s \\ dom (map_of V)\" and\n \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ d \\ dom (map_of V)\"\n by(auto simp add: access_matrix_def Let_def all_pairs_def)\n\ntext\\For all the entries @{term E} of the matrix, the access is allowed\\\nlemma \"(V,E) = access_matrix c rs \\ (s, d) \\ set E \\ runFw s d c rs = Decision FinalAllow\"\n by(auto simp add: access_matrix_def Let_def)\ntext\\However, the entries are only a representation of a whole set of IP addresses. \n For all IP addresses which the entries represent, the access must be allowed.\\\n\n\n(*TODO: move to generic library*)\nlemma map_of_zip_map: \"map_of (zip (map f rs) rs) k = Some v \\ k = f v\"\n apply(induction rs)\n apply(simp)\n apply(simp split: if_split_asm)\n done\n\nlemma access_matrix_sound: assumes matrix: \"(V,E) = access_matrix c rs\" and\n repr: \"(s_repr, d_repr) \\ set E\" and\n s_range: \"(map_of V) s_repr = Some s_range\" and s: \"s \\ wordinterval_to_set s_range\" and\n d_range: \"(map_of V) d_repr = Some d_range\" and d: \"d \\ wordinterval_to_set d_range\"\n shows \"runFw s d c rs = Decision FinalAllow\"\n proof -\n let ?part=\"(build_ip_partition c rs)\"\n have V: \"V = (zip (map getOneIp ?part) ?part)\"\n using matrix by(simp add: access_matrix_def Let_def)\n (*have \"E = [(s, d)\\all_pairs (map getOneIp ?part). runFw s d c rs = Decision FinalAllow]\"\n using matrix by(simp add: access_matrix_def Let_def)\n with repr have \"(s_repr, d_repr) \\ set (all_pairs (map getOneIp ?part))\" by simp\n hence \"s_repr \\ set (map getOneIp ?part)\" and\n \"d_repr \\ set (map getOneIp ?part)\"\n by(simp add: all_pairs_set)+*)\n (*from s_range have \"(s_repr, s_range) \\ set V\" by (simp add: map_of_SomeD)*)\n\n from matrix repr have repr_Allow: \"runFw s_repr d_repr c rs = Decision FinalAllow\"\n by(auto simp add: access_matrix_def Let_def)\n\n have s_range_in_part: \"s_range \\ set ?part\" using V s_range by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n with build_ip_partition_no_empty_elems have \"\\ wordinterval_empty s_range\" by simp\n\n have d_range_in_part: \"d_range \\ set ?part\" using V d_range by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n with build_ip_partition_no_empty_elems have \"\\ wordinterval_empty d_range\" by simp\n\n from map_of_zip_map V s_range have \"s_repr = getOneIp s_range\" by fast\n with \\\\ wordinterval_empty s_range\\ getOneIp_elem wordinterval_element_set_eq \n have \"s_repr \\ wordinterval_to_set s_range\" by blast \n\n from map_of_zip_map V d_range have \"d_repr = getOneIp d_range\" by fast\n with \\\\ wordinterval_empty d_range\\ getOneIp_elem wordinterval_element_set_eq \n have \"d_repr \\ wordinterval_to_set d_range\" by blast \n\n from s_range_in_part have s_range_in_part': \"s_range \\ set (build_ip_partition c rs)\" by simp\n from d_range_in_part have d_range_in_part': \"d_range \\ set (build_ip_partition c rs)\" by simp\n\n from build_ip_partition_same_fw[OF s_range_in_part', unfolded same_fw_behaviour_one_def] s\n \\s_repr \\ wordinterval_to_set s_range\\ have \n \"\\d. runFw s_repr d c rs = runFw s d c rs\" by blast\n with repr_Allow have 1: \"runFw s d_repr c rs = Decision FinalAllow\" by simp\n\n from build_ip_partition_same_fw[OF d_range_in_part', unfolded same_fw_behaviour_one_def] d\n \\d_repr \\ wordinterval_to_set d_range\\ have \n \"\\s. runFw s d_repr c rs = runFw s d c rs\" by blast\n with 1 have 2: \"runFw s d c rs = Decision FinalAllow\" by simp\n thus ?thesis .\nqed\n\n\nlemma distinct_map_getOneIp_obtain: \"v \\ set xs \\ distinct (map getOneIp xs) \\ \n \\s_repr. map_of (zip (map getOneIp xs) xs) s_repr = Some v\"\n proof(induction xs)\n case Nil thus ?case by simp\n next\n case (Cons x xs)\n consider \"v = x\" | \"v \\ set xs\" using Cons.prems(1) by fastforce\n thus ?case\n proof(cases)\n case 1 thus ?thesis by simp blast\n next\n case 2 with Cons.IH Cons.prems(2) obtain s_repr where\n s_repr: \"map_of (zip (map getOneIp xs) xs) s_repr = Some v\" by force\n show ?thesis\n proof(cases \"s_repr \\ getOneIp x\")\n case True with Cons.prems s_repr show ?thesis by(rule_tac x=s_repr in exI, simp)\n next\n case False with Cons.prems s_repr show ?thesis by(fastforce elim: in_set_zipE)\n qed\n qed\n qed\n\n\nlemma access_matrix_complete:\n fixes rs :: \"'i::len simple_rule list\"\n assumes matrix: \"(V,E) = access_matrix c rs\" and\n allow: \"runFw s d c rs = Decision FinalAllow\"\n shows \"\\s_repr d_repr s_range d_range. (s_repr, d_repr) \\ set E \\\n (map_of V) s_repr = Some s_range \\ s \\ wordinterval_to_set s_range \\\n (map_of V) d_repr = Some d_range \\ d \\ wordinterval_to_set d_range\"\n proof -\n let ?part=\"(build_ip_partition c rs)\"\n have V: \"V = zip (map getOneIp ?part) ?part\"\n using matrix by(simp add: access_matrix_def Let_def)\n have E: \"E = [(s, d)\\all_pairs (map getOneIp ?part). runFw s d c rs = Decision FinalAllow]\"\n using matrix by(simp add: access_matrix_def Let_def)\n\n have build_ip_partition_obtain:\n \"\\V. V \\ set (build_ip_partition c rs) \\ s \\ wordinterval_to_set V\" for s\n using build_ip_partition_complete by blast\n\n have distinct_map_getOneIp_build_ip_partition_obtain:\n \"v \\ set (build_ip_partition c rs) \\\n \\s_repr. map_of (zip (map getOneIp (build_ip_partition c rs)) (build_ip_partition c rs)) s_repr = Some v\"\n for v and rs :: \"'i::len simple_rule list\"\n proof(erule distinct_map_getOneIp_obtain)\n show \"distinct (map getOneIp (build_ip_partition c rs))\" \n apply(rule map_getOneIp_distinct)\n subgoal using build_ip_partition_distinct' by blast\n subgoal using build_ip_partition_disjoint build_ip_partition_distinct' by blast\n subgoal using build_ip_partition_no_empty_elems[simplified] by auto\n done\n qed\n\n from build_ip_partition_obtain obtain s_range where\n \"s_range \\ set ?part\" and \"s \\ wordinterval_to_set s_range\" by blast\n from this distinct_map_getOneIp_build_ip_partition_obtain V obtain s_repr where\n ex_s1: \"(map_of V) s_repr = Some s_range\" and ex_s2: \"s \\ wordinterval_to_set s_range\"\n by blast\n\n\n from build_ip_partition_obtain obtain d_range where\n \"d_range \\ set ?part\" and \"d \\ wordinterval_to_set d_range\" by blast\n from this distinct_map_getOneIp_build_ip_partition_obtain V obtain d_repr where\n ex_d1: \"(map_of V) d_repr = Some d_range\" and ex_d2: \"d \\ wordinterval_to_set d_range\"\n by blast\n\n have 1: \"s_repr \\ getOneIp ` set (build_ip_partition c rs)\"\n using V \\map_of V s_repr = Some s_range\\ by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n have 2: \"d_repr \\ getOneIp ` set (build_ip_partition c rs)\"\n using V \\map_of V d_repr = Some d_range\\ by (fastforce elim: in_set_zipE dest: map_of_SomeD)\n\n have \"runFw s_repr d_repr c rs = Decision FinalAllow\"\n proof -\n have f1: \"(\\w wa p ss. \\ same_fw_behaviour_one w wa (p::parts_connection) ss \\\n (\\wb wc. runFw w wb p ss = runFw wa wb p ss \\ runFw wc w p ss = runFw wc wa p ss)) \\\n (\\w wa p ss. (\\wb wc. runFw w wb (p::parts_connection) ss \\ runFw wa wb p ss \\ runFw wc w p ss \\ runFw wc wa p ss) \\\n same_fw_behaviour_one w wa p ss)\"\n unfolding same_fw_behaviour_one_def by blast\n from \\s_range \\ set (build_ip_partition c rs)\\ have f2: \"same_fw_behaviour_one s s_repr c rs\"\n by (metis (no_types) map_of_zip_map V build_ip_partition_no_empty_elems\n build_ip_partition_same_fw ex_s1 ex_s2 getOneIp_elem wordinterval_element_set_eq)\n from \\d_range \\ set (build_ip_partition c rs)\\ have \"same_fw_behaviour_one d_repr d c rs\"\n by (metis (no_types) map_of_zip_map V build_ip_partition_no_empty_elems\n build_ip_partition_same_fw ex_d1 ex_d2 getOneIp_elem wordinterval_element_set_eq)\n with f1 f2 show ?thesis\n using allow by metis\n qed\n \n hence ex1: \"(s_repr, d_repr) \\ set E\" by(simp add: E all_pairs_set 1 2)\n \n thus ?thesis using ex1 ex_s1 ex_s2 ex_d1 ex_d2 by blast \nqed\n\n\ntheorem access_matrix:\n fixes rs :: \"'i::len simple_rule list\"\n assumes matrix: \"(V,E) = access_matrix c rs\"\n shows \"(\\s_repr d_repr s_range d_range. (s_repr, d_repr) \\ set E \\\n (map_of V) s_repr = Some s_range \\ s \\ wordinterval_to_set s_range \\\n (map_of V) d_repr = Some d_range \\ d \\ wordinterval_to_set d_range)\n \\\n runFw s d c rs = Decision FinalAllow\"\nusing matrix access_matrix_sound access_matrix_complete by blast\n\ntext\\\nFor a @{typ \"'i::len simple_rule list\"} and a fixed @{typ parts_connection}, \nwe support to partition the IP address space; for IP addresses of arbitrary length (eg., IPv4, IPv6).\n\nAll members of a partition have the same access rights:\n@{thm build_ip_partition_same_fw [no_vars]}\n\nMinimal:\n@{thm build_ip_partition_same_fw_min [no_vars]}\n\n\nThe resulting access control matrix is sound and complete:\n\n@{thm access_matrix [no_vars]}\n\nTheorem reads: \nFor a fixed connection, you can look up IP addresses (source and destination pairs) in the matrix \nif and only if the firewall accepts this src,dst IP address pair for the fixed connection.\nNote: The matrix is actually a graph (nice visualization!), you need to look up IP addresses \nin the Vertices and check the access of the representants in the edges. If you want to visualize\nthe graph (e.g. with Graphviz or tkiz): The vertices are the node description (i.e. header; \n @{term \"dom V\"} is the label for each node which will also be referenced in the edges,\n @{term \"ran V\"} is the human-readable description for each node (i.e. the full IP range it represents)), \nthe edges are the edges. Result looks nice. Theorem also tells us that this visualization is correct.\n\\\n\n\n\n\n(*construct an ip partition and print it in some usable format\n returns:\n (vertices, edges) where\n vertices = (name, list of ip addresses this vertex corresponds to)\n and edges = (name \\ name) list\n\n Note that the WordInterval is already sorted, which is important for prettyness!\n*)\ntext\\Only defined for @{const simple_firewall_without_interfaces}\\\ndefinition access_matrix_pretty_ipv4\n :: \"parts_connection \\ 32 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv4 c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let (V,E) = (access_matrix c rs);\n formatted_nodes =\n map (\\(v_repr, v_range). (ipv4addr_toString v_repr, ipv4addr_wordinterval_toString v_range)) V;\n formatted_edges =\n map (\\(s,d). (ipv4addr_toString s, ipv4addr_toString d)) E\n in\n (formatted_nodes, formatted_edges)\n )\"\n\ndefinition access_matrix_pretty_ipv4_code\n :: \"parts_connection \\ 32 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv4_code c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let W = build_ip_partition c rs;\n R = map getOneIp W;\n U = all_pairs R\n in\n (zip (map ipv4addr_toString R) (map ipv4addr_wordinterval_toString W), \n map (\\(x,y). (ipv4addr_toString x, ipv4addr_toString y)) [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_pretty_ipv4_code[code]: \"access_matrix_pretty_ipv4 = access_matrix_pretty_ipv4_code\"\n by(simp add: fun_eq_iff access_matrix_pretty_ipv4_def access_matrix_pretty_ipv4_code_def Let_def access_matrix_def map_prod_fun_zip)\n\n\ndefinition access_matrix_pretty_ipv6\n :: \"parts_connection \\ 128 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv6 c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let (V,E) = (access_matrix c rs);\n formatted_nodes =\n map (\\(v_repr, v_range). (ipv6addr_toString v_repr, ipv6addr_wordinterval_toString v_range)) V;\n formatted_edges =\n map (\\(s,d). (ipv6addr_toString s, ipv6addr_toString d)) E\n in\n (formatted_nodes, formatted_edges)\n )\"\n\ndefinition access_matrix_pretty_ipv6_code\n :: \"parts_connection \\ 128 simple_rule list \\ (string \\ string) list \\ (string \\ string) list\" \n where\n \"access_matrix_pretty_ipv6_code c rs \\\n if \\ simple_firewall_without_interfaces rs then undefined else\n (let W = build_ip_partition c rs;\n R = map getOneIp W;\n U = all_pairs R\n in\n (zip (map ipv6addr_toString R) (map ipv6addr_wordinterval_toString W), \n map (\\(x,y). (ipv6addr_toString x, ipv6addr_toString y)) [(s, d)\\all_pairs R. runFw s d c rs = Decision FinalAllow]))\"\n\nlemma access_matrix_pretty_ipv6_code[code]: \"access_matrix_pretty_ipv6 = access_matrix_pretty_ipv6_code\"\n by(simp add: fun_eq_iff access_matrix_pretty_ipv6_def access_matrix_pretty_ipv6_code_def Let_def access_matrix_def map_prod_fun_zip)\n\n \n\ndefinition parts_connection_ssh where\n \"parts_connection_ssh \\ \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP, pc_sport=10000, pc_dport=22\\\"\n\ndefinition parts_connection_http where\n \"parts_connection_http \\ \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP, pc_sport=10000, pc_dport=80\\\"\n\n\ndefinition mk_parts_connection_TCP :: \"16 word \\ 16 word \\ parts_connection\" where\n \"mk_parts_connection_TCP sport dport = \\pc_iiface=''1'', pc_oiface=''1'', pc_proto=TCP,\n pc_sport=sport, pc_dport=dport\\\"\n\nlemma \"mk_parts_connection_TCP 10000 22 = parts_connection_ssh\"\n \"mk_parts_connection_TCP 10000 80 = parts_connection_http\"\n by(simp_all add: mk_parts_connection_TCP_def parts_connection_ssh_def parts_connection_http_def)\n\n\nvalue[code] \"partitioningIps [WordInterval (0::ipv4addr) 0] [WordInterval 0 2, WordInterval 0 2]\"\n\n\ntext_raw\\\nHere is an example of a really large and complicated firewall:\n\n\n\\begin{figure}\n\\centering\n\\resizebox{\\linewidth}{!}{%\n\\tikzset{every loop/.style={looseness=1}}\n\\tikzset{myptr/.style={decoration={markings,mark=at position 1 with %\n {\\arrow[scale=2,>=latex]{>}}},shorten >=0.1cm,shorten <=0.2cm, postaction={decorate}}}%\n\\tikzset{myloop/.style={-to}}%\n\\begin{tikzpicture}\n\\node (m) at (2,-2) {$\\{224.0.0.0 .. 239.255.255.255\\}$};\n\n\\node[align=left] (inet) at (-3,8.5) {$\\{0.0.0.0 .. 126.255.255.255\\} \\cup \\{128.0.0.0 .. 131.159.13.255\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{131.159.16.0 .. 131.159.19.255\\} \\cup \\{131.159.22.0 .. 138.246.253.4\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{138.246.253.11 .. 185.86.231.255\\} \\cup \\{185.86.236.0 .. 188.1.239.85\\} \\cup $ \\\\ \n\t\t\t\t\t\t\t\t\t $ \\{188.1.239.87 .. 188.95.232.63\\} \\cup \\{188.95.232.224 .. 188.95.232.255\\} \\cup $\\\\\n\t\t\t\t\t\t\t\t\t $ \\{188.95.240.0 .. 192.48.106.255\\} \\cup \\{192.48.108.0 .. 223.255.255.255\\} \\cup $\\\\\n\t\t\t\t\t\t\t\t\t $ \\{240.0.0.0 .. 255.255.255.255\\}$};\n\\node[align=left] (internal) at (-5,-10) {$\\{131.159.14.0 .. 131.159.14.7\\} \\cup \\{131.159.14.12 .. 131.159.14.25\\} \\cup $ \\\\ \n$ 131.159.14.27 \\cup \\{131.159.14.29 .. 131.159.14.33\\} \\cup $ \\\\ \n$ \\{131.159.14.38 .. 131.159.14.39\\} \\cup 131.159.14.41 \\cup $ \\\\ \n$ \\{131.159.14.43 .. 131.159.14.51\\} \\cup \\{131.159.14.53 .. 131.159.14.55\\} \\cup $ \\\\ \n$ \\{131.159.14.57 .. 131.159.14.59\\} \\cup \\{131.159.14.61 .. 131.159.14.68\\} \\cup $ \\\\ \n$ 131.159.14.70 .. 131.159.14.82\\} \\cup \\{131.159.14.84 .. 131.159.14.103\\} \\cup $ \\\\ \n$ \\{131.159.14.105 .. 131.159.14.124\\} \\cup \\{131.159.14.126 .. 131.159.14.136\\} \\cup $ \\\\ \n$ \\{131.159.14.138 .. 131.159.14.139\\} \\cup \\{131.159.14.141 .. 131.159.14.144\\} \\cup $ \\\\ \n$ \\{131.159.14.147 .. 131.159.14.154\\} \\cup \\{131.159.14.157 .. 131.159.14.162\\} \\cup $ \\\\ \n$ \\{131.159.14.164 .. 131.159.14.168\\} \\cup \\{131.159.14.170 .. 131.159.14.200\\} \\cup $ \\\\ \n$ \\{131.159.14.202 .. 131.159.14.213\\} \\cup \\{131.159.14.215 .. 131.159.15.4\\} \\cup $ \\\\ \n$ 131.159.15.6 \\cup \\{131.159.15.14 .. 131.159.15.15\\} \\cup $ \\\\ \n$ \\{131.159.15.21 .. 131.159.15.22\\} \\cup 131.159.15.26 \\cup 131.159.15.28 \\cup $ \\\\ \n$ 131.159.15.30 \\cup \\{131.159.15.33 .. 131.159.15.35\\} \\cup $ \\\\ \n$ \\{131.159.15.37 .. 131.159.15.38\\} \\cup 131.159.15.40 \\cup $ \\\\ \n$ \\{131.159.15.45 .. 131.159.15.46\\} \\cup \\{131.159.15.48 .. 131.159.15.49\\} \\cup $ \\\\ \n$ \\{131.159.15.52 .. 131.159.15.55\\} \\cup 131.159.15.57 \\cup 131.159.15.59 \\cup $ \\\\ \n$ \\{131.159.15.61 .. 131.159.15.67\\} \\cup \\{131.159.15.70 .. 131.159.15.196\\} \\cup $ \\\\ \n$ \\{131.159.15.198 .. 131.159.15.227\\} \\cup \\{131.159.15.229 .. 131.159.15.233\\} \\cup $ \\\\ \n$ \\{131.159.15.235 .. 131.159.15.246\\} \\cup \\{131.159.15.250 .. 131.159.15.255\\} \\cup $ \\\\ \n$ \\{131.159.20.0 .. 131.159.20.20\\} \\cup \\{131.159.20.22 .. 131.159.20.28\\} \\cup $ \\\\ \n$ \\{131.159.20.30 .. 131.159.20.35\\} \\cup \\{131.159.20.37 .. 131.159.20.44\\} \\cup $ \\\\ \n$ \\{131.159.20.46 .. 131.159.20.51\\} \\cup \\{131.159.20.53 .. 131.159.20.58\\} \\cup $ \\\\ \n$ \\{131.159.20.60 .. 131.159.20.62\\} \\cup \\{131.159.20.64 .. 131.159.20.70\\} \\cup $ \\\\ \n$ \\{131.159.20.72 .. 131.159.20.73\\} \\cup \\{131.159.20.75 .. 131.159.20.84\\} \\cup $ \\\\ \n$ \\{131.159.20.86 .. 131.159.20.96\\} \\cup \\{131.159.20.98 .. 131.159.20.119\\} \\cup $ \\\\ \n$ \\{131.159.20.121 .. 131.159.20.138\\} \\cup \\{131.159.20.140 .. 131.159.20.149\\} \\cup $ \\\\ \n$ \\{131.159.20.152 .. 131.159.20.154\\} \\cup \\{131.159.20.156 .. 131.159.20.159\\} \\cup $ \\\\ \n$ \\{131.159.20.161 .. 131.159.20.164\\} \\cup \\{131.159.20.167 .. 131.159.20.179\\} \\cup $ \\\\ \n$ \\{131.159.20.181 .. 131.159.20.184\\} \\cup \\{131.159.20.186 .. 131.159.20.199\\} \\cup $ \\\\ \n$ \\{131.159.20.201 .. 131.159.20.232\\} \\cup \\{131.159.20.235 .. 131.159.20.255\\} \\cup $ \\\\ \n$ \\{185.86.232.0 .. 185.86.235.255\\} \\cup \\{188.95.233.0 .. 188.95.233.3\\} \\cup $ \\\\ \n$ \\{188.95.233.5 .. 188.95.233.8\\} \\cup \\{188.95.233.10 .. 188.95.233.255\\} \\cup $ \\\\ \n$ \\{192.48.107.0 .. 192.48.107.255\\}$}; \n\n\\node[align=left] (srvs) at (10,0) {$\\{131.159.14.8 .. 131.159.14.11\\} \\cup 131.159.14.26 \\cup 131.159.14.28 \\cup $ \\\\ \n$ \\{131.159.14.34 .. 131.159.14.37\\} \\cup 131.159.14.40 \\cup 131.159.14.42 \\cup $ \\\\ \n$ 131.159.14.52 \\cup 131.159.14.56 \\cup 131.159.14.60 \\cup 131.159.14.69 \\cup $ \\\\ \n$ 131.159.14.83 \\cup 131.159.14.104 \\cup 131.159.14.125 \\cup 131.159.14.137 \\cup $ \\\\ \n$ 131.159.14.140 \\cup \\{131.159.14.145 .. 131.159.14.146\\} \\cup $ \\\\ \n$ \\{131.159.14.155 .. 131.159.14.156\\} \\cup 131.159.14.163 \\cup 131.159.14.169 \\cup $ \\\\ \n$ 131.159.14.201 \\cup 131.159.14.214 \\cup 131.159.15.5 \\cup $ \\\\ \n$ \\{131.159.15.7 .. 131.159.15.13\\} \\cup \\{131.159.15.16 .. 131.159.15.20\\} \\cup $ \\\\ \n$ \\{131.159.15.23 .. 131.159.15.25\\} \\cup 131.159.15.27 \\cup 131.159.15.29 \\cup $ \\\\ \n$ \\{131.159.15.31 .. 131.159.15.32\\} \\cup 131.159.15.36 \\cup 131.159.15.39 \\cup $ \\\\ \n$ \\{131.159.15.41 .. 131.159.15.44\\} \\cup 131.159.15.47 \\cup 131.159.15.51 \\cup $ \\\\ \n$ 131.159.15.56 \\cup 131.159.15.58 \\cup 131.159.15.60 \\cup $ \\\\ \n$ \\{131.159.15.68 .. 131.159.15.69\\} \\cup 131.159.15.197 \\cup 131.159.15.228 \\cup $ \\\\ \n$ 131.159.15.234 \\cup \\{131.159.15.247 .. 131.159.15.249\\} \\cup 131.159.20.21 \\cup $ \\\\ \n$ 131.159.20.29 \\cup 131.159.20.36 \\cup 131.159.20.45 \\cup 131.159.20.52 \\cup $ \\\\ \n$ 131.159.20.59 \\cup 131.159.20.63 \\cup 131.159.20.71 \\cup 131.159.20.74 \\cup $ \\\\ \n$ 131.159.20.85 \\cup 131.159.20.97 \\cup 131.159.20.120 \\cup 131.159.20.139 \\cup $ \\\\ \n$ \\{131.159.20.150 .. 131.159.20.151\\} \\cup 131.159.20.155 \\cup 131.159.20.160 \\cup $ \\\\ \n$ \\{131.159.20.165 .. 131.159.20.166\\} \\cup 131.159.20.180 \\cup 131.159.20.185 \\cup $ \\\\ \n$ 131.159.20.200 \\cup \\{131.159.20.233 .. 131.159.20.234\\} \\cup $ \\\\ \n$ \\{131.159.21.0 .. 131.159.21.255\\} \\cup \\{188.95.232.192 .. 188.95.232.223\\} \\cup $ \\\\ \n$ 188.95.233.4 \\cup 188.95.233.9 \\cup \\{188.95.234.0 .. 188.95.239.255\\}$}; \n\n\\node[align=left] (ips1) at (-3,-1) {$188.1.239.86 \\cup \\{188.95.232.64 .. 188.95.232.191\\}$};\n\n\\node[align=left] (ips2) at (10,-8) {$\\{138.246.253.6 .. 138.246.253.10\\}$};\n\n\\node[align=left] (ip3) at (5,-6) {$138.246.253.5$};\n\n\\node[align=left] (ip4) at (4.5,-8) {$131.159.15.50$};\n\n\\node[align=left] (l) at (8,-10) {$\\{127.0.0.0 .. 127.255.255.255\\}$};\n\n\n\n\\draw[myloop] (m) to[loop above] (m);\n\\draw[myptr] (m) to (srvs);\n\\draw[myptr] (inet) to (m);\n\\draw[myptr] (inet) to (srvs);\n\\draw[myptr,shorten <=-0.8cm] (internal) to (m);\n\\draw[myptr] (internal) to (inet);\n\\draw[myloop] (internal) to[loop above] (internal);\n\\draw[myptr] (internal) to (srvs);\n\\draw[myptr] (internal) to (ips1);\n\\draw[myptr] (internal) to (ips2);\n\\draw[myptr] (internal) to (ip3);\n\\draw[myptr] (internal) to (ip4);\n\\draw[myptr] (internal) to (l);\n\\draw[myptr] (srvs) to (m);\n\\draw[myptr] (srvs) to (inet);\n\\draw[myptr] (srvs) to (internal);\n\\draw[myloop] (srvs) to[loop above] (srvs);\n\\draw[myptr] (srvs) to (ips1);\n\\draw[myptr] (srvs) to (ips2);\n\\draw[myptr] (srvs) to (ip3);\n\\draw[myptr] (srvs) to (ip4);\n\\draw[myptr] (srvs) to (l);\n\\draw[myptr] (ips1) to (m);\n\\draw[myptr] (ips1) to (inet);\n\\draw[myptr] (ips1) to (internal);\n\\draw[myptr] (ips1) to (srvs);\n\\draw[myloop] (ips1.west) to[loop left] (ips1);\n\\draw[myptr] (ips1) to (ips2);\n\\draw[myptr] (ips1) to (ip3);\n\\draw[myptr] (ips1) to (ip4);\n\\draw[myptr] (ips1) to (l);\n\\draw[myptr] (ips2) to (m);\n\\draw[myptr] (ips2) to (srvs);\n\\draw[myptr] (ips2) to (ip4);\n\\draw[myptr] (ip3) to (m);\n\\draw[myptr] (ip3) to (internal);\n\\draw[myptr] (ip3) to (srvs);\n\\draw[myptr] (ip3) to (ip4);\n\\draw[myptr] (ip4) to (m);\n\\draw[myptr] (ip4) to (inet);\n\\draw[myptr] (ip4) to (internal);\n\\draw[myptr] (ip4) to (srvs);\n\\draw[myptr] (ip4) to (ips1);\n\\draw[myptr] (ip4) to (ips2);\n\\draw[myptr] (ip4) to (ip3);\n\\draw[myloop] (ip4) to[loop below] (ip4);\n\\draw[myptr] (ip4) to (l);\n\n\\end{tikzpicture}%\n}\n\\caption{TUM ssh Service Matrix}\n\\label{fig:tumssh}\n\\end{figure}\n\n\\\n\n\nend \n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Simple_Firewall/Service_Matrix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.255064113699008}} {"text": "theory Simulation_Graphs_TA\n imports Simulation_Graphs DBM_Zone_Semantics Approx_Beta\nbegin\n\nsection \\Instantiation of Simulation Locales\\\n\ninductive step_trans ::\n \"('a, 'c, 't, 's) ta \\ 's \\ ('c, ('t::time)) cval \\ (('c, 't) cconstraint \\ 'a \\ 'c list)\n \\ 's \\ ('c, 't) cval \\ bool\"\n(\"_ \\\\<^sub>t \\_, _\\ \\\\<^bsub>_\\<^esub> \\_, _\\\" [61,61,61] 61)\nwhere\n \"\\A \\ l \\\\<^bsup>g,a,r\\<^esup> l'; u \\ g; u' \\ inv_of A l'; u' = [r \\ 0]u\\\n \\ (A \\\\<^sub>t \\l, u\\ \\\\<^bsub>(g,a,r)\\<^esub> \\l', u'\\)\"\n\ninductive step_trans' ::\n \"('a, 'c, 't, 's) ta \\ 's \\ ('c, ('t::time)) cval \\ ('c, 't) cconstraint \\ 'a \\ 'c list\n \\ 's \\ ('c, 't) cval \\ bool\"\n(\"_ \\'' \\_, _\\ \\\\<^bsup>_\\<^esup> \\_, _\\\" [61,61,61,61] 61)\nwhere\n step': \"A \\ \\l, u\\ \\\\<^bsup>d\\<^esup> \\l', u'\\ \\ A \\\\<^sub>t \\l', u'\\ \\\\<^bsub>t\\<^esub> \\l'', u''\\ \\ A \\' \\l, u\\ \\\\<^bsup>t\\<^esup> \\l'', u''\\\"\n\ninductive step_trans_z ::\n \"('a, 'c, 't, 's) ta \\ 's \\ ('c, ('t::time)) zone\n \\ (('c, 't) cconstraint \\ 'a \\ 'c list) action \\ 's \\ ('c, 't) zone \\ bool\"\n(\"_ \\ \\_, _\\ \\\\<^bsup>_\\<^esup> \\_, _\\\" [61,61,61,61] 61)\nwhere\n step_trans_t_z:\n \"A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l, Z\\<^sup>\\ \\ {u. u \\ inv_of A l}\\\" |\n step_trans_a_z:\n \"A \\ \\l, Z\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l', zone_set (Z \\ {u. u \\ g}) r \\ {u. u \\ inv_of A l'}\\\"\n if \"A \\ l \\\\<^bsup>g,a,r\\<^esup> l'\"\n\ninductive step_trans_z' ::\n \"('a, 'c, 't, 's) ta \\ 's \\ ('c, ('t::time)) zone \\ (('c, 't) cconstraint \\ 'a \\ 'c list)\n \\ 's \\ ('c, 't) zone \\ bool\"\n(\"_ \\'' \\_, _\\ \\\\<^bsup>_\\<^esup> \\_, _\\\" [61,61,61,61] 61)\nwhere\n step_trans_z':\n \"A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l, Z'\\ \\ A \\ \\l, Z'\\ \\\\<^bsup>\\t\\<^esup> \\l', Z''\\ \\ A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z''\\\"\n\nlemmas [intro] =\n step_trans.intros\n step_trans'.intros\n step_trans_z.intros\n step_trans_z'.intros\n\ncontext\n notes [elim!] =\n step.cases step_t.cases\n step_trans.cases step_trans'.cases step_trans_z.cases step_trans_z'.cases\nbegin\n\nlemma step_trans_t_z_sound:\n \"A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l',Z'\\ \\ \\ u' \\ Z'. \\ u \\ Z. \\ d. A \\ \\l, u\\ \\\\<^bsup>d\\<^esup> \\l',u'\\\"\n by (auto 4 5 simp: zone_delay_def zone_set_def)\n\nlemma step_trans_a_z_sound:\n \"A \\ \\l, Z\\ \\\\<^bsup>\\t\\<^esup> \\l',Z'\\ \\ \\ u' \\ Z'. \\ u \\ Z. \\ d. A \\\\<^sub>t \\l, u\\ \\\\<^bsub>t\\<^esub> \\l',u'\\\"\n by (auto 4 4 simp: zone_delay_def zone_set_def)\n\nlemma step_trans_a_z_complete:\n \"A \\\\<^sub>t \\l, u\\ \\\\<^bsub>t\\<^esub> \\l', u'\\ \\ u \\ Z \\ \\ Z'. A \\ \\l, Z\\ \\\\<^bsup>\\t\\<^esup> \\l', Z'\\ \\ u' \\ Z'\"\n by (auto 4 4 simp: zone_delay_def zone_set_def elim!: step_a.cases)\n\nlemma step_trans_t_z_complete:\n \"A \\ \\l, u\\ \\\\<^bsup>d\\<^esup> \\l', u'\\ \\ u \\ Z \\ \\ Z'. A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l', Z'\\ \\ u' \\ Z'\"\n by (auto 4 4 simp: zone_delay_def zone_set_def elim!: step_a.cases)\n\nlemma step_trans_t_z_iff:\n \"A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l', Z'\\ = A \\ \\l, Z\\ \\\\<^bsub>\\\\<^esub> \\l', Z'\\\"\n by auto\n\n\n\nlemma step_trans_a_z_exact:\n \"u' \\ Z'\" if \"A \\\\<^sub>t \\l, u\\ \\\\<^bsub>t\\<^esub> \\l', u'\\\" \"A \\ \\l, Z\\ \\\\<^bsup>\\t\\<^esup> \\l', Z'\\\" \"u \\ Z\"\n using that by (auto 4 4 simp: zone_delay_def zone_set_def)\n\nlemma step_trans_t_z_exact:\n \"u' \\ Z'\" if \"A \\ \\l, u\\ \\\\<^bsup>d\\<^esup> \\l', u'\\\" \"A \\ \\l, Z\\ \\\\<^bsup>\\\\<^esup> \\l', Z'\\\" \"u \\ Z\"\n using that by (auto simp: zone_delay_def)\n\nlemma step_trans_z'_exact:\n \"u' \\ Z'\" if \"A \\' \\l, u\\ \\\\<^bsup>t\\<^esup> \\l', u'\\\" \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z'\\\" \"u \\ Z\"\n using that by (auto 4 4 simp: zone_delay_def zone_set_def)\n\nlemma step_trans_z_step_z_action:\n \"A \\ \\l, Z\\ \\\\<^bsub>\\a\\<^esub> \\l',Z'\\\" if \"A \\ \\l, Z\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l', Z'\\\"\n using that by auto\n\nlemma step_trans_z_step_z:\n \"\\ a. A \\ \\l, Z\\ \\\\<^bsub>a\\<^esub> \\l',Z'\\\" if \"A \\ \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z'\\\"\n using that by auto\n\nlemma step_z_step_trans_z_action:\n \"\\ g r. A \\ \\l, Z\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l', Z'\\\" if \"A \\ \\l, Z\\ \\\\<^bsub>\\a\\<^esub> \\l',Z'\\\"\n using that by (auto 4 4)\n\nlemma step_z_step_trans_z:\n \"\\ t. A \\ \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z'\\\" if \"A \\ \\l, Z\\ \\\\<^bsub>a\\<^esub> \\l',Z'\\\"\n using that by cases auto\n\nend (* Automation *)\n\nlemma step_z'_step_trans_z':\n \"\\ t. A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z''\\\" if \"A \\ \\l, Z\\ \\ \\l', Z''\\\"\n using that unfolding step_z'_def\n by (auto dest!: step_z_step_trans_z_action simp: step_trans_t_z_iff[symmetric])\n\nlemma step_trans_z'_step_z':\n \"A \\ \\l, Z\\ \\ \\l', Z''\\\" if \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z''\\\"\n using that unfolding step_z'_def\n by (auto elim!: step_trans_z'.cases dest!: step_trans_z_step_z_action simp: step_trans_t_z_iff)\n\nlemma step_trans_z_determ:\n \"Z1 = Z2\" if \"A \\ \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z1\\\" \"A \\ \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z2\\\"\n using that by (auto elim!: step_trans_z.cases)\n\nlemma step_trans_z'_determ:\n \"Z1 = Z2\" if \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z1\\\" \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z2\\\"\n using that by (auto elim!: step_trans_z'.cases step_trans_z.cases)\n\nlemma (in Alpha_defs) step_trans_z_V: \"A \\ \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l',Z'\\ \\ Z \\ V \\ Z' \\ V\"\n by (induction rule: step_trans_z.induct; blast intro!: reset_V le_infI1 up_V)\n\nsubsection \\Additional Lemmas on Regions\\\n\ncontext AlphaClosure\nbegin\n\ninductive step_trans_r ::\n \"('a, 'c, t, 's) ta \\ _ \\ 's \\ ('c, t) zone \\ (('c, t) cconstraint \\ 'a \\ 'c list) action\n \\ 's \\ ('c, t) zone \\ bool\"\n(\"_,_ \\ \\_, _\\ \\\\<^bsup>_\\<^esup> \\_, _\\\" [61,61,61,61,61] 61)\nwhere\n step_trans_t_r:\n \"A,\\ \\ \\l,R\\ \\\\<^bsup>\\\\<^esup> \\l,R'\\\" if\n \"valid_abstraction A X (\\ x. real o k x)\" \"R \\ \\ l\" \"R' \\ Succ (\\ l) R\" \"R' \\ \\inv_of A l\\\" |\n step_trans_a_r:\n \"A,\\ \\ \\l,R\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l', R'\\\" if\n \"valid_abstraction A X (\\ x. real o k x)\" \"A \\ l \\\\<^bsup>g,a,r\\<^esup> l'\" \"R \\ \\ l\"\n \"R \\ \\g\\\" \"region_set' R r 0 \\ R'\" \"R' \\ \\inv_of A l'\\\" \"R' \\ \\ l'\"\n\nlemmas [intro] = step_trans_r.intros\n\nlemma step_trans_t_r_iff[simp]:\n \"A,\\ \\ \\l,R\\ \\\\<^bsup>\\\\<^esup> \\l',R'\\ = A,\\ \\ \\l,R\\ \\\\<^bsub>\\\\<^esub> \\l',R'\\\"\n by (auto elim!: step_trans_r.cases)\n\nlemma step_trans_r_step_r_action:\n \"A,\\ \\ \\l,R\\ \\\\<^bsub>\\a\\<^esub> \\l',R'\\\" if \"A,\\ \\ \\l,R\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l',R'\\\"\n using that by (auto elim: step_trans_r.cases)\n\nlemma step_r_step_trans_r_action:\n \"\\ g r. A,\\ \\ \\l,R\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l',R'\\\" if \"A,\\ \\ \\l,R\\ \\\\<^bsub>\\a\\<^esub> \\l',R'\\\"\n using that by (auto elim: step_trans_r.cases)\n\ninductive step_trans_r' ::\n \"('a, 'c, t, 's) ta \\ _ \\ 's \\ ('c, t) zone \\ ('c, t) cconstraint \\ 'a \\ 'c list\n \\ 's \\ ('c, t) zone \\ bool\"\n(\"_,_ \\'' \\_, _\\ \\\\<^bsup>_\\<^esup> \\_, _\\\" [61,61,61,61,61] 61)\nwhere\n \"A,\\ \\' \\l,R\\ \\\\<^bsup>t\\<^esup> \\l',R''\\\" if \"A,\\ \\ \\l,R\\ \\\\<^bsup>\\\\<^esup> \\l,R'\\\" \"A,\\ \\ \\l,R'\\ \\\\<^bsup>\\t\\<^esup> \\l', R''\\\"\n\nlemma step_trans_r'_step_r':\n \"A,\\ \\ \\l,R\\ \\\\<^sub>a \\l',R'\\\" if \"A,\\ \\' \\l,R\\ \\\\<^bsup>(g,a,r)\\<^esup> \\l',R'\\\"\n using that by cases (auto dest: step_trans_r_step_r_action intro!: step_r'.intros)\n\nlemma step_r'_step_trans_r':\n \"\\ g r. A,\\ \\' \\l,R\\ \\\\<^bsup>(g,a,r)\\<^esup> \\l',R'\\\" if \"A,\\ \\ \\l,R\\ \\\\<^sub>a \\l',R'\\\"\n using that by cases (auto dest: step_r_step_trans_r_action intro!: step_trans_r'.intros)\n\nlemma step_trans_a_r_sound:\n assumes \"A,\\ \\ \\l, R\\ \\\\<^bsup>\\a\\<^esup> \\l',R'\\\"\n shows \"\\ u \\ R. \\ u' \\ R'. A \\\\<^sub>t \\l, u\\ \\\\<^bsub>a\\<^esub> \\l',u'\\\"\nusing assms proof cases\n case A: (step_trans_a_r g a r)\n show ?thesis\n unfolding A(1) proof\n fix u assume \"u \\ R\"\n from \\u \\ R\\ A have \"u \\ g\" \"[r\\0]u \\ inv_of A l'\" \"[r\\0]u \\ R'\"\n unfolding region_set'_def ccval_def by auto\n with A show \"\\u'\\R'. A \\\\<^sub>t \\l, u\\ \\\\<^bsub>(g,a,r)\\<^esub> \\l',u'\\\"\n by auto\n qed\nqed\n\nlemma step_trans_r'_sound:\n assumes \"A,\\ \\' \\l, R\\ \\\\<^bsup>t\\<^esup> \\l', R'\\\"\n shows \"\\u\\R. \\u'\\R'. A \\' \\l, u\\ \\\\<^bsup>t\\<^esup> \\l', u'\\\"\n using assms by cases (auto 6 0 dest!: step_trans_a_r_sound step_t_r_sound)\n\nend (* Alpha Closure *)\n\ncontext AlphaClosure\nbegin\n\ncontext\n fixes l l' :: 's and A :: \"('a, 'c, t, 's) ta\"\n assumes valid_abstraction: \"valid_abstraction A X k\"\nbegin\n\ninterpretation alpha: AlphaClosure_global _ \"k l\" \"\\ l\" by standard (rule finite)\n\n\ninterpretation alpha': AlphaClosure_global _ \"k l'\" \"\\ l'\" by standard (rule finite)\nlemma [simp]: \"alpha'.cla = cla l'\" unfolding alpha'.cla_def cla_def ..\n\nlemma regions_poststable1:\n assumes\n \"A \\ \\l, Z\\ \\\\<^bsup>a\\<^esup> \\l',Z'\\\" \"Z \\ V\" \"R' \\ \\ l'\" \"R' \\ Z' \\ {}\"\n shows \"\\ R \\ \\ l. A,\\ \\ \\l,R\\ \\\\<^bsup>a\\<^esup> \\l',R'\\ \\ R \\ Z \\ {}\"\nusing assms proof (induction A \\ A l \\ l _ _ l' \\ l' _rule: step_trans_z.induct)\n case A: (step_trans_t_z Z)\n from \\R' \\ (Z\\<^sup>\\ \\ {u. u \\ inv_of A l}) \\ {}\\ obtain u d where u:\n \"u \\ Z\" \"u \\ d \\ R'\" \"u \\ d \\ inv_of A l\" \"0 \\ d\"\n unfolding zone_delay_def by blast+\n with alpha.closure_subs[OF A(2)] obtain R where R1: \"u \\ R\" \"R \\ \\ l\"\n by (simp add: cla_def) blast\n from \\Z \\ V\\ \\u \\ Z\\ have \"\\x\\X. 0 \\ u x\" unfolding V_def by fastforce\n from region_cover'[OF this] have R: \"[u]\\<^sub>l \\ \\ l\" \"u \\ [u]\\<^sub>l\" by auto\n from SuccI2[OF \\_def' this(2,1) \\0 \\ d\\ HOL.refl] u(2) have v'1:\n \"[u \\ d]\\<^sub>l \\ Succ (\\ l) ([u]\\<^sub>l)\" \"[u \\ d]\\<^sub>l \\ \\ l\"\n by auto\n from alpha.regions_closed'_spec[OF R(1,2) \\0 \\ d\\] have v'2: \"u \\ d \\ [u \\ d]\\<^sub>l\" by simp\n from valid_abstraction have\n \"\\(x, m)\\clkp_set A l. m \\ real (k l x) \\ x \\ X \\ m \\ \\\"\n by (auto elim!: valid_abstraction.cases)\n then have\n \"\\(x, m)\\collect_clock_pairs (inv_of A l). m \\ real (k l x) \\ x \\ X \\ m \\ \\\"\n unfolding clkp_set_def collect_clki_def inv_of_def by fastforce\n from ccompatible[OF this, folded \\_def'] v'1(2) v'2 u(2,3) have\n \"[u \\ d]\\<^sub>l \\ \\inv_of A l\\\"\n unfolding ccompatible_def ccval_def by auto\n from\n alpha.valid_regions_distinct_spec[OF v'1(2) _ v'2 \\u \\ d \\ R'\\] \\R' \\ _\\ \\l = l'\\\n alpha.region_unique_spec[OF R1]\n have \"[u \\ d]\\<^sub>l = R'\" \"[u]\\<^sub>l = R\" by auto\n from valid_abstraction \\R \\ _\\ \\_ \\ Succ (\\ l) _\\ \\_ \\ \\inv_of A l\\\\ have\n \"A,\\ \\ \\l, R\\ \\\\<^bsub>\\\\<^esub> \\l, R'\\\"\n by (auto simp: comp_def \\[u \\ d]\\<^sub>l = R'\\ \\_ = R\\)\n with \\l = l'\\ \\R \\ _\\ \\u \\ R\\ \\u \\ Z\\ show ?case by - (rule bexI[where x = R]; auto)\nnext\n case A: (step_trans_a_z g a r Z)\n from A(4) obtain u v' where\n \"u \\ Z\" and v': \"v' = [r\\0]u\" \"u \\ g\" \"v' \\ inv_of A l'\" \"v' \\ R'\"\n unfolding zone_set_def by blast\n from \\u \\ Z\\ alpha.closure_subs[OF A(2)] A(1) obtain u' R where u':\n \"u \\ R\" \"u' \\ R\" \"R \\ \\ l\"\n by (simp add: cla_def) blast\n then have \"\\x\\X. 0 \\ u x\" unfolding \\_def by fastforce\n from region_cover'[OF this] have \"[u]\\<^sub>l \\ \\ l\" \"u \\ [u]\\<^sub>l\" by auto\n have *:\n \"[u]\\<^sub>l \\ \\g\\\" \"region_set' ([u]\\<^sub>l) r 0 \\ [[r\\0]u]\\<^sub>l'\"\n \"[[r\\0]u]\\<^sub>l' \\ \\ l'\" \"[[r\\0]u]\\<^sub>l' \\ \\inv_of A l'\\\"\n proof -\n from valid_abstraction have \"collect_clkvt (trans_of A) \\ X\"\n \"\\ l g a r l' c. A \\ l \\\\<^bsup>g,a,r\\<^esup> l' \\ c \\ set r \\ k l' c \\ k l c\"\n by (auto elim: valid_abstraction.cases)\n with A(1) have \"set r \\ X\" \"\\y. y \\ set r \\ k l' y \\ k l y\"\n unfolding collect_clkvt_def by (auto 4 8)\n with\n region_set_subs[\n of _ X \"k l\" _ 0, where k' = \"k l'\", folded \\_def, OF \\[u]\\<^sub>l \\ \\ l\\ \\u \\ [u]\\<^sub>l\\ finite\n ]\n show \"region_set' ([u]\\<^sub>l) r 0 \\ [[r\\0]u]\\<^sub>l'\" \"[[r\\0]u]\\<^sub>l' \\ \\ l'\" by auto\n from valid_abstraction have *:\n \"\\l. \\(x, m)\\clkp_set A l. m \\ real (k l x) \\ x \\ X \\ m \\ \\\"\n by (fastforce elim: valid_abstraction.cases)+\n with A(1) have \"\\(x, m)\\collect_clock_pairs g. m \\ real (k l x) \\ x \\ X \\ m \\ \\\"\n unfolding clkp_set_def collect_clkt_def by fastforce\n from \\u \\ [u]\\<^sub>l\\ \\[u]\\<^sub>l \\ \\ l\\ ccompatible[OF this, folded \\_def] \\u \\ g\\ show \"[u]\\<^sub>l \\ \\g\\\"\n unfolding ccompatible_def ccval_def by blast\n have **: \"[r\\0]u \\ [[r\\0]u]\\<^sub>l'\"\n using \\R' \\ \\ l'\\ \\v' \\ R'\\ alpha'.region_unique_spec v'(1) by blast\n from * have\n \"\\(x, m)\\collect_clock_pairs (inv_of A l'). m \\ real (k l' x) \\ x \\ X \\ m \\ \\\"\n unfolding inv_of_def clkp_set_def collect_clki_def by fastforce\n from ** \\[[r\\0]u]\\<^sub>l' \\ \\ l'\\ ccompatible[OF this, folded \\_def] \\v' \\ _\\ show\n \"[[r\\0]u]\\<^sub>l' \\ \\inv_of A l'\\\"\n unfolding ccompatible_def ccval_def \\v' = _\\ by blast\n qed\n from * \\v' = _\\ \\u \\ [u]\\<^sub>l\\ have \"v' \\ [[r\\0]u]\\<^sub>l'\" unfolding region_set'_def by auto\n from alpha'.valid_regions_distinct_spec[OF *(3) \\R' \\ \\ l'\\ \\v' \\ [[r\\0]u]\\<^sub>l'\\ \\v' \\ R'\\]\n have \"[[r\\0]u]\\<^sub>l' = R'\" .\n from alpha.region_unique_spec[OF u'(1,3)] have \"[u]\\<^sub>l = R\" by auto\n from A valid_abstraction \\R \\ _\\ * have \"A,\\ \\ \\l, R\\ \\\\<^bsup>\\(g,a,r)\\<^esup> \\l', R'\\\"\n by (auto simp: comp_def \\_ = R'\\ \\_ = R\\)\n with \\R \\ _\\ \\u \\ R\\ \\u \\ Z\\ show ?case by - (rule bexI[where x = R]; auto)\nqed\n\nlemma regions_poststable':\n assumes\n \"A \\ \\l, Z\\ \\\\<^bsub>a\\<^esub> \\l',Z'\\\" \"Z \\ V\" \"R' \\ \\ l'\" \"R' \\ Z' \\ {}\"\n shows \"\\ R \\ \\ l. A,\\ \\ \\l,R\\ \\\\<^bsub>a\\<^esub> \\l',R'\\ \\ R \\ Z \\ {}\"\n using assms\n by (cases a)\n (auto dest!: regions_poststable1 dest: step_trans_r_step_r_action step_z_step_trans_z_action\n simp: step_trans_t_z_iff[symmetric]\n )\n\nend (* End of context for fixed locations *)\n\nlemma regions_poststable2:\n assumes valid_abstraction: \"valid_abstraction A X k\"\n and prems: \"A \\' \\l, Z\\ \\\\<^bsup>a\\<^esup> \\l',Z'\\\" \"Z \\ V\" \"R' \\ \\ l'\" \"R' \\ Z' \\ {}\"\n shows \"\\ R \\ \\ l. A,\\ \\' \\l,R\\ \\\\<^bsup>a\\<^esup> \\l',R'\\ \\ R \\ Z \\ {}\"\nusing prems(1) proof (cases)\n case steps: (step_trans_z' Z1)\n with prems have \"Z1 \\ V\"\n by (blast dest: step_trans_z_V)\n from regions_poststable1[OF valid_abstraction steps(2) \\Z1 \\ V\\ prems(3,4)] obtain R1 where R1:\n \"R1 \\ \\ l\" \"A,\\ \\ \\l, R1\\ \\\\<^bsup>\\a\\<^esup> \\l', R'\\\" \"R1 \\ Z1 \\ {}\"\n by auto\n from regions_poststable1[OF valid_abstraction steps(1) \\Z \\ V\\ R1(1,3)] obtain R where\n \"R\\\\ l\" \"A,\\ \\ \\l, R\\ \\\\<^bsup>\\\\<^esup> \\l, R1\\\" \"R \\ Z \\ {}\"\n by auto\n with R1(2) show ?thesis\n by (auto intro: step_trans_r'.intros)\nqed\n\ntext \\\n Poststability of Closures:\n For every transition in the zone graph and each region in the closure of the resulting zone,\n there exists a similar transition in the region graph.\n\\\nlemma regions_poststable:\n assumes valid_abstraction: \"valid_abstraction A X k\"\n and A:\n \"A \\ \\l, Z\\ \\\\<^bsub>\\\\<^esub> \\l',Z'\\\" \"A \\ \\l', Z'\\ \\\\<^bsub>\\a\\<^esub> \\l'',Z''\\\"\n \"Z \\ V\" \"R'' \\ \\ l''\" \"R'' \\ Z'' \\ {}\"\n shows \"\\ R \\ \\ l. A,\\ \\ \\l,R\\ \\\\<^sub>a \\l'',R''\\ \\ R \\ Z \\ {}\"\nproof -\n from A(1) \\Z \\ V\\ have \"Z' \\ V\" by (rule step_z_V)\n from A(1) have [simp]: \"l' = l\" by auto\n from regions_poststable'[OF valid_abstraction A(2) \\Z' \\ V\\ \\R'' \\ _\\ \\R'' \\ Z'' \\ {}\\] obtain R'\n where R': \"R'\\\\ l'\" \"A,\\ \\ \\l', R'\\ \\\\<^bsub>\\a\\<^esub> \\l'', R''\\\" \"R' \\ Z' \\ {}\"\n by auto\n from regions_poststable'[OF valid_abstraction A(1) \\Z \\ V\\ R'(1,3)] obtain R where\n \"R \\ \\ l\" \"A,\\ \\ \\l, R\\ \\\\<^bsub>\\\\<^esub> \\l, R'\\\" \"R \\ Z \\ {}\"\n by auto\n with R'(2) show ?thesis by - (rule bexI[where x = \"R\"]; auto intro: step_r'.intros)\nqed\n\nlemma step_t_r_loc:\n \"l' = l\" if \"A,\\ \\ \\l, R\\ \\\\<^bsub>\\\\<^esub> \\l', R'\\\"\n using that by cases auto\n\nlemma \\_V:\n \"u \\ V\" if \"R \\ \\ l\" \"u \\ R\"\n using that unfolding \\_def V_def by auto\n\nlemma step_r'_complete:\n assumes \"A \\' \\l, u\\ \\ \\l',u'\\\" \"valid_abstraction A X (\\ x. real o k x)\" \"u \\ V\"\n shows \"\\ a R'. u' \\ R' \\ A,\\ \\ \\l, [u]\\<^sub>l\\ \\\\<^sub>a \\l',R'\\\"\n using assms\n apply cases\n apply (drule step_t_r_complete, (rule assms; fail), simp add: V_def)\n apply clarify\n apply (frule step_a_r_complete)\n by (auto dest: step_t_r_loc simp: \\_def simp: region_unique intro!: step_r'.intros)\n\nlemma step_r_\\:\n \"R' \\ \\ l'\" if \"A,\\ \\ \\l, R\\ \\\\<^bsub>a\\<^esub> \\l', R'\\\"\n using that by (auto elim: step_r.cases)\n\nlemma step_r'_\\:\n \"R' \\ \\ l'\" if \"A,\\ \\ \\l, R\\ \\\\<^sub>a \\l', R'\\\"\n using that by (auto intro: step_r_\\ elim: step_r'.cases)\n\nend (* End of Alpha Closure *)\n\ncontext Regions\nbegin\n\nlemma closure_parts_mono:\n \"{R \\ \\ l. R \\ Z \\ {}} \\ {R \\ \\ l. R \\ Z' \\ {}}\" if \"Closure\\<^sub>\\\\<^sub>,\\<^sub>l Z \\ Closure\\<^sub>\\\\<^sub>,\\<^sub>l Z'\"\nproof (clarify, goal_cases)\n case prems: (1 R)\n with that have \"R \\ Closure\\<^sub>\\\\<^sub>,\\<^sub>l Z'\"\n unfolding cla_def by auto\n from \\_ \\ {}\\ obtain u where \"u \\ R\" \"u \\ Z\" by auto\n with \\R \\ _\\ obtain R' where \"R' \\ \\ l\" \"u \\ R'\" \"R' \\ Z' \\ {}\" unfolding cla_def by force\n from \\_regions_distinct[OF \\_def' this(1,2) \\R \\ _\\] \\u \\ R\\ have \"R = R'\" by auto\n with \\R' \\ Z' \\ {}\\ \\R \\ Z' = {}\\ show ?case by simp\nqed\n\nlemma closure_parts_id:\n \"{R \\ \\ l. R \\ Z \\ {}} = {R \\ \\ l. R \\ Z' \\ {}}\" if\n \"Closure\\<^sub>\\\\<^sub>,\\<^sub>l Z = Closure\\<^sub>\\\\<^sub>,\\<^sub>l Z'\"\n using closure_parts_mono that by blast\n\nparagraph \\More lemmas on regions\\\n\n(* XXX All of these should be considered for moving into the locales for global sets of regions *)\ncontext\n fixes l' :: 's\nbegin\n\ninterpretation regions: Regions_global _ _ _ \"k l'\"\n by standard (rule finite clock_numbering not_in_X non_empty)+\n\ncontext\n fixes A :: \"('a, 'c, t, 's) ta\"\n assumes valid_abstraction: \"valid_abstraction A X k\"\nbegin\n\nlemmas regions_poststable = regions_poststable[OF valid_abstraction]\n\nlemma clkp_set_clkp_set1:\n \"\\ l. (c, x) \\ clkp_set A l\" if \"(c, x) \\ Timed_Automata.clkp_set A\"\n using that\n unfolding Timed_Automata.clkp_set_def Closure.clkp_set_def\n unfolding Timed_Automata.collect_clki_def Closure.collect_clki_def\n unfolding Timed_Automata.collect_clkt_def Closure.collect_clkt_def\n by fastforce\n\nlemma clkp_set_clkp_set2:\n \"(c, x) \\ Timed_Automata.clkp_set A\" if \"(c, x) \\ clkp_set A l\" for l\n using that\n unfolding Timed_Automata.clkp_set_def Closure.clkp_set_def\n unfolding Timed_Automata.collect_clki_def Closure.collect_clki_def\n unfolding Timed_Automata.collect_clkt_def Closure.collect_clkt_def\n by fastforce\n\nlemma clock_numbering_le: \"\\c\\clk_set A. v c \\ n\"\nproof\n fix c assume \"c \\ clk_set A\"\n then have \"c \\ X\"\n proof (safe, clarsimp, goal_cases)\n case (1 x)\n then obtain l where \"(c, x) \\ clkp_set A l\" by (auto dest: clkp_set_clkp_set1)\n with valid_abstraction show \"c \\ X\" by (auto elim!: valid_abstraction.cases)\n next\n case 2\n with valid_abstraction show \"c \\ X\" by (auto elim!: valid_abstraction.cases)\n qed\n with clock_numbering show \"v c \\ n\" by auto\nqed\n\nlemma beta_alpha_step:\n \"A \\ \\l, Z\\ \\\\<^bsub>\\(a)\\<^esub> \\l', Closure\\<^sub>\\\\<^sub>,\\<^sub>l' Z'\\\" if \"A \\ \\l, Z\\ \\\\<^bsub>\\(a)\\<^esub> \\l', Z'\\\" \"Z \\ V'\"\nproof -\n from that obtain Z1' where Z1': \"Z' = Approx\\<^sub>\\ l' Z1'\" \"A \\ \\l, Z\\ \\\\<^bsub>a\\<^esub> \\l', Z1'\\\"\n by (clarsimp elim!: step_z_beta.cases)\n with \\Z \\ V'\\ have \"Z1' \\ V'\"\n using valid_abstraction clock_numbering_le by (auto intro: step_z_V')\n let ?alpha = \"Closure\\<^sub>\\\\<^sub>,\\<^sub>l' Z1'\" and ?beta = \"Closure\\<^sub>\\\\<^sub>,\\<^sub>l' (Approx\\<^sub>\\ l' Z1')\"\n have \"?beta \\ ?alpha\"\n using regions.approx_\\_closure_\\'[OF \\Z1' \\ V'\\] regions.alpha_interp.closure_involutive\n by (auto 4 3 dest: regions.alpha_interp.cla_mono)\n moreover have \"?alpha \\ ?beta\"\n by (intro regions.alpha_interp.cla_mono[simplified] regions.beta_interp.apx_subset)\n ultimately have \"?beta = ?alpha\" ..\n with Z1' show ?thesis by auto\nqed\n\nlemma beta_alpha_region_step:\n \"\\ a. \\ R \\ \\ l. R \\ Z \\ {} \\ A,\\ \\ \\l, R\\ \\\\<^sub>a \\l', R'\\\" if\n \"A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\\" \"Z \\ V'\" \"R' \\ \\ l'\" \"R' \\ Z' \\ {}\"\nproof -\n from that(1) obtain l'' a Z'' where steps:\n \"A \\ \\l, Z\\ \\\\<^bsub>\\\\<^esub> \\l'', Z''\\\" \"A \\ \\l'', Z''\\ \\\\<^bsub>\\(\\a)\\<^esub> \\l', Z'\\\"\n unfolding step_z_beta'_def by metis\n with \\Z \\ V'\\ steps(1) have \"Z'' \\ V'\"\n using valid_abstraction clock_numbering_le by (blast intro: step_z_V')\n from beta_alpha_step[OF steps(2) this] have \"A \\ \\l'', Z''\\ \\\\<^bsub>\\\\a\\<^esub> \\l', Closure\\<^sub>\\\\<^sub>,\\<^sub>l'(Z')\\\" .\n from step_z_alpha.cases[OF this] obtain Z1 where Z1:\n \"A \\ \\l'', Z''\\ \\\\<^bsub>\\a\\<^esub> \\l', Z1\\\" \"Closure\\<^sub>\\\\<^sub>,\\<^sub>l'(Z') = Closure\\<^sub>\\\\<^sub>,\\<^sub>l'(Z1)\"\n by metis\n from closure_parts_id[OF this(2)] that(3,4) have \"R' \\ Z1 \\ {}\" by blast\n from regions_poststable[OF steps(1) Z1(1) _ \\R' \\ _\\ this] \\Z \\ V'\\ show ?thesis\n by (auto dest: V'_V)\nqed\n\nlemmas step_z_beta'_V' = step_z_beta'_V'[OF valid_abstraction clock_numbering_le]\n\nlemma step_trans_z'_closure_subs:\n assumes\n \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z'\\\" \"Z \\ V\" \"\\ R \\ \\ l. R \\ Z \\ {} \\ R \\ W \\ {}\"\n shows\n \"\\ W'. A \\' \\l, W\\ \\\\<^bsup>t\\<^esup> \\l', W'\\ \\ (\\ R \\ \\ l'. R \\ Z' \\ {} \\ R \\ W' \\ {})\"\nproof -\n from assms(1) obtain W' where step: \"A \\' \\l, W\\ \\\\<^bsup>t\\<^esup> \\l', W'\\\"\n by (auto elim!: step_trans_z.cases step_trans_z'.cases)\n have \"R' \\ W' \\ {}\" if \"R' \\ \\ l'\" \"R' \\ Z' \\ {}\" for R'\n proof -\n from regions_poststable2[OF valid_abstraction assms(1) _ that] \\Z \\ V\\ obtain R where R:\n \"R\\\\ l\" \"A,\\ \\' \\l, R\\ \\\\<^bsup>t\\<^esup> \\l', R'\\\" \"R \\ Z \\ {}\"\n by auto\n with assms(3) obtain u where \"u \\ R\" \"u \\ W\"\n by auto\n with step_trans_r'_sound[OF R(2)] obtain u' where \"u' \\ R'\" \"A \\' \\l, u\\ \\\\<^bsup>t\\<^esup> \\l', u'\\\"\n by auto\n with step_trans_z'_exact[OF this(2) step \\u \\ W\\] show ?thesis\n by auto\n qed\n with step show ?thesis\n by auto\nqed\n\nlemma step_trans_z'_closure_eq:\n assumes\n \"A \\' \\l, Z\\ \\\\<^bsup>t\\<^esup> \\l', Z'\\\" \"Z \\ V\" \"W \\ V\" \"\\ R \\ \\ l. R \\ Z \\ {} \\ R \\ W \\ {}\"\n shows\n \"\\ W'. A \\' \\l, W\\ \\\\<^bsup>t\\<^esup> \\l', W'\\ \\ (\\ R \\ \\ l'. R \\ Z' \\ {} \\ R \\ W' \\ {})\"\nproof -\n from assms(4) have *:\n \"\\ R \\ \\ l. R \\ Z \\ {} \\ R \\ W \\ {}\" \"\\ R \\ \\ l. R \\ W \\ {} \\ R \\ Z \\ {}\"\n by auto\n from step_trans_z'_closure_subs[OF assms(1,2) *(1)] obtain W' where W':\n \"A \\' \\l, W\\ \\\\<^bsup>t\\<^esup> \\l', W'\\\" \"(\\R\\\\ l'. R \\ Z' \\ {} \\ R \\ W' \\ {})\"\n by auto\n with step_trans_z'_closure_subs[OF W'(1) \\W \\ V\\ *(2)] assms(1) show ?thesis\n by (fastforce dest: step_trans_z'_determ)\nqed\n\nlemma step_z'_closure_subs:\n assumes \n \"A \\ \\l, Z\\ \\ \\l', Z'\\\" \"Z \\ V\" \"\\ R \\ \\ l. R \\ Z \\ {} \\ R \\ W \\ {}\"\n shows\n \"\\ W'. A \\ \\l, W\\ \\ \\l', W'\\ \\ (\\ R \\ \\ l'. R \\ Z' \\ {} \\ R \\ W' \\ {})\"\n using assms(1)\n by (auto\n dest: step_trans_z'_step_z'\n dest!: step_z'_step_trans_z' step_trans_z'_closure_subs[OF _ assms(2,3)]\n )\n\nend (* Context for automaton *)\n\nlemma apx_finite:\n \"finite {Approx\\<^sub>\\ l' Z | Z. Z \\ V}\" (is \"finite ?S\")\nproof -\n have \"finite regions.\\\\<^sub>\\\"\n by (simp add: regions.beta_interp.finite_\\)\n then have \"finite {S. S \\ regions.\\\\<^sub>\\}\"\n by auto\n then have \"finite {\\ S | S. S \\ regions.\\\\<^sub>\\}\"\n by auto\n moreover have \"?S \\ {\\ S | S. S \\ regions.\\\\<^sub>\\}\"\n by (auto dest!: regions.beta_interp.apx_in)\n ultimately show ?thesis by (rule finite_subset[rotated])\nqed\n\nlemmas apx_subset = regions.beta_interp.apx_subset\n\nlemma step_z_beta'_empty:\n \"Z' = {}\" if \"A \\ \\l, {}\\ \\\\<^sub>\\ \\l', Z'\\\"\n using that\n by (auto\n elim!: step_z.cases\n simp: step_z_beta'_def regions.beta_interp.apx_empty zone_delay_def zone_set_def\n )\n\nend (* End of context for fixed location *)\n\nlemma step_z_beta'_complete:\n assumes \"A \\' \\l, u\\ \\ \\l', u'\\\" \"u \\ Z\" \"Z \\ V\"\n shows \"\\ Z'. A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ u' \\ Z'\"\nproof -\n from assms(1) obtain l'' u'' d a where steps:\n \"A \\ \\l, u\\ \\\\<^bsup>d\\<^esup> \\l'', u''\\\" \"A \\ \\l'', u''\\ \\\\<^bsub>a\\<^esub> \\l', u'\\\"\n by (force elim!: step'.cases)\n then obtain Z'' where\n \"A \\ \\l, Z\\ \\\\<^bsub>\\\\<^esub> \\l'', Z''\\\" \"u'' \\ Z''\"\n by (meson \\u \\ Z\\ step_t_z_complete)\n moreover with steps(2) obtain Z' where\n \"A \\ \\l'', Z''\\ \\\\<^bsub>\\a\\<^esub> \\l', Z'\\\" \"u' \\ Z'\"\n by (meson \\u'' \\ Z''\\ step_a_z_complete)\n ultimately show ?thesis\n unfolding step_z_beta'_def using \\Z \\ V\\ apx_subset by blast\nqed\n\nend (* End of Regions *)\n\n\nsubsection \\Instantiation of Double Simulation\\\n\nsubsection \\Auxiliary Definitions\\\n\ndefinition state_set :: \"('a, 'c, 'time, 's) ta \\ 's set\" where\n \"state_set A \\ fst ` (fst A) \\ (snd o snd o snd o snd) ` (fst A)\"\n\nlemma finite_trans_of_finite_state_set:\n \"finite (state_set A)\" if \"finite (trans_of A)\"\n using that unfolding state_set_def trans_of_def by auto\n\nlemma state_setI1:\n \"l \\ state_set A\" if \"A \\ l \\\\<^bsup>g,a,r\\<^esup> l'\"\n using that unfolding state_set_def trans_of_def image_def by (auto 4 4)\n\nlemma state_setI2:\n \"l' \\ state_set A\" if \"A \\ l \\\\<^bsup>g,a,r\\<^esup> l'\"\n using that unfolding state_set_def trans_of_def image_def by (auto 4 4)\n\nlemma (in AlphaClosure) step_r'_state_set:\n \"l' \\ state_set A\" if \"A,\\ \\ \\l, R\\ \\\\<^sub>a \\l', R'\\\"\n using that by (blast intro: state_setI2 elim: step_r'.cases)\n\nlemma (in Regions) step_z_beta'_state_set2:\n \"l' \\ state_set A\" if \"A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\\"\n using that unfolding step_z_beta'_def by (force simp: state_set_def trans_of_def)\n\nsubsection \\Instantiation\\\n\nlocale Regions_TA = Regions X _ _ k for X :: \"'c set\" and k :: \"'s \\ 'c \\ nat\" +\n fixes A :: \"('a, 'c, t, 's) ta\"\n assumes valid_abstraction: \"valid_abstraction A X k\"\n and finite_state_set: \"finite (state_set A)\"\nbegin\n\n(* XXX Bundle this? *)\nno_notation Regions_Beta.part (\"[_]\\<^sub>_\" [61,61] 61)\nnotation part'' (\"[_]\\<^sub>_\" [61,61] 61)\n\n(* XXX Move *)\nlemma step_z_beta'_state_set1:\n \"l \\ state_set A\" if \"A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\\"\n using that unfolding step_z_beta'_def by (force simp: state_set_def trans_of_def)\n\nsublocale sim: Double_Simulation_paired\n \"\\ (l, u) (l', u'). A \\' \\l, u\\ \\ \\l', u'\\\" \\ \\Concrete step relation\\\n \"\\ (l, Z) (l', Z'). \\ a. A,\\ \\ \\l, Z\\ \\\\<^sub>a \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the first abstraction layer\\\n \"\\ (l, R). l \\ state_set A \\ R \\ \\ l\" \\ \\Valid states of the first abstraction layer\\\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the second abstraction layer\\\n \"\\ (l, Z). l \\ state_set A \\ Z \\ V' \\ Z \\ {}\" \\ \\Valid states of the second abstraction layer\\\nproof (standard, goal_cases)\n case (1 S T)\n then show ?case\n by (auto dest!: step_r'_sound)\nnext\n case prems: (2 R' l' Z' l Z)\n from prems(3) have \"l \\ state_set A\"\n by (blast intro: step_z_beta'_state_set1)\n from prems show ?case\n unfolding Double_Simulation_paired_Defs.closure'_def\n by (blast dest: beta_alpha_region_step[OF valid_abstraction] step_z_beta'_state_set1)\nnext\n case prems: (3 l R R')\n then show ?case\n using \\_regions_distinct[OF \\_def'] by auto\nnext\n case 4\n have *: \"finite (\\ l)\" for l\n unfolding \\_def by (intro finite_\\ finite)\n have\n \"{(l, R). l \\ state_set A \\ R \\ \\ l} = (\\ l \\ state_set A. ((\\ R. (l, R)) ` {R. R \\ \\ l}))\"\n by auto\n also have \"finite \\\"\n by (auto intro: finite_UN_I[OF finite_state_set] *)\n finally show ?case by auto\nnext\n case (5 l Z)\n then show ?case\n apply safe\n subgoal for u\n using region_cover'[of u l] by (auto dest!: V'_V, auto simp: V_def)\n done\nqed\n\nsublocale Graph_Defs\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {}\" .\n\nlemmas step_z_beta'_V' = step_z_beta'_V'[OF valid_abstraction]\n\nlemma step_r'_complete_spec:\n assumes \"A \\' \\l, u\\ \\ \\l',u'\\\" \"u \\ V\"\n shows \"\\ a R'. u' \\ R' \\ A,\\ \\ \\l, [u]\\<^sub>l\\ \\\\<^sub>a \\l',R'\\\"\n using assms valid_abstraction by (auto simp: comp_def V_def intro!: step_r'_complete)\n\nend (* Regions TA *)\n\n\nsubsection \\Büchi Runs\\\n\nlocale Regions_TA_Start_State = Regions_TA _ _ _ _ _ A for A :: \"('a, 'c, t, 's) ta\" +\n fixes l\\<^sub>0 :: \"'s\" and Z\\<^sub>0 :: \"('c, t) zone\"\n assumes start_state: \"l\\<^sub>0 \\ state_set A\" \"Z\\<^sub>0 \\ V'\" \"Z\\<^sub>0 \\ {}\"\nbegin\n\ndefinition \"a\\<^sub>0 = from_R l\\<^sub>0 Z\\<^sub>0\"\n\nsublocale sim_complete': Double_Simulation_Finite_Complete_paired\n \"\\ (l, u) (l', u'). A \\' \\l, u\\ \\ \\l', u'\\\" \\ \\Concrete step relation\\\n \"\\ (l, Z) (l', Z'). \\ a. A,\\ \\ \\l, Z\\ \\\\<^sub>a \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the first abstraction layer\\\n \"\\ (l, R). l \\ state_set A \\ R \\ \\ l\" \\ \\Valid states of the first abstraction layer\\\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the second abstraction layer\\\n \"\\ (l, Z). l \\ state_set A \\ Z \\ V' \\ Z \\ {}\" \\ \\Valid states of the second abstraction layer\\\n l\\<^sub>0 Z\\<^sub>0\nproof (standard, goal_cases)\n case (1 x y S)\n \\ \\Completeness\\\n then show ?case\n by (force dest: step_z_beta'_complete[rotated 2, OF V'_V])\nnext\n case 4\n \\ \\Finiteness\\\n (* XXX *)\n have *: \"Z \\ V'\" if \"A \\ \\l\\<^sub>0, Z\\<^sub>0\\ \\\\<^sub>\\* \\l, Z\\\" for l Z\n using that start_state step_z_beta'_V' by (induction rule: rtranclp_induct2) blast+\n have \"Z \\ {Approx\\<^sub>\\ l Z | Z. Z \\ V} \\ (l, Z) = (l\\<^sub>0, Z\\<^sub>0)\"\n if \"reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z)\" for l Z\n using that proof (induction rule: rtranclp_induct2)\n case refl\n then show ?case\n by simp\n next\n case prems: (step l Z l' Z')\n from prems(1) have \"A \\ \\l\\<^sub>0, Z\\<^sub>0\\ \\\\<^sub>\\* \\l, Z\\\"\n by induction (auto intro: rtranclp_trans)\n then have \"Z \\ V'\"\n by (rule *)\n with prems show ?case\n unfolding step_z_beta'_def using start_state(2) by (auto 0 1 dest!: V'_V elim!: step_z_V)\n qed\n then have \"{(l, Z). reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z) \\ l \\ state_set A \\ Z \\ V' \\ Z \\ {}}\n \\ {(l, Z) | l Z. l \\ state_set A \\ Z \\ {Approx\\<^sub>\\ l Z | Z. Z \\ V}} \\ {(l\\<^sub>0, Z\\<^sub>0)}\"\n by auto\n also have \"finite \\\" (is \"finite ?S\")\n proof -\n have \"?S = {(l\\<^sub>0, Z\\<^sub>0)} \\ \\ ((\\ l. (\\ Z. (l, Z)) ` {Approx\\<^sub>\\ l Z | Z. Z \\ V}) ` (state_set A))\"\n by blast\n also have \"finite \\\"\n by (blast intro: apx_finite finite_state_set)\n finally show ?thesis .\n qed\n finally show ?case\n by simp\nnext\n case prems: (2 a a')\n then show ?case\n by (auto intro: step_z_beta'_V' step_z_beta'_state_set2)\nnext\n case 3\n from start_state show ?case unfolding a\\<^sub>0_def by (auto simp: from_R_fst)\nqed\n\nsublocale sim_complete_bisim': Double_Simulation_Finite_Complete_Bisim_Cover_paired\n \"\\ (l, u) (l', u'). A \\' \\l, u\\ \\ \\l', u'\\\" \\ \\Concrete step relation\\\n \"\\ (l, Z) (l', Z'). \\ a. A,\\ \\ \\l, Z\\ \\\\<^sub>a \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the first abstraction layer\\\n \"\\ (l, R). l \\ state_set A \\ R \\ \\ l\" \\ \\Valid states of the first abstraction layer\\\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {}\"\n \\ \\Step relation for the second abstraction layer\\\n \"\\ (l, Z). l \\ state_set A \\ Z \\ V' \\ Z \\ {}\" \\ \\Valid states of the second abstraction layer\\\n l\\<^sub>0 Z\\<^sub>0\nproof (standard, goal_cases)\n case (1 l x l' y S)\n then show ?case\n apply clarify\n apply (drule step_r'_complete_spec, (auto intro: \\_V; fail))\n by (auto simp: \\_def region_unique)\nnext\n case (2 l S l' T)\n then show ?case\n by (auto simp add: step_r'_state_set step_r'_\\)\nnext\n case prems: (3 l Z u)\n then show ?case\n using region_cover'[of u l] by (auto dest!: V'_V simp: V_def)+\nqed\n\nsubsection \\State Formulas\\\n\ncontext\n fixes P :: \"'s \\ bool\" \\ \\The state property we want to check\\\nbegin\n\ndefinition \"\\ = P o fst\"\n\nparagraph \\State formulas are compatible with closures.\\\n\nparagraph \\Runs satisfying a formula all the way long\\\n\ninterpretation G\\<^sub>\\: Graph_Start_Defs\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {} \\ P l'\" \"(l\\<^sub>0, Z\\<^sub>0)\" .\n\ntheorem Alw_ev_mc1:\n \"(\\x\\<^sub>0\\a\\<^sub>0. sim.sim.Alw_ev (Not \\ \\) x\\<^sub>0) \\ \\ (P l\\<^sub>0 \\ (\\a. G\\<^sub>\\.reachable a \\ G\\<^sub>\\.reaches1 a a))\"\n using sim_complete_bisim'.Alw_ev_mc1\n unfolding G\\<^sub>\\.reachable_def a\\<^sub>0_def sim_complete_bisim'.\\_def \\_def\n by auto\n\nend (* Context for State Formula *)\n\nsubsection \\Leads-To Properties\\\n\ncontext\n fixes P Q :: \"'s \\ bool\" \\ \\The state properties we want to check\\\nbegin\n\ndefinition \"\\ = Q o fst\"\n\ninterpretation G\\<^sub>\\: Graph_Defs\n \"\\ (l, Z) (l', Z'). A \\ \\l, Z\\ \\\\<^sub>\\ \\l', Z'\\ \\ Z' \\ {} \\ Q l'\" .\n\ntheorem leadsto_mc1:\n \"(\\x\\<^sub>0\\a\\<^sub>0. sim.sim.leadsto (\\ P) (Not \\ \\) x\\<^sub>0) \\\n (\\x. reaches (l\\<^sub>0, Z\\<^sub>0) x \\ P (fst x) \\ Q (fst x) \\ (\\a. G\\<^sub>\\.reaches x a \\ G\\<^sub>\\.reaches1 a a))\"\n if \"\\x\\<^sub>0\\a\\<^sub>0. \\ sim.sim.deadlock x\\<^sub>0\"\nproof -\n from that have *: \"\\x\\<^sub>0\\Z\\<^sub>0. \\ sim.sim.deadlock (l\\<^sub>0, x\\<^sub>0)\"\n unfolding a\\<^sub>0_def by auto\n show ?thesis\n using sim_complete_bisim'.leadsto_mc1[OF *, symmetric, of P Q]\n unfolding \\_def \\_def sim_complete_bisim'.\\'_def sim_complete_bisim'.\\_def a\\<^sub>0_def\n by (auto dest: from_R_D from_R_loc)\nqed\n\nend (* Context for State Formulae *)\n\nlemma from_R_reaches:\n assumes \"sim.sim.Steps.reaches (from_R l\\<^sub>0 Z\\<^sub>0) b\"\n obtains l Z where \"b = from_R l Z\"\n using assms by cases (fastforce simp: sim.A2'_def dest!: from_R_R_of)+\n\nlemma ta_reaches_ex_iff:\n assumes compatible:\n \"\\l u u' R.\n u \\ R \\ u' \\ R \\ R \\ \\ l \\ l \\ state_set A \\ P (l, u) = P (l, u')\"\n shows\n \"(\\ x\\<^sub>0 \\ a\\<^sub>0. \\ l u. sim.sim.reaches x\\<^sub>0 (l, u) \\ P (l, u)) \\\n (\\ l Z. \\ u \\ Z. reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z) \\ P (l, u))\"\nproof -\n have *: \"(\\x\\<^sub>0 \\ a\\<^sub>0. \\ l u. sim.sim.reaches x\\<^sub>0 (l, u) \\ P (l, u))\n \\ (\\y. \\x\\<^sub>0\\from_R l\\<^sub>0 Z\\<^sub>0. sim.sim.reaches x\\<^sub>0 y \\ P y)\"\n unfolding a\\<^sub>0_def by auto\n show ?thesis\n unfolding *\n apply (subst sim_complete_bisim'.sim_reaches_equiv)\n subgoal\n by (simp add: start_state)\n apply (subst sim_complete_bisim'.reaches_ex'[of P])\n unfolding a\\<^sub>0_def\n apply clarsimp\n subgoal\n unfolding sim.P1'_def by (clarsimp simp: fst_simp) (metis R_ofI compatible fst_conv)\n apply safe\n apply (rule from_R_reaches, assumption)\n using from_R_fst by (force intro: from_R_val)+\nqed\n\nlemma ta_reaches_all_iff:\n assumes compatible:\n \"\\l u u' R.\n u \\ R \\ u' \\ R \\ R \\ \\ l \\ l \\ state_set A \\ P (l, u) = P (l, u')\"\n shows\n \"(\\ x\\<^sub>0 \\ a\\<^sub>0. \\ l u. sim.sim.reaches x\\<^sub>0 (l, u) \\ P (l, u)) \\\n (\\ l Z. reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z) \\ (\\ u \\ Z. P (l, u)))\"\nproof -\n have *: \"(\\x\\<^sub>0 \\ a\\<^sub>0. \\ l u. sim.sim.reaches x\\<^sub>0 (l, u) \\ P (l, u))\n \\ (\\y. \\x\\<^sub>0\\from_R l\\<^sub>0 Z\\<^sub>0. sim.sim.reaches x\\<^sub>0 y \\ P y)\"\n unfolding a\\<^sub>0_def by auto\n show ?thesis\n unfolding *\n apply (subst sim_complete_bisim'.sim_reaches_equiv)\n subgoal\n by (simp add: start_state)\n apply (subst sim_complete_bisim'.reaches_all''[of P])\n unfolding a\\<^sub>0_def\n apply clarsimp\n subgoal\n unfolding sim.P1'_def by (clarsimp simp: fst_simp) (metis R_ofI compatible fst_conv)\n apply auto\n apply (rule from_R_reaches, assumption)\n using from_R_fst by (force intro: from_R_val)+\nqed\n\nend (* Reachability Problem precompiled *)\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/TA/Simulation_Graphs_TA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.25501702239959184}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: XVcgEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Parallel Assignments\"\n\ntheory XVcgEx\nimports \"../XVcg\"\n\nbegin\n\nrecord \"globals\" =\n \"G_'\"::\"nat\"\n \"H_'\"::\"nat\"\n\nrecord 'g vars = \"'g state\" +\n A_' :: nat\n B_' :: nat\n C_' :: nat\n I_' :: nat\n M_' :: nat\n N_' :: nat\n R_' :: nat\n S_' :: nat\n Arr_' :: \"nat list\"\n Abr_':: string\n\nterm \"BASIC\n \\A :== x,\n \\B :== y\n END\"\n\nterm \"BASIC\n \\G :== \\H,\n \\H :== \\G\n END\"\n\nterm \"BASIC\n LET (x,y) = (\\A,b);\n z = \\B\n IN \\A :== x,\n \\G :== \\A + y + z\n END\"\n\n\nlemma \"\\\\ \\\\A = 0\\\n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN\n \\A :== a,\n \\B :== b,\n \\C :== c\n END\n \\\\A = x \\ \\B = y \\ \\C = c\\\"\napply vcg\noops\n\nlemma \"\\\\ \\\\A = 0\\\n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN\n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply vcg\noops\n\ndefinition foo:: \"nat \\ (nat \\ nat \\ nat)\"\n where \"foo n = (n,n+1,n+2)\"\n\nlemma \"\\\\ \\\\A = 0\\\n \\\\A < 0\\ \\ BASIC\n LET (a,b,c) = foo \\A\n IN\n \\A :== a,\n \\G :== b + \\B,\n \\H :== c\n END\n \\\\A = x \\ \\G = y \\ \\H = c\\\"\napply (vcg add: foo_def snd_conv fst_conv)\noops\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/XVcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.2547821536263938}} {"text": "theory DYNAMIC_Post_Network\n imports\n DYNAMIC_Post_ISSUER\n Post_RECEIVER\n \"../API_Network\"\n \"BD_Security_Compositional.Composing_Security_Network\"\nbegin\n\nsubsubsection \\Confidentiality for the N-ary composition\\\n\ntype_synonym ttrans = \"(state, act, out) trans\"\ntype_synonym obs = Post_Observation_Setup_ISSUER.obs\ntype_synonym \"value\" = \"Post.value + Post_RECEIVER.value\"\n\nlemma value_cases:\nfixes v :: \"value\"\nobtains (PVal) pst where \"v = Inl (Post.PVal pst)\"\n | (PValS) aid pst where \"v = Inl (Post.PValS aid pst)\"\n | (OVal) ov where \"v = Inl (Post.OVal ov)\"\n | (PValR) pst where \"v = Inr (Post_RECEIVER.PValR pst)\"\nproof (cases v)\n case (Inl vl) then show thesis using PVal PValS OVal by (cases vl rule: Post.value.exhaust) auto next\n case (Inr vr) then show thesis using PValR by (cases vr rule: Post_RECEIVER.value.exhaust) auto\nqed\n\nlocale Post_Network = Network\n+ fixes UIDs :: \"apiID \\ userID set\"\n and AID :: \"apiID\" and PID :: \"postID\"\n assumes AID_in_AIDs: \"AID \\ AIDs\"\nbegin\n\nsublocale Iss: Post \"UIDs AID\" PID .\n\nabbreviation \\ :: \"apiID \\ (state, act, out) trans \\ bool\"\nwhere \"\\ aid trn \\ (if aid = AID then Iss.\\ trn else Post_RECEIVER.\\ PID AID trn)\"\n\nabbreviation f :: \"apiID \\ (state, act, out) trans \\ value\"\nwhere \"f aid trn \\ (if aid = AID then Inl (Iss.f trn) else Inr (Post_RECEIVER.f PID AID trn))\"\n\nabbreviation \\ :: \"apiID \\ (state, act, out) trans \\ bool\"\nwhere \"\\ aid trn \\ (if aid = AID then Iss.\\ trn else ObservationSetup_RECEIVER.\\ (UIDs aid) trn)\"\n\nabbreviation g :: \"apiID \\ (state, act, out) trans \\ obs\"\nwhere \"g aid trn \\ (if aid = AID then Iss.g trn else ObservationSetup_RECEIVER.g PID AID trn)\"\n\nabbreviation T :: \"apiID \\ (state, act, out) trans \\ bool\"\n where \"T aid trn \\ (if aid = AID then Iss.T trn else Post_RECEIVER.T (UIDs aid) PID AID trn)\"\n\n(* Note that Iss.T is trivially False (since the issuer being dynamic, the trigger\nis incorporated in the bound) so an alternative definition of the composite trigger is: *)\nlemma T_def:\n\"T aid trn \\ aid \\ AID \\ Post_RECEIVER.T (UIDs aid) PID AID trn\"\nby auto\n\nabbreviation B :: \"apiID \\ value list \\ value list \\ bool\"\nwhere \"B aid vl vl1 \\\n (if aid = AID then list_all isl vl \\ list_all isl vl1 \\ Iss.B (map projl vl) (map projl vl1)\n else list_all (Not o isl) vl \\ list_all (Not o isl) vl1 \\ Post_RECEIVER.B (map projr vl) (map projr vl1))\"\n\nfun comOfV :: \"apiID \\ value \\ com\" where\n \"comOfV aid (Inl (Post.PValS aid' pst)) = (if aid' \\ aid then Send else Internal)\"\n| \"comOfV aid (Inl (Post.PVal pst)) = Internal\"\n| \"comOfV aid (Inl (Post.OVal ov)) = Internal\"\n| \"comOfV aid (Inr v) = Recv\"\n\nfun tgtNodeOfV :: \"apiID \\ value \\ apiID\" where\n \"tgtNodeOfV aid (Inl (Post.PValS aid' pst)) = aid'\"\n| \"tgtNodeOfV aid (Inl (Post.PVal pst)) = undefined\"\n| \"tgtNodeOfV aid (Inl (Post.OVal ov)) = undefined\"\n| \"tgtNodeOfV aid (Inr v) = AID\"\n\ndefinition syncV :: \"apiID \\ value \\ apiID \\ value \\ bool\" where\n \"syncV aid1 v1 aid2 v2 =\n (\\pst. aid1 = AID \\ v1 = Inl (Post.PValS aid2 pst) \\ v2 = Inr (Post_RECEIVER.PValR pst))\"\n\nlemma syncVI: \"syncV AID (Inl (Post.PValS aid' pst)) aid' (Inr (Post_RECEIVER.PValR pst))\"\nunfolding syncV_def by auto\n\nlemma syncVE:\nassumes \"syncV aid1 v1 aid2 v2\"\nobtains pst where \"aid1 = AID\" \"v1 = Inl (Post.PValS aid2 pst)\" \"v2 = Inr (Post_RECEIVER.PValR pst)\"\nusing assms unfolding syncV_def by auto\n\nfun getTgtV where\n \"getTgtV (Inl (Post.PValS aid pst)) = Inr (Post_RECEIVER.PValR pst)\"\n| \"getTgtV v = v\"\n\nlemma comOfV_AID:\n \"comOfV AID v = Send \\ isl v \\ Iss.isPValS (projl v) \\ Iss.tgtAPI (projl v) \\ AID\"\n \"comOfV AID v = Recv \\ Not (isl v)\"\nby (cases v rule: value_cases; auto)+\n\nlemmas \\_defs = Post_RECEIVER.\\_def2 Iss.\\_def3\n\nsublocale Net: BD_Security_TS_Network_getTgtV\nwhere istate = \"\\_. istate\" and validTrans = validTrans and srcOf = \"\\_. srcOf\" and tgtOf = \"\\_. tgtOf\"\n and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n and sync = sync and \\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\n and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n and source = AID and getTgtV = getTgtV\nusing AID_in_AIDs proof (unfold_locales, goal_cases)\n case (1 nid trn) then show ?case using Iss.validTrans_isCOMact_open[of trn] by (cases trn rule: Iss.\\.cases) (auto simp: \\_defs split: prod.splits) next\n case (2 nid trn) then show ?case using Iss.validTrans_isCOMact_open[of trn] by (cases trn rule: Iss.\\.cases) (auto simp: \\_defs split: prod.splits) next\n case (3 nid trn)\n interpret Sink: Post_RECEIVER \"UIDs nid\" PID AID .\n show ?case using 3 by (cases \"(nid,trn)\" rule: tgtNodeOf.cases) (auto split: prod.splits)\nnext\n case (4 nid trn)\n interpret Sink: Post_RECEIVER \"UIDs nid\" PID AID .\n show ?case using 4 by (cases \"(nid,trn)\" rule: tgtNodeOf.cases) (auto split: prod.splits)\nnext\n case (5 nid1 trn1 nid2 trn2)\n interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n show ?case using 5 by (elim sync_cases) (auto intro: syncVI)\nnext\n case (6 nid1 trn1 nid2 trn2)\n interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n show ?case using 6 by (elim sync_cases) auto\nnext\n case (7 nid1 trn1 nid2 trn2)\n interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n show ?case using 7(2,4,6-10)\n using Iss.validTrans_isCOMact_open[OF 7(2)] Iss.validTrans_isCOMact_open[OF 7(4)]\n by (elim sync_cases) (auto split: prod.splits, auto simp: sendPost_def)\nnext\n case (8 nid1 trn1 nid2 trn2)\n interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n show ?case using 8(2,4,6-10,11,12,13)\n apply (elim syncO_cases; cases trn1; cases trn2)\n apply (auto simp: Iss.g_simps ObservationSetup_RECEIVER.g_simps split: prod.splits)\n apply (auto simp: sendPost_def split: prod.splits elim: syncVE)[]\n done\nnext\n case (9 nid trn)\n then show ?case\n by (cases \"(nid,trn)\" rule: tgtNodeOf.cases)\n (auto simp: ObservationSetup_RECEIVER.\\.simps)\nnext\n case (10 nid trn) then show ?case by (cases trn) (auto simp: \\_defs)\nnext\n case (11 vSrc nid vn) then show ?case by (cases vSrc rule: value_cases) (auto simp: syncV_def)\nnext\n case (12 vSrc nid vn) then show ?case by (cases vSrc rule: value_cases) (auto simp: syncV_def)\nqed\n\nlemma list_all_Not_isl_projectSrcV: \"list_all (Not o isl) (Net.projectSrcV aid vlSrc)\"\nproof (induction vlSrc)\n case (Cons vSrc vlSrc') then show ?case by (cases vSrc rule: value_cases) auto\nqed auto\n\ncontext\nfixes AID' :: apiID\nassumes AID': \"AID' \\ AIDs - {AID}\"\nbegin\n\ninterpretation Recv: Post_RECEIVER \"UIDs AID'\" PID AID by unfold_locales\n\nlemma Iss_BC_BO_tgtAPI:\nshows \"(Iss.BC vl vl1 \\ map Iss.tgtAPI (filter Iss.isPValS vl) =\n map Iss.tgtAPI (filter Iss.isPValS vl1)) \\\n (Iss.BO vl vl1 \\ map Iss.tgtAPI (filter Iss.isPValS vl) =\n map Iss.tgtAPI (filter Iss.isPValS vl1))\"\nby (induction rule: Iss.BC_BO.induct) auto\n\nlemma Iss_B_Recv_B_aux:\nassumes \"list_all isl vl\"\nand \"list_all isl vl1\"\nand \"map Iss.tgtAPI (filter Iss.isPValS (map projl vl)) =\n map Iss.tgtAPI (filter Iss.isPValS (map projl vl1))\"\nshows \"length (map projr (Net.projectSrcV AID' vl)) = length (map projr (Net.projectSrcV AID' vl1))\"\nusing assms proof (induction vl vl1 rule: list22_induct)\n case (ConsCons v vl v1 vl1)\n consider (SendSend) aid pst pst1 where \"v = Inl (Iss.PValS aid pst)\" \"v1 = Inl (Iss.PValS aid pst1)\"\n | (Internal) \"comOfV AID v = Internal\" \"\\Iss.isPValS (projl v)\"\n | (Internal1) \"comOfV AID v1 = Internal\" \"\\Iss.isPValS (projl v1)\"\n using ConsCons(4-6) by (cases v rule: value_cases; cases v1 rule: value_cases) auto\n then show ?case proof cases\n case (SendSend) then show ?thesis using ConsCons.IH(1) ConsCons.prems by auto\n next\n case (Internal) then show ?thesis using ConsCons.IH(2)[of \"v1 # vl1\"] ConsCons.prems by auto\n next\n case (Internal1) then show ?thesis using ConsCons.IH(3)[of \"v # vl\"] ConsCons.prems by auto\n qed\nqed (auto simp: comOfV_AID)\n\nlemma Iss_B_Recv_B:\nassumes \"B AID vl vl1\"\nshows \"Recv.B (map projr (Net.projectSrcV AID' vl)) (map projr (Net.projectSrcV AID' vl1))\"\nusing assms Iss_B_Recv_B_aux Iss_BC_BO_tgtAPI by (auto simp: Iss.B_def Recv.B_def)\n\nend\n\nlemma map_projl_Inl: \"map (projl o Inl) vl = vl\"\nby (induction vl) auto\n\nlemma these_map_Inl_projl: \"list_all isl vl \\ these (map (Some o Inl o projl) vl) = vl\"\nby (induction vl) auto\n\nlemma map_projr_Inr: \"map (projr o Inr) vl = vl\"\nby (induction vl) auto\n\nlemma these_map_Inr_projr: \"list_all (Not o isl) vl \\ these (map (Some o Inr o projr) vl) = vl\"\nby (induction vl) auto\n\nsublocale BD_Security_TS_Network_Preserve_Source_Security_getTgtV\nwhere istate = \"\\_. istate\" and validTrans = validTrans and srcOf = \"\\_. srcOf\" and tgtOf = \"\\_. tgtOf\"\n and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n and sync = sync and \\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\n and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n and source = AID and getTgtV = getTgtV\nproof (unfold_locales, goal_cases)\n case 1 show ?case using AID_in_AIDs .\nnext\n case 2\n interpret Iss': BD_Security_TS_Trans\n istate System_Specification.validTrans srcOf tgtOf Iss.\\ Iss.f Iss.\\ Iss.g Iss.T Iss.B\n istate System_Specification.validTrans srcOf tgtOf Iss.\\ \"\\trn. Inl (Iss.f trn)\" Iss.\\ Iss.g Iss.T \"B AID\"\n id id Some \"Some o Inl\"\n proof (unfold_locales, goal_cases)\n case (11 vl' vl1' tr) then show ?case\n by (intro exI[of _ \"map projl vl1'\"]) (auto simp: map_projl_Inl these_map_Inl_projl)\n qed auto\n show ?case using Iss.secure Iss'.translate_secure by auto\nnext\n case (3 aid tr vl' vl1)\n then show ?case\n using Iss_B_Recv_B[of aid \"(Net.lV AID tr)\" vl1] list_all_Not_isl_projectSrcV\n by auto\nqed\n\ntheorem secure: \"secure\"\nproof (intro preserve_source_secure ballI)\n fix aid\n assume aid: \"aid \\ AIDs - {AID}\"\n interpret Node: Post_RECEIVER \"UIDs aid\" PID AID .\n interpret Node': BD_Security_TS_Trans\n istate System_Specification.validTrans srcOf tgtOf Node.\\ Node.f Node.\\ Node.g Node.T Node.B\n istate System_Specification.validTrans srcOf tgtOf Node.\\ \"\\trn. Inr (Node.f trn)\" Node.\\ Node.g Node.T \"B aid\"\n id id Some \"Some o Inr\"\n proof (unfold_locales, goal_cases)\n case (11 vl' vl1' tr) then show ?case using aid\n by (intro exI[of _ \"map projr vl1'\"]) (auto simp: map_projr_Inr these_map_Inr_projr)\n qed auto\n show \"Net.lsecure aid\"\n using aid Node.Post_secure Node'.translate_secure by auto\nqed\n\nend (* context Post_Network *)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Post_Confidentiality/DYNAMIC_Post_Network.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2547684625947325}} {"text": "(* Author: Florian Haftmann, TU Muenchen *)\n\nsection \\Reflecting Pure types into HOL\\\n\ntheory Typerep\nimports String\nbegin\n\ndatatype typerep = Typerep String.literal \"typerep list\"\n\nclass typerep =\n fixes typerep :: \"'a itself \\ typerep\"\nbegin\n\ndefinition typerep_of :: \"'a \\ typerep\" where\n [simp]: \"typerep_of x = typerep TYPE('a)\"\n\nend\n\nsyntax\n \"_TYPEREP\" :: \"type => logic\" (\"(1TYPEREP/(1'(_')))\")\n\nparse_translation \\\n let\n fun typerep_tr (*\"_TYPEREP\"*) [ty] =\n Syntax.const \\<^const_syntax>\\typerep\\ $\n (Syntax.const \\<^syntax_const>\\_constrain\\ $ Syntax.const \\<^const_syntax>\\Pure.type\\ $\n (Syntax.const \\<^type_syntax>\\itself\\ $ ty))\n | typerep_tr (*\"_TYPEREP\"*) ts = raise TERM (\"typerep_tr\", ts);\n in [(\\<^syntax_const>\\_TYPEREP\\, K typerep_tr)] end\n\\\n\ntyped_print_translation \\\n let\n fun typerep_tr' ctxt (*\"typerep\"*) \\<^Type>\\fun \\<^Type>\\itself T\\ _\\\n (Const (\\<^const_syntax>\\Pure.type\\, _) :: ts) =\n Term.list_comb\n (Syntax.const \\<^syntax_const>\\_TYPEREP\\ $ Syntax_Phases.term_of_typ ctxt T, ts)\n | typerep_tr' _ T ts = raise Match;\n in [(\\<^const_syntax>\\typerep\\, typerep_tr')] end\n\\\n\nsetup \\\nlet\n\nfun add_typerep tyco thy =\n let\n val sorts = replicate (Sign.arity_number thy tyco) \\<^sort>\\typerep\\;\n val vs = Name.invent_names Name.context \"'a\" sorts;\n val ty = Type (tyco, map TFree vs);\n val lhs = \\<^Const>\\typerep ty\\ $ Free (\"T\", Term.itselfT ty);\n val rhs = \\<^Const>\\Typerep\\ $ HOLogic.mk_literal tyco\n $ HOLogic.mk_list \\<^Type>\\typerep\\ (map (HOLogic.mk_typerep o TFree) vs);\n val eq = HOLogic.mk_Trueprop (HOLogic.mk_eq (lhs, rhs));\n in\n thy\n |> Class.instantiation ([tyco], vs, \\<^sort>\\typerep\\)\n |> `(fn lthy => Syntax.check_term lthy eq)\n |-> (fn eq => Specification.definition NONE [] [] (Binding.empty_atts, eq))\n |> snd\n |> Class.prove_instantiation_exit (fn ctxt => Class.intro_classes_tac ctxt [])\n end;\n\nfun ensure_typerep tyco thy =\n if not (Sorts.has_instance (Sign.classes_of thy) tyco \\<^sort>\\typerep\\)\n andalso Sorts.has_instance (Sign.classes_of thy) tyco \\<^sort>\\type\\\n then add_typerep tyco thy else thy;\n\nin\n\nadd_typerep \\<^type_name>\\fun\\\n#> Typedef.interpretation (Local_Theory.background_theory o ensure_typerep)\n#> Code.type_interpretation ensure_typerep\n\nend\n\\\n\n\n\nlemma [code nbe]:\n \"HOL.equal (x :: typerep) x \\ True\"\n by (fact equal_refl)\n\ncode_printing\n type_constructor typerep \\ (Eval) \"Term.typ\"\n| constant Typerep \\ (Eval) \"Term.Type/ (_, _)\"\n\ncode_reserved Eval Term\n\nhide_const (open) typerep Typerep\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Typerep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2547684625947325}} {"text": "section \\Tree to Graph\\\n\ntheory TreeToGraph\n imports \n Semantics.IRTreeEval\n Graph.IRGraph\nbegin\n\nsubsection \\Subgraph to Data-flow Tree\\\n\nfun find_node_and_stamp :: \"IRGraph \\ (IRNode \\ Stamp) \\ ID option\" where\n \"find_node_and_stamp g (n,s) =\n find (\\i. kind g i = n \\ stamp g i = s) (sorted_list_of_set(ids g))\"\n\nexport_code find_node_and_stamp\n\n(* These kinds of nodes are evaluated during the control flow, so are already in MapState. *)\nfun is_preevaluated :: \"IRNode \\ bool\" where\n \"is_preevaluated (InvokeNode n _ _ _ _ _) = True\" |\n \"is_preevaluated (InvokeWithExceptionNode n _ _ _ _ _ _) = True\" |\n \"is_preevaluated (NewInstanceNode n _ _ _) = True\" |\n \"is_preevaluated (LoadFieldNode n _ _ _) = True\" |\n \"is_preevaluated (SignedDivNode n _ _ _ _ _) = True\" |\n \"is_preevaluated (SignedRemNode n _ _ _ _ _) = True\" |\n \"is_preevaluated (ValuePhiNode n _ _) = True\" |\n \"is_preevaluated _ = False\"\n\n\ninductive\n rep :: \"IRGraph \\ ID \\ IRExpr \\ bool\" (\"_ \\ _ \\ _\" 55)\n for g where\n\n ConstantNode:\n \"\\kind g n = ConstantNode c\\\n \\ g \\ n \\ (ConstantExpr c)\" |\n\n ParameterNode:\n \"\\kind g n = ParameterNode i;\n stamp g n = s\\\n \\ g \\ n \\ (ParameterExpr i s)\" |\n\n ConditionalNode:\n \"\\kind g n = ConditionalNode c t f;\n g \\ c \\ ce;\n g \\ t \\ te;\n g \\ f \\ fe\\\n \\ g \\ n \\ (ConditionalExpr ce te fe)\" |\n\n(* Unary nodes *)\n AbsNode:\n \"\\kind g n = AbsNode x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr UnaryAbs xe)\" |\n\n NotNode:\n \"\\kind g n = NotNode x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr UnaryNot xe)\" |\n\n NegateNode:\n \"\\kind g n = NegateNode x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr UnaryNeg xe)\" |\n\n LogicNegationNode:\n \"\\kind g n = LogicNegationNode x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr UnaryLogicNegation xe)\" |\n\n(* Binary nodes *)\n AddNode:\n \"\\kind g n = AddNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinAdd xe ye)\" |\n\n MulNode:\n \"\\kind g n = MulNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinMul xe ye)\" |\n\n SubNode:\n \"\\kind g n = SubNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinSub xe ye)\" |\n\n AndNode:\n \"\\kind g n = AndNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinAnd xe ye)\" |\n\n OrNode:\n \"\\kind g n = OrNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinOr xe ye)\" |\n\n XorNode:\n \"\\kind g n = XorNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinXor xe ye)\" |\n\n ShortCircuitOrNode:\n \"\\kind g n = ShortCircuitOrNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinShortCircuitOr xe ye)\" |\n\n LeftShiftNode:\n \"\\kind g n = LeftShiftNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinLeftShift xe ye)\" |\n\n RightShiftNode:\n \"\\kind g n = RightShiftNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinRightShift xe ye)\" |\n\n UnsignedRightShiftNode:\n \"\\kind g n = UnsignedRightShiftNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinURightShift xe ye)\" |\n\n IntegerBelowNode:\n \"\\kind g n = IntegerBelowNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinIntegerBelow xe ye)\" |\n\n IntegerEqualsNode:\n \"\\kind g n = IntegerEqualsNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinIntegerEquals xe ye)\" |\n\n IntegerLessThanNode:\n \"\\kind g n = IntegerLessThanNode x y;\n g \\ x \\ xe;\n g \\ y \\ ye\\\n \\ g \\ n \\ (BinaryExpr BinIntegerLessThan xe ye)\" |\n\n(* Convert Nodes *)\n NarrowNode:\n \"\\kind g n = NarrowNode inputBits resultBits x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr (UnaryNarrow inputBits resultBits) xe)\" |\n\n SignExtendNode:\n \"\\kind g n = SignExtendNode inputBits resultBits x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr (UnarySignExtend inputBits resultBits) xe)\" |\n\n ZeroExtendNode:\n \"\\kind g n = ZeroExtendNode inputBits resultBits x;\n g \\ x \\ xe\\\n \\ g \\ n \\ (UnaryExpr (UnaryZeroExtend inputBits resultBits) xe)\" |\n\n(* Leaf Node *)\n LeafNode:\n \"\\is_preevaluated (kind g n);\n stamp g n = s\\\n \\ g \\ n \\ (LeafExpr n s)\" |\n\n(* Ref Node *)\n RefNode:\n \"\\kind g n = RefNode n';\n g \\ n' \\ e\\\n \\ g \\ n \\ e\"\n\ncode_pred (modes: i \\ i \\ o \\ bool as exprE) rep .\n\n\ninductive\n replist :: \"IRGraph \\ ID list \\ IRExpr list \\ bool\" (\"_ \\ _ \\\\<^sub>L _\" 55)\n for g where\n\n RepNil:\n \"g \\ [] \\\\<^sub>L []\" |\n\n RepCons:\n \"\\g \\ x \\ xe;\n g \\ xs \\\\<^sub>L xse\\\n \\ g \\ x#xs \\\\<^sub>L xe#xse\"\n\ncode_pred (modes: i \\ i \\ o \\ bool as exprListE) replist .\n\ndefinition wf_term_graph :: \"MapState \\ Params \\ IRGraph \\ ID \\ bool\" where\n \"wf_term_graph m p g n = (\\ e. (g \\ n \\ e) \\ (\\ v. ([m, p] \\ e \\ v)))\"\n\nvalues \"{t. eg2_sq \\ 4 \\ t}\"\n\ninductive_cases ConstantNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (ConstantExpr c)\"\ninductive_cases ParameterNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (ParameterExpr i s)\"\ninductive_cases ConditionalNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (ConditionalExpr ce te fe)\"\ninductive_cases AbsNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr UnaryAbs xe)\"\ninductive_cases NotNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr UnaryNot xe)\"\ninductive_cases NegateNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr UnaryNeg xe)\"\ninductive_cases LogicNegationNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr UnaryLogicNegation xe)\"\ninductive_cases AddNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinAdd xe ye)\"\ninductive_cases MulNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinMul xe ye)\"\ninductive_cases SubNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinSub xe ye)\"\ninductive_cases AndNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinAnd xe ye)\"\ninductive_cases OrNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinOr xe ye)\"\ninductive_cases XorNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinXor xe ye)\"\ninductive_cases ShortCircuitOrE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinShortCircuitOr xe ye)\"\ninductive_cases LeftShiftNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinLeftShift xe ye)\"\ninductive_cases RightShiftNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinRightShift xe ye)\"\ninductive_cases UnsignedRightShiftNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinURightShift xe ye)\"\ninductive_cases IntegerBelowNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinIntegerBelow xe ye)\"\ninductive_cases IntegerEqualsNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinIntegerEquals xe ye)\"\ninductive_cases IntegerLessThanNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (BinaryExpr BinIntegerLessThan xe ye)\"\ninductive_cases NarrowNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr (UnaryNarrow ib rb) xe)\"\ninductive_cases SignExtendNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr (UnarySignExtend ib rb) xe)\"\ninductive_cases ZeroExtendNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (UnaryExpr (UnaryZeroExtend ib rb) xe)\"\ninductive_cases LeafNodeE[elim!]:\\<^marker>\\tag invisible\\\n \"g \\ n \\ (LeafExpr n s)\"\n\n(* group those forward rules into a named set *)\nlemmas RepE\\<^marker>\\tag invisible\\ = \n ConstantNodeE\n ParameterNodeE\n ConditionalNodeE\n AbsNodeE\n NotNodeE\n NegateNodeE\n LogicNegationNodeE\n AddNodeE\n MulNodeE\n SubNodeE\n AndNodeE\n OrNodeE\n XorNodeE\n ShortCircuitOrE\n LeftShiftNodeE\n RightShiftNodeE\n UnsignedRightShiftNodeE\n IntegerBelowNodeE\n IntegerEqualsNodeE\n IntegerLessThanNodeE\n NarrowNodeE\n SignExtendNodeE\n ZeroExtendNodeE\n LeafNodeE\n\n\nsubsection \\Data-flow Tree to Subgraph\\\n\nfun unary_node :: \"IRUnaryOp \\ ID \\ IRNode\" where\n \"unary_node UnaryAbs v = AbsNode v\" |\n \"unary_node UnaryNot v = NotNode v\" |\n \"unary_node UnaryNeg v = NegateNode v\" |\n \"unary_node UnaryLogicNegation v = LogicNegationNode v\" |\n \"unary_node (UnaryNarrow ib rb) v = NarrowNode ib rb v\" |\n \"unary_node (UnarySignExtend ib rb) v = SignExtendNode ib rb v\" |\n \"unary_node (UnaryZeroExtend ib rb) v = ZeroExtendNode ib rb v\"\n\n\n(* Creates the appropriate IRNode for a given binary operator. *)\nfun bin_node :: \"IRBinaryOp \\ ID \\ ID \\ IRNode\" where\n \"bin_node BinAdd x y = AddNode x y\" |\n \"bin_node BinMul x y = MulNode x y\" |\n \"bin_node BinSub x y = SubNode x y\" |\n \"bin_node BinAnd x y = AndNode x y\" |\n \"bin_node BinOr x y = OrNode x y\" |\n \"bin_node BinXor x y = XorNode x y\" |\n \"bin_node BinShortCircuitOr x y = ShortCircuitOrNode x y\" |\n \"bin_node BinLeftShift x y = LeftShiftNode x y\" |\n \"bin_node BinRightShift x y = RightShiftNode x y\" |\n \"bin_node BinURightShift x y = UnsignedRightShiftNode x y\" |\n \"bin_node BinIntegerEquals x y = IntegerEqualsNode x y\" |\n \"bin_node BinIntegerLessThan x y = IntegerLessThanNode x y\" |\n \"bin_node BinIntegerBelow x y = IntegerBelowNode x y\"\n\n\n\ninductive fresh_id :: \"IRGraph \\ ID \\ bool\" where\n \"n \\ ids g \\ fresh_id g n\"\n\ncode_pred fresh_id .\n\n(* This generates a specific fresh ID (max+1), in a code-friendly way. *)\nfun get_fresh_id :: \"IRGraph \\ ID\" where\n(* Previous attempts - cannot generate code due to nat not Enum. \n \"get_fresh_id g = 100\"\n \"get_fresh_id g = (ffold max (0::nat) (f_ids g))\"\n \"get_fresh_id g = fst(last(as_list g))\"\n \"get_fresh_id g = last(sorted_list_of_set (dom (Rep_IRGraph g)))\"\n*)\n \"get_fresh_id g = last(sorted_list_of_set(ids g)) + 1\"\n\nexport_code get_fresh_id\n(* these examples return 6 and 7 respectively *)\nvalue \"get_fresh_id eg2_sq\"\nvalue \"get_fresh_id (add_node 6 (ParameterNode 2, default_stamp) eg2_sq)\"\n\n(* Second version of tree insertion into graph:\n\n g \\ expr \\ (g',n) re-inserts expr into g and returns the new root n.\n\n This means that we can try to re-use existing nodes by finding node IDs bottom-up.\n*)\ninductive\n unrep :: \"IRGraph \\ IRExpr \\ (IRGraph \\ ID) \\ bool\" (\"_ \\ _ \\ _\" 55)\n where\n\n ConstantNodeSame:\n \"\\find_node_and_stamp g (ConstantNode c, constantAsStamp c) = Some n\\\n \\ g \\ (ConstantExpr c) \\ (g, n)\" |\n\n ConstantNodeNew:\n \"\\find_node_and_stamp g (ConstantNode c, constantAsStamp c) = None;\n n = get_fresh_id g;\n g' = add_node n (ConstantNode c, constantAsStamp c) g \\\n \\ g \\ (ConstantExpr c) \\ (g', n)\" |\n\n ParameterNodeSame:\n \"\\find_node_and_stamp g (ParameterNode i, s) = Some n\\\n \\ g \\ (ParameterExpr i s) \\ (g, n)\" |\n\n ParameterNodeNew:\n \"\\find_node_and_stamp g (ParameterNode i, s) = None;\n n = get_fresh_id g;\n g' = add_node n (ParameterNode i, s) g\\\n \\ g \\ (ParameterExpr i s) \\ (g', n)\" |\n\n ConditionalNodeSame:\n \"\\find_node_and_stamp g4 (ConditionalNode c t f, s') = Some n;\n g \\ ce \\ (g2, c);\n g2 \\ te \\ (g3, t);\n g3 \\ fe \\ (g4, f);\n s' = meet (stamp g4 t) (stamp g4 f)\\\n \\ g \\ (ConditionalExpr ce te fe) \\ (g4, n)\" |\n\n ConditionalNodeNew:\n \"\\find_node_and_stamp g4 (ConditionalNode c t f, s') = None;\n g \\ ce \\ (g2, c);\n g2 \\ te \\ (g3, t);\n g3 \\ fe \\ (g4, f);\n s' = meet (stamp g4 t) (stamp g4 f);\n n = get_fresh_id g4;\n g' = add_node n (ConditionalNode c t f, s') g4\\\n \\ g \\ (ConditionalExpr ce te fe) \\ (g', n)\" |\n\n UnaryNodeSame:\n \"\\find_node_and_stamp g2 (unary_node op x, s') = Some n;\n g \\ xe \\ (g2, x);\n s' = stamp_unary op (stamp g2 x)\\\n \\ g \\ (UnaryExpr op xe) \\ (g2, n)\" |\n\n UnaryNodeNew:\n \"\\find_node_and_stamp g2 (unary_node op x, s') = None;\n g \\ xe \\ (g2, x);\n s' = stamp_unary op (stamp g2 x);\n n = get_fresh_id g2;\n g' = add_node n (unary_node op x, s') g2\\\n \\ g \\ (UnaryExpr op xe) \\ (g', n)\" |\n\n BinaryNodeSame:\n \"\\find_node_and_stamp g3 (bin_node op x y, s') = Some n;\n g \\ xe \\ (g2, x);\n g2 \\ ye \\ (g3, y);\n s' = stamp_binary op (stamp g3 x) (stamp g3 y)\\\n \\ g \\ (BinaryExpr op xe ye) \\ (g3, n)\" |\n\n BinaryNodeNew:\n \"\\find_node_and_stamp g3 (bin_node op x y, s') = None;\n g \\ xe \\ (g2, x);\n g2 \\ ye \\ (g3, y);\n s' = stamp_binary op (stamp g3 x) (stamp g3 y);\n n = get_fresh_id g3;\n g' = add_node n (bin_node op x y, s') g3\\\n \\ g \\ (BinaryExpr op xe ye) \\ (g', n)\" |\n\n AllLeafNodes:\n \"\\stamp g n = s;\n is_preevaluated (kind g n)\\\n \\ g \\ (LeafExpr n s) \\ (g, n)\"\n\n(* UnrepNil:\n \"g \\\\<^sub>L [] \\ (g, [])\" |\n\n(* TODO: this will fail for [xe,ye] where they are not equal.\n Figure out how to generate code for this?\n*)\n UnrepCons:\n \"\\g \\ xe \\ (g2, x);\n g2 \\\\<^sub>L xes \\ (g3, xs)\\\n \\ g \\\\<^sub>L (xe#xes) \\ (g3, x#xs)\"*)\n\ncode_pred (modes: i \\ i \\ o \\ bool as unrepE)\n(*\n [show_steps,show_mode_inference,show_intermediate_results] \n*) unrep .\n\ntext_raw \\\\Snip{unrepRules}%\n\\begin{center}\n@{thm[mode=Rule] unrep.ConstantNodeSame [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.ConstantNodeNew [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.ParameterNodeSame [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.ParameterNodeNew [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.ConditionalNodeSame [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.ConditionalNodeNew [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.BinaryNodeSame [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.BinaryNodeNew [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.UnaryNodeSame [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.UnaryNodeNew [no_vars]}\\\\[8px]\n@{thm[mode=Rule] unrep.AllLeafNodes [no_vars]}\\\\[8px]\n\\end{center}\n\\EndSnip\\\n\n(*\ninstantiation IRGraph :: equal begin\n\ndefinition \"(g1 = g2) \\ \n (f_ids g1 = f_ids g2 \\\n (\\n. (n \\ ids g1 \\ (Rep_IRGraph g1 n = Rep_IRGraph g2 n))))\"\ninstance proof \n fix x y :: IRGraph\n show \"x = y \\ x \\ y \\ \\ (y \\ x)\" by (simp add: equiv_exprs_def; auto)\n show \"x \\ x\" by simp\n show \"x \\ y \\ y \\ z \\ x \\ z\" by simp \nqed\nend\n*)\n\nvalues \"{(n, g) . (eg2_sq \\ sq_param0 \\ (g, n))}\"\n\n\nsubsection \\Lift Data-flow Tree Semantics\\\n\ndefinition encodeeval :: \"IRGraph \\ MapState \\ Params \\ ID \\ Value \\ bool\" \n (\"[_,_,_] \\ _ \\ _\" 50)\n where\n \"encodeeval g m p n v = (\\ e. (g \\ n \\ e) \\ ([m,p] \\ e \\ v))\"\n\n\nsubsection \\Graph Refinement\\\n\ndefinition graph_represents_expression :: \"IRGraph \\ ID \\ IRExpr \\ bool\" \n (\"_ \\ _ \\ _\" 50)\n where\n \"(g \\ n \\ e) = (\\e' . (g \\ n \\ e') \\ (e' \\ e))\"\n\ndefinition graph_refinement :: \"IRGraph \\ IRGraph \\ bool\" where\n \"graph_refinement g\\<^sub>1 g\\<^sub>2 = \n ((ids g\\<^sub>1 \\ ids g\\<^sub>2) \\\n (\\ n . n \\ ids g\\<^sub>1 \\ (\\e. (g\\<^sub>1 \\ n \\ e) \\ (g\\<^sub>2 \\ n \\ e))))\"\n\nlemma graph_refinement:\n \"graph_refinement g1 g2 \\ (\\n m p v. n \\ ids g1 \\ ([g1, m, p] \\ n \\ v) \\ ([g2, m, p] \\ n \\ v))\"\n by (meson encodeeval_def graph_refinement_def graph_represents_expression_def le_expr_def)\n\nsubsection \\Maximal Sharing\\\n\ndefinition maximal_sharing:\n \"maximal_sharing g = (\\ n\\<^sub>1 n\\<^sub>2 . n\\<^sub>1 \\ true_ids g \\ n\\<^sub>2 \\ true_ids g \\ \n (\\ e. (g \\ n\\<^sub>1 \\ e) \\ (g \\ n\\<^sub>2 \\ e) \\ (stamp g n\\<^sub>1 = stamp g n\\<^sub>2) \\ n\\<^sub>1 = n\\<^sub>2))\"\n\nend", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Semantics/TreeToGraph.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.2545081531917933}} {"text": "theory RedSafeAppLemma\n imports RedSafeCV RedSafeCase SafeSubTPX\nbegin\n \n (* ##### sares *)\n \nlemma sares_lam_helper: \"\\ well_typed env delta r_s1 e2 tau (diff_use_env (comp_use_env r_s3 r_exa) (comp_use_env rxa (lift_use_env rx2 r)))\n (diff_use_env (comp_use_env rxa rx2) (comp_use_env rxa (lift_use_env rx2 r))); non_prim_env env \\ \\\n well_typed env delta r_s1 e2 tau (diff_use_env (comp_use_env r_s3 r_exa) (comp_use_env rxa (lift_use_env rx2 r))) (app_req rxa rx2 r tau empty_use_env)\"\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac rx=\"diff_use_env (comp_use_env rxa rx2) (comp_use_env rxa (lift_use_env rx2 r))\" in prim_type_no_req)\n apply (auto)\n apply (cut_tac r=\"comp_use_env rxa (lift_use_env rx2 r)\" in comp_empty_use_env2)\n apply (auto)\n done \n\nlemma sares_fix_case: \"\\well_typed_state s1 env delta; sub_use_env s1 r_f; app_red_exp FixApp (s1, AppExp (ConstExp FixConst) x62) ax (s2, e2);\n e1 = AppExp (ConstExp FixConst) x62; well_typed env delta r_s2a x62 t1 r_s3 rx2;\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); (*safe_use_lift rx2 r; safe_type t1 r;*)\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (app_req rx1 rx2 r tau r_ex) rx; leq_use_env r_s2a r_s1; leq_use_env rx1 r_s2a;\n FunTy t1 tau r a = pure_fun (pure_fun t t (req_type t)) t Prim; fun_ty t; unlim t; leq_use_env r_s1 r_f \\\n \\ \\g_ax. well_typed (red_env env g_ax) (red_delta delta g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n well_typed_state s2 (red_env env g_ax) (red_delta delta g_ax) \\\n sub_use_env s2 (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax\"\n apply (case_tac x62)\n apply (auto)\n apply (case_tac ax)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (auto)\n (* - prelim: rxa is weak *)\n apply (case_tac \"\\ weak_use_env rxa\")\n apply (simp add: aff_use_env_def)\n apply (case_tac \"req_type tau\")\n apply (simp add: unlim_def)\n apply (simp)\n apply (simp add: null_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n (* e2 = x52 (Fix (\\ x51. x52)). We can type the external app as: <> x52 <> (Fix (\\ x51. x52)) <>\n We can type the internal app as: <> Fix <> (\\ x51. x52) <>\n *)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env r_s2a (comp_use_env rxa (lift_use_env rxa UsePerm))) (comp_use_env rx2 (comp_use_env r_exa r_ex))\" and\n rx=\"diff_use_env (diff_use_env (comp_use_env rxa rxa) (comp_use_env rxa (lift_use_env rxa UsePerm))) (comp_use_env rx2 (comp_use_env r_exa r_ex))\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac t=\"tau\" and ?rx1.0=\"rxa\" and r_s'=\"r_s'\" and r_end=\"r_end\" and ?e1.0=\"x62a\" and x=\"x61\" and\n ?r_s2.0=\"r_s2a\" and ?r_s3.0=\"r_s2a\" and e'=\"AppExp (ConstExp FixConst) (LamExp x61 x62a)\" in safe_subst_type_preserve_x)\n apply (auto)\n apply (rule_tac x=\"FunTy tau tau UsePerm (req_type tau)\" in exI)\n apply (rule_tac x=\"UsePerm\" in exI)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac \"\\ weak_use_env empty_use_env\")\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac x=\"rxa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (auto)(*\n apply (simp add: aff_use_env_def)\n apply (simp add: weak_use_env_def)*)\n apply (rule_tac id_leq_use_env)(*\n apply (simp add: aff_use_env_def)\n apply (case_tac \"req_type tau\")\n apply (simp add: unlim_def)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)*)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac wts_well_formed_delta)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: aff_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n (* diff correctness *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 rx2\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n (* prove bound shifts were valid. to show that r_s2 (the only end perm bound) is lower than r_s2a - rxa (our proposed bound),\n we use the fact that r_s2 \\ r_s3 - rx2, and whatever is not removed by rx2 was already removed by r_exa from r_s2a. *)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s2a r_exa) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (simp_all)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* proving the rx bound in the primitive case is predicated on the fact that rxa is null *)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (case_tac \"\\ leq_use_env rxa empty_use_env\")\n apply (simp add: aff_use_env_def)\n apply (simp add: null_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (rule_tac r_sb=\"empty_use_env\" in trans_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* otherwise, to show that rx \\ rxa - (rxa + r_exa + r_ex) (our proposed bound). we note that rxa - r_exa \\ rx2.\n rx \\ rx2 - (rx1 + rx2 + r_ex). rx1 is disjoint, rx2 is weak, r_ex is included in our bound *) \n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env rxa r_exa) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"rx2\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: corr_act_def)\n done\n \n \nlemma sares_lam_case: \"\\well_typed_state s2 env delta; sub_use_env s2 r_f; e1 = AppExp (LamExp x51 x52) x62; well_typed env delta r_s2a x62 t1 r_s3 rx2;\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); (*safe_use_lift rx2 r; safe_type t1 r;*)\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (app_req rx1 rx2 r tau r_ex) rx; ax = NoAct; well_typed (add_env env (Var x51) t1) delta (add_use_env rxa (Var x51) r) x52 tau r_s' r_end; is_value x62;\n aff_use_env rxa a; safe_subst_exp x52 x51 x62 e2; s1 = s2; leq_use_env rxa r_s1; leq_use_env r_s2a (diff_use_env r_s1 r_exa); leq_use_env rx1 r_s2a;\n leq_use_env r_exa r_s1; leq_use_env (diff_use_env rxa r_exa) rx1; leq_use_env r_s1 r_f \\\n \\ \\g_ax. well_typed (red_env env g_ax) (red_delta delta g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n well_typed_state s2 (red_env env g_ax) (red_delta delta g_ax) \\\n sub_use_env s2 (exp_red_use_env r_f g_ax) \\ safe_act s2 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax\"\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env (comp_use_env r_s3 (cut_use_env r_exa)) (comp_use_env rxa (lift_use_env rx2 r))) (comp_use_env r_exa (comp_use_env r_ex rx1))\" and\n rx=\"diff_use_env (app_req rxa rx2 r tau empty_use_env) (comp_use_env r_exa (comp_use_env r_ex rx1))\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac sares_lam_helper)\n apply (auto)\n apply (rule_tac x=\"x51\" and t=\"t1\" and ?rx1.0=\"rxa\" and r=\"r\" and ?e1.0=\"x52\" and r_s'=\"r_s'\" and r_end=\"r_end\"\n and e'=\"x62\" and ?r_s2.0=\"comp_use_env r_s2a (cut_use_env r_exa)\" and ?r_s3.0=\"comp_use_env r_s3 (cut_use_env r_exa)\" and ?rx2.0=\"rx2\" in safe_subst_type_preserve_x)\n apply (auto)\n apply (case_tac x62)\n apply (auto)\n apply (case_tac x3)\n apply (auto)\n apply (case_tac x71)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (rule_tac well_typed_comp_perms_gen)\n apply (auto)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_strong_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac strong_cut_use_env)\n apply (rule_tac wts_well_formed_delta)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac cut_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac diff_cut_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n (* the last thing we have to do is show that rxa is disjoint from rx2. the idea is that rxa is contained in rx1 + cut r_exa. *)\n apply (rule_tac r_s=\"comp_use_env rx1 (cut_use_env r_exa)\" in disj_leq_use_env1)\n apply (rule_tac disj_comp_use_env1)\n apply (simp)\n apply (rule_tac r_s=\"r_s2a\" in disj_leq_use_env2)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"r_s1\" in swp_mini_disj_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_strong_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac strong_cut_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_cut_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac well_typed_state_non_prim_env)\n apply (auto)\n (* - proving initial boundary changes *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (*apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)*)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_exa\" in trans_leq_use_env)\n apply (rule_tac fold_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"diff_use_env r_s1 r_exa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - secondary boundary change. *)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: corr_act_def)\n done\n \nlemma empty_infl_use_env: \"infl_use_env r_s r_s = empty_use_env\" \n apply (case_tac \"\\ x. infl_use_env r_s r_s x = empty_use_env x\")\n apply (auto)\n apply (simp add: infl_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \nlemma flat_infl_sexp_wp: \"\\ well_typed env delta r_s e tau r_s rx; well_formed_delta env delta; is_value e \\ \\ well_typed env delta rx e tau rx rx\" \n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s\" and e=\"e\" and rx=\"rx\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (auto)\n apply (cut_tac r_s=\"r_s\" in empty_infl_use_env)\n apply (auto)\n apply (cut_tac r=\"rx\" in comp_empty_use_env2)\n apply (auto)\n done\n \nlemma cancel_strong_leq_use_env: \"\\ strong_use_env r_x \\ \\ leq_use_env (diff_use_env r_x r_x) r_s\" \n apply (simp add: strong_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma infl_strong_use_env: \"strong_use_env (infl_use_env r_s r_x)\" \n apply (simp add: strong_use_env_def)\n apply (simp add: infl_use_env_def)\n done\n \nlemma strong_lift_use_env: \"\\ strong_use_env r_s \\ \\ lift_use_env r_s r = r_s\"\n apply (case_tac \"\\ x. lift_use_env r_s r x = r_s x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n(*\nlemma proper_op: \"\\ app_op xop c e \\ \\ proper_exp rs_map e\"\n apply (simp add: proper_exp_def) \n apply (case_tac xop)\n apply (auto)\n done\n *) \nlemma safe_app_red_exp_strict: \"\\ well_typed env delta r_s1 e1 tau r_s2 rx; well_typed_state s1 env delta;\n sub_use_env s1 r_f; leq_use_env r_s1 r_f; app_red_exp are (s1, e1) ax (s2, e2) \\ \\ (\\ g_ax.\n well_typed (red_env env g_ax) (red_delta delta g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n (*red_env env ax env' \\ *)well_typed_state s2 (red_env env g_ax) (red_delta delta g_ax) \\\n sub_use_env s2 (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax)\"\n apply (case_tac are)\n apply (auto)\n (* lam case *)\n apply (rule_tac sares_lam_case)\n apply (auto)\n (* fix-point case *)\n apply (rule_tac r_s2a=\"r_s2a\" and ?r_s3.0=\"r_s3\" in sares_fix_case)\n apply (auto)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n (* remaining const cases. the idea is that any \"destructive\" uses should have had\n end perms removes to begin with, so red_use_env should be fine. *)\n apply (rule_tac ?r_s1.0=\"r_s1\" and ?r_s2.0=\"r_s3\" and ?rx1.0=\"rx1\" and ?rx2.0=\"rx2\" in safe_app_con_case)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)(*\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)*)\n (* op case *)\n apply (case_tac \"ax \\ NoAct\")\n apply (auto)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"r_s1\" and rx=\"empty_use_env\" in well_typed_simul_end_perm)\n apply (rule_tac safe_app_op_case)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: corr_act_def)\n (* if case 1 *)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rx=\"rx1\" in well_typed_incr_req) \n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (simp add: corr_act_def)\n (* if case 2 *)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rx=\"rx2\" in well_typed_incr_req)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (simp add: corr_act_def)\n (* cv case *)\n apply (rule_tac sares_cv_case)\n apply (auto)\n done \n\nlemma sares_valid: \"valid_reduct app_red_exp\"\n apply (simp add: valid_reduct_def)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and ?e1.0=\"e1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and\n ?s1.0=\"s1\" and ax=\"ax\" and ?s2.0=\"s2\" and ?e2.0=\"e2\" in safe_app_red_exp_strict)\n apply (auto)\n done\n\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/RedSafeAppLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2544892186908187}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | Februaru 2006 |\n | March 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_sf_par\nimports FNF_F_sf_induct FNF_F_sf_ext\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split [split del]\n\n(*****************************************************************\n\n 1. full sequentialization for Parallel (P1 |[X]| DIV)\n 2. full sequentialization for Parallel (P1 |[X]| SKIP)\n 3. full sequentialization for Parallel (P1 |[X]| P2)\n\n *****************************************************************)\n\n(*============================================================*\n | |\n | Parallel (P |[X]| DIV) |\n | |\n *============================================================*)\n\ndefinition\n Pfun_Parallel_DIV :: \"'a set => (('p,'a) proc => ('p,'a) proc)\"\n where\n Pfun_Parallel_DIV_def :\n \"Pfun_Parallel_DIV X == (%P1. P1 |[X]| DIV)\"\n \ndefinition\n SP_step_Parallel_DIV :: \n \"'a set => ('a set => ('a => ('p,'a) proc) => ('p,'a) proc => ('a => ('p,'a) proc) => ('p,'a) proc)\"\n where\n SP_step_Parallel_DIV_def :\n \"SP_step_Parallel_DIV X == (%A1 Pf1 Q1 SPf. \n (? :(A1-X) -> SPf) [+] DIV)\"\n\ndefinition\n fsfF_Parallel_DIV :: \"'a set => ('p,'a) proc => ('p,'a) proc\"\n where\n fsfF_Parallel_DIV_def :\n \"fsfF_Parallel_DIV X == (%P1. \n (fsfF_induct1 (Pfun_Parallel_DIV X)\n (SP_step_Parallel_DIV X) P1))\"\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Parallel_DIV_in:\n \"P1 : fsfF_proc\n ==> fsfF_Parallel_DIV X P1 : fsfF_proc\"\napply (simp add: fsfF_Parallel_DIV_def)\napply (rule fsfF_induct1_in)\napply (simp_all add: SP_step_Parallel_DIV_def\n fsfF_proc.intros)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Parallel_DIV_eqF:\n \"P1 |[X]| DIV =F fsfF_Parallel_DIV X P1\"\napply (simp add: fsfF_Parallel_DIV_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct1_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Parallel_DIV_def\n SP_step_Parallel_DIV_def)\napply (rule cspF_Dist_nonempty, simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV)\napply (simp)\napply (rule cspF_decompo | rule cspF_reflex | simp)+\ndone\n\n(*============================================================*\n | |\n | Parallel (P |[X]| SKIP) |\n | |\n *============================================================*)\n\ndefinition\n Pfun_Parallel_SKIP :: \"'a set => (('p,'a) proc => ('p,'a) proc)\"\n where\n Pfun_Parallel_SKIP_def :\n \"Pfun_Parallel_SKIP X == (%P1. P1 |[X]| SKIP)\"\n \ndefinition\n SP_step_Parallel_SKIP :: \n \"'a set => ('a set => ('a => ('p,'a) proc) => ('p,'a) proc => \n ('a => ('p,'a) proc) => ('p,'a) proc)\"\n where\n SP_step_Parallel_SKIP_def :\n \"SP_step_Parallel_SKIP X == (%A1 Pf1 Q1 SPf.\n (? :(A1-X) -> SPf) [+] Q1)\"\n\ndefinition\n fsfF_Parallel_SKIP :: \"'a set => ('p,'a) proc => ('p,'a) proc\"\n where\n fsfF_Parallel_SKIP_def :\n \"fsfF_Parallel_SKIP X == (%P1. \n (fsfF_induct1 (Pfun_Parallel_SKIP X)\n (SP_step_Parallel_SKIP X) P1))\"\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Parallel_SKIP_in:\n \"P1 : fsfF_proc\n ==> fsfF_Parallel_SKIP X P1 : fsfF_proc\"\napply (simp add: fsfF_Parallel_SKIP_def)\napply (rule fsfF_induct1_in)\napply (simp_all add: SP_step_Parallel_SKIP_def\n fsfF_proc.intros)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Parallel_SKIP_eqF:\n \"P1 |[X]| SKIP =F fsfF_Parallel_SKIP X P1\"\napply (simp add: fsfF_Parallel_SKIP_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct1_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Parallel_SKIP_def\n SP_step_Parallel_SKIP_def)\n\napply (rule cspF_Dist_nonempty, simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice)\napply (simp)\napply (simp)\napply (rule cspF_decompo | rule cspF_reflex | simp)+\ndone\n\n(*============================================================*\n | |\n | Parallel (P |[X]| SKIP or DIV) |\n | |\n *============================================================*)\n\ndefinition\n fsfF_Parallel_SKIP_DIV :: \"'a set => ('p,'a) proc => ('p,'a) proc => ('p,'a) proc\"\n\nwhere\n fsfF_Parallel_SKIP_DIV_def :\n \"fsfF_Parallel_SKIP_DIV X P1 P2 ==\n if (P2 = SKIP) then fsfF_Parallel_SKIP X P1\n else if (P2 = DIV) then fsfF_Parallel_DIV X P1\n else (P1 |[X]| P2)\"\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Parallel_SKIP_DIV_in:\n \"[| P1 : fsfF_proc ; P2 = SKIP | P2 = DIV |]\n ==> fsfF_Parallel_SKIP_DIV X P1 P2 : fsfF_proc\"\napply (simp add: fsfF_Parallel_SKIP_DIV_def)\napply (erule disjE)\napply (simp add: fsfF_Parallel_SKIP_in)\napply (simp add: fsfF_Parallel_DIV_in)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Parallel_SKIP_DIV_eqF:\n \"P1 |[X]| P2 =F fsfF_Parallel_SKIP_DIV X P1 P2\"\napply (simp add: fsfF_Parallel_SKIP_DIV_def)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp add: cspF_fsfF_Parallel_DIV_eqF)\napply (simp add: cspF_fsfF_Parallel_SKIP_eqF)\ndone\n\nlemmas cspF_fsfF_Parallel_SKIP_DIV_eqF_sym =\n cspF_fsfF_Parallel_SKIP_DIV_eqF[THEN cspF_sym]\n\n(*============================================================*\n | |\n | Genaralized Parallel (P |[X]| Q) |\n | |\n *============================================================*)\n\ndefinition\n Pfun_Parallel :: \"'a set => (('p,'a) proc => ('p,'a) proc => ('p,'a) proc)\"\n where\n Pfun_Parallel_def :\n \"Pfun_Parallel X == (%P1 P2. P1 |[X]| P2)\"\n \ndefinition\n SP_step_Parallel :: \n \"'a set => \n ('a set => ('a => ('p,'a) proc) => ('p,'a) proc => \n 'a set => ('a => ('p,'a) proc) => ('p,'a) proc => \n ('a => ('p,'a) proc) => ('a => ('p,'a) proc) => ('a => ('p,'a) proc) => ('p,'a) proc)\"\n where\n SP_step_Parallel_def :\n \"SP_step_Parallel X == (%A1 Pf1 Q1 A2 Pf2 Q2 SPf SPf1 SPf2. \n (if (Q1 = STOP & Q2 = STOP) then\n ((? a:((X Int A1 Int A2) Un (A1 - X) Un (A2 - X))\n -> (if (a : X) then (SPf a)\n else if (a : A1 & a : A2)\n then ((SPf1 a) |~|seq (SPf2 a))\n else if (a : A1) then (SPf1 a)\n else (SPf2 a))) [+] STOP)\n else if (Q1 = STOP) then\n (((? a:((X Int A1 Int A2) Un (A1 - X) Un (A2 - X))\n -> (if (a : X) then (SPf a)\n else if (a : A1 & a : A2)\n then ((SPf1 a) |~|seq (SPf2 a))\n else if (a : A1) then (SPf1 a)\n else (SPf2 a))) [+] STOP)\n [>seq\n (fsfF_Parallel_SKIP_DIV X (((? :A1 -> Pf1) [+] Q1)) Q2))\n\n else if (Q2 = STOP) then\n (((? a:((X Int A1 Int A2) Un (A1 - X) Un (A2 - X))\n -> (if (a : X) then (SPf a)\n else if (a : A1 & a : A2)\n then ((SPf1 a) |~|seq (SPf2 a))\n else if (a : A1) then (SPf1 a)\n else (SPf2 a))) [+] STOP)\n [>seq\n (fsfF_Parallel_SKIP_DIV X (((? :A2 -> Pf2) [+] Q2)) Q1))\n\n else\n (((? a:((X Int A1 Int A2) Un (A1 - X) Un (A2 - X))\n -> (if (a : X) then (SPf a)\n else if (a : A1 & a : A2)\n then ((SPf1 a) |~|seq (SPf2 a))\n else if (a : A1) then (SPf1 a)\n else (SPf2 a))) [+] STOP)\n [>seq\n ((fsfF_Parallel_SKIP_DIV X \n (((? :A2 -> Pf2) [+] Q2)) Q1) |~|seq\n (fsfF_Parallel_SKIP_DIV X \n (((? :A1 -> Pf1) [+] Q1)) Q2)))))\"\n\ndefinition\n fsfF_Parallel :: \"('p,'a) proc => 'a set => ('p,'a) proc => ('p,'a) proc\"\n (\"(1_ /|[_]|seq _)\" [76,0,77] 76)\n where\n fsfF_Parallel_def :\n \"P1 |[X]|seq P2 == \n (fsfF_induct2 (Pfun_Parallel X) (SP_step_Parallel X) P1 P2)\"\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fsfF_Parallel_in_lm:\n \"[| ALL a:A1. Pf1 a : fsfF_proc; \n ALL a:A2. Pf2 a : fsfF_proc; \n ALL a:A1 Int A2. SPf a : fsfF_proc;\n ALL a:A1. SPf1 a : fsfF_proc; \n ALL a:A2. SPf2 a : fsfF_proc;\n Q1 = SKIP | Q1 = DIV | Q1 = STOP; Q2 = SKIP | Q2 = DIV | Q2 = STOP |]\n ==> SP_step_Parallel X A1 Pf1 Q1 A2 Pf2 Q2 SPf SPf1 SPf2 : fsfF_proc\"\napply (simp_all add: SP_step_Parallel_def)\n\n(* Q1 = STOP & Q2 = STOP *)\napply (case_tac \"Q1 = STOP & Q2 = STOP\")\napply (simp)\napply (rule fsfF_proc.intros)\napply (rule ballI)\napply (simp split: if_split)\napply (intro conjI ballI impI)\napply (simp_all)\napply (simp add: fsfF_Int_choice_in)\n\n(* Q1 = STOP *)\napply (subgoal_tac \"~ (Q1 = STOP & Q2 = STOP)\")\napply (simp (no_asm_simp))\napply (case_tac \"Q1 = STOP\")\napply (simp)\napply (rule fsfF_Timeout_in)\n\napply (rule fsfF_proc.intros)\napply (rule ballI)\napply (simp split: if_split)\napply (intro conjI ballI impI)\napply (simp_all)\napply (simp add: fsfF_Int_choice_in)\napply (rule fsfF_Parallel_SKIP_DIV_in)\n\napply (simp add: fsfF_proc.intros)\napply (simp)\n\n(* Q2 = STOP *)\napply (case_tac \"Q2 = STOP\")\napply (simp)\napply (rule fsfF_Timeout_in)\n\napply (rule fsfF_proc.intros)\napply (rule ballI)\napply (simp split: if_split)\napply (intro conjI ballI impI)\napply (simp_all)\napply (simp add: fsfF_Int_choice_in)\napply (rule fsfF_Parallel_SKIP_DIV_in)\napply (simp add: fsfF_proc.intros)\napply (simp)\n\n(* Q1 = SKIP | DIV , Q2 = SKIP | DIV *)\napply (rule fsfF_Timeout_in)\n\napply (rule fsfF_proc.intros)\napply (rule ballI)\napply (simp split: if_split)\napply (intro conjI ballI impI)\napply (simp_all)\napply (simp add: fsfF_Int_choice_in)\n\napply (rule fsfF_Int_choice_in)\napply (rule fsfF_Parallel_SKIP_DIV_in)\napply (simp add: fsfF_proc.intros)\napply (simp)\n\napply (rule fsfF_Parallel_SKIP_DIV_in)\napply (simp add: fsfF_proc.intros)\napply (simp)\ndone\n\n(*------------------------------------*\n | in |\n *------------------------------------*)\n\nlemma fsfF_Parallel_in:\n \"[| P1 : fsfF_proc ; P2 : fsfF_proc |]\n ==> P1 |[X]|seq P2 : fsfF_proc\"\napply (simp add: fsfF_Parallel_def)\napply (rule fsfF_induct2_in)\napply (simp_all)\napply (simp add: fsfF_Parallel_in_lm)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Parallel_eqF:\n \"P1 |[X]| P2 =F P1 |[X]|seq P2\"\napply (simp add: fsfF_Parallel_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct2_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Parallel_def)\napply (rule cspF_Dist_nonempty, simp)\napply (rule cspF_Dist_nonempty, simp)\n\napply (simp add: SP_step_Parallel_def)\n\n(* Q1 = STOP & Q2 = STOP *)\napply (case_tac \"Q1 = STOP & Q2 = STOP\")\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_unit)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_unit)\napply (rule cspF_unit)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_decompo)\napply (simp)\n\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp)\n\napply (rule cspF_rw_left, rule cspF_IF)+\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\n\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (simp)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n\n apply (rule cspF_decompo)\n apply (simp)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_reflex)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\n(* Q1 = STOP *)\napply (simp (no_asm_simp))\napply (case_tac \"Q1 = STOP\")\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Ext_choice_unit)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV_resolve)\napply (fast)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_decompo)\n\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_decompo)\napply (simp)\n\n(* IF --> if *)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\n\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Parallel_SKIP_DIV_eqF[THEN cspF_sym])\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\n(* Q2 = STOP *)\napply (case_tac \"Q2 = STOP\")\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_reflex)\napply (rule cspF_unit)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV_resolve)\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_decompo)\n\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_decompo)\napply (simp)\n\n(* IF --> if *)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\n\n apply (rule cspF_decompo)\n apply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_reflex)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_reflex)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_reflex)\n\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Parallel_SKIP_DIV_eqF[THEN cspF_sym])\napply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_unit)\n apply (rule cspF_reflex)\n apply (rule cspF_commut)\n\n(* DIV or SKIP *)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV_resolve)\napply (simp)\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_decompo)\n\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_decompo)\napply (simp)\n\n(* IF --> if *)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left, rule cspF_IF)+\napply (rule cspF_reflex)\n\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\n\n apply (rule cspF_rw_right)\n apply (rule cspF_fsfF_Parallel_SKIP_DIV_eqF[THEN cspF_sym])\n apply (rule cspF_commut)\n apply (rule cspF_rw_right)\n apply (rule cspF_fsfF_Parallel_SKIP_DIV_eqF[THEN cspF_sym])\n apply (rule cspF_reflex)\n\n(* congruence *)\n\napply (simp add: SP_step_Parallel_def)\n\napply (simp split: if_split)\napply (intro conjI impI)\n\napply (rule cspF_decompo, simp)\napply (rule cspF_decompo, simp)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp_all)\napply (rule cspF_rw_left, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp_all)\n\napply (rule cspF_rw_left, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_Timeout_cong)\napply (rule cspF_decompo, simp)\napply (rule cspF_decompo, simp)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp_all)\napply (rule cspF_rw_left, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp_all)\n\napply (rule cspF_rw_left, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_Timeout_cong)\napply (rule cspF_decompo, simp)\napply (rule cspF_decompo, simp)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp_all)\napply (rule cspF_rw_left, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp_all)\n\napply (rule cspF_rw_left, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_Timeout_cong)\napply (rule cspF_decompo, simp)\napply (rule cspF_decompo, simp)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp_all)\napply (rule cspF_rw_left, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_rw_right, rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp_all)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_sf_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6187804478040616, "lm_q2_score": 0.41111086923216794, "lm_q1q2_score": 0.2543873677605979}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n\n Based on the Jinja theory J/WellTypeRT.thy by Tobias Nipkow \n*)\n\nsection \\Runtime Well-typedness\\\n\ntheory WellTypeRT imports WellType begin\n\n\nsubsection \\Run time types\\\n\nprimrec typeof_h :: \"prog \\ heap \\ val \\ ty option\" (\"_ \\ typeof\\<^bsub>_\\<^esub>\") where\n \"P \\ typeof\\<^bsub>h\\<^esub> Unit = Some Void\"\n| \"P \\ typeof\\<^bsub>h\\<^esub> Null = Some NT\"\n| \"P \\ typeof\\<^bsub>h\\<^esub> (Bool b) = Some Boolean\"\n| \"P \\ typeof\\<^bsub>h\\<^esub> (Intg i) = Some Integer\"\n| \"P \\ typeof\\<^bsub>h\\<^esub> (Ref r) = (case h (the_addr (Ref r)) of None \\ None \n | Some(C,S) \\ (if Subobjs P C (the_path(Ref r)) then\n Some(Class(last(the_path(Ref r))))\n else None))\"\n\n\nlemma type_eq_type: \"typeof v = Some T \\ P \\ typeof\\<^bsub>h\\<^esub> v = Some T\"\nby(induct v)auto\n\nlemma typeof_Void [simp]: \"P \\ typeof\\<^bsub>h\\<^esub> v = Some Void \\ v = Unit\"\nby(induct v,auto split:if_split_asm)\n\nlemma typeof_NT [simp]: \"P \\ typeof\\<^bsub>h\\<^esub> v = Some NT \\ v = Null\"\nby(induct v,auto split:if_split_asm)\n\nlemma typeof_Boolean [simp]: \"P \\ typeof\\<^bsub>h\\<^esub> v = Some Boolean \\ \\b. v = Bool b\"\nby(induct v,auto split:if_split_asm)\n\nlemma typeof_Integer [simp]: \"P \\ typeof\\<^bsub>h\\<^esub> v = Some Integer \\ \\i. v = Intg i\"\nby(induct v,auto split:if_split_asm)\n\nlemma typeof_Class_Subo: \n\"P \\ typeof\\<^bsub>h\\<^esub> v = Some (Class C) \\ \n\\a Cs D S. v = Ref(a,Cs) \\ h a = Some(D,S) \\ Subobjs P D Cs \\ last Cs = C\"\nby(induct v,auto split:if_split_asm)\n\nsubsection \\The rules\\\n\ninductive\n WTrt :: \"[prog,env,heap,expr, ty ] \\ bool\"\n (\"_,_,_ \\ _ : _\" [51,51,51]50)\n and WTrts :: \"[prog,env,heap,expr list,ty list] \\ bool\"\n (\"_,_,_ \\ _ [:] _\" [51,51,51]50)\n for P :: prog\nwhere\n \n WTrtNew:\n \"is_class P C \\ \n P,E,h \\ new C : Class C\"\n\n| WTrtDynCast:\n \"\\ P,E,h \\ e : T; is_refT T; is_class P C \\\n \\ P,E,h \\ Cast C e : Class C\"\n\n| WTrtStaticCast:\n \"\\ P,E,h \\ e : T; is_refT T; is_class P C \\\n \\ P,E,h \\ \\C\\e : Class C\"\n\n| WTrtVal:\n \"P \\ typeof\\<^bsub>h\\<^esub> v = Some T \\\n P,E,h \\ Val v : T\"\n\n| WTrtVar:\n \"E V = Some T \\\n P,E,h \\ Var V : T\"\n\n| WTrtBinOp:\n \"\\ P,E,h \\ e\\<^sub>1 : T\\<^sub>1; P,E,h \\ e\\<^sub>2 : T\\<^sub>2;\n case bop of Eq \\ T = Boolean\n | Add \\ T\\<^sub>1 = Integer \\ T\\<^sub>2 = Integer \\ T = Integer \\\n \\ P,E,h \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\"\n\n| WTrtLAss:\n \"\\ E V = Some T; P,E,h \\ e : T'; P \\ T' \\ T \\\n \\ P,E,h \\ V:=e : T\"\n\n| WTrtFAcc:\n\"\\P,E,h \\ e : Class C; Cs \\ []; P \\ C has least F:T via Cs \\\n \\ P,E,h \\ e\\F{Cs} : T\"\n\n| WTrtFAccNT:\n \"P,E,h \\ e : NT \\ P,E,h \\ e\\F{Cs} : T\"\n\n| WTrtFAss:\n\"\\P,E,h \\ e\\<^sub>1 : Class C; Cs \\ [];\n P \\ C has least F:T via Cs; P,E,h \\ e\\<^sub>2 : T'; P \\ T' \\ T \\\n \\ P,E,h \\ e\\<^sub>1\\F{Cs}:=e\\<^sub>2 : T\"\n\n| WTrtFAssNT:\n \"\\ P,E,h \\ e\\<^sub>1 : NT; P,E,h \\ e\\<^sub>2 : T'; P \\ T' \\ T \\\n \\ P,E,h \\ e\\<^sub>1\\F{Cs}:=e\\<^sub>2 : T\"\n\n| WTrtCall:\n \"\\ P,E,h \\ e : Class C; P \\ C has least M = (Ts,T,m) via Cs;\n P,E,h \\ es [:] Ts'; P \\ Ts' [\\] Ts \\\n \\ P,E,h \\ e\\M(es) : T\" \n\n| WTrtStaticCall:\n \"\\ P,E,h \\ e : Class C'; P \\ Path C' to C unique;\n P \\ C has least M = (Ts,T,m) via Cs; \n P,E,h \\ es [:] Ts'; P \\ Ts' [\\] Ts \\\n \\ P,E,h \\ e\\(C::)M(es) : T\"\n\n| WTrtCallNT:\n \"\\P,E,h \\ e : NT; P,E,h \\ es [:] Ts\\ \\ P,E,h \\ Call e Copt M es : T\"\n\n| WTrtBlock:\n \"\\P,E(V\\T),h \\ e : T'; is_type P T\\ \\ \n P,E,h \\ {V:T; e} : T'\"\n\n| WTrtSeq:\n \"\\ P,E,h \\ e\\<^sub>1 : T\\<^sub>1; P,E,h \\ e\\<^sub>2 : T\\<^sub>2 \\ \\ P,E,h \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2\"\n\n| WTrtCond:\n \"\\ P,E,h \\ e : Boolean; P,E,h \\ e\\<^sub>1 : T; P,E,h \\ e\\<^sub>2 : T \\\n \\ P,E,h \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n\n| WTrtWhile:\n \"\\ P,E,h \\ e : Boolean; P,E,h \\ c : T \\\n \\ P,E,h \\ while(e) c : Void\"\n\n| WTrtThrow:\n \"\\P,E,h \\ e : T'; is_refT T'\\ \n \\ P,E,h \\ throw e : T\"\n\n\n| WTrtNil:\n\"P,E,h \\ [] [:] []\"\n\n| WTrtCons:\n \"\\ P,E,h \\ e : T; P,E,h \\ es [:] Ts \\ \\ P,E,h \\ e#es [:] T#Ts\"\n\n\n\n\ndeclare\n WTrt_WTrts.intros[intro!]\n WTrtNil[iff]\ndeclare\n WTrtFAcc[rule del] WTrtFAccNT[rule del]\n WTrtFAss[rule del] WTrtFAssNT[rule del]\n WTrtCall[rule del] WTrtCallNT[rule del]\n\nlemmas WTrt_induct = WTrt_WTrts.induct [split_format (complete)]\n and WTrt_inducts = WTrt_WTrts.inducts [split_format (complete)]\n\n\nsubsection\\Easy consequences\\\n\ninductive_simps [iff]:\n \"P,E,h \\ [] [:] Ts\"\n \"P,E,h \\ e#es [:] T#Ts\"\n \"P,E,h \\ (e#es) [:] Ts\"\n \"P,E,h \\ Val v : T\"\n \"P,E,h \\ Var V : T\"\n \"P,E,h \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2\"\n \"P,E,h \\ {V:T; e} : T'\"\n\n\n\n\napply(induct_tac es\\<^sub>1)\n apply simp\napply clarsimp\napply(erule thin_rl)\napply (rule iffI)\n apply clarsimp\n apply(rule exI)+\n apply(rule conjI)\n prefer 2 apply blast\n apply simp\napply fastforce\ndone\n\n\n\ninductive_cases WTrt_elim_cases[elim!]:\n \"P,E,h \\ new C : T\"\n \"P,E,h \\ Cast C e : T\"\n \"P,E,h \\ \\C\\e : T\"\n \"P,E,h \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\"\n \"P,E,h \\ V:=e : T\"\n \"P,E,h \\ e\\F{Cs} : T\"\n \"P,E,h \\ e\\F{Cs} := v : T\"\n \"P,E,h \\ e\\M(es) : T\"\n \"P,E,h \\ e\\(C::)M(es) : T\"\n \"P,E,h \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n \"P,E,h \\ while(e) c : T\"\n \"P,E,h \\ throw e : T\"\n\n\nsubsection\\Some interesting lemmas\\\n\n\nlemma WTrts_Val[simp]:\n \"\\Ts. (P,E,h \\ map Val vs [:] Ts) = (map (\\v. (P \\ typeof\\<^bsub>h\\<^esub>) v) vs = map Some Ts)\"\n\napply(induct vs)\n apply fastforce\napply(case_tac Ts)\n apply simp\napply simp\ndone\n\n\n\n\n\n\nlemma WTrt_env_mono:\n \"P,E,h \\ e : T \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h \\ e : T)\" and\n \"P,E,h \\ es [:] Ts \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h \\ es [:] Ts)\"\n\napply(induct rule: WTrt_inducts)\napply(simp add: WTrtNew)\napply(fastforce simp: WTrtDynCast)\napply(fastforce simp: WTrtStaticCast)\napply(fastforce simp: WTrtVal)\napply(simp add: WTrtVar map_le_def dom_def)\napply(fastforce simp add: WTrtBinOp)\napply (force simp:map_le_def)\napply(fastforce simp: WTrtFAcc)\napply(simp add: WTrtFAccNT)\napply(fastforce simp: WTrtFAss)\napply(fastforce simp: WTrtFAssNT)\napply(fastforce simp: WTrtCall)\napply(fastforce simp: WTrtStaticCall)\napply(fastforce simp: WTrtCallNT)\napply(fastforce simp: map_le_def)\napply(fastforce)\napply(fastforce simp: WTrtCond)\napply(fastforce simp: WTrtWhile)\napply(fastforce simp: WTrtThrow)\napply(simp add: WTrtNil)\napply(simp add: WTrtCons)\ndone\n\n\nlemma WT_implies_WTrt: \"P,E \\ e :: T \\ P,E,h \\ e : T\"\nand WTs_implies_WTrts: \"P,E \\ es [::] Ts \\ P,E,h \\ es [:] Ts\"\n\nproof(induct rule: WT_WTs_inducts)\n case WTVal thus ?case by (fastforce dest:type_eq_type)\nnext\n case WTBinOp thus ?case by (fastforce split:bop.splits)\nnext\n case WTFAcc thus ?case\n by(fastforce intro!:WTrtFAcc dest:Subobjs_nonempty \n simp:LeastFieldDecl_def FieldDecls_def)\nnext\n case WTFAss thus ?case\n by(fastforce intro!:WTrtFAss dest:Subobjs_nonempty\n simp:LeastFieldDecl_def FieldDecls_def)\nnext\n case WTCall thus ?case by (fastforce intro:WTrtCall)\nqed (auto simp del:fun_upd_apply)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/CoreC++/WellTypeRT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.4493926344647596, "lm_q1q2_score": 0.25436455410793307}} {"text": "(* Title: HOL/Bali/Type.thy\n Author: David von Oheimb\n*)\n\nsubsection \\Java types\\\n\ntheory Type imports Name begin\n\ntext \\\nsimplifications:\n\\begin{itemize}\n\\item only the most important primitive types\n\\item the null type is regarded as reference type\n\\end{itemize}\n\\\n\ndatatype prim_ty \\\\primitive type, cf. 4.2\\\n = Void \\\\result type of void methods\\\n | Boolean\n | Integer\n\n\ndatatype ref_ty \\\\reference type, cf. 4.3\\\n = NullT \\\\null type, cf. 4.1\\\n | IfaceT qtname \\\\interface type\\\n | ClassT qtname \\\\class type\\\n | ArrayT ty \\\\array type\\\n\nand ty \\\\any type, cf. 4.1\\\n = PrimT prim_ty \\\\primitive type\\\n | RefT ref_ty \\\\reference type\\\n\nabbreviation \"NT == RefT NullT\"\nabbreviation \"Iface I == RefT (IfaceT I)\"\nabbreviation \"Class C == RefT (ClassT C)\"\nabbreviation Array :: \"ty \\ ty\" (\"_.[]\" [90] 90)\n where \"T.[] == RefT (ArrayT T)\"\n\ndefinition\n the_Class :: \"ty \\ qtname\"\n where \"the_Class T = (SOME C. T = Class C)\" (** primrec not possible here **)\n \nlemma the_Class_eq [simp]: \"the_Class (Class C)= C\"\nby (auto simp add: the_Class_def)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Bali/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.25427232876364536}} {"text": "theory JVMCFG_wf imports JVMInterpretation \"../StaticInter/CFGExit_wf\" begin\n\ninductive_set Def :: \"wf_jvmprog \\ cfg_node \\ var set\"\n for P :: \"wf_jvmprog\"\n and n :: \"cfg_node\"\nwhere\n Def_Main_Heap:\n \"n = (ClassMain P, MethodMain P, \\0\\, Return)\n \\ Heap \\ Def P n\"\n| Def_Main_Exception:\n \"n = (ClassMain P, MethodMain P, \\0\\, Return)\n \\ Exception \\ Def P n\"\n| Def_Main_Stack_0:\n \"n = (ClassMain P, MethodMain P, \\0\\, Return)\n \\ Stack 0 \\ Def P n\"\n| Def_Load:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Load idx;\n i = stkLength (P, C, M) pc\\\n \\ Stack i \\ Def P n\"\n| Def_Store:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Store idx \\\n \\ Local idx \\ Def P n\"\n| Def_Push:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Push v;\n i = stkLength (P, C, M) pc \\\n \\ Stack i \\ Def P n\"\n| Def_IAdd:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = IAdd;\n i = stkLength (P, C, M) pc - 2 \\\n \\ Stack i \\ Def P n\"\n| Def_CmpEq:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = CmpEq;\n i = stkLength (P, C, M) pc - 2 \\\n \\ Stack i \\ Def P n\"\n| Def_New_Heap:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = New Cl \\\n \\ Heap \\ Def P n\"\n| Def_New_Stack:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = New Cl;\n i = stkLength (P, C, M) pc \\\n \\ Stack i \\ Def P n\"\n| Def_Exception:\n \"\\ n = (C, M, \\pc\\, Exceptional pco nt);\n C \\ ClassMain P \\\n \\ Exception \\ Def P n\"\n| Def_Exception_handle:\n \"\\ n = (C, M, \\pc\\, Exceptional \\pc'\\ Enter);\n C \\ ClassMain P;\n i = stkLength (P, C, M) pc' - 1 \\\n \\ Stack i \\ Def P n\"\n| Def_Exception_handle_return:\n \"\\ n = (C, M, \\pc\\, Exceptional \\pc'\\ Return);\n C \\ ClassMain P;\n i = stkLength (P, C, M) pc' - 1 \\\n \\ Stack i \\ Def P n\"\n| Def_Getfield:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Getfield Cl Fd;\n i = stkLength (P, C, M) pc - 1 \\\n \\ Stack i \\ Def P n\"\n| Def_Putfield:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Putfield Cl Fd \\\n \\ Heap \\ Def P n\"\n| Def_Invoke_Return_Heap:\n \"\\ n = (C, M, \\pc\\, Return);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Invoke M' n' \\\n \\ Heap \\ Def P n\"\n| Def_Invoke_Return_Exception:\n \"\\ n = (C, M, \\pc\\, Return);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Invoke M' n' \\\n \\ Exception \\ Def P n\"\n| Def_Invoke_Return_Stack:\n \"\\ n = (C, M, \\pc\\, Return);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Invoke M' n';\n i = stkLength (P, C, M) (Suc pc) - 1 \\\n \\ Stack i \\ Def P n\"\n| Def_Invoke_Call_Heap:\n \"\\ n = (C, M, None, Enter);\n C \\ ClassMain P \\\n \\ Heap \\ Def P n\"\n| Def_Invoke_Call_Local:\n \"\\ n = (C, M, None, Enter);\n C \\ ClassMain P;\n i < locLength (P, C, M) 0 \\\n \\ Local i \\ Def P n\"\n| Def_Return:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = instr.Return \\\n \\ Stack 0 \\ Def P n\"\n\ninductive_set Use :: \"wf_jvmprog \\ cfg_node \\ var set\"\n for P :: \"wf_jvmprog\"\n and n :: \"cfg_node\"\nwhere\n Use_Main_Heap:\n \"n = (ClassMain P, MethodMain P, \\0\\, Normal)\n \\ Heap \\ Use P n\"\n| Use_Load:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Load idx \\\n \\ Local idx \\ Use P n\"\n| Use_Enter_Stack:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n case (instrs_of (PROG P) C M ! pc)\n of Store n' \\ d = 1\n | Getfield F Cl \\ d = 1\n | Putfield F Cl \\ d = 2\n | Checkcast Cl \\ d = 1\n | Invoke M' n' \\ d = Suc n'\n | IAdd \\ d \\ {1, 2}\n | IfFalse i \\ d = 1\n | CmpEq \\ d \\ {1 , 2}\n | Throw \\ d = 1\n | instr.Return \\ d = 1\n | _ \\ False;\n i = stkLength (P, C, M) pc - d \\\n \\ Stack i \\ Use P n\"\n| Use_Enter_Local:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n instrs_of (PROG P) C M ! pc = Load n' \\\n \\ Local n' \\ Use P n\"\n| Use_Enter_Heap:\n \"\\ n = (C, M, \\pc\\, Enter);\n C \\ ClassMain P;\n case (instrs_of (PROG P) C M ! pc)\n of New Cl \\ True\n | Checkcast Cl \\ True\n | Throw \\ True\n | _ \\ False \\\n \\ Heap \\ Use P n\"\n| Use_Normal_Heap:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n case (instrs_of (PROG P) C M ! pc)\n of New Cl \\ True\n | Getfield F Cl \\ True\n | Putfield F Cl \\ True\n | Invoke M' n' \\ True\n | _ \\ False \\\n \\ Heap \\ Use P n\"\n| Use_Normal_Stack:\n \"\\ n = (C, M, \\pc\\, Normal);\n C \\ ClassMain P;\n case (instrs_of (PROG P) C M ! pc)\n of Getfield F Cl \\ d = 1\n | Putfield F Cl \\ d \\ {1, 2}\n | Invoke M' n' \\ d > 0 \\ d \\ Suc n'\n | _ \\ False;\n i = stkLength (P, C, M) pc - d \\\n \\ Stack i \\ Use P n\"\n| Use_Return_Heap:\n \"\\ n = (C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n' \\ C = ClassMain P \\\n \\ Heap \\ Use P n\"\n| Use_Return_Stack:\n \"\\ n = (C, M, \\pc\\, Return);\n (instrs_of (PROG P) C M ! pc = Invoke M' n' \\ i = stkLength (P, C, M) (Suc pc) - 1) \\\n (C = ClassMain P \\ i = 0) \\\n \\ Stack i \\ Use P n\"\n| Use_Return_Exception:\n \"\\ n = (C, M, \\pc\\, Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n' \\ C = ClassMain P \\\n \\ Exception \\ Use P n\"\n| Use_Exceptional_Stack:\n \"\\ n = (C, M, \\pc\\, Exceptional opc' nt);\n case (instrs_of (PROG P) C M ! pc)\n of Throw \\ True\n | _ \\ False;\n i = stkLength (P, C, M) pc - 1 \\\n \\ Stack i \\ Use P n\"\n| Use_Exceptional_Exception:\n \"\\ n = (C, M, \\pc\\, Exceptional \\pc'\\ Return);\n instrs_of (PROG P) C M ! pc = Invoke M' n' \\\n \\ Exception \\ Use P n\"\n| Use_Method_Leave_Exception:\n \"\\ n = (C, M, None, Return);\n C \\ ClassMain P \\\n \\ Exception \\ Use P n\"\n| Use_Method_Leave_Heap:\n \"\\ n = (C, M, None, Return);\n C \\ ClassMain P \\\n \\ Heap \\ Use P n\"\n| Use_Method_Leave_Stack:\n \"\\ n = (C, M, None, Return);\n C \\ ClassMain P \\\n \\ Stack 0 \\ Use P n\"\n| Use_Method_Entry_Heap:\n \"\\ n = (C, M, None, Enter);\n C \\ ClassMain P \\\n \\ Heap \\ Use P n\"\n| Use_Method_Entry_Local:\n \"\\ n = (C, M, None, Enter);\n C \\ ClassMain P;\n i < locLength (P, C, M) 0 \\\n \\ Local i \\ Use P n\"\n\nfun ParamDefs :: \"wf_jvmprog \\ cfg_node \\ var list\"\nwhere\n \"ParamDefs P (C, M, \\pc\\, Return) = [Heap, Stack (stkLength (P, C, M) (Suc pc) - 1), Exception]\"\n | \"ParamDefs P (C, M, opc, nt) = []\"\n\nfunction ParamUses :: \"wf_jvmprog \\ cfg_node \\ var set list\"\nwhere\n \"ParamUses P (ClassMain P, MethodMain P, \\0\\, Normal) = [{Heap},{}]\"\n |\n \"M \\ MethodMain P \\ opc \\ \\0\\ \\ nt \\ Normal\n \\ ParamUses P (ClassMain P, M, opc, nt) = []\"\n |\n \"C \\ ClassMain P\n \\ ParamUses P (C, M, opc, nt) = (case opc of None \\ []\n | \\pc\\ \\ (case nt of Normal \\ (case (instrs_of (PROG P) C M ! pc) of\n Invoke M' n \\ (\n {Heap} # rev (map (\\n. {Stack (stkLength (P, C, M) pc - (Suc n))}) [0.. [])\n | _ \\ []\n )\n )\"\n by atomize_elim auto\ntermination by lexicographic_order\n\nlemma in_set_ParamDefsE:\n \"\\ V \\ set (ParamDefs P n);\n \\C M pc. \\ n = (C, M, \\pc\\, Return);\n V \\ {Heap, Stack (stkLength (P, C, M) (Suc pc) - 1), Exception} \\ \\ thesis \\\n \\ thesis\"\n by (cases \"(P, n)\" rule: ParamDefs.cases) auto\n\nlemma in_set_ParamUsesE:\n assumes V_in_ParamUses: \"V \\ \\(set (ParamUses P n))\"\n obtains \"n = (ClassMain P, MethodMain P, \\0\\, Normal)\" and \"V = Heap\"\n | C M pc M' n' i where \"n = (C, M, \\pc\\, Normal)\" and \"instrs_of (PROG P) C M ! pc = Invoke M' n'\"\n and \"V = Heap \\ V = Stack (stkLength (P, C, M) pc - Suc i)\" and \"i < Suc n'\" and \"C \\ ClassMain P\"\nproof (cases \"(P, n)\" rule: ParamUses.cases)\n case 1 with V_in_ParamUses that show ?thesis by clarsimp\nnext\n case 2 with V_in_ParamUses that show ?thesis by clarsimp\nnext\n case (3 C P M pc nt)\n with V_in_ParamUses that show ?thesis\n using [[simproc del: list_to_set_comprehension]]\n by (cases nt, auto) (rename_tac a b, case_tac \"instrs_of (PROG P) C M ! a\", simp_all, fastforce)\nqed\n\nlemma sees_method_fun_wf:\n assumes \"PROG P \\ D sees M': Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in D\"\n and \"(D, D', fs, ms) \\ set (PROG P)\"\n and \"(M', Ts', T', mxs', mxl\\<^sub>0', is', xt') \\ set ms\"\n shows \"Ts = Ts' \\ T = T' \\ mxs = mxs' \\ mxl\\<^sub>0 = mxl\\<^sub>0' \\ is = is' \\ xt = xt'\"\nproof -\n from distinct_class_names [of P] \\(D, D', fs, ms) \\ set (PROG P)\\\n have \"class (PROG P) D = \\(D', fs, ms)\\\"\n by (fastforce intro: map_of_SomeI simp: class_def)\n moreover with distinct_method_names have \"distinct_fst ms\"\n by fastforce\n ultimately show ?thesis using\n \\PROG P \\ D sees M': Ts\\T = (mxs, mxl\\<^sub>0, is, xt) in D\\\n \\(M', Ts', T', mxs', mxl\\<^sub>0', is', xt') \\ set ms\\\n by (fastforce dest: visible_method_exists map_of_SomeD distinct_fst_isin_same_fst\n simp: distinct_fst_is_distinct_fst)\nqed\n\ninterpretation JVMCFG_wf:\n CFG_wf \"sourcenode\" \"targetnode\" \"kind\" \"valid_edge (P, C0, Main)\"\n \"(ClassMain P, MethodMain P, None, Enter)\"\n \"(\\(C, M, pc, type). (C, M))\" \"get_return_edges P\"\n \"((ClassMain P, MethodMain P),[],[]) # procs (PROG P)\"\n \"(ClassMain P, MethodMain P)\"\n \"Def P\" \"Use P\" \"ParamDefs P\" \"ParamUses P\"\n for P C0 Main\nproof (unfold_locales)\n show \"Def P (ClassMain P, MethodMain P, None, Enter) = {} \\\n Use P (ClassMain P, MethodMain P, None, Enter) = {}\"\n by (fastforce elim: Def.cases Use.cases)\nnext\n fix a Q r p fs ins outs\n assume \"valid_edge (P, C0, Main) a\"\n and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and params: \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n hence \"(P, C0, Main) \\ sourcenode a -Q:r\\\\<^bsub>p\\<^esub>fs\\ targetnode a\"\n by (simp add: valid_edge_def)\n from this params show \"length (ParamUses P (sourcenode a)) = length ins\"\n proof cases\n case Main_Call\n with params show ?thesis\n by auto (erule in_set_procsE, auto dest: sees_method_idemp sees_method_fun)\n next\n case (CFG_Invoke_Call C M pc M' n ST LT D' Ts T mxs mxl0 \"is\" xt D Q' paramDefs)\n hence [simp]: \"Q' = Q\" and [simp]: \"r = (C, M, pc)\" and [simp]: \"p = (D, M')\"\n and [simp]: \"fs = paramDefs\"\n by simp_all\n from CFG_Invoke_Call obtain T' mxs' mpc' xt' where\n \"PROG P,T',mxs',mpc',xt' \\ instrs_of (PROG P) C M ! pc,pc :: TYPING P C M\"\n by (blast dest: reachable_node_impl_wt_instr)\n moreover from \\PROG P \\ D' sees M': Ts\\T = (mxs, mxl0, is, xt) in D\\\n have \"PROG P \\ D sees M': Ts\\T = (mxs, mxl0, is, xt) in D\"\n by -(drule sees_method_idemp)\n with params have \"PROG P \\ D sees M': Ts\\T=(mxs, mxl0, is, xt) in D\"\n and \"ins = Heap # map Local [0..\\<^bsub>p\\<^esub>f'\"\n and params: \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n hence \"(P, C0, Main) \\ sourcenode a -Q'\\\\<^bsub>p\\<^esub>f'\\ targetnode a\"\n by (simp add: valid_edge_def)\n from this params\n show \"length (ParamDefs P (targetnode a)) = length outs\"\n by cases (auto elim: in_set_procsE)\nnext\n fix n V\n assume params: \"V \\ set (ParamDefs P n)\"\n and vn: \"CFG.valid_node sourcenode targetnode (valid_edge (P, C0, Main)) n\"\n then obtain ek n'\n where ve:\"valid_edge (P, C0, Main) (n, ek, n') \\ valid_edge (P, C0, Main) (n', ek, n)\"\n by (fastforce simp: JVMCFG_Interpret.valid_node_def)\n from params obtain C M pc where [simp]: \"n = (C, M, \\pc\\, Return)\"\n and V: \"V \\ {Heap, Stack (stkLength (P, C, M) (Suc pc) - 1), Exception}\"\n by (blast elim: in_set_ParamDefsE)\n from ve show \"V \\ Def P n\"\n proof\n assume \"valid_edge (P, C0, Main) (n, ek, n')\"\n thus ?thesis unfolding valid_edge_def\n proof cases\n case Main_Return_to_Exit with V show ?thesis\n by (auto intro: Def_Main_Heap Def_Main_Stack_0 Def_Main_Exception simp: stkLength_def)\n next\n case CFG_Invoke_Return_Check_Normal with V show ?thesis\n by (fastforce intro: Def_Invoke_Return_Heap\n Def_Invoke_Return_Stack Def_Invoke_Return_Exception)\n next\n case CFG_Invoke_Return_Check_Exceptional with V show ?thesis\n by (fastforce intro: Def_Invoke_Return_Heap\n Def_Invoke_Return_Stack Def_Invoke_Return_Exception)\n next\n case CFG_Invoke_Return_Exceptional_prop with V show ?thesis\n by (fastforce intro: Def_Invoke_Return_Heap\n Def_Invoke_Return_Stack Def_Invoke_Return_Exception)\n qed simp_all\n next\n assume \"valid_edge (P, C0, Main) (n', ek, n)\"\n thus ?thesis unfolding valid_edge_def\n proof cases\n case Main_Call_LFalse with V show ?thesis\n by (auto intro: Def_Main_Heap Def_Main_Stack_0 Def_Main_Exception simp: stkLength_def)\n next\n case CFG_Invoke_False with V show ?thesis\n by (fastforce intro: Def_Invoke_Return_Heap\n Def_Invoke_Return_Stack Def_Invoke_Return_Exception)\n next\n case CFG_Return_from_Method with V show ?thesis\n by (fastforce elim!: JVMCFG.cases intro!: Def_Main_Stack_0\n intro: Def_Main_Heap Def_Main_Exception Def_Invoke_Return_Heap\n Def_Invoke_Return_Exception Def_Invoke_Return_Stack simp: stkLength_def)\n qed simp_all\n qed\nnext\n fix a Q r p fs ins outs V\n assume ve: \"valid_edge (P, C0, Main) a\"\n and kind: \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and params: \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n and V: \"V \\ set ins\"\n from params V obtain D fs ms Ts T mb where \"class (PROG P) (fst p) = \\(D, fs, ms)\\\"\n and \"method\": \"PROG P \\ (fst p) sees (snd p): Ts\\T = mb in (fst p)\"\n and ins: \"ins = Heap # map Local [0.. Def P (targetnode a)\" unfolding valid_edge_def\n proof cases\n case (Main_Call T' mxs mxl0 \"is\" xt D' initParams)\n with kind have \"PROG P \\ D' sees Main: []\\T' = (mxs, mxl0, is, xt) in D'\"\n and [simp]: \"p = (D', Main)\"\n by (auto dest: sees_method_idemp)\n with \"method\" have [simp]: \"Ts = []\" and [simp]: \"T' = T\" and [simp]: \"mb = (mxs, mxl0, is, xt)\"\n by (fastforce dest: sees_method_fun)+\n from Main_Call ins V show ?thesis\n by (fastforce intro!: Def_Invoke_Call_Heap Def_Invoke_Call_Local\n dest: sees_method_idemp wt_jvm_prog_impl_wt_start[OF wf_jvmprog_is_wf_typ]\n simp: locLength_def wt_start_def)\n next\n case (CFG_Invoke_Call C M pc M' n ST LT D' Ts' T' mxs mxl0 \"is\" xt D'')\n with kind have \"PROG P \\ D'' sees M': Ts'\\T' = (mxs, mxl0, is, xt) in D''\"\n and [simp]: \"p = (D'', M')\"\n by (auto dest: sees_method_idemp)\n with \"method\" have [simp]: \"Ts' = Ts\" and [simp]: \"T' = T\" and [simp]: \"mb = (mxs, mxl0, is, xt)\"\n by (fastforce dest: sees_method_fun)+\n from CFG_Invoke_Call ins V show ?thesis\n by (fastforce intro!: Def_Invoke_Call_Local Def_Invoke_Call_Heap\n dest: sees_method_idemp wt_jvm_prog_impl_wt_start[OF wf_jvmprog_is_wf_typ] list_all2_lengthD\n simp: locLength_def min_def wt_start_def)\n qed simp_all\nnext\n fix a Q r p fs\n assume \"valid_edge (P, C0, Main) a\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n thus \"Def P (sourcenode a) = {}\" unfolding valid_edge_def\n by cases (auto elim: Def.cases)\nnext\n fix n V\n assume \"CFG.valid_node sourcenode targetnode (valid_edge (P, C0, Main)) n\"\n and V: \"V \\ \\(set (ParamUses P n))\"\n then obtain ek n'\n where ve:\"valid_edge (P, C0, Main) (n, ek, n') \\ valid_edge (P, C0, Main) (n', ek, n)\"\n by (fastforce simp: JVMCFG_Interpret.valid_node_def)\n from V obtain C M pc M' n'' i where\n V: \"n = (ClassMain P, MethodMain P, \\0\\, Normal) \\ V = Heap \\\n n = (C, M, \\pc\\, Normal) \\ instrs_of (PROG P) C M ! pc = Invoke M' n'' \\\n (V = Heap \\ V = Stack (stkLength (P, C, M) pc - Suc i)) \\ i < Suc n'' \\ C \\ ClassMain P\"\n by -(erule in_set_ParamUsesE, fastforce+)\n from ve show \"V \\ Use P n\"\n proof\n assume \"valid_edge (P, C0, Main) (n, ek, n')\"\n from this V show ?thesis unfolding valid_edge_def\n proof cases\n case Main_Call_LFalse with V show ?thesis by (fastforce intro: Use_Main_Heap)\n next\n case Main_Call with V show ?thesis by (fastforce intro: Use_Main_Heap)\n next\n case CFG_Invoke_Call with V show ?thesis\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack [where d=\"Suc i\"])\n next\n case CFG_Invoke_False with V show ?thesis\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack [where d=\"Suc i\"])\n qed simp_all\n next\n assume \"valid_edge (P, C0, Main) (n', ek, n)\"\n from this V show ?thesis unfolding valid_edge_def\n proof cases\n case Main_to_Call with V show ?thesis by (fastforce intro: Use_Main_Heap)\n next\n case CFG_Invoke_Check_NP_Normal with V show ?thesis\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack [where d=\"Suc i\"])\n qed simp_all\n qed\nnext\n fix a Q p f ins outs V\n assume \"valid_edge (P, C0, Main) a\"\n and \"kind a = Q\\\\<^bsub>p\\<^esub>f\"\n and \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n and \"V \\ set outs\"\n thus \"V \\ Use P (sourcenode a)\" unfolding valid_edge_def\n by (cases, simp_all)\n (fastforce elim: in_set_procsE\n intro: Use_Method_Leave_Heap Use_Method_Leave_Stack Use_Method_Leave_Exception)\nnext\n fix a V s\n assume ve: \"valid_edge (P, C0, Main) a\"\n and V_notin_Def: \"V \\ Def P (sourcenode a)\"\n and ik: \"intra_kind (kind a)\"\n and pred: \"JVMCFG_Interpret.pred (kind a) s\"\n show \"JVMCFG_Interpret.state_val\n (CFG.transfer (((ClassMain P, MethodMain P), [], []) # procs (PROG P)) (kind a) s) V\n = JVMCFG_Interpret.state_val s V\"\n proof (cases s)\n case Nil\n thus ?thesis by simp\n next\n case [simp]: Cons\n with ve V_notin_Def ik pred show ?thesis unfolding valid_edge_def\n proof cases\n case CFG_Load with V_notin_Def show ?thesis by (fastforce intro: Def_Load)\n next case CFG_Store with V_notin_Def show ?thesis by (fastforce intro: Def_Store)\n next case CFG_Push with V_notin_Def show ?thesis by (fastforce intro: Def_Push)\n next case CFG_IAdd with V_notin_Def show ?thesis by (fastforce intro: Def_IAdd)\n next case CFG_CmpEq with V_notin_Def show ?thesis by (fastforce intro: Def_CmpEq)\n next case CFG_New_Update with V_notin_Def show ?thesis\n by (fastforce intro: Def_New_Heap Def_New_Stack)\n next case CFG_New_Exceptional_prop with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception)\n next case CFG_New_Exceptional_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Getfield_Update with V_notin_Def show ?thesis\n by (fastforce intro: Def_Getfield split: prod.split)\n next case CFG_Getfield_Exceptional_prop with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception)\n next case CFG_Getfield_Exceptional_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Putfield_Update with V_notin_Def show ?thesis\n by (fastforce intro: Def_Putfield split: prod.split)\n next case CFG_Putfield_Exceptional_prop with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception)\n next case CFG_Putfield_Exceptional_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Checkcast_Exceptional_prop with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception)\n next case CFG_Checkcast_Exceptional_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Throw_prop with V_notin_Def show ?thesis by (fastforce intro: Def_Exception)\n next case CFG_Throw_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Invoke_NP_prop with V_notin_Def show ?thesis by (fastforce intro: Def_Exception)\n next case CFG_Invoke_NP_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception Def_Exception_handle)\n next case CFG_Invoke_Return_Exceptional_handle with V_notin_Def show ?thesis\n by (fastforce intro: Def_Exception_handle_return Def_Exception)\n next case CFG_Return with V_notin_Def show ?thesis by (fastforce intro: Def_Return)\n qed (simp_all add: intra_kind_def)\n qed\nnext\n fix a s s'\n assume ve: \"valid_edge (P, C0, Main) a\"\n and use_Eq: \"\\V\\Use P (sourcenode a). JVMCFG_Interpret.state_val s V\n = JVMCFG_Interpret.state_val s' V\"\n and ik: \"intra_kind (kind a)\"\n and pred_s: \"JVMCFG_Interpret.pred (kind a) s\"\n and pred_s': \"JVMCFG_Interpret.pred (kind a) s'\"\n then obtain cfs C M pc cs cfs' C' M' pc' cs' where [simp]: \"s = (cfs, (C, M, pc)) # cs\"\n and [simp]: \"s' = (cfs', (C', M', pc')) # cs'\"\n by (cases s, fastforce) (cases s', fastforce+)\n from ve show \"\\V\\Def P (sourcenode a).\n JVMCFG_Interpret.state_val\n (CFG.transfer (((ClassMain P, MethodMain P), [], []) # procs (PROG P)) (kind a) s) V =\n JVMCFG_Interpret.state_val\n (CFG.transfer (((ClassMain P, MethodMain P), [], []) # procs (PROG P)) (kind a) s') V\"\n unfolding valid_edge_def\n proof cases\n case Main_Call with ik show ?thesis by (simp add: intra_kind_def)\n next case Main_Return_to_Exit with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Return_Heap Use_Return_Exception Use_Return_Stack)\n next case Method_LFalse with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Method_Entry_Heap Use_Method_Entry_Local) \n next case Method_LTrue with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Method_Entry_Heap Use_Method_Entry_Local)\n next case CFG_Load with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Enter_Local)\n next case CFG_Store with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Enter_Stack)\n next case (CFG_IAdd C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Stack (stkLength (P, C, M) pc - 2) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)+\n with use_Eq CFG_IAdd show ?thesis by (auto elim!: Def.cases)\n next case (CFG_CmpEq C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Stack (stkLength (P, C, M) pc - 2) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)+\n with use_Eq CFG_CmpEq show ?thesis by (auto elim!: Def.cases)\n next case CFG_New_Update\n hence \"Heap \\ Use P (sourcenode a)\" by (fastforce intro: Use_Normal_Heap)\n with use_Eq CFG_New_Update show ?thesis by (fastforce elim: Def.cases)\n next case (CFG_Getfield_Update C M pc)\n hence \"Heap \\ Use P (sourcenode a)\"\n and \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack)+\n with use_Eq CFG_Getfield_Update show ?thesis by (auto elim!: Def.cases split: prod.split)\n next case (CFG_Putfield_Update C M pc)\n hence \"Heap \\ Use P (sourcenode a)\"\n and \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Stack (stkLength (P, C, M) pc - 2) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack)+\n with use_Eq CFG_Putfield_Update show ?thesis by (auto elim!: Def.cases split: prod.split)\n next case (CFG_Throw_prop C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Exceptional_Stack)\n with use_Eq CFG_Throw_prop show ?thesis by (fastforce elim: Def.cases)\n next case (CFG_Throw_handle C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Exceptional_Stack)\n with use_Eq CFG_Throw_handle show ?thesis by (fastforce elim: Def.cases)\n next case CFG_Invoke_Call with ik show ?thesis by (simp add: intra_kind_def)\n next case CFG_Invoke_Return_Check_Normal with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Return_Heap Use_Return_Exception Use_Return_Stack)\n next case CFG_Invoke_Return_Check_Exceptional with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Return_Heap Use_Return_Exception Use_Return_Stack)\n next case CFG_Invoke_Return_Exceptional_handle with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Exceptional_Exception)\n next case CFG_Invoke_Return_Exceptional_prop with use_Eq show ?thesis\n by (fastforce elim: Def.cases intro: Use_Return_Heap Use_Return_Exception Use_Return_Stack)\n next case CFG_Return with use_Eq show ?thesis\n by (fastforce elim!: Def.cases intro: Use_Enter_Stack)\n next case CFG_Return_from_Method with ik show ?thesis by (simp add: intra_kind_def)\n qed (fastforce elim: Def.cases)+\nnext\n fix a s s'\n assume ve: \"valid_edge (P, C0, Main) a\"\n and pred: \"JVMCFG_Interpret.pred (kind a) s\"\n and \"snd (hd s) = snd (hd s')\"\n and use_Eq: \"\\V\\Use P (sourcenode a).\n JVMCFG_Interpret.state_val s V = JVMCFG_Interpret.state_val s' V\"\n and \"length s = length s'\"\n then obtain cfs C M pc cs cfs' cs' where [simp]: \"s = (cfs, (C, M, pc)) # cs\"\n and [simp]: \"s' = (cfs', (C, M, pc)) # cs'\" and length_cs: \"length cs = length cs'\"\n by (cases s, fastforce) (cases s', fastforce+)\n from ve pred show \"JVMCFG_Interpret.pred (kind a) s'\"\n unfolding valid_edge_def\n proof cases\n case Main_Call_LFalse with pred show ?thesis by simp\n next case Main_Call with pred use_Eq show ?thesis by simp\n next case Method_LTrue with pred use_Eq show ?thesis by simp\n next case CFG_Goto with pred use_Eq show ?thesis by simp\n next case (CFG_IfFalse_False C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with use_Eq CFG_IfFalse_False pred show ?thesis by fastforce\n next case (CFG_IfFalse_True C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_IfFalse_True show ?thesis by fastforce\n next case CFG_New_Check_Normal\n hence \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Heap)\n with pred use_Eq CFG_New_Check_Normal show ?thesis by fastforce\n next case CFG_New_Check_Exceptional \n hence \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Heap)\n with pred use_Eq CFG_New_Check_Exceptional show ?thesis by fastforce\n next case (CFG_Getfield_Check_Normal C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Getfield_Check_Normal show ?thesis by fastforce\n next case (CFG_Getfield_Check_Exceptional C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Getfield_Check_Exceptional show ?thesis by fastforce\n next case (CFG_Putfield_Check_Normal C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 2) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Putfield_Check_Normal show ?thesis by fastforce\n next case (CFG_Putfield_Check_Exceptional C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 2) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Putfield_Check_Exceptional show ?thesis by fastforce\n next case (CFG_Checkcast_Check_Normal C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack Use_Enter_Heap)+\n with pred use_Eq CFG_Checkcast_Check_Normal show ?thesis by fastforce\n next case (CFG_Checkcast_Check_Exceptional C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack Use_Enter_Heap)+\n with pred use_Eq CFG_Checkcast_Check_Exceptional show ?thesis by fastforce\n next case (CFG_Throw_Check C M pc)\n hence \"Stack (stkLength (P, C, M) pc - 1) \\ Use P (sourcenode a)\"\n and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack Use_Enter_Heap)+\n with pred use_Eq CFG_Throw_Check show ?thesis by fastforce\n next case (CFG_Invoke_Check_NP_Normal C M pc M' n)\n hence \"Stack (stkLength (P, C, M) pc - (Suc n)) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Invoke_Check_NP_Normal show ?thesis by fastforce\n next case (CFG_Invoke_Check_NP_Exceptional C M pc M' n)\n hence \"Stack (stkLength (P, C, M) pc - (Suc n)) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Enter_Stack)\n with pred use_Eq CFG_Invoke_Check_NP_Exceptional show ?thesis by fastforce\n next case (CFG_Invoke_Call C M pc M' n)\n hence \"Stack (stkLength (P, C, M) pc - (Suc n)) \\ Use P (sourcenode a)\"\n and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Normal_Heap Use_Normal_Stack)+\n with pred use_Eq CFG_Invoke_Call show ?thesis by fastforce\n next case CFG_Invoke_Return_Check_Normal\n hence \"Exception \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Return_Exception)\n with pred use_Eq CFG_Invoke_Return_Check_Normal show ?thesis by fastforce\n next case CFG_Invoke_Return_Check_Exceptional\n hence \"Exception \\ Use P (sourcenode a)\" and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Return_Exception Use_Return_Heap)+\n with pred use_Eq CFG_Invoke_Return_Check_Exceptional show ?thesis by fastforce\n next case CFG_Invoke_Return_Exceptional_prop\n hence \"Exception \\ Use P (sourcenode a)\" and \"Heap \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Return_Exception Use_Return_Heap)+\n with pred use_Eq CFG_Invoke_Return_Exceptional_prop show ?thesis by fastforce\n next case CFG_Return_from_Method with pred length_cs show ?thesis by clarsimp\n qed auto\nnext\n fix a Q r p fs ins outs\n assume \"valid_edge (P, C0, Main) a\"\n and kind: \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and params: \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n thus \"length fs = length ins\" unfolding valid_edge_def\n proof cases\n case (Main_Call T mxs mxl0 \"is\" xt D)\n with kind params have [simp]: \"p = (D, Main)\"\n and \"PROG P \\ D sees Main: []\\T = (mxs, mxl0, is, xt) in D\"\n and \"ins = Heap # map Local [0.. D' sees M': Ts\\T = (mxs, mxl0, is, xt) in D\"\n and \"ins = Heap # map Local [0..(P, C0, Main) \\ \\(C, M, \\pc\\, Normal)\\ \\C \\ ClassMain P\\\n \\instrs_of (PROG P) C M ! pc = Invoke M' n\\ \\TYPING P C M ! pc = \\(ST, LT)\\\\\n \\ST ! n = Class D'\\ have \"n = length Ts\"\n by (fastforce dest!: reachable_node_impl_wt_instr dest: sees_method_fun list_all2_lengthD)\n ultimately show ?thesis using CFG_Invoke_Call kind by auto\n qed simp_all\nnext\n fix a Q r p fs a' Q' r' p' fs' s s'\n assume ve_a: \"valid_edge (P, C0, Main) a\"\n and kind_a: \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and ve_a': \"valid_edge (P, C0, Main) a'\"\n and kind_a': \"kind a' = Q':r'\\\\<^bsub>p'\\<^esub>fs'\"\n and src: \"sourcenode a = sourcenode a'\"\n and pred_s: \"JVMCFG_Interpret.pred (kind a) s\"\n and pred_s': \"JVMCFG_Interpret.pred (kind a') s\"\n then obtain cfs C M pc cs cfs' C' M' pc' cs' \n where [simp]: \"s = (cfs, (C, M, pc)) # cs\" \n by (cases s) fastforce+\n with ve_a kind_a show \"a = a'\" unfolding valid_edge_def\n proof cases\n case Main_Call with ve_a' kind_a' src pred_s pred_s' show ?thesis unfolding valid_edge_def\n by (cases a, cases a') (fastforce elim: JVMCFG.cases dest: sees_method_fun)\n next\n case CFG_Invoke_Call\n note invoke_call1 = this\n from ve_a' kind_a' show ?thesis unfolding valid_edge_def\n proof cases\n case Main_Call with CFG_Invoke_Call src have False by simp\n thus ?thesis by simp\n next\n case CFG_Invoke_Call with src invoke_call1 show ?thesis\n by clarsimp (cases a, cases a', fastforce dest: sees_method_fun)\n qed simp_all\n qed simp_all\nnext\n fix a Q r p fs i ins outs s s'\n assume ve: \"valid_edge (P, C0, Main) a\"\n and kind: \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"i < length ins\"\n and \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n and \"JVMCFG_Interpret.pred (kind a) s\"\n and \"JVMCFG_Interpret.pred (kind a) s'\"\n and use_Eq: \"\\V\\ParamUses P (sourcenode a) ! i.\n JVMCFG_Interpret.state_val s V = JVMCFG_Interpret.state_val s' V\"\n then obtain cfs C M pc cs cfs' C' M' pc' cs' where [simp]: \"s = (cfs, (C, M, pc)) # cs\"\n and [simp]: \"s' = (cfs', (C', M', pc')) # cs'\"\n by (cases s, fastforce) (cases s', fastforce+)\n from ve kind\n show \"JVMCFG_Interpret.params fs (JVMCFG_Interpret.state_val s) ! i =\n JVMCFG_Interpret.params fs (JVMCFG_Interpret.state_val s') ! i\"\n unfolding valid_edge_def\n proof cases\n case Main_Call with kind use_Eq \\i < length ins\\ show ?thesis\n by (cases i) auto\n next\n case CFG_Invoke_Call\n { fix P C M pc n st st' i\n have \"\\V\\rev (map (\\n. {Stack (stkLength (P, C, M) pc - Suc n)}) [0.. JVMCFG_Interpret.params\n (rev (map (\\i s. s (Stack (stkLength (P, C, M) pc - Suc i))) [0..i s. s (Stack (stkLength (P, C, M) pc - Suc i))) [0..i < length ins\\ show ?thesis\n by (cases i, auto) (case_tac nat, auto intro: stack_params)\n qed simp_all\nnext\n fix a Q' p f' ins outs vmap vmap'\n assume \"valid_edge (P, C0, Main) a\"\n and \"kind a = Q'\\\\<^bsub>p\\<^esub>f'\"\n and \"(p, ins, outs) \\ set (((ClassMain P, MethodMain P), [], []) # procs (PROG P))\"\n thus \"f' vmap vmap' = vmap'(ParamDefs P (targetnode a) [:=] map vmap outs)\"\n unfolding valid_edge_def\n by (cases, simp_all) (fastforce elim: in_set_procsE simp: fun_upd_twist)\nnext\n fix a a'\n { fix P n f n' e n''\n assume \"P \\ n -\\f\\ n'\" and \"P \\ n -e\\ n''\"\n hence \"e = \\f \\ n' = n''\"\n by cases (simp_all, (fastforce elim: JVMCFG.cases)+)\n }\n note upd_det = this\n { fix P n Q n' Q' n'' s\n assume \"P \\ n -(Q)\\<^sub>\\\\ n'\" and edge': \"P \\ n -(Q')\\<^sub>\\\\ n''\" and trg: \"n' \\ n''\"\n hence \"(Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\n proof cases\n case CFG_Throw_Check with edge' trg show ?thesis by cases fastforce+\n qed (simp_all, (fastforce elim: JVMCFG.cases)+)\n }\n note pred_det = this\n assume \"valid_edge (P, C0, Main) a\"\n and ve': \"valid_edge (P, C0, Main) a'\"\n and src: \"sourcenode a = sourcenode a'\"\n and trg: \"targetnode a \\ targetnode a'\"\n and \"intra_kind (kind a)\"\n and \"intra_kind (kind a')\"\n thus \"\\Q Q'. kind a = (Q)\\<^sub>\\ \\ kind a' = (Q')\\<^sub>\\ \\ (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n unfolding valid_edge_def intra_kind_def\n by (auto dest: upd_det pred_det)\nqed\n\ninterpretation JVMCFGExit_wf :\n CFGExit_wf \"sourcenode\" \"targetnode\" \"kind\" \"valid_edge (P, C0, Main)\"\n \"(ClassMain P, MethodMain P, None, Enter)\"\n \"(\\(C, M, pc, type). (C, M))\" \"get_return_edges P\"\n \"((ClassMain P, MethodMain P),[],[]) # procs (PROG P)\"\n \"(ClassMain P, MethodMain P)\"\n \"(ClassMain P, MethodMain P, None, Return)\"\n \"Def P\" \"Use P\" \"ParamDefs P\" \"ParamUses P\"\nproof\n show \"Def P (ClassMain P, MethodMain P, None, nodeType.Return) = {} \\\n Use P (ClassMain P, MethodMain P, None, nodeType.Return) = {}\"\n by (fastforce elim: Def.cases Use.cases)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/JinjaVM_Inter/JVMCFG_wf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.2542723287636453}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory DomainSepInv\nimports\n \"ArchIpc_AC\" (* for transfer_caps_loop_pres_dest lec_valid_cap' set_simple_ko_get_tcb thread_set_tcb_fault_update_valid_mdb *)\n \"Monads.WPBang\"\nbegin\n\ntext \\\n We define and prove an invariant that is necessary to achieve domain\n separation on seL4. In its strongest form, we require that all IRQs, other than\n those for the timer, are inactive, and that no IRQControl or\n IRQHandler caps are present (to prevent any inactive IRQs from becoming\n active in the future).\n\n It always requires that there are no domain caps.\n\\\n\ntext \\\n When @{term irqs} is @{term False} we require that non-timer IRQs are off permanently.\n\\\ndefinition domain_sep_inv :: \"bool \\ 'a :: state_ext state \\ 'b :: state_ext state \\ bool\" where\n \"domain_sep_inv irqs st s \\\n (\\slot. \\ cte_wp_at ((=) DomainCap) slot s) \\\n (irqs \\ (\\irq slot. \\ cte_wp_at ((=) IRQControlCap) slot s\n \\ \\ cte_wp_at ((=) (IRQHandlerCap irq)) slot s\n \\ interrupt_states s irq \\ IRQSignal\n \\ interrupt_states s irq \\ IRQReserved\n \\ interrupt_states s = interrupt_states st))\"\n\ndefinition domain_sep_inv_cap where\n \"domain_sep_inv_cap irqs cap \\ case cap of\n IRQControlCap \\ irqs\n | IRQHandlerCap irq \\ irqs\n | DomainCap \\ False\n | _ \\ True\"\n\nlemma cte_wp_at_not_domain_sep_inv_cap:\n \"cte_wp_at (not domain_sep_inv_cap irqs) slot s \\\n ((irqs \\ False) \\\n (\\ irqs \\ (cte_wp_at ((=) IRQControlCap) slot s \\\n (\\ irq. cte_wp_at ((=) (IRQHandlerCap irq)) slot s)))) \\\n cte_wp_at ((=) DomainCap) slot s\"\n apply (rule iffI)\n apply (drule cte_wp_at_norm)\n apply clarsimp\n apply (case_tac c, simp_all add: domain_sep_inv_cap_def pred_neg_def)\n apply (auto elim: cte_wp_at_weakenE split: if_splits)\n done\n\nlemma domain_sep_inv_def2:\n \"domain_sep_inv irqs st s =\n ((\\slot. \\ cte_wp_at ((=) DomainCap) slot s) \\\n (irqs \\ (\\irq slot. \\ cte_wp_at ((=) IRQControlCap) slot s\n \\ \\ cte_wp_at ((=) (IRQHandlerCap irq)) slot s)) \\\n (irqs \\ (\\irq. interrupt_states s irq \\ IRQSignal\n \\ interrupt_states s irq \\ IRQReserved\n \\ interrupt_states s = interrupt_states st)))\"\n by (fastforce simp: domain_sep_inv_def)\n\nlemma domain_sep_inv_wp:\n assumes nctrl:\n \"\\slot. \\(\\s. \\ cte_wp_at (not domain_sep_inv_cap irqs) slot s) and P\\\n f\n \\\\_ s. \\ cte_wp_at (not domain_sep_inv_cap irqs) slot s\\\"\n assumes irq_pres:\n \"\\P. \\ irqs \\ \\(\\s. P (interrupt_states s)) and R\\\n f\n \\\\_ s. P (interrupt_states s)\\\"\n shows\n \"\\domain_sep_inv irqs st and P and (\\s. irqs \\ R s)\\\n f\n \\\\_. domain_sep_inv irqs st\\\"\n apply (clarsimp simp: domain_sep_inv_def2 valid_def)\n apply (subst conj_assoc[symmetric])\n apply (rule conjI)\n apply (rule conjI)\n apply (intro allI)\n apply (erule use_valid[OF _ hoare_strengthen_post[OF nctrl]])\n apply (fastforce simp: cte_wp_at_not_domain_sep_inv_cap)\n apply (fastforce simp: cte_wp_at_not_domain_sep_inv_cap)\n apply (fastforce elim!: use_valid[OF _ hoare_strengthen_post[OF nctrl]]\n simp: cte_wp_at_not_domain_sep_inv_cap)\n apply (case_tac \"irqs\")\n apply blast\n apply (rule disjI2)\n apply simp\n apply (intro allI conjI)\n apply (erule_tac P1=\"\\x. x irq \\ IRQSignal\" in use_valid[OF _ irq_pres], assumption)\n apply blast\n apply (erule use_valid[OF _ irq_pres], assumption)\n apply blast\n apply (erule use_valid[OF _ irq_pres], assumption)\n apply blast\n done\n\nlemma domain_sep_inv_triv:\n assumes cte_pres: \"\\P slot. \\\\s. \\ cte_wp_at P slot s\\ f \\\\_ s. \\ cte_wp_at P slot s\\\"\n assumes irq_pres: \"\\P. \\\\s. P (interrupt_states s)\\ f \\\\_ s. P (interrupt_states s)\\\"\n shows \"\\domain_sep_inv irqs st\\ f \\\\_. domain_sep_inv irqs st\\\"\n apply (rule domain_sep_inv_wp[where P=\"\\\" and R=\"\\\", simplified])\n apply (rule cte_pres, rule irq_pres)\n done\n\nlemma domain_sep_inv_arch_state_update[simp]:\n \"domain_sep_inv irqs st (s\\arch_state := blah\\) = domain_sep_inv irqs st s\"\n by (simp add: domain_sep_inv_def)\n\nlemma domain_sep_inv_machine_state_update[simp]:\n \"domain_sep_inv irqs st (s\\machine_state := X\\) = domain_sep_inv irqs st s\"\n by (simp add: domain_sep_inv_def)\n\nlemma detype_interrupts_states[simp]:\n \"interrupt_states (detype S s) = interrupt_states s\"\n by (simp add: detype_def)\n\nlemma detype_domain_sep_inv[simp]:\n \"domain_sep_inv irqs st s \\ domain_sep_inv irqs st (detype S s)\"\n by (fastforce simp: domain_sep_inv_def)\n\nlemma domain_sep_inv_detype_lift:\n \"\\P\\ f \\\\rv. domain_sep_inv irqs st\\ \\\n \\P\\ f \\\\rv s. domain_sep_inv irqs st (detype S s)\\\"\n by (strengthen detype_domain_sep_inv, assumption)\n\ncrunch domain_sep_inv[wp]: set_extra_badge \"domain_sep_inv irqs st\"\n\n(* FIXME: following 3 lemmas clagged from FinalCaps *)\nlemma set_cap_neg_cte_wp_at_other_helper':\n \"\\ oslot \\ slot; ko_at (TCB x) (fst oslot) s;\n tcb_cap_cases (snd oslot) = Some (ogetF, osetF, orestr);\n kheap (s\\kheap := kheap s(fst oslot \\ TCB (osetF (\\ x. cap) x))\\) (fst slot) = Some (TCB tcb);\n tcb_cap_cases (snd slot) = Some (getF, setF, restr); P (getF tcb) \\\n \\ cte_wp_at P slot s\"\n apply (case_tac \"fst oslot = fst slot\")\n apply (rule cte_wp_at_tcbI)\n apply (fastforce split: if_splits simp: obj_at_def)\n apply assumption\n apply (fastforce split: if_splits simp: tcb_cap_cases_def dest: prod_eqI)\n apply (rule cte_wp_at_tcbI)\n apply (fastforce split: if_splits simp: obj_at_def)\n apply assumption\n apply assumption\n done\n\nlemma set_cap_neg_cte_wp_at_other_helper:\n \"\\ \\ cte_wp_at P slot s; oslot \\ slot; ko_at (TCB x) (fst oslot) s;\n tcb_cap_cases (snd oslot) = Some (getF, setF, restr) \\\n \\ \\ cte_wp_at P slot (s\\kheap := kheap s(fst oslot \\ TCB (setF (\\ x. cap) x))\\)\"\n apply (rule notI)\n apply (erule cte_wp_atE)\n apply (fastforce elim: notE intro: cte_wp_at_cteI split: if_splits)\n apply (fastforce elim: notE intro: set_cap_neg_cte_wp_at_other_helper')\n done\n\nlemma set_cap_neg_cte_wp_at_other:\n \"oslot \\ slot \\ set_cap cap oslot \\\\s. \\ cte_wp_at P slot s\\\"\n unfolding set_cap_def\n apply (wp set_object_wp get_object_wp | wpc | simp add: split_def)+\n apply (intro allI impI conjI)\n apply (rule notI)\n apply (erule cte_wp_atE)\n apply (fastforce split: if_splits dest: prod_eqI elim: notE intro: cte_wp_at_cteI simp: obj_at_def)\n apply (fastforce split: if_splits elim: notE intro: cte_wp_at_tcbI)\n apply (auto dest: set_cap_neg_cte_wp_at_other_helper)\n done\n\nlemma set_cap_neg_cte_wp_at:\n \"\\\\s. \\ cte_wp_at P slot s \\ \\ P capa\\\n set_cap capa slota\n \\\\_ s. \\ cte_wp_at P slot s\\\"\n apply (case_tac \"slot = slota\")\n apply simp\n apply (simp add: set_cap_def set_object_def)\n apply (rule hoare_pre)\n apply (wp get_object_wp | wpc)+\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n apply (rule hoare_pre)\n apply (rule set_cap_neg_cte_wp_at_other, simp+)\n done\n\nlemma domain_sep_inv_cap_IRQControlCap:\n \"\\ domain_sep_inv_cap irqs cap; \\ irqs \\ \\ cap \\ IRQControlCap\"\n by (auto simp: domain_sep_inv_cap_def)\n\nlemma domain_sep_inv_cap_IRQHandlerCap:\n \"\\ domain_sep_inv_cap irqs cap; \\ irqs \\ \\ cap \\ IRQHandlerCap irq\"\n by (auto simp: domain_sep_inv_cap_def)\n\nlemma set_cap_domain_sep_inv:\n \"\\domain_sep_inv irqs st and K (domain_sep_inv_cap irqs cap)\\\n set_cap cap slot\n \\\\_. domain_sep_inv irqs st\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (rule domain_sep_inv_wp)\n apply (wp set_cap_neg_cte_wp_at | simp add: pred_neg_def | blast)+\n done\n\nlemma cte_wp_at_domain_sep_inv_cap:\n \"\\ domain_sep_inv irqs st s; cte_wp_at ((=) cap) slot s \\\n \\ domain_sep_inv_cap irqs cap\"\n apply (case_tac slot)\n apply (auto simp: domain_sep_inv_def domain_sep_inv_cap_def split: cap.splits)\n done\n\nlemma weak_derived_irq_handler:\n \"weak_derived (IRQHandlerCap irq) cap \\ cap = (IRQHandlerCap irq)\"\n by (auto simp: weak_derived_def copy_of_def same_object_as_def split: cap.splits if_splits)\n\n(* FIXME: move to CSpace_AI *)\nlemma weak_derived_DomainCap:\n \"weak_derived c' c \\ (c' = DomainCap) = (c = DomainCap)\"\n apply (clarsimp simp: weak_derived_def)\n apply (erule disjE)\n apply (clarsimp simp: copy_of_def split: if_split_asm)\n apply (auto simp: is_cap_simps same_object_as_def\n split: cap.splits)[1]\n apply simp\n done\n\nlemma cte_wp_at_weak_derived_domain_sep_inv_cap:\n \"\\ domain_sep_inv irqs st s; cte_wp_at (weak_derived cap) slot s \\\n \\ domain_sep_inv_cap irqs cap\"\n apply (cases slot)\n apply (force simp: domain_sep_inv_def domain_sep_inv_cap_def\n split: cap.splits\n dest: cte_wp_at_norm weak_derived_irq_handler weak_derived_DomainCap)\n done\n\nlemma is_derived_IRQHandlerCap:\n \"is_derived m src (IRQHandlerCap irq) cap \\ (cap = IRQHandlerCap irq)\"\n apply (clarsimp simp: is_derived_def)\n apply (case_tac cap, simp_all add: is_cap_simps cap_master_cap_def)\n done\n\n(* FIXME: move to CSpace_AI *)\nlemma DomainCap_is_derived:\n \"is_derived m src DomainCap cap \\ cap = DomainCap\"\n by (auto simp: is_derived_def is_reply_cap_def is_master_reply_cap_def cap_master_cap_def\n split: cap.splits)\n\nlemma cte_wp_at_is_derived_domain_sep_inv_cap:\n \"\\ domain_sep_inv irqs st s; cte_wp_at (is_derived (cdt s) slot cap) slot s \\\n \\ domain_sep_inv_cap irqs cap\"\n apply (cases slot)\n apply (fastforce simp: domain_sep_inv_def domain_sep_inv_cap_def\n split: cap.splits\n dest: cte_wp_at_norm DomainCap_is_derived is_derived_IRQHandlerCap)\n done\n\nlemma domain_sep_inv_exst_update[simp]:\n \"domain_sep_inv irqs st (trans_state f s) = domain_sep_inv irqs st s\"\n by (simp add: domain_sep_inv_def)\n\nlemma domain_sep_inv_is_original_cap_update[simp]:\n \"domain_sep_inv irqs st (s\\is_original_cap := X\\) = domain_sep_inv irqs st s\"\n by (simp add: domain_sep_inv_def)\n\nlemma domain_sep_inv_cdt_update[simp]:\n \"domain_sep_inv irqs st (s\\cdt := X\\) = domain_sep_inv irqs st s\"\n by (simp add: domain_sep_inv_def)\n\ncrunch domain_sep_inv[wp]: update_cdt \"domain_sep_inv irqs st\"\n\nlemma set_untyped_cap_as_full_domain_sep_inv[wp]:\n \"set_untyped_cap_as_full a b c \\domain_sep_inv irqs st\\\"\n apply (clarsimp simp: set_untyped_cap_as_full_def)\n apply (rule hoare_pre)\n apply (rule set_cap_domain_sep_inv)\n apply (case_tac a, simp_all add: domain_sep_inv_cap_def)\n done\n\nlemma cap_insert_domain_sep_inv:\n \"\\domain_sep_inv irqs st and (\\s. cte_wp_at (is_derived (cdt s) slot cap) slot s)\\\n cap_insert cap slot dest_slot\n \\\\_. domain_sep_inv irqs st \\\"\n apply (simp add: cap_insert_def)\n apply (wpsimp wp: set_cap_domain_sep_inv get_cap_wp set_original_wp dxo_wp_weak)\n apply (blast dest: cte_wp_at_is_derived_domain_sep_inv_cap)\n done\n\nlemma domain_sep_inv_cap_NullCap[simp]:\n \"domain_sep_inv_cap irqs NullCap\"\n by (simp add: domain_sep_inv_cap_def)\n\nlemma cap_move_domain_sep_inv:\n \"\\domain_sep_inv irqs st and (\\s. cte_wp_at (weak_derived cap) slot s)\\\n cap_move cap slot dest_slot\n \\\\_. domain_sep_inv irqs st \\\"\n apply (simp add: cap_move_def)\n apply (wpsimp wp: set_cap_domain_sep_inv get_cap_wp set_original_wp dxo_wp_weak)\n apply (blast dest: cte_wp_at_weak_derived_domain_sep_inv_cap)\n done\n\nlemma set_irq_state_domain_sep_inv:\n \"\\domain_sep_inv irqs st and (\\s. stt = interrupt_states s irq)\\\n set_irq_state stt irq\n \\\\_. domain_sep_inv irqs st\\\"\n apply (simp add: set_irq_state_def)\n apply (wp | simp add: do_machine_op_def | wpc)+\n done\n\n\nlocale DomainSepInv_1 =\n fixes state_ext_t :: \"'state_ext :: state_ext itself\"\n assumes arch_finalise_cap_domain_sep_inv[wp]:\n \"arch_finalise_cap c x \\\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n and arch_post_cap_deletion_domain_sep_inv[wp]:\n \"arch_post_cap_deletion acap \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and init_arch_objects_domain_sep_inv[wp]:\n \"init_arch_objects typ ptr n sz refs \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and prepare_thread_delete_domain_sep_inv[wp]:\n \"prepare_thread_delete t \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_finalise_cap_rv:\n \"\\\\_. P (NullCap,NullCap)\\ arch_finalise_cap c x \\\\rv s :: det_ext state. P rv\\\"\nbegin\n\nlemma deleted_irq_handler_domain_sep_inv:\n \"\\domain_sep_inv irqs st and K irqs\\\n deleted_irq_handler irq\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: deleted_irq_handler_def set_irq_state_def)\n apply wp\n apply (simp add: domain_sep_inv_def)\n done\n\nlemma empty_slot_domain_sep_inv:\n \"\\\\s. domain_sep_inv irqs st s \\ (\\ irqs \\ b = NullCap)\\\n empty_slot a b\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding empty_slot_def post_cap_deletion_def\n by (wpsimp wp: get_cap_wp set_cap_domain_sep_inv set_original_wp dxo_wp_weak\n static_imp_wp deleted_irq_handler_domain_sep_inv)\n\nend\n\n\nlemma set_simple_ko_neg_cte_wp_at[wp]:\n \"set_simple_ko f a b \\\\s. \\ cte_wp_at P slot s\\\"\n apply (simp add: set_simple_ko_def)\n apply (wp set_object_wp_strong get_object_wp\n | simp add: partial_inv_def a_type_def split: kernel_object.splits)+\n apply (case_tac \"a = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (fastforce elim: cte_wp_atE simp: obj_at_def)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\ncrunch domain_sep_inv[wp]: set_simple_ko \"domain_sep_inv irqs st\"\n (wp: domain_sep_inv_triv)\n\nlemma set_thread_state_neg_cte_wp_at[wp]:\n \"set_thread_state a b \\\\s. \\ cte_wp_at P slot s\\\"\n apply (simp add: set_thread_state_def)\n apply (wp set_object_wp get_object_wp dxo_wp_weak| simp)+\n apply (case_tac \"a = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma set_bound_notification_neg_cte_wp_at[wp]:\n \"set_bound_notification a b \\\\s. \\ cte_wp_at P slot s\\\"\n apply (simp add: set_bound_notification_def)\n apply (wp set_object_wp get_object_wp dxo_wp_weak| simp)+\n apply (case_tac \"a = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\ncrunch domain_sep_inv[wp]: set_thread_state, set_bound_notification, get_bound_notification \"domain_sep_inv irqs st\"\n (wp: domain_sep_inv_triv)\n\nlemma thread_set_tcb_fault_update_neg_cte_wp_at[wp]:\n \"thread_set (tcb_fault_update blah) t \\\\s. \\ cte_wp_at P slot s\\\"\n apply (simp add: thread_set_def)\n apply (wp set_object_wp get_object_wp | simp)+\n apply (case_tac \"t = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma thread_set_tcb_fault_update_domain_sep_inv[wp]:\n \"thread_set (tcb_fault_update blah) t \\domain_sep_inv irqs st\\\"\n by (wp domain_sep_inv_triv)\n\ncrunch domain_sep_inv[wp]: as_user \"domain_sep_inv irqs st\"\n (wp: domain_sep_inv_triv)\n\nlemma get_cap_domain_sep_inv_cap:\n \"\\domain_sep_inv irqs st\\ get_cap cap \\\\rv s. domain_sep_inv_cap irqs rv\\\"\n by (wpsimp wp: get_cap_wp simp: cte_wp_at_domain_sep_inv_cap)\n\ncrunch domain_sep_inv[wp]: cap_swap_for_delete \"domain_sep_inv irqs st\"\n (wp: get_cap_domain_sep_inv_cap dxo_wp_weak simp: crunch_simps ignore: cap_swap_ext)\n\nlemma preemption_point_domain_sep_inv[wp]:\n \"preemption_point \\domain_sep_inv irqs st\\\"\n by (wp preemption_point_inv | simp)+\n\n\ncontext DomainSepInv_1 begin\n\ncrunches cap_delete_one\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n (wp: mapM_x_wp' unless_wp dxo_wp_weak simp: crunch_simps)\n\nlemma reply_cancel_ipc_domain_sep_inv[wp]:\n \"\\domain_sep_inv irqs st\\\n reply_cancel_ipc t\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: reply_cancel_ipc_def)\n apply (wp select_wp)\n apply (rule hoare_strengthen_post[OF thread_set_tcb_fault_update_domain_sep_inv])\n apply auto\n done\n\ncrunches finalise_cap\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n (wp: dxo_wp_weak)\n\nlemma finalise_cap_domain_sep_inv_cap:\n \"\\\\s. domain_sep_inv_cap irqs cap\\\n finalise_cap cap b\n \\\\rv s :: det_ext state. domain_sep_inv_cap irqs (fst rv)\\\"\n including no_pre\n apply (case_tac cap)\n apply (wp | simp add: o_def split del: if_split split: cap.splits\n | fastforce split: if_splits simp: domain_sep_inv_cap_def)+\n apply (rule hoare_pre, wp, fastforce)\n apply (rule hoare_pre, simp, wp, fastforce simp: domain_sep_inv_cap_def)\n apply (wpc | wp arch_finalise_cap_rv | simp)+\n done\n\nlemma finalise_cap_returns_NullCap:\n \"\\\\s. domain_sep_inv_cap irqs cap\\\n finalise_cap cap b\n \\\\rv s :: det_ext state. \\ irqs \\ snd rv = NullCap\\\"\n apply (case_tac cap)\n by (wpsimp wp: arch_finalise_cap_rv simp: o_def domain_sep_inv_cap_def split_del: if_split)+\n\nlemma rec_del_domain_sep_inv':\n notes drop_spec_valid[wp_split del] drop_spec_validE[wp_split del]\n rec_del.simps[simp del]\n shows\n \"s \\ \\domain_sep_inv irqs st\\\n rec_del call\n \\\\rv s. (case call of (FinaliseSlotCall x y) \\ (y \\ fst rv) \\ \\ irqs \\ snd rv = NullCap\n | _ \\ True) \\\n domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\,\n \\\\_. domain_sep_inv irqs st\\\"\n proof (induct s arbitrary: rule: rec_del.induct, simp_all only: rec_del_fails hoare_fail_any)\n case (1 slot exposed s) show ?case\n apply (simp add: split_def rec_del.simps)\n apply (wpsimp wp: empty_slot_domain_sep_inv\n drop_spec_validE[OF returnOk_wp]\n drop_spec_validE[OF liftE_wp])\n apply (rule spec_strengthen_postE[OF \"1.hyps\"])\n apply fastforce\n done\n next\n case (2 slot exposed s) show ?case\n apply (simp add: rec_del.simps split del: if_split)\n apply (rule hoare_pre_spec_validE)\n apply (wp drop_spec_validE[OF returnOk_wp] drop_spec_validE[OF liftE_wp] set_cap_domain_sep_inv\n | simp add: split_def split del: if_split)+\n apply (rule spec_strengthen_postE)\n apply (rule \"2.hyps\", fastforce+)\n apply (rule drop_spec_validE, (wp preemption_point_inv| simp)+)[1]\n apply simp\n apply (rule spec_strengthen_postE)\n apply (rule \"2.hyps\", fastforce+)\n apply (wp finalise_cap_domain_sep_inv_cap get_cap_wp\n finalise_cap_returns_NullCap\n drop_spec_validE[OF liftE_wp] set_cap_domain_sep_inv\n |simp split del: if_split\n |wp (once) hoare_drop_imps)+\n apply (blast dest: cte_wp_at_domain_sep_inv_cap)\n done\n next\n case (3 ptr bits n slot s) show ?case\n apply (simp add: rec_del.simps)\n apply (wp drop_spec_validE[OF returnOk_wp] drop_spec_validE[OF liftE_wp])\n apply (rule hoare_pre_spec_validE)\n apply (wp drop_spec_validE[OF assertE_wp])\n apply (fastforce)\n done\n next\n case (4 ptr bits n slot s) show ?case\n apply (simp add: rec_del.simps)\n apply (wp drop_spec_validE[OF returnOk_wp] drop_spec_validE[OF liftE_wp] set_cap_domain_sep_inv\n drop_spec_validE[OF assertE_wp] get_cap_wp | simp)+\n apply (rule spec_strengthen_postE[OF \"4.hyps\"])\n apply (simp add: returnOk_def return_def)\n apply (clarsimp simp: domain_sep_inv_cap_def)\n done\n qed\n\nlemma rec_del_domain_sep_inv:\n \"\\domain_sep_inv irqs st\\\n rec_del call\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (rule validE_valid)\n apply (rule use_spec)\n apply (rule spec_strengthen_postE[OF rec_del_domain_sep_inv'])\n by fastforce\n\ncrunches cap_delete\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n\nlemma cap_revoke_domain_sep_inv':\n notes drop_spec_valid[wp_split del] drop_spec_validE[wp_split del]\n shows\n \"s \\ \\ domain_sep_inv irqs st\\\n cap_revoke slot\n \\ \\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\, \\ \\_. domain_sep_inv irqs st\\\"\n proof(induct rule: cap_revoke.induct[where ?a1.0=s])\n case (1 slot s)\n show ?case\n apply (subst cap_revoke.simps)\n apply (rule hoare_pre_spec_validE)\n apply (wp \"1.hyps\")\n apply (wp spec_valid_conj_liftE2 | simp)+\n apply (wp drop_spec_validE[OF valid_validE[OF preemption_point_domain_sep_inv]]\n drop_spec_validE[OF valid_validE[OF cap_delete_domain_sep_inv]]\n drop_spec_validE[OF assertE_wp] drop_spec_validE[OF returnOk_wp]\n drop_spec_validE[OF liftE_wp] select_wp\n | simp | wp (once) hoare_drop_imps)+\n done\nqed\n\nlemmas cap_revoke_domain_sep_inv[wp] = use_spec(2)[OF cap_revoke_domain_sep_inv']\n\nend\n\n\nlemma cap_move_cte_wp_at_other:\n \"\\cte_wp_at P slot and K (slot \\ dest_slot \\ slot \\ src_slot)\\\n cap_move cap src_slot dest_slot\n \\\\_. cte_wp_at P slot\\\"\n unfolding cap_move_def\n by (wpsimp wp: set_cdt_cte_wp_at set_cap_cte_wp_at' dxo_wp_weak static_imp_wp set_original_wp)\n\nlemma cte_wp_at_weak_derived_ReplyCap:\n \"cte_wp_at ((=) (ReplyCap x False R)) slot s\n \\ cte_wp_at (weak_derived (ReplyCap x False R)) slot s\"\n apply (erule cte_wp_atE)\n apply (rule cte_wp_at_cteI)\n apply assumption\n apply assumption\n apply assumption\n apply simp\n apply (rule cte_wp_at_tcbI)\n apply auto\n done\n\nlemma thread_set_tcb_registers_caps_merge_default_tcb_neg_cte_wp_at[wp]:\n \"thread_set (tcb_registers_caps_merge default_tcb) word \\\\s. \\ cte_wp_at P slot s\\\"\n unfolding thread_set_def\n apply (wp set_object_wp | simp)+\n apply (case_tac \"word = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (clarsimp simp: tcb_cap_cases_def tcb_registers_caps_merge_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma thread_set_tcb_registers_caps_merge_default_tcb_domain_sep_inv[wp]:\n \"thread_set (tcb_registers_caps_merge default_tcb) word \\domain_sep_inv irqs st\\\"\n by (wp domain_sep_inv_triv)\n\nlemma cancel_badged_sends_domain_sep_inv[wp]:\n \"cancel_badged_sends epptr badge \\domain_sep_inv irqs st\\\"\n apply (simp add: cancel_badged_sends_def)\n apply (wpsimp wp: dxo_wp_weak mapM_wp | simp add: filterM_mapM | wp (once) hoare_drop_imps)+\n done\n\nlemma create_cap_domain_sep_inv[wp]:\n \"create_cap tp sz p dev slot \\domain_sep_inv irqs st\\\"\n apply (simp add: create_cap_def)\n apply (rule hoare_pre)\n apply (wp set_cap_domain_sep_inv dxo_wp_weak | wpc | simp)+\n apply clarsimp\n apply (case_tac tp, simp_all add: domain_sep_inv_cap_def)\n done\n\nlemma retype_region_neg_cte_wp_at_not_domain_sep_inv_cap:\n \"retype_region base n sz ty dev \\\\s. \\ cte_wp_at (not domain_sep_inv_cap irqs) slot s\\\"\n apply (rule hoare_pre)\n apply (simp only: retype_region_def retype_addrs_def foldr_upd_app_if fun_app_def K_bind_def)\n apply (wp dxo_wp_weak | simp)+\n apply clarsimp\n apply (case_tac \"fst slot \\ (\\p. ptr_add base (p * 2 ^ obj_bits_api ty sz)) ` {0..domain_sep_inv irqs st\\\"\n apply (rule domain_sep_inv_wp[where P=\"\\\" and R=\"\\\", simplified])\n apply (rule retype_region_neg_cte_wp_at_not_domain_sep_inv_cap)\n apply wp\n done\n\nlemma domain_sep_inv_cap_UntypedCap[simp]:\n \"domain_sep_inv_cap irqs (UntypedCap dev base sz n)\"\n by (simp add: domain_sep_inv_cap_def)\n\ncrunch domain_sep_inv[wp]: delete_objects \"domain_sep_inv irqs st\"\n (wp: domain_sep_inv_detype_lift)\n\n\ncontext DomainSepInv_1 begin\n\ncrunches finalise_slot, invoke_untyped, send_signal\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n (wp: crunch_wps mapME_x_inv_wp simp: crunch_simps mapM_x_def_bak)\n\nlemma invoke_cnode_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_cnode_inv ci\\\n invoke_cnode ci\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding invoke_cnode_def\n apply (case_tac ci)\n apply (wp cap_insert_domain_sep_inv cap_move_domain_sep_inv | simp split del: if_split)+\n apply (rule hoare_pre)\n apply (wpsimp wp: cap_move_domain_sep_inv cap_move_cte_wp_at_other get_cap_wp,\n blast dest: cte_wp_at_weak_derived_domain_sep_inv_cap)+\n apply (wpsimp wp: cap_move_domain_sep_inv get_cap_wp)\n apply (fastforce dest: cte_wp_at_weak_derived_ReplyCap)\n apply (wp | simp | wpc | rule hoare_pre)+\n done\n\nend\n\n\nlemma perform_page_invocation_domain_sep_inv_get_cap_helper:\n \"\\\\\\ get_cap blah \\\\rv s. domain_sep_inv_cap irqs (ArchObjectCap (F rv))\\\"\n apply (simp add: domain_sep_inv_cap_def)\n apply (rule wp_post_taut)\n done\n\nlemma set_object_tcb_context_update_neg_cte_wp_at:\n \"\\\\s. \\ cte_wp_at P slot s \\ obj_at ((=) (TCB tcb)) ptr s\\\n set_object ptr (TCB (tcb\\tcb_arch := arch_tcb_context_set X (arch_tcb tcb)\\))\n \\\\_ s. \\ cte_wp_at P slot s\\\"\n apply (wp set_object_wp)\n apply clarsimp\n apply (case_tac \"ptr = fst slot\")\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (erule notE)\n apply (clarsimp simp: obj_at_def)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply (fastforce)\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma set_object_tcb_arch_update_domain_sep_inv:\n \"\\domain_sep_inv irqs st and obj_at ((=) (TCB tcb)) ptr\\\n set_object ptr (TCB (tcb\\tcb_arch := arch\\))\n \\\\_. domain_sep_inv irqs st\\\"\n apply (wp set_object_wp)\n apply (simp add: domain_sep_inv_def fun_upd_def cte_wp_at_caps_of_state)\n apply (fastforce simp: caps_of_state_after_update obj_at_def tcb_cap_cases_def)\n done\n\nlemma dxo_domain_sep_inv[wp]:\n \"do_extended_op eop \\domain_sep_inv irqs st\\\"\n by (simp | wp dxo_wp_weak)+\n\ncrunch domain_sep_inv[wp]: copy_mrs, set_message_info, set_mrs \"domain_sep_inv irqs st\"\n (wp: crunch_wps set_object_tcb_arch_update_domain_sep_inv simp: crunch_simps ignore: set_object)\n\nlemma cap_insert_domain_sep_inv':\n \"\\domain_sep_inv irqs st and K (domain_sep_inv_cap irqs cap)\\\n cap_insert cap slot dest_slot\n \\\\_. domain_sep_inv irqs st\\\"\n apply (simp add: cap_insert_def)\n apply (wp set_cap_domain_sep_inv get_cap_wp dxo_wp_weak | simp split del: if_split)+\n done\n\nlemma domain_sep_inv_cap_max_free_index_update[simp]:\n \"domain_sep_inv_cap irqs (max_free_index_update cap) =\n domain_sep_inv_cap irqs cap\"\n by (simp add: max_free_index_def free_index_update_def split: cap.splits)\n\nlemma domain_sep_inv_cap_ArchObjectCap[simp]:\n \"domain_sep_inv_cap irqs (ArchObjectCap arch_cap)\"\n by (simp add: domain_sep_inv_cap_def)\n\n\nlocale DomainSepInv_2 = DomainSepInv_1 state_ext_t\n for state_ext_t :: \"'state_ext :: state_ext itself\" +\n assumes arch_switch_to_thread_domain_sep_inv[wp]:\n \"arch_switch_to_thread t \\\\s :: det_ext state. domain_sep_inv irqs (st :: 'state_ext state) s\\\"\n and arch_switch_to_idle_thread_domain_sep_inv[wp]:\n \"arch_switch_to_idle_thread \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_activate_idle_thread_domain_sep_inv[wp]:\n \"arch_activate_idle_thread t \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_mask_irq_signal_domain_sep_inv[wp]:\n \"arch_mask_irq_signal irq \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_derive_cap_domain_sep_inv[wp]:\n \"\\\\\\ arch_derive_cap acap \\\\rv s :: det_ext state. domain_sep_inv_cap irqs rv\\,-\"\n and arch_post_modify_registers_domain_sep_inv[wp]:\n \"arch_post_modify_registers cur x31 \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_perform_invocation_domain_sep_inv[wp]:\n \"\\domain_sep_inv irqs st and valid_arch_inv ai\\\n arch_perform_invocation ai\n \\\\_ s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_invoke_irq_handler_domain_sep_inv[wp]:\n \"arch_invoke_irq_handler ihi \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and arch_invoke_irq_control_domain_sep_inv:\n \"\\domain_sep_inv irqs st and arch_irq_control_inv_valid ivk\\\n arch_invoke_irq_control ivk\n \\\\_ s :: det_ext state. domain_sep_inv irqs st s\\\"\n and handle_arch_fault_reply_domain_sep_inv[wp]:\n \"handle_arch_fault_reply vmf thread x y \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and handle_hypervisor_fault_domain_sep_inv[wp]:\n \"handle_hypervisor_fault t hf_t \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and handle_vm_fault_domain_sep_inv[wp]:\n \"handle_vm_fault t vmf_t \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\n and handle_reserved_irq_domain_sep_inv[wp]:\n \"handle_reserved_irq irq \\\\s :: det_ext state. domain_sep_inv irqs st s\\\"\nbegin\n\n(* when i is AckIRQ the preconditions here contradict each other, which\n is why this lemma is true *)\nlemma invoke_irq_handler_domain_sep_inv:\n \"\\domain_sep_inv irqs st and irq_handler_inv_valid i\\\n invoke_irq_handler i\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (case_tac i)\n apply (wp cap_insert_domain_sep_inv' | simp)+\n apply (rename_tac irq cap cslot_ptr s)\n apply (case_tac cap, simp_all add: domain_sep_inv_cap_def)[1]\n apply (wp | clarsimp)+\n done\n\n(* similarly, the preconditions here tend to contradict one another *)\nlemma invoke_control_domain_sep_inv:\n \"\\domain_sep_inv irqs st and irq_control_inv_valid i\\\n invoke_irq_control i\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n including no_pre\n apply (case_tac i)\n apply (case_tac irqs)\n apply (wp cap_insert_domain_sep_inv' | simp )+\n apply (simp add: set_irq_state_def, wp, simp)\n apply (fastforce simp: domain_sep_inv_def domain_sep_inv_cap_def)\n apply (fastforce simp: valid_def domain_sep_inv_def)\n apply simp\n apply (wp arch_invoke_irq_control_domain_sep_inv)\n done\n\nlemma derive_cap_domain_sep_inv_cap:\n \"\\\\s. domain_sep_inv_cap irqs cap\\\n derive_cap slot cap\n \\\\rv s :: det_ext state. domain_sep_inv_cap irqs rv\\,-\"\n apply (simp add: derive_cap_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp add: )+\n apply auto\n done\n\nend\n\n\ncrunch domain_sep_inv[wp]: receive_signal, complete_signal \"domain_sep_inv irqs st\"\n\nlemma domain_sep_inv_cap_ReplyCap[simp]:\n \"domain_sep_inv_cap irqs (ReplyCap param_a param_b param_c)\"\n by (simp add: domain_sep_inv_cap_def)\n\nlemma setup_caller_cap_domain_sep_inv[wp]:\n \"\\domain_sep_inv irqs st\\\n setup_caller_cap a b c\n \\\\_. domain_sep_inv irqs st\\\"\n apply (simp add: setup_caller_cap_def split del:if_split)\n apply (wp cap_insert_domain_sep_inv' | simp)+\n done\n\nlemma transfer_caps_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb\n and (\\ s. (\\x\\set caps.\n s \\ fst x) \\\n (\\x\\set caps.\n cte_wp_at\n (\\cp. fst x \\ NullCap \\\n cp = fst x)\n (snd x) s \\\n real_cte_at (snd x) s))\\\n transfer_caps mi caps endpoint receiver receive_buffer\n \\\\_. domain_sep_inv irqs st\\\"\n unfolding transfer_caps_def\n apply (wpsimp wp: transfer_caps_loop_pres_dest cap_insert_domain_sep_inv\n hoare_vcg_all_lift hoare_vcg_imp_lift)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\ncontext DomainSepInv_2 begin\n\nlemma do_normal_transfer_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb\\\n do_normal_transfer sender send_buffer ep badge grant receiver recv_buffer\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding do_normal_transfer_def\n by (wp transfer_caps_domain_sep_inv hoare_vcg_ball_lift lec_valid_cap' | simp)+\n\ncrunches do_fault_transfer\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n\nlemma do_ipc_transfer_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb\\\n do_ipc_transfer sender ep badge grant receiver\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding do_ipc_transfer_def\n apply (wp do_normal_transfer_domain_sep_inv hoare_vcg_all_lift | wpc | wp (once) hoare_drop_imps)+\n apply clarsimp\n done\n\nlemma send_ipc_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb and\n sym_refs \\ state_refs_of\\\n send_ipc block call badge can_grant can_grant_reply thread epptr\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding send_ipc_def\n apply (wp setup_caller_cap_domain_sep_inv hoare_vcg_if_lift | wpc | simp split del:if_split)+\n apply (rule_tac Q=\"\\ r s. domain_sep_inv irqs st s\" in hoare_strengthen_post)\n apply (wp do_ipc_transfer_domain_sep_inv dxo_wp_weak | wpc | simp)+\n apply (wp (once) hoare_drop_imps)\n apply (wp get_simple_ko_wp)+\n apply clarsimp\n apply (fastforce simp: valid_objs_def valid_obj_def obj_at_def ep_q_refs_of_def\n a_type_def ep_redux_simps neq_Nil_conv valid_ep_def\n elim: ep_queued_st_tcb_at split: list.splits)\n done\n\nlemma receive_ipc_base_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb and\n sym_refs \\ state_refs_of and ko_at (Endpoint ep) epptr \\\n receive_ipc_base aag receiver ep epptr rights is_blocking\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (clarsimp cong: endpoint.case_cong thread_get_def get_thread_state_def)\n apply (wp setup_caller_cap_domain_sep_inv dxo_wp_weak | wpc | simp split del: if_split)+\n apply (rule_tac Q=\"\\ r s. domain_sep_inv irqs st s\" in hoare_strengthen_post)\n apply (wp do_ipc_transfer_domain_sep_inv hoare_vcg_all_lift | wpc | simp)+\n apply (wpsimp wp: hoare_vcg_imp_lift[OF set_simple_ko_get_tcb, unfolded disj_not1]\n hoare_vcg_all_lift get_simple_ko_wp\n simp: a_type_def do_nbrecv_failed_transfer_def)+\n apply (fastforce simp: valid_objs_def valid_obj_def obj_at_def\n ep_redux_simps neq_Nil_conv valid_ep_def\n split: list.splits)\n done\n\nlemma receive_ipc_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and valid_mdb and sym_refs \\ state_refs_of\\\n receive_ipc receiver cap is_blocking\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding receive_ipc_def\n apply (simp add: receive_ipc_def split: cap.splits, clarsimp)\n apply (rule hoare_seq_ext[OF _ get_simple_ko_sp])\n apply (rule hoare_seq_ext[OF _ gbn_sp])\n apply (case_tac ntfnptr, simp)\n apply (wp receive_ipc_base_domain_sep_inv get_simple_ko_wp | simp split: if_split option.splits)+\n done\n\nlemma send_fault_ipc_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_objs and sym_refs \\ state_refs_of\n and valid_mdb and K (valid_fault fault)\\\n send_fault_ipc thread fault\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n unfolding send_fault_ipc_def\n apply (rule hoare_gen_asm)+\n apply (wp send_ipc_domain_sep_inv thread_set_valid_objs thread_set_tcb_fault_update_valid_mdb\n thread_set_refs_trivial thread_set_obj_at_impossible hoare_vcg_ex_lift\n | wpc | simp add: Let_def split_def lookup_cap_def valid_tcb_fault_update)+\n apply (wpe get_cap_inv[where P=\"domain_sep_inv irqs st and valid_objs and valid_mdb\n and sym_refs o state_refs_of\"])\n apply (wp | simp)+\n done\n\ncrunches do_reply_transfer, handle_fault, reply_from_kernel, restart\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n (wp: handle_arch_fault_reply_domain_sep_inv dxo_wp_weak crunch_wps ignore: thread_set)\n\nend\n\ncrunch domain_sep_inv[wp]: setup_reply_master \"domain_sep_inv irqs st\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma thread_set_tcb_ipc_buffer_update_neg_cte_wp_at[wp]:\n \"thread_set (tcb_ipc_buffer_update f) t \\\\s. \\ cte_wp_at P slot s\\\"\n unfolding thread_set_def\n apply (wp set_object_wp | simp)+\n apply (case_tac \"t = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma thread_set_tcb_ipc_buffer_update_domain_sep_inv[wp]:\n \"thread_set (tcb_ipc_buffer_update f) t \\domain_sep_inv irqs st\\\"\n by (rule domain_sep_inv_triv; wp)\n\nlemma thread_set_tcb_fault_handler_update_neg_cte_wp_at[wp]:\n \"thread_set (tcb_fault_handler_update f) t \\\\s. \\ cte_wp_at P slot s\\\"\n unfolding thread_set_def\n apply (wp set_object_wp | simp)+\n apply (case_tac \"t = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma thread_set_tcb_fault_handler_update_domain_sep_inv[wp]:\n \"thread_set (tcb_fault_handler_update f) t \\domain_sep_inv irqs st\\\"\n by (rule domain_sep_inv_triv; wp)\n\nlemma thread_set_tcb_tcb_mcpriority_update_neg_cte_wp_at[wp]:\n \"thread_set (tcb_mcpriority_update f) t \\\\s. \\ cte_wp_at P slot s\\\"\n unfolding thread_set_def\n apply (wp set_object_wp | simp)+\n apply (case_tac \"t = fst slot\")\n apply (clarsimp split: kernel_object.splits)\n apply (erule notE)\n apply (erule cte_wp_atE)\n apply (fastforce simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (rule cte_wp_at_tcbI)\n apply simp\n apply assumption\n apply (fastforce simp: tcb_cap_cases_def split: if_splits)\n apply (fastforce elim: cte_wp_atE intro: cte_wp_at_cteI cte_wp_at_tcbI)\n done\n\nlemma thread_set_tcb_tcp_mcpriority_update_domain_sep_inv[wp]:\n \"thread_set (tcb_mcpriority_update f) t \\domain_sep_inv irqs st\\\"\n by (rule domain_sep_inv_triv; wp)\n\nlemma same_object_as_domain_sep_inv_cap:\n \"\\ same_object_as a cap; domain_sep_inv_cap irqs cap \\\n \\ domain_sep_inv_cap irqs a\"\n apply (case_tac a, simp_all add: same_object_as_def domain_sep_inv_cap_def)\n apply (case_tac cap, simp_all)\n done\n\nlemma checked_cap_insert_domain_sep_inv:\n \"check_cap_at a b (check_cap_at c d (cap_insert a b e)) \\domain_sep_inv irqs st\\\"\n apply (wp get_cap_wp cap_insert_domain_sep_inv' | simp add: check_cap_at_def)+\n apply clarsimp\n apply (drule_tac cap=cap in cte_wp_at_domain_sep_inv_cap)\n apply assumption\n apply (erule (1) same_object_as_domain_sep_inv_cap)\n done\n\ncrunch domain_sep_inv[wp]: bind_notification,reschedule_required \"domain_sep_inv irqs st\"\n\nlemma set_mcpriority_domain_sep_inv[wp]:\n \"set_mcpriority tcb_ref mcp \\domain_sep_inv irqs st\\\"\n unfolding set_mcpriority_def by wp\n\nlemma invoke_domain_domain_set_inv:\n \"invoke_domain word1 word2 \\domain_sep_inv irqs st\\\"\n apply (simp add: invoke_domain_def)\n apply (wp dxo_wp_weak | simp)+\n done\n\n\ncontext DomainSepInv_2 begin\n\nlemma invoke_tcb_domain_sep_inv:\n \"\\domain_sep_inv irqs st and tcb_inv_wf tinv\\\n invoke_tcb tinv\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (case_tac tinv)\n apply ((wp restart_domain_sep_inv hoare_vcg_if_lift mapM_x_wp[OF _ subset_refl]\n | wpc | simp split del: if_split add: check_cap_at_def | clarsimp)+)[3]\n defer\n apply ((wp | simp)+)[2]\n (* just NotificationControl and ThreadControl left *)\n apply (rename_tac option)\n apply (case_tac option)\n apply ((wp | simp)+)[1]\n apply (simp add: split_def cong: option.case_cong)\n apply (wp checked_cap_insert_domain_sep_inv hoare_vcg_all_lift_R hoare_vcg_all_lift\n hoare_vcg_const_imp_lift_R cap_delete_domain_sep_inv cap_delete_deletes\n dxo_wp_weak cap_delete_valid_cap cap_delete_cte_at static_imp_wp\n | wpc | strengthen\n | simp add: option_update_thread_def emptyable_def tcb_cap_cases_def\n tcb_cap_valid_def tcb_at_st_tcb_at\n del: set_priority_extended.dxo_eq)+\n done\n\nlemma perform_invocation_domain_sep_inv':\n \"\\domain_sep_inv irqs st and valid_invocation iv and valid_objs\n and valid_mdb and sym_refs \\ state_refs_of\\\n perform_invocation block call iv\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (case_tac iv)\n apply (wp send_ipc_domain_sep_inv invoke_tcb_domain_sep_inv\n invoke_cnode_domain_sep_inv invoke_control_domain_sep_inv\n invoke_irq_handler_domain_sep_inv arch_perform_invocation_domain_sep_inv\n invoke_domain_domain_set_inv\n | simp add: split_def | blast)+\n done\n\nlemma perform_invocation_domain_sep_inv:\n \"\\domain_sep_inv irqs st and valid_invocation iv and invs\\\n perform_invocation block call iv\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (rule hoare_weaken_pre[OF perform_invocation_domain_sep_inv'])\n apply auto\n done\n\nlemma handle_invocation_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs and ct_active\\\n handle_invocation calling blocking\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: handle_invocation_def ts_Restart_case_helper\n split_def liftE_liftM_liftME liftME_def bindE_assoc)\n apply (wp syscall_valid perform_invocation_domain_sep_inv set_thread_state_runnable_valid_sched\n | simp split del: if_split)+\n apply (rule_tac E=\"\\ft. domain_sep_inv irqs st and valid_objs and sym_refs \\ state_refs_of\n and valid_mdb and (\\y. valid_fault ft)\"\n and R=\"Q\" and Q=Q for Q in hoare_post_impErr)\n apply (wp | simp | clarsimp)+\n apply (rule_tac E=\"\\ft. domain_sep_inv irqs st and valid_objs and sym_refs \\ state_refs_of and\n valid_mdb and (\\y. valid_fault (CapFault x False ft))\"\n and R=\"Q\" and Q=Q for Q in hoare_post_impErr)\n apply (wp lcs_ex_cap_to2 | clarsimp)+\n apply (auto intro: st_tcb_ex_cap simp: ct_in_state_def)\n done\n\nlemma handle_send_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs and ct_active\\\n handle_send a\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: handle_send_def)\n apply (wp handle_invocation_domain_sep_inv)\n done\n\nlemma handle_call_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs and ct_active\\\n handle_call\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: handle_call_def)\n apply (wp handle_invocation_domain_sep_inv)\n done\n\nlemma handle_reply_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs\\\n handle_reply\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: handle_reply_def)\n apply (wp get_cap_wp | wpc)+\n apply auto\n done\n\ncrunches delete_caller_cap\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n\nend\n\n\n(* FIXME: clagged from Syscall_AC *)\nlemma lookup_slot_for_thread_cap_fault:\n \"\\invs\\ lookup_slot_for_thread t s -, \\\\f s. valid_fault (CapFault x y f)\\\"\n apply (simp add: lookup_slot_for_thread_def)\n apply (wp resolve_address_bits_valid_fault2)\n apply clarsimp\n apply (erule (1) invs_valid_tcb_ctable)\n done\n\nlemma domain_sep_inv_cur_thread_update[simp]:\n \"domain_sep_inv irqs st (s\\cur_thread := X\\) = domain_sep_inv irqs st s\"\n apply (simp add: domain_sep_inv_def)\n done\n\nlemma (in is_extended') domain_sep_inv[wp]: \"I (domain_sep_inv irqs st)\" by (rule lift_inv, simp)\n\n\ncontext DomainSepInv_2 begin\n\nlemma handle_recv_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs\\\n handle_recv is_blocking\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (simp add: handle_recv_def Let_def lookup_cap_def split_def)\n apply (wp hoare_vcg_all_lift lookup_slot_for_thread_cap_fault receive_ipc_domain_sep_inv\n delete_caller_cap_domain_sep_inv get_cap_wp get_simple_ko_wp\n | wpc | simp\n | (rule_tac Q=\"\\rv. invs and (\\s. cur_thread s = thread)\" in hoare_strengthen_post, wp,\n clarsimp simp: invs_valid_objs invs_sym_refs))+\n apply (rule_tac Q'=\"\\r s. domain_sep_inv irqs st s \\ invs s \\\n tcb_at thread s \\ thread = cur_thread s\" in hoare_post_imp_R)\n apply wp\n apply ((clarsimp simp add: invs_valid_objs invs_sym_refs\n | intro impI allI conjI\n | rule cte_wp_valid_cap caps_of_state_cteD\n | fastforce simp: valid_fault_def)+)[1]\n apply (wp delete_caller_cap_domain_sep_inv | simp add: split_def cong: conj_cong)+\n apply (wp | simp add: invs_valid_objs invs_mdb invs_sym_refs tcb_at_invs)+\n done\n\ncrunches handle_interrupt, activate_thread, choose_thread\n for domain_sep_inv[wp]: \"\\s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\"\n (wp: dxo_wp_weak crunch_wps)\n\nlemma handle_event_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs and (\\s. ev \\ Interrupt \\ ct_active s)\\\n handle_event ev\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state)\\\"\n apply (case_tac ev, simp_all)\n apply (rule hoare_pre)\n apply (wpsimp wp: handle_send_domain_sep_inv handle_call_domain_sep_inv\n handle_recv_domain_sep_inv handle_reply_domain_sep_inv hy_inv\n | simp add: invs_valid_objs invs_mdb invs_sym_refs valid_fault_def)+\n apply (rule_tac E=\"\\rv s. domain_sep_inv irqs (st :: 'state_ext state) (s :: det_ext state) \\\n invs s \\ valid_fault rv\" and R=\"Q\" and Q=Q for Q in hoare_post_impErr)\n apply (wp | simp add: invs_valid_objs invs_mdb invs_sym_refs valid_fault_def | auto)+\n done\n\nlemma schedule_domain_sep_inv:\n \"(schedule :: (unit,det_ext) s_monad) \\domain_sep_inv irqs (st :: 'state_ext state)\\\"\n apply (simp add: schedule_def allActiveTCBs_def)\n apply (wp add: alternative_wp select_wp guarded_switch_to_lift hoare_drop_imps\n del: ethread_get_wp\n | wpc | clarsimp simp: get_thread_state_def thread_get_def trans_state_update'[symmetric]\n schedule_choose_new_thread_def)+\n done\n\nlemma call_kernel_domain_sep_inv:\n \"\\domain_sep_inv irqs st and invs and (\\s. ev \\ Interrupt \\ ct_active s)\\\n call_kernel ev :: (unit,det_ext) s_monad\n \\\\_ s. domain_sep_inv irqs (st :: 'state_ext state) s\\\"\n apply (simp add: call_kernel_def)\n apply (wp handle_interrupt_domain_sep_inv handle_event_domain_sep_inv schedule_domain_sep_inv\n | simp)+\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/access-control/DomainSepInv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.254272322647262}} {"text": "theory Discussion_NCPC\nimports \"../Observation_Setup\" Discussion_Value_Setup \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\Confidentiality protection from non-PC-members\\\n\ntext \\We verify the following property:\n\n\\ \\\\\nA group of users UIDs learn\nnothing about the various updates of a paper's discussion\n(i.e., about the comments being posted on a paper by the PC members)\n(save for the non-existence of any edit)\nunless/until a user in UIDs becomes a PC member in the paper's conference having no conflict with that paper\nand the conference moves to the discussion phase.\n\n\\ \\\\\n\\\n\nfun T :: \"(state,act,out) trans \\ bool\" where\n\"T (Trans _ _ ou s') =\n (\\ uid \\ UIDs. \\ cid.\n PID \\\\ paperIDs s' cid \\ isPC s' cid uid \\ pref s' uid PID \\ Conflict \\ phase s' cid \\ disPH\n )\"\n\ndeclare T.simps [simp del]\n\ndefinition B :: \"value list \\ value list \\ bool\" where\n\"B vl vl1 \\ vl \\ []\"\n\ninterpretation BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\nlemma reachNT_non_isPC_isChair:\nassumes \"reachNT s\" and \"uid \\ UIDs\"\nshows\n\"(PID \\\\ paperIDs s cid \\ isPC s cid uid \\ phase s cid \\ disPH \\ pref s uid PID = Conflict) \\\n (PID \\\\ paperIDs s cid \\ isChair s cid uid \\ phase s cid \\ disPH \\ pref s uid PID = Conflict)\"\n using assms\n apply induct\n apply (auto simp: istate_def)[]\n apply(intro conjI)\n subgoal for trn apply(cases trn, auto simp: T.simps reachNT_reach)[] .\n by (metis T.elims(3) isChair_isPC reachNT_reach reach.Step tgtOf_simps)\n\n\nlemma T_\\_\\:\nassumes 1: \"reachNT s\" and 2: \"step s a = (ou,s')\" \"\\ (Trans s a ou s')\"\nshows \"\\ \\ (Trans s a ou s')\"\nusing reachNT_non_isPC_isChair[OF 1] 2 unfolding \\_def2\nby (fastforce simp add: uu_defs)\n\n(* major *) lemma eqExcPID_step_out:\nassumes s's1': \"eqExcPID s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sT: \"reachNT s\" and s1: \"reach s1\"\nand PID: \"PID \\\\ paperIDs s cid\"\nand UIDs: \"userOfA a \\ UIDs\"\nshows \"ou = ou1\"\nproof-\n note Inv = reachNT_non_isPC_isChair[OF sT UIDs]\n note eqs = eqExcPID_imp[OF s's1']\n note eqs' = eqExcPID_imp1[OF s's1']\n note s = reachNT_reach[OF sT]\n\n note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_def eeqExcPID_def eqExcD\n note * = step step1 eqs eqs' s s1 PID UIDs paperIDs_equals[OF s] Inv\n\n show ?thesis\n proof (cases a)\n case (Cact x1)\n then show ?thesis using * by (cases x1) auto\n next\n case (Uact x2)\n then show ?thesis using * by (cases x2) auto\n next\n case (UUact x3)\n then show ?thesis using * by (cases x3) auto\n next\n case (Ract x4)\n show ?thesis\n proof (cases x4)\n case (rMyReview x81 x82 x83 x84)\n then show ?thesis using * Ract by (auto simp add: getNthReview_def)\n next\n case (rReviews x91 x92 x93 x94)\n then show ?thesis using * Ract by (clarsimp; metis eqExcPID_imp2 s's1')\n next\n case (rDis x111 x112 x113 x114)\n then show ?thesis using * Ract by (clarsimp; metis discussion.inject)\n qed (use * Ract in auto)\n next\n case (Lact x5)\n then show ?thesis using * by (cases x5; auto; presburger)\n qed\nqed\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < disPH) \\ s = s1 \\ B vl vl1\"\n\n(* main difference from the Paper_Confidentiality/Aut_PC: need to assume\nthat there are means to produce vl1 via iaction when disPH has been reached;\nif not, this yields and exit *)\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\\n \\ cid uid.\n PID \\\\ paperIDs s cid \\ phase s cid = disPH \\\n isPC s cid uid \\ pref s uid PID \\ Conflict\n \\ eqExcPID s s1\"\n\ndefinition \\3 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\3 s vl s1 vl1 \\\n \\ cid. PID \\\\ paperIDs s cid \\ phase s cid > disPH \\ eqExcPID s s1 \\ vl1 = []\"\n\ndefinition \\e :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\e s vl s1 vl1 \\\n vl \\ [] \\\n (\\ cid. PID \\\\ paperIDs s cid \\ phase s cid \\ disPH \\\n \\ (\\ uid. isPC s cid uid \\ pref s uid PID \\ Conflict)\n )\"\n\nlemma init_\\1:\nassumes B: \"B vl vl1\"\nshows \"\\1 istate vl istate vl1\"\nusing B unfolding \\1_def B_def istate_def by auto\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1,\\2,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\2 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\1 s vl s1 vl1\"\n hence rs: \"reach s\" and ss1: \"s1 = s\" and vl: \"vl \\ []\"\n and PID_ph: \"\\ cid. PID \\\\ paperIDs s cid \\ phase s cid < disPH\"\n using reachNT_reach unfolding \\1_def B_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have \\: \"\\ \\ ?trn\"\n proof (cases a)\n case (UUact x3)\n then show ?thesis\n using step PID_ph\n by (cases x3; fastforce simp: uu_defs)\n qed auto\n hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have ?match proof\n show \"validTrans ?trn1\" unfolding ss1 using step by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\ by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n next\n show \"?\\ s' vl' s' vl1\"\n proof(cases \"\\ cid. PID \\\\ paperIDs s cid\")\n case False note PID = False\n have ph_PID': \"\\ cid. PID \\\\ paperIDs s' cid \\ phase s' cid < disPH\" using PID step rs\n subgoal apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n done\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using ph_PID' vl by auto\n thus ?thesis by auto\n next\n case True then obtain CID where PID: \"PID \\\\ paperIDs s CID\" by auto\n hence ph: \"phase s CID < disPH\" (is \"?ph < _\") using PID_ph by auto\n show ?thesis\n proof(cases \"phase s' CID < disPH\")\n case True note ph' = True\n show ?thesis proof(cases \"PID \\\\ paperIDs s' CID\")\n case False\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using vl ph' apply auto\n by (metis PID paperIDs_mono step)(* safety crucially used *)\n thus ?thesis by auto\n next\n case True\n hence \"\\1 s' vl' s' vl1\" unfolding \\1_def B_def vl' using vl ph' apply auto\n by (metis reach_PairI paperIDs_equals rs step) (* safety crucially used *)\n thus ?thesis by auto\n qed\n next\n case False\n hence ph': \"phase s' CID = disPH \\ PID \\\\ paperIDs s' CID\"\n using PID ph step rs\n subgoal apply(cases a)\n subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n by auto\n done\n show ?thesis\n proof(cases \"\\uid. isPC s' CID uid \\ pref s' uid PID \\ Conflict\")\n case True\n hence \"\\2 s' vl' s' vl1\" unfolding \\2_def vl' using vl ph' by auto\n thus ?thesis by auto\n next\n case False\n hence \"\\e s' vl' s' vl1\" unfolding \\e_def vl' using vl ph' by auto\n thus ?thesis by auto\n qed\n qed\n qed\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl by auto\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2,\\3,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\3 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\2 s vl s1 vl1\"\n then obtain CID uid where uid: \"isPC s CID uid\" \"pref s uid PID \\ Conflict\"\n and rs: \"reach s\" and ph: \"phase s CID = disPH\" (is \"?ph = _\")\n and PID: \"PID \\\\ paperIDs s CID\" and ss1: \"eqExcPID s s1\"\n using reachNT_reach unfolding \\2_def by auto\n hence uid_notin: \"uid \\ UIDs\" using ph reachNT_non_isPC_isChair[OF rsT] by force\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof(cases vl1)\n case (Cons v1 vl1') note vl1 = Cons\n have uid1: \"isPC s1 CID uid\" \"pref s1 uid PID \\ Conflict\"\n using ss1 uid unfolding eqExcPID_def by auto\n define a1 where \"a1 \\ UUact (uuDis CID uid (pass s uid) PID v1)\"\n obtain s1' ou1 where step1: \"step s1 a1 = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n have s1s1': \"eqExcPID s1 s1'\" using a1_def step1 UUact_uuDis_step_eqExcPID by auto\n have ss1': \"eqExcPID s s1'\" using eqExcPID_trans[OF ss1 s1s1'] .\n hence many_s1': \"PID \\\\ paperIDs s1' CID\" \"isPC s1' CID uid\"\n \"pref s1' uid PID \\ Conflict\" \"phase s1' CID = disPH\"\n \"pass s1' uid = pass s uid\"\n using uid PID ph unfolding eqExcPID_def by auto\n hence more_s1': \"uid \\\\ userIDs s1'\" \"CID \\\\ confIDs s1'\"\n by (metis paperIDs_confIDs reach_PairI roles_userIDs rs1 step1 many_s1'(1))+\n have f: \"f ?trn1 = v1\" unfolding a1_def by simp\n have rs1': \"reach s1'\" using rs1 step1 by (auto intro: reach_PairI)\n have ou1: \"ou1 = outOK\"\n using step1 uid1 ph unfolding a1_def by (auto simp add: uu_defs many_s1' more_s1')\n have ?iact proof\n show \"step s1 a1 = (ou1,s1')\" by fact\n next\n show \\: \"\\ ?trn1\" using ou1 unfolding a1_def by simp\n thus \"consume ?trn1 vl1 vl1'\" using f unfolding consume_def vl1 by simp\n next\n show \"\\ \\ ?trn1\" by (simp add: a1_def uid_notin)\n next\n have \"\\2 s vl s1' vl1'\" unfolding \\2_def using ph PID ss1' uid by auto\n thus \"?\\ s vl s1' vl1'\" by simp\n qed\n thus ?thesis by auto\n next\n case Nil note vl1 = Nil\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have uid': \"isPC s' CID uid \\ pref s' uid PID \\ Conflict\"\n using uid step rs ph PID pref_Conflict_disPH isPC_persistent by auto\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof(cases \"\\ ?trn\")\n case False note \\ = False\n have vl: \"vl' = vl\" using c \\ unfolding consume_def by (cases vl) auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID s' s1'\" using eqExcPID_step[OF ss1 step step1] .\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID_step_\\[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_step_out[OF ss1 step step1 rsT rs1 PID] by simp\n next\n show \"?\\ s' vl' s1' vl1\"\n proof(cases \"?ph' = disPH\")\n case True\n hence \"\\2 s' vl' s1' vl1\" using PID' s's1' uid' unfolding \\2_def by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > disPH\"\n using ph rs step by (metis le_less phase_increases)\n hence \"\\3 s' vl' s1' vl1\" using s's1' PID' unfolding \\3_def vl1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by simp\n next\n case True note \\ = True\n have s's: \"eqExcPID s' s\" using eqExcPID_sym[OF \\_step_eqExcPID[OF \\ step]] .\n have s's1: \"eqExcPID s' s1\" using eqExcPID_trans[OF s's ss1] .\n have ?ignore proof\n show \"\\ \\ ?trn\" using T_\\_\\ \\ rsT step by auto\n next\n show \"?\\ s' vl' s1 vl1\"\n proof(cases \"?ph' = disPH\")\n case True\n hence \"\\2 s' vl' s1 vl1\" using s's1 PID' uid' unfolding \\2_def by auto\n thus ?thesis by auto\n next\n case False hence \"?ph' > disPH\"\n using ph rs step by (metis le_less phase_increases)\n hence \"\\3 s' vl' s1 vl1\" using s's1 PID' unfolding \\3_def vl1 by auto\n thus ?thesis by auto\n qed\n qed\n thus ?thesis by auto\n qed\n qed\n thus ?thesis using vl1 by auto\n qed\nqed\n\nlemma unwind_cont_\\3: \"unwind_cont \\3 {\\3,\\e}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\3 s vl s1 vl1 \\ \\e s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\3 s vl s1 vl1\"\n then obtain CID where rs: \"reach s\" and ph: \"phase s CID > disPH\" (is \"?ph < _\")\n and PID: \"PID \\\\ paperIDs s CID\"\n and ss1: \"eqExcPID s s1\" and vl1: \"vl1 = []\"\n using reachNT_reach unfolding \\3_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have \"?react\"\n proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n let ?ph' = \"phase s' CID\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n have PID': \"PID \\\\ paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n have ph': \"phase s' CID > disPH\" using ph rs by (meson less_le_trans local.step phase_increases)\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof-\n have \\: \"\\ \\ ?trn\" using ph step unfolding \\_def2 apply (auto simp: uu_defs)\n using PID less_not_refl2 paperIDs_equals rs by blast (* safety crucialy used *)\n have vl: \"vl' = vl\" using c \\ unfolding consume_def by (cases vl) auto\n obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have s's1': \"eqExcPID s' s1'\" using eqExcPID_step[OF ss1 step step1] .\n have \\1: \"\\ \\ ?trn1\" using \\ unfolding eqExcPID_step_\\[OF ss1 step step1] .\n have ?match proof\n show \"validTrans ?trn1\" using step1 by simp\n next\n show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\1 by auto\n next\n show \"\\ ?trn = \\ ?trn1\" unfolding ss1 by simp\n next\n assume \"\\ ?trn\" thus \"g ?trn = g ?trn1\"\n using eqExcPID_step_out[OF ss1 step step1 rsT rs1 PID] by simp\n next\n have \"\\3 s' vl' s1' vl1\" using ph' PID' s's1' unfolding \\3_def vl1 by auto\n thus \"?\\ s' vl' s1' vl1\" by simp\n qed\n thus ?thesis by simp\n qed\n qed\n thus ?thesis using vl1 by simp\n qed\nqed\n\n(* Exit arguments: *)\ndefinition K1exit where\n\"K1exit cid s \\\n (PID \\\\ paperIDs s cid \\ phase s cid \\ disPH \\\n \\ (\\ uid. isPC s cid uid \\ pref s uid PID \\ Conflict))\"\n\nlemma invarNT_K1exit: \"invarNT (K1exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n subgoal for _ a apply(cases a)\n subgoal for x1 apply(cases x1) apply (fastforce simp add: c_defs K1exit_def geq_noPH_confIDs)+ .\n subgoal for x2\n apply(cases x2)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)\n subgoal for x61 apply(cases \"x61 = cid\")\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)+ .\n apply (fastforce simp add: u_defs K1exit_def paperIDs_equals) .\n subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K1exit_def)+ .\n by auto\n done\n\nlemma noVal_K1exit: \"noVal (K1exit cid) v\"\napply(rule no\\_noVal)\nunfolding no\\_def apply safe\n subgoal for _ a apply(cases a)\n apply (fastforce simp add: c_defs K1exit_def)\n apply (fastforce simp add: c_defs K1exit_def)\n subgoal for x3\n apply(cases x3) apply (auto simp add: uu_defs K1exit_def)\n apply (metis paperIDs_equals reachNT_reach) (* crucial use of safety *) .\n by auto\n done\n\nlemma unwind_exit_\\e: \"unwind_exit \\e\"\nproof\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\e: \"\\e s vl s1 vl1\"\n hence vl: \"vl \\ []\" using reachNT_reach unfolding \\e_def by auto\n then obtain CID where \"K1exit CID s\" using \\e unfolding K1exit_def \\e_def by auto\n thus \"vl \\ [] \\ exit s (hd vl)\" apply(simp add: vl)\n by (metis rsT exitI2 invarNT_K1exit noVal_K1exit)\nqed\n\ntheorem secure: secure\napply(rule unwind_decomp3_secure[of \\1 \\2 \\e \\3])\nusing\ninit_\\1\nunwind_cont_\\1 unwind_cont_\\2 unwind_cont_\\3\nunwind_exit_\\e\nby auto\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Discussion_Confidentiality/Discussion_NCPC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.25417942598742943}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__3_on_rules imports n_mutualEx_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__3) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.37022540649291935, "lm_q1q2_score": 0.25395591106023646}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_lemma_inv__4_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_lemma_inv__4_on_rules imports n_mutualExOnI_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__4 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__4) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.3702253925955866, "lm_q1q2_score": 0.2539559015273688}} {"text": "(* Title: JinjaDCI/J/WellTypeRT.thy\n\n Author: Tobias Nipkow, Susannah Mansky\n Copyright 2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory J/WellTypeRT.thy by Tobias Nipkow\n*)\n\nsection \\ Runtime Well-typedness \\\n\ntheory WellTypeRT\nimports WellType\nbegin\n\ninductive\n WTrt :: \"J_prog \\ heap \\ sheap \\ env \\ expr \\ ty \\ bool\"\n and WTrts :: \"J_prog \\ heap \\ sheap \\ env \\ expr list \\ ty list \\ bool\"\n and WTrt2 :: \"[J_prog,env,heap,sheap,expr,ty] \\ bool\"\n (\"_,_,_,_ \\ _ : _\" [51,51,51,51]50)\n and WTrts2 :: \"[J_prog,env,heap,sheap,expr list, ty list] \\ bool\"\n (\"_,_,_,_ \\ _ [:] _\" [51,51,51,51]50)\n for P :: J_prog and h :: heap and sh :: sheap\nwhere\n \n \"P,E,h,sh \\ e : T \\ WTrt P h sh E e T\"\n| \"P,E,h,sh \\ es[:]Ts \\ WTrts P h sh E es Ts\"\n\n| WTrtNew:\n \"is_class P C \\\n P,E,h,sh \\ new C : Class C\"\n\n| WTrtCast:\n \"\\ P,E,h,sh \\ e : T; is_refT T; is_class P C \\\n \\ P,E,h,sh \\ Cast C e : Class C\"\n\n| WTrtVal:\n \"typeof\\<^bsub>h\\<^esub> v = Some T \\\n P,E,h,sh \\ Val v : T\"\n\n| WTrtVar:\n \"E V = Some T \\\n P,E,h,sh \\ Var V : T\"\n\n| WTrtBinOpEq:\n \"\\ P,E,h,sh \\ e\\<^sub>1 : T\\<^sub>1; P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2 \\\n \\ P,E,h,sh \\ e\\<^sub>1 \\Eq\\ e\\<^sub>2 : Boolean\"\n\n| WTrtBinOpAdd:\n \"\\ P,E,h,sh \\ e\\<^sub>1 : Integer; P,E,h,sh \\ e\\<^sub>2 : Integer \\\n \\ P,E,h,sh \\ e\\<^sub>1 \\Add\\ e\\<^sub>2 : Integer\"\n\n| WTrtLAss:\n \"\\ E V = Some T; P,E,h,sh \\ e : T'; P \\ T' \\ T \\\n \\ P,E,h,sh \\ V:=e : Void\"\n\n| WTrtFAcc:\n \"\\ P,E,h,sh \\ e : Class C; P \\ C has F,NonStatic:T in D \\ \\\n P,E,h,sh \\ e\\F{D} : T\"\n\n| WTrtFAccNT:\n \"P,E,h,sh \\ e : NT \\\n P,E,h,sh \\ e\\F{D} : T\"\n\n| WTrtSFAcc:\n \"\\ P \\ C has F,Static:T in D \\ \\\n P,E,h,sh \\ C\\\\<^sub>sF{D} : T\"\n\n| WTrtFAss:\n \"\\ P,E,h,sh \\ e\\<^sub>1 : Class C; P \\ C has F,NonStatic:T in D; P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2; P \\ T\\<^sub>2 \\ T \\\n \\ P,E,h,sh \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 : Void\"\n\n| WTrtFAssNT:\n \"\\ P,E,h,sh \\ e\\<^sub>1:NT; P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2 \\\n \\ P,E,h,sh \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 : Void\"\n\n| WTrtSFAss:\n \"\\ P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2; P \\ C has F,Static:T in D; P \\ T\\<^sub>2 \\ T \\\n \\ P,E,h,sh \\ C\\\\<^sub>sF{D}:=e\\<^sub>2 : Void\"\n\n| WTrtCall:\n \"\\ P,E,h,sh \\ e : Class C; P \\ C sees M,NonStatic:Ts \\ T = (pns,body) in D;\n P,E,h,sh \\ es [:] Ts'; P \\ Ts' [\\] Ts \\\n \\ P,E,h,sh \\ e\\M(es) : T\"\n\n| WTrtCallNT:\n \"\\ P,E,h,sh \\ e : NT; P,E,h,sh \\ es [:] Ts \\\n \\ P,E,h,sh \\ e\\M(es) : T\"\n\n| WTrtSCall:\n \"\\ P \\ C sees M,Static:Ts \\ T = (pns,body) in D;\n P,E,h,sh \\ es [:] Ts'; P \\ Ts' [\\] Ts;\n M = clinit \\ sh D = \\(sfs,Processing)\\ \\ es = map Val vs \\\n \\ P,E,h,sh \\ C\\\\<^sub>sM(es) : T\"\n\n| WTrtBlock:\n \"P,E(V\\T),h,sh \\ e : T' \\\n P,E,h,sh \\ {V:T; e} : T'\"\n\n| WTrtSeq:\n \"\\ P,E,h,sh \\ e\\<^sub>1:T\\<^sub>1; P,E,h,sh \\ e\\<^sub>2:T\\<^sub>2 \\\n \\ P,E,h,sh \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2\"\n\n| WTrtCond:\n \"\\ P,E,h,sh \\ e : Boolean; P,E,h,sh \\ e\\<^sub>1:T\\<^sub>1; P,E,h,sh \\ e\\<^sub>2:T\\<^sub>2;\n P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ T = T\\<^sub>2; P \\ T\\<^sub>2 \\ T\\<^sub>1 \\ T = T\\<^sub>1 \\\n \\ P,E,h,sh \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n\n| WTrtWhile:\n \"\\ P,E,h,sh \\ e : Boolean; P,E,h,sh \\ c:T \\\n \\ P,E,h,sh \\ while(e) c : Void\"\n\n| WTrtThrow:\n \"\\ P,E,h,sh \\ e : T\\<^sub>r; is_refT T\\<^sub>r \\ \\\n P,E,h,sh \\ throw e : T\"\n\n| WTrtTry:\n \"\\ P,E,h,sh \\ e\\<^sub>1 : T\\<^sub>1; P,E(V \\ Class C),h,sh \\ e\\<^sub>2 : T\\<^sub>2; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\\n \\ P,E,h,sh \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 : T\\<^sub>2\"\n\n| WTrtInit:\n \"\\ P,E,h,sh \\ e : T; \\C' \\ set (C#Cs). is_class P C'; \\sub_RI e;\n \\C' \\ set (tl Cs). \\sfs. sh C' = \\(sfs,Processing)\\;\n b \\ (\\C' \\ set Cs. \\sfs. sh C' = \\(sfs,Processing)\\);\n distinct Cs; supercls_lst P Cs \\\n \\ P,E,h,sh \\ INIT C (Cs, b) \\ e : T\"\n\n| WTrtRI:\n \"\\ P,E,h,sh \\ e : T; P,E,h,sh \\ e' : T'; \\C' \\ set (C#Cs). is_class P C'; \\sub_RI e';\n \\C' \\ set (C#Cs). not_init C' e;\n \\C' \\ set Cs. \\sfs. sh C' = \\(sfs,Processing)\\;\n \\sfs. sh C = \\(sfs, Processing)\\ \\ (sh C = \\(sfs, Error)\\ \\ e = THROW NoClassDefFoundError);\n distinct (C#Cs); supercls_lst P (C#Cs) \\\n \\ P,E,h,sh \\ RI(C, e);Cs \\ e' : T'\"\n\n\\ \\well-typed expression lists\\\n\n| WTrtNil:\n \"P,E,h,sh \\ [] [:] []\"\n\n| WTrtCons:\n \"\\ P,E,h,sh \\ e : T; P,E,h,sh \\ es [:] Ts \\\n \\ P,E,h,sh \\ e#es [:] T#Ts\"\n\n(*<*)\ndeclare WTrt_WTrts.intros[intro!] WTrtNil[iff]\ndeclare\n WTrtFAcc[rule del] WTrtFAccNT[rule del] WTrtSFAcc[rule del]\n WTrtFAss[rule del] WTrtFAssNT[rule del] WTrtSFAss[rule del]\n WTrtCall[rule del] WTrtCallNT[rule del] WTrtSCall[rule del]\n\nlemmas WTrt_induct = WTrt_WTrts.induct [split_format (complete)]\n and WTrt_inducts = WTrt_WTrts.inducts [split_format (complete)]\n(*>*)\n\n\nsubsection\\Easy consequences\\\n\n\n\nlemma [iff]: \"(P,E,h,sh \\ e#es [:] T#Ts) = (P,E,h,sh \\ e : T \\ P,E,h,sh \\ es [:] Ts)\"\n(*<*)by(rule iffI) (auto elim: WTrts.cases)(*>*)\n\nlemma [iff]: \"(P,E,h,sh \\ (e#es) [:] Ts) =\n (\\U Us. Ts = U#Us \\ P,E,h,sh \\ e : U \\ P,E,h,sh \\ es [:] Us)\"\n(*<*)by(rule iffI) (auto elim: WTrts.cases)(*>*)\n\n\n\nlemma [iff]: \"P,E,h,sh \\ Val v : T = (typeof\\<^bsub>h\\<^esub> v = Some T)\"\n(*<*)proof(rule iffI) qed (auto elim: WTrt.cases)(*>*)\n\nlemma [iff]: \"P,E,h,sh \\ Var v : T = (E v = Some T)\"\n(*<*)proof(rule iffI) qed (auto elim: WTrt.cases)(*>*)\n\nlemma [iff]: \"P,E,h,sh \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2 = (\\T\\<^sub>1. P,E,h,sh \\ e\\<^sub>1:T\\<^sub>1 \\ P,E,h,sh \\ e\\<^sub>2:T\\<^sub>2)\"\n(*<*)proof(rule iffI) qed (auto elim: WTrt.cases)(*>*)\n\nlemma [iff]: \"P,E,h,sh \\ {V:T; e} : T' = (P,E(V\\T),h,sh \\ e : T')\"\n(*<*)proof(rule iffI) qed (auto elim: WTrt.cases)(*>*)\n\n(*<*)\ninductive_cases WTrt_elim_cases[elim!]:\n \"P,E,h,sh \\ v :=e : T\"\n \"P,E,h,sh \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n \"P,E,h,sh \\ while(e) c : T\"\n \"P,E,h,sh \\ throw e : T\"\n \"P,E,h,sh \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 : T\"\n \"P,E,h,sh \\ Cast D e : T\"\n \"P,E,h,sh \\ e\\F{D} : T\"\n \"P,E,h,sh \\ C\\\\<^sub>sF{D} : T\"\n \"P,E,h,sh \\ e\\F{D} := v : T\"\n \"P,E,h,sh \\ C\\\\<^sub>sF{D} := v : T\"\n \"P,E,h,sh \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\"\n \"P,E,h,sh \\ new C : T\"\n \"P,E,h,sh \\ e\\M{D}(es) : T\"\n \"P,E,h,sh \\ C\\\\<^sub>sM{D}(es) : T\"\n \"P,E,h,sh \\ INIT C (Cs,b) \\ e : T\"\n \"P,E,h,sh \\ RI(C,e);Cs \\ e' : T\"\n(*>*)\n\nsubsection\\Some interesting lemmas\\\n\nlemma WTrts_Val[simp]:\n \"\\Ts. (P,E,h,sh \\ map Val vs [:] Ts) = (map (typeof\\<^bsub>h\\<^esub>) vs = map Some Ts)\"\n(*<*)\nproof(induct vs)\n case (Cons a vs)\n then show ?case by(case_tac Ts; simp)\nqed simp\n(*>*)\n\n\n\n\n\nlemma WTrt_env_mono:\n \"P,E,h,sh \\ e : T \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h,sh \\ e : T)\" and\n \"P,E,h,sh \\ es [:] Ts \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h,sh \\ es [:] Ts)\"\n(*<*)\nproof(induct rule: WTrt_inducts)\n case WTrtVar then show ?case by(simp add: map_le_def dom_def)\nnext\n case WTrtLAss then show ?case by(force simp:map_le_def)\nqed(fastforce intro: WTrt_WTrts.intros)+\n(*>*)\n\n\nlemma WTrt_hext_mono: \"P,E,h,sh \\ e : T \\ h \\ h' \\ P,E,h',sh \\ e : T\"\nand WTrts_hext_mono: \"P,E,h,sh \\ es [:] Ts \\ h \\ h' \\ P,E,h',sh \\ es [:] Ts\"\n(*<*)\nproof(induct rule: WTrt_inducts)\n case WTrtVal then show ?case by(simp add: hext_typeof_mono)\nqed(fastforce intro: WTrt_WTrts.intros)+\n(*>*)\n\nlemma WTrt_shext_mono: \"P,E,h,sh \\ e : T \\ sh \\\\<^sub>s sh' \\ \\sub_RI e \\ P,E,h,sh' \\ e : T\"\nand WTrts_shext_mono: \"P,E,h,sh \\ es [:] Ts \\ sh \\\\<^sub>s sh' \\ \\sub_RIs es \\ P,E,h,sh' \\ es [:] Ts\"\n(*<*)\nby(induct rule: WTrt_inducts)\n (auto simp add: WTrt_WTrts.intros)\n(*>*)\n\nlemma WTrt_hext_shext_mono: \"P,E,h,sh \\ e : T\n \\ h \\ h' \\ sh \\\\<^sub>s sh' \\ \\sub_RI e \\ P,E,h',sh' \\ e : T\"\n by(auto intro: WTrt_hext_mono WTrt_shext_mono)\n\nlemma WTrts_hext_shext_mono: \"P,E,h,sh \\ es [:] Ts\n \\ h \\ h' \\ sh \\\\<^sub>s sh' \\ \\sub_RIs es \\ P,E,h',sh' \\ es [:] Ts\"\n by(auto intro: WTrts_hext_mono WTrts_shext_mono)\n\n\nlemma WT_implies_WTrt: \"P,E \\ e :: T \\ P,E,h,sh \\ e : T\"\nand WTs_implies_WTrts: \"P,E \\ es [::] Ts \\ P,E,h,sh \\ es [:] Ts\"\n(*<*)\nproof(induct rule: WT_WTs_inducts)\n case WTVal then show ?case by(fastforce dest: typeof_lit_typeof)\nnext\n case WTFAcc\n then show ?case by(fastforce simp: WTrtFAcc has_visible_field)\nnext\n case WTSFAcc\n then show ?case by(fastforce simp: WTrtSFAcc has_visible_field)\nnext\n case WTFAss\n then show ?case by(fastforce simp: WTrtFAss dest: has_visible_field)\nnext\n case WTSFAss\n then show ?case by(fastforce simp: WTrtSFAss dest: has_visible_field)\nqed(fastforce intro: WTrt_WTrts.intros)+\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/J/WellTypeRT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.25392305595957}} {"text": "theory IICF_MS_Array_List\nimports \n \"../Intf/IICF_List\" \n Separation_Logic_Imperative_HOL.Array_Blit\n Separation_Logic_Imperative_HOL.Default_Insts\nbegin\n\n type_synonym 'a ms_array_list = \"'a Heap.array \\ nat\"\n\n definition \"is_ms_array_list ms l \\ \\(a,n). \\\\<^sub>Al'. a \\\\<^sub>a l' * \\(n \\ length l' \\ l = take n l' \\ ms=length l')\"\n\n lemma is_ms_array_list_prec[safe_constraint_rules]: \"precise (is_ms_array_list ms)\"\n unfolding is_ms_array_list_def[abs_def]\n apply(rule preciseI)\n apply(simp split: prod.splits) \n \tusing preciseD snga_prec by fastforce\n\n definition \"marl_empty_sz maxsize \\ do {\n a \\ Array.new maxsize default;\n return (a,0)\n }\"\n\n definition \"marl_append \\ \\(a,n) x. do {\n a \\ Array.upd n x a;\n return (a,n+1)\n }\"\n\n definition marl_length :: \"'a::heap ms_array_list \\ nat Heap\" where\n \"marl_length \\ \\(a,n). return (n)\"\n\n definition marl_is_empty :: \"'a::heap ms_array_list \\ bool Heap\" where\n \"marl_is_empty \\ \\(a,n). return (n=0)\"\n\n definition marl_last :: \"'a::heap ms_array_list \\ 'a Heap\" where\n \"marl_last \\ \\(a,n). do {\n Array.nth a (n - 1)\n }\"\n\n definition marl_butlast :: \"'a::heap ms_array_list \\ 'a ms_array_list Heap\" where\n \"marl_butlast \\ \\(a,n). do {\n return (a,n - 1)\n }\"\n\n definition marl_get :: \"'a::heap ms_array_list \\ nat \\ 'a Heap\" where\n \"marl_get \\ \\(a,n) i. Array.nth a i\"\n\n definition marl_set :: \"'a::heap ms_array_list \\ nat \\ 'a \\ 'a ms_array_list Heap\" where\n \"marl_set \\ \\(a,n) i x. do { a \\ Array.upd i x a; return (a,n)}\"\n\n lemma marl_empty_sz_rule[sep_heap_rules]: \"< emp > marl_empty_sz N \"\n by (sep_auto simp: marl_empty_sz_def is_ms_array_list_def)\n\n lemma marl_append_rule[sep_heap_rules]: \"length l < N \\\n < is_ms_array_list N l a > \n marl_append a x \n <\\a. is_ms_array_list N (l@[x]) a >\\<^sub>t\" \n by (sep_auto \n simp: marl_append_def is_ms_array_list_def take_update_last \n split: prod.splits)\n \n lemma marl_length_rule[sep_heap_rules]: \"\n \n marl_length a\n <\\r. is_ms_array_list N l a * \\(r=length l)>\"\n by (sep_auto simp: marl_length_def is_ms_array_list_def)\n \n lemma marl_is_empty_rule[sep_heap_rules]: \"\n \n marl_is_empty a\n <\\r. is_ms_array_list N l a * \\(r\\(l=[]))>\"\n by (sep_auto simp: marl_is_empty_def is_ms_array_list_def)\n\n lemma marl_last_rule[sep_heap_rules]: \"\n l\\[] \\\n \n marl_last a\n <\\r. is_ms_array_list N l a * \\(r=last l)>\"\n by (sep_auto simp: marl_last_def is_ms_array_list_def last_take_nth_conv)\n \n lemma marl_butlast_rule[sep_heap_rules]: \"\n l\\[] \\\n \n marl_butlast a\n \\<^sub>t\"\n by (sep_auto \n split: prod.splits\n simp: marl_butlast_def is_ms_array_list_def butlast_take)\n\n lemma marl_get_rule[sep_heap_rules]: \"\n i\n \n marl_get a i\n <\\r. is_ms_array_list N l a * \\(r=l!i)>\"\n by (sep_auto simp: marl_get_def is_ms_array_list_def split: prod.split)\n\n lemma marl_set_rule[sep_heap_rules]: \"\n i\n \n marl_set a i x\n \"\n by (sep_auto simp: marl_set_def is_ms_array_list_def split: prod.split)\n\n definition \"marl_assn N A \\ hr_comp (is_ms_array_list N) (\\the_pure A\\list_rel)\"\n lemmas [safe_constraint_rules] = CN_FALSEI[of is_pure \"marl_assn N A\" for N A]\n\ncontext \n notes [fcomp_norm_unfold] = marl_assn_def[symmetric]\n notes [intro!] = hfrefI hn_refineI[THEN hn_refine_preI]\n notes [simp] = pure_def hn_ctxt_def invalid_assn_def\nbegin \n\n definition [simp]: \"op_marl_empty_sz (N::nat) \\ op_list_empty\"\n context fixes N :: nat begin\n sepref_register \"PR_CONST (op_marl_empty_sz N)\"\n end\n\n \n\n lemma marl_fold_custom_empty_sz: \n \"op_list_empty = op_marl_empty_sz N\"\n \"mop_list_empty = RETURN (op_marl_empty_sz N)\"\n \"[] = op_marl_empty_sz N\"\n by auto\n\n lemma marl_empty_hnr_aux: \"(uncurry0 (marl_empty_sz N), uncurry0 (RETURN op_list_empty)) \\ unit_assn\\<^sup>k \\\\<^sub>a is_ms_array_list N\"\n by sep_auto\n lemmas marl_empty_hnr = marl_empty_hnr_aux[FCOMP op_list_empty.fref[of \"the_pure A\" for A]]\n lemmas marl_empty_hnr_mop = marl_empty_hnr[FCOMP mk_mop_rl0_np[OF mop_list_empty_alt]]\n\n lemma marl_empty_sz_hnr[sepref_fr_rules]:\n \"(uncurry0 (marl_empty_sz N), uncurry0 (RETURN (PR_CONST (op_marl_empty_sz N)))) \\ unit_assn\\<^sup>k \\\\<^sub>a marl_assn N A\"\n using marl_empty_hnr\n by simp\n\n lemma marl_append_hnr_aux: \"(uncurry marl_append,uncurry (RETURN oo op_list_append)) \\ [\\(l,_). length la ((is_ms_array_list N)\\<^sup>d *\\<^sub>a id_assn\\<^sup>k) \\ is_ms_array_list N\"\n by sep_auto\n lemmas marl_append_hnr[sepref_fr_rules] = marl_append_hnr_aux[FCOMP op_list_append.fref]\n lemmas marl_append_hnr_mop[sepref_fr_rules] = marl_append_hnr[FCOMP mk_mop_rl2_np[OF mop_list_append_alt]]\n\n lemma marl_length_hnr_aux: \"(marl_length,RETURN o op_list_length) \\ (is_ms_array_list N)\\<^sup>k \\\\<^sub>a nat_assn\"\n by sep_auto\n lemmas marl_length_hnr[sepref_fr_rules] = marl_length_hnr_aux[FCOMP op_list_length.fref[of \"the_pure A\" for A]]\n lemmas marl_length_hnr_mop[sepref_fr_rules] = marl_length_hnr[FCOMP mk_mop_rl1_np[OF mop_list_length_alt]]\n\n lemma marl_is_empty_hnr_aux: \"(marl_is_empty,RETURN o op_list_is_empty) \\ (is_ms_array_list N)\\<^sup>k \\\\<^sub>a bool_assn\"\n by sep_auto\n lemmas marl_is_empty_hnr[sepref_fr_rules] = marl_is_empty_hnr_aux[FCOMP op_list_is_empty.fref[of \"the_pure A\" for A]]\n lemmas marl_is_empty_hnr_mop[sepref_fr_rules] = marl_is_empty_hnr[FCOMP mk_mop_rl1_np[OF mop_list_is_empty_alt]]\n\n lemma marl_last_hnr_aux: \"(marl_last,RETURN o op_list_last) \\ [\\x. x\\[]]\\<^sub>a (is_ms_array_list N)\\<^sup>k \\ id_assn\"\n by sep_auto\n lemmas marl_last_hnr[sepref_fr_rules] = marl_last_hnr_aux[FCOMP op_list_last.fref]\n lemmas marl_last_hnr_mop[sepref_fr_rules] = marl_last_hnr[FCOMP mk_mop_rl1[OF mop_list_last_alt]]\n\n lemma marl_butlast_hnr_aux: \"(marl_butlast,RETURN o op_list_butlast) \\ [\\x. x\\[]]\\<^sub>a (is_ms_array_list N)\\<^sup>d \\ (is_ms_array_list N)\"\n by sep_auto\n lemmas marl_butlast_hnr[sepref_fr_rules] = marl_butlast_hnr_aux[FCOMP op_list_butlast.fref[of \"the_pure A\" for A]]\n lemmas marl_butlast_hnr_mop[sepref_fr_rules] = marl_butlast_hnr[FCOMP mk_mop_rl1[OF mop_list_butlast_alt]]\n\n lemma marl_get_hnr_aux: \"(uncurry marl_get,uncurry (RETURN oo op_list_get)) \\ [\\(l,i). ia ((is_ms_array_list N)\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k) \\ id_assn\"\n by sep_auto\n lemmas marl_get_hnr[sepref_fr_rules] = marl_get_hnr_aux[FCOMP op_list_get.fref]\n lemmas marl_get_hnr_mop[sepref_fr_rules] = marl_get_hnr[FCOMP mk_mop_rl2[OF mop_list_get_alt]]\n\n lemma marl_set_hnr_aux: \"(uncurry2 marl_set,uncurry2 (RETURN ooo op_list_set)) \\ [\\((l,i),_). ia ((is_ms_array_list N)\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k) \\ (is_ms_array_list N)\"\n by sep_auto\n lemmas marl_set_hnr[sepref_fr_rules] = marl_set_hnr_aux[FCOMP op_list_set.fref]\n lemmas marl_set_hnr_mop[sepref_fr_rules] = marl_set_hnr[FCOMP mk_mop_rl3[OF mop_list_set_alt]]\n\nend\n\ncontext\n fixes N :: nat\n assumes N_sz: \"N>10\"\nbegin\n\nschematic_goal \"hn_refine (emp) (?c::?'c Heap) ?\\' ?R (do {\n let x = op_marl_empty_sz N;\n RETURN (x@[1::nat])\n})\" \n using N_sz\n by sepref\n\nend\n\nschematic_goal \"hn_refine (emp) (?c::?'c Heap) ?\\' ?R (do {\n let x = op_list_empty;\n RETURN (x@[1::nat])\n})\" \n apply (subst marl_fold_custom_empty_sz[where N=10])\n apply sepref\n done\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/IICF_MS_Array_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25392142869728274}} {"text": "section\\Least Upper Bound\\\ntext\\The simplest way to merge a pair of transitions with identical outputs and updates is to\nsimply take the least upper bound of their \\emph{guards}. This theory presents several variants on\nthis theme.\\\n\ntheory Least_Upper_Bound\n imports \"../Inference\"\nbegin\n\nfun literal_args :: \"'a gexp \\ bool\" where\n \"literal_args (Bc v) = False\" |\n \"literal_args (Eq (V _) (L _)) = True\" |\n \"literal_args (In _ _) = True\" |\n \"literal_args (Eq _ _) = False\" |\n \"literal_args (Gt va v) = False\" |\n \"literal_args (Nor v va) = (literal_args v \\ literal_args va)\"\n\nlemma literal_args_eq:\n \"literal_args (Eq a b) \\ \\v l. a = (V v) \\ b = (L l)\"\n apply (cases a)\n apply simp\n apply (cases b)\n by auto\n\ndefinition \"all_literal_args t = (\\g \\ set (Guards t). literal_args g)\"\n\nfun merge_in_eq :: \"vname \\ value \\ vname gexp list \\ vname gexp list\" where\n \"merge_in_eq v l [] = [Eq (V v) (L l)]\" |\n \"merge_in_eq v l ((Eq (V v') (L l'))#t) = (if v = v' \\ l \\ l' then (In v [l, l'])#t else (Eq (V v') (L l'))#(merge_in_eq v l t))\" |\n \"merge_in_eq v l ((In v' l')#t) = (if v = v' then (In v (remdups (l#l')))#t else (In v' l')#(merge_in_eq v l t))\" |\n \"merge_in_eq v l (h#t) = h#(merge_in_eq v l t)\"\n\nfun merge_in_in :: \"vname \\ value list \\ vname gexp list \\ vname gexp list\" where\n \"merge_in_in v l [] = [In v l]\" |\n \"merge_in_in v l ((Eq (V v') (L l'))#t) = (if v = v' then (In v (List.insert l' l))#t else (Eq (V v') (L l'))#(merge_in_in v l t))\" |\n \"merge_in_in v l ((In v' l')#t) = (if v = v' then (In v (List.union l l'))#t else (In v' l')#(merge_in_in v l t))\" |\n \"merge_in_in v l (h#t) = h#(merge_in_in v l t)\"\n\nfun merge_guards :: \"vname gexp list \\ vname gexp list \\ vname gexp list\" where\n \"merge_guards [] g2 = g2\" |\n \"merge_guards ((Eq (V v) (L l))#t) g2 = merge_guards t (merge_in_eq v l g2)\" |\n \"merge_guards ((In v l)#t) g2 = merge_guards t (merge_in_in v l g2)\" |\n \"merge_guards (h#t) g2 = h#(merge_guards t g2)\"\n\ntext\\The ``least upper bound'' (lob) heuristic simply disjoins the guards of two transitions with\nidentical outputs and updates.\\\ndefinition lob_aux :: \"transition \\ transition \\ transition option\" where\n \"lob_aux t1 t2 = (if Outputs t1 = Outputs t2 \\ Updates t1 = Updates t2 \\ all_literal_args t1 \\ all_literal_args t2 then\n Some \\Label = Label t1, Arity = Arity t1, Guards = remdups (merge_guards (Guards t1) (Guards t2)), Outputs = Outputs t1, Updates = Updates t1\\\n else None)\"\n\nfun lob :: update_modifier where\n \"lob t1ID t2ID s new _ old _ = (let\n t1 = (get_by_ids new t1ID);\n t2 = (get_by_ids new t2ID) in\n case lob_aux t1 t2 of\n None \\ None |\n Some lob_t \\\n Some (replace_transitions new [(t1ID, lob_t), (t2ID, lob_t)])\n )\"\n\nlemma lob_aux_some: \"Outputs t1 = Outputs t2 \\\n Updates t1 = Updates t2 \\\n all_literal_args t1 \\\n all_literal_args t2 \\\n Label t = Label t1 \\\n Arity t = Arity t1 \\\n Guards t = remdups (merge_guards (Guards t1) (Guards t2)) \\\n Outputs t = Outputs t1 \\\n Updates t = Updates t1 \\\n lob_aux t1 t2 = Some t\"\n by (simp add: lob_aux_def)\n\nfun has_corresponding :: \"vname gexp \\ vname gexp list \\ bool\" where\n \"has_corresponding g [] = False\" |\n \"has_corresponding (Eq (V v) (L l)) ((Eq (V v') (L l'))#t) = (if v = v' \\ l = l' then True else has_corresponding (Eq (V v) (L l)) t)\" |\n \"has_corresponding (In v' l') ((Eq (V v) (L l))#t) = (if v = v' \\ l \\ set l' then True else has_corresponding (In v' l') t)\" |\n \"has_corresponding (In v l) ((In v' l')#t) = (if v = v' \\ set l' \\ set l then True else has_corresponding (In v l) t)\" |\n \"has_corresponding g (h#t) = has_corresponding g t\"\n\nlemma no_corresponding_bc: \"\\has_corresponding (Bc x1) G1\"\n apply (induct G1)\n by auto\n\nlemma no_corresponding_gt: \"\\has_corresponding (Gt x1 y1) G1\"\n apply (induct G1)\n by auto\n\nlemma no_corresponding_nor: \"\\has_corresponding (Nor x1 y1) G1\"\n apply (induct G1)\n by auto\n\nlemma has_corresponding_eq: \"has_corresponding (Eq x21 x22) G1 \\ (Eq x21 x22) \\ set G1\"\nproof(induct G1)\n case (Cons a G1)\n then show ?case\n apply (cases a)\n apply simp\n subgoal for x21a x22a\n apply (case_tac \"x21a\")\n apply simp\n apply (case_tac \"x22a\")\n apply clarify\n apply simp\n apply (case_tac \"x21\")\n apply simp\n apply (case_tac \"x22\")\n apply (metis has_corresponding.simps(2))\n by auto\n by auto\nqed auto\n\nlemma has_corresponding_In: \"has_corresponding (In v l) G1 \\ (\\l'. (In v l') \\ set G1 \\ set l' \\ set l) \\ (\\l' \\ set l. (Eq (V v) (L l')) \\ set G1)\"\nproof(induct G1)\n case (Cons a G1)\n then show ?case\n apply (cases a)\n apply simp\n defer\n apply simp\n apply simp\n defer\n apply simp\n apply simp\n subgoal for x21 x22 apply (case_tac x21)\n apply simp\n apply (case_tac x22)\n apply fastforce\n apply simp+\n done\n by metis\nqed auto\n\nlemma gval_each_one: \"g \\ set G \\ apply_guards G s \\ gval g s = true\"\n using apply_guards_cons apply_guards_rearrange by blast\n\nlemma has_corresponding_apply_guards:\n \"\\g\\set G2. has_corresponding g G1 \\\n apply_guards G1 s \\\n apply_guards G2 s\"\nproof(induct G2)\n case (Cons a G2)\n then show ?case\n apply (cases a)\n apply (simp add: no_corresponding_bc)\n apply simp\n apply (metis (full_types) has_corresponding_eq append_Cons append_self_conv2 apply_guards_append apply_guards_rearrange)\n apply (simp add: no_corresponding_gt)\n apply simp\n subgoal for v l\n apply (insert has_corresponding_In[of v l G1])\n apply simp\n apply (erule disjE)\n apply clarsimp\n subgoal for l'\n apply (insert apply_guards_rearrange[of \"In v l'\" G1 s])\n apply simp\n apply (simp only: apply_guards_cons[of \"In v l\" G2])\n apply (simp only: apply_guards_cons[of \"In v l'\" G1])\n apply simp\n apply (cases \"s v\")\n apply simp\n by force\n apply clarsimp\n subgoal for l'\n apply (insert apply_guards_rearrange[of \"Eq (V v) (L l')\" G1 s])\n apply simp\n apply (simp only: apply_guards_cons[of \"In v l\" G2])\n apply (simp only: apply_guards_cons[of \"Eq (V v) (L l')\" G1])\n apply (cases \"s v\")\n apply simp\n apply simp\n using trilean.distinct(1) by presburger\n done\n by (simp add: no_corresponding_nor)\nqed auto\n\nlemma correspondence_subsumption:\n \"Label t1 = Label t2 \\\n Arity t1 = Arity t2 \\\n Outputs t1 = Outputs t2 \\\n Updates t1 = Updates t2 \\\n \\g \\ set (Guards t2). has_corresponding g (Guards t1) \\\n subsumes t2 c t1\"\n by (simp add: can_take_def can_take_transition_def has_corresponding_apply_guards subsumption)\n\ndefinition \"is_lob t1 t2 = (\n Label t1 = Label t2 \\\n Arity t1 = Arity t2 \\\n Outputs t1 = Outputs t2 \\\n Updates t1 = Updates t2 \\\n (\\g \\ set (Guards t2). has_corresponding g (Guards t1)))\"\n\nlemma is_lob_direct_subsumption:\n \"is_lob t1 t2 \\ directly_subsumes e1 e2 s s' t2 t1\"\n apply (rule subsumes_in_all_contexts_directly_subsumes)\n by (simp add: is_lob_def correspondence_subsumption)\n\nfun has_distinguishing :: \"vname gexp \\ vname gexp list \\ bool\" where\n \"has_distinguishing g [] = False\" |\n \"has_distinguishing (Eq (V v) (L l)) ((Eq (V v') (L l'))#t) = (if v = v' \\ l \\ l' then True else has_distinguishing (Eq (V v) (L l)) t)\" |\n \"has_distinguishing (In (I v') l') ((Eq (V (I v)) (L l))#t) = (if v = v' \\ l \\ set l' then True else has_distinguishing (In (I v') l') t)\" |\n \"has_distinguishing (In (I v) l) ((In (I v') l')#t) = (if v = v' \\ set l' \\ set l then True else has_distinguishing (In (I v) l) t)\" |\n \"has_distinguishing g (h#t) = has_distinguishing g t\"\n\nlemma has_distinguishing: \"has_distinguishing g G \\ (\\v l. g = (Eq (V v) (L l))) \\ (\\v l. g = In v l)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (cases g)\n apply simp\n apply (case_tac x21)\n apply simp\n apply (case_tac x22)\n by auto\nqed auto\n\nlemma has_distinguishing_Eq: \"has_distinguishing (Eq (V v) (L l)) G \\ \\l'. (Eq (V v) (L l')) \\ set G \\ l \\ l'\"\nproof (induct G)\n case (Cons a G)\n then show ?case\n apply (cases a)\n apply simp\n apply (case_tac x21)\n apply simp\n apply (case_tac x22)\n apply (metis has_distinguishing.simps(2) list.set_intros(1) list.set_intros(2))\n by auto\nqed auto\n\nlemma ex_mutex: \"Eq (V v) (L l) \\ set G1 \\\n Eq (V v) (L l') \\ set G2 \\\n l \\ l' \\\n apply_guards G1 s \\\n \\ apply_guards G2 s\"\n apply (simp add: apply_guards_def Bex_def)\n apply (rule_tac x=\"Eq (V v) (L l')\" in exI)\n apply simp\n apply (case_tac \"s v\")\n by auto\n\nlemma has_distinguishing_In:\n \"has_distinguishing (In v l) G \\\n (\\l' i. v = I i \\ Eq (V v) (L l') \\ set G \\ l' \\ set l) \\ (\\l' i. v = I i \\ In v l' \\ set G \\ set l' \\ set l)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (case_tac v)\n subgoal for x\n apply simp\n apply (cases a)\n apply simp\n subgoal for x21 x22\n apply (case_tac x21)\n apply simp\n apply (case_tac x22)\n apply (case_tac x2)\n apply fastforce\n apply simp+\n done\n subgoal by simp\n subgoal for x41\n apply (case_tac x41)\n apply (simp, metis)\n by auto\n by auto\n by auto\nqed auto\n\nlemma Eq_apply_guards:\n \"Eq (V v) (L l) \\ set G1 \\\n apply_guards G1 s \\\n s v = Some l\"\n apply (simp add: apply_guards_rearrange)\n apply (simp add: apply_guards_cons)\n apply (cases \"s v\")\n apply simp\n apply simp\n using trilean.distinct(1) by presburger\n\nlemma In_neq_apply_guards:\n \"In v l \\ set G2 \\\n Eq (V v) (L l') \\ set G1 \\\n l' \\ set l \\\n apply_guards G1 s \\\n \\apply_guards G2 s\"\nproof(induct G1)\n case (Cons a G1)\n then show ?case\n apply (simp add: apply_guards_def Bex_def)\n apply (rule_tac x=\"In v l\" in exI)\n using Eq_apply_guards[of v l' \"a#G1\" s]\n by (simp add: Cons.prems(4) image_iff)\nqed auto\n\nlemma In_apply_guards: \"In v l \\ set G1 \\ apply_guards G1 s \\ \\v' \\ set l. s v = Some v'\"\n apply (simp add: apply_guards_rearrange)\n apply (simp add: apply_guards_cons)\n apply (cases \"s v\")\n apply simp\n apply simp\n by (meson image_iff trilean.simps(2))\n\nlemma input_not_constrained_aval_swap_inputs:\n \"\\ aexp_constrains a (V (I v)) \\\n aval a (join_ir i c) = aval a (join_ir (list_update i v x) c)\"\n apply(induct a rule: aexp_induct_separate_V_cases)\n apply simp\n apply (metis aexp_constrains.simps(2) aval.simps(2) input2state_nth input2state_out_of_bounds join_ir_def length_list_update not_le nth_list_update_neq vname.simps(5))\n using join_ir_def by auto\n\nlemma input_not_constrained_gval_swap_inputs:\n \"\\ gexp_constrains a (V (I v)) \\\n gval a (join_ir i c) = gval a (join_ir (i[v := x]) c)\"\nproof(induct a)\n case (Bc x)\n then show ?case\n by (metis (full_types) gval.simps(1) gval.simps(2))\nnext\n case (Eq x1a x2)\n then show ?case\n using input_not_constrained_aval_swap_inputs by auto\nnext\n case (Gt x1a x2)\n then show ?case\n using input_not_constrained_aval_swap_inputs by auto\nnext\n case (In x1a x2)\n then show ?case\n apply simp\n apply (case_tac \"join_ir i c x1a\")\n apply (case_tac \"join_ir (i[v := x]) c x1a\")\n apply simp\n apply (metis In.prems aval.simps(2) gexp_constrains.simps(5) input_not_constrained_aval_swap_inputs option.discI)\n apply (case_tac \"join_ir (i[v := x]) c x1a\")\n apply (metis In.prems aval.simps(2) gexp_constrains.simps(5) input_not_constrained_aval_swap_inputs option.discI)\n by (metis In.prems aval.simps(2) gexp_constrains.simps(5) input_not_constrained_aval_swap_inputs)\nqed auto\n\nlemma test_aux: \"\\g\\set (removeAll (In (I v) l) G1). \\ gexp_constrains g (V (I v)) \\\n apply_guards G1 (join_ir i c) \\\n x \\ set l \\\n apply_guards G1 (join_ir (i[v := x]) c)\"\nproof(induct G1)\n case (Cons a G1)\n then show ?case\n apply (simp only: apply_guards_cons)\n apply (case_tac \"a = In (I v) l\")\n apply simp\n apply (case_tac \"join_ir i c (I v)\")\n apply simp\n apply (case_tac \"join_ir (i[v := x]) c (I v)\")\n apply (metis join_ir_nth le_less_linear length_list_update list_update_beyond option.discI)\n apply simp\n apply (metis join_ir_nth le_less_linear length_list_update list_update_beyond nth_list_update_eq option.inject trilean.distinct(1))\n apply (case_tac \"join_ir (i[v := x]) c (I v)\")\n apply (metis join_ir_nth le_less_linear length_list_update list_update_beyond option.discI)\n apply simp\n using input_not_constrained_gval_swap_inputs by auto\nqed auto\n\nlemma test:\n assumes\n p1: \"In (I v) l \\ set G2\" and\n p2: \"In (I v) l' \\ set G1\" and\n p3: \"x \\ set l'\" and\n p4: \"x \\ set l\" and\n p5: \"apply_guards G1 (join_ir i c)\" and\n p6: \"length i = a\" and\n p7: \"\\g \\ set (removeAll (In (I v) l') G1). \\ gexp_constrains g (V (I v))\"\n shows \"\\i. length i = a \\ apply_guards G1 (join_ir i c) \\ (length i = a \\ \\ apply_guards G2 (join_ir i c))\"\n apply (rule_tac x=\"list_update i v x\" in exI)\n apply standard\n apply (simp add: p6)\n apply standard\n using p3 p5 p7 test_aux apply blast\n using p1 p4\n apply (simp add: apply_guards_rearrange)\n apply (simp add: apply_guards_cons join_ir_def)\n apply (case_tac \"input2state (i[v := x]) $ v\")\n apply simp\n apply simp\n by (metis input2state_nth input2state_within_bounds length_list_update nth_list_update_eq option.inject)\n\ndefinition get_Ins :: \"vname gexp list \\ (nat \\ value list) list\" where\n \"get_Ins G = map (\\g. case g of (In (I v) l) \\ (v, l)) (filter (\\g. case g of (In (I _) _ ) \\ True | _ \\ False) G)\"\n\nlemma get_Ins_Cons_equiv: \"\\v l. a = In (I v) l \\ get_Ins (a # G) = get_Ins G\"\n apply (simp add: get_Ins_def)\n apply (cases a)\n apply simp+\n apply (metis (full_types) vname.exhaust vname.simps(6))\n by simp\n\nlemma Ball_Cons: \"(\\x \\ set (a#l). P x) = (P a \\ (\\x \\ set l. P x))\"\n by simp\n\nlemma In_in_get_Ins: \"(In (I v) l \\ set G) = ((v, l) \\ set (get_Ins G))\"\nproof(induct G)\n case Nil\n then show ?case\n by (simp add: get_Ins_def)\nnext\n case (Cons a G)\n then show ?case\n apply (simp add: get_Ins_def)\n apply (cases a)\n apply simp+\n subgoal for x by (case_tac x, auto)\n apply auto\n done\nqed\n\ndefinition \"check_get_Ins G = (\\(v, l') \\ set (get_Ins G). \\g \\ set (removeAll (In (I v) l') G). \\ gexp_constrains g (V (I v)))\"\n\nlemma no_Ins: \"[] = get_Ins G \\ set G - {In (I i) l} = set G\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (cases a)\n apply (simp add: get_Ins_Cons_equiv insert_Diff_if)+\n subgoal for x41 x42\n apply (case_tac x41)\n apply simp\n apply (metis In_in_get_Ins equals0D list.set(1) list.set_intros(1))\n apply (simp add: get_Ins_Cons_equiv)\n done\n by (simp add: get_Ins_Cons_equiv insert_Diff_if)\nqed auto\n\nlemma test2: \"In (I i) l \\ set (Guards t2) \\\n In (I i) l' \\ set (Guards t1) \\\n length ia = Arity t1 \\\n apply_guards (Guards t1) (join_ir ia c) \\\n x \\ set l' \\\n x \\ set l \\\n \\(v, l')\\insert (0, []) (set (get_Ins (Guards t1))). \\g\\set (removeAll (In (I v) l') (Guards t1)). \\ gexp_constrains g (V (I v)) \\\n Arity t1 = Arity t2 \\\n \\i. length i = Arity t2 \\ apply_guards (Guards t1) (join_ir i c) \\ (length i = Arity t2 \\ \\ apply_guards (Guards t2) (join_ir i c))\"\n using test[of i l \"Guards t2\" l' \"Guards t1\" x ia c \"Arity t2\"]\n apply simp\n apply (case_tac \"\\g\\set (Guards t1) - {In (I i) l'}. \\ gexp_constrains g (V (I i))\")\n apply simp\n apply simp\n using In_in_get_Ins by blast\n\nlemma distinguishing_subsumption:\n assumes\n p1: \"\\g \\ set (Guards t2). has_distinguishing g (Guards t1)\" and\n p2: \"Arity t1 = Arity t2\" and\n p3: \"\\i. can_take_transition t1 i c\" and\n p4: \"(\\(v, l') \\ insert (0, []) (set (get_Ins (Guards t1))). \\g \\ set (removeAll (In (I v) l') (Guards t1)). \\ gexp_constrains g (V (I v)))\"\n shows\n \"\\ subsumes t2 c t1\"\nproof-\n show ?thesis\n apply (rule bad_guards)\n apply (simp add: can_take_transition_def can_take_def p2)\n apply (insert p1, simp add: Bex_def)\n apply (erule exE)\n apply (case_tac \"\\v l. x = (Eq (V v) (L l))\")\n apply (metis can_take_def can_take_transition_def ex_mutex p2 p3 has_distinguishing_Eq)\n apply (case_tac \"\\v l. x = In v l\")\n defer\n using has_distinguishing apply blast\n apply clarify\n apply (case_tac \"\\l' i. v = I i \\ Eq (V v) (L l') \\ set (Guards t1) \\ l' \\ set l\")\n apply (metis In_neq_apply_guards can_take_def can_take_transition_def p2 p3)\n apply (case_tac \"(\\l' i. v = I i \\ In v l' \\ set (Guards t1) \\ set l' \\ set l)\")\n defer\n using has_distinguishing_In apply blast\n apply simp\n apply (erule conjE)\n apply (erule exE)+\n apply (erule conjE)\n apply (insert p3, simp only: can_take_transition_def can_take_def)\n apply (case_tac \"\\x. x \\ set l' \\ x \\ set l\")\n apply (erule exE)+\n apply (erule conjE)+\n apply (insert p4 p2)\n using test2\n apply blast\n by auto\nqed\n\ndefinition \"lob_distinguished t1 t2 = (\n(\\g \\ set (Guards t2). has_distinguishing g (Guards t1)) \\\nArity t1 = Arity t2 \\\n(\\(v, l') \\ insert (0, []) (set (get_Ins (Guards t1))). \\g \\ set (removeAll (In (I v) l') (Guards t1)). \\ gexp_constrains g (V (I v))))\"\n\nlemma must_be_another:\n \"1 < size (fset_of_list b) \\\n x \\ set b \\\n \\x' \\ set b. x \\ x'\"\nproof(induct b)\n case (Cons a b)\n then show ?case\n apply (simp add: Bex_def)\n by (metis List.finite_set One_nat_def card.insert card_gt_0_iff card_mono fset_of_list.rep_eq insert_absorb le_0_eq less_nat_zero_code less_numeral_extra(4) not_less_iff_gr_or_eq set_empty2 subsetI)\nqed auto\n\nlemma another_swap_inputs:\n \"apply_guards G (join_ir i c) \\\n filter (\\g. gexp_constrains g (V (I a))) G = [In (I a) b] \\\n xa \\ set b \\\n apply_guards G (join_ir (i[a := xa]) c)\"\nproof(induct G)\n case (Cons g G)\n then show ?case\n apply (simp add: apply_guards_cons)\n apply (case_tac \"gexp_constrains g (V (I a))\")\n defer\n using input_not_constrained_gval_swap_inputs apply auto[1]\n apply simp\n apply (case_tac \"join_ir i c (I a) \\ Some ` set b\")\n defer\n apply simp\n apply clarify\n apply standard\n using apply_guards_def input_not_constrained_gval_swap_inputs\n apply (simp add: filter_empty_conv)\n apply (case_tac \"join_ir i c (I a)\")\n apply simp\n apply (case_tac \"join_ir (i[a := xa]) c (I a)\")\n apply simp\n apply (metis image_eqI trilean.distinct(1))\n apply simp\n apply (metis image_eqI trilean.distinct(1))\n apply (case_tac \"join_ir i c (I a)\")\n apply simp\n apply simp\n apply (metis image_eqI trilean.distinct(1))\n apply (case_tac \"join_ir i c (I a)\")\n apply simp\n apply (case_tac \"join_ir (i[a := xa]) c (I a)\")\n apply simp\n apply (metis join_ir_nth le_less_linear length_list_update list_update_beyond option.discI)\n apply simp\n apply standard\n apply (metis (no_types, lifting) Cons.hyps Cons.prems(2) filter_empty_conv removeAll_id set_ConsD test_aux)\n by (metis in_these_eq join_ir_nth le_less_linear length_list_update list_update_beyond nth_list_update_eq these_image_Some_eq)\nqed auto\n\nlemma lob_distinguished_2_not_subsumes:\n \"\\(i, l) \\ set (get_Ins (Guards t2)). filter (\\g. gexp_constrains g (V (I i))) (Guards t2) = [(In (I i) l)] \\\n (\\l' \\ set l. i < Arity t1 \\ Eq (V (I i)) (L l') \\ set (Guards t1) \\ size (fset_of_list l) > 1) \\\n Arity t1 = Arity t2 \\\n \\i. can_take_transition t2 i c \\\n \\ subsumes t1 c t2\"\n apply (rule bad_guards)\n apply simp\n apply (simp add: can_take_def can_take_transition_def Bex_def)\n apply clarify\n apply (case_tac \"\\x' \\ set b. x \\ x'\")\n defer\n apply (simp add: must_be_another)\n apply (simp add: Bex_def)\n apply (erule exE)\n apply (rule_tac x=\"list_update i a xa\" in exI)\n apply simp\n apply standard\n apply (simp add: another_swap_inputs)\n by (metis Eq_apply_guards input2state_nth join_ir_def length_list_update nth_list_update_eq option.inject vname.simps(5))\n\ndefinition \"lob_distinguished_2 t1 t2 =\n (\\(i, l) \\ set (get_Ins (Guards t2)). filter (\\g. gexp_constrains g (V (I i))) (Guards t2) = [(In (I i) l)] \\\n (\\l' \\ set l. i < Arity t1 \\ Eq (V (I i)) (L l') \\ set (Guards t1) \\ size (fset_of_list l) > 1) \\\n Arity t1 = Arity t2)\"\n\nlemma lob_distinguished_3_not_subsumes:\n \"\\(i, l) \\ set (get_Ins (Guards t2)). filter (\\g. gexp_constrains g (V (I i))) (Guards t2) = [(In (I i) l)] \\\n (\\(i', l') \\ set (get_Ins (Guards t1)). i = i' \\ set l' \\ set l) \\\n Arity t1 = Arity t2 \\\n \\i. can_take_transition t2 i c \\\n \\ subsumes t1 c t2\"\n apply (rule bad_guards)\n apply simp\n apply (simp add: can_take_def can_take_transition_def Bex_def)\n apply (erule exE)+\n apply (erule conjE)+\n apply (erule exE)+\n apply (erule conjE)+\n apply (case_tac \"\\x. x \\ set b \\ x \\ set ba\")\n defer\n apply auto[1]\n apply (erule exE)+\n apply (erule conjE)+\n apply (rule_tac x=\"list_update i a x\" in exI)\n apply simp\n apply standard\n using another_swap_inputs apply blast\n by (metis In_apply_guards In_in_get_Ins input2state_not_None input2state_nth join_ir_def nth_list_update_eq option.distinct(1) option.inject vname.simps(5))\n\n\ndefinition \"lob_distinguished_3 t1 t2 = (\\(i, l) \\ set (get_Ins (Guards t2)). filter (\\g. gexp_constrains g (V (I i))) (Guards t2) = [(In (I i) l)] \\\n (\\(i', l') \\ set (get_Ins (Guards t1)). i = i' \\ set l' \\ set l) \\\n Arity t1 = Arity t2)\"\n\nfun is_In :: \"'a gexp \\ bool\" where\n \"is_In (In _ _) = True\" |\n \"is_In _ = False\"\n\ntext\\The ``greatest upper bound'' (gob) heuristic is similar to \\texttt{lob} but applies a more\nintellegent approach to guard merging.\\\n\ndefinition gob_aux :: \"transition \\ transition \\ transition option\" where\n \"gob_aux t1 t2 = (if Outputs t1 = Outputs t2 \\ Updates t1 = Updates t2 \\ all_literal_args t1 \\ all_literal_args t2 then\n Some \\Label = Label t1, Arity = Arity t1, Guards = remdups (filter (Not \\ is_In) (merge_guards (Guards t1) (Guards t2))), Outputs = Outputs t1, Updates = Updates t1\\\n else None)\"\n\nfun gob :: update_modifier where\n \"gob t1ID t2ID s new _ old _ = (let\n t1 = (get_by_ids new t1ID);\n t2 = (get_by_ids new t2ID) in\n case gob_aux t1 t2 of\n None \\ None |\n Some gob_t \\\n Some (replace_transitions new [(t1ID, gob_t), (t2ID, gob_t)])\n )\"\n\ntext\\The ``Gung Ho'' heuristic simply drops the guards of both transitions, making them identical.\\\ndefinition gung_ho_aux :: \"transition \\ transition \\ transition option\" where\n \"gung_ho_aux t1 t2 = (if Outputs t1 = Outputs t2 \\ Updates t1 = Updates t2 \\ all_literal_args t1 \\ all_literal_args t2 then\n Some \\Label = Label t1, Arity = Arity t1, Guards = [], Outputs = Outputs t1, Updates = Updates t1\\\n else None)\"\n\nfun gung_ho :: update_modifier where\n \"gung_ho t1ID t2ID s new _ old _ = (let\n t1 = (get_by_ids new t1ID);\n t2 = (get_by_ids new t2ID) in\n case gung_ho_aux t1 t2 of\n None \\ None |\n Some gob_t \\\n Some (replace_transitions new [(t1ID, gob_t), (t2ID, gob_t)])\n )\"\n\n\n\nlemma guard_subset_eq_outputs_updates_direct_subsumption:\n \"Label t1 = Label t2 \\\n Arity t1 = Arity t2 \\\n Outputs t1 = Outputs t2 \\\n Updates t1 = Updates t2 \\\n set (Guards t2) \\ set (Guards t1) \\\n directly_subsumes m1 m2 s1 s2 t2 t1\"\n apply (rule subsumes_in_all_contexts_directly_subsumes)\n by (simp add: guard_subset_eq_outputs_updates_subsumption)\n\nlemma unconstrained_input:\n \"\\g\\set G. \\ gexp_constrains g (V (I i)) \\\n apply_guards G (join_ir ia c) \\\n apply_guards G (join_ir (ia[i := x']) c)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (simp add: apply_guards_cons)\n using input_not_constrained_gval_swap_inputs[of a i ia c x']\n by simp\nqed auto\n\nlemma each_input_guarded_once_cons:\n \"\\i\\\\ (enumerate_gexp_inputs ` set (a # G)). length (filter (\\g. gexp_constrains g (V (I i))) (a # G)) \\ 1 \\\n \\i\\\\ (enumerate_gexp_inputs ` set G). length (filter (\\g. gexp_constrains g (V (I i))) G) \\ 1\"\n apply (simp add: Ball_def)\n apply clarify\nproof -\n fix x :: nat and xa :: \"vname gexp\"\n assume a1: \"\\x. (x \\ enumerate_gexp_inputs a \\ length (if gexp_constrains a (V (I x)) then a # filter (\\g. gexp_constrains g (V (I x))) G else filter (\\g. gexp_constrains g (V (I x))) G) \\ 1) \\ ((\\xa\\set G. x \\ enumerate_gexp_inputs xa) \\ length (if gexp_constrains a (V (I x)) then a # filter (\\g. gexp_constrains g (V (I x))) G else filter (\\g. gexp_constrains g (V (I x))) G) \\ 1)\"\n assume a2: \"xa \\ set G\"\n assume \"x \\ enumerate_gexp_inputs xa\"\n then have \"if gexp_constrains a (V (I x)) then length (a # filter (\\g. gexp_constrains g (V (I x))) G) \\ 1 else length (filter (\\g. gexp_constrains g (V (I x))) G) \\ 1\"\n using a2 a1 by fastforce\n then show \"length (filter (\\g. gexp_constrains g (V (I x))) G) \\ 1\"\n by (metis (no_types) impossible_Cons le_cases order.trans)\nqed\n\nlemma literal_args_can_take:\n \"\\g\\set G. \\i v s. g = Eq (V (I i)) (L v) \\ g = In (I i) s \\ s \\ [] \\\n \\i\\\\ (enumerate_gexp_inputs ` set G). i < a \\\n \\i\\\\ (enumerate_gexp_inputs ` set G). length (filter (\\g. gexp_constrains g (V (I i))) G) \\ 1 \\\n \\i. length i = a \\ apply_guards G (join_ir i c)\"\nproof(induct G)\n case Nil\n then show ?case\n using Ex_list_of_length\n by auto\nnext\n case (Cons a G)\n then show ?case\n apply simp\n apply (case_tac \"\\y\\set G. \\i\\enumerate_gexp_inputs y. length (filter (\\g. gexp_constrains g (V (I i))) G) \\ 1\")\n defer\n using each_input_guarded_once_cons apply auto[1]\n apply (simp add: ball_Un)\n apply clarsimp\n apply (induct a)\n apply simp\n apply simp\n subgoal for x2 i ia\n apply (case_tac x2)\n apply (rule_tac x=\"list_update i ia x1\" in exI)\n apply (simp add: apply_guards_cons unconstrained_input filter_empty_conv)\n apply simp+\n done\n apply simp\n subgoal for _ x2 i ia\n apply (case_tac x2)\n apply simp\n subgoal for aa\n apply (rule_tac x=\"list_update i ia aa\" in exI)\n apply (simp add: apply_guards_cons unconstrained_input filter_empty_conv)\n done\n done\n by simp\nqed\n\nlemma \"(SOME x'. x' \\ (v::value)) \\ v\"\nproof(induct v)\n case (Num x)\n then show ?case\n by (metis (full_types) someI_ex value.simps(4))\nnext\n case (Str x)\n then show ?case\n by (metis (full_types) someI_ex value.simps(4))\nqed\n\nlemma opposite_gob_subsumption: \"\\g \\ set (Guards t1). \\i v s. g = Eq (V (I i)) (L v) \\ (g = In (I i) s \\ s \\ []) \\\n \\g \\ set (Guards t2). \\i v s. g = Eq (V (I i)) (L v) \\ (g = In (I i) s \\ s \\ []) \\\n \\ i. \\v. Eq (V (I i)) (L v) \\ set (Guards t1) \\\n (\\g \\ set (Guards t2). \\ gexp_constrains g (V (I i))) \\\n Arity t1 = Arity t2 \\\n \\i \\ enumerate_inputs t2. i < Arity t2 \\\n \\i \\ enumerate_inputs t2. length (filter (\\g. gexp_constrains g (V (I i))) (Guards t2)) \\ 1 \\\n \\ subsumes t1 c t2\"\n apply (rule bad_guards)\n apply (simp add: enumerate_inputs_def can_take_transition_def can_take_def Bex_def)\n using literal_args_can_take[of \"Guards t2\" \"Arity t2\" c]\n apply simp\n apply clarify\n subgoal for i ia v\n apply (rule_tac x=\"list_update ia i (Eps (\\x'. x' \\ v))\" in exI)\n apply simp\n apply standard\n apply (simp add: apply_guards_def)\n using input_not_constrained_gval_swap_inputs apply simp\n apply (simp add: apply_guards_def Bex_def)\n apply (rule_tac x=\"Eq (V (I i)) (L v)\" in exI)\n apply (simp add: join_ir_def)\n apply (case_tac \"input2state (ia[i := SOME x'. x' \\ v]) $ i\")\n apply simp\n apply simp\n apply (case_tac \"i < length ia\")\n apply (simp add: input2state_nth)\n apply (case_tac v)\n apply (metis (mono_tags) someI_ex value.simps(4))\n apply (metis (mono_tags) someI_ex value.simps(4))\n by (metis input2state_within_bounds length_list_update)\n done\n\nfun is_lit_eq :: \"vname gexp \\ nat \\ bool\" where\n \"is_lit_eq (Eq (V (I i)) (L v)) i' = (i = i')\" |\n \"is_lit_eq _ _ = False\"\n\nlemma \"(\\v. Eq (V (I i)) (L v) \\ set G) = (\\g \\ set G. is_lit_eq g i)\"\n by (metis is_lit_eq.elims(2) is_lit_eq.simps(1))\n\nfun is_lit_eq_general :: \"vname gexp \\ bool\" where\n \"is_lit_eq_general (Eq (V (I _)) (L _)) = True\" |\n \"is_lit_eq_general _ = False\"\n\nfun is_input_in :: \"vname gexp \\ bool\" where\n \"is_input_in (In (I i) s) = (s \\ [])\" |\n \"is_input_in _ = False\"\n\ndefinition \"opposite_gob t1 t2 = (\n (\\g \\ set (Guards t1). is_lit_eq_general g \\ is_input_in g) \\\n (\\g \\ set (Guards t2). is_lit_eq_general g \\ is_input_in g) \\\n (\\ i \\ (enumerate_inputs t1 \\ enumerate_inputs t2). (\\g \\ set (Guards t1). is_lit_eq g i) \\\n (\\g \\ set (Guards t2). \\ gexp_constrains g (V (I i)))) \\\n Arity t1 = Arity t2 \\\n (\\i \\ enumerate_inputs t2. i < Arity t2) \\\n (\\i \\ enumerate_inputs t2. length (filter (\\g. gexp_constrains g (V (I i))) (Guards t2)) \\ 1))\"\n\nlemma \"is_lit_eq_general g \\ is_input_in g \\\n \\i v s. g = Eq (V (I i)) (L v) \\ g = In (I i) s \\ s \\ []\"\n by (meson is_input_in.elims(2) is_lit_eq_general.elims(2))\n\nlemma opposite_gob_directly_subsumption:\n \"opposite_gob t1 t2 \\ \\ subsumes t1 c t2\"\n apply (rule opposite_gob_subsumption)\n unfolding opposite_gob_def\n apply (meson is_input_in.elims(2) is_lit_eq_general.elims(2))+\n apply (metis is_lit_eq.elims(2))\n by auto\n\nfun get_in :: \"'a gexp \\ ('a \\ value list) option\" where\n \"get_in (In v s) = Some (v, s)\" |\n \"get_in _ = None\"\n\nlemma not_subset_not_in: \"(\\ s1 \\ s2) = (\\i. i \\ s1 \\ i \\ s2)\"\n by auto\n\nlemma get_in_is: \"(get_in x = Some (v, s1)) = (x = In v s1)\"\n by (induct x, auto)\n\nlemma gval_rearrange:\n \"g \\ set G \\\n gval g s = true \\\n apply_guards (removeAll g G) s \\\n apply_guards G s\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (simp only: apply_guards_cons)\n apply standard\n apply (metis apply_guards_cons removeAll.simps(2))\n by (metis apply_guards_cons removeAll.simps(2) removeAll_id)\nqed auto\n\nlemma singleton_list: \"(length l = 1) = (\\e. l = [e])\"\n by (induct l, auto)\n\nlemma remove_restricted:\n \"g \\ set G \\\n gexp_constrains g (V v) \\\n restricted_once v G \\\n not_restricted v (removeAll g G)\"\n apply (simp add: restricted_once_def not_restricted_def singleton_list)\n apply clarify\n subgoal for e \n apply (case_tac \"e = g\")\n defer\n apply (metis (no_types, lifting) DiffE Diff_insert_absorb Set.set_insert empty_set filter.simps(2) filter_append in_set_conv_decomp insert_iff list.set(2))\n apply (simp add: filter_empty_conv)\n proof -\n fix e :: \"'a gexp\"\n assume \"filter (\\g. gexp_constrains g (V v)) G = [g]\"\n then have \"{g \\ set G. gexp_constrains g (V v)} = {g}\"\n by (metis (no_types) empty_set list.simps(15) set_filter)\n then show \"\\g\\set G - {g}. \\ gexp_constrains g (V v)\"\n by blast\n qed\n done\n\nlemma unrestricted_input_swap:\n \"not_restricted (I i) G \\\n apply_guards G (join_ir iaa c) \\\n apply_guards (removeAll g G) (join_ir (iaa[i := ia]) c)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (simp add: apply_guards_cons not_restricted_def)\n apply safe\n apply (meson neq_Nil_conv)\n apply (metis input_not_constrained_gval_swap_inputs list.distinct(1))\n by (metis list.distinct(1))\nqed auto\n\nlemma apply_guards_remove_restricted:\n \"g \\ set G \\\n gexp_constrains g (V (I i)) \\\n restricted_once (I i) G \\\n apply_guards G (join_ir iaa c) \\\n apply_guards (removeAll g G) (join_ir (iaa[i := ia]) c)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply simp\n apply safe\n apply (rule unrestricted_input_swap)\n apply (simp add: not_restricted_def restricted_once_def)\n apply (meson apply_guards_subset set_subset_Cons)\n apply (simp add: apply_guards_rearrange not_restricted_def restricted_once_def unrestricted_input_swap)\n by (metis apply_guards_cons filter.simps(2) filter_empty_conv input_not_constrained_gval_swap_inputs list.inject restricted_once_def singleton_list)\nqed auto\n\nlemma In_swap_inputs:\n \"In (I i) s2 \\ set G \\\n restricted_once (I i) G \\\n ia \\ set s2 \\\n apply_guards G (join_ir iaa c) \\\n apply_guards G (join_ir (iaa[i := ia]) c)\"\n using apply_guards_remove_restricted[of \"In (I i) s2\" G i iaa c ia]\n apply simp\n apply (rule gval_rearrange[of \"In (I i) s2\"])\n apply simp\n apply (metis filter_empty_conv gval_each_one input_not_constrained_gval_swap_inputs length_0_conv not_restricted_def remove_restricted test_aux)\n by blast\n\ndefinition these :: \"'a option list \\ 'a list\" where\n \"these as = map (\\x. case x of Some y \\ y) (filter (\\x. x \\ None) as)\"\n\nlemma these_cons: \"these (a#as) = (case a of None \\ these as | Some x \\ x#(these as))\"\n apply (cases a)\n apply (simp add: these_def)\n by (simp add: these_def)\n\ndefinition get_ins :: \"vname gexp list \\ (nat \\ value list) list\" where\n \"get_ins g = map (\\(v, s). case v of I i \\ (i, s)) (filter (\\(v, _). case v of I _ \\ True | R _ \\ False) (these (map get_in g)))\"\n\nlemma in_get_ins:\n \"(I x1a, b) \\ set (these (map get_in G)) \\\n In (I x1a) b \\ set G\"\nproof(induct G)\n case Nil\n then show ?case\n by (simp add: these_def)\nnext\n case (Cons a G)\n then show ?case\n apply simp\n apply (simp add: these_cons)\n apply (cases a)\n by auto\nqed\n\nlemma restricted_head: \"\\v. restricted_once v (Eq (V x2) (L x1) # G) \\ not_restricted v (Eq (V x2) (L x1) # G) \\\n not_restricted x2 G\"\n apply (erule_tac x=x2 in allE)\n by (simp add: restricted_once_def not_restricted_def)\n\nfun atomic :: \"'a gexp \\ bool\" where\n \"atomic (Eq (V _) (L _)) = True\" |\n \"atomic (In _ _) = True\" |\n \"atomic _ = False\"\n\nlemma restricted_max_once_cons: \"\\v. restricted_once v (g#gs) \\ not_restricted v (g#gs) \\\n \\v. restricted_once v gs \\ not_restricted v gs\"\n apply (simp add: restricted_once_def not_restricted_def)\n apply safe\n subgoal for v \n by (erule_tac x=v in allE)\n (metis (mono_tags, lifting) list.distinct(1) list.inject singleton_list)\n done\n\nlemma not_restricted_swap_inputs:\n \"not_restricted (I x1a) G \\\n apply_guards G (join_ir i r) \\\n apply_guards G (join_ir (i[x1a := x1]) r)\"\nproof(induct G)\n case (Cons a G)\n then show ?case\n apply (simp add: apply_guards_cons not_restricted_cons)\n using input_not_constrained_gval_swap_inputs by auto\nqed auto\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/heuristics/Least_Upper_Bound.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25392142869728274}} {"text": "theory GallopA\n imports \"Simpl/Vcg\" Main \"~~/src/HOL/Library/Code_Target_Numeral\" \"TimSortLemma\" \"TimSortProc\"\nbegin\n\n\n\nlemma (in gallop_left_impl) gallop_left_modifies:\n shows\n \"\\ \\. \\\\ {\\} \\ret:== PROC gallop_left(\\key, \\array, \\base, \\len, \\hint)\n {t. t may_only_modify_globals \\ in []}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in gallop_right_impl) gallop_right_modifies:\n shows\n \"\\ \\. \\\\ {\\} \\ret:== PROC gallop_right(\\key, \\array, \\base, \\len, \\hint)\n {t. t may_only_modify_globals \\ in []}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in merge_lo_impl) merge_lo_modifies:\n shows\n \"\\ \\. \\\\ {\\} PROC merge_lo(\\base1, \\len1, \\base2, \\len2)\n {t. t may_only_modify_globals \\ in [a]}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in merge_hi_impl) merge_hi_modifies:\n shows\n \"\\ \\. \\\\ {\\} PROC merge_hi(\\base1, \\len1, \\base2, \\len2)\n {t. t may_only_modify_globals \\ in [a]}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in gallop_left_impl) gallop_left_spec:\n shows\n \"\\\\. \\\\ \\ \\. \\array\\[] \\ \\base\\0 \\ \\len>0 \\ \\hint<\\len \\ \\base+\\len\\length \\array\\\n \\ret :== PROC gallop_left(\\key, \\array, \\base, \\len, \\hint)\n \\ \\ret \\0 \\ \\ret \\\\len \\ \\len = \\<^bsup>\\\\<^esup>len\\\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (hoare_rule anno=\"\n \\last_ofs :== 0;; \\ofs :== 1;;\n IF \\array ! (\\base + \\hint) < \\key\n THEN \\max_ofs :== \\len - \\hint;;\n WHILE \\ofs < \\max_ofs \\ \\array ! (\\base + \\hint + \\ofs) < \\key \n INV \\ \\ofs>0 \\ \\last_ofs\\0 \\ \\last_ofs<\\ofs \\ \\last_ofs<\\max_ofs \\\n \\base = \\<^bsup>\\\\<^esup>base \\ \\len = \\<^bsup>\\\\<^esup>len \\ \\hint = \\<^bsup>\\\\<^esup>hint \\ \\hint<\\len \\\n \\max_ofs = \\len-\\hint \\\n DO \\last_ofs :== \\ofs;; \\ofs :== \\ofs + \\ofs + 1 OD;;\n IF \\max_ofs < \\ofs THEN \\ofs :== \\max_ofs FI;; \\last_ofs :== \\last_ofs + \\hint + 1;; \\ofs :== \\ofs + \\hint\n ELSE \\max_ofs :== \\hint + 1;;\n WHILE \\ofs < \\max_ofs \\ \\key \\ \\array ! (\\base + \\hint - \\ofs) \n INV \\ \\ofs>0 \\ \\last_ofs\\0 \\ \\last_ofs<\\ofs \\ \\last_ofs<\\max_ofs \\\n \\base = \\<^bsup>\\\\<^esup>base \\ \\len = \\<^bsup>\\\\<^esup>len \\ \\hint = \\<^bsup>\\\\<^esup>hint \\ \\hint<\\len \\\n DO \\last_ofs :== \\ofs;; \\ofs :== \\ofs + \\ofs + 1 OD;;\n IF \\max_ofs < \\ofs THEN \\ofs :== \\max_ofs FI;; \\tmp_gallop :== \\last_ofs;; \\last_ofs :== \\hint + 1 - \\ofs;;\n \\ofs :== \\hint - \\tmp_gallop\n FI;;\n WHILE \\last_ofs < \\ofs \n INV \\ \\last_ofs\\0 \\ \\last_ofs\\\\ofs \\ \\ofs\\\\len \\\n \\last_ofs \\ (\\ofs+\\last_ofs)div 2 \\ \\ofs \\ (\\ofs+\\last_ofs)div 2 \\\n \\len = \\<^bsup>\\\\<^esup>len \\ \\base = \\<^bsup>\\\\<^esup>base \\\n DO \\mid :== (\\ofs + \\last_ofs) div 2;; IF \\array ! (\\base + \\mid) < \\key THEN \\last_ofs :== \\mid + 1 ELSE \\ofs :== \\mid FI OD;;\n \\ret :== \\ofs\n \" in HoarePartial.annotateI)\n apply vcg\n by auto \n \n\nlemma (in gallop_right_impl) gallop_right_spec:\n shows\n \"\\\\. \\\\ \\ \\. \\array\\[] \\ \\base\\0 \\ \\len>0 \\ \\hint<\\len \\ \\base+\\len\\length \\array\\\n \\ret :== PROC gallop_right(\\key, \\array, \\base, \\len, \\hint)\n \\ \\ret \\0 \\ \\ret \\\\len \\ \\len = \\<^bsup>\\\\<^esup>len\\\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (hoare_rule anno=\"\n \\last_ofs :== 0;; \\ofs :== 1;;\n IF \\key < \\array ! (\\base + \\hint)\n THEN \\max_ofs :== \\hint + 1;;\n WHILE \\ofs < \\max_ofs \\ \\key < \\array ! (\\base + \\hint - \\ofs)\n INV \\ \\ofs>0 \\ \\last_ofs\\0 \\ \\last_ofs<\\ofs \\ \\last_ofs<\\max_ofs \\\n \\base = \\<^bsup>\\\\<^esup>base \\ \\len = \\<^bsup>\\\\<^esup>len \\ \\hint = \\<^bsup>\\\\<^esup>hint \\ \\hint<\\len\n \\ \n DO \\last_ofs :== \\ofs;; \\ofs :== \\ofs + \\ofs + 1 OD;;\n IF \\max_ofs < \\ofs THEN \\ofs :== \\max_ofs FI;;\n \\tmp_gallop :== \\last_ofs;; \\last_ofs :== \\hint + 1 - \\ofs;;\n \\ofs :== \\hint - \\tmp_gallop\n ELSE \\max_ofs :== \\len - \\hint;;\n WHILE \\ofs < \\max_ofs \\ \\array ! (\\base + \\hint + \\ofs) \\ \\key\n INV \\ \\ofs>0 \\ \\last_ofs\\0 \\ \\last_ofs<\\ofs \\ \\last_ofs<\\max_ofs \\\n \\base = \\<^bsup>\\\\<^esup>base \\ \\len = \\<^bsup>\\\\<^esup>len \\ \\hint = \\<^bsup>\\\\<^esup>hint \\ \\hint<\\len \\\n \\max_ofs = \\len-\\hint \\ \n DO \\last_ofs :== \\ofs;; \\ofs :== \\ofs + \\ofs + 1 OD;;\n IF \\max_ofs < \\ofs THEN \\ofs :== \\max_ofs FI;;\n \\last_ofs :== \\last_ofs + \\hint + 1;; \\ofs :== \\ofs + \\hint\n FI;;\n WHILE \\last_ofs < \\ofs \n INV \\ \\last_ofs\\0 \\ \\last_ofs\\\\ofs \\ \\ofs\\\\len \\\n \\last_ofs \\ (\\ofs+\\last_ofs)div 2 \\ \\ofs \\ (\\ofs+\\last_ofs)div 2 \\\n \\len = \\<^bsup>\\\\<^esup>len \\ \\base = \\<^bsup>\\\\<^esup>base \\\n DO \\mid :== (\\ofs + \\last_ofs) div 2;;\n IF \\key < \\array ! (\\base + \\mid) THEN \\ofs :== \\mid\n ELSE \\last_ofs :== \\mid+1 FI \n OD;;\n \\ret :== \\ofs\n \" in HoarePartial.annotateI)\n apply vcg\n by auto \n\n\n\n lemma (in merge_lo_impl) merge_lo_spec:\n shows\n \"\\\\. \\\\ \\ \\. \\base1\\0 \\ \\len1>0 \\ \\len2>0 \\ \\len1\\\\len2 \\ \n (\\base1+\\len1 = \\base2) \\ (\\base2+\\len2 \\ length \\a)\\\n PROC merge_lo(\\base1, \\len1, \\base2, \\len2)\n \\length \\a = length \\<^bsup>\\\\<^esup>a\\\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (hoare_rule anno=\"\n TRY\n \\tmp :== replicate \\len1 (0::int);;\n \\tmp :== list_copy \\tmp (0::nat) \\a \\base1 \\len1;;\n \\cursor1 :== 0;;\n \\cursor2 :==\\base2;;\n \\dest :== \\base1;;\n \\a!\\dest :== \\a!\\cursor2;;\n \\dest :== \\dest+1;;\n \\cursor2 :== \\cursor2+1;;\n \\len2 :== \\len2-1;;\n \\min_gallop :== \\global_min_gallop;;(* need to add min gallop to globals var *)\n IF \\len2=0 THEN \\a :== list_copy \\a \\dest \\tmp \\cursor1 \\len1;; THROW FI;;\n IF \\len1=1 THEN \\a :== list_copy \\a \\dest \\a \\cursor2 \\len2;; \\a!(\\dest+\\len2):== \\tmp!\\cursor1;;THROW FI;;\n TRY\n WHILE True \n INV \\ \\cursor1\\0 \\ \\cursor2\\\\base2 \\\n \\len1>1 \\ \\len2>0 \\\n \\cursor1+\\len1 = \\<^bsup>\\\\<^esup>len1 \\\n \\cursor2+\\len2 = \\base2+\\<^bsup>\\\\<^esup>len2 \\\n \\dest+\\len1 = \\cursor2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len1 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n DO\n \\count1 :== 0;;\n \\count2 :== 0;;\n WHILE (\\count1 < \\min_gallop & \\count2 < \\min_gallop)\n INV \\ \\cursor1\\0 \\ \\cursor2\\\\base2 \\\n \\len1>1 \\ \\len2>0 \\\n \\cursor1+\\len1 = \\<^bsup>\\\\<^esup>len1 \\\n \\cursor2+\\len2 = \\base2+\\<^bsup>\\\\<^esup>len2 \\\n \\dest+\\len1 = \\cursor2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len1 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n DO\n IF \\a!\\cursor2 < \\tmp!\\cursor1\n THEN\n \\a!\\dest :== \\a!\\cursor2;;\n \\dest :== \\dest+1;;\n \\cursor2 :== \\cursor2+1;;\n \\count2 :== \\count2+1;;\n \\count1 :== 0;;\n \\len2 :== \\len2-1;;\n IF \\len2 = 0 THEN THROW FI\n ELSE\n \\a!\\dest :== \\tmp!\\cursor1;;\n \\dest :== \\dest+1;;\n \\cursor1 :== \\cursor1+1;;\n \\count1 :== \\count1+1;;\n \\count2 :== 0;;\n \\len1 :== \\len1-1;;\n IF \\len1 = 1 THEN THROW FI\n FI\n OD;;\n WHILE (\\count1 \\ \\global_min_gallop | \\count2 \\ \\global_min_gallop)\n INV \\ \\cursor1\\0 \\ \\cursor2\\\\base2 \\\n \\len1>1 \\ \\len2>0 \\\n \\cursor1+\\len1 = \\<^bsup>\\\\<^esup>len1 \\\n \\cursor2+\\len2 = \\base2+\\<^bsup>\\\\<^esup>len2 \\\n \\dest+\\len1 = \\cursor2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len1 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n DO\n \\count1 :== CALL gallop_right(\\a!\\cursor2, \\tmp, \\cursor1, \\len1, 0);;\n IF \\count1 \\ 0\n THEN\n \\a :== list_copy \\a \\dest \\tmp \\cursor1 \\count1;;\n \\dest :== \\dest+\\count1;;\n \\cursor1 :== \\cursor1+\\count1;;\n \\len1 :== \\len1-\\count1;;\n IF \\len1\\1 THEN THROW FI\n FI;;\n \\a!\\dest :== \\a!\\cursor2;;\n \\dest :== \\dest+1;;\n \\cursor2 :== \\cursor2+1;;\n \\len2 :== \\len2-1;;\n IF \\len2 = 0 THEN THROW FI;;\n\n \\count2 :== CALL gallop_left(\\tmp!\\cursor1, \\a, \\cursor2, \\len2, 0);;\n IF \\count2 \\ 0\n THEN\n \\a :== list_copy \\a \\dest \\a \\cursor2 \\count2;;\n \\dest :== \\dest+\\count2;;\n \\cursor2 :== \\cursor2+\\count2;;\n \\len2 :== \\len2-\\count2;;\n IF \\len2 = 0 THEN THROW FI\n FI;;\n \\a!\\dest :== \\tmp!\\cursor1;;\n \\dest :== \\dest+1;;\n \\cursor1 :== \\cursor1+1;;\n \\len1 :== \\len1-1;;\n IF \\len1 = 1 THEN THROW FI;;\n \\min_gallop :== \\min_gallop-1\n OD;;\n IF \\min_gallop < 0 THEN \\min_gallop :== 0 FI;;\n \\min_gallop :== \\min_gallop + 2\n OD\n CATCH\n Skip\n END;;\n IF \\len1 = 1\n THEN \\a :== list_copy \\a \\dest \\a \\cursor2 \\len2;;\\a!(\\dest+\\len2) :== \\tmp!\\cursor1\n ELSE IF \\len1 = 0\n THEN Skip\n ELSE \\a :== list_copy \\a \\dest \\tmp \\cursor1 \\len1 \n FI\n FI\nCATCH\nSkip\nEND\" in HoarePartial.annotateI)\n apply vcg\n apply (simp_all add:Suc_lessI)\n apply (auto simp add:list_copy_def)\ndone \n\n\n\n\nlemma (in merge_hi_impl) merge_hi_spec:\n shows\n \"\\\\. \\\\ \\ \\. \\base1\\0 \\ \\len1>0 \\ \\len2>0 \\ \\len1\\\\len2 \\ \n (\\base1+\\len1 = \\base2) \\ (\\base2+\\len2 \\ length \\a)\\\n PROC merge_hi(\\base1, \\len1, \\base2, \\len2)\n \\length \\a = length \\<^bsup>\\\\<^esup>a \\\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (hoare_rule anno=\"\n TRY\n \\tmp :== replicate \\len2 (0::int);;\n \\tmp :== list_copy \\tmp (0::nat) \\a \\base2 \\len2;;\n \\cursor1 :== \\base1+\\len1-1;;\n \\cursor2 :==\\len2-1;;\n \\dest :== \\base2+\\len2-1;;\n \\a!\\dest :== \\a!\\cursor1;;\n \\dest :== \\dest-1;;\n \\cursor1 :== \\cursor1-1;;\n \\len1 :== \\len1-1;;\n \\min_gallop :== \\global_min_gallop;;(* need to add min gallop to globals var *)\n IF \\len1=0 THEN \\a :== list_copy \\a (\\dest-(\\len2-1)) \\tmp 0 \\len2;; THROW FI;;\n IF \\len2=1 \n THEN \n \\dest :== \\dest-\\len1;;\n \\cursor1 :== \\cursor1-\\len1;;\n \\a :== list_copy \\a (\\dest+1) \\a (\\cursor1+1) \\len1;; \n \\a!\\dest:== \\tmp!\\cursor2;;\n THROW \n FI;;\n TRY\n WHILE True \n INV \\ \\len1>0 \\ \\len1<\\<^bsup>\\\\<^esup>len1 \\\n \\len2>1 \\ \\len2\\\\<^bsup>\\\\<^esup>len2 \\\n \\cursor1+1=\\base1+\\len1 \\\n \\cursor2+1=\\len2 \\\n \\dest=\\cursor1+\\len2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len2 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n (\\<^bsup>\\\\<^esup>base1+\\<^bsup>\\\\<^esup>len1 = \\<^bsup>\\\\<^esup>base2) \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a)\\\n DO\n \\count1 :== 0;;\n \\count2 :== 0;;\n WHILE (\\count1 < \\min_gallop & \\count2 < \\min_gallop)\n INV \\ \\len1>0 \\ \\len1<\\<^bsup>\\\\<^esup>len1 \\\n \\len2>1 \\ \\len2\\\\<^bsup>\\\\<^esup>len2 \\\n \\cursor1+1=\\base1+\\len1 \\\n \\cursor2+1=\\len2 \\\n \\dest=\\cursor1+\\len2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len2 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n (\\<^bsup>\\\\<^esup>base1+\\<^bsup>\\\\<^esup>len1 = \\<^bsup>\\\\<^esup>base2)\\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n DO\n IF \\tmp!\\cursor2 < \\a!\\cursor1\n THEN\n \\a!\\dest :== \\a!\\cursor1;;\n \\dest :== \\dest-1;;\n \\cursor1 :== \\cursor1-1;;\n \\count1 :== \\count1+1;;\n \\count2 :== 0;;\n \\len1 :== \\len1-1;;\n IF \\len1 = 0 THEN THROW FI\n ELSE\n \\a!\\dest :== \\tmp!\\cursor2;;\n \\dest :== \\dest-1;;\n \\cursor2 :== \\cursor2-1;;\n \\count2 :== \\count2+1;;\n \\count1 :== 0;;\n \\len2 :== \\len2-1;;\n IF \\len2 = 1 THEN THROW FI\n FI\n OD;;\n WHILE (\\count1 \\ \\global_min_gallop | \\count2 \\ \\global_min_gallop)\n INV \\ \\len1>0 \\ \\len1<\\<^bsup>\\\\<^esup>len1 \\\n \\len2>1 \\ \\len2\\\\<^bsup>\\\\<^esup>len2 \\\n \\cursor1+1=\\base1+\\len1 \\\n \\cursor2+1=\\len2 \\\n \\dest=\\cursor1+\\len2 \\\n \\base1 = \\<^bsup>\\\\<^esup>base1 \\\n \\base2 = \\<^bsup>\\\\<^esup>base2 \\\n length \\tmp = \\<^bsup>\\\\<^esup>len2 \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n (\\<^bsup>\\\\<^esup>base1+\\<^bsup>\\\\<^esup>len1 = \\<^bsup>\\\\<^esup>base2) \\\n length \\a = length \\<^bsup>\\\\<^esup>a \\\n (\\<^bsup>\\\\<^esup>base2+\\<^bsup>\\\\<^esup>len2 \\ length \\<^bsup>\\\\<^esup>a) \\\n DO\n \\count_tmp :== CALL gallop_right(\\tmp!\\cursor2, \\a, \\base1, \\len1, \\len1-1);;\n \\count1 :== \\len1 - \\count_tmp;;\n IF \\count1 \\ 0\n THEN\n \\dest :== \\dest-\\count1;;\n \\cursor1 :== \\cursor1-\\count1;;\n \\len1 :== \\len1-\\count1;;\n \\a :== list_copy \\a (\\dest+1) \\a (\\cursor1+1) \\count1;;\n IF \\len1=0 THEN THROW FI\n FI;;\n \\a!\\dest :== \\tmp!\\cursor2;;\n \\dest :== \\dest-1;;\n \\cursor2 :== \\cursor2-1;;\n \\len2 :== \\len2-1;;\n IF \\len2 = 1 THEN THROW FI;;\n\n \\count_tmp :== CALL gallop_left(\\a!\\cursor1, \\tmp, 0, \\len2, (\\len2-1));;\n \\count2 :== \\len2 - \\count_tmp;;\n IF \\count2 \\ 0\n THEN\n \\dest :== \\dest-\\count2;;\n \\cursor2 :== \\cursor2-\\count2;;\n \\len2 :== \\len2-\\count2;;\n \\a :== list_copy \\a (\\dest+1) \\tmp (\\cursor2+1) \\count2;;\n IF \\len2 \\ 1 THEN THROW FI\n FI;;\n \\a!\\dest :== \\a!\\cursor1;;\n \\dest :== \\dest-1;;\n \\cursor1 :== \\cursor1-1;;\n \\len1 :== \\len1-1;;\n IF \\len1 = 0 THEN THROW FI;;\n \\min_gallop :== \\min_gallop-1\n OD;;\n IF \\min_gallop < 0 THEN \\min_gallop :== 0 FI;;\n \\min_gallop :== \\min_gallop + 2\n OD\n CATCH\n Skip\n END;;\n IF \\len2 = 1\n THEN \n \\dest :== \\dest-\\len1;;\n \\cursor1 :== \\cursor1-\\len1;;\n \\a :== list_copy \\a (\\dest+1) \\a (\\cursor1+1) \\len1;;\n \\a!\\dest :== \\tmp!\\cursor2\n ELSE IF \\len2 = 0\n THEN Skip\n ELSE \\a :== list_copy \\a (\\dest-(\\len2-1)) \\tmp 0 \\len2 \n FI\n FI\nCATCH\nSkip\nEND\"\n in HoarePartial.annotateI) \n apply vcg \n apply (simp_all)\n apply (auto simp add:Suc_diff_Suc)\n done \n\n\nend", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/GallopA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.25392142869728274}} {"text": "theory Coinductive\n imports Main \"HOL-Library.BNF_Corec\" \"ext/ext_BigStepSimple\"\nbegin\n\ncodatatype 'a stream = SCons (shd: 'a) (stl: \"'a stream\")\n\ntype_synonym 'a strace = \"'a trace_block stream\"\n\ntype_synonym 'a stassn = \"'a strace \\ bool\"\n\nsubsection \\Combining two traces\\\n\ntext \\Whether two rdy_infos from different processes are compatible.\\\nfun compat_rdy :: \"rdy_info \\ rdy_info \\ bool\" where\n \"compat_rdy (r11, r12) (r21, r22) = (r11 \\ r22 = {} \\ r12 \\ r21 = {})\"\n\ntext \\Merge two rdy infos\\\nfun merge_rdy :: \"rdy_info \\ rdy_info \\ rdy_info\" where\n \"merge_rdy (r11, r12) (r21, r22) = (r11 \\ r21, r12 \\ r22)\"\n\nlemma WaitBlk_eq_combine:\n assumes \"WaitBlk d1 p1 rdy1 = WaitBlk d1' p1' rdy1'\"\n and \"WaitBlk d1 p2 rdy2 = WaitBlk d1' p2' rdy2'\"\n shows \"WaitBlk d1 (\\\\. ParState (p1 \\) (p2 \\)) (merge_rdy rdy1 rdy2) =\n WaitBlk d1' (\\\\. ParState (p1' \\) (p2' \\)) (merge_rdy rdy1' rdy2')\"\nproof -\n have a1: \"d1 = d1'\" \"rdy1 = rdy1'\" \"rdy2 = rdy2'\"\n using assms WaitBlk_cong by blast+\n have a2: \"\\t. 0 \\ t \\ t \\ d1 \\ p1 t = p1' t\"\n using assms(1) WaitBlk_cong2 by blast\n have a3: \"\\t. 0 \\ t \\ t \\ d1 \\ p2 t = p2' t\"\n using assms(2) WaitBlk_cong2 by blast\n show ?thesis\n proof (cases d1)\n case (real r)\n have b: \"d1' = ereal r\"\n using real a1(1) by auto\n show ?thesis\n unfolding real b apply (auto simp add: WaitBlk_simps)\n apply (rule ext) apply auto\n subgoal for x apply (rule a2) by (auto simp add: real)\n subgoal for x apply (rule a3) by (auto simp add: real)\n using a1 by auto\n next\n case PInf\n have b: \"d1' = \\\"\n using PInf a1 by auto\n show ?thesis\n unfolding PInf b infinity_ereal_def\n apply (auto simp: WaitBlk_simps)\n apply (rule ext) apply auto\n subgoal for x apply (rule a2) by (auto simp add: PInf)\n subgoal for x apply (rule a3) by (auto simp add: PInf)\n using a1 by auto\n next\n case MInf\n have b: \"d1' = - \\\"\n using MInf a1 by auto\n show ?thesis\n unfolding MInf b\n by (auto simp: a1 WaitBlk_simps)\n qed\nqed\n\ncoinductive combine_blocks :: \"cname set \\ 'a strace \\ 'a strace \\ 'a strace \\ bool\" where\n \\ \\Paired communication\\\n combine_blocks_pair1:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (SCons (InBlock ch v) blks1) (SCons (OutBlock ch v) blks2)\n (SCons (IOBlock ch v) blks)\"\n| combine_blocks_pair2:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (SCons (OutBlock ch v) blks1) (SCons (InBlock ch v) blks2)\n (SCons (IOBlock ch v) blks)\"\n\n \\ \\Paired communication\\\n| combine_blocks_unpair1:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (SCons (CommBlock ch_type ch v) blks1) blks2\n (SCons (CommBlock ch_type ch v) blks)\"\n| combine_blocks_unpair2:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms blks1 (SCons (CommBlock ch_type ch v) blks2)\n (SCons (CommBlock ch_type ch v) blks)\"\n\n \\ \\Wait\\\n| combine_blocks_wait:\n \"combine_blocks comms blks1 blks2 blks \\\n compat_rdy rdy1 rdy2 \\\n hist = (\\\\. ParState ((\\x::real. hist1 x) \\) ((\\x::real. hist2 x) \\)) \\\n rdy = merge_rdy rdy1 rdy2 \\\n combine_blocks comms (SCons (WaitBlk t (\\x::real. hist1 x) rdy1) blks1)\n (SCons (WaitBlk t (\\x::real. hist2 x) rdy2) blks2)\n (SCons (WaitBlk t hist rdy) blks)\"\n\nlemma combine_blocks_waitE:\n \"combine_blocks comms (SCons (WaitBlk d1 p1 rdy1) blks1)\n (SCons (WaitBlk d2 p2 rdy2) blks2) blks \\\n (\\blks'. d1 = d2 \\\n compat_rdy rdy1 rdy2 \\\n blks = SCons (WaitBlk d1 (\\t. ParState (p1 t) (p2 t))\n (merge_rdy rdy1 rdy2)) blks' \\\n combine_blocks comms blks1 blks2 blks' \\ P) \\ P\"\nproof (induction rule: combine_blocks.cases)\n case (combine_blocks_wait comms' blks1' blks2' blks' rdy1' rdy2' hist hist1 hist2 rdy t)\n have a1: \"blks1 = blks1'\" \"blks2 = blks2'\"\n \"WaitBlk d1 p1 rdy1 = WaitBlk t hist1 rdy1'\"\n \"WaitBlk d2 p2 rdy2 = WaitBlk t hist2 rdy2'\"\n using combine_blocks_wait(2,3) by auto\n have a2: \"d1 = d2\" \"rdy1 = rdy1'\" \"rdy2 = rdy2'\" \"d1 = t\" \"d2 = t\"\n using WaitBlk_cong a1(3,4) by blast+\n have a3: \"WaitBlk d1 p2 rdy2 = WaitBlk t hist2 rdy2'\"\n using a2 a1(4) by auto\n have a4: \"WaitBlk d1 (\\\\. ParState (p1 \\) (p2 \\)) (merge_rdy rdy1 rdy2) =\n WaitBlk t (\\\\. ParState (hist1 \\) (hist2 \\)) (merge_rdy rdy1' rdy2')\"\n using WaitBlk_eq_combine[OF a1(3) a3] by auto\n show ?case\n using combine_blocks_wait a1 a2 a4 by auto\nqed (auto)\n\nlemma combine_blocks_waitCommE:\n assumes \"ch \\ comms\"\n shows\n \"combine_blocks comms (SCons (WaitBlk d1 p1 rdy1) blks1)\n (SCons (CommBlock ch_type ch v) blks2) blks \\ P\"\n apply (induction rule: combine_blocks.cases)\n using assms by auto\n\nlemma combine_blocks_waitCommE':\n assumes \"ch \\ comms\"\n shows\n \"combine_blocks comms (SCons (CommBlock ch_type ch v) blks1) \n (SCons (WaitBlk d1 p1 rdy1) blks2) blks \\ P\"\n apply (induction rule: combine_blocks.cases)\n using assms by auto\n\nlemma combine_blocks_waitCommE2:\n assumes \"ch \\ comms\"\n shows\n \"combine_blocks comms (SCons (WaitBlk d1 p1 rdy1) blks1)\n (SCons (CommBlock ch_type ch v) blks2) blks \\\n (\\blks'. blks = SCons (CommBlock ch_type ch v) blks' \\\n combine_blocks comms (SCons (WaitBlk d1 p1 rdy1) blks1) blks2 blks' \\ P) \\ P\"\nproof (induction rule: combine_blocks.cases)\n case (combine_blocks_unpair2 ch' comms' blks1' blks2' blks' ch_type' v')\n have a1: \"blks2 = blks2'\" \"CommBlock ch_type ch v = CommBlock ch_type' ch' v'\"\n using combine_blocks_unpair2(3) by auto\n have a2: \"ch_type = ch_type'\" \"ch = ch'\" \"v = v'\"\n using a1 by auto\n show ?case\n using combine_blocks_unpair2 a1 a2 by auto\nqed (auto simp: assms)\n\nlemma combine_blocks_waitCommE2':\n assumes \"ch \\ comms\"\n shows\n \"combine_blocks comms (SCons (CommBlock ch_type ch v) blks1)\n (SCons (WaitBlk d1 p1 rdy1) blks2) blks \\\n (\\blks'. blks = SCons (CommBlock ch_type ch v) blks' \\\n combine_blocks comms blks1 (SCons (WaitBlk d1 p1 rdy1) blks2) blks' \\ P) \\ P\"\nproof (induction rule: combine_blocks.cases)\n case (combine_blocks_unpair2 ch' comms' blks1' blks2' blks' ch_type' v')\n have a1: \"blks2 = blks2'\" \"CommBlock ch_type ch v = CommBlock ch_type' ch' v'\"\n using combine_blocks_unpair2(3) by auto\n have a2: \"ch_type = ch_type'\" \"ch = ch'\" \"v = v'\"\n using a1 by auto\n show ?case\n using combine_blocks_unpair2 a1 a2 by auto\nqed (auto simp: assms)\n\nlemma combine_blocks_pairE:\n assumes \"ch1 \\ comms\"\n and \"ch2 \\ comms\"\n shows \"combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) (SCons (CommBlock ch_type2 ch2 v2) blks2) blks \\\n (\\blks'. ch1 = ch2 \\ v1 = v2 \\ (ch_type1 = In \\ ch_type2 = Out \\ ch_type1 = Out \\ ch_type2 = In) \\\n blks = SCons (IOBlock ch1 v1) blks' \\ combine_blocks comms blks1 blks2 blks' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto simp:assms)\n\nlemma combine_blocks_unpairE1:\n assumes \"ch1 \\ comms \"\n and \"ch2 \\ comms \"\n shows \"combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) (SCons (CommBlock ch_type2 ch2 v2) blks2) blks \\\n (\\blks'. blks = SCons (CommBlock ch_type1 ch1 v1) blks' \\\n combine_blocks comms blks1 (SCons (CommBlock ch_type2 ch2 v2) blks2) blks' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto simp:assms)\n\nlemma combine_blocks_unpairE1':\n assumes \"ch1 \\ comms\" \n and \"ch2 \\ comms\"\nshows \"combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) (SCons (CommBlock ch_type2 ch2 v2) blks2) blks \\\n (\\blks'. blks = SCons (CommBlock ch_type2 ch2 v2) blks' \\\n combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) blks2 blks' \\ P) \\ P\"\n apply (induct rule: combine_blocks.cases)\n using assms by auto\n\nlemma combine_blocks_unpairE2:\n assumes \"ch1 \\ comms\" \n and \" ch2 \\ comms\"\n shows \"combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) (SCons (CommBlock ch_type2 ch2 v2 ) blks2) blks \\\n (\\blks'. blks = SCons (CommBlock ch_type1 ch1 v1) blks' \\\n combine_blocks comms blks1 (SCons (CommBlock ch_type2 ch2 v2) blks2) blks' \\ P) \\\n (\\blks'. blks = SCons (CommBlock ch_type2 ch2 v2) blks' \\\n combine_blocks comms (SCons (CommBlock ch_type1 ch1 v1) blks1) blks2 blks' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto simp add:assms)\n\ntype_synonym tid = real\n\ndatatype status =\n WAIT | READY | RUNNING\n\n\ndatatype estate =\n Sch (pool:\"(real \\ tid) list\") (run_now:tid) (run_prior:real)\n| Task (status:status) (entered:nat) (task_prior:real)\n| None\n\n\nfun sched_push :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_push t (Sch p rn rp) s = Sch (p @ [(s (CHR ''p''), t)]) rn rp\"\n| \"sched_push t (Task st ent tp) s = undefined\"\n| \"sched_push t None s = undefined\"\n\nfun sched_assign :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_assign t (Sch p rn rp) s = Sch p t (s (CHR ''p''))\"\n| \"sched_assign t (Task st ent tp) s = undefined\"\n| \"sched_assign t None s = undefined\"\n\nfun get_max_default :: \"real \\ tid \\ (real \\ tid) list \\ real \\ tid\" where\n \"get_max_default (prior, t) [] = (prior, t)\"\n| \"get_max_default (prior, t) ((prior2, t2) # rest) =\n (if prior \\ prior2 then\n get_max_default (prior, t) rest\n else\n get_max_default (prior2, t2) rest)\"\n\nfun get_max :: \"(real \\ tid) list \\ real \\ tid\" where\n \"get_max [] = (-1, -1)\"\n| \"get_max ((prior, t) # rest) = get_max_default (prior, t) rest\"\n\nfun del_proc :: \"(real \\ tid) list \\ tid \\ (real \\ tid) list\" where\n \"del_proc [] t = []\"\n| \"del_proc ((prior, t) # rest) t2 =\n (if t = t2 then rest\n else (prior, t) # del_proc rest t)\"\n\nfun sched_get_max :: \"estate \\ state \\ estate\" where\n \"sched_get_max (Sch p rn rp) s =\n (let (prior, t) = get_max p in Sch (del_proc p t) t prior)\"\n| \"sched_get_max (Task st ent tp) s = undefined\"\n| \"sched_get_max None s = undefined\"\n\nfun sched_clear :: \"estate \\ state \\ estate\" where\n \"sched_clear (Sch p rn rp) s = Sch [] (-1) (-1)\"\n| \"sched_clear (Task st ent tp) s = undefined\"\n| \"sched_clear None s = undefined\"\n\nfun sched_del_proc :: \"tid \\ estate \\ state \\ estate\" where\n \"sched_del_proc t (Sch p rn rp) s = Sch (del_proc p t) rn rp\"\n| \"sched_del_proc t (Task st ent tp) s = undefined\"\n| \"sched_del_proc t None s = undefined\"\n\ndefinition req_ch :: \"tid \\ string\" where\n \"req_ch tid = (\n if tid = 1 then ''reqProcessor1''\n else if tid = 2 then ''reqProcessor2''\n else if tid = 3 then ''reqProcessor3''\n else undefined)\"\n\ndefinition preempt_ch :: \"tid \\ string\" where\n \"preempt_ch tid = (\n if tid = 1 then ''preempt1''\n else if tid = 2 then ''preempt2''\n else if tid = 3 then ''preempt3''\n else undefined)\"\n\ndefinition run_ch :: \"tid \\ string\" where\n \"run_ch tid = (\n if tid = 1 then ''run1''\n else if tid = 2 then ''run2''\n else if tid = 3 then ''run3''\n else undefined)\"\n\ndefinition free_ch :: \"tid \\ string\" where\n \"free_ch tid = (\n if tid = 1 then ''free1''\n else if tid = 2 then ''free2''\n else if tid = 3 then ''free3''\n else undefined)\"\n\ndefinition exit_ch :: \"tid \\ string\" where\n \"exit_ch tid = (\n if tid = 1 then ''exit1''\n else if tid = 2 then ''exit2''\n else if tid = 3 then ''exit3''\n else undefined)\"\n\ndefinition dispatch_ch :: \"tid \\ string\" where\n \"dispatch_ch tid = (\n if tid = 1 then ''dis1''\n else if tid = 2 then ''dis2''\n else if tid = 3 then ''dis3''\n else undefined)\"\n\ncoinductive dispatch_assn :: \"tid \\ state \\ estate stassn\" where\n \"init_t' = start_s (CHR ''t'') \\\n init_t' < 0.045 \\\n wt \\ 0.045 - init_t' \\\n blk1 = WaitBlk (ereal wt) (\\t. EState (None, start_s(CHR ''t'' := init_t' + t))) ({}, {}) \\\n dispatch_assn i (start_s(CHR ''t'' := init_t' + wt)) rest \\\n dispatch_assn i start_s (SCons blk1 rest)\"\n| \"init_t' = start_s (CHR ''t'') \\\n init_t' = 0.045 \\\n blk1 = OutBlock (dispatch_ch i) 0 \\\n dispatch_assn i (start_s(CHR ''t'' := 0)) rest \\\n dispatch_assn i start_s (SCons blk1 rest)\"\nthm dispatch_assn.coinduct\nthm dispatch_assn.cases\n\ncoinductive task_assn :: \"tid \\ string \\ estate \\ state \\ estate stassn\" where\n \"start_es = Task WAIT ent tp \\\n wt > 0 \\\n blk1 = WaitBlk (ereal wt) (\\_. EState (start_es, start_s)) ({}, {dispatch_ch i}) \\\n task_assn i ''p1'' start_es start_s rest \\\n task_assn i ''p1'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task WAIT ent tp \\\n blk1 = InBlock (dispatch_ch i) 0 \\\n task_assn i ''p2'' (Task READY 0 tp) (start_s(CHR ''t'' := 0)) rest \\\n task_assn i ''p1'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n blk1 = OutBlock (req_ch i) tp \\\n task_assn i ''p3'' start_es start_s rest \\\n task_assn i ''p2'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n init_t = start_s (CHR ''t'') \\\n init_t < 0.045 \\\n wt \\ 0.045 - init_t \\\n blk1 = WaitBlk (ereal wt) (\\t. EState (start_es, start_s(CHR ''t'' := init_t + t))) ({}, {run_ch i}) \\\n task_assn i ''p3'' start_es (start_s(CHR ''t'' := init_t + wt)) rest \\\n task_assn i ''p3'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n init_t = start_s (CHR ''t'') \\\n init_t = 0.045 \\\n blk1 = OutBlock (exit_ch i) 0 \\\n task_assn i ''p1'' start_es start_s rest \\\n task_assn i ''p3'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task READY 0 tp \\\n blk1 = InBlock (run_ch i) 0 \\\n task_assn i ''p4'' (Task RUNNING 1 tp) (start_s(CHR ''c'' := 0)) rest \\\n task_assn i ''p3'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task READY 1 tp \\\n blk1 = InBlock (run_ch i) 0 \\\n task_assn i ''p4'' (Task RUNNING 1 tp) start_s rest \\\n task_assn i ''p3'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = start_s (CHR ''t'') \\\n init_c = start_s (CHR ''c'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.01 - init_c \\\n wt > 0 \\\n blk1 = WaitBlk (ereal wt)\n (\\t. EState (start_es, start_s(CHR ''t'' := init_t + t,\n CHR ''c'' := init_c + t))) ({}, {preempt_ch i}) \\\n task_assn i ''p4'' start_es (start_s(CHR ''t'' := init_t + wt,\n CHR ''c'' := init_c + wt)) rest \\\n task_assn i ''p4'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n blk1 = InBlock (preempt_ch i) 0 \\\n task_assn i ''p2'' (Task READY 1 tp) start_s rest \\\n task_assn i ''p4'' start_es start_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = start_s (CHR ''t'') \\\n init_c = start_s (CHR ''c'') \\\n init_c = 0.01 \\ init_t = 0.045 \\\n blk1 = OutBlock (free_ch i) 0 \\\n task_assn i ''p1'' (Task READY 1 tp) start_s rest \\\n task_assn i ''p4'' start_es start_s (SCons blk1 rest)\"\n\ncoinductive task_dis_assn :: \"tid \\ string \\ state \\ estate \\ state \\ estate stassn\" where\n \"start_es = Task WAIT ent tp \\\n init_t' = dis_s (CHR ''t'') \\\n init_t' < 0.045 \\\n wt \\ 0.045 - init_t' \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState\n (EState (None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s))) ({}, {dispatch_ch i}) \\\n task_dis_assn i ''p1'' (dis_s(CHR ''t'' := init_t' + wt)) start_es task_s rest \\\n task_dis_assn i ''p1'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task WAIT ent tp \\\n init_t' = dis_s (CHR ''t'') \\\n init_t' = 0.045 \\\n blk1 = IOBlock (dispatch_ch i) 0 \\\n task_dis_assn i ''p2'' (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0)) rest \\\n task_dis_assn i ''p1'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n blk1 = OutBlock (req_ch i) tp \\\n task_dis_assn i ''p3'' dis start_es task_s rest \\\n task_dis_assn i ''p2'' dis start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n init_t = task_s (CHR ''t'') \\\n init_t' = dis_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.045 - init_t' \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState\n (EState (None, dis_t(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t + t)))) ({}, {run_ch i}) \\\n task_dis_assn i ''p3'' (dis_s(CHR ''t'' := init_t' + wt))\n start_es (task_s(CHR ''t'' := init_t + wt)) rest \\\n task_dis_assn i ''p3'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task READY ent tp \\\n init_t = task_s (CHR ''t'') \\\n init_t = 0.045 \\\n blk1 = OutBlock (exit_ch i) 0 \\\n task_dis_assn i ''p1'' dis_s start_es task_s rest \\\n task_dis_assn i ''p3'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task READY 0 tp \\\n blk1 = InBlock (run_ch i) 0 \\\n task_dis_assn i ''p4'' dis_s (Task RUNNING 1 tp) (task_s(CHR ''c'' := 0)) rest \\\n task_dis_assn i ''p3'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task READY 1 tp \\\n blk1 = InBlock (run_ch i) 0 \\\n task_dis_assn i ''p4'' dis_s (Task RUNNING 1 tp) task_s rest \\\n task_dis_assn i ''p3'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n init_t' = dis_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.01 - init_c \\\n wt \\ 0.045 - init_t' \\\n wt > 0 \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState\n (EState (None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t))))\n ({}, {preempt_ch i}) \\\n task_dis_assn i ''p4'' (dis_s(CHR ''t'' := init_t' + wt)) start_es (task_s(CHR ''t'' := init_t + wt,\n CHR ''c'' := init_c + wt)) rest \\\n task_dis_assn i ''p4'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n blk1 = InBlock (preempt_ch i) 0 \\\n task_dis_assn i ''p2'' dis_s (Task READY 1 tp) task_s rest \\\n task_dis_assn i ''p4'' dis_s start_es task_s (SCons blk1 rest)\"\n| \"start_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n init_c = 0.01 \\ init_t = 0.045 \\\n blk1 = OutBlock (free_ch i) 0 \\\n task_dis_assn i ''p1'' dis_s (Task READY 1 tp) task_s rest \\\n task_dis_assn i ''p4'' dis_s start_es task_s (SCons blk1 rest)\"\nthm task_dis_assn.coinduct\n\ntheorem combine_task_dis:\n assumes \"i \\ {1,2,3}\"\n shows\n \"dispatch_assn i dis_s blks1 \\\n task_assn i pc start_es task_s blks2 \\\n combine_blocks {dispatch_ch i} blks1 blks2 blks \\\n task_dis_assn i pc dis_s start_es task_s blks\"\nproof (coinduction arbitrary: pc dis_s start_es task_s blks1 blks2 blks rule: task_dis_assn.coinduct)\n have comm_in: \"dispatch_ch i \\ {dispatch_ch i}\"\n by auto\n have req_not_in: \"req_ch i \\ {dispatch_ch i}\"\n unfolding req_ch_def dispatch_ch_def\n using assms by auto\n have exit_not_in: \"exit_ch i \\ {dispatch_ch i}\"\n unfolding exit_ch_def dispatch_ch_def\n using assms by auto\n have run_not_in: \"run_ch i \\ {dispatch_ch i}\"\n unfolding run_ch_def dispatch_ch_def\n using assms by auto\n have preempt_not_in: \"preempt_ch i \\ {dispatch_ch i}\"\n unfolding preempt_ch_def dispatch_ch_def\n using assms by auto\n have free_not_in: \"free_ch i \\ {dispatch_ch i}\"\n unfolding free_ch_def dispatch_ch_def\n using assms by auto\n case task_dis_assn\n from task_dis_assn(1) show ?case\n proof (cases rule: dispatch_assn.cases)\n case (1 init_t' wt1 blk1' rest1)\n note d1 = 1\n from task_dis_assn(2) show ?thesis\n proof (cases rule: task_assn.cases)\n case (1 ent' tp' wt2 blk2' rest2)\n note t1 = 1\n obtain rest where rest:\n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState\n (EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s))) (merge_rdy ({}, {}) ({}, {dispatch_ch i}))) rest\"\n \"combine_blocks {dispatch_ch i} rest1 rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t1(2) d1(5) t1(5)]\n apply (elim combine_blocks_waitE) by blast\n then show ?thesis\n using d1 t1 by auto\n next\n case (2 ent tp blk2' rest2)\n note t2 = 2\n from task_dis_assn(3)[unfolded d1(1) t2(2) d1(5) t2(4)]\n show ?thesis\n by (elim combine_blocks_waitCommE[OF comm_in])\n next\n case (3 ent tp blk2' rest2)\n note t3 = 3\n obtain rest where rest:\n \"blks = SCons (OutBlock (req_ch i) tp) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t3(2) d1(5) t3(4)]\n apply (elim combine_blocks_waitCommE2[OF req_not_in]) by blast\n then show ?thesis\n using t3 d1 task_dis_assn(1) by auto\n next\n case (4 ent' tp' init_t2 wt2 blk2' rest2)\n note t4 = 4\n obtain rest where\n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState\n (EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t2 + t))))\n (merge_rdy ({}, {}) ({}, {run_ch i}))) rest\"\n \"combine_blocks {dispatch_ch i} rest1 rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t4(2) d1(5) t4(7)]\n apply (elim combine_blocks_waitE) by blast\n then show ?thesis\n using t4 d1 by auto\n next\n case (5 ent tp init_t blk2' rest2)\n note t5 = 5\n obtain rest where rest:\n \"blks = SCons (OutBlock (exit_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t5(2) d1(5) t5(6)]\n apply (elim combine_blocks_waitCommE2[OF exit_not_in]) by blast\n then show ?thesis\n using t5 d1 task_dis_assn(1) by auto\n next\n case (6 tp blk2' rest2)\n note t6 = 6\n obtain rest where rest:\n \"blks = SCons (InBlock (run_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t6(2) d1(5) t6(4)]\n apply (elim combine_blocks_waitCommE2[OF run_not_in]) by blast\n then show ?thesis\n using t6 d1 task_dis_assn(1) by auto\n next\n case (7 tp blk1 rest2)\n note t7 = 7 \n obtain rest where rest:\n \"blks = SCons (InBlock (run_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t7(2) d1(5) t7(4)]\n apply (elim combine_blocks_waitCommE2[OF run_not_in]) by blast\n then show ?thesis\n using t7 d1 task_dis_assn(1) by auto\n next\n case (8 tp init_t init_c wt2 blk2' rest2)\n note t8 = 8\n thm d1\n obtain rest where rest:\n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState\n (EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))) (merge_rdy ({}, {}) ({}, {preempt_ch i}))) rest\"\n \"combine_blocks {dispatch_ch i} rest1 rest2 rest\"\n using task_dis_assn(3) [unfolded d1(1) d1(5) t8(2) t8(9)]\n apply (elim combine_blocks_waitE) by blast\n then show ?thesis using d1 t8 by auto\n next\n case (9 tp blk2' rest2)\n note t9 = 9\n thm d1\n obtain rest where rest:\n \"blks = SCons (InBlock (preempt_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t9(2) d1(5) t9(4)]\n apply (elim combine_blocks_waitCommE2[OF preempt_not_in]) by blast\n then show ?thesis\n using d1 t9 task_dis_assn by auto\n next\n case (10 tp init_t init_c blk2' rest2)\n note t10 = 10\n obtain rest where rest:\n \"blks = SCons (OutBlock (free_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (WaitBlk (ereal wt1) (\\t. EState (estate.None, dis_s(CHR ''t'' := init_t' + t)))\n ({}, {})) rest1)\n rest2 rest\"\n using task_dis_assn(3)[unfolded d1(1) t10(2) d1(5) t10(7)]\n apply (elim combine_blocks_waitCommE2[OF free_not_in]) by blast\n then show ?thesis\n using d1 t10 task_dis_assn by auto\n qed\n next\n case (2 init_t' blk1' rest1)\n note d2 = 2\n from task_dis_assn(2) show ?thesis\n proof (cases rule: task_assn.cases)\n case (1 ent tp wt blk2' rest2)\n note t1 = 1\n from task_dis_assn(3)[unfolded d2(1) t1(2) d2(4) t1(5)]\n show ?thesis\n by (elim combine_blocks_waitCommE'[OF comm_in])\n next\n case (2 ent tp blk2' rest2)\n note t2 = 2\n obtain rest where rest:\n \"blks = SCons (IOBlock (dispatch_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n rest1 rest2 rest\"\n using task_dis_assn(3)[unfolded d2(1,4) t2(2,4)]\n apply(elim combine_blocks_pairE[OF comm_in comm_in]) by blast\n then show ?thesis \n using d2 t2 task_dis_assn by auto\n next\n case (3 ent tp blk2' rest2)\n note t3=3\n obtain rest where rest:\n \"blks = SCons (OutBlock (req_ch i) tp) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t3(2,4)]\n apply(elim combine_blocks_unpairE1'[OF comm_in req_not_in]) by blast\n then show ?thesis \n using task_dis_assn d2 t3 by auto\n next\n case (4 ent tp init_t wt blk1 rest)\n note t4 = 4\n from task_dis_assn(3)[unfolded d2(1,4) t4(2,7)]\n show ?thesis \n by (elim combine_blocks_waitCommE'[OF comm_in])\n next\n case (5 ent tp init_t blk2' rest2)\n note t5 = 5\n obtain rest where rest:\n \"blks = SCons (OutBlock (exit_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t5(2,6)]\n apply(elim combine_blocks_unpairE1'[OF comm_in exit_not_in]) by blast\n then show ?thesis using task_dis_assn d2 t5 by auto\n next\n case (6 tp blk2' rest2)\n note t6 = 6\n obtain rest where rest:\n \"blks = SCons (InBlock (run_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t6(2,4)]\n apply(elim combine_blocks_unpairE1'[OF comm_in run_not_in]) by blast\n then show ?thesis using task_dis_assn d2 t6 by auto\n next\n case (7 tp blk2' rest2)\n note t7 = 7\n obtain rest where rest:\n \"blks = SCons (InBlock (run_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t7(2,4)]\n apply(elim combine_blocks_unpairE1'[OF comm_in run_not_in]) by blast\n then show ?thesis using task_dis_assn d2 t7 by auto\n next\n case (8 tp init_t init_c wt blk1 rest)\n note t8 = 8\n from task_dis_assn(3)[unfolded d2(1,4) t8(2,9)]\n show ?thesis \n by (elim combine_blocks_waitCommE'[OF comm_in])\n next\n case (9 tp blk2' rest2)\n note t9 = 9\n obtain rest where rest:\n \"blks = SCons (InBlock (preempt_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t9(2,4)]\n apply(elim combine_blocks_unpairE1'[OF comm_in preempt_not_in]) by blast\n then show ?thesis using task_dis_assn d2 t9 by auto\n next\n case (10 tp init_t init_c blk2' rest2)\n note t10 = 10\n obtain rest where rest:\n \"blks = SCons (OutBlock (free_ch i) 0) rest\"\n \"combine_blocks {dispatch_ch i}\n (SCons (OutBlock (dispatch_ch i) 0) rest1)\n rest2 rest\"\n using task_dis_assn(3) [unfolded d2(1,4) t10(2,7)]\n apply(elim combine_blocks_unpairE1'[OF comm_in free_not_in]) by blast\n then show ?thesis using task_dis_assn d2 t10 by auto\n qed\nqed\nqed\n\ndefinition sch :: \"estate proc\" where\n\"sch = EChoice \n[((req_ch 1)[?]CHR ''p'',\n (CHR ''i'' ::= (\\_ . 1));\n IF (\\ (a,s) . run_prior a \\ s (CHR ''p'')) \n THEN Basic (sched_push 1) \n ELSE (IF (\\ (a,s) . run_now a \\ -1) \n THEN (Cm (preempt_ch 1 [!] (\\_. 0))) \n ELSE Skip \n FI);\n Basic (sched_assign 1); \n Cm (run_ch 1[!](\\_ . 0)) \n FI),\n ((free_ch 1)[?]CHR ''F'',\n (CHR ''i'' ::= (\\_ . 1));\n IF (\\ (a,s) . length (pool a) > 0) \n THEN (Basic (sched_get_max) ; Cm (run_ch 1[!](\\_ . 0))) \n ELSE Basic sched_clear \n FI),\n ((exit_ch 1)[?]CHR ''E'',\n (CHR ''i'' ::= (\\_ . 1)); \n Basic (sched_del_proc 1)),\n ((req_ch 2)[?]CHR ''p'',\n (CHR ''i'' ::= (\\_ . 2));\n IF (\\ (a,s) . run_prior a \\ s (CHR ''p'')) \n THEN Basic (sched_push 2) \n ELSE (IF (\\ (a,s) . run_now a \\ -1) \n THEN (Cm (preempt_ch 2 [!] (\\_. 0))) \n ELSE Skip \n FI);\n Basic (sched_assign 2); \n Cm (run_ch 2[!](\\_ . 0)) \n FI),\n ((free_ch 2)[?]CHR ''F'',\n (CHR ''i'' ::= (\\_ . 2));\n IF (\\ (a,s) . length (pool a) > 0) \n THEN (Basic (sched_get_max) ; Cm (run_ch 2[!](\\_ . 0))) \n ELSE Basic sched_clear \n FI),\n ((exit_ch 2)[?]CHR ''E'',\n (CHR ''i'' ::= (\\_ . 2)); \n Basic (sched_del_proc 2)),\n ((req_ch 3)[?]CHR ''p'',\n (CHR ''i'' ::= (\\_ . 3));\n IF (\\ (a,s) . run_prior a \\ s (CHR ''p'')) \n THEN Basic (sched_push 3) \n ELSE (IF (\\ (a,s) . run_now a \\ -1) \n THEN (Cm (preempt_ch 3 [!] (\\_. 0))) \n ELSE Skip \n FI);\n Basic (sched_assign 3); \n Cm (run_ch 3[!](\\_ . 0)) \n FI),\n ((free_ch 3)[?]CHR ''F'',\n (CHR ''i'' ::= (\\_ . 3));\n IF (\\ (a,s) . length (pool a) > 0) \n THEN (Basic (sched_get_max) ; Cm (run_ch 3[!](\\_ . 0))) \n ELSE Basic sched_clear \n FI),\n ((exit_ch 3)[?]CHR ''E'',\n (CHR ''i'' ::= (\\_ . 3)); \n Basic (sched_del_proc 3))]\"\n\n\ncoinductive sch_assn :: \"string \\ estate \\ state \\ estate stassn\" where\n \"sch_es = Sch p r_now r_prior \\\n wt > 0 \\\n blk1 = WaitBlk (ereal wt) (\\_. EState (sch_es, sch_s)) ({}, image req_ch {1,2,3} \\ image free_ch {1,2,3} \\ image exit_ch {1,2,3}) \\\n sch_assn ''q0'' sch_es sch_s rest \\\n sch_assn ''q0'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n blk1 = InBlock (req_ch i) prior \\\n i \\ {1,2,3}\\\n sch_assn ''q1'' sch_es (sch_s(CHR ''p'' := prior, CHR ''i'' := i)) rest \\\n sch_assn ''q0'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n prior = sch_s CHR ''p'' \\\n r_prior \\ prior \\\n sch_assn ''q0'' (sched_push i sch_es sch_s) sch_s rest \\\n sch_assn ''q1'' sch_es sch_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now \\ -1 \\\n blk1 = OutBlock (preempt_ch r_now) 0 \\\n sch_assn ''q2'' sch_es sch_s rest \\\n sch_assn ''q1'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now = -1 \\\n sch_assn ''q2'' sch_es sch_s rest \\\n sch_assn ''q1'' sch_es sch_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n prior = sch_s CHR ''p'' \\\n blk1 = OutBlock (run_ch i) 0 \\\n sch_assn ''q0'' (sched_assign i sch_es sch_s) sch_s rest \\\n sch_assn ''q2'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n blk1 = InBlock (free_ch i) 0 \\\n sch_assn ''q3'' sch_es (sch_s(CHR ''i'' := i)) rest \\\n sch_assn ''q0'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n length p > 0 \\\n blk1 = OutBlock (run_ch (snd (get_max p))) 0 \\\n sch_assn ''q0'' (sched_get_max sch_es sch_s) sch_s rest \\\n sch_assn ''q3'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n length p = 0 \\\n sch_assn ''q0'' (sched_clear sch_es sch_s) sch_s rest \\\n sch_assn ''q3'' sch_es sch_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n blk1 = InBlock (exit_ch i) 0 \\\n sch_assn ''q4'' sch_es (sch_s(CHR ''i'' := i)) rest \\\n sch_assn ''q0'' sch_es sch_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n sch_assn ''q0'' (sched_del_proc (sch_s CHR ''i'') sch_es sch_s) sch_s rest \\\n sch_assn ''q4'' sch_es sch_s rest\"\n\n\n\ncoinductive sch_task_dis_assn :: \"tid \\ string \\ string \\ estate \\ state \\ state \\ estate \\ state \\ estate stassn\" where\n \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n init_t' = dis_s (CHR ''t'') \\\n init_t' < 0.045 \\\n wt \\ 0.045 - init_t' \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState (EState (sch_es, sch_s))(ParState\n (EState (None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s)))) \n ({}, {dispatch_ch i} \\ image req_ch {1,2,3} \\ image free_ch {1,2,3} \\ image exit_ch {1,2,3}) \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s (dis_s(CHR ''t'' := init_t' + wt)) start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j \\ i \\\n blk1 = InBlock (req_ch j) prior \\\n sch_task_dis_assn i ''q1'' ''p1'' sch_es (sch_s(CHR ''p'' := prior, CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior \\ prior \\\n sch_task_dis_assn i ''q0'' ''p1'' (sched_push j sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p1'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now \\ -1 \\\n blk1 = OutBlock (preempt_ch r_now) 0 \\\n sch_task_dis_assn i ''q2'' ''p1'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now = -1 \\\n sch_task_dis_assn i ''q2'' ''p1'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p1'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n blk1 = OutBlock (run_ch j) 0 \\\n sch_task_dis_assn i ''q0'' ''p1'' (sched_assign i sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q2'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j \\ i \\\n blk1 = InBlock (free_ch j) 0 \\\n sch_task_dis_assn i ''q3'' ''p1'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n length p > 0 \\\n blk1 = OutBlock (run_ch (snd (get_max p))) 0 \\\n sch_task_dis_assn i ''q0'' ''p1'' (sched_get_max sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n length p = 0 \\\n sch_task_dis_assn i ''q0'' ''p1'' (sched_clear sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p1'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n j \\ i \\\n blk1 = InBlock (exit_ch j) 0 \\\n sch_task_dis_assn i ''q4'' ''p1'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n sch_task_dis_assn i ''q0'' ''p1'' (sched_del_proc (sch_s CHR ''i'') sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q4'' ''p1'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task WAIT ent tp \\\n init_t' = dis_s (CHR ''t'') \\\n init_t' = 0.045 \\\n blk1 = IOBlock (dispatch_ch i) 0 \\\n sch_task_dis_assn i ''q0'' ''p2'' sch_es sch_s (dis_s(CHR ''t'' := 0)) (Task READY 0 tp) (task_s(CHR ''t'' := 0)) rest \\\n sch_task_dis_assn i ''q0'' ''p1'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n blk1 = IOBlock (req_ch i) prior \\\n start_es = Task READY ent tp \\\n blk1 = OutBlock (req_ch i) tp \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es (sch_s(CHR ''p'' := prior, CHR ''i'' := i)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p2'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n i = sch_s CHR ''i'' \\\n r_prior \\ sch_s CHR ''p'' \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_push i sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n init_t = task_s (CHR ''t'') \\\n init_t' = dis_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.045 - init_t' \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState (EState (sch_es,sch_s))(ParState\n (EState (None, dis_t(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t + t))))) ({}, {run_ch i} \\ image req_ch {1,2,3} \\ image free_ch {1,2,3} \\ image exit_ch {1,2,3}) \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s (dis_s(CHR ''t'' := init_t' + wt))\n start_es (task_s(CHR ''t'' := init_t + wt)) rest \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j \\ i \\\n blk1 = InBlock (req_ch j) prior \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es (sch_s(CHR ''p'' := prior, CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior \\ prior \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_push j sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now \\ -1 \\\n blk1 = OutBlock (preempt_ch r_now) 0 \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n r_now = -1 \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n blk1 = OutBlock (run_ch j) 0 \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_assign j sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j \\ i \\\n blk1 = InBlock (free_ch j) 0 \\\n sch_task_dis_assn i ''q3'' ''p3'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n length p > 0 \\\n snd (get_max p) \\ i \\\n blk1 = OutBlock (run_ch (snd (get_max p))) 0 \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_get_max sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n(* \nTask READY 0 tp and Task READY 1 tp\n*)\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n length p > 0 \\\n snd (get_max p) = i \\\n blk1 = IOBlock (run_ch i) 0 \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_get_max sch_es sch_s) sch_s dis_s (Task RUNNING 1 tp) task_s rest \\\n sch_task_dis_assn i ''q3'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n(* length p must be greater than 0\n*)\n| \"sch_es = Sch p r_now r_prior \\\n length p = 0 \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_clear sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n j \\ i \\\n blk1 = InBlock (exit_ch j) 0 \\\n sch_task_dis_assn i ''q4'' ''p3'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n sch_task_dis_assn i ''q0'' ''p3'' (sched_del_proc (sch_s CHR ''i'') sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q4'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n init_t = task_s (CHR ''t'') \\\n init_t = 0.045 \\\n blk1 = IOBlock (exit_ch i) 0 \\\n sch_task_dis_assn i ''q4'' ''p1'' sch_es sch_s dis_s (Task WAIT ent tp) task_s rest \\\n sch_task_dis_assn i ''q0'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n i = sch_s CHR ''i'' \\\n r_prior < sch_s CHR ''p'' \\\n r_now \\ -1 \\\n blk1 = OutBlock (preempt_ch r_now) 0 \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY ent tp \\\n i = sch_s CHR ''i'' \\\n r_prior < sch_s CHR ''p'' \\\n r_now = -1 \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p3'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n start_es = Task READY 0 tp \\\n blk1 = IOBlock (run_ch i) 0 \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_assign i sch_es sch_s) sch_s dis_s (Task RUNNING 1 tp) (task_s(CHR ''c'' := 0)) rest \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n i = sch_s CHR ''i'' \\\n start_es = Task READY 1 tp \\\n blk1 = IOBlock (run_ch i) 0 \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_assign i sch_es sch_s) sch_s dis_s (Task RUNNING 1 tp) task_s rest \\\n sch_task_dis_assn i ''q2'' ''p3'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n init_t' = dis_s (CHR ''t'') \\\n wt \\ 0.045 - init_t \\\n wt \\ 0.01 - init_c \\\n wt \\ 0.045 - init_t' \\\n wt > 0 \\\n blk1 = WaitBlk (ereal wt) (\\t. ParState (EState (sch_es, sch_s)) (ParState\n (EState (None, dis_s(CHR ''t'' := init_t' + t)))\n (EState (start_es, task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))))\n ({}, {preempt_ch i}\\ image req_ch {1,2,3} \\ image free_ch {1,2,3} \\ image exit_ch {1,2,3}) \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s (dis_s(CHR ''t'' := init_t' + wt)) start_es (task_s(CHR ''t'' := init_t + wt,\n CHR ''c'' := init_c + wt)) rest \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task RUNNING 1 tp \\\n init_t = task_s (CHR ''t'') \\\n init_c = task_s (CHR ''c'') \\\n init_c = 0.01 \\ init_t = 0.045 \\\n blk1 = IOBlock (free_ch i) 0 \\\n sch_task_dis_assn i ''q3'' ''p1'' sch_es (sch_s(CHR ''i'' := i)) dis_s (Task READY 1 tp) task_s rest \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task RUNNING 1 tp \\\n j \\ i \\\n blk1 = InBlock (req_ch j) prior \\\n sch_task_dis_assn i ''q1'' ''p4'' sch_es (sch_s(CHR ''p'' := prior, CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task RUNNING 1 tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n r_prior \\ prior \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_push j sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q1'' ''p4'' sch_es sch_s dis_s start_es task_s rest\"\n\n(* \nr_now = i, r_prior = tp\n*)\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task RUNNING 1 tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\ \n prior = sch_s CHR ''p'' \\\n r_prior < prior \\\n blk1 = IOBlock (preempt_ch i) 0 \\\n sch_task_dis_assn i ''q2'' ''p2'' sch_es sch_s dis_s (Task READY 1 tp) task_s rest \\\n sch_task_dis_assn i ''q1'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n j = sch_s CHR ''i'' \\\n j \\ i \\\n prior = sch_s CHR ''p'' \\\n blk1 = OutBlock (run_ch j) 0 \\\n sch_task_dis_assn i ''q0'' ''p2'' (sched_assign j sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q2'' ''p2'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n j \\ i \\\n blk1 = InBlock (free_ch j) 0 \\\n sch_task_dis_assn i ''q3'' ''p4'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n length p > 0 \\\n blk1 = OutBlock (run_ch (snd (get_max p))) 0 \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_get_max sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n length p = 0 \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_clear sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q3'' ''p4'' sch_es sch_s dis_s start_es task_s rest\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n j \\ i \\\n blk1 = InBlock (exit_ch j) 0 \\\n sch_task_dis_assn i ''q4'' ''p4'' sch_es (sch_s(CHR ''i'' := j)) dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q0'' ''p4'' sch_es sch_s dis_s start_es task_s (SCons blk1 rest)\"\n| \"sch_es = Sch p r_now r_prior \\\n start_es = Task READY 1 tp \\\n sch_task_dis_assn i ''q0'' ''p4'' (sched_del_proc (sch_s CHR ''i'') sch_es sch_s) sch_s dis_s start_es task_s rest \\\n sch_task_dis_assn i ''q4'' ''p4'' sch_es sch_s dis_s start_es task_s rest\"\n\n\ntheorem combine_sch_task_dis:\n assumes \"i \\ {1,2,3}\"\n shows \"sch_assn qc sch_es sch_s blks1 \\\n task_dis_assn i pc dis_s start_es task_s blks2 \\\n combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} blks1 blks2 blks \\\n sch_task_dis_assn i qc pc sch_es sch_s dis_s start_es task_s blks\"\nproof (coinduction arbitrary: qc pc sch_es sch_s dis_s start_es task_s blks1 blks2 blks rule: sch_task_dis_assn.coinduct)\n have comm_in_req:\"req_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n by auto\n have comm_in_exit:\"exit_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n by auto\n have comm_in_run:\"run_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n by auto\n have comm_in_preempt:\"preempt_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n by auto\n have comm_in_free:\"free_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n by auto\n have comm_not_in_dis:\"dispatch_ch i \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n apply(auto simp add: dispatch_ch_def req_ch_def run_ch_def free_ch_def preempt_ch_def exit_ch_def)\n using assms by auto\n case sch_task_dis_assn\n from sch_task_dis_assn(1) \n show ?case\n proof (cases rule: sch_assn.cases)\n case (1 p r_now r_prior wt1 blk1 rest1)\n note s1 = 1\n from sch_task_dis_assn(2) \n show ?thesis \n proof (cases rule : task_dis_assn.cases)\n case (1 ent tp init_t' wt2 blk2 rest2)\n note t1 = 1\n obtain rest where rest: \n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState (EState (sch_es, sch_s)) \n (ParState (EState (None, dis_s(CHR ''t'' := init_t' + t))) (EState (start_es, task_s))))\n ({}, {dispatch_ch i} \\ req_ch ` {1, 2, 3} \\ free_ch ` {1, 2, 3} \\ exit_ch ` {1, 2, 3})) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} rest1 rest2 rest\"\n using sch_task_dis_assn(3)[unfolded s1(2,5) t1(2,7)]\n apply (elim combine_blocks_waitE)\n by (smt merge_rdy.simps sup_assoc sup_commute sup_idem)\n then show ?thesis using s1 t1 sch_task_dis_assn by auto\n next\n case (2 ent tp init_t' blk2 rest2)\n note t2 = 2\n obtain rest where rest: \n \"blks = SCons (IOBlock (dispatch_ch i) 0) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} blks1 rest2 rest\"\n using sch_task_dis_assn(3)[unfolded s1(2,5) t2(2,6)]\n apply(simp add: s1(2,5) t2(2,6))\n apply(elim combine_blocks_waitCommE2[OF comm_not_in_dis]) by blast\n then show ?thesis using s1 t2 sch_task_dis_assn by auto\n next\n case (3 ent tp blk1 rest)\n note t3 = 3\n from sch_task_dis_assn(3)[unfolded s1(2,5) t3(2,4)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_req])\n next\n case (4 ent tp init_t init_t' wt2 blk2 dis_s rest2)\n note t4 = 4\n obtain rest where \n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState (EState (sch_es, sch_s)) \n (ParState (EState (None, dis_s(CHR ''t'' := init_t' + t))) (EState (start_es, task_s(CHR ''t'' := init_t + t)))))\n ({}, {run_ch i} \\ req_ch ` {1, 2, 3} \\ free_ch ` {1, 2, 3} \\ exit_ch ` {1, 2, 3})) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} rest1 rest2 rest\"\n using sch_task_dis_assn(3)[unfolded s1(2,5) t4(2,8)]\n apply (elim combine_blocks_waitE) \n by (smt (verit, ccfv_threshold) Un_insert_left Un_insert_right merge_rdy.simps sup_bot.left_neutral sup_bot_right)\n then show ?thesis using s1 t4 sch_task_dis_assn by auto\n next\n case (5 ent tp init_t blk1 rest)\n note t5 = 5\n from sch_task_dis_assn(3)[unfolded s1(2,5) t5(2,6)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_exit])\n next\n case (6 tp blk1 rest)\n note t6 = 6\n from sch_task_dis_assn(3)[unfolded s1(2,5) t6(2,4)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_run])\n next\n case (7 tp blk1 rest)\n note t7 = 7\n from sch_task_dis_assn(3)[unfolded s1(2,5) t7(2,4)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_run])\n next\n case (8 tp init_t init_c init_t' wt2 blk2 rest2)\n note t8 = 8\n obtain rest where \n \"ereal wt1 = ereal wt2\"\n \"blks = SCons (WaitBlk (ereal wt1) (\\t. ParState (EState (sch_es, sch_s)) \n (ParState (EState (None, dis_s(CHR ''t'' := init_t' + t))) (EState (start_es, task_s(CHR ''t'' := init_t + t, CHR ''c'' := init_c + t)))))\n ({}, {preempt_ch i} \\ req_ch ` {1, 2, 3} \\ free_ch ` {1, 2, 3} \\ exit_ch ` {1, 2, 3})) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} rest1 rest2 rest\"\n using sch_task_dis_assn(3)[unfolded s1(2,5) t8(2,11)]\n apply (elim combine_blocks_waitE) \n by (simp add: insert_commute)\n then show ?thesis using s1 t8 sch_task_dis_assn by auto\n next\n case (9 tp blk1 rest)\n note t9 = 9\n from sch_task_dis_assn(3)[unfolded s1(2,5) t9(2,4)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_preempt])\n next\n case (10 tp init_t init_c blk1 rest)\n note t10 =10\n from sch_task_dis_assn(3)[unfolded s1(2,5) t10(2,7)]\n show ?thesis by(elim combine_blocks_waitCommE[OF comm_in_free])\n qed\n next\n case (2 p r_now r_prior blk1 j prior rest1)\n note s2 = 2\n from sch_task_dis_assn(2) \n show ?thesis \n proof (cases rule : task_dis_assn.cases)\n case (1 ent tp init_t' wt blk2 rest2)\n note t1 = 1\n show ?thesis\n proof (cases \"j = i\")\n case True\n from sch_task_dis_assn(3)[unfolded s2(2,4) t1(2,7) True]\n show ?thesis by(elim combine_blocks_waitCommE'[OF comm_in_req])\n next\n case False\n then have comm_not_in:\"(req_ch j) \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n apply(simp add: dispatch_ch_def req_ch_def run_ch_def free_ch_def preempt_ch_def exit_ch_def)\n using assms s2(5) by auto \n obtain rest where rest:\n \"blks = SCons (InBlock (req_ch j) prior) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} rest1 blks2 rest\"\n using sch_task_dis_assn(3)[unfolded s2(2,4) t1(2,7)]\n apply(simp add: t1(2,7))\n apply(elim combine_blocks_waitCommE2'[OF comm_not_in]) by auto\n show ?thesis \n apply(rule disjI2)\n apply(rule disjI1)\n apply(rule exI[where x=\"sch_es\"])\n apply(rule exI[where x=\"pool sch_es\"])\n apply(rule exI[where x=\"run_now sch_es\"])\n apply(rule exI[where x=\"run_prior sch_es\"])\n apply(rule exI[where x=\"start_es\"])\n apply(rule exI[where x=\"entered start_es\"])\n apply(rule exI[where x=\"task_prior start_es\"])\n apply(rule exI[where x=\"j\"])\n apply(rule exI[where x=\"i\"])\n apply(rule exI[where x=\"(InBlock (req_ch j) prior)\"])\n apply(rule exI[where x=\"prior\"])\n apply(rule exI[where x=\"sch_s\"])\n apply(rule exI[where x=\"dis_s\"])\n apply(rule exI[where x=\"task_s\"])\n apply(rule exI[where x=\"rest\"])\n apply(intro conjI)\n apply(rule refl, simp add: s2 t1)+\n using t1 apply simp\n apply(rule refl)+\n using rest apply simp\n using s2 apply simp\n using t1 apply simp\n using False apply simp\n apply(rule refl)\n apply(rule disjI1)\n apply(rule exI[where x=\"''q1''\"])\n apply(rule exI[where x=\"''p1''\"])\n apply(rule exI[where x=\"sch_es\"])\n apply(rule exI[where x=\"sch_s(CHR ''p'' := prior, CHR ''i'' := j)\"])\n apply(rule exI[where x=\"dis_s\"])\n apply(rule exI[where x=\"start_es\"])\n apply(rule exI[where x=\"task_s\"])\n apply(rule exI[where x=\"rest1\"])\n apply(rule exI[where x=\"blks2\"])\n apply(rule exI[where x=\"rest\"])\n apply(intro conjI)\n apply(rule refl)+\n using s2 apply simp\n using sch_task_dis_assn t1 apply simp\n using rest apply simp\n done\n qed\n next\n case (2 ent tp init_t' blk2 rest2)\n note t2 = 2\n show ?thesis \n proof (cases \" j = i\")\n case True\n obtain rest where\n \"blks = SCons (IOBlock (dispatch_ch i) 0) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} blks1 rest2 rest\"\n using sch_task_dis_assn(3)[unfolded s2(2,4) t2(2,6) True]\n apply (simp add: s2(2,4) t2(2,6) True)\n apply(elim combine_blocks_unpairE1'[OF comm_in_req comm_not_in_dis]) by blast\n then show ?thesis using sch_task_dis_assn s2 t2 True by auto\n next\n case False\n then have comm_not_in:\"(req_ch j) \\ {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i}\"\n apply(simp add: dispatch_ch_def req_ch_def run_ch_def free_ch_def preempt_ch_def exit_ch_def)\n using assms s2(5) by auto \n obtain rest where\n \"blks = SCons (InBlock (req_ch j) prior) rest\"\n \"combine_blocks {req_ch i, run_ch i, free_ch i, preempt_ch i, exit_ch i} rest1 blks2 rest\"\n using sch_task_dis_assn(3)[unfolded s2(2,4) t2(2,6)]\n apply (simp add: s2(2,4) t2(2,6))\n apply(elim combine_blocks_unpairE2[OF comm_not_in comm_not_in_dis]) \n then show ?thesis sorry\n qed\n\n next\n case (3 ent tp blk1 rest)\n then show ?thesis sorry\n next\n case (4 ent tp init_t init_t' wt blk1 dis_t rest)\n then show ?thesis sorry\n next\n case (5 ent tp init_t blk1 rest)\n then show ?thesis sorry\n next\n case (6 tp blk1 rest)\n then show ?thesis sorry\n next\n case (7 tp blk1 rest)\n then show ?thesis sorry\n next\n case (8 tp init_t init_c init_t' wt blk1 rest)\n then show ?thesis sorry\n next\n case (9 tp blk1 rest)\n then show ?thesis sorry\n next\n case (10 tp init_t init_c blk1 rest)\n then show ?thesis sorry\n qed\n next\n case (3 p r_now r_prior i prior)\n then show ?thesis sorry\n next\n case (4 p r_now r_prior i prior blk1 rest)\n then show ?thesis sorry\n next\n case (5 p r_now r_prior i prior)\n then show ?thesis sorry\n next\n case (6 p r_now r_prior i prior blk1 rest)\n then show ?thesis sorry\n next\n case (7 p r_now r_prior blk1 i rest)\n then show ?thesis sorry\n next\n case (8 p r_now r_prior blk1 rest)\n then show ?thesis sorry\n next\n case (9 p r_now r_prior)\n then show ?thesis sorry\n next\n case (10 p r_now r_prior blk1 i rest)\n then show ?thesis sorry\n next\n case (11 p r_now r_prior)\n then show ?thesis sorry\n qed\nqed\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/Coinductive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.5, "lm_q1q2_score": 0.25390593213960216}} {"text": "theory Buchberger_Timings\n imports Groebner_Bases.Buchberger_Examples Print\nbegin\n\nsubsection \\Scalar Polynomials\\\n\nfunction trd_aux_punit_print where\n \"trd_aux_punit_print to fs p r (i::nat) (j::nat) =\n (if is_zero p then\n print (i, j) r\n else\n case find_adds_punit to fs (lt_punit to p) of\n None \\ trd_aux_punit_print to fs (tail_punit to p) (plus_monomial_less r (lc_punit to p) (lt_punit to p)) (Suc i) j\n | Some f \\ trd_aux_punit_print to fs\n (timing (tail_punit to p - monom_mult_punit (lc_punit to p / lc_punit to f) (lt_punit to p - lt_punit to f) (tail_punit to f)))\n (print (lc_punit to p / lc_punit to f) r)\n i (Suc j)\n )\"\n by auto\ntermination sorry\n\nlemma compute_trd_punit [code]: \"trd_punit to fs p = trd_aux_punit to fs p (change_ord to 0)\"\n by (simp add: punit'.punit.trd_def change_ord_def)\n\ndefinition \"product_crit_punit_print to =\n (\\gs bs ps data p q. if product_crit_punit to gs bs ps data p q then (print ''prod'' True) else False)\"\n\ndefinition \"chain_ncrit_punit_print to =\n (\\data gs bs hs ps q_in_bs p q. if chain_ncrit_punit to data gs bs hs ps q_in_bs p q then (print ''nchain'' True) else False)\"\n\ndefinition \"chain_ocrit_punit_print to =\n (\\data hs ps p q. if chain_ocrit_punit to data hs ps p q then (print ''ochain'' True) else False)\"\n\ndefinition \"trdsp_punit_timing to = (\\bs p. timing_lbl ''trdsp'' (trd_punit to bs (spoly_punit to (fst (fst p)) (fst (snd p)))))\"\n\ndefinition \"trdsp_punit_print to = (\\bs p. (let res = trd_punit to bs (spoly_punit to (fst (fst p)) (fst (snd p))) in if res = 0 then print ''0'' res else res))\"\n\ndefinition \"add_pairs_punit_timing =\n (\\np icrit ncrit ocrit comb gs bs ps hs data.\n timing_lbl ''ap''\n (let ps1 = apply_ncrit_punit ncrit data gs bs hs (apply_icrit_punit icrit data gs bs hs (np gs bs hs data));\n ps2 = apply_ocrit_punit ocrit data hs ps1 ps in comb (map snd [x\\ps1 . \\ fst x]) ps2))\"\n\ndefinition \"add_pairs_punit_print =\n (\\np icrit ncrit ocrit comb gs bs ps hs data.\n (let ps0 = np gs bs hs data;\n ps1 = apply_ncrit_punit ncrit data gs bs hs (apply_icrit_punit icrit data gs bs hs ps0);\n ps2 = apply_ocrit_punit ocrit data hs ps1 ps;\n ps3 = [x\\ps1 . \\ fst x] in print ((length ps + length ps0) - (length ps2 + length ps3)) (comb (map snd ps3) ps2)))\"\n\ndefinition \"add_basis_sorted_print =\n (\\rel gs bs ns data. (if length ns = 0 then (\\_ x. x) else print) (length bs + length ns, map (card_keys \\ fst) ns) (merge_wrt (rel data) bs ns))\"\n\ndefinition \"add_basis_sorted_timing =\n (\\rel gs bs ns data. timing_lbl ''ab'' (merge_wrt (rel data) bs ns))\"\n\ndefinition \"gb_sel_punit_print =\n (\\_ _ ps _. print (length ps) (if List.null ps then [] else [hd ps]))\"\n\nlemma product_crit_punit_print [simp]: \"product_crit_punit_print = product_crit_punit\"\n by (rule ext, simp add: product_crit_punit_print_def)\n\nlemma chain_ncrit_punit_print [simp]: \"chain_ncrit_punit_print = chain_ncrit_punit\"\n by (rule ext, simp add: chain_ncrit_punit_print_def)\n\nlemma chain_ocrit_punit_print [simp]: \"chain_ocrit_punit_print = chain_ocrit_punit\"\n by (rule ext, simp add: chain_ocrit_punit_print_def)\n\n\n(*\nlemma gb_sel_punit_print [code_abbrev]: \"gb_sel_punit_print = gb_sel_punit\"\n apply (simp add: gb_sel_punit_print_def Let_def) sorry\n*)\n\n(*\nlemma discard_red_cp_punit_timing [code_abbrev]: \"discard_red_cp_punit_timing = discard_red_cp_punit\"\n sorry\n\nlemma add_pairs_sorted_punit_timing [code_abbrev]: \"add_pairs_sorted_punit_timing = add_pairs_sorted_punit\"\n sorry\n\nlemma add_basis_sorted_timing [code_abbrev]: \"add_basis_sorted_timing = add_basis_sorted\"\n sorry\n*)\n\n(*\nlemma add_pairs_punit_canon_print [code_abbrev]: \"add_pairs_punit_print = add_pairs_punit\"\n sorry\n*)\n\n(*\nlemma add_basis_sorted_print [code_abbrev]: \"add_basis_sorted_print = add_basis_sorted\"\n sorry\n*)\n\n(*\nlemma trd_punit_print [code_abbrev]: \"trd_punit_print = trd_punit\"\n sorry\n*)\n\n(*\nlemma compute_trd_punit [code]: \"trd_punit fs p = trd_aux_punit_print fs p 0 0 0\"\n sorry\n*)\n\n(*\nlemma trdsp_punit_timing [code_abbrev]: \"trdsp_punit_timing = trdsp_punit\"\n sorry\n*)\n\n(*\nlemma trdsp_punit_print [code_abbrev]: \"trdsp_punit_print = trdsp_punit\"\n sorry\n*)\n\nvalue [code] \"timing (length (gb_punit DRLEX (map (\\p. (p, ())) ((eco DRLEX 8)::(_ \\\\<^sub>0 rat) list)) ()))\"\n\nend (* theory *)\n", "meta": {"author": "amaletzk", "repo": "Isabelle-Groebner", "sha": "34e25806ec60a4bee8f21b038eeaaf1065d9f6d0", "save_path": "github-repos/isabelle/amaletzk-Isabelle-Groebner", "path": "github-repos/isabelle/amaletzk-Isabelle-Groebner/Isabelle-Groebner-34e25806ec60a4bee8f21b038eeaaf1065d9f6d0/Buchberger_Timings.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.2538861868256171}} {"text": "theory flash4Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutXAcksDoneVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_NakVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_NakVsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv4: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX2VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX1VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_PutVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv4: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv4: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv4 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash4Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.253886180316285}} {"text": "theory Std_to_Inca_compiler\n imports Std_to_Inca_simulation\n \"VeriComp.Compiler\"\nbegin\n\n\nsubsection \\Compilation of function definitions\\\n\nfun compile_instr where\n \"compile_instr (Std.IPush d) = Inca.IPush d\" |\n \"compile_instr Std.IPop = Inca.IPop\" |\n \"compile_instr (Std.IGet n) = Inca.IGet n\" |\n \"compile_instr (Std.ISet n) = Inca.ISet n\" |\n \"compile_instr (Std.ILoad x) = Inca.ILoad x\" |\n \"compile_instr (Std.IStore x) = Inca.IStore x\" |\n \"compile_instr (Std.IOp op) = Inca.IOp op\" |\n \"compile_instr (Std.ICJump l\\<^sub>t l\\<^sub>f) = Inca.ICJump l\\<^sub>t l\\<^sub>f\" |\n \"compile_instr (Std.ICall f) = Inca.ICall f\" |\n \"compile_instr Std.IReturn = Inca.IReturn\"\n\nfun compile_fundef where\n \"compile_fundef (Fundef [] _ _ _) = None\" |\n \"compile_fundef (Fundef bblocks ar ret locals) =\n Some (Fundef (map_ran (\\_. map compile_instr) bblocks) ar ret locals)\"\n\ncontext std_inca_simulation begin\n\nlemma lambda_eq_eq[simp]: \"(\\x y. y = x) = (=)\"\n apply (intro ext)\n by blast\n\nlemma norm_compile_instr:\n \"norm_instr (compile_instr instr) = instr\"\nby (cases instr) auto\n\nlemma rel_compile_fundef:\n assumes \"compile_fundef fd1 = Some fd2\"\n shows \"rel_fundef (=) norm_eq fd1 fd2\"\n using assms\nproof (cases rule: compile_fundef.elims)\n case (2 x xs ar)\n then show ?thesis\n by (auto intro: list.rel_refl\n simp: const_eq_if_conv list.rel_map norm_compile_instr map_ran_def case_prod_beta\n rel_prod_sel)\nqed simp_all\n\nlemma rel_fundef_imp_fundef_ok_iff:\n assumes \"rel_fundef (=) norm_eq fd1 fd2\"\n shows \"wf_fundef fd1 \\ wf_fundef fd2\"\n unfolding wf_fundef_def\n using assms\n by (auto simp: list_all2_rel_prod_conv list.rel_eq elim: fundef.rel_cases)\n\nlemma rel_fundefs_imp_wf_fundefs_iff:\n assumes rel_f_g: \"rel_fundefs f g\"\n shows \"wf_fundefs f \\ wf_fundefs g\"\nproof (rule iffI)\n assume \"wf_fundefs f\" show \"wf_fundefs g\"\n proof (rule wf_fundefsI)\n fix x fd\n assume \"g x = Some fd\" thus \"wf_fundef fd\"\n using \\wf_fundefs f\\\n by (meson rel_f_g rel_fundef_imp_fundef_ok_iff rel_fundefs_Some2 wf_fundefs_imp_wf_fundef)\n qed\nnext\n show \"wf_fundefs g \\ wf_fundefs f\"\n using rel_f_g\n by (meson rel_fundef_imp_fundef_ok_iff rel_fundefs_Some1 wf_fundefs_imp_wf_fundef wf_fundefsI)\nqed\n\nlemma compile_fundef_wf:\n assumes \"compile_fundef fd = Some fd'\"\n shows \"wf_fundef fd'\"\n using assms\nproof (cases rule: compile_fundef.elims)\n case (2 x xs ar)\n then show ?thesis\n by (simp add: const_eq_if_conv wf_fundef_def map_ran_Cons_sel)\nqed simp_all\n\n\nsubsection \\Compilation of function environments\\\n\ndefinition compile_env where\n \"compile_env e \\\n Some Sinca.Fenv.from_list \\ ap_map_list (ap_map_prod Some compile_fundef) (Fstd_to_list e)\"\n\nlemma compile_env_imp_rel_option:\n assumes \"compile_env F1 = Some F2\"\n shows \"rel_option (\\fd1 fd2. compile_fundef fd1 = Some fd2) (Fstd_get F1 f) (Finca_get F2 f)\"\nproof -\n from assms(1) obtain xs where\n ap_map_list_F1: \"ap_map_list (ap_map_prod Some compile_fundef) (Fstd_to_list F1) = Some xs\" and\n F2_def: \"F2 = Sinca.Fenv.from_list xs\"\n by (auto simp add: compile_env_def ap_option_eq_Some_conv)\n\n show ?thesis\n unfolding F2_def Sinca.Fenv.from_list_correct[symmetric]\n unfolding Sinca.Fenv.from_list_correct\n unfolding Sstd.Fenv.to_list_correct[symmetric]\n using ap_map_list_F1\n by (simp add: ap_map_list_ap_map_prod_imp_rel_option_map_of)\nqed\n\nlemma Finca_get_compile:\n assumes compile_F1: \"compile_env F1 = Some F2\"\n shows \"Finca_get F2 f = Fstd_get F1 f \\ compile_fundef\"\n using compile_env_imp_rel_option[OF assms(1), of f]\n by (auto elim!: option.rel_cases)\n\nlemma compile_env_rel_fundefs:\n assumes \"compile_env F1 = Some F2\"\n shows \"rel_fundefs (Fstd_get F1) (Finca_get F2)\"\n unfolding rel_fundefs_def\nproof (rule allI)\n fix f\n show \"rel_option (rel_fundef (=) norm_eq) (Fstd_get F1 f) (Finca_get F2 f)\"\n using compile_env_imp_rel_option[OF assms(1), of f]\n by (auto elim!: option.rel_cases intro: rel_compile_fundef)\nqed\n\nlemma compile_env_imp_wf_fundefs2:\n assumes \"compile_env F1 = Some F2\"\n shows \"wf_fundefs (Finca_get F2)\"\n unfolding Finca_get_compile[OF assms(1)]\n by (auto simp: bind_eq_Some_conv intro!: wf_fundefsI intro: compile_fundef_wf)\n\n\nsubsection \\Compilation of programs\\\n\nfun compile where\n \"compile (Prog F1 H f) = Some Prog \\ compile_env F1 \\ Some H \\ Some f\"\n\ntheorem compile_load:\n assumes\n compile_p1: \"compile p1 = Some p2\" and\n load: \"Sinca.load p2 s2\"\n shows \"\\s1. Sstd.load p1 s1 \\ match s1 s2\"\nproof (cases p1)\n case (Prog F1 H main)\n with assms(1) obtain F2 where\n compile_F1: \"compile_env F1 = Some F2\" and\n p2_def: \"p2 = Prog F2 H main\"\n by (auto simp: ap_option_eq_Some_conv)\n\n show ?thesis\n using assms(2) unfolding p2_def Sinca.load_def\n proof (cases _ _ _ s2 rule: load.cases)\n case (1 fd2)\n from 1 obtain fd1 where\n F1_main: \"Fstd_get F1 main = Some fd1\" and compile_fd1: \"compile_fundef fd1 = Some fd2\"\n using Finca_get_compile[OF compile_F1] by (auto simp: bind_eq_Some_conv)\n\n note rel_fd1_fd2 = rel_compile_fundef[OF compile_fd1]\n hence first_label_fd1_fd2: \"fst (hd (body fd1)) = fst (hd (body fd2))\"\n using 1\n by (auto elim!: fundef.rel_cases dest: list_all2_rel_prod_fst_hd)\n\n have bodies_fd1_fd2: \"body fd1 = [] \\ body fd2 = []\"\n using rel_fundef_body_length[OF rel_fd1_fd2]\n by auto\n\n let ?s1 = \"State F1 H [allocate_frame main fd1 [] uninitialized]\"\n\n show ?thesis\n proof (intro exI conjI)\n show \"Sstd.load p1 ?s1\"\n unfolding Prog\n using 1 F1_main rel_fd1_fd2 bodies_fd1_fd2\n by (auto simp: rel_fundef_arities Sstd.load_def intro!: load.intros)\n next\n note rel_F1_F2 = compile_env_rel_fundefs[OF compile_F1]\n moreover have \"wf_fundefs (Fstd_get F1)\"\n proof (rule wf_fundefsI)\n fix f fd1\n assume \"Fstd_get F1 f = Some fd1\"\n then show \"wf_fundef fd1\"\n by (metis (mono_tags, lifting) Finca_get_compile bind.bind_lunit compile_F1\n rel_F1_F2 compile_fundef_wf rel_fundef_imp_fundef_ok_iff\n rel_fundefs_Some1)\n qed\n ultimately show \"match ?s1 s2\"\n unfolding 1\n using rel_fd1_fd2\n by (auto simp: allocate_frame_def first_label_fd1_fd2 rel_fundef_locals\n intro: match.intros)\n qed\n qed\nqed\n\nsublocale std_to_inca_compiler:\n compiler where\n step1 = Sstd.step and final1 = \"final Fstd_get Std.IReturn\" and load1 = \"Sstd.load\" and\n step2 = Sinca.step and final2 = \"final Finca_get Inca.IReturn\" and load2 = \"Sinca.load\" and\n order = \"\\_ _. False\" and match = \"\\_. match\" and compile = compile\n using compile_load\n by unfold_locales auto\n\n\nsubsection \\Completeness of compilation\\\n\nlemma compile_fundef_complete:\n assumes \"wf_fundef fd1\"\n shows \"\\fd2. compile_fundef fd1 = Some fd2\"\nproof (cases fd1)\n case (Fundef bbs ar)\n then obtain bb bbs' where bbs_def: \"bbs = bb # bbs'\"\n using assms(1) by (cases bbs; auto)\n show ?thesis\n using assms\n unfolding Fundef bbs_def\n by simp\nqed\n\nlemma compile_env_complete:\n assumes wf_F1: \"wf_fundefs (Fstd_get F1)\"\n shows \"\\F2. compile_env F1 = Some F2\"\nproof -\n show ?thesis\n using wf_F1\n by (auto simp: compile_env_def ap_option_eq_Some_conv ap_map_prod_eq_Some_conv\n intro!: ex_ap_map_list_eq_SomeI Sstd.Fenv.to_list_list_allI compile_fundef_complete\n intro: wf_fundefs_imp_wf_fundef)\nqed\n\ntheorem compile_complete:\n assumes wf_p1: \"wf_prog Fstd_get p1\"\n shows \"\\p2. compile p1 = Some p2\"\nproof (cases p1)\n case (Prog x1 x2 x3)\n then show ?thesis\n using wf_p1 unfolding wf_prog_def\n by (auto dest: compile_env_complete)\nqed\n\ntheorem compile_load_forward:\n assumes\n wf_p1: \"wf_prog Fstd_get p1\" and load_p1: \"Sstd.load p1 s1\"\n shows \"\\p2 s2. compile p1 = Some p2 \\ Sinca.load p2 s2 \\ match s1 s2\"\nproof -\n from load_p1 obtain F1 H main fd1 where\n p1_def: \"p1 = Prog F1 H main\" and\n s1_def: \"s1 = Global.state.State F1 H [allocate_frame main fd1 [] uninitialized]\" and\n F1_main: \"Fstd_get F1 main = Some fd1\" and\n arity_fd1: \"arity fd1 = 0\"\n by (auto simp: Sstd.load_def elim: load.cases)\n\n obtain F2 where compile_F1: \"compile_env F1 = Some F2\"\n using wf_p1[unfolded p1_def wf_prog_def, simplified]\n using compile_env_complete[of F1]\n by auto\n\n obtain fd2 where\n F2_main: \"Finca_get F2 main = Some fd2\" and compile_fd1: \"compile_fundef fd1 = Some fd2\"\n using compile_env_imp_rel_option[OF compile_F1, of main]\n unfolding F1_main option_rel_Some1\n by auto\n\n hence rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n using rel_compile_fundef by auto\n\n note wf_fd2 = compile_fundef_wf[OF compile_fd1]\n\n let ?s2 = \"State F2 H [allocate_frame main fd2 [] uninitialized]\"\n\n show ?thesis\n proof (intro exI conjI)\n show \"compile p1 = Some (Prog F2 H main)\"\n by (simp add: p1_def compile_F1)\n next\n show \"Sinca.load (Prog F2 H main) ?s2\"\n using F2_main arity_fd1\n using rel_fundef_arities[OF rel_fd1_fd2]\n using compile_fundef_wf[OF compile_fd1]\n by (auto simp: wf_fundef_def Sinca.load_def intro: load.intros)\n next\n have \"fst (hd (body fd1)) = fst (hd (body fd2))\"\n using rel_fd1_fd2 wf_fd2\n by (auto simp add: fundef.rel_sel wf_fundef_def list_all2_rel_prod_fst_hd)\n moreover have \"wf_fundefs (Fstd_get F1)\"\n using compile_env_imp_wf_fundefs2[OF compile_F1]\n using compile_env_rel_fundefs[OF compile_F1, THEN rel_fundefs_imp_wf_fundefs_iff]\n by simp\n ultimately show \"match s1 ?s2\"\n unfolding s1_def\n using rel_fd1_fd2 compile_env_rel_fundefs[OF compile_F1]\n by (auto simp: allocate_frame_def rel_fundef_locals intro!: match.intros)\n qed\nqed\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/Std_to_Inca_compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.2538594500315461}} {"text": "(* Title: Jinja/J/SmallTypeSafe.thy\n\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Type Safety Proof} *}\n\ntheory TypeSafe\nimports Progress JWellForm\nbegin\n\nsubsection{*Basic preservation lemmas*}\n\ntext{* First two easy preservation lemmas. *}\n\ntheorem red_preserves_hconf:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ (\\T E. \\ P,E,h \\ e : T; P \\ h \\ \\ \\ P \\ h' \\)\"\nand reds_preserves_hconf:\n \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ (\\Ts E. \\ P,E,h \\ es [:] Ts; P \\ h \\ \\ \\ P \\ h' \\)\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case (RedNew h a C FDTs h' l)\n have new: \"new_Addr h = Some a\" and fields: \"P \\ C has_fields FDTs\"\n and h': \"h' = h(a\\(C, init_fields FDTs))\"\n and hconf: \"P \\ h \\\" by fact+\n from new have None: \"h a = None\" by(rule new_Addr_SomeD)\n moreover have \"P,h \\ (C,init_fields FDTs) \\\"\n using fields by(rule oconf_init_fields)\n ultimately show \"P \\ h' \\\" using h' by(fast intro: hconf_new[OF hconf])\nnext\n case (RedFAss h a C fs F D v l)\n let ?fs' = \"fs((F,D)\\v)\"\n have hconf: \"P \\ h \\\" and ha: \"h a = Some(C,fs)\"\n and wt: \"P,E,h \\ addr a\\F{D}:=Val v : T\" by fact+\n from wt ha obtain TF Tv where typeofv: \"typeof\\<^bsub>h\\<^esub> v = Some Tv\"\n and has: \"P \\ C has F:TF in D\"\n and sub: \"P \\ Tv \\ TF\" by auto\n have \"P,h \\ (C, ?fs') \\\"\n proof (rule oconf_fupd[OF has])\n show \"P,h \\ (C, fs) \\\" using hconf ha by(simp add:hconf_def)\n show \"P,h \\ v :\\ TF\" using sub typeofv by(simp add:conf_def)\n qed\n with hconf ha show \"P \\ h(a\\(C, ?fs')) \\\" by (rule hconf_upd_obj)\nqed auto\n(*>*)\n\n\ntheorem red_preserves_lconf:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\\n (\\T E. \\ P,E,h \\ e:T; P,h \\ l (:\\) E \\ \\ P,h' \\ l' (:\\) E)\"\nand reds_preserves_lconf:\n \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\\n (\\Ts E. \\ P,E,h \\ es[:]Ts; P,h \\ l (:\\) E \\ \\ P,h' \\ l' (:\\) E)\"\n(*<*)\nproof(induct rule:red_reds_inducts)\n case RedNew thus ?case\n by(fast intro:lconf_hext red_hext_incr[OF red_reds.RedNew])\nnext\n case RedLAss thus ?case by(fastforce elim: lconf_upd simp:conf_def)\nnext\n case RedFAss thus ?case\n by(fast intro:lconf_hext red_hext_incr[OF red_reds.RedFAss])\nnext\n case (InitBlockRed e h l V v e' h' l' v' T T')\n have red: \"P \\ \\e, (h, l(V\\v))\\ \\ \\e',(h', l')\\\"\n and IH: \"\\T E . \\ P,E,h \\ e:T; P,h \\ l(V\\v) (:\\) E \\\n \\ P,h' \\ l' (:\\) E\"\n and l'V: \"l' V = Some v'\" and lconf: \"P,h \\ l (:\\) E\"\n and wt: \"P,E,h \\ {V:T := Val v; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover from IH lconf wt have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(auto simp del: fun_upd_apply simp: fun_upd_same lconf_upd2 conf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:split_if_asm)\nnext\n case (BlockRedNone e h l V e' h' l' T T')\n have red: \"P \\ \\e,(h, l(V := None))\\ \\ \\e',(h', l')\\\"\n and IH: \"\\E T. \\ P,E,h \\ e : T; P,h \\ l(V:=None) (:\\) E \\\n \\ P,h' \\ l' (:\\) E\"\n and lconf: \"P,h \\ l (:\\) E\" and wt: \"P,E,h \\ {V:T; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(rule IH, insert lconf wt, auto simp:lconf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:split_if_asm)\nnext\n case (BlockRedSome e h l V e' h' l' v T T')\n have red: \"P \\ \\e,(h, l(V := None))\\ \\ \\e',(h', l')\\\"\n and IH: \"\\E T. \\P,E,h \\ e : T; P,h \\ l(V:=None) (:\\) E\\\n \\ P,h' \\ l' (:\\) E\"\n and lconf: \"P,h \\ l (:\\) E\" and wt: \"P,E,h \\ {V:T; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(rule IH, insert lconf wt, auto simp:lconf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:split_if_asm)\nqed auto\n(*>*)\n\n\ntext{* Preservation of definite assignment more complex and requires a\nfew lemmas first. *}\n\n\n\n\nlemma red_lA_incr: \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ \\dom l\\ \\ \\ e \\ \\dom l'\\ \\ \\ e'\"\nand reds_lA_incr: \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ \\dom l\\ \\ \\s es \\ \\dom l'\\ \\ \\s es'\"\n(*<*)\napply(induct rule:red_reds_inducts)\napply(simp_all del:fun_upd_apply add:hyperset_defs)\napply auto\napply(blast dest:red_lcl_incr)+\ndone\n(*>*)\n\n\ntext{* Now preservation of definite assignment. *}\n\nlemma assumes wf: \"wf_J_prog P\"\nshows red_preserves_defass:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ \\ e \\dom l\\ \\ \\ e' \\dom l'\\\"\nand \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ \\s es \\dom l\\ \\ \\s es' \\dom l'\\\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case BinOpRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case FAssRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case CallObj thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n case RedCall thus ?case\n apply (auto dest!:sees_wf_mdecl[OF wf] simp:wf_mdecl_def elim!:D_mono')\n by(auto simp:hyperset_defs)\nnext\n case InitBlockRed thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case BlockRedNone thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case BlockRedSome thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case SeqRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case CondRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case TryRed thus ?case\n by (fastforce dest:red_lcl_incr intro:D_mono' simp:hyperset_defs)\nnext\n case ListRed1 thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n case RedWhile thus ?case by(auto simp:hyperset_defs elim!:D_mono')\nqed (auto simp:hyperset_defs)\n(*>*)\n\n\ntext{* Combining conformance of heap and local variables: *}\n\ndefinition sconf :: \"J_prog \\ env \\ state \\ bool\" (\"_,_ \\ _ \\\" [51,51,51]50)\nwhere\n \"P,E \\ s \\ \\ let (h,l) = s in P \\ h \\ \\ P,h \\ l (:\\) E\"\n\nlemma red_preserves_sconf:\n \"\\ P \\ \\e,s\\ \\ \\e',s'\\; P,E,hp s \\ e : T; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nby(fastforce intro:red_preserves_hconf red_preserves_lconf\n simp add:sconf_def)\n(*>*)\n\nlemma reds_preserves_sconf:\n \"\\ P \\ \\es,s\\ [\\] \\es',s'\\; P,E,hp s \\ es [:] Ts; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nby(fastforce intro:reds_preserves_hconf reds_preserves_lconf\n simp add:sconf_def)\n(*>*)\n\n\nsubsection \"Subject reduction\"\n\nlemma wt_blocks:\n \"\\E. \\ length Vs = length Ts; length vs = length Ts \\ \\\n (P,E,h \\ blocks(Vs,Ts,vs,e) : T) =\n (P,E(Vs[\\]Ts),h \\ e:T \\ (\\Ts'. map (typeof\\<^bsub>h\\<^esub>) vs = map Some Ts' \\ P \\ Ts' [\\] Ts))\"\n(*<*)\napply(induct Vs Ts vs e rule:blocks_induct)\napply (force simp add:rel_list_all2_Cons2)\napply simp_all\ndone\n(*>*)\n\n\n\n\n\ncorollary subject_reduction:\n \"\\ wf_J_prog P; P \\ \\e,s\\ \\ \\e',s'\\; P,E \\ s \\; P,E,hp s \\ e:T \\\n \\ \\T'. P,E,hp s' \\ e':T' \\ P \\ T' \\ T\"\n(*<*)by(cases s, cases s', fastforce dest:subject_reduction2)(*>*)\n\ncorollary subjects_reduction:\n \"\\ wf_J_prog P; P \\ \\es,s\\ [\\] \\es',s'\\; P,E \\ s \\; P,E,hp s \\ es[:]Ts \\\n \\ \\Ts'. P,E,hp s' \\ es'[:]Ts' \\ P \\ Ts' [\\] Ts\"\n(*<*)by(cases s, cases s', fastforce dest:subjects_reduction2)(*>*)\n\n\nsubsection {* Lifting to @{text\"\\*\"} *}\n\ntext{* Now all these preservation lemmas are first lifted to the transitive\nclosure \\dots *}\n\nlemma Red_preserves_sconf:\nassumes wf: \"wf_J_prog P\" and Red: \"P \\ \\e,s\\ \\* \\e',s'\\\"\nshows \"\\T. \\ P,E,hp s \\ e : T; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct2)\n case refl show ?case by fact\nnext\n case step thus ?case\n by(blast intro:red_preserves_sconf dest: subject_reduction[OF wf])\nqed\n(*>*)\n\n\nlemma Red_preserves_defass:\nassumes wf: \"wf_J_prog P\" and reds: \"P \\ \\e,s\\ \\* \\e',s'\\\"\nshows \"\\ e \\dom(lcl s)\\ \\ \\ e' \\dom(lcl s')\\\"\nusing reds\nproof (induct rule:converse_rtrancl_induct2)\n case refl thus ?case .\nnext\n case (step e s e' s') thus ?case\n by(cases s,cases s')(auto dest:red_preserves_defass[OF wf])\nqed\n\n\nlemma Red_preserves_type:\nassumes wf: \"wf_J_prog P\" and Red: \"P \\ \\e,s\\ \\* \\e',s'\\\"\nshows \"!!T. \\ P,E \\ s\\; P,E,hp s \\ e:T \\\n \\ \\T'. P \\ T' \\ T \\ P,E,hp s' \\ e':T'\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct2)\n case refl thus ?case by blast\nnext\n case step thus ?case\n by(blast intro:widen_trans red_preserves_sconf\n dest:subject_reduction[OF wf])\nqed\n(*>*)\n\n\nsubsection {* Lifting to @{text\"\\\"} *}\n\ntext{* \\dots and now to the big step semantics, just for fun. *}\n\nlemma eval_preserves_sconf:\n \"\\ wf_J_prog P; P \\ \\e,s\\ \\ \\e',s'\\; P,E \\ e::T; P,E \\ s\\ \\ \\ P,E \\ s'\\\"\n(*<*)\nby(blast intro:Red_preserves_sconf big_by_small WT_implies_WTrt wf_prog_wwf_prog)\n(*>*)\n\n\n\n\n\nsubsection \"The final polish\"\n\ntext{* The above preservation lemmas are now combined and packed nicely. *}\n\ndefinition wf_config :: \"J_prog \\ env \\ state \\ expr \\ ty \\ bool\" (\"_,_,_ \\ _ : _ \\\" [51,0,0,0,0]50)\nwhere\n \"P,E,s \\ e:T \\ \\ P,E \\ s \\ \\ P,E,hp s \\ e:T\"\n\ntheorem Subject_reduction: assumes wf: \"wf_J_prog P\"\nshows \"P \\ \\e,s\\ \\ \\e',s'\\ \\ P,E,s \\ e : T \\\n \\ \\T'. P,E,s' \\ e' : T' \\ \\ P \\ T' \\ T\"\n(*<*)\nby(force simp add: wf_config_def\n elim:red_preserves_sconf dest:subject_reduction[OF wf])\n(*>*)\n\n\ntheorem Subject_reductions:\nassumes wf: \"wf_J_prog P\" and reds: \"P \\ \\e,s\\ \\* \\e',s'\\\"\nshows \"\\T. P,E,s \\ e:T \\ \\ \\T'. P,E,s' \\ e':T' \\ \\ P \\ T' \\ T\"\n(*<*)\nusing reds\nproof (induct rule:converse_rtrancl_induct2)\n case refl thus ?case by blast\nnext\n case step thus ?case\n by(blast dest:Subject_reduction[OF wf] intro:widen_trans)\nqed\n(*>*)\n\n\ncorollary Progress: assumes wf: \"wf_J_prog P\"\nshows \"\\ P,E,s \\ e : T \\; \\ e \\dom(lcl s)\\; \\ final e \\ \\ \\e' s'. P \\ \\e,s\\ \\ \\e',s'\\\"\n(*<*)\nusing progress[OF wf_prog_wwf_prog[OF wf]]\nby(auto simp:wf_config_def sconf_def)\n(*>*)\n\n\ncorollary TypeSafety:\n \"\\ wf_J_prog P; P,E \\ s \\; P,E \\ e::T; \\ e \\dom(lcl s)\\;\n P \\ \\e,s\\ \\* \\e',s'\\; \\(\\e'' s''. P \\ \\e',s'\\ \\ \\e'',s''\\) \\\n \\ (\\v. e' = Val v \\ P,hp s' \\ v :\\ T) \\\n (\\a. e' = Throw a \\ a \\ dom(hp s'))\"\n(*<*)\napply(subgoal_tac \" P,E,s \\ e:T \\\")\n prefer 2\n apply(fastforce simp:wf_config_def dest:WT_implies_WTrt)\napply(frule (2) Subject_reductions)\napply(erule exE conjE)+\napply(frule (2) Red_preserves_defass)\napply(subgoal_tac \"final e'\")\n prefer 2\n apply(blast dest: Progress)\napply (fastforce simp:wf_config_def final_def conf_def dest: Progress)\ndone\n(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/J/TypeSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2538392343246956}} {"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System *)\n(* File: fmi_export.thy *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK) *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk *)\n(******************************************************************************)\n(* LAST REVIEWED: 18 Sep 2017 *)\n\nsection {* FMI {\\Circus} Model *}\n\ntheory fmi_export\nimports fmi\n \"../theories/utp_circus_prefix\"\nbegin recall_syntax\n\ndeclare [[syntax_ambiguity_warning = false]]\n\nsubsection {* Preliminaries *}\n\ntext {* The below cause ambiguities wrt their CSP definitions. *}\n\nhide_const utp_cml.Skip\nhide_const utp_cml.Stop\n\n(*\ntext {* I believe the following adjustments are not required anymore. *}\n\nsyntax\n \"_csp_sync\" :: \"logic \\ logic \\ logic\" (\"_ \\\\<^sub>u _\" [81, 80] 80)\n*)\n\ntext {* Undeclaring Simon's prefix notation (need to parse \\Interaction\\. *}\n\npurge_syntax\n \"_output_prefix\" :: \"('a, '\\) uexpr \\ prefix_elem'\" (\"!'(_')\")\n \"_output_prefix\" :: \"('a, '\\) uexpr \\ prefix_elem'\" (\".'(_')\")\n\nsubsection {* Lists as Tables *}\n\ntype_synonym ('a, 'b) table = \"('a \\ 'b) list\"\n\nfun lookup :: \"('a \\ 'b) list \\ 'a \\ 'b\" where\n\"lookup ((x, y) # t) v = (if v = x then y else (lookup t x))\" |\n\"lookup [] x = undefined\"\n\nsyntax \"_ulookup\" ::\n \"('a \\ 'b, '\\) uexpr \\ ('a, '\\) uexpr \\ ('b, '\\) uexpr\" (\"lookup\\<^sub>u\")\n\ntranslations \"lookup\\<^sub>u t x\" \\ \"(CONST bop) (CONST lookup) t x\"\n\nsubsection {* Instantiations *}\n\ntext {*\n The instantiations below are unsafe since the type @{typ uval} may actually\n have a higher cardinality than the continuum, depending on what HOL types we\n inject into it! This is why I decided to adopt a shallow state model for the\n \\Interaction\\ process. (An alternative would be to adopt an axiomatic model,\n which requires some remaining more work on integrating axiomatic variables.)\n Strictly speaking, axiomatic values are probably not needed since the only\n types that FMI 2.0 allows to be exchanged between FMUs are Real, Integer,\n String and Boolean, all of which can be injected into the deep model, too.\n*}\n\ninstance uval :: \"{continuum, two}\" sorry\ninstance uvar_ext :: (type) \"{continuum, two}\" sorry\n\nsubsection {* {\\Circus} Constructs *}\n\nsyntax \"_if_then_else\" ::\n \"'a upred \\ ('a, 'b) urel \\ ('a, 'b) urel \\ ('a, 'b) urel\"\n (\"(if\\<^sub>\\ (_)/ then\\<^sub>\\ (_)/ else\\<^sub>\\ (_))\" [0, 0, 10] 10)\n\ntranslations \"if\\<^sub>\\ b then\\<^sub>\\ P else\\<^sub>\\ Q\" \\ \"P \\ b \\\\<^sub>r Q\"\n\nsubsection {* \\Timer\\ Process *}\n\ntext {*\n A problem with the {\\Circus} process encoding below is that, currently, it\n is not possible to write mixed prefixes with both inputs and outputs. Hence,\n I had to use a trick converting everything into a single input prefix. That\n input imposes constraints so that some parts of the communication effectively\n behave like outputs. A second issue is that, referring to page 16 of D2.2d,\n we see that the @{text AllowGetsAndSets} action is actually parametric. My\n translation currently does not support parametric actions; hence I adopted\n a solution that encodes procedure parameters by local variables. Due to the\n proper treatment of scope by Isabelle/UTP, we generally get away with this.\n Both issues can thus be overcome; an integration of syntax translations that\n conceal the manual adjustments done below is pending work.\n*}\n\ntext {* \\todo{Write the same process as below with axiomatic variables.} *}\n\ndefinition\n\"process TimerOld1(ct::TIME('\\), hc::NZTIME('\\), tN::TIME('\\)) \\ begin\n state(vstore)\n Step =\n (tm:setT?(t : \\t \\ tN\\) \\\\<^sub>\\ ( := \\t\\) ;; Step) \\\n (tm:updateSS?(ss : true) \\\\<^sub>\\ ( := \\ss\\) ;; Step) \\\n (tm:step![out]((&, &)\\<^sub>u) \\\\<^sub>\\\n (> :=\n min\\<^sub>u(& + \\

(& pos>), \\tN\\)) ;; Step) \\\n ((& =\\<^sub>u \\tN\\) &\\<^sub>u tm:endc \\\\<^sub>\\ Stop)\n \\ (, := \\ct\\, \\hc\\) ;; Step\nend\"\n\ndefinition\n\"process TimerOld2(ct::TIME('\\), hc::NZTIME('\\), tN::TIME('\\)) \\ begin\n state(vstore)\n Step =\n (tm:setT?(t : \\t \\ tN\\) \\\\<^sub>\\ ( := \\t\\) ;; Step) \\\n (tm:updateSS?(ss) \\\\<^sub>\\ ( := \\ss\\) ;; Step) \\\n (tm:step![out\\<^sub>1]($)![out\\<^sub>2]($) \\\\<^sub>\\\n (> :=\n min\\<^sub>u(& + \\
(& pos>), \\tN\\)) ;; Step) \\\n ((& =\\<^sub>u \\tN\\) &\\<^sub>u tm:endc \\\\<^sub>\\ Stop)\n \\ (, := \\ct\\, \\hc\\) ;; Step\nend\"\n\nsubsubsection {* \\Interaction\\ Process *}\n\ntext {*\n Note that I changed the type of @{text rinps} with respect to the tentative\n model given in the deliverable D2.2d. That is, instead of using the partial\n function type @{typ \"FMI2COMP \\ (VAR \\ VAL)\"} for @{text rinps}, I decided\n to use the list @{typ \"((FMI2COMP \\ VAR) \\ VAL) list\"}. This is (currently)\n a technicality since there are issues with using function types in prefixes,\n to do with Simon's embedding of shallow variables. Using lists circumvents\n the issue for and ought not limit generality since we may reasonably assume\n that the port-dependency graph is a finite relation.\n*}\n\ntext {* Process State: \\rinps :: (port \\ VAL) list\\. *}\n\ndefinition\n\"process InteractionOld \\ begin\n state(vstore)\n Instantiation = (;; i : FMUs \\\n fmi:fmi2Instantiate?\\<^sub>u(i_sc : \\\\<^sub>1(\\i_sc\\) =\\<^sub>u \\i\\) \\ Skip) and\n\n InstantiationMode =\n (if\\<^sub>\\ \\parameters = []\\ then\\<^sub>\\\n (;; i : FMUs \\\n fmi:fmi2SetUpExperiment?\\<^sub>u(i_startTime_stopTimeDefined_stopTime_st :\n \\\\<^sub>1(\\i_startTime_stopTimeDefined_stopTime_st\\) =\\<^sub>u \\i\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)) =\\<^sub>u \\startTime\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\))) =\\<^sub>u \\stopTimeDefined\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)))) =\\<^sub>u \\stopTime\\)\n \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2EnterInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip)\n else\\<^sub>\\\n (;; i_x_v : parameters \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\\\<^sub>1(\\i_x_v\\) \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\\\<^sub>1(\\\\<^sub>2(\\i_x_v\\)) \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u \\\\<^sub>2(\\\\<^sub>2(\\i_x_v\\))) \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2SetUpExperiment?\\<^sub>u(i_startTime_stopTimeDefined_stopTime_st :\n \\\\<^sub>1(\\i_startTime_stopTimeDefined_stopTime_st\\) =\\<^sub>u \\i\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)) =\\<^sub>u \\startTime\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\))) =\\<^sub>u \\stopTimeDefined\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)))) =\\<^sub>u \\stopTime\\)\n \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2EnterInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip)) and\n\n InitializationMode =\n (if\\<^sub>\\ \\initialValues = []\\ then\\<^sub>\\\n (;; i : FMUs \\\n fmi:fmi2ExitInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip)\n else\\<^sub>\\\n (;; i_x_v : initialValues \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\\\<^sub>1(\\i_x_v\\) \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\\\<^sub>1(\\\\<^sub>2(\\i_x_v\\)) \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u \\\\<^sub>2(\\\\<^sub>2(\\i_x_v\\))) \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2ExitInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip)) and\n\n Terminated = (;; i : FMUs \\\n fmi:fmi2Terminate?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\\n fmi:fmi2FreeInstance?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip) ;;\n ctr:endsimulation \\\\<^sub>u Skip and\n\n TakeOutputs = VAL) list> := \\\\ ;;\n (;; out : outputs \\ fmi:fmi2Get?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\FMU out\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\name out\\) \\\n (;; inp : pdg out \\\n := & ^\\<^sub>u \\(\\inp\\, \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(&i_x_v_st))))\\<^sub>u\\)) and\n\n DistributeInputs = (;; inp : inputs \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\FMU inp\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\name inp\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u (lookup\\<^sub>u $ \\inp\\)) \\ Skip) and\n\n Step = (;; i : [0..(length FMUs)] \\\n (if (i::int) = 0 then\n ctr:stepToComplete \\\\<^sub>u\n (fmi:fmi2DoStep?\\<^sub>u(i_t_hc_st :\n \\\\<^sub>1(\\i_t_hc_st\\) =\\<^sub>u \\nth FMUs 1\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_t_hc_st\\)) =\\<^sub>u $ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_t_hc_st\\))) =\\<^sub>u $) \\ Skip)\n else if (i::int) < (length FMUs) then\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated?\\<^sub>u(i_b_st :\n \\\\<^sub>1(\\i_b_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X) \\\n (fmi:fmi2GetMaxStepSize?\\<^sub>u(i_t_st :\n \\\\<^sub>1(\\i_t_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X)) \\\n (fmi:fmi2DoStep?\\<^sub>u(i_t_hc_st :\n \\\\<^sub>1(\\i_t_hc_st\\) =\\<^sub>u \\nth FMUs (nat (i+1))\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_t_hc_st\\)) =\\<^sub>u $ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_t_hc_st\\))) =\\<^sub>u $) \\ Skip)\n else\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated?\\<^sub>u(i_b_st :\n \\\\<^sub>1(\\i_b_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X) \\\n (fmi:fmi2GetMaxStepSize?\\<^sub>u(i_t_st :\n \\\\<^sub>1(\\i_t_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X)) \\\n (ctr:stepAnalysed \\\\<^sub>u Skip))) and\n\n slaveInitialized =\n (tm:endc \\\\<^sub>u Terminated) \\\n (tm:step?\\<^sub>u(t_hc : true) \\\n (* Used local variables to pass action parameters! *)\n (, := \\\\<^sub>1(&t_hc), \\\\<^sub>2(&t_hc)) ;;\n TakeOutputs ;; DistributeInputs ;; Step) and\n\n NextStep =\n (tm:updateSS?\\<^sub>u(d : true) \\ NextStep) \\\n (tm:setT?\\<^sub>u(t : true) \\ NextStep) \\\n (slaveInitialized ;; NextStep) \\\n (Terminated)\n\n \\ Instantiation ;; InstantiationMode ;; InitializationMode ;; slaveInitialized\nend\"\n\ntheorem \"P InteractionOld\"\napply (unfold InteractionOld_def)\napply (simp add: circus_syntax Let_def)\noops\n\ntext {* A simplified definition of the same (?) process is given below. *}\n\ndefinition\n\"process InteractionSimplified \\ begin\n state(vstore)\n Instantiation = (;; i : FMUs \\\n fmi:fmi2Instantiate?\\<^sub>u(i_sc : \\\\<^sub>1(\\i_sc\\) =\\<^sub>u \\i\\) \\ Skip) and\n\n InstantiationMode =\n (;; i_x_v : parameters \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\\\<^sub>1(\\i_x_v\\) \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\\\<^sub>1(\\\\<^sub>2(\\i_x_v\\)) \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u \\\\<^sub>2(\\\\<^sub>2(\\i_x_v\\))) \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2SetUpExperiment?\\<^sub>u(i_startTime_stopTimeDefined_stopTime_st :\n \\\\<^sub>1(\\i_startTime_stopTimeDefined_stopTime_st\\) =\\<^sub>u \\i\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)) =\\<^sub>u \\startTime\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\))) =\\<^sub>u \\stopTimeDefined\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\\\<^sub>2(\\i_startTime_stopTimeDefined_stopTime_st\\)))) =\\<^sub>u \\stopTime\\)\n \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2EnterInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip) and\n\n InitializationMode =\n (;; i_x_v : initialValues \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\\\<^sub>1(\\i_x_v\\) \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\\\<^sub>1(\\\\<^sub>2(\\i_x_v\\)) \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u \\\\<^sub>2(\\\\<^sub>2(\\i_x_v\\))) \\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2ExitInitializationMode?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip) and\n\n Terminated = (;; i : FMUs \\\n fmi:fmi2Terminate?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\\n fmi:fmi2FreeInstance?\\<^sub>u(i_st : \\\\<^sub>1(\\i_st\\) =\\<^sub>u \\i\\) \\ Skip) ;;\n ctr:endsimulation \\\\<^sub>u Skip and\n\n TakeOutputs = VAL) list> := \\\\ ;;\n (;; out : outputs \\ fmi:fmi2Get?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\FMU out\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\name out\\) \\\n (;; inp : pdg out \\\n := & ^\\<^sub>u \\(\\inp\\, \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(&i_x_v_st))))\\<^sub>u\\)) and\n\n DistributeInputs = (;; inp : inputs \\\n fmi:fmi2Set?\\<^sub>u(i_x_v_st :\n \\\\<^sub>1(\\i_x_v_st\\) =\\<^sub>u \\FMU inp\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_x_v_st\\)) =\\<^sub>u \\name inp\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_x_v_st\\))) =\\<^sub>u (lookup\\<^sub>u $ \\inp\\)) \\ Skip) and\n\n Step = (;; i : [0..(length FMUs)] \\\n (if (i::int) = 0 then\n ctr:stepToComplete \\\\<^sub>u\n (fmi:fmi2DoStep?\\<^sub>u(i_t_hc_st :\n \\\\<^sub>1(\\i_t_hc_st\\) =\\<^sub>u \\nth FMUs 1\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_t_hc_st\\)) =\\<^sub>u $ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_t_hc_st\\))) =\\<^sub>u $) \\ Skip)\n else if (i::int) < (length FMUs) then\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated?\\<^sub>u(i_b_st :\n \\\\<^sub>1(\\i_b_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X) \\\n (fmi:fmi2GetMaxStepSize?\\<^sub>u(i_t_st :\n \\\\<^sub>1(\\i_t_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X)) \\\n (fmi:fmi2DoStep?\\<^sub>u(i_t_hc_st :\n \\\\<^sub>1(\\i_t_hc_st\\) =\\<^sub>u \\nth FMUs (nat (i+1))\\ \\\n \\\\<^sub>1(\\\\<^sub>2(\\i_t_hc_st\\)) =\\<^sub>u $ \\\n \\\\<^sub>1(\\\\<^sub>2(\\\\<^sub>2(\\i_t_hc_st\\))) =\\<^sub>u $) \\ Skip)\n else\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated?\\<^sub>u(i_b_st :\n \\\\<^sub>1(\\i_b_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X) \\\n (fmi:fmi2GetMaxStepSize?\\<^sub>u(i_t_st :\n \\\\<^sub>1(\\i_t_st\\) =\\<^sub>u \\nth FMUs (nat i)\\) \\ X)) \\\n (ctr:stepAnalysed \\\\<^sub>u Skip))) and\n\n slaveInitialized =\n (tm:endc \\\\<^sub>u Terminated) \\\n (tm:step?\\<^sub>u(t_hc : true) \\\n (* Used local variables to pass action parameters! *)\n (, := \\\\<^sub>1(&t_hc), \\\\<^sub>2(&t_hc)) ;;\n TakeOutputs ;; DistributeInputs ;; Step) and\n\n NextStep =\n (tm:updateSS?\\<^sub>u(d : true) \\ NextStep) \\\n (tm:setT?\\<^sub>u(t : true) \\ NextStep) \\\n (slaveInitialized ;; NextStep) \\\n (Terminated)\n\n \\ Instantiation ;; InstantiationMode ;; InitializationMode ;; slaveInitialized\nend\"\n\ndefinition\n\"process InteractionNew \\ begin\n state(vstore)\n Instantiation = (;; i : FMUs \\\n fmi:fmi2Instantiate.[out\\<^sub>1](\\i\\)?(sc) \\\\<^sub>\\ Skip) and\n\n InstantiationMode =\n (;; (i, x, v) : parameters \\\n fmi:fmi2Set![out\\<^sub>1](\\i\\)![out\\<^sub>2](\\x\\)![out\\<^sub>3](\\v\\)?(st) \\\\<^sub>\\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2SetUpExperiment![out\\<^sub>1](\\i\\)![out\\<^sub>2](\\startTime\\)\n ![out\\<^sub>3](\\stopTimeDefined\\)![out\\<^sub>4](\\stopTime\\)?(st) \\\\<^sub>\\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2EnterInitializationMode.[out\\<^sub>1](\\i\\)?(sc) \\\\<^sub>\\ Skip) and\n\n InitializationMode =\n (;; (i, x, v) : initialValues \\\n fmi:fmi2Set![out\\<^sub>1](\\i\\)![out\\<^sub>2](\\x\\)![out\\<^sub>3](\\v\\)?(st) \\\\<^sub>\\ Skip) ;;\n (;; i : FMUs \\\n fmi:fmi2ExitInitializationMode![out\\<^sub>1](\\i\\)?(sc) \\\\<^sub>\\ Skip) and\n\n Terminated =\n (;; i : FMUs \\\n fmi:fmi2Terminate.[out\\<^sub>1](\\i\\)?(sc) \\\\<^sub>\\\n fmi:fmi2FreeInstance.[out\\<^sub>1](\\i\\)?(sc) \\\\<^sub>\\ Skip) ;;\n ctr:endsimulation \\\\<^sub>\\ Skip and\n\n TakeOutputs = VAL) list> := \\\\ ;;\n (;; out : outputs \\\n fmi:fmi2Get.[out\\<^sub>1](\\FMU out\\).[out\\<^sub>2](\\name out\\)?(v)?(st) \\\\<^sub>\\\n (;; inp : pdg out \\ := & ^\\<^sub>u \\(\\inp\\, \\v\\)\\<^sub>u\\)) and\n\n DistributeInputs = (;; inp : inputs \\\n fmi:fmi2Set.[out\\<^sub>1](\\FMU inp\\).[out\\<^sub>2](\\name inp\\)\n ![out\\<^sub>3](lookup\\<^sub>u $ \\inp\\)?(st) \\\\<^sub>\\ Skip) and\n\n Step = (;; i : [0..(length FMUs)] \\\n (if (i::int) = 0 then\n ctr:stepToComplete \\\\<^sub>\\\n (fmi:fmi2DoStep.[out\\<^sub>1](\\FMUs!0\\).[out\\<^sub>2]($).[out\\<^sub>3]($)?(st) \\\\<^sub>\\ Skip)\n else if (i::int) < (length FMUs) then\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated.[out\\<^sub>1](\\FMUs!(nat (i-1))\\)?(b)?(st) \\\\<^sub>\\ X) \\\n (fmi:fmi2GetMaxStepSize.[out\\<^sub>1](\\FMUs!(nat (i-1))\\)?(t)?(st) \\\\<^sub>\\ X)) \\\n (fmi:fmi2DoStep.[out\\<^sub>1](\\FMUs!(nat i)\\).[out\\<^sub>2]($).[out\\<^sub>3]($)?(st) \\\\<^sub>\\ Skip)\n else\n (\\ X \\\n (fmi:fmi2GetBooleanStatusfmi2Terminated.[out\\<^sub>1](\\FMUs!(nat (i-1))\\)?(b)?(st) \\\\<^sub>\\ X) \\\n (fmi:fmi2GetMaxStepSize.[out\\<^sub>1](\\FMUs!(nat (i-1))\\)?(t)?(st) \\\\<^sub>\\ X)) \\\n (ctr:stepAnalysed \\\\<^sub>\\ Skip))) and\n\n slaveInitialized =\n (tm:endc \\\\<^sub>\\ Terminated) \\\n (tm:step?(t)?(hc) \\\\<^sub>\\\n (* We use local variables to pass action parameters! *)\n (, := \\t\\, \\hc\\) ;;\n TakeOutputs ;; DistributeInputs ;; Step) and\n\n NextStep =\n (tm:updateSS?(d) \\\\<^sub>\\ NextStep) \\\n (tm:setT?(t) \\\\<^sub>\\ NextStep) \\\n (slaveInitialized ;; NextStep) \\\n (Terminated)\n\n \\ Instantiation ;; InstantiationMode ;; InitializationMode ;; slaveInitialized\nend\"\n\ntheorem \"P InteractionNew\"\napply (unfold InteractionNew_def)\napply (simp add: circus_syntax Let_def)\noops\n\nsubsubsection {* \\FMUStatesManager\\ Process *}\n\ndefinition\n\"process FMUStatesManagerOld1(i::FMI2COMP) \\ begin\n state(vstore)\n AllowsGetsAndSets =\n (fmi:fmi2GetFMUState?\\<^sub>u(i_s_st : \\\\<^sub>1(\\i_s_st\\) =\\<^sub>u \\i\\) \\\n ( := \\\\<^sub>1(\\\\<^sub>2(&i_s_st)) ;; AllowsGetsAndSets)) \\\n (fmi:fmi2SetFMUState?\\<^sub>u(i_s_st : \\\\<^sub>1(\\i_s_st\\) =\\<^sub>u \\i\\ \\ \\\\<^sub>1(\\\\<^sub>2(\\i_s_st\\)) =\\<^sub>u $) \\\n ( := \\\\<^sub>1(\\\\<^sub>2(&i_s_st)) ;; AllowsGetsAndSets)) and\n AllowAGet =\n (fmi:fmi2GetFMUState?\\<^sub>u(i_s_st : \\\\<^sub>1(\\i_s_st\\) =\\<^sub>u \\i\\) \\\n ( := \\\\<^sub>1(\\\\<^sub>2(&i_s_st)) ;; AllowsGetsAndSets))\n \\ fmi:fmi2Instantiate?\\<^sub>u(i_b : \\\\<^sub>1(\\i_b\\) =\\<^sub>u \\i\\) \\ AllowAGet\nend\"\n\ndefinition\n\"process FMUStatesManagerOld2(i::FMI2COMP) \\ begin\n state(vstore)\n AllowsGetsAndSets =\n (fmi:fmi2GetFMUState![out](\\i\\)?(s)?(st) \\\\<^sub>\\ ( := \\s\\) ;; AllowsGetsAndSets) \\\n (fmi:fmi2SetFMUState![out\\<^sub>1](\\i\\)![out\\<^sub>2](&) \\\\<^sub>\\ AllowsGetsAndSets) and\n AllowAGet =\n (fmi:fmi2GetFMUState![out](\\i\\)?(s)?(st) \\\\<^sub>\\ ( := \\s\\) ;; AllowsGetsAndSets)\n \\ fmi:fmi2Instantiate![out](\\i\\)?(b) \\\\<^sub>\\ AllowAGet\nend\"\n\nsubsection {* Proof Experiments *}\n\nterm \"setT!\\<^sub>u(\\0\\) \\ SKIP\"\nterm \"InputCSP setT x\"\nterm \"\\''x''\\\\<^sub>d\"\nterm \"(dvar_lens \\''x''\\\\<^sub>d)\"\nterm \"\\''x''\\\\<^sub>d\\\"\nterm \"InputCircus setT (\\''x''\\\\<^sub>d\\)\"\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/fmi_export.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.25378200506022475}} {"text": "(*<*)\ntheory Monitor\n imports\n Formula\n Optimized_Join\n \"MFOTL_Monitor.Abstract_Monitor\"\n \"HOL-Library.While_Combinator\"\n \"HOL-Library.Mapping\"\n \"Deriving.Derive\"\n \"Generic_Join.Generic_Join_Correctness\"\nbegin\n(*>*)\n\nsection \\Generic monitoring algorithm\\\n\ntext \\The algorithm defined here abstracts over the implementation of the temporal operators.\\\n\nsubsection \\Monitorable formulas\\\n\ndefinition \"mmonitorable \\ \\ safe_formula \\ \\ Formula.future_bounded \\\"\ndefinition \"mmonitorable_regex b g r \\ safe_regex b g r \\ Regex.pred_regex Formula.future_bounded r\"\n\ndefinition is_simple_eq :: \"Formula.trm \\ Formula.trm \\ bool\" where\n \"is_simple_eq t1 t2 = (Formula.is_Const t1 \\ (Formula.is_Const t2 \\ Formula.is_Var t2) \\\n Formula.is_Var t1 \\ Formula.is_Const t2)\"\n\nfun mmonitorable_exec :: \"Formula.formula \\ bool\" where\n \"mmonitorable_exec (Formula.Eq t1 t2) = is_simple_eq t1 t2\"\n| \"mmonitorable_exec (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var y))) = (x = y)\"\n| \"mmonitorable_exec (Formula.Pred e ts) = list_all (\\t. Formula.is_Var t \\ Formula.is_Const t) ts\"\n| \"mmonitorable_exec (Formula.Let p \\ \\) = ({0..} \\ Formula.fv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Neg \\) = (fv \\ = {} \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Or \\ \\) = (fv \\ = fv \\ \\ mmonitorable_exec \\ \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.And \\ \\) = (mmonitorable_exec \\ \\\n (safe_assignment (fv \\) \\ \\ mmonitorable_exec \\ \\\n fv \\ \\ fv \\ \\ (is_constraint \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))))\"\n| \"mmonitorable_exec (Formula.Ands l) = (let (pos, neg) = partition mmonitorable_exec l in\n pos \\ [] \\ list_all mmonitorable_exec (map remove_neg neg) \\\n \\(set (map fv neg)) \\ \\(set (map fv pos)))\"\n| \"mmonitorable_exec (Formula.Exists \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Agg y \\ b f \\) = (mmonitorable_exec \\ \\\n y + b \\ Formula.fv \\ \\ {0.. Formula.fv \\ \\ Formula.fv_trm f \\ Formula.fv \\)\"\n| \"mmonitorable_exec (Formula.Prev I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Next I \\) = (mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Since \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.Until \\ I \\) = (Formula.fv \\ \\ Formula.fv \\ \\ right I \\ \\ \\\n (mmonitorable_exec \\ \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False)) \\ mmonitorable_exec \\)\"\n| \"mmonitorable_exec (Formula.MatchP I r) = Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Past Strict r\"\n| \"mmonitorable_exec (Formula.MatchF I r) = (Regex.safe_regex Formula.fv (\\g \\. mmonitorable_exec \\ \\ (g = Lax \\ (case \\ of Formula.Neg \\' \\ mmonitorable_exec \\' | _ \\ False))) Futu Strict r \\ right I \\ \\)\"\n| \"mmonitorable_exec _ = False\"\n\nlemma cases_Neg_iff:\n \"(case \\ of formula.Neg \\ \\ P \\ | _ \\ False) \\ (\\\\. \\ = formula.Neg \\ \\ P \\)\"\n by (cases \\) auto\n\nlemma safe_formula_mmonitorable_exec: \"safe_formula \\ \\ Formula.future_bounded \\ \\ mmonitorable_exec \\\"\nproof (induct \\ rule: safe_formula.induct)\n case (8 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (9 \\ \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (10 l)\n from \"10.prems\"(2) have bounded: \"Formula.future_bounded \\\" if \"\\ \\ set l\" for \\\n using that by (auto simp: list.pred_set)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have \"set poss \\ set posm\"\n proof (rule subsetI)\n fix x assume \"x \\ set poss\"\n then have \"x \\ set l\" \"safe_formula x\" using posnegs by simp_all\n then have \"mmonitorable_exec x\" using \"10.hyps\"(1) bounded by blast\n then show \"x \\ set posm\" using \\x \\ set poss\\ posnegm posnegs by simp\n qed\n then have \"set negm \\ set negs\" using posnegm posnegs by auto\n obtain \"poss \\ []\" \"list_all safe_formula (map remove_neg negs)\"\n \"(\\x\\set negs. fv x) \\ (\\x\\set poss. fv x)\"\n using \"10.prems\"(1) posnegs by simp\n then have \"posm \\ []\" using \\set poss \\ set posm\\ by auto\n moreover have \"list_all mmonitorable_exec (map remove_neg negm)\"\n proof -\n let ?l = \"map remove_neg negm\"\n have \"\\x. x \\ set ?l \\ mmonitorable_exec x\"\n proof -\n fix x assume \"x \\ set ?l\"\n then obtain y where \"y \\ set negm\" \"x = remove_neg y\" by auto\n then have \"y \\ set negs\" using \\set negm \\ set negs\\ by blast\n then have \"safe_formula x\"\n unfolding \\x = remove_neg y\\ using \\list_all safe_formula (map remove_neg negs)\\\n by (simp add: list_all_def)\n show \"mmonitorable_exec x\"\n proof (cases \"\\z. y = Formula.Neg z\")\n case True\n then obtain z where \"y = Formula.Neg z\" by blast\n then show ?thesis\n using \"10.hyps\"(2)[OF posnegs refl] \\x = remove_neg y\\ \\y \\ set negs\\ posnegs bounded\n \\safe_formula x\\ by fastforce\n next\n case False\n then have \"remove_neg y = y\" by (cases y) simp_all\n then have \"y = x\" unfolding \\x = remove_neg y\\ by simp\n show ?thesis\n using \"10.hyps\"(1) \\y \\ set negs\\ posnegs \\safe_formula x\\ unfolding \\y = x\\\n by auto\n qed\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n moreover have \"(\\x\\set negm. fv x) \\ (\\x\\set posm. fv x)\"\n using \\\\ (fv ` set negs) \\ \\ (fv ` set poss)\\ \\set poss \\ set posm\\ \\set negm \\ set negs\\\n by fastforce\n ultimately show ?case using posnegm by simp\nnext\n case (15 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (16 \\ I \\)\n then show ?case\n unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps\n by (auto simp: cases_Neg_iff)\nnext\n case (17 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nnext\n case (18 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)\nqed (auto simp add: is_simple_eq_def list.pred_set)\n\nlemma safe_assignment_future_bounded: \"safe_assignment X \\ \\ Formula.future_bounded \\\"\n unfolding safe_assignment_def by (auto split: formula.splits)\n\nlemma is_constraint_future_bounded: \"is_constraint \\ \\ Formula.future_bounded \\\"\n by (induction rule: is_constraint.induct) simp_all\n\nlemma mmonitorable_exec_mmonitorable: \"mmonitorable_exec \\ \\ mmonitorable \\\"\nproof (induct \\ rule: mmonitorable_exec.induct)\n case (7 \\ \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (auto simp: cases_Neg_iff intro: safe_assignment_future_bounded is_constraint_future_bounded)\nnext\n case (8 l)\n obtain poss negs where posnegs: \"(poss, negs) = partition safe_formula l\" by simp\n obtain posm negm where posnegm: \"(posm, negm) = partition mmonitorable_exec l\" by simp\n have pos_monitorable: \"list_all mmonitorable_exec posm\" using posnegm by (simp add: list_all_iff)\n have neg_monitorable: \"list_all mmonitorable_exec (map remove_neg negm)\"\n using \"8.prems\" posnegm by (simp add: list_all_iff)\n have \"set posm \\ set poss\"\n using \"8.hyps\"(1) posnegs posnegm unfolding mmonitorable_def by auto\n then have \"set negs \\ set negm\"\n using posnegs posnegm by auto\n\n have \"poss \\ []\" using \"8.prems\" posnegm \\set posm \\ set poss\\ by auto\n moreover have \"list_all safe_formula (map remove_neg negs)\"\n using neg_monitorable \"8.hyps\"(2)[OF posnegm refl] \\set negs \\ set negm\\\n unfolding mmonitorable_def by (auto simp: list_all_iff)\n moreover have \"\\ (fv ` set negm) \\ \\ (fv ` set posm)\"\n using \"8.prems\" posnegm by simp\n then have \"\\ (fv ` set negs) \\ \\ (fv ` set poss)\"\n using \\set posm \\ set poss\\ \\set negs \\ set negm\\ by fastforce\n ultimately have \"safe_formula (Formula.Ands l)\" using posnegs by simp\n moreover have \"Formula.future_bounded (Formula.Ands l)\"\n proof -\n have \"list_all Formula.future_bounded posm\"\n using pos_monitorable \"8.hyps\"(1) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n moreover have fnegm: \"list_all Formula.future_bounded (map remove_neg negm)\"\n using neg_monitorable \"8.hyps\"(2) posnegm unfolding mmonitorable_def\n by (auto elim!: list.pred_mono_strong)\n then have \"list_all Formula.future_bounded negm\"\n proof -\n have \"\\x. x \\ set negm \\ Formula.future_bounded x\"\n proof -\n fix x assume \"x \\ set negm\"\n have \"Formula.future_bounded (remove_neg x)\" using fnegm \\x \\ set negm\\ by (simp add: list_all_iff)\n then show \"Formula.future_bounded x\" by (cases x) auto\n qed\n then show ?thesis by (simp add: list_all_iff)\n qed\n ultimately have \"list_all Formula.future_bounded l\" using posnegm by (auto simp: list_all_iff)\n then show ?thesis by (auto simp: list_all_iff)\n qed\n ultimately show ?case unfolding mmonitorable_def ..\nnext\n case (13 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: cases_Neg_iff)\nnext\n case (14 \\ I \\)\n then show ?case\n unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps\n by (fastforce simp: one_enat_def cases_Neg_iff)\nnext\n case (15 I r)\n then show ?case\n by (auto elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nnext\n case (16 I r)\n then show ?case\n by (auto 0 3 elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]\n simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)\nqed (auto simp add: mmonitorable_def mmonitorable_regex_def is_simple_eq_def one_enat_def list.pred_set)\n\nlemma monitorable_formula_code[code]: \"mmonitorable \\ = mmonitorable_exec \\\"\n using mmonitorable_exec_mmonitorable safe_formula_mmonitorable_exec mmonitorable_def\n by blast\n\nsubsection \\Handling regular expressions\\\n\ndatatype mregex =\n MSkip nat\n | MTestPos nat\n | MTestNeg nat\n | MPlus mregex mregex\n | MTimes mregex mregex\n | MStar mregex\n\nprimrec ok where\n \"ok _ (MSkip n) = True\"\n| \"ok m (MTestPos n) = (n < m)\"\n| \"ok m (MTestNeg n) = (n < m)\"\n| \"ok m (MPlus r s) = (ok m r \\ ok m s)\"\n| \"ok m (MTimes r s) = (ok m r \\ ok m s)\"\n| \"ok m (MStar r) = ok m r\"\n\nprimrec from_mregex where\n \"from_mregex (MSkip n) _ = Regex.Skip n\"\n| \"from_mregex (MTestPos n) \\s = Regex.Test (\\s ! n)\"\n| \"from_mregex (MTestNeg n) \\s = (if safe_formula (Formula.Neg (\\s ! n))\n then Regex.Test (Formula.Neg (Formula.Neg (Formula.Neg (\\s ! n))))\n else Regex.Test (Formula.Neg (\\s ! n)))\"\n| \"from_mregex (MPlus r s) \\s = Regex.Plus (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MTimes r s) \\s = Regex.Times (from_mregex r \\s) (from_mregex s \\s)\"\n| \"from_mregex (MStar r) \\s = Regex.Star (from_mregex r \\s)\"\n\nprimrec to_mregex_exec where\n \"to_mregex_exec (Regex.Skip n) xs = (MSkip n, xs)\"\n| \"to_mregex_exec (Regex.Test \\) xs = (if safe_formula \\ then (MTestPos (length xs), xs @ [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg (length xs), xs @ [\\']) | _ \\ (MSkip 0, xs))\"\n| \"to_mregex_exec (Regex.Plus r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MPlus mr ms, zs))\"\n| \"to_mregex_exec (Regex.Times r s) xs =\n (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys\n in (MTimes mr ms, zs))\"\n| \"to_mregex_exec (Regex.Star r) xs =\n (let (mr, ys) = to_mregex_exec r xs in (MStar mr, ys))\"\n\nprimrec shift where\n \"shift (MSkip n) k = MSkip n\"\n| \"shift (MTestPos i) k = MTestPos (i + k)\"\n| \"shift (MTestNeg i) k = MTestNeg (i + k)\"\n| \"shift (MPlus r s) k = MPlus (shift r k) (shift s k)\"\n| \"shift (MTimes r s) k = MTimes (shift r k) (shift s k)\"\n| \"shift (MStar r) k = MStar (shift r k)\"\n\nprimrec to_mregex where\n \"to_mregex (Regex.Skip n) = (MSkip n, [])\"\n| \"to_mregex (Regex.Test \\) = (if safe_formula \\ then (MTestPos 0, [\\])\n else case \\ of Formula.Neg \\' \\ (MTestNeg 0, [\\']) | _ \\ (MSkip 0, []))\"\n| \"to_mregex (Regex.Plus r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MPlus mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Times r s) =\n (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s\n in (MTimes mr (shift ms (length ys)), ys @ zs))\"\n| \"to_mregex (Regex.Star r) =\n (let (mr, ys) = to_mregex r in (MStar mr, ys))\"\n\nlemma shift_0: \"shift r 0 = r\"\n by (induct r) auto\n\nlemma shift_shift: \"shift (shift r k) j = shift r (k + j)\"\n by (induct r) auto\n\nlemma to_mregex_to_mregex_exec:\n \"case to_mregex r of (mr, \\s) \\ to_mregex_exec r xs = (shift mr (length xs), xs @ \\s)\"\n by (induct r arbitrary: xs)\n (auto simp: shift_shift ac_simps split: formula.splits prod.splits)\n\nlemma to_mregex_to_mregex_exec_Nil[code]: \"to_mregex r = to_mregex_exec r []\"\n using to_mregex_to_mregex_exec[where xs=\"[]\" and r = r] by (auto simp: shift_0)\n\nlemma ok_mono: \"ok m mr \\ m \\ n \\ ok n mr\"\n by (induct mr) auto\n\nlemma from_mregex_cong: \"ok m mr \\ (\\i < m. xs ! i = ys ! i) \\ from_mregex mr xs = from_mregex mr ys\"\n by (induct mr) auto\n\nlemma not_Neg_cases:\n \"(\\\\. \\ \\ Formula.Neg \\) \\ (case \\ of formula.Neg \\ \\ f \\ | _ \\ x) = x\"\n by (cases \\) auto\n\nlemma to_mregex_exec_ok:\n \"to_mregex_exec r xs = (mr, ys) \\ \\zs. ys = xs @ zs \\ set zs = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: xs mr ys)\n case (Skip x)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)\nnext\n case (Star r)\n then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\nqed\n\nlemma ok_shift: \"ok (i + m) (Monitor.shift r i) \\ ok m r\"\n by (induct r) auto\n\nlemma to_mregex_ok: \"to_mregex r = (mr, ys) \\ set ys = atms r \\ ok (length ys) mr\"\nproof (induct r arbitrary: mr ys)\n case (Skip x)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Test x)\n show ?case proof (cases \"\\x'. x = Formula.Neg x'\")\n case True\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)\n next\n case False\n with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)\n qed\nnext\n case (Plus r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Times r1 r2)\n then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)\nnext\n case (Star r)\n then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)\nqed\n\nlemma from_mregex_shift: \"from_mregex (shift r (length xs)) (xs @ ys) = from_mregex r ys\"\n by (induct r) (auto simp: nth_append)\n\nlemma from_mregex_to_mregex: \"safe_regex m g r \\ case_prod from_mregex (to_mregex r) = r\"\n by (induct r rule: safe_regex.induct)\n (auto dest: to_mregex_ok intro!: from_mregex_cong simp: nth_append from_mregex_shift cases_Neg_iff\n split: prod.splits modality.splits)\n\nlemma from_mregex_eq: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ from_mregex mr \\s = r\"\n using from_mregex_to_mregex[of m g r] by auto\n\nlemma from_mregex_to_mregex_exec: \"safe_regex m g r \\ case_prod from_mregex (to_mregex_exec r xs) = r\"\nproof (induct r arbitrary: xs rule: safe_regex_induct)\n case (Plus b g r s)\n from Plus(3) Plus(1)[of xs] Plus(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesF g r s)\n from TimesF(3) TimesF(2)[of xs] TimesF(1)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (TimesP g r s)\n from TimesP(3) TimesP(1)[of xs] TimesP(2)[of \"snd (to_mregex_exec r xs)\"] show ?case\n by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok\n intro!: from_mregex_cong[where m = \"length (snd (to_mregex_exec r xs))\"])\nnext\n case (Star b g r)\n from Star(2) Star(1)[of xs] show ?case\n by (auto split: prod.splits)\nqed (auto split: prod.splits simp: cases_Neg_iff)\n\n\nderive linorder mregex\n\nsubsubsection \\LPD\\\n\ndefinition saturate where\n \"saturate f = while (\\S. f S \\ S) f\"\n\nlemma saturate_code[code]:\n \"saturate f S = (let S' = f S in if S' = S then S else saturate f S')\"\n unfolding saturate_def Let_def\n by (subst while_unfold) auto\n\ndefinition \"MTimesL r S = MTimes r ` S\"\ndefinition \"MTimesR R s = (\\r. MTimes r s) ` R\"\n\nprimrec LPD where\n \"LPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"LPD (MTestPos \\) = {}\"\n| \"LPD (MTestNeg \\) = {}\"\n| \"LPD (MPlus r s) = (LPD r \\ LPD s)\"\n| \"LPD (MTimes r s) = MTimesR (LPD r) s \\ LPD s\"\n| \"LPD (MStar r) = MTimesR (LPD r) (MStar r)\"\n\nprimrec LPDi where\n \"LPDi 0 r = {r}\"\n| \"LPDi (Suc i) r = (\\s \\ LPD r. LPDi i s)\"\n\nlemma LPDi_Suc_alt: \"LPDi (Suc i) r = (\\s \\ LPDi i r. LPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"LPDs r = (\\i. LPDi i r)\"\n\nlemma LPDs_refl: \"r \\ LPDs r\"\n by (auto simp: LPDs_def intro: exI[of _ 0])\nlemma LPDs_trans: \"r \\ LPD s \\ s \\ LPDs t \\ r \\ LPDs t\"\n by (force simp: LPDs_def LPDi_Suc_alt simp del: LPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma LPDi_Test:\n \"LPDi i (MSkip 0) \\ {MSkip 0}\"\n \"LPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma LPDs_Test:\n \"LPDs (MSkip 0) \\ {MSkip 0}\"\n \"LPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"LPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding LPDs_def using LPDi_Test by blast+\n\nlemma LPDi_MSkip: \"LPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF LPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma LPDs_MSkip: \"LPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding LPDs_def using LPDi_MSkip by auto\n\nlemma LPDi_Plus: \"LPDi i (MPlus r s) \\ {MPlus r s} \\ LPDi i r \\ LPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma LPDs_Plus: \"LPDs (MPlus r s) \\ {MPlus r s} \\ LPDs r \\ LPDs s\"\n unfolding LPDs_def using LPDi_Plus[of _ r s] by auto\n\nlemma LPDi_Times:\n \"LPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesR (\\j \\ i. LPDi j r) s \\ (\\j \\ i. LPDi j s)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesR_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma LPDs_Times: \"LPDs (MTimes r s) \\ {MTimes r s} \\ MTimesR (LPDs r) s \\ LPDs s\"\n unfolding LPDs_def using LPDi_Times[of _ r s] by (force simp: MTimesR_def)\n\nlemma LPDi_Star: \"j \\ i \\ LPDi j (MStar r) \\ {MStar r} \\ MTimesR (\\j \\ i. LPDi j r) (MStar r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesR_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF LPDi_Times])\nqed simp\n\nlemma LPDs_Star: \"LPDs (MStar r) \\ {MStar r} \\ MTimesR (LPDs r) (MStar r)\"\n unfolding LPDs_def using LPDi_Star[OF order_refl, of _ r] by (force simp: MTimesR_def)\n\nlemma finite_LPDs: \"finite (LPDs r)\"\nproof (induct r)\n case (MSkip n)\n then show ?case by (intro finite_subset[OF LPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF LPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF LPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF LPDs_Times]) (simp add: MTimesR_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF LPDs_Star]) (simp add: MTimesR_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addLPD r \\ \\S. insert r S \\ Set.bind (insert r S) LPD\"\n\nprivate lemma mono_addLPD: \"mono (addLPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma LPDs_aux1: \"lfp (addLPD r) \\ LPDs r\"\n by (rule lfp_induct[OF mono_addLPD], auto intro: LPDs_refl LPDs_trans simp: Set.bind_def)\n\nprivate lemma LPDs_aux2: \"LPDi i r \\ lfp (addLPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addLPD]) (auto simp: LPDi_Suc_alt simp del: LPDi.simps)\nqed\n\nlemma LPDs_alt: \"LPDs r = lfp (addLPD r)\"\n using LPDs_aux1 LPDs_aux2 by (force simp: LPDs_def)\n\nlemma LPDs_code[code]:\n \"LPDs r = saturate (addLPD r) {}\"\n unfolding LPDs_alt saturate_def\n by (rule lfp_while[OF mono_addLPD _ finite_LPDs, of r]) (auto simp: LPDs_refl LPDs_trans Set.bind_def)\n\nend\n\nsubsubsection \\RPD\\\n\nprimrec RPD where\n \"RPD (MSkip n) = (case n of 0 \\ {} | Suc m \\ {MSkip m})\"\n| \"RPD (MTestPos \\) = {}\"\n| \"RPD (MTestNeg \\) = {}\"\n| \"RPD (MPlus r s) = (RPD r \\ RPD s)\"\n| \"RPD (MTimes r s) = MTimesL r (RPD s) \\ RPD r\"\n| \"RPD (MStar r) = MTimesL (MStar r) (RPD r)\"\n\nprimrec RPDi where\n \"RPDi 0 r = {r}\"\n| \"RPDi (Suc i) r = (\\s \\ RPD r. RPDi i s)\"\n\nlemma RPDi_Suc_alt: \"RPDi (Suc i) r = (\\s \\ RPDi i r. RPD s)\"\n by (induct i arbitrary: r) fastforce+\n\ndefinition \"RPDs r = (\\i. RPDi i r)\"\n\nlemma RPDs_refl: \"r \\ RPDs r\"\n by (auto simp: RPDs_def intro: exI[of _ 0])\nlemma RPDs_trans: \"r \\ RPD s \\ s \\ RPDs t \\ r \\ RPDs t\"\n by (force simp: RPDs_def RPDi_Suc_alt simp del: RPDi.simps intro: exI[of _ \"Suc _\"])\n\nlemma RPDi_Test:\n \"RPDi i (MSkip 0) \\ {MSkip 0}\"\n \"RPDi i (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDi i (MTestNeg \\) \\ {MTestNeg \\}\"\n by (induct i) auto\n\nlemma RPDs_Test:\n \"RPDs (MSkip 0) \\ {MSkip 0}\"\n \"RPDs (MTestPos \\) \\ {MTestPos \\}\"\n \"RPDs (MTestNeg \\) \\ {MTestNeg \\}\"\n unfolding RPDs_def using RPDi_Test by blast+\n\nlemma RPDi_MSkip: \"RPDi i (MSkip n) \\ MSkip ` {i. i \\ n}\"\n by (induct i arbitrary: n) (auto dest: set_mp[OF RPDi_Test(1)] simp: le_Suc_eq split: nat.splits)\n\nlemma RPDs_MSkip: \"RPDs (MSkip n) \\ MSkip ` {i. i \\ n}\"\n unfolding RPDs_def using RPDi_MSkip by auto\n\nlemma RPDi_Plus: \"RPDi i (MPlus r s) \\ {MPlus r s} \\ RPDi i r \\ RPDi i s\"\n by (induct i arbitrary: r s) auto\n\nlemma RPDi_Suc_RPD_Plus:\n \"RPDi (Suc i) r \\ RPDs (MPlus r s)\"\n \"RPDi (Suc i) s \\ RPDs (MPlus r s)\"\n unfolding RPDs_def by (force intro!: exI[of _ \"Suc i\"])+\n\nlemma RPDs_Plus: \"RPDs (MPlus r s) \\ {MPlus r s} \\ RPDs r \\ RPDs s\"\n unfolding RPDs_def using RPDi_Plus[of _ r s] by auto\n\nlemma RPDi_Times:\n \"RPDi i (MTimes r s) \\ {MTimes r s} \\ MTimesL r (\\j \\ i. RPDi j s) \\ (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: r s)\n case (Suc i)\n show ?case\n by (fastforce simp: MTimesL_def dest: bspec[of _ _ \"Suc _\"] dest!: set_mp[OF Suc])\nqed simp\n\nlemma RPDs_Times: \"RPDs (MTimes r s) \\ {MTimes r s} \\ MTimesL r (RPDs s) \\ RPDs r\"\n unfolding RPDs_def using RPDi_Times[of _ r s] by (force simp: MTimesL_def)\n\nlemma RPDi_Star: \"j \\ i \\ RPDi j (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (\\j \\ i. RPDi j r)\"\nproof (induct i arbitrary: j r)\n case (Suc i)\n from Suc(2) show ?case\n by (auto 0 5 simp: MTimesL_def image_iff le_Suc_eq\n dest: bspec[of _ _ \"Suc 0\"] bspec[of _ _ \"Suc _\"] set_mp[OF Suc(1)] dest!: set_mp[OF RPDi_Times])\nqed simp\n\nlemma RPDs_Star: \"RPDs (MStar r) \\ {MStar r} \\ MTimesL (MStar r) (RPDs r)\"\n unfolding RPDs_def using RPDi_Star[OF order_refl, of _ r] by (force simp: MTimesL_def)\n\nlemma finite_RPDs: \"finite (RPDs r)\"\nproof (induct r)\n case MSkip\n then show ?case by (intro finite_subset[OF RPDs_MSkip]) simp\nnext\n case (MTestPos \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(2)]) simp\nnext\n case (MTestNeg \\)\n then show ?case by (intro finite_subset[OF RPDs_Test(3)]) simp\nnext\n case (MPlus r s)\n then show ?case by (intro finite_subset[OF RPDs_Plus]) simp\nnext\n case (MTimes r s)\n then show ?case by (intro finite_subset[OF RPDs_Times]) (simp add: MTimesL_def)\nnext\n case (MStar r)\n then show ?case by (intro finite_subset[OF RPDs_Star]) (simp add: MTimesL_def)\nqed\n\ncontext begin\n\nprivate abbreviation (input) \"addRPD r \\ \\S. insert r S \\ Set.bind (insert r S) RPD\"\n\nprivate lemma mono_addRPD: \"mono (addRPD r)\"\n unfolding mono_def Set.bind_def by auto\n\nprivate lemma RPDs_aux1: \"lfp (addRPD r) \\ RPDs r\"\n by (rule lfp_induct[OF mono_addRPD], auto intro: RPDs_refl RPDs_trans simp: Set.bind_def)\n\nprivate lemma RPDs_aux2: \"RPDi i r \\ lfp (addRPD r)\"\nproof (induct i)\n case 0\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) auto\nnext\n case (Suc i)\n then show ?case\n by (subst lfp_unfold[OF mono_addRPD]) (auto simp: RPDi_Suc_alt simp del: RPDi.simps)\nqed\n\nlemma RPDs_alt: \"RPDs r = lfp (addRPD r)\"\n using RPDs_aux1 RPDs_aux2 by (force simp: RPDs_def)\n\nlemma RPDs_code[code]:\n \"RPDs r = saturate (addRPD r) {}\"\n unfolding RPDs_alt saturate_def\n by (rule lfp_while[OF mono_addRPD _ finite_RPDs, of r]) (auto simp: RPDs_refl RPDs_trans Set.bind_def)\n\nend\n\nsubsection \\The executable monitor\\\n\ntype_synonym ts = nat\n\ntype_synonym 'a mbuf2 = \"'a table list \\ 'a table list\"\ntype_synonym 'a mbufn = \"'a table list list\"\ntype_synonym 'a msaux = \"(ts \\ 'a table) list\"\ntype_synonym 'a muaux = \"(ts \\ 'a table \\ 'a table) list\"\ntype_synonym 'a mr\\aux = \"(ts \\ (mregex, 'a table) mapping) list\"\ntype_synonym 'a ml\\aux = \"(ts \\ 'a table list \\ 'a table) list\"\n\ndatatype mconstraint = MEq | MLess | MLessEq\n\nrecord args =\n args_ivl :: \\\n args_n :: nat\n args_L :: \"nat set\"\n args_R :: \"nat set\"\n args_pos :: bool\n\ndatatype (dead 'msaux, dead 'muaux) mformula =\n MRel \"event_data table\"\n | MPred Formula.name \"Formula.trm list\"\n | MLet Formula.name nat \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\"\n | MAnd \"nat set\" \"('msaux, 'muaux) mformula\" bool \"nat set\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MAndAssign \"('msaux, 'muaux) mformula\" \"nat \\ Formula.trm\"\n | MAndRel \"('msaux, 'muaux) mformula\" \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm\"\n | MAnds \"nat set list\" \"nat set list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\"\n | MOr \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\"\n | MNeg \"('msaux, 'muaux) mformula\"\n | MExists \"('msaux, 'muaux) mformula\"\n | MAgg bool nat Formula.agg_op nat \"Formula.trm\" \"('msaux, 'muaux) mformula\"\n | MPrev \\ \"('msaux, 'muaux) mformula\" bool \"event_data table list\" \"ts list\"\n | MNext \\ \"('msaux, 'muaux) mformula\" bool \"ts list\"\n | MSince args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" \"'msaux\"\n | MUntil args \"('msaux, 'muaux) mformula\" \"('msaux, 'muaux) mformula\" \"event_data mbuf2\" \"ts list\" \"'muaux\"\n | MMatchP \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" \"event_data mr\\aux\"\n | MMatchF \\ \"mregex\" \"mregex list\" \"('msaux, 'muaux) mformula list\" \"event_data mbufn\" \"ts list\" \"event_data ml\\aux\"\n\nrecord ('msaux, 'muaux) mstate =\n mstate_i :: nat\n mstate_m :: \"('msaux, 'muaux) mformula\"\n mstate_n :: nat\n\nfun eq_rel :: \"nat \\ Formula.trm \\ Formula.trm \\ event_data table\" where\n \"eq_rel n (Formula.Const x) (Formula.Const y) = (if x = y then unit_table n else empty_table)\"\n| \"eq_rel n (Formula.Var x) (Formula.Const y) = singleton_table n x y\"\n| \"eq_rel n (Formula.Const x) (Formula.Var y) = singleton_table n y x\"\n| \"eq_rel n _ _ = undefined\"\n\nlemma regex_atms_size: \"x \\ regex.atms r \\ size x < regex.size_regex size r\"\n by (induct r) auto\n\nlemma atms_size:\n assumes \"x \\ atms r\"\n shows \"size x < Regex.size_regex size r\"\nproof -\n { fix y assume \"y \\ regex.atms r\" \"case y of formula.Neg z \\ x = z | _ \\ False\"\n then have \"size x < Regex.size_regex size r\"\n by (cases y rule: formula.exhaust) (auto dest: regex_atms_size)\n }\n with assms show ?thesis\n unfolding atms_def\n by (auto split: formula.splits dest: regex_atms_size)\nqed\n\ndefinition init_args :: \"\\ \\ nat \\ nat set \\ nat set \\ bool \\ args\" where\n \"init_args I n L R pos = \\args_ivl = I, args_n = n, args_L = L, args_R = R, args_pos = pos\\\"\n\nlocale msaux =\n fixes valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n assumes valid_init_msaux: \"L \\ R \\\n valid_msaux (init_args I n L R pos) 0 (init_msaux (init_args I n L R pos)) []\"\n assumes valid_add_new_ts_msaux: \"valid_msaux args cur aux auxlist \\ nt \\ cur \\\n valid_msaux args nt (add_new_ts_msaux args nt aux)\n (filter (\\(t, rel). enat (nt - t) \\ right (args_ivl args)) auxlist)\"\n assumes valid_join_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n valid_msaux args cur (join_msaux args rel1 aux)\n (map (\\(t, rel). (t, join rel (args_pos args) rel1)) auxlist)\"\n assumes valid_add_new_table_msaux: \"valid_msaux args cur aux auxlist \\\n table (args_n args) (args_R args) rel2 \\\n valid_msaux args cur (add_new_table_msaux args rel2 aux)\n (case auxlist of\n [] => [(cur, rel2)]\n | ((t, y) # ts) \\ if t = cur then (t, y \\ rel2) # ts else (cur, rel2) # auxlist)\"\n and valid_result_msaux: \"valid_msaux args cur aux auxlist \\ result_msaux args aux =\n foldr (\\) [rel. (t, rel) \\ auxlist, left (args_ivl args) \\ cur - t] {}\"\n\nfun check_before :: \"\\ \\ ts \\ (ts \\ 'a \\ 'b) \\ bool\" where\n \"check_before I dt (t, a, b) \\ enat t + right I < enat dt\"\n\nfun proj_thd :: \"('a \\ 'b \\ 'c) \\ 'c\" where\n \"proj_thd (t, a1, a2) = a2\"\n\ndefinition update_until :: \"args \\ event_data table \\ event_data table \\ ts \\ event_data muaux \\ event_data muaux\" where\n \"update_until args rel1 rel2 nt aux =\n (map (\\x. case x of (t, a1, a2) \\ (t, if (args_pos args) then join a1 True rel1 else a1 \\ rel1,\n if mem (nt - t) (args_ivl args) then a2 \\ join rel2 (args_pos args) a1 else a2)) aux) @\n [(nt, rel1, if left (args_ivl args) = 0 then rel2 else empty_table)]\"\n\nlemma map_proj_thd_update_until: \"map proj_thd (takeWhile (check_before (args_ivl args) nt) auxlist) =\n map proj_thd (takeWhile (check_before (args_ivl args) nt) (update_until args rel1 rel2 nt auxlist))\"\nproof (induction auxlist)\n case Nil\n then show ?case by (simp add: update_until_def)\nnext\n case (Cons a auxlist)\n then show ?case\n by (cases \"right (args_ivl args)\") (auto simp add: update_until_def split: if_splits prod.splits)\nqed\n\nfun eval_until :: \"\\ \\ ts \\ event_data muaux \\ event_data table list \\ event_data muaux\" where\n \"eval_until I nt [] = ([], [])\"\n| \"eval_until I nt ((t, a1, a2) # aux) = (if t + right I < nt then\n (let (xs, aux) = eval_until I nt aux in (a2 # xs, aux)) else ([], (t, a1, a2) # aux))\"\n\nlemma eval_until_length:\n \"eval_until I nt auxlist = (res, auxlist') \\ length auxlist = length res + length auxlist'\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlemma eval_until_res: \"eval_until I nt auxlist = (res, auxlist') \\\n res = map proj_thd (takeWhile (check_before I nt) auxlist)\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: prod.splits)\n\nlemma eval_until_auxlist': \"eval_until I nt auxlist = (res, auxlist') \\\n auxlist' = drop (length res) auxlist\"\n by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)\n (auto split: if_splits prod.splits)\n\nlocale muaux =\n fixes valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ ts \\ 'muaux \\ event_data table list \\ 'muaux\"\n assumes valid_init_muaux: \"L \\ R \\\n valid_muaux (init_args I n L R pos) 0 (init_muaux (init_args I n L R pos)) []\"\n assumes valid_add_new_muaux: \"valid_muaux args cur aux auxlist \\\n table (args_n args) (args_L args) rel1 \\\n table (args_n args) (args_R args) rel2 \\\n nt \\ cur \\\n valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux)\n (update_until args rel1 rel2 nt auxlist)\"\n assumes valid_length_muaux: \"valid_muaux args cur aux auxlist \\ length_muaux args aux = length auxlist\"\n assumes valid_eval_muaux: \"valid_muaux args cur aux auxlist \\ nt \\ cur \\\n eval_muaux args nt aux = (res, aux') \\ eval_until (args_ivl args) nt auxlist = (res', auxlist') \\\n res = res' \\ valid_muaux args cur aux' auxlist'\"\n\nlocale maux = msaux valid_msaux init_msaux add_new_ts_msaux join_msaux add_new_table_msaux result_msaux +\n muaux valid_muaux init_muaux add_new_muaux length_muaux eval_muaux\n for valid_msaux :: \"args \\ ts \\ 'msaux \\ event_data msaux \\ bool\"\n and init_msaux :: \"args \\ 'msaux\"\n and add_new_ts_msaux :: \"args \\ ts \\ 'msaux \\ 'msaux\"\n and join_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and add_new_table_msaux :: \"args \\ event_data table \\ 'msaux \\ 'msaux\"\n and result_msaux :: \"args \\ 'msaux \\ event_data table\"\n and valid_muaux :: \"args \\ ts \\ 'muaux \\ event_data muaux \\ bool\"\n and init_muaux :: \"args \\ 'muaux\"\n and add_new_muaux :: \"args \\ event_data table \\ event_data table \\ ts \\ 'muaux \\ 'muaux\"\n and length_muaux :: \"args \\ 'muaux \\ nat\"\n and eval_muaux :: \"args \\ nat \\ 'muaux \\ event_data table list \\ 'muaux\"\n\nfun split_assignment :: \"nat set \\ Formula.formula \\ nat \\ Formula.trm\" where\n \"split_assignment X (Formula.Eq t1 t2) = (case (t1, t2) of\n (Formula.Var x, Formula.Var y) \\ if x \\ X then (y, t1) else (x, t2)\n | (Formula.Var x, _) \\ (x, t2)\n | (_, Formula.Var y) \\ (y, t1))\"\n| \"split_assignment _ _ = undefined\"\n\nfun split_constraint :: \"Formula.formula \\ Formula.trm \\ bool \\ mconstraint \\ Formula.trm\" where\n \"split_constraint (Formula.Eq t1 t2) = (t1, True, MEq, t2)\"\n| \"split_constraint (Formula.Less t1 t2) = (t1, True, MLess, t2)\"\n| \"split_constraint (Formula.LessEq t1 t2) = (t1, True, MLessEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Eq t1 t2)) = (t1, False, MEq, t2)\"\n| \"split_constraint (Formula.Neg (Formula.Less t1 t2)) = (t1, False, MLess, t2)\"\n| \"split_constraint (Formula.Neg (Formula.LessEq t1 t2)) = (t1, False, MLessEq, t2)\"\n| \"split_constraint _ = undefined\"\n\nfunction (in maux) (sequential) minit0 :: \"nat \\ Formula.formula \\ ('msaux, 'muaux) mformula\" where\n \"minit0 n (Formula.Neg \\) = (if fv \\ = {} then MNeg (minit0 n \\) else MRel empty_table)\"\n| \"minit0 n (Formula.Eq t1 t2) = MRel (eq_rel n t1 t2)\"\n| \"minit0 n (Formula.Pred e ts) = MPred e ts\"\n| \"minit0 n (Formula.Let p \\ \\) = MLet p (Formula.nfv \\) (minit0 (Formula.nfv \\) \\) (minit0 n \\)\"\n| \"minit0 n (Formula.Or \\ \\) = MOr (minit0 n \\) (minit0 n \\) ([], [])\"\n| \"minit0 n (Formula.And \\ \\) = (if safe_assignment (fv \\) \\ then\n MAndAssign (minit0 n \\) (split_assignment (fv \\) \\)\n else if safe_formula \\ then\n MAnd (fv \\) (minit0 n \\) True (fv \\) (minit0 n \\) ([], [])\n else if is_constraint \\ then\n MAndRel (minit0 n \\) (split_constraint \\)\n else (case \\ of Formula.Neg \\ \\\n MAnd (fv \\) (minit0 n \\) False (fv \\) (minit0 n \\) ([], [])))\"\n| \"minit0 n (Formula.Ands l) = (let (pos, neg) = partition safe_formula l in\n let mpos = map (minit0 n) pos in\n let mneg = map (minit0 n) (map remove_neg neg) in\n let vpos = map fv pos in\n let vneg = map fv neg in\n MAnds vpos vneg (mpos @ mneg) (replicate (length l) []))\"\n| \"minit0 n (Formula.Exists \\) = MExists (minit0 (Suc n) \\)\"\n| \"minit0 n (Formula.Agg y \\ b f \\) = MAgg (fv \\ \\ {0.. b f (minit0 (b + n) \\)\"\n| \"minit0 n (Formula.Prev I \\) = MPrev I (minit0 n \\) True [] []\"\n| \"minit0 n (Formula.Next I \\) = MNext I (minit0 n \\) True []\"\n| \"minit0 n (Formula.Since \\ I \\) = (if safe_formula \\\n then MSince (init_args I n (Formula.fv \\) (Formula.fv \\) True) (minit0 n \\) (minit0 n \\) ([], []) [] (init_msaux (init_args I n (Formula.fv \\) (Formula.fv \\) True))\n else (case \\ of\n Formula.Neg \\ \\ MSince (init_args I n (Formula.fv \\) (Formula.fv \\) False) (minit0 n \\) (minit0 n \\) ([], []) [] (init_msaux (init_args I n (Formula.fv \\) (Formula.fv \\) False))\n | _ \\ undefined))\"\n| \"minit0 n (Formula.Until \\ I \\) = (if safe_formula \\\n then MUntil (init_args I n (Formula.fv \\) (Formula.fv \\) True) (minit0 n \\) (minit0 n \\) ([], []) [] (init_muaux (init_args I n (Formula.fv \\) (Formula.fv \\) True))\n else (case \\ of\n Formula.Neg \\ \\ MUntil (init_args I n (Formula.fv \\) (Formula.fv \\) False) (minit0 n \\) (minit0 n \\) ([], []) [] (init_muaux (init_args I n (Formula.fv \\) (Formula.fv \\) False))\n | _ \\ undefined))\"\n| \"minit0 n (Formula.MatchP I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchP I mr (sorted_list_of_set (RPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] [])\"\n| \"minit0 n (Formula.MatchF I r) =\n (let (mr, \\s) = to_mregex r\n in MMatchF I mr (sorted_list_of_set (LPDs mr)) (map (minit0 n) \\s) (replicate (length \\s) []) [] [])\"\n| \"minit0 n _ = undefined\"\n by pat_completeness auto\ntermination (in maux)\n by (relation \"measure (\\(_, \\). size \\)\")\n (auto simp: less_Suc_eq_le size_list_estimation' size_remove_neg\n dest!: to_mregex_ok[OF sym] atms_size)\n\ndefinition (in maux) minit :: \"Formula.formula \\ ('msaux, 'muaux) mstate\" where\n \"minit \\ = (let n = Formula.nfv \\ in \\mstate_i = 0, mstate_m = minit0 n \\, mstate_n = n\\)\"\n\ndefinition (in maux) minit_safe where\n \"minit_safe \\ = (if mmonitorable_exec \\ then minit \\ else undefined)\"\n\nfun mprev_next :: \"\\ \\ event_data table list \\ ts list \\ event_data table list \\ event_data table list \\ ts list\" where\n \"mprev_next I [] ts = ([], [], ts)\"\n| \"mprev_next I xs [] = ([], xs, [])\"\n| \"mprev_next I xs [t] = ([], xs, [t])\"\n| \"mprev_next I (x # xs) (t # t' # ts) = (let (ys, zs) = mprev_next I xs (t' # ts)\n in ((if mem (t' - t) I then x else empty_table) # ys, zs))\"\n\nfun mbuf2_add :: \"event_data table list \\ event_data table list \\ event_data mbuf2 \\ event_data mbuf2\" where\n \"mbuf2_add xs' ys' (xs, ys) = (xs @ xs', ys @ ys')\"\n\nfun mbuf2_take :: \"(event_data table \\ event_data table \\ 'b) \\ event_data mbuf2 \\ 'b list \\ event_data mbuf2\" where\n \"mbuf2_take f (x # xs, y # ys) = (let (zs, buf) = mbuf2_take f (xs, ys) in (f x y # zs, buf))\"\n| \"mbuf2_take f (xs, ys) = ([], (xs, ys))\"\n\nfun mbuf2t_take :: \"(event_data table \\ event_data table \\ ts \\ 'b \\ 'b) \\ 'b \\\n event_data mbuf2 \\ ts list \\ 'b \\ event_data mbuf2 \\ ts list\" where\n \"mbuf2t_take f z (x # xs, y # ys) (t # ts) = mbuf2t_take f (f x y t z) (xs, ys) ts\"\n| \"mbuf2t_take f z (xs, ys) ts = (z, (xs, ys), ts)\"\n\nlemma size_list_length_diff1: \"xs \\ [] \\ [] \\ set xs \\\n size_list (\\xs. length xs - Suc 0) xs < size_list length xs\"\nproof (induct xs)\n case (Cons x xs)\n then show ?case\n by (cases xs) auto\nqed simp\n\nfun mbufn_add :: \"event_data table list list \\ event_data mbufn \\ event_data mbufn\" where\n \"mbufn_add xs' xs = List.map2 (@) xs xs'\"\n\nfunction mbufn_take :: \"(event_data table list \\ 'b \\ 'b) \\ 'b \\ event_data mbufn \\ 'b \\ event_data mbufn\" where\n \"mbufn_take f z buf = (if buf = [] \\ [] \\ set buf then (z, buf)\n else mbufn_take f (f (map hd buf) z) (map tl buf))\"\n by pat_completeness auto\ntermination by (relation \"measure (\\(_, _, buf). size_list length buf)\")\n (auto simp: comp_def Suc_le_eq size_list_length_diff1)\n\nfun mbufnt_take :: \"(event_data table list \\ ts \\ 'b \\ 'b) \\\n 'b \\ event_data mbufn \\ ts list \\ 'b \\ event_data mbufn \\ ts list\" where\n \"mbufnt_take f z buf ts =\n (if [] \\ set buf \\ ts = [] then (z, buf, ts)\n else mbufnt_take f (f (map hd buf) (hd ts) z) (map tl buf) (tl ts))\"\n\nfun match :: \"Formula.trm list \\ event_data list \\ (nat \\ event_data) option\" where\n \"match [] [] = Some Map.empty\"\n| \"match (Formula.Const x # ts) (y # ys) = (if x = y then match ts ys else None)\"\n| \"match (Formula.Var x # ts) (y # ys) = (case match ts ys of\n None \\ None\n | Some f \\ (case f x of\n None \\ Some (f(x \\ y))\n | Some z \\ if y = z then Some f else None))\"\n| \"match _ _ = None\"\n\nfun meval_trm :: \"Formula.trm \\ event_data tuple \\ event_data\" where\n \"meval_trm (Formula.Var x) v = the (v ! x)\"\n| \"meval_trm (Formula.Const x) v = x\"\n| \"meval_trm (Formula.Plus x y) v = meval_trm x v + meval_trm y v\"\n| \"meval_trm (Formula.Minus x y) v = meval_trm x v - meval_trm y v\"\n| \"meval_trm (Formula.UMinus x) v = - meval_trm x v\"\n| \"meval_trm (Formula.Mult x y) v = meval_trm x v * meval_trm y v\"\n| \"meval_trm (Formula.Div x y) v = meval_trm x v div meval_trm y v\"\n| \"meval_trm (Formula.Mod x y) v = meval_trm x v mod meval_trm y v\"\n| \"meval_trm (Formula.F2i x) v = EInt (integer_of_event_data (meval_trm x v))\"\n| \"meval_trm (Formula.I2f x) v = EFloat (double_of_event_data (meval_trm x v))\"\n\ndefinition eval_agg :: \"nat \\ bool \\ nat \\ Formula.agg_op \\ nat \\ Formula.trm \\\n event_data table \\ event_data table\" where\n \"eval_agg n g0 y \\ b f rel = (if g0 \\ rel = empty_table\n then singleton_table n y (eval_agg_op \\ {})\n else (\\k.\n let group = Set.filter (\\x. drop b x = k) rel;\n M = (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` meval_trm f ` group\n in k[y:=Some (eval_agg_op \\ M)]) ` (drop b) ` rel)\"\n\ndefinition (in maux) update_since :: \"args \\ event_data table \\ event_data table \\ ts \\\n 'msaux \\ event_data table \\ 'msaux\" where\n \"update_since args rel1 rel2 nt aux =\n (let aux0 = join_msaux args rel1 (add_new_ts_msaux args nt aux);\n aux' = add_new_table_msaux args rel2 aux0\n in (result_msaux args aux', aux'))\"\n\ndefinition \"lookup = Mapping.lookup_default empty_table\"\n\nfun \\_lax where\n \"\\_lax guard \\s (MSkip n) = (if n = 0 then guard else empty_table)\"\n| \"\\_lax guard \\s (MTestPos i) = join guard True (\\s ! i)\"\n| \"\\_lax guard \\s (MTestNeg i) = join guard False (\\s ! i)\"\n| \"\\_lax guard \\s (MPlus r s) = \\_lax guard \\s r \\ \\_lax guard \\s s\"\n| \"\\_lax guard \\s (MTimes r s) = join (\\_lax guard \\s r) True (\\_lax guard \\s s)\"\n| \"\\_lax guard \\s (MStar r) = guard\"\n\nfun r\\_strict where\n \"r\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"r\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"r\\_strict n \\s (MPlus r s) = r\\_strict n \\s r \\ r\\_strict n \\s s\"\n| \"r\\_strict n \\s (MTimes r s) = \\_lax (r\\_strict n \\s r) \\s s\"\n| \"r\\_strict n \\s (MStar r) = unit_table n\"\n\nfun l\\_strict where\n \"l\\_strict n \\s (MSkip m) = (if m = 0 then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MTestPos i) = \\s ! i\"\n| \"l\\_strict n \\s (MTestNeg i) = (if \\s ! i = empty_table then unit_table n else empty_table)\"\n| \"l\\_strict n \\s (MPlus r s) = l\\_strict n \\s r \\ l\\_strict n \\s s\"\n| \"l\\_strict n \\s (MTimes r s) = \\_lax (l\\_strict n \\s s) \\s r\"\n| \"l\\_strict n \\s (MStar r) = unit_table n\"\n\nfun r\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"r\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"r\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"r\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"r\\ \\ X \\s (MPlus r s) = r\\ \\ X \\s r \\ r\\ \\ X \\s s\"\n| \"r\\ \\ X \\s (MTimes r s) = r\\ (\\t. \\ (MTimes r t)) X \\s s \\ \\_lax (r\\ \\ X \\s r) \\s s\"\n| \"r\\ \\ X \\s (MStar r) = r\\ (\\t. \\ (MTimes (MStar r) t)) X \\s r\"\n\nfun l\\ :: \"(mregex \\ mregex) \\ (mregex, 'a table) mapping \\ 'a table list \\ mregex \\ 'a table\" where\n \"l\\ \\ X \\s (MSkip n) = (case n of 0 \\ empty_table | Suc m \\ lookup X (\\ (MSkip m)))\"\n| \"l\\ \\ X \\s (MTestPos i) = empty_table\"\n| \"l\\ \\ X \\s (MTestNeg i) = empty_table\"\n| \"l\\ \\ X \\s (MPlus r s) = l\\ \\ X \\s r \\ l\\ \\ X \\s s\"\n| \"l\\ \\ X \\s (MTimes r s) = l\\ (\\t. \\ (MTimes t s)) X \\s r \\ \\_lax (l\\ \\ X \\s s) \\s r\"\n| \"l\\ \\ X \\s (MStar r) = l\\ (\\t. \\ (MTimes t (MStar r))) X \\s r\"\n\nlift_definition mrtabulate :: \"mregex list \\ (mregex \\ 'b table) \\ (mregex, 'b table) mapping\"\n is \"\\ks f. (map_of (List.map_filter (\\k. let fk = f k in if fk = empty_table then None else Some (k, fk)) ks))\" .\n\nlemma lookup_tabulate:\n \"distinct xs \\ lookup (mrtabulate xs f) x = (if x \\ set xs then f x else empty_table)\"\n unfolding lookup_default_def lookup_def\n by transfer (auto simp: Let_def map_filter_def map_of_eq_None_iff o_def image_image dest!: map_of_SomeD\n split: if_splits option.splits)\n\ndefinition update_matchP :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\\n event_data mr\\aux \\ event_data table \\ event_data mr\\aux\" where\n \"update_matchP n I mr mrs rels nt aux =\n (let aux = (case [(t, mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = nt then r\\_strict n rels mr else {}))).\n (t, rel) \\ aux, enat (nt - t) \\ right I]\n of [] \\ [(nt, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = nt then x # aux'\n else (nt, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\n in (foldr (\\) [lookup rel mr. (t, rel) \\ aux, left I \\ nt - t] {}, aux))\"\n\ndefinition update_matchF_base where\n \"update_matchF_base n I mr mrs rels nt =\n (let X = mrtabulate mrs (l\\_strict n rels)\n in ([(nt, rels, if left I = 0 then lookup X mr else empty_table)], X))\"\n\ndefinition update_matchF_step where\n \"update_matchF_step I mr mrs nt = (\\(t, rels', rel) (aux', X).\n (let Y = mrtabulate mrs (l\\ id X rels')\n in ((t, rels', if mem (nt - t) I then rel \\ lookup Y mr else rel) # aux', Y)))\"\n\ndefinition update_matchF :: \"nat \\ \\ \\ mregex \\ mregex list \\ event_data table list \\ ts \\ event_data ml\\aux \\ event_data ml\\aux\" where\n \"update_matchF n I mr mrs rels nt aux =\n fst (foldr (update_matchF_step I mr mrs nt) aux (update_matchF_base n I mr mrs rels nt))\"\n\nfun eval_matchF :: \"\\ \\ mregex \\ ts \\ event_data ml\\aux \\ event_data table list \\ event_data ml\\aux\" where\n \"eval_matchF I mr nt [] = ([], [])\"\n| \"eval_matchF I mr nt ((t, rels, rel) # aux) = (if t + right I < nt then\n (let (xs, aux) = eval_matchF I mr nt aux in (rel # xs, aux)) else ([], (t, rels, rel) # aux))\"\n\nprimrec map_split where\n \"map_split f [] = ([], [])\"\n| \"map_split f (x # xs) =\n (let (y, z) = f x; (ys, zs) = map_split f xs\n in (y # ys, z # zs))\"\n\nfun eval_assignment :: \"nat \\ Formula.trm \\ event_data tuple \\ event_data tuple\" where\n \"eval_assignment (x, t) y = (y[x:=Some (meval_trm t y)])\"\n\nfun eval_constraint0 :: \"mconstraint \\ event_data \\ event_data \\ bool\" where\n \"eval_constraint0 MEq x y = (x = y)\"\n| \"eval_constraint0 MLess x y = (x < y)\"\n| \"eval_constraint0 MLessEq x y = (x \\ y)\"\n\nfun eval_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ event_data tuple \\ bool\" where\n \"eval_constraint (t1, p, c, t2) x = (eval_constraint0 c (meval_trm t1 x) (meval_trm t2 x) = p)\"\n\nprimrec (in maux) meval :: \"nat \\ ts \\ Formula.database \\ ('msaux, 'muaux) mformula \\\n event_data table list \\ ('msaux, 'muaux) mformula\" where\n \"meval n t db (MRel rel) = ([rel], MRel rel)\"\n| \"meval n t db (MPred e ts) = (map (\\X. (\\f. Table.tabulate f 0 n) ` Option.these\n (match ts ` X)) (case Mapping.lookup db e of None \\ [{}] | Some xs \\ xs), MPred e ts)\"\n| \"meval n t db (MLet p m \\ \\) =\n (let (xs, \\) = meval m t db \\; (ys, \\) = meval n t (Mapping.update p (map (image (map the)) xs) db) \\\n in (ys, MLet p m \\ \\))\"\n| \"meval n t db (MAnd A_\\ \\ pos A_\\ \\ buf) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. bin_join n A_\\ r1 pos A_\\ r2) (mbuf2_add xs ys buf)\n in (zs, MAnd A_\\ \\ pos A_\\ \\ buf))\"\n| \"meval n t db (MAndAssign \\ conf) =\n (let (xs, \\) = meval n t db \\ in (map (\\r. eval_assignment conf ` r) xs, MAndAssign \\ conf))\"\n| \"meval n t db (MAndRel \\ conf) =\n (let (xs, \\) = meval n t db \\ in (map (Set.filter (eval_constraint conf)) xs, MAndRel \\ conf))\"\n| \"meval n t db (MAnds A_pos A_neg L buf) =\n (let R = map (meval n t db) L in\n let buf = mbufn_add (map fst R) buf in\n let (zs, buf) = mbufn_take (\\xs zs. zs @ [mmulti_join n A_pos A_neg xs]) [] buf in\n (zs, MAnds A_pos A_neg (map snd R) buf))\"\n| \"meval n t db (MOr \\ \\ buf) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (zs, buf) = mbuf2_take (\\r1 r2. r1 \\ r2) (mbuf2_add xs ys buf)\n in (zs, MOr \\ \\ buf))\"\n| \"meval n t db (MNeg \\) =\n (let (xs, \\) = meval n t db \\ in (map (\\r. (if r = empty_table then unit_table n else empty_table)) xs, MNeg \\))\"\n| \"meval n t db (MExists \\) =\n (let (xs, \\) = meval (Suc n) t db \\ in (map (\\r. tl ` r) xs, MExists \\))\"\n| \"meval n t db (MAgg g0 y \\ b f \\) =\n (let (xs, \\) = meval (b + n) t db \\ in (map (eval_agg n g0 y \\ b f) xs, MAgg g0 y \\ b f \\))\"\n| \"meval n t db (MPrev I \\ first buf nts) =\n (let (xs, \\) = meval n t db \\;\n (zs, buf, nts) = mprev_next I (buf @ xs) (nts @ [t])\n in (if first then empty_table # zs else zs, MPrev I \\ False buf nts))\"\n| \"meval n t db (MNext I \\ first nts) =\n (let (xs, \\) = meval n t db \\;\n (xs, first) = (case (xs, first) of (_ # xs, True) \\ (xs, False) | a \\ a);\n (zs, _, nts) = mprev_next I xs (nts @ [t])\n in (zs, MNext I \\ first nts))\"\n| \"meval n t db (MSince args \\ \\ buf nts aux) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n ((zs, aux), buf, nts) = mbuf2t_take (\\r1 r2 t (zs, aux).\n let (z, aux) = update_since args r1 r2 t aux\n in (zs @ [z], aux)) ([], aux) (mbuf2_add xs ys buf) (nts @ [t])\n in (zs, MSince args \\ \\ buf nts aux))\"\n| \"meval n t db (MUntil args \\ \\ buf nts aux) =\n (let (xs, \\) = meval n t db \\; (ys, \\) = meval n t db \\;\n (aux, buf, nts) = mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [t]);\n (zs, aux) = eval_muaux args (case nts of [] \\ t | nt # _ \\ nt) aux\n in (zs, MUntil args \\ \\ buf nts aux))\"\n| \"meval n t db (MMatchP I mr mrs \\s buf nts aux) =\n (let (xss, \\s) = map_split id (map (meval n t db) \\s);\n ((zs, aux), buf, nts) = mbufnt_take (\\rels t (zs, aux).\n let (z, aux) = update_matchP n I mr mrs rels t aux\n in (zs @ [z], aux)) ([], aux) (mbufn_add xss buf) (nts @ [t])\n in (zs, MMatchP I mr mrs \\s buf nts aux))\"\n| \"meval n t db (MMatchF I mr mrs \\s buf nts aux) =\n (let (xss, \\s) = map_split id (map (meval n t db) \\s);\n (aux, buf, nts) = mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [t]);\n (zs, aux) = eval_matchF I mr (case nts of [] \\ t | nt # _ \\ nt) aux\n in (zs, MMatchF I mr mrs \\s buf nts aux))\"\n\ndefinition (in maux) mstep :: \"Formula.database \\ ts \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\" where\n \"mstep tdb st =\n (let (xs, m) = meval (mstate_n st) (snd tdb) (fst tdb) (mstate_m st)\n in (List.enumerate (mstate_i st) xs,\n \\mstate_i = mstate_i st + length xs, mstate_m = m, mstate_n = mstate_n st\\))\"\n\nsubsection \\Verdict delay\\\n\ncontext fixes \\ :: Formula.trace begin\n\nfun progress :: \"(Formula.name \\ nat) \\ Formula.formula \\ nat \\ nat\" where\n \"progress P (Formula.Pred e ts) j = (case P e of None \\ j | Some k \\ k)\"\n| \"progress P (Formula.Let p \\ \\) j = progress (P(p \\ progress P \\ j)) \\ j\"\n| \"progress P (Formula.Eq t1 t2) j = j\"\n| \"progress P (Formula.Less t1 t2) j = j\"\n| \"progress P (Formula.LessEq t1 t2) j = j\"\n| \"progress P (Formula.Neg \\) j = progress P \\ j\"\n| \"progress P (Formula.Or \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.And \\ \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Ands l) j = (if l = [] then j else Min (set (map (\\\\. progress P \\ j) l)))\"\n| \"progress P (Formula.Exists \\) j = progress P \\ j\"\n| \"progress P (Formula.Agg y \\ b f \\) j = progress P \\ j\"\n| \"progress P (Formula.Prev I \\) j = (if j = 0 then 0 else min (Suc (progress P \\ j)) j)\"\n| \"progress P (Formula.Next I \\) j = progress P \\ j - 1\"\n| \"progress P (Formula.Since \\ I \\) j = min (progress P \\ j) (progress P \\ j)\"\n| \"progress P (Formula.Until \\ I \\) j =\n Inf {i. \\k. k < j \\ k \\ min (progress P \\ j) (progress P \\ j) \\ \\ \\ i + right I \\ \\ \\ k}\"\n| \"progress P (Formula.MatchP I r) j = min_regex_default (progress P) r j\"\n| \"progress P (Formula.MatchF I r) j =\n Inf {i. \\k. k < j \\ k \\ min_regex_default (progress P) r j \\ \\ \\ i + right I \\ \\ \\ k}\"\n\ndefinition \"progress_regex P = min_regex_default (progress P)\"\n\ndeclare progress.simps[simp del]\nlemmas progress_simps[simp] = progress.simps[folded progress_regex_def[THEN fun_cong, THEN fun_cong]]\n\nend\n\ndefinition \"pred_mapping Q = pred_fun (\\_. True) (pred_option Q)\"\ndefinition \"rel_mapping Q = rel_fun (=) (rel_option Q)\"\n\nlemma pred_mapping_alt: \"pred_mapping Q P = (\\p \\ dom P. Q (the (P p)))\"\n unfolding pred_mapping_def pred_fun_def option.pred_set dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_alt: \"rel_mapping Q P P' = (dom P = dom P' \\ (\\p \\ dom P. Q (the (P p)) (the (P' p))))\"\n unfolding rel_mapping_def rel_fun_def rel_option_iff dom_def\n by (force split: option.splits)\n\nlemma rel_mapping_map_upd[simp]: \"Q x y \\ rel_mapping Q P P' \\ rel_mapping Q (P(p \\ x)) (P'(p \\ y))\"\n by (auto simp: rel_mapping_alt)\n\nlemma pred_mapping_map_upd[simp]: \"Q x \\ pred_mapping Q P \\ pred_mapping Q (P(p \\ x))\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_empty[simp]: \"pred_mapping Q Map.empty\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono: \"pred_mapping Q P \\ Q \\ R \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma pred_mapping_mono_strong: \"pred_mapping Q P \\\n (\\p. p \\ dom P \\ Q (the (P p)) \\ R (the (P p))) \\ pred_mapping R P\"\n by (auto simp: pred_mapping_alt)\n\nlemma progress_mono_gen: \"j \\ j' \\ rel_mapping (\\) P P' \\ progress \\ P \\ j \\ progress \\ P' \\ j'\"\nproof (induction \\ arbitrary: P P')\n case (Pred e ts)\n then show ?case\n by (force simp: rel_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[THEN order_trans])\nnext\n case (Until \\ I \\)\n from Until(1,2)[of P P'] Until.prems show ?case\n by (cases \"right I\")\n (auto dest: trans_le_add1[OF \\_mono] intro!: cInf_superset_mono)\nnext\n case (MatchF I r)\n from MatchF(1)[of _ P P'] MatchF.prems show ?case\n by (cases \"right I\"; cases \"regex.atms r = {}\")\n (auto 0 3 simp: Min_le_iff progress_regex_def dest: trans_le_add1[OF \\_mono]\n intro!: cInf_superset_mono elim!: less_le_trans order_trans)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma rel_mapping_reflp: \"reflp Q \\ rel_mapping Q P P\"\n by (auto simp: rel_mapping_alt reflp_def)\n\nlemmas progress_mono = progress_mono_gen[OF _ rel_mapping_reflp[unfolded reflp_def], simplified]\n\nlemma progress_le_gen: \"pred_mapping (\\x. x \\ j) P \\ progress \\ P \\ j \\ j\"\nproof (induction \\ arbitrary: P)\n case (Pred e ts)\n then show ?case\n by (auto simp: pred_mapping_alt dom_def split: option.splits)\nnext\n case (Ands l)\n then show ?case\n by (auto simp: image_iff intro!: Min.coboundedI[where a=\"progress \\ P (hd l) j\", THEN order_trans])\nnext\n case (Until \\ I \\)\n then show ?case\n by (cases \"right I\")\n (auto intro: trans_le_add1[OF \\_mono] intro!: cInf_lower)\nnext\n case (MatchF I r)\n then show ?case\n by (cases \"right I\")\n (auto intro: trans_le_add1[OF \\_mono] intro!: cInf_lower)\nqed (force simp: Min_le_iff progress_regex_def split: option.splits)+\n\nlemma progress_le: \"progress \\ Map.empty \\ j \\ j\"\n using progress_le_gen[of _ Map.empty] by auto\n\nlemma progress_0_gen[simp]:\n \"pred_mapping (\\x. x = 0) P \\ progress \\ P \\ 0 = 0\"\n using progress_le_gen[of 0 P] by auto\n\nlemma progress_0[simp]:\n \"progress \\ Map.empty \\ 0 = 0\"\n by (auto simp: pred_mapping_alt)\n\ndefinition max_mapping :: \"('b \\ 'a option) \\ ('b \\ 'a option) \\ 'b \\ ('a :: linorder) option\" where\n \"max_mapping P P' x = (case (P x, P' x) of\n (None, None) \\ None\n | (Some x, None) \\ None\n | (None, Some x) \\ None\n | (Some x, Some y) \\ Some (max x y))\"\n\ndefinition Max_mapping :: \"('b \\ 'a option) set \\ 'b \\ ('a :: linorder) option\" where\n \"Max_mapping Ps x = (if (\\P \\ Ps. P x \\ None) then Some (Max ((\\P. the (P x)) ` Ps)) else None)\"\n\nlemma dom_max_mapping[simp]: \"dom (max_mapping P1 P2) = dom P1 \\ dom P2\"\n unfolding max_mapping_def by (auto split: option.splits)\n\nlemma dom_Max_mapping[simp]: \"dom (Max_mapping X) = (\\P \\ X. dom P)\"\n unfolding Max_mapping_def by (auto split: if_splits)\n\nlemma Max_mapping_coboundedI:\n assumes \"finite X\" \"\\Q \\ X. dom Q = dom P\" \"P \\ X\"\n shows \"rel_mapping (\\) P (Max_mapping X)\"\n unfolding rel_mapping_alt\nproof (intro conjI ballI)\n from assms(3) have \"X \\ {}\" by auto\n then show \"dom P = dom (Max_mapping X)\" using assms(2) by auto\nnext\n fix p\n assume \"p \\ dom P\"\n with assms show \"the (P p) \\ the (Max_mapping X p)\"\n by (force simp add: Max_mapping_def intro!: Max.coboundedI imageI)\nqed\n\nlemma rel_mapping_trans: \"P OO Q \\ R \\\n rel_mapping P P1 P2 \\ rel_mapping Q P2 P3 \\ rel_mapping R P1 P3\"\n by (force simp: rel_mapping_alt dom_def set_eq_iff)\n\nabbreviation range_mapping :: \"nat \\ nat \\ ('b \\ nat option) \\ bool\" where\n \"range_mapping i j P \\ pred_mapping (\\x. i \\ x \\ x \\ j) P\"\n\nlemma range_mapping_relax:\n \"range_mapping i j P \\ i' \\ i \\ j' \\ j \\ range_mapping i' j' P\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_max_mapping[simp]:\n \"range_mapping i j1 P1 \\ range_mapping i j2 P2 \\ range_mapping i (max j1 j2) (max_mapping P1 P2)\"\n by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)\n\nlemma range_mapping_Max_mapping[simp]:\n \"finite X \\ X \\ {} \\ \\x\\X. range_mapping i (j x) (P x) \\ range_mapping i (Max (j ` X)) (Max_mapping (P ` X))\"\n by (force simp: pred_mapping_alt Max_mapping_def dom_def image_iff\n intro!: Max_ge_iff[THEN iffD2] split: if_splits)\n\nlemma pred_mapping_le:\n \"pred_mapping ((\\) i) P1 \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma pred_mapping_le':\n \"pred_mapping ((\\) j) P1 \\ i \\ j \\ rel_mapping (\\) P1 P2 \\ pred_mapping ((\\) (i :: nat)) P2\"\n by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)\n\nlemma max_mapping_cobounded1: \"dom P1 \\ dom P2 \\ rel_mapping (\\) P1 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_cobounded2: \"dom P2 \\ dom P1 \\ rel_mapping (\\) P2 (max_mapping P1 P2)\"\n unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)\n\nlemma max_mapping_fun_upd2[simp]:\n \"(max_mapping P1 (P2(p := y)))(p \\ x) = (max_mapping P1 P2)(p \\ x)\"\n by (auto simp: max_mapping_def)\n\nlemma rel_mapping_max_mapping_fun_upd: \"dom P2 \\ dom P1 \\ p \\ dom P2 \\ the (P2 p) \\ y \\\n rel_mapping (\\) P2 ((max_mapping P1 P2)(p \\ y))\"\n by (auto simp: rel_mapping_alt max_mapping_def split: option.splits)\n\nlemma progress_ge_gen: \"Formula.future_bounded \\ \\\n \\P j. dom P = S \\ range_mapping i j P \\ i \\ progress \\ P \\ j\"\nproof (induction \\ arbitrary: i S)\n case (Pred e ts)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: option.splits if_splits simp: rel_mapping_alt pred_mapping_alt dom_def)\nnext\n case (Let p \\ \\)\n from Let.prems obtain P2 j2 where P2: \"dom P2 = insert p S\" \"range_mapping i j2 P2\"\n \"i \\ progress \\ P2 \\ j2\"\n by (atomize_elim, intro Let(2)) (force simp: pred_mapping_alt rel_mapping_alt dom_def)+\n from Let.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (the (P2 p)) j1 P1\"\n \"the (P2 p) \\ progress \\ P1 \\ j1\"\n by (atomize_elim, intro Let(1)) auto\n let ?P12 = \"max_mapping P1 P2\"\n from P1 P2 have le1: \"progress \\ P1 \\ j1 \\ progress \\ (?P12(p := P1 p)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n from P1 P2 have le2: \"progress \\ P2 \\ j2 \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)\n show ?case\n unfolding progress.simps\n proof (intro exI[of _ \"?P12(p := P1 p)\"] exI[of _ \"max j1 j2\"] conjI)\n show \"dom (?P12(p := P1 p)) = S\"\n using P1 P2 by (auto simp: dom_def max_mapping_def)\n next\n show \"range_mapping i (max j1 j2) (?P12(p := P1 p))\"\n using P1 P2 by (force simp add: pred_mapping_alt dom_def max_mapping_def split: option.splits)\n next\n have \"i \\ progress \\ P2 \\ j2\" by fact\n also have \"... \\ progress \\ (?P12(p \\ progress \\ P1 \\ j1)) \\ (max j1 j2)\"\n using le2 by blast\n also have \"... \\ progress \\ ((?P12(p := P1 p))(p\\progress \\ (?P12(p := P1 p)) \\ (max j1 j2))) \\ (max j1 j2)\"\n by (auto intro!: progress_mono_gen simp: le1 rel_mapping_alt)\n finally show \"i \\ ...\" .\n qed\nnext\n case (Eq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Less _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (LessEq _ _)\n then show ?case\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"]) (auto split: if_splits simp: pred_mapping_alt)\nnext\n case (Or \\1 \\2)\n from Or(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Or(1)[of S i] by auto\n moreover\n from Or(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Or(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Or \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (And \\1 \\2)\n from And(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using And(1)[of S i] by auto\n moreover\n from And(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using And(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.And \\1 \\2) (max j1 j2)\"\n by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) auto\nnext\n case (Ands l)\n show ?case proof (cases \"l = []\")\n case True\n then show ?thesis\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"])\n (auto split: if_splits simp: pred_mapping_alt)\n next\n case False\n then obtain \\ where \"\\ \\ set l\" by (cases l) auto\n from Ands.prems have \"\\\\\\set l. Formula.future_bounded \\\"\n by (simp add: list.pred_set)\n { fix \\\n assume \"\\ \\ set l\"\n with Ands.prems obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Ands(1)[of \\ S i]) (auto simp: list.pred_set)\n then have \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\Pj. ?P Pj\")\n by (intro exI[of _ \"(P, j)\"]) auto\n }\n then have \"\\\\\\set l. \\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\ i \\ progress \\ (fst Pj) \\ (snd Pj)\"\n (is \"\\\\\\set l. \\Pj. ?P Pj \\\")\n by blast\n with Ands(1) Ands.prems False have \"\\Pjf. \\\\\\set l. ?P (Pjf \\) \\\"\n by (auto simp: Ball_def intro: choice)\n then obtain Pjf where Pjf: \"\\\\\\set l. ?P (Pjf \\) \\\" ..\n define Pf where \"Pf = fst o Pjf\"\n define jf where \"jf = snd o Pjf\"\n have *: \"dom (Pf \\) = S\" \"range_mapping i (jf \\) (Pf \\)\" \"i \\ progress \\ (Pf \\) \\ (jf \\)\"\n if \"\\ \\ set l\" for \\\n using Pjf[THEN bspec, OF that] unfolding Pf_def jf_def by auto\n with False show ?thesis\n unfolding progress.simps eq_False[THEN iffD2, OF False] if_False\n by ((subst Min_ge_iff; simp add: False),\n intro exI[where x=\"MAX \\\\set l. jf \\\"] exI[where x=\"Max_mapping (Pf ` set l)\"]\n conjI ballI order.trans[OF *(3) progress_mono_gen] Max_mapping_coboundedI)\n (auto simp: False *[OF \\\\ \\ set l\\] \\\\ \\ set l\\)\n qed\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n then obtain P j where \"dom P = S\" \"range_mapping i j P\" \"i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Prev(1)) (auto simp: pred_mapping_alt dom_def)\n with Prev(2) have\n \"dom P = S \\ range_mapping i (max i j) P \\ i \\ progress \\ P (formula.Prev I \\) (max i j)\"\n by (auto simp: le_Suc_eq max_def pred_mapping_alt split: if_splits\n elim: order.trans[OF _ progress_mono])\n then show ?case by blast\nnext\n case (Next I \\)\n then obtain P j where \"dom P = S\" \"range_mapping (Suc i) j P\" \"Suc i \\ progress \\ P \\ j\"\n by (atomize_elim, intro Next(1)) (auto simp: pred_mapping_alt dom_def)\n then show ?case\n by (intro exI[of _ P] exI[of _ j]) (auto 0 3 simp: pred_mapping_alt dom_def)\nnext\n case (Since \\1 I \\2)\n from Since(3) obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping i j1 P1\" \"i \\ progress \\ P1 \\1 j1\"\n using Since(1)[of S i] by auto\n moreover\n from Since(3) obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping i j2 P2\" \"i \\ progress \\ P2 \\2 j2\"\n using Since(2)[of S i] by auto\n ultimately have \"i \\ progress \\ (max_mapping P1 P2) (Formula.Since \\1 I \\2) (max j1 j2)\"\n by (auto elim!: order.trans[OF _ progress_mono_gen] simp: max_mapping_cobounded1 max_mapping_cobounded2)\n with P1 P2 show ?case by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"])\n (auto elim!: pred_mapping_le intro: max_mapping_cobounded1)\nnext\n case (Until \\1 I \\2)\n from Until.prems obtain b where [simp]: \"right I = enat b\"\n by (cases \"right I\") (auto)\n obtain i' where \"i < i'\" and \"\\ \\ i + b + 1 \\ \\ \\ i'\"\n using ex_le_\\[where x=\"\\ \\ i + b + 1\"] by (auto simp add: less_eq_Suc_le)\n then have 1: \"\\ \\ i + b < \\ \\ i'\" by simp\n from Until.prems obtain P1 j1 where P1: \"dom P1 = S\" \"range_mapping (Suc i') j1 P1\" \"Suc i' \\ progress \\ P1 \\1 j1\"\n by (atomize_elim, intro Until(1)) (auto simp: pred_mapping_alt dom_def)\n from Until.prems obtain P2 j2 where P2: \"dom P2 = S\" \"range_mapping (Suc i') j2 P2\" \"Suc i' \\ progress \\ P2 \\2 j2\"\n by (atomize_elim, intro Until(2)) (auto simp: pred_mapping_alt dom_def)\n let ?P12 = \"max_mapping P1 P2\"\n have \"i \\ progress \\ ?P12 (Formula.Until \\1 I \\2) (max j1 j2)\"\n unfolding progress.simps\n proof (intro cInf_greatest, goal_cases nonempty greatest)\n case nonempty\n then show ?case\n by (auto simp: trans_le_add1[OF \\_mono] intro!: exI[of _ \"max j1 j2\"])\n next\n case (greatest x)\n from P1(2,3) have \"i' < j1\"\n by (auto simp: less_eq_Suc_le intro!: progress_le_gen elim!: order.trans pred_mapping_mono_strong)\n then have \"i' < max j1 j2\" by simp\n have \"progress \\ P1 \\1 j1 \\ progress \\ ?P12 \\1 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded1)\n moreover have \"progress \\ P2 \\2 j2 \\ progress \\ ?P12 \\2 (max j1 j2)\"\n using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded2)\n ultimately have \"i' \\ min (progress \\ ?P12 \\1 (max j1 j2)) (progress \\ ?P12 \\2 (max j1 j2))\"\n using P1(3) P2(3) by simp\n with greatest \\i' < max j1 j2\\ have \"\\ \\ i' \\ \\ \\ x + b\"\n by simp\n with 1 have \"\\ \\ i < \\ \\ x\" by simp\n then show ?case by (auto dest!: less_\\D)\n qed\n with P1 P2 \\i < i'\\ show ?case\n by (intro exI[of _ \"max_mapping P1 P2\"] exI[of _ \"max j1 j2\"]) (auto simp: range_mapping_relax)\nnext\n case (MatchP I r)\n then show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchP.prems show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some i else None\"] exI[of _ i])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set)\n next\n case False\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj))\"\n let ?pickP = \"fst o pick\" let ?pickj = \"snd o pick\"\n from MatchP have pick: \"\\ \\ regex.atms r \\ dom (?pickP \\) = S \\\n range_mapping i (?pickj \\) (?pickP \\) \\ i \\ progress \\ (?pickP \\) \\ (?pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping i (snd Pj) (fst Pj) \\\n i \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n with False show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"Max_mapping (?pickP ` regex.atms r)\"] exI[of _ \"Max (?pickj ` regex.atms r)\"])\n (auto simp: Max_mapping_coboundedI\n order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen])\n qed\nnext\n case (MatchF I r)\n from MatchF.prems obtain b where [simp]: \"right I = enat b\"\n by auto\n obtain i' where i': \"i < i'\" \"\\ \\ i + b + 1 \\ \\ \\ i'\"\n using ex_le_\\[where x=\"\\ \\ i + b + 1\"] by (auto simp add: less_eq_Suc_le)\n then have 1: \"\\ \\ i + b < \\ \\ i'\" by simp\n have ix: \"i \\ x\" if \"\\ \\ i' \\ b + \\ \\ x\" \"b + \\ \\ i < \\ \\ i'\" for x\n using less_\\D[of \\ i] that less_le_trans by fastforce\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n with MatchF.prems i' ix show ?thesis\n unfolding progress.simps\n by (intro exI[of _ \"\\e. if e \\ S then Some (Suc i') else None\"] exI[of _ \"Suc i'\"])\n (auto split: if_splits simp: pred_mapping_alt regex.pred_set add.commute less_Suc_eq\n intro!: cInf_greatest dest!: spec[of _ i'] less_imp_le[THEN \\_mono, of _ i' \\])\n next\n case False\n then obtain \\ where \\: \"\\ \\ regex.atms r\" by auto\n define pick where \"pick = (\\\\. SOME Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj))\"\n define pickP where \"pickP = fst o pick\" define pickj where \"pickj = snd o pick\"\n from MatchF have pick: \"\\ \\ regex.atms r \\ dom (pickP \\) = S \\\n range_mapping (Suc i') (pickj \\) (pickP \\) \\ Suc i' \\ progress \\ (pickP \\) \\ (pickj \\)\" for \\\n unfolding pick_def o_def future_bounded.simps regex.pred_set pickj_def pickP_def\n by (intro someI_ex[where P = \"\\Pj. dom (fst Pj) = S \\ range_mapping (Suc i') (snd Pj) (fst Pj) \\\n Suc i' \\ progress \\ (fst Pj) \\ (snd Pj)\"]) auto\n let ?P = \"Max_mapping (pickP ` regex.atms r)\" let ?j = \"Max (pickj ` regex.atms r)\"\n from pick[OF \\] False \\ have \"Suc i' \\ ?j\"\n by (intro order_trans[OF pick[THEN conjunct2, THEN conjunct2], OF \\] order_trans[OF progress_le_gen])\n (auto simp: Max_ge_iff dest: range_mapping_relax[of _ _ _ 0, OF _ _ order_refl, simplified])\n moreover\n note i' 1 ix\n moreover\n from MatchF.prems have \"Regex.pred_regex Formula.future_bounded r\"\n by auto\n ultimately show ?thesis using \\_mono[of _ ?j \\] less_\\D[of \\ i] pick False\n by (intro exI[of _ \"?j\"] exI[of _ \"?P\"])\n (auto 0 3 intro!: cInf_greatest\n order_trans[OF le_SucI[OF order_refl] order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen]]\n range_mapping_Max_mapping[OF _ _ ballI[OF range_mapping_relax[of \"Suc i'\" _ _ i, OF _ _ order_refl]]]\n simp: ac_simps Suc_le_eq trans_le_add2 Max_mapping_coboundedI progress_regex_def\n dest: spec[of _ \"i'\"] spec[of _ ?j])\n qed\nqed (auto split: option.splits)\n\nlemma progress_ge: \"Formula.future_bounded \\ \\ \\j. i \\ progress \\ Map.empty \\ j\"\n using progress_ge_gen[of \\ \"{}\" i \\]\n by auto\n\n\n\nlemma progress_time_conv:\n assumes \"\\i \\ i = \\ \\' i\"\n shows \"progress \\ P \\ j = progress \\' P \\ j\"\n using assms proof (induction \\ arbitrary: P)\n case (Until \\1 I \\2)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with Until show ?case\n proof (cases \"right I\")\n case (enat b)\n then show ?thesis\n proof (cases \"j\")\n case (Suc n)\n with enat * Until show ?thesis\n using \\_mono[THEN trans_le_add1]\n by (auto 8 0\n intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=n] cInf_restrict_nat[symmetric, where x=n]])\n qed simp\n qed simp\nnext\n case (MatchF I r)\n have *: \"i \\ j - 1 \\ i < j\" if \"j \\ 0\" for i\n using that by auto\n with MatchF show ?case using \\_mono[THEN trans_le_add1]\n by (cases \"right I\"; cases j)\n ((auto 6 0 simp: progress_le_gen progress_regex_def intro!: box_equals[OF arg_cong[where f=Inf]\n cInf_restrict_nat[symmetric, where x=\"j-1\"] cInf_restrict_nat[symmetric, where x=\"j-1\"]]) [])+\nqed (auto simp: progress_regex_def)\n\nlemma Inf_UNIV_nat: \"(Inf UNIV :: nat) = 0\"\n by (simp add: cInf_eq_minimum)\n\nlemma progress_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"progress \\ P \\ (plen \\) = progress \\' P \\ (plen \\)\"\n using assms by (auto intro: progress_time_conv \\_prefix_conv)\n\nlemma bounded_rtranclp_mono:\n fixes n :: \"'x :: linorder\"\n assumes \"\\i j. R i j \\ j < n \\ S i j\" \"\\i j. R i j \\ i \\ j\"\n shows \"rtranclp R i j \\ j < n \\ rtranclp S i j\"\nproof (induct rule: rtranclp_induct)\n case (step y z)\n then show ?case\n using assms(1,2)[of y z]\n by (auto elim!: rtrancl_into_rtrancl[to_pred, rotated])\nqed auto\n\nlemma sat_prefix_conv_gen:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ P \\ (plen \\) \\ dom V = dom V' \\ dom P = dom V \\\n pred_mapping (\\x. x \\ plen \\) P \\\n (\\p i \\. p \\ dom V \\ i < the (P p) \\ the (V p) i = the (V' p) i) \\\n Formula.sat \\ V v i \\ \\ Formula.sat \\' V' v i \\\"\nproof (induction \\ arbitrary: P V V' v i)\n case (Pred e ts)\n from Pred.prems(1,4) have \"i < plen \\\"\n by (blast intro!: order.strict_trans2 progress_le_gen)\n show ?case proof (cases \"V e\")\n case None\n then have \"V' e = None\" using \\dom V = dom V'\\ by auto\n with None \\_prefix_conv[OF assms(1,2) \\i < plen \\\\] show ?thesis by simp\n next\n case (Some a)\n obtain a' where \"V' e = Some a'\" using Some \\dom V = dom V'\\ by auto\n then have \"i < the (P e)\"\n using Pred.prems(1-3) by (auto split: option.splits)\n then have \"the (V e) i = the (V' e) i\"\n using Some by (intro Pred.prems(5)) (simp_all add: domI)\n with Some \\V' e = Some a'\\ show ?thesis by simp\n qed\nnext\n case (Let p \\ \\)\n let ?V = \"\\V \\. (V(p \\ \\i. {v. length v = Formula.nfv \\ \\ Formula.sat \\ V v i \\}))\"\n show ?case unfolding sat.simps proof (rule Let.IH(2))\n from Let.prems show \"i < progress \\ (P(p \\ progress \\ P \\ (plen \\))) \\ (plen \\)\"\n by simp\n from Let.prems show \"dom (?V V \\) = dom (?V V' \\')\"\n by simp\n from Let.prems show \"dom (P(p \\ progress \\ P \\ (plen \\))) = dom (?V V \\)\"\n by simp\n from Let.prems show \"pred_mapping (\\x. x \\ plen \\) (P(p \\ progress \\ P \\ (plen \\)))\"\n by (auto intro!: pred_mapping_map_upd elim!: progress_le_gen)\n next\n fix p' i \\'\n assume 1: \"p' \\ dom (?V V \\)\" and 2: \"i < the ((P(p \\ progress \\ P \\ (plen \\))) p')\"\n show \"the (?V V \\ p') i = the (?V V' \\' p') i\" proof (cases \"p' = p\")\n case True\n with Let 2 show ?thesis by auto\n next\n case False\n with 1 2 show ?thesis by (auto intro!: Let.prems(5))\n qed\n qed\nnext\n case (Eq t1 t2)\n show ?case by simp\nnext\n case (Neg \\)\n then show ?case by simp\nnext\n case (Or \\1 \\2)\n then show ?case by auto\nnext\n case (Ands l)\n from Ands.prems have \"\\\\\\set l. i < progress \\ P \\ (plen \\)\"\n by (cases l) simp_all\n with Ands show ?case unfolding sat_Ands by blast\nnext\n case (Exists \\)\n then show ?case by simp\nnext\n case (Prev I \\)\n with \\_prefix_conv[OF assms(1,2)] show ?case\n by (cases i) (auto split: if_splits)\nnext\n case (Next I \\)\n then have \"Suc i < plen \\\"\n by (auto intro: order.strict_trans2[OF _ progress_le_gen[of _ P \\ \\]])\n with Next.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong Next) auto\nnext\n case (Since \\1 I \\2)\n then have \"i < plen \\\"\n by (auto elim!: order.strict_trans2[OF _ progress_le_gen])\n with Since.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro conj_cong ex_cong ball_cong Since) auto\nnext\n case (Until \\1 I \\2)\n from Until.prems obtain b where right[simp]: \"right I = enat b\"\n by (cases \"right I\") (auto simp add: Inf_UNIV_nat)\n from Until.prems obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\"\n \"j \\ progress \\ P \\1 (plen \\)\" \"j \\ progress \\ P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < progress \\ P \\1 (plen \\)\" and 2: \"k < progress \\ P \\2 (plen \\)\"\n if \"\\ \\ k \\ \\ \\ i + b\" for k\n using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\])+\n have 3: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" for k\n using 1[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n\n from Until.prems have \"i < progress \\' P (Formula.Until \\1 I \\2) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n then obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\"\n \"j \\ progress \\' P \\1 (plen \\)\" \"j \\ progress \\' P \\2 (plen \\)\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ \"i\"]\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"k < progress \\ P \\1 (plen \\)\" and 21: \"k < progress \\ P \\2 (plen \\)\"\n if \"\\ \\' k \\ \\ \\' i + b\" for k\n unfolding progress_prefix_conv[OF assms(1,2)]\n using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\'])+\n have 31: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n using 11[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])\n show ?case unfolding sat.simps\n proof ((intro ex_cong iffI; elim conjE), goal_cases LR RL)\n case (LR j)\n with Until(1)[OF 1] Until(2)[OF 2] \\_prefix_conv[OF assms(1,2) 3] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \\_mono, rotated])\n next\n case (RL j)\n with Until(1)[OF 11] Until(2)[OF 21] \\_prefix_conv[OF assms(1,2) 31] Until.prems show ?case\n by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \\_mono, rotated])\n qed\nnext\n case (MatchP I r)\n then have \"i < plen \\\"\n by (force simp: pred_mapping_alt elim!: order.strict_trans2[OF _ progress_le_gen])\n with MatchP.prems \\_prefix_conv[OF assms(1,2)] show ?case\n unfolding sat.simps\n by (intro ex_cong conj_cong match_cong_strong MatchP) (auto simp: progress_regex_def split: if_splits)\nnext\n case (MatchF I r)\n from MatchF.prems obtain b where right[simp]: \"right I = enat b\"\n by (cases \"right I\") (auto simp add: Inf_UNIV_nat)\n show ?case\n proof (cases \"regex.atms r = {}\")\n case True\n from MatchF.prems(1) obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" for k\n by (meson \\_mono discrete not_le order.strict_trans2 that)\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n then obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\" \"j \\ plen \\\"\n by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 2: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n by (meson \\_mono discrete not_le order.strict_trans2 that)\n from MatchF.prems(1,4) True show ?thesis\n unfolding sat.simps conj_commute[of \"left I \\ _\" \"_ \\ _\"]\n proof (intro ex_cong conj_cong match_cong_strong, goal_cases left right sat)\n case (left j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 1, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (right j)\n then show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \\_mono, rotated]))\n qed auto\n next\n case False\n from MatchF.prems(1) False obtain j where \"\\ \\ i + b + 1 \\ \\ \\ j\" \"(\\x\\regex.atms r. j \\ progress \\ P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 1: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"\\ \\ k \\ \\ \\ i + b\" for k \\\n using that\n by (fastforce elim!: order.strict_trans2[rotated] intro: less_\\D[of \\])\n then have 2: \"k < plen \\\" if \"\\ \\ k \\ \\ \\ i + b\" \"regex.atms r \\ {}\" for k\n using that\n by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n\n from MatchF.prems have \"i < progress \\' P (Formula.MatchF I r) (plen \\)\"\n unfolding progress_prefix_conv[OF assms(1,2)] by blast\n with False obtain j where \"\\ \\' i + b + 1 \\ \\ \\' j\" \"(\\x\\regex.atms r. j \\ progress \\' P x (plen \\))\"\n by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def\n dest!: le_cInf_iff[THEN iffD1, rotated -1])\n then have 11: \"\\ \\ regex.atms r \\ k < progress \\ P \\ (plen \\)\" if \"\\ \\' k \\ \\ \\' i + b\" for k \\\n using that using progress_prefix_conv[OF assms(1,2)]\n by (auto 0 3 elim!: order.strict_trans2[rotated] intro: less_\\D[of \\'])\n have 21: \"k < plen \\\" if \"\\ \\' k \\ \\ \\' i + b\" for k\n using 11[OF that(1)] False by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \\], of k])\n show ?thesis unfolding sat.simps conj_commute[of \"left I \\ _\" \"_ \\ _\"]\n proof ((intro ex_cong conj_cong match_cong_strong MatchF(1)[OF _ _ MatchF(3-6)]; assumption?), goal_cases right left progress)\n case (right j)\n with False show ?case\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (left j)\n with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]\n by (intro iffI)\n ((subst (1 2) \\_prefix_conv[OF assms(1,2) 21, symmetric]; auto elim: order.trans[OF \\_mono, rotated]),\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \\_mono, rotated]))\n next\n case (progress j k z)\n with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]\n by (elim 1[rotated])\n (subst (1 2) \\_prefix_conv[OF assms(1,2) 21]; auto elim!: order.trans[OF \\_mono, rotated])\n qed\n qed\nqed auto\n\nlemma sat_prefix_conv:\n assumes \"prefix_of \\ \\\" and \"prefix_of \\ \\'\"\n shows \"i < progress \\ Map.empty \\ (plen \\) \\\n Formula.sat \\ Map.empty v i \\ \\ Formula.sat \\' Map.empty v i \\\"\n by (erule sat_prefix_conv_gen[OF assms]) auto\n\nlemma progress_remove_neg[simp]: \"progress \\ P (remove_neg \\) j = progress \\ P \\ j\"\n by (cases \\) simp_all\n\nlemma safe_progress_get_and: \"safe_formula \\ \\\n Min ((\\\\. progress \\ P \\ j) ` set (get_and_list \\)) = progress \\ P \\ j\"\n by (induction \\ rule: get_and_list.induct) auto\n\nlemma progress_convert_multiway: \"safe_formula \\ \\ progress \\ P (convert_multiway \\) j = progress \\ P \\ j\"\nproof (induction \\ arbitrary: P rule: safe_formula_induct)\n case (And_safe \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ \\)\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (get_and_list ?c\\ @ get_and_list ?c\\)\"\n using And_safe by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_safe.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (And_Not \\ \\)\n let ?c = \"convert_multiway (Formula.And \\ (Formula.Neg \\))\"\n let ?c\\ = \"convert_multiway \\\"\n let ?c\\ = \"convert_multiway \\\"\n have c_eq: \"?c = Formula.Ands (Formula.Neg ?c\\ # get_and_list ?c\\)\"\n using And_Not by simp\n from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n moreover from \\safe_formula \\\\ have \"safe_formula ?c\\\" by (rule safe_convert_multiway)\n ultimately show ?case\n unfolding c_eq\n using And_Not.IH\n by (auto simp: get_and_nonempty Min.union safe_progress_get_and)\nnext\n case (MatchP I r)\n from MatchP show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nnext\n case (MatchF I r)\n from MatchF show ?case\n unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image\n by (intro if_cong arg_cong[of _ _ Min] arg_cong[of _ _ Inf] arg_cong[of _ _ \"(\\) _\"]\n image_cong Collect_cong all_cong1 imp_cong conj_cong image_cong)\n (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)\nqed auto\n\n\nsubsection \\Specification\\\n\ndefinition pprogress :: \"Formula.formula \\ Formula.prefix \\ nat\" where\n \"pprogress \\ \\ = (THE n. \\\\. prefix_of \\ \\ \\ progress \\ Map.empty \\ (plen \\) = n)\"\n\nlemma pprogress_eq: \"prefix_of \\ \\ \\ pprogress \\ \\ = progress \\ Map.empty \\ (plen \\)\"\n unfolding pprogress_def using progress_prefix_conv\n by blast\n\nlocale future_bounded_mfodl =\n fixes \\ :: Formula.formula\n assumes future_bounded: \"Formula.future_bounded \\\"\n\nsublocale future_bounded_mfodl \\ sliceable_timed_progress \"Formula.nfv \\\" \"Formula.fv \\\" \"relevant_events \\\"\n \"\\\\ v i. Formula.sat \\ Map.empty v i \\\" \"pprogress \\\"\nproof (unfold_locales, goal_cases)\n case (1 x)\n then show ?case by (simp add: fvi_less_nfv)\nnext\n case (2 v v' \\ i)\n then show ?case by (simp cong: sat_fv_cong[rule_format])\nnext\n case (3 v S \\ i)\n then show ?case\n using sat_slice_iff[symmetric] by simp\nnext\n case (4 \\ \\')\n moreover obtain \\ where \"prefix_of \\' \\\"\n using ex_prefix_of ..\n moreover have \"prefix_of \\ \\\"\n using prefix_of_antimono[OF \\\\ \\ \\'\\ \\prefix_of \\' \\\\] .\n ultimately show ?case\n by (simp add: pprogress_eq plen_mono progress_mono)\nnext\n case (5 \\ x)\n obtain j where \"x \\ progress \\ Map.empty \\ j\"\n using future_bounded progress_ge by blast\n then have \"x \\ pprogress \\ (take_prefix j \\)\"\n by (simp add: pprogress_eq[of _ \\])\n then show ?case by force\nnext\n case (6 \\ \\ \\' i v)\n then have \"i < progress \\ Map.empty \\ (plen \\)\"\n by (simp add: pprogress_eq)\n with 6 show ?case\n using sat_prefix_conv by blast\nnext\n case (7 \\ \\')\n then have \"plen \\ = plen \\'\"\n by transfer (simp add: list_eq_iff_nth_eq)\n moreover obtain \\ \\' where \"prefix_of \\ \\\" \"prefix_of \\' \\'\"\n using ex_prefix_of by blast+\n moreover have \"\\i < plen \\. \\ \\ i = \\ \\' i\"\n using 7 calculation\n by transfer (simp add: list_eq_iff_nth_eq)\n ultimately show ?case\n by (simp add: pprogress_eq progress_time_conv)\nqed\n\nlocale verimon_spec =\n fixes \\ :: Formula.formula\n assumes monitorable: \"mmonitorable \\\"\n\nsublocale verimon_spec \\ future_bounded_mfodl\n using monitorable by unfold_locales (simp add: mmonitorable_def)\n\n\nsubsection \\Correctness\\\n\nsubsubsection \\Invariants\\\n\ndefinition wf_mbuf2 :: \"nat \\ nat \\ nat \\ (nat \\ event_data table \\ bool) \\ (nat \\ event_data table \\ bool) \\\n event_data mbuf2 \\ bool\" where\n \"wf_mbuf2 i ja jb P Q buf \\ i \\ ja \\ i \\ jb \\ (case buf of (xs, ys) \\\n list_all2 P [i.. list_all2 Q [i.. 'b \\ 'c \\ bool) \\ 'a list \\ 'b list \\ 'c list \\ bool\" for P :: \"('a \\ 'b \\ 'c \\ bool)\" where\n \"list_all3 P [] [] []\"\n| \"P a1 a2 a3 \\ list_all3 P q1 q2 q3 \\ list_all3 P (a1 # q1) (a2 # q2) (a3 # q3)\"\n\nlemma list_all3_list_all2D: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma list_all2_list_all3I: \"length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs \\\n list_all3 P xs ys zs\"\n by (induct xs ys arbitrary: zs rule: list_induct2)\n (auto simp: list_all2_Cons1 intro: list_all3.intros)\n\nlemma list_all3_list_all2_eq: \"list_all3 P xs ys zs \\\n (length xs = length ys \\ list_all2 (case_prod P) (zip xs ys) zs)\"\n using list_all2_list_all3I list_all3_list_all2D by blast\n\nlemma list_all3_mapD: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n by (induct \"map f xs\" \"map g ys\" \"map h zs\" arbitrary: xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_mapI: \"list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs \\\n list_all3 P (map f xs) (map g ys) (map h zs)\"\n by (induct xs ys zs rule: list_all3.induct)\n (auto intro: list_all3.intros)\n\nlemma list_all3_map_iff: \"list_all3 P (map f xs) (map g ys) (map h zs) \\\n list_all3 (\\x y z. P (f x) (g y) (h z)) xs ys zs\"\n using list_all3_mapD list_all3_mapI by blast\n\nlemmas list_all3_map =\n list_all3_map_iff[where g=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and h=id, unfolded list.map_id id_apply]\n list_all3_map_iff[where f=id and g=id, unfolded list.map_id id_apply]\n\nlemma list_all3_conv_all_nth:\n \"list_all3 P xs ys zs =\n (length xs = length ys \\ length ys = length zs \\ (\\i < length xs. P (xs!i) (ys!i) (zs!i)))\"\n by (auto simp add: list_all3_list_all2_eq list_all2_conv_all_nth)\n\nlemma list_all3_refl [intro?]:\n \"(\\x. x \\ set xs \\ P x x x) \\ list_all3 P xs xs xs\"\n by (simp add: list_all3_conv_all_nth)\n\ndefinition wf_mbufn :: \"nat \\ nat list \\ (nat \\ event_data table \\ bool) list \\ event_data mbufn \\ bool\" where\n \"wf_mbufn i js Ps buf \\ list_all3 (\\P j xs. i \\ j \\ list_all2 P [i.. _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula \\ Formula.formula \\ event_data mbuf2 \\ bool\" where\n \"wf_mbuf2' \\ P V j n R \\ \\ buf \\ wf_mbuf2 (min (progress \\ P \\ j) (progress \\ P \\ j))\n (progress \\ P \\ j) (progress \\ P \\ j)\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) buf\"\n\ndefinition wf_mbufn' :: \"Formula.trace \\ _ \\ _ \\ nat \\ nat \\ event_data list set \\\n Formula.formula Regex.regex \\ event_data mbufn \\ bool\" where\n \"wf_mbufn' \\ P V j n R r buf \\ (case to_mregex r of (mr, \\s) \\\n wf_mbufn (progress_regex \\ P r j) (map (\\\\. progress \\ P \\ j) \\s)\n (map (\\\\ i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n buf)\"\n\nlemma wf_mbuf2'_UNIV_alt: \"wf_mbuf2' \\ P V j n UNIV \\ \\ buf \\ (case buf of (xs, ys) \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] xs \\\n list_all2 (\\i. wf_table n (Formula.fv \\) (\\v. Formula.sat \\ V (map the v) i \\))\n [min (progress \\ P \\ j) (progress \\ P \\ j) ..< (progress \\ P \\ j)] ys)\"\n unfolding wf_mbuf2'_def wf_mbuf2_def\n by (simp add: mem_restr_UNIV[THEN eqTrueI, abs_def] split: prod.split)\n\ndefinition wf_ts :: \"Formula.trace \\ _ \\ nat \\ Formula.formula \\ Formula.formula \\ ts list \\ bool\" where\n \"wf_ts \\ P j \\ \\ ts \\ list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j).. _ \\ nat \\ Formula.formula Regex.regex \\ ts list \\ bool\" where\n \"wf_ts_regex \\ P j r ts \\ list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j.. I \\ \\ Formula.Since (if pos then \\ else Formula.Neg \\) I \\\"\n\ndefinition (in msaux) wf_since_aux :: \"Formula.trace \\ _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'msaux \\ nat \\ bool\" where\n \"wf_since_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n qtable (args_n args) (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n\ndefinition wf_matchP_aux :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data mr\\aux \\ nat \\ bool\" where\n \"wf_matchP_aux \\ V n R I r aux ne \\ sorted_wrt (\\x y. fst x > fst y) aux \\\n (\\t X. (t, X) \\ set aux \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ (ne-1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (case to_mregex r of (mr, \\s) \\\n (\\ms \\ RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne-1)\n (Formula.MatchP (point (\\ \\ (ne-1) - t)) (from_mregex ms \\s)))\n (lookup X ms)))) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ (ne-1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set aux))\"\n\nlemma qtable_mem_restr_UNIV: \"qtable n A(mem_restr UNIV) Q X = wf_table n A Q X\"\n unfolding qtable_def by auto\n\nlemma (in msaux) wf_since_aux_UNIV_alt:\n \"wf_since_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\ (\\cur auxlist. valid_msaux args cur aux auxlist \\\n cur = (if ne = 0 then 0 else \\ \\ (ne - 1)) \\\n sorted_wrt (\\x y. fst x > fst y) auxlist \\\n (\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n wf_table (args_n args) (Formula.fv \\)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep (args_pos args) \\ (point (\\ \\ (ne - 1) - t)) \\)) X) \\\n (\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right (args_ivl args) \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)))\"\n unfolding wf_since_aux_def qtable_mem_restr_UNIV ..\n\ndefinition wf_until_auxlist :: \"Formula.trace \\ _ \\ nat \\ event_data list set \\ bool \\\n Formula.formula \\ \\ \\ Formula.formula \\ event_data muaux \\ nat \\ bool\" where\n \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. if pos then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length auxlist \\ mem (\\ \\ j - \\ \\ i) I \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) r2)\n auxlist [ne.. _ \\ event_data list set \\ args \\\n Formula.formula \\ Formula.formula \\ 'muaux \\ nat \\ bool\" where\n \"wf_until_aux \\ V R args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n wf_until_auxlist \\ V (args_n args) R (args_pos args) \\ (args_ivl args) \\ auxlist ne)\"\n\nlemma (in muaux) wf_until_aux_UNIV_alt:\n \"wf_until_aux \\ V UNIV args \\ \\ aux ne \\ Formula.fv \\ \\ Formula.fv \\ \\\n (\\cur auxlist. valid_muaux args cur aux auxlist \\\n cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1)) \\\n list_all2 (\\x i. case x of (t, r1, r2) \\ t = \\ \\ i \\\n wf_table (args_n args) (Formula.fv \\) (\\v. if (args_pos args)\n then (\\k\\{i.. V (map the v) k \\)\n else (\\k\\{i.. V (map the v) k \\)) r1 \\\n wf_table (args_n args) (Formula.fv \\) (\\v. \\j. i \\ j \\ j < ne + length auxlist \\ mem (\\ \\ j - \\ \\ i) (args_ivl args) \\\n Formula.sat \\ V (map the v) j \\ \\\n (\\k\\{i.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\)) r2)\n auxlist [ne.. _ \\ nat \\ event_data list set \\\n \\ \\ Formula.formula Regex.regex \\ event_data ml\\aux \\ nat \\ nat \\ bool\" where\n \"wf_matchF_aux \\ V n R I r aux ne k \\ (case to_mregex r of (mr, \\s) \\\n list_all2 (\\x i. case x of (t, rels, rel) \\ t = \\ \\ i \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) i \\)) \\s rels \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < ne + length aux + k \\ mem (\\ \\ j - \\ \\ i) I \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel)\n aux [ne.. V n R I r st i =\n (case st of (aux, Y) \\ aux \\ [] \\ wf_matchF_aux \\ V n R I r aux i 0 \\\n (case to_mregex r of (mr, \\s) \\ \\ms \\ LPDs mr.\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux - 1)) (lookup Y ms)))\"\n\ndefinition lift_envs' :: \"nat \\ event_data list set \\ event_data list set\" where\n \"lift_envs' b R = (\\(xs,ys). xs @ ys) ` ({xs. length xs = b} \\ R)\"\n\nfun formula_of_constraint :: \"Formula.trm \\ bool \\ mconstraint \\ Formula.trm \\ Formula.formula\" where\n \"formula_of_constraint (t1, True, MEq, t2) = Formula.Eq t1 t2\"\n| \"formula_of_constraint (t1, True, MLess, t2) = Formula.Less t1 t2\"\n| \"formula_of_constraint (t1, True, MLessEq, t2) = Formula.LessEq t1 t2\"\n| \"formula_of_constraint (t1, False, MEq, t2) = Formula.Neg (Formula.Eq t1 t2)\"\n| \"formula_of_constraint (t1, False, MLess, t2) = Formula.Neg (Formula.Less t1 t2)\"\n| \"formula_of_constraint (t1, False, MLessEq, t2) = Formula.Neg (Formula.LessEq t1 t2)\"\n\ninductive (in maux) wf_mformula :: \"Formula.trace \\ nat \\ _ \\ _ \\\n nat \\ event_data list set \\ ('msaux, 'muaux) mformula \\ Formula.formula \\ bool\"\n for \\ j where\n Eq: \"is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1. x < n \\ \\x\\Formula.fv_trm t2. x < n \\\n wf_mformula \\ j P V n R (MRel (eq_rel n t1 t2)) (Formula.Eq t1 t2)\"\n | neq_Var: \"x < n \\\n wf_mformula \\ j P V n R (MRel empty_table) (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var x)))\"\n | Pred: \"\\x\\Formula.fv (Formula.Pred e ts). x < n \\\n \\t\\set ts. Formula.is_Var t \\ Formula.is_Const t \\\n wf_mformula \\ j P V n R (MPred e ts) (Formula.Pred e ts)\"\n | Let: \"wf_mformula \\ j P V m UNIV \\ \\' \\\n wf_mformula \\ j (P(p \\ progress \\ P \\' j))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\'})) n R \\ \\' \\\n {0.. Formula.fv \\' \\ b \\ m \\ m = Formula.nfv \\' \\\n wf_mformula \\ j P V n R (MLet p m \\ \\) (Formula.Let p \\' \\')\"\n | And: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if pos then \\ = Formula.And \\' \\'\n else \\ = Formula.And \\' (Formula.Neg \\') \\ Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MAnd (fv \\') \\ pos (fv \\') \\ buf) \\\"\n | AndAssign: \"wf_mformula \\ j P V n R \\ \\' \\\n x < n \\ x \\ Formula.fv \\' \\ Formula.fv_trm t \\ Formula.fv \\' \\ (x, t) = conf \\\n \\' = Formula.Eq (Formula.Var x) t \\ \\' = Formula.Eq t (Formula.Var x) \\\n wf_mformula \\ j P V n R (MAndAssign \\ conf) (Formula.And \\' \\')\"\n | AndRel: \"wf_mformula \\ j P V n R \\ \\' \\\n \\' = formula_of_constraint conf \\\n (let (t1, _, _, t2) = conf in Formula.fv_trm t1 \\ Formula.fv_trm t2 \\ Formula.fv \\') \\\n wf_mformula \\ j P V n R (MAndRel \\ conf) (Formula.And \\' \\')\"\n | Ands: \"list_all2 (\\\\ \\'. wf_mformula \\ j P V n R \\ \\') l (l_pos @ map remove_neg l_neg) \\\n wf_mbufn (progress \\ P (Formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (l_pos @ map remove_neg l_neg)) (map (\\\\ i.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (l_pos @ map remove_neg l_neg)) buf \\\n (l_pos, l_neg) = partition safe_formula l' \\\n l_pos \\ [] \\\n list_all safe_formula (map remove_neg l_neg) \\\n A_pos = map fv l_pos \\\n A_neg = map fv l_neg \\\n \\(set A_neg) \\ \\(set A_pos) \\\n wf_mformula \\ j P V n R (MAnds A_pos A_neg l buf) (Formula.Ands l')\"\n | Or: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n Formula.fv \\' = Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_mformula \\ j P V n R (MOr \\ \\ buf) (Formula.Or \\' \\')\"\n | Neg: \"wf_mformula \\ j P V n R \\ \\' \\ Formula.fv \\' = {} \\\n wf_mformula \\ j P V n R (MNeg \\) (Formula.Neg \\')\"\n | Exists: \"wf_mformula \\ j P V (Suc n) (lift_envs R) \\ \\' \\\n wf_mformula \\ j P V n R (MExists \\) (Formula.Exists \\')\"\n | Agg: \"wf_mformula \\ j P V (b + n) (lift_envs' b R) \\ \\' \\\n y < n \\\n y + b \\ Formula.fv \\' \\\n {0.. Formula.fv \\' \\\n Formula.fv_trm f \\ Formula.fv \\' \\\n g0 = (Formula.fv \\' \\ {0..\n wf_mformula \\ j P V n R (MAgg g0 y \\ b f \\) (Formula.Agg y \\ b f \\')\"\n | Prev: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ j = 0 \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [min (progress \\ P \\' j) (j-1).. P \\' j] buf \\\n list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\' j) (j-1)..\n wf_mformula \\ j P V n R (MPrev I \\ first buf nts) (Formula.Prev I \\')\"\n | Next: \"wf_mformula \\ j P V n R \\ \\' \\\n first \\ progress \\ P \\' j = 0 \\\n list_all2 (\\i t. t = \\ \\ i) [progress \\ P \\' j - 1..\n wf_mformula \\ j P V n R (MNext I \\ first nts) (Formula.Next I \\')\"\n | Since: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n wf_since_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Since \\'' I \\') j) \\\n wf_mformula \\ j P V n R (MSince args \\ \\ buf nts aux) (Formula.Since \\'' I \\')\"\n | Until: \"wf_mformula \\ j P V n R \\ \\' \\ wf_mformula \\ j P V n R \\ \\' \\\n if args_pos args then \\'' = \\' else \\'' = Formula.Neg \\' \\\n safe_formula \\'' = args_pos args \\\n args_ivl args = I \\\n args_n args = n \\\n args_L args = Formula.fv \\' \\\n args_R args = Formula.fv \\' \\\n Formula.fv \\' \\ Formula.fv \\' \\\n wf_mbuf2' \\ P V j n R \\' \\' buf \\\n wf_ts \\ P j \\' \\' nts \\\n wf_until_aux \\ V R args \\' \\' aux (progress \\ P (Formula.Until \\'' I \\') j) \\\n progress \\ P (Formula.Until \\'' I \\') j + length_muaux args aux = min (progress \\ P \\' j) (progress \\ P \\' j) \\\n wf_mformula \\ j P V n R (MUntil args \\ \\ buf nts aux) (Formula.Until \\'' I \\')\"\n | MatchP: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (RPDs mr) \\\n safe_regex Past Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j) \\\n wf_mformula \\ j P V n R (MMatchP I mr mrs \\s buf nts aux) (Formula.MatchP I r)\"\n | MatchF: \"(case to_mregex r of (mr', \\s') \\\n list_all2 (wf_mformula \\ j P V n R) \\s \\s' \\ mr = mr') \\\n mrs = sorted_list_of_set (LPDs mr) \\\n safe_regex Futu Strict r \\\n wf_mbufn' \\ P V j n R r buf \\\n wf_ts_regex \\ P j r nts \\\n wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j \\\n wf_mformula \\ j P V n R (MMatchF I mr mrs \\s buf nts aux) (Formula.MatchF I r)\"\n\ndefinition (in maux) wf_mstate :: \"Formula.formula \\ Formula.prefix \\ event_data list set \\ ('msaux, 'muaux) mstate \\ bool\" where\n \"wf_mstate \\ \\ R st \\ mstate_n st = Formula.nfv \\ \\ (\\\\. prefix_of \\ \\ \\\n mstate_i st = progress \\ Map.empty \\ (plen \\) \\\n wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\)\"\n\n\nsubsubsection \\Initialisation\\\n\n\nlemma wf_mbuf2'_0: \"pred_mapping (\\x. x = 0) P \\ wf_mbuf2' \\ P V 0 n R \\ \\ ([], [])\"\n unfolding wf_mbuf2'_def wf_mbuf2_def by simp\n\nlemma wf_mbufn'_0: \"to_mregex r = (mr, \\s) \\ pred_mapping (\\x. x = 0) P \\ wf_mbufn' \\ P V 0 n R r (replicate (length \\s) [])\"\n unfolding wf_mbufn'_def wf_mbufn_def map_replicate_const[symmetric]\n by (auto simp: list_all3_map intro: list_all3_refl simp: Min_eq_iff progress_regex_def)\n\nlemma wf_ts_0: \"wf_ts \\ P 0 \\ \\ []\"\n unfolding wf_ts_def by simp\n\nlemma wf_ts_regex_0: \"wf_ts_regex \\ P 0 r []\"\n unfolding wf_ts_regex_def by simp\n\nlemma (in msaux) wf_since_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n wf_since_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b) \\' \\' (init_msaux (init_args I n (Formula.fv \\') (Formula.fv \\') b)) 0\"\n unfolding wf_since_aux_def by (auto intro!: valid_init_msaux)\n\nlemma (in muaux) wf_until_aux_Nil: \"Formula.fv \\' \\ Formula.fv \\' \\\n wf_until_aux \\ V R (init_args I n (Formula.fv \\') (Formula.fv \\') b) \\' \\' (init_muaux (init_args I n (Formula.fv \\') (Formula.fv \\') b)) 0\"\n unfolding wf_until_aux_def wf_until_auxlist_def by (auto intro: valid_init_muaux)\n\nlemma wf_matchP_aux_Nil: \"wf_matchP_aux \\ V n R I r [] 0\"\n unfolding wf_matchP_aux_def by simp\n\nlemma wf_matchF_aux_Nil: \"wf_matchF_aux \\ V n R I r [] 0 k\"\n unfolding wf_matchF_aux_def by simp\n\nlemma fv_regex_alt: \"safe_regex m g r \\ Formula.fv_regex r = (\\\\ \\ atms r. Formula.fv \\)\"\n unfolding fv_regex_alt atms_def\n by (auto 0 3 dest: safe_regex_safe_formula)\n\nlemmas to_mregex_atms =\n to_mregex_ok[THEN conjunct1, THEN equalityD1, THEN set_mp, rotated]\n\nlemma (in maux) wf_minit0: \"safe_formula \\ \\ \\x\\Formula.fv \\. x < n \\\n pred_mapping (\\x. x = 0) P \\\n wf_mformula \\ 0 P V n R (minit0 n \\) \\\"\nproof (induction arbitrary: n R P V rule: safe_formula_induct)\n case (Eq_Const c d)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var1 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (Eq_Var2 c x)\n then show ?case\n by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)\nnext\n case (neq_Var x y)\n then show ?case by (auto intro!: wf_mformula.neq_Var)\nnext\n case (Pred e ts)\n then show ?case by (auto intro!: wf_mformula.Pred)\nnext\n case (Let p \\ \\)\n with fvi_less_nfv show ?case\n by (auto simp: pred_mapping_alt dom_def intro!: wf_mformula.Let Let(4,5))\nnext\n case (And_assign \\ \\)\n then have 1: \"\\x\\fv \\. x < n\" by simp\n from 1 \\safe_assignment (fv \\) \\\\\n obtain x t where\n \"x < n\" \"x \\ fv \\\" \"fv_trm t \\ fv \\\"\n \"\\ = Formula.Eq (Formula.Var x) t \\ \\ = Formula.Eq t (Formula.Var x)\"\n unfolding safe_assignment_def by (force split: formula.splits trm.splits)\n with And_assign show ?case\n by (auto intro!: wf_mformula.AndAssign split: trm.splits)\nnext\n case (And_safe \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (And_constraint \\ \\)\n from \\fv \\ \\ fv \\\\ \\is_constraint \\\\\n obtain t1 p c t2 where\n \"(t1, p, c, t2) = split_constraint \\\"\n \"formula_of_constraint (split_constraint \\) = \\\"\n \"fv_trm t1 \\ fv_trm t2 \\ fv \\\"\n by (induction rule: is_constraint.induct) auto\n with And_constraint show ?case\n by (auto 0 3 intro!: wf_mformula.AndRel)\nnext\n case (And_Not \\ \\)\n then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)\nnext\n case (Ands l pos neg)\n note posneg = \"Ands.hyps\"(1)\n let ?wf_minit = \"\\x. wf_mformula \\ 0 P V n R (minit0 n x)\"\n let ?pos = \"filter safe_formula l\"\n let ?neg = \"filter (Not \\ safe_formula) l\"\n have \"list_all2 ?wf_minit ?pos pos\"\n using Ands.IH(1) Ands.prems posneg by (auto simp: list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all2 ?wf_minit (map remove_neg ?neg) (map remove_neg neg)\"\n using Ands.IH(2) Ands.prems posneg by (auto simp: list.rel_map list_all_iff intro!: list.rel_refl_strong)\n moreover have \"list_all3 (\\_ _ _. True) (?pos @ map remove_neg ?neg) (?pos @ map remove_neg ?neg) l\"\n by (auto simp: list_all3_conv_all_nth comp_def sum_length_filter_compl)\n moreover have \"l \\ [] \\ (MIN \\\\set l. (0 :: nat)) = 0\"\n by (cases l) (auto simp: Min_eq_iff)\n ultimately show ?case using Ands.hyps Ands.prems(2)\n by (auto simp: wf_mbufn_def list_all3_map list.rel_map map_replicate_const[symmetric] subset_eq\n map_map[symmetric] map_append[symmetric] simp del: map_map map_append\n intro!: wf_mformula.Ands list_all2_appendI)\nnext\n case (Neg \\)\n then show ?case by (auto intro!: wf_mformula.Neg)\nnext\n case (Or \\ \\)\n then show ?case by (auto intro!: wf_mformula.Or wf_mbuf2'_0)\nnext\n case (Exists \\)\n then show ?case by (auto simp: fvi_Suc_bound intro!: wf_mformula.Exists)\nnext\n case (Agg y \\ b f \\)\n then show ?case by (auto intro!: wf_mformula.Agg Agg.IH fvi_plus_bound)\nnext\n case (Prev I \\)\n thm wf_mformula.Prev[where P=P]\n then show ?case by (auto intro!: wf_mformula.Prev)\nnext\n case (Next I \\)\n then show ?case by (auto intro!: wf_mformula.Next)\nnext\n case (Since \\ I \\)\n then show ?case\n using wf_since_aux_Nil\n by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)\nnext\n case (Not_Since \\ I \\)\n then show ?case\n using wf_since_aux_Nil\n by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)\nnext\n case (Until \\ I \\)\n then show ?case\n using valid_length_muaux[OF valid_init_muaux[OF Until(1)]] wf_until_aux_Nil\n by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)\nnext\n case (Not_Until \\ I \\)\n then show ?case\n using valid_length_muaux[OF valid_init_muaux[OF Not_Until(1)]] wf_until_aux_Nil\n by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)\nnext\n case (MatchP I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchP list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchP_aux_Nil\n dest!: to_mregex_atms)\nnext\n case (MatchF I r)\n then show ?case\n by (auto simp: list.rel_map fv_regex_alt progress_le Min_eq_iff progress_regex_def\n simp del: progress_simps split: prod.split\n intro!: wf_mformula.MatchF list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchF_aux_Nil\n dest!: to_mregex_atms)\nqed\n\nlemma (in maux) wf_mstate_minit: \"safe_formula \\ \\ wf_mstate \\ pnil R (minit \\)\"\n unfolding wf_mstate_def minit_def Let_def\n by (auto intro!: wf_minit0 fvi_less_nfv)\n\n\nsubsubsection \\Evaluation\\\n\nlemma match_wf_tuple: \"Some f = match ts xs \\\n wf_tuple n (\\t\\set ts. Formula.fv_trm t) (Table.tabulate f 0 n)\"\n by (induction ts xs arbitrary: f rule: match.induct)\n (fastforce simp: wf_tuple_def split: if_splits option.splits)+\n\nlemma match_fvi_trm_None: \"Some f = match ts xs \\ \\t\\set ts. x \\ Formula.fv_trm t \\ f x = None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_fvi_trm_Some: \"Some f = match ts xs \\ t \\ set ts \\ x \\ Formula.fv_trm t \\ f x \\ None\"\n by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)\n\nlemma match_eval_trm: \"\\t\\set ts. \\i\\Formula.fv_trm t. i < n \\ Some f = match ts xs \\\n map (Formula.eval_trm (Table.tabulate (\\i. the (f i)) 0 n)) ts = xs\"\nproof (induction ts xs arbitrary: f rule: match.induct)\n case (3 x ts y ys)\n from 3(1)[symmetric] 3(2,3) show ?case\n by (auto 0 3 dest: match_fvi_trm_Some sym split: option.splits if_splits intro!: eval_trm_fv_cong)\nqed (auto split: if_splits)\n\nlemma wf_tuple_tabulate_Some: \"wf_tuple n A (Table.tabulate f 0 n) \\ x \\ A \\ x < n \\ \\y. f x = Some y\"\n unfolding wf_tuple_def by auto\n\nlemma ex_match: \"wf_tuple n (\\t\\set ts. Formula.fv_trm t) v \\\n \\t\\set ts. (\\x\\Formula.fv_trm t. x < n) \\ (Formula.is_Var t \\ Formula.is_Const t) \\\n \\f. match ts (map (Formula.eval_trm (map the v)) ts) = Some f \\ v = Table.tabulate f 0 n\"\nproof (induction ts \"map (Formula.eval_trm (map the v)) ts\" arbitrary: v rule: match.induct)\n case (3 x ts y ys)\n then show ?case\n proof (cases \"x \\ (\\t\\set ts. Formula.fv_trm t)\")\n case True\n with 3 show ?thesis\n by (auto simp: insert_absorb dest!: wf_tuple_tabulate_Some meta_spec[of _ v])\n next\n case False\n with 3(3,4) have\n *: \"map (Formula.eval_trm (map the v)) ts = map (Formula.eval_trm (map the (v[x := None]))) ts\"\n by (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n from False 3(2-4) obtain f where\n \"match ts (map (Formula.eval_trm (map the v)) ts) = Some f\" \"v[x := None] = Table.tabulate f 0 n\"\n unfolding *\n by (atomize_elim, intro 3(1)[of \"v[x := None]\"])\n (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)\n moreover from False this have \"f x = None\" \"length v = n\"\n by (auto dest: match_fvi_trm_None[OF sym] arg_cong[of _ _ length])\n ultimately show ?thesis using 3(3)\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def)\n qed\nqed (auto simp: wf_tuple_def intro: nth_equalityI)\n\nlemma eq_rel_eval_trm: \"v \\ eq_rel n t1 t2 \\ is_simple_eq t1 t2 \\\n \\x\\Formula.fv_trm t1 \\ Formula.fv_trm t2. x < n \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2\"\n by (cases t1; cases t2) (simp_all add: is_simple_eq_def singleton_table_def split: if_splits)\n\nlemma in_eq_rel: \"wf_tuple n (Formula.fv_trm t1 \\ Formula.fv_trm t2) v \\\n is_simple_eq t1 t2 \\\n Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2 \\\n v \\ eq_rel n t1 t2\"\n by (cases t1; cases t2)\n (auto simp: is_simple_eq_def singleton_table_def wf_tuple_def unit_table_def\n intro!: nth_equalityI split: if_splits)\n\nlemma table_eq_rel: \"is_simple_eq t1 t2 \\\n table n (Formula.fv_trm t1 \\ Formula.fv_trm t2) (eq_rel n t1 t2)\"\n by (cases t1; cases t2; simp add: is_simple_eq_def)\n\nlemma wf_tuple_Suc_fviD: \"wf_tuple (Suc n) (Formula.fvi b \\) v \\ wf_tuple n (Formula.fvi (Suc b) \\) (tl v)\"\n unfolding wf_tuple_def by (simp add: fvi_Suc nth_tl)\n\nlemma table_fvi_tl: \"table (Suc n) (Formula.fvi b \\) X \\ table n (Formula.fvi (Suc b) \\) (tl ` X)\"\n unfolding table_def by (auto intro: wf_tuple_Suc_fviD)\n\nlemma wf_tuple_Suc_fvi_SomeI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (Some x # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma wf_tuple_Suc_fvi_NoneI: \"0 \\ Formula.fvi b \\ \\ wf_tuple n (Formula.fvi (Suc b) \\) v \\\n wf_tuple (Suc n) (Formula.fvi b \\) (None # v)\"\n unfolding wf_tuple_def\n by (auto simp: fvi_Suc less_Suc_eq_0_disj)\n\nlemma qtable_project_fv: \"qtable (Suc n) (fv \\) (mem_restr (lift_envs R)) P X \\\n qtable n (Formula.fvi (Suc 0) \\) (mem_restr R)\n (\\v. \\x. P ((if 0 \\ fv \\ then Some x else None) # v)) (tl ` X)\"\n using neq0_conv by (fastforce simp: image_iff Bex_def fvi_Suc elim!: qtable_cong dest!: qtable_project)\n\nlemma mem_restr_lift_envs'_append[simp]:\n \"length xs = b \\ mem_restr (lift_envs' b R) (xs @ ys) = mem_restr R ys\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: list_all2_append list.rel_map intro!: exI[where x=\"map the xs\"] list.rel_refl)\n\nlemma nth_list_update_alt: \"xs[i := x] ! j = (if i < length xs \\ i = j then x else xs ! j)\"\n by auto\n\nlemma wf_tuple_upd_None: \"wf_tuple n A xs \\ A - {i} = B \\ wf_tuple n B (xs[i:=None])\"\n unfolding wf_tuple_def\n by (auto simp: nth_list_update_alt)\n\nlemma mem_restr_upd_None: \"mem_restr R xs \\ mem_restr R (xs[i:=None])\"\n unfolding mem_restr_def\n by (auto simp: list_all2_conv_all_nth nth_list_update_alt)\n\nlemma mem_restr_dropI: \"mem_restr (lift_envs' b R) xs \\ mem_restr R (drop b xs)\"\n unfolding mem_restr_def lift_envs'_def\n by (auto simp: append_eq_conv_conj list_all2_append2)\n\nlemma mem_restr_dropD:\n assumes \"b \\ length xs\" and \"mem_restr R (drop b xs)\"\n shows \"mem_restr (lift_envs' b R) xs\"\nproof -\n let ?R = \"\\a b. a \\ None \\ a = Some b\"\n from assms(2) obtain v where \"v \\ R\" and \"list_all2 ?R (drop b xs) v\"\n unfolding mem_restr_def ..\n show ?thesis unfolding mem_restr_def proof\n have \"list_all2 ?R (take b xs) (map the (take b xs))\"\n by (auto simp: list.rel_map intro!: list.rel_refl)\n moreover note \\list_all2 ?R (drop b xs) v\\\n ultimately have \"list_all2 ?R (take b xs @ drop b xs) (map the (take b xs) @ v)\"\n by (rule list_all2_appendI)\n then show \"list_all2 ?R xs (map the (take b xs) @ v)\" by simp\n show \"map the (take b xs) @ v \\ lift_envs' b R\"\n unfolding lift_envs'_def using assms(1) \\v \\ R\\ by auto\n qed\nqed\n\nlemma wf_tuple_append: \"wf_tuple a {x \\ A. x < a} xs \\\n wf_tuple b {x - a | x. x \\ A \\ x \\ a} ys \\\n wf_tuple (a + b) A (xs @ ys)\"\n unfolding wf_tuple_def by (auto simp: nth_append eq_diff_iff)\n\nlemma wf_tuple_map_Some: \"length xs = n \\ {0.. A \\ wf_tuple n A (map Some xs)\"\n unfolding wf_tuple_def by auto\n\nlemma wf_tuple_drop: \"wf_tuple (b + n) A xs \\ {x - b | x. x \\ A \\ x \\ b} = B \\\n wf_tuple n B (drop b xs)\"\n unfolding wf_tuple_def by force\n\nlemma ecard_image: \"inj_on f A \\ ecard (f ` A) = ecard A\"\n unfolding ecard_def by (auto simp: card_image dest: finite_imageD)\n\nlemma meval_trm_eval_trm: \"wf_tuple n A x \\ fv_trm t \\ A \\ \\i\\A. i < n \\\n meval_trm t x = Formula.eval_trm (map the x) t\"\n unfolding wf_tuple_def\n by (induction t) simp_all\n\nlemma list_update_id: \"xs ! i = z \\ xs[i:=z] = xs\"\n by (induction xs arbitrary: i) (auto split: nat.split)\n\nlemma qtable_wf_tupleD: \"qtable n A P Q X \\ \\x\\X. wf_tuple n A x\"\n unfolding qtable_def table_def by blast\n\nlemma qtable_eval_agg:\n assumes inner: \"qtable (b + n) (Formula.fv \\) (mem_restr (lift_envs' b R))\n (\\v. Formula.sat \\ V (map the v) i \\) rel\"\n and n: \"\\x\\Formula.fv (Formula.Agg y \\ b f \\). x < n\"\n and fresh: \"y + b \\ Formula.fv \\\"\n and b_fv: \"{0.. Formula.fv \\\"\n and f_fv: \"Formula.fv_trm f \\ Formula.fv \\\"\n and g0: \"g0 = (Formula.fv \\ \\ {0.. b f \\)) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)) (eval_agg n g0 y \\ b f rel)\"\n (is \"qtable _ ?fv _ ?Q ?rel'\")\nproof -\n define M where \"M = (\\v. {(x, ecard Zs) | x Zs.\n Zs = {zs. length zs = b \\ Formula.sat \\ V (zs @ v) i \\ \\ Formula.eval_trm (zs @ v) f = x} \\\n Zs \\ {}})\"\n have f_fvi: \"Formula.fvi_trm b f \\ Formula.fvi b \\\"\n using f_fv by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n show ?thesis proof (cases \"g0 \\ rel = empty_table\")\n case True\n then have [simp]: \"Formula.fvi b \\ = {}\"\n by (auto simp: g0 fvi_iff_fv(1)[where b=b])\n then have [simp]: \"Formula.fvi_trm b f = {}\"\n using f_fvi by auto\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\" by (simp add: eval_agg_def True)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n have \"\\ Formula.sat \\ V (zs @ map the v) i \\\" if [simp]: \"length zs = b\" for zs\n proof -\n let ?zs = \"map2 (\\z i. if i \\ Formula.fv \\ then Some z else None) zs [0.. fv \\. x < b} ?zs\"\n by (simp add: wf_tuple_def)\n then have \"wf_tuple (b + n) (Formula.fv \\) (?zs @ v[y:=None])\"\n using \\wf_tuple n ?fv v\\ True\n by (auto simp: g0 intro!: wf_tuple_append wf_tuple_upd_None)\n then have \"\\ Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\\"\n using True \\mem_restr R v\\\n by (auto simp del: map_append dest!: in_qtableI[OF inner, rotated -1]\n intro!: mem_restr_upd_None)\n also have \"Formula.sat \\ V (map the (?zs @ v[y:=None])) i \\ \\ Formula.sat \\ V (zs @ map the v) i \\\"\n using True by (auto simp: g0 nth_append intro!: sat_fv_cong)\n finally show ?thesis .\n qed\n then have M_empty: \"M (map the v) = {}\"\n unfolding M_def by blast\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0 singleton_table_def)\n have \"v \\ singleton_table n y (the (v ! y))\" \"length v = n\"\n using \\wf_tuple n ?fv v\\ unfolding wf_tuple_def singleton_table_def\n by (auto simp add: tabulate_alt map_nth\n intro!: trans[OF map_cong[where g=\"(!) v\", simplified nth_map, OF refl], symmetric])\n then show \"v \\ eval_agg n g0 y \\ b f rel\"\n if \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n using M_empty True that n\n by (simp add: M_def eval_agg_def g0)\n qed\n next\n case non_default_case: False\n have union_fv: \"{0.. (\\x. x + b) ` Formula.fvi b \\ = fv \\\"\n using b_fv\n by (auto simp: fvi_iff_fv(1)[where b=b] intro!: image_eqI[where b=x and x=\"x - b\" for x])\n have b_n: \"\\x\\fv \\. x < b + n\"\n proof\n fix x assume \"x \\ fv \\\"\n show \"x < b + n\" proof (cases \"x \\ b\")\n case True\n with \\x \\ fv \\\\ have \"x - b \\ ?fv\"\n by (simp add: fvi_iff_fv(1)[where b=b])\n then show ?thesis using n f_fvi by (auto simp: Un_absorb2)\n qed simp\n qed\n\n define M' where \"M' = (\\k. let group = Set.filter (\\x. drop b x = k) rel;\n images = meval_trm f ` group\n in (\\y. (y, ecard (Set.filter (\\x. meval_trm f x = y) group))) ` images)\"\n have M'_M: \"M' (drop b x) = M (map the (drop b x))\" if \"x \\ rel\" \"mem_restr (lift_envs' b R) x\" for x\n proof -\n from that have wf_x: \"wf_tuple (b + n) (fv \\) x\"\n by (auto elim!: in_qtableE[OF inner])\n then have wf_zs_x: \"wf_tuple (b + n) (fv \\) (map Some zs @ drop b x)\"\n if \"length zs = b\" for zs\n using that b_fv\n by (auto intro!: wf_tuple_append wf_tuple_map_Some wf_tuple_drop)\n have 1: \"(length zs = b \\ Formula.sat \\ V (zs @ map the (drop b x)) i \\ \\\n Formula.eval_trm (zs @ map the (drop b x)) f = y) \\\n (\\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ meval_trm f a = y)\"\n (is \"?A \\ (\\a. ?B a)\") for y zs\n proof (intro iffI conjI)\n assume ?A\n then have \"?B (map Some zs @ drop (length zs) x)\"\n using in_qtableI[OF inner wf_zs_x] \\mem_restr (lift_envs' b R) x\\\n meval_trm_eval_trm[OF wf_zs_x f_fv b_n]\n by (auto intro!: mem_restr_dropI)\n then show \"\\a. ?B a\" ..\n next\n assume \"\\a. ?B a\"\n then obtain a where \"?B a\" ..\n then have \"a \\ rel\" and a_eq: \"a = map Some zs @ drop b x\"\n using append_take_drop_id[of b a] by auto\n then have \"length a = b + n\"\n using inner unfolding qtable_def table_def\n by (blast intro!: wf_tuple_length)\n then show \"length zs = b\"\n using wf_tuple_length[OF wf_x] unfolding a_eq by simp\n then have \"mem_restr (lift_envs' b R) a\"\n using \\mem_restr _ x\\ unfolding a_eq by (auto intro!: mem_restr_dropI)\n then show \"Formula.sat \\ V (zs @ map the (drop b x)) i \\\"\n using in_qtableE[OF inner \\a \\ rel\\]\n by (auto simp: a_eq sat_fv_cong[THEN iffD1, rotated -1])\n from \\?B a\\ show \"Formula.eval_trm (zs @ map the (drop b x)) f = y\"\n using meval_trm_eval_trm[OF wf_zs_x f_fv b_n, OF \\length zs = b\\]\n unfolding a_eq by simp\n qed\n have 2: \"map Some (map the (take b a)) = take b a\" if \"a \\ rel\" for a\n using that b_fv inner[THEN qtable_wf_tupleD]\n unfolding table_def wf_tuple_def\n by (auto simp: list_eq_iff_nth_eq)\n have 3: \"ecard {zs. \\a. a \\ rel \\ take b a = map Some zs \\ drop b a = drop b x \\ P a} =\n ecard {a. a \\ rel \\ drop b a = drop b x \\ P a}\" (is \"ecard ?A = ecard ?B\") for P\n proof -\n have \"ecard ?A = ecard ((\\zs. map Some zs @ drop b x) ` ?A)\"\n by (auto intro!: ecard_image[symmetric] inj_onI)\n also have \"(\\zs. map Some zs @ drop b x) ` ?A = ?B\"\n by (subst (1 2) eq_commute) (auto simp: image_iff, metis \"2\" append_take_drop_id)\n finally show ?thesis .\n qed\n show ?thesis\n unfolding M_def M'_def\n by (auto simp: non_default_case Let_def image_def Set.filter_def 1 3, metis \"2\")\n qed\n have drop_lift: \"mem_restr (lift_envs' b R) x\" if \"x \\ rel\" \"mem_restr R ((drop b x)[y:=z])\" for x z\n proof -\n have \"(drop b x)[y:=None] = (drop b x)[y:=drop b x ! y]\" proof -\n from \\x \\ rel\\ have \"drop b x ! y = None\"\n using fresh n inner[THEN qtable_wf_tupleD]\n by (simp add: add.commute wf_tuple_def)\n then show ?thesis by simp\n qed\n then have \"(drop b x)[y:=None] = drop b x\" by simp\n moreover from \\x \\ rel\\ have \"length x = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n moreover from that(2) have \"mem_restr R ((drop b x)[y:=z, y:=None])\"\n by (rule mem_restr_upd_None)\n ultimately show ?thesis\n by (auto intro!: mem_restr_dropD)\n qed\n\n {\n fix v\n assume \"mem_restr R v\"\n have \"v \\ (\\k. k[y:=Some (eval_agg_op \\ (M' k))]) ` drop b ` rel \\\n v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n (is \"v \\ ?A \\ v \\ ?B\")\n proof\n assume \"v \\ ?A\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M' (drop b v')))]\"\n by auto\n then have \"M' (drop b v') = M (map the (drop b v'))\"\n using \\mem_restr R v\\ by (auto intro!: M'_M drop_lift)\n with * show \"v \\ ?B\" by simp\n next\n assume \"v \\ ?B\"\n then obtain v' where *: \"v' \\ rel\" \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n by auto\n then have \"M (map the (drop b v')) = M' (drop b v')\"\n using \\mem_restr R v\\ by (auto intro!: M'_M[symmetric] drop_lift)\n with * show \"v \\ ?A\" by simp\n qed\n then have \"v \\ eval_agg n g0 y \\ b f rel \\ v \\ (\\k. k[y:=Some (eval_agg_op \\ (M (map the k)))]) ` drop b ` rel\"\n by (simp add: non_default_case eval_agg_def M'_def Let_def)\n }\n note alt = this\n\n show ?thesis proof (rule qtableI)\n show \"table n ?fv ?rel'\"\n using inner[THEN qtable_wf_tupleD] n f_fvi\n by (auto simp: eval_agg_def non_default_case table_def wf_tuple_def Let_def nth_list_update\n fvi_iff_fv[where b=b] add.commute)\n next\n fix v\n assume \"wf_tuple n ?fv v\" \"mem_restr R v\"\n then have length_v: \"length v = n\" by (simp add: wf_tuple_def)\n\n show \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n if \"v \\ eval_agg n g0 y \\ b f rel\"\n proof -\n from that obtain v' where \"v' \\ rel\"\n \"v = (drop b v')[y:=Some (eval_agg_op \\ (M (map the (drop b v'))))]\"\n using alt[OF \\mem_restr R v\\] by blast\n then have length_v': \"length v' = b + n\"\n using inner[THEN qtable_wf_tupleD]\n by (simp add: wf_tuple_def)\n have \"Formula.sat \\ V (map the v') i \\\"\n using \\v' \\ rel\\ \\mem_restr R v\\\n by (auto simp: \\v = _\\ elim!: in_qtableE[OF inner] intro!: drop_lift \\v' \\ rel\\)\n then have \"Formula.sat \\ V (map the (take b v') @ map the v) i \\\"\n proof (rule sat_fv_cong[THEN iffD1, rotated], intro ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"map the v' ! x = (map the (take b v') @ map the v) ! x\"\n by (auto simp: \\v = _\\ nth_append)\n qed\n then have 1: \"M (map the v) \\ {}\" by (force simp: M_def length_v')\n\n have \"y < length (drop b v')\" using n by (simp add: length_v')\n moreover have \"Formula.sat \\ V (zs @ map the v) i \\ \\\n Formula.sat \\ V (zs @ map the (drop b v')) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the v) f =\n Formula.eval_trm (zs @ map the (drop b v')) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < length v'\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v')\n ultimately show \"(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x\"\n by (auto simp: \\v = _\\ that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the v))\"\n by (simp add: M_def \\v = _\\ conj_commute cong: conj_cong)\n with 1 show ?thesis by (auto simp: M_def)\n qed\n\n show \"v \\ eval_agg n g0 y \\ b f rel\"\n if sat_Agg: \"Formula.sat \\ V (map the v) i (Formula.Agg y \\ b f \\)\"\n proof -\n obtain zs where \"length zs = b\" and \"map Some zs @ v[y:=None] \\ rel\"\n proof (cases \"fv \\ \\ {0.. empty_table\" by (simp add: g0)\n then obtain x where \"x \\ rel\" by auto\n have \"(\\i < n. (v[y:=None]) ! i = None)\"\n using True \\wf_tuple n ?fv v\\ f_fv\n by (fastforce simp: wf_tuple_def fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n moreover have x: \"(\\i < n. drop b x ! i = None) \\ length x = b + n\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] f_fv\n by (auto simp: wf_tuple_def)\n ultimately have \"v[y:=None] = drop b x\"\n unfolding list_eq_iff_nth_eq by (auto simp: length_v)\n with \\x \\ rel\\ have \"take b x @ v[y:=None] \\ rel\" by simp\n moreover have \"map (Some \\ the) (take b x) = take b x\"\n using True \\x \\ rel\\ inner[THEN qtable_wf_tupleD] b_fv\n by (subst map_cong[where g=id, OF refl]) (auto simp: wf_tuple_def in_set_conv_nth)\n ultimately have \"map Some (map the (take b x)) @ v[y:=None] \\ rel\" by simp\n then show thesis using x[THEN conjunct2] by (fastforce intro!: that[rotated])\n next\n case False\n with sat_Agg obtain zs where \"length zs = b\" and \"Formula.sat \\ V (zs @ map the v) i \\\"\n by auto\n then have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\\"\n using fresh\n by (auto simp: map_update not_less nth_append elim!: sat_fv_cong[THEN iffD1, rotated]\n intro!: nth_list_update_neq[symmetric])\n then have \"map Some zs @ v[y:=None] \\ rel\"\n using b_fv f_fv fresh\n by (auto intro!: in_qtableI[OF inner] wf_tuple_append wf_tuple_map_Some\n wf_tuple_upd_None \\wf_tuple n ?fv v\\ mem_restr_upd_None \\mem_restr R v\\\n simp: \\length zs = b\\ set_eq_iff fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])\n force+\n with that \\length zs = b\\ show thesis by blast\n qed\n then have 1: \"v[y:=None] \\ drop b ` rel\" by (intro image_eqI) auto\n\n have y_length: \"y < length v\" using n by (simp add: length_v)\n moreover have \"Formula.sat \\ V (zs @ map the (v[y:=None])) i \\ \\\n Formula.sat \\ V (zs @ map the v) i \\\" if \"length zs = b\" for zs\n proof (intro sat_fv_cong ballI)\n fix x\n assume \"x \\ fv \\\"\n then have \"x \\ y + b\" using fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv \\\\ b_n by (simp add: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n moreover have \"Formula.eval_trm (zs @ map the (v[y:=None])) f =\n Formula.eval_trm (zs @ map the v) f\" if \"length zs = b\" for zs\n proof (intro eval_trm_fv_cong ballI)\n fix x\n assume \"x \\ fv_trm f\"\n then have \"x \\ y + b\" using f_fv fresh by blast\n moreover have \"x < b + length v\"\n using \\x \\ fv_trm f\\ f_fv b_n by (auto simp: length_v)\n ultimately show \"(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x\"\n by (auto simp: that nth_append)\n qed\n ultimately have \"map the v ! y = eval_agg_op \\ (M (map the (v[y:=None])))\"\n using sat_Agg by (simp add: M_def cong: conj_cong) (simp cong: rev_conj_cong)\n then have 2: \"v ! y = Some (eval_agg_op \\ (M (map the (v[y:=None]))))\"\n using \\wf_tuple n ?fv v\\ y_length by (auto simp add: wf_tuple_def)\n show ?thesis\n unfolding alt[OF \\mem_restr R v\\]\n by (rule image_eqI[where x=\"v[y:=None]\"]) (use 1 2 in \\auto simp: y_length list_update_id\\)\n qed\n qed\n qed\nqed\n\nlemma mprev: \"mprev_next I xs ts = (ys, xs', ts') \\\n list_all2 P [i.. list_all2 (\\i t. t = \\ \\ i) [i.. i \\ j' \\ i < j \\\n list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then P i X else X = empty_table)\n [i..\n list_all2 P [min j' (j-1)..\n list_all2 (\\i t. t = \\ \\ i) [min j' (j-1)..\n list_all2 P [Suc i.. list_all2 (\\i t. t = \\ \\ i) [i.. Suc i \\ j' \\ i < j \\\n list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then P (Suc i) X else X = empty_table)\n [i..\n list_all2 P [Suc (min (j'-1) (j-1))..\n list_all2 (\\i t. t = \\ \\ i) [min (j'-1) (j-1).. A \\ A \\ set xs \\ x \\ foldr (\\) xs {}\"\n by (induction xs) auto\n\nlemma in_foldr_UnE: \"x \\ foldr (\\) xs {} \\ (\\A. A \\ set xs \\ x \\ A \\ P) \\ P\"\n by (induction xs) auto\n\nlemma sat_the_restrict: \"fv \\ \\ A \\ Formula.sat \\ V (map the (restrict A v)) i \\ = Formula.sat \\ V (map the v) i \\\"\n by (rule sat_fv_cong) (auto intro!: map_the_restrict)\n\nlemma eps_the_restrict: \"fv_regex r \\ A \\ Regex.eps (Formula.sat \\ V (map the (restrict A v))) i r = Regex.eps (Formula.sat \\ V (map the v)) i r\"\n by (rule eps_fv_cong) (auto intro!: map_the_restrict)\n\nlemma sorted_wrt_filter[simp]: \"sorted_wrt R xs \\ sorted_wrt R (filter P xs)\"\n by (induct xs) auto\n\nlemma concat_map_filter[simp]:\n \"concat (map f (filter P xs)) = concat (map (\\x. if P x then f x else []) xs)\"\n by (induct xs) auto\n\nlemma map_filter_alt:\n \"map f (filter P xs) = concat (map (\\x. if P x then [f x] else []) xs)\"\n by (induct xs) auto\n\nlemma (in maux) update_since:\n assumes pre: \"wf_since_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel2\"\n and result_eq: \"(rel, aux') = update_since args rel1 rel2 (\\ \\ ne) aux\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n and \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ I \\)) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv \\) v\"\n note sat.simps[simp del]\n from pre[unfolded wf_since_aux_def] obtain cur auxlist where aux: \"valid_msaux args cur aux auxlist\"\n \"sorted_wrt (\\x y. fst y < fst x) auxlist\"\n \"\\t X. (t, X) \\ set auxlist \\ ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n qtable n (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\)) X\"\n \"\\t. ne \\ 0 \\ t \\ \\ \\ (ne - 1) \\ \\ \\ (ne - 1) - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\X. (t, X) \\ set auxlist)\"\n and cur_def:\n \"cur = (if ne = 0 then 0 else \\ \\ (ne - 1))\"\n unfolding args_ivl args_n args_pos by blast\n from pre[unfolded wf_since_aux_def] have fv_sub: \"Formula.fv \\ \\ Formula.fv \\\" by simp\n\n define aux0 where \"aux0 = join_msaux args rel1 (add_new_ts_msaux args (\\ \\ ne) aux)\"\n define auxlist0 where \"auxlist0 = [(t, join rel pos rel1). (t, rel) \\ auxlist, \\ \\ ne - t \\ right I]\"\n have tabL: \"table (args_n args) (args_L args) rel1\"\n using qtable1[unfolded qtable_def] unfolding args_n[symmetric] args_L[symmetric] by simp\n have cur_le: \"cur \\ \\ \\ ne\"\n unfolding cur_def by auto\n have valid0: \"valid_msaux args (\\ \\ ne) aux0 auxlist0\" unfolding aux0_def auxlist0_def\n using valid_join_msaux[OF valid_add_new_ts_msaux[OF aux(1)], OF cur_le tabL]\n by (auto simp: args_ivl args_pos cur_def map_filter_alt split_beta cong: map_cong)\n from aux(2) have sorted_auxlist0: \"sorted_wrt (\\x y. fst x > fst y) auxlist0\"\n unfolding auxlist0_def\n by (induction auxlist) (auto simp add: sorted_wrt_append)\n have in_auxlist0_1: \"(t, X) \\ set auxlist0 \\ ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (Formula.sat \\ V (map the v) (ne-1) (Sincep pos \\ (point (\\ \\ (ne-1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\))) X\" for t X\n unfolding auxlist0_def using fvi_subset\n by (auto 0 1 elim!: qtable_join[OF _ qtable1] simp: sat_the_restrict dest!: aux(3))\n then have in_auxlist0_le_\\: \"(t, X) \\ set auxlist0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_auxlist0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set auxlist0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set auxlist\"\n by (atomize_elim, intro aux(4))\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\\\ \\ ne - t \\ right I\\ have \"(t, join X pos rel1) \\ set auxlist0\"\n unfolding auxlist0_def by (auto elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set auxlist0\"\n by blast\n qed\n have auxlist0_Nil: \"auxlist0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t))\"\n using in_auxlist0_2 by (auto)\n\n have aux'_eq: \"aux' = add_new_table_msaux args rel2 aux0\"\n using result_eq unfolding aux0_def update_since_def Let_def by simp\n define auxlist' where\n auxlist'_eq: \"auxlist' = (case auxlist0 of\n [] \\ [(\\ \\ ne, rel2)]\n | x # auxlist' \\ (if fst x = \\ \\ ne then (fst x, snd x \\ rel2) # auxlist' else (\\ \\ ne, rel2) # x # auxlist'))\"\n have tabR: \"table (args_n args) (args_R args) rel2\"\n using qtable2[unfolded qtable_def] unfolding args_n[symmetric] args_R[symmetric] by simp\n have valid': \"valid_msaux args (\\ \\ ne) aux' auxlist'\"\n unfolding aux'_eq auxlist'_eq using valid_add_new_table_msaux[OF valid0 tabR]\n by (auto simp: not_le split: list.splits option.splits if_splits)\n have sorted_auxlist': \"sorted_wrt (\\x y. fst x > fst y) auxlist'\"\n unfolding auxlist'_eq\n using sorted_auxlist0 in_auxlist0_le_\\ by (cases auxlist0) fastforce+\n have in_auxlist'_1: \"t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\ (\\i. \\ \\ i = t) \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)) X\"\n if auxlist': \"(t, X) \\ set auxlist'\" for t X\n proof (cases auxlist0)\n case Nil\n with auxlist' show ?thesis\n unfolding auxlist'_eq using qtable2 auxlist0_Nil\n by (auto simp: zero_enat_def[symmetric] sat_Since_rec[where i=ne]\n dest: spec[of _ \"\\ \\ (ne-1)\"] elim!: qtable_cong[OF _ refl])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with auxlist' Cons t have \"X = snd a \\ rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 by (auto split: if_splits)\n moreover from in_auxlist0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ (ne - 1)\" \"\\ \\ ne - fst a \\ right I\" \"\\i. \\ \\ i = fst a\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1)\n (Sincep pos \\ (point (\\ \\ (ne - 1) - fst a)) \\) \\ (if pos then Formula.sat \\ V (map the v) ne \\\n else \\ Formula.sat \\ V (map the v) ne \\)) (snd a)\"\n by (auto simp: True[symmetric] zero_enat_def[symmetric])\n ultimately show ?thesis using qtable2 t True\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(6) elim!: qtable_union)\n next\n case False\n with auxlist' Cons t have \"X = rel2\"\n unfolding auxlist'_eq using sorted_auxlist0 in_auxlist0_le_\\[of \"fst a\" \"snd a\"] by (auto split: if_splits)\n with auxlist' Cons t False show ?thesis\n unfolding auxlist'_eq using qtable2 in_auxlist0_2[of \"\\ \\ (ne-1)\"] in_auxlist0_le_\\[of \"fst a\" \"snd a\"] sorted_auxlist0\n by (auto simp: sat_Since_rec[where i=ne] sat.simps(3) zero_enat_def[symmetric] enat_0_iff not_le\n elim!: qtable_cong[OF _ refl] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with auxlist' Cons have \"(t, X) \\ set auxlist0\"\n unfolding auxlist'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ (ne - 1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne - 1) (Sincep pos \\ (point (\\ \\ (ne - 1) - t)) \\) \\\n (if pos then Formula.sat \\ V (map the v) ne \\ else \\ Formula.sat \\ V (map the v) ne \\)) X\"\n using in_auxlist0_1 by blast+\n with False auxlist' Cons show ?thesis\n unfolding auxlist'_eq using qtable2\n by (fastforce simp: sat_Since_rec[where i=ne] sat.simps(6)\n diff_diff_right[where i=\"\\ \\ ne\" and j=\"\\ \\ _ + \\ \\ ne\" and k=\"\\ \\ (ne - 1)\",\n OF trans_le_add2, simplified] elim!: qtable_cong[OF _ refl] order_trans dest: le_\\_less)\n qed\n qed\n\n have in_auxlist'_2: \"\\X. (t, X) \\ set auxlist'\" if \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases auxlist0)\n case Nil\n with True show ?thesis unfolding auxlist'_eq by (simp add: zero_enat_def[symmetric])\n next\n case (Cons a as)\n with True show ?thesis unfolding auxlist'_eq\n by (cases \"fst a = \\ \\ ne\") (auto simp: zero_enat_def[symmetric])\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set auxlist0\" using \\\\ \\ ne - t \\ right I\\ \\\\i. \\ \\ i = t\\\n using \\_mono[of \"ne - 1\" \"ne\" \\] by (atomize_elim, cases \"right I\") (auto intro!: in_auxlist0_2 simp del: \\_mono)\n then show ?thesis unfolding auxlist'_eq using False \\\\ \\ ne - t \\ right I\\\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_since_aux \\ V R args \\ \\ aux' (Suc ne)\"\n unfolding wf_since_aux_def args_ivl args_n args_pos\n by (auto simp add: fv_sub dest: in_auxlist'_1 intro: sorted_auxlist' in_auxlist'_2\n intro!: exI[of _ auxlist'] valid')\n\n have \"rel = result_msaux args aux'\"\n using result_eq by (auto simp add: update_since_def Let_def)\n with valid' have rel_eq: \"rel = foldr (\\) [rel. (t, rel) \\ auxlist', left I \\ \\ \\ ne - t] {}\"\n by (auto simp add: args_ivl valid_result_msaux\n intro!: arg_cong[where f = \"\\x. foldr (\\) (concat x) {}\"] split: option.splits)\n have rel_alt: \"rel = (\\(t, rel) \\ set auxlist'. if left I \\ \\ \\ ne - t then rel else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)\n show \"qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Sincep pos \\ I \\)) rel\"\n unfolding rel_alt\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n left I \\ \\ \\ ne - t \\ Formula.sat \\ V (map the v) ne (Sincep pos \\ (point (\\ \\ ne - t)) \\)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n proof (rule iffI, erule sat_Since_point, goal_cases left right)\n case (left j)\n then show ?case using in_auxlist'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_Since_pointD dest: in_auxlist'_1)\n qed\n qed (auto dest!: in_auxlist'_1 intro!: qtable_empty)\nqed\n\nlemma fv_regex_from_mregex:\n \"ok (length \\s) mr \\ fv_regex (from_mregex mr \\s) \\ (\\\\ \\ set \\s. fv \\)\"\n by (induct mr) (auto simp: Bex_def in_set_conv_nth)+\n\nlemma qtable_\\_lax:\n assumes \"ok (length \\s) mr\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and \"fv_regex (from_mregex mr \\s) \\ A\" and \"qtable n A (mem_restr R) Q guard\"\n shows \"qtable n A (mem_restr R)\n (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s) \\ Q v) (\\_lax guard rels mr)\"\n using assms\nproof (induct mr)\n case (MPlus mr1 mr2)\n from MPlus(3-6) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n then have \"fv_regex (from_mregex mr1 \\s) \\ A\" \"fv_regex (from_mregex mr2 \\s) \\ A\"\n using fv_regex_from_mregex[of \\s mr1] fv_regex_from_mregex[of \\s mr2] by (auto simp: subset_eq)\n with MTimes(3-6) show ?case\n by (auto simp: eps_the_restrict restrict_idle intro!: qtable_join[OF MTimes(1,2)])\nqed (auto split: prod.splits if_splits simp: qtable_empty_iff list_all2_conv_all_nth\n in_set_conv_nth restrict_idle sat_the_restrict\n intro: in_qtableI qtableI elim!: qtable_join[where A=A and C=A])\n\nlemma nullary_qtable_cases: \"qtable n {} P Q X \\ (X = empty_table \\ X = unit_table n)\"\n by (simp add: qtable_def table_empty)\n\nlemma qtable_empty_unit_table:\n \"qtable n {} R P empty_table \\ qtable n {} R (\\v. \\ P v) (unit_table n)\"\n by (auto intro: qtable_unit_table simp add: qtable_empty_iff)\n\nlemma qtable_unit_empty_table:\n \"qtable n {} R P (unit_table n) \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (auto intro!: qtable_empty elim: in_qtableE simp add: wf_tuple_empty unit_table_def)\n\nlemma qtable_nonempty_empty_table:\n \"qtable n {} R P X \\ x \\ X \\ qtable n {} R (\\v. \\ P v) empty_table\"\n by (frule nullary_qtable_cases) (auto dest: qtable_unit_empty_table)\n\n\nlemma qtable_r\\_strict:\n assumes \"safe_regex Past Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (r\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma qtable_l\\_strict:\n assumes \"safe_regex Futu Strict (from_mregex mr \\s)\" \"ok (length \\s) mr\" \"A = fv_regex (from_mregex mr \\s)\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n shows \"qtable n A (mem_restr R) (\\v. Regex.eps (Formula.sat \\ V (map the v)) i (from_mregex mr \\s)) (l\\_strict n rels mr)\"\n using assms\nproof (hypsubst, induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table\n dest!: qtable_nonempty_empty_table split: if_splits)\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) (fastforce intro: qtable_union split: if_splits)+\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto intro: qtable_cong[OF qtable_\\_lax] split: if_splits)+\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto simp: qtable_unit_table split: if_splits)\nqed\n\nlemma rtranclp_False: \"(\\i j. False)\\<^sup>*\\<^sup>* = (=)\"\nproof -\n have \"(\\i j. False)\\<^sup>*\\<^sup>* i j \\ i = j\" for i j :: 'a\n by (induct i j rule: rtranclp.induct) auto\n then show ?thesis\n by (auto intro: exI[of _ 0])\nqed\n\ninductive ok_rctxt for \\s where\n \"ok_rctxt \\s id id\"\n| \"ok_rctxt \\s \\ \\' \\ ok_rctxt \\s (\\t. \\ (MTimes mr t)) (\\t. \\' (Regex.Times (from_mregex mr \\s) t))\"\n\nlemma ok_rctxt_swap: \"ok_rctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_rctxt.induct) auto\n\nlemma ok_rctxt_cong: \"ok_rctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_rctxt.induct) simp_all\n\nlemma qtable_r\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_rctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` RPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.rpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (r\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_rctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(2) qtable_\\_lax[OF _ _ _ MTimes(1)]]\n elim!: ok_rctxt.intros(2) simp: MTimesL_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_rctxt.intros simp: MTimesL_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_r\\ = qtable_r\\\\[OF _ _ _ ok_rctxt.intros(1), unfolded rpd\\_rpd image_id id_apply]\n\ninductive ok_lctxt for \\s where\n \"ok_lctxt \\s id id\"\n| \"ok_lctxt \\s \\ \\' \\ ok_lctxt \\s (\\t. \\ (MTimes t mr)) (\\t. \\' (Regex.Times t (from_mregex mr \\s)))\"\n\nlemma ok_lctxt_swap: \"ok_lctxt \\s \\ \\' \\ from_mregex (\\ mr) \\s = \\' (from_mregex mr \\s)\"\n by (induct \\ \\' arbitrary: mr rule: ok_lctxt.induct) auto\n\nlemma ok_lctxt_cong: \"ok_lctxt \\s \\ \\' \\ Regex.match (Formula.sat \\ V v) r = Regex.match (Formula.sat \\ V v) s \\\n Regex.match (Formula.sat \\ V v) (\\' r) i j = Regex.match (Formula.sat \\ V v) (\\' s) i j\"\n by (induct \\ \\' arbitrary: r s rule: ok_lctxt.induct) simp_all\n\nlemma qtable_l\\\\:\n assumes \"ok (length \\s) mr\" \"fv_regex (from_mregex mr \\s) \\ A\"\n and \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n and \"ok_lctxt \\s \\ \\'\"\n and \"\\ms \\ \\ ` LPD mr. qtable n A (mem_restr R) (\\v. Q (map the v) (from_mregex ms \\s)) (lookup rel ms)\"\n shows \"qtable n A (mem_restr R)\n (\\v. \\s \\ Regex.lpd\\ \\' (Formula.sat \\ V (map the v)) j (from_mregex mr \\s). Q (map the v) s)\n (l\\ \\ rel rels mr)\"\n using assms\nproof (induct mr arbitrary: \\ \\')\n case MSkip\n then show ?case\n by (auto simp: rtranclp_False ok_lctxt_swap qtable_empty_iff\n elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \\ \\']] split: nat.splits)\nnext\n case (MPlus mr1 mr2)\n from MPlus(3-7) show ?case\n by (auto intro!: qtable_union[OF MPlus(1,2)])\nnext\n case (MTimes mr1 mr2)\n from MTimes(3-7) show ?case\n by (auto intro!: qtable_union[OF MTimes(1) qtable_\\_lax[OF _ _ _ MTimes(2)]]\n elim!: ok_lctxt.intros(2) simp: MTimesR_def Ball_def)\nnext\n case (MStar mr)\n from MStar(2-6) show ?case\n by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_lctxt.intros simp: MTimesR_def Ball_def)\nqed (auto simp: qtable_empty_iff)\n\nlemmas qtable_l\\ = qtable_l\\\\[OF _ _ _ ok_lctxt.intros(1), unfolded lpd\\_lpd image_id id_apply]\n\nlemma RPD_fv_regex_le:\n \"ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesL_def split: nat.splits)+\n\nlemma RPD_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPD mr \\ safe_regex Past g (from_mregex ms \\s)\"\nproof (induct Past g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesP g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesP(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le TimesP(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma RPDi_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> safe_regex Past g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: RPD_safe)\n\nlemma RPDs_safe: \"safe_regex Past g (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> safe_regex Past g (from_mregex ms \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe)\n\nlemma RPD_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPD mr \\ fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Past Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case (Skip n)\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesP r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le)\nqed\n\nlemma RPDi_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: RPD_safe_fv_regex RPD_safe)\n\nlemma RPDs_safe_fv_regex: \"safe_regex Past Strict (from_mregex mr \\s) \\\n ms \\ RPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding RPDs_def by (auto dest: RPDi_safe_fv_regex)\n\nlemma RPD_ok: \"ok m mr \\ ms \\ RPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesL_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesL_def)\nqed (auto split: nat.splits)\n\nlemma RPDi_ok: \"ok m mr \\ ms \\ RPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: RPD_ok)\n\nlemma RPDs_ok: \"ok m mr \\ ms \\ RPDs mr \\ ok m ms\"\n unfolding RPDs_def by (auto intro: RPDi_ok)\n\nlemma LPD_fv_regex_le:\n \"ms \\ LPD mr \\ fv_regex (from_mregex ms \\s) \\ fv_regex (from_mregex mr \\s)\"\n by (induct mr arbitrary: ms) (auto simp: MTimesR_def split: nat.splits)+\n\nlemma LPD_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPD mr ==> safe_regex Futu g (from_mregex ms \\s)\"\nproof (induct Futu g \"from_mregex mr \\s\" arbitrary: mr ms rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test g \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MPlus mr ms)\n with Plus(3-5) show ?thesis\n by (auto dest!: Plus(1,2))\n qed auto\nnext\n case (TimesF g r s mrs)\n then show ?case\n proof (cases mrs)\n case (MTimes mr ms)\n with TimesF(3-5) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits dest: TimesF(1,2))\n qed auto\nnext\n case (Star g r)\n then show ?case\n proof (cases mr)\n case (MStar x6)\n with Star(2-4) show ?thesis\n by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le\n elim!: safe_cosafe[rotated] dest!: Star(1))\n qed auto\nqed\n\nlemma LPDi_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n by (induct n arbitrary: ms mr) (auto dest: LPD_safe)\n\nlemma LPDs_safe: \"safe_regex Futu g (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> safe_regex Futu g (from_mregex ms \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe)\n\nlemma LPD_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPD mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\nproof (induct Futu Strict \"from_mregex mr \\s\" arbitrary: mr rule: safe_regex_induct)\n case Skip\n then show ?case\n by (cases mr) (auto split: nat.splits)\nnext\n case (Test \\)\n then show ?case\n by (cases mr) auto\nnext\n case (Plus r s)\n then show ?case\n by (cases mr) auto\nnext\n case (TimesF r s)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits)\nnext\n case (Star r)\n then show ?case\n by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le)\nqed\n\nlemma LPDi_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDi n mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n by (induct n arbitrary: ms mr) (auto 5 0 dest: LPD_safe_fv_regex LPD_safe)\n\nlemma LPDs_safe_fv_regex: \"safe_regex Futu Strict (from_mregex mr \\s) \\\n ms \\ LPDs mr ==> fv_regex (from_mregex ms \\s) = fv_regex (from_mregex mr \\s)\"\n unfolding LPDs_def by (auto dest: LPDi_safe_fv_regex)\n\nlemma LPD_ok: \"ok m mr \\ ms \\ LPD mr \\ ok m ms\"\nproof (induct mr arbitrary: ms)\n case (MPlus mr1 mr2)\n from MPlus(3,4) show ?case\n by (auto elim: MPlus(1,2))\nnext\n case (MTimes mr1 mr2)\n from MTimes(3,4) show ?case\n by (auto elim: MTimes(1,2) simp: MTimesR_def)\nnext\n case (MStar mr)\n from MStar(2,3) show ?case\n by (auto elim: MStar(1) simp: MTimesR_def)\nqed (auto split: nat.splits)\n\nlemma LPDi_ok: \"ok m mr \\ ms \\ LPDi n mr \\ ok m ms\"\n by (induct n arbitrary: ms mr) (auto intro: LPD_ok)\n\nlemma LPDs_ok: \"ok m mr \\ ms \\ LPDs mr \\ ok m ms\"\n unfolding LPDs_def by (auto intro: LPDi_ok)\n\nlemma update_matchP:\n assumes pre: \"wf_matchP_aux \\ V n R I r aux ne\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne \\) rel) \\s rels\"\n and result_eq: \"(rel, aux') = update_matchP n I mr mrs rels (\\ \\ ne) aux\"\n shows \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n and \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\nproof -\n let ?wf_tuple = \"\\v. wf_tuple n (Formula.fv_regex r) v\"\n let ?update = \"\\rel t. mrtabulate mrs (\\mr.\n r\\ id rel rels mr \\ (if t = \\ \\ ne then r\\_strict n rels mr else {}))\"\n note sat.simps[simp del]\n\n define aux0 where \"aux0 = [(t, ?update rel t). (t, rel) \\ aux, enat (\\ \\ ne - t) \\ right I]\"\n have sorted_aux0: \"sorted_wrt (\\x y. fst x > fst y) aux0\"\n using pre[unfolded wf_matchP_aux_def, THEN conjunct1]\n unfolding aux0_def\n by (induction aux) (auto simp add: sorted_wrt_append)\n { fix ms\n assume \"ms \\ RPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Past Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"RPD ms \\ RPDs mr\"\n using safe RPDs_safe RPDs_safe_fv_regex mr from_mregex_to_mregex RPDs_ok to_mregex_ok RPDs_trans\n by fastforce+\n } note * = this\n have **: \"\\ \\ ne - (\\ \\ i + \\ \\ ne - \\ \\ (ne - Suc 0)) = \\ \\ (ne - Suc 0) - \\ \\ i\" for i\n by (metis (no_types, lifting) Nat.diff_diff_right \\_mono add.commute add_diff_cancel_left diff_le_self le_add2 order_trans)\n have ***: \"\\ \\ i = \\ \\ ne\"\n if \"\\ \\ ne \\ \\ \\ i\" \"\\ \\ i \\ \\ \\ (ne - Suc 0)\" \"ne > 0\" for i\n by (metis (no_types, lifting) Suc_pred \\_mono diff_le_self le_\\_less le_antisym not_less_eq that)\n then have in_aux0_1: \"(t, X) \\ set aux0 \\ ne \\ 0 \\ t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\" for t X\n unfolding aux0_def using safe mr mrs\n by (auto simp: lookup_tabulate map_of_map_restrict restrict_map_def finite_RPDs * ** RPDs_trans diff_le_mono2\n intro!: sat_MatchP_rec[of \\ _ _ ne, THEN iffD2]\n qtable_union[OF qtable_r\\[OF _ _ qtables] qtable_r\\_strict[OF _ _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point 0) r)\" _ ms for ms]\n qtable_cong[OF qtable_r\\[OF _ _ qtables],\n of ms \"fv_regex r\" \"\\v r. Formula.sat \\ V v (ne - Suc 0) (Formula.MatchP (point (\\ \\ (ne - Suc 0) - \\ \\ i)) r)\"\n _ _ \"(\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - \\ \\ i)) (from_mregex ms \\s)))\" for ms i]\n dest!: assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct1, rule_format]\n sat_MatchP_rec[\"of\" \\ _ _ ne, THEN iffD1]\n elim!: bspec order.trans[OF _ \\_mono] bexI[rotated] split: option.splits if_splits) (* slow 7 sec *)\n then have in_aux0_le_\\: \"(t, X) \\ set aux0 \\ t \\ \\ \\ ne\" for t X\n by (meson \\_mono diff_le_self le_trans)\n have in_aux0_2: \"ne \\ 0 \\ t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\ \\i. \\ \\ i = t \\\n \\X. (t, X) \\ set aux0\" for t\n proof -\n fix t\n assume \"ne \\ 0\" \"t \\ \\ \\ (ne-1)\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n then obtain X where \"(t, X) \\ set aux\"\n by (atomize_elim, intro assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct2, rule_format])\n (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \\_mono)\n with \\\\ \\ ne - t \\ right I\\ have \"(t, ?update X t) \\ set aux0\"\n unfolding aux0_def by (auto simp: id_def elim!: bexI[rotated] intro!: exI[of _ X])\n then show \"\\X. (t, X) \\ set aux0\"\n by blast\n qed\n have aux0_Nil: \"aux0 = [] \\ ne = 0 \\ ne \\ 0 \\ (\\t. t \\ \\ \\ (ne-1) \\ \\ \\ ne - t \\ right I \\\n (\\i. \\ \\ i = t))\"\n using in_aux0_2 by (cases \"ne = 0\") (auto)\n\n have aux'_eq: \"aux' = (case aux0 of\n [] \\ [(\\ \\ ne, mrtabulate mrs (r\\_strict n rels))]\n | x # aux' \\ (if fst x = \\ \\ ne then x # aux'\n else (\\ \\ ne, mrtabulate mrs (r\\_strict n rels)) # x # aux'))\"\n using result_eq unfolding aux0_def update_matchP_def Let_def by simp\n have sorted_aux': \"sorted_wrt (\\x y. fst x > fst y) aux'\"\n unfolding aux'_eq\n using sorted_aux0 in_aux0_le_\\ by (cases aux0) (fastforce)+\n\n have in_aux'_1: \"t \\ \\ \\ ne \\ \\ \\ ne - t \\ right I \\ (\\i. \\ \\ i = t) \\\n (\\ms\\RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms))\"\n if aux': \"(t, X) \\ set aux'\" for t X\n proof (cases aux0)\n case Nil\n with aux' show ?thesis\n unfolding aux'_eq using safe mrs qtables aux0_Nil *\n by (auto simp: zero_enat_def[symmetric] sat_MatchP_rec[where i=ne]\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict]\n dest: spec[of _ \"\\ \\ (ne-1)\"])\n next\n case (Cons a as)\n show ?thesis\n proof (cases \"t = \\ \\ ne\")\n case t: True\n show ?thesis\n proof (cases \"fst a = \\ \\ ne\")\n case True\n with aux' Cons t have \"X = snd a\"\n unfolding aux'_eq using sorted_aux0 by auto\n moreover from in_aux0_1[of \"fst a\" \"snd a\"] Cons have \"ne \\ 0\"\n \"fst a \\ \\ \\ ne\" \"\\ \\ ne - fst a \\ right I\" \"\\i. \\ \\ i = fst a\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - fst a)) (from_mregex ms \\s))) (lookup (snd a) ms)\"\n by auto\n ultimately show ?thesis using t True\n by auto\n next\n case False\n with aux' Cons t have \"X = mrtabulate mrs (r\\_strict n rels)\"\n unfolding aux'_eq using sorted_aux0 in_aux0_le_\\[of \"fst a\" \"snd a\"] by auto\n with aux' Cons t False show ?thesis\n unfolding aux'_eq using safe mrs qtables * in_aux0_2[of \"\\ \\ (ne-1)\"] in_aux0_le_\\[of \"fst a\" \"snd a\"] sorted_aux0\n by (auto simp: sat_MatchP_rec[where i=ne] zero_enat_def[symmetric] enat_0_iff not_le\n lookup_tabulate finite_RPDs split: option.splits\n intro!: qtable_cong[OF qtable_r\\_strict] dest!: le_\\_less meta_mp)\n qed\n next\n case False\n with aux' Cons have \"(t, X) \\ set aux0\"\n unfolding aux'_eq by (auto split: if_splits)\n then have \"ne \\ 0\" \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\"\n \"\\ms \\ RPDs mr. qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne\n (Formula.MatchP (point (\\ \\ ne - t)) (from_mregex ms \\s))) (lookup X ms)\"\n using in_aux0_1 by blast+\n with False aux' Cons show ?thesis\n unfolding aux'_eq by auto\n qed\n qed\n\n have in_aux'_2: \"\\X. (t, X) \\ set aux'\" if \"t \\ \\ \\ ne\" \"\\ \\ ne - t \\ right I\" \"\\i. \\ \\ i = t\" for t\n proof (cases \"t = \\ \\ ne\")\n case True\n then show ?thesis\n proof (cases aux0)\n case Nil\n with True show ?thesis unfolding aux'_eq by simp\n next\n case (Cons a as)\n with True show ?thesis unfolding aux'_eq using eq_fst_iff[of t a]\n by (cases \"fst a = \\ \\ ne\") auto\n qed\n next\n case False\n with that have \"ne \\ 0\"\n using le_\\_less neq0_conv by blast\n moreover from False that have \"t \\ \\ \\ (ne-1)\"\n by (metis One_nat_def Suc_leI Suc_pred \\_mono diff_is_0_eq' order.antisym neq0_conv not_le)\n ultimately obtain X where \"(t, X) \\ set aux0\" using \\\\ \\ ne - t \\ right I\\ \\\\i. \\ \\ i = t\\\n by atomize_elim (auto intro!: in_aux0_2)\n then show ?thesis unfolding aux'_eq using False\n by (auto intro: exI[of _ X] split: list.split)\n qed\n\n show \"wf_matchP_aux \\ V n R I r aux' (Suc ne)\"\n unfolding wf_matchP_aux_def using mr\n by (auto dest: in_aux'_1 intro: sorted_aux' in_aux'_2)\n\n have rel_eq: \"rel = foldr (\\) [lookup rel mr. (t, rel) \\ aux', left I \\ \\ \\ ne - t] {}\"\n unfolding aux'_eq aux0_def\n using result_eq by (simp add: update_matchP_def Let_def)\n have rel_alt: \"rel = (\\(t, rel) \\ set aux'. if left I \\ \\ \\ ne - t then lookup rel mr else empty_table)\"\n unfolding rel_eq\n by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)\n show \"qtable n (fv_regex r) (mem_restr R) (\\v. Formula.sat \\ V (map the v) ne (Formula.MatchP I r)) rel\"\n unfolding rel_alt\n proof (rule qtable_Union[where Qi=\"\\(t, X) v.\n left I \\ \\ \\ ne - t \\ Formula.sat \\ V (map the v) ne (Formula.MatchP (point (\\ \\ ne - t)) r)\"],\n goal_cases finite qtable equiv)\n case (equiv v)\n show ?case\n proof (rule iffI, erule sat_MatchP_point, goal_cases left right)\n case (left j)\n then show ?case using in_aux'_2[of \"\\ \\ j\", OF _ _ exI, OF _ _ refl] by auto\n next\n case right\n then show ?case by (auto elim!: sat_MatchP_pointD dest: in_aux'_1)\n qed\n qed (auto dest!: in_aux'_1 intro!: qtable_empty dest!: bspec[OF _ RPDs_refl]\n simp: from_mregex_eq[OF safe mr])\nqed\n\nlemma length_update_until: \"length (update_until args rel1 rel2 nt aux) = Suc (length aux)\"\n unfolding update_until_def by simp\n\nlemma wf_update_until_auxlist:\n assumes pre: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length auxlist) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_auxlist \\ V n R pos \\ I \\ (update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist) ne\"\n unfolding wf_until_auxlist_def length_update_until\n unfolding update_until_def list.rel_map add_Suc_right upt.simps eqTrueI[OF le_add1] if_True\nproof (rule list_all2_appendI, unfold list.rel_map, goal_cases old new)\n case old\n show ?case\n proof (rule list.rel_mono_strong[OF assms(1)[unfolded wf_until_auxlist_def]]; safe, goal_cases mono1 mono2)\n case (mono1 i X Y v)\n then show ?case\n by (fastforce simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq\n elim!: qtable_join[OF _ qtable1] qtable_union[OF _ qtable1])\n next\n case (mono2 i X Y v)\n then show ?case using fvi_subset\n by (auto 0 3 simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq split: if_splits\n elim!: qtable_union[OF _ qtable_join_fixed[OF qtable2]]\n elim: qtable_cong[OF _ refl] intro: exI[of _ \"ne + length auxlist\"]) (* slow 8 sec*)\n qed\nnext\n case new\n then show ?case\n by (auto intro!: qtable_empty qtable1 qtable2[THEN qtable_cong] exI[of _ \"ne + length auxlist\"]\n simp: args_ivl args_n args_pos less_Suc_eq zero_enat_def[symmetric])\nqed\n\nlemma (in muaux) wf_update_until:\n assumes pre: \"wf_until_aux \\ V R args \\ \\ aux ne\"\n and qtable1: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel1\"\n and qtable2: \"qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length_muaux args aux) \\) rel2\"\n and fvi_subset: \"Formula.fv \\ \\ Formula.fv \\\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\\"\n and args_R: \"args_R args = Formula.fv \\\"\n and args_pos: \"args_pos args = pos\"\n shows \"wf_until_aux \\ V R args \\ \\ (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) ne \\\n length_muaux args (add_new_muaux args rel1 rel2 (\\ \\ (ne + length_muaux args aux)) aux) = Suc (length_muaux args aux)\"\nproof -\n from pre obtain cur auxlist where valid_aux: \"valid_muaux args cur aux auxlist\" and\n cur: \"cur = (if ne + length auxlist = 0 then 0 else \\ \\ (ne + length auxlist - 1))\" and\n pre_list: \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist ne\"\n unfolding wf_until_aux_def args_ivl args_n args_pos by auto\n have length_aux: \"length_muaux args aux = length auxlist\"\n using valid_length_muaux[OF valid_aux] .\n define nt where \"nt \\ \\ \\ (ne + length_muaux args aux)\"\n have nt_mono: \"cur \\ nt\"\n unfolding cur nt_def length_aux by simp\n define auxlist' where \"auxlist' \\ update_until args rel1 rel2 (\\ \\ (ne + length auxlist)) auxlist\"\n have length_auxlist': \"length auxlist' = Suc (length auxlist)\"\n unfolding auxlist'_def by (auto simp add: length_update_until)\n have tab1: \"table (args_n args) (args_L args) rel1\"\n using qtable1 unfolding args_n[symmetric] args_L[symmetric] by (auto simp add: qtable_def)\n have tab2: \"table (args_n args) (args_R args) rel2\"\n using qtable2 unfolding args_n[symmetric] args_R[symmetric] by (auto simp add: qtable_def)\n have fv_sub: \"fv \\ \\ fv \\\"\n using pre unfolding wf_until_aux_def by auto\n moreover have valid_add_new_auxlist: \"valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux) auxlist'\"\n using valid_add_new_muaux[OF valid_aux tab1 tab2 nt_mono]\n unfolding auxlist'_def nt_def length_aux .\n moreover have \"length_muaux args (add_new_muaux args rel1 rel2 nt aux) = Suc (length_muaux args aux)\"\n using valid_length_muaux[OF valid_add_new_auxlist] unfolding length_auxlist' length_aux[symmetric] .\n moreover have \"wf_until_auxlist \\ V n R pos \\ I \\ auxlist' ne\"\n using wf_update_until_auxlist[OF pre_list qtable1[unfolded length_aux] qtable2[unfolded length_aux] fv_sub args_ivl args_n args_pos]\n unfolding auxlist'_def .\n moreover have \"\\ \\ (ne + length auxlist) = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\"\n unfolding cur length_auxlist' by auto\n ultimately show ?thesis\n unfolding wf_until_aux_def nt_def length_aux args_ivl args_n args_pos by fast\nqed\n\nlemma length_update_matchF_base:\n \"length (fst (update_matchF_base I mr mrs nt entry st)) = Suc 0\"\n by (auto simp: Let_def update_matchF_base_def)\n\nlemma length_update_matchF_step:\n \"length (fst (update_matchF_step I mr mrs nt entry st)) = Suc (length (fst st))\"\n by (auto simp: Let_def update_matchF_step_def split: prod.splits)\n\nlemma length_foldr_update_matchF_step:\n \"length (fst (foldr (update_matchF_step I mr mrs nt) aux base)) = length aux + length (fst base)\"\n by (induct aux arbitrary: base) (auto simp: Let_def length_update_matchF_step)\n\nlemma length_update_matchF: \"length (update_matchF n I mr mrs rels nt aux) = Suc (length aux)\"\n unfolding update_matchF_def update_matchF_base_def length_foldr_update_matchF_step\n by (auto simp: Let_def)\n\nlemma wf_update_matchF_base_invar:\n assumes safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) j \\) rel) \\s rels\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_base n I mr mrs rels (\\ \\ j)) j\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n show ?thesis\n unfolding wf_matchF_invar_def wf_matchF_aux_def update_matchF_base_def mr prod.case Let_def mrs\n using safe\n by (auto simp: * from_mregex qtables qtable_empty_iff zero_enat_def[symmetric]\n lookup_tabulate finite_LPDs eps_match less_Suc_eq LPDs_refl\n intro!: qtable_cong[OF qtable_l\\_strict[where \\s=\\s]] intro: qtables exI[of _ j]\n split: option.splits)\nqed\n\nlemma Un_empty_table[simp]: \"rel \\ empty_table = rel\" \"empty_table \\ rel = rel\"\n unfolding empty_table_def by auto\n\nlemma wf_matchF_invar_step:\n assumes wf: \"wf_matchF_invar \\ V n R I r st (Suc i)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) rel) \\s rels\"\n and rel: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. i \\ j \\ j < i + length (fst st) \\ mem (\\ \\ j - \\ \\ i) I \\\n Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n and entry: \"entry = (\\ \\ i, rels, rel)\"\n and nt: \"nt = \\ \\ (i + length (fst st))\"\n shows \"wf_matchF_invar \\ V n R I r (update_matchF_step I mr mrs nt entry st) i\"\nproof -\n have from_mregex: \"from_mregex mr \\s = r\"\n using safe mr using from_mregex_eq by blast\n { fix ms\n assume \"ms \\ LPDs mr\"\n then have \"fv_regex (from_mregex ms \\s) = fv_regex r\"\n \"safe_regex Futu Strict (from_mregex ms \\s)\" \"ok (length \\s) ms\" \"LPD ms \\ LPDs mr\"\n using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans\n by fastforce+\n } note * = this\n { fix aux X ms\n assume \"st = (aux, X)\" \"ms \\ LPDs mr\"\n with wf mr have \"qtable n (fv_regex r) (mem_restr R)\n (\\v. Regex.match (Formula.sat \\ V (map the v)) (from_mregex ms \\s) i (i + length aux))\n (l\\ (\\x. x) X rels ms)\"\n by (intro qtable_cong[OF qtable_l\\[where \\s=\\s and A=\"fv_regex r\" and\n Q=\"\\v r. Regex.match (Formula.sat \\ V v) r (Suc i) (i + length aux)\", OF _ _ qtables]])\n (auto simp: wf_matchF_invar_def * LPDs_trans lpd_match[of i] elim!: bspec)\n } note l\\ = this\n have \"lookup (mrtabulate mrs f) ms = f ms\" if \"ms \\ LPDs mr\" for ms and f :: \"mregex \\ 'a table\"\n using that mrs by (fastforce simp: lookup_tabulate finite_LPDs split: option.splits)+\n then show ?thesis\n using wf mr mrs entry nt LPDs_trans\n by (auto 0 3 simp: Let_def wf_matchF_invar_def update_matchF_step_def wf_matchF_aux_def mr * LPDs_refl\n list_all2_Cons1 append_eq_Cons_conv upt_eq_Cons_conv Suc_le_eq qtables\n lookup_tabulate finite_LPDs id_def l\\ from_mregex less_Suc_eq\n intro!: qtable_union[OF rel l\\] qtable_cong[OF rel]\n intro: exI[of _ \"i + length _\"]\n split: if_splits prod.splits)\nqed\n\nlemma wf_update_matchF_invar:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne (length (fst st) - 1)\"\n and wf: \"wf_matchF_invar \\ V n R I r st (ne + length aux)\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and j: \"j = ne + length aux + length (fst st) - 1\"\n shows \"wf_matchF_invar \\ V n R I r (foldr (update_matchF_step I mr mrs (\\ \\ j)) aux st) ne\"\n using pre wf unfolding j\nproof (induct aux arbitrary: ne)\n case (Cons entry aux)\n from Cons(1)[of \"Suc ne\"] Cons(2,3) show ?case\n unfolding foldr.simps o_apply\n by (intro wf_matchF_invar_step[where rels = \"fst (snd entry)\" and rel = \"snd (snd entry)\"])\n (auto simp: safe mr mrs wf_matchF_aux_def wf_matchF_invar_def list_all2_Cons1 append_eq_Cons_conv\n Suc_le_eq upt_eq_Cons_conv length_foldr_update_matchF_step add.assoc split: if_splits)\nqed simp\n\n\nlemma wf_update_matchF:\n assumes pre: \"wf_matchF_aux \\ V n R I r aux ne 0\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and nt: \"nt = \\ \\ (ne + length aux)\"\n and qtables: \"list_all2 (\\\\ rel. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) (ne + length aux) \\) rel) \\s rels\"\n shows \"wf_matchF_aux \\ V n R I r (update_matchF n I mr mrs rels nt aux) ne 0\"\n unfolding update_matchF_def using wf_update_matchF_base_invar[OF safe mr mrs qtables, of I]\n unfolding nt\n by (intro wf_update_matchF_invar[OF _ _ safe mr mrs, unfolded wf_matchF_invar_def split_beta, THEN conjunct2, THEN conjunct1])\n (auto simp: length_update_matchF_base wf_matchF_invar_def update_matchF_base_def Let_def pre)\n\nlemma wf_until_aux_Cons: \"wf_until_auxlist \\ V n R pos \\ I \\ (a # aux) ne \\\n wf_until_auxlist \\ V n R pos \\ I \\ aux (Suc ne)\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong)\n\nlemma wf_matchF_aux_Cons: \"wf_matchF_aux \\ V n R I r (entry # aux) ne i \\\n wf_matchF_aux \\ V n R I r aux (Suc ne) i\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong split: prod.splits)\n\nlemma wf_until_aux_Cons1: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\ t = \\ \\ ne\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons1: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\ t = \\ \\ ne\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma wf_until_aux_Cons3: \"wf_until_auxlist \\ V n R pos \\ I \\ ((t, a1, a2) # aux) ne \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux) \\ mem (\\ \\ j - \\ \\ ne) I \\\n Formula.sat \\ V (map the v) j \\ \\ (\\k\\{ne.. V (map the v) k \\ else \\ Formula.sat \\ V (map the v) k \\))) a2\"\n unfolding wf_until_auxlist_def\n by (simp add: upt_conv_Cons del: upt_Suc)\n\nlemma wf_matchF_aux_Cons3: \"wf_matchF_aux \\ V n R I r ((t, rels, rel) # aux) ne i \\\n qtable n (Formula.fv_regex r) (mem_restr R) (\\v. (\\j. ne \\ j \\ j < Suc (ne + length aux + i) \\ mem (\\ \\ j - \\ \\ ne) I \\\n Regex.match (Formula.sat \\ V (map the v)) r ne j)) rel\"\n unfolding wf_matchF_aux_def\n by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)\n\nlemma upt_append: \"a \\ b \\ b \\ c \\ [a.. ja'\" \"jb \\ jb'\"\n shows \"wf_mbuf2 i ja' jb' P Q (mbuf2_add xs ys buf)\"\n using assms unfolding wf_mbuf2_def\n by (auto 0 3 simp: list_all2_append2 upt_append dest: list_all2_lengthD\n intro: exI[where x=\"[i..j j'. [j..) js js'\"\n shows \"wf_mbufn i js' Ps (mbufn_add xss buf)\"\n unfolding wf_mbufn_def list_all3_conv_all_nth\nproof safe\n show \"length Ps = length js'\" \"length js' = length (mbufn_add xss buf)\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth by auto\nnext\n fix k assume k: \"k < length Ps\"\n then show \"i \\ js' ! k\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth\n by (auto 0 4 dest: spec[of _ i])\n from k have \" [i..i z. \\x y. P i x \\ Q i y \\ z = f x y) [i.. xs = [] \\ ys = []\"\n \"list_all3 P xs [] zs \\ xs = [] \\ zs = []\"\n \"list_all3 P [] ys zs \\ ys = [] \\ zs = []\"\n unfolding list_all3_conv_all_nth by auto\n\nlemma list_all3_Cons:\n \"list_all3 P xs ys (z # zs) \\ (\\x xs' y ys'. xs = x # xs' \\ ys = y # ys' \\ P x y z \\ list_all3 P xs' ys' zs)\"\n \"list_all3 P xs (y # ys) zs \\ (\\x xs' z zs'. xs = x # xs' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs' ys zs')\"\n \"list_all3 P (x # xs) ys zs \\ (\\y ys' z zs'. ys = y # ys' \\ zs = z # zs' \\ P x y z \\ list_all3 P xs ys' zs')\"\n unfolding list_all3_conv_all_nth\n by (auto simp: length_Suc_conv Suc_length_conv nth_Cons split: nat.splits)\n\nlemma list_all3_mono_strong: \"list_all3 P xs ys zs \\\n (\\x y z. x \\ set xs \\ y \\ set ys \\ z \\ set zs \\ P x y z \\ Q x y z) \\\n list_all3 Q xs ys zs\"\n by (induct xs ys zs rule: list_all3.induct) (auto intro: list_all3.intros)\n\ndefinition Mini where\n \"Mini i js = (if js = [] then i else Min (set js))\"\n\nlemma wf_mbufn_in_set_Mini:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ Mini i js = i\"\n unfolding in_set_conv_nth\nproof (elim exE conjE)\n fix k\n have \"i \\ j\" if \"j \\ set js\" for j\n using that assms unfolding wf_mbufn_def list_all3_conv_all_nth in_set_conv_nth by auto\n moreover assume \"k < length buf\" \"buf ! k = []\"\n ultimately show ?thesis using assms\n unfolding Mini_def wf_mbufn_def list_all3_conv_all_nth\n by (auto 0 4 dest!: spec[of _ k] intro: Min_eqI simp: in_set_conv_nth)\nqed\n\nlemma wf_mbufn_notin_set:\n assumes \"wf_mbufn i js Ps buf\"\n shows \"[] \\ set buf \\ j \\ set js \\ i < j\"\n using assms unfolding wf_mbufn_def list_all3_conv_all_nth\n by (cases \"i \\ set js\") (auto intro: le_neq_implies_less simp: in_set_conv_nth)\n\nlemma wf_mbufn_map_tl:\n \"wf_mbufn i js Ps buf \\ [] \\ set buf \\ wf_mbufn (Suc i) js Ps (map tl buf)\"\n by (auto simp: wf_mbufn_def list_all3_map Suc_le_eq\n dest: rel_funD[OF tl_transfer] elim!: list_all3_mono_strong le_neq_implies_less)\n\nlemma list_all3_list_all2I: \"list_all3 (\\x y z. Q x z) xs ys zs \\ list_all2 Q xs zs\"\n by (induct xs ys zs rule: list_all3.induct) auto\n\nlemma mbuf2t_take_eqD:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n shows \"wf_mbuf2 (min ja jb) ja jb P Q buf'\"\n and \"list_all2 R [min ja jb.. set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n from nonempty rec.prems(2) have \"Mini i js = Mini (Suc i) js\"\n unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k. k \\ set js \\ k \\ j\"\n and \"k = Mini (i + length nts) js\"\n shows \"wf_mbufn k js Ps buf'\"\n and \"list_all2 R [k.. []\"\n using that by (fastforce simp flip: length_greater_0_conv)\n with 2 show ?case\n using wf_mbufn_in_set_Mini[OF 2(2)] wf_mbufn_notin_set[OF 2(2)]\n by (subst (asm) mbufnt_take.simps) (force simp: Mini_def wf_mbufn_def\n dest!: IH(2)[rotated, OF _ wf_mbufn_map_tl[OF 2(2)] *]\n split: if_splits prod.splits)\nqed\n\nlemma mbuf2t_take_induct[consumes 5, case_names base step]:\n assumes \"mbuf2t_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbuf2 i ja jb P Q buf\"\n and \"list_all2 R [i.. j\" \"jb \\ j\"\n and \"U i z\"\n and \"\\k x y t z. i \\ k \\ Suc k \\ ja \\ Suc k \\ jb \\\n P k x \\ Q k y \\ R k t \\ U k z \\ U (Suc k) (f x y t z)\"\n shows \"U (min ja jb) z'\"\n using assms unfolding wf_mbuf2_def\n by (induction f z buf nts arbitrary: i z' buf' nts' rule: mbuf2t_take.induct)\n (auto simp add: list_all2_Cons2 upt_eq_Cons_conv less_eq_Suc_le min_absorb1 min_absorb2\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated] split: prod.split)\n\nlemma list_all2_hdD:\n assumes \"list_all2 P [i.. []\"\n shows \"P i (hd xs)\" \"i < j\"\n using assms unfolding list_all2_conv_all_nth\n by (auto simp: hd_conv_nth intro: zero_less_diff[THEN iffD1] dest!: spec[of _ 0])\n\nlemma mbufn_take_induct[consumes 3, case_names base step]:\n assumes \"mbufn_take f z buf = (z', buf')\"\n and \"wf_mbufn i js Ps buf\"\n and \"U i z\"\n and \"\\k xs z. i \\ k \\ Suc k \\ Mini i js \\\n list_all2 (\\P x. P k x) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n shows \"U (Mini i js) z'\"\n using assms unfolding wf_mbufn_def\nproof (induction f z buf arbitrary: i z' buf' rule: mbufn_take.induct)\n case rec: (1 f z buf)\n show ?case proof (cases \"buf = []\")\n case True\n with rec.prems show ?thesis unfolding Mini_def by simp\n next\n case nonempty: False\n show ?thesis proof (cases \"[] \\ set buf\")\n case True\n from rec.prems(2) have \"\\j\\set js. i \\ j\"\n by (auto simp: in_set_conv_nth list_all3_conv_all_nth)\n moreover from True rec.prems(2) have \"i \\ set js\"\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n ultimately have \"Mini i js = i\"\n unfolding Mini_def\n by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])\n with rec.prems nonempty True show ?thesis by simp\n next\n case False\n with nonempty rec.prems(2) have more: \"Suc i \\ Mini i js\"\n using diff_is_0_eq not_le unfolding Mini_def\n by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)\n then have \"Mini i js = Mini (Suc i) js\" unfolding Mini_def by auto\n show ?thesis\n unfolding \\Mini i js = Mini (Suc i) js\\\n proof (rule rec.IH)\n show \"\\ (buf = [] \\ [] \\ set buf)\" using nonempty False by simp\n show \"mbufn_take f (f (map hd buf) z) (map tl buf) = (z', buf')\"\n using nonempty False rec.prems by simp\n show \"list_all3 (\\P j xs. Suc i \\ j \\ list_all2 P [Suc i..k xs z. Suc i \\ k \\ Suc k \\ Mini (Suc i) js \\\n list_all2 (\\P. P k) Ps xs \\ U k z \\ U (Suc k) (f xs z)\"\n by (rule rec.prems(4)) (auto simp: Mini_def)\n qed\n qed\n qed\nqed\n\nlemma mbufnt_take_induct[consumes 5, case_names base step]:\n assumes \"mbufnt_take f z buf nts = (z', buf', nts')\"\n and \"wf_mbufn i js Ps buf\"\n and \"list_all2 R [i..k. k \\ set js \\ k \\ j\"\n and \"U i z\"\n and \"\\k xs t z. i \\ k \\ Suc k \\ Mini j js \\\n list_all2 (\\P x. P k x) Ps xs \\ R k t \\ U k z \\ U (Suc k) (f xs t z)\"\n shows \"U (Mini (i + length nts) js) z'\"\n using assms\nproof (induction f z buf nts arbitrary: i z' buf' nts' rule: mbufnt_take.induct)\n case (1 f z buf nts)\n then have *: \"list_all2 R [Suc i.. []\" \"nts = []\"\n using that unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)]\n by (fastforce simp: Mini_def list_all3_Cons neq_Nil_conv)\n with 1(2-7) list_all2_hdD[OF 1(4)] show ?case\n unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)] wf_mbufn_notin_set[OF 1(3)]\n by (subst (asm) mbufnt_take.simps)\n (auto simp add: Mini_def list.rel_map Suc_le_eq\n elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated]\n list_all3_mono_strong[THEN list_all3_list_all2I[of _ _ js]] list_all2_hdD\n dest!: 1(1)[rotated, OF _ wf_mbufn_map_tl[OF 1(3)] * _ 1(7)] split: prod.split if_splits)\nqed\n\nlemma mbuf2_take_add':\n assumes eq: \"mbuf2_take f (mbuf2_add xs ys buf) = (zs, buf')\"\n and pre: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and rm: \"rel_mapping (\\) P P'\"\n and xs: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"list_all2 (\\i Z. \\X Y.\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) Y \\\n Z = f X Y)\n [min (progress \\ P \\ j) (progress \\ P \\ j).. P' \\ j') (progress \\ P' \\ j')] zs\"\n using pre rm unfolding wf_mbuf2'_def\n by (force intro!: mbuf2_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm])+\n\nlemma mbuf2t_take_add':\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n shows \"wf_mbuf2' \\ P' V j' n R \\ \\ buf'\"\n and \"wf_ts \\ P' j' \\ \\ nts'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def wf_ts_def\n by (auto intro!: mbuf2t_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen)\n\nlemma ok_0_atms: \"ok 0 mr \\ regex.atms (from_mregex mr []) = {}\"\n by (induct mr) auto\n\nlemma ok_0_progress: \"ok 0 mr \\ progress_regex \\ P (from_mregex mr []) j = j\"\n by (drule ok_0_atms) (auto simp: progress_regex_def)\n\nlemma atms_empty_atms: \"safe_regex m g r \\ atms r = {} \\ regex.atms r = {}\"\n by (induct r rule: safe_regex_induct) (auto split: if_splits simp: cases_Neg_iff)\n\nlemma atms_empty_progress: \"safe_regex m g r \\ atms r = {} \\ progress_regex \\ P r j = j\"\n by (drule atms_empty_atms) (auto simp: progress_regex_def)\n\nlemma to_mregex_empty_progress: \"safe_regex m g r \\ to_mregex r = (mr, []) \\\n progress_regex \\ P r j = j\"\n using from_mregex_eq ok_0_progress to_mregex_ok atms_empty_atms by fastforce\n\nlemma progress_regex_le: \"pred_mapping (\\x. x \\ j) P \\ progress_regex \\ P r j \\ j\"\n by (auto intro!: progress_le_gen simp: Min_le_iff progress_regex_def)\n\nlemma Neg_acyclic: \"formula.Neg x = x \\ P\"\n by (induct x) auto\n\nlemma case_Neg_in_iff: \"x \\ (case y of formula.Neg \\' \\ {\\'} | _ \\ {}) \\ y = formula.Neg x\"\n by (cases y) auto\n\nlemma atms_nonempty_progress:\n \"safe_regex m g r \\ atms r \\ {} \\ (\\\\. progress \\ P \\ j) ` atms r = (\\\\. progress \\ P \\ j) ` regex.atms r\"\n by (frule atms_empty_atms; simp)\n (auto 0 3 simp: atms_def image_iff case_Neg_in_iff elim!: disjE_Not2 dest: safe_regex_safe_formula)\n\nlemma to_mregex_nonempty_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\ \\s \\ [] \\\n progress_regex \\ P r j = (MIN \\\\set \\s. progress \\ P \\ j)\"\n using atms_nonempty_progress to_mregex_ok unfolding progress_regex_def by fastforce\n\nlemma to_mregex_progress: \"safe_regex m g r \\ to_mregex r = (mr, \\s) \\\n progress_regex \\ P r j = (if \\s = [] then j else (MIN \\\\set \\s. progress \\ P \\ j))\"\n using to_mregex_nonempty_progress to_mregex_empty_progress unfolding progress_regex_def by auto\n\nlemma mbufnt_take_add':\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n shows \"wf_mbufn' \\ P' V j' n R r buf'\"\n and \"wf_ts_regex \\ P' j' r nts'\"\n using pre_buf pre_nts bounded rm mr safe xss \\j \\ j'\\ unfolding wf_mbufn'_def wf_ts_regex_def\n using atms_empty_progress[of m g r] to_mregex_ok[OF mr]\n by (auto 0 3 simp: list.rel_map to_mregex_empty_progress to_mregex_nonempty_progress Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n dest: list_all2_lengthD elim!: mbufnt_take_eqD[OF eq wf_mbufn_add])\n\nlemma mbuf2t_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and pre_buf: \"wf_mbuf2' \\ P V j n R \\ \\ buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [min (progress \\ P \\ j) (progress \\ P \\ j)..i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] xs\"\n and ys: \"list_all2 (\\i. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ j'] ys\"\n and \"j \\ j'\"\n and base: \"U (min (progress \\ P \\ j) (progress \\ P \\ j)) z\"\n and step: \"\\k X Y z. min (progress \\ P \\ j) (progress \\ P \\ j) \\ k \\\n Suc k \\ progress \\ P' \\ j' \\ Suc k \\ progress \\ P' \\ j' \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) X \\\n qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\) Y \\\n U k z \\ U (Suc k) (f X Y (\\ \\ k) z)\"\n shows \"U (min (progress \\ P' \\ j') (progress \\ P' \\ j')) z'\"\n using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def\n by (blast intro!: mbuf2t_take_induct[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \\j \\ j'\\ rm]\n progress_le_gen base step)\n\nlemma mbufnt_take_add_induct'[consumes 6, case_names base step]:\n assumes eq: \"mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')\"\n and bounded: \"pred_mapping (\\x. x \\ j) P\" \"pred_mapping (\\x. x \\ j') P'\"\n and rm: \"rel_mapping (\\) P P'\"\n and safe: \"safe_regex m g r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and pre_buf: \"wf_mbufn' \\ P V j n R r buf\"\n and pre_nts: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j..\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) \\s)\n (map2 upt (map (\\\\. progress \\ P \\ j) \\s) (map (\\\\. progress \\ P' \\ j') \\s)) xss\"\n and \"j \\ j'\"\n and base: \"U (progress_regex \\ P r j) z\"\n and step: \"\\k Xs z. progress_regex \\ P r j \\ k \\ Suc k \\ progress_regex \\ P' r j' \\\n list_all2 (\\\\. qtable n (Formula.fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k \\)) \\s Xs \\\n U k z \\ U (Suc k) (f Xs (\\ \\ k) z)\"\n shows \"U (progress_regex \\ P' r j') z'\"\n using pre_buf pre_nts bounded rm \\j \\ j'\\ to_mregex_progress[OF safe mr, of \\ P' j'] to_mregex_empty_progress[OF safe, of mr \\ P j] base\n unfolding wf_mbufn'_def mr prod.case\n by (fastforce dest!: mbufnt_take_induct[OF eq wf_mbufn_add[OF _ xss] pre_nts, of U]\n simp: list.rel_map le_imp_diff_is_add ac_simps Mini_def\n intro: progress_mono_gen[OF \\j \\ j'\\ rm] list.rel_refl_strong progress_le_gen\n intro!: base step dest: list_all2_lengthD split: if_splits)\n\nlemma progress_Until_le: \"progress \\ P (Formula.Until \\ I \\) j \\ min (progress \\ P \\ j) (progress \\ P \\ j)\"\n by (cases \"right I\") (auto simp: trans_le_add1 intro!: cInf_lower)\n\nlemma progress_MatchF_le: \"progress \\ P (Formula.MatchF I r) j \\ progress_regex \\ P r j\"\n by (cases \"right I\") (auto simp: trans_le_add1 progress_regex_def intro!: cInf_lower)\n\nlemma list_all2_upt_Cons: \"P a x \\ list_all2 P [Suc a.. Suc a \\ b \\\n list_all2 P [a.. list_all2 P [b..\n a \\ b \\ b \\ c \\ list_all2 P [a..x. R x x) xs ys\"\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth)\n\nlemma map_split_map: \"map_split f (map g xs) = map_split (f o g) xs\"\n by (induct xs) auto\n\nlemma map_split_alt: \"map_split f xs = (map (fst o f) xs, map (snd o f) xs)\"\n by (induct xs) (auto split: prod.splits)\n\nlemma fv_formula_of_constraint: \"fv (formula_of_constraint (t1, p, c, t2)) = fv_trm t1 \\ fv_trm t2\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct) simp_all\n\nlemma (in maux) wf_mformula_wf_set: \"wf_mformula \\ j P V n R \\ \\' \\ wf_set n (Formula.fv \\')\"\n unfolding wf_set_def\nproof (induction rule: wf_mformula.induct)\n case (AndRel P V n R \\ \\' \\' conf)\n then show ?case by (auto simp: fv_formula_of_constraint dest!: subsetD)\nnext\n case (Ands P V n R l l_pos l_neg l' buf A_pos A_neg)\n from Ands.IH have \"\\\\'\\set (l_pos @ map remove_neg l_neg). \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \"_ @ _\"] del: set_append)\n then have \"\\\\'\\set (l_pos @ l_neg). \\x\\fv \\'. x < n\"\n by (auto dest: bspec[where x=\"remove_neg _\"])\n then show ?case using Ands.hyps(2) by auto\nnext\n case (Agg P V b n R \\ \\' y f g0 \\)\n then have \"Formula.fvi_trm b f \\ Formula.fvi b \\'\"\n by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])\n with Agg show ?case by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=b])\nnext\n case (MatchP r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchP have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nnext\n case (MatchF r P V n R \\s mr mrs buf nts I aux)\n then obtain \\s' where conv: \"to_mregex r = (mr, \\s')\" by blast\n with MatchF have \"\\\\'\\set \\s'. \\x\\fv \\'. x < n\"\n by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \\s'])\n with conv show ?case\n by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \\safe_regex _ _ r\\])\nqed (auto simp: fvi_Suc split: if_splits)\n\nlemma qtable_mmulti_join:\n assumes pos: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_pos Q_pos L_pos\"\n and neg: \"list_all3 (\\A Qi X. qtable n A P Qi X \\ wf_set n A) A_neg Q_neg L_neg\"\n and C_eq: \"C = \\(set A_pos)\" and L_eq: \"L = L_pos @ L_neg\"\n and \"A_pos \\ []\" and fv_subset: \"\\(set A_neg) \\ \\(set A_pos)\"\n and restrict_pos: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_pos\"\n and restrict_neg: \"\\x. wf_tuple n C x \\ P x \\ list_all (\\A. P (restrict A x)) A_neg\"\n and Qs: \"\\x. wf_tuple n C x \\ P x \\ Q x \\\n list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n shows \"qtable n C P Q (mmulti_join n A_pos A_neg L)\"\nproof (rule qtableI)\n from pos have 1: \"list_all2 (\\A X. table n A X \\ wf_set n A) A_pos L_pos\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n moreover from neg have \"list_all2 (\\A X. table n A X \\ wf_set n A) A_neg L_neg\"\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)\n ultimately have L: \"list_all2 (\\A X. table n A X \\ wf_set n A) (A_pos @ A_neg) (L_pos @ L_neg)\"\n by (rule list_all2_appendI)\n note in_join_iff = mmulti_join_correct[OF \\A_pos \\ []\\ L]\n from 1 have take_eq: \"take (length A_pos) (L_pos @ L_neg) = L_pos\"\n by (auto dest!: list_all2_lengthD)\n from 1 have drop_eq: \"drop (length A_pos) (L_pos @ L_neg) = L_neg\"\n by (auto dest!: list_all2_lengthD)\n\n note mmulti_join.simps[simp del]\n show \"table n C (mmulti_join n A_pos A_neg L)\"\n unfolding C_eq L_eq table_def by (simp add: in_join_iff)\n show \"Q x\" if \"x \\ mmulti_join n A_pos A_neg L\" \"wf_tuple n C x\" \"P x\" for x\n using that(2,3)\n proof (rule Qs[THEN iffD2, OF _ _ conjI])\n have pos': \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n and neg': \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using that(1) unfolding L_eq in_join_iff take_eq drop_eq by simp_all\n show \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n using pos pos' restrict_pos that(2,3)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n have fv_subset': \"\\i. i < length A_neg \\ A_neg ! i \\ C\"\n using fv_subset unfolding C_eq by (auto simp: Sup_le_iff)\n show \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using neg neg' restrict_neg that(2,3)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n wf_tuple_restrict_simple[OF _ fv_subset'])\n qed\n show \"x \\ mmulti_join n A_pos A_neg L\" if \"wf_tuple n C x\" \"P x\" \"Q x\" for x\n unfolding L_eq in_join_iff take_eq drop_eq\n proof (intro conjI)\n from that have pos': \"list_all2 (\\A Qi. Qi (restrict A x)) A_pos Q_pos\"\n and neg': \"list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg Q_neg\"\n using Qs[THEN iffD1] by auto\n show \"wf_tuple n (\\A\\set A_pos. A) x\"\n using \\wf_tuple n C x\\ unfolding C_eq by simp\n show \"list_all2 (\\A. (\\) (restrict A x)) A_pos L_pos\"\n using pos pos' restrict_pos that(1,2)\n by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def\n C_eq wf_tuple_restrict_simple[OF _ Sup_upper])\n show \"list_all2 (\\A. (\\) (restrict A x)) A_neg L_neg\"\n using neg neg' restrict_neg that(1,2)\n by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)\n qed\nqed\n\nlemma nth_filter: \"i < length (filter P xs) \\\n (\\i'. i' < length xs \\ P (xs ! i') \\ Q (xs ! i')) \\ Q (filter P xs ! i)\"\n by (metis (lifting) in_set_conv_nth set_filter mem_Collect_eq)\n\nlemma nth_partition: \"i < length xs \\\n (\\i'. i' < length (filter P xs) \\ Q (filter P xs ! i')) \\\n (\\i'. i' < length (filter (Not \\ P) xs) \\ Q (filter (Not \\ P) xs ! i')) \\ Q (xs ! i)\"\n by (metis (no_types, lifting) in_set_conv_nth set_filter mem_Collect_eq comp_apply)\n\nlemma qtable_bin_join:\n assumes \"qtable n A P Q1 X\" \"qtable n B P Q2 Y\" \"\\ b \\ B \\ A\" \"C = A \\ B\"\n \"\\x. wf_tuple n C x \\ P x \\ P (restrict A x) \\ P (restrict B x)\"\n \"\\x. b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ Q2 (restrict B x)\"\n \"\\x. \\ b \\ wf_tuple n C x \\ P x \\ Q x \\ Q1 (restrict A x) \\ \\ Q2 (restrict B x)\"\n shows \"qtable n C P Q (bin_join n A X b B Y)\"\n using qtable_join[OF assms] bin_join_table[of n A X B Y b] assms(1,2)\n by (auto simp add: qtable_def)\n\nlemma restrict_update: \"y \\ A \\ y < length x \\ restrict A (x[y:=z]) = restrict A x\"\n unfolding restrict_def by (auto simp add: nth_list_update)\n\nlemma qtable_assign:\n assumes \"qtable n A P Q X\"\n \"y < n\" \"insert y A = A'\" \"y \\ A\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ P (restrict A x')\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ Q' (x[y:=Some (f x)])\"\n \"\\x'. wf_tuple n A' x' \\ P x' \\ Q' x' \\ Q (restrict A x') \\ x' ! y = Some (f (restrict A x'))\"\n shows \"qtable n A' P Q' ((\\x. x[y:=Some (f x)]) ` X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\" unfolding qtable_def by simp\n then show \"table n A' ?Y\"\n unfolding table_def wf_tuple_def using assms(2,3)\n by (auto simp: nth_list_update)\nnext\n fix x'\n assume \"x' \\ ?Y\" \"wf_tuple n A' x'\" \"P x'\"\n then obtain x where \"x \\ X\" and x'_eq: \"x' = x[y:=Some (f x)]\" by blast\n then have \"wf_tuple n A x\"\n using assms(1) unfolding qtable_def table_def by blast\n then have \"y < length x\" using assms(2) by (simp add: wf_tuple_def)\n with \\wf_tuple n A x\\ have \"restrict A x' = x\"\n unfolding x'_eq by (simp add: restrict_update[OF assms(4)] restrict_idle)\n with \\wf_tuple n A' x'\\ \\P x'\\ have \"P x\"\n using assms(5) by blast\n with \\wf_tuple n A x\\ \\x \\ X\\ have \"Q x\"\n using assms(1) by (elim in_qtableE)\n with \\wf_tuple n A x\\ \\P x\\ show \"Q' x'\"\n unfolding x'_eq by (rule assms(6))\nnext\n fix x'\n assume \"wf_tuple n A' x'\" \"P x'\" \"Q' x'\"\n then have \"wf_tuple n A (restrict A x')\"\n using assms(3) by (auto intro!: wf_tuple_restrict_simple)\n moreover have \"P (restrict A x')\"\n using \\wf_tuple n A' x'\\ \\P x'\\ by (rule assms(5))\n moreover have \"Q (restrict A x')\" and y: \"x' ! y = Some (f (restrict A x'))\"\n using \\wf_tuple n A' x'\\ \\P x'\\ \\Q' x'\\ by (auto dest!: assms(7))\n ultimately have \"restrict A x' \\ X\" by (intro in_qtableI[OF assms(1)])\n moreover have \"x' = (restrict A x')[y:=Some (f (restrict A x'))]\"\n using y assms(2,3) \\wf_tuple n A (restrict A x')\\ \\wf_tuple n A' x'\\\n by (auto simp: list_eq_iff_nth_eq wf_tuple_def nth_list_update nth_restrict)\n ultimately show \"x' \\ ?Y\" by simp\nqed\n\nlemma sat_the_update: \"y \\ fv \\ \\ Formula.sat \\ V (map the (x[y:=z])) i \\ = Formula.sat \\ V (map the x) i \\\"\n by (rule sat_fv_cong) (metis map_update nth_list_update_neq)\n\nlemma progress_constraint: \"progress \\ P (formula_of_constraint c) j = j\"\n by (induction rule: formula_of_constraint.induct) simp_all\n\nlemma qtable_filter:\n assumes \"qtable n A P Q X\"\n \"\\x. wf_tuple n A x \\ P x \\ Q x \\ R x \\ Q' x\"\n shows \"qtable n A P Q' (Set.filter R X)\" (is \"qtable _ _ _ _ ?Y\")\nproof (rule qtableI)\n from assms(1) have \"table n A X\"\n unfolding qtable_def by simp\n then show \"table n A ?Y\"\n unfolding table_def wf_tuple_def by simp\nnext\n fix x\n assume \"x \\ ?Y\" \"wf_tuple n A x\" \"P x\"\n with assms show \"Q' x\" by (auto elim!: in_qtableE)\nnext\n fix x\n assume \"wf_tuple n A x\" \"P x\" \"Q' x\"\n with assms show \"x \\ Set.filter R X\" by (auto intro!: in_qtableI)\nqed\n\nlemma eval_constraint_sat_eq: \"wf_tuple n A x \\ fv_trm t1 \\ A \\ fv_trm t2 \\ A \\\n \\i\\A. i < n \\ eval_constraint (t1, p, c, t2) x =\n Formula.sat \\ V (map the x) i (formula_of_constraint (t1, p, c, t2))\"\n by (induction \"(t1, p, c, t2)\" rule: formula_of_constraint.induct)\n (simp_all add: meval_trm_eval_trm)\n\ndeclare progress_le_gen[simp]\n\ndefinition \"wf_envs \\ j P P' V db =\n (dom V = dom P \\\n Mapping.keys db = dom P \\ {p. p \\ fst ` \\ \\ j} \\\n rel_mapping (\\) P P' \\\n pred_mapping (\\i. i \\ j) P \\\n pred_mapping (\\i. i \\ Suc j) P' \\\n (\\p \\ Mapping.keys db - dom P. the (Mapping.lookup db p) = [{ts. (p, ts) \\ \\ \\ j}]) \\\n (\\p \\ dom P. list_all2 (\\i X. X = the (V p) i) [the (P p).. event_data list) set \\ Formula.database\" is\n \"\\X p. (if p \\ fst ` X then Some [{ts. (p, ts) \\ X}] else None)\" .\n\nlemma wf_envs_mk_db: \"wf_envs \\ j Map.empty Map.empty Map.empty (mk_db (\\ \\ j))\"\n unfolding wf_envs_def mk_db_def\n by transfer (force split: if_splits simp: image_iff rel_mapping_alt)\n\nlemma wf_envs_update:\n assumes wf_envs: \"wf_envs \\ j P P' V db\"\n and m_eq: \"m = Formula.nfv \\\"\n and in_fv: \"{0 ..< m} \\ fv \\\"\n and xs: \"list_all2 (\\i. qtable m (Formula.fv \\) (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\))\n [progress \\ P \\ j.. P' \\ (Suc j)] xs\"\n shows \"wf_envs \\ j (P(p \\ progress \\ P \\ j)) (P'(p \\ progress \\ P' \\ (Suc j)))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\}))\n (Mapping.update p (map (image (map the)) xs) db)\"\n unfolding wf_envs_def\nproof (intro conjI ballI, goal_cases)\n case 3\n from assms show ?case\n by (auto simp: wf_envs_def pred_mapping_alt progress_le progress_mono_gen\n intro!: rel_mapping_map_upd)\nnext\n case (6 p')\n with assms show ?case by (cases \"p' \\ dom P\") (auto simp: wf_envs_def lookup_update')\nnext\n case (7 p')\n from xs in_fv have \"list_all2 (\\x y. map the ` y = {v. length v = m \\ Formula.sat \\ V v x \\})\n [progress \\ P \\ j.. P' \\ (Suc j)] xs\"\n by (elim list.rel_mono_strong) (auto 0 3 simp: wf_tuple_def nth_append\n elim!: in_qtableE in_qtableI intro!: image_eqI[where x=\"map Some _\"])\n moreover have \"list_all2 (\\i X. X = the (V p') i) [the (P p').. p'\"\n proof -\n from that 7 have \"p' \\ dom P\" by simp\n with wf_envs show ?thesis by (simp add: wf_envs_def)\n qed\n ultimately show ?case\n by (simp add: list.rel_map image_iff lookup_update')\nqed (use assms in \\auto simp: wf_envs_def\\)\n\nlemma wf_envs_P_simps[simp]:\n \"wf_envs \\ j P P' V db \\ pred_mapping (\\i. i \\ j) P\"\n \"wf_envs \\ j P P' V db \\ pred_mapping (\\i. i \\ Suc j) P'\"\n \"wf_envs \\ j P P' V db \\ rel_mapping (\\) P P'\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_le[simp]:\n \"wf_envs \\ j P P' V db \\ progress \\ P \\ j \\ j\"\n \"wf_envs \\ j P P' V db \\ progress \\ P' \\ (Suc j) \\ Suc j\"\n unfolding wf_envs_def by auto\n\nlemma wf_envs_progress_regex_le[simp]:\n \"wf_envs \\ j P P' V db \\ progress_regex \\ P r j \\ j\"\n \"wf_envs \\ j P P' V db \\ progress_regex \\ P' r (Suc j) \\ Suc j\"\n unfolding wf_envs_def by (auto simp: progress_regex_le)\n\nlemma wf_envs_progress_mono[simp]:\n \"wf_envs \\ j P P' V db \\ a \\ b \\ progress \\ P \\ a \\ progress \\ P' \\ b\"\n unfolding wf_envs_def\n by (auto simp: progress_mono_gen)\n\nlemma qtable_wf_tuple_cong: \"qtable n A P Q X \\ A = B \\ (\\v. wf_tuple n A v \\ P v \\ Q v = Q' v) \\ qtable n B P Q' X\"\n unfolding qtable_def table_def by blast\n\nlemma (in maux) meval:\n assumes \"wf_mformula \\ j P V n R \\ \\'\" \"wf_envs \\ j P P' V db\"\n shows \"case meval n (\\ \\ j) db \\ of (xs, \\\\<^sub>n) \\ wf_mformula \\ (Suc j) P' V n R \\\\<^sub>n \\' \\\n list_all2 (\\i. qtable n (Formula.fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (Suc j)] xs\"\n using assms\nproof (induction \\ arbitrary: db P P' V n R \\')\n case (MRel rel)\n then show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp add: ball_Un intro: wf_mformula.intros table_eq_rel eq_rel_eval_trm\n in_eq_rel qtable_empty qtable_unit_table intro!: qtableI)\nnext\n case (MPred e ts)\n then show ?case\n proof (cases \"e \\ dom P\")\n case True\n with MPred(2) have \"e \\ Mapping.keys db\" \"e \\ dom P'\" \"e \\ dom V\"\n \"list_all2 (\\i X. X = the (V e) i) [the (P e)..x. _ = tabulate x 0 n\", OF refl]\n elim!: list.rel_mono_strong bexI[rotated] dest: ex_match\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff\n list.map_comp keys_dom_lookup)\n next\n note MPred(1)\n moreover\n case False\n moreover\n from False MPred(2) have \"e \\ dom P'\" \"e \\ dom V\"\n unfolding wf_envs_def rel_mapping_alt by auto\n moreover\n from False MPred(2) have *: \"e \\ fst ` \\ \\ j \\ e \\ Mapping.keys db\"\n unfolding wf_envs_def by auto\n from False MPred(2) have\n \"e \\ Mapping.keys db \\ Mapping.lookup db e = Some [{ts. (e, ts) \\ \\ \\ j}]\"\n unfolding wf_envs_def keys_dom_lookup by (metis Diff_iff domD option.sel)\n with * have \"(case Mapping.lookup db e of None \\ [{}] | Some xs \\ xs) = [{ts. (e, ts) \\ \\ \\ j}]\"\n by (cases \"e \\ fst ` \\ \\ j\") (auto simp: image_iff keys_dom_lookup split: option.splits)\n ultimately show ?thesis\n by (cases rule: wf_mformula.cases)\n (fastforce intro!: wf_mformula.Pred qtableI bexI[where P=\"\\x. _ = tabulate x 0 n\", OF refl]\n elim!: list.rel_mono_strong bexI[rotated] dest: ex_match\n simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff list.map_comp)\n qed\nnext\n case (MLet p m \\1 \\2)\n from MLet.prems(1) obtain \\1' \\2' where Let: \"\\' = Formula.Let p \\1' \\2'\" and\n 1: \"wf_mformula \\ j P V m UNIV \\1 \\1'\" and\n fv: \"m = Formula.nfv \\1'\" \"{0.. fv \\1'\" and\n 2: \"wf_mformula \\ j (P(p \\ progress \\ P \\1' j))\n (V(p \\ \\i. {v. length v = m \\ Formula.sat \\ V v i \\1'}))\n n R \\2 \\2'\"\n by (cases rule: wf_mformula.cases) auto\n obtain xs \\1_new where e1: \"meval m (\\ \\ j) db \\1 = (xs, \\1_new)\" and\n wf1: \"wf_mformula \\ (Suc j) P' V m UNIV \\1_new \\1'\" and\n res1: \"list_all2 (\\i. qtable m (fv \\1') (mem_restr UNIV) (\\v. Formula.sat \\ V (map the v) i \\1'))\n [progress \\ P \\1' j.. P' \\1' (Suc j)] xs\"\n using MLet(1)[OF 1(1) MLet.prems(2)] by (auto simp: eqTrueI[OF mem_restr_UNIV, abs_def])\n from MLet(2)[OF 2 wf_envs_update[OF MLet.prems(2) fv res1]] wf1 e1 fv\n show ?case unfolding Let\n by (auto simp: fun_upd_def intro!: wf_mformula.Let)\nnext\n case (MAnd A_\\ \\ pos A_\\ \\ buf)\n from MAnd.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: sat_the_restrict simp del: bin_join.simps\n dest!: MAnd.IH split: if_splits prod.splits intro!: wf_mformula.And qtable_bin_join\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MAndAssign \\ conf)\n from MAndAssign.prems obtain \\'' x t \\'' where\n wf_envs: \"wf_envs \\ j P P' V db\" and\n \\'_eq: \"\\' = formula.And \\'' \\''\" and\n wf_\\: \"wf_mformula \\ j P V n R \\ \\''\" and\n \"x < n\" and\n \"x \\ fv \\''\" and\n fv_t_subset: \"fv_trm t \\ fv \\''\" and\n conf: \"(x, t) = conf\" and\n \\''_eqs: \"\\'' = formula.Eq (trm.Var x) t \\ \\'' = formula.Eq t (trm.Var x)\"\n by (cases rule: wf_mformula.cases)\n from wf_\\ wf_envs obtain xs \\\\<^sub>n where\n meval_eq: \"meval n (\\ \\ j) db \\ = (xs, \\\\<^sub>n)\" and\n wf_\\\\<^sub>n: \"wf_mformula \\ (Suc j) P' V n R \\\\<^sub>n \\''\" and\n xs: \"list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\''))\n [progress \\ P \\'' j.. P' \\'' (Suc j)] xs\"\n by (auto dest!: MAndAssign.IH)\n have progress_eqs:\n \"progress \\ P \\' j = progress \\ P \\'' j\"\n \"progress \\ P' \\' (Suc j) = progress \\ P' \\'' (Suc j)\"\n using \\''_eqs wf_envs_progress_le[OF wf_envs] by (auto simp: \\'_eq)\n\n show ?case proof (simp add: meval_eq, intro conjI)\n show \"wf_mformula \\ (Suc j) P' V n R (MAndAssign \\\\<^sub>n conf) \\'\"\n unfolding \\'_eq\n by (rule wf_mformula.AndAssign) fact+\n next\n show \"list_all2 (\\i. qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'))\n [progress \\ P \\' j.. P' \\' (Suc j)] (map ((`) (eval_assignment conf)) xs)\"\n unfolding list.rel_map progress_eqs conf[symmetric] eval_assignment.simps\n using xs\n proof (rule list.rel_mono_strong)\n fix i X\n assume qtable: \"qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\'') X\"\n then show \"qtable n (fv \\') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\')\n ((\\y. y[x := Some (meval_trm t y)]) ` X)\"\n proof (rule qtable_assign)\n show \"x < n\" by fact\n show \"insert x (fv \\'') = fv \\'\"\n using \\''_eqs fv_t_subset by (auto simp: \\'_eq)\n show \"x \\ fv \\''\" by fact\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\') v\" and \"mem_restr R v\"\n then show \"mem_restr R (restrict (fv \\'') v)\" by simp\n\n assume sat: \"Formula.sat \\ V (map the v) i \\'\"\n then have A: \"Formula.sat \\ V (map the (restrict (fv \\'') v)) i \\''\" (is ?A)\n by (simp add: \\'_eq sat_the_restrict)\n have \"map the v ! x = Formula.eval_trm (map the v) t\"\n using sat \\''_eqs by (auto simp: \\'_eq)\n also have \"... = Formula.eval_trm (map the (restrict (fv \\'') v)) t\"\n using fv_t_subset by (auto simp: map_the_restrict intro!: eval_trm_fv_cong)\n finally have \"map the v ! x = meval_trm t (restrict (fv \\'') v)\"\n using meval_trm_eval_trm[of n \"fv \\''\" \"restrict (fv \\'') v\" t]\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (fastforce simp: \\'_eq intro!: wf_tuple_restrict)\n then have B: \"v ! x = Some (meval_trm t (restrict (fv \\'') v))\" (is ?B)\n using \\''_eqs wf_v \\x < n\\ by (auto simp: wf_tuple_def \\'_eq)\n from A B show \"?A \\ ?B\" ..\n next\n fix v\n assume wf_v: \"wf_tuple n (fv \\'') v\" and \"mem_restr R v\"\n and sat: \"Formula.sat \\ V (map the v) i \\''\"\n let ?v = \"v[x := Some (meval_trm t v)]\"\n from sat have A: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\x \\ fv \\''\\ by (simp add: sat_the_update)\n have \"y \\ fv_trm t \\ x \\ y\" for y\n using fv_t_subset \\x \\ fv \\''\\ by auto\n then have B: \"Formula.sat \\ V (map the ?v) i \\''\"\n using \\''_eqs meval_trm_eval_trm[of n \"fv \\''\" v t] \\x < n\\\n fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\\]\n by (auto simp: wf_tuple_def map_update intro!: eval_trm_fv_cong)\n from A B show \"Formula.sat \\ V (map the ?v) i \\'\"\n by (simp add: \\'_eq)\n qed\n qed\n qed\nnext\n case (MAndRel \\ conf)\n from MAndRel.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto simp: progress_constraint progress_le list.rel_map fv_formula_of_constraint\n Un_absorb2 wf_mformula_wf_set[unfolded wf_set_def] split: prod.splits\n dest!: MAndRel.IH[where db=db and P=P and P'=P'] eval_constraint_sat_eq[THEN iffD2]\n intro!: wf_mformula.AndRel\n elim!: list.rel_mono_strong qtable_filter eval_constraint_sat_eq[THEN iffD1])\nnext\n case (MAnds A_pos A_neg l buf)\n note mbufn_take.simps[simp del] mbufn_add.simps[simp del] mmulti_join.simps[simp del]\n\n from MAnds.prems obtain pos neg l' where\n wf_l: \"list_all2 (wf_mformula \\ j P V n R) l (pos @ map remove_neg neg)\" and\n wf_buf: \"wf_mbufn (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P \\ j) (pos @ map remove_neg neg))\n (map (\\\\ i. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\)) (pos @ map remove_neg neg)) buf\" and\n posneg: \"(pos, neg) = partition safe_formula l'\" and\n \"pos \\ []\" and\n safe_neg: \"list_all safe_formula (map remove_neg neg)\" and\n A_eq: \"A_pos = map fv pos\" \"A_neg = map fv neg\" and\n fv_subset: \"\\ (set A_neg) \\ \\ (set A_pos)\" and\n \"\\' = Formula.Ands l'\"\n by (cases rule: wf_mformula.cases) simp\n have progress_eq: \"progress \\ P' (formula.Ands l') (Suc j) =\n Mini (progress \\ P (formula.Ands l') j) (map (\\\\. progress \\ P' \\ (Suc j)) (pos @ map remove_neg neg))\"\n using \\pos \\ []\\ posneg\n by (auto simp: Mini_def image_Un[symmetric] Collect_disj_eq[symmetric] intro!: arg_cong[where f=Min])\n\n have join_ok: \"qtable n (\\ (fv ` set l')) (mem_restr R)\n (\\v. list_all (Formula.sat \\ V (map the v) k) l')\n (mmulti_join n A_pos A_neg L)\"\n if args_ok: \"list_all2 (\\x. qtable n (fv x) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k x))\n (pos @ map remove_neg neg) L\"\n for k L\n proof (rule qtable_mmulti_join)\n let ?ok = \"\\A Qi X. qtable n A (mem_restr R) Qi X \\ wf_set n A\"\n let ?L_pos = \"take (length A_pos) L\"\n let ?L_neg = \"drop (length A_pos) L\"\n have 1: \"length pos \\ length L\"\n using args_ok by (auto dest!: list_all2_lengthD)\n show \"list_all3 ?ok A_pos (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) ?L_pos\"\n using args_ok wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth nth_append\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R]\n dest: order.strict_trans2[OF _ 1])\n from args_ok have prems_neg: \"list_all2 (\\\\. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) k (remove_neg \\))) neg ?L_neg\"\n by (auto simp: A_eq list_all2_append1 list.rel_map)\n show \"list_all3 ?ok A_neg (map (\\\\ v. Formula.sat \\ V (map the v) k (remove_neg \\)) neg) ?L_neg\"\n using prems_neg wf_l unfolding A_eq\n by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length nth_append less_diff_conv\n split: if_splits intro!: wf_mformula_wf_set[of \\ j P V n R _ \"remove_neg _\", simplified])\n show \"\\(fv ` set l') = \\(set A_pos)\"\n using fv_subset posneg unfolding A_eq by auto\n show \"L = take (length A_pos) L @ drop (length A_pos) L\" by simp\n show \"A_pos \\ []\" using \\pos \\ []\\ A_eq by simp\n\n fix x :: \"event_data tuple\"\n assume \"wf_tuple n (\\ (fv ` set l')) x\" and \"mem_restr R x\"\n then show \"list_all (\\A. mem_restr R (restrict A x)) A_pos\"\n and \"list_all (\\A. mem_restr R (restrict A x)) A_neg\"\n by (simp_all add: list.pred_set)\n\n have \"list_all Formula.is_Neg neg\"\n using posneg safe_neg\n by (auto 0 3 simp add: list.pred_map elim!: list.pred_mono_strong\n intro: formula.exhaust[of \\ \"Formula.is_Neg \\\" for \\])\n then have \"list_all (\\\\. Formula.sat \\ V (map the v) i (remove_neg \\) \\\n \\ Formula.sat \\ V (map the v) i \\) neg\" for v i\n by (fastforce simp: Formula.is_Neg_def elim!: list.pred_mono_strong)\n then show \"list_all (Formula.sat \\ V (map the x) k) l' =\n (list_all2 (\\A Qi. Qi (restrict A x)) A_pos\n (map (\\\\ v. Formula.sat \\ V (map the v) k \\) pos) \\\n list_all2 (\\A Qi. \\ Qi (restrict A x)) A_neg\n (map (\\\\ v. Formula.sat \\ V (map the v) k\n (remove_neg \\))\n neg))\"\n using posneg\n by (auto simp add: A_eq list_all2_conv_all_nth list_all_length sat_the_restrict\n elim: nth_filter nth_partition[where P=safe_formula and Q=\"Formula.sat _ _ _ _\"])\n qed fact\n\n from MAnds.prems(2) show ?case\n unfolding \\\\' = Formula.Ands l'\\\n by (auto 0 3 simp add: list.rel_map progress_eq map2_map_map list_all3_map\n list_all3_list_all2_conv list.pred_map\n simp del: set_append map_append progress_simps split: prod.splits\n intro!: wf_mformula.Ands[OF _ _ posneg \\pos \\ []\\ safe_neg A_eq fv_subset]\n list.rel_mono_strong[OF wf_l] wf_mbufn_add[OF wf_buf]\n list.rel_flip[THEN iffD1, OF list.rel_mono_strong, OF wf_l]\n list.rel_refl join_ok[unfolded list.pred_set]\n dest!: MAnds.IH[OF _ _ MAnds.prems(2), rotated]\n elim!: wf_mbufn_take list_all2_appendI\n elim: mbufn_take_induct[OF _ wf_mbufn_add[OF wf_buf]])\nnext\n case (MOr \\ \\ buf)\n from MOr.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto dest!: MOr.IH split: if_splits prod.splits intro!: wf_mformula.Or qtable_union\n elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])\nnext\n case (MNeg \\)\n have *: \"qtable n {} (mem_restr R) (\\v. P v) X \\\n \\ qtable n {} (mem_restr R) (\\v. \\ P v) empty_table \\ x \\ X \\ False\" for P x X\n using nullary_qtable_cases qtable_unit_empty_table by fastforce\n from MNeg.prems show ?case\n by (cases rule: wf_mformula.cases)\n (auto 0 4 intro!: wf_mformula.Neg dest!: MNeg.IH\n simp add: list.rel_map\n dest: nullary_qtable_cases qtable_unit_empty_table intro!: qtable_empty_unit_table\n elim!: list.rel_mono_strong elim: *)\nnext\n case (MExists \\)\n from MExists.prems show ?case\n by (cases rule: wf_mformula.cases)\n (force simp: list.rel_map fvi_Suc sat_fv_cong nth_Cons'\n intro!: wf_mformula.Exists dest!: MExists.IH qtable_project_fv\n elim!: list.rel_mono_strong table_fvi_tl qtable_cong sat_fv_cong[THEN iffD1, rotated -1]\n split: if_splits)+\nnext\n case (MAgg g0 y \\ b f \\)\n from MAgg.prems show ?case\n using wf_mformula_wf_set[OF MAgg.prems(1), unfolded wf_set_def]\n by (cases rule: wf_mformula.cases)\n (auto 0 3 simp add: list.rel_map simp del: sat.simps fvi.simps split: prod.split\n intro!: wf_mformula.Agg qtable_eval_agg dest!: MAgg.IH elim!: list.rel_mono_strong)\nnext\n case (MPrev I \\ first buf nts)\n from MPrev.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Prev \\)\n let ?xs = \"fst (meval n (\\ \\ j) db \\)\"\n let ?\\ = \"snd (meval n (\\ \\ j) db \\)\"\n let ?ls = \"fst (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j]))\"\n let ?rs = \"fst (snd (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j])))\"\n let ?ts = \"snd (snd (mprev_next I (buf @ ?xs) (nts @ [\\ \\ j])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?min = \"min (progress \\ P' \\ (Suc j)) (Suc j - 1)\"\n from Prev MPrev.IH[OF _ MPrev.prems(2), of n R \\] have IH: \"wf_mformula \\ (Suc j) P' V n R ?\\ \\\" and\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (Suc j)] ?xs\" by auto\n with Prev(4,5) MPrev.prems(2) have \"list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then ?P i X else X = empty_table)\n [min (progress \\ P \\ j) (j - 1)..\n list_all2 ?P [?min.. P' \\ (Suc j)] ?rs \\\n list_all2 (\\i t. t = \\ \\ i) [?min.. P \\ j)) j = Suc (min (progress \\ P \\ j) (j-1))\" if \"j > 0\"\n using that by auto\n ultimately show ?thesis using Prev(1,3) MPrev.prems(2) IH\n by (auto simp: map_Suc_upt[symmetric] upt_Suc[of 0] list.rel_map qtable_empty_iff\n simp del: upt_Suc elim!: wf_mformula.Prev list.rel_mono_strong\n split: prod.split if_split_asm)\n qed\nnext\n case (MNext I \\ first nts)\n from MNext.prems show ?case\n proof (cases rule: wf_mformula.cases)\n case (Next \\)\n\n have min[simp]:\n \"min (progress \\ P \\ j - Suc 0) (j - Suc 0) = progress \\ P \\ j - Suc 0\"\n \"min (progress \\ P' \\ (Suc j) - Suc 0) j = progress \\ P' \\ (Suc j) - Suc 0\"\n using wf_envs_progress_le[OF MNext.prems(2), of \\] by auto\n\n let ?xs = \"fst (meval n (\\ \\ j) db \\)\"\n let ?ys = \"case (?xs, first) of (_ # xs, True) \\ xs | _ \\ ?xs\"\n let ?\\ = \"snd (meval n (\\ \\ j) db \\)\"\n let ?ls = \"fst (mprev_next I ?ys (nts @ [\\ \\ j]))\"\n let ?rs = \"fst (snd (mprev_next I ?ys (nts @ [\\ \\ j])))\"\n let ?ts = \"snd (snd (mprev_next I ?ys (nts @ [\\ \\ j])))\"\n let ?P = \"\\i X. qtable n (fv \\) (mem_restr R) (\\v. Formula.sat \\ V (map the v) i \\) X\"\n let ?min = \"min (progress \\ P' \\ (Suc j) - 1) (Suc j - 1)\"\n from Next MNext.IH[OF _ MNext.prems(2), of n R \\] have IH: \"wf_mformula \\ (Suc j) P' V n R ?\\ \\\"\n \"list_all2 ?P [progress \\ P \\ j.. P' \\ (Suc j)] ?xs\" by auto\n with Next have \"list_all2 (\\i X. if mem (\\ \\ (Suc i) - \\ \\ i) I then ?P (Suc i) X else X = empty_table)\n [progress \\ P \\ j - 1..\n list_all2 ?P [Suc ?min.. P' \\ (Suc j)] ?rs \\\n list_all2 (\\i t. t = \\ \\ i) [?min.. P \\ j < progress \\ P' \\ (Suc j)\"\n using that wf_envs_progress_le[OF MNext.prems(2), of \\]\n by (intro mnext) (auto simp: list_all2_Cons2 upt_eq_Cons_conv\n intro!: list_all2_upt_append list_all2_appendI split: list.splits)\n then show ?thesis using wf_envs_progress_le[OF MNext.prems(2), of \\]\n wf_envs_progress_mono[OF MNext.prems(2), of j \"Suc j\" \\, simplified] Next IH\n by (cases \"progress \\ P' \\ (Suc j) > progress \\ P \\ j\")\n (auto 0 3 simp: qtable_empty_iff le_Suc_eq le_diff_conv\n elim!: wf_mformula.Next list.rel_mono_strong list_all2_appendI\n split: prod.split list.splits if_split_asm) (* slow 5 sec*)\n qed\nnext\n case (MSince args \\ \\ buf nts aux)\n note sat.simps[simp del]\n from MSince.prems obtain \\'' \\''' \\'' I where Since_eq: \"\\' = Formula.Since \\''' I \\''\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_since_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Since \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n by (cases rule: wf_mformula.cases) (auto)\n have \\''': \"Formula.fv \\''' = Formula.fv \\''\" \"progress \\ P \\''' j = progress \\ P \\'' j\"\n \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all split: if_splits)\n from MSince.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j).. \\ j])\"\n using nts unfolding wf_ts_def\n by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)\n have update: \"wf_since_aux \\ V R args \\'' \\'' (snd (zs, aux')) (progress \\ P' (Formula.Since \\''' I \\'') (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv \\''' \\ Formula.fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Since \\''' I \\'')))\n [progress \\ P (Formula.Since \\''' I \\'') j.. P' (Formula.Since \\''' I \\'') (Suc j)] (fst (zs, aux'))\"\n if eval_\\: \"fst (meval n (\\ \\ j) db \\) = xs\"\n and eval_\\: \"fst (meval n (\\ \\ j) db \\) = ys\"\n and eq: \"mbuf2t_take (\\r1 r2 t (zs, aux).\n case update_since args r1 r2 t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbuf2_add xs ys buf) (nts @ [\\ \\ j]) = ((zs, aux'), buf', nts')\"\n for xs ys zs aux' buf' nts'\n unfolding progress_simps \\'''\n proof (rule mbuf2t_take_add_induct'[where j=j and j'=\"Suc j\" and z'=\"(zs, aux')\",\n OF eq wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc],\n goal_cases xs ys _ base step)\n case xs\n then show ?case\n using MSince.IH(1)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case ys\n then show ?case\n using MSince.IH(2)[OF \\ MSince.prems(2)] eval_\\ by auto\n next\n case base\n then show ?case\n using aux by (simp add: \\''')\n next\n case (step k X Y z)\n then show ?case\n using fvi_subset pos\n by (auto 0 3 simp: args_ivl args_n args_L args_R Un_absorb1\n elim!: update_since(1) list_all2_appendI dest!: update_since(2)\n split: prod.split if_splits)\n qed simp\n with MSince.IH(1)[OF \\ MSince.prems(2)] MSince.IH(2)[OF \\ MSince.prems(2)] show ?case\n by (auto 0 3 simp: Since_eq split: prod.split\n intro: wf_mformula.Since[OF _ _ pos pos_eq args_ivl args_n args_L args_R fvi_subset]\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc])\nnext\n case (MUntil args \\ \\ buf nts aux)\n note sat.simps[simp del] progress_simps[simp del]\n from MUntil.prems obtain \\'' \\''' \\'' I where Until_eq: \"\\' = Formula.Until \\''' I \\''\"\n and pos: \"if args_pos args then \\''' = \\'' else \\''' = Formula.Neg \\''\"\n and pos_eq: \"safe_formula \\''' = args_pos args\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and \\: \"wf_mformula \\ j P V n R \\ \\''\"\n and fvi_subset: \"Formula.fv \\'' \\ Formula.fv \\''\"\n and buf: \"wf_mbuf2' \\ P V j n R \\'' \\'' buf\"\n and nts: \"wf_ts \\ P j \\'' \\'' nts\"\n and aux: \"wf_until_aux \\ V R args \\'' \\'' aux (progress \\ P (Formula.Until \\''' I \\'') j)\"\n and args_ivl: \"args_ivl args = I\"\n and args_n: \"args_n args = n\"\n and args_L: \"args_L args = Formula.fv \\''\"\n and args_R: \"args_R args = Formula.fv \\''\"\n and length_aux: \"progress \\ P (Formula.Until \\''' I \\'') j + length_muaux args aux =\n min (progress \\ P \\'' j) (progress \\ P \\'' j)\"\n by (cases rule: wf_mformula.cases) (auto)\n define pos where args_pos: \"pos = args_pos args\"\n have \\''': \"progress \\ P \\''' j = progress \\ P \\'' j\" \"progress \\ P' \\''' j = progress \\ P' \\'' j\" for j\n using pos by (simp_all add: progress.simps split: if_splits)\n from MUntil.prems(2) have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [min (progress \\ P \\'' j) (progress \\ P \\'' j).. \\ j])\"\n using nts unfolding wf_ts_def\n by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)\n {\n fix xs ys zs aux' aux'' buf' nts'\n assume eval_\\: \"fst (meval n (\\ \\ j) db \\) = xs\"\n and eval_\\: \"fst (meval n (\\ \\ j) db \\) = ys\"\n and eq1: \"mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [\\ \\ j]) =\n (aux', buf', nts')\"\n and eq2: \"eval_muaux args (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) aux' = (zs, aux'')\"\n define ne where \"ne \\ progress \\ P (Formula.Until \\''' I \\'') j\"\n have update1: \"wf_until_aux \\ V R args \\'' \\'' aux' (progress \\ P (Formula.Until \\''' I \\'') j) \\\n ne + length_muaux args aux' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j))\"\n using MUntil.IH(1)[OF \\ MUntil.prems(2)] eval_\\ MUntil.IH(2)[OF \\ MUntil.prems(2)]\n eval_\\ nts_snoc nts_snoc length_aux aux fvi_subset\n unfolding \\'''\n by (elim mbuf2t_take_add_induct'[where j'=\"Suc j\", OF eq1 wf_envs_P_simps[OF MUntil.prems(2)] buf])\n (auto simp: args_n args_L args_R ne_def wf_update_until)\n then obtain cur auxlist' where valid_aux': \"valid_muaux args cur aux' auxlist'\" and\n cur: \"cur = (if ne + length auxlist' = 0 then 0 else \\ \\ (ne + length auxlist' - 1))\" and\n wf_auxlist': \"wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' (progress \\ P (Formula.Until \\''' I \\'') j)\"\n unfolding wf_until_aux_def ne_def args_ivl args_n args_pos by auto\n have length_aux': \"length_muaux args aux' = length auxlist'\"\n using valid_length_muaux[OF valid_aux'] .\n have nts': \"wf_ts \\ P' (Suc j) \\'' \\'' nts'\"\n using MUntil.IH(1)[OF \\ MUntil.prems(2)] eval_\\ MUntil.IH(2)[OF \\ MUntil.prems(2)]\n MUntil.prems(2) eval_\\ nts_snoc\n unfolding wf_ts_def\n by (intro mbuf2t_take_eqD(2)[OF eq1]) (auto intro: wf_mbuf2_add buf[unfolded wf_mbuf2'_def])\n define zs'' where \"zs'' = fst (eval_until I (case nts' of [] \\ \\ \\ j | nt # x \\ nt) auxlist')\"\n define auxlist'' where \"auxlist'' = snd (eval_until I (case nts' of [] \\ \\ \\ j | nt # x \\ nt) auxlist')\"\n have current_w_le: \"cur \\ (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof (cases nts')\n case Nil\n have p_le: \"min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) - 1 \\ j\"\n using wf_envs_progress_le[OF MUntil.prems(2)]\n by (auto simp: min_def le_diff_conv)\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux']\n using Nil by auto\n next\n case (Cons nt x)\n have progress_\\''': \"progress \\ P' \\'' (Suc j) = progress \\ P' \\''' (Suc j)\"\n using pos by (auto simp add: progress.simps split: if_splits)\n have \"nt = \\ \\ (min (progress \\ P' \\'' (Suc j)) (progress \\ P' \\'' (Suc j)))\"\n using nts'[unfolded wf_ts_def Cons]\n unfolding list_all2_Cons2 upt_eq_Cons_conv by auto\n then show ?thesis\n unfolding cur conjunct2[OF update1, unfolded length_aux'] Cons progress_\\'''\n by (auto split: if_splits list.splits intro!: \\_mono)\n qed\n have valid_aux'': \"valid_muaux args cur aux'' auxlist''\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n by (auto simp add: args_ivl zs''_def auxlist''_def)\n have length_aux'': \"length_muaux args aux'' = length auxlist''\"\n using valid_length_muaux[OF valid_aux''] .\n have eq2': \"eval_until I (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) auxlist' = (zs, auxlist'')\"\n using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']\n by (auto simp add: args_ivl zs''_def auxlist''_def)\n have length_aux'_aux'': \"length_muaux args aux' = length zs + length_muaux args aux''\"\n using eval_until_length[OF eq2'] unfolding length_aux' length_aux'' .\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist' i \\\n i + length auxlist' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n wf_until_auxlist \\ V n R pos \\'' I \\'' auxlist'' (progress \\ P' (Formula.Until \\''' I \\'') (Suc j)) \\\n i + length zs = progress \\ P' (Formula.Until \\''' I \\'') (Suc j) \\\n i + length zs + length auxlist'' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv \\'') (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.Until (if pos then \\'' else Formula.Neg \\'') I \\'')))\n [i.. V n R pos \\'' I \\'' aux' (Suc i)\"\n by (rule wf_until_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv \\'') (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem (\\ \\ j - \\ \\ i) I \\ Formula.sat \\ V (map the v) j \\'' \\\n (\\k\\{i.. V (map the v) k \\'' else \\ Formula.sat \\ V (map the v) k \\''))) a2\"\n unfolding \\a = (t, a1, a2)\\ by (rule wf_until_aux_Cons3)\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' =\n min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j))\"\n by simp\n have \"i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j)\"\n if \"enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt) \\ enat t + right I\"\n using that nts' unfolding wf_ts_def progress.simps\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv \\'''\n intro!: cInf_lower \\_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.Until \\''' I \\'') (Suc j)\"\n if \"enat t + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof -\n from that obtain m where m: \"right I = enat m\" by (cases \"right I\") auto\n have \\_min: \"\\ \\ (min j k) = min (\\ \\ j) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"(Suc j) \\ progress \\ P' \\ (Suc j) \\ progress \\ P' \\ (Suc j) = (Suc j)\" for \\\n using wf_envs_progress_le[OF MUntil.prems(2), of \\] by auto\n have min_Suc[simp]: \"min j (Suc j) = j\" by auto\n let ?X = \"{i. \\k. k < Suc j \\ k \\min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\ enat (\\ \\ k) \\ enat (\\ \\ i) + right I}\"\n let ?min = \"min j (min (progress \\ P' \\'' (Suc j)) (progress \\ P' \\'' (Suc j)))\"\n have \"\\ \\ ?min \\ \\ \\ j\"\n by (rule \\_mono) auto\n from m have \"?X \\ {}\"\n by (auto dest!: \\_mono[of _ \"progress \\ P' \\'' (Suc j)\" \\]\n simp: not_le not_less \\''' intro!: exI[of _ \"progress \\ P' \\'' (Suc j)\"])\n from m show ?thesis\n using that nts' unfolding wf_ts_def progress.simps\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto simp: 1 \\''' not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"] less_le_trans[of \"\\ \\ i + m\" \"\\ \\ _\" \"\\ \\ _ + m\"] less_\\D)\n qed\n moreover have *: \"k < progress \\ P' \\ (Suc j)\" if\n \"enat (\\ \\ i) + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n \"enat (\\ \\ k - \\ \\ i) \\ right I\" \"\\ = \\'' \\ \\ = \\''\" for k \\\n proof -\n from that(1,2) obtain m where \"right I = enat m\"\n \"\\ \\ i + m < (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\" \"\\ \\ k - \\ \\ i \\ m\"\n by (cases \"right I\") auto\n with that(3) nts' progress_le[of \\ \\'' \"Suc j\"] progress_le[of \\ \\'' \"Suc j\"]\n show ?thesis\n unfolding wf_ts_def le_diff_conv\n by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute\n simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of \"\\ \\ k\"] less_\\D)\n qed\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, a1, a2)\\\n by (auto simp: \\''' 1 sat.simps upt_conv_Cons dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n qed\n thm this\n note wf_aux'' = this[OF wf_envs_progress_mono[OF MUntil.prems(2) le_SucI[OF order_refl]]\n wf_auxlist' conjunct2[OF update1, unfolded ne_def length_aux']]\n have \"progress \\ P (formula.Until \\''' I \\'') j + length auxlist' =\n progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist''\"\n using wf_aux'' valid_aux'' length_aux'_aux''\n by (auto simp add: ne_def length_aux' length_aux'')\n then have \"cur =\n (if progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist'' = 0 then 0\n else \\ \\ (progress \\ P' (formula.Until \\''' I \\'') (Suc j) + length auxlist'' - 1))\"\n unfolding cur ne_def by auto\n then have \"wf_until_aux \\ V R args \\'' \\'' aux'' (progress \\ P' (formula.Until \\''' I \\'') (Suc j)) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs = progress \\ P' (formula.Until \\''' I \\'') (Suc j) \\\n progress \\ P (formula.Until \\''' I \\'') j + length zs + length_muaux args aux'' = min (progress \\ P' \\''' (Suc j)) (progress \\ P' \\'' (Suc j)) \\\n list_all2 (\\i. qtable n (fv \\'') (mem_restr R) (\\v. Formula.sat \\ V (map the v) i (formula.Until (if pos then \\'' else formula.Neg \\'') I \\'')))\n [progress \\ P (formula.Until \\''' I \\'') j.. P (formula.Until \\''' I \\'') j + length zs] zs\"\n using wf_aux'' valid_aux'' fvi_subset\n unfolding wf_until_aux_def length_aux'' args_ivl args_n args_pos by (auto simp only: length_aux'')\n }\n note update = this\n from MUntil.IH(1)[OF \\ MUntil.prems(2)] MUntil.IH(2)[OF \\ MUntil.prems(2)] pos pos_eq fvi_subset show ?case\n by (auto 0 4 simp: args_ivl args_n args_pos Until_eq \\''' progress.simps(6) split: prod.split if_splits\n dest!: update[OF refl refl, rotated]\n intro!: wf_mformula.Until[OF _ _ _ _ args_ivl args_n args_L args_R fvi_subset]\n elim!: list.rel_mono_strong qtable_cong\n elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc]\n mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc])\nnext\n case (MMatchP I mr mrs \\s buf nts aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del]\n from MMatchP.prems obtain r \\s where eq: \"\\' = Formula.MatchP I r\"\n and safe: \"safe_regex Past Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (RPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchP_aux \\ V n R I r aux (progress \\ P (Formula.MatchP I r) j)\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i) [progress_regex \\ P r j.. \\ j])\"\n using nts unfolding wf_ts_regex_def\n by (auto simp add: wf_envs_progress_regex_le[OF MMatchP.prems(2)] intro: list_all2_appendI)\n have update: \"wf_matchP_aux \\ V n R I r (snd (zs, aux')) (progress \\ P' (Formula.MatchP I r) (Suc j)) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchP I r)))\n [progress \\ P (Formula.MatchP I r) j.. P' (Formula.MatchP I r) (Suc j)] (fst (zs, aux'))\"\n if eval: \"map (fst o meval n (\\ \\ j) db) \\s = xss\"\n and eq: \"mbufnt_take (\\rels t (zs, aux).\n case update_matchP n I mr mrs rels t aux of (z, x) \\ (zs @ [z], x))\n ([], aux) (mbufn_add xss buf) (nts @ [\\ \\ j]) = ((zs, aux'), buf', nts')\"\n for xss zs aux' buf' nts'\n unfolding progress_simps\n proof (rule mbufnt_take_add_induct'[where j'=\"Suc j\" and z'=\"(zs, aux')\", OF eq wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc],\n goal_cases xss _ base step)\n case xss\n then show ?case\n using eval \\s\n by (auto simp: list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map\n list.rel_flip[symmetric, of _ \\s \\s] dest!: MMatchP.IH(1)[OF _ _ MMatchP.prems(2)]\n elim!: list.rel_mono_strong split: prod.splits)\n next\n case base\n then show ?case\n using aux by auto\n next\n case (step k Xs z)\n then show ?case\n by (auto simp: Un_absorb1 mrs safe mr elim!: update_matchP(1) list_all2_appendI\n dest!: update_matchP(2) split: prod.split)\n qed simp\n then show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchP.IH[OF _ _ MMatchP.prems(2)] split: prod.splits)\nnext\n case (MMatchF I mr mrs \\s buf nts aux)\n note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del] progress_simps[simp del]\n from MMatchF.prems obtain r \\s where eq: \"\\' = Formula.MatchF I r\"\n and safe: \"safe_regex Futu Strict r\"\n and mr: \"to_mregex r = (mr, \\s)\"\n and mrs: \"mrs = sorted_list_of_set (LPDs mr)\"\n and \\s: \"list_all2 (wf_mformula \\ j P V n R) \\s \\s\"\n and buf: \"wf_mbufn' \\ P V j n R r buf\"\n and nts: \"wf_ts_regex \\ P j r nts\"\n and aux: \"wf_matchF_aux \\ V n R I r aux (progress \\ P (Formula.MatchF I r) j) 0\"\n and length_aux: \"progress \\ P (Formula.MatchF I r) j + length aux = progress_regex \\ P r j\"\n by (cases rule: wf_mformula.cases) (auto)\n have nts_snoc: \"list_all2 (\\i t. t = \\ \\ i)\n [progress_regex \\ P r j.. \\ j])\"\n using nts unfolding wf_ts_regex_def\n by (auto simp add: wf_envs_progress_regex_le[OF MMatchF.prems(2)] intro: list_all2_appendI)\n {\n fix xss zs aux' aux'' buf' nts'\n assume eval: \"map (fst o meval n (\\ \\ j) db) \\s = xss\"\n and eq1: \"mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [\\ \\ j]) =\n (aux', buf', nts')\"\n and eq2: \"eval_matchF I mr (case nts' of [] \\ \\ \\ j | nt # _ \\ nt) aux' = (zs, aux'')\"\n have update1: \"wf_matchF_aux \\ V n R I r aux' (progress \\ P (Formula.MatchF I r) j) 0 \\\n progress \\ P (Formula.MatchF I r) j + length aux' = progress_regex \\ P' r (Suc j)\"\n using eval nts_snoc nts_snoc length_aux aux \\s\n by (elim mbufnt_take_add_induct'[where j'=\"Suc j\", OF eq1 wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf])\n (auto simp: length_update_matchF\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)]\n elim: wf_update_matchF[OF _ safe mr mrs] elim!: list.rel_mono_strong)\n from MMatchF.prems(2) have nts': \"wf_ts_regex \\ P' (Suc j) r nts'\"\n using eval eval nts_snoc \\s\n unfolding wf_ts_regex_def\n by (intro mbufnt_take_eqD(2)[OF eq1 wf_mbufn_add[where js'=\"map (\\\\. progress \\ P' \\ (Suc j)) \\s\",\n OF buf[unfolded wf_mbufn'_def mr prod.case]]])\n (auto simp: to_mregex_progress[OF safe mr] Mini_def\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \\s \\s]\n list_all2_Cons1 elim!: list.rel_mono_strong intro!: list.rel_refl_strong\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)])\n have \"i \\ progress \\ P' (Formula.MatchF I r) (Suc j) \\\n wf_matchF_aux \\ V n R I r aux' i 0 \\\n i + length aux' = progress_regex \\ P' r (Suc j) \\\n wf_matchF_aux \\ V n R I r aux'' (progress \\ P' (Formula.MatchF I r) (Suc j)) 0 \\\n i + length zs = progress \\ P' (Formula.MatchF I r) (Suc j) \\\n i + length zs + length aux'' = progress_regex \\ P' r (Suc j) \\\n list_all2 (\\i. qtable n (Formula.fv_regex r) (mem_restr R)\n (\\v. Formula.sat \\ V (map the v) i (Formula.MatchF I r)))\n [i.. V n R I r aux' (Suc i) 0\"\n by (rule wf_matchF_aux_Cons)\n from Cons.prems(2) have 1: \"t = \\ \\ i\"\n unfolding \\a = (t, rels, rel)\\ by (rule wf_matchF_aux_Cons1)\n from Cons.prems(2) have 3: \"qtable n (Formula.fv_regex r) (mem_restr R) (\\v.\n (\\j\\i. j < Suc (i + length aux') \\ mem (\\ \\ j - \\ \\ i) I \\ Regex.match (Formula.sat \\ V (map the v)) r i j)) rel\"\n unfolding \\a = (t, rels, rel)\\ using wf_matchF_aux_Cons3 by force\n from Cons.prems(3) have Suc_i_aux': \"Suc i + length aux' = progress_regex \\ P' r (Suc j)\"\n by simp\n have \"i \\ progress \\ P' (Formula.MatchF I r) (Suc j)\"\n if \"enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt) \\ enat t + right I\"\n using that nts' unfolding wf_ts_regex_def progress_simps\n by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv\n intro!: cInf_lower \\_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)\n moreover\n have \"Suc i \\ progress \\ P' (Formula.MatchF I r) (Suc j)\"\n if \"enat t + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n proof -\n from that obtain m where m: \"right I = enat m\" by (cases \"right I\") auto\n have \\_min: \"\\ \\ (min j k) = min (\\ \\ j) (\\ \\ k)\" for k\n by (simp add: min_of_mono monoI)\n have le_progress_iff[simp]: \"Suc j \\ progress \\ P' \\ (Suc j) \\ progress \\ P' \\ (Suc j) = (Suc j)\" for \\\n using wf_envs_progress_le[OF MMatchF.prems(2), of \\] by auto\n have min_Suc[simp]: \"min j (Suc j) = j\" by auto\n let ?X = \"{i. \\k. k < Suc j \\ k \\ progress_regex \\ P' r (Suc j) \\ enat (\\ \\ k) \\ enat (\\ \\ i) + right I}\"\n let ?min = \"min j (progress_regex \\ P' r (Suc j))\"\n have \"\\ \\ ?min \\ \\ \\ j\"\n by (rule \\_mono) auto\n from m have \"?X \\ {}\"\n by (auto dest!: less_\\D add_lessD1 simp: not_le not_less)\n from m show ?thesis\n using that nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]\n unfolding wf_ts_regex_def progress_simps\n by (intro cInf_greatest[OF \\?X \\ {}\\])\n (auto simp: 1 not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq\n simp del: upt_Suc split: list.splits if_splits\n dest!: spec[of _ \"?min\"] less_le_trans[of \"\\ \\ i + m\" \"\\ \\ _\" \"\\ \\ _ + m\"] less_\\D)\n qed\n moreover have *: \"k < progress_regex \\ P' r (Suc j)\" if\n \"enat (\\ \\ i) + right I < enat (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\"\n \"enat (\\ \\ k - \\ \\ i) \\ right I\" for k\n proof -\n from that(1,2) obtain m where \"right I = enat m\"\n \"\\ \\ i + m < (case nts' of [] \\ \\ \\ j | nt # x \\ nt)\" \"\\ \\ k - \\ \\ i \\ m\"\n by (cases \"right I\") auto\n with nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]\n show ?thesis\n unfolding wf_ts_regex_def le_diff_conv\n by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute\n simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of \"\\ \\ k\"] less_\\D)\n qed\n ultimately show ?case using Cons.prems Suc_i_aux'[simplified]\n unfolding \\a = (t, rels, rel)\\\n by (auto simp: 1 sat.simps upt_conv_Cons dest!: Cons.IH[OF _ aux' Suc_i_aux']\n simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])\n\n qed\n note this[OF progress_mono_gen[OF le_SucI, OF order.refl] conjunct1[OF update1] conjunct2[OF update1]]\n }\n note update = this[OF refl, rotated]\n with MMatchF.prems(2) show ?case using \\s\n by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \\s \\s]\n list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros\n elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]\n dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)] update split: prod.splits)\nqed\n\n\nsubsubsection \\Monitor step\\\n\nlemma (in maux) wf_mstate_mstep: \"wf_mstate \\ \\ R st \\ last_ts \\ \\ snd tdb \\\n wf_mstate \\ (psnoc \\ tdb) R (snd (mstep (map_prod mk_db id tdb) st))\"\n unfolding wf_mstate_def mstep_def Let_def\n by (fastforce simp add: progress_mono le_imp_diff_is_add split: prod.splits\n elim!: prefix_of_psnocE dest: meval[OF _ wf_envs_mk_db] list_all2_lengthD)\n\ndefinition \"flatten_verdicts Vs = (\\ (set (map (\\(i, X). (\\v. (i, v)) ` X) Vs)))\"\n\nlemma flatten_verdicts_append[simp]:\n \"flatten_verdicts (Vs @ Us) = flatten_verdicts Vs \\ flatten_verdicts Us\"\n by (induct Vs) (auto simp: flatten_verdicts_def)\n\nlemma (in maux) mstep_output_iff:\n assumes \"wf_mstate \\ \\ R st\" \"last_ts \\ \\ snd tdb\" \"prefix_of (psnoc \\ tdb) \\\" \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n progress \\ Map.empty \\ (plen \\) \\ i \\ i < progress \\ Map.empty \\ (Suc (plen \\)) \\\n wf_tuple (Formula.nfv \\) (Formula.fv \\) v \\ Formula.sat \\ Map.empty (map the v) i \\\"\nproof -\n from prefix_of_psnocE[OF assms(3,2)] have \"prefix_of \\ \\\"\n \"\\ \\ (plen \\) = fst tdb\" \"\\ \\ (plen \\) = snd tdb\" by auto\n moreover from assms(1) \\prefix_of \\ \\\\ have \"mstate_n st = Formula.nfv \\\"\n \"mstate_i st = progress \\ Map.empty \\ (plen \\)\" \"wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\"\n unfolding wf_mstate_def by blast+\n moreover from meval[OF \\wf_mformula \\ (plen \\) Map.empty Map.empty (mstate_n st) R (mstate_m st) \\\\ wf_envs_mk_db] obtain Vs st' where\n \"meval (mstate_n st) (\\ \\ (plen \\)) (mk_db (\\ \\ (plen \\))) (mstate_m st) = (Vs, st')\"\n \"wf_mformula \\ (Suc (plen \\)) Map.empty Map.empty (mstate_n st) R st' \\\"\n \"list_all2 (\\i. qtable (mstate_n st) (fv \\) (mem_restr R) (\\v. Formula.sat \\ Map.empty (map the v) i \\))\n [progress \\ Map.empty \\ (plen \\).. Map.empty \\ (Suc (plen \\))] Vs\" by blast\n moreover from this assms(4) have \"qtable (mstate_n st) (fv \\) (mem_restr R)\n (\\v. Formula.sat \\ Map.empty (map the v) i \\) (Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"\n if \"progress \\ Map.empty \\ (plen \\) \\ i\" \"i < progress \\ Map.empty \\ (Suc (plen \\))\"\n using that by (auto simp: list_all2_conv_all_nth\n dest!: spec[of _ \"(i - progress \\ Map.empty \\ (plen \\))\"])\n ultimately show ?thesis\n using assms(4) unfolding mstep_def Let_def flatten_verdicts_def\n by (auto simp: in_set_enumerate_eq list_all2_conv_all_nth progress_mono le_imp_diff_is_add\n elim!: in_qtableE in_qtableI intro!: bexI[of _ \"(i, Vs ! (i - progress \\ Map.empty \\ (plen \\)))\"])\nqed\n\n\nsubsubsection \\Monitor function\\\n\nlocale verimon = verimon_spec + maux\n\nlemma (in verimon) mstep_mverdicts:\n assumes wf: \"wf_mstate \\ \\ R st\"\n and le[simp]: \"last_ts \\ \\ snd tdb\"\n and restrict: \"mem_restr R v\"\n shows \"(i, v) \\ flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \\\n (i, v) \\ M (psnoc \\ tdb) - M \\\"\nproof -\n obtain \\ where p2: \"prefix_of (psnoc \\ tdb) \\\"\n using ex_prefix_of by blast\n with le have p1: \"prefix_of \\ \\\" by (blast elim!: prefix_of_psnocE)\n show ?thesis\n unfolding M_def\n by (auto 0 3 simp: p2 progress_prefix_conv[OF _ p1] sat_prefix_conv[OF _ p1] not_less\n pprogress_eq[OF p1] pprogress_eq[OF p2]\n dest: mstep_output_iff[OF wf le p2 restrict, THEN iffD1] spec[of _ \\]\n mstep_output_iff[OF wf le _ restrict, THEN iffD1] progress_sat_cong[OF p1]\n intro: mstep_output_iff[OF wf le p2 restrict, THEN iffD2] p1)\nqed\n\ncontext maux\nbegin\n\nprimrec msteps0 where\n \"msteps0 [] st = ([], st)\"\n| \"msteps0 (tdb # \\) st =\n (let (V', st') = mstep (map_prod mk_db id tdb) st; (V'', st'') = msteps0 \\ st' in (V' @ V'', st''))\"\n\nprimrec msteps0_stateless where\n \"msteps0_stateless [] st = []\"\n| \"msteps0_stateless (tdb # \\) st = (let (V', st') = mstep (map_prod mk_db id tdb) st in V' @ msteps0_stateless \\ st')\"\n\nlemma msteps0_msteps0_stateless: \"fst (msteps0 w st) = msteps0_stateless w st\"\n by (induct w arbitrary: st) (auto simp: split_beta)\n\nlift_definition msteps :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list \\ ('msaux, 'muaux) mstate\"\n is msteps0 .\n\nlift_definition msteps_stateless :: \"Formula.prefix \\ ('msaux, 'muaux) mstate \\ (nat \\ event_data table) list\"\n is msteps0_stateless .\n\nlemma msteps_msteps_stateless: \"fst (msteps w st) = msteps_stateless w st\"\n by transfer (rule msteps0_msteps0_stateless)\n\nlemma msteps0_snoc: \"msteps0 (\\ @ [tdb]) st =\n (let (V', st') = msteps0 \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by (induct \\ arbitrary: st) (auto split: prod.splits)\n\nlemma msteps_psnoc: \"last_ts \\ \\ snd tdb \\ msteps (psnoc \\ tdb) st =\n (let (V', st') = msteps \\ st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))\"\n by transfer' (auto simp: msteps0_snoc split: list.splits prod.splits if_splits)\n\ndefinition monitor where\n \"monitor \\ \\ = msteps_stateless \\ (minit_safe \\)\"\n\nend\n\nlemma Suc_length_conv_snoc: \"(Suc n = length xs) = (\\y ys. xs = ys @ [y] \\ length ys = n)\"\n by (cases xs rule: rev_cases) auto\n\nlemma (in verimon) wf_mstate_msteps: \"wf_mstate \\ \\ R st \\ mem_restr R v \\ \\ \\ \\' \\\n X = msteps (pdrop (plen \\) \\') st \\ wf_mstate \\ \\' R (snd X) \\\n ((i, v) \\ flatten_verdicts (fst X)) = ((i, v) \\ M \\' - M \\)\"\nproof (induct \"plen \\' - plen \\\" arbitrary: X st \\ \\')\n case 0\n from 0(1,4,5) have \"\\ = \\'\" \"X = ([], st)\"\n by (transfer; auto)+\n with 0(2) show ?case unfolding flatten_verdicts_def by simp\nnext\n case (Suc x)\n from Suc(2,5) obtain \\'' tdb where \"x = plen \\'' - plen \\\" \"\\ \\ \\''\"\n \"\\' = psnoc \\'' tdb\" \"pdrop (plen \\) (psnoc \\'' tdb) = psnoc (pdrop (plen \\) \\'') tdb\"\n \"last_ts (pdrop (plen \\) \\'') \\ snd tdb\" \"last_ts \\'' \\ snd tdb\"\n \"\\'' \\ psnoc \\'' tdb\"\n proof (atomize_elim, transfer, elim exE, goal_cases prefix)\n case (prefix _ _ \\' _ \\_tdb)\n then show ?case\n proof (cases \\_tdb rule: rev_cases)\n case (snoc \\ tdb)\n with prefix show ?thesis\n by (intro bexI[of _ \"\\' @ \\\"] exI[of _ tdb])\n (force simp: sorted_append append_eq_Cons_conv split: list.splits if_splits)+\n qed simp\n qed\n with Suc(1)[OF this(1) Suc.prems(1,2) this(2) refl] Suc.prems show ?case\n unfolding msteps_msteps_stateless[symmetric]\n by (auto simp: msteps_psnoc split_beta mstep_mverdicts\n dest: mono_monitor[THEN set_mp, rotated] intro!: wf_mstate_mstep)\nqed\n\nlemma (in verimon) wf_mstate_msteps_stateless:\n assumes \"wf_mstate \\ \\ R st\" \"mem_restr R v\" \"\\ \\ \\'\"\n shows \"(i, v) \\ flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) \\ (i, v) \\ M \\' - M \\\"\n using wf_mstate_msteps[OF assms refl] unfolding msteps_msteps_stateless by simp\n\nlemma (in verimon) wf_mstate_msteps_stateless_UNIV: \"wf_mstate \\ \\ UNIV st \\ \\ \\ \\' \\\n flatten_verdicts (msteps_stateless (pdrop (plen \\) \\') st) = M \\' - M \\\"\n by (auto dest: wf_mstate_msteps_stateless[OF _ mem_restr_UNIV])\n\nlemma (in verimon) mverdicts_Nil: \"M pnil = {}\"\n by (simp add: M_def pprogress_eq)\n\ncontext maux\nbegin\n\nlemma minit_safe_minit: \"mmonitorable \\ \\ minit_safe \\ = minit \\\"\n unfolding minit_safe_def monitorable_formula_code by simp\n\nlemma wf_mstate_minit_safe: \"mmonitorable \\ \\ wf_mstate \\ pnil R (minit_safe \\)\"\n using wf_mstate_minit minit_safe_minit mmonitorable_def by metis\n\nend\n\nlemma (in verimon) monitor_mverdicts: \"flatten_verdicts (monitor \\ \\) = M \\\"\n unfolding monitor_def using monitorable\n by (subst wf_mstate_msteps_stateless_UNIV[OF wf_mstate_minit_safe, simplified])\n (auto simp: mmonitorable_def mverdicts_Nil)\n\nsubsection \\Collected correctness results\\\n\ncontext verimon\nbegin\n\ntext \\We summarize the main results proved above.\n\\begin{enumerate}\n\\item The term @{term M} describes semantically the monitor's expected behaviour:\n\\begin{itemize}\n\\item @{thm[source] mono_monitor}: @{thm mono_monitor[no_vars]}\n\\item @{thm[source] sound_monitor}: @{thm sound_monitor[no_vars]}\n\\item @{thm[source] complete_monitor}: @{thm complete_monitor[no_vars]}\n\\item @{thm[source] sliceable_M}: @{thm sliceable_M[no_vars]}\n\\end{itemize}\n\\item The executable monitor's online interface @{term minit_safe} and @{term mstep}\n preserves the invariant @{term wf_mstate} and produces the the verdicts according\n to @{term M}:\n\\begin{itemize}\n\\item @{thm[source] wf_mstate_minit_safe}: @{thm wf_mstate_minit_safe[no_vars]}\n\\item @{thm[source] wf_mstate_mstep}: @{thm wf_mstate_mstep[no_vars]}\n\\item @{thm[source] mstep_mverdicts}: @{thm mstep_mverdicts[no_vars]}\n\\end{itemize}\n\\item The executable monitor's offline interface @{term monitor} implements @{term M}:\n\\begin{itemize}\n\\item @{thm[source] monitor_mverdicts}: @{thm monitor_mverdicts[no_vars]}\n\\end{itemize}\n\\end{enumerate}\n\\\n\nend\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/MFODL_Monitor_Optimized/Monitor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105587468141, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.25366752458772285}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: SmallStepCon.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Small-Step Semantics and Infinite Computations*} \n\ntheory SmallStepCon imports \"EmbSimpl.SmallStep\" \"SemanticCon\" \n \"TerminationCon\"\n (* \"Sep_Algebra.Sep_Heap_Instance\" \n \"Actions.ActionsSemantics\" *)\nbegin\n\ntext {* The redex of a statement is the substatement, which is actually altered\nby the next step in the small-step semantics.\n*}\nprimrec redex:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com\"\nwhere\n\"redex Skip = Skip\" |\n\"redex (Basic f e) = (Basic f e)\" |\n\"redex (Spec r e) = (Spec r e)\" |\n\"redex (Seq c\\<^sub>1 c\\<^sub>2) = redex c\\<^sub>1\" |\n\"redex (Cond b c\\<^sub>1 c\\<^sub>2) = (Cond b c\\<^sub>1 c\\<^sub>2)\" |\n\"redex (While b c) = (While b c)\" |\n\"redex (Call p) = (Call p)\" |\n\"redex (DynCom d) = (DynCom d)\" |\n\"redex (Guard f b c) = (Guard f b c)\" |\n\"redex (Throw) = Throw\" |\n\"redex (Catch c\\<^sub>1 c\\<^sub>2) = redex c\\<^sub>1\" |\n\"redex (Await b c e) = (Await b c e)\"\n\nsubsection {*Small-Step Computation: @{text \"\\\\\\<^sub>c(c, s) \\ (c', s')\"}*}\n\n(* locale localsvars = \n fixes toSeq :: \"(('g \\ 'l \\ 'l list),'f) xstate \\ ('s,'f) xstate\" \n fixes SegGl :: \"'s \\ 'g\"\n fixes SegLo ::\"'s \\ 'l\"\n\nassumes SeqFault:\"toSeq (Fault f) = Fault f\" and\n SeqStuck:\"toSeq (Stuck) = Stuck\" and\n SeqNormal:\"toSeq (Normal (g,l,ls)) = Normal s \\ SegGl s = g \\ SegLo s = l\" and\n SeqEq:\"toSeq (Normal (g,l,ls)) = toSeq (Normal (g,l,ls'))\" and\n SeqEqAbr:\"toSeq (Abrupt (g,l,ls)) = toSeq (Abrupt (g,l,ls'))\" and\n SeqAbrupt:\"toSeq (Abrupt (g,l,ls)) = Abrupt s \\ SegGl s = g \\ SegLo s = l\" \nbegin\nprimrec fromSeq ::\"('s, 'f) xstate \\ 'l list \\ (('g \\ 'l \\ 'l list),'f) xstate\"\n where \"fromSeq (Normal s) locs = Normal (SegGl s, SegLo s, locs)\"\n |\"fromSeq (Abrupt s) locs = Abrupt (SegGl s, SegLo s, locs)\"\n |\"fromSeq (Fault f) locs = Fault f\"\n |\"fromSeq Stuck locs = Stuck\"\n\nlemma ParFault:\"fromSeq (Fault f) ls = Fault f\" and\n ParStuck:\"fromSeq (Stuck) ls = Stuck\" and\n ParNormal:\"fromSeq (Normal s) ls = Normal (SegGl s, SegLo s, ls)\" and\n ParAbrupt:\"fromSeq (Abrupt s) ls = Abrupt (SegGl s, SegLo s, ls)\"\n by auto\n\nlemma abnormal_from_to:\"\\s'. s\\Normal s' \\ s\\Abrupt s' \\ fromSeq (toSeq s) x = s\" \n by (cases s, auto simp add: SeqFault ParFault SeqStuck ParStuck)\n \nlemma abnormal_to_from:\"\\s'. s\\Normal s' \\ s\\Abrupt s' \\ toSeq (fromSeq s x) = s\" \n by (cases s, auto simp add: SeqFault ParFault SeqStuck ParStuck) \n\nlemma normal_to_from:\"fromSeq (toSeq (Normal (g,l,ls))) x = Normal (g,l,x)\"\n using SeqNormal ParNormal by (metis (full_types))\n\nlemma normal_from_to:\"toSeq (fromSeq (Normal s) x) = Normal s\"\n using SeqNormal ParNormal by auto\n\nlemma abrupt_to_from:\"fromSeq (toSeq (Abrupt (g,l,ls))) x = Abrupt (g,l,x)\"\n using SeqAbrupt ParAbrupt by (metis (full_types))\n\nlemma abrutp_from_to:\"toSeq (fromSeq (Abrupt s) x) = Abrupt s\"\n using SeqAbrupt ParAbrupt by auto\n\nlemma to_seq_distinct:\n \"toSeq (Normal s1) \\ toSeq (Abrupt s2) \\\n toSeq (Normal s1) \\ toSeq (Stuck) \\\n toSeq (Normal s1) \\ toSeq (Fault f) \\\n toSeq (Abrupt s2) \\ toSeq (Stuck) \\\n toSeq (Abrupt s2) \\ toSeq (Fault f) \\\n toSeq (Stuck) \\ toSeq (Fault f)\"\n using SeqNormal SeqStuck SeqAbrupt SeqFault \n by (smt prod_cases3 xstate.distinct)+\n\nlemma from_seq_distinct:\n \"fromSeq (Normal s1) \\ fromSeq (Abrupt s2) \\\n fromSeq (Normal s1) \\ fromSeq (Stuck) \\\n fromSeq (Normal s1) \\ fromSeq (Fault f) \\\n fromSeq (Abrupt s2) \\ fromSeq (Stuck) \\\n fromSeq (Abrupt s2) \\ fromSeq (Fault f) \\\n fromSeq (Stuck) \\ fromSeq (Fault f)\" \n using ParFault ParStuck ParAbrupt ParNormal \n by (smt prod_cases3 xstate.distinct)+\n\nlemma toSeq_eq:\"(toSeq (Normal (g,l,ls)) = toSeq (Normal (g',l',ls))) = (g=g' \\ l=l')\"\n by (metis (full_types) SeqNormal)\n\nlemma toSeq_diff:\"(toSeq (Normal (g,l,ls)) \\ toSeq (Normal (g',l',ls))) = (g\\g' \\ l\\l')\"\n using toSeq_eq by auto\n \nend *)\n (* and\n a4:\"\\i. i \\ id ` (localSet locs) \\ setLocal i locs loc = locs\" and\n a5:\"card (localSet locs) \\ card (UNIV::'id set)\" and\n a6:\"\\i. i \\ id ` (localSet locs) \\ getLocals locs i = None\" and\n a7:\"\\id' id. id \\ id' \\ getLocals (setLocal id locs loc) id' = getLocals locs id'\" and\n a8:\"\\id1 id2. id1\\id2 \\ id1 \\ id ` (localSet locs) \\ id2 \\ id ` (localSet locs) \\ \n getLocals locs id1 \\ getLocals locs id2\" and\n a9:\"\\e1 e2. e1 \\ (localSet locs) \\ e2 \\ (localSet locs) \\ e1\\e2 \\ id e1 \\ id e2\" \nbegin \n\n\nend\nrecord g = x1::nat\nrecord l = ids:: nat l1::nat\n\nrecord gl = x1::nat ids::nat l1::nat\ntype_synonym ('l) ls = \"'l list\"\n\ndefinition id1 ::\"l \\ nat\"\n where \"id1 ml \\ l.ids ml\"\n\ndefinition getLocal :: \"gl \\ l\"\n where \"getLocal gls \\ \\l.ids = gl.ids gls, l.l1 = gl.l1 gls\\\"\n\ndefinition getGlobal :: \"gl \\ g\"\n where \"getGlobal gls \\ \\g.x1 = gl.x1 gls\\\"\n\ndefinition toSeq :: \"(g\\l) \\ gl\"\n where \"toSeq gls \\ \\gl.x1 = (g.x1 (fst gls)), gl.ids = l.ids (snd gls), gl.l1 = l.l1 (snd gls)\\\"\n\ndefinition localSet ::\"l ls \\ l set\"\n where \"localSet mlocs \\ set mlocs\"\n\ndefinition getLocals ::\"l ls \\ nat \\ l option\"\n where \"getLocals mlocs idn \\ find (\\l. id1 l = idn) mlocs\"\n\ndefinition setLocal ::\"nat \\ l ls \\ l \\ l ls\"\n where \"setLocal idn mlocs l \\ if find (\\l. id1 l = idn) mlocs = None then mlocs\n else \n let p = (SOME n. id1 (nth mlocs n) = idn) in\n mlocs[p:= l]\"\n\ninterpretation localsvars getLocal getGlobal toSeq \n apply (unfold_locales)\n apply (unfold getLocal_def toSeq_def getGlobal_def)\n by auto \n*) \n\ntype_synonym ('s,'p,'f,'e) config = \"('s,'p,'f,'e)com \\ ('s,'f) xstate\"\n\ninductive \n \"stepc\"::\"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\/ _)\" [81,81,81] 100) \n for \\::\"('s,'p,'f,'e) body\"\nwhere\n\n Basicc: \"\\\\\\<^sub>c(Basic f e,Normal s) \\ (Skip,Normal (f s))\"\n\n| Specc: \"(s,t) \\ r \\ \\\\\\<^sub>c(Spec r e,Normal s) \\ (Skip,Normal t)\"\n| SpecStuckc: \"\\t. (s,t) \\ r \\ \\\\\\<^sub>c(Spec r e,Normal s) \\ (Skip,Stuck)\"\n\n| Guardc: \"s\\g \\ \\\\\\<^sub>c(Guard f g c,Normal s) \\ (c,Normal s)\"\n \n| GuardFaultc: \"s\\g \\ \\\\\\<^sub>c(Guard f g c,Normal s) \\ (Skip,Fault f)\"\n\n\n| Seqc: \"\\\\\\<^sub>c(c\\<^sub>1,s) \\ (c\\<^sub>1',s')\n \\ \n \\\\\\<^sub>c(Seq c\\<^sub>1 c\\<^sub>2,s) \\ (Seq c\\<^sub>1' c\\<^sub>2, s')\"\n| SeqSkipc: \"\\\\\\<^sub>c(Seq Skip c\\<^sub>2,s) \\ (c\\<^sub>2, s)\"\n| SeqThrowc: \"\\\\\\<^sub>c(Seq Throw c\\<^sub>2,Normal s) \\ (Throw, Normal s)\"\n\n| CondTruec: \"s\\b \\ \\\\\\<^sub>c(Cond b c\\<^sub>1 c\\<^sub>2,Normal s) \\ (c\\<^sub>1,Normal s)\"\n| CondFalsec: \"s\\b \\ \\\\\\<^sub>c(Cond b c\\<^sub>1 c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n\n| WhileTruec: \"\\s\\b\\ \n \\ \n \\\\\\<^sub>c(While b c,Normal s) \\ (Seq c (While b c),Normal s)\"\n\n| WhileFalsec: \"\\s\\b\\ \n \\ \n \\\\\\<^sub>c(While b c,Normal s) \\ (Skip,Normal s)\"\n\n\n| Awaitc: \"\\s\\b; \\1=\\\\<^sub>\\\\<^sub>a ; \\1\\\\ca1,Normal s\\ \\ t; \n \\(\\t'. t = Abrupt t')\\ \\ \n \\\\\\<^sub>c(Await b ca1 e,Normal s) \\ (Skip,t)\"\n\n| AwaitAbruptc: \"\\s\\b; \\1=\\\\<^sub>\\\\<^sub>a ; \\1\\\\ca1,Normal s\\ \\ t; \n t = Abrupt t'\\ \\ \n \\\\\\<^sub>c(Await b ca1 e,Normal s) \\ (Throw,Normal t')\"\n\n| Callc: \"\\\\ p = Some bdy ; bdy\\Call p\\ \\\n \\\\\\<^sub>c(Call p,Normal s) \\ (bdy,Normal s)\"\n\n| CallUndefinedc: \"\\ p=None \\\n \\\\\\<^sub>c(Call p,Normal s) \\ (Skip,Stuck)\"\n\n| DynComc: \"\\\\\\<^sub>c(DynCom c,Normal s) \\ (c s,Normal s)\"\n\n| Catchc: \"\\\\\\\\<^sub>c(c\\<^sub>1,s) \\ (c\\<^sub>1',s')\\\n \\\n \\\\\\<^sub>c(Catch c\\<^sub>1 c\\<^sub>2,s) \\ (Catch c\\<^sub>1' c\\<^sub>2,s')\"\n\n| CatchThrowc: \"\\\\\\<^sub>c(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n| CatchSkipc: \"\\\\\\<^sub>c(Catch Skip c\\<^sub>2,s) \\ (Skip,s)\"\n\n| FaultPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Fault f) \\ (Skip,Fault f)\"\n| StuckPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Stuck) \\ (Skip,Stuck)\"\n| AbruptPropc: \"\\c\\Skip; redex c = c\\ \\ \\\\\\<^sub>c(c,Abrupt f) \\ (Skip,Abrupt f)\"\n \nlemmas stepc_induct = stepc.induct [of _ \"(c,s)\" \"(c',s')\", split_format (complete), case_names\nBasicc Specc SpecStuckc Guardc GuardFaultc Seqc SeqSkipc SeqThrowc CondTruec CondFalsec\nWhileTruec WhileFalsec Awaitc AwaitAbruptc Callc CallUndefinedc DynComc Catchc CatchThrowc CatchSkipc\nFaultPropc StuckPropc AbruptPropc, induct set]\n\ninductive_cases stepc_call_skip_normal:\n \"\\\\\\<^sub>c(Call p,Normal s) \\ (Skip,s')\"\n\ninductive_cases stepc_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Skip,s) \\ u\"\n \"\\\\\\<^sub>c(Guard f g c,s) \\ u\"\n \"\\\\\\<^sub>c(Basic f e,s) \\ u\"\n \"\\\\\\<^sub>c(Spec r e,s) \\ u\"\n \"\\\\\\<^sub>c(Seq c1 c2,s) \\ u\"\n \"\\\\\\<^sub>c(Cond b c1 c2,s) \\ u\"\n \"\\\\\\<^sub>c(While b c,s) \\ u\"\n \"\\\\\\<^sub>c(Await b c2 e,s) \\ u\"\n \"\\\\\\<^sub>c(Call p,s) \\ u\"\n \"\\\\\\<^sub>c(DynCom c,s) \\ u\"\n \"\\\\\\<^sub>c(Throw,s) \\ u\"\n \"\\\\\\<^sub>c(Catch c1 c2,s) \\ u\"\n\ninductive_cases stepc_not_normal_elim_cases:\n \"\\\\\\<^sub>c(Call p,Abrupt s) \\ (p',s')\"\n \"\\\\\\<^sub>c(Call p, Fault f) \\ (p',s')\"\n \"\\\\\\<^sub>c(Call p, Stuck) \\ (p',s')\"\n \n\nlemma Guardc_not_c:\"Guard f g c \\ c\"\nproof (induct c)\nqed auto\n\nlemma Catch_not_c1:\"Catch c1 c2 \\ c1\"\nproof (induct c1)\nqed auto\n\nlemma Catch_not_c:\"Catch c1 c2 \\ c2\"\nproof (induct c2)\nqed auto\n\nlemma seq_not_eq1: \"Seq c1 c2\\c1\"\n by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\c2\"\n by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\c1\"\n by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\c2\"\n by (induct c2) auto\n\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\nCatch_not_c1 Catch_not_c Catch_not_c1 [THEN not_sym] Catch_not_c[THEN not_sym] \nGuardc_not_c Guardc_not_c[THEN not_sym]\n\ninductive_cases stepc_elim_cases_Seq_Seq:\n\"\\\\\\<^sub>c(Seq c1 c2,s) \\ (Seq c1' c2,s')\" \n\ninductive_cases stepc_elim_cases_Seq_Seq1:\n\"\\\\\\<^sub>c(Seq c1 c2,Fault f) \\ (q,s')\" \n\ninductive_cases stepc_elim_cases_Catch_Catch:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Catch c1' c2,s')\" \n\ninductive_cases stepc_elim_cases_Catch_Catch1:\n\"\\\\\\<^sub>c(Seq c1 c2,Fault f) \\ (q,s')\" \n\ninductive_cases stepc_elim_cases_Seq_skip:\n\"\\\\\\<^sub>c(Seq Skip c2,s) \\ u\" \n\"\\\\\\<^sub>c(Seq (Guard f g c1) c2,s) \\ u\"\n\n\ninductive_cases stepc_elim_cases_Catch_skip:\n\"\\\\\\<^sub>c(Catch Skip c2,s) \\ u\"\n\ninductive_cases stepc_elim_cases_Await_skip:\n\"\\\\\\<^sub>c (Await b c e, Normal s) \\ (Skip,t)\"\n\ninductive_cases stepc_elim_cases_Await_throw:\n\"\\\\\\<^sub>c (Await b c e, Normal s) \\ (Throw,t)\"\n\ninductive_cases stepc_elim_cases_Catch_throw:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (Throw, Normal s1)\" \n\ninductive_cases stepc_elim_cases_Catch_skip_c2:\n\"\\\\\\<^sub>c(Catch c1 c2,s) \\ (c2,s)\"\n\ninductive_cases stepc_Normal_elim_cases [cases set]:\n \"\\\\\\<^sub>c(Skip,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Guard f g c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Basic f e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Spec r e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Seq c1 c2,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Cond b c1 c2,Normal s) \\ u\"\n \"\\\\\\<^sub>c(While b c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Await b c e,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Call p,Normal s) \\ u\"\n \"\\\\\\<^sub>c(DynCom c,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Throw,Normal s) \\ u\"\n \"\\\\\\<^sub>c(Catch c1 c2,Normal s) \\ u\"\n\n\ntext \\ The final configuration is either of the form @{text \"(Skip,_)\"} for normal\ntermination, or @{term \"(Throw,Normal s)\"} in case the program was started in \na @{term \"Normal\"} state and terminated abruptly. The @{const \"Abrupt\"} state is not used to\nmodel abrupt termination, in contrast to the big-step semantics. Only if the\nprogram starts in an @{const \"Abrupt\"} states it ends in the same @{term \"Abrupt\"}\nstate.\\\n\ndefinition final:: \"('s,'p,'f,'e) config \\ bool\" where\n\"final cfg \\ (fst cfg=Skip \\ ((fst cfg=Throw) \\ (\\s. snd cfg=Normal s)))\"\n\ndefinition final_valid::\"('s,'p,'f,'e) config \\ bool\" where\n\"final_valid cfg = ((fst cfg=Skip \\ fst cfg=Throw) \\ (\\s. snd cfg=Normal s))\"\n\nabbreviation \n \"stepc_rtrancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>*/ _)\" [81,81,81] 100)\n where \n \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ ((CONST stepc \\))\\<^sup>*\\<^sup>* cf0 cf1\" \n (* \"\\\\\\<^sub>c cf0 \\\\<^sup>* cf1 \\ (CONST ((stepc \\) \\ (step_e \\)))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\nabbreviation \n \"stepc_trancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f,'e) config,('s,'p,'f,'e) config] \\ bool\"\n (\"_\\\\<^sub>c (_ \\\\<^sup>+/ _)\" [81,81,81] 100)\n where\n \"\\\\\\<^sub>c cf0 \\\\<^sup>+ cf1 \\ (CONST stepc \\)\\<^sup>+\\<^sup>+ cf0 cf1\"\n\nlemma \n assumes step_a: \"\\\\\\<^sub>c(Await b c e, Normal s) \\ (t,u)\"\n shows step_await_step_c:\"(\\\\<^sub>\\\\<^sub>a)\\(c, Normal s) \\\\<^sup>* (sequential t,u)\" \nusing step_a\nproof cases\n fix t1\n assume\n \"(t, u) = (Skip, t1)\" \"s \\ b\" \"(\\\\<^sub>\\\\<^sub>a)\\ \\c,Normal s\\ \\ t1\" \"\\t'. t1 \\ Abrupt t'\"\n thus ?thesis \n by (cases u) \n (auto intro: exec_impl_steps_Fault exec_impl_steps_Normal exec_impl_steps_Stuck)\nnext\n fix t1\n assume \"(t, u) = (Throw, Normal t1)\" \"s \\ b\" \"(\\\\<^sub>\\\\<^sub>a)\\ \\c,Normal s\\ \\ Abrupt t1\"\n thus ?thesis by (simp add: exec_impl_steps_Normal_Abrupt)\nqed\n\nlemma \n assumes (* exec: \"\\\\\\c,Normal s\\ \\ t\" and\n b: \"s \\ b\" and *)\n step_a: \"\\\\\\<^sub>c(Await b c e, Normal s) \\ u\"\n shows step_await_final1:\"final u\"\nusing step_a \nproof cases\n case (1 t) thus \"final u\" by (simp add: final_def)\nnext\n case (2 t)\n thus \"final u\" by (simp add: exec_impl_steps_Normal_Abrupt final_def)\nqed\n\nlemma step_Abrupt_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Abrupt x \\ s=Abrupt x\"\nusing step \n by induct auto\n\nlemma step_not_abrupt_end:\n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\" and \n not_abr:\"\\s'. s\\Abrupt s'\" and \n abr:\"\\s. s' = Abrupt s\"\n shows \"P\"\nusing step not_abr abr\nby induct auto\n\nlemma step_Stuck_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Stuck \\ \n s=Stuck \\ \n (\\r x e. redex c\\<^sub>1 = Spec r e \\ s=Normal x \\ (\\t. (x,t)\\r)) \\ \n (\\p x. redex c\\<^sub>1= Call p \\ s=Normal x \\ \\ p = None) \\\n (\\b c x e. redex c\\<^sub>1 = Await b c e \\ s=Normal x \\ x \\ b \\ (\\\\<^sub>\\\\<^sub>a)\\\\c,s\\\\s')\"\nusing step\nby induct auto\n\nlemma step_Fault_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Fault f \\ \n s=Fault f \\ \n (\\g c x. redex c\\<^sub>1 = Guard f g c \\ s=Normal x \\ x \\ g) \\\n (\\b c1 x e. redex c\\<^sub>1 = Await b c1 e \\ s=Normal x \\ x \\ b \\ (\\\\<^sub>\\\\<^sub>a)\\\\c1,s\\\\s')\"\nusing step \nby induct auto\n\nlemma step_not_Fault_f_end:\n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'\\ Fault ` f \\ s \\ Fault ` f\"\nusing step \n by induct auto\n\n(* ************************************************************************ *)\nsubsection {* Structural Properties of Small Step Computations *}\n(* ************************************************************************ *)\nlemma redex_not_Seq: \"redex c = Seq c1 c2 \\ P\"\n apply (induct c)\n apply auto\n done\nlemma redex_not_Catch: \"redex c = Catch c1 c2 \\ P\"\n apply (induct c)\n apply auto\n done\n\n\n\n\nlemma no_step_final':\n assumes step: \"\\\\\\<^sub>c cfg \\ cfg'\"\n shows \"final cfg \\ P\"\nusing step\n by (cases cfg, cases cfg') (auto intro: no_step_final)\n\n\nlemma step_Abrupt:\n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\x. s=Abrupt x \\ s'=Abrupt x\"\nusing step\nby (induct) auto\n\nlemma step_Fault: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Fault f \\ s'=Fault f\"\nusing step\nby (induct) auto\n\nlemma step_Stuck: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Stuck \\ s'=Stuck\"\nusing step\nby (induct) auto\n\nlemma step_not_normal_not_normal:\n assumes step:\"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\s1. s\\Normal s1 \\ \\s1. s' \\ Normal s1\"\nusing step step_Abrupt step_Stuck step_Fault\nby (induct) auto\n\nlemma step_not_normal_s_eq_t:\n assumes step:\"\\\\\\<^sub>c (c, s) \\ (c', t)\"\n shows \"\\s1. s\\Normal s1 \\ s=t\"\nusing step step_Abrupt step_Stuck step_Fault\nby (induct) auto\n\nlemma SeqSteps: \n assumes steps: \"\\\\\\<^sub>c cfg\\<^sub>1\\\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s);cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Seq c\\<^sub>1 c\\<^sub>2,s) \\\\<^sup>* (Seq c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans]) \n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'') \n have step: \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\" using Trans.hyps(1) by blast\n have steps: \"\\\\\\<^sub>c cfg'' \\\\<^sup>* cfg\\<^sub>2\" by fact\n have cfg\\<^sub>1: \"cfg\\<^sub>1 = (c\\<^sub>1, s)\" and cfg\\<^sub>2: \"cfg\\<^sub>2 = (c\\<^sub>1', s')\" by fact+\n obtain c\\<^sub>1'' s'' where cfg'': \"cfg''=(c\\<^sub>1'',s'')\"\n by (cases cfg'') auto\n from step cfg\\<^sub>1 cfg'' \n have \"\\\\\\<^sub>c (c\\<^sub>1,s) \\ (c\\<^sub>1'',s'')\"\n by simp \n hence \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2,s) \\ (Seq c\\<^sub>1'' c\\<^sub>2,s'')\" by (simp add: Seqc) \n also from Trans.hyps (3) [OF cfg'' cfg\\<^sub>2]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1'' c\\<^sub>2, s'') \\\\<^sup>* (Seq c\\<^sub>1' c\\<^sub>2, s')\" .\n finally show ?case .\nqed\n\nlemma CatchSteps: \n assumes steps: \"\\\\\\<^sub>ccfg\\<^sub>1\\\\<^sup>* cfg\\<^sub>2\"\n shows \"\\ c\\<^sub>1 s c\\<^sub>1' s'. \\cfg\\<^sub>1 = (c\\<^sub>1,s); cfg\\<^sub>2=(c\\<^sub>1',s')\\\n \\ \\\\\\<^sub>c(Catch c\\<^sub>1 c\\<^sub>2,s) \\\\<^sup>* (Catch c\\<^sub>1' c\\<^sub>2, s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct [case_names Refl Trans])\n case Refl\n thus ?case\n by simp\nnext\n case (Trans cfg\\<^sub>1 cfg'')\n have step: \"\\\\\\<^sub>c cfg\\<^sub>1 \\ cfg''\" by fact\n have steps: \"\\\\\\<^sub>c cfg'' \\\\<^sup>* cfg\\<^sub>2\" by fact\n have cfg\\<^sub>1: \"cfg\\<^sub>1 = (c\\<^sub>1, s)\" and cfg\\<^sub>2: \"cfg\\<^sub>2 = (c\\<^sub>1', s')\" by fact+\n obtain c\\<^sub>1'' s'' where cfg'': \"cfg''=(c\\<^sub>1'',s'')\"\n by (cases cfg'') auto\n from step cfg\\<^sub>1 cfg'' \n have s: \"\\\\\\<^sub>c (c\\<^sub>1,s) \\ (c\\<^sub>1'',s'')\"\n by simp\n hence \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2,s) \\ (Catch c\\<^sub>1'' c\\<^sub>2,s'')\"\n by (rule stepc.Catchc)\n also from Trans.hyps (3) [OF cfg'' cfg\\<^sub>2]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1'' c\\<^sub>2, s'') \\\\<^sup>* (Catch c\\<^sub>1' c\\<^sub>2, s')\" .\n finally show ?case . \nqed\n\nlemma steps_Fault: \"\\\\\\<^sub>c (c, Fault f) \\\\<^sup>* (Skip, Fault f)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Fault f) \\\\<^sup>* (Seq Skip c\\<^sub>2, Fault f)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Fault f) \\ (c\\<^sub>2, Fault f)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Fault f) \\\\<^sup>* (Skip, Fault f)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Fault f) \\\\<^sup>* (Catch Skip c\\<^sub>2, Fault f)\".\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Fault f) \\ (Skip, Fault f)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\n\nlemma steps_Stuck: \"\\\\\\<^sub>c (c, Stuck) \\\\<^sup>* (Skip, Stuck)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Stuck) \\\\<^sup>* (Seq Skip c\\<^sub>2, Stuck)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Stuck) \\ (c\\<^sub>2, Stuck)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Stuck) \\\\<^sup>* (Skip, Stuck)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Stuck) \\\\<^sup>* (Catch Skip c\\<^sub>2, Stuck)\" .\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Stuck) \\ (Skip, Stuck)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\nlemma steps_Abrupt: \"\\\\\\<^sub>c (c, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\"\nproof (induct c)\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n have steps_c\\<^sub>2: \"\\\\\\<^sub>c (c\\<^sub>2, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n from SeqSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2, Abrupt s) \\\\<^sup>* (Seq Skip c\\<^sub>2, Abrupt s)\".\n also\n have \"\\\\\\<^sub>c (Seq Skip c\\<^sub>2, Abrupt s) \\ (c\\<^sub>2, Abrupt s)\" by (rule SeqSkipc)\n also note steps_c\\<^sub>2\n finally show ?case by simp\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have steps_c\\<^sub>1: \"\\\\\\<^sub>c (c\\<^sub>1, Abrupt s) \\\\<^sup>* (Skip, Abrupt s)\" by fact\n from CatchSteps [OF steps_c\\<^sub>1 refl refl]\n have \"\\\\\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2, Abrupt s) \\\\<^sup>* (Catch Skip c\\<^sub>2, Abrupt s)\".\n also\n have \"\\\\\\<^sub>c (Catch Skip c\\<^sub>2, Abrupt s) \\ (Skip, Abrupt s)\" by (rule CatchSkipc) \n finally show ?case by simp\nqed (fastforce intro: stepc.intros)+\n\nlemma step_Fault_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\f. s=Fault f \\ s'=Fault f\"\nusing step\nby (induct) auto\n\nlemma step_Abrupt_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"\\x. s=Abrupt x \\ s'=Abrupt x\"\nusing step\nby (induct) auto\n\nlemma step_Stuck_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\"\n shows \"s=Stuck \\ s'=Stuck\"\nusing step\nby (induct) auto\n\nlemma steps_Fault_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Fault f \\ s'=Fault f\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c'' s'')\n thus ?case by (simp add: step_Fault_prop) \nqed\n\nlemma steps_Abrupt_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Abrupt t \\ s'=Abrupt t\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c'' s'')\n thus ?case\n by (auto intro: step_Abrupt_prop)\nqed\n\nlemma steps_Stuck_prop: \n assumes step: \"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\"\n shows \"s=Stuck \\ s'=Stuck\"\nusing step\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp \nnext\n case (Trans c s c'' s'')\n thus ?case\n by (auto intro: step_Stuck_prop)\nqed\n\nlemma step_seq_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\" and\n c_val: \"c=Seq Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val\nproof (cases s)\n case Normal \n thus \"\\sa. s=Normal sa\" by auto\nnext\n case Abrupt\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto \nnext \n case Stuck\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto\nnext\n case Fault\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(5)[of \\ Throw Q s \"(Throw,s')\"] by auto\nqed\n\n\nlemma step_catch_throw_normal:\nassumes step: \"\\\\\\<^sub>c (c, s) \\ (c', s')\" and\n c_val: \"c=Catch Throw Q \\ c'=Throw\"\nshows \"\\sa. s=Normal sa\"\nusing step c_val\nproof (cases s)\n case Normal \n thus \"\\sa. s=Normal sa\" by auto\nnext\n case Abrupt\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto \nnext \n case Stuck\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto\nnext\n case Fault\n thus \"\\sa. s=Normal sa\" using step c_val stepc_elim_cases(12)[of \\ Throw Q s \"(Throw,s')\"] by auto\nqed\n\nlemma step_normal_to_normal[rule_format]:\nassumes step:\"\\\\\\<^sub>c (c, s) \\\\<^sup>* (c', s')\" and\n sn: \"s = Normal sa\" and\n finalc':\"(\\\\\\<^sub>c (c', s') \\\\<^sup>*(c1, s1) \\ (\\sb. s1 = Normal sb))\"\nshows \" (\\sc. s'=Normal sc)\"\nusing step sn finalc' \n proof (induct arbitrary: sa rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl show ?case by (simp add: Refl.prems) \n next \n case (Trans c s c'' s'') thm converse_rtranclpE2 \n thus ?case\n proof (cases s'') \n case (Abrupt a1) thus ?thesis using finalc' by (metis steps_Abrupt_prop Trans.hyps(2)) \n next\n case Stuck thus ?thesis using finalc' by (metis steps_Stuck_prop Trans.hyps(2)) \n next\n case Fault thus ?thesis using finalc' by (metis steps_Fault_prop Trans.hyps(2)) \n next \n case Normal thus ?thesis using Trans.hyps(3) finalc' by blast \n qed \nqed\n\nlemma step_spec_skip_normal_normal:\n assumes a0:\"\\\\\\<^sub>c (c,s) \\ (c',s')\" and\n a1:\"c=Spec r e\" and\n a2: \"s=Normal s1\" and\n a3: \"c'=Skip\" and\n a4: \"(\\t. (s1,t) \\ r)\"\n shows \"\\s1'. s'=Normal s1'\"\nproof (cases s') \n case (Normal u) thus ?thesis by auto\nnext\n case Stuck \n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast\nnext\n case (Fault f) \n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast \nnext\n have \"\\f r b p e. \\ f\\\\<^sub>c (LanguageCon.com.Spec r e, Normal b) \\ p \\ \n (\\ba. p = (Skip::('b, 'a, 'c,'d) com, Normal ba) \\ (b, ba) \\ r) \\ \n p = (Skip, Stuck) \\ (\\ba. (b, ba) \\ r)\"\n by (meson stepc_Normal_elim_cases(4))\n thus ?thesis using a0 a1 a2 a4 by blast\nqed\n\n\ntext{* if not Normal not environmental *}\n\n(* \n\nNOTE\nCall always change the program now \n\nlemma no_advance_call_inf:\nassumes a0: \"redex p1 = Call f\" and\n a1: \"(\\ f) = Some (Call f)\" \nshows \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nusing a0 a1\nproof (induct p1)\n case (Catch) thus ?case by (simp add: Catchc)\nnext\n case (Seq) thus ?case by (simp add: Seqc)\nnext\n case (Call) thus ?case\n by (simp add: Callc) \nqed(auto) *)\n\nlemma no_advance_seq:\nassumes a0: \"P = Seq p1 p2\" and\n a1: \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nshows \"\\\\\\<^sub>c (P,Normal s) \\ (P, Normal s)\"\nby (simp add: Seqc a0 a1)\n\nlemma no_advance_catch:\nassumes a0: \"P = Catch p1 p2\" and\n a1: \"\\\\\\<^sub>c (p1,Normal s) \\ (p1, Normal s)\"\nshows \"\\\\\\<^sub>c (P,Normal s) \\ (P, Normal s)\"\nby (simp add: Catchc a0 a1)\n\nlemma call_not_normal_skip_always:\n assumes a0:\"\\\\\\<^sub>c(Call p,s) \\ (p1,s1)\" and\n a1:\"\\sn. s \\ Normal sn\" and\n a2:\"p1\\Skip\"\n shows \"P\" \nproof(cases s)\n case Normal thus ?thesis using a1 by fastforce\nnext\n case Stuck \n then have a0:\"\\\\\\<^sub>c(Call p,Stuck) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(3)[OF a0] by fastforce\nnext\n case (Fault f) \n then have a0:\"\\\\\\<^sub>c(Call p,Fault f) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(2)[OF a0] by fastforce\nnext\n case (Abrupt a)\n then have a0:\"\\\\\\<^sub>c(Call p,Abrupt a) \\ (p1,s1)\" using a0 by auto\n show ?thesis using a1 a2 stepc_not_normal_elim_cases(1)[OF a0] by fastforce\nqed\n\nlemma call_f_step_not_s_eq_t_false:\n assumes \n a0:\"\\\\\\<^sub>c(P,s) \\ (Q,t)\" and\n a1:\"(redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ ~(s=t)) \\\n (redex P = Call fn \\ \\ fn = Some bdy \\ s=Normal s' \\ s=t \\ P=Q \\ \\ fn \\ Some (Call fn))\"\n shows \"False\"\nusing a0 a1\nproof (induct rule:stepc_induct)\nqed(fastforce+,auto)\n\nlemma step_change_p_or_eq_Ns: \n assumes step: \"\\\\\\<^sub>c (P,Normal s) \\ (Q,s')\"\n shows \"\\(P=Q)\"\nusing step\nproof (induct P arbitrary: Q s s')\nqed(fastforce elim: stepc_Normal_elim_cases)+\n\n \nlemma step_change_p_or_eq_s: \n assumes step: \"\\\\\\<^sub>c (P,s) \\ (Q,s')\"\n shows \"\\(P=Q)\"\nusing step\nproof (induct P arbitrary: Q s s')\nqed (fastforce elim: stepc_elim_cases)+\n\nsubsection \\Lemmas on normalization\\\n\n(* lemma step_sequence_flatten:\n assumes exec: \"\\\\\\<^sub>c(P,s) \\ (Q,t)\" \n shows \"\\\\\\<^sub>c(sequence Seq (flatten P),s) \\ (sequence Seq (flatten Q),t)\"\nusing exec\nproof (induct rule: stepc_induct)\n case (Guardc s g f c) thus ?case using stepc.Guardc\n case (Seqc c1 s c2 s' c2')\n then have \" \\\\\\<^sub>c (Seq (LanguageCon.sequence LanguageCon.com.Seq (LanguageCon.flatten c1)) c2', s) \\\n (Seq (LanguageCon.sequence LanguageCon.com.Seq (LanguageCon.flatten c2)) c2', s') \" \n using stepc.Seqc by fastforce \n thus ?case sorry\nqed(auto intro:stepc.intros)+\n\nlemma normalice_step:\n assumes exec:\"\\\\\\<^sub>c(P,s) \\ (Q,t)\" \n shows \"\\\\\\<^sub>c( normalizec P,s) \\ (normalizec Q,t)\"\nusing exec\nproof(induct rule:stepc_induct)\n case (Catchc P s Q t c2)\n thus ?case\n *) \n(* qed(auto intro: stepc.intros) *)\n\n\nlemma mod_env_not_component:\nshows \"\\ \\\\\\<^sub>c (P, s) \\ (P, t)\"\nproof \n assume a3:\"\\\\\\<^sub>c (P, s) \\ (P, t)\" \n thus False using step_change_p_or_eq_s a3 by fastforce\nqed\n\nlemma redex_not_call_seq_catch:\n assumes a0:\"redex P = Call f \\ P\\Call f\" \n shows \"\\p1 p2. P = Seq p1 p2 \\ P = Catch p1 p2\"\nusing a0 \nproof(induct P)\nqed(fastforce+)\n\n\nlemma three_elems_list:\n assumes a1:\"length l > 2\"\n shows \"\\a0 a1 a2 l1. l=a0#a1#a2#l1\"\nusing a1 by (metis Cons_nth_drop_Suc One_nat_def Suc_1 Suc_leI add_lessD1 drop_0 length_greater_0_conv list.size(3) not_numeral_le_zero one_add_one) \n\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n by (induct xs) auto\n\nlemma list_eq_if [rule_format]: \n \"\\ys. xs=ys \\ (length xs = length ys) \\ (\\i (\\i ys!0=a; ys\\[] \\ \\ ys=(a#(tl ys))\"\n by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\[] \\ ys!0=a \\ P ys \\ P (a#(tl ys))\"\n by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) \\ P ys\"\n by (induct ys) simp_all\n\nlemma nth_tl_eq [rule_format]: \"ys\\[] \\ ys!0=a \\ P (a#(tl ys)) = P ys\"\n by (induct ys) simp_all\n\nlemma nth_tl_pair: \"\\p=(u,ys); ys!0=a; ys\\[] \\ \\ p=(u,(a#(tl ys)))\"\nby (simp add: SmallStepCon.nth_tl)\n\nlemma nth_tl_eq_Pair [rule_format]: \"p=(u,ys) \\ ys\\[] \\ ys!0=a \\ P ((u,a#(tl ys))) = P (u,ys)\"\n by (induct ys) simp_all\n\nlemma tl_zero[rule_format]: \n \" Suc j P (ys!Suc j) \\ P (tl(ys)!j)\"\n by (simp add: List.nth_tl)\n\nlemma tl_zero1[rule_format]:\n \"Suc jP (tl(ys)!j) \\P (ys!Suc j)\"\n by (simp add: List.nth_tl)\n\nlemma tl_zero_eq [rule_format]:\n \"Suc j (P (tl(ys)!j) = P (ys!Suc j))\"\nby (simp add: List.nth_tl)\n\nlemma tl_zero_eq' :\n \"\\j. Suc j (P (tl(ys)!j) = P (ys!Suc j))\"\nusing tl_zero_eq by blast\n\nlemma tl_zero_pair:\"i < length ys \\ length ys = length zs \\\n Suc j < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!j)\" \n by (simp add: tl_zero_eq)\n\n\nlemma tl_zero_pair':\"\\i < length ys. length ys = length zs \\\n Suc j < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n (P ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!j))\" \nusing tl_zero_pair by blast\n\nlemma tl_zero_pair2:\"i < length ys \\ length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc (Suc j))) ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!(Suc j)) ((snd (zs!i))!j)\" \n by (simp add: tl_zero_eq)\n\nlemma tl_zero_pair2':\"\\i < length ys. length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc (Suc j))) ((snd (ys!i))!(Suc j)) =\n P ((snd (zs!i))!(Suc j)) ((snd (zs!i))!j)\" \nusing tl_zero_pair2 by blast\n\nlemma tl_zero_pair21:\"\\i < length ys. length ys = length zs \\\n Suc (Suc j) < length (snd (ys!i)) \\\n snd (zs!i) = tl (snd (ys!i)) \\ \n P ((snd (ys!i))!(Suc j)) ((snd (ys!i))!(Suc (Suc j)))=\n P ((snd (zs!i))!j) ((snd (zs!i))!(Suc j)) \"\nby (metis SmallStepCon.nth_tl list.size(3) not_less0 nth_Cons_Suc) \n\nlemma tl_pair:\"Suc (Suc j) < length l \\ \n l1 = tl l \\\n P (l!(Suc (Suc j))) (l!(Suc j)) =\n P (l1!(Suc j)) (l1!j)\"\nby (simp add: tl_zero_eq)\n\nlemma list_as_map: \n assumes \n a1:\"length clist > 0\" and \n a2: \"xs = (map (\\x. fst (hd x)) clist)\" and\n a3: \"ys = (map (\\x. tl x) clist)\" and\n a4: \"\\i< length clist. length (clist!i) > 0\" and \n a5: \"\\i < length clist. \\j< length clist. \\ki < length clist. \\j< length clist. \n length (clist!i) = length (clist!j)\" \n shows \"clist = map (\\i. (fst i,snd ((clist!0)!0))#snd i) (zip xs ys)\"\nproof-\n let ?clist'= \"map (\\i. (fst i,snd ((clist!0)!0))#snd i) (zip xs ys)\"\n have lens:\"length clist = length ?clist'\" using a2 a3 by auto \n have \"(\\ii. (fst i,snd ((clist!0)!0))#snd i) ((zip xs ys)!i) = clist !i\" \n proof -\n have f1: \"length xs = length clist\"\n using a2 length_map by blast\n have \"\\ (0::nat) < 0\"\n by (meson less_not_refl)\n thus ?thesis\n using f1 by (metis (lifting) a11 a3 a4 \n fst_conv length_map list.exhaust_sel \n list.size(3) nth_zip prod.collapse \n snd_conv snd_zero xs_clist ys_clist)\n qed \n then have \"clist ! i = ?clist' ! i\" using lens a11 by force\n } \n thus ?thesis by auto \n qed\n thus ?thesis using lens list_eq by blast\nqed\n\nlemma list_as_map': \n assumes \n a1:\"length clist > 0\" and \n a2: \"xs = (map (\\x. hd x) clist)\" and\n a3: \"ys = (map (\\x. tl x) clist)\" and\n a4: \"\\i< length clist. length (clist!i) > 0\"\n shows \"clist = map (\\i. (fst i)#snd i) (zip xs ys)\"\nproof-\n let ?clist'= \"map (\\i.(fst i)#snd i) (zip xs ys)\"\n have lens:\"length clist = length ?clist'\" using a2 a3 by auto \n have \"(\\ii. fst i#snd i) ((zip xs ys)!i) = clist !i\" \n using xs_clist ys_clist a11 a2 a3 a4 by fastforce \n then have \"clist ! i = ?clist' ! i\" using lens a11 by force\n } \n thus ?thesis by auto \n qed\n thus ?thesis using lens list_eq by blast\nqed\n\n\nlemma clist_tail: \n assumes \n a1:\"length xs = length clist\" and\n a2: \"ys = (map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\n shows \"\\i < length ys. tl (snd (ys!i)) = clist!i \"\nusing a1 a2\nproof - \n show ?thesis using a2\n by (simp add: a1) \nqed \n\n\nlemma clist_map: \n assumes \n a1:\"length xs = length clist\" \n shows \"clist = map ((\\p. tl (snd p)) \\ (\\i. (\\, (fst i, s) # snd i))) (zip xs clist)\"\nproof -\n have f1: \"map snd (zip xs clist) = clist\"\n using a1 map_snd_zip by blast\n have \"map snd (zip xs clist) = map ((\\p. tl (snd p)) \\ (\\p. (\\, (fst p, s) # snd p))) (zip xs clist)\"\n by simp\n thus ?thesis\n using f1 by presburger\nqed\n\n\nlemma clist_map1: \n assumes \n a1:\"length xs = length clist\" \n shows \"clist = map (\\p. tl (snd p)) (map (\\i. (\\,(fst i,s)#snd i)) (zip xs clist))\"\nproof -\n have \"clist = map ((\\p. tl (snd p)) \\ (\\i. (\\, (fst i, s) # snd i))) (zip xs clist)\" \n using a1 clist_map by fastforce\n thus ?thesis by auto\nqed\n\nlemma clist_map2:\n \"(clist = map (\\p. tl (snd p)) (l::('a \\'b list) list) ) \\\n clist = map (\\p. (snd p)) (map (\\p. (fst p, tl (snd p))) (l::('a \\'b list) list)) \"\nby auto\n\nlemma map_snd:\n assumes a1: \"y = map (\\x. f x) l\"\n shows \"y=(map snd (map (\\x. (g x, f x)) l)) \"\nby (simp add: assms)\n \nlemmas map_snd_sym = map_snd[THEN sym]\n\nlemma map_snd':\n shows \" map (\\x. f x) l=(map snd (map (\\x. (g x, f x)) l)) \"\nby simp\n\n\nlemma hd_nth:\n assumes a1:\"i< length l \\ ( length( (l!i)) > 0)\"\n shows \"f (hd (l!i)) = f (nth (l!i) 0)\"\nusing assms hd_conv_nth by fastforce\n\nlemma map_hd_nth:\n assumes a1:\"(\\i 0)\"\n shows \"map (\\x. f (hd x)) l = map (\\x. f (nth (x) 0)) l\"\nproof - \n have \"\\i < length l. (map (\\x. f (hd x)) l)!i = f (nth (l!i) 0)\"\n using hd_nth a1 by auto\n moreover have \"\\i < length l. (map (\\x. f (nth x 0)) l)!i = f (nth (l!i) 0)\"\n using hd_nth a1 by auto\n ultimately have f1:\"\\i < length l. (map (\\x. f (hd x)) l)!i =(map (\\x. f (nth x 0)) l)!i \"\n by auto\n moreover have f2:\"length (map (\\x. f (hd x)) l) = length l\"\n by auto \n moreover have \"length (map (\\x. f (nth x 0)) l) = length l\" by auto\n ultimately show ?thesis using nth_equalityI by metis\nqed\n\nlemma \"i clist!i = (x1,ys) \\ ys = (map (\\x. (fst (hd (snd x)),s)#tl (snd x)) clist)!i \\\n ys = (map (\\x. (fst x, s)#snd x) \n (zip (map (\\x. fst (hd (snd x))) clist) \n (map (\\x. tl (snd x)) clist)))!i\"\nproof (induct ys)\n case Nil thus ?case by auto\nnext\n case (Cons y ys) \n have \"\\n ps f. \\ n < length ps \\ map f ps ! n = (f (ps ! n::'a \\ ('b \\ 'c) list)::('b \\ 'c) list)\"\n by force\n hence \"y # ys = (fst (hd (snd (clist ! i))), s) # tl (snd (clist ! i))\"\n using Cons.prems(1) Cons.prems(3) by presburger\n thus ?case\n using Cons.prems(1) by auto\nqed\n\n\nlemma mapzip_upd:\" length as = length clist \\\n (map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)\"\nproof - \n assume a2: \"length as = length clist\" \n have \"\\i < length (map (\\j. (as ! j, sa) # clist ! j) [0..j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)!i\" \n using a2\n by auto\n moreover have \"length (map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist))\"\n using a2 by auto \n ultimately have \"(map (\\j. (as ! j, sa) # clist ! j) [0..j. ((fst j, sa)#snd j)) (zip as clist)\"\n using nth_equalityI by blast\n thus \"map (\\j. (as ! j, sa) # clist ! j) [0..j. (fst j, sa) # snd j) (zip as clist) \"\n by auto\nqed\n\n\n(************************************************************************ *)\n(* subsection {* Equivalence between Small-Step and Big-Step Semantics *} *)\n(* ************************************************************************ *)\n \n(* \n\n?\\\\\\<^sub>c (LanguageCon.com.Seq ?c1.0 ?c2.0, ?s) \\\n (LanguageCon.com.Seq ?c1' ?c2.0,\n ?s') \\\n(?\\\\\\<^sub>c (?c1.0, ?s) \\ (?c1', ?s') \\ ?P) \\\n?P\n\nlemma \n assumes \n step_a: \"\\\\\\<^sub>c(Await b c, Normal s) \\ (t,u)\"\n shows step_await_step_c:\"(\\\\<^sub>\\\\<^sub>a)\\(c, Normal s) \\\\<^sup>* (sequential t,u)\" \nusing step_a\nproof cases\n fix t1\n assume\n \"(t, u) = (Skip, t1)\" \"s \\ b\" \"\\\\ \\c,Normal s\\ \\ t1\" \"\\t'. t1 \\ Abrupt t'\"\n thus ?thesis \n by (cases u) \n (auto intro: exec_impl_steps_Fault exec_impl_steps_Normal exec_impl_steps_Stuck)\nnext\n fix t1\n assume \"(t, u) = (Throw, Normal t1)\" \"s \\ b\" \"\\\\ \\c,Normal s\\ \\ Abrupt t1\"\n thus ?thesis by (simp add: exec_impl_steps_Normal_Abrupt)\nqed\n\nlemma \n assumes (* exec: \"\\\\\\c,Normal s\\ \\ t\" and\n b: \"s \\ b\" and *)\n step_a: \"\\\\\\<^sub>c(Await b c, Normal s) \\ u\"\n shows step_await_final1:\"final u\"\nusing step_a \nproof cases\n case (1 t) thus \"final u\" by (simp add: final_def)\nnext\n case (2 t)\n thus \"final u\" by (simp add: exec_impl_steps_Normal_Abrupt final_def)\nqed\n\nlemma step_Abrupt_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Abrupt x \\ s=Abrupt x\"\nusing step\nby induct auto\n\n\nlemma step_Stuck_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Stuck \\ \n s=Stuck \\ \n (\\r x. redex c\\<^sub>1 = Spec r \\ s=Normal x \\ (\\t. (x,t)\\r)) \\ \n (\\p x. redex c\\<^sub>1= Call p \\ s=Normal x \\ \\ p = None) \\\n (\\b c x. redex c\\<^sub>1 = Await b c \\ s=Normal x \\ x \\ b \\ \\\\\\c,s\\\\s')\"\nusing step\nby induct auto\n\nlemma step_Fault_end: \n assumes step: \"\\\\\\<^sub>c (c\\<^sub>1, s) \\ (c\\<^sub>1', s')\"\n shows \"s'=Fault f \\ \n s=Fault f \\ \n (\\g c x. redex c\\<^sub>1 = Guard f g c \\ s=Normal x \\ x \\ g) \\\n (\\b c1 x. redex c\\<^sub>1 = Await b c1 \\ s=Normal x \\ x \\ b \\ \\\\\\c1,s\\\\s')\"\nusing step \nby induct auto\n\n\n\n(* ************************************************************************ *)\nsubsection {* Infinite Computations: @{text \"\\\\(c, s) \\ \\(\\)\"}*}\n(* ************************************************************************ *)\n\ndefinition inf_c:: \"('s,'p,'f,'e) body \\ ('s,'p,'f,'e) config \\ bool\"\n (\"_\\\\<^sub>c _ \\ \\'(\\')\" [60,80] 100) where\n\"\\\\\\<^sub>c cfg \\ \\(\\) \\ (\\f. f (0::nat) = cfg \\ (\\i. \\\\\\<^sub>cf i \\ f (i+1)))\" \n\nlemma not_infI: \"\\\\f. \\f 0 = cfg; \\i. \\\\\\<^sub>cf i \\ f (Suc i)\\ \\ False\\ \n \\ \\\\\\\\<^sub>c cfg \\ \\(\\)\"\n by (auto simp add: inf_c_def)\n\n(* ************************************************************************ *)\nsubsection {* Equivalence between Termination and the Absence of Infinite Computations*}\n(* ************************************************************************ *)\n\n\nlemma step_preserves_termination: \n assumes step: \"\\\\(c,s) \\ (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\" \nusing step\nproof (induct)\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case SpecStuck thus ?case by (fastforce intro: terminates.intros)\nnext\n case Guard thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2) thus ?case\n apply (cases s)\n apply (cases s')\n apply (fastforce intro: terminates.intros step_extend \n elim: terminates_Normal_elim_cases)\n apply (fastforce intro: terminates.intros dest: step_Abrupt_prop \n step_Fault_prop step_Stuck_prop)+\n done\nnext\n case (SeqSkip c\\<^sub>2 s) \n thus ?case \n apply (cases s)\n apply (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )+\n done\nnext\n case (SeqThrow c\\<^sub>2 s) \n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case CondTrue \n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case CondFalse \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case WhileTrue\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case WhileFalse \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case Call \n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case CallUndefined\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case DynCom\n thus ?case \n by (fastforce intro: terminates.intros \n elim: terminates_Normal_elim_cases )\nnext\n case (Catch c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2) thus ?case\n apply (cases s)\n apply (cases s')\n apply (fastforce intro: terminates.intros step_extend \n elim: terminates_Normal_elim_cases)\n apply (fastforce intro: terminates.intros dest: step_Abrupt_prop \n step_Fault_prop step_Stuck_prop)+\n done\nnext\n case CatchThrow\n thus ?case \n by (fastforce intro: terminates.intros exec.intros\n elim: terminates_Normal_elim_cases )\nnext\n case (CatchSkip c\\<^sub>2 s) \n thus ?case \n by (cases s) (fastforce intro: terminates.intros)+\nnext\n case FaultProp thus ?case by (fastforce intro: terminates.intros)\nnext\n case StuckProp thus ?case by (fastforce intro: terminates.intros)\nnext\n case AbruptProp thus ?case by (fastforce intro: terminates.intros)\nnext \n case Await thus ?case using terminates_Skip' by blast \nnext \n case AwaitAbrupt thus ?case by (fastforce intro: terminates.intros)\nqed\n\nlemma steps_preserves_termination: \n assumes steps: \"\\\\(c,s) \\\\<^sup>* (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\"\nusing steps\nproof (induct rule: rtranclp_induct2 [consumes 1, case_names Refl Trans])\n case Refl thus ?case .\nnext\n case Trans\n thus ?case\n by (blast dest: step_preserves_termination)\nqed\n\nML {*\n ML_Thms.bind_thm (\"tranclp_induct2\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(aa,ab)\"), (((\"b\", 0), Position.none), \"(ba,bb)\")] []\n @{thm tranclp_induct}));\n*}\n\nthm tranclp_induct2 tranclp_induct\n\nlemma steps_preserves_termination': \n assumes steps: \"\\\\(c,s) \\\\<^sup>+ (c',s')\"\n shows \"\\\\c\\s \\ \\\\c'\\s'\"\nusing steps\nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case Step thus ?case by (blast intro: step_preserves_termination)\nnext\n case Trans\n thus ?case\n by (blast dest: step_preserves_termination)\nqed\n\n\n\ndefinition head_com:: \"('s,'p,'f,'e) com \\ ('s,'p,'f,'e) com\"\nwhere\n\"head_com c =\n (case c of\n Seq c\\<^sub>1 c\\<^sub>2 \\ c\\<^sub>1\n | Catch c\\<^sub>1 c\\<^sub>2 \\ c\\<^sub>1\n | _ \\ c)\"\n\n \ndefinition head:: \"('s,'p,'f,'e) config \\ ('s,'p,'f,'e) config\"\n where \"head cfg = (head_com (fst cfg), snd cfg)\"\n\nlemma le_Suc_cases: \"\\\\i. \\i < k\\ \\ P i; P k\\ \\ \\i<(Suc k). P i\"\n apply clarify\n apply (case_tac \"i=k\")\n apply auto\n done\n\nlemma redex_Seq_False: \"\\c' c''. (redex c = Seq c'' c') = False\"\n by (induct c) auto\n\nlemma redex_Catch_False: \"\\c' c''. (redex c = Catch c'' c') = False\"\n by (induct c) auto\n\n\nlemma infinite_computation_extract_head_Seq:\n assumes inf_comp: \"\\i::nat. \\\\f i \\ f (i+1)\"\n assumes f_0: \"f 0 = (Seq c\\<^sub>1 c\\<^sub>2,s)\"\n assumes not_fin: \"\\i final (head (f i))\"\n shows \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s')) \\ \n \\\\head (f i) \\ head (f (i+1))\"\n (is \"\\ii final (head (f i))\" by fact\n from this[rule_format] have not_fin_k: \n \"\\i final (head (f i))\" \n apply clarify\n apply (subgoal_tac \"i < Suc k\")\n apply blast\n apply simp\n done\n\n from Suc.hyps [OF this]\n have hyp: \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s')) \\ \n \\\\ head (f i) \\ head (f (i + 1))\".\n show ?case\n proof (rule le_Suc_cases)\n fix i \n assume \"i < k\"\n then show \"?P i\"\n by (rule hyp [rule_format])\n next\n show \"?P k\"\n proof -\n from hyp [rule_format, of \"k - 1\"] f_0\n obtain c' fs' L' s' where f_k: \"f k = (Seq c' c\\<^sub>2, s')\"\n by (cases k) auto\n from inf_comp [rule_format, of k] f_k\n have \"\\\\(Seq c' c\\<^sub>2, s') \\ f (k + 1)\"\n by simp\n moreover\n from not_fin_Suc [rule_format, of k] f_k\n have \"\\ final (c',s')\"\n by (simp add: final_def head_def head_com_def)\n ultimately\n obtain c'' s'' where\n \"\\\\(c', s') \\ (c'', s'')\" and\n \"f (k + 1) = (Seq c'' c\\<^sub>2, s'')\"\n by cases (auto simp add: redex_Seq_False final_def)\n with f_k\n show ?thesis\n by (simp add: head_def head_com_def)\n qed\n qed\nqed\n\nlemma infinite_computation_extract_head_Catch:\n assumes inf_comp: \"\\i::nat. \\\\f i \\ f (i+1)\"\n assumes f_0: \"f 0 = (Catch c\\<^sub>1 c\\<^sub>2,s)\"\n assumes not_fin: \"\\i final (head (f i))\"\n shows \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s')) \\ \n \\\\head (f i) \\ head (f (i+1))\"\n (is \"\\ii final (head (f i))\" by fact\n from this[rule_format] have not_fin_k: \n \"\\i final (head (f i))\" \n apply clarify\n apply (subgoal_tac \"i < Suc k\")\n apply blast\n apply simp\n done\n\n from Suc.hyps [OF this]\n have hyp: \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s')) \\ \n \\\\ head (f i) \\ head (f (i + 1))\".\n show ?case\n proof (rule le_Suc_cases)\n fix i \n assume \"i < k\"\n then show \"?P i\"\n by (rule hyp [rule_format])\n next\n show \"?P k\"\n proof -\n from hyp [rule_format, of \"k - 1\"] f_0\n obtain c' fs' L' s' where f_k: \"f k = (Catch c' c\\<^sub>2, s')\"\n by (cases k) auto\n from inf_comp [rule_format, of k] f_k\n have \"\\\\(Catch c' c\\<^sub>2, s') \\ f (k + 1)\"\n by simp\n moreover\n from not_fin_Suc [rule_format, of k] f_k\n have \"\\ final (c',s')\"\n by (simp add: final_def head_def head_com_def)\n ultimately\n obtain c'' s'' where\n \"\\\\(c', s') \\ (c'', s'')\" and\n \"f (k + 1) = (Catch c'' c\\<^sub>2, s'')\"\n by cases (auto simp add: redex_Catch_False final_def)+\n with f_k\n show ?thesis\n by (simp add: head_def head_com_def)\n qed\n qed\nqed\n\nlemma no_inf_Throw: \"\\ \\\\(Throw,s) \\ \\(\\)\"\nproof \n assume \"\\\\ (Throw, s) \\ \\(\\)\"\n then obtain f where\n step [rule_format]: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Throw, s)\"\n by (auto simp add: inf_def)\n from step [of 0, simplified f_0] step [of 1]\n show False\n by cases (auto elim: step_elim_cases)\nqed\n\nlemma split_inf_Seq: \n assumes inf_comp: \"\\\\(Seq c\\<^sub>1 c\\<^sub>2,s) \\ \\(\\)\"\n shows \"\\\\(c\\<^sub>1,s) \\ \\(\\) \\ \n (\\s'. \\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s') \\ \\\\(c\\<^sub>2,s') \\ \\(\\))\"\nproof -\n from inf_comp obtain f where\n step: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Seq c\\<^sub>1 c\\<^sub>2, s)\"\n by (auto simp add: inf_def)\n from f_0 have head_f_0: \"head (f 0) = (c\\<^sub>1,s)\" \n by (simp add: head_def head_com_def)\n show ?thesis\n proof (cases \"\\i. final (head (f i))\")\n case True\n def k\\\"(LEAST i. final (head (f i)))\"\n have less_k: \"\\i final (head (f i))\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply auto\n done\n from infinite_computation_extract_head_Seq [OF step f_0 this]\n obtain step_head: \"\\i\\ head (f i) \\ head (f (i + 1))\" and\n conf: \"\\ic' s'. f (i + 1) = (Seq c' c\\<^sub>2, s'))\"\n by blast \n from True\n have final_f_k: \"final (head (f k))\"\n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n moreover\n from f_0 conf [rule_format, of \"k - 1\"]\n obtain c' s' where f_k: \"f k = (Seq c' c\\<^sub>2,s')\"\n by (cases k) auto\n moreover\n from step_head have steps_head: \"\\\\head (f 0) \\\\<^sup>* head (f k)\"\n proof (induct k)\n case 0 thus ?case by simp\n next\n case (Suc m)\n have step: \"\\i\\ head (f i) \\ head (f (i + 1))\" by fact\n hence \"\\i\\ head (f i) \\ head (f (i + 1))\"\n by auto\n hence \"\\\\ head (f 0) \\\\<^sup>* head (f m)\"\n by (rule Suc.hyps)\n also from step [rule_format, of m]\n have \"\\\\ head (f m) \\ head (f (m + 1))\" by simp\n finally show ?case by simp\n qed\n {\n assume f_k: \"f k = (Seq Skip c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k\n obtain \"\\\\(Seq Skip c\\<^sub>2,s') \\ (c\\<^sub>2,s')\" and\n f_Suc_k: \"f (k + 1) = (c\\<^sub>2,s')\"\n by (fastforce elim: step.cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (c\\<^sub>2,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(c\\<^sub>2,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n ultimately\n have ?thesis\n by auto\n }\n moreover\n {\n fix x\n assume s': \"s'=Normal x\" and f_k: \"f k = (Seq Throw c\\<^sub>2, s')\"\n from step [rule_format, of k] f_k s'\n obtain \"\\\\(Seq Throw c\\<^sub>2,s') \\ (Throw,s')\" and\n f_Suc_k: \"f (k + 1) = (Throw,s')\"\n by (fastforce elim: step_elim_cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (Throw,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(Throw,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n with no_inf_Throw\n have ?thesis\n by auto\n }\n ultimately \n show ?thesis\n by (auto simp add: final_def head_def head_com_def)\n next\n case False\n then have not_fin: \"\\i. \\ final (head (f i))\"\n by blast\n have \"\\i. \\\\head (f i) \\ head (f (i + 1))\"\n proof \n fix k\n from not_fin \n have \"\\i<(Suc k). \\ final (head (f i))\"\n by simp\n \n from infinite_computation_extract_head_Seq [OF step f_0 this ]\n show \"\\\\ head (f k) \\ head (f (k + 1))\" by simp\n qed\n with head_f_0 have \"\\\\(c\\<^sub>1,s) \\ \\(\\)\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma split_inf_Catch: \n assumes inf_comp: \"\\\\(Catch c\\<^sub>1 c\\<^sub>2,s) \\ \\(\\)\"\n shows \"\\\\(c\\<^sub>1,s) \\ \\(\\) \\ \n (\\s'. \\\\(c\\<^sub>1,s) \\\\<^sup>* (Throw,Normal s') \\ \\\\(c\\<^sub>2,Normal s') \\ \\(\\))\"\nproof -\n from inf_comp obtain f where\n step: \"\\i::nat. \\\\f i \\ f (i+1)\" and\n f_0: \"f 0 = (Catch c\\<^sub>1 c\\<^sub>2, s)\"\n by (auto simp add: inf_def)\n from f_0 have head_f_0: \"head (f 0) = (c\\<^sub>1,s)\" \n by (simp add: head_def head_com_def)\n show ?thesis\n proof (cases \"\\i. final (head (f i))\")\n case True\n def k\\\"(LEAST i. final (head (f i)))\"\n have less_k: \"\\i final (head (f i))\"\n apply (intro allI impI)\n apply (unfold k_def)\n apply (drule not_less_Least)\n apply auto\n done\n from infinite_computation_extract_head_Catch [OF step f_0 this]\n obtain step_head: \"\\i\\ head (f i) \\ head (f (i + 1))\" and\n conf: \"\\ic' s'. f (i + 1) = (Catch c' c\\<^sub>2, s'))\"\n by blast \n from True\n have final_f_k: \"final (head (f k))\"\n apply -\n apply (erule exE)\n apply (drule LeastI)\n apply (simp add: k_def)\n done\n moreover\n from f_0 conf [rule_format, of \"k - 1\"]\n obtain c' s' where f_k: \"f k = (Catch c' c\\<^sub>2,s')\"\n by (cases k) auto\n moreover\n from step_head have steps_head: \"\\\\head (f 0) \\\\<^sup>* head (f k)\"\n proof (induct k)\n case 0 thus ?case by simp\n next\n case (Suc m)\n have step: \"\\i\\ head (f i) \\ head (f (i + 1))\" by fact\n hence \"\\i\\ head (f i) \\ head (f (i + 1))\"\n by auto\n hence \"\\\\ head (f 0) \\\\<^sup>* head (f m)\"\n by (rule Suc.hyps)\n also from step [rule_format, of m]\n have \"\\\\ head (f m) \\ head (f (m + 1))\" by simp\n finally show ?case by simp\n qed\n {\n assume f_k: \"f k = (Catch Skip c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Skip,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k\n obtain \"\\\\(Catch Skip c\\<^sub>2,s') \\ (Skip,s')\" and\n f_Suc_k: \"f (k + 1) = (Skip,s')\"\n by (fastforce elim: step.cases intro: step.intros)\n from step [rule_format, of \"k+1\", simplified f_Suc_k]\n have ?thesis\n by (rule no_step_final') (auto simp add: final_def)\n }\n moreover\n {\n fix x\n assume s': \"s'=Normal x\" and f_k: \"f k = (Catch Throw c\\<^sub>2, s')\"\n with steps_head\n have \"\\\\(c\\<^sub>1,s) \\\\<^sup>* (Throw,s')\"\n using head_f_0\n by (simp add: head_def head_com_def)\n moreover\n from step [rule_format, of k] f_k s'\n obtain \"\\\\(Catch Throw c\\<^sub>2,s') \\ (c\\<^sub>2,s')\" and\n f_Suc_k: \"f (k + 1) = (c\\<^sub>2,s')\"\n by (fastforce elim: step_elim_cases intro: step.intros)\n def g\\\"\\i. f (i + (k + 1))\"\n from f_Suc_k\n have g_0: \"g 0 = (c\\<^sub>2,s')\"\n by (simp add: g_def)\n from step\n have \"\\i. \\\\g i \\ g (i + 1)\"\n by (simp add: g_def)\n with g_0 have \"\\\\(c\\<^sub>2,s') \\ \\(\\)\"\n by (auto simp add: inf_def)\n ultimately\n have ?thesis\n using s'\n by auto\n }\n ultimately \n show ?thesis\n by (auto simp add: final_def head_def head_com_def)\n next\n case False\n then have not_fin: \"\\i. \\ final (head (f i))\"\n by blast\n have \"\\i. \\\\head (f i) \\ head (f (i + 1))\"\n proof \n fix k\n from not_fin \n have \"\\i<(Suc k). \\ final (head (f i))\"\n by simp\n \n from infinite_computation_extract_head_Catch [OF step f_0 this ]\n show \"\\\\ head (f k) \\ head (f (k + 1))\" by simp\n qed\n with head_f_0 have \"\\\\(c\\<^sub>1,s) \\ \\(\\)\"\n by (auto simp add: inf_def)\n thus ?thesis\n by simp\n qed\nqed\n\nlemma Skip_no_step: \"\\\\(Skip,s) \\ cfg \\ P\"\n apply (erule no_step_final')\n apply (simp add: final_def)\n done\n\nlemma not_inf_Stuck: \"\\ \\\\(c,Stuck) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Stuck)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Stuck) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Stuck_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Stuck) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Stuck_prop)\n qed \nnext \n case (Await b c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Stuck)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\nlemma not_inf_Fault: \"\\ \\\\(c,Fault x) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Fault x)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Fault x) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Fault_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Fault x) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Fault_prop)\n qed \nnext\n case (Await b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Fault x)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\nlemma not_inf_Abrupt: \"\\ \\\\(c,Abrupt s) \\ \\(\\)\"\nproof (induct c)\n case Skip\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Abrupt s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Abrupt s) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto dest: steps_Abrupt_prop)\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c\\<^sub>1 c\\<^sub>2, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (While b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (DynCom d) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom d, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard m g c)\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case Throw\n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Abrupt s) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto dest: steps_Abrupt_prop)\n qed \ncase (Await b c) \n show ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Abrupt s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\n\ntheorem terminates_impl_no_infinite_computation:\n assumes termi: \"\\\\c \\ s\"\n shows \"\\ \\\\(c,s) \\ \\(\\)\"\nusing termi\nproof (induct)\n case (Skip s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Skip, Normal s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: Skip_no_step)\n qed\nnext\n case (Basic g s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Basic g, Normal s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Spec r s) \n thus ?case \n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Spec r, Normal s)\" \n from f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Guard s g c m)\n have g: \"s \\ g\" by fact\n have hyp: \"\\ \\\\ (c, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Normal s)\" \n from f_step [of 0] f_0 g\n have \"f 1 = (c,Normal s)\"\n by (fastforce elim: step_elim_cases)\n with f_step\n have \"\\\\ (c, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False ..\n qed\nnext\n case (GuardFault s g m c)\n have g: \"s \\ g\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Guard m g c, Normal s)\" \n from g f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Fault c m) \n thus ?case\n by (rule not_inf_Fault)\nnext\n case (Seq c\\<^sub>1 s c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ \\(\\)\"\n from split_inf_Seq [OF this] Seq.hyps\n show False\n by (auto intro: steps_Skip_impl_exec)\n qed\nnext\n case (CondTrue s b c1 c2)\n have b: \"s \\ b\" by fact\n have hyp_c1: \"\\ \\\\ (c1, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c1 c2, Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = (c1,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (c1, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c1 show False by simp\n qed \nnext\n case (CondFalse s b c2 c1)\n have b: \"s \\ b\" by fact\n have hyp_c2: \"\\ \\\\ (c2, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Cond b c1 c2, Normal s)\" \n from b f_step [of 0] f_0\n have \"f 1 = (c2,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (c2, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp_c2 show False by simp\n qed\nnext \n case (WhileTrue s b c)\n have b: \"s \\ b\" by fact\n have hyp_c: \"\\ \\\\ (c, Normal s) \\ \\(\\)\" by fact\n have hyp_w: \"\\s'. \\\\ \\c,Normal s\\ \\ s' \\ \n \\\\While b c \\ s' \\ \\ \\\\ (While b c, s') \\ \\(\\)\" by fact\n have not_inf_Seq: \"\\ \\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n proof \n assume \"\\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n from split_inf_Seq [OF this] hyp_c hyp_w show False\n by (auto intro: steps_Skip_impl_exec)\n qed\n show ?case\n proof \n assume \"\\\\ (While b c, Normal s) \\ \\(\\)\"\n then obtain f where\n f_step: \"\\i. \\\\f i \\ f (Suc i)\" and\n f_0: \"f 0 = (While b c, Normal s)\" \n by (auto simp add: inf_def)\n from f_step [of 0] f_0 b\n have \"f 1 = (Seq c (While b c),Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (Seq c (While b c), Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with not_inf_Seq show False by simp\n qed\nnext\n case (WhileFalse s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (While b c, Normal s)\" \n from b f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Call p bdy s)\n have bdy: \"\\ p = Some bdy\" by fact\n have hyp: \"\\ \\\\ (bdy, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Normal s)\" \n from bdy f_step [of 0] f_0\n have \"f 1 = (bdy,Normal s)\"\n by (auto elim: step_Normal_elim_cases)\n with f_step\n have \"\\\\ (bdy, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp show False by simp\n qed \nnext\n case (CallUndefined p s)\n have no_bdy: \"\\ p = None\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Call p, Normal s)\" \n from no_bdy f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nnext\n case (Stuck c)\n show ?case\n by (rule not_inf_Stuck)\nnext\n case (DynCom c s)\n have hyp: \"\\ \\\\ (c s, Normal s) \\ \\(\\)\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (DynCom c, Normal s)\" \n from f_step [of 0] f_0\n have \"f (Suc 0) = (c s, Normal s)\"\n by (auto elim: step_elim_cases)\n with f_step have \"\\\\ (c s, Normal s) \\ \\(\\)\"\n apply (simp add: inf_def)\n apply (rule_tac x=\"\\i. f (Suc i)\" in exI)\n by simp\n with hyp\n show False by simp\n qed\nnext (\\,c) \\ clist\n case (Throw s) thus ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Throw, Normal s)\" \n from f_step [of 0] f_0\n show False\n by (auto elim: step_elim_cases)\n qed \nnext\n case (Abrupt c)\n show ?case\n by (rule not_inf_Abrupt)\nnext\n case (Catch c\\<^sub>1 s c\\<^sub>2)\n show ?case\n proof \n assume \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ \\(\\)\"\n from split_inf_Catch [OF this] Catch.hyps\n show False\n by (auto intro: steps_Throw_impl_exec)\n qed\nnext\n case (AwaitTrue s b c)\n have b: \"s \\ b\" by fact\n show ?case\n proof (rule not_infI)\n fix f\n assume f_step: \"\\i. \\\\f i \\ f (Suc i)\"\n assume f_0: \"f 0 = (Await b c, Normal s)\" \n from b f_step [of 0] f_0 f_step [of 1]\n show False\n by (fastforce elim: Skip_no_step step_elim_cases)\n qed\nqed\n\n\ndefinition\n termi_call_steps :: \"('s,'p,'f,'e) body \\ (('s \\ 'p) \\ ('s \\ 'p))set\"\nwhere\n\"termi_call_steps \\ =\n {((t,q),(s,p)). \\\\Call p\\Normal s \\ \n (\\c. \\\\(Call p,Normal s) \\\\<^sup>+ (c,Normal t) \\ redex c = Call q)}\"\n\n\nprimrec subst_redex:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com\"\nwhere\n\"subst_redex Skip c = c\" |\n\"subst_redex (Basic f) c = c\" |\n\"subst_redex (Spec r) c = c\" |\n\"subst_redex (Seq c\\<^sub>1 c\\<^sub>2) c = Seq (subst_redex c\\<^sub>1 c) c\\<^sub>2\" |\n\"subst_redex (Cond b c\\<^sub>1 c\\<^sub>2) c = c\" |\n\"subst_redex (While b c') c = c\" |\n\"subst_redex (Await b c') c = c\" |\n\"subst_redex (Call p) c = c\" |\n\"subst_redex (DynCom d) c = c\" |\n\"subst_redex (Guard f b c') c = c\" |\n\"subst_redex (Throw) c = c\" |\n\"subst_redex (Catch c\\<^sub>1 c\\<^sub>2) c = Catch (subst_redex c\\<^sub>1 c) c\\<^sub>2\"\n\nlemma subst_redex_redex:\n \"subst_redex c (redex c) = c\"\n by (induct c) auto\n\nlemma redex_subst_redex: \"redex (subst_redex c r) = redex r\"\n by (induct c) auto\n \nlemma step_redex':\n shows \"\\\\(redex c,s) \\ (r',s') \\ \\\\(c,s) \\ (subst_redex c r',s')\"\nby (induct c) (auto intro: step.Seq step.Catch)\n\n\nlemma step_redex:\n shows \"\\\\(r,s) \\ (r',s') \\ \\\\(subst_redex c r,s) \\ (subst_redex c r',s')\"\nby (induct c) (auto intro: step.Seq step.Catch)\n\nlemma steps_redex:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. \\\\(subst_redex c r,s) \\\\<^sup>* (subst_redex c r',s')\"\nusing steps\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl \n show \"\\\\ (subst_redex c r', s') \\\\<^sup>* (subst_redex c r', s')\"\n by simp\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" by fact\n from step_redex [OF this]\n have \"\\\\ (subst_redex c r, s) \\ (subst_redex c r'', s'')\".\n also \n have \"\\\\ (subst_redex c r'', s'') \\\\<^sup>* (subst_redex c r', s')\" by fact\n finally show ?case .\nqed\n\nML {*\n ML_Thms.bind_thm (\"trancl_induct2\", Split_Rule.split_rule @{context}\n (Rule_Insts.read_instantiate @{context}\n [(((\"a\", 0), Position.none), \"(aa, ab)\"), (((\"b\", 0), Position.none), \"(ba, bb)\")] []\n @{thm trancl_induct}));\n*}\n\nlemma steps_redex':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. \\\\(subst_redex c r,s) \\\\<^sup>+ (subst_redex c r',s')\"\nusing steps\nproof (induct rule: tranclp_induct2 [consumes 1,case_names Step Trans])\n case (Step r' s')\n have \"\\\\ (r, s) \\ (r', s')\" by fact\n then have \"\\\\ (subst_redex c r, s) \\ (subst_redex c r', s')\"\n by (rule step_redex)\n then show \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r', s')\"..\nnext\n case (Trans r' s' r'' s'')\n have \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r', s')\" by fact\n also\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n hence \"\\\\ (subst_redex c r', s') \\ (subst_redex c r'', s'')\"\n by (rule step_redex)\n finally show \"\\\\ (subst_redex c r, s) \\\\<^sup>+ (subst_redex c r'', s'')\" .\nqed\n\nprimrec seq:: \"(nat \\ ('s,'p,'f,'e)com) \\ 'p \\ nat \\ ('s,'p,'f,'e)com\"\nwhere\n\"seq c p 0 = Call p\" |\n\"seq c p (Suc i) = subst_redex (seq c p i) (c i)\"\n\n\nlemma renumber':\n assumes f: \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r\" \n assumes a_b: \"(a,b) \\ r\\<^sup>*\" \n shows \"b = f 0 \\ (\\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r))\"\nusing a_b\nproof (induct rule: converse_rtrancl_induct [consumes 1])\n assume \"b = f 0\"\n with f show \"\\f. f 0 = b \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by blast\nnext\n fix a z\n assume a_z: \"(a, z) \\ r\" and \"(z, b) \\ r\\<^sup>*\" \n assume \"b = f 0 \\ \\f. f 0 = z \\ (\\i. (f i, f (Suc i)) \\ r)\"\n \"b = f 0\"\n then obtain f where f0: \"f 0 = z\" and seq: \"\\i. (f i, f (Suc i)) \\ r\"\n by iprover\n {\n fix i have \"((\\i. case i of 0 \\ a | Suc i \\ f i) i, f i) \\ r\"\n using seq a_z f0\n by (cases i) auto\n }\n then\n show \"\\f. f 0 = a \\ (\\i. (f i, f (Suc i)) \\ r)\"\n by - (rule exI [where x=\"\\i. case i of 0 \\ a | Suc i \\ f i\"],simp)\nqed\n\nlemma renumber:\n \"\\i. (a,f i) \\ r\\<^sup>* \\ (f i,f(Suc i)) \\ r \n \\ \\f. f 0 = a \\ (\\i. (f i, f(Suc i)) \\ r)\"\n by (blast dest:renumber')\n\nlemma lem:\n \"\\y. r\\<^sup>+\\<^sup>+ a y \\ P a \\ P y \n \\ ((b,a) \\ {(y,x). P x \\ r x y}\\<^sup>+) = ((b,a) \\ {(y,x). P x \\ r\\<^sup>+\\<^sup>+ x y})\"\napply(rule iffI)\n apply clarify\n apply(erule trancl_induct)\n apply blast\n apply(blast intro:tranclp_trans)\napply clarify\napply(erule tranclp_induct)\n apply blast\napply(blast intro:trancl_trans)\ndone\n\ncorollary terminates_impl_no_infinite_trans_computation:\n assumes terminates: \"\\\\c\\s\"\n shows \"\\(\\f. f 0 = (c,s) \\ (\\i. \\\\f i \\\\<^sup>+ f(Suc i)))\"\nproof -\n have \"wf({(y,x). \\\\(c,s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n proof (rule wf_trancl)\n show \"wf {(y, x). \\\\(c,s) \\\\<^sup>* x \\ \\\\x \\ y}\"\n proof (simp only: wf_iff_no_infinite_down_chain,clarify,simp)\n fix f\n assume \"\\i. \\\\(c,s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f (0::nat) = (c,s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from terminates_impl_no_infinite_computation [OF terminates]\n have \"\\ (\\f. f (0::nat) = (c, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (simp add: inf_def)\n ultimately show False\n by simp\n qed\n qed\n hence \"\\ (\\f. \\i. (f (Suc i), f i)\n \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+)\"\n by (simp add: wf_iff_no_infinite_down_chain)\n thus ?thesis\n proof (rule contrapos_nn)\n assume \"\\f. f (0::nat) = (c, s) \\ (\\i. \\\\f i \\\\<^sup>+ f (Suc i))\"\n then obtain f where\n f0: \"f 0 = (c, s)\" and\n seq: \"\\i. \\\\f i \\\\<^sup>+ f (Suc i)\"\n by iprover\n show \n \"\\f. \\i. (f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof (rule exI [where x=f],rule allI)\n fix i\n show \"(f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\ y}\\<^sup>+\"\n proof - \n {\n fix i have \"\\\\(c,s) \\\\<^sup>* f i\"\n proof (induct i)\n case 0 show \"\\\\(c, s) \\\\<^sup>* f 0\"\n by (simp add: f0)\n next\n case (Suc n)\n have \"\\\\(c, s) \\\\<^sup>* f n\" by fact\n with seq show \"\\\\(c, s) \\\\<^sup>* f (Suc n)\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n qed\n }\n hence \"\\\\(c,s) \\\\<^sup>* f i\"\n by iprover\n with seq have\n \"(f (Suc i), f i) \\ {(y, x). \\\\(c, s) \\\\<^sup>* x \\ \\\\x \\\\<^sup>+ y}\"\n by clarsimp\n moreover \n have \"\\y. \\\\f i \\\\<^sup>+ y\\\\\\(c, s) \\\\<^sup>* f i\\\\\\(c, s) \\\\<^sup>* y\"\n by (blast intro: tranclp_into_rtranclp rtranclp_trans)\n ultimately \n show ?thesis \n by (subst lem )\n qed\n qed\n qed\nqed\n\ntheorem wf_termi_call_steps: \"wf (termi_call_steps \\)\"\nproof (simp only: termi_call_steps_def wf_iff_no_infinite_down_chain,\n clarify,simp)\n fix f\n assume inf: \"\\i. (\\(t, q) (s, p).\n \\\\Call p \\ Normal s \\\n (\\c. \\\\ (Call p, Normal s) \\\\<^sup>+ (c, Normal t) \\ redex c = Call q))\n (f (Suc i)) (f i)\"\n def s\\\"\\i::nat. fst (f i)\" \n def p\\\"\\i::nat. snd (f i)::'b\"\n from inf\n have inf': \"\\i. \\\\Call (p i) \\ Normal (s i) \\\n (\\c. \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c, Normal (s (i+1))) \\ \n redex c = Call (p (i+1)))\"\n apply -\n apply (rule allI)\n apply (erule_tac x=i in allE)\n apply (auto simp add: s_def p_def)\n done\n show False\n proof -\n from inf'\n have \"\\c. \\i. \\\\Call (p i) \\ Normal (s i) \\\n \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i+1))) \\ \n redex (c i) = Call (p (i+1))\"\n apply -\n apply (rule choice)\n by blast\n then obtain c where\n termi_c: \"\\i. \\\\Call (p i) \\ Normal (s i)\" and\n steps_c: \"\\i. \\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i+1)))\" and\n red_c: \"\\i. redex (c i) = Call (p (i+1))\"\n by auto\n def g\\\"\\i. (seq c (p 0) i,Normal (s i)::('a,'c) xstate)\"\n from red_c [rule_format, of 0]\n have \"g 0 = (Call (p 0), Normal (s 0))\"\n by (simp add: g_def)\n moreover\n {\n fix i\n have \"redex (seq c (p 0) i) = Call (p i)\"\n by (induct i) (auto simp add: redex_subst_redex red_c)\n from this [symmetric]\n have \"subst_redex (seq c (p 0) i) (Call (p i)) = (seq c (p 0) i)\"\n by (simp add: subst_redex_redex)\n } note subst_redex_seq = this\n have \"\\i. \\\\ (g i) \\\\<^sup>+ (g (i+1))\"\n proof \n fix i\n from steps_c [rule_format, of i]\n have \"\\\\ (Call (p i), Normal (s i)) \\\\<^sup>+ (c i, Normal (s (i + 1)))\".\n from steps_redex' [OF this, of \"(seq c (p 0) i)\"]\n have \"\\\\ (subst_redex (seq c (p 0) i) (Call (p i)), Normal (s i)) \\\\<^sup>+\n (subst_redex (seq c (p 0) i) (c i), Normal (s (i + 1)))\" .\n hence \"\\\\ (seq c (p 0) i, Normal (s i)) \\\\<^sup>+ \n (seq c (p 0) (i+1), Normal (s (i + 1)))\"\n by (simp add: subst_redex_seq)\n thus \"\\\\ (g i) \\\\<^sup>+ (g (i+1))\"\n by (simp add: g_def)\n qed\n moreover\n from terminates_impl_no_infinite_trans_computation [OF termi_c [rule_format, of 0]]\n have \"\\ (\\f. f 0 = (Call (p 0), Normal (s 0)) \\ (\\i. \\\\ f i \\\\<^sup>+ f (Suc i)))\" .\n ultimately show False\n by auto\n qed\nqed\n\n\nlemma no_infinite_computation_implies_wf: \n assumes not_inf: \"\\ \\\\ (c, s) \\ \\(\\)\"\n shows \"wf {(c2,c1). \\ \\ (c,s) \\\\<^sup>* c1 \\ \\ \\ c1 \\ c2}\"\nproof (simp only: wf_iff_no_infinite_down_chain,clarify, simp)\n fix f\n assume \"\\i. \\\\(c, s) \\\\<^sup>* f i \\ \\\\f i \\ f (Suc i)\"\n hence \"\\f. f 0 = (c, s) \\ (\\i. \\\\f i \\ f (Suc i))\"\n by (rule renumber [to_pred])\n moreover from not_inf\n have \"\\ (\\f. f 0 = (c, s) \\ (\\i. \\\\f i \\ f (Suc i)))\"\n by (simp add: inf_def)\n ultimately show False\n by simp\nqed\n\nlemma not_final_Stuck_step: \"\\ final (c,Stuck) \\ \\c' s'. \\\\ (c, Stuck) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Abrupt_step: \n \"\\ final (c,Abrupt s) \\ \\c' s'. \\\\ (c, Abrupt s) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Fault_step: \n \"\\ final (c,Fault f) \\ \\c' s'. \\\\ (c, Fault f) \\ (c',s')\"\nby (induct c) (fastforce intro: step.intros simp add: final_def)+\n\nlemma not_final_Normal_step: \n \"\\ final (c,Normal s) \\ ((\\b c1. redex c = Await b c1) \\ \\\\c \\ Normal s) \\ \\c' s'. \\\\ (c, Normal s) \\ (c',s')\"\nproof (induct c) \n case Skip thus ?case by (simp add: final_def)\nnext\n case Basic thus ?case by (meson step.Basic)\nnext\n case (Spec r)\n thus ?case by (meson step.Spec step.SpecStuck) \nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n thus ?case by (metis SeqSkip SeqThrow final_def fst_conv redex.simps(4) step.Seq terminates_Normal_elim_cases(5))\nnext\n case (Cond b c1 c2)\n show ?case\n by (cases \"s \\ b\") (fastforce intro: step.intros)+\nnext\n case (While b c)\n show ?case\n by (cases \"s \\ b\") (fastforce intro: step.intros)+\nnext\n case (Call p)\n show ?case\n by (cases \"\\ p\") (fastforce intro: step.intros)+\nnext\n case DynCom thus ?case by (fastforce intro: step.intros)\nnext\n case (Guard f g c)\n show ?case\n by (cases \"s \\ g\") (fastforce intro: step.intros)+\nnext\n case Throw\n thus ?case by (fastforce intro: step.intros simp add: final_def)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n thus ?case\n by (cases \"final (c\\<^sub>1,Normal s)\") (fastforce intro: step.intros elim: terminates_Normal_elim_cases simp add: final_def)+\nnext\n case (Await b c) \n then obtain ba c1 where x:\"(\\ba c1. redex (Await b c) = Await ba c1)\" by simp\n then have \"\\\\Await b c \\ Normal s\" using x Await.prems by blast \n also have \"s \\ b\" by (meson `\\\\Await b c \\ Normal s` terminates_Normal_elim_cases(12))\n moreover have \"\\t. \\\\\\c, Normal s\\ \\ t\" by (meson calculation terminates_Normal_elim_cases(12) terminates_implies_exec) \n ultimately show ?case using AwaitAbrupt step.Await by fastforce\nqed\n\nlemma final_termi:\n\"final (c,s) \\ \\\\c\\s\"\n by (cases s) (auto simp add: final_def terminates.intros)\n\nlemma split_computation: \nassumes steps: \"\\\\ (c, s) \\\\<^sup>* (c\\<^sub>f, s\\<^sub>f)\"\nassumes not_final: \"\\ final (c,s)\"\nassumes final: \"final (c\\<^sub>f,s\\<^sub>f)\"\nshows \"\\c' s'. \\\\ (c, s) \\ (c',s') \\ \\\\ (c', s') \\\\<^sup>* (c\\<^sub>f, s\\<^sub>f)\"\nusing steps not_final final\nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl thus ?case by simp\nnext\n case (Trans c s c' s')\n thus ?case by auto\nqed\n\n\nlemma wf_implies_termi_reach_step_case:\nassumes hyp: \"\\c' s'. \\\\ (c, Normal s) \\ (c', s')\\ \\\\c' \\ s'\" and\n hyp1:\"(\\b c1. (redex c = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\nshows \"\\\\c \\ Normal s\"\nusing hyp hyp1\nproof (induct c)\n case Skip show ?case by (fastforce intro: terminates.intros)\nnext\n case Basic show ?case by (fastforce intro: terminates.intros)\nnext\n case (Spec r)\n show ?case\n by (cases \"\\t. (s,t)\\r\") (fastforce intro: terminates.intros)+\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nusing Seq.prems by blast \n have hyp': \"(\\b c1. (redex (Seq c\\<^sub>1 c\\<^sub>2) = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\" by fact \n show ?case \n proof (rule terminates.Seq)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\" \n assume red: \"(\\b c1. (redex c\\<^sub>1 = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c' c\\<^sub>2, s')\"\n by (simp add: step.Seq) \n from hyp [OF this]\n have \"\\\\Seq c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Seq.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using terminates_Skip' by (simp add: hyp') \n next\n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2 \\ s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ s'\"\n show \"\\\\c\\<^sub>2 \\ s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n hence \"c\\<^sub>1=Skip \\ c\\<^sub>1=Throw\"\n by (simp add: final_def)\n thus ?thesis\n proof\n assume Skip: \"c\\<^sub>1=Skip\"\n have s1:\"\\\\(Seq Skip c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s) \\\\ (\\b c1. Seq c\\<^sub>1 c\\<^sub>2 = Await b c1)\"\n by (simp add: step.SeqSkip) \n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Skip s1 by blast \n moreover from exec_c\\<^sub>1 Skip\n have \"s'=Normal s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n assume Throw: \"c\\<^sub>1=Throw\"\n with exec_c\\<^sub>1 have \"s'=Abrupt s\"\n by (auto elim: exec_Normal_elim_cases)\n thus ?thesis\n by auto\n qed\n next\n case False \n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (c\\<^sub>f, t)\" and\n fin:\"(case s' of\n Abrupt x \\ c\\<^sub>f = Throw \\ t = Normal x\n | _ \\ c\\<^sub>f = Skip \\ t = s')\"\n by (fastforce split: xstate.splits)\n with fin have final: \"final (c\\<^sub>f,t)\"\n by (cases s') (auto simp add: final_def)\n from split_computation [OF steps_c\\<^sub>1 False this]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (c\\<^sub>f, t)\" \n by blast\n from step.Seq [OF first]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this]\n have termi_s'': \"\\\\Seq c'' c\\<^sub>2 \\ s''\".\n show ?thesis\n proof (cases s'')\n case (Normal x)\n from termi_s'' [simplified Normal]\n have termi_c\\<^sub>2: \"\\t. \\\\ \\c'',Normal x\\ \\ t \\ \\\\c\\<^sub>2 \\ t\"\n by cases\n show ?thesis\n proof (cases \"\\x'. s'=Abrupt x'\")\n case False\n with fin obtain \"c\\<^sub>f=Skip\" \"t=s'\"\n by (cases s') auto\n from steps_Skip_impl_exec [OF rest [simplified this]] Normal\n have \"\\\\ \\c'',Normal x\\ \\ s'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this]\n show \"\\\\c\\<^sub>2 \\ s'\" .\n next\n case True\n with fin obtain x' where s': \"s'=Abrupt x'\" and \"c\\<^sub>f=Throw\" \"t=Normal x'\"\n by auto\n from steps_Throw_impl_exec [OF rest [simplified this]] Normal \n have \"\\\\ \\c'',Normal x\\ \\ Abrupt x'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this] s'\n show \"\\\\c\\<^sub>2 \\ s'\" by simp\n qed\n next\n case (Abrupt x)\n from steps_Abrupt_prop [OF rest this]\n have \"t=Abrupt x\" by simp\n with fin have \"s'=Abrupt x\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case (Fault f)\n from steps_Fault_prop [OF rest this]\n have \"t=Fault f\" by simp\n with fin have \"s'=Fault f\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case Stuck\n from steps_Stuck_prop [OF rest this]\n have \"t=Stuck\" by simp\n with fin have \"s'=Stuck\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n qed\n qed\n qed\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nby (simp add: Cond.prems(1)) \n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>1, Normal s) \"\n by (simp add: step.CondTrue) \n from hyp [OF this] have \"\\\\c\\<^sub>1 \\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>2, Normal s)\"\n by (simp add: step.CondFalse)\n from hyp [OF this] have \"\\\\c\\<^sub>2 \\ Normal s\".\n with False show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c)\n have hyp: \"\\c' s'. \\\\ (While b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (While b c, Normal s) \\ (Seq c (While b c), Normal s)\"\n by (simp add: step.WhileTrue)\n from hyp [OF this] have \"\\\\(Seq c (While b c)) \\ Normal s\".\n with True show ?thesis\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Call p)\n have hyp: \"\\c' s'. \\\\ (Call p, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: Call.prems)\n show ?case\n proof (cases \"\\ p\")\n case None\n thus ?thesis\n by (auto intro: terminates.intros)\n next\n case (Some bdy)\n then have \"\\\\ (Call p, Normal s) \\ (bdy, Normal s)\"\n by (simp add: step.Call)\n from hyp [OF this] have \"\\\\bdy \\ Normal s\".\n with Some show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (DynCom c)\n have hyp: \"\\c' s'. \\\\ (DynCom c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have \"\\\\ (DynCom c, Normal s) \\ (c s, Normal s)\"\n by (simp add: step.DynCom)\n from hyp [OF this] have \"\\\\c s \\ Normal s\".\n then show ?case\n by (auto intro: terminates.intros)\nnext\n case (Guard f g c)\n have hyp: \"\\c' s'. \\\\ (Guard f g c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\g\")\n case True\n then have \"\\\\ (Guard f g c, Normal s) \\ (c, Normal s) \"\n by (simp add: step.Guard) thm step.Guard\n from hyp [OF this] have \"\\\\c\\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext \n case Throw show ?case by (auto intro: terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have hyp': \"(\\b c1. (redex (Catch c\\<^sub>1 c\\<^sub>2) = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\" by fact\n show ?case\n proof (rule terminates.Catch)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"(\\b c1. (redex c\\<^sub>1 = Await b c1) \\ \\\\c1 \\ Normal s \\ s\\b)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c' c\\<^sub>2, s') \"\n by (simp add: step.Catch)\n from hyp [OF this]\n have \"\\\\Catch c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Catch.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using terminates_Skip' by (simp add: hyp')\n next \n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s' \\ \\\\c\\<^sub>2 \\ Normal s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s'\"\n show \"\\\\c\\<^sub>2 \\ Normal s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n with exec_c\\<^sub>1\n have Throw: \"c\\<^sub>1=Throw\"\n by (auto simp add: final_def elim: exec_Normal_elim_cases)\n have s1: \"\\\\(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n by (simp add: step.CatchThrow)\n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Throw s1 by blast \n moreover from exec_c\\<^sub>1 Throw\n have \"s'=s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n case False\n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (Throw, Normal s')\" \n by (fastforce split: xstate.splits)\n from split_computation [OF steps_c\\<^sub>1 False]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (Throw, Normal s')\" \n by (auto simp add: final_def)\n from step.Catch [OF first]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this] \n have \"\\\\Catch c'' c\\<^sub>2 \\ s''\".\n moreover\n from steps_Throw_impl_exec [OF rest]\n have \"\\\\ \\c'',s''\\ \\ Abrupt s'\".\n moreover\n from rest obtain x where \"s''=Normal x\"\n by (cases s'')\n (auto dest: steps_Fault_prop steps_Abrupt_prop steps_Stuck_prop)\n ultimately show ?thesis\n by (fastforce elim: terminates_elim_cases)\n qed\n qed\n qed\nnext\n case (Await b c) \n have hyp':\"\\ba c1. redex (Await b c) = Await ba c1 \\ \\\\c1 \\ Normal s \\ s \\ ba\" by fact \n have hyp: \"\\c' s'. \\\\ (Await b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: final_termi step_await_final1)\n have red:\"redex (Await b c) = Await b c\" by auto \n then have \"\\b1 c1. (redex (Await b c) = Await b1 c1) \\ b1=b \\ c1 = c\" by simp\n then have \" \\\\c \\ Normal s \\ s \\ b\" by (simp add: Await.prems(2))\n show ?case\n by (simp add: `\\\\c \\ Normal s \\ s \\ b` terminates.AwaitTrue) \nqed\n\n\nlemma wf_implies_termi_reach_step_case':\nassumes hyp: \"\\c' s'. \\\\ (c, Normal s) \\ (c', s')\\ \\\\c' \\ s'\" and\n hyp1:\"~(\\b c1. redex c = Await b c1)\"\nshows \"\\\\c \\ Normal s\"\nusing hyp hyp1\nproof (induct c)\n case Skip show ?case by (fastforce intro: terminates.intros)\nnext\n case Basic show ?case by (fastforce intro: terminates.intros)\nnext\n case (Spec r)\n show ?case\n by (cases \"\\t. (s,t)\\r\") (fastforce intro: terminates.intros)+\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nusing Seq.prems by blast\n have hyp': \"~(\\b c1. redex (Seq c\\<^sub>1 c\\<^sub>2) = Await b c1)\" by fact\n show ?case \n proof (rule terminates.Seq)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"~(\\b c1. redex c\\<^sub>1 = Await b c1)\" \n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c' c\\<^sub>2, s')\"\n by (simp add: step.Seq) \n from hyp [OF this]\n have \"\\\\Seq c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Seq.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\"using hyp' by force \n next\n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2 \\ s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ s'\"\n show \"\\\\c\\<^sub>2 \\ s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n hence \"c\\<^sub>1=Skip \\ c\\<^sub>1=Throw\"\n by (simp add: final_def)\n thus ?thesis\n proof\n assume Skip: \"c\\<^sub>1=Skip\"\n have s1:\"\\\\(Seq Skip c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s) \\\\ (\\b c1. Seq c\\<^sub>1 c\\<^sub>2 = Await b c1)\"\n by (simp add: step.SeqSkip) \n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Skip s1 by blast \n moreover from exec_c\\<^sub>1 Skip\n have \"s'=Normal s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n assume Throw: \"c\\<^sub>1=Throw\"\n with exec_c\\<^sub>1 have \"s'=Abrupt s\"\n by (auto elim: exec_Normal_elim_cases)\n thus ?thesis\n by auto\n qed\n next\n case False \n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (c\\<^sub>f, t)\" and\n fin:\"(case s' of\n Abrupt x \\ c\\<^sub>f = Throw \\ t = Normal x\n | _ \\ c\\<^sub>f = Skip \\ t = s')\"\n by (fastforce split: xstate.splits)\n with fin have final: \"final (c\\<^sub>f,t)\"\n by (cases s') (auto simp add: final_def)\n from split_computation [OF steps_c\\<^sub>1 False this]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (c\\<^sub>f, t)\" \n by blast\n from step.Seq [OF first]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Seq c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this]\n have termi_s'': \"\\\\Seq c'' c\\<^sub>2 \\ s''\".\n show ?thesis\n proof (cases s'')\n case (Normal x)\n from termi_s'' [simplified Normal]\n have termi_c\\<^sub>2: \"\\t. \\\\ \\c'',Normal x\\ \\ t \\ \\\\c\\<^sub>2 \\ t\"\n by cases\n show ?thesis\n proof (cases \"\\x'. s'=Abrupt x'\")\n case False\n with fin obtain \"c\\<^sub>f=Skip\" \"t=s'\"\n by (cases s') auto\n from steps_Skip_impl_exec [OF rest [simplified this]] Normal\n have \"\\\\ \\c'',Normal x\\ \\ s'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this]\n show \"\\\\c\\<^sub>2 \\ s'\" .\n next\n case True\n with fin obtain x' where s': \"s'=Abrupt x'\" and \"c\\<^sub>f=Throw\" \"t=Normal x'\"\n by auto\n from steps_Throw_impl_exec [OF rest [simplified this]] Normal \n have \"\\\\ \\c'',Normal x\\ \\ Abrupt x'\"\n by simp\n from termi_c\\<^sub>2 [rule_format, OF this] s'\n show \"\\\\c\\<^sub>2 \\ s'\" by simp\n qed\n next\n case (Abrupt x)\n from steps_Abrupt_prop [OF rest this]\n have \"t=Abrupt x\" by simp\n with fin have \"s'=Abrupt x\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case (Fault f)\n from steps_Fault_prop [OF rest this]\n have \"t=Fault f\" by simp\n with fin have \"s'=Fault f\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n next\n case Stuck\n from steps_Stuck_prop [OF rest this]\n have \"t=Stuck\" by simp\n with fin have \"s'=Stuck\"\n by (cases s') auto\n thus \"\\\\c\\<^sub>2 \\ s'\" \n by auto\n qed\n qed\n qed\n qed\nnext\n case (Cond b c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\"\nby (simp add: Cond.prems(1)) \n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>1, Normal s) \"\n by (simp add: step.CondTrue) \n from hyp [OF this] have \"\\\\c\\<^sub>1 \\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n then have \"\\\\ (Cond b c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c\\<^sub>2, Normal s)\"\n by (simp add: step.CondFalse)\n from hyp [OF this] have \"\\\\c\\<^sub>2 \\ Normal s\".\n with False show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c)\n have hyp: \"\\c' s'. \\\\ (While b c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\b\") \n case True\n then have \"\\\\ (While b c, Normal s) \\ (Seq c (While b c), Normal s)\"\n by (simp add: step.WhileTrue)\n from hyp [OF this] have \"\\\\(Seq c (While b c)) \\ Normal s\".\n with True show ?thesis\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Call p)\n have hyp: \"\\c' s'. \\\\ (Call p, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by (simp add: Call.prems)\n show ?case\n proof (cases \"\\ p\")\n case None\n thus ?thesis\n by (auto intro: terminates.intros)\n next\n case (Some bdy)\n then have \"\\\\ (Call p, Normal s) \\ (bdy, Normal s)\"\n by (simp add: step.Call)\n from hyp [OF this] have \"\\\\bdy \\ Normal s\".\n with Some show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (DynCom c)\n have hyp: \"\\c' s'. \\\\ (DynCom c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have \"\\\\ (DynCom c, Normal s) \\ (c s, Normal s)\"\n by (simp add: step.DynCom)\n from hyp [OF this] have \"\\\\c s \\ Normal s\".\n then show ?case\n by (auto intro: terminates.intros)\nnext\n case (Guard f g c)\n have hyp: \"\\c' s'. \\\\ (Guard f g c, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n show ?case\n proof (cases \"s\\g\")\n case True\n then have \"\\\\ (Guard f g c, Normal s) \\ (c, Normal s) \"\n by (simp add: step.Guard) thm step.Guard\n from hyp [OF this] have \"\\\\c\\ Normal s\".\n with True show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n thus ?thesis\n by (auto intro: terminates.intros)\n qed\nnext \n case Throw show ?case by (auto intro: terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp: \"\\c' s'. \\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (c', s') \\ \\\\c' \\ s'\" by fact\n have hyp': \"~(\\b c1. redex (Catch c\\<^sub>1 c\\<^sub>2) = Await b c1)\" by fact\n show ?case\n proof (rule terminates.Catch)\n {\n fix c' s'\n assume step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\ (c', s')\"\n assume red: \"~(\\b c1. redex c\\<^sub>1 = Await b c1)\"\n have \"\\\\c' \\ s'\"\n proof -\n from step_c\\<^sub>1\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c' c\\<^sub>2, s') \"\n by (simp add: step.Catch)\n from hyp [OF this]\n have \"\\\\Catch c' c\\<^sub>2 \\ s'\".\n thus \"\\\\c'\\ s'\"\n by cases auto\n qed\n } \n from Catch.hyps (1) [OF this]\n show \"\\\\c\\<^sub>1 \\ Normal s\" using hyp' by force\n next \n show \"\\s'. \\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s' \\ \\\\c\\<^sub>2 \\ Normal s'\"\n proof (intro allI impI)\n fix s'\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal s\\ \\ Abrupt s'\"\n show \"\\\\c\\<^sub>2 \\ Normal s'\"\n proof (cases \"final (c\\<^sub>1,Normal s)\")\n case True\n with exec_c\\<^sub>1\n have Throw: \"c\\<^sub>1=Throw\"\n by (auto simp add: final_def elim: exec_Normal_elim_cases)\n have s1: \"\\\\(Catch Throw c\\<^sub>2,Normal s) \\ (c\\<^sub>2,Normal s)\"\n by (simp add: step.CatchThrow)\n from hyp \n have \"\\\\c\\<^sub>2 \\ Normal s\" using local.Throw s1 by blast \n moreover from exec_c\\<^sub>1 Throw\n have \"s'=s\"\n by (auto elim: exec_Normal_elim_cases)\n ultimately show ?thesis by simp\n next\n case False\n from exec_impl_steps [OF exec_c\\<^sub>1]\n obtain c\\<^sub>f t where \n steps_c\\<^sub>1: \"\\\\ (c\\<^sub>1, Normal s) \\\\<^sup>* (Throw, Normal s')\" \n by (fastforce split: xstate.splits)\n from split_computation [OF steps_c\\<^sub>1 False]\n obtain c'' s'' where\n first: \"\\\\ (c\\<^sub>1, Normal s) \\ (c'', s'')\" and\n rest: \"\\\\ (c'', s'') \\\\<^sup>* (Throw, Normal s')\" \n by (auto simp add: final_def)\n from step.Catch [OF first]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, Normal s) \\ (Catch c'' c\\<^sub>2, s'')\" by auto\n from hyp [OF this] \n have \"\\\\Catch c'' c\\<^sub>2 \\ s''\".\n moreover\n from steps_Throw_impl_exec [OF rest]\n have \"\\\\ \\c'',s''\\ \\ Abrupt s'\".\n moreover\n from rest obtain x where \"s''=Normal x\"\n by (cases s'')\n (auto dest: steps_Fault_prop steps_Abrupt_prop steps_Stuck_prop)\n ultimately show ?thesis\n by (fastforce elim: terminates_elim_cases)\n qed\n qed\n qed\nnext\n case (Await b c) \n show ?case\n using Await.prems(2) by auto \nqed\n\n\nlemma Await_finish:\"\\c2 s2 b c. \\\\ (Await b c, s1) \\ (c2, s2) \\ \\\\c2 \\ s2\"\nby (metis Abrupt Fault Stuck final_termi step_await_final1 step_preserves_termination xstate.exhaust)\n\n \nlemma wf_implies_termi_reach:\nassumes wf: \"wf {(cfg2,cfg1). \\ \\ (c,s) \\\\<^sup>* cfg1 \\ \\ \\ cfg1 \\ cfg2}\"\nshows \"\\c1 s1. \\\\ \\ (c,s) \\\\<^sup>* cfg1; cfg1=(c1,s1)\\\\ \\\\c1\\s1\"\nusing wf \nproof (induct cfg1,simp)\n fix c1 s1\n assume reach: \"\\\\ (c, s) \\\\<^sup>* (c1, s1)\"\n assume hyp_raw: \"\\y c2 s2.\n \\\\\\ (c1, s1) \\ (c2, s2); \\\\ (c, s) \\\\<^sup>* (c2, s2); y = (c2, s2)\\\n \\ \\\\c2 \\ s2\"\n have hyp: \"\\c2 s2. \\\\ (c1, s1) \\ (c2, s2) \\ \\\\c2 \\ s2\"\n apply -\n apply (rule hyp_raw)\n apply assumption\n using reach \n apply simp\n apply (rule refl)\n done\n \n show \"\\\\c1 \\ s1\"\n proof (cases s1) \n case (Normal s1') \n with wf_implies_termi_reach_step_case' [OF hyp [simplified Normal]] \n show ?thesis\n by auto\n qed (auto intro: terminates.intros)\nqed\n\ntheorem no_infinite_computation_impl_terminates:\n assumes not_inf: \"\\ \\\\ (c, s) \\ \\(\\)\"\n shows \"\\\\c\\s\"\nproof -\n from no_infinite_computation_implies_wf [OF not_inf]\n have wf: \"wf {(c2, c1). \\\\(c, s) \\\\<^sup>* c1 \\ \\\\c1 \\ c2}\".\n show ?thesis\n by (rule wf_implies_termi_reach [OF wf]) auto\nqed\n\ncorollary terminates_iff_no_infinite_computation: \n \"\\\\c\\s = (\\ \\\\ (c, s) \\ \\(\\))\"\n apply (rule)\n apply (erule terminates_impl_no_infinite_computation)\n apply (erule no_infinite_computation_impl_terminates)\n done\n\n(* ************************************************************************* *)\nsubsection {* Generalised Redexes *} \n(* ************************************************************************* *)\n\ntext {*\nFor an important lemma for the completeness proof of the Hoare-logic for\ntotal correctness we need a generalisation of @{const \"redex\"} that not only\nyield the redex itself but all the enclosing statements as well.\n*}\n\nprimrec redexes:: \"('s,'p,'f,'e)com \\ ('s,'p,'f,'e)com set\"\nwhere\n\"redexes Skip = {Skip}\" |\n\"redexes (Basic f) = {Basic f}\" |\n\"redexes (Spec r) = {Spec r}\" |\n\"redexes (Seq c\\<^sub>1 c\\<^sub>2) = {Seq c\\<^sub>1 c\\<^sub>2} \\ redexes c\\<^sub>1\" |\n\"redexes (Cond b c\\<^sub>1 c\\<^sub>2) = {Cond b c\\<^sub>1 c\\<^sub>2}\" |\n\"redexes (While b c) = {While b c}\" |\n\"redexes (Call p) = {Call p}\" |\n\"redexes (DynCom d) = {DynCom d}\" |\n\"redexes (Guard f b c) = {Guard f b c}\" |\n\"redexes (Throw) = {Throw}\" |\n\"redexes (Catch c\\<^sub>1 c\\<^sub>2) = {Catch c\\<^sub>1 c\\<^sub>2} \\ redexes c\\<^sub>1\" |\n\"redexes (Await b c) = {Await b c}\"\n\nlemma root_in_redexes: \"c \\ redexes c\"\n apply (induct c)\n apply auto\n done\n\nlemma redex_in_redexes: \"redex c \\ redexes c\"\n apply (induct c)\n apply auto\n done\n\nlemma redex_redexes: \"\\c'. \\c' \\ redexes c; redex c' = c'\\ \\ redex c = c'\" \n apply (induct c)\n apply auto\n done\n\nlemma step_redexes:\n shows \"\\r r'. \\\\\\(r,s) \\ (r',s'); r \\ redexes c\\ \n \\ \\c'. \\\\(c,s) \\ (c',s') \\ r' \\ redexes c'\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case Basic thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case Spec thus ?case by (fastforce intro: step.intros elim: step_elim_cases)\nnext\n case (Seq c\\<^sub>1 c\\<^sub>2)\n have \"r \\ redexes (Seq c\\<^sub>1 c\\<^sub>2)\" by fact\n hence r: \"r = Seq c\\<^sub>1 c\\<^sub>2 \\ r \\ redexes c\\<^sub>1\"\n by simp\n have step_r: \"\\\\ (r, s) \\ (r', s')\" by fact\n from r show ?case\n proof \n assume \"r = Seq c\\<^sub>1 c\\<^sub>2\"\n with step_r\n show ?case\n by (auto simp add: root_in_redexes)\n next\n assume r: \"r \\ redexes c\\<^sub>1\"\n from Seq.hyps (1) [OF step_r this] \n obtain c' where \n step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, s) \\ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n from step.Seq [OF step_c\\<^sub>1]\n have \"\\\\ (Seq c\\<^sub>1 c\\<^sub>2, s) \\ (Seq c' c\\<^sub>2, s')\".\n with r'\n show ?case\n by auto\n qed\nnext\n case Cond \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case While \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Call thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case DynCom thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Guard thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case Throw thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"r \\ redexes (Catch c\\<^sub>1 c\\<^sub>2)\" by fact\n hence r: \"r = Catch c\\<^sub>1 c\\<^sub>2 \\ r \\ redexes c\\<^sub>1\"\n by simp\n have step_r: \"\\\\ (r, s) \\ (r', s')\" by fact\n from r show ?case\n proof \n assume \"r = Catch c\\<^sub>1 c\\<^sub>2\"\n with step_r\n show ?case\n by (auto simp add: root_in_redexes)\n next\n assume r: \"r \\ redexes c\\<^sub>1\"\n from Catch.hyps (1) [OF step_r this] \n obtain c' where \n step_c\\<^sub>1: \"\\\\ (c\\<^sub>1, s) \\ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n from step.Catch [OF step_c\\<^sub>1]\n have \"\\\\ (Catch c\\<^sub>1 c\\<^sub>2, s) \\ (Catch c' c\\<^sub>2, s')\".\n with r'\n show ?case\n by auto\n qed\nnext case (Await b c) \n thus ?case \n by (fastforce intro: step.intros elim: step_elim_cases simp add: root_in_redexes)\nqed \n\nlemma steps_redexes:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. r \\ redexes c \\ \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ r' \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then\n show \"\\c'. \\\\ (c, s') \\\\<^sup>* (c', s') \\ r' \\ redexes c'\"\n by auto\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"r \\ redexes c\" by fact+\n from step_redexes [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"r'' \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"r' \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\n\n\nlemma steps_redexes':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. r \\ redexes c \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ r' \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"r \\ redexes c'\" by fact+\n from step_redexes [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"r' \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"r'' \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma step_redexes_Seq:\n assumes step: \"\\\\(r,s) \\ (r',s')\"\n assumes Seq: \"Seq r c\\<^sub>2 \\ redexes c\"\n shows \"\\c'. \\\\(c,s) \\ (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nproof -\n from step.Seq [OF step]\n have \"\\\\ (Seq r c\\<^sub>2, s) \\ (Seq r' c\\<^sub>2, s')\".\n from step_redexes [OF this Seq] \n show ?thesis .\nqed\n\nlemma steps_redexes_Seq:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. Seq r c\\<^sub>2 \\ redexes c \\ \n \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then show ?case\n by (auto)\n\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"Seq r c\\<^sub>2 \\ redexes c\" by fact+\n from step_redexes_Seq [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"Seq r'' c\\<^sub>2 \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"Seq r' c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\nlemma steps_redexes_Seq':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. Seq r c\\<^sub>2 \\ redexes c \n \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ Seq r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"Seq r c\\<^sub>2 \\ redexes c'\" by fact+\n from step_redexes_Seq [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"Seq r' c\\<^sub>2 \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes_Seq [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"Seq r'' c\\<^sub>2 \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma step_redexes_Catch:\n assumes step: \"\\\\(r,s) \\ (r',s')\"\n assumes Catch: \"Catch r c\\<^sub>2 \\ redexes c\"\n shows \"\\c'. \\\\(c,s) \\ (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nproof -\n from step.Catch [OF step]\n have \"\\\\ (Catch r c\\<^sub>2, s) \\ (Catch r' c\\<^sub>2, s')\".\n from step_redexes [OF this Catch] \n show ?thesis .\nqed\n\nlemma steps_redexes_Catch:\n assumes steps: \"\\\\ (r, s) \\\\<^sup>* (r', s')\"\n shows \"\\c. Catch r c\\<^sub>2 \\ redexes c \\ \n \\c'. \\\\(c,s) \\\\<^sup>* (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: converse_rtranclp_induct2 [case_names Refl Trans])\n case Refl\n then show ?case\n by (auto)\n\nnext\n case (Trans r s r'' s'')\n have \"\\\\ (r, s) \\ (r'', s'')\" \"Catch r c\\<^sub>2 \\ redexes c\" by fact+\n from step_redexes_Catch [OF this]\n obtain c' where\n step: \"\\\\ (c, s) \\ (c', s'')\" and\n r'': \"Catch r'' c\\<^sub>2 \\ redexes c'\"\n by blast\n note step\n also\n from Trans.hyps (3) [OF r'']\n obtain c'' where\n steps: \"\\\\ (c', s'') \\\\<^sup>* (c'', s')\" and\n r': \"Catch r' c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps\n finally\n show ?case\n using r'\n by blast\nqed\n\nlemma steps_redexes_Catch':\n assumes steps: \"\\\\ (r, s) \\\\<^sup>+ (r', s')\"\n shows \"\\c. Catch r c\\<^sub>2 \\ redexes c \n \\ \\c'. \\\\(c,s) \\\\<^sup>+ (c',s') \\ Catch r' c\\<^sub>2 \\ redexes c'\"\nusing steps \nproof (induct rule: tranclp_induct2 [consumes 1, case_names Step Trans])\n case (Step r' s' c') \n have \"\\\\ (r, s) \\ (r', s')\" \"Catch r c\\<^sub>2 \\ redexes c'\" by fact+\n from step_redexes_Catch [OF this]\n show ?case\n by (blast intro: r_into_trancl)\nnext\n case (Trans r' s' r'' s'')\n from Trans obtain c' where\n steps: \"\\\\ (c, s) \\\\<^sup>+ (c', s')\" and\n r': \"Catch r' c\\<^sub>2 \\ redexes c'\"\n by blast\n note steps\n moreover\n have \"\\\\ (r', s') \\ (r'', s'')\" by fact\n from step_redexes_Catch [OF this r'] obtain c'' where\n step: \"\\\\ (c', s') \\ (c'', s'')\" and\n r'': \"Catch r'' c\\<^sub>2 \\ redexes c''\"\n by blast\n note step\n finally show ?case\n using r'' by blast\nqed\n\nlemma redexes_subset:\"\\c'. c' \\ redexes c \\ redexes c' \\ redexes c\"\n by (induct c) auto\n\nlemma redexes_preserves_termination:\n assumes termi: \"\\\\c\\s\"\n shows \"\\c'. c' \\ redexes c \\ \\\\c'\\s\" \nusing termi\nby induct (auto intro: terminates.intros)\n\n*)\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/SmallStepCon-david-ThinkPad-X1-Carbon-5th.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883592602049, "lm_q2_score": 0.4225046348141882, "lm_q1q2_score": 0.25358236354895963}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Cong_Subst_Pres\n imports Weak_Late_Cong_Subst Weak_Late_Cong_Pres\nbegin\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"\\.(P) \\\\<^sup>s \\.(Q)\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.tauPres)\n\nlemma inputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and x :: name\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n\n shows \"a.P \\\\<^sup>s a.Q\"\nproof(auto simp add: substClosed_def)\n fix \\ :: \"(name \\ name) list\"\n {\n fix P Q a x \\\n assume \"P \\\\<^sup>s Q\"\n then have \"P[<\\>] \\\\<^sup>s Q[<\\>]\" by(rule partUnfold)\n then have \"\\y. (P[<\\>])[x::=y] \\ (Q[<\\>])[x::=y]\"\n apply(auto simp add: substClosed_def)\n by(erule_tac x=\"[(x, y)]\" in allE) auto\n moreover assume \"x \\ \\\"\n ultimately have \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" using weakBisimEqvt\n by(force intro: Weak_Late_Cong_Pres.inputPres)\n }\n note Goal = this\n\n obtain y::name where \"y \\ P\" and \"y \\ Q\" and \"y \\ \\\"\n by(generate_fresh \"name\") auto\n from \\P \\\\<^sup>s Q\\ have \"([(x, y)] \\ P) \\\\<^sup>s ([(x, y)] \\ Q)\" by(rule eqvtI)\n hence \"(a.([(x, y)] \\ P))[<\\>] \\ (a.([(x, y)] \\ Q))[<\\>]\" using \\y \\ \\\\ by(rule Goal)\n moreover from \\y \\ P\\ \\y \\ Q\\ have \"a.P = a.([(x, y)] \\ P)\" and \"a.Q = a.([(x, y)] \\ Q)\"\n by(simp add: pi.alphaInput)+\n\n ultimately show \"(a.P)[<\\>] \\ (a.Q)[<\\>]\" by simp\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"a{b}.P \\\\<^sup>s a{b}.Q\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.outputPres)\n\n\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"[a\\b]P \\\\<^sup>s [a\\b]Q\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.matchPres)\n\nlemma sumPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"P \\ R \\\\<^sup>s Q \\ R\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.sumPres)\n\nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\\\<^sup>s Q\"\n\n shows \"P \\ R \\\\<^sup>s Q \\ R\"\nusing assms\nby(force simp add: substClosed_def Weak_Late_Cong_Pres.parPres)\n\n\n\n assumes PeqQ: \"P \\\\<^sup>s Q\"\n \n shows \"<\\x>P \\\\<^sup>s <\\x>Q\"\nproof(auto simp add: substClosed_def)\n fix s::\"(name \\ name) list\"\n\n have Goal: \"\\P Q x s. \\P[] \\ Q[]; x \\ s\\ \\ (<\\x>P)[] \\ (<\\x>Q)[]\"\n by(force intro: Weak_Late_Step_Sim_Pres.resPres Weak_Late_Bisim_Pres.resPres Weak_Late_Bisim.eqvt)\n \n have \"\\c::name. c \\ (P, Q, s)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshP: \"c \\ P\" and cFreshQ: \"c \\ Q\" and cFreshs: \"c \\ s\"\n by(force simp add: fresh_prod)\n\n from PeqQ have \"P[<([(x, c)] \\ s)>] \\ Q[<([(x, c)] \\ s)>]\" and \n \"Q[<([(x, c)] \\ s)>] \\ P[<([(x, c)] \\ s)>]\"\n by(force simp add: congruenceSubstDef)+\n\n hence \"([(x, c)] \\ (P[<([(x, c)] \\ s)>])) \\ ([(x, c)] \\ (Q[<([(x, c)] \\ s)>]))\" and \n \"([(x, c)] \\ (Q[<([(x, c)] \\ s)>])) \\ ([(x, c)] \\ (P[<([(x, c)] \\ s)>]))\"\n by(blast intro: Weak_Late_Step_Sim.eqvtI Weak_Late_Bisim.eqvt)+\n\n hence \"([(x, c)] \\ P)[] \\ ([(x, c)] \\ Q)[]\" and\n \"([(x, c)] \\ Q)[] \\ ([(x, c)] \\ P)[]\" by simp+\n\n with cFreshs have \"(<\\c>([(x, c)] \\ P))[] \\ (<\\c>([(x, c)] \\ Q))[]\" and\n \"(<\\c>([(x, c)] \\ Q))[] \\ (<\\c>([(x, c)] \\ P))[]\"\n by(blast intro: Goal)+\n\n moreover from cFreshP cFreshQ have \"<\\x>P = <\\c>([(x, c)] \\ P)\" and \"<\\x>Q = <\\c>([(x, c)] \\ Q)\"\n by(simp add: alphaRes)+\n\n ultimately show \"(<\\x>P)[] \\ (<\\x>Q)[]\"\n by(simp add: congruence_def)\nqed\n\nlemma congruenceBang:\n fixes P :: pi\n and Q :: pi\n \n assumes \"P \\\\<^sup>s Q\"\n\n shows \"!P \\\\<^sup>s !Q\"\nusing assms\nby(force simp add: substClosed_def intro: Weak_Late_Cong_Pres.congruenceBang)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Cong_Subst_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.25353439273006523}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__34.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__34 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__34 and some rule r*}\nlemma n_RecvReqSVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__0Vsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__0 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__1Vsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__1 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__34:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__34 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__34:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__34.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.25337826650444567}} {"text": "subsection \\Formulation of a subject-subject communication policy and an information flow \npolicy, and showing both can be derived from subject-object configuration data\\\n\ntheory Step_policies\n imports Step_configuration\nbegin\n\nsubsubsection \\Specification\\label{sect:policy_specification}\\\n\ntext \\In order to use CISK, we need an information flow policy @{term ifp}\n relation. \n We also express a static subject-subject @{term sp_spec_subj_obj} and subject-object @{term sp_spec_subj_subj} access control policy\n for the implementation of the model. The following locale summarizes\n all properties we need.\\\n\nlocale policy_axioms =\n fixes sp_spec_subj_obj :: \"'a \\ obj_id_t \\ mode_t \\ bool\"\n and sp_spec_subj_subj :: \"'a \\ 'a \\ bool\"\n and ifp :: \"'a \\ 'a \\ bool\"\n\n assumes sp_spec_file_provider: \"\\ p1 p2 f m1 m2 .\n sp_spec_subj_obj p1 (FILEP f) m1 \\\n sp_spec_subj_obj p2 (FILEP f) m2 \\ sp_spec_subj_subj p1 p2\"\n\n and sp_spec_no_wronly_pages:\n \"\\ p x . sp_spec_subj_obj p (PAGE x) WRITE \\ sp_spec_subj_obj p (PAGE x) READ\"\n\n and ifp_reflexive:\n \"\\ p . ifp p p\"\n\n and ifp_compatible_with_sp_spec:\n \"\\ a b . sp_spec_subj_subj a b \\ ifp a b \\ ifp b a\"\n\n and ifp_compatible_with_ipc:\n \"\\ a b c x . (sp_spec_subj_subj a b\n \\ sp_spec_subj_obj b (PAGE x) WRITE \\ sp_spec_subj_obj c (PAGE x) READ)\n \\ ifp a c\"\nbegin (* empty *) end\n\nsubsubsection \\Derivation\\\n\ntext \\The configuration data only consists of a subject-object policy. \nWe derive the subject-subject policy and the information flow policy from the configuration data and prove that properties we specified in Section~\\ref{sect:policy_specification} are satisfied.\\\n\nlocale abstract_policy_derivation =\n fixes configuration_subj_obj :: \"'a \\ obj_id_t \\ mode_t \\ bool\"\nbegin\n\n definition \"sp_spec_subj_obj a x m \\\n configuration_subj_obj a x m \\ (\\ y . x = PAGE y \\ m = READ \\ configuration_subj_obj a x WRITE)\"\n\n definition \"sp_spec_subj_subj a b \\\n \\ f m1 m2 . sp_spec_subj_obj a (FILEP f) m1 \\ sp_spec_subj_obj b (FILEP f) m2\"\n\n definition \"ifp a b \\\n sp_spec_subj_subj a b\n \\ sp_spec_subj_subj b a\n \\ (\\ c y . sp_spec_subj_subj a c\n \\ sp_spec_subj_obj c (PAGE y) WRITE\n \\ sp_spec_subj_obj b (PAGE y) READ)\n \\ (a = b)\"\n\ntext \\Show that the policies specified in Section~\\ref{sect:policy_specification} can be derived from the configuration and their definitions.\\\n\n lemma correct:\n shows \"policy_axioms sp_spec_subj_obj sp_spec_subj_subj ifp\"\n proof (unfold_locales)\n show sp_spec_file_provider:\n \"\\ p1 p2 f m1 m2 .\n sp_spec_subj_obj p1 (FILEP f) m1 \\\n sp_spec_subj_obj p2 (FILEP f) m2 \\ sp_spec_subj_subj p1 p2\"\n unfolding sp_spec_subj_subj_def by auto\n show sp_spec_no_wronly_pages:\n \"\\ p x . sp_spec_subj_obj p (PAGE x) WRITE \\ sp_spec_subj_obj p (PAGE x) READ\"\n unfolding sp_spec_subj_obj_def by auto\n show ifp_reflexive:\n \"\\ p . ifp p p\"\n unfolding ifp_def by auto\n show ifp_compatible_with_sp_spec:\n \"\\ a b . sp_spec_subj_subj a b \\ ifp a b \\ ifp b a\"\n unfolding ifp_def by auto\n show ifp_compatible_with_ipc:\n \"\\ a b c x . (sp_spec_subj_subj a b\n \\ sp_spec_subj_obj b (PAGE x) WRITE \\ sp_spec_subj_obj c (PAGE x) READ)\n \\ ifp a c\"\n unfolding ifp_def by auto\n qed\nend\n\ntype_synonym sp_subj_subj_t = \"partition_id_t \\ partition_id_t \\ bool\"\ntype_synonym sp_subj_obj_t = \"partition_id_t \\ obj_id_t \\ mode_t \\ bool\"\n\ninterpretation Policy: abstract_policy_derivation \"configured_subj_obj\".\ninterpretation Policy_properties: policy_axioms Policy.sp_spec_subj_obj Policy.sp_spec_subj_subj Policy.ifp\n using Policy.correct by auto\n\nlemma example_how_to_use_properties_in_proofs:\n shows \"\\ p . Policy.ifp p p\"\n using Policy_properties.ifp_reflexive by auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CISC-Kernel/step/Step_policies.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.25337826650444567}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: XVCGCon.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory XVcgCon \nimports VcgSeq\n\nbegin\n\n\ntext {* We introduce a syntactic variant of the let-expression so that we can\nsafely unfold it during verification condition generation. With the new\ntheorem attribute @{text \"vcg_simp\"} we can declare equalities to be used\nby the verification condition generator, while simplifying assertions.\n*}\n\nsyntax\n\"_Let'\" :: \"[letbinds, basicblock] => basicblock\" (\"(LET (_)/ IN (_))\" 23)\n \ntranslations\n \"_Let' (_binds b bs) e\" == \"_Let' b (_Let' bs e)\"\n \"_Let' (_bind x a) e\" == \"CONST Let' a (%x. e)\"\n\n\nlemma Let'_unfold : \"Let' x f = f x\"\n by (simp add: Let'_def Let_def)\n \nlemma Let'_split_conv: \n \"(Let' x (\\p. (case_prod (f p) (g p)))) = \n (Let' x (\\p. (f p) (fst (g p)) (snd (g p))))\"\n by (simp add: split_def)\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/XVcgCon.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749126, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.2533782600659146}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* Automatic instantiation of an AutoCorres C state space as a separation algebra.\n FIXME: this is not quite finished. There are some proof tactics missing (see getter_rewrite etc)\n*)\ntheory Auto_Separation_Algebra\nimports \"AutoCorres\" \"Sep_Algebra.Separation_Algebra\"\nkeywords \"sep_instance\" :: thy_goal\nbegin\n\n\nlemmas sep_conj_def = Separation_Algebra.sep_algebra_class.sep_conj_def\n\ninstantiation \"unit\" :: stronger_sep_algebra\n begin\n definition \"zero_unit \\ ()\"\n definition \"plus_unit \\ (\\h2 h2. ()) :: unit \\ unit \\ unit\"\n definition \"sep_disj_unit \\(\\h1 h2. True) :: unit \\ unit \\ bool\"\n instance\n apply (standard)\n apply (clarsimp simp: zero_unit_def plus_unit_def sep_disj_unit_def)+\n done\nend\n\ninstantiation \"bool\" :: stronger_sep_algebra\n begin\n definition \"zero_bool \\ False\"\n definition \"plus_bool \\ (\\)\"\n definition \"sep_disj_bool \\ \\p q. p \\ \\q\"\n instance\n apply (standard)\n apply (auto simp: zero_bool_def plus_bool_def sep_disj_bool_def)+\n done\nend\n\n instantiation \"fun\" :: (type,stronger_sep_algebra) stronger_sep_algebra\n begin\n definition \"zero_fun \\ (\\x. 0)\"\n definition \"plus_fun f f' \\ (\\x. if f x = 0 then f' x else f x)\"\n definition \"sep_disj_fun \\ (\\f f'. \\x. (f x = 0 \\ f' x = 0)) :: ('a \\ 'b) \\ ('a \\ 'b) \\ bool \"\n instance\n apply standard\n apply (fastforce simp: zero_fun_def sep_disj_fun_def plus_fun_def)+\n apply (clarsimp simp: zero_fun_def sep_disj_fun_def plus_fun_def, safe)\n apply (fastforce)+\n done\nend\n\n\nML \\\ntype sep_info =\n{\n plus_thm : thm option,\n disj_thm : thm option,\n zero_thm : thm option,\n sep_thms : thm list,\n sep_heap_arrows : (term * thm) Typtab.table,\n sep_heap_getters : (term * thm) Typtab.table,\n sep_heap_setters : (term * thm) Typtab.table\n}\n\nfun mk_sep_info (plus_thm : thm option) (disj_thm : thm option) (zero_thm : thm option)\n (sep_heap_arrows : (term * thm) Typtab.table) (sep_heap_getters : (term * thm) Typtab.table)\n ( sep_heap_setters : (term * thm) Typtab.table) (sep_thms : thm list) =\n {plus_thm = plus_thm,\n disj_thm = disj_thm,\n zero_thm = zero_thm,\n sep_thms = sep_thms,\n sep_heap_arrows = sep_heap_arrows,\n sep_heap_getters = sep_heap_getters,\n sep_heap_setters = sep_heap_setters}\n\\\n\nML \\\n\nfun upd_plus_thm (sep_info : sep_info) plus =\n {plus_thm = plus,\n disj_thm = #disj_thm sep_info,\n zero_thm = #zero_thm sep_info,\n sep_thms = #sep_thms sep_info,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_disj_thm (sep_info : sep_info) disj =\n {plus_thm = #plus_thm sep_info,\n disj_thm = disj,\n zero_thm = #zero_thm sep_info,\n sep_thms = #sep_thms sep_info,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_zero_thm (sep_info : sep_info) zero =\n {plus_thm = #plus_thm sep_info,\n disj_thm = #disj_thm sep_info,\n zero_thm = zero,\n sep_thms = #sep_thms sep_info,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_arrows (sep_info : sep_info) arr =\n {plus_thm = #plus_thm sep_info,\n disj_thm = #disj_thm sep_info,\n zero_thm = #zero_thm sep_info,\n sep_heap_arrows = arr,\n sep_thms = #sep_thms sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_getters (sep_info : sep_info) getters =\n {plus_thm = #plus_thm sep_info,\n disj_thm = #disj_thm sep_info,\n zero_thm = #zero_thm sep_info,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = getters,\n sep_thms = #sep_thms sep_info,\n sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_setters (sep_info : sep_info) setters =\n {plus_thm = #plus_thm sep_info,\n disj_thm = #disj_thm sep_info,\n zero_thm = #zero_thm sep_info,\n sep_thms = #sep_thms sep_info,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = setters}\n\nfun upd_thms (sep_info : sep_info) thms =\n {plus_thm = #plus_thm sep_info,\n disj_thm = #disj_thm sep_info,\n zero_thm = #zero_thm sep_info,\n sep_thms = thms,\n sep_heap_arrows = #sep_heap_arrows sep_info,\n sep_heap_getters = #sep_heap_getters sep_info,\n sep_heap_setters = #sep_heap_setters sep_info\n }\n\n\\\n\nML \\val print_type = dest_Type #> fst\\\n\nML \\fun mk_lifted_globals_record stateT rvals ctxt =\n let\n val xs = rvals\n val state_t = \"lifted_globals_ext\" |> Syntax.read_term ctxt\n in\n betapplys (state_t, xs)\n |> Syntax.check_term ctxt\nend;\n\\\n\nML \\\nval get_data = HeapInfo.get #> Symtab.lookup;\n\n\\\n\n\nML\\\nfun zero_lifted_globals subT global_types heap_types =\n let fun make_zero_heap heap_type = (@{mk_term \"(\\(_ :: ?'T ptr). arbitrary_zero :: (?'T))\" ('T)} heap_type)\n fun make_zero_valid_heap heap_type = (@{mk_term \"(\\_. False) :: ?'T ptr \\ bool\" ('T)} heap_type)\n fun make_zero global_type = @{mk_term \"arbitrary_zero :: ?'T\" ('T)} global_type\n in\n map make_zero global_types @\n map make_zero_heap heap_types @\n map make_zero_valid_heap heap_types @\n [@{term \"0\\<^sub>? :: 'b\"}] |>\n mk_lifted_globals_record subT\nend;\n\nval make_conj = @{mk_term \"?P \\ ?Q\" (P, Q)}\n\nval make_conj_list = foldr1 make_conj;\n\nfun get_more ctxt t = \"lifted_globals.more\" |> Syntax.read_term ctxt\n\\\n\n\ndeclare [[ML_print_depth=1000]]\n\nML \\\nfun promote subT (Const (str, typ)) = Const (str, subT --> (typ |> range_type));\n\\\n\nML \\\n\nfun sep_disj_lifted_globals ctxt subT heap_types heap_valid_getters h1 h2 =\nlet\n fun make_valid_disjoint heap_type =\n let val heap_valid_getter = Typtab.lookup heap_valid_getters heap_type |> the |> Const |> promote subT\n (* val heap_valid_getter' = Const (fst heap_valid_getter, subT --> (heap_valid_getter |> snd |> range_type)) *)\n in\n @{mk_term \"(\\ l r. ?f l ## (?f r)) \" (f)} (heap_valid_getter) $ h1 $ h2\n end;\n val typ = subT |> dest_Type |> snd |> hd;\n val more = get_more ctxt subT\n (* val more_disjoint = @{mk_term \"\\(f :: ?'T => ?'M :: stronger_sep_algebra) (l:: ?'T) (r :: ?'T ).\n (f l) ## (f r)\" ('T, 'M)} (subT, typ) $ more $ h1 $ h2 *)\n val is_valid_disjoint = map make_valid_disjoint heap_types\nin\n make_conj_list is_valid_disjoint\nend;\n\\\n\n\nML \\fun setup_heap_zero stateT heap_type global_types sep_info ctxt =\nlet\n val (_, thm, ctxt) = Utils.define_const_args \"zero_lifted_globals_ext\" false (zero_lifted_globals stateT global_types heap_type ctxt) [] ctxt\nin\n (upd_zero_thm sep_info (SOME thm), ctxt)\nend\\\n\nML \\fun setup_heap_disj stateT heap_types heap_valid_getters sep_info ctxt =\nlet\n val term = sep_disj_lifted_globals ctxt stateT heap_types heap_valid_getters (Free (\"s0\", stateT)) (Free (\"s1\", stateT))\n val (_, thm, ctxt') = Utils.define_const_args \"sep_disj_lifted_globals_ext\" false (term) [(\"s0\", stateT), (\"s1\", stateT)] ctxt\nin\n (upd_disj_thm sep_info (SOME thm), ctxt')\nend\\\n\n\n\nML\\\nfun plus_lifted_globals ctxt subT global_names global_getters heap_types heap_getters heap_valid_getters h1 h2 =\nlet\n\n fun make_global_plus global_name =\n let val global_getter = global_name |> Symtab.lookup global_getters |> the |> snd |> promote subT\n\n in @{mk_term \"\\l r. arbitrary_add (?f l) (?f r)\"(f)} global_getter $ h1 $ h2 end;\n\n fun make_heap_plus heap_type =\n let val heap_getter = heap_type |> Typtab.lookup heap_getters |> the |> Const |> promote subT\n val heap_valid_getter = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const |> promote subT\n in\n (@{mk_term\n \"\\l r.\n \\x. if ?valid l x then ?heap l x else if ?valid r x then ?heap r x else\n arbitrary_add ( ?heap l x) ( ?heap r x) \" (heap, valid)}\n (heap_getter, heap_valid_getter) $ h1 $ h2)\n end;\n\n fun make_heap_valid_plus heap_type =\n let val heap_valid_getter = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const |> promote subT\n in\n (@{mk_term \"\\l r.\n (?valid l) + (?valid r)\" (valid)} heap_valid_getter $ h1 $ h2)\n end;\n val typ = subT |> dest_Type |> snd |> hd;\n val more = get_more ctxt subT\n\nin\n map make_global_plus global_names @\n map make_heap_plus heap_types @\n map make_heap_valid_plus heap_types @\n [(@{mk_term \"\\l r.\n arbitrary_add (?f l) (?f r)\" (f)} (more) $ h1 $ h2)] |>\n mk_lifted_globals_record subT\nend;\n\n\\\n\nML \\\nfun setup_heap_plus stateT global_names global_getters heap_types heap_getters heap_valid_getters sep_info ctxt =\nlet\n val term = (plus_lifted_globals ctxt stateT global_names global_getters heap_types\n heap_getters heap_valid_getters (Free (\"s0\", stateT)) (Free (\"s1\", stateT)) ctxt)\n val (_, thm, ctxt') = Utils.define_const_args \"plus_lifted_globals_ext\" false term\n [(\"s0\", stateT), (\"s1\", stateT)] ctxt\nin\n (upd_plus_thm sep_info (SOME thm), ctxt')\nend;\n\n\n\\\n\nML \\\n\n fun make_arrow stateT heap_type heap_getters heap_valid_getters p v=\n let\n val heap_getter = heap_type |> Typtab.lookup heap_getters |> the |> Const\n val heap_valid = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const\n in\n @{mk_term \"\\p v s. ?h s p = v \\ ?v' s p\" (h, v')}\n (heap_getter, heap_valid) $ p $ v\n end;\n\n fun split_on _ [] = [] |\n split_on f (x::xs) = if f x then xs else split_on f xs ;\n\n filter;\n\n fun hds s = String.substring (s,0,1)\n\n fun setup_arrows stateT heap_types heap_getters heap_valid_getters sep_info ctxt =\n let\n val (arrowt, _, ctxt') = Utils.define_const_args \"sep_generic_arrow\" true\n (@{mk_term \"undefined :: (?'h ptr => ?'h => ?'T \\ bool)\" ('T, 'h) } (stateT, @{typ 'h})) [] ctxt\n val ctxt'' = Local_Theory.notation true Syntax.mode_default\n [(arrowt, Infixl (Input.string \"\\s\", 50, Position.no_range))] ctxt'\n fun setup_arrow (heap_type,(sep_info,ctxt)) =\n let\n val pointer = (Free (\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]))\n val value = (Free (\"v\", heap_type))\n val term = (make_arrow stateT heap_type heap_getters heap_valid_getters pointer value)\n val arr_name = \"sep_map_\" ^ HeapLiftBase.name_from_type heap_type\n val arrow = \"\\\" ^ (HeapLiftBase.name_from_type heap_type |> hds)\n val fix = Infixl (Input.string arrow, 50, Position.no_range)\n val (t , thm, ctxt') = Utils.define_const_args arr_name false term\n [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]) , (\"v\", heap_type) ] ctxt\n val ctxt'' = Local_Theory.notation true Syntax.mode_default [(t , fix)] ctxt'\n val genarrowstr = arrowt |> dest_Const |> fst\n val sep_info = sep_info |> #sep_heap_arrows |> Typtab.update (heap_type, (t,thm)) |> upd_heap_arrows sep_info\n in\n (sep_info, ctxt'' |>\n Local_Theory.declaration {syntax = true, pervasive = false} (K (Adhoc_Overloading.generic_add_overloaded genarrowstr )) |>\n Local_Theory.declaration {syntax = true, pervasive = false} (K (Adhoc_Overloading.generic_add_variant genarrowstr t)))\n end;\n in foldr setup_arrow (sep_info,ctxt'') heap_types\n end;\n\n\\\n\nML \\Utils.expand_type_abbrevs; @{theory}; Proof_Context.theory_of;\\\n\nML \\fun liberalise_type _ (Type (s,[])) = (s,[]) |> Type |\n liberalise_type t (Type (s,(xs))) = if (Long_Name.base_name s) = \"lifted_globals_ext\" then\n (Type (s, t :: (tl xs))) else\n (Type (s, map (liberalise_type t) (xs)));\n\\\n\nML \\\n\nfun make_rewrite heap_getters heap_setters heap_type sep_info ctxt =\n let\n val heap_getter = heap_type |> Typtab.lookup heap_getters |> the |> Const\n val heap_setter = heap_type |> Typtab.lookup heap_setters |> the |> Const\n val get_heap_term = @{mk_term \"gets (\\s. ?f s p) \" (f)} (heap_getter)\n val set_heap_term = @{mk_term \"modify (?f (\\a. a(p := v)))\" (f)} heap_setter\n val (t, thy, ctxt) = Utils.define_const_args (\"get_\" ^ (HeapLiftBase.name_from_type heap_type)) false get_heap_term [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type])] ctxt\n val (t', thy', ctxt) = Utils.define_const_args (\"set_\" ^ (HeapLiftBase.name_from_type heap_type)) false set_heap_term [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]), (\"v\", heap_type)] ctxt\n val localise_term = @{mk_term \"modify (\\s. ?f (\\a. a(p:= f s)) (s)) \\ do v <- gets f; ?g p v od\" (f,g)} (heap_setter, t')\n val localise_simps = @{thms modify_def gets_def put_def fun_upd_def get_def return_def bind_def }\n val localise_term' = @{mk_term \"Trueprop (modify (\\s. ?f (\\a. a(p:= f a s)) s) = do a <- gets (\\s. f (?h s) s); ?g p a od)\" (f,h,g)} (heap_setter, heap_getter, t')\n val prove_localise = force_tac\n (ctxt addsimps localise_simps addsimps [thy'])\n val localise_thm = Goal.prove ctxt [\"f\", \"p\"] [] localise_term (fn _ => prove_localise 1)\n val localise'_thm = Goal.prove ctxt [\"f\", \"p\"] [] localise_term' (fn _ => prove_localise 1)\n val sep_info = sep_info |> #sep_thms |> (fn x => x @ [localise_thm, localise'_thm, Thm.symmetric thy,Thm.symmetric thy']) |> upd_thms sep_info\n val sep_info = sep_info |> #sep_heap_getters |> Typtab.update (heap_type, (t,thy)) |> upd_heap_getters sep_info\n val sep_info = sep_info |> #sep_heap_setters |> Typtab.update (heap_type, (t',thy')) |> upd_heap_setters sep_info\n in\n (sep_info, ctxt)\nend;\n\n\n\\\n\nML \\\nUtils.named_cterm_instantiate;\n\nfun make_struct_rewrite (structs : HeapLiftBase.struct_info list) sep_info ctxt =\n let\n val structs = structs |> map #field_info |> List.concat\n fun make_struct_rewrite_inner strct =\n let val getter = strct |> #getter\n val setter = strct |> #setter\n val getter_rewrite_term = @{mk_term \"Trueprop (gets (\\s. ?P (f s) ) =\n do c <- gets f;\n return (?P c )\n od )\" (P)} getter\n val getter_rewrite_term' = @{mk_term \"Trueprop (gets (\\s a. ?P (f s) ) =\n do c <- gets f;\n return (\\a. ?P c ) od )\" (P)} getter\n val setter_rewrite_term = @{mk_term \"Trueprop (gets (\\s . ?P (f s) (g s)) =\n do c <- gets f;\n d <- gets g;\n return ( ?P c d )\n od )\" (P)} setter\n val setter_rewrite_term' = @{mk_term \"Trueprop (gets (\\s a . ?P (f s) (g s)) =\n do c <- gets f;\n d <- gets g;\n return (\\a. ?P c d )\n od )\" (P)} setter\n val getter_rewrite = Goal.prove ctxt [\"f\"] [] getter_rewrite_term (fn _ => Skip_Proof.cheat_tac ctxt 1) (* FIXME: unfinished *)\n val getter_rewrite' = Goal.prove ctxt [\"f\"] [] getter_rewrite_term' (fn _ => Skip_Proof.cheat_tac ctxt 1) (* FIXME: unfinished *)\n val setter_rewrite = Goal.prove ctxt [\"f\", \"g\"] [] setter_rewrite_term (fn _ => Skip_Proof.cheat_tac ctxt 1) (* FIXME: unfinished *)\n val setter_rewrite' = Goal.prove ctxt [\"f\", \"g\"] [] setter_rewrite_term' (fn _ => Skip_Proof.cheat_tac ctxt 1) (* FIXME: unfinished *)\n in [setter_rewrite,setter_rewrite', getter_rewrite, getter_rewrite'] end;\n fun upd_sep_info_list info xs = info |> #sep_thms |> (fn x => x @ xs) |> upd_thms info\n in map make_struct_rewrite_inner structs |> List.concat |> upd_sep_info_list sep_info\nend;\n\nfun make_rewrites heap_types heap_getters heap_setters structs sep_info ctxt =\n let\n val (sep_info, ctxt) = foldr (fn (htype, (info, ctxt)) => (make_rewrite heap_getters heap_setters htype info ctxt) ) (sep_info,ctxt) heap_types\n val sep_info = (make_struct_rewrite structs sep_info ctxt)\n val thms= sep_info |> #sep_thms\n in\n (sep_info, Utils.define_lemmas \"sep_thms\" thms ctxt |> snd )\nend;\n\\\n\nML \\val myss = ref HOL_basic_ss\\\nML \\val mythm = ref @{thms iffI}\\\n\nML \\fun prove_get_leaf_lemma heap_type ((sep_info : sep_info), ctxt) =\n let\n val (heap_getter, heap_getter_def) = heap_type |> Typtab.lookup (#sep_heap_getters sep_info) |> the\n val (heap_arrow, heap_arrow_def) = heap_type |> Typtab.lookup (#sep_heap_arrows sep_info) |> the\n val plus_thm = sep_info |> #plus_thm |> the\n val proof_term = @{mk_term\n \" Trueprop (\n \\\\s. (?arr p x \\* R) s\\\n ?getter p\n \\\\rv. pred_conj (?arr p x \\* R) ( K (rv = x))\\ )\" (arr,getter)}\n (heap_arrow, heap_getter)\n val thms = [@{thm sep_conj_def},\n @{thm pred_conj_def},\n heap_getter_def, heap_arrow_def, plus_thm]\n val name = heap_getter |> dest_Const |> fst |> Long_Name.base_name\n fun proof_tac ctxt = fast_force_tac (ctxt addsimps thms)\n val get_wp = Goal.prove ctxt [\"x\", \"p\",\"R\"] [] proof_term (fn _ => proof_tac ctxt 1)\n in (sep_info, Utils.define_lemma (name ^ \"_wp\") get_wp ctxt |> snd) end;\\\n\n\nML \\\n fun prove_update_heap_lemma (heap_arrow, heap_arrow_def) heap_update ctxt =\n let val proof_term = @{mk_term \"((?arr p x) s \\ (?arr p v) (?heap_update (\\s. fun_upd s p v) s))\" (arr,heap_update)} (heap_arrow, heap_update)\n val proof = clarsimp_tac (ctxt addsimps [heap_arrow_def])\n in Goal.prove ctxt [\"x\", \"p\", \"v\",\"s\"] [] proof_term (fn x => proof 1)\n end;\n\n fun prove_set_leaf_lemma (heap_type, heap_updater) ((sep_info : sep_info), ctxt) =\n let\n val (heap_setter, heap_setter_def) = heap_type |> Typtab.lookup (#sep_heap_setters sep_info) |> the\n val (heap_arrow, heap_arrow_def) = heap_type |> Typtab.lookup (#sep_heap_arrows sep_info) |> the\n val disj_thm = sep_info |> #disj_thm |> the\n val plus_thm = sep_info |> #plus_thm |> the\n val proof_term = @{mk_term\n \" Trueprop (\n \\\\s. (?arr p x \\* R) s\\\n ?setter p v\n \\\\rv. (?arr p v \\* R)\\ )\" (arr,setter)}\n (heap_arrow, heap_setter)\n val thms = @{thms fun_upd_def} @ [ heap_arrow_def, disj_thm, plus_thm]\n val name = heap_setter |> dest_Const |> fst |> Long_Name.base_name\n val heap_update_lemma = prove_update_heap_lemma (heap_arrow, heap_arrow_def) (heap_updater) ctxt\n fun proof_tac ctxt = clarsimp_tac (ctxt addsimps [heap_setter_def]) THEN'\n eresolve0_tac [@{thm sep_conjE}] THEN'\n resolve0_tac [@{thm sep_conjI}] THEN'\n eresolve0_tac [heap_update_lemma] THEN'\n fast_force_tac (ctxt) THEN_ALL_NEW\n fast_force_tac (ctxt addsimps thms)\n val set_wp = Goal.prove ctxt [\"x\", \"p\",\"R\", \"v\"] [] proof_term (fn x => proof_tac (#context x) 1 )\n in (sep_info, Utils.define_lemma (name ^ \"_wp\") set_wp ctxt |> snd) end;\\\n\nML \\\n\nfun prove_get_leaf_lemmas heap_types sep_info ctxt =\n foldr (uncurry prove_get_leaf_lemma) (sep_info, ctxt) heap_types\n\n\nfun prove_set_leaf_lemmas heap_types sep_info ctxt =\n foldr (uncurry prove_set_leaf_lemma) (sep_info, ctxt) heap_types\n\n\\\n\nML \\\n fun force_tac ctxt =\n SELECT_GOAL\n (Classical.clarify_tac ctxt 1 THEN\n IF_UNSOLVED (Simplifier.asm_full_simp_tac ctxt 1) THEN\n ALLGOALS (Classical.first_best_tac ctxt))\n fun zipWith (x::xs) (y::ys) f = f x y :: zipWith xs ys f |\n zipWith _ _ _ = []\n\n fun tester str thy =\n let val data = get_data thy str |> the |> #heap_info\n val typ = data |> #globals_type |> print_type\n val stateT = data |> #globals_type |> dest_Type ||> (K [@{typ 'b}]) |> Type\n val heap_types = data |> #heap_getters |> Typtab.dest |> map fst\n val heap_valid_getters = data |> #heap_valid_getters\n val heap_getters = data |> #heap_getters\n val heap_setters = data |> #heap_setters\n val global_types = data |> #global_fields |> map (fn (_,_,z) => z)\n val global_names = data |> #global_fields |> map (fn (x,_,_) => x)\n val global_getters = data |> #global_field_getters\n val structs = data |> #structs |> Symtab.dest |> map snd\n val sep_info = mk_sep_info NONE NONE NONE Typtab.empty Typtab.empty Typtab.empty []\n fun tup_list (x : sep_info)\n = [x |> #plus_thm |> the,\n x |> #zero_thm |> the,\n x |> #disj_thm |> the]\n fun proof_tac thms ctxt =\n let\n val equality = Proof_Context.get_thm ctxt \"lifted_globals.equality\" ;\n val simpset = ctxt addsimps @{thms sep_add_left_commute sep_disj_commute sep_add_assoc sep_add_commute\n left_commute zero_fun_def plus_fun_def sep_disj_fun_def zero_bool_def\n commute} addsimps thms\n val intros = [equality, @{thm ext}]\n in\n Class.standard_intro_classes_tac ctxt [] THEN\n ((resolve_tac ctxt intros ORELSE'\n force_tac simpset ) |> REPEAT_ALL_NEW |> TRYALL)\n end;\n in thy\n |> Class.instantiation ([typ], [(\"'a\", @{sort type})], @{sort stronger_sep_algebra})\n |> setup_heap_zero stateT heap_types global_types sep_info\n |-> setup_heap_disj stateT heap_types heap_valid_getters\n |-> setup_heap_plus stateT global_names global_getters heap_types heap_getters heap_valid_getters\n |-> setup_arrows stateT heap_types heap_getters heap_valid_getters\n |-> make_rewrites heap_types heap_getters heap_setters structs\n |> (fn (info, ctxt) => (info, (info,ctxt) |> (apfst (tup_list #> proof_tac) #-> Class.prove_instantiation_instance)))\n |-> prove_get_leaf_lemmas heap_types\n |-> prove_set_leaf_lemmas (heap_setters |> Typtab.dest |> map (fn x => x ||> Const)) |> snd\n end;\n\nAdhoc_Overloading.is_overloaded @{context} \"\\\"\n\\\n\nML \\\nval _ =\n Outer_Syntax.command @{command_keyword \"sep_instance\"} \"instantiate and prove type arity\"\n (Parse.path >>\n (fn str => tester str |> Toplevel.begin_local_theory true #> Toplevel.end_local_theory));\n\n(* get_data @{theory} \"swap.c\" |> the |> #structs *)\n\\\n\n\n\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/Auto_Separation_Algebra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.25336434606623265}} {"text": "theory \"Wide_Mouth_Frog_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: Wide Mouthed Frog *)\n\n(* text: \n The protocol is modeled after the description in the SPORE library:\n\n http://www.lsv.ens-cachan.fr/Software/spore/wideMouthedFrog.html\n\n Timestamps are modelled as fresh numbers that are immediatly made public.\n *)\n\nrole I\nwhere \"I =\n [ Send ''1_leak'' ( sN ''TimeI'' )\n , Send ''1'' <| sAV ''I'', sAV ''R'',\n PEnc <| sC ''1'', sN ''TimeI'', sAV ''R'', sN ''kIR'' |>\n ( sK ''I'' ''S'' )\n |>\n ]\"\n\nrole R\nwhere \"R =\n [ Recv ''2'' <| sMV ''S'', sMV ''I'',\n PEnc <| sC ''2'', sMV ''TimeS'', sMV ''I'', sMV ''kIR'' |>\n ( PSymK ( sAV ''R'' ) ( sMV ''S'' ) )\n |>\n ]\"\n\nrole S\nwhere \"S =\n [ Recv ''1'' <| sMV ''I'', sMV ''R'',\n PEnc <| sC ''1'', sMV ''TimeI'', sMV ''R'', sMV ''kIR'' |>\n ( PSymK ( sMV ''I'' ) ( sAV ''S'' ) )\n |>\n , Send ''2_leak'' ( sN ''TimeS'' )\n , Send ''2'' <| sAV ''S'', sMV ''I'',\n PEnc <| sC ''2'', sN ''TimeS'', sMV ''I'', sMV ''kIR'' |>\n ( PSymK ( sMV ''R'' ) ( sAV ''S'' ) )\n |>\n ]\"\n\nprotocol WMF\nwhere \"WMF = { I, R, S }\"\n\nlocale restricted_WMF_state = WMF_state\n\ntype_invariant WMF_msc_typing for WMF\nwhere \"WMF_msc_typing = mk_typing\n [ ((R, ''I''), (KnownT R_2))\n , ((S, ''I''), (KnownT S_1))\n , ((S, ''R''), (KnownT S_1))\n , ((R, ''S''), (KnownT R_2))\n , ((S, ''TimeI''), (SumT (KnownT S_1) (NonceT I ''TimeI'')))\n , ((R, ''TimeS''), (SumT (KnownT R_2) (NonceT S ''TimeS'')))\n , ((R, ''kIR''), (SumT (KnownT R_2) (NonceT I ''kIR'')))\n , ((S, ''kIR''), (SumT (KnownT S_1) (NonceT I ''kIR'')))\n ]\"\n\nsublocale WMF_state < WMF_msc_typing_state\nproof -\n have \"(t,r,s) : approx WMF_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF WMF_msc_typing.monoTyp, completeness_cases_rule])\n case (R_2_I t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_2_I\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (R_2_S t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_2_S\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (R_2_TimeS t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_2_TimeS\n thus ?case\n proof(sources! \"\n Enc {| LC ''2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (R_2_kIR t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = R_2_kIR\n thus ?case\n proof(sources! \"\n Enc {| LC ''2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n case (S_2_enc tid1) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid1), s(AV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid1) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_1_I t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_1_I\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (S_1_R t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_1_R\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (S_1_TimeI t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_1_TimeI\n thus ?case\n proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (S_1_kIR t r s tid0)\n then interpret state: WMF_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = S_1_kIR\n thus ?case\n proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n qed\n thus \"WMF_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext WMF_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection: Secrecy Properties *)\n\nlemma (in restricted_WMF_state) I_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some I\"\n \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"LN ''kIR'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''kIR'' tid0 \")\n case I_1_kIR note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n case (S_2_kIR tid1) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid1), s(MV ''R'' tid1), LN ''kIR'' tid0\n |}\n ( K ( s(MV ''I'' tid1) ) ( s(AV ''S'' tid1) ) ) \")\n case (I_1_enc tid2) note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_WMF_state) S_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some S\"\n \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''R'' tid0)) ~: reveals t\"\n \"( tid0, S_1 ) : steps t\"\n \"s(MV ''kIR'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid0), s(MV ''R'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(MV ''I'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (I_1_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: I_kIR_sec intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WMF_state) R_kIR_sec:\n assumes facts:\n \"roleMap r tid0 = Some R\"\n \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''S'' tid0)) ~: reveals t\"\n \"( tid0, R_2 ) : steps t\"\n \"s(MV ''kIR'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', s(MV ''TimeS'' tid0), s(MV ''I'' tid0),\n s(MV ''kIR'' tid0)\n |}\n ( K ( s(AV ''R'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_2_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: S_kIR_sec intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* subsection: Authentication Properties *)\n\n(* text: \n The authentication guarantee for the initiator is trivial because it does not\n receive any confirmation that the responder received the new session-key.\n *)\n\nlemma (in restricted_WMF_state) S_ni_synch:\n assumes facts:\n \"roleMap r tid3 = Some S\"\n \"RLKR(s(AV ''S'' tid3)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid3)) ~: reveals t\"\n \"( tid3, S_1 ) : steps t\"\n shows\n \"(? tid1.\n roleMap r tid1 = Some I &\n s(AV ''I'' tid1) = s(MV ''I'' tid3) &\n s(AV ''R'' tid1) = s(MV ''R'' tid3) &\n s(AV ''S'' tid1) = s(AV ''S'' tid3) &\n LN ''TimeI'' tid1 = s(MV ''TimeI'' tid3) &\n LN ''kIR'' tid1 = s(MV ''kIR'' tid3) &\n predOrd t (St( tid1, I_1 )) (St( tid3, S_1 )))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid3), s(MV ''R'' tid3),\n s(MV ''kIR'' tid3)\n |}\n ( K ( s(MV ''I'' tid3) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (I_1_enc tid4) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_WMF_state) R_ni_synch:\n assumes facts:\n \"roleMap r tid2 = Some R\"\n \"RLKR(s(AV ''R'' tid2)) ~: reveals t\"\n \"RLKR(s(MV ''I'' tid2)) ~: reveals t\"\n \"RLKR(s(MV ''S'' tid2)) ~: reveals t\"\n \"( tid2, R_2 ) : steps t\"\n shows\n \"(? tid1.\n (? tid3.\n roleMap r tid1 = Some I &\n roleMap r tid3 = Some S &\n s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n s(MV ''I'' tid2) = s(MV ''I'' tid3) &\n s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n s(AV ''R'' tid2) = s(MV ''R'' tid3) &\n s(AV ''S'' tid1) = s(MV ''S'' tid2) &\n s(MV ''S'' tid2) = s(AV ''S'' tid3) &\n LN ''TimeI'' tid1 = s(MV ''TimeI'' tid3) &\n s(MV ''TimeS'' tid2) = LN ''TimeS'' tid3 &\n LN ''kIR'' tid1 = s(MV ''kIR'' tid2) &\n s(MV ''kIR'' tid2) = s(MV ''kIR'' tid3) &\n predOrd t (St( tid1, I_1 )) (St( tid3, S_1 )) &\n predOrd t (St( tid3, S_1 )) (St( tid3, S_2 )) &\n predOrd t (St( tid3, S_2 )) (St( tid2, R_2 ))))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', s(MV ''TimeS'' tid2), s(MV ''I'' tid2),\n s(MV ''kIR'' tid2)\n |}\n ( K ( s(AV ''R'' tid2) ) ( s(MV ''S'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (S_2_enc tid3) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''1'', s(MV ''TimeI'' tid3), s(AV ''R'' tid2),\n s(MV ''kIR'' tid2)\n |}\n ( K ( s(MV ''I'' tid2) ) ( s(AV ''S'' tid3) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (I_1_enc tid4) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/Wide_Mouth_Frog_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.25336434606623265}} {"text": "subsection \\IMO 2006 SL - A6\\\n\ntheory IMO_2006_SL_A6\n imports Complex_Main\nbegin\n\ntheorem IMO_2006_SL_A6:\n fixes a b c :: real\n shows \"Min {M. \\ a b c. \\a * b * (a\\<^sup>2 - b\\<^sup>2) + b * c * (b\\<^sup>2 - c\\<^sup>2) + c * a * (c\\<^sup>2 - a\\<^sup>2)\\ \\ M * (a\\<^sup>2 + b\\<^sup>2 + c\\<^sup>2)\\<^sup>2} = (sqrt 2) * 9 / 32\"\n sorry\n\nend\n", "meta": {"author": "filipmaric", "repo": "IMO", "sha": "9fb602bf4fd5bcb5890361d194a4fb423ac266e2", "save_path": "github-repos/isabelle/filipmaric-IMO", "path": "github-repos/isabelle/filipmaric-IMO/IMO-9fb602bf4fd5bcb5890361d194a4fb423ac266e2/IMO_files/statements/IMO_2006_SL_A6.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.3998116407397951, "lm_q1q2_score": 0.25324480231597646}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory TypeTrackingTyping imports\n Cogent\nbegin\n\ndatatype type_split_kind = TSK_L | TSK_S | TSK_NS\n\ndatatype typing_tree = TyTrLeaf\n | TyTrSplit \"type_split_kind option list\" ctx typing_tree ctx typing_tree\n\ntype_synonym tree_ctx = \"typing_tree * ctx\"\n\nfun\n apply_tsk :: \"type_split_kind option \\ type option \\ type option \\ type option\"\nwhere\n \"apply_tsk None t = (None, t)\"\n | \"apply_tsk (Some TSK_L) t = (t, None)\"\n | \"apply_tsk (Some TSK_S) t = (t, t)\"\n | \"apply_tsk (Some TSK_NS) t = (map_option bang t, t)\"\n\nfun\n follow_typing_tree :: \"tree_ctx \\ tree_ctx \\ tree_ctx\"\nwhere\n \"follow_typing_tree (TyTrSplit sps xs T1 ys T2, \\)\n = ((T1, xs @ map (fst o Product_Type.split apply_tsk) (zip sps \\)),\n (T2, ys @ map (snd o Product_Type.split apply_tsk) (zip sps \\)))\"\n\nfun\n new_tt_types :: \"tree_ctx \\ ctx\"\nwhere\n \"new_tt_types (TyTrSplit sps xs T1 ys T2, \\) = ys\"\n | \"new_tt_types (TyTrLeaf, v) = []\"\n\nfun\n follow_typing_tree_triv :: \"tree_ctx \\ tree_ctx \\ tree_ctx\"\nwhere\n \"follow_typing_tree_triv (TyTrSplit sps xs T1 ys T2, \\) = ((T1, xs @ \\), (T2, ys @ \\))\"\n\ndefinition\n composite_anormal_expr :: \"'f expr \\ bool\"\nwhere\n \"composite_anormal_expr x \\ case x of Let _ _ \\ True\n | LetBang _ _ _ \\ True\n | Case _ _ _ _ \\ True\n | If _ _ _ \\ True\n | Split _ _ \\ True\n | Take _ _ _ \\ True\n | _ \\ False\"\n\ndefinition ttsplit_inner :: \"kind env \\ type_split_kind option list \\ bool \\ ctx \\ ctx \\ ctx \\ bool\"\nwhere\n \"ttsplit_inner K sps kndng \\b \\1 \\2 = (\n length sps = length \\b\n \\ \\1 = map (\\ (sp, v). if sp \\ {Some TSK_L, Some TSK_S} then v else None)\n (zip sps \\b)\n \\ \\2 = map (\\ (sp, v). if sp = Some TSK_L then None else v)\n (zip sps \\b)\n \\ Some TSK_NS \\ set sps\n \\ (\\t \\ set \\b. t \\ None \\ kndng \\ (K \\ the t wellformed))\n \\ (\\i < length \\b. nth sps i = Some TSK_S\n \\ nth \\b i \\ None \\ (\\k. K \\ (the (nth \\b i)) :\\ k \\ S \\ k)))\"\n\ndefinition ttsplit :: \"kind env \\ tree_ctx \\ type_split_kind option list\n \\ ctx \\ tree_ctx \\ ctx \\ tree_ctx \\ bool\"\nwhere\n \"ttsplit K \\ sps xs \\1 ys \\2 =\n (\\\\b \\1a \\2a T1 T2. \\ = (TyTrSplit sps xs T1 ys T2, \\b)\n \\ \\1 = (T1, xs @ \\1a)\n \\ \\2 = (T2, ys @ \\2a)\n \\ ttsplit_inner K sps True \\b \\1a \\2a)\"\n\nlemma ttsplitI:\n \"ttsplit_inner K sps True \\b \\1 \\2 \\ xs' = xs @ \\1 \\ ys' = ys @ \\2\n \\ ttsplit K (TyTrSplit sps xs T1 ys T2, \\b) sps xs (T1, xs') ys (T2, ys')\"\n by (simp add: ttsplit_def)\n\nlemma forall_less_Suc_eq:\n \"(\\j < Suc i. P j) = (P 0 \\ (\\j < i. P (Suc j)))\"\n by (auto simp add: less_Suc_eq_0_disj)\n\nlemma ttsplit_innerI:\n \"ttsplit_inner K sps kndng \\b \\1 \\2\n \\ ttsplit_inner K (None # sps) kndng (None # \\b) (None # \\1) (None # \\2)\"\n \"(kndng \\ K \\ \\ :\\ k) \\ ttsplit_inner K sps kndng \\b \\1 \\2\n \\ ttsplit_inner K (None # sps) kndng (Some \\ # \\b) (None # \\1) (Some \\ # \\2)\"\n \"(kndng \\ K \\ \\ :\\ k) \\ ttsplit_inner K sps kndng \\b \\1 \\2\n \\ ttsplit_inner K (Some TSK_L # sps) kndng (Some \\ # \\b) (Some \\ # \\1) (None # \\2)\"\n \"K \\ \\ :\\ k \\ S \\ k \\ ttsplit_inner K sps kndng \\b \\1 \\2\n \\ ttsplit_inner K (Some TSK_S # sps) kndng (Some \\ # \\b) (Some \\ # \\1) (Some \\ # \\2)\"\n \"ttsplit_inner K [] kndng [] [] []\" \n by (auto simp add: ttsplit_inner_def forall_less_Suc_eq)\n\nlemma split_list_zip:\n \"split K \\ \\1 \\2 = (length \\1 = length \\ \\ length \\2 = length \\\n \\ (\\(x, (y, z)) \\ set (zip \\ (zip \\1 \\2)). split_comp K x y z))\"\n apply (induct \\ arbitrary: \\1 \\2)\n apply (auto elim: split.cases intro: split_empty)[1]\n apply (rule iffI)\n apply (erule split.cases, simp, clarsimp)\n apply (clarsimp simp: length_Suc_conv)\n apply (rule split_cons, simp+)\n done\n\nlemma ttsplit_imp_split:\n \"ttsplit K \\ ijs xs \\1 ys \\2 \\ (\\\\1a \\2a. split K (snd \\) \\1a \\2a\n \\ snd \\1 = xs @ \\1a & snd \\2 = ys @ \\2a)\"\n apply (clarsimp simp: ttsplit_def ttsplit_inner_def split_list_zip set_zip nth_enumerate_eq)\n apply (case_tac \"\\b ! i\")\n apply (simp add: split_comp.none)\n apply (drule bspec, erule nth_mem)\n apply (drule spec, drule(1) mp)\n apply (auto intro: split_comp.intros)\n done\n\nlemma split_imp_ttsplit:\n \"split K \\ \\1 \\2 \\ sps = map (\\i. if \\1 ! i = None then None\n else if \\2 ! i = None then Some TSK_L else Some TSK_S) [0 ..< length \\]\n \\ \\1' = xs @ \\1 \\ \\2' = ys @ \\2\n \\ ttsplit K (TyTrSplit sps xs tt ys tt2, \\) sps xs\n (tt, \\1') ys (tt2, \\2')\"\n apply (clarsimp simp: ttsplit_def ttsplit_inner_def split_list_zip nth_enumerate_eq\n all_set_conv_all_nth o_def image_def\n cong: if_cong)\n apply (intro conjI nth_equalityI allI impI, simp_all add: nth_enumerate_eq)\n apply (force elim!: split_comp.cases)+\n done\n\ndefinition ttsplit_triv :: \"tree_ctx \\ ctx \\ tree_ctx \\ ctx \\ tree_ctx \\ bool\"\nwhere\n \"ttsplit_triv \\ xs \\1 ys \\2 = (\\ijs \\1a \\2a.\n fst \\ = TyTrSplit ijs xs \\1a ys \\2a \\ \\1 = (\\1a, xs @ snd \\) \\ \\2 = (\\2a, ys @ snd \\))\"\n\nlemma ttsplit_trivI:\n \"\\1b = (\\1a, xs @ \\b) \\ \\2b = (\\2a, ys @ \\b) \\ ttsplit_triv (TyTrSplit ijs xs \\1a ys \\2a, \\b) xs \\1b ys \\2b\"\n by (simp add: ttsplit_triv_def)\n\ndefinition ttsplit_bang_inner :: \"kind env \\ type_split_kind option list \\ ctx \\ ctx \\ ctx \\ bool\"\nwhere\n \"ttsplit_bang_inner K sps \\b \\1 \\2 = (\n length sps = length \\b\n \\ \\1 = map (\\ (sp, v). if sp \\ {Some TSK_L, Some TSK_S} then v\n else if sp = Some TSK_NS then map_option bang v else None)\n (zip sps \\b)\n \\ \\2 = map (\\ (sp, v). if sp \\ Some TSK_L then v else None)\n (zip sps \\b)\n \\ (\\i < length \\b. nth sps i \\ Some TSK_NS \\ \\b ! i \\ None \\ (\\k. K \\ the (\\b ! i) :\\ k))\n \\ (\\i < length \\b. nth sps i = Some TSK_NS \\ nth \\b i \\ None) \n \\ (\\i < length \\b. nth sps i = Some TSK_S\n \\ nth \\b i \\ None \\ (\\k. K \\ (the (nth \\b i)) :\\ k \\ S \\ k)))\"\n \ndefinition\n \"ttsplit_bang is sps K \\ xs \\1 ys \\2 =\n (\\\\b \\1a \\2a T1 T2. \\ = (TyTrSplit sps xs T1 ys T2, \\b)\n \\ ttsplit_bang_inner K sps \\b \\1a \\2a\n \\ (\\i < length \\b. (i \\ is) = (nth sps i = Some TSK_NS))\n \\ \\1 = (T1, xs @ \\1a)\n \\ \\2 = (T2, ys @ \\2a))\"\n\nlemma ttsplit_bangI:\n \"xs' = xs @ \\1a \\ ys' = ys @ \\2a\n \\ is = set (map fst (filter (\\(i, v). v = Some TSK_NS) (enumerate 0 sps)))\n \\ ttsplit_bang_inner K sps \\b \\1a \\2a\n \\ ttsplit_bang is sps K (TyTrSplit sps xs T1 ys T2, \\b) xs (T1, xs') ys (T2, ys')\"\n by (simp add: ttsplit_bang_def ttsplit_bang_inner_def in_set_enumerate_eq image_def)\n\nlemma ttsplit_bang_innerI:\n \"ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K (None # sps) (None # \\b) (None # \\1) (None # \\2)\"\n \"K \\ \\ :\\ k \\ ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K (None # sps) (Some \\ # \\b) (None # \\1) (Some \\ # \\2)\"\n \"K \\ \\ :\\ k \\ ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K (Some TSK_L # sps) (Some \\ # \\b) (Some \\ # \\1) (None # \\2)\"\n \"K \\ \\ :\\ k \\ S \\ k \\ ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K (Some TSK_S # sps) (Some \\ # \\b) (Some \\ # \\1) (Some \\ # \\2)\"\n \"K \\ \\ :\\ k \\ \\' = bang \\ \\ ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K (Some TSK_NS # sps) (Some \\ # \\b) (Some \\' # \\1) (Some \\ # \\2)\"\n \"ttsplit_bang_inner K [] [] [] []\"\n by (auto simp add: ttsplit_bang_inner_def forall_less_Suc_eq)\n\nlemma Suc_mem_image_pred:\n \"0 \\ js \\ (Suc n \\ js) = (n \\ pred ` js)\"\n apply (simp add: image_def pred_def)\n apply (auto elim: rev_bexI split: nat.split_asm)\n done\n\nlemma Suc_mem_image_pred_remove:\n \"(n \\ pred ` Set.remove 0 js) = (Suc n \\ js)\"\n by (simp add: Suc_mem_image_pred[symmetric])\n\nlemma split_bang_nth:\n \"split_bang K is \\ \\1 \\2 = (length \\1 = length \\ \\ length \\2 = length \\\n \\ (\\i < length \\. if i \\ is then \\2 ! i = \\ ! i \\ \\ ! i \\ None\n \\ \\1 ! i = map_option bang (\\ ! i)\n else split_comp K (\\ ! i) (\\1 ! i) (\\2 ! i)))\"\n apply (induct \\ arbitrary: \"is\" \\1 \\2)\n apply (auto elim: split_bang.cases intro: split_bang_empty)[1]\n apply (rule iffI)\n apply (erule split_bang.cases, simp)\n apply (clarsimp split del: split_if)\n apply (case_tac i)\n apply simp\n apply (simp add: Suc_mem_image_pred split del: split_if cong: if_cong)\n apply (clarsimp split del: split_if)\n apply (case_tac i)\n apply simp\n apply (simp add: Suc_mem_image_pred_remove split del: split_if cong: if_cong)\n apply (clarsimp simp: length_Suc_conv forall_less_Suc_eq)\n apply (frule_tac x=0 in spec, simp(no_asm_use))\n apply (case_tac \"0 \\ is\", simp_all)\n apply clarsimp\n apply (erule split_bang_bang, rule refl)\n apply (simp add: Suc_mem_image_pred_remove split del: split_if cong: if_cong)\n apply (rule split_bang_cons, (simp_all add: Suc_mem_image_pred split del: split_if cong: if_cong))\n done\n\nlemma ttsplit_bang_imp_split_bang:\n \"ttsplit_bang is sps K \\ xs \\1 ys \\2 \\\n (\\\\1a \\2a. split_bang K is (snd \\) \\1a \\2a\n \\ snd \\1 = xs @ \\1a & snd \\2 = ys @ \\2a)\"\n apply (clarsimp simp: ttsplit_bang_def ttsplit_bang_inner_def\n split_bang_nth nth_enumerate_eq\n split del: split_if cong: if_cong)\n apply clarsimp\n apply (case_tac \"\\b ! i\")\n apply (simp add: split_comp.none)\n apply (drule spec, drule(1) mp)+\n apply (auto intro: split_comp.intros)\n done\n\nlemma ttsplit_bang_inner_Cons:\n \"ttsplit_bang_inner K sps \\b \\1 \\2\n \\ ttsplit_bang_inner K [sp] [\\] [\\1] [\\2]\n \\ ttsplit_bang_inner K (sp # sps) (\\ # \\b) (\\1 # \\1) (\\2 # \\2)\"\n by (simp add: ttsplit_bang_inner_def forall_less_Suc_eq)\n\nlemma split_bang_imp_ttsplit:\n \"split_bang K is \\ \\1 \\2\n \\ \\sps. \\xs ys \\1' \\2'. (\\1' = xs @ \\1 \\ \\2' = ys @ \\2\n \\ ttsplit_bang is sps K (TyTrSplit sps xs tt ys tt2, \\) xs\n (tt, \\1') ys (tt2, \\2'))\"\n apply (clarsimp simp: ttsplit_bang_def)\n apply (induct rule: split_bang.induct)\n apply (simp add: ttsplit_bang_def ttsplit_bang_inner_def)\n apply (clarsimp simp: forall_less_Suc_eq Suc_mem_image_pred)\n apply (rule exI, rule conjI, erule_tac sp=\"if a = None then None\n else if b = None then Some TSK_L else Some TSK_S\" in ttsplit_bang_inner_Cons)\n apply (auto simp: ttsplit_bang_inner_def elim!: split_comp.cases)[1]\n apply (simp add: Set.remove_def)\n apply (clarsimp simp: forall_less_Suc_eq Suc_mem_image_pred_remove)\n apply (rule exI, rule conjI, erule_tac sp=\"Some TSK_NS\" in ttsplit_bang_inner_Cons)\n apply (simp add: ttsplit_bang_inner_def)\n apply simp\n done\n\nlemma split_follow_typing_tree:\n \"ttsplit K \\ sps' xs' \\1 ys' \\2 \\ (\\1, \\2) = follow_typing_tree \\ \\ new_tt_types \\ = ys'\"\n \"ttsplit_triv \\ xs' \\1 ys' \\2 \\ (\\1, \\2) = follow_typing_tree_triv \\ \\ new_tt_types \\ = ys'\"\n \"ttsplit_bang is sps' K \\ xs' \\1 ys' \\2 \\ (\\1, \\2) = follow_typing_tree \\ \\ new_tt_types \\ = ys'\"\n apply (clarsimp simp: ttsplit_def ttsplit_inner_def ball_conj_distrib[symmetric])\n apply (case_tac a, simp_all)\n apply (case_tac aa, simp_all)\n apply (clarsimp elim!: in_set_zipE)\n apply (cases \\, clarsimp simp: ttsplit_triv_def)\n apply (clarsimp simp: ttsplit_bang_def ttsplit_bang_inner_def ball_conj_distrib[symmetric])\n apply (case_tac a, simp_all)\n apply (case_tac aa, simp_all)\n done\n\ninductive ttyping :: \"('f \\ poly_type) \\ kind env \\ tree_ctx \\ 'f expr \\ type \\ bool\" \n (\"_, _, _ T\\ _ : _\" [30,0,0,0,20] 60)\nwhere\n\n ttyping_default: \"\\ \\ composite_anormal_expr x\n ; \\, K, \\ \\ x : t\n \\ \\ \\, K, (tt, \\) T\\ x : t\"\n\n| ttyping_split : \"\\ ttsplit K \\ ijs [] \\1 [Some t, Some u] \\2\n ; \\, K, \\1 T\\ x : TProduct t u\n ; \\, K, \\2 T\\ y : t'\n \\ \\ \\, K, \\ T\\ Split x y : t'\" \n\n| ttyping_let : \"\\ ttsplit K \\ ijs [] \\1 [Some t] \\2 \n ; \\, K, \\1 T\\ x : t\n ; \\, K, \\2 T\\ y : u\n \\ \\ \\, K, \\ T\\ Let x y : u\"\n\n| ttyping_letb : \"\\ ttsplit_bang is sps K \\ [] \\1 [Some t] \\2\n ; \\, K, \\1 T\\ x : t\n ; \\, K, \\2 T\\ y : u\n ; K \\ t :\\ k\n ; E \\ k\n \\ \\ \\, K, \\ T\\ LetBang is x y : u\"\n\n| ttyping_case : \"\\ ttsplit K \\ ijs [] \\1 [] \\2\n ; ttsplit_triv \\2 [Some t] \\3 [Some (TSum (filter (\\ x. fst x \\ tag) ts))] \\4\n ; \\, K, \\1 T\\ x : TSum ts\n ; (tag, t) \\ set ts\n ; \\, K, \\3 T\\ a : u\n ; \\, K, \\4 T\\ b : u\n \\ \\ \\, K, \\ T\\ Case x tag a b : u\" \n\n| ttyping_if : \"\\ ttsplit K \\ ijs [] \\1 [] \\2\n ; ttsplit_triv \\2 [] \\3 [] \\4\n ; \\, K, \\1 T\\ x : TPrim Bool\n ; \\, K, \\3 T\\ a : t\n ; \\, K, \\4 T\\ b : t\n \\ \\ \\, K, \\ T\\ If x a b : t\"\n\n| ttyping_take : \"\\ ttsplit K \\ ijs [] \\1 [Some t, Some (TRecord (ts [f := (t, taken)]) s)] \\2 \n ; \\, K, \\1 T\\ e : TRecord ts s\n ; s \\ ReadOnly\n ; f < length ts\n ; ts ! f = (t, False)\n ; K \\ t :\\ k\n ; S \\ k \\ taken\n ; \\, K, \\2 T\\ e' : u\n \\ \\ \\, K, \\ T\\ Take e f e' : u\"\n\n\nlemma ttyping_imp_typing:\nassumes \"\\, K, \\ T\\ e : u\"\nshows \"\\, K, (snd \\) \\ e : u\"\nusing assms by ( induct rule: ttyping.induct\n , auto simp: ttsplit_triv_def\n dest!: ttsplit_imp_split ttsplit_bang_imp_split_bang\n intro: typing_typing_all.intros)\n\nlemma typing_imp_ttyping_induct:\nshows \" (\\, K, \\ \\ e : u \\ (\\ tt. \\, K, (tt, \\) T\\ e : u))\"\nand \" (\\, K, \\ \\* es : us \\ True)\"\nproof (induct rule: typing_typing_all.inducts)\n \nqed (fastforce intro: ttyping_split[rotated] ttyping_let[rotated] ttyping_letb[rotated]\n ttyping_case[rotated 2] ttyping_if[rotated 2] ttyping_take[rotated 2]\n ttyping_default typing_typing_all.intros\n simp: composite_anormal_expr_def ttsplit_triv_def\n elim: split_imp_ttsplit\n | metis split_bang_imp_ttsplit ttyping_letb append.simps)+\n\n\nlemma ttyping_eq_typing:\nshows \"\\, K, \\ \\ e : u = (\\ tt. \\, K, (tt, \\) T\\ e : u)\"\nby (auto dest: ttyping_imp_typing typing_imp_ttyping_induct)\n\nlemma split_type_wellformed:\n \"K \\ \\ \\ \\1 | \\2 \\ Some t \\ set \\\n \\ K \\ t wellformed\"\n by (induct rule: split.induct, auto elim!: split_comp.cases)\n\nlemma split_bang_type_wellformed:\n \"split_bang K is \\ \\1 \\2 \\ Some t \\ set \\\n \\ Some t \\ set \\1 \\ Some t \\ set \\2 \\ K \\ t wellformed\"\n by (induct arbitrary: \"is\" rule: split_bang.induct,\n auto elim!: split_comp.cases)\n\nlemma weakening_type_wellformed:\n \"K \\ \\ \\w \\' \\ Some t \\ set \\\n \\ K \\ t wellformed\"\n apply (clarsimp simp: weakening_def in_set_conv_decomp\n list_all2_append1 list_all2_Cons1)\n apply (erule weakening_comp.cases, auto)\n done\n\nlemma typing_to_kinding_env:\n \"\\, K, \\ \\ e : u \\ Some t \\ set \\\n \\ K \\ t wellformed\"\n \"\\, K, \\ \\* es : us \\ Some t \\ set \\\n \\ K \\ t wellformed\"\n by (induct rule: typing_typing_all.inducts,\n auto simp add: Cogent.empty_def\n dest: split_bang_type_wellformed weakening_type_wellformed split_type_wellformed)\n\nlemma ttyping_type_wellformed:\n \"\\ \\, K, \\ T\\ x : \\ \\\n \\ \\t. Some t \\ set (snd \\) \\ K \\ t wellformed\"\n by (induct rule: ttyping.induct,\n auto dest!: ttsplit_imp_split ttsplit_bang_imp_split_bang\n dest: split_bang_type_wellformed split_type_wellformed typing_to_kinding_env)\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/cogent/isa/TypeTrackingTyping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.25324480231597646}} {"text": "(* Title: HOL/Auth/n_german_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_invs_on_rules imports n_german_lemma_inv__1_on_rules n_german_lemma_inv__2_on_rules n_german_lemma_inv__3_on_rules n_german_lemma_inv__4_on_rules n_german_lemma_inv__5_on_rules n_german_lemma_inv__6_on_rules n_german_lemma_inv__7_on_rules n_german_lemma_inv__8_on_rules n_german_lemma_inv__9_on_rules n_german_lemma_inv__10_on_rules n_german_lemma_inv__11_on_rules n_german_lemma_inv__12_on_rules n_german_lemma_inv__13_on_rules n_german_lemma_inv__14_on_rules n_german_lemma_inv__15_on_rules n_german_lemma_inv__16_on_rules n_german_lemma_inv__17_on_rules n_german_lemma_inv__18_on_rules n_german_lemma_inv__19_on_rules n_german_lemma_inv__20_on_rules n_german_lemma_inv__21_on_rules n_german_lemma_inv__22_on_rules n_german_lemma_inv__23_on_rules n_german_lemma_inv__24_on_rules n_german_lemma_inv__25_on_rules n_german_lemma_inv__26_on_rules n_german_lemma_inv__27_on_rules n_german_lemma_inv__28_on_rules n_german_lemma_inv__29_on_rules n_german_lemma_inv__30_on_rules n_german_lemma_inv__31_on_rules n_german_lemma_inv__32_on_rules n_german_lemma_inv__33_on_rules n_german_lemma_inv__34_on_rules n_german_lemma_inv__35_on_rules n_german_lemma_inv__36_on_rules n_german_lemma_inv__37_on_rules n_german_lemma_inv__38_on_rules n_german_lemma_inv__39_on_rules n_german_lemma_inv__40_on_rules n_german_lemma_inv__41_on_rules n_german_lemma_inv__42_on_rules n_german_lemma_inv__43_on_rules n_german_lemma_inv__44_on_rules n_german_lemma_inv__45_on_rules n_german_lemma_inv__46_on_rules n_german_lemma_inv__47_on_rules n_german_lemma_inv__48_on_rules n_german_lemma_inv__49_on_rules n_german_lemma_inv__50_on_rules n_german_lemma_inv__51_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(f=inv__1 )\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__2 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__3 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__6 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__7 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__9 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__12 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__13 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__15 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__16 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__19 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__20 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__25 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__26 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__27 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__29 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__31 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__32 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__34 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__35 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__36 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__37 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__39 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__41 p__Inv1 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__42 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__43 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__44 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__45 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__46 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__47 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__48 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__49 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__50 p__Inv1 p__Inv2)\\\n (\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__51 p__Inv1 p__Inv2)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(f=inv__1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__2 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__3 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__6 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__6_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__7 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__7_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__8_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__9 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__9_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__10_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__11_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__12 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__12_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__13 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__13_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__14_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__15 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__15_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__16 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__16_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__17_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__18_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__19 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__19_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__20 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__20_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__21_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__22_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__23_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__24_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__25 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__25_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__26 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__26_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__27 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__27_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__28_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__29 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__29_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__30_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__31 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__31_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__32 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__32_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__33_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__34 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__34_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__35 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__35_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__36 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__36_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__37 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__37_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__38_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__39 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__39_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__40_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__41 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__41_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__42 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__42_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__43 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__43_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__44 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__44_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__45 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__45_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__46 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__46_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__47 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__47_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__48 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__48_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__49 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__49_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__50 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__50_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__51 p__Inv1 p__Inv2)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__51_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.38861802670584894, "lm_q1q2_score": 0.2531282474520022}} {"text": " (*-------------------------------------------*\n | DFP package |\n | June 2005 |\n | December 2005 (modified) |\n | |\n | DFP on CSP-Prover ver.3.0 |\n | September 2006 (modified) |\n | April 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory DFP_Deadlock\nimports DFP_Network\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* Union (B ` A) = (UN x:A. B x) *)\n(* Inter (B ` A) = (INT x:A. B x) *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite (notick | t = []t) *)\n(* *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n 1. \n 2. \n 3. \n 4. \n\n *****************************************************************)\n\n(*********************************************************\n definitions\n *********************************************************)\n\ndefinition\n DeadlockFree :: \"'a event set => ('p,'a) proc => bool\" \n (\"(0[_]-DeadlockFree _)\" [0,55] 55)\n where\n DeadlockFree_def : \n \"[X]-DeadlockFree P == (ALL s. (Tick ~: sett(s)) --> (s,X) ~:f failures P MF)\"\n\n (* R is deadlock free with respect to X, thus\n R can always perform an event in X at least *)\n\ndefinition \n DeadlockFreeNetwork :: \"('i,'p,'a) Network => bool\" \n where\n DeadlockFreeNetwork_def : \n \"DeadlockFreeNetwork V == \n [Ev ` (ALP V)]-DeadlockFree PAR V\"\n\n\n(*** UNIV deadlockfree ***)\n\nsyntax\n \"@isDeadlockFree\" :: \"('p,'a) proc => bool\" \n (\"_ isDeadlockFree\" [1000] 1000)\n\ntranslations\n \"P isDeadlockFree\" == \"[(CONST UNIV)]-DeadlockFree P\"\n\ndefinition\n isDeadlockStateOf :: \n \"('i,'a) net_state => ('i,'a) NetworkF => bool\"\n (\"(0_ isDeadlockStateOf _)\" [55,55] 55)\n where\n isDeadlockStateOf_def : \n \"sigma isDeadlockStateOf VF == \n sigma isStateOf VF & \n Union {((snd sigma) i) |i. i : fst VF}\n = Ev ` (ALP VF)\"\n\n(*********************************************************\n isDeadlockStateOf subset alpha\n *********************************************************)\n\nlemma isDeadlockStateOf_subset_alpha1:\n \"[| (I, FXf) isFailureOf (I, PXf) ; \n (t, Yf) isDeadlockStateOf (I, FXf) ;\n i : I ; e : Yf i|]\n ==> e : (Ev ` (snd (PXf i)))\"\napply (simp add: isDeadlockStateOf_def)\napply (auto simp add: isStateOf_subset_alpha)\ndone\n\nlemma isDeadlockStateOf_subset_alpha2:\n \"[| (I, FXf) isFailureOf (I, PXf) ; \n (t, Yf) isDeadlockStateOf (I, FXf) ;\n i : I ; e : Yf i|]\n ==> e : (Ev ` (snd (FXf i)))\"\napply (simp add: isDeadlockStateOf_def)\napply (auto simp add: isStateOf_subset_alpha)\ndone\n\nlemmas isDeadlockStateOf_subset_alpha = isDeadlockStateOf_subset_alpha1\n isDeadlockStateOf_subset_alpha2\n\n(*********************************************************\n Deadlock and Deadlock freedom\n *********************************************************)\n\n(*** Existency ***)\n\nlemma DeadlockState_notDeadlockFree_only_if_lmEX_lm:\n \"[| ALL s Y.\n (s, Y) : fst (FXf i) -->\n (s, Y) :f failures (fst (PXf i)) MF & Y <= Ev ` snd (FXf i);\n (s rest-tr snd (FXf i), Z) : fst (FXf i);\n Yf i Int Ev ` snd (FXf i) <= Z |]\n ==> (s rest-tr snd (FXf i),\n SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\n : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i)\n <= (SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i)) &\n (SOME Z.\n (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\n <= Ev ` snd (FXf i)\"\napply (rule someI2[of\n\"(%Z. (s rest-tr snd (FXf i), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))\" Z])\napply (rule conjI)\napply (simp)\napply (simp)\napply (simp)\ndone\n\nlemma DeadlockState_notDeadlockFree_only_if_lmEX:\n \"[| (I, FXf) isFailureOf (I, PXf) ;\n ALL i:I. (s rest-tr (snd (PXf i)), Yf i)\n :f failures (fst (PXf i)) MF |]\n ==>\n EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Zf i &\n Zf i <= Ev ` snd (FXf i)\"\n apply (rule_tac x=\n \"(%i. (SOME Z. (s rest-tr (snd (FXf i)), Z) : fst (FXf i) &\n Yf i Int Ev ` snd (FXf i) <= Z &\n Z <= Ev ` snd (FXf i)))\" in exI)\napply (intro ballI impI)\napply (simp add: isFailureOf_def)\napply (drule_tac x=\"i\" in bspec, simp)\napply (drule_tac x=\"i\" in bspec, simp)\napply (simp add: subseteqEX_restRefusal_iff)\napply (elim conjE exE)\napply (rotate_tac -2)\n\napply (drule_tac x=\"s rest-tr snd (FXf i)\" in spec)\napply (drule_tac x=\"Yf i\" in spec)\napply (simp)\napply (elim conjE exE)\napply (rule DeadlockState_notDeadlockFree_only_if_lmEX_lm)\napply (simp_all)\napply (force)\ndone\n\n(* only if part *)\n \nlemma DeadlockState_notDeadlockFree_only_if:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;\n ~ DeadlockFreeNetwork (I,PXf) |]\n ==> (EX sigma. (sigma isDeadlockStateOf (I,FXf)))\"\napply (simp add: DeadlockFreeNetwork_def)\napply (simp add: DeadlockFree_def)\napply (simp add: isDeadlockStateOf_def)\napply (subgoal_tac \"Union (snd ` PXf ` I) = {a. EX i:I. a : snd (FXf i)}\")\n (* ... sub 1 *)\n\n apply (elim conjE exE)\n apply (simp add: PAR_def)\n apply (simp add: in_failures_par)\n apply (elim conjE exE)\n\n apply (subgoal_tac \n \"EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) : fst (FXf i) & \n ((Yf i) Int (Ev ` snd (FXf i))) <= Zf i &\n Zf i <= (Ev ` snd (FXf i))\")\n (* ... sub 2 *)\n apply (elim conjE exE)\n\n apply (rule_tac x=\"s\" in exI)\n apply (rule_tac x=\"Zf\" in exI)\n apply (rule conjI)\n\n apply (simp add: isStateOf_def)\n apply (simp add: ALP_def)\n apply (simp add: subset_insert)\n\n (* set *)\n apply (simp add: ALP_def)\n apply (simp add: isFailureOf_def)\n apply (simp add: Int_insert_eq)\n apply (rule)\n (* <= *)\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n apply (rotate_tac 1)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE)\n\n apply (rule rev_subsetD)\n apply (simp)\n apply (simp)\n apply (rule order_trans)\n apply (simp)\n\n apply (rule)\n apply (simp add: image_iff)\n apply (elim conjE bexE)\n apply (simp)\n apply (rule_tac x=\"i\" in bexI)\n apply (simp)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE bexE exE)\n apply (simp)\n apply (rule_tac x=\"Zf i\" in exI)\n apply (rule conjI)\n apply (fast)\n\n apply (elim conjE disjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp)\n apply (subgoal_tac \n \"Tick : Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I}\")\n apply (rotate_tac 5)\n apply (drule sym)\n apply (simp add: image_iff)\n apply (simp)\n apply (rule_tac x=\"Yf i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n apply (rule_tac x=\"i\" in exI, simp)\n\n apply (rotate_tac -5)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim conjE disjE)\n apply (rule subsetD)\n apply (simp)\n apply (fast)\n\n (* sub 2 *)\n apply (simp add: DeadlockState_notDeadlockFree_only_if_lmEX)\n\n(* sub 1 *)\napply (simp add: isFailureOf_def)\napply (auto)\ndone\n\n(*** if part ***)\n\nlemma DeadlockState_notDeadlockFree_if:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;\n EX sigma. (sigma isDeadlockStateOf (I,FXf)) |]\n ==> ~ DeadlockFreeNetwork (I,PXf)\"\napply (simp add: DeadlockFreeNetwork_def)\napply (simp add: DeadlockFree_def)\napply (simp add: isDeadlockStateOf_def)\n\napply (elim conjE exE)\napply (simp add: PAR_def)\n\napply (rule_tac x=\"a\" in exI)\napply (simp add: in_failures_par)\napply (simp add: isStateOf_def ALP_def)\n\napply (elim conjE exE)\napply (rule conjI)\napply (fast)\napply (rule conjI)\n\napply (rule order_trans)\napply (simp)\napply (simp add: isFailureOf_def)\napply (fast)\n\napply (rule_tac x=\"b\" in exI)\napply (rename_tac s Ys)\napply (drule sym)\napply (simp)\napply (subgoal_tac \"Union (snd ` PXf ` I) = {a. EX i:I. a : snd (PXf i)}\")\napply (simp add: Int_insert_eq)\napply (rule conjI)\n apply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n apply (subgoal_tac \"x : Ev ` {a. EX i:I. a : snd (FXf i)}\")\n\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"Ys ia Int insert Tick (Ev ` snd (PXf ia))\" in exI)\n apply (rule conjI)\n apply (fast)\n\n apply (simp)\n apply (drule_tac x=\"ia\" in bspec, simp)\n apply (simp add: isFailureOf_same_alpha)\n apply (blast)\n\n apply (simp (no_asm) add: image_iff)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp add: isFailureOf_def)\n apply (force)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (elim conjE exE)\n apply (simp add: image_iff)\n apply (elim disjE conjE exE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (force)\n\n apply (elim conjE bexE)\n apply (rule_tac x=\"xb\" in exI, simp)\n apply (rule_tac x=\"i\" in bexI)\n apply (simp)\n apply (simp)\n\napply (intro ballI)\napply (simp add: isFailureOf_def)\napply (simp add: subseteqEX_restRefusal_iff)\n\napply (auto)\ndone\n\n(*** iff ***)\n\nlemma DeadlockState_notDeadlockFree:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n ==> (~ DeadlockFreeNetwork (I,PXf)) = \n (EX sigma. (sigma isDeadlockStateOf (I,FXf)))\"\napply (rule)\napply (rule DeadlockState_notDeadlockFree_only_if, simp_all)\napply (simp add: DeadlockState_notDeadlockFree_if)\ndone\n\n(*** DeadlockFree ***)\n\nlemma DeadlockFree_notDeadlockState:\n \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n ==> DeadlockFreeNetwork (I,PXf) = \n (ALL sigma. ~(sigma isDeadlockStateOf (I,FXf)))\"\napply (rule iffI)\napply (rotate_tac -1)\napply (erule contrapos_pp)\napply (simp add: DeadlockState_notDeadlockFree)\napply (rotate_tac -1)\napply (erule contrapos_pp)\napply (simp add: DeadlockState_notDeadlockFree)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/DFP/DFP_Deadlock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2530683252493279}} {"text": "(* Title: HOL/HOLCF/IOA/Storage/Correctness.thy\n Author: Olaf Müller\n*)\n\nsection \\Correctness Proof\\\n\ntheory Correctness\nimports IOA.SimCorrectness Spec Impl\nbegin\n\ndefault_sort type\n\ndefinition\n sim_relation :: \"((nat * bool) * (nat set * bool)) set\" where\n \"sim_relation = {qua. let c = fst qua; a = snd qua ;\n k = fst c; b = snd c;\n used = fst a; c = snd a\n in\n (\\l\\used. l < k) \\ b=c}\"\n\ndeclare split_paired_Ex [simp del]\n\n\n(* Idea: instead of impl_con_lemma do not rewrite impl_ioa, but derive\n simple lemmas asig_of impl_ioa = impl_sig, trans_of impl_ioa = impl_trans\n Idea: ?ex. move .. should be generally replaced by a step via a subst tac if desired,\n as this can be done globally *)\n\nlemma issimulation:\n \"is_simulation sim_relation impl_ioa spec_ioa\"\napply (simp (no_asm) add: is_simulation_def)\napply (rule conjI)\ntxt \\start states\\\napply (auto)[1]\napply (rule_tac x = \" ({},False) \" in exI)\napply (simp add: sim_relation_def starts_of_def spec_ioa_def impl_ioa_def)\ntxt \\main-part\\\napply (rule allI)+\napply (rule imp_conj_lemma)\napply (rename_tac k b used c k' b' a)\napply (induct_tac \"a\")\napply (simp_all (no_asm) add: sim_relation_def impl_ioa_def impl_trans_def trans_of_def)\napply auto\ntxt \\NEW\\\napply (rule_tac x = \"(used,True)\" in exI)\napply simp\napply (rule transition_is_ex)\napply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)\ntxt \\LOC\\\napply (rule_tac x = \" (used Un {k},False) \" in exI)\napply (simp add: less_SucI)\napply (rule transition_is_ex)\napply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)\napply fast\ntxt \\FREE\\\napply (rename_tac nat, rule_tac x = \" (used - {nat},c) \" in exI)\napply simp\napply (rule transition_is_ex)\napply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)\ndone\n\n\nlemma implementation:\n\"impl_ioa =<| spec_ioa\"\napply (unfold ioa_implements_def)\napply (rule conjI)\napply (simp (no_asm) add: impl_sig_def spec_sig_def impl_ioa_def spec_ioa_def\n asig_outputs_def asig_of_def asig_inputs_def)\napply (rule trace_inclusion_for_simulations)\napply (simp (no_asm) add: impl_sig_def spec_sig_def impl_ioa_def spec_ioa_def\n externals_def asig_outputs_def asig_of_def asig_inputs_def)\napply (rule issimulation)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/Storage/Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318479832805, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.25286439821206796}} {"text": "(* Title: HOL/Auth/n_deadlock_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_invs_on_rules imports n_deadlock_lemma_inv__1_on_rules n_deadlock_lemma_inv__2_on_rules n_deadlock_lemma_inv__3_on_rules n_deadlock_lemma_inv__4_on_rules n_deadlock_lemma_inv__5_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.25286439224257123}} {"text": "theory Norm\n imports Base\nbegin\n\ndefinition Norm where\n \"Norm \\ \\' \\ \\ \\\\<^sub>A \\'\"\n\nlemma normI: \"\\ \\\\<^sub>A \\' \\ Norm \\ \\'\"\n unfolding Norm_def\n by simp\n\nmethod normalize uses rules =\n rule normI, (simp only: star_aci rules)?; rule ent_refl\n \nend\n", "meta": {"author": "balazstothofficial", "repo": "arrays-in-isabelle", "sha": "9d5dd28b0b3d245dae534d546879045a54b4244f", "save_path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle", "path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle/arrays-in-isabelle-9d5dd28b0b3d245dae534d546879045a54b4244f/Norm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.25284104150788594}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Chain\n imports Semantics\nbegin\n\ncontext env begin\n\nabbreviation tauChain :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\<^sup>^\\<^sub>\\ _\" [80, 80, 80] 80)\nwhere \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P' \\ (P, P') \\ {(P, P'). \\ \\ P \\\\ \\ P'}^*\"\n\nabbreviation tauStepChain :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\<^sub>\\ _\" [80, 80, 80] 80)\nwhere \"\\ \\ P \\\\<^sub>\\ P' \\ (P, P') \\ {(P, P'). \\ \\ P \\\\ \\ P'}^+\"\n\nabbreviation tauContextChain :: \"('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\\\<^sup>^\\<^sub>\\ _\" [80, 80] 80)\nwhere \"P \\\\<^sup>^\\<^sub>\\ P' \\ \\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nabbreviation tauContextStepChain :: \"('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\\\<^sub>\\ _\" [80, 80] 80)\nwhere \"P \\\\<^sub>\\ P' \\ \\ \\ P \\\\<^sub>\\ P'\"\n\nlemmas tauChainInduct[consumes 1, case_names TauBase TauStep] = rtrancl.induct[of _ _ \"{(P, P'). \\ \\ P \\\\ \\ P'}\", simplified]\nlemmas tauStepChainInduct[consumes 1, case_names TauBase TauStep] = trancl.induct[of _ _ \"{(P, P'). \\ \\ P \\\\ \\ P'}\", simplified]\n\n\nlemma tauActTauStepChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\ \\ P'\"\n\n shows \"\\ \\ P \\\\<^sub>\\ P'\"\nusing assms by auto\n\nlemma tauActTauChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\ \\ P'\"\n\n shows \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nusing assms by(auto simp add: rtrancl_eq_or_trancl)\n\nlemma tauStepChainEqvt[eqvt]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n\n shows \"(p \\ \\) \\ (p \\ P) \\\\<^sub>\\ (p \\ P')\"\nusing assms\nproof(induct rule: tauStepChainInduct) \n case(TauBase P P')\n hence \"\\ \\ P \\\\ \\ P'\" by simp\n thus ?case by(force dest: semantics.eqvt simp add: eqvts)\nnext\n case(TauStep P P' P'')\n hence \"\\ \\ P' \\\\ \\ P''\" by simp \n hence \"(p \\ \\) \\ (p \\ P') \\\\ \\ (p \\ P'')\" by(force dest: semantics.eqvt simp add: eqvts)\n with `(p \\ \\) \\ (p \\ P) \\\\<^sub>\\ (p \\ P')` show ?case\n by(subst trancl.trancl_into_trancl) auto\nqed\n\nlemma tauChainEqvt[eqvt]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n\n shows \"(p \\ \\) \\ (p \\ P) \\\\<^sup>^\\<^sub>\\ (p \\ P')\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl eqvts)\n\nlemma tauStepChainEqvt'[eqvt]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n shows \"(p \\ (\\ \\ P \\\\<^sub>\\ P')) = (p \\ \\) \\ (p \\ P) \\\\<^sub>\\ (p \\ P')\"\napply(auto simp add: eqvts perm_set_def pt_bij[OF pt_name_inst, OF at_name_inst])\nby(drule_tac p=\"rev p\" in tauStepChainEqvt) auto\n\nlemma tauChainEqvt'[eqvt]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n shows \"(p \\ (\\ \\ P \\\\<^sup>^\\<^sub>\\ P')) = (p \\ \\) \\ (p \\ P) \\\\<^sup>^\\<^sub>\\ (p \\ P')\"\napply(auto simp add: eqvts perm_set_def pt_bij[OF pt_name_inst, OF at_name_inst] rtrancl_eq_or_trancl)\nby(drule_tac p=\"rev p\" in tauStepChainEqvt) auto\n\nlemma tauStepChainFresh:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"x \\ P\"\n\n shows \"x \\ P'\"\nusing assms\nby(induct rule: trancl.induct) (auto dest: tauFreshDerivative)\n\nlemma tauChainFresh:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"x \\ P\"\n\n shows \"x \\ P'\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl intro: tauStepChainFresh)\n\nlemma tauStepChainFreshChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"xvec \\* P\"\n\n shows \"xvec \\* P'\"\nusing assms\nby(induct xvec) (auto intro: tauStepChainFresh)\n\nlemma tauChainFreshChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"xvec \\* P\"\n\n shows \"xvec \\* P'\"\nusing assms\nby(induct xvec) (auto intro: tauChainFresh)\n\nlemma tauStepChainCase:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\ :: 'c\n and Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"(\\, P) mem Cs\"\n and \"\\ \\ \\\"\n and \"guarded P\"\n\n shows \"\\ \\ (Cases Cs) \\\\<^sub>\\ P'\"\nusing assms\nby(induct rule: trancl.induct) (auto intro: Case trancl_into_trancl)\n\nlemma tauStepChainResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name \n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\\\<^sub>\\ \\\\x\\P'\"\nusing assms\nby(induct rule: trancl.induct) (auto dest: Scope trancl_into_trancl)\n\nlemma tauChainResPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name \n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"x \\ \\\"\n\n shows \"\\ \\ \\\\x\\P \\\\<^sup>^\\<^sub>\\ \\\\x\\P'\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl intro: tauStepChainResPres)\n\nlemma tauStepChainResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\*xvec\\P \\\\<^sub>\\ \\\\*xvec\\P'\"\nusing assms\nby(induct xvec) (auto intro: tauStepChainResPres)\n\nlemma tauChainResChainPres:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"xvec \\* \\\"\n\n shows \"\\ \\ \\\\*xvec\\P \\\\<^sup>^\\<^sub>\\ \\\\*xvec\\P'\"\nusing assms\nby(induct xvec) (auto intro: tauChainResPres)\n\nlemma tauStepChainPar1:\n fixes \\ :: 'b\n and \\\\<^sub>Q :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>Q :: \"name list\"\n\n assumes \"\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>\\ P'\"\n and \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* P\"\n\n shows \"\\ \\ P \\ Q \\\\<^sub>\\ P' \\ Q\"\nusing assms\nby(induct rule: trancl.induct) (auto dest: Par1 tauStepChainFreshChain trancl_into_trancl)\n\nlemma tauChainPar1:\n fixes \\ :: 'b\n and \\\\<^sub>Q :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>Q :: \"name list\"\n\n assumes \"\\ \\ \\\\<^sub>Q \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* P\"\n\n shows \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P' \\ Q\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl intro: tauStepChainPar1)\n\nlemma tauStepChainPar2:\n fixes \\ :: 'b\n and \\\\<^sub>P :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>P :: \"name list\"\n\n assumes \"\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>\\ Q'\"\n and \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* Q\"\n\n shows \"\\ \\ P \\ Q \\\\<^sub>\\ P \\ Q'\"\nusing assms\nby(induct rule: trancl.induct) (auto dest: Par2 trancl_into_trancl tauStepChainFreshChain)\n\nlemma tauChainPar2:\n fixes \\ :: 'b\n and \\\\<^sub>P :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>P :: \"name list\"\n\n assumes \"\\ \\ \\\\<^sub>P \\ Q \\\\<^sup>^\\<^sub>\\ Q'\"\n and \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* Q\"\n\n shows \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P \\ Q'\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl intro: tauStepChainPar2)\n\nlemma tauStepChainBang:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\ !P \\\\<^sub>\\ P'\"\n and \"guarded P\"\n\n shows \"\\ \\ !P \\\\<^sub>\\ P'\"\nusing assms\nby(induct x1==\"P \\ !P\" P' rule: trancl.induct) (auto intro: Bang dest: Bang trancl_into_trancl)\n\nlemma tauStepChainStatEq:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sub>\\ P'\"\n and \"\\ \\ \\'\"\n\n shows \"\\' \\ P \\\\<^sub>\\ P'\"\nusing assms\nby(induct rule: trancl.induct) (auto dest: statEqTransition trancl_into_trancl)\n\nlemma tauChainStatEq:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"\\ \\ \\'\"\n\n shows \"\\' \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nusing assms\nby(auto simp add: rtrancl_eq_or_trancl intro: tauStepChainStatEq)\n\ndefinition weakTransition :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi \\ 'a action \\ ('a, 'b, 'c) psi \\ bool\" (\"_ : _ \\ _ \\_ \\ _\" [80, 80, 80, 80, 80] 80)\nwhere\n \"\\ : Q \\ P \\\\ \\ P' \\ \\P''. \\ \\ P \\\\<^sup>^\\<^sub>\\ P'' \\ (insertAssertion (extractFrame Q) \\) \\\\<^sub>F (insertAssertion (extractFrame P'') \\) \\\n \\ \\ P'' \\\\ \\ P'\"\n\nlemma weakTransitionI:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and P'' :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and \"\\ \\ P'' \\\\ \\ P'\"\n\n shows \"\\ : Q \\ P \\\\ \\ P'\"\nusing assms\nby(auto simp add: weakTransition_def)\n\nlemma weakTransitionE:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ : Q \\ P \\\\ \\ P'\"\n\n obtains P'' where \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and \"\\ \\ P'' \\\\ \\ P'\"\nusing assms\nby(auto simp add: weakTransition_def)\n\nlemma weakTransitionClosed[eqvt]:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"\\ : Q \\ P \\\\ \\ P'\"\n\n shows \"(p \\ \\) : (p \\ Q) \\ (p \\ P) \\(p \\ \\)\\ (p \\ P')\"\nproof -\n from assms obtain P'' where \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n\n from `\\ \\ P \\\\<^sup>^\\<^sub>\\ P''` have \"(p \\ \\) \\ (p \\ P) \\\\<^sup>^\\<^sub>\\ (p \\ P'')\"\n by(rule tauChainEqvt)\n moreover from `insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\` \n have \"(p \\ (insertAssertion (extractFrame Q) \\)) \\\\<^sub>F (p \\ (insertAssertion (extractFrame P'') \\))\"\n by(rule FrameStatImpClosed)\n hence \"insertAssertion (extractFrame(p \\ Q)) (p \\ \\) \\\\<^sub>F insertAssertion (extractFrame(p \\ P'')) (p \\ \\)\" by(simp add: eqvts)\n moreover from `\\ \\ P'' \\\\ \\ P'` have \"(p \\ \\) \\ (p \\ P'') \\(p \\ (\\ \\ P'))\"\n by(rule semantics.eqvt)\n hence \"(p \\ \\) \\ (p \\ P'') \\(p \\ \\) \\ (p \\ P')\" by(simp add: eqvts)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n(*\nlemma weakTransitionAlpha:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n and yvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and S: \"set p \\ set xvec \\ set(p \\ xvec)\"\n and \"xvec \\* (p \\ xvec)\"\n and \"(p \\ xvec) \\* P\"\n and \"(p \\ xvec) \\* N\"\n\n shows \"\\ : Q \\ P \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ P')\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n note PChain QeqP''\n moreover from PChain `(p \\ xvec) \\* P` have \"(p \\ xvec) \\* P''\" by(rule tauChainFreshChain)\n with P''Trans `xvec \\* (p \\ xvec)` `(p \\ xvec) \\* N` have \"(p \\ xvec) \\* P'\"\n by(force intro: outputFreshChainDerivative)\n with P''Trans S `(p \\ xvec) \\* N` have \"\\ \\ P'' \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ P')\"\n by(simp add: boundOutputChainAlpha'')\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n*)\nlemma weakOutputAlpha:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n and yvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ P'\"\n and S: \"set p \\ set xvec \\ set(p \\ xvec)\"\n and \"distinctPerm p\"\n and \"xvec \\* P\"\n and \"xvec \\* (p \\ xvec)\"\n and \"(p \\ xvec) \\* M\"\n and \"distinct xvec\"\n\n shows \"\\ : Q \\ P \\M\\\\*xvec\\\\N\\ \\ (p \\ P')\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ P'\"\n by(rule weakTransitionE)\n\n\n note PChain QeqP''\n moreover from PChain `xvec \\* P` have \"xvec \\* P''\" by(rule tauChainFreshChain)\n with P''Trans `xvec \\* (p \\ xvec)` `distinct xvec` `(p \\ xvec) \\* M` have \"xvec \\* (p \\ N)\" and \"xvec \\* P'\"\n by(force intro: outputFreshChainDerivative)+\n hence \"(p \\ xvec) \\* (p \\ p \\ N)\" and \"(p \\ xvec) \\* (p \\ P')\"\n by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])+\n with `distinctPerm p` have \"(p \\ xvec) \\* N\" and \"(p \\ xvec) \\* (p \\ P')\" by simp+\n with P''Trans S `distinctPerm p` have \"\\ \\ P'' \\M\\\\*xvec\\\\N\\ \\ (p \\ P')\"\n apply(simp add: residualInject)\n by(subst boundOutputChainAlpha) auto\n \n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakFreshDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"x \\ P\"\n and \"x \\ \\\"\n and \"bn \\ \\* subject \\\"\n and \"distinct(bn \\)\"\n\n shows \"x \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and P''Trans: \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `x \\ P` have \"x \\ P''\" by(rule tauChainFresh)\n with P''Trans show \"x \\ P'\" using `x \\ \\` `bn \\ \\* subject \\` `distinct(bn \\)`\n by(force intro: freeFreshDerivative)\nqed\n\nlemma weakFreshChainDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and yvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"yvec \\* P\"\n and \"yvec \\* \\\"\n and \"bn \\ \\* subject \\\"\n and \"distinct(bn \\)\"\n\n shows \"yvec \\* P'\"\nusing assms\nby(induct yvec) (auto intro: weakFreshDerivative)\n\nlemma weakInputFreshDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes PTrans: \"\\ : Q \\ P \\M\\N\\ \\ P'\"\n and \"x \\ P\"\n and \"x \\ N\"\n\n shows \"x \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and P''Trans: \"\\ \\ P'' \\M\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `x \\ P` have \"x \\ P''\" by(rule tauChainFresh)\n with P''Trans show \"x \\ P'\" using `x \\ N` \n by(force intro: inputFreshDerivative)\nqed\n\nlemma weakInputFreshChainDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\N\\ \\ P'\"\n and \"xvec \\* P\"\n and \"xvec \\* N\"\n\n shows \"xvec \\* P'\"\nusing assms\nby(induct xvec) (auto intro: weakInputFreshDerivative)\n\nlemma weakOutputFreshDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and x :: name\n\n assumes PTrans: \"\\ : Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n and \"x \\ P\"\n and \"x \\ xvec\"\n and \"xvec \\* M\"\n and \"distinct xvec\"\n\n shows \"x \\ N\"\n and \"x \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and P''Trans: \"\\ \\ P'' \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `x \\ P` have \"x \\ P''\" by(rule tauChainFresh)\n with P''Trans show \"x \\ N\" and \"x \\ P'\" using `x \\ xvec` `xvec \\* M` `distinct xvec`\n by(force intro: outputFreshDerivative)+\nqed\n\nlemma weakOutputFreshChainDerivative:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and yvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n and \"yvec \\* P\"\n and \"xvec \\* yvec\"\n and \"xvec \\* M\"\n and \"distinct xvec\"\n\n shows \"yvec \\* N\"\n and \"yvec \\* P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and P''Trans: \"\\ \\ P'' \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `yvec \\* P` have \"yvec \\* P''\" by(rule tauChainFreshChain)\n with P''Trans show \"yvec \\* N\" and \"yvec \\* P'\" using `xvec \\* yvec` `xvec \\* M` `distinct xvec`\n by(force intro: outputFreshChainDerivative)+\nqed\n\nlemma weakOutputPermSubject:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n and yvec :: \"name list\"\n and zvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n and S: \"set p \\ set yvec \\ set zvec\"\n and \"yvec \\* \\\"\n and \"zvec \\* \\\"\n and \"yvec \\* P\"\n and \"zvec \\* P\"\n\n shows \"\\ : Q \\ P \\(p \\ M)\\\\*xvec\\\\N\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\" \n and P''Trans: \"\\ \\ P'' \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `yvec \\* P` `zvec \\* P` have \"yvec \\* P''\" and \"zvec \\* P''\"\n by(force intro: tauChainFreshChain)+\n\n note PChain QeqP''\n moreover from P''Trans S `yvec \\* \\` `zvec \\* \\` `yvec \\* P''` `zvec \\* P''` have \"\\ \\ P'' \\(p \\ M)\\\\*xvec\\\\N\\ \\ P'\"\n by(rule_tac outputPermSubject) (assumption | auto)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakInputPermSubject:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n and yvec :: \"name list\"\n and zvec :: \"name list\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\N\\ \\ P'\"\n and S: \"set p \\ set yvec \\ set zvec\"\n and \"yvec \\* \\\"\n and \"zvec \\* \\\"\n and \"yvec \\* P\"\n and \"zvec \\* P\"\n\n shows \"\\ : Q \\ P \\(p \\ M)\\N\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\" \n and P''Trans: \"\\ \\ P'' \\M\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `yvec \\* P` `zvec \\* P` have \"yvec \\* P''\" and \"zvec \\* P''\"\n by(force intro: tauChainFreshChain)+\n\n note PChain QeqP''\n moreover from P''Trans S `yvec \\* \\` `zvec \\* \\` `yvec \\* P''` `zvec \\* P''` have \"\\ \\ P'' \\(p \\ M)\\N\\ \\ P'\"\n by(rule_tac inputPermSubject) auto\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakInput:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and K :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and Tvec :: \"'a list\"\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ M \\ K\"\n and \"distinct xvec\" \n and \"set xvec \\ supp N\"\n and \"length xvec = length Tvec\"\n and Qeq\\: \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n\n shows \"\\ : Q \\ M\\\\*xvec N\\.P \\K\\(N[xvec::=Tvec])\\ \\ P[xvec::=Tvec]\"\nproof -\n have \"\\ \\ M\\\\*xvec N\\.P \\\\<^sup>^\\<^sub>\\ M\\\\*xvec N\\.P\" by simp\n moreover from Qeq\\ have \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\\\*xvec N\\.P)) \\\"\n by auto\n moreover from assms have \"\\ \\ M\\\\*xvec N\\.P \\K\\(N[xvec::=Tvec])\\ \\ P[xvec::=Tvec]\"\n by(rule_tac Input)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakOutput:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and K :: 'a\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ M \\ K\"\n and Qeq\\: \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n\n shows \"\\ : Q \\ M\\N\\.P \\K\\N\\ \\ P\"\nproof -\n have \"\\ \\ M\\N\\.P \\\\<^sup>^\\<^sub>\\ M\\N\\.P\" by simp\n moreover from Qeq\\ have \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\N\\.P)) \\\"\n by auto\n moreover have \"insertAssertion (extractFrame(M\\N\\.P)) \\ \\\\<^sub>F insertAssertion (extractFrame(M\\N\\.P)) \\\" by simp\n moreover from `\\ \\ M \\ K` have \"\\ \\ M\\N\\.P \\K\\N\\ \\ P\"\n by(rule Output)\n ultimately show ?thesis by(rule_tac weakTransitionI) auto\nqed\n\nlemma insertGuardedAssertion:\n fixes P :: \"('a, 'b, 'c) psi\"\n\n assumes \"guarded P\"\n\n shows \"insertAssertion(extractFrame P) \\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\nproof -\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" by(rule freshFrame)\n from `guarded P` FrP have \"\\\\<^sub>P \\ \\\" and \"supp \\\\<^sub>P = ({}::name set)\"\n by(blast dest: guardedStatEq)+\n \n from FrP `A\\<^sub>P \\* \\` `\\\\<^sub>P \\ \\` have \"insertAssertion(extractFrame P) \\ \\\\<^sub>F \\A\\<^sub>P, \\ \\ \\\\\"\n by simp (metis frameIntCompositionSym)\n moreover from `A\\<^sub>P \\* \\` have \"\\A\\<^sub>P, \\ \\ \\\\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n by(rule_tac frameResFreshChain) auto\n ultimately show ?thesis by(rule FrameStatEqTrans)\nqed\n \nlemma weakCase:\n fixes \\ :: 'b \n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"(\\, P) mem CsP\"\n and \"\\ \\ \\\"\n and \"guarded P\"\n and RImpQ: \"insertAssertion (extractFrame R) \\ \\\\<^sub>F insertAssertion (extractFrame Q) \\\"\n and ImpR: \"insertAssertion (extractFrame R) \\ \\\\<^sub>F \\\\, \\\\\"\n\n shows \"\\ : R \\ Cases CsP \\\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n show ?thesis\n proof(case_tac \"P = P''\")\n assume \"P = P''\"\n have \"\\ \\ Cases CsP \\\\<^sup>^\\<^sub>\\ Cases CsP\" by simp\n moreover from ImpR AssertionStatEq_def have \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame(Cases CsP)) \\\"\n by(rule_tac FrameStatImpTrans) (auto intro: Identity)+\n\n moreover from P''Trans `(\\, P) mem CsP` `\\ \\ \\` `guarded P` `P = P''` have \"\\ \\ Cases CsP \\\\ \\ P'\"\n by(blast intro: Case)\n ultimately show ?thesis\n by(rule weakTransitionI)\n next\n assume \"P \\ P''\"\n with PChain have \"\\ \\ P \\\\<^sub>\\ P''\" by(simp add: rtrancl_eq_or_trancl)\n hence \"\\ \\ Cases CsP \\\\<^sub>\\ P''\" using `(\\, P) mem CsP` `\\ \\ \\` `guarded P` \n by(rule tauStepChainCase)\n hence \"\\ \\ Cases CsP \\\\<^sup>^\\<^sub>\\ P''\" by simp\n moreover from RImpQ QeqP'' have \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame P'') \\\"\n by(rule FrameStatImpTrans)\n ultimately show ?thesis using P''Trans by(rule weakTransitionI)\n qed\nqed\n\nlemma weakOpen:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : Q \\ P \\M\\\\*(xvec@yvec)\\\\N\\ \\ P'\"\n and \"x \\ supp N\"\n and \"x \\ \\\"\n and \"x \\ M\"\n and \"x \\ xvec\"\n and \"x \\ yvec\"\n\n shows \"\\ : \\\\x\\Q \\ \\\\x\\P \\M\\\\*(xvec@x#yvec)\\\\N\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\M\\\\*(xvec@yvec)\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `x \\ \\` have \"\\ \\ \\\\x\\P \\\\<^sup>^\\<^sub>\\ \\\\x\\P''\" by(rule tauChainResPres)\n moreover from QeqP'' `x \\ \\` have \"insertAssertion (extractFrame(\\\\x\\Q)) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\x\\P'')) \\\" by(force intro: frameImpResPres)\n moreover from P''Trans `x \\ supp N` `x \\ \\` `x \\ M` `x \\ xvec` `x \\ yvec` have \"\\ \\ \\\\x\\P'' \\M\\\\*(xvec@x#yvec)\\\\N\\ \\ P'\"\n by(rule Open)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakScope:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"x \\ \\\"\n and \"x \\ \\\"\n\n shows \"\\ : \\\\x\\Q \\ \\\\x\\P \\\\ \\ \\\\x\\P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\" and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `x \\ \\` have \"\\ \\ \\\\x\\P \\\\<^sup>^\\<^sub>\\ \\\\x\\P''\" by(rule tauChainResPres)\n moreover from QeqP'' `x \\ \\` have \"insertAssertion (extractFrame(\\\\x\\Q)) \\ \\\\<^sub>F insertAssertion (extractFrame(\\\\x\\P'')) \\\" by(force intro: frameImpResPres)\n moreover from P''Trans `x \\ \\` `x \\ \\` have \"\\ \\ \\\\x\\P'' \\\\ \\ \\\\x\\P'\"\n by(rule Scope)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\n\n\n assumes PTrans: \"\\ \\ \\\\<^sub>Q : R \\ P \\\\ \\ P'\"\n and FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\"\n and \"bn \\ \\* Q\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* P\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* R\"\n\n shows \"\\ : R \\ Q \\ P \\ Q \\\\ \\ P' \\ Q\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>Q \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and ReqP'': \"insertAssertion (extractFrame R) (\\ \\ \\\\<^sub>Q) \\\\<^sub>F insertAssertion (extractFrame P'') (\\ \\ \\\\<^sub>Q)\"\n and P''Trans: \"\\ \\ \\\\<^sub>Q \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `A\\<^sub>Q \\* P` have \"A\\<^sub>Q \\* P''\" by(rule tauChainFreshChain)\n from PChain FrQ `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` have \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P'' \\ Q\" by(rule tauChainPar1)\n moreover have \"insertAssertion (extractFrame(R \\ Q)) \\ \\\\<^sub>F insertAssertion (extractFrame(P'' \\ Q)) \\\"\n proof -\n obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* A\\<^sub>Q\" and \"A\\<^sub>R \\* \\\\<^sub>Q\" and \"A\\<^sub>R \\* \\\"\n by(rule_tac C=\"(A\\<^sub>Q, \\\\<^sub>Q, \\)\" in freshFrame) auto\n obtain A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"A\\<^sub>P'' \\* A\\<^sub>Q\" and \"A\\<^sub>P'' \\* \\\\<^sub>Q\" and \"A\\<^sub>P'' \\* \\\"\n by(rule_tac C=\"(A\\<^sub>Q, \\\\<^sub>Q, \\)\" in freshFrame) auto\n\n from FrR FrP'' `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* P''` `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>P'' \\* A\\<^sub>Q` have \"A\\<^sub>Q \\* \\\\<^sub>R\" and \"A\\<^sub>Q \\* \\\\<^sub>P''\"\n by(force dest: extractFrameFreshChain)+\n have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\\"\n by(metis frameNilStatEq frameResChainPres Associativity Commutativity Composition AssertionStatEqTrans)\n moreover from ReqP'' FrR FrP'' `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* \\\\<^sub>Q`\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\\" using freshCompChain by auto\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', \\ \\ \\\\<^sub>P'' \\ \\\\<^sub>Q\\\"\n by(metis frameNilStatEq frameResChainPres Associativity Commutativity Composition AssertionStatEqTrans)\n ultimately have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P'', \\ \\ \\\\<^sub>P'' \\ \\\\<^sub>Q\\\"\n by(force dest: FrameStatImpTrans simp add: FrameStatEq_def)\n\n hence \"\\(A\\<^sub>R@A\\<^sub>Q), \\ \\ \\\\<^sub>R \\ \\\\<^sub>Q\\ \\\\<^sub>F \\(A\\<^sub>P''@A\\<^sub>Q), \\ \\ \\\\<^sub>P'' \\ \\\\<^sub>Q\\\"\n apply(simp add: frameChainAppend)\n apply(drule_tac xvec=A\\<^sub>Q in frameImpResChainPres)\n by(metis frameImpChainComm FrameStatImpTrans)\n with FrR FrQ FrP'' `A\\<^sub>R \\* A\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>R` `A\\<^sub>P'' \\* A\\<^sub>Q` `A\\<^sub>P'' \\* \\\\<^sub>Q` `A\\<^sub>Q \\* \\\\<^sub>P''` `A\\<^sub>R \\* \\` `A\\<^sub>P'' \\* \\` `A\\<^sub>Q \\* \\` ReqP''\n show ?thesis by simp\n qed\n moreover from P''Trans FrQ `bn \\ \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P''` `A\\<^sub>Q \\* \\` have \"\\ \\ P'' \\ Q \\\\ \\ (P' \\ Q)\"\n by(rule Par1) \n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakPar2:\n fixes \\ :: 'b\n and R :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and Q' :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>P :: \"name list\"\n and \\\\<^sub>P :: 'b\n\n assumes QTrans: \"\\ \\ \\\\<^sub>P : R \\ Q \\\\ \\ Q'\"\n and FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"bn \\ \\* P\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* Q\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* R\"\n\n shows \"\\ : P \\ R \\ P \\ Q \\\\ \\ P \\ Q'\"\nproof -\n from QTrans obtain Q'' where QChain: \"\\ \\ \\\\<^sub>P \\ Q \\\\<^sup>^\\<^sub>\\ Q''\"\n and ReqQ'': \"insertAssertion (extractFrame R) (\\ \\ \\\\<^sub>P) \\\\<^sub>F insertAssertion (extractFrame Q'') (\\ \\ \\\\<^sub>P)\"\n and Q''Trans: \"\\ \\ \\\\<^sub>P \\ Q'' \\\\ \\ Q'\"\n by(rule weakTransitionE)\n\n from QChain `A\\<^sub>P \\* Q` have \"A\\<^sub>P \\* Q''\" by(rule tauChainFreshChain)\n\n from QChain FrP `A\\<^sub>P \\* \\` `A\\<^sub>P \\* Q` have \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P \\ Q''\" by(rule tauChainPar2)\n moreover have \"insertAssertion (extractFrame(P \\ R)) \\ \\\\<^sub>F insertAssertion (extractFrame(P \\ Q'')) \\\"\n proof -\n obtain A\\<^sub>R \\\\<^sub>R where FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\" and \"A\\<^sub>R \\* A\\<^sub>P\" and \"A\\<^sub>R \\* \\\\<^sub>P\" and \"A\\<^sub>R \\* \\\"\n by(rule_tac C=\"(A\\<^sub>P, \\\\<^sub>P, \\)\" in freshFrame) auto\n obtain A\\<^sub>Q'' \\\\<^sub>Q'' where FrQ'': \"extractFrame Q'' = \\A\\<^sub>Q'', \\\\<^sub>Q''\\\" and \"A\\<^sub>Q'' \\* A\\<^sub>P\" and \"A\\<^sub>Q'' \\* \\\\<^sub>P\" and \"A\\<^sub>Q'' \\* \\\"\n by(rule_tac C=\"(A\\<^sub>P, \\\\<^sub>P, \\)\" in freshFrame) auto\n\n from FrR FrQ'' `A\\<^sub>P \\* R` `A\\<^sub>P \\* Q''` `A\\<^sub>R \\* A\\<^sub>P` `A\\<^sub>Q'' \\* A\\<^sub>P` have \"A\\<^sub>P \\* \\\\<^sub>R\" and \"A\\<^sub>P \\* \\\\<^sub>Q''\"\n by(force dest: extractFrameFreshChain)+\n have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>R, (\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R\\\"\n by(metis frameNilStatEq frameResChainPres Associativity Commutativity Composition AssertionStatEqTrans)\n\n moreover from ReqQ'' FrR FrQ'' `A\\<^sub>R \\* \\` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>Q'' \\* \\` `A\\<^sub>Q'' \\* \\\\<^sub>P`\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>P) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q'', (\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q''\\\" using freshCompChain by simp\n moreover have \"\\A\\<^sub>Q'', (\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q''\\ \\\\<^sub>F \\A\\<^sub>Q'', \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q''\\\"\n by(metis frameNilStatEq frameResChainPres Associativity Commutativity Composition AssertionStatEqTrans)\n ultimately have \"\\A\\<^sub>R, \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>Q'', \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q''\\\"\n by(force dest: FrameStatImpTrans simp add: FrameStatEq_def)\n hence \"\\(A\\<^sub>P@A\\<^sub>R), \\ \\ \\\\<^sub>P \\ \\\\<^sub>R\\ \\\\<^sub>F \\(A\\<^sub>P@A\\<^sub>Q''), \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q''\\\"\n apply(simp add: frameChainAppend)\n apply(drule_tac xvec=A\\<^sub>P in frameImpResChainPres)\n by(metis frameImpChainComm FrameStatImpTrans)\n with FrR FrP FrQ'' `A\\<^sub>R \\* A\\<^sub>P` `A\\<^sub>R \\* \\\\<^sub>P` `A\\<^sub>P \\* \\\\<^sub>R` `A\\<^sub>Q'' \\* A\\<^sub>P` `A\\<^sub>Q'' \\* \\\\<^sub>P` `A\\<^sub>P \\* \\\\<^sub>Q''` `A\\<^sub>R \\* \\` `A\\<^sub>Q'' \\* \\` `A\\<^sub>P \\* \\` ReqQ''\n show ?thesis by simp\n qed\n moreover from Q''Trans FrP `bn \\ \\* P` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* Q''` `A\\<^sub>P \\* \\` have \"\\ \\ P \\ Q'' \\\\ \\ (P \\ Q')\"\n by(rule_tac Par2) auto\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma weakComm1:\n fixes \\ :: 'b\n and R :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>Q :: \"name list\"\n and \\\\<^sub>Q :: 'b\n\n assumes PTrans: \"\\ \\ \\\\<^sub>Q : R \\ P \\M\\N\\ \\ P'\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\K\\\\*xvec\\\\N\\ \\ Q'\"\n and FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\"\n and MeqK: \"\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n and \"A\\<^sub>R \\* R\"\n and \"A\\<^sub>R \\* M\"\n and \"A\\<^sub>R \\* A\\<^sub>Q\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* P\"\n and \"A\\<^sub>Q \\* Q\"\n and \"A\\<^sub>Q \\* R\"\n and \"A\\<^sub>Q \\* K\"\n and \"xvec \\* P\"\n\n shows \"\\ \\ P \\ Q \\\\<^sub>\\ (\\\\*xvec\\(P' \\ Q'))\"\nproof -\n from `extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K` `A\\<^sub>R \\* A\\<^sub>Q`\n obtain A\\<^sub>Q' where FrQ': \"extractFrame Q = \\A\\<^sub>Q', \\\\<^sub>Q\\\" and \"distinct A\\<^sub>Q'\" and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* P\" \n and \"A\\<^sub>Q' \\* Q\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* K\" and \"A\\<^sub>R \\* A\\<^sub>Q'\"\n by(rule_tac C=\"(\\, P, Q, R, K, A\\<^sub>R)\" in distinctFrame) auto\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>Q \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and RimpP'': \"insertAssertion (extractFrame R) (\\ \\ \\\\<^sub>Q) \\\\<^sub>F insertAssertion (extractFrame P'') (\\ \\ \\\\<^sub>Q)\"\n and P''Trans: \"\\ \\ \\\\<^sub>Q \\ P'' \\M\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `A\\<^sub>Q' \\* P` have \"A\\<^sub>Q' \\* P''\" by(rule tauChainFreshChain)\n obtain A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"A\\<^sub>P'' \\* (\\, A\\<^sub>Q', \\\\<^sub>Q, A\\<^sub>R, \\\\<^sub>R, M, N, K, R, Q, P'', xvec)\" and \"distinct A\\<^sub>P''\"\n by(rule freshFrame)\n hence \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* A\\<^sub>Q'\" and \"A\\<^sub>P'' \\* \\\\<^sub>Q\" and \"A\\<^sub>P'' \\* M\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* Q\"\n and \"A\\<^sub>P'' \\* N\" and \"A\\<^sub>P'' \\* K\" and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* xvec\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\"\n by simp+\n from FrR `A\\<^sub>R \\* A\\<^sub>Q'` `A\\<^sub>Q' \\* R` have \"A\\<^sub>Q' \\* \\\\<^sub>R\" by(drule_tac extractFrameFreshChain) auto\n from FrQ' `A\\<^sub>R \\* A\\<^sub>Q'` `A\\<^sub>R \\* Q` have \"A\\<^sub>R \\* \\\\<^sub>Q\" by(drule_tac extractFrameFreshChain) auto\n from PChain `xvec \\* P` have \"xvec \\* P''\" by(force intro: tauChainFreshChain)+\n\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\\" \n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n moreover with RimpP'' FrP'' FrR `A\\<^sub>P'' \\* \\` `A\\<^sub>R \\* \\` `A\\<^sub>P'' \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>Q`\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\\" using freshCompChain\n by(simp add: freshChainSimps)\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'') \\ \\\\<^sub>Q\\\"\n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n ultimately have RImpP'': \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'') \\ \\\\<^sub>Q\\\"\n by(rule FrameStatEqImpCompose)\n \n from PChain FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P` have \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P'' \\ Q\" by(rule tauChainPar1)\n moreover from QTrans FrR P''Trans MeqK RImpP'' FrP'' FrQ' `distinct A\\<^sub>P''` `distinct A\\<^sub>Q'` `A\\<^sub>P'' \\* A\\<^sub>Q'` `A\\<^sub>R \\* A\\<^sub>Q'`\n `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P''` `A\\<^sub>Q' \\* Q` `A\\<^sub>Q' \\* R` `A\\<^sub>Q' \\* K` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* Q`\n `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* M` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* M`\n obtain K' where \"\\ \\ \\\\<^sub>P'' \\ Q \\K'\\\\*xvec\\\\N\\ \\ Q'\" and \"\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>Q \\ M \\ K'\" and \"A\\<^sub>Q' \\* K'\"\n by(rule_tac comm1Aux) (assumption | simp)+\n with P''Trans FrP'' have \"\\ \\ P'' \\ Q \\\\ \\ \\\\*xvec\\(P' \\ Q')\" using FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P''` `A\\<^sub>Q' \\* Q`\n `xvec \\* P''` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* Q` `A\\<^sub>P'' \\* M` `A\\<^sub>P'' \\* A\\<^sub>Q'`\n by(rule_tac Comm1)\n ultimately show ?thesis\n by(drule_tac tauActTauStepChain) auto\nqed\n\nlemma weakComm2:\n fixes \\ :: 'b\n and R :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>Q :: \"name list\"\n and \\\\<^sub>Q :: 'b\n\n assumes PTrans: \"\\ \\ \\\\<^sub>Q : R \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n and FrR: \"extractFrame R = \\A\\<^sub>R, \\\\<^sub>R\\\"\n and QTrans: \"\\ \\ \\\\<^sub>R \\ Q \\K\\N\\ \\ Q'\"\n and FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\"\n and MeqK: \"\\ \\ \\\\<^sub>R \\ \\\\<^sub>Q \\ M \\ K\"\n and \"A\\<^sub>R \\* \\\"\n and \"A\\<^sub>R \\* P\"\n and \"A\\<^sub>R \\* Q\"\n and \"A\\<^sub>R \\* R\"\n and \"A\\<^sub>R \\* M\"\n and \"A\\<^sub>R \\* A\\<^sub>Q\"\n and \"A\\<^sub>Q \\* \\\"\n and \"A\\<^sub>Q \\* P\"\n and \"A\\<^sub>Q \\* Q\"\n and \"A\\<^sub>Q \\* R\"\n and \"A\\<^sub>Q \\* K\"\n and \"xvec \\* Q\"\n and \"xvec \\* M\"\n and \"xvec \\* A\\<^sub>Q\"\n and \"xvec \\* A\\<^sub>R\"\n\n shows \"\\ \\ P \\ Q \\\\<^sub>\\ (\\\\*xvec\\(P' \\ Q'))\"\nproof -\n from `extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* R` `A\\<^sub>Q \\* K` `A\\<^sub>R \\* A\\<^sub>Q` `xvec \\* A\\<^sub>Q`\n obtain A\\<^sub>Q' where FrQ': \"extractFrame Q = \\A\\<^sub>Q', \\\\<^sub>Q\\\" and \"distinct A\\<^sub>Q'\" and \"A\\<^sub>Q' \\* \\\" and \"A\\<^sub>Q' \\* P\" \n and \"A\\<^sub>Q' \\* Q\" and \"A\\<^sub>Q' \\* R\" and \"A\\<^sub>Q' \\* K\" and \"A\\<^sub>R \\* A\\<^sub>Q'\" and \"A\\<^sub>Q' \\* xvec\"\n by(rule_tac C=\"(\\, P, Q, R, K, A\\<^sub>R, xvec)\" in distinctFrame) auto\n\n from PTrans obtain P'' where PChain: \"\\ \\ \\\\<^sub>Q \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and RimpP'': \"insertAssertion (extractFrame R) (\\ \\ \\\\<^sub>Q) \\\\<^sub>F insertAssertion (extractFrame P'') (\\ \\ \\\\<^sub>Q)\"\n and P''Trans: \"\\ \\ \\\\<^sub>Q \\ P'' \\M\\\\*xvec\\\\N\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `A\\<^sub>Q' \\* P` have \"A\\<^sub>Q' \\* P''\" by(rule tauChainFreshChain)\n obtain A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"A\\<^sub>P'' \\* (\\, A\\<^sub>Q', \\\\<^sub>Q, A\\<^sub>R, \\\\<^sub>R, M, N, K, R, Q, P'', xvec)\" and \"distinct A\\<^sub>P''\"\n by(rule freshFrame)\n hence \"A\\<^sub>P'' \\* \\\" and \"A\\<^sub>P'' \\* A\\<^sub>Q'\" and \"A\\<^sub>P'' \\* \\\\<^sub>Q\" and \"A\\<^sub>P'' \\* M\" and \"A\\<^sub>P'' \\* R\" and \"A\\<^sub>P'' \\* Q\"\n and \"A\\<^sub>P'' \\* N\" and \"A\\<^sub>P'' \\* K\" and \"A\\<^sub>P'' \\* A\\<^sub>R\" and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* xvec\" and \"A\\<^sub>P'' \\* \\\\<^sub>R\"\n by simp+\n from FrR `A\\<^sub>R \\* A\\<^sub>Q'` `A\\<^sub>Q' \\* R` have \"A\\<^sub>Q' \\* \\\\<^sub>R\" by(drule_tac extractFrameFreshChain) auto\n from FrQ' `A\\<^sub>R \\* A\\<^sub>Q'` `A\\<^sub>R \\* Q` have \"A\\<^sub>R \\* \\\\<^sub>Q\" by(drule_tac extractFrameFreshChain) auto\n\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\\" \n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n moreover with RimpP'' FrP'' FrR `A\\<^sub>P'' \\* \\` `A\\<^sub>R \\* \\` `A\\<^sub>P'' \\* \\\\<^sub>Q` `A\\<^sub>R \\* \\\\<^sub>Q`\n have \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>R\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\\" using freshCompChain\n by(simp add: freshChainSimps)\n moreover have \"\\A\\<^sub>P'', (\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P''\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'') \\ \\\\<^sub>Q\\\"\n by(metis frameResChainPres frameNilStatEq Commutativity AssertionStatEqTrans Composition Associativity)\n ultimately have RImpP'': \"\\A\\<^sub>R, (\\ \\ \\\\<^sub>R) \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>P'', (\\ \\ \\\\<^sub>P'') \\ \\\\<^sub>Q\\\"\n by(rule FrameStatEqImpCompose)\n \n from PChain FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P` have \"\\ \\ P \\ Q \\\\<^sup>^\\<^sub>\\ P'' \\ Q\" by(rule tauChainPar1)\n moreover from QTrans FrR P''Trans MeqK RImpP'' FrP'' FrQ' `distinct A\\<^sub>P''` `distinct A\\<^sub>Q'` `A\\<^sub>P'' \\* A\\<^sub>Q'` `A\\<^sub>R \\* A\\<^sub>Q'`\n `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P''` `A\\<^sub>Q' \\* Q` `A\\<^sub>Q' \\* R` `A\\<^sub>Q' \\* K` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* R` `A\\<^sub>P'' \\* Q`\n `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* M` `A\\<^sub>Q \\* R` `A\\<^sub>R \\* Q` `A\\<^sub>R \\* M` `xvec \\* A\\<^sub>R` `xvec \\* M` `A\\<^sub>Q' \\* xvec`\n obtain K' where \"\\ \\ \\\\<^sub>P'' \\ Q \\K'\\N\\ \\ Q'\" and \"\\ \\ \\\\<^sub>P'' \\ \\\\<^sub>Q \\ M \\ K'\" and \"A\\<^sub>Q' \\* K'\"\n by(rule_tac comm2Aux) (assumption | simp)+\n with P''Trans FrP'' have \"\\ \\ P'' \\ Q \\\\ \\ \\\\*xvec\\(P' \\ Q')\" using FrQ' `A\\<^sub>Q' \\* \\` `A\\<^sub>Q' \\* P''` `A\\<^sub>Q' \\* Q`\n `xvec \\* Q` `A\\<^sub>P'' \\* \\` `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* Q` `A\\<^sub>P'' \\* M` `A\\<^sub>P'' \\* A\\<^sub>Q'`\n by(rule_tac Comm2)\n ultimately show ?thesis\n by(drule_tac tauActTauStepChain) auto\nqed\n\nlemma frameImpIntComposition:\n fixes \\ :: 'b\n and \\' :: 'b\n and A\\<^sub>F :: \"name list\"\n and \\\\<^sub>F :: 'b\n\n assumes \"\\ \\ \\'\"\n\n shows \"\\A\\<^sub>F, \\ \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>F, \\' \\ \\\\<^sub>F\\\"\nproof -\n from assms have \"\\A\\<^sub>F, \\ \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>F, \\' \\ \\\\<^sub>F\\\" by(rule frameIntComposition)\n thus ?thesis by(simp add: FrameStatEq_def)\nqed\n\nlemma insertAssertionStatImp:\n fixes F :: \"'b frame\"\n and \\ :: 'b\n and G :: \"'b frame\"\n and \\' :: 'b\n\n assumes FeqG: \"insertAssertion F \\ \\\\<^sub>F insertAssertion G \\\"\n and \"\\ \\ \\'\"\n\n shows \"insertAssertion F \\' \\\\<^sub>F insertAssertion G \\'\"\nproof -\n obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\" and \"A\\<^sub>F \\* \\\" and \"A\\<^sub>F \\* \\'\"\n by(rule_tac C=\"(\\, \\')\" in freshFrame) auto\n obtain A\\<^sub>G \\\\<^sub>G where FrG: \"G = \\A\\<^sub>G, \\\\<^sub>G\\\" and \"A\\<^sub>G \\* \\\" and \"A\\<^sub>G \\* \\'\"\n by(rule_tac C=\"(\\, \\')\" in freshFrame) auto\n\n from `\\ \\ \\'` have \"\\A\\<^sub>F, \\' \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>F, \\ \\ \\\\<^sub>F\\\" by (metis frameIntComposition FrameStatEqSym)\n moreover from `\\ \\ \\'` have \"\\A\\<^sub>G, \\ \\ \\\\<^sub>G\\ \\\\<^sub>F \\A\\<^sub>G, \\' \\ \\\\<^sub>G\\\" by(rule frameIntComposition)\n ultimately have \"\\A\\<^sub>F, \\' \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\' \\ \\\\<^sub>G\\\" using FeqG FrF FrG `A\\<^sub>F \\* \\` `A\\<^sub>G \\* \\` `\\ \\ \\'`\n by(force simp add: FrameStatEq_def dest: FrameStatImpTrans)\n with FrF FrG `A\\<^sub>F \\* \\'` `A\\<^sub>G \\* \\'` show ?thesis by simp\nqed\n\nlemma insertAssertionStatEq:\n fixes F :: \"'b frame\"\n and \\ :: 'b\n and G :: \"'b frame\"\n and \\' :: 'b\n\n assumes FeqG: \"insertAssertion F \\ \\\\<^sub>F insertAssertion G \\\"\n and \"\\ \\ \\'\"\n\n shows \"insertAssertion F \\' \\\\<^sub>F insertAssertion G \\'\"\nproof -\n obtain A\\<^sub>F \\\\<^sub>F where FrF: \"F = \\A\\<^sub>F, \\\\<^sub>F\\\" and \"A\\<^sub>F \\* \\\" and \"A\\<^sub>F \\* \\'\"\n by(rule_tac C=\"(\\, \\')\" in freshFrame) auto\n obtain A\\<^sub>G \\\\<^sub>G where FrG: \"G = \\A\\<^sub>G, \\\\<^sub>G\\\" and \"A\\<^sub>G \\* \\\" and \"A\\<^sub>G \\* \\'\"\n by(rule_tac C=\"(\\, \\')\" in freshFrame) auto\n\n from FeqG FrF FrG `A\\<^sub>F \\* \\` `A\\<^sub>G \\* \\` `\\ \\ \\'`\n have \"\\A\\<^sub>F, \\' \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>G, \\' \\ \\\\<^sub>G\\\"\n by simp (metis frameIntComposition FrameStatEqTrans FrameStatEqSym)\n with FrF FrG `A\\<^sub>F \\* \\'` `A\\<^sub>G \\* \\'` show ?thesis by simp\nqed\n\nlemma weakTransitionStatEq:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"\\ \\ \\'\"\n\n shows \"\\' : Q \\ P \\\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P''\"\n and QeqP'': \"insertAssertion (extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n\n from PChain `\\ \\ \\'` have \"\\' \\ P \\\\<^sup>^\\<^sub>\\ P''\" by(rule tauChainStatEq)\n moreover from QeqP'' `\\ \\ \\'` have \"insertAssertion (extractFrame Q) \\' \\\\<^sub>F insertAssertion (extractFrame P'') \\'\"\n by(rule insertAssertionStatImp)\n moreover from P''Trans `\\ \\ \\'` have \"\\' \\ P'' \\\\ \\ P'\"\n by(rule statEqTransition)\n ultimately show ?thesis by(rule weakTransitionI)\nqed\n\nlemma transitionWeakTransition:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\\\ \\ P'\"\n and \"insertAssertion(extractFrame Q) \\ \\\\<^sub>F insertAssertion(extractFrame P) \\\"\n\n shows \"\\ : Q \\ P \\\\ \\ P'\"\nusing assms\nby(fastforce intro: weakTransitionI)\n\nlemma weakPar1Guarded:\n fixes \\ :: 'b\n and R :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : R \\ P \\\\ \\ P'\"\n and \"bn \\ \\* Q\"\n and \"guarded Q\"\n\n shows \"\\ : (R \\ Q) \\ P \\ Q \\\\ \\ P' \\ Q\"\nproof -\n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* P\" and \"A\\<^sub>Q \\* \\\" and \"A\\<^sub>Q \\* R\"\n by(rule_tac C=\"(\\, P, \\, R)\" in freshFrame) auto\n from `guarded Q` FrQ have \"\\\\<^sub>Q \\ \\\" by(blast dest: guardedStatEq)\n with PTrans have \"\\ \\ \\\\<^sub>Q : R \\ P \\\\ \\ P'\" by(metis weakTransitionStatEq Identity AssertionStatEqSym compositionSym)\n thus ?thesis using FrQ `bn \\ \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* R` \n by(rule weakPar1)\nqed\n\nlemma weakBang:\n fixes \\ :: 'b\n and R :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : R \\ P \\ !P \\\\ \\ P'\"\n and \"guarded P\"\n\n shows \"\\ : R \\ !P \\\\ \\ P'\"\nproof -\n from PTrans obtain P'' where PChain: \"\\ \\ P \\ !P \\\\<^sup>^\\<^sub>\\ P''\"\n and RImpP'': \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame P'') \\\"\n and P''Trans: \"\\ \\ P'' \\\\ \\ P'\"\n by(rule weakTransitionE)\n moreover obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" and \"A\\<^sub>P \\* \\\" by(rule freshFrame)\n moreover from `guarded P` FrP have \"\\\\<^sub>P \\ \\\" by(blast dest: guardedStatEq)\n ultimately show ?thesis\n proof(auto simp add: rtrancl_eq_or_trancl)\n have \"\\ \\ !P \\\\<^sup>^\\<^sub>\\ !P\" by simp\n moreover assume RimpP: \"insertAssertion(extractFrame R) \\ \\\\<^sub>F \\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\\"\n have \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame(!P)) \\\"\n proof -\n from `\\\\<^sub>P \\ \\` have \"\\A\\<^sub>P, \\ \\ \\\\<^sub>P \\ \\\\ \\\\<^sub>F \\A\\<^sub>P, \\ \\ \\\\\"\n by(metis frameIntCompositionSym frameIntAssociativity frameIntCommutativity frameIntIdentity FrameStatEqTrans FrameStatEqSym)\n moreover from `A\\<^sub>P \\* \\` have \"\\A\\<^sub>P, \\ \\ \\\\ \\\\<^sub>F \\\\, \\ \\ \\\\\"\n by(force intro: frameResFreshChain)\n ultimately show ?thesis using RimpP by(auto simp add: FrameStatEq_def dest: FrameStatImpTrans)\n qed\n moreover assume \"\\ \\ P \\ !P \\\\ \\ P'\"\n hence \"\\ \\ !P \\\\ \\ P'\" using `guarded P` by(rule Bang)\n ultimately show ?thesis by(rule weakTransitionI)\n next\n fix P'''\n assume \"\\ \\ P \\ !P \\\\<^sub>\\ P''\"\n hence \"\\ \\ !P \\\\<^sub>\\ P''\" using `guarded P` by(rule tauStepChainBang)\n hence \"\\ \\ !P \\\\<^sup>^\\<^sub>\\ P''\" by simp\n moreover assume \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame P'') \\\"\n and \"\\ \\ P'' \\\\ \\ P'\"\n ultimately show ?thesis by(rule weakTransitionI)\n qed\nqed\n\nlemma weakTransitionFrameImp:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"insertAssertion(extractFrame R) \\ \\\\<^sub>F insertAssertion(extractFrame Q) \\\"\n\n shows \"\\ : R \\ P \\\\ \\ P'\"\nusing assms\nby(auto simp add: weakTransition_def intro: FrameStatImpTrans)\n\nlemma guardedFrameStatEq:\n fixes P :: \"('a, 'b, 'c) psi\"\n\n assumes \"guarded P\"\n\n shows \"extractFrame P \\\\<^sub>F \\\\, \\\\\"\nproof -\n obtain A\\<^sub>P \\\\<^sub>P where FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" by(rule freshFrame)\n from `guarded P` FrP have \"\\\\<^sub>P \\ \\\" by(blast dest: guardedStatEq)\n hence \"\\A\\<^sub>P, \\\\<^sub>P\\ \\\\<^sub>F \\A\\<^sub>P, \\\\\" by(rule_tac frameResChainPres) auto\n moreover have \"\\A\\<^sub>P, \\\\ \\\\<^sub>F \\\\, \\\\\" by(rule_tac frameResFreshChain) auto\n ultimately show ?thesis using FrP by(force intro: FrameStatEqTrans)\nqed\n\nlemma weakGuardedTransition:\n fixes \\ :: 'b\n and Q :: \"('a, 'b, 'c) psi\"\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and R :: \"('a, 'b, 'c) psi\"\n\n assumes PTrans: \"\\ : Q \\ P \\\\ \\ P'\"\n and \"guarded Q\"\n\n shows \"\\ : \\ \\ P \\\\ \\ P'\"\nproof -\n obtain A\\<^sub>Q \\\\<^sub>Q where FrQ: \"extractFrame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\\" and \"A\\<^sub>Q \\* \\\" by(rule freshFrame)\n moreover from `guarded Q` FrQ have \"\\\\<^sub>Q \\ \\\" by(blast dest: guardedStatEq)\n hence \"\\A\\<^sub>Q, \\ \\ \\\\<^sub>Q\\ \\\\<^sub>F \\A\\<^sub>Q, \\ \\ \\\\\" by(metis frameIntCompositionSym)\n moreover from `A\\<^sub>Q \\* \\` have \"\\A\\<^sub>Q, \\ \\ \\\\ \\\\<^sub>F \\\\, \\ \\ \\\\\" by(rule_tac frameResFreshChain) auto\n ultimately have \"insertAssertion(extractFrame Q) \\ \\\\<^sub>F insertAssertion (extractFrame (\\)) \\\"\n using FrQ `A\\<^sub>Q \\* \\` by simp (blast intro: FrameStatEqTrans)\n with PTrans show ?thesis by(rule_tac weakTransitionFrameImp) (auto simp add: FrameStatEq_def) \nqed\n\nlemma expandTauChainFrame:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>P :: \"name list\"\n and \\\\<^sub>P :: 'b\n and C :: \"'d::fs_name\"\n\n assumes PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"distinct A\\<^sub>P\"\n and \"A\\<^sub>P \\* P\"\n and \"A\\<^sub>P \\* C\"\n\n obtains \\' A\\<^sub>P' \\\\<^sub>P' where \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\" and \"A\\<^sub>P' \\* P'\" and \"A\\<^sub>P' \\* C\" and \"distinct A\\<^sub>P'\"\nusing PChain FrP `A\\<^sub>P \\* P`\nproof(induct arbitrary: thesis rule: tauChainInduct)\n case(TauBase P)\n have \"\\\\<^sub>P \\ SBottom' \\ \\\\<^sub>P\" by(rule Identity)\n with `extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\` show ?case using `A\\<^sub>P \\* P` `A\\<^sub>P \\* C` `distinct A\\<^sub>P` by(rule TauBase)\nnext\n case(TauStep P P' P'')\n from `extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\` `A\\<^sub>P \\* P`\n obtain \\' A\\<^sub>P' \\\\<^sub>P' where FrP': \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\"\n and \"A\\<^sub>P' \\* P'\" and \"A\\<^sub>P' \\* C\" and \"distinct A\\<^sub>P'\"\n by(rule_tac TauStep)\n from `\\ \\ P' \\\\ \\ P''` FrP' `distinct A\\<^sub>P'` `A\\<^sub>P' \\* P'` `A\\<^sub>P' \\* C`\n obtain \\'' A\\<^sub>P'' \\\\<^sub>P'' where FrP'': \"extractFrame P'' = \\A\\<^sub>P'', \\\\<^sub>P''\\\" and \"\\\\<^sub>P' \\ \\'' \\ \\\\<^sub>P''\"\n and \"A\\<^sub>P'' \\* P''\" and \"A\\<^sub>P'' \\* C\" and \"distinct A\\<^sub>P''\"\n by(rule expandTauFrame)\n from `\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'` have \"(\\\\<^sub>P \\ \\') \\ \\'' \\ \\\\<^sub>P' \\ \\''\" by(rule Composition)\n with `\\\\<^sub>P' \\ \\'' \\ \\\\<^sub>P''` have \"\\\\<^sub>P \\ \\' \\ \\'' \\ \\\\<^sub>P''\"\n by(metis AssertionStatEqTrans Associativity Commutativity)\n with FrP'' show ?case using `A\\<^sub>P'' \\* P''` `A\\<^sub>P'' \\* C` `distinct A\\<^sub>P''`\n by(rule TauStep)\nqed\n\nlemma frameIntImpComposition:\n fixes \\ :: 'b\n and \\' :: 'b\n and A\\<^sub>F :: \"name list\"\n and \\\\<^sub>F :: 'b\n\n assumes \"\\ \\ \\'\"\n\n shows \"\\A\\<^sub>F, \\ \\ \\\\<^sub>F\\ \\\\<^sub>F \\A\\<^sub>F, \\' \\ \\\\<^sub>F\\\"\nusing assms frameIntComposition\nby(simp add: FrameStatEq_def)\n\nlemma tauChainInduct2[consumes 1, case_names TauBase TauStep]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes PChain: \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and cBase: \"\\P. Prop P P\"\n and cStep: \"\\P P' P''. \\\\ \\ P' \\\\ \\ P''; \\ \\ P \\\\<^sup>^\\<^sub>\\ P'; Prop P P'\\ \\ Prop P P''\"\n\n shows \"Prop P P'\"\nusing assms\nby(rule tauChainInduct)\n\nlemma tauStepChainInduct2[consumes 1, case_names TauBase TauStep]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes PChain: \"\\ \\ P \\\\<^sub>\\ P'\"\n and cBase: \"\\P P'. \\ \\ P \\\\ \\ P' \\ Prop P P'\"\n and cStep: \"\\P P' P''. \\\\ \\ P' \\\\ \\ P''; \\ \\ P \\\\<^sub>\\ P'; Prop P P'\\ \\ Prop P P''\"\n\n shows \"Prop P P'\"\nusing assms\nby(rule tauStepChainInduct)\n\nlemma weakTransferTauChainFrame:\n fixes \\\\<^sub>F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and A\\<^sub>P :: \"name list\"\n and \\\\<^sub>P :: 'b\n and A\\<^sub>F :: \"name list\"\n and A\\<^sub>G :: \"name list\"\n and \\\\<^sub>G :: 'b\n\n assumes PChain: \"\\\\<^sub>F \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\"\n and \"distinct A\\<^sub>P\"\n and FeqG: \"\\\\. insertAssertion (\\A\\<^sub>F, \\\\<^sub>F \\ \\\\<^sub>P\\) \\ \\\\<^sub>F insertAssertion (\\A\\<^sub>G, \\\\<^sub>G \\ \\\\<^sub>P\\) \\\"\n and \"A\\<^sub>F \\* \\\\<^sub>G\"\n and \"A\\<^sub>G \\* \\\"\n and \"A\\<^sub>G \\* \\\\<^sub>F\"\n and \"A\\<^sub>F \\* A\\<^sub>G\"\n and \"A\\<^sub>F \\* P\"\n and \"A\\<^sub>G \\* P\"\n and \"A\\<^sub>P \\* A\\<^sub>F\"\n and \"A\\<^sub>P \\* A\\<^sub>G\"\n and \"A\\<^sub>P \\* \\\\<^sub>F\"\n and \"A\\<^sub>P \\* \\\\<^sub>G\"\n and \"A\\<^sub>P \\* P\"\n\n shows \"\\\\<^sub>G \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nusing PChain FrP `A\\<^sub>F \\* P` `A\\<^sub>G \\* P` `A\\<^sub>P \\* P` \nproof(induct rule: tauChainInduct2)\n case TauBase\n thus ?case by simp\nnext\n case(TauStep P P' P'')\n have FrP: \"extractFrame P = \\A\\<^sub>P, \\\\<^sub>P\\\" by fact\n then have PChain: \"\\\\<^sub>G \\ P \\\\<^sup>^\\<^sub>\\ P'\" using `A\\<^sub>F \\* P` `A\\<^sub>G \\* P` `A\\<^sub>P \\* P` by(rule TauStep)\n then obtain A\\<^sub>P' \\\\<^sub>P' \\' where FrP': \"extractFrame P' = \\A\\<^sub>P', \\\\<^sub>P'\\\" and \"\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'\"\n and \"A\\<^sub>P' \\* A\\<^sub>F\" and \"A\\<^sub>P' \\* A\\<^sub>G\" and \"A\\<^sub>P' \\* \\\\<^sub>F\" and \"A\\<^sub>P' \\* \\\\<^sub>G\"\n and \"distinct A\\<^sub>P'\"\n \n using FrP `distinct A\\<^sub>P` `A\\<^sub>P \\* P` `A\\<^sub>P \\* A\\<^sub>F` `A\\<^sub>P \\* A\\<^sub>G` `A\\<^sub>P \\* \\\\<^sub>F` `A\\<^sub>P \\* \\\\<^sub>G`\n by(rule_tac C=\"(A\\<^sub>F, A\\<^sub>G, \\\\<^sub>F, \\\\<^sub>G)\" in expandTauChainFrame) auto\n\n from PChain `A\\<^sub>F \\* P` `A\\<^sub>G \\* P` have \"A\\<^sub>F \\* P'\" and \"A\\<^sub>G \\* P'\" by(blast dest: tauChainFreshChain)+\n\n with `A\\<^sub>F \\* P` `A\\<^sub>G \\* P` `A\\<^sub>P \\* A\\<^sub>F` `A\\<^sub>P \\* A\\<^sub>G``A\\<^sub>P' \\* A\\<^sub>F` `A\\<^sub>P' \\* A\\<^sub>G` FrP FrP'\n have \"A\\<^sub>F \\* \\\\<^sub>P\" and \"A\\<^sub>G \\* \\\\<^sub>P\" and \"A\\<^sub>F \\* \\\\<^sub>P'\" and \"A\\<^sub>G \\* \\\\<^sub>P'\"\n by(auto dest: extractFrameFreshChain)\n\n from FeqG have FeqG: \"insertAssertion (\\A\\<^sub>F, \\\\<^sub>F \\ \\\\<^sub>P\\) \\' \\\\<^sub>F insertAssertion (\\A\\<^sub>G, \\\\<^sub>G \\ \\\\<^sub>P\\) \\'\"\n by blast\n obtain p::\"name prm\" where \"(p \\ A\\<^sub>F) \\* \\\\<^sub>F\" and \"(p \\ A\\<^sub>F) \\* \\\\<^sub>P\" and \"(p \\ A\\<^sub>F) \\* \\\\<^sub>P'\" and \"(p \\ A\\<^sub>F) \\* \\'\"\n and Sp: \"(set p) \\ set A\\<^sub>F \\ set(p \\ A\\<^sub>F)\" and \"distinctPerm p\"\n by(rule_tac xvec=A\\<^sub>F and c=\"(\\\\<^sub>F, \\\\<^sub>P, \\', \\\\<^sub>P')\" in name_list_avoiding) auto\n obtain q::\"name prm\" where \"(q \\ A\\<^sub>G) \\* \\\\<^sub>G\" and \"(q \\ A\\<^sub>G) \\* \\\\<^sub>P\" and \"(q \\ A\\<^sub>G) \\* \\\\<^sub>P'\" and \"(q \\ A\\<^sub>G) \\* \\'\"\n and Sq: \"(set q) \\ set A\\<^sub>G \\ set(q \\ A\\<^sub>G)\" and \"distinctPerm q\"\n by(rule_tac xvec=A\\<^sub>G and c=\"(\\\\<^sub>G, \\\\<^sub>P, \\', \\\\<^sub>P')\" in name_list_avoiding) auto\n from `\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'` have \"\\(p \\ A\\<^sub>F), ((p \\ \\\\<^sub>F) \\ \\\\<^sub>P')\\ \\\\<^sub>F \\(p \\ A\\<^sub>F), (p \\ \\\\<^sub>F) \\ (\\\\<^sub>P \\ \\')\\\"\n by(rule frameIntCompositionSym[OF AssertionStatEqSym])\n hence \"\\(p \\ A\\<^sub>F), (p \\ \\\\<^sub>F) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\(p \\ A\\<^sub>F), \\' \\ ((p \\ \\\\<^sub>F) \\ \\\\<^sub>P)\\\"\n by(metis frameIntAssociativity FrameStatEqTrans frameIntCommutativity FrameStatEqSym)\n moreover from FeqG `A\\<^sub>F \\* \\\\<^sub>P` `(p \\ A\\<^sub>F) \\* \\\\<^sub>P` `(p \\ A\\<^sub>F) \\* \\\\<^sub>F` `(p \\ A\\<^sub>F) \\* \\'` Sp\n have \"\\(p \\ A\\<^sub>F), \\' \\ ((p \\ \\\\<^sub>F) \\ \\\\<^sub>P)\\ \\\\<^sub>F insertAssertion (\\A\\<^sub>G, \\\\<^sub>G \\ \\\\<^sub>P\\) \\'\"\n apply(erule_tac rev_mp) by(subst frameChainAlpha) (auto simp add: eqvts)\n hence \"\\(p \\ A\\<^sub>F), \\' \\ ((p \\ \\\\<^sub>F) \\ \\\\<^sub>P)\\ \\\\<^sub>F (\\(q \\ A\\<^sub>G), \\' \\ (q \\ \\\\<^sub>G) \\ \\\\<^sub>P\\)\"\n using `A\\<^sub>G \\* \\\\<^sub>P` `(q \\ A\\<^sub>G) \\* \\\\<^sub>P` `(q \\ A\\<^sub>G) \\* \\\\<^sub>G` `(q \\ A\\<^sub>G) \\* \\'` Sq\n apply(erule_tac rev_mp) by(subst frameChainAlpha) (auto simp add: eqvts)\n moreover have \"\\(q \\ A\\<^sub>G), \\' \\ ((q \\ \\\\<^sub>G) \\ \\\\<^sub>P)\\ \\\\<^sub>F \\(q \\ A\\<^sub>G), (q \\ \\\\<^sub>G) \\ (\\\\<^sub>P \\ \\')\\\"\n by(metis frameIntAssociativity FrameStatEqTrans frameIntCommutativity FrameStatEqSym)\n hence \"\\(q \\ A\\<^sub>G), \\' \\ ((q \\ \\\\<^sub>G) \\ \\\\<^sub>P)\\ \\\\<^sub>F \\(q \\ A\\<^sub>G), (q \\ \\\\<^sub>G) \\ \\\\<^sub>P'\\\" using `\\\\<^sub>P \\ \\' \\ \\\\<^sub>P'`\n by(blast intro: FrameStatEqTrans frameIntCompositionSym)\n ultimately have \"\\(p \\ A\\<^sub>F), (p \\ \\\\<^sub>F) \\ \\\\<^sub>P'\\ \\\\<^sub>F \\(q \\ A\\<^sub>G), (q \\ \\\\<^sub>G) \\ \\\\<^sub>P'\\\"\n by(rule FrameStatEqImpCompose)\n with `A\\<^sub>F \\* \\\\<^sub>P'` `(p \\ A\\<^sub>F) \\* \\\\<^sub>P'` `(p \\ A\\<^sub>F) \\* \\\\<^sub>F` Sp have \"\\A\\<^sub>F, \\\\<^sub>F \\ \\\\<^sub>P'\\ \\\\<^sub>F \\(q \\ A\\<^sub>G), (q \\ \\\\<^sub>G) \\ \\\\<^sub>P'\\\"\n by(subst frameChainAlpha) (auto simp add: eqvts)\n with `A\\<^sub>G \\* \\\\<^sub>P'` `(q \\ A\\<^sub>G) \\* \\\\<^sub>P'` `(q \\ A\\<^sub>G) \\* \\\\<^sub>G` Sq have \"\\A\\<^sub>F, \\\\<^sub>F \\ \\\\<^sub>P'\\ \\\\<^sub>F \\A\\<^sub>G, \\\\<^sub>G \\ \\\\<^sub>P'\\\"\n by(subst frameChainAlpha) (auto simp add: eqvts)\n \n with `\\\\<^sub>F \\ P' \\\\ \\ P''` FrP' `distinct A\\<^sub>P'`\n `A\\<^sub>F \\* P'` `A\\<^sub>G \\* P'` `A\\<^sub>F \\* \\\\<^sub>G` `A\\<^sub>G \\* \\\\<^sub>F` `A\\<^sub>P' \\* A\\<^sub>F` `A\\<^sub>P' \\* A\\<^sub>G` `A\\<^sub>P' \\* \\\\<^sub>F` `A\\<^sub>P' \\* \\\\<^sub>G`\n have \"\\\\<^sub>G \\ P' \\\\ \\ P''\" by(rule_tac transferTauFrame)\n with PChain show ?case by(simp add: r_into_rtrancl rtrancl_into_rtrancl)\nqed\n\ncoinductive quiet :: \"('a, 'b, 'c) psi \\ bool\"\n where \"\\\\\\. (insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\\, \\\\ \\ \n (\\Rs. \\ \\ P \\ Rs \\ (\\P'. Rs = \\ \\ P' \\ quiet P')))\\ \\ quiet P\"\n\nlemma quietFrame:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"quiet P\"\n\n shows \"insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\\, \\\\\"\nusing assms\nby(erule_tac quiet.cases) force\n \nlemma quietTransition:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rs :: \"('a, 'b, 'c) residual\"\n\n assumes \"quiet P\"\n and \"\\ \\ P \\ Rs\"\n\n obtains P' where \"Rs = \\ \\ P'\" and \"quiet P'\"\nusing assms\nby(erule_tac quiet.cases) force\n \nlemma quietEqvt:\n fixes P :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes \"quiet P\"\n\n shows \"quiet(p \\ P)\"\nproof -\n let ?X = \"\\P. \\p::name prm. quiet(p \\ P)\"\n from assms have \"?X (p \\ P)\" by(rule_tac x=\"rev p\" in exI) auto\n thus ?thesis\n apply coinduct\n apply(clarify)\n apply(rule_tac x=x in exI)\n apply auto\n apply(drule_tac \\=\"p \\ \\\" in quietFrame)\n apply(drule_tac p=\"rev p\" in FrameStatEqClosed)\n apply(simp add: eqvts)\n apply(drule_tac pi=p in semantics.eqvt)\n apply(erule_tac quietTransition)\n apply assumption\n apply(rule_tac x=\"rev p \\ P'\" in exI)\n apply auto\n apply(drule_tac pi=\"rev p\" in pt_bij3)\n apply(simp add: eqvts)\n apply(rule_tac x=p in exI)\n by simp\nqed\n \n\nlemma quietOutput:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\M\\\\*xvec\\\\N\\ \\ P'\"\n and \"quiet P\"\n\n shows False\nusing assms\napply(erule_tac quiet.cases)\nby(force simp add: residualInject)\n\nlemma quietInput:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\M\\N\\ \\ P'\"\n and \"quiet P\"\n\n shows False\nusing assms\nby(erule_tac quiet.cases) (force simp add: residualInject)\n\nlemma quietTau:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n \n assumes \"\\ \\ P \\\\ \\ P'\"\n and \"insertAssertion (extractFrame P) \\ \\\\<^sub>F \\\\, \\\\\"\n and \"quiet P\"\n\n shows \"quiet P'\"\nusing assms\nby(erule_tac quiet.cases) (force simp add: residualInject)\n\nlemma tauChainCases[consumes 1, case_names TauBase TauStep]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n and \"P = P' \\ Prop\"\n and \"\\ \\ P \\\\<^sub>\\ P' \\ Prop\"\n\n shows Prop\nusing assms\nby(blast elim: rtranclE dest: rtrancl_into_trancl1)\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Tau_Chain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.25284104150788594}} {"text": "theory MonadicWhileExample\n imports \"../Refine_Imperative_HOL/Sepref\"\n \"NREST.RefineMonadicVCG\"\n \"../Refine_Imperative_HOL/IICF/IICF\"\n Complex_Main\n \"HOL-Decision_Procs.Approximation\"\nbegin\n\n\n\ndefinition \"bodytime = 20+rbt_delete_time_logN (Suc (10))\"\ndefinition Prog :: \"nat set nrest\" where\n \"Prog = do { \n (s::nat set) \\ mop_set_empty 10;\n (s::nat set) \\ mop_set_insert (\\x. rbt_insert_logN (card x + 1)) (1::nat) s; \n monadic_WHILEIE\n (\\s. finite s \\ card (s::nat set) \\ 10) (\\s. card (s::nat set) * (bodytime)) \n (\\s. do { b \\ mop_set_isempty (\\_. 10) s; RETURNT (~b) })\n (\\s. do {\n x \\ mop_set_pick (\\_. 10) s;\n mop_set_del (\\s'. rbt_delete_time_logN (card s' + 1)) s x\n }\n ) (s::nat set) }\"\n\nterm Prog\n\nlemma pff: \"x \\ s \\ finite s \\ card s > 0\"\n using card_gt_0_iff by blast \n\nlemma mm2_some_leq: \"Some a \\ mm2 (Some b) (Some c) \\ (c \\ b \\ a \\ b - c )\"\n unfolding mm2_def by(auto)\n\n\nlemma F: \"160 * (\\2 * log 2 11\\ + 1) \\ 1991\"\n by (approximation 10)\nlemma G: \"10 \\ 99550 - 8000 * (\\2 * log 2 11\\ + 1)\"\n by (approximation 10)\n\nlemma z: \"cs \\ 10 \\ rbt_delete_time_logN (Suc cs) \\ rbt_delete_time_logN (Suc 10)\"\n apply(rule rbt_delete_time_logN_mono) by auto\n\nlemma \"Prog \\ SPECT [ {} \\ enat 100000 ]\"\n unfolding Prog_def\n apply(rule T_specifies_I)\n apply (vcg'\\-\\ rules: mop_set_empty mop_set_insert mop_set_isempty ) \n apply(split if_split) apply clarsimp\n apply(intro allI impI conjI)\n apply (vcg'\\-\\ rules: mop_set_empty mop_set_pick mop_set_del ) \n subgoal apply (auto simp: card_Diff1_le dest: pff )\n apply(simp only: Nat.diff_mult_distrib[symmetric])\n apply(subst diff_diff_cancel) subgoal by(auto dest: pff) \n apply(simp add: bodytime_def )\n apply(frule z) by simp\n subgoal by (auto ) \n subgoal apply (auto simp: bodytime_def mm2_some_leq rbt_insert_logN_def rbt_delete_time_def btree_del_time_def rbt_delete_time_logN_def rbt_insert_time_def rbt_ins_time_def rbt_absch_def )\n subgoal \n using F by simp\n subgoal \n using G by simp\n done\n subgoal by simp\n done\n\n\n\n\n\nsepref_definition remdups_impl is \"uncurry0 (Prog)\" :: \"unit_assn\\<^sup>k \\\\<^sub>a rbt_set_assn\"\n unfolding Prog_def monadic_WHILEIE_def monadic_WHILE_aux\n\n apply sepref_dbg_preproc\n apply sepref_dbg_cons_init\n apply sepref_dbg_id \n apply sepref_dbg_monadify\n apply sepref_dbg_opt_init \n apply sepref_dbg_trans_step+ \n apply sepref_dbg_opt\n apply sepref_dbg_cons_solve \\ \\Frame rule, recovering the invalidated list \n or pure elements, propagating recovery over the list structure\\\n apply sepref_dbg_cons_solve \\ \\Trivial frame rule\\\n apply sepref_dbg_constraints\n done\n\n\n\n\n\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Examples/MonadicWhileExample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.3923368301671084, "lm_q1q2_score": 0.25275323619293016}} {"text": "(* Title: HOL/Auth/n_mutualExDeadFree_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExDeadFree Protocol Case Study*} \n\ntheory n_mutualExDeadFree_lemma_inv__2_on_rules imports n_mutualExDeadFree_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_mutualExDeadFree/n_mutualExDeadFree_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.25269236430276043}} {"text": "theory \"ToyExamplesBlocks\"\n\nimports \"../Hoare/HoareTripleForBasicBlocks\"\nbegin\n\nlemmas evm_fun_simps = \n stack_inst_code.simps inst_size_def inst_code.simps \n\nlemmas blocks_simps = build_blocks_def byteListInt_def find_block_def blocks_indexes_def build_basic_blocks_def\n aux_basic_block.simps add_address_def block_pt_def\n\nlemma word_rcat_fixed_simps:\n fixes x::byte\n shows\n \"(word_rcat (x#xs) :: w256) = word_of_int (bin_rcat 8 (map uint (x#xs)))\"\n \"(word_rcat (x#xs) :: 160 word) = word_of_int (bin_rcat 8 (map uint (x#xs)))\"\n by (simp add: word_rcat_def)+\n\nlemmas word_rcat_simps = word_rcat_fixed_simps bin_rcat_def bin_cat_def\n\n\nlemmas pure_emp_simps = pure_def pure_sep emp_def emp_sep zero_set_def\n\nlemma word_rcat_eq: \"word_rcat [x] = x\"\n by (simp add: word_rcat_def bin_rcat_def)\n\nlemma pure_false_simps:\n\"(\\ False \\ \\* R) = \\ False \\\"\n\"(R \\* \\ False \\) = \\ False \\\"\nby (rule ext, simp add: pure_def sep_conj_def emp_def )+\n\ncontext\nnotes if_split[ split del ] sep_fun_simps[simp del]\ngas_value_simps[simp add] pure_emp_simps[simp add]\nevm_fun_simps[simp add] sep_lc[simp del] sep_conj_first[simp add]\npure_false_simps[simp add]\nbegin\n\n(* Example with a Jumpi and a No block *)\n\ndefinition ex1 where\n\"ex1 = build_blocks [ Stack (PUSH_N [1]), Stack (PUSH_N [8]), Pc JUMPI, Stack (PUSH_N [1]), Misc STOP, Pc JUMPDEST, Stack (PUSH_N [2]), Misc STOP]\"\n\nschematic_goal ex1_val:\n \" ex1 = ?p\"\n by(simp add: ex1_def word_rcat_simps Let_def dropWhile.simps blocks_simps next_i_def\n split:if_splits nat.splits option.splits )\n\nlemmas strengthen_insts =\ninst_strengthen_pre[OF inst_stack[OF inst_push_n]]\ninst_strengthen_pre[OF inst_stack[OF inst_pop]]\ninst_strengthen_pre[OF inst_stack[OF inst_calldataload]]\ninst_strengthen_pre[OF inst_swap]\ninst_strengthen_pre[OF inst_dup]\ninst_strengthen_pre[OF inst_memory[OF inst_mstore]]\ninst_strengthen_pre[OF inst_memory[OF inst_mload]]\ninst_strengthen_pre[OF inst_storage[OF inst_sload]]\ninst_strengthen_pre[OF inst_storage[OF inst_sstore]]\ninst_strengthen_pre[OF inst_info[OF inst_callvalue]]\ninst_strengthen_pre[OF inst_info[OF inst_caller]]\ninst_strengthen_pre[OF inst_info[OF inst_calldatasize]]\ninst_strengthen_pre[OF inst_pc[OF inst_jumpdest]]\ninst_strengthen_pre[OF inst_pc[OF inst_instPC]]\ninst_strengthen_pre[OF inst_misc[OF inst_stop]]\ninst_strengthen_pre[OF inst_misc[OF inst_return_memory]]\ninst_strengthen_pre[OF inst_misc[OF inst_return]]\ninst_strengthen_pre[OF inst_misc[OF inst_suicide]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_mul]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_div]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_mod]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_add]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_sub]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_gt]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_eq]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_lt]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_addmod]]\ninst_strengthen_pre[OF inst_arith[OF inst_arith_mulmod]]\ninst_strengthen_pre[OF inst_arith[OF inst_iszero]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_not]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_and]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_and]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_or]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_xor]]\ninst_strengthen_pre[OF inst_bits[OF inst_bits_byte]]\ninst_strengthen_pre[OF inst_unknown]\n\n\nlemma instantiate_emp:\n\"P sd \\ (P \\* emp) sd\"\napply(sep_simp simp: emp_sep)\ndone\n\nmethod sep_imp_solve =\nclarsimp;\n(rule conjI),\n (clarsimp simp add: word_rcat_def)?,\n (sep_cancel)+,\n (erule instantiate_emp)?,\n(simp)\n\nmethod sep_imp_solve_cancel_simp =\nclarsimp?;\n(rule conjI),\n (clarsimp simp add: word_rcat_def)?,\n (sep_cancel, simp?)+,\n (erule instantiate_emp)?,\n(simp)\n\nmethod triple_seq_vcg =\n (rule seq_inst; ((rule strengthen_insts) | triple_seq_vcg)?) |\n rule seq_empty\n\nmethod triple_jumpi_vcg =\n ((rule blocks_jumpi; (rule refl)?),\n triple_seq_vcg, (sep_imp_solve_cancel_simp|sep_imp_solve)+); simp add: bin_rcat_def\n\nmethod triple_jump_vcg =\n ((rule blocks_jump; (rule refl)?),\n triple_seq_vcg, sep_imp_solve+); simp add: bin_rcat_def\n\n\nmethod triple_no_vcg =\n (rule blocks_no; triple_seq_vcg, sep_imp_solve+),\n simp add: word_rcat_simps, sep_cancel+\n\nmethod triple_next_vcg =\n ((rule blocks_next; (rule refl)?),\n triple_seq_vcg, sep_imp_solve+); simp add: bin_rcat_def;\n (simp add: word_rcat_simps; sep_cancel+)?\n\n\nmethod triple_vcg =\n (triple_jumpi_vcg |\n triple_jump_vcg |\n triple_no_vcg |\n triple_next_vcg |\n rule blocks_false_pre)+\n\nthm triple_blocks.intros\n(* For a jumpif that can be solved statically, it works *)\nlemma\n \"\\rest. triple_blocks net ex1\n(continuing ** stack_height 0 ** program_counter 0 ** gas_pred 1000 ** memory_usage 0)\n(0,the (block_lookup ex1 0))\n(stack 0 (word_rcat [2::byte]) ** rest)\"\n apply(unfold ex1_val)\n apply (simp)\n apply(rule exI)\n apply triple_vcg\ndone\n\n(* Same example but we put an unknown value and an if in the post condition *)\n(* For a jumpif where we don't know at all which branch to follow, it works *)\ndefinition ex2 where\n\"ex2 x = build_blocks [ Stack (PUSH_N [x]), Stack (PUSH_N [8]), Pc JUMPI, Stack (PUSH_N [1]), Misc STOP, Pc JUMPDEST, Stack (PUSH_N [2]), Misc STOP]\"\n\nschematic_goal ex2_val:\n \" ex2 x = ?p\"\n by(simp add: ex2_def word_rcat_simps Let_def dropWhile.simps blocks_simps next_i_def\n split:if_splits nat.splits option.splits )\n\nlemma\n \" \\rest0 restn0. triple_blocks net (ex2 cond)\n(continuing ** stack_height 0 ** program_counter 0 ** gas_pred 1000 ** memory_usage 0)\n(0, the (block_lookup (ex2 cond) 0))\n(if word_rcat [cond] = (0::256 word) then stack 0 (word_rcat [1::byte]) ** restn0 else stack 0 (word_rcat [2::byte]) ** rest0)\n\"\n apply(unfold ex2_val)\n apply (simp split: if_splits, rule conjI; clarsimp)\n apply(rule exI, triple_vcg)\n apply(rule exI, triple_vcg)\n apply (clarsimp simp: word_rcat_simps bintrunc_def)\ndone\n\n(* Same example as the previous one but with the unknown value as a precondition *)\n\nlemma\n \"\\rest. triple_blocks net (ex2 cond)\n(continuing ** stack_height 0 ** program_counter 0 ** gas_pred 1000 ** memory_usage 0 **\n \\ (word_rcat [cond] \\ (0::256 word)) \\)\n(0,the (block_lookup (ex2 cond) 0))\n(stack 0 (word_rcat [2::byte]) ** rest )\n\"\napply(unfold ex2_val)\napply (simp)\napply(rule exI)\napply(triple_vcg)\ndone\n\n(* Example with a Jump and a Next block*)\n\ndefinition ex3 where\n\"ex3 = build_blocks [ Stack (PUSH_N [1]), Stack (PUSH_N [5]), Pc JUMP, Pc JUMPDEST, Stack (PUSH_N [2]), Pc JUMPDEST, Misc STOP]\"\n\nschematic_goal ex3_val:\n \" ex3 = ?p\"\n by(simp add: ex3_def word_rcat_simps Let_def dropWhile.simps blocks_simps next_i_def\n split:if_splits nat.splits option.splits )\n\nlemma\n \"\\rest. triple_blocks net ex3\n(continuing ** stack_height 0 ** program_counter 0 ** gas_pred 1000 ** memory_usage 0)\n(0, the (block_lookup ex3 0))\n(stack 0 (word_rcat [1::byte]) ** stack_height (Suc (Suc 0)) ** stack 1 (word_rcat [2::byte]) ** rest)\n\"\napply(unfold ex3_val)\napply (simp)\napply(rule exI)\napply(triple_vcg)\ndone\nend\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/example/ToyExamplesBlocks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.40356685373537454, "lm_q1q2_score": 0.25268296988264943}} {"text": "theory OpSem \nimports Main HOL.Rat \nbegin\n\ntype_synonym TS = rat (* Event *)\ntype_synonym T = nat (* Thread ID *)\ntype_synonym L = nat (*? Ref?*)\ndefinition \"null = (0 :: nat)\"\n\ntype_synonym V = nat\n\n(* bool: release/aquire or relaxed*)\ndatatype action =\n Read bool L V\n | Write bool L V\n | Update L V V\n\nprint_theorems\n\nfun avar :: \"action \\ L\" where\n \"avar (Read _ x v) = x\"\n | \"avar (Write _ x v) = x\"\n | \"avar (Update x e v) = x\"\n\nfun wr_val :: \"action \\ V option\" where\n \"wr_val (Write _ _ v) = Some v\"\n | \"wr_val (Update _ _ v) = Some v\"\n | \"wr_val _ = None\"\n\nfun rd_val :: \"action \\ V option\" where\n \"rd_val (Read _ _ v) = Some v\"\n | \"rd_val (Update _ v _) = Some v\"\n | \"rd_val _ = None\"\n\nfun isRA :: \"action \\ bool\" where\n \"isRA (Read b _ _) = b\" \n | \"isRA (Write b _ _) = b\"\n | \"isRA (Update _ _ _) = True\"\n\nfun isWr :: \"action \\ bool\" where\n \"isWr (Read _ _ _) = False\" \n | \"isWr (Write _ _ _) = True\"\n | \"isWr (Update _ _ _) = False\"\n\nfun isRd :: \"action \\ bool\" where\n \"isRd (Read _ _ _) = True\" \n | \"isRd (Write _ _ _) = False\"\n | \"isRd (Update _ _ _) = False\"\n\nfun isUp :: \"action \\ bool\" where\n \"isUp (Read _ _ _) = False\" \n | \"isUp (Write _ _ _) = False\"\n | \"isUp (Update _ _ _) = True\"\n\n\nabbreviation \"reads a \\ a \\ (dom rd_val)\"\nabbreviation \"writes a \\ a \\ (dom wr_val)\"\n\n\ntype_synonym View = \"L \\ T\"\n\ntype_synonym event = \"TS \\ T \\ action\"\n\nabbreviation time_stamp :: \"event \\ TS\" where \"time_stamp e \\ fst e\"\nabbreviation tid :: \"event \\ T\" where \"tid e \\ fst (snd e)\"\nabbreviation act :: \"event \\ action\" where \"act e \\ snd (snd e)\"\n\nabbreviation var :: \"L \\ TS \\ L\" where \"var \\ fst\"\nabbreviation tst :: \"L \\ TS \\ TS\" where \"tst \\ snd\"\n\n(*\n\n\nrecord write_record =\n val :: V\n is_releasing :: bool\n\nrecord surrey_state =\n writes :: \"(L \\ TS) set\"\n thrView :: \"T \\ L \\ (L \\ TS)\"\n modView :: \"(L \\ TS) \\ L \\ (L \\ TS)\"\n mods :: \"(L \\ TS) \\ write_record\"\n write_available :: \"(L \\ TS) \\ bool\" \\ \\rewrite as \"covered\" instead of write_available\\\n\n\ndefinition \"value \\ w \\ val (mods \\ w)\"\ndefinition \"releasing \\ w \\ is_releasing (mods \\ w)\"\n\ndefinition \"writes_on \\ x = {w . var w = x \\ w \\ writes \\}\"\ndefinition \"visible_writes \\ t x \\ {w \\ writes_on \\ x . tst(thrView \\ t x) \\ tst w}\" \\ \\is this observable writes?\\\n \n\n\nlemma writes_on_var [simp]: \"w \\ writes_on \\ x \\ var w = x\"\n by (simp add: writes_on_def)\n\nlemma visible_var [simp]: \"w \\ visible_writes \\ t x \\ var w = x\"\n by (auto simp add: visible_writes_def)\n\nlemma visible_writes_in_writes: \"visible_writes \\ t x \\ writes \\\"\n using visible_writes_def writes_on_def by fastforce\n\ndefinition \"valid_fresh_ts \\ w ts' \\ tst w < ts' \\ (\\ w' \\ writes_on \\ (var w). tst w < tst w' \\ ts' < tst w')\"\n\ndefinition \"ts_oride m m' x \\ if tst (m x) \\ tst (m' x) then m' x else m x\"\n\ndefinition rev_app :: \"'s \\ ('s \\ 't) \\ 't\" (infixl \";;\" 150)\n where\n \"rev_app s f \\ f s\"\n\n\ndefinition \n \"update_thrView t nv \\ \\ \\ \\ thrView := (thrView \\)(t := nv)\\\"\n\ndefinition \n \"update_modView w nv \\ \\ \\ \\ modView := (modView \\)(w := nv) \\\"\n\ndefinition \n \"update_mods w nwr \\ \\ \\ \\ mods := (mods \\)(w := nwr)\\ \\writes := writes \\ \\ {w}\\\"\n\ndefinition \n \"update_wa w b \\ \\ \\ \\ write_available := (write_available \\)(w := b)\\\"\n\ndefinition \"syncing \\ w b \\ releasing \\ w \\ b\"\n\nlemma [simp]: \"syncing \\ w False = False\"\n by (simp add: syncing_def)\n\nlemma [simp]: \"syncing \\ w True = releasing \\ w\"\n by (simp add: syncing_def)\n\ndefinition\n \"read_trans t b w \\ \\\n let new_thr_idx = (thrView \\ t)(var w := w) in\n let new_thr_idx' = \n if syncing \\ w b then ts_oride new_thr_idx (modView \\ w) else new_thr_idx in\n \\ ;; update_thrView t new_thr_idx'\"\n\nlemma [simp]: \"\\ syncing \\ w b \\ thrView (read_trans t b w \\) t = (thrView \\ t)(var w := w)\"\n by (simp add: read_trans_def rev_app_def update_thrView_def)\n\nlemma syncing_thrView_read_trans [simp]: \"syncing \\ w b \\\n thrView (read_trans t b w \\) t = ts_oride ((thrView \\ t)(var w := w)) (modView \\ w)\"\n by (simp add: read_trans_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"t' \\ t \\ thrView (read_trans t b w \\) t' = (thrView \\ t')\"\n apply (simp add: read_trans_def rev_app_def update_thrView_def)\n by (metis fun_upd_other surrey_state.select_convs(2) surrey_state.surjective surrey_state.update_convs(2))\n\nlemma [simp]: \"var w \\ x \\ b = False \\ thrView (read_trans t b w \\) t x = thrView \\ t x\"\n by (simp add: read_trans_def rev_app_def update_thrView_def Let_def ts_oride_def)\n\nlemma [simp]: \"modView (read_trans t b w \\) = modView \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"mods (read_trans t b w \\) = mods \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n \nlemma [simp]: \"write_available (read_trans t b w \\) = write_available \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes (read_trans t b w \\) = writes \\\"\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes_on (read_trans t b w \\) x = writes_on \\ x\"\n apply(unfold writes_on_def)\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"value (read_trans t False w \\) x = value \\ x\"\n apply(unfold value_def)\n by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\ndefinition\n \"write_trans t b w v \\ ts' \\\n \\ ;; update_thrView t ((thrView \\ t)(var w := (var w, ts'))) \n ;; update_modView (var w, ts') ((thrView \\ t)(var w := (var w, ts')))\n ;; update_mods (var w, ts') \\ val = v, is_releasing = b\\ \n ;; update_wa (var w, ts') True\"\n\n\nlemma [simp]: \"thrView (write_trans t b w v \\ ts') t = (thrView \\ t)(var w := (var w, ts'))\"\n by (simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"t' \\ t \\ thrView (write_trans t b w v \\ ts') t' = (thrView \\ t')\"\n by (simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ modView (write_trans t b w v \\ ts') w' = (thrView \\ t)(var w := (var w, ts'))\"\n apply (simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' \\ var w \\ modView (write_trans t b w v \\ ts') w' = modView \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\ var w \\ modView (write_trans t b w v \\ ts') w' y = modView \\ w' y\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ modView (write_trans t b w v \\ ts') w' = modView \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ mods (write_trans t b w v \\ ts') w' = \\ val = v, is_releasing = b\\\"\n apply (simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' \\ var w \\ mods (write_trans t b w v \\ ts') w' = mods \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ mods (write_trans t b w v \\ ts') w' = mods \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ write_available (write_trans t b w v \\ ts') w' = True\"\n apply (simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' \\ var w \\\n write_available (write_trans t b w v \\ ts') w' = write_available \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ write_available (write_trans t b w v \\ ts') w' = write_available \\ w'\"\n by (auto simp add: write_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma writes_new_w [simp]: \"writes (write_trans t b w v \\ ts') = writes \\ \\ {(var w, ts')}\"\n by(simp add: Let_def rev_app_def\n write_trans_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\ writes_on (write_trans t b w v \\ ts') x = writes_on \\ x \\ {(var w, ts')}\"\n apply(unfold writes_on_def)\n apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n using Collect_cong by auto\n\nlemma [simp]: \"y \\ var w \\ writes_on (write_trans t b w v \\ ts') y = writes_on \\ y\"\n apply(unfold writes_on_def)\n by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"w \\ writes_on \\ y \\ w \\ writes_on (write_trans t b w' v \\ ts') y\"\n apply(unfold writes_on_def)\n by simp\n\n\n\n\ndefinition \"update_trans t w v' \\ ts' \\ \n let new_thr_idx = (thrView \\ t)(var w := (var w, ts')) in\n let new_thr_idx' =\n if releasing \\ w\n then\n ts_oride new_thr_idx (modView \\ w) \n else\n new_thr_idx \n in\n \\ ;; update_thrView t new_thr_idx' \n ;; update_modView (var w, ts') new_thr_idx' \\ \\TODO: check this prime on new_thr_idx\\ \n ;; update_mods (var w, ts') \\ val = v', is_releasing = True\\\n ;; update_wa (var w, ts') True\n ;; update_wa w False\"\n\n\nlemma [simp]: \"\\ releasing \\ w \\\n thrView (update_trans t w v' \\ ts') t = (thrView \\ t)(var w := (var w, ts'))\"\n by (simp add: Let_def rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def update_wa_def)\n\nlemma [simp]: \" releasing \\ w \\ \n thrView (update_trans t w v' \\ ts') t = ts_oride ((thrView \\ t)(var w := (var w, ts'))) (modView \\ w)\"\n by (auto simp add: Let_def update_trans_def update_wa_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\nlemma [simp]: \"t' \\ t \\ thrView (update_trans t w v' \\ ts') t' = (thrView \\ t')\"\n by (simp add: Let_def update_trans_def update_wa_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n \\ releasing \\ w \\ modView (update_trans t w v' \\ ts') w' = (thrView \\ t)(var w := (var w, ts'))\"\n apply (simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n releasing \\ w \\ modView (update_trans t w v' \\ ts') w' = ts_oride ((thrView \\ t)(var w := (var w, ts'))) (modView \\ w)\"\n apply (simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' \\ var w \\ modView (update_trans t w v' \\ ts') w' = modView \\ w'\"\n by (auto simp add: Let_def fun_upd_idem_iff fun_upd_twist rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def update_wa_def)\n \nlemma [simp]: \"tst w' \\ ts' \\ modView (update_trans t w v' \\ ts') w' = modView \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\ var w \\ mods (update_trans t w v' \\ ts') w' = mods \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ mods (update_trans t w v' \\ ts') w' = mods \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\\n mods (update_trans t w v' \\ ts') w' = \\ val = v', is_releasing = True\\\"\n apply (simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' = var w \\ tst w' = ts' \\ \n tst w \\ ts' \\ write_available (update_trans t w v' \\ ts') w'\"\n apply (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n by (metis prod.collapse)\n\nlemma [simp]: \"var w' \\ var w \\ write_available (update_trans t w v' \\ ts') w' = write_available \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"\\ write_available (update_trans t w v' \\ ts') w\"\n by (simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\ ts' \\ tst w' \\ tst w \\ write_available (update_trans t w v' \\ ts') w' = write_available \\ w'\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"writes (update_trans t w v' \\ ts') = writes \\ \\ {(var w, ts')}\"\n by (auto simp add: Let_def update_trans_def rev_app_def update_wa_def update_thrView_def\n update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\ writes_on (update_trans t w v' \\ ts') x = writes_on \\ x \\ {(x, ts')}\"\n apply(unfold writes_on_def)\n apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n using Collect_cong by auto\n\nlemma [simp]: \"y \\ var w \\ writes_on (update_trans t w v' \\ ts') y = writes_on \\ y\"\n apply(unfold writes_on_def)\n by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\ndefinition step :: \"T \\ action \\ surrey_state \\ surrey_state \\ bool\"\n where\n \"step t a \\ \\'\\\n \\ w. w \\ visible_writes \\ t (avar a) \\\n (case a of\n Read b x v \\\n v = value \\ w \\\n \\' = read_trans t b w \\\n | Write b x v \\ \\ ts'.\n write_available \\ w \\ \\ \\ TODO: use sets and predicates consistently \\\n valid_fresh_ts \\ w ts' \\\n \\' = write_trans t b w v \\ ts'\n | Update x v v' \\ \\ ts'.\n v = value \\ w \\ \n write_available \\ w \\\n valid_fresh_ts \\ w ts' \\\n \\' = update_trans t w v' \\ ts')\n \"\n\nlemma step_cases:\n \"step t a \\ \\'\n \\ \n \\\\ w b x v. \\' = read_trans t b w \\ \\ a = Read b x v \\ w \\ visible_writes \\ t (avar a) \\\n v = value \\ w \\ P \\ (read_trans t b w \\)\\\n \\\n \\\\ w b x v ts'. \\' = write_trans t b w v \\ ts' \\ a = Write b x v \\ w \\ visible_writes \\ t (avar a) \\\n write_available \\ w \\\n valid_fresh_ts \\ w ts'\n \\ P \\ (write_trans t b w v \\ ts') \\\n \\\n \\\\ w x v v' ts'. \\' = update_trans t w v' \\ ts' \\ a = Update x v v' \\\n w \\ visible_writes \\ t (avar a) \\\n v = value \\ w \\\n write_available \\ w \\\n valid_fresh_ts \\ w ts'\n \\ P \\ (update_trans t w v' \\ ts')\\\n \\ P \\ \\'\"\n apply(simp add: step_def) apply(case_tac a) by auto\n\n\n\ndefinition \"WrX x v \\ Write False x v\"\ndefinition \"WrR x v \\ Write True x v\"\ndefinition \"RdX x v \\ Read False x v\"\ndefinition \"RdA x v \\ Read True x v\"\n\n\n\nabbreviation WrX_state_abbr:: \" surrey_state \\ L \\ V \\ T \\ surrey_state \\ bool\" (\"_ [_ := _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [x := v]\\<^sub>t \\' \\ step t (WrX x v) \\ \\'\"\n\nabbreviation WrR_state_abbr:: \" surrey_state \\ L \\ V \\ T \\ surrey_state \\ bool\" (\"_ [_ :=\\<^sup>R _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [x :=\\<^sup>R v]\\<^sub>t \\' \\ step t (WrR x v) \\ \\'\"\n\nabbreviation RdX_state_abbr:: \" surrey_state \\ V \\ L \\ T \\ surrey_state \\ bool\" (\"_ [_ \\ _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [r \\ x]\\<^sub>t \\' \\ step t (RdX x r) \\ \\'\"\n\nabbreviation RdA_state_abbr:: \" surrey_state \\ V \\ L \\ T \\ surrey_state \\ bool\" (\"_ [_ \\\\<^sup>A _]\\<^sub>_ _\" [100,100,100,100,100])\n where \"\\ [r \\\\<^sup>A x]\\<^sub>t \\' \\ step t (RdA x r) \\ \\'\"\n\nabbreviation Up_state_abbr:: \" surrey_state \\ L \\ V \\ V \\ T \\ surrey_state \\ bool\" (\"_ RMW[_, _, _]\\<^sub>_ _\" [100,100,100,100,100,100])\n where \"\\ RMW[x, u, v]\\<^sub>t \\' \\ step t (Update x u v) \\ \\'\"\n\n\n\n\ndefinition \"initial_state \\ I \\\n \\ F . writes \\ = (\\x. (x, F x)) ` UNIV \\\n (\\ t x. thrView \\ t x = (x, F x)) \\\n (\\ w x. modView \\ w x = (x, F x)) \\\n (\\ w. mods \\ w = \\ val = I (var w), is_releasing = False \\) \\\n (\\ w. write_available \\ w = True)\"\n\n(*\ndefinition \"initial_state \\ I \\\n \\ F . writes \\ = {(x, F x) | x. True} \\\n (\\ t x. thrView \\ t x = (x, F x)) \\\n (\\ w x. modView \\ w x = (x, F x)) \\\n (\\ w. mods \\ w = \\ val = I (var w), is_releasing = False \\) \\\n (\\ w. write_available \\ w = True)\"\n*)\n\ndefinition \"lastWr \\ x \\ (x, Max (tst`(writes_on \\ x)))\" \n\n\ndefinition\n \"wfs \\ \\\n (\\ t x. thrView \\ t x \\ writes_on \\ x) \\\n (\\ w x. modView \\ w x \\ writes_on \\ x) \\\n (\\ x. finite(writes_on \\ x)) \\\n (\\ w. w \\ writes \\ \\ modView \\ w (var w) = w) \\\n (\\ w x. w = lastWr \\ x \\ write_available \\ w )\"\n\nlemma initially_write_unique: \n \"initial_state \\ I \\ w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\ w = w'\"\n apply(unfold initial_state_def writes_on_def) by auto\n\n lemma finite_single_fst_eq: \\finite {w. fst w = x \\ (\\x. w = (x, F\n x))}\\ (is \\finite ?A\\) proof - have \\?A \\ {(x, F x)}\\ by auto from\n finite_subset[OF this] show ?thesis by auto qed\n\n lemma in_writes_onI: \\var w = x \\ w \\ writes \\ \\ w \\ writes_on \\ x\\\n unfolding writes_on_def by auto\n\n(*\n lemma initial_wfs: assumes \"initial_state \\ I\" shows \"wfs \\\" using\n assms initially_write_unique[OF assms(1)] \n \n apply (auto simp add: wfs_def\n initial_state_def lastWr_def \n intro: in_writes_onI)\n\n sledgehammer\n*)\n \n(* TODO: do something about SMTs *)\nlemma initial_wfs: \n assumes \"initial_state \\ I\" \n shows \"wfs \\\"\n apply(simp add: initial_state_def wfs_def)\n apply(rule conjI) apply (unfold writes_on_def, clarify) \n apply (metis (mono_tags) UNIV_I assms fst_conv image_eqI initial_state_def) \n apply(rule conjI)\n using assms apply (simp add: initial_state_def) \n apply auto[1] \n apply rule using initially_write_unique[OF assms] \n apply (smt Collect_cong empty_iff finite.intros(1) finite.intros(2) insert_compr mem_Collect_eq not_finite_existsD writes_on_def) \n using assms apply safe\n apply (simp add: initial_state_def) apply auto[1]\n using initial_state_def by blast \n\n\n\nlemma allI_case: \"\\\\ y. x \\ y \\ P y\\ \\ \\P x\\ \\ \\ y. P y\" by fastforce\n\n\nlemma [simp]: \"wfs \\ \\ writes_on \\ x \\ {}\"\n apply(simp add: wfs_def)\n by (metis empty_iff)\n\nlemma [simp]: \"wfs \\ \\ finite(writes_on \\ x)\"\n by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\ \\ thrView \\ t x \\ writes_on \\ x\"\n by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\ \\ modView \\ w x \\ writes_on \\ x\"\n using wfs_def by blast\n\n\nlemma [simp]: \"wfs \\ \\ modView (read_trans t b w \\) w x \\ writes_on (read_trans t b w \\) x\"\n by auto\n\nlemma [simp]: \"wfs \\ \\ writes_on \\ x = writes_on (read_trans t b w \\) x\"\n by auto\n\n\nlemma own_ModView:\n assumes \"wfs \\\"\n and \"w \\ writes \\\"\n shows \"modView \\ w (var w) = w\"\n using assms apply(unfold wfs_def)\n by blast\n\nlemma ts_oride_same_var:\n assumes \"wfs \\\"\n and \"x = var w\"\n and \"w \\ visible_writes \\ t (var w)\"\n shows \"ts_oride ((thrView \\ t)(var w := w)) (modView \\ w) x = w\"\n apply(simp add: ts_oride_def) apply safe using assms\n apply (meson own_ModView subsetCE visible_writes_in_writes)\n using assms(2) apply blast \n using assms(2) by blast\n\nlemma ts_oride_diff_var:\n assumes \"wfs \\\"\n and \"x \\ var w\"\n and \"w \\ visible_writes \\ t (var w)\"\n shows \"ts_oride ((thrView \\ t)(var w := w')) (modView \\ w) x = ts_oride (thrView \\ t) (modView \\ w) x\"\n apply(simp add: ts_oride_def)\n using assms(2) by blast\n\nlemma ts_oride_split:\n assumes \"tst (m' x) \\ tst (m x) \\ P (m x)\"\n and \"tst (m x) \\ tst (m' x) \\ P (m' x)\"\n shows \"P (ts_oride m m' x)\"\n apply(simp add: ts_oride_def)\n by (simp add: assms(1) assms(2))\n\nlemma wr_other_pres_last: \"wfs \\ \\ x \\ xa \\ lastWr (write_trans t ba (x, b) v \\ ts') xa = lastWr \\ xa\"\n by(simp add: lastWr_def)\n\nlemma upd_other_pres_last: \"wfs \\ \\ x \\ xa \\ lastWr (update_trans t (x, b) v \\ ts') xa = lastWr \\ xa\"\n by(simp add: lastWr_def)\n\nlemma last_w_not_last: \"wfs \\ \\ (xa, b) \\ visible_writes \\ t xa \\ valid_fresh_ts \\ (xa,b) ts' \\ b \\ Max (tst ` writes_on \\ xa) \\ lastWr (write_trans t ba (xa, b) v \\ ts') xa = lastWr \\ xa \"\n apply(simp add: visible_writes_def valid_fresh_ts_def)\n apply(elim conjE)\n apply(subgoal_tac \"b < Max (tst ` writes_on \\ xa)\")\n defer\n apply(unfold wfs_def , clarsimp)\n apply (metis Max_ge finite_imageI image_eqI le_neq_trans snd_conv)\n apply(subgoal_tac \"tst (lastWr \\ xa) = Max (tst ` writes_on \\ xa)\")\n defer\n apply (simp add: lastWr_def)\n apply (simp add: lastWr_def)\n apply(subgoal_tac \"ts' < Max (tst ` writes_on \\ xa)\")\n defer\n apply simp\n apply (metis (mono_tags, lifting) Max_in empty_iff finite_imageI image_iff) \n by (smt Max_ge Max_in empty_iff finite_imageI finite_insert image_is_empty insert_iff le_neq_trans less_imp_not_less) \n\n\n\nlemma last_w_not_last_upd: \"wfs \\ \\ (xa, b) \\ visible_writes \\ t xa \\ valid_fresh_ts \\ (xa,b) ts' \\ b \\ Max (tst ` writes_on \\ xa) \\ lastWr (update_trans t (xa, b) v \\ ts') xa = lastWr \\ xa \"\n apply(simp add: visible_writes_def valid_fresh_ts_def)\n apply(elim conjE)\n apply(subgoal_tac \"b < Max (tst ` writes_on \\ xa)\")\n defer\n apply(unfold wfs_def, clarsimp)\n apply (metis Max_ge finite_imageI image_eqI le_neq_trans snd_conv)\n apply(subgoal_tac \"tst (lastWr \\ xa) = Max (tst ` writes_on \\ xa)\")\n apply (simp add: lastWr_def)\n apply(subgoal_tac \"ts' < Max (tst ` writes_on \\ xa)\")\n apply (smt Max_ge Max_in dual_order.antisym empty_iff finite_imageI finite_insert image_is_empty insert_iff leD)\n apply (metis (mono_tags, lifting) Max_in empty_iff finite_imageI image_iff)\n by (simp add: lastWr_def)\n\nlemma lastWr_w: \"wfs \\ \\ (xa, Max (tst ` writes_on \\ xa)) \\ visible_writes \\ t xa \\ valid_fresh_ts \\ ((xa, Max (tst ` writes_on \\ xa))) ts' \\\n lastWr (write_trans t ba ((xa, Max (tst ` writes_on \\ xa))) v \\ ts') xa = (xa, ts')\"\n apply(unfold wfs_def)\n apply clarsimp\n apply(simp add: valid_fresh_ts_def)\n apply(elim conjE)\n apply(simp add: lastWr_def)\n by (meson Max_ge Max_insert2 dual_order.strict_implies_order dual_order.trans finite_imageI)\n\n\nlemma lastWr_upd: \"wfs \\ \\ (xa, Max (tst ` writes_on \\ xa)) \\ visible_writes \\ t xa \\ valid_fresh_ts \\ ((xa, Max (tst ` writes_on \\ xa))) ts' \\\n lastWr (update_trans t ((xa, Max (tst ` writes_on \\ xa))) v \\ ts') xa = (xa, ts')\"\n apply(unfold wfs_def)\n apply clarsimp\n apply(simp add: valid_fresh_ts_def)\n apply(elim conjE)\n apply(simp add: lastWr_def)\n by (meson Max_ge Max_insert2 dual_order.strict_implies_order dual_order.trans finite_imageI)\n\n(*\nlemmas lastWrdefs [simp] = lastWr_def \n\nlemma finite_writes: \n assumes \"aa \\ xa\" \n and \"finite{w. var w = xa \\ w \\ surrey_state.writes \\}\" \n shows\n \"finite{w. var w = xa \\\n w \\ surrey_state.writes (write_trans t ba (aa, b) v \\ ts')}\"\n using assms apply auto \n by (smt Collect_cong fst_conv) \n\nlemma wfs_preserved:\n assumes \"wfs \\\"\n and \"step t a \\ \\'\"\n shows \"wfs \\'\"\n using assms(1) apply(unfold wfs_def)\n apply (rule step_cases[OF assms(2)]) \n apply safe apply clarsimp\n unfolding writes_on_def apply (simp add: read_trans_def rev_app_def Let_def)\n apply (intro conjI impI)\n apply (simp add: ts_oride_def update_thrView_def)\n apply (simp add: ts_oride_def update_thrView_def)\n apply clarsimp \n apply (meson in_mono visible_writes_in_writes)\n apply (simp add: ts_oride_def update_thrView_def)\n apply (simp add: ts_oride_def update_thrView_def)\n apply (meson in_mono visible_writes_in_writes)\n apply auto[4]\n unfolding writes_on_def apply (simp add: update_modView_def update_thrView_def update_wa_def update_mods_def write_trans_def rev_app_def Let_def)\n unfolding writes_on_def apply (simp add: update_modView_def update_thrView_def update_wa_def update_mods_def write_trans_def rev_app_def Let_def)\n unfolding writes_on_def apply (simp add: visible_writes_def valid_fresh_ts_def update_modView_def update_thrView_def update_wa_def update_mods_def write_trans_def rev_app_def Let_def)\n apply(case_tac \"xa = aa\") \n prefer 2 apply (erule_tac x = \"xa\" in allE)+ apply auto [1] using finite_writes \n apply (smt Collect_cong fst_conv) \n apply (unfold writes_on_def) apply auto [1] \n sledgehammer\n sorry\n*)\n\nlemma wfs_preserved:\n assumes \"wfs \\\"\n and \"step t a \\ \\'\"\n shows \"wfs \\'\"\n apply(unfold wfs_def)\n apply rule defer apply rule defer apply rule defer defer\n apply clarsimp defer\n apply clarsimp\n apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) wfs_def apply auto[1]\n apply(case_tac \"var w = aa\")\n apply(case_tac \"(aa, b) = (x, ts')\") apply simp\n apply simp \n apply(case_tac \"b = ts'\") apply simp using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp \n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def apply blast\n apply(case_tac \"var w = aa\") (*********)\n apply(case_tac \"releasing \\ w\")\n apply(case_tac \"(aa, b) = (x, ts')\")\n apply simp apply (metis assms(1) fun_upd_same ts_oride_def wfs_def)\n apply(case_tac \"b = ts'\") apply(case_tac \"var w = x\") apply simp\n apply simp apply(rule ts_oride_split) using assms(1) apply simp\n using assms(1) apply simp\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"(aa, b) = (x, ts')\") apply simp\n apply simp apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"b = ts'\")apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply clarsimp apply (rule step_cases[OF assms(2)]) apply simp_all\n using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"var w = x\") apply simp using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n defer\n apply (rule step_cases[OF assms(2)])\n apply(case_tac \"ta = t\") apply(case_tac \"syncing \\ w b\")\n apply simp apply(rule ts_oride_split) \n apply (metis assms(1) fun_upd_apply subsetCE visible_writes_in_writes wfs_def)\n using assms(1) wfs_def apply blast apply simp \n apply (metis assms(1) subsetCE visible_writes_in_writes wfs_def)\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"ta = t\") apply simp\n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast\n apply simp using assms(1) wfs_def apply blast\n apply(case_tac \"ta = t\") apply simp apply(case_tac \"releasing \\ w\") apply simp\n apply(case_tac \"var w = x\") apply simp \n apply (metis assms(1) fun_upd_same ts_oride_def wfs_def)\n apply simp apply(rule ts_oride_split)\n using assms(1) apply auto[1] \n using assms(1) wfs_def apply blast\n apply simp \n using assms(1) wfs_def apply blast\n apply simp apply(case_tac \"var w = x\") apply simp\n using assms(1) wfs_def apply blast apply simp\n using assms(1) wfs_def apply blast\n apply (rule step_cases[OF assms(2)]) apply simp\n using assms(1)\n apply(unfold wfs_def read_trans_def)\n apply(simp add: rev_app_def Let_def syncing_def)\n apply(simp add: update_wa_def update_mods_def update_modView_def update_thrView_def ts_oride_def)\n apply(simp add: lastWr_def)\n apply(unfold writes_on_def, simp)\n apply(elim conjE)\n apply(intro conjI)\n apply(intro allI impI)\n apply simp\n apply (smt fun_upd_def rev_app_def surrey_state.select_convs(3) surrey_state.surjective surrey_state.update_convs(1) surrey_state.update_convs(2) surrey_state.update_convs(3) surrey_state.update_convs(4) surrey_state.update_convs(5) update_modView_def update_mods_def update_thrView_def update_wa_def visible_var write_trans_def)\n (**) apply(intro allI impI)\n apply clarsimp\n apply(case_tac \"aa \\ x\")\n apply(unfold visible_writes_def writes_on_def)\n apply simp\n apply clarsimp\n apply(case_tac \"x \\ xa\")\n using assms(1)\n apply(simp add: wr_other_pres_last lastWr_def)\n apply simp\n apply(case_tac \"b \\ Max (tst ` writes_on \\ xa)\")\n using assms(1) \n apply simp\n apply(subgoal_tac \"(xa, b) \\ visible_writes \\ t xa\")\n apply (simp add: last_w_not_last)\n apply(simp add: write_trans_def rev_app_def)\n apply (simp add: update_modView_def update_mods_def update_thrView_def update_wa_def)\n apply(simp add: visible_writes_def)\n\n apply (metis wfs_def)\n apply simp \n apply(subgoal_tac \"lastWr (write_trans t ba (xa, Max (tst ` writes_on \\ xa)) v \\ ts') xa = (xa, ts')\")\n apply simp \n using assms(1)\n apply(unfold wfs_def)\n apply clarsimp\n apply(simp add: valid_fresh_ts_def)\n apply(elim conjE)\n apply(simp add: lastWr_def)\n apply (meson Max_ge Max_insert2 dual_order.strict_implies_order dual_order.trans finite_imageI)\n\n apply(elim conjE)\n apply(intro conjI)\n apply(intro allI impI)\n apply simp\n apply (simp add: rev_app_def Let_def update_modView_def update_mods_def update_thrView_def update_wa_def update_trans_def)\n apply(intro conjI impI)\n apply(simp add: ts_oride_def)\n apply (metis assms(1) less_le_not_le own_ModView valid_fresh_ts_def)\n apply blast\n apply blast\n apply(intro allI impI)\n apply clarsimp\n apply(case_tac \"aa \\ xa\")\n \n using assms(1) \n apply simp\n apply(simp add: upd_other_pres_last lastWr_def)\n apply clarsimp\n apply(case_tac \"b \\ Max (tst ` writes_on \\ xa)\")\n using assms(1) \n apply simp\n apply(subgoal_tac \"(xa, b) \\ visible_writes \\ t xa\")\n apply (simp add: last_w_not_last_upd)\n apply(simp add: update_trans_def rev_app_def)\n apply (simp add: update_modView_def update_mods_def update_thrView_def update_wa_def Let_def)\n apply(simp add: visible_writes_def)\n \n apply (simp add: lastWr_def)\n\n apply (simp add: lastWr_def visible_writes_def)\n apply clarsimp\n apply (metis wfs_def)\n using assms(1)\n apply(unfold wfs_def)\n apply clarsimp\n apply(simp add: valid_fresh_ts_def)\n apply(elim conjE)\n apply(simp add: lastWr_def)\n apply (elim conjE)\n apply clarsimp\n apply(simp add: update_trans_def rev_app_def)\n apply (simp add: update_modView_def update_mods_def update_thrView_def update_wa_def Let_def)\n apply(intro impI conjI)\n \n apply (metis (no_types, lifting) Max.coboundedI finite.insertI finite_imageI insertI1 sup.absorb2 sup.strict_order_iff)\n using assms(1)\n by simp \n\n \n\n\nlemma [simp]: \"var(lastWr \\ x) = x\" by(simp add: lastWr_def)\n\nlemma last_write_max: \"wfs \\ \\ w \\ writes_on \\ x \\ tst w \\ tst (lastWr \\ x)\"\n by(simp add: lastWr_def)\n\nlemma last_write_write_on [simp]: \"wfs \\ \\ lastWr \\ x \\ writes_on \\ x\"\n apply(simp add: lastWr_def )\n apply(case_tac \"Max (tst`(writes_on \\ x)) \\ tst`(writes_on \\ x)\")\n defer apply simp\n using writes_on_var by fastforce\n\nlemma lastWr_visible:\n \"wfs \\ \\ lastWr \\ x \\ visible_writes \\ t x\"\n by (metis (no_types, lifting) CollectI last_write_max last_write_write_on visible_writes_def wfs_def)\n\nlemma lastWr_read_pres: \"lastWr (read_trans t b w \\) x = lastWr \\ x\"\n by(simp add: lastWr_def)\n\nlemma write_to_different_var [simp]: \"wfs \\ \\ var w \\ x \\ lastWr (write_trans t b w v \\ ts') x = lastWr \\ x\"\n by(simp add: lastWr_def)\n\nlemma [simp]: \"wfs \\ \\ w = (lastWr \\ x) \\ valid_fresh_ts \\ w ts' \\\n lastWr (write_trans t b w v \\ ts') x = (x, ts')\"\n apply (simp add: valid_fresh_ts_def)\n by (simp add: lastWr_def max.strict_order_iff)\n\nlemma [simp]: \"wfs \\ \\ w \\ lastWr \\ x \\ w \\ writes_on \\ x \\ valid_fresh_ts \\ w ts' \\\n lastWr (write_trans t b w v \\ ts') x = lastWr \\ x\"\n apply (subst lastWr_def) apply(case_tac \"var w = x\") apply simp_all defer\n apply (simp add: lastWr_def)\n apply (simp add: valid_fresh_ts_def)\n by (metis dual_order.order_iff_strict lastWr_def last_write_max last_write_write_on max.absorb2 prod.exhaust_sel sndI writes_on_var)\n\nlemma [simp]: \" wfs \\ \\ var w \\ x \\ value (write_trans t b w v \\ ts')(lastWr \\ x) = value \\ (lastWr \\ x)\"\n by(simp add: value_def)\n \n\nlemma [simp]: \"wfs \\ \\ w = lastWr \\ x \\ valid_fresh_ts \\ w ts' \\lastWr (update_trans t w v' \\ ts') x = (x, ts')\"\n apply (subst lastWr_def) apply simp\n by (simp add: lastWr_def less_eq_rat_def max.absorb1 valid_fresh_ts_def)\n\nlemma [simp]: \"wfs \\ \\ w \\ lastWr \\ x \\ w \\ writes_on \\ x \\ valid_fresh_ts \\ w ts' \\\n lastWr (update_trans t w v' \\ ts') x = lastWr \\ x\"\n apply (subst lastWr_def) apply(case_tac \"var w = x\") apply simp_all\n by (metis lastWr_def last_write_max last_write_write_on less_eq_rat_def max_def prod.collapse snd_conv valid_fresh_ts_def writes_on_var)\n\nlemma modView_lte_last: \"wfs \\ \\ tst(modView \\ w x) \\ tst(lastWr \\ x)\"\n using last_write_max wfs_def by blast\n\n \n\ndefinition \"p_obs \\ t x u \\ \\ w. w \\ visible_writes \\ t x \\ u = value \\ w\" \n\ndefinition \"d_obs \\ view x u \\ view x = lastWr \\ x \\ value \\ (lastWr \\ x) = u\"\n\ndefinition \"d_obs_t \\ t x u \\ d_obs \\ (thrView \\ t) x u\"\n\ndefinition \"c_obs \\ x u t y v \\ \n \\ w \\ visible_writes \\ t x. value \\ w = u \\\n d_obs \\ (modView \\ w) y v \\\n releasing \\ w\"\n\nabbreviation p_obs_abbr:: \"nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100, 100, 100, 100])\n where \"[x \\\\<^sub>t u] \\ \\ p_obs \\ t x u\"\n\nabbreviation d_obs_abbr:: \"nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ =\\<^sub>_ _] _\" [100, 100, 100, 100])\n where \"[x =\\<^sub>t u] \\ \\ d_obs_t \\ t x u\"\n\nabbreviation c_obs_abbr:: \"nat \\ nat \\ nat \\ nat \\ nat \\ surrey_state \\ bool\" (\"[_ = _]\\_ =\\<^sub>_ _ \\ _\" [100, 100, 100, 100, 100, 100])\n where \"[x = u]\\y =\\<^sub>t v\\ \\ \\ c_obs \\ x u t y v\"\n\n\n\n\n\ndefinition \"covered \\ x \\ \\ w . w \\ writes_on \\ x \\ write_available \\ w \\ w = lastWr \\ x\"\n\ndefinition \"covered_v \\ x v \\ \\ w . w \\ writes_on \\ x \\ write_available \\ w \\ w = lastWr \\ x \\ value \\ w = v\"\n\nabbreviation covered_v_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"cvd[_, _] _\" [100, 100,100])\n where \"cvd[x, u] \\ \\ covered_v \\ x u\"\n\n\n\n\ndefinition \"mo w w'\\ var(w) = var(w') \\ tst(w) < tst(w')\" \n\ndefinition \"enc \\ view x u \\ \\ w . w \\ writes_on \\ x \\ tst(w) \\ tst(view x) \\ value \\ w = u\"\n\ndefinition \"enc_t \\ t x u \\ enc \\ (thrView \\ t) x u\"\n\ndefinition \"p_vorder \\ u x v \\ \\ w w'. w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\\n value \\ w = u \\ value \\ w' = v \\\n mo w w' \"\n\ndefinition \"d_vorder \\ u x v \\ (\\ w w'. w \\ writes_on \\ x \\ w' \\ writes_on \\ x \\\n value \\ w = u \\ value \\ w' = v \\\n mo w w') \\ p_vorder \\ u x v\"\n\ndefinition \"init_val \\ x v \\ \n \\ w . w \\ writes_on \\ x \\ \n (\\w'\\ writes_on \\ x . w \\ w' \\ mo w w') \\ \n value \\ w = v\"\n\ndefinition \"amo \\ x u \\ \\ p_vorder \\ u x u\"\n\ndefinition \"no_val \\ x i u \\ init_val \\ x i \\ \\ p_vorder \\ i x u\"\n\ndefinition \"last_val \\ x u i \\ \n init_val \\ x i \\ p_vorder \\ i x u \n \\ (\\ w. w \\ u \\ \\ p_vorder \\ u x w)\"\n\n\n\nabbreviation p_vorder_abbr:: \"V \\ L \\ V \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100,100,100,100])\n where \"[u \\\\<^sub>x v] \\ \\ p_vorder \\ u x v\"\n\nabbreviation d_vorder_abbr:: \"V \\ L \\ V \\ surrey_state \\ bool\" (\"[_ \\\\<^sub>_ _] _\" [100,100,100,100])\n where \"[u \\\\<^sub>x v] \\ \\ d_vorder \\ u x v\"\n\nabbreviation amo_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"[\\\\<^sub>_ _] _\" [100,100,100])\n where \"[\\\\<^sub>x u] \\ \\ amo \\ x u\"\n\nabbreviation no_abbr:: \"L \\ V \\ V \\ surrey_state \\ bool\" (\"[\\\\<^sub>_ _]\\<^sub>_ _\" [100,100,100,100])\n where \"[\\\\<^sub>x u]\\<^sub>i \\ \\ no_val \\ x i u\"\n\nabbreviation enc_abbr:: \"L \\ V \\ T \\ surrey_state \\ bool\" (\"[en _ _]\\<^sub>_ _\" [100,100,100,100])\n where \"[en x u]\\<^sub>t \\ \\ enc_t \\ t x u\"\n\nabbreviation last_abbr:: \"L \\ V \\ V \\ T \\ surrey_state \\ bool\" (\"[last _ _ _]\\<^sub>_ _\" [100, 100,100,100,100])\n where \"[last x i u]\\<^sub>t \\ \\ last_val \\ x u i\"\n\nabbreviation init_abbr:: \"L \\ V \\ surrey_state \\ bool\" (\"[init _ _] _\" [100, 100,100])\n where \"[init x v] \\ \\ init_val \\ x v\"\n\n\nlemma d_obs_lastWr_visible: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ w \\ visible_writes \\ t x \\ w = lastWr \\ x\"\n apply (simp add: d_obs_def d_obs_t_def lastWr_def visible_writes_def, auto)\n by (metis dual_order.antisym lastWr_def last_write_max last_write_write_on prod.collapse writes_on_var)\n\n\n\nlemma d_obs_implies_p_obs: \n \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ [x \\\\<^sub>t u] \\\"\n apply(simp add: d_obs_t_def d_obs_def p_obs_def) using lastWr_visible\n by (metis lastWr_def)\n\n\nlemma d_obs_p_obs_agree: \"wfs \\ \\ [x =\\<^sub>t u] \\ \\ [x \\\\<^sub>t v] \\ \\ u = v\"\n apply(unfold p_obs_def d_obs_t_def d_obs_def visible_writes_def)apply clarsimp\n by (metis eq_snd_iff fst_conv lastWr_def last_write_max leD order.not_eq_order_implies_strict writes_on_var)\n\nlemma not_p_obs_implies_c_obs: \"\\ [x \\\\<^sub>t u] \\ \\ [x = u]\\y =\\<^sub>t v\\ \\\"\n by(auto simp add: p_obs_def c_obs_def)\n\nlemma \"[x =\\<^sub>t n] \\ \\ [x =\\<^sub>t' m] \\ \\ m = n\"\n by (simp add: d_obs_def d_obs_t_def)\n\n\n\n\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/OpSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.25266656874212534}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory signed_div\nimports \"../CTranslation\"\nbegin\n\ninstall_C_file \"signed_div.c\"\n\ncontext signed_div\nbegin\n\nlemma f_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL f(5, -1) \\ \\ret__int = -5 \\\"\n apply vcg\n apply (clarsimp simp: sdiv_word_def sdiv_int_def)\n done\n\nlemma f_overflow:\n shows \"\\ a_' s = of_int (- (2^31)); b_' s = -1 \\ \\ \\ \\ \\ Call f_'proc ,Normal s\\ \\ Fault SignedArithmetic\"\n apply (rule exec.Call [where \\=\\, OF f_impl, simplified f_body_def creturn_def])\n apply (rule exec.CatchMiss)\n apply (subst exec.simps, clarsimp simp del: word_neq_0_conv simp: sdiv_word_def sdiv_int_def)+\n apply simp\n done\n\nlemma g_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL g(-5, 10) \\ \\ret__int = -5 \\\"\n apply vcg\n apply (clarsimp simp: smod_word_def smod_int_def sdiv_int_def)\n done\n\nlemma h_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL h(5, -1) \\ \\ret__int = 0 \\\"\n apply vcg\n apply (simp add: word_div_def uint_word_ariths)\n done\n\n(* FIXME: f! *)\nlemma i_result:\n \"\\ \\ \\ True \\ \\ret__int :== CALL f(5, -1) \\ \\ret__int = -5 \\\"\n apply vcg\n apply (clarsimp simp: sdiv_word_def sdiv_int_def)\n done\n\nend\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/testfiles/signed_div.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.25263797876724914}} {"text": "(* Title: JinjaThreads/BV/BVConform.thy\n Author: Cornelia Pusch, Gerwin Klein, Andreas Lochbihler\n\nThe invariant for the type safety proof.\n*)\n\nheader {* \\isaheader{BV Type Safety Invariant} *}\n\ntheory BVConform\nimports\n BVSpec\n \"../JVM/JVMExec\"\nbegin\n\ncontext JVM_heap_base begin\n\ndefinition confT :: \"'c prog \\ 'heap \\ 'addr val \\ ty err \\ bool\" (\"_,_ |- _ :<=T _\" [51,51,51,51] 50)\nwhere\n \"P,h |- v :<=T E \\ case E of Err \\ True | OK T \\ P,h \\ v :\\ T\"\n\nnotation (xsymbols) \n confT (\"_,_ \\ _ :\\\\<^sub>\\ _\" [51,51,51,51] 50)\n\nabbreviation confTs :: \"'c prog \\ 'heap \\ 'addr val list \\ ty\\<^sub>l \\ bool\"\n (\"_,_ |- _ [:<=T] _\" [51,51,51,51] 50)\nwhere\n \"P,h |- vs [:<=T] Ts \\ list_all2 (confT P h) vs Ts\"\n\nnotation (xsymbols)\n confTs (\"_,_ \\ _ [:\\\\<^sub>\\] _\" [51,51,51,51] 50)\n\ndefinition conf_f :: \"'addr jvm_prog \\ 'heap \\ ty\\<^sub>i \\ 'addr bytecode \\ 'addr frame \\ bool\"\nwhere\n \"conf_f P h \\ \\(ST,LT) is (stk,loc,C,M,pc). P,h \\ stk [:\\] ST \\ P,h \\ loc [:\\\\<^sub>\\] LT \\ pc < size is\"\n\nprimrec conf_fs :: \"['addr jvm_prog,'heap,ty\\<^sub>P,mname,nat,ty,'addr frame list] \\ bool\"\nwhere\n \"conf_fs P h \\ M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 [] = True\"\n\n| \"conf_fs P h \\ M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 (f#frs) =\n (let (stk,loc,C,M,pc) = f in\n (\\ST LT Ts T mxs mxl\\<^sub>0 is xt.\n \\ C M ! pc = Some (ST,LT) \\ \n (P \\ C sees M:Ts \\ T = \\(mxs,mxl\\<^sub>0,is,xt)\\ in C) \\\n (\\Ts' T' D m D'. \n is!pc = (Invoke M\\<^sub>0 n\\<^sub>0) \\ class_type_of' (ST!n\\<^sub>0) = \\D\\ \\ P \\ D sees M\\<^sub>0:Ts' \\ T' = m in D' \\ P \\ T\\<^sub>0 \\ T') \\\n conf_f P h (ST, LT) is f \\ conf_fs P h \\ M (size Ts) T frs))\"\n\nprimrec conf_xcp :: \"'addr jvm_prog \\ 'heap \\ 'addr option \\ 'addr instr \\ bool\" where\n \"conf_xcp P h None i = True\"\n| \"conf_xcp P h \\a\\ i = (\\D. typeof_addr h a = \\Class_type D\\ \\ P \\ D \\\\<^sup>* Throwable \\\n (\\D'. P \\ D \\\\<^sup>* D' \\ is_relevant_class i P D'))\"\n\nend\n\ncontext JVM_heap_conf_base begin\n\ndefinition correct_state :: \"[ty\\<^sub>P,'thread_id,('addr, 'heap) jvm_state] \\ bool\"\n (\"_ |- _:_ [ok]\" [61,0,0] 61)\nwhere\n \"correct_state \\ t \\ \\(xp,h,frs).\n P,h \\ t \\t \\ hconf h \\ preallocated h \\\n (case frs of\n [] \\ True\n | (f#fs) \\ \n (let (stk,loc,C,M,pc) = f\n in \\Ts T mxs mxl\\<^sub>0 is xt \\.\n (P \\ C sees M:Ts\\T = \\(mxs,mxl\\<^sub>0,is,xt)\\ in C) \\\n \\ C M ! pc = Some \\ \\\n conf_f P h \\ is f \\ conf_fs P h \\ M (size Ts) T fs \\\n conf_xcp P h xp (is ! pc) ))\"\n\nnotation (xsymbols)\n correct_state (\"_ \\ _:_ \\\" [61,0,0] 61)\n\nend\n\ncontext JVM_heap_base begin\n\nlemma conf_f_def2:\n \"conf_f P h (ST,LT) is (stk,loc,C,M,pc) \\\n P,h \\ stk [:\\] ST \\ P,h \\ loc [:\\\\<^sub>\\] LT \\ pc < size is\"\n by (simp add: conf_f_def)\n\nsection {* Values and @{text \"\\\"} *}\n\nlemma confT_Err [iff]: \"P,h \\ x :\\\\<^sub>\\ Err\" \n by (simp add: confT_def)\n\nlemma confT_OK [iff]: \"P,h \\ x :\\\\<^sub>\\ OK T = (P,h \\ x :\\ T)\"\n by (simp add: confT_def)\n\nlemma confT_cases:\n \"P,h \\ x :\\\\<^sub>\\ X = (X = Err \\ (\\T. X = OK T \\ P,h \\ x :\\ T))\"\n by (cases X) auto\n\nlemma confT_widen [intro?, trans]:\n \"\\ P,h \\ x :\\\\<^sub>\\ T; P \\ T \\\\<^sub>\\ T' \\ \\ P,h \\ x :\\\\<^sub>\\ T'\"\n by (cases T', auto intro: conf_widen)\n\nend\n\ncontext JVM_heap begin\n\nlemma confT_hext [intro?, trans]:\n \"\\ P,h \\ x :\\\\<^sub>\\ T; h \\ h' \\ \\ P,h' \\ x :\\\\<^sub>\\ T\"\n by (cases T) (blast intro: conf_hext)+\n\nend\n\nsection {* Stack and Registers *}\n\ncontext JVM_heap_base begin\n\nlemma confTs_Cons1 [iff]:\n \"P,h \\ x # xs [:\\\\<^sub>\\] Ts = (\\z zs. Ts = z # zs \\ P,h \\ x :\\\\<^sub>\\ z \\ list_all2 (confT P h) xs zs)\"\nby(rule list_all2_Cons1)\n\nlemma confTs_confT_sup:\n \"\\ P,h \\ loc [:\\\\<^sub>\\] LT; n < size LT; LT!n = OK T; P \\ T \\ T' \\ \n \\ P,h \\ (loc!n) :\\ T'\"\n apply (frule list_all2_lengthD)\n apply (drule list_all2_nthD, simp)\n apply simp\n apply (erule conf_widen, assumption+)\n done\n\nlemma confTs_widen [intro?, trans]:\n \"P,h \\ loc [:\\\\<^sub>\\] LT \\ P \\ LT [\\\\<^sub>\\] LT' \\ P,h \\ loc [:\\\\<^sub>\\] LT'\"\n by (rule list_all2_trans, rule confT_widen)\n\nlemma confTs_map [iff]:\n \"(P,h \\ vs [:\\\\<^sub>\\] map OK Ts) = (P,h \\ vs [:\\] Ts)\"\n by (induct Ts arbitrary: vs) (auto simp add: list_all2_Cons2)\n\nlemma reg_widen_Err [iff]:\n \"(P \\ replicate n Err [\\\\<^sub>\\] LT) = (LT = replicate n Err)\"\n by (induct n arbitrary: LT) (auto simp add: list_all2_Cons1)\n \n\n\nend\n\ncontext JVM_heap begin\n\nlemma confTs_hext [intro?]:\n \"P,h \\ loc [:\\\\<^sub>\\] LT \\ h \\ h' \\ P,h' \\ loc [:\\\\<^sub>\\] LT\"\n by (fast elim: list_all2_mono confT_hext) \n \nsection {* correct-frames *}\n\ndeclare fun_upd_apply[simp del]\n\nlemma conf_f_hext:\n \"\\ conf_f P h \\ M f; h \\ h' \\ \\ conf_f P h' \\ M f\"\nby(cases f, cases \\, auto simp add: conf_f_def intro: confs_hext confTs_hext)\n\nlemma conf_fs_hext:\n \"\\ conf_fs P h \\ M n T\\<^sub>r frs; h \\ h' \\ \\ conf_fs P h' \\ M n T\\<^sub>r frs\"\napply (induct frs arbitrary: M n T\\<^sub>r)\n apply simp\napply clarify\napply (simp (no_asm_use))\napply clarify\napply (unfold conf_f_def)\napply (simp (no_asm_use) split: split_if_asm)\napply (fast elim!: confs_hext confTs_hext)+\ndone\n\ndeclare fun_upd_apply[simp]\n\nlemma conf_xcp_hext:\n \"\\ conf_xcp P h xcp i; h \\ h' \\ \\ conf_xcp P h' xcp i\"\nby(cases xcp)(auto elim: typeof_addr_hext_mono)\n\nend\n\ncontext JVM_heap_conf_base begin\n\nlemmas defs1 = correct_state_def conf_f_def wt_instr_def eff_def norm_eff_def app_def xcpt_app_def\n\nlemma correct_state_impl_Some_method:\n \"\\ \\ t: (None, h, (stk,loc,C,M,pc)#frs)\\ \n \\ \\m Ts T. P \\ C sees M:Ts\\T = \\m\\ in C\"\n by(fastforce simp add: defs1)\n\nend\n\ncontext JVM_heap_conf_base' begin\n\n\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/BV/BVConform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621764862150634, "lm_q2_score": 0.4493926344647596, "lm_q1q2_score": 0.252637972174329}} {"text": "theory Proto_Sepref_Borrow\nimports Sepref\nbegin\n\n (* Simple-Minded borrowing for sepref.\n \n Idea: When we can prove that we have not changed an object abstractly, \n and its concrete value is still the same, we can reinstantiate it \n after it has been invalidated.\n \n *)\n\n text \\Operation to reinstantiate dst, by moving source. \n Implementations will also require a proof that the concrete objects are equal!\n \\\n definition \"unborrow src dst \\ doN {ASSERT (src=dst); RETURN ()}\"\n sepref_register unborrow\n\n lemma unborrow_correct[refine_vcg]: \"s=d \\ unborrow s d \\ SPEC (\\r. r=()) (\\_. 0)\"\n unfolding unborrow_def SPEC_def ASSERT_def iASSERT_def apply simp by (auto simp: RETURNT_def)\n \n lemma unborrow_rule[sepref_comb_rules]:\n assumes FRAME: \"\\ \\ hn_ctxt R src srci ** hn_invalid R dst dsti ** F\"\n assumes [simp]: \"vassn_tag \\ \\ srci = dsti\"\n shows \"hn_refine \\ (return ()::unit llM) (hn_invalid R src srci ** hn_ctxt R dst dsti ** F) unit_assn (unborrow$src$dst)\"\n apply (rule hn_refine_vassn_tagI)\n apply (rule hn_refine_cons_pre[OF _ FRAME])\n unfolding unborrow_def apply (simp only: APP_def)\n apply (rule hn_refineI'')\n apply (simp add: refine_pw_simps)\n unfolding hn_ctxt_def invalid_assn_def pure_def\n by vcg'\n \n lemma unborrow_nofail[refine_pw_simps]: \"nofailT (unborrow a b) \\ a=b\" by (auto simp: unborrow_def refine_pw_simps) \n \n \n text \\Assertion that adds constraint on concrete value. Used to carry through concrete equalities.\\\n definition \"cnc_assn \\ A a c \\ \\(\\ c) ** A a c\"\n \n lemma norm_ceq_assn[named_ss sepref_frame_normrel]: \"hn_ctxt (cnc_assn \\ A) a c = (\\(\\ c) ** hn_ctxt A a c)\"\n unfolding hn_ctxt_def cnc_assn_def by simp\n \n lemma cnc_assn_prod_conv[named_ss sepref_frame_normrel]:\n shows \"\\A B \\. A \\\\<^sub>a cnc_assn \\ B = cnc_assn (\\ o snd) (A\\\\<^sub>aB)\"\n and \"\\A B \\. cnc_assn \\ A \\\\<^sub>a B = cnc_assn (\\ o fst) (A\\\\<^sub>aB)\"\n unfolding cnc_assn_def\n by (auto simp: sep_algebra_simps fun_eq_iff)\n \n (* BEWARE: This only only holds without time, would need to have\n to add (infinite?) time credits to premise HT \n\n text \\Rule to prove a-posteriori constraint (Only useful for simple programs.\n TODO: More partial Hoare-triples would make this more useful, e.g., \n we could assume assertions, preconditions, and even termination!\n )\\ \n lemma hnr_ceq_assnI:\n assumes HNR: \"hn_refine \\ c \\' R a\"\n assumes HT: \"llvm_htriple \\ c (\\x'. \\(\\ x') ** sep_true)\"\n shows \"hn_refine \\ c \\' (cnc_assn \\ R) a\"\n proof (rule hn_refine_nofailI)\n assume NF: \"nofailT a\"\n \n show ?thesis\n apply (rule hn_refineI)\n apply (rule cons_post_rule)\n apply (rule htriple_conj_pure[OF HNR[THEN hn_refineD[OF _ NF]] HT])\n apply (auto simp: sep_algebra_simps pred_lift_extract_simps cnc_assn_def)\n done\n \n qed \n *)\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/sepref/Proto_Sepref_Borrow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2522747730686923}} {"text": "theory IICF_Misc\nimports \"../Sepref\"\nbegin\n\n\n\n\n\ncontext\n fixes t :: \"nat\"\nbegin\n definition \"mop_plus a b =SPECT [a + b \\ t]\"\n\n lemma mop_plus: \"\\tt. tt \\ lst (SPECT [ a + b \\ t]) Q \\ tt\n \\ lst (mop_plus a b) Q\" unfolding mop_plus_def by simp \n \n sepref_register \"mop_plus\" \n print_theorems \nend \n \n\n \n \nlemma hn_refine_plus[sepref_fr_rules]: \" hn_refine (hn_val Id a' a * hn_val Id b' b)\n (ureturn (a + b))\n (hn_val Id a' a * hn_val Id b' b)\n (pure Id) (((PR_CONST (mop_plus t)) $ a' $ b'))\"\n unfolding hn_refine_def apply (auto simp: mult.assoc execute_ureturn pure_def hn_ctxt_def)\n by (auto simp: top_assn_rule zero_enat_def relH_def mop_plus_def elim: pureD ) \n \ncontext\n fixes t :: \"nat\"\nbegin\n definition \"mop_min a b =SPECT [min a b \\ t]\"\n\n lemma mop_min: \"\\tt. tt \\ lst (SPECT [ min a b \\ t]) Q \\ tt\n \\ lst (mop_min a b) Q\" unfolding mop_min_def by simp \n \n sepref_register \"mop_min\" \n print_theorems \nend \n \n\n \n \nlemma hn_refine_min[sepref_fr_rules]: \" hn_refine (hn_val Id a' a * hn_val Id b' b)\n (ureturn (min a b))\n (hn_val Id a' a * hn_val Id b' b)\n (pure Id) (((PR_CONST (mop_min t)) $ a' $ b'))\"\n unfolding hn_refine_def apply (auto simp: mult.assoc execute_ureturn pure_def hn_ctxt_def)\n by (auto simp: top_assn_rule zero_enat_def relH_def mop_min_def elim: pureD ) \n \n \ncontext\n fixes t :: \"nat\"\nbegin\n definition \"mop_swap e =SPECT [prod.swap e \\ t]\"\n\n lemma mop_swap: \"\\tt. tt \\ lst (SPECT [ prod.swap e \\ t]) Q \\ tt\n \\ lst (mop_swap e) Q\" unfolding mop_swap_def by simp \n \n sepref_register \"mop_swap\" \n print_theorems \nend \n \n\n \n \nlemma hn_refine_swap[sepref_fr_rules]: \" hn_refine (hn_ctxt (nat_assn \\\\<^sub>a nat_assn) e' e)\n (ureturn (prod.swap e))\n (hn_ctxt (nat_assn \\\\<^sub>a nat_assn) e' e)\n (nat_assn \\\\<^sub>a nat_assn) (((PR_CONST (mop_swap t)) $ e'))\"\n unfolding hn_refine_def apply (auto simp: execute_ureturn )\n apply (auto simp: top_assn_rule zero_enat_def relH_def prod.swap_def mop_swap_def elim: pureD ) \n apply(rule exI[where x=0]) apply auto \n by (smt BNF_Greatest_Fixpoint.IdD IdI entails_def entails_true hn_ctxt_def mult.left_neutral pure_assn_rule pure_def pure_true) \n \n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/IICF/IICF_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2522747730686923}} {"text": "(* Title: JinjaThreads/Framework/FWLifting.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Lifting of thread-local properties to the multithreaded case\\\n\ntheory FWLifting\nimports\n FWWellform\nbegin\n\ntext\\Lifting for properties that only involve thread-local state information and the shared memory.\\\n\ndefinition\n ts_ok :: \"('t \\ 'x \\ 'm \\ bool) \\ ('l, 't,'x) thread_info \\ 'm \\ bool\"\nwhere\n \"\\ln. ts_ok P ts m \\ \\t. case (ts t) of None \\ True | \\(x, ln)\\ \\ P t x m\"\n\nlemma ts_okI:\n \"\\ \\t x ln. ts t = \\(x, ln)\\ \\ P t x m \\ \\ ts_ok P ts m\"\nby(auto simp add: ts_ok_def)\n\nlemma ts_okE:\n \"\\ ts_ok P ts m; \\ \\t x ln. ts t = \\(x, ln)\\ \\ P t x m \\ \\ Q \\ \\ Q\"\nby(auto simp add: ts_ok_def)\n\nlemma ts_okD:\n \"\\ln. \\ ts_ok P ts m; ts t = \\(x, ln)\\ \\ \\ P t x m\"\nby(auto simp add: ts_ok_def)\n\nlemma ts_ok_True [simp]:\n \"ts_ok (\\t m x. True) ts m\"\nby(auto intro: ts_okI)\n\nlemma ts_ok_conj:\n \"ts_ok (\\t x m. P t x m \\ Q t x m) = (\\ts m. ts_ok P ts m \\ ts_ok Q ts m)\"\nby(auto intro: ts_okI intro!: ext dest: ts_okD)\n\nlemma ts_ok_mono:\n \"\\ ts_ok P ts m; \\t x. P t x m \\ Q t x m \\ \\ ts_ok Q ts m\"\nby(auto intro!: ts_okI dest: ts_okD)\n\ntext\\Lifting for properites, that also require additional data that does not change during execution\\\n\ndefinition\n ts_inv :: \"('i \\ 't \\ 'x \\ 'm \\ bool) \\ ('t \\ 'i) \\ ('l,'t,'x) thread_info \\ 'm \\ bool\"\nwhere\n \"\\ln. ts_inv P I ts m \\ \\t. case (ts t) of None \\ True | \\(x, ln)\\ \\ \\i. I t = \\i\\ \\ P i t x m\" \n\nlemma ts_invI:\n \"\\ \\t x ln. ts t = \\(x, ln)\\ \\ \\i. I t = \\i\\ \\ P i t x m \\ \\ ts_inv P I ts m\"\nby(simp add: ts_inv_def)\n\nlemma ts_invE:\n \"\\ ts_inv P I ts m; \\t x ln. ts t = \\(x, ln)\\ \\ (\\i. I t = \\i\\ \\ P i t x m) \\ R \\ \\ R\"\nby(auto simp add: ts_inv_def)\n\nlemma ts_invD:\n \"\\ln. \\ ts_inv P I ts m; ts t = \\(x, ln)\\ \\ \\ \\i. I t = \\i\\ \\ P i t x m\"\nby(auto simp add: ts_inv_def)\n\ntext \\Wellformedness properties for lifting\\\n\ndefinition\n ts_inv_ok :: \"('l,'t,'x) thread_info \\ ('t \\ 'i) \\ bool\"\nwhere\n \"ts_inv_ok ts I \\ \\t. ts t = None \\ I t = None\"\n\nlemma ts_inv_okI:\n \"(\\t. ts t = None \\ I t = None) \\ ts_inv_ok ts I\"\nby(clarsimp simp add: ts_inv_ok_def)\n\nlemma ts_inv_okI2:\n \"(\\t. (\\v. ts t = \\v\\) \\ (\\v. I t = \\v\\)) \\ ts_inv_ok ts I\"\nby(force simp add: ts_inv_ok_def)\n\nlemma ts_inv_okE:\n \"\\ ts_inv_ok ts I; \\t. ts t = None \\ I t = None \\ P \\ \\ P\"\nby(force simp add: ts_inv_ok_def)\n\nlemma ts_inv_okE2:\n \"\\ ts_inv_ok ts I; \\t. (\\v. ts t = \\v\\) \\ (\\v. I t = \\v\\) \\ P \\ \\ P\"\nby(force simp add: ts_inv_ok_def)\n\nlemma ts_inv_okD:\n \"ts_inv_ok ts I \\ (ts t = None) \\ (I t = None)\"\nby(erule ts_inv_okE, blast)\n\nlemma ts_inv_okD2:\n \"ts_inv_ok ts I \\ (\\v. ts t = \\v\\) \\ (\\v. I t = \\v\\)\"\nby(erule ts_inv_okE2, blast)\n\nlemma ts_inv_ok_conv_dom_eq:\n \"ts_inv_ok ts I \\ (dom ts = dom I)\"\nproof -\n have \"ts_inv_ok ts I \\ (\\t. ts t = None \\ I t = None)\"\n unfolding ts_inv_ok_def by blast\n also have \"\\ \\ (\\t. t \\ - dom ts \\ t \\ - dom I)\" by(force)\n also have \"\\ \\ dom ts = dom I\" by auto\n finally show ?thesis .\nqed\n\nlemma ts_inv_ok_upd_ts:\n \"\\ ts t = \\x\\; ts_inv_ok ts I \\ \\ ts_inv_ok (ts(t \\ x')) I\"\nby(auto dest!: ts_inv_okD intro!: ts_inv_okI split: if_splits)\n\nlemma ts_inv_upd_map_option:\n assumes \"ts_inv P I ts m\"\n and \"\\x ln. ts t = \\(x, ln)\\ \\ P (the (I t)) t (fst (f (x, ln))) m\"\n shows \"ts_inv P I (ts(t := (map_option f (ts t)))) m\"\nusing assms\nby(fastforce intro!: ts_invI split: if_split_asm dest: ts_invD)\n\nfun upd_inv :: \"('t \\ 'i) \\ ('i \\ 't \\ 'x \\ 'm \\ bool) \\ ('t,'x,'m) new_thread_action \\ ('t \\ 'i)\"\nwhere\n \"upd_inv I P (NewThread t x m) = I(t \\ SOME i. P i t x m)\"\n| \"upd_inv I P _ = I\"\n\nfun upd_invs :: \"('t \\ 'i) \\ ('i \\ 't \\ 'x \\ 'm \\ bool) \\ ('t,'x,'m) new_thread_action list \\ ('t \\ 'i)\"\nwhere\n \"upd_invs I P [] = I\"\n| \"upd_invs I P (ta#tas) = upd_invs (upd_inv I P ta) P tas\"\n\nlemma upd_invs_append [simp]:\n \"upd_invs I P (xs @ ys) = upd_invs (upd_invs I P xs) P ys\"\nby(induct xs arbitrary: I)(auto)\n\nlemma ts_inv_ok_upd_inv':\n \"ts_inv_ok ts I \\ ts_inv_ok (redT_updT' ts ta) (upd_inv I P ta)\"\nby(cases ta)(auto intro!: ts_inv_okI elim: ts_inv_okD del: iffI)\n\nlemma ts_inv_ok_upd_invs':\n \"ts_inv_ok ts I \\ ts_inv_ok (redT_updTs' ts tas) (upd_invs I P tas)\"\nproof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\nnext\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. ts_inv_ok ts I \\ ts_inv_ok (redT_updTs' ts TAS) (upd_invs I P TAS)\\\n note esok = \\ts_inv_ok TS I\\\n from esok have \"ts_inv_ok (redT_updT' TS TA) (upd_inv I P TA)\"\n by -(rule ts_inv_ok_upd_inv')\n hence \"ts_inv_ok (redT_updTs' (redT_updT' TS TA) TAS) (upd_invs (upd_inv I P TA) P TAS)\"\n by (rule IH)\n thus ?case by simp\nqed\n\nlemma ts_inv_ok_upd_inv:\n \"ts_inv_ok ts I \\ ts_inv_ok (redT_updT ts ta) (upd_inv I P ta)\"\napply(cases ta)\napply(auto intro!: ts_inv_okI elim: ts_inv_okD del: iffI)\ndone\n\nlemma ts_inv_ok_upd_invs:\n \"ts_inv_ok ts I \\ ts_inv_ok (redT_updTs ts tas) (upd_invs I P tas)\"\nproof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\nnext\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. ts_inv_ok ts I \\ ts_inv_ok (redT_updTs ts TAS) (upd_invs I P TAS)\\\n note esok = \\ts_inv_ok TS I\\\n from esok have \"ts_inv_ok (redT_updT TS TA) (upd_inv I P TA)\"\n by -(rule ts_inv_ok_upd_inv)\n hence \"ts_inv_ok (redT_updTs (redT_updT TS TA) TAS) (upd_invs (upd_inv I P TA) P TAS)\"\n by (rule IH)\n thus ?case by simp\nqed\n\nlemma ts_inv_ok_inv_ext_upd_inv:\n \"\\ ts_inv_ok ts I; thread_ok ts ta \\ \\ I \\\\<^sub>m upd_inv I P ta\"\nby(cases ta)(auto intro!: map_le_same_upd dest: ts_inv_okD)\n\nlemma ts_inv_ok_inv_ext_upd_invs:\n \"\\ ts_inv_ok ts I; thread_oks ts tas\\\n \\ I \\\\<^sub>m upd_invs I P tas\"\nproof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\nnext\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. \\ ts_inv_ok ts I; thread_oks ts TAS\\ \\ I \\\\<^sub>m upd_invs I P TAS\\\n note esinv = \\ts_inv_ok TS I\\\n note cct = \\thread_oks TS (TA # TAS)\\\n from esinv cct have \"I \\\\<^sub>m upd_inv I P TA\"\n by(auto intro: ts_inv_ok_inv_ext_upd_inv)\n also from esinv cct have \"ts_inv_ok (redT_updT' TS TA) (upd_inv I P TA)\"\n by(auto intro: ts_inv_ok_upd_inv')\n with cct have \"upd_inv I P TA \\\\<^sub>m upd_invs (upd_inv I P TA) P TAS\"\n by(auto intro: IH)\n finally show ?case by simp\nqed\n\nlemma upd_invs_Some:\n \"\\ thread_oks ts tas; I t = \\i\\; ts t = \\x\\ \\ \\ upd_invs I Q tas t = \\i\\\"\nproof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\nnext\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. \\thread_oks ts TAS; I t = \\i\\; ts t = \\x\\\\ \\ upd_invs I Q TAS t = \\i\\\\\n note cct = \\thread_oks TS (TA # TAS)\\\n note it = \\I t = \\i\\\\\n note est = \\TS t = \\x\\\\\n from cct have cctta: \"thread_ok TS TA\"\n and ccttas: \"thread_oks (redT_updT' TS TA) TAS\" by auto\n from cctta it est have \"upd_inv I Q TA t = \\i\\\"\n by(cases TA, auto)\n moreover\n have \"redT_updT' TS TA t = \\x\\\" using cctta est\n by - (rule redT_updT'_Some) \n ultimately have \"upd_invs (upd_inv I Q TA) Q TAS t = \\i\\\" using ccttas\n by -(erule IH)\n thus ?case by simp\nqed\n\nlemma upd_inv_Some_eq:\n \"\\ thread_ok ts ta; ts t = \\x\\ \\ \\ upd_inv I Q ta t = I t\"\nby(cases ta, auto)\n\nlemma upd_invs_Some_eq: \"\\ thread_oks ts tas; ts t = \\x\\ \\ \\ upd_invs I Q tas t = I t\"\nproof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\nnext\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. \\thread_oks ts TAS; ts t = \\x\\\\ \\ upd_invs I Q TAS t = I t\\\n note cct = \\thread_oks TS (TA # TAS)\\\n note est = \\TS t = \\x\\\\\n from cct est have \"upd_invs (upd_inv I Q TA) Q TAS t = upd_inv I Q TA t\"\n apply(clarsimp)\n apply(erule IH)\n by(rule redT_updT'_Some)\n also from cct est have \"\\ = I t\" \n by(auto elim: upd_inv_Some_eq)\n finally show ?case by simp\nqed\n\nlemma SOME_new_thread_upd_invs:\n assumes Qsome: \"Q (SOME i. Q i t x m) t x m\"\n and nt: \"NewThread t x m \\ set tas\"\n and cct: \"thread_oks ts tas\"\n shows \"\\i. upd_invs I Q tas t = \\i\\ \\ Q i t x m\"\nproof(rule exI[where x=\"SOME i. Q i t x m\"])\n from nt cct have \"upd_invs I Q tas t = \\SOME i. Q i t x m\\\"\n proof(induct tas arbitrary: ts I)\n case Nil thus ?case by simp\n next\n case (Cons TA TAS TS I)\n note IH = \\\\ts I. \\ NewThread t x m \\ set TAS; thread_oks ts TAS \\ \\ upd_invs I Q TAS t = \\SOME i. Q i t x m\\\\\n note nt = \\NewThread t x m \\ set (TA # TAS)\\\n note cct = \\thread_oks TS (TA # TAS)\\\n { assume nt': \"NewThread t x m \\ set TAS\"\n from cct have ?case\n apply(clarsimp)\n by(rule IH[OF nt']) }\n moreover\n { assume ta: \"TA = NewThread t x m\"\n with cct have rup: \"redT_updT' TS TA t = \\(undefined, no_wait_locks)\\\"\n by(simp)\n from cct have cctta: \"thread_oks (redT_updT' TS TA) TAS\" by simp\n from ta have \"upd_inv I Q TA t = \\SOME i. Q i t x m\\\"\n by(simp)\n hence ?case \n by(clarsimp simp add: upd_invs_Some_eq[OF cctta, OF rup]) }\n ultimately show ?case using nt by auto\n qed\n with Qsome show \"upd_invs I Q tas t = \\SOME i. Q i t x m\\ \\ Q (SOME i. Q i t x m) t x m\"\n by(simp)\nqed\n\nlemma ts_ok_into_ts_inv_const:\n assumes \"ts_ok P ts m\"\n obtains I where \"ts_inv (\\_. P) I ts m\"\nproof -\n from assms have \"ts_inv (\\_. P) (\\t. if t \\ dom ts then Some undefined else None) ts m\"\n by(auto intro!: ts_invI dest: ts_okD)\n thus thesis by(rule that)\nqed\n\nlemma ts_inv_const_into_ts_ok:\n \"ts_inv (\\_. P) I ts m \\ ts_ok P ts m\"\nby(auto intro!: ts_okI dest: ts_invD)\n\nlemma ts_inv_into_ts_ok_Ex:\n \"ts_inv Q I ts m \\ ts_ok (\\t x m. \\i. Q i t x m) ts m\"\nby(rule ts_okI)(blast dest: ts_invD)\n\nlemma ts_ok_Ex_into_ts_inv:\n \"ts_ok (\\t x m. \\i. Q i t x m) ts m \\ \\I. ts_inv Q I ts m\"\nby(rule exI[where x=\"\\t. \\SOME i. Q i t (fst (the (ts t))) m\\\"])(auto 4 4 dest: ts_okD intro: someI intro: ts_invI)\n\nlemma Ex_ts_inv_conv_ts_ok:\n \"(\\I. ts_inv Q I ts m) \\ (ts_ok (\\t x m. \\i. Q i t x m) ts m)\"\nby(auto dest: ts_inv_into_ts_ok_Ex ts_ok_Ex_into_ts_inv)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/FWLifting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2521779748096991}} {"text": "\\<^marker>\\creator Alexander Taepper\\\n\ntheory IMP_Minus_To_IMP_Minus_Minus_IMP\n imports\n Primitives_IMP_Minus\n Binary_Arithmetic_IMP\n IMP_Minus_To_IMP_Minus_Minus_State_Translations_IMP\n IMP_Minus_To_IMP_Minus_Minus_nat\n IMP_Minus.Com\nbegin\n\n\nunbundle IMP_Minus_Minus_Com.no_com_syntax\n\n\nsubsection \\Useful Definitions and Lemmas\\\n\n\nsubsection \\map_var_bit_to_var\\\n\nsubsubsection \\map_var_bit_to_var_aux\\\n\nfun map_var_bit_to_var_aux :: \"nat \\ nat \\ nat \\ nat\" where \n\"map_var_bit_to_var_aux acc v n = ((var_bit_to_var_nat (prod_encode (v,hd_nat n)))## acc)\"\n\nrecord map_var_bit_to_var_aux_state =\n map_var_bit_to_var_aux_acc::nat\n map_var_bit_to_var_aux_v::nat\n map_var_bit_to_var_aux_n::nat\n map_var_bit_to_var_aux_ret::nat\n\nabbreviation \"map_var_bit_to_var_aux_prefix \\ ''map_var_bit_to_var_aux.''\"\nabbreviation \"map_var_bit_to_var_aux_acc_str \\ ''acc''\"\nabbreviation \"map_var_bit_to_var_aux_v_str \\ ''v''\"\nabbreviation \"map_var_bit_to_var_aux_n_str \\ ''n''\"\nabbreviation \"map_var_bit_to_var_aux_ret_str \\ ''ret''\"\n\n\nfunction map_var_bit_to_var_aux_imp :: \"map_var_bit_to_var_aux_state \\ map_var_bit_to_var_aux_state\" where \n\"map_var_bit_to_var_aux_imp s = \n(let\n hd_xs' = map_var_bit_to_var_aux_n s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n\n prod_encode_a' = map_var_bit_to_var_aux_v s;\n prod_encode_b' = hd_ret hd_ret_state;\n prod_encode_ret' = 0;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n\n var_bit_to_var_nat_n' = prod_encode_ret prod_encode_ret_state;\n var_bit_to_var_nat_ret' = 0;\n var_bit_to_var_nat_state = \\var_bit_to_var_nat_n = var_bit_to_var_nat_n',\n var_bit_to_var_nat_ret = var_bit_to_var_nat_ret'\\;\n var_bit_to_var_nat_ret_state = var_bit_to_var_nat_imp var_bit_to_var_nat_state;\n\n cons_h' = var_bit_to_var_nat_ret var_bit_to_var_nat_ret_state;\n cons_t' = map_var_bit_to_var_aux_acc s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h',\n cons_t = cons_t', \n cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n map_var_bit_to_var_aux_ret' = cons_ret cons_ret_state;\n \n tl_xs' = map_var_bit_to_var_aux_n s;\n tl_ret' = 0;\n tl_state = \\tl_xs = tl_xs', \n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n\n map_var_bit_to_var_aux_n' = tl_ret tl_ret_state;\n ret = \\map_var_bit_to_var_aux_acc = map_var_bit_to_var_aux_acc s,\n map_var_bit_to_var_aux_v = map_var_bit_to_var_aux_v s,\n map_var_bit_to_var_aux_n = map_var_bit_to_var_aux_n',\n map_var_bit_to_var_aux_ret = map_var_bit_to_var_aux_ret'\\\n in\n ret)\n \" by simp+\n termination\n apply (relation \"measure map_var_bit_to_var_aux_acc\")\n apply simp \n done \n\ndeclare map_var_bit_to_var_aux_imp.simps[simp del]\n\nlemma map_var_bit_to_var_aux_imp_correct[let_function_correctness]:\n\"map_var_bit_to_var_aux_ret (map_var_bit_to_var_aux_imp s) = \n map_var_bit_to_var_aux (map_var_bit_to_var_aux_acc s) (map_var_bit_to_var_aux_v s) (map_var_bit_to_var_aux_n s)\n \\ map_var_bit_to_var_aux_n (map_var_bit_to_var_aux_imp s) = tl_nat (map_var_bit_to_var_aux_n s)\"\napply (subst map_var_bit_to_var_aux_imp.simps)+\napply (auto simp add: hd_imp_correct prod_encode_imp_correct var_bit_to_var_nat_imp_correct cons_imp_correct\n tl_imp_correct)\ndone \n\nfunction map_var_bit_to_var_aux_imp_time :: \"nat \\ map_var_bit_to_var_aux_state \\ nat\" where \n\"map_var_bit_to_var_aux_imp_time t s = \n(let\n hd_xs' = map_var_bit_to_var_aux_n s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs',\n hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n\n prod_encode_a' = map_var_bit_to_var_aux_v s;\n t = t + 2;\n prod_encode_b' = hd_ret hd_ret_state;\n t = t + 2;\n prod_encode_ret' = 0;\n t = t + 2;\n prod_encode_state = \\prod_encode_a = prod_encode_a',\n prod_encode_b = prod_encode_b',\n prod_encode_ret = prod_encode_ret'\\;\n prod_encode_ret_state = prod_encode_imp prod_encode_state;\n t = t + prod_encode_imp_time 0 prod_encode_state;\n\n var_bit_to_var_nat_n' = prod_encode_ret prod_encode_ret_state;\n t = t + 2;\n var_bit_to_var_nat_ret' = 0;\n t = t + 2;\n var_bit_to_var_nat_state = \\var_bit_to_var_nat_n = var_bit_to_var_nat_n',\n var_bit_to_var_nat_ret = var_bit_to_var_nat_ret'\\;\n var_bit_to_var_nat_ret_state = var_bit_to_var_nat_imp var_bit_to_var_nat_state;\n t = t + var_bit_to_var_nat_imp_time 0 var_bit_to_var_nat_state;\n\n cons_h' = var_bit_to_var_nat_ret var_bit_to_var_nat_ret_state;\n t = t + 2;\n cons_t' = map_var_bit_to_var_aux_acc s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h',\n cons_t = cons_t', \n cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n map_var_bit_to_var_aux_ret' = cons_ret cons_ret_state;\n t = t + 2;\n\n tl_xs' = map_var_bit_to_var_aux_n s;\n t = t + 2;\n tl_ret' = 0;\n t = t + 2;\n tl_state = \\tl_xs = tl_xs', \n tl_ret = tl_ret'\\;\n tl_ret_state = tl_imp tl_state;\n t = t + tl_imp_time 0 tl_state;\n\n map_var_bit_to_var_aux_n' = tl_ret tl_ret_state;\n t = t + 2;\n ret = \\map_var_bit_to_var_aux_acc = map_var_bit_to_var_aux_acc s,\n map_var_bit_to_var_aux_v = map_var_bit_to_var_aux_v s,\n map_var_bit_to_var_aux_n = map_var_bit_to_var_aux_n',\n map_var_bit_to_var_aux_ret = map_var_bit_to_var_aux_ret'\\\n in\n t)\n \" by auto\n termination\n apply (relation \"measure (map_var_bit_to_var_aux_acc \\ snd)\")\n apply simp \n done \n\ndeclare map_var_bit_to_var_aux_imp_time.simps[simp del]\n\ndefinition \"map_var_bit_to_var_aux_IMP_Minus \\ \n (hd_prefix @ hd_xs_str) ::= (A (V map_var_bit_to_var_aux_n_str));;\n (hd_prefix @ hd_ret_str) ::= (A (N 0));;\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n\n (prod_encode_prefix @ prod_encode_a_str) ::= (A (V map_var_bit_to_var_aux_v_str));;\n (prod_encode_prefix @ prod_encode_b_str) ::= (A (V (hd_prefix @ hd_ret_str)));;\n (prod_encode_prefix @ prod_encode_ret_str) ::= (A (N 0));;\n invoke_subprogram prod_encode_prefix prod_encode_IMP_Minus;;\n\n (var_bit_to_var_nat_prefix @ var_bit_to_var_nat_n_str) ::= (A (V (prod_encode_prefix @ prod_encode_ret_str)));;\n (var_bit_to_var_nat_prefix @ var_bit_to_var_nat_ret_str) ::= (A (N 0));;\n invoke_subprogram var_bit_to_var_nat_prefix var_bit_to_var_nat_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= (A (V (var_bit_to_var_nat_prefix @ var_bit_to_var_nat_ret_str)));;\n (cons_prefix @ cons_t_str) ::= (A (V map_var_bit_to_var_aux_acc_str));;\n (cons_prefix @ cons_ret_str) ::= (A (N 0));;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n map_var_bit_to_var_aux_ret_str ::= (A (V (cons_prefix @ cons_ret_str)));;\n\n (tl_prefix @ tl_xs_str) ::= (A (V map_var_bit_to_var_aux_n_str));;\n (tl_prefix @ tl_ret_str) ::= (A (N 0));;\n invoke_subprogram tl_prefix tl_IMP_Minus;;\n\n map_var_bit_to_var_aux_n_str ::= (A (V (tl_prefix @ tl_ret_str)))\n\"\n\ndefinition \"map_var_bit_to_var_aux_imp_to_HOL_state p s =\n \\map_var_bit_to_var_aux_acc = (s (add_prefix p map_var_bit_to_var_aux_acc_str)),\n map_var_bit_to_var_aux_v = (s (add_prefix p map_var_bit_to_var_aux_v_str)),\n map_var_bit_to_var_aux_n = (s (add_prefix p map_var_bit_to_var_aux_n_str)),\n map_var_bit_to_var_aux_ret = (s (add_prefix p map_var_bit_to_var_aux_ret_str))\\\"\n\nlemmas map_var_bit_to_var_aux_state_translators =\n map_var_bit_to_var_aux_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n prod_encode_imp_to_HOL_state_def\n var_bit_to_var_nat_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n tl_imp_to_HOL_state_def\n\nabbreviation \"map_var_bit_to_var_aux_IMP_vars \\ {\n map_var_bit_to_var_aux_acc_str, map_var_bit_to_var_aux_v_str, \n map_var_bit_to_var_aux_n_str, map_var_bit_to_var_aux_ret_str}\"\n\nlemma map_var_bit_to_var_aux_IMP_Minus_correct_function_ret:\n \"(invoke_subprogram p map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p map_var_bit_to_var_aux_ret_str)\n = map_var_bit_to_var_aux_ret\n (map_var_bit_to_var_aux_imp (map_var_bit_to_var_aux_imp_to_HOL_state p s))\"\napply (simp only: map_var_bit_to_var_aux_IMP_Minus_def prefix_simps)\napply (erule Seq_E)+\napply (erule hd_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(19) by fastforce\napply (erule prod_encode_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(21) by fastforce\napply (erule var_bit_to_var_nat_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(23) by fastforce\napply (erule cons_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(25) by fastforce\napply (erule tl_IMP_Minus_correct[where vars=\"map_var_bit_to_var_aux_IMP_vars\"])\nsubgoal premises p using p(27) by fastforce\napply (clarsimp simp add:\n map_var_bit_to_var_aux_state_translators Let_def map_var_bit_to_var_aux_imp.simps)\nsubgoal premises p\n using p(10) p(8) p(6) p(4) p(2) by force \ndone \n\nlemma map_var_bit_to_var_aux_IMP_Minus_correct_function_n:\n \"(invoke_subprogram p map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p map_var_bit_to_var_aux_n_str)\n = map_var_bit_to_var_aux_n\n (map_var_bit_to_var_aux_imp (map_var_bit_to_var_aux_imp_to_HOL_state p s))\"\napply (simp only: map_var_bit_to_var_aux_IMP_Minus_def prefix_simps)\napply (erule Seq_E)+\napply (erule hd_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(19) by fastforce\napply (erule prod_encode_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(21) by fastforce\napply (erule var_bit_to_var_nat_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(23) by fastforce\napply (erule cons_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(25) by fastforce\napply (erule tl_IMP_Minus_correct[where vars=\"map_var_bit_to_var_aux_IMP_vars\"])\nsubgoal premises p using p(27) by fastforce\napply (clarsimp simp add:\n map_var_bit_to_var_aux_state_translators Let_def map_var_bit_to_var_aux_imp.simps)\nsubgoal premises p\n using p(10) p(8) p(6) p(4) p(2) by force \ndone \n\nlemma map_var_bit_to_var_aux_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ map_var_bit_to_var_aux_pref) map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix map_var_bit_to_var_aux_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\n\nlemma map_var_bit_to_var_aux_IMP_Minus_correct_time:\n \"(invoke_subprogram p map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = map_var_bit_to_var_aux_imp_time 0 (map_var_bit_to_var_aux_imp_to_HOL_state p s)\"\napply (simp only: map_var_bit_to_var_aux_IMP_Minus_def prefix_simps)\napply (erule Seq_tE)+\napply (erule hd_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(37) by fastforce\napply (erule prod_encode_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(39) by fastforce\napply (erule var_bit_to_var_nat_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(41) by fastforce\napply (erule cons_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(43) by fastforce\napply (erule tl_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(45) by fastforce\napply (force simp: map_var_bit_to_var_aux_imp_time.simps \n Let_def map_var_bit_to_var_aux_state_translators)\ndone \n\nlemma map_var_bit_to_var_aux_IMP_Minus_correct[functional_correctness]:\n \"\\(invoke_subprogram (p1 @ p2) map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (map_var_bit_to_var_aux_imp_time 0 (map_var_bit_to_var_aux_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_var_bit_to_var_aux_ret_str) =\n map_var_bit_to_var_aux_ret (map_var_bit_to_var_aux_imp\n (map_var_bit_to_var_aux_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_var_bit_to_var_aux_n_str) =\n map_var_bit_to_var_aux_n (map_var_bit_to_var_aux_imp\n (map_var_bit_to_var_aux_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using map_var_bit_to_var_aux_IMP_Minus_correct_function_ret \n map_var_bit_to_var_aux_IMP_Minus_correct_function_n\n by (auto simp: map_var_bit_to_var_aux_IMP_Minus_correct_time)\n (meson map_var_bit_to_var_aux_IMP_Minus_correct_effects set_mono_prefix) \n\nsubsubsection \\map_var_bit_to_var_acc\\\n\nfun map_var_bit_to_var_acc' :: \"nat \\ nat \\ nat \\ nat\" where \n\"map_var_bit_to_var_acc' acc v n = (if n \\ 0 \n then (map_var_bit_to_var_acc' ((var_bit_to_var_nat (prod_encode (v,hd_nat n)))## acc) v (tl_nat n))\n else acc)\"\n\nlemma map_var_bit_to_var_acc'_imp_correct:\n\"map_var_bit_to_var_acc' acc v n = map_var_bit_to_var_acc acc v n\"\nproof (induction n arbitrary: acc v rule: less_induct)\n case (less x)\n then show ?case\n proof(cases x)\n case (Suc nat)\n have \"tl_nat x < x\" using Suc\n by simp\n then show ?thesis\n using less by force\n qed (simp)\nqed\n\nrecord map_var_bit_to_var_acc_state =\n map_var_bit_to_var_acc_acc::nat\n map_var_bit_to_var_acc_v::nat\n map_var_bit_to_var_acc_n::nat\n map_var_bit_to_var_acc_ret::nat\n\nabbreviation \"map_var_bit_to_var_acc_prefix \\ ''map_var_bit_to_var_acc.''\"\nabbreviation \"map_var_bit_to_var_acc_acc_str \\ ''acc''\"\nabbreviation \"map_var_bit_to_var_acc_v_str \\ ''v''\"\nabbreviation \"map_var_bit_to_var_acc_n_str \\ ''n''\"\nabbreviation \"map_var_bit_to_var_acc_ret_str \\ ''ret''\"\n\ndefinition \"map_var_bit_to_var_acc_state_upd s \\\n let\n map_var_bit_to_var_aux_acc' = map_var_bit_to_var_acc_acc s;\n map_var_bit_to_var_aux_v' = map_var_bit_to_var_acc_v s;\n map_var_bit_to_var_aux_n' = map_var_bit_to_var_acc_n s;\n map_var_bit_to_var_aux_ret' = 0;\n map_var_bit_to_var_aux_state = \n \\map_var_bit_to_var_aux_acc = map_var_bit_to_var_aux_acc',\n map_var_bit_to_var_aux_v = map_var_bit_to_var_aux_v',\n map_var_bit_to_var_aux_n = map_var_bit_to_var_aux_n',\n map_var_bit_to_var_aux_ret = map_var_bit_to_var_aux_ret'\\;\n map_var_bit_to_var_aux_ret_state = \n map_var_bit_to_var_aux_imp map_var_bit_to_var_aux_state;\n\n\n map_var_bit_to_var_acc_acc' = map_var_bit_to_var_aux_ret map_var_bit_to_var_aux_ret_state;\n map_var_bit_to_var_acc_n' = map_var_bit_to_var_aux_n map_var_bit_to_var_aux_ret_state;\n ret = \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc',\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v s,\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n',\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret s\\\n in ret\n\"\n\ndefinition \"map_var_bit_to_var_acc_imp_compute_loop_condition s \\\n (let\n condition = map_var_bit_to_var_acc_n s\n in condition\n )\n\"\n\ndefinition \"map_var_bit_to_var_acc_imp_after_loop s \\\n (let\n map_var_bit_to_var_acc_ret' = map_var_bit_to_var_acc_acc s;\n ret = \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc s,\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v s,\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n s,\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret'\\\n in ret\n )\"\n\nlemmas map_var_bit_to_var_acc_imp_subprogram_simps = \n map_var_bit_to_var_acc_state_upd_def\n map_var_bit_to_var_acc_imp_compute_loop_condition_def\n map_var_bit_to_var_acc_imp_after_loop_def\n\nfunction map_var_bit_to_var_acc_imp::\n \"map_var_bit_to_var_acc_state \\ map_var_bit_to_var_acc_state\" where\n \"map_var_bit_to_var_acc_imp s =\n (if map_var_bit_to_var_acc_imp_compute_loop_condition s \\ 0\n then\n let next_iteration = map_var_bit_to_var_acc_imp (map_var_bit_to_var_acc_state_upd s)\n in next_iteration\n else\n let ret = map_var_bit_to_var_acc_imp_after_loop s\n in ret\n )\"\n by simp+\ntermination \n apply (relation \"measure map_var_bit_to_var_acc_n\")\n apply (simp add: map_var_bit_to_var_acc_imp_subprogram_simps \n map_var_bit_to_var_aux_imp_correct Let_def)+\n done\n\ndeclare map_var_bit_to_var_acc_imp.simps [simp del]\n\nlemma map_var_bit_to_var_acc_imp_correct[let_function_correctness]:\n \"map_var_bit_to_var_acc_ret (map_var_bit_to_var_acc_imp s) =\n map_var_bit_to_var_acc' (map_var_bit_to_var_acc_acc s) \n (map_var_bit_to_var_acc_v s) (map_var_bit_to_var_acc_n s)\"\n apply (induction s rule: map_var_bit_to_var_acc_imp.induct)\n apply (subst map_var_bit_to_var_acc_imp.simps)\n apply (subst map_var_bit_to_var_acc'.simps)\n apply (simp del: map_var_bit_to_var_acc'.simps \n add: map_var_bit_to_var_acc_imp_subprogram_simps Let_def \n fst_nat_fst'_nat snd_nat_snd'_nat snd'_imp_correct fst'_imp_correct\n map_var_bit_to_var_aux_imp_correct tl_imp_correct)\n done \n\ndefinition \"map_var_bit_to_var_acc_state_upd_time t s \\\n let\n map_var_bit_to_var_aux_acc' = map_var_bit_to_var_acc_acc s;\n t = t + 2;\n map_var_bit_to_var_aux_v' = map_var_bit_to_var_acc_v s;\n t = t + 2;\n map_var_bit_to_var_aux_n' = map_var_bit_to_var_acc_n s;\n t = t + 2;\n map_var_bit_to_var_aux_ret' = 0;\n t = t + 2;\n map_var_bit_to_var_aux_state = \n \\map_var_bit_to_var_aux_acc = map_var_bit_to_var_aux_acc',\n map_var_bit_to_var_aux_v = map_var_bit_to_var_aux_v',\n map_var_bit_to_var_aux_n = map_var_bit_to_var_aux_n',\n map_var_bit_to_var_aux_ret = map_var_bit_to_var_aux_ret'\\;\n map_var_bit_to_var_aux_ret_state = \n map_var_bit_to_var_aux_imp map_var_bit_to_var_aux_state;\n t = t + map_var_bit_to_var_aux_imp_time 0 map_var_bit_to_var_aux_state;\n\n map_var_bit_to_var_acc_acc' = map_var_bit_to_var_aux_ret map_var_bit_to_var_aux_ret_state;\n t = t + 2;\n map_var_bit_to_var_acc_n' = map_var_bit_to_var_aux_n map_var_bit_to_var_aux_ret_state;\n t = t + 2;\n ret = \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc',\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v s,\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n',\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret s\\\n in\n t\n\"\n\ndefinition \"map_var_bit_to_var_acc_imp_compute_loop_condition_time t s \\\n let\n condition = map_var_bit_to_var_acc_n s;\n t = t + 2\n in\n t\n\"\n\ndefinition \"map_var_bit_to_var_acc_imp_after_loop_time t s \\\n let\n map_var_bit_to_var_acc_ret' = map_var_bit_to_var_acc_acc s;\n t = t + 2;\n ret = \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc s,\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v s,\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n s,\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret'\\\n in\n t\n\"\n\nlemmas map_var_bit_to_var_acc_imp_subprogram_time_simps = \n map_var_bit_to_var_acc_state_upd_time_def\n map_var_bit_to_var_acc_imp_compute_loop_condition_time_def\n map_var_bit_to_var_acc_imp_after_loop_time_def\n map_var_bit_to_var_acc_imp_subprogram_simps\n\nfunction map_var_bit_to_var_acc_imp_time::\n \"nat \\ map_var_bit_to_var_acc_state \\ nat\" where\n \"map_var_bit_to_var_acc_imp_time t s =\n map_var_bit_to_var_acc_imp_compute_loop_condition_time 0 s +\n (if map_var_bit_to_var_acc_imp_compute_loop_condition s \\ 0\n then\n (let\n t = t + 1;\n next_iteration =\n map_var_bit_to_var_acc_imp_time (t + map_var_bit_to_var_acc_state_upd_time 0 s)\n (map_var_bit_to_var_acc_state_upd s)\n in next_iteration)\n else\n (let\n t = t + 2;\n ret = t + map_var_bit_to_var_acc_imp_after_loop_time 0 s\n in ret)\n )\"\n by auto\ntermination\n apply (relation \"measure (map_var_bit_to_var_acc_n \\ snd)\")\n by (auto simp add: map_var_bit_to_var_acc_imp_subprogram_time_simps\n map_var_bit_to_var_aux_imp_correct Let_def)\n\ndeclare map_var_bit_to_var_acc_imp_time.simps [simp del] \n\nlemma map_var_bit_to_var_acc_imp_time_acc:\n \"(map_var_bit_to_var_acc_imp_time (Suc t) s) = Suc (map_var_bit_to_var_acc_imp_time t s)\"\n by (induction t s rule: map_var_bit_to_var_acc_imp_time.induct)\n ((subst (1 2) map_var_bit_to_var_acc_imp_time.simps);\n (simp add: map_var_bit_to_var_acc_state_upd_def)) \n\nlemma map_var_bit_to_var_acc_imp_time_acc_2_aux:\n \"(map_var_bit_to_var_acc_imp_time t s) = t + (map_var_bit_to_var_acc_imp_time 0 s)\"\n by (induction t arbitrary: s) (simp add: map_var_bit_to_var_acc_imp_time_acc)+ \n\nlemma map_var_bit_to_var_acc_imp_time_acc_2:\n \"t \\ 0 \\ (map_var_bit_to_var_acc_imp_time t s) = t + (map_var_bit_to_var_acc_imp_time 0 s)\"\n by (rule map_var_bit_to_var_acc_imp_time_acc_2_aux) \n\nlemma map_var_bit_to_var_acc_imp_time_acc_3:\n \"(map_var_bit_to_var_acc_imp_time (a + b) s) = a + (map_var_bit_to_var_acc_imp_time b s)\"\n by (induction a arbitrary: b s) (simp add: map_var_bit_to_var_acc_imp_time_acc)+ \n\nabbreviation \"map_var_bit_to_var_acc_while_cond \\ ''condition''\"\n\ndefinition \"map_var_bit_to_var_acc_IMP_init_while_cond \\\n \\ \\condition = map_var_bit_to_var_acc_n s\\\n map_var_bit_to_var_acc_while_cond ::= A (V map_var_bit_to_var_acc_n_str)\n\"\n\ndefinition \"map_var_bit_to_var_acc_IMP_loop_body \\\n (map_var_bit_to_var_aux_prefix @ map_var_bit_to_var_aux_acc_str)\n ::= A (V map_var_bit_to_var_acc_acc_str);;\n (map_var_bit_to_var_aux_prefix @ map_var_bit_to_var_aux_v_str)\n ::= A (V map_var_bit_to_var_acc_v_str);;\n (map_var_bit_to_var_aux_prefix @ map_var_bit_to_var_aux_n_str)\n ::= A (V map_var_bit_to_var_acc_n_str);;\n (map_var_bit_to_var_aux_prefix @ map_var_bit_to_var_aux_ret_str)\n ::= A (N 0);;\n invoke_subprogram map_var_bit_to_var_aux_prefix map_var_bit_to_var_aux_IMP_Minus;;\n \n (map_var_bit_to_var_acc_acc_str) ::= (A (V (map_var_bit_to_var_aux_prefix \n @ map_var_bit_to_var_aux_ret_str)));;\n (map_var_bit_to_var_acc_n_str) ::= (A (V (map_var_bit_to_var_aux_prefix \n @ map_var_bit_to_var_aux_n_str)))\n\"\n\ndefinition \"map_var_bit_to_var_acc_IMP_after_loop \\\n (map_var_bit_to_var_acc_ret_str) ::= (A (V map_var_bit_to_var_acc_acc_str))\n \\ \\ret = \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc',\\\n \\ \\ map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v',\\\n \\ \\ map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n',\\\n \\ \\ map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret'\\\\\n\"\n\ndefinition map_var_bit_to_var_acc_IMP_Minus where\n \"map_var_bit_to_var_acc_IMP_Minus \\\n map_var_bit_to_var_acc_IMP_init_while_cond;;\n WHILE map_var_bit_to_var_acc_while_cond \\0 DO (\n map_var_bit_to_var_acc_IMP_loop_body;;\n map_var_bit_to_var_acc_IMP_init_while_cond\n );;\n map_var_bit_to_var_acc_IMP_after_loop\"\n\nabbreviation \"map_var_bit_to_var_acc_IMP_vars\\\n {map_var_bit_to_var_acc_while_cond,\n map_var_bit_to_var_acc_acc_str, map_var_bit_to_var_acc_v_str,\n map_var_bit_to_var_acc_n_str, map_var_bit_to_var_acc_ret_str}\"\n\nlemmas map_var_bit_to_var_acc_IMP_subprogram_simps =\n map_var_bit_to_var_acc_IMP_init_while_cond_def\n map_var_bit_to_var_acc_IMP_loop_body_def\n map_var_bit_to_var_acc_IMP_after_loop_def\n\ndefinition \"map_var_bit_to_var_acc_imp_to_HOL_state p s =\n \\map_var_bit_to_var_acc_acc = (s (add_prefix p map_var_bit_to_var_acc_acc_str)),\n map_var_bit_to_var_acc_v = (s (add_prefix p map_var_bit_to_var_acc_v_str)),\n map_var_bit_to_var_acc_n = (s (add_prefix p map_var_bit_to_var_acc_n_str)),\n map_var_bit_to_var_acc_ret = (s (add_prefix p map_var_bit_to_var_acc_ret_str))\\\"\n\nlemmas map_var_bit_to_var_acc_state_translators =\n map_var_bit_to_var_acc_imp_to_HOL_state_def\n map_var_bit_to_var_aux_imp_to_HOL_state_def\n\nlemmas map_var_bit_to_var_acc_complete_simps =\n map_var_bit_to_var_acc_IMP_subprogram_simps\n map_var_bit_to_var_acc_imp_subprogram_simps\n map_var_bit_to_var_acc_state_translators\n\nlemma map_var_bit_to_var_acc_IMP_Minus_correct_function:\n \"(invoke_subprogram p map_var_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p map_var_bit_to_var_acc_ret_str)\n = map_var_bit_to_var_acc_ret\n (map_var_bit_to_var_acc_imp (map_var_bit_to_var_acc_imp_to_HOL_state p s))\"\n apply(induction \"map_var_bit_to_var_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: map_var_bit_to_var_acc_imp.induct)\n apply(subst map_var_bit_to_var_acc_imp.simps)\n apply(simp only: map_var_bit_to_var_acc_IMP_Minus_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule While_tE)\n\n subgoal \n apply (simp only: map_var_bit_to_var_acc_IMP_subprogram_simps prefix_simps)\n apply (clarsimp simp: map_var_bit_to_var_acc_complete_simps) \n done \n\n apply(erule Seq_E)+\n apply(dest_com_gen)\n\n subgoal\n apply(simp only: map_var_bit_to_var_acc_IMP_init_while_cond_def prefix_simps)\n by(fastforce simp add: map_var_bit_to_var_acc_complete_simps)\n\n subgoal\n apply(subst (asm) map_var_bit_to_var_acc_IMP_init_while_cond_def)\n apply(simp only: map_var_bit_to_var_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_E)+\n apply(erule map_var_bit_to_var_aux_IMP_Minus_correct[where vars = \"map_var_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(12) by fastforce\n apply (force simp add: map_var_bit_to_var_acc_imp_subprogram_simps \n map_var_bit_to_var_acc_state_translators Let_def)\n done \n\n subgoal\n apply(simp only: map_var_bit_to_var_acc_IMP_init_while_cond_def prefix_simps\n map_var_bit_to_var_acc_IMP_loop_body_def)\n apply(erule Seq_E)+\n apply(erule map_var_bit_to_var_aux_IMP_Minus_correct[where vars = \"map_var_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(12) by fastforce\n apply (force simp add: map_var_bit_to_var_acc_imp_subprogram_simps \n map_var_bit_to_var_acc_state_translators Let_def split: if_splits)\n done \n done \n\nlemma map_var_bit_to_var_acc_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ map_var_bit_to_var_acc_pref) map_var_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix map_var_bit_to_var_acc_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\nlemmas map_var_bit_to_var_acc_complete_time_simps =\n map_var_bit_to_var_acc_imp_subprogram_time_simps\n map_var_bit_to_var_acc_imp_time_acc\n map_var_bit_to_var_acc_imp_time_acc_2\n map_var_bit_to_var_acc_imp_time_acc_3\n map_var_bit_to_var_acc_state_translators\n\nlemma map_var_bit_to_var_acc_IMP_Minus_correct_time:\n \"(invoke_subprogram p map_var_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = map_var_bit_to_var_acc_imp_time 0 (map_var_bit_to_var_acc_imp_to_HOL_state p s)\"\n apply(induction \"map_var_bit_to_var_acc_imp_to_HOL_state p s\" arbitrary: s s' t\n rule: map_var_bit_to_var_acc_imp.induct)\n apply(subst map_var_bit_to_var_acc_imp_time.simps)\n apply(simp only: map_var_bit_to_var_acc_IMP_Minus_def prefix_simps)\n\n apply(erule Seq_tE)+\n apply(erule While_tE_time)\n subgoal\n apply(simp only: map_var_bit_to_var_acc_IMP_subprogram_simps prefix_simps\n map_var_bit_to_var_acc_complete_time_simps Let_def split: if_splits) \n apply force\n done \n\n apply(erule Seq_tE)+\n apply(simp add: add.assoc)\n apply(dest_com_gen_time)\n\n subgoal\n apply(simp only: map_var_bit_to_var_acc_IMP_init_while_cond_def prefix_simps)\n by(fastforce simp add: map_var_bit_to_var_acc_complete_simps)\n\n subgoal\n apply(subst (asm) map_var_bit_to_var_acc_IMP_init_while_cond_def)\n apply(simp only: map_var_bit_to_var_acc_IMP_loop_body_def prefix_simps)\n apply(erule Seq_tE)+\n apply(erule map_var_bit_to_var_aux_IMP_Minus_correct[where vars = \"map_var_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n apply (force simp: map_var_bit_to_var_acc_imp_subprogram_time_simps\n map_var_bit_to_var_acc_state_translators Let_def)\n done \n\n subgoal\n apply(simp only: prefix_simps map_var_bit_to_var_acc_IMP_init_while_cond_def\n map_var_bit_to_var_acc_IMP_loop_body_def)\n apply(erule Seq_tE)+\n apply(erule map_var_bit_to_var_aux_IMP_Minus_correct[where vars = \"map_var_bit_to_var_acc_IMP_vars\"])\n subgoal premises p using p(21) by fastforce\n apply (clarsimp simp add: map_var_bit_to_var_acc_complete_time_simps Let_def)\n subgoal premises p \n using p(10) \n by (smt (z3) fun_upd_def list.inject list.simps(3) \n map_var_bit_to_var_acc_imp_time_acc_2_aux same_append_eq)\n done \n done \n\nlemma map_var_bit_to_var_acc_IMP_Minus_correct[functional_correctness]:\n \"\\(invoke_subprogram (p1 @ p2) map_var_bit_to_var_acc_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (map_var_bit_to_var_acc_imp_time 0 (map_var_bit_to_var_acc_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_var_bit_to_var_acc_ret_str) =\n map_var_bit_to_var_acc_ret (map_var_bit_to_var_acc_imp\n (map_var_bit_to_var_acc_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using map_var_bit_to_var_acc_IMP_Minus_correct_function\n by (auto simp: map_var_bit_to_var_acc_IMP_Minus_correct_time)\n (meson map_var_bit_to_var_acc_IMP_Minus_correct_effects set_mono_prefix) \n\nsubsubsection \\map_var_bit_to_var_tail\\\nrecord map_var_bit_to_var_tail_state =\nmap_var_bit_to_var_tail_v::nat\nmap_var_bit_to_var_tail_n::nat\nmap_var_bit_to_var_tail_ret::nat \n\nabbreviation \"map_var_bit_to_var_tail_prefix \\ ''map_var_bit_to_var_tail.''\"\nabbreviation \"map_var_bit_to_var_tail_v_str \\ ''v''\"\nabbreviation \"map_var_bit_to_var_tail_n_str \\ ''n''\"\nabbreviation \"map_var_bit_to_var_tail_ret_str \\ ''ret''\"\n\nfunction map_var_bit_to_var_tail_imp :: \n\"map_var_bit_to_var_tail_state \\ map_var_bit_to_var_tail_state\"where \n\"map_var_bit_to_var_tail_imp s =\n (let \n map_var_bit_to_var_acc_acc' = 0;\n map_var_bit_to_var_acc_v' = map_var_bit_to_var_tail_v s;\n map_var_bit_to_var_acc_n' = map_var_bit_to_var_tail_n s;\n map_var_bit_to_var_acc_ret' = 0;\n map_var_bit_to_var_acc_state = \n \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc',\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v',\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n',\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret'\\;\n map_var_bit_to_var_acc_ret_state = map_var_bit_to_var_acc_imp map_var_bit_to_var_acc_state;\n\n reverse_nat_n' = map_var_bit_to_var_acc_ret map_var_bit_to_var_acc_ret_state;\n reverse_nat_ret' = 0;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n map_var_bit_to_var_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n ret = \\map_var_bit_to_var_tail_v = map_var_bit_to_var_tail_v s,\n map_var_bit_to_var_tail_n = map_var_bit_to_var_tail_n s,\n map_var_bit_to_var_tail_ret = map_var_bit_to_var_tail_ret'\\\n in \n ret)\" by simp+\n termination \n apply (relation \"measure map_var_bit_to_var_tail_n\")\n apply auto \n done \n\ndeclare map_var_bit_to_var_tail_imp.simps[simp del]\n\nlemma map_var_bit_to_var_tail_imp_correct[let_function_correctness]:\n \"map_var_bit_to_var_tail_ret (map_var_bit_to_var_tail_imp s)\n = map_var_bit_to_var_tail (map_var_bit_to_var_tail_v s) (map_var_bit_to_var_tail_n s)\"\napply (subst map_var_bit_to_var_tail_imp.simps)\napply auto\nusing map_var_bit_to_var_tail_def reverse_nat_imp_correct \nmap_var_bit_to_var_acc_imp_correct map_var_bit_to_var_acc'_imp_correct\nby auto\n\nfunction map_var_bit_to_var_tail_imp_time :: \n\"nat \\ map_var_bit_to_var_tail_state \\ nat\"where \n\"map_var_bit_to_var_tail_imp_time t s =\n (let \n map_var_bit_to_var_acc_acc' = 0;\n t = t + 2;\n map_var_bit_to_var_acc_v' = map_var_bit_to_var_tail_v s;\n t = t + 2;\n map_var_bit_to_var_acc_n' = map_var_bit_to_var_tail_n s;\n t = t + 2;\n map_var_bit_to_var_acc_ret' = 0;\n t = t + 2;\n map_var_bit_to_var_acc_state = \n \\map_var_bit_to_var_acc_acc = map_var_bit_to_var_acc_acc',\n map_var_bit_to_var_acc_v = map_var_bit_to_var_acc_v',\n map_var_bit_to_var_acc_n = map_var_bit_to_var_acc_n',\n map_var_bit_to_var_acc_ret = map_var_bit_to_var_acc_ret'\\;\n map_var_bit_to_var_acc_ret_state = map_var_bit_to_var_acc_imp map_var_bit_to_var_acc_state;\n t = t + map_var_bit_to_var_acc_imp_time 0 map_var_bit_to_var_acc_state;\n\n reverse_nat_n' = map_var_bit_to_var_acc_ret map_var_bit_to_var_acc_ret_state;\n t = t + 2;\n reverse_nat_ret' = 0;\n t = t + 2;\n reverse_nat_state = \\reverse_nat_n = reverse_nat_n',\n reverse_nat_ret = reverse_nat_ret'\\;\n reverse_nat_ret_state = reverse_nat_imp reverse_nat_state;\n t = t + reverse_nat_imp_time 0 reverse_nat_state;\n \n map_var_bit_to_var_tail_ret' = reverse_nat_ret reverse_nat_ret_state;\n t = t + 2;\n ret = \\map_var_bit_to_var_tail_v = map_var_bit_to_var_tail_v s,\n map_var_bit_to_var_tail_n = map_var_bit_to_var_tail_n s,\n map_var_bit_to_var_tail_ret = map_var_bit_to_var_tail_ret'\\\n in \n t)\" by auto\n termination \n apply (relation \"measure (map_var_bit_to_var_tail_n \\ snd)\")\n apply auto \n done \n\ndeclare map_var_bit_to_var_tail_imp_time.simps[simp del]\n\ndefinition \"map_var_bit_to_var_tail_IMP_Minus \\ \n (map_var_bit_to_var_acc_prefix @ map_var_bit_to_var_acc_acc_str) ::= A (N 0);;\n (map_var_bit_to_var_acc_prefix @ map_var_bit_to_var_acc_v_str) ::= A (V map_var_bit_to_var_tail_v_str);;\n (map_var_bit_to_var_acc_prefix @ map_var_bit_to_var_acc_n_str) ::= A (V map_var_bit_to_var_tail_n_str);;\n (map_var_bit_to_var_acc_prefix @ map_var_bit_to_var_acc_ret_str) ::= A (N 0);;\n invoke_subprogram map_var_bit_to_var_acc_prefix map_var_bit_to_var_acc_IMP_Minus;;\n\n (reverse_nat_prefix @ reverse_nat_n_str) ::= A (V (map_var_bit_to_var_acc_prefix @ map_var_bit_to_var_acc_ret_str));;\n (reverse_nat_prefix @ reverse_nat_ret_str) ::= A (N 0);;\n invoke_subprogram reverse_nat_prefix reverse_nat_IMP_Minus;;\n\n map_var_bit_to_var_tail_ret_str ::= A (V (reverse_nat_prefix @ reverse_nat_ret_str))\n\"\n\nabbreviation \"map_var_bit_to_var_tail_IMP_vars \\ \n {map_var_bit_to_var_tail_ret_str, map_var_bit_to_var_tail_n_str, map_var_bit_to_var_tail_v_str}\"\n\ndefinition \"map_var_bit_to_var_tail_imp_to_HOL_state p s = \n\\ map_var_bit_to_var_tail_v = (s (add_prefix p map_var_bit_to_var_tail_v_str)),\n map_var_bit_to_var_tail_n = (s (add_prefix p map_var_bit_to_var_tail_n_str)),\n map_var_bit_to_var_tail_ret = (s (add_prefix p map_var_bit_to_var_tail_ret_str))\\\"\n\nlemmas map_var_bit_to_var_tail_state_translators = \n map_var_bit_to_var_tail_imp_to_HOL_state_def\n map_var_bit_to_var_acc_imp_to_HOL_state_def\n reverse_nat_imp_to_HOL_state_def\n\nlemma map_var_bit_to_var_tail_IMP_Minus_correct_function:\n\"(invoke_subprogram p map_var_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p map_var_bit_to_var_tail_ret_str)\n = map_var_bit_to_var_tail_ret\n (map_var_bit_to_var_tail_imp (map_var_bit_to_var_tail_imp_to_HOL_state p s))\"\napply (simp only: map_var_bit_to_var_tail_IMP_Minus_def prefix_simps)\napply (erule Seq_E)+\napply (erule map_var_bit_to_var_acc_IMP_Minus_correct[where vars=map_var_bit_to_var_tail_IMP_vars])\nsubgoal premises p using p(9) by fastforce\napply (erule reverse_nat_IMP_Minus_correct[where vars=map_var_bit_to_var_tail_IMP_vars])\nsubgoal premises p using p(11) by fastforce\napply (clarsimp simp add: map_var_bit_to_var_tail_state_translators Let_def\n map_var_bit_to_var_tail_imp.simps)\ndone \n\nlemma map_var_bit_to_var_tail_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ map_var_bit_to_var_tail_pref) map_var_bit_to_var_aux_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix map_var_bit_to_var_tail_pref v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def\n by blast \n\n\nlemma map_var_bit_to_var_tail_IMP_Minus_correct_time:\n \"(invoke_subprogram p map_var_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = map_var_bit_to_var_tail_imp_time 0 (map_var_bit_to_var_tail_imp_to_HOL_state p s)\"\napply (simp only: map_var_bit_to_var_tail_IMP_Minus_def prefix_simps)\napply (erule Seq_tE)+\napply (erule map_var_bit_to_var_acc_IMP_Minus_correct[where vars=map_var_bit_to_var_tail_IMP_vars])\nsubgoal premises p using p(17) by fastforce\napply (erule reverse_nat_IMP_Minus_correct[where vars=map_var_bit_to_var_aux_IMP_vars])\nsubgoal premises p using p(19) by fastforce\napply (force simp: map_var_bit_to_var_tail_imp_time.simps \n Let_def map_var_bit_to_var_tail_state_translators)\ndone \n\nlemma map_var_bit_to_var_tail_IMP_Minus_correct[functional_correctness]:\n \"\\(invoke_subprogram (p1 @ p2) map_var_bit_to_var_tail_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (map_var_bit_to_var_tail_imp_time 0 (map_var_bit_to_var_tail_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) map_var_bit_to_var_tail_ret_str) =\n map_var_bit_to_var_tail_ret (map_var_bit_to_var_tail_imp\n (map_var_bit_to_var_tail_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using map_var_bit_to_var_tail_IMP_Minus_correct_function \n map_var_bit_to_var_tail_IMP_Minus_correct_time\n by (meson com_add_prefix_valid_subset com_only_vars)\n\nsubsection \\push_on_stack\\\nsubsubsection \\push_on_stack_nat\\\nrecord push_on_stack_nat_state =\npush_on_stack_nat_c :: nat\npush_on_stack_nat_n :: nat\npush_on_stack_nat_s :: nat\npush_on_stack_nat_ret :: nat\n\nabbreviation \"push_on_stack_nat_prefix \\ ''push_on_stack_nat.''\"\nabbreviation \"push_on_stack_nat_c_str \\ ''push_on_stack_nat_c''\"\nabbreviation \"push_on_stack_nat_n_str \\ ''push_on_stack_nat_n''\"\nabbreviation \"push_on_stack_nat_s_str \\ ''push_on_stack_nat_s''\"\nabbreviation \"push_on_stack_nat_ret_str \\ ''push_on_stack_nat_ret''\"\n\ndefinition \"push_on_stack_nat_imp_to_HOL_state p s \\\n \\push_on_stack_nat_c = s (add_prefix p push_on_stack_nat_c_str),\n push_on_stack_nat_n = s (add_prefix p push_on_stack_nat_n_str),\n push_on_stack_nat_s = s (add_prefix p push_on_stack_nat_s_str),\n push_on_stack_nat_ret = s (add_prefix p push_on_stack_nat_ret_str)\\\"\n\nabbreviation \"push_on_stack_nat_hd_c \\ ''push_on_stack_nat_hd_c''\"\nabbreviation \"push_on_stack_nat_cons_n_0 \\ ''push_on_stack_nat_cons_n_0''\"\nabbreviation \"push_on_stack_nat_nth_nat_ret_one \\ ''push_on_stack_nat_nth_nat_ret_one''\"\nabbreviation \"push_on_stack_nat_nth_nat_ret_two \\ ''push_on_stack_nat_nth_nat_ret_two''\"\nabbreviation \"push_on_stack_nat_nth_nat_ret_three \\ ''push_on_stack_nat_nth_nat_ret_three''\"\nabbreviation \"push_on_stack_nat_cons_res \\ ''push_on_stack_nat_cons_res''\"\nabbreviation \"push_on_stack_nat_cond_one \\ ''push_on_stack_nat_cond_one''\"\nabbreviation \"push_on_stack_nat_cond_two \\ ''push_on_stack_nat_cond_two''\"\nabbreviation \"push_on_stack_nat_cond_three \\ ''push_on_stack_nat_cond_three''\"\n\nabbreviation \"push_on_stack_nat_IMP_vars \\ {\n push_on_stack_nat_c_str, push_on_stack_nat_n_str, push_on_stack_nat_s_str, push_on_stack_nat_ret_str \n}\"\n\n\nlemmas push_on_stack_nat_state_translators =\n push_on_stack_nat_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def\n cons_imp_to_HOL_state_def\n NOTEQUAL_neq_zero_imp_to_HOL_state_def\n nth_nat_imp_to_HOL_state_def\n\nparagraph if_eq_zero \n\ndefinition \"push_on_stack_nat_eq_zero s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n cons_h' = 1;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n cons_h' = cons_ret cons_ret_state;\n cons_t' = push_on_stack_nat_s s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n ret)\"\n\nlemma push_on_stack_nat_eq_zero_imp_correct[let_function_correctness]:\n \"push_on_stack_nat_ret (push_on_stack_nat_eq_zero s) = \n cons (cons 1 (cons (push_on_stack_nat_n s) 0)) (push_on_stack_nat_s s)\"\n unfolding push_on_stack_nat_eq_zero_def\n apply (simp add: hd_imp_correct cons_imp_correct Let_def)\n done \n\ndefinition \"push_on_stack_nat_eq_zero_time t s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = 1;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_s s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n t = t + 2;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n t)\"\n\ndefinition \"push_on_stack_nat_eq_zero_IMP_Minus \\ \n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_n_str);;\n (cons_prefix @ cons_t_str) ::= A (N 0);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (N 1);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_s_str);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_ret_str ::= A (V (cons_prefix @ cons_ret_str))\n\"\n\nlemma push_on_stack_nat_eq_zero_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_eq_zero_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_eq_zero (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_eq_zero_def)\n apply (simp only: push_on_stack_nat_eq_zero_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(13) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(15) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(17) by fastforce \n apply (force simp: \n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def Let_def)\n done \n\nlemma push_on_stack_nat_eq_zero_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_eq_zero_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_eq_zero_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_eq_zero_time_def)\n apply (simp only: push_on_stack_nat_eq_zero_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(25) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(27) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(29) by fastforce \n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def Let_def\\)\n done\n\nparagraph if_eq_one\n\ndefinition \"push_on_stack_nat_eq_one s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n\n nth_nat_n' = 1;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n\n nth_nat_n' = 2;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n cons_t' = push_on_stack_nat_cons_res;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = 2;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n cons_t' = push_on_stack_nat_s s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n ret)\"\n\nlemma push_on_stack_nat_eq_one_imp_correct[let_function_correctness]:\n \"push_on_stack_nat_ret (push_on_stack_nat_eq_one s) = \n (2## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\"\n unfolding push_on_stack_nat_eq_one_def\n apply (simp add: nth_nat_imp_correct cons_imp_correct Let_def numeral_2_eq_2)\n done\n\ndefinition \"push_on_stack_nat_eq_one_time t s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n t = t + 2;\n\n nth_nat_n' = 1;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n\n nth_nat_n' = 2;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_cons_res;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = 2;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_s s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n t = t + 2;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n t)\"\n\ndefinition \"push_on_stack_nat_eq_one_IMP_Minus \\\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_n_str);;\n (cons_prefix @ cons_t_str) ::= A (N 0);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_cons_res ::= A (V (cons_prefix @ cons_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 1);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n push_on_stack_nat_nth_nat_ret_one ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 2);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_cons_res);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_nth_nat_ret_one);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (N 2);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_s_str);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_ret_str ::= A (V (cons_prefix @ cons_ret_str))\n\"\n\nabbreviation \"push_on_stack_nat_IMP_vars_eq_one \\ push_on_stack_nat_IMP_vars \n \\ {push_on_stack_nat_nth_nat_ret_one, push_on_stack_nat_cons_res}\"\n\nlemma push_on_stack_nat_eq_one_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_eq_one_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_eq_one (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_eq_one_def)\n apply (simp only: push_on_stack_nat_eq_one_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(31) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(33) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(35) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(37) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(39) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(41) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(43) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\n\nlemma push_on_stack_nat_eq_one_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_eq_one_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_eq_one_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_eq_one_time_def)\n apply (simp only: push_on_stack_nat_eq_one_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(61) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(63) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(65) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(67) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(69) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(71) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_one])\n subgoal premises p using p(73) by fastforce\n apply (timeit \\force simp: \n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\nparagraph if_eq_two\n\ndefinition \"push_on_stack_nat_eq_two s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n\n nth_nat_n' = 1;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n\n nth_nat_n' = 2;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n cons_t' = push_on_stack_nat_cons_res;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = 3;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n cons_t' = push_on_stack_nat_s s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n ret)\"\n\nlemma push_on_stack_nat_eq_two_imp_correct[let_function_correctness]:\n \"push_on_stack_nat_ret (push_on_stack_nat_eq_two s) = \n (3## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\"\n unfolding push_on_stack_nat_eq_two_def\n apply (simp add: nth_nat_imp_correct cons_imp_correct Let_def numeral_2_eq_2)\n done\n\ndefinition \"push_on_stack_nat_eq_two_time t s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n t = t + 2;\n\n nth_nat_n' = 1;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n\n nth_nat_n' = 2;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_cons_res;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = 3;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_s s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n t = t + 2;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n t)\"\n\ndefinition \"push_on_stack_nat_eq_two_IMP_Minus \\\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_n_str);;\n (cons_prefix @ cons_t_str) ::= A (N 0);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_cons_res ::= A (V (cons_prefix @ cons_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 1);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n push_on_stack_nat_nth_nat_ret_one ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 2);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_cons_res);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_nth_nat_ret_one);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (N 3);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_s_str);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_ret_str ::= A (V (cons_prefix @ cons_ret_str))\n\"\n\nabbreviation \"push_on_stack_nat_IMP_vars_eq_two \\ push_on_stack_nat_IMP_vars \n \\ {push_on_stack_nat_nth_nat_ret_one, push_on_stack_nat_cons_res}\"\n\nlemma push_on_stack_nat_eq_two_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_eq_two_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_eq_two (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_eq_two_def)\n apply (simp only: push_on_stack_nat_eq_two_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(31) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(33) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(35) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(37) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(39) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(41) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(43) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\nlemma push_on_stack_nat_eq_two_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_eq_two_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_eq_two_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_eq_two_time_def)\n apply (simp only: push_on_stack_nat_eq_two_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(61) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(63) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(65) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(67) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(69) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(71) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_two])\n subgoal premises p using p(73) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\nparagraph if_else\n\ndefinition \"push_on_stack_nat_else s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n\n nth_nat_n' = 1;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n\n nth_nat_n' = 2;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n cons_t' = push_on_stack_nat_cons_res;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = 9;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n cons_t' = push_on_stack_nat_s s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n ret)\"\n\nlemma push_on_stack_nat_else_imp_correct[let_function_correctness]:\n \"push_on_stack_nat_ret (push_on_stack_nat_else s) = \n (9## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\"\n unfolding push_on_stack_nat_else_def\n apply (simp add: nth_nat_imp_correct cons_imp_correct Let_def numeral_2_eq_2)\n done\n\ndefinition \"push_on_stack_nat_else_time t s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n t = t + 2;\n\n nth_nat_n' = 1;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n\n nth_nat_n' = 2;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_cons_res;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = 9;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_s s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n t = t + 2;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n t)\"\n\ndefinition \"push_on_stack_nat_else_IMP_Minus \\\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_n_str);;\n (cons_prefix @ cons_t_str) ::= A (N 0);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_cons_res ::= A (V (cons_prefix @ cons_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 1);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n push_on_stack_nat_nth_nat_ret_one ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 2);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_cons_res);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_nth_nat_ret_one);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (N 9);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_s_str);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_ret_str ::= A (V (cons_prefix @ cons_ret_str))\n\"\n\nabbreviation \"push_on_stack_nat_IMP_vars_else \\ push_on_stack_nat_IMP_vars \n \\ {push_on_stack_nat_nth_nat_ret_one, push_on_stack_nat_cons_res}\"\n\nlemma push_on_stack_nat_else_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_else_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_else (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_else_def)\n apply (simp only: push_on_stack_nat_else_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(31) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(33) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(35) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(37) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(39) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(41) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(43) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\n\nlemma push_on_stack_nat_else_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_else_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_else_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_else_time_def)\n apply (simp only: push_on_stack_nat_else_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(61) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(63) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(65) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(67) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(69) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(71) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_else])\n subgoal premises p using p(73) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done\n\nparagraph if_eq_three\n\ndefinition \"push_on_stack_nat_eq_three s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n cons_t' = 0;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n\n nth_nat_n' = 1;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n\n nth_nat_n' = 2;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n push_on_stack_nat_nth_nat_ret_two = nth_nat_ret nth_nat_ret_state;\n \n nth_nat_n' = 3;\n nth_nat_x' = push_on_stack_nat_c s;\n nth_nat_ret' = 0;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n cons_t' = push_on_stack_nat_cons_res;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_two;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = 6;\n cons_t' = cons_ret cons_ret_state;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n cons_t' = push_on_stack_nat_s s;\n cons_ret' = 0;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n ret)\"\n\nlemma push_on_stack_nat_eq_three_imp_correct[let_function_correctness]:\n \"push_on_stack_nat_ret (push_on_stack_nat_eq_three s) = \n (6## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (nth_nat (Suc (Suc (Suc 0))) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\"\n unfolding push_on_stack_nat_eq_three_def\n apply (simp add: nth_nat_imp_correct cons_imp_correct Let_def numeral_2_eq_2 numeral_3_eq_3)\n done\n\ndefinition \"push_on_stack_nat_eq_three_time t s \\ \n (let\n cons_h' = push_on_stack_nat_n s;\n t = t + 2;\n cons_t' = 0;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n push_on_stack_nat_cons_res = cons_ret cons_ret_state;\n t = t + 2;\n\n nth_nat_n' = 1;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n push_on_stack_nat_nth_nat_ret_one = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n\n nth_nat_n' = 2;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n push_on_stack_nat_nth_nat_ret_two = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n \n nth_nat_n' = 3;\n t = t + 2;\n nth_nat_x' = push_on_stack_nat_c s;\n t = t + 2;\n nth_nat_ret' = 0;\n t = t + 2;\n nth_nat_state = \\nth_nat_n = nth_nat_n', nth_nat_x = nth_nat_x', nth_nat_ret = nth_nat_ret'\\;\n nth_nat_ret_state = nth_nat_imp nth_nat_state;\n t = t + nth_nat_imp_time 0 nth_nat_state;\n\n cons_h' = nth_nat_ret nth_nat_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_cons_res;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_two;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = push_on_stack_nat_nth_nat_ret_one;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = 6;\n t = t + 2;\n cons_t' = cons_ret cons_ret_state;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n cons_h' = cons_ret cons_ret_state;\n t = t + 2;\n cons_t' = push_on_stack_nat_s s;\n t = t + 2;\n cons_ret' = 0;\n t = t + 2;\n cons_state = \\cons_h = cons_h', cons_t = cons_t', cons_ret = cons_ret'\\;\n cons_ret_state = cons_imp cons_state;\n t = t + cons_imp_time 0 cons_state;\n\n push_on_stack_nat_ret' = cons_ret cons_ret_state;\n t = t + 2;\n ret = \\push_on_stack_nat_c = push_on_stack_nat_c s,\n push_on_stack_nat_n = push_on_stack_nat_n s,\n push_on_stack_nat_s = push_on_stack_nat_s s,\n push_on_stack_nat_ret = push_on_stack_nat_ret'\\\nin\n t)\"\n\ndefinition \"push_on_stack_nat_eq_three_IMP_Minus \\\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_n_str);;\n (cons_prefix @ cons_t_str) ::= A (N 0);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_cons_res ::= A (V (cons_prefix @ cons_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 1);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n push_on_stack_nat_nth_nat_ret_one ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 2);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n push_on_stack_nat_nth_nat_ret_two ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n\n (nth_nat_prefix @ nth_nat_n_str) ::= A (N 3);;\n (nth_nat_prefix @ nth_nat_x_str) ::= A (V push_on_stack_nat_c_str);;\n (nth_nat_prefix @ nth_nat_ret_str) ::= A (N 0);;\n invoke_subprogram nth_nat_prefix nth_nat_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (nth_nat_prefix @ nth_nat_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_cons_res);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_nth_nat_ret_two);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V push_on_stack_nat_nth_nat_ret_one);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (N 6);;\n (cons_prefix @ cons_t_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n\n (cons_prefix @ cons_h_str) ::= A (V (cons_prefix @ cons_ret_str));;\n (cons_prefix @ cons_t_str) ::= A (V push_on_stack_nat_s_str);;\n (cons_prefix @ cons_ret_str) ::= A (N 0);;\n invoke_subprogram cons_prefix cons_IMP_Minus;;\n push_on_stack_nat_ret_str ::= A (V (cons_prefix @ cons_ret_str))\n\"\n\nabbreviation \"push_on_stack_nat_IMP_vars_eq_three \\ push_on_stack_nat_IMP_vars \n \\ {push_on_stack_nat_nth_nat_ret_one, push_on_stack_nat_nth_nat_ret_two, \n push_on_stack_nat_cons_res}\"\n\nlemma push_on_stack_nat_eq_three_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_eq_three_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_eq_three (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_eq_three_def)\n apply (simp only: push_on_stack_nat_eq_three_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(40) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(42) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(44) by fastforce\n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(46) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(48) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(50) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(52) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(54) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(56) by fastforce\n apply (timeit \\force simp:\n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def\\)\n done \n\n\nlemma push_on_stack_nat_eq_three_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_eq_three_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_eq_three_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_eq_three_time_def)\n apply (simp only: push_on_stack_nat_eq_three_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(79) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(81) by fastforce \n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(83) by fastforce\n apply (erule nth_nat_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(85) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(87) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(89) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(91) by fastforce \n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(93) by fastforce\n apply (erule cons_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars_eq_three])\n subgoal premises p using p(95) by fastforce\n apply (force simp: \n push_on_stack_nat_imp_to_HOL_state_def cons_imp_to_HOL_state_def \n nth_nat_imp_to_HOL_state_def Let_def)\n done\n\nparagraph separations_of_nested_ifs\n\ndefinition \"push_on_stack_nat_sub_branch_aux1 s \\ \n (let\n hd_xs' = push_on_stack_nat_c s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n NOTEQUAL_neq_zero_b' = 2;\n NOTEQUAL_neq_zero_ret' = 0;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_three = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state)\n in \n (if push_on_stack_nat_cond_three \\ 0\n then push_on_stack_nat_else s\n else push_on_stack_nat_eq_two s))\"\n\nlemma push_on_stack_nat_sub_branch_aux1_imp_correct:\n \"push_on_stack_nat_ret (push_on_stack_nat_sub_branch_aux1 s) = \n (if (hd_nat (push_on_stack_nat_c s)) \\2\n then (9## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\n else (3## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s))\"\n apply (subst push_on_stack_nat_sub_branch_aux1_def)\n apply (simp add: NOTEQUAL_neq_zero_imp_correct hd_imp_correct\n push_on_stack_nat_eq_one_imp_correct push_on_stack_nat_eq_two_imp_correct\n push_on_stack_nat_else_imp_correct\n Let_def)\n done\n\ndefinition \"push_on_stack_nat_sub_branch_aux1_IMP_Minus \\\n (hd_prefix @ hd_xs_str) ::= A (V push_on_stack_nat_c_str);;\n (hd_prefix @ hd_ret_str) ::= A (N 0);;\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n push_on_stack_nat_hd_c ::= A (V (hd_prefix @ hd_ret_str));;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_a_str) ::= A (V push_on_stack_nat_hd_c);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_b_str) ::= A (N 2);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str) ::= A (N 0);;\n invoke_subprogram NOTEQUAL_neq_zero_prefix NOTEQUAL_neq_zero_IMP_Minus;;\n push_on_stack_nat_cond_three ::= A (V (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str));;\n (IF push_on_stack_nat_cond_three \\0\n THEN push_on_stack_nat_else_IMP_Minus\n ELSE push_on_stack_nat_eq_two_IMP_Minus)\n \"\ndefinition \"push_on_stack_nat_sub_branch_aux1_time t s \\ \n (let\n hd_xs' = push_on_stack_nat_c s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n t = t + 2;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n t = t + 2;\n NOTEQUAL_neq_zero_b' = 2;\n t = t + 2;\n NOTEQUAL_neq_zero_ret' = 0;\n t = t + 2;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n t = t + NOTEQUAL_neq_zero_imp_time 0 NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_three = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state);\n t = t + 2\n in (if push_on_stack_nat_cond_three \\ 0\n then \n let\n t = t + 1;\n t = t + push_on_stack_nat_else_time 0 s\n in\n t\n else \n let\n t = t + 1;\n t = t + push_on_stack_nat_eq_two_time 0 s\n in\n t))\"\n\nlemma push_on_stack_nat_sub_branch_aux1_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_sub_branch_aux1 (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_sub_branch_aux1_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux1_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(10) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(12) by fastforce\n apply (erule If_E)\n subgoal\n apply (force dest!: push_on_stack_nat_else_IMP_Minus_correct_function \n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done \n subgoal\n apply (force dest!: push_on_stack_nat_eq_two_IMP_Minus_correct_function \n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done\n done\n\nlemma push_on_stack_nat_sub_branch_aux1_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux1_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_sub_branch_aux1_time 0 \n (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_sub_branch_aux1_time_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux1_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(19) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(21) by fastforce\n apply (erule If_tE)\n subgoal\n apply (force dest!: push_on_stack_nat_else_IMP_Minus_correct_time\n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done \n subgoal\n apply (force dest!: push_on_stack_nat_eq_two_IMP_Minus_correct_time \n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done\n done\n\n definition \"push_on_stack_nat_sub_branch_aux2 s \\ \n (let\n hd_xs' = push_on_stack_nat_c s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n NOTEQUAL_neq_zero_b' = 1;\n NOTEQUAL_neq_zero_ret' = 0;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_two = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state)\n in (if push_on_stack_nat_cond_two \\ 0\n then push_on_stack_nat_sub_branch_aux1 s\n else push_on_stack_nat_eq_one s))\"\n\n\nlemma push_on_stack_nat_sub_branch_aux2_imp_correct:\n \"push_on_stack_nat_ret (push_on_stack_nat_sub_branch_aux2 s) = \n (if (hd_nat (push_on_stack_nat_c s)) \\1\n then (if (hd_nat (push_on_stack_nat_c s)) \\2\n then (9## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\n else (3## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s))\n else (2## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s))\"\n apply (subst push_on_stack_nat_sub_branch_aux2_def)\n apply (simp add: NOTEQUAL_neq_zero_imp_correct hd_imp_correct\n push_on_stack_nat_eq_one_imp_correct push_on_stack_nat_eq_two_imp_correct\n push_on_stack_nat_else_imp_correct push_on_stack_nat_sub_branch_aux1_imp_correct\n Let_def)\n done\n\ndefinition \"push_on_stack_nat_sub_branch_aux2_IMP_Minus \\\n (hd_prefix @ hd_xs_str) ::= A (V push_on_stack_nat_c_str);;\n (hd_prefix @ hd_ret_str) ::= A (N 0);;\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n push_on_stack_nat_hd_c ::= A (V (hd_prefix @ hd_ret_str));;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_a_str) ::= A (V push_on_stack_nat_hd_c);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_b_str) ::= A (N 1);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str) ::= A (N 0);;\n invoke_subprogram NOTEQUAL_neq_zero_prefix NOTEQUAL_neq_zero_IMP_Minus;;\n push_on_stack_nat_cond_two ::= A (V (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str));;\n (IF push_on_stack_nat_cond_two \\0\n THEN push_on_stack_nat_sub_branch_aux1_IMP_Minus\n ELSE push_on_stack_nat_eq_one_IMP_Minus)\"\n\n\nlemma push_on_stack_nat_sub_branch_aux2_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_sub_branch_aux2 (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_sub_branch_aux2_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux2_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(10) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(12) by fastforce\n apply (erule If_E)\n subgoal \n apply (force dest!: push_on_stack_nat_sub_branch_aux1_IMP_Minus_correct_function \n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done \n subgoal \n apply (force dest!: push_on_stack_nat_eq_one_IMP_Minus_correct_function \n simp: push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def\n hd_imp_to_HOL_state_def Let_def)\n done\n done\n\ndefinition \"push_on_stack_nat_sub_branch_aux2_time t s \\ \n (let\n hd_xs' = push_on_stack_nat_c s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n t = t + 2;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n t = t + 2;\n NOTEQUAL_neq_zero_b' = 1;\n t = t + 2;\n NOTEQUAL_neq_zero_ret' = 0;\n t = t + 2;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n t = t + NOTEQUAL_neq_zero_imp_time 0 NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_two = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state);\n t = t + 2\n in (if push_on_stack_nat_cond_two \\ 0\n then \n (let \n t = t + 1;\n t = t + push_on_stack_nat_sub_branch_aux1_time 0 s\n in \n t)\n else \n let \n t = t + 1;\n t = t + push_on_stack_nat_eq_one_time 0 s\n in\n t))\"\n\nlemma push_on_stack_nat_sub_branch_aux2_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux2_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_sub_branch_aux2_time 0 \n (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_sub_branch_aux2_time_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux2_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(19) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(21) by fastforce\n apply (erule If_tE)\n subgoal \n apply (force dest!: push_on_stack_nat_sub_branch_aux1_IMP_Minus_correct_time simp:\n push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def Let_def\n hd_imp_to_HOL_state_def)\n done\n subgoal \n apply (force dest!: push_on_stack_nat_eq_one_IMP_Minus_correct_time simp:\n push_on_stack_nat_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def Let_def\n hd_imp_to_HOL_state_def)\n done\n done\n\ndefinition \"push_on_stack_nat_sub_branch_aux3 s \\ \n(let\n hd_xs' = push_on_stack_nat_c s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n NOTEQUAL_neq_zero_b' = 3;\n NOTEQUAL_neq_zero_ret' = 0;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_one = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state)\n in\n (if push_on_stack_nat_cond_one \\ 0\n then (push_on_stack_nat_sub_branch_aux2 s)\n else push_on_stack_nat_eq_three s))\"\n\nlemma push_on_stack_nat_sub_branch_aux3_imp_correct:\n \"push_on_stack_nat_ret (push_on_stack_nat_sub_branch_aux3 s) =\n (if (hd_nat (push_on_stack_nat_c s)) \\3 \n then (if (hd_nat (push_on_stack_nat_c s)) \\1\n then (if (hd_nat (push_on_stack_nat_c s)) \\2\n then (9## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s)\n else (3## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s))\n else (2## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0)) (push_on_stack_nat_c s)) ##\n (push_on_stack_nat_n s) ## 0)## (push_on_stack_nat_s s))\n else (6## (nth_nat (Suc 0) (push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc 0))(push_on_stack_nat_c s)) ## \n (nth_nat (Suc (Suc (Suc 0))) (push_on_stack_nat_c s)) \n ## (push_on_stack_nat_n s) ## 0) ## (push_on_stack_nat_s s)\n )\"\n apply (subst push_on_stack_nat_sub_branch_aux3_def)\n apply (simp add: NOTEQUAL_neq_zero_imp_correct hd_imp_correct\n push_on_stack_nat_eq_three_imp_correct push_on_stack_nat_sub_branch_aux2_imp_correct\n Let_def)\n done\n\ndefinition \"push_on_stack_nat_sub_branch_aux3_IMP_Minus \\ \n (hd_prefix @ hd_xs_str) ::= A (V push_on_stack_nat_c_str);;\n (hd_prefix @ hd_ret_str) ::= A (N 0);;\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n push_on_stack_nat_hd_c ::= A (V (hd_prefix @ hd_ret_str));;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_a_str) ::= A (V push_on_stack_nat_hd_c);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_b_str) ::= A (N 3);;\n (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str) ::= A (N 0);;\n invoke_subprogram NOTEQUAL_neq_zero_prefix NOTEQUAL_neq_zero_IMP_Minus;;\n push_on_stack_nat_cond_one ::= A (V (NOTEQUAL_neq_zero_prefix @ NOTEQUAL_neq_zero_ret_str));;\n (IF push_on_stack_nat_cond_one \\0\n THEN push_on_stack_nat_sub_branch_aux2_IMP_Minus\n ELSE push_on_stack_nat_eq_three_IMP_Minus)\"\n\ndefinition \"push_on_stack_nat_sub_branch_aux3_time t s \\ \n(let\n hd_xs' = push_on_stack_nat_c s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n t = t + 2;\n NOTEQUAL_neq_zero_a' = push_on_stack_nat_hd_c;\n t = t + 2;\n NOTEQUAL_neq_zero_b' = 3;\n t = t + 2;\n NOTEQUAL_neq_zero_ret' = 0;\n t = t + 2;\n NOTEQUAL_neq_zero_state = \\NOTEQUAL_neq_zero_a = NOTEQUAL_neq_zero_a',\n NOTEQUAL_neq_zero_b = NOTEQUAL_neq_zero_b',\n NOTEQUAL_neq_zero_ret = NOTEQUAL_neq_zero_ret'\\;\n NOTEQUAL_neq_zero_ret_state = NOTEQUAL_neq_zero_imp NOTEQUAL_neq_zero_state;\n t = t + NOTEQUAL_neq_zero_imp_time 0 NOTEQUAL_neq_zero_state;\n push_on_stack_nat_cond_one = (NOTEQUAL_neq_zero_ret NOTEQUAL_neq_zero_ret_state);\n t = t + 2\n in\n (if push_on_stack_nat_cond_one \\ 0\n then \n let \n t = t + 1;\n t = t + push_on_stack_nat_sub_branch_aux2_time 0 s\n in t\n else \n let \n t = t + 1;\n t = t + push_on_stack_nat_eq_three_time 0 s\n in t))\"\n\nlemma push_on_stack_nat_sub_branch_aux3_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux3_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_sub_branch_aux3 (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_sub_branch_aux3_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux3_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(10) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(12) by fastforce\n apply (erule If_E)\n subgoal \n apply (force dest!:push_on_stack_nat_sub_branch_aux2_IMP_Minus_correct_function simp: \n Let_def hd_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done\n subgoal \n apply (force dest!:push_on_stack_nat_eq_three_IMP_Minus_correct_function simp: \n Let_def hd_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n done \n\nlemma push_on_stack_nat_sub_branch_aux3_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_sub_branch_aux3_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_sub_branch_aux3_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_sub_branch_aux3_time_def)\n apply (simp only: push_on_stack_nat_sub_branch_aux3_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(19) by fastforce\n apply (erule NOTEQUAL_neq_zero_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(21) by fastforce\n apply (erule If_tE)\n subgoal \n apply (force dest!:push_on_stack_nat_sub_branch_aux2_IMP_Minus_correct_time simp: \n Let_def hd_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done\n subgoal \n apply (force dest!:push_on_stack_nat_eq_three_IMP_Minus_correct_time simp: \n Let_def hd_imp_to_HOL_state_def NOTEQUAL_neq_zero_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n done \n\ndefinition \"push_on_stack_nat_state_upd s \\ \n (let\n hd_xs' = push_on_stack_nat_c s;\n hd_ret' = 0;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state\n in\n (if push_on_stack_nat_hd_c \\ 0\n then push_on_stack_nat_sub_branch_aux3 s\n else push_on_stack_nat_eq_zero s)\n )\"\n\nfunction push_on_stack_nat_imp::\n \"push_on_stack_nat_state \\ push_on_stack_nat_state\" where\n \"push_on_stack_nat_imp s =\n (let \n ret = push_on_stack_nat_state_upd s\n in \n ret)\"\n by simp+\ntermination\n by (relation \"measure (\\s. push_on_stack_nat_c s)\") simp\n\ndeclare push_on_stack_nat_imp.simps[simp del]\n\nlemma push_on_stack_nat_imp_correct:\n \"push_on_stack_nat_ret (push_on_stack_nat_imp s) =\n push_on_stack_nat (push_on_stack_nat_c s) (push_on_stack_nat_n s) (push_on_stack_nat_s s)\"\n apply (subst push_on_stack_nat_imp.simps)\n apply (subst push_on_stack_nat_def)\n apply (simp add: push_on_stack_nat_state_upd_def hd_imp_correct cons_imp_correct \n NOTEQUAL_neq_zero_imp_correct \n push_on_stack_nat_eq_zero_imp_correct\n push_on_stack_nat_sub_branch_aux3_imp_correct \n Let_def split: if_splits) \n done\n\ndefinition \"push_on_stack_nat_IMP_Minus \\ \n (hd_prefix @ hd_xs_str) ::= A (V push_on_stack_nat_c_str);;\n (hd_prefix @ hd_ret_str) ::= A (N 0);;\n invoke_subprogram hd_prefix hd_IMP_Minus;;\n push_on_stack_nat_hd_c ::= A (V (hd_prefix @ hd_ret_str));;\n IF push_on_stack_nat_hd_c \\0\n THEN push_on_stack_nat_sub_branch_aux3_IMP_Minus\n ELSE push_on_stack_nat_eq_zero_IMP_Minus\"\n\ndefinition \"push_on_stack_nat_state_upd_time t s\\ \n(let\n hd_xs' = push_on_stack_nat_c s;\n t = t + 2;\n hd_ret' = 0;\n t = t + 2;\n hd_state = \\hd_xs = hd_xs', hd_ret = hd_ret'\\;\n hd_ret_state = hd_imp hd_state;\n t = t + hd_imp_time 0 hd_state;\n push_on_stack_nat_hd_c = hd_ret hd_ret_state;\n t = t + 2\n in\n (if push_on_stack_nat_hd_c \\ 0\n then \n let \n t = t + 1;\n t = t + push_on_stack_nat_sub_branch_aux3_time 0 s\n in \n t \n else \n let \n t = t + 1;\n t = t + push_on_stack_nat_eq_zero_time 0 s\n in\n t)\n )\"\n\nfunction push_on_stack_nat_imp_time :: \"nat \\ push_on_stack_nat_state \\ nat\" where\n \"push_on_stack_nat_imp_time t s =\n (let \n ret = push_on_stack_nat_state_upd_time t s\n in \n ret)\"\n by auto\ntermination\n by (relation \"measure (\\(t, s). push_on_stack_nat_c s)\") simp\n\ndeclare push_on_stack_nat_imp_time.simps[simp del]\n\n\n\nlemma push_on_stack_nat_IMP_Minus_correct_function:\n \"(invoke_subprogram p push_on_stack_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n s' (add_prefix p push_on_stack_nat_ret_str)\n = push_on_stack_nat_ret\n (push_on_stack_nat_imp (push_on_stack_nat_imp_to_HOL_state p s))\"\n apply (subst push_on_stack_nat_imp.simps)\n apply (simp only: push_on_stack_nat_IMP_Minus_def prefix_simps)\n apply (erule Seq_E)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(5) by fastforce\n apply (erule If_E)\n subgoal \n apply (force dest!:push_on_stack_nat_sub_branch_aux3_IMP_Minus_correct_function simp: \n push_on_stack_nat_state_upd_def Let_def hd_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n subgoal \n apply (force dest!:push_on_stack_nat_eq_zero_IMP_Minus_correct_function simp: \n push_on_stack_nat_state_upd_def Let_def hd_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n done \n\nlemma push_on_stack_nat_IMP_Minus_correct_time:\n \"(invoke_subprogram p push_on_stack_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s' \\\n t = push_on_stack_nat_imp_time 0 (push_on_stack_nat_imp_to_HOL_state p s)\"\n apply (subst push_on_stack_nat_imp_time.simps)\n apply (simp only: push_on_stack_nat_IMP_Minus_def prefix_simps)\n apply (erule Seq_tE)+\n apply (erule hd_IMP_Minus_correct[where vars=push_on_stack_nat_IMP_vars])\n subgoal premises p using p(9) by fastforce\n apply (erule If_tE)\n subgoal \n apply (force dest!:push_on_stack_nat_sub_branch_aux3_IMP_Minus_correct_time\n simp: push_on_stack_nat_state_upd_time_def \n Let_def hd_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n subgoal \n apply (force dest!:push_on_stack_nat_eq_zero_IMP_Minus_correct_time simp: \n push_on_stack_nat_state_upd_time_def Let_def hd_imp_to_HOL_state_def push_on_stack_nat_imp_to_HOL_state_def)\n done \n done \n\nlemma push_on_stack_nat_IMP_Minus_correct_effects:\n \"\\(invoke_subprogram (p @ push_on_stack_nat_prefix) push_on_stack_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n v \\ vars; \\ (prefix push_on_stack_nat_prefix v)\\\n \\ s (add_prefix p v) = s' (add_prefix p v)\"\n using com_add_prefix_valid'' com_only_vars prefix_def \n by blast\n\nlemma push_on_stack_nat_IMP_Minus_correct:\n \"\\(invoke_subprogram (p1 @ p2) push_on_stack_nat_IMP_Minus, s) \\\\<^bsup>t\\<^esup> s';\n \\v. v \\ vars \\ \\ (set p2 \\ set v);\n \\t = (push_on_stack_nat_imp_time 0 (push_on_stack_nat_imp_to_HOL_state (p1 @ p2) s));\n s' (add_prefix (p1 @ p2) push_on_stack_nat_ret_str) =\n push_on_stack_nat_ret (push_on_stack_nat_imp\n (push_on_stack_nat_imp_to_HOL_state (p1 @ p2) s));\n \\v. v \\ vars \\ s (add_prefix p1 v) = s' (add_prefix p1 v)\\\n \\ P\\ \\ P\"\n using push_on_stack_nat_IMP_Minus_correct_function \n push_on_stack_nat_IMP_Minus_correct_time\n push_on_stack_nat_IMP_Minus_correct_effects set_mono_prefix\n by (smt (verit, ccfv_SIG) com_add_prefix_valid_subset com_only_vars)\n\nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP-_To_IMP--/IMP_Minus_To_IMP_Minus_Minus_IMP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2521779748096991}} {"text": "(* Title: X86 instruction semantics and basic block symbolic execution\n Authors: Freek Verbeek, Abhijith Bharadwaj, Joshua Bockenek, Ian Roessle, Timmy Weerwag, Binoy Ravindran\n Year: 2020\n Maintainer: Freek Verbeek (freek@vt.edu)\n*)\n\nsection \"Removing superfluous memory writes\"\n\ntheory StateCleanUp\n imports State \"HOL-Eisbach.Eisbach\"\nbegin\n\n\ndefinition \"assumptions \\ id\"\n\ntext \\We are going to make schematic theorems of the form:\n \\[\n @{term assumptions} ?A \\implies \\ldots \n \\]\n The assumptions will be generated on-the-fly. The seemingly weird lemmas below achieves that.\\\n\n\nlemma assumptions_impI:\nassumes \"assumptions (P \\ A)\"\n shows \"P\"\n using assms\n by (auto simp add: assumptions_def)\n\nlemma assumptions_conjE:\n shows \"assumptions (P \\ A) \\ P \\ assumptions A\"\n by (auto simp add: assumptions_def)\n\nlemma assumptionsI:\n shows \"assumptions True\"\n by (auto simp add: assumptions_def)\n\n\n\ntext \\Consider two consecutive memory updates. If they write to the same memory locations, only one of these\n need to be kept. We formulate an Eisbach method to that end. \\\n\n\ntext \\Returns true if two states are equal except for a specific memory region.\\\ndefinition eq_except_for_mem :: \"state \\ state \\ 64 word \\ nat \\ 256 word \\ bool \\ bool\"\n where \"eq_except_for_mem \\ \\' a si v b \\ \\ with [\\a,si\\ :=\\<^sub>m v] = (if b then \\' else \\' with [\\a,si\\ :=\\<^sub>m v])\"\n\n\nlemma eefm_start:\n assumes \"eq_except_for_mem (\\ with updates) (\\ with updates') a si v b\"\n shows \"(\\ with ((\\a,si\\ :=\\<^sub>m v)#updates)) = (if b then \\ with updates' else \\ with ((\\a,si\\ :=\\<^sub>m v)#updates'))\"\n using assms\n by (auto simp add: eq_except_for_mem_def region_addresses_def state_with_updates.simps(2) state_update.simps)\n\nlemma eefm_clean_mem:\nassumes \"si' \\ si\"\n and \"eq_except_for_mem (\\ with updates) (\\ with updates') a si v b\"\n shows \"eq_except_for_mem (\\ with ((\\a,si'\\ :=\\<^sub>m v')#updates)) (\\ with updates') a si v b\"\n using assms\n apply (auto simp add: eq_except_for_mem_def state_with_updates.simps(2) state_update.simps)\n subgoal\n apply (cases \"\\ with updates\";cases \"\\ with updates'\";cases \"\\\")\n by (auto simp add: override_on_def region_addresses_iff)\n apply (cases \"\\ with updates\";cases \"\\ with updates'\")\n apply (auto simp add: override_on_def region_addresses_iff)\n apply (rule ext)\n apply (auto split: if_splits)\n by meson\n\nmethod eefm_clean_mem = (rule eefm_clean_mem, (simp (no_asm);fail))\n\n\nlemma eefm_clean_mem_enclosed:\n assumes \"si < 32\" (* due to 256 words being written to memory *)\n and \"enclosed a' si' a si\"\n and \"eq_except_for_mem (\\ with updates) (\\ with updates') a' si' v' b\"\n shows \"eq_except_for_mem (\\ with ((\\a,si\\ :=\\<^sub>m v)#updates)) \n (\\ with ((\\a,si\\ :=\\<^sub>m overwrite (8 * unat (a' - a)) (8 * unat (a' - a) + 8*si') v (v' << unat (a'-a)*8))#updates'))\n a' si' v' True\"\nproof(cases b)\n case True\n thus ?thesis\n using assms(3)\n apply (auto simp add: eq_except_for_mem_def state_with_updates.simps(2) state_update.simps)\n apply (cases \"\\ with updates\";cases \"\\ with updates'\")\n apply (auto simp add: override_on_def)\n apply (rule ext)\n apply (auto)\n\n apply (rule word_eqI)\n subgoal premises prems for _ _ _ _ x n\n proof-\n have 1: \"unat (x - a) - unat (a' - a) = unat(x - a')\"\n using address_in_enclosed_region_as_linarith[OF assms(2),of x]\n address_of_enclosed_region_ge[OF assms(2)]\n word_le_nat_alt prems(4-5)\n by (auto simp add: unat_sub_if_size word_size)\n thus ?thesis\n using prems address_in_enclosed_region[of a' si' a si x,OF assms(2)] assms(1)\n by (auto simp add: word_size take_byte_shiftlr_256 nth_take_byte_overwrite)\n qed\n\n apply (rule word_eqI)\n subgoal for _ _ _ _ x n\n using notin_region_addresses_sub[of x a' si' a]\n by (auto simp add: word_size nth_take_byte_overwrite)\n done\nnext\n case False\n thus ?thesis\n using assms(3)\n apply (auto simp add: eq_except_for_mem_def state_with_updates.simps(2) state_update.simps)\n apply (cases \"\\ with updates\";cases \"\\ with updates'\")\n apply (auto simp add: override_on_def)\n apply (rule ext)\n using enclosed_spec[OF assms(2)]\n apply (auto)\n\n subgoal premises prems for _ _ _ _ _ x \n proof-\n have 1: \"unat (x - a) - unat (a' - a) = unat(x - a')\"\n using address_in_enclosed_region_as_linarith[OF assms(2),of x]\n address_of_enclosed_region_ge[OF assms(2)]\n word_le_nat_alt prems(6)\n by (auto simp add: unat_sub_if_size word_size)\n show ?thesis\n apply (rule word_eqI)\n using 1 prems address_in_enclosed_region[of a' si' a si x,OF assms(2)] assms(1)\n by (auto simp add: word_size take_byte_shiftlr_256 nth_take_byte_overwrite)\n qed\n\n subgoal for _ _ _ _ _ x\n apply (rule word_eqI)\n using notin_region_addresses_sub[of x a' si' a]\n by (auto simp add: word_size nth_take_byte_overwrite)\n by meson\nqed\n\n\nlemmas eefm_clean_mem_enclosed_plus = eefm_clean_mem_enclosed[OF _ enclosed_plus, simplified]\nlemmas eefm_clean_mem_enclosed_minus_numeral = eefm_clean_mem_enclosed[OF _ enclosed_minus_minus, of _ \"numeral n\" \"numeral m\"] for n m\n\nmethod eefm_clean_mem_enclosed_plus = \n (rule eefm_clean_mem_enclosed_plus, (\n (simp (no_asm);fail), (simp (no_asm);fail),\n (\n (simp (no_asm_simp);fail) |\n (rule assumptions_impI[of \"_ + _ < 18446744073709551616\"],simp (no_asm_simp),subst (asm) assumptions_conjE))\n )\n )\n\nmethod eefm_clean_mem_enclosed_minus_numeral = \n (rule eefm_clean_mem_enclosed_minus_numeral, (\n (simp (no_asm);fail), (simp (no_asm);fail), (simp (no_asm);fail), (simp (no_asm);fail), (simp (no_asm);fail),\n (\n (simp (no_asm_simp);fail) | \n (rule assumptions_impI[of \"_ \\ _\"],simp (no_asm_simp),subst (asm) assumptions_conjE))\n ) \n )\n\nlemma eefm_next_mem:\nassumes \"separate a si a' si'\"\n and \"eq_except_for_mem (\\ with updates) (\\ with updates') a si v b\"\n shows \"eq_except_for_mem (\\ with ((\\a',si'\\ :=\\<^sub>m v')#updates)) (\\ with ((\\a',si'\\ :=\\<^sub>m v')#updates')) a si v b\"\n using assms\n apply (auto simp add: eq_except_for_mem_def override_on_def separate_def state_with_updates.simps(2) state_update.simps)\n apply (cases \"\\ with updates\";cases \"\\ with updates'\")\n apply (auto simp add: override_on_def)\n apply (rule ext)\n apply (auto)\n apply (cases \"\\ with updates\";cases \"\\ with updates'\")\n apply (auto simp add: override_on_def)\n apply (rule ext)\n apply (auto)\n by (metis select_convs(2))\n\nmethod eefm_next_mem = \n (rule eefm_next_mem,\n ( (simp (no_asm_simp) add: separate_simps state_simps; fail) |\n (rule assumptions_impI[of \"separate _ _ _ _ \"],simp (no_asm_simp),subst (asm) assumptions_conjE))\n )\n\nlemma eefm_end:\n shows \"eq_except_for_mem (\\ with updates) (\\ with updates) a si v False\"\n by (auto simp add: eq_except_for_mem_def)\n\n\ntext \\We need a tactic exactly like ``subst'' but that applies to the outer most term.\\\n\nML_file \\MySubst.ML\\\n\n\ntext \\The following method takes a goal with state with symbolic state updates.\n It first applies @{thm eefm_start}, considering the outer-most memory update to some region $\\llbracket a, si \\rrbracket$.\n A list @{term updates'} is generated that produces a similar state except for region $\\llbracket a, si \\rrbracket$.\n The list thus can have fewer updates since any update to a region that is enclosed in region $\\llbracket a, si \\rrbracket$ can be removed.\n Consecutively, this method applies rules to determine whether a state update can be kept, merged or removed.\n It may add assumptions to the goal, that assume no overflow.\n\\\n\nmethod clean_up_mem = (\n mysubst eefm_start,\n ( eefm_clean_mem | eefm_clean_mem_enclosed_plus | eefm_clean_mem_enclosed_minus_numeral | eefm_next_mem)+,\n rule eefm_end,\n simp (no_asm),\n ((match premises in A[thin]: \"assumptions (?A \\ ?B)\" \\ \\cut_tac A;subst (asm) assumptions_conjE, erule conjE \\)+)?\n )\n\n\ntext \\The method above applies to one state update. This method can be repeated as long as modifies\n the goal, as it always makes the goal smaller. The method below repeats a given method until\n the goal is unchanged. In deterministic fashion (a la the REPEAT\\_DETERM tactic).\\\n\nmethod_setup repeat_until_unchanged = \\\n Method.text_closure >>\n (fn text => fn ctxt => fn using => \n \\ \\parse the method supplied as parameter\\\n let val ctxt_tac = Method.evaluate_runtime text ctxt using\n fun repeat_until_unchanged (ctxt,st) = \n case Seq.pull (ctxt_tac (ctxt,st)) of\n SOME (Seq.Result (ctxt',st'), _) => \n if Thm.eq_thm (st, st') then \n Seq.make_results (Seq.succeed (ctxt',st'))\n else\n repeat_until_unchanged (ctxt',st')\n | _ => Seq.make_results (Seq.succeed (ctxt,st))\n in\n repeat_until_unchanged \n end)\n\\\n\nmethod clean_up = repeat_until_unchanged clean_up_mem\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/X86_Semantics/StateCleanUp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2521779748096991}} {"text": "theory KVS_WAL_ordered_disk\nimports Main Option String\nbegin\n\n(* We model the disk as list of strings. In this preliminary version, we assume a string can be contained in disk slot (ie., a block) *)\ntype_synonym disk = \"string list\" \n\n(* Convenience type which models a list of disk states that could result as an operation on the disk*)\ntype_synonym disk_states = \"disk list\"\n\n(* Usually, the log is a dedicated portion in the disk. In our model, we model it as a separate disk. This pair of data and log portions\nmake up the actual disk*)\nrecord diskpair = data :: disk\n log :: disk\n\n(* Convenience type which models a list of diskpairs *)\ntype_synonym diskpairlist = \"diskpair list\"\n\n(* Helper to enumerate disk lists *)\nfun enumdisks :: \"disk list list => disk list\"\nwhere\n \"enumdisks [] = []\"\n| \"enumdisks (x#d1) = (x) @ enumdisks d1\"\n\n(* Helper to enumerate diskpair lists *)\nfun enumdiskpairs :: \"diskpair list list => diskpair list\"\nwhere\n \"enumdiskpairs [] = []\"\n| \"enumdiskpairs (x#d1) = (x) @ enumdiskpairs d1\"\n\n(* Helper to check if a given element in present in a list *)\nfun list_contains :: \"'a \\ 'a list \\ bool\"\nwhere\n\"list_contains item [] = False\" |\n\"list_contains item (first # others) = ((item = first) \\ (list_contains item others))\"\n\n(* Log update : This function models how a key value pair is updated on the log *)\n(* Param1: key :: string *)\n(* Param2: value :: string *)\n(* returns: all possible log states :: disk_states *)\n(* There are 3 slots in the log. The first slot contains information about the log itself\n It can either contain 'N' which means there is a log update currently happening or 'C'\n which means the log update completed and it is safe to apply the update. Note: We assume\n the log is cleaned properly (without failures) after applying an update from the log.\n*)\nfun log_update :: \"string \\ string \\ disk_states\"\nwhere\n\"log_update key value = [\n [[],[],[]][0:=''N''],\n [[],[],[]][0:=''N'',(Suc 0):=key],\n [[],[],[]][0:=''N'',(Suc 0):=key,(Suc (Suc 0)):=value],\n [[],[],[]][0:=''C'',(Suc 0):=key,(Suc (Suc 0)):=value]\n ]\"\n\n\n(* Log recovery : This function models how the log is recovered. *)\n(* Param1: index_to_apply :: nat *)\n(* Param2: data_portion :: disk *)\n(* Param3: log_portion :: disk *)\n(* returns: data_portion :: disk*)\n(* Checks if the first slot in the log is 'C' which means the log update has completed properly.\n In that case, it applies the update to index_to_apply in the data portion. Note: Recovery itself \n can crash. This is modelled by function recover_crash *)\nfun recover :: \"nat \\ disk \\ disk \\ disk\"\nwhere\n\"recover idx data_disk log_disk = (if(log_disk!0 = ''C'')\n then data_disk[idx := log_disk!1, (Suc idx) := log_disk!2] else data_disk)\"\n\n(* Log recovery(crashing version) : This function models how the log is recovered. *)\n(* Param1: index_to_apply :: nat *)\n(* Param2: data_portion :: disk *)\n(* Param3: log_portion :: disk *)\n(* returns nothing *)\n(* Checks if the first slot in the log is 'C' which means the log update has completed properly.\n In that case, it applies the update to index_to_apply in the data portion and marks the first slot as 'D'.\n Otherwise does nothing *)\n(* returns: all possible disk pairs that would result if the recovery crashes :: diskpairlist *)\nfun recover_crash :: \"nat \\ disk \\ disk \\ diskpairlist\"\nwhere\n\"recover_crash idx data_disk log_disk = \n (if(log_disk!0 = ''C'')\n then\n [\n (| data = data_disk, log = log_disk |),\n (| data = data_disk[idx := log_disk!1],\n log = log_disk |),\n (| data = data_disk[idx := log_disk!1, (Suc idx) := log_disk!2],\n log = log_disk |),\n (| data = data_disk[idx := log_disk!1, (Suc idx) := log_disk!2],\n log = log_disk[0 := ''D''] |)\n ]\n else \n [\n (| data = data_disk, log = log_disk |)\n ]\n )\" \n\n(* Log checkpointing : This function models how the log is checkpointed. *)\n(* Param1: index_to_apply :: nat *)\n(* Param2: data_portion :: disk *)\n(* Param3: log_portion :: disk *)\n(* returns nothing *)\n(* Same as recovery but called during normal operation and not after failures *)\n(* returns: data_portion :: disk*)\nfun checkpoint :: \"nat \\ disk \\ disk \\ disk\"\nwhere\n\"checkpoint idx data_disk log_disk =(if(log_disk!0 = ''C'')\n then data_disk[idx := log_disk!1, (Suc idx) := log_disk!2] else data_disk)\"\n\n(* KV_Put : This function models how our toy key-value store PUT operation works. *)\n(* Param1: key :: string *)\n(* Param1: value :: string *)\n(* Param1: data_portion :: disk *)\n(* Param2: index_to_apply: nat *)\n(* returns all possible disk states that could result on doing this PUT operation :: disk_states *)\nfun kv_put :: \"string \\ string \\ disk \\ nat \\ disk_states\"\nwhere\n\"kv_put k v current_disk idx= map (checkpoint idx current_disk) (log_update k v)\"\n\n(*Test code*)\nvalue \"log_update ''a'' ''b''\"\nvalue \"enumdisks [ [[''1'',''2''],[''3'',''4''],[''5'',''6'']], [[''7'',''8''],[''9'',''10''],[''11'',''12'']] ]\"\nvalue \"enumdiskpairs (map (recover_crash 1 [''x'',''y'',''z'']) (log_update ''a'' ''b''))\"\nvalue \"map (recover 1 [''x'',''y'',''z'']) (log_update ''a'' ''b'')\"\nvalue \"map (recover 5 [''1'',''2'',''3'',''4'',''5'',''6'',''7'']) (log_update ''a'' ''b'')\"\nvalue \"enumdiskpairs (map (recover_crash 5 [''1'',''2'',''3'',''4'',''5'',''6'',''7'']) (log_update ''a'' ''b''))\"\n(*End of test code*)\n\n(* Assuming no crashes during recovery, prove that the logging mechanism can atomically update a key value pair\n on disk *)\ntheorem atomic_recovery_no_crash_theorem:\nshows \"length d \\ 2 \\ (Suc idx) < length d \\ (list_contains after (map (recover idx d) (log_update s1 s2))) \\ s1\\[] \\ s2 \\[]\n \\\n after!idx=d!idx \\ after!(Suc idx)=d!(Suc idx)\n \\\n after!idx=s1 \\ after!(Suc idx)=s2\"\napply(auto)\ndone\n\n(* Assuming crashes during recovery, prove that the logging mechanism can atomically update a key value pair\n on disk *)\ntheorem atomic_recovery_crash_theorem:\nshows \"length d \\ 2 \\ (Suc idx) < length d \\ ( list_contains after (enumdiskpairs (map (recover_crash idx d) (log_update s1 s2) ) ) ) \\ s1\\[] \\ s2 \\[]\n \\\n (log after)!0=''D'' \\ (data after)!idx=s1 \\ (data after)!(Suc idx)=s2\n \\\n (log after)!0=''N'' \\ (data after)!idx=d!idx \\ (data after)!(Suc idx)=d!(Suc idx)\"\napply(auto)\ndone\n\n(* Atomic KV puts *)\ntheorem kv_put_atomic_theorem:\nshows \"length d \\ 2 \\ (Suc idx) < length d \\ (list_contains after (kv_put s1 s2 d idx)) \\ s1\\[] \\ s2 \\[]\n \\\n after!idx=d!idx \\ after!(Suc idx)=d!(Suc idx)\n \\\n after!idx=s1 \\ after!(Suc idx)=s2\"\napply(auto)\ndone\n", "meta": {"author": "ramanala", "repo": "StorageStackSemantics", "sha": "620fd6fd0703cb4ed1d8cfdea16d1261b4645918", "save_path": "github-repos/isabelle/ramanala-StorageStackSemantics", "path": "github-repos/isabelle/ramanala-StorageStackSemantics/StorageStackSemantics-620fd6fd0703cb4ed1d8cfdea16d1261b4645918/KVS_WAL_ordered_disk.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.25217796828653294}} {"text": "section \\Dynamic Backward Slice\\\n\ntheory DynSlice imports DependentLiveVariables BitVector \"../Basic/SemanticsCFG\" begin\n\nsubsection \\Backward slice of paths\\\n\ncontext DynPDG begin\n\nfun slice_path :: \"'edge list \\ bit_vector\"\n where \"slice_path [] = []\"\n | \"slice_path (a#as) = (let n' = last(targetnodes (a#as)) in\n (sourcenode a -a#as\\\\<^sub>d* n')#slice_path as)\"\n\n(*<*)declare Let_def [simp](*>*)\n\nlemma slice_path_length:\n \"length(slice_path as) = length as\"\nby(induct as) auto\n\n\nlemma slice_path_right_Cons:\n assumes slice:\"slice_path as = x#xs\"\n obtains a' as' where \"as = a'#as'\" and \"slice_path as' = xs\"\nproof(atomize_elim)\n from slice show \"\\a' as'. as = a'#as' \\ slice_path as' = xs\"\n by(induct as) auto\nqed\n\n\nsubsection \\The proof of the fundamental property of (dynamic) slicing\\\n\nfun select_edge_kinds :: \"'edge list \\ bit_vector \\ 'state edge_kind list\"\nwhere \"select_edge_kinds [] [] = []\"\n | \"select_edge_kinds (a#as) (b#bs) = (if b then kind a\n else (case kind a of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))#select_edge_kinds as bs\"\n\n\ndefinition slice_kinds :: \"'edge list \\ 'state edge_kind list\"\n where \"slice_kinds as = select_edge_kinds as (slice_path as)\"\n\n\nlemma select_edge_kinds_max_bv:\n \"select_edge_kinds as (replicate (length as) True) = kinds as\"\nby(induct as,auto simp:kinds_def)\n\n\nlemma slice_path_leqs_information_same_Uses:\n \"\\n -as\\* n'; bs \\\\<^sub>b bs'; slice_path as = bs;\n select_edge_kinds as bs = es; select_edge_kinds as bs' = es'; \n \\V xs. (V,xs,as) \\ dependent_live_vars n' \\ state_val s V = state_val s' V;\n preds es' s'\\ \n \\ (\\V \\ Use n'. state_val (transfers es s) V =\n state_val (transfers es' s') V) \\ preds es s\"\nproof(induct bs bs' arbitrary:as es es' n s s' rule:bv_leqs.induct)\n case 1\n from \\slice_path as = []\\ have \"as = []\" by(cases as) auto\n with \\select_edge_kinds as [] = es\\ \\select_edge_kinds as [] = es'\\\n have \"es = []\" and \"es' = []\" by simp_all\n { fix V assume \"V \\ Use n'\"\n hence \"(V,[],[]) \\ dependent_live_vars n'\" by(rule dep_vars_Use)\n with \\\\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V\\ \\V \\ Use n'\\ \\as = []\\\n have \"state_val s V = state_val s' V\" by blast }\n with \\es = []\\ \\es' = []\\ show ?case by simp\nnext\n case (2 x xs y ys)\n note all = \\\\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V\\\n note IH = \\\\as es es' n s s'. \\n -as\\* n'; xs \\\\<^sub>b ys; slice_path as = xs; \n select_edge_kinds as xs = es; select_edge_kinds as ys = es';\n \\V xs. (V,xs,as) \\ dependent_live_vars n' \\\n state_val s V = state_val s' V; \n preds es' s'\\\n \\ (\\V \\ Use n'. state_val (transfers es s) V =\n state_val (transfers es' s') V) \\ preds es s\\\n from \\x#xs \\\\<^sub>b y#ys\\ have \"x \\ y\" and \"xs \\\\<^sub>b ys\" by simp_all\n from \\slice_path as = x#xs\\ obtain a' as' where \"as = a'#as'\"\n and \"slice_path as' = xs\" by(erule slice_path_right_Cons)\n from \\as = a'#as'\\ \\select_edge_kinds as (x#xs) = es\\\n obtain ex esx where \"es = ex#esx\"\n and ex:\"ex = (if x then kind a'\n else (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))\"\n and \"select_edge_kinds as' xs = esx\" by auto\n from \\as = a'#as'\\ \\select_edge_kinds as (y#ys) = es'\\ obtain ex' esx' \n where \"es' = ex'#esx'\"\n and ex':\"ex' = (if y then kind a'\n else (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\))\"\n and \"select_edge_kinds as' ys = esx'\" by auto\n from \\n -as\\* n'\\ \\as = a'#as'\\ have [simp]:\"n = sourcenode a'\" \n and \"valid_edge a'\" and \"targetnode a' -as'\\* n'\"\n by(auto elim:path_split_Cons)\n from \\n -as\\* n'\\ \\as = a'#as'\\ have \"last(targetnodes as) = n'\"\n by(fastforce intro:path_targetnode)\n from \\preds es' s'\\ \\es' = ex'#esx'\\ have \"pred ex' s'\"\n and \"preds esx' (transfer ex' s')\" by simp_all\n show ?case\n proof(cases \"as' = []\")\n case True\n hence [simp]:\"as' = []\" by simp\n with \\slice_path as' = xs\\ \\xs \\\\<^sub>b ys\\ \n have [simp]:\"xs = [] \\ ys = []\" by auto(cases ys,auto)+\n with \\select_edge_kinds as' xs = esx\\ \\select_edge_kinds as' ys = esx'\\\n have [simp]:\"esx = []\" and [simp]:\"esx' = []\" by simp_all\n from True \\targetnode a' -as'\\* n'\\ \n have [simp]:\"n' = targetnode a'\" by(auto elim:path.cases)\n show ?thesis\n proof(cases x)\n case True\n with \\x \\ y\\ ex ex' have [simp]:\"ex = kind a' \\ ex' = kind a'\" by simp\n have \"pred ex s\"\n proof(cases ex)\n case (Predicate Q)\n with ex ex' True \\x \\ y\\ have [simp]:\"transfer ex s = s\" \n and [simp]:\"transfer ex' s' = s'\"\n by(cases \"kind a'\",auto)+\n show ?thesis\n proof(cases \"n -[a']\\\\<^sub>c\\<^sub>d n'\")\n case True\n { fix V' assume \"V' \\ Use n\"\n with True \\valid_edge a'\\\n have \"(V',[],a'#[]@[]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_cdep DynPDG_path_Nil \n simp:targetnodes_def)\n with all \\as = a'#as'\\ have \"state_val s V' = state_val s' V'\"\n by fastforce }\n with \\pred ex' s'\\ \\valid_edge a'\\\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n next\n case False\n from ex True Predicate have \"kind a' = (Q)\\<^sub>\\\" by(auto split:if_split_asm)\n from True \\slice_path as = x#xs\\ \\as = a'#as'\\ have \"n -[a']\\\\<^sub>d* n'\"\n by(auto simp:targetnodes_def)\n thus ?thesis\n proof(induct rule:DynPDG_path.cases)\n case (DynPDG_path_Nil nx)\n hence False by simp\n thus ?case by simp\n next\n case (DynPDG_path_Append_cdep nx asx n'' asx' nx')\n from \\[a'] = asx@asx'\\ \n have \"(asx = [a'] \\ asx' = []) \\ (asx = [] \\ asx' = [a'])\"\n by (cases asx) auto\n hence False\n proof\n assume \"asx = [a'] \\ asx' = []\"\n with \\n'' -asx'\\\\<^sub>c\\<^sub>d nx'\\ show False\n by(fastforce elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n next\n assume \"asx = [] \\ asx' = [a']\"\n with \\nx -asx\\\\<^sub>d* n''\\ have \"nx = n''\" and \"asx' = [a']\"\n by(auto intro:DynPDG_empty_path_eq_nodes)\n with \\n = nx\\ \\n' = nx'\\ \\n'' -asx'\\\\<^sub>c\\<^sub>d nx'\\ False\n show False by simp\n qed\n thus ?thesis by simp\n next\n case (DynPDG_path_Append_ddep nx asx n'' V asx' nx')\n from \\[a'] = asx@asx'\\ \n have \"(asx = [a'] \\ asx' = []) \\ (asx = [] \\ asx' = [a'])\"\n by (cases asx) auto\n thus ?case\n proof\n assume \"asx = [a'] \\ asx' = []\"\n with \\n'' -{V}asx'\\\\<^sub>d\\<^sub>d nx'\\ have False\n by(fastforce elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n thus ?thesis by simp\n next\n assume \"asx = [] \\ asx' = [a']\"\n with \\nx -asx\\\\<^sub>d* n''\\ have \"nx = n''\"\n by(simp add:DynPDG_empty_path_eq_nodes)\n { fix V' assume \"V' \\ Use n\"\n from \\n'' -{V}asx'\\\\<^sub>d\\<^sub>d nx'\\ \\asx = [] \\ asx' = [a']\\ \\n' = nx'\\\n have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Use elim:DynPDG_edge.cases\n simp:dyn_data_dependence_def)\n with \\V' \\ Use n\\ \\n'' -{V}asx'\\\\<^sub>d\\<^sub>d nx'\\ \\asx = [] \\ asx' = [a']\\\n \\n = nx\\ \\nx = n''\\ \\n' = nx'\\\n have \"(V',[],[a']) \\ dependent_live_vars n'\"\n by(auto elim:dep_vars_Cons_ddep simp:targetnodes_def)\n with all \\as = a'#as'\\ have \"state_val s V' = state_val s' V'\"\n by fastforce }\n with \\pred ex' s'\\ \\valid_edge a'\\ ex ex' True \\x \\ y\\ show ?thesis\n by(fastforce elim:CFG_edge_Uses_pred_equal)\n qed\n qed\n qed\n qed simp\n { fix V assume \"V \\ Use n'\"\n from \\V \\ Use n'\\ have \"(V,[],[]) \\ dependent_live_vars n'\" \n by(rule dep_vars_Use)\n have \"state_val (transfer ex s) V = state_val (transfer ex' s') V\"\n proof(cases \"n -{V}[a']\\\\<^sub>d\\<^sub>d n'\")\n case True\n hence \"V \\ Def n\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n have \"\\V. V \\ Use n \\ state_val s V = state_val s' V\"\n proof -\n fix V' assume \"V' \\ Use n\"\n with \\(V,[],[]) \\ dependent_live_vars n'\\ True\n have \"(V',[],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_ddep simp:targetnodes_def)\n with all \\as = a'#as'\\ show \"state_val s V' = state_val s' V'\" by auto\n qed\n with \\valid_edge a'\\ \\pred ex' s'\\ \\pred ex s\\\n have \"\\V \\ Def n. state_val (transfer (kind a') s) V =\n state_val (transfer (kind a') s') V\"\n by simp(rule CFG_edge_transfer_uses_only_Use,auto)\n with \\V \\ Def n\\ have \"state_val (transfer (kind a') s) V = \n state_val (transfer (kind a') s') V\"\n by simp\n thus ?thesis by fastforce\n next\n case False\n with \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n \\(V,[],[]) \\ dependent_live_vars n'\\\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n from \\(V,[a'],[a']) \\ dependent_live_vars n'\\ all \\as = a'#as'\\\n have states_eq:\"state_val s V = state_val s' V\"\n by auto\n from \\valid_edge a'\\ \\V \\ Use n'\\ False \\pred ex s\\\n have \"state_val (transfers (kinds [a']) s) V = state_val s V\"\n apply(auto intro!:no_ddep_same_state path_edge simp:targetnodes_def)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n moreover\n from \\valid_edge a'\\ \\V \\ Use n'\\ False \\pred ex' s'\\\n have \"state_val (transfers (kinds [a']) s') V = state_val s' V\"\n apply(auto intro!:no_ddep_same_state path_edge simp:targetnodes_def)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n ultimately show ?thesis using states_eq by(auto simp:kinds_def)\n qed }\n hence \"\\V \\ Use n'. state_val (transfer ex s) V = \n state_val (transfer ex' s') V\" by simp\n with \\pred ex s\\ \\es = ex#esx\\ \\es' = ex'#esx'\\ show ?thesis by simp\n next\n case False\n with ex have cases_x:\"ex = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n from cases_x have \"pred ex s\" by(cases \"kind a'\",auto)\n show ?thesis\n proof(cases y)\n case True\n with ex' have [simp]:\"ex' = kind a'\" by simp\n { fix V assume \"V \\ Use n'\"\n from \\V \\ Use n'\\ have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(rule dep_vars_Use)\n from \\slice_path as = x#xs\\ \\as = a'#as'\\ \\\\ x\\ \n have \"\\ n -[a']\\\\<^sub>d* n'\" by(simp add:targetnodes_def)\n hence \"\\ n -{V}[a']\\\\<^sub>d\\<^sub>d n'\" by(fastforce dest:DynPDG_path_ddep)\n with \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n \\(V,[],[]) \\ dependent_live_vars n'\\\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with all \\as = a'#as'\\ have \"state_val s V = state_val s' V\" by auto\n from \\valid_edge a'\\ \\V \\ Use n'\\ \\pred ex' s'\\\n \\\\ n -{V}[a']\\\\<^sub>d\\<^sub>d n'\\ \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n have \"state_val (transfers (kinds [a']) s') V = state_val s' V\"\n apply(auto intro!:no_ddep_same_state path_edge)\n apply(simp add:kinds_def)\n by(case_tac as',auto)\n with \\state_val s V = state_val s' V\\ cases_x\n have \"state_val (transfer ex s) V =\n state_val (transfer ex' s') V\"\n by(cases \"kind a'\",simp_all add:kinds_def) }\n hence \"\\V \\ Use n'. state_val (transfer ex s) V =\n state_val (transfer ex' s') V\" by simp\n with \\as = a'#as'\\ \\es = ex#esx\\ \\es' = ex'#esx'\\ \\pred ex s\\ \n show ?thesis by simp\n next\n case False\n with ex' have cases_y:\"ex' = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n with cases_x have [simp]:\"ex = ex'\" by(cases \"kind a'\") auto\n { fix V assume \"V \\ Use n'\"\n from \\V \\ Use n'\\ have \"(V,[],[]) \\ dependent_live_vars n'\"\n by(rule dep_vars_Use)\n from \\slice_path as = x#xs\\ \\as = a'#as'\\ \\\\ x\\ \n have \"\\ n -[a']\\\\<^sub>d* n'\" by(simp add:targetnodes_def)\n hence no_dep:\"\\ n -{V}[a']\\\\<^sub>d\\<^sub>d n'\" by(fastforce dest:DynPDG_path_ddep)\n with \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n \\(V,[],[]) \\ dependent_live_vars n'\\\n have \"(V,[a'],[a']) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with all \\as = a'#as'\\ have \"state_val s V = state_val s' V\" by auto }\n with \\as = a'#as'\\ cases_x \\es = ex#esx\\ \\es' = ex'#esx'\\ \\pred ex s\\\n show ?thesis by(cases \"kind a'\",auto)\n qed\n qed\n next\n case False\n show ?thesis\n proof(cases \"\\V xs. (V,xs,as') \\ dependent_live_vars n' \\\n state_val (transfer ex s) V = state_val (transfer ex' s') V\")\n case True\n hence imp':\"\\V xs. (V,xs,as') \\ dependent_live_vars n' \\\n state_val (transfer ex s) V = state_val (transfer ex' s') V\" .\n from IH[OF \\targetnode a' -as'\\* n'\\ \\xs \\\\<^sub>b ys\\ \\slice_path as' = xs\\\n \\select_edge_kinds as' xs = esx\\ \\select_edge_kinds as' ys = esx'\\ \n this \\preds esx' (transfer ex' s')\\]\n have all':\"\\V\\Use n'. state_val (transfers esx (transfer ex s)) V =\n state_val (transfers esx' (transfer ex' s')) V\"\n and \"preds esx (transfer ex s)\" by simp_all\n have \"pred ex s\"\n proof(cases ex)\n case (Predicate Q)\n with \\slice_path as = x#xs\\ \\as = a'#as'\\ \\last(targetnodes as) = n'\\ ex \n have \"ex = (\\s. True)\\<^sub>\\ \\ n -a'#as'\\\\<^sub>d* n'\"\n by(cases \"kind a'\",auto split:if_split_asm) \n thus ?thesis\n proof\n assume \"ex = (\\s. True)\\<^sub>\\\" thus ?thesis by simp\n next\n assume \"n -a'#as'\\\\<^sub>d* n'\"\n with \\slice_path as = x#xs\\ \\as = a'#as'\\ \\last(targetnodes as) = n'\\ ex\n have [simp]:\"ex = kind a'\" by clarsimp\n with \\x \\ y\\ ex ex' have [simp]:\"ex' = ex\" by(cases x) auto\n from \\n -a'#as'\\\\<^sub>d* n'\\ show ?thesis\n proof(induct rule:DynPDG_path_rev_cases)\n case DynPDG_path_Nil\n hence False by simp\n thus ?thesis by simp\n next\n case (DynPDG_path_cdep_Append n'' asx asx')\n from \\n -asx\\\\<^sub>c\\<^sub>d n''\\have \"asx \\ []\"\n by(auto elim:DynPDG_edge.cases dest:dyn_control_dependence_path)\n with \\n -asx\\\\<^sub>c\\<^sub>d n''\\ \\n'' -asx'\\\\<^sub>d* n'\\ \\a'#as' = asx@asx'\\\n have cdep:\"\\as1 as2 n''. n -a'#as1\\\\<^sub>c\\<^sub>d n'' \\ \n n'' -as2\\\\<^sub>d* n' \\ as' = as1@as2\"\n by(cases asx) auto \n { fix V assume \"V \\ Use n\"\n with cdep \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n have \"(V,[],as) \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_cdep)\n with all have \"state_val s V = state_val s' V\" by blast }\n with \\valid_edge a'\\ \\pred ex' s'\\\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n next\n case (DynPDG_path_ddep_Append V n'' asx asx')\n from \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ obtain ai ais where \"asx = ai#ais\"\n by(cases asx)(auto dest:DynPDG_ddep_edge_CFG_path)\n with \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ have \"sourcenode ai = n\"\n by(fastforce dest:DynPDG_ddep_edge_CFG_path elim:path.cases)\n from \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ \\asx = ai#ais\\\n have \"last(targetnodes asx) = n''\"\n by(fastforce intro:path_targetnode dest:DynPDG_ddep_edge_CFG_path)\n { fix V' assume \"V' \\ Use n\"\n from \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ have \"(V,[],[]) \\ dependent_live_vars n''\"\n by(fastforce elim:DynPDG_edge.cases dep_vars_Use \n simp:dyn_data_dependence_def)\n with \\n'' -asx'\\\\<^sub>d* n'\\ have \"(V,[],[]@asx') \\ dependent_live_vars n'\"\n by(rule dependent_live_vars_dep_dependent_live_vars)\n have \"(V',[],as) \\ dependent_live_vars n'\"\n proof(cases \"asx' = []\")\n case True\n with \\n'' -asx'\\\\<^sub>d* n'\\ have \"n'' = n'\"\n by(fastforce intro:DynPDG_empty_path_eq_nodes)\n with \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ \\V' \\ Use n\\ True \\as = a'#as'\\\n \\a'#as' = asx@asx'\\\n show ?thesis by(fastforce intro:dependent_live_vars_ddep_empty_fst)\n next\n case False\n with \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ \\asx = ai#ais\\\n \\(V,[],[]@asx') \\ dependent_live_vars n'\\\n have \"(V,ais@[],ais@asx') \\ dependent_live_vars n'\"\n by(fastforce intro:ddep_dependent_live_vars_keep_notempty)\n from \\n'' -asx'\\\\<^sub>d* n'\\ False have \"last(targetnodes asx') = n'\"\n by -(rule path_targetnode,rule DynPDG_path_CFG_path)\n with \\(V,ais@[],ais@asx') \\ dependent_live_vars n'\\\n \\V' \\ Use n\\ \\n -{V}asx\\\\<^sub>d\\<^sub>d n''\\ \\asx = ai#ais\\\n \\sourcenode ai = n\\ \\last(targetnodes asx) = n''\\ False\n have \"(V',[],ai#ais@asx') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_ddep simp:targetnodes_def)\n with \\asx = ai#ais\\ \\a'#as' = asx@asx'\\ \\as = a'#as'\\\n show ?thesis by simp\n qed\n with all have \"state_val s V' = state_val s' V'\" by blast }\n with \\pred ex' s'\\ \\valid_edge a'\\\n show ?thesis by(fastforce elim:CFG_edge_Uses_pred_equal)\n qed\n qed\n qed simp\n with all' \\preds esx (transfer ex s)\\ \\es = ex#esx\\ \\es' = ex'#esx'\\\n show ?thesis by simp\n next\n case False\n then obtain V' xs' where \"(V',xs',as') \\ dependent_live_vars n'\"\n and \"state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\"\n by auto\n show ?thesis\n proof(cases \"n -a'#as'\\\\<^sub>d* n'\")\n case True\n with \\slice_path as = x#xs\\ \\as = a'#as'\\ \\last(targetnodes as) = n'\\ ex\n have [simp]:\"ex = kind a'\" by clarsimp\n with \\x \\ y\\ ex ex' have [simp]:\"ex' = ex\" by(cases x) auto\n { fix V assume \"V \\ Use (sourcenode a')\"\n hence \"(V,[],[]) \\ dependent_live_vars (sourcenode a')\"\n by(rule dep_vars_Use)\n with \\n -a'#as'\\\\<^sub>d* n'\\ have \"(V,[],[]@a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dependent_live_vars_dep_dependent_live_vars)\n with all \\as = a'#as'\\ have \"state_val s V = state_val s' V\"\n by fastforce }\n with \\pred ex' s'\\ \\valid_edge a'\\ have \"pred ex s\"\n by(fastforce intro:CFG_edge_Uses_pred_equal)\n show ?thesis\n proof(cases \"V' \\ Def n\")\n case True\n with \\state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\\\n \\valid_edge a'\\ \\pred ex' s'\\ \\pred ex s\\\n CFG_edge_transfer_uses_only_Use[of a' s s']\n obtain V'' where \"V'' \\ Use n\"\n and \"state_val s V'' \\ state_val s' V''\"\n by auto\n from True \\(V',xs',as') \\ dependent_live_vars n'\\\n \\targetnode a' -as'\\* n'\\ \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n \\valid_edge a'\\ \\n = sourcenode a'\\[THEN sym]\n have \"n -{V'}a'#xs'\\\\<^sub>d\\<^sub>d last(targetnodes (a'#xs'))\"\n by -(drule dependent_live_vars_dependent_edge,\n auto dest!: dependent_live_vars_dependent_edge \n dest:DynPDG_ddep_edge_CFG_path path_targetnode \n simp del:\\n = sourcenode a'\\)\n with \\(V',xs',as') \\ dependent_live_vars n'\\ \\V'' \\ Use n\\\n \\last(targetnodes as) = n'\\ \\as = a'#as'\\\n have \"(V'',[],as) \\ dependent_live_vars n'\" \n by(fastforce intro:dep_vars_Cons_ddep)\n with all have \"state_val s V'' = state_val s' V''\" by blast\n with \\state_val s V'' \\ state_val s' V''\\ have False by simp\n thus ?thesis by simp\n next\n case False\n with \\valid_edge a'\\ \\pred ex s\\\n have \"state_val (transfer (kind a') s) V' = state_val s V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n moreover\n from False \\valid_edge a'\\ \\pred ex' s'\\\n have \"state_val (transfer (kind a') s') V' = state_val s' V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n ultimately have \"state_val s V' \\ state_val s' V'\"\n using \\state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\\\n by simp\n from False have \"\\ n -{V'}a'#xs'\\\\<^sub>d\\<^sub>d \n last(targetnodes (a'#xs'))\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with \\(V',xs',as') \\ dependent_live_vars n'\\ \\last(targetnodes as) = n'\\\n \\as = a'#as'\\\n have \"(V',a'#xs',a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with \\as = a'#as'\\ all have \"state_val s V' = state_val s' V'\" by auto\n with \\state_val s V' \\ state_val s' V'\\ have False by simp\n thus ?thesis by simp\n qed\n next\n case False\n { assume \"V' \\ Def n\"\n with \\(V',xs',as') \\ dependent_live_vars n'\\ \\targetnode a' -as'\\* n'\\\n \\valid_edge a'\\\n have \"n -a'#as'\\\\<^sub>d* n'\"\n by -(drule dependent_live_vars_dependent_edge,\n auto dest:DynPDG_path_ddep DynPDG_path_Append)\n with False have \"False\" by simp }\n hence \"V' \\ Def (sourcenode a')\" by fastforce\n from False \\slice_path as = x#xs\\ \\as = a'#as'\\\n \\last(targetnodes as) = n'\\ \\as' \\ []\\\n have \"\\ x\" by(auto simp:targetnodes_def)\n with ex have cases:\"ex = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n have \"state_val s V' \\ state_val s' V'\"\n proof(cases y)\n case True\n with ex' have [simp]:\"ex' = kind a'\" by simp\n from \\V' \\ Def (sourcenode a')\\ \\valid_edge a'\\ \\pred ex' s'\\\n have states_eq:\"state_val (transfer (kind a') s') V' = state_val s' V'\"\n by(fastforce intro:CFG_edge_no_Def_equal)\n from cases have \"state_val s V' = state_val (transfer ex s) V'\"\n by(cases \"kind a'\") auto\n with states_eq\n \\state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\\\n show ?thesis by simp\n next\n case False\n with ex' have \"ex' = (case kind a' of \\f \\ \\id | (Q)\\<^sub>\\ \\ (\\s. True)\\<^sub>\\)\"\n by simp\n with cases have \"state_val s V' = state_val (transfer ex s) V'\"\n and \"state_val s' V' = state_val (transfer ex' s') V'\"\n by(cases \"kind a'\",auto)+\n with \\state_val (transfer ex s) V' \\ state_val (transfer ex' s') V'\\ \n show ?thesis by simp\n qed\n from \\V' \\ Def (sourcenode a')\\ \n have \"\\ n -{V'}a'#xs'\\\\<^sub>d\\<^sub>d last(targetnodes (a'#xs'))\"\n by(auto elim:DynPDG_edge.cases simp:dyn_data_dependence_def)\n with \\(V',xs',as') \\ dependent_live_vars n'\\ \\last(targetnodes as) = n'\\\n \\as = a'#as'\\\n have \"(V',a'#xs',a'#as') \\ dependent_live_vars n'\"\n by(fastforce intro:dep_vars_Cons_keep)\n with \\as = a'#as'\\ all have \"state_val s V' = state_val s' V'\" by auto\n with \\state_val s V' \\ state_val s' V'\\ have False by simp\n thus ?thesis by simp\n qed\n qed\n qed\nqed simp_all\n\n\ntheorem fundamental_property_of_path_slicing:\n assumes \"n -as\\* n'\" and \"preds (kinds as) s\"\n shows \"(\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V = \n state_val (transfers (kinds as) s) V)\" \n and \"preds (slice_kinds as) s\"\nproof -\n have \"length as = length (slice_path as)\" by(simp add:slice_path_length)\n hence \"slice_path as \\\\<^sub>b replicate (length as) True\"\n by(simp add:maximal_element)\n have \"select_edge_kinds as (replicate (length as) True) = kinds as\"\n by(rule select_edge_kinds_max_bv)\n with \\n -as\\* n'\\ \\slice_path as \\\\<^sub>b replicate (length as) True\\\n \\preds (kinds as) s\\ \n have \"(\\V\\Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V) \\ preds (slice_kinds as) s\"\n by -(rule slice_path_leqs_information_same_Uses,simp_all add:slice_kinds_def)\n thus \"\\V\\Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V\" and \"preds (slice_kinds as) s\"\n by simp_all\nqed\n\nend\n\n\nsubsection \\The fundamental property of (dynamic) slicing related to the semantics\\\n\nlocale BackwardPathSlice_wf = \n DynPDG sourcenode targetnode kind valid_edge Entry Def Use state_val Exit \n dyn_control_dependence +\n CFG_semantics_wf sourcenode targetnode kind valid_edge Entry sem identifies\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ 'state edge_kind\" and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\ 'var set\"\n and Use :: \"'node \\ 'var set\" and state_val :: \"'state \\ 'var \\ 'val\"\n and dyn_control_dependence :: \"'node \\ 'node \\ 'edge list \\ bool\" \n (\"_ controls _ via _\" [51, 0, 0] 1000)\n and Exit :: \"'node\" (\"'('_Exit'_')\") \n and sem :: \"'com \\ 'state \\ 'com \\ 'state \\ bool\" \n (\"((1\\_,/_\\) \\/ (1\\_,/_\\))\" [0,0,0,0] 81)\n and identifies :: \"'node \\ 'com \\ bool\" (\"_ \\ _\" [51, 0] 80) \n\nbegin\n\ntheorem fundamental_property_of_path_slicing_semantically:\n assumes \"n \\ c\" and \"\\c,s\\ \\ \\c',s'\\\"\n obtains n' as where \"n -as\\* n'\" and \"preds (slice_kinds as) s\" \n and \"n' \\ c'\" \n and \"\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V = \n state_val s' V\"\nproof(atomize_elim)\n from \\n \\ c\\ \\\\c,s\\ \\ \\c',s'\\\\ obtain n' as where \"n -as\\* n'\"\n and \"transfers (kinds as) s = s'\"\n and \"preds (kinds as) s\"\n and \"n' \\ c'\"\n by(fastforce dest:fundamental_property)\n with \\n -as\\* n'\\ \\preds (kinds as) s\\ \n have \"\\V \\ Use n'. state_val (transfers (slice_kinds as) s) V =\n state_val (transfers (kinds as) s) V\" and \"preds (slice_kinds as) s\"\n by -(rule fundamental_property_of_path_slicing,simp_all)+\n with \\transfers (kinds as) s = s'\\ have \"\\V \\ Use n'. \n state_val (transfers (slice_kinds as) s) V =\n state_val s' V\" by simp\n with \\n -as\\* n'\\ \\preds (slice_kinds as) s\\ \\n' \\ c'\\\n show \"\\as n'. n -as\\* n' \\ preds (slice_kinds as) s \\ n' \\ c' \\\n (\\V\\Use n'. state_val (transfers (slice_kinds as) s) V = state_val s' V)\"\n by blast\nqed\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/Dynamic/DynSlice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2520554619551142}} {"text": "theory flash14Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_InvVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_InvAck_1_HomeVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_2VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_GetXVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_GetX )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Local_PutXAcksDoneVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_NakVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Nak_HomeVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Remote_GetX_NakVsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv14: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ReplaceHomeVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceShrVldVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ShWbVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_WbVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_GetVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_PutVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_PutXVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_ReplaceVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Remote_GetVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_I )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreVsInv14: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreHomeVsInv14: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv14 iInv1 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash14Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.25205546195511414}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Vanilla32_Preliminaries\nimports CTypes\nbegin\n\nsection \"Words and Pointers\"\n\ninstantiation unit :: c_type\nbegin\ninstance ..\nend\n\ndefinition \"unit_tag \\ TypDesc (TypScalar 1 0\n (\\ field_access = (\\v bs. [0]), field_update = (\\bs v. ())\\)) ''unit''\"\n\ndeclare unit_tag_def [simp]\n\noverloading typ_info_unit \\ typ_info_t begin\n definition typ_info_unit [simp]: \"typ_info_unit (x::unit itself) \\ unit_tag\"\nend\n\ninstantiation unit :: mem_type\nbegin\n definition\n to_bytes_unit :: \"unit \\ byte list\" where\n \"to_bytes_unit a \\ [0]\"\n\n definition\n from_bytes_unit :: \"byte list \\ unit\" where\n \"from_bytes_unit bs \\ ()\"\n\n definition\n size_of_unit :: \"unit itself \\ nat\" where\n \"size_of_unit x \\ 0\"\n\n definition\n align_of_unit :: \"unit itself \\ nat\" where\n \"align_of_unit x \\ 1\"\n\n instance\n apply intro_classes\n apply (auto simp: size_of_def align_of_def align_field_def addr_card\n wf_lf_def fd_cons_desc_def\n fd_cons_double_update_def fd_cons_update_access_def\n fd_cons_access_update_def fd_cons_length_def)\n done\nend\n\ndefinition\n \"bogus_log2lessthree (n::nat) ==\n if n = 128 then 4\n else if n = 64 then (3::nat)\n else if n = 32 then 2\n else if n = 16 then 1\n else if n = 8 then 0\n else undefined\"\ndefinition\n \"len_exp (x::('a::len) itself) \\ bogus_log2lessthree (len_of TYPE('a))\"\n\nlemma lx8' [simp] : \"len_exp (x::8 itself) = 0\"\nby (simp add: len_exp_def bogus_log2lessthree_def)\n\nlemma lx16' [simp]: \"len_exp (x::16 itself) = 1\"\nby (simp add: len_exp_def bogus_log2lessthree_def)\n\nlemma lx32' [simp]: \"len_exp (x::32 itself) = 2\"\nby (simp add: len_exp_def bogus_log2lessthree_def)\n\nlemma lx64' [simp]: \"len_exp (x::64 itself) = 3\"\nby (simp add: len_exp_def bogus_log2lessthree_def)\n\nlemma lx_signed' [simp]: \"len_exp (x::('a::len) signed itself) = len_exp (TYPE('a))\"\n by (simp add: len_exp_def)\n\nclass len8 = len +\n (* this constraint gives us (in the most convoluted way possible) that we're only\n interested in words with a length that is divisible by 8 *)\n assumes len8_bytes: \"len_of TYPE('a::len) = 8 * (2^len_exp TYPE('a))\"\n (* len8_len class gives us that the words are \\ than 128 bits.\n This is a wacky restriction really, but we're really only interested in words\n up to 64 bits, so who cares. *)\n assumes len8_width: \"len_of TYPE('a::len) \\ 128\"\nbegin\n\nlemma len8_size:\n \"len_of TYPE('a) div 8 < addr_card\"\n apply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply(simp add: addr_card)\n apply(rule len8_width)\n done\n\nlemma len8_dv8:\n \"8 dvd len_of TYPE('a)\"\n by (simp add: len8_bytes)\n\nlemma len8_pow:\n \"\\k. len_of TYPE('a) div 8 = 2^k\"\n by (simp add: len8_bytes)\n\nend\n\nfun\n nat_to_bin_string :: \"nat \\ char list\"\n where\n ntbs: \"nat_to_bin_string n = (if (n = 0) then ''0'' else (if n mod 2 = 1 then CHR ''1'' else CHR ''0'') # nat_to_bin_string (n div 2))\"\n\ndeclare nat_to_bin_string.simps [simp del]\n\nlemma nat_to_bin_string_simps:\n \"nat_to_bin_string 0 = ''0''\"\n \"n > 0 \\ nat_to_bin_string n =\n (if n mod 2 = 1 then CHR ''1'' else CHR ''0'') # nat_to_bin_string (n div 2)\"\n apply (induct n, auto simp: nat_to_bin_string.simps)\n done\n\ninstantiation word :: (len8) c_type\nbegin\ninstance ..\nend\n\ninstance signed :: (len8) len8\n apply intro_classes\n apply (metis len8_bytes len_exp_def len_signed)\n apply (metis len8_width len_signed)\n done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/c-parser/umm_heap/Vanilla32_Preliminaries.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804478040617, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.2520499436859717}} {"text": "header{*The Needham-Schroeder Public-Key Protocol against the General Attacker*}\n\ntheory NS_Public_Bad_GA imports PublicGA begin\n\ninductive_set ns_public :: \"event list set\"\n where\n\n Nil: \"[] \\ ns_public\"\n\n | Fake: \"\\evsf \\ ns_public; X \\ synth (analz (knows A evsf))\\\n \\ Says A B X # evsf \\ ns_public\"\n\n | Reception: \"\\ evsr \\ ns_public; Says A B X \\ set evsr \\\n \\ Gets B X # evsr \\ ns_public\"\n\n | NS1: \"\\evs1 \\ ns_public; Nonce NA \\ used evs1\\\n \\ Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\)\n # evs1 \\ ns_public\"\n\n | NS2: \"\\evs2 \\ ns_public; Nonce NB \\ used evs2;\n Gets B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs2\\\n \\ Says B A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\)\n # evs2 \\ ns_public\"\n\n | NS3: \"\\evs3 \\ ns_public;\n Says A B (Crypt (pubEK B) \\Nonce NA, Agent A\\) \\ set evs3;\n Gets A (Crypt (pubEK A) \\Nonce NA, Nonce NB\\) \\ set evs3\\\n \\ Says A B (Crypt (pubEK B) (Nonce NB)) # evs3 \\ ns_public\"\n\n\nlemma NS_no_Notes:\n \"evs \\ ns_public \\ Notes A X \\ set evs\"\napply (erule ns_public.induct)\napply (simp_all)\ndone\n\ntext{*Confidentiality treatment in separate theory file*}\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Inductive_Confidentiality/GeneralAttacker/NS_Public_Bad_GA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.25204993795877795}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: Termination.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\nsection {* Terminating Programs *}\n\ntheory Termination imports Semantic begin\n\nsubsection {* Inductive Characterisation: @{text \"\\\\c\\s\"}*}\n\ninductive \"terminates\"::\"('s,'p,'f) body \\ ('s,'p,'f) com \\ ('s,'f) xstate \\ bool\"\n (\"_\\_ \\ _\" [60,20,60] 89)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\\\Skip \\(Normal s)\"\n\n| Basic: \"\\\\Basic f \\(Normal s)\"\n\n| Spec: \"\\\\Spec r \\(Normal s)\"\n\n| Guard: \"\\s\\g; \\\\c\\(Normal s)\\ \n \\ \n \\\\Guard f g c\\(Normal s)\"\n\n| GuardFault: \"s\\g \n \\ \n \\\\Guard f g c\\(Normal s)\"\n\n\n| Fault [intro,simp]: \"\\\\c\\Fault f\" \n\n\n| Seq: \"\\\\\\c\\<^sub>1\\Normal s; \\s'. \\\\\\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2\\s'\\\n \\\n \\\\Seq c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n| CondTrue: \"\\s \\ b; \\\\c\\<^sub>1\\(Normal s)\\ \n \\ \n \\\\Cond b c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n\n| CondFalse: \"\\s \\ b; \\\\c\\<^sub>2\\(Normal s)\\ \n \\ \n \\\\Cond b c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n\n| WhileTrue: \"\\s \\ b; \\\\c\\(Normal s); \n \\s'. \\\\\\c,Normal s \\ \\ s' \\ \\\\While b c\\s'\\ \n \\ \n \\\\While b c\\(Normal s)\"\n\n| WhileFalse: \"\\s \\ b\\ \n \\ \n \\\\While b c\\(Normal s)\"\n\n| Call: \"\\\\ p=Some bdy;\\\\bdy\\(Normal s)\\ \n \\ \n \\\\Call p\\(Normal s)\"\n\n| CallUndefined: \"\\\\ p = None\\ \n \\ \n \\\\Call p\\(Normal s)\"\n\n| Stuck [intro,simp]: \"\\\\c\\Stuck\"\n \n| DynCom: \"\\\\\\(c s)\\(Normal s)\\ \n \\ \n \\\\DynCom c\\(Normal s)\"\n\n| Throw: \"\\\\Throw\\(Normal s)\"\n\n| Abrupt [intro,simp]: \"\\\\c\\Abrupt s\"\n\n| Catch: \"\\\\\\c\\<^sub>1\\Normal s; \n \\s'. \\\\\\c\\<^sub>1,Normal s \\ \\ Abrupt s' \\ \\\\c\\<^sub>2\\Normal s'\\\n \\\n \\\\Catch c\\<^sub>1 c\\<^sub>2\\Normal s\" \n\n\ninductive_cases terminates_elim_cases [cases set]:\n \"\\\\Skip \\ s\"\n \"\\\\Guard f g c \\ s\"\n \"\\\\Basic f \\ s\"\n \"\\\\Spec r \\ s\"\n \"\\\\Seq c1 c2 \\ s\"\n \"\\\\Cond b c1 c2 \\ s\"\n \"\\\\While b c \\ s\"\n \"\\\\Call p \\ s\"\n \"\\\\DynCom c \\ s\"\n \"\\\\Throw \\ s\"\n \"\\\\Catch c1 c2 \\ s\"\n\ninductive_cases terminates_Normal_elim_cases [cases set]:\n \"\\\\Skip \\ Normal s\"\n \"\\\\Guard f g c \\ Normal s\"\n \"\\\\Basic f \\ Normal s\"\n \"\\\\Spec r \\ Normal s\"\n \"\\\\Seq c1 c2 \\ Normal s\"\n \"\\\\Cond b c1 c2 \\ Normal s\"\n \"\\\\While b c \\ Normal s\"\n \"\\\\Call p \\ Normal s\"\n \"\\\\DynCom c \\ Normal s\"\n \"\\\\Throw \\ Normal s\"\n \"\\\\Catch c1 c2 \\ Normal s\"\n\nlemma terminates_Skip': \"\\\\Skip \\ s\"\n by (cases s) (auto intro: terminates.intros)\n\nlemma terminates_Call_body: \n \"\\ p=Some bdy\\\\\\Call p \\s = \\\\(the (\\ p))\\s\"\n by (cases s)\n (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n\nlemma terminates_Normal_Call_body: \n \"p \\ dom \\ \\\n \\\\Call p \\Normal s = \\\\(the (\\ p))\\Normal s\"\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n\nlemma terminates_implies_exec:\n assumes terminates: \"\\\\c\\s\"\n shows \"\\t. \\\\\\c,s\\ \\ t\"\nusing terminates\nproof (induct)\n case Skip thus ?case by (iprover intro: exec.intros)\nnext\n case Basic thus ?case by (iprover intro: exec.intros)\nnext\n case (Spec r s) thus ?case\n by (cases \"\\t. (s,t)\\ r\") (auto intro: exec.intros)\nnext\n case Guard thus ?case by (iprover intro: exec.intros)\nnext\n case GuardFault thus ?case by (iprover intro: exec.intros)\nnext\n case Fault thus ?case by (iprover intro: exec.intros)\nnext\n case Seq thus ?case by (iprover intro: exec_Seq')\nnext\n case CondTrue thus ?case by (iprover intro: exec.intros)\nnext\n case CondFalse thus ?case by (iprover intro: exec.intros)\nnext\n case WhileTrue thus ?case by (iprover intro: exec.intros)\nnext\n case WhileFalse thus ?case by (iprover intro: exec.intros)\nnext\n case (Call p bdy s) \n then obtain s' where \n \"\\\\\\bdy,Normal s \\ \\ s'\"\n by iprover\n moreover have \"\\ p = Some bdy\" by fact\n ultimately show ?case \n by (cases s') (iprover intro: exec.intros)+\nnext\n case CallUndefined thus ?case by (iprover intro: exec.intros)\nnext\n case Stuck thus ?case by (iprover intro: exec.intros)\nnext\n case DynCom thus ?case by (iprover intro: exec.intros)\nnext\n case Throw thus ?case by (iprover intro: exec.intros)\nnext\n case Abrupt thus ?case by (iprover intro: exec.intros) \nnext\n case (Catch c1 s c2) \n then obtain s' where exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n by iprover\n thus ?case\n proof (cases s')\n case (Normal s'')\n with exec_c1 show ?thesis by (auto intro!: exec.intros)\n next\n case (Abrupt s'')\n with exec_c1 Catch.hyps\n obtain t where \"\\\\\\c2,Normal s'' \\ \\ t\"\n by auto\n with exec_c1 Abrupt show ?thesis by (auto intro: exec.intros)\n next\n case Fault\n with exec_c1 show ?thesis by (auto intro!: exec.CatchMiss)\n next\n case Stuck\n with exec_c1 show ?thesis by (auto intro!: exec.CatchMiss)\n qed\nqed\n\nlemma terminates_block: \n\"\\\\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\\n \\ \\\\block init bdy return c \\ Normal s\"\napply (unfold block_def)\napply (fastforce intro: terminates.intros elim!: exec_Normal_elim_cases \n dest!: not_isAbrD)\ndone\n\nlemma terminates_block_elim [cases set, consumes 1]:\nassumes termi: \"\\\\block init bdy return c \\ Normal s\"\nassumes e: \"\\\\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\n \\ \\ P\"\nshows P\nproof -\n have \"\\\\\\Basic init,Normal s\\ \\ Normal (init s)\"\n by (auto intro: exec.intros)\n with termi\n have \"\\\\bdy \\ Normal (init s)\"\n apply (unfold block_def)\n apply (elim terminates_Normal_elim_cases)\n by simp\n moreover\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\" \n have \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy \n have \"\\\\\\Catch (Seq (Basic init) bdy) \n (Seq (Basic (return s)) Throw),Normal s\\ \\ Normal t\"\n by (fastforce intro: exec.intros)\n with termi have \"\\\\DynCom (\\t. Seq (Basic (return s)) (c s t)) \\ Normal t\"\n apply (unfold block_def)\n apply (elim terminates_Normal_elim_cases)\n by simp\n thus ?thesis\n apply (elim terminates_Normal_elim_cases)\n apply (auto intro: exec.intros)\n done\n qed\n }\n ultimately show P by (iprover intro: e)\nqed\n\n\nlemma terminates_call: \n\"\\\\ p = Some bdy; \\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\\n \\ \\\\call init p return c \\ Normal s\"\n apply (unfold call_def)\n apply (rule terminates_block)\n apply (iprover intro: terminates.intros)\n apply (auto elim: exec_Normal_elim_cases)\n done\n\nlemma terminates_callUndefined: \n\"\\\\ p = None\\\n \\ \\\\call init p return result \\ Normal s\"\n apply (unfold call_def)\n apply (rule terminates_block)\n apply (iprover intro: terminates.intros)\n apply (auto elim: exec_Normal_elim_cases)\n done\n\nlemma terminates_call_elim [cases set, consumes 1]:\nassumes termi: \"\\\\call init p return c \\ Normal s\"\nassumes bdy: \"\\bdy. \\\\ p = Some bdy; \\\\bdy \\ Normal (init s); \n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\ \\ P\"\nassumes undef: \"\\\\ p = None\\ \\ P\" \nshows P\napply (cases \"\\ p\")\napply (erule undef)\nusing termi\napply (unfold call_def)\napply (erule terminates_block_elim)\napply (erule terminates_Normal_elim_cases)\napply simp\napply (frule (1) bdy)\napply (fastforce intro: exec.intros)\napply assumption\napply simp\ndone\n\nlemma terminates_dynCall: \n\"\\\\\\call init (p s) return c \\ Normal s\\\n \\ \\\\dynCall init p return c \\ Normal s\"\n apply (unfold dynCall_def)\n apply (auto intro: terminates.intros terminates_call)\n done\n\nlemma terminates_dynCall_elim [cases set, consumes 1]:\nassumes termi: \"\\\\dynCall init p return c \\ Normal s\"\nassumes \"\\\\\\call init (p s) return c \\ Normal s\\ \\ P\"\nshows P\nusing termi\napply (unfold dynCall_def)\napply (elim terminates_Normal_elim_cases)\napply fact\ndone\n\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"sequence\"}, @{const \"flatten\"} and \n @{const \"normalize\"} *}\n(* ************************************************************************ *)\n\nlemma terminates_sequence_app: \n \"\\s. \\\\\\sequence Seq xs \\ Normal s;\n \\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\\\n\\ \\\\sequence Seq (xs @ ys) \\ Normal s\"\nproof (induct xs)\n case Nil\n thus ?case by (auto intro: exec.intros)\nnext\n case (Cons x xs)\n have termi_x_xs: \"\\\\sequence Seq (x # xs) \\ Normal s\" by fact\n have termi_ys: \"\\s'. \\\\\\sequence Seq (x # xs),Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\" by fact\n show ?case\n proof (cases xs)\n case Nil\n with termi_x_xs termi_ys show ?thesis\n by (cases ys) (auto intro: terminates.intros)\n next\n case Cons\n from termi_x_xs Cons \n have \"\\\\x \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n moreover \n {\n fix s'\n assume exec_x: \"\\\\\\x,Normal s \\ \\ s'\" \n have \"\\\\sequence Seq (xs @ ys) \\ s'\"\n proof -\n from exec_x termi_x_xs Cons\n have termi_xs: \"\\\\sequence Seq xs \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n show ?thesis\n proof (cases s')\n case (Normal s'')\n with exec_x termi_ys Cons \n have \"\\s'. \\\\\\sequence Seq xs,Normal s'' \\ \\ s' \\ \\\\sequence Seq ys \\ s'\"\n by (auto intro: exec.intros)\n from Cons.hyps [OF termi_xs [simplified Normal] this]\n have \"\\\\sequence Seq (xs @ ys) \\ Normal s''\".\n with Normal show ?thesis by simp\n next\n case Abrupt thus ?thesis by (auto intro: terminates.intros)\n next\n case Fault thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n }\n ultimately show ?thesis\n using Cons\n by (auto intro: terminates.intros)\n qed\nqed\n\nlemma terminates_sequence_appD: \n \"\\s. \\\\sequence Seq (xs @ ys) \\ Normal s\n \\ \\\\sequence Seq xs \\ Normal s \\\n (\\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s')\"\nproof (induct xs)\n case Nil\n thus ?case \n by (auto elim: terminates_Normal_elim_cases exec_Normal_elim_cases \n intro: terminates.intros)\nnext\n case (Cons x xs)\n have termi_x_xs_ys: \"\\\\sequence Seq ((x # xs) @ ys) \\ Normal s\" by fact\n show ?case\n proof (cases xs)\n case Nil\n with termi_x_xs_ys show ?thesis\n by (cases ys)\n (auto elim: terminates_Normal_elim_cases exec_Normal_elim_cases \n intro: terminates_Skip')\n next\n case Cons\n with termi_x_xs_ys \n obtain termi_x: \"\\\\x \\ Normal s\" and\n termi_xs_ys: \"\\s'. \\\\\\x,Normal s \\ \\ s' \\ \\\\sequence Seq (xs@ys) \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n \n have \"\\\\Seq x (sequence Seq xs) \\ Normal s\"\n proof (rule terminates.Seq [rule_format])\n show \"\\\\x \\ Normal s\" by (rule termi_x)\n next\n fix s'\n assume exec_x: \"\\\\\\x,Normal s \\ \\ s'\"\n show \"\\\\sequence Seq xs \\ s'\"\n proof -\n from termi_xs_ys [rule_format, OF exec_x]\n have termi_xs_ys': \"\\\\sequence Seq (xs@ys) \\ s'\" .\n show ?thesis\n proof (cases s')\n case (Normal s'')\n from Cons.hyps [OF termi_xs_ys' [simplified Normal]]\n show ?thesis\n using Normal by auto\n next\n case Abrupt thus ?thesis by (auto intro: terminates.intros)\n next\n case Fault thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n qed\n moreover\n {\n fix s'\n assume exec_x_xs: \"\\\\\\Seq x (sequence Seq xs),Normal s \\ \\ s'\"\n have \"\\\\sequence Seq ys \\ s'\"\n proof -\n from exec_x_xs obtain t where \n exec_x: \"\\\\\\x,Normal s \\ \\ t\" and\n exec_xs: \"\\\\\\sequence Seq xs,t \\ \\ s'\"\n by cases\n show ?thesis\n proof (cases t)\n case (Normal t')\n with exec_x termi_xs_ys have \"\\\\sequence Seq (xs@ys) \\ Normal t'\"\n by auto\n from Cons.hyps [OF this] exec_xs Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n with exec_xs have \"s'=Abrupt t'\"\n by (auto dest: Abrupt_end)\n thus ?thesis by (auto intro: terminates.intros)\n next\n case (Fault f)\n with exec_xs have \"s'=Fault f\"\n by (auto dest: Fault_end)\n thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck\n with exec_xs have \"s'=Stuck\"\n by (auto dest: Stuck_end)\n thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n }\n ultimately show ?thesis\n using Cons\n by auto\n qed\nqed\n\nlemma terminates_sequence_appE [consumes 1]:\n \"\\\\\\sequence Seq (xs @ ys) \\ Normal s;\n \\\\\\sequence Seq xs \\ Normal s;\n \\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\\ \\ P\\\n \\ P\"\n by (auto dest: terminates_sequence_appD)\n\nlemma terminates_to_terminates_sequence_flatten: \n assumes termi: \"\\\\c\\s\" \n shows \"\\\\sequence Seq (flatten c)\\s\" \nusing termi \nby (induct)\n (auto intro: terminates.intros terminates_sequence_app \n exec_sequence_flatten_to_exec)\n\nlemma terminates_to_terminates_normalize: \n assumes termi: \"\\\\c\\s\" \n shows \"\\\\normalize c\\s\" \nusing termi \nproof induct\n case Seq\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nnext\n case WhileTrue\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nnext \n case Catch\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nqed (auto intro: terminates.intros)\n\nlemma terminates_sequence_flatten_to_terminates: \n shows \"\\s. \\\\sequence Seq (flatten c)\\s \\ \\\\c\\s\" \nproof (induct c)\n case (Seq c1 c2)\n have \"\\\\sequence Seq (flatten (Seq c1 c2)) \\ s\" by fact\n hence termi_app: \"\\\\sequence Seq (flatten c1 @ flatten c2) \\ s\" by simp\n show ?case\n proof (cases s)\n case (Normal s')\n have \"\\\\Seq c1 c2 \\ Normal s'\"\n proof (rule terminates.Seq [rule_format])\n from termi_app [simplified Normal]\n have \"\\\\sequence Seq (flatten c1) \\ Normal s'\"\n by (cases rule: terminates_sequence_appE)\n with Seq.hyps\n show \"\\\\c1 \\ Normal s'\"\n by simp\n next\n fix s''\n assume \"\\\\\\c1,Normal s' \\ \\ s''\"\n from termi_app [simplified Normal] exec_to_exec_sequence_flatten [OF this]\n have \"\\\\sequence Seq (flatten c2) \\ s''\"\n by (cases rule: terminates_sequence_appE) auto\n with Seq.hyps\n show \"\\\\c2 \\ s''\"\n by simp\n qed\n with Normal show ?thesis\n by simp\n qed (auto intro: terminates.intros)\nqed (auto intro: terminates.intros)\n\nlemma terminates_normalize_to_terminates: \n shows \"\\s. \\\\normalize c\\s \\ \\\\c\\s\" \nproof (induct c)\n case Skip thus ?case by (auto intro: terminates_Skip')\nnext\n case Basic thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case (Seq c1 c2)\n have \"\\\\normalize (Seq c1 c2) \\ s\" by fact\n hence termi_app: \"\\\\sequence Seq (flatten (normalize c1) @ flatten (normalize c2)) \\ s\"\n by simp\n show ?case\n proof (cases s)\n case (Normal s')\n have \"\\\\Seq c1 c2 \\ Normal s'\"\n proof (rule terminates.Seq [rule_format])\n from termi_app [simplified Normal]\n have \"\\\\sequence Seq (flatten (normalize c1)) \\ Normal s'\"\n by (cases rule: terminates_sequence_appE)\n from terminates_sequence_flatten_to_terminates [OF this] Seq.hyps\n show \"\\\\c1 \\ Normal s'\" \n by simp\n next\n fix s''\n assume \"\\\\\\c1,Normal s' \\ \\ s''\"\n from exec_to_exec_normalize [OF this]\n have \"\\\\\\normalize c1,Normal s' \\ \\ s''\" .\n from termi_app [simplified Normal] exec_to_exec_sequence_flatten [OF this] \n have \"\\\\sequence Seq (flatten (normalize c2)) \\ s''\"\n by (cases rule: terminates_sequence_appE) auto\n from terminates_sequence_flatten_to_terminates [OF this] Seq.hyps\n show \"\\\\c2 \\ s''\" \n by simp\n qed\n with Normal show ?thesis by simp\n qed (auto intro: terminates.intros)\nnext\n case (Cond b c1 c2) \n thus ?case\n by (cases s)\n (auto intro: terminates.intros elim!: terminates_Normal_elim_cases)\nnext\n case (While b c)\n have \"\\\\normalize (While b c) \\ s\" by fact\n hence termi_norm_w: \"\\\\While b (normalize c) \\ s\" by simp\n {\n fix t w\n assume termi_w: \"\\\\ w \\ t\"\n have \"w=While b (normalize c) \\ \\\\While b c \\ t\"\n using termi_w \n proof (induct)\n case (WhileTrue t' b' c')\n from WhileTrue obtain\n t'_b: \"t' \\ b\" and\n termi_norm_c: \"\\\\normalize c \\ Normal t'\" and\n termi_norm_w': \"\\s'. \\\\\\normalize c,Normal t' \\ \\ s' \\ \\\\While b c \\ s'\"\n by auto\n from While.hyps [OF termi_norm_c]\n have \"\\\\c \\ Normal t'\".\n moreover\n from termi_norm_w' \n have \"\\s'. \\\\\\c,Normal t' \\ \\ s' \\ \\\\While b c \\ s'\"\n by (auto intro: exec_to_exec_normalize)\n ultimately show ?case\n using t'_b\n by (auto intro: terminates.intros)\n qed (auto intro: terminates.intros)\n }\n from this [OF termi_norm_w]\n show ?case \n by auto\nnext\n case Call thus ?case by simp\nnext\n case DynCom thus ?case \n by (cases s) (auto intro: terminates.intros rangeI elim: terminates_Normal_elim_cases)\nnext\n case Guard thus ?case \n by (cases s) (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case Throw thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case Catch\n thus ?case\n by (cases s) \n (auto dest: exec_to_exec_normalize elim!: terminates_Normal_elim_cases \n intro!: terminates.Catch)\nqed\n\nlemma terminates_iff_terminates_normalize:\n\"\\\\normalize c\\s = \\\\c\\s\"\n by (auto intro: terminates_to_terminates_normalize \n terminates_normalize_to_terminates)\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"strip_guards\"} *}\n(* ************************************************************************* *)\n\nlemma terminates_strip_guards_to_terminates: \"\\s. \\\\strip_guards F c\\s \\ \\\\c\\s\"\nproof (induct c)\n case Skip thus ?case by simp\nnext\n case Basic thus ?case by simp\nnext\n case Spec thus ?case by simp\nnext\n case (Seq c1 c2)\n hence \"\\\\Seq (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Seq c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume s: \"s=Normal s'\"\n assume \"\\\\strip_guards F c1 \\ Normal s'\"\n hence \"\\\\c1 \\ Normal s'\" \n by (rule Seq.hyps)\n moreover\n assume c2: \n \"\\s''. \\\\\\strip_guards F c1,Normal s'\\ \\ s'' \\ \\\\strip_guards F c2\\s''\"\n {\n fix s'' assume exec_c1: \"\\\\\\c1,Normal s' \\ \\ s''\"\n have \" \\\\c2 \\ s''\"\n proof (cases s'')\n case (Normal s''')\n with exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ s''\"\n by (auto intro: exec_to_exec_strip_guards)\n with c2\n show ?thesis\n by (iprover intro: Seq.hyps)\n next\n case (Abrupt s''')\n with exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ s''\"\n by (auto intro: exec_to_exec_strip_guards )\n with c2\n show ?thesis\n by (iprover intro: Seq.hyps)\n next\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n qed\n }\n ultimately show ?thesis\n using s\n by (iprover intro: terminates.intros)\n qed\nnext\n case (Cond b c1 c2)\n hence \"\\\\Cond b (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Cond b c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume \"s'\\b\" \"\\\\strip_guards F c1 \\ Normal s'\" \"s = Normal s'\"\n thus ?thesis\n by (iprover intro: terminates.intros Cond.hyps)\n next\n fix s'\n assume \"s'\\b\" \"\\\\strip_guards F c2 \\ Normal s'\" \"s = Normal s'\"\n thus ?thesis\n by (iprover intro: terminates.intros Cond.hyps)\n qed\nnext\n case (While b c)\n have hyp_c: \"\\s. \\\\strip_guards F c \\ s \\ \\\\c \\ s\" by fact\n have \"\\\\While b (strip_guards F c) \\ s\" using While.prems by simp\n moreover\n {\n fix sw \n assume \"\\\\sw\\s\" \n then have \"sw=While b (strip_guards F c) \\ \n \\\\While b c \\ s\"\n proof (induct)\n case (WhileTrue s b' c')\n have eqs: \"While b' c' = While b (strip_guards F c)\" by fact\n with `s\\b'` have b: \"s\\b\" by simp\n from eqs `\\\\c' \\ Normal s` have \"\\\\strip_guards F c \\ Normal s\"\n by simp\n hence term_c: \"\\\\c \\ Normal s\"\n by (rule hyp_c)\n moreover\n {\n fix t\n assume exec_c: \"\\\\\\c,Normal s \\ \\ t\"\n have \"\\\\While b c \\ t\"\n proof (cases t)\n case Fault\n thus ?thesis by simp\n next\n case Stuck\n thus ?thesis by simp\n next\n case (Abrupt t')\n thus ?thesis by simp\n next\n case (Normal t')\n with exec_c\n have \"\\\\\\strip_guards F c,Normal s \\ \\ Normal t'\"\n by (auto intro: exec_to_exec_strip_guards)\n with WhileTrue.hyps eqs Normal\n show ?thesis\n by fastforce\n qed\n }\n ultimately\n show ?case\n using b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed simp_all\n } \n ultimately show \"\\\\While b c \\ s\"\n by auto\nnext\n case Call thus ?case by simp\nnext\n case DynCom thus ?case \n by (cases s) (auto elim: terminates_Normal_elim_cases intro: terminates.intros rangeI)\nnext\n case Guard \n thus ?case\n by (cases s) (auto elim: terminates_Normal_elim_cases intro: terminates.intros\n split: if_split_asm)\nnext\n case Throw thus ?case by simp\nnext\n case (Catch c1 c2)\n hence \"\\\\Catch (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Catch c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume s: \"s=Normal s'\"\n assume \"\\\\strip_guards F c1 \\ Normal s'\"\n hence \"\\\\c1 \\ Normal s'\" \n by (rule Catch.hyps)\n moreover\n assume c2: \n \"\\s''. \\\\\\strip_guards F c1,Normal s'\\ \\ Abrupt s'' \n \\ \\\\strip_guards F c2\\Normal s''\"\n {\n fix s'' assume exec_c1: \"\\\\\\c1,Normal s' \\ \\ Abrupt s''\"\n have \" \\\\c2 \\ Normal s''\"\n proof -\n from exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ Abrupt s''\"\n by (auto intro: exec_to_exec_strip_guards)\n with c2 \n show ?thesis\n by (auto intro: Catch.hyps)\n qed\n }\n ultimately show ?thesis\n using s\n by (iprover intro: terminates.intros)\n qed\nqed\n\nlemma terminates_strip_to_terminates:\n assumes termi_strip: \"strip F \\\\c\\s\"\n shows \"\\\\c\\s\"\nusing termi_strip\nproof induct\n case (Seq c1 s c2)\n have \"\\\\c1 \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c1,Normal s\\ \\ s'\"\n have \"\\\\c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_strip [OF exec this] Seq.hyps\n show ?thesis\n by auto\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case (WhileTrue s b c)\n have \"\\\\c \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_strip [OF exec this] WhileTrue.hyps\n show ?thesis\n by auto\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have \"\\\\c1 \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c1,Normal s\\ \\ Abrupt s'\"\n from exec_to_exec_strip [OF exec] Catch.hyps\n have \"\\\\c2 \\ Normal s'\"\n by auto\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case Call thus ?case \n by (auto intro: terminates.intros terminates_strip_guards_to_terminates)\nqed (auto intro: terminates.intros)\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{term \"c\\<^sub>1 \\\\<^sub>g c\\<^sub>2\"} *}\n(* ************************************************************************* *)\n\nlemma inter_guards_terminates: \n \"\\c c2 s. \\(c1 \\\\<^sub>g c2) = Some c; \\\\c1\\s \\\n \\ \\\\c\\s\"\nproof (induct c1)\n case Skip thus ?case by (fastforce simp add: inter_guards_Skip)\nnext\n case (Basic f) thus ?case by (fastforce simp add: inter_guards_Basic)\nnext\n case (Spec r) thus ?case by (fastforce simp add: inter_guards_Spec)\nnext\n case (Seq a1 a2)\n have \"(Seq a1 a2 \\\\<^sub>g c2) = Some c\" by fact\n then obtain b1 b2 d1 d2 where\n c2: \"c2=Seq b1 b2\" and \n d1: \"(a1 \\\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\\\<^sub>g b2) = Some d2\" and\n c: \"c=Seq d1 d2\"\n by (auto simp add: inter_guards_Seq)\n have termi_c1: \"\\\\Seq a1 a2 \\ s\" by fact\n have \"\\\\Seq d1 d2 \\ s\"\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n note Normal_s = this\n with d1 termi_c1\n have \"\\\\d1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases intro: Seq.hyps)\n moreover\n {\n fix t\n assume exec_d1: \"\\\\\\d1,Normal s' \\ \\ t\"\n have \"\\\\d2 \\ t\"\n proof (cases t)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal t')\n with inter_guards_exec_noFault [OF d1 exec_d1]\n have \"\\\\\\a1,Normal s' \\ \\ Normal t'\"\n by simp\n with termi_c1 Normal_s have \"\\\\a2 \\ Normal t'\"\n by (auto elim: terminates_Normal_elim_cases) \n with d2 have \"\\\\d2 \\ Normal t'\"\n by (auto intro: Seq.hyps)\n with Normal show ?thesis by simp \n qed\n }\n ultimately have \"\\\\Seq d1 d2 \\ Normal s'\"\n by (fastforce intro: terminates.intros)\n with Normal show ?thesis by simp\n qed\n with c show ?case by simp\nnext\n case Cond thus ?case\n by - (cases s,\n auto intro: terminates.intros elim!: terminates_Normal_elim_cases\n simp add: inter_guards_Cond)\nnext\n case (While b bdy1)\n have \"(While b bdy1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain bdy2 bdy where\n c2: \"c2=While b bdy2\" and\n bdy: \"(bdy1 \\\\<^sub>g bdy2) = Some bdy\" and\n c: \"c=While b bdy\"\n by (auto simp add: inter_guards_While)\n have \"\\\\While b bdy1 \\ s\" by fact\n moreover\n {\n fix s w w1 w2\n assume termi_w: \"\\\\w \\ s\"\n assume w: \"w=While b bdy1\"\n from termi_w w \n have \"\\\\While b bdy \\ s\" \n proof (induct)\n case (WhileTrue s b' bdy1')\n have eqs: \"While b' bdy1' = While b bdy1\" by fact\n from WhileTrue have s_in_b: \"s \\ b\" by simp\n from WhileTrue have termi_bdy1: \"\\\\bdy1 \\ Normal s\" by simp\n show ?case\n proof -\n from bdy termi_bdy1 \n have \"\\\\bdy\\(Normal s)\"\n by (rule While.hyps)\n moreover\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal s \\ \\ t\" \n have \"\\\\While b bdy\\t\"\n proof (cases t)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal t')\n with inter_guards_exec_noFault [OF bdy exec_bdy]\n have \"\\\\\\bdy1,Normal s \\ \\ Normal t'\"\n by simp\n with WhileTrue have \"\\\\While b bdy \\ Normal t'\"\n by simp\n with Normal show ?thesis by simp\n qed\n }\n ultimately show ?thesis\n using s_in_b \n by (blast intro: terminates.WhileTrue)\n qed\n next\n case WhileFalse thus ?case \n by (blast intro: terminates.WhileFalse)\n qed (simp_all)\n }\n ultimately\n show ?case using c by simp\nnext\n case Call thus ?case by (simp add: inter_guards_Call)\nnext\n case (DynCom f1) \n have \"(DynCom f1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain f2 f where\n c2: \"c2=DynCom f2\" and\n f_defined: \"\\s. ((f1 s) \\\\<^sub>g (f2 s)) \\ None\" and\n c: \"c=DynCom (\\s. the ((f1 s) \\\\<^sub>g (f2 s)))\"\n by (auto simp add: inter_guards_DynCom)\n have termi: \"\\\\DynCom f1 \\ s\" by fact\n show ?case\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n from f_defined obtain f where f: \"((f1 s') \\\\<^sub>g (f2 s')) = Some f\"\n by auto\n from Normal termi\n have \"\\\\f1 s'\\ (Normal s')\"\n by (auto elim: terminates_Normal_elim_cases)\n from DynCom.hyps f this \n have \"\\\\f\\ (Normal s')\"\n by blast\n with c f Normal\n show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Guard f g1 bdy1)\n have \"(Guard f g1 bdy1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain g2 bdy2 bdy where\n c2: \"c2=Guard f g2 bdy2\" and\n bdy: \"(bdy1 \\\\<^sub>g bdy2) = Some bdy\" and\n c: \"c=Guard f (g1 \\ g2) bdy\"\n by (auto simp add: inter_guards_Guard)\n have termi_c1: \"\\\\Guard f g1 bdy1 \\ s\" by fact\n show ?case\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n show ?thesis\n proof (cases \"s' \\ g1\")\n case False\n with Normal c show ?thesis by (auto intro: terminates.GuardFault)\n next\n case True\n note s_in_g1 = this\n show ?thesis\n proof (cases \"s' \\ g2\")\n case False\n with Normal c show ?thesis by (auto intro: terminates.GuardFault)\n next\n case True\n with termi_c1 s_in_g1 Normal have \"\\\\bdy1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n with c bdy Guard.hyps Normal True s_in_g1 \n show ?thesis by (auto intro: terminates.Guard)\n qed\n qed\n qed\nnext\n case Throw thus ?case\n by (auto simp add: inter_guards_Throw)\nnext\n case (Catch a1 a2)\n have \"(Catch a1 a2 \\\\<^sub>g c2) = Some c\" by fact\n then obtain b1 b2 d1 d2 where\n c2: \"c2=Catch b1 b2\" and \n d1: \"(a1 \\\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\\\<^sub>g b2) = Some d2\" and\n c: \"c=Catch d1 d2\"\n by (auto simp add: inter_guards_Catch)\n have termi_c1: \"\\\\Catch a1 a2 \\ s\" by fact\n have \"\\\\Catch d1 d2 \\ s\"\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n note Normal_s = this\n with d1 termi_c1\n have \"\\\\d1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases intro: Catch.hyps)\n moreover\n {\n fix t\n assume exec_d1: \"\\\\\\d1,Normal s' \\ \\ Abrupt t\"\n have \"\\\\d2 \\ Normal t\"\n proof -\n from inter_guards_exec_noFault [OF d1 exec_d1]\n have \"\\\\\\a1,Normal s' \\ \\ Abrupt t\"\n by simp\n with termi_c1 Normal_s have \"\\\\a2 \\ Normal t\"\n by (auto elim: terminates_Normal_elim_cases) \n with d2 have \"\\\\d2 \\ Normal t\"\n by (auto intro: Catch.hyps)\n with Normal show ?thesis by simp \n qed\n }\n ultimately have \"\\\\Catch d1 d2 \\ Normal s'\"\n by (fastforce intro: terminates.intros)\n with Normal show ?thesis by simp\n qed\n with c show ?case by simp\nqed\n\nlemma inter_guards_terminates': \n assumes c: \"(c1 \\\\<^sub>g c2) = Some c\" \n assumes termi_c2: \"\\\\c2\\s\"\n shows \"\\\\c\\s\"\nproof -\n from c have \"(c2 \\\\<^sub>g c1) = Some c\" \n by (rule inter_guards_sym)\n from this termi_c2 show ?thesis\n by (rule inter_guards_terminates)\nqed\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"mark_guards\"} *}\n(* ************************************************************************ *)\n\nlemma terminates_to_terminates_mark_guards:\n assumes termi: \"\\\\c\\s\" \n shows \"\\\\mark_guards f c\\s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case Guard thus ?case by (fastforce intro: terminates.intros)\nnext\n case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n case Fault thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 s c2)\n have \"\\\\mark_guards f c1 \\ Normal s\" by fact\n moreover \n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c1,Normal s \\ \\ t\"\n have \"\\\\mark_guards f c2 \\ t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c1,Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = t\" and\n t'_Fault: \"isFault t' \\ isFault t\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault t\" by simp\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n with t'_noFault have \"t'=t\" by simp\n with exec_c1 Seq.hyps\n show ?thesis\n by auto\n qed\n qed \n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case CondTrue thus ?case by (fastforce intro: terminates.intros)\nnext\n case CondFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have \"\\\\mark_guards f c \\ Normal s\" by fact\n moreover \n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c,Normal s \\ \\ t\"\n have \"\\\\mark_guards f (While b c) \\ t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c,Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = t\" and\n t'_Fault: \"isFault t' \\ isFault t\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault t\" by simp\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n with t'_noFault have \"t'=t\" by simp\n with exec_c1 WhileTrue.hyps\n show ?thesis\n by auto\n qed\n qed \n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case WhileFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n case Call thus ?case by (fastforce intro: terminates.intros)\nnext\n case CallUndefined thus ?case by (fastforce intro: terminates.intros)\nnext\n case Stuck thus ?case by (fastforce intro: terminates.intros)\nnext\n case DynCom thus ?case by (fastforce intro: terminates.intros)\nnext\n case Throw thus ?case by (fastforce intro: terminates.intros)\nnext\n case Abrupt thus ?case by (fastforce intro: terminates.intros)\nnext \n case (Catch c1 s c2) \n have \"\\\\mark_guards f c1 \\ Normal s\" by fact\n moreover \n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c1,Normal s \\ \\ Abrupt t\"\n have \"\\\\mark_guards f c2 \\ Normal t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c1,Normal s \\ \\ t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = Abrupt t\" and\n t'_Fault: \"isFault t' \\ isFault (Abrupt t)\" and\n t'_noFault: \"\\ isFault t' \\ t' = Abrupt t\"\n by fastforce\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault (Abrupt t)\" by simp\n thus ?thesis by simp\n next\n case False\n with t'_noFault have \"t'=Abrupt t\" by simp\n with exec_c1 Catch.hyps\n show ?thesis\n by auto\n qed\n qed \n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nqed\n\nlemma terminates_mark_guards_to_terminates_Normal:\n \"\\s. \\\\mark_guards f c\\Normal s \\ \\\\c\\Normal s\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 c2) \n have \"\\\\mark_guards f (Seq c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\mark_guards f c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\mark_guards f c1,Normal s \\ \\ s' \\ \n \\\\mark_guards f c2 \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Seq.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n have \"\\\\ c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_mark_guards [OF exec_c1 False] \n have \"\\\\\\mark_guards f c1,Normal s \\ \\ s'\" .\n from termi_merge_c2 [rule_format, OF this] Seq.hyps\n show ?thesis\n by (cases s') (auto)\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nnext\n case Cond thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (While b c)\n {\n fix u c'\n assume termi_c': \"\\\\c' \\ Normal u\"\n assume c': \"c' = mark_guards f (While b c)\"\n have \"\\\\While b c \\ Normal u\"\n using termi_c' c'\n proof (induct)\n case (WhileTrue s b' c')\n have s_in_b: \"s \\ b\" using WhileTrue by simp\n have \"\\\\mark_guards f c \\ Normal s\"\n using WhileTrue by (auto elim: terminates_Normal_elim_cases)\n with While.hyps have \"\\\\c \\ Normal s\"\n by auto\n moreover\n have hyp_w: \"\\w. \\\\\\mark_guards f c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n using WhileTrue by simp\n hence \"\\w. \\\\\\c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n apply -\n apply (rule allI)\n apply (case_tac \"w\")\n apply (auto dest: exec_to_exec_mark_guards)\n done\n ultimately show ?case\n using s_in_b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros) \n qed auto\n }\n with While show ?case by simp\nnext\n case Call thus ?case \n by (fastforce intro: terminates.intros )\nnext\n case DynCom thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (Guard f g c)\n thus ?case by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case Throw thus ?case \n by (fastforce intro: terminates.intros )\nnext\n case (Catch c1 c2) \n have \"\\\\mark_guards f (Catch c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\mark_guards f c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\mark_guards f c1,Normal s \\ \\ Abrupt s' \\ \n \\\\mark_guards f c2 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Catch.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\ c2 \\ Normal s'\"\n proof -\n from exec_to_exec_mark_guards [OF exec_c1] \n have \"\\\\\\mark_guards f c1,Normal s \\ \\ Abrupt s'\" by simp\n from termi_merge_c2 [rule_format, OF this] Catch.hyps\n show ?thesis\n by iprover\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nqed\n\nlemma terminates_mark_guards_to_terminates:\n \"\\\\mark_guards f c\\s \\ \\\\c\\ s\"\n by (cases s) (auto intro: terminates_mark_guards_to_terminates_Normal)\n\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"merge_guards\"} *}\n(* ************************************************************************ *)\n\nlemma terminates_to_terminates_merge_guards:\n assumes termi: \"\\\\c\\s\" \n shows \"\\\\merge_guards c\\s\"\nusing termi\nproof (induct)\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have termi_merge_c: \"\\\\merge_guards c \\ Normal s\" by fact\n show ?case\n proof (cases \"\\f' g' c'. merge_guards c = Guard f' g' c'\")\n case False\n hence \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (cases \"merge_guards c\") (auto simp add: Let_def)\n with s_in_g termi_merge_c show ?thesis\n by (auto intro: terminates.intros)\n next\n case True\n then obtain f' g' c' where \n mc: \"merge_guards c = Guard f' g' c'\"\n by blast\n show ?thesis\n proof (cases \"f=f'\")\n case False\n with mc have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (simp add: Let_def)\n with s_in_g termi_merge_c show ?thesis\n by (auto intro: terminates.intros)\n next\n case True\n with mc have \"merge_guards (Guard f g c) = Guard f (g \\ g') c'\"\n by simp\n with s_in_g mc True termi_merge_c\n show ?thesis\n by (cases \"s \\ g'\")\n (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\n qed\n qed\nnext\n case (GuardFault s g f c)\n have \"s \\ g\" by fact\n thus ?case\n by (cases \"merge_guards c\")\n (auto intro: terminates.intros split: if_split_asm simp add: Let_def)\nqed (fastforce intro: terminates.intros dest: exec_merge_guards_to_exec)+\n\nlemma terminates_merge_guards_to_terminates_Normal:\n shows \"\\s. \\\\merge_guards c\\Normal s \\ \\\\c\\Normal s\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 c2) \n have \"\\\\merge_guards (Seq c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\merge_guards c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\merge_guards c1,Normal s \\ \\ s' \\ \n \\\\merge_guards c2 \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Seq.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n have \"\\\\ c2 \\ s'\"\n proof -\n from exec_to_exec_merge_guards [OF exec_c1] \n have \"\\\\\\merge_guards c1,Normal s \\ \\ s'\" .\n from termi_merge_c2 [rule_format, OF this] Seq.hyps\n show ?thesis\n by (cases s') (auto)\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nnext\n case Cond thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (While b c)\n {\n fix u c'\n assume termi_c': \"\\\\c' \\ Normal u\"\n assume c': \"c' = merge_guards (While b c)\"\n have \"\\\\While b c \\ Normal u\"\n using termi_c' c'\n proof (induct)\n case (WhileTrue s b' c')\n have s_in_b: \"s \\ b\" using WhileTrue by simp\n have \"\\\\merge_guards c \\ Normal s\"\n using WhileTrue by (auto elim: terminates_Normal_elim_cases)\n with While.hyps have \"\\\\c \\ Normal s\"\n by auto\n moreover\n have hyp_w: \"\\w. \\\\\\merge_guards c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n using WhileTrue by simp\n hence \"\\w. \\\\\\c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n by (simp add: exec_iff_exec_merge_guards [symmetric])\n ultimately show ?case\n using s_in_b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros) \n qed auto\n }\n with While show ?case by simp\nnext\n case Call thus ?case \n by (fastforce intro: terminates.intros )\nnext\n case DynCom thus ?case \n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (Guard f g c)\n have termi_merge: \"\\\\merge_guards (Guard f g c) \\ Normal s\" by fact\n show ?case\n proof (cases \"\\f' g' c'. merge_guards c = Guard f' g' c'\")\n case False\n hence m: \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (cases \"merge_guards c\") (auto simp add: Let_def)\n from termi_merge Guard.hyps show ?thesis\n by (simp only: m)\n (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\n next\n case True\n then obtain f' g' c' where \n mc: \"merge_guards c = Guard f' g' c'\"\n by blast\n show ?thesis\n proof (cases \"f=f'\")\n case False\n with mc have m: \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (simp add: Let_def)\n from termi_merge Guard.hyps show ?thesis\n by (simp only: m)\n (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\n next\n case True\n with mc have m: \"merge_guards (Guard f g c) = Guard f (g \\ g') c'\"\n by simp\n from termi_merge Guard.hyps\n show ?thesis\n by (simp only: m mc)\n (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\n qed\n qed\nnext\n case Throw thus ?case \n by (fastforce intro: terminates.intros )\nnext\n case (Catch c1 c2) \n have \"\\\\merge_guards (Catch c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\merge_guards c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\merge_guards c1,Normal s \\ \\ Abrupt s' \\ \n \\\\merge_guards c2 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Catch.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\ c2 \\ Normal s'\"\n proof -\n from exec_to_exec_merge_guards [OF exec_c1] \n have \"\\\\\\merge_guards c1,Normal s \\ \\ Abrupt s'\" .\n from termi_merge_c2 [rule_format, OF this] Catch.hyps\n show ?thesis\n by iprover\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nqed\n\nlemma terminates_merge_guards_to_terminates:\n \"\\\\merge_guards c\\ s \\ \\\\c\\ s\"\nby (cases s) (auto intro: terminates_merge_guards_to_terminates_Normal)\n\ntheorem terminates_iff_terminates_merge_guards:\n \"\\\\c\\ s = \\\\merge_guards c\\ s\"\n by (iprover intro: terminates_to_terminates_merge_guards \n terminates_merge_guards_to_terminates)\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{term \"c\\<^sub>1 \\\\<^sub>g c\\<^sub>2\"} *}\n(* ************************************************************************ *)\n\nlemma terminates_fewer_guards_Normal:\n shows \"\\c s. \\\\\\c'\\Normal s; c \\\\<^sub>g c'; \\\\\\c',Normal s \\ \\\\Fault ` UNIV\\\n \\ \\\\c\\Normal s\"\nproof (induct c')\n case Skip thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case Basic thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case Spec thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (Seq c1' c2')\n have termi: \"\\\\Seq c1' c2' \\ Normal s\" by fact\n then obtain \n termi_c1': \"\\\\c1'\\ Normal s\" and\n termi_c2': \"\\s'. \\\\\\c1',Normal s \\ \\ s' \\ \\\\c2'\\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n have noFault: \"\\\\\\Seq c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_c1': \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g Seq c1' c2'\" by fact\n from subseteq_guards_Seq [OF this] obtain c1 c2 where \n c: \"c = Seq c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\" \n by blast\n from termi_c1' c1_c1' noFault_c1'\n have \"\\\\c1\\ Normal s\"\n by (rule Seq.hyps)\n moreover\n {\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ t\"\n have \"\\\\c2\\ t\"\n proof -\n from exec_to_exec_subseteq_guards [OF c1_c1' exec_c1] obtain t' where\n exec_c1': \"\\\\\\c1',Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with exec_c1' noFault_c1'\n have False\n by (fastforce elim: isFaultE dest: Fault_end simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_noFault have t': \"t'=t\" by simp\n with termi_c2' exec_c1' \n have termi_c2': \"\\\\c2'\\ t\"\n by auto\n show ?thesis\n proof (cases t)\n case Fault thus ?thesis by auto\n next\n case Abrupt thus ?thesis by auto\n next\n case Stuck thus ?thesis by auto\n next\n case (Normal u)\n with noFault exec_c1' t' \n have \"\\\\\\c2',Normal u \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' [simplified Normal] c2_c2' this\n have \"\\\\c2 \\ Normal u\"\n by (rule Seq.hyps)\n with Normal exec_c1\n show ?thesis by simp\n qed\n qed\n qed\n }\n ultimately show ?case using c by (auto intro: terminates.intros)\nnext\n case (Cond b c1' c2')\n have noFault: \"\\\\\\Cond b c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\Cond b c1' c2' \\ Normal s\" by fact\n have \"c \\\\<^sub>g Cond b c1' c2'\" by fact\n from subseteq_guards_Cond [OF this] obtain c1 c2 where\n c: \"c = Cond b c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\" \n by blast\n thus ?case \n proof (cases \"s \\ b\")\n case True\n with termi have termi_c1': \"\\\\c1' \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n from True noFault have \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c1' c1_c1' this\n have \"\\\\c1 \\ Normal s\"\n by (rule Cond.hyps)\n with True c show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n with termi have termi_c2': \"\\\\c2' \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n from False noFault have \"\\\\\\c2',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' c2_c2' this\n have \"\\\\c2 \\ Normal s\"\n by (rule Cond.hyps)\n with False c show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c')\n have noFault: \"\\\\\\While b c',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\While b c' \\ Normal s\" by fact\n have \"c \\\\<^sub>g While b c'\" by fact\n from subseteq_guards_While [OF this]\n obtain c'' where \n c: \"c = While b c''\" and\n c''_c': \"c'' \\\\<^sub>g c'\"\n by blast\n {\n fix d u\n assume termi: \"\\\\d \\ u\"\n assume d: \"d = While b c'\"\n assume noFault: \"\\\\\\While b c',u \\ \\\\Fault ` UNIV\"\n have \"\\\\While b c'' \\ u\"\n using termi d noFault\n proof (induct)\n case (WhileTrue u b' c''')\n have u_in_b: \"u \\ b\" using WhileTrue by simp\n have termi_c': \"\\\\c' \\ Normal u\" using WhileTrue by simp\n have noFault: \"\\\\\\While b c',Normal u \\ \\\\Fault ` UNIV\" using WhileTrue by simp\n hence noFault_c': \"\\\\\\c',Normal u \\ \\\\Fault ` UNIV\" using u_in_b\n by (auto intro: exec.intros simp add: final_notin_def)\n from While.hyps [OF termi_c' c''_c' this] \n have \"\\\\c'' \\ Normal u\".\n moreover\n from WhileTrue \n have hyp_w: \"\\s'. \\\\\\c',Normal u \\ \\ s' \\ \\\\\\While b c',s' \\ \\\\Fault ` UNIV \n \\ \\\\While b c'' \\ s'\"\n by simp\n {\n fix v\n assume exec_c'': \"\\\\\\c'',Normal u \\ \\ v\"\n have \"\\\\While b c'' \\ v\"\n proof - \n from exec_to_exec_subseteq_guards [OF c''_c' exec_c''] obtain v' where\n exec_c': \"\\\\\\c',Normal u \\ \\ v'\" and\n v_Fault: \"isFault v \\ isFault v'\" and \n v'_noFault: \"\\ isFault v' \\ v' = v\"\n by auto\n show ?thesis\n proof (cases \"isFault v'\")\n case True\n with exec_c' noFault u_in_b\n have False\n by (fastforce \n simp add: final_notin_def intro: exec.intros elim: isFaultE)\n thus ?thesis ..\n next\n case False\n with v'_noFault have v': \"v'=v\"\n by simp\n with noFault exec_c' u_in_b\n have \"\\\\\\While b c',v \\ \\\\Fault ` UNIV\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n from hyp_w [rule_format, OF exec_c' [simplified v'] this]\n show \"\\\\While b c'' \\ v\" .\n qed\n qed\n }\n ultimately\n show ?case using u_in_b \n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed auto\n }\n with c noFault termi show ?case\n by auto\nnext\n case Call thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (DynCom C') \n have termi: \"\\\\DynCom C' \\ Normal s\" by fact\n hence termi_C': \"\\\\C' s \\ Normal s\"\n by cases\n have noFault: \"\\\\\\DynCom C',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_C': \"\\\\\\C' s,Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g DynCom C'\" by fact\n from subseteq_guards_DynCom [OF this] obtain C where\n c: \"c = DynCom C\" and\n C_C': \"\\s. C s \\\\<^sub>g C' s\"\n by blast\n from DynCom.hyps termi_C' C_C' [rule_format] noFault_C'\n have \"\\\\C s \\ Normal s\"\n by fast\n with c show ?case\n by (auto intro: terminates.intros)\nnext \n case (Guard f' g' c')\n have noFault: \"\\\\\\Guard f' g' c',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\Guard f' g' c' \\ Normal s\" by fact\n have \"c \\\\<^sub>g Guard f' g' c'\" by fact\n hence c_cases: \"(c \\\\<^sub>g c') \\ (\\c''. c = Guard f' g' c'' \\ (c'' \\\\<^sub>g c'))\"\n by (rule subseteq_guards_Guard)\n thus ?case\n proof (cases \"s \\ g'\")\n case True\n note s_in_g' = this\n with noFault have noFault_c': \"\\\\\\c',Normal s \\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from termi s_in_g' have termi_c': \"\\\\c' \\ Normal s\"\n by cases auto\n from c_cases show ?thesis\n proof\n assume \"c \\\\<^sub>g c'\"\n from termi_c' this noFault_c'\n show \"\\\\c \\ Normal s\" \n by (rule Guard.hyps)\n next\n assume \"\\c''. c = Guard f' g' c'' \\ (c'' \\\\<^sub>g c')\"\n then obtain c'' where\n c: \"c = Guard f' g' c''\" and c''_c': \"c'' \\\\<^sub>g c'\" \n by blast\n from termi_c' c''_c' noFault_c'\n have \"\\\\c'' \\ Normal s\" \n by (rule Guard.hyps)\n with s_in_g' c\n show ?thesis\n by (auto intro: terminates.intros)\n qed\n next\n case False\n with noFault have False\n by (auto intro: exec.intros simp add: final_notin_def)\n thus ?thesis ..\n qed\nnext\n case Throw thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (Catch c1' c2')\n have termi: \"\\\\Catch c1' c2' \\ Normal s\" by fact\n then obtain \n termi_c1': \"\\\\c1'\\ Normal s\" and\n termi_c2': \"\\s'. \\\\\\c1',Normal s \\ \\ Abrupt s' \\ \\\\c2'\\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n have noFault: \"\\\\\\Catch c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_c1': \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (fastforce intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g Catch c1' c2'\" by fact\n from subseteq_guards_Catch [OF this] obtain c1 c2 where \n c: \"c = Catch c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\" \n by blast\n from termi_c1' c1_c1' noFault_c1'\n have \"\\\\c1\\ Normal s\"\n by (rule Catch.hyps)\n moreover\n {\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt t\"\n have \"\\\\c2\\ Normal t\"\n proof -\n from exec_to_exec_subseteq_guards [OF c1_c1' exec_c1] obtain t' where\n exec_c1': \"\\\\\\c1',Normal s \\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = Abrupt t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with exec_c1' noFault_c1'\n have False\n by (fastforce elim: isFaultE dest: Fault_end simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_noFault have t': \"t'=Abrupt t\" by simp\n with termi_c2' exec_c1' \n have termi_c2': \"\\\\c2'\\ Normal t\"\n by auto\n with noFault exec_c1' t' \n have \"\\\\\\c2',Normal t \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' c2_c2' this\n show \"\\\\c2 \\ Normal t\"\n by (rule Catch.hyps)\n qed\n qed\n }\n ultimately show ?case using c by (auto intro: terminates.intros)\nqed\n\ntheorem terminates_fewer_guards:\n shows \"\\\\\\c'\\s; c \\\\<^sub>g c'; \\\\\\c',s \\ \\\\Fault ` UNIV\\\n \\ \\\\c\\s\"\n by (cases s) (auto intro: terminates_fewer_guards_Normal)\n\nlemma terminates_noFault_strip_guards:\n assumes termi: \"\\\\c\\Normal s\"\n shows \"\\\\\\\\c,Normal s \\ \\\\Fault ` F\\ \\ \\\\strip_guards F c\\Normal s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (auto intro: terminates.intros)\nnext\n case Basic thus ?case by (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (auto intro: terminates.intros)\nnext\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have \"\\\\c \\ Normal s\" by fact\n have \"\\\\\\Guard f g c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_g have \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n with Guard.hyps have \"\\\\strip_guards F c \\ Normal s\" by simp\n with s_in_g show ?case\n by (auto intro: terminates.intros)\nnext\n case GuardFault thus ?case \n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Fault thus ?case by (auto intro: terminates.intros)\nnext\n case (Seq c1 s c2) \n have noFault_Seq: \"\\\\\\Seq c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with Seq.hyps have \"\\\\strip_guards F c1 \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c1: \"\\\\\\strip_guards F c1,Normal s \\ \\ s'\"\n have \"\\\\strip_guards F c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_guards_to_exec [OF exec_strip_guards_c1] noFault_c1\n have \"\\\\\\c1,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this noFault_Seq have \"\\\\\\c2,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using Seq.hyps by simp\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case CondTrue thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def ) \nnext\n case CondFalse thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def ) \nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have noFault_while: \"\\\\\\While b c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_b have noFault_c: \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with WhileTrue.hyps have \"\\\\strip_guards F c \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c: \"\\\\\\strip_guards F c,Normal s \\ \\ s'\"\n have \"\\\\strip_guards F (While b c) \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_guards_to_exec [OF exec_strip_guards_c] noFault_c\n have \"\\\\\\c,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this s_in_b noFault_while have \"\\\\\\While b c,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using WhileTrue.hyps by simp\n qed\n }\n ultimately show ?case\n using WhileTrue.hyps by (auto intro: terminates.intros)\nnext\n case WhileFalse thus ?case by (auto intro: terminates.intros)\nnext\n case Call thus ?case by (auto intro: terminates.intros)\nnext\n case CallUndefined thus ?case by (auto intro: terminates.intros)\nnext\n case Stuck thus ?case by (auto intro: terminates.intros)\nnext\n case DynCom thus ?case \n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Throw thus ?case by (auto intro: terminates.intros)\nnext\n case Abrupt thus ?case by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have noFault_Catch: \"\\\\\\Catch c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n with Catch.hyps have \"\\\\strip_guards F c1 \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c1: \"\\\\\\strip_guards F c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\strip_guards F c2 \\ Normal s'\"\n proof -\n from exec_strip_guards_to_exec [OF exec_strip_guards_c1] noFault_c1\n have \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this noFault_Catch have \"\\\\\\c2,Normal s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using Catch.hyps by simp\n qed\n }\n ultimately show ?case\n using Catch.hyps by (auto intro: terminates.intros)\nqed\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"strip_guards\"} *}\n(* ************************************************************************* *)\n\nlemma terminates_noFault_strip:\n assumes termi: \"\\\\c\\Normal s\"\n shows \"\\\\\\\\c,Normal s \\ \\\\Fault ` F\\ \\ strip F \\\\c\\Normal s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (auto intro: terminates.intros)\nnext\n case Basic thus ?case by (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (auto intro: terminates.intros)\nnext\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have \"\\\\\\Guard f g c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_g have \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c \\ Normal s\" by (simp add: Guard.hyps) \n with s_in_g show ?case\n by (auto intro: terminates.intros simp del: strip_simp)\nnext\n case GuardFault thus ?case \n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Fault thus ?case by (auto intro: terminates.intros)\nnext\n case (Seq c1 s c2) \n have noFault_Seq: \"\\\\\\Seq c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c1 \\ Normal s\" by (simp add: Seq.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c1: \"strip F \\\\\\c1,Normal s \\ \\ s'\"\n have \"strip F \\\\c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_to_exec [OF exec_strip_c1] noFault_c1\n have \"\\\\\\c1,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this noFault_Seq have \"\\\\\\c2,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using Seq.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n by (fastforce intro: terminates.intros)\nnext\n case CondTrue thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def ) \nnext\n case CondFalse thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def ) \nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have noFault_while: \"\\\\\\While b c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_b have noFault_c: \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c \\ Normal s\" by (simp add: WhileTrue.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c: \"strip F \\\\\\c,Normal s \\ \\ s'\"\n have \"strip F \\\\While b c \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_to_exec [OF exec_strip_c] noFault_c\n have \"\\\\\\c,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this s_in_b noFault_while have \"\\\\\\While b c,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using WhileTrue.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n using WhileTrue.hyps by (auto intro: terminates.intros simp del: strip_simp)\nnext\n case WhileFalse thus ?case by (auto intro: terminates.intros)\nnext\n case (Call p bdy s) \n have bdy: \"\\ p = Some bdy\" by fact\n have \"\\\\\\Call p,Normal s \\ \\\\Fault ` F\" by fact\n with bdy have bdy_noFault: \"\\\\\\bdy,Normal s \\ \\\\Fault ` F\"\n by (auto intro: exec.intros simp add: final_notin_def)\n then have strip_bdy_noFault: \"strip F \\\\\\bdy,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def dest!: exec_strip_to_exec elim!: isFaultE)\n\n from bdy_noFault have \"strip F \\\\bdy \\ Normal s\" by (simp add: Call.hyps)\n from terminates_noFault_strip_guards [OF this strip_bdy_noFault]\n have \"strip F \\\\strip_guards F bdy \\ Normal s\".\n with bdy show ?case\n by (fastforce intro: terminates.Call)\nnext\n case CallUndefined thus ?case by (auto intro: terminates.intros)\nnext\n case Stuck thus ?case by (auto intro: terminates.intros)\nnext\n case DynCom thus ?case \n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Throw thus ?case by (auto intro: terminates.intros)\nnext\n case Abrupt thus ?case by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have noFault_Catch: \"\\\\\\Catch c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c1 \\ Normal s\" by (simp add: Catch.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c1: \"strip F \\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"strip F \\\\c2 \\ Normal s'\"\n proof -\n from exec_strip_to_exec [OF exec_strip_c1] noFault_c1\n have \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n moreover\n from this noFault_Catch have \"\\\\\\c2,Normal s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n ultimately show ?thesis\n using Catch.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n using Catch.hyps by (auto intro: terminates.intros simp del: strip_simp)\nqed\n\n\n(* ************************************************************************* *)\nsubsection {* Miscellaneous *}\n(* ************************************************************************* *)\n\nlemma terminates_while_lemma:\n assumes termi: \"\\\\w\\fk\" \n shows \"\\k b c. \\fk = Normal (f k); w=While b c; \n \\i. \\\\\\c,Normal (f i) \\ \\ Normal (f (Suc i))\\\n \\ \\i. f i \\ b\"\nusing termi\nproof (induct)\n case WhileTrue thus ?case by blast\nnext\n case WhileFalse thus ?case by blast\nqed simp_all\n\nlemma terminates_while:\n \"\\\\\\(While b c)\\Normal (f k); \n \\i. \\\\\\c,Normal (f i) \\ \\ Normal (f (Suc i))\\\n \\ \\i. f i \\ b\"\n by (blast intro: terminates_while_lemma)\n\nlemma wf_terminates_while: \n \"wf {(t,s). \\\\(While b c)\\Normal s \\ s\\b \\ \n \\\\\\c,Normal s \\ \\ Normal t}\"\napply(subst wf_iff_no_infinite_down_chain)\napply(rule notI)\napply clarsimp\napply(insert terminates_while)\napply blast\ndone\n\nlemma terminates_restrict_to_terminates:\n assumes terminates_res: \"\\|\\<^bsub>M\\<^esub>\\ c \\ s\"\n assumes not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\c,s \\ \\\\{Stuck}\"\n shows \"\\\\ c \\ s\"\nusing terminates_res not_Stuck\nproof (induct)\n case Skip show ?case by (rule terminates.Skip)\nnext\n case Basic show ?case by (rule terminates.Basic)\nnext\n case Spec show ?case by (rule terminates.Spec)\nnext\n case Guard thus ?case \n by (auto intro: terminates.Guard dest: notStuck_GuardD)\nnext\n case GuardFault thus ?case by (auto intro: terminates.GuardFault)\nnext\n case Fault show ?case by (rule terminates.Fault)\nnext\n case (Seq c1 s c2) \n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\Seq c1 c2,Normal s \\ \\\\{Stuck}\" by fact\n hence c1_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\\\{Stuck}\"\n by (rule notStuck_SeqD1)\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof (rule terminates.Seq,safe)\n from c1_notStuck\n show \"\\\\c1 \\ Normal s\"\n by (rule Seq.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c1,Normal s \\ \\ s'\"\n show \"\\\\c2 \\ s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\ t'\" and \n t'_notStuck: \"t' \\ Stuck \\ t' = s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c1_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=s'\" by simp\n with not_Stuck exec_res\n have \"\\|\\<^bsub>M\\<^esub>\\\\c2,s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_SeqD2) \n with exec_res t' Seq.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nnext\n case CondTrue thus ?case \n by (auto intro: terminates.CondTrue dest: notStuck_CondTrueD)\nnext\n case CondFalse thus ?case \n by (auto intro: terminates.CondFalse dest: notStuck_CondFalseD)\nnext\n case (WhileTrue s b c)\n have s: \"s \\ b\" by fact\n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\While b c,Normal s \\ \\\\{Stuck}\" by fact\n with WhileTrue have c_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s \\ \\\\{Stuck}\"\n by (iprover intro: notStuck_WhileTrueD1)\n show ?case\n proof (rule terminates.WhileTrue [OF s],safe)\n from c_notStuck\n show \"\\\\c \\ Normal s\"\n by (rule WhileTrue.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c,Normal s \\ \\ s'\"\n show \"\\\\While b c \\ s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s \\ \\ t'\" and \n t'_notStuck: \"t' \\ Stuck \\ t' = s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=s'\" by simp\n with not_Stuck exec_res s\n have \"\\|\\<^bsub>M\\<^esub>\\\\While b c,s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_WhileTrueD2) \n with exec_res t' WhileTrue.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nnext\n case WhileFalse then show ?case by (iprover intro: terminates.WhileFalse)\nnext\n case Call thus ?case \n by (auto intro: terminates.Call dest: notStuck_CallD restrict_SomeD)\nnext\n case CallUndefined\n thus ?case\n by (auto dest: notStuck_CallDefinedD)\nnext\n case Stuck show ?case by (rule terminates.Stuck)\nnext\n case DynCom\n thus ?case\n by (auto intro: terminates.DynCom dest: notStuck_DynComD)\nnext\n case Throw show ?case by (rule terminates.Throw)\nnext\n case Abrupt show ?case by (rule terminates.Abrupt)\nnext\n case (Catch c1 s c2) \n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\Catch c1 c2,Normal s \\ \\\\{Stuck}\" by fact\n hence c1_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\\\{Stuck}\"\n by (rule notStuck_CatchD1)\n show \"\\\\Catch c1 c2 \\ Normal s\"\n proof (rule terminates.Catch,safe)\n from c1_notStuck\n show \"\\\\c1 \\ Normal s\"\n by (rule Catch.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n show \"\\\\c2 \\ Normal s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\ t'\" and \n t'_notStuck: \"t' \\ Stuck \\ t' = Abrupt s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c1_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=Abrupt s'\" by simp\n with not_Stuck exec_res\n have \"\\|\\<^bsub>M\\<^esub>\\\\c2,Normal s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_CatchD2) \n with exec_res t' Catch.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nqed\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/EmbSimpl/Termination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.40733340004593027, "lm_q1q2_score": 0.25204993795877795}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * A theoretical framework for reasoning about non-interference\n * of monadic programs.\n *)\n\ntheory EquivValid\nimports Corres_UL\nbegin\n\nsection\\State equivalence validity\\\n\ntext\\\n\nA generalised information flow property.\n\nOften, we read in the entire state, but then only examine part of it.\nThe following property may be used to split up binds whose first part\ndoes this.\n\n@{term \"I\"} is the state relation that holds invariantly.\n\n@{term \"A\"} (also) holds between initial states.\n\n@{term \"B\"} (also) holds between final states.\n\n@{term \"P\"} holds in the initial state for @{term \"f\"}.\n\n@{term \"P'\"} holds in the initial state for @{term \"f'\"}.\n\n\\\n\ndefinition\n equiv_valid_2 :: \"('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('b \\ 'c \\ bool) \\ ('s \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ ('s,'c) nondet_monad \\ bool\"\nwhere\n \"equiv_valid_2 I A B R P P' f f' \\ \\s t.\n P s \\ P' t \\ I s t \\ A s t\n \\ (\\(rva, s') \\ fst (f s). \\(rvb, t') \\ fst (f' t).\n R rva rvb \\ I s' t' \\ B s' t')\"\n\nlemma equiv_valid_2_bind_general:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n shows \"equiv_valid_2 D A C R (\\ s. P s \\ S s) (\\ s. P' s \\ S' s) (f >>= g) (f' >>= g')\"\n using assms\n unfolding bind_def equiv_valid_2_def valid_def\n apply fastforce\n done\n\n(* almost all of the time, the second relation doesn't change *)\nlemma equiv_valid_2_bind:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n shows \"equiv_valid_2 D A A R (\\ s. P s \\ S s) (\\ s. P' s \\ S' s) (f >>= g) (f' >>= g')\"\n using assms by (blast intro: equiv_valid_2_bind_general)\n\nlemma equiv_valid_2_guard_imp:\n assumes reads_res: \"equiv_valid_2 D A B R Q Q' f f'\"\n assumes guard_imp: \"\\ s. P s \\ Q s\"\n assumes guard_imp': \"\\ s. P' s \\ Q' s\"\n shows \"equiv_valid_2 D A B R P P' f f'\"\n using assms\n by (fastforce simp: equiv_valid_2_def)\n\nlemma equiv_valid_2_bind_pre:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes guard_imp: \"\\ s. T s \\ P s \\ S s\"\n assumes guard_imp': \"\\ s. T' s \\ P' s \\ S' s\"\n shows \"equiv_valid_2 D A A R T T' (f >>= g) (f' >>= g')\"\n using assms by (blast intro: equiv_valid_2_bind[THEN equiv_valid_2_guard_imp])\n\nlemma return_ev2:\n assumes rel: \"\\ s t. \\P s; P' t; I s t; A s t\\ \\ R a b\"\n shows \"equiv_valid_2 I A A R P P' (return a) (return b)\"\n by(auto simp: equiv_valid_2_def return_def rel)\n\nlemma equiv_valid_2_liftE:\n \"equiv_valid_2 D A B R P P' f f' \\\n equiv_valid_2 D A B (E \\ R) P P' (liftE f) (liftE f')\"\n apply(unfold liftE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac Q=\"\\\\\" and Q'=\"\\\\\" and R'=R in equiv_valid_2_bind_general)\n apply(fastforce intro: return_ev2)\n apply assumption\n apply(rule wp_post_taut)+\n by(simp_all)\n\nlemma equiv_valid_2_liftE_bindE_general:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n shows \"equiv_valid_2 D A C R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" and Q'=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q' v s)\" in equiv_valid_2_bind_general)\n prefer 2\n apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n apply(rule r1)\n apply(clarsimp simp: lift_def split: sum.split)\n apply(insert r2, fastforce simp: equiv_valid_2_def)[1]\n apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare])\n apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare'])\n by(auto)\n\nlemma equiv_valid_2_liftE_bindE:\n assumes r2: \"\\ rv rv'. R' rv rv' \\ equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes hoare: \"\\ S \\ f \\ Q \\\"\n assumes hoare': \"\\ S' \\ f' \\ Q' \\\"\n assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n shows \"equiv_valid_2 D A A R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n using assms by(blast intro: equiv_valid_2_liftE_bindE_general)\n\nlemma equiv_valid_2_rvrel_imp:\n \"\\equiv_valid_2 I A A R P P' f f'; \\ s t. R s t \\ R' s t\\ \\\n equiv_valid_2 I A A R' P P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nsubsection\\Specialised fixed-state state equivalence validity\\\n\ntext\\\n\nFor resolve_address_bits and rec_del: talk about a fixed initial\nstate. Note we only do this for one of the computations; the other\nstate can be constrained by how it is related to this one by @{term\n\"I\"} and so forth.\n\nAlso captures the typical case where the relation between the return\nvalues is equality and the required preconditions are identical.\n\nwp can cope with this.\n\n\\\n\ndefinition\n spec_equiv_valid :: \"'s \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ bool\"\nwhere\n \"spec_equiv_valid st I A B P f \\ equiv_valid_2 I A B (=) (P and ((=) st)) P f f\"\n\nabbreviation spec_equiv_valid_inv where\n \"spec_equiv_valid_inv st I A P f \\ spec_equiv_valid st I A A P f\"\n\nsubsection\\Specialised state equivalence validity\\\n\ntext\\\n\nMost of the time we deal with the streamlined version.\n\nwp can cope with this too.\n\n\\\n\ndefinition\n equiv_valid :: \"('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ 's \\ bool) \\ ('s \\ bool) \\ ('s,'b) nondet_monad \\ bool\"\nwhere\n \"equiv_valid I A B P f \\ \\st. spec_equiv_valid st I A B P f\"\n\nlemma equiv_valid_def2:\n \"equiv_valid I A B P f = equiv_valid_2 I A B (=) P P f f\"\n by (simp add: equiv_valid_def spec_equiv_valid_def equiv_valid_2_def)\n\nabbreviation equiv_valid_rv where\n \"equiv_valid_rv I A B R P f \\ equiv_valid_2 I A B R P P f f\"\n\n(* this is probably way more general than we need for all but a few special cases *)\nlemma bind_ev_general:\n assumes reads_res_2: \"\\rv. equiv_valid I B C (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid I A B P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\\"\n shows \"equiv_valid I A C (\\s. P' s \\ P'' s) (f >>= g)\"\n unfolding equiv_valid_def2\n apply (rule equiv_valid_2_bind_general[where R'=\"(=)\"])\n apply (auto intro: reads_res_1[unfolded equiv_valid_def2] reads_res_2[unfolded equiv_valid_def2])[2]\n apply (rule hoare)\n apply (rule hoare)\n done\n\nlemma bind_ev:\n assumes reads_res_2: \"\\rv. equiv_valid I A A (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid I A A P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\\"\n shows \"equiv_valid I A A (\\s. P' s \\ P'' s) (f >>= g)\"\n using assms by (blast intro: bind_ev_general)\n\nlemma equiv_valid_guard_imp:\n assumes reads_res: \"equiv_valid I A B Q f\"\n assumes guard_imp: \"\\ s. P s \\ Q s\"\n shows \"equiv_valid I A B P f\"\n using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\nlemmas bind_ev_pre = bind_ev[THEN equiv_valid_guard_imp]\n\nlemma gen_asm_ev':\n assumes \"Q \\ equiv_valid D A B P f\"\n shows \"equiv_valid D A B (P and K Q) f\"\n using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\ndeclare K_def [simp del]\n\nlemmas gen_asm_ev =\n gen_asm_ev'[where P=\"\\\", simplified]\n gen_asm_ev'\n gen_asm_ev'[simplified K_def, where P=\"\\\", simplified]\n gen_asm_ev'[simplified K_def]\n\ndeclare K_def [simp]\n\ntext \\\n This is a further streamlined version that we expect to get the most from\n automating, and for the most part, we shouldn't need to deal with the\n extra generality of the properties above.\n\\\nabbreviation equiv_valid_inv where\n \"equiv_valid_inv I A P f \\ equiv_valid I A A P f\"\n\nabbreviation equiv_valid_rv_inv where\n \"equiv_valid_rv_inv I A R P f \\ equiv_valid_rv I A A R P f\"\n\nlemma get_evrv:\n \"equiv_valid_rv_inv I A (I And A) \\ get\"\n by(auto simp: equiv_valid_2_def get_def)\n\nlemma equiv_valid_rv_bind_general:\n assumes ev1:\n \"equiv_valid_rv I A B W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I B C R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv I A C R P (f >>= g)\"\n apply(rule equiv_valid_2_guard_imp)\n apply(rule equiv_valid_2_bind_general[OF ev2])\n apply(assumption)\n apply(rule ev1)\n apply(rule hoare)\n apply(rule hoare)\n apply(simp_all)\n done\n\nlemma equiv_valid_rv_bind:\n assumes ev1:\n \"equiv_valid_rv_inv I A W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv_inv I A R P (f >>= g)\"\n using assms by(blast intro: equiv_valid_rv_bind_general)\n\nlemma modify_ev2:\n assumes \"\\ s t. \\I s t; A s t; P s; P' t\\ \\ R () () \\ I (f s) (f' t) \\ B (f s) (f' t)\"\n shows\n \"equiv_valid_2 I A B R P P' (modify f) (modify f')\"\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n using assms by auto\n\nlemma put_ev2:\n assumes \"\\ s t. \\I s t; A s t; P s; P' t\\ \\ R () () \\ I x x' \\ B x x'\"\n shows\n \"equiv_valid_2 I A B R P P' (put x) (put x')\"\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n using assms by auto\n\n\nlemma get_bind_ev2:\n assumes \"\\ rv rv'. \\I rv rv'; A rv rv'\\ \\ equiv_valid_2 I A B R (P and ((=) rv)) (P' and ((=) rv')) (f rv) (f' rv')\"\n shows \"equiv_valid_2 I A B R P P' (get >>= f) (get >>= f')\"\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"I And A\" in equiv_valid_2_bind_general)\n apply(rule assms, simp+)\n apply(rule get_evrv)\n apply(wp get_sp)+\n by(auto)\n\n\nlemma return_ev_pre:\n \"equiv_valid_inv I A P (return x)\"\n apply (simp add: equiv_valid_def2 return_ev2)\n done\n\nlemmas return_ev = return_ev_pre[where P=\\]\n\nlemma fail_ev2_l:\n \"equiv_valid_2 I A B R P P' fail f'\"\n by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev2_r:\n \"equiv_valid_2 I A B R P P' f fail\"\n by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev_pre:\n \"equiv_valid I A B P fail\"\n apply (simp add: equiv_valid_def2 fail_ev2_l)\n done\n\nlemmas fail_ev = fail_ev_pre[where P=\\]\n\nlemma assert_ev2:\n \"R () () \\ equiv_valid_2 I A A R P P' (assert a) (assert b)\"\n apply(simp add: assert_def fail_ev2_l fail_ev2_r)\n apply(blast intro: return_ev2)\n done\n\nlemma liftE_ev:\n \"equiv_valid I A B P f \\ equiv_valid I A B P (liftE f)\"\n unfolding liftE_def\n apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev _ wp_post_taut])\n apply fastforce+ (* schematic instantiation *)\n done\n\nlemma if_ev:\n assumes \"b \\ equiv_valid I A B P f\"\n assumes \"\\ b \\ equiv_valid I A B Q g\"\n shows \"equiv_valid I A B (\\s. (b \\ P s) \\ (\\b \\ Q s)) (if b then f else g)\"\n apply (clarsimp split: if_split)\n using assms by blast\n\nlemmas if_ev_pre = equiv_valid_guard_imp[OF if_ev]\n\nlemma assert_ev_pre:\n \"equiv_valid_inv I A P (assert b)\"\n apply(simp add: equiv_valid_def2 assert_ev2)\n done\n\nlemmas assert_ev = assert_ev_pre[where P=\\]\n\nlemma assert_opt_ev:\n \"equiv_valid_inv I A \\ (assert_opt v)\"\n apply (simp add: assert_opt_def return_ev fail_ev\n split: option.split)\n done\n\nlemma assert_opt_ev2:\n assumes \"\\ a a'. \\v = Some a; v' = Some a'\\ \\ R a a'\"\n shows \"equiv_valid_2 I A A R \\ \\ (assert_opt v) (assert_opt v')\"\n apply (simp add: assert_opt_def return_ev fail_ev2_l fail_ev2_r\n split: option.split)\n apply(intro allI impI)\n apply(rule return_ev2)\n apply(rule assms, assumption+)\n done\n\nlemma select_f_ev:\n \"equiv_valid_inv I A (K (det f)) (select_f (f x))\"\n apply (rule gen_asm_ev)\n apply (simp add: select_f_def equiv_valid_def2 equiv_valid_2_def det_set_iff)\n done\n\nlemma gets_evrv:\n \"equiv_valid_rv_inv I A R (K (\\s t. I s t \\ A s t \\ R (f s) (f t))) (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma gets_evrv':\n \"equiv_valid_rv_inv I A R (\\s. (\\t. I s t \\ A s t \\ R (f s) (f t))) (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma gets_evrv'':\n \"\\s t. I s t \\ A s t \\ P s \\ P t \\ R (f s) (f t) \\ equiv_valid_rv_inv I A R P (gets f)\"\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma equiv_valid_rv_guard_imp:\n \"\\equiv_valid_rv I A B R P f; \\ s. Q s \\ P s\\ \\\n equiv_valid_rv I A B R Q f\"\n apply(simp add: equiv_valid_2_def)\n apply fast\n done\n\nlemma gets_ev:\n shows \"equiv_valid_inv I A (\\ s. \\ s t. I s t \\ A s t \\ f s = f t) (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv])\n done\n\nlemma gets_ev':\n shows \"equiv_valid_inv I A (\\ s. \\ t. I s t \\ A s t \\ f s = f t) (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv'])\n done\n\nlemma gets_ev'':\n \"\\s t. I s t \\ A s t \\ P s \\ P t \\ f s = f t \\ equiv_valid_inv I A P (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv''])\n done\n\nlemma gets_the_evrv:\n \"equiv_valid_rv_inv I A R (K (\\s t. I s t \\ A s t \\ R (the (f s)) (the (f t)))) (gets_the f)\"\n unfolding gets_the_def\n apply (rule equiv_valid_rv_bind)\n apply(rule equiv_valid_rv_guard_imp[OF gets_evrv])\n apply simp\n apply(rule assert_opt_ev2)\n apply simp\n apply wp\n done\n\nlemma gets_the_ev:\n \"equiv_valid_inv I A (K (\\s t. I s t \\ A s t \\ f s = f t)) (gets_the f)\"\n unfolding equiv_valid_def2\n apply(rule equiv_valid_rv_guard_imp[OF gets_the_evrv])\n by simp\n\nlemma throwError_ev_pre:\n \"equiv_valid_inv I A P (throwError e)\"\n by (auto simp: throwError_def return_ev_pre)\n\nlemmas throwError_ev = throwError_ev_pre[where P=\\]\n\nlemma returnOk_ev_pre:\n \"equiv_valid_inv I A P (returnOk v)\"\n by (auto simp: returnOk_def return_ev_pre)\n\nlemmas returnOk_ev = returnOk_ev_pre[where P=\\]\n\n(* this seems restrictive, to have the same beginning and ending state relation,\n however, one suspects that bindE is used usually only in code that doesn't\n modify the state, so is probably OK.. We'll see *)\nlemma bindE_ev:\n assumes reads_res_2: \"\\ rv. equiv_valid_inv I A (Q rv) (g rv)\"\n assumes reads_res_1: \"equiv_valid_inv I A P' f\"\n assumes hoare: \"\\ P'' \\ f \\ Q \\,-\"\n shows \"equiv_valid_inv I A (\\s. P' s \\ P'' s) (f >>=E g)\"\n unfolding bindE_def\n apply (rule bind_ev)\n prefer 3\n apply(rule hoare[unfolded validE_R_def validE_def])\n apply(simp split: sum.split add: lift_def throwError_ev)\n apply(blast intro!: reads_res_2)\n apply(rule reads_res_1)\n done\n\nlemmas bindE_ev_pre = bindE_ev[THEN equiv_valid_guard_imp]\n\n(* Of course, when we know that progress is always made, we can do better *)\nlemma liftE_bindE_ev_general:\n assumes r2: \"\\ val. equiv_valid I B C (Q val) (g val)\"\n assumes r1: \"equiv_valid I A B P f\"\n assumes hoare: \"\\ R \\ f \\ Q \\\"\n shows \"equiv_valid I A C (\\ s. P s \\ R s) (liftE f >>=E g)\"\n apply(simp add: bindE_def)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" in bind_ev_general)\n prefer 2\n apply(rule liftE_ev)\n apply(rule r1)\n apply(insert r2, fastforce simp: lift_def split: sum.split simp: equiv_valid_def2 equiv_valid_2_def)[1]\n apply(insert hoare, fastforce simp: valid_def liftE_def return_def bind_def)\n done\n\nlemma liftE_bindE_ev:\n assumes r2: \"\\ val. equiv_valid_inv I A (Q val) (g val)\"\n assumes r1: \"equiv_valid_inv I A P f\"\n assumes hoare: \"\\ R \\ f \\ Q \\\"\n shows \"equiv_valid_inv I A (\\ s. P s \\ R s) (liftE f >>=E g)\"\n using assms by (blast intro: liftE_bindE_ev_general)\n\nlemmas liftE_bindE_ev_pre = liftE_bindE_ev[THEN equiv_valid_guard_imp]\n\nlemma liftM_ev:\n assumes reads_res: \"equiv_valid I A B P g\"\n shows \"equiv_valid I A B P (liftM f g)\"\n apply (simp add: liftM_def)\n apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev reads_res wp_post_taut])\n apply simp\n done\n\nlemma liftME_ev:\n assumes reads_res: \"equiv_valid_inv I A P g\"\n shows \"equiv_valid_inv I A P (liftME f g)\"\n apply(simp add: liftME_def)\n apply (rule bindE_ev_pre[OF returnOk_ev reads_res])\n apply (rule hoare_True_E_R)\n apply fast\n done\n\nlemma whenE_ev:\n assumes a: \"b \\ equiv_valid_inv I A P m\"\n shows \"equiv_valid_inv I A (\\s. b \\ P s) (whenE b m)\"\n unfolding whenE_def by (auto intro: a returnOk_ev_pre)\n\nlemma whenE_throwError_bindE_ev:\n assumes \"\\ rv. \\ b \\ equiv_valid_inv I A P (g rv)\"\n shows \"equiv_valid_inv I A P (whenE b (throwError e) >>=E g)\"\n apply (rule_tac Q=\"\\ rv. P and (\\ s. \\ b)\" in bindE_ev_pre)\n apply (rule gen_asm_ev)\n apply (blast intro: assms)\n apply (rule whenE_ev)\n apply (rule throwError_ev)\n apply (wp whenE_throwError_wp)\n apply simp\n done\n\n(* FIXME: trivially generalised *)\nlemma K_bind_ev:\n \"equiv_valid I A B P f \\ equiv_valid I A B P (K_bind f x)\"\n by simp\n\nsubsection\\wp setup\\\n\nlemmas splits_ev[wp_split] =\n bind_ev_pre bindE_ev_pre\n bind_ev bindE_ev\n if_ev_pre\n if_ev\n\nlemmas wp_ev[wp] =\n return_ev_pre\n return_ev\n liftE_ev\n fail_ev_pre\n fail_ev\n assert_opt_ev\n assert_ev\n gets_ev\n gets_the_ev\n returnOk_ev_pre\n returnOk_ev\n throwError_ev_pre\n throwError_ev\n liftM_ev\n liftME_ev\n whenE_ev\n K_bind_ev\n\nsubsection\\crunch setup\\\n\nlemmas pre_ev =\n hoare_pre\n equiv_valid_guard_imp\n\nsubsection\\Tom instantiates wpc\\\n\nlemma wpc_helper_equiv_valid:\n \"equiv_valid D A B Q f \\ wpc_helper (P, P') (Q, Q') (equiv_valid D A B P f)\"\n using equiv_valid_guard_imp\n apply (simp add: wpc_helper_def)\n apply (blast)\n done\n\nwpc_setup \"\\m. equiv_valid D A B Q m\" wpc_helper_equiv_valid\n\nsubsection\\More hoare-like rules\\\n\nlemma mapM_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapM m lst)\"\n using assms\n apply(atomize)\n apply(rule_tac Q=I in equiv_valid_guard_imp)\n apply(induct lst)\n apply(simp add: mapM_Nil return_ev_pre)\n apply(subst mapM_Cons)\n apply(rule bind_ev_pre[where P''=\"I\"])\n apply(rule bind_ev[OF return_ev])\n apply fastforce\n apply (rule wp_post_taut)\n apply fastforce+\n done\n\nlemma mapM_x_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapM_x m lst)\"\n apply(subst mapM_x_mapM)\n apply(rule bind_ev_pre[OF return_ev mapM_ev_pre])\n apply (blast intro: reads_res invariant inv_established wp_post_taut)+\n done\n\nlemma mapM_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n shows \"equiv_valid_inv D A I (mapM m lst)\"\n using assms by (auto intro: mapM_ev_pre)\n\nlemma mapM_x_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\\"\n shows \"equiv_valid_inv D A I (mapM_x m lst)\"\n using assms by (auto intro: mapM_x_ev_pre)\n\n(* MOVE -- proof clagged from mapM_x_mapM *)\nlemma mapME_x_mapME:\n \"mapME_x f l = mapME f l >>=E (\\ y. returnOk ())\"\n apply (simp add: mapME_x_def sequenceE_x_def mapME_def sequenceE_def)\n apply (induct l, simp_all add: Let_def bindE_assoc)\n done\n\nlemma mapME_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\,-\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapME m lst)\"\n using assms\n apply(atomize)\n apply(rule_tac Q=I in equiv_valid_guard_imp)\n apply(induct lst)\n apply(simp add: mapME_Nil returnOk_ev_pre)\n apply(subst mapME_Cons)\n apply wp\n apply fastforce\n apply (rule hoare_True_E_R[where P=\"\\\"])\n apply fastforce+\n done\n\nlemma mapME_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv I A P (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ P \\ m x \\ \\_. P \\, -\"\n shows \"equiv_valid_inv I A P (mapME m lst)\"\n using assms by (auto intro: mapME_ev_pre)\n\nlemma mapME_x_ev_pre:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\,-\"\n assumes inv_established: \"\\ s. P s \\ I s\"\n shows \"equiv_valid_inv D A P (mapME_x m lst)\"\n unfolding mapME_x_mapME\n apply (wp assms mapME_ev_pre | simp)+\n done\n\nlemma mapME_x_ev:\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A I (m x)\"\n assumes invariant: \"\\ x. x \\ set lst \\ \\ I \\ m x \\ \\_. I \\, -\"\n shows \"equiv_valid_inv D A I (mapME_x m lst)\"\n using assms by (auto intro: mapME_x_ev_pre)\n\nlemma mapM_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapM m lst)\"\n apply(rule mapM_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapM_x_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapM_x m lst)\"\n apply(rule mapM_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapME_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapME m lst)\"\n apply(rule mapME_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nlemma mapME_x_ev':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (K (P x)) (m x)\"\n shows \"equiv_valid_inv D A (K (\\x\\set lst. P x)) (mapME_x m lst)\"\n apply(rule mapME_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n done\n\nsubsection\\Rules for the specialised validity\\\n\nlemma use_spec_ev:\n \"(\\st. spec_equiv_valid st I A B P f) \\ equiv_valid I A B P f\"\n by (simp add: equiv_valid_def)\n\nlemma drop_spec_ev:\n \"equiv_valid I A B P f \\ spec_equiv_valid st I A B P f\"\n by (simp add: equiv_valid_def)\n\nlemma spec_equiv_valid_guard_imp:\n assumes reads_res: \"spec_equiv_valid_inv s' I A P' f\"\n assumes guard_imp: \"\\ s. P s \\ P' s\"\n shows \"spec_equiv_valid_inv s' I A P f\"\n using assms\n by (fastforce simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma bind_spec_ev:\n assumes reads_res_2: \"\\ rv s''. (rv, s'') \\ fst (f s') \\ spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n assumes hoare: \"\\P''\\ f \\Q\\\"\n shows \"spec_equiv_valid_inv s' I A (\\s. P' s \\ P'' s) (f >>= g)\"\n using reads_res_1\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def valid_def bind_def split_def)\n apply (erule_tac x=t in allE)\n apply clarsimp\n apply (erule_tac x=\"(a, b)\" in ballE)\n apply (erule_tac x=\"(ab, bb)\" in ballE)\n apply clarsimp\n apply (cut_tac rv=\"ab\" and s''=\"b\" in reads_res_2)\n apply assumption\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply(erule_tac x=bb in allE)\n using hoare\n apply (fastforce simp: valid_def)+\n done\n\nlemma bindE_spec_ev:\n assumes reads_res_2: \"\\ rv s''. (Inr rv, s'') \\ fst (f s') \\ spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n assumes hoare: \"\\P''\\ f \\Q\\,-\"\n shows \"spec_equiv_valid_inv s' I A (\\s. P' s \\ P'' s) (f >>=E g)\"\n unfolding bindE_def\n apply (rule bind_spec_ev)\n prefer 3\n apply(rule hoare[simplified validE_R_def validE_def])\n apply(simp split: sum.split add: lift_def)\n apply(rule conjI)\n apply(fastforce simp: spec_equiv_valid_def throwError_def return_ev2)\n apply(fastforce simp: reads_res_2)\n apply(rule reads_res_1)\n done\n\nlemma if_spec_ev:\n \"\\ G \\ spec_equiv_valid_inv s' I A P f;\n \\ G \\ spec_equiv_valid_inv s' I A P' f'\n \\ \\ spec_equiv_valid_inv s' I A (\\s. (G \\ P s) \\ (\\ G \\ P' s)) (if G then f else f')\"\n by (cases G, simp+)\n\nlemmas splits_spec_ev[wp_split] =\n drop_spec_ev\n spec_equiv_valid_guard_imp[OF bind_spec_ev] spec_equiv_valid_guard_imp[OF bindE_spec_ev]\n bind_spec_ev bindE_spec_ev\n spec_equiv_valid_guard_imp[OF if_spec_ev] if_spec_ev\n\n(* Miscellaneous rules. *)\n\nlemma assertE_ev[wp]:\n \"equiv_valid_inv I A \\ (assertE b)\"\n unfolding assertE_def\n apply wp\n by simp\n\nlemma equiv_valid_2_bindE:\n assumes g: \"\\rv rv'. R' rv rv' \\\n equiv_valid_2 D A A (E \\ R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes h1: \"\\S\\ f \\Q\\,-\"\n assumes h2: \"\\S'\\ f' \\Q'\\,-\"\n assumes f: \"equiv_valid_2 D A A (E \\ R') P P' f f'\"\n shows \"equiv_valid_2 D A A (E \\ R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"E \\ R'\" and Q=\"case_sum \\\\ Q\" and Q'=\"case_sum \\\\ Q'\" and S=S and S'=S' in equiv_valid_2_bind)\n apply(clarsimp simp: lift_def split: sum.splits)\n apply(intro impI conjI allI)\n apply(simp add: throwError_def)\n apply(rule return_ev2)\n apply simp\n apply(simp)\n apply(simp)\n apply(fastforce intro: g)\n apply(rule f)\n apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n by auto\n\nlemma rel_sum_comb_equals:\n \"((=) \\ (=)) = (=)\"\n apply(rule ext)\n apply(rule ext)\n apply(rename_tac a b)\n apply(case_tac a, auto)\n done\n\ndefinition spec_equiv_valid_2_inv where\n \"spec_equiv_valid_2_inv s I A R P P' f f' \\\n equiv_valid_2 I A A R (P and ((=) s)) P' f f'\"\n\nlemma spec_equiv_valid_def2:\n \"spec_equiv_valid s I A A P f =\n spec_equiv_valid_2_inv s I A (=) P P f f\"\n apply(simp add: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n done\n\nlemma drop_spec_ev2_inv:\n \"equiv_valid_2 I A A R P P' f f' \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n apply(simp add: spec_equiv_valid_2_inv_def)\n apply(erule equiv_valid_2_guard_imp, auto)\n done\n\nlemma spec_equiv_valid_2_inv_guard_imp:\n \"\\spec_equiv_valid_2_inv s I A R Q Q' f f'; \\ s. P s \\ Q s; \\ s. P' s \\ Q' s\\ \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n by(auto simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n\nlemma bind_spec_ev2:\n assumes reads_res_2: \"\\ rv s' rv'. \\(rv, s') \\ fst (f s); R' rv rv'\\ \\ spec_equiv_valid_2_inv s' I A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes reads_res_1: \"spec_equiv_valid_2_inv s I A R' P P' f f'\"\n assumes hoare: \"\\S\\ f \\Q\\\"\n assumes hoare': \"\\S'\\ f' \\Q'\\\"\n shows \"spec_equiv_valid_2_inv s I A R (P and S) (P' and S') (f >>= g) (f' >>= g')\"\n using reads_res_1\n apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def bind_def split_def)\n apply (erule_tac x=t in allE)\n apply clarsimp\n apply (drule_tac x=\"(a, b)\" in bspec, assumption)\n apply (drule_tac x=\"(ab, bb)\" in bspec, assumption)\n apply clarsimp\n apply (cut_tac rv=\"a\" and s'=\"b\" in reads_res_2)\n apply assumption\n apply assumption\n apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n apply(drule_tac x=bb in spec)\n apply clarsimp\n using hoare hoare'\n apply (fastforce simp: valid_def)+\n done\n\nlemma spec_equiv_valid_2_inv_bindE:\n assumes g: \"\\rv s' rv'. \\(Inr rv, s') \\ fst (f s); R' rv rv'\\ \\\n spec_equiv_valid_2_inv s' I A (E \\ R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n assumes h1: \"\\S\\ f \\Q\\,-\"\n assumes h2: \"\\S'\\ f' \\Q'\\,-\"\n assumes f: \"spec_equiv_valid_2_inv s I A (E \\ R') P P' f f'\"\n shows \"spec_equiv_valid_2_inv s I A (E \\ R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n apply(unfold bindE_def)\n apply(rule spec_equiv_valid_2_inv_guard_imp)\n apply(rule_tac R'=\"E \\ R'\" and Q=\"case_sum \\\\ Q\" and Q'=\"case_sum \\\\ Q'\" and S=S and S'=S' in bind_spec_ev2)\n apply(clarsimp simp: lift_def split: sum.splits)\n apply(intro impI conjI allI)\n apply(simp add: throwError_def)\n apply(rule drop_spec_ev2_inv[OF return_ev2])\n apply simp\n apply(simp)\n apply(simp)\n apply(fastforce intro: g)\n apply(rule f)\n apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n by auto\n\nlemma trancl_subset_equivalence:\n \"\\(a, b) \\ r'\\<^sup>+; \\x. (a, x)\\r'\\<^sup>+ \\ Q x; \\x y. Q x \\ ((y, x) \\ r) = ((y, x) \\ r')\\ \\ (a, b) \\ r\\<^sup>+\"\n apply(induct a b rule: trancl.induct)\n apply(blast)\n apply(simp)\n apply(rule_tac b=b in trancl_into_trancl)\n apply(simp)\n apply(erule_tac x=c in allE)\n apply(subgoal_tac \"(a, c) \\ r'\\<^sup>+\")\n apply(auto)\n done\n\nlemma equiv_valid_rv_gets_compD:\n \"equiv_valid_rv_inv I A R P (gets (f \\ g)) \\\n equiv_valid_rv_inv I A (\\ rv rv'. R (f rv) (f rv')) P (gets g)\"\n apply(clarsimp simp: equiv_valid_2_def gets_def bind_def return_def get_def)\n done\n\n\nlemma liftE_ev2:\n \"equiv_valid_2 I A B R P P' f f' \\\n equiv_valid_2 I A B (E \\ R) P P' (liftE f) (liftE f')\"\n apply(clarsimp simp: liftE_def equiv_valid_2_def bind_def return_def)\n apply fastforce\n done\n\nlemma whenE_spec_ev2_inv:\n assumes a: \"b \\ spec_equiv_valid_2_inv s I A R P P' m m'\"\n assumes r: \"\\ x. R x x\"\n shows \"spec_equiv_valid_2_inv s I A R P P' (whenE b m) (whenE b m')\"\n unfolding whenE_def\n apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev2_inv[OF return_ev2] intro: r)\n done\n\nlemma whenE_spec_ev:\n assumes a: \"b \\ spec_equiv_valid_inv s I A P m\"\n shows \"spec_equiv_valid_inv s I A P (whenE b m) \"\n unfolding whenE_def\n apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev[OF return_ev_pre])\n done\n\n\nlemma spec_equiv_valid_2_inv_by_spec_equiv_valid:\n \"\\spec_equiv_valid s I A A P f; P' = P; f' = f;\n (\\ a. R a a)\\ \\\n spec_equiv_valid_2_inv s I A R P P' f f'\"\n apply(clarsimp simp: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma mapM_ev'':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (P x) (m x)\"\n assumes inv: \"\\ x. x \\ set lst \\ \\ \\s. \\x\\set lst. P x s \\ m x \\ \\_ s. \\x\\set lst. P x s \\\"\n shows \"equiv_valid_inv D A (\\ s. \\x\\set lst. P x s) (mapM m lst)\"\n apply(rule mapM_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n apply(wpsimp wp: inv)\n done\n\nlemma mapM_x_ev'':\n assumes reads_res: \"\\ x. x \\ set lst \\ equiv_valid_inv D A (P x) (m x)\"\n assumes inv: \"\\ x. x \\ set lst \\ \\ \\s. \\x\\set lst. P x s \\ m x \\ \\_ s. \\x\\set lst. P x s \\\"\n shows \"equiv_valid_inv D A (\\ s. \\x\\set lst. P x s) (mapM_x m lst)\"\n apply(rule mapM_x_ev)\n apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n apply(wpsimp wp: inv)\n done\n\nlemma catch_ev[wp]:\n assumes ok:\n \"equiv_valid I A A P f\"\n assumes err:\n \"\\ e. equiv_valid I A A (E e) (handler e)\"\n assumes hoare:\n \"\\ P \\ f -, \\ E \\\"\n shows\n \"equiv_valid I A A P (f handler)\"\n apply(simp add: catch_def)\n apply (wp err ok | wpc | simp)+\n apply(insert hoare[simplified validE_E_def validE_def])[1]\n apply(simp split: sum.splits)\n by simp\n\nlemma equiv_valid_rv_trivial:\n assumes inv: \"\\ P. \\ P \\ f \\ \\_. P \\\"\n shows \"equiv_valid_rv_inv I A \\\\ \\ f\"\n by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv])\n\nlemma equiv_valid_2_trivial:\n assumes inv: \"\\ P. \\ P \\ f \\ \\_. P \\\"\n assumes inv': \"\\ P. \\ P \\ f' \\ \\_. P \\\"\n shows \"equiv_valid_2 I A A \\\\ \\ \\ f f'\"\n by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv] state_unchanged[OF inv'])\n\nlemma gen_asm_ev2_r:\n \"\\P' \\ equiv_valid_2 I A B R P Q f f'\\ \\\n equiv_valid_2 I A B R P (Q and (K P')) f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_l:\n \"\\P \\ equiv_valid_2 I A B R Q P' f f'\\ \\\n equiv_valid_2 I A B R (Q and (K P)) P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_r':\n \"\\P' \\ equiv_valid_2 I A B R P \\ f f'\\ \\\n equiv_valid_2 I A B R P (\\s. P') f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma gen_asm_ev2_l':\n \"\\P \\ equiv_valid_2 I A B R \\ P' f f'\\ \\\n equiv_valid_2 I A B R (\\s. P) P' f f'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma equiv_valid_rv_liftE_bindE:\n assumes ev1:\n \"equiv_valid_rv_inv I A W P f\"\n assumes ev2:\n \"\\ rv rv'. W rv rv' \\ equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n assumes hoare:\n \"\\ P \\ f \\ Q \\\"\n shows \"equiv_valid_rv_inv I A R P ((liftE f) >>=E g)\"\n apply(unfold bindE_def)\n apply(rule_tac Q=\"\\ rv. K (\\ v. rv \\ Inl v) and (\\ s. \\ v. rv = Inr v \\ Q v s)\" in equiv_valid_rv_bind)\n apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n apply(rule ev1)\n apply(clarsimp simp: lift_def split: sum.split)\n apply(insert ev2, fastforce simp: equiv_valid_2_def)[1]\n apply(insert hoare, clarsimp simp: valid_def liftE_def bind_def return_def split_def)\n done\n\nlemma if_evrv:\n assumes \"b \\ equiv_valid_rv_inv I A R P f\"\n assumes \"\\ b \\ equiv_valid_rv_inv I A R Q g\"\n shows \"equiv_valid_rv_inv I A R (\\s. (b \\ P s) \\ (\\b \\ Q s)) (if b then f else g)\"\n apply (clarsimp split: if_split)\n using assms by blast\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/EquivValid.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.49609382947091957, "lm_q1q2_score": 0.2519223324010374}} {"text": "theory InferComplete\n imports InferRange AltLBoundLemma\nbegin\n\n (* ##### defines specialization properties *)\n \ndefinition spec_env :: \"nat res_env \\ pt_env \\ dir_type_subst \\ bool\" where\n \"spec_env env_v env t_subx = (\\ x. case env_v x of\n None \\ env x = None\n | Some a \\ env x = t_subx a\n )\" \n \nlemma self_spec_env: \"spec_env env_v (dir_subst_tenv t_sub env_v) t_sub\" \n apply (simp add: spec_env_def)\n apply (auto)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (simp add: dir_subst_tenv_def)\n done\n \nlemma eq_spec_env: \"\\ dir_subst_tenv t_sub env_v = dir_subst_tenv t_sub' env_v \\ \\ spec_env env_v (dir_subst_tenv t_sub env_v) t_sub'\" \n apply (simp)\n apply (rule_tac self_spec_env)\n done \n \n (* #### fresh list lemmas *)\n\nlemma dom_list_set_contain: \"\\ x \\ dom_list_set l \\ \\ list_contain (dom_list l) x\" \n apply (induct l)\n apply (auto)\n done\n \nlemma dom_list_set_use: \"\\ list_contain (dom_list l) x; dom_list_set l \\ ds\\ \\ x \\ ds\" \n apply (induct l)\n apply (auto)\n done\n \nlemma append_contain_dom_list: \"\\ list_contain (dom_list (l1 @ l2)) a \\ \\ list_contain (dom_list l1) a \\ list_contain (dom_list l2) a\"\n apply (auto)\n apply (induct l1)\n apply (auto)\n done\n\nlemma append_fresh_in_list: \"\\ fresh_in_list (dom_list l1); \\x. list_contain (dom_list l2) x \\ \\ list_contain (dom_list l1) x;\n fresh_in_list (dom_list l2) \\ \\ fresh_in_list (dom_list (l1 @ l2))\"\n apply (induct l1)\n apply (auto)\n apply (cut_tac a=\"a\" and ?l1.0=\"l1\" and ?l2.0=\"l2\" in append_contain_dom_list)\n apply (auto)\n done\n \nlemma append_fresh_list: \"\\ fresh_list ds (dom_list l1); tsub_dom (dir_list_add_env t_sub l1) ds';\n fresh_list ds' (dom_list l2); ds \\ ds' \\ \\ fresh_list ds (dom_list (l1 @ l2))\"\n apply (simp add: fresh_list_def)\n apply (auto)\n (* first we prove that l1 @ l2 is fresh internally *)\n apply (rule_tac append_fresh_in_list)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac l=\"l1\" and ds=\"ds'\" in list_add_dls)\n apply (auto)\n apply (cut_tac x=\"x\" and ds=\"ds'\" and l=\"l1\" in dom_list_set_use)\n apply (auto)\n (* next we want to prove that if x is in l1 @ l2, x \\ ds *)\n apply (cut_tac ?l1.0=\"l1\" and ?l2.0=\"l2\" and a=\"x\" in append_contain_dom_list)\n apply (auto)\n done \n \nlemma add_list_contain: \"\\ list_contain (dom_list l) x \\ \\ dir_list_add_env t_sub l x \\ None\"\n apply (induct l)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: dir_add_env_def)\n done\n \nlemma add_fresh_list: \"\\ fresh_list ds (dom_list l); tsub_dom (dir_list_add_env t_sub l) ds';\n x \\ ds'; ds \\ ds' \\ \\ fresh_list ds (dom_list ((x, t) # l))\" \n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: tsub_dom_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and l=\"l\" and x=\"x\" in add_list_contain)\n apply (auto)\n done\n \nlemma append_fresh_list2: \"\\ fresh_list ds (dom_list l2); tsub_dom (dir_list_add_env t_sub l2) ds';\n fresh_list ds' (dom_list l1); ds \\ ds' \\ \\ fresh_list ds (dom_list (l1 @ l2))\"\n apply (simp add: fresh_list_def)\n apply (auto)\n (* first we prove that l1 @ l2 is fresh internally *)\n apply (rule_tac append_fresh_in_list)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (cut_tac l=\"l2\" and ds=\"ds'\" in list_add_dls)\n apply (auto)\n apply (cut_tac x=\"x\" and ds=\"ds'\" and l=\"l2\" in dom_list_set_use)\n apply (auto)\n (* next we want to prove that if x is in l1 @ l2, x \\ ds *)\n apply (cut_tac ?l1.0=\"l1\" and ?l2.0=\"l2\" and a=\"x\" in append_contain_dom_list)\n apply (auto)\n done \n \n (* #### unsorted lemmas *)\n \n \nlemma add_subst_perm: \"\\ x \\ pvar_set_perm p \\ \\ sol_subst_perm (add_use_env p_sub x r) p = sol_subst_perm p_sub p\" \n apply (case_tac p)\n apply (auto)\n apply (simp add: add_use_env_def)\n done\n \nlemma add_subst_permx: \"\\ x \\ pvar_set px \\ \\ dir_subst_permx t_sub (add_use_env p_sub x r) px = dir_subst_permx t_sub p_sub px\" \n apply (induct px)\n apply (auto)\n apply (simp_all add: add_subst_perm)\n done\n \nlemma add_psub_leq_use_env: \"\\ pvar_range r_xv ds; x \\ ds; leq_use_env (dir_subst_penv t_sub p_sub r_xv) r_s \\ \\\n leq_use_env (dir_subst_penv t_sub (add_use_env p_sub x r) r_xv) r_s\"\n apply (simp add: leq_use_env_def)\n apply (simp add: dir_subst_penv_def)\n apply (auto)\n apply (rule_tac t=\"dir_subst_permx t_sub (add_use_env p_sub x r) (r_xv xa)\"\n and s=\"dir_subst_permx t_sub p_sub (r_xv xa)\" in subst)\n apply (case_tac \"x \\ pvar_set (r_xv xa)\")\n apply (simp add: add_subst_permx)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n done \n \nlemma add_psub_use_env: \"\\ pvar_range r_xv ds; x \\ ds \\ \\\n dir_subst_penv t_sub (add_use_env p_sub x r) r_xv = dir_subst_penv t_sub p_sub r_xv\" \n apply (case_tac \"\\ y. dir_subst_penv t_sub (add_use_env p_sub x r) r_xv y = dir_subst_penv t_sub p_sub r_xv y\") \n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (cut_tac t_sub=\"t_sub\" and p_sub=\"p_sub\" and x=\"x\" and px=\"r_xv y\" and r=\"r\" in add_subst_permx)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"y\" in allE)\n apply (auto)\n done\n \nlemma comp_subst_perm: \"\\ psub_dom p_sub2 ds'; pvar_set_perm p \\ ds; ds \\ ds' = {} \\ \\\n sol_subst_perm (comp_use_env p_sub1 p_sub2) p = sol_subst_perm p_sub1 p\"\n apply (case_tac p)\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (simp add: psub_dom_def)\n apply (erule_tac x=\"x2\" in allE)\n apply (auto)\n apply (case_tac \"p_sub1 x2\")\n apply (auto)\n done\n\nlemma comp_subst_permx: \"\\ psub_dom p_sub2 ds'; pvar_set px \\ ds; ds \\ ds' = {} \\ \\\n dir_subst_permx t_sub (comp_use_env p_sub1 p_sub2) px = dir_subst_permx t_sub p_sub1 px\" \n apply (induct px)\n apply (auto)\n apply (simp add: comp_subst_perm)\n apply (simp add: comp_subst_perm)\n apply (simp add: comp_subst_perm)\n done\n \nlemma comp_psub_leq_use_env1: \"\\ psub_dom p_sub2 ds'; pvar_range r_xv ds; ds \\ ds' = {};\n leq_use_env (dir_subst_penv t_sub p_sub1 r_xv) r_s \\ \\\n leq_use_env (dir_subst_penv t_sub (comp_use_env p_sub1 p_sub2) r_xv) r_s\"\n apply (simp add: leq_use_env_def)\n apply (simp add: dir_subst_penv_def)\n apply (auto)\n apply (rule_tac t=\"dir_subst_permx t_sub (comp_use_env p_sub1 p_sub2) (r_xv x)\"\n and s=\"dir_subst_permx t_sub p_sub1 (r_xv x)\" in subst)\n apply (case_tac \"pvar_set (r_xv x) \\ ds\")\n apply (simp add: comp_subst_permx)\n apply (simp add: pvar_range_def)\n apply (auto)\n done\n\nlemma comp_psub_use_env1: \"\\ psub_dom p_sub2 ds'; pvar_range r_xv ds; ds \\ ds' = {} \\ \\\n dir_subst_penv t_sub (comp_use_env p_sub1 p_sub2) r_xv = dir_subst_penv t_sub p_sub1 r_xv\" \n apply (case_tac \"\\ x. dir_subst_penv t_sub (comp_use_env p_sub1 p_sub2) r_xv x = dir_subst_penv t_sub p_sub1 r_xv x\")\n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (cut_tac t_sub=\"t_sub\" and ?p_sub1.0=\"p_sub1\" and ?p_sub2.0=\"p_sub2\" and ds=\"ds\" and ds'=\"ds'\" and px=\"r_xv x\" in comp_subst_permx)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n \nlemma comp_psub_leq_use_env2: \"\\ psub_dom p_sub1 ds'; pvar_range r_xv ds; ds \\ ds' = {};\n leq_use_env (dir_subst_penv t_sub p_sub2 r_xv) r_s \\ \\\n leq_use_env (dir_subst_penv t_sub (comp_use_env p_sub1 p_sub2) r_xv) r_s\"\n apply (cut_tac r_s=\"p_sub1\" and r_x=\"p_sub2\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac comp_psub_leq_use_env1)\n apply (auto)\n done\n \nlemma comp_psub_use_env2: \"\\ psub_dom p_sub2 ds'; pvar_range r_xv ds; ds \\ ds' = {} \\ \\\n dir_subst_penv t_sub (comp_use_env p_sub2 p_sub1) r_xv = dir_subst_penv t_sub p_sub1 r_xv\" \n apply (simp add: comm_comp_use_env)\n apply (rule_tac comp_psub_use_env1)\n apply (auto)\n done\n \nlemma diff_leq_use_env_rev: \"\\ leq_use_env (diff_use_env r_x r_ex) r_s; leq_use_env r_ex r_s \\ \\ leq_use_env r_x r_s\"\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n \nlemma dist_union_use_leq: \"\\ leq_perm p r; leq_perm q r \\ \\ leq_perm (union_perm p q) r\" \n apply (case_tac r)\n apply (auto)\n apply (case_tac p)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n apply (case_tac p)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n done\n \nlemma union_use_leq1: \"\\ leq_perm p q \\ \\ leq_perm p (union_perm q r)\" \n apply (case_tac q)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (case_tac p)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n\nlemma union_use_leq2: \"\\ leq_perm p r \\ \\ leq_perm p (union_perm q r)\" \n apply (case_tac r)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n apply (case_tac p)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n apply (case_tac q)\n apply (auto)\n done\n \nlemma dir_add_leq_permx: \"\\ t_sub x = None \\ \\ leq_perm (dir_subst_permx t_sub p_sub r) (dir_subst_permx (dir_add_env t_sub x tau) p_sub r)\" \n apply (induct r)\n apply (auto)\n apply (case_tac \"sol_subst_perm p_sub xa\")\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (auto)\n apply (case_tac \"t_sub xa\")\n apply (auto)\n apply (case_tac \"as_perm (req_type a)\")\n apply (auto)\n apply (rule_tac dist_union_use_leq)\n apply (rule_tac union_use_leq1)\n apply (auto)\n apply (rule_tac union_use_leq2)\n apply (auto)\n apply (case_tac \"dir_subst_permx t_sub p_sub r\")\n apply (auto)\n apply (case_tac \"dir_subst_permx t_sub p_sub r1\")\n apply (auto)\n done\n \nlemma dir_add_leq_use_env: \"\\ tsub_dom t_sub ds; x \\ ds \\ \\ leq_use_env (dir_subst_penv t_sub p_sub r_sv) (dir_subst_penv (dir_add_env t_sub x tau) p_sub r_sv)\"\n apply (simp add: leq_use_env_def)\n apply (simp add: dir_subst_penv_def)\n apply (auto)\n apply (simp add: tsub_dom_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac dir_add_leq_permx)\n apply (simp)\n done\n \nlemma dom_list_contain: \"\\ x \\ dom_list_set l \\ \\ list_contain (dom_list l) x\" \n apply (induct l)\n apply (auto)\n done\n\nlemma dom_list_contain_rev: \"\\ list_contain (dom_list l) x \\ \\ x \\ dom_list_set l\" \n apply (induct l)\n apply (auto)\n done \n \nlemma dir_list_add_leq_use_env: \"\\ tsub_dom t_sub ds; fresh_list ds (dom_list l) \\ \\\n leq_use_env (dir_subst_penv t_sub p_sub r_sv) (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv)\"\n apply (induct l)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_sb=\"dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv\" in trans_leq_use_env)\n apply (rule_tac ds=\"ds \\ (dom_list_set l)\" in dir_add_leq_use_env)\n apply (rule_tac ds=\"ds\" in list_add_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac x=\"a\" and l=\"l\" in dom_list_contain)\n apply (simp)\n apply (simp add: fresh_list_def)\n apply (simp add: fresh_list_def)\n done\n \nlemma dir_list_append_eq_ih: \"dir_list_add_env t_sub (l @ la) a = dir_list_add_env (dir_list_add_env t_sub la) l a\" \n apply (induct l)\n apply (auto)\n apply (simp add: dir_add_env_def)\n done\n \nlemma dir_list_append_eq: \"dir_list_add_env t_sub (l @ la) = dir_list_add_env (dir_list_add_env t_sub la) l\" \n apply (case_tac \"\\ a. dir_list_add_env t_sub (l @ la) a = dir_list_add_env (dir_list_add_env t_sub la) l a\")\n apply (auto)\n apply (simp add: dir_list_append_eq_ih)\n done\n \nlemma ifz_sol_subst_penv: \"\\ p_sub p = NoPerm \\ \\ dir_subst_penv t_sub p_sub (ifz_var_env (XPerm (SVar p)) r_sv) = empty_use_env\" \n apply (case_tac \"\\ x. dir_subst_penv t_sub p_sub (ifz_var_env (XPerm (SVar p)) r_sv) x = empty_use_env x\") \n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: ifz_var_env_def)\n apply (simp add: empty_use_env_def)\n apply (case_tac \"r_sv x = XPerm (SPerm NoPerm)\")\n apply (auto)\n done \n \n (* #### pvar / tvar lemmas *)\n \nfun pvar_aff where\n \"pvar_aff (AffConst a) = {}\"\n| \"pvar_aff (AffVar v) = {v}\" \n \nfun pvar_type where\n \"pvar_type IntScheme = {}\"\n | \"pvar_type BoolScheme = {}\"\n | \"pvar_type UnitScheme = {}\"\n | \"pvar_type (VarScheme v) = {}\" \n | \"pvar_type (ArrayScheme tau) = pvar_type tau\"\n | \"pvar_type (PairScheme t1 t2 p) = pvar_type t1 \\ pvar_type t2 \\ pvar_set_perm p\"\n | \"pvar_type (FunScheme t1 t2 p a) = pvar_type t1 \\ pvar_type t2 \\ pvar_set_perm p \\ pvar_aff a\"\n | \"pvar_type (ChanScheme tau c_end) = pvar_type tau\" \n \nlemma comp_subst_aff: \"\\ psub_dom p_subx ds; pvar_aff a \\ ds = {} \\ \\\n sol_subst_aff p_sub a = sol_subst_aff (comp_use_env p_sub p_subx) a\" \n apply (case_tac a)\n apply (auto)\n apply (simp add: psub_dom_def)\n apply (simp add: comp_use_env_def)\n apply (erule_tac x=\"x2\" in allE)\n apply (auto)\n apply (case_tac \"p_sub x2\")\n apply (auto)\n done\n \nlemma comp_dir_subst_type1: \"\\ dir_subst_type t_sub p_sub tau_v tau;\n pvar_type tau_v \\ ds; psub_dom p_subx ds'; ds \\ ds' = {} \\ \\\n dir_subst_type t_sub (comp_use_env p_sub p_subx) tau_v tau\" \n apply (induct tau_v arbitrary: tau)\n apply (auto)\n apply (simp add: comp_subst_perm)\n apply (simp add: comp_subst_perm)\n apply (rule_tac comp_subst_aff)\n apply (auto)\n done\n\nlemma comp_dir_subst_type2: \"\\ dir_subst_type t_sub p_subx tau_v tau;\n pvar_type tau_v \\ ds; psub_dom p_sub ds'; ds \\ ds' = {} \\ \\\n dir_subst_type t_sub (comp_use_env p_sub p_subx) tau_v tau\" \n apply (cut_tac r_s=\"p_sub\" and r_x=\"p_subx\" in comm_comp_use_env)\n apply (auto)\n apply (rule_tac comp_dir_subst_type1)\n apply (auto)\n done\n \nlemma add_subst_aff: \"\\ p \\ pvar_aff a \\ \\\n sol_subst_aff p_sub a = sol_subst_aff (add_use_env p_sub p r) a\" \n apply (case_tac a)\n apply (auto)\n apply (simp add: add_use_env_def)\n done\n \nlemma add_dir_subst_type: \"\\ dir_subst_type t_sub p_sub tau_v tau; p \\ pvar_type tau_v \\ \\\n dir_subst_type t_sub (add_use_env p_sub p r) tau_v tau\"\n apply (induct tau_v arbitrary: tau)\n apply (auto)\n apply (simp add: add_subst_perm)\n apply (simp add: add_subst_perm)\n apply (rule_tac add_subst_aff)\n apply (auto)\n done\n \nlemma dir_add_subst_permx: \"\\ x \\ tvar_set px \\ \\\n dir_subst_permx (dir_add_env t_sub x tau) p_sub px = dir_subst_permx t_sub p_sub px\"\n apply (induct px)\n apply (auto)\n apply (simp add: dir_add_env_def)\n done \n \nlemma dir_add_subst_type: \"\\ dir_subst_type t_sub p_sub tau_v tau; x \\ tvar_type tau_v \\ \\\n dir_subst_type (dir_add_env t_sub x t) p_sub tau_v tau\"\n apply (induct tau_v arbitrary: tau)\n apply (auto)\n apply (simp add: dir_add_env_def)\n done\n \nlemma dir_list_add_subst_type: \"\\ dir_subst_type t_sub p_sub tau_v tau; tvar_type tau_v \\ dom_list_set l = {} \\ \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau\"\n apply (induct l arbitrary: tau_v tau)\n apply (auto)\n apply (rule_tac dir_add_subst_type)\n apply (auto)\n done\n \nlemma infer_tvar_type: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ tvar_type tau_v \\ ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op case *)\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_s_def)\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_s_def)\n (* var case *)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"res_name x\" in allE)\n apply (auto)\n (* pair case *) \n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (simp)\n apply (cut_tac c=\"x\" and A=\"tvar_type t1\" and B=\"ds2\" in contra_subsetD)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_type t2\" and B=\"ds3\" in contra_subsetD)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (simp)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (auto)\n apply (case_tac \"x \\ ds'\")\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_type t2\" and B=\"ds3\" in contra_subsetD)\n apply (auto)\n (* lam case *)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_type t2\" and B=\"ds2\" in contra_subsetD)\n apply (auto)\n done\n \nlemma ipvt_const: \"\\sub_range env_v ds; xa \\ pvar_type tau_v; const_scheme x ds tau_v c_list ds'\\ \\ xa \\ set_diff ds' ds\" \n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_s_def)\n apply (simp_all add: set_diff_def)\n apply (simp_all add: fresh_list_def)\n apply (auto)\n done\n \nlemma infer_pvar_type: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ pvar_type tau_v \\ set_diff ds' ds\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op case *)\n apply (rule_tac ipvt_const)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_s_def)\n (* pair case p1. *)\n apply (simp add: set_diff_def)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (simp)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (case_tac \"\\ pvar_type t1 \\ ds2 - ds\")\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"x \\ ds2\")\n apply (auto)\n apply (case_tac \"x \\ ds\")\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* pair case p2. *)\n apply (case_tac \"\\ pvar_type t2 \\ ds3 - ds2\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"x \\ ds3\")\n apply (auto)\n apply (case_tac \"x \\ ds2\")\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n (* if case *)\n apply (case_tac \"\\ pvar_type t2 \\ ds3 - ds2\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (case_tac \"x \\ ds3\")\n apply (auto)\n apply (case_tac \"x \\ ds2\")\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* lam case *)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"\\ pvar_type t2 \\ ds2 - (insert a ds)\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (case_tac \"p \\ ds2\")\n apply (auto)\n apply (case_tac \"a \\ insert a ds\")\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)(*\n apply (cut_tac env_v=\"add_env env_v (Var x1a) a\" and r_sv=\"r_s'\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)*)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (auto)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_type t2\" and B=\"ds2 - (insert a ds)\" in contra_subsetD)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_type t2\" and B=\"ds2 - (insert a ds)\" in contra_subsetD)\n apply (auto)\n done \n \n (* #### auxiliary lemmas *)\n \n (* \n when we call \"infer\" on an expression, we receive a constraint set representing the set of all possible solutions for well-typedness.\n\n suppose that an expression is well-typed, and we have a partial solution to the constraint set, solving all permission based constraints,\n reducing all constraints to just type-based constraints.\n\n Gamma, P1 |- e: tau, P2, Q \\ Infer(Gamma*, X, e) = (tau*, P*, Q*, R*, K, X') \\\n \\( P* ) \\ P1 \\ \\( tau* ) \\ tau \\ Gamma* \\ Gamma \\\n (\\ \\. \\ |= \\(K) \\ \\( Gamma* ) = Gamma \\ \\(\\( tau* )) = tau)\n\n\n Gamma, P1 |- e: tau, P2, Q \\ Infer(Gamma*, X, e) = (tau*, P*, Q*, R*, K, X') \n Gamma* \\ Gamma \\\n (\\ \\. \\ |~ K \\ \\( Gamma* ) = Gamma \\ \\( tau* ) = tau) \n *)\n\nlemma dir_subst_spec_env_ex: \"\\ spec_env env_v env t_subx \\ \\ dir_subst_tenv t_subx env_v = env\"\n apply (case_tac \"\\ x. dir_subst_tenv t_subx env_v x = env x\")\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (simp add: spec_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"env_v x\")\n apply (auto)\n done \n \nlemma dir_subst_spec_env: \"\\ spec_env env_v env t_subx \\ \\ \\t_sub. dir_subst_tenv t_sub env_v = env\" \n apply (rule_tac x=\"t_subx\" in exI)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (simp)\n done\n \nlemma ivrcc_prim_case: \"\\ spec_env env_v env t_sub; tsub_dom t_sub ds \\ \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds \\\n fresh_list ds (dom_list l) \\ dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\ (\\p_sub. psub_dom p_sub {})\" \n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (simp)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (simp add: psub_dom_def)\n apply (simp add: empty_use_env_def)\n done\n \nlemma ivrcc_array_case: \"\\ spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds;\n ta \\ ds; req_type t \\ Aff \\ \\\n \\l. tsub_dom (dir_list_add_env t_sub l) (insert ta ds) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (insert ta ds - ds)) \\\n dir_list_add_env t_sub l ta = Some t \\ (\\tau_x. dir_list_add_env t_sub l ta = Some tau_x \\ aff_leq (req_type tau_x) UsePerm)\" \n apply (rule_tac x=\"[(ta, t)]\" in exI)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac empty_psub_dom)\n apply (simp add: dir_add_env_def)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: dir_add_env_def)\n apply (case_tac \"req_type t\")\n apply (auto) \n done\n \nlemma ivrcc_chan_case: \"\\ spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; ta \\ ds \\ \\\n \\l. tsub_dom (dir_list_add_env t_sub l) (insert ta ds) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\ (\\p_sub. psub_dom p_sub (insert ta ds - ds)) \\ dir_list_add_env t_sub l ta = Some t\" \n apply (rule_tac x=\"[(ta, t)]\" in exI)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac dir_add_eq_env)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac empty_psub_dom)\n apply (simp add: dir_add_env_def)\n done\n\nlemma empty_cut_use_env: \"cut_use_env empty_use_env = empty_use_env\" \n apply (case_tac \"\\ x. cut_use_env empty_use_env x = empty_use_env x\")\n apply (auto)\n apply (simp add: cut_use_env_def)\n apply (simp add: empty_use_env_def)\n done\n \nlemma ivr_const_case: \"\\spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; tau \\ const_type x; const_scheme x ds tau_v c_list ds';\n leq_use_env (diff_use_env r_s r_ex) r_s; leq_use_env r_x (diff_use_env r_s r_ex)\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list)\" \n apply (simp add: empty_leq_var_env)\n apply (simp add: subst_empty_var_env)\n apply (simp add: diff_empty_use_env1)\n apply (simp add: empty_cut_use_env)\n apply (simp add: leq_empty_use_env)\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n apply (simp_all add: pure_fun_s_def)\n apply (simp_all add: unlim_def)\n apply (simp_all add: set_diff_def)\n (* basic cases *)\n apply (rule_tac ivrcc_prim_case)\n apply (auto)\n apply (rule_tac ivrcc_prim_case)\n apply (auto)\n apply (rule_tac ivrcc_prim_case)\n apply (auto)\n (* fixed point *)\n apply (case_tac t)\n apply (auto)\n apply (rule_tac x=\"[(t2, x62), (t1, x61)]\" in exI)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac x=\"add_use_env (add_use_env empty_use_env p x63) q (as_perm x64)\" in exI)\n apply (auto)\n apply (rule_tac add_psub_dom)\n apply (rule_tac add_psub_dom)\n apply (rule_tac empty_psub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (simp add: add_use_env_def)\n apply (simp add: trip_convert)\n apply (simp add: fresh_list_def)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (simp add: add_use_env_def)\n apply (simp add: trip_convert)\n apply (simp add: add_use_env_def)\n apply (case_tac x64)\n apply (auto)\n (* array cases *)\n apply (rule_tac ivrcc_array_case)\n apply (auto)\n apply (rule_tac ivrcc_array_case)\n apply (auto)\n apply (rule_tac ivrcc_array_case)\n apply (auto)\n apply (rule_tac ivrcc_array_case)\n apply (auto)\n (* unpack *)\n apply (rule_tac x=\"[(t1a, t1), (t2a, t2), (txa, tx)]\" in exI)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (rule_tac x=\"add_use_env (add_use_env empty_use_env p r) p' r'\" in exI)\n apply (auto)\n apply (rule_tac add_psub_dom)\n apply (rule_tac add_psub_dom)\n apply (rule_tac empty_psub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: dir_add_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: dir_add_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: dir_add_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* simp chan cases *)\n apply (simp_all add: is_own_def)\n apply (rule_tac ivrcc_chan_case)\n apply (auto)\n apply (rule_tac ivrcc_chan_case)\n apply (auto)\n apply (rule_tac ivrcc_chan_case)\n apply (auto)\n (* fork *)\n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (auto)\n apply (rule_tac x=\"add_use_env empty_use_env p (as_perm a)\" in exI)\n apply (auto)\n apply (rule_tac add_psub_dom)\n apply (rule_tac empty_psub_dom)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (simp add: trip_convert)\n done\n\nlemma ivr_op_case: \"\\spec_env env_v env t_sub; sub_range env_v ds'; tsub_dom t_sub ds'; leq_use_env (diff_use_env r_s r_ex) r_s; leq_use_env r_x (diff_use_env r_s r_ex)\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds' (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds') \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub (op_scheme x) (op_type x))\"\n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (simp)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (simp add: empty_psub_dom)\n apply (simp add: empty_leq_var_env)\n apply (simp add: subst_empty_var_env)\n apply (simp add: diff_empty_use_env1)\n apply (simp add: empty_cut_use_env)\n apply (simp add: leq_empty_use_env)\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: pure_fun_def)\n apply (simp_all add: pure_fun_s_def)\n done\n\n (* \n we want to show that if we subtract EX from our constructed requirements - constructed subtractant,\n we will end up with a result contained in Q. (that our total construction is minimal).\n `(X - M) - EX \\ Q`\n\n by induction, our constructed reqs should be less than the real reqs. the key then is to make\n sure that we are subtracting our \"enough\". both the real subtractant + the artificial subtractant.\n we can know that we are since EX subtracts more than both of these.\n (X - M) \\ rx \\ rx - EX' \\ Q \\ P1 - EX' \\ P1 - EX\n *)\n \nlemma squish_leq_use_env: \"\\ leq_use_env (diff_use_env r_s r_ex') (diff_use_env r_c r_ex);\n leq_use_env (diff_use_env r_c r_ex) (diff_use_env r_c r_ex'); leq_use_env r_x r_s; leq_use_env r_s r_c \\ \\\n leq_use_env (diff_use_env r_x r_ex) (diff_use_env r_s r_ex')\" \n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: diff_use_env_def)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex' x\")\n apply (auto)\n apply (case_tac \"r_c x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex' x\")\n apply (auto)\n apply (case_tac \"r_c x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_c x\")\n apply (auto)\n done\n \nlemma crush_leq_use_env: \"\\ leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s r_ex'); leq_use_env r_xa r_s;\n leq_use_env (diff_use_env r_xb r_ex) r_xa \\ \\\n leq_use_env (diff_use_env r_xb r_ex) (diff_use_env r_xa r_ex')\"\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex' x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n apply (case_tac \"r_ex' x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_xa x\")\n apply (auto)\n done\n\nlemma dist_diff_leq_use_env_rev: \"\\ leq_use_env r_exa r_s; leq_use_env (diff_use_env r_s r_exb) (diff_use_env r_s r_exa) \\ \\\n leq_use_env (cut_use_env r_exa) r_exb\"\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n done\n \nlemma ivrvc_ineq: \"\\ t_sub b = Some tau_x \\ \\\n leq_use_env (dir_subst_penv t_sub p_sub (one_var_env (owner_name x) (XType b))) (ereq_use_env (owner_name x) tau_x)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: one_var_env_def)\n apply (simp add: ereq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: end_req_perm_def)\n apply (case_tac \"req_type tau_x\")\n apply (auto)\n done\n \nlemma dist_cut_leq_use_env: \"\\ leq_use_env r_x r_s \\ \\ leq_use_env (cut_use_env r_x) (cut_use_env r_s)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma rhs_cut_leq_use_env: \"\\ leq_use_env (cut_use_env r_x) r_s \\ \\ leq_use_env (cut_use_env r_x) (cut_use_env r_s)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma dist_cut_comp_use_env: \"cut_use_env (comp_use_env r_s r_x) = comp_use_env (cut_use_env r_s) (cut_use_env r_x)\" \n apply (case_tac \"\\ x. cut_use_env (comp_use_env r_s r_x) x = comp_use_env (cut_use_env r_s) (cut_use_env r_x) x\") \n apply (auto)\n apply (simp add: cut_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (simp_all add: comp_use_env_def)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp_all add: comp_use_env_def)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp add: comp_use_env_def)\n done\n \nlemma lhs_dist_cut_leq_use_env: \"\\ leq_use_env (comp_use_env (cut_use_env r_s) (cut_use_env r_x)) r_c \\ \\\n leq_use_env (cut_use_env (comp_use_env r_s r_x)) r_c\" \n apply (simp add: dist_cut_comp_use_env)\n done\n \nlemma ivr_var_case: \"\\spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; env (res_name x) = Some tau; env_v (res_name x) = Some a;\n env (owner_name x) = Some tau_x; value_req x tau tau_x; env_v (owner_name x) = Some b; leq_use_env (ereq_use_env (owner_name x) tau_x) r_s;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)); leq_use_env r_x (diff_use_env r_s r_ex);\n leq_use_env r_exa r_s; leq_use_env (diff_use_env (ereq_use_env (owner_name x) tau_x) (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)) r_x\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (one_var_env (owner_name x) (XType b))) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (one_var_env (owner_name x) (XType b))) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (one_var_env (owner_name x) (XType b)))) r_ex \\\n dir_list_add_env t_sub l a = Some tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub (var_val_crn x (VarScheme a) (VarScheme b)))\" \n apply (rule_tac x=\"[]\" in exI)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (simp)\n apply (case_tac \"t_sub a \\ Some tau\")\n apply (simp add: spec_env_def)\n apply (erule_tac x=\"res_name x\" in allE)\n apply (case_tac \"env_v (res_name x)\")\n apply (auto)\n apply (case_tac \"t_sub b \\ Some tau_x\")\n apply (simp add: spec_env_def)\n apply (erule_tac x=\"owner_name x\" in allE)\n apply (case_tac \"env_v (owner_name x)\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and x=\"x\" and b=\"b\" and tau_x=\"tau_x\" in ivrvc_ineq)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac empty_psub_dom)\n apply (rule_tac r_sb=\"ereq_use_env (owner_name x) tau_x\" in trans_leq_use_env)\n apply (simp_all)(*\n apply (rule_tac st_diff_comp_leq_use_env)*)\n apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (owner_name x) tau_x) (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (simp_all)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"cut_use_env (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)\" in trans_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in dist_diff_leq_use_env_rev)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac dist_cut_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (case_tac x)\n apply (auto)(*\n apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (owner_name x) tau_x) (comp_use_env (ereq_use_env (owner_name x) tau_x) r_exa)\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_c=\"r_s\" in squish_leq_use_env)\n apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n apply (auto)*)\n done\n \n\nlemma ivrpc_coerce: \"\\ \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds \\ \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list)\" \n apply (auto)\n done\n\nlemma sub_snorm_use_env: \"\\ leq_use_env r_exa r_s; leq_use_env r_x (diff_use_env r_s r_exa);\n \\ x. super_norm_use_env (diff_use_env r_s r_exa) r_x x = diff_use_env (diff_use_env r_s r_exa) r_exb x \\ \\\n diff_use_env r_s (comp_use_env r_exa r_exb) = super_norm_use_env r_s r_x\"\n apply (case_tac \"\\ x. diff_use_env r_s (comp_use_env r_exa r_exb) x = super_norm_use_env r_s r_x x\")\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: leq_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: super_norm_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: comp_use_env_def)\n apply (case_tac \"diff_perm (r_s x) (r_exa x) = OwnPerm \\ r_x x = NoPerm\")\n apply (auto)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (case_tac \"r_s x = OwnPerm \\ r_x x = NoPerm\")\n apply (auto)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (simp add: diff_use_env_def)\n apply (case_tac \"r_exa x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_exb x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \n \n \nlemma ivr_induct_format: \"\\ well_typed env r_s1 e1 t1 r_s2 rx1; well_typed env r_s2 e2 t2 r_s3 rx2 \\ \\\n (\\ r_exa r_exb. leq_use_env r_exa r_s1 \\ leq_use_env r_exb (diff_use_env r_s1 r_exa) \\\n super_norm_use_env r_s1 r_s3 = diff_use_env r_s1 (comp_use_env r_exa r_exb) \\\n well_typed env r_s1 e1 t1 (diff_use_env r_s1 r_exa) rx1 \\\n well_typed env (diff_use_env r_s1 r_exa) e2 t2 (diff_use_env (diff_use_env r_s1 r_exa) r_exb) rx2)\" \n apply (cut_tac env=\"env\" and e=\"e1\" in well_typed_sstr_end_perm) \n apply (auto)\n apply (cut_tac env=\"env\" and r_c=\"super_norm_use_env r_s1 r_s2\" and e=\"e2\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rhs_snorm_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2\" in snorm_diff_use_env)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"diff_use_env r_s1 r_ex\" and e=\"e2\" in well_typed_sstr_end_perm)\n apply (auto)\n apply (cut_tac r_s=\"diff_use_env r_s1 r_ex\" and r_x=\"r_s3\" in snorm_diff_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_exa\" in exI)\n apply (auto)\n apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s3\" and r_exa=\"r_ex\" and r_exb=\"r_exa\" in sub_snorm_use_env)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done\n \nlemma sol_sat_split: \"\\ dir_sol_sat t_sub p_sub cl1; dir_sol_sat t_sub p_sub cl2 \\ \\ dir_sol_sat t_sub p_sub (cl1 @ cl2)\" \n apply (induct cl1)\n apply (auto)\n done\n\nfun tvar_crn where\n \"tvar_crn (UnifyCrn t1 t2) = (tvar_type t1 \\ tvar_type t2)\"\n| \"tvar_crn (MemValCrn tau tau_x) = (tvar_type tau \\ tvar_type tau_x)\"\n| \"tvar_crn (LeqCrn px q) = (tvar_set px)\"\n| \"tvar_crn (LeqTypeCrn tau px) = (tvar_type tau)\"\n| \"tvar_crn (DisjCrn px qx) = (tvar_set px \\ tvar_set qx)\" \n| \"tvar_crn (SemiDisjCrn px qx) = (tvar_set px \\ tvar_set qx)\"\n\nfun tvar_crn_list where\n \"tvar_crn_list [] = {}\"\n| \"tvar_crn_list (c # c_t) = (tvar_crn c \\ tvar_crn_list c_t)\"\n \nfun pvar_crn where\n \"pvar_crn (UnifyCrn t1 t2) = (pvar_type t1 \\ pvar_type t2)\"\n| \"pvar_crn (MemValCrn tau tau_x) = (pvar_type tau \\ pvar_type tau_x)\"\n| \"pvar_crn (LeqCrn px q) = (pvar_set px \\ pvar_set_perm q)\"\n| \"pvar_crn (LeqTypeCrn tau px) = (pvar_type tau \\ pvar_set_perm px)\"\n| \"pvar_crn (DisjCrn px qx) = (pvar_set px \\ pvar_set qx)\" \n| \"pvar_crn (SemiDisjCrn px qx) = (pvar_set px \\ pvar_set qx)\"\n\nfun pvar_crn_list where\n \"pvar_crn_list [] = {}\"\n| \"pvar_crn_list (c # c_t) = (pvar_crn c \\ pvar_crn_list c_t)\"\n \nlemma dir_add_sol_crn: \"\\ dir_sol_crn t_sub p_sub c; x \\ tvar_crn c \\ \\ dir_sol_crn (dir_add_env t_sub x tau) p_sub c\"\n apply (case_tac c)\n apply (auto)\n apply (simp_all add: dir_add_subst_permx)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (simp add: dir_add_subst_type)\n apply (rule_tac x=\"t'\" in exI)\n apply (rule_tac x=\"tx'\" in exI)\n apply (simp add: dir_add_subst_type)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (simp add: dir_add_subst_type)\n done\n \nlemma dir_add_sol_sat: \"\\ dir_sol_sat t_sub p_sub c_list; x \\ tvar_crn_list c_list \\ \\ dir_sol_sat (dir_add_env t_sub x tau) p_sub c_list\"\n apply (induct c_list)\n apply (auto)\n apply (rule_tac dir_add_sol_crn)\n apply (auto)\n done\n\n (* if we add variables to t_sub, and those variables are fresh from c_list, solution satisfaction is maintained *)\nlemma dir_list_add_sol_sat: \"\\ dir_sol_sat t_sub p_sub c_list; (dom_list_set l) \\ (tvar_crn_list c_list) = {} \\ \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list\"\n apply (induct l)\n apply (auto)\n apply (rule_tac dir_add_sol_sat)\n apply (auto)\n done\n\nlemma add_psub_sol_crn: \"\\ dir_sol_crn t_sub p_sub c; x \\ pvar_crn c \\ \\\n dir_sol_crn t_sub (add_use_env p_sub x r) c\"\n apply (case_tac c)\n apply (auto)\n apply (simp_all add: add_subst_permx)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (simp add: add_dir_subst_type)\n apply (rule_tac x=\"t'\" in exI)\n apply (rule_tac x=\"tx'\" in exI)\n apply (simp add: add_dir_subst_type)\n apply (simp add: add_subst_perm)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (auto)\n apply (simp add: add_dir_subst_type)\n apply (simp add: add_subst_perm)\n done\n \nlemma add_psub_sol_sat: \"\\ dir_sol_sat t_sub p_sub c_list; x \\ pvar_crn_list c_list \\ \\\n dir_sol_sat t_sub (add_use_env p_sub x r) c_list\"\n apply (induct c_list)\n apply (auto)\n apply (simp add: add_psub_sol_crn)\n done\n \nlemma comp_psub_sol_crn: \"\\ dir_sol_crn t_sub p_sub c; pvar_crn c \\ ds; psub_dom p_subx ds'; ds \\ ds' = {} \\ \\\n dir_sol_crn t_sub (comp_use_env p_sub p_subx) c\"\n apply (induct c)\n apply (auto)\n apply (simp_all add: comp_subst_permx)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (simp add: comp_dir_subst_type1)\n apply (rule_tac x=\"t'\" in exI)\n apply (rule_tac x=\"tx'\" in exI)\n apply (simp add: comp_dir_subst_type1)\n apply (simp add: comp_subst_perm)\n apply (rule_tac x=\"tau_x\" in exI)\n apply (simp add: comp_dir_subst_type1)\n apply (simp add: comp_subst_perm)\n done\n \nlemma comp_psub_sol_sat1: \"\\ dir_sol_sat t_sub p_sub c_list; pvar_crn_list c_list \\ ds; psub_dom p_subx ds'; ds \\ ds' = {} \\ \\\n dir_sol_sat t_sub (comp_use_env p_sub p_subx) c_list\"\n apply (induct c_list)\n apply (auto)\n apply (simp add: comp_psub_sol_crn)\n done\n\nlemma comp_psub_sol_sat2: \"\\ dir_sol_sat t_sub p_sub c_list; pvar_crn_list c_list \\ ds; psub_dom p_subx ds'; ds \\ ds' = {} \\ \\\n dir_sol_sat t_sub (comp_use_env p_subx p_sub) c_list\"\n apply (simp add: comm_comp_use_env)\n apply (rule_tac comp_psub_sol_sat1)\n apply (auto)\n done\n \nlemma derive_dom_list_set: \"\\ tsub_dom (dir_list_add_env t_sub l) ds';\n fresh_list ds (dom_list l) \\ \\ dom_list_set l \\ set_diff ds' ds\"\n apply (induct l)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (simp add: tsub_dom_def)\n apply (simp add: fresh_list_def)\n apply (simp add: dir_add_env_def)\n apply (case_tac \"tsub_dom (dir_list_add_env t_sub l) ds'\")\n apply (case_tac \"fresh_list ds (dom_list l)\")\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and x=\"a\" and ds=\"ds'\" and tau=\"b\" in add_tsub_dom_rev)\n apply (auto)\n done\n \n (*\nlemma infer_tvar_crn_list: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds' \\ \\ tvar_crn_list c_list \\ ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n *)\n \nlemma tvar_clist_split: \"\\ x \\ tvar_crn_list (cl1 @ cl2) \\ \\ x \\ tvar_crn_list cl1 \\ x \\ tvar_crn_list cl2\" \n apply (induct cl1)\n apply (auto)\n done \n \nlemma tvar_clist_disj: \"\\ x \\ tvar_crn_list (disj_crn r_s r_x d); tvar_range r_s ds; tvar_range r_x ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done\n \nlemma tvar_clist_semi_disj: \"\\ x \\ tvar_crn_list (semi_disj_crn r_s r_x d); tvar_range r_s ds; tvar_range r_x ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done\n\nlemma tvar_clist_aff: \"\\ x \\ tvar_crn_list (aff_crn r_s p d); tvar_range r_s ds; tvar_set_perm p \\ ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done \n \nlemma pvar_clist_split: \"\\ x \\ pvar_crn_list (cl1 @ cl2) \\ \\ x \\ pvar_crn_list cl1 \\ x \\ pvar_crn_list cl2\" \n apply (induct cl1)\n apply (auto)\n done\n \nlemma pvar_clist_disj: \"\\ x \\ pvar_crn_list (disj_crn r_s r_x d); pvar_range r_s ds; pvar_range r_x ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done\n\nlemma pvar_clist_semi_disj: \"\\ x \\ pvar_crn_list (semi_disj_crn r_s r_x d); pvar_range r_s ds; pvar_range r_x ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done\n\nlemma pvar_clist_aff: \"\\ x \\ pvar_crn_list (aff_crn r_s p d); pvar_range r_s ds; pvar_set_perm p \\ ds \\ \\ x \\ ds\" \n apply (induct d)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"a\" in allE)\n apply (auto)\n done\n\ndefinition induct_clist where\n \"induct_clist v_list ds = (v_list \\ ds)\"\n \nlemma infer_tvar_crn_list_ih: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ induct_clist (tvar_crn_list c_list) ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op case *)\n apply (simp add: induct_clist_def)\n apply (case_tac x)\n apply (auto)\n apply (simp add: induct_clist_def)\n (* var case *)\n apply (simp add: induct_clist_def)\n apply (case_tac x)\n apply (auto)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"Loc x22\" in allE)\n apply (auto)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"Loc x21\" in allE)\n apply (auto)\n (* pair case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" and env_v=\"env_v\" in subset_sub_range)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac r_sv=\"r_s1\" and r_xv=\"r_x1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac r_sv=\"r_s2\" and r_xv=\"r_x2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac r_mv=\"r_m1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac r_mv=\"r_m2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"disj_crn (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)) d\" and\n ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"lift_var_env r_x1 (SVar p)\" and r_x=\"lift_var_env r_x2 (SVar p)\" and x=\"x\" and ds=\"insert p ds3\" in tvar_clist_disj)\n apply (simp)\n apply (rule_tac lift_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m2 r_x1 d\" and\n ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m2\" and r_x=\"r_x1\" and x=\"x\" and ds=\"insert p ds3\" in tvar_clist_semi_disj)\n apply (simp)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 r_s2 d\" and ?cl2.0=\"cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"r_s2\" and x=\"x\" and ds=\"ds3\" in tvar_clist_semi_disj)\n apply (simp)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl1\" and B=\"ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl2\" and B=\"ds3\" in Set.rev_subsetD)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 (comp_var_env r_s2 r_s3) d\" and\n ?cl2.0=\"cl1 @ cl2 @ cl3\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"comp_var_env r_s2 r_s3\" and x=\"x\" and ds=\"ds'\" in tvar_clist_semi_disj)\n apply (simp)\n apply (cut_tac r_mv=\"r_m1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (cut_tac r_sv=\"r_s2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac r_sv=\"r_s3\" and e=\"e3\" and env_v=\"env_v\" and ds=\"ds3\" and ds'=\"ds'\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2 @ cl3\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl1\" and B=\"ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl2\" and ?cl2.0=\"cl3\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl2\" and B=\"ds3\" in Set.rev_subsetD)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl3\" and B=\"ds'\" in Set.rev_subsetD)\n apply (auto)\n (* lam case *)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (cut_tac r_sv=\"r_s'\" and e=\"e\" and env_v=\"add_env env_v (Var x1a) a\" in infer_tvar_range)\n apply (auto) \n apply (rule_tac add_sub_range)\n apply (simp)\n apply (simp add: tvar_range_def)\n apply (erule_tac x=\"Var x1a\" in allE)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"aff_crn (rem_var_env r_s' (Var x1a)) (SVar q) d\" and ?cl2.0=\"cl\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"rem_var_env r_s' (Var x1a)\" and x=\"x\" and p=\"SVar q\" and ds=\"insert q ds2\" in tvar_clist_aff)\n apply (simp)\n apply (rule_tac rem_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (cut_tac r_sv=\"r_s'\" and e=\"e\" and env_v=\"add_env env_v (Var x1a) a\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac e=\"e\" and ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac add_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (simp_all)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl\" and B=\"ds2\" in Set.rev_subsetD)\n apply (auto)\n (* app case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (cut_tac r_sv=\"r_s1\" and e=\"e1\" and env_v=\"env_v\" in infer_tvar_range)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"disj_crn r_x1 (lift_var_env r_x2 (SVar p)) d\" and\n ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_x1\" and r_x=\"lift_var_env r_x2 (SVar p)\" and x=\"x\" and ds=\"insert p ds3\" in tvar_clist_disj)\n apply (auto)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (cut_tac r_sv=\"r_s1\" and e=\"e1\" and env_v=\"env_v\" in infer_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac r_sv=\"r_s2\" and e=\"e2\" and ds=\"ds2\" and env_v=\"env_v\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m2 r_x1 d\" and ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m2\" and r_x=\"r_x1\" and x=\"x\" and ds=\"insert p ds3\" in tvar_clist_semi_disj)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac env_v=\"env_v\" and ds=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 r_s2 d\" and ?cl2.0=\"cl1 @ cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"r_s2\" and x=\"x\" and ds=\"insert p ds3\" in tvar_clist_semi_disj)\n apply (auto)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac env_v=\"env_v\" and ds=\"ds\" in infer_m_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2\" in tvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl1\" and B=\"ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"tvar_crn_list cl2\" and B=\"ds3\" in Set.rev_subsetD)\n apply (auto)\n done\n \nlemma infer_tvar_crn_list: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ tvar_crn_list c_list \\ ds'\" \n apply (cut_tac env_v=\"env_v\" and e=\"e\" and ds=\"ds\" and ds'=\"ds'\" in infer_tvar_crn_list_ih)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n done\n \nlemma infer_pvar_crn_list_ih: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ induct_clist (pvar_crn_list c_list) (set_diff ds' ds)\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op case *)\n apply (simp add: induct_clist_def)\n apply (simp add: set_diff_def)\n apply (case_tac x)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: induct_clist_def)\n (* var case *)\n apply (simp add: induct_clist_def)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n (* pair case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_type)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac r_sv=\"r_s1\" and r_xv=\"r_x1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac r_sv=\"r_s2\" and r_xv=\"r_x2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac r_mv=\"r_m1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac r_mv=\"r_m2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"disj_crn (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)) d\" and\n ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"lift_var_env r_x1 (SVar p)\" and r_x=\"lift_var_env r_x2 (SVar p)\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_disj)\n apply (simp)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m2 r_x1 d\" and\n ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m2\" and r_x=\"r_x1\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_semi_disj)\n apply (simp)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 r_s2 d\" and ?cl2.0=\"cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"r_s2\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_semi_disj)\n apply (simp)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2\" in pvar_clist_split)\n apply (auto)\n apply (case_tac \"x \\ set_diff ds2 ds\")\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl1\" and B=\"set_diff ds2 ds\" in Set.rev_subsetD)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl2\" and B=\"set_diff ds3 ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 (comp_var_env r_s2 r_s3) d\" and\n ?cl2.0=\"cl1 @ cl2 @ cl3\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"comp_var_env r_s2 r_s3\" and x=\"x\" and ds=\"set_diff ds' ds\" in pvar_clist_semi_disj)\n apply (simp)\n apply (cut_tac r_mv=\"r_m1\" and e=\"e1\" and env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in infer_m_sub_range)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (cut_tac r_sv=\"r_s2\" and e=\"e2\" and env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac r_sv=\"r_s3\" and e=\"e3\" and env_v=\"env_v\" and ds=\"ds3\" and ds'=\"ds'\" in infer_s_sub_range)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2 @ cl3\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl1\" and B=\"set_diff ds2 ds\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl2\" and ?cl2.0=\"cl3\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl2\" and B=\"set_diff ds3 ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl3\" and B=\"set_diff ds' ds3\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* lam case *)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (case_tac \"p \\ ds\")\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac r_sv=\"r_s'\" and e=\"e\" and env_v=\"add_env env_v (Var x1a) a\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: pvar_range_def)\n apply (erule_tac x=\"Var x1a\" in allE)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"aff_crn (rem_var_env r_s' (Var x1a)) (SVar q) d\" and ?cl2.0=\"cl\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"rem_var_env r_s' (Var x1a)\" and x=\"x\" and p=\"SVar q\" and ds=\"set_diff (insert q ds2) ds\" in pvar_clist_aff)\n apply (simp)\n apply (rule_tac rem_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 (insert a ds)\" in subset_pvar_range)\n apply (cut_tac r_sv=\"r_s'\" and e=\"e\" and env_v=\"add_env env_v (Var x1a) a\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (case_tac \"q \\ ds\")\n apply (cut_tac e=\"e\" and ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (simp add: set_diff_def)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (simp)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl\" and B=\"set_diff ds2 (insert a ds)\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n (* app case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (cut_tac r_sv=\"r_s1\" and e=\"e1\" and env_v=\"env_v\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n apply (case_tac \"q \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"disj_crn r_x1 (lift_var_env r_x2 (SVar p)) d\" and\n ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_x1\" and r_x=\"lift_var_env r_x2 (SVar p)\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_disj)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (cut_tac r_sv=\"r_s1\" and e=\"e1\" and env_v=\"env_v\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac r_sv=\"r_s2\" and e=\"e2\" and env_v=\"env_v\" in infer_s_sub_range)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m2 r_x1 d\" and\n ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m2\" and r_x=\"r_x1\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_semi_disj)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (rule_tac infer_m_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"semi_disj_crn r_m1 r_s2 d\" and\n ?cl2.0=\"cl1 @ cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac r_s=\"r_m1\" and r_x=\"r_s2\" and x=\"x\" and ds=\"set_diff (insert p ds3) ds\" in pvar_clist_semi_disj)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (rule_tac infer_m_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and ?cl1.0=\"cl1\" and ?cl2.0=\"cl2\" in pvar_clist_split)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl1\" and B=\"set_diff ds2 ds\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac c=\"x\" and A=\"pvar_crn_list cl2\" and B=\"set_diff ds3 ds2\" in Set.rev_subsetD)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n done\n \nlemma infer_pvar_crn_list: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ pvar_crn_list c_list \\ set_diff ds' ds\" \n apply (cut_tac env_v=\"env_v\" and e=\"e\" and ds=\"ds\" and ds'=\"ds'\" in infer_pvar_crn_list_ih)\n apply (auto)\n apply (simp add: induct_clist_def)\n apply (auto)\n done\n \nlemma sol_sat_disj: \"\\ disj_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_x) \\ \\ dir_sol_sat t_sub p_sub (disj_crn r_s r_x d)\" \n apply (induct d)\n apply (auto)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: dir_subst_penv_def)\n done\n\nlemma sol_sat_mini_disj: \"\\ mini_disj_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_x) \\ \\\n dir_sol_sat t_sub p_sub (semi_disj_crn r_s r_x d)\" \n apply (induct d)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: dir_subst_penv_def)\n done\n (*\nlemma sol_sat_aff: \"\\ aff_use_env (dir_subst_penv t_sub p_sub r_s) a \\ \\ dir_sol_sat t_sub p_sub (aff_crn r_s (SVar p) d)\" *)\n\nlemma cut_disj_use_env: \"\\ mini_disj_use_env r_x r_s \\ \\ disj_use_env r_s (cut_use_env r_x)\" \n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma swap_diff_cut_leq_use_env: \"\\ leq_use_env r_x r_s; leq_use_env r_ex (diff_use_env r_s r_x) \\ \\\n leq_use_env (cut_use_env r_x) (diff_use_env r_s r_ex)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: cut_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n \nlemma cut_mini_disj_use_env: \"\\ mini_disj_use_env (cut_use_env r_s) r_x \\ \\ mini_disj_use_env r_s r_x\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: cut_use_env_def)\n done\n\nlemma ivrpc_main: \"\\\n spec_env env_v (dir_subst_tenv (dir_list_add_env t_sub l) env_v) t_sub; sub_range env_v ds; tsub_dom t_sub ds;\n infer_type env_v ds e1 t1a r_s1 r_x1 r_m1 cl1 ds2; \n infer_type env_v ds2 e2 t2a r_s2 r_x2 r_m2 cl2 ds3;\n leq_use_env (lift_use_env rx1 r) r_s3; leq_use_env (lift_use_env rx2 r) r_s3; aff_leq (max_aff (req_type t1) (req_type t2)) r;\n disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r); leq_use_env r_s3 r_s;\n finite_dom (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))) d;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s3 r_exa); p \\ ds3; leq_use_env r_exa r_s;\n leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_exa (PairTy t1 t2 r)) r_x; leq_use_env r_exaa r_s;\n leq_use_env r_exb (diff_use_env r_s r_exaa); super_norm_use_env r_s r_s3 = diff_use_env r_s (comp_use_env r_exaa r_exb);\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) r_s e1 t1 (diff_use_env r_s r_exaa) rx1;\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) (diff_use_env r_s r_exaa) e2 t2 (diff_use_env (diff_use_env r_s r_exaa) r_exb) rx2;\n tsub_dom (dir_list_add_env t_sub l) ds2; fresh_list ds (dom_list l); env = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_sub (set_diff ds2 ds); leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_s1) r_s;\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_x1) r_exaa) rx1;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_m1)) r_exaa; dir_subst_type (dir_list_add_env t_sub l) p_sub t1a t1;\n dir_sol_sat (dir_list_add_env t_sub l) p_sub cl1; tsub_dom (dir_list_add_env (dir_list_add_env t_sub l) la) ds3; fresh_list ds2 (dom_list la);\n dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub l) la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_suba (set_diff ds3 ds2); leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_s2) (diff_use_env r_s r_exaa);\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_x2) r_exb) rx2;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_m2)) r_exb;\n dir_subst_type (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba t2a t2; dir_sol_sat (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba cl2\\\n \\ \\la. tsub_dom (dir_list_add_env t_sub la) (insert p ds3) \\\n fresh_list ds (dom_list la) \\\n dir_subst_tenv (dir_list_add_env t_sub la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v \\\n (\\p_sub. psub_dom p_sub (set_diff (insert p ds3) ds) \\\n leq_use_env\n (dir_subst_penv (dir_list_add_env t_sub la) p_sub\n (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))))\n r_s \\\n leq_use_env\n (diff_use_env\n (dir_subst_penv (dir_list_add_env t_sub la) p_sub\n (ifz_var_env (XPerm (SVar p)) (comp_var_env (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)))))\n r_ex)\n r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub la) p_sub (comp_var_env r_m1 r_m2))) r_ex \\\n dir_subst_type (dir_list_add_env t_sub la) p_sub t1a t1 \\\n dir_subst_type (dir_list_add_env t_sub la) p_sub t2a t2 \\\n r = p_sub p \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub la) p_sub t1a tau_x \\ aff_leq (req_type tau_x) (p_sub p)) \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub la) p_sub t2a tau_x \\ aff_leq (req_type tau_x) (p_sub p)) \\\n dir_sol_sat (dir_list_add_env t_sub la) p_sub\n (disj_crn (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)) d @\n semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2))\" \n (* defining new t_sub *)\n apply (rule_tac x=\"la @ l\" in exI)\n apply (auto)\n apply (rule_tac append_tsub_dom)\n apply (rule_tac ds=\"ds\" in list_add_tsub_dom)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and l=\"l\" and ds=\"ds2\" in list_add_dls)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and ds=\"ds3\" in list_add_dls)\n apply (auto)\n apply (rule_tac ds=\"ds\" and ds'=\"ds2\" in append_fresh_list2)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: dir_list_append_eq)\n (* P* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_s1) r_s\")\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\"\n and r_sv=\"r_s1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_s1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_s1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* P* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_s2) (diff_use_env r_s r_exaa)\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_s2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_s2\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def) \n (* X* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x1) r_exaa) rx1\")\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\"\n and r_sv=\"r_x1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_x1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_x1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def) \n (* X* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x2) r_exb) rx2\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_m1)) r_exaa\")\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\"\n and r_sv=\"r_m1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_m2)) r_exb\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* - prelim: (t_sub, p_sub)(t1a) = t1 *)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n tau_v=\"t1a\" and tau=\"t1\" in dir_list_add_subst_type)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac ds=\"set_diff ds2 ds\" in comp_dir_subst_type1)\n apply (simp)\n apply (rule_tac infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac tau_v=\"t1a\" and ds'=\"ds2\" and ds=\"ds\" in infer_pvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_contain)\n apply (simp)\n apply (cut_tac tau_v=\"t1a\" and ds'=\"ds2\" and ds=\"ds\" in infer_tvar_type)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* - prelim: (t_sub, p_sub)(t2a) = t2 *)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and p=\"p\" and r=\"r\" and\n tau_v=\"t2a\" and tau=\"t2\" in add_dir_subst_type)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_dir_subst_type2)\n apply (simp)\n apply (rule_tac infer_pvar_type)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (cut_tac tau_v=\"t2a\" and ds'=\"ds3\" and ds=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n (* defining new p_sub *)\n apply (rule_tac x=\"add_use_env (comp_use_env p_sub p_suba) p r\" in exI)\n apply (auto)\n (* - psub domain containment *)\n apply (rule_tac add_psub_dom)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n (* - p_sub(r_sv) \\ r_s *)\n apply (rule_tac dist_comp_leq_var_env)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac dist_comp_leq_var_env)\n apply (auto)\n apply (rule_tac t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x1 (SVar p))\"\n and s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x1)\n (sol_subst_perm (add_use_env (comp_use_env p_sub p_suba) p r) (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (auto)\n apply (case_tac \"add_use_env (comp_use_env p_sub p_suba) p r p \\ r\")\n apply (simp add: add_use_env_def)\n apply (auto)\n apply (rule_tac r_ex=\"r_exaa\" in diff_leq_use_env_rev)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n (* > part 2. *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac dist_comp_leq_var_env)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x2 (SVar p))\"\n and s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x2)\n (sol_subst_perm (add_use_env (comp_use_env p_sub p_suba) p r) (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac r_ex=\"r_exb\" in diff_leq_use_env_rev)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (case_tac \"add_use_env (comp_use_env p_sub p_suba) p r p \\ r\")\n apply (simp add: add_use_env_def)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n (* - p_sub(r_xv) \\ r_x. primitive case *)\n apply (case_tac \"r = NoPerm\")\n apply (cut_tac t_sub=\"dir_list_add_env t_sub (la @ l)\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and p=\"p\" and\n r_sv=\"comp_var_env (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p))\" in ifz_sol_subst_penv)\n apply (auto)\n apply (simp add: add_use_env_def)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: pair_req_def)\n (* > non-primitive case *)\n apply (simp add: dir_list_append_eq)\n apply (case_tac \"as_aff r = Prim\")\n apply (case_tac r)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env\n (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r)\n (comp_var_env (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)))) r_ex\" in trans_leq_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x1 (SVar p))\"\n and s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x1)\n (sol_subst_perm (add_use_env (comp_use_env p_sub p_suba) p r) (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac r_sb=\"diff_use_env (lift_use_env rx1 r) r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp add: lift_diff_use_env)\n apply (case_tac \"add_use_env (comp_use_env p_sub p_suba) p r p \\ r\")\n apply (simp add: add_use_env_def)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) r_x1) r_exaa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac rhs_snorm_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac infer_x_leq_use_env)\n apply (auto)\n apply (rule_tac self_diff_leq_use_env)\n (* > transformation proving removal of extra substitutions is sound *)\n (* > part 2. *)\n apply (rule_tac t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x2 (SVar p))\"\n and s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x2)\n (sol_subst_perm (add_use_env (comp_use_env p_sub p_suba) p r) (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (simp add: lift_diff_use_env)\n apply (case_tac \"add_use_env (comp_use_env p_sub p_suba) p r p \\ r\")\n apply (simp add: add_use_env_def)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x2)\n r_exb\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_snorm_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_s2\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac infer_x_leq_use_env)\n apply (auto)\n apply (rule_tac self_diff_leq_use_env)\n (* > finishing the case *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac if_zero_leq_var_env)\n apply (rule_tac id_leq_use_env)\n (* - (t_sub, p_sub)( M1* ) \\ EX. r_s - r_ex <= r_s3 <= r_s1 - (r_exaa + r_exb) *)\n apply (rule_tac r_sb=\"cut_use_env (comp_use_env r_exaa r_exb)\" in trans_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in dist_diff_leq_use_env_rev)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 r_exa\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac rhs_snorm_leq_use_env)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac rhs_cut_leq_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (simp add: dist_cut_comp_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac comp_leq_use_env2)\n apply (simp add: dir_list_append_eq)\n (* - type equivalences *)\n apply (simp add: dir_list_append_eq)\n apply (simp add: dir_list_append_eq)\n (* - pair permission *)\n apply (simp add: add_use_env_def)\n (* - further type equivalence *)\n apply (rule_tac x=\"t1\" in exI)\n apply (simp add: dir_list_append_eq)\n apply (simp add: add_use_env_def)\n apply (case_tac \"req_type t2\")\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (case_tac \"req_type t1\")\n apply (simp_all)\n apply (rule_tac x=\"t2\" in exI)\n apply (simp add: dir_list_append_eq)\n apply (simp add: add_use_env_def)\n apply (case_tac \"req_type t1\")\n apply (auto)\n apply (case_tac \"req_type t2\")\n apply (simp_all)\n apply (case_tac r)\n apply (simp_all)\n apply (case_tac \"req_type t2\")\n apply (simp_all)\n apply (case_tac \"req_type t2\")\n apply (simp_all)\n (* - solution satisfiability. disjointness *)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_disj)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac r_s=\"comp_use_env (lift_use_env rx1 r) (cut_use_env r_exaa)\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"comp_use_env (lift_use_env rx2 r) (cut_use_env r_exb)\" in disj_leq_use_env2)\n apply (rule_tac disj_comp_use_env1)\n apply (rule_tac disj_comp_use_env2)\n apply (simp)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (simp_all)\n apply (rule_tac disj_comp_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (simp_all)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac cut_leq_use_env)\n apply (simp)\n (* > proving the inequality for r_x2 vs rx2 *)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x2 (SVar p))) r_exb\" in trans_leq_use_env)\n apply (rule_tac s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x2)\n (add_use_env (comp_use_env p_sub p_suba) p r p)\" and\n t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x2 (SVar p))\" in subst)\n apply (simp add: lift_sol_subst_penvx)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac r_sb=\"lift_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) r_x2) r_exb) r\" in trans_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)(*\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and\n r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and\n r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and ds'=\"set_diff ds2 ds\" in comp_psub_use_env2)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)*)\n apply (rule_tac dist_lift_leq_use_env_gen)\n apply (simp add: add_use_env_def)\n apply (case_tac r)\n apply (simp_all)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* > proving the inequality for r_x1 vs rx1 *)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x1 (SVar p))) r_exaa\" in trans_leq_use_env)\n apply (rule_tac t=\"dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) (lift_var_env r_x1 (SVar p))\"\n and s=\"lift_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) (add_use_env (comp_use_env p_sub p_suba) p r) r_x1)\n (add_use_env (comp_use_env p_sub p_suba) p r p)\" in subst)\n apply (simp add: lift_sol_subst_penvx)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac r_sb=\"lift_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) r_x1) r_exaa) r\" in trans_leq_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac dist_lift_leq_use_env_gen)\n apply (simp add: add_use_env_def)\n apply (case_tac r)\n apply (simp_all)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* > semi-disjointness 1 *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_mini_disj)\n apply (rule_tac cut_mini_disj_use_env)\n apply (rule_tac r_s=\"r_exb\" in mini_disj_leq_use_env1)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"comp_use_env (diff_use_env r_s r_exb) (cut_use_env r_exaa)\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac swap_diff_cut_leq_use_env)\n apply (simp_all)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la)\n (add_use_env (comp_use_env p_sub p_suba) p r) r_x1) r_exaa\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (simp_all)\n apply (rule_tac lift_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* > semi-disjointness 2 *)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_mini_disj)\n apply (rule_tac cut_mini_disj_use_env)\n apply (rule_tac r_s=\"r_exaa\" in mini_disj_leq_use_env1)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (simp_all)\n (* > constraint list 1 correctness *)\n apply (rule_tac sol_sat_split)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac dir_list_add_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac ds=\"set_diff ds2 ds\" in comp_psub_sol_sat1)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds2\")\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_set_contain)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* > constraint list 2 correctness *)\n apply (cut_tac c_list=\"cl2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_psub_sol_sat2)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds2\")\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n done\n\n \nlemma ivr_pair_case: \"\\\\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e1 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e1 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e2 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e2 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; infer_type env_v ds e1 t1a r_s1 r_x1 r_m1 cl1 ds2; well_typed env r_s e1 t1 r_s2a rx1;\n infer_type env_v ds2 e2 t2a r_s2 r_x2 r_m2 cl2 ds3; well_typed env r_s2a e2 t2 r_s3 rx2; leq_use_env (lift_use_env rx1 r) r_s3;\n leq_use_env (lift_use_env rx2 r) r_s3; aff_leq (max_aff (req_type t1) (req_type t2)) r; disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r);\n finite_dom (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))) d;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s3 r_exa); leq_use_env r_x (diff_use_env r_s r_ex); p \\ ds3; leq_use_env r_exa r_s;\n leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_exa (PairTy t1 t2 r)) r_x\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) (insert p ds3) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff (insert p ds3) ds) \\\n leq_use_env\n (dir_subst_penv (dir_list_add_env t_sub l) p_sub\n (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))))\n r_s \\\n leq_use_env\n (diff_use_env\n (dir_subst_penv (dir_list_add_env t_sub l) p_sub\n (ifz_var_env (XPerm (SVar p)) (comp_var_env (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)))))\n r_ex)\n r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (comp_var_env r_m1 r_m2))) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t1a t1 \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t2a t2 \\\n r = p_sub p \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub l) p_sub t1a tau_x \\ aff_leq (req_type tau_x) (p_sub p)) \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub l) p_sub t2a tau_x \\ aff_leq (req_type tau_x) (p_sub p)) \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub\n (disj_crn (lift_var_env r_x1 (SVar p)) (lift_var_env r_x2 (SVar p)) d @\n semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2))\"\n apply (cut_tac env=\"env\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in ivr_induct_format)\n apply (auto)\n apply (cut_tac e=\"e1\" and env_v=\"env_v\" and t_sub=\"t_sub\" and ds=\"ds\" in ivrpc_coerce)\n apply (auto)\n apply (cut_tac e=\"e2\" and env_v=\"env_v\" and t_sub=\"dir_list_add_env t_sub l\" and ds=\"ds2\" in ivrpc_coerce)\n apply (auto)\n apply (rule_tac self_spec_env)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (auto)\n apply (rule_tac env_v=\"env_v\" and r_s=\"r_s\" and ?r_s3.0=\"r_s3\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" \n and ?r_s1.0=\"r_s1\" and ?r_x1.0=\"r_x1\" and ?r_m1.0=\"r_m1\" and ?r_s2.0=\"r_s2\" and ?r_x2.0=\"r_x2\" and ?r_m2.0=\"r_m2\" in ivrpc_main)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done \n \n\nlemma ivric_coerce: \"\\ \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds \\ \\\n \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list)\" \n apply (auto)\n done\n \nlemma subset_fresh_list: \"\\ ds \\ ds'; fresh_list ds' l \\ \\ fresh_list ds l\" \n apply (simp add: fresh_list_def)\n apply (auto)\n done\n\nlemma ivric_main: \"\\ spec_env env_v (dir_subst_tenv (dir_list_add_env t_sub l) env_v) t_sub; sub_range env_v ds; tsub_dom t_sub ds;\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) r_s e1 BoolTy r_s2 rx'; infer_type env_v ds e1 t1 r_s1 r_x1 r_m1 cl1 ds2;\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) r_s2 e2 tau (diff_use_env r_s r_ex) rx1; infer_type env_v ds2 e2 t2 r_s2a r_x2 r_m2 cl2 ds3;\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) r_s2 e3 tau (diff_use_env r_s r_ex) rx2; infer_type env_v ds3 e3 t3 r_s3 r_x3 r_m3 cl3 ds';\n finite_dom (comp_var_env r_s1 (comp_var_env r_s2a r_s3)) d; super_norm_use_env r_s r_s2 = diff_use_env r_s r_exa; leq_use_env r_exa r_s;\n tsub_dom (dir_list_add_env t_sub l) ds2; fresh_list ds (dom_list l); env = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_sub (set_diff ds2 ds); leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_s1) r_s;\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_x1) r_exa) rx';\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_m1)) r_exa; dir_subst_type (dir_list_add_env t_sub l) p_sub t1 BoolTy;\n dir_sol_sat (dir_list_add_env t_sub l) p_sub cl1; tsub_dom (dir_list_add_env (dir_list_add_env t_sub l) la) ds3; fresh_list ds2 (dom_list la);\n dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub l) la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_suba (set_diff ds3 ds2); leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_s2a) r_s2;\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_x2) r_ex) rx1;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_m2)) r_ex;\n dir_subst_type (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba t2 tau; dir_sol_sat (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba cl2;\n tsub_dom (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) ds'; fresh_list ds3 (dom_list lb);\n dir_subst_tenv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_subb (set_diff ds' ds3); leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) p_subb r_s3) r_s2;\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) p_subb r_x3) r_ex) rx2;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) p_subb r_m3)) r_ex;\n dir_subst_type (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) p_subb t3 tau;\n dir_sol_sat (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb) p_subb cl3\\\n \\ \\la. tsub_dom (dir_list_add_env t_sub la) ds' \\\n fresh_list ds (dom_list la) \\\n dir_subst_tenv (dir_list_add_env t_sub la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub la) p_sub (comp_var_env r_s1 (comp_var_env r_s2a r_s3))) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub la) p_sub (comp_var_env r_x2 r_x3)) r_ex) (comp_use_env rx1 rx2) \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub la) p_sub (comp_var_env r_m1 (comp_var_env r_m2 r_m3)))) r_ex \\\n dir_subst_type (dir_list_add_env t_sub la) p_sub t2 tau \\\n dir_subst_type (dir_list_add_env t_sub la) p_sub t1 BoolTy \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub la) p_sub t2 tau_x \\ dir_subst_type (dir_list_add_env t_sub la) p_sub t3 tau_x) \\\n dir_sol_sat (dir_list_add_env t_sub la) p_sub (semi_disj_crn r_m1 (comp_var_env r_s2a r_s3) d @ cl1 @ cl2 @ cl3))\"\n (* P* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_s1) r_s\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_s1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (rule_tac ds'=\"ds3\" in subset_fresh_list)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_s1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"comp_use_env p_suba p_subb\"\n and r_xv=\"r_s1\" and ds=\"set_diff ds2 ds\" and ds'=\"set_diff ds' ds2\" in comp_psub_use_env1)\n apply (auto)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n (* P* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_s2a) r_s2\")\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_s2a\" and ds=\"ds3\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub2.0=\"p_sub\" and ?p_sub1.0=\"comp_use_env p_suba p_subb\"\n and r_xv=\"r_s2a\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_subb\"\n and r_xv=\"r_s2a\" and ds=\"set_diff ds3 ds2\" and ds'=\"set_diff ds' ds3\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* P* inequality 3 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_s3) r_s2\")\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds3\" and e=\"e3\" and ds'=\"ds'\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_sub\" and\n ?p_sub1.0=\"comp_use_env p_suba p_subb\" and r_xv=\"r_s3\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_suba\" and ?p_sub1.0=\"p_subb\"\n and r_xv=\"r_s3\" and ds'=\"set_diff ds3 ds2\" and ds=\"set_diff ds' ds3\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* X* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_x2) r_ex) rx1\")\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_x2\" and ds=\"ds3\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub2.0=\"p_sub\" and ?p_sub1.0=\"comp_use_env p_suba p_subb\"\n and r_xv=\"r_x2\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_subb\"\n and r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and ds'=\"set_diff ds' ds3\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* X* inequality 3 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_x3) r_ex) rx2\")\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds3\" and e=\"e3\" and ds'=\"ds'\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_sub\" and\n ?p_sub1.0=\"comp_use_env p_suba p_subb\" and r_xv=\"r_x3\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_suba\" and ?p_sub1.0=\"p_subb\"\n and r_xv=\"r_x3\" and ds'=\"set_diff ds3 ds2\" and ds=\"set_diff ds' ds3\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_m1)) r_exa\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_m1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (rule_tac ds'=\"ds3\" in subset_fresh_list)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_m1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"comp_use_env p_suba p_subb\"\n and r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" and ds'=\"set_diff ds' ds2\" in comp_psub_use_env1)\n apply (auto)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_m2)) r_ex\")\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\"\n and r_sv=\"r_m2\" and ds=\"ds3\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub2.0=\"p_sub\" and ?p_sub1.0=\"comp_use_env p_suba p_subb\"\n and r_xv=\"r_m2\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_subb\"\n and r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" and ds'=\"set_diff ds' ds3\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 3 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb)\n (comp_use_env p_sub (comp_use_env p_suba p_subb)) r_m3)) r_ex\")\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds3\" and e=\"e3\" and ds'=\"ds'\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_sub\" and\n ?p_sub1.0=\"comp_use_env p_suba p_subb\" and r_xv=\"r_m3\" and ds'=\"set_diff ds2 ds\" and ds=\"set_diff ds' ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and ?p_sub2.0=\"p_suba\" and ?p_sub1.0=\"p_subb\"\n and r_xv=\"r_m3\" and ds'=\"set_diff ds3 ds2\" and ds=\"set_diff ds' ds3\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* proving type equivalence for t2 *)\n apply (case_tac \"\\ dir_subst_type (dir_list_add_env t_sub (lb @ la @ l)) (comp_use_env p_sub (comp_use_env p_suba p_subb)) t2 tau\")\n apply (simp add: dir_list_append_eq)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n apply (cut_tac tau_v=\"t2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_type)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and l=\"lb\" and p_sub=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\" and\n tau_v=\"t2\" and tau=\"tau\" in dir_list_add_subst_type)\n apply (rule_tac ds=\"set_diff ds' ds2\" in comp_dir_subst_type2)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_dir_subst_type1)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac x=\"x\" and l=\"lb\" in dom_list_contain)\n apply (simp)\n apply (cut_tac tau_v=\"t2\" and ds'=\"ds3\" and ds=\"ds2\" in infer_tvar_type)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* proving type equivalence for t3 *)\n apply (case_tac \"\\ dir_subst_type (dir_list_add_env t_sub (lb @ la @ l)) (comp_use_env p_sub (comp_use_env p_suba p_subb)) t3 tau\")\n apply (simp add: dir_list_append_eq)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (cut_tac tau_v=\"t3\" and ds=\"ds3\" and ds'=\"ds'\" in infer_pvar_type)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) lb\" and\n p_sub=\"p_sub\" and p_subx=\"comp_use_env p_suba p_subb\" and ds=\"set_diff ds' ds2\" in comp_dir_subst_type2)\n apply (rule_tac ds=\"set_diff ds' ds3\" in comp_dir_subst_type2)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (rule_tac x=\"lb @ la @ l\" in exI)\n apply (auto)\n (* type subst domain containment *)\n apply (simp add: dir_list_append_eq)\n (* freshness of lb, la, l *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (rule_tac t_sub=\"t_sub\" and ds=\"ds\" and ds'=\"ds3\" in append_fresh_list2)\n apply (auto)\n apply (rule_tac ds=\"ds\" and ds'=\"ds2\" in append_fresh_list2)\n apply (auto)\n apply (simp add: dir_list_append_eq)\n (* tenv equality *)\n apply (simp add: dir_list_append_eq)\n (* defining new p_sub *)\n apply (rule_tac x=\"comp_use_env p_sub (comp_use_env p_suba p_subb)\" in exI)\n apply (auto)\n (* p_sub containment *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n (* initial permission environment containment *)\n apply (simp add: dir_list_append_eq)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n (* requirements containment *)\n apply (simp add: dir_list_append_eq)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n (* subtractant containment *)\n apply (simp add: dir_list_append_eq)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac lhs_dist_cut_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"cut_use_env r_exa\" in trans_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in dist_diff_leq_use_env_rev)\n apply (simp)\n apply (rule_tac t=\"diff_use_env r_s r_exa\" and s=\"super_norm_use_env r_s r_s2\" in subst)\n apply (simp)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac well_typed_perm_leq)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac rhs_cut_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_dist_cut_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n (* type equivalence *)\n apply (simp add: dir_list_append_eq)\n apply (cut_tac tau_v=\"t1\" and ds=\"ds\" and ds'=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp_all)\n apply (cut_tac tau_v=\"t1\" and ds'=\"ds2\" and ds=\"ds\" in infer_tvar_type)\n apply (auto)\n apply (rule_tac dir_list_add_subst_type)\n apply (rule_tac dir_list_add_subst_type)\n apply (rule_tac ds=\"set_diff ds2 ds\" and ds'=\"set_diff ds' ds2\" in comp_dir_subst_type1)\n apply (simp_all)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_contain)\n apply (simp)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"lb\" in dom_list_contain)\n apply (simp)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* constraint list correctness. disjointness *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_mini_disj)\n apply (rule_tac cut_mini_disj_use_env)\n apply (rule_tac r_s=\"r_exa\" in mini_disj_leq_use_env1)\n apply (rule_tac r_s=\"diff_use_env r_s r_exa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac t=\"diff_use_env r_s r_exa\" and s=\"super_norm_use_env r_s r_s2\" in subst)\n apply (simp)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n (* - constraint list 1 correctness *)\n apply (rule_tac sol_sat_split)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac dir_list_add_sol_sat)\n apply (rule_tac dir_list_add_sol_sat)\n apply (rule_tac ds=\"set_diff ds2 ds\" and ds'=\"set_diff ds' ds2\" in comp_psub_sol_sat1)\n apply (simp_all)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_set_contain)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"lb\" in dom_list_set_contain)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* - constraint list 2 correctness *)\n apply (rule_tac sol_sat_split)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac c_list=\"cl2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac dir_list_add_sol_sat)\n apply (rule_tac ds=\"set_diff ds' ds2\" and ds'=\"set_diff ds2 ds\" in comp_psub_sol_sat2)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_psub_sol_sat1)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac x=\"x\" and l=\"lb\" in dom_list_set_contain)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* - constraint list 3 correctness *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (cut_tac c_list=\"cl3\" and ds=\"ds3\" and ds'=\"ds'\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl3\" and ds=\"ds3\" and ds'=\"ds'\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds2\" and ds'=\"set_diff ds2 ds\" in comp_psub_sol_sat2)\n apply (rule_tac ds=\"set_diff ds' ds3\" in comp_psub_sol_sat2)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n done\n \n \nlemma ivr_if_case: \"\\\\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e1 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e1 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e2 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e2 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e3 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e3 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; well_typed env r_s e1 BoolTy r_s2 rx'; infer_type env_v ds e1 t1 r_s1 r_x1 r_m1 cl1 ds2;\n well_typed env r_s2 e2 tau (diff_use_env r_s r_ex) rx1; infer_type env_v ds2 e2 t2 r_s2a r_x2 r_m2 cl2 ds3;\n well_typed env r_s2 e3 tau (diff_use_env r_s r_ex) rx2; infer_type env_v ds3 e3 t3 r_s3 r_x3 r_m3 cl3 ds';\n finite_dom (comp_var_env r_s1 (comp_var_env r_s2a r_s3)) d\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (comp_var_env r_s1 (comp_var_env r_s2a r_s3))) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (comp_var_env r_x2 r_x3)) r_ex) (comp_use_env rx1 rx2) \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (comp_var_env r_m1 (comp_var_env r_m2 r_m3)))) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t2 tau \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t1 BoolTy \\\n (\\tau_x. dir_subst_type (dir_list_add_env t_sub l) p_sub t2 tau_x \\ dir_subst_type (dir_list_add_env t_sub l) p_sub t3 tau_x) \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub (semi_disj_crn r_m1 (comp_var_env r_s2a r_s3) d @ cl1 @ cl2 @ cl3))\" \n apply (cut_tac r_s=\"r_s\" and r_x=\"r_s2\" in snorm_diff_use_env)\n apply (auto)\n apply (cut_tac e=\"e1\" and env=\"env\" and env_v=\"env_v\" and t_sub=\"t_sub\" and ds=\"ds\" and r_s=\"r_s\" and r_ex=\"r_exa\" in ivric_coerce)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s\" and ?r_s2.0=\"r_s2\" and e=\"e1\" in well_typed_sstr_end_perm)\n apply (auto)\n apply (cut_tac e=\"e2\" and env=\"dir_subst_tenv (dir_list_add_env t_sub l) env_v\" and env_v=\"env_v\" and\n t_sub=\"dir_list_add_env t_sub l\" and ds=\"ds2\" and r_s=\"r_s2\" and r_ex=\"r_ex\" in ivric_coerce)\n apply (auto)\n apply (rule_tac r_c=\"diff_use_env r_s r_ex\" in well_typed_decr_end_perm)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac r_sb=\"diff_use_env r_s r_ex\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac self_spec_env)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (auto)\n apply (cut_tac e=\"e3\" and env=\"dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub l) la) env_v\" and env_v=\"env_v\" and\n t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ds=\"ds3\" and r_s=\"r_s2\" and r_ex=\"r_ex\" in ivric_coerce)\n apply (auto)\n apply (rule_tac r_c=\"diff_use_env r_s r_ex\" in well_typed_decr_end_perm)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac r_sb=\"diff_use_env r_s r_ex\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac eq_spec_env)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac env_v=\"env_v\" and r_s=\"r_s\" and ?r_s3.0=\"r_s3\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\"\n and ?r_s1.0=\"r_s1\" and ?r_x1.0=\"r_x1\" and ?r_m1.0=\"r_m1\" and ?r_s2.0=\"r_s2\" and ?r_x2.0=\"r_x2\" and ?r_m2.0=\"r_m2\"\n and ?r_s3.0=\"r_s3\" and ?r_x3.0=\"r_x3\" and ?r_m3.0=\"r_m3\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and p_suba=\"p_suba\"\n and p_subb=\"p_subb\" and l=\"l\" and la=\"la\" and lb=\"lb\" and ds=\"ds\" and ?ds2.0=\"ds2\" and ?ds3.0=\"ds3\" and ds'=\"ds'\" in ivric_main)\n apply (auto)\n done\n \nlemma ivrlc_coerce: \"\\ \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds \\ \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list)\"\n apply (auto)\n done\n \nlemma add_spec_env: \"\\ sub_range env_v ds; a \\ ds; spec_env env_v env t_sub \\ \\\n spec_env (add_env env_v x a) (add_env env x tau) (dir_add_env t_sub a tau)\" \n apply (simp add: spec_env_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"env xa\")\n apply (case_tac \"env_v xa\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: add_env_def)\n apply (simp add: dir_add_env_def)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (case_tac \"env_v xa\")\n apply (auto)\n apply (simp add: add_env_def)\n apply (simp add: dir_add_env_def)\n apply (auto)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n done\n\n (* tau1 <: tau2 indicates that tau1 represents a stricter class of values. ie t1 can be used where t2 is used. *)\nfunction sub_type :: \"p_type \\ p_type \\ bool\" where\n \"sub_type IntTy s = (s = IntTy)\"\n| \"sub_type UnitTy s = (s = UnitTy)\" \n| \"sub_type BoolTy s = (s = BoolTy)\" \n| \"sub_type (ArrayTy t) s = (s = ArrayTy t)\" \n| \"sub_type (PairTy t1 t2 r) s = (s = PairTy t1 t2 r)\"\n| \"sub_type (FunTy t1 t2 r a) s = (case s of\n FunTy s1 s2 q b \\ sub_type s1 t1 \\ sub_type t2 s2 \\ leq_perm q r \\ leq_perm (as_perm a) (as_perm b)\n | sx \\ False)\"\n| \"sub_type (ChanTy t c_end) s = (s = ChanTy t c_end)\"\nby pat_completeness auto\ntermination\n apply (rule_tac R=\"measure (\\ (t, s). max (size t) (size s))\" in local.termination)\n apply (auto)\n done\n\nfun weaken_type where \n \"weaken_type (FunTy t1 t2 r a) s = (case s of\n FunTy s1 s2 q b \\ t1 = s1 \\ t2 = s2 \\ r = q \\ leq_perm (as_perm a) (as_perm b)\n | sx \\ False)\"\n| \"weaken_type t s = (t = s)\"\n\n \nlemma dir_list_ex: \"\\ t_sub x = tau; fresh_list ds (dom_list l); x \\ ds \\ \\ dir_list_add_env t_sub l x = tau\" \n apply (induct l)\n apply (auto)\n apply (case_tac \"\\ fresh_list ds (dom_list l)\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n done\n \nlemma sol_sat_aff: \"\\ aff_use_env (dir_subst_penv t_sub p_sub r_s) (as_aff (sol_subst_perm p_sub p)) \\ \\\n dir_sol_sat t_sub p_sub (aff_crn r_s p d)\" \n apply (induct d)\n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: aff_use_env_def)\n apply (case_tac \"sol_subst_perm p_sub p\")\n apply (auto)\n apply (simp add: null_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (case_tac \"dir_subst_permx t_sub p_sub (r_s a)\")\n apply (auto)\n done \n \nlemma ivrlc_main: \"\\\n spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; infer_type (add_env env_v (Var x1a) a) (insert a ds) e t2 r_s' r_x' r_m' cl ds2;\n well_typed (add_env env (Var x1a) t1) (add_use_env rx (Var x1a) r) e t2a r_s'a r_end; aff_use_env rx aa; leq_use_env rx r_s;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s r_exa); leq_use_env r_x (diff_use_env r_s r_ex); x1a \\ ref_vars e; leq_use_env r_exa r_s;\n leq_use_env (diff_use_env rx r_exa) r_x; finite_dom (rem_var_env r_s' (Var x1a)) d; a \\ ds; p \\ q; p \\ ds2; q \\ ds2;\n tsub_dom (dir_list_add_env (dir_add_env t_sub a t1) l) ds2; fresh_list (insert a ds) (dom_list l);\n dir_subst_tenv (dir_list_add_env (dir_add_env t_sub a t1) l) (add_env env_v (Var x1a) a) = add_env env (Var x1a) t1;\n psub_dom p_sub (set_diff ds2 (insert a ds));\n leq_use_env (dir_subst_penv (dir_list_add_env (dir_add_env t_sub a t1) l) p_sub r_s') (add_use_env rx (Var x1a) r);\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_add_env t_sub a t1) l) p_sub r_x') (add_use_env rx (Var x1a) r))\n (diff_use_env r_end (add_use_env rx (Var x1a) r));\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_add_env t_sub a t1) l) p_sub r_m')) (add_use_env rx (Var x1a) r);\n dir_subst_type (dir_list_add_env (dir_add_env t_sub a t1) l) p_sub t2 t2a; dir_sol_sat (dir_list_add_env (dir_add_env t_sub a t1) l) p_sub cl\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) (insert p (insert q ds2)) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff (insert p (insert q ds2)) ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (rem_var_env r_s' (Var x1a))) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (rem_var_env r_s' (Var x1a))) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env)) r_ex \\\n dir_list_add_env t_sub l a = Some t1 \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t2 t2a \\\n r = p_sub p \\\n aa = as_aff (p_sub q) \\\n leq_perm (dir_subst_permx (dir_list_add_env t_sub l) p_sub (r_s' (Var x1a))) (p_sub p) \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub (aff_crn (rem_var_env r_s' (Var x1a)) (SVar q) d @ cl))\" \n\n (* defining new type substitution *)\n apply (rule_tac x=\"l @ [(a, t1)]\" in exI)\n apply (auto)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac ds=\"ds2\" in subset_tsub_dom)\n apply (auto)\n apply (rule_tac t_sub=\"t_sub\" and ds'=\"insert a ds\" in append_fresh_list2)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and l=\"l @ [(a, t1)]\" and env_v=\"env_v\" and ds=\"ds\" in dir_list_cancel_add_eq_env)\n apply (simp)\n apply (rule_tac t_sub=\"t_sub\" and ds'=\"insert a ds \" in append_fresh_list2)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (auto)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n apply (rule_tac dir_subst_spec_env_ex)\n apply (simp)\n (* prelim: initial permission containment *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_list_add_env (dir_add_env t_sub a t1) l) (add_use_env (add_use_env p_sub p r) q (as_perm aa)) r_s')\n (add_use_env rx (Var x1a) r)\") \n apply (cut_tac t_sub=\"dir_list_add_env (dir_add_env t_sub a t1) l\" and p_sub=\"add_use_env p_sub p r\" and\n r_xv=\"r_s'\" and ds=\"set_diff ds2 (insert a ds)\" and x=\"q\" and r=\"as_perm aa\" in add_psub_use_env)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_add_env t_sub a t1) l\" and p_sub=\"p_sub\" and\n r_xv=\"r_s'\" and ds=\"set_diff ds2 (insert a ds)\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n (* defining new permission substitution *)\n apply (rule_tac x=\"add_use_env (add_use_env p_sub p r) q (as_perm aa)\" in exI)\n apply (auto)\n (* p_sub containment *)\n apply (rule_tac add_psub_dom)\n apply (rule_tac add_psub_dom)\n apply (rule_tac ds=\"set_diff ds2 (insert a ds)\" in subset_psub_dom)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n (* initial permission containment *)\n apply (rule_tac r_sb=\"rem_use_env (add_use_env rx (Var x1a) r) (Var x1a)\" in trans_leq_use_env)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (rule_tac dist_add_leq_use_env)\n apply (simp)\n apply (simp add: rem_sol_subst_penv)\n apply (rule_tac dist_rem_leq_use_env)\n apply (simp add: dir_list_append_eq)\n (* requirements containment *)\n apply (rule_tac r_sb=\"diff_use_env rx r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (simp_all)\n apply (rule_tac diff_leq_use_env)\n apply (simp add: rem_sol_subst_penv)\n apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n apply (simp add: dir_list_append_eq)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_add_env t_sub a t1) l\" and p_sub=\"add_use_env p_sub p r\" and\n r_xv=\"r_s'\" and ds=\"set_diff ds2 (insert a ds)\" and x=\"q\" and r=\"as_perm aa\" in add_psub_use_env)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_add_env t_sub a t1) l\" and p_sub=\"p_sub\" and\n r_xv=\"r_s'\" and ds=\"set_diff ds2 (insert a ds)\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n (* subtractant containment *)\n apply (rule_tac cut_leq_use_env)\n apply (rule_tac empty_leq_var_env)\n (* proof of a's type *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac ds=\"insert a ds\" in dir_list_ex)\n apply (simp add: dir_add_env_def)\n apply (auto)\n (* correctness for t2 *)\n apply (simp add: dir_list_append_eq)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_pvar_type)\n apply (simp)\n apply (rule_tac add_sub_range)\n apply (simp)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac add_dir_subst_type)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* correctness of p + q *)\n apply (simp add: add_use_env_def)\n apply (simp add: add_use_env_def)\n apply (case_tac aa)\n apply (auto)\n (* correctness of p with respect to r_s' *)\n apply (case_tac \"\\ leq_perm ((dir_subst_penv (dir_list_add_env (dir_add_env t_sub a t1) l)\n (add_use_env (add_use_env p_sub p r) q (as_perm aa)) r_s') (Var x1a)) ((add_use_env rx (Var x1a) r) (Var x1a))\")\n apply (simp add: leq_use_env_def)\n apply (simp add: dir_list_append_eq)\n apply (simp add: add_use_env_def)\n apply (simp add: dir_subst_penv_def)\n (* constraint list: affinity *)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_aff)\n apply (case_tac \"\\ as_aff (sol_subst_perm (add_use_env (add_use_env p_sub p r) q (as_perm aa)) (SVar q)) = aa\")\n apply (simp add: add_use_env_def)\n apply (case_tac \"aa\")\n apply (auto)\n apply (rule_tac r_s=\"rx\" in aff_leq_use_env)\n apply (simp)\n apply (simp add: dir_list_append_eq)\n apply (simp add: rem_sol_subst_penv)\n apply (rule_tac rem_add_leq_use_env)\n apply (simp)\n (* - sub-constraint list correctness *)\n apply (cut_tac c_list=\"cl\" and ds=\"insert a ds\" and ds'=\"ds2\" in infer_pvar_crn_list)\n apply (auto)\n apply (rule_tac add_sub_range)\n apply (simp)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n done\n \nlemma ivr_lam_case: \"\\\\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; infer_type (add_env env_v (Var x1a) a) (insert a ds) e t2 r_s' r_x' r_m' cl ds2;\n well_typed (add_env env (Var x1a) t1) (add_use_env rx (Var x1a) r) e t2a r_s'a r_end; aff_use_env rx aa; leq_use_env rx r_s;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s r_exa); leq_use_env r_x (diff_use_env r_s r_ex); x1a \\ ref_vars e; leq_use_env r_exa r_s;\n leq_use_env (diff_use_env rx r_exa) r_x; finite_dom (rem_var_env r_s' (Var x1a)) d; a \\ ds; p \\ q; p \\ ds2; q \\ ds2\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) (insert p (insert q ds2)) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff (insert p (insert q ds2)) ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (rem_var_env r_s' (Var x1a))) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (rem_var_env r_s' (Var x1a))) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub empty_var_env)) r_ex \\\n dir_list_add_env t_sub l a = Some t1 \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub t2 t2a \\\n r = p_sub p \\\n aa = as_aff (p_sub q) \\\n leq_perm (dir_subst_permx (dir_list_add_env t_sub l) p_sub (r_s' (Var x1a))) (p_sub p) \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub (aff_crn (rem_var_env r_s' (Var x1a)) (SVar q) d @ cl))\"\n (* initial induction *)\n apply (cut_tac env_v=\"add_env env_v (Var x1a) a\" and env=\"add_env env (Var x1a) t1\" and e=\"e\"\n and r_s=\"add_use_env rx (Var x1a) r\" and r_ex=\"add_use_env rx (Var x1a) r\" and ds=\"insert a ds\" and t_sub=\"dir_add_env t_sub a t1\" in ivrlc_coerce)\n apply (auto)\n apply (rule_tac well_typed_end_perm_lbound)\n apply (auto)\n apply (rule_tac ds=\"ds\" in add_spec_env)\n apply (simp_all)\n apply (rule_tac add_sub_range)\n apply (simp_all)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds\" in subset_tsub_dom)\n apply (auto)\n (* main lemma *)\n apply (rule_tac ivrlc_main)\n apply (auto)\n done\n \nlemma add_fresh_list_ex: \"\\ fresh_list ds (dom_list l); tsub_dom (dir_list_add_env t_sub l) ds';\n x \\ ds'; ds \\ ds' \\ \\ fresh_list ds (x # (dom_list l))\" \n apply (cut_tac x=\"x\" and ds=\"ds\" and l=\"l\" and ds'=\"ds'\" in add_fresh_list)\n apply (auto)\n done \n \nlemma ivrac_coerce: \"\\ \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n well_typed env r_s e tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds \\ \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list)\" \n apply (auto)\n done\n \nlemma dir_add_cancel_use_env: \"\\ tvar_range r_sv ds; a \\ ds \\ \\\n dir_subst_penv (dir_add_env t_sub a tau) p_sub r_sv = dir_subst_penv t_sub p_sub r_sv\"\n apply (case_tac \"\\ x. dir_subst_penv (dir_add_env t_sub a tau) p_sub r_sv x = dir_subst_penv t_sub p_sub r_sv x\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and a=\"a\" and r_sv=\"r_sv\" and tau=\"tau\" in dir_add_cancel_use_env_ih)\n apply (auto)\n done \n \nlemma ifz_sol_subst_penv_gen: \"\\ dir_subst_permx t_sub p_sub px = NoPerm \\ \\ dir_subst_penv t_sub p_sub (ifz_var_env px r_sv) = empty_use_env\" \n apply (case_tac \"\\ x. dir_subst_penv t_sub p_sub (ifz_var_env px r_sv) x = empty_use_env x\") \n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: ifz_var_env_def)\n apply (simp add: empty_use_env_def)\n apply (case_tac \"r_sv x = XPerm (SPerm NoPerm)\")\n apply (auto)\n done \n \nlemma ivrac_main: \"\\\n spec_env env_v (dir_subst_tenv (dir_list_add_env t_sub l) env_v) t_sub; sub_range env_v ds; tsub_dom t_sub ds;\n infer_type env_v ds e1 tau_f r_s1 r_x1 r_m1 cl1 ds2;\n infer_type env_v ds2 e2 t1a r_s2a r_x2 r_m2 cl2 ds3; leq_use_env r_s3 r_s;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env r_x (diff_use_env r_s r_ex);\n leq_use_env r_exa r_s; leq_use_env (app_req rx1 rx2 r tau r_exa) r_x;\n finite_dom (comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2a (lift_var_env r_x2 (SVar p)))) d; fresh_list ds3 [aa, p, q]; leq_use_env r_exaa r_s;\n leq_use_env r_exb (diff_use_env r_s r_exaa); super_norm_use_env r_s r_s3 = diff_use_env r_s (comp_use_env r_exaa r_exb);\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) r_s e1 (FunTy t1 tau r a) (diff_use_env r_s r_exaa) rx1;\n well_typed (dir_subst_tenv (dir_list_add_env t_sub l) env_v) (diff_use_env r_s r_exaa) e2 t1 (diff_use_env (diff_use_env r_s r_exaa) r_exb) rx2;\n tsub_dom (dir_list_add_env t_sub l) ds2; fresh_list ds (dom_list l); env = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_sub (set_diff ds2 ds); leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_s1) r_s;\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_x1) r_exaa) rx1;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_m1)) r_exaa;\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_f (FunTy t1 tau r a); dir_sol_sat (dir_list_add_env t_sub l) p_sub cl1;\n tsub_dom (dir_list_add_env (dir_list_add_env t_sub l) la) ds3; fresh_list ds2 (dom_list la);\n dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub l) la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v;\n psub_dom p_suba (set_diff ds3 ds2); leq_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_s2a) (diff_use_env r_s r_exaa);\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_x2) r_exb) rx2;\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba r_m2)) r_exb;\n dir_subst_type (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba t1a t1; dir_sol_sat (dir_list_add_env (dir_list_add_env t_sub l) la) p_suba cl2\\\n \\ \\la. tsub_dom (dir_list_add_env t_sub la) (insert aa (insert p (insert q ds3))) \\\n fresh_list ds (dom_list la) \\\n dir_subst_tenv (dir_list_add_env t_sub la) env_v = dir_subst_tenv (dir_list_add_env t_sub l) env_v \\\n (\\p_sub. psub_dom p_sub (set_diff (insert aa (insert p (insert q ds3))) ds) \\\n leq_use_env\n (dir_subst_penv (dir_list_add_env t_sub la) p_sub\n (comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2a (lift_var_env r_x2 (SVar p)))))\n r_s \\\n leq_use_env\n (diff_use_env\n (dir_subst_penv (dir_list_add_env t_sub la) p_sub (ifz_var_env (XType aa) (comp_var_env r_x1 (lift_var_env r_x2 (SVar p))))) r_ex)\n r_x \\\n leq_use_env\n (cut_use_env\n (dir_subst_penv (dir_list_add_env t_sub la) p_sub\n (comp_var_env (comp_var_env r_m1 r_x1) (comp_var_env r_m2 (lift_var_env r_x2 (SVar p))))))\n r_ex \\\n dir_list_add_env t_sub la aa = Some tau \\\n (\\tau_x. (\\t1_x. dir_subst_type (dir_list_add_env t_sub la) p_sub t1a t1_x \\\n (\\t2_x. dir_list_add_env t_sub la aa = Some t2_x \\ tau_x = FunTy t1_x t2_x (p_sub p) (as_aff (p_sub q)))) \\\n dir_subst_type (dir_list_add_env t_sub la) p_sub tau_f tau_x) \\\n dir_sol_sat (dir_list_add_env t_sub la) p_sub\n (disj_crn r_x1 (lift_var_env r_x2 (SVar p)) d @ semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2a d @ cl1 @ cl2))\"\n (* prelim: type subst domain *)\n apply (cut_tac t_sub=\"t_sub\" and ?l1.0=\"la\" and ?l2.0=\"l\" and ds=\"ds3\" in append_tsub_dom)\n apply (rule_tac ds=\"ds\" in list_add_tsub_dom)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and l=\"l\" and ds=\"ds2\" in list_add_dls)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and ds=\"ds3\" in list_add_dls)\n apply (auto)\n (* defining new t_sub *)\n apply (rule_tac x=\"[(aa, tau)] @ la @ l\" in exI)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (rule_tac ds=\"ds3\" in subset_tsub_dom)\n apply (auto)\n apply (rule_tac t_sub=\"t_sub\" and ds'=\"ds3\" in add_fresh_list_ex)\n apply (rule_tac ds=\"ds\" and ds'=\"ds2\" in append_fresh_list2)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac ds=\"ds\" in dir_add_eq_env)\n apply (simp add: dir_list_append_eq)\n apply (simp)\n apply (case_tac \"aa \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n (* p \\ ds3 *)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (case_tac \"aa \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (case_tac \"q \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n (* prelim: sub_range env_v ds2 *)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (simp)\n (* P* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_s1) r_s\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_s1\" and ds=\"ds2\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\"\n and r_sv=\"r_s1\" and ds=\"ds2\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and r_xv=\"r_s1\"\n and ds=\"set_diff ds2 ds\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_s1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_s1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* P* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_s2a) (diff_use_env r_s r_exaa)\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_s2a\" and ds=\"ds3\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n r_xv=\"r_s2a\" and ds=\"set_diff ds3 ds2\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_s2a\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_s2a\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* X* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x1) r_exaa) rx1\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_x1\" and ds=\"ds2\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and r_sv=\"r_x1\" and ds=\"ds2\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n r_xv=\"r_x1\" and ds=\"set_diff ds2 ds\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_x1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_x1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* X* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r_exb) rx2\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_x2\" and ds=\"ds3\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_x2\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 1 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_m1)) r_exaa\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_m1\" and ds=\"ds2\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and l=\"la\" and r_sv=\"r_m1\" and ds=\"ds2\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" in dir_list_add_cancel_use_env)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and e=\"e1\" and ds'=\"ds2\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and ?p_sub1.0=\"p_sub\" and ?p_sub2.0=\"p_suba\" and r_xv=\"r_m1\" and ds=\"set_diff ds2 ds\" in comp_psub_use_env1)\n apply (auto)\n apply (simp add: set_diff_def)\n (* M* inequality 2 *)\n apply (case_tac \"\\ leq_use_env (cut_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_m2)) r_exb\")\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_m_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and e=\"e2\" and ds'=\"ds3\" in infer_m_tvar_range)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and a=\"aa\" and tau=\"tau\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_sv=\"r_m2\" and ds=\"ds3\" in dir_add_cancel_use_env)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"add_use_env (comp_use_env p_sub p_suba) p r\" and\n r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" and x=\"q\" and r=\"as_perm a\" in add_psub_use_env)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and p_sub=\"comp_use_env p_sub p_suba\" and r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" and x=\"p\" and r=\"r\" in add_psub_use_env)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and ?p_sub1.0=\"p_suba\" and ?p_sub2.0=\"p_sub\" and r_xv=\"r_m2\" and ds=\"set_diff ds3 ds2\" in comp_psub_use_env2)\n apply (auto)\n apply (simp add: set_diff_def)\n (* prelim: (t_sub, p_sub)(tau_f) = FunTy t1 tau r a *)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and x=\"aa\" and t=\"tau\" and tau_v=\"tau_f\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and tau=\"FunTy t1 tau r a\" in dir_add_subst_type)\n apply (rule_tac dir_list_add_subst_type)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (simp)\n apply (cut_tac tau_v=\"tau_f\" and ds'=\"ds2\" and ds=\"ds\" in infer_pvar_type)\n apply (auto)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac ds=\"set_diff ds2 ds\" in comp_dir_subst_type1)\n apply (simp)\n apply (rule_tac infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_contain)\n apply (simp)\n apply (cut_tac tau_v=\"tau_f\" and ds'=\"ds2\" and ds=\"ds\" in infer_tvar_type)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac tau_v=\"tau_f\" and ds'=\"ds2\" and ds=\"ds\" in infer_tvar_type)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto) \n (* prelim: (t_sub, p_sub)(t1a) = t1 *)\n apply (cut_tac t_sub=\"dir_list_add_env (dir_list_add_env t_sub l) la\" and x=\"aa\" and t=\"tau\" and tau_v=\"t1a\" and\n p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and tau=\"t1\" in dir_add_subst_type)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac add_dir_subst_type)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_dir_subst_type2)\n apply (simp)\n apply (rule_tac infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (cut_tac tau_v=\"t1a\" and ds'=\"ds3\" and ds=\"ds2\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac tau_v=\"t1a\" and ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_type)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac tau_v=\"t1a\" and ds'=\"ds3\" and ds=\"ds2\" in infer_tvar_type)\n apply (auto)\n (* prelim: rewriting of lift r_x2 *)\n apply (case_tac \"dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) (lift_var_env r_x2 (SVar p)) \\\n lift_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r\")\n apply (cut_tac t_sub=\"dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau\"\n and p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and r_s=\"r_x2\" and r=\"SVar p\" in lift_sol_subst_penv)\n apply (case_tac \"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a) p \\ r\")\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* prelim: (t_sub, p_sub)( X1* ) \\ P1 *)\n apply (cut_tac r_sc=\"dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x1\"\n and r_sb=\"comp_use_env rx1 r_exaa\" and r_sa=\"r_s\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (simp)\n (* prelim: (t_sub, p_sub)(lift( X2* )) \\ P1 *)\n apply (cut_tac r_sc=\"lift_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r\"\n and r_sb=\"comp_use_env (lift_use_env rx2 r) r_exb\" and r_sa=\"r_s\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac t=\"diff_use_env (lift_use_env\n (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r) r_exb\" and\n s=\"lift_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r_exb) r\" in subst)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n (* defining new p_sub *)\n apply (rule_tac x=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" in exI)\n apply (auto)\n (* p_sub domain containment *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac add_psub_dom)\n apply (rule_tac add_psub_dom)\n apply (rule_tac comp_psub_dom)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_psub_dom)\n apply (simp)\n apply (rule_tac set_diff_subset)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* initial permission containment *)\n apply (simp add: dir_list_append_eq)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp_all)\n (* requirements containment. primitive case *)\n apply (case_tac \"req_type tau = Prim\")\n apply (cut_tac t_sub=\"dir_add_env (dir_list_add_env t_sub (la @ l)) aa tau\" and r_sv=\"comp_var_env r_x1 (lift_var_env r_x2 (SVar p))\"\n and p_sub=\"add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)\" and px=\"XType aa\" in ifz_sol_subst_penv_gen)\n apply (simp add: dir_add_env_def)\n apply (auto)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n (* - non-primitive case *)\n apply (simp add: app_req_def)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac spec_diff_lift_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) (comp_var_env r_x1 (lift_var_env r_x2 (SVar p)))) r_ex\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a))\n (comp_var_env r_x1 (lift_var_env r_x2 (SVar p)))) (comp_use_env r_exaa r_exb)\" in trans_leq_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac t=\"diff_use_env (lift_use_env\n (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r) r_exb\" and\n s=\"lift_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r_exb) r\" in subst)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s\" in crush_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac t=\"diff_use_env r_s (comp_use_env r_exaa r_exb)\" and s=\"super_norm_use_env r_s r_s3\" in subst)\n apply (simp)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp_all)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac if_zero_leq_var_env)\n apply (rule_tac id_leq_use_env)\n (* subtractant containment *)\n apply (rule_tac r_sb=\"cut_use_env (comp_use_env (comp_use_env rx1 r_exaa) (comp_use_env (lift_use_env rx2 r) r_exb))\" in trans_leq_use_env)\n apply (rule_tac r_s=\"r_s\" in dist_diff_leq_use_env_rev)\n apply (rule_tac r_sb=\"comp_use_env r_s (comp_use_env rx1 (lift_use_env rx2 r))\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (simp_all)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac r_sb=\"diff_use_env r_s r_exaa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s (comp_use_env (comp_use_env r_exaa r_exb) (comp_use_env rx1 (lift_use_env rx2 r)))\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac t=\"diff_use_env r_s (comp_use_env r_exaa r_exb)\" and s=\"super_norm_use_env r_s r_s3\" in subst)\n apply (simp)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac rhs_cut_leq_use_env)\n apply (simp add: dir_list_append_eq)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac lhs_dist_cut_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac lhs_dist_cut_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n apply (rule_tac cut_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_dist_cut_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n apply (rule_tac cut_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac t=\"diff_use_env (lift_use_env\n (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r) r_exb\" and\n s=\"lift_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r_exb) r\" in subst)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n (* correctness of expression type *)\n apply (simp add: dir_add_env_def)\n (* correctness of unification constraint *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac x=\"FunTy t1 tau r a\" in exI)\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (simp add: add_use_env_def)\n apply (simp add: fresh_list_def)\n apply (case_tac a)\n apply (auto)\n (* correctness of constraints: disjointness *)\n apply (simp add: dir_list_append_eq)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_disj)\n apply (rule_tac r_s=\"comp_use_env rx1 (cut_use_env r_exaa)\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"comp_use_env (lift_use_env rx2 r) (cut_use_env r_exb)\" in disj_leq_use_env2)\n apply (rule_tac disj_comp_use_env1)\n apply (rule_tac disj_comp_use_env2)\n apply (simp)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac disj_comp_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac cut_disj_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac cut_leq_use_env)\n apply (simp)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (lift_use_env\n (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r) r_exb\" in trans_leq_use_env)\n apply (rule_tac t=\"diff_use_env (lift_use_env\n (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r) r_exb\" and\n s=\"lift_use_env (diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x2) r_exb) r\" in subst)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac dist_lift_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x1) r_exaa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* - semi-disjointness 1 *)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_mini_disj)\n apply (rule_tac cut_mini_disj_use_env)\n apply (rule_tac r_s=\"r_exb\" in mini_disj_leq_use_env1)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"comp_use_env (diff_use_env r_s r_exb) (cut_use_env r_exaa)\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac swap_diff_cut_leq_use_env)\n apply (simp_all)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (dir_subst_penv (dir_add_env (dir_list_add_env (dir_list_add_env t_sub l) la) aa tau)\n (add_use_env (add_use_env (comp_use_env p_sub p_suba) p r) q (as_perm a)) r_x1) r_exaa\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp)\n apply (rule_tac r_s=\"diff_use_env r_s r_exb\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"super_norm_use_env r_s r_s3\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac rhs_snorm_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env_cut)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* - semi-disjointness 2 *)\n apply (rule_tac sol_sat_split)\n apply (rule_tac sol_sat_mini_disj)\n apply (rule_tac cut_mini_disj_use_env)\n apply (rule_tac r_s=\"r_exaa\" in mini_disj_leq_use_env1)\n apply (rule_tac r_s=\"diff_use_env r_s r_exaa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (simp_all)\n (* > constraint list 1 correctness *)\n apply (rule_tac sol_sat_split)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl1\" and ds=\"ds\" and ds'=\"ds2\" in infer_pvar_crn_list)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac dir_add_sol_sat)\n apply (rule_tac dir_list_add_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac ds=\"set_diff ds2 ds\" in comp_psub_sol_sat1)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac x=\"x\" and l=\"la\" in dom_list_set_contain)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n (* > constraint list 2 correctness *)\n apply (cut_tac c_list=\"cl2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_tvar_crn_list)\n apply (auto)\n apply (cut_tac c_list=\"cl2\" and ds=\"ds2\" and ds'=\"ds3\" in infer_pvar_crn_list)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac dir_add_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac add_psub_sol_sat)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in comp_psub_sol_sat2)\n apply (simp_all)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n done\n \nlemma ivr_app_case: \"\\\\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e1 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e1 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n \\tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub.\n \\well_typed env r_s e2 tau (diff_use_env r_s r_ex) r_x; infer_type env_v ds e2 tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) ds' \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff ds' ds) \\\n leq_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_xv) r_ex) r_x \\\n leq_use_env (cut_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub r_mv)) r_ex \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_v tau \\ dir_sol_sat (dir_list_add_env t_sub l) p_sub c_list);\n spec_env env_v env t_sub; sub_range env_v ds; tsub_dom t_sub ds; well_typed env r_s e1 (FunTy t1 tau r a) r_s2 rx1;\n infer_type env_v ds e1 tau_f r_s1 r_x1 r_m1 cl1 ds2; well_typed env r_s2 e2 t1 r_s3 rx2; infer_type env_v ds2 e2 t1a r_s2a r_x2 r_m2 cl2 ds3;\n leq_use_env (diff_use_env r_s r_ex) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_exa));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env r_x (diff_use_env r_s r_ex);\n leq_use_env r_exa r_s; leq_use_env (app_req rx1 rx2 r tau r_exa) r_x;\n finite_dom (comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2a (lift_var_env r_x2 (SVar p)))) d; fresh_list ds3 [aa, p, q]\\\n \\ \\l. tsub_dom (dir_list_add_env t_sub l) (insert aa (insert p (insert q ds3))) \\\n fresh_list ds (dom_list l) \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = env \\\n (\\p_sub. psub_dom p_sub (set_diff (insert aa (insert p (insert q ds3))) ds) \\\n leq_use_env\n (dir_subst_penv (dir_list_add_env t_sub l) p_sub\n (comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2a (lift_var_env r_x2 (SVar p)))))\n r_s \\\n leq_use_env\n (diff_use_env (dir_subst_penv (dir_list_add_env t_sub l) p_sub (ifz_var_env (XType aa) (comp_var_env r_x1 (lift_var_env r_x2 (SVar p)))))\n r_ex)\n r_x \\\n leq_use_env\n (cut_use_env\n (dir_subst_penv (dir_list_add_env t_sub l) p_sub\n (comp_var_env (comp_var_env r_m1 r_x1) (comp_var_env r_m2 (lift_var_env r_x2 (SVar p))))))\n r_ex \\\n dir_list_add_env t_sub l aa = Some tau \\\n (\\tau_x. (\\t1_x. dir_subst_type (dir_list_add_env t_sub l) p_sub t1a t1_x \\\n (\\t2_x. dir_list_add_env t_sub l aa = Some t2_x \\ tau_x = FunTy t1_x t2_x (p_sub p) (as_aff (p_sub q)))) \\\n dir_subst_type (dir_list_add_env t_sub l) p_sub tau_f tau_x) \\\n dir_sol_sat (dir_list_add_env t_sub l) p_sub\n (disj_crn r_x1 (lift_var_env r_x2 (SVar p)) d @ semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2a d @ cl1 @ cl2))\" \n apply (cut_tac env=\"env\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in ivr_induct_format)\n apply (auto) \n apply (cut_tac e=\"e1\" and env_v=\"env_v\" and t_sub=\"t_sub\" and ds=\"ds\" in ivrac_coerce)\n apply (auto)\n apply (cut_tac e=\"e2\" and env_v=\"env_v\" and t_sub=\"dir_list_add_env t_sub l\" and ds=\"ds2\" in ivrac_coerce)\n apply (auto)\n apply (rule_tac self_spec_env)\n apply (rule_tac ds=\"ds\" in subset_sub_range)\n apply (simp)\n apply (rule_tac infer_x_subset)\n apply (auto)\n apply (rule_tac env_v=\"env_v\" and r_s=\"r_s\" and ?r_s3.0=\"r_s3\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" \n and ?r_s1.0=\"r_s1\" and ?r_x1.0=\"r_x1\" and ?r_m1.0=\"r_m1\" and r_s2a=\"r_s2a\" and ?r_x2.0=\"r_x2\" and ?r_m2.0=\"r_m2\" in ivrac_main)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done\n \n (*\n [ Gamma, P |- e: tau, P - EX, Q \\ Infer(Gamma*, X, e) = (tau*, P*, Q*, R*, K, X') \\ \\( Gamma* ) = Gamma\n \\ range( Gamma* ) \\ X \\ dom(\\) \\ X ] \\\n (\\ \\* \\' \\. \\' = \\ o \\* \\ dom(\\') \\ X \\ fresh(\\*, X) \\ \\'( Gamma* ) = Gamma\n \\ dom( \\ ) \\ X' - X \\ (\\', \\)( P* ) \\ P \\ (\\', \\)( Q* ) - EX \\ Q \\ (\\', \\)( R* ) \\ EX\n \\ (\\', \\)( tau* ) = tau \\ (\\', \\) |= K)\n *)\nlemma ivr_partial: \"\\ well_typed env r_s e tau (diff_use_env r_s r_ex) r_x;\n infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; spec_env env_v env t_sub;\n sub_range env_v ds; tsub_dom t_sub ds \\ \\\n (\\ l t_subx p_sub. t_subx = dir_list_add_env t_sub l \\ tsub_dom t_subx ds' \\\n fresh_list ds (dom_list l) \\ dir_subst_tenv t_subx env_v = env \\\n psub_dom p_sub (set_diff ds' ds) \\ leq_use_env (dir_subst_penv t_subx p_sub r_sv) r_s \\\n leq_use_env (diff_use_env (dir_subst_penv t_subx p_sub r_xv) r_ex) r_x \\ leq_use_env (cut_use_env (dir_subst_penv t_subx p_sub r_mv)) r_ex \\\n dir_subst_type t_subx p_sub tau_v tau \\ dir_sol_sat t_subx p_sub c_list)\" \n apply (induct e arbitrary: tau r_s r_x r_ex env env_v ds tau_v r_sv r_xv r_mv c_list ds' t_sub)\n apply (auto)\n (* const case *)\n apply (rule_tac ivr_const_case)\n apply (auto)\n (* op case *)\n apply (rule_tac ivr_op_case)\n apply (auto)\n (* var case *)\n apply (rule_tac ivr_var_case)\n apply (auto)\n (* pair case *)\n apply (rule_tac ivr_pair_case)\n apply (auto)\n (* if case *)\n apply (rule_tac ivr_if_case)\n apply (auto)\n (* lam case *)\n apply (rule_tac ivr_lam_case)\n apply (auto)\n (* app case *)\n apply (rule_tac ivr_app_case)\n apply (auto)\n done\n \nlemma infer_valid_right: \"\\ well_typed empty_env r_s1 e tau r_s2 rx; infer_type empty_env ds e tau_v r_sv r_xv r_mv c_list ds' \\ \\ \\ t_sub p_sub. dir_sol_sat t_sub p_sub c_list\"\n apply (cut_tac env=\"empty_env\" and env_v=\"empty_env\" and e=\"e\" and r_s=\"r_s1\" and r_x=\"diff_use_env rx r_s1\" and r_ex=\"r_s1\" and t_sub=\"empty_env\" in ivr_partial)\n apply (auto)\n apply (rule_tac well_typed_end_perm_lbound)\n apply (simp)\n apply (simp add: spec_env_def)\n apply (simp add: empty_env_def)\n apply (simp add: sub_range_def)\n apply (simp add: empty_env_def)\n apply (simp add: tsub_dom_def)\n apply (simp add: empty_env_def)\n done\n\nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/InferComplete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2519223324010374}} {"text": "(* Title: Uint.thy\n Author: Peter Lammich, TU Munich\n Author: Andreas Lochbihler, ETH Zurich\n*)\n\nchapter \\Unsigned words of default size\\\n\ntheory Uint imports\n Word_Type_Copies\n Code_Target_Integer_Bit\nbegin\n\ntext \\\n This theory provides access to words in the target languages of the code generator\n whose bit width is the default of the target language. To that end, the type \\uint\\\n models words of width \\dflt_size\\, but \\dflt_size\\ is known only to be positive.\n\n Usage restrictions:\n Default-size words (type \\uint\\) cannot be used for evaluation, because \n the results depend on the particular choice of word size in the target language\n and implementation. Symbolic evaluation has not yet been set up for \\uint\\.\n\\\n\ntext \\The default size type\\\ntypedecl dflt_size\n\ninstantiation dflt_size :: typerep begin\ndefinition \"typerep_class.typerep \\ \\_ :: dflt_size itself. Typerep.Typerep (STR ''Uint.dflt_size'') []\"\ninstance ..\nend\n\nconsts dflt_size_aux :: \"nat\"\nspecification (dflt_size_aux) dflt_size_aux_g0: \"dflt_size_aux > 0\"\n by auto\nhide_fact dflt_size_aux_def\n\ninstantiation dflt_size :: len begin\ndefinition \"len_of_dflt_size (_ :: dflt_size itself) \\ dflt_size_aux\"\ninstance by(intro_classes)(simp add: len_of_dflt_size_def dflt_size_aux_g0)\nend\n\nabbreviation \"dflt_size \\ len_of (TYPE (dflt_size))\"\n\ncontext includes integer.lifting begin\nlift_definition dflt_size_integer :: integer is \"int dflt_size\" .\ndeclare dflt_size_integer_def[code del]\n \\ \\The code generator will substitute a machine-dependent value for this constant\\\n\nlemma dflt_size_by_int[code]: \"dflt_size = nat_of_integer dflt_size_integer\"\nby transfer simp\n\nlemma dflt_size[simp]: \n \"dflt_size > 0\"\n \"dflt_size \\ Suc 0\"\n \"\\ dflt_size < Suc 0\"\n using len_gt_0[where 'a=dflt_size]\n by (simp_all del: len_gt_0)\nend\n\nsection \\Type definition and primitive operations\\\n\ntypedef uint = \\UNIV :: dflt_size word set\\ ..\n\nglobal_interpretation uint: word_type_copy Abs_uint Rep_uint\n using type_definition_uint by (rule word_type_copy.intro)\n\nsetup_lifting type_definition_uint\n\ndeclare uint.of_word_of [code abstype]\n\ndeclare Quotient_uint [transfer_rule]\n\ninstantiation uint :: \\{comm_ring_1, semiring_modulo, equal, linorder}\\\nbegin\n\nlift_definition zero_uint :: uint is 0 .\nlift_definition one_uint :: uint is 1 .\nlift_definition plus_uint :: \\uint \\ uint \\ uint\\ is \\(+)\\ .\nlift_definition uminus_uint :: \\uint \\ uint\\ is uminus .\nlift_definition minus_uint :: \\uint \\ uint \\ uint\\ is \\(-)\\ .\nlift_definition times_uint :: \\uint \\ uint \\ uint\\ is \\(*)\\ .\nlift_definition divide_uint :: \\uint \\ uint \\ uint\\ is \\(div)\\ .\nlift_definition modulo_uint :: \\uint \\ uint \\ uint\\ is \\(mod)\\ .\nlift_definition equal_uint :: \\uint \\ uint \\ bool\\ is \\HOL.equal\\ .\nlift_definition less_eq_uint :: \\uint \\ uint \\ bool\\ is \\(\\)\\ .\nlift_definition less_uint :: \\uint \\ uint \\ bool\\ is \\(<)\\ .\n\nglobal_interpretation uint: word_type_copy_ring Abs_uint Rep_uint\n by standard (fact zero_uint.rep_eq one_uint.rep_eq\n plus_uint.rep_eq uminus_uint.rep_eq minus_uint.rep_eq\n times_uint.rep_eq divide_uint.rep_eq modulo_uint.rep_eq\n equal_uint.rep_eq less_eq_uint.rep_eq less_uint.rep_eq)+\n\ninstance proof -\n show \\OFCLASS(uint, comm_ring_1_class)\\\n by (rule uint.of_class_comm_ring_1)\n show \\OFCLASS(uint, semiring_modulo_class)\\\n by (fact uint.of_class_semiring_modulo)\n show \\OFCLASS(uint, equal_class)\\\n by (fact uint.of_class_equal)\n show \\OFCLASS(uint, linorder_class)\\\n by (fact uint.of_class_linorder)\nqed\n\nend\n\ninstantiation uint :: ring_bit_operations\nbegin\n\nlift_definition bit_uint :: \\uint \\ nat \\ bool\\ is bit .\nlift_definition not_uint :: \\uint \\ uint\\ is \\Bit_Operations.not\\ .\nlift_definition and_uint :: \\uint \\ uint \\ uint\\ is \\Bit_Operations.and\\ .\nlift_definition or_uint :: \\uint \\ uint \\ uint\\ is \\Bit_Operations.or\\ .\nlift_definition xor_uint :: \\uint \\ uint \\ uint\\ is \\Bit_Operations.xor\\ .\nlift_definition mask_uint :: \\nat \\ uint\\ is mask .\nlift_definition push_bit_uint :: \\nat \\ uint \\ uint\\ is push_bit .\nlift_definition drop_bit_uint :: \\nat \\ uint \\ uint\\ is drop_bit .\nlift_definition signed_drop_bit_uint :: \\nat \\ uint \\ uint\\ is signed_drop_bit .\nlift_definition take_bit_uint :: \\nat \\ uint \\ uint\\ is take_bit .\nlift_definition set_bit_uint :: \\nat \\ uint \\ uint\\ is Bit_Operations.set_bit .\nlift_definition unset_bit_uint :: \\nat \\ uint \\ uint\\ is unset_bit .\nlift_definition flip_bit_uint :: \\nat \\ uint \\ uint\\ is flip_bit .\n\nglobal_interpretation uint: word_type_copy_bits Abs_uint Rep_uint signed_drop_bit_uint\n by standard (fact bit_uint.rep_eq not_uint.rep_eq and_uint.rep_eq or_uint.rep_eq xor_uint.rep_eq\n mask_uint.rep_eq push_bit_uint.rep_eq drop_bit_uint.rep_eq signed_drop_bit_uint.rep_eq take_bit_uint.rep_eq\n set_bit_uint.rep_eq unset_bit_uint.rep_eq flip_bit_uint.rep_eq)+\n\ninstance\n by (fact uint.of_class_ring_bit_operations)\n\nend\n\nlift_definition uint_of_nat :: \\nat \\ uint\\\n is word_of_nat .\n\nlift_definition nat_of_uint :: \\uint \\ nat\\\n is unat .\n\nlift_definition uint_of_int :: \\int \\ uint\\\n is word_of_int .\n\nlift_definition int_of_uint :: \\uint \\ int\\\n is uint .\n\ncontext\n includes integer.lifting\nbegin\n\nlift_definition Uint :: \\integer \\ uint\\\n is word_of_int .\n\nlift_definition integer_of_uint :: \\uint \\ integer\\\n is uint .\n\nend\n\nglobal_interpretation uint: word_type_copy_more Abs_uint Rep_uint signed_drop_bit_uint\n uint_of_nat nat_of_uint uint_of_int int_of_uint Uint integer_of_uint\n apply standard\n apply (simp_all add: uint_of_nat.rep_eq nat_of_uint.rep_eq\n uint_of_int.rep_eq int_of_uint.rep_eq\n Uint.rep_eq integer_of_uint.rep_eq integer_eq_iff)\n done\n\ninstantiation uint :: \"{size, msb, lsb, set_bit, bit_comprehension}\"\nbegin\n\nlift_definition size_uint :: \\uint \\ nat\\ is size .\n\nlift_definition msb_uint :: \\uint \\ bool\\ is msb .\nlift_definition lsb_uint :: \\uint \\ bool\\ is lsb .\n\ntext \\Workaround: avoid name space clash by spelling out \\<^text>\\lift_definition\\ explicitly.\\\n\ndefinition set_bit_uint :: \\uint \\ nat \\ bool \\ uint\\\n where set_bit_uint_eq: \\set_bit_uint a n b = (if b then Bit_Operations.set_bit else unset_bit) n a\\\n\ncontext\n includes lifting_syntax\nbegin\n\nlemma set_bit_uint_transfer [transfer_rule]:\n \\(cr_uint ===> (=) ===> (\\) ===> cr_uint) Generic_set_bit.set_bit Generic_set_bit.set_bit\\\n by (simp only: set_bit_eq [abs_def] set_bit_uint_eq [abs_def]) transfer_prover\n\nend\n\nlift_definition set_bits_uint :: \\(nat \\ bool) \\ uint\\ is set_bits .\nlift_definition set_bits_aux_uint :: \\(nat \\ bool) \\ nat \\ uint \\ uint\\ is set_bits_aux .\n\nglobal_interpretation uint: word_type_copy_misc Abs_uint Rep_uint signed_drop_bit_uint\n uint_of_nat nat_of_uint uint_of_int int_of_uint Uint integer_of_uint dflt_size set_bits_aux_uint\n by (standard; transfer) simp_all\n\ninstance using uint.of_class_bit_comprehension\n uint.of_class_set_bit uint.of_class_lsb\n by simp_all standard\n\nend\n\nsection \\Code setup\\\n\ncode_printing code_module Uint \\ (SML)\n\\\nstructure Uint : sig\n val set_bit : Word.word -> IntInf.int -> bool -> Word.word\n val shiftl : Word.word -> IntInf.int -> Word.word\n val shiftr : Word.word -> IntInf.int -> Word.word\n val shiftr_signed : Word.word -> IntInf.int -> Word.word\n val test_bit : Word.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n let val mask = Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n in if b then Word.orb (x, mask)\n else Word.andb (x, Word.notb mask)\n end\n\nfun shiftl x n =\n Word.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n Word.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n Word.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n Word.andb (x, Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word.fromInt 0\n\nend; (* struct Uint *)\\\ncode_reserved SML Uint\n\ncode_printing code_module Uint \\ (Haskell)\n \\module Uint(Int, Word, dflt_size) where\n\n import qualified Prelude\n import Data.Int(Int)\n import Data.Word(Word)\n import qualified Data.Bits\n\n dflt_size :: Prelude.Integer\n dflt_size = Prelude.toInteger (bitSize_aux (0::Word)) where\n bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Int\n bitSize_aux = Data.Bits.bitSize\\\n and (Haskell_Quickcheck)\n \\module Uint(Int, Word, dflt_size) where\n\n import qualified Prelude\n import Data.Int(Int)\n import Data.Word(Word)\n import qualified Data.Bits\n\n dflt_size :: Prelude.Int\n dflt_size = bitSize_aux (0::Word) where\n bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Int\n bitSize_aux = Data.Bits.bitSize\n\\\ncode_reserved Haskell Uint dflt_size\n\ntext \\\n OCaml and Scala provide only signed bit numbers, so we use these and \n implement sign-sensitive operations like comparisons manually.\n\\\n\ncode_printing code_module \"Uint\" \\ (OCaml)\n\\module Uint : sig\n type t = int\n val dflt_size : Z.t\n val less : t -> t -> bool\n val less_eq : t -> t -> bool\n val set_bit : t -> Z.t -> bool -> t\n val shiftl : t -> Z.t -> t\n val shiftr : t -> Z.t -> t\n val shiftr_signed : t -> Z.t -> t\n val test_bit : t -> Z.t -> bool\n val int_mask : int\n val int32_mask : int32\n val int64_mask : int64\nend = struct\n\ntype t = int\n\nlet dflt_size = Z.of_int Sys.int_size;;\n\n(* negative numbers have their highest bit set, \n so they are greater than positive ones *)\nlet less x y =\n if x<0 then\n y<0 && x 0;;\n\nlet int_mask =\n if Sys.int_size < 32 then lnot 0 else 0xFFFFFFFF;;\n\nlet int32_mask = \n if Sys.int_size < 32 then Int32.pred (Int32.shift_left Int32.one Sys.int_size)\n else Int32.of_string \"0xFFFFFFFF\";;\n\nlet int64_mask = \n if Sys.int_size < 64 then Int64.pred (Int64.shift_left Int64.one Sys.int_size)\n else Int64.of_string \"0xFFFFFFFFFFFFFFFF\";;\n\nend;; (*struct Uint*)\\\ncode_reserved OCaml Uint\n\ncode_printing code_module Uint \\ (Scala)\n\\object Uint {\ndef dflt_size : BigInt = BigInt(32)\n\ndef less(x: Int, y: Int) : Boolean =\n if (x < 0) y < 0 && x < y\n else y < 0 || x < y\n\ndef less_eq(x: Int, y: Int) : Boolean =\n if (x < 0) y < 0 && x <= y\n else y < 0 || x <= y\n\ndef set_bit(x: Int, n: BigInt, b: Boolean) : Int =\n if (b)\n x | (1 << n.intValue)\n else\n x & (1 << n.intValue).unary_~\n\ndef shiftl(x: Int, n: BigInt) : Int = x << n.intValue\n\ndef shiftr(x: Int, n: BigInt) : Int = x >>> n.intValue\n\ndef shiftr_signed(x: Int, n: BigInt) : Int = x >> n.intValue\n\ndef test_bit(x: Int, n: BigInt) : Boolean =\n (x & (1 << n.intValue)) != 0\n\n} /* object Uint */\\\ncode_reserved Scala Uint\n\n\ntext \\\n OCaml's conversion from Big\\_int to int demands that the value fits into a signed integer.\n The following justifies the implementation.\n\\\n\ncontext\n includes integer.lifting bit_operations_syntax\nbegin\n\ndefinition wivs_mask :: int where \"wivs_mask = 2^ dflt_size - 1\"\nlift_definition wivs_mask_integer :: integer is wivs_mask .\n\n\ndefinition wivs_shift :: int where \"wivs_shift = 2 ^ dflt_size\"\nlift_definition wivs_shift_integer :: integer is wivs_shift .\nlemma [code]: \"wivs_shift_integer = 2 ^ dflt_size\"\n by transfer (simp add: wivs_shift_def)\n\ndefinition wivs_index :: nat where \"wivs_index == dflt_size - 1\"\nlift_definition wivs_index_integer :: integer is \"int wivs_index\".\nlemma wivs_index_integer_code[code]: \"wivs_index_integer = dflt_size_integer - 1\"\n by transfer (simp add: wivs_index_def of_nat_diff)\n\ndefinition wivs_overflow :: int where \"wivs_overflow == 2^ (dflt_size - 1)\"\nlift_definition wivs_overflow_integer :: integer is wivs_overflow .\nlemma [code]: \"wivs_overflow_integer = 2 ^ (dflt_size - 1)\"\n by transfer (simp add: wivs_overflow_def)\n\ndefinition wivs_least :: int where \"wivs_least == - wivs_overflow\"\nlift_definition wivs_least_integer :: integer is wivs_least .\nlemma [code]: \"wivs_least_integer = - (2 ^ (dflt_size - 1))\"\n by transfer (simp add: wivs_overflow_def wivs_least_def)\n\ndefinition Uint_signed :: \"integer \\ uint\" where\n \"Uint_signed i = (if i < wivs_least_integer \\ wivs_overflow_integer \\ i then undefined Uint i else Uint i)\"\n\nlemma Uint_code [code]:\n \"Uint i = \n (let i' = i AND wivs_mask_integer in \n if bit i' wivs_index then Uint_signed (i' - wivs_shift_integer) else Uint_signed i')\"\n including undefined_transfer \n unfolding Uint_signed_def\n apply transfer\n apply (subst word_of_int_via_signed)\n apply (auto simp add: push_bit_of_1 mask_eq_exp_minus_1 word_of_int_via_signed\n wivs_mask_def wivs_index_def wivs_overflow_def wivs_least_def wivs_shift_def)\n done\n\nlemma Uint_signed_code [code]:\n \"Rep_uint (Uint_signed i) = \n (if i < wivs_least_integer \\ i \\ wivs_overflow_integer then Rep_uint (undefined Uint i) else word_of_int (int_of_integer_symbolic i))\"\n unfolding Uint_signed_def Uint_def int_of_integer_symbolic_def by(simp add: Abs_uint_inverse)\nend\n\ntext \\\n Avoid @{term Abs_uint} in generated code, use @{term Rep_uint'} instead. \n The symbolic implementations for code\\_simp use @{term Rep_uint}.\n\n The new destructor @{term Rep_uint'} is executable.\n As the simplifier is given the [code abstract] equations literally, \n we cannot implement @{term Rep_uint} directly, because that makes code\\_simp loop.\n\n If code generation raises Match, some equation probably contains @{term Rep_uint} \n ([code abstract] equations for @{typ uint} may use @{term Rep_uint} because\n these instances will be folded away.)\n\\\n\ndefinition Rep_uint' where [simp]: \"Rep_uint' = Rep_uint\"\n\nlemma Rep_uint'_code [code]: \"Rep_uint' x = (BITS n. bit x n)\"\n unfolding Rep_uint'_def by transfer (simp add: set_bits_bit_eq)\n\nlift_definition Abs_uint' :: \"dflt_size word \\ uint\" is \"\\x :: dflt_size word. x\" .\n\nlemma Abs_uint'_code [code]:\n \"Abs_uint' x = Uint (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\ndeclare [[code drop: \"term_of_class.term_of :: uint \\ _\"]]\n\nlemma term_of_uint_code [code]:\n defines \"TR \\ typerep.Typerep\" and \"bit0 \\ STR ''Numeral_Type.bit0''\" \n shows\n \"term_of_class.term_of x = \n Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint.uint.Abs_uint'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR (STR ''Uint.dflt_size'') []], TR (STR ''Uint.uint'') []]))\n (term_of_class.term_of (Rep_uint' x))\"\n by(simp add: term_of_anything)\n\ntext \\Important:\n We must prevent the reflection oracle (eval-tac) to \n use our machine-dependent type.\n\\\n\ncode_printing\n type_constructor uint \\\n (SML) \"Word.word\" and\n (Haskell) \"Uint.Word\" and\n (OCaml) \"Uint.t\" and\n (Scala) \"Int\" and\n (Eval) \"*** \\\"Error: Machine dependent type\\\" ***\" and\n (Quickcheck) \"Word.word\" \n| constant dflt_size_integer \\\n (SML) \"(IntInf.fromLarge (Int.toLarge Word.wordSize))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.wordSize\" and\n (Haskell) \"Uint.dflt'_size\" and\n (OCaml) \"Uint.dflt'_size\" and\n (Scala) \"Uint.dflt'_size\"\n| constant Uint \\\n (SML) \"Word.fromLargeInt (IntInf.toLarge _)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.fromInt\" and\n (Haskell) \"(Prelude.fromInteger _ :: Uint.Word)\" and\n (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint.Word)\" and\n (Scala) \"_.intValue\"\n| constant Uint_signed \\\n (OCaml) \"Z.to'_int\"\n| constant \"0 :: uint\" \\\n (SML) \"(Word.fromInt 0)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"(Word.fromInt 0)\" and\n (Haskell) \"(0 :: Uint.Word)\" and\n (OCaml) \"0\" and\n (Scala) \"0\"\n| constant \"1 :: uint\" \\\n (SML) \"(Word.fromInt 1)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"(Word.fromInt 1)\" and\n (Haskell) \"(1 :: Uint.Word)\" and\n (OCaml) \"1\" and\n (Scala) \"1\"\n| constant \"plus :: uint \\ _ \" \\\n (SML) \"Word.+ ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.+ ((_), (_))\" and\n (Haskell) infixl 6 \"+\" and\n (OCaml) \"Pervasives.(+)\" and\n (Scala) infixl 7 \"+\"\n| constant \"uminus :: uint \\ _\" \\\n (SML) \"Word.~\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.~\" and\n (Haskell) \"negate\" and\n (OCaml) \"Pervasives.(~-)\" and\n (Scala) \"!(- _)\"\n| constant \"minus :: uint \\ _\" \\\n (SML) \"Word.- ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.- ((_), (_))\" and\n (Haskell) infixl 6 \"-\" and\n (OCaml) \"Pervasives.(-)\" and\n (Scala) infixl 7 \"-\"\n| constant \"times :: uint \\ _ \\ _\" \\\n (SML) \"Word.* ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.* ((_), (_))\" and\n (Haskell) infixl 7 \"*\" and\n (OCaml) \"Pervasives.( * )\" and\n (Scala) infixl 8 \"*\"\n| constant \"HOL.equal :: uint \\ _ \\ bool\" \\\n (SML) \"!((_ : Word.word) = _)\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"!((_ : Word.word) = _)\" and\n (Haskell) infix 4 \"==\" and\n (OCaml) \"(Pervasives.(=):Uint.t -> Uint.t -> bool)\" and\n (Scala) infixl 5 \"==\"\n| class_instance uint :: equal \\\n (Haskell) -\n| constant \"less_eq :: uint \\ _ \\ bool\" \\\n (SML) \"Word.<= ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.<= ((_), (_))\" and\n (Haskell) infix 4 \"<=\" and\n (OCaml) \"Uint.less'_eq\" and\n (Scala) \"Uint.less'_eq\"\n| constant \"less :: uint \\ _ \\ bool\" \\\n (SML) \"Word.< ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.< ((_), (_))\" and\n (Haskell) infix 4 \"<\" and\n (OCaml) \"Uint.less\" and\n (Scala) \"Uint.less\"\n| constant \"Bit_Operations.not :: uint \\ _\" \\\n (SML) \"Word.notb\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.notb\" and\n (Haskell) \"Data'_Bits.complement\" and\n (OCaml) \"Pervasives.lnot\" and\n (Scala) \"_.unary'_~\"\n| constant \"Bit_Operations.and :: uint \\ _\" \\\n (SML) \"Word.andb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.andb ((_),/ (_))\" and\n (Haskell) infixl 7 \"Data_Bits..&.\" and\n (OCaml) \"Pervasives.(land)\" and\n (Scala) infixl 3 \"&\"\n| constant \"Bit_Operations.or :: uint \\ _\" \\\n (SML) \"Word.orb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.orb ((_),/ (_))\" and\n (Haskell) infixl 5 \"Data_Bits..|.\" and\n (OCaml) \"Pervasives.(lor)\" and\n (Scala) infixl 1 \"|\"\n| constant \"Bit_Operations.xor :: uint \\ _\" \\\n (SML) \"Word.xorb ((_),/ (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.xorb ((_),/ (_))\" and\n (Haskell) \"Data'_Bits.xor\" and\n (OCaml) \"Pervasives.(lxor)\" and\n (Scala) infixl 2 \"^\"\n\ndefinition uint_divmod :: \"uint \\ uint \\ uint \\ uint\" where\n \"uint_divmod x y = \n (if y = 0 then (undefined ((div) :: uint \\ _) x (0 :: uint), undefined ((mod) :: uint \\ _) x (0 :: uint)) \n else (x div y, x mod y))\"\n\ndefinition uint_div :: \"uint \\ uint \\ uint\" \nwhere \"uint_div x y = fst (uint_divmod x y)\"\n\ndefinition uint_mod :: \"uint \\ uint \\ uint\" \nwhere \"uint_mod x y = snd (uint_divmod x y)\"\n\nlemma div_uint_code [code]: \"x div y = (if y = 0 then 0 else uint_div x y)\"\nincluding undefined_transfer unfolding uint_divmod_def uint_div_def\nby transfer(simp add: word_div_def)\n\nlemma mod_uint_code [code]: \"x mod y = (if y = 0 then x else uint_mod x y)\"\nincluding undefined_transfer unfolding uint_mod_def uint_divmod_def\nby transfer(simp add: word_mod_def)\n\ndefinition uint_sdiv :: \"uint \\ uint \\ uint\"\nwhere [code del]:\n \"uint_sdiv x y =\n (if y = 0 then undefined ((div) :: uint \\ _) x (0 :: uint)\n else Abs_uint (Rep_uint x sdiv Rep_uint y))\"\n\ndefinition div0_uint :: \"uint \\ uint\"\nwhere [code del]: \"div0_uint x = undefined ((div) :: uint \\ _) x (0 :: uint)\"\ndeclare [[code abort: div0_uint]]\n\ndefinition mod0_uint :: \"uint \\ uint\"\nwhere [code del]: \"mod0_uint x = undefined ((mod) :: uint \\ _) x (0 :: uint)\"\ndeclare [[code abort: mod0_uint]]\n\ndefinition wivs_overflow_uint :: uint \n where \"wivs_overflow_uint \\ push_bit (dflt_size - 1) 1\"\n\nlemma Rep_uint_wivs_overflow_uint_eq:\n \\Rep_uint wivs_overflow_uint = 2 ^ (dflt_size - Suc 0)\\\n by (simp add: wivs_overflow_uint_def one_uint.rep_eq push_bit_uint.rep_eq uint.word_of_power push_bit_eq_mult)\n\nlemma wivs_overflow_uint_greater_eq_0:\n \\wivs_overflow_uint > 0\\\n apply (simp add: less_uint.rep_eq zero_uint.rep_eq Rep_uint_wivs_overflow_uint_eq)\n apply transfer\n apply (simp add: take_bit_push_bit push_bit_eq_mult)\n done\n\nlemma uint_divmod_code [code]:\n \"uint_divmod x y =\n (if wivs_overflow_uint \\ y then if x < y then (0, x) else (1, x - y)\n else if y = 0 then (div0_uint x, mod0_uint x)\n else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y);\n r = x - q * y\n in if r \\ y then (q + 1, r - y) else (q, r))\"\nproof (cases \\y = 0\\)\n case True\n moreover have \\x \\ 0\\\n by transfer simp\n moreover note wivs_overflow_uint_greater_eq_0\n ultimately show ?thesis\n by (auto simp add: uint_divmod_def div0_uint_def mod0_uint_def not_less)\nnext\n case False\n then show ?thesis\n including undefined_transfer \n unfolding uint_divmod_def uint_sdiv_def div0_uint_def mod0_uint_def\n wivs_overflow_uint_def\n apply transfer\n apply (simp add: divmod_via_sdivmod push_bit_of_1)\n done\nqed\n\nlemma uint_sdiv_code [code]:\n \"Rep_uint (uint_sdiv x y) =\n (if y = 0 then Rep_uint (undefined ((div) :: uint \\ _) x (0 :: uint))\n else Rep_uint x sdiv Rep_uint y)\"\nunfolding uint_sdiv_def by(simp add: Abs_uint_inverse)\n\ntext \\\n Note that we only need a translation for signed division, but not for the remainder\n because @{thm uint_divmod_code} computes both with division only.\n\\\n\ncode_printing\n constant uint_div \\\n (SML) \"Word.div ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.div ((_), (_))\" and\n (Haskell) \"Prelude.div\"\n| constant uint_mod \\\n (SML) \"Word.mod ((_), (_))\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Word.mod ((_), (_))\" and\n (Haskell) \"Prelude.mod\"\n| constant uint_divmod \\\n (Haskell) \"divmod\"\n| constant uint_sdiv \\\n (OCaml) \"Pervasives.('/)\" and\n (Scala) \"_ '/ _\"\n\ndefinition uint_test_bit :: \"uint \\ integer \\ bool\"\nwhere [code del]:\n \"uint_test_bit x n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (bit :: uint \\ _) x n\n else bit x (nat_of_integer n))\"\n\nlemma test_bit_uint_code [code]:\n \"bit x n \\ n < dflt_size \\ uint_test_bit x (integer_of_nat n)\"\n including undefined_transfer integer.lifting unfolding uint_test_bit_def\n by (transfer, simp, transfer, simp)\n\nlemma uint_test_bit_code [code]:\n \"uint_test_bit w n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (bit :: uint \\ _) w n else bit (Rep_uint w) (nat_of_integer n))\"\n unfolding uint_test_bit_def by(simp add: bit_uint.rep_eq)\n\ncode_printing constant uint_test_bit \\\n (SML) \"Uint.test'_bit\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.test'_bit\" and\n (Haskell) \"Data'_Bits.testBitBounded\" and\n (OCaml) \"Uint.test'_bit\" and\n (Scala) \"Uint.test'_bit\"\n\ndefinition uint_set_bit :: \"uint \\ integer \\ bool \\ uint\"\nwhere [code del]:\n \"uint_set_bit x n b =\n (if n < 0 \\ dflt_size_integer \\ n then undefined (set_bit :: uint \\ _) x n b\n else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint_code [code]:\n \"set_bit x n b = (if n < dflt_size then uint_set_bit x (integer_of_nat n) b else x)\"\n including undefined_transfer integer.lifting unfolding uint_set_bit_def\n by (transfer) (auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint_set_bit_code [code]:\n \"Rep_uint (uint_set_bit w n b) = \n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (set_bit :: uint \\ _) w n b)\n else set_bit (Rep_uint w) (nat_of_integer n) b)\"\nincluding undefined_transfer integer.lifting unfolding uint_set_bit_def by transfer simp\n\ncode_printing constant uint_set_bit \\\n (SML) \"Uint.set'_bit\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.set'_bit\" and\n (Haskell) \"Data'_Bits.setBitBounded\" and\n (OCaml) \"Uint.set'_bit\" and\n (Scala) \"Uint.set'_bit\"\n\ndefinition uint_shiftl :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_shiftl x n = (if n < 0 \\ dflt_size_integer \\ n then undefined (push_bit :: nat \\ uint \\ _) x n else push_bit (nat_of_integer n) x)\"\n\nlemma shiftl_uint_code [code]: \"push_bit n x = (if n < dflt_size then uint_shiftl x (integer_of_nat n) else 0)\"\n including undefined_transfer integer.lifting unfolding uint_shiftl_def\n by (transfer fixing: n) simp\n\nlemma uint_shiftl_code [code]:\n \"Rep_uint (uint_shiftl w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (push_bit :: nat \\ uint \\ _) w n) else push_bit (nat_of_integer n) (Rep_uint w))\"\n including undefined_transfer integer.lifting unfolding uint_shiftl_def by transfer simp\n\ncode_printing constant uint_shiftl \\\n (SML) \"Uint.shiftl\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftl\" and\n (Haskell) \"Data'_Bits.shiftlBounded\" and\n (OCaml) \"Uint.shiftl\" and\n (Scala) \"Uint.shiftl\"\n\ndefinition uint_shiftr :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_shiftr x n = (if n < 0 \\ dflt_size_integer \\ n then undefined (drop_bit :: nat \\ uint \\ _) x n else drop_bit (nat_of_integer n) x)\"\n\nlemma shiftr_uint_code [code]: \"drop_bit n x = (if n < dflt_size then uint_shiftr x (integer_of_nat n) else 0)\"\n including undefined_transfer integer.lifting unfolding uint_shiftr_def\n by (transfer fixing: n) simp\n\nlemma uint_shiftr_code [code]:\n \"Rep_uint (uint_shiftr w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined (drop_bit :: nat \\ uint \\ _) w n) else drop_bit (nat_of_integer n) (Rep_uint w))\"\n including undefined_transfer integer.lifting unfolding uint_shiftr_def by transfer simp\n\ncode_printing constant uint_shiftr \\\n (SML) \"Uint.shiftr\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftr\" and\n (Haskell) \"Data'_Bits.shiftrBounded\" and\n (OCaml) \"Uint.shiftr\" and\n (Scala) \"Uint.shiftr\"\n\ndefinition uint_sshiftr :: \"uint \\ integer \\ uint\"\nwhere [code del]:\n \"uint_sshiftr x n =\n (if n < 0 \\ dflt_size_integer \\ n then undefined signed_drop_bit_uint n x else signed_drop_bit_uint (nat_of_integer n) x)\"\n\nlemma sshiftr_uint_code [code]:\n \"signed_drop_bit_uint n x = \n (if n < dflt_size then uint_sshiftr x (integer_of_nat n) else \n if bit x wivs_index then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_sshiftr_def\nby transfer(simp add: not_less signed_drop_bit_beyond word_size wivs_index_def)\n\nlemma uint_sshiftr_code [code]:\n \"Rep_uint (uint_sshiftr w n) =\n (if n < 0 \\ dflt_size_integer \\ n then Rep_uint (undefined signed_drop_bit_uint n w) else signed_drop_bit (nat_of_integer n) (Rep_uint w))\"\nincluding undefined_transfer integer.lifting unfolding uint_sshiftr_def by transfer simp\n\ncode_printing constant uint_sshiftr \\\n (SML) \"Uint.shiftr'_signed\" and\n (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n (Quickcheck) \"Uint.shiftr'_signed\" and\n (Haskell) \n \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint.Int) _)) :: Uint.Word)\" and\n (OCaml) \"Uint.shiftr'_signed\" and\n (Scala) \"Uint.shiftr'_signed\"\n\nlemma uint_msb_test_bit: \"msb x \\ bit (x :: uint) wivs_index\"\n by transfer (simp add: msb_word_iff_bit wivs_index_def)\n\nlemma msb_uint_code [code]: \"msb x \\ uint_test_bit x wivs_index_integer\"\n apply(simp add: uint_test_bit_def uint_msb_test_bit \n wivs_index_integer_code dflt_size_integer_def wivs_index_def)\n by (metis (full_types) One_nat_def dflt_size(2) less_iff_diff_less_0 \n nat_of_integer_of_nat of_nat_1 of_nat_diff of_nat_less_0_iff wivs_index_def)\n\nlemma uint_of_int_code [code]: \"uint_of_int i = (BITS n. bit i n)\"\n by transfer (simp add: word_of_int_conv_set_bits)\n\n\nsection \\Quickcheck setup\\\n\ndefinition uint_of_natural :: \"natural \\ uint\"\nwhere \"uint_of_natural x \\ Uint (integer_of_natural x)\"\n\ninstantiation uint :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint \\ qc_random_cnv uint_of_natural\"\ndefinition \"exhaustive_uint \\ qc_exhaustive_cnv uint_of_natural\"\ndefinition \"full_exhaustive_uint \\ qc_full_exhaustive_cnv uint_of_natural\"\ninstance ..\nend\n\ninstantiation uint :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n \"\\i. (Uint i, Uint (- i))\" \"0\"\n \"Typerep.Typerep (STR ''Uint.uint'') []\" .\n\ndefinition \"narrowing_uint d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint itself \\ _\"]]\nlemmas partial_term_of_uint [code] = partial_term_of_code\n\ninstance ..\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Native_Word/Uint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.3998116407397951, "lm_q1q2_score": 0.2517912246389341}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2020\n(C) Copyright Sebastian A. Mödersheim, DTU, 2020\n(C) Copyright Achim D. Brucker, University of Exeter, 2020\n(C) Copyright Anders Schlichtkrull, DTU, 2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Term_Abstraction.thy\n Author: Andreas Viktor Hess, DTU\n Author: Sebastian A. Mödersheim, DTU\n Author: Achim D. Brucker, University of Exeter\n Author: Anders Schlichtkrull, DTU\n*)\n\nsection\\Term Abstraction\\\ntheory Term_Abstraction\n imports Transactions\nbegin\n\nsubsection \\Definitions\\\nfun to_abs (\"\\\\<^sub>0\") where\n \"\\\\<^sub>0 [] _ = {}\"\n| \"\\\\<^sub>0 ((Fun (Val m) [],Fun (Set s) S)#D) n =\n (if m = n then insert s (\\\\<^sub>0 D n) else \\\\<^sub>0 D n)\"\n| \"\\\\<^sub>0 (_#D) n = \\\\<^sub>0 D n\"\n\nfun abs_apply_term (infixl \"\\\\<^sub>\\\" 67) where\n \"Var x \\\\<^sub>\\ \\ = Var x\"\n| \"Fun (Val n) T \\\\<^sub>\\ \\ = Fun (Abs (\\ n)) (map (\\t. t \\\\<^sub>\\ \\) T)\"\n| \"Fun f T \\\\<^sub>\\ \\ = Fun f (map (\\t. t \\\\<^sub>\\ \\) T)\"\n\ndefinition abs_apply_list (infixl \"\\\\<^sub>\\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t\" 67) where\n \"M \\\\<^sub>\\\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\ \\ map (\\t. t \\\\<^sub>\\ \\) M\"\n\ndefinition abs_apply_terms (infixl \"\\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t\" 67) where\n \"M \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ (\\t. t \\\\<^sub>\\ \\) ` M\"\n\ndefinition abs_apply_pairs (infixl \"\\\\<^sub>\\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s\" 67) where\n \"F \\\\<^sub>\\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\ \\ map (\\(s,t). (s \\\\<^sub>\\ \\, t \\\\<^sub>\\ \\)) F\"\n\ndefinition abs_apply_strand_step (infixl \"\\\\<^sub>\\\\<^sub>s\\<^sub>t\\<^sub>p\" 67) where\n \"s \\\\<^sub>\\\\<^sub>s\\<^sub>t\\<^sub>p \\ \\ (case s of\n (l,send\\t\\) \\ (l,send\\t \\\\<^sub>\\ \\\\)\n | (l,receive\\t\\) \\ (l,receive\\t \\\\<^sub>\\ \\\\)\n | (l,\\ac: t \\ t'\\) \\ (l,\\ac: (t \\\\<^sub>\\ \\) \\ (t' \\\\<^sub>\\ \\)\\)\n | (l,insert\\t,t'\\) \\ (l,insert\\t \\\\<^sub>\\ \\,t' \\\\<^sub>\\ \\\\)\n | (l,delete\\t,t'\\) \\ (l,delete\\t \\\\<^sub>\\ \\,t' \\\\<^sub>\\ \\\\)\n | (l,\\ac: t \\ t'\\) \\ (l,\\ac: (t \\\\<^sub>\\ \\) \\ (t' \\\\<^sub>\\ \\)\\)\n | (l,\\X\\\\\\: F \\\\: F'\\) \\ (l,\\X\\\\\\: (F \\\\<^sub>\\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\\\: (F' \\\\<^sub>\\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\\))\"\n\ndefinition abs_apply_strand (infixl \"\\\\<^sub>\\\\<^sub>s\\<^sub>t\" 67) where\n \"S \\\\<^sub>\\\\<^sub>s\\<^sub>t \\ \\ map (\\x. x \\\\<^sub>\\\\<^sub>s\\<^sub>t\\<^sub>p \\) S\"\n\n\nsubsection \\Lemmata\\\nlemma to_abs_alt_def:\n \"\\\\<^sub>0 D n = {s. \\S. (Fun (Val n) [], Fun (Set s) S) \\ set D}\"\nby (induct D n rule: to_abs.induct) auto\n\nlemma abs_term_apply_const[simp]:\n \"is_Val f \\ Fun f [] \\\\<^sub>\\ a = Fun (Abs (a (the_Val f))) []\"\n \"\\is_Val f \\ Fun f [] \\\\<^sub>\\ a = Fun f []\"\nby (cases f; auto)+\n\nlemma abs_fv: \"fv (t \\\\<^sub>\\ a) = fv t\"\nby (induct t a rule: abs_apply_term.induct) auto\n\nlemma abs_eq_if_no_Val:\n assumes \"\\f \\ funs_term t. \\is_Val f\"\n shows \"t \\\\<^sub>\\ a = t \\\\<^sub>\\ b\"\nusing assms\nproof (induction t)\n case (Fun f T) thus ?case by (cases f) simp_all\nqed simp\n\n\n\nlemma abs_set_empty[simp]: \"{} \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t \\ = {}\"\nunfolding abs_apply_terms_def by simp\n\n\n\nlemma abs_set_union: \"(A \\ B) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a = (A \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a) \\ (B \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a)\"\nunfolding abs_apply_terms_def\nby auto\n\nlemma abs_subterms: \"subterms (t \\\\<^sub>\\ \\) = subterms t \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof (induction t)\n case (Fun f T) thus ?case by (cases f) (auto simp add: abs_apply_terms_def)\nqed (simp add: abs_apply_terms_def)\n\nlemma abs_subterms_in: \"s \\ subterms t \\ s \\\\<^sub>\\ a \\ subterms (t \\\\<^sub>\\ a)\"\nproof (induction t)\n case (Fun f T) thus ?case by (cases f) auto\nqed simp\n\nlemma abs_ik_append: \"(ik\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a = (ik\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t B \\\\<^sub>s\\<^sub>e\\<^sub>t I) \\\\<^sub>\\\\<^sub>s\\<^sub>e\\<^sub>t a\"\nunfolding abs_apply_terms_def ik\\<^sub>s\\<^sub>s\\<^sub>t_def\nby auto\n\nlemma to_abs_in:\n assumes \"(Fun (Val n) [], Fun (Set s) []) \\ set D\"\n shows \"s \\ \\\\<^sub>0 D n\"\nusing assms by (induct rule: to_abs.induct) auto\n\nlemma to_abs_empty_iff_notin_db:\n \"Fun (Val n) [] \\\\<^sub>\\ \\\\<^sub>0 D = Fun (Abs {}) [] \\ (\\s S. (Fun (Val n) [], Fun (Set s) S) \\ set D)\"\nby (simp add: to_abs_alt_def)\n\nlemma to_abs_list_insert:\n assumes \"Fun (Val n) [] \\ t\"\n shows \"\\\\<^sub>0 D n = \\\\<^sub>0 (List.insert (t,s) D) n\"\nusing assms to_abs_alt_def[of D n] to_abs_alt_def[of \"List.insert (t,s) D\" n]\nby auto\n\nlemma to_abs_list_insert':\n \"insert s (\\\\<^sub>0 D n) = \\\\<^sub>0 (List.insert (Fun (Val n) [], Fun (Set s) S) D) n\"\nusing to_abs_alt_def[of D n]\n to_abs_alt_def[of \"List.insert (Fun (Val n) [], Fun (Set s) S) D\" n]\nby auto\n\nlemma to_abs_list_remove_all:\n assumes \"Fun (Val n) [] \\ t\"\n shows \"\\\\<^sub>0 D n = \\\\<^sub>0 (List.removeAll (t,s) D) n\"\nusing assms to_abs_alt_def[of D n] to_abs_alt_def[of \"List.removeAll (t,s) D\" n]\nby auto\n\nlemma to_abs_list_remove_all':\n \"\\\\<^sub>0 D n - {s} = \\\\<^sub>0 (filter (\\d. \\S. d = (Fun (Val n) [], Fun (Set s) S)) D) n\"\nusing to_abs_alt_def[of D n]\n to_abs_alt_def[of \"filter (\\d. \\S. d = (Fun (Val n) [], Fun (Set s) S)) D\" n]\nby auto\n\nlemma to_abs_db\\<^sub>s\\<^sub>s\\<^sub>t_append:\n assumes \"\\u s. insert\\u, s\\ \\ set B \\ Fun (Val n) [] \\ u \\ \\\"\n and \"\\u s. delete\\u, s\\ \\ set B \\ Fun (Val n) [] \\ u \\ \\\"\n shows \"\\\\<^sub>0 (db'\\<^sub>s\\<^sub>s\\<^sub>t A \\ D) n = \\\\<^sub>0 (db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ D) n\"\nusing assms\nproof (induction B rule: List.rev_induct)\n case (snoc b B)\n hence IH: \"\\\\<^sub>0 (db'\\<^sub>s\\<^sub>s\\<^sub>t A \\ D) n = \\\\<^sub>0 (db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ D) n\" by auto\n have *: \"\\u s. b = insert\\u,s\\ \\ Fun (Val n) [] \\ u \\ \\\"\n \"\\u s. b = delete\\u,s\\ \\ Fun (Val n) [] \\ u \\ \\\"\n using snoc.prems by simp_all\n show ?case\n proof (cases b)\n case (Insert u s)\n hence **: \"db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B@[b]) \\ D = List.insert (u \\ \\,s \\ \\) (db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ D)\"\n using db\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"A@B\" \"[b]\"] by simp\n have \"Fun (Val n) [] \\ u \\ \\\" using *(1) Insert by auto\n thus ?thesis using IH ** to_abs_list_insert by metis\n next\n case (Delete u s)\n hence **: \"db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B@[b]) \\ D = List.removeAll (u \\ \\,s \\ \\) (db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B) \\ D)\"\n using db\\<^sub>s\\<^sub>s\\<^sub>t_append[of \"A@B\" \"[b]\"] by simp\n have \"Fun (Val n) [] \\ u \\ \\\" using *(2) Delete by auto\n thus ?thesis using IH ** to_abs_list_remove_all by metis\n qed (simp_all add: db\\<^sub>s\\<^sub>s\\<^sub>t_no_upd_append[of \"[b]\" \"A@B\"] IH)\nqed simp\n\nlemma to_abs_neq_imp_db_update:\n assumes \"\\\\<^sub>0 (db\\<^sub>s\\<^sub>s\\<^sub>t A I) n \\ \\\\<^sub>0 (db\\<^sub>s\\<^sub>s\\<^sub>t (A@B) I) n\"\n shows \"\\u s. u \\ I = Fun (Val n) [] \\ (insert\\u,s\\ \\ set B \\ delete\\u,s\\ \\ set B)\"\nproof -\n { fix D have ?thesis when \"\\\\<^sub>0 D n \\ \\\\<^sub>0 (db'\\<^sub>s\\<^sub>s\\<^sub>t B I D) n\" using that\n proof (induction B I D rule: db'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n case 2 thus ?case\n by (metis db'\\<^sub>s\\<^sub>s\\<^sub>t.simps(2) list.set_intros(1,2) subst_apply_pair_pair to_abs_list_insert)\n next\n case 3 thus ?case\n by (metis db'\\<^sub>s\\<^sub>s\\<^sub>t.simps(3) list.set_intros(1,2) subst_apply_pair_pair to_abs_list_remove_all)\n qed simp_all\n } thus ?thesis using assms by (metis db\\<^sub>s\\<^sub>s\\<^sub>t_append db\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed\n\nlemma abs_term_subst_eq:\n fixes \\ \\::\"(('a,'b,'c) prot_fun, ('d,'e prot_atom) term \\ nat) subst\"\n assumes \"\\x \\ fv t. \\ x \\\\<^sub>\\ a = \\ x \\\\<^sub>\\ b\"\n and \"\\n T. Fun (Val n) T \\ subterms t\"\n shows \"t \\ \\ \\\\<^sub>\\ a = t \\ \\ \\\\<^sub>\\ b\"\nusing assms\nproof (induction t)\n case (Fun f T) thus ?case\n proof (cases f)\n case (Val n)\n hence False using Fun.prems(2) by blast\n thus ?thesis by metis\n qed auto\nqed simp\n\nlemma abs_term_subst_eq':\n fixes \\ \\::\"(('a,'b,'c) prot_fun, ('d,'e prot_atom) term \\ nat) subst\"\n assumes \"\\x \\ fv t. \\ x \\\\<^sub>\\ a = \\ x\"\n and \"\\n T. Fun (Val n) T \\ subterms t\"\n shows \"t \\ \\ \\\\<^sub>\\ a = t \\ \\\"\nusing assms\nproof (induction t)\n case (Fun f T) thus ?case\n proof (cases f)\n case (Val n)\n hence False using Fun.prems(2) by blast\n thus ?thesis by metis\n qed auto\nqed simp\n\nlemma abs_val_in_funs_term:\n assumes \"f \\ funs_term t\" \"is_Val f\"\n shows \"Abs (\\ (the_Val f)) \\ funs_term (t \\\\<^sub>\\ \\)\"\nusing assms by (induct t \\ rule: abs_apply_term.induct) auto\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Automated_Stateful_Protocol_Verification", "sha": "e24b8241b56d24240e1227caff737d4af82e12ec", "save_path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification", "path": "github-repos/isabelle/logicalhacking-Automated_Stateful_Protocol_Verification/Automated_Stateful_Protocol_Verification-e24b8241b56d24240e1227caff737d4af82e12ec/Automated_Stateful_Protocol_Verification/Term_Abstraction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199008363969, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2517686358624974}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Noninterference_Base\nimports \"../../lib/Simulation\"\nbegin\n\ntext {*\n Toby's extended noninterference definitions to handle dynamic assignment,\n that depends on the current state, of\n the domain that each action is assigned to. This is the gory details\n reported in the the CPP 2012 paper\n \\emph{Noninterference for Operating System Kernels}.\n*}\n\nlemma un_eq:\n \"\\S = S'; T = T'\\ \\ S \\ T = S' \\ T'\"\n apply auto\n done\n\nlemma Un_eq:\n \"\\\\ x y. \\x \\ xs; y \\ ys\\ \\ P x = Q y; \\ x. x \\ xs; \\ y. y \\ ys\\ \\ (\\x\\xs. P x) = (\\y\\ys. Q y)\"\n apply auto\n done\n\nlemma Int_eq:\n \"\\\\ x y. \\x \\ xs; y \\ ys\\ \\ P x = Q y; \\ x. x \\ xs; \\ y. y \\ ys\\ \\ (\\x\\xs. P x) = (\\y\\ys. Q y)\"\n apply auto\n done\n\nlemma Un_eq_Int:\n assumes ex: \"\\ x. x \\ xs\"\n assumes ey: \"\\ y. y \\ ys\"\n assumes a: \"\\ x y. \\x \\ xs; y \\ ys\\ \\ S x = S' y\"\n shows \"(\\x\\xs. S x) = (\\x\\ys. S' x)\"\n apply(rule equalityI)\n apply(clarsimp)\n apply(drule a, assumption, simp)\n apply clarsimp\n apply(insert ex ey)\n apply clarsimp\n apply(frule a, assumption)\n apply fastforce\n done\n\nprimrec Run :: \"('e \\ ('s \\ 's) set) \\ 'e list \\ ('s \\ 's) set\" where\n \"Run Stepf [] = Id\" |\n \"Run Stepf (a#as) = Stepf a O Run Stepf as\"\n\n\nlemma Run_mid':\n shows\n \"\\ s u bs. (s,u) \\ Run Stepf (as @ bs) \\ (\\ t. (s,t) \\ Run Stepf as \\ (t,u) \\ Run Stepf bs)\"\n proof(induct as)\n case Nil show ?case\n apply(clarsimp)\n done\n next\n case (Cons a as) show ?case\n apply(clarsimp simp: relcomp_def)\n apply(drule \"Cons.hyps\"[rule_format])\n apply fastforce\n done\nqed\n\nlemma Run_mid:\n \"(s,u) \\ Run Stepf (as @ bs) \\ (\\ t. (s,t) \\ Run Stepf as \\ (t,u) \\ Run Stepf bs)\"\n apply(erule Run_mid'[rule_format])\n done\n\nlemma Run_trans':\n \"\\ s t u bs. (s,t) \\ Run Stepf as \\ (t,u) \\ Run Stepf bs \\ (s,u) \\ Run Stepf (as @ bs)\"\n by (induct_tac as) auto\n\nlemma Run_trans:\n \"\\(s,t) \\ Run Stepf as; (t,u) \\ Run Stepf bs\\ \\ (s,u) \\ Run Stepf (as @ bs)\"\n by(blast intro: Run_trans'[rule_format])\n\nlemma Run_app:\n \"Run Stepf (as @ bs) = (Run Stepf as) O (Run Stepf bs)\"\n apply(rule equalityI)\n apply(fastforce dest: Run_mid)\n apply(fastforce intro: Run_trans)\n done\n\n(* An ADT with an initial state. *)\nlocale system =\n fixes A :: \"('a,'s,'e) data_type\" \n and s0 :: \"'s\" (* an initial state *)\n\ncontext system begin\n\n(* State 's' is reachable from the initial state 's0'. *)\ndefinition reachable where\n \"reachable s \\ \\ js. s \\ execution A s0 js\"\n\ndefinition Step where\n \"Step a \\ {(s,s') . s' \\ execution A s [a]}\"\n\n(* The system is \"observationally deterministic\": that is, the\n * observable part of the system is always deterministic. *)\ndefinition obs_det where\n \"obs_det \\ \\ s js. (\\ s'. execution A s js = {s'})\"\n\nlemma obs_detD:\n \"obs_det \\ \\ s'. execution A s js = {s'}\" by (simp add: obs_det_def)\n\n(* The abstraction/concretisation functions \"Init\"/\"Fin\"\n * don't abstract away information. *)\ndefinition no_abs where\n \"no_abs \\ \\ x s as . reachable s \\ x \\ steps (Simulation.Step A) (Init A s) as \\ Init A (Fin A x) = {x}\"\n \nlemma no_absD:\n \"no_abs \\ reachable s \\ x \\ steps (Simulation.Step A) (Init A s) as \\ Init A (Fin A x) = {x}\" by (auto simp: no_abs_def)\n\nend\n\n(*\n * A system that is always enabled.\n *\n * In particular, the system will never be in deadlock, and there\n * is always an enabled transition from every reachable state.\n *)\nlocale enabled_system = system +\n assumes enabled: \"(\\ js. s \\ execution A s0 js) \\ \\ s'. s' \\ execution A s js\"\n\ncontext enabled_system begin\n\nlemma reachable_enabled:\n \"reachable s \\ \\ s'. s' \\ execution A s js\"\n apply(simp add: reachable_def)\n apply(erule enabled)\n done\n\n\nlemma enabled_Step:\n \"reachable s \\ \\ s'. (s,s') \\ Step a\"\n apply(simp add: Step_def, blast intro: reachable_enabled)\n done\n\n\nend\n\n(* we define the unwinding conditions for systems for which a running\n a sequence of events is equivalent to performing a sequence of individual\n steps: one for each event in the sequence in turn *)\nlocale Step_system = system A s0\n for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" +\n assumes reachable_s0: \"reachable s0\"\n assumes execution_Run: \"reachable s \\ execution A s as = {s'. (s,s') \\ Run Step as}\"\n\n\ncontext Step_system begin\n\nlemma execution_Run':\n \"s \\ execution A s0 js \\ execution A s as = {s'. (s,s') \\ Run Step as}\"\n apply(rule execution_Run)\n apply(fastforce simp: reachable_def)\n done\n\nlemma reachable_Run:\n \"reachable s \\ \\as. (s0,s) \\ Run Step as\"\n apply (clarsimp simp add: reachable_def)\n apply (cut_tac as=js in execution_Run[OF reachable_s0])\n apply blast\n done\n\nlemma Run_reachable:\n \"\\as. (s0,s) \\ Run Step as \\ reachable s\"\n apply (clarsimp simp add: reachable_def)\n apply (cut_tac as=as in execution_Run[OF reachable_s0])\n apply blast\n done\n\n\nlemma reachable_execution:\n \"\\reachable s; s' \\ execution A s js\\ \\ reachable s'\"\n apply(clarsimp simp: reachable_def)\n apply(rule_tac x=\"jsa @ js\" in exI)\n apply(frule execution_Run'[where s=s and as=js])\n apply(simp add: execution_Run[where s=s0, simplified reachable_s0])\n apply(fastforce simp: Run_app)\n done\n\nlemma reachable_Step:\n \"\\reachable s; (s,s') \\ Step a\\ \\ reachable s'\"\n apply(erule reachable_execution)\n apply(simp add: Step_def)\n done\n\nlemma reachable_induct_helper: assumes a:\n \"\\s s' a.\n \\reachable s; P s;\n (s, s') \\ Step a\\\n \\ P s'\"\n shows \"\\(s0, s1) \\ Run Step as; P s0\\\n \\ P s1\"\n apply (induct as arbitrary: s1 rule: rev_induct)\n apply simp\n apply(fastforce dest: Run_mid intro: a Run_reachable)\n done\n\nlemma reachable_induct: \"(\\s s' a. reachable s \\ (s,s') \\ (Step a) \\ P s \\ P s') \\ reachable s1 \\ P s0 \\ P s1\"\n apply (drule reachable_Run)\n apply (elim exE)\n apply (rule reachable_induct_helper)\n apply simp+\n done\n\nend\n\nlocale Init_Fin_system = system A s0\n for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" +\n assumes reachable_s0: \"reachable s0\"\n assumes Fin_Init: \"reachable s \\ Fin A ` Init A s = {s}\"\n assumes Init_Fin: \"reachable s \\ x \\ steps (Simulation.Step A) (Init A s) as \\ x \\ Init A (Fin A x)\"\n assumes obs_det_or_no_abs: \"obs_det \\ no_abs\"\n\n\ncontext Init_Fin_system begin\n\n\nlemma execution_subset_Run:\n \"reachable s \\ execution A s as \\ {s'. (s,s') \\ Run Step as}\"\n apply(induct as arbitrary: s rule: rev_induct)\n apply(simp add: execution_def steps_def Fin_Init)\n apply(simp add: execution_def steps_def)\n apply(rule subsetI)\n apply clarsimp\n apply(rule Run_trans)\n apply blast\n apply(cut_tac x=xc and s=s and as=xs in Init_Fin, (simp add: steps_def)+)\n apply(clarsimp simp: Step_def execution_def steps_def)\n apply blast\n done\n\nlemma Run_subset_execution:\n \"\\no_abs; reachable s\\ \\ {s'. (s,s') \\ Run Step as} \\ execution A s as\"\n apply(induct as arbitrary: s rule: rev_induct)\n apply(simp add: execution_def steps_def Fin_Init)\n apply(simp add: execution_def steps_def)\n apply(rule subsetI)\n apply clarsimp\n apply(drule Run_mid)\n apply clarsimp\n apply(drule_tac x=s in meta_spec)\n apply clarsimp\n apply(drule_tac subsetD)\n apply blast\n apply(clarsimp simp: Image_def image_def Step_def execution_def steps_def)\n apply(rule_tac x=xc in exI)\n apply clarsimp\n apply(rule_tac x=xd in bexI)\n apply assumption\n apply(drule_tac x=xb in no_absD)\n apply(simp add: steps_def Image_def)+\n done\n\nlemma Run_det:\n \"obs_det \\ \\ s'. {s'. (s,s') \\ Run Step as} = {s'}\"\n apply(induct as arbitrary: s rule: rev_induct)\n apply simp\n apply(simp add: Run_app relcomp_def)\n apply(drule_tac x=s in meta_spec)\n apply clarsimp\n apply(drule_tac s=s' and js=\"[x]\" in obs_detD)\n apply (clarsimp simp: Step_def)\n apply(rule_tac x=\"s'a\" in exI)\n apply (auto dest: equalityD1)\n done\n \nlemma eq:\n \"\\S \\ T; \\ x. S = {x}; \\ y. T = {y}\\ \\ S = T\"\n apply blast\n done\n\nlemma execution_Run:\n \"reachable s \\ execution A s as = {s'. (s,s') \\ Run Step as}\"\n apply(rule disjE[OF obs_det_or_no_abs])\n apply(rule eq)\n apply(erule execution_subset_Run)\n apply(erule obs_detD)\n apply(erule Run_det)\n apply(rule equalityI)\n apply(erule execution_subset_Run)\n apply(erule (1) Run_subset_execution)\n done\n\nend\n\nlemma Init_Fin_system_Step_system:\n \"Init_Fin_system A s0 \\ Step_system A s0\"\n apply(unfold_locales)\n apply(erule Init_Fin_system.reachable_s0)\n apply(erule (1) Init_Fin_system.execution_Run)\n done\n\nsublocale Init_Fin_system \\ Step_system\n apply(rule Init_Fin_system_Step_system)\n apply(unfold_locales)\n done\n\n(* when Init is the inverse image of Fin, the above assumptions are met by a system\n for which Fin is injective, or one that appears deterministic to an observer *)\n\nlocale Init_inv_Fin_system = system A s0\n for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" +\n assumes Fin_Init_s0: \"s0 \\ Fin A ` Init A s0\"\n assumes Init_inv_Fin: \"reachable s \\ Init A s = {s'. Fin A s' = s}\"\n assumes Fin_inj: \"inj (Fin A)\"\n\ncontext Init_inv_Fin_system begin\n\nlemma s0_reachable:\n \"reachable s0\"\n apply(simp add: system.reachable_def)\n apply(rule_tac x=\"[]\" in exI)\n apply(simp add: execution_def steps_def)\n apply(simp add: Fin_Init_s0)\n done\n\nlemma foldl_foldl_Step:\n \"\\x \\ foldl (\\S j. data_type.Step A j `` S) M as; \n M \\ foldl (\\S j. data_type.Step A j `` S) B js\\\n \\ x \\ foldl (\\S j. data_type.Step A j `` S)\n (foldl (\\S j. data_type.Step A j `` S) B js) as\"\n apply(induct as arbitrary: x M js B rule: rev_induct) \n apply fastforce\n apply simp\n apply(erule ImageE)\n apply(drule_tac x=xb in meta_spec)\n apply(drule_tac x=M in meta_spec)\n apply simp\n apply(drule_tac x=js in meta_spec) \n apply(drule_tac x=B in meta_spec, simp)\n apply(blast)\n done\n\nlemma reachable_Fin:\n \"\\reachable s;\n x \\ steps (Simulation.Step A) (Init A s) as\\\n \\ reachable (Fin A x)\"\n apply(cut_tac s=s in Init_inv_Fin, assumption)\n apply(clarsimp simp: reachable_def execution_def steps_def)\n apply(rule_tac x=\"js@as\" in exI)\n apply(rule imageI)\n apply(subgoal_tac \"{s'. Fin A s' = Fin A xa} = {xa}\")\n apply simp\n apply(erule foldl_foldl_Step)\n apply blast\n apply(blast dest: injD[OF Fin_inj])\n done\n \n\nend\n \n\n\n\nlemma Init_inv_Fin_system_Init_Fin_system:\n \"Init_inv_Fin_system A s0 \\ Init_Fin_system A s0\"\n apply(unfold_locales)\n apply(erule Init_inv_Fin_system.s0_reachable)\n apply(simp add: Init_inv_Fin_system.Init_inv_Fin)\n apply(simp add: image_def)\n apply(fastforce simp: system.reachable_def execution_def)\n apply(cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n apply assumption\n apply(blast intro: Init_inv_Fin_system.reachable_Fin)\n apply simp\n apply(rule disjI2)\n apply(clarsimp simp: system.no_abs_def)\n apply(frule Init_inv_Fin_system.Fin_inj)\n apply(cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n apply assumption\n apply(blast intro: Init_inv_Fin_system.reachable_Fin)\n apply simp\n apply(fastforce dest: injD)\n done\n\n\nsublocale Init_inv_Fin_system \\ Init_Fin_system\n apply(rule Init_inv_Fin_system_Init_Fin_system)\n apply(unfold_locales)\n done\n\n\nlocale noninterference_policy =\n fixes dom :: \"'e \\ 's \\ 'd\" (* dynamic dom assignment *)\n fixes uwr :: \"'d \\ ('s \\ 's) set\"\n fixes policy :: \"('d \\ 'd) set\" (* who can send info to whom *)\n fixes out :: \"'d \\ 's \\ 'p\" (* observable parts of d in state s *)\n fixes schedDomain :: \"'d\"\n assumes uwr_equiv_rel: \"equiv UNIV (uwr u)\"\n assumes schedIncludesCurrentDom:\n \"(s,t) \\ uwr schedDomain \\ dom e s = dom e t\"\n assumes schedFlowsToAll:\n \"(schedDomain,d) \\ policy\"\n assumes schedNotGlobalChannel:\n \"(x,schedDomain) \\ policy \\ x = schedDomain\"\n\ncontext noninterference_policy begin\n\nabbreviation uwr2 :: \"'s \\ 'd \\ 's \\ bool\" (\"(_/ \\_\\/ _)\" [50,100,50] 1000) \nwhere \"s \\u\\ t \\ (s,t) \\ uwr u\"\n\nabbreviation policy2 :: \"'d \\ 'd \\ bool\" (infix \"\\\" 50) where\n\"u \\ v \\ (u,v) \\ policy\"\n\nlemma uwr_refl:\n \"s \\(u::'d)\\ s\"\n apply(cut_tac u=u in uwr_equiv_rel)\n apply(clarsimp simp: equiv_def)\n apply(blast dest: refl_onD)\n done\n\nlemma uwr_sym:\n \"x \\(u::'d)\\ y \\ y \\u\\ x\"\n apply(cut_tac u=u in uwr_equiv_rel)\n apply(clarsimp simp: equiv_def)\n apply(blast dest: symD)\n done\n\nlemma uwr_trans:\n \"\\x \\(u::'d)\\ y; y \\u\\ z\\ \\ x \\u\\ z\"\n apply(cut_tac u=u in uwr_equiv_rel)\n apply(clarsimp simp: equiv_def)\n apply(blast dest: transD)\n done\n\ndefinition sameFor_dom :: \"'s \\ 'd set \\ 's \\ bool\" (\"(_/ \\_\\/ _)\" [50,100,50] 1000) where\n \"s \\us\\ t \\ \\u\\us. (s,t) \\ uwr u\"\n\nlemma sameFor_subset_dom: \"\\s \\(x::'d set)\\ t; y \\ x\\ \\ s \\y\\ t\"\n by(fastforce simp: sameFor_dom_def)\n\n\nlemma sameFor_inter_domI: \"s \\(S::'d set)\\ t \\ s \\(S \\ B)\\ t\"\n by(auto simp: sameFor_dom_def)\n\n\nlemma sameFor_sym_dom:\n \"s \\(S::'d set)\\ t \\ t \\S\\ s\"\n by(auto simp: sameFor_dom_def uwr_sym)\n\nend\n\nlocale noninterference_system = enabled_system A s0 + noninterference_policy dom uwr policy out schedDomain\n for A :: \"('a,'s,'e) data_type\" \n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\" \n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\"\n and out :: \"'d \\ 's \\ 'p\"\n and schedDomain :: \"'d\"\n\n\n\ncontext noninterference_system begin\n\n(* The set of domains (which carry out actions in the list \"as\") which\n * may influence \"u\", assuming we start in state \"s\". *)\nprimrec \n sources :: \"'e list \\ 's \\ 'd \\ 'd set\" where\n sources_Nil: \"sources [] s u = {u}\"|\n sources_Cons: \"sources (a#as) s u = (\\{sources as s' u| s'. (s,s') \\ Step a}) \\ \n {w. w = dom a s \\ (\\ v s'. dom a s \\ v \\ (s,s') \\ Step a \\ v \\ sources as s' u)}\"\n\ndeclare sources_Nil [simp del] \ndeclare sources_Cons [simp del] \n\n\n \ndefinition \n obs_equiv :: \"'s \\ 'e list \\ 's \\ 'e list \\ 'd \\ bool\" \nwhere\n \"obs_equiv s as t bs d \\ \\ s' t'. s' \\ execution A s as \\ t' \\ execution A t bs \\\n out d s' = out d t'\"\n\n\ndefinition \n uwr_equiv :: \"'s \\ 'e list \\ 's \\ 'e list \\ 'd \\ bool\" \nwhere\n \"uwr_equiv s as t bs d \\ \\ s' t'. s' \\ execution A s as \\ t' \\ execution A t bs \\\n s' \\d\\ t'\"\n\n\n\ntext {* Nonleakage *}\ndefinition\n Nonleakage :: \"bool\" where\n \"Nonleakage \\ \\as s u t. reachable s \\ reachable t \\ \n s \\schedDomain\\ t \\\n s \\(sources as s u)\\ t \\ obs_equiv s as t as u\"\n\ntext {* A generalisation of Nonleakage. *}\ndefinition Nonleakage_gen :: \"bool\" where\n \"Nonleakage_gen \\ \\as s u t. reachable s \\ reachable t \\\n s \\schedDomain\\ t \\\n s \\(sources as s u)\\ t \\ uwr_equiv s as t as u\"\n\n\n\n\nlemma uwr_equiv_sym:\n \"uwr_equiv s as t bs u \\ uwr_equiv t bs s as u\"\n apply(fastforce simp: uwr_equiv_def uwr_sym)\n done\n\nlemma uwr_equiv_trans:\n \"\\reachable t; uwr_equiv s as t bs x; uwr_equiv t bs u cs x\\ \\ uwr_equiv s as u cs x\"\n apply(clarsimp simp: uwr_equiv_def)\n apply(cut_tac s=t and js=bs in reachable_enabled)\n apply assumption\n apply(blast intro: uwr_trans)\n done\n\nprimrec gen_purge :: \"('e list \\ 's \\ 'd \\ 'd set) \\ 'd \\ 'e list \\ 's set \\ 'e list\" \nwhere\n Nil : \"gen_purge sf u [] ss = []\" |\n Cons: \"gen_purge sf u (a#as) ss = \n (if (\\s\\ss. dom a s \\ sf (a#as) s u) then \n a#gen_purge sf u as (\\s\\ss. {s'. (s,s') \\ Step a})\n else \n gen_purge sf u as ss)\"\n\n\n\ndefinition ipurge where\n \"ipurge \\ gen_purge sources\"\n\nlemma ipurge_Nil:\n \"ipurge u [] ss = []\"\n by(auto simp: ipurge_def)\n\nlemma ipurge_Cons: \n \"ipurge u (a#as) ss = \n (if (\\ s\\ss. dom a s \\ sources (a#as) s u) then \n a#ipurge u as (\\s\\ss. {s'. (s,s') \\ Step a})\n else \n ipurge u as ss)\"\n by (auto simp: ipurge_def)\n\n\nlemma gen_purge_shortens:\n \"length (gen_purge sf u as ss) \\ length as\"\n apply(induct as arbitrary: ss)\n apply(simp)\n apply(clarsimp)\n apply(rule le_trans)\n apply assumption\n apply simp\n done\n\n\n\n\nlemma INT_cong':\n assumes a: \"\\ x. Q x \\ P x = P' x\"\n shows\n \"\\{P x|x. Q x} = \\{P' x|x. Q x}\"\n apply (auto simp: a)\n done\n \n\ntext {* Standard Noninterfernce *}\n\ndefinition\n Noninterference :: \"bool\" where\n \"Noninterference \\\n \\ u as s. reachable s \\ \n (obs_equiv s as s (ipurge u as {s}) u)\"\n\n\ntext {* Strong Noninterference *}\ndefinition\n Noninterference_strong :: \"bool\" where\n \"Noninterference_strong \\\n \\ u as bs s. reachable s \\\n (ipurge u as {s}) = (ipurge u bs {s}) \\\n (obs_equiv s as s bs u)\"\n\n\n\nlemma obs_equiv_sym:\n \"obs_equiv s as t bs u \\ obs_equiv t bs s as u\"\n apply(clarsimp simp: obs_equiv_def)\n done\n\nlemma obs_equiv_trans:\n \"\\reachable t; obs_equiv s as t bs u; obs_equiv t bs x cs u\\ \\ obs_equiv s as x cs u\"\n apply(clarsimp simp: obs_equiv_def)\n apply(cut_tac s=t and js=bs in reachable_enabled, assumption, blast)\n done\n\nlemma Noninterference_Noninterference_strong:\n \"\\Noninterference\\ \\ Noninterference_strong\n\"\n apply(clarsimp simp: Noninterference_def Noninterference_strong_def)\n apply(drule_tac x=u in spec)\n apply(frule_tac x=as in spec, drule_tac x=s in spec)\n apply(drule_tac x=bs in spec, drule_tac x=s in spec)\n apply clarsimp\n apply(rule obs_equiv_trans)\n apply assumption\n apply assumption\n apply(erule obs_equiv_sym)\n done\n\n\ntext {* Noninfluence -- the combination of Noninterference and \n Nonleakage. \n\n We add the assumption about equivalence wrt the scheduler's domain, as\n is common in e.g. GVW.*}\ndefinition\n Noninfluence :: \"bool\" where\n \"Noninfluence \\\n \\ u as s t. reachable s \\ reachable t \\\n s \\(sources as s u)\\ t \\ s \\schedDomain\\ t \\\n obs_equiv s as t (ipurge u as {t}) u\"\n\n\n\n\ndefinition\n Noninfluence_strong :: \"bool\" where\n \"Noninfluence_strong \\\n \\ u as bs s t. reachable s \\ reachable t \\\n s \\(sources as s u)\\ t \\ s \\schedDomain\\ t \\\n ipurge u as {s} = ipurge u bs {s} \\\n obs_equiv s as t bs u\"\n\n\n\n\nlemma notin_policyI:\n \"\\dom a s \\ sources (a # list) s u; \\ s'. (s,s') \\ Step a \\ ua \\ sources list s' u\\ \\\n (dom a s,ua) \\ policy\"\n apply(clarsimp simp: sources_Cons)\n done\n\n\nlemma Noninfluence_strong_Noninterference_strong:\n \"Noninfluence_strong \\ Noninterference_strong\"\n apply(clarsimp simp: Noninfluence_strong_def Noninterference_strong_def)\n apply(drule_tac x=u in spec, drule_tac x=as in spec, drule_tac x=bs in spec)\n apply(fastforce simp: sameFor_dom_def uwr_refl)\n done\n\nlemma Noninfluence_strong_Nonleakage:\n \"Noninfluence_strong \\ Nonleakage\"\n apply(clarsimp simp: Noninfluence_strong_def Nonleakage_def)\n done\n\ntext {* This stronger condition is needed\n to make the induction proof work for Noninterference. It can be viewed\n as a generalisation of Noninfluence; hence its name here.\n*}\ndefinition\n Noninfluence_gen :: \"bool\" where\n \"Noninfluence_gen \\\n \\ u as s ts. reachable s \\ (\\ t \\ ts. reachable t) \\\n (\\t \\ ts. s \\(sources as s u)\\ t) \\ (\\t \\ ts. s \\schedDomain\\ t) \\ \n (\\t \\ ts. uwr_equiv s as t (ipurge u as ts) u)\"\n\ndefinition\n Noninfluence_uwr :: \"bool\" where\n \"Noninfluence_uwr \\\n \\ u as s t. reachable s \\ reachable t \\\n s \\(sources as s u)\\ t \\ s \\schedDomain\\ t \\\n uwr_equiv s as t (ipurge u as {t}) u\"\n\ndefinition\n Noninfluence_strong_uwr :: \"bool\" where\n \"Noninfluence_strong_uwr \\\n \\ u as bs s t. reachable s \\ reachable t \\\n s \\(sources as s u)\\ t \\ s \\schedDomain\\ t \\\n ipurge u as {s} = ipurge u bs {s} \\\n uwr_equiv s as t bs u\"\n\n\n\n\ndefinition output_consistent :: \"bool\" where\n \"output_consistent \\ \\ u s s'. s \\u\\ s' \\ (out u s = out u s')\"\n\ndefinition confidentiality_u :: \"bool\" where\n \"confidentiality_u \\ \\ a u s t. reachable s \\ reachable t \\\n s \\schedDomain\\ t \\\n ((dom a s \\ u) \\ s \\dom a s\\ t) \\ \n s \\u\\ t \\ \n (\\ s' t'. (s,s') \\ Step a \\ (t,t') \\ Step a \\\n s' \\u\\ t')\"\n\nlemma no_domain_visible_nondeterminism:\n \"\\confidentiality_u; reachable s; (s,s') \\ Step a; (s,s'') \\ Step a\\ \\ s' \\d\\ s''\"\n apply(clarsimp simp: confidentiality_u_def)\n apply(fastforce intro: uwr_refl)\n done\n\ndefinition integrity_u :: \"bool\" where\n \"integrity_u \\ \\ a u s. reachable s \\ \n (dom a s,u) \\ policy \\\n (\\ s'. (s,s') \\ Step a \\ s \\u\\ s')\"\n\n(*<*)\n(* integrity_u actually guarantees this (seemingly) stronger condition *)\ndefinition integrity_u_more :: \"bool\" where\n \"integrity_u_more \\ \\ a u s. reachable s \\ \n (dom a s,u) \\ policy \\\n (\\ s' t. s \\u\\ t \\ (s,s') \\ Step a \\ s' \\u\\ t)\"\n\nlemma integrity_u_more:\n \"integrity_u \\ integrity_u_more\"\n apply(clarsimp simp: integrity_u_more_def integrity_u_def)\n apply(blast dest: uwr_sym uwr_trans)\n done\n(*>*)\n\nlemma integrity_uD:\n \"\\integrity_u; reachable s; (dom a s,u) \\ policy;\n s \\u\\ t; (s,s') \\ Step a\\ \\ \n s' \\u\\ t\"\n apply(drule integrity_u_more)\n apply(simp add: integrity_u_more_def)\n done\n\n\n\n\ntext {*\n A weaker version of @{prop confidentiality_u} that, with\n @{prop integrity_u}, implies it.\n*}\ndefinition confidentiality_u_weak where\n \"confidentiality_u_weak \\ \\ a u s t. reachable s \\ reachable t \\\n s \\schedDomain\\ t \\ dom a s \\ u \\ s \\(dom a s)\\ t \\ \n s \\u\\ t \\ \n (\\ s' t'. (s,s') \\ Step a \\ (t,t') \\ Step a \\ s' \\u\\ t')\"\n\nlemma confidentiality_u_confidentiality_u_weak:\n \"confidentiality_u \\ confidentiality_u_weak\"\n apply (simp add: confidentiality_u_def confidentiality_u_weak_def)\n apply blast\n done\n\nlemma impCE':\n \"\\P \\ Q; \\P; Q\\ \\ R; \\ P \\ R\\ \\ R\"\n apply auto\n done\n\nlemma confidentiality_u_weak:\n \"\\confidentiality_u_weak; integrity_u\\ \\\n confidentiality_u\"\n apply(clarsimp simp: confidentiality_u_def)\n apply(erule impCE')\n apply(subst (asm) confidentiality_u_weak_def, blast)\n apply(frule integrity_uD, simp+)\n apply(drule_tac s=t and t=\"s'\" in integrity_uD)\n apply assumption\n apply(drule_tac e=a in schedIncludesCurrentDom)\n apply simp\n apply(blast intro: uwr_sym)\n apply assumption\n apply(erule uwr_sym)\n done\n\nlemma obs_equivI:\n \"\\output_consistent; uwr_equiv s as t bs ob\\ \\ obs_equiv s as t bs ob\"\n apply(clarsimp simp: obs_equiv_def)\n apply(auto simp: uwr_equiv_def output_consistent_def)\n done\n\nlemma Noninfluence_uwr_Noninfluence:\n \"\\output_consistent; Noninfluence_uwr\\ \\ Noninfluence\"\n apply(clarsimp simp: Noninfluence_def)\n apply(erule obs_equivI)\n apply(auto simp: Noninfluence_uwr_def)\n done\n\nlemma Noninfluence_strong_uwr_Noninfluence_strong:\n \"\\output_consistent; Noninfluence_strong_uwr\\ \\ Noninfluence_strong\"\n apply(clarsimp simp: Noninfluence_strong_def)\n apply(erule obs_equivI)\n apply(auto simp: Noninfluence_strong_uwr_def)\n done\n\nlemma sched_equiv_preserved:\n \"\\confidentiality_u; reachable s; reachable t;\n s \\schedDomain\\ t; (s,s') \\ Step a; (t,t') \\ Step a\\ \\\n s' \\schedDomain\\ t'\"\n apply(case_tac \"dom a s = schedDomain\")\n apply(subst (asm) confidentiality_u_def)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=schedDomain in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=t in spec)\n apply simp\n apply(subst (asm) confidentiality_u_def)\n apply(blast intro: schedNotGlobalChannel)\n done\n\nlemma sched_equiv_preserved_left:\n \"\\integrity_u; s \\schedDomain\\ t;\n dom a s \\ schedDomain; (s,s') \\ Step a; reachable s\\ \\ \n s' \\schedDomain\\ t\"\n apply(blast intro: integrity_uD schedNotGlobalChannel)\n done \n\nlemma Noninfluence_gen_Noninterference:\n \"\\output_consistent; Noninfluence_gen\\ \\ Noninterference\"\n apply(clarsimp simp: Noninterference_def Noninfluence_gen_def)\n apply(erule_tac x=u in allE)\n apply(erule_tac x=as in allE)\n apply(erule_tac x=s in allE)\n apply(erule_tac x=\"{s}\" in allE)\n apply(clarsimp simp: sameFor_dom_def uwr_refl)\n apply(blast intro: obs_equivI)\n done\n\nlemma Noninfluence_gen_Noninfluence:\n \"\\output_consistent; Noninfluence_gen\\ \\ Noninfluence\"\n apply(clarsimp simp: Noninfluence_def Noninfluence_gen_def)\n apply(erule_tac x=u in allE)\n apply(erule_tac x=as in allE)\n apply(erule_tac x=s in allE)\n apply(erule_tac x=\"{t}\" in allE)\n apply(blast intro: obs_equivI)\n done\n\nlemma Noninfluence_gen_Noninfluence_uwr:\n \"\\Noninfluence_gen\\ \\ Noninfluence_uwr\"\n apply(clarsimp simp: Noninfluence_uwr_def Noninfluence_gen_def)\n done\n\nlemma Noninfluence_gen_Noninterference_strong:\n \"\\output_consistent; Noninfluence_gen\\ \\ Noninterference_strong\"\n apply(rule Noninterference_Noninterference_strong)\n apply(blast intro: Noninfluence_gen_Noninterference)\n done\n\n\nend\n\nlocale enabled_Step_system = enabled_system A s0 + Step_system A s0\n for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" \n\n\n(* we define the unwinding conditions for any system *)\nlocale unwinding_system = enabled_Step_system A s0 + noninterference_policy dom uwr policy out schedDomain\n for A :: \"('a,'s,'e) data_type\" \n and s0 :: \"'s\"\n and dom :: \"'e \\ 's \\ 'd\" \n and uwr :: \"'d \\ ('s \\ 's) set\"\n and policy :: \"('d \\ 'd) set\"\n and out :: \"'d \\ 's \\ 'p\"\n and schedDomain :: \"'d\"\n\nsublocale unwinding_system \\ noninterference_system\n apply(unfold_locales)\n done\n\ncontext unwinding_system begin\n\n\n\n\nlemma sources_refl:\n \"reachable s \\ u \\ sources as s u\"\n apply(induct as arbitrary: s)\n apply(simp add: sources_Nil)\n apply(simp add: sources_Cons)\n apply(frule_tac a=a in enabled_Step)\n apply (auto simp: reachable_Step)\n done\n\n\n\nlemma schedDomain_in_sources_Cons:\n \"reachable s \\ dom a s = schedDomain \\ dom a s \\ sources (a#as) s u\"\n apply(unfold sources_Cons)\n apply(erule ssubst)\n apply(rule UnI2)\n apply(clarsimp)\n apply(rule_tac x=u in exI)\n apply(safe)\n apply(rule schedFlowsToAll)\n apply(frule_tac a=a in enabled_Step)\n apply(fastforce dest: sources_refl reachable_Step)\n done\n\n\n\nlemma sources_eq':\n \"confidentiality_u \\ s \\schedDomain\\ t \\ reachable s \\ reachable t \\ sources as s u = sources as t u\"\n proof (induct as arbitrary: s t)\n case Nil show ?case\n apply(simp add: sources_Nil)\n done\n next\n case (Cons a as) show ?case\n apply(clarsimp simp: sources_Cons)\n apply(rule un_eq)\n apply(simp only: Union_eq, simp only: UNION_eq[symmetric])\n apply(rule Un_eq, clarsimp)\n apply(metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step)\n apply(fastforce intro: enabled_Step)\n apply(fastforce intro: enabled_Step)\n apply(clarsimp simp: schedIncludesCurrentDom)\n apply(rule Collect_cong)\n apply(rule conj_cong, rule refl)\n apply(rule iff_exI)\n apply(metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step enabled_Step)\n done\n qed\n\n\nlemma sources_eq:\n \"\\confidentiality_u; s \\schedDomain\\ t; reachable s; reachable t\\ \\ \n sources as s u = sources as t u\"\n apply(rule sources_eq'[rule_format], simp)\n done\n\n\nlemma sameFor_sources_dom:\n \"\\s \\(sources (a#as) s u)\\ t; dom a s \\ x; x \\ sources as s' u; (s,s') \\ Step a\\ \\\n s \\(dom a s)\\ t\"\n apply(simp add: sameFor_dom_def)\n apply(erule bspec)\n apply(subst sources_Cons)\n apply(rule UnI2)\n apply blast\n done\n\nlemma sources_unwinding_step:\n \"\\s \\(sources (a#as) s u)\\ t; s \\schedDomain\\ t; confidentiality_u;\n (s,s') \\ Step a; (t,t') \\ Step a; reachable s; reachable t\\ \\\n s' \\(sources as s' u)\\ t'\"\n apply(clarsimp simp: sameFor_dom_def sources_Cons)\n apply(subst (asm) confidentiality_u_def)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=ua in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=t in spec)\n apply(fastforce intro: sameFor_sources_dom)\n done\n\nlemma ipurge_eq'_helper:\n \"\\s \\ ss; dom a s \\ sources (a # as) s u; \\s\\ts. dom a s \\ sources (a # as) s u;\n (\\s t. s \\ ss \\ t \\ ts \\ s \\schedDomain\\ t \\ reachable s \\ reachable t); t \\ ts; confidentiality_u\\ \\\n False\"\n apply(cut_tac s=s and t=t and as=as and u=u in sources_eq, simp+)\n apply(clarsimp simp: sources_Cons | safe)+\n apply(rename_tac s')\n apply(drule_tac x=t in bspec, simp)\n apply clarsimp\n apply(cut_tac s=t in enabled_Step, simp)\n apply(erule exE, rename_tac t')\n apply(drule_tac x=\"sources as t' u\" in spec)\n apply(cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n apply(fastforce elim: sched_equiv_preserved)\n apply(fastforce intro: reachable_Step)\n apply(fastforce intro: reachable_Step)\n apply(fastforce simp: schedIncludesCurrentDom)\n apply(drule_tac x=t in bspec, simp)\n apply clarsimp\n apply(rename_tac v s')\n apply(drule_tac x=v in spec, erule impE, fastforce simp: schedIncludesCurrentDom)\n apply(cut_tac s=t in enabled_Step[where a=a], simp, clarsimp, rename_tac t')\n apply(cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n apply(fastforce elim: sched_equiv_preserved)\n apply(fastforce intro: reachable_Step)\n apply(fastforce intro: reachable_Step)\n apply(fastforce simp: schedIncludesCurrentDom)\n done\n \n \n\nlemma ipurge_eq':\n \"(\\ s t. s\\ss \\ t\\ts \\ s \\schedDomain\\ t \\ reachable s \\ reachable t) \\ (\\ s. s \\ ss) \\ (\\ t. t \\ ts) \\ confidentiality_u \\ ipurge u as ss = ipurge u as ts\"\n proof (induct as arbitrary: ss ts)\n case Nil show ?case\n apply(simp add: ipurge_def)\n done\n next\n case (Cons a as) show ?case\n apply(clarsimp simp: ipurge_Cons schedIncludesCurrentDom)\n apply(intro conjI impI)\n apply(rule \"Cons.hyps\"[rule_format])\n apply clarsimp\n apply(metis sched_equiv_preserved reachable_Step enabled_Step)\n apply clarsimp\n apply(drule ipurge_eq'_helper, simp+)[1]\n apply clarsimp\n apply(drule ipurge_eq'_helper, (simp add: uwr_sym)+)[1]\n apply(rule \"Cons.hyps\"[rule_format], auto)\n done \n qed\n\nlemma ipurge_eq:\n \"\\s \\schedDomain\\ t; reachable s; reachable t;\n confidentiality_u\\ \\ \n ipurge u as {s} = ipurge u as {t}\"\n apply(rule ipurge_eq'[rule_format], simp)\n done\n\nlemma Noninfluence_uwr_Noninfluence_strong_uwr:\n \"\\confidentiality_u; Noninfluence_uwr\\ \\ Noninfluence_strong_uwr\"\n apply(clarsimp simp: Noninfluence_uwr_def Noninfluence_strong_uwr_def)\n apply(frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n apply assumption+\n apply(frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n apply assumption+\n apply clarsimp\n apply(drule_tac x=u in spec)\n apply(frule_tac x=as in spec)\n apply(drule_tac x=s in spec, drule_tac x=t in spec)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=t in spec, drule_tac x=t in spec)\n apply clarsimp\n apply(rule_tac t=t in uwr_equiv_trans)\n apply assumption\n apply assumption\n apply(rule uwr_equiv_sym)\n apply(clarsimp simp: sameFor_dom_def uwr_refl)\n done\n\nlemma Noninfluence_Noninfluence_strong:\n \"\\confidentiality_u; Noninfluence\\ \\ Noninfluence_strong\"\n apply(clarsimp simp: Noninfluence_def Noninfluence_strong_def)\n apply(frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n apply assumption+\n apply(frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n apply assumption+\n apply clarsimp\n apply(drule_tac x=u in spec)\n apply(frule_tac x=as in spec)\n apply(drule_tac x=s in spec, drule_tac x=t in spec)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=t in spec, drule_tac x=t in spec)\n apply clarsimp\n apply(rule_tac t=t in obs_equiv_trans)\n apply assumption\n apply assumption\n apply(rule obs_equiv_sym)\n apply(clarsimp simp: sameFor_dom_def uwr_refl)\n done\n\n\nlemma dom_in_sources_Cons:\n \"\\confidentiality_u; reachable s; reachable t;\n s \\(sources (a#as) s u)\\ t; s \\schedDomain\\ t;\n (dom a s \\ sources (a#as) s u)\\ \\ \n (dom a t \\ sources (a#as) t u)\"\n apply(subgoal_tac \"dom a s = dom a t\")\n apply(fastforce dest: sources_eq)\n apply(blast intro: schedIncludesCurrentDom)\n done\n\n\n\nlemma uwr_equiv_Cons_bothI:\n \"\\reachable s; reachable t;\n \\ s' t'. (s,s') \\ Step a \\ (t,t') \\ Step b \\ uwr_equiv s' as t' bs u\\ \\\n uwr_equiv s (a # as) t (b # bs) u\"\n apply(clarsimp simp: uwr_equiv_def)\n apply(clarsimp simp: execution_Run)\n apply(fastforce simp: execution_Run reachable_Step)\n done\n\nlemma uwr_equiv_Cons_leftI:\n \"\\reachable s; \\ s'. (s,s') \\ Step a \\ uwr_equiv s' as t bs u\\ \\\n uwr_equiv s (a # as) t bs u\"\n apply(fastforce simp: uwr_equiv_def execution_Run reachable_Step)\n done\n\n\nlemma notin_policyI':\n \"\\reachable s;\n dom a s \\ sources (a # list) s u; (s,s') \\ Step a; ua \\ sources list s' u\\ \\\n (dom a s,ua) \\ policy\"\n apply(rule notin_policyI)\n apply auto\n done\n\nlemma sources_eq_Step:\n \"\\integrity_u; confidentiality_u; reachable s; (s,s') \\ Step a; dom a s \\ schedDomain\\ \\\n (sources as s' u) = (sources as s u)\"\n apply(rule sources_eq, simp+)\n apply(rule_tac t=s and s=s and a=a in sched_equiv_preserved_left, (simp add: uwr_refl reachable_Step)+)\n done\n \nlemma sources_equiv_preserved_left:\n \"\\integrity_u; confidentiality_u; reachable s; reachable t; s \\schedDomain\\ t; \n dom a s \\ sources (a#as) s u; s \\sources (a#as) s u\\ t; (s,s') \\ Step a; dom a s \\ schedDomain\\ \\\n s' \\sources as s' u\\ t\"\n apply(clarsimp simp: sameFor_dom_def)\n apply(rename_tac v)\n apply(case_tac \"(dom a s, v) \\ policy\")\n apply(fastforce simp: sources_Cons)\n apply(fastforce dest: integrity_uD simp: sources_Cons)\n done\n\nlemma Noninfluence_gen:\n \"\\confidentiality_u; integrity_u\\ \\ Noninfluence_gen\"\n apply(subst Noninfluence_gen_def)\n apply(intro allI)\n proof -\n assume conf: \"confidentiality_u\"\n assume integ: \"integrity_u\"\n fix u as s ts\n show \"reachable s \\ Ball ts reachable \\\n Ball ts (sameFor_dom s (sources as s u)) \\ (\\t\\ts. s \\schedDomain\\ t) \\ (\\t\\ts. uwr_equiv s as t (ipurge u as ts) u)\"\n proof(induct as arbitrary: s ts)\n case Nil\n show ?case\n apply(clarsimp simp: sameFor_dom_def ipurge_Nil sources_Nil uwr_equiv_def)\n apply(clarsimp simp: execution_Run)\n done\n next\n case (Cons a as)\n show ?case\n apply(clarsimp simp: ipurge_Cons | safe)+\n apply(rule uwr_equiv_Cons_bothI)\n apply assumption\n apply blast\n apply(clarify)\n apply(rename_tac ta tb s' tb')\n apply(rule Cons.hyps[rule_format])\n apply(blast intro: reachable_Step)\n apply(clarsimp)\n apply(rename_tac tc' tc)\n using conf apply(rule_tac s=s and t=tc and a=a in sources_unwinding_step, simp+)[1]\n apply(clarsimp, rename_tac tc' tc)\n apply(rule sched_equiv_preserved[OF conf], (auto simp: sources_refl))[1]\n apply blast\n apply(rename_tac ta)\n apply(rule uwr_equiv_Cons_leftI, blast)\n apply(clarsimp, rename_tac s')\n apply(case_tac \"dom a s = schedDomain\")\n apply(cut_tac s=s and a=a and as=as and u=u in schedDomain_in_sources_Cons, assumption+)\n apply(metis schedIncludesCurrentDom sources_eq[OF conf])\n apply(rule Cons.hyps[rule_format])\n apply(blast intro: reachable_Step)\n apply(rename_tac tb)\n apply(rule_tac a=a in sources_equiv_preserved_left[OF integ conf], simp+)\n apply(fastforce simp: schedIncludesCurrentDom sources_eq[OF conf])\n apply blast\n apply assumption\n apply assumption\n apply(rule_tac s=s and a=a in sched_equiv_preserved_left[OF integ], simp+)\n done\n qed\n qed\n\nlemma Nonleakage_gen:\n \"\\confidentiality_u\\ \\ Nonleakage_gen\"\n apply(subst Nonleakage_gen_def)\n apply(rule allI) \n apply(induct_tac as)\n apply(simp add: sources_Nil uwr_equiv_def execution_Run sameFor_dom_def)\n apply(clarsimp)\n apply(rule uwr_equiv_Cons_bothI)\n apply assumption\n apply assumption\n apply clarsimp\n apply(drule_tac x=s' in spec, drule_tac x=u in spec, drule_tac x=t' in spec)\n apply(clarsimp simp: reachable_Step)\n apply(erule impE)\n apply(blast intro: sched_equiv_preserved)\n apply(erule mp)\n apply(blast intro: sources_unwinding_step)\n done\n \n\n\nlemma Noninterference:\n \"\\confidentiality_u_weak; output_consistent; integrity_u\\ \\ \n Noninterference\"\n apply(rule Noninfluence_gen_Noninterference)\n apply assumption\n apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n done\n\nlemma Noninterference_strong:\n \"\\confidentiality_u_weak; output_consistent; integrity_u\\ \\ \n Noninterference_strong\"\n apply(rule Noninfluence_gen_Noninterference_strong)\n apply assumption\n apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n done\n\n\n\nlemma Noninfluence:\n \"\\confidentiality_u_weak; output_consistent; integrity_u\\ \\ \n Noninfluence\"\n apply(rule Noninfluence_gen_Noninfluence)\n apply assumption\n apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n done\n\nlemma Noninfluence_strong:\n \"\\confidentiality_u_weak; output_consistent; integrity_u\\ \\ \n Noninfluence_strong\"\n apply(rule Noninfluence_Noninfluence_strong)\n apply(blast intro: confidentiality_u_weak)\n apply(blast intro: Noninfluence)\n done\n\n\nlemma Noninfluence_uwr:\n \"\\confidentiality_u_weak; integrity_u\\ \\ \n Noninfluence_uwr\"\n apply(rule Noninfluence_gen_Noninfluence_uwr)\n apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n done\n\nlemma Noninfluence_strong_uwr:\n \"\\confidentiality_u_weak; integrity_u\\ \\ \n Noninfluence_strong_uwr\"\n apply(rule Noninfluence_uwr_Noninfluence_strong_uwr)\n apply(blast intro: confidentiality_u_weak)\n apply(blast intro: Noninfluence_uwr)\n done\n\nlemma sources_Step:\n \"\\reachable s; (dom a s, u) \\ policy\\ \\\n sources [a] s u = {u}\"\n apply(auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n done\n\nlemma sources_Step_2:\n \"\\reachable s; (dom a s, u) \\ policy\\ \\\n sources [a] s u = {dom a s,u}\"\n apply(auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n done\n\nlemma execution_Nil:\n \"reachable s \\ execution A s [] = {s}\"\n apply(simp add: execution_Run)\n done\n\nlemma Noninfluence_gen_confidentiality_u_weak:\n \"Noninfluence_gen \\ confidentiality_u_weak\"\n apply(clarsimp simp: Noninfluence_gen_def confidentiality_u_weak_def)\n apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n apply(drule_tac x=s in spec, drule_tac x=\"{t}\" in spec)\n apply(simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def ipurge_Cons ipurge_Nil split: if_splits add: schedIncludesCurrentDom)\n done\n\nlemma Noninfluence_strong_uwr_confidentiality_u_weak:\n \"Noninfluence_strong_uwr \\ confidentiality_u_weak\"\n apply(clarsimp simp: Noninfluence_strong_uwr_def confidentiality_u_weak_def)\n apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[a]\" in spec)\n apply(drule_tac x=s in spec, drule_tac x=t in spec)\n apply(simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def)\n done\n\nlemma Nonleakage_gen_confidentiality_u:\n \"Nonleakage_gen \\ confidentiality_u\"\n apply(clarsimp simp: Nonleakage_gen_def confidentiality_u_def)\n apply(drule_tac x=\"[a]\" in spec, drule_tac x=s in spec)\n apply(drule_tac x=u in spec, drule_tac x=t in spec)\n apply(case_tac \"dom a s \\ u\")\n apply(simp add: sources_Step_2 uwr_equiv_def sameFor_dom_def Step_def)\n apply(simp add: sources_Step uwr_equiv_def sameFor_dom_def Step_def)\n done\n\nlemma Nonleakage_gen_equiv_confidentiality_u:\n \"Nonleakage_gen = confidentiality_u\"\n apply(blast intro: Nonleakage_gen_confidentiality_u Nonleakage_gen)\n done\n\nlemma non_sched_doms_cannot_schedule:\n \"\\integrity_u; reachable s; dom a s \\ schedDomain; (s,s') \\ Step a\\ \\ s \\schedDomain\\ s'\"\n apply(drule_tac u=schedDomain in integrity_uD)\n apply assumption\n apply(erule contrapos_nn)\n apply(erule schedNotGlobalChannel)\n apply(rule uwr_refl)\n apply assumption\n apply(erule uwr_sym)\n done\n\n\ntext {*\n In systems with just a single event, @{prop integrity_u} is a very strong\n condition. It implies that once the scheduler is not\n running, it can never run again.\n\n This is one explanation for why seL4 (whose automaton has only a single\n event) doesn't satisfy @{prop integrity_u}.\n*}\nlemma integrity_u_and_single_event_systems:\n \"\\integrity_u; reachable s; dom a s \\ schedDomain; s' \\ execution A s as;\n \\ y::'e. y = a\\ \\ dom e s' \\ schedDomain\"\n apply(frule_tac x=e in spec)\n apply(erule ssubst)\n apply(rule_tac P=\"\\x. x \\ schedDomain\" in subst[rotated])\n apply assumption\n apply(induct as arbitrary: s s' a rule: rev_induct)\n apply(simp add: execution_Run)\n apply(simp add: execution_Run)\n apply(drule Run_mid)\n apply(erule exE, rename_tac t)\n apply(drule_tac x=s in meta_spec)\n apply(drule_tac x=t in meta_spec)\n apply(drule_tac x=a in meta_spec)\n apply simp\n apply(rule schedIncludesCurrentDom)\n apply(rule non_sched_doms_cannot_schedule)\n apply assumption\n apply(rule reachable_execution)\n apply assumption\n apply(fastforce simp: execution_Run)\n apply assumption\n apply(drule_tac x=x in spec)\n apply blast\n done\n\nend\n\n\ntext {* The unwinding conditions are not only sound but also complete *}\nlocale complete_unwinding_system = unwinding_system +\n assumes policy_refl:\n \"(u,u) \\ policy\"\n\ncontext complete_unwinding_system begin\n\nlemma Noninfluence_gen_integrity_u:\n \"Noninfluence_gen \\ integrity_u\"\n apply(clarsimp simp: Noninfluence_gen_def integrity_u_def)\n apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n apply(drule_tac x=s in spec, drule_tac x=\"{s}\" in spec)\n apply(simp add: sources_Step sameFor_dom_def uwr_equiv_def Step_def ipurge_Cons ipurge_Nil split: if_splits add: uwr_refl policy_refl execution_Nil uwr_sym)\n done\n\n\nlemma Noninfluence_strong_uwr_integrity_u: \"Noninfluence_strong_uwr \\ integrity_u\"\n apply(clarsimp simp: Noninfluence_strong_uwr_def integrity_u_def)\n apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[]\" in spec)\n apply(drule_tac x=s in spec, drule_tac x=s in spec)\n apply(simp add: sources_Step sameFor_dom_def uwr_refl uwr_equiv_def Step_def ipurge_Cons ipurge_Nil split: if_splits)\n apply(simp add: policy_refl)\n apply(simp add: execution_Nil)\n apply(blast intro: uwr_sym)\n done\n\ntext {*\n @{prop Noninfluence_gen} actually turns out to be equivalent to @{prop Noninfluence_strong_uwr},\n when the policy is reflexive. So the two unwinding conditions for integrity\n and confidentiality actually turn out to be sound and sufficient for the\n condition we were using them to prove in the first place. \n*}\nlemma Noninfluence_gen_equiv_Noninfluence_strong_uwr:\n \"Noninfluence_gen = Noninfluence_strong_uwr\"\n apply(rule iffI)\n apply(rule Noninfluence_strong_uwr)\n apply(erule Noninfluence_gen_confidentiality_u_weak)\n apply(erule Noninfluence_gen_integrity_u)\n apply(rule Noninfluence_gen)\n apply(rule confidentiality_u_weak)\n apply(erule Noninfluence_strong_uwr_confidentiality_u_weak)\n apply(erule Noninfluence_strong_uwr_integrity_u)+\n done\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/infoflow/Noninterference_Base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.2517460651641145}} {"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: ClosureEx.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory ClosureEx\nimports \"../Vcg\" \"../Simpl_Heap\" Closure\nbegin\n\n\nrecord globals = \n cnt_' :: \"ref \\ nat\"\n alloc_' :: \"ref list\"\n free_' :: \"nat\"\nrecord 'g vars = \"'g state\" +\n p_':: ref\n r_':: nat\n n_':: nat\n m_':: nat\n c_':: \"(string \\ ref) list \\ string\"\n d_':: \"(string \\ ref) list \\ string\"\n e_':: \"(string \\ nat) list \\ string\"\n\n\ndefinition \"var\\<^sub>n = [''n''\\ (\\x. n_'_update (\\_. x)),\n ''m''\\ (\\x. m_'_update (\\_. x))]\"\ndefinition \"upd\\<^sub>n = gen_upd var\\<^sub>n\"\n\nlemma upd\\<^sub>n_ap: \"upd\\<^sub>n (fst (ap es (es',p))) = upd\\<^sub>n es' \\ upd\\<^sub>n es\"\n by (simp add: upd\\<^sub>n_def gen_upd_ap)\n\n\nlemma\n\"\\\\\\\\n=n\\<^sub>0 \\ (\\i j. \\\\ \\\\n=i \\ \\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=i + j\\)\\ \n \\e :== (ap [(''n'',\\n)] \\e) \n \\\\j. \\\\ \\\\m=j\\ callClosure upd\\<^sub>n \\e \\\\r=n\\<^sub>0 + j\\\\\"\napply vcg_step\napply clarify\napply (rule ap_closure [where var=var\\<^sub>n, folded upd\\<^sub>n_def])\napply clarsimp\napply (rename_tac s s')\napply (erule_tac x=\"n_' s\" in allE) \napply (erule_tac x=\"m_' s'\" in allE) \napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply (simp add: upd\\<^sub>n_def gen_upd_def var\\<^sub>n_def)\ndone\n\n\ndefinition \"var = [''p''\\ (\\x. p_'_update (\\_. x))]\"\ndefinition \"upd = gen_upd var\"\n\nprocedures Inc(p|r) =\n \"\\p\\\\cnt :== \\p\\\\cnt + 1;;\n \\r :== \\p\\\\cnt\"\n\nlemma (in Inc_impl)\n \"\\i p. \\\\ \\\\p\\\\cnt = i\\ \\r :== PROC Inc(\\p) \\\\r=i+1 \\ \\p\\\\cnt = i+1\\\"\n apply vcg\n apply simp\n done\n \nprocedures (imports Inc_signature) NewCounter(|c) =\n\"\\p :== NEW 1 [\\cnt :== 0];;\n \\c :== ([(''p'',\\p)],Inc_'proc)\" \n\n\nlocale NewCounter_impl' = NewCounter_impl + Inc_impl\nlemma (in NewCounter_impl')\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\n\nshows \n \"\\alloc. \\\\ \\1 \\ \\free\\ \\c :== PROC NewCounter() \n \\\\p. p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply simp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\nlemma (in NewCounter_impl')\nshows NewCounter_spec:\n \"\\alloc. \\\\ \\1 \\ \\free \\ \\alloc=alloc\\ \\c :== PROC NewCounter() \n \\\\p. p \\ set alloc \\ p \\ set \\alloc \\ p \\ Null \\ p\\\\cnt = 0 \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\"\napply vcg\napply clarsimp\napply (rule_tac x=\"new (set alloc)\" in exI)\napply simp\napply (simp add: callClosure_def)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply (simp add: upd_def var_def gen_upd_def)\ndone\n\n\n\nlemma \"\\\\\\\\p. p \\ Null \\ p\\\\cnt = i \\\n (\\i. \\\\ \\p\\\\cnt = i\\ callClosure upd \\c \\\\r=i+1 \\ p\\\\cnt = i+1\\)\\\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=i+1\\\"\napply (rule conseq_extract_pre)\napply clarify\napply (rule dynCallClosureFix)\napply (simp only: Ball_def)\nprefer 3\napply (assumption)\nprefer 2\napply vcg_step\napply vcg_step\napply (simp only: simp_thms)\napply clarsimp\ndone\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=1\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (erule_tac x=0 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply (assumption)\napply simp\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\));;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\r_' := r_' t\\))\n \\\\r=2\\\"\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\n\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\n\nlemma (in NewCounter_impl')\n shows \"\\\\ \\1 \\ \\free\\ \n \\c :== CALL NewCounter ();;\n \\d :== \\c;;\n dynCallClosure (\\s. s) upd c_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\n_' := r_' t\\));;\n dynCallClosure (\\s. s) upd d_' (\\s t. s\\globals := globals t\\) \n (\\s t. Basic (\\u. u\\m_' := r_' t\\));;\n \\r :== \\n + \\m\n \\\\r=3\\\"\n\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\nprefer 2\napply vcg_step\napply vcg_step\napply vcg_step\napply (rule dynCallClosure)\napply vcg_step\napply vcg_step\napply vcg_step\napply vcg_step\napply clarsimp\napply (subgoal_tac \"\\\\ \\p\\\\cnt = 0\\ callClosure upd (c_' t) \\\\r = Suc 0 \\ p\\\\cnt = Suc 0\\\")\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule_tac x=1 in allE)\napply (rule exI)\napply (rule exI)\napply (rule conjI)\napply assumption\napply clarsimp\napply (erule allE)\napply assumption\ndone\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/ex/ClosureEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073802837477, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2517028500839003}} {"text": "theory Impl_List_Playground_ChairNetwork\nimports \"../TopoS_Impl\"\nbegin\n\n\ntext{*An example of our chair network [simplified]*}\n\nabbreviation \"V\\TopoS_Vertices.V\"\n\ntext{*Our access control view on the network*}\n definition ChairNetwork_empty :: \"vString list_graph\" where\n \"ChairNetwork_empty \\ \\ nodesL = [V ''WebSrv'', V ''FilesSrv'', V ''PrinterBW'',\n V ''PrinterColor'', V ''Students'',\n V ''Employees'', V ''EReachable'',\n V ''Internet''],\n edgesL = [] \\\"\n \n lemma \"valid_list_graph ChairNetwork_empty\" by eval\n\n\nsubsection{*Our security requirements*}\n subsubsection{*We have a server with confidential data*}\n definition ConfidentialChairData::\"(vString SecurityInvariant)\" where\n \"ConfidentialChairData \\ new_configured_list_SecurityInvariant SINVAR_BLPtrusted_impl.SINVAR_LIB_BLPtrusted \\ \n node_properties = [V ''FilesSrv'' \\ \\ privacy_level = 1, trusted = False \\,\n V ''Employees'' \\ \\ privacy_level = 0, trusted = True \\,\n V ''EReachable'' \\ \\ privacy_level = 0, trusted = True \\], \n model_global_properties = () \n \\\"\n\n\n (*\n subsubsection{*We have a hierarchical printing policy*}\n definition \"PrintingHierarchy_nodes=[V ''Employees''\\ DN (''ColorPrinting''--Leaf, 0),\n V ''PrinterColor''\\ DN (''ColorPrinting''--''Printer''--Leaf, 0),\n V ''Students''\\ DN (''ColorPrinting''--''BwPrinting''--Leaf, 0),\n V ''PrinterBW''\\ DN (''ColorPrinting''--''BwPrinting''--''Printer''--Leaf, 0)]\"\n definition \"PrintingHierarchy_tree=Department ''ColorPrinting'' [\n Department ''Printer'' [], \n Department ''BwPrinting'' [\n Department ''Printer'' []]]\"\n definition PrintingHierarchy::\"vString SecurityInvariant\" where\n \"PrintingHierarchy \\ new_configured_list_SecurityInvariant SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\ \n node_properties = PrintingHierarchy_nodes,\n model_global_properties = PrintingHierarchy_tree\n \\\"\n \n --\"verify globals, I admit, not very elegant\"\n lemma \"nm_verify_globals SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG ChairNetwork_empty \n (nm_node_props SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\ node_properties = PrintingHierarchy_nodes, model_global_properties = PrintingHierarchy_tree \\) PrintingHierarchy_tree\" by eval\n *)\n subsubsection{* The color printer is only accessibly by employees, The black.white printer by employees and students*}\n definition \"PrintingACL \\ new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\ \n node_properties = [V ''PrinterColor'' \\ Master [V ''Employees'', V ''EReachable''],\n V ''PrinterBW'' \\ Master [V ''Employees'', V ''EReachable'', V ''Students''],\n V ''Employees'' \\ Care,\n V ''EReachable'' \\ Care,\n V ''Students'' \\ Care], \n model_global_properties = () \n \\\"\n\n subsubsection{* Printers are information sinks *}\n definition \"PrintingSink \\ new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\ \n node_properties = [V ''PrinterColor'' \\ Sink,\n V ''PrinterBW'' \\ Sink], \n model_global_properties = () \n \\\"\n\n\n\n subsubsection{*Students may access each other but are not accessible from the outside*}\n definition \"StudentSubnet \\ new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\ \n node_properties = [V ''Students'' \\ Member, V ''Employees'' \\ Member, V ''EReachable'' \\ InboundGateway], \n model_global_properties = () \n \\\"\n\n\n subsubsection{* The files server is only accessibly by employees*}\n definition \"FilesSrcACL \\ new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\ \n node_properties = [V ''FilesSrv'' \\ Master [V ''Employees'', V ''EReachable''],\n V ''Employees'' \\ Care,\n V ''EReachable'' \\ Care], \n model_global_properties = () \n \\\"\n\n\n subsubsection{*emplyees are reachable from the Internet*}\n (*nothing to do here*)\n\nlemma \"implc_sinvar ConfidentialChairData ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingACL ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingSink ChairNetwork_empty\" by eval\nlemma \"implc_sinvar StudentSubnet ChairNetwork_empty\" by eval\nlemma \"implc_sinvar FilesSrcACL ChairNetwork_empty\" by eval\n\ndefinition \"ChairSecurityRequirements = [ConfidentialChairData, PrintingACL, PrintingSink, StudentSubnet, FilesSrcACL]\"\n\nvalue \"implc_get_offending_flows ChairSecurityRequirements ChairNetwork_empty\"\nvalue \"generate_valid_topology ChairSecurityRequirements ChairNetwork_empty\"\n\nvalue \"List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty)\"\n\ndefinition \"ChairNetwork = generate_valid_topology ChairSecurityRequirements \n \\nodesL = nodesL ChairNetwork_empty, edgesL = List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty) \\\"\n\nlemma \"all_security_requirements_fulfilled ChairSecurityRequirements ChairNetwork\" by eval\n\nvalue \"ChairNetwork\"\n\nML_val{*\nvizualize_graph @{context} @{term \"ChairSecurityRequirements\"} @{term \"ChairNetwork\"};\n*}\n\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Examples/Impl_List_Playground_ChairNetwork.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2516885333360469}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ArraysMemInstance\nimports Arrays CompoundCTypes\nbegin\n\nprimrec\n array_tag_n :: \"nat \\ ('a::c_type,'b::finite) array typ_info\"\nwhere\n atn_base:\n \"array_tag_n 0 = ((empty_typ_info (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @\n nat_to_bin_string (CARD('b::finite))))::('a::c_type,'b) array\n typ_info)\"\n| atn_rec:\n \"array_tag_n (Suc n) = ((ti_typ_combine TYPE('a::c_type)\n (\\x. index x n) (\\x f. update f n x) (replicate n CHR ''1'')\n (array_tag_n n))::('a,'b::finite) array typ_info)\"\n\ndefinition\n array_tag :: \"('a::c_type,'b::finite) array itself \\ ('a,'b) array typ_info\" where\n \"array_tag t \\ array_tag_n (CARD('b))\"\n\ninstance array :: (c_type,finite) c_type ..\n\noverloading typ_info_array \\ typ_info_t begin\ndefinition\n typ_info_array: \"typ_info_array (w::('a::c_type,'b::finite) array itself) \\ array_tag w\"\nend\n\nlemma field_names_array_tag_length [rule_format]:\n \"x \\ set (field_names_list (array_tag_n n)) \\ length x < n\"\napply(induct_tac n)\n apply simp\napply clarsimp\ndone\n\nlemma replicate_mem_field_names_array_tag [simp]:\n \"replicate n x \\ set (field_names_list (array_tag_n n))\"\napply clarsimp\napply(drule field_names_array_tag_length)\napply simp\ndone\n\nlemma aggregate_array_tag [simp]:\n \"aggregate (array_tag_n n)\"\napply(case_tac n)\n apply simp+\ndone\n\nlemma wf_desc_array_tag [simp]:\n \"wf_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp+\napply(erule wf_desc_ti_typ_combine)\napply simp\ndone\n\nlemma wf_size_desc_array_tag [simp, rule_format]:\n \"0 < n \\ wf_size_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct n)\n apply simp+\napply(case_tac \"n=0\")\n apply simp\napply(rule wf_size_desc_ti_typ_combine)\napply simp\ndone\n\nlemma g_ind_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n g_ind (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule g_ind_ti_typ_combine)\n apply clarsimp+\ndone\n\nlemma fc_array_tag_udpate [simp]:\n \"n \\ m \\ n \\ CARD('b) \\\n fu_commutes (update_ti_t ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fc_ti_typ_combine)\n apply(clarsimp simp: fg_cons_def)\n apply clarsimp+\ndone\n\nlemma f_ind_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n f_ind (\\x. index x m) (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule f_ind_ti_typ_combine)\n apply clarsimp\napply simp\ndone\n\nlemma fa_fu_g_array_tag_udpate [simp, rule_format]:\n \"n \\ m \\ m < CARD('b) \\\n fa_ind (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\napply(induct_tac n)\n apply clarsimp+\napply(erule fa_ind_ti_typ_combine)\napply clarsimp+\ndone\n\nlemma wf_fdp_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\\n wf_lf (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\napply(induct_tac n)\n apply clarsimp+\napply(erule wf_lf_ti_typ_combine)\n apply simp+\ndone\n\nlemma upd_local_update [simp]:\n \"upd_local (\\x f. update f n x)\"\napply(auto simp: upd_local_def)\napply(subst cart_eq)\napply clarsimp\napply(subst (asm) cart_eq)\napply(drule_tac x=i in spec)\napply clarsimp\napply(case_tac \"i=n\")\n apply simp+\ndone\n\nlemma fu_eq_mask_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\ (\\m. (\\k v. k < CARD('b) \\\n index ((m v)::('a,'b) array) k = (if n \\ k then\n index (undefined::('a::mem_type,'b::finite) array) k\n else index v k)) \\ fu_eq_mask (array_tag_n n) m)\"\napply(induct n)\n apply clarsimp\n apply(rule fu_eq_mask_empty_typ_info)\n apply clarsimp\n apply(subst cart_eq)\n apply simp\napply clarsimp\napply(rule fu_eq_mask_ti_typ_combine)\n apply(drule_tac x=\"\\v. update (m v) n (index undefined n)\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(drule_tac x=k in spec)\n apply clarsimp\n apply(case_tac \"k=n\")\n apply simp\n apply clarsimp\n apply(subgoal_tac \"\\v bs. m (update v n bs) = update (m v) n bs\")\n apply clarsimp+\n apply(subst cart_eq)\n apply clarsimp\n apply(drule_tac x=i in spec)\n apply clarsimp\n apply(case_tac \"i=n\")\n apply clarsimp+\n apply(frule_tac x=\"update v n bs\" in spec)\n apply(drule_tac x=\"v\" in spec)\n apply clarsimp\n apply(case_tac \"Suc n \\ i\")\n apply clarsimp+\n apply(clarsimp simp: fg_cons_def)\n apply(clarsimp)\n apply simp\ndone\n\nlemma size_td_array_tag [simp]:\n \"size_td (((array_tag_n n)::('a,'b::finite) array typ_info)) =\n n * size_of TYPE('a::c_type)\"\napply(induct_tac n)\n apply simp\napply simp\napply(simp add: size_td_lt_ti_typ_combine size_of_def)\ndone\n\nlemma align_td_array_tag [rule_format]:\n \"0 < n \\ align_td ((array_tag_n n)::('a,'b::finite) array typ_info) = (align_td (typ_info_t (TYPE('a::c_type))))\"\napply(induct_tac n)\n apply simp\napply(clarsimp simp: ti_typ_combine_def Let_def)\napply(case_tac \"n = 0\")\n apply(clarsimp simp: align_of_def max_def)+\ndone\n\nlemma align_field_array [simp]:\n \"align_field ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply(erule align_field_ti_typ_combine)\napply simp\napply(rule dvd_mult)\napply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp add: align_of_def)\napply(rule align_size_of)\ndone\n\ninstance array :: (mem_type,finite) mem_type_sans_size\napply intro_classes\n apply(simp_all add: typ_info_array array_tag_def size_of_def\n norm_bytes_def)\n\n apply clarsimp\n apply(rule fu_eq_mask)\n apply(simp add: size_of_def)\n apply(rule fu_eq_mask_array_tag)\n apply simp+\n\napply(clarsimp simp: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp\napply(rule dvd_trans)\n apply(subgoal_tac \"align_of TYPE('a) dvd size_of TYPE('a)\")\n apply(simp only: align_of_def)\n apply(rule align_size_of)\napply(simp add: size_of_def)\ndone\n\ndeclare atn_base [simp del]\ndeclare atn_rec [simp del]\n\nlemma size_of_array [simp]:\n \"size_of TYPE(('a,'b::finite) array) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma size_td_array:\n \"size_td (typ_info_t TYPE(('a,'b::finite) array)) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma align_td_array:\n \"2^align_td (typ_info_t TYPE(('a,'b::finite) array)) = align_of TYPE('a::c_type)\"\napply(simp add: align_of_def typ_info_array array_tag_def)\napply(subst align_td_array_tag)\n apply simp+\ndone\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/umm_heap/ArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.2516457817108451}} {"text": "(* Title: HOL/Auth/TLS.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1997 University of Cambridge\n\nInductive relation \"tls\" for the TLS (Transport Layer Security) protocol.\nThis protocol is essentially the same as SSL 3.0.\n\nAbstracted from \"The TLS Protocol, Version 1.0\" by Tim Dierks and Christopher\nAllen, Transport Layer Security Working Group, 21 May 1997,\nINTERNET-DRAFT draft-ietf-tls-protocol-03.txt. Section numbers below refer\nto that memo.\n\nAn RSA cryptosystem is assumed, and X.509v3 certificates are abstracted down\nto the trivial form {A, publicKey(A)}privateKey(Server), where Server is a\nglobal signing authority.\n\nA is the client and B is the server, not to be confused with the constant\nServer, who is in charge of all public keys.\n\nThe model assumes that no fraudulent certificates are present, but it does\nassume that some private keys are to the spy.\n\nREMARK. The event \"Notes A \\Agent B, Nonce PMS\\\" appears in ClientKeyExch,\nCertVerify, ClientFinished to record that A knows M. It is a note from A to\nherself. Nobody else can see it. In ClientKeyExch, the Spy can substitute\nhis own certificate for A's, but he cannot replace A's note by one for himself.\n\nThe Note event avoids a weakness in the public-key model. Each\nagent's state is recorded as the trace of messages. When the true client (A)\ninvents PMS, he encrypts PMS with B's public key before sending it. The model\ndoes not distinguish the original occurrence of such a message from a replay.\nIn the shared-key model, the ability to encrypt implies the ability to\ndecrypt, so the problem does not arise.\n\nProofs would be simpler if ClientKeyExch included A's name within\nCrypt KB (Nonce PMS). As things stand, there is much overlap between proofs\nabout that message (which B receives) and the stronger event\nNotes A \\Agent B, Nonce PMS\\.\n*)\n\nsection\\The TLS Protocol: Transport Layer Security\\\n\ntheory TLS imports Public \"~~/src/HOL/Library/Nat_Bijection\" begin\n\ndefinition certificate :: \"[agent,key] => msg\" where\n \"certificate A KA == Crypt (priSK Server) \\Agent A, Key KA\\\"\n\ntext\\TLS apparently does not require separate keypairs for encryption and\nsignature. Therefore, we formalize signature as encryption using the\nprivate encryption key.\\\n\ndatatype role = ClientRole | ServerRole\n\nconsts\n (*Pseudo-random function of Section 5*)\n PRF :: \"nat*nat*nat => nat\"\n\n (*Client, server write keys are generated uniformly by function sessionK\n to avoid duplicating their properties. They are distinguished by a\n tag (not a bool, to avoid the peculiarities of if-and-only-if).\n Session keys implicitly include MAC secrets.*)\n sessionK :: \"(nat*nat*nat) * role => key\"\n\nabbreviation\n clientK :: \"nat*nat*nat => key\" where\n \"clientK X == sessionK(X, ClientRole)\"\n\nabbreviation\n serverK :: \"nat*nat*nat => key\" where\n \"serverK X == sessionK(X, ServerRole)\"\n\n\nspecification (PRF)\n inj_PRF: \"inj PRF\"\n \\\\the pseudo-random function is collision-free\\\n apply (rule exI [of _ \"%(x,y,z). prod_encode(x, prod_encode(y,z))\"])\n apply (simp add: inj_on_def prod_encode_eq)\n done\n\nspecification (sessionK)\n inj_sessionK: \"inj sessionK\"\n \\\\sessionK is collision-free; also, no clientK clashes with any serverK.\\\n apply (rule exI [of _ \n \"%((x,y,z), r). prod_encode(case_role 0 1 r, \n prod_encode(x, prod_encode(y,z)))\"])\n apply (simp add: inj_on_def prod_encode_eq split: role.split) \n done\n\naxiomatization where\n \\\\sessionK makes symmetric keys\\\n isSym_sessionK: \"sessionK nonces \\ symKeys\" and\n\n \\\\sessionK never clashes with a long-term symmetric key \n (they don't exist in TLS anyway)\\\n sessionK_neq_shrK [iff]: \"sessionK nonces \\ shrK A\"\n\n\ninductive_set tls :: \"event list set\"\n where\n Nil: \\\\The initial, empty trace\\\n \"[] \\ tls\"\n\n | Fake: \\\\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"[| evsf \\ tls; X \\ synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf \\ tls\"\n\n | SpyKeys: \\\\The spy may apply @{term PRF} and @{term sessionK}\n to available nonces\\\n \"[| evsSK \\ tls;\n {Nonce NA, Nonce NB, Nonce M} <= analz (spies evsSK) |]\n ==> Notes Spy \\ Nonce (PRF(M,NA,NB)),\n Key (sessionK((NA,NB,M),role))\\ # evsSK \\ tls\"\n\n | ClientHello:\n \\\\(7.4.1.2)\n PA represents \\CLIENT_VERSION\\, \\CIPHER_SUITES\\ and \\COMPRESSION_METHODS\\.\n It is uninterpreted but will be confirmed in the FINISHED messages.\n NA is CLIENT RANDOM, while SID is \\SESSION_ID\\.\n UNIX TIME is omitted because the protocol doesn't use it.\n May assume @{term \"NA \\ range PRF\"} because CLIENT RANDOM is \n 28 bytes while MASTER SECRET is 48 bytes\\\n \"[| evsCH \\ tls; Nonce NA \\ used evsCH; NA \\ range PRF |]\n ==> Says A B \\Agent A, Nonce NA, Number SID, Number PA\\\n # evsCH \\ tls\"\n\n | ServerHello:\n \\\\7.4.1.3 of the TLS Internet-Draft\n PB represents \\CLIENT_VERSION\\, \\CIPHER_SUITE\\ and \\COMPRESSION_METHOD\\.\n SERVER CERTIFICATE (7.4.2) is always present.\n \\CERTIFICATE_REQUEST\\ (7.4.4) is implied.\\\n \"[| evsSH \\ tls; Nonce NB \\ used evsSH; NB \\ range PRF;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsSH |]\n ==> Says B A \\Nonce NB, Number SID, Number PB\\ # evsSH \\ tls\"\n\n | Certificate:\n \\\\SERVER (7.4.2) or CLIENT (7.4.6) CERTIFICATE.\\\n \"evsC \\ tls ==> Says B A (certificate B (pubK B)) # evsC \\ tls\"\n\n | ClientKeyExch:\n \\\\CLIENT KEY EXCHANGE (7.4.7).\n The client, A, chooses PMS, the PREMASTER SECRET.\n She encrypts PMS using the supplied KB, which ought to be pubK B.\n We assume @{term \"PMS \\ range PRF\"} because a clash betweem the PMS\n and another MASTER SECRET is highly unlikely (even though\n both items have the same length, 48 bytes).\n The Note event records in the trace that she knows PMS\n (see REMARK at top).\\\n \"[| evsCX \\ tls; Nonce PMS \\ used evsCX; PMS \\ range PRF;\n Says B' A (certificate B KB) \\ set evsCX |]\n ==> Says A B (Crypt KB (Nonce PMS))\n # Notes A \\Agent B, Nonce PMS\\\n # evsCX \\ tls\"\n\n | CertVerify:\n \\\\The optional Certificate Verify (7.4.8) message contains the\n specific components listed in the security analysis, F.1.1.2.\n It adds the pre-master-secret, which is also essential!\n Checking the signature, which is the only use of A's certificate,\n assures B of A's presence\\\n \"[| evsCV \\ tls;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCV;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCV |]\n ==> Says A B (Crypt (priK A) (Hash\\Nonce NB, Agent B, Nonce PMS\\))\n # evsCV \\ tls\"\n\n \\\\Finally come the FINISHED messages (7.4.8), confirming PA and PB\n among other things. The master-secret is PRF(PMS,NA,NB).\n Either party may send its message first.\\\n\n | ClientFinished:\n \\\\The occurrence of \\Notes A \\Agent B, Nonce PMS\\\\ stops the\n rule's applying when the Spy has satisfied the \\Says A B\\ by\n repaying messages sent by the true client; in that case, the\n Spy does not know PMS and could not send ClientFinished. One\n could simply put @{term \"A\\Spy\"} into the rule, but one should not\n expect the spy to be well-behaved.\\\n \"[| evsCF \\ tls;\n Says A B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsCF;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCF;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCF;\n M = PRF(PMS,NA,NB) |]\n ==> Says A B (Crypt (clientK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsCF \\ tls\"\n\n | ServerFinished:\n \\\\Keeping A' and A'' distinct means B cannot even check that the\n two messages originate from the same source.\\\n \"[| evsSF \\ tls;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsSF;\n Says B A \\Nonce NB, Number SID, Number PB\\ \\ set evsSF;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSF;\n M = PRF(PMS,NA,NB) |]\n ==> Says B A (Crypt (serverK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsSF \\ tls\"\n\n | ClientAccepts:\n \\\\Having transmitted ClientFinished and received an identical\n message encrypted with serverK, the client stores the parameters\n needed to resume this session. The \"Notes A ...\" premise is\n used to prove \\Notes_master_imp_Crypt_PMS\\.\\\n \"[| evsCA \\ tls;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCA;\n M = PRF(PMS,NA,NB);\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\;\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evsCA;\n Says B' A (Crypt (serverK(NA,NB,M)) X) \\ set evsCA |]\n ==>\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ # evsCA \\ tls\"\n\n | ServerAccepts:\n \\\\Having transmitted ServerFinished and received an identical\n message encrypted with clientK, the server stores the parameters\n needed to resume this session. The \"Says A'' B ...\" premise is\n used to prove \\Notes_master_imp_Crypt_PMS\\.\\\n \"[| evsSA \\ tls;\n A \\ B;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSA;\n M = PRF(PMS,NA,NB);\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\;\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evsSA;\n Says A' B (Crypt (clientK(NA,NB,M)) X) \\ set evsSA |]\n ==>\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ # evsSA \\ tls\"\n\n | ClientResume:\n \\\\If A recalls the \\SESSION_ID\\, then she sends a FINISHED\n message using the new nonces and stored MASTER SECRET.\\\n \"[| evsCR \\ tls;\n Says A B \\Agent A, Nonce NA, Number SID, Number PA\\: set evsCR;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCR;\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evsCR |]\n ==> Says A B (Crypt (clientK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsCR \\ tls\"\n\n | ServerResume:\n \\\\Resumption (7.3): If B finds the \\SESSION_ID\\ then he can \n send a FINISHED message using the recovered MASTER SECRET\\\n \"[| evsSR \\ tls;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\: set evsSR;\n Says B A \\Nonce NB, Number SID, Number PB\\ \\ set evsSR;\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evsSR |]\n ==> Says B A (Crypt (serverK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\)) # evsSR\n \\ tls\"\n\n | Oops:\n \\\\The most plausible compromise is of an old session key. Losing\n the MASTER SECRET or PREMASTER SECRET is more serious but\n rather unlikely. The assumption @{term \"A\\Spy\"} is essential: \n otherwise the Spy could learn session keys merely by \n replaying messages!\\\n \"[| evso \\ tls; A \\ Spy;\n Says A B (Crypt (sessionK((NA,NB,M),role)) X) \\ set evso |]\n ==> Says A Spy (Key (sessionK((NA,NB,M),role))) # evso \\ tls\"\n\n(*\nProtocol goals:\n* M, serverK(NA,NB,M) and clientK(NA,NB,M) will be known only to the two\n parties (though A is not necessarily authenticated).\n\n* B upon receiving CertVerify knows that A is present (But this\n message is optional!)\n\n* A upon receiving ServerFinished knows that B is present\n\n* Each party who has received a FINISHED message can trust that the other\n party agrees on all message components, including PA and PB (thus foiling\n rollback attacks).\n*)\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\ntext\\Automatically unfold the definition of \"certificate\"\\\ndeclare certificate_def [simp]\n\ntext\\Injectiveness of key-generating functions\\\ndeclare inj_PRF [THEN inj_eq, iff]\ndeclare inj_sessionK [THEN inj_eq, iff]\ndeclare isSym_sessionK [simp]\n\n\n(*** clientK and serverK make symmetric keys; no clashes with pubK or priK ***)\n\nlemma pubK_neq_sessionK [iff]: \"publicKey b A \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare pubK_neq_sessionK [THEN not_sym, iff]\n\nlemma priK_neq_sessionK [iff]: \"invKey (publicKey b A) \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare priK_neq_sessionK [THEN not_sym, iff]\n\nlemmas keys_distinct = pubK_neq_sessionK priK_neq_sessionK\n\n\nsubsection\\Protocol Proofs\\\n\ntext\\Possibility properties state that some traces run the protocol to the\nend. Four paths and 12 rules are considered.\\\n\n\n(** These proofs assume that the Nonce_supply nonces\n (which have the form @ N. Nonce N \\ used evs)\n lie outside the range of PRF. It seems reasonable, but as it is needed\n only for the possibility theorems, it is not taken as an axiom.\n**)\n\n\ntext\\Possibility property ending with ClientAccepts.\\\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\SID M. \\evs \\ tls.\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ClientFinished, THEN tls.ServerFinished,\n THEN tls.ClientAccepts], possibility, blast+)\ndone\n\n\ntext\\And one for ServerAccepts. Either FINISHED message may come first.\\\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\SID NA PA NB PB M. \\evs \\ tls.\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ServerFinished, THEN tls.ClientFinished, \n THEN tls.ServerAccepts], possibility, blast+)\ndone\n\n\ntext\\Another one, for CertVerify (which is optional)\\\nlemma \"[| \\evs. (@ N. Nonce N \\ used evs) \\ range PRF; A \\ B |]\n ==> \\NB PMS. \\evs \\ tls.\n Says A B (Crypt (priK A) (Hash\\Nonce NB, Agent B, Nonce PMS\\)) \n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.CertVerify], possibility, blast+)\ndone\n\n\ntext\\Another one, for session resumption (both ServerResume and ClientResume).\n NO tls.Nil here: we refer to a previous session, not the empty trace.\\\nlemma \"[| evs0 \\ tls;\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs0;\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs0;\n \\evs. (@ N. Nonce N \\ used evs) \\ range PRF;\n A \\ B |]\n ==> \\NA PA NB PB X. \\evs \\ tls.\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\ &\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evs &\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.ClientHello\n [THEN tls.ServerHello,\n THEN tls.ServerResume, THEN tls.ClientResume], possibility, blast+)\ndone\n\n\nsubsection\\Inductive proofs about tls\\\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\ntext\\Spy never sees a good agent's private key!\\\nlemma Spy_see_priK [simp]:\n \"evs \\ tls ==> (Key (privateKey b A) \\ parts (spies evs)) = (A \\ bad)\"\nby (erule tls.induct, force, simp_all, blast)\n\nlemma Spy_analz_priK [simp]:\n \"evs \\ tls ==> (Key (privateKey b A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_priK_D [dest!]:\n \"[|Key (privateKey b A) \\ parts (knows Spy evs); evs \\ tls|] ==> A \\ bad\"\nby (blast dest: Spy_see_priK)\n\n\ntext\\This lemma says that no false certificates exist. One might extend the\n model to include bogus certificates for the agents, but there seems\n little point in doing so: the loss of their private keys is a worse\n breach of security.\\\nlemma certificate_valid:\n \"[| certificate B KB \\ parts (spies evs); evs \\ tls |] ==> KB = pubK B\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast) \ndone\n\nlemmas CX_KB_is_pubKB = Says_imp_spies [THEN parts.Inj, THEN certificate_valid]\n\n\nsubsubsection\\Properties of items found in Notes\\\n\nlemma Notes_Crypt_parts_spies:\n \"[| Notes A \\Agent B, X\\ \\ set evs; evs \\ tls |]\n ==> Crypt (pubK B) X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, \n frule_tac [7] CX_KB_is_pubKB, force, simp_all)\napply (blast intro: parts_insertI)\ndone\n\ntext\\C may be either A or B\\\nlemma Notes_master_imp_Crypt_PMS:\n \"[| Notes C \\s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))\\ \\ set evs;\n evs \\ tls |]\n ==> Crypt (pubK B) (Nonce PMS) \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\Client, Server Accept\\\napply (blast dest!: Notes_Crypt_parts_spies)+\ndone\n\ntext\\Compared with the theorem above, both premise and conclusion are stronger\\\nlemma Notes_master_imp_Notes_PMS:\n \"[| Notes A \\s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))\\ \\ set evs;\n evs \\ tls |]\n ==> Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\ServerAccepts\\\napply blast\ndone\n\n\nsubsubsection\\Protocol goal: if B receives CertVerify, then A sent it\\\n\ntext\\B can check A's signature if he has received A's certificate.\\\nlemma TrustCertVerify_lemma:\n \"[| X \\ parts (spies evs);\n X = Crypt (priK A) (Hash\\nb, Agent B, pms\\);\n evs \\ tls; A \\ bad |]\n ==> Says A B X \\ set evs\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext\\Final version: B checks X using the distributed KA instead of priK A\\\nlemma TrustCertVerify:\n \"[| X \\ parts (spies evs);\n X = Crypt (invKey KA) (Hash\\nb, Agent B, pms\\);\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Says A B X \\ set evs\"\nby (blast dest!: certificate_valid intro!: TrustCertVerify_lemma)\n\n\ntext\\If CertVerify is present then A has chosen PMS.\\\nlemma UseCertVerify_lemma:\n \"[| Crypt (priK A) (Hash\\nb, Agent B, Nonce PMS\\) \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext\\Final version using the distributed KA instead of priK A\\\nlemma UseCertVerify:\n \"[| Crypt (invKey KA) (Hash\\nb, Agent B, Nonce PMS\\)\n \\ parts (spies evs);\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad |]\n ==> Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\nby (blast dest!: certificate_valid intro!: UseCertVerify_lemma)\n\n\nlemma no_Notes_A_PRF [simp]:\n \"evs \\ tls ==> Notes A \\Agent B, Nonce (PRF x)\\ \\ set evs\"\napply (erule tls.induct, force, simp_all)\ntxt\\ClientKeyExch: PMS is assumed to differ from any PRF.\\\napply blast\ndone\n\n\nlemma MS_imp_PMS [dest!]:\n \"[| Nonce (PRF (PMS,NA,NB)) \\ parts (spies evs); evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\Easy, e.g. by freshness\\\napply (blast dest: Notes_Crypt_parts_spies)+\ndone\n\n\n\n\nsubsubsection\\Unicity results for PMS, the pre-master-secret\\\n\ntext\\PMS determines B.\\\nlemma Crypt_unique_PMS:\n \"[| Crypt(pubK B) (Nonce PMS) \\ parts (spies evs);\n Crypt(pubK B') (Nonce PMS) \\ parts (spies evs);\n Nonce PMS \\ analz (spies evs);\n evs \\ tls |]\n ==> B=B'\"\napply (erule rev_mp, erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra, force, simp_all (no_asm_simp))\ntxt\\Fake, ClientKeyExch\\\napply blast+\ndone\n\n\n(** It is frustrating that we need two versions of the unicity results.\n But Notes A \\Agent B, Nonce PMS\\ determines both A and B. Sometimes\n we have only the weaker assertion Crypt(pubK B) (Nonce PMS), which\n determines B alone, and only if PMS is secret.\n**)\n\ntext\\In A's internal Note, PMS determines A and B.\\\nlemma Notes_unique_PMS:\n \"[| Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Notes A' \\Agent B', Nonce PMS\\ \\ set evs;\n evs \\ tls |]\n ==> A=A' & B=B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: Notes_Crypt_parts_spies)\ndone\n\n\nsubsection\\Secrecy Theorems\\\n\ntext\\Key compromise lemma needed to prove @{term analz_image_keys}.\n No collection of keys can help the spy get new private keys.\\\nlemma analz_image_priK [rule_format]:\n \"evs \\ tls\n ==> \\KK. (Key(priK B) \\ analz (Key`KK Un (spies evs))) =\n (priK B \\ KK | B \\ bad)\"\napply (erule tls.induct)\napply (simp_all (no_asm_simp)\n del: image_insert\n add: image_Un [THEN sym]\n insert_Key_image Un_assoc [THEN sym])\ntxt\\Fake\\\napply spy_analz\ndone\n\n\ntext\\slightly speeds up the big simplification below\\\nlemma range_sessionkeys_not_priK:\n \"KK <= range sessionK ==> priK B \\ KK\"\nby blast\n\n\ntext\\Lemma for the trivial direction of the if-and-only-if\\\nlemma analz_image_keys_lemma:\n \"(X \\ analz (G Un H)) --> (X \\ analz H) ==>\n (X \\ analz (G Un H)) = (X \\ analz H)\"\nby (blast intro: analz_mono [THEN subsetD])\n\n(** Strangely, the following version doesn't work:\n\\Z. (Nonce N \\ analz (Key`(sessionK`Z) Un (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\n**)\n\nlemma analz_image_keys [rule_format]:\n \"evs \\ tls ==>\n \\KK. KK <= range sessionK -->\n (Nonce N \\ analz (Key`KK Un (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (safe del: iffI)\napply (safe del: impI iffI intro!: analz_image_keys_lemma)\napply (simp_all (no_asm_simp) (*faster*)\n del: image_insert imp_disjL (*reduces blow-up*)\n add: image_Un [THEN sym] Un_assoc [THEN sym]\n insert_Key_singleton\n range_sessionkeys_not_priK analz_image_priK)\napply (simp_all add: insert_absorb)\ntxt\\Fake\\\napply spy_analz\ndone\n\ntext\\Knowing some session keys is no help in getting new nonces\\\nlemma analz_insert_key [simp]:\n \"evs \\ tls ==>\n (Nonce N \\ analz (insert (Key (sessionK z)) (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\nby (simp del: image_insert\n add: insert_Key_singleton analz_image_keys)\n\n\nsubsubsection\\Protocol goal: serverK(Na,Nb,M) and clientK(Na,Nb,M) remain secure\\\n\n(** Some lemmas about session keys, comprising clientK and serverK **)\n\n\ntext\\Lemma: session keys are never used if PMS is fresh.\n Nonces don't have to agree, allowing session resumption.\n Converse doesn't hold; revealing PMS doesn't force the keys to be sent.\n THEY ARE NOT SUITABLE AS SAFE ELIM RULES.\\\nlemma PMS_lemma:\n \"[| Nonce PMS \\ parts (spies evs);\n K = sessionK((Na, Nb, PRF(PMS,NA,NB)), role);\n evs \\ tls |]\n ==> Key K \\ parts (spies evs) & (\\Y. Crypt K Y \\ parts (spies evs))\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB) \napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\SpyKeys\\\napply blast\ntxt\\Many others\\\napply (force dest!: Notes_Crypt_parts_spies Notes_master_imp_Crypt_PMS)+\ndone\n\nlemma PMS_sessionK_not_spied:\n \"[| Key (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) \\ parts (spies evs);\n evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\nlemma PMS_Crypt_sessionK_not_spied:\n \"[| Crypt (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) Y\n \\ parts (spies evs); evs \\ tls |]\n ==> Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\ntext\\Write keys are never sent if M (MASTER SECRET) is secure.\n Converse fails; betraying M doesn't force the keys to be sent!\n The strong Oops condition can be weakened later by unicity reasoning,\n with some effort.\n NO LONGER USED: see \\clientK_not_spied\\ and \\serverK_not_spied\\\\\nlemma sessionK_not_spied:\n \"[| \\A. Says A Spy (Key (sessionK((NA,NB,M),role))) \\ set evs;\n Nonce M \\ analz (spies evs); evs \\ tls |]\n ==> Key (sessionK((NA,NB,M),role)) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake, SpyKeys\\\napply blast+\ndone\n\n\ntext\\If A sends ClientKeyExch to an honest B, then the PMS will stay secret.\\\nlemma Spy_not_see_PMS:\n \"[| Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Nonce PMS \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply spy_analz\ntxt\\SpyKeys\\\napply force\napply (simp_all add: insert_absorb) \ntxt\\ClientHello, ServerHello, ClientKeyExch: mostly freshness reasoning\\\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\ntxt\\ClientAccepts and ServerAccepts: because @{term \"PMS \\ range PRF\"}\\\napply force+\ndone\n\n\ntext\\If A sends ClientKeyExch to an honest B, then the MASTER SECRET\n will stay secret.\\\nlemma Spy_not_see_MS:\n \"[| Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Nonce (PRF(PMS,NA,NB)) \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply spy_analz\ntxt\\SpyKeys: by secrecy of the PMS, Spy cannot make the MS\\\napply (blast dest!: Spy_not_see_PMS)\napply (simp_all add: insert_absorb)\ntxt\\ClientAccepts and ServerAccepts: because PMS was already visible;\n others, freshness etc.\\\napply (blast dest: Notes_Crypt_parts_spies Spy_not_see_PMS \n Notes_imp_knows_Spy [THEN analz.Inj])+\ndone\n\n\n\nsubsubsection\\Weakening the Oops conditions for leakage of clientK\\\n\ntext\\If A created PMS then nobody else (except the Spy in replays)\n would send a message using a clientK generated from that PMS.\\\nlemma Says_clientK_unique:\n \"[| Says A' B' (Crypt (clientK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A' \\ Spy |]\n ==> A = A'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ClientFinished, ClientResume: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Notes_PMS \n intro: Notes_unique_PMS [THEN conjunct1])+\ndone\n\n\ntext\\If A created PMS and has not leaked her clientK to the Spy,\n then it is completely secure: not even in parts!\\\nlemma clientK_not_spied:\n \"[| Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Says A Spy (Key (clientK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad;\n evs \\ tls |]\n ==> Key (clientK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\ClientKeyExch\\\napply blast \ntxt\\SpyKeys\\\napply (blast dest!: Spy_not_see_MS)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_sessionK_not_spied)\ntxt\\Oops\\\napply (blast intro: Says_clientK_unique)\ndone\n\n\nsubsubsection\\Weakening the Oops conditions for leakage of serverK\\\n\ntext\\If A created PMS for B, then nobody other than B or the Spy would\n send a message using a serverK generated from that PMS.\\\nlemma Says_serverK_unique:\n \"[| Says B' A' (Crypt (serverK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad; B' \\ Spy |]\n ==> B = B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ServerResume, ServerFinished: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\ntext\\If A created PMS for B, and B has not leaked his serverK to the Spy,\n then it is completely secure: not even in parts!\\\nlemma serverK_not_spied:\n \"[| Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Says B Spy (Key(serverK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad; evs \\ tls |]\n ==> Key (serverK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply blast \ntxt\\SpyKeys\\\napply (blast dest!: Spy_not_see_MS)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_sessionK_not_spied)\ntxt\\Oops\\\napply (blast intro: Says_serverK_unique)\ndone\n\n\nsubsubsection\\Protocol goals: if A receives ServerFinished, then B is present\n and has used the quoted values PA, PB, etc. Note that it is up to A\n to compare PA with what she originally sent.\\\n\ntext\\The mention of her name (A) in X assures A that B knows who she is.\\\nlemma TrustServerFinished [rule_format]:\n \"[| X = Crypt (serverK(Na,Nb,M))\n (Hash\\Number SID, Nonce M,\n Nonce Na, Number PA, Agent A,\n Nonce Nb, Number PB, Agent B\\);\n M = PRF(PMS,NA,NB);\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs -->\n Notes A \\Agent B, Nonce PMS\\ \\ set evs -->\n X \\ parts (spies evs) --> Says B A X \\ set evs\"\napply (erule ssubst)+\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: serverK_not_spied)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ndone\n\ntext\\This version refers not to ServerFinished but to any message from B.\n We don't assume B has received CertVerify, and an intruder could\n have changed A's identity in all other messages, so we can't be sure\n that B sends his message to A. If CLIENT KEY EXCHANGE were augmented\n to bind A's identity with PMS, then we could replace A' by A below.\\\nlemma TrustServerMsg [rule_format]:\n \"[| M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs -->\n Notes A \\Agent B, Nonce PMS\\ \\ set evs -->\n Crypt (serverK(Na,Nb,M)) Y \\ parts (spies evs) -->\n (\\A'. Says B A' (Crypt (serverK(Na,Nb,M)) Y) \\ set evs)\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp) add: ex_disj_distrib)\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: serverK_not_spied)\ntxt\\ClientKeyExch\\\napply (clarify, blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ServerResume, ServerFinished: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\nsubsubsection\\Protocol goal: if B receives any message encrypted with clientK\n then A has sent it\\\n\ntext\\ASSUMING that A chose PMS. Authentication is\n assumed here; B cannot verify it. But if the message is\n ClientFinished, then B can then check the quoted values PA, PB, etc.\\\n\nlemma TrustClientMsg [rule_format]:\n \"[| M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs -->\n Notes A \\Agent B, Nonce PMS\\ \\ set evs -->\n Crypt (clientK(Na,Nb,M)) Y \\ parts (spies evs) -->\n Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: clientK_not_spied)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ClientFinished, ClientResume: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Notes_PMS dest: Notes_unique_PMS)+\ndone\n\n\nsubsubsection\\Protocol goal: if B receives ClientFinished, and if B is able to\n check a CertVerify from A, then A has used the quoted\n values PA, PB, etc. Even this one requires A to be uncompromised.\\\nlemma AuthClientFinished:\n \"[| M = PRF(PMS,NA,NB);\n Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs;\n Says A' B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs;\n certificate A KA \\ parts (spies evs);\n Says A'' B (Crypt (invKey KA) (Hash\\nb, Agent B, Nonce PMS\\))\n \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad |]\n ==> Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\nby (blast intro!: TrustClientMsg UseCertVerify)\n\n(*22/9/97: loads in 622s, which is 10 minutes 22 seconds*)\n(*24/9/97: loads in 672s, which is 11 minutes 12 seconds [stronger theorems]*)\n(*29/9/97: loads in 481s, after removing Certificate from ClientKeyExch*)\n(*30/9/97: loads in 476s, after removing unused theorems*)\n(*30/9/97: loads in 448s, after fixing ServerResume*)\n\n(*08/9/97: loads in 189s (pike), after much reorganization,\n back to 621s on albatross?*)\n\n(*10/2/99: loads in 139s (pike)\n down to 433s on albatross*)\n\n(*5/5/01: conversion to Isar script\n loads in 137s (perch)\n the last ML version loaded in 122s on perch, a 600MHz machine:\n twice as fast as pike. No idea why it's so much slower!\n The Isar script is slower still, perhaps because simp_all simplifies\n the assumptions be default.\n*)\n\n(*20/11/11: loads in 5.8s elapses time, 9.3s CPU time on dual-core laptop*)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/TLS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7217432182679956, "lm_q2_score": 0.3486451353339458, "lm_q1q2_score": 0.2516322620094029}} {"text": "section \\Computations of PiCore Language\\\n\ntheory PiCore_Computation\nimports PiCore_Semantics\nbegin\n\nsubsection \\Environment transitions\\\n\nlocale event_comp = event ptran petran fin_com\nfor ptran :: \"'Env \\ (('s,'prog) pconf \\ ('s,'prog) pconf) set\" \nand petran :: \"'Env \\ ('s,'prog) pconf \\ ('s,'prog) pconf \\ bool\" (\"_ \\ _ -pe\\ _\" [81,81,81] 80)\nand fin_com :: \"'prog\"\n+\nfixes cpts_p :: \"'Env \\ ('s,'prog) pconfs set\"\nfixes cpts_of_p :: \"'Env \\ 'prog \\ 's \\ (('s,'prog) pconfs) set\"\n(*assumes cpts_p_simps:\n \"((\\P s. aa = [(P, s)]) \\\n (\\P t xs s. aa = (P, s) # (P, t) # xs \\ \\ \\ (P, s) -pe\\ (P, t) \\ (P, t) # xs \\ cpts_p \\) \\\n (\\P s Q t xs. aa = (P, s) # (Q, t) # xs \\ \\ \\ (P, s) -c\\ (Q, t) \\ (Q, t) # xs \\ cpts_p \\)) \\ (aa \\ cpts_p \\)\"*)\nassumes cpts_p_simps:\n \"((\\P s. aa = [(P, s)]) \\\n (\\P t xs s. aa = (P, s) # (P, t) # xs \\ (P, t) # xs \\ cpts_p \\) \\\n (\\P s Q t xs. aa = (P, s) # (Q, t) # xs \\ \\ \\ (P, s) -c\\ (Q, t) \\ (Q, t) # xs \\ cpts_p \\)) \\ (aa \\ cpts_p \\)\"\nassumes cptn_not_empty [simp]:\"[] \\ cpts_p \\\" \n(* assumes cpts_of_p_def: \"cpts_of_p \\ P s \\ {l. l!0=(P,s) \\ l \\ cpts_p \\}\" *)\nassumes cpts_of_p_def: \"l!0 = (P,s) \\ l \\ cpts_p \\ \\ l \\ cpts_of_p \\ P s\" \n\nbegin\n\nlemma CptsPOne: \"[(P,s)] \\ cpts_p \\\" \n using cpts_p_simps[of \"[(P,s)]\" \\] by auto\n\nlemma CptsPEnv: \"(P, t)#xs \\ cpts_p \\ \\ (P,s)#(P,t)#xs \\ cpts_p \\\" \n using cpts_p_simps[of \"(P, s) # (P, t) # xs\" \\] by auto\n \nlemma CptsPComp: \"\\\\ \\ (P,s) -c\\ (Q,t); (Q, t)#xs \\ cpts_p \\\\ \\ (P,s)#(Q,t)#xs \\ cpts_p \\\"\n using cpts_p_simps[of \"(P, s) # (Q, t) # xs\" \\ ] by auto\n\nsubsection \\Sequential computations\\\n\nsubsubsection \\Sequential computations of programs\\\n\n(*\nlemma cptn_not_empty [simp]:\"[] \\ cpts_p \\\" using cpts_p_simps by blast \n*)\n\ninductive\n eetran :: \"'Env \\ ('l,'k,'s,'prog) econf \\ ('l,'k,'s,'prog) econf \\ bool\" (\"_ \\ _ -ee\\ _\" [81,81,81] 80)\nfor \\ :: 'Env\nwhere (*EnvEP: \"\\ \\ (P, s) -pe\\ (P, t) \\ \\ \\ (P, s, x) -ee\\ (P, t, x)\" | (* simulate env tran of program*)\n EnvEE: \"\\ \\ (P, s, x) -ee\\ (P, s, y)\" (* simulate event entry *)*)\n EnvE: \"\\ \\ (P, s, x) -ee\\ (P, t, y)\"\n\nlemma eetranE: \"\\ \\ p -ee\\ p' \\ (\\P s t. p = (P, s) \\ p' = (P, t) \\ Q) \\ Q\"\n by (induct p, induct p', erule eetran.cases, blast)\n\ninductive\n esetran :: \"'Env \\ ('l,'k,'s,'prog) esconf \\ ('l,'k,'s,'prog) esconf \\ bool\" (\"_ \\ _ -ese\\ _\" [81,81,81] 80)\nwhere\n EnvES: \"\\ \\ (P, s, x) -ese\\ (P, t, y)\"\n\nlemma esetranE: \"\\ \\ p -ese\\ p' \\ (\\P s t. p = (P, s) \\ p' = (P, t) \\ Q) \\ Q\"\n by (induct p, induct p', erule esetran.cases, blast)\n\ninductive\n pesetran :: \"'Env \\ ('l,'k,'s,'prog) pesconf \\ ('l,'k,'s,'prog) pesconf \\ bool\" (\"_ \\ _ -pese\\ _\" [81,81,81] 80)\nwhere\n EnvPES: \"\\ \\ (P, s, x) -pese\\ (P, t, y)\"\n\nlemma pesetranE: \"\\ \\ p -pese\\ p' \\ (\\P s t. p = (P, s) \\ p' = (P, t) \\ Q) \\ Q\"\n by (induct p, induct p', erule pesetran.cases, blast)\n\nsubsubsection \\Sequential computations of events\\\n\ninductive_set cpts_ev :: \"'Env \\ ('l,'k,'s,'prog) econfs set\"\nfor \\ :: 'Env\nwhere\n CptsEvOne: \"[(e,s,x)] \\ cpts_ev \\\"\n| CptsEvEnv: \"(e, t, x)#xs \\ cpts_ev \\ \\ (e, s, y)#(e, t, x)#xs \\ cpts_ev \\\"\n| CptsEvComp: \"\\\\ \\ (e1,s,x) -et-ct\\ (e2,t,y); (e2,t,y)#xs \\ cpts_ev \\\\ \\ (e1,s,x)#(e2,t,y)#xs \\ cpts_ev \\\"\n\ndefinition cpts_of_ev :: \"'Env \\ ('l,'k,'s,'prog) event \\ 's \\ ('l,'k,'s,'prog) x \\ ('l,'k,'s,'prog) econfs set\" where\n \"cpts_of_ev \\ ev s x \\ {l. l!0=(ev,(s,x)) \\ l \\ cpts_ev \\}\" \n\nsubsubsection \\Sequential computations of event systems\\\n\ninductive_set cpts_es :: \"'Env \\ ('l,'k,'s,'prog) esconfs set\"\nfor \\ :: 'Env\nwhere\n CptsEsOne: \"[(es,s,x)] \\ cpts_es \\\"\n| CptsEsEnv: \"(es, t, x)#xs \\ cpts_es \\ \\ (es, s, y)#(es, t, x)#xs \\ cpts_es \\\"\n| CptsEsComp: \"\\\\ \\ (es1,s,x) -es-ct\\ (es2,t,y); (es2,t,y)#xs \\ cpts_es \\\\ \\ (es1,s,x)#(es2,t,y)#xs \\ cpts_es \\\"\n\ndefinition cpts_of_es :: \"'Env \\ ('l,'k,'s,'prog) esys \\ 's \\ ('l,'k,'s,'prog) x \\ ('l,'k,'s,'prog) esconfs set\" where\n \"cpts_of_es \\ es s x \\ {l. l!0=(es,s,x) \\ l \\ cpts_es \\}\" \n\nsubsubsection \\Sequential computations of par event systems\\\n\n\ninductive_set cpts_pes :: \"'Env \\ ('l,'k,'s,'prog) pesconfs set\"\nfor \\ :: 'Env\nwhere\n CptsPesOne: \"[(pes,s,x)] \\ cpts_pes \\\"\n| CptsPesEnv: \"(pes, t, x)#xs \\ cpts_pes \\ \\ (pes, s, y)#(pes, t, x)#xs \\ cpts_pes \\\"\n| CptsPesComp: \"\\\\ \\ (pes1,s,x) -pes-ct\\ (pes2,t,y); (pes2,t,y)#xs \\ cpts_pes \\\\ \\ (pes1,s,x)#(pes2,t,y)#xs \\ cpts_pes \\\"\n\ndefinition cpts_of_pes :: \"'Env \\ ('l,'k,'s,'prog) paresys \\ 's \\ ('l,'k,'s,'prog) x \\ ('l,'k,'s,'prog) pesconfs set\" where\n \"cpts_of_pes \\ pes s x \\ {l. l!0=(pes,s,x) \\ l \\ cpts_pes \\}\" \n\nsubsection \\Lemmas\\\n(*\nsubsubsection \\Programs\\\n\nlemma tl_in_cptn: \"\\ a#xs \\cpts_p \\; xs\\[] \\ \\ xs\\cpts_p \\\"\n by (force elim: cpts_p.cases)\n\nlemma tl_zero[rule_format]: \n \"P (ys!Suc j) \\ Suc j ys\\[] \\ P (tl(ys)!j)\"\n by (induct ys) simp_all\n*)\n\nsubsubsection \\Events\\\n\nlemma cpts_e_not_empty [simp]:\"[] \\ cpts_ev \\\"\napply(force elim:cpts_ev.cases)\ndone\n\nlemma eetran_eqconf: \"\\ \\ (e1, s1, x1) -ee\\ (e2, s2, x2) \\ e1 = e2\"\n apply(rule eetran.cases)\n apply(simp)+\n done\n\nlemma eetran_eqconf1: \"\\ \\ ec1 -ee\\ ec2 \\ getspc_e ec1 = getspc_e ec2\"\n proof -\n assume a0: \"\\ \\ ec1 -ee\\ ec2\"\n then obtain e1 and s1 and x1 and e2 and s2 and x2 where a1: \"ec1 = (e1, s1, x1)\" and a2: \"ec2 = (e2, s2, x2)\"\n by (meson prod_cases3) \n then have \"e1 = e2\" using a0 eetran_eqconf by fastforce \n with a1 show ?thesis by (simp add: a2 getspc_e_def) \n qed\n\nlemma eqconf_eetran1: \"e1 = e2 \\ \\ \\ (e1, s1, x1) -ee\\ (e2, s2, x2)\"\n by (simp add: eetran.intros) \n\nlemma eqconf_eetran: \"getspc_e ec1 = getspc_e ec2 \\ \\ \\ ec1 -ee\\ ec2\" \n proof -\n assume \"getspc_e ec1 = getspc_e ec2\"\n then show ?thesis using getspc_e_def eetran.EnvE by (metis eq_fst_iff)\n qed\n\n\nlemma cpts_ev_sub0: \"\\el \\ cpts_ev \\; Suc 0 < length el\\ \\ drop (Suc 0) el \\ cpts_ev \\\"\n apply(rule cpts_ev.cases)\n apply(simp)+\n done \n\nlemma cpts_ev_subi: \"\\el \\ cpts_ev \\; Suc i < length el\\ \\ drop (Suc i) el \\ cpts_ev \\\"\n proof -\n assume p0:\"el \\ cpts_ev \\\" and p1:\"Suc i < length el\"\n have \"\\el i. el \\ cpts_ev \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_ev \\\"\n proof -\n {\n fix el i\n have \"el \\ cpts_ev \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_ev \\\"\n proof(induct i)\n case 0 show ?case by (simp add: cpts_ev_sub0) \n next\n case (Suc j)\n assume b0: \"el \\ cpts_ev \\ \\ Suc j < length el \\ drop (Suc j) el \\ cpts_ev \\\"\n show ?case\n proof\n assume c0: \"el \\ cpts_ev \\ \\ Suc (Suc j) < length el\"\n with b0 have c1: \"drop (Suc j) el \\ cpts_ev \\\"\n by (simp add: c0 Suc_lessD) \n then show \"drop (Suc (Suc j)) el \\ cpts_ev \\\"\n using c0 cpts_ev_sub0 by fastforce \n qed\n qed\n }\n then show ?thesis by auto\n qed\n with p0 p1 show ?thesis by auto\n qed\n \nlemma notran_confeq0: \"\\el \\ cpts_ev \\; Suc 0 < length el; \\ (\\t. \\ \\ el ! 0 -et-t\\ el ! 1)\\\n \\ getspc_e (el ! 0) = getspc_e (el ! 1)\"\n apply(simp)\n apply(rule cpts_ev.cases)\n apply(simp)+\n apply(simp add:getspc_e_def)+\n done\n\nlemma notran_confeqi: \"\\el \\ cpts_ev \\; Suc i < length el; \\ (\\t. \\ \\ el ! i -et-t\\ el ! Suc i)\\\n \\ getspc_e (el ! i) = getspc_e (el ! (Suc i))\"\n proof -\n assume p0: \"el \\ cpts_ev \\\" and\n p1: \"Suc i < length el\" and\n p2: \"\\ (\\t. \\ \\ el ! i -et-t\\ el ! Suc i)\"\n have \"\\el i. el \\ cpts_ev \\ \\ Suc i < length el \\ \\ (\\t. \\ \\ el ! i -et-t\\ el ! Suc i)\n \\ getspc_e (el ! i) = getspc_e (el ! (Suc i))\"\n proof -\n {\n fix el i\n assume a0: \"el \\ cpts_ev \\ \\ Suc i < length el \\ \\ (\\t. \\ \\ el ! i -et-t\\ el ! Suc i)\"\n then have \"getspc_e (el ! i) = getspc_e (el ! (Suc i))\"\n proof(induct i)\n case 0 then show ?case\n using notran_confeq0 by (metis One_nat_def)\n next\n case (Suc j)\n let ?subel = \"drop (Suc j) el\"\n assume b0: \"el \\ cpts_ev \\ \\ Suc (Suc j) < length el \\ \\ (\\t. \\ \\ el ! Suc j -et-t\\ el ! Suc (Suc j))\" \n then have b1: \"?subel \\ cpts_ev \\\" by (simp add: Suc_lessD b0 cpts_ev_subi) \n from b0 have b2: \"Suc 0 < length ?subel\" by auto \n from b0 have b3: \"\\ (\\t. \\ \\ ?subel ! 0 -et-t\\ ?subel ! 1)\" by auto\n with b1 b2 have b3: \"getspc_e (?subel ! 0) = getspc_e (?subel ! 1)\"\n using notran_confeq0 by blast\n then show ?case\n by (metis Cons_nth_drop_Suc One_nat_def Suc_lessD b0 nth_Cons_0 nth_Cons_Suc) \n qed\n }\n then show ?thesis by auto\n qed\n with p0 p1 p2 show ?thesis by auto\n qed\n\nlemma cpts_ev_onemore: \"\\el \\ cpts_ev \\; length el > 0; \\ \\ el ! (length el - 1) -et-t\\ ec\\ \\\n el @ [ec] \\ cpts_ev \\\"\n proof -\n assume p0: \"el \\ cpts_ev \\\"\n and p1: \"length el > 0\"\n and p2: \"\\ \\ el ! (length el - 1) -et-t\\ ec\"\n\n have \"\\el ec t \\. el \\ cpts_ev \\ \\ length el > 0 \\ \\ \\ el ! (length el - 1) -et-t\\ ec \\ el @ [ec] \\ cpts_ev \\\"\n proof -\n {\n fix el ec t \\\n assume a0: \"el \\ cpts_ev \\\"\n and a1: \"length el > 0\"\n and a2: \"\\ \\ el ! (length el - 1) -et-t\\ ec\"\n from a0 a1 a2 have \"el @ [ec] \\ cpts_ev \\\"\n proof(induct el)\n case (CptsEvOne e s x) \n assume b0: \"\\ \\ [(e, s, x)] ! (length [(e, s, x)] - 1) -et-t\\ ec\"\n then have \"\\ \\ (e, s, x) -et-t\\ ec\" by simp\n then show ?case by (metis append_Cons append_Nil cpts_ev.CptsEvComp \n cpts_ev.CptsEvOne surj_pair) \n next\n case (CptsEvEnv e s1 x xs s2 y)\n assume b0: \"(e, s1, x) # xs \\ cpts_ev \\\"\n and b1: \"0 < length ((e, s1, x) # xs) \\\n \\ \\ ((e, s1, x) # xs) ! (length ((e, s1, x) # xs) - 1) -et-t\\ ec \n \\ ((e, s1, x) # xs) @ [ec] \\ cpts_ev \\\"\n and b2: \"0 < length ((e, s2, y) # (e, s1, x) # xs)\"\n and b3: \"\\ \\ ((e, s2, y) # (e, s1, x) # xs) ! (length ((e, s2, y) # (e, s1, x) # xs) - 1) -et-t\\ ec\"\n then show ?case \n proof(cases \"xs = []\")\n assume c0: \"xs = []\"\n with b3 have \"\\ \\ (e, s1, x)-et-t\\ ec\" by simp\n with b1 c0 have \"((e, s1, x) # xs) @ [ec] \\ cpts_ev \\\" by simp\n then show ?thesis by (simp add: cpts_ev.CptsEvEnv) \n next\n assume c0: \"xs \\ []\"\n with b3 have \"\\ \\ last xs -et-t\\ ec\" by (simp add: last_conv_nth) \n with b1 c0 have \"((e, s1, x) # xs) @ [ec] \\ cpts_ev \\\" using b3 by auto\n then show ?thesis by (simp add: cpts_ev.CptsEvEnv) \n qed\n next\n case (CptsEvComp e1 s1 x1 et e2 t1 y1 xs1)\n assume b0: \"\\ \\ (e1, s1, x1) -et-et\\ (e2, t1, y1)\"\n and b1: \"(e2, t1, y1) # xs1 \\ cpts_ev \\\"\n and b2: \"0 < length ((e2, t1, y1) # xs1) \\\n \\ \\ ((e2, t1, y1) # xs1) ! (length ((e2, t1, y1) # xs1) - 1) -et-t\\ ec \n \\ ((e2, t1, y1) # xs1) @ [ec] \\ cpts_ev \\\"\n and b3: \"0 < length ((e1, s1, x1) # (e2, t1, y1) # xs1)\"\n and b4: \"\\ \\ ((e1, s1, x1) # (e2, t1, y1) # xs1) ! (length ((e1, s1, x1) # (e2, t1, y1) # xs1) - 1) -et-t\\ ec\"\n then show ?case \n proof(cases \"xs1 = []\")\n assume c0: \"xs1 = []\"\n with b4 have \"\\ \\ (e2, t1, y1)-et-t\\ ec\" by simp\n with b2 c0 have \"((e2, t1, y1) # xs1) @ [ec] \\ cpts_ev \\\" by simp\n with b0 show ?thesis using cpts_ev.CptsEvComp by fastforce \n next\n assume c0: \"xs1 \\ []\"\n with b4 have \"\\ \\ last xs1 -et-t\\ ec\" by (simp add: last_conv_nth)\n with b2 c0 have \"((e2, t1, y1) # xs1) @ [ec] \\ cpts_ev \\\" using b4 by auto \n then show ?thesis using b0 cpts_ev.CptsEvComp by fastforce \n qed\n qed\n }\n then show ?thesis by auto\n qed\n\n then show \"el @ [ec] \\ cpts_ev \\\" using p0 p1 p2 by blast \n qed\n\nlemma cpts_ev_same: \"\\length el > 0; \\i. i < length el \\ getspc_e (el!i) = es\\ \\ el \\ cpts_ev \\\"\n proof -\n assume p0: \"length el > 0\"\n and p1: \"\\i. i < length el \\ getspc_e (el!i) = es\"\n have \"\\el es. length el > 0 \\ (\\i. i < length el \\ getspc_e (el!i) = es) \\ el \\ cpts_ev \\\"\n proof -\n {\n fix el es\n assume a0: \"length (el :: ('l,'k,'s,'prog) econfs) > 0\"\n and a1: \"\\i. i < length el \\ getspc_e (el!i) = es\"\n then have \"el \\ cpts_ev \\\"\n proof(induct el)\n case Nil show ?case using Nil.prems(1) by auto \n next\n case (Cons a as)\n assume b0: \"0 < length as \\ \\i as \\ cpts_ev \\\"\n and b1: \"0 < length (a # as)\"\n and b2: \"\\i(as = [])\"\n then obtain b and bs where c1: \"as = b # bs\" by (meson neq_Nil_conv) \n from c0 have \"0 < length as\" by simp\n with b0 have \"\\i as \\ cpts_ev \\\" by simp\n with b2 have \"as \\ cpts_ev \\\" by force\n moreover from b2 have \"getspc_e a = es\" by auto\n moreover from b2 c1 have \"getspc_e b = es\" by auto\n ultimately show ?thesis using c1 getspc_e_def by (metis cpts_ev.CptsEvEnv fst_conv prod_cases3) \n qed\n qed\n }\n then show ?thesis by auto\n qed\n\n then show ?thesis using p0 p1 by auto\n qed\n\nsubsubsection \\Event systems\\\n\n\nlemma cpts_es_not_empty [simp]:\"[] \\ cpts_es \\\"\napply(force elim:cpts_es.cases)\ndone\n\n\nlemma esetran_eqconf: \"\\ \\ (es1, s1, x1) -ese\\ (es2, s2, x2) \\ es1 = es2\"\n apply(rule esetran.cases)\n apply(simp)+\n done\n\nlemma esetran_eqconf1: \"\\ \\ esc1 -ese\\ esc2 \\ getspc_es esc1 = getspc_es esc2\"\n proof -\n assume a0: \"\\ \\ esc1 -ese\\ esc2\"\n then obtain es1 and s1 and x1 and es2 and s2 and x2 where a1: \"esc1 = (es1, s1, x1)\" and a2: \"esc2 = (es2, s2, x2)\"\n by (meson prod_cases3) \n then have \"es1 = es2\" using a0 esetran_eqconf by fastforce \n with a1 show ?thesis by (simp add: a2 getspc_es_def) \n qed\n\nlemma eqconf_esetran1: \"es1 = es2 \\ \\ \\ (es1, s1, x1) -ese\\ (es2, s2, x2)\"\n by (simp add: esetran.intros) \n\n\nlemma eqconf_esetran: \"getspc_es esc1 = getspc_es esc2 \\ \\ \\ esc1 -ese\\ esc2\" \n proof -\n assume a0: \"getspc_es esc1 = getspc_es esc2\"\n (*then show ?thesis using getspc_es_def esetran.EnvES by (metis eq_fst_iff)*)\n obtain es1 and s1 and x1 where a1: \"esc1 = (es1, s1, x1)\" using prod_cases3 by blast \n obtain es2 and s2 and x2 where a2: \"esc2 = (es2, s2, x2)\" using prod_cases3 by blast \n with a0 a1 have \"es1 = es2\" by (simp add:getspc_es_def)\n with a1 a2 have a3: \"\\ \\ (es1, s1, x1) -ese\\ (es2, s2, x2)\" by (simp add:eqconf_esetran1)\n from a3 a1 a2 show ?thesis by simp\n qed\n\nlemma exist_estran: \"\\(es1, s1, x1) # (es, s, x) # esl \\ cpts_es \\; es1 \\ es\\ \\ (\\est. \\ \\ (es1, s1, x1) -es-est\\ (es, s, x))\"\n apply(rule cpts_es.cases)\n apply(simp)+\n by auto\n\nlemma cpts_es_drop0: \"\\el \\ cpts_es \\; Suc 0 < length el\\ \\ drop (Suc 0) el \\ cpts_es \\\"\n apply(rule cpts_es.cases)\n apply(simp)+\n done \n\nlemma cpts_es_dropi: \"\\el \\ cpts_es \\; Suc i < length el\\ \\ drop (Suc i) el \\ cpts_es \\\"\n proof -\n assume p0:\"el \\ cpts_es \\\" and p1:\"Suc i < length el\"\n have \"\\el i. el \\ cpts_es \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_es \\\"\n proof -\n {\n fix el i\n have \"el \\ cpts_es \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_es \\\"\n proof(induct i)\n case 0 show ?case by (simp add: cpts_es_drop0) \n next\n case (Suc j)\n assume b0: \"el \\ cpts_es \\ \\ Suc j < length el \\ drop (Suc j) el \\ cpts_es \\\"\n show ?case\n proof\n assume c0: \"el \\ cpts_es \\ \\ Suc (Suc j) < length el\"\n with b0 have c1: \"drop (Suc j) el \\ cpts_es \\\"\n by (simp add: c0 Suc_lessD) \n then show \"drop (Suc (Suc j)) el \\ cpts_es \\\"\n using c0 cpts_es_drop0 by fastforce \n qed\n qed\n }\n then show ?thesis by auto\n qed\n with p0 p1 show ?thesis by auto\n qed\n\n\nlemma cpts_es_dropi2: \"\\el \\ cpts_es \\; i < length el\\ \\ drop i el \\ cpts_es \\\"\n using cpts_es_dropi by (metis (no_types, hide_lams) drop_0 lessI less_Suc_eq_0_disj) \n\nlemma cpts_es_take0: \"\\el \\ cpts_es \\; i < length el; el1 = take (Suc i) el; j < length el1\\ \n \\ drop (length el1 - Suc j) el1 \\ cpts_es \\\"\n proof -\n assume p0: \"el \\ cpts_es \\\"\n and p1: \"i < length el\"\n and p2: \"el1 = take (Suc i) el\"\n and p3: \"j < length el1\"\n have \"\\i j. el \\ cpts_es \\ \\ i < length el \\ el1 = take (Suc i) el \\ j < length el1 \n \\ drop (length el1 - Suc j) el1 \\ cpts_es \\\"\n proof -\n {\n fix i j\n assume a0: \"el \\ cpts_es \\\"\n and a1: \"i < length el\"\n and a2: \"el1 = take (Suc i) el\"\n and a3: \"j < length el1\"\n then have \"drop (length el1 - Suc j) el1 \\ cpts_es \\\"\n proof(induct j)\n case 0 \n have \"drop (length el1 - Suc 0) el1 = [el ! i]\"\n by (simp add: a1 a2 take_Suc_conv_app_nth) \n then show ?case by (metis cpts_es.CptsEsOne old.prod.exhaust) \n next\n case (Suc jj)\n assume b0: \"el \\ cpts_es \\ \\ i < length el \\ el1 = take (Suc i) el \n \\ jj < length el1 \\ drop (length el1 - Suc jj) el1 \\ cpts_es \\\"\n and b1: \"el \\ cpts_es \\\"\n and b2: \"i < length el\"\n and b3: \"el1 = take (Suc i) el\"\n and b4: \"Suc jj < length el1\"\n then have b5: \"drop (length el1 - Suc jj) el1 \\ cpts_es \\\"\n using Suc_lessD by blast \n let ?el2 = \"drop (Suc i) el\"\n from a2 have b6: \"el1 @ ?el2 = el\" by simp\n let ?el1sht = \"drop (length el1 - Suc jj) el1\"\n let ?el1lng = \"drop (length el1 - Suc (Suc jj)) el1\"\n let ?elsht = \"drop (length el1 - Suc jj) el\"\n let ?ellng = \"drop (length el1 - Suc (Suc jj)) el\"\n from b6 have a7: \"?el1sht @ ?el2 = ?elsht\"\n by (metis diff_is_0_eq diff_le_self drop_0 drop_append) \n from b6 have a8: \"?el1lng @ ?el2 = ?ellng\"\n by (metis (no_types, lifting) a7 append_eq_append_conv diff_is_0_eq' diff_le_self drop_append) \n have a9: \"?ellng = (el ! (length el1 - Suc (Suc jj))) # ?elsht\"\n by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_diff_Suc Suc_leI a8 \n append_is_Nil_conv b4 diff_diff_cancel drop_all length_drop \n list.size(3) not_less old.nat.distinct(2)) \n from b1 b4 have a10: \"?elsht \\ cpts_es \\\"\n by (metis a7 append_is_Nil_conv b5 cpts_es_dropi2 drop_all not_less)\n from b1 b4 have a11: \"?ellng \\ cpts_es \\\"\n by (metis a9 cpts_es_dropi2 drop_all list.simps(3) not_less)\n have a12: \"?el1lng = (el ! (length el1 - Suc (Suc jj))) # ?el1sht\"\n by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_diff_Suc \n b4 b6 diff_less gr_implies_not0 length_0_conv length_greater_0_conv \n nth_append zero_less_Suc)\n from a11 have \"?el1lng \\ cpts_es \\\"\n proof(induct ?ellng)\n case CptsEsOne show ?case\n using CptsEsOne.hyps a7 a9 by auto \n next\n case (CptsEsEnv es1 t1 x1 xs1 s1 y1)\n assume c0: \"(es1, t1, x1) # xs1 \\ cpts_es \\\"\n and c1: \"(es1, t1, x1) # xs1 = drop (length el1 - Suc (Suc jj)) el \\\n drop (length el1 - Suc (Suc jj)) el1 \\ cpts_es \\\"\n and c2: \"(es1, s1, y1) # (es1, t1, x1) # xs1 = drop (length el1 - Suc (Suc jj)) el\"\n from c0 have \"(es1, s1, y1) # (es1, t1, x1) # xs1 \\ cpts_es \\\"\n by (simp add: a11 c2) \n have c3: \"?el1sht ! 0 = (es1, t1, x1)\" by (metis (no_types, lifting) Suc_leI Suc_lessD a7 \n a9 append_eq_Cons_conv b4 c2 diff_diff_cancel length_drop list.inject \n list.size(3) nth_Cons_0 old.nat.distinct(2)) \n then have c4: \"\\el1sht'. ?el1sht = (es1, t1, x1) # el1sht'\" by (metis Cons_nth_drop_Suc b4 \n diff_diff_cancel drop_0 length_drop less_or_eq_imp_le zero_less_Suc) \n have c5: \"?el1lng = (es1, s1, y1) # ?el1sht\" using a12 a9 c2 by auto \n \n with b5 c4 show ?case using cpts_es.CptsEsEnv by fastforce \n next\n case (CptsEsComp es1 s1 x1 et es2 t1 y1 xs1)\n assume c0: \"\\ \\ (es1, s1, x1) -es-et\\ (es2, t1, y1)\"\n and c1: \"(es2, t1, y1) # xs1 \\ cpts_es \\\"\n and c2: \"(es2, t1, y1) # xs1 = drop (length el1 - Suc (Suc jj)) el \n \\ drop (length el1 - Suc (Suc jj)) el1 \\ cpts_es \\\"\n and c3: \"(es1, s1, x1) # (es2, t1, y1) # xs1 = drop (length el1 - Suc (Suc jj)) el\"\n have c4: \"?el1sht ! 0 = (es2, t1, y1)\" by (metis (no_types, lifting) Suc_leI Suc_lessD a7 \n a9 append_eq_Cons_conv b4 c3 diff_diff_cancel length_drop list.inject \n list.size(3) nth_Cons_0 old.nat.distinct(2)) \n then have c5: \"\\el1sht'. ?el1sht = (es2, t1, y1) # el1sht'\" by (metis Cons_nth_drop_Suc b4 \n diff_diff_cancel drop_0 length_drop less_or_eq_imp_le zero_less_Suc) \n have c6: \"?el1lng = (es1, s1, x1) # ?el1sht\" using a12 a9 c3 by auto\n with b5 c5 show ?case using c0 cpts_es.CptsEsComp by fastforce \n qed\n\n then show ?case by simp\n qed\n }\n then show ?thesis by auto\n qed\n then show \"drop (length el1 - Suc j) el1 \\ cpts_es \\\"\n using p0 p1 p2 p3 by blast \n qed\n\n\nlemma cpts_es_take: \"\\el \\ cpts_es \\; i < length el\\ \\ take (Suc i) el \\ cpts_es \\\"\n using cpts_es_take0 gr_implies_not0 by fastforce\n\nlemma cpts_es_seg: \"\\el \\ cpts_es \\; m \\ length el; n \\ length el; m < n\\ \n \\ take (n - m) (drop m el) \\ cpts_es \\\"\n proof -\n assume p0: \"el \\ cpts_es \\\"\n and p1: \"m \\ length el\"\n and p2: \"n \\ length el\"\n and p3: \"m < n\"\n then have \"drop m el \\ cpts_es \\\" \n using cpts_es_dropi by (metis (no_types, lifting) drop_0 le_0_eq le_SucE less_le_trans zero_induct) \n then show ?thesis using cpts_es_take\n by (metis (no_types, lifting) cpts_es_dropi2 drop_take inc_induct \n leD le_SucE length_take min.absorb2 p0 p1 p2 p3)\n qed\n\nlemma cpts_es_seg2: \"\\el \\ cpts_es \\; m \\ length el; n \\ length el; take (n - m) (drop m el) \\ []\\ \n \\ take (n - m) (drop m el) \\ cpts_es \\\"\n proof -\n assume p0: \"el \\ cpts_es \\\"\n and p1: \"m \\ length el\"\n and p2: \"n \\ length el\"\n and p3: \"take (n - m) (drop m el) \\ []\"\n from p3 have \"m < n\" by simp\n then show ?thesis using cpts_es_seg using p0 p1 p2 by blast\n qed\n\nlemma cpts_es_same: \"\\length el > 0; \\i. i < length el \\ getspc_es (el!i) = es\\ \\ el \\ cpts_es \\\"\n proof -\n assume p0: \"length el > 0\"\n and p1: \"\\i. i < length el \\ getspc_es (el!i) = es\"\n have \"\\el es. length el > 0 \\ (\\i. i < length el \\ getspc_es (el!i) = es) \\ el \\ cpts_es \\\"\n proof -\n {\n fix el es\n assume a0: \"length (el :: ('l,'k,'s,'prog) esconf list) > 0\"\n and a1: \"\\i. i < length el \\ getspc_es (el!i) = es\"\n then have \"el \\ cpts_es \\\"\n proof(induct el)\n case Nil show ?case using Nil.prems(1) by auto \n next\n case (Cons a as)\n assume b0: \"0 < length as \\ \\i as \\ cpts_es \\\"\n and b1: \"0 < length (a # as)\"\n and b2: \"\\i(as = [])\"\n then obtain b and bs where c1: \"as = b # bs\" by (meson neq_Nil_conv) \n from c0 have \"0 < length as\" by simp\n with b0 have \"\\i as \\ cpts_es \\\" by simp\n with b2 have \"as \\ cpts_es \\\" by force\n moreover from b2 have \"getspc_es a = es\" by auto\n moreover from b2 c1 have \"getspc_es b = es\" by auto\n ultimately show ?thesis using c1 getspc_es_def by (metis cpts_es.CptsEsEnv fst_conv prod_cases3) \n qed\n qed\n }\n then show ?thesis by auto\n qed\n\n then show ?thesis using p0 p1 by auto\n qed\n\n\nlemma noevtent_inmid_eq: \n \"(\\ (\\j. j > 0 \\ Suc j < length esl \\ getspc_es (esl ! j) = EvtSys es \\ getspc_es (esl ! Suc j) \\ EvtSys es))\n = (\\j. j > 0 \\ Suc j < length esl \\ getspc_es (esl ! j) = EvtSys es \\ getspc_es (esl ! Suc j) = EvtSys es)\"\n by blast\n\nlemma evtseq_next_in_cpts:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ getspc_es (esl!i) = EvtSeq e esys\n \\ getspc_es (esl!Suc i) = esys \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e esys)\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n then show ?thesis\n proof -\n {\n fix i\n assume a0: \"Suc i < length esl\"\n and a1: \"getspc_es (esl!i) = EvtSeq e esys\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 have \"getspc_es (?esl1!0) = EvtSeq e esys\" by auto \n then obtain s1 and x1 where a3: \"?esl1!0 = (EvtSeq e esys,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a1 have \"getspc_es (?esl1!1) = esys \\ (\\e. getspc_es (?esl1!1) = EvtSeq e esys)\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = drop i esl\"\n and b1: \"getspc_es (esl ! i) = EvtSeq e esys\"\n then have \"es' = EvtSeq e esys\" using getspc_es_def by (metis a3 fst_conv nth_Cons_0)\n with b0 have \"getspc_es (drop i esl ! 1) = EvtSeq e esys\" using getspc_es_def\n by (metis One_nat_def fst_conv nth_Cons_0 nth_Cons_Suc) \n then show ?case by auto\n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (esl ! i) = EvtSeq e esys\"\n then have b3: \"es1' = EvtSeq e esys\" \n by (metis Pair_inject a3 nth_Cons_0)\n from b0 b3 have \"es2' = esys \\ (\\e. es2' = EvtSeq e esys)\" \n using evtseq_tran_sys_or_seq by simp\n with b1 show ?case using getspc_es_def\n by (metis One_nat_def fst_conv nth_Cons_0 nth_Cons_Suc) \n \n qed\n\n then have \"getspc_es (esl!Suc i) = esys \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e esys)\"\n using a0 by fastforce\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma evtseq_next_in_cpts_anony:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ getspc_es (esl!i) = EvtSeq e esys \\ is_anonyevt e\n \\ getspc_es (esl!Suc i) = esys \n \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e esys \\ is_anonyevt e)\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n then show ?thesis\n proof -\n {\n fix i\n assume a0: \"Suc i < length esl\"\n and a1: \"getspc_es (esl!i) = EvtSeq e esys \\ is_anonyevt e\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 have \"getspc_es (?esl1!0) = EvtSeq e esys\" by auto \n then obtain s1 and x1 where a3: \"?esl1!0 = (EvtSeq e esys,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a1 have \"getspc_es (?esl1!1) = esys \n \\ (\\e. getspc_es (?esl1!1) = EvtSeq e esys \\ is_anonyevt e)\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = drop i esl\"\n and b1: \"getspc_es (esl ! i) = EvtSeq e esys \\ is_anonyevt e\"\n then have \"es' = EvtSeq e esys\" using getspc_es_def by (metis a3 fst_conv nth_Cons_0)\n with b0 have \"getspc_es (drop i esl ! 1) = EvtSeq e esys \\ is_anonyevt e\" \n using getspc_es_def by (metis One_nat_def b1 fst_conv nth_Cons_0 nth_Cons_Suc)\n then show ?case by auto\n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (esl ! i) = EvtSeq e esys \\ is_anonyevt e\"\n then have b3: \"es1' = EvtSeq e esys\" \n by (metis Pair_inject a3 nth_Cons_0)\n from b0 b3 have \"es2' = esys \\ (\\e. es2' = EvtSeq e esys \\ is_anonyevt e)\" \n using evtseq_tran_sys_or_seq_anony\n by simp\n with b1 show ?case using getspc_es_def\n by (metis One_nat_def fst_conv nth_Cons_0 nth_Cons_Suc) \n \n qed\n\n then have \"getspc_es (esl!Suc i) = esys \n \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e esys \\ is_anonyevt e)\"\n using a0 by fastforce\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma evtsys_next_in_cpts:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ getspc_es (esl!i) = EvtSys es \n \\ getspc_es (esl!Suc i) = EvtSys es \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e (EvtSys es))\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n then show ?thesis\n proof -\n {\n fix i\n assume a0: \"Suc i < length esl\"\n and a1: \"getspc_es (esl!i) = EvtSys es\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 have \"getspc_es (?esl1!0) = EvtSys es\" by auto \n then obtain s1 and x1 where a3: \"?esl1!0 = (EvtSys es,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a1 have \"getspc_es (?esl1!1) = EvtSys es \\ (\\e. getspc_es (?esl1!1) = EvtSeq e (EvtSys es))\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = drop i esl\"\n and b1: \"getspc_es (esl ! i) = EvtSys es\"\n then have \"es' = EvtSys es\" using getspc_es_def by (metis a3 fst_conv nth_Cons_0)\n with b0 have \"getspc_es (drop i esl ! 1) = EvtSys es\" using getspc_es_def\n by (metis One_nat_def fst_conv nth_Cons_0 nth_Cons_Suc) \n then show ?case by simp\n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (esl ! i) = EvtSys es\"\n then have b3: \"es1' = EvtSys es\" \n by (metis Pair_inject a3 nth_Cons_0)\n from b0 b3 have \"\\e. es2' = EvtSeq e (EvtSys es)\" using evtsys_evtent by simp\n then obtain e where \"es2' = EvtSeq e (EvtSys es)\" by auto\n with b1 have \"\\e. getspc_es (drop i esl ! 1) = EvtSeq e (EvtSys es)\" \n using getspc_es_def by (metis One_nat_def eq_fst_iff nth_Cons_0 nth_Cons_Suc)\n then show ?case by simp\n qed\n\n then have \"getspc_es (esl!Suc i) = EvtSys es \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e (EvtSys es))\"\n using a0 by fastforce\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma evtsys_next_in_cpts_anony:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ getspc_es (esl!i) = EvtSys es \n \\ getspc_es (esl!Suc i) = EvtSys es \n \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n then show ?thesis\n proof -\n {\n fix i\n assume a0: \"Suc i < length esl\"\n and a1: \"getspc_es (esl!i) = EvtSys es\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 have \"getspc_es (?esl1!0) = EvtSys es\" by auto \n then obtain s1 and x1 where a3: \"?esl1!0 = (EvtSys es,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a1 have \"getspc_es (?esl1!1) = EvtSys es \n \\ (\\e. getspc_es (?esl1!1) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = drop i esl\"\n and b1: \"getspc_es (esl ! i) = EvtSys es\"\n then have \"es' = EvtSys es\" using getspc_es_def by (metis a3 fst_conv nth_Cons_0)\n with b0 have \"getspc_es (drop i esl ! 1) = EvtSys es\" using getspc_es_def\n by (metis One_nat_def fst_conv nth_Cons_0 nth_Cons_Suc) \n then show ?case by simp\n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (esl ! i) = EvtSys es\"\n then have b3: \"es1' = EvtSys es\" \n by (metis Pair_inject a3 nth_Cons_0)\n from b0 b3 have \"\\e. es2' = EvtSeq e (EvtSys es)\" using evtsys_evtent by simp\n then obtain e where \"es2' = EvtSeq e (EvtSys es)\" by auto\n with b0 b1 b3 have \"\\e. getspc_es (drop i esl ! 1) = EvtSeq e (EvtSys es) \\ is_anonyevt e\"\n using getspc_es_def by (metis One_nat_def ent_spec2' evtsysent_evtent0 \n fst_conv is_anonyevt.simps(1) noevtent_notran nth_Cons_0 nth_Cons_Suc) \n \n then show ?case by simp\n qed\n\n then have \"getspc_es (esl!Suc i) = EvtSys es \n \\ (\\e. getspc_es (esl!Suc i) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n using a0 by fastforce\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma evtsys_all_es_in_cpts:\n \"\\esl\\cpts_es \\; length esl > 0; getspc_es (esl!0) = EvtSys es \\ \\\n \\i. i < length esl \\ getspc_es (esl!i) = EvtSys es \\ (\\e. getspc_es (esl!i) = EvtSeq e (EvtSys es))\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n and p1: \"length esl > 0\"\n and p2: \"getspc_es (esl!0) = EvtSys es\"\n show ?thesis\n proof -\n {\n fix i\n assume a0: \"i < length esl\"\n then have \"getspc_es (esl!i) = EvtSys es \\ (\\e. getspc_es (esl!i) = EvtSeq e (EvtSys es))\"\n proof(induct i)\n case 0 from p2 show ?case by simp\n next\n case (Suc j)\n assume b0: \"j < length esl \\ \n getspc_es (esl ! j) = EvtSys es \\ (\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es))\"\n and b1: \"Suc j < length esl\"\n then have \"getspc_es (esl ! j) = EvtSys es \\ (\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es))\"\n by simp\n then show ?case\n proof \n assume c0: \"getspc_es (esl ! j) = EvtSys es\"\n with p0 b1 show ?thesis using evtsys_next_in_cpts by auto\n next\n assume c0: \"\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es)\"\n with p0 b1 show ?thesis using evtseq_next_in_cpts by blast\n qed\n qed\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma evtsys_all_es_in_cpts_anony:\n \"\\esl\\cpts_es \\; length esl > 0; getspc_es (esl!0) = EvtSys es \\ \\\n \\i. i < length esl \\ getspc_es (esl!i) = EvtSys es \n \\ (\\e. getspc_es (esl!i) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n and p1: \"length esl > 0\"\n and p2: \"getspc_es (esl!0) = EvtSys es\"\n show ?thesis\n proof -\n {\n fix i\n assume a0: \"i < length esl\"\n then have \"getspc_es (esl!i) = EvtSys es \\ (\\e. getspc_es (esl!i) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n proof(induct i)\n case 0 from p2 show ?case by simp\n next\n case (Suc j)\n assume b0: \"j < length esl \\ \n getspc_es (esl ! j) = EvtSys es \n \\ (\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n and b1: \"Suc j < length esl\"\n then have \"getspc_es (esl ! j) = EvtSys es \n \\ (\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es) \\ is_anonyevt e)\"\n by simp\n then show ?case\n proof \n assume c0: \"getspc_es (esl ! j) = EvtSys es\"\n with p0 b1 show ?thesis using evtsys_next_in_cpts_anony by auto\n next\n assume c0: \"\\e. getspc_es (esl ! j) = EvtSeq e (EvtSys es) \\ is_anonyevt e\"\n with p0 b1 show ?thesis using evtseq_next_in_cpts_anony by blast\n qed\n qed\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma not_anonyevt_none_in_evtseq:\n \"\\esl\\cpts_es \\; esl = (EvtSeq e es,s1,x1)#(es,s2,x2)#xs \\ \\ e \\ AnonyEvent fin_com\"\n apply(rule cpts_es.cases)\n apply(simp)+\n apply (metis Suc_eq_plus1 add.commute add.right_neutral esys.size(3) le_add1 lessI not_le) \n apply(rule estran.cases)\n apply(simp)+\n apply (metis Suc_eq_plus1 add.commute add.right_neutral esys.size(3) le_add1 lessI not_le)\n apply(rule etran.cases)\n apply(simp)+\n prefer 2\n apply(simp) using ptran_not_none apply auto[1]\n done\n\nlemma not_anonyevt_none_in_evtseq1:\n \"\\esl\\cpts_es \\; length esl > 1; getspc_es (esl!0) = EvtSeq e es;\n getspc_es (esl!1) = es \\ \\ e \\ AnonyEvent fin_com\"\n using getspc_es_def not_anonyevt_none_in_evtseq\n by (metis (no_types, hide_lams) Cons_nth_drop_Suc drop_0 eq_fst_iff less_Suc_eq less_Suc_eq_0_disj less_one)\n\nlemma fst_esys_snd_eseq_exist_evtent:\n \"\\esl\\cpts_es \\; esl = (EvtSys es, s, x) # (EvtSeq ev (EvtSys es), s1,x1) # xs\\ \\\n \\t. \\ \\ (EvtSys es, s, x) -es-t\\ (EvtSeq ev (EvtSys es), s1,x1)\"\n apply(rule cpts_es.cases)\n apply(simp)+\n apply blast\n by blast\n\nlemma fst_esys_snd_eseq_exist_evtent2:\n \"\\esl\\cpts_es \\; esl = (EvtSys es, s, x) # (EvtSeq ev (EvtSys es), s1,x1) # xs\\ \\\n \\e k. \\ \\ (EvtSys es, s, x) -es-(EvtEnt (BasicEvent e))\\k\\ (EvtSeq ev (EvtSys es), s1,x1)\"\n apply(rule cpts_es.cases)\n apply(simp)+\n apply blast\n by (metis (no_types, hide_lams) cmd_enable_impl_notesys2 estran_impl_evtentorcmd \n evtent_is_basicevt fst_conv getspc_es_def nth_Cons_0 nth_Cons_Suc)\n\n \nlemma fst_esys_snd_eseq_exist: \n \"\\esl\\cpts_es \\; length esl \\ 2 \\ getspc_es (esl!0) = EvtSys es \\ getspc_es (esl!1) \\ EvtSys es\\\n \\ \\s x ev s1 x1 xs. esl = (EvtSys es, s, x) # (EvtSeq ev (EvtSys es), s1,x1) # xs\"\n proof -\n assume a0: \"length esl \\ 2 \\ getspc_es (esl!0) = EvtSys es \\ getspc_es (esl!1) \\ EvtSys es\"\n and c1: \"esl\\cpts_es \\\"\n from a0 have b0: \"getspc_es (esl!0) = EvtSys es \\ getspc_es (esl!1) \\ EvtSys es\"\n by (metis (no_types, lifting))\n \n from a0 have b1: \"2 \\ length esl\" by fastforce \n moreover from b0 b1 have \"\\s x. esl!0 = (EvtSys es, s, x)\" using getspc_es_def\n by (metis eq_fst_iff) \n moreover have \"\\ev s1 x1. esl!1 = (EvtSeq ev (EvtSys es), s1,x1)\" using getspc_es_def\n proof -\n from c1 a0 b0 have \"\\ev. getspc_es (esl!1) = EvtSeq ev (EvtSys es)\" \n by (metis One_nat_def Suc_1 Suc_le_lessD evtsys_next_in_cpts) \n then show ?thesis using getspc_es_def by (metis fst_conv surj_pair) \n qed\n ultimately show ?thesis by (metis (no_types, hide_lams) One_nat_def Suc_1 \n Suc_n_not_le_n diff_is_0_eq hd_Cons_tl hd_conv_nth length_tl \n list.size(3) not_numeral_le_zero nth_Cons_Suc order_trans) \n qed\n\n \nlemma notevtent_cptses_isenvorcmd: \n \"\\esl\\cpts_es \\; length esl \\ 2; \\ (\\e k. \\ \\ esl ! 0 -es-EvtEnt e\\k\\ esl ! 1)\\ \n \\ \\ \\ esl ! 0 -ese\\ esl ! 1 \\ (\\c k. \\ \\ esl ! 0 -es-Cmd c\\k\\ esl ! 1)\"\n apply(rule cpts_es.cases)\n apply simp+\n apply (simp add: esetran.intros)\n using estran_impl_evtentorcmd2\n by (metis One_nat_def nth_Cons_0 nth_Cons_Suc) \n \nlemma only_envtran_to_basicevt:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ (\\e. getspc_es (esl!i) = EvtSeq e esys) \n \\ getspc_es (esl!Suc i) = EvtSeq (BasicEvent e) esys\n \\ getspc_es (esl!i) = EvtSeq (BasicEvent e) esys\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n then show ?thesis\n proof -\n {\n fix i\n assume a0: \"Suc i < length esl\"\n and a1: \"getspc_es (esl!Suc i) = EvtSeq (BasicEvent e) esys\"\n and a00: \"\\e. getspc_es (esl!i) = EvtSeq e esys\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 have \"getspc_es (?esl1!1) = EvtSeq (BasicEvent e) esys\" by auto \n then obtain s1 and x1 where a3: \"?esl1!1 = (EvtSeq (BasicEvent e) esys,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a1 have \"getspc_es (?esl1!0) = EvtSeq (BasicEvent e) esys\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = drop i esl\"\n and b1: \"getspc_es (esl ! Suc i) = EvtSeq (BasicEvent e) esys\"\n then have \"es' = EvtSeq (BasicEvent e) esys\" \n by (metis One_nat_def a3 nth_Cons_0 nth_Cons_Suc prod.inject) \n with b0 show ?case using getspc_es_def by (metis fst_conv nth_Cons_0) \n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (esl ! Suc i) = EvtSeq (BasicEvent e) esys\"\n then have b3: \"es2' = EvtSeq (BasicEvent e) esys\"\n by (metis One_nat_def Pair_inject a3 nth_Cons_0 nth_Cons_Suc) \n from a00 obtain e' where b4: \"getspc_es (esl ! i) = EvtSeq e' esys\" by auto\n then have \"es1' = EvtSeq e' esys\"\n by (metis (no_types, lifting) CptsEsComp.hyps(4) fst_conv getspc_es_def nth_via_drop) \n with b0 b3 have \"\\ (\\e. es2' = EvtSeq (BasicEvent e) esys)\" \n using notrans_to_basicevt_insameesys[of \\ es1' s' x' et' es2' t' y' esys] by auto\n with b3 show ?case by blast\n qed\n }\n then show ?thesis by auto\n qed\n qed\n\nlemma incpts_es_impl_evnorcomptran:\n \"esl\\cpts_es \\ \\ \\i. Suc i < length esl \\ \\ \\ esl ! i -ese\\ esl ! Suc i \\ (\\et. \\ \\ esl ! i -es-et\\ esl ! Suc i)\" \n proof -\n assume p0: \"esl\\cpts_es \\\"\n {\n fix i\n assume a0: \"Suc i < length esl\"\n let ?esl1 = \"take 2 (drop i esl)\"\n from a0 p0 have \"take (Suc (Suc i) - i) (drop i esl) \\ cpts_es \\\" \n using cpts_es_seg[of esl \\ i \"Suc (Suc i)\"] by simp\n then have \"?esl1 \\ cpts_es \\\" by auto\n moreover\n from a0 obtain esc1 and s1 and x1 where a1: \"esl ! i = (esc1,s1,x1)\"\n using prod_cases3 by blast \n moreover\n from a0 obtain esc2 and s2 and x2 where a2: \"esl ! Suc i = (esc2,s2,x2)\"\n using prod_cases3 by blast \n moreover\n from a0 have \"esl ! i = ?esl1 ! 0\" by (simp add: Cons_nth_drop_Suc Suc_lessD) \n moreover\n from a0 have \"esl ! Suc i = ?esl1 ! 1\" by (simp add: Cons_nth_drop_Suc Suc_lessD) \n ultimately have \"(esc1, s1, x1)#[(esc2, s2, x2)] \\ cpts_es \\\" \n by (metis Cons_nth_drop_Suc Suc_lessD a0 numeral_2_eq_2 take_0 take_Suc_Cons)\n then have \"\\ \\ (esc1, s1, x1) -ese\\ (esc2, s2, x2) \\ (\\et. \\ \\ (esc1, s1, x1) -es-et\\ (esc2, s2, x2))\"\n apply(rule cpts_es.cases)\n apply simp+\n apply (simp add: esetran.intros)\n by auto\n with a1 a2 have \"\\ \\ esl ! i -ese\\ esl ! Suc i \\ (\\et. \\ \\ esl ! i -es-et\\ esl ! Suc i)\" by simp\n }\n then show ?thesis by auto\n qed\n\nlemma incpts_es_eseq_not_evtent:\n \"\\esl\\cpts_es \\; Suc i < length esl; \\e esys. getspc_es (esl!i) = EvtSeq e esys \\ is_anonyevt e\\ \n \\ \\(\\e k. t = EvtEnt e \\ \\ \\ esl!i -es-t\\k\\ esl!Suc i)\"\n proof -\n assume p0: \"esl\\cpts_es \\\"\n and a0: \"Suc i < length esl\"\n and a1: \"\\e esys. getspc_es (esl!i) = EvtSeq e esys \\ is_anonyevt e\"\n let ?esl1 = \"drop i esl\"\n from p0 a0 have a2: \"?esl1\\cpts_es \\\" by (metis (no_types, hide_lams) Suc_diff_1 Suc_lessD \n cpts_es_dropi diff_diff_cancel drop_0 length_drop length_greater_0_conv \n less_or_eq_imp_le list.size(3)) \n from a0 a1 obtain e and esys where a3: \"getspc_es (?esl1!0) = EvtSeq e esys\" by auto \n then obtain s1 and x1 where a4: \"?esl1!0 = (EvtSeq e esys,s1,x1)\" \n using getspc_es_def by (metis fst_conv old.prod.exhaust)\n from a2 a3 have \"\\(\\e k. t = EvtEnt e \\ \\ \\ ?esl1!0 -es-t\\k\\ ?esl1!1)\"\n proof(induct ?esl1)\n case (CptsEsOne es' s' x')\n then show ?case by (metis One_nat_def Suc_eq_plus1_left Suc_lessD a0 \n le_add_diff_inverse2 length_Cons length_drop less_imp_le \n list.size(3) not_less_iff_gr_or_eq) \n next\n case (CptsEsEnv es' t' x' xs' s' y')\n assume b0: \"(es', s', y') # (es', t', x') # xs' = ?esl1\"\n and b1: \"getspc_es (?esl1 ! 0) = EvtSeq e esys\"\n then have \"es' = EvtSeq e esys\"\n by (metis Pair_inject a4 nth_Cons_0) \n with b0 show ?case using getspc_es_def\n by (metis (mono_tags, lifting) a1 evtseq_no_evtent2 nth_Cons_0 nth_via_drop) \n next\n case (CptsEsComp es1' s' x' et' es2' t' y' xs')\n assume b0: \"\\ \\ (es1', s', x') -es-et'\\ (es2', t', y')\"\n and b1: \"(es1', s', x') # (es2', t', y') # xs' = drop i esl\"\n and b2: \"getspc_es (?esl1 ! 0) = EvtSeq e esys\"\n then have b3: \"es1' = EvtSeq e esys\"\n by (metis Pair_inject a4 nth_Cons_0)\n with b0 b1 show ?case using getspc_es_def\n by (metis (no_types, lifting) a1 evtseq_no_evtent2 nth_Cons_0 nth_via_drop) \n qed\n \n with a0 show ?thesis by (simp add: Cons_nth_drop_Suc Suc_lessD) \n qed\n\nlemma evtsys_not_eq_in_tran_aux:\"\\ \\ (P,s,x) -es-est\\ (Q,t,y) \\ P \\ Q\"\n apply(erule estran.cases)\n apply (simp add: evt_not_eq_in_tran_aux)\n apply (simp add: evt_not_eq_in_tran_aux)\n by (simp add: evtseq_ne_es)\n\nlemma evtsys_not_eq_in_tran_aux1:\"\\ \\ esc1 -es-est\\ esc2 \\ getspc_es esc1 \\ getspc_es esc2\"\n proof -\n assume p0: \"\\ \\ esc1 -es-est\\ esc2\"\n obtain es1 and s1 and x1 and es2 and s2 and x2 where a0: \"esc1 = (es1,s1,x1) \\ esc2 = (es2,s2,x2)\"\n by (metis prod.collapse)\n with p0 have \"es1 \\ es2\" using evtsys_not_eq_in_tran_aux by simp\n with a0 show ?thesis by (simp add:getspc_es_def)\n qed\n\nlemma evtsys_not_eq_in_tran [simp]: \"\\ \\ \\ (P,s,x) -es-est\\ (P,t,y)\"\n apply clarify\n apply(drule evtsys_not_eq_in_tran_aux)\n apply simp\n done\n\nlemma evtsys_not_eq_in_tran2 [simp]: \"\\(\\est. \\ \\ (P,s,x) -es-est\\ (P,t,y))\" by simp\n\nlemma es_tran_not_etran2: \"\\ \\ (P,s,x) -es-pt\\ (Q,t,y) \\ \\(\\ \\ (P,s,x) -ese\\(Q,t,y))\"\n by (metis esetran.cases evtsys_not_eq_in_tran_aux)\n\nlemma es_tran_not_etran1: \"\\ \\ esc1 -es-pt\\ esc2 \\ \\(\\ \\ esc1 -ese\\esc2)\"\n using esetran_eqconf1 evtsys_not_eq_in_tran_aux1 by blast\n\nsubsubsection \\Parallel event systems\\\n\nlemma cpts_pes_not_empty [simp]:\"[] \\ cpts_pes \\\"\napply(force elim:cpts_pes.cases)\ndone\n\nlemma pesetran_eqconf: \"\\ \\ (es1, s1, x1) -pese\\ (es2, s2, x2) \\ es1 = es2\"\n apply(rule pesetran.cases)\n apply(simp)+\n done\n\nlemma pesetran_eqconf1: \"\\ \\ esc1 -pese\\ esc2 \\ getspc esc1 = getspc esc2\"\n proof -\n assume a0: \"\\ \\ esc1 -pese\\ esc2\"\n then obtain es1 and s1 and x1 and es2 and s2 and x2 where a1: \"esc1 = (es1, s1, x1)\" and a2: \"esc2 = (es2, s2, x2)\"\n by (meson prod_cases3) \n then have \"es1 = es2\" using a0 pesetran_eqconf by fastforce \n with a1 show ?thesis by (simp add: a2 getspc_def) \n qed\n\nlemma eqconf_pesetran1: \"es1 = es2 \\ \\ \\ (es1, s1, x1) -pese\\ (es2, s2, x2)\"\n by (simp add: pesetran.intros) \n\n\nlemma eqconf_pesetran: \"getspc esc1 = getspc esc2 \\ \\ \\ esc1 -pese\\ esc2\" \n proof -\n assume a0: \"getspc esc1 = getspc esc2\"\n obtain es1 and s1 and x1 where a1: \"esc1 = (es1, s1, x1)\" using prod_cases3 by blast \n obtain es2 and s2 and x2 where a2: \"esc2 = (es2, s2, x2)\" using prod_cases3 by blast \n with a0 a1 have \"es1 = es2\" by (simp add:getspc_def)\n with a1 a2 have a3: \"\\ \\ (es1, s1, x1) -pese\\ (es2, s2, x2)\" by (simp add:eqconf_pesetran1)\n from a3 a1 a2 show ?thesis by simp\n qed\n\nlemma pestran_cpts_pes: \"\\\\ \\ C1 -pes-ct\\ C2; C2#xs \\ cpts_pes \\\\ \\ C1#C2#xs \\ cpts_pes \\\"\n proof -\n assume p0: \"\\ \\ C1 -pes-ct\\ C2\"\n and p1: \"C2#xs \\ cpts_pes \\\"\n moreover\n obtain pes1 and s1 and x1 where \"C1 = (pes1,s1,x1)\"\n using prod_cases3 by blast \n moreover\n obtain pes2 and s2 and x2 where \"C2 = (pes2,s2,x2)\" \n using prod_cases3 by blast \n ultimately show ?thesis by (simp add: cpts_pes.CptsPesComp) \n qed\n\nlemma cpts_pes_onemore: \"\\el \\ cpts_pes \\; (\\ \\ el ! (length el - 1) -pes-t\\ ec) \\ (\\ \\ el ! (length el - 1) -pese\\ ec)\\ \\\n el @ [ec] \\ cpts_pes \\\"\n proof -\n assume p0: \"el \\ cpts_pes \\\"\n and p2: \"(\\ \\ el ! (length el - 1) -pes-t\\ ec) \\ (\\ \\ el ! (length el - 1) -pese\\ ec)\"\n from p0 have p1: \"el \\ []\"\n using cpts_pes.simps by blast\n have \"\\el ec t. el \\ cpts_pes \\ \\ ((\\ \\ el ! (length el - 1) -pes-t\\ ec) \\ (\\ \\ el ! (length el - 1) -pese\\ ec)) \n \\ el @ [ec] \\ cpts_pes \\\"\n proof -\n {\n fix el ec t\n assume a0: \"el \\ cpts_pes \\\"\n and a2: \"(\\ \\ el ! (length el - 1) -pes-t\\ ec) \\ (\\ \\ el ! (length el - 1) -pese\\ ec)\"\n then have a1: \"length el > 0\"\n using cpts_pes.simps by blast\n from a0 a1 a2 have \"el @ [ec] \\ cpts_pes \\\"\n proof(induct el)\n case (CptsPesOne e s x) \n assume b0: \"(\\ \\ [(e, s, x)] ! (length [(e, s, x)] - 1) -pes-t\\ ec) \n \\ \\ \\ [(e, s, x)] ! (length [(e, s, x)] - 1) -pese\\ ec\"\n then have \"(\\ \\ (e, s, x) -pes-t\\ ec) \\ (\\ \\ (e, s, x) -pese\\ ec)\" by simp\n then show ?case \n proof\n assume \"\\ \\ (e, s, x) -pes-t\\ ec\"\n then show ?thesis by (metis append_Cons append_Nil \n cpts_pes.CptsPesComp cpts_pes.CptsPesOne surj_pair)\n next\n assume \"\\ \\ (e, s, x) -pese\\ ec\"\n then show ?thesis\n by (metis append_Cons append_Nil cpts_pes.CptsPesEnv \n cpts_pes.CptsPesOne pesetranE surj_pair) \n qed\n next\n case (CptsPesEnv e s1 x xs s2 y)\n assume b0: \"(e, s1, x) # xs \\ cpts_pes \\\"\n and b1: \"0 < length ((e, s1, x) # xs) \\\n (\\ \\ ((e, s1, x) # xs) ! (length ((e, s1, x) # xs) - 1) -pes-t\\ ec) \\\n (\\ \\ ((e, s1, x) # xs) ! (length ((e, s1, x) # xs) - 1) -pese\\ ec) \\\n ((e, s1, x) # xs) @ [ec] \\ cpts_pes \\\"\n and b2: \"0 < length ((e, s2, y) # (e, s1, x) # xs)\"\n and b3: \"(\\ \\ ((e, s2, y) # (e, s1, x) # xs) ! (length ((e, s2, y) # (e, s1, x) # xs) - 1) -pes-t\\ ec) \\\n (\\ \\ ((e, s2, y) # (e, s1, x) # xs) ! (length ((e, s2, y) # (e, s1, x) # xs) - 1) -pese\\ ec)\"\n then show ?case \n proof(cases \"xs = []\")\n assume c0: \"xs = []\"\n with b3 have \"(\\ \\ (e, s1, x) -pes-t\\ ec) \\ (\\ \\ (e, s1, x) -pese\\ ec)\" by simp\n with b1 c0 have \"((e, s1, x) # xs) @ [ec] \\ cpts_pes \\\" by simp\n then show ?thesis by (simp add: cpts_pes.CptsPesEnv) \n next\n assume c0: \"xs \\ []\"\n with b3 have \"(\\ \\ last xs -pes-t\\ ec) \\ (\\ \\ last xs -pese\\ ec)\" by (simp add: last_conv_nth) \n with b1 c0 have \"((e, s1, x) # xs) @ [ec] \\ cpts_pes \\\" using b3 by auto\n then show ?thesis by (simp add: cpts_pes.CptsPesEnv) \n qed\n next\n case (CptsPesComp e1 s1 x1 et e2 t1 y1 xs1)\n assume b0: \"\\ \\ (e1, s1, x1) -pes-et\\ (e2, t1, y1)\"\n and b1: \"(e2, t1, y1) # xs1 \\ cpts_pes \\\"\n and b2: \"0 < length ((e2, t1, y1) # xs1) \\\n (\\ \\ ((e2, t1, y1) # xs1) ! (length ((e2, t1, y1) # xs1) - 1) -pes-t\\ ec) \\\n (\\ \\ ((e2, t1, y1) # xs1) ! (length ((e2, t1, y1) # xs1) - 1) -pese\\ ec) \\\n ((e2, t1, y1) # xs1) @ [ec] \\ cpts_pes \\\"\n and b3: \"0 < length ((e1, s1, x1) # (e2, t1, y1) # xs1)\"\n and b4: \"(\\ \\ ((e1, s1, x1) # (e2, t1, y1) # xs1) ! (length ((e1, s1, x1) # (e2, t1, y1) # xs1) - 1) -pes-t\\ ec) \\\n \\ \\ ((e1, s1, x1) # (e2, t1, y1) # xs1) ! (length ((e1, s1, x1) # (e2, t1, y1) # xs1) - 1) -pese\\ ec\"\n then show ?case \n proof(cases \"xs1 = []\")\n assume c0: \"xs1 = []\"\n with b4 have \"(\\ \\ (e2, t1, y1) -pes-t\\ ec) \\ (\\ \\ (e2, t1, y1) -pese\\ ec)\" by simp\n with b2 c0 have \"((e2, t1, y1) # xs1) @ [ec] \\ cpts_pes \\\" by simp\n with b0 show ?thesis using cpts_pes.CptsPesComp by fastforce \n next\n assume c0: \"xs1 \\ []\"\n with b4 have \"(\\ \\ last xs1 -pes-t\\ ec) \\ (\\ \\ last xs1 -pese\\ ec)\" by (simp add: last_conv_nth)\n with b2 c0 have \"((e2, t1, y1) # xs1) @ [ec] \\ cpts_pes \\\" using b4 by auto \n then show ?thesis using b0 cpts_pes.CptsPesComp by fastforce \n qed\n qed\n }\n then show ?thesis by blast\n qed\n\n then show \"el @ [ec] \\ cpts_pes \\\" using p0 p1 p2 by blast \n qed\n\nlemma pes_not_eq_in_tran_aux:\"\\ \\ (P,s,x) -pes-est\\ (Q,t,y) \\ P \\ Q\"\n apply(erule pestran.cases)\n by (metis Pair_inject evtsys_not_eq_in_tran fun_upd_same)\n \nlemma pes_not_eq_in_tran [simp]: \"\\ \\ \\ (P,s,x) -pes-est\\ (P,t,y)\"\n apply clarify\n apply(drule pes_not_eq_in_tran_aux)\n apply simp\n done\n\nlemma pes_tran_not_etran1: \"\\ \\ pes1 -pes-t\\ pes2 \\ \\(\\ \\ pes1 -pese\\pes2)\"\n by (metis pes_not_eq_in_tran pesetranE surj_pair)\n\nlemma pes_tran_not_etran2: \"\\ \\ (P,s,x) -pes-pt\\ (Q,t,y) \\ \\(\\ \\ (P,s,x) -pese\\(Q,t,y))\"\n by (simp add: pes_tran_not_etran1)\n \nlemma incpts_pes_impl_evnorcomptran:\n \"esl\\cpts_pes \\ \\ \\i. Suc i < length esl \\ \\ \\ esl ! i -pese\\ esl ! Suc i \\ (\\et. \\ \\ esl ! i -pes-et\\ esl ! Suc i)\" \n proof -\n assume p0: \"esl\\cpts_pes \\\"\n then show ?thesis\n proof(induct esl)\n case (CptsPesOne) show ?case by simp\n next\n case (CptsPesEnv pes t x xs s y)\n assume a0: \"(pes, t, x) # xs \\ cpts_pes \\\"\n and a1: \"\\i. Suc i < length ((pes, t, x) # xs) \\\n \\ \\ ((pes, t, x) # xs) ! i -pese\\ ((pes, t, x) # xs) ! Suc i \\\n (\\et. \\ \\ ((pes, t, x) # xs) ! i -pes-et\\ ((pes, t, x) # xs) ! Suc i)\"\n then show ?case \n proof -\n {\n fix i\n assume b0: \"Suc i < length ((pes, s, y) # (pes, t, x) # xs)\"\n have \"\\ \\ ((pes, s, y) # (pes, t, x) # xs) ! i -pese\\ ((pes, s, y) # (pes, t, x) # xs) ! Suc i \\\n (\\et. \\ \\ ((pes, s, y) # (pes, t, x) # xs) ! i -pes-et\\ ((pes, s, y) # (pes, t, x) # xs) ! Suc i)\"\n proof(cases \"i = 0\")\n assume c0: \"i = 0\"\n then show ?thesis by (simp add: eqconf_pesetran1 nth_Cons') \n next\n assume c0: \"i \\ 0\"\n then have \"i > 0\" by auto\n with a1 b0 show ?thesis by (simp add: length_Cons) \n qed\n }\n then show ?thesis by auto\n qed\n next\n case (CptsPesComp pes1 s x ct pes2 t y xs)\n assume a0: \"\\ \\ (pes1, s, x) -pes-ct\\ (pes2, t, y)\"\n and a1: \"(pes2, t, y) # xs \\ cpts_pes \\\"\n and a2: \"\\i. Suc i < length ((pes2, t, y) # xs) \\\n \\ \\ ((pes2, t, y) # xs) ! i -pese\\ ((pes2, t, y) # xs) ! Suc i \\\n (\\et. \\ \\ ((pes2, t, y) # xs) ! i -pes-et\\ ((pes2, t, y) # xs) ! Suc i)\"\n then show ?case \n proof -\n {\n fix i\n assume b0: \"Suc i < length ((pes1, s, x) # (pes2, t, y) # xs)\"\n have \"\\ \\ ((pes1, s, x) # (pes2, t, y) # xs) ! i -pese\\ ((pes1, s, x) # (pes2, t, y) # xs) ! Suc i \\\n (\\et. \\ \\ ((pes1, s, x) # (pes2, t, y) # xs) ! i -pes-et\\ ((pes1, s, x) # (pes2, t, y) # xs) ! Suc i)\"\n proof(cases \"i = 0\")\n assume c0: \"i = 0\"\n with a0 show ?thesis using nth_Cons_0 nth_Cons_Suc by auto \n next\n assume c0: \"i \\ 0\"\n then have \"i > 0\" by auto\n with a2 b0 show ?thesis using Suc_inject Suc_less_eq2 Suc_pred \n length_Cons nth_Cons_Suc by auto \n qed\n }\n then show ?thesis by auto\n qed\n qed\n qed\n\nlemma cpts_pes_drop0: \"\\el \\ cpts_pes \\; Suc 0 < length el\\ \\ drop (Suc 0) el \\ cpts_pes \\\"\n apply(rule cpts_pes.cases)\n apply(simp)+\n done \n\nlemma cpts_pes_dropi: \"\\el \\ cpts_pes \\; Suc i < length el\\ \\ drop (Suc i) el \\ cpts_pes \\\"\n proof -\n assume p0:\"el \\ cpts_pes \\\" and p1:\"Suc i < length el\"\n have \"\\el i. el \\ cpts_pes \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_pes \\\"\n proof -\n {\n fix el i\n have \"el \\ cpts_pes \\ \\ Suc i < length el \\ drop (Suc i) el \\ cpts_pes \\\"\n proof(induct i)\n case 0 show ?case by (simp add: cpts_pes_drop0) \n next\n case (Suc j)\n assume b0: \"el \\ cpts_pes \\ \\ Suc j < length el \\ drop (Suc j) el \\ cpts_pes \\\"\n show ?case\n proof\n assume c0: \"el \\ cpts_pes \\ \\ Suc (Suc j) < length el\"\n with b0 have c1: \"drop (Suc j) el \\ cpts_pes \\\"\n by (simp add: c0 Suc_lessD) \n then show \"drop (Suc (Suc j)) el \\ cpts_pes \\\"\n using c0 cpts_pes_drop0 by fastforce \n qed\n qed\n }\n then show ?thesis by auto\n qed\n with p0 p1 show ?thesis by auto\n qed\n\nlemma cpts_pes_take0: \"\\el \\ cpts_pes \\; i < length el; el1 = take (Suc i) el; j < length el1\\ \n \\ drop (length el1 - Suc j) el1 \\ cpts_pes \\\"\n proof -\n assume p0: \"el \\ cpts_pes \\\"\n and p1: \"i < length el\"\n and p2: \"el1 = take (Suc i) el\"\n and p3: \"j < length el1\"\n have \"\\i j. el \\ cpts_pes \\ \\ i < length el \\ el1 = take (Suc i) el \\ j < length el1 \n \\ drop (length el1 - Suc j) el1 \\ cpts_pes \\\"\n proof -\n {\n fix i j\n assume a0: \"el \\ cpts_pes \\\"\n and a1: \"i < length el\"\n and a2: \"el1 = take (Suc i) el\"\n and a3: \"j < length el1\"\n then have \"drop (length el1 - Suc j) el1 \\ cpts_pes \\\"\n proof(induct j)\n case 0 \n have \"drop (length el1 - Suc 0) el1 = [el ! i]\"\n by (simp add: a1 a2 take_Suc_conv_app_nth) \n then show ?case by (metis cpts_pes.CptsPesOne old.prod.exhaust) \n next\n case (Suc jj)\n assume b0: \"el \\ cpts_pes \\ \\ i < length el \\ el1 = take (Suc i) el \n \\ jj < length el1 \\ drop (length el1 - Suc jj) el1 \\ cpts_pes \\\"\n and b1: \"el \\ cpts_pes \\\"\n and b2: \"i < length el\"\n and b3: \"el1 = take (Suc i) el\"\n and b4: \"Suc jj < length el1\"\n then have b5: \"drop (length el1 - Suc jj) el1 \\ cpts_pes \\\"\n using Suc_lessD by blast \n let ?el2 = \"drop (Suc i) el\"\n from a2 have b6: \"el1 @ ?el2 = el\" by simp\n let ?el1sht = \"drop (length el1 - Suc jj) el1\"\n let ?el1lng = \"drop (length el1 - Suc (Suc jj)) el1\"\n let ?elsht = \"drop (length el1 - Suc jj) el\"\n let ?ellng = \"drop (length el1 - Suc (Suc jj)) el\"\n from b6 have a7: \"?el1sht @ ?el2 = ?elsht\"\n by (metis diff_is_0_eq diff_le_self drop_0 drop_append) \n from b6 have a8: \"?el1lng @ ?el2 = ?ellng\"\n by (metis (no_types, lifting) a7 append_eq_append_conv diff_is_0_eq' diff_le_self drop_append) \n have a9: \"?ellng = (el ! (length el1 - Suc (Suc jj))) # ?elsht\"\n by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_diff_Suc Suc_leI a8 \n append_is_Nil_conv b4 diff_diff_cancel drop_all length_drop \n list.size(3) not_less old.nat.distinct(2)) \n from b1 b4 have a10: \"?elsht \\ cpts_pes \\\"\n by (metis Suc_diff_Suc a7 append_is_Nil_conv b5 cpts_pes_dropi drop_all not_less)\n from b1 b4 have a11: \"?ellng \\ cpts_pes \\\"\n by (metis (no_types, lifting) Suc_diff_Suc a9 cpts_pes_dropi diff_is_0_eq \n drop_0 drop_all leI list.simps(3))\n have a12: \"?el1lng = (el ! (length el1 - Suc (Suc jj))) # ?el1sht\"\n by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_diff_Suc b4 b6 diff_less \n gr_implies_not0 length_0_conv length_greater_0_conv nth_append zero_less_Suc)\n from a11 have \"?el1lng \\ cpts_pes \\\"\n proof(induct ?ellng)\n case CptsPesOne show ?case\n using CptsPesOne.hyps a7 a9 by auto \n next\n case (CptsPesEnv es1 t1 x1 xs1 s1 y1)\n assume c0: \"(es1, t1, x1) # xs1 \\ cpts_pes \\\"\n and c1: \"(es1, t1, x1) # xs1 = drop (length el1 - Suc (Suc jj)) el \\\n drop (length el1 - Suc (Suc jj)) el1 \\ cpts_pes \\\"\n and c2: \"(es1, s1, y1) # (es1, t1, x1) # xs1 = drop (length el1 - Suc (Suc jj)) el\"\n from c0 have \"(es1, s1, y1) # (es1, t1, x1) # xs1 \\ cpts_pes \\\"\n by (simp add: a11 c2) \n have c3: \"?el1sht ! 0 = (es1, t1, x1)\" by (metis (no_types, lifting) Suc_leI Suc_lessD a7 \n a9 append_eq_Cons_conv b4 c2 diff_diff_cancel length_drop list.inject \n list.size(3) nth_Cons_0 old.nat.distinct(2)) \n then have c4: \"\\el1sht'. ?el1sht = (es1, t1, x1) # el1sht'\" by (metis Cons_nth_drop_Suc b4 \n diff_diff_cancel drop_0 length_drop less_or_eq_imp_le zero_less_Suc) \n have c5: \"?el1lng = (es1, s1, y1) # ?el1sht\" using a12 a9 c2 by auto \n \n with b5 c4 show ?case using cpts_pes.CptsPesEnv by fastforce \n next\n case (CptsPesComp es1 s1 x1 et es2 t1 y1 xs1)\n assume c0: \"\\ \\ (es1, s1, x1) -pes-et\\ (es2, t1, y1)\"\n and c1: \"(es2, t1, y1) # xs1 \\ cpts_pes \\\"\n and c2: \"(es2, t1, y1) # xs1 = drop (length el1 - Suc (Suc jj)) el \n \\ drop (length el1 - Suc (Suc jj)) el1 \\ cpts_pes \\\"\n and c3: \"(es1, s1, x1) # (es2, t1, y1) # xs1 = drop (length el1 - Suc (Suc jj)) el\"\n have c4: \"?el1sht ! 0 = (es2, t1, y1)\" by (metis (no_types, lifting) Suc_leI Suc_lessD a7 \n a9 append_eq_Cons_conv b4 c3 diff_diff_cancel length_drop list.inject \n list.size(3) nth_Cons_0 old.nat.distinct(2)) \n then have c5: \"\\el1sht'. ?el1sht = (es2, t1, y1) # el1sht'\" by (metis Cons_nth_drop_Suc b4 \n diff_diff_cancel drop_0 length_drop less_or_eq_imp_le zero_less_Suc) \n have c6: \"?el1lng = (es1, s1, x1) # ?el1sht\" using a12 a9 c3 by auto\n with b5 c5 show ?case using c0 cpts_pes.CptsPesComp by fastforce \n qed\n\n then show ?case by simp\n qed\n }\n then show ?thesis by auto\n qed\n then show \"drop (length el1 - Suc j) el1 \\ cpts_pes \\\"\n using p0 p1 p2 p3 by blast \n qed\n\nlemma cpts_pes_take: \"\\el \\ cpts_pes \\; i < length el\\ \\ take (Suc i) el \\ cpts_pes \\\"\n using cpts_pes_take0 gr_implies_not0 by fastforce\n\nlemma cpts_pes_seg: \"\\el \\ cpts_pes \\; m \\ length el; n \\ length el; m < n\\ \n \\ take (n - m) (drop m el) \\ cpts_pes \\\"\n proof -\n assume p0: \"el \\ cpts_pes \\\"\n and p1: \"m \\ length el\"\n and p2: \"n \\ length el\"\n and p3: \"m < n\"\n then have \"drop m el \\ cpts_pes \\\" \n using cpts_pes_dropi by (metis (no_types, lifting) drop_0 le_0_eq le_SucE less_le_trans zero_induct) \n then show ?thesis using cpts_pes_take\n by (smt Suc_diff_Suc diff_diff_cancel diff_less_Suc diff_right_commute length_drop less_le_trans p2 p3)\n qed\n\nlemma cpts_pes_seg2: \"\\el \\ cpts_pes \\; m \\ length el; n \\ length el; take (n - m) (drop m el) \\ []\\ \n \\ take (n - m) (drop m el) \\ cpts_pes \\\"\n proof -\n assume p0: \"el \\ cpts_pes \\\"\n and p1: \"m \\ length el\"\n and p2: \"n \\ length el\"\n and p3: \"take (n - m) (drop m el) \\ []\"\n from p3 have \"m < n\" by simp\n then show ?thesis using cpts_pes_seg using p0 p1 p2 by blast\n qed\n\nsubsection \\Compositionality of the Semantics\\\n\nsubsubsection \\Definition of the conjoin operator\\\n\ndefinition same_length :: \"('l,'k,'s,'prog) pesconfs \\ ('k \\ ('l,'k,'s,'prog) esconfs) \\ bool\" where\n \"same_length c cs \\ \\k. length (cs k) = length c\"\n \ndefinition same_state :: \"('l,'k,'s,'prog) pesconfs \\ ('k \\ ('l,'k,'s,'prog) esconfs) \\ bool\" where\n \"same_state c cs \\ \\k j. j < length c \\ gets (c!j) = gets_es ((cs k)!j) \\ getx (c!j) = getx_es ((cs k)!j)\"\n\ndefinition same_spec :: \"('l,'k,'s,'prog) pesconfs \\ ('k \\ ('l,'k,'s,'prog) esconfs) \\ bool\" where\n \"same_spec c cs \\ \\k j. j < length c \\ (getspc (c!j)) k = getspc_es ((cs k) ! j)\"\n\ndefinition compat_tran :: \"'Env \\ ('l,'k,'s,'prog) pesconfs \\ ('k \\ ('l,'k,'s,'prog) esconfs) \\ bool\" where\n \"compat_tran \\ c cs \\ \\j. Suc j < length c \\ \n ((\\t k. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j)) \\\n (\\k t. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\ (\\ \\ cs k!j -es-(t\\k)\\ cs k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!j -ese\\ cs k'! Suc j))))\n \\\n ((\\ \\ (c!j) -pese\\ (c!Suc j)) \\ (\\k. (\\ \\ ((cs k)!j) -ese\\ ((cs k)! Suc j))))\"\n\ndefinition conjoin :: \"'Env \\ ('l,'k,'s,'prog) pesconfs \\ ('k \\ ('l,'k,'s,'prog) esconfs) \\ bool\" (\"_ _ \\ _\" [65,65] 64) where\n \"\\ c \\ cs \\ (same_length c cs) \\ (same_state c cs) \\ (same_spec c cs) \\ (compat_tran \\ c cs)\"\n\nsubsubsection \\Lemmas of conjoin\\\n\nlemma acts_in_conjoin_cpts: \"\\ c \\ cs \\ \\i. Suc i < length (cs k) \\ \\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i) \n \\ (\\e. \\ \\ ((cs k)!i) -es-(EvtEnt e\\k)\\ ((cs k)! Suc i))\n \\ (\\c. \\ \\ ((cs k)!i) -es-(Cmd c\\k)\\ ((cs k)! Suc i))\"\n proof -\n assume p0: \"\\ c \\ cs\"\n {\n fix i\n assume a0: \"Suc i < length (cs k)\"\n from p0 have a1: \"length c = length (cs k)\" by (simp add:conjoin_def same_length_def)\n from p0 have \"compat_tran \\ c cs\" by (simp add:conjoin_def)\n with a0 a1 have \"(\\t k. (\\ \\ c!i -pes-(t\\k)\\ c!Suc i) \\\n (\\k t. (\\ \\ c!i -pes-(t\\k)\\ c!Suc i) \\ (\\ \\ cs k!i -es-(t\\k)\\ cs k! Suc i) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!i -ese\\ cs k'! Suc i))))\n \\\n ((\\ \\ (c!i) -pese\\ (c!Suc i)) \\ (\\k. (\\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i))))\" \n by (simp add: compat_tran_def)\n then have \"\\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i) \n \\ (\\e. \\ \\ ((cs k)!i) -es-(EvtEnt e\\k)\\ ((cs k)! Suc i))\n \\ (\\c. \\ \\ ((cs k)!i) -es-(Cmd c\\k)\\ ((cs k)! Suc i))\"\n proof\n assume b0: \"\\t k. (\\ \\ c!i -pes-(t\\k)\\ c!Suc i) \\\n (\\k t. (\\ \\ c!i -pes-(t\\k)\\ c!Suc i) \\ (\\ \\ cs k!i -es-(t\\k)\\ cs k! Suc i) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!i -ese\\ cs k'! Suc i)))\"\n then obtain t and k1 where b1: \"(\\ \\ c!i -pes-(t\\k1)\\ c!Suc i) \\\n (\\k t. (\\ \\ c!i -pes-(t\\k)\\ c!Suc i) \\ (\\ \\ cs k!i -es-(t\\k)\\ cs k! Suc i) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!i -ese\\ cs k'! Suc i)))\" by auto\n then show ?thesis\n proof(cases \"k = k1\")\n assume c0: \"k = k1\"\n with b1 show ?thesis by (meson estran_impl_evtentorcmd2') \n next\n assume c0: \"k \\ k1\"\n with b1 show ?thesis by auto\n qed\n next\n assume b0: \"(\\ \\ (c!i) -pese\\ (c!Suc i)) \\ (\\k. (\\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i)))\"\n then show ?thesis by simp\n qed\n }\n then show ?thesis by simp\n qed\n\nlemma entevt_in_conjoin_cpts: \n \"\\\\ c \\ cs; Suc i < length (cs k); getspc_es ((cs k)!i) = EvtSys es; \n getspc_es ((cs k)!Suc i) \\ EvtSys es \\\n \\ (\\e. \\ \\ ((cs k)!i) -es-(EvtEnt e\\k)\\ ((cs k)! Suc i))\"\n proof -\n assume p0: \"\\ c \\ cs\"\n and p1: \"Suc i < length (cs k)\"\n and p2: \"getspc_es ((cs k)!i) = EvtSys es\"\n and p3: \"getspc_es ((cs k)!Suc i) \\ EvtSys es\"\n then have \"\\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i) \n \\ (\\e. \\ \\ ((cs k)!i) -es-(EvtEnt e\\k)\\ ((cs k)! Suc i))\n \\ (\\c. \\ \\ ((cs k)!i) -es-(Cmd c\\k)\\ ((cs k)! Suc i))\"\n using acts_in_conjoin_cpts by fastforce \n then show ?thesis\n proof\n assume \"\\ \\ ((cs k)!i) -ese\\ ((cs k)! Suc i)\"\n with p2 p3 show ?thesis by (simp add: esetran_eqconf1) \n next\n assume \"(\\e. \\ \\ cs k ! i -es-EvtEnt e\\k\\ cs k ! Suc i) \n \\ (\\c. \\ \\ cs k ! i -es-Cmd c\\k\\ cs k ! Suc i)\"\n then show ?thesis \n proof\n assume \"\\e. \\ \\ cs k ! i -es-EvtEnt e\\k\\ cs k ! Suc i\"\n then show ?thesis by simp\n next\n assume \"\\c. \\ \\ cs k ! i -es-Cmd c\\k\\ cs k ! Suc i\"\n with p2 p3 show ?thesis \n by (meson cmd_enable_impl_anonyevt2 esys_not_eseq) \n qed\n qed\n qed\n\nlemma notentevt_in_conjoin_cpts: \n \"\\\\ c \\ cs; Suc i < length (cs k); \\(getspc_es ((cs k)!i) = EvtSys es \\ getspc_es ((cs k)!Suc i) \\ EvtSys es);\n \\i < length (cs k). getspc_es ((cs k) ! i) = EvtSys es \n \\ (\\e. is_anonyevt e \\ getspc_es ((cs k) ! i) = EvtSeq e (EvtSys es))\\\n \\ \\(\\e. \\ \\ ((cs k)!i) -es-(EvtEnt e\\k)\\ ((cs k)! Suc i))\"\n proof -\n assume p0: \"\\ c \\ cs\"\n and p1: \"Suc i < length (cs k)\"\n and p2: \"\\(getspc_es ((cs k)!i) = EvtSys es \\ getspc_es ((cs k)!Suc i) \\ EvtSys es)\"\n and p3: \"\\i < length (cs k). getspc_es ((cs k) ! i) = EvtSys es \n \\ (\\e. is_anonyevt e \\ getspc_es ((cs k) ! i) = EvtSeq e (EvtSys es))\"\n from p2 have \"getspc_es ((cs k)!i) \\ EvtSys es \\ getspc_es ((cs k)!Suc i) = EvtSys es\" by simp\n with p3 have \"(\\e. is_anonyevt e \\ getspc_es ((cs k) ! i) = EvtSeq e (EvtSys es)) \n \\ getspc_es ((cs k)!Suc i) = EvtSys es\"\n using Suc_lessD p1 by blast\n then show ?thesis\n proof\n assume \"\\e. is_anonyevt e \\ getspc_es ((cs k) ! i) = EvtSeq e (EvtSys es)\"\n then obtain e1 where \"is_anonyevt e1 \\ getspc_es ((cs k) ! i) = EvtSeq e1 (EvtSys es)\" by auto\n then show ?thesis using evtent_is_basicevt_inevtseq2 by fastforce\n next\n assume \"getspc_es ((cs k)!Suc i) = EvtSys es\"\n then show ?thesis by (metis Suc_lessD evtseq_no_evtent2 evtsys_not_eq_in_tran_aux1 p1 p3) \n qed\n qed\n\nlemma take_n_conjoin: \"\\\\ c \\ cs; n \\ length c; c1 = take n c; cs1 = (\\k. take n (cs k))\\ \n \\ \\ c1 \\ cs1\"\n proof -\n assume p0: \"\\ c \\ cs\"\n and p1: \"n \\ length c\"\n and p2: \"c1 = take n c\"\n and p3: \"cs1 = (\\k. take n (cs k))\"\n have a0: \"same_length c1 cs1\" by (metis conjoin_def length_take p0 p2 p3 same_length_def) \n then have a1: \"\\k. length (cs1 k) = length c1\" by (simp add:same_length_def)\n \n have \"same_state c1 cs1\"\n proof -\n {\n fix k j\n assume b0: \"j < length c1\"\n from p1 p3 a1 have b1: \"cs1 k = take n (cs k)\" by simp \n from p0 have b2[rule_format]: \"\\k j. j < length c \n \\ gets (c!j) = gets_es ((cs k)!j) \\ getx (c!j) = getx_es ((cs k)!j)\"\n by (simp add:conjoin_def same_state_def)\n from p2 b1 b0 have \"gets (c ! j) = gets (c1 ! j) \\ gets_es ((cs k)!j) = gets_es ((cs1 k)!j)\n \\ getx (c!j) = getx (c1!j)\"\n by (simp add: nth_append)\n with p1 p2 b1 b2[of j k] b0 have \"gets (c1!j) = gets_es ((cs1 k)!j) \\ getx (c1!j) = getx_es ((cs1 k)!j)\"\n by simp\n }\n then show ?thesis by (simp add:same_state_def)\n qed\n moreover\n have \"same_spec c1 cs1\" \n proof -\n {\n fix k j\n assume b0: \"j < length c1\"\n from p1 p3 a1 have b1: \"cs1 k = take n (cs k)\" by simp \n from p0 have b2[rule_format]: \"\\k j. j < length c \n \\ (getspc (c!j)) k = getspc_es ((cs k) ! j)\"\n by (simp add:conjoin_def same_spec_def)\n from p2 b1 b0 have \"getspc (c1!j) = getspc (c!j) \n \\ getspc_es ((cs k) ! j) = getspc_es ((cs1 k) ! j)\" \n by (simp add: nth_append)\n then have \"(getspc (c1!j)) k = getspc_es ((cs1 k) ! j)\"\n using b0 b2 p2 by auto \n }\n then show ?thesis by (simp add:same_spec_def)\n qed\n moreover\n have \"compat_tran \\ c1 cs1\"\n proof -\n {\n fix j\n assume b0: \"Suc j < length c1\"\n with p0 p2 have \"((\\t k. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j)) \\\n (\\k t. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\ (\\ \\ cs k!j -es-(t\\k)\\ cs k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!j -ese\\ cs k'! Suc j))))\n \\\n ((\\ \\ (c!j) -pese\\ (c!Suc j)) \\ (\\k. (\\ \\ ((cs k)!j) -ese\\ ((cs k)! Suc j))))\"\n by (simp add:conjoin_def compat_tran_def)\n moreover\n from p2 b0 have \"c!j = c1!j\" by simp\n moreover\n from p2 b0 have \"c!Suc j = c1!Suc j\" by simp\n moreover\n from p1 p2 p3 a1 b0 have \"\\k. cs1 k!j = cs k!j\"\n by (simp add: Suc_lessD) \n moreover\n from p1 p2 p3 a1 b0 have \"\\k. cs1 k!Suc j = cs k!Suc j\"\n by (simp add: Suc_lessD) \n ultimately\n have \"((\\t k. (\\ \\ c1!j -pes-(t\\k)\\ c1!Suc j)) \\\n (\\k t. (\\ \\ c1!j -pes-(t\\k)\\ c1!Suc j) \\ (\\ \\ cs1 k!j -es-(t\\k)\\ cs1 k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs1 k'!j -ese\\ cs1 k'! Suc j))))\n \\\n ((\\ \\ (c1!j) -pese\\ (c1!Suc j)) \\ (\\k. (\\ \\ ((cs1 k)!j) -ese\\ ((cs1 k)! Suc j))))\" by simp\n }\n then show ?thesis by (simp add:compat_tran_def)\n qed\n ultimately show ?thesis by (simp add:conjoin_def a0)\n qed\n\nlemma drop_n_conjoin: \"\\\\ c \\ cs; n \\ length c; c1 = drop n c; cs1 = (\\k. drop n (cs k))\\ \n \\ \\ c1 \\ cs1\"\n proof -\n assume p0: \"\\ c \\ cs\"\n and p1: \"n \\ length c\"\n and p2: \"c1 = drop n c\"\n and p3: \"cs1 = (\\k. drop n (cs k))\"\n have a0: \"same_length c1 cs1\" by (metis conjoin_def length_drop p0 p2 p3 same_length_def) \n then have a1: \"\\k. length (cs1 k) = length c1\" by (simp add:same_length_def)\n \n have \"same_state c1 cs1\"\n proof -\n {\n fix k j\n assume b0: \"j < length c1\"\n from p1 p3 a1 have b1: \"cs1 k = drop n (cs k)\" by simp \n from p0 have b2[rule_format]: \"\\k j. j < length c \n \\ gets (c!j) = gets_es ((cs k)!j) \\ getx (c!j) = getx_es ((cs k)!j)\"\n by (simp add:conjoin_def same_state_def)\n from p2 b1 b0 have \"gets (c ! (n + j)) = gets (c1 ! j) \\ gets_es ((cs k)!(n + j)) = gets_es ((cs1 k)!j)\n \\ getx (c!(n + j)) = getx (c1!j)\"\n proof -\n have f1: \"n + j \\ length c\"\n using b0 p2 by auto\n then have \"n + j \\ length (cs k)\"\n by (metis (no_types) conjoin_def p0 same_length_def)\n then show ?thesis\n using f1 by (simp add: b1 p2)\n qed\n \n with p1 p2 b1 b2[of \"n + j\" k] b0 have \"gets (c1!j) = gets_es ((cs1 k)!j) \\ getx (c1!j) = getx_es ((cs1 k)!j)\"\n by (smt a1 add_diff_cancel_left' drop_eq_Nil length_drop less_diff_conv2 list.size(3) \n nat_le_linear nat_neq_iff not_less_zero nth_drop order.asym semiring_normalization_rules(24))\n \n }\n then show ?thesis by (simp add:same_state_def)\n qed\n moreover\n have \"same_spec c1 cs1\" \n proof -\n {\n fix k j\n assume b0: \"j < length c1\"\n from p1 p3 a1 have b1: \"cs1 k = drop n (cs k)\" by simp \n from p0 have b2[rule_format]: \"\\k j. j < length c \n \\ (getspc (c!j)) k = getspc_es ((cs k) ! j)\"\n by (simp add:conjoin_def same_spec_def)\n from p2 b1 b0 have \"getspc (c1!j) = getspc (c!(n+j)) \n \\ getspc_es ((cs k) ! (n+j)) = getspc_es ((cs1 k) ! j)\" \n proof -\n have f1: \"n + j \\ length c\"\n using b0 p2 by auto\n then have \"n + j \\ length (cs k)\"\n by (metis (no_types) conjoin_def p0 same_length_def)\n then show ?thesis\n using f1 by (simp add: b1 p2)\n qed\n then have \"(getspc (c1!j)) k = getspc_es ((cs1 k) ! j)\"\n using b0 b2 p2 by auto \n }\n then show ?thesis by (simp add:same_spec_def)\n qed\n moreover\n have \"compat_tran \\ c1 cs1\"\n proof -\n {\n fix j\n assume b0: \"Suc j < length c1\"\n with p0 p2 have \"((\\t k. (\\ \\ c!(n+j) -pes-(t\\k)\\ c!Suc (n+j))) \\\n (\\k t. (\\ \\ c!(n+j) -pes-(t\\k)\\ c!Suc (n+j)) \\ (\\ \\ cs k!(n+j) -es-(t\\k)\\ cs k! Suc (n+j)) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!(n+j) -ese\\ cs k'! Suc (n+j)))))\n \\\n ((\\ \\ (c!(n+j)) -pese\\ (c!Suc (n+j))) \\ (\\k. (\\ \\ ((cs k)!(n+j)) -ese\\ ((cs k)! Suc (n+j)))))\"\n by (simp add:conjoin_def compat_tran_def)\n moreover\n from p2 b0 have \"c!(n+j) = c1!j\" by simp\n moreover\n from p2 b0 have \"c!Suc (n+j) = c1!Suc j\" by simp\n moreover\n from p1 p2 p3 a1 b0 have \"\\k. cs1 k!j = cs k!(n+j)\"\n by (metis drop_eq_Nil length_greater_0_conv less_imp_Suc_add linear nth_drop zero_less_Suc)\n moreover\n from p1 p2 p3 a1 b0 have \"\\k. cs1 k!Suc j = cs k!Suc (n+j)\"\n by (smt Suc_lessE add_Suc_right drop_eq_Nil length_greater_0_conv linear nth_drop zero_less_Suc)\n ultimately\n have \"((\\t k. (\\ \\ c1!j -pes-(t\\k)\\ c1!Suc j)) \\\n (\\k t. (\\ \\ c1!j -pes-(t\\k)\\ c1!Suc j) \\ (\\ \\ cs1 k!j -es-(t\\k)\\ cs1 k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs1 k'!j -ese\\ cs1 k'! Suc j))))\n \\\n ((\\ \\ (c1!j) -pese\\ (c1!Suc j)) \\ (\\k. (\\ \\ ((cs1 k)!j) -ese\\ ((cs1 k)! Suc j))))\" by simp\n }\n then show ?thesis by (simp add:compat_tran_def)\n qed\n ultimately show ?thesis by (simp add:conjoin_def a0)\n qed\n\nlemma conjoin_imp_cptses_k_help: \"\\c \\ cpts_pes \\\\ \\ \n \\cs k. \\ c \\ cs \\ (cs k \\ cpts_es \\)\" \n proof -\n assume p0: \"c \\ cpts_pes \\\"\n {\n fix k\n from p0 have \"\\cs. c \\ cpts_pes \\ \\ \\ c \\ cs \\ (cs k \\ cpts_es \\)\"\n proof(induct c)\n case (CptsPesOne pes s x)\n\n {\n fix cs\n assume a0: \"\\ [(pes, s, x)] \\ cs\"\n then have p3:\"length (cs k) = 1\" by (simp add:conjoin_def same_length_def)\n from a0 have p5: \"same_spec [(pes, s, x)] cs \\ same_state [(pes, s, x)] cs\" by (simp add:conjoin_def)\n with a0 p3 have \"cs k ! 0 = (pes k, s, x)\" \n using esconf_trip pesconf_trip same_spec_def same_state_def\n by (metis One_nat_def length_Cons list.size(3) nth_Cons_0 prod.sel(1) prod.sel(2) zero_less_one) \n with p3 have \"cs k \\ cpts_es \\\"\n by (metis (no_types, hide_lams) One_nat_def Suc_less_eq cpts_es.CptsEsOne length_0_conv length_Cons neq0_conv neq_Nil_conv prod_cases3)\n }\n then show ?case by auto\n next\n case (CptsPesEnv pes t x xs s y)\n assume a0: \"(pes, t, x) # xs \\ cpts_pes \\\"\n and a1[rule_format]: \"\\cs. (pes, t, x) # xs \\ cpts_pes \\ \\ \\ (pes, t, x) # xs \\ cs \\ cs k \\ cpts_es \\\"\n {\n fix cs\n assume b0: \"(pes, s, y) # (pes, t, x) # xs \\ cpts_pes \\\"\n and b1: \"\\ (pes, s, y) # (pes, t, x) # xs \\ cs\"\n let ?esl = \"(pes, t, x) # xs\"\n let ?esllon = \"(pes, s, y) # (pes, t, x) # xs\"\n let ?cs = \"(\\k. drop 1 (cs k))\"\n from b1 have \"\\ ?esl \\ ?cs\" using drop_n_conjoin[of \\ ?esllon cs 1 ?esl ?cs] by auto\n with a0 a1[of ?cs] have b2: \"?cs k \\ cpts_es \\\" by simp\n from b1 have b3: \"cs k ! 0 = (pes k, s, y)\" \n using conjoin_def[of \\ ?esllon cs] same_state_def[of ?esllon cs] same_spec_def[of ?esllon cs]\n by (metis esconf_trip gets_def getspc_def getx_def length_greater_0_conv \n list.simps(3) nth_Cons_0 prod.sel(1) prod.sel(2)) \n\n from b1 have \"getspc_es (cs k ! 1) = (getspc (?esllon ! 1)) k\" \n using conjoin_def[of \\ ?esllon cs] same_spec_def[of ?esllon cs]\n by (metis diff_Suc_1 length_Cons zero_less_Suc zero_less_diff) \n moreover\n from b1 have \"gets (?esllon ! 1) = gets_es ((cs k)!1) \\ getx (?esllon ! 1) = getx_es ((cs k)!1)\"\n using conjoin_def[of \\ ?esllon cs] same_state_def[of ?esllon cs]\n diff_Suc_1 length_Cons zero_less_Suc zero_less_diff by fastforce\n ultimately have \"cs k ! 1 = (pes k, t, x)\" \n using b0 getspc_def gets_def getx_def\n by (metis One_nat_def esconf_trip fst_conv nth_Cons_0 nth_Cons_Suc snd_conv) \n \n with b2 b3 have \"cs k \\ cpts_es \\\" using CptsEsEnv\n by (metis Cons_nth_drop_Suc One_nat_def Suc_lessD cpts_es_not_empty \n drop_0 drop_eq_Nil not_le) \n }\n then show ?case by auto\n next\n case (CptsPesComp pes1 s y ct pes2 t x xs)\n assume a0: \"\\ \\ (pes1, s, y) -pes-ct\\ (pes2, t, x)\"\n and a1: \"(pes2, t, x) # xs \\ cpts_pes \\\"\n and a2[rule_format]: \"\\cs. (pes2, t, x) # xs \\ cpts_pes \\ \\ \\ (pes2, t, x) # xs \\ cs \\ cs k \\ cpts_es \\\"\n {\n fix cs\n assume b0: \"(pes1, s, y) # (pes2, t, x) # xs \\ cpts_pes \\\"\n and b1: \"\\ (pes1, s, y) # (pes2, t, x) # xs \\ cs\"\n let ?esl = \"(pes2, t, x) # xs\"\n let ?esllon = \"(pes1, s, y) # (pes2, t, x) # xs\"\n let ?cs = \"(\\k. drop 1 (cs k))\"\n from b1 have \"\\ ?esl \\ ?cs\" using drop_n_conjoin[of \\ ?esllon cs 1 ?esl ?cs] by auto\n with a1 a2[of ?cs] have b2: \"?cs k \\ cpts_es \\\" by simp\n from b1 have b3: \"cs k ! 0 = (pes1 k, s, y)\" \n using conjoin_def[of \\ ?esllon cs] same_state_def[of ?esllon cs] same_spec_def[of ?esllon cs]\n by (metis esconf_trip gets_def getspc_def getx_def length_greater_0_conv \n list.simps(3) nth_Cons_0 prod.sel(1) prod.sel(2)) \n\n from b1 have \"getspc_es (cs k ! 1) = (getspc (?esllon ! 1)) k\" \n using conjoin_def[of \\ ?esllon cs] same_spec_def[of ?esllon cs]\n by (metis diff_Suc_1 length_Cons zero_less_Suc zero_less_diff) \n moreover\n from b1 have \"gets (?esllon ! 1) = gets_es ((cs k)!1) \\ getx (?esllon ! 1) = getx_es ((cs k)!1)\"\n using conjoin_def[of \\ ?esllon cs] same_state_def[of ?esllon cs]\n diff_Suc_1 length_Cons zero_less_Suc zero_less_diff by fastforce\n ultimately have b4: \"cs k ! 1 = (pes2 k, t, x)\" \n using b0 getspc_def gets_def getx_def\n by (metis One_nat_def esconf_trip fst_conv nth_Cons_0 nth_Cons_Suc snd_conv) \n \n from b1 have \"compat_tran \\ ?esllon cs\" by (simp add:conjoin_def)\n then have \"((\\t k. (\\ \\ ?esllon!0 -pes-(t\\k)\\ ?esllon!Suc 0)) \\\n (\\k t. (\\ \\ ?esllon!0 -pes-(t\\k)\\ ?esllon!Suc 0) \\ (\\ \\ cs k!0 -es-(t\\k)\\ cs k! Suc 0) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!0 -ese\\ cs k'! Suc 0))))\n \\\n ((\\ \\ (?esllon!0) -pese\\ (?esllon!Suc 0)) \\ (\\k. (\\ \\ ((cs k)!0) -ese\\ ((cs k)! Suc 0))))\"\n using compat_tran_def[of \\ ?esllon cs] by fastforce\n then have \"cs k \\ cpts_es \\\" \n proof\n assume c0: \"(\\t k. (\\ \\ ?esllon!0 -pes-(t\\k)\\ ?esllon!Suc 0)) \\\n (\\k t. (\\ \\ ?esllon!0 -pes-(t\\k)\\ ?esllon!Suc 0) \\ (\\ \\ cs k!0 -es-(t\\k)\\ cs k! Suc 0) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!0 -ese\\ cs k'! Suc 0)))\"\n then obtain t1 and k1 where c1: \"(\\ \\ ?esllon!0 -pes-(t1\\k1)\\ ?esllon!Suc 0)\" by auto\n with c0 have c2: \"(\\ \\ cs k1!0 -es-(t1\\k1)\\ cs k1! Suc 0) \\\n (\\k'. k' \\ k1 \\ (\\ \\ cs k'!0 -ese\\ cs k'! Suc 0))\" by auto\n show ?thesis\n proof(cases \"k = k1\")\n assume d0: \"k = k1\"\n with c2 have \"(\\ \\ cs k!0 -es-(t1\\k)\\ cs k! Suc 0)\" by auto\n with b2 b3 b4 show ?thesis using CptsEsComp\n by (metis Cons_nth_drop_Suc One_nat_def Suc_lessD cpts_es_not_empty drop_0 drop_eq_Nil not_le)\n next\n assume d0: \"k \\ k1\"\n with c2 have \"\\ \\ cs k!0 -ese\\ cs k! Suc 0\" by auto\n with b2 b3 b4 show ?thesis using CptsEsEnv\n by (metis Cons_nth_drop_Suc One_nat_def Suc_lessD cpts_es_not_empty \n drop_0 drop_eq_Nil esetran_eqconf not_le) \n qed\n next\n assume c0: \"(\\ \\ (?esllon!0) -pese\\ (?esllon!Suc 0)) \\ (\\k. (\\ \\ ((cs k)!0) -ese\\ ((cs k)! Suc 0)))\"\n then have \"\\ \\ ((cs k)!0) -ese\\ ((cs k)! Suc 0)\" by simp\n with b2 b3 b4 show ?thesis using CptsEsEnv a0 c0 pes_tran_not_etran1 by fastforce \n qed\n }\n then show ?case by auto\n qed\n }\n with p0 show ?thesis by simp \n qed\n\nlemma conjoin_imp_cptses_k: \n \"\\c \\ cpts_of_pes \\ pes s x; \\ c \\ cs\\ \n \\ cs k \\ cpts_of_es \\ (pes k) s x\" \n proof -\n assume p0: \"c \\ cpts_of_pes \\ pes s x\"\n and p1: \"\\ c \\ cs\"\n from p0 have a1: \"c\\cpts_pes \\ \\ c!0 = (pes,s,x)\" by (simp add:cpts_of_pes_def)\n from a1 p1 have \"cs k \\ cpts_es \\\" using conjoin_imp_cptses_k_help by auto\n moreover\n from p0 p1 have \"cs k ! 0 = (pes k,s,x)\"\n by (metis a1 conjoin_def cpts_pes_not_empty esconf_trip fst_conv gets_def \n getspc_def getx_def length_greater_0_conv same_spec_def same_state_def snd_conv) \n ultimately show ?thesis by (simp add:cpts_of_es_def)\n qed\n\nsubsubsection \\Semantics is Compositional\\\n\nlemma conjoin_cs_imp_cpt: \"\\\\k p. pes k = p; (\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs)\\\n \\ c \\ cpts_of_pes \\ pes s x\"\n proof -\n assume p0: \"\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs\"\n and p1: \"\\k p. pes k = p\"\n then obtain cs where \"(\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs\" by auto\n then have a0: \"(\\k. (cs k)!0=(pes k,s,x) \\ (cs k) \\ cpts_es \\) \\ \\ c \\ cs\" by (simp add:cpts_of_es_def)\n from p1 obtain p and k where a1: \"pes k = p\" by auto\n\n from p1 obtain k and p where \"pes k = p\" by auto\n with a0 have a2: \"(cs k)!0=(pes k,s,x) \\ (cs k) \\ cpts_es \\\" by auto\n then have \"(cs k) \\ []\" by auto\n moreover\n from a0 have \"same_length c cs\" by (simp add:conjoin_def)\n ultimately have a3: \"c \\ []\" using same_length_def by force \n\n have g0: \"c!0 = (pes,s,x)\"\n proof -\n from a3 a0 have \"same_spec c cs\" by (simp add:conjoin_def)\n with a3 have b2: \"\\k. (getspc (c!0)) k = getspc_es ((cs k) ! 0)\" by (simp add:same_spec_def)\n with a0 have \"\\k. (getspc (c!0)) k = pes k\" by (simp add:getspc_es_def)\n then have b3: \"getspc (c!0) = pes\" by auto\n\n from a0 have \"same_state c cs\" by (simp add:conjoin_def)\n with a3 have \"gets (c!0) = gets_es ((cs k)!0) \\ getx (c!0) = getx_es ((cs k)!0)\" \n by (simp add:same_state_def)\n with a2 have \"gets (c!0) = s \\ getx (c!0) = x\" \n by (simp add:gets_def getx_def gets_es_def getx_es_def)\n with b3 show ?thesis using gets_def getx_def getspc_def by (metis prod.collapse)\n qed\n have \"\\i. i > 0 \\ i \\ length c \\ take i c \\ cpts_pes \\\"\n proof -\n {\n fix i\n assume b0: \"i > 0 \\ i \\ length c\"\n then have \"take i c \\ cpts_pes \\\"\n proof(induct i)\n case 0 show ?case using \"0.prems\" by auto \n next\n case (Suc j)\n assume c0: \"0 < j \\ j \\ length c \\ take j c \\ cpts_pes \\\"\n and c1: \"0 < Suc j \\ Suc j \\ length c\"\n show ?case\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n with c0 show ?case by (simp add: a3 cpts_pes.CptsPesOne g0 hd_conv_nth take_Suc) \n next\n assume d0: \"j \\ 0\"\n from a0 have d1: \"compat_tran \\ c cs\" by (simp add:conjoin_def)\n then have d2: \"\\j. Suc j < length c \\ \n (\\t k. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\\n (\\k t. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\ (\\ \\ cs k!j -es-(t\\k)\\ cs k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!j -ese\\ cs k'! Suc j))))\n \\\n ((\\ \\ (c!j) -pese\\ (c!Suc j)) \\ (\\k. (\\ \\ ((cs k)!j) -ese\\ ((cs k)! Suc j))))\"\n by (simp add:compat_tran_def)\n \n from d0 have d3: \"j - 1 \\ 0\" by simp\n from c1 have d6: \"Suc (j - 1) < length c\" using d0 by auto \n \n with d3 have d4: \"(\\t k. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\\n (\\k t. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\ (\\ \\ cs k!(j-1) -es-(t\\k)\\ cs k! Suc (j-1)) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!(j-1) -ese\\ cs k'! Suc (j-1)))))\n \\\n ((\\ \\ (c!(j-1)) -pese\\ (c!Suc (j-1))) \\ (\\k. (\\ \\ ((cs k)!(j-1)) -ese\\ ((cs k)!Suc (j-1)))))\"\n using d2 by auto\n from c0 c1 d0 have d5: \"take j c \\ cpts_pes \\\" by auto\n from d4 show ?case\n proof \n assume \"(\\t k. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\\n (\\k t. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\ (\\ \\ cs k!(j-1) -es-(t\\k)\\ cs k! Suc (j-1)) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!(j-1) -ese\\ cs k'! Suc (j-1)))))\"\n then obtain t and k where e0: \"(\\ \\ (c!(j-1)) -pes-(t\\k)\\ (c!Suc (j-1)))\" by auto\n then have \"\\ \\ ((take j c) ! (length (take j c) - 1)) -pes-(t\\k)\\ (c!Suc (j-1))\"\n by (metis (no_types, lifting) Suc_diff_1 Suc_leD Suc_lessD \n d6 butlast_take c1 d0 length_butlast neq0_conv nth_append_length take_Suc_conv_app_nth) \n with d5 have \"(take j c) @ [c!Suc (j-1)] \\ cpts_pes \\\" using cpts_pes_onemore by blast\n then show ?thesis using d0 d6 take_Suc_conv_app_nth by fastforce\n next\n assume \"(\\ \\ (c!(j-1)) -pese\\ (c!Suc (j-1))) \\ (\\k. (\\ \\ ((cs k)!(j-1)) -ese\\ ((cs k)!Suc (j-1))))\"\n then have \"\\ \\ ((take j c) ! (length (take j c) - 1)) -pese\\ (c!Suc (j-1))\" \n by (metis (no_types, lifting) Suc_diff_1 Suc_leD Suc_lessD \n d6 butlast_take c1 d0 length_butlast neq0_conv nth_append_length take_Suc_conv_app_nth) \n with d5 have \"(take j c) @ [c!Suc (j-1)] \\ cpts_pes \\\" using cpts_pes_onemore by blast\n then show ?thesis using d0 d6 take_Suc_conv_app_nth by fastforce\n qed\n \n qed\n qed\n }\n then show ?thesis by auto\n qed\n\n with a3 have g1: \"c\\cpts_pes \\\" by auto\n from g0 g1 show ?thesis by (simp add:cpts_of_pes_def)\n qed\n\nlemma comp_tran_env: \"\\(\\k. cs k \\ cpts_of_es \\ (pes k) t1 x1); c = (pes, t1, x1) # xs; c\\cpts_pes \\; \n \\ c \\ cs; c' = (pes, s1, y1) # (pes, t1, x1) # xs\\ \\ \n compat_tran \\ c' (\\k. (pes k, s1, y1) # cs k)\"\n proof -\n let ?cs' = \"\\k. (pes k, s1, y1) # cs k\"\n assume p0: \"\\k. cs k \\ cpts_of_es \\ (pes k) t1 x1\"\n and p1: \"c \\ cpts_pes \\\"\n and p2: \"\\ c \\ cs\"\n and p3: \"c' = (pes, s1, y1) # (pes, t1, x1) # xs\"\n and p4: \"c = (pes, t1, x1) # xs\"\n from p0 have b3: \"\\k. cs k \\ cpts_es \\ \\ (cs k)!0 = (pes k,t1,x1)\" by (simp add:cpts_of_es_def)\n show \"compat_tran \\ c' ?cs'\"\n proof -\n {\n fix j\n assume dd0: \"Suc j < length c'\"\n have \"(\\t k. (\\ \\ (c'!j) -pes-(t\\k)\\ (c'!Suc j)) \\\n (\\k t. (\\ \\ c'!j -pes-(t\\k)\\ c'!Suc j) \\ (\\ \\ ?cs' k!j -es-(t\\k)\\ ?cs' k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ ?cs' k'!j -ese\\ ?cs' k'! Suc j))))\n \\\n ((\\ \\ (c'!j) -pese\\ (c'!Suc j)) \\ (\\k. (\\ \\ ((?cs' k)!j) -ese\\ ((?cs' k)! Suc j))))\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n from p3 have \"(\\ \\ (c'!0) -pese\\ (c'!1))\"\n by (simp add: pesetran.intros) \n moreover\n have \"\\k. (\\ \\ ((?cs' k)!0) -ese\\ ((?cs' k)!1))\"\n by (simp add: b3 esetran.intros) \n ultimately show ?thesis using d0 by simp\n next\n assume d0: \"j \\ 0\"\n then have d0_1: \"j > 0\" by simp\n from p2 have \"compat_tran \\ c cs\" by (simp add:conjoin_def)\n then have d1: \"\\j. Suc j < length c \\ \n (\\t k. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\\n (\\k t. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\ (\\ \\ cs k!j -es-(t\\k)\\ cs k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!j -ese\\ cs k'! Suc j))))\n \\\n ((\\ \\ (c!j) -pese\\ (c!Suc j)) \\ (\\k. (\\ \\ ((cs k)!j) -ese\\ ((cs k)! Suc j))))\"\n by (simp add:compat_tran_def)\n from p3 p4 dd0 d0 have d2: \"Suc (j-1) < length c\" by auto\n let ?j1 = \"j - 1\"\n from d1 d2 have d3: \"(\\t k. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\\n (\\k t. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\ (\\ \\ cs k!(j-1) -es-(t\\k)\\ cs k! Suc (j-1)) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!(j-1) -ese\\ cs k'! Suc (j-1)))))\n \\\n ((\\ \\ (c!(j-1)) -pese\\ (c!Suc (j-1))) \\ (\\k. (\\ \\ ((cs k)!(j-1)) -ese\\ ((cs k)!Suc (j-1)))))\"\n by auto\n from p3 p4 d0 dd0 have d4: \"c'!j = c!(j-1) \\ c'!Suc j = c!Suc (j-1)\" by simp\n have d5: \"(\\k. (?cs' k) ! j= (cs k)! (j-1)) \\ (\\k. (?cs' k) ! Suc j= (cs k)! Suc (j-1))\" \n by (simp add: d0_1) \n with d3 d4 show ?thesis by auto\n qed\n \n }\n then show ?thesis by (simp add:compat_tran_def)\n qed\n qed\n\nlemma comp_tran_pestran: \"\\(\\k. cs k \\ cpts_of_es \\ (pes2 k) t1 x1); c = (pes2, t1, x1) # xs; c\\cpts_pes \\; \n \\ c \\ cs; c' = (pes1, s1, y1) # (pes2, t1, x1) # xs; \\ \\ (pes1, s1, y1) -pes-ct\\ (pes2, t1, x1)\\\n \\ compat_tran \\ c' (\\k. (pes1 k, s1, y1) # cs k)\"\n proof -\n let ?cs' = \"\\k. (pes1 k, s1, y1) # cs k\"\n assume p0: \"\\k. cs k \\ cpts_of_es \\ (pes2 k) t1 x1\"\n and p1: \"c \\ cpts_pes \\\"\n and p2: \"\\ c \\ cs\"\n and p3: \"c' = (pes1, s1, y1) # (pes2, t1, x1) # xs\"\n and p4: \"c = (pes2, t1, x1) # xs\"\n and p5: \"\\ \\ (pes1, s1, y1) -pes-ct\\ (pes2, t1, x1)\"\n from p0 have b3: \"\\k. cs k \\ cpts_es \\ \\ (cs k)!0 = (pes2 k,t1,x1)\" by (simp add:cpts_of_es_def)\n show \"compat_tran \\ c' ?cs'\"\n proof -\n {\n fix j\n assume dd0: \"Suc j < length c'\"\n have \"(\\t k. (\\ \\ (c'!j) -pes-(t\\k)\\ (c'!Suc j)) \\\n (\\k t. (\\ \\ c'!j -pes-(t\\k)\\ c'!Suc j) \\ (\\ \\ ?cs' k!j -es-(t\\k)\\ ?cs' k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ ?cs' k'!j -ese\\ ?cs' k'! Suc j))))\n \\\n ((\\ \\ (c'!j) -pese\\ (c'!Suc j)) \\ (\\k. (\\ \\ ((?cs' k)!j) -ese\\ ((?cs' k)! Suc j))))\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n from p5 obtain k and aa where c0: \"ct = (aa\\k)\" using get_actk_def by (metis cases) \n with p5 have \"\\es'. (\\ \\ (pes1 k, s1, y1) -es-(aa\\k)\\ (es', t1, x1)) \\ pes2 = pes1(k:=es')\" \n using pestran_estran by auto\n then obtain es' where c1: \"(\\ \\ (pes1 k, s1, y1) -es-(aa\\k)\\ (es', t1, x1)) \\ pes2 = pes1(k:=es')\"\n by auto\n from b3 have c2: \"cs k \\cpts_es \\ \\ (cs k)!0 = (pes2 k,t1,x1)\" by auto\n then obtain xs1 where c4: \"(cs k) = (pes2 k,t1,x1)#xs1\"\n by (metis cpts_es_not_empty neq_Nil_conv nth_Cons_0) \n then have c3: \"?cs' k = (pes1 k, s1, y1) # (pes2 k,t1,x1)#xs1\" by simp\n\n from p3 p5 c0 have g0: \"\\ \\ (c'!0) -pes-(aa\\k)\\ (c'!Suc 0)\" by auto\n moreover\n have \"\\k1 t1. (\\ \\ c'!0 -pes-(t1\\k1)\\ c'!Suc 0) \\ (\\ \\ ?cs' k1!0 -es-(t1\\k1)\\ ?cs' k1! Suc 0) \\\n (\\k'. k' \\ k1 \\ (\\ \\ ?cs' k'!0 -ese\\ ?cs' k'! Suc 0))\"\n proof -\n {\n fix k1 t1\n assume d0: \"\\ \\ c'!0 -pes-(t1\\k1)\\ c'!Suc 0\"\n with p3 have \"\\ \\ ?cs' k1!0 -es-(t1\\k1)\\ ?cs' k1! Suc 0\"\n using b3 fun_upd_apply nth_Cons_0 nth_Cons_Suc pestran_estran by fastforce\n moreover\n from d0 have \"\\k'. k' \\ k1 \\ (\\ \\ ?cs' k'!0 -ese\\ ?cs' k'! Suc 0)\"\n using b3 esetran.intros fun_upd_apply nth_Cons_0 nth_Cons_Suc p3 pestran_estran by fastforce\n ultimately have \"(\\ \\ c'!0 -pes-(t1\\k1)\\ c'!Suc 0) \\ (\\ \\ ?cs' k1!0 -es-(t1\\k1)\\ ?cs' k1! Suc 0) \\\n (\\k'. k' \\ k1 \\ (\\ \\ ?cs' k'!0 -ese\\ ?cs' k'! Suc 0))\" by simp\n }\n then show ?thesis by auto\n qed\n ultimately show ?thesis using d0 by auto\n next\n assume d0: \"j \\ 0\"\n then have d0_1: \"j > 0\" by simp\n from p2 have \"compat_tran \\ c cs\" by (simp add:conjoin_def)\n then have d1: \"\\j. Suc j < length c \\ \n (\\t k. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\\n (\\k t. (\\ \\ c!j -pes-(t\\k)\\ c!Suc j) \\ (\\ \\ cs k!j -es-(t\\k)\\ cs k! Suc j) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!j -ese\\ cs k'! Suc j))))\n \\\n ((\\ \\ (c!j) -pese\\ (c!Suc j)) \\ (\\k. (\\ \\ ((cs k)!j) -ese\\ ((cs k)! Suc j))))\"\n by (simp add:compat_tran_def)\n from p3 p4 dd0 d0 have d2: \"Suc (j-1) < length c\" by auto\n with d0 d0_1 d1 have d3: \"(\\t k. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\\n (\\k t. (\\ \\ c!(j-1) -pes-(t\\k)\\ c!Suc (j-1)) \\ (\\ \\ cs k!(j-1) -es-(t\\k)\\ cs k! Suc (j-1)) \\\n (\\k'. k' \\ k \\ (\\ \\ cs k'!(j-1) -ese\\ cs k'! Suc (j-1)))))\n \\\n ((\\ \\ (c!(j-1)) -pese\\ (c!Suc (j-1))) \\ (\\k. (\\ \\ ((cs k)!(j-1)) -ese\\ ((cs k)!Suc (j-1)))))\"\n by blast\n from p3 p4 d0 dd0 have d4: \"c'!j = c!(j-1) \\ c'!Suc j = c!Suc (j-1)\" by simp\n have d5: \"(\\k. (?cs' k) ! j= (cs k)! (j-1)) \\ (\\k. (?cs' k) ! Suc j= (cs k)! Suc (j-1))\" \n by (simp add: d0_1) \n with d3 d4 show ?thesis by auto\n qed\n \n }\n then show ?thesis by (simp add:compat_tran_def)\n qed\n qed\n\nlemma cpt_imp_exist_conjoin_cs0: \n \"\\c. c \\ cpts_pes \\ \\\n (\\cs. (\\k. (cs k) \\ cpts_of_es \\ ((getspc (c!0)) k) (gets (c!0)) (getx (c!0))) \\ \\ c \\ cs)\"\n proof -\n {\n fix c\n assume p0: \"c \\ cpts_pes \\\"\n then have \"\\cs. (\\k. (cs k) \\ cpts_of_es \\ ((getspc (c!0)) k) (gets (c!0)) (getx (c!0))) \\ \\ c \\ cs\"\n proof(induct c)\n case (CptsPesOne pes1 s1 x1)\n let ?cs = \"\\k. [(pes1 k, s1,x1)]\" \n let ?c = \"[(pes1, s1, x1)]\"\n have \"\\k. ?cs k \\ cpts_of_es \\ (getspc (?c ! 0) k) (gets (?c ! 0)) (getx (?c ! 0))\"\n proof -\n {\n fix k\n have \"?cs k = [(pes1 k,s1,x1)]\" by simp\n moreover\n have \"?cs k \\ cpts_es \\\" by (simp add: cpts_es.CptsEsOne) \n ultimately have \"?cs k \\ cpts_of_es \\ (pes1 k) s1 x1\" by (simp add: cpts_of_es_def)\n }\n then show ?thesis by (simp add: gets_def getspc_def getx_def) \n qed\n moreover\n have \"\\ ?c \\ ?cs\"\n proof -\n have \"same_length ?c ?cs\" by (simp add: same_length_def) \n moreover\n have \"same_state ?c ?cs\" using same_state_def gets_def gets_es_def getx_def getx_es_def\n by (smt length_Cons less_Suc0 list.size(3) nth_Cons_0 snd_conv) \n moreover\n have \"same_spec ?c ?cs\" using same_spec_def getspc_def getspc_es_def\n by (metis (mono_tags, lifting) fst_conv length_Cons less_Suc0 list.size(3) nth_Cons_0)\n moreover\n have \"compat_tran \\ ?c ?cs\" by (simp add: compat_tran_def) \n ultimately show ?thesis by (simp add:conjoin_def)\n qed\n ultimately show ?case by auto\n next\n case (CptsPesEnv pes1 t1 x1 xs s1 y1)\n let ?c = \"(pes1, t1, x1) # xs\"\n assume b0: \"?c\\ cpts_pes \\\"\n and b1: \"\\cs. (\\k. cs k \\ cpts_of_es \\ (getspc (?c ! 0) k) (gets (?c ! 0))\n (getx (?c ! 0))) \\ \\ ?c \\ cs\"\n then obtain cs where b2: \"(\\k. cs k \\ cpts_of_es \\ (pes1 k) t1 x1) \\ \\ ?c \\ cs\" \n using getspc_def gets_def getx_def by (metis fst_conv nth_Cons_0 snd_conv) \n then have b3: \"\\k. cs k \\ cpts_es \\ \\ (cs k)!0 = (pes1 k,t1,x1)\" by (simp add:cpts_of_es_def)\n let ?c' = \"(pes1, s1, y1) # (pes1, t1, x1) # xs\"\n let ?cs' = \"\\k. (pes1 k,s1,y1)#(cs k)\" \n have g0: \"\\k. ?cs' k \\ cpts_of_es \\ (getspc (?c' ! 0) k) (gets (?c' ! 0)) (getx (?c' ! 0))\" \n proof -\n {\n fix k\n from b3 have c0: \"cs k \\cpts_es \\ \\ (cs k)!0 = (pes1 k,t1,x1)\" by auto\n then obtain xs1 where \"(cs k) = (pes1 k,t1,x1)#xs1\"\n by (metis cpts_es_not_empty neq_Nil_conv nth_Cons_0) \n with c0 have c1: \"?cs' k \\ cpts_es \\\" by (simp add: cpts_es.CptsEsEnv) \n then have \"?cs' k \\ cpts_of_es \\ (getspc (?c' ! 0) k) (gets (?c' ! 0)) (getx (?c' ! 0))\" \n by (simp add: cpts_of_es_def gets_def getspc_def getx_def) \n }\n then show ?thesis by auto\n qed\n from b2 have b4: \"\\ ?c \\ cs\" by simp\n from b1 have g1: \"\\ ?c' \\ ?cs'\"\n proof -\n from b4 have \"same_length ?c' ?cs'\"\n by (simp add: conjoin_def same_length_def) \n moreover\n have \"same_state ?c' ?cs'\"\n proof -\n {\n fix k' j\n assume c0: \"j < length ?c'\"\n have \"gets (?c'!j) = gets_es ((?cs' k')!j) \\ getx (?c'!j) = getx_es ((?cs' k')!j)\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n then show ?thesis by (simp add:gets_def gets_es_def getx_def getx_es_def) \n next\n assume d0: \"j \\ 0\"\n with b4 show ?thesis using same_state_def gets_def gets_es_def getx_def getx_es_def\n using c0 conjoin_def length_Cons less_Suc_eq_0_disj nth_Cons_Suc by fastforce\n qed\n }\n then show ?thesis by (simp add: same_state_def) \n qed\n\n moreover \n have \"same_spec ?c' ?cs'\"\n proof -\n {\n fix k' j\n assume c0: \"j < length ?c'\"\n have \"(getspc (?c'!j)) k' = getspc_es ((?cs' k') ! j)\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n then show ?thesis by (simp add:getspc_def getspc_es_def) \n next\n assume d0: \"j \\ 0\"\n with b4 show ?thesis using same_spec_def getspc_def getspc_es_def\n by (metis (no_types, lifting) Nat.le_diff_conv2 One_nat_def c0 conjoin_def \n less_Suc0 list.size(4) not_less nth_Cons')\n qed\n }\n then show ?thesis by (simp add: same_spec_def) \n qed\n moreover\n from b0 b2 b4 have \"compat_tran \\ ?c' ?cs'\" \n using comp_tran_env [of cs \\ pes1 t1 x1 ?c xs ?c' s1 y1] by simp\n ultimately show ?thesis by (simp add:conjoin_def)\n qed\n from g0 g1 show ?case by auto\n next\n case (CptsPesComp pes1 s1 y1 ct pes2 t1 x1 xs)\n let ?c = \"(pes2, t1, x1) # xs\"\n assume b0: \"?c\\ cpts_pes \\\"\n and b1: \"\\cs. (\\k. cs k \\ cpts_of_es \\ (getspc (?c ! 0) k) (gets (?c ! 0))\n (getx (?c ! 0))) \\ \\ ?c \\ cs\"\n and b00: \"\\ \\ (pes1, s1, y1) -pes-ct\\ (pes2, t1, x1)\"\n then obtain cs where b2: \"(\\k. cs k \\ cpts_of_es \\ (pes2 k) t1 x1) \\ \\ ?c \\ cs\" \n using getspc_def gets_def getx_def by (metis fst_conv nth_Cons_0 snd_conv) \n then have b3: \"\\k. cs k \\ cpts_es \\ \\ (cs k)!0 = (pes2 k,t1,x1)\" by (simp add:cpts_of_es_def)\n let ?c' = \"(pes1, s1, y1) # (pes2, t1, x1) # xs\"\n let ?cs' = \"\\k. (pes1 k,s1,y1)#(cs k)\" \n have g0: \"\\k. ?cs' k \\ cpts_of_es \\ (getspc (?c' ! 0) k) (gets (?c' ! 0)) (getx (?c' ! 0))\" \n proof -\n {\n fix k\n obtain ka and aa where c0: \"ct = (aa\\ka)\" using get_actk_def by (metis cases) \n with b00 have \"\\es'. (\\ \\ (pes1 ka, s1, y1) -es-(aa\\ka)\\ (es', t1, x1)) \\ pes2 = pes1(ka:=es')\" \n using pestran_estran by auto\n then obtain es' where c1: \"(\\ \\ (pes1 ka, s1, y1) -es-(aa\\ka)\\ (es', t1, x1)) \\ pes2 = pes1(ka:=es')\"\n by auto\n from b3 have c2: \"cs k \\cpts_es \\ \\ (cs k)!0 = (pes2 k,t1,x1)\" by auto\n then obtain xs1 where c4: \"(cs k) = (pes2 k,t1,x1)#xs1\"\n by (metis cpts_es_not_empty neq_Nil_conv nth_Cons_0) \n then have c3: \"?cs' k = (pes1 k, s1, y1) # (pes2 k,t1,x1)#xs1\" by simp\n have \"?cs' k \\ cpts_of_es \\ (getspc (?c' ! 0) k) (gets (?c' ! 0)) (getx (?c' ! 0))\" \n proof(cases \"k = ka\")\n assume d0: \"k = ka\"\n with c1 have \"\\ \\ (pes1 k, s1, y1) -es-(aa\\k)\\ (pes2 k, t1, x1)\" by auto\n with c2 c3 d0 have \"?cs' k \\ cpts_es \\\"\n using cpts_es.CptsEsComp by fastforce \n then show ?thesis by (simp add: cpts_of_es_def gets_def getspc_def getx_def)\n next\n assume d0: \"k \\ ka\"\n with c1 have \"pes1 k = pes2 k\" by simp\n with c2 c3 have d1: \"?cs' k \\ cpts_es \\\"\n by (simp add: cpts_es.CptsEsEnv) \n then show ?thesis by (simp add: cpts_of_es_def gets_def getspc_def getx_def) \n qed\n }\n then show ?thesis by auto\n qed\n from b2 have b4: \"\\ ?c \\ cs\" by simp\n from b1 have g1: \"\\ ?c' \\ ?cs'\"\n proof -\n from b4 have \"same_length ?c' ?cs'\"\n by (simp add: conjoin_def same_length_def) \n moreover\n have \"same_state ?c' ?cs'\"\n proof -\n {\n fix k' j\n assume c0: \"j < length ?c'\"\n have \"gets (?c'!j) = gets_es ((?cs' k')!j) \\ getx (?c'!j) = getx_es ((?cs' k')!j)\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n then show ?thesis by (simp add:gets_def gets_es_def getx_def getx_es_def) \n next \n assume d0: \"j \\ 0\"\n with b4 show ?thesis using same_state_def gets_def gets_es_def getx_def getx_es_def\n using c0 conjoin_def length_Cons less_Suc_eq_0_disj nth_Cons_Suc by fastforce\n qed\n }\n then show ?thesis by (simp add: same_state_def) \n qed\n\n moreover \n have \"same_spec ?c' ?cs'\"\n proof -\n {\n fix k' j\n assume c0: \"j < length ?c'\"\n have \"(getspc (?c'!j)) k' = getspc_es ((?cs' k') ! j)\"\n proof(cases \"j = 0\")\n assume d0: \"j = 0\"\n then show ?thesis by (simp add:getspc_def getspc_es_def) \n next\n assume d0: \"j \\ 0\"\n with b4 show ?thesis using same_spec_def getspc_def getspc_es_def\n by (metis (no_types, lifting) Nat.le_diff_conv2 One_nat_def Suc_leI c0 conjoin_def \n list.size(4) neq0_conv not_less nth_Cons')\n qed\n }\n then show ?thesis by (simp add: same_spec_def) \n qed\n moreover\n from b0 b00 b2 b4 have \"compat_tran \\ ?c' ?cs'\" \n using comp_tran_pestran [of cs \\ pes2 t1 x1 ?c xs ?c' pes1 s1 y1 ct] by simp\n\n ultimately show ?thesis by (simp add:conjoin_def)\n qed\n from g0 g1 show ?case by auto\n qed\n \n }\n then show ?thesis by (metis (mono_tags, lifting)) \n qed\n\n\nlemma cpt_imp_exist_conjoin_cs: \"c \\ cpts_of_pes \\ pes s x\n \\ \\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs\"\n proof -\n assume p0: \"c \\ cpts_of_pes \\ pes s x\"\n then have \"c!0=(pes,s,x) \\ c \\ cpts_pes \\\" by (simp add:cpts_of_pes_def)\n then show ?thesis \n using cpt_imp_exist_conjoin_cs0 getspc_def gets_def getx_def\n by (metis fst_conv snd_conv) \n qed\n\ntheorem par_evtsys_semantics_comp: \n \"cpts_of_pes \\ pes s x = {c. \\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs}\"\n proof -\n have \"\\c. c\\cpts_of_pes \\ pes s x \\ (\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs)\"\n proof -\n {\n fix c\n assume a0: \"c\\cpts_of_pes \\ pes s x\"\n then have \"\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs\"\n using cpt_imp_exist_conjoin_cs cpts_of_pes_def getx_def mem_Collect_eq prod.sel(2) by fastforce \n }\n then show ?thesis by auto\n qed\n moreover\n have \"\\c. (\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs) \\ c\\cpts_of_pes \\ pes s x\"\n proof -\n {\n fix c\n assume a0: \"\\cs. (\\k. (cs k) \\ cpts_of_es \\ (pes k) s x) \\ \\ c \\ cs\"\n then have \"c\\cpts_of_pes \\ pes s x\"\n using conjoin_cs_imp_cpt by fastforce \n }\n then show ?thesis by auto\n qed\n ultimately show ?thesis by auto\n qed\n\nend\n\nend (*end of theory Computation*)", "meta": {"author": "SunHuan321", "repo": "uc-OS-verification", "sha": "760e159857c4015d6a9e3ccbe9f8247e4518862a", "save_path": "github-repos/isabelle/SunHuan321-uc-OS-verification", "path": "github-repos/isabelle/SunHuan321-uc-OS-verification/uc-OS-verification-760e159857c4015d6a9e3ccbe9f8247e4518862a/PiCore/PiCore_Computation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5234203489363242, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.25149231732029925}} {"text": "(*\n\nCopyright (c) 2017, ETH Zurich\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\nON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\n(* ######################################################################### *) \nchapter \"Exception Handler for the MIPS R4600\"\n(* ######################################################################### *)\n\n\n(*<*)\ntheory MipsTLBReplacementHandler\n imports MipsTLB MipsTLBPageTable \nbegin\n(*>*)\n\ntext \"This is a non-deterministic model of a TLB with replacement handler\n for the MIPS R4600 TLB model.\"\n\n \n(* ========================================================================= *) \nsection \"MIPS TLB + MIPS PageTables\"\n(* ========================================================================= *) \n \ntext \"We define the the TLB + page table combinations as a record of a TLB\n instance and a page table instance where the TLB entries will always \n be filled based on the entries of the page table.\"\n \nrecord MipsTLBPT = \n tlb :: MIPSTLB\n pte :: MIPSPT\n\n \n \n(* ========================================================================= *) \nsection \"Non-deterministic Exception Handler\"\n(* ========================================================================= *)\n \ntext \"The non-deterministic replacement handler uses the random write function\n of the TLB to non-deterministically replace an existing entry with the\n new one. Note, that this definition alone won't preserve the validity\n constraints of the TLB as defined in the TLBValid predicate, in\n particular, when its being invoked with the same ASID and VPN twice.\" \n \n \ndefinition MipsTLBPT_update_tlb :: \"MipsTLBPT \\ ASID \\ VPN \\ MipsTLBPT set\"\n where \"MipsTLBPT_update_tlb mpt as vpn = \n {\\tlb = t, pte = (pte mpt)\\ | \n t. t\\ tlbwr (MIPSPT_mk_tlbentry (pte mpt) as vpn) (tlb mpt)}\"\n\n\n(* ========================================================================= *) \nsection \"Fault Function\"\n(* ========================================================================= *) \n\ntext \"While the update function purely updates the entry, the definition of the\n fault function effectively simulates a translate attempt and invokes\n the update function when a refill exception occurs. If an entry is \n present, then the state of the TLB is not changed. \"\n \ndefinition MipsTLBPT_fault :: \"MipsTLBPT \\ ASID \\ VPN \\ MipsTLBPT set\"\n where \"MipsTLBPT_fault mtlb as vpn = \n (if MIPSTLB_try_translate (tlb mtlb) as vpn = EXNREFILL then \n MipsTLBPT_update_tlb mtlb as vpn\n else {mtlb})\" \n \n\ntext \"Therefore we can proof that if the TLB does not throw the refill \n exception, the faulting function won't change the state of the TLB\n i.e. the input MipsTLBPT is the same as the output.\"\n \nlemma MipsTLBPT_fault_no_change:\n \"\\vpn as. MIPSTLB_try_translate (tlb m) as vpn \\ EXNREFILL \\\n (\\m2 \\ MipsTLBPT_fault m as vpn. m = m2)\"\n by(simp add: MipsTLBPT_fault_def)\n \n \n \n(* ========================================================================= *) \nsection \"Valid TLB and page tables\"\n(* ========================================================================= *) \n\n \ntext \"We say that the combination of a TLB and page tables is valid if both, \n the TLB and the page table are valid and additionally, the TLB must be\n an instance of the page table.\" \n \n(* ------------------------------------------------------------------------- *) \nsubsection \"Instance\"\n(* ------------------------------------------------------------------------- *)\n\ntext \"A TLB is an instance of a page table if for all entries in the TLB there\n is a corresponding, equal entry in the page table. In other words, the\n entry of the TLB must be equal to a created entry from the page table\n using the very same VPN and ASID.\"\n \ndefinition MipsTLBPT_is_instance :: \"MipsTLBPT \\ bool\"\n where \"MipsTLBPT_is_instance mt = \n (\\i < (capacity (tlb mt)). entries (tlb mt) i = \n MIPSPT_mk_tlbentry (pte mt) (asid (hi (entries (tlb mt) i) )) \n (vpn2 (hi (entries (tlb mt) i) )))\"\n\n \n(* ------------------------------------------------------------------------- *) \nsubsection \"Validity\"\n(* ------------------------------------------------------------------------- *)\n \ntext \"We therefore can define the validity of a TLB + PageTable combination\n as the logic and of the validity of the page tables and the TLB\n independently, and together with the instance definition from above.\"\n \ndefinition MipsTLBPT_valid :: \"MipsTLBPT \\ bool\"\n where \"MipsTLBPT_valid mt = ((MIPSPT_valid (pte mt)) \n \\ (TLBValid (tlb mt)) \n \\ (MipsTLBPT_is_instance mt) )\" \n\n \n\n \n\n(* ========================================================================= *) \nsection \"Translate Function\"\n(* ========================================================================= *) \n\ntext \"The translation function first faults on the TLB. This has the effect that\n if the entry is not present, it gets placed in the TLB. Then the translate\n attempt is made, which results in an empty set if the entry was not valid.\"\n \n \ndefinition MipsTLBPT_translate :: \"MipsTLBPT \\ ASID \\ VPN \\ PFN set\"\n where \"MipsTLBPT_translate mtlb as vpn = \n \\{ MIPSTLB_translate (tlb m) as vpn | m . m \\ MipsTLBPT_fault mtlb as vpn}\"\n\n \nlemma \n assumes valid : \"MipsTLBPT_valid mtlb\"\n shows \"MipsTLBPT_translate mtlb as vpn = MIPSPT_translate (pte mtlb) as vpn\"\n oops\n\n\n(* ========================================================================= *) \nsection \"Translate Function\"\n(* ========================================================================= *) \n\n \n\nlemma MipsTLBPT_instance_no_global:\n assumes valid: \"MipsTLBPT_valid m\"\n and inrange : \"i < (capacity (tlb m))\"\n shows \"\\ EntryIsGlobal (entries (tlb m) i)\" \nproof -\n from valid have inst :\n \"MipsTLBPT_is_instance (m)\"\n by(simp add:MipsTLBPT_valid_def) \n \n from inst inrange have X0: \"\n entries (tlb m) i = MIPSPT_mk_tlbentry (pte m) (asid (hi (entries (tlb m) i) )) \n (vpn2 (hi (entries (tlb m) i) ))\"\n by(simp add:MipsTLBPT_is_instance_def)\n \n from valid have X1: \"\\ EntryIsGlobal (MIPSPT_mk_tlbentry (pte m) (asid (hi (entries (tlb m) i) )) \n (vpn2 (hi (entries (tlb m) i) )))\" \n by(simp add:MIPSPT_TLBENTRY_not_global MipsTLBPT_valid_def )\n\n from X0 X1 show ?thesis\n by(auto)\nqed\n \nlemma MipsTLBPT_instance_entry_is_4k:\n assumes valid: \"MipsTLBPT_valid m\"\n and inrange : \"i < (capacity (tlb m))\"\n shows \"(mask (entries (tlb m) i)) = MASK4K\" \nproof -\n from valid inrange have X0:\n \"entries (tlb m) i = MIPSPT_mk_tlbentry (pte m) (asid (hi (entries (tlb m) i) )) \n (vpn2 (hi (entries (tlb m) i) ))\"\n by(simp add: MipsTLBPT_valid_def MipsTLBPT_is_instance_def)\n \n have X1:\n \"(mask (MIPSPT_mk_tlbentry (pte m) (asid (hi (entries (tlb m) i) )) \n (vpn2 (hi (entries (tlb m) i))))) = MASK4K\"\n by(simp add:MIPSPT_TLBENTRY_mask_is) \n \n from X0 X1 show ?thesis \n by(auto)\nqed\n \n\n \n \n(* ========================================================================= *) \nsection \"The Fault Function Preserves Validity\"\n(* ========================================================================= *) \n\ntext \"Next we proof that whenever the validity condition holds and the ASID/VPN\n are in the valid ranges then the fault function will result in a valid state.\n For this purpose we split up the proof into the three conditions and in the\n end use the lemmas to prove the validity.\" \n\n(* ------------------------------------------------------------------------- *) \nsubsection \"Instance Preservation\" \n(* ------------------------------------------------------------------------- *) \n \ntext \"We now show that the fault function will preserve the instance condition\n of the TLB. For this we split up the proof into two cases, one where the \n entry is not present (i.e. refill exception condition) and one where the\n TLB has the entry.\"\n\nlemma MipsTLBT_keeps_instance: \nassumes valid: \" MipsTLBPT_valid mpt \"\n and inrange: \"vpn < MIPSPT_EntriesMax\"\n and inrange2: \" ASIDValid as\"\n shows \"\\m \\ (MipsTLBPT_fault mpt as vpn). MipsTLBPT_is_instance m\" \nproof cases\n assume nfault: \"MIPSTLB_try_translate (tlb mpt) as vpn = EXNREFILL\"\n then show ?thesis \n proof -\n from valid have isinstance:\n \"MipsTLBPT_is_instance mpt\"\n by(simp add:MipsTLBPT_valid_def)\n \n have Z1: \n \"(\\m i. i < (capacity (tlb mpt)) \\\n m = \\\n tlb = \\\n capacity = capacity (tlb mpt), \n wired = wired (tlb mpt), \n random = random (tlb mpt), \n entries = \n (entries (tlb mpt))(i := MIPSPT_mk_tlbentry (pte mpt) as vpn) \\,\n pte = (pte mpt) \\ \\ \n ((entries (tlb m) i = \n MIPSPT_mk_tlbentry (pte m) (asid (hi (entries (tlb m) i))) \n (vpn2 (hi (entries (tlb m) i) )))))\"\n by(auto simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n \n from nfault have X0: \n \"(\\m \\ (MipsTLBPT_fault mpt as vpn). MipsTLBPT_is_instance m) =\n (\\m \\ MipsTLBPT_update_tlb mpt as vpn . MipsTLBPT_is_instance m)\"\n by(simp add:MipsTLBPT_fault_def)\n \n have X1: \n \"... = (\\m\\{\\tlb = t, pte = pte mpt\\ |t. \n t \\ tlbwr (MIPSPT_mk_tlbentry (pte mpt) as vpn) (tlb mpt)}. \n MipsTLBPT_is_instance m)\"\n by(simp only:MipsTLBPT_update_tlb_def)\n \n have X2: \n \"... = (\\m\\{\\tlb = t, pte = pte mpt\\ |t.\n t \\ {t2 | t2 i. t2= \\\n capacity = capacity (tlb mpt), \n wired = wired (tlb mpt), \n random = random (tlb mpt), \n entries = \n (entries (tlb mpt))(i := MIPSPT_mk_tlbentry (pte mpt) as vpn)\\ \\\n i \\ RandomIndexRange (tlb mpt)}}.\n MipsTLBPT_is_instance m)\"\n by(auto simp add:tlbwr_def)\n \n have X3: \n \"... = (\\i \\ RandomIndexRange (tlb mpt). \n MipsTLBPT_is_instance (\\\n tlb = \\\n capacity = capacity (tlb mpt), \n wired = wired (tlb mpt), \n random = random (tlb mpt), \n entries = \n (entries (tlb mpt))(i := MIPSPT_mk_tlbentry (pte mpt) as vpn)\\, \n pte = pte mpt\\))\"\n by(auto)\n \n from isinstance X0 X1 X2 X3 Z1 show ?thesis \n by(auto simp add:MipsTLBPT_is_instance_def)\n qed\nnext\n assume nfault: \"MIPSTLB_try_translate (tlb mpt) as vpn \\ EXNREFILL\"\n then show ?thesis \n proof -\n from valid have isinstance:\n \"MipsTLBPT_is_instance mpt\"\n by(simp add:MipsTLBPT_valid_def)\n \n from nfault have X1: \"\\m \\ (MipsTLBPT_fault mpt as vpn). m = mpt\"\n by(simp add:MipsTLBPT_fault_def)\n \n from isinstance X1 show ?thesis \n by(auto) \n qed \nqed \n\n \n(* ------------------------------------------------------------------------- *) \nsubsection \"TLB Valid Preservation\" \n(* ------------------------------------------------------------------------- *) \n\ntext \"The next step is to proof that the validity of the TLB is preserved when\n the fault function replaces an entry. This holds, because the TLB state \n is only changed when there was no match, which implies that there are\n no matching entries. We first proof two helper lemmas and then use them\n to do the proof of the actual lemma.\"\n\n \n(* ------------------------------------------------------------------------- *) \nsubsubsection \"Helper Lemmas\" \n(* ------------------------------------------------------------------------- *)\n\ntext \"We show that if the TLB + page tables are in a valid state and the entry\n of the TLB matches with the created entry from the page table, then\n this entry also matches on the VPN that has been used to create it from \n the page table.\"\n \nlemma MipsTLBT_EntryMatchVPN_EntryMatchV :\nassumes valid: \"MipsTLBPT_valid mpt \"\n and inrange: \"i < capacity (tlb mpt)\"\n and match: \"(EntryVPNMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn))\"\n shows \"(EntryVPNMatchV vpn (entries (tlb mpt) i))\"\nproof -\n from valid inrange have vpn2even:\n \"even (vpn2 (hi (entries (tlb mpt) i)))\"\n by(simp add:MipsTLBPT_valid_def TLBValid_def TLBEntryWellFormed_def \n TLBENTRYWellFormed_def TLBENTRYHIWellFormed_def VPN2Valid_def)\n \n have vpn2eve2 : \"even (vpn2 (hi (MIPSPT_mk_tlbentry (pte mpt) as vpn)))\"\n by(simp add:MIPSPT_TLBENTRY_vpn2_even)\n \n from valid inrange have mask4k:\n \"(mask (entries (tlb mpt) i )) = MASK4K\"\n by(simp add:MipsTLBPT_instance_entry_is_4k)\n \n from match have X0:\n \"(EntryVPNMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n (entries (tlb mpt) i))\"\n by(simp add:EntryVPNMatch_commute)\n \n have X1: \n \"(vpn2 (hi (MIPSPT_mk_tlbentry (pte mpt) as vpn))) \n = (if (even vpn) then vpn else (vpn -1 ))\"\n by(simp add:MIPSPT_TLBENTRY_vpn2_is)\n\n from X0 mask4k vpn2even vpn2eve2 have X2: \n \"EntryVPNMatchV (vpn2 (hi (MIPSPT_mk_tlbentry (pte mpt) as vpn))) \n (entries (tlb mpt) i)\"\n by(simp add:EntryVPNMatch_alter MIPSPT_TLBENTRY_mask_is) \n \n from X1 X2 have X3:\n \"EntryVPNMatchV (if (even vpn) then vpn else (vpn - 1)) \n (entries (tlb mpt) i)\"\n by(auto)\n\n from vpn2even mask4k X3 have X4: \n \"EntryVPNMatchV (if (even vpn) then vpn else (vpn - 1)) \n (entries (tlb mpt) i)\"\n by(simp add:EntryVPNMatchV_equals_odd) \n \n from vpn2even mask4k X4 X3 show ?thesis \n by(cases \"even vpn\", simp, simp add:EntryVPNMatchV_equals_odd)\nqed\n\ntext \"Next we show that if an entry does not match on the VPN and ASID then the \n created entry does not match on the VPN and ASID at the same time.\" \n \nlemma MipsTLBT_no_EntryMatch :\nassumes valid: \"MipsTLBPT_valid mpt \"\n and inrange: \"iEntryMatchVPNASID vpn as (entries (tlb mpt) i)\"\n shows \"\\(EntryVPNMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n \\ EntryASIDMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn))\"\nproof cases\n assume vpnmatch : \"(EntryVPNMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn))\"\n then show ?thesis\n proof -\n from vpnmatch valid inrange have X1:\n \"(EntryVPNMatchV vpn (entries (tlb mpt) i))\"\n by(simp add:MipsTLBT_EntryMatchVPN_EntryMatchV)\n \n from valid have ptvalid : \"MIPSPT_valid (pte mpt)\"\n by(simp add:MipsTLBPT_valid_def)\n \n from nomatch X1 have X0 :\n \"\\ EntryASIDMatchA as (entries (tlb mpt) i)\"\n by(simp add:EntryMatchVPNASID_def)\n \n from valid inrange X0 ptvalid have X2: \n \"\\EntryASIDMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn)\"\n by(simp add:EntryASIDMatch_def MipsTLBPT_instance_no_global \n MIPSPT_TLBENTRY_not_global MIPSPT_TLBENTRY_asid_is \n EntryASIDMatchA_def)\n\n thus ?thesis \n by(auto) \n qed\nnext\n assume novpnmatch : \n \"\\(EntryVPNMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn))\"\n then show ?thesis\n by(auto)\nqed\n \n \n(* ------------------------------------------------------------------------- *) \nsubsubsection \"TLB Valid property is preserved\" \n(* ------------------------------------------------------------------------- *)\n \ntext \"Now we proof using the two lemmas above that the fault function always \n preserves the TLBValid property. We do this by a case distinction, when\n the entry is not present or when it is.\" \n \nlemma MipsTLBT_keeps_TLBValid :\nassumes valid: \"MipsTLBPT_valid mpt \"\n and inrange: \"vpn < MIPSPT_EntriesMax\"\n and inrange2: \"ASIDValid as\"\n shows \"\\m \\ MipsTLBPT_fault mpt as vpn . TLBValid (tlb m)\"\nproof cases\n assume fault: \"MIPSTLB_try_translate (tlb mpt) as vpn = EXNREFILL\"\n then show ?thesis\n proof - \n from fault have X0:\n \"MipsTLBPT_fault mpt as vpn = \n {\\tlb = t, pte = pte mpt\\ |t. \n t \\ tlbwr (MIPSPT_mk_tlbentry (pte mpt) as vpn) (tlb mpt)}\"\n by(simp add:MipsTLBPT_fault_def MipsTLBPT_update_tlb_def)\n \n from valid have tlbvalid: \n \"TLBValid (tlb mpt)\" \n by(auto simp add:MipsTLBPT_valid_def)\n \n from valid have ptvalid :\n \"MIPSPT_valid (pte mpt)\"\n by(auto simp add:MipsTLBPT_valid_def)\n \n from inrange inrange2 ptvalid have wf:\n \"TLBENTRYWellFormed (MIPSPT_mk_tlbentry (pte mpt) as vpn)\"\n by(simp add:MIPSPT_TLBENTRY_wellformed )\n \n from fault have nomatch :\n \"(\\iEntryMatchVPNASID vpn as (entries (tlb mpt) i))\"\n by(simp add:MIPSTLB_fault_no_match)\n\n from nomatch ptvalid valid have X1:\n \"(\\i(EntryVPNMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n \\ EntryASIDMatch (entries (tlb mpt) i) \n (MIPSPT_mk_tlbentry (pte mpt) as vpn)))\"\n by(auto simp:MipsTLBT_no_EntryMatch)\n \n from ptvalid nomatch X1 have nc:\n \"TLBEntryNoConflict (MIPSPT_mk_tlbentry (pte mpt) as vpn) (tlb mpt)\" \n by(auto simp add:TLBEntryNoConflict_def EntryMatch_def)\n \n from tlbvalid wf nc X0 show ?thesis\n by(auto simp:TLBRandomUpdateValid)\n qed \nnext\n assume nfault: \"MIPSTLB_try_translate (tlb mpt) as vpn \\ EXNREFILL\"\n then show ?thesis \n proof -\n from nfault have X0:\n \"MipsTLBPT_fault mpt as vpn = {mpt}\"\n by(simp add:MipsTLBPT_fault_def)\n \n from valid have tlbvalid:\n \"TLBValid (tlb mpt)\"\n by(simp add:MipsTLBPT_valid_def)\n \n from X0 tlbvalid show ?thesis \n by(auto)\n qed \nqed\n \n\n(* ------------------------------------------------------------------------- *) \nsubsection \"Page Table Valid Preservation\" \n(* ------------------------------------------------------------------------- *) \n\ntext \"Lastly, we show that the fault function preserves the validity of the\n page table which is trivial given the page tables are not changed.\"\n\nlemma MipsTLBT_keeps_ptvalid:\n \"\\vpn mpt as. MipsTLBPT_valid mpt \\ vpn < MIPSPT_EntriesMax \n \\ \\m \\ MipsTLBPT_fault mpt as vpn . MIPSPT_valid (pte m)\" \n by(simp add:MipsTLBPT_valid_def MipsTLBPT_update_tlb_def \n MipsTLBPT_fault_def, auto)\n \n(* ------------------------------------------------------------------------- *) \nsubsection \"Validity Preservation\" \n(* ------------------------------------------------------------------------- *) \n \ntext \"By using the three lemmas from above, we can show that the fault function\n preserves the TLBValid, the page table and instance properties and\n therefore we can show that the validity of the TLB+page table are\n preserved.\" \n \nlemma MipsTLBPT_keeps_valid :\n assumes valid: \"\\mpt. MipsTLBPT_valid mpt \"\n and inrange: \"\\vpn. vpn < MIPSPT_EntriesMax\"\n and inrange2: \"\\as. ASIDValid as\"\n shows \"\\vpn mpt as. \\m \\ MipsTLBPT_fault mpt as vpn . MipsTLBPT_valid m\"\n apply(subst MipsTLBPT_valid_def)\n apply(simp add:ball_conj_distrib)\n apply(simp add:MipsTLBT_keeps_ptvalid valid inrange inrange2 )\n apply(simp add:MipsTLBT_keeps_instance valid inrange inrange2)\n apply(simp add:MipsTLBT_keeps_TLBValid valid inrange inrange2 )\n done\n\n \n \n(* ========================================================================= *) \nsection \"Matching TLB Entries\"\n(* ========================================================================= *) \n\ntext \"We now show that if the entry matches a particular ASID and VPN then \n the entry is equal to the created entry. We do a case distinction\n on the vpn, even and odd. \"\n \n \nlemma MipsTLBPT_match_is_equlas_even: \nassumes inrange: \"i < capacity (tlb mtlb)\"\n and match: \"EntryMatchVPNASID vpn as (entries (tlb mtlb) i) \"\n and valid: \"MipsTLBPT_valid mtlb\"\n and veven : \"even vpn\"\n shows \"entries (tlb mtlb) i = MIPSPT_mk_tlbentry (pte mtlb) as vpn\"\nproof -\n \n from valid have ptvalid :\n \"MIPSPT_valid (pte mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n \n from valid have isinstance :\n \"MipsTLBPT_is_instance (mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n\n from valid have tlbvalid :\n \"TLBValid (tlb mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n \n from valid inrange match isinstance have X0: \n \"(asid (hi (entries (tlb mtlb) i))) = as\"\n by(simp add:EntryMatchVPNASID_def\n EntryASIDMatchA_def \n MipsTLBPT_instance_no_global)\n \n from inrange tlbvalid have vpne2ven :\n \"even (vpn2 (hi (entries (tlb mtlb) i)))\"\n by(simp add:TLBValid_def TLBEntryWellFormed_def \n TLBENTRYWellFormed_def \n TLBENTRYHIWellFormed_def VPN2Valid_def)\n \n from veven vpne2ven inrange valid match isinstance have X1:\n \"(vpn2 (hi (entries (tlb mtlb) i))) = vpn\"\n by(auto simp add:EntryMatchVPNASID_def EntryVPNMatchV_def \n EntryMin4KVPN_def EntryMax4KVPN_def \n MipsTLBPT_instance_entry_is_4k num_4k_pages_def\n even_vpn_compare)\n \n from isinstance have X3:\n \"(\\i < (capacity (tlb mtlb)).\n entries (tlb mtlb) i = \n MIPSPT_mk_tlbentry (pte mtlb) (asid (hi (entries (tlb mtlb) i) ))\n (vpn2 (hi (entries (tlb mtlb) i) )))\"\n by(simp add:MipsTLBPT_is_instance_def)\n \n from X3 inrange have X4 : \n \"entries (tlb mtlb) i = \n MIPSPT_mk_tlbentry (pte mtlb) (asid (hi (entries (tlb mtlb) i) ))\n (vpn2 (hi (entries (tlb mtlb) i) ))\"\n by(auto)\n \n from X0 X1 X3 X4 show ?thesis\n by(auto)\nqed\n\nlemma MipsTLBPT_match_is_equlas_odd: \nassumes inrange: \"i < capacity (tlb mtlb)\"\n and match: \"EntryMatchVPNASID vpn as (entries (tlb mtlb) i) \"\n and valid: \"MipsTLBPT_valid mtlb\"\n and vodd : \"odd vpn\"\n shows \"entries (tlb mtlb) i = MIPSPT_mk_tlbentry (pte mtlb) as vpn\"\nproof -\n from valid have ptvalid :\n \"MIPSPT_valid (pte mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n \n from valid have isinstance :\n \"MipsTLBPT_is_instance (mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n\n from valid have tlbvalid :\n \"TLBValid (tlb mtlb)\"\n by(simp add:MipsTLBPT_valid_def) \n \n from valid inrange match isinstance have X0: \n \"(asid (hi (entries (tlb mtlb) i))) = as\"\n by(simp add:EntryMatchVPNASID_def\n EntryASIDMatchA_def \n MipsTLBPT_instance_no_global)\n \n from inrange tlbvalid have vpne2ven :\n \"even (vpn2 (hi (entries (tlb mtlb) i)))\"\n by(simp add:TLBValid_def TLBEntryWellFormed_def TLBENTRYWellFormed_def \n TLBENTRYHIWellFormed_def VPN2Valid_def)\n \n from vodd vpne2ven inrange valid match isinstance have X1:\n \"(vpn2 (hi (entries (tlb mtlb) i))) = (vpn - 1)\"\n by(auto simp:EntryMatchVPNASID_def EntryVPNMatchV_def EntryMin4KVPN_def \n EntryMax4KVPN_def MipsTLBPT_instance_entry_is_4k num_4k_pages_def\n even_vpn_compare)\n \n from inrange isinstance have X3:\n \"entries (tlb mtlb) i = \n MIPSPT_mk_tlbentry (pte mtlb) (asid (hi (entries (tlb mtlb) i) ))\n (vpn2 (hi (entries (tlb mtlb) i) ))\"\n by(simp add:MipsTLBPT_is_instance_def)\n\n from vodd have X4: \n \"MIPSPT_mk_tlbentry (pte mtlb) as (vpn - 1) \n = MIPSPT_mk_tlbentry (pte mtlb) as vpn\"\n by(simp add:MIPSPT_mk_tlbentry_def)\n \n from X0 X1 X3 X4 show ?thesis\n by(auto)\nqed \n \n \nlemma MipsTLBPT_match_is_equlas: \nassumes inrange: \"i < capacity (tlb mtlb)\"\n and match: \"EntryMatchVPNASID vpn as (entries (tlb mtlb) i) \"\n and valid: \"MipsTLBPT_valid mtlb\"\n shows \"entries (tlb mtlb) i = MIPSPT_mk_tlbentry (pte mtlb) as vpn\"\nproof cases\n assume veven: \"even vpn\"\n then show ?thesis \n by(simp add:MipsTLBPT_match_is_equlas_even inrange match valid)\nnext\n assume vodd: \"odd vpn\"\n then show ?thesis\n by(simp add:MipsTLBPT_match_is_equlas_odd inrange match valid)\nqed\n \n \n(* ========================================================================= *) \nsection \"Existence of Entry\"\n(* ========================================================================= *) \n\ntext \"If for a given ASID/VPN the translation attempt does not throw a refill\n exception then there exist an entry in the TLB that matches the\n ASID/VPN.\" \n \nlemma MipsTLBPT_no_fault_entry_exist :\nassumes valid: \"MipsTLBPT_valid mtlb\"\n and translates : \"MIPSTLB_try_translate (tlb mtlb) as vpn \\ EXNREFILL\"\n shows \"(\\i < (capacity (tlb mtlb)). \n (entries (tlb mtlb) i) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\"\nproof -\n from valid have inst:\n \"MipsTLBPT_is_instance mtlb\"\n by(simp add:MipsTLBPT_valid_def)\n from valid have ptvalid :\n \"MIPSPT_valid (pte mtlb)\"\n by(simp add:MipsTLBPT_valid_def)\n from valid have tlbvalid:\n \"TLBValid (tlb mtlb)\"\n by(simp add:MipsTLBPT_valid_def)\n \n from inst have inst2: \n \"(\\iii as vpn. i < capacity (tlb mtlb) \n \\ EntryMatchVPNASID vpn as (entries (tlb mtlb) i) \n \\ entries (tlb mtlb) i = MIPSPT_mk_tlbentry (pte mtlb) as vpn\"\n by(simp add:MipsTLBPT_match_is_equlas)\n \n from matchexist X0 show ?thesis by(auto) \nqed\n \n\n(* ========================================================================= *) \nsection \"No Match implies no Translate\"\n(* ========================================================================= *) \n\ntext \"For any entry in the TLB other than the one that may match, the\n translate function will return the empty set.\"\n \nlemma MipsTLBPT_Entry_no_match_no_translate:\nassumes inrange: \" i < capacity (tlb mtlb)\"\n and valid: \"MipsTLBPT_valid mtlb\"\n and inotmatch: \" i \\ (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = \n (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\"\n shows \"TLBENTRY_translate (entries (tlb mtlb) i) as vpn = {}\"\nproof cases\n assume fault: \"MIPSTLB_try_translate (tlb mtlb) as vpn = EXNREFILL\"\n then show ?thesis \n proof -\n from fault inrange have nomatch:\n \"\\EntryMatchVPNASID vpn as (entries (tlb mtlb) i)\"\n by(simp add:MIPSTLB_fault_no_match)\n from nomatch show ?thesis\n by(simp add:TLBENTRY_translate_def)\n qed \nnext\n assume nofault: \"MIPSTLB_try_translate (tlb mtlb) as vpn \\ EXNREFILL\"\n then show ?thesis \n proof -\n from valid have tlbvalid:\n \"TLBValid (tlb mtlb)\"\n by(simp add:MipsTLBPT_valid_def)\n\n from valid have inst:\n \"MipsTLBPT_is_instance mtlb\" \n by(simp add:MipsTLBPT_valid_def)\n \n have mask4k2: \n \"(\\i < (capacity (tlb mtlb)). mask ((entries (tlb mtlb)) i) = MASK4K)\"\n proof -\n from inst have Z0:\n \"(\\i < capacity (tlb mtlb). mask ((entries (tlb mtlb)) i) = MASK4K) =\n (\\i < (capacity (tlb mtlb)). \n mask (MIPSPT_mk_tlbentry (pte mtlb) \n (asid (hi (entries (tlb mtlb) i)))\n (vpn2 (hi (entries (tlb mtlb) i))))\n = MASK4K)\"\n by(simp add:MipsTLBPT_is_instance_def)\n \n from Z0 show ?thesis \n by(auto simp:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n qed\n \n from nofault valid have exist:\n \"(\\j. j < (capacity (tlb mtlb)) \\\n (entries (tlb mtlb) j) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\" \n by(simp add:MipsTLBPT_no_fault_entry_exist) \n \n from exist have match: \n \"entries (tlb mtlb) \n (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n = (MIPSPT_mk_tlbentry (pte mtlb) as vpn)\"\n by(simp add:some_eq_ex[symmetric])\n \n from exist have ir2: \n \"(SOME j. j < (capacity (tlb mtlb)) \\ ((entries (tlb mtlb) j)) \n = (MIPSPT_mk_tlbentry (pte mtlb) as vpn)) < (capacity (tlb mtlb))\"\n by(simp add:some_eq_ex[symmetric])\n \n have X0: \n \"EntryMatchVPNASID vpn as (entries (tlb mtlb) (SOME j. \n j < (capacity (tlb mtlb)) \\ ((entries (tlb mtlb) j)) \n = (MIPSPT_mk_tlbentry (pte mtlb) as vpn)))\"\n by(simp add:match MIPSPT_TLBENTRY_match)\n \n have X1: \n \"(SOME j. j < capacity (tlb mtlb) \\ entries (tlb mtlb) j \n = MIPSPT_mk_tlbentry (pte mtlb) as vpn) \\ i\"\n by(auto simp add:inotmatch)\n \n from tlbvalid inrange ir2 mask4k2 X0 X1 have nomatch :\n \"\\ EntryMatchVPNASID vpn as (entries (tlb mtlb) i)\"\n by(simp add:TLBValid_implies_no_other_match)\n \n from nomatch show ?thesis \n by(auto simp:TLBENTRY_translate_def) \n qed\nqed\n\n(* ========================================================================= *) \nsection \"Translate Simplification\"\n(* ========================================================================= *) \n \ntext \"Next we show the equivalence of the translate function to be equal to \n directly reading out the entry from the page table.\" \n \nlemma MipsTLBPT_translate_is:\n assumes inrange: \"vpn < MIPSPT_EntriesMax\"\n and inrange2: \"as < ASIDMax\"\n and cap: \"capacity (tlb mtlb) > 0\"\n and valid: \"MipsTLBPT_valid mtlb\"\n shows \"MipsTLBPT_translate mtlb as vpn = \n (if (v ((entry (pte mtlb)) vpn as))\n then {(pfn ((entry (pte mtlb)) vpn as))} else {})\" \nproof cases\n assume fault: \"MIPSTLB_try_translate (tlb mtlb) as vpn = EXNREFILL\"\n then show ?thesis \n proof -\n from valid have tlbvalid : \n \"TLBValid (tlb mtlb)\"\n by(simp add:MipsTLBPT_valid_def)\n \n from fault have X0: \n \"MipsTLBPT_translate mtlb as vpn = \n \\{MIPSTLB_translate (tlb m) as vpn | m. \n m \\ MipsTLBPT_update_tlb mtlb as vpn}\"\n by(simp add:MipsTLBPT_translate_def MipsTLBPT_fault_def)\n\n have X1: \n \" ... = \\{MIPSTLB_translate (tlb m) as vpn |m. \n m \\ {\\tlb = t, pte = pte mtlb\\ |t. \n t \\ tlbwr (MIPSPT_mk_tlbentry (pte mtlb) as vpn) (tlb mtlb)}}\"\n by(simp only:MipsTLBPT_update_tlb_def)\n \n have X2: \n \" ... = \\{MIPSTLB_translate (tlb m) as vpn |m.\n \\t. m = \\tlb = t, pte = pte mtlb\\ \\\n (\\i. t = \\\n capacity = capacity (tlb mtlb), \n wired = wired (tlb mtlb), \n random = random (tlb mtlb), \n entries = (entries (tlb mtlb))(\n i := MIPSPT_mk_tlbentry (pte mtlb) as vpn)\\\n \\ i \\ RandomIndexRange (tlb mtlb))}\"\n by(simp add:tlbwr_def)\n \n have X3: \n \"... = \\{MIPSTLB_translate (tlb m) as vpn |m.\n \\i. m = \\tlb = \\\n capacity = capacity (tlb mtlb), \n wired = wired (tlb mtlb), \n random = random (tlb mtlb), \n entries = (entries (tlb mtlb))(\n i := MIPSPT_mk_tlbentry (pte mtlb) as vpn)\\, pte = pte mtlb\\ \n \\ i \\ RandomIndexRange (tlb mtlb)}\"\n by(auto)\n \n have X4: \n \" ... = \\{{pa| pa j. pa \\ TLBENTRY_translate (entries (tlb m) j) as vpn \n \\ j < capacity (tlb m)} |m i.\n m = \\tlb = \\\n capacity = capacity (tlb mtlb), \n wired = wired (tlb mtlb), \n random = random (tlb mtlb), \n entries = (entries (tlb mtlb))(\n i := MIPSPT_mk_tlbentry (pte mtlb) as vpn)\\, pte = pte mtlb\\ \\\n i \\ RandomIndexRange (tlb mtlb)}\"\n by(simp add:MIPSTLB_translate_def)\n \n have X5:\n \"... = \\{ {pa| pa j. \n pa \\ TLBENTRY_translate (entries (tlb m) j) as vpn \\ j < capacity (tlb m) \\ i = j}\n \\ {pa| pa j. pa \\ TLBENTRY_translate (entries (tlb m) j) as vpn \\ j < capacity (tlb m) \\ i \\ j} | \n m i.\n m = \\tlb = \\\n capacity = capacity (tlb mtlb), \n wired = wired (tlb mtlb), \n random = random (tlb mtlb), \n entries = (entries (tlb mtlb))(i := MIPSPT_mk_tlbentry (pte mtlb) as vpn)\\,\n pte = pte mtlb\\ \\\n i \\ RandomIndexRange (tlb mtlb)}\"\n by(blast)\n \n have X6: \" ... = \\{ {pa| pa j. pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn \\ j < capacity (tlb m) \\ i = j}\n \\ {pa| pa j. pa \\ TLBENTRY_translate (entries (tlb m) j) as vpn \\ j < capacity (tlb m) \\ i \\ j} |m i.\n m = \\tlb = \\capacity = capacity (tlb mtlb), wired = wired (tlb mtlb), random = random (tlb mtlb), entries = (entries (tlb mtlb))(i := MIPSPT_mk_tlbentry (pte mtlb) as vpn)\\, pte = pte mtlb\\ \\\n i \\ RandomIndexRange (tlb mtlb)}\"\n by(auto)\n\n have X7: \" ... = \\{{pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn. i < capacity (tlb mtlb)} \\\n {pa | pa j. j \\ i \\ j < capacity (tlb mtlb) \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) j) as vpn} |\n i. i \\ RandomIndexRange (tlb mtlb)}\"\n by(auto)\n\n have X8: \" ... = {pa | pa i. pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn \\ i \\ RandomIndexRange (tlb mtlb) \\ i\n {pa. \\j i. i \\ RandomIndexRange (tlb mtlb) \\ j \\ i \\ j < capacity (tlb mtlb) \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) j) as vpn}\"\n by(auto)\n \n from fault have X9: \" ... = {pa | pa i. pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn \\ i \\ RandomIndexRange (tlb mtlb) \\ i TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn \\ i \\ RandomIndexRange (tlb mtlb)}\"\n by(auto simp:RandomIndex_in_capacity cap)\n\n from tlbvalid have X11 : \" ... = (if (v ((entry (pte mtlb)) vpn as)) then {(pfn ((entry (pte mtlb)) vpn as))} else {})\"\n by(auto simp add:MIPSPT_TLBENTRY_translate_is RandomIndexRange_def TLBValid_def)\n \n from fault X0 X1 X2 X3 X4 X5 X6 X7 X8 X9 X10 X11 show ?thesis\n by(auto)\n qed\nnext\n assume nofault: \"MIPSTLB_try_translate (tlb mtlb) as vpn \\ EXNREFILL\"\n then show ?thesis \n proof -\n\n from nofault inrange inrange2 valid have exist:\n \"(\\j. j < (capacity (tlb mtlb)) \\\n (entries (tlb mtlb) j) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\" \n by(simp add:MipsTLBPT_no_fault_entry_exist)\n \n from exist have match: \"\n entries (tlb mtlb) \n (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n = (MIPSPT_mk_tlbentry (pte mtlb) as vpn)\"\n by(simp add:some_eq_ex[symmetric])\n \n from exist have ir2: \" (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn)) < (capacity (tlb mtlb)) \"\n by(simp add:some_eq_ex[symmetric])\n \n \n from nofault have X0: \"MipsTLBPT_translate mtlb as vpn = MIPSTLB_translate (tlb mtlb) as vpn\"\n by(simp add:MipsTLBPT_translate_def MipsTLBPT_fault_def)\n\n have X1 : \" ... = {pa | pa i. i < capacity (tlb mtlb) \n \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) i) as vpn}\"\n by(auto simp add:MIPSTLB_translate_def)\n \n have X2 : \" ... = {pa | pa i. i < capacity (tlb mtlb) \\ i = (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) i) as vpn} \\\n {pa | pa i. i < capacity (tlb mtlb) \\ i \\ (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) i) as vpn}\"\n by(auto)\n \n \n \n from match have X3: \" ... = {pa | pa i. i < capacity (tlb mtlb) \\ i = (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn} \\\n {pa | pa i. i < capacity (tlb mtlb) \\ i \\ (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) i) as vpn}\"\n by(auto)\n \n from ir2 have X4: \" ... = {pa | pa i. i = (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn} \\\n {pa | pa i. i < capacity (tlb mtlb) \\ i \\ (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (entries (tlb mtlb) i) as vpn}\"\n by(auto)\n \n from valid have X5: \" ... = {pa | pa i. i = (SOME j. j < (capacity (tlb mtlb)) \n \\ ((entries (tlb mtlb) j)) = (MIPSPT_mk_tlbentry (pte mtlb) as vpn))\n \\ pa \\ TLBENTRY_translate (MIPSPT_mk_tlbentry (pte mtlb) as vpn) as vpn}\"\n by(auto simp add:MipsTLBPT_Entry_no_match_no_translate)\n \n have X6: \" ... = (if (v ((entry (pte mtlb)) vpn as)) then {(pfn ((entry (pte mtlb)) vpn as))} else {})\"\n by(simp add:MIPSPT_TLBENTRY_translate_is)\n \n \n from X0 X1 X2 X3 X4 X5 X6 match show ?thesis\n by(auto)\n qed\nqed \n \nend ", "meta": {"author": "BarrelfishOS", "repo": "Isabelle-hardware-models", "sha": "a638383df9dd8db15805c59efb65724bc919df0a", "save_path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models", "path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models/Isabelle-hardware-models-a638383df9dd8db15805c59efb65724bc919df0a/theories/mipstlb/MipsTLBReplacementHandler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2514923173202992}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: HoarePartial.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Properties of Total Correctness Hoare Logic *}\n\ntheory HoareTotalProps imports SmallStep HoareTotalDef HoarePartialProps begin\n\nsubsection {* Soundness *}\n\nlemma hoaret_sound: \n assumes hoare: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n case (Skip \\ F P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Skip P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Skip,Normal s\\ \\ t\" \"s \\ P\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Skip \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Basic \\ F f P A)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\ P} (Basic f) P,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Basic f,Normal s\\ \\ t\" \"s \\ {s. f s \\ P}\"\n thus \"t \\ Normal ` P \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Basic f \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Spec \\ F r Q A)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)} Spec r Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Spec r ,Normal s\\ \\ t\" \n \"s \\ {s. (\\t. (s, t) \\ r \\ t \\ Q) \\ (\\t. (s, t) \\ r)}\"\n thus \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases auto\n next\n fix s show \"\\\\Spec r \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Seq \\ F P c1 R A c2 Q)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Seq c1 c2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec P obtain r where\n exec_c1: \"\\\\\\c1,Normal s\\ \\ r\" and exec_c2: \"\\\\\\c2,r\\ \\ t\"\n by cases auto\n with t_notin_F have \"r \\ Fault ` F\"\n by (auto dest: Fault_end)\n from valid_c1 ctxt exec_c1 P this\n have r: \"r \\ Normal ` R \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n proof (cases r)\n case (Normal r')\n with exec_c2 r\n show \"t\\Normal ` Q \\ Abrupt ` A\"\n apply -\n apply (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F])\n apply auto\n done\n next\n case (Abrupt r')\n with exec_c2 have \"t=Abrupt r'\"\n by (auto elim: exec_elim_cases)\n with Abrupt r show ?thesis\n by auto\n next\n case Fault with r show ?thesis by blast\n next\n case Stuck with r show ?thesis by blast\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s\\P\"\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c1,Normal s\\ \\ r\"\n have \"\\\\c2 \\ r\"\n proof (cases r)\n case (Normal r')\n with cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"r\\Normal ` R\"\n by auto\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n show \"\\\\c2 \\ r\"\n by auto\n qed auto \n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Cond \\ F P b c1 Q A c2)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ b) c1 Q,A\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P \\ - b) c2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Cond b c1 c2,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"s\\b\")\n case True\n with exec have \"\\\\\\c1,Normal s\\ \\ t\"\n by cases auto\n with P True \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n next\n case False\n with exec P have \"\\\\\\c2,Normal s\\ \\ t\"\n by cases auto\n with P False \n show ?thesis\n by - (rule cvalidt_postD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n thus \"\\\\Cond b c1 c2 \\ Normal s\"\n using cvalidt_termD [OF valid_c1 ctxt] cvalidt_termD [OF valid_c2 ctxt]\n by (cases \"s \\ b\") (auto intro: terminates.intros)\n qed\nnext\n case (While r \\ F P b c A)\n assume wf: \"wf r\"\n have valid_c: \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P \\ b) c ({t. (t, \\) \\ r} \\ P),A\"\n using While.hyps by iprover\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\ - b),A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume wprems: \"\\\\\\While b c,Normal s\\ \\ t\" \"s \\ P\" \"t \\ Fault ` F\"\n from wf\n have \"\\t. \\\\\\\\While b c,Normal s\\ \\ t; s \\ P; t \\ Fault ` F\\ \n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (induct)\n fix s t\n assume hyp: \n \"\\s' t. \\(s',s)\\r; \\\\\\While b c,Normal s'\\ \\ t; s' \\ P; t \\ Fault ` F\\\n \\ t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n assume exec: \"\\\\\\While b c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume b: \"s\\b\"\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\" \n assume exec_w: \"\\\\\\While b c,s'\\ \\ t\"\n from exec_w t_notin_F have \"s' \\ Fault ` F\"\n by (auto dest: Fault_end)\n from exec_c P b valid_c ctxt this\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P) \\ Abrupt ` A\"\n by (auto simp add: cvalidt_def validt_def valid_def)\n show ?thesis\n proof (cases s')\n case Normal \n with exec_w s' t_notin_F\n show ?thesis\n by - (rule hyp,auto)\n next\n case Abrupt\n with exec_w have \"t=s'\"\n by (auto dest: Abrupt_end)\n with Abrupt s' show ?thesis\n by blast\n next\n case Fault\n with exec_w have \"t=s'\"\n by (auto dest: Fault_end)\n with Fault s' show ?thesis\n by blast\n next\n case Stuck\n with exec_w have \"t=s'\"\n by (auto dest: Stuck_end)\n with Stuck s' show ?thesis\n by blast\n qed\n next\n assume \"s\\b\" \"t=Normal s\" with P show ?thesis by simp\n qed\n qed\n with wprems show \"t \\ Normal ` (P \\ - b) \\ Abrupt ` A\" by blast\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume \"s \\ P\"\n with wf \n show \"\\\\While b c \\ Normal s\"\n proof (induct)\n fix s\n assume hyp: \"\\s'. \\(s',s)\\r; s' \\ P\\ \n \\ \\\\While b c \\ Normal s'\"\n assume P: \"s \\ P\"\n show \"\\\\While b c \\ Normal s\"\n proof (cases \"s \\ b\")\n case False with P show ?thesis\n by (blast intro: terminates.intros)\n next\n case True\n with valid_c P ctxt\n have \"\\\\c \\ Normal s\"\n by (simp add: cvalidt_def validt_def)\n moreover\n {\n fix s'\n assume exec_c: \"\\\\\\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases s')\n case (Normal s'')\n with exec_c P True valid_c ctxt\n have s': \"s' \\ Normal ` ({s'. (s', s) \\ r} \\ P)\"\n by (fastforce simp add: cvalidt_def validt_def valid_def)\n then show ?thesis\n by (blast intro: hyp)\n qed auto\n }\n ultimately\n show ?thesis\n by (blast intro: terminates.intros)\n qed\n qed\n qed\nnext\n case (Guard \\ F g P c Q A f)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ (g \\ P)\"\n from exec P have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ (g \\ P)\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (Guarantee f F \\ g P c Q A)\n have valid_c: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (g \\ P) c Q,A\" by fact\n have f_F: \"f \\ F\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Guard f g c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Guard f g c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P:\"s \\ P\"\n from exec f_F t_notin_F have g: \"s \\ g\"\n by cases auto\n with P have P': \"s \\ g \\ P\"\n by blast\n from exec g have \"\\\\\\c,Normal s\\ \\ t\"\n by cases auto\n from valid_c ctxt this P' t_notin_F\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P:\"s \\ P\"\n thus \"\\\\Guard f g c \\ Normal s\"\n by (auto intro: terminates.intros cvalidt_termD [OF valid_c ctxt])\n qed\nnext\n case (CallRec P p Q A Specs r Specs_wf \\ F)\n have p: \"(P,p,Q,A) \\ Specs\" by fact\n have wf: \"wf r\" by fact\n have Specs_wf: \n \"Specs_wf = (\\p \\. (\\(P,q,Q,A). (P \\ {s. ((s, q),\\,p) \\ r},q,Q,A)) ` Specs)\" by fact\n from CallRec.hyps\n have valid_body: \n \"\\(P, p, Q, A)\\Specs. p \\ dom \\ \\\n (\\\\. \\,\\ \\ Specs_wf p \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) the (\\ p) Q,A)\" by auto\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof -\n {\n fix \\p \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n from wf\n have \"\\\\ p P Q A. \\\\p = (\\,p); (P,p,Q,A) \\ Specs\\ \\ \n \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ (p))) Q,A\" \n proof (induct \\p rule: wf_induct [rule_format, consumes 1, case_names WF])\n case (WF \\p \\ p P Q A)\n have \\p: \"\\p = (\\, p)\" by fact\n have p: \"(P, p, Q, A) \\ Specs\" by fact\n {\n fix q P' Q' A'\n assume q: \"(P',q,Q',A') \\ Specs\"\n have \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (P' \\ {s. ((s,q), \\,p) \\ r}) (Call q) Q',A'\"\n proof (rule validtI)\n fix s t\n assume exec_q: \n \"\\\\\\Call q,Normal s\\ \\ t\"\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from Pre q \\p\n have valid_bdy: \n \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') the (\\ q) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from exec_q show \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ q = Some bdy\"\n assume exec_bdy: \"\\\\\\bdy,Normal s\\ \\ t\"\n from valid_bdy [simplified bdy option.sel] t_notin_F exec_bdy Pre'\n have \"t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (auto simp add: validt_def valid_def)\n with Pre q \n show ?thesis\n by auto\n next\n assume \"\\ q = None\"\n with q valid_body have False by auto\n thus ?thesis ..\n qed\n next\n fix s\n assume Pre: \"s \\ P' \\ {s. ((s,q), \\,p) \\ r}\"\n from Pre q \\p\n have valid_bdy: \n \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s} \\ P') (the (\\ q)) Q',A'\"\n by - (rule WF.hyps, auto)\n from Pre q\n have Pre': \"s \\ {s} \\ P'\"\n by auto\n from valid_bdy ctxt Pre'\n have \"\\\\the (\\ q) \\ Normal s\"\n by (auto simp add: validt_def)\n with valid_body q \n show \"\\\\Call q\\ Normal s\"\n by (fastforce intro: terminates.Call)\n qed\n }\n hence \"\\(P, p, Q, A)\\Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by (auto simp add: cvalidt_def Specs_wf)\n with ctxt have \"\\(P, p, Q, A)\\\\ \\ Specs_wf p \\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P Call p Q,A\"\n by auto\n with p valid_body \n show \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (simp add: cvalidt_def) blast\n qed\n }\n note lem = this\n have valid_body': \n \"\\\\. \\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A \\ \n \\(P,p,Q,A)\\Specs. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ P) (the (\\ p)) Q,A\"\n by (auto intro: lem)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_call: \"\\\\\\Call p,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec_call show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix bdy \n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal s\\ \\ t\"\n from exec_body bdy p P t_notin_F \n valid_body' [of \"s\", OF ctxt] \n ctxt\n have \"t \\ Normal ` Q \\ Abrupt ` A\"\n apply (simp only: cvalidt_def validt_def valid_def) \n apply (drule (1) bspec)\n apply auto\n done\n with p P \n show ?thesis\n by simp\n next\n assume \"\\ p = None\"\n with p valid_body have False by auto\n thus ?thesis by simp\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\"\n show \"\\\\Call p \\ Normal s\"\n proof -\n from ctxt P p valid_body' [of \"s\",OF ctxt]\n have \"\\\\(the (\\ p)) \\ Normal s\"\n by (auto simp add: cvalidt_def validt_def)\n with valid_body p show ?thesis\n by (fastforce intro: terminates.Call)\n qed\n qed\n qed\nnext\n case (DynCom P \\ F c Q A)\n hence valid_c: \"\\s\\P. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A\" by simp\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\DynCom c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n assume \"\\\\\\c s,Normal s\\ \\ t\" \n from cvalidt_postD [OF valid_c [rule_format, OF P] ctxt this P t_notin_F]\n show ?thesis .\n qed\n next\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\DynCom c \\ Normal s\"\n proof -\n from cvalidt_termD [OF valid_c [rule_format, OF P] ctxt P]\n have \"\\\\c s \\ Normal s\" .\n thus ?thesis\n by (rule terminates.intros)\n qed\n qed\nnext\n case (Throw \\ F A Q)\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume \"\\\\\\Throw,Normal s\\ \\ t\" \"s \\ A\"\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by cases simp\n next\n fix s\n show \"\\\\Throw \\ Normal s\"\n by (rule terminates.intros)\n qed\nnext\n case (Catch \\ F P c\\<^sub>1 Q R c\\<^sub>2 A)\n have valid_c1: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n have valid_c2: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases)\n fix s'\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt s'\" \n assume exec_c2: \"\\\\\\c\\<^sub>2,Normal s'\\ \\ t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have \"Abrupt s' \\ Abrupt ` R\"\n by auto\n with cvalidt_postD [OF valid_c2 ctxt] exec_c2 t_notin_F\n show ?thesis\n by fastforce\n next\n assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" \n assume notAbr: \"\\ isAbr t\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P] t_notin_F\n have \"t \\ Normal ` Q \\ Abrupt ` R\" .\n with notAbr\n show ?thesis\n by auto\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s\" \n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1\\ Normal s\"\n by (rule cvalidt_termD)\n moreover\n {\n fix r assume exec_c1: \"\\\\\\c\\<^sub>1,Normal s\\ \\ Abrupt r\"\n from cvalidt_postD [OF valid_c1 ctxt exec_c1 P]\n have r: \"Abrupt r\\Normal ` Q \\ Abrupt ` R\"\n by auto\n hence \"Abrupt r\\Abrupt ` R\" by fast\n with cvalidt_termD [OF valid_c2 ctxt] exec_c1\n have \"\\\\c\\<^sub>2 \\ Normal r\"\n by fast\n }\n ultimately show ?thesis\n by (iprover intro: terminates.intros)\n qed\n qed\nnext\n case (Conseq P \\ F c Q A)\n hence adapt: \n \"\\s \\ P. (\\P' Q' A'. (\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\ s \\ P'\\ Q' \\ Q \\ A' \\ A)\" by blast\n show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n proof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from adapt [rule_format, OF P]\n obtain P' and Q' and A' where \n valid_P'_Q': \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n and weaken: \"s \\ P'\" \"Q' \\ Q\" \"A'\\ A\"\n by blast\n from exec valid_P'_Q' ctxt t_notin_F\n have P'_Q': \"Normal s \\ Normal ` P' \\ \n t \\ Normal ` Q' \\ Abrupt ` A'\"\n by (unfold cvalidt_def validt_def valid_def) blast\n hence \"s \\ P' \\ t \\ Normal ` Q' \\ Abrupt ` A'\"\n by blast\n with weaken \n show ?thesis\n by blast\n qed\n next\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from P adapt\n obtain P' and Q' and A' where \n \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A'\"\n \"s \\ P'\"\n by blast\n with ctxt\n show ?thesis\n by (simp add: cvalidt_def validt_def)\n qed\n qed\nnext\n case (Asm P p Q A \\ F)\n assume \"(P, p, Q, A) \\ \\\"\n then show \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n by (auto simp add: cvalidt_def )\nnext\n case ExFalso thus ?case by iprover\nqed\n\nlemma hoaret_sound':\n\"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (drule hoaret_sound)\n apply (simp add: cvalidt_def)\n done\n\ntheorem total_to_partial: \n assumes total: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" shows \"\\,{}\\\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from total have \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_sound)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n by (simp add: cvalidt_def validt_def cvalid_def)\n thus ?thesis\n by (rule hoare_complete)\nqed\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s} c \n {t. \\\\\\c,Normal Z\\ \\ Normal t}, {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (rule validtI) \n fix s t\n assume \"\\\\\\c,Normal s\\ \\ t\" \n \"s \\ {s. s = Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n \"t \\ Fault ` F\"\n thus \"t \\ Normal ` {t. \\\\\\c,Normal Z\\ \\ Normal t} \\ \n Abrupt ` {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n apply (cases t) \n apply (auto simp add: final_notin_def)\n done\nnext\n fix s\n assume \"s \\ {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c\\Normal s}\"\n thus \"\\\\c\\Normal s\"\n by blast\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n assumes modif: \"\\Z::'a. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z::'a assn) c (Q' Z),(A' Z)\"\n assumes impl: \"\\s. s \\ P \\ s \\ P' s \\ (\\t. t \\ Q' s \\ t \\ Q) \\ \n (\\t. t \\ A' s \\ t \\ A)\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby - (rule conseq [OF modif],blast)\n\nlemma MGT_implies_complete:\n assumes MGT: \"\\Z. \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s}\n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n assumes valid: \"\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n shows \"\\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n using MGT\n apply (rule ConseqMGT) \n apply (insert valid)\n apply (auto simp add: validt_def valid_def intro!: final_notinI)\n done\n\nlemma conseq_extract_state_indep_prop: \n assumes state_indep_prop:\"\\s \\ P. R\" \n assumes to_show: \"R \\ \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule Conseq)\n apply (clarify)\n apply (rule_tac x=\"P\" in exI)\n apply (rule_tac x=\"Q\" in exI)\n apply (rule_tac x=\"A\" in exI)\n using state_indep_prop to_show\n by blast\n\nlemma MGT_lemma:\n assumes MGT_Calls: \n \"\\p \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n shows \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},{t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\nproof (induct c)\n case Skip\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Skip,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Skip \\ Normal s} \n Skip\n {t. \\\\\\Skip,Normal Z\\ \\ Normal t},{t. \\\\\\Skip,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Skip [THEN conseqPre])\n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Basic f)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\Basic f,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Basic f \\ Normal s} \n Basic f\n {t. \\\\\\Basic f,Normal Z\\ \\ Normal t},\n {t. \\\\\\Basic f,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Basic [THEN conseqPre]) \n (auto elim: exec_elim_cases simp add: final_notin_def \n intro: exec.intros terminates.intros)\nnext\n case (Spec r)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Spec r,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Spec r \\ Normal s} \n Spec r\n {t. \\\\\\Spec r,Normal Z\\ \\ Normal t},\n {t. \\\\\\Spec r,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.Spec [THEN conseqPre])\n apply (clarsimp simp add: final_notin_def)\n apply (case_tac \"\\t. (Z,t) \\ r\")\n apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n done\nnext\n case (Seq c1 c2) \n have hyp_c1: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s}\n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n have hyp_c2: \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s}\n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Seq.hyps by iprover\n from hyp_c1 \n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Seq c1 c2\\Normal s} c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t \\ \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n elim: terminates_Normal_elim_cases \n intro: exec.intros)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Seq c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Seq c1 c2\\Normal s} \n Seq c1 c2\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule hoaret.Seq )\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c1,Normal Z\\ \\ Normal t \\\n \\\\\\c2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \\\\c2 \\ Normal t}\n c2 \n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [OF hyp_c2],safe)\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Normal t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Normal t\"\n by (rule exec.intros)\n next\n fix r t\n assume \"\\\\\\c1,Normal Z\\ \\ Normal r\" \"\\\\\\c2,Normal r\\ \\ Abrupt t\"\n then show \"\\\\\\Seq c1 c2,Normal Z\\ \\ Abrupt t\"\n by (rule exec.intros)\n qed\n qed\nnext\n case (Cond b c1 c2) \n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c1\\Normal s} \n c1 \n {t. \\\\\\c1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c1,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\b) \n c1 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondTrue \n elim: terminates_Normal_elim_cases)\n moreover\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c2\\Normal s} \n c2 \n {t. \\\\\\c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c2,Normal Z\\ \\ Abrupt t}\" \n using Cond.hyps by iprover \n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s}\\-b) \n c2 \n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\" \n by (rule ConseqMGT)\n (fastforce simp add: final_notin_def intro: exec.CondFalse \n elim: terminates_Normal_elim_cases)\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Cond b c1 c2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Cond b c1 c2)\\Normal s} \n (Cond b c1 c2)\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Cond b c1 c2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Cond) \nnext\n case (While b c)\n let ?unroll = \"({(s,t). s\\b \\ \\\\\\c,Normal s\\ \\ Normal t})\\<^sup>*\"\n let ?P' = \"\\Z. {t. (Z,t)\\?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\"\n let ?A = \"\\Z. {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n let ?r = \"{(t,s). \\\\(While b c)\\Normal s \\ s\\b \\ \n \\\\\\c,Normal s\\ \\ Normal t}\"\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(While b c)\\Normal s} \n (While b c)\n {t. \\\\\\While b c,Normal Z\\ \\ Normal t},\n {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t}\"\n proof (rule ConseqMGT [where ?P'=\"\\ Z. ?P' Z\" \n and ?Q'=\"\\ Z. ?P' Z \\ - b\"])\n have wf_r: \"wf ?r\" by (rule wf_terminates_while)\n show \"\\ Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\ - b),(?A Z)\"\n proof (rule allI, rule hoaret.While [OF wf_r])\n fix Z\n from While \n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub>{s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\c\\Normal s}\n c\n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\" by iprover\n show \"\\\\. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> ({\\} \\ ?P' Z \\ b) c \n ({t. (t, \\) \\ ?r} \\ ?P' Z),(?A Z)\"\n proof (rule allI, rule ConseqMGT [OF hyp_c])\n fix \\ s\n assume \"s\\ {\\} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t}\n \\ b\"\n then obtain \n s_eq_\\: \"s=\\\" and\n Z_s_unroll: \"(Z,s) \\ ?unroll\" and\n noabort:\"\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" and\n while_term: \"\\\\(While b c)\\Normal s\" and\n s_in_b: \"s\\b\" \n by blast\n show \"s \\ {t. t = s \\ \\\\\\c,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal t} \\\n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Normal t} \\\n t \\ {t. (t,\\) \\ ?r} \\ \n {t. (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b \n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\ \n \\\\(While b c)\\Normal t}) \\ \n (\\t. t \\ {t. \\\\\\c,Normal s\\ \\ Abrupt t} \\\n t \\ {t. \\\\\\While b c,Normal Z\\ \\ Abrupt t})\"\n (is \"?C1 \\ ?C2 \\ ?C3\")\n proof (intro conjI)\n from Z_s_unroll noabort s_in_b while_term show ?C1 \n by (blast elim: terminates_Normal_elim_cases)\n next\n {\n fix t \n assume s_t: \"\\\\\\c,Normal s\\ \\ Normal t\"\n with s_eq_\\ while_term s_in_b have \"(t,\\) \\ ?r\"\n by blast\n moreover\n from Z_s_unroll s_t s_in_b \n have \"(Z, t) \\ ?unroll\"\n by (blast intro: rtrancl_into_rtrancl)\n moreover from while_term s_t s_in_b \n have \"\\\\(While b c)\\Normal t\"\n by (blast elim: terminates_Normal_elim_cases)\n moreover note noabort\n ultimately \n have \"(t,\\) \\ ?r \\ (Z, t) \\ ?unroll \\ \n (\\e. (Z,e)\\?unroll \\ e\\b\n \\ \\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)) \\\n \\\\(While b c)\\Normal t\"\n by iprover\n }\n then show ?C2 by blast\n next\n {\n fix t\n assume s_t: \"\\\\\\c,Normal s\\ \\ Abrupt t\" \n from Z_s_unroll noabort s_t s_in_b\n have \"\\\\\\While b c,Normal Z\\ \\ Abrupt t\"\n by blast\n } thus ?C3 by simp\n qed\n qed\n qed\n next\n fix s\n assume P: \"s \\ {s. s=Z \\ \\\\\\While b c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\While b c \\ Normal s}\"\n hence WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by auto\n show \"s \\ ?P' s \\ \n (\\t. t\\(?P' s \\ - b)\\\n t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\\\n (\\t. t\\?A s \\ t\\?A Z)\"\n proof (intro conjI)\n {\n fix e\n assume \"(Z,e) \\ ?unroll\" \"e \\ b\"\n from this WhileNoFault\n have \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n (\\u. \\\\\\c,Normal e\\ \\Abrupt u \\ \n \\\\\\While b c,Normal Z\\ \\ Abrupt u)\" (is \"?Prop Z e\")\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n assume e_in_b: \"e \\ b\"\n assume WhileNoFault: \"\\\\\\While b c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n with e_in_b WhileNoFault\n have cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n moreover\n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with e_in_b have \"\\\\\\While b c,Normal e\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n ultimately\n show \"?Prop e e\"\n by iprover\n next\n fix Z r\n assume e_in_b: \"e\\b\" \n assume WhileNoFault: \"\\\\\\While b c,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n assume hyp: \"\\e\\b;\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\ ?Prop r e\"\n assume Z_r:\n \"(Z, r) \\ {(Z, r). Z \\ b \\ \\\\\\c,Normal Z\\ \\ Normal r}\"\n with WhileNoFault\n have \"\\\\\\While b c,Normal r\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from hyp [OF e_in_b this] obtain\n cNoFault: \"\\\\\\c,Normal e\\ \\\\({Stuck} \\ Fault ` (-F))\" and\n Abrupt_r: \"\\u. \\\\\\c,Normal e\\ \\ Abrupt u \\ \n \\\\\\While b c,Normal r\\ \\ Abrupt u\"\n by simp\n \n {\n fix u assume \"\\\\\\c,Normal e\\ \\ Abrupt u\"\n with Abrupt_r have \"\\\\\\While b c,Normal r\\ \\ Abrupt u\" by simp\n moreover from Z_r obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by simp\n ultimately have \"\\\\\\While b c,Normal Z\\ \\ Abrupt u\"\n by (blast intro: exec.intros)\n }\n with cNoFault show \"?Prop Z e\"\n by iprover\n qed\n }\n with P show \"s \\ ?P' s\"\n by blast\n next\n {\n fix t\n assume \"termination\": \"t \\ b\"\n assume \"(Z, t) \\ ?unroll\"\n hence \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof (induct rule: converse_rtrancl_induct [consumes 1])\n from \"termination\" \n show \"\\\\\\While b c,Normal t\\ \\ Normal t\"\n by (blast intro: exec.WhileFalse)\n next\n fix Z r\n assume first_body: \n \"(Z, r) \\ {(s, t). s \\ b \\ \\\\\\c,Normal s\\ \\ Normal t}\"\n assume \"(r, t) \\ ?unroll\"\n assume rest_loop: \"\\\\\\While b c, Normal r\\ \\ Normal t\"\n show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n proof -\n from first_body obtain\n \"Z \\ b\" \"\\\\\\c,Normal Z\\ \\ Normal r\"\n by fast\n moreover\n from rest_loop have\n \"\\\\\\While b c,Normal r\\ \\ Normal t\"\n by fast\n ultimately show \"\\\\\\While b c,Normal Z\\ \\ Normal t\"\n by (rule exec.WhileTrue)\n qed\n qed\n }\n with P\n show \"(\\t. t\\(?P' s \\ - b)\n \\t\\{t. \\\\\\While b c,Normal Z\\ \\ Normal t})\"\n by blast\n next\n from P show \"\\t. t\\?A s \\ t\\?A Z\"\n by simp\n qed\n qed\nnext\n case (Call p)\n from noStuck_Call\n have \"\\s \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\\n \\\\Call p\\ Normal s}.\n p \\ dom \\\"\n by (fastforce simp add: final_notin_def)\n then show ?case\n proof (rule conseq_extract_state_indep_prop)\n assume p_defined: \"p \\ dom \\\"\n with MGT_Calls show\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \n \\\\\\Call p ,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))\\\n \\\\Call p\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (auto)\n qed\nnext\n case (DynCom c)\n have hyp: \n \"\\s'. \\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c s',Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c s'\\Normal s} c s'\n {t. \\\\\\c s',Normal Z\\ \\ Normal t},{t. \\\\\\c s',Normal Z\\ \\ Abrupt t}\"\n using DynCom by simp\n have hyp':\n \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s = Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s} \n (c Z)\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},{t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp]) \n (fastforce simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>{s. s=Z \\ \\\\\\DynCom c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\DynCom c\\Normal s}\n DynCom c\n {t. \\\\\\DynCom c,Normal Z\\ \\ Normal t},\n {t. \\\\\\DynCom c,Normal Z\\ \\ Abrupt t}\"\n apply (rule hoaret.DynCom)\n apply (clarsimp)\n apply (rule hyp' [simplified])\n done\nnext\n case (Guard f g c)\n have hyp_c: \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\Normal s} \n c \n {t. \\\\\\c,Normal Z\\ \\ Normal t},\n {t. \\\\\\c,Normal Z\\ \\ Abrupt t}\"\n using Guard by iprover\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Guard f g c,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Guard f g c\\ Normal s} \n Guard f g c \n {t. \\\\\\Guard f g c ,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n proof (cases \"f \\ F\")\n case True\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s})\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply (insert True)\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n from True this\n show ?thesis\n by (rule conseqPre [OF Guarantee]) auto\n next\n case False\n from hyp_c\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F \\<^esub>(g \\ {s. s \\ g \\ s=Z \\ \n \\\\\\Guard f g c,Normal s\\ \\\\({Stuck}\\ Fault ` (-F))\\\n \\\\Guard f g c\\ Normal s} )\n c\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Normal t},\n {t. \\\\\\Guard f g c,Normal Z\\ \\ Abrupt t}\"\n apply (rule ConseqMGT)\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply (auto simp add: final_notin_def intro: exec.intros \n elim: terminates_Normal_elim_cases)\n done\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Throw \\ Normal s}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>1 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \\\\c\\<^sub>2 \\ Normal t \\\n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n elim: terminates_Normal_elim_cases\n simp add: final_notin_def)\n moreover\n have \n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\c\\<^sub>2 \\ Normal s} c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n hence \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. \\\\\\c\\<^sub>1,Normal Z\\ \\Abrupt s \\ \\\\c\\<^sub>2 \\ Normal s \\ \n \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F))} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT)\n (fastforce intro: exec.intros terminates.intros \n simp add: noFault_def')\n ultimately\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Catch c\\<^sub>1 c\\<^sub>2 \\ Normal s} \n Catch c\\<^sub>1 c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule hoaret.Catch )\nqed\n\n\n\n\n assume \"Z \\ g\"\n from this have \"\\\\(Guard f g c,Normal Z) \\ (c,Normal Z)\"\n by (rule step.Guard)\n from step_redexes [OF this c'] obtain c'' where\n step: \"\\\\ (c', Normal Z) \\ (c'', Normal Z)\" and c'': \"c \\ redexes c''\"\n by blast\n note steps also note step \n finally show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c \\ redexes c'\"\n using c'' by blast\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Normal t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n next\n fix t\n assume \"\\\\\\Guard f g c ,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\Guard f g c ,Normal Z\\ \\ Abrupt t\"\n using False\n by (cases \"Z\\ g\") (auto simp add: final_notin_def intro: exec.intros )\n qed\n then show ?thesis\n apply (rule conseqPre [OF hoaret.Guard])\n apply clarify\n apply (frule Guard_noFaultStuckD [OF _ False])\n apply auto\n done\n qed\nnext\n case Throw\n show \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Throw,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal \\ \\\n (\\c'. \\\\(Call p, Normal \\) \\\\<^sup>+ (c',Normal s) \\ Throw \\ redexes c')}\n Throw\n {t. \\\\\\Throw,Normal Z\\ \\ Normal t},\n {t. \\\\\\Throw,Normal Z\\ \\ Abrupt t}\"\n by (rule conseqPre [OF hoaret.Throw]) \n (blast intro: exec.intros terminates.intros)\nnext\n case (Catch c\\<^sub>1 c\\<^sub>2)\n have hyp_c1:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>1,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ \n c\\<^sub>1 \\ redexes c')}\n c\\<^sub>1 \n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have hyp_c2:\n \"\\Z. \\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s= Z \\ \\\\\\c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal s) \\ c\\<^sub>2 \\ redexes c')}\n c\\<^sub>2\n {t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Normal t},{t. \\\\\\c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n using Catch.hyps by iprover\n have\n \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s = Z \\ \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\)\\\\<^sup>+(c',Normal s) \\\n Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c')}\n c\\<^sub>1\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault`(-F)) \\ \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')}\"\n proof (rule ConseqMGT [OF hyp_c1],clarify,safe) \n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n thus \"\\\\\\c\\<^sub>1,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n next\n fix c'\n assume steps: \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume c': \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n from steps redexes_subset [OF this]\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z) \\ c\\<^sub>1 \\ redexes c'\"\n by (auto iff: root_in_redexes)\n next\n fix t\n assume \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Normal t\"\n thus \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t\"\n by (auto intro: exec.intros)\n next\n fix t\n assume \"\\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\\\({Stuck} \\ Fault ` (-F))\" \n \"\\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n thus \"\\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F))\"\n by (auto simp add: final_notin_def intro: exec.intros)\n next\n fix c' t\n assume steps_c': \"\\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal Z)\" \n assume red: \"Catch c\\<^sub>1 c\\<^sub>2 \\ redexes c'\"\n assume exec_c\\<^sub>1: \"\\\\ \\c\\<^sub>1,Normal Z\\ \\ Abrupt t\"\n show \"\\c'. \\\\ (Call p, Normal \\) \\\\<^sup>+ (c', Normal t) \\ c\\<^sub>2 \\ redexes c'\"\n proof -\n note steps_c'\n also\n from exec_impl_steps_Normal_Abrupt [OF exec_c\\<^sub>1]\n have \"\\\\ (c\\<^sub>1, Normal Z) \\\\<^sup>* (Throw, Normal t)\".\n from steps_redexes_Catch [OF this red] \n obtain c'' where\n steps_c'': \"\\\\ (c', Normal Z) \\\\<^sup>* (c'', Normal t)\" and\n Catch: \"Catch Throw c\\<^sub>2 \\ redexes c''\"\n by blast\n note steps_c''\n also \n have step_Catch: \"\\\\ (Catch Throw c\\<^sub>2,Normal t) \\ (c\\<^sub>2,Normal t)\"\n by (rule step.CatchThrow)\n from step_redexes [OF step_Catch Catch]\n obtain c''' where\n step_c''': \"\\\\ (c'', Normal t) \\ (c''', Normal t)\" and\n c2: \"c\\<^sub>2 \\ redexes c'''\"\n by blast\n note step_c'''\n finally show ?thesis\n using c2\n by blast\n qed\n qed\n moreover\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> {t. \\\\\\c\\<^sub>1,Normal Z\\ \\ Abrupt t \\ \n \\\\\\c\\<^sub>2,Normal t\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p \\ Normal \\ \\\n (\\c'. \\\\(Call p,Normal \\) \\\\<^sup>+ (c',Normal t) \\ c\\<^sub>2 \\ redexes c')} \n c\\<^sub>2\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Normal t},\n {t. \\\\\\Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\ \\ Abrupt t}\"\n by (rule ConseqMGT [OF hyp_c2]) (fastforce intro: exec.intros)\n ultimately show ?case\n by (rule hoaret.Catch)\nqed\n\n\ntext {* To prove a procedure implementation correct it suffices to assume\n only the procedure specifications of procedures that actually\n occur during evaluation of the body. \n *}\n\nlemma Call_lemma:\n assumes A: \n \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes pdef: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\\\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n the (\\ p) \n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\napply (rule conseqPre)\napply (rule Call_lemma' [OF A])\nusing pdef\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] root_in_redexes)\ndone\n\nlemma Call_lemma_switch_Call_body:\n assumes \n call: \"\\q \\ dom \\. \\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n {s. s=Z \\ \\\\\\Call q,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call q\\Normal s \\ ((s,q),(\\,p)) \\ termi_call_steps \\}\n (Call q)\n {t. \\\\\\Call q,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call q,Normal Z\\ \\ Abrupt t}\"\n assumes p_defined: \"p \\ dom \\\"\n shows \"\\Z. \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> \n ({\\} \\ {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n the (\\ p) \n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])\napply (rule conseqPre)\napply (rule Call_lemma')\napply (rule call)\nusing p_defined\napply (fastforce intro: terminates.intros tranclp.r_into_trancl [of \"(step \\)\", OF step.Call] \nroot_in_redexes)\ndone\n\nlemma MGT_Call:\n\"\\p \\ dom \\. \\Z. \n \\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\napply (intro ballI allI)\napply (rule CallRec' [where Procs=\"dom \\\" and\n P=\"\\p Z. {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}\" and\n Q=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Normal t}\" and\n A=\"\\p Z. {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\" and\n r=\"termi_call_steps \\\"\n ]) \napply simp\napply simp\napply (rule wf_termi_call_steps)\napply (intro ballI allI)\napply simp\napply (rule Call_lemma_switch_Call_body [rule_format, simplified])\napply (rule hoaret.Asm)\napply fastforce\napply assumption\ndone\n\n\nlemma CollInt_iff: \"{s. P s} \\ {s. Q s} = {s. P s \\ Q s}\"\n by auto\n\nlemma image_Un_conv: \"f ` (\\p\\dom \\. \\Z. {x p Z}) = (\\p\\dom \\. \\Z. {f (x p Z)})\"\n by (auto iff: not_None_eq)\n\n\ntext {* Another proof of @{text MGT_Call}, maybe a little more readable *}\nlemma \n\"\\p \\ dom \\. \\Z. \n \\,{} \\\\<^sub>t\\<^bsub>/F\\<^esub> {s. s=Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\(Call p)\\Normal s}\n (Call p)\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\nproof -\n {\n fix p Z \\\n assume defined: \"p \\ dom \\\"\n def Specs == \"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\"\n def Specs_wf == \"(\\p \\. (\\(P,q,Q,A). \n (P \\ {s. ((s,q),\\,p) \\ termi_call_steps \\}, q, Q, A)) ` Specs)\"\n have \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\the (\\ p),Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\the (\\ p)\\Normal s}) \n (the (\\ p))\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Normal t},\n {t. \\\\\\the (\\ p),Normal Z\\ \\ Abrupt t}\"\n apply (rule Call_lemma [rule_format, OF _ defined])\n apply (rule hoaret.Asm)\n apply (clarsimp simp add: Specs_wf_def Specs_def image_Un_conv)\n apply (rule_tac x=q in bexI)\n apply (rule_tac x=Z in exI)\n apply (clarsimp simp add: CollInt_iff)\n apply auto\n done\n hence \"\\,Specs_wf p \\\n \\\\<^sub>t\\<^bsub>/F\\<^esub>({\\} \\\n {s. s = Z \\ \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s}) \n (the (\\ p))\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t}\"\n by (simp only: exec_Call_body' [OF defined] \n noFaultStuck_Call_body' [OF defined] \n terminates_Normal_Call_body [OF defined])\n } note bdy=this\n show ?thesis\n apply (intro ballI allI)\n apply (rule hoaret.CallRec [where Specs=\"(\\p\\dom \\. \\Z. \n {({s. s=Z \\ \n \\\\\\Call p,Normal s\\ \\\\({Stuck} \\ Fault ` (-F)) \\ \n \\\\Call p\\Normal s},\n p,\n {t. \\\\\\Call p,Normal Z\\ \\ Normal t},\n {t. \\\\\\Call p,Normal Z\\ \\ Abrupt t})})\", \n OF _ wf_termi_call_steps [of \\] refl])\n apply fastforce\n apply clarify\n apply (rule conjI)\n apply fastforce\n apply (rule allI)\n apply (simp (no_asm_use) only : Un_empty_left)\n apply (rule bdy)\n apply auto\n done\nqed\n\n\ntheorem hoaret_complete: \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\ \\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Call])\n\nlemma hoaret_complete': \n assumes cvalid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\")\n case True\n hence \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_complete)\n thus \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (rule hoaret_augment_context) simp\nnext\n case False\n with cvalid\n show ?thesis\n by (rule ExFalso)\nqed\n\nsubsection {* And Now: Some Useful Rules *}\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\(Call p),Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturn:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr, \n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n assumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n assumes valid_modif: \n \"\\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call p (Modif \\),(ModifAbr \\)\" \n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\call init p return c,Normal s\\ \\ t\"\n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from exec\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\(Call p) ,Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with res_modif have \"Normal (return' s t') = Normal (return s t')\"\n by simp\n with exec_body exec_c bdy \n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ p = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also \n from exec_body bdy\n have \"\\\\\\Call p ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init p return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init p return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ p = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n assume \"\\ p = None\" \"t=Stuck\"\n hence \"\\\\\\call init p return' c,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have call: \"\\\\call init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n show \"\\\\call init p return c \\ Normal s\"\n proof (cases \"p \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ p = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\(Call p ),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of \"init s\"] ctxt' this] P \n res_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\nqed\n\nlemma ProcModifyReturnSameFaults:\n assumes spec: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n assumes res_modif:\n \"\\s t. t \\ Modif (init s) \\ (return' s t) = (return s t)\"\n assumes ret_modifAbr: \n \"\\s t. t \\ ModifAbr (init s) \\ (return' s t) = (return s t)\"\n assumes modifies_spec: \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call p) (Modif \\),(ModifAbr \\)\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoaret_complete') \napply (rule ProcModifyReturnSameFaults_sound [where Modif=Modif and ModifAbr=ModifAbr,\n OF _ _ res_modif ret_modifAbr])\napply (rule hoaret_sound [OF spec])\nusing modifies_spec\napply (blast intro: hoare_sound)\ndone\n\n\nsubsubsection {* DynCall *}\n\n\nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.Call)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n then have ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n by (auto intro: valid_augment_Faults)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \n \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \n \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \n \\,\\\\\\<^bsub>/UNIV\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturn_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n \"\\s\\P. \\\\. \\,\\ \\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume exec: \"\\\\\\dynCall init p return c,Normal s\\ \\ t\"\n assume t_notin_F: \"t \\ Fault ` F\"\n assume P: \"s \\ P\"\n with valid_modif \n have valid_modif': \n \"\\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} (Call (p s)) (Modif \\),(ModifAbr \\)\"\n by blast\n from exec\n have \"\\\\\\call init (p s) return c,Normal s\\ \\ t\"\n by (cases rule: exec_dynCall_Normal_elim)\n then show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases rule: exec_call_Normal_elim)\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t'\" \n assume exec_c: \"\\\\\\c s t',Normal (return s t')\\ \\ t\" \n from exec_body bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ Modif (init s)\"\n by auto\n with ret_modif have \"Normal (return' s t') = \n Normal (return s t')\"\n by simp\n with exec_body exec_c bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_call)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy t'\n assume bdy: \"\\ (p s) = Some bdy\"\n assume exec_body: \"\\\\\\bdy,Normal (init s)\\ \\ Abrupt t'\" \n assume t: \"t = Abrupt (return s t')\"\n also from exec_body bdy\n have \"\\\\\\Call (p s) ,Normal (init s)\\ \\ Abrupt t'\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif' [rule_format, of \"init s\"] ctxt' this] P\n have \"t' \\ ModifAbr (init s)\"\n by auto\n with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n by simp\n finally have \"t = Abrupt (return' s t')\" .\n with exec_body bdy\n have \"\\\\\\call init (p s) return' c,Normal s\\ \\ t\" \n by (auto intro: exec_callAbrupt)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this] P t_notin_F\n show ?thesis\n by simp\n next\n fix bdy f\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Fault f\" and\n t: \"t = Fault f\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callFault)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from cvalidt_postD [OF valid_call ctxt this P] t t_notin_F\n show ?thesis\n by simp\n next\n fix bdy\n assume bdy: \"\\ (p s) = Some bdy\"\n assume \"\\\\\\bdy,Normal (init s)\\ \\ Stuck\" \n \"t = Stuck\"\n with bdy have \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callStuck)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n fix bdy\n assume \"\\ (p s) = None\" \"t=Stuck\"\n hence \"\\\\\\call init (p s) return' c ,Normal s\\ \\ t\"\n by (auto intro: exec_callUndefined)\n hence \"\\\\\\dynCall init p return' c,Normal s\\ \\ t\" \n by (rule exec_dynCall)\n from valid_call ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def)\n assume P: \"s \\ P\"\n from valid_call ctxt P\n have \"\\\\dynCall init p return' c\\ Normal s\"\n by (rule cvalidt_termD)\n hence call: \"\\\\call init (p s) return' c\\ Normal s\"\n by cases\n have \"\\\\call init (p s) return c \\ Normal s\"\n proof (cases \"p s \\ dom \\\")\n case True\n with call obtain bdy where \n bdy: \"\\ (p s) = Some bdy\" and termi_bdy: \"\\\\bdy \\ Normal (init s)\" and \n termi_c: \"\\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \n \\\\c s t \\ Normal (return' s t)\"\n by cases auto \n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n hence \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy bdy\n have \"\\\\\\Call (p s),Normal (init s)\\ \\ Normal t\"\n by (auto simp add: intro: exec.intros)\n from cvalidD [OF valid_modif [rule_format, of s \"init s\"] ctxt' this] P \n ret_modif\n have \"return' s t = return s t\"\n by auto\n with termi_c exec_bdy show ?thesis by auto\n qed\n }\n with bdy termi_bdy\n show ?thesis\n by (iprover intro: terminates_call)\n next\n case False\n thus ?thesis\n by (auto intro: terminates_callUndefined)\n qed\n thus \"\\\\dynCall init p return c \\ Normal s\"\n by (iprover intro: terminates_dynCall)\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n \"\\s t. t \\ Modif (init s) \\ return' s t = return s t\"\nassumes ret_modifAbr: \"\\s t. t \\ ModifAbr (init s) \\ return' s t = return s t\"\nassumes modif: \n \"\\s \\ P. \\\\. \\,\\\\\\<^bsub>/F\\<^esub> {\\} Call (p s) (Modif \\),(ModifAbr \\)\" \nshows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoaret_complete')\napply (rule dynProcModifyReturnSameFaults_sound \n [where Modif=Modif and ModifAbr=ModifAbr,\n OF hoaret_sound [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_sound [OF modif [rule_format]])\napply assumption\ndone\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\n assumes valid_Q: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_R: \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n from valid_Q ctxt exec P t_notin_F have \"t \\ Normal ` Q \\ Abrupt ` A\"\n by (rule cvalidt_postD)\n moreover\n from valid_R ctxt exec P t_notin_F have \"t \\ Normal ` R \\ Abrupt ` B\"\n by (rule cvalidt_postD)\n ultimately show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ B)\"\n by blast\nnext \n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from valid_Q ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\nlemma PostConjI:\n assumes deriv_Q: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \n assumes deriv_R: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c R,B\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ B)\"\napply (rule hoaret_complete')\napply (rule PostConjI_sound)\napply (rule hoaret_sound [OF deriv_Q])\napply (rule hoaret_sound [OF deriv_R])\ndone\n\n\nlemma Merge_PostConj_sound: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n with F_G have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n by (auto intro: validt_augment_Faults)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n with P_P' have P': \"s \\ P'\"\n by auto\n assume t_noFault: \"t \\ Fault ` F\"\n show \"t \\ Normal ` (Q \\ R) \\ Abrupt ` (A \\ X)\"\n proof -\n from cvalidt_postD [OF validF [rule_format] ctxt exec P t_noFault]\n have \"t \\ Normal ` Q \\ Abrupt ` A\".\n moreover from this have \"t \\ Fault ` G\"\n by auto\n from cvalidt_postD [OF validG [rule_format] ctxt' exec P' this]\n have \"t \\ Normal ` R \\ Abrupt ` X\" .\n ultimately show ?thesis by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n from validF ctxt P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\nqed\n\n\n\nlemma Merge_PostConj: \n assumes validF: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validG: \"\\,\\\\\\<^sub>t\\<^bsub>/G\\<^esub> P' c R,X\"\n assumes F_G: \"F \\ G\"\n assumes P_P': \"P \\ P'\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c (Q \\ R),(A \\ X)\"\napply (rule hoaret_complete')\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoaret_sound)\nusing validG apply (blast intro:hoaret_sound)\ndone\n\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\n assumes valid_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\n assumes valid_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\ \\\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto simp add: validt_def) \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\"\n assume t_notin_F: \"t \\ Fault ` F\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case Normal\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case Abrupt\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n next\n case (Fault f)\n assume t: \"t=Fault f\"\n with exec inter_guards_exec_Fault [OF c]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f \\ \\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n by auto\n then show ?thesis\n proof (cases rule: disjE [consumes 1])\n assume \"\\\\\\c\\<^sub>1,Normal s\\ \\ Fault f\"\n from cvalidt_postD [OF valid_c1 ctxt this P] t t_notin_F\n show ?thesis\n by blast\n next\n assume \"\\\\\\c\\<^sub>2,Normal s\\ \\ Fault f\"\n from cvalidD [OF valid_c2 ctxt' this P] t t_notin_F\n show ?thesis\n by blast\n qed\n next\n case Stuck\n with inter_guards_exec_noFault [OF c exec]\n have \"\\\\\\c\\<^sub>1,Normal s\\ \\ t\" by simp\n from valid_c1 ctxt this P t_notin_F\n show ?thesis\n by (rule cvalidt_postD)\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid_c1 ctxt P\n have \"\\\\c\\<^sub>1 \\ Normal s\"\n by (rule cvalidt_termD)\n with c show ?thesis\n by (rule inter_guards_terminates)\n qed\nqed\n\nlemma SplitGuards: \n assumes c: \"(c\\<^sub>1 \\\\<^sub>g c\\<^sub>2) = Some c\" \n assumes deriv_c1: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n assumes deriv_c2: \"\\,\\\\\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SplitGuards_sound [OF _ _ c])\napply (rule hoaret_sound [OF deriv_c1])\napply (rule hoare_sound [OF deriv_c2])\ndone\n\nlemma CombineStrip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes valid_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n by (auto simp add: validt_def)\n from ctxt have ctxt'': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt'' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt'' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with exec Fault\n have \"\\\\\\strip_guards (-F) c,Normal s\\ \\ Fault f\" \n by (auto intro: exec_to_exec_strip_guards_Fault)\n from cvalidD [OF valid_strip ctxt' this P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt'' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt'' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\nlemma CombineStrip:\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes deriv_strip: \"\\,\\\\\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule CombineStrip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound:\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes validFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n from ctxt have ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n from ctxt have ctxtFlip: \"\\(P, p, Q, A)\\\\. \\\\\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases t)\n case (Normal t')\n from cvalidt_postD [OF valid ctxt' exec P] Normal \n show ?thesis\n by auto\n next\n case (Abrupt t')\n from cvalidt_postD [OF valid ctxt' exec P] Abrupt \n show ?thesis\n by auto\n next\n case (Fault f)\n show ?thesis\n proof (cases \"f \\ F\")\n case True\n hence \"f \\ -F\" by simp\n with cvalidD [OF validFlip ctxtFlip exec P] Fault\n have False\n by auto\n thus ?thesis ..\n next\n case False\n with cvalidt_postD [OF valid ctxt' exec P] Fault\n show ?thesis\n by auto\n qed\n next\n case Stuck\n from cvalidt_postD [OF valid ctxt' exec P] Stuck\n show ?thesis\n by auto\n qed\nnext\n fix s\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\ \\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\"\n hence ctxt': \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n by (auto intro: valid_augment_Faults simp add: validt_def)\n assume P: \"s \\ P\"\n show \"\\\\c \\ Normal s\"\n proof -\n from valid ctxt' P\n show \"\\\\c \\ Normal s\"\n by (rule cvalidt_termD)\n qed\nqed\n\n\nlemma GuardsFlip: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes derivFlip: \"\\,\\\\\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule GuardsFlip_sound)\napply (iprover intro: hoaret_sound [OF deriv])\napply (iprover intro: hoare_sound [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\mark_guards f c,Normal s\\ \\ t\" \n from exec_mark_guards_to_exec [OF exec] obtain t' where\n exec_c: \"\\\\\\c,Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof -\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c P]\n have \"t' \\ Normal ` Q \\ Abrupt ` A\"\n by blast\n with t'_noFault\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\mark_guards f c \\ Normal s\"\n by (rule terminates_to_terminates_mark_guards)\nqed\n\nlemma MarkGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\n\nlemma MarkGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n proof (cases \"isFault t\")\n case True\n with exec_to_exec_mark_guards_Fault exec\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ Fault f'\"\n by (fastforce elim: isFaultE)\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n have False\n by auto\n thus ?thesis ..\n next\n case False\n from exec_to_exec_mark_guards [OF exec False]\n obtain f' where \"\\\\\\mark_guards f c,Normal s\\ \\ t\"\n by auto\n from cvalidt_postD [OF valid [rule_format] ctxt this P]\n show ?thesis\n by auto\n qed\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\mark_guards f c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_mark_guards_to_terminates)\nqed\n\nlemma MarkGuardsD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\"\n from exec_merge_guards_to_exec [OF exec_merge] \n have exec: \"\\\\\\c,Normal s\\ \\ t\" .\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\c \\ Normal s\".\n thus \"\\\\merge_guards c \\ Normal s\"\n by (rule terminates_to_terminates_merge_guards)\nqed\n\nlemma MergeGuardsI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoaret_complete')\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_merge_guards [OF exec] \n have exec_merge: \"\\\\\\merge_guards c,Normal s\\ \\ t\".\n assume P: \"s \\ P\" \n assume t_notin_F: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\merge_guards c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_merge_guards_to_terminates)\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n from exec_to_exec_subseteq_guards [OF c_c' exec] obtain t' where\n exec_c': \"\\\\\\c',Normal s\\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n assume P: \"s \\ P\" \n assume t_noFault: \"t \\ Fault ` {}\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n show \"t \\ Normal ` Q \\ Abrupt ` A\"\n by auto\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have termi_c': \"\\\\c' \\ Normal s\".\n from cvalidt_postD [OF valid ctxt _ P]\n have noFault_c': \"\\\\\\c',Normal s\\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def)\n from termi_c' c_c' noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule terminates_fewer_guards)\nqed\n\nlemma SubsetGuards: \n assumes c_c': \"c \\\\<^sub>g c'\"\n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c' Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume exec: \"\\\\\\c,Normal s\\ \\ t\" \n hence exec_norm: \"\\\\\\normalize c,Normal s\\ \\ t\" \n by (rule exec_to_exec_normalize)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec_norm P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\normalize c \\ Normal s\".\n thus \"\\\\c \\ Normal s\"\n by (rule terminates_normalize_to_terminates)\nqed\n\nlemma NormalizeD: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeD_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n assumes valid: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cvalidtI)\n fix s t\n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume \"\\\\\\normalize c,Normal s\\ \\ t\" \n hence exec: \"\\\\\\c,Normal s\\ \\ t\" \n by (rule exec_normalize_to_exec)\n assume P: \"s \\ P\" \n assume noFault: \"t \\ Fault ` F\"\n from cvalidt_postD [OF valid [rule_format] ctxt exec P noFault]\n show \"t \\ Normal ` Q \\ Abrupt ` A\".\nnext\n fix s \n assume ctxt: \"\\(P, p, Q, A)\\\\. \\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n assume P: \"s \\ P\" \n from cvalidt_termD [OF valid ctxt P]\n have \"\\\\ c \\ Normal s\".\n thus \"\\\\normalize c \\ Normal s\"\n by (rule terminates_to_terminates_normalize)\nqed\n\nlemma NormalizeI: \n assumes deriv: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoaret_complete')\napply (rule NormalizeI_sound)\napply (iprover intro: hoaret_sound [OF deriv])\ndone\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma validt_restrict_to_validt:\nassumes validt_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from validt_c\n have valid_c: \"\\|\\<^bsub>M\\<^esub>\\\\<^bsub>/F\\<^esub> P c Q,A\" by (simp add: validt_def)\n hence \"\\\\\\<^bsub>/F\\<^esub> P c Q,A\" by (rule valid_restrict_to_valid)\n moreover\n {\n fix s\n assume P: \"s \\ P\"\n have \"\\\\c\\Normal s\"\n proof -\n from P validt_c have \"\\|\\<^bsub>M\\<^esub>\\c\\Normal s\"\n by (auto simp add: validt_def)\n moreover\n from P valid_c\n have \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s\\ \\\\{Stuck}\"\n by (auto simp add: valid_def final_notin_def)\n ultimately show ?thesis\n by (rule terminates_restrict_to_terminates)\n qed\n }\n ultimately show ?thesis\n by (auto simp add: validt_def)\nqed\n\n\nlemma augment_procs:\nassumes deriv_c: \"\\|\\<^bsub>M\\<^esub>,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_restrict_to_validt)\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nsubsubsection {* Miscellaneous *}\n\nlemma augment_Faults:\nassumes deriv_c: \"\\,{}\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\ F'\"\nshows \"\\,{}\\\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n apply (rule hoaret_complete)\n apply (rule validt_augment_Faults [OF _ F])\n apply (insert hoaret_sound [OF deriv_c])\n by (simp add: cvalidt_def)\n\nlemma TerminationPartial_sound:\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n assumes partial_corr: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nusing \"termination\" partial_corr \nby (auto simp add: cvalidt_def validt_def cvalid_def)\n\nlemma TerminationPartial:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. \\\\c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n apply (rule hoaret_complete')\n apply (rule TerminationPartial_sound [OF \"termination\"])\n apply (rule hoare_sound [OF partial_deriv])\n done\n\nlemma TerminationPartialStrip:\n assumes partial_deriv: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n assumes \"termination\": \"\\s \\ P. strip F' \\\\strip_guards F' c\\Normal s\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from \"termination\" have \"\\s \\ P. \\\\c\\Normal s\"\n by (auto intro: terminates_strip_guards_to_terminates \n terminates_strip_to_terminates)\n with partial_deriv\n show ?thesis\n by (rule TerminationPartial)\nqed\n\nlemma SplitTotalPartial:\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nlemma SplitTotalPartial':\n assumes termi: \"\\,\\\\\\<^sub>t\\<^bsub>/UNIV\\<^esub> P c Q',A'\"\n assumes part: \"\\,\\\\\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nproof -\n from hoaret_sound [OF termi] hoare_sound [OF part]\n have \"\\,\\\\\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n by (fastforce simp add: cvalidt_def validt_def cvalid_def valid_def)\n thus ?thesis\n by (rule hoaret_complete')\nqed\n \nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/HoareTotalProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.25149231732029914}} {"text": "theory SC11\nimports Main\nbegin\n\n(*\nTODO: need to modify the definition to include RC11 model and RA11 model.\n\nRC11: a. make the SC fence stronger having a total order on all writes.\n b. WW-merge mistake, too week a sc read/write instead of the acq write.\n our timed-relaxed memory model will make it stronger to prevent SB and WW-merge\n c. the way to prevent out-of-thin-air reads is problematic.\n the requirement for sb \\ rf to be acyclic is too strong.\n\nRA11: RA11 is just adding modification order on each location on top of\n the current acquire/release atomics.\n\n*)\n\ntype_synonym action_id = nat\ntype_synonym thread_id = nat\ntype_synonym location = nat\ntype_synonym avalue = nat\ntype_synonym program = nat\n\n(* 1 - Relational definitions *)\n\ndefinition irrefl where\n\"irrefl S ord = (\\ x \\ S . \\ ((x,x) \\ ord))\"\n\ndefinition trans where\n\"trans S ord = (\\ x \\ S . (\\ y \\ S . (\\ z \\ S. (x,y) \\ ord \\ (y,z) \\ ord \\ (x,z) \\ ord)))\"\n\ndefinition cross where\n\"cross S T = {(s,t) . s \\ S \\ t \\ T}\"\n\ninductive tc' where\na: \"r (x,y) \\ tc' r (x,y)\"\n| b: \"\\ tc' r (x,z); tc' r (z,y)\\ \\ tc' r (x,y)\"\n\ndefinition tc where\n\"tc r = {(x,y) . (x,y) \\ r \\ tc' (\\ (x,y) . (x,y) \\ r) (x,y) }\"\n\ndefinition restrict_relation_set where\n\"restrict_relation_set rel s = rel \\ (cross s s)\"\n\ndefinition strict_preorder where\n\"strict_preorder s ord =(irrefl s (ord) \\ trans s (ord))\"\n\ndefinition relation_over where\n\"relation_over s rel = (\\ (a,b) \\ rel . a \\ s \\ b \\ s)\"\n\ndefinition inj_on where\n\"inj_on f A = (\\ x \\ A . (\\ y \\ A . f x = f y \\ x = y))\"\n\ndefinition total_order_over where\n\"total_order_over s ord = (relation_over s ord \\ (\\ x \\ s . (\\ y \\ s . (x,y) \\ ord \\ (y,x) \\ ord \\ x = y)))\"\n\ndefinition strict_total_order_over where\n\"strict_total_order_over s ord = (strict_preorder s ord \\ total_order_over s ord)\"\n\ndefinition adjacent_less_than where\n\"adjacent_less_than ord s x y = ((x,y) \\ ord \\ \\ (\\ z \\ s . (x,z) \\ ord \\ (z,y) \\ ord))\"\n\ndefinition adjacent_less_than_such_that where\n\"adjacent_less_than_such_that pred ord s x y =\n (pred x \\ (x,y) \\ ord \\ \\ (\\ z \\ s . pred z \\ (x,z) \\ ord \\ (z,y) \\ ord))\"\n\n(* 2 - Action and location types *)\n\ndatatype memory_order =\n Mo_seq_cst\n | Mo_relaxed\n | Mo_release\n | Mo_acquire\n | Mo_consume\n | Mo_acq_rel\n\ndatatype lock_outcome =\n Success\n | Blocked\n\ndatatype action =\n Lock action_id thread_id location lock_outcome\n | Unlock action_id thread_id location\n | Atomic_load action_id thread_id memory_order location avalue\n | Atomic_store action_id thread_id memory_order location avalue\n | Atomic_rmw action_id thread_id memory_order location avalue avalue\n | Load action_id thread_id location avalue\n | Store action_id thread_id location avalue\n | Fence action_id thread_id memory_order\n | Blocked_rmw action_id thread_id location\n\nprimrec action_id_of where\n\"action_id_of (Lock aid x y z) = aid\"\n| \"action_id_of (Unlock aid x y) = aid\"\n| \"action_id_of (Atomic_load aid x y u v) = aid\"\n| \"action_id_of (Atomic_store aid x y u v) = aid\"\n| \"action_id_of (Atomic_rmw aid x y z u v) = aid\"\n| \"action_id_of (Load aid x y z) = aid\"\n| \"action_id_of (Store aid x y z) = aid\"\n| \"action_id_of (Fence aid x y) = aid\"\n| \"action_id_of (Blocked_rmw aid x y) = aid\"\n\nprimrec thread_id_of where\n\"thread_id_of (Lock x tid y z) = tid\"\n| \"thread_id_of (Unlock x tid y) = tid\"\n| \"thread_id_of (Atomic_load x tid y u v) = tid\"\n| \"thread_id_of (Atomic_store x tid y u v) = tid\"\n| \"thread_id_of (Atomic_rmw x tid y z u v) = tid\"\n| \"thread_id_of (Load x tid y z) = tid\"\n| \"thread_id_of (Store x tid y z) = tid\"\n| \"thread_id_of (Fence x tid y) = tid\"\n| \"thread_id_of (Blocked_rmw x tid y) = tid\"\n\nfun memory_order_of where\n\"memory_order_of (Atomic_load x y ord u v) = Some ord\"\n| \"memory_order_of (Atomic_store x y ord u v) = Some ord\"\n| \"memory_order_of (Atomic_rmw x y ord z u v) = Some ord\"\n| \"memory_order_of (Fence x y ord) = Some ord\"\n| \"memory_order_of x = None\"\n\nprimrec location_of where\n\"location_of (Lock x tid l z) = Some l\"\n| \"location_of (Unlock x tid l) = Some l\"\n| \"location_of (Atomic_load x tid y l v) = Some l\"\n| \"location_of (Atomic_store x tid y l v) = Some l\"\n| \"location_of (Atomic_rmw x tid y l u v) = Some l\"\n| \"location_of (Load x tid l z) = Some l\"\n| \"location_of (Store x tid l z) = Some l\"\n| \"location_of (Fence x tid y) = None\"\n| \"location_of (Blocked_rmw x tid l) = Some l\"\n\nfun value_read_by where\n\"value_read_by (Atomic_load x tid y l v) = Some v\"\n| \"value_read_by (Atomic_rmw x tid y l u v) = Some v\"\n| \"value_read_by (Load x tid l v) = Some v\"\n| \"value_read_by x = None\"\n\nfun value_written_by where\n \"value_written_by (Atomic_store x tid y l v) = Some v\"\n| \"value_written_by (Atomic_rmw x tid y l u v) = Some v\"\n| \"value_written_by (Store x tid l v) = Some v\"\n| \"value_written_by x = None\"\n\nfun is_lock where\n \"is_lock (Lock x tid l z) = True\"\n| \"is_lock a = False\"\n\nfun is_successful_lock where\n \"is_successful_lock (Lock x tid l Success) = True\"\n| \"is_successful_lock a = False\"\n\nfun is_blocked_lock where\n \"is_blocked_lock (Lock x tid l Blocked) = True\"\n| \"is_blocked_lock a = False\"\n\nfun is_unlock where\n \"is_unlock (Unlock x tid l) = True\"\n| \"is_unlock a = False\"\n\nfun is_atomic_load where\n \"is_atomic_load (Atomic_load x tid y l v) = True\"\n| \"is_atomic_load a = False\"\n\nfun is_atomic_store where\n \"is_atomic_store (Atomic_store x tid y l v) = True\"\n| \"is_atomic_store a = False\"\n\nfun is_atomic_rmw where\n \"is_atomic_rmw (Atomic_rmw x tid y l v u) = True\"\n| \"is_atomic_rmw a = False\"\n\nfun is_blocked_rmw where\n \"is_blocked_rmw (Blocked_rmw x tid y) = True\"\n| \"is_blocked_rmw a = False\"\n\nfun is_load where\n \"is_load (Load x tid y z) = True\"\n| \"is_load a = False\"\n\nfun is_store where\n \"is_store (Store x tid y z) = True\"\n| \"is_store a = False\"\n\nfun is_fence where\n \"is_fence (Fence x y z) = True\"\n| \"is_fence a = False\"\n\nfun is_atomic_action where\n \"is_atomic_action a = (is_atomic_load a \\ is_atomic_store a \\ is_atomic_rmw a)\"\n\nfun is_read where\n \"is_read a = (is_load a \\ is_atomic_load a \\ is_atomic_rmw a)\"\n\nfun is_write where\n \"is_write a = (is_store a \\ is_atomic_store a \\ is_atomic_rmw a)\"\n\n(* It is important to note that seq_cst atomics are both acquires and releases *)\n\nfun is_acquire where\n\"is_acquire a = (case memory_order_of a of \n Some Mo_acquire \\ is_read a \\ is_fence a\n | Some Mo_acq_rel \\ is_read a \\ is_fence a\n | Some Mo_seq_cst \\ is_read a \\ is_fence a\n | Some Mo_consume \\ is_fence a\n | None \\ is_lock a\n | _ \\ False)\"\n\nfun is_consume where\n\"is_consume a = (is_read a \\ (memory_order_of a = Some Mo_consume))\"\n\nfun is_release where\n\"is_release a = (case memory_order_of a of \n Some Mo_acquire \\ is_write a \\ is_fence a\n | Some Mo_acq_rel \\ is_write a \\ is_fence a\n | Some Mo_seq_cst \\ is_write a \\ is_fence a\n | None \\ is_unlock a\n | _ \\ False)\"\n\nfun is_seq_cst where\n\"is_seq_cst a = (memory_order_of a = Some Mo_seq_cst)\"\n\n\n(* - 2.2 - Location kinds *)\n\ndatatype location_kind =\n Mutex\n | Non_atomic\n | Atomic\n\ndefinition actions_respect_location_kinds where\n\"actions_respect_location_kinds S lk = \n (\\ a \\ S . case location_of a of Some l \\ \n (case lk l of \n Mutex \\ is_lock a \\ is_unlock a\n | Non_atomic \\ is_load a \\ is_store a\n | Atomic \\ is_store a \\ is_atomic_action a \\ is_blocked_rmw a)\n | None \\ True)\"\n\nfun is_at_location_kind where\n\"is_at_location_kind lk a lk0 = \n (case location_of a of Some l \\ (lk l = lk0)\n | None \\ False)\"\n\nfun is_at_mutex_location where\n\"is_at_mutex_location lk a = is_at_location_kind lk a Mutex\"\n\nfun is_at_non_atomic_location where\n\"is_at_non_atomic_location lk a = is_at_location_kind lk a Non_atomic\"\n\nfun is_at_atomic_location where\n\"is_at_atomic_location lk a = is_at_location_kind lk a Atomic\"\n\n(* 3 - The preferred model *)\nrecord opsem_execution_part =\n actions :: \"action set\"\n threads :: \"thread_id set\"\n lk :: \"location \\ location_kind\"\n sb :: \"(action * action) set\"\n asw :: \"(action * action) set\"\n dd :: \"(action * action) set\"\n cd :: \"(action * action) set\"\n\nrecord witness_execution_part =\n rf :: \"(action * action) set\"\n mo :: \"(action * action) set\"\n sc :: \"(action * action) set\"\n\n(* - 3.2 - Well formed action *)\n\nfun same_thread where\n\"same_thread a b = (thread_id_of a = thread_id_of b)\"\n\nfun threadwise_relation_over where\n\"threadwise_relation_over s rel = relation_over s rel\"\n\nfun same_location where \n\"same_location a b = (location_of a = location_of b)\"\n\nfun locations_of where\n\"locations_of as = {l . (\\ a . Some l = location_of a \\ a \\ as)}\"\n\nfun well_formed_action where\n\"well_formed_action a = \n (case a of Atomic_load x y mem_ord u v \\\n mem_ord = Mo_relaxed \\ mem_ord = Mo_acquire \\ mem_ord = Mo_seq_cst \\ mem_ord = Mo_consume\n | Atomic_store x y mem_ord u v \\ mem_ord = Mo_relaxed \\ mem_ord = Mo_release \\ mem_ord = Mo_seq_cst \n | Atomic_rmw x y mem_ord z u v \\ mem_ord = Mo_relaxed \\ mem_ord = Mo_release \\ mem_ord = Mo_acquire\n \\ mem_ord = Mo_acq_rel \\ mem_ord = Mo_seq_cst \\ mem_ord = Mo_consume\n | _ \\ True)\"\n\n(* - 3.3 - Well formed threads *)\nfun well_formed_threads where\n\"well_formed_threads as threads' lk' sb' asw' dd' cd' = \n (inj_on action_id_of as \\\n (\\ a \\ as . well_formed_action a) \\\n threadwise_relation_over as sb' \\\n threadwise_relation_over as dd' \\\n threadwise_relation_over as cd' \\\n strict_preorder as sb' \\\n strict_preorder as dd' \\\n strict_preorder as cd' \\\n (\\ a \\ as . thread_id_of a \\ threads') \\\n actions_respect_location_kinds as lk' \\\n dd' \\ sb' \\\n relation_over as asw' \\\n (\\ a \\ as . is_blocked_rmw a \\ is_blocked_lock a \\ \\ (\\ b \\ as . (a,b) \\ sb')))\"\n\n(* - 3.4 - Consistent locks *)\nfun consistent_locks where\n\"consistent_locks as lo hb = \n (strict_total_order_over {a . a \\ as \\ (is_lock a \\ is_unlock a)} lo \\\n restrict_relation_set hb {a . a \\ as \\ (is_lock a \\ is_unlock a)} \\ lo \\\n (\\ (a,c) \\ lo. \n is_successful_lock a \\ is_successful_lock c \\ same_location a c\n \\\n (\\ b \\ as . same_location a b \\ is_unlock b \\ (a,b) \\ lo \\ (b,c) \\ lo)))\"\n\n(* - 3.5 - Well formed reads from mapping *)\nfun well_formed_reads_from_mapping where\n\"well_formed_reads_from_mapping as lk' rf' = \n (relation_over as rf' \\\n (\\ a1 \\ as . (\\ a2 \\ as . (\\ b \\ as . \n (a1,b) \\ rf' \\ (a2,b) \\ rf' \\ (a1 = a2)))) \\\n (\\ a \\ as . (\\ b \\ as . (a,b) \\ rf' \\ \n same_location a b \\ (value_read_by b = value_written_by a) \\\n \\ (a = b) \\ \\ is_fence a \\ \\ is_fence b \\\n \\ (is_at_mutex_location lk' a) \\ \n (is_at_non_atomic_location lk' a \\ is_store a \\ is_load b) \\\n (is_at_atomic_location lk' a \\\n (is_atomic_store a \\ is_atomic_rmw a \\ is_store a) \\ \n (is_atomic_load b \\ is_atomic_rmw b \\ is_load b)))))\"\n\n(* - 3.6 - Happens before *)\nfun rs_element where\n\"rs_element rs_head a =\n (same_thread a rs_head \\ is_atomic_rmw a)\"\n\nfun release_sequence where\n\"release_sequence as lk' mo' a_rel b =\n (is_at_atomic_location lk' b \\\n is_release a_rel \\\n ((b = a_rel) \\\n (rs_element a_rel b \\ (a_rel,b) \\ mo' \\\n (\\ c \\ as . ((a_rel,c) \\ mo' \\ (c,b) \\ mo') \\ rs_element a_rel c))))\"\n\n\nfun release_sequence_set where\n\"release_sequence_set as lk' mo' =\n {(a,b) . a \\ as \\ b \\ as \\ release_sequence as lk' mo' a b}\"\n\nfun hypothetical_release_sequence where\n\"hypothetical_release_sequence as lk' mo' a b =\n (is_at_atomic_location lk' b \\\n ((b = a) \\\n ( rs_element a b \\ (a,b) \\ mo' \\ \n (\\ c \\ as . ((a,c) \\ mo' \\ (c,b) \\ mo') \\ rs_element a c))))\"\n\nfun hypothetical_release_sequence_set where\n\"hypothetical_release_sequence_set as lk' mo' =\n {(a,b) . a \\ as \\ b \\ as \\ hypothetical_release_sequence as lk' mo' a b}\"\n\nfun synchronizes_with where\n\"synchronizes_with as sb' asw' rf' lo rs hrs a b =\n ((a,b) \\ asw' \\\n ( same_location a b \\ a \\ as \\ b \\ as \\\n ( (is_unlock a \\ is_successful_lock b \\ (a,b) \\ lo) \\\n ( is_release a \\ is_acquire b \\ \\ (same_thread a b) \\\n (\\ c \\ as . (a,c) \\ rs \\ (c,b) \\ rf' ) ) \\\n (\\ (same_thread a b) \\\n is_fence a \\ is_release a \\ is_fence b \\ is_acquire b \\\n (\\ x \\ as . (\\ y \\ as . same_location x y \\\n is_atomic_action x \\ is_atomic_action y \\ is_write x \\\n (a,x) \\ sb' \\ (y,b) \\ sb' \\\n (\\ z \\ as . (x,z) \\ hrs \\ (z,y) \\ rf')))) \\ \n (\\ (same_thread a b) \\\n is_fence a \\ is_release a \\ is_atomic_action b \\ is_acquire b \\\n (\\ x \\ as . same_location x b \\\n is_atomic_action x \\ is_write x \\ (a,x) \\ sb' \\\n (\\ z \\ as . (x,z) \\ hrs \\ (z,b) \\ rf' ) ) ) \\\n (\\ (same_thread a b) \\\n is_atomic_action a \\ is_release a \\\n is_fence b \\ is_acquire b \\\n (\\ x \\ as . same_location a x \\ is_atomic_action x \\\n (x,b) \\ sb' \\\n (\\ z \\ as . (a,z) \\ rs \\ (z,x) \\ rf' ) ) ))))\"\n\nfun synchronizes_with_set where\n\"synchronizes_with_set as sb' asw' rf' lo rs hrs =\n {(a,b) . a \\ as \\ b \\ as \\ synchronizes_with as sb' asw' rf' lo rs hrs a b}\"\n\nfun carries_a_dependency_to_set where\n\"carries_a_dependency_to_set as sb' dd' rf' = tc ( (rf' \\ sb') \\ dd')\"\n\nfun dependency_ordered_before where\n\"dependency_ordered_before as rf' rs cad a d =\n (a \\ as \\ d \\ as \\\n (\\ b \\ as . is_release a \\ is_consume b \\\n (\\ e \\ as . (a,e) \\ rs \\ (e,b) \\ rf') \\\n ( (b,d) \\ cad \\ (b = d) )))\"\n\nfun dependency_ordered_before_set where\n\"dependency_ordered_before_set as rf' rs cad =\n {(a,b) . a \\ as \\ b \\ as \\ dependency_ordered_before as rf' rs cad a b}\"\n\nfun compose where\n\"compose R1 R2 = { (w,z) . \\ t . (w,t) \\ R1 \\ (t,z) \\ R2}\"\n\nfun inter_thread_happens_before where\n\"inter_thread_happens_before sb' sw dob =\n tc ((sw \\ dob \\ (compose sw sb')) \\ (compose sb' (sw \\ dob \\ (compose sw sb'))))\"\n\n\nfun consistent_inter_thread_happens_before where\n\"consistent_inter_thread_happens_before as ithb = irrefl as ithb\"\n\nfun happens_before where\n\"happens_before as sb' ithb = sb' \\ ithb\"\n\n(* - 3.7 - Consistent SC and modification orders *)\n\nfun all_sc_actions where\n\"all_sc_actions as =\n { a . a \\ as \\ (is_seq_cst a \\ is_lock a \\ is_unlock a )}\"\n\nfun consistent_sc_order where\n\"consistent_sc_order as mo' sc' hb = \n (strict_total_order_over (all_sc_actions as) sc' \\\n (restrict_relation_set hb (all_sc_actions as)) \\ sc' \\\n (restrict_relation_set mo' (all_sc_actions as)) \\ sc')\"\n\nfun consistent_modification_order where\n\"consistent_modification_order as lk' sb' mo' hb =\n ((\\ a \\ as . (\\ b \\ as . (a,b) \\ mo' \\\n (same_location a b \\ is_write a \\ is_write b))) \\\n (\\ l \\ locations_of as .\n (case lk' l of Atomic \\ \n (strict_total_order_over {a . a \\ {a . a \\ as \\ location_of a = Some l} \\ is_write a}\n (restrict_relation_set mo' {a . a \\ as \\ location_of a = Some l})\n \\ restrict_relation_set hb {a . a \\ {a . a \\ as \\ location_of a = Some l} \\ is_write a} \\ mo') )))\"\n\n\n(* - 3.8 - Visible side effects *)\nfun visible_side_effect where\n\"visible_side_effect as hb a b =\n ((a,b) \\ hb \\\n is_write a \\ is_read b \\ same_location a b \\\n \\ (\\ c \\ as . \\ (c = a) \\ \\ (c = b) \\\n is_write c \\ same_location c b \\\n (a,c) \\ hb \\ (c,b) \\ hb))\"\n\n\nfun visible_side_effect_set where\n\"visible_side_effect_set as hb =\n { (a,b) . (a,b) \\ hb \\ visible_side_effect as hb a b}\"\n\n(* - 3.9 - Undefined behaviour *)\nfun indeterminate_reads where\n\"indeterminate_reads as rf' =\n {b . b \\ as \\ is_read b \\ \\ (\\ a \\ as . (a,b) \\ rf')}\"\n\nfun unsequenced_races where\n\"unsequenced_races as sb' =\n{(a,b) . a \\ as \\ b \\ as \\ \\ (a = b) \\ same_location a b \\ (is_write a \\ is_write b) \\\n same_thread a b \\ \\ ((a,b) \\ sb' \\ (b,a) \\ sb')}\"\n\nfun data_races where\n\"data_races as hb =\n{(a,b) . a \\ as \\ b \\ as \\ \\ a = b \\ same_location a b \\ (is_write a \\ is_write b) \\\n \\ same_thread a b \\ \\ (is_atomic_action a \\ is_atomic_action b) \\\n \\ ((a,b) \\ hb \\ (b,a) \\ hb) }\"\n\nfun data_races' where\n\"data_races' Xo Xw lo =\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\\n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\\n data_races (actions Xo) hb)))))))\"\n\nfun good_mutex_use where\n\"good_mutex_use as lk' sb' lo a =\n (case {a' . a' \\ as \\ ((is_successful_lock a' \\ is_unlock a') \\ (location_of a' = location_of a))} of \n mutexes_at_l \\ (case restrict_relation_set lo mutexes_at_l of lock_order \\\n ( is_unlock a \\ (\\ al \\ as .\n is_successful_lock al \\ (location_of al = location_of a) \\ (al,a) \\ sb' \\\n adjacent_less_than lock_order as al a ) ) \\\n ( is_lock a \\\n \\ (\\ al \\ as .\n is_successful_lock al \\ (location_of a = location_of al) \\ same_thread a al \\\n adjacent_less_than lock_order as al a ))))\"\n\n\nfun bad_mutexes where\n\"bad_mutexes Xo lo =\n { a . a \\ (actions Xo) \\ \\ (good_mutex_use (actions Xo) (lk Xo) (sb Xo) lo a)}\"\n\nfun undefined_behaviour where\n\"undefined_behaviour Xo Xw =\n (\\ (data_races' Xo Xw (sc Xw) = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) (rf Xw) = {}) \\\n \\ (bad_mutexes Xo (sc Xw) = {}))\"\n\n(* - 3.10 - Consistent reads from mapping *)\nfun consistent_non_atomic_read_values where\n\"consistent_non_atomic_read_values as lk' rf' vse =\n (\\ b \\ as . (is_read b \\ is_at_non_atomic_location lk' b)\n \\ (if (\\ a_vse \\ as . (a_vse,b) \\ vse)\n then (\\ a_vse \\ as . (a_vse,b) \\ vse \\ (a_vse,b) \\ rf')\n else \\ (\\ a \\ as . (a,b) \\ rf')))\"\n\nfun coherent_memory_use where\n\"coherent_memory_use as lk' rf' mo' hb = \n ((\\ (x,a) \\ rf' .(\\ (y,b) \\ rf' .\n ((a,b) \\ hb \\ same_location a b \\ is_at_atomic_location lk' b) \\\n ((x = y) \\ (x,y) \\ mo'))) \\\n (\\ (a,b) \\ hb . (\\ c \\ as .\n ((c,b) \\ rf' \\ is_write a \\ same_location a b \\ is_at_atomic_location lk' b) \\\n ((c = a) \\ (a,c) \\ mo'))) \\ \n (\\ (a,b) \\ hb . (\\ c \\ as .\n ((c,a) \\ rf' \\ is_write b \\ same_location a b \\ is_at_atomic_location lk' a) \\\n ((c,b) \\ mo'))))\"\n\nfun rmw_atomicity where\n\"rmw_atomicity as rf' mo' = \n (\\ (a,b) \\ rf' .\n is_atomic_rmw b \\ adjacent_less_than mo' as a b)\"\n\nfun sc_reads_restricted where\n\"sc_reads_restricted as rf' sc' mo' hb =\n (\\ (a,b) \\ rf' .\n is_seq_cst b \\\n (adjacent_less_than_such_that (\\ c . is_write c \\ same_location b c) sc' as a b) \\\n ( \\ (is_seq_cst a) \\\n (\\ x \\ as .\n (adjacent_less_than_such_that (\\ c . is_write c \\ same_location b c) sc' as x b)\n \\ \\ ((a,x) \\ hb))))\"\n\n\n\n (* fence restriction N3291 29.3p4 *)\n (* fence restriction N3291 29.3p5 *)\n (* fence restriction N3291 29.3p6 *)\n (* SC fences impose mo N3291 29.3p7 *)\n(* SC fences impose mo N3291 29.3p7, w collapsed first write*)\n(* SC fences impose mo N3291 29.3p7, w collapsed second write*)\n\nfun sc_fences_heeded where\n\"sc_fences_heeded as sb' rf' sc' mo' = \n ((\\ a \\ as . (\\ (x,b) \\ sb' . (\\ y \\ as .\n ( is_write a \\ is_fence x \\\n adjacent_less_than sc' as a x \\\n is_atomic_action b \\ same_location a b \\\n (y,b) \\ rf') \\\n (y = a) \\ (a,y) \\ mo') )) \\\n (\\ (a,x) \\ sb' . (\\ (y,b) \\ rf' .\n ((is_atomic_action a \\ is_write a \\\n is_fence x \\ is_atomic_action b \\ (x,b) \\ sc' \\\n same_location a b) \\\n ((y = a) \\ (a,y) \\ mo')))) \\\n (\\ (a,x) \\ sb' . (\\ (y,b) \\ sb' . (\\ z \\ as .\n (is_atomic_action a \\ is_write a \\\n is_fence x \\ is_fence y \\ (x,y) \\ sc' \\\n is_atomic_action b \\ same_location a b \\\n (z,b) \\ rf') \\\n ((z = a) \\ (a,z) \\ mo')))) \\\n (\\ (a,x) \\ sb' . (\\ (y,b) \\ sb' .\n ( is_atomic_action a \\ is_write a \\\n is_atomic_action b \\ is_write b \\\n is_fence x \\ is_fence y \\ (x,y) \\ sc' \\\n same_location a b \\\n (a,b) \\ mo'))) \\\n (\\ a \\ as . (\\ (y,b) \\ sb' .\n ( is_atomic_action a \\ is_write a \\\n is_fence y \\ (a,y) \\ sc' \\\n is_atomic_action b \\ is_write b \\\n same_location a b \\\n (a,b) \\ mo'))) \\\n (\\ (a,x) \\ sb' . (\\ b \\ as .\n (is_atomic_action a \\ is_write a \\\n is_fence x \\ is_atomic_action b \\ is_write b \\ (x,b) \\ sc' \\\n same_location a b \\\n (a,b) \\ mo'))) )\"\n\nfun no_vsse_consistent_atomic_read_values where\n\"no_vsse_consistent_atomic_read_values as lk' rf' hb vse = \n (\\ b \\ as .\n (is_read b \\ is_at_atomic_location lk' b) \\\n ( if (\\ a_vse \\ as . (a_vse,b) \\ vse)\n then (\\ a \\ as . (a,b) \\ rf' \\ \\ ((b,a) \\ hb))\n else \\ (\\ a \\ as . (a,b) \\ rf')))\"\n\nfun no_vsse_consistent_reads_from_mapping where\n\"no_vsse_consistent_reads_from_mapping as lk' sb' rf' sc' mo' hb vse =\n (consistent_non_atomic_read_values as lk' rf' vse \\\n no_vsse_consistent_atomic_read_values as lk' rf' hb vse \\\n coherent_memory_use as lk' rf' mo' hb \\\n rmw_atomicity as rf' mo' \\\n sc_reads_restricted as rf' sc' mo' hb \\\n sc_fences_heeded as sb' rf' sc' mo')\"\n\n(* 3.11 - Consistent execution *)\n(* This simplification has ben verified equivalent to the model\n in section 3 using the HOL theorem prover. It removes the complicated\n notion of VSSE's, whose force is covered by the coherence requirements.\n For those looking to work with C or C++ concurrency, this is the preferred model. *)\n\nfun no_vsse_consistent_execution where\n\"no_vsse_consistent_execution Xo Xw = \n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) (sc Xw) rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\\n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n consistent_locks (actions Xo) (sc Xw) hb \\\n consistent_inter_thread_happens_before (actions Xo) ithb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse)))))))))\"\n\n(* - 3.12 - Preferred model top level judgement *)\ndefinition no_vsse_cmm where\n\"no_vsse_cmm opsem p = \n (case { (Xopsem,Xwitness) . opsem p Xopsem \\ no_vsse_consistent_execution Xopsem Xwitness}\n of pre_executions \\ \n if (\\ (Xo,Xw) \\ pre_executions . undefined_behaviour Xo Xw)\n then {(Xo,Xw) . True} else pre_executions)\"\n\n\n(* 4 - Standard C/C++ model *)\n(* The following definitions make up the memory model described by the\n 2011 standard. It was constructed in discussion with the\n standardisation comittee. *)\n\nfun visible_sequence_of_side_effects_tail where\n\"visible_sequence_of_side_effects_tail as mo' hb vsse_head b = \n { c . c \\ as \\ (vsse_head,c) \\ mo' \\ \\ (b,c) \\ hb \\\n (\\ a \\ as . (vsse_head,a) \\ mo' \\ (a,c) \\ mo' \\ \\ (b,a) \\ hb)}\"\n\n(* visible sequences of side effects have been proven redundant. See the simpler model in section 3. *)\nfun visible_sequence_of_side_effects where\n\"visible_sequence_of_side_effects as lk' mo' hb vsse_head b =\n (b , if is_at_atomic_location lk' b then\n {vsse_head} \\\n visible_sequence_of_side_effects_tail as mo' hb vsse_head b\n else {})\"\n\nfun visible_sequences_of_side_effects_set where\n\"visible_sequences_of_side_effects_set as lk' mo' hb vse =\n { (b,bs) . b \\ as \\ is_at_atomic_location lk' b \\ is_read b \\\n (\\ vsse_head . (b,bs) = visible_sequence_of_side_effects as lk' mo' hb vsse_head b\n \\ vsse_head \\ as \\ (vsse_head,b) \\ vse)}\"\n\nfun consistent_atomic_read_values where\n\"consistent_atomic_read_values as lk' rf' vsses =\n (\\ b \\ as . (is_read b \\ is_at_atomic_location lk' b) \\ \n ( if (\\ (b',v) \\ vsses . b = b')\n then (\\ (b',v) \\ vsses . b = b' \\\n (\\ c \\ v . (c,b) \\ rf'))\n else \\ (\\ a \\ as . (a,b) \\ rf')))\"\n\nfun consistent_reads_from_mapping where \n\"consistent_reads_from_mapping as lk' sb' rf' sc' mo' hb vse vsses =\n (consistent_non_atomic_read_values as lk' rf' vse \\\n consistent_atomic_read_values as lk' rf' vsses \\\n coherent_memory_use as lk' rf' mo' hb \\\n rmw_atomicity as rf' mo' \\\n sc_reads_restricted as rf' sc' mo' hb \\\n sc_fences_heeded as sb' rf' sc' mo')\"\n\nfun consistent_execution where\n\"consistent_execution Xo Xw =\n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) (sc Xw) rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\ \n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n (case visible_sequences_of_side_effects_set (actions Xo) (lk Xo) (mo Xw) hb vse of vsses \\\n consistent_locks (actions Xo) (sc Xw) hb \\\n consistent_inter_thread_happens_before (actions Xo) ithb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse vsses))))))))))\"\n\n(* - 4.1 - Standard model top level judgement *)\ndefinition cmm where\n\"cmm opsem p = (case { (Xopsem,Xwitness) . opsem p Xopsem \\ consistent_execution Xopsem Xwitness}\n of pre_executions \\ if (\\ (Xo,Xw) \\ pre_executions . undefined_behaviour Xo Xw)\n then {(Xo,Xw). True} else pre_executions)\"\n\n\n(* 5 - Model with seperate lock order *)\n(* A version of the no VSSE model with a seperate lock order. *)\nfun no_vsse_seperate_lo_consistent_execution where\n\"no_vsse_seperate_lo_consistent_execution Xo Xw lo =\n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\ \n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n (case visible_sequences_of_side_effects_set (actions Xo) (lk Xo) (mo Xw) hb vse of vsses \\\n consistent_locks (actions Xo) lo hb \\\n consistent_inter_thread_happens_before (actions Xo) ithb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse))))))))))\"\n\nfun no_vsse_seperate_lo_undefined_behaviour where\n\"no_vsse_seperate_lo_undefined_behaviour Xo Xw lo =\n (\\ (data_races' Xo Xw lo = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) (rf Xw) = {}) \\\n \\ (bad_mutexes Xo lo = {}))\"\n\n(* - 5.1 - Seperate lock order top level judgement *)\ndefinition no_vsse_seperate_lo_cmm where\n\"no_vsse_seperate_lo_cmm opsem p = \n (case { (Xopsem,(Xwitness,lo)).\n opsem p Xopsem \\ no_vsse_seperate_lo_consistent_execution Xopsem Xwitness lo}\n of pre_executions \\\n if (\\ (Xo,(Xw,lo)) \\ pre_executions . no_vsse_seperate_lo_undefined_behaviour Xo Xw lo)\n then { (Xo,(Xw,lo)) . True } else pre_executions)\"\n\n(* 6 - Model with per-location lock orders *)\n(* This model uses per location lock orders rather than one shared one. *)\nfun multi_lo_consistent_locks where\n\"multi_lo_consistent_locks as lk' lo hb =\n (case {a . a \\ as \\ (is_lock a \\ is_unlock a)} of mutex_actions \\\n (case restrict_relation_set hb mutex_actions of lo_happens_before \\\n lo_happens_before \\ lo \\\n (\\ (a,c) \\ lo . is_successful_lock a \\ is_successful_lock c \\ same_location a c\n \\ (\\ b \\ as . same_location a b \\ is_unlock b \\ (a,b) \\ lo \\ (b,c) \\ lo)) \\\n (\\ l \\ locations_of as . \n (case {a . a \\ as \\location_of a = Some l} of actions_at_l \\\n (case lk' l of Mutex \\ strict_total_order_over actions_at_l (restrict_relation_set lo actions_at_l)\n | _ \\ Set.is_empty (restrict_relation_set lo actions_at_l))))))\"\n\nfun no_vsse_multi_lo_consistent_execution where\n\"no_vsse_multi_lo_consistent_execution Xo Xw lo =\n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\ \n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n multi_lo_consistent_locks (actions Xo) (lk Xo) lo hb \\\n consistent_inter_thread_happens_before (actions Xo) ithb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse)))))))))\"\n\n(* - 6.1 - per-location lock order top level judgement *)\ndefinition no_vsse_multi_lo_cmm where\n\"no_vsse_multi_lo_cmm opsem p = \n (case { (Xopsem,(Xwitness,lo)).\n opsem p Xopsem \\ no_vsse_multi_lo_consistent_execution Xopsem Xwitness lo}\n of pre_executions \\\n if (\\ (Xo,(Xw,lo)) \\ pre_executions . no_vsse_seperate_lo_undefined_behaviour Xo Xw lo)\n then { (Xo,(Xw,lo)) . True } else pre_executions)\"\n\n(* 7 - Model with single step mutex synchronisation *)\n(* This model creates synchronizes-with edges from each unlock to the\n next lock at the same location, rather than all subsequent ones. *)\nfun lo_single_synchronizes_with where\n\"lo_single_synchronizes_with as sb' asw' rf' lo rs hrs a b = \n ((a,b) \\ asw' \\\n (same_location a b \\ a \\ as \\ b \\ as \\\n ((is_unlock a \\ is_successful_lock b \\ (a,b) \\ lo \\\n \\ (\\ c \\ as . (a,c) \\ lo \\ (c,b) \\ lo)) \\\n (is_release a \\ is_acquire b \\ \\ (same_thread a b) \\\n (\\ c \\ as . (a,c) \\ rs \\ (c,b) \\ rf')) \\\n ( \\ (same_thread a b) \\\n is_fence a \\ is_release a \\ is_fence b \\ is_acquire b \\\n (\\ x \\ as . (\\ y \\ as . same_location x y \\\n is_atomic_action x \\ is_atomic_action y \\ is_write x \\\n (a,x) \\ sb' \\ (y,b) \\ sb' \\\n (\\ z \\ as . (x,z) \\ hrs \\ (z,y) \\ rf')))) \\\n ( \\ (same_thread a b) \\\n is_fence a \\ is_release a \\ is_atomic_action b \\ is_acquire b \\\n (\\ x \\ as . same_location x b \\\n is_atomic_action x \\ is_write x \\ (a,x) \\ sb' \\\n (\\ z \\ as . (x,z) \\ hrs \\ (z,b) \\ rf'))) \\\n ( \\ (same_thread a b) \\\n is_atomic_action a \\ is_release a \\\n is_fence b \\ is_acquire b \\\n ( \\ x \\ as . same_location a x \\ is_atomic_action x \\\n (x,b) \\ sb' \\\n ( \\ z \\ as . (a,z) \\ rs \\ (z,x) \\ rf'))))))\"\n\nfun lo_single_synchronizes_with_set where\n\"lo_single_synchronizes_with_set as sb' asw' rf' lo rs hrs =\n {(a,b) . a \\ as \\ b \\ as \\\n lo_single_synchronizes_with as sb' asw' rf' lo rs hrs a b}\"\n\nfun no_vsse_multi_lo_single_sw_consistent_execution where\n\"no_vsse_multi_lo_single_sw_consistent_execution Xo Xw lo =\n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\ \n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n multi_lo_consistent_locks (actions Xo) (lk Xo) lo hb \\\n consistent_inter_thread_happens_before (actions Xo) ithb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse)))))))))\"\n\nfun los_single_sw_data_races' where\n\"los_single_sw_data_races' Xo Xw lo = \n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case lo_single_synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case carries_a_dependency_to_set (actions Xo) (sb Xo) (dd Xo) (rf Xw) of cad \\\n (case dependency_ordered_before_set (actions Xo) (rf Xw) rs cad of dob \\ \n (case inter_thread_happens_before (sb Xo) sw dob of ithb \\\n (case happens_before (actions Xo) (sb Xo) ithb of hb \\ \n data_races (actions Xo) hb)))))))\"\n\nfun no_vsse_multi_lo_single_sw_undefined_behaviour where\n\"no_vsse_multi_lo_single_sw_undefined_behaviour Xo Xw lo = \n (\\ (los_single_sw_data_races' Xo Xw lo = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) (rf Xw) = {}) \\\n \\ (bad_mutexes Xo lo = {}))\"\n\n(* - 7.1 - single step mutex synchronisation top level judgement *)\ndefinition no_vsse_multi_lo_single_sw_cmm where\n\"no_vsse_multi_lo_single_sw_cmm opsem p = \n (case { (Xopsem,(Xwitness,lo)).\n opsem p Xopsem \\ no_vsse_multi_lo_single_sw_consistent_execution Xopsem Xwitness lo}\n of pre_executions \\\n if (\\ (Xo,(Xw,lo)) \\ pre_executions . no_vsse_multi_lo_single_sw_undefined_behaviour Xo Xw lo)\n then { (Xo,(Xw,lo)) . True } else pre_executions)\"\n\n(* 8 - Model simplified for programs without consumes *)\n(* This model is simplified for use with programs that don't use\n consume memory orders. Happens-before is transitive. *)\n\nfun no_vsse_consume_happens_before where\n\"no_vsse_consume_happens_before sb' sw = tc (sb' \\ sw)\"\n\nfun no_vsse_consume_consistent_happens_before where\n\"no_vsse_consume_consistent_happens_before as hb = irrefl as hb\"\n\nfun no_vsse_consume_consistent_execution where\n\"no_vsse_consume_consistent_execution Xo Xw = \n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) (sc Xw) rs hrs of sw \\\n (case no_vsse_consume_happens_before (sb Xo) sw of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n consistent_locks (actions Xo) (sc Xw) hb \\\n no_vsse_consume_consistent_happens_before (actions Xo) hb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse))))))\"\n\nfun no_vsse_consume_data_races' where\n\"no_vsse_consume_data_races' Xo Xw lo = \n (case release_sequence_set (actions Xo) (lk Xo) (mo Xw) of rs \\\n (case hypothetical_release_sequence_set (actions Xo) (lk Xo) (mo Xw) of hrs \\\n (case synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo rs hrs of sw \\\n (case no_vsse_consume_happens_before (sb Xo) sw of hb \\\n data_races (actions Xo) hb))))\"\n\nfun no_vsse_consume_undefined_behaviour where\n\"no_vsse_consume_undefined_behaviour Xo Xw = \n (\\ (no_vsse_consume_data_races' Xo Xw (sc Xw) = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) (rf Xw) = {}) \\\n \\ (bad_mutexes Xo (sc Xw) = {}))\"\n\n(* - 8.1 - No consume top level judgement *)\ndefinition no_vsse_consume_cmm where\n\"no_vsse_consume_cmm opsem p = \n (case { (Xopsem,Xwitness).\n opsem p Xopsem \\ no_vsse_consume_consistent_execution Xopsem Xwitness}\n of pre_executions \\\n if (\\ (Xo,Xw) \\ pre_executions . no_vsse_consume_undefined_behaviour Xo Xw)\n then { (Xo,Xw) . True } else pre_executions)\"\n\n(* 9 - Model simplified for programs without consumes or relaxed *)\n(* Without relaxed, can release sequences go? Unfortunately not. This model is NOT equvalent. *)\nfun no_vsse_consume_relaxed_synchronizes_with where\n\"no_vsse_consume_relaxed_synchronizes_with as sb' asw' rf' lo a b = \n ((a,b) \\ asw' \\\n ( same_location a b \\ a \\ as \\ b \\ as \\\n ((is_unlock a \\ is_lock b \\ (a,b) \\ lo) \\\n ( is_release a \\ is_acquire b \\ \\ (same_thread a b) \\ (a,b) \\ rf' ) ) ))\"\n\nfun no_vsse_consume_relaxed_synchronizes_with_set where\n\"no_vsse_consume_relaxed_synchronizes_with_set as sb' asw' rf' lo =\n {(a,b) . a \\ as \\ b \\ as \\ no_vsse_consume_relaxed_synchronizes_with as sb' asw' rf' lo a b}\"\n\nfun no_vsse_consume_relaxed_consistent_execution where\n\"no_vsse_consume_relaxed_consistent_execution Xo Xw = \n (well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo) \\\n (case no_vsse_consume_relaxed_synchronizes_with_set\n (actions Xo) (sb Xo) (asw Xo) (rf Xw) (sc Xw) of sw \\\n (case no_vsse_consume_happens_before (sb Xo) sw of hb \\ \n (case visible_side_effect_set (actions Xo) hb of vse \\\n consistent_locks (actions Xo) (sc Xw) hb \\\n no_vsse_consume_consistent_happens_before (actions Xo) hb \\\n consistent_sc_order (actions Xo) (mo Xw) (sc Xw) hb \\\n consistent_modification_order (actions Xo) (lk Xo) (sb Xo) (mo Xw) hb \\\n well_formed_reads_from_mapping (actions Xo) (lk Xo) (rf Xw) \\\n no_vsse_consistent_reads_from_mapping (actions Xo) (lk Xo) (sb Xo) (rf Xw) (sc Xw) (mo Xw) hb vse))))\"\n\nfun no_vsse_consume_relaxed_data_races' where\n\"no_vsse_consume_relaxed_data_races' Xo Xw lo = \n (case no_vsse_consume_relaxed_synchronizes_with_set\n (actions Xo) (sb Xo) (asw Xo) (rf Xw) lo of sw \\\n (case no_vsse_consume_happens_before (sb Xo) sw of hb \\\n data_races (actions Xo) hb))\"\n\nfun no_vsse_consume_relaxed_undefined_behaviour where\n\"no_vsse_consume_relaxed_undefined_behaviour Xo Xw = \n (\\ (no_vsse_consume_relaxed_data_races' Xo Xw (sc Xw) = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) (rf Xw) = {}) \\\n \\ (bad_mutexes Xo (sc Xw) = {}))\"\n\n(* - 9.1 - No consume or relaxed top level judgement *)\ndefinition no_vsse_consume_relaxed_cmm where\n\"no_vsse_consume_relaxed_cmm opsem p = \n (case { (Xopsem,Xwitness).\n opsem p Xopsem \\ no_vsse_consume_relaxed_consistent_execution Xopsem Xwitness}\n of pre_executions \\\n if (\\ (Xo,Xw) \\ pre_executions . no_vsse_consume_relaxed_undefined_behaviour Xo Xw)\n then { (Xo,Xw) . True } else pre_executions)\"\n\n(* 10 - Model simplified for programs without consumes, relaxed, acquires or releases *)\nfun consistent_total_order where\n\"consistent_total_order as sb' asw' tot = \n (strict_total_order_over as tot \\ (sb' \\ tot) \\ (asw' \\ tot))\"\n\nfun tot_consistent_reads_from_mapping where\n\"tot_consistent_reads_from_mapping as lk' rf' tot = \n (\\ b \\ as .\n (is_read b) \\\n (case { a . a \\ as \\ (same_location a b) \\ is_write a} of writes_at_same_location \\\n if (\\ a \\ as .adjacent_less_than \n (restrict_relation_set tot (writes_at_same_location \\ {b})) as a b)\n then (\\ a \\ as .\n ((a,b) \\ rf') \\\n adjacent_less_than (restrict_relation_set tot (writes_at_same_location \\ {b})) as a b)\n else \\ (\\ a \\ as . (a,b) \\ rf')))\"\n\nfun tot_consistent_execution where\n\"tot_consistent_execution Xo rf' tot = \n (case restrict_relation_set tot { a . a \\ actions Xo \\ (is_lock a \\ is_unlock a)} of lo \\ \n well_formed_threads (actions Xo) (threads Xo) (lk Xo) (sb Xo) (asw Xo) (dd Xo) (cd Xo)\n \\ consistent_total_order (actions Xo) (sb Xo) (asw Xo) tot\n \\ consistent_locks (actions Xo) lo tot\n \\ tot_consistent_reads_from_mapping (actions Xo) (lk Xo) rf' tot\n \\ well_formed_reads_from_mapping (actions Xo) (lk Xo) rf')\"\n\nfun tot_hb_data_races where\n\"tot_hb_data_races Xo rf' tot =\n (case tot \\ {(a,b) . a \\ (actions Xo) \\ b \\ (actions Xo) \\ is_seq_cst a \\is_seq_cst b} of sc' \\\n (case tot \\ {(a,b) . a \\ (actions Xo) \\ b \\ (actions Xo) \\\n (same_location a b) \\ is_write a \\ is_write b} of mo' \\\n (case no_vsse_consume_relaxed_synchronizes_with_set (actions Xo) (sb Xo) (asw Xo) rf' tot of sw' \\\n (case no_vsse_consume_happens_before (sb Xo) sw' of hb \\\n data_races (actions Xo) hb))))\"\n\nfun tot_data_races where\n\"tot_data_races as tot = \n { (a,b) . a \\ as \\ b \\ as \\\n \\ (a = b) \\ same_location a b \\ (is_write a \\ is_write b) \\\n \\ (same_thread a b) \\\n \\ (is_atomic_action a \\ is_atomic_action b) \\\n (adjacent_less_than tot as a b \\ adjacent_less_than tot as b a) }\"\n\nfun tot_undefined_behaviour where\n\"tot_undefined_behaviour Xo rf' tot = \n (\\ (tot_hb_data_races Xo rf' tot = {}) \\\n \\ (unsequenced_races (actions Xo) (sb Xo) = {}) \\\n \\ (indeterminate_reads (actions Xo) rf' = {}) \\\n \\ (bad_mutexes Xo tot = {}))\"\n\n(* - 10.1 - No consume, relaxed, acquire or release top level judgement *)\ndefinition tot_cmm where\n\"tot_cmm opsem p = \n (case { (Xopsem,(rf,tot)).\n opsem p Xopsem \\ tot_consistent_execution Xopsem rf tot}\n of pre_executions \\\n if (\\ (Xo,(rf,tot)) \\ pre_executions . tot_undefined_behaviour Xo rf tot)\n then { (Xo,(rf,tot)) . True } else pre_executions)\"\n\n\n\nend", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/SC11.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081925, "lm_q2_score": 0.3665897432423098, "lm_q1q2_score": 0.2514620345886556}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_lemma_inv__3_on_rules imports n_mutualExOnI_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__3) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.37022540649291935, "lm_q1q2_score": 0.25144920998354203}} {"text": "theory TypeTheorems imports gASPFuturesTypeSystem begin\n\nsection{* Induction lemmas *}\nlemma TypeValue_induct_Config:\n\"P,Cn aos futs\\\\<^sub>V v:T \n\\ (\\P aos futs n. Prop P aos futs (ASPInt n) (BType Integer))\n\\ (\\P aos futs b. Prop P aos futs (ASPBool b) (BType Boolean))\n\\ (\\P aos futs. Prop P aos futs null (BType AnyObject))\n\\ (\\ Acts Futs \\ C' state R Ec Rq P. (Acts \\ = Some (AO C' state R Ec Rq) \\ Prop P Acts Futs (ActRef \\) (BType (TObj C'))))\n\\ (\\ Acts Futs f T V P. Futs f = Some (T, V) \\ Prop P Acts Futs (FutRef f) (FutType T)) \n\\ (\\ Acts Futs f T V P. Prop P Acts Futs (undefined) (FutType AnyObject)) \n\\ (\\P T T' aos futs v. P\\T\\T' \\ P,Cn aos futs\\\\<^sub>Vv:T \\ Prop P aos futs v T \\ Prop P aos futs v T')\n\\Prop P aos futs v T\"\napply (insert gASPFuturesTypeSystem.TypeValue.induct [of P \"Cn aos futs\" v T \"\\ x conf y . (Prop x (Conf_AOs conf) (Conf_futs conf) y )\" ])\napply auto\napply (drule meta_impE,auto)\napply(case_tac Config,auto)\ndone\n\nlemma TypeExpression_induct_Config:\n\"P,Cn aos futs,\\ in C\\\\<^sub>Ee:T \\\n (\\P aos futs \\ C v T. P,Cn aos futs,\\ in C\\\\<^sub>Av:T \\ Prop P aos futs \\ C (At v) T) \\\n (\\P aos futs \\ C e e'. P,Cn aos futs,\\ in C\\\\<^sub>Ae:BType Integer \\ P,Cn aos futs,\\ in C\\\\<^sub>Ae':BType Integer \\ Prop P aos futs \\ C (e+\\<^sub>Ae') (BType Integer)) \\ \n (\\P T T' aos futs \\ C e. P\\T\\T' \\ P,Cn aos futs,\\ in C\\\\<^sub>Ee:T \\ Prop P aos futs \\ C e T \\Prop P aos futs \\ C e T') \n \\ Prop P aos futs \\ C e T\"\napply (insert gASPFuturesTypeSystem.TypeExpression.induct [of P \"Cn aos futs\" \\ C e T \"\\ x conf y z t. (Prop x (Conf_AOs conf) (Conf_futs conf) y z t)\" ])\napply clarsimp\n apply (drule meta_impE,auto,case_tac Config,auto)+\ndone\n\nlemma TypeAtom_induct_Config:\n\"P,Cn aos futs,\\ in C\\\\<^sub>Ae:T \\\n (\\P aos futs \\ C v T. P,Cn aos futs\\\\<^sub>Vv:T \\ Prop P aos futs \\ C (Val v) T) \\\n (\\P aos futs \\ C. Prop P aos futs \\ C (Var This) (BType (TObj C))) \\ \n (\\P T T' aos futs \\ C x. \\ x = Some T \\ Prop P aos futs \\ C (Var (VarOrThis.Id x)) T) \\\n (\\P T T' aos futs \\ C e. P\\T\\T' \\ P,Cn aos futs,\\ in C\\\\<^sub>Ae:T \\ Prop P aos futs \\ C e T \\Prop P aos futs \\ C e T')\n \\ Prop P aos futs \\ C e T\"\napply (insert gASPFuturesTypeSystem.TypeAtom.induct [of P \"Cn aos futs\" \\ C e T \"\\ x conf y z t. (Prop x (Conf_AOs conf) (Conf_futs conf) y z t)\" ])\napply clarsimp\n apply (drule meta_impE,auto,case_tac Config,auto)+\ndone\n\nlemma TypeStatement_TypeStatementList_induct_Config:\n\" (\\P aos futs \\ C a T x T'. P,Cn aos futs,\\ in C\\\\<^sub>Ra:T \\ \\ x = Some T' \\ P\\T\\T' \\ P1 P aos futs \\ C (x =\\<^sub>A a)) \\\n (\\P C Class m Meth T' aos futs \\ e T x. fetchClass P C = Some Class \\ fetchMethodInClass Class m = Some Meth \\ MRType Meth = T' \\ P,Cn aos futs,\\ in C\\\\<^sub>Ee:T \\ \\ x = Some T' \\ P\\T\\T' \\ P1 P aos futs \\ C (return e)) \\\n (\\P aos futs \\ C z sl sl'. P,Cn aos futs,\\ in C\\\\<^sub>Az:BType Boolean \\ (P,Cn aos futs,\\ in C\\\\<^sub>L sl) \\ P2 P aos futs \\ C sl \\ P,Cn aos futs,\\ in C\\\\<^sub>L sl' \\ P2 P aos futs \\ C sl' \\ P1 P aos futs \\ C (IF z THEN sl ELSE sl' )) \\\n (\\P aos futs \\ C. P2 P aos futs \\ C []) \\\n (\\P aos futs \\ C s sl. P,Cn aos futs,\\ in C\\\\<^sub>S s \\ P1 P aos futs \\ C s \\ P,Cn aos futs,\\ in C\\\\<^sub>L sl \\ P2 P aos futs \\ C sl \\ P2 P aos futs \\ C (s ;; sl)) \\\n ((P,Cn aos futs,\\ in x4\\\\<^sub>S x5) \\ P1 P aos futs \\ x4 x5) \\ ((P',Cn aos' futs',\\' in x9\\\\<^sub>L x10) \\ P2 P' aos' futs' \\' x9 x10)\"\napply (insert gASPFuturesTypeSystem.TypeStatement_TypeStatementList.induct [of \"\\ x conf y z t. (P1 x (Conf_AOs conf) (Conf_futs conf) y z t)\" \"\\ x conf y z t. (P2 x (Conf_AOs conf) (Conf_futs conf) y z t)\" P \"Cn aos futs\" \\ x4 x5 P' \"Cn aos' futs'\" \\' x9 x10])\napply rule\n apply (drule meta_impE,auto,case_tac Config,auto)+\ndone\n\nlemma TypeRhs_induct_Config:\n\"(P,Cn aos futs,\\ in C\\\\<^sub>RR: T)\\\n (\\P aos futs \\ C e T. (P,Cn aos futs,\\ in C\\\\<^sub>Ee:T) \\ P1 P aos futs \\ C (Expr e) T) \\\n (\\P aos futs \\ C z C' Class m Meth param_types el.\n (P,Cn aos futs,\\ in C\\\\<^sub>Az:BType (TObj C')) \\\n fetchClass P C' = Some Class \\ fetchMethodInClass Class m = Some Meth \\ param_types = map fst (MParams Meth) \\ length param_types = length el \\ \\i in C\\\\<^sub>Eel ! i:param_types ! i) \n \\ P1 P aos futs \\ C (z.\\<^sub>Am(el)) (MakeFutureType (MRType Meth))) \\\n (\\P C' Class Class_param_types el aos futs \\ C. fetchClass P C' = Some Class \\ Class_param_types = map fst (ClassParameters Class) \\ length Class_param_types = length el \n \\ \\i in C\\\\<^sub>E(el ! i):(Class_param_types ! i)) \\ P1 P aos futs \\ C (newActive C'(el)) (BType (TObj C'))) \\\n (\\P aos futs \\ C z T. (P,Cn aos futs,\\ in C\\\\<^sub>Az:FutType T) \\ P1 P aos futs \\ C (Get z) (BType T)) \\ (\\P T T' aos futs \\ C e. P\\T\\T' \n \\ P,Cn aos futs,\\ in C\\\\<^sub>Re:T \\ P1 P aos futs \\ C e T \\ P1 P aos futs \\ C e T') \n\\ P1 P aos futs \\ C R T\"\napply (insert TypeRhs.induct [of P \"Cn aos futs\" \\ C R T \"\\ x conf y z t. (P1 x (Conf_AOs conf) (Conf_futs conf) y z t)\"])\napply auto\napply (drule meta_impE,auto,case_tac Config,auto)+\ndone\n\nsection{* Basic Lemmas *}\n\nlemma TypeStatementList_TypeStatement[rule_format]: \n\"(P,Config,\\ in C \\\\<^sub>L Stl) \\ (S \\ set Stl\\ (P,Config,\\ in C \\\\<^sub>S S))\"\napply (induct_tac Stl)\n apply clarsimp+\napply (drule TypeStatementList.cases,auto)\ndone\n\nlemma fetchClass_Some_In[rule_format]:\n \"fetchClass (Prog CL Vars Stl) C = Some CLa \\ CLa\\set CL\"\nby (unfold fetchClass_def, rule find_Some,auto)\n\nlemma fetchClass_Some_Name[rule_format]:\n \"fetchClass (Prog CL Vars Stl) C = Some CLa \\ Name CLa=C\"\nby (unfold fetchClass_def,simp,drule find_Some_P,simp)\n\nlemma fetchMethodInClass_Some:\n \"fetchMethodInClass C m = Some M \\ M \\ set (Methods C)\"\nby (unfold fetchMethodInClass_def, rule find_Some,auto)\n\n\nsection{* extending set of AOs in config *}\n\nlemma TypeValue_extendconfiguration_AO[rule_format]:\n\"P,Cn AOs Futures\\\\<^sub>Vv:T \\ (case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C=C' | None \\ True) \n \\(P,Cn (AOs(\\\\ (AO C state R Ec Rq))) Futures\\\\<^sub>Vv:T)\"\napply (erule TypeValue_induct_Config,auto)\n apply (rule \"TypeValue.intros\" )\n apply (rule \"TypeValue.intros\" )\n apply (rule \"TypeValue.intros\" )\n apply (case_tac \"\\=\\'\")\n apply (rule TypeValue.intros,force)\n apply (rule TypeValue.intros,force)\n apply (rule TypeValue.intros,simp)\n apply (rule TypeValue.intros)\napply (rule TypeValue.intros,auto)\ndone\n\nlemma TypeValue_extendconfiguration_AO_lambda[rule_format]:\n\"P,Cn AOs Futures\\\\<^sub>Vv:T \\ (case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C=C' | None \\ True) \n \\(P,Cn ( (\\a. if a = \\ then Some (AO C state R Ec Rq) else AOs a) ) Futures\\\\<^sub>Vv:T)\"\nby (insert TypeValue_extendconfiguration_AO,simp add: fun_upd_def)\n\nlemma TypeAtom_extendconfiguration_AO[rule_format]:\n\"P,Cn AOs futs,\\ in C\\\\<^sub>Az:T \\ ((case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \\ \n ( P,Cn (\\a. if a = \\ then Some (AO C'' state R Ec Rq) else AOs a) futs ,\\ in C\\\\<^sub>Az:T))\"\napply (erule \"TypeAtom_induct_Config\",auto)\n apply (rule \"TypeValue.cases\",auto)\n apply (rule \"TypeAtom.intros\",(rule TypeValue_extendconfiguration_AO_lambda)?,(auto)?)+\ndone\n\n\nlemma TypeExpression_extendconfiguration_AO[rule_format]:\n\"P,Cn AOs futs,\\ in C\\\\<^sub>Ee:T \\ ((case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \\ \n ( P,Cn (\\a. if a = \\ then Some (AO C'' state R Ec Rq) else AOs a) futs ,\\ in C\\\\<^sub>Ee:T))\"\napply (erule \"TypeExpression_induct_Config\",auto)\n apply (rule \"TypeExpression.intros\",(auto)?)+\n apply (rule \"TypeAtom_extendconfiguration_AO\",auto)\n apply (rule \"TypeExpression.intros\",(auto)?)+\n apply (rule \"TypeAtom_extendconfiguration_AO\",auto)\n apply (rule \"TypeAtom_extendconfiguration_AO\",auto)\napply (rule \"TypeExpression.intros\",auto)\ndone\n\nlemma TypeRhs_extendconfiguration_AO[rule_format]:\n\"P,Cn AOs futs,\\ in C\\\\<^sub>Ra:T \\ ((case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True)\n \\(P,Cn (\\a. if a = \\ then Some (AO C'' state R Ec Rq) else AOs a) futs,\\ in C\\\\<^sub>Ra:T))\"\napply (erule \"TypeRhs_induct_Config\",auto)\n(*5*)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeExpression_extendconfiguration_AO,auto)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeAtom_extendconfiguration_AO,auto)\n apply (rule_tac AOs=aos in TypeExpression_extendconfiguration_AO)\n apply (drule_tac x=i in spec,auto)\n(*3*)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (rule_tac AOs=aos in TypeExpression_extendconfiguration_AO)\n apply (drule_tac x=i in spec,auto)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeAtom_extendconfiguration_AO,force)\napply (rule \"TypeRhs.intros\",(auto)?)\ndone\n\n\nlemma TypeStatement_extendconfiguration_AO_Pre[rule_format]:\n\" ((P,Cn AOs futs,\\ in C \\\\<^sub>S S) \\ (\\ \\ X. (case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True)\n \\ (P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) futs,\\ in C \\\\<^sub>S S))) \\ \n ((P, Cn AOs futs,\\ in C \\\\<^sub>L Stl) \\ (\\ \\ X. (case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True)\n \\ (P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) futs,\\ in C \\\\<^sub>L Stl)))\"\napply (rule TypeStatement_TypeStatementList_induct_Config,auto)\n(*5*)\n apply (rule \"TypeStatement_TypeStatementList.intros\",auto)\n apply (erule_tac AOs=aos in TypeRhs_extendconfiguration_AO,auto)\n apply (rule \"TypeStatement_TypeStatementList.intros\",force,auto)\n apply (erule_tac AOs=aos in TypeExpression_extendconfiguration_AO,auto)\n apply (rule \"TypeStatement_TypeStatementList.intros\")\n(*5*)\n apply (erule_tac AOs=aos in TypeAtom_extendconfiguration_AO,auto)\n apply (rule \"TypeStatement_TypeStatementList.intros\")\napply (rule \"TypeStatement_TypeStatementList.intros\")\n apply auto\ndone\n\nlemma TypeRequest_extendconfiguration_AO[rule_format]:\n\"P,Cn AOs futs in C\\\\<^sub>Q (f,m,vl) \\ ((case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True)\n \\(P,Cn (\\a. if a = \\ then Some (AO C'' state R Ec Rq) else AOs a) futs in C\\\\<^sub>Q (f,m,vl)))\"\napply (erule TypeRequest.cases,auto)\napply (rule TypeRequest.intros,auto)\napply (drule_tac x=i in spec)\napply clarsimp\napply (rule_tac TypeValue_extendconfiguration_AO_lambda)\napply auto\ndone\n\n(* GLOBAL LEMMAS *)\nlemma TypeStatement_extendconfiguration_AO:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>S S) \\(case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \n \\P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) futs,\\ in C \\\\<^sub>S S\"\nby (insert TypeStatement_extendconfiguration_AO_Pre, auto)\n\nlemma TypeStatementList_extendconfiguration_AO:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>L Stl) \\(case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \n \\P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) futs,\\ in C \\\\<^sub>L Stl\"\nby (insert TypeStatement_extendconfiguration_AO_Pre, auto)\n\nsection{* extending set of futs in config *}\n\nlemma TypeValue_extendconfiguration_futs[rule_format]:\n\"P,Cn AOs futs\\\\<^sub>Vv:T \\(futs f = None\\(P,Cn AOs (futs(f\\a))\\\\<^sub>Vv:T))\"\napply (erule TypeValue_induct_Config,auto)\n apply (rule TypeValue.intros,auto?)+\ndone\nlemma TypeValue_extendconfiguration_futs_lambda[rule_format]:\n\"P,Cn AOs futs\\\\<^sub>Vv:T \\futs f = None\\(P,Cn AOs (\\a. if a = f then Some Y else futs a)\\\\<^sub>Vv:T)\"\nby (insert TypeValue_extendconfiguration_futs,simp add: fun_upd_def)\n\n\nlemma TypeAtom_extendconfiguration_futs[rule_format]:\n\"P,Cn AOs futs,\\ in C\\\\<^sub>Az:T \\ futs f = None\\( P,Cn AOs (\\a. if a = f then Some Y else futs a),\\ in C\\\\<^sub>Az:T)\"\napply (erule \"TypeAtom_induct_Config\",auto)\n apply (rule \"TypeValue.cases\",auto)\n apply (rule \"TypeAtom.intros\",(rule TypeValue_extendconfiguration_futs_lambda)?,(auto)?)+\ndone\n\nlemma TypeExpression_extendconfiguration_futs[rule_format]:\n\"P,Cn aos futs,\\ in C\\\\<^sub>Ee:T \\ futs f = None\\( P,Cn aos (\\a. if a = f then Some Y else futs a),\\ in C\\\\<^sub>Ee:T)\"\napply (erule \"TypeExpression_induct_Config\",auto)\n apply (rule \"TypeExpression.intros\",(auto)?)+\n apply (rule \"TypeAtom_extendconfiguration_futs\",auto)\n apply (rule \"TypeExpression.intros\",(auto)?)+\n apply (rule \"TypeAtom_extendconfiguration_futs\",auto)\n apply (rule \"TypeAtom_extendconfiguration_futs\",auto)\napply (rule \"TypeExpression.intros\",auto)\ndone\n\n\nlemma TypeRhs_extendconfiguration_futs[rule_format]:\n\"P,Cn aos futs,\\ in C\\\\<^sub>Ra:T \\ (futs f = None\\(P,Cn aos (\\a. if a = f then Some Y else futs a),\\ in C\\\\<^sub>Ra:T))\"\napply (erule \"TypeRhs_induct_Config\",auto)\n(*5*)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeExpression_extendconfiguration_futs,auto)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeAtom_extendconfiguration_futs,auto)\n apply (rule_tac aos=aos in TypeExpression_extendconfiguration_futs)\n apply (drule_tac x=i in spec,auto)\n(*3*)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (rule_tac aos=aos in TypeExpression_extendconfiguration_futs)\n apply (drule_tac x=i in spec,auto)\n apply (rule \"TypeRhs.intros\",(auto)?)\n apply (erule TypeAtom_extendconfiguration_futs,force)\napply (rule \"TypeRhs.intros\",(auto)?)\ndone\n\nlemma TypeStatement_extendconfiguration_futs_Pre[rule_format]:\n\" ((P,Cn AOs futs,\\ in C \\\\<^sub>S S) \\ (\\ f Y. f\\(dom futs)\\ (P, Cn AOs (futs(f\\Y)),\\ in C \\\\<^sub>S S))) \\ \n ((P, Cn AOs futs,\\ in C \\\\<^sub>L Stl) \\ (\\ f Y. f\\(dom futs)\\ (P, Cn AOs (futs(f\\Y)),\\ in C \\\\<^sub>L Stl)))\"\napply (rule TypeStatement_TypeStatementList_induct_Config,auto)\n(*5*)\n apply (rule \"TypeStatement_TypeStatementList.intros\",auto)\n apply (erule TypeRhs_extendconfiguration_futs,auto)\n apply (rotate_tac -1,erule contrapos_pp,force) \n apply (rule \"TypeStatement_TypeStatementList.intros\",auto)\n apply (erule TypeExpression_extendconfiguration_futs,auto)\n apply (rotate_tac -1,erule contrapos_pp,force) \n apply (rule \"TypeStatement_TypeStatementList.intros\")\n(*5*)\n apply (erule TypeAtom_extendconfiguration_futs,auto)\n apply (rotate_tac -1,erule contrapos_pp,force)\n apply (drule_tac x=f in spec,auto)+\n apply (rule \"TypeStatement_TypeStatementList.intros\")\napply (rule \"TypeStatement_TypeStatementList.intros\")\n apply (drule_tac x=f in spec,auto)+\ndone\n\nlemma TypeRequest_extendconfiguration_futs[rule_format]:\n\"P,Cn AOs futs in C\\\\<^sub>Q (f,m,vl) \\ (futs f = None\n \\(P,Cn AOs (\\a. if a = f then Some Y else futs a) in C\\\\<^sub>Q (f,m,vl)))\"\nby (erule TypeRequest.cases,auto)\n\n\n(* GLOBAL LEMMAS *)\nlemma TypeStatement_extendconfiguration_futs:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>S S) \\f\\(dom futs) \\P, Cn AOs (futs(f\\Y)),\\ in C \\\\<^sub>S S\"\nby (insert TypeStatement_extendconfiguration_futs_Pre,case_tac Y, simp)\n\nlemma TypeStatementList_extendconfiguration_futs:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>L Stl) \\f\\(dom futs) \\P, Cn AOs (futs(f\\Y)),\\ in C \\\\<^sub>L Stl\"\nby (insert TypeStatement_extendconfiguration_futs_Pre,case_tac Y, simp)\n\n\nsection {* extend AOs and futs *}\nlemma TypeStatement_extendconfiguration:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>S S) \\(case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \\f\\(dom futs) \n \\P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) (futs(f\\Y)),\\ in C \\\\<^sub>S S\"\nby (insert TypeStatement_extendconfiguration_futs,insert TypeStatement_extendconfiguration_AO, auto)\n\nlemma TypeStatementList_extendconfiguration:\n\" (P,Cn AOs futs,\\ in C \\\\<^sub>L Stl) \\(case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C''=C' | None \\ True) \n \\f\\(dom futs) \\P, Cn (AOs(\\\\(AO C'' state R Ec Rq))) (futs(f\\Y)),\\ in C \\\\<^sub>L Stl\"\nby (insert TypeStatementList_extendconfiguration_futs,insert TypeStatementList_extendconfiguration_AO, auto)\n\nsection {* compositional lemmas for WT *}\n\nlemma TypeUpdate_AO: \"P \\ Cn AOs Futures \\\n (case AOs \\ of Some (AO C' st' R' Ec' Rq') \\ C=C' | None \\ True) \\\n (\\ CL . (fetchClass P C = Some CL \\\n (\n (* check state *)\n ( ( \\ x v. (state(x) =Some v \\ (\\ T . (T,x)\\ set (ClassParameters CL) \\ (P,Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures\\\\<^sub>V v: T))) ) )\n (* check request queue*)\n \\ (\\ R'\\set Rq. (P, (Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures) in C \\\\<^sub>Q R' ) )\n (* check current request*)\n \\ \n (case R of Some (f,m,vl) \\\n (\\ Meth. fetchMethodInClass CL m = Some Meth \\\n (P, Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures in C \\\\<^sub>Q (f,m,vl)) \n \\ (case Ec of (locs,Stl) \\ (( \\ x v. (locs(x) =Some v \\ ( (\\ T . (T,x)\\ set (LocalVariables Meth) \\ (P,Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures\\\\<^sub>V v: T))\n \\(\\ T . (T,x)\\ set (MParams Meth) \\ (P,Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures\\\\<^sub>V v: T))) )))\n \\ ( \\ s\\set Stl. \n (P,Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures,(BuildTypeEnv (ClassParameters CL))++(BuildTypeEnv (LocalVariables Meth))++(BuildTypeEnv (MParams Meth)) in C \\\\<^sub>S s)\n )) ) ) )))\n\\ P \\ Cn (AOs(\\ \\ AO C state R Ec Rq)) Futures \"\napply (clarsimp,auto)\n apply (clarsimp simp: ran_def)\n apply (case_tac \"a = \\\",clarsimp)\n(*activity not alpha *)\n apply clarsimp\n apply (case_tac Act,clarsimp)\n apply (drule_tac x= \"(AO x1 x2 x3 (aa, b) x5)\" in spec)\n apply clarsimp\n apply (erule impE,force)\n apply clarsimp\n apply (intro allI conjI)\n(*4*)\n apply clarsimp\n apply (drule_tac x=x in spec)+\n apply (drule_tac x=v in spec)+\n apply clarsimp\n apply (rule_tac x=T in exI)\n apply clarsimp\n apply (erule TypeValue_extendconfiguration_AO)\n apply clarsimp\n\n(*3 Q*)\n apply clarsimp\n apply (rename_tac a)\n(* one of the pending request *)\n apply (drule_tac x=\"(ab, ac, a)\" in bspec,simp)\n apply (erule TypeRequest.cases)\n apply (rule_tac Meth=Meth in TypeRequest.intros)\n apply auto\n apply (drule_tac x=i in spec,clarsimp)\n apply (rule TypeValue_extendconfiguration_AO)\n apply clarsimp+\n\n(*2 the current req*)\n apply (case_tac x3,auto) \n apply (simp add: Fun.fun_upd_def)\n apply (erule TypeRequest_extendconfiguration_AO)\n apply auto\n apply (drule_tac x=x in spec,drule_tac x=v in spec,clarsimp)\n apply (elim disjE)\n apply clarsimp\n apply (rule_tac x=T in exI,clarsimp)\n apply (erule TypeValue_extendconfiguration_AO,force)\n(*3*)\n apply clarsimp\n apply (drule_tac x=T in spec,simp add: MethSignature_def)\n apply (drule TypeValue_extendconfiguration_AO,force,force)\n\n apply (drule_tac x=x in bspec,auto)\n apply (erule_tac \\=\\ in TypeStatement_extendconfiguration_AO)\n apply simp\n\n(*1 Finally: futures *)\napply (drule_tac x=\"(a,b)\" in bspec)\n apply simp\napply(case_tac b)\n apply auto\napply (erule TypeValue_extendconfiguration_AO)\napply clarsimp\ndone\n\nsection{*Type-empty-config*}\n\nlemma TypeValue_EmptyConfig_pre: \n \"(P,Cnf\\\\<^sub>Vv:T) \\(Cnf=EmptyConfig \\(P,Config\\\\<^sub>Vv:T))\"\napply (erule TypeValue.induct,auto)\napply (rule TypeValue.intros)+\napply auto\ndone\nlemma TypeValue_EmptyConfig: \n \"(P,EmptyConfig\\\\<^sub>Vv:T) \\(P,Config\\\\<^sub>Vv:T)\"\nby (drule TypeValue_EmptyConfig_pre,auto)\n\nlemma TypeAtom_EmptyConfig_pre: \n \"(P,Cnf,\\ in C\\\\<^sub>Av:T) \\(Cnf=EmptyConfig \\(P,Config,\\ in C\\\\<^sub>Av:T))\"\napply (erule TypeAtom.induct,auto)\napply (rule TypeAtom.intros)\napply (erule TypeValue_EmptyConfig)\napply (rule TypeAtom.intros)\napply (erule TypeAtom.intros)\napply (erule TypeAtom.intros,simp)\ndone\nlemma TypeAtom_EmptyConfig: \n\"(P,EmptyConfig,\\ in C\\\\<^sub>Av:T) \\(P,Config,\\ in C\\\\<^sub>Av:T)\"\nby (drule TypeAtom_EmptyConfig_pre,auto)\n\nlemma TypeExpression_EmptyConfig_pre: \n \"(P,Cnf,\\ in C\\\\<^sub>Ee:T) \\(Cnf=EmptyConfig \\(P,Config,\\ in C\\\\<^sub>Ee:T))\"\napply (erule TypeExpression.induct,auto)\napply (rule TypeExpression.intros)\napply (erule TypeAtom_EmptyConfig)\napply (rule TypeExpression.intros)\napply (erule TypeAtom_EmptyConfig)\napply (erule TypeAtom_EmptyConfig)\napply (erule TypeExpression.intros,simp)\ndone\nlemma TypeExpression_EmptyConfig: \n\"(P,EmptyConfig,\\ in C\\\\<^sub>Ee:T) \\(P,Config,\\ in C\\\\<^sub>Ee:T)\"\nby (drule TypeExpression_EmptyConfig_pre,auto)\n\nlemma TypeRhs_EmptyConfig_pre:\n\"(P,Cnf,\\ in C\\\\<^sub>RR:T) \\(Cnf=EmptyConfig \\(P,Config,\\ in C\\\\<^sub>RR:T))\"\napply (drule TypeRhs.induct,auto)\napply (rule TypeRhs.intros)\napply (erule TypeExpression_EmptyConfig)\napply (rule TypeRhs.intros,auto)\napply (erule TypeAtom_EmptyConfig)\napply (drule_tac x=i in spec,simp)\napply (erule TypeExpression_EmptyConfig)\napply (rule TypeRhs.intros,auto)\napply (drule_tac x=i in spec,simp)\napply (erule TypeExpression_EmptyConfig)\napply (rule TypeRhs.intros)\napply (erule TypeAtom_EmptyConfig)\napply (rule TypeRhs.intros,auto)\ndone\nlemma TypeRhs_EmptyConfig: \n\"(P,EmptyConfig,\\ in C\\\\<^sub>RR:T) \\(P,Config,\\ in C\\\\<^sub>RR:T)\"\nby (drule TypeRhs_EmptyConfig_pre,auto)\n\nlemma Type_EmptyConfig_Stl_pre: \"((P,Cnf,\\ in C \\\\<^sub>S S) \\(Cnf=EmptyConfig \\(P,Config,\\ in C \\\\<^sub>S S))) \\\n ((P,Cnf,\\ in C \\\\<^sub>L Stl) \\ (Cnf=EmptyConfig \\(P,Config,\\ in C \\\\<^sub>L Stl)))\"\napply (rule TypeStatement_TypeStatementList.induct,auto)\napply (rule TypeStatement_TypeStatementList.intros,auto)\napply (erule TypeRhs_EmptyConfig)\napply (rule TypeStatement_TypeStatementList.intros,auto)\napply (erule TypeExpression_EmptyConfig)\napply (rule TypeStatement_TypeStatementList.intros,auto)\napply (erule TypeAtom_EmptyConfig)\napply (rule TypeStatement_TypeStatementList.intros)\napply (rule TypeStatement_TypeStatementList.intros,auto)\ndone\n\nlemma TypeStl_EmptyConfig: \n\"(P,EmptyConfig,\\ in C \\\\<^sub>L Stl) \\(P,Config,\\ in C \\\\<^sub>L Stl)\"\nby (insert Type_EmptyConfig_Stl_pre,auto)\n\nlemma Var_in_LocalVariables:\n\" map_of (zip (map snd (LocalVariables aa)) (map (Initialisation_from_ASPType \\ fst) (LocalVariables aa))) x = Some v \\\n (\\T. (T, x) \\ set (LocalVariables aa)\\ (P,Config\\\\<^sub>Vv:T))\" \napply (case_tac aa,simp,erule_tac t=aa in ssubst,simp add: atomize_imp)\napply (induct_tac LocalVariables)\n apply (clarsimp )+\napply (rule_tac x=a in exI)\napply (case_tac a,clarsimp)\n\n apply (case_tac x1,unfold Initialisation_from_ASPType_def Initialisation_from_BasicType_def)\n(*5*)\n apply (clarsimp,rule TypeValue.intros)\n apply (clarsimp,rule TypeValue.intros)\n apply (clarsimp,rule TypeValue.intros,rule Subtype.intros(3))\n apply (rule TypeValue.intros)\n apply (clarsimp,rule TypeValue.intros)\n\napply (case_tac x2)\n(*4*)\n apply (clarsimp,rule TypeValue.intros,rule Subtype.intros(2))\n apply (rule TypeValue.intros)\n apply (clarsimp,rule TypeValue.intros,rule Subtype.intros(2))\n apply (rule TypeValue.intros)\n apply (clarsimp,rule TypeValue.intros,rule Subtype.intros(2))\n apply (rule TypeValue.intros,rule Subtype.intros(3))\n apply (rule TypeValue.intros)\napply (clarsimp,rule TypeValue.intros,rule Subtype.intros(2))\napply (rule TypeValue.intros)\ndone\n\n\nsection{* Well-typed initial configuraiton *}\n\n\nlemma Initialization_Vars_BasicType: \n\"(map_of (map (\\ v. (snd v,Initialisation_from_BasicType (fst v))) vl)) x=Some v \n \\ \\T. ((T,x)\\set vl\\ (P,Conf\\\\<^sub>Vv:BType T))\"\napply (auto simp: Initialisation_from_BasicType_def)\napply (drule Map.map_of_SomeD,auto)\napply (rule_tac x=a in exI,auto)\napply (case_tac a,auto)\n(*4*)\n apply (rule TypeValue.intros)\n apply (rule TypeValue.intros)\n apply (subgoal_tac \"P,Conf\\\\<^sub>Vnull:BType AnyObject\")\n apply (subgoal_tac \"P\\BType AnyObject\\BType (TObj x3)\")\n apply (erule TypeValue.intros)\n apply auto\n apply (rule Subtype.intros)\n apply (rule TypeValue.intros)\n apply (rule TypeValue.intros)\ndone\n\nlemma Initialization_Vars_ASPType: \n\"(map_of (map (\\ v. (snd v,Initialisation_from_ASPType (fst v))) vl)) x=Some v \n \\ \\T. ((T,x)\\set vl\\ (P,Conf\\\\<^sub>Vv:T))\"\napply (auto simp: Initialisation_from_ASPType_def)\napply (drule Map.map_of_SomeD,auto)\napply (rule_tac x=a in exI,auto)\napply (case_tac a,auto)\n apply (case_tac x1,auto simp: Initialisation_from_BasicType_def)\n(*5*)\n apply (rule TypeValue.intros)\n apply (rule TypeValue.intros)\n apply (subgoal_tac \"P,Conf\\\\<^sub>Vnull:BType AnyObject\")\n apply (subgoal_tac \"P\\BType AnyObject\\BType (TObj x3)\")\n apply (erule TypeValue.intros)\n apply auto\n apply (rule Subtype.intros)\n apply (rule TypeValue.intros)\n apply (rule TypeValue.intros)\napply (case_tac x2,auto simp: Initialisation_from_BasicType_def)\n(*4*)\n apply (rule TypeValue.intros,rule Subtype.intros(2),rule TypeValue.intros) (*enforce btype\\<^sub>Vnull:FutType AnyObject\")\n apply (subgoal_tac \"P\\FutType AnyObject\\FutType (TObj x3)\")\n apply (erule TypeValue.intros,simp)\n apply (rule Subtype.intros)\n apply (rule TypeValue.intros,rule Subtype.intros(2),rule TypeValue.intros)\napply (rule TypeValue.intros,rule Subtype.intros(2),rule TypeValue.intros)\ndone\n\n\ntheorem WTinitialconfiguration: \"\\\\<^sub>P Prog CL Vars Stl \\ Prog ((MainObjClass Vars)#CL) Vars Stl \\ InitialConfiguration (Prog CL Vars Stl)\"\napply (unfold InitialConfiguration_def BuildInitialConfigurationfromVarsStl_def)\napply (auto,unfold Let_def Initialisation_from_ASPType_def fetchClass_def fetchMethodInClass_def MainObjClass_def MainMethodEmptyBody_def,auto)\n apply (intro gASPFuturesTypeSystem.TypeRequest.intros, auto simp: fetchClass_def fetchMethodInClass_def GetBasicType_def )\n apply (rule Initialization_Vars_ASPType)\n apply (simp add: Initialisation_from_ASPType_def)\n(*1*)\napply (rule TypeStatementList_TypeStatement,auto)\napply (unfold BuildTypeEnv_def)\napply (rule_tac AOs=\"empty\" in TypeStatementList_extendconfiguration)\n apply (auto)\ndone\n\nsection {* Subject Reduction *}\n\n\n\ntheorem SubjectReduction: \n\"(Prog CL Vars Stl \\ Cn aos futs \\ Cn aos' futs') \\ (\\\\<^sub>P Prog CL Vars Stl)\n \\ ((Prog CL Vars Stl \\ Cn aos futs) \\ (Prog CL Vars Stl \\ Cn aos' futs'))\"\napply (erule gASPFutures.reduction.induct)\n(* 11 SERVE *)\n apply (case_tac P, rename_tac CL Vars Stl, simp only: Let_def)\n apply (intro impI,rule TypeUpdate_AO)\n apply clarsimp+\n apply (drule_tac x=\"AO C state None (a, b) ((f, m, vl) # Rq)\" in bspec,force simp: ran_def)\n apply simp\n apply clarify\n apply (rule_tac x=CLa in exI)\n apply clarsimp\n apply (intro conjI,clarsimp)\n apply (drule_tac x=x in spec, drule_tac x=v in spec)\n apply clarsimp\n apply (rule_tac x=T in exI)\n apply clarsimp\n apply (erule TypeValue_extendconfiguration_AO,clarsimp)\n(*12*)\n apply clarsimp\n apply (rename_tac a b c)\n apply (drule_tac x=\"(a,b,c)\" in bspec,simp)\n apply (simp add: fun_upd_def)\n apply (erule TypeRequest_extendconfiguration_AO)\n apply force\n(*11*)\n apply (simp add: Bind_def )\n apply (case_tac \"fetchMethodInClass CLa m\",clarsimp)\n apply clarsimp\n apply (intro conjI)\n apply (simp add: fun_upd_def,erule TypeRequest_extendconfiguration_AO,force)\n(*12 well typed new body! *)\n apply (simp add: Let_def)\n apply (case_tac \"length (MParams aa) = length vl\") \n apply (drule_tac x=CLa in bspec)\n apply (erule fetchClass_Some_In)\n\napply (intro allI impI,simp,elim conjE)\napply (rotate_tac 12) (*map_of (zip (map snd (LocalVariables aa)) (map (Initialisation_from_ASPType \\ fst) (MParams aa))) ++ map_of (zip (map snd (MParams aa)) vl) = ac*)\napply (drule sym,simp)\napply (drule Map.map_add_SomeD,elim disjE)\n\napply (rule disjI2)\napply (erule \"TypeRequest.cases\")\napply (drule Map.map_of_SomeD,simp, simp add: set_conv_nth,clarsimp)\napply (drule_tac x=i in spec,simp)\napply (rule_tac x=\"fst (MParams aa ! i)\" in exI)\napply clarsimp\napply (intro conjI)\napply (rule_tac x=\"MParams aa\" in exI)\napply (case_tac \"MethSignature aa\",force)\napply (erule TypeValue_extendconfiguration_AO,force)\n\napply (rule disjI1, elim conjE)\napply (frule Var_in_LocalVariables,clarsimp)\napply (rule_tac x=T in exI,simp)\napply (subgoal_tac \"\nzip (map snd (LocalVariables aa)) (map (Initialisation_from_ASPType \\ fst) (MParams aa))\n=map (\\v. (snd v, Initialisation_from_ASPType (fst v))) (LocalVariables aa)\")\napply force\n\napply (simp add: zip_map1)\n\napply clarsimp\n\n apply (rule_tac Stl=\"Body aa\" in TypeStatementList_TypeStatement)\napply (drule_tac x=CLa in bspec)\napply (erule fetchClass_Some_In)\napply (drule_tac x=aa in bspec)\napply (erule fetchMethodInClass_Some)\napply (rule TypeStl_EmptyConfig)\napply (simp add: BuildTypeEnv_def)\napply (drule fetchClass_Some_Name,clarsimp)\napply (clarsimp simp: Let_def)\napply (case_tac \"length (MParams aa) = length vl\") \napply force\napply force\n\n(*10 AssignLocal *)\napply (case_tac P, rename_tac CL Vars Stl, simp only: Let_def)\napply (intro impI)\napply (rule TypeUpdate_AO)\napply clarsimp+\napply (drule_tac x=\"(AO C state (Some (a, aa, b)) (locs, x =\\<^sub>A Expr e ;; Stla) Rq)\" in bspec,force simp: ran_def)\napply simp\napply clarify\napply (rule_tac x=CLa in exI)\napply clarsimp\napply (intro conjI,clarsimp)\napply (drule_tac x=xa in spec, drule_tac x=va in spec)\napply clarsimp\napply (rule_tac x=T in exI)\napply clarsimp\napply (erule TypeValue_extendconfiguration_AO,clarsimp)\n(*12*)\napply clarsimp\napply (rename_tac a b c)\napply (drule_tac x=\"(a,b,c)\" in bspec,simp)\napply (simp add: fun_upd_def)\napply (erule TypeRequest_extendconfiguration_AO)\napply force\n(*11*)\napply (simp add: fun_upd_def)\napply (erule TypeRequest_extendconfiguration_AO)\napply force\n(*10*)\napply clarsimp\napply (drule_tac x=xa in bspec,simp)\napply (erule TypeStatement_extendconfiguration_AO)\napply force\n\n(*9 AssignField*)\napply (case_tac P, rename_tac CL Vars Stl, simp only: Let_def)\napply (intro impI)\napply (thin_tac \"x \\ dom locs\")\napply (rule TypeUpdate_AO)\napply clarsimp+\napply (drule_tac x=\"(AO C state (Some (a, aa, b)) (locs, x =\\<^sub>A Expr e ;; Stla) Rq)\" in bspec,force simp: ran_def)\napply simp\napply clarify\napply (rule_tac x=CLa in exI)\napply clarsimp\napply (intro conjI,clarsimp)\napply (intro conjI,clarsimp)\napply (drule_tac x=x in spec, drule_tac x=y in spec)\napply clarsimp\napply (rule_tac x=T in exI)\napply clarsimp\napply (erule TypeValue_extendconfiguration_AO,clarsimp)\n(*12*)\napply clarsimp\napply (rename_tac a b c)\napply (drule_tac x=\"(a,b,c)\" in bspec,simp)\napply (simp add: fun_upd_def)\napply (erule TypeRequest_extendconfiguration_AO)\napply force\n(*11*)\napply (simp add: fun_upd_def)\napply (erule TypeRequest_extendconfiguration_AO)\napply force\n(*10*)\napply clarsimp\napply (drule_tac x=xa in bspec,simp)\napply (erule TypeStatement_extendconfiguration_AO)\napply force\n", "meta": {"author": "lhenrio", "repo": "DFEcplicitFuturesinIsabelle", "sha": "a53fe1cbcabf14481577d37778041f76685417e8", "save_path": "github-repos/isabelle/lhenrio-DFEcplicitFuturesinIsabelle", "path": "github-repos/isabelle/lhenrio-DFEcplicitFuturesinIsabelle/DFEcplicitFuturesinIsabelle-a53fe1cbcabf14481577d37778041f76685417e8/TypeTheorems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.411110869232168, "lm_q1q2_score": 0.2513457744738366}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Agent\n imports Subst_Term\nbegin\n\nnominal_datatype ('term, 'assertion, 'condition) psi = \n PsiNil (\"\\\" 190)\n\n\n| Output \"'term::fs_name\" 'term \"('term, 'assertion::fs_name, 'condition::fs_name) psi\" (\"_\\_\\._\" [120, 120, 110] 110)\n| Input 'term \"('term, 'assertion, 'condition) input\" (\"_\\_\" [120, 120] 110)\n| Case \"(('term, 'assertion, 'condition) psiCase)\" (\"Case _\" [120] 120)\n| Par \"('term, 'assertion, 'condition) psi\" \"('term, 'assertion, 'condition) psi\" (infixl \"\\\" 90)\n| Res \"\\name\\(('term, 'assertion, 'condition) psi)\" (\"\\\\_\\_\" [120, 120] 110)\n| Assert 'assertion (\"\\_\\\" [120] 120)\n| Bang \"('term, 'assertion, 'condition) psi\" (\"!_\" [110] 110)\n\nand ('term, 'assertion, 'condition) input = \n Trm 'term \"(('term, 'assertion, 'condition) psi)\" (\"\\_._\" [130, 130] 130)\n| Bind \"\\name\\(('term, 'assertion, 'condition) input)\" (\"\\__\" [120, 120] 120)\n\nand ('term, 'assertion, 'condition) psiCase = \n EmptyCase (\"\\\\<^sub>c\" 120)\n| Cond 'condition \"(('term, 'assertion, 'condition) psi)\"\n \"(('term, 'assertion, 'condition) psiCase)\" (\"\\ _ \\ _ _ \" [120, 120, 120] 120)\n\nlemma psiFreshSet[simp]:\n fixes X :: \"name set\"\n and M :: \"'a::fs_name\"\n and N :: 'a\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n and \\ :: 'b\n and \\ :: 'c\n\n shows \"X \\* (M\\N\\.P) = (X \\* M \\ X \\* N \\ X \\* P)\"\n and \"X \\* M\\I = (X \\* M \\ X \\* I)\"\n and \"X \\* Case C = X \\* C\"\n and \"X \\* (P \\ Q) = (X \\* P \\ X \\* Q)\"\n and \"X \\* \\\\x\\P = (X \\* [x].P)\"\n and \"X \\* \\\\\\ = X \\* \\\"\n and \"X \\* !P = X \\* P\"\n and \"X \\* \\\"\n and \"X \\* Trm N P = (X \\* N \\ X \\* P)\"\n and \"X \\* Bind x I = X \\* ([x].I)\"\n\n and \"X \\* \\\\<^sub>c\"\n and \"X \\* \\ \\ \\ P C = (X \\* \\ \\ X \\* P \\ X \\* C)\"\nby(auto simp add: fresh_star_def psi.fresh)+\n\nlemma psiFreshVec[simp]:\n fixes xvec :: \"name list\"\n\n shows \"xvec \\* (M\\N\\.P) = (xvec \\* M \\ xvec \\* N \\ xvec \\* P)\"\n and \"xvec \\* M\\I = (xvec \\* M \\ xvec \\* I)\"\n and \"xvec \\* Case C = xvec \\* C\"\n and \"xvec \\* (P \\ Q) = (xvec \\* P \\ xvec \\* Q)\"\n and \"xvec \\* \\\\x\\P = (xvec \\* [x].P)\"\n and \"xvec \\* \\\\\\ = xvec \\* \\\"\n and \"xvec \\* !P = xvec \\* P\"\n and \"xvec \\* \\\"\n\n and \"xvec \\* Trm N P = (xvec \\* N \\ xvec \\* P)\"\n and \"xvec \\* Bind x I = xvec \\* ([x].I)\"\n\n and \"xvec \\* \\\\<^sub>c\"\n and \"xvec \\* \\ \\ \\ P C = (xvec \\* \\ \\ xvec \\* P \\ xvec \\* C)\"\nby(auto simp add: fresh_star_def)\n\nfun psiCases :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list \\ ('a, 'b, 'c) psiCase\"\nwhere \n base: \"psiCases [] = \\\\<^sub>c\"\n| step: \"psiCases ((\\, P)#xs) = Cond \\ P (psiCases xs)\"\n\nlemma psiCasesEqvt[eqvt]:\n fixes p :: \"name prm\"\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n\n shows \"(p \\ (psiCases Cs)) = psiCases(p \\ Cs)\"\nby(induct Cs) auto\n\nlemma psiCasesFresh[simp]:\n fixes x :: name\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n \n shows \"x \\ psiCases Cs = x \\ Cs\"\nby(induct Cs)\n (auto simp add: fresh_list_nil fresh_list_cons)\n\nlemma psiCasesFreshChain[simp]:\n fixes xvec :: \"name list\"\n and Cs :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and Xs :: \"name set\"\n \n shows \"(xvec \\* psiCases Cs) = xvec \\* Cs\"\n and \"(Xs \\* psiCases Cs) = Xs \\* Cs\"\nby(auto simp add: fresh_star_def)\n\nabbreviation\n psiCasesJudge (\"Cases _\" [80] 80) where \"Cases Cs \\ Case(psiCases Cs)\"\n\nprimrec resChain :: \"name list \\ ('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ ('a, 'b, 'c) psi\" where\n base: \"resChain [] P = P\"\n| step: \"resChain (x#xs) P = \\\\x\\(resChain xs P)\"\n\nnotation resChain (\"\\\\*_\\_\" [80, 80] 80)\n\nlemma resChainEqvt[eqvt]:\n fixes perm :: \"name prm\"\n and lst :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"perm \\ (\\\\*xvec\\P) = \\\\*(perm \\ xvec)\\(perm \\ P)\"\nby(induct_tac xvec, auto)\n\nlemma resChainSupp:\n fixes xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"supp(\\\\*xvec\\P) = (supp P) - set xvec\"\nby(induct xvec) (auto simp add: psi.supp abs_supp)\n\nlemma resChainFresh: \n fixes x :: name\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"x \\ \\\\*xvec\\P = (x \\ set xvec \\ x \\ P)\"\nby (induct xvec) (simp_all add: abs_fresh)\n\nlemma resChainFreshSet: \n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and yvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"Xs \\* (\\\\*xvec\\P) = (\\x\\Xs. x \\ set xvec \\ x \\ P)\"\n and \"yvec \\* (\\\\*xvec\\P) = (\\x\\(set yvec). x \\ set xvec \\ x \\ P)\"\nby (simp add: fresh_star_def resChainFresh)+\n\nlemma resChainFreshSimps[simp]:\n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n\n shows \"Xs \\* xvec \\ Xs \\* (\\\\*xvec\\P) = (Xs \\* P)\"\n and \"yvec \\* xvec \\ yvec \\* (\\\\*xvec\\P) = (yvec \\* P)\"\n and \"xvec \\* (\\\\*xvec\\P)\"\napply(simp add: resChainFreshSet) apply(force simp add: fresh_star_def name_list_supp fresh_def)\napply(simp add: resChainFreshSet) apply(force simp add: fresh_star_def name_list_supp fresh_def)\nby(simp add: resChainFreshSet)\n \nlemma resChainAlpha:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes xvecFreshP: \"(p \\ xvec) \\* P\"\n and S: \"set p \\ set xvec \\ set (p \\ xvec)\"\n\n shows \"\\\\*xvec\\P = \\\\*(p \\ xvec)\\(p \\ P)\"\nproof -\n note pt_name_inst at_name_inst S\n moreover have \"set xvec \\* (\\\\*xvec\\P)\"\n by (simp add: resChainFreshSet)\n moreover from xvecFreshP have \"set (p \\ xvec) \\* (\\\\*xvec\\P)\"\n by (simp add: resChainFreshSet) (simp add: fresh_star_def)\n ultimately have \"\\\\*xvec\\P = p \\ (\\\\*xvec\\P)\"\n by (rule_tac pt_freshs_freshs [symmetric])\n then show ?thesis by(simp add: eqvts)\nqed\n\nlemma resChainAppend:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"\\\\*(xvec@yvec)\\P = \\\\*xvec\\(\\\\*yvec\\P)\"\nby(induct xvec) auto\n\nlemma resChainSimps[dest]:\n fixes xvec :: \"name list\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and Q :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Q' :: \"('a, 'b, 'c) psi\"\n\n shows \"((\\\\*xvec\\(P \\ Q)) = P' \\ Q') \\ (P = P' \\ Q = Q')\"\n and \"(P \\ Q = \\\\*xvec\\(P' \\ Q')) \\ (P = P' \\ Q = Q')\"\nby(case_tac xvec, simp_all add: psi.inject)+\n\nprimrec inputChain :: \"name list \\ 'a::fs_name \\ ('a, 'b::fs_name, 'c::fs_name) psi \\ ('a, 'b, 'c) input\" where\n base: \"inputChain [] N P = \\(N).P\"\n| step: \"inputChain (x#xs) N P = \\ x (inputChain xs N P)\"\n\nabbreviation\n inputChainJudge (\"_\\\\*_ _\\._\" [80, 80, 80, 80] 80) where \"M\\\\*xvec N\\.P \\ M\\(inputChain xvec N P)\"\n\nlemma inputChainEqvt[eqvt]:\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n \n shows \"p \\ (inputChain xvec N P) = inputChain (p \\ xvec) (p \\ N) (p \\ P)\"\nby(induct_tac xvec) auto\n\nlemma inputChainFresh: \n fixes x :: name\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"x \\ (inputChain xvec N P) = (x \\ set xvec \\ (x \\ N \\ x \\ P))\"\nby (induct xvec) (simp_all add: abs_fresh)\n\nlemma inductChainSimps[simp]:\n fixes xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"xvec \\* (inputChain xvec N P)\"\nby(induct xvec) (auto simp add: abs_fresh abs_fresh_star fresh_star_def)\n\nlemma inputChainFreshSet: \n fixes Xs :: \"name set\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n shows \"Xs \\* (inputChain xvec N P) = (\\x\\Xs. x \\ set xvec \\ (x \\ N \\ x \\ P))\"\nby (simp add: fresh_star_def inputChainFresh)\n\nlemma inputChainAlpha:\n fixes p :: \"name prm\"\n and Xs :: \"name set\"\n and Ys :: \"name set\"\n\n assumes XsFreshP: \"Xs \\* (inputChain xvec N P)\"\n and YsFreshN: \"Ys \\* N\"\n and YsFreshP: \"Ys \\* P\"\n and S: \"set p \\ Xs \\ Ys\"\n\n shows \"(inputChain xvec N P) = (inputChain (p \\ xvec) (p \\ N) (p \\ P))\"\nproof -\n note pt_name_inst at_name_inst XsFreshP S\n moreover from YsFreshN YsFreshP have \"Ys \\* (inputChain xvec N P)\"\n by (simp add: inputChainFreshSet) (simp add: fresh_star_def)\n ultimately have \"(inputChain xvec N P) = p \\ (inputChain xvec N P)\"\n by (rule_tac pt_freshs_freshs [symmetric])\n then show ?thesis by(simp add: eqvts)\nqed\n\nlemma inputChainAlpha':\n fixes p :: \"name prm\"\n and xvec :: \"name list\"\n and N :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes xvecFreshP: \"(p \\ xvec) \\* P\"\n and xvecFreshN: \"(p \\ xvec) \\* N\"\n and S: \"set p \\ set xvec \\ set (p \\ xvec)\"\n\n shows \"(inputChain xvec N P) = (inputChain (p \\ xvec) (p \\ N) (p \\ P))\"\nproof -\n note pt_name_inst at_name_inst S\n moreover have \"set xvec \\* (inputChain xvec N P)\"\n by (simp add: inputChainFreshSet)\n ultimately show ?thesis using xvecFreshN xvecFreshP \n by(rule_tac inputChainAlpha) (simp add: fresh_star_def)+\nqed\n\nlemma alphaRes:\n fixes M :: \"'a::fs_name\"\n and x :: name\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and y :: name\n\n assumes yFreshP: \"y \\ P\"\n\n shows \"\\\\x\\P = \\\\y\\([(x, y)] \\ P)\"\nproof(cases \"x = y\")\n assume \"x=y\"\n thus ?thesis by simp\nnext\n assume \"x \\ y\"\n with yFreshP show ?thesis\n by(perm_simp add: psi.inject alpha calc_atm fresh_left)\nqed\n\nlemma alphaInput:\n fixes x :: name\n and I :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input\"\n and c :: name\n\n assumes A1: \"c \\ I\"\n\n shows \"\\ x I = \\ c([(x, c)] \\ I)\"\nproof(cases \"x = c\")\n assume \"x=c\"\n thus ?thesis by simp\nnext\n assume \"x \\ c\"\n with A1 show ?thesis\n by(perm_simp add: input.inject alpha calc_atm fresh_left)\nqed\n\nlemma inputChainLengthEq:\n fixes xvec :: \"name list\"\n and yvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes \"length xvec = length yvec\"\n and \"xvec \\* yvec\"\n and \"distinct yvec\"\n and \"yvec \\* M\"\n and \"yvec \\* P\"\n\n obtains N Q where \"inputChain xvec M P = inputChain yvec N Q\"\nproof -\n assume \"\\N Q. inputChain xvec M P = inputChain yvec N Q \\ thesis\"\n moreover obtain n where \"n = length xvec\" by auto\n with assms have \"\\N Q. inputChain xvec M P = inputChain yvec N Q\"\n proof(induct n arbitrary: xvec yvec M P)\n case 0\n thus ?case by auto\n next\n case(Suc n xvec yvec M P)\n from \\Suc n = length xvec\\\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n with \\length xvec = length yvec\\\n obtain y yvec' where \"yvec = y#yvec'\" by(case_tac yvec) auto\n from \\yvec = y#yvec'\\ \\xvec=x#xvec'\\ \\xvec \\* yvec\\ \\distinct yvec\\ \\length xvec = length yvec\\ \\yvec \\* M\\ \\yvec \\* P\\\n have \"length xvec' = length yvec'\" and \"xvec' \\* yvec'\" and \"distinct yvec'\" and \"yvec' \\* M\" and \"yvec' \\* P\"\n by simp+\n then obtain N Q where Eq: \"inputChain xvec' M P = inputChain yvec' N Q\" using \\length xvec' = n\\\n by(drule_tac Suc) auto\n moreover from \\distinct yvec\\ \\yvec = y#yvec'\\ have \"y \\ yvec'\" by auto\n moreover from \\xvec \\* yvec\\ \\xvec = x#xvec'\\ \\yvec=y#yvec'\\ have \"x \\ y\" and \"x \\ yvec'\"\n by auto\n moreover from \\yvec \\* M\\ \\yvec \\* P\\ \\yvec = y#yvec'\\ have \"y \\ M\" and \"y \\ P\" by auto\n hence \"y \\ inputChain xvec' M P\" by(simp add: inputChainFresh)\n with Eq have \"y \\ inputChain yvec' N Q\" by(simp add: inputChainFresh)\n ultimately have \"\\ x (inputChain xvec' M P) = \\ y (inputChain yvec' ([(x, y)] \\ N) ([(x, y)] \\ Q))\"\n by(simp add: input.inject alpha' eqvts name_swap)\n thus ?case using \\xvec = x#xvec'\\ \\yvec=y#yvec'\\ by force\n qed\n ultimately show ?thesis\n by blast\nqed\n\nlemma inputChainEq:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"inputChain xvec M P = inputChain yvec N Q\"\n and \"xvec \\* yvec\"\n and \"distinct xvec\"\n and \"distinct yvec\"\n\n obtains p where \"(set p) \\ (set xvec) \\ set (p \\ xvec)\" and \"distinctPerm p\" and \"yvec = p \\ xvec\" and \"N = p \\ M\" and \"Q = p \\ P\"\nproof -\n assume \"\\p. \\set p \\ set xvec \\ set (p \\ xvec); distinctPerm p; yvec = p \\ xvec; N = p \\ M; Q = p \\ P\\ \\ thesis\"\n moreover obtain n where \"n = length xvec\" by auto\n with assms have \"\\p. (set p) \\ (set xvec) \\ set (yvec) \\ distinctPerm p \\ yvec = p \\ xvec \\ N = p \\ M \\ Q = p \\ P\"\n proof(induct n arbitrary: xvec yvec M N P Q)\n case(0 xvec yvec M N P Q)\n have Eq: \"inputChain xvec M P = inputChain yvec N Q\" by fact\n from \\0 = length xvec\\ have \"xvec = []\" by auto\n moreover with Eq have \"yvec = []\"\n by(case_tac yvec) auto\n ultimately show ?case using Eq\n by(simp add: input.inject)\n next\n case(Suc n xvec yvec M N P Q)\n from \\Suc n = length xvec\\\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n from \\inputChain xvec M P = inputChain yvec N Q\\ \\xvec = x # xvec'\\\n obtain y yvec' where \"inputChain (x#xvec') M P = inputChain (y#yvec') N Q\"\n and \"yvec = y#yvec'\"\n by(case_tac yvec) auto\n hence EQ: \"\\ x (inputChain xvec' M P) = \\ y (inputChain yvec' N Q)\"\n by simp\n from \\xvec = x#xvec'\\ \\yvec=y#yvec'\\ \\xvec \\* yvec\\\n have \"x \\ y\" and \"xvec' \\* yvec'\" and \"x \\ yvec'\" and \"y \\ xvec'\"\n by(auto simp add: fresh_list_cons)\n from \\distinct xvec\\ \\distinct yvec\\ \\xvec=x#xvec'\\ \\yvec=y#yvec'\\ have \"x \\ xvec'\" and \"y \\ yvec'\" and \"distinct xvec'\" and \"distinct yvec'\"\n by simp+\n have IH: \"\\xvec yvec M N P Q. \\inputChain xvec (M::'a) (P::('a, 'b, 'c) psi) = inputChain yvec (N::'a) (Q::('a, 'b, 'c) psi); xvec \\* yvec; distinct xvec; distinct yvec; n = length xvec\\ \\ \\p. (set p) \\ (set xvec) \\ (set yvec) \\ distinctPerm p \\ yvec = p \\ xvec \\ N = p \\ M \\ Q = p \\ P\"\n by fact\n from EQ \\x \\ y\\ \\x \\ yvec'\\ \\y \\ yvec'\\ have \"inputChain xvec' M P = inputChain yvec' ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n by(simp add: input.inject alpha eqvts)\n with \\xvec' \\* yvec'\\ \\distinct xvec'\\ \\distinct yvec'\\ \\length xvec' = n\\ IH\n obtain p where S: \"(set p) \\ (set xvec') \\ (set yvec')\" and \"distinctPerm p\" and \"yvec' = p \\ xvec'\" and \"([(x, y)] \\ N) = p \\ M\" and \"([(x, y)] \\ Q) = p \\ P\"\n by metis\n from S have \"set((x, y)#p) \\ set(x#xvec') \\ set(y#yvec')\" by auto\n moreover from \\x \\ xvec'\\ \\x \\ yvec'\\ \\y \\ xvec'\\ \\y \\ yvec'\\ S have \"x \\ p\" and \"y \\ p\"\n apply(induct p)\n by(auto simp add: fresh_list_nil fresh_list_cons fresh_prod name_list_supp) (auto simp add: fresh_def) \n\n with S \\distinctPerm p\\ \\x \\ y\\ have \"distinctPerm((x, y)#p)\" by auto\n moreover from \\yvec' = p \\ xvec'\\ \\x \\ p\\ \\y \\ p\\ \\x \\ xvec'\\ \\y \\ xvec'\\ have \"(y#yvec') = ((x, y)#p) \\ (x#xvec')\"\n by(simp add: calc_atm freshChainSimps)\n moreover from \\([(x, y)] \\ N) = p \\ M\\ have \"([(x, y)] \\ [(x, y)] \\ N) = [(x, y)] \\ p \\ M\"\n by(simp add: pt_bij)\n hence \"N = ((x, y)#p) \\ M\" by simp\n moreover from \\([(x, y)] \\ Q) = p \\ P\\ have \"([(x, y)] \\ [(x, y)] \\ Q) = [(x, y)] \\ p \\ P\"\n by(simp add: pt_bij)\n hence \"Q = ((x, y)#p) \\ P\" by simp\n ultimately show ?case using \\xvec=x#xvec'\\ \\yvec=y#yvec'\\\n by blast\n qed\n ultimately show ?thesis by blast\nqed\n\nlemma inputChainEqLength:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"inputChain xvec M P = inputChain yvec N Q\"\n\n shows \"length xvec = length yvec\"\nproof -\n obtain n where \"n = length xvec\" by auto\n with assms show ?thesis\n proof(induct n arbitrary: xvec yvec M P N Q)\n case(0 xvec yvec M P N Q)\n from \\0 = length xvec\\ have \"xvec = []\" by auto\n moreover with \\inputChain xvec M P = inputChain yvec N Q\\ have \"yvec = []\"\n by(case_tac yvec) auto\n ultimately show ?case by simp\n next\n case(Suc n xvec yvec M P N Q)\n from \\Suc n = length xvec\\\n obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n by(case_tac xvec) auto\n from \\inputChain xvec M P = inputChain yvec N Q\\ \\xvec = x # xvec'\\\n obtain y yvec' where \"inputChain (x#xvec') M P = inputChain (y#yvec') N Q\"\n and \"yvec = y#yvec'\"\n by(case_tac yvec) auto\n hence EQ: \"\\ x (inputChain xvec' M P) = \\ y (inputChain yvec' N Q)\"\n by simp\n have IH: \"\\xvec yvec M P N Q. \\inputChain xvec (M::'a) (P::('a, 'b, 'c) psi) = inputChain yvec N Q; n = length xvec\\ \\ length xvec = length yvec\"\n by fact\n show ?case\n proof(case_tac \"x = y\")\n assume \"x = y\"\n with EQ have \"inputChain xvec' M P = inputChain yvec' N Q\"\n by(simp add: alpha input.inject)\n with IH \\length xvec' = n\\ have \"length xvec' = length yvec'\"\n by blast\n with \\xvec = x#xvec'\\ \\yvec=y#yvec'\\\n show ?case by simp\n next\n assume \"x \\ y\"\n with EQ have \"inputChain xvec' M P = inputChain ([(x, y)] \\ yvec') ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n by(simp add: alpha input.inject eqvts)\n with IH \\length xvec' = n\\ have \"length xvec' = length ([(x, y)] \\ yvec')\"\n by blast\n hence \"length xvec' = length yvec'\"\n by simp\n with \\xvec = x#xvec'\\ \\yvec=y#yvec'\\\n show ?case by simp\n qed\n qed\nqed\n\nlemma alphaInputChain:\n fixes yvec :: \"name list\"\n and xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n\n assumes \"length xvec = length yvec\"\n and \"yvec \\* M\"\n and \"yvec \\* P\"\n and \"yvec \\* xvec\"\n and \"distinct yvec\"\n\n shows \"inputChain xvec M P = inputChain yvec ([xvec yvec] \\\\<^sub>v M) ([xvec yvec] \\\\<^sub>v P)\"\nusing assms\nproof(induct rule: composePermInduct)\n case cBase\n show ?case by simp\nnext\n case(cStep x xvec y yvec)\n thus ?case \n apply auto\n by(subst alphaInput[of y]) (auto simp add: inputChainFresh eqvts)\nqed\n\nlemma inputChainInject[simp]:\n\n shows \"(inputChain xvec M P = inputChain xvec N Q) = ((M = N) \\ (P = Q))\"\nby(induct xvec) (auto simp add: input.inject alpha)\n\nlemma alphaInputDistinct:\n fixes xvec :: \"name list\"\n and M :: \"'a::fs_name\"\n and P :: \"('a, 'b::fs_name, 'c::fs_name) psi\"\n and yvec :: \"name list\"\n and N :: 'a\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes Eq: \"inputChain xvec M P = inputChain yvec N Q\"\n and xvecDist: \"distinct xvec\"\n and Mem: \"\\x. x \\ set xvec \\ x \\ supp M\"\n and xvecFreshyvec: \"xvec \\* yvec\"\n and xvecFreshN: \"xvec \\* N\"\n and xvecFreshQ: \"xvec \\* Q\"\n\n shows \"distinct yvec\"\nproof -\n from Eq have \"length xvec = length yvec\"\n by(rule inputChainEqLength)\n with assms show ?thesis\n proof(induct n==\"length xvec\" arbitrary: xvec yvec N Q rule: nat.induct)\n case(zero xvec yvec N Q)\n thus ?case by simp\n next\n case(Suc n xvec yvec N Q)\n have L: \"length xvec = length yvec\" and \"Suc n = length xvec\" by fact+\n then obtain x xvec' y yvec' where xEq: \"xvec = x#xvec'\" and yEq: \"yvec = y#yvec'\"\n and L': \"length xvec' = length yvec'\"\n by(cases xvec, auto, cases yvec, auto)\n have xvecFreshyvec: \"xvec \\* yvec\" and xvecDist: \"distinct xvec\" by fact+\n with xEq yEq have xineqy: \"x \\ y\" and xvec'Freshyvec': \"xvec' \\* yvec'\"\n and xvec'Dist: \"distinct xvec'\" and xFreshxvec': \"x \\ xvec'\"\n and xFreshyvec': \"x \\ yvec'\" and yFreshxvec': \"y \\ xvec'\"\n by(auto simp add: fresh_list_cons)\n have Eq: \"inputChain xvec M P = inputChain yvec N Q\" by fact\n with xEq yEq xineqy have Eq': \"inputChain xvec' M P = inputChain ([(x, y)] \\ yvec') ([(x, y)] \\ N) ([(x, y)] \\ Q)\"\n by(simp add: input.inject alpha eqvts) \n moreover have Mem:\"\\x. x \\ set xvec \\ x \\ supp M\" by fact\n with xEq have \"\\x. x \\ set xvec' \\ x \\ supp M\" by simp\n moreover have xvecFreshN: \"xvec \\* N\" by fact\n with xEq xFreshxvec' yFreshxvec' have \"xvec' \\* ([(x, y)] \\ N)\" by simp\n moreover have xvecFreshQ: \"xvec \\* Q\" by fact\n with xEq xFreshxvec' yFreshxvec' have \"xvec' \\* ([(x, y)] \\ Q)\" by simp\n moreover have \"Suc n = length xvec\" by fact\n with xEq have \"n = length xvec'\" by simp\n moreover from xvec'Freshyvec' xFreshxvec' yFreshxvec' have \"xvec' \\* ([(x, y)] \\ yvec')\"\n by simp\n moreover from L' have \"length xvec' = length([(x, y)] \\ yvec')\" by simp\n ultimately have \"distinct([(x, y)] \\ yvec')\" using xvec'Dist\n by(rule_tac Suc)\n hence \"distinct yvec'\" by simp\n from Mem xEq have xSuppM: \"x \\ supp M\" by simp\n from L xvecFreshyvec xvecDist xvecFreshN xvecFreshQ\n have \"inputChain yvec N Q = inputChain xvec ([yvec xvec] \\\\<^sub>v N) ([yvec xvec] \\\\<^sub>v Q)\"\n by(simp add: alphaInputChain)\n with Eq have \"M = [yvec xvec] \\\\<^sub>v N\" by auto\n with xEq yEq have \"M = [(y, x)] \\ [yvec' xvec'] \\\\<^sub>v N\"\n by simp\n with xSuppM have ySuppN: \"y \\ supp([yvec' xvec'] \\\\<^sub>v N)\"\n by(drule_tac pi=\"[(x, y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\n (simp add: calc_atm eqvts name_swap)\n have \"y \\ yvec'\"\n proof(simp add: fresh_def, rule notI)\n assume \"y \\ supp yvec'\"\n hence \"y mem yvec'\"\n by(induct yvec') (auto simp add: supp_list_nil supp_list_cons supp_atm)\n moreover from xvecFreshN xEq xFreshxvec' have \"xvec' \\* N\" by simp\n ultimately have \"y \\ [yvec' xvec'] \\\\<^sub>v N\" using L' xvec'Freshyvec' xvec'Dist\n by(force intro: freshChainPerm simp add: freshChainSym)\n with ySuppN show \"False\" by(simp add: fresh_def)\n qed\n with \\distinct yvec'\\ yEq show ?case by simp\n qed\nqed\n\nlemma psiCasesInject[simp]:\n fixes CsP :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n shows \"(psiCases CsP = psiCases CsQ) = (CsP = CsQ)\"\nproof(induct CsP arbitrary: CsQ)\n case(Nil CsQ)\n thus ?case by(case_tac CsQ) (auto)\nnext\n case(Cons a CsP CsQ)\n thus ?case\n by(case_tac a, case_tac CsQ) (clarsimp simp add: psiCase.inject)+\nqed\n\nlemma casesInject[simp]:\n fixes CsP :: \"('c::fs_name \\ ('a::fs_name, 'b::fs_name, 'c) psi) list\"\n and CsQ :: \"('c \\ ('a, 'b, 'c) psi) list\"\n\n shows \"(Cases CsP = Cases CsQ) = (CsP = CsQ)\"\napply(induct CsP)\napply(auto simp add: psiCase.inject)\napply(case_tac CsQ)\napply(simp add: psiCase.inject psi.inject)\napply(force simp add: psiCase.inject psi.inject)\napply(case_tac CsQ)\napply(force simp add: psiCase.inject psi.inject)\napply(auto simp add: psiCase.inject psi.inject)\napply(simp only: psiCases.simps[symmetric])\napply(simp only: psiCasesInject)\napply simp\napply(case_tac CsQ)\nby(auto simp add: psiCase.inject psi.inject)\n\nnominal_primrec\n guarded :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ bool\"\n and guarded' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input \\ bool\"\n and guarded'' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psiCase \\ bool\"\n\nwhere\n \"guarded (\\) = True\"\n| \"guarded (M\\N\\.P) = True\"\n| \"guarded (M\\I) = True\"\n| \"guarded (Case C) = guarded'' C\"\n| \"guarded (P \\ Q) = ((guarded P) \\ (guarded Q))\"\n| \"guarded (\\\\x\\P) = (guarded P)\"\n| \"guarded (\\\\\\) = False\"\n| \"guarded (!P) = guarded P\"\n\n| \"guarded' (Trm M P) = False\"\n| \"guarded' (\\ y I) = False\"\n\n| \"guarded'' (\\\\<^sub>c) = True\"\n| \"guarded'' (\\\\ \\ P C) = (guarded P \\ guarded'' C)\"\napply(finite_guess)+\napply(rule TrueI)+\nby(fresh_guess add: fresh_bool)+\n\nlemma guardedEqvt[eqvt]:\n fixes p :: \"name prm\"\n and P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n shows \"(p \\ (guarded P)) = guarded (p \\ P)\"\n and \"(p \\ (guarded' I)) = guarded' (p \\ I)\"\n and \"(p \\ (guarded'' C)) = guarded'' (p \\ C)\"\nby(nominal_induct P and I and C rule: psi_input_psiCase.strong_inducts)\n (simp add: eqvts)+\n\nlemma guardedClosed[simp]:\n fixes P :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi\"\n and p :: \"name prm\"\n\n assumes \"guarded P\"\n\n shows \"guarded(p \\ P)\"\nproof -\n from \\guarded P\\ have \"p \\ (guarded P)\"\n by(simp add: perm_bool)\n thus ?thesis by(simp add: eqvts)\nqed\n\nlocale substPsi =\n substTerm?: substType substTerm +\n substAssert?: substType substAssert +\n substCond?: substType substCond\n\n for substTerm :: \"('a::fs_name) \\ name list \\ 'a::fs_name list \\ 'a\"\n and substAssert :: \"('b::fs_name) \\ name list \\ 'a::fs_name list \\ 'b\"\n and substCond :: \"('c::fs_name) \\ name list \\ 'a::fs_name list \\ 'c\"\nbegin\n\nnominal_primrec \n subs :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psi \\ name list \\ 'a list \\ ('a, 'b, 'c) psi\"\nand subs' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) input \\ name list \\ 'a list \\ ('a, 'b, 'c) input\"\nand subs'' :: \"('a::fs_name, 'b::fs_name, 'c::fs_name) psiCase \\ name list \\ 'a list \\ ('a, 'b, 'c) psiCase\"\n\nwhere\n \"subs (\\) xvec Tvec = \\\"\n| \"(subs (M\\N\\.P) xvec Tvec) = (substTerm M xvec Tvec)\\(substTerm N xvec Tvec)\\.(subs P xvec Tvec)\"\n| \"(subs (M\\I) xvec Tvec) = (substTerm M xvec Tvec)\\(subs' I xvec Tvec)\"\n\n| \"(subs (Case C) xvec Tvec) = (Case (subs'' C xvec Tvec))\"\n| \"(subs (P \\ Q) xvec Tvec) = (subs P xvec Tvec) \\ (subs Q xvec Tvec)\"\n| \"\\y \\ xvec; y \\ Tvec\\ \\ (subs (\\\\y\\P) xvec Tvec) = \\\\y\\(subs P xvec Tvec)\"\n| \"(subs (\\\\\\) xvec Tvec) = \\(substAssert \\ xvec Tvec)\\\"\n| \"(subs (!P) xvec Tvec) = !(subs P xvec Tvec)\"\n\n| \"(subs' ((Trm M P)::('a::fs_name, 'b::fs_name, 'c::fs_name) input) xvec Tvec) = (\\(substTerm M xvec Tvec).(subs P xvec Tvec))\"\n| \"\\y \\ xvec; y \\ Tvec\\ \\ (subs' (\\ y I) xvec Tvec) = (\\ y (subs' I xvec Tvec))\"\n\n| \"(subs'' (\\\\<^sub>c::('a::fs_name, 'b::fs_name, 'c::fs_name) psiCase) xvec Tvec) = \\\\<^sub>c\"\n| \"(subs'' (\\\\ \\ P C) xvec Tvec) = (\\(substCond \\ xvec Tvec) \\ (subs P xvec Tvec) (subs'' C xvec Tvec))\"\napply(finite_guess add: substTerm.fs substAssert.fs substCond.fs)+\napply(rule TrueI)+\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(simp add: abs_fresh)\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\napply(rule supports_fresh[of \"supp(xvec, Tvec)\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\ndone\n\nlemma substEqvt[eqvt]:\n fixes p :: \"name prm\"\n and P :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n shows \"(p \\ (subs P xvec Tvec)) = subs (p \\ P) (p \\ xvec) (p \\ Tvec)\"\n and \"(p \\ (subs' I xvec Tvec)) = subs' (p \\ I) (p \\ xvec) (p \\ Tvec)\"\n and \"(p \\ (subs'' C xvec Tvec)) = subs'' (p \\ C) (p \\ xvec) (p \\ Tvec)\"\napply(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psiCase.strong_inducts)\napply(auto simp add: eqvts)\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply simp\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\nby simp\n\nlemma subst2[intro]:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and x :: name\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n assumes \"x \\ Tvec\"\n and \"x \\ xvec\"\n\n shows \"x \\ P \\ x \\ (subs P xvec Tvec)\"\n and \"x \\ I \\ x \\ (subs' I xvec Tvec)\"\n and \"x \\ C \\ x \\ (subs'' C xvec Tvec)\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psiCase.strong_inducts)\n (auto intro: substTerm.subst2 substCond.subst2 substAssert.subst2 simp add: abs_fresh)\n\nlemma subst2Chain[intro]:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and Xs :: \"name set\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n assumes \"Xs \\* xvec\"\n and \"Xs \\* Tvec\"\n\n shows \"Xs \\* P \\ Xs \\* (subs P xvec Tvec)\"\n and \"Xs \\* I \\ Xs \\* (subs' I xvec Tvec)\"\n and \"Xs \\* C \\ Xs \\* (subs'' C xvec Tvec)\"\nusing assms\nby(auto intro: subst2 simp add: fresh_star_def)\n\nlemma renaming:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and p :: \"name prm\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a ,'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n assumes \"length xvec = length Tvec\"\n and \"set p \\ set xvec \\ set (p \\ xvec)\"\n and \"distinctPerm p\"\n\n shows \"\\(p \\ xvec) \\* P\\ \\ (subs P xvec Tvec) = subs (p \\ P) (p \\ xvec) Tvec\"\n and \"\\(p \\ xvec) \\* I\\ \\ (subs' I xvec Tvec) = subs' (p \\ I) (p \\ xvec) Tvec\"\n and \"\\(p \\ xvec) \\* C\\ \\ (subs'' C xvec Tvec) = subs'' (p \\ C) (p \\ xvec) Tvec\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec p Tvec rule: psi_input_psiCase.strong_inducts)\n (auto intro: substTerm.renaming substCond.renaming substAssert.renaming simp add: freshChainSimps psi.inject input.inject psiCase.inject)\n\nlemma subst4Chain:\n fixes xvec :: \"name list\"\n and Tvec :: \"'a list\"\n and P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n and \"xvec \\* Tvec\"\n\n shows \"xvec \\* (subs P xvec Tvec)\"\n and \"xvec \\* (subs' I xvec Tvec)\"\n and \"xvec \\* (subs'' C xvec Tvec)\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psiCase.strong_inducts)\n (auto intro: substTerm.subst4Chain substCond.subst4Chain substAssert.subst4Chain simp add: abs_fresh)\n\nlemma guardedSubst[simp]:\n fixes P :: \"('a, 'b, 'c) psi\"\n and I :: \"('a, 'b, 'c) input\"\n and C :: \"('a, 'b, 'c) psiCase\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n assumes \"length xvec = length Tvec\"\n and \"distinct xvec\"\n\n shows \"guarded P \\ guarded(subs P xvec Tvec)\"\n and \"guarded' I \\ guarded'(subs' I xvec Tvec)\"\n and \"guarded'' C \\ guarded''(subs'' C xvec Tvec)\"\nusing assms\nby(nominal_induct P and I and C avoiding: xvec Tvec rule: psi_input_psiCase.strong_inducts) auto\n\ndefinition seqSubs :: \"('a, 'b, 'c) psi \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) psi\" (\"_[<_>]\" [80, 80] 130)\n where \"P[<\\>] \\ foldl (\\Q. \\(xvec, Tvec). subs Q xvec Tvec) P \\\"\n\ndefinition seqSubs' :: \"('a, 'b, 'c) input \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) input\" \n where \"seqSubs' I \\ \\ foldl (\\Q. \\(xvec, Tvec). subs' Q xvec Tvec) I \\\"\n\ndefinition seqSubs'' :: \"('a, 'b, 'c) psiCase \\ (name list \\ 'a list) list \\ ('a, 'b, 'c) psiCase\"\n where \"seqSubs'' C \\ \\ foldl (\\Q. \\(xvec, Tvec). subs'' Q xvec Tvec) C \\\"\n\nlemma substInputChain[simp]:\n fixes xvec :: \"name list\"\n and N :: \"'a\"\n and P :: \"('a, 'b, 'c) psi\"\n and yvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n assumes \"xvec \\* yvec\"\n and \"xvec \\* Tvec\"\n\n shows \"subs' (inputChain xvec N P) yvec Tvec = inputChain xvec (substTerm N yvec Tvec) (subs P yvec Tvec)\"\nusing assms\nby(induct xvec) (auto simp add: psi.inject)\n\nfun caseListSubst :: \"('c \\ ('a, 'b, 'c) psi) list \\ name list \\ 'a list \\ ('c \\ ('a, 'b, 'c) psi) list\"\nwhere\n \"caseListSubst [] _ _ = []\"\n| \"caseListSubst ((\\, P)#Cs) xvec Tvec = (substCond \\ xvec Tvec, (subs P xvec Tvec))#(caseListSubst Cs xvec Tvec)\"\n\n\n\n shows \"subs (Cases Cs) xvec Tvec = Cases(caseListSubst Cs xvec Tvec)\"\nby(induct Cs) (auto simp add: psi.inject)\n\nlemma substCases'[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and xvec :: \"name list\"\n and Tvec :: \"'a list\"\n\n shows \"(subs'' (psiCases Cs) xvec Tvec) = psiCases(caseListSubst Cs xvec Tvec)\"\nby(induct Cs) auto\n\nlemma seqSubstSimps[simp]:\n shows \"seqSubs (\\) \\ = \\\"\n and \"(seqSubs (M\\N\\.P) \\) = (substTerm.seqSubst M \\)\\(substTerm.seqSubst N \\)\\.(seqSubs P \\)\"\n and \"(seqSubs (M\\I) \\) = (substTerm.seqSubst M \\)\\(seqSubs' I \\)\"\n\n and \"(seqSubs (Case C) \\) = (Case (seqSubs'' C \\))\"\n and \"(seqSubs (P \\ Q) \\) = (seqSubs P \\) \\ (seqSubs Q \\)\"\n and \"\\y \\ \\\\ \\ (seqSubs (\\\\y\\P) \\) = \\\\y\\(seqSubs P \\)\"\n and \"(seqSubs (\\\\\\) \\) = \\(substAssert.seqSubst \\ \\)\\\"\n and \"(seqSubs (!P) \\) = !(seqSubs P \\)\"\n \n and \"(seqSubs' ((Trm M P)::('a::fs_name, 'b::fs_name, 'c::fs_name) input) \\) = (\\(substTerm.seqSubst M \\).(seqSubs P \\))\"\n and \"\\y \\ \\\\ \\ (seqSubs' (\\ y I) \\) = (\\ y (seqSubs' I \\))\"\n \n and \"(seqSubs'' (\\\\<^sub>c::('a::fs_name, 'b::fs_name, 'c::fs_name) psiCase) \\) = \\\\<^sub>c\"\n and \"(seqSubs'' (\\\\ \\ P C) \\) = (\\(substCond.seqSubst \\ \\) \\ (seqSubs P \\) (seqSubs'' C \\))\"\nby(induct \\ arbitrary: M N P I C Q \\ \\, auto simp add: seqSubs_def seqSubs'_def seqSubs''_def)\n\nlemma seqSubsNil[simp]:\n \"seqSubs P [] = P\"\nby(simp add: seqSubs_def)\n\nlemma seqSubsCons[simp]:\n shows \"seqSubs P ((xvec, Tvec)#\\) = seqSubs(subs P xvec Tvec) \\\"\n by(simp add: seqSubs_def)\n\nlemma seqSubsTermAppend[simp]:\n shows \"seqSubs P (\\@\\') = seqSubs (seqSubs P \\) \\'\"\nby(induct \\) (auto simp add: seqSubs_def)\n\nfun caseListSeqSubst :: \"('c \\ ('a, 'b, 'c) psi) list \\ (name list \\ 'a list) list \\ ('c \\ ('a, 'b, 'c) psi) list\"\nwhere\n \"caseListSeqSubst [] _ = []\"\n| \"caseListSeqSubst ((\\, P)#Cs) \\ = (substCond.seqSubst \\ \\, (seqSubs P \\))#(caseListSeqSubst Cs \\)\"\n\nlemma seqSubstCases[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n shows \"seqSubs (Cases Cs) \\ = Cases(caseListSeqSubst Cs \\)\"\nby(induct Cs) (auto simp add: psi.inject)\n\nlemma seqSubstCases'[simp]:\n fixes Cs :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and \\ :: \"(name list \\ 'a list) list\"\n\n shows \"(seqSubs'' (psiCases Cs) \\) = psiCases(caseListSeqSubst Cs \\)\"\nby(induct Cs) auto\n\nlemma seqSubstEqvt[eqvt]:\n fixes P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"(name list \\ 'a list) list\"\n and p :: \"name prm\"\n\n shows \"(p \\ (P[<\\>])) = (p \\ P)[<(p \\ \\)>]\"\nby(induct \\ arbitrary: P) (auto simp add: eqvts seqSubs_def)\n\nlemma guardedSeqSubst:\n assumes \"guarded P\"\n and \"wellFormedSubst \\\"\n\n shows \"guarded(seqSubs P \\)\"\nusing assms\nby(induct \\ arbitrary: P) (auto dest: guardedSubst)\n\nend\n\nlemma inter_eqvt:\n shows \"(pi::name prm) \\ ((X::name set) \\ Y) = (pi \\ X) \\ (pi \\ Y)\"\nby(auto simp add: perm_set_def perm_bij)\n\nlemma delete_eqvt:\n fixes p :: \"name prm\"\n and X :: \"name set\"\n and Y :: \"name set\"\n\n shows \"p \\ (X - Y) = (p \\ X) - (p \\ Y)\"\nby(auto simp add: perm_set_def perm_bij)\n\nlemma perm_singleton[simp]:\n shows \"(p::name prm) \\ {(x::name)} = {p \\ x}\"\nby(auto simp add: perm_set_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Agent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2513203076179137}} {"text": "(* Title: HOL/Hoare/HeapSyntaxAbort.thy\n Author: Tobias Nipkow\n Copyright 2002 TUM\n*)\n\ntheory HeapSyntaxAbort imports Hoare_Logic_Abort Heap begin\n\nsubsection \"Field access and update\"\n\ntext\\Heap update \\p^.h := e\\ is now guarded against @{term p}\nbeing Null. However, @{term p} may still be illegal,\ne.g. uninitialized or dangling. To guard against that, one needs a\nmore detailed model of the heap where allocated and free addresses are\ndistinguished, e.g. by making the heap a map, or by carrying the set\nof free addresses around. This is needed anyway as soon as we want to\nreason about storage allocation/deallocation.\\\n\nsyntax\n \"_refupdate\" :: \"('a \\ 'b) \\ 'a ref \\ 'b \\ ('a \\ 'b)\"\n (\"_/'((_ \\ _)')\" [1000,0] 900)\n \"_fassign\" :: \"'a ref => id => 'v => 's com\"\n (\"(2_^._ :=/ _)\" [70,1000,65] 61)\n \"_faccess\" :: \"'a ref => ('a ref \\ 'v) => 'v\"\n (\"_^._\" [65,1000] 65)\ntranslations\n \"_refupdate f r v\" == \"f(CONST addr r := v)\"\n \"p^.f := e\" => \"(p \\ CONST Null) \\ (f := _refupdate f p e)\"\n \"p^.f\" => \"f(CONST addr p)\"\n\n\ndeclare fun_upd_apply[simp del] fun_upd_same[simp] fun_upd_other[simp]\n\n\ntext \"An example due to Suzuki:\"\n\nlemma \"VARS v n\n {w = Ref w0 & x = Ref x0 & y = Ref y0 & z = Ref z0 &\n distinct[w0,x0,y0,z0]}\n w^.v := (1::int); w^.n := x;\n x^.v := 2; x^.n := y;\n y^.v := 3; y^.n := z;\n z^.v := 4; x^.n := z\n {w^.n^.n^.v = 4}\"\nby vcg_simp\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Hoare/HeapSyntaxAbort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2513203076179137}} {"text": "(*\n(C) Copyright Andreas Viktor Hess, DTU, 2018-2020\n\nAll Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n- Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n- Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n- Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products\n derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*)\n\n(* Title: Stateful_Strands.thy\n Author: Andreas Viktor Hess, DTU\n*)\n\n\nsection \\Stateful Strands\\\ntheory Stateful_Strands\nimports Strands_and_Constraints\nbegin\n\nsubsection \\Stateful Constraints\\\ndatatype (funs\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p: 'a, vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p: 'b) stateful_strand_step = \n Send (the_msg: \"('a,'b) term\") (\"send\\_\\\" 80)\n| Receive (the_msg: \"('a,'b) term\") (\"receive\\_\\\" 80)\n| Equality (the_check: poscheckvariant) (the_lhs: \"('a,'b) term\") (the_rhs: \"('a,'b) term\")\n (\"\\_: _ \\ _\\\" [80,80])\n| Insert (the_elem_term: \"('a,'b) term\") (the_set_term: \"('a,'b) term\") (\"insert\\_,_\\\" 80)\n| Delete (the_elem_term: \"('a,'b) term\") (the_set_term: \"('a,'b) term\") (\"delete\\_,_\\\" 80)\n| InSet (the_check: poscheckvariant) (the_elem_term: \"('a,'b) term\") (the_set_term: \"('a,'b) term\")\n (\"\\_: _ \\ _\\\" [80,80])\n| NegChecks (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p: \"'b list\")\n (the_eqs: \"(('a,'b) term \\ ('a,'b) term) list\")\n (the_ins: \"(('a,'b) term \\ ('a,'b) term) list\")\n (\"\\_\\\\\\: _ \\\\: _\\\" [80,80])\nwhere\n \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Send _) = []\"\n| \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Receive _) = []\"\n| \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Equality _ _ _) = []\"\n| \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert _ _) = []\"\n| \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete _ _) = []\"\n| \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ _ _) = []\"\n\ntype_synonym ('a,'b) stateful_strand = \"('a,'b) stateful_strand_step list\"\ntype_synonym ('a,'b) dbstatelist = \"(('a,'b) term \\ ('a,'b) term) list\"\ntype_synonym ('a,'b) dbstate = \"(('a,'b) term \\ ('a,'b) term) set\"\n\nabbreviation\n \"is_Assignment x \\ (is_Equality x \\ is_InSet x) \\ the_check x = Assign\"\n\nabbreviation\n \"is_Check x \\ ((is_Equality x \\ is_InSet x) \\ the_check x = Check) \\ is_NegChecks x\"\n\nabbreviation\n \"is_Update x \\ is_Insert x \\ is_Delete x\"\n\nabbreviation InSet_select (\"select\\_,_\\\") where \"select\\t,s\\ \\ InSet Assign t s\"\nabbreviation InSet_check (\"\\_ in _\\\") where \"\\t in s\\ \\ InSet Check t s\"\nabbreviation Equality_assign (\"\\_ := _\\\") where \"\\t := s\\ \\ Equality Assign t s\"\nabbreviation Equality_check (\"\\_ == _\\\") where \"\\t == s\\ \\ Equality Check t s\"\n\nabbreviation NegChecks_Inequality1 (\"\\_ != _\\\") where\n \"\\t != s\\ \\ NegChecks [] [(t,s)] []\"\n\nabbreviation NegChecks_Inequality2 (\"\\_\\_ != _\\\") where\n \"\\x\\t != s\\ \\ NegChecks [x] [(t,s)] []\"\n\nabbreviation NegChecks_Inequality3 (\"\\_,_\\_ != _\\\") where\n \"\\x,y\\t != s\\ \\ NegChecks [x,y] [(t,s)] []\"\n\nabbreviation NegChecks_Inequality4 (\"\\_,_,_\\_ != _\\\") where\n \"\\x,y,z\\t != s\\ \\ NegChecks [x,y,z] [(t,s)] []\"\n\nabbreviation NegChecks_NotInSet1 (\"\\_ not in _\\\") where\n \"\\t not in s\\ \\ NegChecks [] [] [(t,s)]\"\n\nabbreviation NegChecks_NotInSet2 (\"\\_\\_ not in _\\\") where\n \"\\x\\t not in s\\ \\ NegChecks [x] [] [(t,s)]\"\n\nabbreviation NegChecks_NotInSet3 (\"\\_,_\\_ not in _\\\") where\n \"\\x,y\\t not in s\\ \\ NegChecks [x,y] [] [(t,s)]\"\n\nabbreviation NegChecks_NotInSet4 (\"\\_,_,_\\_ not in _\\\") where\n \"\\x,y,z\\t not in s\\ \\ NegChecks [x,y,z] [] [(t,s)]\"\n\nfun trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Send t) = {t}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Receive t) = {t}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Equality _ t t') = {t,t'}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert t t') = {t,t'}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete t t') = {t,t'}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ t t') = {t,t'}\"\n| \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks _ F F') = trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F'\"\n\ndefinition trms\\<^sub>s\\<^sub>s\\<^sub>t where \"trms\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ` set S)\"\ndeclare trms\\<^sub>s\\<^sub>s\\<^sub>t_def[simp]\n\nfun trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Send t) = [t]\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Receive t) = [t]\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Equality _ t t') = [t,t']\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert t t') = [t,t']\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete t t') = [t,t']\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ t t') = [t,t']\"\n| \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks _ F F') = concat (map (\\(t,t'). [t,t']) (F@F'))\"\n\ndefinition trms_list\\<^sub>s\\<^sub>s\\<^sub>t where \"trms_list\\<^sub>s\\<^sub>s\\<^sub>t S \\ remdups (concat (map trms_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\ndefinition ik\\<^sub>s\\<^sub>s\\<^sub>t where \"ik\\<^sub>s\\<^sub>s\\<^sub>t A \\ {t. Receive t \\ set A}\"\n\ndefinition bvars\\<^sub>s\\<^sub>s\\<^sub>t::\"('a,'b) stateful_strand \\ 'b set\" where\n \"bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(set (map (set \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p) S))\"\n\nfun fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p::\"('a,'b) stateful_strand_step \\ 'b set\" where\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Send t) = fv t\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Receive t) = fv t\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Equality _ t t') = fv t \\ fv t'\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert t t') = fv t \\ fv t'\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete t t') = fv t \\ fv t'\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ t t') = fv t \\ fv t'\"\n| \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks X F F') = fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' - set X\"\n\ndefinition fv\\<^sub>s\\<^sub>s\\<^sub>t::\"('a,'b) stateful_strand \\ 'b set\" where\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(set (map fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\nfun fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\) = fv_list t\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\) = fv_list t\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\_: t \\ s\\) = fv_list t@fv_list s\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\) = fv_list t@fv_list s\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\) = fv_list t@fv_list s\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\_: t \\ s\\) = fv_list t@fv_list s\"\n| \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: F'\\) = filter (\\x. x \\ set X) (fv_list\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F@F'))\"\n\ndefinition fv_list\\<^sub>s\\<^sub>s\\<^sub>t where\n \"fv_list\\<^sub>s\\<^sub>s\\<^sub>t S \\ remdups (concat (map fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\ndeclare bvars\\<^sub>s\\<^sub>s\\<^sub>t_def[simp]\ndeclare fv\\<^sub>s\\<^sub>s\\<^sub>t_def[simp]\n\ndefinition vars\\<^sub>s\\<^sub>s\\<^sub>t::\"('a,'b) stateful_strand \\ 'b set\" where\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(set (map vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\nabbreviation wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p::\"('a,'b) stateful_strand_step \\ 'b set\" where\n \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\\n case x of\n NegChecks _ _ _ \\ {}\n | Equality Check _ _ \\ {}\n | InSet Check _ _ \\ {}\n | Delete _ _ \\ {}\n | _ \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x\"\n\ndefinition wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t::\"('a,'b) stateful_strand \\ 'b set\" where\n \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(set (map wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\nabbreviation wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ \n case x of\n Send t \\ fv t\n | Equality Assign s t \\ fv s\n | InSet Assign s t \\ fv s \\ fv t\n | _ \\ {}\"\n\ndefinition wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t where\n \"wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(set (map wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\nfun wf'\\<^sub>s\\<^sub>s\\<^sub>t::\"'b set \\ ('a,'b) stateful_strand \\ bool\" where\n \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V [] = True\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Receive t#S) = (fv t \\ V \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t V S)\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Send t#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Equality Assign t t'#S) = (fv t' \\ V \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S)\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Equality Check _ _#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Insert t s#S) = (fv t \\ V \\ fv s \\ V \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t V S)\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (Delete _ _#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (InSet Assign t s#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv s) S\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (InSet Check _ _#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\n| \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (NegChecks _ _ _#S) = wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\n\nabbreviation \"wf\\<^sub>s\\<^sub>s\\<^sub>t S \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t {} S \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n\nfun subst_apply_stateful_strand_step::\n \"('a,'b) stateful_strand_step \\ ('a,'b) subst \\ ('a,'b) stateful_strand_step\"\n (infix \"\\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p\" 51) where\n \"send\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = send\\t \\ \\\\\"\n| \"receive\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = receive\\t \\ \\\\\"\n| \"\\a: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\a: (t \\ \\) \\ (s \\ \\)\\\"\n| \"\\a: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\a: (t \\ \\) \\ (s \\ \\)\\\"\n| \"insert\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = insert\\t \\ \\, s \\ \\\\\"\n| \"delete\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = delete\\t \\ \\, s \\ \\\\\"\n| \"\\X\\\\\\: F \\\\: G\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\X\\\\\\: (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\\\: (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\\\"\n\ndefinition subst_apply_stateful_strand::\n \"('a,'b) stateful_strand \\ ('a,'b) subst \\ ('a,'b) stateful_strand\"\n (infix \"\\\\<^sub>s\\<^sub>s\\<^sub>t\" 51) where\n \"S \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\ map (\\x. x \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) S\"\n\nfun dbupd\\<^sub>s\\<^sub>s\\<^sub>t::\"('f,'v) stateful_strand \\ ('f,'v) subst \\ ('f,'v) dbstate \\ ('f,'v) dbstate\"\nwhere\n \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t [] I D = D\"\n| \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t (Insert t s#A) I D = dbupd\\<^sub>s\\<^sub>s\\<^sub>t A I (insert ((t,s) \\\\<^sub>p I) D)\"\n| \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) I D = dbupd\\<^sub>s\\<^sub>s\\<^sub>t A I (D - {((t,s) \\\\<^sub>p I)})\"\n| \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t (_#A) I D = dbupd\\<^sub>s\\<^sub>s\\<^sub>t A I D\"\n\nfun db'\\<^sub>s\\<^sub>s\\<^sub>t::\"('f,'v) stateful_strand \\ ('f,'v) subst \\ ('f,'v) dbstatelist \\ ('f,'v) dbstatelist\"\nwhere\n \"db'\\<^sub>s\\<^sub>s\\<^sub>t [] I D = D\"\n| \"db'\\<^sub>s\\<^sub>s\\<^sub>t (Insert t s#A) I D = db'\\<^sub>s\\<^sub>s\\<^sub>t A I (List.insert ((t,s) \\\\<^sub>p I) D)\"\n| \"db'\\<^sub>s\\<^sub>s\\<^sub>t (Delete t s#A) I D = db'\\<^sub>s\\<^sub>s\\<^sub>t A I (List.removeAll ((t,s) \\\\<^sub>p I) D)\"\n| \"db'\\<^sub>s\\<^sub>s\\<^sub>t (_#A) I D = db'\\<^sub>s\\<^sub>s\\<^sub>t A I D\"\n\ndefinition db\\<^sub>s\\<^sub>s\\<^sub>t where\n \"db\\<^sub>s\\<^sub>s\\<^sub>t S I \\ db'\\<^sub>s\\<^sub>s\\<^sub>t S I []\"\n\nfun setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert t s) = {(t,s)}\"\n| \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete t s) = {(t,s)}\"\n| \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ t s) = {(t,s)}\"\n| \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks _ _ F') = set F'\"\n| \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p _ = {}\"\n\ntext \\The set-operations of a stateful strand\\\ndefinition setops\\<^sub>s\\<^sub>s\\<^sub>t where\n \"setops\\<^sub>s\\<^sub>s\\<^sub>t S \\ \\(setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p ` set S)\"\n\nfun setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p where\n \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Insert t s) = [(t,s)]\"\n| \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (Delete t s) = [(t,s)]\"\n| \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (InSet _ t s) = [(t,s)]\"\n| \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (NegChecks _ _ F') = F'\"\n| \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p _ = []\"\n\ntext \\The set-operations of a stateful strand (list variant)\\\ndefinition setops_list\\<^sub>s\\<^sub>s\\<^sub>t where\n \"setops_list\\<^sub>s\\<^sub>s\\<^sub>t S \\ remdups (concat (map setops_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p S))\"\n\n\nsubsection \\Small Lemmata\\\nlemma trms_list\\<^sub>s\\<^sub>s\\<^sub>t_is_trms\\<^sub>s\\<^sub>s\\<^sub>t: \"trms\\<^sub>s\\<^sub>s\\<^sub>t S = set (trms_list\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nunfolding trms\\<^sub>s\\<^sub>t_def trms_list\\<^sub>s\\<^sub>s\\<^sub>t_def\nproof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\nqed simp\n\nlemma setops_list\\<^sub>s\\<^sub>s\\<^sub>t_is_setops\\<^sub>s\\<^sub>s\\<^sub>t: \"setops\\<^sub>s\\<^sub>s\\<^sub>t S = set (setops_list\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nunfolding setops\\<^sub>s\\<^sub>s\\<^sub>t_def setops_list\\<^sub>s\\<^sub>s\\<^sub>t_def\nproof (induction S)\n case (Cons x S) thus ?case by (cases x) auto\nqed simp\n\nlemma fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p: \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a = set (fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a)\"\nproof (cases a)\n case (NegChecks X F G) thus ?thesis\n using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_append[of F G] fv_list\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_append[of F G]\n fv_list\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of \"F@G\"]\n by auto\nqed (simp_all add: fv_list\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s fv_list_is_fv)\n\nlemma fv_list\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t: \"fv\\<^sub>s\\<^sub>s\\<^sub>t S = set (fv_list\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nunfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def fv_list\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) (simp_all add: fv_list\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p)\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite[simp]: \"finite (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x)\"\nby (cases x) auto\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_finite[simp]: \"finite (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nusing trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) auto\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite[simp]: \"finite (vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x)\"\nby (cases x) auto\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_finite[simp]: \"finite (vars\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nusing vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite unfolding vars\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) auto\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite[simp]: \"finite (fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x)\"\nby (cases x) auto\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_finite[simp]: \"finite (fv\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nusing fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) auto\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite[simp]: \"finite (set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x))\"\nby (rule finite_set)\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t_finite[simp]: \"finite (bvars\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nusing bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_finite unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) auto\n\nlemma subst_sst_nil[simp]: \"[] \\\\<^sub>s\\<^sub>s\\<^sub>t \\ = []\"\nby (simp add: subst_apply_stateful_strand_def)\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_nil[simp]: \"db\\<^sub>s\\<^sub>s\\<^sub>t [] \\ = []\"\nby (simp add: db\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma ik\\<^sub>s\\<^sub>s\\<^sub>t_nil[simp]: \"ik\\<^sub>s\\<^sub>s\\<^sub>t [] = {}\"\nby (simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma ik\\<^sub>s\\<^sub>s\\<^sub>t_append[simp]: \"ik\\<^sub>s\\<^sub>s\\<^sub>t (A@B) = ik\\<^sub>s\\<^sub>s\\<^sub>t A \\ ik\\<^sub>s\\<^sub>s\\<^sub>t B\"\n by (auto simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_set_is_dbupd\\<^sub>s\\<^sub>s\\<^sub>t: \"set (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D) = dbupd\\<^sub>s\\<^sub>s\\<^sub>t A I (set D)\" (is \"?A = ?B\")\nproof\n show \"?A \\ ?B\"\n proof\n fix t s show \"(t,s) \\ ?A \\ (t,s) \\ ?B\" by (induct rule: db'\\<^sub>s\\<^sub>s\\<^sub>t.induct) auto\n qed\n\n show \"?B \\ ?A\"\n proof\n fix t s show \"(t,s) \\ ?B \\ (t,s) \\ ?A\" by (induct arbitrary: D rule: dbupd\\<^sub>s\\<^sub>s\\<^sub>t.induct) auto\n qed\nqed\n\nlemma dbupd\\<^sub>s\\<^sub>s\\<^sub>t_no_upd:\n assumes \"\\a \\ set A. \\is_Insert a \\ \\is_Delete a\"\n shows \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t A I D = D\"\nusing assms\nproof (induction A)\n case (Cons a A) thus ?case by (cases a) auto\nqed simp\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_no_upd:\n assumes \"\\a \\ set A. \\is_Insert a \\ \\is_Delete a\"\n shows \"db'\\<^sub>s\\<^sub>s\\<^sub>t A I D = D\"\nusing assms\nproof (induction A)\n case (Cons a A) thus ?case by (cases a) auto\nqed simp\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_no_upd_append:\n assumes \"\\b \\ set B. \\is_Insert b \\ \\is_Delete b\"\n shows \"db'\\<^sub>s\\<^sub>s\\<^sub>t A = db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n using assms\nproof (induction A)\n case Nil thus ?case by (simp add: db\\<^sub>s\\<^sub>s\\<^sub>t_no_upd)\nnext\n case (Cons a A) thus ?case by (cases a) simp_all\nqed\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_append:\n \"db'\\<^sub>s\\<^sub>s\\<^sub>t (A@B) I D = db'\\<^sub>s\\<^sub>s\\<^sub>t B I (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D)\"\nproof (induction A arbitrary: D)\n case (Cons a A) thus ?case by (cases a) auto\nqed simp\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_in_cases:\n assumes \"(t,s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D)\"\n shows \"(t,s) \\ set D \\ (\\t' s'. insert\\t',s'\\ \\ set A \\ t = t' \\ I \\ s = s' \\ I)\"\n using assms\nproof (induction A arbitrary: D)\n case (Cons a A) thus ?case by (cases a) fastforce+\nqed simp\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_in_cases':\n assumes \"(t,s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D)\"\n and \"(t,s) \\ set D\"\n shows \"\\B C t' s'. A = B@insert\\t',s'\\#C \\ t = t' \\ I \\ s = s' \\ I \\\n (\\t'' s''. delete\\t'',s''\\ \\ set C \\ t \\ t'' \\ I \\ s \\ s'' \\ I)\"\n using assms(1)\nproof (induction A rule: List.rev_induct)\n case (snoc a A)\n note * = snoc db\\<^sub>s\\<^sub>s\\<^sub>t_append[of A \"[a]\" I D]\n thus ?case\n proof (cases a)\n case (Insert t' s')\n thus ?thesis using * by (cases \"(t,s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D)\") force+\n next\n case (Delete t' s')\n hence **: \"t \\ t' \\ I \\ s \\ s' \\ I\" using * by simp\n\n have \"(t,s) \\ set (db'\\<^sub>s\\<^sub>s\\<^sub>t A I D)\" using * Delete by force\n then obtain B C u v where B:\n \"A = B@insert\\u,v\\#C\" \"t = u \\ I\" \"s = v \\ I\"\n \"\\t' s'. delete\\t',s'\\ \\ set C \\ t \\ t' \\ I \\ s \\ s' \\ I\"\n using snoc.IH by moura\n\n have \"A@[a] = B@insert\\u,v\\#(C@[a])\"\n \"\\t' s'. delete\\t',s'\\ \\ set (C@[a]) \\ t \\ t' \\ I \\ s \\ s' \\ I\"\n using B(1,4) Delete ** by auto\n thus ?thesis using B(2,3) by blast\n qed force+\nqed (simp add: assms(2))\n\nlemma db\\<^sub>s\\<^sub>s\\<^sub>t_filter:\n \"db'\\<^sub>s\\<^sub>s\\<^sub>t A I D = db'\\<^sub>s\\<^sub>s\\<^sub>t (filter is_Update A) I D\"\nby (induct A I D rule: db'\\<^sub>s\\<^sub>s\\<^sub>t.induct) simp_all\n\nlemma subst_sst_cons: \"a#A \\\\<^sub>s\\<^sub>s\\<^sub>t \\ = (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)#(A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nby (simp add: subst_apply_stateful_strand_def)\n\nlemma subst_sst_snoc: \"A@[a] \\\\<^sub>s\\<^sub>s\\<^sub>t \\ = (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)@[a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\]\"\nby (simp add: subst_apply_stateful_strand_def)\n\nlemma subst_sst_append[simp]: \"A@B \\\\<^sub>s\\<^sub>s\\<^sub>t \\ = (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)@(B \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nby (simp add: subst_apply_stateful_strand_def)\n\nlemma sst_vars_append_subset:\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\" \"bvars\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t B \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\" \"bvars\\<^sub>s\\<^sub>s\\<^sub>t B \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t (A@B)\"\nby auto\n\nlemma sst_vars_disj_cons[simp]: \"fv\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = {} \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A = {}\"\nunfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset[simp]: \"fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (a#A)\"\nby auto\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases[simp]:\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) =\n fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) - set X\"\nby simp_all\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_cases[simp]:\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\) = fv t\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\) = fv t\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\) = fv t \\ fv s\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\) = fv t \\ fv s\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\) = fv t \\ fv s\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\) = fv t \\ fv s\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\) = fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\ set X\" (is ?A)\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: [(t,s)] \\\\: []\\) = fv t \\ fv s \\ set X\" (is ?B)\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: [] \\\\: [(t,s)]\\) = fv t \\ fv s \\ set X\" (is ?C)\nproof\n show ?A ?B ?C by auto\nqed simp_all\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases[simp]:\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = fv (t \\ \\) \\ fv (s \\ \\)\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) =\n fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ set X\" (is ?A)\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: [(t,s)] \\\\: []\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) =\n fv (t \\ rm_vars (set X) \\) \\ fv (s \\ rm_vars (set X) \\) \\ set X\" (is ?B)\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: [] \\\\: [(t,s)]\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) =\n fv (t \\ rm_vars (set X) \\) \\ fv (s \\ rm_vars (set X) \\) \\ set X\" (is ?C)\nproof\n show ?A ?B ?C by auto\nqed simp_all\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t A \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t (a#A)\"\nby auto\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\"\nby (cases a) auto\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t_subst: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = bvars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst[of _ \\]\nby (induct A) (simp_all add: subst_apply_stateful_strand_def)\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_set_cases[simp]:\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\c: t \\ s\\)) = {}\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\)) = set X\"\nby simp_all\n\n\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t_NegChecks: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t A = bvars\\<^sub>s\\<^sub>s\\<^sub>t (filter is_NegChecks A)\" \nproof (induction A)\n case (Cons a A) thus ?case by (cases a) fastforce+\nqed simp\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_append[simp]: \"vars\\<^sub>s\\<^sub>s\\<^sub>t (A@B) = vars\\<^sub>s\\<^sub>s\\<^sub>t A \\ vars\\<^sub>s\\<^sub>s\\<^sub>t B\"\nby (simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_Nil[simp]: \"vars\\<^sub>s\\<^sub>s\\<^sub>t [] = {}\"\nby (simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_Cons: \"vars\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_Cons: \"fv\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A\"\nunfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def by simp\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t_Cons: \"bvars\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nunfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_Cons'[simp]:\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (send\\t\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (send\\t\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (receive\\t\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (receive\\t\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (\\a: t \\ s\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\a: t \\ s\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (insert\\t,s\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,s\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (delete\\t,s\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (delete\\t,s\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (\\a: t \\ s\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\a: t \\ s\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t (\\X\\\\\\: F \\\\: G\\#A) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (simp_all add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p:\n fixes x::\"('a,'b) stateful_strand_step\"\n shows \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x)\"\nproof (cases x)\n case (NegChecks X F G) thus ?thesis by (induct F) force+\nqed simp_all\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>s\\<^sub>t:\n fixes S::\"('a,'b) stateful_strand\"\n shows \"vars\\<^sub>s\\<^sub>s\\<^sub>t S = fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S\"\nproof (induction S)\n case (Cons x S) thus ?case\n using vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p[of x]\n by (auto simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed simp\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_NegCheck[simp]:\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\) = set X \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\nby (simp_all add: sup_commute sup_left_commute vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p)\n\nlemma bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_NegCheck[simp]:\n \"bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\) = X\"\n \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\[]\\\\\\: F \\\\: G\\)) = {}\"\nby simp_all\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_NegCheck[simp]:\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\X\\\\\\: F \\\\: G\\) = fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G - set X\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\[]\\\\\\: F \\\\: G\\) = fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\t != s\\) = fv t \\ fv s\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\t not in s\\) = fv t \\ fv s\"\nby simp_all\n\n\n\n\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p:\n assumes \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\"\n shows \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a)\"\nusing assms var_is_subterm\nproof (cases a)\n case (NegChecks X F F')\n hence \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F' - set X\" using assms by simp\n thus ?thesis using NegChecks var_is_subterm by fastforce\nqed force+\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_is_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A \\ Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t A)\"\nproof (induction A)\n case (Cons a A) thus ?case using fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p by (cases \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A\") auto\nqed simp\n\nlemma var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p:\n assumes \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a)\"\n shows \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\"\nusing assms vars_iff_subtermeq\nproof (cases a)\n case (NegChecks X F F')\n hence \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F')\" using assms by simp\n thus ?thesis using NegChecks vars_iff_subtermeq by force\nqed force+\n\nlemma var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t: \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t A) \\ x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nproof (induction A)\n case (Cons a A)\n show ?case\n proof (cases \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t A)\")\n case True thus ?thesis using Cons.IH by (simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n next\n case False thus ?thesis\n using Cons.prems var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_is_vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p\n by (fastforce simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed\nqed simp\n\nlemma var_trms\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t: \"Var x \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (meson var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t UN_I term.order_refl)\n\nlemma ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset: \"ik\\<^sub>s\\<^sub>s\\<^sub>t A \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (force simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma var_subterm_ik\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t: \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t A) \\ x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\"\nusing var_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t_is_vars\\<^sub>s\\<^sub>s\\<^sub>t ik\\<^sub>s\\<^sub>s\\<^sub>t_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset by fast\n\n\n\n\n\nlemma fv_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset:\n \"fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nproof (induction S)\n case (Cons x S)\n have *: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t (x#S)) = fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t (x#S) = fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\" \"vars\\<^sub>s\\<^sub>s\\<^sub>t (x#S) = vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t S\"\n unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def fv\\<^sub>s\\<^sub>s\\<^sub>t_def vars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n\n { case 1\n show ?case using Cons.IH(1)\n proof (cases x)\n case (NegChecks X F G)\n hence \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\n \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\ set X\"\n by (simp, meson vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_cases(7))\n hence \"fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x\"\n using fv_trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of F] fv_trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of G]\n by auto\n thus ?thesis\n using Cons.IH(1) *(1,3)\n by blast\n qed auto\n }\n\n { case 2\n show ?case using Cons.IH(2)\n proof (cases x)\n case (NegChecks X F G)\n hence \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\n \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x = (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G) - set X\"\n by auto\n hence \"fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x)\"\n using fv_trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of F] fv_trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_is_fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of G]\n by auto\n thus ?thesis\n using Cons.IH(2) *(1,2)\n by blast\n qed auto\n }\nqed simp_all\n\nlemma fv_ik_subset_fv_sst'[simp]: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t S) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\nunfolding ik\\<^sub>s\\<^sub>s\\<^sub>t_def by (induct S) auto\n\nlemma fv_ik_subset_vars_sst'[simp]: \"fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t S) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t S\"\nusing fv_ik_subset_fv_sst' fv_trms\\<^sub>s\\<^sub>s\\<^sub>t_subset by fast\n\nlemma ik\\<^sub>s\\<^sub>s\\<^sub>t_var_is_fv: \"Var x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>s\\<^sub>t A) \\ x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (meson fv_ik_subset_fv_sst'[of A] fv_subset_subterms subsetCE term.set_intros(3))\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases':\n assumes x: \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n shows \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)\"\nusing x vars_term_subst[of _ \\] vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_cases(1,2,3,4,5,6) vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(1,2)[of _ \\]\n vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(3,6)[of _ _ _ \\] vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(4,5)[of _ _ \\]\nproof (cases s)\n case (NegChecks X F G)\n let ?\\' = \"rm_vars (set X) \\\"\n have \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\') \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\') \\ x \\ set X\"\n using vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(7)[of X F G \\] x NegChecks by simp\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (?\\' ` fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (?\\' ` fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G) \\ x \\ set X\"\n using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst[of _ ?\\'] by blast\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G) \\ x \\ set X\"\n using rm_vars_fv\\<^sub>s\\<^sub>e\\<^sub>t_subst by fast\n thus ?thesis\n using NegChecks vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_cases(7)[of X F G]\n by auto\nqed simp_all\n\nlemma vars\\<^sub>s\\<^sub>s\\<^sub>t_subst_cases:\n assumes \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t S \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` vars\\<^sub>s\\<^sub>s\\<^sub>t S)\"\n using assms\nproof (induction S)\n case (Cons s S) thus ?case\n proof (cases \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\")\n case False\n note * = subst_sst_cons[of s S \\] vars\\<^sub>s\\<^sub>s\\<^sub>t_Cons[of \"s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\" \"S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\"] vars\\<^sub>s\\<^sub>s\\<^sub>t_Cons[of s S]\n have **: \"x \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\" using Cons.prems False * by simp\n show ?thesis using vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases'[OF **] * by auto\n qed (auto simp add: vars\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed simp\n\nlemma subset_subst_pairs_diff_exists:\n fixes \\::\"('a,'b) subst\" and D D'::\"('a,'b) dbstate\"\n shows \"\\Di. Di \\ D \\ Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ = (D \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\) - D'\"\nby (metis (no_types, lifting) Diff_subset subset_image_iff)\n\nlemma subset_subst_pairs_diff_exists':\n fixes \\::\"('a,'b) subst\" and D::\"('a,'b) dbstate\"\n assumes \"finite D\"\n shows \"\\Di. Di \\ D \\ Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {d \\\\<^sub>p \\} \\ d \\\\<^sub>p \\ \\ (D - Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms\nproof (induction D rule: finite_induct)\n case (insert d' D)\n then obtain Di where IH: \"Di \\ D\" \"Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {d \\\\<^sub>p \\}\" \"d \\\\<^sub>p \\ \\ (D - Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\" by moura\n show ?case\n proof (cases \"d' \\\\<^sub>p \\ = d \\\\<^sub>p \\\")\n case True\n hence \"insert d' Di \\ insert d' D\" \"insert d' Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {d \\\\<^sub>p \\}\"\n \"d \\\\<^sub>p \\ \\ (insert d' D - insert d' Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\" \n using IH by auto\n thus ?thesis by metis\n next\n case False\n hence \"Di \\ insert d' D\" \"Di \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ \\ {d \\\\<^sub>p \\}\"\n \"d \\\\<^sub>p \\ \\ (insert d' D - Di) \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\" \n using IH by auto\n thus ?thesis by metis\n qed\nqed simp\n\nlemma stateful_strand_step_subst_inI[intro]:\n \"send\\t\\ \\ set A \\ send\\t \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"receive\\t\\ \\ set A \\ receive\\t \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"\\c: t \\ s\\ \\ set A \\ \\c: (t \\ \\) \\ (s \\ \\)\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"insert\\t, s\\ \\ set A \\ insert\\t \\ \\, s \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"delete\\t, s\\ \\ set A \\ delete\\t \\ \\, s \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"\\c: t \\ s\\ \\ set A \\ \\c: (t \\ \\) \\ (s \\ \\)\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"\\X\\\\\\: F \\\\: G\\ \\ set A \n \\ \\X\\\\\\: (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\\\: (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"\\t != s\\ \\ set A \\ \\t \\ \\ != s \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n \"\\t not in s\\ \\ set A \\ \\t \\ \\ not in s \\ \\\\ \\ set (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nproof (induction A)\n case (Cons a A)\n note * = subst_sst_cons[of a A \\]\n { case 1 thus ?case using Cons.IH(1) * by (cases a) auto }\n { case 2 thus ?case using Cons.IH(2) * by (cases a) auto }\n { case 3 thus ?case using Cons.IH(3) * by (cases a) auto }\n { case 4 thus ?case using Cons.IH(4) * by (cases a) auto }\n { case 5 thus ?case using Cons.IH(5) * by (cases a) auto }\n { case 6 thus ?case using Cons.IH(6) * by (cases a) auto }\n { case 7 thus ?case using Cons.IH(7) * by (cases a) auto }\n { case 8 thus ?case using Cons.IH(8) * by (cases a) auto }\n { case 9 thus ?case using Cons.IH(9) * by (cases a) auto }\nqed simp_all\n\nlemma stateful_strand_step_cases_subst:\n \"is_Send a = is_Send (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Receive a = is_Receive (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Equality a = is_Equality (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Insert a = is_Insert (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Delete a = is_Delete (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_InSet a = is_InSet (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_NegChecks a = is_NegChecks (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Assignment a = is_Assignment (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Check a = is_Check (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n \"is_Update a = is_Update (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\nby (cases a; simp_all)+\n\nlemma stateful_strand_step_subst_inv_cases:\n \"send\\t\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t'. t = t' \\ \\ \\ send\\t'\\ \\ set S\"\n \"receive\\t\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t'. t = t' \\ \\ \\ receive\\t'\\ \\ set S\"\n \"\\c: t \\ s\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t' s'. t = t' \\ \\ \\ s = s' \\ \\ \\ \\c: t' \\ s'\\ \\ set S\"\n \"insert\\t,s\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t' s'. t = t' \\ \\ \\ s = s' \\ \\ \\ insert\\t',s'\\ \\ set S\"\n \"delete\\t,s\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t' s'. t = t' \\ \\ \\ s = s' \\ \\ \\ delete\\t',s'\\ \\ set S\"\n \"\\c: t \\ s\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\t' s'. t = t' \\ \\ \\ s = s' \\ \\ \\ \\c: t' \\ s'\\ \\ set S\"\n \"\\X\\\\\\: F \\\\: G\\ \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\n \\F' G'. F = F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\ \\ G = G' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\ \\\n \\X\\\\\\: F' \\\\: G'\\ \\ set S\"\nproof (induction S)\n case (Cons a S)\n have *: \"x \\ set (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n when \"x \\ set (a#S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"x \\ a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\" for x\n using that by (simp add: subst_apply_stateful_strand_def)\n\n { case 1 thus ?case using Cons.IH(1)[OF *] by (cases a) auto }\n { case 2 thus ?case using Cons.IH(2)[OF *] by (cases a) auto }\n { case 3 thus ?case using Cons.IH(3)[OF *] by (cases a) auto }\n { case 4 thus ?case using Cons.IH(4)[OF *] by (cases a) auto }\n { case 5 thus ?case using Cons.IH(5)[OF *] by (cases a) auto }\n { case 6 thus ?case using Cons.IH(6)[OF *] by (cases a) auto }\n { case 7 thus ?case using Cons.IH(7)[OF *] by (cases a) auto }\nqed simp_all\n\nlemma stateful_strand_step_fv_subset_cases:\n \"send\\t\\ \\ set S \\ fv t \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"receive\\t\\ \\ set S \\ fv t \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"\\c: t \\ s\\ \\ set S \\ fv t \\ fv s \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"insert\\t,s\\ \\ set S \\ fv t \\ fv s \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"delete\\t,s\\ \\ set S \\ fv t \\ fv s \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"\\c: t \\ s\\ \\ set S \\ fv t \\ fv s \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\n \"\\X\\\\\\: F \\\\: G\\ \\ set S \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G - set X \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\"\nproof (induction S)\n case (Cons a S)\n { case 1 thus ?case using Cons.IH(1) by auto }\n { case 2 thus ?case using Cons.IH(2) by auto }\n { case 3 thus ?case using Cons.IH(3) by auto }\n { case 4 thus ?case using Cons.IH(4) by auto }\n { case 5 thus ?case using Cons.IH(5) by auto }\n { case 6 thus ?case using Cons.IH(6) by auto }\n { case 7 thus ?case using Cons.IH(7) by fastforce }\nqed simp_all\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_nil[simp]:\n \"trms\\<^sub>s\\<^sub>s\\<^sub>t [] = {}\"\nunfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_mono:\n \"set M \\ set N \\ trms\\<^sub>s\\<^sub>s\\<^sub>t M \\ trms\\<^sub>s\\<^sub>s\\<^sub>t N\"\nby auto\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_in:\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t S\"\n shows \"\\a \\ set S. t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\"\nusing assms unfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_cons: \"trms\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A\"\nunfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_append[simp]: \"trms\\<^sub>s\\<^sub>s\\<^sub>t (A@B) = trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ trms\\<^sub>s\\<^sub>s\\<^sub>t B\"\nunfolding trms\\<^sub>s\\<^sub>s\\<^sub>t_def by force\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst:\n assumes \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) \\ subst_domain \\ = {}\"\n shows \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof (cases a)\n case (NegChecks X F G)\n hence \"rm_vars (set X) \\ = \\\" using assms rm_vars_apply'[of \\ \"set X\"] by auto\n hence \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using NegChecks image_Un by simp_all\n thus ?thesis by (metis trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst)\nqed simp_all\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst':\n assumes \"\\is_NegChecks a\"\n shows \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms by (cases a) simp_all\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst'':\n fixes t::\"('a,'b) term\" and \\::\"('a,'b) subst\"\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (b \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n shows \"\\s \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b. t = s \\ rm_vars (set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b)) \\\"\nproof (cases \"is_NegChecks b\")\n case True\n then obtain X F G where *: \"b = NegChecks X F G\" by (cases b) moura+\n thus ?thesis using assms trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst[of _ \"rm_vars (set X) \\\"] by auto\nnext\n case False\n hence \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (b \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b \\\\<^sub>s\\<^sub>e\\<^sub>t rm_vars (set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b)) \\\"\n using trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst' bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_NegChecks\n by fastforce\n thus ?thesis using assms by fast\nqed\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst''':\n fixes t::\"('a,'b) term\" and \\ \\::\"('a,'b) subst\"\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (b \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n shows \"\\s \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b. t = s \\ rm_vars (set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p b)) \\ \\\\<^sub>s \\\"\nproof -\n obtain s where s: \"s \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (b \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\" \"t = s \\ \\\" using assms by moura\n show ?thesis using trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst''[OF s(1)] s(2) by auto\nqed\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_subst:\n assumes \"bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\"\n shows \"trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms\nproof (induction S)\n case (Cons a S)\n hence IH: \"trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>s\\<^sub>e\\<^sub>t \\\" and *: \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) \\ subst_domain \\ = {}\"\n by auto\n show ?case using trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst[OF *] IH by (auto simp add: subst_apply_stateful_strand_def)\nqed simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_subst_cons:\n \"trms\\<^sub>s\\<^sub>s\\<^sub>t (a#A \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing subst_sst_cons[of a A \\] trms\\<^sub>s\\<^sub>s\\<^sub>t_cons[of a A] trms\\<^sub>s\\<^sub>s\\<^sub>t_append by simp\n\nlemma (in intruder_model) wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\))\"\n using assms\nproof (cases a)\n case (NegChecks X F G)\n hence *: \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) =\n (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)) \\ (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\))\"\n by simp\n\n have \"trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\ = (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\\\<^sub>s\\<^sub>e\\<^sub>t \\) \\ (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n using NegChecks image_Un by simp\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" using * assms by auto\n hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\\\<^sub>s\\<^sub>e\\<^sub>t rm_vars (set X) \\)\"\n \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G \\\\<^sub>s\\<^sub>e\\<^sub>t rm_vars (set X) \\)\"\n using wf_trms_subst_rm_vars[of \\ \"trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\" \"set X\"]\n wf_trms_subst_rm_vars[of \\ \"trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" \"set X\"]\n by fast+\n thus ?thesis\n using * trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst[of _ \"rm_vars (set X) \\\"]\n by auto\nqed auto\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_fv_vars\\<^sub>s\\<^sub>s\\<^sub>t_subset: \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t A \\ fv t \\ vars\\<^sub>s\\<^sub>s\\<^sub>t A\" \nproof (induction A)\n case (Cons a A) thus ?case by (cases a) auto\nqed simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_fv_subst_subset:\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t S\" \"subst_domain \\ \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n shows \"fv (t \\ \\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing assms\nproof (induction S)\n case (Cons s S) show ?case\n proof (cases \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t S\")\n case True\n hence \"fv (t \\ \\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" using Cons.IH Cons.prems by auto\n thus ?thesis using subst_sst_cons[of s S \\] unfolding vars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n next\n case False\n hence *: \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s\" \"subst_domain \\ \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s) = {}\" using Cons.prems by auto\n hence \"fv (t \\ \\) \\ vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n proof (cases s)\n case (NegChecks X F G)\n hence **: \"t \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ t \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" using *(1) by auto\n have ***: \"rm_vars (set X) \\ = \\\" using *(2) NegChecks rm_vars_apply' by auto\n have \"fv (t \\ \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\n using ** *** trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_fv_subst_subset[of t _ \\] by auto\n thus ?thesis using *(2) using NegChecks vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(7)[of X F G \\] by blast\n qed auto\n thus ?thesis using subst_sst_cons[of s S \\] unfolding vars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n qed\nqed simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_fv_subst_subset':\n assumes \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\" \"fv t \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\" \"fv (t \\ \\) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n shows \"fv (t \\ \\) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing assms\nproof (induction S)\n case (Cons s S) show ?case\n proof (cases \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\")\n case True\n hence \"fv (t \\ \\) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" using Cons.IH Cons.prems by auto\n thus ?thesis using subst_sst_cons[of s S \\] unfolding vars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n next\n case False\n hence 0: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)\" \"fv t \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s) = {}\"\n \"fv (t \\ \\) \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s) = {}\"\n using Cons.prems by auto\n\n note 1 = UN_Un UN_insert fv\\<^sub>s\\<^sub>e\\<^sub>t.simps subst_apply_fv_subset subst_apply_fv_unfold\n subst_apply_term_empty sup_bot.comm_neutral fv_subterms_set fv_subset[OF 0(1)]\n\n note 2 = subst_apply_fv_union\n\n have \"fv (t \\ \\) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n proof (cases s)\n case (NegChecks X F G)\n hence 3: \"t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\ t \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G)\" using 0(1) by auto\n have \"t \\ rm_vars (set X) \\ = t \\ \\\" using 0(2) NegChecks rm_vars_ident[of t] by auto\n hence \"fv (t \\ \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\n using 3 trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_fv_subst_subset'[of t _ \"rm_vars (set X) \\\"] by fastforce\n thus ?thesis using 0(2,3) NegChecks fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(7)[of X F G \\] by auto\n qed (metis (no_types, lifting) 1 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(1) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(1),\n metis (no_types, lifting) 1 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(2) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(2),\n metis (no_types, lifting) 1 2 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(3) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(3),\n metis (no_types, lifting) 1 2 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(4) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(4),\n metis (no_types, lifting) 1 2 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(5) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(5),\n metis (no_types, lifting) 1 2 trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps(6) fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases(6))\n thus ?thesis using subst_sst_cons[of s S \\] unfolding fv\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n qed\nqed simp\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_funs_term_cases:\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\" \"f \\ funs_term t\"\n shows \"(\\u \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s. f \\ funs_term u) \\ (\\x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s. f \\ funs_term (\\ x))\"\n using assms\nproof (cases s)\n case (NegChecks X F G)\n hence \"t \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ t \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\n using assms(1) by auto\n hence \"(\\u\\trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F. f \\ funs_term u) \\ (\\x\\fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F. f \\ funs_term (rm_vars (set X) \\ x)) \\\n (\\u\\trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G. f \\ funs_term u) \\ (\\x\\fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G. f \\ funs_term (rm_vars (set X) \\ x))\"\n using trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_funs_term_cases[OF _ assms(2), of _ \"rm_vars (set X) \\\"] by meson\n hence \"(\\u \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G. f \\ funs_term u) \\\n (\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G. f \\ funs_term (rm_vars (set X) \\ x))\"\n by blast\n thus ?thesis\n proof\n assume \"\\x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G. f \\ funs_term (rm_vars (set X) \\ x)\"\n then obtain x where x: \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" \"f \\ funs_term (rm_vars (set X) \\ x)\"\n by auto\n hence \"x \\ set X\" \"rm_vars (set X) \\ x = \\ x\" by auto\n thus ?thesis using x by (auto simp add: assms NegChecks)\n qed (auto simp add: assms NegChecks)\nqed (use assms funs_term_subst[of _ \\] in auto)\n\nlemma trms\\<^sub>s\\<^sub>s\\<^sub>t_funs_term_cases:\n assumes \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"f \\ funs_term t\"\n shows \"(\\u \\ trms\\<^sub>s\\<^sub>s\\<^sub>t S. f \\ funs_term u) \\ (\\x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S. f \\ funs_term (\\ x))\"\nusing assms(1)\nproof (induction S)\n case (Cons s S) thus ?case\n proof (cases \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\")\n case False\n hence \"t \\ trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\" using Cons.prems(1) subst_sst_cons[of s S \\] trms\\<^sub>s\\<^sub>s\\<^sub>t_cons by auto\n thus ?thesis using trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_funs_term_cases[OF _ assms(2)] by fastforce\n qed auto\nqed simp\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_is_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t_subst:\n assumes \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t T\"\n and \"bvars\\<^sub>s\\<^sub>s\\<^sub>t T \\ subst_domain \\ = {}\"\n shows \"\\ x \\ subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t (T \\\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\nusing trms\\<^sub>s\\<^sub>s\\<^sub>t_subst[OF assms(2)] subterms_subst_subset'[of \\ \"trms\\<^sub>s\\<^sub>s\\<^sub>t T\"]\n fv\\<^sub>s\\<^sub>s\\<^sub>t_is_subterm_trms\\<^sub>s\\<^sub>s\\<^sub>t[OF assms(1)]\nby (metis (no_types, lifting) image_iff subset_iff subst_apply_term.simps(1))\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_fv_subset:\n assumes \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\" \"x \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S\" \"fv (\\ x) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n shows \"fv (\\ x) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nusing assms\nproof (induction S)\n case (Cons a S)\n note 1 = fv_subst_subset[of _ _ \\]\n note 2 = subst_apply_fv_union subst_apply_fv_unfold[of _ \\] fv_subset image_eqI\n note 3 = fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst_cases\n note 4 = fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p.simps\n from Cons show ?case\n proof (cases \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\")\n case False\n hence 5: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\" \" fv (\\ x) \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) = {}\" \"x \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a)\"\n using Cons.prems by auto\n hence \"fv (\\ x) \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n proof (cases a)\n case (NegChecks X F G)\n let ?\\ = \"rm_vars (set X) \\\"\n have *: \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" using NegChecks 5(1) by auto\n have **: \"fv (\\ x) \\ set X = {}\" using NegChecks 5(2) by simp\n have ***: \"\\ x = ?\\ x\" using NegChecks 5(3) by auto\n have \"fv (\\ x) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\) \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ?\\)\"\n using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst_fv_subset[of x _ ?\\] * *** by auto\n thus ?thesis using NegChecks ** by auto\n qed (metis (full_types) 1 5(1) 3(1) 4(1), metis (full_types) 1 5(1) 3(2) 4(2),\n metis (full_types) 2 5(1) 3(3) 4(3), metis (full_types) 2 5(1) 3(4) 4(4),\n metis (full_types) 2 5(1) 3(5) 4(5), metis (full_types) 2 5(1) 3(6) 4(6))\n thus ?thesis by (auto simp add: subst_sst_cons[of a S \\])\n qed (auto simp add: subst_sst_cons[of a S \\])\nqed simp\n\nlemma (in intruder_model) wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_trms\\<^sub>s\\<^sub>s\\<^sub>t_subst:\n assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\))\"\n using assms\nproof (induction A)\n case (Cons a A)\n hence IH: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t (A \\\\<^sub>s\\<^sub>s\\<^sub>t \\))\" and *: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\" by auto\n have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\))\" by (rule wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst[OF *])\n thus ?case using IH trms\\<^sub>s\\<^sub>s\\<^sub>t_subst_cons[of a A \\] by blast\nqed simp\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var:\n assumes \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\y \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S. x \\ fv (\\ y)\"\n using assms\nproof (induction S)\n case (Cons s S)\n hence \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ \\y \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S. x \\ fv (\\ y)\"\n using bvars\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset[of S s]\n by blast\n thus ?case\n proof (cases \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\")\n case False\n hence *: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n using Cons.prems(1) subst_sst_cons[of s S \\]\n by fastforce\n\n have \"\\y \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s. x \\ fv (\\ y)\"\n proof (cases s)\n case (NegChecks X F G)\n hence \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\)\"\n and **: \"x \\ set X\"\n using * by simp_all\n then obtain y where y: \"y \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ y \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" \"x \\ fv ((rm_vars (set X) \\) y)\"\n using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst_obtain_var[of _ _ \"rm_vars (set X) \\\"]\n by blast\n have \"y \\ set X\"\n proof\n assume y_in: \"y \\ set X\"\n hence \"(rm_vars (set X) \\) y = Var y\" by auto\n hence \"x = y\" using y(2) by simp\n thus False using ** y_in by metis\n qed\n thus ?thesis using NegChecks y by auto\n qed (use * fv_subst_obtain_var in force)+\n thus ?thesis by auto\n qed auto\nqed simp\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_subset_range_vars_if_subset_domain:\n assumes \"fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\\"\n shows \"fv\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ range_vars \\\"\nusing assms fv\\<^sub>s\\<^sub>s\\<^sub>t_subst_obtain_var[of _ S \\] subst_dom_vars_in_subst[of _ \\] subst_fv_imgI[of \\]\nby (metis (no_types) in_mono subsetI)\n\nlemma fv\\<^sub>s\\<^sub>s\\<^sub>t_in_fv_trms\\<^sub>s\\<^sub>s\\<^sub>t: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S \\ x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t S)\"\nproof (induction S)\n case (Cons s S) thus ?case\n proof (cases \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t S\")\n case False\n hence *: \"x \\ fv\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s\" using Cons.prems by simp\n hence \"x \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s)\"\n proof (cases s)\n case (NegChecks X F G)\n hence \"x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\ x \\ fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\" using * by simp_all\n thus ?thesis using * fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_in_fv_trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s[of x] NegChecks by auto\n qed auto\n thus ?thesis by simp\n qed simp\nqed simp\n\nlemma stateful_strand_step_subst_comp:\n assumes \"range_vars \\ \\ set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x) = {}\"\n shows \"x \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ = (x \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\"\nproof (cases x)\n case (NegChecks X F G)\n hence *: \"range_vars \\ \\ set X = {}\" using assms by simp\n have \"H \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) (\\ \\\\<^sub>s \\) = (H \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\) \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\\" for H\n using pairs_subst_comp rm_vars_comp[OF *] by (induct H) (auto simp add: subst_apply_pairs_def)\n thus ?thesis using NegChecks by simp\nqed simp_all\n\nlemma stateful_strand_subst_comp:\n assumes \"range_vars \\ \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n shows \"S \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ = (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>s\\<^sub>t \\\"\nusing assms\nproof (induction S)\n case (Cons s S)\n hence IH: \"S \\\\<^sub>s\\<^sub>s\\<^sub>t \\ \\\\<^sub>s \\ = (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\\\<^sub>s\\<^sub>s\\<^sub>t \\\" using Cons by auto\n\n have \"s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ \\\\<^sub>s \\ = (s \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\"\n using Cons.prems stateful_strand_step_subst_comp[of \\ s \\]\n unfolding range_vars_alt_def by auto\n thus ?case using IH by (simp add: subst_apply_stateful_strand_def)\nqed simp\n\nlemma subst_apply_bvars_disj_NegChecks:\n assumes \"set X \\ subst_domain \\ = {}\"\n shows \"NegChecks X F G \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = NegChecks X (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\nproof -\n have \"rm_vars (set X) \\ = \\\" using assms rm_vars_apply'[of \\ \"set X\"] by auto\n thus ?thesis by simp\nqed\n\nlemma subst_apply_NegChecks_no_bvars[simp]:\n \"\\[]\\\\\\: F \\\\: F'\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\[]\\\\\\: (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\\\: (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\\\"\n \"\\[]\\\\\\: [] \\\\: F'\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\[]\\\\\\: [] \\\\: (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\\\"\n \"\\[]\\\\\\: F \\\\: []\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\[]\\\\\\: (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) \\\\: []\\\"\n \"\\[]\\\\\\: [] \\\\: [(t,s)]\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\[]\\\\\\: [] \\\\: ([(t \\ \\,s \\ \\)])\\\" (is ?A)\n \"\\[]\\\\\\: [(t,s)] \\\\: []\\ \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\ = \\[]\\\\\\: ([(t \\ \\,s \\ \\)]) \\\\: []\\\" (is ?B)\nby simp_all\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_mono:\n \"set M \\ set N \\ setops\\<^sub>s\\<^sub>s\\<^sub>t M \\ setops\\<^sub>s\\<^sub>s\\<^sub>t N\"\nby (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_nil[simp]: \"setops\\<^sub>s\\<^sub>s\\<^sub>t [] = {}\"\nby (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_cons[simp]: \"setops\\<^sub>s\\<^sub>s\\<^sub>t (a#A) = setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\ setops\\<^sub>s\\<^sub>s\\<^sub>t A\"\nby (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_cons_subset[simp]: \"setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ setops\\<^sub>s\\<^sub>s\\<^sub>t (a#A)\"\nusing setops\\<^sub>s\\<^sub>s\\<^sub>t_cons[of a A] by blast\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_append: \"setops\\<^sub>s\\<^sub>s\\<^sub>t (A@B) = setops\\<^sub>s\\<^sub>s\\<^sub>t A \\ setops\\<^sub>s\\<^sub>s\\<^sub>t B\"\nproof (induction A)\n case (Cons a A) thus ?case by (cases a) (auto simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_member_iff:\n \"(t,s) \\ setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p x \\\n (x = Insert t s \\ x = Delete t s \\ (\\ac. x = InSet ac t s) \\\n (\\X F F'. x = NegChecks X F F' \\ (t,s) \\ set F'))\"\nby (cases x) auto\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_member_iff:\n \"(t,s) \\ setops\\<^sub>s\\<^sub>s\\<^sub>t A \\\n (Insert t s \\ set A \\ Delete t s \\ set A \\ (\\ac. InSet ac t s \\ set A) \\\n (\\X F F'. NegChecks X F F' \\ set A \\ (t,s) \\ set F'))\"\n (is \"?P \\ ?Q\")\nproof (induction A)\n case (Cons a A) thus ?case\n proof (cases \"(t, s) \\ setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a\")\n case True thus ?thesis using setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_member_iff[of t s a] by auto\n qed auto\nqed simp\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst:\n assumes \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) \\ subst_domain \\ = {}\"\n shows \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nproof (cases a)\n case (NegChecks X F G)\n hence \"rm_vars (set X) \\ = \\\" using assms rm_vars_apply'[of \\ \"set X\"] by auto\n hence \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = set (G \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\ = set G \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using NegChecks image_Un by simp_all\n thus ?thesis by (simp add: subst_apply_pairs_def) \nqed simp_all\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst':\n assumes \"\\is_NegChecks a\"\n shows \"setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\) = setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms by (cases a) auto\n\n\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_subst:\n assumes \"bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\"\n shows \"setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\nusing assms\nproof (induction S)\n case (Cons a S)\n have \"bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ subst_domain \\ = {}\" and *: \"set (bvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p a) \\ subst_domain \\ = {}\"\n using Cons.prems by auto\n hence IH: \"setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) = setops\\<^sub>s\\<^sub>s\\<^sub>t S \\\\<^sub>p\\<^sub>s\\<^sub>e\\<^sub>t \\\"\n using Cons.IH by auto\n show ?case\n using setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst[OF *] IH unfolding setops\\<^sub>s\\<^sub>s\\<^sub>t_def\n by (auto simp add: subst_apply_stateful_strand_def)\nqed (simp add: setops\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma setops\\<^sub>s\\<^sub>s\\<^sub>t_subst':\n fixes p::\"('a,'b) term \\ ('a,'b) term\" and \\::\"('a,'b) subst\"\n assumes \"p \\ setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n shows \"\\s \\ setops\\<^sub>s\\<^sub>s\\<^sub>t S. \\X. set X \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ p = s \\\\<^sub>p rm_vars (set X) \\\"\nusing assms\nproof (induction S)\n case (Cons a S)\n note 0 = setops\\<^sub>s\\<^sub>s\\<^sub>t_cons[of a S] bvars\\<^sub>s\\<^sub>s\\<^sub>t_Cons[of a S]\n note 1 = setops\\<^sub>s\\<^sub>s\\<^sub>t_cons[of \"a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\\" \"S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\"] subst_sst_cons[of a S \\]\n have \"p \\ setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\) \\ p \\ setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\" using Cons.prems 1 by auto\n thus ?case\n proof\n assume *: \"p \\ setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (a \\\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p \\)\"\n show ?thesis using setops\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p_subst''[OF *] 0 by blast\n next\n assume *: \"p \\ setops\\<^sub>s\\<^sub>s\\<^sub>t (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n show ?thesis using Cons.IH[OF *] 0 by blast\n qed\nqed simp\n\n\nsubsection \\Stateful Constraint Semantics\\\ncontext intruder_model\nbegin\n\ndefinition negchecks_model where\n \"negchecks_model (\\::('a,'b) subst) (D::('a,'b) dbstate) X F G \\\n (\\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ \n (list_ex (\\f. fst f \\ (\\ \\\\<^sub>s \\) \\ snd f \\ (\\ \\\\<^sub>s \\)) F \\\n list_ex (\\f. f \\\\<^sub>p (\\ \\\\<^sub>s \\) \\ D) G))\"\n\nfun strand_sem_stateful::\n \"('fun,'var) terms \\ ('fun,'var) dbstate \\ ('fun,'var) stateful_strand \\ ('fun,'var) subst \\ bool\"\n (\"\\_; _; _\\\\<^sub>s\")\nwhere\n \"\\M; D; []\\\\<^sub>s = (\\\\. True)\"\n| \"\\M; D; Send t#S\\\\<^sub>s = (\\\\. M \\ t \\ \\ \\ \\M; D; S\\\\<^sub>s \\)\"\n| \"\\M; D; Receive t#S\\\\<^sub>s = (\\\\. \\insert (t \\ \\) M; D; S\\\\<^sub>s \\)\"\n| \"\\M; D; Equality _ t t'#S\\\\<^sub>s = (\\\\. t \\ \\ = t' \\ \\ \\ \\M; D; S\\\\<^sub>s \\)\"\n| \"\\M; D; Insert t s#S\\\\<^sub>s = (\\\\. \\M; insert ((t,s) \\\\<^sub>p \\) D; S\\\\<^sub>s \\)\"\n| \"\\M; D; Delete t s#S\\\\<^sub>s = (\\\\. \\M; D - {(t,s) \\\\<^sub>p \\}; S\\\\<^sub>s \\)\"\n| \"\\M; D; InSet _ t s#S\\\\<^sub>s = (\\\\. (t,s) \\\\<^sub>p \\ \\ D \\ \\M; D; S\\\\<^sub>s \\)\"\n| \"\\M; D; NegChecks X F F'#S\\\\<^sub>s = (\\\\. negchecks_model \\ D X F F' \\ \\M; D; S\\\\<^sub>s \\)\"\n\n\nlemmas strand_sem_stateful_induct =\n strand_sem_stateful.induct[case_names Nil ConsSnd ConsRcv ConsEq\n ConsIns ConsDel ConsIn ConsNegChecks]\n\nabbreviation constr_sem_stateful (infix \"\\\\<^sub>s\" 91) where \"\\ \\\\<^sub>s A \\ \\{}; {}; A\\\\<^sub>s \\\"\n\nlemma stateful_strand_sem_NegChecks_no_bvars:\n \"\\M; D; [\\t not in s\\]\\\\<^sub>s \\ \\ (t \\ \\, s \\ \\) \\ D\"\n \"\\M; D; [\\t != s\\]\\\\<^sub>s \\ \\ t \\ \\ \\ s \\ \\\"\nby (simp_all add: negchecks_model_def empty_dom_iff_empty_subst)\n\nlemma strand_sem_ik_mono_stateful:\n \"\\M; D; A\\\\<^sub>s \\ \\ \\M \\ M'; D; A\\\\<^sub>s \\\"\nusing ideduct_mono by (induct A arbitrary: M M' D rule: strand_sem_stateful.induct) force+\n\nlemma strand_sem_append_stateful:\n \"\\M; D; A@B\\\\<^sub>s \\ \\ \\M; D; A\\\\<^sub>s \\ \\ \\M \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\); dbupd\\<^sub>s\\<^sub>s\\<^sub>t A \\ D; B\\\\<^sub>s \\\"\n (is \"?P \\ ?Q \\ ?R\")\nproof -\n have 1: \"?P \\ ?Q\" by (induct A rule: strand_sem_stateful.induct) auto\n\n have 2: \"?P \\ ?R\"\n proof (induction A arbitrary: M D B)\n case (Cons a A) thus ?case\n proof (cases a)\n case (Receive t)\n have \"insert (t \\ \\) (M \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\)) = M \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t A \\ D = dbupd\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\ D\"\n using Receive by (auto simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis using Cons Receive by force\n qed (auto simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed (simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n have 3: \"?Q \\ ?R \\ ?P\"\n proof (induction A arbitrary: M D)\n case (Cons a A) thus ?case\n proof (cases a)\n case (Receive t)\n have \"insert (t \\ \\) (M \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t A \\\\<^sub>s\\<^sub>e\\<^sub>t \\)) = M \\ (ik\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\\\<^sub>s\\<^sub>e\\<^sub>t \\)\"\n \"dbupd\\<^sub>s\\<^sub>s\\<^sub>t A \\ D = dbupd\\<^sub>s\\<^sub>s\\<^sub>t (a#A) \\ D\"\n using Receive by (auto simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n thus ?thesis using Cons Receive by simp\n qed (auto simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n qed (simp add: ik\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\n show ?thesis by (metis 1 2 3)\nqed\n\nlemma negchecks_model_db_subset:\n fixes F F'::\"(('a,'b) term \\ ('a,'b) term) list\"\n assumes \"D' \\ D\"\n and \"negchecks_model \\ D X F F'\"\n shows \"negchecks_model \\ D' X F F'\"\nproof -\n have \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D') F'\"\n when \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D) F'\"\n for \\::\"('a,'b) subst\"\n using Bex_set[of F' \"\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D'\"]\n Bex_set[of F' \"\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D\"]\n that assms(1)\n by blast\n thus ?thesis using assms(2) by (auto simp add: negchecks_model_def)\nqed\n\nlemma negchecks_model_db_supset:\n fixes F F'::\"(('a,'b) term \\ ('a,'b) term) list\"\n assumes \"D' \\ D\"\n and \"\\f \\ set F'. \\\\. subst_domain \\ = set X \\ ground (subst_range \\) \\ f \\\\<^sub>p (\\ \\\\<^sub>s \\) \\ D - D'\"\n and \"negchecks_model \\ D' X F F'\"\n shows \"negchecks_model \\ D X F F'\"\nproof -\n have \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D) F'\"\n when \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D') F'\" \"subst_domain \\ = set X \\ ground (subst_range \\)\"\n for \\::\"('a,'b) subst\"\n using Bex_set[of F' \"\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D'\"]\n Bex_set[of F' \"\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D\"]\n that assms(1,2)\n by blast\n thus ?thesis using assms(3) by (auto simp add: negchecks_model_def)\nqed\n\nlemma negchecks_model_subst:\n fixes F F'::\"(('a,'b) term \\ ('a,'b) term) list\"\n assumes \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n shows \"negchecks_model (\\ \\\\<^sub>s \\) D X F F' \\ negchecks_model \\ D X (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\nproof -\n have 0: \"\\ \\\\<^sub>s (\\ \\\\<^sub>s \\) = \\ \\\\<^sub>s (\\ \\\\<^sub>s \\)\"\n when \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\" for \\\n by (metis (no_types, lifting) \\ subst_compose_assoc assms(1) inf_sup_aci(1)\n subst_comp_eq_if_disjoint_vars sup_inf_absorb range_vars_alt_def)\n\n { fix \\::\"('a,'b) subst\" and t t'\n assume \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n and *: \"list_ex (\\f. fst f \\ (\\ \\\\<^sub>s (\\ \\\\<^sub>s \\)) \\ snd f \\ (\\ \\\\<^sub>s (\\ \\\\<^sub>s \\))) F\"\n obtain f where f: \"f \\ set F\" \"fst f \\ \\ \\\\<^sub>s (\\ \\\\<^sub>s \\) \\ snd f \\ \\ \\\\<^sub>s (\\ \\\\<^sub>s \\)\"\n using * by (induct F) auto\n hence \"(fst f \\ \\) \\ \\ \\\\<^sub>s \\ \\ (snd f \\ \\) \\ \\ \\\\<^sub>s \\\" using 0[OF \\] by simp\n moreover have \"(fst f \\ \\, snd f \\ \\) \\ set (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using f(1) by (auto simp add: subst_apply_pairs_def)\n ultimately have \"list_ex (\\f. fst f \\ (\\ \\\\<^sub>s \\) \\ snd f \\ (\\ \\\\<^sub>s \\)) (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using f(1) Bex_set by fastforce\n } moreover {\n fix \\::\"('a,'b) subst\" and t t'\n assume \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n and *: \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s (\\ \\\\<^sub>s \\) \\ D) F'\"\n obtain f where f: \"f \\ set F'\" \"f \\\\<^sub>p \\ \\\\<^sub>s (\\ \\\\<^sub>s \\) \\ D\"\n using * by (induct F') auto\n hence \"f \\\\<^sub>p \\ \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D\" using 0[OF \\] by (metis subst_pair_compose)\n moreover have \"f \\\\<^sub>p \\ \\ set (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using f(1) by (auto simp add: subst_apply_pairs_def)\n ultimately have \"list_ex (\\f. f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D) (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using f(1) Bex_set by fastforce\n } moreover {\n fix \\::\"('a,'b) subst\" and t t'\n assume \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n and *: \"list_ex (\\f. fst f \\ (\\ \\\\<^sub>s \\) \\ snd f \\ (\\ \\\\<^sub>s \\)) (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n obtain f where f: \"f \\ set (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\" \"fst f \\ \\ \\\\<^sub>s \\ \\ snd f \\ \\ \\\\<^sub>s \\\"\n using * by (induct F) (auto simp add: subst_apply_pairs_def)\n then obtain g where g: \"g \\ set F\" \"f = g \\\\<^sub>p \\\" by (auto simp add: subst_apply_pairs_def)\n have \"fst g \\ \\ \\\\<^sub>s (\\ \\\\<^sub>s \\) \\ snd g \\ \\ \\\\<^sub>s (\\ \\\\<^sub>s \\)\"\n using f(2) g 0[OF \\] by (simp add: prod.case_eq_if)\n hence \"list_ex (\\f. fst f \\ (\\ \\\\<^sub>s (\\ \\\\<^sub>s \\)) \\ snd f \\ (\\ \\\\<^sub>s (\\ \\\\<^sub>s \\))) F\"\n using g Bex_set by fastforce\n } moreover {\n fix \\::\"('a,'b) subst\" and t t'\n assume \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n and *: \"list_ex (\\f. f \\\\<^sub>p (\\ \\\\<^sub>s \\) \\ D) (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n obtain f where f: \"f \\ set (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\" \"f \\\\<^sub>p \\ \\\\<^sub>s \\ \\ D\"\n using * by (induct F') (auto simp add: subst_apply_pairs_def)\n then obtain g where g: \"g \\ set F'\" \"f = g \\\\<^sub>p \\\" by (auto simp add: subst_apply_pairs_def)\n have \"g \\\\<^sub>p \\ \\\\<^sub>s (\\ \\\\<^sub>s \\) \\ D\"\n using f(2) g 0[OF \\] by (simp add: prod.case_eq_if)\n hence \"list_ex (\\f. f \\\\<^sub>p (\\ \\\\<^sub>s (\\ \\\\<^sub>s \\)) \\ D) F'\"\n using g Bex_set by fastforce\n } ultimately show ?thesis using assms unfolding negchecks_model_def by blast\nqed\n\nlemma strand_sem_subst_stateful:\n fixes \\::\"('fun,'var) subst\"\n assumes \"(subst_domain \\ \\ range_vars \\) \\ bvars\\<^sub>s\\<^sub>s\\<^sub>t S = {}\"\n shows \"\\M; D; S\\\\<^sub>s (\\ \\\\<^sub>s \\) \\ \\M; D; S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\\\\<^sub>s \\\"\nproof\n note [simp] = subst_sst_cons[of _ _ \\] subst_subst_compose[of _ \\ \\]\n\n have \"(subst_domain \\ \\ range_vars \\) \\ (subst_domain \\ \\ range_vars \\) = {}\"\n when \\: \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n and \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n for X and \\::\"('fun,'var) subst\"\n using \\ \\ unfolding range_vars_alt_def by auto\n hence 0: \"\\ \\\\<^sub>s \\ = \\ \\\\<^sub>s \\\"\n when \\: \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n and \\: \"subst_domain \\ = set X\" \"ground (subst_range \\)\"\n for \\ X\n by (metis \\ \\ subst_comp_eq_if_disjoint_vars)\n\n show \"\\M; D; S\\\\<^sub>s (\\ \\\\<^sub>s \\) \\ \\M; D; S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\\\\<^sub>s \\\" using assms\n proof (induction S arbitrary: M D rule: strand_sem_stateful_induct)\n case (ConsNegChecks M D X F F' S)\n hence *: \"\\M; D; S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\\\\<^sub>s \\\" and **: \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def negchecks_model_def by (force, auto)\n have \"negchecks_model (\\ \\\\<^sub>s \\) D X F F'\" using ConsNegChecks by auto\n hence \"negchecks_model \\ D X (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using 0[OF **] negchecks_model_subst[OF **] by blast\n moreover have \"rm_vars (set X) \\ = \\\" using ConsNegChecks.prems(2) by force\n ultimately show ?case using * by auto\n qed simp_all\n\n show \"\\M; D; S \\\\<^sub>s\\<^sub>s\\<^sub>t \\\\\\<^sub>s \\ \\ \\M; D; S\\\\<^sub>s (\\ \\\\<^sub>s \\)\" using assms\n proof (induction S arbitrary: M D rule: strand_sem_stateful_induct)\n case (ConsNegChecks M D X F F' S)\n have \\: \"rm_vars (set X) \\ = \\\" using ConsNegChecks.prems(2) by force\n hence *: \"\\M; D; S\\\\<^sub>s (\\ \\\\<^sub>s \\)\" and **: \"(subst_domain \\ \\ range_vars \\) \\ set X = {}\"\n using ConsNegChecks unfolding bvars\\<^sub>s\\<^sub>s\\<^sub>t_def negchecks_model_def by auto\n have \"negchecks_model \\ D X (F \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\) (F' \\\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\)\"\n using ConsNegChecks.prems(1) \\ by (auto simp add: subst_compose_assoc negchecks_model_def)\n hence \"negchecks_model (\\ \\\\<^sub>s \\) D X F F'\"\n using 0[OF **] negchecks_model_subst[OF **] by blast\n thus ?case using * by auto\n qed simp_all\nqed\n\nend\n\n\nsubsection \\Well-Formedness Lemmata\\\nlemma wfvarsocc\\<^sub>s\\<^sub>s\\<^sub>t_subset_wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t[simp]:\n \"wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S\"\nby (induction S)\n (auto simp add: wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def\n split: stateful_strand_step.split poscheckvariant.split)\n\nlemma wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_append: \"wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t (S@S') = wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S'\"\nby (simp add: wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_union[simp]:\n \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t (S@T) = wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t T\"\nby (simp add: wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_singleton:\n \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t [s] = wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p s\"\nby (simp add: wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_prefix[dest]: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (S@S') \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\nby (induct S rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct) auto\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ W) S\"\nproof (induction S arbitrary: V)\n case (Cons x S) thus ?case\n proof (cases x)\n case (Send t)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ W) S\" using Cons.prems(1) Cons.IH by simp\n thus ?thesis using Send by (simp add: sup_commute sup_left_commute)\n next\n case (Equality a t t')\n show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ W) S\" \"fv t' \\ V \\ W\" using Equality Cons.prems(1) Cons.IH by auto\n thus ?thesis using Equality Assign by (simp add: sup_commute sup_left_commute)\n next\n case Check thus ?thesis using Equality Cons by auto\n qed\n next\n case (InSet a t t')\n show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv t' \\ W) S\" using InSet Cons.prems(1) Cons.IH by auto\n thus ?thesis using InSet Assign by (simp add: sup_commute sup_left_commute)\n next\n case Check thus ?thesis using InSet Cons by auto\n qed\n qed auto\nqed simp\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>tI[intro]: \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ V \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\nproof (induction S)\n case (Cons x S) thus ?case\n proof (cases x)\n case (Send t)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" \"V \\ fv t = V\"\n using Cons\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n thus ?thesis using Send by simp\n next\n case (Equality a t t')\n show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" \"fv t' \\ V\"\n using Equality Cons \n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n thus ?thesis using wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono Equality Assign by simp\n next\n case Check\n thus ?thesis\n using Equality Cons\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n qed\n next\n case (InSet a t t')\n show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" \"fv t \\ fv t' \\ V\"\n using InSet Cons\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n thus ?thesis using wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono InSet Assign by (simp add: Un_assoc) \n next\n case Check\n thus ?thesis\n using InSet Cons\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def\n by auto\n qed\n qed (simp_all add: wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed (simp add: wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>tI'[intro]:\n assumes \"\\((\\x. case x of\n Receive t \\ fv t\n | Equality Assign _ t' \\ fv t'\n | Insert t t' \\ fv t \\ fv t'\n | _ \\ {}) ` set S) \\ V\"\n shows \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\nusing assms\nproof (induction S)\n case (Cons x S) thus ?case\n proof (cases x)\n case (Equality a t t')\n thus ?thesis using Cons by (cases a) (auto simp add: wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono)\n next\n case (InSet a t t')\n thus ?thesis using Cons by (cases a) (auto simp add: wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono Un_assoc)\n qed (simp_all add: wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono)\nqed simp\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_append_exec: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (S@S') \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\"\nproof (induction S arbitrary: V)\n case (Cons x S V) thus ?case\n proof (cases x)\n case (Send t)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\" using Cons.prems Cons.IH by simp\n thus ?thesis using Send unfolding wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def by (auto simp add: sup_assoc)\n next\n case (Equality a t t') show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\" using Equality Cons.prems Cons.IH by auto\n thus ?thesis using Equality Assign unfolding wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def by (auto simp add: sup_assoc)\n next\n case Check\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\" using Equality Cons.prems Cons.IH by auto\n thus ?thesis using Equality Check unfolding wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def by (auto simp add: sup_assoc)\n qed\n next\n case (InSet a t t') show ?thesis\n proof (cases a)\n case Assign\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv t' \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\" using InSet Cons.prems Cons.IH by auto\n thus ?thesis using InSet Assign unfolding wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def by (auto simp add: sup_assoc)\n next\n case Check\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S) S'\" using InSet Cons.prems Cons.IH by auto\n thus ?thesis using InSet Check unfolding wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def by (auto simp add: sup_assoc)\n qed\n qed (auto simp add: wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def)\nqed (simp add: wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_append:\n \"wf'\\<^sub>s\\<^sub>s\\<^sub>t X S \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t Y T \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t (X \\ Y) (S@T)\"\nproof (induction X S rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n case 1 thus ?case by (metis wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono Un_commute append_Nil)\nnext\n case 3 thus ?case by (metis append_Cons Un_commute Un_assoc wf'\\<^sub>s\\<^sub>s\\<^sub>t.simps(3))\nnext\n case (4 V t t' S)\n hence *: \"fv t' \\ V\" and \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ Y) (S @ T)\" by simp_all\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ Y \\ fv t) (S @ T)\" by (metis Un_commute Un_assoc)\n thus ?case using * by auto\nnext\n case (8 V t t' S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv t' \\ Y) (S @ T)\" by simp_all\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ Y \\ fv t \\ fv t') (S @ T)\" by (metis Un_commute Un_assoc)\n thus ?case by auto\nqed auto\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_append_suffix:\n \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ V \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t V (S@S')\"\nproof (induction V S rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n case (2 V t S)\n hence *: \"fv t \\ V\" \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" by simp_all\n hence \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ V\"\n using \"2.prems\"(2) unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n thus ?case using \"2.IH\" * by simp\nnext\n case (3 V t S)\n hence *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S\" by simp_all\n hence \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ (V \\ fv t)\"\n using \"3.prems\"(2) unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n thus ?case using \"3.IH\" * by simp\nnext\n case (4 V t t' S)\n hence *: \"fv t' \\ V\" \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S\" by simp_all\n moreover have \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (\\t := t'\\) = fv t \\ fv t'\"\n by simp\n moreover have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t (\\t := t'\\#S) = fv t \\ fv t' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S\"\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n ultimately have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ (V \\ fv t)\"\n using \"4.prems\"(2) by blast\n thus ?case using \"4.IH\" * by simp\nnext\n case (6 V t t' S)\n hence *: \"fv t \\ fv t' \\ V\" \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" by simp_all\n moreover have \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (insert\\t,t'\\) = fv t \\ fv t'\"\n by simp\n moreover have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t (insert\\t,t'\\#S) = fv t \\ fv t' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S\"\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n ultimately have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ V\"\n using \"6.prems\"(2) by blast\n thus ?case using \"6.IH\" * by simp\nnext\n case (8 V t t' S)\n hence *: \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv t') S\" by simp_all\n moreover have \"vars\\<^sub>s\\<^sub>s\\<^sub>t\\<^sub>p (select\\t,t'\\) = fv t \\ fv t'\"\n by simp\n moreover have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t (select\\t,t'\\#S) = fv t \\ fv t' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S\"\n unfolding wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def by auto\n ultimately have \"wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S' \\ wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t S \\ (V \\ fv t \\ fv t')\"\n using \"8.prems\"(2) by blast\n thus ?case using \"8.IH\" * by simp\nqed (simp_all add: wf\\<^sub>s\\<^sub>s\\<^sub>tI wfrestrictedvars\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_append_suffix':\n assumes \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\"\n and \"\\((\\x. case x of\n Receive t \\ fv t\n | Equality Assign _ t' \\ fv t'\n | Insert t t' \\ fv t \\ fv t'\n | _ \\ {}) ` set S') \\ wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t S \\ V\"\n shows \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V (S@S')\"\nusing assms\nby (induction V S rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n (auto simp add: wf\\<^sub>s\\<^sub>s\\<^sub>tI' wf\\<^sub>s\\<^sub>s\\<^sub>t_vars_mono wfvarsoccs\\<^sub>s\\<^sub>s\\<^sub>t_def)\n\nlemma wf\\<^sub>s\\<^sub>s\\<^sub>t_subst_apply:\n \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S \\ wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\nproof (induction S arbitrary: V rule: wf'\\<^sub>s\\<^sub>s\\<^sub>t.induct)\n case (2 V t S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" \"fv t \\ V\" by simp_all\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"fv (t \\ \\) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)\"\n using \"2.IH\" subst_apply_fv_subset by simp_all\n thus ?case by (simp add: subst_apply_stateful_strand_def)\nnext\n case (3 V t S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S\" by simp\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` (V \\ fv t))) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" using \"3.IH\" by metis\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V) \\ fv (t \\ \\)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" by (metis subst_apply_fv_union)\n thus ?case by (simp add: subst_apply_stateful_strand_def)\nnext\n case (4 V t t' S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t) S\" \"fv t' \\ V\" by auto\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` (V \\ fv t))) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" and *: \"fv (t' \\ \\) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)\"\n using \"4.IH\" subst_apply_fv_subset by force+\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V) \\ fv (t \\ \\)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" by (metis subst_apply_fv_union)\n thus ?case using * by (simp add: subst_apply_stateful_strand_def)\nnext\n case (6 V t t' S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t V S\" \"fv t \\ fv t' \\ V\" by auto\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" \"fv (t \\ \\) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)\" \"fv (t' \\ \\) \\ fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V)\"\n using \"6.IH\" subst_apply_fv_subset by force+\n thus ?case by (simp add: sup_assoc subst_apply_stateful_strand_def)\nnext\n case (8 V t t' S)\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (V \\ fv t \\ fv t') S\" by auto\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` (V \\ fv t \\ fv t'))) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\"\n using \"8.IH\" subst_apply_fv_subset by force\n hence \"wf'\\<^sub>s\\<^sub>s\\<^sub>t (fv\\<^sub>s\\<^sub>e\\<^sub>t (\\ ` V) \\ fv (t \\ \\) \\ fv (t' \\ \\)) (S \\\\<^sub>s\\<^sub>s\\<^sub>t \\)\" by (metis subst_apply_fv_union)\n thus ?case by (simp add: subst_apply_stateful_strand_def)\nqed (auto simp add: subst_apply_stateful_strand_def)\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Stateful_Protocol_Composition_and_Typing", "sha": "34755583e50bc8a2e3eb0f91350c0b8510422a16", "save_path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing", "path": "github-repos/isabelle/logicalhacking-Stateful_Protocol_Composition_and_Typing/Stateful_Protocol_Composition_and_Typing-34755583e50bc8a2e3eb0f91350c0b8510422a16/Stateful_Protocol_Composition_and_Typing/Stateful_Strands.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2513203076179137}} {"text": "theory No_Alias\n imports Simpl.Vcg \"Rust-Verification.Rust_Semantics\"\nbegin\n\nrecord no_alias_env = globals_ram +\n x :: tagged_ref (* locals are represented by owning reference *)\n ref1 :: tagged_ref\n ref2 :: tagged_ref\n\ndefinition no_alias_body :: \"(no_alias_env, 'p, rust_error) com\" where\n \"no_alias_body ==\n Basic (\\s. (let (r, s') = heap_new (int_val 100) s in s'\\ x := r \\));;\n\n reborrow_stmt Unique x (\\s r. s\\ ref1 := r \\);;\n write_imm ref1 (int_val 200);;\n\n reborrow_stmt Unique x (\\s r. s\\ ref2 := r \\);;\n write_imm ref2 (int_val 300)\"\n\n(* Termination *)\nlemma \"\\ \\\\<^sub>t {s. wf_heap s} no_alias_body {s. True}\"\n unfolding no_alias_body_def\n apply vcg_step\n prefer 2\n apply vcg_step\n apply vcg_step\n apply vcg_step\n apply vcg_step\n prefer 2\n apply vcg_step\n apply vcg_step\n apply vcg_step\n apply vcg_step\n prefer 2\n apply vcg_step\n apply vcg_step\n apply vcg_step\n apply vcg_step\n prefer 2\n apply vcg_step\n apply vcg_step\n apply vcg_step\n apply vcg_step\n apply vcg_step\n by (simp add: Let_def)\n\n(* Termination, by full VCG *)\nlemma \"\\ \\\\<^sub>t {s. wf_heap s} no_alias_body {s. True}\"\n unfolding no_alias_body_def\n apply vcg\n by (auto simp: Let_def)\n\n(* Spec of the program *)\nlemma \"\\ \\\\<^sub>t\n {s. wf_heap s}\n no_alias_body\n {s. (let p = the_ptr (pointer (x s)) in\n memory s ! p = int_val 300) \\\n writable (x s) s \\ \\writable (ref1 s) s \\ writable (ref2 s) s}\"\n unfolding no_alias_body_def\n apply vcg\n (* This auto takes too long because of the term size *)\n by (auto simp: Let_def)\n\nend", "meta": {"author": "pandaman64", "repo": "sabi", "sha": "a5de6b33cb0e5b9e6f0e610de0a3536236d1a694", "save_path": "github-repos/isabelle/pandaman64-sabi", "path": "github-repos/isabelle/pandaman64-sabi/sabi-a5de6b33cb0e5b9e6f0e610de0a3536236d1a694/Rustv/Tests/ex/No_Alias.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.2513203076179137}} {"text": "theory utp_fault_designs\nimports \"../utp/utp\" utp_designs\nbegin\nsubsection {*Sequential C-program alphabet*}\n\ntext {*In order to record the interaction of a sequential C program with its execution environment, \n we extend the alphabet of UTP by two additional global state variables:\n \\begin{itemize} \n \\<^item> fault: a variable of type @{typ \"'f option\"} used to record a fault of a given guard is \n not satisfied.\n \\<^item> abrupt: a boolean variable used to\n \\end{itemize}\n\n*}\n\nalphabet 'f cp_vars = des_vars +\n abrupt:: bool\n fault :: bool\n stuck :: bool\n fault_tr :: \"'f option\"\n \n (*wait :: bool*)\n\ndeclare cp_vars.splits [alpha_splits]\n\nsubsubsection {*Alphabet proofs*}\ntext {*\n The two locale interpretations below are a technicality to improve automatic\n proof support via the predicate and relational tactics. This is to enable the\n (re-)interpretation of state spaces to remove any occurrences of lens types\n after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n of their derivatives have been applied. Eventually, it would be desirable to\n automate both interpretations as part of a custom outer command for defining\n alphabets.\n*}\n\ninterpretation cp_vars:\n lens_interp \"\\ (ok, r) . (ok, abrupt\\<^sub>v r, fault\\<^sub>v r, fault_tr\\<^sub>v r, stuck\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation cp_vars_rel: lens_interp \"\\(ok, ok', r, r').\n (ok, ok', abrupt\\<^sub>v r, abrupt\\<^sub>v r', fault\\<^sub>v r, fault\\<^sub>v r', fault_tr\\<^sub>v r, fault_tr\\<^sub>v r', stuck\\<^sub>v r, \n stuck\\<^sub>v r',more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\n\nsubsubsection {*Type lifting*}\n\ntype_synonym ('f, '\\) cp = \"('f, '\\) cp_vars_scheme des\"\ntype_synonym ('f,'\\,'\\) rel_cp = \"(('f,'\\) cp, ('f,'\\) cp) rel\"\ntype_synonym ('f,'\\) hrel_cp = \"(('f,'\\) cp) hrel\"\n\nsubsubsection {*Syntactic type setup*}\n\ntranslations\n (type) \"('f,'\\) cp\" <= (type) \"('f, '\\) cp_vars_scheme des\"\n (type) \"('f,'\\) cp\" <= (type) \"('f, '\\) cp_vars_ext des\"\n (type) \"('f,'\\,'\\) rel_cp\" <= (type) \"(('f,'\\) cp, (_,'\\) cp) rel\"\n\nnotation cp_vars_child_lens\\<^sub>a (\"\\\\<^sub>c\")\nnotation cp_vars_child_lens (\"\\\\<^sub>C\")\n\nsyntax\n \"_svid_st_alpha\" :: \"svid\" (\"\\\\<^sub>C\")\n \"_svid_st_a\" :: \"svid\" (\"\\\\<^sub>c\")\ntranslations\n \"_svid_st_alpha\" => \"CONST cp_vars_child_lens\"\n \"_svid_st_a\" => \"CONST cp_vars_child_lens\\<^sub>a\"\n\nlemma cvars_ord [usubst]:\n \"$ok \\\\<^sub>v $ok\\\" \"$abrupt \\\\<^sub>v $abrupt\\\" \"$fault \\\\<^sub>v $fault\\\" \"$fault_tr \\\\<^sub>v $fault_tr\\\" \"$stuck \\\\<^sub>v $stuck\\\" \n \"$ok \\\\<^sub>v $abrupt\\\" \"$ok \\\\<^sub>v $abrupt\" \"$ok\\ \\\\<^sub>v $abrupt\\\" \"$ok\\ \\\\<^sub>v $abrupt\" \n \"$ok \\\\<^sub>v $fault\\\" \"$ok \\\\<^sub>v $fault\" \"$ok\\ \\\\<^sub>v $fault\\\" \"$ok\\ \\\\<^sub>v $fault\"\n \"$ok \\\\<^sub>v $fault_tr\\\" \"$ok \\\\<^sub>v $fault_tr\" \"$ok\\ \\\\<^sub>v $fault_tr\\\" \"$ok\\ \\\\<^sub>v $fault_tr\"\n \"$ok \\\\<^sub>v $stuck\\\" \"$ok \\\\<^sub>v $stuck\" \"$ok\\ \\\\<^sub>v $stuck\\\" \"$ok\\ \\\\<^sub>v $stuck\"\n \"$abrupt \\\\<^sub>v $fault\" \"$abrupt \\\\<^sub>v $fault\\\" \"$abrupt\\ \\\\<^sub>v $fault\" \"$abrupt\\ \\\\<^sub>v $fault\\\"\n \"$abrupt \\\\<^sub>v $fault_tr\" \"$abrupt \\\\<^sub>v $fault_tr\\\" \"$abrupt\\ \\\\<^sub>v $fault_tr\" \"$abrupt\\ \\\\<^sub>v $fault_tr\\\"\n \"$abrupt \\\\<^sub>v $stuck\\\" \"$abrupt \\\\<^sub>v $stuck\" \"$abrupt\\ \\\\<^sub>v $stuck\\\" \"$abrupt\\ \\\\<^sub>v $stuck\" \n \"$fault \\\\<^sub>v $stuck\\\" \"$fault \\\\<^sub>v $stuck\" \"$fault\\ \\\\<^sub>v $stuck\\\" \"$fault\\ \\\\<^sub>v $stuck\"\n \"$fault_tr \\\\<^sub>v $stuck\\\" \"$fault_tr \\\\<^sub>v $stuck\" \"$fault_tr\\ \\\\<^sub>v $stuck\\\" \"$fault_tr\\ \\\\<^sub>v $stuck\"\n by (simp_all add: var_name_ord_def)\n\nabbreviation abrupt_f::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"abrupt_f R \\ R\\false/$abrupt\\\"\n\nabbreviation abrupt_t::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"abrupt_t R \\ R\\true/$abrupt\\\"\n\nabbreviation fault_f::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"fault_f R \\ R\\false/$fault\\\"\n\nabbreviation fault_t::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"fault_t R \\ R\\true/$fault\\\"\n\nabbreviation stuck_f::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"stuck_f R \\ R\\false/$stuck\\\"\n\nabbreviation stuck_t::\"('f, '\\, '\\) rel_cp \\ ('f, '\\, '\\) rel_cp\"\nwhere \"stuck_t R \\ R\\true/$stuck\\\"\n\nsyntax\n \"_abrupt_f\" :: \"logic \\ logic\" (\"_\\<^sub>a\\<^sub>f\" [1000] 1000)\n \"_abrupt_t\" :: \"logic \\ logic\" (\"_\\<^sub>a\\<^sub>t\" [1000] 1000)\n \"_fault_f\" :: \"logic \\ logic\" (\"_\\<^sub>f\\<^sub>f\" [1000] 1000)\n \"_fault_t\" :: \"logic \\ logic\" (\"_\\<^sub>f\\<^sub>t\" [1000] 1000)\n \"_stuck_f\" :: \"logic \\ logic\" (\"_\\<^sub>s\\<^sub>f\" [1000] 1000)\n \"_stuck_t\" :: \"logic \\ logic\" (\"_\\<^sub>s\\<^sub>t\" [1000] 1000)\n\ntranslations\n \"P \\<^sub>a\\<^sub>f\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST abrupt) false) P\"\n \"P \\<^sub>a\\<^sub>t\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST abrupt) true) P\"\n \"P \\<^sub>f\\<^sub>f\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST fault) false) P\"\n \"P \\<^sub>f\\<^sub>t\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST fault) true) P\"\n \"P \\<^sub>s\\<^sub>f\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST stuck) false) P\"\n \"P \\<^sub>s\\<^sub>t\" \\ \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST stuck) true) P\"\n\nsubsection {*UTP-Relations lift and drop*}\n\nabbreviation lift_desr (\"\\_\\\\<^sub>C\")\nwhere \"\\P\\\\<^sub>C \\ P \\\\<^sub>p (\\\\<^sub>C \\\\<^sub>L \\\\<^sub>C)\"\n\nabbreviation lift_pre_desr (\"\\_\\\\<^sub>C\\<^sub><\")\nwhere \"\\p\\\\<^sub>C\\<^sub>< \\ \\\\p\\\\<^sub><\\\\<^sub>C\"\n\nabbreviation lift_post_desr (\"\\_\\\\<^sub>C\\<^sub>>\")\nwhere \"\\p\\\\<^sub>C\\<^sub>> \\ \\\\p\\\\<^sub>>\\\\<^sub>C\"\n\nabbreviation drop_desr (\"\\_\\\\<^sub>C\")\nwhere \"\\P\\\\<^sub>C \\ P \\\\<^sub>p (\\\\<^sub>C \\\\<^sub>L \\\\<^sub>C)\"\n\n\nsubsection {* Reactive lemmas *}\n\nlemma unrest_ok_lift_rea [unrest]:\n \"$ok \\ \\P\\\\<^sub>C\" \"$ok\\ \\ \\P\\\\<^sub>C\"\n by (pred_auto)+\n\nlemma unrest_abrupt_lift_rea [unrest]:\n \"$abrupt \\ \\P\\\\<^sub>C\" \"$abrupt\\ \\ \\P\\\\<^sub>C\"\n by (pred_auto)+\n\nlemma unrest_fault_lift_rea [unrest]:\n \"$fault \\ \\P\\\\<^sub>C\" \"$fault\\ \\ \\P\\\\<^sub>C\"\n by (pred_auto)+\n\nlemma unrest_stuck_lift_rea [unrest]:\n \"$stuck \\ \\P\\\\<^sub>C\" \"$stuck\\ \\ \\P\\\\<^sub>C\"\n by (pred_auto)+\n\nlemma seqr_abrupt_true [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>t = (P \\<^sub>a\\<^sub>t ;; Q)\"\n by (rel_auto)\n\nlemma seqr_abrupt_false [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>f = (P \\<^sub>a\\<^sub>f ;; Q)\"\n by (rel_auto)\n\nlemma seqr_fault_true [usubst]: \"(P ;; Q) \\<^sub>f\\<^sub>t = (P \\<^sub>f\\<^sub>t ;; Q)\"\n by (rel_auto)\n\nlemma seqr_fault_false [usubst]: \"(P ;; Q) \\<^sub>f\\<^sub>f = (P \\<^sub>f\\<^sub>f ;; Q)\"\n by (rel_auto)\n\nlemma seqr_stuck_true [usubst]: \"(P ;; Q) \\<^sub>s\\<^sub>t = (P \\<^sub>s\\<^sub>t ;; Q)\"\n by (rel_auto)\n\nlemma seqr_stuck_false [usubst]: \"(P ;; Q) \\<^sub>s\\<^sub>f = (P \\<^sub>s\\<^sub>f ;; Q)\"\n by (rel_auto)\n\nsubsection{*Healthiness conditions*}\n\ntext {*Programs in fault or abrupt or stuck state do not progress*}\ndefinition C3_def [upred_defs]: \n \"C3(P) = (P \\ \\$abrupt \\ \\$fault \\ \\$stuck \\ $fault_tr =\\<^sub>u \\None\\ \\ II)\"\n\nsubsection{*Control flow statements*}\n\ntext{*We introduce the known control-flow statements for C. Our semantics is restricted\n to @{const C3}. In other words It assumes:\n \\begin{itemize} \n \\<^item> an execution starting from initial stable state ie,@{term \"$ok\"}, \n \\<^item> terminates a final state ie,@{term \"$ok\\\"},\n \\<^item> the final state is a normal state ie,\n @{term \"\\$abrupt\"} and @{term \"$fault_tr =\\<^sub>u \\None\\\"},\n \\end{itemize}\n Thus it capture Simpl semantics.\n *}\n\nabbreviation\n \"Simpl P \\ C3(\\true\\\\<^sub>C \\ (P))\"\n\ndefinition skip_c :: \"('f,'\\) hrel_cp\" (\"SKIP\")\nwhere [urel_defs]:\n \"SKIP = Simpl (\\$abrupt\\ \\ \\$stuck\\ \\ \\$fault\\ \\ $fault_tr\\ =\\<^sub>u \\None\\ \\ \\II\\\\<^sub>C)\"\n\ndefinition stuck_c :: \"('f,'\\) hrel_cp\" (\"STUCK\")\nwhere [urel_defs]: \"STUCK = C3($stuck\\)\"\n\ndefinition assigns_c :: \"'\\ usubst \\ ('f,'\\) hrel_cp\" (\"\\_\\\\<^sub>C\")\nwhere [urel_defs]: \n \"assigns_c \\ = C3(\\true\\\\<^sub>C \\ (\\$abrupt\\ \\ \\$stuck\\ \\ \\$fault\\ \\ $fault_tr\\ =\\<^sub>u \\None\\ \\ \\\\\\\\\\<^sub>a\\\\<^sub>C))\"\n\nsubsection{*THROW*}\n\ndefinition throw_c :: \"('f,'\\) hrel_cp\" (\"THROW\")\nwhere [urel_defs]: \n \"THROW = Simpl ($abrupt\\ \\ \\$stuck\\ \\ \\$fault\\ \\ $fault_tr\\ =\\<^sub>u \\None\\ \\ \\II\\\\<^sub>C)\"\n\nsubsection{*Conditional*}\n\nabbreviation If_c :: \"'\\ cond \\('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"bif (_)/ then (_) else (_) eif\")where\n \"If_c b P Q \\ (P \\ \\b\\\\<^sub>C\\<^sub>< \\ Q)\"\n\nsubsection{*GUARD*}\n\nabbreviation guard_c :: \"'f \\ '\\ cond \\ ('f,'\\) hrel_cp\" \nwhere \"guard_c f b \\ \n (bif b then SKIP else (\\$abrupt\\ \\ \\$stuck\\ \\ $fault\\ \\ $fault_tr\\ =\\<^sub>u \\Some f\\ \\ \\II\\\\<^sub>C) eif)\"\n\nsubsection{*assert and assume*}\n\ndefinition rassume_c :: \"'\\ upred \\ ('f,'\\) hrel_cp\" (\"_\\<^sup>\\\\<^sup>C\" [999] 999) where\n[urel_defs]: \"rassume_c c = (bif c then SKIP else \\\\<^sub>D eif)\"\n\ndefinition rassert_c :: \"'\\ upred \\ ('f,'\\) hrel_cp\" (\"_\\<^sub>\\\\<^sub>C\" [999] 999) where\n[urel_defs]: \"rassert_c c = (bif c then SKIP else \\\\<^sub>D eif)\"\n\nsubsection{*Exceptions*}\n\nabbreviation catch_c :: \"('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"try (_) catch /(_) end\")\nwhere \"try P catch Q end \\ (P ;; ((abrupt:== (\\ &abrupt) ;;Q) \\ $abrupt \\ II))\"\n\nsubsection{*Scoping*}\n\ndefinition block_c (\"bob INIT (_) BODY /(_) RESTORE /(_) RETURN/(_) eob\") where\n[urel_defs]:\n \"bob INIT init BODY body RESTORE restore RETURN return eob= \n (Abs_uexpr (\\(s, s'). \n \\init ;; body ;; Abs_uexpr (\\(t, t').\n \\(abrupt:== (\\ &abrupt) ;;restore (s, s') (t, t');; THROW) \\ $abrupt \\ II;; \n restore (s, s') (t, t');; return(s, s') (t, t')\\\\<^sub>e (t, t'))\\\\<^sub>e (s, s')))\" \n\nsubsection{*Loops*}\npurge_notation while (\"while\\<^sup>\\ _ do _ od\")\n\ndefinition While :: \"'\\ cond \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"while\\<^sup>\\ _ do _ od\") where\n\"While b C = (\\ X \\ bif b then (C ;; X) else SKIP eif)\"\n\npurge_notation while_top (\"while _ do _ od\")\n\nabbreviation While_top :: \"'\\ cond \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"while _ do _ od\") where\n\"while b do P od \\ while\\<^sup>\\ b do P od\"\n\npurge_notation while_bot (\"while\\<^sub>\\ _ do _ od\")\n\ndefinition While_bot :: \"'\\ cond \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"while\\<^sub>\\ _ do _ od\") where\n\"while\\<^sub>\\ b do P od = (\\ X \\ bif b then (P ;; X) else SKIP eif)\"\n\nsubsection{*While-loop inv*}\ntext {* While loops with invariant decoration *}\n\npurge_notation while_inv (\"while _ invr _ do _ od\" 70)\n\ndefinition While_inv :: \"'\\ cond \\ '\\ cond \\ ('f,'\\) hrel_cp \\ ('f,'\\) hrel_cp\" (\"while _ invr _ do _ od\" 70) where\n\"while b invr p do S od = while b do S od\"\n\ndeclare While_def [urel_defs]\ndeclare While_inv_def [urel_defs]\ndeclare While_bot_def [urel_defs]\n\n\nsyntax\n \"_assignmentc\" :: \"svid_list \\ uexprs \\ logic\" (infixr \"\\\" 55)\n\ntranslations\n \"_assignmentc xs vs\" => \"CONST assigns_c (_mk_usubst (CONST id) xs vs)\"\n \"x \\ v\" <= \"CONST assigns_c (CONST subst_upd (CONST id) (CONST svar x) v)\"\n \"x \\ v\" <= \"CONST assigns_c (CONST subst_upd (CONST id) x v)\"\n \"x,y \\ u,v\" <= \"CONST assigns_c (CONST subst_upd (CONST subst_upd (CONST id) (CONST svar x) u) (CONST svar y) v)\"\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/orca/theories/utp_fault_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2513083247123449}} {"text": "section \\Equivalence of a Diamond-Shaped Relaying Network and a Cross-Shaped Broadcasting Network\\\n\ntheory \"Network_Equivalences-Diamond-Relaying_Broadcasting\"\n imports \"Network_Equivalences-Diamond-Foundations\"\nbegin\n\nabbreviation diamond_receiving_and_relaying where\n \"diamond_receiving_and_relaying r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\\n \\ \\Link 0--1:\\ l\\<^sub>0\\<^sub>1 \\ [r\\<^sub>1, l\\<^sub>1\\<^sub>3] \\\n \\ \\Link 0--2:\\ l\\<^sub>0\\<^sub>2 \\ [r\\<^sub>2, l\\<^sub>2\\<^sub>3] \\\n \\ \\Link 1--3:\\ l\\<^sub>1\\<^sub>3 \\ [r\\<^sub>3, l\\<^sub>3\\<^sub>0] \\\n \\ \\Link 2--3:\\ l\\<^sub>2\\<^sub>3 \\ [r\\<^sub>3, l\\<^sub>3\\<^sub>0] \\\n \\ \\Link 3--0:\\ l\\<^sub>3\\<^sub>0 \\ [r\\<^sub>0, l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2]\"\n\nabbreviation diamond where\n \"diamond s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 \\\n \\ l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving_and_relaying r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\"\n\nabbreviation cross where\n \"cross s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 \\\n \\ m. (\n \\\\<^sup>* (\\ m) \\\n cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ m) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ m)\n )\"\n\nlemma untangling:\n shows \"\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\\\<^sup>*l\\<^sub>0\\<^sub>1 \\ \\\\<^sup>*l\\<^sub>0\\<^sub>2 \\ \\\\<^sup>*l\\<^sub>1\\<^sub>3 \\ \\\\<^sup>*l\\<^sub>2\\<^sub>3 \\ \\\\<^sup>*l\\<^sub>3\\<^sub>0 \\\n diamond_receiving_and_relaying r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\n \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\\\<^sup>*l\\<^sub>0\\<^sub>1 \\ \\\\<^sup>*l\\<^sub>0\\<^sub>2 \\ \\\\<^sup>*l\\<^sub>1\\<^sub>3 \\ \\\\<^sup>*l\\<^sub>2\\<^sub>3 \\ \\\\<^sup>*l\\<^sub>3\\<^sub>0 \\\n diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\\n initial_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\"\n (is \"?p \\\\<^sub>s ?q\")\nproof -\n have \"?p \\\\<^sub>s\n \\ \\Link 0--1:\\ (\\\\<^sup>+l\\<^sub>0\\<^sub>1 \\ \\a\\[r\\<^sub>1, l\\<^sub>1\\<^sub>3]. \\\\<^sup>?a \\ l\\<^sub>0\\<^sub>1 \\ [r\\<^sub>1, l\\<^sub>1\\<^sub>3]) \\\n \\ \\Link 0--2:\\ (\\\\<^sup>+l\\<^sub>0\\<^sub>2 \\ \\a\\[r\\<^sub>2, l\\<^sub>2\\<^sub>3]. \\\\<^sup>?a \\ l\\<^sub>0\\<^sub>2 \\ [r\\<^sub>2, l\\<^sub>2\\<^sub>3]) \\\n \\ \\Link 1--3:\\ (\\\\<^sup>+l\\<^sub>1\\<^sub>3 \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. \\\\<^sup>?a \\ l\\<^sub>1\\<^sub>3 \\ [r\\<^sub>3, l\\<^sub>3\\<^sub>0]) \\\n \\ \\Link 2--3:\\ (\\\\<^sup>+l\\<^sub>2\\<^sub>3 \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. \\\\<^sup>?a \\ l\\<^sub>2\\<^sub>3 \\ [r\\<^sub>3, l\\<^sub>3\\<^sub>0]) \\\n \\ \\Link 3--0:\\ (\\\\<^sup>+l\\<^sub>3\\<^sub>0 \\ \\a\\[r\\<^sub>0, l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2]. \\\\<^sup>?a \\ l\\<^sub>3\\<^sub>0 \\ [r\\<^sub>0, l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2])\"\n unfolding duploss_def and general_parallel.simps using thorn_simps by equivalence\n also have \"\\ \\\\<^sub>s\n \\ \\Link 0--1:\\ (\\\\<^sup>+l\\<^sub>0\\<^sub>1 \\ \\a\\[r\\<^sub>1, l\\<^sub>1\\<^sub>3]. \\\\<^sup>?a \\ \\a\\[r\\<^sub>1, l\\<^sub>1\\<^sub>3]. l\\<^sub>0\\<^sub>1 \\ a) \\\n \\ \\Link 0--2:\\ (\\\\<^sup>+l\\<^sub>0\\<^sub>2 \\ \\a\\[r\\<^sub>2, l\\<^sub>2\\<^sub>3]. \\\\<^sup>?a \\ \\a\\[r\\<^sub>2, l\\<^sub>2\\<^sub>3]. l\\<^sub>0\\<^sub>2 \\ a) \\\n \\ \\Link 1--3:\\ (\\\\<^sup>+l\\<^sub>1\\<^sub>3 \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. \\\\<^sup>?a \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. l\\<^sub>1\\<^sub>3 \\ a) \\\n \\ \\Link 2--3:\\ (\\\\<^sup>+l\\<^sub>2\\<^sub>3 \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. \\\\<^sup>?a \\ \\a\\[r\\<^sub>3, l\\<^sub>3\\<^sub>0]. l\\<^sub>2\\<^sub>3 \\ a) \\\n \\ \\Link 3--0:\\ (\\\\<^sup>+l\\<^sub>3\\<^sub>0 \\ \\a\\[r\\<^sub>0, l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2]. \\\\<^sup>?a \\ \\a\\[r\\<^sub>0, l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2]. l\\<^sub>3\\<^sub>0 \\ a)\"\n using distributor_split by equivalence\n also have \"\\ \\\\<^sub>s ?q\"\n unfolding duploss_def and general_parallel.simps using thorn_simps by equivalence\n finally show ?thesis .\nqed\n\ntheorem diamond_cross_equivalence:\n shows \"\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n diamond s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3\n \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n cross s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3\"\nproof -\n have \"\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving_and_relaying r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n \\\\<^sub>s\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n (\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving_and_relaying r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n (\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n initial_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using untangling sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n initial_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\"\n using core_transformation sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n (\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n (\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using receiving_collapse sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n (\n \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n (\n \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0) \\\n cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0)\n )\n )\"\n using sending_collapse sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n (\n \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n \\0\\ \\ l\\<^sub>0\\<^sub>1. \\1\\ \\ l\\<^sub>0\\<^sub>2. \\2\\ \\ l\\<^sub>1\\<^sub>3. \\3\\ \\ l\\<^sub>2\\<^sub>3. (\n \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>1) \\ \\\\<^sup>* (\\ l\\<^sub>0\\<^sub>2) \\ \\\\<^sup>* (\\ l\\<^sub>1\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>2\\<^sub>3) \\ \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n transformed_core (\\ l\\<^sub>0\\<^sub>1) (\\ l\\<^sub>0\\<^sub>2) (\\ l\\<^sub>1\\<^sub>3) (\\ l\\<^sub>2\\<^sub>3) (\\ l\\<^sub>3\\<^sub>0)\n )\n )\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0)\n )\"\n unfolding tagged_new_channel_def using core_collapse sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n also have \"\\ \\\\<^sub>s\n \\\\<^sup>?r\\<^sub>0 \\ \\\\<^sup>?r\\<^sub>1 \\ \\\\<^sup>?r\\<^sub>2 \\ \\\\<^sup>?r\\<^sub>3 \\\n \\4\\ \\ l\\<^sub>3\\<^sub>0. (\n \\\\<^sup>* (\\ l\\<^sub>3\\<^sub>0) \\\n cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0) \\\n cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 (\\ l\\<^sub>3\\<^sub>0)\n )\"\n using thorn_simps sorry\n (* FIXME:\n This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n \\<^theory_text>\\iprover\\-based equivalence reasoner will be able to solve it.\n *)\n finally show ?thesis unfolding tagged_new_channel_def .\nqed\n\nend\n", "meta": {"author": "input-output-hk", "repo": "network-equivalences", "sha": "dedffb052a31ded438928ca44a7ebb2475a792d7", "save_path": "github-repos/isabelle/input-output-hk-network-equivalences", "path": "github-repos/isabelle/input-output-hk-network-equivalences/network-equivalences-dedffb052a31ded438928ca44a7ebb2475a792d7/src/Network_Equivalences-Diamond-Relaying_Broadcasting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2513083247123448}} {"text": "\nsection \\Intuitionistic first-order logic\\\n\ntheory betterFOL\nimports Pure\nbegin\n\nML \\\\<^assert> (not (can ML \\open RunCall\\))\\\nML_file \\~~/src/Tools/misc_legacy.ML\\\nML_file \\~~/src/Provers/splitter.ML\\\nML_file \\~~/src/Provers/hypsubst.ML\\\nML_file \\~~/src/Tools/IsaPlanner/zipper.ML\\\nML_file \\~~/src/Tools/IsaPlanner/isand.ML\\\nML_file \\~~/src/Tools/IsaPlanner/rw_inst.ML\\\nML_file \\~~/src/Provers/quantifier1.ML\\\nML_file \\~~/src/Tools/intuitionistic.ML\\\nML_file \\~~/src/Tools/project_rule.ML\\\nML_file \\~~/src/Tools/atomize_elim.ML\\\n\n\nsubsection \\Syntax and axiomatic basis\\\n\nsetup Pure_Thy.old_appl_syntax_setup\n\nclass \"term\"\ndefault_sort \\term\\\n\ntypedecl o\n\njudgment\n Trueprop :: \\o \\ prop\\ (\\(_)\\ 5)\n\n\nsubsubsection \\Equality\\\n\naxiomatization\n eq :: \\['a, 'a] \\ o\\ (infixl \\=\\ 50)\nwhere\n refl: \\a = a\\ and\n subst: \\a = b \\ P(a) \\ P(b)\\\n\n\nsubsubsection \\Propositional logic\\\n\naxiomatization\n False :: \\o\\ and\n conj :: \\[o, o] => o\\ (infixr \\\\\\ 35) and\n disj :: \\[o, o] => o\\ (infixr \\\\\\ 30) and\n imp :: \\[o, o] => o\\ (infixr \\\\\\ 25)\n\naxiomatization\nwhere\n mp: \\\\P \\ Q; P\\ \\ Q\\ and\n a1: \\A \\ (B \\ A)\\ and\n a2: \\(A \\ (B \\ C))\\((A \\ B)\\(A \\ C))\\\n\ntheorem Ded: \\(P \\ Q) \\ P \\ Q\\\n\n(*\n\n conjI: \\\\P; Q\\ \\ P \\ Q\\ and\n conjunct1: \\P \\ Q \\ P\\ and\n conjunct2: \\P \\ Q \\ Q\\ and\n\n disjI1: \\P \\ P \\ Q\\ and\n disjI2: \\Q \\ P \\ Q\\ and\n disjE: \\\\P \\ Q; P \\ R; Q \\ R\\ \\ R\\ and\n\n impI: \\(P \\ Q) \\ P \\ Q\\ and\n mp: \\\\P \\ Q; P\\ \\ Q\\ and\n\n FalseE: \\False \\ P\\\n*)\n\n", "meta": {"author": "georgydunaev", "repo": "article_isabelle_in_zfc", "sha": "29480bab0a514a1d07a5259dd57fe41e48f3dbeb", "save_path": "github-repos/isabelle/georgydunaev-article_isabelle_in_zfc", "path": "github-repos/isabelle/georgydunaev-article_isabelle_in_zfc/article_isabelle_in_zfc-29480bab0a514a1d07a5259dd57fe41e48f3dbeb/betterFOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.4035668537353746, "lm_q1q2_score": 0.251203959524245}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory signedoverflow\nimports \"CParser.CTranslation\"\nbegin\n\nexternal_file \"signedoverflow.c\"\ninstall_C_file \"signedoverflow.c\"\n\ncontext signedoverflow\nbegin\n\nthm f_body_def\n\n(* painful lemma about sint and word arithmetic results...\nlemma j0: \"\\ \\ \\ True \\ Call f_'proc \\ \\ret__int = 0 \\\"\napply vcg\napply simp_all\napply auto\n*)\n\nthm g_body_def\n\nlemma \"\\ \\ \\ True \\ \\ret__int :== CALL g(1) \\ \\ret__int = - 1 \\\"\napply vcg\napply (simp add: word_sle_def)\ndone\n\nlemma \"\\ \\ \\ True \\ \\ret__int :== CALL g(- 2147483648) \\ \\ret__int = - 1 \\\"\napply vcg\napply (simp add: word_sle_def)\ndone\n\nlemma \"\\ \\ \\ True \\ \\ret__int :== CALL g(- 2147483647) \\ \\ret__int = 2147483647 \\\"\napply vcg\napply (simp add: word_sle_def)\ndone\n\nend (* context *)\n\nend (* theory *)\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/testfiles/signedoverflow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.2511698877171206}} {"text": "theory MainHC\nimports Main\nbegin\n\n-- \"we need full proof object support to use translate_thm later on\"\nML {* proofs := 2 *}\n\ntypes 'a partial = \"'a option\"\n\n(* negation of is_none *)\nprimrec defOp :: \"'a partial => bool\"\nwhere\n\"defOp None = False\" |\n\"defOp (Some x) = True\"\n\ndefinition makeTotal :: \"'a partial => 'a\"\nwhere \"makeTotal == the\"\n\ndefinition makePartial :: \"'a => 'a partial\"\nwhere \"makePartial == Some\"\n\n(* undefined is predefined *)\ndefinition undefinedOp :: \"'a partial\"\nwhere \"undefinedOp == None\"\n\n(* backward compatibility only *)\ndefinition noneOp :: \"'a partial\"\nwhere \"noneOp == undefinedOp\"\n\ndefinition restrictOp :: \"'a partial => bool => 'a partial\"\nwhere \"restrictOp a b == if b then a else undefinedOp\"\n\n(* utilities *)\ndefinition flip :: \"('a => 'b => 'c) => 'b => 'a => 'c\"\nwhere \"flip f a b == f b a\"\n\ndefinition uncurryOp :: \"('a => 'b => 'c) => 'a * 'b => 'c\"\nwhere \"uncurryOp f p == f (fst p) (snd p)\"\n\ndefinition curryOp :: \"('a * 'b => 'c) => 'a => 'b => 'c\"\nwhere \"curryOp f a b == f (a, b)\"\n\n(* map on pairs *)\ndefinition mapFst :: \"('a => 'b) => 'a * 'c => 'b * 'c\"\nwhere \"mapFst f p == (f (fst p), snd p)\"\n\ndefinition mapSnd :: \"('b => 'c) => 'a * 'b => 'a * 'c\"\nwhere \"mapSnd f p == (fst p, f (snd p))\"\n\n(* predefined HasCASL functions *)\ndefinition ifImplOp :: \"bool * bool => bool\"\nwhere \"ifImplOp p == snd p --> fst p\"\n\ndefinition existEqualOp :: \"'a partial => 'a partial => bool\" \n (\"(_ =e=/ _)\" [50, 51] 50)\nwhere \"existEqualOp a b == defOp a & defOp b & makeTotal a = makeTotal b\"\n\ndefinition exEqualOp :: \"'a partial * 'a partial => bool\"\nwhere \"exEqualOp == uncurryOp existEqualOp\"\n\ndefinition strongEqualOp :: \"'a partial => 'a partial => bool\"\n (\"(_ =s=/ _)\" [50, 51] 50)\nwhere \"strongEqualOp a b == a = b\"\n\ndefinition whenElseOp :: \"('a partial * bool) * 'a partial => 'a partial\"\nwhere \"whenElseOp t == case t of\n (p, e) => if snd p then fst p else e\"\n\n(*resOp :: \"'a partial * 'b partial => 'a\"\n\"resOp p == makeTotal (restrictOp (fst p) (defOp (snd p)))\"*)\n\ndefinition resOp :: \"'a partial * 'b partial => 'a partial\"\nwhere \"resOp p == restrictOp (fst p) (defOp (snd p))\"\n\n\n(* conversions *)\ndefinition lift2partial :: \"('a => 'b partial) => 'a partial => 'b partial\"\nwhere \"lift2partial f s == restrictOp (f (makeTotal s)) (defOp s)\"\n\ndefinition mapPartial :: \"('a => 'b) => 'a partial => 'b partial\"\nwhere \"mapPartial f s == restrictOp (makePartial (f (makeTotal s))) (defOp s)\"\n\ndefinition unpackPartial :: \"(('a => 'b) => 'c => 'd partial)\n => ('a => 'b) partial => 'c => 'd partial\"\nwhere \"unpackPartial c s a == lift2partial (flip c a) s\"\n\ndefinition unpackBool :: \"(('a => 'b) => 'c => bool)\n => ('a => 'b) partial => 'c => bool\"\nwhere \"unpackBool c s a == defOp s & c (makeTotal s) a\"\n\ndefinition unpack2partial :: \"(('a => 'b) => 'c => 'd)\n => ('a => 'b) partial => 'c => 'd partial\"\nwhere \"unpack2partial c s a == mapPartial (flip c a) s\"\n\ndefinition unpack2bool :: \"(('a => 'b) => 'c => 'd)\n => ('a => 'b) partial => 'c => bool\"\nwhere \"unpack2bool c s a == defOp s\"\n\ndefinition bool2partial :: \"bool => unit partial\"\nwhere \"bool2partial b == restrictOp (makePartial ()) b\"\n\ndefinition liftUnit2unit :: \"('a => 'b) => bool => bool\"\nwhere \"liftUnit2unit f b == b\"\n\ndefinition liftUnit2bool :: \"(unit => bool) => bool => bool\"\nwhere \"liftUnit2bool f b == b & f ()\"\n\ndefinition liftUnit2partial :: \"(unit => 'a partial) => bool => 'a partial\"\nwhere \"liftUnit2partial f b == restrictOp (f ()) b\"\n\ndefinition liftUnit :: \"(unit => 'a) => bool => 'a partial\"\nwhere \"liftUnit f b ==restrictOp (makePartial (f ())) b\"\n\ndefinition lift2unit :: \"('b => 'c) => ('a partial => bool)\"\nwhere \"lift2unit f == defOp\"\n\ndefinition lift2bool :: \"('a => bool) => 'a partial => bool\"\nwhere \"lift2bool f s == defOp s & f (makeTotal s)\"\n\n(* old stuff *)\nprimrec app :: \"('a => 'b option) option => 'a option => 'b option\"\nwhere\n \"app None a = None\" |\n \"app (Some f) x = (case x of\n None => None\n | Some x' => f x')\"\n\nprimrec apt :: \"('a => 'b) option => 'a option => 'b option\"\nwhere\n \"apt None a = None\" |\n \"apt (Some f) x = (case x of\n None => None\n | Some x' => Some (f x'))\"\n\nprimrec pApp :: \"('a => bool) option => 'a option => bool\"\nwhere\n \"pApp None a = False\" |\n \"pApp (Some f) x = (case x of\n None => False\n | Some y => f y)\"\n\nprimrec pair :: \"'a option => 'b option => ('a * 'b) option\"\nwhere\n \"pair None a = None\" |\n \"pair (Some x) z = (case z of\n None => None\n | Some y => Some (x,y))\"\n\nlemma some_inj : \"Some x = Some y ==> x = y\"\napply (auto)\ndone\n\n(* Monad law added by Lutz Schroeder *)\n\nlemma partial_monad_unit1[simp]: \"lift2partial f (makePartial a) = f a\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def)\ndone\n\nlemma partial_monad_unit2[simp]: \"lift2partial makePartial m = m\"\napply (auto simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\napply (case_tac \"m\")\napply (auto)\napply (case_tac \"m\")\napply (auto)\ndone\n\nlemma partial_monad_assoc[simp]:\n \"lift2partial g (lift2partial f m) =\n lift2partial (%x. lift2partial g (f x)) m\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\ndone\n\nlemma strictness_closure:\n \"defOp (lift2partial f a) = (defOp (lift2partial f a) & defOp a)\"\napply (simp add: lift2partial_def makePartial_def restrictOp_def makeTotal_def undefinedOp_def)\ndone\n\n(*\n Identities added by Ewaryst Schulz\n*)\n(* \nlemma defOp_implies_makePartial:\n\"defOp(x :: 'a partial) ==> (EX (y :: 'a). x = makePartial y)\"\n-- \"for isabelle 2009\"\n by (rule Option.option.exhaust [of x], simp, simp add: exI makePartial_def)\n-- \"for isabelle 2008\"\n by (rule Datatype.option.exhaust [of x], simp, simp add: exI makePartial_def)\n-- \"for both versions:\"\n sorry\n*)\n\naxioms\n\ndefOp_implies_makePartial:\n\"defOp(x :: 'a partial) ==> (EX (y :: 'a). x = makePartial y)\"\n\n\n-- \"need this to expand a term for application of lemmas\"\nlemma partial_identity: \"!!x. makeTotal(makePartial(x)) = x\"\n by (simp add: makeTotal_def makePartial_def)\n\nconsts preDefOp :: \"'a partial => bool\"\n\naxioms\n\npreDefOp_atom[simp]: \"preDefOp a = defOp a\"\n\npreDefOp_lift[simp]:\n\"preDefOp (lift2partial f a) = (defOp (lift2partial f a) & preDefOp a)\"\n\n\nend\n", "meta": {"author": "spechub", "repo": "Hets-lib", "sha": "7bed416952e7000e2fa37f0b6071b5291b299b77", "save_path": "github-repos/isabelle/spechub-Hets-lib", "path": "github-repos/isabelle/spechub-Hets-lib/Hets-lib-7bed416952e7000e2fa37f0b6071b5291b299b77/Isabelle/2008/MainHC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2510938934196687}} {"text": "section \\Independence of IMAP Commands\\\n\ntext\\In this section we show that two concurrent operations that reference to the same tag must be \nidentical.\\\n\ntheory\n \"IMAP-proof-independent\"\n imports\n \"IMAP-def\"\n \"IMAP-proof-helpers\" \nbegin\n\nlemma (in imap) Broadcast_Expunge_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (i, Expunge e mo i)] prefix of j\"\n shows \"Deliver (mo, Append mo e) \\ set xs \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"mo \\ snd (y e)\"\n using broadcast_only_valid_msgs[of xs \"(i, Expunge e mo i)\" j] \n valid_behaviours_def[of y \"(i, Expunge e mo i)\"] assms by auto\n ultimately show ?thesis\n using assms Deliver_added_files apply_operations_added_files by blast\nqed\n\nlemma (in imap) Broadcast_Store_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (i, Store e mo i)] prefix of j\"\n shows \"Deliver (mo, Append mo e) \\ set xs \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"mo \\ snd (y e)\"\n using broadcast_only_valid_msgs[of xs \"(i, Store e mo i)\" j] \n valid_behaviours_def[of y \"(i, Store e mo i)\"] assms by auto\n ultimately show ?thesis\n using assms Deliver_added_files apply_operations_added_files by blast\nqed\n\nlemma (in imap) Deliver_added_ids:\n assumes \"xs prefix of j\"\n and \"i \\ set (added_ids xs e)\"\n shows \"Deliver (i, Create i e) \\ set xs \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set xs)\"\n using assms proof (induct xs rule: rev_induct, clarsimp)\n case (snoc x xs) thus ?case\n proof (cases x, force)\n case X: (Deliver e')\n moreover obtain a b where \"e' = (a, b)\" by force\n ultimately show ?thesis\n using snoc apply (case_tac b; clarify)\n apply (simp, metis added_ids_Deliver_Create_diff_collapse \n added_ids_Deliver_Create_same_collapse empty_iff list.set(1) set_ConsD create_id_valid \n in_set_conv_decomp prefix_of_appendD, force)\n using append_id_valid apply (simp, metis (no_types, lifting) prefix_of_appendD, simp, metis \n Un_iff added_ids_Deliver_Expunge_diff_collapse added_ids_Deliver_Expunge_same_collapse \n empty_iff expunge_id_valid list.set(1) list.set_intros(1) prefix_of_appendD set_ConsD \n set_append)\n by (simp, blast)\n qed\nqed\n\nlemma (in imap) Broadcast_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (r, Delete ix e)] prefix of j\"\n and \"i \\ ix\"\n shows \"Deliver (i, Create i e) \\ set xs \\ \n Deliver (i, Append i e) \\ set xs \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set xs) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"ix = fst (y e) \\ snd (y e)\"\n by (metis (mono_tags, lifting) assms(1) broadcast_only_valid_msgs operation.case(2)\n option.simps(1) valid_behaviours_def case_prodD)\n ultimately show ?thesis\n using assms Deliver_added_ids apply_operations_added_ids\n by (metis Deliver_added_files Un_iff apply_operations_added_files le_iff_sup prefix_of_appendD)\nqed\n\nlemma (in imap) concurrent_create_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Create i e) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Create i e) (ir, Delete is e)\"\nproof -\n have f1: \"Deliver (i, Create i e) \\ set (history j)\"\n using assms prefix_msg_in_history by blast\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f2: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms by auto\n have f3: \"Deliver (i, Append i e) \\ set pre\" using f1 P \n by (metis (full_types) Pair_inject fst_conv network.delivery_has_a_cause network.msg_id_unique \n network_axioms operation.simps(9) prefix_elem_to_carriers prefix_of_appendD)\n have f4: \"\\ mo . Deliver (i, Expunge e mo i) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.simps(11)\n prefix_elem_to_carriers prefix_of_appendD)\n have \"\\ mo . Deliver (i, Store e mo i) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.simps(13)\n prefix_elem_to_carriers prefix_of_appendD) \n thus ?thesis using f2 f3 f4 P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_store_expunge_independent_technical:\n assumes \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e i r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (r, Expunge e i r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence f1: \"Deliver (i, Append i e) \\ set pre \\ \n (\\ mo2 . Deliver (i, Store e mo2 i) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) by auto\n hence f2: \"Deliver (i, Append i e) \\ set (history k)\"\n by (metis Pair_inject assms(1) assms(2) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.distinct(17) prefix_msg_in_history)\n from f1 obtain mo2 :: 'a where\n \"Deliver (i, Store e mo2 i) \\ set (history k)\" using f2\n using P prefix_elem_to_carriers by blast \n hence \"Deliver (i, Store e mo i) \\ set (history k)\" using assms f1 f2 P \n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n prefix_msg_in_history) \n then show ?thesis\n using hb.intros(2) events_in_local_order f1 f2 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_store_expunge_independent_technical2:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo2 i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e mo r) \\ set (node_deliver_messages xs)\"\n shows \"mo2 \\ r\"\nproof -\n obtain oid :: \"'a \\ ('a, 'b) operation \\ nat\" where\n oid: \"\\p n. Deliver p \\ set (history n) \\ Broadcast p \\ set (history (oid p))\"\n by (metis (no_types) delivery_has_a_cause)\n hence f1: \"Broadcast (r, Expunge e mo r) \\ set (history (oid (r, Expunge e mo r)))\"\n using assms(1) assms(3) prefix_msg_in_history by blast\n obtain k :: \"'a \\ 'b \\ ('a \\ ('a, 'b) operation) event list \\ 'a\" where k: \n \"\\i e pre. (\\mo. Deliver (i, Store e mo i) \\ set pre) = \n (Deliver (i, Store e (k i e pre) i) \\ set pre)\"\n by moura\n obtain pre :: \"nat \\ ('a \\ ('a, 'b) operation) event \\ ('a \\ ('a, 'b) operation) event list\" \n where pre: \"\\k op1. (\\op2. op2 @ [op1] prefix of k) = (pre k op1 @ [op1] prefix of k)\"\n by moura\n hence f2: \"\\e n. e \\ set (history n) \\ pre n e @ [e] prefix of n\"\n using events_before_exist by simp\n hence f3: \"pre (oid (i, Store e1 mo2 i)) (Broadcast (i, Store e1 mo2 i))\n prefix of oid (i, Store e1 mo2 i)\"\n using oid assms(1) assms(2) prefix_msg_in_history by blast\n have f4: \"Deliver (r, Append r e1) \\ set (history (oid (i, Store e1 mo2 i)))\"\n by (metis (no_types) oid f1 fst_conv msg_id_unique old.prod.inject operation.distinct(15))\n have \"Deliver (r, Store e1 (k r e1 (pre (oid (i, Store e1 mo2 i)) \n (Broadcast (i, Store e1 mo2 i)))) r) \\ set (history (oid (i, Store e1 mo2 i)))\"\n by (metis (no_types) oid f1 fst_conv msg_id_unique old.prod.inject operation.distinct(19))\n thus ?thesis using oid k f2 f3 f4 assms\n by (metis (no_types, lifting) Broadcast_Store_Deliver_prefix_closed \n network.prefix_msg_in_history network_axioms prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_store_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (ir, Delete is e)\"\nproof -\n have f1: \"Deliver (i, Store e mo i) \\ set (history j)\" using assms prefix_msg_in_history by auto\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f2: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\\n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\" \n using Broadcast_Deliver_prefix_closed assms(1) by auto \n have f3: \"Deliver (i, Create i e) \\ set pre\" using f1 P \n by (metis Pair_inject delivery_has_a_cause fst_conv msg_id_unique operation.distinct(7) \n prefix_elem_to_carriers prefix_of_appendD)\n have f4: \"Deliver (i, Append i e) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique operation.distinct(17) \n prefix_elem_to_carriers prefix_of_appendD prod.inject)\n have \"\\ mo . Deliver (i, Expunge e mo i) \\ set pre\" using f1 P\n by (metis Pair_inject delivery_has_a_cause fst_conv msg_id_unique operation.simps(25) \n prefix_elem_to_carriers prefix_of_appendD)\n hence \"Deliver (i, Store e mo i) \\ set pre\" using f1 f2 f3 f4 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers) \n thus ?thesis using P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_append_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (ir, Delete is e)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms(1) by auto\n hence \"Deliver (i, Append i e) \\ set pre\" using assms P f1\n by (metis (no_types, hide_lams) delivery_has_a_cause events_in_local_order fst_conv \n hb_broadcast_exists1 hb_deliver msg_id_unique prefix_msg_in_history)\n thus ?thesis using P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_append_expunge_independent_technical:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e mo r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (r, Expunge e mo r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"Deliver (mo, Append mo e) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) by auto\n hence \"(\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\" using P assms \n proof -\n have \"Deliver (mo, Append mo e) \\ set (history j)\"\n using assms(1) assms(2) assms(3) prefix_msg_in_history by blast\n thus ?thesis\n by (metis (no_types) P Pair_inject delivery_has_a_cause fst_conv msg_id_unique \n operation.simps(23) prefix_elem_to_carriers prefix_of_appendD)\n qed\n thus ?thesis\n using hb.intros(2) events_in_local_order assms(1) P f1 by blast\nqed\n\nlemma (in imap) concurrent_append_store_independent_technical:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e mo r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (r, Store e mo r)\"\nproof -\n obtain pre k where pre: \"pre@[Broadcast (r, Store e mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence f1: \"Deliver (mo, Append mo e) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) by auto\n have f2: \"Deliver (i, Append i e) \\ set (history j)\"\n by (meson assms network.prefix_msg_in_history network_axioms)\n then show ?thesis using assms f1 \n by (metis pre delivery_has_a_cause events_in_local_order fst_conv hb_deliver \n msg_id_unique node_histories.prefix_of_appendD node_histories_axioms \n prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_expunge_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Expunge e mo i) (ir, Delete is e)\"\nproof -\n obtain pre k where pre: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence A: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms(1) by auto \n hence \"Deliver (i, Expunge e mo i) \\ set pre\" using assms\n proof -\n have f1: \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using pre prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Expunge e mo i) \\ set (history j)\"\n by (meson assms network.prefix_msg_in_history network_axioms)\n then show ?thesis using f1 A \n by (metis (no_types, lifting) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms)\n qed \n ultimately show ?thesis\n using hb.intros(2) events_in_local_order by blast\nqed\n\nlemma (in imap) concurrent_store_store_independent_technical:\n assumes \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e i r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (r, Store e i r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Append i e) \\ set pre \\ (\\ mo2 . Deliver (i, Store e mo2 i) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) P by auto \n hence \"Deliver (i, Store e mo i) \\ set pre\" using assms f1 \n by (metis delivery_has_a_cause fst_conv msg_id_unique prefix_msg_in_history)\n then show ?thesis\n using hb.intros(2) events_in_local_order P by blast\nqed\n\nlemma (in imap) expunge_delete_tag_causality:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\" \n and \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n shows \"Deliver (i, Expunge e2 mo i) \\ set (history k)\"\nproof- \n have f1: \"Deliver (i, Append i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(15) prefix_msg_in_history)\n have f2: \"Deliver (i, Create i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(5) prefix_msg_in_history)\n have f3: \"\\ mo. Deliver (i, Store e2 mo i) \\ set (history k)\" using assms\n by (metis Pair_inject fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n operation.simps(25) prefix_msg_in_history)\n hence \"\\ mo1. Deliver (i, Expunge e2 mo1 i) \\ set (history k)\" using assms f1 f2 \n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers)\n then obtain mo1 :: 'a where\n \"Deliver (i, Expunge e2 mo1 i) \\ set (history k)\" by blast\n then show ?thesis using assms f1 f2 f3\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(4) prefix_msg_in_history)\nqed\n\nlemma (in imap) expunge_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence \"Deliver (i, Expunge e2 mo i) \\ set (history k)\" using assms expunge_delete_tag_causality\n by blast\n then show ?thesis using assms\n by (metis delivery_has_a_cause fst_conv network.msg_id_unique network_axioms \n operation.inject(4) prefix_msg_in_history prod.inject)\nqed\n\nlemma (in imap) store_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n have f1: \"Deliver (i, Append i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(17) prefix_msg_in_history)\n have f2: \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set (history k)\" using assms\n by (metis Pair_inject fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n operation.distinct(19) prefix_msg_in_history)\n have f3: \"Deliver (i, Create i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(8) prefix_msg_in_history)\n hence \"(\\ mo1. Deliver (i, Store e2 mo1 i) \\ set pre)\" using assms P f1 f2 imap_axioms \n by (meson imap.Broadcast_Deliver_prefix_closed prefix_elem_to_carriers prefix_of_appendD)\n then obtain mo1 :: 'a where\n f3: \"Deliver (i, Store e2 mo1 i) \\ set pre\" by blast\n then have f4: \"Deliver (i, Store e2 mo1 i) \\ set (history k)\"\n using P prefix_elem_to_carriers by blast \n hence \"Deliver (i, Store e2 mo i) \\ set pre\" using f2 f3 assms \n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(5) prefix_msg_in_history)\n moreover have \"Deliver(i, Store e1 mo i) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast \n ultimately show ?thesis using f4\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.inject(5))\nqed\n\nlemma (in imap) create_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Create i e1) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n have f1: \"Deliver (i, Append i e2) \\ set (history k)\"\n by (metis assms(2) assms(3) delivery_has_a_cause fst_conv network.msg_id_unique \n network.prefix_msg_in_history network_axioms operation.distinct(3) prod.inject)\n have f2: \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set (history k)\"\n by (metis assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n old.prod.inject operation.distinct(5) prefix_msg_in_history)\n have f3: \"\\ mo. Deliver (i, Store e2 mo i) \\ set (history k)\"\n by (metis Pair_inject assms(2) assms(3) delivery_has_a_cause fst_conv msg_id_unique \n operation.distinct(7) prefix_msg_in_history)\n hence \"Deliver (i, Create i e2) \\ set pre\" using assms P f2 f1 imap_axioms\n by (meson imap.Broadcast_Deliver_prefix_closed prefix_elem_to_carriers prefix_of_appendD)\n then show ?thesis using f1 f2 f3\n by (metis (no_types, lifting) P assms(2) assms(3) delivery_has_a_cause fst_conv msg_id_unique \n node_histories.prefix_of_appendD node_histories_axioms old.prod.inject operation.inject(1) \n prefix_elem_to_carriers prefix_msg_in_history)\nqed\n\nlemma (in imap) append_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence f1: \"\\e. e \\ set pre \\ e \\ set (history k)\" using prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Create i e2) \\ set pre\" using P f1\n by (metis assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n old.prod.inject operation.distinct(3) prefix_msg_in_history)\n moreover have D1: \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set pre\" using P f1\n by (metis Pair_inject assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.distinct(15) prefix_msg_in_history)\n moreover have D2: \"\\ mo. Deliver (i, Store e2 mo i) \\ set pre\" using P f1\n by (metis Pair_inject assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.simps(23) prefix_msg_in_history)\n moreover hence \"Deliver (i, Append i e2) \\ set pre\" \n using P D1 D2 f2 assms(1) Broadcast_Deliver_prefix_closed by blast\n moreover have \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n ultimately show ?thesis using assms \n by (metis f1 msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(3) prod.sel(1))\nqed\n\nlemma (in imap) append_expunge_ids_imply_messages_same:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e2 mo r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where pre: \"pre@[Broadcast (r, Expunge e2 mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence \"Deliver (mo, Append mo e2) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e2 mo2 mo) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1)\n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms) \n hence \"Deliver (i, Append i e2) \\ set pre\" using assms\n by (metis (no_types, lifting) pre delivery_has_a_cause fst_conv hb_broadcast_exists1 \n msg_id_unique network.hb_deliver network.prefix_msg_in_history network_axioms \n node_histories.events_in_local_order node_histories_axioms operation.distinct(17) \n prod.inject) \n moreover have \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n ultimately show ?thesis\n by (metis (no_types, lifting) fst_conv network.delivery_has_a_cause network.msg_id_unique \n network_axioms operation.inject(3) prefix_elem_to_carriers prefix_of_appendD prod.inject)\nqed\n\nlemma (in imap) append_store_ids_imply_messages_same:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e2 mo r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e2 mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence A: \"Deliver (mo, Append mo e2) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e2 mo2 mo) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1)\n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms)\n have f1: \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n hence \"Deliver (i, Append i e2) \\ set pre\" using assms P A\n by (metis Pair_inject assms(1) P delivery_has_a_cause fst_conv msg_id_unique \n operation.simps(23) prefix_elem_to_carriers prefix_of_appendD)\n then show ?thesis using f1\n by (metis P delivery_has_a_cause fst_conv msg_id_unique \n node_histories.prefix_of_appendD node_histories_axioms operation.inject(3) \n prefix_elem_to_carriers prod.inject)\nqed\n\nlemma (in imap) expunge_store_ids_imply_messages_same:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e2 i r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e2 i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence pprefix: \"pre prefix of k\"\n using P by blast\n have A: \"Deliver (i, Append i e2) \\ set pre \\ \n (\\ mo2 . Deliver (i, Store e2 mo2 i) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) P by blast \n have \"Deliver (i, Store e2 mo i) \\ set pre\" using assms A P\n proof -\n obtain op1 :: \"'a \\ ('a, 'b) operation \\ nat\" where\n f1: \"Broadcast (i, Store e1 mo i) \\ set (history (op1 (i, Store e1 mo i)))\"\n by (meson assms(1) assms(2) delivery_has_a_cause prefix_msg_in_history)\n then show ?thesis \n using f1 A pprefix delivery_has_a_cause network.msg_id_unique network_axioms \n node_histories.prefix_to_carriers node_histories_axioms \n by fastforce\n qed\n moreover have \"Deliver (i, Store e1 mo i) \\ set (history j)\"\n using assms(1) assms(2) prefix_msg_in_history by auto\n ultimately show ?thesis using assms P\n by (metis delivery_has_a_cause fst_conv msg_id_unique operation.inject(5) \n prefix_elem_to_carriers prefix_of_appendD prod.inject) \nqed\n\nlemma (in imap) store_store_ids_imply_messages_same:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e2 i r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e2 i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence A: \"Deliver (i, Append i e2) \\ set pre \\\n (\\ mo2 . Deliver (i, Store e2 mo2 i) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) by blast\n have \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using P prefix_elem_to_carriers by auto\n hence \"Deliver (i, Store e2 mo i) \\ set pre\" \n by (metis A assms(1) assms(2) delivery_has_a_cause fst_conv msg_id_unique \n operation.distinct(17) operation.inject(5) prefix_msg_in_history prod.inject)\n moreover have \"Deliver (i, Store e1 mo i) \\ set (history j)\"\n using assms(1) assms(2) prefix_msg_in_history by auto\n ultimately show ?thesis using assms\n by (metis Pair_inject delivery_has_a_cause msg_id_unique operation.simps(5) \n prefix_elem_to_carriers prefix_of_appendD prod.sel(1))\nqed \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/IMAP-CRDT/IMAP-proof-independent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093585306515, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.2510938864035783}} {"text": "theory SINVAR_NoRefl_impl\nimports SINVAR_NoRefl \"../TopoS_Interface_impl\"\nbegin\n\ncode_identifier code_module SINVAR_NoRefl_impl => (Scala) SINVAR_NoRefl\n\n\nsubsubsection \\SecurityInvariant NoRefl List Implementation\\\n\nfun sinvar :: \"'v list_graph \\ ('v \\ node_config) \\ bool\" where\n \"sinvar G nP = (\\ (s,r) \\ set (edgesL G). s = r \\ nP s = Refl)\"\n\n\ndefinition NoRefl_offending_list:: \"'v list_graph \\ ('v \\ node_config) \\ ('v \\ 'v) list list\" where\n \"NoRefl_offending_list G nP = (if sinvar G nP then\n []\n else \n [ [e \\ edgesL G. case e of (e1,e2) \\ e1 = e2 \\ nP e1 = NoRefl] ])\"\n\n\n\ndefinition \"NetModel_node_props P = (\\ i. (case (node_properties P) i of Some property \\ property | None \\ SINVAR_NoRefl.default_node_properties))\"\n\n\ndefinition \"NoRefl_eval G P = (wf_list_graph G \\\n sinvar G (SecurityInvariant.node_props SINVAR_NoRefl.default_node_properties P))\"\n\n\ninterpretation NoRefl_impl:TopoS_List_Impl \n where default_node_properties=SINVAR_NoRefl.default_node_properties\n and sinvar_spec=SINVAR_NoRefl.sinvar\n and sinvar_impl=sinvar\n and receiver_violation=SINVAR_NoRefl.receiver_violation\n and offending_flows_impl=NoRefl_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=NoRefl_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(simp add: TopoS_NoRefl list_graph_to_graph_def)\n apply(rule conjI)\n apply(simp add: list_graph_to_graph_def NoRefl_offending_set NoRefl_offending_set_def NoRefl_offending_list_def)\n apply(rule conjI)\n apply(simp only: NetModel_node_props_def)\n apply(metis NoRefl.node_props.simps NoRefl.node_props_eq_node_props_formaldef)\n apply(simp only: NoRefl_eval_def)\n apply(simp add: TopoS_eval_impl_proofrule[OF TopoS_NoRefl])\n apply(simp add: list_graph_to_graph_def)\ndone\n\n\nsubsubsection \\PolEnforcePoint packing\\\n definition SINVAR_LIB_NoRefl :: \"('v::vertex, node_config) TopoS_packed\" where\n \"SINVAR_LIB_NoRefl \\ \n \\ nm_name = ''NoRefl'', \n nm_receiver_violation = SINVAR_NoRefl.receiver_violation,\n nm_default = SINVAR_NoRefl.default_node_properties, \n nm_sinvar = sinvar,\n nm_offending_flows = NoRefl_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = NoRefl_eval\n \\\"\n interpretation SINVAR_LIB_NoRefl_interpretation: TopoS_modelLibrary SINVAR_LIB_NoRefl\n SINVAR_NoRefl.sinvar\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_NoRefl_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\ntext \\Examples\\\n\n definition example_net :: \"nat list_graph\" where\n \"example_net \\ \\ nodesL = [1::nat,2,3], \n edgesL = [(1,2),(2,2),(2,1),(1,3)] \\\"\n lemma \"wf_list_graph example_net\" by eval\n \n definition example_conf where\n \"example_conf \\ ((\\e. SINVAR_NoRefl.default_node_properties)(2:= Refl))\" \n \n lemma \"sinvar example_net example_conf\" by eval\n lemma \"NoRefl_offending_list example_net (\\e. SINVAR_NoRefl.default_node_properties) = [[(2, 2)]]\" by eval\n\n\nhide_const (open) NetModel_node_props\nhide_const (open) sinvar\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_NoRefl_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2508491276625876}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory AfsFsopR\nimports\n \"../adt/BilbyT\"\n \"../adt/VfsT\"\n \"../spec/AfsS\"\n \"../spec/AfsInvS\"\n \"../spec/OstoreInvS\"\nbegin\n\ntext {*\n Relation between the abstract FS of the correctness\n spec and the FS implemented by the Fsop component relying on\n the object store. \n\nThe object store is a projection from its internal state to a\nmapping from OID to Object (ostore_map).\nEach ostore update is a function update on the ostore_map and can non-deterministically\nbe synchronised to medium. Synchronisation is similar to correctness spec level,\napplying all updates to ostore_map. Refinement proof (fsop_sync/ostore_sync) should be easy.\nEach update should have a matching update at correctness spec level and applying all\nand sequentially applying updates on both AFS and OstoreMap should yield an element\nthat satisfy the relation afs_fsop_sr.\n\n*}\n\ndefinition\n obj_inode_type_to_afs_type :: \"ObjInode\\<^sub>T \\ afs_inode \\ afs_inode_type\"\nwhere\n \"obj_inode_type_to_afs_type i afsinode \\ (if S_ISREG (ObjInode.mode\\<^sub>f i) then IReg (i_data afsinode) else\n (if S_ISDIR (ObjInode.mode\\<^sub>f i) then IDir (i_dir afsinode) else\n (\\ \\ if S_ISLNK (mode<^sub>f i) then \\ ILnk (i_path afsinode) \\ \\else\n undefined\\)))\" \n\ndefinition\n obj_inode_to_afs_inode :: \"Obj\\<^sub>T \\ afs_inode \\ afs_inode\"\nwhere\n \"obj_inode_to_afs_inode obj afsinode \\\n (let i = obj_oinode obj in\n \\i_type = obj_inode_type_to_afs_type i afsinode,\n i_ino = inum_from_obj_id $ ObjInode.id\\<^sub>f i,\n i_nlink = ObjInode.nlink\\<^sub>f i,\n i_size = ObjInode.size\\<^sub>f i,\n i_mtime = ObjInode.mtime_sec\\<^sub>f i,\n i_ctime = ObjInode.ctime_sec\\<^sub>f i,\n i_uid = ObjInode.uid\\<^sub>f i,\n i_gid = ObjInode.gid\\<^sub>f i,\n i_mode = ObjInode.mode\\<^sub>f i,\n i_flags = ObjInode.flags\\<^sub>f i\\)\"\n \n\ntext {*\n Relation between a AFS file and a file in the object store.\n A file in the correctness spec corresponds to two type of objects\n stored in the object store:\n - An inode object where file attributes are stored, including the\n size (i_data part is irrelevant)\n - Multiple data objects that contain the data stored in the file.\n Each data object contains a \"block\" of data of BILBYFS_BLOCK_SIZE\n bytes. The block index parameter of ObjIdData indicates the index\n of the block in the file. (Where index i is byte offset\n i \\ BILBYFS_BLOCK_SIZE in the file.)\n We currently do not allow holes.\n *}\n\ndefinition\n file_eq :: \"afs_inode \\ ostore_map \\ bool\"\nwhere\n \"file_eq file os \\\n (\\blk_idx blk. (blk_idx < length (i_data file) \\ blk = (i_data file) ! blk_idx) \\\n blk = (\\wa $ odata\\<^sub>f $ obj_odata $ the $ os $ obj_id_data_mk (i_ino file, of_nat blk_idx)))\" \n\ndefinition\n get_dent_type :: \"afs_map \\ Ino \\ U8\"\nwhere\n \"get_dent_type afs ino \\\n (case (i_type $ the $ afs ino) of\n IReg _ \\ bilbyFsItypeReg | IDir _ \\ bilbyFsItypeDir | ILnk _ \\ bilbyFsItypeLnk )\"\n\ntext {*\n Relation between a AFS directory and a directory in the object store.\n At the correctness spec level directories are a an inode that contains\n a bunch of attributes and a mapping from name to inode number.\n At the Fsop level, directories are:\n - An inode for attributes such as mode, owner...\n - Multiple directory entry arrays (dentarrs).\n Each directory entry contains a name, an inode number and a type.\n The idea is that in order to have a quick lookup for a name in a\n directory, we address directory entries using a hash of the\n name they contain. As different names can have the same hash,\n we group all hash collisions together within an array of directory\n entry (dentarr).\n Mapping entries on AFS directories and dentarr objects attached to\n Fsop directories have to match one another.\n Additionally, directory entries at Fsop level contain a type\n attribute which indicates the type of the inode referred by the\n inode number. This type attribute is a duplicated piece of\n information also contained in the inode itself, but having\n it is necessary for performance reason. When listing a directory\n reading an extra inode for each directory entry would be orders\n of magnitude slower.\n *}\n\ndefinition\n dir_eq :: \"afs_inode \\ afs_map \\ostore_map \\ bool\"\nwhere\n \"dir_eq dir afs os \\\n (\\name. \n (let obj = os $ obj_id_dentarr_mk (i_ino dir, name);\n entries = stripNone $ \\a $ ObjDentarr.entries\\<^sub>f $ obj_odentarr $ the obj in\n (case i_dir dir $ \\wa name of\n option.Some in_ino \\\n (case obj of\n option.Some _ \\\n {e \\ set entries. ObjDentry.ino\\<^sub>f e = in_ino \\ ObjDentry.name\\<^sub>f e = name} =\n {\\ino\\<^sub>f = in_ino, type\\<^sub>f = get_dent_type afs in_ino, nlen\\<^sub>f = u32_to_u16 $ wordarray_length name, name\\<^sub>f = name \\} |\n option.None \\ False)\n | option.None \\\n (case obj of\n option.Some _ \\\n {e \\ set entries. ObjDentry.name\\<^sub>f e = name} = {}\n | option.None \\ True))))\"\n\ntext {* Relation between a AFS symlinks and a symlinks in the object store.\n This relation is quite similar to files except that symbolic links can\n only use a single data block to store the symbolic link path.\n*}\ndefinition\n symlink_eq :: \"afs_inode \\ ostore_map \\ bool\"\nwhere\n \"symlink_eq symlink os \\\n i_path symlink = (\\wa $ odata\\<^sub>f $ obj_odata $ the $ os $ obj_id_data_mk (i_ino symlink, 0))\"\n\ntext {*\n Domain equivalence ensures that there is an inode in the AFS\n iff there is an existing inode at Fsop level.\n*}\ndefinition\n afs_fsop_dom_eq :: \"afs_map \\ ostore_map \\ bool\"\nwhere\n \"afs_fsop_dom_eq afs os \\ dom afs = dom (\\ino. os (obj_id_inode_mk ino))\"\n\ntext {*\n Content equivalence\n*}\ndefinition\n afs_fsop_content_eq :: \"afs_map \\ ostore_map \\ bool\"\nwhere\n \"afs_fsop_content_eq afs os \\ \n (\\ino \\ dom afs.\n let inode = (the $ afs ino);\n oino = (the $ os $ obj_id_inode_mk ino) in\n obj_inode_to_afs_inode oino inode = inode \\\n (case i_type inode of\n IReg file_data \\ file_eq inode os |\n IDir dir \\ dir_eq inode afs os |\n ILnk path \\ symlink_eq inode os))\"\n\ndefinition\n afs_fsop_match :: \"afs_map \\ ostore_map \\ bool\"\nwhere\n \"afs_fsop_match afs os \\ afs_fsop_dom_eq afs os \\ afs_fsop_content_eq afs os\"\n \ntext {*\n Definitions useful to describe parameters, pre/post conditions of\n refinement statements\n*}\ndefinition\n vnode_afs_inode_consistency :: \"vnode \\ afs_inode \\ bool\"\nwhere\n \"vnode_afs_inode_consistency v i \\\n v_ino v = i_ino i \\\n v_nlink v = i_nlink i \\\n v_mtime v = i_mtime i \\\n v_ctime v = i_ctime i \\\n v_uid v = i_uid i \\\n v_gid v = i_gid i \\\n v_mode v = i_mode i\"\n\ndefinition\n is_valid_vdir :: \"vnode \\ (Ino \\ afs_inode) \\ bool\"\nwhere\n \"is_valid_vdir vdir afs \\\n v_ino vdir \\ dom afs \\\n (v_mode vdir AND s_IFMT = s_IFDIR) \\\n afs_inode_is_dir (i_type $ the $ afs $ v_ino vdir) \\\n vnode_afs_inode_consistency vdir (the $ afs $ v_ino vdir)\"\n\nlemma vdir_dir_consistent:\n \"is_valid_vdir vdir afs \\ vnode_afs_inode_consistency vdir (the $ afs $ v_ino vdir)\"\n by (clarsimp simp: is_valid_vdir_def dom_def)\n\nlemma vdir_is_dir:\n \"\\ is_valid_vdir vdir afs \\ \\ afs_inode_is_dir (i_type $ the $ afs (v_ino vdir))\"\n by (clarsimp simp: is_valid_vdir_def)\n\ntext {* Refinement proof of the operation sync. *}\n\ndefinition\n match_afs_data_fs_state :: \"afs_state \\ FsState\\<^sub>T \\ bool\"\nwhere\n \"match_afs_data_fs_state afs_data fs_st \\\n a_is_readonly afs_data = (is_ro\\<^sub>f $ fsop_st\\<^sub>f fs_st)\"\n\ndefinition\n afs_fsop_match_step_updates :: \"afs_map \\ (afs_map \\ afs_map) list \\\n ostore_map \\ (ostore_map \\ ostore_map) list \\ bool\"\nwhere\n \"afs_fsop_match_step_updates afs afs_updates os os_updates \\\n length os_updates = length afs_updates \\\n (\\n \\ length os_updates.\n afs_fsop_match (a_afs_updated_n n afs afs_updates)\n (apply_n_updates n os os_updates))\"\n\ndefinition\n \"afmsu afs_data os_st \\ \n afs_fsop_match_step_updates\n (a_medium_afs afs_data) (a_medium_updates afs_data) \n (\\_ostore_medium os_st) (\\_updates os_st)\"\n\ndefinition\n \"afs_inv_steps afs \\\n (\\n \\ length (a_medium_updates afs).\n afs_inv (a_afs_updated_n n (a_medium_afs afs) (a_medium_updates afs)))\"\n\nlemma afs_inv_steps_updated_afsD:\n \"afs_inv_steps afs \\ afs_inv (updated_afs afs)\"\n apply (simp add: updated_afs_def)\n apply (simp add: afs_inv_steps_def)\n apply (erule_tac x=\"length (a_medium_updates afs)\" in allE)\n apply (fastforce simp add: a_afs_updated_def)\n done\n\ntext{* In the success case, we ensure that the updates match and that the on-medium\n states match too. Note that simply applying the updates on both sides and ensuring\n that the resulting states match is not enough, both syncs could have applied a different\n number of updates. *}\ndefinition\n afs_fsop_rel :: \"afs_state \\ FsState\\<^sub>T \\ bool\"\nwhere\n \"afs_fsop_rel afs_data fs_st \\\n inv_mount_st (FsState.mount_st\\<^sub>f fs_st) \\\n afs_inv_steps afs_data \\ \n (let os_st = ostore_st\\<^sub>f fs_st in\n afmsu afs_data os_st \\\n inv_ostore (mount_st\\<^sub>f fs_st) os_st \\ inv_\\_ostore (\\_ostore_uptodate os_st) \\\n match_afs_data_fs_state afs_data fs_st)\"\n\nlemma afs_fsop_rel_inv_ostoreD:\n \"afs_fsop_rel afs_data fs_st \\ inv_ostore (mount_st\\<^sub>f fs_st) (ostore_st\\<^sub>f fs_st)\"\n by (clarsimp simp: afs_fsop_rel_def Let_def) \n(*\nlemma afs_fsop_rel_inv_stepD:\n\"afs_fsop_rel afs_data fs_st \\ inv_\\_step_updates (ostore_st\\<^sub>f fs_st)\"\nby (clarsimp simp: afs_fsop_rel_def Let_def) \n*)\nlemma afs_fsop_rel_inv_\\_ostoreD:\n\"afs_fsop_rel afs_data fs_st \\ inv_\\_ostore (\\_ostore_uptodate (ostore_st\\<^sub>f fs_st))\"\nby (clarsimp simp: afs_fsop_rel_def Let_def) \n\nlemmas afs_fsop_rel_simps = \n afs_fsop_rel_def \n match_afs_data_fs_state_def\n afmsu_def\n Let_def\n afs_fsop_match_step_updates_def\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/refine/AfsFsopR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2508491276625876}} {"text": "theory PetersonLitmus\n imports Examples \nbegin\n\ndatatype globals = X | Y | T\nrecord aux = S :: bool\n\nlemma thread0:\n \"FNBEGIN\n R: (\\<^sup>1\\X\\ \\ \\<^sup>2\\<^sup>aS \\ \\<^sup>1\\<^sup>aS) \\ \\<^sup>1\\X\\ = \\<^sup>2\\X\\ \\ (\\<^sup>2\\T\\ = \\<^sup>1\\T\\ \\ (\\<^sup>1\\T\\ \\ \\ \\<^sup>2\\T\\ \\ (\\<^sup>1\\X\\ \\ \\\\<^sup>2\\<^sup>aS)))\n G: (\\<^sup>1\\Y\\ \\ \\<^sup>1\\<^sup>aS \\ \\<^sup>2\\<^sup>aS) \\ \\<^sup>1\\Y\\ = \\<^sup>2\\Y\\ \\ (\\<^sup>2\\T\\ = \\<^sup>1\\T\\ \\ (\\\\<^sup>1\\T\\ \\ \\<^sup>2\\T\\ \\ (\\<^sup>1\\Y\\ \\ \\<^sup>2\\<^sup>aS)))\n P: True\n {\n \\X\\ := #True;\n fence;\n \\T\\ := #True :\\<^sub>a \\<^sup>aS := True;\n fence;\n \\<^bold>r0 := \\Y\\ :\\<^sub>a \\<^sup>aS := (\\<^sup>aS \\ \\<^sup>0\\Y\\);\n \\<^bold>r1 := \\T\\\n }\n Q: (\\<^sup>0\\X\\ \\ (\\<^sup>aS \\ \\<^sup>0\\<^bold>r(0 :: nat) \\ \\<^sup>0\\<^bold>r1))\n FNEND\" \n apply (unfold fn_valid.simps, intro conjI)\n\n (* Stability of Q *)\n apply (auto simp: glb_def step\\<^sub>t_def stable_def)[1]\n\n (* Wellformedness of R & G *)\n apply (auto simp: transitive_def reflexive_def)[3]\n\n (* Guarantees of each atomic action *)\n apply (auto simp: wp\\<^sub>r_def st_upd_def step_def glb_def aux_upd_def)[1]\n\n (* WP *)\n apply simp\n apply (clarsimp simp: stabilize_def st_upd_def glb_def aux_upd_def rg_def)\n apply (meson less_numeral_extra(3))\n\n (* RIF *)\n apply rif_eval\n apply (clarsimp simp: expand_points_def checks_def, unfold chk_def)\n apply (intro allI conjI impI)\n apply (auto simp: guar_def st_upd_def step_def glb_def aux_upd_def liftg_def)[1]\n apply (rule wp_split[where ?f=\"\\a b. b(Glb T :=\\<^sub>s st a (Glb T), Reg 1 :=\\<^sub>s st a (Reg 1))\"]; clarsimp simp: step\\<^sub>t_def)\n apply (intro conjI impI state_eq; clarsimp simp add: glb_def; metis rg_def)\n by (intro conjI impI state_eq; clarsimp simp add: glb_def)\n\nlemma thread1:\n \"FNBEGIN\n R: (\\<^sup>1\\Y\\ \\ \\<^sup>1\\<^sup>aS \\ \\<^sup>2\\<^sup>aS) \\ \\<^sup>1\\Y\\ = \\<^sup>2\\Y\\ \\ (\\<^sup>2\\T\\ = \\<^sup>1\\T\\ \\ (\\\\<^sup>1\\T\\ \\ \\<^sup>2\\T\\ \\ (\\<^sup>1\\Y\\ \\ \\<^sup>2\\<^sup>aS)))\n G: (\\<^sup>1\\X\\ \\ \\<^sup>2\\<^sup>aS \\ \\<^sup>1\\<^sup>aS) \\ \\<^sup>1\\X\\ = \\<^sup>2\\X\\ \\ (\\<^sup>2\\T\\ = \\<^sup>1\\T\\ \\ (\\<^sup>1\\T\\ \\ \\ \\<^sup>2\\T\\ \\ (\\<^sup>1\\X\\ \\ \\\\<^sup>2\\<^sup>aS)))\n P: True\n {\n \\Y\\ := #True;\n fence;\n \\T\\ := #False :\\<^sub>a \\<^sup>aS := False;\n fence;\n \\<^bold>r0 := \\X\\ :\\<^sub>a \\<^sup>aS := (\\<^sup>aS \\ \\\\<^sup>0\\X\\);\n \\<^bold>r1 := (!\\T\\)\n }\n Q: (\\<^sup>0\\Y\\ \\ (\\\\<^sup>aS \\ \\<^sup>0\\<^bold>r(0 :: nat) \\ \\<^sup>0\\<^bold>r1))\n FNEND\" \n apply (unfold fn_valid.simps, intro conjI)\n\n (* Stability of Q *)\n apply (auto simp: glb_def step\\<^sub>t_def stable_def)[1]\n\n (* Wellformedness of R & G *)\n apply (auto simp: transitive_def reflexive_def)[3]\n\n (* Guarantees of each atomic action *)\n apply (auto simp: wp\\<^sub>r_def st_upd_def step_def glb_def aux_upd_def)[1]\n\n (* WP *)\n apply simp\n apply (clarsimp simp: stabilize_def st_upd_def glb_def aux_upd_def rg_def c_neg_def)\n apply (intro conjI impI)\n prefer 2\n apply (meson less_numeral_extra(3))\n apply auto[1]\n\n (* RIF *)\n apply rif_eval\n apply (clarsimp simp: expand_points_def checks_def, unfold chk_def)\n apply (intro allI conjI impI)\n apply (auto simp: guar_def st_upd_def step_def glb_def aux_upd_def liftg_def)[1]\n apply (rule wp_split[where ?f=\"\\a b. b(Glb T :=\\<^sub>s st a (Glb T), Reg 1 :=\\<^sub>s st a (Reg 1))\"]; clarsimp simp: c_neg_def step\\<^sub>t_def)\n apply (intro conjI impI state_eq; clarsimp simp add: glb_def; metis rg_def)\n by (intro conjI impI state_eq; clarsimp simp add: glb_def)\n\nend", "meta": {"author": "UQ-PAC", "repo": "wmm-rg", "sha": "7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2", "save_path": "github-repos/isabelle/UQ-PAC-wmm-rg", "path": "github-repos/isabelle/UQ-PAC-wmm-rg/wmm-rg-7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2/SimAsm/Examples/PetersonLitmus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2506222908122817}} {"text": "section\\Network Security Policy Verification\\\ntheory Network_Security_Policy_Verification\nimports\n TopoS_Interface\n TopoS_Interface_impl\n TopoS_Library\n TopoS_Composition_Theory\n TopoS_Stateful_Policy\n TopoS_Composition_Theory_impl\n TopoS_Stateful_Policy_Algorithm\n TopoS_Stateful_Policy_impl\n TopoS_Impl\nbegin\n\n\n\nsection\\A small Tutorial\\\n\ntext\\We demonstrate usage of the executable theory.\\\ntext\\Everything that is indented and starts with `Interlude:' summarizes the main correctness proofs and can be skipped if only the implementation is concerned\\\n\nsubsection\\Policy\\\ntext\\The secuity policy is a directed graph.\\\ndefinition policy :: \"nat list_graph\" where\n \"policy \\ \\ nodesL = [1,2,3],\n edgesL = [(1,2), (2,2), (2,3)] \\\"\n\ntext\\It is syntactically well-formed\\\nlemma wf_list_graph_policy: \"wf_list_graph policy\" by eval\n\ntext\\In contrast, this is not a syntactically well-formed graph.\\\nlemma \"\\ wf_list_graph \\ nodesL = [1,2]::nat list, edgesL = [(1,2), (2,2), (2,3)] \\\" by eval\n\ntext\\Our @{const policy} has three rules.\\\nlemma \"length (edgesL policy) = 3\" by eval\n\nsubsection\\Security Invariants\\\ntext\\We construct a security invariant. Node @{term \"2::nat\"} has confidential data\\\n\ndefinition BLP_security_levels :: \"nat \\ SINVAR_BLPtrusted.node_config\"where\n \"BLP_security_levels \\ [2 \\ \\ security_level = 1, trusted = False \\]\"\n\ndefinition BLP_m::\"(nat SecurityInvariant)\" where\n \"BLP_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\ \n node_properties = BLP_security_levels\n \\ ''Two has confidential information''\"\n\n\n text\\Interlude: @{const BLP_m} is a valid implementation of a SecurityInvariant\\\n definition BLP_m_spec :: \"nat SecurityInvariant_configured option\"where\n \"BLP_m_spec \\ new_configured_SecurityInvariant (\n SINVAR_BLPtrusted.sinvar,\n SINVAR_BLPtrusted.default_node_properties,\n SINVAR_BLPtrusted.receiver_violation,\n SecurityInvariant.node_props SINVAR_BLPtrusted.default_node_properties \\ \n node_properties = BLP_security_levels\n \\)\"\n text\\Fist, we need to show that the formal definition obeys all requirements, @{const new_configured_SecurityInvariant} verifies this. To double check, we manually give the configuration.\\\n lemma BLP_m_spec: assumes \"nP = (\\ v. (case BLP_security_levels v of Some c \\ c | None \\ SINVAR_BLPtrusted.default_node_properties))\"\n shows \"BLP_m_spec = Some \\ \n c_sinvar = (\\G. SINVAR_BLPtrusted.sinvar G nP),\n c_offending_flows = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows SINVAR_BLPtrusted.sinvar G nP),\n c_isIFS = SINVAR_BLPtrusted.receiver_violation\n \\\" (is \"BLP_m_spec = Some ?Spec\")\n proof - \n have NetModelLib: \"TopoS_modelLibrary SINVAR_LIB_BLPtrusted SINVAR_BLPtrusted.sinvar\"\n by(unfold_locales)\n from assms have nP: \"nP = nm_node_props SINVAR_LIB_BLPtrusted \\ \n node_properties = BLP_security_levels\n \\\" by(simp add: fun_eq_iff SINVAR_LIB_BLPtrusted_def SINVAR_BLPtrusted_impl.NetModel_node_props_def)\n \n have \"BLP_m_spec = new_configured_SecurityInvariant (SINVAR_BLPtrusted.sinvar, SINVAR_BLPtrusted.default_node_properties, SINVAR_BLPtrusted.receiver_violation, nP)\"\n unfolding BLP_m_spec_def nP by(simp add: SINVAR_BLPtrusted_impl.NetModel_node_props_def SINVAR_LIB_BLPtrusted_def)\n also with TopoS_modelLibrary_yields_new_configured_SecurityInvariant[OF NetModelLib nP]\n have \"\\ = Some ?Spec\" by (simp add: SINVAR_LIB_BLPtrusted_def)\n finally show ?thesis by blast\n qed\n lemma valid_reqs_BLP: \"valid_reqs [the BLP_m_spec]\"\n by(simp add: valid_reqs_def)(metis BLP_m_spec_def BLPtrusted_impl.spec new_configured_SecurityInvariant.simps new_configured_SecurityInvariant_sound option.distinct(1) option.exhaust_sel)\n\n\n text\\Interlude: While @{const BLP_m} is executable code, we will now show that this executable code complies with its formal definition.\\\n lemma complies_BLP: \"SecurityInvariant_complies_formal_def BLP_m (the BLP_m_spec)\"\n unfolding BLP_m_def\n apply(rule new_configured_list_SecurityInvariant_complies)\n apply(simp_all add: BLP_m_spec_def)\n apply(unfold_locales)\n by(simp add: fun_eq_iff SINVAR_LIB_BLPtrusted_def SINVAR_BLPtrusted_impl.NetModel_node_props_def)\n\n\n\ntext\\We define the list of all security invariants of type @{typ \"nat SecurityInvariant list\"}.\n The type @{typ nat} is because the policy's nodes are of type @{typ nat}.\\\ndefinition \"security_invariants = [BLP_m]\"\n\n\ntext\\We can see that the policy does not fulfill the security invariants.\\\nlemma \"\\ all_security_requirements_fulfilled security_invariants policy\" by eval\n\ntext\\We ask why. Obviously, node 2 leaks confidential data to node 3.\\\nvalue \"implc_get_offending_flows security_invariants policy\"\nlemma \"implc_get_offending_flows security_invariants policy = [[(2, 3)]]\" by eval\n\n text\\Interlude: the implementation @{const implc_get_offending_flows} corresponds to the formal definition @{const get_offending_flows}\\\n lemma \"set ` set (implc_get_offending_flows (get_impl [(BLP_m, the BLP_m_spec)]) policy) = get_offending_flows (get_spec [(BLP_m, the BLP_m_spec)]) (list_graph_to_graph policy)\"\n apply(rule implc_get_offending_flows_complies)\n by(simp_all add: complies_BLP wf_list_graph_policy)\n \n\ntext\\\nVisualization of the violation (only in interactive mode)\n\\\nML_val\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"policy\"};\n\\\n\ntext\\Experimental: the config (only one) can be added to the end.\\\nML_val\\\nvisualize_graph_header @{context} @{term \"security_invariants\"} @{term \"policy\"} @{term \"BLP_security_levels\"};\n\\\n\n\ntext\\\nThe policy has a flaw. We throw it away and generate a new one which fulfills the invariants.\n\\\ndefinition \"max_policy = generate_valid_topology security_invariants \\nodesL = nodesL policy, edgesL = List.product (nodesL policy) (nodesL policy) \\\"\n\n text\\Interlude: the implementation @{const implc_get_offending_flows} corresponds to the formal definition @{const get_offending_flows}\\\n thm generate_valid_topology_complies\n\n text\\Interlude: the formal definition is sound\\\n thm generate_valid_topology_sound\n\n text\\Here, it is also complete\\\n lemma \"wf_graph G \\ max_topo [the BLP_m_spec] (TopoS_Composition_Theory.generate_valid_topology [the BLP_m_spec] (fully_connected G))\"\n apply(rule generate_valid_topology_max_topo[OF valid_reqs_BLP])\n apply(assumption)\n apply(simp add: BLP_m_spec)\n by blast\n\n\ntext\\Calculating the maximum policy\\\nvalue \"max_policy\"\nlemma \"max_policy = \\nodesL = [1, 2, 3], edgesL = [(1, 1), (1, 2), (1, 3), (2, 2), (3, 1), (3, 2), (3, 3)]\\\" by eval\n\n\ntext\\\nVisualizing the maximum policy (only in interactive mode)\n\\\nML\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"max_policy\"};\n\\\n\ntext\\Of course, all security invariants hold for the maximum policy.\\\nlemma \"all_security_requirements_fulfilled security_invariants max_policy\" by eval\n\n\nsubsection\\A stateful implementation\\\ntext\\We generate a stateful policy\\\ndefinition \"stateful_policy = generate_valid_stateful_policy_IFSACS_2 policy security_invariants\"\n\ntext\\When thinking about it carefully, no flow can be stateful without introducing an information leakage here!\\\nvalue \"stateful_policy\"\nlemma \"stateful_policy = \\hostsL = [1, 2, 3], flows_fixL = [(1, 2), (2, 2), (2, 3)], flows_stateL = []\\\" by eval\n\n text\\Interlude: the stateful policy we are computing fulfills all the necessary properties\\\n thm generate_valid_stateful_policy_IFSACS_2_complies\n\n (*the individual algorithms fir IFS/ACS return a maximum policy*)\n thm filter_compliant_stateful_ACS_correct filter_compliant_stateful_ACS_maximal\n thm filter_IFS_no_violations_correct filter_IFS_no_violations_maximal\n\ntext\\\nVisualizing the stateful policy (only in interactive mode)\n\\\nML_val\\\nvisualize_edges @{context} @{term \"flows_fixL stateful_policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL stateful_policy\"})] \"\"; \n\\\n\n\ntext\\This is how it would look like if @{term \"(3,1)\"} were a stateful flow\\\nML_val\\\nvisualize_edges @{context} @{term \"flows_fixL stateful_policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"[(3::nat,1::nat)]\"})] \"\"; \n\\\n\n\nhide_const policy security_invariants max_policy stateful_policy\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Network_Security_Policy_Verification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.25062227818932004}} {"text": "section \\Instantiate CFG locale with While CFG\\\n\ntheory Interpretation imports \n WCFG \n \"../Basic/CFGExit\" \nbegin\n\nsubsection \\Instatiation of the \\CFG\\ locale\\\n\nabbreviation sourcenode :: \"w_edge \\ w_node\"\n where \"sourcenode e \\ fst e\"\n\nabbreviation targetnode :: \"w_edge \\ w_node\"\n where \"targetnode e \\ snd(snd e)\"\n\nabbreviation kind :: \"w_edge \\ state edge_kind\"\n where \"kind e \\ fst(snd e)\"\n\n\ndefinition valid_edge :: \"cmd \\ w_edge \\ bool\"\n where \"valid_edge prog a \\ prog \\ sourcenode a -kind a\\ targetnode a\"\n\ndefinition valid_node ::\"cmd \\ w_node \\ bool\"\n where \"valid_node prog n \\ \n (\\a. valid_edge prog a \\ (n = sourcenode a \\ n = targetnode a))\"\n\n\nlemma While_CFG_aux:\n \"CFG sourcenode targetnode (valid_edge prog) Entry\"\nproof(unfold_locales)\n fix a assume \"valid_edge prog a\" and \"targetnode a = (_Entry_)\"\n obtain nx et nx' where \"a = (nx,et,nx')\" by (cases a) auto\n with \\valid_edge prog a\\ \\targetnode a = (_Entry_)\\ \n have \"prog \\ nx -et\\ (_Entry_)\" by(simp add:valid_edge_def)\n thus False by fastforce\nnext\n fix a a'\n assume assms:\"valid_edge prog a\" \"valid_edge prog a'\"\n \"sourcenode a = sourcenode a'\" \"targetnode a = targetnode a'\"\n obtain x et y where [simp]:\"a = (x,et,y)\" by (cases a) auto\n obtain x' et' y' where [simp]:\"a' = (x',et',y')\" by (cases a') auto\n from assms have \"et = et'\"\n by(fastforce intro:WCFG_edge_det simp:valid_edge_def)\n with \\sourcenode a = sourcenode a'\\ \\targetnode a = targetnode a'\\\n show \"a = a'\" by simp\nqed\n\ninterpretation While_CFG:\n CFG sourcenode targetnode kind \"valid_edge prog\" Entry\n for prog\n by(rule While_CFG_aux)\n\n\nlemma While_CFGExit_aux:\n \"CFGExit sourcenode targetnode kind (valid_edge prog) Entry Exit\"\nproof(unfold_locales)\n fix a assume \"valid_edge prog a\" and \"sourcenode a = (_Exit_)\"\n obtain nx et nx' where \"a = (nx,et,nx')\" by (cases a) auto\n with \\valid_edge prog a\\ \\sourcenode a = (_Exit_)\\ \n have \"prog \\ (_Exit_) -et\\ nx'\" by(simp add:valid_edge_def)\n thus False by fastforce\nnext\n have \"prog \\ (_Entry_) -(\\s. False)\\<^sub>\\\\ (_Exit_)\" by(rule WCFG_Entry_Exit)\n thus \"\\a. valid_edge prog a \\ sourcenode a = (_Entry_) \\\n targetnode a = (_Exit_) \\ kind a = (\\s. False)\\<^sub>\\\"\n by(fastforce simp:valid_edge_def)\nqed\n\ninterpretation While_CFGExit:\n CFGExit sourcenode targetnode kind \"valid_edge prog\" Entry Exit\n for prog\nby(rule While_CFGExit_aux)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/While/Interpretation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.25057415312705633}} {"text": "(*\n This file contains the update semantics to C correspondence lemmas for word array functions\n*)\ntheory SumRandom_UpdCCorres\n imports SumRandom_UAbsFun\nbegin\n\ncontext SumRandom begin\n\nsection \"Correspondence Lemmas Between Update Semantics and C\"\n\nsubsection \"random_seed\"\nthm update_sem_init.abs_rel_def\nthm afun_corres abs_rel_def\n\nthm \\_def\nlemma (in update_sem_init) abs_rel_def':\n \"abs_rel \\' srel afun_name \\' afun_mon\n = (\\\\ st x x' r' w'. (\\, st) \\ srel \\ val_rel x x'\n \\ \\', \\ \\ x :u fst (snd (\\' afun_name)) \\r', w'\\\n \\ \\\\s0. s0 = st\\ \n afun_mon x' \n \\\\y' s'. \\\\' y. \\' afun_name (\\, x) (\\', y) \\ (\\',s') \\ srel \\ val_rel y y'\\!)\" \n by (fastforce simp: abs_rel_def validNF_def valid_def no_fail_def)\nfind_theorems name:\"rand'_\"\nthm random_aux_Seed_C_def\nterm rand'\nthm rand_with_seed'_def\n\nlemma \"\\ \\s. True \\ rand' \\\\r s. True\\!\" oops\nlemma rand_with_seed_C_spec:\n \"\\\\h. True \\ \n rand_with_seed' x' \n \\\\r h'. True \\!\" \n unfolding rand_with_seed'_def\n apply wp \n sorry\n\nlemma rand_with_seed_abs_rel_0 : \n \"abs_rel \\ state_rel ''rand_with_seed'' \\u0 rand_with_seed'\"\n apply (clarsimp simp add: abs_rel_def' )\n\n apply wpsimp\n sorry\nlemma rand_with_seed_corres_i: \n\"(\\i \\ v' \\' \\ st.\n i < length \\ \\\n val_rel (\\ ! i) v' \\\n \\' ! i = Some (fst (snd Random_seed_master_TypeProof.rand_with_seed_type)) \\\n update_sem_init.corres seed_abs_typing_u seed_abs_repr state_rel\n (App (AFun ''rand_with_seed'' []) (Var i)) \n (do x <- rand_with_seed' v';\n gets (\\s. x)\n od)\n \\ui \\\n \\\n \\' \\ st)\"\n apply (rule afun_corres)\n apply (simp add: abs_rel_def \\_def)\n apply clarsimp\n apply safe\n \n\n\n\n\nlemma rand_with_seed_corres:\n \"\\i \\ v' \\' \\ st.\n \\ i < length \\; \n val_rel (\\ ! i) v'; \n \\' ! i = option.Some (prod.fst (prod.snd (\\ ''random_with_seed'')));\n \\u ''random_with_seed''= rand_with_seed_u\\ \\ \n update_sem_init.corres \n seed_abs_typing_u \n seed_abs_repr \n state_rel\n (App (AFun ''random_with_seed'' []) (Var i))\n (do x <- random_seed_master_pp_inferred.rand_with_seed' v';\n gets (\\s. x)\n od)\n \\0' \\ \\ \\' \\ st\n \"\n apply (rule afun_corres)\n\nlemma upd_C_wordarray_put2_corres_gen:\n \"\\i \\ v' \\' \\ st.\n \\i < length \\; val_rel (\\ ! i) v'; \\' ! i = option.Some (prod.fst (prod.snd (\\ ''wordarray_put2_0'')));\n \\0' ''wordarray_put2_0'' = upd_wa_put2_0\\\n \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) (App (AFun ''wordarray_put2_0'' []) (Var i))\n (do x <- main_pp_inferred.wordarray_put2_0' v';\n gets (\\s. x)\n od)\n \\0' \\ \\ \\' \\ st\"\n apply (rule absfun_corres; simp?)\n apply (thin_tac \"\\' ! i = _\")\n apply (clarsimp simp: abs_fun_rel_def; rename_tac r w)\n apply (rotate_tac -1)\n apply (subst (asm) \\_def)\n apply (subst (asm) \\_def)\n apply (clarsimp simp: val_rel_simp wordarray_put2_0_type_def abbreviated_type_defs)\n apply (erule upd.u_t_recE)\n apply (erule upd.u_t_r_consE; clarsimp)+\n apply (erule upd.u_t_primE)+\n apply (subst (asm) lit_type.simps)+\n apply clarsimp\n apply (erule upd.u_t_r_emptyE)\n apply (erule upd.u_t_p_absE; simp)\n apply (frule wa_abs_typing_u_elims(1); clarsimp; rename_tac len arr)\n apply (rule conjI)\n apply (monad_eq simp: wordarray_put2_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def)\n apply (erule_tac x = \"t2_C.arr_C v'\" in allE)\n apply (erule_tac x = \"values_C (heap_WordArray_u32_C st (t2_C.arr_C v')) +\\<^sub>p uint (t2_C.idx_C v')\" in allE)\n apply (clarsimp simp: heap_rel_ptr_def heap_rel_ptr_w32_def wa_abs_repr_def is_valid_simp type_rel_simp)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = \"t2_C.idx_C v'\" in allE)+\n apply (clarsimp simp: val_rel_simp heap_simp type_rel_simp)\n apply clarsimp\n apply (monad_eq simp: upd_wa_put2_0_def)\n apply (case_tac \"idx_C v' < len\"; clarsimp)\n apply (rule conjI)\n apply (monad_eq simp: wordarray_put2_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta heap_rel_ptr_w32_meta)\n apply (monad_eq simp: wordarray_put2_0'_def)\n apply (frule_tac p = \"t2_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: val_rel_simp heap_simp is_valid_simp)\n apply (drule wa_abs_typing_u_elims(5))\n apply (erule_tac x = \"t2_C.idx_C v'\" in allE; clarsimp)\n apply (drule_tac upd_h = \"(heap_w32_update \n (\\x. x(values_C (heap_WordArray_u32_C st (t2_C.arr_C v')) +\\<^sub>p uint (idx_C v') := val_C v')) st)\" and\n x = \"(values_C (heap_WordArray_u32_C st (t2_C.arr_C v'))) +\\<^sub>p uint (idx_C v')\" and\n uv' = \"UPrim (LU32 (val_C v'))\" and uv = \"UPrim x\"\n in all_heap_rel_updE; simp?; clarsimp?)\n apply (clarsimp simp: type_rel_simp)\n apply (drule_tac upd_h = \"(heap_w32_update\n (\\x. x(values_C (heap_WordArray_u32_C st (t2_C.arr_C v')) +\\<^sub>p uint (idx_C v') := val_C v')) st)\" and\n x = \"(values_C (heap_WordArray_u32_C st (t2_C.arr_C v'))) +\\<^sub>p uint (idx_C v')\" and\n uv' = \"UPrim (LU32 (val_C v'))\" and uv = \"UPrim x\"\n in all_heap_rel_updE; simp?; clarsimp?)\n apply (rule conjI, clarsimp simp: val_rel_simp)\n apply clarsimp\n apply (rule FalseE)\n apply (cut_tac p = p and q = \"((values_C (heap_WordArray_u32_C st (t2_C.arr_C v'))) +\\<^sub>p uint (idx_C v'))\" in ptr_val_inj)\n apply (clarsimp simp: ptr_add_def)\n apply (monad_eq simp: wordarray_put2_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta)\n apply (frule_tac p = \"t2_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: val_rel_simp heap_simp is_valid_simp)\n done\n\nlemmas upd_C_wordarray_put2_corres = upd_C_wordarray_put2_corres_gen[rotated -1, of \\0, simplified fun_eq_iff]\n\nsubsection \"wordarray_length\"\n\nlemma upd_C_wordarray_length_corres_gen:\n\"\\i \\ v' \\' \\ st.\n \\i < length \\; val_rel (\\ ! i) v'; \\' ! i = option.Some (prod.fst (prod.snd (\\ ''wordarray_length_0'')));\n \\0' ''wordarray_length_0''= upd_wa_length_0\\\n \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) (App (AFun ''wordarray_length_0'' []) (Var i))\n (do x <- main_pp_inferred.wordarray_length_0' v';\n gets (\\s. x)\n od)\n \\0' \\ \\ \\' \\ st\"\n apply (rule absfun_corres; simp?)\n apply (clarsimp simp: abs_fun_rel_def; rename_tac r w)\n apply (thin_tac \"\\' ! i = _\")\n apply (rotate_tac -1)\n apply (subst (asm) \\_def)\n apply (subst (asm) \\_def)\n apply (clarsimp simp: val_rel_simp wordarray_length_0_type_def)\n apply (erule upd.u_t_p_absE; simp)\n apply (frule wa_abs_typing_u_elims(1); clarsimp; rename_tac len arr)\n apply (rule conjI)\n apply (monad_eq simp: wordarray_length_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def)\n apply (erule_tac x = v' in allE)\n apply (clarsimp simp: heap_rel_ptr_def type_rel_simp wa_abs_repr_def is_valid_simp)\n apply clarsimp\n apply (rule_tac x = \\ in exI)\n apply (rule conjI)\n apply (clarsimp simp: upd_wa_length_0_def)\n apply (monad_eq simp: wordarray_length_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def)\n apply (erule_tac x = v' in allE)\n apply (clarsimp simp: heap_rel_ptr_def type_rel_simp wa_abs_repr_def heap_simp val_rel_simp)\n apply (monad_eq simp: wordarray_length_0'_def)\n done\n\nlemmas upd_C_wordarray_length_corres = upd_C_wordarray_length_corres_gen[rotated -1, of \\0, simplified fun_eq_iff]\n\nsubsection \"wordarray_get\"\n\nlemma upd_C_wordarray_get_corres_gen:\n\"\\i \\ v' \\' \\ st.\n \\i < length \\; val_rel (\\ ! i) v'; \\' ! i = option.Some (prod.fst (prod.snd (\\ ''wordarray_get_0'')));\n \\0' ''wordarray_get_0'' = upd_wa_get_0\\\n \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) (App (AFun ''wordarray_get_0'' []) (Var i))\n (do x <- main_pp_inferred.wordarray_get_0' v';\n gets (\\s. x)\n od)\n \\0' \\ \\ \\' \\ st\"\n apply (rule absfun_corres; simp?)\n apply (clarsimp simp: abs_fun_rel_def; rename_tac r w)\n apply (thin_tac \"\\' ! i = _\")\n apply (rotate_tac -1)\n apply (subst (asm) \\_def)\n apply (subst (asm) \\_def)\n apply (clarsimp simp: val_rel_simp wordarray_get_0_type_def abbreviated_type_defs)\n apply (erule upd.u_t_recE)\n apply (erule upd.u_t_r_consE; clarsimp)+\n apply (erule upd.u_t_r_emptyE)\n apply (erule upd.u_t_primE; subst (asm) lit_type.simps; clarsimp)\n apply (erule upd.u_t_p_absE; simp)\n apply (frule wa_abs_typing_u_elims(1); clarsimp; rename_tac len arr)\n apply (rule conjI)\n apply (monad_eq simp: wordarray_get_0'_def)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta heap_rel_ptr_w32_meta)\n apply (drule_tac p = \"t1_C.p1_C v'\" and uv = \"UAbstract (UWA (TPrim (Num U32)) len arr)\" in all_heap_rel_ptrD; \n clarsimp simp: type_rel_simp wa_abs_repr_def val_rel_simp is_valid_simp heap_simp)\n apply (drule not_le_imp_less)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = \"t1_C.p2_C v'\" in allE; clarsimp)\n apply (drule_tac p = \"values_C (heap_WordArray_u32_C st (t1_C.p1_C v')) +\\<^sub>p uint (t1_C.p2_C v')\" and\n uv = \"UPrim x\" in all_heap_rel_ptrD; simp add: type_rel_simp)\n apply clarsimp\n apply (rule_tac x = \\ in exI)\n apply (rule conjI)\n apply (clarsimp simp: upd_wa_get_0_def)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = \"t1_C.p2_C v'\" in allE)\n apply (monad_eq simp: wordarray_get_0'_def word_less_nat_alt word_le_nat_alt)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta heap_rel_ptr_w32_meta)\n apply (drule_tac p = \"t1_C.p1_C v'\" and uv = \"UAbstract (UWA (TPrim (Num U32)) len arr)\" in all_heap_rel_ptrD; \n clarsimp simp: type_rel_simp wa_abs_repr_def val_rel_simp is_valid_simp heap_simp)\n apply (drule_tac p = \"values_C (heap_WordArray_u32_C st (t1_C.p1_C v')) +\\<^sub>p uint (t1_C.p2_C v')\" and\n uv = \"UPrim x\" in all_heap_rel_ptrD;\n clarsimp simp: type_rel_simp val_rel_simp)\n apply (monad_eq simp: wordarray_get_0'_def)\n apply blast\n done\n\nlemmas upd_C_wordarray_get_corres = upd_C_wordarray_get_corres_gen[rotated -1, of \\0, simplified fun_eq_iff]\n\nsubsection \"Helper lemmas, definitions and abbreviations for second order abstract functions\"\n\nabbreviation \"elem_type x \\ (present_type \\ (\\xs. xs ! 0) \\ rec_type_list) x\"\nabbreviation \"mk_urecord xs \\ URecord (map (\\x. (x, upd.uval_repr x)) xs)\"\n\ndefinition \"foldmap_measure i end \\ unat end - unat i\"\ndefinition \"foldmap_bounds frm to len i e \n \\ frm \\ i \\ e = min to len \\ (frm < e \\ i \\ e) \\ ((\\(frm < e)) \\ frm = i)\"\ndefinition \"foldmap_inv foldmap \\' \\ p frm i f acc obsv r \\' res s' res'\n \\ foldmap \\' \\ p frm i f acc obsv r (\\', res) \\ val_rel res res' \\ (\\', s') \\ state_rel\"\ndefinition \"foldmap_inv_stat obsv obsv' \\ val_rel obsv obsv'\"\n\nlemma whileLoop_add_invI:\n assumes \"\\ P \\ whileLoop_inv c b init I (measure M) \\ Q \\!\"\n shows \"\\ P \\ whileLoop c b init \\ Q \\!\"\n by (metis assms whileLoop_inv_def)\n\nlemma validNF_select_UNIV:\n \"\\\\s. \\x. Q x s\\ select UNIV \\Q\\!\"\n apply (subst select_UNIV_unknown)\n apply (rule validNF_unknown)\n done\n\nsubsection \"wordarray_fold_no_break\"\n\nlemma \\_wordarray_fold_no_break_0:\n \"\\ ''wordarray_fold_no_break_0'' = wordarray_fold_no_break_0_type\"\n by (clarsimp simp: \\_def)\n\nlemma fold_dispatch_wp:\n \"\\proc_ctx_wellformed \\; upd.proc_env_matches_ptrs \\0' \\;\n wa_abs_typing_u (UWA (TPrim (Num num)) len arr) ''WordArray'' [TPrim (Num num)] (Boxed ReadOnly ptrl) r w \\;\n \\ p = option.Some (UAbstract (UWA (TPrim (Num num)) len arr));\n upd.uval_typing \\ \\ acc (foldmap_acc_type ''wordarray_fold_no_break_0'') ra wa;\n upd.uval_typing \\ \\ obsv (foldmap_obsv_type ''wordarray_fold_no_break_0'') ro {};\n wa \\ r = {}; wa \\ ro = {}; p \\ wa;\n (\\, [], [option.Some (foldmap_funarg_type ''wordarray_fold_no_break_0'')] \\ \n (App f (Var 0)) : (foldmap_funret_type ''wordarray_fold_no_break_0''));\n \\x x' \\ s. val_rel x x' \\\n update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) \n (App f (Var 0)) (do ret <- dispatch f_num x'; gets (\\s. ret) od) \n \\0' [x] \\ [option.Some (foldmap_funarg_type ''wordarray_fold_no_break_0'')] \\ s;\n elem_type (foldmap_funarg_type ''wordarray_fold_no_break_0'') = TPrim (Num num)\\ \\\n \\\\sa. (a', n') = (a, n) \\ n < e \\\n (\\\\' res x v. args = t3_C.elem_C_update (\\_. v) a \\\n \\' (arr + size_of_num_type num * n) = option.Some x \\ val_rel x v \\\n foldmap_inv upd_wa_foldnb_bod \\0' \\ p frm n f acc obsv (ra \\ ro) \\' res sa (t3_C.acc_C args)) \\\n foldmap_bounds frm to len n e \\ foldmap_inv_stat obsv (t3_C.obsv_C args)\\\n dispatch f_num args \n \\\\ret sb. (\\\\' res.\n foldmap_inv upd_wa_foldnb_bod \\0' \\ p frm (n + 1) f acc obsv (ra \\ ro) \\' res sb ret) \\\n foldmap_inv_stat obsv (t3_C.obsv_C args) \\ foldmap_bounds frm to len (n + 1) e \\ \n foldmap_measure (n + 1) to < foldmap_measure n' to\\!\"\n apply (subst validNF_def)\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)\n apply (subst valid_def)\n apply (subst no_fail_def)\n apply clarsimp\n apply (subst all_imp_conj_distrib[symmetric])\n apply (clarsimp simp: foldmap_inv_def)\n apply (rename_tac sa \\' res x v)\n apply (erule_tac x = \"mk_urecord [x, res, obsv]\" in allE)\n apply (erule_tac x = args in allE)\n apply (erule impE)\n apply (subst val_rel_simp; simp add: foldmap_inv_stat_def)\n apply (erule_tac x = \\' in allE)\n apply (erule_tac x = sa in allE)\n apply (clarsimp simp: corres_def)\n apply (frule_tac t = \"TPrim (Num num)\" in upd_wa_foldnb_bod_preservation[rotated 2]; simp?; clarsimp?)\n apply (rename_tac r' w')\n apply (subgoal_tac \"upd.matches_ptrs \\ \\' [(mk_urecord [x, res, obsv])]\n [option.Some (foldmap_funarg_type ''wordarray_fold_no_break_0'')] (r' \\ ro) w'\")\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)\n apply (erule impE, blast)\n apply clarsimp\n apply (rename_tac ret sb)\n apply (erule_tac x = ret in allE)\n apply (erule_tac x = sb in allE)\n apply clarsimp\n apply (drule upd.preservation[where \\s = \"[]\" and K = \"[]\", simplified]; simp?)\n apply clarsimp\n apply (rename_tac \\'' res' rb wb)\n apply (clarsimp simp: foldmap_bounds_def)\n apply (case_tac \"frm < to \\ frm < len\"; clarsimp)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = n in allE; clarsimp)\n apply (frule_tac p = \"arr + (size_of_num_type num) * n\" in valid_ptr_not_in_frame_same; simp?)\n apply (drule_tac x = \"arr + 4 * n\" and S' = r in orthD2; simp?)\n apply (drule_tac wa_abs_typing_u_elims(2)[where \\s = \"[_]\", simplified]; simp)\n apply blast\n apply clarsimp\n apply (drule_tac t = num and arr = arr and len = len and r' = res' \n in upd_wa_foldnb_bod_step; simp?; clarsimp?)\n apply (rule conjI)\n apply (drule_tac p = p in readonly_not_in_frame; simp?)\n apply (subst Int_Un_distrib2)+\n apply clarsimp\n apply (rule conjI)\n apply (rule disjointI)\n apply (frule_tac p = x and r = ra and w = wa in upd.uval_typing_valid(1)[rotated 1]; simp?)\n apply clarsimp\n apply (drule_tac p = y in readonly_not_in_frame; simp?)\n apply (drule upd.uval_typing_pointers_noalias; blast)\n apply (rule conjI)\n apply (rule disjointI)\n apply (frule_tac p = x and r = ro and w = \"{}\" in upd.uval_typing_valid(1)[rotated 1]; simp?)\n apply clarsimp\n apply (drule_tac p = y in readonly_not_in_frame; simp?)\n apply blast\n apply (rule disjointI)\n apply (frule wa_abs_typing_u_elims(5))\n apply clarsimp\n apply (erule_tac x = i in allE; clarsimp)\n apply (drule_tac p = \"arr + (size_of_num_type num) * i\" in readonly_not_in_frame; simp?)\n apply (drule wa_abs_typing_u_elims(2); clarsimp)\n apply blast\n apply (rule conjI)\n apply (rule_tac x = \\'' in exI)\n apply (rule_tac x = res' in exI; simp)\n apply (frule_tac a = n and k = to in less_is_non_zero_p1)\n apply (drule unatSuc2; clarsimp simp: word_less_nat_alt word_le_nat_alt foldmap_measure_def)\n apply linarith\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)\n apply (rule upd.matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n apply (rule upd.u_t_struct; simp?)\n apply (rule upd.u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n apply (subst (asm) val_rel_word; clarsimp)\n apply (rule upd.u_t_prim'; clarsimp)\n apply (rule upd.u_t_r_cons1[where r' = ro and w' = \"{}\", simplified]; simp?)\n apply (drule_tac u = obsv in upd.uval_typing_frame(1); simp?)\n apply blast\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_empty)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp)\n apply (rule disjointI)\n apply (frule_tac p = y and r = ro in upd.uval_typing_valid(1)[where w = \"{}\", simplified]; simp?)\n apply clarsimp\n apply (drule_tac p = y in readonly_not_in_frame; simp?)\n apply (drule_tac x = y and S' = ro in orthD2; simp?)\n apply (drule_tac v = res in upd.type_repr_uval_repr(1); simp)\n apply (subst (asm) val_rel_word; clarsimp)\n apply (rule upd.matches_ptrs_empty[where \\s = \"[]\", simplified])\n done\n\nlemma upd_C_wordarray_fold_no_break_corres_gen:\n \"\\upd.proc_env_matches_ptrs \\0' \\; i < length \\; val_rel (\\ ! i) v'; \n \\' ! i = option.Some (prod.fst (prod.snd (\\ ''wordarray_fold_no_break_0'')));\n D \\ k \\ S \\ k; K' \\ (foldmap_obsv_type ''wordarray_fold_no_break_0'') :\\ k;\n \\ ! i = URecord fs; f = prod.fst (fs ! 3); \n (\\, [], [option.Some (foldmap_funarg_type ''wordarray_fold_no_break_0'')] \\ \n (App (uvalfun_to_exprfun f) (Var 0)) : (foldmap_funret_type ''wordarray_fold_no_break_0''));\n \\x x' \\ s. val_rel x x' \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) \n (App (uvalfun_to_exprfun f) (Var 0)) (do ret <- dispatch_t4' (t5_C.f_C v') x'; gets (\\s. ret) od) \n \\0' [x] \\ [option.Some (foldmap_funarg_type ''wordarray_fold_no_break_0'')] \\ s;\n \\1' ''wordarray_fold_no_break_0'' = upd_wa_foldnb \\ \\0' (foldmap_funarg_type ''wordarray_fold_no_break_0'');\n elem_type (foldmap_funarg_type ''wordarray_fold_no_break_0'') = TPrim (Num num)\\\n \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr)\n (App (AFun ''wordarray_fold_no_break_0'' []) (Var i)) (do x <- main_pp_inferred.wordarray_fold_no_break_0' v';\ngets (\\s. x)\n od)\n \\1' \\ \\ \\' \\ s\"\n apply (rule absfun_corres; simp)\n apply (clarsimp simp: abs_fun_rel_def'; rename_tac r w)\n apply (thin_tac \"\\' ! i = _\")\n apply (subst (asm) val_rel_simp; clarsimp)\n apply (subst (asm) val_rel_ptr_def; clarsimp)\n apply (subst (asm) val_rel_fun_tag)\n apply (subst (asm) val_rel_word)\n apply (subst (asm) val_rel_word)\n apply (clarsimp simp: upd_wa_foldnb_def wordarray_fold_no_break_0'_def)\n apply (rename_tac pwa_rep frm_rep to_rep f_rep acc a_rep obsv o_rep wa_rep)\n apply (erule upd.u_t_recE; clarsimp)\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)\n apply (erule upd.u_t_r_consE; clarsimp)\n apply (erule upd.u_t_p_absE; clarsimp)\n apply (frule wa_abs_typing_u_elims(1); clarsimp)\n apply (rename_tac r len arr)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_primE)+\n apply (drule_tac t = \"lit_type _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; clarsimp)+\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (frule upd.tfun_no_pointers(1))\n apply (frule upd.tfun_no_pointers(2))\n apply clarsimp\n apply (rename_tac acc ra wa obsv ro wo)\n apply (drule upd.discardable_or_shareable_not_writeable; simp?)\n apply clarsimp\n apply (subst unknown_bind_ignore)+\n apply (clarsimp simp: join_guards)\n apply wp\n apply (clarsimp simp: unknown_bind_ignore split: prod.split)\n apply (rename_tac var e)\n apply (rule_tac M = \"\\((_, i), _). foldmap_measure i (t5_C.to_C v')\" and \n I = \"\\(a, b) s. (\\\\' res. foldmap_inv upd_wa_foldnb_bod \\0' \\ (ptr_val (t5_C.arr_C v'))\n (t5_C.frm_C v') b (uvalfun_to_exprfun f) acc obsv (ra \\ ro) \\' res s (t3_C.acc_C a)) \\\n foldmap_inv_stat obsv (t3_C.obsv_C a) \\\n foldmap_bounds (t5_C.frm_C v') (t5_C.to_C v') len b e\" in whileLoop_add_invI; simp?)\n apply (wp; clarsimp simp: unknown_bind_ignore split: prod.splits)\n apply (rename_tac sa a n args a' n')\n apply (rule_tac a = a and wa = wa and ra = ra and ro = ro and w = \"{}\" and r = r and\n ptrl = undefined in fold_dispatch_wp[rotated 2]; simp?)\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)+\n apply wp\n apply wp\n apply clarsimp\n apply (rename_tac args j \\' res)\n apply (clarsimp simp: foldmap_bounds_def foldmap_inv_def)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = j in allE; clarsimp)\n apply (drule_tac acc = acc and obsv = obsv and rb = ra and wb = wa and rc = ro\n in upd_wa_foldnb_bod_preservation; simp?; clarsimp?)\n apply (frule_tac p = \"ptr_val (t5_C.arr_C v')\" in valid_ptr_not_in_frame_same; simp?)\n apply (drule_tac p = \"arr + (size_of_num_type num) * j\" in valid_ptr_not_in_frame_same; simp?)\n apply (drule_tac x = \"arr + (size_of_num_type num) * j\" and S = wa and S' = r in orthD2; simp?)\n apply (drule wa_abs_typing_u_elims(2); clarsimp)\n apply blast\n apply (thin_tac \"_ \\ state_rel\")\n apply (rule conjI)\n apply (rule_tac x = \\' in exI)\n apply (rule_tac x = res in exI)\n apply (rule_tac x = \"UPrim x\" in exI)\n apply clarsimp\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_w32_meta heap_rel_ptr_meta)\n apply (rotate_tac -1)\n apply (drule_tac p = \"Ptr(arr + (size_of_num_type num) * j)\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp)\n apply (rule_tac x = \"heap_w32 s (PTR(32 word) (arr + (size_of_num_type num) * j))\" in exI)\n apply (drule_tac p = \"t5_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: val_rel_WordArray_u32_C_def ptr_add_def heap_simp mult.commute)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_w32_meta heap_rel_ptr_meta)\n apply (rotate_tac -1)\n apply (drule_tac p = \"Ptr(arr + (size_of_num_type num) * j)\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp)\n apply (drule_tac p = \"t5_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: is_valid_simp heap_simp val_rel_WordArray_u32_C_def ptr_add_def mult.commute)\n apply (rule conjI)\n apply (erule u_t_primtE; clarsimp)\n apply (rule conjI)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp?)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(5); simp)\n apply (rule conjI)\n apply (erule u_t_funafuntE; clarsimp)\n apply (rename_tac x' j \\' res)\n apply (rule_tac x = \\' in exI)\n apply (rule_tac x = res in exI)\n apply (clarsimp simp: foldmap_inv_def)\n apply (rule_tac x = \"foldmap_acc_type ''wordarray_fold_no_break_0''\" in exI)\n apply (rule_tac x = \"foldmap_obsv_type ''wordarray_fold_no_break_0''\" in exI)\n apply (rule_tac x = \"''elem''\" in exI)\n apply (rule_tac x = \"''acc''\" in exI)\n apply (rule_tac x = \"''obsv''\" in exI)\n apply (clarsimp simp: \\_wordarray_fold_no_break_0 wordarray_fold_no_break_0_type_def abbreviated_type_defs)\n apply (rule_tac x = ra in exI)\n apply (rule conjI)\n apply (intro exI, assumption)\n apply (rule_tac x = ro in exI)\n apply (rule conjI, simp)\n apply (unfold foldmap_bounds_def)\n apply (erule conjE)+\n apply (case_tac \"t5_C.frm_C v' < e\")\n apply (erule impE, assumption)\n apply (thin_tac \"_ \\ _\")\n apply clarsimp\n apply (case_tac \"j < t5_C.to_C v'\"; clarsimp)\n apply (rule upd_wa_foldnb_bod_to_geq_len; simp?)\n apply (erule impE, assumption)\n apply (thin_tac \"_ \\ _\")\n apply clarsimp\n apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n apply (case_tac \"t5_C.frm_C v' < t5_C.to_C v'\"; subst upd_wa_foldnb_bod.simps; clarsimp)\n apply wp\n apply wp\n apply (rule validNF_select_UNIV)\n apply (clarsimp simp: foldmap_inv_stat_def)\n apply (clarsimp simp: order.strict_implies_order)\n apply (clarsimp simp: foldmap_inv_def state_rel_def heap_rel_def heap_rel_ptr_meta)\n apply (frule_tac p = \"t5_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: is_valid_simp val_rel_WordArray_u32_C_def heap_simp)\n apply (rule conjI; clarsimp)\n apply (rule conjI)\n apply (rule_tac x = \\ in exI)\n apply (rule_tac x = acc in exI)\n apply clarsimp\n apply (drule wa_abs_typing_u_elims(5))\n apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n apply (rule conjI; clarsimp)\n apply (rename_tac j)\n apply (erule_tac x = j in allE; clarsimp)\n apply (subst min_def)\n apply (subst (asm) not_le[symmetric])+\n apply (subst if_not_P; simp?)\n apply (rule conjI)\n apply (rule_tac x = \\ in exI)\n apply (rule_tac x = acc in exI)\n apply clarsimp\n apply (drule wa_abs_typing_u_elims(5))\n apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n apply (rule conjI; clarsimp)\n apply (rename_tac j)\n apply (erule_tac x = j in allE; clarsimp)\n apply (subst min_def)\n apply (clarsimp simp: not_le)\n done\n\nsubsection \"wordarray_map_no_break\"\n\nlemma \\_wordarray_map_no_break_0:\n \"\\ ''wordarray_map_no_break_0'' = wordarray_map_no_break_0_type\"\n by (clarsimp simp: \\_def)\n\nlemma map_dispatch_wp:\n \"\\proc_ctx_wellformed \\; upd.proc_env_matches_ptrs \\0' \\;\n wa_abs_typing_u (UWA (TPrim (Num num)) len arr) ''WordArray'' [TPrim (Num num)] (Boxed Writable ptrl) r w \\;\n \\ p = option.Some (UAbstract (UWA (TPrim (Num num)) len arr));\n upd.uval_typing \\ \\ acc (foldmap_acc_type ''wordarray_map_no_break_0'') ra wa;\n upd.uval_typing \\ \\ obsv (foldmap_obsv_type ''wordarray_map_no_break_0'') ro {}; wa \\ r = {}; p \\ w;\n p \\ r; w \\ wa = {}; w \\ (ra \\ ro) = {}; wa \\ ro = {}; p \\ wa; p \\ ra; p \\ ro; p = ptr_val p';\n (\\, [], [option.Some (foldmap_funarg_type ''wordarray_map_no_break_0'')] \\ \n (App f (Var 0)) : (foldmap_funret_type ''wordarray_map_no_break_0''));\n \\x x' \\ s. val_rel x x' \\\n update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) \n (App f (Var 0)) (do ret <- dispatch f_num x'; gets (\\s. ret) od) \n \\0' [x] \\ [option.Some (foldmap_funarg_type ''wordarray_map_no_break_0'')] \\ s;\n elem_type (foldmap_funarg_type ''wordarray_map_no_break_0'') = TPrim (Num num)\\ \\\n \\\\sa. (a', n') = (a, n) \\ n < e \\\n (\\\\' res x v. args = t6_C.elem_C_update (\\_. v) a \\\n \\' (arr + size_of_num_type U32 * n) = option.Some x \\ val_rel x v \\\n foldmap_inv upd_wa_mapAccumnb_bod \\0' \\ p frm n f acc obsv (ra \\ ro) \\' res sa (t10_C p' (t6_C.acc_C args))) \\\n foldmap_bounds frm to len n e \\ foldmap_inv_stat obsv (t6_C.obsv_C args)\\\n dispatch f_num args \n \\\\ret sb. (\\\\' res. \n foldmap_inv upd_wa_mapAccumnb_bod \\0' \\ p frm (n + 1) f acc obsv (ra \\ ro) \\' res \n (heap_w32_update (\\x a. if a = values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n \n then t7_C.p1_C ret else x a) sb) (t10_C p' (t7_C.p2_C ret))) \\\n foldmap_inv_stat obsv (t6_C.obsv_C args) \\\n foldmap_bounds frm to len (n + 1) e \\\n foldmap_measure (n + 1) to < foldmap_measure n' to \\\n is_valid_WordArray_u32_C sb p' \\\n is_valid_w32 sb (values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n)\\!\"\n apply (subst validNF_def)\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)\n apply (subst valid_def)\n apply (subst no_fail_def)\n apply clarsimp\n apply (subst all_imp_conj_distrib[symmetric])\n apply (clarsimp simp: foldmap_inv_def)\n apply (rename_tac sa \\' res x v)\n apply (frule upd_wa_mapAccumnb_bod_preservation'; simp?)\n apply clarsimp\n apply (rename_tac racc)\n apply (erule_tac x = \"mk_urecord [x, racc, obsv]\" in allE)\n apply (erule_tac x = args in allE)\n apply clarsimp\n apply (erule impE)\n apply (clarsimp simp: val_rel_simp foldmap_inv_stat_def)\n apply (erule_tac x = \\' in allE)\n apply (erule_tac x = sa in allE)\n apply (clarsimp simp: corres_def)\n apply (frule_tac t = \"TPrim (Num num)\" in upd_wa_mapAccumnb_bod_preservation; simp?; clarsimp?)\n apply (subst Int_Un_distrib2; clarsimp)\n apply (subst (asm) Int_Un_distrib; clarsimp)\n apply (subst (asm) Int_Un_distrib; clarsimp)\n apply (rename_tac r' w')\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n apply (erule upd.u_t_r_consE; clarsimp)\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (rename_tac w' rb wb racc rc wc)\n apply (erule upd.u_t_p_con_wrE)\n apply (drule_tac t = \"RCon _ _\" in sym; clarsimp)\n apply (frule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n apply clarsimp\n apply (frule_tac p = p in readonly_not_in_frame; simp?)\n apply (subst (asm) insert_ident; clarsimp)\n apply (rename_tac wb)\n apply (subgoal_tac \"upd.matches_ptrs \\ \\' [(mk_urecord [x, racc, obsv])]\n [option.Some (foldmap_funarg_type ''wordarray_map_no_break_0'')] (rc \\ ro) wc\")\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)\n apply (erule impE, blast)\n apply clarsimp\n apply (rename_tac ret sb)\n apply (erule_tac x = ret in allE)\n apply (erule_tac x = sb in allE)\n apply clarsimp\n apply (drule upd.preservation[where \\s = \"[]\" and K = \"[]\", simplified]; simp?)\n apply clarsimp\n apply (rename_tac \\'' res' r' w')\n apply (erule u_t_rectE; clarsimp)\n apply (erule u_t_r_contE; clarsimp)\n apply (erule u_t_r_contE; clarsimp)\n apply (erule u_t_r_contE; clarsimp)\n apply (rename_tac x' rd wd racc' r' w')\n apply (frule_tac v = x' in upd.tprim_no_pointers(1); clarsimp)\n apply (frule_tac v = x' in upd.tprim_no_pointers(2); clarsimp)\n apply (clarsimp simp: foldmap_bounds_def)\n apply (case_tac \"frm < to \\ frm < len\"; clarsimp)\n apply (thin_tac \"wa_abs_typing_u _ _ _ _ _ _ _\")\n apply (drule_tac t = num and arr = arr and len = len and v' = x' and r' = racc'\n in upd_wa_mapAccumnb_bod_step; simp?; clarsimp?)\n apply (drule wa_abs_typing_u_elims(6); simp?)\n apply (subst Int_Un_distrib2)+\n apply clarsimp\n apply (rule conjI)\n apply (rule disjointI)\n apply (rename_tac y y')\n apply (frule_tac p = y and r = ra and w = wa in upd.uval_typing_valid(1)[rotated 1]; simp?)\n apply clarsimp\n apply (drule_tac p = y' in readonly_not_in_frame; simp?)\n apply (drule_tac x = y' and S' = \"ra \\ ro\" in orthD2; simp?)\n apply (drule upd.uval_typing_pointers_noalias)\n apply (drule_tac x = y' and S = ra and S' = wa in orthD1; simp?)\n apply (rule conjI)\n apply (rule disjointI)\n apply (rename_tac y y')\n apply (frule_tac p = y and r = ro and w = \"{}\" in upd.uval_typing_valid(1)[rotated 1]; simp?)\n apply clarsimp\n apply (drule_tac p = y' in readonly_not_in_frame; simp?)\n apply blast\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (drule_tac v = x' in upd.type_repr_uval_repr(1); simp)\n apply (drule_tac v = racc' in upd.type_repr_uval_repr(1); simp)\n apply (thin_tac \"_ \\ state_rel\")\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta heap_rel_ptr_w32_meta)\n apply (frule_tac p = p and \\ = \\' in valid_ptr_not_in_frame_same; simp?)\n apply (drule_tac p = \"arr + (size_of_num_type num) * n\" and \\ = \\' in valid_ptr_not_in_frame_same; simp?)\n apply (drule_tac x = \"arr + (size_of_num_type num) * n\" and S' = wc in orthD1; simp?)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = n in exI; clarsimp)\n apply (frule_tac p = p' in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (frule_tac p = \"values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n\" and uv = x in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: val_rel_simp heap_simp)\n apply (clarsimp simp: type_rel_simp val_rel_simp)\n apply (rule conjI)\n apply (rule_tac x = \"\\''(arr + (size_of_num_type num) * n \\ x')\" in exI)\n apply (rule_tac x = \"mk_urecord [UPtr (ptr_val p') (RCon ''WordArray'' [RPrim (Num U32)]), racc']\" in exI)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: val_rel_simp)\n apply (clarsimp simp: heap_simp is_valid_simp)\n apply (drule_tac upd_h = \"(heap_w32_update \n (\\x a. if a = values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n then t7_C.p1_C ret else x a) sb)\" and\n uv = x and uv' = x' and x = \"values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n\"\n in all_heap_rel_updE; simp?; clarsimp?)\n apply (clarsimp simp: val_rel_simp)\n apply (drule_tac v = x' in upd.type_repr_uval_repr(1); simp add: val_rel_simp)\n apply (clarsimp simp: val_rel_simp type_rel_simp)\n apply (drule_tac upd_h = \"(heap_w32_update \n (\\x a. if a = values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n then t7_C.p1_C ret else x a) sb)\" and\n uv = x and uv' = x' and x = \"values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n\"\n in all_heap_rel_updE; simp?; clarsimp?)\n apply (clarsimp simp: val_rel_simp)\n apply (drule_tac v = x' in upd.type_repr_uval_repr(1); simp add: val_rel_simp)\n apply (rule conjI)\n apply (clarsimp simp: val_rel_simp)\n apply (cut_tac p = pa and q = \"values_C (heap_WordArray_u32_C sb p') +\\<^sub>p uint n\" in ptr_val_inj)\n apply clarsimp\n apply (clarsimp simp: ptr_add_def mult.commute val_rel_simp)\n apply (clarsimp simp: is_valid_simp)\n apply (frule_tac a = n and k = to in less_is_non_zero_p1)\n apply (drule unatSuc2; clarsimp simp: word_less_nat_alt word_le_nat_alt foldmap_measure_def)\n apply linarith\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)\n apply (rule upd.matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n apply (rule upd.u_t_struct; simp?)\n apply (rule upd.u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n apply (subst (asm) val_rel_word; clarsimp)\n apply (rule upd.u_t_prim'; clarsimp)\n apply (rule upd.u_t_r_cons1[where r' = ro and w' = \"{}\", simplified]; simp?)\n apply (drule_tac u = obsv in upd.uval_typing_frame(1); simp?)\n apply blast\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_empty)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp)\n apply (rule disjointI)\n apply (frule_tac p = y and r = ro in upd.uval_typing_valid(1)[where w = \"{}\", simplified]; simp?)\n apply clarsimp\n apply (drule_tac p = y in readonly_not_in_frame; simp?)\n apply (drule_tac x = y and S' = ro in orthD2; simp?)\n apply (drule_tac x = y and S' = \"ra \\ ro\" in orthD2; simp?)\n apply (subst (asm) val_rel_word; clarsimp)\n apply (rule upd.matches_ptrs_empty[where \\s = \"[]\", simplified])\n done\n\nlemma upd_C_wordarray_map_no_break_corres_gen:\n \"\\upd.proc_env_matches_ptrs \\0' \\; i < length \\; val_rel (\\ ! i) v';\n \\' ! i = option.Some (prod.fst (prod.snd (\\ ''wordarray_map_no_break_0'')));\n D \\ k \\ S \\ k; K' \\ (foldmap_obsv_type ''wordarray_map_no_break_0'') :\\ k;\n \\ ! i = URecord fs; f = prod.fst (fs ! 3);\n (\\, [], [option.Some (foldmap_funarg_type ''wordarray_map_no_break_0'')] \\ \n (App (uvalfun_to_exprfun f) (Var 0)) : (foldmap_funret_type ''wordarray_map_no_break_0''));\n \\x x' \\ s. val_rel x x' \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr) \n (App (uvalfun_to_exprfun f) (Var 0)) (do ret <- dispatch_t8' (t9_C.f_C v') x'; gets (\\s. ret) od) \n \\0' [x] \\ [option.Some (foldmap_funarg_type ''wordarray_map_no_break_0'')] \\ s;\n \\1' ''wordarray_map_no_break_0'' = upd_wa_mapAccumnb \\ \\0' \n (foldmap_funarg_type ''wordarray_map_no_break_0'') (foldmap_funret_type ''wordarray_map_no_break_0'');\n elem_type (foldmap_funarg_type ''wordarray_map_no_break_0'') = TPrim (Num num)\\\n \\ update_sem_init.corres wa_abs_typing_u wa_abs_repr (Generated.state_rel wa_abs_repr)\n (App (AFun ''wordarray_map_no_break_0'' []) (Var i)) (do x <- main_pp_inferred.wordarray_map_no_break_0' v';\ngets (\\s. x)\n od)\n \\1' \\ \\ \\' \\ s\"\n apply (rule absfun_corres; simp)\n apply (clarsimp simp: abs_fun_rel_def'; rename_tac r w)\n apply (thin_tac \"\\' ! i = _\")\n apply (subst (asm) val_rel_simp; clarsimp)\n apply (subst (asm) val_rel_ptr_def; clarsimp)\n apply (subst (asm) val_rel_fun_tag)\n apply (subst (asm) val_rel_word)\n apply (subst (asm) val_rel_word)\n apply (clarsimp simp: upd_wa_mapAccumnb_def wordarray_map_no_break_0'_def)\n apply (rename_tac pwa_rep frm_rep to_rep f_rep acc a_rep o_rep wa_rep)\n apply (erule upd.u_t_recE; clarsimp)\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)\n apply (erule upd.u_t_r_consE; clarsimp)\n apply (rename_tac r w r' w')\n apply (erule upd.u_t_p_absE; clarsimp)\n apply (rename_tac w)\n apply (frule wa_abs_typing_u_elims(1); clarsimp)\n apply (rename_tac len arr)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_primE)+\n apply (drule_tac t = \"lit_type _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; clarsimp)+\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (frule upd.tfun_no_pointers(1))\n apply (frule upd.tfun_no_pointers(2))\n apply clarsimp\n apply (rename_tac acc ra wa obsv ro wo)\n apply (drule_tac v = obsv in upd.discardable_or_shareable_not_writeable(1); simp?)\n apply (subst unknown_bind_ignore)+\n apply (clarsimp simp: join_guards) \n apply wp\n apply (clarsimp simp: unknown_bind_ignore split: prod.split)\n apply (rename_tac var e)\n apply (rule_tac M = \"\\((_, i), _). foldmap_measure i (t9_C.to_C v')\" and \n I = \"\\(a, b) s. (\\\\' res. foldmap_inv upd_wa_mapAccumnb_bod \\0' \\ (ptr_val (t9_C.arr_C v'))\n (t9_C.frm_C v') b (uvalfun_to_exprfun f) acc obsv (ra \\ ro) \\' res s (t10_C (t9_C.arr_C v') (t6_C.acc_C a))) \\\n foldmap_inv_stat obsv (t6_C.obsv_C a) \\\n foldmap_bounds (t9_C.frm_C v') (t9_C.to_C v') len b e\" in whileLoop_add_invI; simp?)\n apply (wp; clarsimp simp: unknown_bind_ignore split: prod.splits)\n apply (rename_tac sa a n args a' n')\n apply (clarsimp simp: conj_left_commute[of \"is_valid_w32 _ _\", simplified])\n apply (clarsimp simp: conj_commute[of \"is_valid_w32 _ _\", simplified])\n apply (rule_tac a = a and wa = wa and ra = ra and ro = ro and w = w and r = r and\n ptrl = undefined in map_dispatch_wp; simp?)\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)+\n apply wp\n apply wp\n apply clarsimp\n apply (rename_tac args j \\' res)\n apply (clarsimp simp: foldmap_inv_def foldmap_bounds_def)\n apply (drule upd_wa_mapAccumnb_bod_preservation; simp?; clarsimp?)\n apply (subst Int_Un_distrib2; clarsimp)\n apply (cut_tac A = w and B = ra and C = ro in Int_Un_distrib; clarsimp)\n apply (cut_tac A = w and B = ra and C = ro in Int_Un_distrib; clarsimp)\n apply (frule_tac p = \"ptr_val (t9_C.arr_C v')\" in valid_ptr_not_in_frame_same; simp?)\n apply (thin_tac \"_ \\ state_rel\")\n apply (frule_tac upd_wa_mapAccumnb_bod_preservation'; simp?)\n apply clarsimp\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n apply (erule upd.u_t_p_con_wrE)\n apply (drule_tac t = \"RCon _ _\" in sym; clarsimp)\n apply (thin_tac \"wa_abs_typing_u _ _ _ _ _ _ _\")\n apply (drule wa_abs_typing_u_elims(5))\n apply (erule_tac x = j in allE; clarsimp)\n apply (clarsimp simp: state_rel_def heap_rel_def heap_rel_ptr_meta heap_rel_ptr_w32_meta)\n apply (frule_tac p = \"t9_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (rotate_tac -2)\n apply (frule_tac p = \"Ptr(arr + (size_of_num_type num) * j)\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp)\n apply (rule conjI)\n apply (rule_tac x = \\' in exI)\n apply (rule_tac x = \"mk_urecord [UPtr (ptr_val (t9_C.arr_C v'))\n (RCon ''WordArray'' [RPrim (Num num)]), racc]\" in exI)\n apply (rule_tac x = \"UPrim x\" in exI)\n apply (rule_tac x = \"heap_w32 s (PTR(32 word) (arr + (size_of_num_type num) * j))\" in exI)\n apply (clarsimp simp: val_rel_WordArray_u32_C_def ptr_add_def heap_simp mult.commute)\n apply (clarsimp simp: val_rel_WordArray_u32_C_def ptr_add_def is_valid_simp heap_simp mult.commute)\n apply (rule conjI)\n apply (drule_tac v = acc in upd.type_repr_uval_repr(1); simp)\n apply (rule conjI)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(5); simp)\n apply (rule conjI)\n apply (erule u_t_funafuntE; clarsimp)\n apply (rule_tac x = \\' in exI)\n apply (rule_tac x = res in exI)\n apply (clarsimp simp: foldmap_inv_def)\n apply (rule conjI)\n apply (rule_tac x = \"foldmap_acc_type ''wordarray_map_no_break_0''\" in exI)\n apply (rule_tac x = \"foldmap_obsv_type ''wordarray_map_no_break_0''\" in exI)\n apply (rule_tac x = \"''elem''\" in exI)\n apply (rule_tac x = \"''acc''\" in exI)\n apply (rule_tac x = \"''obsv''\" in exI)\n apply (rule_tac x = \"''p1''\" in exI)\n apply (rule_tac x = \"''p2''\" in exI)\n apply (rule_tac x = ra in exI)\n apply (clarsimp simp: \\_wordarray_map_no_break_0 wordarray_map_no_break_0_type_def abbreviated_type_defs)\n apply (rule conjI)\n apply (intro exI, assumption)\n apply (rule_tac x = ro in exI)\n apply clarsimp\n apply (rename_tac j \\' res)\n apply (unfold foldmap_bounds_def)\n apply (erule conjE)+\n apply (case_tac \"t9_C.frm_C v' < e\")\n apply (erule impE, assumption)\n apply (thin_tac \"_ \\ _\")\n apply clarsimp\n apply (case_tac \"j < t9_C.to_C v'\"; clarsimp)\n apply (rule upd_wa_mapAccumnb_bod_to_geq_len; simp?)\n apply (erule impE, assumption)\n apply (thin_tac \"_ \\ _\")\n apply clarsimp\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n apply (case_tac \"t9_C.frm_C v' < t9_C.to_C v'\"; subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (clarsimp simp: val_rel_simp)\n apply wp\n apply wp\n apply (rule validNF_select_UNIV)\n apply (rule validNF_select_UNIV)\n apply (clarsimp simp: foldmap_inv_stat_def)\n apply (clarsimp simp: order.strict_implies_order)\n apply (clarsimp simp: foldmap_inv_def state_rel_def heap_rel_def heap_rel_ptr_meta)\n apply (frule_tac p = \"t9_C.arr_C v'\" in all_heap_rel_ptrD; simp?)\n apply (clarsimp simp: type_rel_simp wa_abs_repr_def)\n apply (clarsimp simp: is_valid_simp val_rel_WordArray_u32_C_def heap_simp)\n apply (rule conjI; clarsimp)\n apply (rule conjI)\n apply (rule_tac x = \\ in exI)\n apply (rule_tac x = \"mk_urecord [UPtr (ptr_val (t9_C.arr_C v'))\n (RCon ''WordArray'' [RPrim (Num num)]), acc]\" in exI)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(5); clarsimp)\n apply (rename_tac j)\n apply (erule_tac x = j in allE; clarsimp)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule conjI)\n apply (clarsimp simp: val_rel_simp)\n apply (rule conjI; clarsimp)\n apply (subst min_def)\n apply (subst (asm) not_le[symmetric])+\n apply (subst if_not_P; simp?)\n apply (rule conjI)\n apply (rule_tac x = \\ in exI)\n apply (rule_tac x = \"mk_urecord [UPtr (ptr_val (t9_C.arr_C v'))\n (RCon ''WordArray'' [RPrim (Num num)]), acc]\" in exI)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(5); clarsimp)\n apply (rename_tac j)\n apply (erule_tac x = j in allE; clarsimp)\n apply (rule conjI)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule conjI)\n apply (clarsimp simp: val_rel_simp)\n apply (rule conjI; clarsimp)\n apply (subst min_def)\n apply (clarsimp simp: not_le)\n done\n\nend (* of context *)\nend", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/sum-random/manual/SumRandom_UpdCCorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.2505741462415942}} {"text": "theory InferRange\n imports InferDef\nbegin\n \n (* ##### random mechnical lemmas *)\n \nlemma trip_convert: \"as_aff (as_perm a) = a\" \n apply (case_tac a)\n apply (auto)\n done \n \nlemma infer_x_subset_ih: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; x \\ ds \\ \\ x \\ ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n apply (case_tac xa)\n apply (auto)\n done\n \nlemma infer_x_subset: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds' \\ \\ ds \\ ds'\" \n apply (auto)\n apply (rule_tac infer_x_subset_ih)\n apply (auto)\n done \n \n (* ##### direct type substitution composition *)\n \ndefinition dir_add_env where\n \"dir_add_env t_sub a tau = (\\ a'. if a' = a then Some tau else t_sub a')\" \n \nfun dir_list_add_env where\n \"dir_list_add_env t_sub [] = t_sub\" \n| \"dir_list_add_env t_sub ((a, tau) # a_t) = dir_add_env (dir_list_add_env t_sub a_t) a tau\"\n \n \n (* #### domain / range based lemmas *)\n\ndefinition sub_range where\n \"sub_range env_v ds = (\\ x. case env_v x of\n None \\ True\n | Some a \\ a \\ ds\n )\" \n \ndefinition tsub_dom where\n \"tsub_dom t_sub ds = (\\ a. t_sub a \\ None \\ a \\ ds)\"\n\ndefinition psub_dom where\n \"psub_dom p_sub ds = (\\ a. p_sub a \\ NoPerm \\ a \\ ds)\"\n \ndefinition set_diff :: \"'a set \\ 'a set \\ 'a set\" where\n \"set_diff s1 s2 = s1 - s2\" \n \nfun dom_list where\n \"dom_list [] = []\" \n| \"dom_list ((x, v) # t) = x # (dom_list t)\" \n \nfun dom_list_set where\n \"dom_list_set [] = {}\" \n| \"dom_list_set ((x, v) # t) = ({x} \\ dom_list_set t)\" \n \nlemma dir_add_eq_env: \"\\ dir_subst_tenv t_sub env_v = env; sub_range env_v ds; a \\ ds \\ \\\n dir_subst_tenv (dir_add_env t_sub a tau) env_v = env\" \n apply (auto)\n apply (case_tac \"\\ x. dir_subst_tenv (dir_add_env t_sub a tau) env_v x = env x\")\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (case_tac \"a = aa\")\n apply (auto)\n done \n \nlemma dir_list_append_eq_env_ih: \"dir_subst_tenv (dir_list_add_env t_sub (l @ la)) env_v x = dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub la) l) env_v x\" \n apply (induct l)\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (simp add: dir_add_env_def)\n done\n \nlemma dir_list_append_eq_env: \"dir_subst_tenv (dir_list_add_env t_sub (l @ la)) env_v = dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub la) l) env_v\"\n apply (case_tac \"\\ x. dir_subst_tenv (dir_list_add_env t_sub (l @ la)) env_v x = dir_subst_tenv (dir_list_add_env (dir_list_add_env t_sub la) l) env_v x\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and x=\"x\" in dir_list_append_eq_env_ih)\n apply (auto)\n done\n\nlemma dir_list_dist_add_eq_env_ih: \"\\ dir_subst_tenv t_sub env_v x = dir_subst_tenv t_sub' env_v x \\ \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v x = dir_subst_tenv (dir_list_add_env t_sub' l) env_v x\"\n apply (induct l)\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (simp add: dir_add_env_def)\n done\n \nlemma dir_list_dist_add_eq_env: \"\\ dir_subst_tenv t_sub env_v = dir_subst_tenv t_sub' env_v \\ \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = dir_subst_tenv (dir_list_add_env t_sub' l) env_v\"\n apply (case_tac \"\\ x. dir_subst_tenv (dir_list_add_env t_sub l) env_v x = dir_subst_tenv (dir_list_add_env t_sub' l) env_v x\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and x=\"x\" and t_sub'=\"t_sub'\" in dir_list_dist_add_eq_env_ih)\n apply (auto)\n done\n \nlemma dir_list_cancel_add_eq_env_ih: \"\\ sub_range env_v ds; fresh_list ds (dom_list l) \\ \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v x = dir_subst_tenv t_sub env_v x\" \n apply (induct l)\n apply (auto)\n apply (simp add: dir_subst_tenv_def)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (simp add: dir_add_env_def)\n apply (auto)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (case_tac \"\\ fresh_list ds (dom_list l)\")\n apply (auto)\n apply (simp add: fresh_list_def)\n done\n \nlemma dir_list_cancel_add_eq_env: \"\\ sub_range env_v ds; fresh_list ds (dom_list l) \\ \\\n dir_subst_tenv (dir_list_add_env t_sub l) env_v = dir_subst_tenv t_sub env_v\" \n apply (case_tac \"\\ x. dir_subst_tenv (dir_list_add_env t_sub l) env_v x = dir_subst_tenv t_sub env_v x\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and x=\"x\" in dir_list_cancel_add_eq_env_ih)\n apply (auto)\n done\n \n \nlemma subset_tsub_dom: \"\\ tsub_dom t_sub ds; ds \\ ds' \\ \\ tsub_dom t_sub ds'\" \n apply (simp add: tsub_dom_def)\n apply (auto)\n done\n \nlemma add_tsub_dom: \"\\ tsub_dom t_sub ds; x \\ ds \\ \\ tsub_dom (dir_add_env t_sub x tau) ds\" \n apply (simp add: tsub_dom_def)\n apply (simp add: dir_add_env_def)\n done\n\nlemma add_tsub_dom_rev: \"\\ tsub_dom (dir_add_env t_sub x tau) ds \\ \\ tsub_dom t_sub ds\" \n apply (simp add: tsub_dom_def)\n apply (simp add: dir_add_env_def)\n done \n \nlemma list_add_tsub_dom: \"\\ tsub_dom t_sub ds; ds \\ ds'; dom_list_set l \\ ds' \\ \\ tsub_dom (dir_list_add_env t_sub l) ds'\" \n apply (induct l)\n apply (auto)\n apply (simp add: subset_tsub_dom)\n apply (rule_tac add_tsub_dom)\n apply (auto)\n done\n \nlemma list_add_tsub_dom_rev: \"\\ tsub_dom (dir_list_add_env t_sub l) ds \\ \\ tsub_dom t_sub ds\" \n apply (induct l)\n apply (auto)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and x=\"a\" in add_tsub_dom_rev)\n apply (auto)\n done\n \nlemma append_tsub_dom: \"\\ tsub_dom (dir_list_add_env t_sub l2) ds; dom_list_set l1 \\ ds \\ \\ tsub_dom (dir_list_add_env t_sub (l1 @ l2)) ds\" \n apply (induct l1)\n apply (auto)\n apply (rule_tac add_tsub_dom)\n apply (auto)\n done\n \nlemma subset_psub_dom: \"\\ psub_dom p_sub ds; ds \\ ds' \\ \\ psub_dom p_sub ds'\" \n apply (simp add: psub_dom_def)\n apply (auto)\n done\n \nlemma empty_psub_dom: \"psub_dom empty_use_env ds\" \n apply (simp add: psub_dom_def)\n apply (simp add: empty_use_env_def)\n done\n \nlemma add_psub_dom: \"\\ psub_dom p_sub ds; x \\ ds \\ \\ psub_dom (add_use_env p_sub x p) ds\" \n apply (simp add: psub_dom_def)\n apply (simp add: add_use_env_def)\n done \n \nlemma comp_psub_dom: \"\\ psub_dom p_sub1 ds; psub_dom p_sub2 ds \\ \\ psub_dom (comp_use_env p_sub1 p_sub2) ds\" \n apply (simp add: psub_dom_def)\n apply (auto)\n apply (simp add: comp_use_env_def)\n apply (case_tac \"p_sub1 a = NoPerm\")\n apply (auto)\n apply (case_tac \"p_sub2 a = NoPerm\")\n apply (auto)\n done \n \nlemma subset_sub_range: \"\\ sub_range env_v ds; ds \\ ds' \\ \\ sub_range env_v ds'\" \n apply (simp add: sub_range_def)\n apply (auto)\n apply (case_tac \"env_v x\")\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n \nlemma list_add_dls: \"\\ tsub_dom (dir_list_add_env t_sub l) ds \\ \\ dom_list_set l \\ ds\" \n apply (induct l)\n apply (auto)\n apply (simp add: tsub_dom_def)\n apply (simp add: dir_add_env_def)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and x=\"a\" in add_tsub_dom_rev)\n apply (auto)\n done \n \n \n (* #### p_exp range *)\n \nfun pvar_set_perm where\n \"pvar_set_perm (SPerm p) = {}\"\n| \"pvar_set_perm (SVar x) = {x}\" \n \nfun pvar_set where\n \"pvar_set (XPerm p) = pvar_set_perm p\"\n| \"pvar_set (XType a) = {}\"\n| \"pvar_set (XComp px qx) = (pvar_set px \\ pvar_set qx)\"\n| \"pvar_set (XLift px q) = (pvar_set px \\ pvar_set_perm q)\" \n| \"pvar_set (XIfZero px qx) = (pvar_set px \\ pvar_set qx)\" \n \ndefinition pvar_range where\n \"pvar_range r_sv ds = (\\ a. pvar_set (r_sv a) \\ ds)\" \n \nlemma empty_pvar_range: \"pvar_range empty_var_env ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: empty_var_env_def)\n done\n \nlemma comp_pvar_range: \"\\ pvar_range r_sv ds; pvar_range r_xv ds \\ \\ pvar_range (comp_var_env r_sv r_xv) ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: comp_var_env_def)\n done\n \nlemma lift_pvar_range: \"\\ pvar_range r_sv ds; pvar_set_perm p \\ ds \\ \\ pvar_range (lift_var_env r_sv p) ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: lift_var_env_def)\n done\n\nfun tvar_set where\n \"tvar_set (XPerm p) = {}\"\n| \"tvar_set (XType a) = {a}\"\n| \"tvar_set (XComp px qx) = (tvar_set px \\ tvar_set qx)\"\n| \"tvar_set (XLift px q) = (tvar_set px)\" \n| \"tvar_set (XIfZero px qx) = (tvar_set px \\ tvar_set qx)\" \n \ndefinition tvar_range where\n \"tvar_range r_sv ds = (\\ a. tvar_set (r_sv a) \\ ds)\" \n \nlemma empty_tvar_range: \"tvar_range empty_var_env ds\" \n apply (simp add: tvar_range_def)\n apply (simp add: empty_var_env_def)\n done\n \nlemma comp_tvar_range: \"\\ tvar_range r_sv ds; tvar_range r_xv ds \\ \\ tvar_range (comp_var_env r_sv r_xv) ds\" \n apply (simp add: tvar_range_def)\n apply (simp add: comp_var_env_def)\n done\n \nlemma lift_tvar_range: \"\\ tvar_range r_sv ds; tvar_set_perm p \\ ds \\ \\ tvar_range (lift_var_env r_sv p) ds\" \n apply (simp add: tvar_range_def)\n apply (simp add: lift_var_env_def)\n done \n \nlemma subset_pvar_range: \"\\ pvar_range p_sub ds; ds \\ ds' \\ \\ pvar_range p_sub ds'\" \n apply (simp add: pvar_range_def)\n apply (auto)\n done \n \nlemma set_diff_subset: \"\\ ds3 \\ ds4; ds \\ ds2 \\ \\ set_diff ds3 ds2 \\ set_diff ds4 ds\" \n apply (simp add: set_diff_def)\n apply (auto)\n done\n \nlemma ifz_pvar_range: \"\\ pvar_range r_sv ds; pvar_set px \\ ds \\ \\ pvar_range (ifz_var_env px r_sv) ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: ifz_var_env_def)\n done \n\nlemma rem_pvar_range: \"\\ pvar_range r_sv ds \\ \\ pvar_range (rem_var_env r_sv x) ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: rem_var_env_def)\n done \n \nlemma comp_pvar_range_rev1: \"\\ pvar_range (comp_var_env r_sv r_xv) ds \\ \\ pvar_range r_sv ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: comp_var_env_def)\n apply (auto)\n apply (erule_tac x=\"a\" in allE)\n apply (case_tac \"r_sv a = XPerm (SPerm NoPerm) \\ r_xv a = XPerm (SPerm NoPerm)\")\n apply (auto)\n done\n\nlemma comp_pvar_range_rev2: \"\\ pvar_range (comp_var_env r_sv r_xv) ds \\ \\ pvar_range r_xv ds\" \n apply (simp add: pvar_range_def)\n apply (simp add: comp_var_env_def)\n apply (auto)\n apply (erule_tac x=\"a\" in allE)\n apply (case_tac \"r_sv a = XPerm (SPerm NoPerm) \\ r_xv a = XPerm (SPerm NoPerm)\")\n apply (auto)\n done\n \nlemma dir_add_eq_permx: \"\\ tvar_set px \\ ds; a \\ ds \\ \\\n dir_subst_permx (dir_add_env t_sub a tau) p_sub px = dir_subst_permx t_sub p_sub px\" \n apply (induct px)\n apply (auto)\n apply (case_tac \"t_sub x\")\n apply (auto)\n apply (simp_all add: dir_add_env_def)\n apply (auto)\n done\n \nlemma dir_add_cancel_use_env_ih: \"\\ tvar_range r_sv ds; a \\ ds \\ \\\n dir_subst_penv (dir_add_env t_sub a tau) p_sub r_sv x = dir_subst_penv t_sub p_sub r_sv x\" \n apply (simp add: dir_subst_penv_def)\n apply (cut_tac t_sub=\"t_sub\" and a=\"a\" and ds=\"ds\" and px=\"r_sv x\" in dir_add_eq_permx)\n apply (simp add: tvar_range_def)\n apply (simp_all)\n done\n \nlemma dir_list_add_cancel_use_env_ih: \"\\ tvar_range r_sv ds; fresh_list ds (dom_list l) \\ \\\n dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv x = dir_subst_penv t_sub p_sub r_sv x\" \n apply (induct l)\n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (cut_tac t_sub=\"dir_list_add_env t_sub l\" and p_sub=\"p_sub\" and a=\"a\" and tau=\"b\" and x=\"x\" and ds=\"ds\" in dir_add_cancel_use_env_ih)\n apply (auto)\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: fresh_list_def)\n done\n \nlemma dir_list_add_cancel_use_env: \"\\ tvar_range r_sv ds; fresh_list ds (dom_list l) \\ \\\n dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv = dir_subst_penv t_sub p_sub r_sv\" \n apply (case_tac \"\\ x. dir_subst_penv (dir_list_add_env t_sub l) p_sub r_sv x = dir_subst_penv t_sub p_sub r_sv x\")\n apply (auto)\n apply (cut_tac t_sub=\"t_sub\" and x=\"x\" in dir_list_add_cancel_use_env_ih)\n apply (auto)\n done \n \nlemma ifz_tvar_range: \"\\ tvar_range r_sv ds; tvar_set px \\ ds \\ \\ tvar_range (ifz_var_env px r_sv) ds\" \n apply (simp add: tvar_range_def)\n apply (simp add: ifz_var_env_def)\n done \n \nlemma infer_s_sub_range: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds' \\ \\ pvar_range r_sv (set_diff ds' ds) \\ pvar_range r_xv (set_diff ds' ds)\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op + var cases *)\n apply (rule_tac empty_pvar_range)\n apply (rule_tac empty_pvar_range)\n apply (simp add: pvar_range_def)\n apply (simp add: one_var_env_def)\n apply (simp add: pvar_range_def)\n apply (simp add: one_var_env_def)\n (* pair case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac ifz_pvar_range)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* lam case *)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac rem_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 (insert a ds)\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (cut_tac ds=\"insert a ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac rem_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 (insert a ds)\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n (* app case *)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (rule_tac ifz_pvar_range)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)(*\n apply (simp add: set_diff_def)\n apply (case_tac \"p_a \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)*)\n done\n\nlemma add_sub_range: \"\\ sub_range env_v ds \\ \\ sub_range (add_env env_v x a) (insert a ds)\" \n apply (simp add: sub_range_def)\n apply (simp add: add_env_def)\n apply (auto)\n apply (erule_tac x=\"xa\" in allE)\n apply (case_tac \"env_v xa\")\n apply (auto)\n done\n \nlemma infer_m_sub_range: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds' \\ \\ pvar_range r_mv (set_diff ds' ds)\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op + var cases *)\n apply (rule_tac empty_pvar_range)\n apply (rule_tac empty_pvar_range)\n apply (simp add: pvar_range_def)\n apply (simp add: one_var_env_def)\n (* pair case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (simp)\n apply (simp add: set_diff_def)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac ds=\"set_diff ds' ds3\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n (* lam case *)\n apply (rule_tac empty_pvar_range)\n (* app case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds2 ds\" in subset_pvar_range)\n apply (rule_tac comp_pvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and r_xv=\"r_x1\" and ds'=\"ds2\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac comp_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (rule_tac lift_pvar_range)\n apply (rule_tac ds=\"set_diff ds3 ds2\" in subset_pvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and r_xv=\"r_x2\" and ds'=\"ds3\" in infer_s_sub_range)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n apply (case_tac \"p \\ ds3\")\n apply (simp add: fresh_list_def)\n apply (auto)\n apply (simp add: set_diff_def)\n apply (auto)\n done\n \nlemma rem_tvar_range: \"\\ tvar_range r_sv ds \\ \\ tvar_range (rem_var_env r_sv x) ds\" \n apply (simp add: tvar_range_def)\n apply (simp add: rem_var_env_def)\n done \n \nlemma subset_tvar_range: \"\\ tvar_range r_sv ds; ds \\ ds' \\ \\ tvar_range r_sv ds'\"\n apply (simp add: tvar_range_def)\n apply (auto)\n done\n \nlemma infer_tvar_range: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\\n tvar_range r_sv ds' \\ tvar_range r_xv ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op + var cases *)\n apply (rule_tac empty_tvar_range)\n apply (rule_tac empty_tvar_range)\n apply (simp add: tvar_range_def)\n apply (simp add: one_var_env_def)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"owner_name x\" in allE)\n apply (auto)\n apply (simp add: tvar_range_def)\n apply (simp add: one_var_env_def)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"owner_name x\" in allE)\n apply (auto)\n (* pair case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (simp)\n apply (rule_tac lift_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (simp)\n apply (rule_tac lift_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac ifz_tvar_range)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac lift_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds'\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n (* lam case *)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (auto)\n apply (rule_tac rem_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and x=\"Var x1a\" and a=\"a\" in add_sub_range)\n apply (auto)\n apply (rule_tac rem_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n (* app case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (auto)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac ifz_tvar_range)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n done \n\nlemma infer_m_tvar_range: \"\\ infer_type env_v ds e tau_v r_sv r_xv r_mv c_list ds'; sub_range env_v ds \\ \\ tvar_range r_mv ds'\" \n apply (induct e arbitrary: env_v ds tau_v r_sv r_xv r_mv c_list ds')\n apply (auto)\n (* const + op + var cases *)\n apply (rule_tac empty_tvar_range)\n apply (rule_tac empty_tvar_range)\n apply (simp add: tvar_range_def)\n apply (simp add: one_var_env_def)\n apply (simp add: sub_range_def)\n apply (erule_tac x=\"owner_name x\" in allE)\n apply (auto)\n (* pair case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n (* if case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds3\" and ds'=\"ds'\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and ds'=\"ds3\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n (* lam case *)\n apply (rule_tac empty_tvar_range)\n (* app case *)\n apply (cut_tac ds=\"ds\" and ds'=\"ds2\" in infer_x_subset)\n apply (auto)\n apply (cut_tac ds=\"ds2\" and ds'=\"ds3\" in infer_x_subset)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds\" and ds'=\"ds2\" in subset_sub_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds2\" in subset_tvar_range)\n apply (rule_tac comp_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and r_xv=\"r_x1\" and ds'=\"ds2\" in infer_tvar_range)\n apply (auto)\n apply (rule_tac comp_tvar_range)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (rule_tac lift_tvar_range)\n apply (rule_tac ds=\"ds3\" in subset_tvar_range)\n apply (auto)\n apply (cut_tac env_v=\"env_v\" and ds=\"ds2\" and r_xv=\"r_x2\" and ds'=\"ds3\" in infer_tvar_range)\n apply (auto)\n done \n \nfun tvar_type where\n \"tvar_type IntScheme = {}\"\n | \"tvar_type BoolScheme = {}\"\n | \"tvar_type UnitScheme = {}\"\n | \"tvar_type (VarScheme a) = {a}\"\n | \"tvar_type (ArrayScheme tau) = tvar_type tau\"\n | \"tvar_type (PairScheme t1 t2 p) = tvar_type t1 \\ tvar_type t2\"\n | \"tvar_type (FunScheme t1 t2 p a) = tvar_type t1 \\ tvar_type t2\"\n | \"tvar_type (ChanScheme tau c_end) = tvar_type tau\" \n \nend\n", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/InferRange.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.25057414624159413}} {"text": "(* Title: HOL/Auth/CertifiedEmail.thy\n Author: Giampaolo Bella, Christiano Longo and Lawrence C Paulson\n*)\n\nsection\\The Certified Electronic Mail Protocol by Abadi et al.\\\n\ntheory CertifiedEmail imports Public begin\n\nabbreviation\n TTP :: agent where\n \"TTP == Server\"\n\nabbreviation\n RPwd :: \"agent => key\" where\n \"RPwd == shrK\"\n\n \n(*FIXME: the four options should be represented by pairs of 0 or 1.\n Right now only BothAuth is modelled.*)\nconsts\n NoAuth :: nat\n TTPAuth :: nat\n SAuth :: nat\n BothAuth :: nat\n\ntext\\We formalize a fixed way of computing responses. Could be better.\\\ndefinition \"response\" :: \"agent => agent => nat => msg\" where\n \"response S R q == Hash \\Agent S, Key (shrK R), Nonce q\\\"\n\n\ninductive_set certified_mail :: \"event list set\"\n where\n\n Nil: \\\\The empty trace\\\n \"[] \\ certified_mail\"\n\n| Fake: \\\\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"[| evsf \\ certified_mail; X \\ synth(analz(spies evsf))|] \n ==> Says Spy B X # evsf \\ certified_mail\"\n\n| FakeSSL: \\\\The Spy may open SSL sessions with TTP, who is the only agent\n equipped with the necessary credentials to serve as an SSL server.\\\n \"[| evsfssl \\ certified_mail; X \\ synth(analz(spies evsfssl))|]\n ==> Notes TTP \\Agent Spy, Agent TTP, X\\ # evsfssl \\ certified_mail\"\n\n| CM1: \\\\The sender approaches the recipient. The message is a number.\\\n \"[|evs1 \\ certified_mail;\n Key K \\ used evs1;\n K \\ symKeys;\n Nonce q \\ used evs1;\n hs = Hash\\Number cleartext, Nonce q, response S R q, Crypt K (Number m)\\;\n S2TTP = Crypt(pubEK TTP) \\Agent S, Number BothAuth, Key K, Agent R, hs\\|]\n ==> Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number BothAuth, \n Number cleartext, Nonce q, S2TTP\\ # evs1 \n \\ certified_mail\"\n\n| CM2: \\\\The recipient records @{term S2TTP} while transmitting it and her\n password to @{term TTP} over an SSL channel.\\\n \"[|evs2 \\ certified_mail;\n Gets R \\Agent S, Agent TTP, em, Number BothAuth, Number cleartext, \n Nonce q, S2TTP\\ \\ set evs2;\n TTP \\ R; \n hr = Hash \\Number cleartext, Nonce q, response S R q, em\\ |]\n ==> \n Notes TTP \\Agent R, Agent TTP, S2TTP, Key(RPwd R), hr\\ # evs2\n \\ certified_mail\"\n\n| CM3: \\\\@{term TTP} simultaneously reveals the key to the recipient and gives\n a receipt to the sender. The SSL channel does not authenticate \n the client (@{term R}), but @{term TTP} accepts the message only \n if the given password is that of the claimed sender, @{term R}.\n He replies over the established SSL channel.\\\n \"[|evs3 \\ certified_mail;\n Notes TTP \\Agent R, Agent TTP, S2TTP, Key(RPwd R), hr\\ \\ set evs3;\n S2TTP = Crypt (pubEK TTP) \n \\Agent S, Number BothAuth, Key k, Agent R, hs\\;\n TTP \\ R; hs = hr; k \\ symKeys|]\n ==> \n Notes R \\Agent TTP, Agent R, Key k, hr\\ # \n Gets S (Crypt (priSK TTP) S2TTP) # \n Says TTP S (Crypt (priSK TTP) S2TTP) # evs3 \\ certified_mail\"\n\n| Reception:\n \"[|evsr \\ certified_mail; Says A B X \\ set evsr|]\n ==> Gets B X#evsr \\ certified_mail\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare analz_into_parts [dest]\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"[| Key K \\ used []; K \\ symKeys |] ==> \n \\S2TTP. \\evs \\ certified_mail.\n Says TTP S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] certified_mail.Nil\n [THEN certified_mail.CM1, THEN certified_mail.Reception,\n THEN certified_mail.CM2, \n THEN certified_mail.CM3]) \napply (possibility, auto) \ndone\n\n\nlemma Gets_imp_Says:\n \"[| Gets B X \\ set evs; evs \\ certified_mail |] ==> \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, auto)\ndone\n\n\nlemma Gets_imp_parts_knows_Spy:\n \"[|Gets A X \\ set evs; evs \\ certified_mail|] ==> X \\ parts(spies evs)\"\napply (drule Gets_imp_Says, simp)\napply (blast dest: Says_imp_knows_Spy parts.Inj) \ndone\n\nlemma CM2_S2TTP_analz_knows_Spy:\n \"[|Gets R \\Agent A, Agent B, em, Number AO, Number cleartext, \n Nonce q, S2TTP\\ \\ set evs;\n evs \\ certified_mail|] \n ==> S2TTP \\ analz(spies evs)\"\napply (drule Gets_imp_Says, simp) \napply (blast dest: Says_imp_knows_Spy analz.Inj) \ndone\n\nlemmas CM2_S2TTP_parts_knows_Spy = \n CM2_S2TTP_analz_knows_Spy [THEN analz_subset_parts [THEN subsetD]]\n\nlemma hr_form_lemma [rule_format]:\n \"evs \\ certified_mail\n ==> hr \\ synth (analz (spies evs)) --> \n (\\S2TTP. Notes TTP \\Agent R, Agent TTP, S2TTP, pwd, hr\\\n \\ set evs --> \n (\\clt q S em. hr = Hash \\Number clt, Nonce q, response S R q, em\\))\"\napply (erule certified_mail.induct)\napply (synth_analz_mono_contra, simp_all, blast+)\ndone \n\ntext\\Cannot strengthen the first disjunct to @{term \"R\\Spy\"} because\nthe fakessl rule allows Spy to spoof the sender's name. Maybe can\nstrengthen the second disjunct with @{term \"R\\Spy\"}.\\\nlemma hr_form:\n \"[|Notes TTP \\Agent R, Agent TTP, S2TTP, pwd, hr\\ \\ set evs;\n evs \\ certified_mail|]\n ==> hr \\ synth (analz (spies evs)) | \n (\\clt q S em. hr = Hash \\Number clt, Nonce q, response S R q, em\\)\"\nby (blast intro: hr_form_lemma) \n\nlemma Spy_dont_know_private_keys [dest!]:\n \"[|Key (privateKey b A) \\ parts (spies evs); evs \\ certified_mail|]\n ==> A \\ bad\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\\napply (blast dest: Fake_parts_insert_in_Un) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \n apply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD] \n analz_subset_parts [THEN subsetD], blast) \ndone\n\nlemma Spy_know_private_keys_iff [simp]:\n \"evs \\ certified_mail\n ==> (Key (privateKey b A) \\ parts (spies evs)) = (A \\ bad)\"\nby blast \n\nlemma Spy_dont_know_TTPKey_parts [simp]:\n \"evs \\ certified_mail ==> Key (privateKey b TTP) \\ parts(spies evs)\" \nby simp\n\nlemma Spy_dont_know_TTPKey_analz [simp]:\n \"evs \\ certified_mail ==> Key (privateKey b TTP) \\ analz(spies evs)\"\nby auto\n\ntext\\Thus, prove any goal that assumes that @{term Spy} knows a private key\nbelonging to @{term TTP}\\\ndeclare Spy_dont_know_TTPKey_parts [THEN [2] rev_notE, elim!]\n\n\nlemma CM3_k_parts_knows_Spy:\n \"[| evs \\ certified_mail;\n Notes TTP \\Agent A, Agent TTP,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, \n Agent R, hs\\, Key (RPwd R), hs\\ \\ set evs|]\n ==> Key K \\ parts(spies evs)\"\napply (rotate_tac 1)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\n apply (blast intro:parts_insertI)\ntxt\\Fake SSL\\\napply (blast dest: parts.Body) \ntxt\\Message 2\\\napply (blast dest!: Gets_imp_Says elim!: knows_Spy_partsEs)\ntxt\\Message 3\\\napply (metis parts_insertI)\ndone\n\nlemma Spy_dont_know_RPwd [rule_format]:\n \"evs \\ certified_mail ==> Key (RPwd A) \\ parts(spies evs) --> A \\ bad\"\napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (blast dest: Fake_parts_insert_in_Un) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \napply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD]\n analz_subset_parts [THEN subsetD])\ndone\n\n\nlemma Spy_know_RPwd_iff [simp]:\n \"evs \\ certified_mail ==> (Key (RPwd A) \\ parts(spies evs)) = (A\\bad)\"\nby (auto simp add: Spy_dont_know_RPwd) \n\nlemma Spy_analz_RPwd_iff [simp]:\n \"evs \\ certified_mail ==> (Key (RPwd A) \\ analz(spies evs)) = (A\\bad)\"\nby (metis Spy_know_RPwd_iff Spy_spies_bad_shrK analz.Inj analz_into_parts)\n\ntext\\Unused, but a guarantee of sorts\\\ntheorem CertAutenticity:\n \"[|Crypt (priSK TTP) X \\ parts (spies evs); evs \\ certified_mail|] \n ==> \\A. Says TTP A (Crypt (priSK TTP) X) \\ set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (blast dest: Spy_dont_know_private_keys Fake_parts_insert_in_Un)\ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2 parts_insert_knows_A) \n apply (blast dest!: Fake_parts_sing_imp_Un, blast)\ndone\n\n\nsubsection\\Proving Confidentiality Results\\\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\ certified_mail ==>\n \\K KK. invKey (pubEK TTP) \\ KK -->\n (Key K \\ analz (Key`KK Un (spies evs))) =\n (K \\ KK | Key K \\ analz (spies evs))\"\napply (erule certified_mail.induct)\napply (drule_tac [6] A=TTP in symKey_neq_priEK) \napply (erule_tac [6] disjE [OF hr_form]) \napply (drule_tac [5] CM2_S2TTP_analz_knows_Spy) \nprefer 9\napply (elim exE)\napply (simp_all add: synth_analz_insert_eq\n subset_trans [OF _ subset_insertI]\n subset_trans [OF _ Un_upper2] \n del: image_insert image_Un add: analz_image_freshK_simps)\ndone\n\n\nlemma analz_insert_freshK:\n \"[| evs \\ certified_mail; KAB \\ invKey (pubEK TTP) |] ==>\n (Key K \\ analz (insert (Key KAB) (spies evs))) =\n (K = KAB | Key K \\ analz (spies evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\ntext\\@{term S2TTP} must have originated from a valid sender\n provided @{term K} is secure. Proof is surprisingly hard.\\\n\nlemma Notes_SSL_imp_used:\n \"[|Notes B \\Agent A, Agent B, X\\ \\ set evs|] ==> X \\ used evs\"\nby (blast dest!: Notes_imp_used)\n\n\n(*The weaker version, replacing \"used evs\" by \"parts (spies evs)\", \n isn't inductive: message 3 case can't be proved *)\nlemma S2TTP_sender_lemma [rule_format]:\n \"evs \\ certified_mail ==>\n Key K \\ analz (spies evs) -->\n (\\AO. Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs\\ \\ used evs -->\n (\\m ctxt q. \n hs = Hash\\Number ctxt, Nonce q, response S R q, Crypt K (Number m)\\ &\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number ctxt, Nonce q,\n Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs \\\\ \\ set evs))\" \napply (erule certified_mail.induct, analz_mono_contra)\napply (drule_tac [5] CM2_S2TTP_parts_knows_Spy, simp)\napply (simp add: used_Nil Crypt_notin_initState, simp_all)\ntxt\\Fake\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Fake SSL\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest: analz_subset_parts [THEN subsetD]) \ntxt\\Message 1\\\napply (clarsimp, blast)\ntxt\\Message 2\\\napply (simp add: parts_insert2, clarify) \napply (metis parts_cut Un_empty_left usedI)\ntxt\\Message 3\\ \napply (blast dest: Notes_SSL_imp_used used_parts_subset_parts) \ndone \n\nlemma S2TTP_sender:\n \"[|Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\ \\ used evs;\n Key K \\ analz (spies evs);\n evs \\ certified_mail|]\n ==> \\m ctxt q. \n hs = Hash\\Number ctxt, Nonce q, response S R q, Crypt K (Number m)\\ &\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number ctxt, Nonce q,\n Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, hs\\\\ \\ set evs\" \nby (blast intro: S2TTP_sender_lemma) \n\n\ntext\\Nobody can have used non-existent keys!\\\nlemma new_keys_not_used [simp]:\n \"[|Key K \\ used evs; K \\ symKeys; evs \\ certified_mail|]\n ==> K \\ keysFor (parts (spies evs))\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all) \ntxt\\Fake\\\napply (force dest!: keysFor_parts_insert) \ntxt\\Message 1\\\napply blast \ntxt\\Message 3\\\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption) \napply (force dest!: keysFor_parts_insert)\ndone\n\n\ntext\\Less easy to prove @{term \"m'=m\"}. Maybe needs a separate unicity\ntheorem for ciphertexts of the form @{term \"Crypt K (Number m)\"}, \nwhere @{term K} is secure.\\\nlemma Key_unique_lemma [rule_format]:\n \"evs \\ certified_mail ==>\n Key K \\ analz (spies evs) -->\n (\\m cleartext q hs.\n Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number cleartext, Nonce q,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\\\\n \\ set evs -->\n (\\m' cleartext' q' hs'.\n Says S' R'\n \\Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n Number cleartext', Nonce q',\n Crypt (pubEK TTP) \\Agent S', Number AO', Key K, Agent R', hs'\\\\\n \\ set evs --> R' = R & S' = S & AO' = AO & hs' = hs))\" \napply (erule certified_mail.induct, analz_mono_contra, simp_all)\n prefer 2\n txt\\Message 1\\\n apply (blast dest!: Says_imp_knows_Spy [THEN parts.Inj] new_keys_not_used Crypt_imp_keysFor)\ntxt\\Fake\\\napply (auto dest!: usedI S2TTP_sender analz_subset_parts [THEN subsetD]) \ndone\n\ntext\\The key determines the sender, recipient and protocol options.\\\nlemma Key_unique:\n \"[|Says S R\n \\Agent S, Agent TTP, Crypt K (Number m), Number AO,\n Number cleartext, Nonce q,\n Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\\\\n \\ set evs;\n Says S' R'\n \\Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n Number cleartext', Nonce q',\n Crypt (pubEK TTP) \\Agent S', Number AO', Key K, Agent R', hs'\\\\\n \\ set evs;\n Key K \\ analz (spies evs);\n evs \\ certified_mail|]\n ==> R' = R & S' = S & AO' = AO & hs' = hs\"\nby (rule Key_unique_lemma, assumption+)\n\n\nsubsection\\The Guarantees for Sender and Recipient\\\n\ntext\\A Sender's guarantee:\n If Spy gets the key then @{term R} is bad and @{term S} moreover\n gets his return receipt (and therefore has no grounds for complaint).\\\ntheorem S_fairness_bad_R:\n \"[|Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n Key K \\ analz (spies evs);\n evs \\ certified_mail;\n S\\Spy|]\n ==> R \\ bad & Gets S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\\napply spy_analz\ntxt\\Fake SSL\\\napply spy_analz\ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: synth_analz_insert_eq \n subset_trans [OF _ subset_insertI]\n subset_trans [OF _ Un_upper2] \n del: image_insert image_Un add: analz_image_freshK_simps) \napply (simp_all add: symKey_neq_priEK analz_insert_freshK)\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique)+\ndone\n\ntext\\Confidentially for the symmetric key\\\ntheorem Spy_not_see_encrypted_key:\n \"[|Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n evs \\ certified_mail;\n S\\Spy; R \\ bad|]\n ==> Key K \\ analz(spies evs)\"\nby (blast dest: S_fairness_bad_R) \n\n\ntext\\Agent @{term R}, who may be the Spy, doesn't receive the key\n until @{term S} has access to the return receipt.\\ \ntheorem S_guarantee:\n \"[|Says S R \\Agent S, Agent TTP, Crypt K (Number m), Number AO, \n Number cleartext, Nonce q, S2TTP\\ \\ set evs;\n S2TTP = Crypt (pubEK TTP) \\Agent S, Number AO, Key K, Agent R, hs\\;\n Notes R \\Agent TTP, Agent R, Key K, hs\\ \\ set evs;\n S\\Spy; evs \\ certified_mail|]\n ==> Gets S (Crypt (priSK TTP) S2TTP) \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt\\Message 1\\\napply (blast dest: Notes_imp_used) \ntxt\\Message 3\\\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique S_fairness_bad_R) \ndone\n\n\ntext\\If @{term R} sends message 2, and a delivery certificate exists, \n then @{term R} receives the necessary key. This result is also important\n to @{term S}, as it confirms the validity of the return receipt.\\\ntheorem RR_validity:\n \"[|Crypt (priSK TTP) S2TTP \\ used evs;\n S2TTP = Crypt (pubEK TTP)\n \\Agent S, Number AO, Key K, Agent R, \n Hash \\Number cleartext, Nonce q, r, em\\\\;\n hr = Hash \\Number cleartext, Nonce q, r, em\\;\n R\\Spy; evs \\ certified_mail|]\n ==> Notes R \\Agent TTP, Agent R, Key K, hr\\ \\ set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule ssubst)\napply (erule certified_mail.induct, simp_all)\ntxt\\Fake\\ \napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Fake SSL\\\napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ntxt\\Message 2\\\napply (drule CM2_S2TTP_parts_knows_Spy, assumption)\napply (force dest: parts_cut)\ntxt\\Message 3\\\napply (frule_tac hr_form, assumption)\napply (elim disjE exE, simp_all) \napply (blast dest: Fake_parts_sing [THEN subsetD]\n dest!: analz_subset_parts [THEN subsetD]) \ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/CertifiedEmail.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.41489884579676883, "lm_q1q2_score": 0.25057061483747967}} {"text": "(* Title: HOL/Auth/n_mutualEx_on_ini.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_on_ini imports n_mutualEx_base\nbegin\nlemma iniImply_inv__1:\nassumes a1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nand a2: \"formEval (andList (allInitSpecs N)) s\"\nshows \"formEval f s\"\nusing a1 a2 by auto\n\nlemma iniImply_inv__2:\nassumes a1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\nand a2: \"formEval (andList (allInitSpecs N)) s\"\nshows \"formEval f s\"\nusing a1 a2 by auto\n\nlemma iniImply_inv__3:\nassumes a1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nand a2: \"formEval (andList (allInitSpecs N)) s\"\nshows \"formEval f s\"\nusing a1 a2 by auto\n\nlemma iniImply_inv__4:\nassumes a1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\nand a2: \"formEval (andList (allInitSpecs N)) s\"\nshows \"formEval f s\"\nusing a1 a2 by auto\n\nlemma iniImply_inv__5:\nassumes a1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\nand a2: \"formEval (andList (allInitSpecs N)) s\"\nshows \"formEval f s\"\nusing a1 a2 by auto\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_on_ini.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.25046624158606906}} {"text": "(* Title: JinjaThreads/Compiler/Correctness1.thy\n Author: Andreas Lochbihler, Tobias Nipkow\n\n reminiscent of the Jinja theory Compiler/Correctness1\n*)\n\nheader {* \\isaheader{Semantic Correctness of Stage 1} *}\n\ntheory Correctness1 imports\n J0J1Bisim\n \"../J/DefAssPreservation\"\nbegin\n\nlemma finals_map_Val [simp]: \"finals (map Val vs)\"\nby(simp add: finals_iff)\n\ncontext J_heap_base begin\n\nlemma \\red0r_preserves_defass:\n assumes wf: \"wf_J_prog P\"\n shows \"\\ \\red0r extTA P t h (e, xs) (e', xs'); \\ e \\dom xs\\ \\ \\ \\ e' \\dom xs'\\\"\nby(induct rule: rtranclp_induct2)(auto dest: red_preserves_defass[OF wf])\n\nlemma \\red0t_preserves_defass:\n assumes wf: \"wf_J_prog P\"\n shows \"\\ \\red0t extTA P t h (e, xs) (e', xs'); \\ e \\dom xs\\ \\ \\ \\ e' \\dom xs'\\\"\nby(rule \\red0r_preserves_defass[OF wf])(rule tranclp_into_rtranclp)\n\nend\n\nlemma LAss_lem:\n \"\\x \\ set xs; size xs \\ size ys \\\n \\ m1 \\\\<^sub>m m2(xs[\\]ys) \\ m1(x\\y) \\\\<^sub>m m2(xs[\\]ys[index xs x := y])\"\napply(simp add:map_le_def)\napply(simp add:fun_upds_apply index_less_aux eq_sym_conv)\ndone\n\nlemma Block_lem:\nfixes l :: \"'a \\ 'b\"\nassumes 0: \"l \\\\<^sub>m [Vs [\\] ls]\"\n and 1: \"l' \\\\<^sub>m [Vs [\\] ls', V\\v]\"\n and hidden: \"V \\ set Vs \\ ls ! index Vs V = ls' ! index Vs V\"\n and size: \"size ls = size ls'\" \"size Vs < size ls'\"\nshows \"l'(V := l V) \\\\<^sub>m [Vs [\\] ls']\"\nproof -\n have \"l'(V := l V) \\\\<^sub>m [Vs [\\] ls', V\\v](V := l V)\"\n using 1 by(rule map_le_upd)\n also have \"\\ = [Vs [\\] ls'](V := l V)\" by simp\n also have \"\\ \\\\<^sub>m [Vs [\\] ls']\"\n proof (cases \"l V\")\n case None thus ?thesis by simp\n next\n case (Some w)\n hence \"[Vs [\\] ls] V = Some w\"\n using 0 by(force simp add: map_le_def split:if_splits)\n hence VinVs: \"V \\ set Vs\" and w: \"w = ls ! index Vs V\"\n using size by(auto simp add:fun_upds_apply split:if_splits)\n hence \"w = ls' ! index Vs V\" using hidden[OF VinVs] by simp\n hence \"[Vs [\\] ls'](V := l V) = [Vs [\\] ls']\"\n using Some size VinVs by(simp add:index_less_aux map_upds_upd_conv_index)\n thus ?thesis by simp\n qed\n finally show ?thesis .\nqed\n\nsubsection {* Correctness proof *}\n\nlocale J0_J1_heap_base =\n J: J_heap_base +\n J1: J1_heap_base + \n constrains addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\nbegin\n\nlemma ta_bisim01_extTA2J0_extTA2J1:\n assumes wf: \"wf_J_prog P\"\n and nt: \"\\n T C M a h. \\ n < length \\ta\\\\<^bsub>t\\<^esub>; \\ta\\\\<^bsub>t\\<^esub> ! n = NewThread T (C, M, a) h \\\n \\ typeof_addr h a = \\Class_type C\\ \\ (\\T meth D. P \\ C sees M:[]\\T =\\meth\\ in D)\"\n shows \"ta_bisim01 (extTA2J0 P ta) (extTA2J1 (compP1 P) ta)\"\napply(simp add: ta_bisim_def ta_upd_simps)\napply(auto intro!: list_all2_all_nthI)\napply(case_tac \"\\ta\\\\<^bsub>t\\<^esub> ! n\")\n apply(auto simp add: bisim_red0_Red1_def)\napply(drule (1) nt)\napply(clarify)\napply(erule bisim_list_extTA2J0_extTA2J1[OF wf, simplified])\ndone\n\nlemma red_external_ta_bisim01: \n \"\\ wf_J_prog P; P,t \\ \\a\\M(vs), h\\ -ta\\ext \\va, h'\\ \\ \\ ta_bisim01 (extTA2J0 P ta) (extTA2J1 (compP1 P) ta)\"\napply(rule ta_bisim01_extTA2J0_extTA2J1, assumption)\napply(drule (1) red_external_new_thread_sees, auto simp add: in_set_conv_nth)\napply(drule red_ext_new_thread_heap, auto simp add: in_set_conv_nth)\ndone\n\nlemmas \\red1t_expr =\n NewArray_\\red1t_xt Cast_\\red1t_xt InstanceOf_\\red1t_xt BinOp_\\red1t_xt1 BinOp_\\red1t_xt2 LAss_\\red1t\n AAcc_\\red1t_xt1 AAcc_\\red1t_xt2 AAss_\\red1t_xt1 AAss_\\red1t_xt2 AAss_\\red1t_xt3\n ALength_\\red1t_xt FAcc_\\red1t_xt FAss_\\red1t_xt1 FAss_\\red1t_xt2 Call_\\red1t_obj\n Call_\\red1t_param Block_None_\\red1t_xt Block_\\red1t_Some Sync_\\red1t_xt InSync_\\red1t_xt\n Seq_\\red1t_xt Cond_\\red1t_xt Throw_\\red1t_xt Try_\\red1t_xt\n\nlemmas \\red1r_expr =\n NewArray_\\red1r_xt Cast_\\red1r_xt InstanceOf_\\red1r_xt BinOp_\\red1r_xt1 BinOp_\\red1r_xt2 LAss_\\red1r\n AAcc_\\red1r_xt1 AAcc_\\red1r_xt2 AAss_\\red1r_xt1 AAss_\\red1r_xt2 AAss_\\red1r_xt3\n ALength_\\red1r_xt FAcc_\\red1r_xt FAss_\\red1r_xt1 FAss_\\red1r_xt2 Call_\\red1r_obj\n Call_\\red1r_param Block_None_\\red1r_xt Block_\\red1r_Some Sync_\\red1r_xt InSync_\\red1r_xt\n Seq_\\red1r_xt Cond_\\red1r_xt Throw_\\red1r_xt Try_\\red1r_xt\n\ndefinition sim_move01 :: \n \"'addr J1_prog \\ 'thread_id \\ ('addr, 'thread_id, 'heap) J0_thread_action \\ 'addr expr \\ 'addr expr1 \\ 'heap\n \\ 'addr locals1 \\ ('addr, 'thread_id, 'heap) external_thread_action \\ 'addr expr1 \\ 'heap \\ 'addr locals1 \\ bool\"\nwhere\n \"sim_move01 P t ta0 e0 e h xs ta e' h' xs' \\ \\ final e0 \\\n (if \\move0 P h e0 then h' = h \\ ta0 = \\ \\ ta = \\ \\ \\red1't P t h (e, xs) (e', xs')\n else ta_bisim01 ta0 (extTA2J1 P ta) \\\n (if call e0 = None \\ call1 e = None\n then (\\e'' xs''. \\red1'r P t h (e, xs) (e'', xs'') \\ False,P,t \\1 \\e'', (h, xs'')\\ -ta\\ \\e', (h', xs')\\ \\\n \\ \\move1 P h e'')\n else False,P,t \\1 \\e, (h, xs)\\ -ta\\ \\e', (h', xs')\\ \\ \\ \\move1 P h e))\"\n\ndefinition sim_moves01 :: \n \"'addr J1_prog \\ 'thread_id \\ ('addr, 'thread_id, 'heap) J0_thread_action \\ 'addr expr list \\ 'addr expr1 list \\ 'heap\n \\ 'addr locals1 \\ ('addr, 'thread_id, 'heap) external_thread_action \\ 'addr expr1 list \\ 'heap \\ 'addr locals1 \\ bool\"\nwhere\n \"sim_moves01 P t ta0 es0 es h xs ta es' h' xs' \\ \\ finals es0 \\\n (if \\moves0 P h es0 then h' = h \\ ta0 = \\ \\ ta = \\ \\ \\reds1't P t h (es, xs) (es', xs')\n else ta_bisim01 ta0 (extTA2J1 P ta) \\\n (if calls es0 = None \\ calls1 es = None\n then (\\es'' xs''. \\reds1'r P t h (es, xs) (es'', xs'') \\ False,P,t \\1 \\es'', (h, xs'')\\ [-ta\\] \\es', (h', xs')\\ \\ \n \\ \\moves1 P h es'')\n else False,P,t \\1 \\es, (h, xs)\\ [-ta\\] \\es', (h', xs')\\ \\ \\ \\moves1 P h es))\"\n\ndeclare \\red1t_expr [elim!] \\red1r_expr[elim!]\n\nlemma sim_move01_expr:\n assumes \"sim_move01 P t ta0 e0 e h xs ta e' h' xs'\"\n shows\n \"sim_move01 P t ta0 (newA T\\e0\\) (newA T\\e\\) h xs ta (newA T\\e'\\) h' xs'\"\n \"sim_move01 P t ta0 (Cast T e0) (Cast T e) h xs ta (Cast T e') h' xs'\"\n \"sim_move01 P t ta0 (e0 instanceof T) (e instanceof T) h xs ta (e' instanceof T) h' xs'\"\n \"sim_move01 P t ta0 (e0 \\bop\\ e2) (e \\bop\\ e2') h xs ta (e' \\bop\\ e2') h' xs'\"\n \"sim_move01 P t ta0 (Val v \\bop\\ e0) (Val v \\bop\\ e) h xs ta (Val v \\bop\\ e') h' xs'\"\n \"sim_move01 P t ta0 (V := e0) (V' := e) h xs ta (V' := e') h' xs'\"\n \"sim_move01 P t ta0 (e0\\e2\\) (e\\e2'\\) h xs ta (e'\\e2'\\) h' xs'\"\n \"sim_move01 P t ta0 (Val v\\e0\\) (Val v\\e\\) h xs ta (Val v\\e'\\) h' xs'\"\n \"sim_move01 P t ta0 (e0\\e2\\ := e3) (e\\e2'\\ := e3') h xs ta (e'\\e2'\\ := e3') h' xs'\"\n \"sim_move01 P t ta0 (Val v\\e0\\ := e3) (Val v\\e\\ := e3') h xs ta (Val v\\e'\\ := e3') h' xs'\"\n \"sim_move01 P t ta0 (AAss (Val v) (Val v') e0) (AAss (Val v) (Val v') e) h xs ta (AAss (Val v) (Val v') e') h' xs'\"\n \"sim_move01 P t ta0 (e0\\length) (e\\length) h xs ta (e'\\length) h' xs'\"\n \"sim_move01 P t ta0 (e0\\F{D}) (e\\F'{D'}) h xs ta (e'\\F'{D'}) h' xs'\"\n \"sim_move01 P t ta0 (FAss e0 F D e2) (FAss e F' D' e2') h xs ta (FAss e' F' D' e2') h' xs'\"\n \"sim_move01 P t ta0 (FAss (Val v) F D e0) (FAss (Val v) F' D' e) h xs ta (FAss (Val v) F' D' e') h' xs'\"\n \"sim_move01 P t ta0 (e0\\M(es)) (e\\M(es')) h xs ta (e'\\M(es')) h' xs'\"\n \"sim_move01 P t ta0 ({V:T=vo; e0}) ({V':T=None; e}) h xs ta ({V':T=None; e'}) h' xs'\"\n \"sim_move01 P t ta0 (sync(e0) e2) (sync\\<^bsub>V'\\<^esub>(e) e2') h xs ta (sync\\<^bsub>V'\\<^esub>(e') e2') h' xs'\"\n \"sim_move01 P t ta0 (insync(a) e0) (insync\\<^bsub>V'\\<^esub>(a') e) h xs ta (insync\\<^bsub>V'\\<^esub>(a') e') h' xs'\"\n \"sim_move01 P t ta0 (e0;;e2) (e;;e2') h xs ta (e';;e2') h' xs'\"\n \"sim_move01 P t ta0 (if (e0) e2 else e3) (if (e) e2' else e3') h xs ta (if (e') e2' else e3') h' xs'\"\n \"sim_move01 P t ta0 (throw e0) (throw e) h xs ta (throw e') h' xs'\"\n \"sim_move01 P t ta0 (try e0 catch(C V) e2) (try e catch(C' V') e2') h xs ta (try e' catch(C' V') e2') h' xs'\"\nusing assms\napply(simp_all add: sim_move01_def final_iff \\red1r_Val \\red1t_Val split: split_if_asm split del: split_if)\napply(fastforce simp add: final_iff \\red1r_Val \\red1t_Val intro: red1_reds1.intros)+\ndone\n\nlemma sim_moves01_expr:\n \"sim_move01 P t ta0 e0 e h xs ta e' h' xs' \\ sim_moves01 P t ta0 (e0 # es2) (e # es2') h xs ta (e' # es2') h' xs'\"\n \"sim_moves01 P t ta0 es0 es h xs ta es' h' xs' \\ sim_moves01 P t ta0 (Val v # es0) (Val v # es) h xs ta (Val v # es') h' xs'\"\napply(simp_all add: sim_move01_def sim_moves01_def final_iff finals_iff Cons_eq_append_conv \\red1t_Val \\red1r_Val split: split_if_asm split del: split_if)\napply(auto simp add: Cons_eq_append_conv \\red1t_Val \\red1r_Val split: split_if_asm intro: List1Red1 List1Red2 \\red1t_inj_\\reds1t \\red1r_inj_\\reds1r \\reds1t_cons_\\reds1t \\reds1r_cons_\\reds1r)\napply(force elim!: \\red1r_inj_\\reds1r List1Red1)\napply(force elim!: \\red1r_inj_\\reds1r List1Red1)\napply(force elim!: \\red1r_inj_\\reds1r List1Red1)\napply(force elim!: \\red1r_inj_\\reds1r List1Red1)\napply(force elim!: \\reds1r_cons_\\reds1r intro!: List1Red2)\napply(force elim!: \\reds1r_cons_\\reds1r intro!: List1Red2)\ndone\n\nlemma sim_move01_CallParams:\n \"sim_moves01 P t ta0 es0 es h xs ta es' h' xs'\n \\ sim_move01 P t ta0 (Val v\\M(es0)) (Val v\\M(es)) h xs ta (Val v\\M(es')) h' xs'\"\napply(clarsimp simp add: sim_move01_def sim_moves01_def \\reds1r_map_Val \\reds1t_map_Val is_vals_conv split: split_if_asm split del: split_if)\n apply(fastforce simp add: sim_move01_def sim_moves01_def \\reds1r_map_Val \\reds1t_map_Val intro: Call_\\red1r_param Call1Params)\n apply(rule conjI, fastforce)\n apply(split split_if)\n apply(rule conjI)\n apply(clarsimp simp add: finals_iff)\n apply(clarify)\n apply(split split_if)\n apply(rule conjI)\n apply(simp del: call.simps calls.simps call1.simps calls1.simps)\n apply(fastforce simp add: sim_move01_def sim_moves01_def \\red1r_Val \\red1t_Val \\reds1r_map_Val_Throw intro: Call_\\red1r_param Call1Params split: split_if_asm)\n apply(fastforce split: split_if_asm simp add: is_vals_conv \\reds1r_map_Val \\reds1r_map_Val_Throw)\napply(rule conjI, fastforce)\napply(fastforce simp add: sim_move01_def sim_moves01_def \\red1r_Val \\red1t_Val \\reds1t_map_Val \\reds1r_map_Val is_vals_conv intro: Call_\\red1r_param Call1Params split: split_if_asm)\ndone\n\nlemma sim_move01_reds:\n \"\\ (h', a) \\ allocate h (Class_type C); ta0 = \\NewHeapElem a (Class_type C)\\; ta = \\NewHeapElem a (Class_type C)\\ \\\n \\ sim_move01 P t ta0 (new C) (new C) h xs ta (addr a) h' xs\"\n \"allocate h (Class_type C) = {} \\ sim_move01 P t \\ (new C) (new C) h xs \\ (THROW OutOfMemory) h xs\"\n \"\\ (h', a) \\ allocate h (Array_type T (nat (sint i))); 0 <=s i;\n ta0 = \\NewHeapElem a (Array_type T (nat (sint i)))\\; ta = \\NewHeapElem a (Array_type T (nat (sint i)))\\ \\\n \\ sim_move01 P t ta0 (newA T\\Val (Intg i)\\) (newA T\\Val (Intg i)\\) h xs ta (addr a) h' xs\"\n \"i sim_move01 P t \\ (newA T\\Val (Intg i)\\) (newA T\\Val (Intg i)\\) h xs \\ (THROW NegativeArraySize) h xs\"\n \"\\ allocate h (Array_type T (nat (sint i))) = {}; 0 <=s i \\\n \\ sim_move01 P t \\ (newA T\\Val (Intg i)\\) (newA T\\Val (Intg i)\\) h xs \\ (THROW OutOfMemory) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; P \\ U \\ T \\\n \\ sim_move01 P t \\ (Cast T (Val v)) (Cast T (Val v)) h xs \\ (Val v) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; \\ P \\ U \\ T \\\n \\ sim_move01 P t \\ (Cast T (Val v)) (Cast T (Val v)) h xs \\ (THROW ClassCast) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; b \\ v \\ Null \\ P \\ U \\ T \\\n \\ sim_move01 P t \\ ((Val v) instanceof T) ((Val v) instanceof T) h xs \\ (Val (Bool b)) h xs\"\n \"binop bop v1 v2 = Some (Inl v) \\ sim_move01 P t \\ ((Val v1) \\bop\\ (Val v2)) (Val v1 \\bop\\ Val v2) h xs \\ (Val v) h xs\"\n \"binop bop v1 v2 = Some (Inr a) \\ sim_move01 P t \\ ((Val v1) \\bop\\ (Val v2)) (Val v1 \\bop\\ Val v2) h xs \\ (Throw a) h xs\"\n \"\\ xs!V = v; V < size xs \\ \\ sim_move01 P t \\ (Var V') (Var V) h xs \\ (Val v) h xs\"\n \"V < length xs \\ sim_move01 P t \\ (V' := Val v) (V := Val v) h xs \\ unit h (xs[V := v])\"\n \"sim_move01 P t \\ (null\\Val v\\) (null\\Val v\\) h xs \\ (THROW NullPointer) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; i sint i \\ int n \\\n \\ sim_move01 P t \\ (addr a\\Val (Intg i)\\) ((addr a)\\Val (Intg i)\\) h xs \\ (THROW ArrayIndexOutOfBounds) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n;\n heap_read h a (ACell (nat (sint i))) v;\n ta0 = \\ReadMem a (ACell (nat (sint i))) v\\; \n ta = \\ReadMem a (ACell (nat (sint i))) v\\ \\\n \\ sim_move01 P t ta0 (addr a\\Val (Intg i)\\) ((addr a)\\Val (Intg i)\\) h xs ta (Val v) h xs\"\n \"sim_move01 P t \\ (null\\Val v\\ := Val v') (null\\Val v\\ := Val v') h xs \\ (THROW NullPointer) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; i sint i \\ int n \\\n \\ sim_move01 P t \\ (AAss (addr a) (Val (Intg i)) (Val v)) (AAss (addr a) (Val (Intg i)) (Val v)) h xs \\ (THROW ArrayIndexOutOfBounds) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n; typeof\\<^bsub>h\\<^esub> v = \\U\\; \\ (P \\ U \\ T) \\\n \\ sim_move01 P t \\ (AAss (addr a) (Val (Intg i)) (Val v)) (AAss (addr a) (Val (Intg i)) (Val v)) h xs \\ (THROW ArrayStore) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n; typeof\\<^bsub>h\\<^esub> v = Some U; P \\ U \\ T;\n heap_write h a (ACell (nat (sint i))) v h'; \n ta0 = \\WriteMem a (ACell (nat (sint i))) v\\; ta = \\WriteMem a (ACell (nat (sint i))) v \\ \\\n \\ sim_move01 P t ta0 (AAss (addr a) (Val (Intg i)) (Val v)) (AAss (addr a) (Val (Intg i)) (Val v)) h xs ta unit h' xs\"\n \"typeof_addr h a = \\Array_type T n\\ \\ sim_move01 P t \\ (addr a\\length) (addr a\\length) h xs \\ (Val (Intg (word_of_int (int n)))) h xs\"\n \"sim_move01 P t \\ (null\\length) (null\\length) h xs \\ (THROW NullPointer) h xs\"\n\n \"\\ heap_read h a (CField D F) v; ta0 = \\ReadMem a (CField D F) v\\; ta = \\ReadMem a (CField D F) v\\ \\\n \\ sim_move01 P t ta0 (addr a\\F{D}) (addr a\\F{D}) h xs ta (Val v) h xs\"\n \"sim_move01 P t \\ (null\\F{D}) (null\\F{D}) h xs \\ (THROW NullPointer) h xs\"\n \"\\ heap_write h a (CField D F) v h'; ta0 = \\WriteMem a (CField D F) v\\; ta = \\WriteMem a (CField D F) v\\ \\\n \\ sim_move01 P t ta0 (addr a\\F{D} := Val v) (addr a\\F{D} := Val v) h xs ta unit h' xs\"\n \"sim_move01 P t \\ (null\\F{D} := Val v) (null\\F{D} := Val v) h xs \\ (THROW NullPointer) h xs\"\n \"sim_move01 P t \\ ({V':T=vo; Val u}) ({V:T=None; Val u}) h xs \\ (Val u) h xs\"\n \"V < length xs \\ sim_move01 P t \\ (sync(null) e0) (sync\\<^bsub>V\\<^esub> (null) e1) h xs \\ (THROW NullPointer) h (xs[V := Null])\"\n \"sim_move01 P t \\ (Val v;;e0) (Val v;; e1) h xs \\ e1 h xs\"\n \"sim_move01 P t \\ (if (true) e0 else e0') (if (true) e1 else e1') h xs \\ e1 h xs\"\n \"sim_move01 P t \\ (if (false) e0 else e0') (if (false) e1 else e1') h xs \\ e1' h xs\"\n \"sim_move01 P t \\ (throw null) (throw null) h xs \\ (THROW NullPointer) h xs\"\n \"sim_move01 P t \\ (try (Val v) catch(C V') e0) (try (Val v) catch(C V) e1) h xs \\ (Val v) h xs\"\n \"\\ typeof_addr h a = \\Class_type D\\; P \\ D \\\\<^sup>* C; V < length xs \\\n \\ sim_move01 P t \\ (try (Throw a) catch(C V') e0) (try (Throw a) catch(C V) e1) h xs \\ ({V:Class C=None; e1}) h (xs[V := Addr a])\"\n \"sim_move01 P t \\ (newA T\\Throw a\\) (newA T\\Throw a\\) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Cast T (Throw a)) (Cast T (Throw a)) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ ((Throw a) instanceof T) ((Throw a) instanceof T) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ ((Throw a) \\bop\\ e0) ((Throw a) \\bop\\ e1) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Val v \\bop\\ (Throw a)) (Val v \\bop\\ (Throw a)) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (V' := Throw a) (V := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\e0\\) (Throw a\\e1\\) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Val v\\Throw a\\) (Val v\\Throw a\\) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\e0\\ := e0') (Throw a\\e1\\ := e1') h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Val v\\Throw a\\ := e0) (Val v\\Throw a\\ := e1) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Val v\\Val v'\\ := Throw a) (Val v\\Val v'\\ := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\length) (Throw a\\length) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\F{D}) (Throw a\\F{D}) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\F{D} := e0) (Throw a\\F{D} := e1) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Val v\\F{D} := Throw a) (Val v\\F{D} := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a\\M(es0)) (Throw a\\M(es1)) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ ({V':T=vo; Throw a}) ({V:T=None; Throw a}) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (sync(Throw a) e0) (sync\\<^bsub>V\\<^esub>(Throw a) e1) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (Throw a;;e0) (Throw a;;e1) h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (if (Throw a) e0 else e0') (if (Throw a) e1 else e1') h xs \\ (Throw a) h xs\"\n \"sim_move01 P t \\ (throw (Throw a)) (throw (Throw a)) h xs \\ (Throw a) h xs\"\napply(simp_all add: sim_move01_def ta_bisim_def split: split_if_asm split del: split_if)\napply(fastforce intro: red1_reds1.intros)+\ndone\n\nlemma sim_move01_ThrowParams:\n \"sim_move01 P t \\ (Val v\\M(map Val vs @ Throw a # es0)) (Val v\\M(map Val vs @ Throw a # es1)) h xs \\ (Throw a) h xs\"\napply(simp add: sim_move01_def split del: split_if)\napply(rule conjI, fastforce)\napply(split split_if)\napply(rule conjI)\n apply(fastforce intro: red1_reds1.intros)\napply(fastforce simp add: sim_move01_def intro: red1_reds1.intros)\ndone\n\nlemma sim_move01_CallNull:\n \"sim_move01 P t \\ (null\\M(map Val vs)) (null\\M(map Val vs)) h xs \\ (THROW NullPointer) h xs\"\nby(fastforce simp add: sim_move01_def map_eq_append_conv intro: red1_reds1.intros)\n\nlemma sim_move01_SyncLocks:\n \"\\ V < length xs; ta0 = \\Lock\\a, SyncLock a\\; ta = \\Lock\\a, SyncLock a\\ \\\n \\ sim_move01 P t ta0 (sync(addr a) e0) (sync\\<^bsub>V\\<^esub> (addr a) e1) h xs ta (insync\\<^bsub>V\\<^esub> (a) e1) h (xs[V := Addr a])\"\n \"\\ xs ! V = Addr a'; V < length xs; ta0 = \\Unlock\\a', SyncUnlock a'\\; ta = \\Unlock\\a', SyncUnlock a'\\ \\\n \\ sim_move01 P t ta0 (insync(a') (Val v)) (insync\\<^bsub>V\\<^esub> (a) (Val v)) h xs ta (Val v) h xs\"\n \"\\ xs ! V = Addr a'; V < length xs; ta0 = \\Unlock\\a', SyncUnlock a'\\; ta = \\Unlock\\a', SyncUnlock a'\\ \\\n \\ sim_move01 P t ta0 (insync(a') (Throw a'')) (insync\\<^bsub>V\\<^esub> (a) (Throw a'')) h xs ta (Throw a'') h xs\"\nby(fastforce simp add: sim_move01_def ta_bisim_def expand_finfun_eq fun_eq_iff finfun_upd_apply ta_upd_simps intro: red1_reds1.intros[simplified] split: split_if_asm)+\n\nlemma sim_move01_TryFail:\n \"\\ typeof_addr h a = \\Class_type D\\; \\ P \\ D \\\\<^sup>* C \\\n \\ sim_move01 P t \\ (try (Throw a) catch(C V') e0) (try (Throw a) catch(C V) e1) h xs \\ (Throw a) h xs\"\nby(auto simp add: sim_move01_def intro!: Red1TryFail)\n\nlemma sim_move01_BlockSome:\n \"\\ sim_move01 P t ta0 e0 e h (xs[V := v]) ta e' h' xs'; V < length xs \\\n \\ sim_move01 P t ta0 ({V':T=\\v\\; e0}) ({V:T=\\v\\; e}) h xs ta ({V:T=None; e'}) h' xs'\"\n \"V < length xs \\ sim_move01 P t \\ ({V':T=\\v\\; Val u}) ({V:T=\\v\\; Val u}) h xs \\ (Val u) h (xs[V := v])\"\n \"V < length xs \\ sim_move01 P t \\ ({V':T=\\v\\; Throw a}) ({V:T=\\v\\; Throw a}) h xs \\ (Throw a) h (xs[V := v])\"\napply(auto simp add: sim_move01_def)\napply(split split_if_asm)\n apply(fastforce intro: intro: converse_rtranclp_into_rtranclp Block1Some Block1Red Block_\\red1r_Some)\napply(fastforce intro: intro: converse_rtranclp_into_rtranclp Block1Some Block1Red Block_\\red1r_Some)\napply(fastforce simp add: sim_move01_def intro!: \\red1t_2step[OF Block1Some] \\red1r_1step[OF Block1Some] Red1Block Block1Throw)+\ndone\n\nlemmas sim_move01_intros =\n sim_move01_expr sim_move01_reds sim_move01_ThrowParams sim_move01_CallNull sim_move01_TryFail\n sim_move01_BlockSome sim_move01_CallParams\n\ndeclare sim_move01_intros[intro]\n\nlemma sim_move01_preserves_len: \"sim_move01 P t ta0 e0 e h xs ta e' h' xs' \\ length xs' = length xs\"\nby(fastforce simp add: sim_move01_def split: split_if_asm dest: \\red1r_preserves_len \\red1t_preserves_len red1_preserves_len)\n\nlemma sim_move01_preserves_unmod:\n \"\\ sim_move01 P t ta0 e0 e h xs ta e' h' xs'; unmod e i; i < length xs \\ \\ xs' ! i = xs ! i\"\napply(auto simp add: sim_move01_def split: split_if_asm dest: \\red1t_preserves_unmod)\napply(frule (2) \\red1'r_preserves_unmod)\napply(frule (1) \\red1r_unmod_preserved)\napply(frule \\red1r_preserves_len)\napply(auto dest: red1_preserves_unmod)\napply(frule (2) \\red1'r_preserves_unmod)\napply(frule (1) \\red1r_unmod_preserved)\napply(frule \\red1r_preserves_len)\napply(auto dest: red1_preserves_unmod)\ndone\n\nlemma assumes wf: \"wf_J_prog P\"\n shows red1_simulates_red_aux:\n \"\\ extTA2J0 P,P,t \\ \\e1, S\\ -TA\\ \\e1', S'\\; bisim vs e1 e2 XS; fv e1 \\ set vs;\n lcl S \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e1 \\ length XS;\n \\aMvs. call e1 = \\aMvs\\ \\ synthesized_call P (hp S) aMvs \\\n \\ \\ta e2' XS'. sim_move01 (compP1 P) t TA e1 e2 (hp S) XS ta e2' (hp S') XS' \\ bisim vs e1' e2' XS' \\ lcl S' \\\\<^sub>m [vs [\\] XS']\"\n (is \"\\ _; _; _; _; _; ?synth e1 S \\ \\ ?concl e1 e2 S XS e1' S' TA vs\")\n\n and reds1_simulates_reds_aux:\n \"\\ extTA2J0 P,P,t \\ \\es1, S\\ [-TA\\] \\es1', S'\\; bisims vs es1 es2 XS; fvs es1 \\ set vs;\n lcl S \\\\<^sub>m [vs [\\] XS]; length vs + max_varss es1 \\ length XS;\n \\aMvs. calls es1 = \\aMvs\\ \\ synthesized_call P (hp S) aMvs \\\n \\ \\ta es2' xs'. sim_moves01 (compP1 P) t TA es1 es2 (hp S) XS ta es2' (hp S') xs' \\ bisims vs es1' es2' xs' \\ lcl S' \\\\<^sub>m [vs [\\] xs']\"\n (is \"\\ _; _; _; _; _; ?synths es1 S \\ \\ ?concls es1 es2 S XS es1' S' TA vs\")\nproof(induct arbitrary: vs e2 XS and vs es2 XS rule: red_reds.inducts)\n case (BinOpRed1 e s ta e' s' bop e2 Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisim Vs (e \\bop\\ e2) E2 xs` obtain E\n where \"E2 = E \\bop\\ compE1 Vs e2\" and \"bisim Vs e E xs\" and \"\\ contains_insync e2\" by auto\n with IH[of Vs E xs] `fv (e \\bop\\ e2) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `\\ is_val e`\n `length Vs + max_vars (e \\bop\\ e2) \\ length xs` `?synth (e \\bop\\ e2) s` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n show ?case by(cases \"is_val e'\")(fastforce elim!: sim_move01_expr)+\nnext\n case (BinOpRed2 e s ta e' s' v bop Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `bisim Vs (Val v \\bop\\ e) E2 xs` obtain E\n where \"E2 = Val v \\bop\\ E\" and \"bisim Vs e E xs\" by auto\n with IH[of Vs E xs] `fv (Val v \\bop\\ e) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars (Val v \\bop\\ e) \\ length xs` `?synth (Val v \\bop\\ e) s` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n show ?case by(fastforce elim!: sim_move01_expr)\nnext\n case RedVar thus ?case\n by(fastforce simp add: index_less_aux map_le_def fun_upds_apply intro!: exI dest: bspec)\nnext\n case RedLAss thus ?case\n by(fastforce intro: index_less_aux LAss_lem intro!: exI simp del: fun_upd_apply)\nnext\n case (AAccRed1 a s ta a' s' i Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs a e2 XS; fv a \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars a \\ length XS;\n ?synth a s \\ \\ ?concl a e2 s XS a' s' ta vs`\n from `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\` have \"\\ is_val a\" by auto\n with `bisim Vs (a\\i\\) E2 xs` obtain E\n where \"E2 = E\\compE1 Vs i\\\" and \"bisim Vs a E xs\" and \"\\ contains_insync i\" by auto\n with IH[of Vs E xs] `fv (a\\i\\) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `\\ is_val a`\n `length Vs + max_vars (a\\i\\) \\ length xs` `?synth (a\\i\\) s` `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\`\n show ?case by(cases \"is_val a'\")(fastforce elim!: sim_move01_expr)+\nnext\n case (AAccRed2 i s ta i' s' a Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs i e2 XS; fv i \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars i \\ length XS;\n ?synth i s \\ \\ ?concl i e2 s XS i' s' ta vs`\n from `bisim Vs (Val a\\i\\) E2 xs` obtain E\n where \"E2 = Val a\\E\\\" and \"bisim Vs i E xs\" by auto\n with IH[of Vs E xs] `fv (Val a\\i\\) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars (Val a\\i\\) \\ length xs` `?synth (Val a\\i\\) s` `extTA2J0 P,P,t \\ \\i,s\\ -ta\\ \\i',s'\\`\n show ?case by(fastforce elim!: sim_move01_expr)\nnext\n case RedAAcc thus ?case by(auto simp del: split_paired_Ex)\nnext\n case (AAssRed1 a s ta a' s' i e Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs a e2 XS; fv a \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars a \\ length XS;\n ?synth a s \\ \\ ?concl a e2 s XS a' s' ta vs`\n from `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\` have \"\\ is_val a\" by auto\n with `bisim Vs (a\\i\\:=e) E2 xs` obtain E\n where E2: \"E2 = E\\compE1 Vs i\\:=compE1 Vs e\" and \"bisim Vs a E xs\"\n and sync: \"\\ contains_insync i\" \"\\ contains_insync e\" by auto\n with IH[of Vs E xs] `fv (a\\i\\:=e) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `\\ is_val a` `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\`\n `length Vs + max_vars (a\\i\\:=e) \\ length xs` `?synth (a\\i\\:=e) s`\n obtain ta' e2' xs'\n where IH': \"sim_move01 (compP1 P) t ta a E (hp s) xs ta' e2' (hp s') xs'\"\n \"bisim Vs a' e2' xs'\" \"lcl s' \\\\<^sub>m [Vs [\\] xs']\"\n by auto\n show ?case\n proof(cases \"is_val a'\")\n case True\n from `fv (a\\i\\:=e) \\ set Vs` sync\n have \"bisim Vs i (compE1 Vs i) xs'\" \"bisim Vs e (compE1 Vs e) xs'\" by auto\n with IH' E2 True sync `\\ is_val a` `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\` show ?thesis\n by(cases \"is_val i\")(fastforce elim!: sim_move01_expr)+\n next\n case False with IH' E2 sync `\\ is_val a` `extTA2J0 P,P,t \\ \\a,s\\ -ta\\ \\a',s'\\`\n show ?thesis by(fastforce elim!: sim_move01_expr)\n qed\nnext\n case (AAssRed2 i s ta i' s' a e Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs i e2 XS; fv i \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars i \\ length XS;\n ?synth i s \\ \\ ?concl i e2 s XS i' s' ta vs`\n from `extTA2J0 P,P,t \\ \\i,s\\ -ta\\ \\i',s'\\` have \"\\ is_val i\" by auto\n with `bisim Vs (Val a\\i\\ := e) E2 xs` obtain E\n where \"E2 = Val a\\E\\:=compE1 Vs e\" and \"bisim Vs i E xs\" and \"\\ contains_insync e\" by auto\n with IH[of Vs E xs] `fv (Val a\\i\\:=e) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `\\ is_val i` `extTA2J0 P,P,t \\ \\i,s\\ -ta\\ \\i',s'\\`\n `length Vs + max_vars (Val a\\i\\:=e) \\ length xs` `?synth (Val a\\i\\:=e) s`\n show ?case by(cases \"is_val i'\")(fastforce elim!: sim_move01_expr)+\nnext\n case (AAssRed3 e s ta e' s' a i Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `bisim Vs (Val a\\Val i\\ := e) E2 xs` obtain E\n where \"E2 = Val a\\Val i\\:=E\" and \"bisim Vs e E xs\" by auto\n with IH[of Vs E xs] `fv (Val a\\Val i\\:=e) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n `length Vs + max_vars (Val a\\Val i\\:=e) \\ length xs` `?synth (Val a\\Val i\\:=e) s`\n show ?case by(fastforce elim!: sim_move01_expr)\nnext\n case RedAAssStore thus ?case by(auto intro!: exI)\nnext\n case (FAssRed1 e s ta e' s' F D e2 Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisim Vs (e\\F{D} := e2) E2 xs` obtain E\n where \"E2 = E\\F{D} := compE1 Vs e2\" and \"bisim Vs e E xs\" and \"\\ contains_insync e2\" by auto\n with IH[of Vs E xs] `fv (e\\F{D} := e2) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `\\ is_val e` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n `length Vs + max_vars (e\\F{D} := e2) \\ length xs` `?synth (e\\F{D} := e2) s`\n show ?case by(cases \"is_val e'\")(fastforce elim!: sim_move01_expr)+\nnext\n case (FAssRed2 e s ta e' s' v F D Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `bisim Vs (Val v\\F{D} := e) E2 xs` obtain E\n where \"E2 = Val v\\F{D} := E\" and \"bisim Vs e E xs\" by auto\n with IH[of Vs E xs] `fv (Val v\\F{D} := e) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n `length Vs + max_vars (Val v\\F{D} := e) \\ length xs` `?synth (Val v\\F{D} := e) s`\n show ?case by(fastforce elim!: sim_move01_expr)\nnext\n case (CallObj e s ta e' s' M es Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisim Vs (e\\M(es)) E2 xs` obtain E\n where \"E2 = E\\M(compEs1 Vs es)\" and \"bisim Vs e E xs\" and \"\\ contains_insyncs es\"\n by(auto simp add: compEs1_conv_map)\n with IH[of Vs E xs] `fv (e\\M(es)) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars (e\\M(es)) \\ length xs` `?synth (e\\M(es)) s`\n show ?case by(cases \"is_val e'\")(fastforce elim!: sim_move01_expr split: split_if_asm)+\nnext\n case (CallParams es s ta es' s' v M Vs E2 xs)\n note IH = `\\vs es2 XS. \\bisims vs es es2 XS; fvs es \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_varss es \\ length XS;\n ?synths es s \\ \\ ?concls es es2 s XS es' s' ta vs`\n from `bisim Vs (Val v\\M(es)) E2 xs` obtain Es \n where \"E2 = Val v\\M(Es)\" and \"bisims Vs es Es xs\" by auto\n moreover from `extTA2J0 P,P,t \\ \\es,s\\ [-ta\\] \\es',s'\\` have \"\\ is_vals es\" by auto\n with `?synth (Val v\\M(es)) s` have \"?synths es s\" by(auto)\n moreover note IH[of Vs Es xs] `fv (Val v\\M(es)) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` \n `length Vs + max_vars (Val v\\M(es)) \\ length xs`\n ultimately show ?case by(fastforce elim!: sim_move01_CallParams)\nnext\n case (RedCall s a U M Ts T pns body D vs Vs E2 xs)\n from `typeof_addr (hp s) a = \\U\\`\n have \"call (addr a\\M(map Val vs)) = \\(a, M, vs)\\\" by auto\n with `?synth (addr a\\M(map Val vs)) s` have \"synthesized_call P (hp s) (a, M, vs)\" by auto\n with `typeof_addr (hp s) a = \\U\\` `P \\ class_type_of U sees M: Ts\\T = \\(pns, body)\\ in D`\n have False by(auto simp add: synthesized_call_conv dest: sees_method_fun)\n thus ?case ..\nnext\n case (RedCallExternal s a T M Ts Tr D vs ta va h' ta' e' s' Vs E2 xs)\n from `bisim Vs (addr a\\M(map Val vs)) E2 xs` have \"E2 = addr a\\M(map Val vs)\" by auto\n moreover note `P \\ class_type_of T sees M: Ts\\Tr = Native in D` `typeof_addr (hp s) a = \\T\\` `ta' = extTA2J0 P ta`\n `e' = extRet2J (addr a\\M(map Val vs)) va` `s' = (h', lcl s)` `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\`\n `lcl s \\\\<^sub>m [Vs [\\] xs]`\n moreover from wf `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\`\n have \"ta_bisim01 (extTA2J0 P ta) (extTA2J1 (compP1 P) ta)\" by(rule red_external_ta_bisim01)\n moreover from `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\` `typeof_addr (hp s) a = \\T\\`\n `P \\ class_type_of T sees M: Ts\\Tr = Native in D`\n have \"\\external_defs D M \\ h' = hp s \\ ta = \\\"\n by(fastforce dest: \\external'_red_external_heap_unchanged \\external'_red_external_TA_empty simp add: \\external'_def \\external_def)\n ultimately show ?case \n by(cases va)(fastforce intro!: exI[where x=ta] intro: Red1CallExternal simp add: map_eq_append_conv sim_move01_def dest: sees_method_fun simp del: split_paired_Ex)+\nnext\n case (BlockRed e h x V vo ta e' h' x' T Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl (h, x(V := vo)) \\\\<^sub>m [vs [\\] XS];\n length vs + max_vars e \\ length XS; ?synth e (h, (x(V := vo)))\\\n \\ ?concl e e2 (h, x(V := vo)) XS e' (h', x') ta vs`\n note red = `extTA2J0 P,P,t \\ \\e,(h, x(V := vo))\\ -ta\\ \\e',(h', x')\\`\n note len = `length Vs + max_vars {V:T=vo; e} \\ length xs`\n from `fv {V:T=vo; e} \\ set Vs` have fv: \"fv e \\ set (Vs@[V])\" by auto\n from `bisim Vs {V:T=vo; e} E2 xs` show ?case\n proof(cases rule: bisim_cases(6)[consumes 1, case_names BlockNone BlockSome BlockSomeNone])\n case (BlockNone E')\n with red IH[of \"Vs@[V]\" E' xs] fv `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars {V:T=vo; e} \\ length xs` `?synth {V:T=vo; e} (h, x)`\n obtain TA' e2' xs' where red': \"sim_move01 (compP1 P) t ta e E' h xs TA' e2' h' xs'\"\n and bisim': \"bisim (Vs @ [V]) e' e2' xs'\" \"x' \\\\<^sub>m [Vs @ [V] [\\] xs']\" by auto \n from red' `length Vs + max_vars {V:T=vo; e} \\ length xs`\n have \"length (Vs@[V]) + max_vars e \\ length xs'\"\n by(fastforce simp add: sim_move01_def dest: red1_preserves_len \\red1t_preserves_len \\red1r_preserves_len split: split_if_asm)\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"x' \\\\<^sub>m [Vs [\\] xs', V \\ xs' ! length Vs]\" by(simp)\n moreover \n { assume \"V \\ set Vs\"\n hence \"hidden (Vs @ [V]) (index Vs V)\" by(rule hidden_index)\n with `bisim (Vs @ [V]) e E' xs` have \"unmod E' (index Vs V)\"\n by -(rule hidden_bisim_unmod)\n moreover from `length Vs + max_vars {V:T=vo; e} \\ length xs` `V \\ set Vs`\n have \"index Vs V < length xs\" by(auto intro: index_less_aux)\n ultimately have \"xs ! index Vs V = xs' ! index Vs V\"\n using sim_move01_preserves_unmod[OF red'] by(simp) }\n moreover from red' have \"length xs = length xs'\" by(rule sim_move01_preserves_len[symmetric])\n ultimately have rel: \"x'(V := x V) \\\\<^sub>m [Vs [\\] xs']\"\n using `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]` `length Vs + max_vars {V:T=vo; e} \\ length xs`\n by(auto intro: Block_lem)\n show ?thesis\n proof(cases \"x' V\")\n case None\n with red' bisim' BlockNone len\n show ?thesis by(fastforce simp del: split_paired_Ex fun_upd_apply intro: rel)\n next\n case (Some v)\n moreover\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"[Vs @ [V] [\\] xs'] V = \\v\\\"\n by(auto simp add: map_le_def dest: bspec)\n moreover\n from `length Vs + max_vars {V:T=vo; e} \\ length xs` have \"length Vs < length xs\" by auto\n ultimately have \"xs' ! length Vs = v\" using `length xs = length xs'` by(simp)\n with red' bisim' BlockNone Some len\n show ?thesis by(fastforce simp del: fun_upd_apply intro: rel)\n qed\n next\n case (BlockSome E' v)\n with red IH[of \"Vs@[V]\" E' \"xs[length Vs := v]\"] fv `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars {V:T=vo; e} \\ length xs` `?synth {V:T=vo; e} (h, x)`\n obtain TA' e2' xs' where red': \"sim_move01 (compP1 P) t ta e E' h (xs[length Vs := v]) TA' e2' h' xs'\"\n and bisim': \"bisim (Vs @ [V]) e' e2' xs'\" \"x' \\\\<^sub>m [Vs @ [V] [\\] xs']\" by auto\n from red' `length Vs + max_vars {V:T=vo; e} \\ length xs`\n have \"length (Vs@[V]) + max_vars e \\ length xs'\" by(auto dest: sim_move01_preserves_len)\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"x' \\\\<^sub>m [Vs [\\] xs', V \\ xs' ! length Vs]\" by(simp)\n moreover \n { assume \"V \\ set Vs\"\n hence \"hidden (Vs @ [V]) (index Vs V)\" by(rule hidden_index)\n with `bisim (Vs @ [V]) e E' (xs[length Vs := v])` have \"unmod E' (index Vs V)\"\n by -(rule hidden_bisim_unmod)\n moreover from `length Vs + max_vars {V:T=vo; e} \\ length xs` `V \\ set Vs`\n have \"index Vs V < length xs\" by(auto intro: index_less_aux)\n moreover from `length Vs + max_vars {V:T=vo; e} \\ length xs` `V \\ set Vs`\n have \"(xs[length Vs := v]) ! index Vs V = xs ! index Vs V\" by(simp)\n ultimately have \"xs ! index Vs V = xs' ! index Vs V\"\n using sim_move01_preserves_unmod[OF red', of \"index Vs V\"] by(simp) }\n moreover from red' have \"length xs = length xs'\" by(auto dest: sim_move01_preserves_len)\n ultimately have rel: \"x'(V := x V) \\\\<^sub>m [Vs [\\] xs']\"\n using `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]` `length Vs + max_vars {V:T=vo; e} \\ length xs`\n by(auto intro: Block_lem)\n from BlockSome red obtain v' where Some: \"x' V = \\v'\\\" by(auto dest!: red_lcl_incr)\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"[Vs @ [V] [\\] xs'] V = \\v'\\\"\n by(auto simp add: map_le_def dest: bspec)\n moreover\n from `length Vs + max_vars {V:T=vo; e} \\ length xs` have \"length Vs < length xs\" by auto\n ultimately have \"xs' ! length Vs = v'\" using `length xs = length xs'` by(simp)\n with red' bisim' BlockSome Some `length Vs < length xs`\n show ?thesis by(fastforce simp del: fun_upd_apply intro: rel)\n next \n case (BlockSomeNone E')\n with red IH[of \"Vs@[V]\" E' xs] fv `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]`\n `length Vs + max_vars {V:T=vo; e} \\ length xs` `?synth {V:T=vo; e} (h, x)`\n obtain TA' e2' xs' where red': \"sim_move01 (compP1 P) t ta e E' h xs TA' e2' h' xs'\"\n and IH': \"bisim (Vs @ [V]) e' e2' xs'\" \"x' \\\\<^sub>m [Vs @ [V] [\\] xs']\" by auto\n from red' `length Vs + max_vars {V:T=vo; e} \\ length xs`\n have \"length (Vs@[V]) + max_vars e \\ length xs'\" by(auto dest: sim_move01_preserves_len)\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"x' \\\\<^sub>m [Vs [\\] xs', V \\ xs' ! length Vs]\" by(simp)\n moreover \n { assume \"V \\ set Vs\"\n hence \"hidden (Vs @ [V]) (index Vs V)\" by(rule hidden_index)\n with `bisim (Vs @ [V]) e E' xs` have \"unmod E' (index Vs V)\"\n by -(rule hidden_bisim_unmod)\n moreover from `length Vs + max_vars {V:T=vo; e} \\ length xs` `V \\ set Vs`\n have \"index Vs V < length xs\" by(auto intro: index_less_aux)\n moreover from `length Vs + max_vars {V:T=vo; e} \\ length xs` `V \\ set Vs`\n have \"(xs[length Vs := v]) ! index Vs V = xs ! index Vs V\" by(simp)\n ultimately have \"xs ! index Vs V = xs' ! index Vs V\"\n using sim_move01_preserves_unmod[OF red', of \"index Vs V\"] by(simp) }\n moreover from red' have \"length xs = length xs'\" by(auto dest: sim_move01_preserves_len)\n ultimately have rel: \"x'(V := x V) \\\\<^sub>m [Vs [\\] xs']\"\n using `lcl (h, x) \\\\<^sub>m [Vs [\\] xs]` `length Vs + max_vars {V:T=vo; e} \\ length xs`\n by(auto intro: Block_lem)\n from BlockSomeNone red obtain v' where Some: \"x' V = \\v'\\\" by(auto dest!: red_lcl_incr)\n with `x' \\\\<^sub>m [Vs @ [V] [\\] xs']` have \"[Vs @ [V] [\\] xs'] V = \\v'\\\"\n by(auto simp add: map_le_def dest: bspec)\n moreover\n from `length Vs + max_vars {V:T=vo; e} \\ length xs` have \"length Vs < length xs\" by auto\n ultimately have \"xs' ! length Vs = v'\" using `length xs = length xs'` by(simp)\n with red' IH' BlockSomeNone Some `length Vs < length xs`\n show ?thesis by(fastforce simp del: fun_upd_apply intro: rel)\n qed\nnext\n case (RedBlock V T vo u s Vs E2 xs)\n from `bisim Vs {V:T=vo; Val u} E2 xs` obtain vo'\n where [simp]: \"E2 = {length Vs:T=vo'; Val u}\" by auto\n from RedBlock show ?case\n proof(cases vo)\n case (Some v)\n with `bisim Vs {V:T=vo; Val u} E2 xs`\n have vo': \"case vo' of None \\ xs ! length Vs = v | Some v' \\ v = v'\" by auto\n have \"sim_move01 (compP1 P) t \\ {V:T=vo; Val u} E2 (hp s) xs \\ (Val u) (hp s) (xs[length Vs := v])\"\n proof(cases vo')\n case None with vo'\n have \"xs[length Vs := v] = xs\" by auto\n thus ?thesis using Some None by auto\n next\n case Some\n from `length Vs + max_vars {V:T=vo; Val u} \\ length xs` have \"length Vs < length xs\" by simp\n with vo' Some show ?thesis using `vo = Some v` by auto\n qed\n thus ?thesis using RedBlock by fastforce\n qed fastforce\nnext\n case SynchronizedNull thus ?case by fastforce\nnext\n case (LockSynchronized a e s Vs E2 xs)\n from `bisim Vs (sync(addr a) e) E2 xs`\n have E2: \"E2 = sync\\<^bsub>length Vs\\<^esub> (addr a) (compE1 (Vs@[fresh_var Vs]) e)\" \n and sync: \"\\ contains_insync e\" by auto\n moreover have \"fresh_var Vs \\ set Vs\" by(rule fresh_var_fresh)\n with `fv (sync(addr a) e) \\ set Vs` have \"fresh_var Vs \\ fv e\" by auto\n from E2 `fv (sync(addr a) e) \\ set Vs` sync\n have \"bisim (Vs@[fresh_var Vs]) e (compE1 (Vs@[fresh_var Vs]) e) (xs[length Vs := Addr a])\"\n by(auto intro!: compE1_bisim)\n hence \"bisim Vs (insync(a) e) (insync\\<^bsub>length Vs\\<^esub> (a) (compE1 (Vs@[fresh_var Vs]) e)) (xs[length Vs := Addr a])\"\n using `fresh_var Vs \\ fv e` `length Vs + max_vars (sync(addr a) e) \\ length xs` by auto\n moreover from `length Vs + max_vars (sync(addr a) e) \\ length xs`\n have \"False,compP1 P,t \\1 \\sync\\<^bsub>length Vs\\<^esub> (addr a) (compE1 (Vs@[fresh_var Vs]) e), (hp s, xs)\\\n -\\Lock\\a, SyncLock a\\\\\n \\insync\\<^bsub>length Vs\\<^esub> (a) (compE1 (Vs@[fresh_var Vs]) e), (hp s, xs[length Vs := Addr a])\\\"\n by -(rule Lock1Synchronized, auto)\n hence \"sim_move01 (compP1 P) t \\Lock\\a, SyncLock a\\ (sync(addr a) e) E2 (hp s) xs \\Lock\\a, SyncLock a\\ (insync\\<^bsub>length Vs\\<^esub> (a) (compE1 (Vs@[fresh_var Vs]) e)) (hp s) (xs[length Vs := Addr a])\"\n using E2 by(fastforce simp add: sim_move01_def ta_bisim_def)\n moreover have \"zip Vs (xs[length Vs := Addr a]) = (zip Vs xs)[length Vs := (arbitrary, Addr a)]\"\n by(rule sym)(simp add: update_zip)\n hence \"zip Vs (xs[length Vs := Addr a]) = zip Vs xs\" by simp\n with `lcl s \\\\<^sub>m [Vs [\\] xs]` have \"lcl s \\\\<^sub>m [Vs [\\] xs[length Vs := Addr a]]\"\n by(auto simp add: map_le_def map_upds_def)\n ultimately show ?case using `lcl s \\\\<^sub>m [Vs [\\] xs]` by fastforce\nnext\n case (SynchronizedRed2 e s ta e' s' a Vs E2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s \\ \\ ?concl e e2 s XS e' s' ta vs`\n from `bisim Vs (insync(a) e) E2 xs` obtain E\n where E2: \"E2 = insync\\<^bsub>length Vs\\<^esub> (a) E\" and bisim: \"bisim (Vs@[fresh_var Vs]) e E xs\"\n and xsa: \"xs ! length Vs = Addr a\" by auto\n from `fv (insync(a) e) \\ set Vs` fresh_var_fresh[of Vs] have fv: \"fresh_var Vs \\ fv e\" by auto\n from `length Vs + max_vars (insync(a) e) \\ length xs` have \"length Vs < length xs\" by simp\n { assume \"lcl s (fresh_var Vs) \\ None\"\n then obtain v where \"lcl s (fresh_var Vs) = \\v\\\" by auto\n with `lcl s \\\\<^sub>m [Vs [\\] xs]` have \"[Vs [\\] xs] (fresh_var Vs) = \\v\\\" \n by(auto simp add: map_le_def dest: bspec)\n hence \"fresh_var Vs \\ set Vs\" \n by(auto simp add: map_upds_def set_zip dest!: map_of_SomeD )\n moreover have \"fresh_var Vs \\ set Vs\" by(rule fresh_var_fresh)\n ultimately have False by contradiction }\n hence \"lcl s (fresh_var Vs) = None\" by(cases \"lcl s (fresh_var Vs)\", auto)\n hence \"(lcl s)(fresh_var Vs := None) = lcl s\" by(auto intro: ext)\n moreover from `lcl s \\\\<^sub>m [Vs [\\] xs]`\n have \"(lcl s)(fresh_var Vs := None) \\\\<^sub>m [Vs [\\] xs, fresh_var Vs \\ xs ! length Vs]\" by(simp)\n ultimately have \"lcl s \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] xs]\"\n using `length Vs < length xs` by(auto)\n with IH[of \"Vs@[fresh_var Vs]\" E xs] `fv (insync(a) e) \\ set Vs` bisim\n `length Vs + max_vars (insync(a) e) \\ length xs` `?synth (insync(a) e) s` \n obtain TA' e2' xs' where IH': \"sim_move01 (compP1 P) t ta e E (hp s) xs TA' e2' (hp s') xs'\"\n \"bisim (Vs @ [fresh_var Vs]) e' e2' xs'\" \"lcl s' \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] xs']\" by auto\n from `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\` have \"dom (lcl s') \\ dom (lcl s) \\ fv e\" by(auto dest: red_dom_lcl)\n with fv `lcl s (fresh_var Vs) = None` have \"(fresh_var Vs) \\ dom (lcl s')\" by auto\n hence \"lcl s' (fresh_var Vs) = None\" by auto\n moreover from IH' have \"length xs = length xs'\" by(auto dest: sim_move01_preserves_len)\n moreover note `lcl s' \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] xs']` `length Vs < length xs`\n ultimately have \"lcl s' \\\\<^sub>m [Vs [\\] xs']\" by(auto simp add: map_le_def dest: bspec)\n moreover from bisim fv have \"unmod E (length Vs)\" by(auto intro: bisim_fv_unmod)\n with IH' `length Vs < length xs` have \"xs ! length Vs = xs' ! length Vs\"\n by(auto dest!: sim_move01_preserves_unmod)\n with xsa have \"xs' ! length Vs = Addr a\" by simp\n ultimately show ?case using IH' E2 by(fastforce)\nnext\n case (UnlockSynchronized a v s Vs E2 xs)\n from `bisim Vs (insync(a) Val v) E2 xs` have E2: \"E2 = insync\\<^bsub>length Vs\\<^esub> (a) Val v\" \n and xsa: \"xs ! length Vs = Addr a\" by auto\n moreover from `length Vs + max_vars (insync(a) Val v) \\ length xs` xsa\n have \"False,compP1 P,t \\1 \\insync\\<^bsub>length Vs\\<^esub> (a) (Val v), (hp s, xs)\\ -\\Unlock\\a, SyncUnlock a\\\\ \\Val v, (hp s, xs)\\\"\n by-(rule Unlock1Synchronized, auto)\n hence \"sim_move01 (compP1 P) t \\Unlock\\a, SyncUnlock a\\ (insync(a) Val v) (insync\\<^bsub>length Vs\\<^esub> (a) Val v) (hp s) xs \\Unlock\\a, SyncUnlock a\\ (Val v) (hp s) xs\"\n by(fastforce simp add: sim_move01_def ta_bisim_def)\n ultimately show ?case using `lcl s \\\\<^sub>m [Vs [\\] xs]` by fastforce\nnext\n case (RedWhile b c s Vs E2 xs)\n from `bisim Vs (while (b) c) E2 xs` have \"E2 = while (compE1 Vs b) (compE1 Vs c)\"\n and sync: \"\\ contains_insync b\" \"\\ contains_insync c\" by auto\n moreover have \"False,compP1 P,t \\1 \\while(compE1 Vs b) (compE1 Vs c), (hp s, xs)\\ \n -\\\\ \\if (compE1 Vs b) (compE1 Vs c;;while(compE1 Vs b) (compE1 Vs c)) else unit, (hp s, xs)\\\"\n by(rule Red1While)\n hence \"sim_move01 (compP1 P) t \\ (while (b) c) (while (compE1 Vs b) (compE1 Vs c)) (hp s) xs \\ (if (compE1 Vs b) (compE1 Vs c;;while(compE1 Vs b) (compE1 Vs c)) else unit) (hp s) xs\"\n by(auto simp add: sim_move01_def)\n moreover from `fv (while (b) c) \\ set Vs` sync\n have \"bisim Vs (if (b) (c;; while (b) c) else unit)\n (if (compE1 Vs b) (compE1 Vs (c;; while(b) c)) else (compE1 Vs unit)) xs\"\n by -(rule bisimCond, auto)\n ultimately show ?case using `lcl s \\\\<^sub>m [Vs [\\] xs]`\n by(simp)((rule exI)+, erule conjI, auto)\nnext\n case (RedTryCatch s a D C V e2 Vs E2 xs)\n thus ?case by(auto intro!: exI)(auto intro!: compE1_bisim)\nnext\n case RedTryFail thus ?case by(auto intro!: exI)\nnext\n case (ListRed1 e s ta e' s' es Vs ES2 xs)\n note IH = `\\vs e2 XS. \\bisim vs e e2 XS; fv e \\ set vs; lcl s \\\\<^sub>m [vs [\\] XS]; length vs + max_vars e \\ length XS;\n ?synth e s\\ \\ ?concl e e2 s XS e' s' ta vs`\n from `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisims Vs (e # es) ES2 xs` obtain E' \n where \"bisim Vs e E' xs\" and ES2: \"ES2 = E' # compEs1 Vs es\" \n and sync: \"\\ contains_insyncs es\" by(auto simp add: compEs1_conv_map)\n with IH[of Vs E' xs] `fvs (e # es) \\ set Vs` `lcl s \\\\<^sub>m [Vs [\\] xs]` `extTA2J0 P,P,t \\ \\e,s\\ -ta\\ \\e',s'\\`\n `length Vs + max_varss (e # es) \\ length xs` `?synths (e # es) s` `\\ is_val e`\n show ?case by(cases \"is_val e'\")(fastforce elim!: sim_moves01_expr split: split_if_asm)+\nnext\n case (ListRed2 es s ta es' s' v Vs ES2 xs)\n thus ?case by(fastforce elim!: bisims_cases elim!: sim_moves01_expr)\nnext\n case CallThrowParams thus ?case\n by(fastforce elim!:bisim_cases simp add: bisims_map_Val_Throw)\nnext\n case (BlockThrow V T vo a s Vs e2 xs) thus ?case\n by(cases vo)(fastforce elim!: bisim_cases)+\nnext \n case (SynchronizedThrow2 a ad s Vs E2 xs)\n from `bisim Vs (insync(a) Throw ad) E2 xs` have \"xs ! length Vs = Addr a\" by auto\n with `length Vs + max_vars (insync(a) Throw ad) \\ length xs`\n have \"False,compP1 P,t \\1 \\insync\\<^bsub>length Vs\\<^esub> (a) Throw ad, (hp s, xs)\\ -\\Unlock\\a, SyncUnlock a\\\\ \\Throw ad, (hp s, xs)\\\"\n by-(rule Synchronized1Throw2, auto)\n hence \"sim_move01 (compP1 P) t \\Unlock\\a, SyncUnlock a\\ (insync(a) Throw ad) (insync\\<^bsub>length Vs\\<^esub> (a) Throw ad) (hp s) xs \\Unlock\\a, SyncUnlock a\\ (Throw ad) (hp s) xs\"\n by(fastforce simp add: sim_move01_def ta_bisim_def fun_eq_iff expand_finfun_eq finfun_upd_apply ta_upd_simps split: split_if_asm)\n moreover note `lcl s \\\\<^sub>m [Vs [\\] xs]` `bisim Vs (insync(a) Throw ad) E2 xs`\n ultimately show ?case by(fastforce)\nnext\n case InstanceOfRed thus ?case by(fastforce)\nnext\n case RedInstanceOf thus ?case by(auto intro!: exI)\nnext\n case InstanceOfThrow thus ?case by fastforce\nqed(fastforce simp del: fun_upd_apply split: split_if_asm)+\n\nend\n\ndeclare max_dest [iff del]\n\ndeclare split_paired_Ex [simp del]\n\nprimrec countInitBlock :: \"('a, 'b, 'addr) exp \\ nat\"\n and countInitBlocks :: \"('a, 'b, 'addr) exp list \\ nat\"\nwhere \n \"countInitBlock (new C) = 0\"\n| \"countInitBlock (newA T\\e\\) = countInitBlock e\"\n| \"countInitBlock (Cast T e) = countInitBlock e\"\n| \"countInitBlock (e instanceof T) = countInitBlock e\"\n| \"countInitBlock (Val v) = 0\"\n| \"countInitBlock (Var V) = 0\"\n| \"countInitBlock (V := e) = countInitBlock e\"\n| \"countInitBlock (e \\bop\\ e') = countInitBlock e + countInitBlock e'\"\n| \"countInitBlock (a\\i\\) = countInitBlock a + countInitBlock i\"\n| \"countInitBlock (AAss a i e) = countInitBlock a + countInitBlock i + countInitBlock e\"\n| \"countInitBlock (a\\length) = countInitBlock a\"\n| \"countInitBlock (e\\F{D}) = countInitBlock e\"\n| \"countInitBlock (FAss e F D e') = countInitBlock e + countInitBlock e'\"\n| \"countInitBlock (e\\M(es)) = countInitBlock e + countInitBlocks es\"\n| \"countInitBlock ({V:T=vo; e}) = (case vo of None \\ 0 | Some v \\ 1) + countInitBlock e\"\n| \"countInitBlock (sync\\<^bsub>V'\\<^esub> (e) e') = countInitBlock e + countInitBlock e'\"\n| \"countInitBlock (insync\\<^bsub>V'\\<^esub> (ad) e) = countInitBlock e\"\n| \"countInitBlock (e;;e') = countInitBlock e + countInitBlock e'\"\n| \"countInitBlock (if (e) e1 else e2) = countInitBlock e + countInitBlock e1 + countInitBlock e2\"\n| \"countInitBlock (while(b) e) = countInitBlock b + countInitBlock e\"\n| \"countInitBlock (throw e) = countInitBlock e\"\n| \"countInitBlock (try e catch(C V) e') = countInitBlock e + countInitBlock e'\"\n\n| \"countInitBlocks [] = 0\"\n| \"countInitBlocks (e # es) = countInitBlock e + countInitBlocks es\"\n\ncontext J0_J1_heap_base begin\n\nlemmas \\red0r_expr =\n NewArray_\\red0r_xt Cast_\\red0r_xt InstanceOf_\\red0r_xt BinOp_\\red0r_xt1 BinOp_\\red0r_xt2 LAss_\\red0r\n AAcc_\\red0r_xt1 AAcc_\\red0r_xt2 AAss_\\red0r_xt1 AAss_\\red0r_xt2 AAss_\\red0r_xt3\n ALength_\\red0r_xt FAcc_\\red0r_xt FAss_\\red0r_xt1 FAss_\\red0r_xt2 Call_\\red0r_obj\n Call_\\red0r_param Block_\\red0r_xt Sync_\\red0r_xt InSync_\\red0r_xt\n Seq_\\red0r_xt Cond_\\red0r_xt Throw_\\red0r_xt Try_\\red0r_xt\n\nlemmas \\red0t_expr =\n NewArray_\\red0t_xt Cast_\\red0t_xt InstanceOf_\\red0t_xt BinOp_\\red0t_xt1 BinOp_\\red0t_xt2 LAss_\\red0t\n AAcc_\\red0t_xt1 AAcc_\\red0t_xt2 AAss_\\red0t_xt1 AAss_\\red0t_xt2 AAss_\\red0t_xt3\n ALength_\\red0t_xt FAcc_\\red0t_xt FAss_\\red0t_xt1 FAss_\\red0t_xt2 Call_\\red0t_obj\n Call_\\red0t_param Block_\\red0t_xt Sync_\\red0t_xt InSync_\\red0t_xt\n Seq_\\red0t_xt Cond_\\red0t_xt Throw_\\red0t_xt Try_\\red0t_xt\n\ndeclare \\red0r_expr [elim!]\ndeclare \\red0t_expr [elim!]\n\ndefinition sim_move10 :: \n \"'addr J_prog \\ 'thread_id \\ ('addr, 'thread_id, 'heap) external_thread_action \\ 'addr expr1 \\ 'addr expr1 \\ 'addr expr\n \\ 'heap \\ 'addr locals \\ ('addr, 'thread_id, 'heap) J0_thread_action \\ 'addr expr \\ 'heap \\ 'addr locals \\ bool\"\nwhere\n \"sim_move10 P t ta1 e1 e1' e h xs ta e' h' xs' \\ \\ final e1 \\\n (if \\move1 P h e1 then (\\red0t (extTA2J0 P) P t h (e, xs) (e', xs') \\ countInitBlock e1' < countInitBlock e1 \\ e' = e \\ xs' = xs) \\ h' = h \\ ta1 = \\ \\ ta = \\\n else ta_bisim01 ta (extTA2J1 (compP1 P) ta1) \\\n (if call e = None \\ call1 e1 = None \n then (\\e'' xs''. \\red0r (extTA2J0 P) P t h (e, xs) (e'', xs'') \\ extTA2J0 P,P,t \\ \\e'', (h, xs'')\\ -ta\\ \\e', (h', xs')\\ \\ no_call P h e'' \\ \\ \\move0 P h e'')\n else extTA2J0 P,P,t \\ \\e, (h, xs)\\ -ta\\ \\e', (h', xs')\\ \\ no_call P h e \\ \\ \\move0 P h e))\"\n\ndefinition sim_moves10 :: \n \"'addr J_prog \\ 'thread_id \\ ('addr, 'thread_id, 'heap) external_thread_action \\ 'addr expr1 list \\ 'addr expr1 list\n \\ 'addr expr list \\ 'heap \\ 'addr locals \\ ('addr, 'thread_id, 'heap) J0_thread_action \\ 'addr expr list \\ 'heap \n \\ 'addr locals \\ bool\"\nwhere\n \"sim_moves10 P t ta1 es1 es1' es h xs ta es' h' xs' \\ \\ finals es1 \\\n (if \\moves1 P h es1 then (\\reds0t (extTA2J0 P) P t h (es, xs) (es', xs') \\ countInitBlocks es1' < countInitBlocks es1 \\ es' = es \\ xs' = xs) \\ h' = h \\ ta1 = \\ \\ ta = \\\n else ta_bisim01 ta (extTA2J1 (compP1 P) ta1) \\\n (if calls es = None \\ calls1 es1 = None\n then (\\es'' xs''. \\reds0r (extTA2J0 P) P t h (es, xs) (es'', xs'') \\ extTA2J0 P,P,t \\ \\es'', (h, xs'')\\ [-ta\\] \\es', (h', xs')\\ \\ no_calls P h es'' \\ \\ \\moves0 P h es'')\n else extTA2J0 P,P,t \\ \\es, (h, xs)\\ [-ta\\] \\es', (h', xs')\\ \\ no_calls P h es \\ \\ \\moves0 P h es))\"\n\nlemma sim_move10_expr:\n assumes \"sim_move10 P t ta1 e1 e1' e h xs ta e' h' xs'\"\n shows\n \"sim_move10 P t ta1 (newA T\\e1\\) (newA T\\e1'\\) (newA T\\e\\) h xs ta (newA T\\e'\\) h' xs'\"\n \"sim_move10 P t ta1 (Cast T e1) (Cast T e1') (Cast T e) h xs ta (Cast T e') h' xs'\"\n \"sim_move10 P t ta1 (e1 instanceof T) (e1' instanceof T) (e instanceof T) h xs ta (e' instanceof T) h' xs'\"\n \"sim_move10 P t ta1 (e1 \\bop\\ e2) (e1' \\bop\\ e2) (e \\bop\\ e2') h xs ta (e' \\bop\\ e2') h' xs'\"\n \"sim_move10 P t ta1 (Val v \\bop\\ e1) (Val v \\bop\\ e1') (Val v \\bop\\ e) h xs ta (Val v \\bop\\ e') h' xs'\"\n \"sim_move10 P t ta1 (V := e1) (V := e1') (V' := e) h xs ta (V' := e') h' xs'\"\n \"sim_move10 P t ta1 (e1\\e2\\) (e1'\\e2\\) (e\\e2'\\) h xs ta (e'\\e2'\\) h' xs'\"\n \"sim_move10 P t ta1 (Val v\\e1\\) (Val v\\e1'\\) (Val v\\e\\) h xs ta (Val v\\e'\\) h' xs'\"\n \"sim_move10 P t ta1 (e1\\e2\\ := e3) (e1'\\e2\\ := e3) (e\\e2'\\ := e3') h xs ta (e'\\e2'\\ := e3') h' xs'\"\n \"sim_move10 P t ta1 (Val v\\e1\\ := e3) (Val v\\e1'\\ := e3) (Val v\\e\\ := e3') h xs ta (Val v\\e'\\ := e3') h' xs'\"\n \"sim_move10 P t ta1 (AAss (Val v) (Val v') e1) (AAss (Val v) (Val v') e1') (AAss (Val v) (Val v') e) h xs ta (AAss (Val v) (Val v') e') h' xs'\"\n \"sim_move10 P t ta1 (e1\\length) (e1'\\length) (e\\length) h xs ta (e'\\length) h' xs'\"\n \"sim_move10 P t ta1 (e1\\F{D}) (e1'\\F{D}) (e\\F'{D'}) h xs ta (e'\\F'{D'}) h' xs'\"\n \"sim_move10 P t ta1 (FAss e1 F D e2) (FAss e1' F D e2) (FAss e F' D' e2') h xs ta (FAss e' F' D' e2') h' xs'\"\n \"sim_move10 P t ta1 (FAss (Val v) F D e1) (FAss (Val v) F D e1') (FAss (Val v) F' D' e) h xs ta (FAss (Val v) F' D' e') h' xs'\"\n \"sim_move10 P t ta1 (e1\\M(es)) (e1'\\M(es)) (e\\M(es')) h xs ta (e'\\M(es')) h' xs'\"\n \"sim_move10 P t ta1 (sync\\<^bsub>V\\<^esub>(e1) e2) (sync\\<^bsub>V\\<^esub>(e1') e2) (sync(e) e2') h xs ta (sync(e') e2') h' xs'\"\n \"sim_move10 P t ta1 (insync\\<^bsub>V\\<^esub>(a) e1) (insync\\<^bsub>V\\<^esub>(a) e1') (insync(a') e) h xs ta (insync(a') e') h' xs'\"\n \"sim_move10 P t ta1 (e1;;e2) (e1';;e2) (e;;e2') h xs ta (e';;e2') h' xs'\"\n \"sim_move10 P t ta1 (if (e1) e2 else e3) (if (e1') e2 else e3) (if (e) e2' else e3') h xs ta (if (e') e2' else e3') h' xs'\"\n \"sim_move10 P t ta1 (throw e1) (throw e1') (throw e) h xs ta (throw e') h' xs'\"\n \"sim_move10 P t ta1 (try e1 catch(C V) e2) (try e1' catch(C V) e2) (try e catch(C' V') e2') h xs ta (try e' catch(C' V') e2') h' xs'\"\nusing assms\napply(simp_all add: sim_move10_def final_iff split del: split_if split add: split_if_asm)\napply(fastforce simp add: \\red0t_Val \\red0r_Val intro: red_reds.intros)+\ndone\n\nlemma sim_moves10_expr:\n \"sim_move10 P t ta1 e1 e1' e h xs ta e' h' xs' \\ sim_moves10 P t ta1 (e1 # es2) (e1' # es2) (e # es2') h xs ta (e' # es2') h' xs'\"\n \"sim_moves10 P t ta1 es1 es1' es h xs ta es' h' xs' \\ sim_moves10 P t ta1 (Val v # es1) (Val v # es1') (Val v # es) h xs ta (Val v # es') h' xs'\"\nunfolding sim_moves10_def sim_move10_def final_iff finals_iff\napply(simp_all add: Cons_eq_append_conv split del: split_if split: split_if_asm)\napply(safe intro!: if_split)\napply(fastforce simp add: is_vals_conv \\reds0t_map_Val \\reds0r_map_Val \\red0t_Val \\red0r_Val intro!: \\red0r_inj_\\reds0r \\reds0r_cons_\\reds0r \\red0t_inj_\\reds0t \\reds0t_cons_\\reds0t ListRed1 ListRed2 split: split_if_asm)+\ndone\n\nlemma sim_move10_CallParams:\n \"sim_moves10 P t ta1 es1 es1' es h xs ta es' h' xs'\n \\ sim_move10 P t ta1 (Val v\\M(es1)) (Val v\\M(es1')) (Val v\\M(es)) h xs ta (Val v\\M(es')) h' xs'\"\nunfolding sim_move10_def sim_moves10_def\napply(simp split: split_if_asm split del: split_if add: is_vals_conv)\n apply(fastforce simp add: \\red0t_Val \\red0r_Val \\reds0t_map_Val \\reds0r_map_Val intro: Call_\\red0r_param Call_\\red0t_param CallParams split: split_if_asm split del: split_if intro!: if_split)\n apply(rule conjI)\n apply fastforce\n apply(rule if_split)\n apply fastforce\n apply(clarsimp split del: split_if)\n apply(rule if_split)\n apply(clarsimp split: split_if_asm simp add: is_vals_conv)\n apply(erule disjE)\n apply clarsimp\n apply(rule exI conjI)+\n apply(erule Call_\\red0r_param)\n apply(fastforce intro: CallParams)\n apply(fastforce simp add: \\reds0r_map_Val)\n apply(rule exI conjI)+\n apply(erule Call_\\red0r_param)\n apply(fastforce intro!: CallParams)\n apply(clarsimp split del: split_if split: split_if_asm simp add: is_vals_conv \\reds0r_map_Val)\n apply fastforce\napply(rule conjI)\n apply fastforce\napply(rule if_split)\n apply fastforce\napply(rule conjI)\n apply fastforce\napply(rule if_split)\n apply(clarsimp split: split_if_asm)\napply(clarsimp split: split_if_asm split del: split_if simp add: is_vals_conv)\napply(fastforce intro: CallParams)\ndone\n\nlemma sim_move10_Block:\n \"sim_move10 P t ta1 e1 e1' e h (xs(V' := vo)) ta e' h' xs'\n \\ sim_move10 P t ta1 ({V:T=None; e1}) ({V:T=None; e1'}) ({V':T=vo; e}) h xs ta ({V':T=xs' V'; e'}) h' (xs'(V' := xs V'))\"\nproof -\n assume \"sim_move10 P t ta1 e1 e1' e h (xs(V' := vo)) ta e' h' xs'\"\n moreover {\n fix e'' xs''\n assume \"extTA2J0 P,P,t \\ \\e'',(h, xs'')\\ -ta\\ \\e',(h', xs')\\\"\n hence \"extTA2J0 P,P,t \\ \\e'',(h, xs''(V' := xs V', V' := xs'' V'))\\ -ta\\ \\e',(h', xs')\\\" by simp\n from BlockRed[OF this, of T]\n have \"extTA2J0 P,P,t \\ \\{V':T=xs'' V'; e''},(h, xs''(V' := xs V'))\\ -ta\\ \\{V':T=xs' V'; e'},(h', xs'(V' := xs V'))\\\"\n by simp }\n ultimately show ?thesis\n by(fastforce simp add: sim_move10_def final_iff split: split_if_asm)\nqed\n\nlemma sim_move10_reds:\n \"\\ (h', a) \\ allocate h (Class_type C); ta1 = \\NewHeapElem a (Class_type C)\\; ta = \\NewHeapElem a (Class_type C)\\ \\\n \\ sim_move10 P t ta1 (new C) e1' (new C) h xs ta (addr a) h' xs\"\n \"allocate h (Class_type C) = {} \\ sim_move10 P t \\ (new C) e1' (new C) h xs \\ (THROW OutOfMemory) h xs\"\n \"\\ (h', a) \\ allocate h (Array_type T (nat (sint i))); 0 <=s i;\n ta1 = \\NewHeapElem a (Array_type T (nat (sint i)))\\; ta = \\NewHeapElem a (Array_type T (nat (sint i)))\\ \\\n \\ sim_move10 P t ta1 (newA T\\Val (Intg i)\\) e1' (newA T\\Val (Intg i)\\) h xs ta (addr a) h' xs\"\n \"i sim_move10 P t \\ (newA T\\Val (Intg i)\\) e1' (newA T\\Val (Intg i)\\) h xs \\ (THROW NegativeArraySize) h xs\"\n \"\\ allocate h (Array_type T (nat (sint i))) = {}; 0 <=s i \\\n \\ sim_move10 P t \\ (newA T\\Val (Intg i)\\) e1' (newA T\\Val (Intg i)\\) h xs \\ (THROW OutOfMemory) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; P \\ U \\ T \\\n \\ sim_move10 P t \\ (Cast T (Val v)) e1' (Cast T (Val v)) h xs \\ (Val v) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; \\ P \\ U \\ T \\\n \\ sim_move10 P t \\ (Cast T (Val v)) e1' (Cast T (Val v)) h xs \\ (THROW ClassCast) h xs\"\n \"\\ typeof\\<^bsub>h\\<^esub> v = \\U\\; b \\ v \\ Null \\ P \\ U \\ T \\\n \\ sim_move10 P t \\ ((Val v) instanceof T) e1' ((Val v) instanceof T) h xs \\ (Val (Bool b)) h xs\"\n \"binop bop v1 v2 = Some (Inl v) \\ sim_move10 P t \\ ((Val v1) \\bop\\ (Val v2)) e1' (Val v1 \\bop\\ Val v2) h xs \\ (Val v) h xs\"\n \"binop bop v1 v2 = Some (Inr a) \\ sim_move10 P t \\ ((Val v1) \\bop\\ (Val v2)) e1' (Val v1 \\bop\\ Val v2) h xs \\ (Throw a) h xs\"\n \"xs V = \\v\\ \\ sim_move10 P t \\ (Var V') e1' (Var V) h xs \\ (Val v) h xs\"\n \"sim_move10 P t \\ (V' := Val v) e1' (V := Val v) h xs \\ unit h (xs(V \\ v))\"\n \"sim_move10 P t \\ (null\\Val v\\) e1' (null\\Val v\\) h xs \\ (THROW NullPointer) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; i sint i \\ int n \\\n \\ sim_move10 P t \\ (addr a\\Val (Intg i)\\) e1' ((addr a)\\Val (Intg i)\\) h xs \\ (THROW ArrayIndexOutOfBounds) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n;\n heap_read h a (ACell (nat (sint i))) v;\n ta1 = \\ReadMem a (ACell (nat (sint i))) v\\; ta = \\ReadMem a (ACell (nat (sint i))) v\\ \\\n \\ sim_move10 P t ta1 (addr a\\Val (Intg i)\\) e1' ((addr a)\\Val (Intg i)\\) h xs ta (Val v) h xs\"\n \"sim_move10 P t \\ (null\\Val v\\ := Val v') e1' (null\\Val v\\ := Val v') h xs \\ (THROW NullPointer) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; i sint i \\ int n \\\n \\ sim_move10 P t \\ (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs \\ (THROW ArrayIndexOutOfBounds) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n; typeof\\<^bsub>h\\<^esub> v = \\U\\; \\ (P \\ U \\ T) \\\n \\ sim_move10 P t \\ (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs \\ (THROW ArrayStore) h xs\"\n \"\\ typeof_addr h a = \\Array_type T n\\; 0 <=s i; sint i < int n; typeof\\<^bsub>h\\<^esub> v = Some U; P \\ U \\ T;\n heap_write h a (ACell (nat (sint i))) v h';\n ta1 = \\WriteMem a (ACell (nat (sint i))) v\\; ta = \\WriteMem a (ACell (nat (sint i))) v\\ \\\n \\ sim_move10 P t ta1 (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs ta unit h' xs\"\n \"typeof_addr h a = \\Array_type T n\\ \\ sim_move10 P t \\ (addr a\\length) e1' (addr a\\length) h xs \\ (Val (Intg (word_of_int (int n)))) h xs\"\n \"sim_move10 P t \\ (null\\length) e1' (null\\length) h xs \\ (THROW NullPointer) h xs\"\n \"\\ heap_read h a (CField D F) v; ta1 = \\ReadMem a (CField D F) v\\; ta = \\ReadMem a (CField D F) v\\ \\\n \\ sim_move10 P t ta1 (addr a\\F{D}) e1' (addr a\\F{D}) h xs ta (Val v) h xs\"\n \"sim_move10 P t \\ (null\\F{D}) e1' (null\\F{D}) h xs \\ (THROW NullPointer) h xs\"\n \"\\ heap_write h a (CField D F) v h'; ta1 = \\WriteMem a (CField D F) v\\; ta = \\WriteMem a (CField D F) v\\ \\\n \\ sim_move10 P t ta1 (addr a\\F{D} := Val v) e1' (addr a\\F{D} := Val v) h xs ta unit h' xs\"\n\n \"sim_move10 P t \\ (null\\F{D} := Val v) e1' (null\\F{D} := Val v) h xs \\ (THROW NullPointer) h xs\"\n \"sim_move10 P t \\ ({V':T=None; Val u}) e1' ({V:T=vo; Val u}) h xs \\ (Val u) h xs\"\n \"sim_move10 P t \\ ({V':T=\\v\\; e}) ({V':T=None; e}) ({V:T=vo; e'}) h xs \\ ({V:T=vo; e'}) h xs\"\n \"sim_move10 P t \\ (sync\\<^bsub>V'\\<^esub>(null) e0) e1' (sync(null) e1) h xs \\ (THROW NullPointer) h xs\"\n \"sim_move10 P t \\ (Val v;;e0) e1' (Val v;; e1) h xs \\ e1 h xs\"\n \"sim_move10 P t \\ (if (true) e0 else e0') e1' (if (true) e1 else e2) h xs \\ e1 h xs\"\n \"sim_move10 P t \\ (if (false) e0 else e0') e1' (if (false) e1 else e2) h xs \\ e2 h xs\"\n \"sim_move10 P t \\ (throw null) e1' (throw null) h xs \\ (THROW NullPointer) h xs\"\n \"sim_move10 P t \\ (try (Val v) catch(C V') e0) e1' (try (Val v) catch(C V) e1) h xs \\ (Val v) h xs\"\n \"\\ typeof_addr h a = \\Class_type D\\; P \\ D \\\\<^sup>* C \\\n \\ sim_move10 P t \\ (try (Throw a) catch(C V') e0) e1' (try (Throw a) catch(C V) e1) h xs \\ ({V:Class C=\\Addr a\\; e1}) h xs\"\n \"sim_move10 P t \\ (newA T\\Throw a\\) e1' (newA T\\Throw a\\) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Cast T (Throw a)) e1' (Cast T (Throw a)) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ ((Throw a) instanceof T) e1' ((Throw a) instanceof T) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ ((Throw a) \\bop\\ e0) e1' ((Throw a) \\bop\\ e1) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v \\bop\\ (Throw a)) e1' (Val v \\bop\\ (Throw a)) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (V' := Throw a) e1' (V := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\e0\\) e1' (Throw a\\e1\\) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v\\Throw a\\) e1' (Val v\\Throw a\\) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\e0\\ := e0') e1' (Throw a\\e1\\ := e2) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v\\Throw a\\ := e0) e1' (Val v\\Throw a\\ := e1) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v\\Val v'\\ := Throw a) e1' (Val v\\Val v'\\ := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\length) e1' (Throw a\\length) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\F{D}) e1' (Throw a\\F{D}) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\F{D} := e0) e1' (Throw a\\F{D} := e1) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v\\F{D} := Throw a) e1' (Val v\\F{D} := Throw a) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a\\M(es0)) e1' (Throw a\\M(es1)) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Val v\\M(map Val vs @ Throw a # es0)) e1' (Val v\\M(map Val vs @ Throw a # es1)) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ ({V':T=None; Throw a}) e1' ({V:T=vo; Throw a}) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (sync\\<^bsub>V'\\<^esub>(Throw a) e0) e1' (sync(Throw a) e1) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (Throw a;;e0) e1' (Throw a;;e1) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (if (Throw a) e0 else e0') e1' (if (Throw a) e1 else e2) h xs \\ (Throw a) h xs\"\n \"sim_move10 P t \\ (throw (Throw a)) e1' (throw (Throw a)) h xs \\ (Throw a) h xs\"\napply(fastforce simp add: sim_move10_def no_calls_def no_call_def ta_bisim_def intro: red_reds.intros)+\ndone\n\nlemma sim_move10_CallNull:\n \"sim_move10 P t \\ (null\\M(map Val vs)) e1' (null\\M(map Val vs)) h xs \\ (THROW NullPointer) h xs\"\nby(fastforce simp add: sim_move10_def map_eq_append_conv intro: RedCallNull)\n\nlemma sim_move10_SyncLocks:\n \"\\ ta1 = \\Lock\\a, SyncLock a\\; ta = \\Lock\\a, SyncLock a\\ \\\n \\ sim_move10 P t ta1 (sync\\<^bsub>V\\<^esub>(addr a) e0) e1' (sync(addr a) e1) h xs ta (insync(a) e1) h xs\"\n \"\\ ta1 = \\Unlock\\a, SyncUnlock a\\; ta = \\Unlock\\a, SyncUnlock a\\ \\\n \\ sim_move10 P t ta1 (insync\\<^bsub>V\\<^esub>(a') (Val v)) e1' (insync(a) (Val v)) h xs ta (Val v) h xs\"\n \"\\ ta1 = \\Unlock\\a, SyncUnlock a\\; ta = \\Unlock\\a, SyncUnlock a\\ \\\n \\ sim_move10 P t ta1 (insync\\<^bsub>V\\<^esub>(a') (Throw a'')) e1' (insync(a) (Throw a'')) h xs ta (Throw a'') h xs\"\nby(fastforce simp add: sim_move10_def ta_bisim_def ta_upd_simps intro: red_reds.intros[simplified])+\n\nlemma sim_move10_TryFail:\n \"\\ typeof_addr h a = \\Class_type D\\; \\ P \\ D \\\\<^sup>* C \\\n \\ sim_move10 P t \\ (try (Throw a) catch(C V') e0) e1' (try (Throw a) catch(C V) e1) h xs \\ (Throw a) h xs\"\nby(auto simp add: sim_move10_def intro!: RedTryFail)\n\nlemmas sim_move10_intros =\n sim_move10_expr sim_move10_reds sim_move10_CallNull sim_move10_TryFail sim_move10_Block sim_move10_CallParams\n\nlemma sim_move10_preserves_defass:\n assumes wf: \"wf_J_prog P\"\n shows \"\\ sim_move10 P t ta1 e1 e1' e h xs ta e' h' xs'; \\ e \\dom xs\\ \\ \\ \\ e' \\dom xs'\\\"\nby(auto simp add: sim_move10_def split: split_if_asm dest!: \\red0r_preserves_defass[OF wf] \\red0t_preserves_defass[OF wf] red_preserves_defass[OF wf])\n\ndeclare sim_move10_intros[intro]\n\nlemma assumes wf: \"wf_J_prog P\"\n shows red_simulates_red1_aux:\n \"\\ False,compP1 P,t \\1 \\e1, S\\ -TA\\ \\e1', S'\\; bisim vs e2 e1 (lcl S); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl S]; length vs + max_vars e1 \\ length (lcl S);\n \\ e2 \\dom x\\ \\\n \\ \\ta e2' x'. sim_move10 P t TA e1 e1' e2 (hp S) x ta e2' (hp S') x' \\ bisim vs e2' e1' (lcl S') \\ x' \\\\<^sub>m [vs [\\] lcl S']\"\n (is \"\\ _; _; _; _; _; _ \\ \\ ?concl e1 e1' e2 S x TA S' e1' vs\")\n\n and reds_simulates_reds1_aux:\n \"\\ False,compP1 P,t \\1 \\es1, S\\ [-TA\\] \\es1', S'\\; bisims vs es2 es1 (lcl S); fvs es2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl S]; length vs + max_varss es1 \\ length (lcl S);\n \\s es2 \\dom x\\ \\\n \\ \\ta es2' x'. sim_moves10 P t TA es1 es1' es2 (hp S) x ta es2' (hp S') x' \\ bisims vs es2' es1' (lcl S') \\ x' \\\\<^sub>m [vs [\\] lcl S']\"\n (is \"\\ _; _; _; _; _; _ \\ \\ ?concls es1 es1' es2 S x TA S' es1' vs\")\nproof(induct arbitrary: vs e2 x and vs es2 x rule: red1_reds1.inducts)\n case (Bin1OpRed1 e s ta e' s' bop e2 Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisim Vs E2 (e \\bop\\ e2) (lcl s)` obtain E E2'\n where E2: \"E2 = E \\bop\\ E2'\" \"e2 = compE1 Vs E2'\" and \"bisim Vs E e (lcl s)\"\n and sync: \"\\ contains_insync E2'\"\n by(auto elim!: bisim_cases)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (e \\bop\\ e2) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately obtain TA' e2' x' where \"sim_move10 P t ta e e' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' e' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(auto)\n with E2 `fv E2 \\ set Vs` sync show ?case by(cases \"is_val e2'\")(auto intro: BinOpRed1)\nnext\n case (Bin1OpRed2 e s ta e' s' v bop Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `bisim Vs E2 (Val v \\bop\\ e) (lcl s)` obtain E \n where E2: \"E2 = Val v \\bop\\ E\" and \"bisim Vs E e (lcl s)\" by(auto)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (Val v \\bop\\ e) \\ length (lcl s)` `\\ E2 \\dom X\\` E2\n ultimately show ?case by(auto intro: BinOpRed2)\nnext\n case (Red1Var s V v Vs E2 X)\n from `bisim Vs E2 (Var V) (lcl s)` `fv E2 \\ set Vs`\n obtain V' where \"E2 = Var V'\" \"V' = Vs ! V\" \"V = index Vs V'\" by(clarify, simp)\n from `E2 = Var V'` `\\ E2 \\dom X\\`\n obtain v' where \"X V' = \\v'\\\" by(auto simp add: hyperset_defs)\n with `X \\\\<^sub>m [Vs [\\] lcl s]` have \"[Vs [\\] lcl s] V' = \\v'\\\" by(rule map_le_SomeD)\n with `length Vs + max_vars (Var V) \\ length (lcl s)`\n have \"lcl s ! (index Vs V') = v'\" by(auto intro: map_upds_Some_eq_nth_index)\n with `V = index Vs V'` `lcl s ! V = v` have \"v = v'\" by simp\n with `X V' = \\v'\\` `E2 = Var V'` `X \\\\<^sub>m [Vs [\\] lcl s]`\n show ?case by(fastforce intro: RedVar)\nnext\n case (LAss1Red e s ta e' s' V Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `bisim Vs E2 (V:=e) (lcl s)` obtain E V'\n where E2: \"E2 = (V':=E)\" \"V = index Vs V'\" and \"bisim Vs E e (lcl s)\" by auto\n with IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (V:=e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n E2 show ?case by(auto intro: LAssRed)\nnext\n case (Red1LAss V l v h Vs E2 X)\n from `bisim Vs E2 (V:=Val v) (lcl (h, l))` obtain V' where \"E2 = (V' := Val v)\" \"V = index Vs V'\" by(auto)\n moreover with `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl (h, l)]` `length Vs + max_vars (V:=Val v) \\ length (lcl (h, l))`\n have \"X(V' \\ v) \\\\<^sub>m [Vs [\\] l[index Vs V' := v]]\" by(auto intro: LAss_lem)\n ultimately show ?case by(auto intro: RedLAss simp del: fun_upd_apply)\nnext\n case (AAcc1Red1 a s ta a' s' i Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 a (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars a \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl a a' e2 s x ta s' a' vs`\n from `False,compP1 P,t \\1 \\a,s\\ -ta\\ \\a',s'\\` have \"\\ is_val a\" by auto\n with `bisim Vs E2 (a\\i\\) (lcl s)` obtain E E2'\n where E2: \"E2 = E\\E2'\\\" \"i = compE1 Vs E2'\" and \"bisim Vs E a (lcl s)\"\n and sync: \"\\ contains_insync E2'\" by(fastforce)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (a\\i\\) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately obtain TA' e2' x' where \"sim_move10 P t ta a a' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' a' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(auto)\n with E2 `fv E2 \\ set Vs` sync show ?case\n by(cases \"is_val e2'\")(auto intro: AAccRed1)\nnext\n case (AAcc1Red2 i s ta i' s' a Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 i (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars i \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl i i' e2 s x ta s' i' vs`\n from `bisim Vs E2 (Val a\\i\\) (lcl s)` obtain E \n where E2: \"E2 = Val a\\E\\\" and \"bisim Vs E i (lcl s)\" by(auto)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]` E2\n `length Vs + max_vars (Val a\\i\\) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately show ?case by(auto intro: AAccRed2)\nnext\n case Red1AAcc thus ?case by(fastforce intro: RedAAcc simp del: fun_upd_apply)\nnext\n case (AAss1Red1 a s ta a' s' i e Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 a (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars a \\ length (lcl s); \\ e2 \\dom x\\ \\\n \\ ?concl a a' e2 s x ta s' a' vs`\n from `False,compP1 P,t \\1 \\a,s\\ -ta\\ \\a',s'\\` have \"\\ is_val a\" by auto\n with `bisim Vs E2 (a\\i\\:=e) (lcl s)` obtain E E2' E2''\n where E2: \"E2 = E\\E2'\\:=E2''\" \"i = compE1 Vs E2'\" \"e = compE1 Vs E2''\" and \"bisim Vs E a (lcl s)\"\n and sync: \"\\ contains_insync E2'\" \"\\ contains_insync E2''\" by(fastforce)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (a\\i\\:=e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately obtain TA' e2' x' where IH': \"sim_move10 P t ta a a' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' a' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(auto)\n show ?case\n proof(cases \"is_val e2'\")\n case True\n from E2 `fv E2 \\ set Vs` sync have \"bisim Vs E2' i (lcl s')\" \"bisim Vs E2'' e (lcl s')\" by auto\n with IH' E2 True sync show ?thesis\n by(cases \"is_val E2'\")(fastforce intro: AAssRed1)+\n next\n case False with IH' E2 sync show ?thesis by(fastforce intro: AAssRed1)\n qed\nnext\n case (AAss1Red2 i s ta i' s' a e Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 i (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars i \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl i i' e2 s x ta s' i' vs`\n from `False,compP1 P,t \\1 \\i,s\\ -ta\\ \\i',s'\\` have \"\\ is_val i\" by auto\n with `bisim Vs E2 (Val a\\i\\:=e) (lcl s)` obtain E E2'\n where E2: \"E2 = Val a\\E\\:=E2'\" \"e = compE1 Vs E2'\" and \"bisim Vs E i (lcl s)\"\n and sync: \"\\ contains_insync E2'\" by(fastforce)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (Val a\\i\\:=e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately obtain TA' e2' x' where \"sim_move10 P t ta i i' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' i' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(auto)\n with E2 `fv E2 \\ set Vs` sync show ?case\n by(cases \"is_val e2'\")(fastforce intro: AAssRed2)+\nnext\n case (AAss1Red3 e s ta e' s' a i Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `bisim Vs E2 (Val a\\Val i\\:=e) (lcl s)` obtain E\n where E2: \"E2 = Val a\\Val i\\:=E\" and \"bisim Vs E e (lcl s)\" by(fastforce)\n moreover note IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]` E2\n `length Vs + max_vars (Val a\\Val i\\:=e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately show ?case by(fastforce intro: AAssRed3)\nnext\n case Red1AAssStore thus ?case by(auto)((rule exI conjI)+, auto)\nnext\n case Red1AAss thus ?case \n by(fastforce simp del: fun_upd_apply)\nnext \n case (FAss1Red1 e s ta e' s' F D e2 Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\` have \"\\ is_val e\" by auto\n with `bisim Vs E2 (e\\F{D}:=e2) (lcl s)` obtain E E2'\n where E2: \"E2 = E\\F{D}:=E2'\" \"e2 = compE1 Vs E2'\" and \"bisim Vs E e (lcl s)\" \n and sync: \"\\ contains_insync E2'\" by(fastforce)\n with IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (e\\F{D}:=e2) \\ length (lcl s)` `\\ E2 \\dom X\\`\n obtain TA' e2' x' where \"sim_move10 P t ta e e' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' e' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(fastforce)\n with E2 `fv E2 \\ set Vs` sync show ?case by(cases \"is_val e2'\")(auto intro: FAssRed1)\nnext \n case (FAss1Red2 e s ta e' s' v F D Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ ?concl e e' e2 s x ta s' e' vs`\n from `bisim Vs E2 (Val v\\F{D}:=e) (lcl s)` obtain E\n where E2: \"E2 = (Val v\\F{D}:=E)\" and \"bisim Vs E e (lcl s)\" by(fastforce)\n with IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (Val v\\F{D}:=e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n E2 show ?case by(fastforce intro: FAssRed2)\nnext\n case (Call1Obj e s ta e' s' M es Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s);\n \\ e2 \\dom x\\ \\ \\ ?concl e e' e2 s x ta s' e' vs` \n from `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\` `bisim Vs E2 (e\\M(es)) (lcl s)`\n obtain E es' where E2: \"E2 = E\\M(es')\" \"es = compEs1 Vs es'\" and \"bisim Vs E e (lcl s)\"\n and sync: \"\\ contains_insyncs es'\" by(auto elim!: bisim_cases simp add: compEs1_conv_map)\n with IH[of Vs E X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (e\\M(es)) \\ length (lcl s)` `\\ E2 \\dom X\\`\n obtain TA' e2' x' where IH': \"sim_move10 P t ta e e' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' e' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(fastforce)\n with E2 `fv E2 \\ set Vs` `E2 = E\\M(es')` sync show ?case\n by(cases \"is_val e2'\")(auto intro: CallObj)\nnext\n case (Call1Params es s ta es' s' v M Vs E2 X)\n note IH = `\\vs es2 x. \\ bisims vs es2 es (lcl s); fvs es2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_varss es \\ length (lcl s); \\s es2 \\dom x\\\\ \n \\ ?concls es es' es2 s x ta s' es' vs`\n from `bisim Vs E2 (Val v\\M(es)) (lcl s)` obtain Es\n where \"E2 = Val v \\M(Es)\" \"bisims Vs Es es (lcl s)\" by(auto)\n with IH[of Vs Es X] `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_vars (Val v\\M(es)) \\ length (lcl s)` `\\ E2 \\dom X\\`\n `E2 = Val v \\M(Es)` show ?case by(fastforce intro: CallParams)\nnext\n case (Red1CallExternal s a T M Ts Tr D vs ta va h' e' s' Vs E2 X)\n from `bisim Vs E2 (addr a\\M(map Val vs)) (lcl s)` have E2: \"E2 = addr a\\M(map Val vs)\" by auto\n moreover from `compP1 P \\ class_type_of T sees M: Ts\\Tr = Native in D`\n have \"P \\ class_type_of T sees M: Ts\\Tr = Native in D\" by simp\n moreover from `compP1 P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\`\n have \"P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\\" by simp\n moreover from wf `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\`\n have \"ta_bisim01 (extTA2J0 P ta) (extTA2J1 (compP1 P) ta)\"\n by(rule red_external_ta_bisim01)\n moreover note `typeof_addr (hp s) a = \\T\\` `e' = extRet2J1 (addr a\\M(map Val vs)) va` `s' = (h', lcl s)`\n moreover from `typeof_addr (hp s) a = \\T\\` `P,t \\ \\a\\M(vs),hp s\\ -ta\\ext \\va,h'\\`\n `P \\ class_type_of T sees M: Ts\\Tr = Native in D`\n have \"\\external_defs D M \\ ta = \\ \\ h' = hp s\"\n by(fastforce dest: \\external'_red_external_heap_unchanged \\external'_red_external_TA_empty simp add: \\external'_def \\external_def)\n ultimately show ?case using `X \\\\<^sub>m [Vs [\\] lcl s]`\n by(fastforce intro!: exI[where x=\"extTA2J0 P ta\"] intro: RedCallExternal simp add: map_eq_append_conv sim_move10_def synthesized_call_def dest: sees_method_fun del: disjCI intro: disjI1 disjI2)\nnext\n case (Block1Red e h x ta e' h' x' V T Vs E2 X)\n note IH = `\\vs e2 xa. \\ bisim vs e2 e (lcl (h, x)); fv e2 \\ set vs; xa \\\\<^sub>m [vs [\\] lcl (h, x)];\n length vs + max_vars e \\ length (lcl (h, x)); \\ e2 \\dom xa\\\\\n \\ ?concl e e' e2 (h, x) xa ta (h', x') e' vs` \n from `False,compP1 P,t \\1 \\e,(h, x)\\ -ta\\ \\e',(h', x')\\`\n have \"length x = length x'\" by(auto dest: red1_preserves_len)\n with `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))`\n have \"length Vs < length x'\" by simp\n from `bisim Vs E2 {V:T=None; e} (lcl (h, x))`\n show ?case\n proof(cases rule: bisim_cases(12)[consumes 1, case_names BlockNone BlockSome BlockSomeNone])\n case (BlockNone V' E)\n with `fv E2 \\ set Vs` have \"fv E \\ set (Vs@[V'])\" by auto\n with IH[of \"Vs@[V']\" E \"X(V' := None)\"] BlockNone `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl (h, x)]`\n `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` `\\ E2 \\dom X\\`\n obtain TA' e2' X' where IH': \"sim_move10 P t ta e e' E h (X(V' := None)) TA' e2' h' X'\"\n \"bisim (Vs @ [V']) e2' e' x'\" \"X' \\\\<^sub>m [Vs @ [V'] [\\] x']\"\n by(fastforce simp del: fun_upd_apply)\n { assume \"V' \\ set Vs\"\n hence \"hidden (Vs @ [V']) (index Vs V')\" by(rule hidden_index)\n with `bisim (Vs @ [V']) E e (lcl (h, x))` have \"unmod e (index Vs V')\"\n by(auto intro: hidden_bisim_unmod)\n moreover from `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` `V' \\ set Vs`\n have \"index Vs V' < length x\" by(auto intro: index_less_aux)\n ultimately have \"x ! index Vs V' = x' ! index Vs V'\"\n using red1_preserves_unmod[OF `False,compP1 P,t \\1 \\e,(h, x)\\ -ta\\ \\e',(h', x')\\`]\n by(simp) }\n with `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` \n `X' \\\\<^sub>m [Vs @ [V'] [\\] x']` `length x = length x'` `X \\\\<^sub>m [Vs [\\] lcl (h, x)]`\n have rel: \"X'(V' := X V') \\\\<^sub>m [Vs [\\] x']\" by(auto intro: Block_lem)\n\n show ?thesis\n proof(cases \"X' V'\")\n case None\n with BlockNone IH' rel show ?thesis by(fastforce intro: BlockRed)\n next\n case (Some v)\n with `X' \\\\<^sub>m [Vs @ [V'] [\\] x']` `length Vs < length x'`\n have \"x' ! length Vs = v\" by(auto dest: map_le_SomeD)\n with BlockNone IH' rel Some show ?thesis by(fastforce intro: BlockRed)\n qed\n next\n case BlockSome thus ?thesis by simp\n next\n case (BlockSomeNone V' E)\n with `fv E2 \\ set Vs` have \"fv E \\ set (Vs@[V'])\" by auto\n with IH[of \"Vs@[V']\" E \"X(V' \\ x ! length Vs)\"] BlockSomeNone `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl (h, x)]`\n `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` `\\ E2 \\dom X\\`\n obtain TA' e2' X' where IH': \"sim_move10 P t ta e e' E h (X(V' \\ x ! length Vs)) TA' e2' h' X'\"\n \"bisim (Vs @ [V']) e2' e' x'\" \"X' \\\\<^sub>m [Vs @ [V'] [\\] x']\"\n by(fastforce simp del: fun_upd_apply)\n { assume \"V' \\ set Vs\"\n hence \"hidden (Vs @ [V']) (index Vs V')\" by(rule hidden_index)\n with `bisim (Vs @ [V']) E e (lcl (h, x))` have \"unmod e (index Vs V')\"\n by(auto intro: hidden_bisim_unmod)\n moreover from `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` `V' \\ set Vs`\n have \"index Vs V' < length x\" by(auto intro: index_less_aux)\n ultimately have \"x ! index Vs V' = x' ! index Vs V'\"\n using red1_preserves_unmod[OF `False,compP1 P,t \\1 \\e,(h, x)\\ -ta\\ \\e',(h', x')\\`]\n by(simp) }\n with `length Vs + max_vars {V:T=None; e} \\ length (lcl (h, x))` \n `X' \\\\<^sub>m [Vs @ [V'] [\\] x']` `length x = length x'` `X \\\\<^sub>m [Vs [\\] lcl (h, x)]`\n have rel: \"X'(V' := X V') \\\\<^sub>m [Vs [\\] x']\" by(auto intro: Block_lem)\n from `sim_move10 P t ta e e' E h (X(V' \\ x ! length Vs)) TA' e2' h' X'`\n obtain v' where \"X' V' = \\v'\\\"\n by(auto simp: sim_move10_def split: split_if_asm dest!: \\red0t_lcl_incr \\red0r_lcl_incr red_lcl_incr subsetD)\n with `X' \\\\<^sub>m [Vs @ [V'] [\\] x']` `length Vs < length x'`\n have \"x' ! length Vs = v'\" by(auto dest: map_le_SomeD)\n with BlockSomeNone IH' rel `X' V' = \\v'\\`\n show ?thesis by(fastforce intro: BlockRed)\n qed\nnext\n case(Block1Some V xs T v e h)\n from `bisim vs e2 {V:T=\\v\\; e} (lcl (h, xs))` obtain e' V' where \"e2 = {V':T=\\v\\; e'}\"\n and \"V = length vs\" \"bisim (vs @ [V']) e' e (xs[length vs := v])\" by(fastforce)\n moreover have \"sim_move10 P t \\ {length vs:T=\\v\\; e} {length vs:T=None; e} {V':T=\\v\\; e'} h x \\ {V':T=\\v\\; e'} h x\"\n by(auto)\n moreover from `bisim (vs @ [V']) e' e (xs[length vs := v])`\n `length vs + max_vars {V:T=\\v\\; e} \\ length (lcl (h, xs))`\n have \"bisim vs {V':T=\\v\\; e'} {length vs:T=None; e} (xs[length vs := v])\" by auto\n moreover from `x \\\\<^sub>m [vs [\\] lcl (h, xs)]` `length vs + max_vars {V:T=\\v\\; e} \\ length (lcl (h, xs))`\n have \"x \\\\<^sub>m [vs [\\] xs[length vs := v]]\" by auto\n ultimately show ?case by auto\nnext\n case (Lock1Synchronized V xs a e h Vs E2 X)\n note len = `length Vs + max_vars (sync\\<^bsub>V\\<^esub> (addr a) e) \\ length (lcl (h, xs))`\n from `bisim Vs E2 (sync\\<^bsub>V\\<^esub> (addr a) e) (lcl (h, xs))` obtain E\n where E2: \"E2 = sync(addr a) E\" \"e = compE1 (Vs@[fresh_var Vs]) E\" \n and sync: \"\\ contains_insync E\" and [simp]: \"V = length Vs\" by auto\n moreover\n have \"extTA2J0 P,P,t \\ \\sync(addr a) E, (h, X)\\ -\\Lock\\a, SyncLock a\\\\ \\insync(a) E, (h, X)\\\"\n by(rule LockSynchronized)\n moreover from `fv E2 \\ set Vs` fresh_var_fresh[of Vs] sync len\n have \"bisim Vs (insync(a) E) (insync\\<^bsub>length Vs\\<^esub> (a) e) (xs[length Vs := Addr a])\"\n unfolding `e = compE1 (Vs@[fresh_var Vs]) E` `E2 = sync(addr a) E`\n by -(rule bisimInSynchronized,rule compE1_bisim, auto)\n moreover have \"zip Vs (xs[length Vs := Addr a]) = (zip Vs xs)[length Vs := (arbitrary, Addr a)]\"\n by(rule sym)(simp add: update_zip)\n hence \"zip Vs (xs[length Vs := Addr a]) = zip Vs xs\" by simp\n with `X \\\\<^sub>m [Vs [\\] (lcl (h, xs))]` have \"X \\\\<^sub>m [Vs [\\] xs[length Vs := Addr a]]\"\n by(auto simp add: map_le_def map_upds_def)\n ultimately show ?case by(fastforce intro: sim_move10_SyncLocks)\nnext\n case (Synchronized1Red2 e s ta e' s' V a Vs E2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s);\n \\ e2 \\dom x\\ \\ \\ ?concl e e' e2 s x ta s' e' vs` \n from `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) e) (lcl s)` obtain E\n where E2: \"E2 = insync(a) E\" and bisim: \"bisim (Vs@[fresh_var Vs]) E e (lcl s)\"\n and xsa: \"lcl s ! length Vs = Addr a\" and [simp]: \"V = length Vs\" by auto\n with `fv E2 \\ set Vs` fresh_var_fresh[of Vs] have fv: \"(fresh_var Vs) \\ fv E\" by auto\n from `length Vs + max_vars (insync\\<^bsub>V\\<^esub> (a) e) \\ length (lcl s)` have \"length Vs < length (lcl s)\" by simp\n { assume \"X (fresh_var Vs) \\ None\"\n then obtain v where \"X (fresh_var Vs) = \\v\\\" by auto\n with `X \\\\<^sub>m [Vs [\\] lcl s]` have \"[Vs [\\] lcl s] (fresh_var Vs) = \\v\\\" \n by(auto simp add: map_le_def dest: bspec)\n hence \"(fresh_var Vs) \\ set Vs\" \n by(auto simp add: map_upds_def set_zip dest!: map_of_SomeD )\n moreover have \"(fresh_var Vs) \\ set Vs\" by(rule fresh_var_fresh)\n ultimately have False by contradiction }\n hence \"X (fresh_var Vs) = None\" by(cases \"X (fresh_var Vs)\", auto)\n hence \"X(fresh_var Vs := None) = X\" by(auto intro: ext)\n moreover from `X \\\\<^sub>m [Vs [\\] lcl s]`\n have \"X(fresh_var Vs := None) \\\\<^sub>m [Vs [\\] lcl s, (fresh_var Vs) \\ (lcl s) ! length Vs]\" by(simp)\n ultimately have \"X \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] lcl s]\"\n using `length Vs < length (lcl s)` by(auto)\n moreover note IH[of \"Vs@[fresh_var Vs]\" E X] bisim E2 `fv E2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]` \n `length Vs + max_vars (insync\\<^bsub>V\\<^esub> (a) e) \\ length (lcl s)` `\\ E2 \\dom X\\`\n ultimately obtain TA' e2' x' where IH': \"sim_move10 P t ta e e' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim (Vs @ [fresh_var Vs]) e2' e' (lcl s')\" \"x' \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] lcl s']\" by auto\n hence \"dom x' \\ dom X \\ fv E\"\n by(fastforce iff del: domIff simp add: sim_move10_def dest: red_dom_lcl \\red0r_dom_lcl[OF wf_prog_wwf_prog[OF wf]] \\red0t_dom_lcl[OF wf_prog_wwf_prog[OF wf]] \\red0r_fv_subset[OF wf_prog_wwf_prog[OF wf]] split: split_if_asm)\n with fv `X (fresh_var Vs) = None` have \"(fresh_var Vs) \\ dom x'\" by auto\n hence \"x' (fresh_var Vs) = None\" by auto\n moreover from `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\`\n have \"length (lcl s) = length (lcl s')\" by(auto dest: red1_preserves_len)\n moreover note `x' \\\\<^sub>m [Vs @ [fresh_var Vs] [\\] lcl s']` `length Vs < length (lcl s)`\n ultimately have \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by(auto simp add: map_le_def dest: bspec)\n moreover from bisim fv have \"unmod e (length Vs)\" by(auto intro: bisim_fv_unmod)\n with `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\` `length Vs < length (lcl s)`\n have \"lcl s ! length Vs = lcl s' ! length Vs\"\n by(auto dest!: red1_preserves_unmod)\n with xsa have \"lcl s' ! length Vs = Addr a\" by simp\n ultimately show ?case using IH' E2 by(auto intro: SynchronizedRed2)\nnext\n case (Unlock1Synchronized xs V a' a v h Vs E2 X)\n from `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) Val v) (lcl (h, xs))`\n have E2: \"E2 = insync(a) Val v\" \"V = length Vs\" \"xs ! length Vs = Addr a\" by auto\n moreover with `xs ! V = Addr a'` have [simp]: \"a' = a\" by simp\n have \"extTA2J0 P,P,t \\ \\insync(a) (Val v), (h, X)\\ -\\Unlock\\a, SyncUnlock a\\\\ \\Val v, (h, X)\\\"\n by(rule UnlockSynchronized)\n ultimately show ?case using `X \\\\<^sub>m [Vs [\\] lcl (h, xs)]` by(fastforce intro: sim_move10_SyncLocks)\nnext\n case (Unlock1SynchronizedNull xs V a v h Vs E2 X)\n from `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) Val v) (lcl (h, xs))`\n have \"V = length Vs\" \"xs ! length Vs = Addr a\" by(auto)\n with `xs ! V = Null` have False by simp\n thus ?case ..\nnext\n case (Unlock1SynchronizedFail xs V A' a' v h Vs E2 X)\n from `False` show ?case ..\nnext\n case (Red1While b c s Vs E2 X)\n from `bisim Vs E2 (while (b) c) (lcl s)` obtain B C\n where E2: \"E2 = while (B) C\" \"b = compE1 Vs B\" \"c = compE1 Vs C\" \n and sync: \"\\ contains_insync B\" \"\\ contains_insync C\" by auto\n moreover have \"extTA2J0 P,P,t \\ \\while (B) C, (hp s, X)\\ -\\\\ \\if (B) (C;;while (B) C) else unit, (hp s, X)\\\"\n by(rule RedWhile)\n hence \"sim_move10 P t \\ (while (compE1 Vs B) (compE1 Vs C)) (if (compE1 Vs B) (compE1 Vs C;;while (compE1 Vs B) (compE1 Vs C)) else unit) (while (B) C) (hp s) X \\ (if (B) (C;;while (B) C) else unit) (hp s) X\"\n by(auto simp add: sim_move10_def)\n moreover from `fv E2 \\ set Vs` E2 sync\n have \"bisim Vs (if (B) (C;; while (B) C) else unit)\n (if (compE1 Vs B) (compE1 Vs (C;; while(B) C)) else (compE1 Vs unit)) (lcl s)\"\n by -(rule bisimCond, auto)\n ultimately show ?case using `X \\\\<^sub>m [Vs [\\] lcl s]`\n by(simp)(rule exI, rule exI, rule exI, erule conjI, auto)\nnext\n case (Red1TryCatch h a D C V x e2 Vs E2 X)\n from `bisim Vs E2 (try Throw a catch(C V) e2) (lcl (h, x))`\n obtain E2' V' where \"E2 = try Throw a catch(C V') E2'\" \"V = length Vs\" \"e2 = compE1 (Vs @ [V']) E2'\"\n and sync: \"\\ contains_insync E2'\" by(auto)\n with `fv E2 \\ set Vs` have \"fv E2' \\ set (Vs @[V'])\" by auto\n with `e2 = compE1 (Vs @ [V']) E2'` sync have \"bisim (Vs @[V']) E2' e2 (x[V := Addr a])\"\n by(auto intro!: compE1_bisim)\n with `V = length Vs` `length Vs + max_vars (try Throw a catch(C V) e2) \\ length (lcl (h, x))`\n have \"bisim Vs {V':Class C=\\Addr a\\; E2'} {length Vs:Class C=None; e2} (x[V := Addr a])\"\n by(auto intro: bisimBlockSomeNone)\n moreover from `length Vs + max_vars (try Throw a catch(C V) e2) \\ length (lcl (h, x))`\n have \"[Vs [\\] x[length Vs := Addr a]] = [Vs [\\] x]\" by simp\n with `X \\\\<^sub>m [Vs [\\] lcl (h, x)]` have \"X \\\\<^sub>m [Vs [\\] x[length Vs := Addr a]]\" by simp\n moreover note `e2 = compE1 (Vs @ [V']) E2'` `E2 = try Throw a catch(C V') E2'`\n `typeof_addr h a = \\Class_type D\\` `compP1 P \\ D \\\\<^sup>* C` `V = length Vs`\n ultimately show ?case by(auto intro!: exI)\nnext\n case Red1TryFail thus ?case by(auto intro!: exI sim_move10_TryFail)\nnext\n case (List1Red1 e s ta e' s' es Vs ES2 X)\n note IH = `\\vs e2 x. \\ bisim vs e2 e (lcl s); fv e2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_vars e \\ length (lcl s); \\ e2 \\dom x\\\\\n \\ \\TA' e2' x'. sim_move10 P t ta e e' e2 (hp s) x TA' e2' (hp s') x' \\ \n bisim vs e2' e' (lcl s') \\ x' \\\\<^sub>m [vs [\\] lcl s']`\n from `bisims Vs ES2 (e # es) (lcl s)` `False,compP1 P,t \\1 \\e,s\\ -ta\\ \\e',s'\\`\n obtain E ES where \"ES2 = E # ES\" \"\\ is_val E\" \"es = compEs1 Vs ES\" \"bisim Vs E e (lcl s)\"\n and sync: \"\\ contains_insyncs ES\" by(auto elim!: bisims_cases simp add: compEs1_conv_map)\n with IH[of Vs E X] `fvs ES2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_varss (e # es) \\ length (lcl s)` `\\s ES2 \\dom X\\`\n obtain TA' e2' x' where IH': \"sim_move10 P t ta e e' E (hp s) X TA' e2' (hp s') x'\"\n \"bisim Vs e2' e' (lcl s')\" \"x' \\\\<^sub>m [Vs [\\] lcl s']\" by fastforce\n show ?case\n proof(cases \"is_val e2'\")\n case False\n with IH' `ES2 = E # ES` `es = compEs1 Vs ES` sync show ?thesis by(auto intro: sim_moves10_expr)\n next\n case True\n from `fvs ES2 \\ set Vs` `ES2 = E # ES` `es = compEs1 Vs ES` sync\n have \"bisims Vs ES es (lcl s')\" by(auto intro: compEs1_bisims)\n with IH' True `ES2 = E # ES` `es = compEs1 Vs ES` show ?thesis by(auto intro: sim_moves10_expr)\n qed\nnext\n case (List1Red2 es s ta es' s' v Vs ES2 X)\n note IH = `\\vs es2 x. \\bisims vs es2 es (lcl s); fvs es2 \\ set vs;\n x \\\\<^sub>m [vs [\\] lcl s]; length vs + max_varss es \\ length (lcl s); \\s es2 \\dom x\\\\\n \\ \\TA' es2' x'. sim_moves10 P t ta es es' es2 (hp s) x TA' es2' (hp s') x' \\ bisims vs es2' es' (lcl s') \\ x' \\\\<^sub>m [vs [\\] lcl s']`\n from `bisims Vs ES2 (Val v # es) (lcl s)` obtain ES where \"ES2 = Val v # ES\" \"bisims Vs ES es (lcl s)\"\n by(auto elim!: bisims_cases)\n with IH[of Vs ES X] `fvs ES2 \\ set Vs` `X \\\\<^sub>m [Vs [\\] lcl s]`\n `length Vs + max_varss (Val v # es) \\ length (lcl s)` `\\s ES2 \\dom X\\`\n `ES2 = Val v # ES` show ?case by(fastforce intro: sim_moves10_expr)\nnext\n case Call1ThrowParams\n thus ?case by(fastforce intro: CallThrowParams elim!: bisim_cases simp add: bisims_map_Val_Throw2)\nnext\n case (Synchronized1Throw2 xs V a' a ad h Vs E2 X)\n from `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) Throw ad) (lcl (h, xs))`\n have \"xs ! length Vs = Addr a\" and \"V = length Vs\" by auto\n with `xs ! V = Addr a'` have [simp]: \"a' = a\" by simp\n have \"extTA2J0 P,P,t \\ \\insync(a) Throw ad, (h, X)\\ -\\Unlock\\a, SyncUnlock a\\\\ \\Throw ad, (h, X)\\\"\n by(rule SynchronizedThrow2)\n with `X \\\\<^sub>m [Vs [\\] lcl (h, xs)]` `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) Throw ad) (lcl (h, xs))`\n show ?case by(auto intro: sim_move10_SyncLocks intro!: exI)\nnext\n case (Synchronized1Throw2Null xs V a a' h Vs E2 X)\n from `bisim Vs E2 (insync\\<^bsub>V\\<^esub> (a) Throw a') (lcl (h, xs))`\n have \"V = length Vs\" \"xs ! length Vs = Addr a\" by(auto)\n with `xs ! V = Null` have False by simp\n thus ?case ..\nnext\n case (Synchronized1Throw2Fail xs V A' a' a h Vs E2 X)\n from `False` show ?case ..\nnext\n case InstanceOf1Red thus ?case by auto(blast)\nnext\n case Red1InstanceOf thus ?case by hypsubst_thin auto\nnext\n case InstanceOf1Throw thus ?case by auto\nqed(simp_all del: fun_upd_apply, (fastforce intro: red_reds.intros simp del: fun_upd_apply simp add: finfun_upd_apply)+)\n\nlemma bisim_call_Some_call1:\n \"\\ bisim Vs e e' xs; call e = \\aMvs\\; length Vs + max_vars e' \\ length xs \\\n \\ \\e'' xs'. \\red1'r P t h (e', xs) (e'', xs') \\ call1 e'' = \\aMvs\\ \\ \n bisim Vs e e'' xs' \\ take (length Vs) xs = take (length Vs) xs'\"\n\n and bisims_calls_Some_calls1:\n \"\\ bisims Vs es es' xs; calls es = \\aMvs\\; length Vs + max_varss es' \\ length xs \\ \n \\ \\es'' xs'. \\reds1'r P t h (es', xs) (es'', xs') \\ calls1 es'' = \\aMvs\\ \\ \n bisims Vs es es'' xs' \\ take (length Vs) xs = take (length Vs) xs'\"\nproof(induct rule: bisim_bisims.inducts)\n case bisimCallParams thus ?case\n by(fastforce simp add: is_vals_conv split: split_if_asm)\nnext\n case bisimBlockNone thus ?case by(fastforce intro: take_eq_take_le_eq)\nnext\n case (bisimBlockSome Vs V e e' xs v T)\n from `length Vs + max_vars {length Vs:T=\\v\\; e'} \\ length xs`\n have \"\\red1'r P t h ({length Vs:T=\\v\\; e'}, xs) ({length Vs:T=None; e'}, xs[length Vs := v])\"\n by(auto intro!: \\red1r_1step Block1Some)\n also from bisimBlockSome obtain e'' xs'\n where \"\\red1'r P t h (e', xs[length Vs := v]) (e'', xs')\"\n and \"call1 e'' = \\aMvs\\\" \"bisim (Vs @ [V]) e e'' xs'\" \n and \"take (length (Vs @ [V])) (xs[length Vs := v]) = take (length (Vs @ [V])) xs'\" by auto\n hence \"\\red1'r P t h ({length Vs:T=None; e'}, xs[length Vs := v]) ({length Vs:T=None; e''}, xs')\" by auto\n also from `call1 e'' = \\aMvs\\` have \"call1 {length Vs:T=None; e''} = \\aMvs\\\" by simp\n moreover from `take (length (Vs @ [V])) (xs[length Vs := v]) = take (length (Vs @ [V])) xs'`\n have \"take (length Vs) xs = take (length Vs) xs'\"\n by(auto dest: take_eq_take_le_eq[where m=\"length Vs\"] simp add: take_list_update_beyond)\n moreover {\n have \"xs' ! length Vs = take (length (Vs @ [V])) xs' ! length Vs\" by simp\n also note `take (length (Vs @ [V])) (xs[length Vs := v]) = take (length (Vs @ [V])) xs'`[symmetric]\n also have \"take (length (Vs @ [V])) (xs[length Vs := v]) ! length Vs = v\"\n using `length Vs + max_vars {length Vs:T=\\v\\; e'} \\ length xs` by simp\n finally have \"bisim Vs {V:T=\\v\\; e} {length Vs:T=None; e''} xs'\"\n using `bisim (Vs @ [V]) e e'' xs'` by auto }\n ultimately show ?case by blast\nnext\n case (bisimBlockSomeNone Vs V e e' xs v T)\n then obtain e'' xs' where \"\\red1'r P t h (e', xs) (e'', xs')\" \"call1 e'' = \\aMvs\\\" \"bisim (Vs @ [V]) e e'' xs'\"\n and \"take (length (Vs @ [V])) xs = take (length (Vs @ [V])) xs'\" by auto\n hence \"\\red1'r P t h ({length Vs:T=None; e'}, xs) ({length Vs:T=None; e''}, xs')\" by auto\n moreover from `call1 e'' = \\aMvs\\` have \"call1 ({length Vs:T=None; e''}) = \\aMvs\\\" by simp\n moreover from `take (length (Vs @ [V])) xs = take (length (Vs @ [V])) xs'`\n have \"take (length Vs) xs = take (length Vs) xs'\" by(auto intro: take_eq_take_le_eq)\n moreover {\n have \"xs' ! length Vs = take (length (Vs @ [V])) xs' ! length Vs\" by simp\n also note `take (length (Vs @ [V])) xs = take (length (Vs @ [V])) xs'`[symmetric]\n also have \"take (length (Vs @ [V])) xs ! length Vs = v\" using `xs ! length Vs = v` by simp\n finally have \"bisim Vs {V:T=\\v\\; e} {length Vs:T=None; e''} xs'\"\n using `bisim (Vs @ [V]) e e'' xs'` by auto }\n ultimately show ?case by blast\nnext\n case (bisimInSynchronized Vs e e' xs a)\n then obtain e'' xs' where \"\\red1'r P t h (e', xs) (e'', xs')\" \"call1 e'' = \\aMvs\\\" \"bisim (Vs @ [fresh_var Vs]) e e'' xs'\"\n and \"take (Suc (length Vs)) xs = take (Suc (length Vs)) xs'\" by auto\n hence \"\\red1'r P t h (insync\\<^bsub>length Vs\\<^esub> (a) e', xs) (insync\\<^bsub>length Vs\\<^esub> (a) e'', xs')\" by auto\n moreover from `call1 e'' = \\aMvs\\` have \"call1 (insync\\<^bsub>length Vs\\<^esub> (a) e'') = \\aMvs\\\" by simp\n moreover from `take (Suc (length Vs)) xs = take (Suc (length Vs)) xs'`\n have \"take (length Vs) xs = take (length Vs) xs'\" by(auto intro: take_eq_take_le_eq)\n moreover {\n have \"xs' ! length Vs = take (Suc (length Vs)) xs' ! length Vs\" by simp\n also note `take (Suc (length Vs)) xs = take (Suc (length Vs)) xs'`[symmetric]\n also have \"take (Suc (length Vs)) xs ! length Vs = Addr a\"\n using `xs ! length Vs = Addr a` by simp\n finally have \"bisim Vs (insync(a) e) (insync\\<^bsub>length Vs\\<^esub> (a) e'') xs'\"\n using `bisim (Vs @ [fresh_var Vs]) e e'' xs'` by auto }\n ultimately show ?case by blast\nnext\n case bisimsCons1 thus ?case by(fastforce intro!: \\red1r_inj_\\reds1r)\nnext\n case bisimsCons2 thus ?case by(fastforce intro!: \\reds1r_cons_\\reds1r)\nqed fastforce+\n\nlemma sim_move01_into_Red1:\n \"sim_move01 P t ta e E' h xs ta' e2' h' xs'\n \\ if \\Move0 P h (e, es1)\n then \\Red1't P t h ((E', xs), exs2) ((e2', xs'), exs2) \\ ta = \\ \\ h = h'\n else \\ex2' exs2' ta'. \\Red1'r P t h ((E', xs), exs2) (ex2', exs2') \\\n (call e = None \\ call1 E' = None \\ ex2' = (E', xs) \\ exs2' = exs2) \\\n False,P,t \\1 \\ex2'/exs2',h\\ -ta'\\ \\(e2', xs')/exs2,h'\\ \\\n \\ \\Move1 P h (ex2', exs2') \\ ta_bisim01 ta ta'\"\napply(auto simp add: sim_move01_def intro: \\red1t_into_\\Red1t \\red1r_into_\\Red1r red1Red split: split_if_asm)\napply(fastforce intro: red1Red intro!: \\red1r_into_\\Red1r)+\ndone\n\nlemma sim_move01_max_vars_decr:\n \"sim_move01 P t ta e0 e h xs ta' e' h' xs' \\ max_vars e' \\ max_vars e\"\nby(fastforce simp add: sim_move01_def split: split_if_asm dest: \\red1t_max_vars red1_max_vars_decr \\red1r_max_vars)\n\nlemma Red1_simulates_red0:\n assumes wf: \"wf_J_prog P\"\n and red: \"P,t \\0 \\e1/es1, h\\ -ta\\ \\e1'/es1', h'\\\"\n and bisiml: \"bisim_list1 (e1, es1) (ex2, exs2)\"\n shows \"\\ex2'' exs2''. bisim_list1 (e1', es1') (ex2'', exs2'') \\\n (if \\Move0 P h (e1, es1)\n then \\Red1't (compP1 P) t h (ex2, exs2) (ex2'', exs2'') \\ ta = \\ \\ h = h'\n else \\ex2' exs2' ta'. \\Red1'r (compP1 P) t h (ex2, exs2) (ex2', exs2') \\ \n (call e1 = None \\ call1 (fst ex2) = None \\ ex2' = ex2 \\ exs2' = exs2) \\\n False,compP1 P,t \\1 \\ex2'/exs2', h\\ -ta'\\ \\ex2''/exs2'', h'\\ \\\n \\ \\Move1 P h (ex2', exs2') \\ ta_bisim01 ta ta')\"\n (is \"\\ex2'' exs2'' . _ \\ ?red ex2'' exs2''\")\nusing red\nproof(cases)\n case (red0Red XS')\n note [simp] = `es1' = es1`\n and red = `extTA2J0 P,P,t \\ \\e1,(h, empty)\\ -ta\\ \\e1',(h', XS')\\`\n and notsynth = `\\aMvs. call e1 = \\aMvs\\ \\ synthesized_call P h aMvs`\n from bisiml obtain E xs where ex2: \"ex2 = (E, xs)\"\n and bisim: \"bisim [] e1 E xs\" and fv: \"fv e1 = {}\" \n and length: \"max_vars E \\ length xs\" and bsl: \"bisim_list es1 exs2\"\n and D: \"\\ e1 \\{}\\\" by(auto elim!: bisim_list1_elim)\n from bisim_max_vars[OF bisim] length red1_simulates_red_aux[OF wf red bisim] fv notsynth\n obtain ta' e2' xs' where sim: \"sim_move01 (compP1 P) t ta e1 E h xs ta' e2' h' xs'\"\n and bisim': \"bisim [] e1' e2' xs'\" and XS': \"XS' \\\\<^sub>m empty\" by auto\n from sim_move01_into_Red1[OF sim, of es1 exs2]\n have \"?red (e2', xs') exs2\" unfolding ex2 by auto\n moreover {\n note bsl bisim' moreover\n from fv red_fv_subset[OF wf_prog_wwf_prog[OF wf] red]\n have \"fv e1' = {}\" by simp\n moreover from red D have \"\\ e1' \\dom XS'\\\"\n by(auto dest: red_preserves_defass[OF wf] split: split_if_asm)\n with red_dom_lcl[OF red] `fv e1 = {}` have \"\\ e1' \\{}\\\"\n by(auto elim!: D_mono' simp add: hyperset_defs)\n moreover from sim have \"length xs = length xs'\" \"max_vars e2' \\ max_vars E\"\n by(auto dest: sim_move01_preserves_len sim_move01_max_vars_decr)\n with length have length': \"max_vars e2' \\ length xs'\" by(auto)\n ultimately have \"bisim_list1 (e1', es1) ((e2', xs'), exs2)\" by(rule bisim_list1I) }\n ultimately show ?thesis using ex2 by(simp split del: split_if)(rule exI conjI|assumption)+\nnext\n case (red0Call a M vs U Ts T pns body D)\n note [simp] = `ta = \\` `h' = h`\n and es1' = `es1' = e1 # es1`\n and e1' = `e1' = blocks (this # pns) (Class D # Ts) (Addr a # vs) body`\n and call = `call e1 = \\(a, M, vs)\\`\n and ha = `typeof_addr h a = \\U\\`\n and sees = `P \\ class_type_of U sees M: Ts\\T = \\(pns, body)\\ in D`\n and len = `length vs = length pns` `length Ts = length pns`\n from bisiml obtain E xs where ex2: \"ex2 = (E, xs)\"\n and bisim: \"bisim [] e1 E xs\" and fv: \"fv e1 = {}\" \n and length: \"max_vars E \\ length xs\" and bsl: \"bisim_list es1 exs2\"\n and D: \"\\ e1 \\{}\\\" by(auto elim!: bisim_list1_elim)\n \n from bisim_call_Some_call1[OF bisim call, of \"compP1 P\" t h] length\n obtain e' xs' where red: \"\\red1'r (compP1 P) t h (E, xs) (e', xs')\"\n and \"call1 e' = \\(a, M, vs)\\\" \"bisim [] e1 e' xs'\" \n and \"take 0 xs = take 0 xs'\" by auto\n \n let ?e1' = \"blocks (this # pns) (Class D # Ts) (Addr a # vs) body\"\n let ?e2' = \"blocks1 0 (Class D#Ts) (compE1 (this # pns) body)\"\n let ?xs2' = \"Addr a # vs @ replicate (max_vars (compE1 (this # pns) body)) undefined_value\"\n let ?exs2' = \"(e', xs') # exs2\"\n\n have \"\\Red1'r (compP1 P) t h ((E, xs), exs2) ((e', xs'), exs2)\"\n using red by(rule \\red1r_into_\\Red1r)\n moreover {\n note `call1 e' = \\(a, M, vs)\\` \n moreover note ha\n moreover have \"compP1 P \\ class_type_of U sees M:Ts \\ T = map_option (\\(pns, body). compE1 (this # pns) body) \\(pns, body)\\ in D\"\n using sees unfolding compP1_def by(rule sees_method_compP)\n hence sees': \"compP1 P \\ class_type_of U sees M:Ts \\ T = \\compE1 (this # pns) body\\ in D\" by simp\n moreover from len have \"length vs = length Ts\" by simp\n ultimately have \"False,compP1 P,t \\1 \\(e', xs')/exs2,h\\ -\\\\ \\(?e2', ?xs2')/?exs2', h\\\" by(rule red1Call) \n moreover have \"\\Move1 P h ((e', xs'), exs2)\" using `call1 e' = \\(a, M, vs)\\` ha sees\n by(auto simp add: synthesized_call_def \\external'_def dest: sees_method_fun dest!: \\move1_not_call1[where P=P and h=h])\n ultimately have \"\\Red1' (compP1 P) t h ((e', xs'), exs2) ((?e2', ?xs2'), ?exs2')\" by auto }\n ultimately have \"\\Red1't (compP1 P) t h ((E, xs), exs2) ((?e2', ?xs2'), ?exs2')\" by(rule rtranclp_into_tranclp1)\n moreover\n { from red have \"length xs' = length xs\" by(rule \\red1r_preserves_len)\n moreover from red have \"max_vars e' \\ max_vars E\" by(rule \\red1r_max_vars)\n ultimately have \"max_vars e' \\ length xs'\" using length by simp }\n with bsl `bisim [] e1 e' xs'` fv D have \"bisim_list (e1 # es1) ?exs2'\"\n using `call e1 = \\(a, M, vs)\\` `call1 e' = \\(a, M, vs)\\` by(rule bisim_listCons)\n hence \"bisim_list1 (e1', es1') ((?e2', ?xs2'), ?exs2')\"\n unfolding e1' es1'\n proof(rule bisim_list1I)\n from wf_prog_wwf_prog[OF wf] sees\n have \"wf_mdecl wwf_J_mdecl P D (M,Ts,T,\\(pns,body)\\)\" by(rule sees_wf_mdecl)\n hence fv': \"fv body \\ set pns \\ {this}\" by(auto simp add: wf_mdecl_def)\n moreover from `P \\ class_type_of U sees M: Ts\\T = \\(pns, body)\\ in D` have \"\\ contains_insync body\"\n by(auto dest!: sees_wf_mdecl[OF wf] WT_expr_locks simp add: wf_mdecl_def contains_insync_conv)\n ultimately have \"bisim ([this] @ pns) body (compE1 ([this] @ pns) body) ?xs2'\"\n by -(rule compE1_bisim, auto)\n with `length vs = length pns` `length Ts = length pns`\n have \"bisim ([] @ [this]) (blocks pns Ts vs body) (blocks1 (Suc 0) Ts (compE1 (this # pns) body)) ?xs2'\"\n by -(drule blocks_bisim,auto simp add: nth_append)\n from bisimBlockSomeNone[OF this, of \"Addr a\" \"Class D\"]\n show \"bisim [] ?e1' ?e2' ?xs2'\" by simp\n from fv' len show \"fv ?e1' = {}\" by auto\n\n from wf sees\n have \"wf_mdecl wf_J_mdecl P D (M,Ts,T,\\(pns,body)\\)\" by(rule sees_wf_mdecl)\n hence \"\\ body \\set pns \\ {this}\\\" by(auto simp add: wf_mdecl_def)\n with `length vs = length pns` `length Ts = length pns`\n have \"\\ (blocks pns Ts vs body) \\dom [this \\ Addr a]\\\" by(auto)\n thus \"\\ ?e1' \\{}\\\" by auto\n \n from len show \"max_vars ?e2' \\ length ?xs2'\" by(auto simp add: blocks1_max_vars)\n qed\n moreover have \"\\Move0 P h (e1, es1)\" using call ha sees\n by(fastforce simp add: synthesized_call_def \\external'_def dest: sees_method_fun \\move0_callD[where P=P and h=h])\n ultimately show ?thesis using ex2 `call e1 = \\(a, M, vs)\\` \n by(simp del: \\Move1.simps)(rule exI conjI|assumption)+\nnext\n case (red0Return e)\n note es1 = `es1 = e # es1'` and e1' = `e1' = inline_call e1 e`\n and [simp] = `ta = \\` `h' = h`\n and fin = `final e1`\n from bisiml es1 obtain E' xs' E xs exs' aMvs where ex2: \"ex2 = (E', xs')\" and exs2: \"exs2 = (E, xs) # exs'\"\n and bisim': \"bisim [] e1 E' xs'\"\n and bisim: \"bisim [] e E xs\"\n and fv: \"fv e = {}\"\n and length: \"max_vars E \\ length xs\"\n and bisiml: \"bisim_list es1' exs'\"\n and D: \"\\ e \\{}\\\"\n and call: \"call e = \\aMvs\\\"\n and call1: \"call1 E = \\aMvs\\\"\n by(fastforce elim: bisim_list1_elim)\n let ?e2' = \"inline_call E' E\"\n\n from `final e1` bisim' have \"final E'\" by(auto)\n hence red': \"False,compP1 P,t \\1 \\ex2/exs2, h\\ -\\\\ \\(?e2', xs)/exs', h\\\"\n unfolding ex2 exs2 by(rule red1Return)\n moreover have \"\\Move0 P h (e1, es1) = \\Move1 P h ((E', xs'), exs2)\"\n using `final e1` `final E'` by auto\n moreover {\n note bisiml\n moreover\n from bisim' fin bisim\n have \"bisim [] (inline_call e1 e) (inline_call E' E) xs\"\n using call by(rule bisim_inline_call)(simp add: fv)\n moreover from fv_inline_call[of e1 e] fv fin \n have \"fv (inline_call e1 e) = {}\" by auto\n moreover from fin have \"\\ (inline_call e1 e) \\{}\\\"\n using call D by(rule defass_inline_call)\n moreover have \"max_vars ?e2' \\ max_vars E + max_vars E'\" by(rule inline_call_max_vars1)\n with `final E'` length have \"max_vars ?e2' \\ length xs\" by(auto elim!: final.cases)\n ultimately have \"bisim_list1 (inline_call e1 e, es1') ((?e2', xs), exs')\"\n by(rule bisim_list1I) }\n ultimately show ?thesis using e1' `final e1` `final E'` ex2 \n apply(simp del: \\Move0.simps \\Move1.simps)\n apply(rule exI conjI impI|assumption)+\n apply(rule tranclp.r_into_trancl, simp)\n apply blast\n done\nqed\n\nlemma sim_move10_into_red0:\n assumes wwf: \"wwf_J_prog P\"\n and sim: \"sim_move10 P t ta e2 e2' e h empty ta' e' h' x'\"\n and fv: \"fv e = {}\"\n shows \"if \\move1 P h e2\n then (\\Red0t P t h (e, es) (e', es) \\ countInitBlock e2' < countInitBlock e2 \\ e' = e \\ x' = empty) \\ ta = \\ \\ h = h'\n else \\e'' ta'. \\Red0r P t h (e, es) (e'', es) \\\n (call1 e2 = None \\ call e = None \\ e'' = e) \\\n P,t \\0 \\e''/es,h\\ -ta'\\ \\e'/es,h'\\ \\\n \\ \\Move0 P h (e'', es) \\ ta_bisim01 ta' (extTA2J1 (compP1 P) ta)\"\nproof(cases \"\\move1 P h e2\")\n case True\n with sim have \"\\ final e2\"\n and red: \"\\red0t (extTA2J0 P) P t h (e, empty) (e', x') \\\n countInitBlock e2' < countInitBlock e2 \\ e' = e \\ x' = empty\"\n and [simp]: \"h' = h\" \"ta = \\\" \"ta' = \\\" by(simp_all add: sim_move10_def)\n from red have \"\\Red0t P t h (e, es) (e', es) \\\n countInitBlock e2' < countInitBlock e2 \\ e' = e \\ x' = empty\"\n proof\n assume red: \"\\red0t (extTA2J0 P) P t h (e, empty) (e', x')\"\n from \\red0t_fv_subset[OF wwf red] \\red0t_dom_lcl[OF wwf red] fv\n have \"dom x' \\ {}\" by(auto split: split_if_asm)\n hence \"x' = empty\" by auto\n with red have \"\\red0t (extTA2J0 P) P t h (e, empty) (e', empty)\" by simp\n with wwf have \"\\Red0t P t h (e, es) (e', es)\"\n using fv by(rule \\red0t_into_\\Red0t)\n thus ?thesis ..\n qed simp\n with True show ?thesis by simp\nnext\n case False\n with sim obtain e'' xs'' where \"\\ final e2\"\n and \\red: \"\\red0r (extTA2J0 P) P t h (e, empty) (e'', xs'')\"\n and red: \"extTA2J0 P,P,t \\ \\e'',(h, xs'')\\ -ta'\\ \\e',(h', x')\\\"\n and call: \"call1 e2 = None \\ call e = None \\ e'' = e\"\n and \"\\ \\move0 P h e''\" \"ta_bisim01 ta' (extTA2J1 (compP1 P) ta)\" \"no_call P h e''\"\n by(auto simp add: sim_move10_def split: split_if_asm)\n from \\red0r_fv_subset[OF wwf \\red] \\red0r_dom_lcl[OF wwf \\red] fv\n have \"dom xs'' \\ {}\" by(auto)\n hence \"xs'' = empty\" by(auto)\n with \\red have \"\\red0r (extTA2J0 P) P t h (e, empty) (e'', empty)\" by simp\n with wwf have \"\\Red0r P t h (e, es) (e'', es)\"\n using fv by(rule \\red0r_into_\\Red0r)\n moreover from red `xs'' = empty`\n have \"extTA2J0 P,P,t \\ \\e'',(h, empty)\\ -ta'\\ \\e',(h', x')\\\" by simp\n from red0Red[OF this] `no_call P h e''` \n have \"P,t \\0 \\e''/es,h\\ -ta'\\ \\e'/es,h'\\\" by(simp add: no_call_def)\n moreover from `\\ \\move0 P h e''` red\n have \"\\ \\Move0 P h (e'', es)\" by auto\n ultimately show ?thesis using False `ta_bisim01 ta' (extTA2J1 (compP1 P) ta)` call\n by(simp del: \\Move0.simps) blast\nqed\n\nlemma red0_simulates_Red1:\n assumes wf: \"wf_J_prog P\"\n and red: \"False,compP1 P,t \\1 \\ex2/exs2, h\\ -ta\\ \\ex2'/exs2', h'\\\"\n and bisiml: \"bisim_list1 (e, es) (ex2, exs2)\"\n shows \"\\e' es'. bisim_list1 (e', es') (ex2', exs2') \\\n (if \\Move1 P h (ex2, exs2)\n then (\\Red0t P t h (e, es) (e', es') \\ countInitBlock (fst ex2') < countInitBlock (fst ex2) \\ exs2' = exs2 \\ e' = e \\ es' = es) \\\n ta = \\ \\ h = h'\n else \\e'' es'' ta'. \\Red0r P t h (e, es) (e'', es'') \\\n (call1 (fst ex2) = None \\ call e = None \\ e'' = e \\ es'' = es) \\\n P,t \\0 \\e''/es'', h\\ -ta'\\ \\e'/es', h'\\ \\\n \\ \\Move0 P h (e'', es'') \\ ta_bisim01 ta' ta)\"\n (is \"\\e' es' . _ \\ ?red e' es'\")\nusing red\nproof(cases)\n case (red1Red E xs TA E' xs')\n note red = `False,compP1 P,t \\1 \\E,(h, xs)\\ -TA\\ \\E',(h', xs')\\`\n and ex2 = `ex2 = (E, xs)`\n and ex2' = `ex2' = (E', xs')`\n and [simp] = `ta = extTA2J1 (compP1 P) TA` `exs2' = exs2`\n from bisiml ex2 have bisim: \"bisim [] e E xs\" and fv: \"fv e = {}\"\n and length: \"max_vars E \\ length xs\" and bsl: \"bisim_list es exs2\"\n and D: \"\\ e \\{}\\\" by(auto elim: bisim_list1_elim)\n from red_simulates_red1_aux[OF wf red, simplified, OF bisim, of empty] fv length D\n obtain TA' e2' x' where red': \"sim_move10 P t TA E E' e h empty TA' e2' h' x'\"\n and bisim'': \"bisim [] e2' E' xs'\" and lcl': \"x' \\\\<^sub>m empty\" by auto\n from red have \"\\ final E\" by auto\n with sim_move10_into_red0[OF wf_prog_wwf_prog[OF wf] red', of es] fv ex2 ex2'\n have red'': \"?red e2' es\" by fastforce\n moreover {\n note bsl bisim''\n moreover from red' fv have \"fv e2' = {}\"\n by(fastforce simp add: sim_move10_def split: split_if_asm dest: \\red0r_fv_subset[OF wf_prog_wwf_prog[OF wf]] \\red0t_fv_subset[OF wf_prog_wwf_prog[OF wf]] red_fv_subset[OF wf_prog_wwf_prog[OF wf]])\n moreover from red' have \"dom x' \\ dom (empty) \\ fv e\"\n unfolding sim_move10_def\n apply(auto split: split_if_asm del: subsetI dest: \\red0r_dom_lcl[OF wf_prog_wwf_prog[OF wf]] \\red0t_dom_lcl[OF wf_prog_wwf_prog[OF wf]])\n apply(frule_tac [1-2] \\red0r_fv_subset[OF wf_prog_wwf_prog[OF wf]])\n apply(auto dest!: \\red0r_dom_lcl[OF wf_prog_wwf_prog[OF wf]] red_dom_lcl del: subsetI, blast+)\n done\n with fv have \"dom x' \\ {}\" by(auto)\n hence \"x' = empty\" by(auto)\n with D red' have \"\\ e2' \\{}\\\"\n by(auto dest!: sim_move10_preserves_defass[OF wf] split: split_if_asm)\n moreover from red have \"length xs' = length xs\" by(auto dest: red1_preserves_len)\n with red1_max_vars[OF red] length\n have \"max_vars E' \\ length xs'\" by simp\n ultimately have \"bisim_list1 (e2', es) ((E', xs'), exs2)\"\n by(rule bisim_list1I) }\n ultimately show ?thesis using ex2'\n by(clarsimp split: split_if_asm)(rule exI conjI|assumption|simp)+\nnext\n case (red1Call E a M vs U Ts T body D xs)\n note [simp] = `ex2 = (E, xs)` `h' = h` `ta = \\`\n and ex2' = `ex2' = (blocks1 0 (Class D#Ts) body, Addr a # vs @ replicate (max_vars body) undefined_value)`\n and exs' = `exs2' = (E, xs) # exs2`\n and call = `call1 E = \\(a, M, vs)\\` and ha = `typeof_addr h a = \\U\\`\n and sees = `compP1 P \\ class_type_of U sees M: Ts\\T = \\body\\ in D`\n and len = `length vs = length Ts`\n let ?e2' = \"blocks1 0 (Class D#Ts) body\"\n let ?xs2' = \"Addr a # vs @ replicate (max_vars body) undefined_value\"\n from bisiml have bisim: \"bisim [] e E xs\" and fv: \"fv e = {}\"\n and length: \"max_vars E \\ length xs\" and bsl: \"bisim_list es exs2\"\n and D: \"\\ e \\{}\\\" by(auto elim: bisim_list1_elim)\n\n from bisim `call1 E = \\(a, M, vs)\\`\n have \"call e = \\(a, M, vs)\\\" by(rule bisim_call1_Some_call)\n moreover note ha\n moreover from `compP1 P \\ class_type_of U sees M: Ts\\T = \\body\\ in D`\n obtain pns Jbody where sees': \"P \\ class_type_of U sees M: Ts\\T = \\(pns, Jbody)\\ in D\"\n and body: \"body = compE1 (this # pns) Jbody\"\n by(auto dest: sees_method_compPD)\n let ?e' = \"blocks (this # pns) (Class D # Ts) (Addr a # vs) Jbody\"\n note sees' moreover from wf sees' have \"length Ts = length pns\"\n by(auto dest!: sees_wf_mdecl simp add: wf_mdecl_def)\n with len have \"length vs = length pns\" \"length Ts = length pns\" by simp_all\n ultimately have red': \"P,t \\0 \\e/es, h\\ -\\\\ \\?e'/e#es, h\\\" by(rule red0Call)\n moreover from `call e = \\(a, M, vs)\\` ha sees'\n have \"\\Move0 P h (e, es)\"\n by(fastforce simp add: synthesized_call_def dest: \\move0_callD[where P=P and h=h] sees_method_fun)\n ultimately have \"\\Red0t P t h (e, es) (?e', e#es)\" by auto\n moreover\n from bsl bisim fv D length `call e = \\(a, M, vs)\\` `call1 E = \\(a, M, vs)\\`\n have \"bisim_list (e # es) ((E, xs) # exs2)\" by(rule bisim_list.intros)\n hence \"bisim_list1 (?e', e # es) (ex2', (E, xs) # exs2)\" unfolding ex2'\n proof(rule bisim_list1I)\n from wf_prog_wwf_prog[OF wf] sees'\n have \"wf_mdecl wwf_J_mdecl P D (M,Ts,T,\\(pns,Jbody)\\)\" by(rule sees_wf_mdecl)\n hence \"fv Jbody \\ set pns \\ {this}\" by(auto simp add: wf_mdecl_def)\n moreover from sees' have \"\\ contains_insync Jbody\"\n by(auto dest!: sees_wf_mdecl[OF wf] WT_expr_locks simp add: wf_mdecl_def contains_insync_conv)\n ultimately have \"bisim ([] @ this # pns) Jbody (compE1 ([] @ this # pns) Jbody) ?xs2'\"\n by -(rule compE1_bisim, auto)\n with `length vs = length Ts` `length Ts = length pns` body\n have \"bisim [] ?e' (blocks1 (length ([] :: vname list)) (Class D # Ts) body) ?xs2'\"\n by -(rule blocks_bisim, auto simp add: nth_append nth_Cons')\n thus \"bisim [] ?e' ?e2' ?xs2'\" by simp\n from `length vs = length Ts` `length Ts = length pns` `fv Jbody \\ set pns \\ {this}`\n show \"fv ?e' = {}\" by auto\n from wf sees'\n have \"wf_mdecl wf_J_mdecl P D (M,Ts,T,\\(pns,Jbody)\\)\" by(rule sees_wf_mdecl)\n hence \"\\ Jbody \\set pns \\ {this}\\\" by(auto simp add: wf_mdecl_def)\n with `length vs = length Ts` `length Ts = length pns`\n have \"\\ (blocks pns Ts vs Jbody) \\dom [this \\ Addr a]\\\" by(auto)\n thus \"\\ ?e' \\{}\\\" by simp\n from len show \"max_vars ?e2' \\ length ?xs2'\" by(simp add: blocks1_max_vars)\n qed\n moreover have \"\\Move1 P h (ex2, exs2)\" using ha `call1 E = \\(a, M, vs)\\` sees'\n by(auto simp add: synthesized_call_def \\external'_def dest!: \\move1_not_call1[where P=P and h=h] dest: sees_method_fun)\n ultimately show ?thesis using exs'\n by(simp del: \\Move1.simps \\Move0.simps)(rule exI conjI rtranclp.rtrancl_refl|assumption)+\nnext\n case (red1Return E' x' E x)\n note [simp] = `h' = h` `ta = \\`\n and ex2 = `ex2 = (E', x')` and exs2 = `exs2 = (E, x) # exs2'`\n and ex2' = `ex2' = (inline_call E' E, x)`\n and fin = `final E'`\n from bisiml ex2 exs2 obtain e' es' aMvs where es: \"es = e' # es'\"\n and bsl: \"bisim_list es' exs2'\"\n and bisim: \"bisim [] e E' x'\"\n and bisim': \"bisim [] e' E x\"\n and fv: \"fv e' = {}\"\n and length: \"max_vars E \\ length x\"\n and D: \"\\ e' \\{}\\\"\n and call: \"call e' = \\aMvs\\\"\n and call1: \"call1 E = \\aMvs\\\"\n by(fastforce elim!: bisim_list1_elim)\n \n from `final E'` bisim have fin': \"final e\" by(auto)\n hence \"P,t \\0 \\e/e' # es',h\\ -\\\\ \\inline_call e e'/es',h\\\" by(rule red0Return)\n moreover from bisim fin' bisim' call\n have \"bisim [] (inline_call e e') (inline_call E' E) x\"\n by(rule bisim_inline_call)(simp add: fv)\n with bsl have \"bisim_list1 (inline_call e e', es') (ex2', exs2')\" unfolding ex2'\n proof(rule bisim_list1I)\n from fin' fv_inline_call[of e e'] fv show \"fv (inline_call e e') = {}\" by auto\n from fin' show \"\\ (inline_call e e') \\{}\\\" using call D by(rule defass_inline_call)\n \n from call1_imp_call[OF call1]\n have \"max_vars (inline_call E' E) \\ max_vars E + max_vars E'\"\n by(rule inline_call_max_vars)\n with fin length show \"max_vars (inline_call E' E) \\ length x\" by(auto elim!: final.cases)\n qed\n moreover have \"\\Move1 P h (ex2, exs2) = \\Move0 P h (e, es)\" using ex2 call1 call fin fin' by(auto)\n ultimately show ?thesis using es\n by(simp del: \\Move1.simps \\Move0.simps) blast\nqed\n\nend\n\nsublocale J0_J1_heap_base < red0_Red1'!: FWdelay_bisimulation_base\n final_expr0\n \"mred0 P\"\n final_expr1\n \"mred1' (compP1 P)\"\n convert_RA\n \"\\t. bisim_red0_Red1\" \n bisim_wait01\n \"\\MOVE0 P\"\n \"\\MOVE1 (compP1 P)\"\n for P\n.\n\ncontext J0_J1_heap_base begin\n\nlemma delay_bisimulation_red0_Red1: \n assumes wf: \"wf_J_prog P\"\n shows \"delay_bisimulation_measure (mred0 P t) (mred1' (compP1 P) t) bisim_red0_Red1 (ta_bisim (\\t. bisim_red0_Red1)) (\\MOVE0 P) (\\MOVE1 (compP1 P)) (\\es es'. False) (\\(((e', xs'), exs'), h') (((e, xs), exs), h). countInitBlock e'< countInitBlock e)\"\n (is \"delay_bisimulation_measure _ _ _ _ _ _ ?\\1 ?\\2\")\nproof(unfold_locales)\n fix s1 s2 s1'\n assume \"bisim_red0_Red1 s1 s2\" \"red0_mthr.silent_move P t s1 s1'\"\n moreover obtain ex1 exs1 h1 where s1: \"s1 = ((ex1, exs1), h1)\" by(cases s1, auto)\n moreover obtain ex1' exs1' h1' where s1': \"s1' = ((ex1', exs1'), h1')\" by(cases s1', auto)\n moreover obtain ex2 exs2 h2 where s2: \"s2 = ((ex2, exs2), h2)\" by(cases s2, auto)\n ultimately have bisim: \"bisim_list1 (ex1, exs1) (ex2, exs2)\"\n and heap: \"h1 = h2\"\n and red: \"P,t \\0 \\ex1/exs1,h1\\ -\\\\ \\ex1'/exs1',h1'\\\"\n and \\: \"\\Move0 P h1 (ex1, exs1)\"\n by(auto simp add: bisim_red0_Red1_def red0_mthr.silent_move_iff)\n from Red1_simulates_red0[OF wf red bisim] \\\n obtain ex2'' exs2'' where bisim': \"bisim_list1 (ex1', exs1') (ex2'', exs2'')\" \n and red': \"\\Red1't (compP1 P) t h1 (ex2, exs2) (ex2'', exs2'')\"\n and [simp]: \"h1' = h1\" by auto\n from \\Red1't_into_Red1'_\\mthr_silent_movet[OF red'] bisim' heap\n have \"\\s2'. Red1_mthr.silent_movet False (compP1 P) t s2 s2' \\ bisim_red0_Red1 s1' s2'\"\n unfolding s2 s1' by(auto simp add: bisim_red0_Red1_def)\n thus \"bisim_red0_Red1 s1' s2 \\ ?\\1^++ s1' s1 \\ (\\s2'. Red1_mthr.silent_movet False (compP1 P) t s2 s2' \\ bisim_red0_Red1 s1' s2')\" ..\nnext\n fix s1 s2 s2'\n assume \"bisim_red0_Red1 s1 s2\" \"Red1_mthr.silent_move False (compP1 P) t s2 s2'\"\n moreover obtain ex1 exs1 h1 where s1: \"s1 = ((ex1, exs1), h1)\" by(cases s1, auto)\n moreover obtain ex2 exs2 h2 where s2: \"s2 = ((ex2, exs2), h2)\" by(cases s2, auto)\n moreover obtain ex2' exs2' h2' where s2': \"s2' = ((ex2', exs2'), h2')\" by(cases s2', auto)\n ultimately have bisim: \"bisim_list1 (ex1, exs1) (ex2, exs2)\"\n and heap: \"h1 = h2\"\n and red: \"False,compP1 P,t \\1 \\ex2/exs2,h2\\ -\\\\ \\ex2'/exs2',h2'\\\"\n and \\: \"\\Move1 P h2 (ex2, exs2)\"\n by(fastforce simp add: bisim_red0_Red1_def Red1_mthr.silent_move_iff)+\n from red0_simulates_Red1[OF wf red bisim] \\\n obtain e' es' where bisim': \"bisim_list1 (e', es') (ex2', exs2')\"\n and red': \"\\Red0t P t h2 (ex1, exs1) (e', es') \\ \n countInitBlock (fst ex2') < countInitBlock (fst ex2) \\ exs2' = exs2 \\ e' = ex1 \\ es' = exs1\"\n and [simp]: \"h2' = h2\" by auto\n from red'\n show \"bisim_red0_Red1 s1 s2' \\ ?\\2^++ s2' s2 \\ (\\s1'. red0_mthr.silent_movet P t s1 s1' \\ bisim_red0_Red1 s1' s2')\"\n (is \"?refl \\ ?step\")\n proof\n assume \"\\Red0t P t h2 (ex1, exs1) (e', es')\"\n from \\Red0t_into_red0_\\mthr_silent_movet[OF this] bisim' heap\n have ?step unfolding s1 s2' by(auto simp add: bisim_red0_Red1_def)\n thus ?thesis ..\n next\n assume \"countInitBlock (fst ex2') < countInitBlock (fst ex2) \\ exs2' = exs2 \\ e' = ex1 \\ es' = exs1\"\n hence ?refl using bisim' heap unfolding s1 s2' s2\n by (auto simp add: bisim_red0_Red1_def split_beta)\n thus ?thesis ..\n qed\nnext\n fix s1 s2 ta1 s1'\n assume \"bisim_red0_Red1 s1 s2\" and \"mred0 P t s1 ta1 s1'\" and \\: \"\\ \\MOVE0 P s1 ta1 s1'\"\n moreover obtain ex1 exs1 h1 where s1: \"s1 = ((ex1, exs1), h1)\" by(cases s1, auto)\n moreover obtain ex1' exs1' h1' where s1': \"s1' = ((ex1', exs1'), h1')\" by(cases s1', auto)\n moreover obtain ex2 exs2 h2 where s2: \"s2 = ((ex2, exs2), h2)\" by(cases s2, auto)\n ultimately have heap: \"h2 = h1\"\n and bisim: \"bisim_list1 (ex1, exs1) (ex2, exs2)\"\n and red: \"P,t \\0 \\ex1/exs1,h1\\ -ta1\\ \\ex1'/exs1',h1'\\\"\n by(auto simp add: bisim_red0_Red1_def)\n from \\ have \"\\ \\Move0 P h1 (ex1, exs1)\" unfolding s1\n using red by(auto elim!: red0.cases dest: red_\\_taD[where extTA=\"extTA2J0 P\", OF extTA2J0_\\])\n with Red1_simulates_red0[OF wf red bisim]\n obtain ex2'' exs2'' ex2' exs2' ta'\n where bisim': \"bisim_list1 (ex1', exs1') (ex2'', exs2'')\"\n and red': \"\\Red1'r (compP1 P) t h1 (ex2, exs2) (ex2', exs2')\"\n and red'': \"False,compP1 P,t \\1 \\ex2'/exs2',h1\\ -ta'\\ \\ex2''/exs2'',h1'\\\"\n and \\': \"\\ \\Move1 P h1 (ex2', exs2')\"\n and ta: \"ta_bisim01 ta1 ta'\" by fastforce\n from red'' have \"mred1' (compP1 P) t ((ex2', exs2'), h1) ta' ((ex2'', exs2''), h1')\" by auto\n moreover from \\' have \"\\ \\MOVE1 (compP1 P) ((ex2', exs2'), h1) ta' ((ex2'', exs2''), h1')\" by simp\n moreover from red' have \"Red1_mthr.silent_moves False (compP1 P) t s2 ((ex2', exs2'), h1)\"\n unfolding s2 heap by(rule \\Red1'r_into_Red1'_\\mthr_silent_moves)\n moreover from bisim' have \"bisim_red0_Red1 ((ex1', exs1'), h1') ((ex2'', exs2''), h1')\"\n by(auto simp add: bisim_red0_Red1_def)\n ultimately\n show \"\\s2' s2'' ta2. Red1_mthr.silent_moves False (compP1 P) t s2 s2' \\ mred1' (compP1 P) t s2' ta2 s2'' \\\n \\ \\MOVE1 (compP1 P) s2' ta2 s2'' \\ bisim_red0_Red1 s1' s2'' \\ ta_bisim01 ta1 ta2\"\n using ta unfolding s1' by blast\nnext\n fix s1 s2 ta2 s2'\n assume \"bisim_red0_Red1 s1 s2\" and \"mred1' (compP1 P) t s2 ta2 s2'\" and \\: \"\\ \\MOVE1 (compP1 P) s2 ta2 s2'\"\n moreover obtain ex1 exs1 h1 where s1: \"s1 = ((ex1, exs1), h1)\" by(cases s1, auto)\n moreover obtain ex2 exs2 h2 where s2: \"s2 = ((ex2, exs2), h2)\" by(cases s2, auto)\n moreover obtain ex2' exs2' h2' where s2': \"s2' = ((ex2', exs2'), h2')\" by(cases s2', auto)\n ultimately have heap: \"h2 = h1\"\n and bisim: \"bisim_list1 (ex1, exs1) (ex2, exs2)\"\n and red: \"False,compP1 P,t \\1 \\ex2/exs2,h1\\ -ta2\\ \\ex2'/exs2',h2'\\\"\n by(auto simp add: bisim_red0_Red1_def)\n from \\ heap have \"\\ \\Move1 P h2 (ex2, exs2)\" unfolding s2\n using red by(fastforce elim!: Red1.cases dest: red1_\\_taD)\n with red0_simulates_Red1[OF wf red bisim]\n obtain e' es' e'' es'' ta'\n where bisim': \"bisim_list1 (e', es') (ex2', exs2')\"\n and red': \"\\Red0r P t h1 (ex1, exs1) (e'', es'')\"\n and red'': \"P,t \\0 \\e''/es'',h1\\ -ta'\\ \\e'/es',h2'\\\"\n and \\': \"\\ \\Move0 P h1 (e'', es'')\"\n and ta: \"ta_bisim01 ta' ta2\" using heap by fastforce\n from red'' have \"mred0 P t ((e'', es''), h1) ta' ((e', es'), h2')\" by auto\n moreover from red' have \"red0_mthr.silent_moves P t ((ex1, exs1), h1) ((e'', es''), h1)\"\n by(rule \\Red0r_into_red0_\\mthr_silent_moves)\n moreover from \\' have \"\\ \\MOVE0 P ((e'', es''), h1) ta' ((e', es'), h2')\" by simp\n moreover from bisim' have \"bisim_red0_Red1 ((e', es'), h2') ((ex2', exs2'), h2')\"\n by(auto simp add: bisim_red0_Red1_def)\n ultimately\n show \"\\s1' s1'' ta1. red0_mthr.silent_moves P t s1 s1' \\\n mred0 P t s1' ta1 s1'' \\ \\ \\MOVE0 P s1' ta1 s1'' \\\n bisim_red0_Red1 s1'' s2' \\ ta_bisim01 ta1 ta2\"\n using ta unfolding s1 s2' by blast\nnext\n show \"wfP ?\\1\" by auto\nnext\n have \"wf (measure countInitBlock)\" ..\n hence \"wf (inv_image (measure countInitBlock) (\\(((e', xs'), exs'), h'). e'))\" ..\n also have \"inv_image (measure countInitBlock) (\\(((e', xs'), exs'), h'). e') = {(s2', s2). ?\\2 s2' s2}\"\n by(simp add: inv_image_def split_beta)\n finally show \"wfP ?\\2\" by(simp add: wfP_def)\nqed\n\nlemma delay_bisimulation_diverge_red0_Red1: \n assumes \"wf_J_prog P\"\n shows \"delay_bisimulation_diverge (mred0 P t) (mred1' (compP1 P) t) bisim_red0_Red1 (ta_bisim (\\t. bisim_red0_Red1)) (\\MOVE0 P) (\\MOVE1 (compP1 P))\"\nproof -\n interpret delay_bisimulation_measure\n \"mred0 P t\" \"mred1' (compP1 P) t\" \"bisim_red0_Red1\" \"ta_bisim (\\t. bisim_red0_Red1)\" \"\\MOVE0 P\" \"\\MOVE1 (compP1 P)\"\n \"\\es es'. False\" \"\\(((e', xs'), exs'), h') (((e, xs), exs), h). countInitBlock e'< countInitBlock e\"\n using assms by(rule delay_bisimulation_red0_Red1)\n show ?thesis by unfold_locales\nqed\n\nlemma red0_Red1'_FWweak_bisim:\n assumes wf: \"wf_J_prog P\"\n shows \"FWdelay_bisimulation_diverge final_expr0 (mred0 P) final_expr1 (mred1' (compP1 P))\n (\\t. bisim_red0_Red1) bisim_wait01 (\\MOVE0 P) (\\MOVE1 (compP1 P))\"\nproof -\n interpret delay_bisimulation_diverge\n \"mred0 P t\"\n \"mred1' (compP1 P) t\" \n bisim_red0_Red1 \n \"ta_bisim (\\t. bisim_red0_Red1)\" \"\\MOVE0 P\" \"\\MOVE1 (compP1 P)\"\n for t\n using wf by(rule delay_bisimulation_diverge_red0_Red1)\n show ?thesis\n proof\n fix t and s1 and s2 :: \"(('addr expr1 \\ 'addr locals1) \\ ('addr expr1 \\ 'addr locals1) list) \\ 'heap\"\n assume \"bisim_red0_Red1 s1 s2\" \"(\\(x1, m). final_expr0 x1) s1\"\n moreover hence \"(\\(x2, m). final_expr1 x2) s2\"\n by(cases s1)(cases s2,auto simp add: bisim_red0_Red1_def final_iff elim!: bisim_list1_elim elim: bisim_list.cases)\n ultimately show \"\\s2'. Red1_mthr.silent_moves False (compP1 P) t s2 s2' \\ bisim_red0_Red1 s1 s2' \\ (\\(x2, m). final_expr1 x2) s2'\"\n by blast\n next\n fix t s1 and s2 :: \"(('addr expr1 \\ 'addr locals1) \\ ('addr expr1 \\ 'addr locals1) list) \\ 'heap\"\n assume \"bisim_red0_Red1 s1 s2\" \"(\\(x2, m). final_expr1 x2) s2\"\n moreover hence \"(\\(x1, m). final_expr0 x1) s1\"\n by(cases s1)(cases s2,auto simp add: bisim_red0_Red1_def final_iff elim!: bisim_list1_elim elim: bisim_list.cases)\n ultimately show \"\\s1'. red0_mthr.silent_moves P t s1 s1' \\ bisim_red0_Red1 s1' s2 \\ (\\(x1, m). final_expr0 x1) s1'\"\n by blast\n next\n fix t' x m1 x' m2 t x1 x2 x1' ta1 x1'' m1' x2' ta2 x2'' m2'\n assume b: \"bisim_red0_Red1 (x, m1) (x', m2)\"\n and bo: \"bisim_red0_Red1 (x1, m1) (x2, m2)\"\n and \\red1: \"red0_mthr.silent_moves P t (x1, m1) (x1', m1)\"\n and red1: \"mred0 P t (x1', m1) ta1 (x1'', m1')\"\n and \\1: \"\\ \\MOVE0 P (x1', m1) ta1 (x1'', m1')\"\n and \\red2: \"Red1_mthr.silent_moves False (compP1 P) t (x2, m2) (x2', m2)\"\n and red2: \"mred1' (compP1 P) t (x2', m2) ta2 (x2'', m2')\"\n and bo': \"bisim_red0_Red1 (x1'', m1') (x2'', m2')\"\n and tb: \"ta_bisim (\\t. bisim_red0_Red1) ta1 ta2\"\n from b have \"m1 = m2\" by(auto simp add: bisim_red0_Red1_def split_beta)\n moreover from bo' have \"m1' = m2'\" by(auto simp add: bisim_red0_Red1_def split_beta)\n ultimately show \"bisim_red0_Red1 (x, m1') (x', m2')\" using b\n by(auto simp add: bisim_red0_Red1_def split_beta)\n next\n fix t x1 m1 x2 m2 x1' ta1 x1'' m1' x2' ta2 x2'' m2' w\n assume \"bisim_red0_Red1 (x1, m1) (x2, m2)\"\n and \"red0_mthr.silent_moves P t (x1, m1) (x1', m1)\"\n and red0: \"mred0 P t (x1', m1) ta1 (x1'', m1')\"\n and \"\\ \\MOVE0 P (x1', m1) ta1 (x1'', m1')\"\n and \"Red1_mthr.silent_moves False (compP1 P) t (x2, m2) (x2', m2)\"\n and red1: \"mred1' (compP1 P) t (x2', m2) ta2 (x2'', m2')\"\n and \"\\ \\MOVE1 (compP1 P) (x2', m2) ta2 (x2'', m2')\"\n and \"bisim_red0_Red1 (x1'', m1') (x2'', m2')\"\n and \"ta_bisim01 ta1 ta2\"\n and Suspend: \"Suspend w \\ set \\ta1\\\\<^bsub>w\\<^esub>\" \"Suspend w \\ set \\ta2\\\\<^bsub>w\\<^esub>\"\n from red0 red1 Suspend show \"bisim_wait01 x1'' x2''\"\n by(cases x2')(cases x2'', auto dest: Red_Suspend_is_call Red1_Suspend_is_call simp add: split_beta bisim_wait01_def is_call_def)\n next\n fix t x1 m1 x2 m2 ta1 x1' m1'\n assume \"bisim_red0_Red1 (x1, m1) (x2, m2)\"\n and \"bisim_wait01 x1 x2\"\n and \"mred0 P t (x1, m1) ta1 (x1', m1')\"\n and wakeup: \"Notified \\ set \\ta1\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta1\\\\<^bsub>w\\<^esub>\"\n moreover obtain e0 es0 where [simp]: \"x1 = (e0, es0)\" by(cases x1)\n moreover obtain e0' es0' where [simp]: \"x1' = (e0', es0')\" by(cases x1')\n moreover obtain e1 xs1 exs1 where [simp]: \"x2 = ((e1, xs1), exs1)\" by(cases x2) auto\n ultimately have bisim: \"bisim_list1 (e0, es0) ((e1, xs1), exs1)\"\n and m1: \"m2 = m1\"\n and call: \"call e0 \\ None\" \"call1 e1 \\ None\"\n and red: \"P,t \\0 \\e0/es0, m1\\ -ta1\\ \\e0'/es0', m1'\\\"\n by(auto simp add: bisim_wait01_def bisim_red0_Red1_def)\n from red wakeup have \"\\ \\Move0 P m1 (e0, es0)\"\n by(auto elim!: red0.cases dest: red_\\_taD[where extTA=\"extTA2J0 P\", simplified])\n with Red1_simulates_red0[OF wf red bisim] call m1\n show \"\\ta2 x2' m2'. mred1' (compP1 P) t (x2, m2) ta2 (x2', m2') \\ bisim_red0_Red1 (x1', m1') (x2', m2') \\ ta_bisim01 ta1 ta2\"\n by(auto simp add: bisim_red0_Red1_def)\n next\n fix t x1 m1 x2 m2 ta2 x2' m2'\n assume \"bisim_red0_Red1 (x1, m1) (x2, m2)\"\n and \"bisim_wait01 x1 x2\" \n and \"mred1' (compP1 P) t (x2, m2) ta2 (x2', m2')\"\n and wakeup: \"Notified \\ set \\ta2\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta2\\\\<^bsub>w\\<^esub>\"\n moreover obtain e0 es0 where [simp]: \"x1 = (e0, es0)\" by(cases x1)\n moreover obtain e1 xs1 exs1 where [simp]: \"x2 = ((e1, xs1), exs1)\" by(cases x2) auto\n moreover obtain e1' xs1' exs1' where [simp]: \"x2' = ((e1', xs1'), exs1')\" by(cases x2') auto\n ultimately have bisim: \"bisim_list1 (e0, es0) ((e1, xs1), exs1)\"\n and m1: \"m2 = m1\"\n and call: \"call e0 \\ None\" \"call1 e1 \\ None\"\n and red: \"False,compP1 P,t \\1 \\(e1, xs1)/exs1, m1\\ -ta2\\ \\(e1', xs1')/exs1', m2'\\\"\n by(auto simp add: bisim_wait01_def bisim_red0_Red1_def)\n from red wakeup have \"\\ \\Move1 P m1 ((e1, xs1), exs1)\"\n by(auto elim!: Red1.cases dest: red1_\\_taD)\n with red0_simulates_Red1[OF wf red bisim] m1 call\n show \"\\ta1 x1' m1'. mred0 P t (x1, m1) ta1 (x1', m1') \\ bisim_red0_Red1 (x1', m1') (x2', m2') \\ ta_bisim01 ta1 ta2\"\n by(auto simp add: bisim_red0_Red1_def)\n next\n show \"(\\x. final_expr0 x) \\ (\\x. final_expr1 x)\"\n by(auto simp add: split_paired_Ex final_iff)\n qed\nqed\n\nlemma bisim_J0_J1_start:\n assumes wf: \"wf_J_prog P\"\n and start: \"wf_start_state P C M vs\"\n shows \"red0_Red1'.mbisim (J0_start_state P C M vs) (J1_start_state (compP1 P) C M vs)\"\nproof -\n from start obtain Ts T pns body D\n where sees: \"P \\ C sees M:Ts\\T=\\(pns,body)\\ in D\"\n and conf: \"P,start_heap \\ vs [:\\] Ts\"\n by cases auto\n from conf have vs: \"length vs = length Ts\" by(rule list_all2_lengthD)\n from sees_wf_mdecl[OF wf_prog_wwf_prog[OF wf] sees]\n have fvbody: \"fv body \\ {this} \\ set pns\" and len: \"length pns = length Ts\"\n by(auto simp add: wf_mdecl_def)\n with vs have fv: \"fv (blocks pns Ts vs body) \\ {this}\" by auto\n have wfCM: \"wf_J_mdecl P D (M, Ts, T, pns, body)\"\n using sees_wf_mdecl[OF wf sees] by(auto simp add: wf_mdecl_def)\n then obtain T' where wtbody: \"P,[this # pns [\\] Class D # Ts] \\ body :: T'\" by auto\n hence elbody: \"expr_locks body = (\\l. 0)\" by(rule WT_expr_locks)\n hence cisbody: \"\\ contains_insync body\" by(auto simp add: contains_insync_conv)\n from wfCM len vs have dabody: \"\\ (blocks pns Ts vs body) \\{this}\\\" by auto\n from sees have sees1: \"compP1 P \\ C sees M:Ts\\T = \\compE1 (this # pns) body\\ in D\"\n by(auto dest: sees_method_compP[where f=\"(\\C M Ts T (pns, body). compE1 (this # pns) body)\"])\n\n let ?e = \"blocks1 0 (Class C#Ts) (compE1 (this # pns) body)\"\n let ?xs = \"Null # vs @ replicate (max_vars body) undefined_value\"\n from fvbody cisbody len vs\n have \"bisim [] (blocks (this # pns) (Class D # Ts) (Null # vs) body) (blocks1 (length ([] :: vname list)) (Class D # Ts) (compE1 (this # pns) body)) ?xs\"\n by-(rule blocks_bisim,(fastforce simp add: nth_Cons' nth_append)+)\n with fv dabody len vs elbody sees sees1\n show ?thesis unfolding start_state_def\n by(auto intro!: red0_Red1'.mbisimI split: split_if_asm)(auto simp add: bisim_red0_Red1_def blocks1_max_vars intro!: bisim_list.intros bisim_list1I wset_thread_okI)\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Compiler/Correctness1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621764862150636, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.250466228513578}} {"text": "(* Title: Jinja/J/WellForm.thy\n\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Generic Well-formedness of programs} *}\n\ntheory WellForm imports TypeRel SystemClasses begin\n\ntext {*\\noindent This theory defines global well-formedness conditions\nfor programs but does not look inside method bodies. Hence it works\nfor both Jinja and JVM programs. Well-typing of expressions is defined\nelsewhere (in theory @{text WellType}).\n\nBecause Jinja does not have method overloading, its policy for method\noverriding is the classical one: \\emph{covariant in the result type\nbut contravariant in the argument types.} This means the result type\nof the overriding method becomes more specific, the argument types\nbecome more general.\n*}\n\ntype_synonym 'm wf_mdecl_test = \"'m prog \\ cname \\ 'm mdecl \\ bool\"\n\ndefinition wf_fdecl :: \"'m prog \\ fdecl \\ bool\"\nwhere\n \"wf_fdecl P \\ \\(F,T). is_type P T\"\n\ndefinition wf_mdecl :: \"'m wf_mdecl_test \\ 'm wf_mdecl_test\"\nwhere\n \"wf_mdecl wf_md P C \\ \\(M,Ts,T,mb).\n (\\T\\set Ts. is_type P T) \\ is_type P T \\ wf_md P C (M,Ts,T,mb)\"\n\ndefinition wf_cdecl :: \"'m wf_mdecl_test \\ 'm prog \\ 'm cdecl \\ bool\"\nwhere\n \"wf_cdecl wf_md P \\ \\(C,(D,fs,ms)).\n (\\f\\set fs. wf_fdecl P f) \\ distinct_fst fs \\\n (\\m\\set ms. wf_mdecl wf_md P C m) \\ distinct_fst ms \\\n (C \\ Object \\\n is_class P D \\ \\ P \\ D \\\\<^sup>* C \\\n (\\(M,Ts,T,m)\\set ms.\n \\D' Ts' T' m'. P \\ D sees M:Ts' \\ T' = m' in D' \\\n P \\ Ts' [\\] Ts \\ P \\ T \\ T'))\"\n\ndefinition wf_syscls :: \"'m prog \\ bool\"\nwhere\n \"wf_syscls P \\ {Object} \\ sys_xcpts \\ set(map fst P)\"\n\ndefinition wf_prog :: \"'m wf_mdecl_test \\ 'm prog \\ bool\"\nwhere\n \"wf_prog wf_md P \\ wf_syscls P \\ (\\c \\ set P. wf_cdecl wf_md P c) \\ distinct_fst P\"\n\n\nsubsection{* Well-formedness lemmas *}\n\nlemma class_wf: \n \"\\class P C = Some c; wf_prog wf_md P\\ \\ wf_cdecl wf_md P (C,c)\"\n(*<*)\napply (unfold wf_prog_def class_def)\napply (fast dest: map_of_SomeD)\ndone\n(*>*)\n\n\nlemma class_Object [simp]: \n \"wf_prog wf_md P \\ \\C fs ms. class P Object = Some (C,fs,ms)\"\n(*<*)\napply (unfold wf_prog_def wf_syscls_def class_def)\napply (auto simp: map_of_SomeI)\ndone\n(*>*)\n\n\nlemma is_class_Object [simp]:\n \"wf_prog wf_md P \\ is_class P Object\"\n(*<*)by (simp add: is_class_def)(*>*)\n(* Unused\nlemma is_class_supclass:\nassumes wf: \"wf_prog wf_md P\" and sub: \"P \\ C \\\\<^sup>* D\"\nshows \"is_class P C \\ is_class P D\"\nusing sub apply(induct)\n apply assumption\napply(fastforce simp:wf_cdecl_def subcls1_def is_class_def\n dest:class_wf[OF _ wf])\ndone\n\nThis is NOT true because P \\ NT \\ Class C for any Class C\nlemma is_type_suptype: \"\\ wf_prog p P; is_type P T; P \\ T \\ T' \\\n \\ is_type P T'\"\n*)\n\nlemma is_class_xcpt:\n \"\\ C \\ sys_xcpts; wf_prog wf_md P \\ \\ is_class P C\"\n(*<*)\n apply (simp add: wf_prog_def wf_syscls_def is_class_def class_def)\n apply (fastforce intro!: map_of_SomeI)\n done\n(*>*)\n\n\nlemma subcls1_wfD:\n \"\\ P \\ C \\\\<^sup>1 D; wf_prog wf_md P \\ \\ D \\ C \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n(*<*)\napply( frule r_into_trancl)\napply( drule subcls1D)\napply(clarify)\napply( drule (1) class_wf)\napply( unfold wf_cdecl_def)\napply(force simp add: reflcl_trancl [THEN sym] simp del: reflcl_trancl)\ndone\n(*>*)\n\n\nlemma wf_cdecl_supD: \n \"\\wf_cdecl wf_md P (C,D,r); C \\ Object\\ \\ is_class P D\"\n(*<*)by (auto simp: wf_cdecl_def)(*>*)\n\n\nlemma subcls_asym:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n(*<*)\napply(erule tranclE)\napply(fast dest!: subcls1_wfD )\napply(fast dest!: subcls1_wfD intro: trancl_trans)\ndone\n(*>*)\n\n\nlemma subcls_irrefl:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ C \\ D\"\n(*<*)\napply (erule trancl_trans_induct)\napply (auto dest: subcls1_wfD subcls_asym)\ndone\n(*>*)\n\n\nlemma acyclic_subcls1:\n \"wf_prog wf_md P \\ acyclic (subcls1 P)\"\n(*<*)\napply (unfold acyclic_def)\napply (fast dest: subcls_irrefl)\ndone\n(*>*)\n\n\nlemma wf_subcls1:\n \"wf_prog wf_md P \\ wf ((subcls1 P)\\)\"\n(*<*)\napply (rule finite_acyclic_wf)\napply ( subst finite_converse)\napply ( rule finite_subcls1)\napply (subst acyclic_converse)\napply (erule acyclic_subcls1)\ndone\n(*>*)\n\n\nlemma single_valued_subcls1:\n \"wf_prog wf_md G \\ single_valued (subcls1 G)\"\n(*<*)\nby(auto simp:wf_prog_def distinct_fst_def single_valued_def dest!:subcls1D)\n(*>*)\n\n\nlemma subcls_induct: \n \"\\ wf_prog wf_md P; \\C. \\D. (C,D) \\ (subcls1 P)\\<^sup>+ \\ Q D \\ Q C \\ \\ Q C\"\n(*<*)\n (is \"?A \\ PROP ?P \\ _\")\nproof -\n assume p: \"PROP ?P\"\n assume ?A thus ?thesis apply -\napply(drule wf_subcls1)\napply(drule wf_trancl)\napply(simp only: trancl_converse)\napply(erule_tac a = C in wf_induct)\napply(rule p)\napply(auto)\ndone\nqed\n(*>*)\n\n\nlemma subcls1_induct_aux:\n \"\\ is_class P C; wf_prog wf_md P; Q Object;\n \\C D fs ms.\n \\ C \\ Object; is_class P C; class P C = Some (D,fs,ms) \\\n wf_cdecl wf_md P (C,D,fs,ms) \\ P \\ C \\\\<^sup>1 D \\ is_class P D \\ Q D\\ \\ Q C \\\n \\ Q C\"\n(*<*)\n (is \"?A \\ ?B \\ ?C \\ PROP ?P \\ _\")\nproof -\n assume p: \"PROP ?P\"\n assume ?A ?B ?C thus ?thesis apply -\napply(unfold is_class_def)\napply( rule impE)\nprefer 2\napply( assumption)\nprefer 2\napply( assumption)\napply( erule thin_rl)\napply( rule subcls_induct)\napply( assumption)\napply( rule impI)\napply( case_tac \"C = Object\")\napply( fast)\napply safe\napply( frule (1) class_wf)\napply( frule (1) wf_cdecl_supD)\n\napply( subgoal_tac \"P \\ C \\\\<^sup>1 a\")\napply( erule_tac [2] subcls1I)\napply( rule p)\napply (unfold is_class_def)\napply auto\ndone\nqed\n(*>*)\n\n(* FIXME can't we prove this one directly?? *)\nlemma subcls1_induct [consumes 2, case_names Object Subcls]:\n \"\\ wf_prog wf_md P; is_class P C; Q Object;\n \\C D. \\C \\ Object; P \\ C \\\\<^sup>1 D; is_class P D; Q D\\ \\ Q C \\\n \\ Q C\"\n(*<*)\n apply (erule subcls1_induct_aux, assumption, assumption)\n apply blast\n done\n(*>*)\n\n\nlemma subcls_C_Object:\n \"\\ is_class P C; wf_prog wf_md P \\ \\ P \\ C \\\\<^sup>* Object\"\n(*<*)\napply(erule (1) subcls1_induct)\n apply( fast)\napply(erule (1) converse_rtrancl_into_rtrancl)\ndone\n(*>*)\n\n\nlemma is_type_pTs:\nassumes \"wf_prog wf_md P\" and \"(C,S,fs,ms) \\ set P\" and \"(M,Ts,T,m) \\ set ms\"\nshows \"set Ts \\ types P\"\n(*<*)\nproof\n from assms have \"wf_mdecl wf_md P C (M,Ts,T,m)\" \n by (unfold wf_prog_def wf_cdecl_def) auto \n hence \"\\t \\ set Ts. is_type P t\" by (unfold wf_mdecl_def) auto\n moreover fix t assume \"t \\ set Ts\"\n ultimately have \"is_type P t\" by blast\n thus \"t \\ types P\" ..\nqed\n(*>*)\n\n\nsubsection{* Well-formedness and method lookup *}\n\nlemma sees_wf_mdecl:\n \"\\ wf_prog wf_md P; P \\ C sees M:Ts\\T = m in D \\ \\ wf_mdecl wf_md P D (M,Ts,T,m)\"\n(*<*)\napply(drule visible_method_exists)\napply(fastforce simp:wf_cdecl_def dest!:class_wf dest:map_of_SomeD)\ndone\n(*>*)\n\n\nlemma sees_method_mono [rule_format (no_asm)]: \n \"\\ P \\ C' \\\\<^sup>* C; wf_prog wf_md P \\ \\\n \\D Ts T m. P \\ C sees M:Ts\\T = m in D \\\n (\\D' Ts' T' m'. P \\ C' sees M:Ts'\\T' = m' in D' \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T)\"\n(*<*)\napply( drule rtranclD)\napply( erule disjE)\napply( fastforce)\napply( erule conjE)\napply( erule trancl_trans_induct)\nprefer 2\napply( clarify)\napply( drule spec, drule spec, drule spec, drule spec, erule (1) impE)\napply clarify\napply( fast elim: widen_trans widens_trans)\napply( clarify)\napply( drule subcls1D)\napply( clarify)\napply(clarsimp simp:Method_def)\napply(frule (2) sees_methods_rec)\napply(rule refl)\napply(case_tac \"map_of ms M\")\napply(rule_tac x = D in exI)\napply(rule_tac x = Ts in exI)\napply(rule_tac x = T in exI)\napply simp\napply(rule_tac x = m in exI)\napply(fastforce simp add:map_add_def split:option.split)\napply clarsimp\napply(rename_tac Ts' T' m')\napply( drule (1) class_wf)\napply( unfold wf_cdecl_def Method_def)\napply( frule map_of_SomeD)\napply auto\napply(drule (1) bspec, simp)\napply(erule_tac x=D in allE, erule_tac x=Ts in allE, erule_tac x=T in allE)\napply(fastforce simp:map_add_def split:option.split)\ndone\n(*>*)\n\n\nlemma sees_method_mono2:\n \"\\ P \\ C' \\\\<^sup>* C; wf_prog wf_md P;\n P \\ C sees M:Ts\\T = m in D; P \\ C' sees M:Ts'\\T' = m' in D' \\\n \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T\"\n(*<*)by(blast dest:sees_method_mono sees_method_fun)(*>*)\n\n\nlemma mdecls_visible:\nassumes wf: \"wf_prog wf_md P\" and \"class\": \"is_class P C\"\nshows \"\\D fs ms. class P C = Some(D,fs,ms)\n \\ \\Mm. P \\ C sees_methods Mm \\ (\\(M,Ts,T,m) \\ set ms. Mm M = Some((Ts,T,m),C))\"\n(*<*)\nusing wf \"class\"\nproof (induct rule:subcls1_induct)\n case Object\n with wf have \"distinct_fst ms\"\n by (unfold class_def wf_prog_def wf_cdecl_def) (fastforce dest:map_of_SomeD)\n with Object show ?case by(fastforce intro!: sees_methods_Object map_of_SomeI)\nnext\n case Subcls\n with wf have \"distinct_fst ms\"\n by (unfold class_def wf_prog_def wf_cdecl_def) (fastforce dest:map_of_SomeD)\n with Subcls show ?case\n by(fastforce elim:sees_methods_rec dest:subcls1D map_of_SomeI\n simp:is_class_def)\nqed\n(*>*)\n\n\nlemma mdecl_visible:\nassumes wf: \"wf_prog wf_md P\" and C: \"(C,S,fs,ms) \\ set P\" and m: \"(M,Ts,T,m) \\ set ms\"\nshows \"P \\ C sees M:Ts\\T = m in C\"\n(*<*)\nproof -\n from wf C have \"class\": \"class P C = Some (S,fs,ms)\"\n by (auto simp add: wf_prog_def class_def is_class_def intro: map_of_SomeI)\n from \"class\" have \"is_class P C\" by(auto simp:is_class_def) \n with assms \"class\" show ?thesis\n by(bestsimp simp:Method_def dest:mdecls_visible)\nqed\n(*>*)\n\n\nlemma Call_lemma:\n \"\\ P \\ C sees M:Ts\\T = m in D; P \\ C' \\\\<^sup>* C; wf_prog wf_md P \\\n \\ \\D' Ts' T' m'.\n P \\ C' sees M:Ts'\\T' = m' in D' \\ P \\ Ts [\\] Ts' \\ P \\ T' \\ T \\ P \\ C' \\\\<^sup>* D'\n \\ is_type P T' \\ (\\T\\set Ts'. is_type P T) \\ wf_md P D' (M,Ts',T',m')\"\n(*<*)\napply(frule (2) sees_method_mono)\napply(fastforce intro:sees_method_decl_above dest:sees_wf_mdecl\n simp: wf_mdecl_def)\ndone\n(*>*)\n\n\nlemma wf_prog_lift:\n assumes wf: \"wf_prog (\\P C bd. A P C bd) P\"\n and rule:\n \"\\wf_md C M Ts C T m bd.\n wf_prog wf_md P \\\n P \\ C sees M:Ts\\T = m in C \\ \n set Ts \\ types P \\\n bd = (M,Ts,T,m) \\\n A P C bd \\\n B P C bd\"\n shows \"wf_prog (\\P C bd. B P C bd) P\"\n(*<*)\nproof -\n from wf show ?thesis\n apply (unfold wf_prog_def wf_cdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (unfold wf_mdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply clarsimp\n apply (frule mdecl_visible [OF wf], assumption+)\n apply (frule is_type_pTs [OF wf], assumption+)\n apply (drule rule [OF wf], assumption+)\n apply auto\n done\nqed\n(*>*)\n\n\nsubsection{* Well-formedness and field lookup *}\n\nlemma wf_Fields_Ex:\n \"\\ wf_prog wf_md P; is_class P C \\ \\ \\FDTs. P \\ C has_fields FDTs\"\n(*<*)\napply(frule class_Object)\napply(erule (1) subcls1_induct)\n apply(blast intro:has_fields_Object)\napply(blast intro:has_fields_rec dest:subcls1D)\ndone\n(*>*)\n\n\nlemma has_fields_types:\n \"\\ P \\ C has_fields FDTs; (FD,T) \\ set FDTs; wf_prog wf_md P \\ \\ is_type P T\"\n(*<*)\napply(induct rule:Fields.induct)\n apply(fastforce dest!: class_wf simp: wf_cdecl_def wf_fdecl_def)\napply(fastforce dest!: class_wf simp: wf_cdecl_def wf_fdecl_def)\ndone\n(*>*)\n\n\nlemma sees_field_is_type:\n \"\\ P \\ C sees F:T in D; wf_prog wf_md P \\ \\ is_type P T\"\n(*<*)\nby(fastforce simp: sees_field_def\n elim: has_fields_types map_of_SomeD[OF map_of_remap_SomeD])\n(*>*)\n\nlemma wf_syscls:\n \"set SystemClasses \\ set P \\ wf_syscls P\"\n(*<*)\napply (simp add: image_def SystemClasses_def wf_syscls_def sys_xcpts_def\n ObjectC_def NullPointerC_def ClassCastC_def OutOfMemoryC_def)\n apply force\ndone\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/Common/WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.25040438538016085}} {"text": "theory ARMv7A_Update_ASID_Ref\n\n\nimports ARMv7A_Update_TTBR0_Ref\n\nbegin \n\n\n\n\nlemma update_asid_non_det_sat_refine:\n \"\\ update_ASID a (s::'a non_det_tlb_state_scheme) = ((), s') ; update_ASID a (t::'b sat_tlb_state_scheme) = ((), t'); \n tlb_rel_sat (typ_non_det_tlb s) (typ_sat_tlb t) \\ \\ \n tlb_rel_sat (typ_non_det_tlb s') (typ_sat_tlb t')\"\n apply (clarsimp simp: update_ASID_non_det_tlb_state_ext_def update_ASID_sat_tlb_state_ext_def)\n apply (clarsimp simp: tlb_rel_sat_def saturated_def)\n apply (cases s, cases t , clarsimp simp: state.defs pairsub_def, force)\n done\n\n\n\nlemma asid_unequal_snp_upd_equal' [simp]:\n \"a \\ a' \\ snp_upd_cur' snp ist m r a' a = snp a\"\n by (clarsimp simp: snp_upd_cur'_def)\n\n\n\nlemma saturated_global_subset_lookup_tlb_un_eq:\n \"saturated (typ_sat_tlb s) \\ \n lookup''(global_entries (fst(sat_tlb s)) \\ \n global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = \n lookup'' (global_entries (fst(sat_tlb s))) a v\"\n apply (rule tlb_subset_lookup_un_eq)\n apply (subgoal_tac \"global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries (the ` {e \\ range (pt_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (clarsimp simp: saturated_def global_entries_def) apply blast\n by (rule global_entries_ptable_same)\n\n\n\nlemma saturated_global_subset_lookup_pdc_un_eq:\n \"saturated (typ_sat_tlb s) \\ \n lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ \n global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = \n lookup_pdc (global_entries_pdc (snd(sat_tlb s))) a v\"\n apply (rule pdc_subset_lookup_un_eq)\n apply (subgoal_tac \"global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries_pdc (the ` {e \\ range (pdc_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (clarsimp simp: saturated_def global_entries_pdc_def) apply blast\n by (rule global_entries_pdc_ptable_same)\n\n\n\nlemma update_asid_sat_incon_refine:\n \"\\ update_ASID a (s::'a sat_tlb_state_scheme) = ((), s') ; update_ASID a (t::'b set_tlb_state_scheme) = ((), t'); \n tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t) \\ \\ \n tlb_rel_abs (typ_sat_tlb s') (typ_set_tlb t')\"\n apply (clarsimp simp: update_ASID_sat_tlb_state_ext_def update_ASID_set_tlb_state_ext_def Let_def)\n apply (frule tlb_rel_absD)\n apply (case_tac \"a = ASID s\")\n (* to the same ASID *)\n apply (subgoal_tac \"sat_tlb s = pairunion (sat_tlb s)\n (the ` {e \\ range (pt_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e}, the ` {e \\ range (pdc_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e})\")\n prefer 2\n apply (clarsimp simp: saturated_def) \n apply (clarsimp simp: tlb_rel_abs_def)\n apply (rule conjI)\n apply (clarsimp simp: state.defs)\n apply (rule conjI)\n apply clarsimp\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def )\n apply (cases t, cases s, clarsimp) apply force\n apply clarsimp\n apply (clarsimp simp: lookup_from'_def snap_conv'_def snp_upd_cur'_def snp_upd_cur_def)\n (* to new asid *)\n apply (clarsimp simp: tlb_rel_abs_def)\n apply (rule conjI)\n apply (clarsimp simp: state.defs)\n apply (rule conjI)\n apply (clarsimp simp: saturated_def)\n apply (thin_tac \"s' = s \\ASID := a, sat_tlb := pairunion (sat_tlb s)\n (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}, the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\\\")\n apply (thin_tac \"t' = t\n \\ASID := a,\n set_tlb := set_tlb t\n \\snapshot := snp_upd_cur' (snapshot (set_tlb t)) (iset (set_tlb t)) (MEM s) (TTBR0 s) (ASID s),\n iset := fst (snapshot (set_tlb t) a) \\ iset (set_tlb t) \\ global_set (set_tlb t) \\ ptable_comp (snd (snapshot (set_tlb t) a)) (pt_walk_pair a (MEM s) (TTBR0 s))\\\\\")\n apply (rule conjI)\n apply (clarsimp simp: incon_addrs_def)\n apply (rule conjI)\n apply (clarsimp simp: inconsistent_vaddrs_def)\n apply (rule conjI)\n apply (clarsimp)\n apply (rename_tac v)\n apply (subgoal_tac \"fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = (non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ \n (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (simp only:)\n apply (thin_tac \"fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = (non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ \n (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (subgoal_tac \"lookup'' (global_entries (fst(sat_tlb s))) a v = lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v \")\n prefer 2\n apply (rule saturated_global_subset_lookup_tlb_un_eq[symmetric], simp)\n apply (drule_tac t = \"non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon)\n apply blast\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Hit xa\") \n apply (case_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\")\n apply blast\n apply clarsimp\n apply (subgoal_tac \"lookup'' (fst(sat_tlb s)) (ASID s) v = Hit xa \\ \n lookup'' (fst(sat_tlb s)) (ASID s) v = Incon\")\n apply (erule_tac P = \"lookup'' (fst(sat_tlb s)) (ASID s) v = Hit xa\" in disjE)\n apply (case_tac \"is_fault (pt_walk (ASID s) (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: incoherrent_vaddrs_def)\n apply force\n apply (drule lookup_asid_tlb_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"asid_of (the (pt_walk a (MEM s) (TTBR0 s) v)) = None\")\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (case_tac \"fst(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (drule_tac a' = a in no_fault_pt_walk_unequal_asid')\n apply (frule non_fault_pt_walk_full_walk)\n apply (subgoal_tac \"the (pt_walk a (MEM s) (TTBR0 s) v) \\ x3\")\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def)\n apply (subgoal_tac \"asid_of x3 \\ None\")\n apply force\n apply (drule lookup_non_global_hit_asid_of_not_none, simp)\n apply (drule lookup_non_global_miss_non_fault)\n apply (frule_tac a' = a in no_fault_pt_walk_unequal_asid', simp)\n apply (rule_tac v = v and a = a and t = \"(the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in lookup_global_hit_asid_of_none, simp)\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"xa \\ the (pt_walk (ASID t) (MEM s) (TTBR0 s) v)\")\n apply (drule_tac b = v and x = xa in saturatd_lookup_hit_no_fault; simp?)\n apply (subgoal_tac \"asid_of xa = None\")\n apply (subgoal_tac \"asid_of (the (pt_walk (ASID t) (MEM s) (TTBR0 s) v)) \\ None\")\n apply force\n apply (subgoal_tac \"lookup'' (non_global_entries (the ` {e \\ range (pt_walk (ASID t) (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID t) v = Hit \n (the (pt_walk (ASID t) (MEM s) (TTBR0 s) v))\")\n apply (rule lookup_non_global_hit_asid_of_not_none, simp)\n apply (rule_tac a = a in non_global_lookup_hit_asid, simp)\n apply (rule lookup_global_hit_asid_of_none, simp)\n apply (clarsimp)\n apply (subgoal_tac \"xa \\ the (pt_walk (ASID t) (MEM s) (TTBR0 s) v)\")\n apply (drule_tac b = v and x = xa in saturatd_lookup_hit_no_fault; simp?)\n apply (subgoal_tac \"asid_of xa = None\")\n apply (subgoal_tac \"asid_of (the (pt_walk (ASID t) (MEM s) (TTBR0 s) v)) \\ None\")\n apply force\n apply (subgoal_tac \"lookup'' (non_global_entries (the ` {e \\ range (pt_walk (ASID t) (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID t) v = Hit \n (the (pt_walk (ASID t) (MEM s) (TTBR0 s) v))\")\n apply (rule lookup_non_global_hit_asid_of_not_none, simp)\n apply (rule_tac a = a in non_global_lookup_hit_asid, simp)\n apply (rule lookup_global_hit_asid_of_none, simp)\n apply blast\n apply (metis (no_types, hide_lams) lookup_global_hit_order lookup_global_same_for_asids)\n apply (subgoal_tac \"xa \\ global_entries (fst(sat_tlb s))\")\n apply (subgoal_tac \"v \\ range_of xa\")\n apply (clarsimp simp: global_range_def)\n apply blast\n apply (simp add: lookup_asid_tlb_hit_entry_range)\n using lookup_in_asid_tlb apply auto[1]\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon)\n apply blast\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))a v = Hit x\")\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (case_tac \"fst(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (subgoal_tac \"\\is_fault (pt_walk a (MEM s) (TTBR0 s) v)\")\n apply (subgoal_tac \"xb = the (pt_walk a (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis pt_walk_new_no_fault_pt_walk' option.inject) \n apply (frule_tac a' = a in non_global_lookup_hit_asid, simp)\n apply (rule non_global_hit_no_fault, simp)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force \n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force\n apply (clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon)\n apply blast\n apply (clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (case_tac \"fst(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (subgoal_tac \"\\is_fault (pt_walk a (MEM s) (TTBR0 s) v)\")\n apply (subgoal_tac \"xa = the (pt_walk a (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis pt_walk_new_no_fault_pt_walk' option.inject) \n apply (frule_tac a' = a in non_global_lookup_hit_asid, simp)\n apply (rule non_global_hit_no_fault, simp)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pt_walk_not_incon apply force\n apply (clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (rule tlb_nion_global_non_global)\n apply (clarsimp)\n apply (rename_tac v)\n apply (subgoal_tac \"snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = (non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ \n (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (simp only:)\n apply (thin_tac \"snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = (non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ \n (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (subgoal_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s))) a v = lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v \")\n prefer 2\n apply (rule saturated_global_subset_lookup_pdc_un_eq[symmetric], simp)\n apply (drule_tac t = \"non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in union_asid_pdc_incon_cases)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_pdc_def lookup_def asid_of_pdc_def tagged_pdc_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon_pdc')\n apply blast\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Hit xa\") \n apply (case_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\")\n apply blast\n apply clarsimp\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s)) (ASID s) v = Hit xa \\ \n lookup_pdc (snd(sat_tlb s)) (ASID s) v = Incon\")\n apply (erule_tac P = \"lookup_pdc (snd(sat_tlb s)) (ASID s) v = Hit xa\" in disjE)\n apply (case_tac \"is_fault (pdc_walk (ASID s) (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: incoherrent_vaddrs_def)\n apply force\n apply (drule lookup_asid_pdc_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"asid_of_pdc (the (pdc_walk a (MEM s) (TTBR0 s) v)) = None\")\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (case_tac \"snd(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.sel option.simps(3) pt_walk_new_no_fault_pdc_walk pt_walk_new_par_fault_pdc_walk)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.sel option.simps(3) pt_walk_new_no_fault_pdc_walk )\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis lookup_non_global_hit_asid_of_not_none_pdc option.sel pt_walk_new_no_fault_pdc_walk)\n apply (rule_tac v = v and a = a and t = \"(the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in lookup_global_hit_asid_of_none_pdc)\n apply (subgoal_tac \"\\ is_fault (pdc_walk a (MEM s) (TTBR0 s) v)\")\n apply (rule lookup_pdc_non_global_miss_non_fault, simp, simp)\n using no_fault_pdc_walk_unequal_asid' apply blast\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"xa \\ the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v)\")\n apply (drule_tac b = v and x = xa in saturatd_lookup_pdc_hit_no_fault; simp?)\n apply (subgoal_tac \"asid_of_pdc xa = None\")\n apply (subgoal_tac \"asid_of_pdc (the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v)) \\ None\")\n apply force\n apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (the ` {e \\ range (pdc_walk (ASID t) (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID t) v = Hit \n (the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v))\")\n apply (rule lookup_non_global_hit_asid_of_not_none_pdc, simp)\n apply (rule_tac a = a in non_global_lookup_pdc_hit_asid, simp)\n apply (rule lookup_global_hit_asid_of_none_pdc, simp)\n apply (clarsimp)\n apply (subgoal_tac \"xa \\ the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v)\")\n apply (drule_tac b = v and x = xa in saturatd_lookup_pdc_hit_no_fault; simp?)\n apply (subgoal_tac \"asid_of_pdc xa = None\")\n apply (subgoal_tac \"asid_of_pdc (the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v)) \\ None\")\n apply force\n apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (the ` {e \\ range (pdc_walk (ASID t) (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID t) v = Hit \n (the (pdc_walk (ASID t) (MEM s) (TTBR0 s) v))\")\n apply (rule lookup_non_global_hit_asid_of_not_none_pdc, simp)\n apply (rule_tac a = a in non_global_lookup_pdc_hit_asid, simp)\n apply (rule lookup_global_hit_asid_of_none_pdc, simp)\n apply blast\n apply (metis lookup_global_same_for_asids_pdc lookup_pdc_global_hit_order)\n apply (subgoal_tac \"xa \\ global_entries_pdc (snd(sat_tlb s))\")\n apply (subgoal_tac \"v \\ range_of xa\")\n apply (clarsimp simp: global_range_def)\n apply blast\n apply (simp add: lookup_asid_pdc_hit_entry_range)\n using lookup_in_asid_pdc apply auto[1]\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_pdc_def lookup_def asid_of_pdc_def tagged_pdc_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon_pdc')\n apply blast\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))a v = Hit x\")\n apply (drule union_asid_pdc_incon_cases)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (case_tac \"snd(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (subgoal_tac \"\\is_fault (pdc_walk a (MEM s) (TTBR0 s) v)\")\n apply (subgoal_tac \"xb = the (pdc_walk a (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.inject pt_walk_new_no_fault_pdc_walk pt_walk_new_par_fault_pdc_walk) \n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.inject pt_walk_new_no_fault_pdc_walk pt_walk_new_par_fault_pdc_walk)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.inject pt_walk_new_no_fault_pdc_walk pt_walk_new_par_fault_pdc_walk) \n apply (frule_tac a' = a in non_global_lookup_pdc_hit_asid, simp)\n apply (rule non_global_hit_no_fault_pdc, simp)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force \n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force\n apply (clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\n a v = Incon\")\n apply (subgoal_tac \"v \\ iset (set_tlb t)\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply blast\n apply (clarsimp simp: global_entries_pdc_def lookup_def asid_of_pdc_def tagged_pdc_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (drule_tac a' = \"ASID s\" in lookup_global_incon_incon_pdc')\n apply blast\n apply (clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (drule union_asid_pdc_incon_cases)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (case_tac \"snd(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (subgoal_tac \"\\is_fault (pdc_walk a (MEM s) (TTBR0 s) v)\")\n apply (subgoal_tac \"xa = the (pdc_walk a (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis (no_types, hide_lams) non_fault_pt_walk_pair_disjI option.inject\n option.sel pt_walk_full_no_pdc_fault pt_walk_new_par_fault_pdc_walk pt_walk_typ.inject(2) pt_walk_typ.simps(8))\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.inject pt_walk_new_no_fault_pdc_walk) \n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.inject pt_walk_new_no_fault_pdc_walk)\n apply (frule_tac a' = a in non_global_lookup_pdc_hit_asid, simp)\n apply (rule non_global_hit_no_fault_pdc, simp)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force\n apply (erule disjE, clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (erule disjE, clarsimp simp: )\n using non_global_lookup_range_pdc_walk_not_incon apply force\n apply (clarsimp simp: )\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (rule pdc_non_global_non_global)\n apply (clarsimp simp: incoherrent_vaddrs_def)\n apply (rule conjI)\n apply clarsimp\n apply (rename_tac v x)\n apply (subgoal_tac \"fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = \n (non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (simp only:)\n apply (thin_tac \"fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = \n (non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (subgoal_tac \"lookup'' (global_entries (fst(sat_tlb s))) a v = lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v \")\n prefer 2\n apply (rule saturated_global_subset_lookup_tlb_un_eq[symmetric], simp)\n apply (drule_tac t = \"non_global_entries (fst(sat_tlb s)) \\ non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in lookup_asid_tlb_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup''(global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (subgoal_tac \"lookup'' (non_global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (drule lookup_asid_tlb_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global [symmetric])\n apply (case_tac \"fst(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis option.simps(3) pt_walk_new_no_fault_pt_walk') \n apply (erule disjE, clarsimp)\n apply (clarsimp)\n apply (rule is_fault_non_global_entries_miss, simp)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup'' (global_entries (fst(sat_tlb s)) \\ global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Hit x\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\") \n apply blast\n apply (subgoal_tac \" lookup'' (fst(sat_tlb s)) (ASID t) v = Hit x \\\n lookup'' (fst(sat_tlb s)) (ASID t) v = Incon\")\n prefer 2\n apply (metis (no_types, hide_lams) lookup_global_hit_order lookup_global_same_for_asids )\n apply (erule disjE)\n apply (clarsimp simp: ) \n using no_fault_pt_walk_unequal_asid' apply fastforce\n apply (clarsimp simp: inconsistent_vaddrs_def) apply force\n apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (clarsimp)\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\") \n apply blast\n apply (subgoal_tac \" lookup'' (fst(sat_tlb s)) (ASID t) v = Hit x \\\n lookup'' (fst(sat_tlb s)) (ASID t) v = Incon\")\n prefer 2\n apply (metis (no_types, hide_lams) lookup_global_hit_order lookup_global_same_for_asids )\n apply (erule disjE)\n apply (clarsimp simp: ) \n using no_fault_pt_walk_unequal_asid' apply fastforce\n apply (clarsimp simp: inconsistent_vaddrs_def) apply force\n apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (rule tlb_nion_global_non_global)\n apply clarsimp\n apply (rename_tac v x)\n apply (subgoal_tac \"snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = \n (non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (simp only:)\n apply (thin_tac \"snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} = \n (non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) \\ (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}))\")\n apply (subgoal_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s))) a v = lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v \")\n prefer 2\n apply (rule saturated_global_subset_lookup_pdc_un_eq[symmetric], simp)\n apply (drule_tac t = \"non_global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\" in lookup_asid_pdc_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Miss\")\n apply (drule lookup_asid_pdc_hit_union_cases')\n apply (erule disjE, clarsimp)\n apply (drule_tac x = a in spec, simp, drule_tac x = v in spec)\n apply (clarsimp simp: non_global_to_global_pdc [symmetric])\n apply (case_tac \"snd(lookup_from' (snapshot (set_tlb t)) a v)\"; clarsimp?)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis is_fault_def pt_walk_full_no_pdc_fault pt_walk_partial_no_pdc_fault)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis is_fault_def pt_walk_full_no_pdc_fault)\n apply (clarsimp simp: ptable_comp_def is_fault_def entry_leq_def) \n apply (metis is_fault_def pt_walk_full_no_pdc_fault)\n apply (erule disjE, clarsimp)\n apply (clarsimp)\n apply (rule is_fault_non_global_entries_pdc_miss,simp)\n apply (erule disjE, clarsimp)\n apply (thin_tac \"lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) a v = Hit x\")\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\") \n apply blast\n apply (subgoal_tac \" lookup_pdc (snd(sat_tlb s)) (ASID t) v = Hit x \\\n lookup_pdc (snd(sat_tlb s)) (ASID t) v = Incon\")\n prefer 2\n apply (metis (no_types, hide_lams) lookup_pdc_global_hit_order lookup_global_same_for_asids_pdc )\n apply (erule disjE)\n apply (clarsimp simp: ) \n using no_fault_pdc_walk_unequal_asid' apply fastforce\n apply (clarsimp simp: inconsistent_vaddrs_def) apply force\n apply (clarsimp simp: global_entries_pdc_def lookup_def asid_of_pdc_def tagged_pdc_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (clarsimp)\n apply (subgoal_tac \"v \\ global_set (set_tlb t)\")\n apply (case_tac \"v \\ iset (set_tlb t)\") \n apply blast\n apply (subgoal_tac \" lookup_pdc (snd(sat_tlb s)) (ASID t) v = Hit x \\\n lookup_pdc (snd(sat_tlb s)) (ASID t) v = Incon\")\n prefer 2\n apply (metis (no_types, hide_lams) lookup_pdc_global_hit_order lookup_global_same_for_asids_pdc )\n apply (erule disjE)\n apply (clarsimp simp: ) \n using no_fault_pdc_walk_unequal_asid' apply fastforce\n apply (clarsimp simp: inconsistent_vaddrs_def) apply force\n apply (clarsimp simp: global_entries_pdc_def lookup_def asid_of_pdc_def tagged_pdc_entry_set_def entry_set_def global_range_def split: if_split_asm option.splits)\n apply blast\n apply (rule pdc_non_global_non_global)\n apply (rule conjI)\n apply (clarsimp simp: global_range_def)\n apply (rule conjI)\n\n apply (subgoal_tac \"global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries (fst(sat_tlb s))\")\n apply (simp only:)\n apply (subgoal_tac \"global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) \\ \n global_entries (fst(sat_tlb s))\" )\n apply (clarsimp simp: global_entries_union)\n apply blast\n apply (subgoal_tac \"global_entries (the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries (the ` {e \\ range (pt_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (clarsimp simp: saturated_def global_entries_def) apply force\n apply (rule global_entries_ptable_same)\n apply (subgoal_tac \"global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries_pdc (snd(sat_tlb s))\")\n apply (simp only:)\n apply (subgoal_tac \"global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) \\ \n global_entries_pdc (snd(sat_tlb s))\" )\n apply (clarsimp simp: global_entries_union_pdc)\n apply blast\n\n apply (subgoal_tac \"global_entries_pdc (the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e}) = \n global_entries_pdc (the ` {e \\ range (pdc_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (clarsimp simp: saturated_def global_entries_pdc_def) apply force\n apply (rule global_entries_pdc_ptable_same)\n apply (clarsimp simp: )\n apply (rule conjI)\n apply (subgoal_tac \"(fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} - global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) =\n non_global_entries (fst(sat_tlb s)\\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (thin_tac \"(fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e} - global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) =\n non_global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (case_tac \"aa = ASID t\")\n apply (thin_tac \" \\a. a \\ ASID s \\\n (\\v. lookup'' (fst (sat_tlb s) - global_entries (fst (sat_tlb s))) a v \\ fst (lookup_from' (snapshot (set_tlb t)) a v) \\\n lookup_pdc (snd (sat_tlb s) - global_entries_pdc (snd (sat_tlb s))) a v \\ snd (lookup_from' (snapshot (set_tlb t)) a v))\")\n apply (clarsimp)\n apply (subgoal_tac \"lookup'' (non_global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID t) v =\n lookup'' (non_global_entries (fst(sat_tlb s))) (ASID t) v\")\n apply (simp only:)\n apply (thin_tac \"lookup'' (non_global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID s) v =\n lookup'' (non_global_entries (fst(sat_tlb s))) (ASID s) v\")\n apply (case_tac \"fst(lookup_from' (snp_upd_cur' (snapshot (set_tlb t)) (iset (set_tlb t)) (MEM s) (TTBR0 s) (ASID t)) (ASID t) v)\"; clarsimp)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\")\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (metis lookup_asid_tlb_miss_union lookup_tlb_eq_union_global_non_global lookup_type.exhaust option.simps(3) pt_walk_new_fault_pt_walk_fault')\n apply blast\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\")\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (metis lookup_asid_tlb_miss_union not_miss_incon_hit_asid_tlb option.discI pt_walk_new_par_fault_pt_walk_fault' tlb_global_non_global_union)\n apply blast\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\")\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (metis lookup_asid_tlb_miss_union not_miss_incon_hit_asid_tlb option.discI pt_walk_new_par_fault_pt_walk_fault' tlb_global_non_global_union)\n apply blast \n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"x31 = the (pt_walk (ASID t) (MEM s) (TTBR0 s) v)\")\n prefer 2\n apply (simp add: pt_walk_new_no_fault_pt_walk')\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup'' (fst(sat_tlb s)) (ASID s) v\"; clarsimp)\n apply (metis lookup_asid_tlb_miss_union tlb_global_non_global_union)\n apply (subgoal_tac \"lookup'' (fst(sat_tlb s)) (ASID s) v = lookup'' (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e}) (ASID t) v\")\n prefer 2\n apply (clarsimp simp: saturated_def)\n apply (simp add: sup.absorb1) \n apply (simp only:)\n apply (drule lookup_asid_tlb_hit_union_cases')\n apply (thin_tac \"(\\x. lookup_pdc (snd (sat_tlb s)) (ASID s) v \\ Hit x) \\ (\\y. pdc_walk (ASID s) (MEM s) (TTBR0 s) v = Some y)\")\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"is_fault (pt_walk (ASID s) (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: is_fault_def)\n apply (rule asid_tlb_lookup_miss_is_fault, simp)\n apply (erule disjE, clarsimp)\n apply (clarsimp)\n apply (subgoal_tac \"x3 = y\") apply clarsimp\n apply (subgoal_tac \"lookup'' (fst(sat_tlb s)) (ASID s) v = lookup'' (global_entries (fst(sat_tlb s)) \\ non_global_entries (fst(sat_tlb s))) (ASID s) v \")\n apply (simp only:)\n apply (thin_tac \" lookup'' (the ` {e \\ range (pt_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e}) (ASID s) v = Hit y \")\n apply (drule lookup_asid_tlb_hit_union_cases') \n apply (erule disjE, clarsimp) \n apply (erule disjE, clarsimp) \n apply (drule lookup_non_global_hit_asid_of_not_none, simp)\n apply (clarsimp) \n apply (drule lookup_non_global_hit_asid_of_not_none, simp)\n apply (clarsimp) apply (insert tlb_global_non_global_union [of \"fst(sat_tlb s)\"])\n apply (simp add: Un_commute)\n apply (frule asid_tlb_lookup_range_fault_pt_walk)\n apply (drule_tac x = v in bspec)\n using lookup_asid_tlb_hit_entry_range apply force\n apply simp\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup'' (fst(sat_tlb s)) (ASID t) v\"; clarsimp)\n apply (simp only: non_global_to_global)\n apply (subgoal_tac \"lookup'' (fst(sat_tlb s) - global_entries (fst(sat_tlb s))) (ASID t) v = Miss\") apply simp\n apply (rule lookup_miss_minus_miss, simp)\n apply (subgoal_tac \"x3a = x3\", simp)\n apply (simp only: non_global_to_global)\n apply (subgoal_tac \"lookup'' (fst(sat_tlb s) - global_entries (fst(sat_tlb s))) (ASID t) v = Miss \\\n lookup'' (fst(sat_tlb s) - global_entries (fst(sat_tlb s))) (ASID t) v = Hit x3\")\n apply force\n apply (rule lookup_miss_minus_miss_hit, simp)\n apply (frule_tac b = v and x = x3a in saturatd_lookup_hit_no_fault, simp, \n simp add: is_fault_def, simp)\n using pt_walk_new_no_fault_pt_walk' apply force\n apply (rule lookup_non_global_union_asid_unequal, simp)\n apply (drule_tac x = aa in spec, simp, drule_tac x = v in spec)\n apply (subgoal_tac \"lookup'' (non_global_entries (fst(sat_tlb s) \\ the ` {e \\ range (pt_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) aa v =\n lookup'' (non_global_entries (fst(sat_tlb s))) aa v\") \n apply (simp only: non_global_to_global)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: if_split_asm option.splits)\n apply (rule lookup_non_global_union_asid_unequal', simp, simp, simp) \n using non_global_to_global apply auto [1] \n apply (subgoal_tac \"(snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} - global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) =\n non_global_entries_pdc (snd(sat_tlb s)\\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (simp only:)\n apply (thin_tac \"(snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e} - global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) =\n non_global_entries_pdc (snd(sat_tlb s)\\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})\")\n apply (case_tac \"aa = ASID t\")\n apply (thin_tac \" \\a. a \\ ASID s \\\n (\\v. lookup'' (fst (sat_tlb s) - global_entries (fst (sat_tlb s))) a v \\ fst (lookup_from' (snapshot (set_tlb t)) a v) \\\n lookup_pdc (snd (sat_tlb s) - global_entries_pdc (snd (sat_tlb s))) a v \\ snd (lookup_from' (snapshot (set_tlb t)) a v))\")\n apply (clarsimp)\n apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID s) v =\n lookup_pdc (non_global_entries_pdc (snd(sat_tlb s))) (ASID s) v\")\n apply (simp only:)\n apply (thin_tac \"lookup_pdc (non_global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) (ASID s) v =\n lookup_pdc (non_global_entries_pdc (snd(sat_tlb s))) (ASID s) v\")\n apply (case_tac \"snd(lookup_from' (snp_upd_cur' (snapshot (set_tlb t)) (iset (set_tlb t)) (MEM s) (TTBR0 s) (ASID t)) (ASID t) v)\"; clarsimp)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\")\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (metis (full_types) global_entries_pdc_def leq_Miss less_eq_lookup_type lookup_asid_pdc_miss_union lookup_eq_union_global_non_global_pdc lookup_type.exhaust lookup_type.simps(3) non_global_entries_pdc_def\n not_Some_eq pt_walk_new_fault_pdc_walk_fault' pt_walk_pair_def typ_sat_prim_parameter typ_sat_tlb_def)\n apply blast\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\")\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n\n subgoal\n proof -\n fix v :: vaddr and x2 :: pdc_entry\n assume a1: \"saturated (typ_sat_tlb s)\"\n assume a2: \"pt_walk_pair (ASID s) (MEM s) (TTBR0 s) v = Partial_Walk x2\"\n assume a3: \"asid_of_pdc x2 = None\"\n assume a4: \"lookup_pdc (snd (sat_tlb s)) (ASID s) v \\ Incon\"\n have \"the (Some x2) = x2\"\n by simp\n moreover\n { assume \"lookup_pdc (snd (sat_tlb s)) (ASID s) v = Hit x2\"\n then have \"\\P. lookup_pdc (P \\ non_global_entries_pdc (snd (sat_tlb s))) (ASID s) v = Hit x2\"\n by (metis (no_types) lookup_eq_union_global_non_global_pdc)\n then have \"lookup_pdc (non_global_entries_pdc (snd (sat_tlb s))) (ASID s) v = Miss\"\n using a3 lookup_asid_pdc_hit_union_cases' lookup_non_global_hit_asid_of_not_none_pdc by blast }\n ultimately show \"lookup_pdc (non_global_entries_pdc (snd (sat_tlb s))) (ASID s) v = Miss\"\n using a4 a2 a1 by (metis (no_types) lookup_asid_pdc_miss_union pdc_global_non_global_union pt_walk_new_par_fault_pdc_walk pt_walk_partial_no_pdc_fault saturate_no_icon_miss)\n qed\n apply blast\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"x32 = the (pdc_walk (ASID s) (MEM s) (TTBR0 s) v)\")\n prefer 2\n apply (simp add: pt_walk_new_no_fault_pdc_walk)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup_pdc (snd(sat_tlb s)) (ASID s) v\"; clarsimp)\n using pt_walk_full_no_pdc_fault sat_miss_pdc_fault apply fastforce\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s)) (ASID s) v = lookup_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e}) (ASID t) v\")\n prefer 2\n apply (clarsimp simp: saturated_def)\n apply (simp add: sup.absorb1) \n apply (simp only:)\n apply (drule lookup_asid_pdc_hit_union_cases')\n apply (thin_tac \"(\\x. lookup'' (fst (sat_tlb s)) (ASID s) v \\ Hit x) \\ (\\y. pt_walk (ASID s) (MEM s) (TTBR0 s) v = Some y)\")\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"is_fault (pdc_walk (ASID s) (MEM s) (TTBR0 s) v)\")\n apply (clarsimp simp: is_fault_def) \n apply (rule lookup_pdc_miss_is_fault, simp)\n apply (erule disjE, clarsimp)\n apply (clarsimp)\n apply (subgoal_tac \"x3 = y\") apply clarsimp\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s)) (ASID s) v = lookup_pdc (global_entries_pdc (snd(sat_tlb s)) \\ non_global_entries_pdc (snd(sat_tlb s))) (ASID s) v \")\n apply (simp only:)\n apply (thin_tac \" lookup_pdc (the ` {e \\ range (pdc_walk (ASID s) (MEM s) (TTBR0 s)). \\ is_fault e}) (ASID s) v = Hit y \")\n apply (drule lookup_asid_pdc_hit_union_cases') \n apply (erule disjE, clarsimp) \n apply (erule disjE, clarsimp) \n apply (drule lookup_non_global_hit_asid_of_not_none_pdc, simp)\n apply (clarsimp) \n apply (drule lookup_non_global_hit_asid_of_not_none_pdc, simp)\n apply (clarsimp) apply (insert pdc_global_non_global_union [of \"snd(sat_tlb s)\"])\n apply (simp add: Un_commute) \n apply (frule lookup_pdc_range_fault_pt_walk)\n apply (drule_tac x = v in bspec)\n using lookup_asid_pdc_hit_entry_range apply blast\n apply simp\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: pt_walk_typ.splits if_split_asm option.splits)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup_pdc (snd(sat_tlb s)) (ASID t) v\"; clarsimp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss\") apply simp\n apply (rule lookup_miss_minus_miss_pdc, simp)\n apply (subgoal_tac \"x3a = x3\", simp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss \\\n lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Hit x3\")\n apply force\n apply (rule lookup_miss_minus_miss_hit_pdc, simp)\n apply (frule_tac b = v and x = x3a in saturatd_lookup_pdc_hit_no_fault, simp, \n simp add: is_fault_def, simp)\n apply (simp add: pt_walk_new_par_fault_pdc_walk)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup_pdc (snd(sat_tlb s)) (ASID t) v\"; clarsimp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss\") apply simp\n apply (rule lookup_miss_minus_miss_pdc, simp)\n apply (subgoal_tac \"x3a = x3\", simp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss \\\n lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Hit x3\")\n apply force\n apply (rule lookup_miss_minus_miss_hit_pdc, simp)\n apply (frule_tac b = v and x = x3a in saturatd_lookup_pdc_hit_no_fault, simp, \n simp add: is_fault_def, simp)\n using pt_walk_new_no_fault_pdc_walk apply force\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (subgoal_tac \"v \\ incon_addrs (typ_sat_tlb s)\") prefer 2 apply blast\n apply (thin_tac \"incon_addrs (typ_sat_tlb s) \\ iset (set_tlb t)\")\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def is_fault_def)\n apply (case_tac \"lookup_pdc (snd(sat_tlb s)) (ASID t) v\"; clarsimp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss\") apply simp\n apply (rule lookup_miss_minus_miss_pdc, simp)\n apply (subgoal_tac \"x3a = x3\", simp)\n apply (simp only: non_global_to_global_pdc)\n apply (subgoal_tac \"lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Miss \\\n lookup_pdc (snd(sat_tlb s) - global_entries_pdc (snd(sat_tlb s))) (ASID t) v = Hit x3\")\n apply force\n apply (rule lookup_miss_minus_miss_hit_pdc, simp)\n apply (frule_tac b = v and x = x3a in saturatd_lookup_pdc_hit_no_fault, simp, \n simp add: is_fault_def, simp)\n using pt_walk_new_no_fault_pdc_walk apply force\n apply (rule lookup_non_global_union_asid_unequal_pdc, simp)\n apply (drule_tac x = aa in spec, simp, drule_tac x = v in spec)\n apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (snd(sat_tlb s) \\ the ` {e \\ range (pdc_walk a (MEM s) (TTBR0 s)). \\ is_fault e})) aa v =\n lookup_pdc (non_global_entries_pdc (snd(sat_tlb s))) aa v\") \n apply (simp only: non_global_to_global_pdc)\n apply (clarsimp simp: snp_upd_cur'_def snp_upd_cur_def)\n apply (clarsimp simp: lookup_from'_def snap_conv'_def split: if_split_asm option.splits) \n apply (rule lookup_non_global_union_asid_unequal_pdc', simp, simp, simp) \n using non_global_to_global_pdc by auto [1] \n\n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_PDC/ARMv7A_Update_ASID_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.25033174018307863}} {"text": "theory Timeout\nimports Semantics PositiveAccounts QuiescentResult AssetsPreservation\nbegin\n\nfun isClosedAndEmpty :: \"TransactionOutput \\ bool\" where\n\"isClosedAndEmpty (TransactionOutput txOut) = (txOutContract txOut = Close\n \\ accounts (txOutState txOut) = [])\" |\n\"isClosedAndEmpty _ = False\"\n\nlemma max_of_ge : \"ia \\ i \\ max (i::int) ia = i\"\n by linarith\n\nlemma reduceStepClose_is_Close : \"reduceContractStep env sta Close = Reduced re wa nsta ncon \\ ncon = Close\"\n apply simp\n apply (cases \"refundOne (accounts sta)\")\n apply simp\n subgoal for a\n apply (cases \"a\")\n subgoal for aa b\n apply (cases \"aa\")\n by simp\n done\n done\n\nlemma reductionLoopClose_is_Close : \"reductionLoop reduced env sta Close x y = ContractQuiescent newReduced re wa nsta ncon \\ ncon = Close\"\n apply (induction reduced env sta Close x y rule:reductionLoop.induct)\n subgoal for reduced env state warnings payments\n apply (simp only:reductionLoop.simps)\n apply (cases \"reduceContractStep env state Close\")\n subgoal for x11 x12 x13 x14\n apply (simp del:reductionLoop.simps reduceContractStep.simps add:reduceStepClose_is_Close)\n using reduceStepClose_is_Close by fastforce\n apply (simp del:reduceContractStep.simps)\n apply (simp del:reduceContractStep.simps)\n done\n done\n\nlemma reduceClose_is_Close : \"reduceContractUntilQuiescent env sta Close = ContractQuiescent reduced re wa nsta ncon \\ ncon = Close\"\n apply (simp del:reductionLoop.simps)\n using reductionLoopClose_is_Close by blast\n\nlemma timedOutReduce_only_quiescent_in_close_When :\n \"minTime sta \\ iniTime \\\n maxTimeContract (When x41 x42 x43) \\ iniTime \\\n iniTime \\ endTime \\\n reduceContractStep \\timeInterval = (iniTime, endTime)\\ (sta\\minTime := iniTime\\) (When x41 x42 x43) \\ NotReduced\"\n apply (induction x41)\n by simp_all\n\nlemma maxTimeWhen : \"maxTimeContract (When x41 x42 x43) \\ iniTime \\ x42 \\ iniTime\"\n apply (induction x41 arbitrary:x42 x43 iniTime)\n by auto\n\nlemma maxTimeNotAmbiguous_reduceStep :\n \"maxTimeContract cont \\ iniTime \\\n iniTime \\ endTime \\\n reduceContractStep \\timeInterval = (iniTime, endTime)\\ state cont \\ AmbiguousTimeIntervalReductionError\"\n apply (cases cont)\n apply simp\n apply (auto split:option.split bool.split)\n subgoal for x21 x22 x23 x24 x25\n apply (cases \"let moneyToPay = evalValue \\timeInterval = (iniTime, endTime)\\ state x24 in moneyToPay \\ 0\")\n apply simp\n apply simp\n apply (cases \"let moneyToPay = evalValue \\timeInterval = (iniTime, endTime)\\ state x24;\n balance = case lookup (x21, x23) (accounts state) of None \\ 0 | Some x \\ x; paidMoney = min balance moneyToPay\n in giveMoney x21 x22 x23 paidMoney (if balance \\ moneyToPay then MList.delete (x21, x23) (accounts state)\n else MList.insert (x21, x23) (balance - paidMoney) (accounts state))\")\n by (meson ReduceStepResult.distinct(3))\n using maxTimeWhen apply blast\n by (meson ReduceStepResult.distinct(3))\n\nlemma maxTimeOnlyDecreases_reduceStepWhen :\n \"reduceContractStep inte state (When x41 x42 x43) = Reduced wa ef nstate ncont \\\n maxTimeContract ncont \\ maxTimeContract (When x41 x42 x43)\"\n apply (induction x41 arbitrary: inte state x42 x43 wa ef nstate ncont)\n apply (smt ReduceStepResult.distinct(1) ReduceStepResult.distinct(3) ReduceStepResult.inject maxTimeContract.simps(4) prod.case_eq_if reduceContractStep.simps(4))\n by fastforce\n\nlemma maxTimeOnlyDecreases_reduceStep :\n \"reduceContractStep inte state cont = Reduced wa ef nstate ncont \\\n maxTimeContract ncont \\ maxTimeContract cont\"\n apply (cases cont)\n using reduceStepClose_is_Close apply blast\n apply (simp only:reduceContractStep.simps)\n subgoal for x21 x22 x23 x24 x25\n apply (cases \"let moneyToPay = evalValue inte state x24\n in evalValue inte state x24 \\ 0\")\n apply simp\n apply simp\n apply (cases \"let moneyToPay = evalValue inte state x24; balance = case lookup (x21, x23) (accounts state) of None \\ 0 | Some x \\ x;\n paidMoney = min balance moneyToPay\n in giveMoney x21 x22 x23 paidMoney\n (if balance \\ moneyToPay then MList.delete (x21, x23) (accounts state)\n else MList.insert (x21, x23) (balance - paidMoney) (accounts state))\")\n by (metis ReduceStepResult.inject eq_iff)\n apply auto[1]\n apply (simp add: maxTimeOnlyDecreases_reduceStepWhen)\n apply (metis ReduceStepResult.inject eq_iff maxTimeContract.simps(6) reduceContractStep.simps(5))\n by simp\n\nlemma maxTimeNotAmbiguous_reduceLoop : \"maxTimeContract cont \\ iniTime \\\n iniTime \\ endTime \\\n reductionLoop reduced \\timeInterval = (iniTime, endTime)\\ sta cont x y \\ RRAmbiguousTimeIntervalError\"\n apply (induction reduced \"\\timeInterval = (iniTime, endTime)\\\" sta cont x y rule:reductionLoop.induct)\n subgoal premises facts for reduced state contract warnings payments\n apply (cases \"reduceContractStep \\timeInterval = (iniTime, endTime)\\ state contract\")\n apply (simp only:reductionLoop.simps ReduceStepResult.case)\n apply (simp only:Let_def)\n using facts(1) facts(2) facts(3) maxTimeOnlyDecreases_reduceStep apply fastforce\n apply auto[1]\n by (simp add: facts(2) facts(3) maxTimeNotAmbiguous_reduceStep)\n done\n\nlemma maxTimeNotAmbiguous : \"maxTimeContract cont \\ iniTime \\\n iniTime \\ endTime \\\n reduceContractUntilQuiescent \\timeInterval = (iniTime, endTime)\\ (sta\\minTime := iniTime\\) cont \\ RRAmbiguousTimeIntervalError\"\n using maxTimeNotAmbiguous_reduceLoop by auto\n\n\nlemma timedOutReduce_only_quiescent_in_close :\n \"minTime sta \\ iniTime \\\n maxTimeContract c \\ iniTime \\\n iniTime \\ endTime \\\n reduceContractStep \\timeInterval = (iniTime, endTime)\\ (sta\\minTime := iniTime\\) c = NotReduced \\ c = Close\"\n apply (cases c)\n apply blast\n apply (metis reduceContractStep.simps(2) reduceContractStepPayIsQuiescent)\n apply simp\n using timedOutReduce_only_quiescent_in_close_When apply blast\n apply (metis ReduceStepResult.distinct(1) reduceContractStep.simps(5))\n by simp\n\nlemma timedOutReduceStep_does_not_modify_minTime :\n \"minTime sta = iniTime \\\n reduceContractStep \\timeInterval = (iniTime, endTime)\\ sta contract =\n Reduced warning effect newState ncontract \\ minTime newState = iniTime\"\n apply (cases contract)\n apply simp\n apply (cases \"refundOne (accounts sta)\")\n apply simp\n subgoal for a\n apply (cases a)\n subgoal for aa\n apply (cases aa)\n by auto\n done\n subgoal for x21 x22 x23 x24\n apply (cases \"let moneyToPay = evalValue \\timeInterval = (iniTime, endTime)\\ sta x24\n in moneyToPay \\ 0\")\n apply auto[1]\n apply simp\n apply (cases \"giveMoney x21 x22 x23\n (min (case lookup (x21, x23) (accounts sta) of None \\ 0 | Some x \\ x)\n (evalValue \\timeInterval = (iniTime, endTime)\\ sta x24))\n (if (case lookup (x21, x23) (accounts sta) of None \\ 0 | Some x \\ x)\n \\ evalValue \\timeInterval = (iniTime, endTime)\\ sta x24\n then MList.delete (x21, x23) (accounts sta)\n else MList.insert (x21, x23)\n ((case lookup (x21, x23) (accounts sta) of None \\ 0 | Some x \\ x) -\n min (case lookup (x21, x23) (accounts sta) of None \\ 0 | Some x \\ x)\n (evalValue \\timeInterval = (iniTime, endTime)\\ sta x24))\n (accounts sta))\")\n by (auto simp:Let_def)\n apply auto[1]\n apply (smt ReduceStepResult.distinct(1) ReduceStepResult.distinct(3) ReduceStepResult.inject State.ext_inject State.surjective State.update_convs(4) prod.case_eq_if reduceContractStep.simps(4))\n apply (smt ReduceStepResult.inject State.ext_inject State.surjective State.update_convs(3) State.update_convs(4) reduceContractStep.simps(5))\n by simp\n\nlemma timedOutReduceContractLoop_closes_contract : \"minTime sta \\ iniTime \\\n maxTimeContract cont \\ iniTime \\\n iniTime \\ endTime \\\n minTime sta = iniTime \\\n reductionLoop reduced \\timeInterval = (iniTime, endTime)\\ sta cont x y =\n ContractQuiescent newReduced warning effect newState ncontract \\\n ncontract = Close\"\n apply (induction reduced \"\\timeInterval = (iniTime, endTime)\\\" sta cont x y arbitrary: warning effect newState ncontract rule:reductionLoop.induct)\n subgoal for reduced state contract warnings payments warning effect newState ncontract\n apply (simp only:reductionLoop.simps[of reduced \"\\timeInterval = (iniTime, endTime)\\\" \"(sta\\minTime := iniTime\\)\" contract warnings payments])\n apply (cases \"reduceContractStep \\timeInterval = (iniTime, endTime)\\ state contract\")\n subgoal for x11 x12 x13 x14\n apply (simp only:ReduceStepResult.case Let_def)\n subgoal premises facts\n apply (rule facts(1)[of x11 x12 x13 x14 \"(if x11 = ReduceNoWarning then warnings else x11 # warnings)\"\n \"(case x12 of ReduceNoPayment \\ payments | ReduceWithPayment payment \\ payment # payments)\"\n warning effect newState ncontract])\n apply simp\n apply simp\n apply simp\n apply simp\n using facts(3) facts(7) maxTimeOnlyDecreases_reduceStep apply fastforce\n apply simp\n using facts(5) facts(7) timedOutReduceStep_does_not_modify_minTime apply blast\n by (metis (no_types, lifting) ReduceStepResult.simps(8) facts(6) facts(7) reductionLoop.simps)\n done\n using timedOutReduce_only_quiescent_in_close apply fastforce\n using maxTimeNotAmbiguous_reduceStep by blast\n done\n\nlemma timedOutReduceContractUntilQuiescent_closes_contract :\n \"iniTime \\ minTime sta\n \\ iniTime \\ maxTimeContract cont\n \\ endTime \\ iniTime\n \\ reduceContractUntilQuiescent \\timeInterval = (max iniTime (minTime sta), endTime)\\ (sta\\minTime := max iniTime (minTime sta)\\) cont\n = ContractQuiescent reduced warning effect newState ncontract \\ ncontract = Close\"\n apply (simp only:reduceContractUntilQuiescent.simps)\n by (smt State.select_convs(4) State.surjective State.update_convs(4) timedOutReduceContractLoop_closes_contract)\n\nlemma timedOutReduceContractStep_empties_accounts :\n \"validAndPositive_state sta \\\n minTime sta \\ iniTime \\\n maxTimeContract cont \\ iniTime \\\n iniTime \\ endTime \\\n reduceContractUntilQuiescent \\timeInterval = (iniTime, endTime)\\ (sta\\minTime := iniTime\\) cont\n = ContractQuiescent reduced warning effect newState ncontract \\ accounts newState = []\"\n by (smt State.ext_inject State.surjective State.update_convs(4) allAccountsPositiveState.elims(3) isQuiescent.simps(1) positiveMoneyInAccountOrNoAccountImpliesAllAccountsPositive reduceContractUntilQuiecentIsQuiescent reduceContractUntilQuiescent.simps timedOutReduceContractLoop_closes_contract validAndPositiveImpliesPositive validAndPositiveImpliesValid validAndPositive_state.elims(3) valid_state.simps)\n\ntheorem timedOutTransaction_closes_contract :\n \"validAndPositive_state sta\n \\ iniTime \\ minTime sta\n \\ iniTime \\ maxTimeContract cont\n \\ endTime \\ iniTime\n \\ accounts sta \\ [] \\ cont \\ Close\n \\ isClosedAndEmpty (computeTransaction \\ interval = (iniTime, endTime)\n , inputs = [] \\ sta cont)\"\n apply (simp del:validAndPositive_state.simps reduceContractUntilQuiescent.simps add:Let_def)\n apply (cases \"reduceContractUntilQuiescent \\timeInterval = (max iniTime (minTime sta), endTime)\\ (sta\\minTime := max iniTime (minTime sta)\\) cont\")\n apply (simp only:ReduceResult.case list.case ApplyAllResult.case max_of_ge)\n apply (cases \"cont = Close\")\n apply (simp del:validAndPositive_state.simps reduceContractUntilQuiescent.simps)\n apply (metis maxTimeContract.simps(1) reduceContractUntilQuiescent.simps reductionLoopClose_is_Close timedOutReduceContractStep_empties_accounts)\n apply (simp del:validAndPositive_state.simps reduceContractUntilQuiescent.simps)\n subgoal for x11 x12 x13 x14 x15\n apply (rule mp[of x11])\n apply (metis max.orderE timedOutReduceContractStep_empties_accounts timedOutReduceContractUntilQuiescent_closes_contract)\n apply (rule mp[of \"x15 = Close\"])\n apply (metis (no_types, lifting) ReduceResult.inject ReduceStepResult.exhaust ReduceStepResult.simps(8) ReduceStepResult.simps(9) maxTimeNotAmbiguous_reduceStep reduceContractUntilQuiescent.simps reductionLoop.simps reductionLoop_reduce_monotonic)\n by (metis max.orderE timedOutReduceContractUntilQuiescent_closes_contract) \n apply (simp del:validAndPositive_state.simps reduceContractUntilQuiescent.simps)\n using maxTimeNotAmbiguous by auto\n\ncorollary timeOutTransaction_does_not_fail : \n assumes \"validAndPositive_state sta\"\n assumes \"emptyTxAfterDeadline = \\ interval = (iniTime, endTime), inputs = [] \\\"\n assumes \"iniTime \\ minTime sta\"\n and \"iniTime \\ maxTimeContract cont\"\n and \"endTime \\ iniTime\" \n assumes \"accounts sta \\ [] \\ cont \\ Close\"\n shows \"\\txOut. computeTransaction emptyTxAfterDeadline sta cont = TransactionOutput txOut\"\n using assms by (meson Timeout.isClosedAndEmpty.elims(2) timedOutTransaction_closes_contract)\n\ntheorem timeOutTransaction_closes_contract2 :\n \"validAndPositive_state sta\n \\ accounts sta \\ [] \\ cont \\ Close\n \\ \\ inp . isClosedAndEmpty (computeTransaction inp sta cont)\"\n by (meson not_less not_less_iff_gr_or_eq timedOutTransaction_closes_contract)\n\ntheorem timedOutTransaction_preserves_assets :\n assumes \"validAndPositive_state sta\"\n assumes \"emptyTxAfterDeadline = \\ interval = (iniTime, endTime), inputs = [] \\\"\n assumes \"iniTime \\ minTime sta\"\n and \"iniTime \\ maxTimeContract cont\"\n and \"endTime \\ iniTime\"\n assumes \"accounts sta \\ [] \\ cont \\ Close\"\n assumes \"computeTransaction emptyTxAfterDeadline sta cont = TransactionOutput txOut\"\n shows \"assetsInState sta = assetsInExternalPayments (txOutPayments txOut)\"\nproof -\n note assms\n moreover have \"assetsInState sta + assetsInTransaction emptyTxAfterDeadline \n = assetsInState (txOutState txOut) + assetsInExternalPayments (txOutPayments txOut)\"\n using computeTransaction_preserves_assets calculation by presburger\n moreover have \"accounts (txOutState txOut) = []\"\n using calculation by (metis Timeout.isClosedAndEmpty.simps(1) timedOutTransaction_closes_contract)\n ultimately show ?thesis by auto\nqed\n\nend\n", "meta": {"author": "input-output-hk", "repo": "marlowe", "sha": "d2f7b3108894b7c3169c71214f1a2772716544bf", "save_path": "github-repos/isabelle/input-output-hk-marlowe", "path": "github-repos/isabelle/input-output-hk-marlowe/marlowe-d2f7b3108894b7c3169c71214f1a2772716544bf/isabelle/Core/Timeout.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2503317346045022}} {"text": "(* Title: HOL/Library/Rewrite.thy\n Author: Christoph Traut, Lars Noschinski, TU Muenchen\n\nProof method \"rewrite\" with support for subterm-selection based on patterns.\n*)\n\ntheory Rewrite\nimports Main\nbegin\n\nconsts rewrite_HOLE :: \"'a::{}\" (\"\\\")\n\nlemma eta_expand:\n fixes f :: \"'a::{} \\ 'b::{}\"\n shows \"f \\ \\x. f x\" .\n\nlemma rewr_imp:\n assumes \"PROP A \\ PROP B\"\n shows \"(PROP A \\ PROP C) \\ (PROP B \\ PROP C)\"\n apply (rule Pure.equal_intr_rule)\n apply (drule equal_elim_rule2[OF assms]; assumption)\n apply (drule equal_elim_rule1[OF assms]; assumption)\n done\n\nlemma imp_cong_eq:\n \"(PROP A \\ (PROP B \\ PROP C) \\ (PROP B' \\ PROP C')) \\\n ((PROP B \\ PROP A \\ PROP C) \\ (PROP B' \\ PROP A \\ PROP C'))\"\n apply (intro Pure.equal_intr_rule)\n apply (drule (1) cut_rl; drule Pure.equal_elim_rule1 Pure.equal_elim_rule2; assumption)+\n apply (drule Pure.equal_elim_rule1 Pure.equal_elim_rule2; assumption)+\n done\n\nML_file \\cconv.ML\\\nML_file \\rewrite.ML\\\n\nend\n", "meta": {"author": "landonf", "repo": "isabelle-legacy", "sha": "e40f3ca7e9a42bb91e57fd15f969388e6e83f692", "save_path": "github-repos/isabelle/landonf-isabelle-legacy", "path": "github-repos/isabelle/landonf-isabelle-legacy/isabelle-legacy-e40f3ca7e9a42bb91e57fd15f969388e6e83f692/src/HOL/Library/Rewrite.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.542863297964157, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2502690892342978}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * This is a purely theoretical theory containing proofs\n * that the whileLoop rules in \"WhileLoopRules\" are complete.\n *\n * You probably don't care about this.\n *)\ntheory WhileLoopRulesCompleteness\nimports WhileLoopRules\nbegin\n\nlemma whileLoop_rule_strong_complete:\n \"(\\ \\s'. s' = s \\ whileLoop C B r \\ \\r s. (r, s) \\ fst Q \\\n \\ (\\r'' s''. (r'', s'') \\ fst Q \\ \\ \\s'. s' = s \\ whileLoop C B r \\\\ \\r s. r = r'' \\ s = s'' \\)\n \\ (snd Q \\ snd (whileLoop C B r s))\n \\ (\\ snd Q \\ \\ \\s'. s' = s \\ whileLoop C B r \\ \\_ _. True \\!))\n = (whileLoop C B r s = Q)\"\n apply (rule iffI)\n apply (rule whileLoop_rule_strong, auto)[1]\n apply (clarsimp simp: valid_def exs_valid_def validNF_alt_def)\n apply force\n done\n\nlemma valid_whileLoop_complete:\n \"(\\I.\n (\\s. P r s \\ I r s )\n \\ (\\r. \\ \\s. I r s \\ C r s \\ B r \\ I \\)\n \\ (\\r s. ( I r s \\ \\ C r s ) \\ Q r s))\n = \\ P r \\ whileLoop C B r \\ Q \\\"\n apply (rule iffI)\n apply clarsimp\n apply (rule_tac I=I in valid_whileLoop, auto)[1]\n apply (rule exI [where x=\"\\r s. \\ \\s'. s' = s \\ whileLoop C B r \\ Q \\\"])\n apply (intro conjI)\n apply (clarsimp simp: valid_def)\n apply (subst (2) valid_def)\n apply clarsimp\n apply (subst (asm) (2) whileLoop_unroll)\n apply (case_tac \"C a b\")\n apply (clarsimp simp: valid_def bind_def' Bex_def condition_def split: if_split_asm)\n apply force\n apply (clarsimp simp: valid_def bind_def' Bex_def condition_def split: if_split_asm)\n apply force\n apply (subst whileLoop_unroll)\n apply (clarsimp simp: valid_def bind_def' condition_def return_def)\n done\n\nlemma validNF_whileLoop_complete:\n \"(\\I R.\n (\\s. P r s \\ I r s )\n \\ (\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s\\ B r \\\\r' s'. I r' s' \\ ((r', s'), r, s) \\ R\\!)\n \\ (wf R)\n \\ (\\r s. ( I r s \\ \\ C r s ) \\ Q r s))\n = \\ P r \\ whileLoop C B r \\ Q \\!\"\n (is \"(\\I R. ?LHS I R) = ?RHS\")\nproof (rule iffI)\n assume lhs: \"\\I R. ?LHS I R\"\n\n obtain I R where \"?LHS I R\"\n using lhs\n by auto\n\n thus ?RHS\n by (rule_tac validNF_whileLoop [where I=I and R=R], auto)\nnext\n assume loop: \"?RHS\"\n\n define I where \"I \\ \\r s. \\ \\s'. s' = s \\ whileLoop C B r \\ \\r s. Q r s \\!\"\n define R where \"R \\ {(x, y). C (fst y) (snd y) \\ x \\ fst (B (fst y) (snd y)) \\\n whileLoop_terminates C B (fst y) (snd y)}\"\n\n have \"wf R\"\n using R_def whileLoop_terminates_wf\n by auto\n\n have start: \"\\s. P r s \\ I r s\"\n by (metis (full_types) I_def loop validNF_weaken_pre)\n\n have fin: \"\\r s. \\ I r s; \\ C r s \\ \\ Q r s\"\n apply (unfold I_def)\n apply (subst (asm) whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def'\n validNF_alt_def return_def)\n done\n\n have step: \"\\r s. \\\\s'. I r s' \\ C r s' \\ s' = s\\ B r\n \\\\r' s'. I r' s' \\ ((r', s'), r, s) \\ R\\!\"\n (is \"\\r s. \\ ?pre r s \\ B r \\ ?post r s \\!\")\n proof -\n have inv_step:\n \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ I r' s'\"\n apply (clarsimp simp: I_def)\n apply (subst (asm) whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def' validNF_alt_def)\n apply force\n done\n\n have R_step:\n \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ ((r', s'), (r, s)) \\ R\"\n apply (clarsimp simp: I_def R_def)\n apply (clarsimp simp: validNF_alt_def whileLoop_def)\n done\n\n show \"\\r s. ?thesis r s\"\n apply rule\n apply (clarsimp simp: valid_def inv_step R_step)\n apply (clarsimp simp: no_fail_def I_def validNF_alt_def)\n apply (drule (1) snd_whileLoop_first_step)\n apply simp\n done\n qed\n\n show \"\\I' R'. ?LHS I' R'\"\n using \\wf R\\ start fin step\n by blast\nqed\n\n\nlemma snd_whileLoop_complete:\n shows \"snd (whileLoop C B r s) =\n (\\I. I r s \\ C r s \\\n (\\r. \\ \\s. I r s \\ C r s \\ \\ snd (B r s) \\\n B r \\\\ \\r s. C r s \\ I r s \\))\"\n (is \"?LHS = ?RHS\")\nproof (rule iffI)\n assume \"?LHS\"\n thus \"?RHS\"\n apply (clarsimp simp: whileLoop_def)\n apply (erule disjE)\n apply (rule exI [where x=\"\\r s. (Some (r, s), None) \\ whileLoop_results C B\"])\n apply (intro conjI)\n apply simp\n apply (metis Pair_inject whileLoop_results_cases_fail)\n apply (clarsimp simp: exs_valid_def)\n apply (erule whileLoop_results_cases_fail, fastforce)\n apply clarsimp\n apply (erule bexI [rotated])\n apply clarsimp\n apply (metis fst_conv snd_conv whileLoop_results_cases_fail)\n apply (rule exI [where x=\"\\r s. \\ whileLoop_terminates C B r s\"])\n apply clarsimp\n apply (rule conjI)\n apply (subst (asm) whileLoop_terminates_simps)\n apply clarsimp\n apply (clarsimp simp: exs_valid_def)\n apply (subst (asm) (2) whileLoop_terminates_simps)\n apply clarsimp\n apply (erule bexI [rotated])\n apply clarsimp\n apply (subst (asm) (2) whileLoop_terminates_simps)\n apply clarsimp\n done\nnext\n assume \"?RHS\"\n thus \"?LHS\"\n apply clarsimp\n apply (erule (1) snd_whileLoop)\n apply force\n done\nqed\n\nlemma not_snd_whileLoop_complete:\n shows \"(\\ snd (whileLoop C B r s)) = (\\I R . I r s \\ wf R \\\n (\\r s r' s'. (I r s \\ C r s \\ (r', s') \\ fst (B r s)) \\ I r' s')\n \\ (\\r s. I r s \\ C r s \\ \\ snd (B r s))\n \\ (\\r s r' s'. I r s \\ C r s \\ (r', s') \\ fst (B r s) \\ ((r', s'), (r, s)) \\ R))\"\n (is \"?LHS = ?RHS\")\nproof (rule iffI)\n assume \"?RHS\"\n thus \"?LHS\"\n apply (clarsimp)\n apply (erule make_pos_goal, rule not_snd_whileLoop)\n apply assumption\n defer\n apply assumption\n apply (clarsimp simp: validNF_def no_fail_def valid_def)\n done\nnext\n assume no_fail: \"?LHS\"\n define I where \"I \\ \\r s. \\ snd (whileLoop C B r s)\"\n define R where \"R \\ {((r', s'), (r, s)). C r s \\ (r', s') \\ fst (B r s) \\\n whileLoop_terminates C B r s}\"\n\n have \"I r s\"\n by (clarsimp simp: I_def no_fail)\n\n moreover have \"wf R\"\n apply (rule wf_subset [OF whileLoop_terminates_wf [where C=C and B=B]])\n apply (clarsimp simp: R_def)\n done\n\n moreover have \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ I r' s'\"\n apply (clarsimp simp: I_def whileLoop_def)\n apply (rule conjI)\n apply (metis whileLoop_results_simps)\n apply (erule whileLoop_terminates_cases)\n apply clarsimp\n apply fastforce\n done\n\n moreover have \"\\r s. \\ I r s; C r s \\ \\ \\ snd (B r s)\"\n apply (clarsimp simp: I_def)\n apply (subst (asm) whileLoop_unroll)\n apply (clarsimp simp: condition_true bind_def)\n done\n\n moreover have \"\\r s r' s'. \\ I r s; C r s; (r', s') \\ fst (B r s) \\ \\ ((r', s'), (r, s)) \\ R\"\n apply (clarsimp simp: R_def)\n apply (metis I_def snd_conv whileLoop_def)\n done\n\n ultimately show ?RHS\n by (metis (mono_tags))\nqed\n\n\nfun valid_path\nwhere\n \"valid_path C B [] = False\"\n | \"valid_path C B [x] = (\\ C (fst x) (snd x))\"\n | \"valid_path C B (x#y#xs) = ((C (fst x) (snd x) \\ y \\ fst (B (fst x) (snd x)) \\ valid_path C B (y#xs)))\"\n\ndefinition \"shortest_path_length C B x Q \\\n (LEAST n. \\l. valid_path C B l \\ hd l = x \\ Q (fst (last l)) (snd (last l)) \\ length l = n)\"\n\nlemma shortest_path_length_same [simp]:\n \"\\ \\ C (fst a) (snd a); Q (fst a) (snd a) \\ \\ shortest_path_length C B a Q = 1\"\n apply (clarsimp simp: shortest_path_length_def)\n apply (rule Least_equality)\n apply (rule exI [where x=\"[a]\"])\n apply clarsimp\n apply (case_tac \"y = 0\")\n apply clarsimp\n apply clarsimp\n done\n\nlemma valid_path_simp:\n \"valid_path C B l =\n (((\\r s. l = [(r, s)] \\ \\ C r s) \\\n (\\r s r' s' xs. l = (r, s)#(r', s')#xs \\ C r s \\ (r', s') \\ fst (B r s) \\ valid_path C B ((r', s')#xs))))\"\n apply (case_tac l)\n apply clarsimp\n apply (case_tac list)\n apply clarsimp\n apply clarsimp\n done\n\nlemma path_exists:\n assumes path: \"\\ \\s'. s' = s \\ whileLoop C B r \\\\ Q \\\"\n shows \"\\l. valid_path C B l \\ hd l = (r, s) \\ Q (fst (last l)) (snd (last l))\"\nproof -\n {\n fix r' s'\n assume x: \"(r', s') \\ fst (whileLoop C B r s)\"\n assume y: \"Q r' s'\"\n have ?thesis\n using x y\n apply (induct rule: in_whileLoop_induct)\n apply (rule_tac x=\"[(r,s)]\" in exI)\n apply clarsimp\n apply clarsimp\n apply (case_tac l)\n apply clarsimp\n apply (rule_tac x=\"(r, s)#l\" in exI)\n apply clarsimp\n done\n }\n\n thus ?thesis\n using path\n by (clarsimp simp: exs_valid_def)\nqed\n\nlemma shortest_path_exists:\n \"\\ \\ \\s'. s' = s \\ whileLoop C B r \\\\ Q \\ \\ \\\n \\l. valid_path C B l\n \\ shortest_path_length C B (r, s) Q = length l\n \\ hd l = (r, s)\n \\ Q (fst (last l)) (snd (last l))\"\n apply (frule path_exists)\n apply (clarsimp simp: simp: shortest_path_length_def)\n apply (rule LeastI2_ex)\n apply force\n apply force\n done\n\nlemma shortest_path_is_shortest:\n \"\\ valid_path C B l; Q (fst (last l)) (snd (last l)) \\ \\ shortest_path_length C B (hd l) Q \\ length l\"\n apply (clarsimp simp: simp: shortest_path_length_def)\n apply (rule Least_le)\n apply force\n done\n\nlemma valid_path_implies_exs_valid_whileLoop:\n \"valid_path C B l \\ \\ \\s. s = snd (hd l) \\ whileLoop C B (fst (hd l)) \\\\ \\r s. (r, s) = last l \\\"\n apply (induct l)\n apply clarsimp\n apply clarsimp\n apply rule\n apply clarsimp\n apply (subst whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def' exs_valid_def return_def)\n apply clarsimp\n apply (subst whileLoop_unroll)\n apply (clarsimp simp: condition_def bind_def' exs_valid_def return_def)\n apply rule\n apply (clarsimp split: prod.splits)\n apply (case_tac l)\n apply clarsimp\n apply (clarsimp split del: if_split)\n apply (erule bexI [rotated])\n apply clarsimp\n apply clarsimp\n apply (case_tac l, auto)\n done\n\nlemma shortest_path_gets_shorter:\n \"\\ \\ \\s'. s' = s \\ whileLoop C B r \\\\ Q \\;\n C r s \\\n \\ \\(r', s') \\ fst (B r s).\n shortest_path_length C B (r', s') Q < shortest_path_length C B (r, s) Q\n \\ \\ \\s. s = s' \\ whileLoop C B r' \\\\ Q \\\"\n apply (drule shortest_path_exists)\n apply clarsimp\n apply (case_tac l)\n apply clarsimp\n apply (case_tac list)\n apply clarsimp\n apply (rule_tac x=\"aa\" in bexI)\n apply clarify\n apply (simp only: valid_path.simps, clarify)\n apply (frule shortest_path_is_shortest [where Q=Q])\n apply simp\n apply clarsimp\n apply (drule valid_path_implies_exs_valid_whileLoop)\n apply (clarsimp simp: exs_valid_def)\n apply (erule bexI [rotated])\n apply (clarsimp split: if_split_asm)\n apply clarsimp\n done\n\nlemma exs_valid_whileLoop_complete:\n \"(\\T R.\n (\\s. P s \\ T r s)\n \\ (\\r s0. \\ \\s. T r s \\ C r s \\ s = s0 \\ B r\n \\\\ \\r' s'. T r' s' \\ ((r', s'), (r, s0)) \\ R \\)\n \\ wf R\n \\ (\\r s. (T r s \\ \\ C r s) \\ Q r s))\n = (\\ P \\ whileLoop C B r \\\\ Q \\)\"\n (is \"(\\T R. ?LHS T R) = ?RHS\")\nproof (rule iffI)\n assume lhs: \"\\T R. ?LHS T R\"\n obtain T R where TR: \"?LHS T R\"\n using lhs\n by blast\n\n show \"?RHS\"\n by (rule exs_valid_whileLoop [where T=T and R=R], auto simp: TR)\nnext\n assume rhs: \"?RHS\"\n\n define I where \"I \\ \\r s. \\ \\s'. s' = s \\ whileLoop C B r \\\\ Q \\\"\n\n define R where \"R \\ measure (\\(r, s). shortest_path_length C B (r, s) Q)\"\n\n have P_s: \"\\s. P s \\ I r s\"\n using rhs\n by (clarsimp simp: I_def exs_valid_def)\n\n have inv_holds: \"\\r s. \\ I r s; C r s \\ \\\n \\(r', s') \\ fst (B r s). I r' s' \\ ((r', s'), r, s) \\ R\"\n apply (clarsimp simp: I_def R_def)\n apply (frule (1) shortest_path_gets_shorter)\n apply clarsimp\n apply (rule bexI [rotated], assumption)\n apply clarsimp\n done\n\n have wf_R: \"wf R\"\n by (clarsimp simp: R_def)\n\n have last_step: \"\\r s. \\ I r s; \\ C r s \\ \\ Q r s\"\n apply (clarsimp simp: I_def exs_valid_def)\n apply (metis in_return whileLoop_cond_fail)\n done\n\n show \"\\I R. ?LHS I R\"\n apply (rule exI [where x=I])\n apply (rule exI [where x=R])\n using P_s inv_holds wf_R last_step\n apply (clarsimp simp: exs_valid_def)\n done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/WhileLoopRulesCompleteness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.2502690824150981}} {"text": "theory Simulation\n imports Semantics\nbegin\n\ncontext env begin\n\ndefinition\n \"simulation\" :: \"'b \\ ('a, 'b, 'c) psi \\\n ('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set \\ \n ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\[_] _\" [80, 80, 80, 80] 80)\nwhere\n \"\\ \\ P \\[Rel] Q \\ \\\\ \\ Q'. \\ \\ Q \\\\ @ \\ \\ Q' \\ bn \\ \\* \\ \\ bn \\ \\* P \\ (\\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel)\"\n\nabbreviation\n simulation_nil_judge (\"_ \\[_] _\" [80, 80, 80] 80) where \"P \\[Rel] Q \\ S_bottom' \\ P \\[Rel] Q\"\n\nlemma simI[consumes 1, case_names c_sim]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assumes Eqvt: \"eqvt Rel\"\n and Sim: \"\\\\ \\ Q'. \\\\ \\ Q \\\\ @ \\ \\ Q'; bn \\ \\* P; bn \\ \\* Q; bn \\ \\* \\; bn \\ \\* \\; distinct(bn \\);\n bn \\ \\* (subject \\); bn \\ \\* C\\ \\ \\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\n\n shows \"\\ \\ P \\[Rel] Q\"\nproof(auto simp add: simulation_def)\n fix \\ \\ Q'\n assume \"\\ \\ Q \\\\ @ \\ \\ Q'\" and \"bn \\ \\* \\\" and \"bn \\ \\* P\"\n thus \"\\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\n proof(nominal_induct \\ rule: action.strong_induct)\n case(In M N)\n thus ?case by(rule_tac Sim) auto\n next\n case(Out M xvec N)\n moreover {\n fix M xvec N Q'\n assume \"(xvec::name list) \\* \\\" and \"xvec \\* P\"\n obtain p where xvec_fresh_psi: \"((p::name prm) \\ (xvec::name list)) \\* \\\"\n and xvec_freshM: \"(p \\ xvec) \\* (M::'a)\"\n and xvec_freshN: \"(p \\ xvec) \\* (N::'a)\"\n and xvec_freshP: \"(p \\ xvec) \\* P\"\n and xvec_freshQ: \"(p \\ xvec) \\* Q\"\n and xvec_fresh_pi: \"(p \\ xvec) \\* \\\"\n and xvec_freshQ': \"(p \\ xvec) \\* (Q'::('a, 'b, 'c) psi)\"\n and xvec_freshC: \"(p \\ xvec) \\* C\"\n and xvec_freshxvec: \"(p \\ xvec) \\* xvec\"\n and S: \"(set p) \\ (set xvec) \\ (set(p \\ xvec))\"\n and dpr: \"distinct_perm p\"\n\tby(rule_tac xvec=xvec and c=\"(\\, M, Q, N, P, Q', \\, xvec, C)\" in name_list_avoiding)\n (auto simp add: eqvts fresh_star_prod)\n\n from `(p \\ xvec) \\* M` `distinct_perm p` have \"xvec \\* (p \\ M)\"\n\tby(subst pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst, where pi=p, symmetric]) simp\n\n assume Trans: \"\\ \\ Q \\\\ @ M\\\\*xvec\\\\N\\ \\ Q'\"\n with xvec_freshN xvec_freshQ' S\n have \"\\ \\ Q \\\\ @ M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ (p \\ Q')\"\n\tby(simp add: bound_output_chain_alpha'' residual_inject)\n moreover hence \"distinct(p \\ xvec)\" by(auto dest: bound_output_distinct)\n \n moreover note xvec_fresh_psi xvec_freshP xvec_freshQ xvec_freshM xvec_freshC xvec_fresh_pi\n ultimately obtain \\' P' where P_trans: \"\\ \\ P \\\\' @ M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ P'\"\n and P'_rel_q': \"(\\, P', p \\ Q') \\ Rel\"\n\tby(drule_tac Sim) auto\n hence \"(p \\ \\) \\ (p \\ P) \\(p\\\\') @ (p \\ (M\\\\*(p \\ xvec)\\\\(p \\ N)\\ \\ P'))\"\n\tby(rule_tac semantics.eqvt)\n moreover from xvec_freshP `xvec \\* P` P_trans\n have \"xvec \\* \\'\" \"(p\\xvec) \\* \\'\"\n by(auto intro: trans_fresh_provenance)\n moreover note `xvec \\* \\` xvec_fresh_psi `xvec \\* P` xvec_freshP S dpr\n ultimately have \"\\ \\ P \\\\' @ (p \\ M)\\\\*xvec\\\\N\\ \\ (p \\ P')\"\n\tby(simp add: eqvts name_set_fresh_fresh)\n with `xvec \\* \\` xvec_fresh_psi `xvec \\* P` xvec_freshP S `xvec \\* (p \\ M)`\n have \"\\ \\ P \\\\' @ (p \\ p \\ M)\\\\*xvec\\\\N\\ \\ (p \\ P')\"\n by(rule_tac output_perm_subject)\n (simp add: fresh_star_def | assumption)+\n\n with dpr have \"\\ \\ P \\\\' @ M\\\\*xvec\\\\N\\ \\ (p \\ P')\"\n\tby simp\n\n moreover from P'_rel_q' Eqvt have \"(p \\ \\, p \\ P', p \\ p \\ Q') \\ Rel\"\n\tapply(simp add: eqvt_def eqvts)\n\tapply(erule_tac x=\"(\\, P', p \\ Q')\" in ballE)\n\tapply(erule_tac x=\"p\" in allE)\n\tby(auto simp add: eqvts)\n with `xvec \\* \\` xvec_fresh_psi S dpr have \"(\\, p \\ P', Q') \\ Rel\" by simp\n ultimately have \"\\\\' P'. \\ \\ P \\ \\' @ M\\\\*xvec\\\\N\\ \\ P' \\ (\\, P', Q') \\ Rel\"\n\tby blast\n }\n ultimately show ?case by force\n next\n case Tau\n thus ?case by(rule_tac Sim) auto\n qed\nqed\n\nlemma simI2[case_names c_sim]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and C :: \"'d::fs_name\"\n\n assumes Sim: \"\\\\ \\ Q'. \\\\ \\ Q \\\\ @ \\ \\ Q'; bn \\ \\* P; bn \\ \\* \\; distinct(bn \\)\\ \\ \\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\n\n shows \"\\ \\ P \\[Rel] Q\"\nusing assms\nby(force simp add: simulation_def dest: bound_output_distinct)\n\nlemma sim_i_chain_fresh[consumes 4, case_names c_sim]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and xvec :: \"name list\"\n and C :: \"'d::fs_name\"\n\n assumes Eqvt: \"eqvt Rel\"\n and \"xvec \\* \\\"\n and \"xvec \\* P\"\n and \"xvec \\* Q\"\n and Sim: \"\\\\ \\ Q'. \\\\ \\ Q \\\\ @ \\ \\ Q'; bn \\ \\* P; bn \\ \\* Q; bn \\ \\* \\; bn \\ \\* \\;\n bn \\ \\* subject \\; distinct(bn \\); bn \\ \\* C; xvec \\* \\; xvec \\* \\; xvec \\* Q'\\ \\\n \\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\n shows \"\\ \\ P \\[Rel] Q\"\nusing `eqvt Rel`\nproof(induct rule: simI[where C=\"(xvec, C)\"])\n case(c_sim \\ \\ Q')\n from `xvec \\* Q` `\\ \\ Q \\\\ @ \\ \\ Q'` have \"xvec \\* \\\"\n by(auto intro: trans_fresh_provenance)\n from `bn \\ \\* (xvec, C)` have \"bn \\ \\* xvec\" and \"bn \\ \\* C\" by(simp add: fresh_chain_sym)+ \n obtain p::\"name prm\" where \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* Q\" and \"(p \\ xvec) \\* \\\"\n and \"(p \\ xvec) \\* \\\" and S: \"set p \\ set xvec \\ set(p \\ xvec)\"\n and \"distinct_perm p\"\n by(rule_tac c=\"(\\, P, Q, \\, \\)\" and xvec=xvec in name_list_avoiding) auto\n show ?case\n proof(cases rule: action_cases[where \\=\\])\n case(c_input M N)\n from `\\ \\ Q \\\\ @ \\ \\ Q'` `\\=M\\N\\` have \"(p \\ \\) \\ (p \\ Q) \\(p\\\\) @ (p \\ (M\\N\\ \\ Q'))\"\n by(force intro: semantics.eqvt)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` `xvec \\* Q` `(p \\ xvec) \\* Q` S `(p\\xvec) \\* \\` `xvec \\* \\`\n have Q_trans: \"\\ \\ Q \\\\ @ (p \\ M)\\(p \\ N)\\ \\ (p \\ Q')\"\n by(simp add: eqvts)\n moreover from `(p \\ xvec) \\* \\` have \"(p \\ (p \\ xvec)) \\* (p \\ \\)\"\n by(simp only: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst]) \n with `distinct_perm p` `\\=M\\N\\` have \"xvec \\* (p \\ M)\" and \"xvec \\* (p \\ N)\" by simp+\n moreover with Q_trans `xvec \\* Q` have \"xvec \\* (p \\ Q')\" by(rule_tac input_fresh_chain_derivative)\n ultimately have \"\\\\' P'. \\ \\ P \\ \\' @ (p \\ M)\\(p \\ N)\\ \\ P' \\ (\\, P', (p \\ Q')) \\ Rel\"\n using `xvec \\* \\`\n by(rule_tac Sim) (assumption | simp)+\n then obtain \\' P' where P_trans: \"\\ \\ P \\ \\' @ (p \\ M)\\(p \\ N)\\ \\ P'\" and P'_rel_q': \"(\\, P', (p \\ Q')) \\ Rel\"\n by blast\n from P_trans have \"(p \\ \\) \\ (p \\ P) \\ (p\\\\') @ (p \\ ((p \\ M)\\(p \\ N)\\ \\ P'))\"\n by(rule semantics.eqvt)\n moreover from P_trans `xvec \\* P` `(p\\xvec) \\* P` have \"xvec \\* \\'\" \"(p\\xvec) \\* \\'\"\n by(auto intro: trans_fresh_provenance)\n moreover note `xvec \\* \\` `(p \\ xvec) \\* \\` `xvec \\* P` `(p \\ xvec) \\* P` S `distinct_perm p`\n ultimately have \"\\ \\ P \\ \\' @ M\\N\\ \\ (p \\ P')\"\n by(simp add: eqvts)\n moreover from P'_rel_q' `eqvt Rel` have \"(p \\ \\, p \\ P', p \\ p \\ Q') \\ Rel\"\n by(auto simp add: eqvt_def)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S `distinct_perm p`\n have \"(\\, p \\ P', Q') \\ Rel\" by simp\n ultimately show ?thesis using `\\=M\\N\\` by blast\n next\n case(c_output M yvec N)\n from `distinct(bn \\)` `bn \\ \\* subject \\` `\\=M\\\\*yvec\\\\N\\` have \"distinct yvec\" and \"yvec \\* M\" by simp+\n from `\\ \\ Q \\\\ @ \\ \\ Q'` `\\=M\\\\*yvec\\\\N\\` have \"(p \\ \\) \\ (p \\ Q) \\(p \\ \\) @ (p \\ (M\\\\*yvec\\\\N\\ \\ Q'))\"\n by(force intro: semantics.eqvt)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` `xvec \\* Q` `(p \\ xvec) \\* Q` S `xvec \\* \\` `(p\\xvec) \\* \\`\n have Q_trans: \"\\ \\ Q \\\\ @ (p \\ M)\\\\*(p \\ yvec)\\\\(p \\ N)\\ \\ (p \\ Q')\"\n by(simp add: eqvts)\n with S `bn \\ \\* xvec` `(p \\ xvec) \\* \\` `\\=M\\\\*yvec\\\\N\\` have \"\\ \\ Q \\\\ @ (p \\ M)\\\\*yvec\\\\(p \\ N)\\ \\ (p \\ Q')\"\n by simp\n moreover from `(p \\ xvec) \\* \\` have \"(p \\ (p \\ xvec)) \\* (p \\ \\)\"\n by(simp only: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst]) \n with `distinct_perm p` `\\=M\\\\*yvec\\\\N\\` have \"xvec \\* (p \\ M)\" and \"xvec \\* (p \\ N)\" and \"xvec \\* (p \\ yvec)\" by simp+\n moreover with Q_trans `xvec \\* Q` `distinct yvec` `yvec \\* M` have \"xvec \\* (p \\ Q')\"\n by(drule_tac output_fresh_chain_derivative(2)) (auto simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n moreover from `yvec \\* M` S `bn \\ \\* xvec` `(p \\ xvec) \\* \\` `\\=M\\\\*yvec\\\\N\\` `distinct_perm p`\n have \"yvec \\* (p \\ M)\" by(subst pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst, symmetric, where pi=p]) simp\n ultimately have \"\\\\' P'. \\ \\ P \\\\' @ (p \\ M)\\\\*yvec\\\\(p \\ N)\\ \\ P' \\ (\\, P', (p \\ Q')) \\ Rel\"\n using `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* Q``bn \\ \\* xvec` `bn \\ \\* C` `yvec \\* M` `\\=M\\\\*yvec\\\\N\\` `distinct yvec` `bn \\ \\* \\` `xvec \\* \\`\n by(rule_tac Sim) auto\n then obtain \\' P' where P_trans: \"\\ \\ P \\ \\' @ (p \\ M)\\\\*yvec\\\\(p \\ N)\\ \\ P'\" and P'_rel_q': \"(\\, P', (p \\ Q')) \\ Rel\"\n by blast\n from P_trans have \"(p \\ \\) \\ (p \\ P) \\ (p\\\\') @ (p \\ ((p \\ M)\\\\*yvec\\\\(p \\ N)\\ \\ P'))\"\n by(rule semantics.eqvt)\n moreover from P_trans `xvec \\* P` `(p\\xvec) \\* P` have \"xvec \\* \\'\" \"(p\\xvec) \\* \\'\"\n by(auto intro: trans_fresh_provenance) \n moreover note `xvec \\* \\` `(p \\ xvec) \\* \\` `xvec \\* P` `(p \\ xvec) \\* P` S `distinct_perm p` `bn \\ \\* xvec` `(p \\ xvec) \\* \\` `\\=M\\\\*yvec\\\\N\\`\n ultimately have \"\\ \\ P \\ \\' @ M\\\\*yvec\\\\N\\ \\ (p \\ P')\" by(simp add: eqvts)\n moreover from P'_rel_q' `eqvt Rel` have \"(p \\ \\, p \\ P', p \\ p \\ Q') \\ Rel\"\n by(auto simp add: eqvt_def)\n with `xvec \\* \\` `(p \\ xvec) \\* \\` S `distinct_perm p`\n have \"(\\, p \\ P', Q') \\ Rel\" by simp\n ultimately show ?thesis using `\\=M\\\\*yvec\\\\N\\` by blast\n next\n case c_tau\n from `\\ \\ Q \\\\ @ \\ \\ Q'` `\\ = \\` `xvec \\* Q` have \"xvec \\* Q'\"\n by(blast dest: tau_fresh_chain_derivative)\n with `\\ \\ Q \\\\ @ \\ \\ Q'` `\\ = \\` `xvec \\* \\`\n show ?thesis by(drule_tac Sim) auto\n qed\nqed\n\nlemma sim_i_fresh[consumes 4, case_names c_sim]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and x :: name\n and C :: \"'d::fs_name\"\n\n assumes Eqvt: \"eqvt Rel\"\n and \"x \\ \\\"\n and \"x \\ P\"\n and \"x \\ Q\"\n and \"\\\\ \\ Q'. \\\\ \\ Q \\\\ @ \\ \\ Q'; bn \\ \\* P; bn \\ \\* Q; bn \\ \\* \\; bn \\ \\* \\;\n bn \\ \\* subject \\; distinct(bn \\); bn \\ \\* C; x \\ \\; x \\ Q'; x \\ \\\\ \\\n \\\\' P'. \\ \\ P \\\\' @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\n\n shows \"\\ \\ P \\[Rel] Q\"\nusing assms\nby(rule_tac xvec=\"[x]\" and C=C in sim_i_chain_fresh) auto\n\nlemma simE:\n fixes F :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\[Rel] Q\"\n\n shows \"\\\\ \\ Q'. \\\\ \\ Q \\\\ @ \\ \\ Q'; bn \\ \\* \\; bn \\ \\* P\\ \\ \\\\ P'. \\ \\ P \\\\ @ \\ \\ P' \\ (\\, P', Q') \\ Rel\"\nusing assms\nby(auto simp add: simulation_def)\n\nlemma sim_closed_aux:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes Eqvt_rel: \"eqvt Rel\"\n and P_simQ: \"\\ \\ P \\[Rel] Q\"\n\n shows \"(p \\ \\) \\ (p \\ P) \\[Rel] (p \\ Q)\"\nusing Eqvt_rel\nproof(induct rule: simI[of _ _ _ _ \"(\\, P, p)\"])\n case(c_sim \\ \\ Q')\n from `p \\ \\ \\ p \\ Q \\\\ @ \\ \\ Q'` \n have \"(rev p \\ p \\ \\) \\ (rev p \\ p \\ Q) \\(rev p \\ \\) @ (rev p \\ (\\ \\ Q'))\"\n by(blast dest: semantics.eqvt)\n hence \"\\ \\ Q \\(rev p \\ \\) @ (rev p \\ \\) \\ (rev p \\ Q')\"\n by(simp add: eqvts)\n moreover with `bn \\ \\* (\\, P, p)` have \"bn \\ \\* \\\" and \"bn \\ \\* P\" and \"bn \\ \\* p\" by simp+\n ultimately obtain \\' P' where P_trans: \"\\ \\ P \\\\' @ (rev p \\ \\) \\ P'\"\n and P'_rel_q': \"(\\, P', rev p \\ Q') \\ Rel\"\n using P_simQ\n by(force dest!: simE fresh_chain_perm_simp simp add: eqvts)\n from P_trans have \"(p \\ \\) \\ (p \\ P) \\(p\\ \\') @ (p \\ ((rev p \\ \\) \\ P'))\"\n by(rule semantics.eqvt)\n with `bn \\ \\* p` have \"(p \\ \\) \\ (p \\ P) \\(p\\\\') @ \\ \\ (p \\ P')\"\n by(simp add: eqvts fresh_chain_perm_simp)\n moreover from P'_rel_q' Eqvt_rel have \"(p \\ (\\, P', rev p \\ Q')) \\ Rel\"\n by(simp only: eqvt_def)\n hence \"(p \\ \\, p \\ P', Q') \\ Rel\" by simp\n ultimately show ?case by blast\nqed\n\nlemma sim_closed:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and p :: \"name prm\"\n\n assumes Eqvt_rel: \"eqvt Rel\"\n\n shows \"\\ \\ P \\[Rel] Q \\ (p \\ \\) \\ (p \\ P) \\[Rel] (p \\ Q)\"\n and \"P \\[Rel] Q \\ (p \\ P) \\[Rel] (p \\ Q)\"\nusing Eqvt_rel\nby(force dest: sim_closed_aux simp add: perm_bottom)+\n\nlemma reflexive:\n fixes Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n\n assumes \"{(\\, P, P) | \\ P. True} \\ Rel\"\n\n shows \"\\ \\ P \\[Rel] P\"\nusing assms\nby(force simp add: simulation_def)\n(*\nlemma sim_res[consumes 11, case_names c_open c_res]:\n fixes \\ :: 'b\n and x :: name\n and Q :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and Q' :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and C :: \"'d::fs_name\"\n and \\' :: 'b\n\n assumes Trans: \"\\ \\ \\\\x\\Q \\M\\\\*xvec\\\\N\\ \\ Q'\"\n and \"x \\ xvec\"\n and \"x \\ \\\"\n and \"x \\ M\"\n and \"x \\ \\'\"\n and \"x \\ P\"\n and \"eqvt Rel\"\n and \"xvec \\* \\\"\n and \"xvec \\* \\'\"\n and \"xvec \\* P\"\n and \"xvec \\* C\"\n and r_open: \"\\xvec1 xvec2 y N Q'. \\\\ \\ Q \\M\\\\*(xvec1@xvec2)\\\\N\\ \\ Q'; x \\ supp N; x \\ xvec1; x \\ xvec2; xvec1 \\* \\; xvec1 \\* \\'; xvec1 \\* P; xvec1 \\* C;\n xvec2 \\* \\; xvec2 \\* \\'; xvec2 \\* P; xvec2 \\* C; x \\ y; y \\ xvec1; y \\ xvec2; y \\ \\; y \\ P; y \\ C\\ \\ \n \\P'. \\' \\ P \\(([(x, y)] \\ G) (xvec1@x#xvec2) N P') \\ (\\', P', ([(x, y)] \\ F) Q') \\ Rel\"\n and r_scope: \"\\N Q'. \\\\ \\ Q \\ M\\\\*xvec\\\\N\\ \\ Q'; x \\ N\\ \\ \\P'. \\' \\ P \\(G xvec N P') \\ (\\', P', F (\\\\x\\Q')) \\ Rel\"\n \n shows \"\\P'. \\' \\ P \\(G xvec N P') \\ (\\', P', F Q') \\ Rel\"\nusing Trans `x \\ xvec` `x \\ \\` `x \\ M`\nproof(induct rule: res_casesB)\n case(c_open xvec1 xvec2 y N Q')\n note `\\ \\ Q \\M\\\\*(xvec1@xvec2)\\\\([(x, y)] \\ N)\\ \\ ([(x, y)] \\ Q')`\n moreover from `y \\ supp N` have \"([(x, y)] \\ y) \\ [(x, y)] \\ (supp N)\"\n by(simp add: pt_set_bij[OF pt_name_inst, OF at_name_inst])\n with `x \\ y` have \"x \\ supp([(x, y)] \\ N)\" by(simp add: calc_atm eqvts)\n moreover from `xvec = xvec1@y#xvec2` `xvec \\* \\` `xvec \\* \\'` `xvec \\* P` `xvec \\* C` `x \\ xvec`\n have \"xvec1 \\* \\\" and \"xvec1 \\* \\'\" and \"xvec1 \\* P\" and \"xvec1 \\* C\"\n and \"xvec2 \\* \\\" and \"xvec2 \\* \\'\" and \"xvec2 \\* P\" and \"xvec2 \\* C\"\n and \"y \\ \\\" and \"y \\ \\'\" and \"y \\ P\" and \"x \\ xvec1\" and \"x \\ xvec2\" and \"y \\ C\"\n by(simp add: fresh_list_cons fresh_list_append)+ \n ultimately obtain P' where P_trans: \"\\' \\ P \\(([(x, y)] \\ G) (xvec1@x#xvec2) ([(x, y)] \\ N) P')\"\n and P'_rel_q': \"(\\', P', ([(x, y)] \\ F) ([(x, y)] \\ Q')) \\ Rel\"\n using `y \\ xvec1` `y \\ xvec2` `x \\ y`\n by(blast dest: r_open)\n \n from P_trans have \"([(x, y)] \\ \\') \\ ([(x, y)] \\ P) \\ [(x, y)] \\ (([(x, y)] \\ G) (xvec1@x#xvec2) ([(x, y)] \\ N) P')\"\n by(rule semantics.eqvt)\n with `x \\ \\'` `y \\ \\'` `x \\ P` `y \\ P` `x \\ xvec1` `y \\ xvec1` `x \\ xvec2` `y \\ xvec2` `x \\ y` `xvec = xvec1@y#xvec2`\n have \"\\' \\ P \\(G xvec N ([(x, y)] \\ P'))\"\n by(simp add: pt_fun_app_eq perm_fun_def eqvts calc_atm)\n moreover from P'_rel_q' `eqvt Rel` have \"([(x, y)] \\ \\', [(x, y)] \\ P', ([(x, y)] \\ (([(x, y)] \\ F) ([(x, y)] \\ Q')))) \\ Rel\"\n by(simp only: eqvt_def) auto\n with `x \\ \\'` `y \\ \\'` `x \\ y`have \"(\\', [(x, y)] \\ P', F Q') \\ Rel\"\n by(simp add: eqvts pt_fun_app_eq[OF pt_name_inst, OF at_name_inst, of _ \"([(x, y)] \\ F)\"])\n ultimately show ?case by blast\nnext\n case(c_res N Q')\n thus ?case by(blast intro: r_scope)\nqed\n*)\n\n\n assumes P_simQ: \"\\ \\ P \\[Rel] Q\"\n and Q_simR: \"\\ \\ Q \\[Rel'] R\"\n and Eqvt: \"eqvt Rel''\"\n and Set: \"{(\\, P, R) | \\ P R. \\Q. (\\, P, Q) \\ Rel \\ (\\, Q, R) \\ Rel'} \\ Rel''\"\n\n shows \"\\ \\ P \\[Rel''] R\"\nusing `eqvt Rel''`\nproof(induct rule: simI[where C=Q])\n case(c_sim \\ \\ R')\n from Q_simR `\\ \\ R \\\\ @ \\ \\ R'` `(bn \\) \\* \\` `(bn \\) \\* Q`\n obtain \\' Q' where Q_trans: \"\\ \\ Q \\\\' @ \\ \\ Q'\" and Q'_rel'_r': \"(\\, Q', R') \\ Rel'\"\n by(blast dest: simE)\n from P_simQ Q_trans `bn \\ \\* \\` `bn \\ \\* P`\n obtain \\'' P' where P_trans: \"\\ \\ P \\\\'' @ \\ \\ P'\" and P'_rel_q': \"(\\, P', Q') \\ Rel\"\n by(blast dest: simE)\n with P_trans Q'_rel'_r' P'_rel_q' Set\n show ?case by blast\nqed\n\nlemma stat_eq_sim:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes P_simQ: \"\\ \\ P \\[Rel] Q\"\n and \"eqvt Rel'\"\n and \"\\ \\ \\'\"\n and C1: \"\\\\'' R S \\'''. \\(\\'', R, S) \\ Rel; \\'' \\ \\'''\\ \\ (\\''', R, S) \\ Rel'\"\n\n shows \"\\' \\ P \\[Rel'] Q\"\nusing `eqvt Rel'`\nproof(induct rule: simI[of _ _ _ _ \\])\n case(c_sim \\ \\ Q')\n from `\\' \\ Q \\\\ @ \\ \\ Q'` `\\ \\ \\'`\n have \"\\ \\ Q \\\\ @ \\ \\ Q'\" by(metis stat_eq_transition Assertion_stat_eq_sym)\n with P_simQ `bn \\ \\* \\` `bn \\ \\* P`\n obtain \\' P' where \"\\ \\ P \\\\' @ \\ \\ P'\" and \"(\\, P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from `\\ \\ P \\\\' @ \\ \\ P'` `\\ \\ \\'` have \"\\' \\ P \\\\' @ \\ \\ P'\"\n by(rule stat_eq_transition)\n moreover from `(\\, P', Q') \\ Rel` `\\ \\ \\'` have \"(\\', P', Q') \\ Rel'\"\n by(rule C1)\n ultimately show ?case by blast\nqed\n\n\n\n assumes \"\\ \\ P \\[A] Q\"\n and \"A \\ B\"\n\n shows \"\\ \\ P \\[B] Q\"\nusing assms\nby(simp (no_asm) add: simulation_def) (force dest: simE)\n\nend\n\nend\n\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Simulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.2502690755958983}} {"text": "(*\n * Copyright 2022, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchArch_AI\nimports Arch_AI\nbegin\n\nunbundle l4v_word_context\n\ncontext Arch begin global_naming RISCV64\n\ndefinition\n \"valid_aci aci \\ case aci of MakePool frame slot parent base \\\n \\s. cte_wp_at (\\c. c = NullCap) slot s \\ real_cte_at slot s \\\n ex_cte_cap_wp_to is_cnode_cap slot s \\\n slot \\ parent \\\n cte_wp_at (\\cap. \\idx. cap = UntypedCap False frame pageBits idx) parent s \\\n descendants_of parent (cdt s) = {} \\\n is_aligned base asid_low_bits \\\n asid_table s (asid_high_bits_of base) = None\"\n\nlemma safe_parent_strg:\n \"cte_wp_at (\\cap. cap = UntypedCap False frame pageBits idx) p s \\\n descendants_of p (cdt s) = {} \\\n valid_objs s\n \\\n cte_wp_at (safe_parent_for (cdt s) p\n (ArchObjectCap (ASIDPoolCap frame base)))\n p s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_parent_for_def is_physical_def arch_is_physical_def)\n apply (rule is_aligned_no_overflow)\n apply (drule (1) caps_of_state_valid_cap)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n done\n\nlemma range_cover_full:\n \"\\is_aligned ptr sz; sz \\ range_cover (ptr::machine_word) sz sz (Suc 0)\"\n by (clarsimp simp:range_cover_def unat_eq_0 le_mask_iff[symmetric] word_and_le1 word_bits_def)\n\n\ndefinition\n valid_arch_inv :: \"arch_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_arch_inv ai \\ case ai of\n InvokePageTable pti \\ valid_pti pti\n | InvokePage pgi \\ valid_page_inv pgi\n | InvokeASIDControl aci \\ valid_aci aci\n | InvokeASIDPool api \\ valid_apinv api\"\n\nlemma check_vp_wpR [wp]:\n \"\\\\s. vmsz_aligned w sz \\ P () s\\\n check_vp_alignment sz w \\P\\, -\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp whenE_wp|wpc)+\n apply (simp add: vmsz_aligned_def)\n done\n\n\nlemma check_vp_inv: \"\\P\\ check_vp_alignment sz w \\\\_. P\\\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp whenE_wp|wpc)+\n apply simp\n done\n\n\nlemma p2_low_bits_max:\n \"(2 ^ asid_low_bits - 1) = (max_word :: asid_low_index)\"\n by (simp add: asid_low_bits_def)\n\nlemma dom_ucast_eq:\n \"is_aligned y asid_low_bits \\\n (- dom (\\a::asid_low_index. p (ucast a :: machine_word)) \\ {x. ucast x + (y::RISCV64_A.asid) \\ 0} = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_low_bits - 1 \\ x + ucast y \\ 0} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule conjI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_low_bits_def)\n apply simp\n apply (clarsimp simp: mask_2pm1[symmetric] ucast_ucast_mask2 is_down is_aligned_mask)\n apply (frule and_mask_eq_iff_le_mask[THEN iffD2])\n apply (simp add: asid_low_bits_def)\n apply (erule notE)\n apply (subst word_plus_and_or_coroll)\n apply word_eqI_solve\n apply (subst (asm) word_plus_and_or_coroll; word_bitwise, clarsimp simp: word_size)\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule conjI)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_low_bits_def)\n apply clarsimp\n apply (erule notE)\n apply (simp add: is_aligned_mask asid_low_bits_def)\n apply (subst word_plus_and_or_coroll)\n apply word_eqI_solve\n apply (subst (asm) word_plus_and_or_coroll)\n apply (word_bitwise, clarsimp simp: word_size)\n apply (word_bitwise)\n done\n\n\nlemma asid_high_bits_max_word:\n \"(2 ^ asid_high_bits - 1) = (max_word :: asid_high_index)\"\n by (simp add: asid_high_bits_def)\n\n\nlemma dom_ucast_eq_8:\n \"(- dom (\\a::asid_high_index. p (ucast a::machine_word)) = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_high_bits - 1} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_high_bits_def)\n apply simp\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_high_bits_def)\n done\n\n\nlemma ucast_fst_hd_assocs:\n assumes \"- dom (\\x::asid_low_index. pool (ucast x)) \\ {x. ucast x + (a::RISCV64_A.asid) \\ 0} \\ {}\"\n assumes \"is_aligned a asid_low_bits\"\n shows\n \"fst (hd [(x, y) \\ assocs pool. x \\ 2 ^ asid_low_bits - 1 \\ x + ucast a \\ 0 \\ y = None]) +\n (ucast a :: machine_word) =\n ucast (UCAST(asid_low_len \\ asid_len)\n (fst (hd [(x, y) \\ assocs (\\a. pool (ucast a)). ucast x + a \\ 0 \\ y = None])) + a)\"\nproof -\n have [unfolded word_bits_def, simplified, simp]: \"asid_low_bits < word_bits\"\n by (simp add: asid_low_bits_def word_bits_def)\n have [unfolded asid_low_bits_def, simplified, simp]:\n \"x && mask asid_low_bits = x\"\n if \"x < 2^asid_low_bits\" for x::machine_word\n using that by (simp add: le_mask_iff_lt_2n[THEN iffD1, symmetric] word_le_mask_eq)\n have [unfolded asid_bits_def asid_low_bits_def, simplified, simp]:\n \"x && mask asid_bits = x\"\n if \"x < 2^asid_low_bits\" for x::machine_word\n proof -\n have \"mask asid_low_bits \\ (mask asid_bits :: machine_word)\"\n by (simp add: mask_def asid_low_bits_def asid_bits_def)\n with that show ?thesis\n by (simp add: le_mask_iff_lt_2n[THEN iffD1, symmetric] word_le_mask_eq)\n qed\n have [unfolded asid_bits_def asid_low_bits_def, simplified, simp]:\n \"(x + ucast a \\ 0) = (ucast x + a \\ 0)\"\n if \"x < 2^asid_low_bits\" for x::machine_word\n proof -\n from that have \"x \\ mask asid_low_bits\" by (simp add: le_mask_iff_lt_2n[THEN iffD1, symmetric])\n with `is_aligned a asid_low_bits`\n show ?thesis\n apply (subst word_and_or_mask_aligned2; simp add: is_aligned_ucastI)\n apply (subst word_and_or_mask_aligned2, assumption, erule ucast_le_maskI)\n apply (simp add: asid_low_bits_def)\n apply word_bitwise\n apply simp\n done\n qed\n\n from assms show ?thesis\n apply (simp add: ucast_assocs[unfolded o_def])\n apply (simp add: filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_mask2 is_down)\n apply (simp add: asid_low_bits_def minus_one_norm)\n apply (subgoal_tac \"P\" for P) (* cut_tac but more awesome *)\n apply (subst hd_map, assumption)\n apply (simp add: ucast_ucast_mask2 is_down)\n apply (drule hd_in_set)\n apply clarsimp\n apply (subst ucast_add_mask_aligned; assumption?)\n apply (rule ucast_le_maskI)\n apply (simp add: mask_def word_le_make_less)\n apply (simp add: ucast_ucast_mask cong: conj_cong)\n apply (simp add: assocs_empty_dom_comp null_def split_def)\n apply (simp add: ucast_assocs[unfolded o_def] filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_mask2 is_down)\n done\nqed\n\n\ncrunch typ_at [wp]:\n perform_page_table_invocation, perform_page_invocation, perform_asid_pool_invocation\n \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps)\n\nlemmas perform_page_table_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_table_invocation_typ_at]\n\nlemmas perform_page_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_invocation_typ_at]\n\nlemmas perform_asid_pool_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_asid_pool_invocation_typ_at]\n\nlemma perform_asid_control_invocation_tcb_at:\n \"\\invs and valid_aci aci and st_tcb_at active p and\n K (\\w a b c. aci = asid_control_invocation.MakePool w a b c \\ w \\ p)\\\n perform_asid_control_invocation aci\n \\\\rv. tcb_at p\\\"\n apply (simp add: perform_asid_control_invocation_def)\n apply (cases aci)\n apply clarsimp\n apply (wp |simp)+\n apply (wp obj_at_delete_objects retype_region_obj_at_other2 hoare_vcg_const_imp_lift|assumption)+\n apply (intro impI conjI)\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def image_def ptr_add_def)\n apply (clarsimp simp: st_tcb_at_tcb_at)+\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def valid_aci_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)\n apply simp\n apply (simp add:cte_wp_at_caps_of_state)\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (erule(1) in_empty_interE)\n apply (clarsimp simp:page_bits_def)\n apply simp\n done\n\n\nlemma ucast_asid_high_btis_of_le [simp]:\n \"ucast (asid_high_bits_of w) \\ (2 ^ asid_high_bits - 1 :: machine_word)\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less)\n apply simp\n apply (simp add: asid_high_bits_def)\n done\n\n\nlemma invoke_arch_tcb:\n \"\\invs and valid_arch_inv ai and st_tcb_at active tptr\\\n arch_perform_invocation ai\n \\\\rv. tcb_at tptr\\\"\n apply (simp add: arch_perform_invocation_def)\n apply (cases ai; simp; (wp; clarsimp simp add: st_tcb_at_tcb_at)?)\n apply (wp perform_asid_control_invocation_tcb_at)\n apply (clarsimp simp add: valid_arch_inv_def)\n apply (clarsimp simp: valid_aci_def)\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs cte_wp_at_caps_of_state)\n apply (drule_tac p=\"(aa,ba)\" in caps_of_state_valid_cap, fastforce)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (drule_tac x=tptr in base_member_set, simp)\n apply (simp add: pageBits_def field_simps del: atLeastAtMost_iff)\n apply (metis (no_types) orthD1 x_power_minus_1)\n apply simp\n done\n\nend\n\n\nlocale asid_update = Arch +\n fixes ap asid_hi s s'\n assumes ko: \"asid_pools_of s ap = Some Map.empty\"\n assumes empty: \"asid_table s asid_hi = None\"\n defines \"s' \\ s\\arch_state := arch_state s\\riscv_asid_table := (asid_table s)(asid_hi \\ ap)\\\\\"\nbegin\n\nlemma aobjs_of[simp]:\n \"aobjs_of s' = aobjs_of s\"\n unfolding s'_def by simp\n\nlemma vspace_for_pool_ap[simp]:\n \"vspace_for_pool ap asid (asid_pools_of s) = None\"\n using ko by (simp add: vspace_for_pool_def obind_def)\n\nlemma asid_hi_pool_for_asid:\n \"asid_high_bits_of asid = asid_hi \\ pool_for_asid asid s = None\"\n using empty by (simp add: pool_for_asid_def)\n\nlemma asid_hi_pool_for_asid':\n \"asid_high_bits_of asid = asid_hi \\ pool_for_asid asid s' = Some ap\"\n by (simp add: pool_for_asid_def s'_def)\n\nlemma asid_hi_vs_lookup_table:\n \"asid_high_bits_of asid = asid_hi \\ vs_lookup_table asid_pool_level asid vref s = None\"\n by (simp add: asid_hi_pool_for_asid vs_lookup_table_def obind_def)\n\nlemma vs_lookup_table:\n \"vs_lookup_table level asid vref s' =\n (if asid_high_bits_of asid = asid_hi \\ level = asid_pool_level\n then Some (asid_pool_level, ap)\n else vs_lookup_table level asid vref s)\"\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: vs_lookup_table_def in_omonad asid_hi_pool_for_asid')\n apply (clarsimp simp: vs_lookup_table_def)\n apply (cases \"asid_high_bits_of asid = asid_hi\"; simp)\n apply (clarsimp simp: obind_def asid_hi_pool_for_asid' asid_hi_pool_for_asid)\n apply (rule obind_eqI)\n apply (simp add: s'_def pool_for_asid_def)\n apply (clarsimp simp: obind_def split: option.splits)\n done\n\nlemma vs_lookup_slot:\n \"vs_lookup_slot level asid vref s' =\n (if asid_high_bits_of asid = asid_hi \\ level = asid_pool_level\n then Some (asid_pool_level, ap)\n else vs_lookup_slot level asid vref s)\"\n apply (simp add: vs_lookup_slot_def)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: obind_def vs_lookup_table)\n apply (rule obind_eqI)\n apply (clarsimp simp: vs_lookup_table)\n apply (clarsimp simp: obind_def split: option.splits)\n done\n\nlemma vs_lookup_target[simp]:\n \"vs_lookup_target level asid vref s' = vs_lookup_target level asid vref s\"\n apply (cases \"asid_high_bits_of asid = asid_hi \\ level = asid_pool_level\")\n apply (simp add: vs_lookup_target_def vs_lookup_slot_def obind_def vs_lookup_table\n asid_hi_vs_lookup_table\n split: option.splits)\n apply (clarsimp simp: vs_lookup_target_def)\n apply (rule obind_eqI)\n apply (clarsimp simp: vs_lookup_slot)\n apply (clarsimp simp: obind_def split: option.splits)\n done\n\nlemma obj_at [simp]:\n \"obj_at P p s' = obj_at P p s\"\n by (simp add: s'_def)\n\nlemma valid_pte[simp]:\n \"valid_pte level pte s' = valid_pte level pte s\"\n by (cases pte; simp add: data_at_def)\n\nlemma valid_vspace_obj[simp]:\n \"valid_vspace_obj level ao s' = valid_vspace_obj level ao s\"\n by (cases ao; simp)\n\nlemma vspace_objs':\n \"valid_vspace_objs s \\ valid_vspace_objs s'\"\n using ko\n apply (clarsimp simp: valid_vspace_objs_def vs_lookup_table)\n apply (clarsimp simp: in_omonad)\n done\n\nlemma global_objs':\n \"valid_global_objs s \\ valid_global_objs s'\"\n by (simp add: valid_global_objs_def)\n\nlemma caps_of_state_s':\n \"caps_of_state s' = caps_of_state s\"\n by (rule caps_of_state_pspace, simp add: s'_def)\n\nlemma valid_vs_lookup[simp]:\n \"valid_vs_lookup s' = valid_vs_lookup s\"\n by (clarsimp simp: valid_vs_lookup_def caps_of_state_s')\n\nlemma valid_table_caps':\n \"valid_table_caps s \\ valid_table_caps s'\"\n by (simp add: valid_table_caps_def caps_of_state_s' s'_def)\n\nlemma valid_asid_pool_caps':\n \"\\ valid_asid_pool_caps s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ obj_refs cap = {ap} \\ vs_cap_ref cap = Some (ucast asid_hi << asid_low_bits, 0) \\\n \\ valid_asid_pool_caps s'\"\n unfolding valid_asid_pool_caps_def by (clarsimp simp: s'_def)\n\nlemma valid_arch_caps:\n \"\\ valid_arch_caps s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ obj_refs cap = {ap} \\ vs_cap_ref cap = Some (ucast asid_hi << asid_low_bits, 0) \\\n \\ valid_arch_caps s'\"\n apply (simp add: valid_arch_caps_def valid_table_caps' valid_asid_pool_caps')\n apply (simp add: caps_of_state_s')\n done\n\nlemma valid_asid_map':\n \"valid_asid_map s \\ valid_asid_map s'\"\n by (clarsimp simp: valid_asid_map_def)\n\nlemma vspace_for_asid[simp]:\n \"vspace_for_asid asid s' = vspace_for_asid asid s\"\n using ko empty\n by (clarsimp simp: vspace_for_asid_def obind_def pool_for_asid_def s'_def vspace_for_pool_def\n split: option.splits)\n\nlemma global_pt[simp]:\n \"global_pt s' = global_pt s\"\n by (simp add: s'_def)\n\nlemma equal_kernel_mappings:\n \"equal_kernel_mappings s' = equal_kernel_mappings s\"\n by (simp add: equal_kernel_mappings_def has_kernel_mappings_def)\n\nend\n\n\ncontext Arch begin global_naming RISCV64\n\nlemma valid_arch_state_strg:\n \"valid_arch_state s \\ ap \\ ran (asid_table s) \\ asid_pool_at ap s \\\n valid_arch_state (s\\arch_state := arch_state s\\riscv_asid_table := riscv_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply (clarsimp simp: valid_arch_state_def)\n apply (clarsimp simp: valid_asid_table_def ran_def)\n apply (fastforce intro!: inj_on_fun_updI simp: asid_pools_at_eq)\n done\n\n\nlemma valid_vs_lookup_at_upd_strg:\n \"valid_vs_lookup s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None\n \\\n valid_vs_lookup (s\\arch_state := arch_state s\\riscv_asid_table := (asid_table s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (prop_tac \"asid_update ap asid s\", (unfold_locales; assumption))\n apply (simp add: asid_update.valid_vs_lookup)\n done\n\nlemma valid_asid_pool_caps_upd_strg:\n \"valid_asid_pool_caps s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None \\\n (\\ptr cap. caps_of_state s ptr = Some cap\n \\ obj_refs cap = {ap} \\ vs_cap_ref cap = Some (ucast asid << asid_low_bits, 0))\n \\\n valid_asid_pool_caps_2 (caps_of_state s) (asid_table s(asid \\ ap))\"\n apply clarsimp\n apply (prop_tac \"asid_update ap asid s\", (unfold_locales; assumption))\n apply (fastforce dest: asid_update.valid_asid_pool_caps')\n done\n\nlemma retype_region_ap[wp]:\n \"\\\\\\\n retype_region ap (Suc 0) 0 (ArchObject ASIDPoolObj) dev\n \\\\_ s. asid_pools_of s ap = Some Map.empty\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule retype_region_obj_at)\n apply simp\n apply simp\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def)\n apply (clarsimp simp: obj_at_def default_object_def default_arch_object_def in_omonad)\n done\n\n\nlemma retype_region_ako[wp]:\n \"\\\\\\ retype_region ap (Suc 0) 0 (ArchObject ASIDPoolObj) dev \\\\_. ako_at (ASIDPool Map.empty) ap\\\"\n apply (rule hoare_strengthen_post, rule retype_region_ap)\n apply (simp add: obj_at_def in_omonad)\n done\n\nlemma retype_region_ap':\n \"\\\\\\ retype_region ap (Suc 0) 0 (ArchObject ASIDPoolObj) dev \\\\rv. asid_pool_at ap\\\"\n apply (rule hoare_strengthen_post, rule retype_region_ap)\n apply (simp add: asid_pools_at_eq)\n done\n\n\nlemma no_cap_to_obj_with_diff_ref_null_filter:\n \"no_cap_to_obj_with_diff_ref cap S\n = (\\s. \\c \\ ran (null_filter (caps_of_state s) |` (- S)).\n obj_refs c = obj_refs cap\n \\ table_cap_ref c = table_cap_ref cap)\"\n apply (simp add: no_cap_to_obj_with_diff_ref_def\n ball_ran_eq cte_wp_at_caps_of_state)\n apply (simp add: Ball_def)\n apply (intro iff_allI ext)\n apply (simp add: restrict_map_def null_filter_def)\n apply (auto dest!: obj_ref_none_no_asid[rule_format]\n simp: table_cap_ref_def)\n done\n\n\nlemma retype_region_no_cap_to_obj:\n \"\\valid_pspace and valid_mdb\n and caps_overlap_reserved {ptr..ptr + 2 ^ obj_bits_api ty us - 1}\n and caps_no_overlap ptr sz\n and pspace_no_overlap_range_cover ptr sz\n and no_cap_to_obj_with_diff_ref cap S\n and (\\s. \\slot. cte_wp_at (\\c. up_aligned_area ptr sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n and K (ty = CapTableObject \\ 0 < us)\n and K (range_cover ptr sz (obj_bits_api ty us) 1) \\\n retype_region ptr 1 us ty dev\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n apply (rule hoare_gen_asm)+\n apply (simp add: no_cap_to_obj_with_diff_ref_null_filter)\n apply (wp retype_region_caps_of | simp)+\n apply fastforce\n done\n\n\nlemma valid_table_caps_asid_upd [iff]:\n \"valid_table_caps (s\\arch_state := (riscv_asid_table_update f (arch_state s))\\) =\n valid_table_caps s\"\n by (simp add: valid_table_caps_def second_level_tables_def)\n\nlemma set_cap_reachable_pg_cap:\n \"set_cap cap' slot \\\\s. P (reachable_frame_cap cap s)\\\"\n unfolding reachable_frame_cap_def reachable_target_def vs_lookup_target_def\n apply (clarsimp simp: in_omonad vs_lookup_slot_def vs_lookup_table_def)\n apply (wp_pre, wps, wp)\n apply simp\n done\n\nlemma set_cap_reachable_target[wp]:\n \"set_cap cap slot \\\\s. P (reachable_target ref p s)\\\"\n apply (clarsimp simp: reachable_target_def split_def)\n apply (wp_pre, wps, wp)\n apply simp\n done\n\nlemma cap_insert_simple_arch_caps_ap:\n \"\\valid_arch_caps and (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s)\n and no_cap_to_obj_with_diff_ref cap {dest}\n and (\\s. asid_table s (asid_high_bits_of asid) = None \\ asid_pools_of s ap = Some Map.empty)\n and K (cap = ArchObjectCap (ASIDPoolCap ap asid) \\ is_aligned asid asid_low_bits) \\\n cap_insert cap src dest\n \\\\rv s. valid_arch_caps (s\\arch_state := arch_state s\n \\riscv_asid_table := riscv_asid_table (arch_state s)(asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (simp add: cap_insert_def update_cdt_def set_cdt_def valid_arch_caps_def\n set_untyped_cap_as_full_def bind_assoc)\n apply (strengthen valid_vs_lookup_at_upd_strg valid_asid_pool_caps_upd_strg)\n apply (wp get_cap_wp set_cap_valid_vs_lookup set_cap_arch_obj\n set_cap_valid_table_caps hoare_vcg_all_lift\n | simp split del: if_split)+\n apply (simp add: F)\n apply (rule_tac P = \"cte_wp_at ((=) src_cap) src\" in set_cap_orth)\n apply (wp hoare_vcg_imp_lift hoare_vcg_ball_lift set_free_index_final_cap hoare_vcg_all_lift\n hoare_vcg_disj_lift set_cap_reachable_pg_cap set_cap.vs_lookup_pages\n | clarsimp)+\n apply (wp set_cap_arch_obj set_cap_valid_table_caps hoare_vcg_ball_lift\n get_cap_wp static_imp_wp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps)\n apply (rule conjI)\n apply (clarsimp simp: vs_cap_ref_def)\n apply (rule_tac x=\"fst dest\" in exI)\n apply (rule_tac x=\"snd dest\" in exI)\n apply (simp add: asid_high_bits_shl)\n apply (rule conjI)\n apply (simp add: unique_table_caps_def is_cap_simps)\n apply (subst unique_table_refs_def)\n apply (intro allI impI)\n apply (simp split: if_split_asm)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (erule (3) unique_table_refsD)\n done\n\nlemma valid_asid_map_asid_upd_strg:\n \"valid_asid_map s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None \\\n valid_asid_map (asid_table_update asid ap s)\"\n by (simp add: valid_asid_map_def)\n\nlemma valid_vspace_objs_asid_upd_strg:\n \"valid_vspace_objs s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None \\\n valid_vspace_objs (asid_table_update asid ap s)\"\n apply clarsimp\n apply (prop_tac \"asid_update ap asid s\", (unfold_locales; assumption))\n apply (erule (1) asid_update.vspace_objs')\n done\n\nlemma valid_global_objs_asid_upd_strg:\n \"valid_global_objs s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None \\\n valid_global_objs (asid_table_update asid ap s)\"\n by (clarsimp simp: valid_global_objs_def)\n\nlemma equal_kernel_mappings_asid_upd_strg:\n \"equal_kernel_mappings s \\\n asid_pools_of s ap = Some Map.empty \\\n asid_table s asid = None \\\n equal_kernel_mappings (asid_table_update asid ap s)\"\n apply clarsimp\n apply (prop_tac \"asid_update ap asid s\", (unfold_locales; assumption))\n apply (simp add: asid_update.equal_kernel_mappings)\n done\n\nlemma safe_parent_cap_is_device:\n \"safe_parent_for m p cap pcap \\ cap_is_device cap = cap_is_device pcap\"\n by (simp add: safe_parent_for_def)\n\nlemma cap_insert_ioports_ap:\n \"\\valid_ioports and (\\s. cte_wp_at (\\cap'. safe_ioport_insert cap cap' s) dest s) and\n K (is_ap_cap cap)\\\n cap_insert cap src dest\n \\\\rv. valid_ioports\\\"\n by wpsimp\n\ncrunches cap_insert\n for aobjs_of[wp]: \"\\s. P (aobjs_of s)\"\n (wp: crunch_wps)\n\nlemma cap_insert_ap_invs:\n \"\\invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq \\ cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (riscv_asid_table (arch_state s)) \\\n asid_table s (asid_high_bits_of asid) = None)\\\n cap_insert cap src dest\n \\\\rv s. invs (s\\arch_state := arch_state s\n \\riscv_asid_table := (riscv_asid_table \\ arch_state) s(asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (strengthen valid_arch_state_strg valid_vspace_objs_asid_upd_strg\n equal_kernel_mappings_asid_upd_strg valid_asid_map_asid_upd_strg\n valid_global_objs_asid_upd_strg)\n apply (simp cong: conj_cong)\n apply (rule hoare_pre)\n apply (wp cap_insert_simple_mdb cap_insert_iflive\n cap_insert_zombies cap_insert_ifunsafe cap_insert_ioports_ap\n cap_insert_valid_global_refs cap_insert_idle\n valid_irq_node_typ cap_insert_simple_arch_caps_ap)\n apply (clarsimp simp: is_simple_cap_def cte_wp_at_caps_of_state is_cap_simps)\n apply (frule safe_parent_cap_is_device)\n apply (drule safe_parent_cap_range)\n apply (simp add: is_simple_cap_arch_def)\n apply (rule conjI)\n prefer 2\n apply (clarsimp simp: obj_at_def a_type_def in_omonad)\n apply (clarsimp simp: valid_cap_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule_tac p=\"(a,b)\" in caps_of_state_valid_cap, fastforce)\n apply (auto simp: obj_at_def is_tcb_def is_cap_table_def\n valid_cap_def [where c=\"cap.Zombie a b x\" for a b x]\n dest: obj_ref_is_tcb obj_ref_is_cap_table split: option.splits)\n done\n\nlemma max_index_upd_no_cap_to:\n \"\\\\s. no_cap_to_obj_with_diff_ref cap {slot} s \\\n cte_wp_at ((=) ucap) cref s \\ is_untyped_cap ucap\\\n set_cap (max_free_index_update ucap) cref\n \\\\rv s. no_cap_to_obj_with_diff_ref cap {slot} s \\\"\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def)\n apply (wp hoare_vcg_ball_lift set_cap_cte_wp_at_neg)\n apply (clarsimp simp:cte_wp_at_caps_of_state free_index_update_def is_cap_simps)\n apply (drule_tac x = cref in bspec)\n apply clarsimp\n apply (clarsimp simp:table_cap_ref_def)\n done\n\nlemma perform_asid_control_invocation_pred_tcb_at:\n \"\\\\s. pred_tcb_at proj Q t s \\ st_tcb_at ((Not \\ inactive) and (Not \\ idle)) t s\n \\ ct_active s \\ invs s \\ valid_aci aci s\\\n perform_asid_control_invocation aci\n \\\\_. pred_tcb_at proj Q t\\\"\n supply\n is_aligned_neg_mask_eq[simp del]\n is_aligned_neg_mask_weaken[simp del]\n apply (clarsimp simp: perform_asid_control_invocation_def split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_name_pre_state)\n apply (subgoal_tac \"is_aligned word1 page_bits\")\n prefer 2\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply (simp add:valid_cap_simps cap_aligned_def page_bits_def)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def word_bits_def pageBits_def word_size_bits_def)+\n apply (simp add:is_aligned_neg_mask_eq)\n apply (wp hoare_vcg_const_imp_lift retype_region_st_tcb_at[where sz=page_bits] set_cap_no_overlap|simp)+\n apply (strengthen invs_valid_objs invs_psp_aligned)\n apply (clarsimp simp:conj_comms)\n apply (wp max_index_upd_invs_simple get_cap_wp)+\n apply (clarsimp simp: valid_aci_def)\n apply (frule intvl_range_conv)\n apply (simp add:word_bits_def page_bits_def pageBits_def)\n apply (clarsimp simp:detype_clear_um_independent page_bits_def is_aligned_neg_mask_eq)\n apply (rule conjI)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (simp only: field_simps)\n apply (rule pspace_no_overlap_detype')\n apply (rule caps_of_state_valid_cap)\n apply (simp add:page_bits_def)+\n apply (simp add:invs_valid_objs invs_psp_aligned)+\n apply (rule conjI)\n apply (frule st_tcb_ex_cap)\n apply clarsimp\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (fastforce simp:page_bits_def)\n apply simp\n apply (clarsimp simp:obj_bits_api_def arch_kobj_size_def cte_wp_at_caps_of_state\n default_arch_object_def empty_descendants_range_in)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state\n empty_descendants_range_in descendants_range_def2)+\n apply (thin_tac \"x = Some cap.NullCap\" for x)+\n apply (drule(1) caps_of_state_valid_cap[OF _ invs_valid_objs])\n apply (intro conjI)\n apply (clarsimp simp:valid_cap_def cap_aligned_def range_cover_full\n invs_psp_aligned invs_valid_objs page_bits_def)\n apply (erule pspace_no_overlap_detype)\n apply (auto simp:page_bits_def detype_clear_um_independent)\n done\n\nlemma perform_asid_control_invocation_st_tcb_at:\n \"\\st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\n and ct_active and invs and valid_aci aci\\\n perform_asid_control_invocation aci\n \\\\_. st_tcb_at P t\\\"\n apply (wpsimp wp: perform_asid_control_invocation_pred_tcb_at)\n apply (fastforce simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma set_cap_idx_up_aligned_area:\n \"\\K (\\idx. pcap = UntypedCap dev ptr pageBits idx) and cte_wp_at ((=) pcap) slot\n and valid_objs\\ set_cap (max_free_index_update pcap) slot\n \\\\rv s. (\\slot. cte_wp_at (\\c. up_aligned_area ptr pageBits \\ cap_range c \\ cap_is_device c = dev) slot s)\\\"\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_cap_cte_wp_at)\n apply (rule_tac x = slot in exI)\n apply clarsimp\n apply (frule(1) cte_wp_valid_cap)\n apply (clarsimp simp: cte_wp_at_caps_of_state p_assoc_help valid_cap_def valid_untyped_def\n cap_aligned_def)\n done\n\nprimrec(nonexhaustive)\n get_untyped_cap_idx :: \"cap \\ nat\"\nwhere\n \"get_untyped_cap_idx (UntypedCap dev ref sz idx) = idx\"\n\nlemma aci_invs':\n assumes Q_ignores_arch[simp]: \"\\f s. Q (arch_state_update f s) = Q s\"\n assumes Q_ignore_machine_state[simp]: \"\\f s. Q (machine_state_update f s) = Q s\"\n assumes Q_detype[simp]: \"\\f s. Q (detype f s) = Q s\"\n assumes cap_insert_Q: \"\\cap src dest. \\Q and invs and K (src \\ dest)\\\n cap_insert cap src dest\n \\\\_.Q\\\"\n assumes retype_region_Q[wp]:\"\\a b c d e. \\Q\\ retype_region a b c d e \\\\_.Q\\\"\n assumes set_cap_Q[wp]: \"\\a b. \\Q\\ set_cap a b \\\\_.Q\\\"\n shows \"\\invs and Q and ct_active and valid_aci aci\\ perform_asid_control_invocation aci \\\\y s. invs s \\ Q s\\\"\nproof -\n have cap_insert_invsQ:\n \"\\cap src dest ap asid.\n \\Q and (invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq\\cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (asid_table s) \\ asid_table s (asid_high_bits_of asid) = None))\\\n cap_insert cap src dest\n \\\\rv s.\n invs\n (s\\arch_state := arch_state s\n \\riscv_asid_table := (riscv_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\) \\\n Q\n (s\\arch_state := arch_state s\n \\riscv_asid_table := (riscv_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (wp cap_insert_ap_invs)\n apply simp\n apply (rule hoare_pre)\n apply (rule cap_insert_Q, assumption)\n apply (auto simp: cte_wp_at_caps_of_state)\n done\n show ?thesis\n apply (clarsimp simp: perform_asid_control_invocation_def valid_aci_def\n split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_const_imp_lift)\n apply (wp cap_insert_invsQ hoare_vcg_ex_lift | simp)+\n apply (simp add: valid_cap_def |\n strengthen real_cte_tcb_valid safe_parent_strg\n invs_vobjs_strgs\n ex_cte_cap_to_cnode_always_appropriate_strg)+\n apply (wp hoare_vcg_const_imp_lift set_free_index_invs\n retype_region_plain_invs[where sz = pageBits]\n retype_cte_wp_at[where sz = pageBits] hoare_vcg_ex_lift\n retype_region_obj_at_other3[where P=\"is_cap_table n\" and sz = pageBits for n]\n retype_region_ex_cte_cap_to[where sz = pageBits]\n retype_region_ap[simplified]\n retype_region_ap'[simplified]\n retype_region_no_cap_to_obj[where sz = pageBits,simplified]\n | simp del: split_paired_Ex)+\n apply (strengthen invs_valid_objs invs_psp_aligned\n invs_mdb invs_valid_pspace\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\"]\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\",\n simplified]\n caps_region_kernel_window_imp[where\n p = \"case aci of MakePool frame slot parent base \\ parent\"]\n invs_cap_refs_in_kernel_window)+\n apply (wp set_cap_caps_no_overlap set_cap_no_overlap get_cap_wp\n max_index_upd_caps_overlap_reserved max_index_upd_invs_simple\n set_cap_cte_cap_wp_to set_cap_cte_wp_at max_index_upd_no_cap_to\n | simp split del: if_split | wp (once) hoare_vcg_ex_lift)+\n apply (rule_tac P = \"is_aligned word1 page_bits\" in hoare_gen_asm)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def pageBits_def word_size_bits_def)\n apply (simp add:page_bits_def pageBits_def word_bits_def)\n apply (simp add: page_bits_def)\n apply wp\n apply (clarsimp simp: cte_wp_at_caps_of_state if_option_Some\n split del: if_split)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state)+\n apply (simp add:descendants_range_def2 empty_descendants_range_in)\n apply (simp add:invs_mdb invs_valid_pspace invs_psp_aligned invs_valid_objs)\n apply (clarsimp dest!:caps_of_state_cteD)\n apply (frule(1) unsafe_protected[where p=t and p'=t for t])\n apply (simp add:empty_descendants_range_in)+\n apply fastforce\n apply clarsimp\n apply (frule_tac p = \"(aa,ba)\" in cte_wp_valid_cap)\n apply fastforce\n apply (clarsimp simp: detype_clear_um_independent obj_bits_api_def arch_kobj_size_def\n default_arch_object_def conj_comms)\n apply (rule conjI)\n apply (clarsimp simp:valid_cap_simps cap_aligned_def page_bits_def not_le)\n apply (simp add:empty_descendants_range_in)\n apply (frule valid_cap_aligned)\n apply (clarsimp simp: cap_aligned_def)\n apply (subst caps_no_overlap_detype[OF descendants_range_caps_no_overlapI],\n assumption, simp,\n simp add: empty_descendants_range_in)\n apply (frule pspace_no_overlap_detype, clarify+)\n apply (frule intvl_range_conv[where bits = pageBits])\n apply (simp add:pageBits_def word_bits_def)\n apply (clarsimp simp: page_bits_def)\n apply (frule(1) ex_cte_cap_protects)\n apply (simp add:empty_descendants_range_in)\n apply fastforce\n apply (rule subset_refl)\n apply fastforce\n apply (clarsimp simp: field_simps)\n apply (intro conjI impI;\n simp add: free_index_of_def valid_cap_simps valid_untyped_def\n empty_descendants_range_in range_cover_full clear_um_def max_free_index_def;\n clarsimp simp:valid_untyped_def valid_cap_simps)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule(1) cap_to_protected)\n apply (simp add:empty_descendants_range_in descendants_range_def2)+\n apply (drule invs_arch_state)+\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (drule (1) subsetD)+\n apply (clarsimp simp: in_opt_map_eq)\n apply (erule notE, erule is_aligned_no_overflow)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def)\n apply (thin_tac \"cte_wp_at ((=) cap.NullCap) p s\" for p s)\n apply (subst(asm) eq_commute,\n erule(1) untyped_children_in_mdbE[where cap=\"cap.UntypedCap dev p bits idx\" for dev p bits idx,\n simplified, rotated])\n apply (simp add: is_aligned_no_overflow)\n apply simp\n apply clarsimp\n done\n\nqed\n\n\nlemmas aci_invs[wp] =\n aci_invs'[where Q=\\,simplified hoare_post_taut, OF refl refl refl TrueI TrueI TrueI,simplified]\n\nlemma invoke_arch_invs[wp]:\n \"\\invs and ct_active and valid_arch_inv ai\\\n arch_perform_invocation ai\n \\\\rv. invs\\\"\n apply (cases ai, simp_all add: valid_arch_inv_def arch_perform_invocation_def)\n apply (wp|simp)+\n done\n\nlemma sts_aobjs_of[wp]:\n \"set_thread_state t st \\\\s. P (aobjs_of s)\\\"\n unfolding set_thread_state_def\n apply (wpsimp wp: set_object_wp)\n apply (erule rsubst[where P=P])\n apply (auto dest!: get_tcb_SomeD simp: opt_map_def split: option.splits)\n done\n\ncrunches set_thread_state\n for pool_for_asid[wp]: \"\\s. P (pool_for_asid asid s)\"\n (wp: assert_inv)\n\nlemma sts_vspace_for_asid[wp]:\n \"set_thread_state t st \\\\s. P (vspace_for_asid asid s)\\\"\n apply (simp add: vspace_for_asid_def obind_def split: option.splits)\n apply (rule conjI; wpsimp wp: hoare_vcg_all_lift hoare_vcg_imp_lift)\n done\n\nlemma sts_vspace_at_asid[wp]:\n \"set_thread_state t st \\vspace_at_asid asid pd\\\"\n unfolding vspace_at_asid_def by wpsimp\n\nlemma sts_valid_slots_inv[wp]:\n \"set_thread_state t st \\valid_slots m\\\"\n unfolding valid_slots_def\n apply (cases m)\n apply (wpsimp wp: hoare_vcg_all_lift hoare_vcg_imp_lift' sts_typ_ats)\n apply fastforce\n done\n\nlemma sts_same_ref[wp]:\n \"set_thread_state t st \\\\s. P (same_ref ref cap s)\\\"\n unfolding same_ref_def by (cases ref) (wpsimp simp: vs_lookup_slot_def in_omonad)\n\nlemma sts_valid_page_inv[wp]:\n \"set_thread_state t st \\valid_page_inv page_invocation\\\"\n unfolding valid_page_inv_def\n apply (cases page_invocation)\n apply (wpsimp wp: sts_typ_ats hoare_vcg_ex_lift hoare_vcg_disj_lift | wps)+\n done\n\ncrunch global_refs_inv[wp]: set_thread_state \"\\s. P (global_refs s)\"\n\nlemma sts_vs_lookup_slot[wp]:\n \"set_thread_state t st \\\\s. P (vs_lookup_slot level asid vref s)\\\"\n by (simp add: vs_lookup_slot_def obind_def split: option.splits) wpsimp\n\nlemma sts_valid_vspace_table_inv[wp]:\n \"set_thread_state t st \\valid_pti i\\\"\n unfolding valid_pti_def\n by (cases i; wpsimp wp: sts_typ_ats hoare_vcg_ex_lift hoare_vcg_all_lift\n simp: invalid_pte_at_def aobjs_of_ako_at_Some[symmetric])\n\nlemma sts_valid_arch_inv:\n \"set_thread_state t st \\valid_arch_inv ai\\\"\n apply (cases ai; simp add: valid_arch_inv_def; wp?)\n apply (rename_tac asid_control_invocation)\n apply (case_tac asid_control_invocation)\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (rule hoare_pre, wp hoare_vcg_ex_lift cap_table_at_typ_at)\n apply clarsimp\n apply (clarsimp simp: valid_apinv_def split: asid_pool_invocation.splits)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_thread_state_ko)\n apply (clarsimp simp: is_tcb_def)\n done\n\n\ncrunch_ignore (add: select_ext find_vspace_for_asid)\n\n\ncrunch inv [wp]: arch_decode_invocation \"P\"\n (wp: crunch_wps select_wp select_ext_weak_wp simp: crunch_simps)\n\n\ndeclare lookup_slot_for_cnode_op_cap_to [wp]\n\n\nlemma shiftr_irrelevant:\n \"x < 2 ^ asid_low_bits \\ is_aligned (y :: machine_word) asid_low_bits \\\n x + y >> asid_low_bits = y >> asid_low_bits\"\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: is_aligned_nth)\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n apply (rule word_eqI)\n apply (simp add: nth_shiftr)\n apply safe\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n done\n\n\ndeclare mask_shift [simp]\ndeclare word_less_sub_le [simp del]\ndeclare ptrFormPAddr_addFromPPtr [simp]\n\n\nlemma le_user_vtop_less_pptr_base[simp]:\n \"x \\ user_vtop \\ x < pptr_base\"\n using dual_order.strict_trans2 by blast\n\nlemmas le_user_vtop_canonical_address = below_user_vtop_canonical[simp]\n\nlemma ptrFromPAddr_addr_from_ppn:\n \"is_aligned pt_ptr table_size \\\n ptrFromPAddr (addr_from_ppn (ucast (addrFromPPtr pt_ptr >> pageBits))) = pt_ptr\"\n apply (simp add: addr_from_ppn_def ucast_ucast_mask bit_simps)\n apply (frule is_aligned_addrFromPPtr[simplified bit_simps])\n apply (simp add: aligned_shiftr_mask_shiftl mask_len_id[where 'a=machine_word_len, simplified])\n done\n\nlemma ptrFromPAddr_addr_from_ppn':\n \"is_aligned pt_ptr pt_bits \\\n ptrFromPAddr (addr_from_ppn (ucast (addrFromPPtr pt_ptr >> pt_bits))) = pt_ptr\"\n using ptrFromPAddr_addr_from_ppn by (simp add: bit_simps)\n\nlemma is_aligned_pageBitsForSize_table_size:\n \"is_aligned p (pageBitsForSize vmpage_size) \\ is_aligned p table_size\"\n apply (erule is_aligned_weaken)\n apply (simp add: pbfs_atleast_pageBits[unfolded bit_simps] bit_simps)\n done\n\nlemma vmsz_aligned_vref_for_level:\n \"\\ vmsz_aligned vref sz; pt_bits_left level = pageBitsForSize sz \\ \\\n vref_for_level vref level = vref\"\n by (simp add: vref_for_level_def vmsz_aligned_def)\n\nlemma vs_lookup_slot_pte_at:\n \"\\ vs_lookup_slot level asid vref s = Some (level, pt_slot);\n vref \\ user_region; level \\ max_pt_level; invs s \\ \\\n pte_at pt_slot s\"\n apply (clarsimp simp: pte_at_eq vs_lookup_slot_table_unfold in_omonad)\n apply (drule valid_vspace_objs_strongD[rotated]; clarsimp)\n apply (clarsimp simp: ptes_of_def in_omonad)\n (* pt_slot equation does not want to substitute in clarsimp, because rhs mentions pt_slot *)\n apply (rule subst[where P=\"\\pt_slot. is_aligned pt_slot pte_bits\"], rule sym, assumption)\n apply (thin_tac \"pt_slot = t\" for t)\n apply (clarsimp simp: pt_slot_offset_def)\n apply (rule is_aligned_add; simp add: is_aligned_shift)\n done\n\nlemma vmpage_size_of_level_pt_bits_left:\n \"\\ pt_bits_left level = pageBitsForSize vmpage_size; level \\ max_pt_level \\ \\\n vmpage_size_of_level level = vmpage_size\"\n by (cases vmpage_size; simp add: vmpage_size_of_level_def pt_bits_left_def bit_simps) auto\n\nlemma is_PagePTE_make_user[simp]:\n \"is_PagePTE (make_user_pte p attr R) \\ make_user_pte p attr R = InvalidPTE\"\n by (auto simp: is_PagePTE_def make_user_pte_def)\n\nlemma decode_fr_inv_map_wf[wp]:\n \"arch_cap = FrameCap p rights vmpage_size dev option \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n decode_fr_inv_map label args slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n unfolding decode_fr_inv_map_def Let_def\n apply (wpsimp wp: check_vp_wpR split_del: if_split)\n apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def neq_Nil_conv)\n apply (rename_tac s pt_ptr asid vref ab ba ys pt_slot level)\n apply (prop_tac \"args!0 \\ user_region\")\n apply (clarsimp simp: user_region_def not_le)\n apply (rule user_vtop_canonical_user)\n apply (erule aligned_add_mask_lessD)\n apply (simp add: vmsz_aligned_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_arch_update_def is_cap_simps cap_master_cap_simps)\n apply (thin_tac \"Ball S P\" for S P)\n apply (frule (1) pt_lookup_slot_vs_lookup_slotI, clarsimp)\n apply (clarsimp simp: valid_arch_cap_def valid_cap_def cap_aligned_def wellformed_mapdata_def)\n apply (frule is_aligned_pageBitsForSize_table_size)\n apply (frule (3) vs_lookup_slot_table_base)\n apply (clarsimp simp: same_ref_def make_user_pte_def ptrFromPAddr_addr_from_ppn)\n (* FIXME RISCV: remove duplication due to PagePTE/InvalidPTE cases: *)\n apply (rule conjI; clarsimp)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (rule_tac x=level in exI)\n apply (rule_tac x=\"args!0\" in exI)\n apply (fastforce simp: vmsz_aligned_vref_for_level)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (clarsimp simp: valid_slots_def make_user_pte_def wellformed_pte_def\n ptrFromPAddr_addr_from_ppn)\n apply (rename_tac level' asid' vref')\n apply (frule (3) vs_lookup_slot_table_base)\n apply (prop_tac \"level' \\ max_pt_level\")\n apply (drule_tac level=level in valid_vspace_objs_strongD[rotated]; clarsimp)\n apply (rule ccontr, clarsimp simp: not_le)\n apply (drule vs_lookup_asid_pool; clarsimp)\n apply (clarsimp simp: in_omonad)\n apply (drule (1) vs_lookup_table_unique_level; clarsimp)\n apply (simp add: vs_lookup_slot_pte_at data_at_def vmpage_size_of_level_pt_bits_left\n split: if_split_asm)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (clarsimp simp: wellformed_mapdata_def vspace_for_asid_def)\n apply (clarsimp simp: parent_for_refs_def)\n apply (frule (3) vs_lookup_slot_table_base)\n apply (frule (2) valid_vspace_objs_strongD[rotated]; clarsimp)\n apply (drule (1) vs_lookup_table_target)\n apply (drule valid_vs_lookupD; clarsimp simp: vmsz_aligned_vref_for_level)\n apply (subgoal_tac \"is_pt_cap cap\")\n apply (force simp: is_cap_simps)\n apply (fastforce dest: cap_to_pt_is_pt_cap intro: valid_objs_caps)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (rule_tac x=level in exI)\n apply (rule_tac x=\"args!0\" in exI)\n apply (fastforce simp: vmsz_aligned_vref_for_level)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (clarsimp simp: valid_slots_def make_user_pte_def wellformed_pte_def\n ptrFromPAddr_addr_from_ppn)\n apply (rename_tac level' asid' vref')\n apply (frule (3) vs_lookup_slot_table_base)\n apply (prop_tac \"level' \\ max_pt_level\")\n apply (drule_tac level=level in valid_vspace_objs_strongD[rotated]; clarsimp)\n apply (rule ccontr, clarsimp simp: not_le)\n apply (drule vs_lookup_asid_pool; clarsimp)\n apply (clarsimp simp: in_omonad)\n apply (drule (1) vs_lookup_table_unique_level; clarsimp)\n apply (simp add: vs_lookup_slot_pte_at data_at_def vmpage_size_of_level_pt_bits_left\n split: if_split_asm)\n apply (rule strengthen_imp_same_first_conj[OF conjI])\n apply (clarsimp simp: wellformed_mapdata_def vspace_for_asid_def)\n apply (clarsimp simp: parent_for_refs_def)\n apply (frule (3) vs_lookup_slot_table_base)\n apply (frule (2) valid_vspace_objs_strongD[rotated]; clarsimp)\n apply (drule (1) vs_lookup_table_target)\n apply (drule valid_vs_lookupD; clarsimp simp: vmsz_aligned_vref_for_level)\n apply (subgoal_tac \"is_pt_cap cap\")\n apply (force simp: is_cap_simps)\n apply (fastforce dest: cap_to_pt_is_pt_cap intro: valid_objs_caps)\n done\n\nlemma decode_frame_invocation_wf[wp]:\n \"arch_cap = FrameCap word rights vmpage_size dev option \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n decode_frame_invocation label args slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n unfolding decode_frame_invocation_def\n by (wpsimp simp: valid_arch_inv_def valid_page_inv_def cte_wp_at_caps_of_state\n is_cap_simps valid_arch_cap_def valid_cap_def\n valid_unmap_def wellformed_mapdata_def vmsz_aligned_def\n split: option.split)\n\nlemma neg_mask_user_region:\n \"p \\ user_region \\ p && ~~mask n \\ user_region\"\n apply (simp add: user_region_def canonical_user_def bit.conj_ac\n flip: and_mask_0_iff_le_mask)\n apply (subst bit.conj_assoc[symmetric])\n apply simp\n done\n\nlemma decode_pt_inv_map_wf[wp]:\n \"arch_cap = PageTableCap pt_ptr pt_map_data \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n decode_pt_inv_map label args slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n unfolding decode_pt_inv_map_def Let_def\n apply wpsimp\n apply (clarsimp simp: valid_arch_inv_def valid_pti_def pte_at_eq invalid_pte_at_def\n wellformed_pte_def valid_cap_def cte_wp_at_caps_of_state)\n apply (rename_tac p level)\n apply (prop_tac \"args!0 \\ user_region\")\n apply (simp add: wellformed_mapdata_def user_region_def user_vtop_canonical_user)\n apply (rule conjI, clarsimp simp: valid_arch_cap_def wellformed_mapdata_def vspace_for_asid_def\n neg_mask_user_region)\n apply (rule conjI, clarsimp simp: is_arch_update_def is_cap_simps cap_master_cap_simps)\n apply (simp add: ptrFromPAddr_addr_from_ppn cap_aligned_def)\n apply (drule (1) pt_lookup_slot_vs_lookup_slotI)\n apply (rule_tac x=level in exI, simp add: vm_level_not_less_zero)\n apply (clarsimp simp: obj_at_def)\n apply (rule conjI, clarsimp)\n apply (drule valid_table_caps_pdD, clarsimp)\n apply (clarsimp simp: in_omonad)\n apply (rule_tac x=\"args!0\" in exI)\n apply (simp add: vref_for_level_def)\n done\n\nlemma decode_page_table_invocation_wf[wp]:\n \"arch_cap = PageTableCap pt_ptr pt_map_data \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and real_cte_at slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n decode_page_table_invocation label args slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n unfolding decode_page_table_invocation_def is_final_cap_def\n apply (wpsimp simp: valid_arch_inv_def valid_pti_def valid_arch_cap_def valid_cap_def\n cte_wp_at_caps_of_state is_cap_simps)\n apply (rule conjI; clarsimp)\n done\n\nlemma cte_wp_at_eq_simp:\n \"cte_wp_at ((=) cap) = cte_wp_at (\\c. c = cap)\"\n by (force intro: arg_cong [where f=cte_wp_at])\n\nlemma asid_low_hi_cast:\n \"is_aligned asid_hi asid_low_bits \\\n ucast (ucast asid_low + (asid_hi::asid)) = (asid_low :: asid_low_index)\"\n apply (simp add: is_aligned_nth asid_low_bits_def)\n apply (subst word_plus_and_or_coroll; word_eqI_solve)\n done\n\nlemma decode_asid_pool_invocation_wf[wp]:\n \"arch_cap = ASIDPoolCap ap asid \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and\n (\\s. \\x \\ set excaps. s \\ (fst x))\\\n decode_asid_pool_invocation label args slot arch_cap excaps\n \\valid_arch_inv\\, -\"\n unfolding decode_asid_pool_invocation_def Let_def\n apply wpsimp\n apply (rule ccontr, erule notE[where P=\"valid_arch_inv i s\" for i s])\n apply (clarsimp simp: valid_arch_inv_def valid_apinv_def pool_for_asid_def word_neq_0_conv\n cte_wp_at_caps_of_state neq_Nil_conv obj_at_def in_omonad valid_cap_def\n asid_low_hi_cast asid_high_bits_of_add_ucast)\n done\n\nlemma decode_asid_control_invocation_wf[wp]:\n \"arch_cap = ASIDControlCap \\\n \\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and\n (\\s. \\x \\ set excaps. s \\ (fst x))\\\n decode_asid_control_invocation label args slot ASIDControlCap excaps\n \\valid_arch_inv\\, -\"\n unfolding decode_asid_control_invocation_def valid_arch_inv_def\n apply (simp add: Let_def split_def cong: if_cong split del: if_split)\n apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger\n | wpc | simp add: valid_arch_inv_def valid_aci_def is_aligned_shiftl_self)+)[1]\n apply (rule_tac Q'= \"\\rv. real_cte_at rv\n and ex_cte_cap_wp_to is_cnode_cap rv\n and (\\s. descendants_of (snd (excaps!0)) (cdt s) = {})\n and cte_wp_at (\\c. \\idx. c = UntypedCap False frame pageBits idx) (snd (excaps!0))\n and (\\s. riscv_asid_table (arch_state s) free = None)\"\n in hoare_post_imp_R)\n apply (simp add: lookup_target_slot_def)\n apply wp\n apply (clarsimp simp: cte_wp_at_def)\n apply (wpsimp wp: ensure_no_children_sp select_ext_weak_wp select_wp whenE_throwError_wp)+\n apply (rule conjI, fastforce)\n apply (cases excaps, simp)\n apply (case_tac list, simp)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (simp add: ex_cte_cap_wp_to_def)\n apply (rule_tac x=ac in exI)\n apply (rule_tac x=ba in exI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n done\n\nlemma arch_decode_inv_wf[wp]:\n \"\\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and real_cte_at slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and\n (\\s. \\x \\ set excaps. s \\ (fst x))\\\n arch_decode_invocation label args x_slot slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n unfolding arch_decode_invocation_def by wpsimp fastforce\n\ndeclare word_less_sub_le [simp]\n\ncrunch pred_tcb_at [wp]:\n perform_page_table_invocation, perform_page_invocation, perform_asid_pool_invocation\n \"pred_tcb_at proj P t\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma arch_pinv_st_tcb_at:\n \"\\invs and valid_arch_inv ai and ct_active and\n st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\\\n arch_perform_invocation ai\n \\\\rv. st_tcb_at P t\\\"\n apply (cases ai; simp add: arch_perform_invocation_def valid_arch_inv_def)\n apply (wp perform_asid_control_invocation_st_tcb_at; fastforce elim!: pred_tcb_weakenE)+\n done\n\nend\n\n\ncontext begin interpretation Arch .\n\nrequalify_consts\n valid_arch_inv\n\nrequalify_facts\n invoke_arch_tcb\n invoke_arch_invs\n sts_valid_arch_inv\n arch_decode_inv_wf\n arch_pinv_st_tcb_at\n\nend\n\ndeclare invoke_arch_invs[wp]\ndeclare arch_decode_inv_wf[wp]\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/RISCV64/ArchArch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.25019670745147277}} {"text": "(* Title: HOL/Auth/TLS.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1997 University of Cambridge\n\nInductive relation \"tls\" for the TLS (Transport Layer Security) protocol.\nThis protocol is essentially the same as SSL 3.0.\n\nAbstracted from \"The TLS Protocol, Version 1.0\" by Tim Dierks and Christopher\nAllen, Transport Layer Security Working Group, 21 May 1997,\nINTERNET-DRAFT draft-ietf-tls-protocol-03.txt. Section numbers below refer\nto that memo.\n\nAn RSA cryptosystem is assumed, and X.509v3 certificates are abstracted down\nto the trivial form {A, publicKey(A)}privateKey(Server), where Server is a\nglobal signing authority.\n\nA is the client and B is the server, not to be confused with the constant\nServer, who is in charge of all public keys.\n\nThe model assumes that no fraudulent certificates are present, but it does\nassume that some private keys are to the spy.\n\nREMARK. The event \"Notes A \\Agent B, Nonce PMS\\\" appears in ClientKeyExch,\nCertVerify, ClientFinished to record that A knows M. It is a note from A to\nherself. Nobody else can see it. In ClientKeyExch, the Spy can substitute\nhis own certificate for A's, but he cannot replace A's note by one for himself.\n\nThe Note event avoids a weakness in the public-key model. Each\nagent's state is recorded as the trace of messages. When the true client (A)\ninvents PMS, he encrypts PMS with B's public key before sending it. The model\ndoes not distinguish the original occurrence of such a message from a replay.\nIn the shared-key model, the ability to encrypt implies the ability to\ndecrypt, so the problem does not arise.\n\nProofs would be simpler if ClientKeyExch included A's name within\nCrypt KB (Nonce PMS). As things stand, there is much overlap between proofs\nabout that message (which B receives) and the stronger event\nNotes A \\Agent B, Nonce PMS\\.\n*)\n\nsection\\The TLS Protocol: Transport Layer Security\\\n\ntheory TLS imports Public \"HOL-Library.Nat_Bijection\" begin\n\ndefinition certificate :: \"[agent,key] \\ msg\" where\n \"certificate A KA == Crypt (priSK Server) \\Agent A, Key KA\\\"\n\ntext\\TLS apparently does not require separate keypairs for encryption and\nsignature. Therefore, we formalize signature as encryption using the\nprivate encryption key.\\\n\ndatatype role = ClientRole | ServerRole\n\nconsts\n (*Pseudo-random function of Section 5*)\n PRF :: \"nat*nat*nat \\ nat\"\n\n (*Client, server write keys are generated uniformly by function sessionK\n to avoid duplicating their properties. They are distinguished by a\n tag (not a bool, to avoid the peculiarities of if-and-only-if).\n Session keys implicitly include MAC secrets.*)\n sessionK :: \"(nat*nat*nat) * role \\ key\"\n\nabbreviation\n clientK :: \"nat*nat*nat \\ key\" where\n \"clientK X == sessionK(X, ClientRole)\"\n\nabbreviation\n serverK :: \"nat*nat*nat \\ key\" where\n \"serverK X == sessionK(X, ServerRole)\"\n\n\nspecification (PRF)\n inj_PRF: \"inj PRF\"\n \\ \\the pseudo-random function is collision-free\\\n apply (rule exI [of _ \"\\(x,y,z). prod_encode(x, prod_encode(y,z))\"])\n apply (simp add: inj_on_def prod_encode_eq)\n done\n\nspecification (sessionK)\n inj_sessionK: \"inj sessionK\"\n \\ \\sessionK is collision-free; also, no clientK clashes with any serverK.\\\n apply (rule exI [of _ \n \"\\((x,y,z), r). prod_encode(case_role 0 1 r, \n prod_encode(x, prod_encode(y,z)))\"])\n apply (simp add: inj_on_def prod_encode_eq split: role.split) \n done\n\naxiomatization where\n \\ \\sessionK makes symmetric keys\\\n isSym_sessionK: \"sessionK nonces \\ symKeys\" and\n\n \\ \\sessionK never clashes with a long-term symmetric key \n (they don't exist in TLS anyway)\\\n sessionK_neq_shrK [iff]: \"sessionK nonces \\ shrK A\"\n\n\ninductive_set tls :: \"event list set\"\n where\n Nil: \\ \\The initial, empty trace\\\n \"[] \\ tls\"\n\n | Fake: \\ \\The Spy may say anything he can say. The sender field is correct,\n but agents don't use that information.\\\n \"\\evsf \\ tls; X \\ synth (analz (spies evsf))\\\n \\ Says Spy B X # evsf \\ tls\"\n\n | SpyKeys: \\ \\The spy may apply \\<^term>\\PRF\\ and \\<^term>\\sessionK\\\n to available nonces\\\n \"\\evsSK \\ tls;\n {Nonce NA, Nonce NB, Nonce M} \\ analz (spies evsSK)\\\n \\ Notes Spy \\ Nonce (PRF(M,NA,NB)),\n Key (sessionK((NA,NB,M),role))\\ # evsSK \\ tls\"\n\n | ClientHello:\n \\ \\(7.4.1.2)\n PA represents \\CLIENT_VERSION\\, \\CIPHER_SUITES\\ and \\COMPRESSION_METHODS\\.\n It is uninterpreted but will be confirmed in the FINISHED messages.\n NA is CLIENT RANDOM, while SID is \\SESSION_ID\\.\n UNIX TIME is omitted because the protocol doesn't use it.\n May assume \\<^term>\\NA \\ range PRF\\ because CLIENT RANDOM is \n 28 bytes while MASTER SECRET is 48 bytes\\\n \"\\evsCH \\ tls; Nonce NA \\ used evsCH; NA \\ range PRF\\\n \\ Says A B \\Agent A, Nonce NA, Number SID, Number PA\\\n # evsCH \\ tls\"\n\n | ServerHello:\n \\ \\7.4.1.3 of the TLS Internet-Draft\n PB represents \\CLIENT_VERSION\\, \\CIPHER_SUITE\\ and \\COMPRESSION_METHOD\\.\n SERVER CERTIFICATE (7.4.2) is always present.\n \\CERTIFICATE_REQUEST\\ (7.4.4) is implied.\\\n \"\\evsSH \\ tls; Nonce NB \\ used evsSH; NB \\ range PRF;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsSH\\\n \\ Says B A \\Nonce NB, Number SID, Number PB\\ # evsSH \\ tls\"\n\n | Certificate:\n \\ \\SERVER (7.4.2) or CLIENT (7.4.6) CERTIFICATE.\\\n \"evsC \\ tls \\ Says B A (certificate B (pubK B)) # evsC \\ tls\"\n\n | ClientKeyExch:\n \\ \\CLIENT KEY EXCHANGE (7.4.7).\n The client, A, chooses PMS, the PREMASTER SECRET.\n She encrypts PMS using the supplied KB, which ought to be pubK B.\n We assume \\<^term>\\PMS \\ range PRF\\ because a clash betweem the PMS\n and another MASTER SECRET is highly unlikely (even though\n both items have the same length, 48 bytes).\n The Note event records in the trace that she knows PMS\n (see REMARK at top).\\\n \"\\evsCX \\ tls; Nonce PMS \\ used evsCX; PMS \\ range PRF;\n Says B' A (certificate B KB) \\ set evsCX\\\n \\ Says A B (Crypt KB (Nonce PMS))\n # Notes A \\Agent B, Nonce PMS\\\n # evsCX \\ tls\"\n\n | CertVerify:\n \\ \\The optional Certificate Verify (7.4.8) message contains the\n specific components listed in the security analysis, F.1.1.2.\n It adds the pre-master-secret, which is also essential!\n Checking the signature, which is the only use of A's certificate,\n assures B of A's presence\\\n \"\\evsCV \\ tls;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCV;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCV\\\n \\ Says A B (Crypt (priK A) (Hash\\Nonce NB, Agent B, Nonce PMS\\))\n # evsCV \\ tls\"\n\n \\ \\Finally come the FINISHED messages (7.4.8), confirming PA and PB\n among other things. The master-secret is PRF(PMS,NA,NB).\n Either party may send its message first.\\\n\n | ClientFinished:\n \\ \\The occurrence of \\Notes A \\Agent B, Nonce PMS\\\\ stops the\n rule's applying when the Spy has satisfied the \\Says A B\\ by\n repaying messages sent by the true client; in that case, the\n Spy does not know PMS and could not send ClientFinished. One\n could simply put \\<^term>\\A\\Spy\\ into the rule, but one should not\n expect the spy to be well-behaved.\\\n \"\\evsCF \\ tls;\n Says A B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsCF;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCF;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCF;\n M = PRF(PMS,NA,NB)\\\n \\ Says A B (Crypt (clientK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsCF \\ tls\"\n\n | ServerFinished:\n \\ \\Keeping A' and A'' distinct means B cannot even check that the\n two messages originate from the same source.\\\n \"\\evsSF \\ tls;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\\n \\ set evsSF;\n Says B A \\Nonce NB, Number SID, Number PB\\ \\ set evsSF;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSF;\n M = PRF(PMS,NA,NB)\\\n \\ Says B A (Crypt (serverK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsSF \\ tls\"\n\n | ClientAccepts:\n \\ \\Having transmitted ClientFinished and received an identical\n message encrypted with serverK, the client stores the parameters\n needed to resume this session. The \"Notes A ...\" premise is\n used to prove \\Notes_master_imp_Crypt_PMS\\.\\\n \"\\evsCA \\ tls;\n Notes A \\Agent B, Nonce PMS\\ \\ set evsCA;\n M = PRF(PMS,NA,NB);\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\;\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evsCA;\n Says B' A (Crypt (serverK(NA,NB,M)) X) \\ set evsCA\\\n \\\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ # evsCA \\ tls\"\n\n | ServerAccepts:\n \\ \\Having transmitted ServerFinished and received an identical\n message encrypted with clientK, the server stores the parameters\n needed to resume this session. The \"Says A'' B ...\" premise is\n used to prove \\Notes_master_imp_Crypt_PMS\\.\\\n \"\\evsSA \\ tls;\n A \\ B;\n Says A'' B (Crypt (pubK B) (Nonce PMS)) \\ set evsSA;\n M = PRF(PMS,NA,NB);\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\;\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evsSA;\n Says A' B (Crypt (clientK(NA,NB,M)) X) \\ set evsSA\\\n \\\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ # evsSA \\ tls\"\n\n | ClientResume:\n \\ \\If A recalls the \\SESSION_ID\\, then she sends a FINISHED\n message using the new nonces and stored MASTER SECRET.\\\n \"\\evsCR \\ tls;\n Says A B \\Agent A, Nonce NA, Number SID, Number PA\\ \\ set evsCR;\n Says B' A \\Nonce NB, Number SID, Number PB\\ \\ set evsCR;\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evsCR\\\n \\ Says A B (Crypt (clientK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\))\n # evsCR \\ tls\"\n\n | ServerResume:\n \\ \\Resumption (7.3): If B finds the \\SESSION_ID\\ then he can \n send a FINISHED message using the recovered MASTER SECRET\\\n \"\\evsSR \\ tls;\n Says A' B \\Agent A, Nonce NA, Number SID, Number PA\\ \\ set evsSR;\n Says B A \\Nonce NB, Number SID, Number PB\\ \\ set evsSR;\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evsSR\\\n \\ Says B A (Crypt (serverK(NA,NB,M))\n (Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\)) # evsSR\n \\ tls\"\n\n | Oops:\n \\ \\The most plausible compromise is of an old session key. Losing\n the MASTER SECRET or PREMASTER SECRET is more serious but\n rather unlikely. The assumption \\<^term>\\A\\Spy\\ is essential: \n otherwise the Spy could learn session keys merely by \n replaying messages!\\\n \"\\evso \\ tls; A \\ Spy;\n Says A B (Crypt (sessionK((NA,NB,M),role)) X) \\ set evso\\\n \\ Says A Spy (Key (sessionK((NA,NB,M),role))) # evso \\ tls\"\n\n(*\nProtocol goals:\n* M, serverK(NA,NB,M) and clientK(NA,NB,M) will be known only to the two\n parties (though A is not necessarily authenticated).\n\n* B upon receiving CertVerify knows that A is present (But this\n message is optional!)\n\n* A upon receiving ServerFinished knows that B is present\n\n* Each party who has received a FINISHED message can trust that the other\n party agrees on all message components, including PA and PB (thus foiling\n rollback attacks).\n*)\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\ntext\\Automatically unfold the definition of \"certificate\"\\\ndeclare certificate_def [simp]\n\ntext\\Injectiveness of key-generating functions\\\ndeclare inj_PRF [THEN inj_eq, iff]\ndeclare inj_sessionK [THEN inj_eq, iff]\ndeclare isSym_sessionK [simp]\n\n\n(*** clientK and serverK make symmetric keys; no clashes with pubK or priK ***)\n\nlemma pubK_neq_sessionK [iff]: \"publicKey b A \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare pubK_neq_sessionK [THEN not_sym, iff]\n\nlemma priK_neq_sessionK [iff]: \"invKey (publicKey b A) \\ sessionK arg\"\nby (simp add: symKeys_neq_imp_neq)\n\ndeclare priK_neq_sessionK [THEN not_sym, iff]\n\nlemmas keys_distinct = pubK_neq_sessionK priK_neq_sessionK\n\n\nsubsection\\Protocol Proofs\\\n\ntext\\Possibility properties state that some traces run the protocol to the\nend. Four paths and 12 rules are considered.\\\n\n\n(** These proofs assume that the Nonce_supply nonces\n (which have the form @ N. Nonce N \\ used evs)\n lie outside the range of PRF. It seems reasonable, but as it is needed\n only for the possibility theorems, it is not taken as an axiom.\n**)\n\n\ntext\\Possibility property ending with ClientAccepts.\\\nlemma \"\\\\evs. (SOME N. Nonce N \\ used evs) \\ range PRF; A \\ B\\\n \\ \\SID M. \\evs \\ tls.\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ClientFinished, THEN tls.ServerFinished,\n THEN tls.ClientAccepts], possibility, blast+)\ndone\n\n\ntext\\And one for ServerAccepts. Either FINISHED message may come first.\\\nlemma \"\\\\evs. (SOME N. Nonce N \\ used evs) \\ range PRF; A \\ B\\\n \\ \\SID NA PA NB PB M. \\evs \\ tls.\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.ServerFinished, THEN tls.ClientFinished, \n THEN tls.ServerAccepts], possibility, blast+)\ndone\n\n\ntext\\Another one, for CertVerify (which is optional)\\\nlemma \"\\\\evs. (SOME N. Nonce N \\ used evs) \\ range PRF; A \\ B\\\n \\ \\NB PMS. \\evs \\ tls.\n Says A B (Crypt (priK A) (Hash\\Nonce NB, Agent B, Nonce PMS\\)) \n \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.Nil\n [THEN tls.ClientHello, THEN tls.ServerHello,\n THEN tls.Certificate, THEN tls.ClientKeyExch,\n THEN tls.CertVerify], possibility, blast+)\ndone\n\n\ntext\\Another one, for session resumption (both ServerResume and ClientResume).\n NO tls.Nil here: we refer to a previous session, not the empty trace.\\\nlemma \"\\evs0 \\ tls;\n Notes A \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs0;\n Notes B \\Number SID, Agent A, Agent B, Nonce M\\ \\ set evs0;\n \\evs. (SOME N. Nonce N \\ used evs) \\ range PRF;\n A \\ B\\\n \\ \\NA PA NB PB X. \\evs \\ tls.\n X = Hash\\Number SID, Nonce M,\n Nonce NA, Number PA, Agent A,\n Nonce NB, Number PB, Agent B\\ \\\n Says A B (Crypt (clientK(NA,NB,M)) X) \\ set evs \\\n Says B A (Crypt (serverK(NA,NB,M)) X) \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] tls.ClientHello\n [THEN tls.ServerHello,\n THEN tls.ServerResume, THEN tls.ClientResume], possibility, blast+)\ndone\n\n\nsubsection\\Inductive proofs about tls\\\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\ntext\\Spy never sees a good agent's private key!\\\nlemma Spy_see_priK [simp]:\n \"evs \\ tls \\ (Key (privateKey b A) \\ parts (spies evs)) = (A \\ bad)\"\nby (erule tls.induct, force, simp_all, blast)\n\nlemma Spy_analz_priK [simp]:\n \"evs \\ tls \\ (Key (privateKey b A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_priK_D [dest!]:\n \"\\Key (privateKey b A) \\ parts (knows Spy evs); evs \\ tls\\ \\ A \\ bad\"\nby (blast dest: Spy_see_priK)\n\n\ntext\\This lemma says that no false certificates exist. One might extend the\n model to include bogus certificates for the agents, but there seems\n little point in doing so: the loss of their private keys is a worse\n breach of security.\\\nlemma certificate_valid:\n \"\\certificate B KB \\ parts (spies evs); evs \\ tls\\ \\ KB = pubK B\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast) \ndone\n\nlemmas CX_KB_is_pubKB = Says_imp_spies [THEN parts.Inj, THEN certificate_valid]\n\n\nsubsubsection\\Properties of items found in Notes\\\n\nlemma Notes_Crypt_parts_spies:\n \"\\Notes A \\Agent B, X\\ \\ set evs; evs \\ tls\\\n \\ Crypt (pubK B) X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, \n frule_tac [7] CX_KB_is_pubKB, force, simp_all)\napply (blast intro: parts_insertI)\ndone\n\ntext\\C may be either A or B\\\nlemma Notes_master_imp_Crypt_PMS:\n \"\\Notes C \\s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))\\ \\ set evs;\n evs \\ tls\\\n \\ Crypt (pubK B) (Nonce PMS) \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\Client, Server Accept\\\napply (blast dest!: Notes_Crypt_parts_spies)+\ndone\n\ntext\\Compared with the theorem above, both premise and conclusion are stronger\\\nlemma Notes_master_imp_Notes_PMS:\n \"\\Notes A \\s, Agent A, Agent B, Nonce(PRF(PMS,NA,NB))\\ \\ set evs;\n evs \\ tls\\\n \\ Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\ServerAccepts\\\napply blast\ndone\n\n\nsubsubsection\\Protocol goal: if B receives CertVerify, then A sent it\\\n\ntext\\B can check A's signature if he has received A's certificate.\\\nlemma TrustCertVerify_lemma:\n \"\\X \\ parts (spies evs);\n X = Crypt (priK A) (Hash\\nb, Agent B, pms\\);\n evs \\ tls; A \\ bad\\\n \\ Says A B X \\ set evs\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext\\Final version: B checks X using the distributed KA instead of priK A\\\nlemma TrustCertVerify:\n \"\\X \\ parts (spies evs);\n X = Crypt (invKey KA) (Hash\\nb, Agent B, pms\\);\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad\\\n \\ Says A B X \\ set evs\"\nby (blast dest!: certificate_valid intro!: TrustCertVerify_lemma)\n\n\ntext\\If CertVerify is present then A has chosen PMS.\\\nlemma UseCertVerify_lemma:\n \"\\Crypt (priK A) (Hash\\nb, Agent B, Nonce PMS\\) \\ parts (spies evs);\n evs \\ tls; A \\ bad\\\n \\ Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all, blast)\ndone\n\ntext\\Final version using the distributed KA instead of priK A\\\nlemma UseCertVerify:\n \"\\Crypt (invKey KA) (Hash\\nb, Agent B, Nonce PMS\\)\n \\ parts (spies evs);\n certificate A KA \\ parts (spies evs);\n evs \\ tls; A \\ bad\\\n \\ Notes A \\Agent B, Nonce PMS\\ \\ set evs\"\nby (blast dest!: certificate_valid intro!: UseCertVerify_lemma)\n\n\nlemma no_Notes_A_PRF [simp]:\n \"evs \\ tls \\ Notes A \\Agent B, Nonce (PRF x)\\ \\ set evs\"\napply (erule tls.induct, force, simp_all)\ntxt\\ClientKeyExch: PMS is assumed to differ from any PRF.\\\napply blast\ndone\n\n\nlemma MS_imp_PMS [dest!]:\n \"\\Nonce (PRF (PMS,NA,NB)) \\ parts (spies evs); evs \\ tls\\\n \\ Nonce PMS \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\Easy, e.g. by freshness\\\napply (blast dest: Notes_Crypt_parts_spies)+\ndone\n\n\n\n\nsubsubsection\\Unicity results for PMS, the pre-master-secret\\\n\ntext\\PMS determines B.\\\nlemma Crypt_unique_PMS:\n \"\\Crypt(pubK B) (Nonce PMS) \\ parts (spies evs);\n Crypt(pubK B') (Nonce PMS) \\ parts (spies evs);\n Nonce PMS \\ analz (spies evs);\n evs \\ tls\\\n \\ B=B'\"\napply (erule rev_mp, erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra, force, simp_all (no_asm_simp))\ntxt\\Fake, ClientKeyExch\\\napply blast+\ndone\n\n\n(** It is frustrating that we need two versions of the unicity results.\n But Notes A \\Agent B, Nonce PMS\\ determines both A and B. Sometimes\n we have only the weaker assertion Crypt(pubK B) (Nonce PMS), which\n determines B alone, and only if PMS is secret.\n**)\n\ntext\\In A's internal Note, PMS determines A and B.\\\nlemma Notes_unique_PMS:\n \"\\Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Notes A' \\Agent B', Nonce PMS\\ \\ set evs;\n evs \\ tls\\\n \\ A=A' \\ B=B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: Notes_Crypt_parts_spies)\ndone\n\n\nsubsection\\Secrecy Theorems\\\n\ntext\\Key compromise lemma needed to prove \\<^term>\\analz_image_keys\\.\n No collection of keys can help the spy get new private keys.\\\nlemma analz_image_priK [rule_format]:\n \"evs \\ tls\n \\ \\KK. (Key(priK B) \\ analz (Key`KK \\ (spies evs))) =\n (priK B \\ KK | B \\ bad)\"\napply (erule tls.induct)\napply (simp_all (no_asm_simp)\n del: image_insert\n add: image_Un [THEN sym]\n insert_Key_image Un_assoc [THEN sym])\ntxt\\Fake\\\napply spy_analz\ndone\n\n\ntext\\slightly speeds up the big simplification below\\\nlemma range_sessionkeys_not_priK:\n \"KK \\ range sessionK \\ priK B \\ KK\"\nby blast\n\n\ntext\\Lemma for the trivial direction of the if-and-only-if\\\nlemma analz_image_keys_lemma:\n \"(X \\ analz (G \\ H)) \\ (X \\ analz H) \\\n (X \\ analz (G \\ H)) = (X \\ analz H)\"\nby (blast intro: analz_mono [THEN subsetD])\n\n(** Strangely, the following version doesn't work:\n\\Z. (Nonce N \\ analz (Key`(sessionK`Z) \\ (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\n**)\n\nlemma analz_image_keys [rule_format]:\n \"evs \\ tls \\\n \\KK. KK \\ range sessionK \\\n (Nonce N \\ analz (Key`KK \\ (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (safe del: iffI)\napply (safe del: impI iffI intro!: analz_image_keys_lemma)\napply (simp_all (no_asm_simp) (*faster*)\n del: image_insert imp_disjL (*reduces blow-up*)\n add: image_Un [THEN sym] Un_assoc [THEN sym]\n insert_Key_singleton\n range_sessionkeys_not_priK analz_image_priK)\napply (simp_all add: insert_absorb)\ntxt\\Fake\\\napply spy_analz\ndone\n\ntext\\Knowing some session keys is no help in getting new nonces\\\nlemma analz_insert_key [simp]:\n \"evs \\ tls \\\n (Nonce N \\ analz (insert (Key (sessionK z)) (spies evs))) =\n (Nonce N \\ analz (spies evs))\"\nby (simp del: image_insert\n add: insert_Key_singleton analz_image_keys)\n\n\nsubsubsection\\Protocol goal: serverK(Na,Nb,M) and clientK(Na,Nb,M) remain secure\\\n\n(** Some lemmas about session keys, comprising clientK and serverK **)\n\n\ntext\\Lemma: session keys are never used if PMS is fresh.\n Nonces don't have to agree, allowing session resumption.\n Converse doesn't hold; revealing PMS doesn't force the keys to be sent.\n THEY ARE NOT SUITABLE AS SAFE ELIM RULES.\\\nlemma PMS_lemma:\n \"\\Nonce PMS \\ parts (spies evs);\n K = sessionK((Na, Nb, PRF(PMS,NA,NB)), role);\n evs \\ tls\\\n \\ Key K \\ parts (spies evs) \\ (\\Y. Crypt K Y \\ parts (spies evs))\"\napply (erule rev_mp, erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB) \napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ntxt\\SpyKeys\\\napply blast\ntxt\\Many others\\\napply (force dest!: Notes_Crypt_parts_spies Notes_master_imp_Crypt_PMS)+\ndone\n\nlemma PMS_sessionK_not_spied:\n \"\\Key (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) \\ parts (spies evs);\n evs \\ tls\\\n \\ Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\nlemma PMS_Crypt_sessionK_not_spied:\n \"\\Crypt (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) Y\n \\ parts (spies evs); evs \\ tls\\\n \\ Nonce PMS \\ parts (spies evs)\"\nby (blast dest: PMS_lemma)\n\ntext\\Write keys are never sent if M (MASTER SECRET) is secure.\n Converse fails; betraying M doesn't force the keys to be sent!\n The strong Oops condition can be weakened later by unicity reasoning,\n with some effort.\n NO LONGER USED: see \\clientK_not_spied\\ and \\serverK_not_spied\\\\\nlemma sessionK_not_spied:\n \"\\\\A. Says A Spy (Key (sessionK((NA,NB,M),role))) \\ set evs;\n Nonce M \\ analz (spies evs); evs \\ tls\\\n \\ Key (sessionK((NA,NB,M),role)) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, analz_mono_contra)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake, SpyKeys\\\napply blast+\ndone\n\n\ntext\\If A sends ClientKeyExch to an honest B, then the PMS will stay secret.\\\nlemma Spy_not_see_PMS:\n \"\\Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad\\\n \\ Nonce PMS \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply spy_analz\ntxt\\SpyKeys\\\napply force\napply (simp_all add: insert_absorb) \ntxt\\ClientHello, ServerHello, ClientKeyExch: mostly freshness reasoning\\\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\napply (blast dest: Notes_Crypt_parts_spies)\ntxt\\ClientAccepts and ServerAccepts: because \\<^term>\\PMS \\ range PRF\\\\\napply force+\ndone\n\n\ntext\\If A sends ClientKeyExch to an honest B, then the MASTER SECRET\n will stay secret.\\\nlemma Spy_not_see_MS:\n \"\\Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad\\\n \\ Nonce (PRF(PMS,NA,NB)) \\ analz (spies evs)\"\napply (erule rev_mp, erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply spy_analz\ntxt\\SpyKeys: by secrecy of the PMS, Spy cannot make the MS\\\napply (blast dest!: Spy_not_see_PMS)\napply (simp_all add: insert_absorb)\ntxt\\ClientAccepts and ServerAccepts: because PMS was already visible;\n others, freshness etc.\\\napply (blast dest: Notes_Crypt_parts_spies Spy_not_see_PMS \n Notes_imp_knows_Spy [THEN analz.Inj])+\ndone\n\n\n\nsubsubsection\\Weakening the Oops conditions for leakage of clientK\\\n\ntext\\If A created PMS then nobody else (except the Spy in replays)\n would send a message using a clientK generated from that PMS.\\\nlemma Says_clientK_unique:\n \"\\Says A' B' (Crypt (clientK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A' \\ Spy\\\n \\ A = A'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ClientFinished, ClientResume: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Notes_PMS \n intro: Notes_unique_PMS [THEN conjunct1])+\ndone\n\n\ntext\\If A created PMS and has not leaked her clientK to the Spy,\n then it is completely secure: not even in parts!\\\nlemma clientK_not_spied:\n \"\\Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Says A Spy (Key (clientK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad;\n evs \\ tls\\\n \\ Key (clientK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\ClientKeyExch\\\napply blast \ntxt\\SpyKeys\\\napply (blast dest!: Spy_not_see_MS)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_sessionK_not_spied)\ntxt\\Oops\\\napply (blast intro: Says_clientK_unique)\ndone\n\n\nsubsubsection\\Weakening the Oops conditions for leakage of serverK\\\n\ntext\\If A created PMS for B, then nobody other than B or the Spy would\n send a message using a serverK generated from that PMS.\\\nlemma Says_serverK_unique:\n \"\\Says B' A' (Crypt (serverK(Na,Nb,PRF(PMS,NA,NB))) Y) \\ set evs;\n Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad; B' \\ Spy\\\n \\ B = B'\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ServerResume, ServerFinished: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\ntext\\If A created PMS for B, and B has not leaked his serverK to the Spy,\n then it is completely secure: not even in parts!\\\nlemma serverK_not_spied:\n \"\\Notes A \\Agent B, Nonce PMS\\ \\ set evs;\n Says B Spy (Key(serverK(Na,Nb,PRF(PMS,NA,NB)))) \\ set evs;\n A \\ bad; B \\ bad; evs \\ tls\\\n \\ Key (serverK(Na,Nb,PRF(PMS,NA,NB))) \\ parts (spies evs)\"\napply (erule rev_mp, erule rev_mp)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake\\\napply blast \ntxt\\SpyKeys\\\napply (blast dest!: Spy_not_see_MS)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_sessionK_not_spied)\ntxt\\Oops\\\napply (blast intro: Says_serverK_unique)\ndone\n\n\nsubsubsection\\Protocol goals: if A receives ServerFinished, then B is present\n and has used the quoted values PA, PB, etc. Note that it is up to A\n to compare PA with what she originally sent.\\\n\ntext\\The mention of her name (A) in X assures A that B knows who she is.\\\nlemma TrustServerFinished [rule_format]:\n \"\\X = Crypt (serverK(Na,Nb,M))\n (Hash\\Number SID, Nonce M,\n Nonce Na, Number PA, Agent A,\n Nonce Nb, Number PB, Agent B\\);\n M = PRF(PMS,NA,NB);\n evs \\ tls; A \\ bad; B \\ bad\\\n \\ Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs \\\n Notes A \\Agent B, Nonce PMS\\ \\ set evs \\\n X \\ parts (spies evs) \\ Says B A X \\ set evs\"\napply (erule ssubst)+\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: serverK_not_spied)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ndone\n\ntext\\This version refers not to ServerFinished but to any message from B.\n We don't assume B has received CertVerify, and an intruder could\n have changed A's identity in all other messages, so we can't be sure\n that B sends his message to A. If CLIENT KEY EXCHANGE were augmented\n to bind A's identity with PMS, then we could replace A' by A below.\\\nlemma TrustServerMsg [rule_format]:\n \"\\M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad\\\n \\ Says B Spy (Key(serverK(Na,Nb,M))) \\ set evs \\\n Notes A \\Agent B, Nonce PMS\\ \\ set evs \\\n Crypt (serverK(Na,Nb,M)) Y \\ parts (spies evs) \\\n (\\A'. Says B A' (Crypt (serverK(Na,Nb,M)) Y) \\ set evs)\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp) add: ex_disj_distrib)\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: serverK_not_spied)\ntxt\\ClientKeyExch\\\napply (clarify, blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ServerResume, ServerFinished: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Crypt_PMS \n dest: Spy_not_see_PMS Notes_Crypt_parts_spies Crypt_unique_PMS)+\ndone\n\n\nsubsubsection\\Protocol goal: if B receives any message encrypted with clientK\n then A has sent it\\\n\ntext\\ASSUMING that A chose PMS. Authentication is\n assumed here; B cannot verify it. But if the message is\n ClientFinished, then B can then check the quoted values PA, PB, etc.\\\n\nlemma TrustClientMsg [rule_format]:\n \"\\M = PRF(PMS,NA,NB); evs \\ tls; A \\ bad; B \\ bad\\\n \\ Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs \\\n Notes A \\Agent B, Nonce PMS\\ \\ set evs \\\n Crypt (clientK(Na,Nb,M)) Y \\ parts (spies evs) \\\n Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\napply (erule ssubst)\napply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)\napply (force, simp_all (no_asm_simp))\ntxt\\Fake: the Spy doesn't have the critical session key!\\\napply (blast dest: clientK_not_spied)\ntxt\\ClientKeyExch\\\napply (blast dest!: PMS_Crypt_sessionK_not_spied)\ntxt\\ClientFinished, ClientResume: by unicity of PMS\\\napply (blast dest!: Notes_master_imp_Notes_PMS dest: Notes_unique_PMS)+\ndone\n\n\nsubsubsection\\Protocol goal: if B receives ClientFinished, and if B is able to\n check a CertVerify from A, then A has used the quoted\n values PA, PB, etc. Even this one requires A to be uncompromised.\\\nlemma AuthClientFinished:\n \"\\M = PRF(PMS,NA,NB);\n Says A Spy (Key(clientK(Na,Nb,M))) \\ set evs;\n Says A' B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs;\n certificate A KA \\ parts (spies evs);\n Says A'' B (Crypt (invKey KA) (Hash\\nb, Agent B, Nonce PMS\\))\n \\ set evs;\n evs \\ tls; A \\ bad; B \\ bad\\\n \\ Says A B (Crypt (clientK(Na,Nb,M)) Y) \\ set evs\"\nby (blast intro!: TrustClientMsg UseCertVerify)\n\n(*22/9/97: loads in 622s, which is 10 minutes 22 seconds*)\n(*24/9/97: loads in 672s, which is 11 minutes 12 seconds [stronger theorems]*)\n(*29/9/97: loads in 481s, after removing Certificate from ClientKeyExch*)\n(*30/9/97: loads in 476s, after removing unused theorems*)\n(*30/9/97: loads in 448s, after fixing ServerResume*)\n\n(*08/9/97: loads in 189s (pike), after much reorganization,\n back to 621s on albatross?*)\n\n(*10/2/99: loads in 139s (pike)\n down to 433s on albatross*)\n\n(*5/5/01: conversion to Isar script\n loads in 137s (perch)\n the last ML version loaded in 122s on perch, a 600MHz machine:\n twice as fast as pike. No idea why it's so much slower!\n The Isar script is slower still, perhaps because simp_all simplifies\n the assumptions be default.\n*)\n\n(*20/11/11: loads in 5.8s elapses time, 9.3s CPU time on dual-core laptop*)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/TLS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.25010246854270307}} {"text": "theory flash80Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_InvVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_GetXVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Global ''Dir_local'') ) ( Const true )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutVsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Put )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_NakVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Nak_HomeVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_Remote_GetX_NakVsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutXVsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Nak2VsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put2VsInv80: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_ShWb )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX1VsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX2VsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX1VsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_GetVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_PutVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_PutXVsInv80: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv80 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') ) ( Const WB_Wb )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_ReplaceVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Remote_GetVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule1) ) ( Const CACHE_E )) ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv80: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv80 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv80: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv80 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash80Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.2500459831654072}}

\\ x \\ \\\\ \n by (simp only: sw_particulars_simp)\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_ed_iff[simp]: \\ed x y \\ x \\ \\ \\ y \\ \\\\\n apply (simp only: ed_def ; intro iffI conjI ballI impI ; simp?)\n by blast\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_no_indep[simp]: \\\\ indep x y\\\n by (simp add: indep_def)\n\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_empty_world[simp,intro!]: \\\\ \\ \\\\ \n by (simp add: sw_worlds_simp)\n\nend\n\nlocale single_world_pre_particular_struct_morphism =\n pre_particular_struct_morphism where Typ\\<^sub>p\\<^sub>1 = \\Typ\\<^sub>p\\<^sub>1\\ and Typ\\<^sub>p\\<^sub>2 = \\Typ\\<^sub>p\\<^sub>2\\ and Typ\\<^sub>q = \\Typ\\<^sub>q\\ +\n src: single_world_particular_struct where \\ = \\\\\\<^sub>1\\ and Typ\\<^sub>p = \\Typ\\<^sub>p\\<^sub>1\\ and Typ\\<^sub>q = \\Typ\\<^sub>q\\ +\n tgt: single_world_particular_struct where \\ = \\\\\\<^sub>2\\ and Typ\\<^sub>p = \\Typ\\<^sub>p\\<^sub>2\\ and Typ\\<^sub>q = \\Typ\\<^sub>q\\\n for\n Typ\\<^sub>p\\<^sub>1 :: \\'p\\<^sub>1 itself\\ and\n Typ\\<^sub>p\\<^sub>2 :: \\'p\\<^sub>2 itself\\ and\n Typ\\<^sub>q :: \\'q itself\\ \nbegin\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_world_corresp_iff[simp]:\n \\w\\<^sub>s \\ w\\<^sub>t \\ (w\\<^sub>s = \\ \\ w\\<^sub>t = \\) \\ \n (w\\<^sub>s = src.\\ \\ w\\<^sub>t = tgt.\\ \\ \\ ` src.\\ \\ tgt.\\)\\\n apply (intro iffI conjI disjCI \n ; (elim conjE disjE)?\n ; simp\n ; (elim world_corresp_E)? \n ; (intro world_corresp_I)?\n ; simp?)\n subgoal by blast\n subgoal by (metis Set.subset_empty empty_is_image image_subsetI morph_preserves_particulars \n src.sw_in_worlds src.sw_particulars_simp src.sw_worlds_case \n tgt.sw_particulars_simp tgt.sw_worlds_case)\n subgoal by blast\n done\n\nlemma \\<^marker>\\tag (proof) aponly\\ sw_particular_struct_morphism_iff:\n \\particular_struct_morphism \\\\<^sub>1 \\\\<^sub>2 \\ \\ \n \\ ` src.\\ \\ tgt.\\ \\ \n (is \\?P \\ ?Q\\)\nproof\n assume \\?P\\\n then interpret phi: particular_struct_morphism \\\\<^sub>1 \\\\<^sub>2 \\ by simp\n show \\?Q\\\n apply (intro conjI ballI impI subsetI ; (elim conjE imageE)? ; simp)\n using morph_preserves_particulars by blast\nnext\n assume A: \\?Q\\\n show \\?P\\\n apply (unfold_locales ; simp)\n subgoal G1 for w\\<^sub>s\n apply (cases w\\<^sub>s rule: src.sw_worlds_case ; simp)\n apply (intro exI[of _ \\] ; simp) \n using A by linarith\n subgoal G2 for w\\<^sub>t\n apply (cases w\\<^sub>t rule: tgt.sw_worlds_case ; simp)\n apply (intro exI[of _ \\] ; simp)\n using A by linarith\n done\nqed \n\nend\n\nlocale single_world_particular_struct_morphism =\n single_world_pre_particular_struct_morphism \n where Typ\\<^sub>p\\<^sub>1 = \\Typ\\<^sub>p\\<^sub>1\\ and Typ\\<^sub>p\\<^sub>2 = \\Typ\\<^sub>p\\<^sub>2\\ and Typ\\<^sub>q = \\Typ\\<^sub>q\\ \n for\n Typ\\<^sub>p\\<^sub>1 :: \\'p\\<^sub>1 itself\\ and\n Typ\\<^sub>p\\<^sub>2 :: \\'p\\<^sub>2 itself\\ and\n Typ\\<^sub>q :: \\'q itself\\ +\n assumes\n image_subset: \\\\ ` src.\\ \\ tgt.\\\\ and\n morph_closes_quale_assoc_1:\n \\\\x\\<^sub>t y\\<^sub>t q. \\ x\\<^sub>t \\ \\ ` src.\\ ; y\\<^sub>t \\ tgt.\\ ; q \\ \\\\<^sub>s ; y\\<^sub>t \\\\<^sub>t x\\<^sub>t ; y\\<^sub>t \\\\<^sub>t q \\\n \\ y\\<^sub>t \\ \\ ` src.\\\\\n\nsublocale single_world_particular_struct_morphism \\ particular_struct_morphism\n apply (simp only: sw_particular_struct_morphism_iff)\n using image_subset morph_closes_quale_assoc_1 by metis\n\nend", "meta": {"author": "joaoraf", "repo": "thesis-isabelle-sources", "sha": "5930e1d4899aed5d314c7a132bbed73bfe3ee607", "save_path": "github-repos/isabelle/joaoraf-thesis-isabelle-sources", "path": "github-repos/isabelle/joaoraf-thesis-isabelle-sources/thesis-isabelle-sources-5930e1d4899aed5d314c7a132bbed73bfe3ee607/ParticularStructures/SingleWorldStructure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.27230710087760307}} {"text": "theory \"Lowe_modified_BAN_concrete_Andrew_Secure_RPC_cert_auto\"\nimports\n \"ESPLogic\"\nbegin\n\n(* section: Lowe modified BAN concrete Andrew Secure RPC *)\n\n(* text: \n Modeled after the model in the SPORE library.\n\n Notable differences:\n\n 1. 'succ(x)' is invertible. Hence, we just model it as a tuple ('succ',x) of\n a global constant 'succ' and the variable x. This means that we only\n exploit the tagging properties of 'succ', but do not assume any\n information hiding.\n\n 2. Instead of implicit typing, we are using explicit global constants to\n discern messages.\n *)\n\nrole A\nwhere \"A =\n [ Send ''1'' <| sAV ''A'', sN ''Na'' |>\n , Recv ''2'' <| sMV ''B'',\n PEnc <| sC ''2'', sN ''Na'', sMV ''Kab'', sMV ''B'' |>\n ( sKbd (AVar ''A'') (MVar ''B'') )\n |>\n , Send ''3'' ( PEnc <| sC ''3'', sN ''Na'' |> ( sMV ''Kab'' ) )\n , Recv ''4'' ( sMV ''Nb'' )\n ]\"\n\nrole B\nwhere \"B =\n [ Recv ''1'' <| sMV ''A'', sMV ''Na'' |>\n , Send ''2'' <| sAV ''B'',\n PEnc <| sC ''2'', sMV ''Na'', sN ''Kab'', sAV ''B'' |>\n ( sKbd (MVar ''A'') (AVar ''B'') )\n |>\n , Recv ''3'' ( PEnc <| sC ''3'', sMV ''Na'' |> ( sN ''Kab'' ) )\n , Send ''4'' ( sN ''Nb'' )\n ]\"\n\nprotocol Andrew\nwhere \"Andrew = { A, B }\"\n\nlocale restricted_Andrew_state = Andrew_state\n\ntype_invariant Andrew_msc_typing for Andrew\nwhere \"Andrew_msc_typing = mk_typing\n [ ((B, ''A''), (KnownT B_1))\n , ((A, ''B''), (KnownT A_2))\n , ((A, ''Kab''), (SumT (KnownT A_2) (NonceT B ''Kab'')))\n , ((B, ''Na''), (KnownT B_1))\n , ((A, ''Nb''), (KnownT A_4))\n ]\"\n\nsublocale Andrew_state < Andrew_msc_typing_state\nproof -\n have \"(t,r,s) : approx Andrew_msc_typing\"\n proof(cases rule: reachable_in_approxI_ext\n [OF Andrew_msc_typing.monoTyp, completeness_cases_rule])\n case (A_2_B t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_B\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (A_2_Kab t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = A_2_Kab\n thus ?case\n proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid0, s(MV ''Kab'' tid0), s(MV ''B'' tid0) |}\n ( Kbd ( s(AV ''A'' tid0) ) ( s(MV ''B'' tid0) ) ) \")\n qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n next\n case (B_1_A t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_A\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n next\n case (B_1_Na t r s tid0)\n then interpret state: Andrew_msc_typing_state t r s\n by unfold_locales auto\n note_prefix_closed (state) facts = B_1_Na\n thus ?case\n by (fastforce intro: event_predOrdI split: if_splits)\n qed\n thus \"Andrew_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Andrew_state begin\n\n (* This rule is unsafe in general, but OK here, \n as we are only reasoning about static compromise. \n *)\n lemma static_longterm_key_reveal[dest!]:\n \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n by (auto intro: compr_predOrdI)\n\n lemma longterm_private_key_secrecy:\n assumes facts:\n \"SK m : knows t\"\n \"RLKR m ~: reveals t\"\n shows \"False\"\n using facts by (sources \"SK m\")\n\n lemma longterm_sym_ud_key_secrecy:\n assumes facts:\n \"K m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n shows \"False\"\n using facts by (sources \"K m1 m2\")\n\n lemma longterm_sym_bd_key_secrecy:\n assumes facts:\n \"Kbd m1 m2 : knows t\"\n \"RLKR m1 ~: reveals t\"\n \"RLKR m2 ~: reveals t\"\n \"m1 : Agent\"\n \"m2 : Agent\"\n shows \"False\"\n proof -\n from facts \n have \"KShr (agents {m1, m2}) : knows t\"\n by (auto simp: Kbd_def)\n thus ?thesis using facts\n proof (sources \"KShr (agents {m1, m2})\")\n qed (auto simp: agents_def Agent_def)\n qed\n\n lemmas ltk_secrecy =\n longterm_sym_ud_key_secrecy\n longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n longterm_sym_bd_key_secrecy\n longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n longterm_private_key_secrecy\n longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* text: \nNote the additional B identity in the second message above. It guarantees that\ndespite using a bidirectional longterm symmetric key, we have agreement on the\ninvolved roles.\n *)\n\n(* subsection: Security Properties *)\n\nlemma (in restricted_Andrew_state) B_sec_Kab:\n assumes facts:\n \"roleMap r tid0 = Some B\"\n \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n \"LN ''Kab'' tid0 : knows t\"\n shows \"False\"\nusing facts proof(sources! \" LN ''Kab'' tid0 \")\n case B_2_Kab note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Andrew_state) A_sec_Kab:\n assumes facts:\n \"roleMap r tid0 = Some A\"\n \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid0)) ~: reveals t\"\n \"( tid0, A_2 ) : steps t\"\n \"s(MV ''Kab'' tid0) : knows t\"\n shows \"False\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid0, s(MV ''Kab'' tid0), s(MV ''B'' tid0) |}\n ( Kbd ( s(AV ''A'' tid0) ) ( s(MV ''B'' tid0) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_2_enc tid1) note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) A_noninjective_agreement:\n assumes facts:\n \"roleMap r tid1 = Some A\"\n \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''B'' tid1)) ~: reveals t\"\n \"( tid1, A_2 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some B &\n s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n s(MV ''B'' tid1) = s(AV ''B'' tid2) &\n LN ''Na'' tid1 = s(MV ''Na'' tid2) &\n s(MV ''Kab'' tid1) = LN ''Kab'' tid2)\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid1, s(MV ''Kab'' tid1), s(MV ''B'' tid1) |}\n ( Kbd ( s(AV ''A'' tid1) ) ( s(MV ''B'' tid1) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (auto dest!: ltk_secrecy)\n next\n case (B_2_enc tid2) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) B_noninjective_agreement:\n assumes facts:\n \"roleMap r tid1 = Some B\"\n \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n \"RLKR(s(MV ''A'' tid1)) ~: reveals t\"\n \"( tid1, B_3 ) : steps t\"\n shows\n \"(? tid2.\n roleMap r tid2 = Some A &\n s(MV ''A'' tid1) = s(AV ''A'' tid2) &\n s(AV ''B'' tid1) = s(MV ''B'' tid2) &\n s(MV ''Na'' tid1) = LN ''Na'' tid2 &\n LN ''Kab'' tid1 = s(MV ''Kab'' tid2))\"\nproof -\n note_prefix_closed facts = facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''3'', s(MV ''Na'' tid1) |} ( LN ''Kab'' tid1 ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n next\n case (A_3_enc tid2) note_unified facts = this facts\n thus ?thesis proof(sources! \"\n Enc {| LC ''2'', LN ''Na'' tid2, LN ''Kab'' tid1, s(MV ''B'' tid2) |}\n ( Kbd ( s(AV ''A'' tid2) ) ( s(MV ''B'' tid2) ) ) \")\n case fake note_unified facts = this facts\n thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n next\n case (B_2_enc tid3) note_unified facts = this facts\n thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\n qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/Lowe_modified_BAN_concrete_Andrew_Secure_RPC_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621764862150636, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.27230709377139145}} {"text": "(* *********************************************************************\n\n Theory LA.thy is part of a framework for modelling,\n verification and transformation of concurrent imperative\n programs. Copyright (c) 2021 M. Bortin\n\n The framework is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n For more details see the license agreement (LICENSE) you should have\n received along with the framework.\n \n ******************************************************************* *)\n \ntheory LA\nimports Prelims\nbegin\n\ntext \"highlighting the type of relations between (abstract) states\"\ntype_synonym 'a staterel = \"('a \\ 'a) set\"\n\n\ntext \"an auxiliary annotation structure for the parallel components\"\nrecord 's annpar =\n ap_rely :: \"'s staterel\"\n ap_precond :: \"'s set\"\n ap_postcond :: \"'s set\"\n\n\nsection \"A generic imperative language\"\n\n\ndatatype 's LA =\n Skip \n | Basic \"'s \\ 's\"\n | Seq \"'s LA\" \"'s LA\" \n | Cond \"'s set\" \"'s LA\" \"'s LA\"\n | While \"'s set\" \"'s set\" \"'s LA\" \"'s LA\" \n | Parallel \"('s LA \\ 's annpar) list\"\n | Await \"'s set\" \"'s set\" \"'s LA\"\n | CJump \"'s set\" nat \"'s LA\"\n\n\ntext \"the unconditional jump instruction\"\ndefinition \"Jump i = CJump UNIV i Skip\"\n\n\nfun jumpfree :: \"'s LA \\ bool\"\nwhere \"jumpfree Skip = True\" |\n \"jumpfree (Basic f) = True\" |\n \"jumpfree (Seq p1 p2) = (jumpfree p1 \\ jumpfree p2)\" |\n \"jumpfree (Parallel ps) = (\\p\\set ps. jumpfree (fst p))\" |\n \"jumpfree (Cond c p1 p2) = (jumpfree p1 \\ jumpfree p2)\" |\n \"jumpfree (Await c a p) = jumpfree p\" |\n \"jumpfree (While c i p q) = (jumpfree p \\ jumpfree q)\" |\n \"jumpfree _ = False\"\n\n\nlemma jumpfree_Jump[simp] :\n\"jumpfree (Jump i) = False\"\n by(simp add: Jump_def)\n\n\ntext \"locally sequential programs\"\nfun locally_seq :: \"'s LA \\ bool\"\nwhere \"locally_seq (Seq p1 p2) = (locally_seq p1 \\ locally_seq p2)\" |\n \"locally_seq (Parallel ps) = False\" |\n \"locally_seq (Cond c p1 p2) = (locally_seq p1 \\ locally_seq p2)\" |\n \"locally_seq (Await c a p) = locally_seq p\" |\n \"locally_seq (While c i p q) = (locally_seq p \\ locally_seq q)\" |\n \"locally_seq (CJump C i p) = locally_seq p\" |\n \"locally_seq _ = True\" \n\n\nlemma locally_seq_Jump[simp] :\n\"locally_seq (Jump i) = True\"\n by(simp add: Jump_def)\n\n\n\ntext \"the set of local jumps\"\nfun ljumps :: \"'s LA \\ nat set\"\nwhere \"ljumps Skip = {}\" |\n \"ljumps (Basic f) = {}\" |\n \"ljumps (CJump C i p) = {i} \\ ljumps p\" |\n \"ljumps (Seq p1 p2) = (ljumps p1 \\ ljumps p2)\" |\n \"ljumps (Parallel ps) = (\\((ljumps \\ fst) ` set ps))\" |\n \"ljumps (Cond c p1 p2) = (ljumps p1 \\ ljumps p2)\" |\n \"ljumps (Await c a p) = ljumps p\" |\n \"ljumps (While c i p q) = (ljumps p \\ ljumps q)\" \n\n\nlemma ljumps_Jump[simp] :\n\"ljumps (Jump i) = {i}\"\n by(simp add: Jump_def)\n\n\n\n\n\n\nsection \"Concrete syntax for the LA programs\"\n\nsyntax\n \"_quote\" :: \"'b \\ ('a \\ 'b)\" (\"(\\_\\)\" [0] 1000)\n \"_antiquote\" :: \"('a \\ 'b) \\ 'b\" (\"\\_\" [1000] 1000)\n \"_Assert\" :: \"'a \\ 'a set\" (\"(\\_\\)\" [0] 1000)\n\ntranslations\n \"\\b\\\" \\ \"CONST Collect \\b\\\"\n\nparse_translation \\\n let\n fun quote_tr [t] = Syntax_Trans.quote_tr @{syntax_const \"_antiquote\"} t\n | quote_tr ts = raise TERM (\"quote_tr\", ts);\n in [(@{syntax_const \"_quote\"}, K quote_tr)] end\n\\\n\nlemma neg_Collect[simp] :\n\"- Collect P = Collect (\\x. \\ P x)\"\n by fast\n\n\nsyntax\n \"_fst\" :: \"'a \\ 'b \\ 'a\" (\"_\\<^sub>,\" [60] 61)\n \"_snd\" :: \"'a \\ 'b \\ 'b\" (\"_\\<^sub>.\" [60] 61)\n\n\nparse_translation \\\n let\n fun fst_tr ((Const (@{const_syntax Pair}, _) $ p $ c)\n :: ts) = p;\n\n fun snd_tr ((Const (@{const_syntax Pair}, _) $ p $ c)\n :: ts) = c;\n in\n [(@{syntax_const \"_fst\"}, K fst_tr),\n (@{syntax_const \"_snd\"}, K snd_tr)]\n end\n\\\n\n\nsyntax\n \"_Assign\" :: \"idt \\ 'b \\ 's LA\"\n (\"(\\_ :=/ _)\" [70, 65] 61)\n\ntranslations\n \"\\x := a\" \\ \"(CONST Basic \\\\(_update_name x (\\_. a))\\)\"\n\nsyntax\n \"_before\" :: \"id \\ 'a\" (\"\\_\")\n \"_after\" :: \"id \\ 'a\" (\"\\_\")\n\ntranslations\n \"\\x\" \\ \"x \\ CONST fst\"\n \"\\x\" \\ \"x \\ CONST snd\"\n\n\nsyntax\n \"_Seq\" :: \"'s LA \\ 's LA \\ 's LA\"\n (\"(_;//_)\" [56, 55] 55)\n \n\n \"_Cond\" :: \"'s set \\ 's LA \\ 's LA \\ 's LA\"\n (\"(IF _//(2THEN/ (_))//(2ELSE/ (_))//FI)\" [0, 0, 0] 61)\n \"_Cond2\" :: \"'s set \\ 's LA \\ 's LA\"\n (\"(IF _//(2THEN/ (_))//FI)\" [0,0] 56)\n\n\n \"_While_inv\" :: \"'s set \\ 's set \\ 's LA \\ 's LA \\ 's LA\"\n (\"(WHILE _/ \\ inv: _/\\//(2DO/ (_))//SUBSEQUENTLY _//OD)\" [0, 0, 0, 0] 61)\n\n \"_While\" :: \"'s set \\ 's LA \\ 's LA \\ 's LA\"\n (\"(WHILE _//(2DO/ (_))//SUBSEQUENTLY _//OD)\" [0, 0, 0] 61)\n\n \"_WhileS\" :: \"'s set \\ 's set \\ 's LA \\ 's LA\"\n (\"(WHILE _/ \\ inv: _/\\//(2DO/ (_))//OD)\" [0, 0, 0] 61)\n \"_WhileS5\" :: \"'s set \\ 's LA \\ 's LA\"\n (\"(WHILE _//(2DO/ (_))//OD)\" [0, 0] 61)\n\n \"_AwaitA\" :: \"'s set \\ 's set \\ 's LA \\ 's LA\"\n (\"(AWAIT _/ \\ ann: _/\\//(2THEN/ (_))/ END)\" [0,0,0] 61)\n \"_AtomA\" :: \"'s set \\ 's LA \\ 's LA\"\n (\"(\\ ann: _/\\\\_\\)\" [0,0] 61)\n \"_WaitA\" :: \"'s set \\ 's set \\ 's LA\"\n (\"(WAIT _/ \\ ann: _/\\ END)\" [0,0] 61)\n\n \"_Await\" :: \"'s set \\ 's LA \\ 's LA\"\n (\"(AWAIT _/ (2THEN/ (_))/ END)\" [0,0] 61)\n \"_Atom\" :: \"'s set \\ 's LA \\ 's LA\"\n (\"(\\_\\)\" [0] 61)\n \"_Wait\" :: \"'s set \\ 's LA\"\n (\"(WAIT _/ END)\" [0] 61) \n\n\n \"_Jump\" :: \"nat \\ 's LA\" (\"JUMP _/\" [0] 61)\n\n \"_CJump\" :: \"'s set \\ nat \\ 's LA \\ 's LA\" \n (\"CJUMP _/ TO/ _//(2OTHERWISE/ (_))//END \" [0,0,0] 61)\n\n \"_Skip\" :: \"'s LA\" (\"SKIP\" 61)\n\n\ntranslations\n \"p1;p2\" \\ \"CONST Seq p1 p2\" \n\n \"IF b THEN c1 ELSE c2 FI\" \\ \"CONST Cond b c1 c2\"\n \"IF b THEN c FI\" \\ \"IF b THEN c ELSE SKIP FI\"\n\n\n \"WHILE b \\inv: i\\ DO p SUBSEQUENTLY q OD\" \\ \"CONST While b i p q\"\n \"WHILE b DO p SUBSEQUENTLY q OD\" \\ \"WHILE b \\inv: CONST UNIV\\ DO p SUBSEQUENTLY q OD\"\n\n \"WHILE b \\inv: i\\ DO p OD\" \\ \"WHILE b \\inv: i\\ DO p SUBSEQUENTLY SKIP OD\"\n \"WHILE b DO p OD\" \\ \"WHILE b DO p SUBSEQUENTLY SKIP OD\"\n\n \"AWAIT b \\ann: a\\ THEN c END\" \\ \"CONST Await b a c\"\n \"\\ann: a\\\\c\\\" \\ \"AWAIT CONST UNIV \\ann: a\\ THEN c END\"\n \"WAIT b \\ann: a\\ END\" \\ \"AWAIT b \\ann: a\\ THEN SKIP END\"\n\n\n \"AWAIT b THEN c END\" \\ \"CONST Await b (CONST UNIV) c\"\n \"\\c\\\" \\ \"AWAIT CONST UNIV THEN c END\"\n \"WAIT b END\" \\ \"AWAIT b THEN SKIP END\"\n \"JUMP j\" \\ \"CONST Jump j\"\n \"CJUMP b TO j OTHERWISE p END\" \\ \"CONST CJump b j p\"\n \"SKIP\" \\ \"CONST Skip\" \n\n\nnonterminal prgs\nsyntax\n \"_PAR\" :: \"prgs \\ 'a\"\n (\"(INTERLEAVING-BEGIN//_//INTERLEAVING-END)\" [57] 56)\n \"_AnnPrg\" :: \"['a, 'a, 'a, 'a] \\ prgs\"\n (\"(2 \\ rely: _,/ pre: _,/ post: _ \\//_)\" [90, 90, 90, 60] 57)\n \"_AnnPrgs\" :: \"['a, 'a, 'a, 'a, prgs] \\ prgs\"\n (\"(2 \\ rely: _,/ pre: _,/ post: _ \\//_)//\\//_\" [90, 90, 90, 60, 57] 57)\n \"_AnnPrgScheme\" :: \"['a, 'a, 'a, 'a, 'a, 'a, 'a] \\ prgs\"\n (\" (2SCHEME-BEGIN [_ \\ _ < _]//\\ rely: _,/ pre: _,/ post: _ \\//_//SCHEME-END)\" [0,0,0,90,90,90,0] 57)\n\n \"_Prg\" :: \"['a] \\ prgs\"\n (\"(2 _)\" [60] 57)\n \"_Prgs\" :: \"['a, prgs] \\ prgs\"\n (\"(2 _)//\\//_\" [60,57] 57)\n \"_PrgScheme\" :: \"['a, 'a, 'a, 'a] \\ prgs\" \n (\" (2SCHEME-BEGIN [_ \\ _ < _]//_//SCHEME-END)\" [0,0,0,60] 57)\n\ntranslations\n \"_PAR ps\" \\ \"CONST Parallel ps\"\n \"_AnnPrg r p q c\" \\ \"([(c, \\ap_rely=r, ap_precond=p, ap_postcond=q\\)])\"\n \"_AnnPrgs r p q c ps\" \\ \"((c, \\ap_rely=r, ap_precond=p, ap_postcond=q\\) # ps)\"\n \"_AnnPrgScheme j i k r p q c\" \\\n \"(CONST map (\\i. (c, \\ap_rely=r, ap_precond=p, ap_postcond=q\\)) [j..\n \"([(c, \\ap_rely=CONST UNIV, ap_precond=CONST UNIV, ap_postcond=CONST UNIV\\)])\"\n \"_Prgs c ps\" \\\n \"((c, \\ap_rely=CONST UNIV, ap_precond=CONST UNIV, ap_postcond=CONST UNIV\\) # ps)\"\n \"_PrgScheme j i k c\" \\\n \"(CONST map (\\i. (c, \\ap_rely=CONST UNIV, ap_precond=CONST UNIV, ap_postcond=CONST UNIV\\ )) [j.. \n\nfun dest_absL (x, T, body) =\n let\n fun name_clash (Free (y, _)) = (x = y)\n | name_clash (t $ u) = name_clash t orelse name_clash u\n | name_clash (Abs (_, _, t)) = name_clash t\n | name_clash _ = false;\n in\n if name_clash body then\n dest_absL (singleton (Name.variant_list [x]) x, T, body) (*potentially slow*)\n else (x, subst_bound (Free (x, T), body))\n end;\n\n fun quote_tr' f (t :: ts) =\n Term.list_comb (f $ Syntax_Trans.quote_tr' @{syntax_const \"_antiquote\"} t, ts)\n | quote_tr' _ _ = raise Match;\n\n fun annquote_tr' f (r :: t :: ts) =\n Term.list_comb (f $ r $ Syntax_Trans.quote_tr' @{syntax_const \"_antiquote\"} t, ts)\n | annquote_tr' _ _ = raise Match;\n\n val assert_tr' = quote_tr' (Syntax.const @{syntax_const \"_Assert\"});\n\n fun annbexp_tr' name (r :: (Const (@{const_syntax Collect}, _) $ t) :: ts) =\n annquote_tr' (Syntax.const name) (r :: t :: ts)\n | annbexp_tr' name (r :: Const (@{const_syntax UNIV}, _) :: ts) =\n annquote_tr' (Syntax.const name)\n (r :: Abs (\"s\", dummyT, Const (@{const_syntax True}, dummyT)) :: ts)\n | annbexp_tr' name (r :: Const (@{const_syntax Set.empty}, _) :: ts) =\n annquote_tr' (Syntax.const name)\n (r :: Abs (\"s\", dummyT, Const (@{const_syntax False}, dummyT)) :: ts)\n | annbexp_tr' _ _ = raise Match;\n\n fun annassign_tr' (r :: Abs (x, _, f $ k $ Bound 0) :: ts) =\n quote_tr' (Syntax.const @{syntax_const \"_Assign\"} $ r $ Syntax_Trans.update_name_tr' f)\n (Abs (x, dummyT, Syntax_Trans.const_abs_tr' k) :: ts)\n | annassign_tr' _ = raise Match;\n\n fun dest_list (Const (@{const_syntax Nil}, _)) = []\n | dest_list (Const (@{const_syntax Cons}, _) $ x $ xs) = x :: dest_list xs\n | dest_list xs = [xs];\n\n fun new_Pair a b =\n (Const (@{const_syntax Pair}, dummyT) $ a $ b)\n\n fun dest_prod (Const (@{const_syntax Pair}, _) $ a $ b) = (a, b)\n | dest_prod _ = raise Match;\n\n fun dest_upt (Const (@{const_syntax upt},_) $ m $ n) = (m, n)\n | dest_upt _ = raise Match;\n\n fun dest_apar (Const (@{const_syntax annpar_ext}, _) $ r $ p $ q $ _) = (r, p, q)\n | dest_apar _ = raise Match;\n\n fun prg_tr' const aconst xs pqa =\n let val (c, apr) = dest_prod pqa\n val (R, P, Q) = dest_apar apr\n fun fake (Const (@{const_syntax UNIV},_)) = true\n | fake _ = false\n val const' = if fake R then const else aconst\n val ys = if fake R then [] else [R, P, Q]\n in list_comb (Syntax.const const', xs @ ys @ [c])\n end\n\n fun prgs_lst_tr'\n [Const (@{const_syntax map}, _) $ Abs (i, T, p) $ upt] =\n let val (j, k) = dest_upt upt\n in prg_tr' @{syntax_const \"_PrgScheme\"} @{syntax_const \"_AnnPrgScheme\"}\n [j, Free (i, T), k] (snd(dest_absL (i, T, p)))\n end\n | prgs_lst_tr' [p] =\n prg_tr' @{syntax_const \"_Prg\"} @{syntax_const \"_AnnPrg\"} [] p\n | prgs_lst_tr' (p :: ps) =\n prg_tr' @{syntax_const \"_Prgs\"} @{syntax_const \"_AnnPrgs\"} [] p $\n prgs_lst_tr' ps \n | prgs_lst_tr' _ = raise Match\n\n fun Parallel_tr (cs :: _) =\n let val cs' = dest_list cs\n in Syntax.const @{syntax_const \"_PAR\"} $\n prgs_lst_tr' cs' end\n | Parallel_tr _ = raise Match;\n\n fun Basic_tr (Abs (x, _, f $ k $ Bound 0) :: ts) =\n quote_tr' (Syntax.const @{syntax_const \"_Assign\"} $ Syntax_Trans.update_name_tr' f)\n (Abs (x, dummyT, Syntax_Trans.const_abs_tr' k) :: ts) \n | Basic_tr ((f $ k) :: ts) = quote_tr' (Syntax.const @{syntax_const \"_Assign\"} $ Syntax_Trans.update_name_tr' f)\n (k :: ts) \n | Basic_tr _ = raise Match;\n\n\\\n\nprint_translation \\\n [(@{const_syntax Collect}, K assert_tr'),\n (@{const_syntax Basic}, K Basic_tr),\n (@{const_syntax Parallel}, K Parallel_tr)]\n\\\n\n\n\nend", "meta": {"author": "maksym-bortin", "repo": "a_framework", "sha": "df46703505efafcf1087d4461e93e502d94712ab", "save_path": "github-repos/isabelle/maksym-bortin-a_framework", "path": "github-repos/isabelle/maksym-bortin-a_framework/a_framework-df46703505efafcf1087d4461e93e502d94712ab/LA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4225046348141883, "lm_q1q2_score": 0.27218809335415517}} {"text": "(* Title: JinjaThreads/J/WellType.thy\n Author: Tobias Nipkow, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Well-typedness of Jinja expressions} *}\n\ntheory WellType\nimports\n Expr\n State\n \"../Common/ExternalCallWF\"\n \"../Common/WellForm\"\n \"../Common/SemiType\"\nbegin\n\ndeclare Listn.lesub_list_impl_same_size[simp del]\ndeclare listE_length [simp del]\n\ntype_synonym \n env = \"vname \\ ty\"\n\ninductive\n WT :: \"(ty \\ ty \\ ty \\ bool) \\ 'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_,_ \\ _ :: _\" [51,51,51,51]50)\n and WTs :: \"(ty \\ ty \\ ty \\ bool) \\ 'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" \n (\"_,_,_ \\ _ [::] _\" [51,51,51,51]50)\n for is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n and P :: \"'addr J_prog\"\nwhere\n\n WTNew:\n \"is_class P C \\\n is_lub,P,E \\ new C :: Class C\"\n\n| WTNewArray:\n \"\\ is_lub,P,E \\ e :: Integer; is_type P (T\\\\) \\ \\\n is_lub,P,E \\ newA T\\e\\ :: T\\\\\"\n\n| WTCast:\n \"\\ is_lub,P,E \\ e :: T; P \\ U \\ T \\ P \\ T \\ U; is_type P U \\\n \\ is_lub,P,E \\ Cast U e :: U\"\n\n| WTInstanceOf:\n \"\\ is_lub,P,E \\ e :: T; P \\ U \\ T \\ P \\ T \\ U; is_type P U; is_refT U \\\n \\ is_lub,P,E \\ e instanceof U :: Boolean\"\n\n| WTVal:\n \"typeof v = Some T \\\n is_lub,P,E \\ Val v :: T\"\n\n| WTVar:\n \"E V = Some T \\\n is_lub,P,E \\ Var V :: T\"\n\n| WTBinOp:\n \"\\ is_lub,P,E \\ e1 :: T1; is_lub,P,E \\ e2 :: T2; P \\ T1\\bop\\T2 :: T \\\n \\ is_lub,P,E \\ e1\\bop\\e2 :: T\"\n\n| WTLAss:\n \"\\ E V = Some T; is_lub,P,E \\ e :: T'; P \\ T' \\ T; V \\ this \\\n \\ is_lub,P,E \\ V:=e :: Void\"\n\n| WTAAcc:\n \"\\ is_lub,P,E \\ a :: T\\\\; is_lub,P,E \\ i :: Integer \\\n \\ is_lub,P,E \\ a\\i\\ :: T\"\n\n| WTAAss:\n \"\\ is_lub,P,E \\ a :: T\\\\; is_lub,P,E \\ i :: Integer; is_lub,P,E \\ e :: T'; P \\ T' \\ T \\\n \\ is_lub,P,E \\ a\\i\\ := e :: Void\"\n\n| WTALength:\n \"is_lub,P,E \\ a :: T\\\\ \\ is_lub,P,E \\ a\\length :: Integer\"\n\n| WTFAcc:\n \"\\ is_lub,P,E \\ e :: U; class_type_of' U = \\C\\; P \\ C sees F:T (fm) in D \\\n \\ is_lub,P,E \\ e\\F{D} :: T\"\n\n| WTFAss:\n \"\\ is_lub,P,E \\ e\\<^sub>1 :: U; class_type_of' U = \\C\\; P \\ C sees F:T (fm) in D; is_lub,P,E \\ e\\<^sub>2 :: T'; P \\ T' \\ T \\\n \\ is_lub,P,E \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 :: Void\"\n\n| WTCall:\n \"\\ is_lub,P,E \\ e :: U; class_type_of' U = \\C\\; P \\ C sees M:Ts \\ T = meth in D;\n is_lub,P,E \\ es [::] Ts'; P \\ Ts' [\\] Ts \\\n \\ is_lub,P,E \\ e\\M(es) :: T\"\n\n| WTBlock:\n \"\\ is_type P T; is_lub,P,E(V \\ T) \\ e :: T'; case vo of None \\ True | \\v\\ \\ \\T'. typeof v = \\T'\\ \\ P \\ T' \\ T \\\n \\ is_lub,P,E \\ {V:T=vo; e} :: T'\"\n\n| WTSynchronized:\n \"\\ is_lub,P,E \\ o' :: T; is_refT T; T \\ NT; is_lub,P,E \\ e :: T' \\\n \\ is_lub,P,E \\ sync(o') e :: T'\"\n\n-- \"Note that insync is not statically typable.\"\n\n| WTSeq:\n \"\\ is_lub,P,E \\ e\\<^sub>1::T\\<^sub>1; is_lub,P,E \\ e\\<^sub>2::T\\<^sub>2 \\\n \\ is_lub,P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n| WTCond:\n \"\\ is_lub,P,E \\ e :: Boolean; is_lub,P,E \\ e\\<^sub>1::T\\<^sub>1; is_lub,P,E \\ e\\<^sub>2::T\\<^sub>2; \\ lub(T\\<^sub>1, T\\<^sub>2) = T \\\n \\ is_lub,P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile:\n \"\\ is_lub,P,E \\ e :: Boolean; is_lub,P,E \\ c::T \\\n \\ is_lub,P,E \\ while (e) c :: Void\"\n\n| WTThrow:\n \"\\ is_lub,P,E \\ e :: Class C; P \\ C \\\\<^sup>* Throwable \\ \\ \n is_lub,P,E \\ throw e :: Void\"\n\n| WTTry:\n \"\\ is_lub,P,E \\ e\\<^sub>1 :: T; is_lub,P,E(V \\ Class C) \\ e\\<^sub>2 :: T; P \\ C \\\\<^sup>* Throwable \\\n \\ is_lub,P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n\n| WTNil: \"is_lub,P,E \\ [] [::] []\"\n\n| WTCons: \"\\ is_lub,P,E \\ e :: T; is_lub,P,E \\ es [::] Ts \\ \\ is_lub,P,E \\ e#es [::] T#Ts\"\n\nabbreviation WT' :: \"'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_ \\ _ :: _\" [51,51,51] 50)\nwhere \"WT' P \\ WT (TypeRel.is_lub P) P\"\n\nabbreviation WTs' :: \"'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" (\"_,_ \\ _ [::] _\" [51,51,51] 50)\nwhere \"WTs' P \\ WTs (TypeRel.is_lub P) P\"\n\ndeclare WT_WTs.intros[intro!]\n\ninductive_simps WTs_iffs [iff]:\n \"is_lub',P,E \\ [] [::] Ts\"\n \"is_lub',P,E \\ e#es [::] T#Ts\"\n \"is_lub',P,E \\ e#es [::] Ts\"\n\nlemma WTs_conv_list_all2: \n fixes is_lub \n shows \"is_lub,P,E \\ es [::] Ts = list_all2 (WT is_lub P E) es Ts\"\nby(induct es arbitrary: Ts)(auto simp add: list_all2_Cons1 elim: WTs.cases)\n\nlemma WTs_append [iff]: \"\\is_lub Ts. (is_lub,P,E \\ es\\<^sub>1 @ es\\<^sub>2 [::] Ts) =\n (\\Ts\\<^sub>1 Ts\\<^sub>2. Ts = Ts\\<^sub>1 @ Ts\\<^sub>2 \\ is_lub,P,E \\ es\\<^sub>1 [::] Ts\\<^sub>1 \\ is_lub,P,E \\ es\\<^sub>2[::]Ts\\<^sub>2)\"\nby(auto simp add: WTs_conv_list_all2 list_all2_append1 dest: list_all2_lengthD[symmetric])\n\ninductive_simps WT_iffs [iff]:\n \"is_lub',P,E \\ Val v :: T\"\n \"is_lub',P,E \\ Var V :: T\"\n \"is_lub',P,E \\ e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n \"is_lub',P,E \\ {V:T=vo; e} :: T'\"\n\ninductive_cases WT_elim_cases[elim!]:\n \"is_lub',P,E \\ V :=e :: T\"\n \"is_lub',P,E \\ sync(o') e :: T\"\n \"is_lub',P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ while (e) c :: T\"\n \"is_lub',P,E \\ throw e :: T\"\n \"is_lub',P,E \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ Cast D e :: T\"\n \"is_lub',P,E \\ e instanceof U :: T\"\n \"is_lub',P,E \\ a\\F{D} :: T\"\n \"is_lub',P,E \\ a\\F{D} := v :: T\"\n \"is_lub',P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T\"\n \"is_lub',P,E \\ new C :: T\"\n \"is_lub',P,E \\ newA T\\e\\ :: T'\"\n \"is_lub',P,E \\ a\\i\\ := e :: T\"\n \"is_lub',P,E \\ a\\i\\ :: T\"\n \"is_lub',P,E \\ a\\length :: T\"\n \"is_lub',P,E \\ e\\M(ps) :: T\"\n \"is_lub',P,E \\ sync(o') e :: T\"\n \"is_lub',P,E \\ insync(a) e :: T\"\n\nlemma fixes is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes is_lub_unique: \"\\T1 T2 T3 T4. \\ \\ lub(T1, T2) = T3; \\ lub(T1, T2) = T4 \\ \\ T3 = T4\"\n shows WT_unique: \"\\ is_lub,P,E \\ e :: T; is_lub,P,E \\ e :: T' \\ \\ T = T'\"\n and WTs_unique: \"\\ is_lub,P,E \\ es [::] Ts; is_lub,P,E \\ es [::] Ts' \\ \\ Ts = Ts'\"\napply(induct arbitrary: T' and Ts' rule: WT_WTs.inducts)\napply blast\napply blast\napply blast\napply blast\napply fastforce\napply fastforce\napply(fastforce dest: WT_binop_fun)\napply fastforce\napply fastforce\napply fastforce\napply fastforce\napply(fastforce dest: sees_field_fun)\napply(fastforce dest: sees_field_fun)\napply(fastforce dest: sees_method_fun)\napply fastforce\napply fastforce\napply fastforce\napply(blast dest: is_lub_unique)\napply fastforce\napply fastforce\napply blast\napply fastforce\napply fastforce\ndone\n\nlemma fixes is_lub\n shows wt_env_mono: \"is_lub,P,E \\ e :: T \\ (\\E'. E \\\\<^sub>m E' \\ is_lub,P,E' \\ e :: T)\"\n and wts_env_mono: \"is_lub,P,E \\ es [::] Ts \\ (\\E'. E \\\\<^sub>m E' \\ is_lub,P,E' \\ es [::] Ts)\"\napply(induct rule: WT_WTs.inducts)\napply(simp add: WTNew)\napply(simp add: WTNewArray)\napply(fastforce simp: WTCast)\napply(fastforce simp: WTInstanceOf)\napply(fastforce simp: WTVal)\napply(simp add: WTVar map_le_def dom_def)\napply(fastforce simp: WTBinOp)\napply(force simp:map_le_def)\napply(simp add: WTAAcc)\napply(simp add: WTAAss, fastforce)\napply(simp add: WTALength, fastforce)\napply(fastforce simp: WTFAcc)\napply(fastforce simp: WTFAss del:WT_WTs.intros WT_elim_cases)\napply(fastforce)\napply(fastforce simp: map_le_def WTBlock)\napply(fastforce simp: WTSynchronized)\napply(fastforce simp: WTSeq)\napply(fastforce simp: WTCond)\napply(fastforce simp: WTWhile)\napply(fastforce simp: WTThrow)\napply(fastforce simp: WTTry map_le_def dom_def)\napply(fastforce)+\ndone\n\nlemma fixes is_lub\n shows WT_fv: \"is_lub,P,E \\ e :: T \\ fv e \\ dom E\"\n and WT_fvs: \"is_lub,P,E \\ es [::] Ts \\ fvs es \\ dom E\"\napply(induct rule:WT_WTs.inducts)\napply(simp_all del: fun_upd_apply)\napply fast+\ndone\n\nlemma fixes is_lub\n shows WT_expr_locks: \"is_lub,P,E \\ e :: T \\ expr_locks e = (\\ad. 0)\"\n and WTs_expr_lockss: \"is_lub,P,E \\ es [::] Ts \\ expr_lockss es = (\\ad. 0)\"\nby(induct rule: WT_WTs.inducts)(auto)\n\nlemma\n fixes is_lub :: \"ty \\ ty \\ ty \\ bool\" (\"\\ lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes is_lub_is_type: \"\\T1 T2 T3. \\ \\ lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ is_type P T3\"\n and wf: \"wf_prog wf_md P\"\n shows WT_is_type: \"\\ is_lub,P,E \\ e :: T; ran E \\ types P \\ \\ is_type P T\"\n and WTs_is_type: \"\\ is_lub,P,E \\ es [::] Ts; ran E \\ types P \\ \\ set Ts \\ types P\"\napply(induct rule: WT_WTs.inducts)\napply simp\napply simp\napply simp\napply simp\napply (simp add:typeof_lit_is_type)\napply (fastforce intro:nth_mem simp add: ran_def)\napply(simp add: WT_binop_is_type)\napply(simp)\napply(simp del: is_type_array add: is_type_ArrayD)\napply(simp)\napply(simp)\napply(simp add:sees_field_is_type[OF _ wf])\napply(simp)\napply(fastforce dest: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)\napply(fastforce simp add: ran_def split: split_if_asm)\napply(simp add: is_class_Object[OF wf])\napply(simp)\napply(simp)\napply(fastforce intro: is_lub_is_type)\napply(simp)\napply(simp)\napply simp\napply simp\napply simp\ndone\n\nlemma\n fixes is_lub1 :: \"ty \\ ty \\ ty \\ bool\" (\"\\1 lub'((_,/ _)') = _\" [51,51,51] 50)\n and is_lub2 :: \"ty \\ ty \\ ty \\ bool\" (\"\\2 lub'((_,/ _)') = _\" [51,51,51] 50)\n assumes wf: \"wf_prog wf_md P\"\n and is_lub1_into_is_lub2: \"\\T1 T2 T3. \\ \\1 lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ \\2 lub(T1, T2) = T3\"\n and is_lub2_is_type: \"\\T1 T2 T3. \\ \\2 lub(T1, T2) = T3; is_type P T1; is_type P T2 \\ \\ is_type P T3\"\n shows WT_change_is_lub: \"\\ is_lub1,P,E \\ e :: T; ran E \\ types P \\ \\ is_lub2,P,E \\ e :: T\"\n and WTs_change_is_lub: \"\\ is_lub1,P,E \\ es [::] Ts; ran E \\ types P \\ \\ is_lub2,P,E \\ es [::] Ts\"\nproof(induct rule: WT_WTs.inducts)\n case (WTBlock U E V e' T vo)\n from `is_type P U` `ran E \\ types P`\n have \"ran (E(V \\ U)) \\ types P\" by(auto simp add: ran_def)\n hence \"is_lub2,P,E(V \\ U) \\ e' :: T\" by(rule WTBlock)\n with `is_type P U` show ?case\n using `case vo of None \\ True | \\v\\ \\ \\T'. typeof v = \\T'\\ \\ P \\ T' \\ U` by auto\nnext\n case (WTCond E e e1 T1 e2 T2 T)\n from `ran E \\ types P` have \"is_lub2,P,E \\ e :: Boolean\" \"is_lub2,P,E \\ e1 :: T1\" \"is_lub2,P,E \\ e2 :: T2\"\n by(rule WTCond)+\n moreover from is_lub2_is_type wf `is_lub2,P,E \\ e1 :: T1` `ran E \\ types P`\n have \"is_type P T1\" by(rule WT_is_type)\n from is_lub2_is_type wf `is_lub2,P,E \\ e2 :: T2` `ran E \\ types P`\n have \"is_type P T2\" by(rule WT_is_type)\n with `\\1 lub(T1, T2) = T` `is_type P T1`\n have \"\\2 lub(T1, T2) = T\" by(rule is_lub1_into_is_lub2)\n ultimately show ?case ..\nnext\n case (WTTry E e1 T V C e2)\n from `ran E \\ types P` have \"is_lub2,P,E \\ e1 :: T\" by(rule WTTry)\n moreover from `P \\ C \\\\<^sup>* Throwable` have \"is_class P C\"\n by(rule is_class_sub_Throwable[OF wf])\n with `ran E \\ types P` have \"ran (E(V \\ Class C)) \\ types P\"\n by(auto simp add: ran_def)\n hence \"is_lub2,P,E(V \\ Class C) \\ e2 :: T\" by(rule WTTry)\n ultimately show ?case using `P \\ C \\\\<^sup>* Throwable` ..\nqed auto\n\nsubsection {* Code generator setup *}\n\nlemma WTBlock_code:\n \"\\is_lub. \\ is_type P T; is_lub,P,E(V \\ T) \\ e :: T'; \n case vo of None \\ True | \\v\\ \\ case typeof v of None \\ False | Some T' \\ P \\ T' \\ T \\\n \\ is_lub,P,E \\ {V:T=vo; e} :: T'\"\nby(auto)\n\nlemmas [code_pred_intro] =\n WTNew WTNewArray WTCast WTInstanceOf WTVal WTVar WTBinOp WTLAss WTAAcc WTAAss WTALength WTFAcc WTFAss WTCall \ndeclare \n WTBlock_code [code_pred_intro WTBlock']\nlemmas [code_pred_intro] =\n WTSynchronized WTSeq WTCond WTWhile WTThrow WTTry\n WTNil WTCons\n\ncode_pred\n (modes:\n (i \\ i \\ o \\ bool) \\ i \\ i \\ i \\ o \\ bool, \n (i \\ i \\ o \\ bool) \\ i \\ i \\ i \\ i \\ bool)\n [detect_switches, skip_proof]\n WT\nproof -\n case WT\n from WT.prems show thesis\n proof cases\n case (WTBlock T V e vo)\n thus thesis using WTBlock'[OF refl refl refl, of V T vo e] by(auto)\n qed(assumption|erule that[OF refl refl refl]|rule refl)+\nnext\n case WTs\n from WTs.prems that show thesis by cases blast+\nqed\n\ninductive is_lub_sup :: \"'m prog \\ ty \\ ty \\ ty \\ bool\"\nfor P T1 T2 T3\nwhere\n \"sup P T1 T2 = OK T3 \\ is_lub_sup P T1 T2 T3\"\n\ncode_pred\n (modes: i \\ i \\ i \\ o \\ bool, i \\ i \\ i \\ i \\ bool)\n is_lub_sup\n.\n\ndefinition WT_code :: \"'addr J_prog \\ env \\ 'addr expr \\ ty \\ bool\" (\"_,_ \\ _ ::' _\" [51,51,51] 50)\nwhere \"WT_code P \\ WT (is_lub_sup P) P\"\n\ndefinition WTs_code :: \"'addr J_prog \\ env \\ 'addr expr list \\ ty list \\ bool\" (\"_,_ \\ _ [::''] _\" [51,51,51] 50)\nwhere \"WTs_code P \\ WTs (is_lub_sup P) P\"\n\nlemma assumes wf: \"wf_prog wf_md P\"\n shows WT_code_into_WT: \n \"\\ P,E \\ e ::' T; ran E \\ types P \\ \\ P,E \\ e :: T\"\n\n and WTs_code_into_WTs:\n \"\\ P,E \\ es [::'] Ts; ran E \\ types P \\ \\ P,E \\ es [::] Ts\"\nproof -\n assume ran: \"ran E \\ types P\"\n { assume wt: \"P,E \\ e ::' T\"\n show \"P,E \\ e :: T\"\n by(rule WT_change_is_lub[OF wf _ _ wt[unfolded WT_code_def] ran])(blast elim!: is_lub_sup.cases intro: sup_is_lubI[OF wf] is_lub_is_type[OF wf])+ }\n { assume wts: \"P,E \\ es [::'] Ts\"\n show \"P,E \\ es [::] Ts\"\n by(rule WTs_change_is_lub[OF wf _ _ wts[unfolded WTs_code_def] ran])(blast elim!: is_lub_sup.cases intro: sup_is_lubI[OF wf] is_lub_is_type[OF wf])+ }\nqed\n\nlemma assumes wf: \"wf_prog wf_md P\"\n shows WT_into_WT_code: \n \"\\ P,E \\ e :: T; ran E \\ types P \\ \\ P,E \\ e ::' T\"\n\n and WT_into_WTs_code_OK:\n \"\\ P,E \\ es [::] Ts; ran E \\ types P \\ \\ P,E \\ es [::'] Ts\"\nproof -\n assume ran: \"ran E \\ types P\"\n { assume wt: \"P,E \\ e :: T\"\n show \"P,E \\ e ::' T\" unfolding WT_code_def\n by(rule WT_change_is_lub[OF wf _ _ wt ran])(blast intro!: is_lub_sup.intros intro: is_lub_subD[OF wf] sup_is_type[OF wf] elim!: is_lub_sup.cases)+ }\n { assume wts: \"P,E \\ es [::] Ts\"\n show \"P,E \\ es [::'] Ts\" unfolding WTs_code_def\n by(rule WTs_change_is_lub[OF wf _ _ wts ran])(blast intro!: is_lub_sup.intros intro: is_lub_subD[OF wf] sup_is_type[OF wf] elim!: is_lub_sup.cases)+ }\nqed\n\ntheorem WT_eq_WT_code:\n assumes \"wf_prog wf_md P\"\n and \"ran E \\ types P\"\n shows \"P,E \\ e :: T \\ P,E \\ e ::' T\"\nusing assms by(blast intro: WT_code_into_WT WT_into_WT_code)\n\ncode_pred\n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n [inductify]\n WT_code \n.\n\ncode_pred\n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n [inductify]\n WTs_code \n.\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/J/WellType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.27218809335415517}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* Author: Andrew Boyton, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\nchapter \"Instantiating capDL as a separation algebra.\"\n\ntheory Abstract_Separation_D\nimports\n \"../../Sep_Tactics\"\n Types_D\n \"../../Map_Extra\"\nbegin\n\n(**************************************\n * Start of lemmas to move elsewhere. *\n **************************************)\n\nlemma inter_empty_not_both:\n\"\\x \\ A; A \\ B = {}\\ \\ x \\ B\"\n by fastforce\n\nlemma union_intersection:\n \"A \\ (A \\ B) = A\"\n \"B \\ (A \\ B) = B\"\n \"(A \\ B) \\ A = A\"\n \"(A \\ B) \\ B = B\"\n by fastforce+\n\nlemma union_intersection1: \"A \\ (A \\ B) = A\"\n by (rule inf_sup_absorb)\nlemma union_intersection2: \"B \\ (A \\ B) = B\"\n by fastforce\n\n(* This lemma is strictly weaker than restrict_map_disj. *)\nlemma restrict_map_disj':\n \"S \\ T = {} \\ h |` S \\ h' |` T\"\n by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_add_restrict_comm:\n \"S \\ T = {} \\ h |` S ++ h' |` T = h' |` T ++ h |` S\"\n apply (drule restrict_map_disj')\n apply (erule map_add_com)\n done\n\n(************************************\n * End of lemmas to move elsewhere. *\n ************************************)\n\n\n\n(* The state for separation logic has:\n * The memory heap.\n * A function for which objects own which fields.\n In capDL, we say that an object either owns all of its fields, or none of them.\n These are both taken from the cdl_state.\n *)\n\ndatatype sep_state = SepState cdl_heap cdl_ghost_state\n\n(* Functions to get the heap and the ghost_state from the sep_state. *)\nprimrec sep_heap :: \"sep_state \\ cdl_heap\"\nwhere \"sep_heap (SepState h gs) = h\"\n\nprimrec sep_ghost_state :: \"sep_state \\ cdl_ghost_state\"\nwhere \"sep_ghost_state (SepState h gs) = gs\"\n\ndefinition\n the_set :: \"'a option set \\ 'a set\"\nwhere\n \"the_set xs = {x. Some x \\ xs}\"\n\nlemma the_set_union [simp]:\n \"the_set (A \\ B) = the_set A \\ the_set B\"\n by (fastforce simp: the_set_def)\n\nlemma the_set_inter [simp]:\n \"the_set (A \\ B) = the_set A \\ the_set B\"\n by (fastforce simp: the_set_def)\n\nlemma the_set_inter_empty:\n \"A \\ B = {} \\ the_set A \\ the_set B = {}\"\n by (fastforce simp: the_set_def)\n\n\n(* As the capDL operations mostly take the state (rather than the heap)\n * we need to redefine some of them again to take just the heap.\n *)\ndefinition\n slots_of_heap :: \"cdl_heap \\ cdl_object_id \\ cdl_cap_map\"\nwhere\n \"slots_of_heap h \\ \\obj_id.\n case h obj_id of\n None \\ Map.empty\n | Some obj \\ object_slots obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n add_to_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"add_to_slots new_val obj \\ update_slots (new_val ++ (object_slots obj)) obj\"\n\nlemma add_to_slots_assoc:\n \"add_to_slots x (add_to_slots (y ++ z) obj) =\n add_to_slots (x ++ y) (add_to_slots z obj)\"\n apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n apply (fastforce simp: cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\n(* Lemmas about add_to_slots, update_slots and object_slots. *)\nlemma add_to_slots_twice [simp]:\n \"add_to_slots x (add_to_slots y a) = add_to_slots (x ++ y) a\"\n by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n split: cdl_object.splits)\n\nlemma slots_of_heap_empty [simp]: \"slots_of_heap Map.empty object_id = Map.empty\"\n by (simp add: slots_of_heap_def)\n\nlemma slots_of_heap_empty2 [simp]:\n \"h obj_id = None \\ slots_of_heap h obj_id = Map.empty\"\n by (simp add: slots_of_heap_def)\n\nlemma update_slots_add_to_slots_empty [simp]:\n \"update_slots Map.empty (add_to_slots new obj) = update_slots Map.empty obj\"\n by (clarsimp simp: update_slots_def add_to_slots_def split:cdl_object.splits)\n\nlemma update_object_slots_id [simp]: \"update_slots (object_slots a) a = a\"\n by (clarsimp simp: update_slots_def object_slots_def\n split: cdl_object.splits)\n\nlemma update_slots_of_heap_id [simp]:\n \"h obj_id = Some obj \\ update_slots (slots_of_heap h obj_id) obj = obj\"\n by (clarsimp simp: update_slots_def slots_of_heap_def object_slots_def\n split: cdl_object.splits)\n\nlemma add_to_slots_empty [simp]: \"add_to_slots Map.empty h = h\"\n by (simp add: add_to_slots_def)\n\nlemma update_slots_eq:\n \"update_slots a o1 = update_slots a o2 \\ update_slots b o1 = update_slots b o2\"\n by (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n\n\n\n(* If there are not two conflicting objects at a position in two states.\n * Objects conflict if their types are different or their ghost_states collide.\n *)\ndefinition\n not_conflicting_objects :: \"sep_state \\ sep_state \\ cdl_object_id \\ bool\"\nwhere\n \"not_conflicting_objects state_a state_b = (\\obj_id.\n let heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in case (heap_a obj_id, heap_b obj_id) of\n (Some o1, Some o2) \\ object_type o1 = object_type o2 \\ gs_a obj_id \\ gs_b obj_id = {}\n | _ \\ True)\"\n\n\n(* \"Cleans\" slots to conform with the components. *)\ndefinition\n clean_slots :: \"cdl_cap_map \\ cdl_components \\ cdl_cap_map\"\nwhere\n \"clean_slots slots cmp \\ slots |` the_set cmp\"\n\n(* Sets the fields of an object to a \"clean\" state.\n Because a frame's size is part of it's type, we don't reset it. *)\ndefinition\n object_clean_fields :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean_fields obj cmp \\ if None \\ cmp then obj else case obj of\n Tcb x \\ Tcb (x\\cdl_tcb_fault_endpoint := undefined\\)\n | CNode x \\ CNode (x\\cdl_cnode_size_bits := undefined \\)\n | _ \\ obj\"\n\n(* Sets the slots of an object to a \"clean\" state. *)\ndefinition\n object_clean_slots :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean_slots obj cmp \\ update_slots (clean_slots (object_slots obj) cmp) obj\"\n\n(* Sets an object to a \"clean\" state. *)\ndefinition\n object_clean :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean obj gs \\ object_clean_slots (object_clean_fields obj gs) gs\"\n\n(* Overrides the left object with the attributes of the right, as specified by the ghost state.\n If the components for an object are empty, then this object is treated as empty, and thus ignored.\n *)\ndefinition\n object_add :: \"cdl_object \\ cdl_object \\ cdl_components \\ cdl_components \\ cdl_object\"\nwhere\n \"object_add obj_a obj_b cmps_a cmps_b \\\n let clean_obj_a = object_clean obj_a cmps_a;\n clean_obj_b = object_clean obj_b cmps_b\n in if (cmps_a = {})\n then clean_obj_b\n else if (cmps_b = {})\n then clean_obj_a\n else if (None \\ cmps_b)\n then (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_b)\n else (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_a)\"\n\n(* Heaps are added by adding their respective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n * (overwrites the left with the right).\n *)\ndefinition\n cdl_heap_add :: \"sep_state \\ sep_state \\ cdl_heap\"\nwhere\n \"cdl_heap_add state_a state_b \\ \\obj_id.\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n case heap_b obj_id of\n None \\ heap_a obj_id\n | Some obj_b \\\n (case heap_a obj_id of\n None \\ heap_b obj_id\n | Some obj_a \\ Some (object_add obj_a obj_b (gs_a obj_id) (gs_b obj_id)))\"\n\n(* Heaps are added by adding their repsective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n * (overwrites the left with the right).\n *)\ndefinition\n cdl_ghost_state_add :: \"sep_state \\ sep_state \\ cdl_ghost_state\"\nwhere\n \"cdl_ghost_state_add state_a state_b \\ \\obj_id.\n let heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in if heap_a obj_id = None \\ heap_b obj_id \\ None then gs_b obj_id\n else if heap_b obj_id = None \\ heap_a obj_id \\ None then gs_a obj_id\n else gs_a obj_id \\ gs_b obj_id\"\n\n\n(* Adding states adds their heaps,\n * and each objects owns whichever fields it owned in either heap.\n *)\ndefinition\n sep_state_add :: \"sep_state \\ sep_state \\ sep_state\"\nwhere\n \"sep_state_add state_a state_b \\\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n SepState (cdl_heap_add state_a state_b) (cdl_ghost_state_add state_a state_b)\"\n\n\n(* Heaps are disjoint if for all of their objects:\n * the caps of their respective objects are disjoint,\n * their respective objects don't conflict,\n * they don't both own any of the same fields.\n*)\ndefinition\n sep_state_disj :: \"sep_state \\ sep_state \\ bool\"\nwhere\n \"sep_state_disj state_a state_b \\\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n \\obj_id. not_conflicting_objects state_a state_b obj_id\"\n\nlemma not_conflicting_objects_comm:\n \"not_conflicting_objects h1 h2 obj = not_conflicting_objects h2 h1 obj\"\n apply (clarsimp simp: not_conflicting_objects_def split:option.splits)\n apply (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\nlemma object_clean_comm:\n \"\\object_type obj_a = object_type obj_b;\n object_slots obj_a ++ object_slots obj_b = object_slots obj_b ++ object_slots obj_a; None \\ cmp\\\n \\ object_clean (add_to_slots (object_slots obj_a) obj_b) cmp =\n object_clean (add_to_slots (object_slots obj_b) obj_a) cmp\"\n apply (clarsimp simp: object_type_def split: cdl_object.splits)\n apply (clarsimp simp: object_clean_def object_clean_slots_def object_clean_fields_def\n add_to_slots_def object_slots_def update_slots_def\n cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)+\n done\n\nlemma add_to_slots_object_slots:\n \"object_type y = object_type z\n \\ add_to_slots (object_slots (add_to_slots (x) y)) z =\n add_to_slots (x ++ object_slots y) z\"\n apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n apply (fastforce simp: object_type_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\nlemma not_conflicting_objects_empty [simp]:\n \"not_conflicting_objects s (SepState Map.empty (\\obj_id. {})) obj_id\"\n by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma empty_not_conflicting_objects [simp]:\n \"not_conflicting_objects (SepState Map.empty (\\obj_id. {})) s obj_id\"\n by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma not_conflicting_objects_empty_object [elim!]:\n \"(sep_heap x) obj_id = None \\ not_conflicting_objects x y obj_id\"\n by (clarsimp simp: not_conflicting_objects_def)\n\nlemma empty_object_not_conflicting_objects [elim!]:\n \"(sep_heap y) obj_id = None \\ not_conflicting_objects x y obj_id\"\n apply (drule not_conflicting_objects_empty_object [where y=x])\n apply (clarsimp simp: not_conflicting_objects_comm)\n done\n\nlemma cdl_heap_add_empty [simp]:\n \"cdl_heap_add (SepState h gs) (SepState Map.empty (\\obj_id. {})) = h\"\n by (simp add: cdl_heap_add_def)\n\nlemma empty_cdl_heap_add [simp]:\n \"cdl_heap_add (SepState Map.empty (\\obj_id. {})) (SepState h gs)= h\"\n apply (simp add: cdl_heap_add_def)\n apply (rule ext)\n apply (clarsimp split: option.splits)\n done\n\nlemma map_add_result_empty1: \"a ++ b = Map.empty \\ a = Map.empty\"\n apply (subgoal_tac \"dom (a++b) = {}\")\n apply (subgoal_tac \"dom (a) = {}\")\n apply clarsimp\n apply (unfold dom_map_add)[1]\n apply clarsimp\n apply clarsimp\n done\n\nlemma map_add_result_empty2: \"a ++ b = Map.empty \\ b = Map.empty\"\n apply (subgoal_tac \"dom (a++b) = {}\")\n apply (subgoal_tac \"dom (a) = {}\")\n apply clarsimp\n apply (unfold dom_map_add)[1]\n apply clarsimp\n apply clarsimp\n done\n\nlemma map_add_emptyE [elim!]: \"\\a ++ b = Map.empty; \\a = Map.empty; b = Map.empty\\ \\ R\\ \\ R\"\n apply (frule map_add_result_empty1)\n apply (frule map_add_result_empty2)\n apply clarsimp\n done\n\nlemma clean_slots_empty [simp]:\n \"clean_slots Map.empty cmp = Map.empty\"\n by (clarsimp simp: clean_slots_def)\n\nlemma object_type_update_slots [simp]:\n \"object_type (update_slots slots x) = object_type x\"\n by (clarsimp simp: object_type_def update_slots_def split: cdl_object.splits)\n\nlemma object_type_object_clean_slots [simp]:\n \"object_type (object_clean_slots x cmp) = object_type x\"\n by (clarsimp simp: object_clean_slots_def)\n\nlemma object_type_object_clean_fields [simp]:\n \"object_type (object_clean_fields x cmp) = object_type x\"\n by (clarsimp simp: object_clean_fields_def object_type_def split: cdl_object.splits)\n\nlemma object_type_object_clean [simp]:\n \"object_type (object_clean x cmp) = object_type x\"\n by (clarsimp simp: object_clean_def)\n\nlemma object_type_add_to_slots [simp]:\n \"object_type (add_to_slots slots x) = object_type x\"\n by (clarsimp simp: object_type_def add_to_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_update_slots [simp]:\n \"has_slots obj \\ object_slots (update_slots slots obj) = slots\"\n by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n split: cdl_object.splits)\n\nlemma object_slots_update_slots_empty [simp]:\n \"\\has_slots obj \\ object_slots (update_slots slots obj) = Map.empty\"\n by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n split: cdl_object.splits)\n\nlemma update_slots_no_slots [simp]:\n \"\\has_slots obj \\ update_slots slots obj = obj\"\n by (clarsimp simp: update_slots_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_update_slots [simp]:\n \"update_slots slots (update_slots slots' obj) = update_slots slots obj\"\n by (clarsimp simp: update_slots_def split: cdl_object.splits)\n\nlemma update_slots_same_object:\n \"a = b \\ update_slots a obj = update_slots b obj\"\n by (erule arg_cong)\n\nlemma object_type_has_slots:\n \"\\has_slots x; object_type x = object_type y\\ \\ has_slots y\"\n by (clarsimp simp: object_type_def has_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_fields [simp]:\n \"object_slots (object_clean_fields obj cmp) = object_slots obj\"\n by (clarsimp simp: object_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_slots [simp]:\n \"object_slots (object_clean_slots obj cmp) = clean_slots (object_slots obj) cmp\"\n by (clarsimp simp: object_clean_slots_def object_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean [simp]:\n \"object_slots (object_clean obj cmp) = clean_slots (object_slots obj) cmp\"\n by (clarsimp simp: object_clean_def)\n\nlemma object_slots_add_to_slots [simp]:\n \"object_type y = object_type z \\ object_slots (add_to_slots (object_slots y) z) = object_slots y ++ object_slots z\"\n by (clarsimp simp: object_slots_def add_to_slots_def update_slots_def object_type_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_slots [simp]:\n \"update_slots slots (object_clean_slots obj cmp) = update_slots slots obj\"\n by (clarsimp simp: object_clean_slots_def)\n\nlemma object_clean_fields_idem [simp]:\n \"object_clean_fields (object_clean_fields obj cmp) cmp = object_clean_fields obj cmp\"\n by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma object_clean_slots_idem [simp]:\n \"object_clean_slots (object_clean_slots obj cmp) cmp = object_clean_slots obj cmp\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: object_clean_slots_def clean_slots_def)+\n done\n\nlemma object_clean_fields_object_clean_slots [simp]:\n \"object_clean_fields (object_clean_slots obj gs) gs = object_clean_slots (object_clean_fields obj gs) gs\"\n by (clarsimp simp: object_clean_fields_def object_clean_slots_def\n clean_slots_def object_slots_def update_slots_def\n split: cdl_object.splits)\n\nlemma object_clean_idem [simp]:\n \"object_clean (object_clean obj cmp) cmp = object_clean obj cmp\"\n by (clarsimp simp: object_clean_def)\n\nlemma has_slots_object_clean_slots:\n \"has_slots (object_clean_slots obj cmp) = has_slots obj\"\n by (clarsimp simp: has_slots_def object_clean_slots_def update_slots_def split: cdl_object.splits)\n\nlemma has_slots_object_clean_fields:\n \"has_slots (object_clean_fields obj cmp) = has_slots obj\"\n by (clarsimp simp: has_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma has_slots_object_clean:\n \"has_slots (object_clean obj cmp) = has_slots obj\"\n by (clarsimp simp: object_clean_def has_slots_object_clean_slots has_slots_object_clean_fields)\n\nlemma object_slots_update_slots_object_clean_fields [simp]:\n \"object_slots (update_slots slots (object_clean_fields obj cmp)) = object_slots (update_slots slots obj)\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: has_slots_object_clean_fields)+\n done\n\nlemma object_clean_fields_update_slots [simp]:\n \"object_clean_fields (update_slots slots obj) cmp = update_slots slots (object_clean_fields obj cmp)\"\n by (clarsimp simp: object_clean_fields_def update_slots_def split: cdl_object.splits)\n\nlemma object_clean_fields_twice [simp]:\n \"(object_clean_fields (object_clean_fields obj cmp') cmp) = object_clean_fields obj (cmp \\ cmp')\"\n by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_fields:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'\\\n \\ update_slots slots (object_clean_fields obj cmps) =\n update_slots slots (object_clean_fields obj' cmps')\"\n by (fastforce simp: update_slots_def object_clean_fields_def object_type_def split: cdl_object.splits)\n\nlemma object_clean_fields_no_slots:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'; \\ has_slots obj; \\ has_slots obj'\\\n \\ object_clean_fields obj cmps = object_clean_fields obj' cmps'\"\n by (fastforce simp: object_clean_fields_def object_type_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_object_clean:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'\\\n \\ update_slots slots (object_clean obj cmps) = update_slots slots (object_clean obj' cmps')\"\n apply (clarsimp simp: object_clean_def object_clean_slots_def)\n apply (erule (2) update_slots_object_clean_fields)\n done\n\nlemma cdl_heap_add_assoc':\n \"\\obj_id. not_conflicting_objects x z obj_id \\\n not_conflicting_objects y z obj_id \\\n not_conflicting_objects x z obj_id \\\n cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (rule ext)\n apply (rename_tac obj_id)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp simp: cdl_heap_add_def cdl_ghost_state_add_def not_conflicting_objects_def)\n apply (simp add: Let_unfold split: option.splits)\n apply (rename_tac obj_y obj_x obj_z)\n apply (clarsimp simp: object_add_def clean_slots_def object_clean_def object_clean_slots_def Let_unfold)\n apply (case_tac \"has_slots obj_z\")\n apply (subgoal_tac \"has_slots obj_y\")\n apply (subgoal_tac \"has_slots obj_x\")\n apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n map_add_restrict union_intersection |\n drule inter_empty_not_both |\n erule update_slots_object_clean_fields |\n erule object_type_has_slots, simp |\n simp | safe)+)[3]\n apply (subgoal_tac \"\\ has_slots obj_y\")\n apply (subgoal_tac \"\\ has_slots obj_x\")\n apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n map_add_restrict union_intersection |\n drule inter_empty_not_both |\n erule object_clean_fields_no_slots |\n erule object_type_has_slots, simp |\n simp | safe)+)\n apply (fastforce simp: object_type_has_slots)+\n done\n\nlemma cdl_heap_add_assoc:\n \"\\sep_state_disj x y; sep_state_disj y z; sep_state_disj x z\\\n \\ cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (clarsimp simp: sep_state_disj_def)\n apply (cut_tac cdl_heap_add_assoc')\n apply fast\n apply fastforce\n done\n\nlemma cdl_ghost_state_add_assoc:\n \"cdl_ghost_state_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_ghost_state_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (rule ext)\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def Let_unfold)\n done\n\nlemma clean_slots_map_add_comm:\n \"cmps_a \\ cmps_b = {}\n \\ clean_slots slots_a cmps_a ++ clean_slots slots_b cmps_b =\n clean_slots slots_b cmps_b ++ clean_slots slots_a cmps_a\"\n apply (clarsimp simp: clean_slots_def)\n apply (drule the_set_inter_empty)\n apply (erule map_add_restrict_comm)\n done\n\nlemma object_clean_all:\n \"object_type obj_a = object_type obj_b \\ object_clean obj_b {} = object_clean obj_a {}\"\n apply (clarsimp simp: object_clean_def object_clean_slots_def clean_slots_def the_set_def)\n apply (rule_tac cmps'1=\"{}\" and obj'1=\"obj_a\" in trans [OF update_slots_object_clean_fields], fastforce+)\n done\n\nlemma object_add_comm:\n \"\\object_type obj_a = object_type obj_b; cmps_a \\ cmps_b = {}\\\n \\ object_add obj_a obj_b cmps_a cmps_b = object_add obj_b obj_a cmps_b cmps_a\"\n apply (clarsimp simp: object_add_def Let_unfold)\n apply (rule conjI | clarsimp)+\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (erule object_clean_all)\n apply (clarsimp)\n apply (rule_tac cmps'1=cmps_b and obj'1=obj_b in trans [OF update_slots_object_clean], assumption+)\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n done\n\nlemma sep_state_add_comm:\n \"sep_state_disj x y \\ sep_state_add x y = sep_state_add y x\"\n apply (clarsimp simp: sep_state_add_def sep_state_disj_def)\n apply (rule conjI)\n apply (case_tac x, case_tac y, clarsimp)\n apply (rename_tac heap_a gs_a heap_b gs_b)\n apply (clarsimp simp: cdl_heap_add_def Let_unfold)\n apply (rule ext)\n apply (case_tac \"heap_a obj_id\")\n apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n apply (rename_tac obj_a obj_b)\n apply (erule_tac x=obj_id in allE)\n apply (rule object_add_comm)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (rule ext, fastforce simp: cdl_ghost_state_add_def Let_unfold Un_commute)\n done\n\nlemma add_to_slots_comm:\n \"\\object_slots y_obj \\ object_slots z_obj; update_slots Map.empty y_obj = update_slots Map.empty z_obj \\\n \\ add_to_slots (object_slots z_obj) y_obj = add_to_slots (object_slots y_obj) z_obj\"\n by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n cdl_tcb.splits cdl_cnode.splits\n dest!: map_add_com\n split: cdl_object.splits)\n\nlemma cdl_heap_add_none1:\n \"cdl_heap_add x y obj_id = None \\ (sep_heap x) obj_id = None\"\n by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma cdl_heap_add_none2:\n \"cdl_heap_add x y obj_id = None \\ (sep_heap y) obj_id = None\"\n by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma object_type_object_addL:\n \"object_type obj = object_type obj'\n \\ object_type (object_add obj obj' cmp cmp') = object_type obj\"\n by (clarsimp simp: object_add_def Let_unfold)\n\nlemma object_type_object_addR:\n \"object_type obj = object_type obj'\n \\ object_type (object_add obj obj' cmp cmp') = object_type obj'\"\n by (clarsimp simp: object_add_def Let_unfold)\n\nlemma sep_state_add_disjL:\n \"\\sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\ \\ sep_state_disj x y\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\nlemma sep_state_add_disjR:\n \"\\sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\ \\ sep_state_disj x z\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\nlemma sep_state_add_disj:\n \"\\sep_state_disj y z; sep_state_disj x y; sep_state_disj x z\\ \\ sep_state_disj x (sep_state_add y z)\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\n\n\n\n(*********************************************)\n(* Definition of separation logic for capDL. *)\n(*********************************************)\n\ninstantiation \"sep_state\" :: zero\nbegin\n definition \"0 \\ SepState Map.empty (\\obj_id. {})\"\n instance ..\nend\n\ninstantiation \"sep_state\" :: stronger_sep_algebra\nbegin\n\ndefinition \"(##) \\ sep_state_disj\"\ndefinition \"(+) \\ sep_state_add\"\n\n\n\n(**********************************************\n * The proof that this is a separation logic. *\n **********************************************)\n\ninstance\n apply intro_classes\n(* x ## 0 *)\n apply (simp add: sep_disj_sep_state_def sep_state_disj_def zero_sep_state_def)\n(* x ## y \\ y ## x *)\n apply (clarsimp simp: not_conflicting_objects_comm sep_disj_sep_state_def sep_state_disj_def Let_unfold\n map_disj_com Int_commute)\n(* x + 0 = x *)\n apply (simp add: plus_sep_state_def sep_state_add_def zero_sep_state_def)\n apply (case_tac x)\n apply (clarsimp simp: cdl_heap_add_def)\n apply (rule ext)\n apply (clarsimp simp: cdl_ghost_state_add_def split:if_split_asm)\n(* x ## y \\ x + y = y + x *)\n apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n apply (erule sep_state_add_comm)\n(* (x + y) + z = x + (y + z) *)\n apply (simp add: plus_sep_state_def sep_state_add_def)\n apply (rule conjI)\n apply (clarsimp simp: sep_disj_sep_state_def)\n apply (erule (2) cdl_heap_add_assoc)\n apply (rule cdl_ghost_state_add_assoc)\n(* x ## y + z = (x ## y \\ x ## z) *)\n apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n apply (rule iffI)\n (* x ## y + z \\ (x ## y \\ x ## z) *)\n apply (rule conjI)\n (* x ## y + z \\ (x ## y) *)\n apply (erule (1) sep_state_add_disjL)\n (* x ## y + z \\ (x ## z) *)\n apply (erule (1) sep_state_add_disjR)\n (* x ## y + z \\ (x ## y \\ x ## z) *)\n apply clarsimp\n apply (erule (2) sep_state_add_disj)\n done\n\nend\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/sep_algebra/ex/capDL/Abstract_Separation_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883735630722, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.272042491358547}} {"text": "theory Calls\n imports \"reassembly_setup.Leviathan_Setup\"\n \"Det_Step\"\nbegin\n\ncontext execution_context\nbegin\ntext \"To call a concrete function on a concrete state.\"\ndefinition call\\<^sub>c :: \"(state \\ state) \\ state \\ state \\ bool\"\n where \"call\\<^sub>c f s s' \\ s' = (let s'' = f s in s''\\regs := (regs s'')(rip := get_rip s + 5)\\)\"\n\ntext \"To call an abstract function on an abstract state\"\ndefinition abstract\\<^sub>0 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>0 S f \\ \\' \\ \\ s s' . call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>0:\n shows \"call\\<^sub>c f s s' \\ abstract\\<^sub>0 S f ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>0_def)\n\ndefinition abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ 32 word \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 \\ \\' \\ \\ s s' . EDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"EDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>1\\<^sub>_\\<^sub>3\\<^sub>2_def)\n\ndefinition abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ 64 word \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 S f p\\<^sub>0 \\ \\' \\ \\ s s' . RDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4:\n shows \"RDI s = p\\<^sub>0 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4 S f p\\<^sub>0 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>1\\<^sub>_\\<^sub>6\\<^sub>4_def)\n\ndefinition abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ _ \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 \\ \\' \\ \\ s s' . RDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"RDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>2\\<^sub>_\\<^sub>6\\<^sub>4\\<^sub>_\\<^sub>3\\<^sub>2_def)\n\ndefinition abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 :: \"(state \\ '\\\\<^sub>C \\ '\\\\<^sub>C\\<^sub>C) \\ _ \\ _ \\ _ \\ unit \\ '\\\\<^sub>C \\ unit \\ '\\\\<^sub>C \\ bool\"\n where \"abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 \\ \\' \\ \\ s s' . EDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ ((), \\ S s') = \\' \\ ((), \\ S s) = \\\"\n\nlemma abstract_call\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2:\n shows \"EDI s = p\\<^sub>0 \\ ESI s = p\\<^sub>1 \\ call\\<^sub>c f s s' \\ abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2 S f p\\<^sub>0 p\\<^sub>1 ((), \\ S s) ((), \\ S s')\"\n by (auto simp add: call\\<^sub>c_def Let_def abstract\\<^sub>2\\<^sub>_\\<^sub>3\\<^sub>2_\\<^sub>3\\<^sub>2_def)\n\nend\nend", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/current_work/isabelle/Calls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.27204249135854697}} {"text": "(* File: Loop_Composition.thy\n Copyright 2021 Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\\n\\<^marker>\\contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\\n\nsection \\Loop Composition\\\n\ntheory Loop_Composition\n imports \"Basic_Modules/Component_Types/Termination_Condition\"\n \"Basic_Modules/Defer_Module\"\n Sequential_Composition\nbegin\n\ntext\n\\The loop composition uses the same module in sequence,\ncombined with a termination condition, until either\n (1) the termination condition is met or\n (2) no new decisions are made (i.e., a fixed point is reached).\\\n\nsubsection \\Definition\\\n\nlemma loop_termination_helper:\n assumes\n not_term: \"\\t (acc A p)\" and\n subset: \"defer (acc \\ m) A p \\ defer acc A p\" and\n not_inf: \"\\infinite (defer acc A p)\"\n shows\n \"((acc \\ m, m, t, A, p), (acc, m, t, A, p)) \\\n measure (\\(acc, m, t, A, p). card (defer acc A p))\"\n using assms psubset_card_mono\n by auto\n\n(*\n This function handles the accumulator for the following loop composition\n function.\n*)\nfunction loop_comp_helper ::\n \"'a Electoral_Module \\ 'a Electoral_Module \\\n 'a Termination_Condition \\ 'a Electoral_Module\" where\n \"t (acc A p) \\ \\((defer (acc \\ m) A p) \\ (defer acc A p)) \\\n infinite (defer acc A p) \\\n loop_comp_helper acc m t A p = acc A p\" |\n \"\\(t (acc A p) \\ \\((defer (acc \\ m) A p) \\ (defer acc A p)) \\\n infinite (defer acc A p)) \\\n loop_comp_helper acc m t A p = loop_comp_helper (acc \\ m) m t A p\"\nproof -\n fix\n P :: bool and\n x :: \"('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile\"\n assume\n a1: \"\\t acc A p m.\n \\t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p);\n x = (acc, m, t, A, p)\\ \\ P\" and\n a2: \"\\t acc A p m.\n \\\\ (t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p));\n x = (acc, m, t, A, p)\\ \\ P\"\n have \"\\f A p p2 g. (g, f, p, A, p2) = x\"\n using prod_cases5\n by metis\n then show P\n using a2 a1\n by (metis (no_types))\nnext\n show\n \"\\t acc A p m ta acca Aa pa ma.\n t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p) \\\n ta (acca Aa pa) \\ \\ defer (acca \\ ma) Aa pa \\ defer acca Aa pa \\\n infinite (defer acca Aa pa) \\\n (acc, m, t, A, p) = (acca, ma, ta, Aa, pa) \\\n acc A p = acca Aa pa\"\n by fastforce\nnext\n show\n \"\\t acc A p m ta acca Aa pa ma.\n t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p) \\\n \\ (ta (acca Aa pa) \\ \\ defer (acca \\ ma) Aa pa \\ defer acca Aa pa \\\n infinite (defer acca Aa pa)) \\\n (acc, m, t, A, p) = (acca, ma, ta, Aa, pa) \\\n acc A p = loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa)\"\n proof -\n fix\n t :: \"'a Termination_Condition\" and\n acc :: \"'a Electoral_Module\" and\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n m :: \"'a Electoral_Module\" and\n ta :: \"'a Termination_Condition\" and\n acca :: \"'a Electoral_Module\" and\n Aa :: \"'a set\" and\n pa :: \"'a Profile\" and\n ma :: \"'a Electoral_Module\"\n assume\n a1: \"t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p)\" and\n a2: \"\\ (ta (acca Aa pa) \\ \\ defer (acca \\ ma) Aa pa \\ defer acca Aa pa \\\n infinite (defer acca Aa pa))\" and\n \"(acc, m, t, A, p) = (acca, ma, ta, Aa, pa)\"\n hence False\n using a2 a1\n by force\n thus \"acc A p = loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa)\"\n by auto\nqed\nnext\n show\n \"\\t acc A p m ta acca Aa pa ma.\n \\ (t (acc A p) \\ \\ defer (acc \\ m) A p \\ defer acc A p \\\n infinite (defer acc A p)) \\\n \\ (ta (acca Aa pa) \\ \\ defer (acca \\ ma) Aa pa \\ defer acca Aa pa \\\n infinite (defer acca Aa pa)) \\\n (acc, m, t, A, p) = (acca, ma, ta, Aa, pa) \\\n loop_comp_helper_sumC (acc \\ m, m, t, A, p) =\n loop_comp_helper_sumC (acca \\ ma, ma, ta, Aa, pa)\"\n by force\nqed\ntermination\nproof -\n have f0:\n \"\\r. wf r \\\n (\\p f (A::'a set) prof g.\n p (f A prof) \\\n \\ defer (f \\ g) A prof \\ defer f A prof \\\n infinite (defer f A prof) \\\n ((f \\ g, g, p, A, prof), (f, g, p, A, prof)) \\ r)\"\n using loop_termination_helper wf_measure \"termination\"\n by (metis (no_types))\n hence\n \"\\r p.\n Ex ((\\ra. \\f (A::'a set) prof pa g.\n \\prof2 pb p_rel pc pd h (B::'a set) prof3 i pe.\n \\ wf r \\\n loop_comp_helper_dom\n (p::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile) \\\n infinite (defer f A prof) \\\n pa (f A prof) \\\n wf\n (prof2::((\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile) \\ _) set) \\\n \\ loop_comp_helper_dom (pb::\n ('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile) \\\n wf p_rel \\ \\ defer (f \\ g) A prof \\ defer f A prof \\\n \\ loop_comp_helper_dom\n (pc::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile) \\\n ((f \\ g, g, pa, A, prof), f, g, pa, A, prof) \\ p_rel \\ wf p_rel \\\n \\ loop_comp_helper_dom\n (pd::('a Electoral_Module) \\ (_ Electoral_Module) \\\n (_ Termination_Condition) \\ _ set \\ _ Profile) \\\n finite (defer h B prof3) \\\n defer (h \\ i) B prof3 \\ defer h B prof3 \\\n \\ pe (h B prof3) \\\n ((h \\ i, i, pe, B, prof3), h, i, pe, B, prof3) \\ r)::\n ((('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile) \\\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile) set \\ bool)\"\n by metis\n obtain\n p_rel :: \"((('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile) \\\n ('a Electoral_Module) \\ ('a Electoral_Module) \\\n ('a Termination_Condition) \\ 'a set \\ 'a Profile) set\" where\n \"wf p_rel \\\n (\\p f A prof g. p (f A prof) \\\n \\ defer (f \\ g) A prof \\ defer f A prof \\\n infinite (defer f A prof) \\\n ((f \\ g, g, p, A, prof), f, g, p, A, prof) \\ p_rel)\"\n using f0\n by presburger\n thus ?thesis\n using \"termination\"\n by metis\nqed\n\nlemma loop_comp_code_helper[code]:\n \"loop_comp_helper acc m t A p =\n (if (t (acc A p) \\ \\((defer (acc \\ m) A p) \\ (defer acc A p)) \\\n infinite (defer acc A p))\n then (acc A p) else (loop_comp_helper (acc \\ m) m t A p))\"\n by simp\n\nfunction loop_composition ::\n \"'a Electoral_Module \\ 'a Termination_Condition \\\n 'a Electoral_Module\" where\n \"t ({}, {}, A) \\\n loop_composition m t A p = defer_module A p\" |\n \"\\(t ({}, {}, A)) \\\n loop_composition m t A p = (loop_comp_helper m m t) A p\"\n by (fastforce, simp_all)\ntermination\n using \"termination\" wf_empty\n by blast\n\nabbreviation loop ::\n \"'a Electoral_Module \\ 'a Termination_Condition \\ 'a Electoral_Module\"\n (\"_ \\\\<^sub>_\" 50) where\n \"m \\\\<^sub>t \\ loop_composition m t\"\n\nlemma loop_comp_code[code]:\n \"loop_composition m t A p =\n (if (t ({},{},A))\n then (defer_module A p) else (loop_comp_helper m m t) A p)\"\n by simp\n\nlemma loop_comp_helper_imp_partit:\n assumes\n module_m: \"electoral_module m\" and\n profile: \"finite_profile A p\"\n shows\n \"electoral_module acc \\ (n = card (defer acc A p)) \\\n well_formed A (loop_comp_helper acc m t A p)\"\nproof (induct arbitrary: acc rule: less_induct)\n case (less)\n have\n \"\\(f::'a set \\ 'a Profile \\ 'a Result) g.\n (electoral_module f \\ electoral_module g) \\\n electoral_module (f \\ g)\"\n by auto\n hence \"electoral_module (acc \\ m)\"\n using less.prems module_m\n by metis\n hence wf_acc:\n \"\\ t (acc A p) \\ \\ t (acc A p) \\\n defer (acc \\ m) A p \\ defer acc A p \\\n finite (defer acc A p) \\\n well_formed A (loop_comp_helper acc m t A p)\"\n using less.hyps less.prems loop_comp_helper.simps(2)\n psubset_card_mono\n by metis\n have \"well_formed A (acc A p)\"\n using electoral_module_def less.prems profile\n by blast\n thus ?case\n using wf_acc loop_comp_helper.simps(1)\n by (metis (no_types))\nqed\n\nsubsection \\Soundness\\\n\ntheorem loop_comp_sound:\n assumes m_module: \"electoral_module m\"\n shows \"electoral_module (m \\\\<^sub>t)\"\n using def_mod_sound electoral_module_def loop_composition.simps(1)\n loop_composition.simps(2) loop_comp_helper_imp_partit m_module\n by metis\n\nlemma loop_comp_helper_imp_no_def_incr:\n assumes\n module_m: \"electoral_module m\" and\n profile: \"finite_profile A p\"\n shows\n \"(electoral_module acc \\ n = card (defer acc A p)) \\\n defer (loop_comp_helper acc m t) A p \\ defer acc A p\"\nproof (induct arbitrary: acc rule: less_induct)\n case (less)\n have emod_acc_m: \"electoral_module (acc \\ m)\"\n using less.prems module_m\n by simp\n have \"\\A Aa. infinite (A::'a set) \\ \\ Aa \\ A \\ card Aa < card A\"\n using psubset_card_mono\n by metis\n hence\n \"\\ t (acc A p) \\ defer (acc \\ m) A p \\ defer acc A p \\\n finite (defer acc A p) \\\n defer (loop_comp_helper (acc \\ m) m t) A p \\ defer acc A p\"\n using emod_acc_m less.hyps less.prems\n by blast\n hence\n \"\\ t (acc A p) \\ defer (acc \\ m) A p \\ defer acc A p \\\n finite (defer acc A p) \\\n defer (loop_comp_helper acc m t) A p \\ defer acc A p\"\n using loop_comp_helper.simps(2)\n by (metis (no_types))\n thus ?case\n using eq_iff loop_comp_helper.simps(1)\n by (metis (no_types))\nqed\n\nsubsection \\Lemmata\\\n\nlemma loop_comp_helper_def_lift_inv_helper:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n f_prof: \"finite_profile A p\"\n shows\n \"(defer_lift_invariance acc \\ n = card (defer acc A p)) \\\n (\\q a.\n (a \\ (defer (loop_comp_helper acc m t) A p) \\\n lifted A p q a) \\\n (loop_comp_helper acc m t) A p =\n (loop_comp_helper acc m t) A q)\"\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n have defer_card_comp:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n card (defer (acc \\ m) A p) = card (defer (acc \\ m) A q))\"\n using monotone_m def_lift_inv_seq_comp_help\n by metis\n have defer_card_acc:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc) A p) \\ lifted A p q a) \\\n card (defer (acc) A p) = card (defer (acc) A q))\"\n by (simp add: defer_lift_invariance_def)\n hence defer_card_acc_2:\n \"defer_lift_invariance acc \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n card (defer (acc) A p) = card (defer (acc) A q))\"\n using monotone_m f_prof defer_lift_invariance_def seq_comp_def_set_trans\n by metis\n thus ?case\n proof cases\n assume card_unchanged: \"card (defer (acc \\ m) A p) = card (defer acc A p)\"\n with defer_card_comp defer_card_acc monotone_m\n have\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc) A p) \\ lifted A p q a) \\\n (loop_comp_helper acc m t) A q = acc A q)\"\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n def_card_eq:\n \"card (defer (acc \\ m) A p) = card (defer acc A p)\" and\n dli_acc: \"defer_lift_invariance acc\" and\n def_seq_lift_card:\n \"\\q a. a \\ defer (acc \\ m) A p \\ Profile.lifted A p q a \\\n card (defer (acc \\ m) A p) = card (defer (acc \\ m) A q)\" and\n a_in_def_acc: \"a \\ defer acc A p\" and\n lifted_A: \"Profile.lifted A p q a\"\n have emod_m: \"electoral_module m\"\n using defer_lift_invariance_def monotone_m\n by auto\n have emod_acc: \"electoral_module acc\"\n using defer_lift_invariance_def dli_acc\n by blast\n have acc_eq_pq: \"acc A q = acc A p\"\n using a_in_def_acc defer_lift_invariance_def dli_acc lifted_A\n by (metis (full_types))\n with emod_acc emod_m\n have\n \"finite (defer acc A p) \\\n loop_comp_helper acc m t A q = acc A q\"\n using a_in_def_acc def_card_eq def_seq_lift_card\n dual_order.strict_iff_order f_prof lifted_A\n loop_comp_code_helper psubset_card_mono\n seq_comp_def_set_bounded\n by (metis (no_types))\n thus \"loop_comp_helper acc m t A q = acc A q\"\n using acc_eq_pq loop_comp_code_helper\n by (metis (full_types))\n qed\n moreover from card_unchanged have\n \"(loop_comp_helper acc m t) A p = acc A p\"\n using loop_comp_helper.simps(1) order.strict_iff_order\n psubset_card_mono\n by metis\n ultimately have\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance acc) \\\n (\\q a. (a \\ (defer (loop_comp_helper acc m t) A p) \\\n lifted A p q a) \\\n (loop_comp_helper acc m t) A p =\n (loop_comp_helper acc m t) A q)\"\n using defer_lift_invariance_def\n by metis\n thus ?thesis\n using monotone_m seq_comp_presv_def_lift_inv\n by blast\n next\n assume card_changed:\n \"\\ (card (defer (acc \\ m) A p) = card (defer acc A p))\"\n with f_prof seq_comp_def_card_bounded have card_smaller_for_p:\n \"electoral_module (acc) \\\n (card (defer (acc \\ m) A p) < card (defer acc A p))\"\n using monotone_m order.not_eq_order_implies_strict\n defer_lift_invariance_def\n by (metis (full_types))\n with defer_card_acc_2 defer_card_comp\n have card_changed_for_q:\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n (card (defer (acc \\ m) A q) < card (defer acc A q)))\"\n using defer_lift_invariance_def\n by (metis (no_types, lifting))\n thus ?thesis\n proof cases\n assume t_not_satisfied_for_p: \"\\ t (acc A p)\"\n hence t_not_satisfied_for_q:\n \"defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n \\ t (acc A q))\"\n using monotone_m f_prof defer_lift_invariance_def seq_comp_def_set_trans\n by metis\n from card_changed defer_card_comp defer_card_acc\n have dli_card_def:\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc)) \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ Profile.lifted A p q a) \\\n card (defer (acc \\ m) A q) \\ (card (defer acc A q)))\"\n proof -\n have\n \"\\f.\n (defer_lift_invariance f \\\n (\\A prof prof2 (a::'a).\n f A prof \\ f A prof2 \\\n Profile.lifted A prof prof2 a \\\n a \\ defer f A prof) \\ \\ electoral_module f) \\\n ((\\A p1 p2 b. f A p1 = f A p2 \\ \\ Profile.lifted A p1 p2 b \\\n b \\ defer f A p1) \\\n electoral_module f \\ \\ defer_lift_invariance f)\"\n using defer_lift_invariance_def\n by blast\n thus ?thesis\n using card_changed monotone_m f_prof seq_comp_def_set_trans\n by (metis (no_types, hide_lams))\n qed\n hence dli_def_subset:\n \"defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc) \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n defer (acc \\ m) A q \\ defer acc A q)\"\n proof -\n {\n fix\n alt :: 'a and\n prof :: \"'a Profile\"\n have\n \"(\\ defer_lift_invariance (acc \\ m) \\ \\ defer_lift_invariance acc) \\\n (alt \\ defer (acc \\ m) A p \\ \\ lifted A p prof alt) \\\n defer (acc \\ m) A prof \\ defer acc A prof\"\n using Profile.lifted_def dli_card_def defer_lift_invariance_def\n monotone_m psubsetI seq_comp_def_set_bounded\n by (metis (no_types))\n }\n thus ?thesis\n by metis\n qed\n with t_not_satisfied_for_p\n have rec_step_q:\n \"(defer_lift_invariance (acc \\ m) \\ defer_lift_invariance (acc)) \\\n (\\q a. (a \\ (defer (acc \\ m) A p) \\ lifted A p q a) \\\n loop_comp_helper acc m t A q =\n loop_comp_helper (acc \\ m) m t A q)\"\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n a_in_def_impl_def_subset:\n \"\\q a. a \\ defer (acc \\ m) A p \\ lifted A p q a \\\n defer (acc \\ m) A q \\ defer acc A q\" and\n dli_acc: \"defer_lift_invariance acc\" and\n a_in_def_seq_acc_m: \"a \\ defer (acc \\ m) A p\" and\n lifted_pq_a: \"lifted A p q a\"\n have defer_subset_acc:\n \"defer (acc \\ m) A q \\ defer acc A q\"\n using a_in_def_impl_def_subset lifted_pq_a\n a_in_def_seq_acc_m\n by metis\n have \"electoral_module acc\"\n using dli_acc defer_lift_invariance_def\n by auto\n hence \"finite (defer acc A q) \\ \\ t (acc A q)\"\n using lifted_def dli_acc a_in_def_seq_acc_m\n lifted_pq_a def_presv_fin_prof\n t_not_satisfied_for_q\n by metis\n with defer_subset_acc\n show\n \"loop_comp_helper acc m t A q =\n loop_comp_helper (acc \\ m) m t A q\"\n using loop_comp_code_helper\n by metis\n qed\n have rec_step_p:\n \"electoral_module acc \\\n loop_comp_helper acc m t A p = loop_comp_helper (acc \\ m) m t A p\"\n proof (safe)\n assume emod_acc: \"electoral_module acc\"\n have emod_implies_defer_subset:\n \"electoral_module m \\ defer (acc \\ m) A p \\ defer acc A p\"\n using emod_acc f_prof seq_comp_def_set_bounded\n by blast\n have card_ineq: \"card (defer (acc \\ m) A p) < card (defer acc A p)\"\n using card_smaller_for_p emod_acc\n by force\n have fin_def_limited_acc:\n \"finite_profile (defer acc A p) (limit_profile (defer acc A p) p)\"\n using def_presv_fin_prof emod_acc f_prof\n by metis\n have \"defer (acc \\ m) A p \\ defer acc A p\"\n using emod_implies_defer_subset defer_lift_invariance_def monotone_m\n by blast\n hence \"defer (acc \\ m) A p \\ defer acc A p\"\n using fin_def_limited_acc card_ineq card_psubset\n by metis\n with fin_def_limited_acc\n show \"loop_comp_helper acc m t A p = loop_comp_helper (acc \\ m) m t A p\"\n using loop_comp_code_helper t_not_satisfied_for_p\n by (metis (no_types))\n qed\n show ?thesis\n proof (safe)\n fix\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n dli_acc: \"defer_lift_invariance acc\" and\n n_card_acc: \"n = card (defer acc A p)\" and\n a_in_defer_lch: \"a \\ defer (loop_comp_helper acc m t) A p\" and\n a_lifted: \"Profile.lifted A p q a\"\n hence emod_acc: \"electoral_module acc\"\n using defer_lift_invariance_def\n by metis\n have \"defer_lift_invariance (acc \\ m) \\ a \\ defer (acc \\ m) A p\"\n using a_in_defer_lch defer_lift_invariance_def dli_acc\n f_prof loop_comp_helper_imp_no_def_incr monotone_m\n rec_step_p seq_comp_presv_def_lift_inv subsetD\n by (metis (no_types))\n with emod_acc\n show \"loop_comp_helper acc m t A p = loop_comp_helper acc m t A q\"\n using a_in_defer_lch a_lifted card_smaller_for_p dli_acc\n less.hyps n_card_acc rec_step_p rec_step_q\n by (metis (full_types))\n qed\n next\n assume \"\\ \\t (acc A p)\"\n with defer_lift_invariance_def\n show ?thesis\n using loop_comp_helper.simps(1)\n by metis\n qed\n qed\nqed\n\nlemma loop_comp_helper_def_lift_inv:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\" and\n profile: \"finite_profile A p\"\n shows\n \"\\q a. (lifted A p q a \\ a \\ (defer (loop_comp_helper acc m t) A p)) \\\n (loop_comp_helper acc m t) A p = (loop_comp_helper acc m t) A q\"\n using loop_comp_helper_def_lift_inv_helper\n monotone_m monotone_acc profile\n by blast\n\nlemma loop_comp_helper_def_lift_inv2:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\" and\n finite_A_p: \"finite_profile A p\" and\n lifted_A_pq: \"lifted A p q a\" and\n a_in_defer_acc: \"a \\ defer (loop_comp_helper acc m t) A p\"\n shows\n \"(loop_comp_helper acc m t) A p = (loop_comp_helper acc m t) A q\"\n using finite_A_p lifted_A_pq a_in_defer_acc\n loop_comp_helper_def_lift_inv\n monotone_acc monotone_m\n by blast\n\nlemma lifted_imp_fin_prof:\n assumes \"lifted A p q a\"\n shows \"finite_profile A p\"\n using assms Profile.lifted_def\n by fastforce\n\nlemma loop_comp_helper_presv_def_lift_inv:\n assumes\n monotone_m: \"defer_lift_invariance m\" and\n monotone_acc: \"defer_lift_invariance acc\"\n shows \"defer_lift_invariance (loop_comp_helper acc m t)\"\nproof -\n have\n \"\\f. (defer_lift_invariance f \\\n (\\A prof prof2 (a::'a).\n f A prof \\ f A prof2 \\\n Profile.lifted A prof prof2 a \\\n a \\ defer f A prof) \\\n \\ electoral_module f) \\\n ((\\A prof prof2 a. f A prof = f A prof2 \\\n \\ Profile.lifted A prof prof2 a \\\n a \\ defer f A prof) \\\n electoral_module f \\ \\ defer_lift_invariance f)\"\n using defer_lift_invariance_def\n by blast\n thus ?thesis\n using electoral_module_def lifted_imp_fin_prof\n loop_comp_helper_def_lift_inv loop_comp_helper_imp_partit\n monotone_acc monotone_m\n by (metis (full_types))\nqed\n\nlemma loop_comp_presv_non_electing_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n non_electing_acc: \"non_electing acc\" and\n f_prof: \"finite_profile A p\" and\n acc_defer_card: \"n = card (defer acc A p)\"\n shows \"elect (loop_comp_helper acc m t) A p = {}\"\n using acc_defer_card non_electing_acc\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n thus ?case\n proof (safe)\n fix x :: \"'a\"\n assume\n y_acc_no_elect:\n \"(\\y acc'. y < card (defer acc A p) \\\n y = card (defer acc' A p) \\ non_electing acc' \\\n elect (loop_comp_helper acc' m t) A p = {})\" and\n acc_non_elect:\n \"non_electing acc\" and\n x_in_acc_elect:\n \"x \\ elect (loop_comp_helper acc m t) A p\"\n have\n \"\\(f::'a set \\ 'a Profile \\ 'a Result) g.\n (non_electing f \\ non_electing g) \\\n non_electing (f \\ g)\"\n by simp\n hence seq_acc_m_non_elect: \"non_electing (acc \\ m)\"\n using acc_non_elect non_electing_m\n by blast\n have \"\\A B. (finite (A::'a set) \\ B \\ A) \\ card B < card A\"\n using psubset_card_mono\n by metis\n hence card_ineq:\n \"\\A B. (finite (A::'a set) \\ B \\ A) \\ card B < card A\"\n by presburger\n have no_elect_acc: \"elect acc A p = {}\"\n using acc_non_elect f_prof non_electing_def\n by auto\n have card_n_no_elect:\n \"\\n f.\n (n < card (defer acc A p) \\ n = card (defer f A p) \\ non_electing f) \\\n elect (loop_comp_helper f m t) A p = {}\"\n using y_acc_no_elect\n by blast\n have\n \"\\f.\n (finite (defer acc A p) \\ defer f A p \\ defer acc A p \\ non_electing f) \\\n elect (loop_comp_helper f m t) A p = {}\"\n using card_n_no_elect psubset_card_mono\n by metis\n hence f0:\n \"(\\ t (acc A p) \\ defer (acc \\ m) A p \\ defer acc A p \\\n finite (defer acc A p)) \\\n \\ t (acc A p) \\\n elect (loop_comp_helper acc m t) A p = {}\"\n using loop_comp_code_helper seq_acc_m_non_elect\n by (metis (no_types))\n obtain set_func :: \"'a set \\ 'a\" where\n \"\\A. (A = {} \\ (\\a. a \\ A)) \\ (A \\ {} \\ set_func A \\ A)\"\n using all_not_in_conv\n by (metis (no_types))\n thus \"x \\ {}\"\n using loop_comp_code_helper no_elect_acc x_in_acc_elect f0\n by (metis (no_types))\n qed\nqed\n\nlemma loop_comp_helper_iter_elim_def_n_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n n_acc_defer_card: \"n = card (defer acc A p)\" and\n n_ge_x: \"n \\ x\" and\n def_card_gt_one: \"card (defer acc A p) > 1\" and\n acc_nonelect: \"non_electing acc\"\n shows \"card (defer (loop_comp_helper acc m t) A p) = x\"\n using n_ge_x def_card_gt_one acc_nonelect n_acc_defer_card\nproof (induct n arbitrary: acc rule: less_induct)\n case (less n)\n have subset:\n \"(card (defer acc A p) > 1 \\ finite_profile A p \\ electoral_module acc) \\\n defer (acc \\ m) A p \\ defer acc A p\"\n using seq_comp_elim_one_red_def_set single_elimination\n by blast\n hence step_reduces_defer_set:\n \"(card (defer acc A p) > 1 \\ finite_profile A p \\ non_electing acc) \\\n defer (acc \\ m) A p \\ defer acc A p\"\n using non_electing_def\n by auto\n thus ?case\n proof cases\n assume term_satisfied: \"t (acc A p)\"\n have \"card (defer_r (loop_comp_helper acc m t A p)) = x\"\n using loop_comp_helper.simps(1) term_satisfied terminate_if_n_left\n by metis\n thus ?case\n by blast\n next\n assume term_not_satisfied: \"\\(t (acc A p))\"\n hence card_not_eq_x: \"card (defer acc A p) \\ x\"\n by (simp add: terminate_if_n_left)\n have rec_step:\n \"(card (defer acc A p) > 1 \\ finite_profile A p \\ non_electing acc) \\\n loop_comp_helper acc m t A p =\n loop_comp_helper (acc \\ m) m t A p\" (*needed for step*)\n using loop_comp_helper.simps(2) non_electing_def def_presv_fin_prof\n step_reduces_defer_set term_not_satisfied\n by metis\n thus ?case\n proof cases\n assume card_too_small:\n \"card (defer acc A p) < x\"\n thus ?thesis\n using not_le card_too_small less.prems(1) less.prems(4) not_le\n by (metis (no_types))\n next\n assume old_card_at_least_x: \"\\(card (defer acc A p) < x)\"\n obtain i where i_is_new_card: \"i = card (defer (acc \\ m) A p)\"\n by blast\n with card_not_eq_x\n have card_too_big:\n \"card (defer acc A p) > x\"\n using nat_neq_iff old_card_at_least_x\n by blast\n hence enough_leftover:\n \"card (defer acc A p) > 1\"\n using x_greater_zero\n by auto\n have \"electoral_module acc \\ (defer acc A p) \\ A\"\n by (simp add: defer_in_alts f_prof)\n hence step_profile:\n \"electoral_module acc \\\n finite_profile (defer acc A p)\n (limit_profile (defer acc A p) p)\"\n using f_prof limit_profile_sound\n by auto\n hence\n \"electoral_module acc \\\n card (defer m (defer acc A p)\n (limit_profile (defer acc A p) p)) =\n card (defer acc A p) - 1\"\n using non_electing_m single_elimination\n single_elim_decr_def_card2 enough_leftover\n by blast\n hence \"electoral_module acc \\ i = card (defer acc A p) - 1\"\n using sequential_composition.simps snd_conv i_is_new_card\n by metis\n hence \"electoral_module acc \\ i \\ x\"\n using card_too_big\n by linarith\n hence new_card_still_big_enough: \"electoral_module acc \\ x \\ i\"\n by blast\n have\n \"electoral_module acc \\ electoral_module m \\\n defer (acc \\ m) A p \\ defer acc A p\"\n using enough_leftover f_prof subset\n by blast\n hence\n \"electoral_module acc \\ electoral_module m \\\n i \\ card (defer acc A p)\"\n using card_mono i_is_new_card step_profile\n by blast\n hence i_geq_x:\n \"electoral_module acc \\ electoral_module m \\ (i = x \\ i > x)\"\n using nat_less_le new_card_still_big_enough\n by blast\n thus ?thesis\n proof cases\n assume new_card_greater_x: \"electoral_module acc \\ i > x\"\n hence \"electoral_module acc \\ 1 < card (defer (acc \\ m) A p)\"\n using x_greater_zero i_is_new_card\n by linarith\n moreover have new_card_still_big_enough2:\n \"electoral_module acc \\ x \\ i\" (* Needed for step *)\n using i_is_new_card new_card_still_big_enough\n by blast\n moreover have\n \"n = card (defer acc A p) \\\n (electoral_module acc \\ i < n)\" (* Needed for step *)\n using subset step_profile enough_leftover f_prof psubset_card_mono\n i_is_new_card\n by blast\n moreover have\n \"electoral_module acc \\\n electoral_module (acc \\ m)\" (* Needed for step *)\n using non_electing_def non_electing_m seq_comp_sound\n by blast\n moreover have non_electing_new:\n \"non_electing acc \\ non_electing (acc \\ m)\"\n by (simp add: non_electing_m)\n ultimately have card_x:\n \"(n = card (defer acc A p) \\ non_electing acc \\\n electoral_module acc) \\\n card (defer (loop_comp_helper (acc \\ m) m t) A p) = x\"\n using less.hyps i_is_new_card new_card_greater_x\n by blast\n have f1: \"loop_comp_helper acc m t A p = loop_comp_helper (acc \\ m) m t A p\"\n using enough_leftover f_prof less.prems(3) rec_step\n by blast\n have \"electoral_module acc\"\n using less.prems(3) non_electing_def\n by blast\n thus ?thesis\n using f1 card_x less.prems(3) less.prems(4)\n by presburger\n next\n assume i_not_gt_x: \"\\(electoral_module acc \\ i > x)\"\n hence \"electoral_module acc \\ electoral_module m \\ i = x\"\n using i_geq_x\n by blast\n hence \"electoral_module acc \\ electoral_module m \\ t ((acc \\ m) A p)\"\n using i_is_new_card terminate_if_n_left\n by blast\n hence\n \"electoral_module acc \\ electoral_module m \\\n card (defer_r (loop_comp_helper (acc \\ m) m t A p)) = x\"\n using loop_comp_helper.simps(1) terminate_if_n_left\n by metis\n thus ?thesis\n using i_not_gt_x dual_order.strict_iff_order i_is_new_card\n loop_comp_helper.simps(1) new_card_still_big_enough\n f_prof rec_step terminate_if_n_left\n enough_leftover less.prems(3)\n by metis\n qed\n qed\n qed\nqed\n\nlemma loop_comp_helper_iter_elim_def_n:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n acc_defers_enough: \"card (defer acc A p) \\ x\" and\n non_electing_acc: \"non_electing acc\"\n shows \"card (defer (loop_comp_helper acc m t) A p) = x\"\n using acc_defers_enough gr_implies_not0 le_neq_implies_less\n less_one linorder_neqE_nat loop_comp_helper.simps(1)\n loop_comp_helper_iter_elim_def_n_helper non_electing_acc\n non_electing_m f_prof single_elimination nat_neq_iff\n terminate_if_n_left x_greater_zero less_le\n by (metis (no_types, lifting))\n\nlemma iter_elim_def_n_helper:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = x))\" and\n x_greater_zero: \"x > 0\" and\n f_prof: \"finite_profile A p\" and\n enough_alternatives: \"card A \\ x\"\n shows \"card (defer (m \\\\<^sub>t) A p) = x\"\nproof cases\n assume \"card A = x\"\n thus ?thesis\n by (simp add: terminate_if_n_left)\nnext\n assume card_not_x: \"\\ card A = x\"\n thus ?thesis\n proof cases\n assume \"card A < x\"\n thus ?thesis\n using enough_alternatives not_le\n by blast\n next\n assume \"\\card A < x\"\n hence card_big_enough_A: \"card A > x\"\n using card_not_x\n by linarith\n hence card_m: \"card (defer m A p) = card A - 1\"\n using non_electing_m f_prof single_elimination\n single_elim_decr_def_card2 x_greater_zero\n by fastforce\n hence card_big_enough_m: \"card (defer m A p) \\ x\"\n using card_big_enough_A\n by linarith\n hence \"(m \\\\<^sub>t) A p = (loop_comp_helper m m t) A p\"\n by (simp add: card_not_x terminate_if_n_left)\n thus ?thesis\n using card_big_enough_m non_electing_m f_prof single_elimination\n terminate_if_n_left x_greater_zero\n loop_comp_helper_iter_elim_def_n\n by metis\n qed\nqed\n\nsubsection \\Composition Rules\\\n\n(*The loop composition preserves defer-lift-invariance.*)\ntheorem loop_comp_presv_def_lift_inv[simp]:\n assumes monotone_m: \"defer_lift_invariance m\"\n shows \"defer_lift_invariance (m \\\\<^sub>t)\"\n unfolding defer_lift_invariance_def\nproof (safe)\n from monotone_m\n have \"electoral_module m\"\n unfolding defer_lift_invariance_def\n by simp\n thus \"electoral_module (m \\\\<^sub>t)\"\n by (simp add: loop_comp_sound)\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n q :: \"'a Profile\" and\n a :: \"'a\"\n assume\n a_in_loop_defer: \"a \\ defer (m \\\\<^sub>t) A p\" and\n lifted_a: \"Profile.lifted A p q a\"\n have defer_lift_loop:\n \"\\ p q a. (a \\ (defer (m \\\\<^sub>t) A p) \\ lifted A p q a) \\\n (m \\\\<^sub>t) A p = (m \\\\<^sub>t) A q\"\n using monotone_m lifted_imp_fin_prof loop_comp_helper_def_lift_inv2\n loop_composition.simps defer_module.simps\n by (metis (full_types))\n show \"(m \\\\<^sub>t) A p = (m \\\\<^sub>t) A q\"\n using a_in_loop_defer lifted_a defer_lift_loop\n by metis\nqed\n\n(*The loop composition preserves the property non-electing.*)\ntheorem loop_comp_presv_non_electing[simp]:\n assumes non_electing_m: \"non_electing m\"\n shows \"non_electing (m \\\\<^sub>t)\"\n unfolding non_electing_def\nproof (safe, simp_all)\n show \"electoral_module (m \\\\<^sub>t)\"\n using loop_comp_sound non_electing_def non_electing_m\n by metis\nnext\n fix\n A :: \"'a set\" and\n p :: \"'a Profile\" and\n x :: \"'a\"\n assume\n fin_A: \"finite A\" and\n prof_A: \"profile A p\" and\n x_elect: \"x \\ elect (m \\\\<^sub>t) A p\"\n show \"False\"\n using def_mod_non_electing loop_comp_presv_non_electing_helper\n non_electing_m empty_iff fin_A loop_comp_code\n non_electing_def prof_A x_elect\n by metis\nqed\n\ntheorem iter_elim_def_n[simp]:\n assumes\n non_electing_m: \"non_electing m\" and\n single_elimination: \"eliminates 1 m\" and\n terminate_if_n_left: \"\\ r. ((t r) \\ (card (defer_r r) = n))\" and\n x_greater_zero: \"n > 0\"\n shows \"defers n (m \\\\<^sub>t)\"\nproof -\n have\n \"\\ A p. finite_profile A p \\ card A \\ n \\\n card (defer (m \\\\<^sub>t) A p) = n\"\n using iter_elim_def_n_helper non_electing_m single_elimination\n terminate_if_n_left x_greater_zero\n by blast\n moreover have \"electoral_module (m \\\\<^sub>t)\"\n using loop_comp_sound eliminates_def single_elimination\n by blast\n thus ?thesis\n by (simp add: calculation defers_def)\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master - Bevor Range/theories/Compositional_Structures/Loop_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2720144392745758}} {"text": "(*****************************************************************************\n * HOL-TestGen --- theorem-prover based test case generation\n * http://www.brucker.ch/projects/hol-testgen/\n * \n * UPF\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2005-2012 ETH Zurich, Switzerland\n * 2008-2015 Achim D. Brucker, Germany\n * 2009-2017 Université Paris-Sud, France\n * 2015-2017 The University of Sheffield, UK \n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n * * Redistributions of source code must retain the above copyright\n * notice, this list of conditions and the following disclaimer.\n *\n * * Redistributions in binary form must reproduce the above\n * copyright notice, this list of conditions and the following\n * disclaimer in the documentation and/or other materials provided\n * with the distribution.\n *\n * * Neither the name of the copyright holders nor the names of its\n * contributors may be used to endorse or promote products derived\n * from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\nsection\\The Core of the Unified Policy Framework (UPF)\\\ntheory\n UPFCore\n imports \n Monads\nbegin\n\n\nsubsection\\Foundation\\\ntext\\\n The purpose of this theory is to formalize a somewhat non-standard view\n on the fundamental concept of a security policy which is worth outlining.\n This view has arisen from prior experience in the modelling of network\n (firewall) policies. Instead of regarding policies as relations on resources,\n sets of permissions, etc., we emphasise the view that a policy is a policy\n decision function that grants or denies access to resources, permissions, etc.\n In other words, we model the concrete function that implements the policy\n decision point in a system, and which represents a \"wrapper\" around the\n business logic. An advantage of this view is that it is compatible\n with many different policy models, enabling a uniform modelling framework to be\n defined. Furthermore, this function is typically a large cascade of nested\n conditionals, using conditions referring to an internal state and security\n contexts of the system or a user. This cascade of conditionals can easily be\n decomposed into a set of test cases similar to transformations used for binary\n decision diagrams (BDD), and motivate equivalence class testing for unit test and \n sequence test scenarios. From the modelling perspective, using \\HOL as\n its input language, we will consequently use the expressive power of its\n underlying functional programming language, including the possibility to\n define higher-order combinators.\n\n In more detail, we model policies as partial functions based on input\n data $\\alpha$ (arguments, system state, security context, ...) to output\n data $\\beta$: \n\\\n\ndatatype '\\ decision = allow '\\ | deny '\\\n\ntype_synonym ('\\,'\\) policy = \"'\\ \\ '\\ decision\" (infixr \"|->\" 0)\n\ntext\\In the following, we introduce a number of shortcuts and alternative notations.\nThe type of policies is represented as:\\\n\ntranslations (type) \"'\\ |-> '\\\" <= (type) \"'\\ \\ '\\ decision\"\ntype_notation \"policy\" (infixr \"\\\" 0) \n\ntext\\... allowing the notation @{typ \"'\\ \\ '\\\"} for the policy type and the\nalternative notations for @{term None} and @{term Some} of the \\HOL library \n@{typ \"'\\ option\"} type:\\\n\nnotation \"None\" (\"\\\")\nnotation \"Some\" (\"\\_\\\" 80)\n\ntext\\Thus, the range of a policy may consist of @{term \"\\accept x\\\"} data,\n of @{term \"\\deny x\\\"} data, as well as @{term \"\\\"} modeling the undefinedness\n of a policy, i.e. a policy is considered as a partial function. Partial \n functions are used since we describe elementary policies by partial system \n behaviour, which are glued together by operators such as function override and \n functional composition. \n\\\n\ntext\\We define the two fundamental sets, the allow-set $Allow$ and the\n deny-set $Deny$ (written $A$ and $D$ set for short), to characterize these\n two main sets of the range of a policy. \n\\\ndefinition Allow :: \"('\\ decision) set\"\nwhere \"Allow = range allow\"\n\ndefinition Deny :: \"('\\ decision) set\"\nwhere \"Deny = range deny\"\n \n\nsubsection\\Policy Constructors\\\ntext\\\n Most elementary policy constructors are based on the\n update operation @{thm [source] \"Fun.fun_upd_def\"} @{thm Fun.fun_upd_def}\n and the maplet-notation @{term \"a(x \\ y)\"} used for @{term \"a(x:=\\y\\)\"}.\n\n Furthermore, we add notation adopted to our problem domain:\\\n\nnonterminal policylets and policylet\n\nsyntax\n \"_policylet1\" :: \"['a, 'a] => policylet\" (\"_ /\\\\<^sub>+/ _\")\n \"_policylet2\" :: \"['a, 'a] => policylet\" (\"_ /\\\\<^sub>-/ _\")\n \"\" :: \"policylet => policylets\" (\"_\")\n \"_Maplets\" :: \"[policylet, policylets] => policylets\" (\"_,/ _\")\n \"_Maplets\" :: \"[policylet, policylets] => policylets\" (\"_,/ _\")\n \"_MapUpd\" :: \"['a |-> 'b, policylets] => 'a |-> 'b\" (\"_/'(_')\" [900,0]900)\n \"_emptypolicy\" :: \"'a |-> 'b\" (\"\\\")\n\ntranslations\n \"_MapUpd m (_Maplets xy ms)\" \\ \"_MapUpd (_MapUpd m xy) ms\"\n \"_MapUpd m (_policylet1 x y)\" \\ \"m(x := CONST Some (CONST allow y))\"\n \"_MapUpd m (_policylet2 x y)\" \\ \"m(x := CONST Some (CONST deny y))\"\n \"\\\" \\ \"CONST Map.empty\" \n\ntext\\Here are some lemmas essentially showing syntactic equivalences:\\\nlemma test: \"\\(x\\\\<^sub>+a, y\\\\<^sub>-b) = \\(x \\\\<^sub>+ a, y \\\\<^sub>- b)\" by simp\n\nlemma test2: \"p(x\\\\<^sub>+a,x\\\\<^sub>-b) = p(x\\\\<^sub>-b)\" by simp\n\ntext\\\n We inherit a fairly rich theory on policy updates from Map here. Some examples are: \n\\\n\nlemma pol_upd_triv1: \"t k = \\allow x\\ \\ t(k\\\\<^sub>+x) = t\"\n by (rule ext) simp\n\nlemma pol_upd_triv2: \"t k = \\deny x\\ \\ t(k\\\\<^sub>-x) = t\"\n by (rule ext) simp\n\nlemma pol_upd_allow_nonempty: \"t(k\\\\<^sub>+x) \\ \\\" \n by simp\n\nlemma pol_upd_deny_nonempty: \"t(k\\\\<^sub>-x) \\ \\\" \n by simp\n\nlemma pol_upd_eqD1 : \"m(a\\\\<^sub>+x) = n(a\\\\<^sub>+y) \\ x = y\"\n by(auto dest: map_upd_eqD1)\n\nlemma pol_upd_eqD2 : \"m(a\\\\<^sub>-x) = n(a\\\\<^sub>-y) \\ x = y\"\n by(auto dest: map_upd_eqD1)\n\nlemma pol_upd_neq1 [simp]: \"m(a\\\\<^sub>+x) \\ n(a\\\\<^sub>-y)\"\n by(auto dest: map_upd_eqD1)\n\n\nsubsection\\Override Operators\\\ntext\\\n Key operators for constructing policies are the override operators. There are four different \n versions of them, with one of them being the override operator from the Map theory. As it is \n common to compose policy rules in a ``left-to-right-first-fit''-manner, that one is taken as \n default, defined by a syntax translation from the provided override operator from the Map \n theory (which does it in reverse order).\n\\\n\nsyntax\n \"_policyoverride\" :: \"['a \\ 'b, 'a \\ 'b] \\ 'a \\ 'b\" (infixl \"\\\" 100)\ntranslations\n \"p \\ q\" \\ \"q ++ p\" \n\n\ntext\\\n Some elementary facts inherited from Map are:\n\\\n\nlemma override_empty: \"p \\ \\ = p\" \n by simp\n\nlemma empty_override: \"\\ \\ p = p\" \n by simp\n\nlemma override_assoc: \"p1 \\ (p2 \\ p3) = (p1 \\ p2) \\ p3\" \n by simp\n\ntext\\\n The following two operators are variants of the standard override. For override\\_A, \n an allow of wins over a deny. For override\\_D, the situation is dual. \n\\\n\ndefinition override_A :: \"['\\\\'\\, '\\\\'\\] \\ '\\\\'\\\" (infixl \"++'_A\" 100) \nwhere \"m2 ++_A m1 = \n (\\x. (case m1 x of \n \\allow a\\ \\ \\allow a\\\n | \\deny a\\ \\ (case m2 x of \\allow b\\ \\ \\allow b\\ \n | _ \\ \\deny a\\)\n | \\ \\ m2 x)\n )\"\n\nsyntax\n \"_policyoverride_A\" :: \"['a \\ 'b, 'a \\ 'b] \\ 'a \\ 'b\" (infixl \"\\\\<^sub>A\" 100)\ntranslations\n \"p \\\\<^sub>A q\" \\ \"p ++_A q\"\n\nlemma override_A_empty[simp]: \"p \\\\<^sub>A \\ = p\" \n by(simp add:override_A_def)\n\nlemma empty_override_A[simp]: \"\\ \\\\<^sub>A p = p\" \n apply (rule ext)\n apply (simp add:override_A_def)\n subgoal for x \n apply (case_tac \"p x\")\n apply (simp_all)\n subgoal for a\n apply (case_tac a)\n apply (simp_all)\n done\n done \n done \n\n\nlemma override_A_assoc: \"p1 \\\\<^sub>A (p2 \\\\<^sub>A p3) = (p1 \\\\<^sub>A p2) \\\\<^sub>A p3\" \n by (rule ext, simp add: override_A_def split: decision.splits option.splits)\n\ndefinition override_D :: \"['\\\\'\\, '\\\\'\\] \\ '\\\\'\\\" (infixl \"++'_D\" 100) \nwhere \"m1 ++_D m2 = \n (\\x. case m2 x of \n \\deny a\\ \\ \\deny a\\\n | \\allow a\\ \\ (case m1 x of \\deny b\\ \\ \\deny b\\\n | _ \\ \\allow a\\)\n | \\ \\ m1 x \n )\"\n \nsyntax\n \"_policyoverride_D\" :: \"['a \\ 'b, 'a \\ 'b] \\ 'a \\ 'b\" (infixl \"\\\\<^sub>D\" 100)\ntranslations\n \"p \\\\<^sub>D q\" \\ \"p ++_D q\"\n\nlemma override_D_empty[simp]: \"p \\\\<^sub>D \\ = p\" \n by(simp add:override_D_def)\n\nlemma empty_override_D[simp]: \"\\ \\\\<^sub>D p = p\" \n apply (rule ext)\n apply (simp add:override_D_def)\n subgoal for x \n apply (case_tac \"p x\", simp_all)\n subgoal for a\n apply (case_tac a, simp_all)\n done\n done\n done\n\nlemma override_D_assoc: \"p1 \\\\<^sub>D (p2 \\\\<^sub>D p3) = (p1 \\\\<^sub>D p2) \\\\<^sub>D p3\"\n apply (rule ext)\n apply (simp add: override_D_def split: decision.splits option.splits)\ndone\n\nsubsection\\Coercion Operators\\\ntext\\\n Often, especially when combining policies of different type, it is necessary to \n adapt the input or output domain of a policy to a more refined context. \n\\ \n\ntext\\\n An analogous for the range of a policy is defined as follows: \n\\\n\ndefinition policy_range_comp :: \"['\\\\'\\, '\\\\'\\] \\ '\\ \\'\\\" (infixl \"o'_f\" 55) \nwhere\n \"f o_f p = (\\x. case p x of\n \\allow y\\ \\ \\allow (f y)\\\n | \\deny y\\ \\ \\deny (f y)\\\n | \\ \\ \\)\"\n\nsyntax\n \"_policy_range_comp\" :: \"['\\\\'\\, '\\\\'\\] \\ '\\ \\'\\\" (infixl \"o\\<^sub>f\" 55)\ntranslations\n \"p o\\<^sub>f q\" \\ \"p o_f q\"\n\nlemma policy_range_comp_strict : \"f o\\<^sub>f \\ = \\\"\n apply (rule ext)\n apply (simp add: policy_range_comp_def)\n done\n\n\ntext\\\n A generalized version is, where separate coercion functions are applied to the result \n depending on the decision of the policy is as follows: \n\\\n\ndefinition range_split :: \"[('\\\\'\\)\\('\\\\'\\),'\\ \\ '\\] \\ '\\ \\ '\\\"\n (infixr \"\\\" 100)\nwhere \"(P) \\ p = (\\x. case p x of \n \\allow y\\ \\ \\allow ((fst P) y)\\\n | \\deny y\\ \\ \\deny ((snd P) y)\\ \n | \\ \\ \\)\"\n\nlemma range_split_strict[simp]: \"P \\ \\ = \\\"\n apply (rule ext)\n apply (simp add: range_split_def)\n done\n\n\nlemma range_split_charn:\n \"(f,g) \\ p = (\\x. case p x of \n \\allow x\\ \\ \\allow (f x)\\\n | \\deny x\\ \\ \\deny (g x)\\ \n | \\ \\ \\)\"\n apply (simp add: range_split_def)\n apply (rule ext)\n subgoal for x \n apply (case_tac \"p x\")\n apply (simp_all)\n subgoal for a\n apply (case_tac \"a\")\n apply (simp_all)\n done\n done\n done\n\ntext\\\n The connection between these two becomes apparent if considering the following lemma:\n\\\n\nlemma range_split_vs_range_compose: \"(f,f) \\ p = f o\\<^sub>f p\"\n by(simp add: range_split_charn policy_range_comp_def)\n \nlemma range_split_id [simp]: \"(id,id) \\ p = p\"\n apply (rule ext)\n apply (simp add: range_split_charn id_def)\n subgoal for x\n apply (case_tac \"p x\")\n apply (simp_all)\n subgoal for a\n apply (case_tac \"a\")\n apply (simp_all)\n done\n done \n done \n\nlemma range_split_bi_compose [simp]: \"(f1,f2) \\ (g1,g2) \\ p = (f1 o g1,f2 o g2) \\ p\"\n apply (rule ext)\n apply (simp add: range_split_charn comp_def)\n subgoal for x \n apply (case_tac \"p x\")\n apply (simp_all)\n subgoal for a\n apply (case_tac \"a\")\n apply (simp_all)\n done\n done\n done\n\ntext\\\n The next three operators are rather exotic and in most cases not used. \n\\\n\ntext \\\n The following is a variant of range\\_split, where the change in the decision depends \n on the input instead of the output. \n\\\n\ndefinition dom_split2a :: \"[('\\ \\ '\\) \\ ('\\ \\'\\),'\\ \\ '\\] \\ '\\ \\ '\\\" (infixr \"\\a\" 100)\nwhere \"P \\a p = (\\x. case p x of \n \\allow y\\ \\ \\allow (the ((fst P) x))\\\n | \\deny y\\ \\ \\deny (the ((snd P) x))\\ \n | \\ \\ \\)\"\n\ndefinition dom_split2 :: \"[('\\ \\ '\\) \\ ('\\ \\'\\),'\\ \\ '\\] \\ '\\ \\ '\\\" (infixr \"\\\" 100)\nwhere \"P \\ p = (\\x. case p x of \n \\allow y\\ \\ \\allow ((fst P) x)\\\n | \\deny y\\ \\ \\deny ((snd P) x)\\\n | \\ \\ \\)\"\n\ndefinition range_split2 :: \"[('\\ \\ '\\) \\ ('\\ \\'\\),'\\ \\ '\\] \\ '\\ \\ ('\\ \\'\\)\" (infixr \"\\2\" 100)\nwhere \"P \\2 p = (\\x. case p x of \n \\allow y\\ \\ \\allow (y,(fst P) x)\\\n | \\deny y\\ \\ \\deny (y,(snd P) x)\\ \n | \\ \\ \\)\"\n\ntext\\\n The following operator is used for transition policies only: a transition policy is transformed \n into a state-exception monad. Such a monad can for example be used for test case generation using \n HOL-Testgen~\\cite{brucker.ea:theorem-prover:2012}.\n\\\n\ndefinition policy2MON :: \"('\\\\'\\ \\ 'o\\'\\) \\ ('\\ \\('o decision,'\\) MON\\<^sub>S\\<^sub>E)\"\nwhere \"policy2MON p = (\\ \\ \\. case p (\\,\\) of\n \\(allow (outs,\\'))\\ \\ \\(allow outs, \\')\\\n | \\(deny (outs,\\'))\\ \\ \\(deny outs, \\')\\\n | \\ \\ \\)\"\n\nlemmas UPFCoreDefs = Allow_def Deny_def override_A_def override_D_def policy_range_comp_def \n range_split_def dom_split2_def map_add_def restrict_map_def\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/UPF/UPFCore.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2719598375416356}} {"text": "section {* UTP variables *}\n\ntheory utp_urel_setup\n imports utp_lift utp_tactics\nbegin\n(*tactics are in utp_tactics*)\nconsts\n useq :: \"'a \\ 'b \\ 'c\" (infixr \";;\" 51)\n uskip :: \"'a\" (\"II\")\n\ndefinition in\\ :: \"('\\, '\\ \\ '\\) uvar\" where\n\"in\\ = \\ lens_get = fst, lens_put = \\ (A, A') v. (v, A') \\\"\n\ndefinition out\\ :: \"('\\, '\\ \\ '\\) uvar\" where\n\"out\\ = \\ lens_get = snd, lens_put = \\ (A, A') v. (A, v) \\\"\n\ndeclare in\\_def [urel_defs]\ndeclare out\\_def [urel_defs]\n\nlemma var_in_alpha [simp]: \"x ;\\<^sub>L in\\ = ivar x\"\n by (simp add: fst_lens_def in\\_def in_var_def)\n\nlemma var_out_alpha [simp]: \"x ;\\<^sub>L out\\ = ovar x\"\n by (simp add: out\\_def out_var_def snd_lens_def)\n\nlemma out_alpha_in_indep [simp]:\n \"out\\ \\ in_var x\" \"in_var x \\ out\\\"\n by (simp_all add: in_var_def out\\_def lens_indep_def fst_lens_def lens_comp_def)\n\nlemma in_alpha_out_indep [simp]:\n \"in\\ \\ out_var x\" \"out_var x \\ in\\\"\n by (simp_all add: in_var_def in\\_def lens_indep_def fst_lens_def lens_comp_def)\n\ntext {* The alphabet of a relation consists of the input and output portions *}\n\nlemma alpha_in_out:\n \"\\ \\\\<^sub>L in\\ +\\<^sub>L out\\\"\n by (metis fst_lens_def fst_snd_id_lens in\\_def lens_equiv_refl out\\_def snd_lens_def)\n\nabbreviation usubst_rel_lift :: \"'\\ usubst \\ ('\\ \\ '\\) usubst\" (\"\\_\\\\<^sub>s\") where\n\"\\\\\\\\<^sub>s \\ \\ \\\\<^sub>s in\\\"\n\nabbreviation usubst_rel_drop :: \"('\\ \\ '\\) usubst \\ '\\ usubst\" (\"\\_\\\\<^sub>s\") where\n\"\\\\\\\\<^sub>s \\ \\ \\\\<^sub>s in\\\"\n\n\nend\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/utp/utp_urel_setup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2719598305067658}} {"text": "section \\Compositional Reasoning\\\n\n(*<*)\ntheory Compositional_Reasoning\nimports BD_Security\nbegin\n(*>*)\n\n\ncontext BD_Security begin\n\n\nsubsection\\Preliminaries\\\n\ndefinition \"disjAll \\s s vl s1 vl1 \\ (\\\\ \\ \\s. \\ s vl s1 vl1)\"\n\nlemma disjAll_simps[simp]:\n \"disjAll {} \\ \\_ _ _ _. False\"\n \"disjAll (insert \\ \\s) \\ \\s vl s1 vl1. \\ s vl s1 vl1 \\ disjAll \\s s vl s1 vl1\"\n unfolding disjAll_def[abs_def] by auto\n\n\nlemma iaction_mono:\nassumes 1: \"iaction \\ s vl s1 vl1\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"iaction \\' s vl s1 vl1\"\nproof-\n obtain a1 ou1 s1' vl1'\n where \"step s1 a1 = (ou1, s1')\" and \"\\ (Trans s1 a1 ou1 s1')\"\n and \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\" and \"\\ \\ (Trans s1 a1 ou1 s1')\"\n and \"\\ s vl s1' vl1'\" using 1 unfolding iaction_def by auto\n thus ?thesis unfolding iaction_def using 2 apply -\n by (rule exI[of _ a1], rule exI[of _ ou1], rule exI[of _ s1'], rule exI[of _ vl1']) auto\nqed\n\nlemma match_mono:\nassumes 1: \"match \\ s s1 vl1 a ou s' vl'\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"match \\' s s1 vl1 a ou s' vl'\"\nproof-\n obtain a1 ou1 s1' vl1'\n where \"\\ s' vl' s1' vl1'\"\n and \"step s1 a1 = (ou1, s1')\"\n and \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\"\n and \"\\ (Trans s a ou s') = \\ (Trans s1 a1 ou1 s1')\"\n and \"(\\ (Trans s a ou s') \\ g (Trans s a ou s') = g (Trans s1 a1 ou1 s1'))\"\n using 1 unfolding match_def by auto\n thus ?thesis unfolding match_def using 2 apply -\n by (rule exI[of _ a1], rule exI[of _ ou1], rule exI[of _ s1'], rule exI[of _ vl1']) auto\nqed\n\nlemma ignore_mono:\nassumes 1: \"ignore \\ s s1 vl1 a ou s' vl'\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"ignore \\' s s1 vl1 a ou s' vl'\"\nusing assms unfolding ignore_def by auto\n\nlemma reaction_mono:\nassumes 1: \"reaction \\ s vl s1 vl1\" and 2: \"\\ s vl s1 vl1. \\ s vl s1 vl1 \\ \\' s vl s1 vl1\"\nshows \"reaction \\' s vl s1 vl1\"\nproof\n fix a ou s' vl'\n assume \"step s a = (ou, s')\" and \"\\ T (Trans s a ou s')\" and \"consume (Trans s a ou s') vl vl'\"\n hence \"match \\ s s1 vl1 a ou s' vl' \\ ignore \\ s s1 vl1 a ou s' vl'\" (is \"?m \\ ?i\")\n using 1 unfolding reaction_def by auto\n thus \"match \\' s s1 vl1 a ou s' vl' \\ ignore \\' s s1 vl1 a ou s' vl'\" (is \"?m' \\ ?i'\")\n proof\n assume ?m from match_mono[OF this 2] show ?thesis by simp\n next\n assume ?i from ignore_mono[OF this 2] show ?thesis by simp\n qed\nqed\n\n\nsubsection\\Decomposition into an arbitrary network of components\\\n\n(* Unwind not to itself, but to a disjunction of other relations: *)\ndefinition unwind_to where\n\"unwind_to \\ \\s \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\ s vl s1 vl1\n \\\n vl \\ [] \\ exit s (hd vl)\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n (vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1\"\n\nlemma unwind_toI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\ s vl s1 vl1\\\n \\\n vl \\ [] \\ exit s (hd vl)\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n (vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1\"\nshows \"unwind_to \\ \\s\"\nusing assms unfolding unwind_to_def by auto\n\n(* Decomposition: *)\nlemma unwind_dec:\nassumes ne: \"\\ \\. \\ \\ \\s \\ next \\ \\ \\s \\ unwind_to \\ (next \\)\"\nshows \"unwind (disjAll \\s)\" (is \"unwind ?\\\")\nproof\n fix s s1 :: 'state and vl vl1 :: \"'value list\"\n assume r: \"reachNT s\" \"reach s1\" and \\: \"?\\ s vl s1 vl1\"\n then obtain \\ where \\: \"\\ \\ \\s\" and 2: \"\\ s vl s1 vl1\" unfolding disjAll_def by auto\n let ?\\s' = \"next \\\" let ?\\' = \"disjAll ?\\s'\"\n have \"(vl \\ [] \\ exit s (hd vl)) \\\n iaction ?\\' s vl s1 vl1 \\\n ((vl \\ [] \\ vl1 = []) \\ reaction ?\\' s vl s1 vl1)\"\n using 2 \\ ne r unfolding unwind_to_def by auto\n moreover have \"\\ s vl s1 vl1. ?\\' s vl s1 vl1 \\ ?\\ s vl s1 vl1\"\n using ne[OF \\] unfolding disjAll_def by auto\n ultimately show\n \"(vl \\ [] \\ exit s (hd vl)) \\\n iaction ?\\ s vl s1 vl1 \\\n ((vl \\ [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\"\n using iaction_mono[of ?\\' _ _ _ _ ?\\] reaction_mono[of ?\\' _ _ _ _ ?\\] by blast\nqed\n\nlemma init_dec:\nassumes \\0: \"\\0 \\ \\s\"\nand i: \"\\ vl vl1. B vl vl1 \\ \\0 istate vl istate vl1\"\nshows \"\\ vl vl1. B vl vl1 \\ disjAll \\s istate vl istate vl1\"\nusing assms unfolding disjAll_def by auto\n\ntheorem unwind_dec_secure:\nassumes \\0: \"\\0 \\ \\s\"\nand i: \"\\ vl vl1. B vl vl1 \\ \\0 istate vl istate vl1\"\nand ne: \"\\ \\. \\ \\ \\s \\ next \\ \\ \\s \\ unwind_to \\ (next \\)\"\nshows secure\nusing init_dec[OF \\0 i] unwind_dec[OF ne] unwind_secure by metis\n\n\nsubsection\\A customization for linear modular reasoning\\\n\n(* The customization assumes that each component unwinds only into itself,\nits successor or an exit component. *)\n\ndefinition unwind_cont where\n\"unwind_cont \\ \\s \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\ s vl s1 vl1\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n ((vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1)\"\n\nlemma unwind_contI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\ s vl s1 vl1\\\n \\\n iaction (disjAll \\s) s vl s1 vl1\n \\\n ((vl \\ [] \\ vl1 = []) \\ reaction (disjAll \\s) s vl s1 vl1)\"\nshows \"unwind_cont \\ \\s\"\nusing assms unfolding unwind_cont_def by auto\n\ndefinition unwind_exit where\n\"unwind_exit \\e \\\n \\ s vl s1 vl1.\n reachNT s \\ reach s1 \\ \\e s vl s1 vl1\n \\\n vl \\ [] \\ exit s (hd vl)\"\n\nlemma unwind_exitI[intro?]:\nassumes\n\"\\ s vl s1 vl1.\n \\reachNT s; reach s1; \\e s vl s1 vl1\\\n \\\n vl \\ [] \\ exit s (hd vl)\"\nshows \"unwind_exit \\e\"\nusing assms unfolding unwind_exit_def by auto\n\nfun allConsec :: \"'a list \\ ('a * 'a) set\" where\n \"allConsec [] = {}\"\n| \"allConsec [a] = {}\"\n| \"allConsec (a # b # as) = insert (a,b) (allConsec (b#as))\"\n\n\nlemma set_allConsec:\nassumes \"\\ \\ set \\s'\" and \"\\s = \\s' ## \\1\"\nshows \"\\ \\2. (\\,\\2) \\ allConsec \\s\"\nusing assms proof (induction \\s' arbitrary: \\s)\n case Nil thus ?case by auto\nnext\n case (Cons \\3 \\s' \\s)\n show ?case proof(cases \"\\ = \\3\")\n case True\n show ?thesis proof(cases \\s')\n case Nil\n show ?thesis unfolding \\\\s = (\\3 # \\s') ## \\1\\ Nil True by (rule exI[of _ \\1]) simp\n next\n case (Cons \\4 \\s'')\n show ?thesis unfolding \\\\s = (\\3 # \\s') ## \\1\\ Cons True by (rule exI[of _ \\4]) simp\n qed\n next\n case False hence \"\\ \\ set \\s'\" using Cons by auto\n then obtain \\2 where \"(\\, \\2) \\ allConsec (\\s' ## \\1)\" using Cons by auto\n thus ?thesis unfolding \\\\s = (\\3 # \\s') ## \\1\\ by (intro exI[of _ \\2]) (cases \\s', auto)\n qed\nqed\n\nlemma allConsec_set:\nassumes \"(\\1,\\2) \\ allConsec \\s\"\nshows \"\\1 \\ set \\s \\ \\2 \\ set \\s\"\nusing assms by (induct \\s rule: allConsec.induct) auto\n\n(* Liniar decomposition: *)\ntheorem unwind_decomp_secure:\nassumes n: \"\\s \\ []\"\nand i: \"\\ vl vl1. B vl vl1 \\ hd \\s istate vl istate vl1\"\nand c: \"\\ \\1 \\2. (\\1,\\2) \\ allConsec \\s \\ unwind_cont \\1 {\\1, \\2, \\e}\"\nand l: \"unwind_cont (last \\s) {last \\s, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\nproof-\n let ?\\0 = \"hd \\s\" let ?\\s = \"insert \\e (set \\s)\"\n define \"next\" where \"next \\1 =\n (if \\1 = \\e then {}\n else if \\1 = last \\s then {\\1,\\e}\n else {\\1,SOME \\2. (\\1,\\2) \\ allConsec \\s,\\e})\" for \\1\n show ?thesis\n proof(rule unwind_dec_secure)\n show \"?\\0 \\ ?\\s\" using n by auto\n next\n fix vl vl1 assume \"B vl vl1\"\n thus \"?\\0 istate vl istate vl1\" by fact\n next\n fix \\\n assume 1: \"\\ \\ ?\\s\" show \"next \\ \\ ?\\s \\ unwind_to \\ (next \\)\"\n proof-\n {assume \"\\ = \\e\"\n hence ?thesis using e unfolding next_def unwind_exit_def unwind_to_def by auto\n }\n moreover\n {assume \"\\ = last \\s\" and \"\\ \\ \\e\"\n hence ?thesis using n l unfolding next_def unwind_cont_def unwind_to_def by simp\n }\n moreover\n {assume 1: \"\\ \\ set \\s\" and 2: \"\\ \\ last \\s\" \"\\ \\ \\e\"\n then obtain \\' \\s' where \\s: \"\\s = \\s' ## \\'\" and \\: \"\\ \\ set \\s'\"\n by (metis (no_types) append_Cons append_assoc in_set_conv_decomp last_snoc rev_exhaust)\n have \"\\ \\2. (\\, \\2) \\ allConsec \\s\" using set_allConsec[OF \\ \\s] .\n hence \"(\\, SOME \\2. (\\, \\2) \\ allConsec \\s) \\ allConsec \\s\" by (metis (lifting) someI_ex)\n hence ?thesis using 1 2 c unfolding next_def unwind_cont_def unwind_to_def\n by simp (metis (no_types) allConsec_set)\n }\n ultimately show ?thesis using 1 by blast\n qed\n qed\nqed\n\nsubsection\\Instances\\\n\ncorollary unwind_decomp3_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand l: \"unwind_cont \\3 {\\3, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3]\" \\e])\nusing assms by auto\n\ncorollary unwind_decomp4_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand c3: \"unwind_cont \\3 {\\3, \\4, \\e}\"\nand l: \"unwind_cont \\4 {\\4, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3, \\4]\" \\e])\nusing assms by auto\n\ncorollary unwind_decomp5_secure:\nassumes\ni: \"\\ vl vl1. B vl vl1 \\ \\1 istate vl istate vl1\"\nand c1: \"unwind_cont \\1 {\\1, \\2, \\e}\"\nand c2: \"unwind_cont \\2 {\\2, \\3, \\e}\"\nand c3: \"unwind_cont \\3 {\\3, \\4, \\e}\"\nand c4: \"unwind_cont \\4 {\\4, \\5, \\e}\"\nand l: \"unwind_cont \\5 {\\5, \\e}\"\nand e: \"unwind_exit \\e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\1, \\2, \\3, \\4, \\5]\" \\e])\nusing assms by auto\n\n\n\n\n(*<*)\n\nend (* context BD_Security *)\n\n\nend\n\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Bounded_Deducibility_Security/Compositional_Reasoning.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.27192803161602486}} {"text": "theory Incredible_Propositional_Tasks\nimports\n Incredible_Completeness\n Incredible_Propositional\nbegin\n\ncontext ND_Rules_Inst begin\nlemma eff_NatRuleI:\n \"nat_rule rule c ants\n \\ entail = (\\ \\ subst s (freshen a c))\n \\ hyps = ((\\ant. ((\\p. subst s (freshen a p)) |`| a_hyps ant |\\| \\ \\ subst s (freshen a (a_conc ant)))) |`| ants)\n \\ (\\ ant f. ant |\\| ants \\ f |\\| \\ \\ freshenLC a ` (a_fresh ant) \\ lconsts f = {})\n \\ (\\ ant. ant |\\| ants \\ freshenLC a ` (a_fresh ant) \\ subst_lconsts s = {})\n \\ eff (NatRule rule) entail hyps\"\n by (drule eff.intros(2)) simp_all\nend\n\ncontext Abstract_Task begin\nlemma natEff_InstI:\n \"rule = (r,c)\n \\ c \\ set (consequent r)\n \\ antec = f_antecedent r\n \\ natEff_Inst rule c antec\"\n by (metis natEff_Inst.intros)\nend\n\ncontext begin\n\nsubsubsection \\Task 1.1\\\n\ntext \\This is the very first task of the Incredible Proof Machine: @{term \"A \\ A\"}\\\n\nabbreviation A :: \"(string,prop_funs) pform\"\n where \"A \\ Fun (Const ''A'') []\"\n\ntext \\First the task is defined as an @{term Abstract_Task}.\\\n\ninterpretation task1_1: Abstract_Task\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n antecedent\n consequent\n prop_rules\n \"[A]\"\n \"[A]\"\nby unfold_locales simp\n\ntext \\Then we show, that this task has a proof within our formalization of natural deduction\n by giving a concrete proof tree.\\\n\nlemma \"task1_1.solved\"\n unfolding task1_1.solved_def\napply clarsimp\napply (rule_tac x=\"{|A|}\" in exI)\napply clarsimp\napply (rule_tac x=\"Node ({|A|} \\ A, Axiom) {||}\" in exI)\napply clarsimp\napply (rule conjI)\n apply (rule task1_1.wf)\n apply (solves clarsimp)\n apply clarsimp\n apply (rule task1_1.eff.intros(1))\n apply (solves simp)\n apply (solves clarsimp)\nby (auto intro: tfinite.intros)\n\n\nprint_locale Vertex_Graph\ninterpretation task1_1: Vertex_Graph task1_1.nodes task1_1.inPorts task1_1.outPorts \"{|0::nat,1|}\"\n \"undefined(0 := Assumption A, 1 := Conclusion A)\"\n.\n\nprint_locale Pre_Port_Graph\ninterpretation task1_1: Pre_Port_Graph task1_1.nodes task1_1.inPorts task1_1.outPorts \"{|0::nat,1|}\"\n \"undefined(0 := Assumption A, 1 := Conclusion A)\"\n \"{((0,Reg A),(1,plain_ant A))}\"\n.\n\nprint_locale Instantiation\ninterpretation task1_1: Instantiation\n task1_1.inPorts\n task1_1.outPorts\n \"undefined(0 := Assumption A, 1 := Conclusion A)\"\n task1_1.hyps\n task1_1.nodes\n \"{((0,Reg A),(1,plain_ant A))}\"\n \"{|0::nat,1|}\"\n task1_1.labelsIn\n task1_1.labelsOut\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n \"id\"\n \"undefined\"\nby unfold_locales simp\n\ndeclare One_nat_def [simp del]\n\nlemma path_one_edge[simp]:\n \"task1_1.path v1 v2 pth \\\n (v1 = 0 \\ v2 = 1 \\ pth = [((0,Reg A),(1,plain_ant A))] \\\n pth = [] \\ v1 = v2)\"\n apply (cases pth)\n apply (auto simp add: task1_1.path_cons_simp')\n apply (rename_tac list, case_tac list, auto simp add: task1_1.path_cons_simp')+\n done\n\ntext \\Finally we can also show that there is a proof graph for this task.\\\n\ninterpretation Tasked_Proof_Graph\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n antecedent\n consequent\n prop_rules\n \"[A]\"\n \"[A]\"\n \"{|0::nat,1|}\"\n \"undefined(0 := Assumption A, 1 := Conclusion A)\"\n \"{((0,Reg A),(1,plain_ant A))}\"\n \"id\"\n \"undefined\"\napply unfold_locales\n apply (solves simp)\n apply (solves clarsimp)\n apply (solves clarsimp)\n apply (solves clarsimp)\n apply (solves fastforce)\n apply (solves fastforce)\n apply (solves \\clarsimp simp add: task1_1.labelAtOut_def task1_1.labelAtIn_def\\)\n apply (solves clarsimp)\napply (solves clarsimp)\ndone\n\nsubsubsection \\Task 2.11\\\n\ntext \\This is a slightly more interesting task as it involves both our connectives: @{term \"P \\ Q \\ R \\ P \\ (Q \\ R)\"}\\\n\nabbreviation B :: \"(string,prop_funs) pform\"\n where \"B \\ Fun (Const ''B'') []\"\nabbreviation C :: \"(string,prop_funs) pform\"\n where \"C \\ Fun (Const ''C'') []\"\n\ninterpretation task2_11: Abstract_Task\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n antecedent\n consequent\n prop_rules\n \"[Fun imp [Fun and [A,B],C]]\"\n \"[Fun imp [A,Fun imp [B,C]]]\"\nby unfold_locales simp_all\n\nabbreviation \"n_andI \\ task2_11.n_rules !! 0\"\nabbreviation \"n_andE1 \\ task2_11.n_rules !! 1\"\nabbreviation \"n_andE2 \\ task2_11.n_rules !! 2\"\nabbreviation \"n_impI \\ task2_11.n_rules !! 3\"\nabbreviation \"n_impE \\ task2_11.n_rules !! 4\"\n\nlemma n_andI [simp]: \"n_andI = (andI, Fun and [X,Y])\"\n unfolding task2_11.n_rules_def by (simp add: prop_rules_def)\nlemma n_andE1 [simp]: \"n_andE1 = (andE, X)\"\n unfolding task2_11.n_rules_def One_nat_def by (simp add: prop_rules_def)\nlemma n_andE2 [simp]: \"n_andE2 = (andE, Y)\"\n unfolding task2_11.n_rules_def numeral_2_eq_2 by (simp add: prop_rules_def)\nlemma n_impI [simp]: \"n_impI = (impI, Fun imp [X,Y])\"\n unfolding task2_11.n_rules_def numeral_3_eq_3 by (simp add: prop_rules_def)\nlemma n_impE [simp]: \"n_impE = (impE, Y)\"\nproof -\n have \"n_impE = task2_11.n_rules !! Suc 3\" by simp\n also have \"... = (impE, Y)\"\n unfolding task2_11.n_rules_def numeral_3_eq_3 by (simp add: prop_rules_def)\n finally show ?thesis .\nqed\n\n\nlemma subst_Var_eq_id [simp]: \"subst Var = id\"\n by (rule ext) (induct_tac x; auto simp: map_idI)\n\nlemma xy_update: \"f = undefined(''X'' := x, ''Y'' := y) \\ x = f ''X'' \\ y = f ''Y''\" by force\nlemma y_update: \"f = undefined(''Y'':=y) \\ y = f ''Y''\" by force\n\ndeclare snth.simps(1) [simp del]\n\ntext \\By interpreting @{term Solved_Task} we show that there is a proof tree for the task.\n We get the existence of the proof graph for free by using the completeness theorem.\\\n\ninterpretation task2_11: Solved_Task\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n antecedent\n consequent\n prop_rules\n \"[Fun imp [Fun and [A,B],C]]\"\n \"[Fun imp [A,Fun imp [B,C]]]\"\napply unfold_locales\n unfolding task2_11.solved_def\napply clarsimp\napply (rule_tac x=\"{|Fun imp [Fun and [A,B],C]|}\" in exI)\napply clarsimp\n\\ \\The actual proof tree for this task.\\\napply (rule_tac x=\"Node ({|Fun imp [Fun and [A, B], C]|} \\ Fun imp [A, Fun imp [B, C]],NatRule n_impI)\n {|Node ({|Fun imp [Fun and [A, B], C], A|} \\ Fun imp [B,C],NatRule n_impI)\n {|Node ({|Fun imp [Fun and [A, B], C], A, B|} \\ C,NatRule n_impE)\n {|Node ({|Fun imp [Fun and [A, B], C], A, B|} \\ Fun imp [Fun and [A,B], C],Axiom) {||},\n Node ({|Fun imp [Fun and [A, B], C], A, B|} \\ Fun and [A,B],NatRule n_andI) \n {|Node ({|Fun imp [Fun and [A, B], C], A, B|} \\ A,Axiom) {||},\n Node ({|Fun imp [Fun and [A, B], C], A, B|} \\ B,Axiom) {||}\n |}\n |}\n |}\n |}\" in exI)\napply clarsimp\napply (rule conjI)\n\n apply (rule task1_1.wf)\n apply (solves \\clarsimp; metis n_impI snth_smap snth_sset\\)\n apply clarsimp\n apply (rule task1_1.eff_NatRuleI [unfolded propositional.freshen_def, simplified]) apply simp_all[4]\n apply (rule task2_11.natEff_InstI)\n apply (solves simp)\n apply (solves simp)\n apply (solves simp)\n apply (intro conjI; simp; rule xy_update)\n apply (solves simp)\n apply (solves \\fastforce simp: propositional.f_antecedent_def\\)\n apply clarsimp\n\n apply (rule task1_1.wf)\n apply (solves \\clarsimp; metis n_impI snth_smap snth_sset\\)\n apply clarsimp\n apply (rule task1_1.eff_NatRuleI [unfolded propositional.freshen_def, simplified]) apply simp_all[4]\n apply (rule task2_11.natEff_InstI)\n apply (solves simp)\n apply (solves simp)\n apply (solves simp)\n apply (intro conjI; simp; rule xy_update)\n apply (solves simp)\n apply (solves \\fastforce simp: propositional.f_antecedent_def\\)\n apply clarsimp\n\n apply (rule task1_1.wf)\n apply (solves \\clarsimp; metis n_impE snth_smap snth_sset\\)\n apply clarsimp\n apply (rule task1_1.eff_NatRuleI [unfolded propositional.freshen_def, simplified, where s=\"undefined(''Y'':=C,''X'':=Fun and [A,B])\"]) apply simp_all[4]\n apply (rule task2_11.natEff_InstI)\n apply (solves simp)\n apply (solves simp)\n apply (solves simp)\n apply (solves \\intro conjI; simp\\)\n apply (solves \\simp add: propositional.f_antecedent_def\\)\n apply (erule disjE)\n\n apply (auto intro: task1_1.wf intro!: task1_1.eff.intros(1))[1]\n\n apply (rule task1_1.wf)\n apply (solves \\clarsimp; metis n_andI snth_smap snth_sset\\)\n apply clarsimp\n apply (rule task1_1.eff_NatRuleI [unfolded propositional.freshen_def, simplified]) apply simp_all[4]\n apply (rule task2_11.natEff_InstI)\n apply (solves simp)\n apply (solves simp)\n apply (solves simp)\n apply (intro conjI; simp; rule xy_update)\n apply (solves simp)\n apply (solves \\simp add: propositional.f_antecedent_def\\)\n apply clarsimp\n\n apply (erule disjE)\n apply (solves \\rule task1_1.wf; auto intro: task1_1.eff.intros(1)\\)\n apply (solves \\rule task1_1.wf; auto intro: task1_1.eff.intros(1)\\)\n \nby (rule tfinite.intros; auto)+\n\n\ninterpretation Tasked_Proof_Graph\n \"curry (SOME f. bij f):: nat \\ string \\ string\"\n \"\\_. id\"\n \"\\_. {}\"\n \"closed :: (string, prop_funs) pform \\ bool\"\n subst\n \"\\_. {}\"\n \"\\_. id\"\n \"Var undefined\"\n antecedent\n consequent\n prop_rules\n \"[Fun imp [Fun and [A,B],C]]\"\n \"[Fun imp [A,Fun imp [B,C]]]\"\n task2_11.vertices \n task2_11.nodeOf \n task2_11.edges\n task2_11.vidx\n task2_11.inst\nby unfold_locales\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Incredible_Proof_Machine/Incredible_Propositional_Tasks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.27189490134432603}} {"text": "(* Author: Andreas Lochbihler\n Maintainer: Andreas Lochbihler\n*)\nheader {* Manual construction of a resumption codatatype *}\n\ntheory Resumption imports \n \"~~/src/HOL/Library/Old_Datatype\"\nbegin\n\ntext {*\n This theory defines the following codatatype:\n\n\\begin{verbatim}\ncodatatype ('a,'b,'c,'d) resumption =\n Terminal 'a\n | Linear 'b \"('a,'b,'c,'d) resumption\"\n | Branch 'c \"'d => ('a,'b,'c,'d) resumption\"\n\\end{verbatim}\n\n*}\n\nsubsection {* Auxiliary definitions and lemmata similar to @{theory Old_Datatype} *}\n\nlemma Lim_mono: \"(\\d. rs d \\ rs' d) \\ Old_Datatype.Lim rs \\ Old_Datatype.Lim rs'\"\nby(simp add: Lim_def) blast\n\nlemma Lim_UN1: \"Old_Datatype.Lim (\\x. \\y. f x y) = (\\y. Old_Datatype.Lim (\\x. f x y))\"\nby(simp add: Old_Datatype.Lim_def) blast\n\ntext {*\n Inverse for @{term \"Old_Datatype.Lim\"} like @{term \"Old_Datatype.Split\"} and @{term \"Old_Datatype.Case\"}\n for @{term \"Old_Datatype.Scons\"} and @{term \"In0\"}/@{term \"In1\"}\n*}\n\ndefinition DTBranch :: \"(('b \\ ('a, 'b) Old_Datatype.dtree) \\ 'c) \\ ('a, 'b) Old_Datatype.dtree \\ 'c\"\nwhere \"DTBranch f M = (THE u. \\x. M = Old_Datatype.Lim x \\ u = f x)\"\n\nlemma DTBranch_Lim [simp]: \"DTBranch f (Old_Datatype.Lim M) = f M\"\nby(auto simp add: DTBranch_def dest: Lim_inject)\n\ntext {* Lemmas for @{term Old_Datatype.ntrunc} and @{term \"Old_Datatype.Lim\"} *}\n\nlemma ndepth_Push_Node_Inl_aux:\n \"case_nat (Inl n) f k = Inr 0 \\ Suc (LEAST x. f x = Inr 0) <= k\"\napply (induct \"k\", auto)\napply (erule Least_le)\ndone\n\nlemma ndepth_Push_Node_Inl:\n \"ndepth (Push_Node (Inl a) n) = Suc (ndepth n)\"\nusing Rep_Node[of n, unfolded Node_def]\napply(simp add: ndepth_def Push_Node_def Abs_Node_inverse[OF Node_Push_I[OF Rep_Node]])\napply(simp add: Push_def split_beta)\napply(rule Least_equality)\napply(auto elim: LeastI intro: ndepth_Push_Node_Inl_aux)\ndone\n\nlemma ntrunc_Lim [simp]: \"ntrunc (Suc k) (Old_Datatype.Lim rs) = Old_Datatype.Lim (\\x. ntrunc k (rs x))\"\nunfolding Lim_def ntrunc_def\napply(rule equalityI)\napply clarify\napply(auto simp add: ndepth_Push_Node_Inl)\ndone\n\nsubsection {* Definition for the codatatype universe *}\n\ntext {* Constructors *}\n\ndefinition TERMINAL :: \"'a \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\nwhere \"TERMINAL a = In0 (Old_Datatype.Leaf (Inr (Inr a)))\"\n\ndefinition LINEAR :: \"'b \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\n where \"LINEAR b r = In1 (In0 (Scons (Old_Datatype.Leaf (Inr (Inl b))) r))\"\n\ndefinition BRANCH :: \"'c \\ ('d \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree) \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\n where \"BRANCH c rs = In1 (In1 (Scons (Old_Datatype.Leaf (Inl c)) (Old_Datatype.Lim rs)))\"\n\ntext {* case operator *}\n\ndefinition case_RESUMPTION :: \"('a \\ 'e) \\ ('b \\ (('c + 'b + 'a, 'd) Old_Datatype.dtree) \\ 'e) \\ ('c \\ ('d \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree) \\ 'e) \\ ('c + 'b + 'a, 'd) Old_Datatype.dtree \\ 'e\"\nwhere \n \"case_RESUMPTION t l br =\n Old_Datatype.Case (t o inv (Old_Datatype.Leaf o Inr o Inr))\n (Old_Datatype.Case (Old_Datatype.Split (\\x. l (inv (Old_Datatype.Leaf o Inr o Inl) x)))\n (Old_Datatype.Split (\\x. DTBranch (br (inv (Old_Datatype.Leaf o Inl) x)))))\"\n\n\n\nlemma case_RESUMPTION_simps [simp]:\n shows case_RESUMPTION_TERMINAL: \"case_RESUMPTION t l br (TERMINAL a) = t a\"\n and case_RESUMPTION_LINEAR: \"case_RESUMPTION t l br (LINEAR b r) = l b r\"\n and case_RESUMPTION_BRANCH: \"case_RESUMPTION t l br (BRANCH c rs) = br c rs\"\napply(simp_all add: case_RESUMPTION_def TERMINAL_def LINEAR_def BRANCH_def o_def)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\ndone\n\nlemma LINEAR_mono: \"r \\ r' \\ LINEAR b r \\ LINEAR b r'\"\nby(simp add: LINEAR_def In1_mono In0_mono Scons_mono)\n\nlemma BRANCH_mono: \"(\\d. rs d \\ rs' d) \\ BRANCH c rs \\ BRANCH c rs'\"\nby(simp add: BRANCH_def In1_mono Scons_mono Lim_mono)\n\nlemma LINEAR_UN: \"LINEAR b (\\x. f x) = (\\x. LINEAR b (f x))\"\nby (simp add: LINEAR_def In1_UN1 In0_UN1 Scons_UN1_y)\n\nlemma BRANCH_UN: \"BRANCH b (\\d. \\x. f d x) = (\\x. BRANCH b (\\d. f d x))\"\nby (simp add: BRANCH_def Lim_UN1 In1_UN1 In0_UN1 Scons_UN1_y)\n\ntext {* The codatatype universe *}\n\ncoinductive_set resumption :: \"('c + 'b + 'a, 'd) Old_Datatype.dtree set\"\nwhere\nresumption_TERMINAL:\n \"TERMINAL a \\ resumption\"\n| resumption_LINEAR:\n \"r \\ resumption \\ LINEAR b r \\ resumption\"\n| resumption_BRANCH:\n \"(\\d. rs d \\ resumption) \\ BRANCH c rs \\ resumption\"\n\nsubsection {* Definition of the codatatype as a type *}\n\ntypedef ('a,'b,'c,'d) resumption = \"resumption :: ('c + 'b + 'a, 'd) Old_Datatype.dtree set\"\nproof\n show \"TERMINAL undefined \\ ?resumption\" by(blast intro: resumption.intros)\nqed\n\ntext {* Constructors *}\n\ndefinition Terminal :: \"'a \\ ('a,'b,'c,'d) resumption\"\nwhere \"Terminal a = Abs_resumption (TERMINAL a)\"\n\ndefinition Linear :: \"'b \\ ('a,'b,'c,'d) resumption \\ ('a,'b,'c,'d) resumption\"\nwhere \"Linear b r = Abs_resumption (LINEAR b (Rep_resumption r))\"\n\ndefinition Branch :: \"'c \\ ('d \\ ('a,'b,'c,'d) resumption) \\ ('a,'b,'c,'d) resumption\"\nwhere \"Branch c rs = Abs_resumption (BRANCH c (\\d. Rep_resumption (rs d)))\"\n\nlemma [iff]:\n shows Terminal_not_Linear: \"Terminal a \\ Linear b r\"\n and Linear_not_Terminal: \"Linear b R \\ Terminal a\"\n and Termina_not_Branch: \"Terminal a \\ Branch c rs\"\n and Branch_not_Terminal: \"Branch c rs \\ Terminal a\"\n and Linear_not_Branch: \"Linear b r \\ Branch c rs\"\n and Branch_not_Linear: \"Branch c rs \\ Linear b r\"\n and Terminal_inject: \"Terminal a = Terminal a' \\ a = a'\"\n and Linear_inject: \"Linear b r = Linear b' r' \\ b = b' \\ r = r'\"\n and Branch_inject: \"Branch c rs = Branch c' rs' \\ c = c' \\ rs = rs'\"\napply(auto simp add: Terminal_def Linear_def Branch_def simp add: Rep_resumption resumption.intros Abs_resumption_inject Rep_resumption_inject)\napply(subst (asm) fun_eq_iff, auto simp add: Rep_resumption_inject)\ndone\n\nlemma Rep_resumption_constructors:\n shows Rep_resumption_Terminal: \"Rep_resumption (Terminal a) = TERMINAL a\"\n and Rep_resumption_Linear: \"Rep_resumption (Linear b r) = LINEAR b (Rep_resumption r)\"\n and Rep_resumption_Branch: \"Rep_resumption (Branch c rs) = BRANCH c (\\d. Rep_resumption (rs d))\"\nby(simp_all add: Terminal_def Linear_def Branch_def Abs_resumption_inverse resumption.intros Rep_resumption)\n\ntext {* Case operator *}\n\ndefinition case_resumption :: \"('a \\ 'e) \\ ('b \\ ('a,'b,'c,'d) resumption \\ 'e) \\\n ('c \\ ('d \\ ('a,'b,'c,'d) resumption) \\ 'e) \\ ('a,'b,'c,'d) resumption \\ 'e\"\nwhere [code del]:\n \"case_resumption t l br r =\n case_RESUMPTION t (\\b r. l b (Abs_resumption r)) (\\c rs. br c (\\d. Abs_resumption (rs d))) (Rep_resumption r)\"\n\nlemma case_resumption_simps [simp, code]:\n shows case_resumption_Terminal: \"case_resumption t l br (Terminal a) = t a\"\n and case_resumption_Linear: \"case_resumption t l br (Linear b r) = l b r\"\n and case_resumption_Branch: \"case_resumption t l br (Branch c rs) = br c rs\"\nby(simp_all add: Terminal_def Linear_def Branch_def case_resumption_def Abs_resumption_inverse resumption.intros Rep_resumption Rep_resumption_inverse)\n\ndeclare [[case_translation case_resumption Terminal Linear Branch]]\n\nlemma case_resumption_cert:\n assumes \"CASE \\ case_resumption t l br\"\n shows \"(CASE (Terminal a) \\ t a) &&& (CASE (Linear b r) \\ l b r) &&& (CASE (Branch c rs) \\ br c rs)\"\nusing assms by simp_all\n\ncode_datatype Terminal Linear Branch\n\nsetup {*\n Code.add_case @{thm case_resumption_cert}\n*}\n\nsetup {*\n Nitpick.register_codatatype @{typ \"('a,'b,'c,'d) resumption\"} @{const_name case_resumption}\n (map dest_Const [@{term Terminal}, @{term Linear}, @{term Branch}])\n*}\n\nlemma resumption_exhaust [cases type: resumption]:\n obtains (Terminal) a where \"x = Terminal a\"\n | (Linear) b r where \"x = Linear b r\"\n | (Branch) c rs where \"x = Branch c rs\"\nproof(cases x)\n case (Abs_resumption y)\n note [simp] = `x = Abs_resumption y`\n from `y \\ resumption` show thesis\n proof(cases rule: resumption.cases)\n case resumption_TERMINAL thus ?thesis\n by -(rule Terminal, simp add: Terminal_def)\n next\n case (resumption_LINEAR r b) \n from `r \\ resumption` have \"Rep_resumption (Abs_resumption r) = r\"\n by(simp add: Abs_resumption_inverse)\n hence \"y = LINEAR b (Rep_resumption (Abs_resumption r))\"\n using `y = LINEAR b r` by simp\n thus ?thesis by -(rule Linear, simp add: Linear_def)\n next\n case (resumption_BRANCH rs c)\n from `\\d. rs d \\ resumption`\n have eq: \"rs = (\\d. Rep_resumption (Abs_resumption (rs d)))\"\n by(subst Abs_resumption_inverse) blast+\n show ?thesis using `y = BRANCH c rs` \n by -(rule Branch, simp add: Branch_def, subst eq, simp)\n qed\nqed\n\nlemma resumption_split:\n \"P (case_resumption t l br r) \\ \n (\\a. r = Terminal a \\ P (t a)) \\\n (\\b r'. r = Linear b r' \\ P (l b r')) \\\n (\\c rs. r = Branch c rs \\ P (br c rs))\"\nby(cases r) simp_all\n\nlemma resumption_split_asm:\n \"P (case_resumption t l br r) \\\n \\ ((\\a. r = Terminal a \\ \\ P (t a)) \\\n (\\b r'. r = Linear b r' \\ \\ P (l b r')) \\\n (\\c rs. r = Branch c rs \\ \\ P (br c rs)))\"\nby(cases r) simp_all\n\nlemmas resumption_splits = resumption_split resumption_split_asm\n\n\ntext {* corecursion operator *}\n\ndatatype (dead 'a, dead 'b, dead 'c, dead 'd, dead 'e) resumption_corec =\n Terminal_corec 'a\n | Linear_corec 'b 'e\n | Branch_corec 'c \"'d \\ 'e\"\n | Resumption_corec \"('a, 'b, 'c, 'd) resumption\"\n\nprimrec RESUMPTION_corec_aux :: \"nat \\ ('e \\ ('a,'b,'c,'d,'e) resumption_corec) \\ 'e \\ ('c + 'b + 'a,'d) Old_Datatype.dtree\"\nwhere\n \"RESUMPTION_corec_aux 0 f e = {}\"\n| \"RESUMPTION_corec_aux (Suc n) f e =\n (case f e of Terminal_corec a \\ TERMINAL a\n | Linear_corec b e' \\ LINEAR b (RESUMPTION_corec_aux n f e')\n | Branch_corec c es \\ BRANCH c (\\d. RESUMPTION_corec_aux n f (es d))\n | Resumption_corec r \\ Rep_resumption r)\"\n\ndefinition RESUMPTION_corec :: \"('e \\ ('a,'b,'c,'d,'e) resumption_corec) \\ 'e \\ ('c + 'b + 'a,'d) Old_Datatype.dtree\"\nwhere\n \"RESUMPTION_corec f e = (\\n. RESUMPTION_corec_aux n f e)\"\n\nlemma RESUMPTION_corec [nitpick_simp]:\n \"RESUMPTION_corec f e =\n (case f e of Terminal_corec a \\ TERMINAL a\n | Linear_corec b e' \\ LINEAR b (RESUMPTION_corec f e')\n | Branch_corec c es \\ BRANCH c (\\d. RESUMPTION_corec f (es d))\n | Resumption_corec r \\ Rep_resumption r)\"\n (is \"?lhs = ?rhs\")\nproof\n show \"?lhs \\ ?rhs\" unfolding RESUMPTION_corec_def\n proof(rule UN_least)\n fix n\n show \"RESUMPTION_corec_aux n f e\n \\ (case f e of Terminal_corec a \\ TERMINAL a\n | Linear_corec b e' \\ LINEAR b (\\n. RESUMPTION_corec_aux n f e')\n | Branch_corec c es \\ BRANCH c (\\d. \\n. RESUMPTION_corec_aux n f (es d))\n | Resumption_corec r \\ Rep_resumption r)\"\n apply(cases n, simp_all split: resumption_corec.split)\n by(rule conjI strip LINEAR_mono[OF UN_upper] BRANCH_mono[OF UN_upper] UNIV_I)+\n qed\nnext\n show \"?rhs \\ ?lhs\" unfolding RESUMPTION_corec_def\n apply(simp split: resumption_corec.split add: LINEAR_UN BRANCH_UN)\n by safe(rule_tac a=\"Suc ?n\" in UN_I, rule UNIV_I, simp)+\nqed\n\nlemma RESUMPTION_corec_type: \"RESUMPTION_corec f e \\ resumption\"\nproof -\n have \"\\x. RESUMPTION_corec f e = RESUMPTION_corec f x\" by blast\n thus ?thesis\n proof coinduct\n case (resumption x)\n then obtain e where x: \"x = RESUMPTION_corec f e\" by blast\n thus ?case \n proof(cases \"f e\")\n case (Resumption_corec r)\n thus ?thesis using x\n by(cases r)(simp_all add: RESUMPTION_corec Rep_resumption_constructors Rep_resumption)\n qed(auto simp add: RESUMPTION_corec)\n qed\nqed\n\ntext {* corecursion operator for the resumption type *}\n\ndefinition resumption_corec :: \"('e \\ ('a,'b,'c,'d,'e) resumption_corec) \\ 'e \\ ('a,'b,'c,'d) resumption\"\nwhere\n \"resumption_corec f e = Abs_resumption (RESUMPTION_corec f e)\"\n\nlemma resumption_corec:\n \"resumption_corec f e =\n (case f e of Terminal_corec a \\ Terminal a\n | Linear_corec b e' \\ Linear b (resumption_corec f e')\n | Branch_corec c es \\ Branch c (\\d. resumption_corec f (es d))\n | Resumption_corec r \\ r)\"\nunfolding resumption_corec_def\napply(subst RESUMPTION_corec)\napply(auto split: resumption_corec.splits simp add: Terminal_def Linear_def Branch_def RESUMPTION_corec_type Abs_resumption_inverse Rep_resumption_inverse)\ndone\n\ntext {* Equality as greatest fixpoint *}\n\ncoinductive Eq_RESUMPTION :: \"('c+'b+'a, 'd) Old_Datatype.dtree \\ ('c+'b+'a, 'd) Old_Datatype.dtree \\ bool\"\nwhere\n EqTERMINAL: \"Eq_RESUMPTION (TERMINAL a) (TERMINAL a)\"\n| EqLINEAR: \"Eq_RESUMPTION r r' \\ Eq_RESUMPTION (LINEAR b r) (LINEAR b r')\"\n| EqBRANCH: \"(\\d. Eq_RESUMPTION (rs d) (rs' d)) \\ Eq_RESUMPTION (BRANCH c rs) (BRANCH c rs')\"\n\n\n\nlemma Eq_RESUMPTION_refl:\n assumes \"r \\ resumption\"\n shows \"Eq_RESUMPTION r r\"\nproof -\n def r' == r\n with assms have \"r = r' \\ r \\ resumption\" by auto\n thus \"Eq_RESUMPTION r r'\"\n proof(coinduct)\n case (Eq_RESUMPTION r r')\n hence [simp]: \"r = r'\" and \"r \\ resumption\" by auto\n from `r \\ resumption` show ?case\n by(cases rule: resumption.cases) auto\n qed\nqed\n\nlemma Eq_RESUMPTION_into_resumption:\n assumes \"Eq_RESUMPTION r r\"\n shows \"r \\ resumption\"\nusing assms\nproof(coinduct)\n case resumption thus ?case by cases auto\nqed\n\nlemma Eq_RESUMPTION_eq:\n \"Eq_RESUMPTION r r' \\ r = r' \\ r \\ resumption\"\nproof(rule iffI)\n assume \"Eq_RESUMPTION r r'\"\n hence \"\\k. ntrunc k r = ntrunc k r'\" by(rule Eq_RESUMPTION_implies_ntrunc_equality)\n hence \"r = r'\" by(rule ntrunc_equality)\n moreover with `Eq_RESUMPTION r r'` have \"r \\ resumption\"\n by(auto intro: Eq_RESUMPTION_into_resumption)\n ultimately show \"r = r' \\ r \\ resumption\" ..\nnext\n assume \"r = r' \\ r \\ resumption\"\n thus \"Eq_RESUMPTION r r'\" by(blast intro: Eq_RESUMPTION_refl)\nqed\n\nlemma Eq_RESUMPTION_I [consumes 1, case_names Eq_RESUMPTION, case_conclusion Eq_RESUMPTION EqTerminal EqLinear EqBranch]:\n assumes \"X r r'\"\n and step: \"\\r r'. X r r' \\\n (\\a. r = TERMINAL a \\ r' = TERMINAL a) \\\n (\\R R' b. r = LINEAR b R \\ r' = LINEAR b R' \\ (X R R' \\ Eq_RESUMPTION R R')) \\\n (\\rs rs' c. r = BRANCH c rs \\ r' = BRANCH c rs' \\ (\\d. X (rs d) (rs' d) \\ Eq_RESUMPTION (rs d) (rs' d)))\"\n shows \"r = r'\"\nproof -\n from `X r r'` have \"Eq_RESUMPTION r r'\"\n by(coinduct)(rule step)\n thus ?thesis by(simp add: Eq_RESUMPTION_eq)\nqed\n\nlemma resumption_equalityI [consumes 1, case_names Eq_resumption, case_conclusion Eq_resumption EqTerminal EqLinear EqBranch]:\n assumes \"X r r'\"\n and step: \"\\r r'. X r r' \\\n (\\a. r = Terminal a \\ r' = Terminal a) \\\n (\\R R' b. r = Linear b R \\ r' = Linear b R' \\ (X R R' \\ R = R')) \\\n (\\rs rs' c. r = Branch c rs \\ r' = Branch c rs' \\ (\\d. X (rs d) (rs' d) \\ rs d = rs' d))\"\n shows \"r = r'\"\nproof -\n def M == \"Rep_resumption r\" and N == \"Rep_resumption r'\"\n with `X r r'` have \"\\r r'. M = Rep_resumption r \\ N = Rep_resumption r' \\ X r r'\" by blast\n hence \"M = N\"\n proof(coinduct rule: Eq_RESUMPTION_I)\n case (Eq_RESUMPTION M N)\n then obtain r r' where [simp]: \"M = Rep_resumption r\" \"N = Rep_resumption r'\"\n and \"X r r'\" by blast\n { assume \"\\a. r = Terminal a \\ r' = Terminal a\"\n hence ?EqTerminal by(auto simp add: Rep_resumption_constructors)\n hence ?case .. }\n moreover\n { assume \"\\R R' b. r = Linear b R \\ r' = Linear b R' \\ (X R R' \\ R = R')\"\n hence ?EqLinear\n by(clarsimp simp add: Rep_resumption_constructors Eq_RESUMPTION_eq Rep_resumption_inject Rep_resumption)\n hence ?case by blast }\n moreover\n { assume \"\\rs rs' c. r = Branch c rs \\ r' = Branch c rs' \\ (\\d. X (rs d) (rs' d) \\ rs d = rs' d)\"\n hence ?EqBranch\n by(clarsimp simp add: Rep_resumption_constructors Eq_RESUMPTION_eq Rep_resumption_inject Rep_resumption)\n hence ?case by blast }\n ultimately show ?case using step[OF `X r r'`] by blast\n qed\n thus ?thesis unfolding M_def N_def by(simp add: Rep_resumption_inject)\nqed\n\ntext {*\n Finality of @{text \"resumption\"}: Uniqueness of functions defined by corecursion.\n*}\n\nlemma equals_RESUMPTION_corec:\n assumes h: \"\\x. h x = (case f x of Terminal_corec a \\ TERMINAL a\n | Linear_corec b x' \\ LINEAR b (h x')\n | Branch_corec c xs \\ BRANCH c (\\d. h (xs d))\n | Resumption_corec r \\ Rep_resumption r)\"\n shows \"h = RESUMPTION_corec f\"\nproof\n fix x\n def h' == \"RESUMPTION_corec f\"\n have h': \"\\x. h' x = (case f x of Terminal_corec a \\ TERMINAL a\n | Linear_corec b x' \\ LINEAR b (h' x')\n | Branch_corec c xs \\ BRANCH c (\\d. h' (xs d))\n | Resumption_corec r \\ Rep_resumption r)\"\n unfolding h'_def by(simp add: RESUMPTION_corec)\n def M == \"h x\" and N == \"h' x\"\n hence \"\\x. M = h x \\ N = h' x\" by blast\n thus \"M = N\"\n proof(coinduct rule: Eq_RESUMPTION_I)\n case (Eq_RESUMPTION M N)\n then obtain x where [simp]: \"M = h x\" \"N = h' x\" by blast\n show ?case\n proof(cases \"f x\")\n case (Terminal_corec a)\n with h h' have ?EqTerminal by simp\n thus ?thesis ..\n next\n case (Linear_corec b x')\n with h h' have ?EqLinear by auto\n thus ?thesis by blast\n next\n case (Branch_corec c xs)\n with h h' have ?EqBranch by auto\n thus ?thesis by blast\n next\n case (Resumption_corec r)\n thus ?thesis\n by(cases r)(simp_all add: h h' Rep_resumption_constructors Eq_RESUMPTION_refl Rep_resumption)\n qed\n qed\nqed\n\nlemma equals_resumption_corec:\n assumes h: \"\\x. h x = (case f x of Terminal_corec a \\ Terminal a\n | Linear_corec b x' \\ Linear b (h x')\n | Branch_corec c xs \\ Branch c (\\d. h (xs d))\n | Resumption_corec r \\ r)\"\n shows \"h = resumption_corec f\"\nproof(rule ext)\n fix x\n { fix x\n from h[of x]\n have \"Rep_resumption (h x) =\n (case f x of Terminal_corec a \\ TERMINAL a\n | Linear_corec b x' \\ LINEAR b (Rep_resumption (h x'))\n | Branch_corec c xs \\ BRANCH c (\\d. Rep_resumption (h (xs d)))\n | Resumption_corec r \\ Rep_resumption r)\"\n by(auto split: resumption_corec.split simp add: Rep_resumption_constructors) }\n hence eq: \"(\\x. Rep_resumption (h x)) = RESUMPTION_corec f\" by(rule equals_RESUMPTION_corec)\n hence \"Abs_resumption (Rep_resumption (h x)) = Abs_resumption (RESUMPTION_corec f x)\"\n by(subst (asm) fun_eq_iff)(auto)\n from this[symmetric] show \"h x = resumption_corec f x\"\n unfolding resumption_corec_def by(simp add: Rep_resumption_inverse)\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Coinductive/Examples/Resumption.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2718286569298458}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n\n Based on extracts from the Jinja theories:\n Common/Objects.thy by David von Oheimb\n Common/Conform.thy by David von Oheimb and Tobias Nipkow\n Common/Exceptions.thy by Gerwin Klein and Martin Strecker\n J/BigStep.thy by Tobias Nipkow\n J/SmallStep.thy by Tobias Nipkow\n J/WellTypeRT.thy by Tobias Nipkow \n*)\n\n\nheader {* \\isaheader{Heap Extension} *}\n\ntheory HeapExtension\nimports Progress\nbegin\n\nsection {* The Heap Extension *}\n\ndefinition hext :: \"heap \\ heap \\ bool\" (\"_ \\ _\" [51,51] 50) where\n \"h \\ h' \\ \\a C S. h a = Some(C,S) \\ (\\S'. h' a = Some(C,S'))\"\n\nlemma hextI: \"\\a C S. h a = Some(C,S) \\ (\\S'. h' a = Some(C,S')) \\ h \\ h'\"\n\napply (unfold hext_def)\napply auto\ndone\n\n\nlemma hext_objD: \"\\ h \\ h'; h a = Some(C,S) \\ \\ \\S'. h' a = Some(C,S')\"\n\napply (unfold hext_def)\napply (force)\ndone\n\n\nlemma hext_refl [iff]: \"h \\ h\"\n\napply (rule hextI)\napply (fast)\ndone\n\n\nlemma hext_new [simp]: \"h a = None \\ h \\ h(a\\x)\"\n\napply (rule hextI)\napply (auto simp:fun_upd_apply)\ndone\n\n\nlemma hext_trans: \"\\ h \\ h'; h' \\ h'' \\ \\ h \\ h''\"\n\napply (rule hextI)\napply (fast dest: hext_objD)\ndone\n\n\nlemma hext_upd_obj: \"h a = Some (C,S) \\ h \\ h(a\\(C,S'))\"\n\napply (rule hextI)\napply (auto simp:fun_upd_apply)\ndone\n\n\n\nsection {* @{text\"\\\"} and preallocated *}\n\nlemma preallocated_hext:\n \"\\ preallocated h; h \\ h' \\ \\ preallocated h'\"\nby (simp add: preallocated_def hext_def)\n\n\nlemmas preallocated_upd_obj = preallocated_hext [OF _ hext_upd_obj]\nlemmas preallocated_new = preallocated_hext [OF _ hext_new]\n\n\n\nsection {* @{text\"\\\"} in Small- and BigStep *}\n\nlemma red_hext_incr: \"P,E \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ h \\ h'\"\n and reds_hext_incr: \"P,E \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ h \\ h'\"\n\nproof(induct rule:red_reds_inducts)\n case RedNew thus ?case\n by(fastforce dest:new_Addr_SomeD simp:hext_def split:if_splits)\nnext\n case RedFAss thus ?case by(simp add:hext_def split:if_splits)\nqed simp_all\n\n\nlemma step_hext_incr: \"P,E \\ \\e,s\\ \\* \\e',s'\\ \\ hp s \\ hp s'\"\n\nproof(induct rule:converse_rtrancl_induct2)\n case refl thus ?case by(rule hext_refl)\nnext\n case (step e s e'' s'')\n have Red:\"((e, s), e'', s'') \\ Red P E\"\n and hext:\"hp s'' \\ hp s'\" by fact+\n from Red have \"P,E \\ \\e,s\\ \\ \\e'',s''\\\" by simp\n hence \"hp s \\ hp s''\"\n by(cases s,cases s'')(auto dest:red_hext_incr)\n with hext show ?case by-(rule hext_trans)\nqed\n\n\nlemma steps_hext_incr: \"P,E \\ \\es,s\\ [\\]* \\es',s'\\ \\ hp s \\ hp s'\"\n\nproof(induct rule:converse_rtrancl_induct2)\n case refl thus ?case by(rule hext_refl)\nnext\n case (step es s es'' s'')\n have Reds:\"((es, s), es'', s'') \\ Reds P E\"\n and hext:\"hp s'' \\ hp s'\" by fact+\n from Reds have \"P,E \\ \\es,s\\ [\\] \\es'',s''\\\" by simp\n hence \"hp s \\ hp s''\"\n by(cases s,cases s'',auto dest:reds_hext_incr)\n with hext show ?case by-(rule hext_trans)\nqed\n\n\n\nlemma eval_hext: \"P,E \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ h \\ h'\"\nand evals_hext: \"P,E \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ h \\ h'\"\n\nproof (induct rule:eval_evals_inducts)\n case New thus ?case\n by(fastforce intro!: hext_new intro:someI simp:new_Addr_def\n split:split_if_asm simp del:fun_upd_apply)\nnext\n case FAss thus ?case\n by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply\n elim!: hext_trans)\nqed (auto elim!: hext_trans)\n\n\n\nsection {* @{text\"\\\"} and conformance *}\n\nlemma conf_hext: \"h \\ h' \\ P,h \\ v :\\ T \\ P,h' \\ v :\\ T\"\nby(cases T)(induct v,auto dest: hext_objD split:split_if_asm)+\n\nlemma confs_hext: \"P,h \\ vs [:\\] Ts \\ h \\ h' \\ P,h' \\ vs [:\\] Ts\"\nby (erule list_all2_mono, erule conf_hext, assumption)\n\nlemma fconf_hext: \"\\ P,h \\ fs (:\\) E; h \\ h' \\ \\ P,h' \\ fs (:\\) E\"\n\napply (unfold fconf_def)\napply (fast elim: conf_hext)\ndone\n\n\n\nlemmas fconf_upd_obj = fconf_hext [OF _ hext_upd_obj]\nlemmas fconf_new = fconf_hext [OF _ hext_new]\n\n\n\nlemma oconf_hext: \"P,h \\ obj \\ \\ h \\ h' \\ P,h' \\ obj \\\"\n\napply (auto simp:oconf_def)\napply (erule allE)\napply (erule_tac x=\"Cs\" in allE)\napply (erule_tac x=\"fs'\" in allE)\napply (fastforce elim:fconf_hext)\ndone\n\n\nlemmas oconf_new = oconf_hext [OF _ hext_new]\nlemmas oconf_upd_obj = oconf_hext [OF _ hext_upd_obj]\n\n\nlemma hconf_new: \"\\ P \\ h \\; h a = None; P,h \\ obj \\ \\ \\ P \\ h(a\\obj) \\\"\nby (unfold hconf_def) (auto intro: oconf_new preallocated_new)\n\nlemma \"\\P \\ h \\; h' = h(a \\ (C, Collect (init_obj P C))); h a = None; wf_prog wf_md P\\\n \\ P \\ h' \\\"\napply (simp add:hconf_def oconf_def)\napply auto\n apply (rule_tac x=\"init_class_fieldmap P (last Cs)\" in exI)\n apply (rule init_obj.intros)\n apply assumption\n apply (erule init_obj.cases)\n apply clarsimp\n apply (erule init_obj.cases)\n apply clarsimp\n apply (erule_tac x=\"a\" in allE)\n apply clarsimp\n apply (erule init_obj.cases)\n apply simp\n apply (erule_tac x=\"a\" in allE)\n apply clarsimp\n apply (erule init_obj.cases)\n apply clarsimp\n apply (drule Subobj_last_isClass)\n apply simp\n apply (auto simp:is_class_def)\n apply (rule fconf_init_fields)\n apply auto\n apply (erule_tac x=\"aa\" in allE)\n apply (erule_tac x=\"aaa\" in allE)\n apply (erule_tac x=\"b\" in allE)\n apply clarsimp\n apply (rotate_tac -1)\n apply (erule_tac x=\"Cs\" in allE)\n apply (erule_tac x=\"fs'\" in allE)\n apply clarsimp thm fconf_new\n apply (erule fconf_new)\n apply simp\napply (rule preallocated_new)\napply simp_all\ndone\n\n\n\nlemma hconf_upd_obj: \n\"\\ P \\ h\\; h a = Some(C,S); P,h \\ (C,S')\\ \\ \\ P \\ h(a\\(C,S'))\\\"\nby (unfold hconf_def) (auto intro: oconf_upd_obj preallocated_upd_obj)\n\nlemma lconf_hext: \"\\ P,h \\ l (:\\)\\<^sub>w E; h \\ h' \\ \\ P,h' \\ l (:\\)\\<^sub>w E\"\n\napply (unfold lconf_def)\napply (fast elim: conf_hext)\ndone\n\n\n\nsection {* @{text\"\\\"} in the runtime type system *}\n\nlemma hext_typeof_mono: \"\\ h \\ h'; P \\ typeof\\<^bsub>h\\<^esub> v = Some T \\ \\ P \\ typeof\\<^bsub>h'\\<^esub> v = Some T\"\n\napply(cases v)\n apply simp\n apply simp\n apply simp\n apply simp\napply(fastforce simp:hext_def)\ndone\n\n\n\nlemma WTrt_hext_mono: \"P,E,h \\ e : T \\ (\\h'. h \\ h' \\ P,E,h' \\ e : T)\"\nand WTrts_hext_mono: \"P,E,h \\ es [:] Ts \\ (\\h'. h \\ h' \\ P,E,h' \\ es [:] Ts)\"\n\napply(induct rule: WTrt_inducts)\napply(simp add: WTrtNew)\napply(fastforce intro: WTrtDynCast)\napply(fastforce intro: WTrtStaticCast)\napply(fastforce simp: WTrtVal dest:hext_typeof_mono)\napply(simp add: WTrtVar)\napply(fastforce simp add: WTrtBinOp)\napply(fastforce simp add: WTrtLAss)\napply(fastforce simp: WTrtFAcc del:WTrt_WTrts.intros WTrt_elim_cases)\napply(simp add: WTrtFAccNT)\napply(fastforce simp: WTrtFAss del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtFAssNT del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtCall del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtStaticCall del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtCallNT del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce)\napply(fastforce simp add: WTrtSeq)\napply(fastforce simp add: WTrtCond)\napply(fastforce simp add: WTrtWhile)\napply(fastforce simp add: WTrtThrow)\napply(simp add: WTrtNil)\napply(simp add: WTrtCons)\ndone\n\n\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/HeapExtension.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.27182865692984576}} {"text": "(* Title: SSA_CFG.thy\n Author: Sebastian Ullrich, Denis Lohner\n*)\n\ntheory SSA_CFG\nimports Graph_path \"HOL-Library.Sublist\"\nbegin\n\nsubsection \\CFG\\\n\nlocale CFG_base = graph_Entry_base \\e \\n invar inEdges' Entry\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry :: \"'g \\ 'node\" +\nfixes \"defs\" :: \"'g \\ 'node \\ 'var::linorder set\"\nfixes \"uses\" :: \"'g \\ 'node \\ 'var set\"\nbegin\n definition \"vars g \\ fold (\\) (map (uses g) (\\n g)) {}\"\n definition defAss' :: \"'g \\ 'node \\ 'var \\ bool\" where\n \"defAss' g m v \\ (\\ns. g \\ Entry g-ns\\m \\ (\\n \\ set ns. v \\ defs g n))\"\n\n definition defAss'Uses :: \"'g \\ bool\" where\n \"defAss'Uses g \\ \\m \\ set (\\n g). \\v \\ uses g m. defAss' g m v\"\nend\n\nlocale CFG = CFG_base \\e \\n invar inEdges' Entry \"defs\" \"uses\"\n+ graph_Entry \\e \\n invar inEdges' Entry\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry :: \"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'var::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'var set\" +\nassumes defs_uses_disjoint: \"n \\ set (\\n g) \\ defs g n \\ uses g n = {}\"\nassumes defs_finite[simp]: \"finite (defs g n)\"\nassumes uses_in_\\n: \"v \\ uses g n \\ n \\ set (\\n g)\"\nassumes uses_finite[simp, intro!]: \"finite (uses g n)\"\nassumes invar[intro!]: \"invar g\"\nbegin\n lemma vars_finite[simp]: \"finite (vars g)\"\n by (auto simp:vars_def)\n\n lemma Entry_no_predecessor[simp]: \"predecessors g (Entry g) = []\"\n using Entry_unreachable\n by (auto simp:predecessors_def)\n\n lemma uses_in_vars[elim, simp]: \"v \\ uses g n \\ v \\ vars g\"\n by (auto simp add:vars_def uses_in_\\n intro!: fold_union_elemI)\n\n lemma varsE:\n assumes \"v \\ vars g\"\n obtains n where \"n \\ set (\\n g)\" \"v \\ uses g n\"\n using assms by (auto simp:vars_def elim!:fold_union_elem)\n\n lemma defs_uses_disjoint'[simp]: \"n \\ set (\\n g) \\ v \\ defs g n \\ v \\ uses g n \\ False\"\n using defs_uses_disjoint by auto\nend\n\ncontext CFG\nbegin\n lemma defAss'E:\n assumes \"defAss' g m v\" \"g \\ Entry g-ns\\m\"\n obtains n where \"n \\ set ns\" \"v \\ defs g n\"\n using assms unfolding defAss'_def by auto\n\n lemmas defAss'I = defAss'_def[THEN iffD2, rule_format]\n\n lemma defAss'_extend:\n assumes \"defAss' g m v\"\n assumes \"g \\ n-ns\\m\" \"\\n \\ set (tl ns). v \\ defs g n\"\n shows \"defAss' g n v\"\n unfolding defAss'_def proof (rule allI, rule impI)\n fix ns'\n assume \"g \\ Entry g-ns'\\n\"\n with assms(2) have \"g \\ Entry g-ns'@tl ns\\m\" by auto\n with assms(1) obtain n' where n': \"n' \\ set (ns'@tl ns)\" \"v \\ defs g n'\" by -(erule defAss'E)\n with assms(3) have \"n' \\ set (tl ns)\" by auto\n with n' show \"\\n \\ set ns'. v \\ defs g n\" by auto\n qed\nend\n\ntext \\A CFG is well-formed if it satisfies definite assignment.\\\n\nlocale CFG_wf = CFG \\e \\n invar inEdges' Entry \"defs\" \"uses\"\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'var::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'var set\" +\nassumes def_ass_uses: \"\\m \\ set (\\n g). \\v \\ uses g m. defAss' g m v\"\n\nsubsection \\SSA CFG\\\n\ntype_synonym ('node, 'val) phis = \"'node \\ 'val \\ 'val list\"\n\ndeclare in_set_zipE[elim]\ndeclare zip_same[simp]\n\nlocale CFG_SSA_base = CFG_base \\e \\n invar inEdges' Entry \"defs\" \"uses\"\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" +\nfixes phis :: \"'g \\ ('node, 'val) phis\"\nbegin\n definition \"phiDefs g n \\ {v. (n,v) \\ dom (phis g)}\"\n definition[code]: \"allDefs g n \\ defs g n \\ phiDefs g n\"\n\n definition[code]: \"phiUses g n \\\n \\n' \\ set (successors g n). \\v' \\ phiDefs g n'. snd ` Set.filter (\\(n'',v). n'' = n) (set (zip (predecessors g n') (the (phis g (n',v')))))\"\n definition[code]: \"allUses g n \\ uses g n \\ phiUses g n\"\n definition[code]: \"allVars g \\ \\n \\ set (\\n g). allDefs g n \\ allUses g n\"\n\n definition defAss :: \"'g \\ 'node \\ 'val \\ bool\" where\n \"defAss g m v \\ (\\ns. g \\ Entry g-ns\\m \\ (\\n \\ set ns. v \\ allDefs g n))\"\n\n lemmas CFG_SSA_defs = phiDefs_def allDefs_def phiUses_def allUses_def allVars_def defAss_def\nend\n\nlocale CFG_SSA = CFG \\e \\n invar inEdges' Entry \"defs\" \"uses\" + CFG_SSA_base \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" and\n phis :: \"'g \\ ('node, 'val) phis\" +\nassumes phis_finite: \"finite (dom (phis g))\"\nassumes phis_in_\\n: \"phis g (n,v) = Some vs \\ n \\ set (\\n g)\"\nassumes phis_wf:\n \"phis g (n,v) = Some args \\ length (predecessors g n) = length args\"\nassumes simpleDefs_phiDefs_disjoint: \n \"n \\ set (\\n g) \\ defs g n \\ phiDefs g n = {}\"\nassumes allDefs_disjoint:\n \"\\n \\ set (\\n g); m \\ set (\\n g); n \\ m\\ \\ allDefs g n \\ allDefs g m = {}\"\nbegin\n lemma phis_disj:\n assumes \"phis g (n,v) = Some vs\"\n and \"phis g (n',v) = Some vs'\"\n shows \"n = n'\" and \"vs = vs'\"\n proof -\n from assms have \"n \\ set (\\n g)\" and \"n' \\ set (\\n g)\"\n by (auto dest: phis_in_\\n)\n from allDefs_disjoint [OF this] assms show \"n = n'\"\n by (auto simp: allDefs_def phiDefs_def)\n with assms show \"vs = vs'\" by simp\n qed\n\n lemma allDefs_disjoint': \"\\n \\ set (\\n g); m \\ set (\\n g); v \\ allDefs g n; v \\ allDefs g m\\ \\ n = m\"\n using allDefs_disjoint by auto\n\n lemma phiUsesI:\n assumes \"n' \\ set (\\n g)\" \"phis g (n',v') = Some vs\" \"(n,v) \\ set (zip (predecessors g n') vs)\"\n shows \"v \\ phiUses g n\"\n proof-\n from assms(3) have \"n \\ set (predecessors g n')\" by auto\n hence 1: \"n' \\ set (successors g n)\" using assms(1) by simp\n from assms(2) have 2: \"v' \\ phiDefs g n'\" by (auto simp add:phiDefs_def)\n from assms(2) have 3: \"the (phis g (n',v')) = vs\" by simp\n show ?thesis unfolding phiUses_def by (rule UN_I[OF 1], rule UN_I[OF 2], auto simp:image_def Set.filter_def assms(3) 3)\n qed\n\n lemma phiUsesE:\n assumes \"v \\ phiUses g n\"\n obtains n' v' vs where \"n' \\ set (successors g n)\" \"(n,v) \\ set (zip (predecessors g n') vs)\" \"phis g (n', v') = Some vs\"\n proof-\n from assms(1) obtain n' v' where \"n'\\set (successors g n)\" \"v'\\phiDefs g n'\"\n \"v \\ snd ` Set.filter (\\(n'', v). n'' = n) (set (zip (predecessors g n') (the (phis g (n', v')))))\" by (auto simp:phiUses_def)\n thus ?thesis by - (rule that[of n' \"the (phis g (n',v'))\" v'], auto simp:phiDefs_def)\n qed\n\n lemma defs_in_allDefs[simp]: \"v \\ defs g n \\ v \\ allDefs g n\" by (simp add:allDefs_def)\n lemma phiDefs_in_allDefs[simp, elim]: \"v \\ phiDefs g n \\ v \\ allDefs g n\" by (simp add:allDefs_def)\n \n\n lemma phiDefs_finite[simp]: \"finite (phiDefs g n)\"\n unfolding phiDefs_def\n proof (rule finite_surj[where f=snd], rule phis_finite[where g=g])\n have \"\\x y. phis g (n,x) = Some y \\ x \\ snd ` dom (phis g)\" by (metis domI imageI snd_conv)\n thus \"{v. (n, v) \\ dom (phis g)} \\ snd ` dom (phis g)\" by auto\n qed\n\n lemma phiUses_finite[simp]:\n assumes \"n \\ set (\\n g)\"\n shows \"finite (phiUses g n)\"\n by (auto simp:phiUses_def Set.filter_def)\n\n lemma allDefs_finite[simp]: \"n \\ set (\\n g) \\ finite (allDefs g n)\" by (auto simp add:allDefs_def)\n lemma allUses_finite[simp]: \"n \\ set (\\n g) \\ finite (allUses g n)\" by (auto simp add:allUses_def)\n lemma allVars_finite[simp]: \"finite (allVars g)\" by (auto simp add:allVars_def)\n\n lemmas defAssI = defAss_def[THEN iffD2, rule_format]\n lemmas defAssD = defAss_def[THEN iffD1, rule_format]\n\n lemma defAss_extend:\n assumes \"defAss g m v\"\n assumes \"g \\ n-ns\\m\" \"\\n \\ set (tl ns). v \\ allDefs g n\"\n shows \"defAss g n v\"\n unfolding defAss_def proof (rule allI, rule impI)\n fix ns'\n assume \"g \\ Entry g-ns'\\n\"\n with assms(2) have \"g \\ Entry g-ns'@tl ns\\m\" by auto\n with assms(1) obtain n' where n': \"n' \\ set (ns'@tl ns)\" \"v \\ allDefs g n'\" by (auto dest:defAssD)\n with assms(3) have \"n' \\ set (tl ns)\" by auto\n with n' show \"\\n \\ set ns'. v \\ allDefs g n\" by auto\n qed\n\n lemma defAss_dominating:\n assumes[simp]: \"n \\ set (\\n g)\"\n shows \"defAss g n v \\ (\\m \\ set (\\n g). dominates g m n \\ v \\ allDefs g m)\"\n proof\n assume asm: \"defAss g n v\"\n obtain ns where ns: \"g \\ Entry g-ns\\n\" by (atomize, auto)\n from defAssD[OF asm this] obtain m where m: \"m \\ set ns\" \"v \\ allDefs g m\" by auto\n have \"dominates g m n\"\n proof\n fix ns'\n assume ns': \"g \\ Entry g-ns'\\n\"\n from defAssD[OF asm this] obtain m' where m': \"m' \\ set ns'\" \"v \\ allDefs g m'\" by auto\n with m ns ns' have \"m' = m\" by - (rule allDefs_disjoint', auto)\n with m' show \"m \\ set ns'\" by simp\n qed simp\n with m ns show \"\\m\\set (\\n g). dominates g m n \\ v \\ allDefs g m\" by auto\n next\n assume \"\\m \\ set (\\n g). dominates g m n \\ v \\ allDefs g m\"\n then obtain m where[simp]: \"m \\ set (\\n g)\" and m: \"dominates g m n\" \"v \\ allDefs g m\" by auto\n show \"defAss g n v\"\n proof (rule defAssI)\n fix ns\n assume \"g \\ Entry g-ns\\n\"\n with m(1) have \"m \\ set ns\" by - (rule dominates_mid, auto)\n with m(2) show \"\\n\\set ns. v \\ allDefs g n\" by auto\n qed\n qed\nend\n\nlocale CFG_SSA_wf_base = CFG_SSA_base \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" and\n phis :: \"'g \\ ('node, 'val) phis\"\nbegin\n text \\Using the SSA properties, we can map every value to its unique defining node and\n remove the @{typ 'node} parameter of the @{term phis} map.\\\n\n definition defNode :: \"'g \\ 'val \\ 'node\" where\n defNode_code [code]: \"defNode g v \\ hd [n \\ \\n g. v \\ allDefs g n]\"\n\n abbreviation \"def_dominates g v' v \\ dominates g (defNode g v') (defNode g v)\"\n abbreviation \"strict_def_dom g v' v \\ defNode g v' \\ defNode g v \\ def_dominates g v' v\"\n\n definition \"phi g v = phis g (defNode g v,v)\"\n definition[simp]: \"phiArg g v v' \\ \\vs. phi g v = Some vs \\ v' \\ set vs\"\n\n definition[code]: \"isTrivialPhi g v v' \\ v' \\ v \\\n (case phi g v of\n Some vs \\ set vs = {v,v'} \\ set vs = {v'}\n | None \\ False)\"\n definition[code]: \"trivial g v \\ \\v' \\ allVars g. isTrivialPhi g v v'\"\n definition[code]: \"redundant g \\ \\v \\ allVars g. trivial g v\"\n\n definition \"defAssUses g \\ \\n \\ set (\\n g). \\v \\ allUses g n. defAss g n v\"\n\n text \\'liveness' of an SSA value is defined inductively starting from simple uses so that\n a circle of \\pf s is not considered live.\\\n\n declare [[inductive_internals]]\n inductive liveVal :: \"'g \\ 'val \\ bool\"\n for g :: 'g\n where\n liveSimple: \"\\n \\ set (\\n g); val \\ uses g n\\ \\ liveVal g val\"\n | livePhi: \"\\liveVal g v; phiArg g v v'\\ \\ liveVal g v'\"\n\n definition \"pruned g = (\\n \\ set (\\n g). \\val. val \\ phiDefs g n \\ liveVal g val)\"\n\n lemmas \"CFG_SSA_wf_defs\" = CFG_SSA_defs defNode_code phi_def isTrivialPhi_def trivial_def redundant_def liveVal_def pruned_def\nend\n\nlocale CFG_SSA_wf = CFG_SSA \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis + CFG_SSA_wf_base \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" and\n phis :: \"'g \\ ('node, 'val) phis\" +\n assumes allUses_def_ass: \"\\v \\ allUses g n; n \\ set (\\n g)\\ \\ defAss g n v\"\n assumes Entry_no_phis[simp]: \"phis g (Entry g,v) = None\"\nbegin\n lemma allVars_in_allDefs: \"v \\ allVars g \\ \\n \\ set (\\n g). v \\ allDefs g n\"\n unfolding allVars_def\n apply auto\n apply (drule(1) allUses_def_ass)\n apply (clarsimp simp: defAss_def)\n apply (drule Entry_reaches)\n apply auto[1]\n by fastforce\n\n lemma phiDefs_Entry_empty[simp]: \"phiDefs g (Entry g) = {}\"\n by (auto simp: phiDefs_def)\n\n lemma phi_Entry_empty[simp]: \"defNode g v = Entry g \\ phi g v = None\"\n by (simp add:phi_def)\n\n lemma defNode_ex1:\n assumes \"v \\ allVars g\"\n shows \"\\!n. n \\ set (\\n g) \\ v \\ allDefs g n\"\n proof (rule ex_ex1I)\n show \"\\n. n \\ set (\\n g) \\ v \\ allDefs g n\"\n proof-\n from assms(1) obtain n where n: \"n \\ set (\\n g)\" \"v \\ allDefs g n \\ v \\ allUses g n\" by (auto simp:allVars_def)\n thus ?thesis\n proof (cases \"v \\ allUses g n\")\n case True\n from n(1) obtain ns where ns: \"g \\ Entry g-ns\\n\" by (atomize_elim, rule Entry_reaches, auto)\n with allUses_def_ass[OF True n(1)] obtain m where m: \"m \\ set ns\" \"v \\ allDefs g m\" by - (drule defAssD, auto)\n from ns this(1) have \"m \\ set (\\n g)\" by (rule path2_in_\\n)\n with n(1) m show ?thesis by auto\n qed auto\n qed\n show \"\\n m. n \\ set (\\n g) \\ v \\ allDefs g n \\ m \\ set (\\n g) \\ v \\ allDefs g m \\ n = m\" using allDefs_disjoint by auto\n qed\n\n lemma defNode_def: \"v \\ allVars g \\ defNode g v = (THE n. n \\ set (\\n g) \\ v \\ allDefs g n)\"\n unfolding defNode_code by (rule the1_list[symmetric], rule defNode_ex1)\n\n lemma defNode[simp]:\n assumes \"v \\ allVars g\"\n shows \"(defNode g v) \\ set (\\n g)\" \"v \\ allDefs g (defNode g v)\"\n apply (atomize(full))\n unfolding defNode_def[OF assms] using assms\n by - (rule theI', rule defNode_ex1)\n\n lemma defNode_eq[intro]:\n assumes \"n \\ set (\\n g)\" \"v \\ allDefs g n\"\n shows \"defNode g v = n\"\n apply (subst defNode_def, rule allDefs_in_allVars[OF assms(2) assms(1)])\n by (rule the1_equality, rule defNode_ex1, rule allDefs_in_allVars[where n=n], simp_all add:assms)\n\n lemma defNode_cases[consumes 1]:\n assumes \"v \\ allVars g\"\n obtains (simpleDef) \"v \\ defs g (defNode g v)\"\n | (phi) \"phi g v \\ None\"\n proof (cases \"v \\ defs g (defNode g v)\")\n case True\n thus thesis by (rule simpleDef)\n next\n case False\n with assms[THEN defNode(2)] show thesis\n by - (rule phi, auto simp: allDefs_def phiDefs_def phi_def)\n qed\n\n lemma phi_phiDefs[simp]: \"phi g v = Some vs \\ v \\ phiDefs g (defNode g v)\" by (auto simp:phiDefs_def phi_def)\n\n lemma simpleDef_not_phi:\n assumes \"n \\ set (\\n g)\" \"v \\ defs g n\"\n shows \"phi g v = None\"\n proof-\n from assms have \"defNode g v = n\" by auto\n with assms show ?thesis using simpleDefs_phiDefs_disjoint by (auto simp: phi_def phiDefs_def)\n qed\n\n lemma phi_wf: \"phi g v = Some vs \\ length (predecessors g (defNode g v)) = length vs\"\n by (rule phis_wf) (simp add:phi_def)\n\n lemma phi_finite: \"finite (dom (phi g))\"\n proof-\n let ?f = \"\\v. (defNode g v,v)\"\n have \"phi g = phis g \\ ?f\" by (auto simp add:phi_def)\n moreover have \"inj ?f\" by (auto intro:injI)\n hence \"finite (dom (phis g \\ ?f))\" by - (rule finite_dom_comp, auto simp add:phis_finite inj_on_def)\n ultimately show ?thesis by simp\n qed\n\n lemma phiUses_exI:\n assumes \"m \\ set (predecessors g n)\" \"phis g (n,v) = Some vs\" \"n \\ set (\\n g)\"\n obtains v' where \"v' \\ phiUses g m\" \"v' \\ set vs\"\n proof-\n from assms(1) obtain i where i: \"m = predecessors g n ! i\" \"i < length (predecessors g n)\" by (metis in_set_conv_nth)\n with assms(2) phis_wf have[simp]: \"i < length vs\" by (auto simp add:phi_def)\n from i assms(2,3) have \"vs ! i \\ phiUses g m\" by - (rule phiUsesI, auto simp add:phiUses_def phi_def set_zip)\n thus thesis by (rule that) (auto simp add:i(2) phis_wf)\n qed\n\n lemma phiArg_exI:\n assumes \"m \\ set (predecessors g (defNode g v))\" \"phi g v \\ None\" and[simp]: \"v \\ allVars g\"\n obtains v' where \"v' \\ phiUses g m\" \"phiArg g v v'\"\n proof-\n from assms(2) obtain vs where \"phi g v = Some vs\" by auto\n with assms(1) show thesis\n by - (rule phiUses_exI, auto intro!:that simp: phi_def)\n qed\n\n lemma phiUses_exI':\n assumes \"phiArg g p q\" and[simp]: \"p \\ allVars g\"\n obtains m where \"q \\ phiUses g m\" \"m \\ set (predecessors g (defNode g p))\"\n proof-\n let ?n = \"defNode g p\"\n from assms(1) obtain i vs where vs: \"phi g p = Some vs\" and i: \"q = vs ! i\" \"i < length vs\" by (metis in_set_conv_nth phiArg_def)\n with phis_wf have[simp]: \"i < length (predecessors g ?n)\" by (auto simp add:phi_def)\n from vs i have \"q \\ phiUses g (predecessors g ?n ! i)\" by - (rule phiUsesI, auto simp add:phiUses_def phi_def set_zip)\n thus thesis by (rule that) (auto simp add:i(2) phis_wf)\n qed\n\n lemma phiArg_in_allVars[simp]:\n assumes \"phiArg g v v'\"\n shows \"v' \\ allVars g\"\n proof-\n let ?n = \"defNode g v\"\n from assms(1) obtain vs where vs: \"phi g v = Some vs\" \"v' \\ set vs\" by auto\n then obtain m where m: \"(m,v') \\ set (zip (predecessors g ?n) vs)\" by - (rule set_zip_leftI, rule phi_wf)\n from vs(1) have n: \"?n \\ set (\\n g)\" by (simp add: phi_def phis_in_\\n)\n with m have[simp]: \"m \\ set (\\n g)\" by auto\n from n m vs have \"v' \\ phiUses g m\" by - (rule phiUsesI, simp_all add:phi_def)\n thus ?thesis by - (rule allUses_in_allVars, auto simp:allUses_def)\n qed\n\n lemma defAss_defNode:\n assumes \"defAss g m v\" \"v \\ allVars g\" \"g \\ Entry g-ns\\m\"\n shows \"defNode g v \\ set ns\"\n proof-\n from assms obtain n where n: \"n \\ set ns\" \"v \\ allDefs g n\" by (auto simp:defAss_def)\n with assms(3) have \"n = defNode g v\" by - (rule defNode_eq[symmetric], auto)\n with n show \"defNode g v \\ set ns\" by (simp add:defAss_def)\n qed\n\n lemma defUse_path_ex:\n assumes \"v \\ allUses g m\" \"m \\ set (\\n g)\"\n obtains ns where \"g \\ defNode g v-ns\\m\" \"EntryPath g ns\"\n proof-\n from assms have \"defAss g m v\" by - (rule allUses_def_ass, auto)\n moreover from assms obtain ns where ns: \"g \\ Entry g-ns\\m\" \"EntryPath g ns\"\n by - (atomize_elim, rule Entry_reachesE, auto)\n ultimately have \"defNode g v \\ set ns\" using assms(1)\n by - (rule defAss_defNode, auto)\n with ns(1) obtain ns' where \"g \\ defNode g v-ns'\\m\" \"suffix ns' ns\"\n by (rule path2_split_ex', auto simp: Sublist.suffix_def)\n thus thesis using ns(2)\n by - (rule that, assumption, rule EntryPath_suffix, auto)\n qed\n\n lemma defUse_path_dominated:\n assumes \"g \\ defNode g v-ns\\n\" \"defNode g v \\ set (tl ns)\" \"v \\ allUses g n\" \"n' \\ set ns\"\n shows \"dominates g (defNode g v) n'\"\n proof (rule dominatesI)\n fix es\n assume asm: \"g \\ Entry g-es\\n'\"\n from assms(1,4) obtain ns' where ns': \"g \\ n'-ns'\\n\" \"suffix ns' ns\"\n by - (rule path2_split_ex, auto simp: Sublist.suffix_def)\n from assms have \"defAss g n v\" by - (rule allUses_def_ass, auto)\n with asm ns'(1) assms(3) have \"defNode g v \\ set (es@tl ns')\" by - (rule defAss_defNode, auto)\n with suffix_tl_subset[OF ns'(2)] assms(2) show \"defNode g v \\ set es\" by auto\n next\n show \"n' \\ set (\\n g)\" using assms(1,4) by auto\n qed\n\n lemma allUses_dominated:\n assumes \"v \\ allUses g n\" \"n \\ set (\\n g)\"\n shows \"dominates g (defNode g v) n\"\n proof-\n from assms obtain ns where \"g \\ defNode g v-ns\\n\" \"defNode g v \\ set (tl ns)\"\n by - (rule defUse_path_ex, auto elim: simple_path2)\n with assms(1) show ?thesis by - (rule defUse_path_dominated, auto)\n qed\n\n lemma phiArg_path_ex':\n assumes \"phiArg g p q\" and[simp]: \"p \\ allVars g\"\n obtains ns m where \"g \\ defNode g q-ns\\m\" \"EntryPath g ns\" \"q \\ phiUses g m\" \"m \\ set (predecessors g (defNode g p))\"\n proof-\n from assms obtain m where m: \"q \\ phiUses g m\" \"m \\ set (predecessors g (defNode g p))\"\n by (rule phiUses_exI')\n then obtain ns where \"g \\ defNode g q-ns\\m\" \"EntryPath g ns\" by - (rule defUse_path_ex, auto)\n with m show thesis by - (rule that)\n qed\n\n lemma phiArg_path_ex:\n assumes \"phiArg g p q\" and[simp]: \"p \\ allVars g\"\n obtains ns where \"g \\ defNode g q-ns\\defNode g p\" \"length ns > 1\"\n by (rule phiArg_path_ex'[OF assms], rule, auto)\n\n lemma phiArg_tranclp_path_ex:\n assumes \"r\\<^sup>+\\<^sup>+ p q\" \"p \\ allVars g\" and[simp]: \"\\p q. r p q \\ phiArg g p q\"\n obtains ns where \"g \\ defNode g q-ns\\defNode g p\" \"length ns > 1\"\n \"\\n \\ set (butlast ns). \\p q m ns'. r p q \\ g \\ defNode g q-ns'\\m \\ (defNode g q) \\ set (tl ns') \\ q \\ phiUses g m \\ m \\ set (predecessors g (defNode g p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode g p \\ set ns\"\n using assms(1,2) proof (induction rule: converse_tranclp_induct)\n case (base p)\n from base.hyps base.prems(2) obtain ns' m where ns': \"g \\ defNode g q-ns'\\m\" \"defNode g q \\ set (tl ns')\" \"m \\ set (predecessors g (defNode g p))\" \"q \\ phiUses g m\"\n by - (rule phiArg_path_ex', rule assms(3), auto intro: simple_path2)\n hence ns: \"g \\ defNode g q-ns'@[defNode g p]\\defNode g p\" \"length (ns'@[defNode g p]) > 1\" by auto\n\n show ?case\n proof (rule base.prems(1)[OF ns, rule_format], rule exI, rule exI, rule exI, rule exI)\n fix n\n assume \"n \\ set (butlast (ns' @ [defNode g p]))\"\n with base.hyps ns'\n show \"r p q \\\n g \\ defNode g q-ns'\\m \\\n defNode g q \\ set (tl ns') \\\n q \\ phiUses g m \\\n m \\ set (predecessors g (defNode g p)) \\ n \\ set ns' \\ set ns' \\ set (ns' @ [defNode g p]) \\ defNode g p \\ set (ns' @ [defNode g p])\"\n by auto\n qed\n next\n case (step p p')\n from step.prems(2) step.hyps(1) obtain ns'\\<^sub>2 m where ns'\\<^sub>2: \"g \\ defNode g p'-ns'\\<^sub>2\\m\" \"m \\ set (predecessors g (defNode g p))\" \"defNode g p' \\ set (tl ns'\\<^sub>2)\" \"p' \\ phiUses g m\"\n by - (rule phiArg_path_ex', rule assms(3), auto intro: simple_path2)\n then obtain ns\\<^sub>2 where ns\\<^sub>2: \"g \\ defNode g p'-ns\\<^sub>2\\defNode g p\" \"length ns\\<^sub>2 > 1\" \"ns\\<^sub>2 = ns'\\<^sub>2@[defNode g p]\" by (atomize_elim, auto)\n\n show thesis\n proof (rule step.IH)\n fix ns\n assume ns: \"g \\ defNode g q-ns\\defNode g p'\" \"1 < length ns\"\n assume IH: \"\\n\\set (butlast ns).\n \\p q m ns'.\n r p q \\\n g \\ defNode g q-ns'\\m \\\n defNode g q \\ set (tl ns') \\\n q \\ phiUses g m \\ m \\ set (predecessors g (defNode g p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode g p \\ set ns\"\n\n let ?path = \"ns@tl ns\\<^sub>2\"\n have ns_ns\\<^sub>2: \"g \\ defNode g q-?path\\defNode g p\" \"1 < length ?path\" using ns ns\\<^sub>2(1,2) by auto\n show thesis\n proof (rule step.prems(1)[OF ns_ns\\<^sub>2, rule_format])\n fix n\n assume n: \"n \\ set (butlast ?path)\"\n show \"\\p q m ns'a.\n r p q \\\n g \\ defNode g q-ns'a\\m \\\n defNode g q \\ set (tl ns'a) \\\n q \\ phiUses g m \\ m \\ set (predecessors g (defNode g p)) \\ n \\ set ns'a \\ set ns'a \\ set ?path \\ defNode g p \\ set ?path\"\n proof (cases \"n \\ set (butlast ns)\")\n case True\n with IH obtain p q m ns' where \"\n r p q \\\n g \\ defNode g q-ns'\\m \\\n defNode g q \\ set (tl ns') \\\n q \\ phiUses g m \\ m \\ set (predecessors g (defNode g p)) \\ n \\ set ns' \\ set ns' \\ set ns \\ defNode g p \\ set ns\" by auto\n thus ?thesis by - (rule exI, rule exI, rule exI, rule exI, auto)\n next\n case False\n from ns ns\\<^sub>2 have 1: \"?path = butlast ns@ns\\<^sub>2\"\n by - (rule concat_join[symmetric], auto simp: path2_def)\n from ns\\<^sub>2(1) n False 1 have \"n \\ set (butlast ns\\<^sub>2)\" by (auto simp: butlast_append path2_not_Nil)\n with step.hyps ns'\\<^sub>2 ns\\<^sub>2(3) show ?thesis\n by - (subst 1, rule exI[where x=p], rule exI[where x=p'], rule exI, rule exI, auto simp: path2_not_Nil)\n qed\n qed\n next\n show \"p' \\ allVars g\" using step.prems(2) step.hyps(1)[THEN assms(3)] by auto\n qed\n qed\n\n lemma non_dominated_predecessor:\n assumes \"n \\ set (\\n g)\" \"n \\ Entry g\"\n obtains m where \"m \\ set (predecessors g n)\" \"\\dominates g n m\"\n proof-\n obtain ns where \"g \\ Entry g-ns\\n\"\n by (atomize_elim, rule Entry_reaches, auto simp add:assms(1))\n then obtain ns' where ns': \"g \\ Entry g-ns'\\n\" \"n \\ set (butlast ns')\"\n by (rule simple_path2)\n let ?m = \"last (butlast ns')\"\n from ns'(1) assms(2) obtain m: \"g \\ Entry g-butlast ns'\\?m\" \"?m \\ set (predecessors g n)\"\n by - (rule path2_unsnoc, auto)\n with m(1) ns'(2) show thesis\n by - (rule that, auto elim:dominatesE)\n qed\n\n lemmas dominates_trans'[trans, elim] = dominates_trans[OF invar]\n lemmas strict_dom_trans'[trans, elim] = strict_dom_trans[OF invar]\n lemmas dominates_refl'[simp] = dominates_refl[OF invar]\n lemmas dominates_antisymm'[dest] = dominates_antisymm[OF invar]\n\n lemma liveVal_in_allVars[simp]: \"liveVal g v \\ v \\ allVars g\"\n by (induction rule: liveVal.induct, auto intro!: allUses_in_allVars)\n\n lemma phi_no_closed_loop:\n assumes[simp]: \"p \\ allVars g\" and \"phi g p = Some vs\"\n shows \"set vs \\ {p}\"\n proof (cases \"defNode g p = Entry g\")\n case True\n with assms(2) show ?thesis by auto\n next\n case False\n show ?thesis\n proof\n assume[simp]: \"set vs = {p}\"\n let ?n = \"defNode g p\"\n obtain ns where ns: \"g \\ Entry g-ns\\?n\" \"?n \\ set (butlast ns)\" by (rule simple_Entry_path, auto)\n let ?m = \"last (butlast ns)\"\n from ns False obtain m: \"g \\ Entry g-butlast ns\\?m\" \"?m \\ set (predecessors g ?n)\"\n by - (rule path2_unsnoc, auto)\n hence \"p \\ phiUses g ?m\" using assms(2) by - (rule phiUses_exI, auto simp:phi_def)\n hence \"defAss g ?m p\" using m by - (rule allUses_def_ass, auto)\n then obtain l where l: \"l \\ set (butlast ns)\" \"p \\ allDefs g l\" using m by - (drule defAssD, auto)\n with assms(2) m have \"l = ?n\" by - (rule allDefs_disjoint', auto)\n with ns l m show False by auto\n qed\n qed\n\n lemma phis_phi: \"phis g (n, v) = Some vs \\ phi g v = Some vs\"\n unfolding phi_def\n apply (subst defNode_eq)\n by (auto simp: allDefs_def phi_def phiDefs_def intro: phis_in_\\n)\n\n lemma trivial_phi: \"trivial g v \\ phi g v \\ None\"\n by (auto simp: trivial_def isTrivialPhi_def split: option.splits)\n\n lemma trivial_finite: \"finite {v. trivial g v}\"\n by (rule finite_subset[OF _ phi_finite]) (auto dest: trivial_phi)\n\n lemma trivial_in_allVars: \"trivial g v \\ v \\ allVars g\"\n by (drule trivial_phi, auto simp: allDefs_def phiDefs_def image_def phi_def intro: phis_in_\\n intro!: allDefs_in_allVars)\n\n declare phiArg_def [simp del]\nend\n\nsubsection \\Bundling of CFG and Equivalent SSA CFG\\\n\nlocale CFG_SSA_Transformed_base = old: CFG_base \\e \\n invar inEdges' Entry oldDefs oldUses + CFG_SSA_wf_base \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n oldDefs :: \"'g \\ 'node \\ 'var::linorder set\" and\n oldUses :: \"'g \\ 'node \\ 'var set\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" and\n phis :: \"'g \\ ('node, 'val) phis\" +\n fixes var :: \"'g \\ 'val \\ 'var\"\n\nlocale CFG_SSA_Transformed = CFG_SSA_Transformed_base \\e \\n invar inEdges' Entry oldDefs oldUses \"defs\" \"uses\" phis var\n + old: CFG_wf \\e \\n invar inEdges' Entry oldDefs oldUses + CFG_SSA_wf \\e \\n invar inEdges' Entry \"defs\" \"uses\" phis\nfor\n \\e :: \"'g \\ ('node::linorder \\ 'edgeD \\ 'node) set\" and\n \\n :: \"'g \\ 'node list\" and\n invar :: \"'g \\ bool\" and\n inEdges' :: \"'g \\ 'node \\ ('node \\ 'edgeD) list\" and\n Entry::\"'g \\ 'node\" and\n oldDefs :: \"'g \\ 'node \\ 'var::linorder set\" and\n oldUses :: \"'g \\ 'node \\ 'var set\" and\n \"defs\" :: \"'g \\ 'node \\ 'val::linorder set\" and\n \"uses\" :: \"'g \\ 'node \\ 'val set\" and\n phis :: \"'g \\ ('node, 'val) phis\" and\n var :: \"'g \\ 'val \\ 'var\" +\n assumes oldDefs_def: \"oldDefs g n = var g ` defs g n\"\n assumes oldUses_def: \"n \\ set (\\n g) \\ oldUses g n = var g ` uses g n\"\n assumes conventional: \"\n\\g \\ n-ns\\m; n \\ set (tl ns); v \\ allDefs g n; v \\ allUses g m; x \\ set (tl ns); v' \\ allDefs g x\\ \\ var g v' \\ var g v\"\n assumes phis_same_var[elim]: \"phis g (n,v) = Some vs \\ v' \\ set vs \\ var g v' = var g v\"\n assumes allDefs_var_disjoint: \"\\n \\ set (\\n g); v \\ allDefs g n; v' \\ allDefs g n; v \\ v'\\ \\ var g v' \\ var g v\"\nbegin\n lemma conventional': \"\\g \\ n-ns\\m; n \\ set (tl ns); v \\ allDefs g n; v \\ allUses g m; v' \\ allDefs g x; var g v' = var g v\\ \\ x \\ set (tl ns)\"\n using conventional by auto\n\n lemma conventional'': \"\\g \\ defNode g v-ns\\m; defNode g v \\ set (tl ns); v \\ allUses g m; var g v' = var g v; v \\ allVars g; v' \\ allVars g\\ \\ defNode g v' \\ set (tl ns)\"\n by (rule conventional'[where v=v and v'=v'], auto)\n\n lemma phiArg_same_var: \"phiArg g p q \\ var g q = var g p\"\n by (metis phiArg_def phi_def phis_same_var)\n\n lemma oldDef_defAss:\n assumes \"v \\ allUses g n\" \"g \\ Entry g-ns\\n\"\n obtains m where \"m \\ set ns\" \"var g v \\ oldDefs g m\"\n using assms proof (induction ns arbitrary: v n rule: length_induct)\n case (1 ns)\n from \"1.prems\"(2-) have 2: \"defNode g v \\ set ns\"\n by - (rule defAss_defNode, rule allUses_def_ass, auto)\n let ?V = \"defNode g v\"\n from \"1.prems\"(2,3) have[simp]: \"v \\ allVars g\" by auto\n thus ?case\n proof (cases v rule: defNode_cases)\n case simpleDef\n with 2 show thesis by - (rule \"1.prems\"(1), auto simp: oldDefs_def)\n next\n case phi\n then obtain vs where vs: \"phi g v = Some vs\" by auto\n from \"1.prems\"(3) 2 obtain ns' where ns': \"g \\ Entry g-ns'\\?V\" \"prefix ns' ns\"\n by (rule old.path2_split_ex, auto)\n let ?V' = \"last (butlast ns')\"\n from ns' phi have nontriv: \"length ns' \\ 2\"\n by - (rule old.path2_nontrivial, auto)\n hence 3: \"g \\ Entry g-butlast ns'\\?V'\" \"?V' \\ set (old.predecessors g ?V)\"\n using ns'(1) by (auto intro: old.path2_unsnoc)\n with phi vs obtain v' where v': \"v' \\ phiUses g ?V'\" \"var g v' = var g v\"\n by - (rule phiArg_exI, auto simp: phi_def phis_same_var phiArg_def)\n show thesis\n proof (rule \"1.IH\"[rule_format])\n show \"length (butlast ns') < length ns\" using ns' by (cases ns', auto simp: old.path2_not_Nil2 dest: prefix_length_le)\n show \"v' \\ allUses g ?V'\" using v'(1) by simp\n next\n fix n\n assume \"n \\ set (butlast ns')\" \"var g v' \\ oldDefs g n\"\n thus thesis\n using ns'(2)[THEN set_mono_prefix] v'(2) by - (rule \"1.prems\"(1)[of n], auto dest: in_set_butlastD)\n qed (rule 3(1))\n qed\n qed\n\n lemma allDef_path_from_simpleDef:\n assumes[simp]: \"v \\ allVars g\"\n obtains n ns where \"g \\ n-ns\\defNode g v\" \"old.EntryPath g ns\" \"var g v \\ oldDefs g n\"\n proof-\n let ?V = \"defNode g v\"\n from assms obtain ns where ns: \"g \\ Entry g-ns\\?V\" \"old.EntryPath g ns\"\n by - (rule old.Entry_reachesE, auto)\n from assms show thesis\n proof (cases v rule: defNode_cases)\n case simpleDef\n thus thesis by - (rule that, auto simp: oldDefs_def)\n next\n case phi\n then obtain vs where vs: \"phi g v = Some vs\" by auto\n let ?V' = \"last (butlast ns)\"\n from ns phi have nontriv: \"length ns \\ 2\"\n by - (rule old.path2_nontrivial, auto)\n hence 3: \"g \\ Entry g-butlast ns\\?V'\" \"?V' \\ set (old.predecessors g ?V)\"\n using ns(1) by (auto intro: old.path2_unsnoc)\n with phi vs obtain v' where v': \"v' \\ phiUses g ?V'\" \"var g v' = var g v\"\n by - (rule phiArg_exI, auto simp: phi_def phis_same_var phiArg_def)\n with 3(1) obtain n where n: \"n \\ set (butlast ns)\" \"var g v' \\ oldDefs g n\"\n by - (rule oldDef_defAss[of v' g], auto)\n with ns obtain ns' where \"g \\ n-ns'\\?V\" \"suffix ns' ns\"\n by - (rule old.path2_split_ex'[OF ns(1)], auto intro: in_set_butlastD simp: Sublist.suffix_def)\n with n(2) v'(2) ns(2) show thesis\n by - (rule that, assumption, erule old.EntryPath_suffix, auto)\n qed\n qed\n\n lemma defNode_var_disjoint:\n assumes \"p \\ allVars g\" \"q \\ allVars g\" \"p \\ q\" \"defNode g p = defNode g q\"\n shows \"var g p \\ var g q\"\n proof-\n have \"q \\ allDefs g (defNode g p)\" using assms(2) assms(4) by (auto)\n thus ?thesis using assms(1-3)\n by - (rule allDefs_var_disjoint[of \"defNode g p\" g], auto)\n qed\n\n lemma phiArg_distinct_nodes:\n assumes \"phiArg g p q\" \"p \\ q\" and[simp]: \"p \\ allVars g\"\n shows \"defNode g p \\ defNode g q\"\n proof\n have \"p \\ allDefs g (defNode g p)\" by simp\n moreover assume \"defNode g p = defNode g q\"\n ultimately have \"var g p \\ var g q\" using assms\n by - (rule defNode_var_disjoint, auto)\n moreover\n from assms(1) have \"var g q = var g p\" by (rule phiArg_same_var)\n ultimately show False by simp\n qed\n\n lemma phiArgs_def_distinct:\n assumes \"phiArg g p q\" \"phiArg g p r\" \"q \\ r\" \"p \\ allVars g\"\n shows \"defNode g q \\ defNode g r\"\n proof (rule)\n assume \"defNode g q = defNode g r\"\n hence \"var g q \\ var g r\" using assms by - (rule defNode_var_disjoint, auto)\n thus False using phiArg_same_var[OF assms(1)] phiArg_same_var[OF assms(2)] by simp\n qed\n\n lemma defNode_not_on_defUse_path:\n assumes p: \"g \\ defNode g p-ns\\n\" \"defNode g p \\ set (tl ns)\" \"p \\ allUses g n\"\n assumes[simp]: \"q \\ allVars g\" \"p \\ q\" \"var g p = var g q\"\n shows \"defNode g q \\ set ns\"\n proof-\n let ?P = \"defNode g p\"\n let ?Q = \"defNode g q\"\n\n have[simp]: \"p \\ allVars g\" using p(1,3) by auto\n have \"?P \\ ?Q\" using defNode_var_disjoint[of p g q] by auto\n moreover have \"?Q \\ set (tl ns)\" using p(2,3)\n by - (rule conventional'[OF p(1), of p q], auto)\n ultimately show ?thesis using p(1) by (cases ns, auto simp: old.path2_def)\n qed\n\n lemma defUse_paths_disjoint:\n assumes p: \"g \\ defNode g p-ns\\n\" \"defNode g p \\ set (tl ns)\" \"p \\ allUses g n\"\n assumes q: \"g \\ defNode g q-ms\\m\" \"defNode g q \\ set (tl ms)\" \"q \\ allUses g m\"\n assumes[simp]: \"p \\ q\" \"var g p = var g q\"\n shows \"set ns \\ set ms = {}\"\n proof (rule equals0I)\n fix y\n assume y: \"y \\ set ns \\ set ms\"\n\n {\n fix p ns n\n assume p: \"g \\ defNode g p-ns\\n\" \"defNode g p \\ set (tl ns)\" \"p \\ allUses g n\"\n assume y: \"y \\ set ns\"\n from p(1,3) have dom: \"old.dominates g (defNode g p) n\" by - (rule allUses_dominated, auto)\n moreover\n obtain ns' where \"g \\ y-ns'\\n\" \"suffix ns' ns\"\n by (rule old.path2_split_first_last[OF p(1) y], auto)\n ultimately have \"old.dominates g (defNode g p) y\" using suffix_tl_subset[of ns' ns] p(2)\n by - (rule old.dominates_extend[where ms=ns'], auto)\n }\n with assms y have dom: \"old.dominates g (defNode g p) y\" \"old.dominates g (defNode g q) y\" by auto\n\n {\n fix p ns n q ms m\n let ?P = \"defNode g p\"\n let ?Q = \"defNode g q\"\n\n assume p: \"g \\ defNode g p-ns\\n\" \"defNode g p \\ set (tl ns)\" \"p \\ allUses g n\" \"old.dominates g ?P y\" \"y \\ set ns\"\n assume q: \"g \\ defNode g q-ms\\m\" \"defNode g q \\ set (tl ms)\" \"q \\ allUses g m\" \"old.dominates g ?Q y\" \"y \\ set ms\"\n assume[simp]: \"p \\ q\" \"var g p = var g q\"\n assume dom: \"old.dominates g ?P ?Q\"\n then obtain pqs where pqs: \"g \\ ?P-pqs\\?Q\" \"?P \\ set (tl pqs)\" by (rule old.dominates_path, auto intro: old.simple_path2)\n from p obtain ns\\<^sub>2 where ns\\<^sub>2: \"g \\ y-ns\\<^sub>2\\n\" \"suffix ns\\<^sub>2 ns\" by - (rule old.path2_split_first_last, auto)\n from q obtain ms\\<^sub>1 where ms\\<^sub>1: \"g \\ ?Q-ms\\<^sub>1\\y\" \"prefix ms\\<^sub>1 ms\" by - (rule old.path2_split_first_last, auto)\n have \"var g q \\ var g p\"\n proof (rule conventional[OF _ _ _ p(3)])\n let ?path = \"(pqs@tl ms\\<^sub>1)@tl ns\\<^sub>2\"\n show \"g \\ ?P-?path\\n\" using pqs ms\\<^sub>1 ns\\<^sub>2\n by (auto simp del:append_assoc intro:old.path2_app)\n have \"?P \\ set (tl ns\\<^sub>2)\" using p(2) ns\\<^sub>2(2)[THEN suffix_tl_subset, THEN subsetD] by auto\n moreover\n have[simp]: \"q \\ allVars g\" \"p \\ allVars g\" using p q by auto\n have \"?P \\ set (tl ms)\" using q\n by - (rule conventional'[where v'=p and v=q], auto)\n hence \"?P \\ set (tl ms\\<^sub>1)\" using ms\\<^sub>1(2)[simplified, THEN prefix_tl_subset] by auto\n ultimately\n show \"?P \\ set (tl ?path)\" using pqs(2)\n by - (rule notI, auto dest: subsetD[OF set_tl_append'])\n show \"p \\ allDefs g (defNode g p)\" by auto\n have \"?P \\ ?Q\" using defNode_var_disjoint[of p g q] by auto\n hence 1: \"length pqs > 1\" using pqs by - (rule old.path2_nontriv)\n hence \"?Q \\ set (tl pqs)\" using pqs unfolding old.path2_def by (auto intro:last_in_tl)\n moreover from 1 have \"pqs \\ []\" by auto\n ultimately show \"?Q \\ set (tl ?path)\" by simp\n show \"q \\ allDefs g ?Q\" by simp\n qed\n hence False by simp\n }\n from this[OF p _ _ q] this[OF q _ _ p] y dom show False\n by - (rule old.dominates_antitrans[OF _ dom], auto)\n qed\n\n lemma oldDefsI: \"v \\ defs g n \\ var g v \\ oldDefs g n\" by (simp add: oldDefs_def)\n \n lemma simpleDefs_phiDefs_var_disjoint:\n assumes \"v \\ phiDefs g n\" \"n \\ set (\\n g)\"\n shows \"var g v \\ oldDefs g n\"\n proof\n from assms have[simp]: \"v \\ allVars g\" by auto\n assume \"var g v \\ oldDefs g n\"\n then obtain v'' where v'': \"v'' \\ defs g n\" \"var g v'' = var g v\"\n by (auto simp: oldDefs_def)\n from this(1) assms have \"v'' \\ v\"\n using simpleDefs_phiDefs_disjoint[of n g] by (auto simp: phiArg_def)\n with v'' assms show False\n using allDefs_var_disjoint[of n g v'' v] by auto\n qed\n\n lemma liveVal_use_path: \n assumes \"liveVal g v\"\n obtains ns m where \"g \\ defNode g v-ns\\m\" \"var g v \\ oldUses g m\"\n \"\\x. x \\ set (tl ns) \\ var g v \\ oldDefs g x\"\n using assms proof (induction)\n case (liveSimple m v)\n from liveSimple.hyps have[simp]: \"v \\ allVars g\"\n by - (rule allUses_in_allVars, auto)\n from liveSimple.hyps obtain ns where ns: \"g \\ defNode g v-ns\\m\" \"defNode g v \\ set (tl ns)\"\n by - (rule defUse_path_ex, auto intro!: uses_in_allUses elim: old.simple_path2)\n from this(1) show thesis\n proof (rule liveSimple.prems)\n show \"var g v \\ oldUses g m\" using liveSimple.hyps by (auto simp: oldUses_def)\n {\n fix x\n assume asm: \"x \\ set (tl ns)\" \"var g v \\ oldDefs g x\"\n then obtain v' where \"v' \\ defs g x\" \"var g v' = var g v\"\n by (auto simp: oldDefs_def)\n with asm liveSimple.hyps have False\n by - (rule conventional[OF ns, of v x v', THEN notE], auto)\n }\n thus \"\\x. x \\ set (tl ns) \\ var g v \\ oldDefs g x\" by auto\n qed\n next\n case (livePhi v v')\n from livePhi.hyps have[simp]: \"v \\ allVars g\" \"v' \\ allVars g\" \"var g v' = var g v\"\n by (auto intro: phiArg_same_var)\n show thesis\n proof (rule livePhi.IH)\n fix ns m\n assume asm: \"g \\ defNode g v-ns\\m\" \"var g v \\ oldUses g m\"\n \"\\x. x \\ set (tl ns) \\ var g v \\ oldDefs g x\"\n from livePhi.hyps(2) obtain ns' m' where ns': \"g \\ defNode g v'-ns'\\m'\" \"v' \\ phiUses g m'\"\n \"m' \\ set (old.predecessors g (defNode g v))\" \"defNode g v' \\ set (tl ns')\"\n by (rule phiArg_path_ex', auto elim: old.simple_path2)\n show thesis \n proof (rule livePhi.prems)\n show \"g \\ defNode g v'-(ns'@[defNode g v])@tl ns\\m\"\n apply (rule old.path2_app)\n apply (rule old.path2_snoc[OF ns'(1,3)])\n by (rule asm(1))\n show \"var g v' \\ oldUses g m\" using asm(2) by simp\n {\n fix x\n assume asm: \"x \\ set (tl ns')\" \"var g v \\ oldDefs g x\"\n then obtain v'' where \"v'' \\ defs g x\" \"var g v'' = var g v\"\n by (auto simp: oldDefs_def)\n with asm ns'(2) have False\n by - (rule conventional[OF ns'(1,4), of v' x v'', THEN notE], auto)\n }\n then show \"\\x. x \\ set (tl ((ns'@[defNode g v])@tl ns)) \\ var g v' \\ oldDefs g x\"\n using simpleDefs_phiDefs_var_disjoint[of v g \"defNode g v\"] livePhi.hyps(2)\n by (auto dest!: set_tl_append'[THEN subsetD] asm(3) simp: phiArg_def)\n qed\n qed\n qed\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Formal_SSA/SSA_CFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.2718286569298457}} {"text": "theory SINVAR_DomainHierarchyNG_impl\nimports SINVAR_DomainHierarchyNG \"../TopoS_Interface_impl\"\nbegin\n\n\nsubsubsection \\SecurityInvariant DomainHierarchy List Implementation\\\n\ncode_identifier code_module SINVAR_DomainHierarchyNG_impl => (Scala) SINVAR_DomainHierarchyNG\n\nfun sinvar :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ bool\" where\n \"sinvar G nP = (\\ (s, r) \\ set (edgesL G). (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s))\"\n\n\ndefinition DomainHierarchyNG_sanity_check_config :: \"domainNameTrust list \\ domainTree \\ bool\" where\n \"DomainHierarchyNG_sanity_check_config host_attributes tree = (\\ c \\ set host_attributes.\n case c of Unassigned \\ True\n | DN (level, trust) \\ valid_hierarchy_pos tree level\n )\"\n\nfun verify_globals :: \"'v list_graph \\ ('v \\ domainNameTrust) \\ domainTree \\ bool\" where\n \"verify_globals G nP tree = (\\ v \\ set (nodesL G). \n case (nP v) of Unassigned \\ True | DN (level, trust) \\ valid_hierarchy_pos tree level\n )\"\n\n(*TODO: to get rid of verify_globals\n this stronger DomainHierarchyNG_sanity_check_config sanity checker checks the config\n for all graphs!*)\nlemma \"DomainHierarchyNG_sanity_check_config c tree \\\n {x. \\v. nP v = x} = set c \\\n verify_globals G nP tree\"\n apply(simp add: DomainHierarchyNG_sanity_check_config_def split: if_split_asm)\n apply(clarify)\n apply(case_tac \"nP v\")\n apply(simp_all)\n apply(clarify)\n by force\n\n\ndefinition DomainHierarchyNG_offending_list:: \"'v list_graph \\ ('v \\ domainNameTrust) \\ ('v \\ 'v) list list\" where\n \"DomainHierarchyNG_offending_list G nP = (if sinvar G nP then\n []\n else \n [ [e \\ edgesL G. case e of (s,r) \\ \\ (nP r) \\\\<^sub>t\\<^sub>r\\<^sub>u\\<^sub>s\\<^sub>t (nP s) ] ])\"\n\n\n\nlemma \"DomainHierarchyNG.node_props P = \n (\\i. case node_properties P i of None \\ SINVAR_DomainHierarchyNG.default_node_properties | Some property \\ property)\"\nby(fact SecurityInvariant.node_props.simps[OF TopoS_DomainHierarchyNG, of \"P\"])\n\ndefinition \"NetModel_node_props P = (\\ i. (case (node_properties P) i of Some property \\ property | None \\ SINVAR_DomainHierarchyNG.default_node_properties))\"\n(*\n\n(*TODO does this work?*)\nlemma[code_unfold]: \"DomainHierarchyNG.node_props P = NetModel_node_props P\"\nby(simp add: NetModel_node_props_def)\n\ndefinition \"DomainHierarchyNG_eval G P = (wf_list_graph G \\\n sinvar G (SecurityInvariant.node_props SINVAR_DomainHierarchyNG.default_node_properties P))\"\n\n\ninterpretation DomainHierarchyNG_impl:TopoS_List_Impl \n where default_node_properties=SINVAR_DomainHierarchyNG.default_node_properties\n and sinvar_spec=SINVAR_DomainHierarchyNG.sinvar\n and sinvar_impl=sinvar\n and receiver_violation=SINVAR_DomainHierarchyNG.receiver_violation\n and offending_flows_impl=DomainHierarchyNG_offending_list\n and node_props_impl=NetModel_node_props\n and eval_impl=DomainHierarchyNG_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n apply(simp add: TopoS_DomainHierarchyNG list_graph_to_graph_def; fail)\n apply(rule conjI)\n apply(simp add: list_graph_to_graph_def DomainHierarchyNG_offending_set\n DomainHierarchyNG_offending_set_def DomainHierarchyNG_offending_list_def; fail)\n apply(rule conjI)\n apply(simp only: NetModel_node_props_def)\n apply(metis DomainHierarchyNG.node_props.simps DomainHierarchyNG.node_props_eq_node_props_formaldef)\n apply(simp only: DomainHierarchyNG_eval_def)\n apply(intro allI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_DomainHierarchyNG])\n apply(simp add: list_graph_to_graph_def)\ndone\n\n\nsubsubsection \\DomainHierarchyNG packing\\\n definition SINVAR_LIB_DomainHierarchyNG :: \"('v::vertex, domainNameTrust) TopoS_packed\" where\n \"SINVAR_LIB_DomainHierarchyNG \\ \n \\ nm_name = ''DomainHierarchyNG'', \n nm_receiver_violation = SINVAR_DomainHierarchyNG.receiver_violation,\n nm_default = SINVAR_DomainHierarchyNG.default_node_properties, \n nm_sinvar = sinvar,\n nm_offending_flows = DomainHierarchyNG_offending_list, \n nm_node_props = NetModel_node_props,\n nm_eval = DomainHierarchyNG_eval\n \\\"\n interpretation SINVAR_LIB_DomainHierarchyNG_interpretation: TopoS_modelLibrary SINVAR_LIB_DomainHierarchyNG \n SINVAR_DomainHierarchyNG.sinvar\n apply(unfold TopoS_modelLibrary_def SINVAR_LIB_DomainHierarchyNG_def)\n apply(rule conjI)\n apply(simp)\n apply(simp)\n by(unfold_locales)\n\n\n\n\n\n\ntext \\Examples:\\\ndefinition example_TUM_net :: \"string list_graph\" where\n \"example_TUM_net \\ \\ nodesL=[''Gateway'', ''LowerSVR'', ''UpperSRV''], \n edgesL=[\n (''Gateway'',''LowerSVR''), (''Gateway'',''UpperSRV''), \n (''LowerSVR'', ''Gateway''),\n (''UpperSRV'', ''Gateway'')\n ] \\\"\nvalue \"wf_list_graph example_TUM_net\"\n\ndefinition example_TUM_config :: \"string \\ domainNameTrust\" where\n \"example_TUM_config \\ ((\\ e. default_node_properties)\n (''Gateway'':= DN (''ACD''--''AISD''--Leaf, 1),\n ''LowerSVR'':= DN (''ACD''--''AISD''--Leaf, 0),\n ''UpperSRV'':= DN (''ACD''--Leaf, 0)\n ))\"\n\ndefinition example_TUM_hierarchy :: \"domainTree\" where\n\"example_TUM_hierarchy \\ (Department ''ACD'' [\n Department ''AISD'' []\n ])\"\n\nvalue \"verify_globals example_TUM_net example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net example_TUM_config\"\n\ndefinition example_TUM_net_invalid where\n\"example_TUM_net_invalid \\ example_TUM_net\\edgesL := \n (''LowerSRV'', ''UpperSRV'')#(edgesL example_TUM_net)\\\"\n\nvalue \"verify_globals example_TUM_net_invalid example_TUM_config example_TUM_hierarchy\"\nvalue \"sinvar example_TUM_net_invalid example_TUM_config\"\nvalue \"DomainHierarchyNG_offending_list example_TUM_net_invalid example_TUM_config\"\n\n\nhide_const (open) NetModel_node_props\n\nhide_const (open) sinvar \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_DomainHierarchyNG_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419831347361, "lm_q2_score": 0.39233683016710835, "lm_q1q2_score": 0.2717489601037421}} {"text": "section \\Algorithms on Nondeterministic Generalized Büchi Automata\\\n\ntheory NGBA_Algorithms\nimports\n NGBA_Graphs\n NGBA_Implement\n NBA_Combine\n NBA_Algorithms\n Degeneralization_Refine\nbegin\n\n subsection \\Operations\\\n\n definition op_language_empty where [simp]: \"op_language_empty A \\ NGBA.language A = {}\"\n\n lemmas [autoref_op_pat] = op_language_empty_def[symmetric]\n\n subsection \\Implementations\\\n\n context\n begin\n\n interpretation autoref_syn by this\n\n lemma ngba_g_ahs: \"ngba_g A = \\ g_V = UNIV, g_E = E_of_succ (\\ p. CAST\n ((\\ a \\ ngba.alphabet A. ngba.transition A a p ::: \\S\\ list_set_rel) ::: \\S\\ ahs_rel bhc)),\n g_V0 = ngba.initial A \\\"\n unfolding ngba_g_def ngba.successors_alt_def CAST_def id_apply autoref_tag_defs by rule\n\n schematic_goal ngbai_gi:\n notes [autoref_ga_rules] = map2set_to_list\n fixes S :: \"('statei \\ 'state) set\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(?f :: ?'a, RETURN (ngba_g A)) \\ ?A\"\n unfolding ngba_g_ahs[where S = S and bhc = bhc] by (autoref_monadic (plain))\n concrete_definition ngbai_gi uses ngbai_gi\n lemma ngbai_gi_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n shows \"(NGBA_Algorithms.ngbai_gi seq bhc hms, ngba_g) \\\n \\L, S\\ ngbai_ngba_rel \\ \\unit_rel, S\\ g_impl_rel_ext\"\n using ngbai_gi.refine[THEN RETURN_nres_relD] assms unfolding autoref_tag_defs by blast\n\n schematic_goal ngba_nodes:\n fixes S :: \"('statei \\ 'state) set\"\n assumes [simp]: \"finite ((g_E (ngba_g A))\\<^sup>* `` g_V0 (ngba_g A))\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(?f :: ?'a, op_reachable (ngba_g A)) \\ ?R\" by autoref\n concrete_definition ngba_nodes uses ngba_nodes\n lemma ngba_nodes_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_PRECOND (finite (NGBA.nodes A))\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n assumes \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(NGBA_Algorithms.ngba_nodes seq bhc hms Ai,\n (OP NGBA.nodes ::: \\L, S\\ ngbai_ngba_rel \\ \\S\\ ahs_rel bhc) $ A) \\ \\S\\ ahs_rel bhc\"\n proof -\n have 1: \"NGBA.nodes A = op_reachable (ngba_g A)\" by (auto simp: ngba_g_V0 ngba_g_E_rtrancl)\n have 2: \"finite ((g_E (ngba_g A))\\<^sup>* `` g_V0 (ngba_g A))\" using assms(1) unfolding 1 by simp\n show ?thesis using ngba_nodes.refine assms 2 unfolding autoref_tag_defs 1 by blast\n qed\n\n lemma ngba_igbg_ahs: \"ngba_igbg A = \\ g_V = UNIV, g_E = E_of_succ (\\ p. CAST\n ((\\ a \\ NGBA.alphabet A. NGBA.transition A a p ::: \\S\\ list_set_rel) ::: \\S\\ ahs_rel bhc)), g_V0 = NGBA.initial A,\n igbg_num_acc = length (NGBA.accepting A), igbg_acc = ngba_acc (NGBA.accepting A) \\\"\n unfolding ngba_g_def ngba_igbg_def ngba.successors_alt_def CAST_def id_apply autoref_tag_defs\n unfolding graph_rec.defs\n by simp\n\n definition \"ngba_acc_bs cs p \\ fold (\\ (k, c) bs. if c p then bs_insert k bs else bs) (List.enumerate 0 cs) (bs_empty ())\"\n\n lemma ngba_acc_bs_empty[simp]: \"ngba_acc_bs [] p = bs_empty ()\" unfolding ngba_acc_bs_def by simp\n lemma ngba_acc_bs_insert[simp]:\n assumes \"c p\"\n shows \"ngba_acc_bs (cs @ [c]) p = bs_insert (length cs) (ngba_acc_bs cs p)\"\n using assms unfolding ngba_acc_bs_def by (simp add: enumerate_append_eq)\n lemma ngba_acc_bs_skip[simp]:\n assumes \"\\ c p\"\n shows \"ngba_acc_bs (cs @ [c]) p = ngba_acc_bs cs p\"\n using assms unfolding ngba_acc_bs_def by (simp add: enumerate_append_eq)\n\n lemma ngba_acc_bs_correct[simp]: \"bs_\\ (ngba_acc_bs cs p) = ngba_acc cs p\"\n proof (induct cs rule: rev_induct)\n case Nil\n show ?case unfolding ngba_acc_def by simp\n next\n case (snoc c cs)\n show ?case using less_Suc_eq snoc by (cases \"c p\") (force simp: ngba_acc_def)+\n qed\n\n lemma ngba_acc_impl_bs[autoref_rules]: \"(ngba_acc_bs, ngba_acc) \\ \\S \\ bool_rel\\ list_rel \\ S \\ \\nat_rel\\ bs_set_rel\"\n proof -\n have \"(ngba_acc_bs, ngba_acc) \\ \\Id \\ bool_rel\\ list_rel \\ Id \\ \\nat_rel\\ bs_set_rel\"\n by (auto simp: bs_set_rel_def in_br_conv)\n also have \"(ngba_acc, ngba_acc) \\ \\S \\ bool_rel\\ list_rel \\ S \\ \\nat_rel\\ set_rel\" by parametricity\n finally show ?thesis by simp\n qed\n\n schematic_goal ngbai_igbgi:\n notes [autoref_ga_rules] = map2set_to_list\n fixes S :: \"('statei \\ 'state) set\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(?f :: ?'a, RETURN (ngba_igbg A)) \\ ?A\"\n unfolding ngba_igbg_ahs[where S = S and bhc = bhc] by (autoref_monadic (plain))\n concrete_definition ngbai_igbgi uses ngbai_igbgi\n lemma ngbai_igbgi_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n shows \"(NGBA_Algorithms.ngbai_igbgi seq bhc hms, ngba_igbg) \\\n \\L, S\\ ngbai_ngba_rel \\ igbg_impl_rel_ext unit_rel S\"\n using ngbai_igbgi.refine[THEN RETURN_nres_relD] assms unfolding autoref_tag_defs by blast\n\n schematic_goal ngba_language_empty:\n fixes S :: \"('statei \\ 'state) set\"\n assumes [simp]: \"igb_fr_graph (ngba_igbg A)\"\n assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhs\"\n assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ S \\ S \\ bool_rel\"\n assumes [autoref_rules]: \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(?f :: ?'a, do { r \\ op_find_lasso_spec (ngba_igbg A); RETURN (r = None)}) \\ ?A\"\n by (autoref_monadic (plain))\n concrete_definition ngba_language_empty uses ngba_language_empty\n lemma nba_language_empty_refine[autoref_rules]:\n fixes S :: \"('statei \\ 'state) set\"\n assumes \"SIDE_PRECOND (finite (NGBA.nodes A))\"\n assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n assumes \"GEN_OP seq HOL.eq (S \\ S \\ bool_rel)\"\n assumes \"(Ai, A) \\ \\L, S\\ ngbai_ngba_rel\"\n shows \"(NGBA_Algorithms.ngba_language_empty seq bhc hms Ai,\n (OP op_language_empty ::: \\L, S\\ ngbai_ngba_rel \\ bool_rel) $ A) \\ bool_rel\"\n proof -\n have 1: \"NGBA.nodes A = op_reachable (ngba_g A)\" by (auto simp: ngba_g_V0 ngba_g_E_rtrancl)\n have 2: \"finite ((g_E (ngba_g A))\\<^sup>* `` g_V0 (ngba_g A))\" using assms(1) unfolding 1 by simp\n interpret igb_fr_graph \"ngba_igbg A\"\n using 2 unfolding ngba_igbg_def ngba_g_def graph_rec.defs ngba_acc_def by unfold_locales auto\n have \"(RETURN (NGBA_Algorithms.ngba_language_empty seq bhc hms Ai),\n do { r \\ find_lasso_spec; RETURN (r = None) }) \\ \\bool_rel\\ nres_rel\"\n using ngba_language_empty.refine assms igb_fr_graph_axioms by simp\n also have \"(do { r \\ find_lasso_spec; RETURN (r = None) },\n RETURN (\\ Ex is_lasso_prpl)) \\ \\bool_rel\\ nres_rel\"\n unfolding find_lasso_spec_def by (refine_vcg) (auto split: option.splits)\n finally have \"NGBA_Algorithms.ngba_language_empty seq bhc hms Ai \\ \\ Ex is_lasso_prpl\"\n unfolding nres_rel_comp using RETURN_nres_relD by force\n also have \"\\ \\ \\ Ex is_acc_run\" using lasso_prpl_acc_run_iff by auto\n also have \"\\ \\ NGBA.language A = {}\" using NGBA_Graphs.acc_run_language is_igb_graph by auto\n finally show ?thesis by simp\n qed\n\n lemma degeneralize_alt_def: \"degeneralize A = nba\n (ngba.alphabet A)\n ((\\ p. (p, 0)) ` ngba.initial A)\n (\\ a (p, k). (\\ q. (q, Degeneralization.count (ngba.accepting A) p k)) ` ngba.transition A a p)\n (degen (ngba.accepting A))\"\n unfolding degeneralization.degeneralize_def by auto\n\n schematic_goal ngba_degeneralize: \"(?f :: ?'a, degeneralize) \\ ?R\"\n unfolding degeneralize_alt_def\n using degen_param[autoref_rules] count_param[autoref_rules]\n by autoref\n concrete_definition ngba_degeneralize uses ngba_degeneralize\n lemmas ngba_degeneralize_refine[autoref_rules] = ngba_degeneralize.refine\n\n schematic_goal nba_intersect':\n assumes [autoref_rules]: \"(seq, HOL.eq) \\ L \\ L \\ bool_rel\"\n shows \"(?f, intersect') \\ \\L, S\\ nbai_nba_rel \\ \\L, T\\ nbai_nba_rel \\ \\L, S \\\\<^sub>r T\\ ngbai_ngba_rel\"\n unfolding intersection.product_def by autoref\n concrete_definition nba_intersect' uses nba_intersect'\n lemma nba_intersect'_refine[autoref_rules]:\n assumes \"GEN_OP seq HOL.eq (L \\ L \\ bool_rel)\"\n shows \"(nba_intersect' seq, intersect') \\\n \\L, S\\ nbai_nba_rel \\ \\L, T\\ nbai_nba_rel \\ \\L, S \\\\<^sub>r T\\ ngbai_ngba_rel\"\n using nba_intersect'.refine assms unfolding autoref_tag_defs by this\n\n end\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Transition_Systems_and_Automata/Automata/NBA/NGBA_Algorithms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.2717293306137525}} {"text": "(* Title: Imperative_HOL_Time/Ref_Time.thy\n Author: Maximilian P. L. Haslbeck & Bohua Zhan, TU Muenchen\n*)\n\nsection \\Monadic references\\\n\ntext \\This theory is an adaptation of \\HOL/Imperative_HOL/Array_Time.thy\\,\n adding time bookkeeping.\\\n\ntheory Ref_Time\nimports Array_Time\nbegin\n\ntext \\\n Imperative reference operations; modeled after their ML counterparts.\n See \\<^url>\\http://caml.inria.fr/pub/docs/manual-caml-light/node14.15.html\\\n and \\<^url>\\http://www.smlnj.org/doc/Conversion/top-level-comparison.html\\.\n\\\n\nsubsection \\Primitives\\\n\ndefinition present :: \"heap \\ 'a::heap ref \\ bool\" where\n \"present h r \\ addr_of_ref r < lim h\"\n\ndefinition get :: \"heap \\ 'a::heap ref \\ 'a\" where\n \"get h = from_nat \\ refs h TYPEREP('a) \\ addr_of_ref\"\n\ndefinition set :: \"'a::heap ref \\ 'a \\ heap \\ heap\" where\n \"set r x = refs_update\n (\\h. h(TYPEREP('a) := ((h (TYPEREP('a))) (addr_of_ref r := to_nat x))))\"\n\ndefinition alloc :: \"'a \\ heap \\ 'a::heap ref \\ heap\" where\n \"alloc x h = (let\n l = lim h;\n r = Ref l\n in (r, set r x (h\\lim := l + 1\\)))\"\n\ndefinition noteq :: \"'a::heap ref \\ 'b::heap ref \\ bool\" (infix \"=!=\" 70) where\n \"r =!= s \\ TYPEREP('a) \\ TYPEREP('b) \\ addr_of_ref r \\ addr_of_ref s\"\n\n\nsubsection \\Monad operations\\\n\ndefinition ref :: \"'a::heap \\ 'a ref Heap\" where\n [code del]: \"ref v = Heap_Time_Monad.heap (%h. let (r,h') = alloc v h in (r,h',1))\"\n\ndefinition lookup :: \"'a::heap ref \\ 'a Heap\" (\"!_\" 61) where\n [code del]: \"lookup r = Heap_Time_Monad.tap (\\h. get h r)\"\n\ndefinition update :: \"'a ref \\ 'a::heap \\ unit Heap\" (\"_ := _\" 62) where\n [code del]: \"update r v = Heap_Time_Monad.heap (\\h. ((), set r v h, 1))\"\n\ndefinition change :: \"('a::heap \\ 'a) \\ 'a ref \\ 'a Heap\" where\n \"change f r = do {\n x \\ ! r;\n let y = f x;\n r := y;\n return y\n }\"\n\n\nsubsection \\Properties\\\n\ntext \\Primitives\\\n\nlemma noteq_sym: \"r =!= s \\ s =!= r\"\n and unequal [simp]: \"r \\ r' \\ r =!= r'\" \\ \\same types!\\\n by (auto simp add: noteq_def)\n\nlemma noteq_irrefl: \"r =!= r \\ False\"\n by (auto simp add: noteq_def)\n\nlemma present_alloc_neq: \"present h r \\ r =!= fst (alloc v h)\"\n by (simp add: present_def alloc_def noteq_def Let_def)\n\nlemma next_fresh [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"\\ present h r\"\n using assms by (cases h) (auto simp add: alloc_def present_def Let_def)\n\nlemma next_present [simp]:\n assumes \"(r, h') = alloc x h\"\n shows \"present h' r\"\n using assms by (cases h) (auto simp add: alloc_def set_def present_def Let_def)\n\nlemma get_set_eq [simp]:\n \"get (set r x h) r = x\"\n by (simp add: get_def set_def)\n\nlemma get_set_neq [simp]:\n \"r =!= s \\ get (set s x h) r = get h r\"\n by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n \"set r x (set r y h) = set r x h\"\n by (simp add: set_def)\n\nlemma not_present_alloc [simp]:\n \"\\ present h (fst (alloc v h))\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma set_set_swap:\n \"r =!= r' \\ set r x (set r' x' h) = set r' x' (set r x h)\"\n by (simp add: noteq_def set_def fun_eq_iff)\n\nlemma alloc_set:\n \"fst (alloc x (set r x' h)) = fst (alloc x h)\"\n by (simp add: alloc_def set_def Let_def)\n\nlemma get_alloc [simp]:\n \"get (snd (alloc x h)) (fst (alloc x' h)) = x\"\n by (simp add: alloc_def Let_def)\n\nlemma set_alloc [simp]:\n \"set (fst (alloc v h)) v' (snd (alloc v h)) = snd (alloc v' h)\"\n by (simp add: alloc_def Let_def)\n\nlemma get_alloc_neq: \"r =!= fst (alloc v h) \\ \n get (snd (alloc v h)) r = get h r\"\n by (simp add: get_def set_def alloc_def Let_def noteq_def)\n\nlemma lim_set [simp]:\n \"lim (set r v h) = lim h\"\n by (simp add: set_def)\n\nlemma present_alloc [simp]: \n \"present h r \\ present (snd (alloc v h)) r\"\n by (simp add: present_def alloc_def Let_def)\n\nlemma present_set [simp]:\n \"present (set r v h) = present h\"\n by (simp add: present_def fun_eq_iff)\n\nlemma noteq_I:\n \"present h r \\ \\ present h r' \\ r =!= r'\"\n by (auto simp add: noteq_def present_def)\n\n\ntext \\Monad operations\\\n\nlemma execute_ref [execute_simps]:\n \"execute (ref v) h = Some (let (r,h') = alloc v h in (r,h',1))\"\n by (simp add: ref_def execute_simps)\n\nlemma success_refI [success_intros]:\n \"success (ref v) h\"\n by (auto intro: success_intros simp add: ref_def)\n\nlemma effect_refI [effect_intros]:\n assumes \"(r, h') = alloc v h\" \"n=1\"\n shows \"effect (ref v) h h' r n\"\n apply (rule effectI) apply (insert assms, simp add: execute_simps)\n by (metis case_prod_conv) \n\nlemma effect_refE [effect_elims]:\n assumes \"effect (ref v) h h' r n\" \n obtains \"get h' r = v\" and \"present h' r\" and \"\\ present h r\" and \"n=1\"\n using assms apply (rule effectE) apply (simp add: execute_simps)\n by (metis (no_types, lifting) Ref_Time.alloc_def Ref_Time.get_set_eq fst_conv next_fresh next_present prod.case_eq_if snd_conv)\n\nlemma execute_lookup [execute_simps]:\n \"Heap_Time_Monad.execute (lookup r) h = Some (get h r, h, 1)\"\n by (simp add: lookup_def execute_simps)\n\nlemma success_lookupI [success_intros]:\n \"success (lookup r) h\"\n by (auto intro: success_intros simp add: lookup_def)\n\nlemma effect_lookupI [effect_intros]:\n assumes \"h' = h\" \"x = get h r\" \"n=1\"\n shows \"effect (!r) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_lookupE [effect_elims]:\n assumes \"effect (!r) h h' x n\"\n obtains \"h' = h\" \"x = get h r\" \"n=1\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_update [execute_simps]:\n \"Heap_Time_Monad.execute (update r v) h = Some ((), set r v h, 1)\"\n by (simp add: update_def execute_simps)\n\nlemma success_updateI [success_intros]:\n \"success (update r v) h\"\n by (auto intro: success_intros simp add: update_def)\n\nlemma effect_updateI [effect_intros]:\n assumes \"h' = set r v h\" \"n=1\"\n shows \"effect (r := v) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updateE [effect_elims]:\n assumes \"effect (r' := v) h h' r n\"\n obtains \"h' = set r' v h\" \"n=1\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_change [execute_simps]:\n \"Heap_Time_Monad.execute (change f r) h = Some (f (get h r), set r (f (get h r)) h, 3)\"\n by (simp add: change_def bind_def Let_def execute_simps)\n\nlemma success_changeI [success_intros]:\n \"success (change f r) h\"\n by (auto intro!: success_intros effect_intros simp add: change_def)\n\nlemma effect_changeI [effect_intros]: \n assumes \"h' = set r (f (get h r)) h\" \"x = f (get h r)\" \"n=3\"\n shows \"effect (change f r) h h' x n\"\n by (rule effectI) (insert assms, simp add: execute_simps) \n\nlemma effect_changeE [effect_elims]:\n assumes \"effect (change f r') h h' r n\"\n obtains \"h' = set r' (f (get h r')) h\" \"r = f (get h r')\" \"n=3\"\n using assms by (rule effectE) (simp add: execute_simps)\n\nlemma lookup_chain:\n \"(!r \\ f) = wait 1 \\ f\"\n by (rule Heap_eqI) (auto simp add: lookup_def execute_simps intro: execute_bind)\n\n(* this one is wrong! \nlemma update_change [code]:\n \"r := e = change (\\_. e) r \\ return ()\"\n by (rule Heap_eqI) (simp add: change_def lookup_chain)\n*)\n\ntext \\Non-interaction between imperative arrays and imperative references\\\n\nlemma array_get_set [simp]:\n \"Array_Time.get (set r v h) = Array_Time.get h\"\n by (simp add: Array_Time.get_def set_def fun_eq_iff)\n\nlemma get_update [simp]:\n \"get (Array_Time.update a i v h) r = get h r\"\n by (simp add: get_def Array_Time.update_def Array_Time.set_def)\n\nlemma alloc_update:\n \"fst (alloc v (Array_Time.update a i v' h)) = fst (alloc v h)\"\n by (simp add: Array_Time.update_def Array_Time.get_def Array_Time.set_def alloc_def Let_def)\n\nlemma update_set_swap:\n \"Array_Time.update a i v (set r v' h) = set r v' (Array_Time.update a i v h)\"\n by (simp add: Array_Time.update_def Array_Time.get_def Array_Time.set_def set_def)\n\nlemma length_alloc [simp]: \n \"Array_Time.length (snd (alloc v h)) a = Array_Time.length h a\"\n by (simp add: Array_Time.length_def Array_Time.get_def alloc_def set_def Let_def)\n\nlemma array_get_alloc [simp]: \n \"Array_Time.get (snd (alloc v h)) = Array_Time.get h\"\n by (simp add: Array_Time.get_def alloc_def set_def Let_def fun_eq_iff)\n\nlemma present_update [simp]: \n \"present (Array_Time.update a i v h) = present h\"\n by (simp add: Array_Time.update_def Array_Time.set_def fun_eq_iff present_def)\n\nlemma array_present_set [simp]:\n \"Array_Time.present (set r v h) = Array_Time.present h\"\n by (simp add: Array_Time.present_def set_def fun_eq_iff)\n\nlemma array_present_alloc [simp]:\n \"Array_Time.present h a \\ Array_Time.present (snd (alloc v h)) a\"\n by (simp add: Array_Time.present_def alloc_def Let_def)\n\nlemma set_array_set_swap:\n \"Array_Time.set a xs (set r x' h) = set r x' (Array_Time.set a xs h)\"\n by (simp add: Array_Time.set_def set_def)\n\nhide_const (open) present get set alloc noteq lookup update change\n\n\nsubsection \\Code generator setup\\\n\ntext \\Intermediate operation avoids invariance problem in \\Scala\\ (similar to value restriction)\\\n\ndefinition ref' where\n [code del]: \"ref' = ref\"\n\n\n\n\ntext \\SML / Eval\\\n\ncode_printing type_constructor ref \\ (SML) \"_/ ref\"\ncode_printing type_constructor ref \\ (Eval) \"_/ Unsynchronized.ref\"\ncode_printing constant Ref \\ (SML) \"raise/ (Fail/ \\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (SML) \"(fn/ ()/ =>/ ref/ _)\"\ncode_printing constant ref' \\ (Eval) \"(fn/ ()/ =>/ Unsynchronized.ref/ _)\"\ncode_printing constant Ref_Time.lookup \\ (SML) \"(fn/ ()/ =>/ !/ _)\"\ncode_printing constant Ref_Time.update \\ (SML) \"(fn/ ()/ =>/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (SML) infixl 6 \"=\"\n\ncode_reserved Eval Unsynchronized\n\n\ntext \\OCaml\\\n\ncode_printing type_constructor ref \\ (OCaml) \"_/ ref\"\ncode_printing constant Ref \\ (OCaml) \"failwith/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (OCaml) \"(fun/ ()/ ->/ ref/ _)\"\ncode_printing constant Ref_Time.lookup \\ (OCaml) \"(fun/ ()/ ->/ !/ _)\"\ncode_printing constant Ref_Time.update \\ (OCaml) \"(fun/ ()/ ->/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml ref\n\n\ntext \\Haskell\\\n\ncode_printing type_constructor ref \\ (Haskell) \"Heap.STRef/ Heap.RealWorld/ _\"\ncode_printing constant Ref \\ (Haskell) \"error/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\ (Haskell) \"Heap.newSTRef\"\ncode_printing constant Ref_Time.lookup \\ (Haskell) \"Heap.readSTRef\"\ncode_printing constant Ref_Time.update \\ (Haskell) \"Heap.writeSTRef\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Haskell) infix 4 \"==\"\ncode_printing class_instance ref :: HOL.equal \\ (Haskell) -\n\n\ntext \\Scala\\\n\ncode_printing type_constructor ref \\ (Scala) \"!Ref[_]\"\ncode_printing constant Ref \\ (Scala) \"!sys.error(\\\"bare Ref\\\")\"\ncode_printing constant ref' \\ (Scala) \"('_: Unit)/ =>/ Ref((_))\"\ncode_printing constant Ref_Time.lookup \\ (Scala) \"('_: Unit)/ =>/ Ref.lookup((_))\"\ncode_printing constant Ref_Time.update \\ (Scala) \"('_: Unit)/ =>/ Ref.update((_), (_))\"\ncode_printing constant \"HOL.equal :: 'a ref \\ 'a ref \\ bool\" \\ (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "bzhan", "repo": "Imperative_HOL_Time", "sha": "09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec", "save_path": "github-repos/isabelle/bzhan-Imperative_HOL_Time", "path": "github-repos/isabelle/bzhan-Imperative_HOL_Time/Imperative_HOL_Time-09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec/Ref_Time.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27172933061375243}} {"text": "(* Author: Pascal Stoop, ETH Zurich\n Author: Andreas Lochbihler, Digital Asset *)\n\nsection \\Lazy types in generated code\\\n\ntheory Code_Lazy\nimports Case_Converter\nkeywords\n \"code_lazy_type\"\n \"activate_lazy_type\"\n \"deactivate_lazy_type\"\n \"activate_lazy_types\"\n \"deactivate_lazy_types\"\n \"print_lazy_types\" :: thy_decl\nbegin\n\ntext \\\n This theory and the CodeLazy tool described in \\<^cite>\\\"LochbihlerStoop2018\"\\.\n\n It hooks into Isabelle's code generator such that the generated code evaluates a user-specified\n set of type constructors lazily, even in target languages with eager evaluation.\n The lazy type must be algebraic, i.e., values must be built from constructors and a\n corresponding case operator decomposes them. Every datatype and codatatype is algebraic\n and thus eligible for lazification.\n\\\n\nsubsection \\The type \\lazy\\\\\n\ntypedef 'a lazy = \"UNIV :: 'a set\" ..\nsetup_lifting type_definition_lazy\nlift_definition delay :: \"(unit \\ 'a) \\ 'a lazy\" is \"\\f. f ()\" .\nlift_definition force :: \"'a lazy \\ 'a\" is \"\\x. x\" .\n\ncode_datatype delay\nlemma force_delay [code]: \"force (delay f) = f ()\" by transfer (rule refl)\nlemma delay_force: \"delay (\\_. force s) = s\" by transfer (rule refl)\n\ndefinition termify_lazy2 :: \"'a :: typerep lazy \\ term\"\n where \"termify_lazy2 x =\n Code_Evaluation.App (Code_Evaluation.Const (STR ''Code_Lazy.delay'') (TYPEREP((unit \\ 'a) \\ 'a lazy)))\n (Code_Evaluation.Const (STR ''Pure.dummy_pattern'') (TYPEREP((unit \\ 'a))))\"\n\ndefinition termify_lazy ::\n \"(String.literal \\ 'typerep \\ 'term) \\\n ('term \\ 'term \\ 'term) \\\n (String.literal \\ 'typerep \\ 'term \\ 'term) \\\n 'typerep \\ ('typerep \\ 'typerep \\ 'typerep) \\ ('typerep \\ 'typerep) \\\n ('a \\ 'term) \\ 'typerep \\ 'a :: typerep lazy \\ 'term \\ term\"\n where \"termify_lazy _ _ _ _ _ _ _ _ x _ = termify_lazy2 x\"\n\ndeclare [[code drop: \"Code_Evaluation.term_of :: _ lazy \\ _\"]]\n\nlemma term_of_lazy_code [code]:\n \"Code_Evaluation.term_of x \\\n termify_lazy\n Code_Evaluation.Const Code_Evaluation.App Code_Evaluation.Abs\n TYPEREP(unit) (\\T U. typerep.Typerep (STR ''fun'') [T, U]) (\\T. typerep.Typerep (STR ''Code_Lazy.lazy'') [T])\n Code_Evaluation.term_of TYPEREP('a) x (Code_Evaluation.Const (STR '''') (TYPEREP(unit)))\"\n for x :: \"'a :: {typerep, term_of} lazy\"\n by (rule term_of_anything)\n\ntext \\\n The implementations of \\<^typ>\\_ lazy\\ using language primitives cache forced values.\n\n Term reconstruction for lazy looks into the lazy value and reconstructs it to the depth it has been evaluated.\n This is not done for Haskell as we do not know of any portable way to inspect whether a lazy value\n has been evaluated to or not.\n\\\n\ncode_printing code_module Lazy \\ (SML)\n\\signature LAZY =\nsig\n type 'a lazy;\n val lazy : (unit -> 'a) -> 'a lazy;\n val force : 'a lazy -> 'a;\n val peek : 'a lazy -> 'a option\n val termify_lazy : \n (string -> 'typerep -> 'term) -> \n ('term -> 'term -> 'term) -> \n (string -> 'typerep -> 'term -> 'term) ->\n 'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->\n ('a -> 'term) -> 'typerep -> 'a lazy -> 'term -> 'term;\nend;\n\nstructure Lazy : LAZY = \nstruct\n\ndatatype 'a content =\n Delay of unit -> 'a\n | Value of 'a \n | Exn of exn;\n\ndatatype 'a lazy = Lazy of 'a content ref;\n\nfun lazy f = Lazy (ref (Delay f));\n\nfun force (Lazy x) = case !x of\n Delay f => (\n let val res = f (); val _ = x := Value res; in res end\n handle exn => (x := Exn exn; raise exn))\n | Value x => x\n | Exn exn => raise exn;\n\nfun peek (Lazy x) = case !x of\n Value x => SOME x\n | _ => NONE;\n\nfun termify_lazy const app abs unitT funT lazyT term_of T x _ =\n app (const \"Code_Lazy.delay\" (funT (funT unitT T) (lazyT T))) \n (case peek x of SOME y => abs \"_\" unitT (term_of y)\n | _ => const \"Pure.dummy_pattern\" (funT unitT T));\n\nend;\\ for type_constructor lazy constant delay force termify_lazy\n| type_constructor lazy \\ (SML) \"_ Lazy.lazy\"\n| constant delay \\ (SML) \"Lazy.lazy\"\n| constant force \\ (SML) \"Lazy.force\"\n| constant termify_lazy \\ (SML) \"Lazy.termify'_lazy\"\n\ncode_reserved SML Lazy\n\ncode_printing \\ \\For code generation within the Isabelle environment, we reuse the thread-safe\n implementation of lazy from \\<^file>\\~~/src/Pure/Concurrent/lazy.ML\\\\\n code_module Lazy \\ (Eval) \\\\ for constant undefined\n| type_constructor lazy \\ (Eval) \"_ Lazy.lazy\"\n| constant delay \\ (Eval) \"Lazy.lazy\"\n| constant force \\ (Eval) \"Lazy.force\"\n| code_module Termify_Lazy \\ (Eval)\n\\structure Termify_Lazy = struct\nfun termify_lazy\n (_: string -> typ -> term) (_: term -> term -> term) (_: string -> typ -> term -> term)\n (_: typ) (_: typ -> typ -> typ) (_: typ -> typ)\n (term_of: 'a -> term) (T: typ) (x: 'a Lazy.lazy) (_: term) =\n Const (\"Code_Lazy.delay\", (HOLogic.unitT --> T) --> Type (\"Code_Lazy.lazy\", [T])) $\n (case Lazy.peek x of\n SOME (Exn.Res x) => absdummy HOLogic.unitT (term_of x)\n | _ => Const (\"Pure.dummy_pattern\", HOLogic.unitT --> T));\nend;\\ for constant termify_lazy\n| constant termify_lazy \\ (Eval) \"Termify'_Lazy.termify'_lazy\"\n\ncode_reserved Eval Termify_Lazy\n\ncode_printing\n type_constructor lazy \\ (OCaml) \"_ Lazy.t\"\n| constant delay \\ (OCaml) \"Lazy.from'_fun\"\n| constant force \\ (OCaml) \"Lazy.force\"\n| code_module Termify_Lazy \\ (OCaml)\n\\module Termify_Lazy : sig\n val termify_lazy :\n (string -> 'typerep -> 'term) ->\n ('term -> 'term -> 'term) ->\n (string -> 'typerep -> 'term -> 'term) ->\n 'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->\n ('a -> 'term) -> 'typerep -> 'a Lazy.t -> 'term -> 'term\nend = struct\n\nlet termify_lazy const app abs unitT funT lazyT term_of ty x _ =\n app (const \"Code_Lazy.delay\" (funT (funT unitT ty) (lazyT ty)))\n (if Lazy.is_val x then abs \"_\" unitT (term_of (Lazy.force x))\n else const \"Pure.dummy_pattern\" (funT unitT ty));;\n\nend;;\\ for constant termify_lazy\n| constant termify_lazy \\ (OCaml) \"Termify'_Lazy.termify'_lazy\"\n\ncode_reserved OCaml Lazy Termify_Lazy\n\n\ncode_printing\n code_module Lazy \\ (Haskell) \\\nmodule Lazy(Lazy, delay, force) where\n\nnewtype Lazy a = Lazy a\ndelay f = Lazy (f ())\nforce (Lazy x) = x\\ for type_constructor lazy constant delay force\n| type_constructor lazy \\ (Haskell) \"Lazy.Lazy _\"\n| constant delay \\ (Haskell) \"Lazy.delay\"\n| constant force \\ (Haskell) \"Lazy.force\"\n\ncode_reserved Haskell Lazy\n\ncode_printing\n code_module Lazy \\ (Scala) \n\\object Lazy {\n final class Lazy[A] (f: Unit => A) {\n var evaluated = false;\n lazy val x: A = f(())\n\n def get() : A = {\n evaluated = true;\n return x\n }\n }\n\n def force[A] (x: Lazy[A]) : A = {\n return x.get()\n }\n\n def delay[A] (f: Unit => A) : Lazy[A] = {\n return new Lazy[A] (f)\n }\n\n def termify_lazy[Typerep, Term, A] (\n const: String => Typerep => Term,\n app: Term => Term => Term,\n abs: String => Typerep => Term => Term,\n unitT: Typerep,\n funT: Typerep => Typerep => Typerep,\n lazyT: Typerep => Typerep,\n term_of: A => Term,\n ty: Typerep,\n x: Lazy[A],\n dummy: Term) : Term = {\n if (x.evaluated)\n app(const(\"Code_Lazy.delay\")(funT(funT(unitT)(ty))(lazyT(ty))))(abs(\"_\")(unitT)(term_of(x.get())))\n else\n app(const(\"Code_Lazy.delay\")(funT(funT(unitT)(ty))(lazyT(ty))))(const(\"Pure.dummy_pattern\")(funT(unitT)(ty)))\n }\n}\\ for type_constructor lazy constant delay force termify_lazy\n| type_constructor lazy \\ (Scala) \"Lazy.Lazy[_]\"\n| constant delay \\ (Scala) \"Lazy.delay\"\n| constant force \\ (Scala) \"Lazy.force\"\n| constant termify_lazy \\ (Scala) \"Lazy.termify'_lazy\"\n\ncode_reserved Scala Lazy\n\ntext \\Make evaluation with the simplifier respect \\<^term>\\delay\\s.\\\n\nlemma delay_lazy_cong: \"delay f = delay f\" by simp\nsetup \\Code_Simp.map_ss (Simplifier.add_cong @{thm delay_lazy_cong})\\ \n\nsubsection \\Implementation\\\n\nML_file \\code_lazy.ML\\\n\nsetup \\\n Code_Preproc.add_functrans (\"lazy_datatype\", Code_Lazy.transform_code_eqs)\n\\\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Library/Code_Lazy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27172933061375243}} {"text": "(* Title: BDD\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* \nNormalizeTotalProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Proof of Procedure Normalize *}\ntheory NormalizeTotalProof imports LevellistProof ShareReduceRepListProof \n RepointProof begin\n\nhide_const (open) DistinctTreeProver.set_of tree.Node tree.Tip\n\nlemma (in Normalize_impl) Normalize_modifies:\n shows\n \"\\\\. \\\\{\\} \\p :== PROC Normalize (\\p) \n {t. t may_only_modify_globals \\ in [rep,mark,low,high,next]}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\nlemma (in Normalize_impl) Normalize_spec: \n shows \"\\\\ pret prebdt. \\\\\\<^sub>t\n \\\\. Dag \\p \\low \\high pret \\ ordered pret \\var \\ \n \\p \\ Null \\ (\\n. n \\ set_of pret \\ \\mark n = \\mark \\p) \\ \n bdt pret \\var = Some prebdt\\ \n \\p :== PROC Normalize(\\p)\n \\(\\pt. pt \\ set_of pret \n \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt \\ \\<^bsup>\\\\<^esup>low pt = \\low pt \\ \\<^bsup>\\\\<^esup>high pt = \\high pt \\ \n \\<^bsup>\\\\<^esup>mark pt = \\mark pt \\ \\<^bsup>\\\\<^esup>next pt = \\next pt) \\ \n (\\postt. Dag \\p \\low \\high postt \\ reduced postt \\ \n shared postt \\<^bsup>\\\\<^esup>var \\ ordered postt \\<^bsup>\\\\<^esup>var \\\n set_of postt \\ set_of pret \\ \n (\\postbdt. bdt postt \\<^bsup>\\\\<^esup>var = Some postbdt \\ prebdt \\ postbdt)) \\ \n (\\ no. no \\ set_of pret \\ \\mark no = (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p)) \\\"\n apply (hoare_rule HoareTotal.ProcNoRec1)\n apply (hoare_rule anno=\"\n \\levellist :==replicate (\\p\\\\var + 1) Null;;\n \\levellist :== CALL Levellist (\\p, (\\ \\p\\\\mark) , \\levellist);;\n (ANNO (\\,ll). \\\\. Levellist \\levellist \\next ll \\\n Dag \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high pret \\ ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (bdt pret \\<^bsup>\\\\<^esup>var = Some prebdt) \\ \n wf_ll pret ll \\<^bsup>\\\\<^esup>var \\ \n length \\levellist = ((\\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var) + 1) \\ \n wf_marking pret \\<^bsup>\\\\<^esup>mark \\mark (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p) \\ \n (\\pt. pt \\ set_of pret \\ \\<^bsup>\\\\<^esup>next pt = \\next pt) \\\n \\low = \\<^bsup>\\\\<^esup>low \\ \\high = \\<^bsup>\\\\<^esup>high \\ \\p = \\<^bsup>\\\\<^esup>p \\ \\rep = \\<^bsup>\\\\<^esup>rep \\ \n \\var = \\<^bsup>\\\\<^esup>var\\ \n \\n :==0;;\n WHILE (\\n < length \\levellist) \n INV \\Levellist \\levellist \\next ll \\\n Dag \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high pret \\ ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (bdt pret \\<^bsup>\\\\<^esup>var = Some prebdt) \\ wf_ll pret ll \\<^bsup>\\\\<^esup>var \\ \n length \\<^bsup>\\\\<^esup>levellist = ((\\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var) + 1) \\ \n wf_marking pret \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>mark (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p) \\\n \\<^bsup>\\\\<^esup>low = \\<^bsup>\\\\<^esup>low \\ \\<^bsup>\\\\<^esup>high = \\<^bsup>\\\\<^esup>high \\ \\<^bsup>\\\\<^esup>p = \\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>rep = \\<^bsup>\\\\<^esup>rep \\ \\<^bsup>\\\\<^esup>var = \\<^bsup>\\\\<^esup>var \\\n \\n \\ length \\<^bsup>\\\\<^esup>levellist \\\n (\\pt i. (pt \\ set_of pret \\ (\\n <= i \\ pt \\ set (ll ! i) \\\n i \\\\<^esup>levellist ) \n \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt)) \\ \n \\rep ` Nodes \\n ll \\ Nodes \\n ll \\ \n (\\no \\ Nodes \\n ll.\n no\\\\rep\\\\<^bsup>\\\\<^esup>var <= no\\\\<^bsup>\\\\<^esup>var \\ \n (\\not nort. Dag (\\rep no) (\\rep \\ \\<^bsup>\\\\<^esup>low ) (\\rep \\ \\<^bsup>\\\\<^esup>high ) nort \\\n Dag no \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high not \\ reduced nort \\ \n ordered nort \\<^bsup>\\\\<^esup>var \\ set_of nort \\ \\rep ` Nodes \\n ll \\ \n (\\ no \\ set_of nort. \\rep no = no) \\ \n (\\nobdt norbdt. bdt not \\<^bsup>\\\\<^esup>var = Some nobdt \\ \n bdt nort \\<^bsup>\\\\<^esup>var = Some norbdt \\ nobdt \\ norbdt))) \\\n (\\t1 t2. \n t1\\Dags (\\rep `(Nodes \\n ll))(\\rep \\ \\<^bsup>\\\\<^esup>low )(\\rep \\ \\<^bsup>\\\\<^esup>high)\\\n t2\\Dags (\\rep `(Nodes \\n ll))(\\rep \\ \\<^bsup>\\\\<^esup>low )(\\rep \\ \\<^bsup>\\\\<^esup>high)\n \\ \n isomorphic_dags_eq t1 t2 \\<^bsup>\\\\<^esup>var) \\\n \\levellist = \\<^bsup>\\\\<^esup>levellist \\ \\next = \\<^bsup>\\\\<^esup>next \\ \\mark = \\<^bsup>\\\\<^esup>mark \\ \\low = \\<^bsup>\\\\<^esup>low \\ \n \\high = \\<^bsup>\\\\<^esup>high \\ \\p = \\<^bsup>\\\\<^esup>p \\ \\var = \\<^bsup>\\\\<^esup>var \\\n VAR MEASURE (length \\levellist - \\n)\n DO\n CALL ShareReduceRepList(\\levellist ! \\n);;\n \\n :==\\n + 1\n OD\n \\(\\postnormt. Dag (\\rep \\<^bsup>\\\\<^esup>p) (\\rep \\ \\<^bsup>\\\\<^esup>low ) (\\rep \\ \\<^bsup>\\\\<^esup>high ) postnormt \\ \n reduced postnormt \\ shared postnormt \\<^bsup>\\\\<^esup>var \\ \n ordered postnormt \\<^bsup>\\\\<^esup>var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. bdt postnormt \\<^bsup>\\\\<^esup>var = Some postnormbdt \\ prebdt \\ postnormbdt) \\\n (\\ no \\ set_of postnormt. (\\rep no = no))) \\ \n ordered pret \\<^bsup>\\\\<^esup>var \\ \\<^bsup>\\\\<^esup>p \\ Null \\ \n (\\ pt. pt \\ set_of pret \\ \\<^bsup>\\\\<^esup>rep pt = \\rep pt) \\ \n \\levellist = \\<^bsup>\\\\<^esup>levellist \\ \\next = \\<^bsup>\\\\<^esup>next \\ \\mark = \\<^bsup>\\\\<^esup>mark \\ \\low = \\<^bsup>\\\\<^esup>low \\ \\high = \\<^bsup>\\\\<^esup>high \\\n \\p = \\<^bsup>\\\\<^esup>p \\ (\\ no. no \\ set_of pret \\ \\mark no = (\\ \\<^bsup>\\\\<^esup>mark \\<^bsup>\\\\<^esup>p)) \\)\n ;;\n \\p :== CALL Repoint (\\p)\"\n in HoareTotal.annotateI)\n apply (vcg spec=spec_total)\n prefer 2\n (*from precondition of inner spec to invariant *)\n apply (simp add: Nodes_def null_comp_def)\n (*from inner spec to postcondition *) \n apply (rule_tac x=pret in exI)\n apply clarify\n apply (rule conjI)\n apply clarsimp\n apply (case_tac i)\n apply simp\n apply simp\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply clarify\n apply (simp (no_asm_use) only: simp_thms) \n apply (rule_tac x=\"ll\" in exI)\n apply (rule conjI)\n apply assumption\n apply clarify\n apply (simp only: simp_thms triv_forall_equality True_implies_equals) \n apply (rule_tac x=postnormt in exI)\n apply (rule conjI)\n apply simp\n apply (rule conjI)\n apply simp\n apply clarify\n apply (simp (no_asm_simp))\n prefer 2\n (*while-while-Fall: while nb und Schleifenbdg gelten \\ while (nb+1)*)\n apply clarify\n apply (simp only: simp_thms triv_forall_equality True_implies_equals)\n apply (rule_tac x=\"ll!n\" in exI)\n apply (rule conjI)\n apply (simp add: Levellist_def)\n prefer 3\n (*while-end-Fall: INV nb gilt und Schleifenbdg falsch \\ Nachbdg while*)\n apply (clarify)\n apply (simp (no_asm_use) only: simp_thms triv_forall_equality True_implies_equals) \nproof -\n -- {* End of while (invariant + false condition) to end of inner SPEC *}\n fix var p rep mark vara lowa higha pa levellista repa marka nexta varb ll \n nb pret prebdt and low :: \"ref \\ ref\" and \n high :: \"ref \\ ref\" and repb :: \"ref \\ ref\"\n assume ll: \"Levellist levellista nexta ll\"\n assume wf_lla: \"wf_ll pret ll var\"\n assume length_lla: \"length levellista = var p + 1\"\n assume ord_pret: \"ordered pret var\"\n assume pnN: \" p \\ Null\"\n assume rep_repb_nc: \n \"\\pt i. pt \\ set_of pret \\ nb \\ i \\ pt \\ set (ll ! i) \\ \n i < length levellista \n \\ rep pt = repb pt\"\n\n assume wf_marking_prop: \" wf_marking pret mark marka (\\ mark p)\"\n assume pret_dag: \"Dag p low high pret\"\n assume prebdt: \"bdt pret var = Some prebdt\"\n assume not_nbslla: \"\\ nb < length levellista\"\n assume nb_le_lla: \" nb \\ length levellista\"\n \n assume normalize_prop: \"\\no\\Nodes nb ll.\n var (repb no) \\ var no \\\n (\\not nort. Dag (repb no) (repb \\ low) (repb \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\ \n set_of nort \\ repb ` Nodes nb ll \\ \n (\\no\\set_of nort. repb no = no) \\ \n (\\nobdt norbdt. bdt not var = Some nobdt \\ \n bdt nort var = Some norbdt \\ nobdt \\ norbdt))\"\n assume repbNodes_in_Nodes: \" repb ` Nodes nb ll \\ Nodes nb ll\"\n assume shared_mult_dags: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \\ \n t2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n show \"(\\postnormt. Dag (repb p) (repb \\ low) (repb \\ high) postnormt \\\n reduced postnormt \\ shared postnormt var \\\n ordered postnormt var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. \n bdt postnormt var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\ no \\ set_of postnormt. repb no = no)) \\\n ordered pret var \\ p \\ Null \\ \n (\\pt. pt \\ set_of pret \\ rep pt = repb pt) \\ \n (\\no. no \\ set_of pret \\ marka no = (\\ mark p))\"\n\n proof -\n from ll have length_ll_eq: \"length levellista = length ll\"\n by (simp add: Levellist_length)\n from rep_repb_nc have rep_nc_post: \"\\pt. pt \\ set_of pret \\ rep pt = repb pt\"\n by auto\n from pnN pret_dag obtain lt rt where pret_def: \"pret = Node lt p rt\"\n by auto\n from wf_marking_prop pret_def \n have marking_inverted: \"(\\no. no \\ set_of pret \\ marka no = (\\ mark p))\"\n by (simp add: wf_marking_def)\n from not_nbslla nb_le_lla have nb_length_lla: \"nb = length levellista\"\n by simp\n with length_lla have varp_s_nb: \"var p < nb\"\n by simp\n from pret_def have p_in_pret: \"p \\ set_of pret\"\n by simp\n with wf_lla have \"p \\ set (ll ! (var p))\" \n by (simp add: wf_ll_def)\n with varp_s_nb have p_in_Nodes: \"p \\ Nodes nb ll\"\n by (auto simp add: Nodes_def)\n with normalize_prop obtain not nort where\n varrepno_varno: \" var (repb p) \\ var p\" and\n nort_dag: \"Dag (repb p) (repb \\ low) (repb \\ high) nort\" and\n not_dag: \" Dag p low high not\" and\n red_nort: \"reduced nort\" and\n ord_nort: \"ordered nort var\" and\n nort_in_repNodes: \" set_of nort \\ repb ` Nodes nb ll\" and\n nort_repb: \"(\\no\\set_of nort. repb no = no)\" and\n bdt_prop: \"\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = Some norbdt \\\n nobdt \\ norbdt\"\n by auto\n \n from wf_lla nb_length_lla have Nodes_in_pret: \"Nodes nb ll \\ set_of pret\"\n apply -\n apply (rule Nodes_in_pret)\n apply (auto simp add: length_ll_eq)\n done\n from pret_dag wf_lla nb_length_lla have \"Null \\ Nodes nb ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n with p_in_Nodes repbNodes_in_Nodes have rp_nNull: \"repb p \\ Null\"\n by auto\n with nort_dag have nort_nTip: \"nort\\ Tip\"\n by auto\n have \"\\postnormt. Dag (repb p) (repb \\ low) (repb \\ high) postnormt \\\n reduced postnormt \\ shared postnormt var \\\n ordered postnormt var \\ set_of postnormt \\ set_of pret \\ \n (\\postnormbdt. \n bdt postnormt var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\no \\ set_of postnormt. repb no = no)\"\n proof (rule_tac x=nort in exI)\n from nort_in_repNodes repbNodes_in_Nodes Nodes_in_pret \n have nort_in_pret: \"set_of nort \\ set_of pret\"\n by blast\n from not_dag pret_dag have not_pret: \"not = pret\"\n by (simp add: Dag_unique)\n with bdt_prop prebdt have pret_bdt_prop: \n \"\\postnormbdt.\n bdt nort var = Some postnormbdt \\ prebdt \\ postnormbdt\"\n by auto\n from shared_mult_dags have \"shared nort var\"\n proof (auto simp add: shared_def isomorphic_dags_eq_def)\n fix st1 st2 bdt1\n assume shared_imp: \n \"\\t1 t2. t1\\Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high) \\ \n t2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\n \\\n (\\bdt1. bdt t1 var = Some bdt1 \\ bdt t2 var = Some bdt1) \\ t1 = t2\"\n assume st1_nort: \" st1 \\ nort\"\n assume st2_nort: \"st2 \\ nort\"\n assume bdt_st1: \"bdt st1 var = Some bdt1\"\n assume bdt_st2: \" bdt st2 var = Some bdt1\"\n from nort_in_repNodes nort_dag nort_nTip \n have nort_in_DagsrNodes: \n \"nort \\ Dags (repb `(Nodes nb ll)) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done\n show \"st1 = st2\"\n proof (cases st1)\n case Tip\n note st1_Tip=this\n with bdt_st1 bdt_st2 show ?thesis\n by auto\n next\n case (Node lst1 st1p rst1)\n note st1_Node=this\n then have st1_nTip: \"st1 \\ Tip\"\n by simp\n show ?thesis\n proof (cases st2)\n case Tip\n with bdt_st1 bdt_st2 show ?thesis\n by auto\n next\n case (Node lst2 st2p rst2)\n note st2_Node=this\n then have st2_nTip: \"st2 \\ Tip\"\n by simp \n from nort_in_DagsrNodes st1_nort ord_nort wf_lla st1_nTip \n have st1_in_Dags: \n \"st1 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule Dags_subdags)\n apply auto\n done\n from nort_in_DagsrNodes st2_nort ord_nort wf_lla st2_nTip \n have st2_in_Dags: \n \"st2 \\ Dags (repb ` Nodes nb ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply (rule Dags_subdags) \n apply auto\n done\n from st1_in_Dags st2_in_Dags bdt_st1 bdt_st2 shared_imp show \"st1=st2\"\n by simp\n qed\n qed\n qed\n with nort_dag red_nort ord_nort nort_in_pret pret_bdt_prop nort_repb \n show \"Dag (repb p) (repb \\ low) (repb \\ high) nort \\\n reduced nort \\ shared nort var \\ ordered nort var \\ \n set_of nort \\ set_of pret \\ \n (\\postnormbdt. \n bdt nort var = Some postnormbdt \\ prebdt \\ postnormbdt) \\ \n (\\no \\ set_of nort. repb no = no)\"\n apply -\n apply (intro conjI)\n apply assumption+\n done\n qed\n with wf_lla length_lla ord_pret pnN rep_nc_post marking_inverted\n show ?thesis\n by simp\n qed\nnext\n -- {* From postcondition inner SPEC to final postcondition *}\n fix var low high p rep levellist marka \"next\" \n nexta lowb highb pb levellista ll repa pret prebdt \n and mark::\"ref\\bool\" and postnormt postnormbdt\n assume ll: \"Levellist levellista nexta ll\"\n assume repoint_spec: \n \"Dag pb lowb highb postnormt\"\n \"\\pt. pt \\ set_of postnormt \\ low pt = lowb pt \\ high pt = highb pt\"\n assume pret_dag: \"Dag p low high pret\"\n assume ord_pret: \"ordered pret var\"\n assume pnN: \" p \\ Null\"\n assume onemark_pret: \n \"\\n. n \\ set_of pret \\ mark n = mark p\" (is \"\\n. ?in_pret n \\ ?eq_mark_p n\")\n assume pret_bdt: \" bdt pret var = Some prebdt\"\n \n assume wf_ll: \"wf_ll pret ll var\" and\n length_ll:\"length levellist =var p + 1\" and\n wf_marking_ll: \"wf_marking pret mark marka (\\ mark p)\"\n assume \n postnormt_dag: \"Dag (repa p) (repa \\ low) (repa \\ high) postnormt\" and\n reduced_postnormt: \"reduced postnormt\" and\n shared_postnormt: \"shared postnormt var\" and\n ordered_postnormt: \"ordered postnormt var\" and\n subset_pret: \"set_of postnormt \\ set_of pret\"and\n sim_bdt: \"bdt postnormt var = Some postnormbdt\" \"prebdt \\ postnormbdt\" and\n postdag_repa: \"\\no \\ set_of postnormt. repa no = no\" and\n rep_eq: \"\\pt. pt \\ set_of pret \\ rep pt = repa pt\" and\n pret_marked: \"\\no. no \\ set_of pret \\ marka no = (\\ mark p)\"\n assume unmodif_next: \"\\p. p \\ set_of pret \\ next p = nexta p\"\n show \"(\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt \\ \n mark pt = marka pt ) \"\n\n proof -\n from ll have length_ll_eq: \"length levellista = length ll\"\n by (simp add: Levellist_length)\n from repoint_spec pnN subset_pret\n have repoint_nc: \"(\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt) \\ Dag pb lowb highb postnormt\"\n by auto\n then have lowhigh_b_eq: \"\\pt. pt \\ set_of pret \n \\ low pt = lowb pt \\ high pt = highb pt\"\n by fastforce\n from wf_marking_ll pret_dag pnN \n have mark_b_eq: \"\\pt. pt \\ set_of pret \\ mark pt = marka pt\"\n apply -\n apply (simp add: wf_marking_def)\n apply (split dag.splits)\n apply simp\n apply (rule allI)\n apply (rule impI)\n apply (elim conjE)\n apply (erule_tac x=pt in allE)\n apply fastforce\n done\n with lowhigh_b_eq rep_eq unmodif_next\n have pret_nc: \"\\pt. pt \\ set_of pret \n \\ rep pt = repa pt \\ low pt = lowb pt \\ high pt = highb pt \\ \n mark pt = marka pt \\ next pt = nexta pt\"\n by blast\n(* from repoint_nc have rept_dag: \"Dag pb lowb highb postnormt\"\n by simp\n with reduced_postnormt shared_postnormt ordered_postnormt subset_pret sim_bdt \n pret_bdt \n have post_same_prop: \n \"\\postt. Dag pb lowb highb postt \\ reduced postt \\\n shared postt var \\ ordered postt var \\ set_of postt \\ set_of pret \\\n (\\postbdt. bdt postt var = Some postbdt \\ prebdt \\ postbdt)\" \n apply -\n apply (rule_tac x=postnormt in exI)\n apply fastforce\n done*)\n from pret_nc \n show ?thesis\n by fastforce\n qed\nnext\n -- {* invariant to invariant *}\n fix var low high p rep mark pret prebdt levellist ll \"next\" marka n repc \n and repb :: \"ref \\ ref\" \n assume ll: \"Levellist levellist next ll\"\n assume pret_dag: \"Dag p low high pret\"\n assume ord_pret: \" ordered pret var\"\n assume pnN: \"p \\ Null\"\n assume prebdt_pret: \"bdt pret var = Some prebdt\"\n assume wf_ll: \"wf_ll pret ll var\"\n assume lll: \"length levellist = var p + 1\"\n assume n_Suc_var_p: \"n < var p + 1\"\n assume wf_marking_m_ma: \"wf_marking pret mark marka (\\ mark p)\"\n\n(* assume rep_nc: \" \\pt. pt \\ set_of pret \\ \n (\\i. n \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repb pt\" *)\n assume rep_nc: \"\\pt i.\n pt \\ set_of pret \\ n \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1 \\\n rep pt = repb pt\"\n assume repbNodes_in_Nodes: \"repb ` Nodes n ll \\ Nodes n ll\"\n assume\n normalize_prop: \"\\no\\Nodes n ll.\n var (repb no) \\ var no \\\n (\\not nort. Dag (repb no) (repb \\ low) (repb \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repb ` Nodes n ll \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ \n nobdt \\ norbdt)))\" \n assume \n isomorphic_dags_eq: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n show \"(\\no\\set (ll ! n).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\\n high no \\ set (ll ! n) \\\n isLeaf_pt no low high = (var no \\ 1) \\\n (low no \\ Null \\ repb (low no) \\ Null) \\ (repb \\ low) no \\ set (ll ! n)) \\\n (\\no1\\set (ll ! n). \\no2\\set (ll ! n). var no1 = var no2) \\\n (\\repa. (\\no. no \\ set (ll ! n) \\ repb no = repa no) \\\n (\\no\\set (ll ! n).\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no \\ set (ll ! n) \\\n repa (repa no) = repa no \\\n (\\no1\\set (ll ! n).\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))) \\\n var p + 1 - (n + 1) < var p + 1 - n \\\n n + 1 \\ var p + 1 \\\n (\\pt i. pt \\ set_of pret \\ (n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \\\n rep pt = repa pt) \\\n repa ` Nodes (n + 1) ll \\ Nodes (n + 1) ll \\\n (\\no\\Nodes (n + 1) ll.\n var (repa no) \\ var no \\\n (\\not nort.\n Dag (repa no) (repa \\ low) (repa \\ high) nort \\\n Dag no low high not \\\n reduced nort \\\n ordered nort var \\\n set_of nort \\ repa ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repa no = no) \\\n (\\nobdt.\n bdt not var = Some nobdt \\\n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))) \\\n (\\t1 t2.\n t1 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n t2 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n isomorphic_dags_eq t1 t2 var))\"\n proof -\n from ll have length_ll_eq: \"length levellist = length ll\"\n by (simp add: Levellist_length)\n from n_Suc_var_p lll have nsll: \"n < length levellist\" by simp\n hence nseqll: \"n \\ length levellist\" by simp\n have srrl_precond: \"(\\no \\ set (ll ! n).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\\n high no \\ set (ll ! n) \\ \n isLeaf_pt no low high = (var no \\ 1) \\ \n (low no \\ Null \\ repb (low no) \\ Null) \\ \n (repb \\ low) no \\ set (ll ! n))\"\n proof (intro ballI)\n fix no\n assume no_in_lln: \"no \\ set (ll ! n)\"\n with wf_ll nsll have no_in_pret_var: \"no \\ set_of pret \\ var no = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with pret_dag have no_nNull: \"no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n from pret_dag prebdt_pret no_in_pret_var \n have balanced_no: \"(low no = Null) = (high no = Null)\"\n apply -\n apply (erule conjE)\n apply (rule_tac p=p and low=low in balanced_bdt)\n apply auto\n done\n have low_no_notin_lln: \"low no \\ set (ll ! n)\"\n proof (cases \"low no = Null\")\n case True\n note lno_Null=this\n with balanced_no have hno_Null: \"high no = Null\"\n by simp\n show ?thesis\n proof (cases \"low no \\ set (ll ! n)\") \n case True\n with wf_ll nsll have \"low no \\ set_of pret \\ var (low no) = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"low no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n with lno_Null show ?thesis\n by simp\n next\n assume lno_notin_lln: \"low no \\ set (ll ! n)\"\n then show ?thesis\n by simp\n qed\n next\n assume lno_nNull: \"low no \\ Null\"\n with balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n show ?thesis\n proof (cases \"low no \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"low no \\ set_of pret \\ var (low no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_children_smaller no_in_pret_var show ?thesis\n by simp\n next\n assume \"low no \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n qed\n have high_no_notin_lln: \"high no \\ set (ll ! n)\"\n proof (cases \"high no = Null\")\n case True\n note hno_Null=this\n with balanced_no have lno_Null: \"low no = Null\"\n by simp\n show ?thesis\n proof (cases \"high no \\ set (ll ! n)\") \n case True\n with wf_ll nsll have \"high no \\ set_of pret \\ var (high no) = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"high no \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n with hno_Null show ?thesis\n by simp\n next\n assume hno_notin_lln: \"high no \\ set (ll ! n)\"\n then show ?thesis\n by simp\n qed\n next\n assume hno_nNull: \"high no \\ Null\"\n with balanced_no have lno_nNull: \"low no \\ Null\"\n by simp\n with hno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n show ?thesis\n proof (cases \"high no \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"high no \\ set_of pret \\ var (high no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_children_smaller no_in_pret_var show ?thesis\n by simp\n next\n assume \"high no \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n qed \n from no_in_pret_var pret_dag no_nNull obtain not where \n no_dag_ex: \"Dag no low high not\"\n apply -\n apply (rotate_tac 2)\n apply (drule subnode_dag_cons)\n apply (auto simp del: Dag_Ref)\n done\n with pret_dag prebdt_pret no_in_pret_var obtain nobdt \n where nobdt_ex: \n \"bdt not var = Some nobdt\"\n apply -\n apply (drule subbdt_ex_dag_def)\n apply auto\n done\n have isLeaf_var: \"isLeaf_pt no low high = (var no \\ 1)\"\n proof\n assume no_isLeaf: \"isLeaf_pt no low high\"\n from nobdt_ex no_dag_ex no_isLeaf show \"var no \\ 1\"\n apply -\n apply (rule bdt_Some_Leaf_var_le_1)\n apply auto\n done\n next\n assume varno_le_1: \"var no \\ 1\"\n show \"isLeaf_pt no low high\"\n proof (cases \"var no = 0\")\n case True\n with nobdt_ex no_nNull no_dag_ex have \"not = Node Tip no Tip\" \n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n with no_dag_ex show \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n next\n assume \"var no \\ 0\"\n with varno_le_1 have \"var no = 1\"\n by simp\n with nobdt_ex no_nNull no_dag_ex have \"not = Node Tip no Tip\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with no_dag_ex show \"isLeaf_pt no low high\"\n by (simp add: isLeaf_pt_def)\n qed\n qed\n have repb_low_nNull: \"(low no \\ Null \\ repb (low no) \\ Null)\"\n proof\n assume lno_nNull: \"low no \\ Null\"\n with no_nNull no_in_pret_var pret_dag have lno_in_pret: \"low no \\ set_of pret\"\n apply -\n apply (rule_tac low=low in subelem_set_of_low)\n apply auto\n done\n from lno_nNull balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done \n with no_in_pret_var have var_lno_l_n: \"var (low no) set (ll ! (var (low no)))\"\n by (simp add: wf_ll_def length_ll_eq)\n with lno_in_pret var_lno_l_n have \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n hence \"repb (low no) \\ repb ` Nodes n ll\"\n by simp\n with repbNodes_in_Nodes have repb_lno_in_Nodes: \n \"repb (low no) \\ Nodes n ll\"\n by blast\n from pret_dag wf_ll nsll have \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done \n with repb_lno_in_Nodes show \"repb (low no) \\ Null\"\n by auto\n qed\n have Null_notin_lln: \"Null \\ set (ll ! n)\"\n proof (cases \"Null \\ set (ll ! n)\")\n case True\n with wf_ll nsll have \"Null \\ set_of pret \\ var (Null) = n\" \n by (simp add: wf_ll_def length_ll_eq)\n with pret_dag have \"Null \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n thus ?thesis\n by auto\n next\n assume \"Null \\ set (ll ! n)\"\n thus ?thesis\n by simp\n qed\n have \"(repb \\ low) no \\ set (ll ! n)\"\n proof (cases \"low no = Null\") \n case True\n with Null_notin_lln show ?thesis\n by (simp add: null_comp_def)\n next\n assume lno_nNull: \"low no \\ Null\"\n with no_nNull no_in_pret_var pret_dag have lno_in_pret: \"low no \\ set_of pret\"\n apply -\n apply (rule_tac low=low in subelem_set_of_low)\n apply auto\n done\n from lno_nNull have propto_eq_comp: \"(repb \\ low) no = repb (low no)\"\n by (simp add: null_comp_def)\n from lno_nNull balanced_no have hno_nNull: \"high no \\ Null\"\n by simp\n with lno_nNull pret_dag ord_pret no_in_pret_var \n have var_children_smaller: \"var (low no) < var no \\ var (high no) < var no\" \n apply -\n apply (rule var_ordered_children)\n apply auto\n done \n with no_in_pret_var have var_lno_l_n: \"var (low no) set (ll ! (var (low no)))\"\n by (simp add: wf_ll_def length_ll_eq)\n with lno_in_pret var_lno_l_n have lno_in_Nodes_n: \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n hence \"repb (low no) \\ repb ` Nodes n ll\"\n by simp\n with repbNodes_in_Nodes have repb_lno_in_Nodes: \n \"repb (low no) \\ Nodes n ll\"\n by blast\n with lno_in_Nodes_n normalize_prop have \"var (repb (low no)) \\ var (low no)\" \n by auto\n with var_lno_l_n have var_rep_lno_l_n: \" var (repb (low no)) < n\"\n by simp\n with repb_lno_in_Nodes have \"\\ k < n. repb (low no) \\ set (ll ! k)\"\n by (auto simp add: Nodes_def)\n with wf_ll propto_eq_comp nsll show \" (repb \\ low) no \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n qed\n with no_nNull balanced_no low_no_notin_lln high_no_notin_lln isLeaf_var repb_low_nNull\n show \" no \\ Null \\\n (low no = Null) = (high no = Null) \\\n low no \\ set (ll ! n) \\ high no \\ set (ll ! n) \\ \n isLeaf_pt no low high = (var no \\ 1) \\ \n (low no \\ Null \\ repb (low no) \\ Null) \\ \n (repb \\ low) no \\ set (ll ! n)\"\n by auto\n qed\n have all_nodes_same_var: \"\\no1 \\ set (ll ! n). \\no2 \\ set (ll ! n). var no1 = var no2\"\n proof (intro ballI impI)\n fix no1 no2\n assume \"no1 \\ set (ll ! n)\"\n with wf_ll nsll have var_lln_i: \"var no1 = n\"\n by (simp add: wf_ll_def length_ll_eq)\n assume \"no2 \\ set (ll ! n)\"\n with wf_ll nsll have \"var no2 = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with var_lln_i show \" var no1 = var no2\"\n by simp\n qed\n have \"(\\repa. (\\no. no \\ set (ll ! n) \\ repb no = repa no) \\\n (\\no\\set (ll ! n).\n repa no \\ Null \\\n (if (repa \\ low) no = (repa \\ high) no \\ low no \\ Null\n then repa no = (repa \\ low) no\n else repa no \\ set (ll ! n) \\\n repa (repa no) = repa no \\\n (\\no1\\set (ll ! n).\n ((repa \\ high) no1 = (repa \\ high) no \\\n (repa \\ low) no1 = (repa \\ low) no) =\n (repa no = repa no1)))) \\\n var p + 1 - (n + 1) < var p + 1 - n \\\n n + 1 \\ var p + 1 \\\n (\\pt i. pt \\ set_of pret \\ (n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \\\n rep pt = repa pt) \\\n repa ` Nodes (n + 1) ll \\ Nodes (n + 1) ll \\\n (\\no\\Nodes (n + 1) ll.\n var (repa no) \\ var no \\\n (\\not nort.\n Dag (repa no) (repa \\ low) (repa \\ high) nort \\\n Dag no low high not \\\n reduced nort \\\n ordered nort var \\\n set_of nort \\ repa ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repa no = no) \\\n (\\nobdt.\n bdt not var = Some nobdt \\\n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))) \\\n (\\t1 t2.\n t1 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n t2 \\ Dags (repa ` Nodes (n + 1) ll) (repa \\ low) (repa \\ high) \\\n isomorphic_dags_eq t1 t2 var))\"\n (is \"(\\repc. ?srrl_post repc \\ ?norm_inv repc) \") \n proof (intro allI impI, elim conjE)\n fix repc\n assume repbc_nc: \"\\no. no \\ set (ll ! n) \\ repb no = repc no\"\n assume rep_prop: \" \\no\\set (ll ! n).\n repc no \\ Null \\\n (if (repc \\ low) no = (repc \\ high) no \\ low no \\ Null\n then repc no = (repc \\ low) no\n else repc no \\ set (ll ! n) \\\n repc (repc no) = repc no \\\n (\\no1\\set (ll ! n).\n ((repc \\ high) no1 = (repc \\ high) no \\\n (repc \\ low) no1 = (repc \\ low) no) =\n (repc no = repc no1)))\"\n show \"?norm_inv repc\"\n proof -\n from n_Suc_var_p have termi: \"var p + 1 - (n + 1) < var p + 1 - n\"\n by arith\n from wf_ll repbc_nc nsll \n have Nodes_n_rep_nc: \"\\p. p \\ Nodes n ll \\ repb p = repc p\"\n apply -\n apply (rule allI)\n apply (rule impI)\n apply (simp add: Nodes_def)\n apply (erule exE)\n apply (erule_tac x=p in allE)\n apply (drule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n from repbNodes_in_Nodes \n have Nodes_n_rep_in_Nodesn: \n \"\\ p. p \\ Nodes n ll \\ repb p \\ Nodes n ll\"\n by auto\n from wf_ll nsll have \"Nodes n ll \\ set_of pret\"\n apply -\n apply (rule Nodes_in_pret)\n apply (auto simp add: length_ll_eq)\n done\n with Nodes_n_rep_in_Nodesn \n have Nodes_n_rep_in_pret: \"\\p. p \\ Nodes n ll \\ repb p \\ set_of pret\"\n apply -\n apply (intro allI impI)\n apply blast\n done\n have Nodes_repbc_Dags_eq: \"\\p t. p \\ Nodes n ll \n \\ Dag (repb p) (repb \\ low) (repb \\ high) t = \n Dag (repc p) (repc \\ low) (repc \\ high) t\"\n proof (intro allI impI)\n fix p t\n assume p_in_Nodes: \" p \\ Nodes n ll\"\n then have repp_nc: \"repb p = repc p\"\n by (rule Nodes_n_rep_nc [rule_format])\n from p_in_Nodes normalize_prop obtain nort where\n nort_repb_dag: \"Dag (repb p) (repb \\ low) (repb \\ high) nort\" and\n nort_in_repbNodes: \"set_of nort \\ repb ` Nodes n ll\"\n apply -\n apply (erule_tac x=p in ballE)\n prefer 2\n apply auto\n done\n from nort_in_repbNodes repbNodes_in_Nodes \n have nort_in_Nodesn: \"set_of nort \\ Nodes n ll\"\n by blast\n from pret_dag wf_ll nsll have \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n with p_in_Nodes repbNodes_in_Nodes have repp_nNull: \"repb p \\ Null\"\n by auto\n from nort_repb_dag repp_nc \n have nort_repbc_dag: \"Dag (repc p) (repb \\ low) (repb \\ high) nort\"\n by simp\n from nort_in_Nodesn have \"\\x \\ set_of nort. x \\ Nodes n ll\"\n apply -\n apply (rule ballI)\n apply blast\n done\n with wf_ll nsll have \"\\x \\ set_of nort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret nort_repbc_dag ord_pret wf_ll nsll repbc_nc \n have \n \"\\ x \\ set_of nort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with nort_repbc_dag repp_nc \n have \"Dag (repc p) (repb \\ low) (repb \\ high) nort = \n Dag (repc p) (repc \\ low) (repc \\ high) nort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply (rule ballI)\n apply (erule_tac x=x in ballE)\n apply (elim conjE)\n apply (rule conjI)\n apply auto\n done\n with nort_repbc_dag repp_nc show \n \"Dag (repb p) (repb \\ low) (repb \\ high) t = \n Dag (repc p) (repc \\ low) (repc \\ high) t\"\n apply auto\n apply (rotate_tac 2)\n apply (frule_tac Dag_unique)\n apply (rotate_tac 1)\n apply simp\n apply simp\n apply (frule Dag_unique)\n apply (rotate_tac 3)\n apply simp\n apply simp\n done\n qed\n from rep_prop have repbc_changes: \"\\no\\set (ll ! n).\n repc no \\ Null \\\n (if (repc \\ low) no = (repc \\ high) no \\ low no \\ Null \n then repc no = (repc \\ low) no\n else repc no \\ set (ll ! n) \\ repc (repc no) = repc no \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) no \\ \n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1)))\"\n by blast\n from nsll lll have n_var_prop: \"n + 1 <= var p + 1\"\n by simp\n from rep_nc have Sucn_repb_nc: \"(\\pt. pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repb pt)\" \n apply -\n apply (intro allI impI)\n apply (erule_tac x=pt in allE)\n apply auto\n apply (rule_tac x=\"i\" in exI)\n apply auto\n done\n have repc_nc: \n \"(\\pt. pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1) \n \\ rep pt = repc pt)\" \n proof (intro allI impI)\n fix pt \n assume pt_notin_lower_ll: \"pt \\ set_of pret \\ \n (\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1)\"\n show \"rep pt = repc pt\"\n proof (cases \"pt \\ set_of pret\")\n case True\n with wf_ll nsll have \"pt \\ set (ll ! n)\"\n apply (simp add: wf_ll_def length_ll_eq)\n apply (case_tac \"pt \\ set (ll ! n)\")\n apply (subgoal_tac \"pt \\ set_of pret\")\n apply (auto)\n done\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with Sucn_repb_nc True show ?thesis\n by auto\n next\n assume pt_in_pret: \"\\ pt \\ set_of pret\"\n with pt_notin_lower_ll have pt_in_higher_ll: \n \"\\i. n + 1 \\ i \\ pt \\ set (ll ! i) \\ i < var p + 1\"\n by simp\n with nsll wf_ll lll have pt_notin_lln: \"pt \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=i and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with Sucn_repb_nc pt_in_higher_ll show ?thesis\n by auto \n qed\n qed\n from wf_ll nsll \n have Nodesn_notin_lln: \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def)\n apply clarify\n apply (drule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc \n have Nodesn_repnc: \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n have repcNodes_in_Nodes: \n \"repc ` Nodes (n + 1) ll \\ Nodes (n + 1) ll\"\n proof\n fix x\n assume x_in_repcNodesSucn: \" x \\ repc ` Nodes (n + 1) ll\"\n show \"x \\ Nodes (n + 1) ll\"\n proof (cases \"x \\ repc `Nodes n ll\")\n case True\n with repbNodes_repcNodes repbNodes_in_Nodes have \"x \\ Nodes n ll\" \n by auto\n with Nodes_subset show ?thesis \n by auto\n next\n assume \" x \\ repc `Nodes n ll\"\n with x_in_repcNodesSucn have x_in_repclln: \"x \\ repc `set (ll ! n)\"\n apply (auto simp add: Nodes_def)\n apply (case_tac \"k set (ll ! n)\"\n from rep_prop y_in_repclln obtain\n repcy_nNull: \"repc y \\ Null\" and\n red_prop: \"(repc \\ low) y = (repc \\ high) y \\ \n low y \\ Null \\ repc y = (repc \\ high) y\" and\n share_prop: \"((repc \\ low) y = (repc \\ high) y \\ low y = Null) \n \\ repc y \\ set (ll ! n) \\ repc (repc y) = repc y \\ \n (\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1))\"\n using [[simp_depth_limit = 4]]\n by auto\n from wf_ll nsll y_in_repclln obtain\n y_in_pret: \"y \\ set_of pret\" and\n vary_n: \"var y = n\"\n by (auto simp add: wf_ll_def length_ll_eq)\n from y_in_pret pret_dag have y_nNull: \"y \\ Null\"\n apply -\n apply (rule set_of_nn)\n apply auto\n done\n show \"x \\ Nodes (n + 1) ll\"\n proof (cases \"low y = Null\")\n case True\n from pret_dag prebdt_pret True y_in_pret \n have highy_Null: \"high y = Null\"\n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n with share_prop True obtain \n repcy_in_llb: \"repc y \\ set (ll ! n)\" and\n rry_ry: \" repc (repc y) = repc y\" and\n y_other_node_prop: \"\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1)\"\n by simp\n from repcy_in_llb x_repcy show ?thesis\n by (auto simp add: Nodes_def)\n next\n assume lowy_nNull: \"low y \\ Null\"\n with pret_dag prebdt_pret y_in_pret \n have highy_nNull: \"high y \\ Null\"\n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n show ?thesis\n proof (cases \"(repc \\ low) y = (repc \\ high) y\")\n case True\n with red_prop lowy_nNull have \"repc y = (repc \\ high) y\"\n by auto\n with highy_nNull have red_repc_y: \"repc y = repc (high y)\"\n by (simp add: null_comp_def)\n from pret_dag ord_pret y_in_pret lowy_nNull highy_nNull \n \n have \"var (low y) < var y \\ var (high y) < var y\"\n apply -\n apply (rule var_ordered_children) \n apply auto\n done\n with vary_n have varhighy: \"var (high y) < n\"\n by auto\n from y_in_pret y_nNull highy_nNull pret_dag \n have \"high y \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll varhighy have \"high y \\ Nodes n ll\"\n by (auto simp add: wf_ll_def Nodes_def)\n with red_repc_y have \"repc y \\ repc `Nodes n ll\"\n by simp\n with x_repcy have \"x \\ repc `Nodes n ll\"\n by simp\n with repbNodes_repcNodes repbNodes_in_Nodes \n have \"x \\ Nodes n ll\" \n by auto\n with Nodes_subset show ?thesis \n by auto\n next\n assume \"(repc \\ low) y \\ (repc \\ high) y\"\n with share_prop obtain \n repcy_in_llbn: \"repc y \\ set (ll ! n)\" and\n rry_ry: \"repc (repc y) = repc y\" and \n y_other_node_share: \"\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) y \\ \n (repc \\ low) no1 = (repc \\ low) y) = (repc y = repc no1)\"\n by auto\n with repcy_in_llbn x_repcy have \"x \\ set (ll ! n)\"\n by auto\n then show ?thesis\n by (auto simp add: Nodes_def)\n qed\n qed\n qed\n qed\n qed\n have \"(\\no\\Nodes (n + 1) ll.\n var (repc no) \\ var no \\ \n (\\not nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\\n Dag no low high not \\\n reduced nort \\ ordered nort var \\ \n set_of nort \\ repc ` Nodes (n + 1) ll \\ \n (\\no\\set_of nort. repc no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt))))\"\n (is \"\\no\\Nodes (n + 1) ll. ?Q i no\")\n proof (intro ballI)\n fix no\n assume no_in_Nodes: \"no \\ Nodes (n + 1) ll\"\n from wf_ll no_in_Nodes nsll have no_in_pret: \"no \\ set_of pret\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (erule conjE)\n apply (thin_tac \"\\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule exE)\n apply (erule_tac x=k in allE)\n apply (erule impE)\n apply arith\n apply (erule_tac x=no in ballE)\n apply auto\n done\n from pret_dag no_in_pret have nonNull: \"no\\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done \n show \"?Q i no\"\n proof (cases \"no \\ Nodes n ll\")\n case True\n note no_in_Nodesn=this\n with wf_ll nsll no_in_Nodes \n have no_notin_llbn: \"no \\ set (ll ! n)\"\n apply -\n apply (simp add: Nodes_def length_ll_eq)\n apply (elim exE)\n apply (drule_tac ?i=ka and ?j=n in no_in_one_ll)\n apply arith\n apply simp\n apply auto\n done\n with repbc_nc have repb_no_eq_repc_no: \"repb no = repc no\" \n by simp\n from repbc_nc no_in_Nodes no_notin_llbn normalize_prop True \n have varrep_eq_var: \"var (repc no) \\ var no\" \n apply -\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in allE)\n apply simp\n done\n moreover\n from True normalize_prop no_in_Nodes obtain not nort where\n nort_dag: \"Dag (repb no) (repb \\ low) (repb \\ high) nort\" and\n ord_nort: \"ordered nort var\" and\n subset_nort_not: \"set_of nort \\ repb `(Nodes n ll)\" and\n not_dag: \" Dag no low high not\" and\n red_nort: \"reduced nort\" and \n nort_repb: \"(\\no\\set_of nort. repb no = no)\" and\n bdt_prop: \"\\nobdt norbdt. bdt not var = Some nobdt \\ \n bdt nort var = Some norbdt \\ nobdt \\ norbdt\" \n by blast\n moreover\n from Nodesn_notin_lln repbc_nc nort_repb subset_nort_not repbNodes_in_Nodes \n have nort_repc: \n \"(\\no\\set_of nort. repc no = no)\"\n apply auto\n apply (subgoal_tac \"no \\ Nodes n ll\")\n apply fastforce\n apply blast\n done\n moreover\n from nort_dag have nortnodesnN: \"(\\no. no \\ set_of nort \\ no \\ Null)\"\n apply -\n apply (rule allI)\n apply (rule impI)\n apply (rule set_of_nn)\n apply auto\n done\n moreover \n have \"Dag (repc no) (repc \\ low) (repc \\ high) nort\"\n proof -\n from no_notin_llbn repbc_nc have repbc_no: \"repc no = repb no\"\n by fastforce\n with nort_dag \n have nortrepbc_dag: \"Dag (repc no) (repb \\ low) (repb \\ high) nort\"\n by simp\n from wf_ll nseqll have \"Nodes n ll \\ set_of pret\"\n apply -\n apply (rule Nodes_levellist_subset_t)\n apply assumption+\n apply (simp add: length_ll_eq)\n done\n with repbNodes_in_Nodes subset_nort_not \n have subset_nort_pret: \"set_of nort \\ set_of pret\"\n by simp\n have vxsn_in_pret: \"\\ x \\ set_of nort. var x < n \\ x \\ set_of pret\"\n proof (rule ballI)\n fix x\n assume x_in_nort: \"x \\ set_of nort\"\n from x_in_nort subset_nort_not repbNodes_in_Nodes \n have \"x \\ Nodes n ll\"\n by blast\n with wf_ll nsll have xsn: \"var x < n\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (erule conjE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule exE)\n apply (erule_tac x=k in allE)\n apply (erule impE)\n apply arith\n apply (erule_tac x=x in ballE)\n apply auto\n done\n from x_in_nort subset_nort_pret have x_in_pret: \"x \\ set_of pret\"\n by blast\n with xsn show \"var x < n \\ x \\ set_of pret\" by simp\n qed\n with pret_dag prebdt_pret nortrepbc_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\ x \\ set_of nort. ((repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x)\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with nort_dag \n have \"Dag (repc no) (repc \\ low) (repc \\ high) nort = \n Dag (repc no) (repb \\ low) (repb \\ high) nort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply simp\n done\n with nortrepbc_dag show ?thesis\n by simp\n qed\n moreover \n have \"set_of nort \\ repc `(Nodes (n + 1) ll)\"\n proof -\n have Nodesn_in_NodesSucn: \"Nodes n ll \\ Nodes (n + 1) ll\"\n by (simp add: Nodes_def set_split)\n then have repbNodesn_in_repbNodesSucn: \n \"repb `(Nodes n ll) \\ repb `(Nodes (n + 1) ll)\"\n by blast\n from wf_ll nsll \n have Nodes_n_notin_lln: \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n from Nodesn_in_NodesSucn \n have \"repc `(Nodes n ll) \\ repc `(Nodes (n + 1) ll)\"\n by blast\n with repbNodes_repcNodes subset_nort_not repbNodesn_in_repbNodesSucn \n show ?thesis by simp\n qed\n ultimately show ?thesis \n by blast\n next\n assume \" no \\ Nodes n ll\"\n with no_in_Nodes have no_in_llbn: \"no \\ set (ll ! n)\"\n apply (simp add: Nodes_def)\n apply (erule exE)\n apply (erule_tac x=k in allE)\n apply (case_tac \"k Null \\\n ((repc \\ low) no = (repc \\ high) no \\ low no \\ Null \n \\ repc no = (repc \\ high) no) \\\n (((repc \\ low) no = (repc \\ high) no \\ low no = Null) \n \\ repc no \\ set (ll ! n) \\ repc (repc no) = repc no \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) no \\\n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1)))\"\n (is \"?rnonN \\ ?repreduce \\ ?repshare\")\n using [[simp_depth_limit=4]]\n by (simp split: split_if)\n then obtain \n rnonN: \"?rnonN\" and\n repreduce: \"?repreduce\" and\n repshare: \"?repshare\"\n by blast\n have repcn_normalize: \"var (repc no) \\ var no \\\n (\\not nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\\n Dag no low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repc ` Nodes (n + 1) ll \\\n (\\no\\set_of nort. repc no = no) \\\n (\\nobdt. bdt not var = Some nobdt \\ \n (\\norbdt. bdt nort var = Some norbdt \\ nobdt \\ norbdt)))\"\n (is \"?varrep \\ ?repcn_prop\" \n is \"?varrep \\ \n (\\not nort. ?nort_dag nort \\ ?not_dag not \\ ?red nort \\ \n ?ord nort \\ ?nort_in_Nodes nort \\ ?repcno_no_n nort \\ ?bdt_equ not nort)\")\n proof (cases \"high no = Null\")\n case True\n note highnoNull=this\n with pret_dag prebdt_pret no_in_pret \n have lownoNull: \"low no = Null\"\n apply -\n apply (drule balanced_bdt)\n apply assumption+\n apply simp\n done\n with repshare have repcnoinlln:\"repc no \\ set (ll ! n)\"\n by simp\n with wf_ll nsll have varrno_n: \"var (repc no) = n\"\n by (simp add: wf_ll_def length_ll_eq)\n with varno have varrep: \"?varrep\"\n by simp\n from wf_ll nsll no_in_llbn varrno_n \n have varrno_varno: \"var (repc no) = var no\"\n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll repcnoinlln \n have rno_in_pret: \"repc no \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from repcnoinlln repshare lownoNull \n have reprep_eq_rep: \"repc (repc no) = repc no\" \n by simp\n with repcnoinlln repshare lownoNull \n have repchildreneq: \n \"((repc \\ high) (repc no) = (repc \\ high) no \\ \n (repc \\ low) (repc no) = (repc \\ low) no)\"\n by simp\n have repcn_prop: \"?repcn_prop\"\n apply - \n apply (rule_tac x=\"(Node Tip no Tip)\" in exI)\n apply (rule_tac x=\"(Node Tip (repc no) Tip)\" in exI)\n apply (intro conjI)\n apply simp\n prefer 3\n apply simp\n prefer 3\n apply simp\n proof -\n from pret_dag pnN rno_in_pret have rnonN: \"repc no \\ Null\"\n apply (case_tac \"repc no = Null\")\n apply auto\n done\n from highnoNull repchildreneq \n have rhighNull: \"(repc \\ high) (repc no) = Null\" \n by (simp add: null_comp_def)\n from lownoNull repchildreneq \n have rlowNull: \"(repc \\ low) (repc no) = Null\" \n by (simp add: null_comp_def)\n with rhighNull rnonN \n show \"repc no \\ Null \\ (repc \\ low) (repc no) = Null \\ \n (repc \\ high) (repc no) = Null\"\n by simp\n next\n from nonNull lownoNull highnoNull \n show \"?not_dag (Node Tip no Tip)\"\n by simp\n next\n from no_in_Nodes \n show \"set_of (Node Tip (repc no) Tip) \\ repc ` Nodes (n + 1) ll\"\n by simp\n next\n show \"\\no\\set_of (Node Tip (repc no) Tip). repc no = no\"\n proof \n fix pt\n assume pt_in_repcLeaf: \"pt \\ set_of (Node Tip (repc no) Tip)\"\n with reprep_eq_rep show \"repc pt = pt\"\n by simp\n qed\n next\n show \"?bdt_equ (Node Tip no Tip) (Node Tip (repc no) Tip)\"\n proof (cases \"var no = 0\")\n case True \n note vno_Null=this\n then have nobdt: \"bdt (Node Tip no Tip) var = Some Zero\" by simp\n from varrep vno_Null have varrno: \"var (repc no) = 0\" by simp\n then have norbdt: \"bdt (Node Tip (repc no) Tip) var = Some Zero\" by simp\n from nobdt norbdt vno_Null varrno show ?thesis\n by (simp add: cong_eval_def)\n next\n assume vno_not_Null: \"var no \\ 0\"\n show ?thesis\n proof (cases \"var no = 1\")\n case True\n note vno_One=this\n then have nobdt: \"bdt (Node Tip no Tip) var = Some One\" by simp\n from varrno_varno vno_One \n have \"bdt (Node Tip (repc no) Tip) var = Some One\" by simp \n with nobdt show ?thesis by (auto simp add: cong_eval_def)\n next\n assume vno_nOne: \"var no \\ 1\"\n with vno_not_Null have onesvno: \"1 < var no\" by simp\n from nonNull lownoNull highnoNull \n have no_dag: \"Dag no low high (Node Tip no Tip)\"\n by simp \n with pret_dag no_in_pret have not_in_pret: \"(Node Tip no Tip) \\ pret\"\n by (metis set_of_subdag)\n with prebdt_pret have \"\\bdt2. bdt (Node Tip no Tip) var = Some bdt2\"\n by (metis subbdt_ex)\n with onesvno show ?thesis \n by simp\n qed\n qed\n qed\n with varrep reprep_eq_rep show ?thesis by simp\n next\n assume hno_nNull: \"high no \\ Null\"\n with pret_dag prebdt_pret no_in_pret have lno_nNull: \"low no \\ Null\"\n by (metis balanced_bdt)\n (*-------------------normalize_prop fuer (high no)------------------------*)\n \n from no_in_pret nonNull hno_nNull pret_dag \n have hno_in_pret: \"high no \\ set_of pret\"\n by (metis subelem_set_of_high)\n with wf_ll \n have hno_in_ll: \"high no \\ set (ll ! (var (high no)))\" \n by (simp add: wf_ll_def)\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n \n have varhnos_varno: \"var (high no) < var no\"\n by (metis var_ordered_children)\n with varno have varhnos_n: \"var (high no) < n\" by simp\n with hno_in_ll have hno_in_Nodesn: \"high no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (high no)\" in exI)\n apply simp\n done\n from wf_ll nsll hno_in_ll varhnos_n \n have \"high no \\ set (ll ! n)\"\n apply -\n apply (rule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repb_repc_high: \"repb (high no) = repc (high no)\" by simp\n with normalize_prop hno_in_Nodesn varhnos_varno varno \n have high_normalize: \"var (repc (high no)) \\ var (high no) \\\n (\\not nort. Dag (repc (high no)) (repb \\ low) (repb \\ high) nort \\\n Dag (high no) low high not \\ reduced nort \\\n ordered nort var \\ set_of nort \\ repb `(Nodes n ll) \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = \n Some norbdt \\ nobdt \\ norbdt))\"\n (is \"?varrep_high \\ \n (\\not nort. ?repbchigh_dag nort \\ ?high_dag not \\ \n ?redhigh nort \\ ?ordhigh nort \\ ?rephigh_in_Nodes nort \\ \n ?repbno_no nort \\ ?highdd_prop not nort)\"\n is \"?varrep_high \\ ?not_nort_prop\")\n apply simp\n apply (erule_tac x=\"high no\" in ballE)\n apply (simp del: Dag_Ref)\n apply simp\n done\n then have varrep_high: \"?varrep_high\" by simp\n from varhnos_n varrep_high have varrephno_s_n: \n \"var (repc (high no)) < n\"\n by simp\n from Nodes_subset \n have \"Nodes n ll \\ Nodes (Suc n) ll\"\n by auto\n with hno_in_Nodesn repcNodes_in_Nodes \n have \"repc (high no) \\ Nodes (Suc n) ll\"\n apply simp\n apply blast\n done\n with wf_ll nsll have \"repc (high no) \\ set_of pret\"\n apply (simp add: wf_ll_def Nodes_def length_ll_eq)\n apply (elim conjE exE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule_tac x=k in allE)\n apply (erule impE)\n apply simp\n apply (erule_tac x=\"repc (high no)\" in ballE)\n apply auto\n done\n with wf_ll varrephno_s_n \n have \"\\ k set (ll ! k)\"\n by (auto simp add: wf_ll_def)\n with wf_ll nsll have \"repc (high no) \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc \n have repbchigh_idem: \"repb (repc (high no)) = repc (repc (high no))\"\n by auto\n from high_normalize \n have not_nort_prop_high: \"?not_nort_prop\" by (simp del: Dag_Ref)\n from not_nort_prop_high obtain hnot where high_dag: \"?high_dag hnot\"\n by auto\n from wf_ll nsll \n have \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then \n have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n then have repcNodes_repbNodes: \n \"repc `(Nodes n ll) = repb `(Nodes n ll)\"\n by simp\n from pret_dag nsll wf_ll \n have null_notin_Nodesn: \"Null \\ Nodes n ll\"\n apply -\n apply (rule Null_notin_Nodes)\n apply (auto simp add: length_ll_eq)\n done\n from hno_in_Nodesn have \"repc (high no) \\ repc `(Nodes n ll)\"\n by blast\n with repbNodes_in_Nodes repcNodes_repbNodes \n have \"repc (high no) \\ Nodes n ll\"\n apply simp\n apply blast\n done\n with null_notin_Nodesn have rhn_nNull: \"repc (high no) \\ Null\"\n by auto\n\n (*-------------------normalize_prop fuer (low no)--------------------------*)\n\n from no_in_pret nonNull lno_nNull pret_dag \n have lno_in_pret: \"low no \\ set_of pret\"\n by (rule subelem_set_of_low)\n with wf_ll \n have lno_in_ll: \"low no \\ set (ll ! (var (low no)))\" \n by (simp add: wf_ll_def)\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n have varlnos_varno: \"var (low no) < var no\"\n apply -\n apply (drule var_ordered_children)\n apply assumption+\n apply auto\n done\n with varno have varlnos_n: \"var (low no) < n\" by simp\n with lno_in_ll have lno_in_Nodesn: \"low no \\ Nodes n ll\"\n apply (simp add: Nodes_def)\n apply (rule_tac x=\"var (low no)\" in exI)\n apply simp\n done\n from varlnos_n wf_ll nsll lno_in_ll \n have \"low no \\ set (ll ! n)\"\n apply -\n apply (rule no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repb_repc_low: \"repb (low no) = repc (low no)\" by simp\n with normalize_prop lno_in_Nodesn varlnos_varno varno \n have low_normalize: \"var (repc (low no)) \\ var (low no) \\\n (\\not nort. Dag (repc (low no)) (repb \\ low) (repb \\ high) nort \\\n Dag (low no) low high not \\ reduced nort \\ ordered nort var \\\n set_of nort \\ repb `(Nodes n ll) \\\n (\\no\\set_of nort. repb no = no) \\\n (\\nobdt norbdt. bdt not var = Some nobdt \\ bdt nort var = Some norbdt \\ \n nobdt \\ norbdt))\"\n (is \"?varrep_low \\ \n (\\not nort. ?repbclow_dag nort \\ ?low_dag not \\ ?redhigh nort \\ \n ?ordhigh nort \\ ?replow_in_Nodes nort \\ ?low_repno_no nort \n \\ ?lowdd_prop not nort)\"\n is \"?varrep_low \\ ?not_nort_prop_low\")\n apply simp\n apply (erule_tac x=\"low no\" in ballE)\n apply (simp del: Dag_Ref)\n apply simp\n done\n then have varrep_low: \"?varrep_low\" by simp\n from low_normalize have not_nort_prop_low: \"?not_nort_prop_low\" \n by (simp del: Dag_Ref)\n from lno_in_Nodesn have \"repc (low no) \\ repc `(Nodes n ll)\"\n by blast\n with repbNodes_in_Nodes repcNodes_repbNodes \n have \"repc (low no) \\ Nodes n ll\"\n apply simp\n apply blast\n done\n with null_notin_Nodesn have rln_nNull: \"repc (low no) \\ Null\"\n by auto\n\n \n show ?thesis\n proof (cases \"repc (low no) = repc (high no)\")\n case True\n note red_case=this\n with repreduce lno_nNull hno_nNull \n have rno_eq_hrno: \"repc no = repc (high no)\" \n by (simp add: null_comp_def)\n from varhnos_varno rno_eq_hrno varrep_high have varrep: \"?varrep\" by simp\n from not_nort_prop_high not_nort_prop_low have repcn_prop: \"?repcn_prop\"\n apply -\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort )\n apply (rule_tac x=\"(Node lnot no rnot)\" in exI)\n apply (rule_tac x=rnort in exI)\n apply (elim conjE)\n apply (intro conjI)\n prefer 7\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt)\n apply (elim conjE)\n apply (case_tac \"Suc 0 < var no\")\n apply (rule_tac x=\"(Bdt_Node lnobdt (var no) rnobdt)\" in exI)\n apply (rule conjI)\n prefer 2\n apply (rule_tac x=rnorbdt in exI)\n apply (rule conjI)\n proof -\n fix rnot lnot rnort lnort\n assume highnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume ord_nort: \" ordered rnort var\"\n assume rnort_in_repNodes: \" set_of rnort \\ repb ` Nodes n ll\"\n from rnort_in_repNodes repbNodes_in_Nodes \n have nort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by blast\n from varhnos_n varrep_high \n have vrhnos_n: \"var (repc (high no)) < n\" by simp\n from rhn_nNull highnort_dag \n have \"\\lno rno. rnort = Node lno (repc (high no)) rno\" by fastforce\n with highnort_dag rhn_nNull have \"root rnort = repc (high no)\" by auto\n with ord_nort have \"\\x \\ set_of rnort. var x <= var (repc (high no))\"\n apply -\n apply (rule ballI)\n apply (drule ordered_set_of)\n apply auto\n done\n with vrhnos_n have vxsn: \"\\x \\ set_of rnort. var x < n\" \n by fastforce\n from nort_in_Nodes have \"\\x \\ set_of rnort. x \\ Nodes n ll\" \n by auto\n with wf_ll nsll \n have x_in_pret: \"\\x \\ set_of rnort. x \\ set_of pret\"\n apply -\n apply (rule ballI)\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n from vxsn x_in_pret \n have vxsn_in_nort: \"\\x \\ set_of rnort. var x x \\ set_of pret\"\n by auto\n with pret_dag prebdt_pret highnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\x \\ set_of rnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n with rno_eq_hrno \n have \"Dag (repc no) (repc \\ low) (repc \\ high) rnort = \n Dag (repc no) (repb \\ low) (repb \\ high) rnort\"\n apply -\n apply (rule heaps_eq_Dag_eq)\n apply simp\n done\n with highnort_dag rno_eq_hrno \n show \"Dag (repc no) (repc \\ low) (repc \\ high) rnort\" by simp\n next\n fix rnot lnot rnort lnort\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n with lnot_dag nonNull \n show \"Dag no low high (Node lnot no rnot)\" by simp\n next\n fix rnot lnot rnort lnort\n assume \" reduced rnort\"\n then show \"reduced rnort\" by simp\n next\n fix rnort\n assume \"ordered rnort var\"\n then show \"ordered rnort var\" by simp\n next\n fix rnort\n assume rnort_in_Nodes: \" set_of rnort \\ repb ` Nodes n ll\"\n have \"Nodes n ll \\ Nodes (n + 1) ll\" \n by (simp add: Nodes_def set_split) \n then have \"repc ` Nodes n ll \\ repc ` Nodes (n + 1) ll\"\n by blast\n with rnort_in_Nodes repbNodes_repcNodes \n show \" set_of rnort \\ repc ` Nodes (n + 1) ll\" \n by (simp add: Nodes_def)\n next\n fix rnort rnorbdt\n assume \" bdt rnort var = Some rnorbdt\"\n then show \" bdt rnort var = Some rnorbdt\" by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume rcongeval: \"rnobdt \\ rnorbdt\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnorbdt_def: \" bdt lnort var = Some lnorbdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume lcongeval:\"lnobdt \\ lnorbdt\"\n from red_case lnort_dag rnort_dag \n have lnort_rnort: \"lnort = rnort\" \n by (simp add: Dag_unique del: Dag_Ref)\n with lnorbdt_def lcongeval rnorbdt_def \n have lnobdt_rnorbdt: \"lnobdt \\ rnorbdt\" by simp\n with rcongeval have \"lnobdt \\ rnobdt\" \n apply -\n apply (rule cong_eval_trans)\n apply (auto simp add: cong_eval_sym)\n done\n then have \" Bdt_Node lnobdt (var no) rnobdt \\ rnobdt\"\n apply -\n apply (simp add: cong_eval_sym [rule_format])\n apply (rule cong_eval_child_high)\n apply assumption\n done\n with rcongeval show \"Bdt_Node lnobdt (var no) rnobdt \\ rnorbdt\"\n apply -\n apply (rotate_tac 1)\n apply (rule cong_eval_trans)\n apply auto\n done\n next\n fix lnot rnot lnobdt rnobdt\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \" Dag (high no) low high rnot\"\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume onesvarno: \" Suc 0 < var no\"\n with rnobdt_def lnot_dag rnot_dag lnobdt_def \n show \"bdt (Node lnot no rnot) var = \n Some (Bdt_Node lnobdt (var no) rnobdt)\" \n by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume cong_rno_rnor: \" rnobdt \\ rnorbdt\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume \"\\ Suc 0 < var no\"\n then have varnoseq1: \"var no = 0 \\ var no = 1\" by auto\n show \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt \\ \n (\\norbdt. bdt rnort var = Some norbdt \\ nobdt \\ norbdt)\"\n proof (cases \"var no = 0\")\n case True\n note vnoNull=this\n with pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n show ?thesis\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n next\n assume \"var no \\ 0\"\n with varnoseq1 have vnoOne: \"var no = 1\" by simp\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n vnoOne \n have vlvrNull: \"var (low no) = 0 \\ var (high no) = 0\"\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n then have vlNull: \"var (low no) = 0\" by simp\n from vlvrNull have vrNull: \"var (high no) = 0\" by simp\n from lnobdt_def lnot_dag vlNull lno_nNull \n have lnobdt_Zero: \"lnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from rnobdt_def rnot_dag vrNull hno_nNull \n have rnobdt_Zero: \"rnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from lnobdt_Zero lnobdt_def have \"bdt lnot var = Some Zero\" by simp\n with lnot_dag vlNull \n have lnot_Node: \"lnot = (Node Tip (low no) Tip)\"\n by auto\n from rnobdt_Zero rnobdt_def rnot_dag vrNull \n have rnot_Node: \"rnot = (Node Tip (high no) Tip)\" \n by auto\n from pret_dag no_in_pret obtain not where \n not_ex: \"Dag no low high not\"\n apply -\n apply (drule dag_setof_exD)\n apply auto\n done\n with pret_dag no_in_pret have not_ex_in_pret: \"not <= pret\" \n apply -\n apply (rule set_of_subdag)\n apply auto\n done\n from not_ex lnot_dag rnot_dag nonNull \n have not_def: \"not = (Node lnot no rnot)\" \n by (simp add: Dag_unique del: Dag_Ref)\n with not_ex_in_pret prebdt_pret \n have nobdt_ex: \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt\"\n apply -\n apply (rule subbdt_ex)\n apply auto\n done\n then obtain nobdt where \n nobdt_def: \"bdt (Node lnot no rnot) var = Some nobdt\" by auto\n from not_def have \"root not = no\" by simp\n with nobdt_def vnoOne not_def have \"not = (Node Tip no Tip)\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with not_def have \"rnot = Tip\" by simp\n with rnot_Node show ?thesis by simp\n qed\n next\n fix rnot lnot rnort lnort\n assume rnort_in_repb_Nodesn: \"set_of rnort \\ repb ` Nodes n ll\"\n assume rnort_repb_no: \"\\no\\set_of rnort. repb no = no\"\n from repbNodes_in_Nodes rnort_in_repb_Nodesn \n have rnort_in_Nodesn: \"set_of rnort \\ Nodes n ll\"\n by blast\n show \"\\no\\set_of rnort. repc no = no\"\n proof\n fix pt\n assume pt_in_rnort: \" pt \\ set_of rnort\"\n with rnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with rnort_repb_no pt_in_rnort show \"repc pt = pt\"\n by auto\n qed\n qed\n with varrep show ?thesis by simp\n next\n assume share_case_cond: \"repc (low no) \\ repc (high no)\"\n with lno_nNull hno_nNull \n have share_case_cond_propto: \"(repc \\ low) no \\ (repc \\ high) no\"\n by (simp add: null_comp_def)\n with repshare obtain \n rno_in_llbn: \"repc no \\ set (ll ! n)\" and\n rrno_eq_rno: \"repc (repc no) = repc no\" and\n twonodes_in_llbn_prop: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) no \\ \n (repc \\ low) no1 = (repc \\ low) no) = (repc no = repc no1))\"\n by auto\n from wf_ll rno_in_llbn nsll \n have varrepno_n: \"var (repc no) = n\" \n by (simp add: wf_ll_def length_ll_eq)\n with varno have varrep: \"?varrep\" \n by simp\n from not_nort_prop_high not_nort_prop_low have repcn_prop: \"?repcn_prop\"\n apply-\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort)\n apply (rule_tac x=\"Node lnot no rnot\" in exI)\n apply (rule_tac x=\"Node lnort (repc no) rnort\" in exI)\n apply (elim conjE)\n apply (intro conjI)\n prefer 7\n apply (elim exE)\n apply (rename_tac rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt)\n apply (elim conjE)\n apply (case_tac \"Suc 0 < var no\")\n apply (rule_tac x=\"(Bdt_Node lnobdt (var no) rnobdt)\" in exI)\n apply (rule conjI)\n prefer 2\n apply (rule_tac x=\"(Bdt_Node lnorbdt (var (repc no)) rnorbdt)\" in exI)\n apply (rule conjI)\n proof -\n fix rnot lnot rnort lnort\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnort_in_repNodes: \"set_of rnort \\ repb ` Nodes n ll\"\n assume lnort_in_repNodes: \"set_of lnort \\ repb ` Nodes n ll\"\n from rnort_in_repNodes repbNodes_in_Nodes \n have rnort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by simp\n from lnort_in_repNodes repbNodes_in_Nodes \n have lnort_in_Nodes: \"set_of lnort \\ Nodes n ll\"\n by simp\n from rnort_in_Nodes \n have rnortx_in_Nodes: \"\\ x \\ set_of rnort. x \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have \"\\ x \\ set_of rnort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret rnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\x \\ set_of rnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n then have \"Dag (repc (high no)) (repc \\ low) (repc \\ high) rnort = \n Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply assumption\n done\n with rnort_dag \n have rnort_dag_repc: \n \"Dag (repc (high no)) (repc \\ low) (repc \\ high) rnort\" \n by simp\n from lnort_in_Nodes \n have lnortx_in_Nodes: \"\\x \\ set_of lnort. x \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have \"\\ x \\ set_of lnort. x \\ set_of pret \\ var x < n\"\n apply -\n apply (rule ballI)\n apply (rule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with pret_dag prebdt_pret lnort_dag ord_pret wf_ll nsll \n repbc_nc \n have \"\\ x \\ set_of lnort. (repc \\ low) x = (repb \\ low) x \\ \n (repc \\ high) x = (repb \\ high) x\"\n apply -\n apply (rule nort_null_comp)\n apply (auto simp add: length_ll_eq)\n done\n then have \n \"Dag (repc (low no)) (repc \\ low) (repc \\ high) lnort = \n Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\" \n apply -\n apply (rule heaps_eq_Dag_eq)\n apply assumption\n done\n with lnort_dag \n have lnort_dag_repc: \n \"Dag (repc (low no)) (repc \\ low) (repc \\ high) lnort\" \n by simp\n from lno_nNull hno_nNull \n have propto_comp: \"(repc \\ low) no = repc (low no) \\ \n (repc \\ high) no = repc (high no)\" \n by (simp add: null_comp_def)\n from rno_in_llbn twonodes_in_llbn_prop rrno_eq_rno \n have \"(repc \\ high) (repc no) = (repc \\ high) no \\ \n (repc \\ low) (repc no) = (repc \\ low) no\"\n by simp\n with propto_comp lnort_dag_repc rnort_dag_repc lno_nNull hno_nNull \n rnonN \n show \"Dag(repc no)(repc \\ low)(repc \\ high)(Node lnort (repc no) rnort)\"\n by auto\n next\n fix rnot lnot rnort lnort\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n with rnot_dag nonNull \n show \"Dag no low high (Node lnot no rnot)\" \n by simp\n next\n fix rnort lnort\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume red_rnort: \"reduced rnort\"\n assume red_lnort: \" reduced lnort\"\n from rhn_nNull rnort_dag obtain lrnort rrnort where \n rnort_Node: \"rnort = (Node lrnort (repc (high no)) rrnort)\"\n by auto\n from rln_nNull lnort_dag obtain llnort rlnort where \n lnort_Node: \"lnort = (Node llnort (repc (low no)) rlnort)\"\n by auto\n from twonodes_in_llbn_prop rrno_eq_rno rno_in_llbn hno_nNull lno_nNull \n have \"((repc \\ high) (repc no)) = repc (high no) \\ \n ((repc \\ low) (repc no)) = repc (low no)\"\n apply -\n apply (erule_tac x=\"repc no\" in ballE)\n apply (auto simp add: null_comp_def)\n done\n with share_case_cond \n have \"((repc \\ high) (repc no)) \\ ((repc \\ low) (repc no))\"\n by auto\n with red_lnort red_rnort rnort_Node lnort_Node share_case_cond \n show \"reduced (Node lnort (repc no) rnort)\"\n apply -\n apply (rule_tac lp=\"repc (low no)\" and rp=\"repc (high no)\" and \n llt=llnort and rlt = rlnort and lrt=lrnort and rrt=rrnort \n in reduced_children_parent)\n apply auto\n done\n next\n fix lnort rnort\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume ord_lnort: \"ordered lnort var\"\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume ord_rnort: \" ordered rnort var\"\n assume lnort_in_repNodes: \"set_of lnort \\ repb `Nodes n ll\"\n assume rnort_in_repNodes: \"set_of rnort \\ repb `Nodes n ll\"\n from lnort_in_repNodes repbNodes_in_Nodes \n have lnort_in_Nodes: \"set_of lnort \\ Nodes n ll\"\n by simp\n from rnort_in_repNodes repbNodes_in_Nodes \n have rnort_in_Nodes: \"set_of rnort \\ Nodes n ll\"\n by simp\n\n from rhn_nNull rnort_dag obtain lrnort rrnort where \n rnort_Node: \"rnort = (Node lrnort (repc (high no)) rrnort)\"\n by auto\n from rln_nNull lnort_dag obtain llnort rlnort where \n lnort_Node: \"lnort = (Node llnort (repc (low no)) rlnort)\"\n by auto\n from lnort_dag rln_nNull lnort_in_Nodes \n have \"repc (low no) \\ set_of lnort\" \n by auto\n with lnort_in_Nodes \n have \"repc (low no) \\ Nodes n ll\"\n by blast\n with wf_ll nsll \n have vrlno_sn: \"var (repc (low no)) < n\"\n apply -\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n from rnort_dag rhn_nNull rnort_in_Nodes \n have \"repc (high no) \\ set_of rnort\" \n by auto\n with rnort_in_Nodes \n have \"repc (high no) \\ Nodes n ll\"\n by blast\n with wf_ll nsll have vrhno_sn: \"var (repc (high no)) < n\"\n apply -\n apply (drule wf_ll_Nodes_pret)\n apply (auto simp add: length_ll_eq)\n done\n with varrepno_n vrlno_sn lnort_dag ord_lnort rnort_dag rnort_Node \n lnort_Node ord_rnort \n show \"ordered (Node lnort (repc no) rnort) var\"\n by auto\n next\n fix lnort rnort\n assume lnort_in_Nodes: \"set_of lnort \\ repb `Nodes n ll\"\n assume rnort_in_Nodes: \"set_of rnort \\ repb `Nodes n ll\"\n from lnort_in_Nodes repbNodes_repcNodes \n have lnort_in_repcNodes: \"set_of lnort \\ repc `Nodes n ll\"\n by simp\n from rnort_in_Nodes repbNodes_repcNodes \n have rnort_in_repcNodes: \"set_of rnort \\ repc `Nodes n ll\"\n by simp\n have nNodessubset: \"Nodes n ll \\ Nodes (n+1) ll\"\n by (simp add: Nodes_subset)\n then have repc_Nodes_subset:\n \"repc `Nodes n ll \\ repc `Nodes (n+1) ll\"\n by blast\n from no_in_Nodes have \"repc no \\ repc `Nodes (n+1) ll\"\n by blast\n with repc_Nodes_subset lnort_in_repcNodes rnort_in_repcNodes \n show \"set_of (Node lnort (repc no) rnort) \\ \n repc `Nodes (n + 1) ll\"\n apply simp\n apply blast\n done\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume cong_rno_rnor: \" rnobdt \\ rnorbdt\"\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \"Dag (high no) low high rnot\"\n assume \"\\ Suc 0 < var no\"\n then have varnoseq1: \"var no = 0 \\ var no = 1\" by auto\n show \"\\nobdt. bdt (Node lnot no rnot) var = Some nobdt \\ \n (\\norbdt. bdt (Node lnort (repc no) rnort) var = Some norbdt \\ \n nobdt \\ norbdt)\"\n proof (cases \"var no = 0\")\n case True\n note vnoNull=this\n with pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n show ?thesis\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n next\n assume \"var no \\ 0\"\n with varnoseq1 have vnoOne: \"var no = 1\" by simp\n from pret_dag ord_pret no_in_pret lno_nNull hno_nNull \n vnoOne \n have vlvrNull: \"var (low no) = 0 \\ var (high no) = 0\"\n apply -\n apply (drule var_ordered_children)\n apply auto\n done\n then have vlNull: \"var (low no) = 0\" by simp\n from vlvrNull have vrNull: \"var (high no) = 0\" by simp\n from lnobdt_def lnot_dag vlNull lno_nNull \n have lnobdt_Zero: \"lnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from rnobdt_def rnot_dag vrNull hno_nNull \n have rnobdt_Zero: \"rnobdt = Zero\"\n apply -\n apply (drule bdt_Some_var0_Zero)\n apply auto\n done\n from lnobdt_Zero lnobdt_def \n have \"bdt lnot var = Some Zero\" by simp\n with lnot_dag vlNull \n have lnot_Node: \"lnot = (Node Tip (low no) Tip)\"\n by auto\n from rnobdt_Zero rnobdt_def rnot_dag vrNull \n have rnot_Node: \"rnot = (Node Tip (high no) Tip)\" \n by auto\n from pret_dag no_in_pret obtain not \n where not_ex: \"Dag no low high not\"\n apply -\n apply (drule dag_setof_exD)\n apply auto\n done\n with pret_dag no_in_pret have not_ex_in_pret: \"not <= pret\" \n apply -\n apply (rule set_of_subdag)\n apply auto\n done\n from not_ex lnot_dag rnot_dag nonNull \n have not_def: \"not = (Node lnot no rnot)\" \n by (simp add: Dag_unique del: Dag_Ref)\n with not_ex_in_pret prebdt_pret \n have nobdt_ex: \"\\ nobdt. bdt (Node lnot no rnot) var = Some nobdt\"\n apply -\n apply (rule subbdt_ex)\n apply auto\n done\n then obtain nobdt where \n nobdt_def: \"bdt (Node lnot no rnot) var = Some nobdt\" by auto\n from not_def have \"root not = no\" by simp\n with nobdt_def vnoOne not_def \n have \"not = (Node Tip no Tip)\"\n apply -\n apply (drule bdt_Some_var1_One)\n apply auto\n done\n with not_def have \"rnot = Tip\" by simp\n with rnot_Node show ?thesis by simp\n qed\n next\n fix lnot rnot lnobdt rnobdt\n assume lnot_dag: \"Dag (low no) low high lnot\"\n assume rnot_dag: \" Dag (high no) low high rnot\"\n assume lnobdt_def: \" bdt lnot var = Some lnobdt\"\n assume rnobdt_def: \" bdt rnot var = Some rnobdt\"\n assume onesvarno: \" Suc 0 < var no\"\n with rnobdt_def lnot_dag rnot_dag lnobdt_def \n show \"bdt (Node lnot no rnot) var = \n Some (Bdt_Node lnobdt (var no) rnobdt)\" by simp\n next\n fix rnot lnot rnort lnort rnobdt lnobdt rnorbdt lnorbdt\n assume rnort_dag: \n \"Dag (repc (high no)) (repb \\ low) (repb \\ high) rnort\"\n assume lnort_dag: \n \"Dag (repc (low no)) (repb \\ low) (repb \\ high) lnort\"\n assume rnorbdt_def: \" bdt rnort var = Some rnorbdt\"\n assume lnorbdt_def: \"bdt lnort var = Some lnorbdt\"\n assume varno_bOne: \"Suc 0 < var no\"\n with varno have \"Suc 0 < n\" by simp\n with varrepno_n have \"Suc 0 < var (repc no)\" by simp\n with rnorbdt_def lnorbdt_def \n show \"bdt (Node lnort (repc no) rnort) var = \n Some (Bdt_Node lnorbdt (var (repc no)) rnorbdt)\"\n by simp\n next\n fix rnobdt lnobdt rnorbdt lnorbdt \n assume lcong_eval: \"lnobdt \\ lnorbdt\"\n assume rcong_eval: \" rnobdt \\ rnorbdt\"\n from varno varrepno_n have \"var (repc no) = var no\" by simp\n with lcong_eval rcong_eval \n show \"Bdt_Node lnobdt (var no) rnobdt \\ \n Bdt_Node lnorbdt (var (repc no)) rnorbdt\"\n apply (unfold cong_eval_def)\n apply (rule ext)\n by simp\n next\n fix rnot lnot rnort lnort\n assume lnort_repb: \"\\no\\set_of lnort. repb no = no\"\n assume rnort_repb: \"\\no\\set_of rnort. repb no = no\"\n assume rnort_in_repb_Nodesn: \"set_of rnort \\ repb ` Nodes n ll\"\n assume lnort_in_repb_Nodesn: \"set_of lnort \\ repb ` Nodes n ll\"\n from repbNodes_in_Nodes rnort_in_repb_Nodesn \n have rnort_in_Nodesn: \"set_of rnort \\ Nodes n ll\"\n by blast\n from repbNodes_in_Nodes lnort_in_repb_Nodesn \n have lnort_in_Nodesn: \"set_of lnort \\ Nodes n ll\"\n by blast\n have rnort_repc: \"\\no\\set_of rnort. repc no = no\"\n proof\n fix pt\n assume pt_in_rnort: \" pt \\ set_of rnort\"\n with rnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with rnort_repb pt_in_rnort show \"repc pt = pt\"\n by auto\n qed\n have lnort_repc: \"\\no\\set_of lnort. repc no = no\"\n proof\n fix pt\n assume pt_in_lnort: \" pt \\ set_of lnort\"\n with lnort_in_Nodesn have \"pt \\ Nodes n ll\" \n by blast\n with Nodesn_notin_lln have \"pt \\ set (ll ! n)\"\n by auto\n with repbc_nc have \"repb pt = repc pt\"\n by auto\n with lnort_repb pt_in_lnort show \"repc pt = pt\"\n by auto\n qed\n show \"\\no\\set_of (Node lnort (repc no) rnort). repc no = no\"\n proof\n fix pt\n assume pt_in_rept: \"pt \\ set_of (Node lnort (repc no) rnort)\"\n show \"repc pt = pt\"\n proof (cases \"pt \\ set_of lnort\")\n case True\n with lnort_repc show ?thesis\n by auto\n next\n assume pt_notin_lnort: \"pt \\ set_of lnort\"\n show ?thesis\n proof (cases \"pt \\ set_of rnort\")\n case True\n with rnort_repc show ?thesis\n by auto\n next \n assume pt_notin_rnort: \"pt \\ set_of rnort\"\n with pt_notin_lnort pt_in_rept have \"pt = repc no\"\n by simp\n with rrno_eq_rno show \"repc pt = pt\"\n by simp\n qed\n qed\n qed\n qed\n \n with varrep rrno_eq_rno show ?thesis by simp\n qed\n qed\n with rnonN show ?thesis by simp\n qed\n qed\n note while_while_prop=this\n from wf_ll nsll \n have \"\\no \\ Nodes n ll. no \\ set (ll ! n)\"\n apply (simp add: Nodes_def length_ll_eq)\n apply clarify\n apply (drule no_in_one_ll)\n apply auto\n done\n with repbc_nc have \"\\no \\ Nodes n ll. repb no = repc no\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in allE)\n apply simp\n done\n then have repbNodes_repcNodes: \n \"repb `(Nodes n ll) = repc `(Nodes n ll)\"\n apply -\n apply rule\n apply blast\n apply rule\n apply (erule imageE)\n apply (erule_tac x=xa in ballE)\n prefer 2\n apply simp\n apply rule\n apply auto\n done\n then have repcNodes_repbNodes: \n \"repc `(Nodes n ll) = repb `(Nodes n ll)\"\n by simp\n have repbc_dags_eq: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n apply -\n apply rule\n apply rule\n apply (erule Dags.cases)\n apply (rule DagsI)\n prefer 4\n apply rule\n apply (erule Dags.cases)\n apply (rule DagsI)\n proof -\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes n ll\"\n assume x_t: \"x=t\"\n with t_in_repcNodes repcNodes_repbNodes \n show \"set_of x \\ repb ` Nodes n ll\" \n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes n ll\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume x_t: \"x=t\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodes t_dag t_nTip t_Node obtain q where \n rq_p: \"repc q = p\" and q_in_Nodes: \"q \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n from q_in_Nodes have \"repb q = repc q\"\n by (rule Nodes_n_rep_nc [rule_format])\n with rq_p have repbq_p: \"repb q = p\" by simp\n from q_in_Nodes \n have \"Dag (repb q) (repb \\ low) (repb \\ high) t = \n Dag (repc q) (repc \\ low) (repc \\ high) t\"\n by (rule Nodes_repbc_Dags_eq [rule_format])\n with t_dag rq_p have \"Dag (repb q) (repb \\ low) (repb \\ high) t\" by simp\n with repbq_p x_t show \"Dag p (repb \\ low) (repb \\ high) x\"\n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repb ` Nodes n ll\"\n assume x_t: \"x=t\"\n with t_in_repcNodes repbNodes_repcNodes \n show \"set_of x \\ repc ` Nodes n ll\" \n by simp\n next\n fix x p t\n assume t_in_repcNodes: \"set_of t \\ repb ` Nodes n ll\"\n assume t_dag: \"Dag p (repb \\ low) (repb \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume x_t: \"x=t\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodes t_dag t_nTip t_Node obtain q where \n rq_p: \"repb q = p\" and q_in_Nodes: \"q \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n from q_in_Nodes have \"repb q = repc q\"\n by (rule Nodes_n_rep_nc [rule_format])\n with rq_p have repbq_p: \"repc q = p\" by simp\n from q_in_Nodes \n have \"Dag (repb q) (repb \\ low) (repb \\ high) t = \n Dag (repc q) (repc \\ low) (repc \\ high) t\"\n by (rule Nodes_repbc_Dags_eq [rule_format])\n with t_dag rq_p have \"Dag (repc q) (repc \\ low) (repc \\ high) t\" by simp\n with repbq_p x_t show \"Dag p (repc \\ low) (repc \\ high) x\"\n by simp\n next\n fix x p and t :: \"dag\"\n assume x_t: \"x = t\"\n assume t_nTip: \" t \\ Tip\"\n with x_t show \"x\\ Tip\" by simp\n next\n fix x p and t :: \"dag\"\n assume x_t: \"x = t\"\n assume t_nTip: \" t \\ Tip\"\n with x_t show \"x\\ Tip\" by simp\n qed\n from pret_dag wf_ll nsll \n have null_notin_Nodes_Suc_n: \"Null \\ Nodes (Suc n) ll\"\n by - (rule Null_notin_Nodes,auto simp add: length_ll_eq)\n { fix t1 t2\n assume t1_in_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repbc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n from t1_in_DagsNodesn repbc_Dags \n have t1_repb_subnode: \n \"t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\" \n by simp\n from t2_in_DagsNodesSucn \n have t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\" \n by simp\n from repbNodes_in_Nodes repbNodes_repcNodes \n have repcNodesn_in_Nodesn: \"repc `Nodes n ll \\ Nodes n ll\"\n by simp\n from t1_in_DagsNodesn obtain q where \n Dag_q_Nodes_n: \n \"Dag (repc q) (repc \\ low) (repc \\ high) t1 \\ q \\ Nodes n ll\"\n proof (elim Dags.cases)\n fix p t\n assume t1_t: \"t1 = t\"\n assume t_in_repcNodesn: \"set_of t \\ repc ` Nodes n ll\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n assume t_nTip: \" t \\ Tip\"\n assume obtain_prop: \"\\q. Dag (repc q) (repc \\ low) (repc \\ high) t1 \\ \n q \\ Nodes n ll \\ ?thesis\"\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n from t_in_repcNodesn t_dag t_nTip t_Node obtain k where \n rk_p: \"repc k = p\" and k_in_Nodes: \"k \\ Nodes n ll\"\n apply simp\n apply (elim conjE)\n apply (erule imageE)\n apply auto\n done\n with t1_t t_dag obtain_prop rk_p k_in_Nodes show ?thesis\n by auto\n qed\n with wf_ll nsll have varq_sn: \"(var q < n)\" \n apply (simp add: Nodes_def)\n apply (elim conjE)\n apply (erule exE)\n apply (simp add: wf_ll_def length_ll_eq)\n apply (elim conjE)\n apply (thin_tac \" \\q. q \\ set_of pret \\ q \\ set (ll ! var q)\")\n apply (erule_tac x=k in allE)\n apply auto\n done\n from Dag_q_Nodes_n have q_in_Nodesn: \"q \\ Nodes n ll\"\n by simp\n then have \"\\ k set (ll ! k)\"\n by (simp add: Nodes_def)\n with wf_ll nsll have \"q \\ set (ll ! n)\"\n apply -\n apply (erule exE)\n apply (rule_tac i=k and j=n in no_in_one_ll)\n apply (auto simp add: length_ll_eq)\n done\n with repbc_nc have repbc_q: \"repc q = repb q\"\n apply -\n apply (erule_tac x=q in allE)\n apply auto\n done\n from normalize_prop q_in_Nodesn have \"var (repb q) <= var q\"\n apply -\n apply (erule_tac x=q in ballE)\n apply auto\n done\n with repbc_q have var_repc_q: \"var (repc q) <= var q\"\n by simp\n with varq_sn have var_repc_q_n: \"var (repc q) < n\"\n by simp\n \n from Nodes_subset Dag_q_Nodes_n while_while_prop \n have ord_t1_var_rep: \"ordered t1 var \\ var (repc q) <= var q\" \n apply (elim conjE)\n apply (erule_tac x=q in ballE)\n apply auto\n done\n then have ord_t1: \"ordered t1 var\" by simp\n from ord_t1_var_rep have varrep_q: \"var (repc q) <= var q\" by simp\n from t2_in_DagsNodesSucn have ord_t2: \"ordered t2 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t2 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes have x_in_repcNodesSucn: \n \"\\x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where repca_p: \"p=repc a\" and \n a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from while_while_prop have while_prop_part: \n \"\\no \\ Nodes (Suc n) ll. \n var (repc no) <= var no\"\n by auto\n from while_while_prop have rep_rep_nort: \n \"\\no\\Nodes (n + 1) ll. (\\nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\ \n (\\no\\set_of nort. repc no = no))\"\n by auto\n from repcNodes_in_Nodes null_notin_Nodes_Suc_n \n have \"\\no \\ Nodes (n+1) ll. repc no \\ Null\"\n by auto\n with rep_rep_nort have \"\\ no \\ Nodes (n+1) ll. repc (repc no) = (repc no)\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in ballE)\n apply (erule exE)\n apply (subgoal_tac \"repc no \\ set_of nort\")\n apply (elim conjE)\n apply (erule_tac x=\"repc no\" in ballE)\n apply simp\n apply simp\n apply (simp)\n apply (elim conjE)\n apply (thin_tac \"\\no\\set_of nort. repc no = no\")\n apply auto\n done\n with t2_in_DagsNodesSucn t2_notin_DagsNodesn ord_t2 while_prop_part \n wf_ll nsll repcNodes_in_Nodes obtain a where\n t2_repc_dag: \"Dag (repc a) (repc \\ low) (repc \\ high) t2\" and\n a_in_lln: \"a \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a_in_pret: \"a \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a_in_lln have vara_n: \"var a = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a_in_lln rep_prop obtain\n repp_nNull: \" repc a \\ Null\" and\n repp_reduce: \"(repc \\ low) a = (repc \\ high) a \\ low a \\ Null \n \\ repc a = (repc \\ high) a\" and\n repp_share: \"((repc \\ low) a = (repc \\ high) a \\ low a = Null) \n \\ repc a \\ set (ll ! n) \\\n repc (repc a) = repc a \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a \\ \n (repc \\ low) no1 = (repc \\ low) a) = (repc a = repc no1))\"\n using [[simp_depth_limit=4]]\n by auto\n from t2_repc_dag a_in_lln repp_nNull obtain lt2 rt2 where \n t2_Node: \"t2 = (Node lt2 (repc a) rt2)\"\n by auto\n have \"isomorphic_dags_eq t1 t2 var\"\n proof (cases \"(repc \\ low) a = (repc \\ high) a \\ low a \\ Null\")\n case True\n note red=this\n then have red_case: \"(repc \\ low) a = (repc \\ high) a\"\n by simp\n from red have low_nNull: \"low a \\ Null\"\n by simp\n with pret_dag prebdt_pret a_in_pret have highp_nNull: \"high a \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a_in_pret low_nNull highp_nNull \n have var_children_smaller: \"var (low a) < var a \\ var (high a) < var a\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a_in_pret have a_nNull: \"a \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a_in_pret highp_nNull pret_dag have \"high a \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a \\ set (ll ! (var (high a)))\" \n by (simp add: wf_ll_def)\n with a_in_lln t2_repc_dag var_children_smaller vara_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha_in_Nodesn: \"(high a) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha_in_rNodesn: \"repc (high a) \\ repc ` Nodes n ll\"\n by simp\n from higha_in_Nodesn normalize_prop obtain rt where \n rt_dag: \"Dag (repb (high a)) (repb \\ low) (repb \\ high) rt\" and\n rt_in_repbNort: \"set_of rt \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a\" in ballE)\n apply auto\n done\n from rt_in_repbNort repbNodes_repcNodes \n have rt_in_repcNodesn: \"set_of rt \\ repc `Nodes n ll\"\n by blast\n from rt_dag higha_in_Nodesn \n have repcrt_dag: \"Dag (repc (high a)) (repc \\ low) (repc \\ high) rt\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt_nTip: \"rt \\ Tip\"\n proof -\n have \"repc (high a) \\ Null\"\n proof -\n note rhigha_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt_dag show ?thesis by auto\n qed\n from a_nNull a_in_pret low_nNull pret_dag have \"low a \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \"low a \\ set (ll ! (var (low a)))\" \n by (simp add: wf_ll_def)\n with a_in_lln t2_repc_dag var_children_smaller vara_n \n have \"\\k set (ll ! k)\"\n by auto\n then have \"(low a) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlow_in_rNodesn: \"repc (low a) \\ repc ` Nodes n ll\"\n by simp\n show ?thesis\n proof -\n from repp_reduce low_nNull highp_nNull red_case \n have repc_p_def: \"repc a = repc (high a)\" \n by (simp add: null_comp_def)\n with rt_in_repcNodesn repcrt_dag rhigha_in_rNodesn a_in_lln t2_repc_dag\n repc_p_def rt_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt\")\n apply (auto simp add: Dag_unique)\n done\n from t1_in_DagsNodesn t2_in_Dags_Nodesn repbc_dags_eq isomorphic_dags_eq_asm \n show shared_t1_t2: \"isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (erule_tac x=t1 in allE)\n apply (erule_tac x=t2 in allE)\n apply simp\n done\n qed\n next\n assume share: \" \\ ((repc \\ low) a = (repc \\ high) a \\ low a \\ Null)\"\n then\n have share: \"(repc \\ low) a \\ (repc \\ high) a \\ low a = Null\"\n using [[simp_depth_limit=1]]\n by simp\n with repp_share obtain \n ra_in_llbn: \"repc a \\ set (ll ! n)\" and \n rra_ra: \"repc (repc a) = repc a\" and\n two_nodes_share: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) a \\ \n (repc \\ low) no1 = (repc \\ low) a) = (repc a = repc no1))\"\n using [[simp_depth_limit=3]]\n by simp\n from wf_ll ra_in_llbn nsll have var_repc_a_n: \"var (repc a) = n\" \n by (auto simp add: wf_ll_def length_ll_eq)\n show ?thesis\n proof (auto simp add: isomorphic_dags_eq_def)\n fix bdt1\n assume bdt_t1: \"bdt t1 var = Some bdt1\"\n assume bdt_t2: \"bdt t2 var = Some bdt1\"\n show \"t1 = t2\"\n proof (cases t1)\n case Tip\n with bdt_t1 show ?thesis\n by simp\n next\n case (Node lt1 p1 rt1)\n note t1_Node=this\n with Dag_q_Nodes_n have \"p1=(repc q)\"\n by simp\n with t2_Node bdt_t1 bdt_t2 t1_Node have \"var (repc q) = var (repc a)\"\n apply -\n apply (rule same_bdt_var)\n apply auto\n done\n with var_repc_q_n var_repc_a_n show ?thesis\n by simp\n qed\n qed\n qed }\n note mixed_Dags_case = this\n from repbc_dags_eq isomorphic_dags_eq \n have dags_shared: \n \"\\t1 t2. t1 \\ Dags (repc ` Nodes (Suc n) ll)(repc \\ low)(repc \\ high)\\\n t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (rule Dags_Nodes_cases)\n apply (rule isomorphic_dags_eq_sym)\n proof -\n fix t1 t2\n assume t1_in_Dagsn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_Dagsn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repb_repc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n with t1_in_Dagsn t2_in_Dagsn isomorphic_dags_eq_asm \n show \"isomorphic_dags_eq t1 t2 var\" by simp\n next\n fix t1 t2\n assume t1_in_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume isomorphic_dags_eq_asm: \n \"\\t1 t2. t1 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \\\n t2 \\ Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high) \n \\ isomorphic_dags_eq t1 t2 var\"\n assume repbc_Dags: \n \"Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high) = \n Dags (repb ` Nodes n ll) (repb \\ low) (repb \\ high)\"\n from t1_in_DagsNodesn t2_notin_DagsNodesn t2_in_DagsNodesSucn \n isomorphic_dags_eq_asm repbc_Dags\n show \"isomorphic_dags_eq t1 t2 var\"\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n next\n fix t1 t2\n assume t1_in_DagsNodesSucn: \n \"t1 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume t1_notin_DagsNodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n assume t2_in_DagsNodesSucn: \n \"t2 \\ Dags (repc ` Nodes (Suc n) ll) (repc \\ low) (repc \\ high)\"\n assume t2_notin_DagsNodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n \n \n (* ab hier gehts um t1 *)\n from t1_in_DagsNodesSucn have ord_t1: \"ordered t1 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t1 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes \n have x_in_repcNodesSucn: \n \"\\ x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where \n repca_p: \"p=repc a\" and a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from while_while_prop \n have while_prop_part: \"\\no \\ Nodes (Suc n) ll. \n var (repc no) <= var no\"\n by auto\n from while_while_prop have rep_rep_nort: \n \"\\no\\Nodes (n + 1) ll. \n (\\nort. Dag (repc no) (repc \\ low) (repc \\ high) nort \\ \n (\\no\\set_of nort. repc no = no))\"\n by auto\n from repcNodes_in_Nodes null_notin_Nodes_Suc_n \n have \"\\ no \\ Nodes (n+1) ll. repc no \\ Null\"\n by auto\n with rep_rep_nort \n have rep_rep_no: \"\\no \\ Nodes (n+1) ll. repc (repc no) = (repc no)\"\n apply -\n apply (rule ballI)\n apply (erule_tac x=no in ballE)\n prefer 2\n apply simp\n apply (erule_tac x=no in ballE)\n apply (erule exE)\n apply (subgoal_tac \"repc no \\ set_of nort\")\n apply (elim conjE)\n apply (erule_tac x=\"repc no\" in ballE)\n apply simp\n apply simp\n apply (simp)\n apply (elim conjE)\n apply (thin_tac \"\\no\\set_of nort. repc no = no\")\n apply auto\n done\n with t1_in_DagsNodesSucn t1_notin_DagsNodesn ord_t1 while_prop_part wf_ll \n nsll repcNodes_in_Nodes obtain a1 where\n t1_repc_dag: \"Dag (repc a1) (repc \\ low) (repc \\ high) t1\" and\n a1_in_lln: \"a1 \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a1_in_pret: \"a1 \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a1_in_lln have vara1_n: \"var a1 = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a1_in_lln rep_prop obtain\n repa1_nNull: \" repc a1 \\ Null\" and\n repa1_reduce: \"(repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null \n \\ repc a1 = (repc \\ high) a1\" and\n repa1_share: \"((repc \\ low) a1 = (repc \\ high) a1 \\ low a1 = Null) \n \\ repc a1 \\ set (ll ! n) \\ repc (repc a1) = repc a1 \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a1 \\ \n (repc \\ low) no1 = (repc \\ low) a1) = (repc a1 = repc no1))\"\n using [[simp_depth_limit=4]]\n by auto\n from t1_repc_dag a1_in_lln repa1_nNull obtain lt1 rt1 where \n t1_Node: \"t1 = (Node lt1 (repc a1) rt1)\"\n by auto\n\n\n\n (* ab hier gehts um t2 *)\n from t2_in_DagsNodesSucn have ord_t2: \"ordered t2 var\"\n proof (elim Dags.cases)\n fix p t\n assume t_in_repcNodes: \"set_of t \\ repc ` Nodes (Suc n) ll\"\n assume t_nTip: \" t \\ Tip\"\n assume t2t: \"t2 = t\"\n assume t_dag: \"Dag p (repc \\ low) (repc \\ high) t\"\n from t_in_repcNodes \n have x_in_repcNodesSucn: \n \"\\ x. x \\ set_of t \\ x \\ repc ` Nodes (Suc n) ll\" \n apply -\n apply auto\n done\n from t_nTip t_dag have \"p \\ Null\"\n apply -\n apply (case_tac \"p=Null\")\n apply auto\n done\n with t_nTip t_dag obtain lt rt where t_Node: \"t=Node lt p rt\"\n by auto\n then have \"p \\ set_of t\"\n by auto\n with x_in_repcNodesSucn have \"p \\ repc ` Nodes (Suc n) ll\"\n by simp\n then obtain a where \n repca_p: \"p=repc a\" and a_in_NodesSucn: \"a \\ Nodes (Suc n) ll\"\n by auto\n with repca_p while_while_prop t_dag t2t show ?thesis\n apply -\n apply (erule_tac x=a in ballE)\n apply (elim conjE exE)\n apply (subgoal_tac \"nort = t\") \n prefer 2\n apply (simp add: Dag_unique)\n apply auto\n done\n qed\n from rep_rep_no t2_in_DagsNodesSucn t2_notin_DagsNodesn ord_t2 while_prop_part wf_ll \n nsll repcNodes_in_Nodes obtain a2 where\n t2_repc_dag: \"Dag (repc a2) (repc \\ low) (repc \\ high) t2\" and\n a2_in_lln: \"a2 \\ set (ll ! n)\"\n apply -\n apply (drule restrict_root_Node)\n apply (auto simp add: length_ll_eq)\n done\n with wf_ll nsll have a2_in_pret: \"a2 \\ set_of pret\" \n by (simp add: wf_ll_def length_ll_eq)\n from wf_ll nsll a2_in_lln have vara2_n: \"var a2 = n\" \n by (simp add: wf_ll_def length_ll_eq)\n from a2_in_lln rep_prop obtain\n repa2_nNull: \" repc a2 \\ Null\" and\n repa2_reduce: \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null \n \\ repc a2 = (repc \\ high) a2\" and\n repa2_share: \"((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 = Null) \n \\ repc a2 \\ set (ll ! n) \\ repc (repc a2) = repc a2 \\ \n (\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a2 \\ \n (repc \\ low) no1 = (repc \\ low) a2) = (repc a2 = repc no1))\"\n using [[simp_depth_limit = 4]]\n by auto\n from t2_repc_dag a2_in_lln repa2_nNull obtain lt2 rt2 where \n t2_Node: \"t2 = (Node lt2 (repc a2) rt2)\"\n by auto\n show \"isomorphic_dags_eq t1 t2 var\"\n proof (cases \"(repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null\")\n case True\n note t1_red_cond=this \n with t1_red_cond have t1_red_case: \"(repc \\ low) a1 = (repc \\ high) a1\"\n by simp\n from t1_red_cond have lowa1_nNull: \"low a1 \\ Null\"\n by simp\n with pret_dag prebdt_pret a1_in_pret have higha1_nNull: \"high a1 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a1_in_pret lowa1_nNull higha1_nNull \n have var_children_smaller_a1: \"var (low a1) < var a1 \\ var (high a1) < var a1\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a1_in_pret have a1_nNull: \"a1 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a1_in_pret higha1_nNull pret_dag have \"high a1 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a1 \\ set (ll ! (var (high a1)))\" \n by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\k set (ll ! k)\"\n by auto\n then have higha1_in_Nodesn: \"(high a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha1_in_rNodesn: \"repc (high a1) \\ repc ` Nodes n ll\"\n by simp\n from higha1_in_Nodesn normalize_prop obtain rt1 where \n rt1_dag: \"Dag (repb (high a1)) (repb \\ low) (repb \\ high) rt1\" and\n rt1_in_repbNort: \"set_of rt1 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a1\" in ballE)\n apply auto\n done\n from rt1_in_repbNort repbNodes_repcNodes \n have rt1_in_repcNodesn: \"set_of rt1 \\ repc `Nodes n ll\"\n by blast\n from rt1_dag higha1_in_Nodesn \n have repcrt1_dag: \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt1_nTip: \"rt1 \\ Tip\"\n proof -\n have \"repc (high a1) \\ Null\"\n proof -\n note rhigha1_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt1_dag show ?thesis by auto\n qed\n from repa1_reduce lowa1_nNull higha1_nNull t1_red_case \n have repc_a1_def: \"repc a1 = repc (high a1)\" \n by (simp add: null_comp_def)\n with rt1_in_repcNodesn repcrt1_dag rhigha1_in_rNodesn a1_in_lln \n t1_repc_dag repc_a1_def rt1_nTip \n have t1_in_Dags_Nodesn: \n \"t1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t1=rt1\")\n apply (auto simp add: Dag_unique)\n done\n show ?thesis\n proof (cases \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null\")\n case True\n note t2_red_cond=this \n with t2_red_cond have t2_red_case: \"(repc \\ low) a2 = (repc \\ high) a2\"\n by simp\n from t2_red_cond have lowa2_nNull: \"low a2 \\ Null\"\n by simp\n with pret_dag prebdt_pret a2_in_pret have higha2_nNull: \"high a2 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a2_in_pret lowa2_nNull higha2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a2_in_pret higha2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2 where \n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2\" and\n rt2_in_repbNort: \"set_of rt2 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2 \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag show ?thesis by auto\n qed\n from repa2_reduce lowa2_nNull higha2_nNull t2_red_case \n have repc_a2_def: \"repc a2 = repc (high a2)\" \n by (simp add: null_comp_def)\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag repc_a2_def rt2_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt2\")\n apply (auto simp add: Dag_unique)\n done\n from isomorphic_dags_eq t1_in_Dags_Nodesn t2_in_Dags_Nodesn repbc_dags_eq \n show ?thesis\n by auto\n next\n assume t2_share_cond: \n \"\\ ((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null)\"\n from t1_in_Dags_Nodesn t2_notin_DagsNodesn t2_in_DagsNodesSucn \n isomorphic_dags_eq repbc_dags_eq\n show ?thesis\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n qed\n next\n assume t1_share_cond: \n \"\\((repc \\ low) a1 = (repc \\ high) a1 \\ low a1 \\ Null)\"\n with repa1_share obtain\n repca1_in_llbn: \"repc a1 \\ set (ll ! n)\" and \n reprepa1: \"repc (repc a1) = repc a1\" and\n twonodes_llbn_a1: \n \"(\\no1\\set (ll ! n). ((repc \\ high) no1 = (repc \\ high) a1 \\ \n (repc \\ low) no1 = (repc \\ low) a1) = (repc a1 = repc no1))\"\n using [[simp_depth_limit=2]]\n by auto\n show ?thesis\n proof (cases \"(repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null\")\n case True\n note t2_red_cond=this \n with t2_red_cond have t2_red_case: \"(repc \\ low) a2 = (repc \\ high) a2\"\n by simp\n from t2_red_cond have lowa2_nNull: \"low a2 \\ Null\"\n by simp\n with pret_dag prebdt_pret a2_in_pret have higha2_nNull: \"high a2 \\ Null\" \n apply -\n apply (drule balanced_bdt)\n apply auto\n done\n from pret_dag ord_pret a2_in_pret lowa2_nNull higha2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n with a2_in_pret higha2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll \n have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2 where \n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2\" and\n rt2_in_repbNort: \"set_of rt2 \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2 \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag show ?thesis by auto\n qed\n from repa2_reduce lowa2_nNull higha2_nNull t2_red_case \n have repc_a2_def: \"repc a2 = repc (high a2)\" \n by (simp add: null_comp_def)\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag repc_a2_def rt2_nTip \n have t2_in_Dags_Nodesn: \n \"t2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply simp\n apply (subgoal_tac \"t2=rt2\")\n apply (auto simp add: Dag_unique)\n done\n from t2_in_Dags_Nodesn t1_notin_DagsNodesn t1_in_DagsNodesSucn \n isomorphic_dags_eq repbc_dags_eq \n have \"isomorphic_dags_eq t2 t1 var\"\n apply -\n apply (rule mixed_Dags_case)\n apply auto\n done\n then show ?thesis\n by (simp add: isomorphic_dags_eq_sym)\n next\n assume t2_shared_cond: \n \"\\ ((repc \\ low) a2 = (repc \\ high) a2 \\ low a2 \\ Null)\"\n with repa2_share obtain\n repca2_in_llbn: \"repc a2 \\ set (ll ! n)\" and \n reprepa2: \"repc (repc a2) = repc a2\" and\n twonodes_llbn_a2: \"(\\no1\\set (ll ! n). \n ((repc \\ high) no1 = (repc \\ high) a2 \\ \n (repc \\ low) no1 = (repc \\ low) a2) = (repc a2 = repc no1))\"\n using [[simp_depth_limit=2]]\n by auto \n from twonodes_llbn_a2 a1_in_lln \n have share_a1_a2: \n \"((repc \\ high) a1 = (repc \\ high) a2 \\ \n (repc \\ low) a1 = (repc \\ low) a2) = (repc a2 = repc a1)\"\n by auto\n from twonodes_llbn_a1 repca1_in_llbn reprepa1 \n have children_repc_eq_a1: \"(repc \\ high) (repc a1) = (repc \\ high) a1 \\ \n (repc \\ low) (repc a1) = (repc \\ low) a1\"\n by auto\n from twonodes_llbn_a2 repca2_in_llbn reprepa2 \n have children_repc_eq_a2: \"(repc \\ high) (repc a2) = (repc \\ high) a2 \\ \n (repc \\ low) (repc a2) = (repc \\ low) a2\"\n by auto\n from t1_Node t2_Node show ?thesis\n proof (clarsimp simp add: isomorphic_dags_eq_def)\n fix bdt1\n assume t1_bdt: \"bdt (Node lt1 (repc a1) rt1) var = Some bdt1\"\n assume t2_bdt: \"bdt (Node lt2 (repc a2) rt2) var = Some bdt1\"\n show \"lt1 = lt2 \\ repc a1 = repc a2 \\ rt1 = rt2\"\n proof (cases bdt1)\n case Zero\n with t1_bdt t1_Node obtain\n lt1_Tip: \"lt1 = Tip\" and\n rt1_Tip: \"rt1 = Tip\"\n by simp\n from Zero t2_bdt t2_Node obtain \n lt2_Tip: \"lt2 = Tip\" and\n rt2_Tip: \"rt2 = Tip\"\n by simp\n from t1_repc_dag t1_Node lt1_Tip have \"(repc \\ low) (repc a1) = Null\" \n by simp\n with children_repc_eq_a1 \n have repc_low_a1_Null: \"(repc \\ low) a1 = Null\"\n by simp\n from t1_repc_dag t1_Node rt1_Tip \n have \"(repc \\ high) (repc a1) = Null\"\n by simp\n with children_repc_eq_a1 \n have repc_high_a1_Null: \"(repc \\ high) a1 = Null\"\n by simp\n from t2_repc_dag t2_Node lt2_Tip have \"(repc \\ low) (repc a2) = Null\" \n by simp\n with children_repc_eq_a2 \n have repc_low_a2_Null: \"(repc \\ low) a2 = Null\"\n by simp\n from t2_repc_dag t2_Node rt2_Tip \n have \"(repc \\ high) (repc a2) = Null\"\n by simp\n with children_repc_eq_a2 \n have repc_high_a2_Null: \"(repc \\ high) a2 = Null\"\n by simp\n with share_a1_a2 repc_low_a1_Null repc_high_a1_Null \n repc_low_a2_Null repc_high_a2_Null\n have \"repc a2 = repc a1\"\n by auto\n with lt1_Tip rt1_Tip lt2_Tip rt2_Tip show ?thesis\n by auto\n next\n case One\n with t1_bdt t1_Node obtain\n lt1_Tip: \"lt1 = Tip\" and\n rt1_Tip: \"rt1 = Tip\"\n by simp\n from One t2_bdt t2_Node obtain \n lt2_Tip: \"lt2 = Tip\" and\n rt2_Tip: \"rt2 = Tip\"\n by simp\n from t1_repc_dag t1_Node lt1_Tip have \"(repc \\ low) (repc a1) = Null\" \n by simp\n with children_repc_eq_a1 \n have repc_low_a1_Null: \"(repc \\ low) a1 = Null\"\n by simp\n from t1_repc_dag t1_Node rt1_Tip have \"(repc \\ high) (repc a1) = Null\"\n by simp\n with children_repc_eq_a1 \n have repc_high_a1_Null: \"(repc \\ high) a1 = Null\"\n by simp\n from t2_repc_dag t2_Node lt2_Tip have \"(repc \\ low) (repc a2) = Null\" \n by simp\n with children_repc_eq_a2 \n have repc_low_a2_Null: \"(repc \\ low) a2 = Null\"\n by simp\n from t2_repc_dag t2_Node rt2_Tip have \"(repc \\ high) (repc a2) = Null\"\n by simp\n with children_repc_eq_a2 \n have repc_high_a2_Null: \"(repc \\ high) a2 = Null\"\n by simp\n with share_a1_a2 repc_low_a1_Null repc_high_a1_Null \n repc_low_a2_Null repc_high_a2_Null\n have \"repc a2 = repc a1\"\n by auto\n with lt1_Tip rt1_Tip lt2_Tip rt2_Tip show ?thesis\n by auto\n next\n case (Bdt_Node lbdt v rbdt)\n note bdt_Node_case=this\n with t1_bdt t1_Node obtain\n lbdt_def_lt1: \"bdt lt1 var = Some lbdt\" and\n rbdt_def_rt1: \"bdt rt1 var = Some rbdt\"\n by auto\n from t2_bdt bdt_Node_case t2_Node obtain\n lbdt_def_lt2: \"bdt lt2 var = Some lbdt\" and\n rbdt_def_rt2: \"bdt rt2 var = Some rbdt\"\n by auto\n from lbdt_def_lt1 t1_Node t1_repc_dag children_repc_eq_a1 \n have \"(repc \\ low) a1 \\ Null\"\n by auto\n then have low_a1_nNull: \"(low a1) \\ Null\" \n by (auto simp: null_comp_def)\n from rbdt_def_rt1 t1_Node t1_repc_dag children_repc_eq_a1 \n have \"(repc \\ high) a1 \\ Null\"\n by auto\n then have high_a1_nNull: \"(high a1) \\ Null\" \n by (auto simp: null_comp_def)\n from lbdt_def_lt2 t2_Node t2_repc_dag children_repc_eq_a2 \n have \"(repc \\ low) a2 \\ Null\"\n by auto\n then have low_a2_nNull: \"(low a2) \\ Null\" \n by (auto simp: null_comp_def)\n from rbdt_def_rt2 t2_Node t2_repc_dag children_repc_eq_a2 \n have \"(repc \\ high) a2 \\ Null\"\n by auto\n then have high_a2_nNull: \"(high a2) \\ Null\" \n by (auto simp: null_comp_def)\n\n (*hier gehts um t1*)\n from pret_dag ord_pret a1_in_pret low_a1_nNull high_a1_nNull \n have var_children_smaller_a1: \n \"var (low a1) < var a1 \\ var (high a1) < var a1\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a1_in_pret have a1_nNull: \"a1 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n \n (*hier gehts um rt1 *)\n with a1_in_pret high_a1_nNull pret_dag have \"high a1 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll \n have \"high a1 \\ set (ll ! (var (high a1)))\" \n by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha1_in_Nodesn: \"(high a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha1_in_rNodesn: \n \"repc (high a1) \\ repc ` Nodes n ll\"\n by simp\n from higha1_in_Nodesn normalize_prop obtain rt1h where\n rt1_dag: \"Dag (repb (high a1)) (repb \\ low) (repb \\ high) rt1h\" and\n rt1_in_repbNort: \"set_of rt1h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a1\" in ballE)\n apply auto\n done\n from rt1_in_repbNort repbNodes_repcNodes \n have rt1_in_repcNodesn: \"set_of rt1h \\ repc `Nodes n ll\"\n by blast\n from rt1_dag higha1_in_Nodesn \n have repcrt1_dag: \n \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t1_Node t1_repc_dag high_a1_nNull children_repc_eq_a1 \n have \"Dag (repc (high a1)) (repc \\ low) (repc \\ high) rt1\"\n by (auto simp add: null_comp_def)\n with repcrt1_dag have rt1h_rt1: \"rt1h = rt1\" by (simp add: Dag_unique)\n have rt1_nTip: \"rt1 \\ Tip\"\n proof -\n have \"repc (high a1) \\ Null\"\n proof -\n note rhigha1_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt1_dag rt1h_rt1 show ?thesis by auto\n qed\n with rt1_in_repcNodesn repcrt1_dag rhigha1_in_rNodesn a1_in_lln \n t1_repc_dag rt1h_rt1 \n have rt1_in_Dags_Nodesn: \n \"rt1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n\n \n (*hier gehts um lt1 *)\n from a1_nNull a1_in_pret low_a1_nNull pret_dag \n have \"low a1 \\ set_of pret\"\n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \n \"low a1 \\ set (ll ! (var (low a1)))\" by (simp add: wf_ll_def)\n with a1_in_lln t1_repc_dag var_children_smaller_a1 vara1_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have lowa1_in_Nodesn: \"(low a1) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlowa1_in_rNodesn: \"repc (low a1) \\ repc ` Nodes n ll\"\n by simp\n from lowa1_in_Nodesn normalize_prop obtain lt1h where\n lt1_dag: \"Dag (repb (low a1)) (repb \\ low) (repb \\ high) lt1h\" and\n lt1_in_repbNort: \"set_of lt1h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"low a1\" in ballE)\n apply auto\n done\n from lt1_in_repbNort repbNodes_repcNodes \n have lt1_in_repcNodesn: \"set_of lt1h \\ repc `Nodes n ll\"\n by blast\n from lt1_dag lowa1_in_Nodesn \n have repclt1_dag: \"Dag (repc (low a1)) (repc \\ low) (repc \\ high) lt1h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t1_Node t1_repc_dag low_a1_nNull children_repc_eq_a1 \n have \"Dag (repc (low a1)) (repc \\ low) (repc \\ high) lt1\"\n by (auto simp add: null_comp_def)\n with repclt1_dag have lt1h_lt1: \"lt1h = lt1\" by (simp add: Dag_unique)\n have lt1_nTip: \"lt1 \\ Tip\"\n proof -\n have \"repc (low a1) \\ Null\"\n proof -\n note rlowa1_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repclt1_dag lt1h_lt1 show ?thesis by auto\n qed\n with lt1_in_repcNodesn repclt1_dag rlowa1_in_rNodesn a1_in_lln \n t1_repc_dag lt1h_lt1 \n have lt1_in_Dags_Nodesn: \n \"lt1 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n \n \n (*hier gehts um t2*)\n from pret_dag ord_pret a2_in_pret low_a2_nNull high_a2_nNull \n have var_children_smaller_a2: \n \"var (low a2) < var a2 \\ var (high a2) < var a2\"\n apply -\n apply (rule var_ordered_children)\n apply auto\n done\n from pret_dag a2_in_pret have a2_nNull: \"a2 \\ Null\" \n apply -\n apply (rule set_of_nn [rule_format])\n apply auto\n done\n \n (*hier gehts um rt1 *)\n with a2_in_pret high_a2_nNull pret_dag have \"high a2 \\ set_of pret\" \n apply -\n apply (drule subelem_set_of_high)\n apply auto\n done\n with wf_ll have \"high a2 \\ set (ll ! (var (high a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have higha2_in_Nodesn: \"(high a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rhigha2_in_rNodesn: \n \"repc (high a2) \\ repc ` Nodes n ll\"\n by simp\n from higha2_in_Nodesn normalize_prop obtain rt2h where\n rt2_dag: \"Dag (repb (high a2)) (repb \\ low) (repb \\ high) rt2h\" and\n rt2_in_repbNort: \"set_of rt2h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"high a2\" in ballE)\n apply auto\n done\n from rt2_in_repbNort repbNodes_repcNodes \n have rt2_in_repcNodesn: \"set_of rt2h \\ repc `Nodes n ll\"\n by blast\n from rt2_dag higha2_in_Nodesn \n have repcrt2_dag: \n \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t2_Node t2_repc_dag high_a2_nNull children_repc_eq_a2 \n have \"Dag (repc (high a2)) (repc \\ low) (repc \\ high) rt2\"\n by (auto simp add: null_comp_def)\n with repcrt2_dag have rt2h_rt2: \"rt2h = rt2\" by (simp add: Dag_unique)\n have rt2_nTip: \"rt2 \\ Tip\"\n proof -\n have \"repc (high a2) \\ Null\"\n proof -\n note rhigha2_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repcrt2_dag rt2h_rt2 show ?thesis by auto\n qed\n with rt2_in_repcNodesn repcrt2_dag rhigha2_in_rNodesn a2_in_lln \n t2_repc_dag rt2h_rt2 \n have rt2_in_Dags_Nodesn: \n \"rt2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n\n \n (*hier gehts um lt2 *)\n from a2_nNull a2_in_pret low_a2_nNull pret_dag \n have \"low a2 \\ set_of pret\"\n apply -\n apply (drule subelem_set_of_low)\n apply auto\n done\n with wf_ll have \"low a2 \\ set (ll ! (var (low a2)))\" \n by (simp add: wf_ll_def)\n with a2_in_lln t2_repc_dag var_children_smaller_a2 vara2_n \n have \"\\ k set (ll ! k)\"\n by auto\n then have lowa2_in_Nodesn: \"(low a2) \\ Nodes n ll\"\n by (simp add: Nodes_def)\n then have rlowa2_in_rNodesn: \"repc (low a2) \\ repc ` Nodes n ll\"\n by simp\n from lowa2_in_Nodesn normalize_prop obtain lt2h where\n lt2_dag: \"Dag (repb (low a2)) (repb \\ low) (repb \\ high) lt2h\" and\n lt2_in_repbNort: \"set_of lt2h \\ repb `Nodes n ll\"\n apply -\n apply (erule_tac x=\"low a2\" in ballE)\n apply auto\n done\n from lt2_in_repbNort repbNodes_repcNodes \n have lt2_in_repcNodesn: \"set_of lt2h \\ repc `Nodes n ll\"\n by blast\n from lt2_dag lowa2_in_Nodesn \n have repclt2_dag: \"Dag (repc (low a2)) (repc \\ low) (repc \\ high) lt2h\"\n apply -\n apply (drule Nodes_repbc_Dags_eq [rule_format])\n apply auto\n done\n from t2_Node t2_repc_dag low_a2_nNull children_repc_eq_a2 \n have \"Dag (repc (low a2)) (repc \\ low) (repc \\ high) lt2\"\n by (auto simp add: null_comp_def)\n with repclt2_dag have lt2h_lt2: \"lt2h = lt2\" by (simp add: Dag_unique)\n have lt2_nTip: \"lt2 \\ Tip\"\n proof -\n have \"repc (low a2) \\ Null\"\n proof -\n note rlowa2_in_rNodesn\n also have \n \"repc `Nodes n ll \\ repc `Nodes (Suc n) ll\"\n using Nodes_subset \n by blast\n also have \"\\ \\ Nodes (Suc n) ll\"\n using repcNodes_in_Nodes\n by simp\n finally show ?thesis\n using null_notin_Nodes_Suc_n\n by auto\n qed\n with repclt2_dag lt2h_lt2 show ?thesis by auto\n qed\n with lt2_in_repcNodesn repclt2_dag rlowa2_in_rNodesn a2_in_lln \n t2_repc_dag lt2h_lt2 \n have lt2_in_Dags_Nodesn: \n \"lt2 \\ Dags (repc ` Nodes n ll) (repc \\ low) (repc \\ high)\"\n apply -\n apply (rule DagsI)\n apply auto\n done \n \n \n from isomorphic_dags_eq lt1_in_Dags_Nodesn lt2_in_Dags_Nodesn repbc_dags_eq \n have shared_lt1_lt2: \"isomorphic_dags_eq lt1 lt2 var\"\n by auto\n from isomorphic_dags_eq rt1_in_Dags_Nodesn rt2_in_Dags_Nodesn repbc_dags_eq \n have shared_rt1_rt2: \"isomorphic_dags_eq rt1 rt2 var\"\n by auto\n \n from shared_lt1_lt2 lbdt_def_lt1 lbdt_def_lt2 have lt1_lt2: \"lt1 = lt2\"\n by (auto simp add: isomorphic_dags_eq_def)\n then have root_lt1_lt2: \"root lt1 = root lt2\"\n by auto\n from lt1_nTip t1_repc_dag t1_Node have \"(repc \\ low) (repc a1) \\ Null\"\n by auto\n with lt1_nTip t1_repc_dag t1_Node obtain llt1 lt1p rlt1 where \n lt1_Node: \"lt1 = Node llt1 lt1p rlt1\"\n by auto\n with t1_repc_dag t1_Node children_repc_eq_a1 lt1_nTip \n have root_lt1: \"root lt1 = (repc \\ low) a1\"\n by auto\n from lt2_nTip t2_repc_dag t2_Node have \"(repc \\ low) (repc a2) \\ Null\"\n by auto\n with lt2_nTip t2_repc_dag t2_Node obtain llt2 lt2p rlt2 where \n lt2_Node: \"lt2 = Node llt2 lt2p rlt2\"\n by auto\n with t2_repc_dag t2_Node children_repc_eq_a2 lt2_nTip \n have root_lt2: \"root lt2 = (repc \\ low) a2\"\n by auto\n from root_lt1_lt2 root_lt2 root_lt1 \n have low_a1_a2: \"(repc \\ low) a1 = (repc \\ low) a2\"\n by auto\n from shared_rt1_rt2 rbdt_def_rt1 rbdt_def_rt2 have rt1_rt2: \"rt1 = rt2\"\n by (auto simp add: isomorphic_dags_eq_def)\n then have root_rt1_rt2: \"root rt1 = root rt2\"\n by auto\n from rt1_nTip t1_repc_dag t1_Node have \"(repc \\ high) (repc a1) \\ Null\"\n by auto\n with rt1_nTip t1_repc_dag t1_Node obtain lrt1 rt1p rrt1 where \n rt1_Node: \"rt1 = Node lrt1 rt1p rrt1\"\n by auto\n with t1_repc_dag t1_Node children_repc_eq_a1 rt1_nTip \n have root_rt1: \"root rt1 = (repc \\ high) a1\"\n by auto\n from rt2_nTip t2_repc_dag t2_Node \n have \"(repc \\ high) (repc a2) \\ Null\"\n by auto\n with rt2_nTip t2_repc_dag t2_Node obtain lrt2 rt2p rrt2 where \n rt2_Node: \"rt2 = Node lrt2 rt2p rrt2\"\n by auto\n with t2_repc_dag t2_Node children_repc_eq_a2 rt2_nTip \n have root_rt2: \"root rt2 = (repc \\ high) a2\"\n by auto\n from root_rt1_rt2 root_rt2 root_rt1 \n have high_a1_a2: \"(repc \\ high) a1 = (repc \\ high) a2\"\n by auto\n from low_a1_a2 high_a1_a2 share_a1_a2 \n have \"repc a1 = repc a2\"\n by auto\n with lt1_lt2 rt1_rt2 show ?thesis\n by auto\n qed\n qed\n qed\n qed\n qed\n from termi dags_shared while_while_prop repcNodes_in_Nodes repc_nc n_var_prop \n wf_marking_m_ma \n show ?thesis\n by auto\n qed\n qed\n with srrl_precond all_nodes_same_var \n show ?thesis\n apply -\n apply (intro conjI)\n apply assumption+\n done\n qed\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/BDD/NormalizeTotalProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.27172933061375243}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Sim\n imports Weak_Early_Semantics Strong_Early_Sim_Pres\nbegin\n\ndefinition weakSimulation :: \"pi \\ (pi \\ pi) set \\ pi \\ bool\" (\"_ \\<_> _\" [80, 80, 80] 80)\n where \"P \\ Q \\ (\\a x Q'. Q \\a<\\x> \\ Q' \\ x \\ P \\ (\\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel)) \\\n (\\\\ Q'. Q \\\\ \\ Q' \\ (\\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel))\"\n\n\n\n assumes \"P \\ P'\"\n and \"A \\ B\"\n\n shows \"P \\ P'\"\nusing assms\nby(simp add: weakSimulation_def) blast\n\nlemma simCasesCont[consumes 1, case_names Bound Free]:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and C :: \"'a::fs_name\"\n\n assumes Eqvt: \"eqvt Rel\"\n and Bound: \"\\a x Q'. \\Q \\ a<\\x> \\ Q'; x \\ P; x \\ Q; x \\ a; x \\ C\\ \\ \\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\"\n and Free: \"\\\\ Q'. Q \\ \\ \\ Q' \\ \\P'. P \\\\<^sup>^ \\ \\ P' \\ (P', Q') \\ Rel\"\n\n shows \"P \\ Q\"\nproof(auto simp add: weakSimulation_def)\n fix a x Q'\n assume QTrans: \"Q \\ a<\\x> \\ Q'\" and \"x \\ P\"\n obtain c::name where \"c \\ P\" and \"c \\ Q\" and \"c \\ a\" and \"c \\ Q'\" and \"c \\ C\" and \"c \\ x\"\n by(generate_fresh \"name\") auto\n\n from QTrans `c \\ Q'` have \"Q \\ a<\\c> \\ ([(x, c)] \\ Q')\" by(simp add: alphaBoundOutput)\n then obtain P' where PTrans: \"P \\a<\\c> \\ P'\" and P'RelQ': \"(P', [(x, c)] \\ Q') \\ Rel\"\n using `c \\ P` `c \\ Q` `c \\ a` `c \\ C`\n by(drule_tac Bound) auto\n\n from PTrans `x \\ P` `c \\ x` have \"P \\a<\\x> \\ ([(x, c)] \\ P')\"\n by(force intro: weakTransitionAlpha simp add: name_swap)\n moreover from Eqvt P'RelQ' have \"([(x, c)] \\ P', [(x, c)] \\ [(x, c)] \\ Q') \\ Rel\"\n by(rule eqvtRelI)\n hence \"([(x, c)] \\ P', Q') \\ Rel\" by simp\n ultimately show \"\\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\"\n by blast\nnext\n fix \\ Q'\n assume \"Q \\\\ \\ Q'\"\n thus \"\\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel\"\n by(rule Free)\nqed\n\nlemma simCases[case_names Bound Free]:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and C :: \"'a::fs_name\"\n\n assumes \"\\Q' a x. \\Q \\ a<\\x> \\ Q'; x \\ P\\ \\ \\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\"\n and \"\\Q' \\. Q \\ \\ \\ Q' \\ \\P'. P \\\\<^sup>^ \\ \\ P' \\ (P', Q') \\ Rel\"\n\n shows \"P \\ Q\"\nusing assms\nby(auto simp add: weakSimulation_def)\n\nlemma simE:\n fixes P :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Q :: pi\n and a :: name\n and x :: name\n and Q' :: pi\n\n assumes \"P \\ Q\"\n\n shows \"Q \\a<\\x> \\ Q' \\ x \\ P \\ \\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\"\n and \"Q \\\\ \\ Q' \\ \\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel\"\nusing assms by(simp add: weakSimulation_def)+\n\nlemma weakSimTauChain:\n fixes P :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n and Q :: pi\n and Q' :: pi\n\n assumes QChain: \"Q \\\\<^sub>\\ Q'\"\n and PRelQ: \"(P, Q) \\ Rel\"\n and PSimQ: \"\\R S. (R, S) \\ Rel \\ R \\ S\"\n\n shows \"\\P'. P \\\\<^sub>\\ P' \\ (P', Q') \\ Rel\"\nproof -\n from QChain show ?thesis\n proof(induct rule: tauChainInduct)\n case id\n moreover have \"P \\\\<^sub>\\ P\" by simp\n ultimately show ?case using PSimQ PRelQ by blast\n next\n case(ih Q' Q'')\n have \"\\P'. P \\\\<^sub>\\ P' \\ (P', Q') \\ Rel\" by fact\n then obtain P' where PChain: \"P \\\\<^sub>\\ P'\" and P'Rel'Q': \"(P', Q') \\ Rel\" by blast\n from P'Rel'Q' have \"P' \\ Q'\" by(rule PSimQ)\n moreover have Q'Trans: \"Q' \\\\ \\ Q''\" by fact\n ultimately obtain P'' where P'Trans: \"P' \\\\<^sup>^\\ \\ P''\" and P''RelQ'': \"(P'', Q'') \\ Rel\"\n by(blast dest: simE)\n from P'Trans have \"P' \\\\<^sub>\\ P''\" by simp\n with PChain have \"P \\\\<^sub>\\ P''\" by auto\n with P''RelQ'' show ?case by blast\n qed\nqed\n\nlemma simE2:\n fixes P :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Q :: pi\n and a :: name\n and x :: name\n and Q' :: pi\n\n assumes Sim: \"\\R S. (R, S) \\ Rel \\ R \\ S\"\n and Eqvt: \"eqvt Rel\"\n and PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"Q \\a<\\x> \\ Q' \\ x \\ P \\ \\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\"\n and \"Q \\\\<^sup>^\\ \\ Q' \\ \\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel\"\nproof -\n assume QTrans: \"Q \\a<\\x> \\ Q'\" and \"x \\ P\"\n from QTrans obtain Q'' Q''' where QChain: \"Q \\\\<^sub>\\ Q'''\"\n and Q'''Trans: \"Q''' \\a<\\x> \\ Q''\"\n and Q''Chain: \"Q'' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n\n from QChain PRelQ Sim obtain P''' where PChain: \"P \\\\<^sub>\\ P'''\" and P'''RelQ''': \"(P''', Q''') \\ Rel\" \n by(blast dest: weakSimTauChain)\n\n from PChain `x \\ P` have \"x \\ P'''\" by(rule freshChain)\n \n from P'''RelQ''' have \"P''' \\ Q'''\" by(rule Sim)\n with Q'''Trans `x \\ P'''` obtain P'' where P'''Trans: \"P''' \\a<\\x> \\ P''\"\n and P''RelQ'': \"(P'', Q'') \\ Rel\"\n by(blast dest: simE)\n\n from Q''Chain P''RelQ'' Sim obtain P' where P''Chain: \"P'' \\\\<^sub>\\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: weakSimTauChain)\n from PChain P'''Trans P''Chain have \"P \\a<\\x> \\ P'\"\n by(blast dest: Weak_Early_Step_Semantics.chainTransitionAppend)\n with P'RelQ' show \"\\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ Rel\" by blast\nnext\n assume \"Q \\\\<^sup>^\\ \\ Q'\"\n thus \"\\P'. P \\\\<^sup>^\\ \\ P' \\ (P', Q') \\ Rel\"\n proof(induct rule: transitionCases)\n case Step\n have \"Q \\\\ \\ Q'\" by fact\n then obtain Q'' Q''' where QChain: \"Q \\\\<^sub>\\ Q''\" \n and Q''Trans: \"Q'' \\\\ \\ Q'''\"\n and Q'''Chain: \"Q''' \\\\<^sub>\\ Q'\"\n by(blast dest: transitionE)\n\n from QChain PRelQ Sim have \"\\P''. P \\\\<^sub>\\ P'' \\ (P'', Q'') \\ Rel\"\n by(rule weakSimTauChain)\n then obtain P'' where PChain: \"P \\\\<^sub>\\ P''\" and P''RelQ'': \"(P'', Q'') \\ Rel\" by blast\n from P''RelQ'' have \"P'' \\ Q''\" by(rule Sim)\n with Q''Trans obtain P''' where P''Trans: \"P'' \\\\<^sup>^\\ \\ P'''\"\n and P'''RelQ''': \"(P''', Q''') \\ Rel\"\n by(blast dest: simE)\n \n have \"\\P'. P''' \\\\<^sub>\\ P' \\ (P', Q') \\ Rel\" using Q'''Chain P'''RelQ''' Sim\n by(rule weakSimTauChain)\n then obtain P' where P'''Chain: \"P''' \\\\<^sub>\\ P'\" and P'RelQ': \"(P', Q') \\ Rel\" by blast\n \n from PChain P''Trans P'''Chain have \"P \\\\<^sup>^\\ \\ P'\"\n by(blast dest: chainTransitionAppend)\n with P'RelQ' show ?case by blast\n next\n case Stay\n have \"P \\\\<^sup>^\\ \\ P\" by simp\n thus ?case using PRelQ by blast\n qed\nqed\n\nlemma eqvtI:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and perm :: \"name prm\"\n\n assumes PSimQ: \"P \\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n and EqvtRel': \"eqvt Rel'\"\n\n shows \"(perm \\ P) \\ (perm \\ Q)\"\nproof(induct rule: simCases)\n case(Bound Q' a x)\n have xFreshP: \"x \\ perm \\ P\" by fact\n have QTrans: \"(perm \\ Q) \\ a<\\x> \\ Q'\" by fact\n\n hence \"(rev perm \\ (perm \\ Q)) \\ rev perm \\ (a<\\x> \\ Q')\" by(rule eqvts)\n hence \"Q \\ (rev perm \\ a)<\\(rev perm \\ x)> \\ (rev perm \\ Q')\" \n by(simp add: name_rev_per)\n moreover from xFreshP have \"(rev perm \\ x) \\ P\" by(simp add: name_fresh_left)\n ultimately obtain P' where PTrans: \"P \\(rev perm \\ a)<\\(rev perm \\ x)> \\ P'\"\n and P'RelQ': \"(P', rev perm \\ Q') \\ Rel\" using PSimQ\n by(blast dest: simE)\n \n from PTrans have \"(perm \\ P) \\(perm \\ rev perm \\ a)<\\(perm \\ rev perm \\ x)> \\ perm \\ P'\" \n by(rule eqvts)\n hence \"(perm \\ P) \\a<\\x> \\ (perm \\ P')\" by(simp add: name_per_rev)\n moreover from P'RelQ' RelRel' have \"(P', rev perm \\ Q') \\ Rel'\" by blast\n with EqvtRel' have \"(perm \\ P', perm \\ (rev perm \\ Q')) \\ Rel'\"\n by(rule eqvtRelI)\n hence \"(perm \\ P', Q') \\ Rel'\" by(simp add: name_per_rev)\n ultimately show ?case by blast\nnext\n case(Free Q' \\)\n have QTrans: \"(perm \\ Q) \\ \\ \\ Q'\" by fact\n\n hence \"(rev perm \\ (perm \\ Q)) \\ rev perm \\ (\\ \\ Q')\" by(rule eqvts)\n hence \"Q \\ (rev perm \\ \\) \\ (rev perm \\ Q')\" by(simp add: name_rev_per)\n with PSimQ obtain P' where PTrans: \"P \\\\<^sup>^ (rev perm \\ \\) \\ P'\"\n and PRel: \"(P', (rev perm \\ Q')) \\ Rel\"\n by(blast dest: simE)\n\n from PTrans have \"(perm \\ P) \\\\<^sup>^ (perm \\ rev perm \\ \\) \\ perm \\ P'\"\n by(rule Weak_Early_Semantics.eqvtI)\n hence L1: \"(perm \\ P) \\\\<^sup>^ \\ \\ (perm \\ P')\" by(simp add: name_per_rev)\n from PRel EqvtRel' RelRel' have \"((perm \\ P'), (perm \\ (rev perm \\ Q'))) \\ Rel'\"\n by(force intro: eqvtRelI)\n hence \"((perm \\ P'), Q') \\ Rel'\" by(simp add: name_per_rev)\n with L1 show ?case by blast\nqed\n\n(*****************Reflexivity and transitivity*********************)\n\nlemma reflexive:\n fixes P :: pi\n and Rel :: \"(pi \\ pi) set\"\n\n assumes \"Id \\ Rel\"\n\n shows \"P \\ P\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.singleActionChain\n simp add: weakSimulation_def weakFreeTransition_def)\n\n\n\n assumes QSimR: \"Q \\ R\"\n and Eqvt: \"eqvt Rel\"\n and Eqvt'': \"eqvt Rel''\"\n and Trans: \"Rel O Rel' \\ Rel''\"\n and Sim: \"\\S T. (S, T) \\ Rel \\ S \\ T\"\n and PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"P \\ R\"\nproof -\n from Eqvt'' show ?thesis\n proof(induct rule: simCasesCont[where C=Q])\n case(Bound a x R')\n have RTrans: \"R \\a<\\x> \\ R'\" by fact\n from `x \\ Q` QSimR RTrans obtain Q' where QTrans: \"Q \\a<\\x> \\ Q'\"\n and Q'Rel'R': \"(Q', R') \\ Rel'\"\n by(blast dest: simE)\n\n from Sim Eqvt PRelQ QTrans `x \\ P` \n obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(drule_tac simE2) auto\n(* by(blast dest: simE2)*)\n moreover from P'RelQ' Q'Rel'R' Trans have \"(P', R') \\ Rel''\" by blast\n ultimately show ?case by blast\n next\n case(Free \\ R')\n have RTrans: \"R \\ \\ \\ R'\" by fact\n with QSimR obtain Q' where QTrans: \"Q \\\\<^sup>^ \\ \\ Q'\" and Q'RelR': \"(Q', R') \\ Rel'\"\n by(blast dest: simE)\n from Sim Eqvt PRelQ QTrans have \"\\P'. P \\\\<^sup>^ \\ \\ P' \\ (P', Q') \\ Rel\"\n by(blast intro: simE2)\n then obtain P' where PTrans: \"P \\\\<^sup>^ \\ \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\" by blast\n from P'RelQ' Q'RelR' Trans have \"(P', R') \\ Rel''\" by blast\n with PTrans show ?case by blast\n qed\nqed\n\nlemma strongAppend:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n and Rel'' :: \"(pi \\ pi) set\"\n\n assumes PSimQ: \"P \\ Q\"\n and QSimR: \"Q \\[Rel'] R\"\n and Eqvt'': \"eqvt Rel''\"\n and Trans: \"Rel O Rel' \\ Rel''\"\n\n shows \"P \\ R\"\nproof -\n from Eqvt'' show ?thesis\n proof(induct rule: simCasesCont[where C=Q])\n case(Bound a x R')\n have RTrans: \"R \\a<\\x> \\ R'\" by fact\n from QSimR RTrans `x \\ Q` obtain Q' where QTrans: \"Q \\a<\\x> \\ Q'\"\n and Q'Rel'R': \"(Q', R') \\ Rel'\"\n by(blast dest: Strong_Early_Sim.elim)\n\n with PSimQ QTrans `x \\ P` obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\" \n by(blast dest: simE)\n moreover from P'RelQ' Q'Rel'R' Trans have \"(P', R') \\ Rel''\" by blast\n ultimately show ?case by blast\n next\n case(Free \\ R')\n have RTrans: \"R \\ \\ \\ R'\" by fact\n with QSimR obtain Q' where QTrans: \"Q \\\\ \\ Q'\" and Q'RelR': \"(Q', R') \\ Rel'\"\n by(blast dest: Strong_Early_Sim.elim)\n from PSimQ QTrans obtain P' where PTrans: \"P \\\\<^sup>^ \\ \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from P'RelQ' Q'RelR' Trans have \"(P', R') \\ Rel''\" by blast\n with PTrans show ?case by blast\n qed\nqed\n\nlemma strongSimWeakSim:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n\n assumes PSimQ: \"P \\[Rel] Q\"\n\n shows \"P \\ Q\"\nproof(induct rule: simCases)\n case(Bound Q' a x)\n have \"Q \\a<\\x> \\ Q'\" by fact\n with PSimQ `x \\ P` obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: Strong_Early_Sim.elim)\n from PTrans have \"P \\a<\\x> \\ P'\"\n by(force intro: Weak_Early_Step_Semantics.singleActionChain simp add: weakFreeTransition_def)\n with P'RelQ' show ?case by blast\nnext\n case(Free Q' \\)\n have \"Q \\\\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\\\ \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: Strong_Early_Sim.elim)\n from PTrans have \"P \\\\<^sup>^\\ \\ P'\" by(rule Weak_Early_Semantics.singleActionChain)\n with P'RelQ' show ?case by blast\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Early_Sim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.27172933061375243}} {"text": "theory InferSound\n imports InferDef\nbegin\n\n (* ##### inference correctness lemma 1 *)\n\nlemma ivl_const_main: \"\\ dir_sol_sat t_sub p_sub c_list; const_scheme x ds tau c_list ds'\\ \\ full_subst_type t_sub p_sub tau_n tau \\ const_type x\"\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: full_subst_type_def)\n apply (simp_all add: pure_fun_s_def)\n apply (simp_all add: pure_fun_def)\n apply (simp_all add: unlim_def)\n apply (simp_all add: is_own_def)\n apply (auto)\n done\n \nlemma ivl_op_main: \"full_subst_type t_sub p_sub tau_n (op_scheme x) = op_type x\"\n apply (case_tac x)\n apply (auto)\n apply (simp_all add: full_subst_type_def)\n apply (simp_all add: pure_fun_s_def)\n apply (simp_all add: pure_fun_def)\n done\n \nlemma ivl_pair_ih: \"\\ \\env tau r_s r_x r_m c_list ds ds'.\n \\infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\\n \\ well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m));\n infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\ \\\n well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m))\" \n apply (auto)\n done\n \nlemma ivl_if_ih: \"\\ \\env tau r_s r_x r_m c_list ds ds'.\n \\infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\\n \\ well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m));\n infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list \\ \\\n well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m))\" \n apply (auto)\n done\n \nlemma ivl_lam_ih: \"\\ \\env tau r_s r_x r_m c_list ds ds'.\n \\infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\\n \\ well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m));\n infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list \\ \\\n well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m))\" \n apply (auto)\n done\n \nlemma ivl_app_ih: \"\\ \\env tau r_s r_x r_m c_list ds ds'.\n \\infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\\n \\ well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m));\n infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list\\ \\\n well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m))\n (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m))\" \n apply (auto)\n done\n \nlemma ivl_var_leq_perm: \"\\ req_type tau_n = Prim \\ \\\n leq_perm (end_req_perm (full_subst_type t_sub p_sub tau_n (VarScheme b)))\n (dir_subst_penv t_sub p_sub (one_var_env (owner_name x) (XType b)) (owner_name x))\"\n apply (simp add: full_subst_type_def)\n apply (simp add: end_req_perm_def)\n apply (simp add: dir_subst_penv_def)\n apply (simp add: one_var_env_def)\n apply (case_tac \"t_sub b\")\n apply (auto)\n apply (case_tac \"req_type a\")\n apply (auto)\n done\n \nlemma dir_aff_leq: \"\\ dir_subst_type t_sub p_sub tau_v tau; aff_leq (req_type tau) r \\ \\\n aff_leq (req_type (full_subst_type_f t_sub p_sub tau_n tau_v)) r\"\n apply (induct tau_v)\n apply (auto)\n done\n \nlemma dir_subst_type_eq: \"\\ dir_subst_type t_sub p_sub tau_v tau \\ \\ full_subst_type t_sub p_sub tau_n tau_v = tau\" \n apply (induct tau_v arbitrary: tau)\n apply (auto)\n apply (simp_all add: full_subst_type_def)\n done\n \nlemma mini_disj_lift_use_env_rev: \"\\ mini_disj_use_env r_x r_s \\ \\ mini_disj_use_env r_x (lift_use_env r_s r)\" \n apply (case_tac r)\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n done\n \nlemma infer_valid_left: \"\\ infer_type env ds e tau r_s r_x r_m c_list ds'; dir_sol_sat t_sub p_sub c_list; req_type tau_n = Prim \\ \\\n well_typed (dir_subst_tenv (fill_tsub t_sub tau_n) env) (dir_subst_penv t_sub p_sub r_s) e (full_subst_type t_sub p_sub tau_n tau)\n (diff_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_m)) (diff_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_m))\"\n apply (induct e arbitrary: env tau r_s r_x r_m c_list ds ds')\n apply (auto)\n (* const case *)\n apply (rule_tac ivl_const_main)\n apply (simp_all)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* op case *)\n apply (rule_tac ivl_op_main)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* var case *)\n apply (simp add: dir_subst_tenv_def)\n apply (simp add: fill_tsub_def)\n apply (case_tac \"t_sub a\")\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (simp add: full_subst_type_def)\n apply (simp add: fill_tsub_def)\n apply (cut_tac x=\"owner_name x\" and tau=\"full_subst_type t_sub p_sub tau_n (VarScheme b)\" and\n r_s=\"dir_subst_penv t_sub p_sub (one_var_env (owner_name x) (XType b))\" in ereq_leq_use_envx)\n apply (rule_tac ivl_var_leq_perm)\n apply (auto)\n apply (rule_tac x=\"dir_subst_penv t_sub p_sub (one_var_env (owner_name x) (XType b))\" in exI)\n apply (rule_tac x=\"full_subst_type t_sub p_sub tau_n (VarScheme b)\" in exI)\n apply (simp add: full_subst_type_def)\n apply (simp add: dir_subst_tenv_def)\n apply (auto)\n apply (case_tac \"t_sub b\")\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp_all)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n (* pair case. exepected type *)\n (* - prelim: solution satisfaction *)(*\n apply (cut_tac ?cl2.0=\"semi_disj_crn r_m2 (lift_var_env r_x1 (SVar p)) d @ semi_disj_crn r_m1 (comp_var_env r_s2 (lift_var_env r_x2 (SVar p))) d @ cl1 @ cl2\" in sol_sat_append2)\n apply (auto)\n apply (cut_tac ?cl2.0=\"semi_disj_crn r_m1 (comp_var_env r_s2 (lift_var_env r_x2 (SVar p))) d @ cl1 @ cl2\" in sol_sat_append2)\n apply (auto)*)\n apply (simp add: full_subst_type_def)\n apply (cut_tac ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in sol_sat_append2)\n apply (auto)\n apply (cut_tac ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in sol_sat_append2)\n apply (auto)\n apply (cut_tac ?cl2.0=\"cl1 @ cl2\" in sol_sat_append2)\n apply (auto)\n (* - prelim: initial disjointness statements *)\n apply (cut_tac r_x=\"r_m2\" and r_s=\"r_x1\" in sol_sat_mini_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (auto)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac infer_m_sub_dom)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac lift_sub_dom2)\n apply (rule_tac id_sub_dom)\n apply (cut_tac r_x=\"r_m1\" and r_s=\"r_s2\" in sol_sat_mini_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (auto)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac infer_m_sub_dom)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac id_sub_dom)\n apply (cut_tac r_x=\"lift_var_env r_x1 (SVar p)\" and r_s=\"lift_var_env r_x2 (SVar p)\" in sol_sat_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (auto)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n(*\n apply (cut_tac r_x=\"comp_var_env r_s1 (lift_var_env r_x1 (SVar p))\" and r_s=\"comp_var_env r_s2 (lift_var_env r_x2 (SVar p))\" and d=\"d\" in sol_sat_disj_use_env)\n apply (rule_tac ?cl2.0=\"cl1 @ cl2\" in sol_sat_append1)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac id_sub_dom)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p))) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)*) \n (* - expected permission environments *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p)))\n (comp_var_env r_s2 (lift_var_env r_x2 (SVar p))))) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub (comp_var_env (comp_var_env r_s1 (lift_var_env r_x1 (SVar p)))\n (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))))\n (dir_subst_penv t_sub p_sub (comp_var_env r_m1 r_m2))\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x1) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (auto)\n (* - induction for e1 *)\n apply (cut_tac env=\"env\" and ds=\"ds\" and e=\"e1\" and tau=\"t1\" and r_s=\"r_s1\" and r_x=\"r_x1\" and r_m=\"r_m1\" and\n c_list=\"cl1\" and ds'=\"ds2\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_pair_ih)\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n (* > remove [S2 + lift(X2, p)] using the precision lemma *)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac well_typed_comp_perms_prec)\n(*\n (* > get into form [(S1 + lift(X1, p)) - M1] + [(S2 + lift(X2, p)) - M1] *)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac t=\"diff_use_env\n (comp_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))))\n (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))))\n (dir_subst_penv t_sub p_sub r_m1)\" and\n s=\"comp_use_env (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))))\n (dir_subst_penv t_sub p_sub r_m1))\n (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))))\n (dir_subst_penv t_sub p_sub r_m1))\" in subst)\n apply (rule_tac dist_diff_comp_use_env)\n (* > increase [(S2 + lift(X2, p)) - M1] to (S2 + lift(X2, p)) *)\n apply (rule_tac r_c=\"comp_use_env\n (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))))\n (dir_subst_penv t_sub p_sub r_m1))\n (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))))\" in well_typed_decr_end_perm)\n (* > remove (S2 + lift(X2, p)) from the start + end perms *)\n apply (rule_tac well_typed_comp_perms)*)\n (* > transform [(S1 + lift(X1, p)) - M1] into (S1 - M1) + lift(X1 - M1, p) *)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x1) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (simp_all)\n apply (rule_tac t=\"diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p))) (dir_subst_penv t_sub p_sub r_m1)\"\n and s=\"comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_m1))\n (diff_use_env (lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)) (dir_subst_penv t_sub p_sub r_m1))\" in subst)\n apply (rule_tac dist_diff_comp_use_env)\n apply (simp add: lift_diff_use_env)\n (* > remove lifts and cancel X1 *)\n apply (rule_tac well_typed_comp_lift_perms)\n apply (cut_tac r_s=\"dir_subst_penv t_sub p_sub r_s1\" and r_x=\"dir_subst_penv t_sub p_sub r_x1\" in cancel_comp_use_env2)\n apply (rule_tac env=\"env\" and e=\"e1\" and c_list=\"cl1\" in infer_x_leq_use_env)\n apply (auto)\n apply (cut_tac r_s=\"diff_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_m1)\" and\n r_x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x1) (dir_subst_penv t_sub p_sub r_m1)\" in cancel_comp_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac env=\"env\" and e=\"e1\" and c_list=\"cl1\" in infer_x_leq_use_env)\n apply (auto)\n (* - proof of bound changes *)\n apply (simp add: full_subst_type_def)\n apply (rule_tac self_diff_leq_use_env)\n(*\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)*)\n (* - induction for e2. *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub r_m2)\" in exI)\n apply (cut_tac env=\"env\" and ds=\"ds2\" and e=\"e2\" and tau=\"t2\" and r_s=\"r_s2\" and r_x=\"r_x2\" and r_m=\"r_m2\" and\n c_list=\"cl2\" and ds'=\"ds3\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_pair_ih)\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (rule_tac sol_sat_append2)\n apply (simp)\n apply (simp add: comp_sol_subst_penv)\n (* > reduce end perms *)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env (comp_use_env\n (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))))\n (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))))) (dir_subst_penv t_sub p_sub r_m2))\n (dir_subst_penv t_sub p_sub r_m1)\" and rx=\"diff_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x2)\n (dir_subst_penv t_sub p_sub r_m2)) (dir_subst_penv t_sub p_sub r_m1)\" in well_typed_simul_end_perm)\n (*\n apply (rule_tac ?r_s2.0=\"diff_use_env (comp_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))))\n (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))) (dir_subst_penv t_sub p_sub r_m2)))\n (dir_subst_penv t_sub p_sub r_m1)\" and rx=\"diff_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x2)\n (dir_subst_penv t_sub p_sub r_m2)) (dir_subst_penv t_sub p_sub r_m1)\" in well_typed_simul_end_perm)*)\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac well_typed_comp_perms_prec2)\n (* - unroll lifts *)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac t=\"diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))))\n (dir_subst_penv t_sub p_sub r_m2)\" and s=\"comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_m2))\n (diff_use_env (lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))) (dir_subst_penv t_sub p_sub r_m2))\" in subst)\n apply (rule_tac dist_diff_comp_use_env)\n apply (simp add: lift_diff_use_env)\n apply (rule_tac well_typed_comp_lift_perms)\n (* - cancellations *)\n apply (cut_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" and r_x=\"dir_subst_penv t_sub p_sub r_x2\" in cancel_comp_use_env2)\n apply (rule_tac env=\"env\" and e=\"e2\" and c_list=\"cl2\" in infer_x_leq_use_env)\n apply (auto)\n apply (cut_tac r_s=\"diff_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_m2)\" and\n r_x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub r_m2)\" in cancel_comp_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac env=\"env\" and e=\"e2\" and c_list=\"cl2\" in infer_x_leq_use_env)\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (rule_tac self_diff_leq_use_env)\n (* - disjointness used to remove r_s1 *)(*\n apply (rule_tac comm_disj_use_env)\n apply (simp)*)\n (* - proving that r_m1 can be subtracted out *)\n apply (simp add: own_env_vars_def)\n apply (case_tac \"dir_subst_penv t_sub p_sub r_s2 x = NoPerm\")\n apply (cut_tac e=\"e2\" and ?r_s1.0=\"dir_subst_penv t_sub p_sub r_s2\" and x=\"x\" in well_typed_no_npv_use)\n apply (auto)(*\n apply (case_tac \"dir_subst_penv t_sub p_sub r_s1 x \\ OwnPerm\")\n apply (cut_tac r_x=\"dir_subst_penv t_sub p_sub r_m1\" and r_s=\"dir_subst_penv t_sub p_sub r_s1\" and x=\"x\" in leq_use_no_own)\n apply (simp)\n apply (rule_tac c_list=\"cl1\" in infer_m_leq_use_env)\n apply (auto)\n apply (cut_tac r_x=\"dir_subst_penv t_sub p_sub r_s1\" and r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p)))\"\n and r_ex=\"dir_subst_penv t_sub p_sub r_s2\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp add: disj_use_env_def)*)\n apply (simp add: mini_disj_use_env_def)\n (* - end perm bounds correctness *)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac id_leq_use_env)\n (*\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)*)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac infer_x_leq_use_env)\n apply (simp)(*\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p)))\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac e=\"e1\" and c_list=\"cl1\" in infer_m_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)*)\n apply (rule_tac self_diff_leq_use_env)\n (* - native permission bound constraint e1 *)\n apply (rule_tac t=\"lift_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x1) (dir_subst_penv t_sub p_sub r_m1)) (p_sub p)\" and\n s=\"diff_use_env (lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)) (dir_subst_penv t_sub p_sub r_m1)\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac r_s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_lift_use_env_rev)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)(* \n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p)))\" in disj_leq_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (simp)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl2\" in infer_m_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)*)\n (* - native permission bound constraint e2 *)\n apply (rule_tac t=\"lift_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub r_m2)) (p_sub p)\" and\n s=\"diff_use_env (lift_use_env (dir_subst_penv t_sub p_sub r_x2) (p_sub p)) (dir_subst_penv t_sub p_sub r_m2)\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac mini_disj_lift_use_env_rev)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac infer_x_leq_use_env)\n apply (simp)(*\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))\" in disj_leq_use_env2)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p)))\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl1\" in infer_m_leq_use_env)\n apply (simp)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (simp add: lift_sol_subst_penvx)\n apply (rule_tac self_comp_leq_use_env2)*)\n (* - affinity requirements *)\n apply (rule_tac max_aff_leq)\n apply (rule_tac dir_aff_leq)\n apply (simp_all)\n apply (rule_tac tau=\"tau_xa\" in dir_aff_leq)\n apply (simp_all)\n (* - disjointness requirement *)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" in disj_leq_use_env2)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))\" in disj_leq_use_env1)\n apply (simp)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n(*\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))\" in disj_leq_use_env2)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p)))\" in disj_leq_use_env1)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)*)\n (* - final existential *)\n apply (rule_tac x=\"dir_subst_penv t_sub p_sub (comp_var_env r_m1 r_m2)\" in exI)\n apply (auto)\n apply (rule_tac rhs_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac if_zero_leq_var_env)\n apply (rule_tac dist_comp_leq_var_env)\n apply (rule_tac comp_leq_var_env1)\n apply (rule_tac comp_leq_var_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac comp_leq_var_env2)\n apply (rule_tac comp_leq_var_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_var_env)\n apply (rule_tac comp_leq_var_env1)\n apply (rule_tac comp_leq_var_env1)\n apply (rule_tac c_list=\"cl1\" in infer_m_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_var_env2)\n apply (rule_tac comp_leq_var_env1)\n apply (rule_tac c_list=\"cl2\" in infer_m_leq_use_env)\n apply (simp)\n apply (simp add: pair_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac \"sol_subst_perm p_sub (SVar p) = NoPerm\")\n apply (simp)\n apply (simp add: if_zero_pos_var_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x1 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x1) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (p_sub p)\" in subst)\n apply (rule_tac lift_sol_subst_penvx)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n (* if case. prelim: satisfiability sub-constraints *)\n apply (cut_tac p_sub=\"p_sub\" and ?cl2.0=\"cl1 @ cl2 @ cl3\" in sol_sat_append2)\n apply (simp)\n apply (cut_tac p_sub=\"p_sub\" and ?cl2.0=\"cl2 @ cl3\" in sol_sat_append2)\n apply (simp)\n (* - prelim: disjointness constraints *)\n apply (cut_tac p_sub=\"p_sub\" and r_x=\"r_m1\" and r_s=\"comp_var_env r_s2 r_s3\" in sol_sat_mini_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env r_s1 (comp_var_env r_s2 r_s3)\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac infer_m_sub_dom)\n apply (auto)\n apply (rule_tac r_s=\"comp_var_env r_s1 (comp_var_env r_s2 r_s3)\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n (* - induction on e1 *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x1) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub (comp_var_env r_s1 (comp_var_env r_s2 r_s3))) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (auto)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (comp_var_env r_s1 (comp_var_env r_s2 r_s3))\"\n and s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub (comp_var_env r_s2 r_s3))\" in subst)\n apply (simp add: comp_sol_subst_penv)\n apply (cut_tac env=\"env\" and ds=\"ds\" and e=\"e1\" and tau=\"t1\" and r_s=\"r_s1\" and r_x=\"r_x1\" and r_m=\"r_m1\" and\n c_list=\"cl1\" and ds'=\"ds2\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_if_ih)\n apply (auto)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac well_typed_comp_perms_prec)\n apply (case_tac t1)\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (simp add: full_subst_type_def)\n (* - induction on e2 *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub (comp_var_env r_m1 (comp_var_env r_m2 r_m3)))\" in exI)\n apply (auto)\n apply (simp add: comp_sol_subst_penv)\n apply (cut_tac env=\"env\" and ds=\"ds2\" and e=\"e2\" and tau=\"t2\" and r_s=\"r_s2\" and r_x=\"r_x2\" and r_m=\"r_m2\" and\n c_list=\"cl2\" and ds'=\"ds3\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_if_ih)\n apply (auto)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env (comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s1)\n (dir_subst_penv t_sub p_sub r_m1)) (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3)))\n (dir_subst_penv t_sub p_sub r_m2)) (dir_subst_penv t_sub p_sub r_m3)\" and rx=\"diff_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x2)\n (dir_subst_penv t_sub p_sub r_m2)) (dir_subst_penv t_sub p_sub r_m3)\" in well_typed_simul_end_perm)\n apply (rule_tac ?r_s1.0=\"comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_m1))\n (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3))\" in well_typed_incr_start_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac well_typed_comp_perms_prec2)\n apply (rule_tac well_typed_comp_perms_prec)\n apply (simp_all)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac infer_m_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl2\" in infer_x_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3)\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl2\" in infer_x_leq_use_env)\n apply (simp)\n (* - induction on e3 *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x3) (dir_subst_penv t_sub p_sub (comp_var_env r_m1 (comp_var_env r_m2 r_m3)))\" in exI)\n apply (auto)\n apply (simp add: comp_sol_subst_penv)\n apply (cut_tac env=\"env\" and ds=\"ds3\" and e=\"e3\" and tau=\"t3\" and r_s=\"r_s3\" and r_x=\"r_x3\" and r_m=\"r_m3\" and\n c_list=\"cl3\" and ds'=\"ds'\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_if_ih)\n apply (auto)\n apply (rule_tac sol_sat_append2)\n apply (simp)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env (comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s1)\n (dir_subst_penv t_sub p_sub r_m1)) (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3)))\n (dir_subst_penv t_sub p_sub r_m3)) (dir_subst_penv t_sub p_sub r_m2)\" and rx=\"diff_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x3)\n (dir_subst_penv t_sub p_sub r_m3)) (dir_subst_penv t_sub p_sub r_m2)\" in well_typed_simul_end_perm)\n apply (rule_tac ?r_s1.0=\"comp_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_m1))\n (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3))\" in well_typed_incr_start_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac well_typed_comp_perms_prec2)\n apply (rule_tac well_typed_comp_perms_prec2)\n apply (simp add: dir_subst_type_eq)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac infer_m_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp add: comm_comp_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: comm_comp_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac infer_x_leq_use_env)\n apply (auto)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (simp add: comm_comp_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub r_s3)\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac infer_x_leq_use_env)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (simp add: dist_diff_comp_use_env)\n apply (simp add: comp_sol_subst_penv)\n (* lam case *)\n apply (simp add: full_subst_type_def)\n apply (rule_tac x=\"dir_subst_penv t_sub p_sub (rem_var_env r_s' (Var x1a))\" in exI)\n apply (auto)\n (* - induction on e *)\n apply (cut_tac env=\"add_env env (Var x1a) a\" and ds=\"insert a ds\" and e=\"e\" and tau=\"t2\" and r_s=\"r_s'\" and r_x=\"r_x'\" and r_m=\"r_m'\" and\n c_list=\"cl\" and ds'=\"ds2\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_lam_ih)\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (rule_tac sol_sat_append2)\n apply (simp)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x') (dir_subst_penv t_sub p_sub r_m')\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_s') (dir_subst_penv t_sub p_sub r_m')\" in exI)\n apply (simp add: rem_sol_subst_penv)\n apply (rule_tac ?r_s1.0=\"add_use_env (rem_use_env (dir_subst_penv t_sub p_sub r_s') (Var x1a)) (Var x1a)\n (dir_subst_permx t_sub p_sub (r_s' (Var x1a)))\" in well_typed_incr_start_perm)\n apply (case_tac \"dir_subst_permx t_sub p_sub (r_s' (Var x1a)) \\ (dir_subst_penv t_sub p_sub r_s') (Var x1a)\")\n apply (simp add: dir_subst_penv_def)\n apply (simp add: add_rem_use_env)\n apply (cut_tac t_sub=\"t_sub\" and tau_n=\"tau_n\" and x=\"x1a\" and env=\"env\" and a=\"a\" and p_sub=\"p_sub\" in add_sol_subst_tenv)\n apply (simp add: full_subst_type_def)\n apply (rule_tac dist_add_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (simp)\n apply (rule_tac sol_sat_aff_use_envx)\n apply (rule_tac sol_sat_append1)\n apply (simp_all)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (simp add: subst_empty_var_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: subst_empty_var_env)\n apply (rule_tac id_leq_use_env)\n (* app case. prelim: satisfiability constraints *)\n apply (cut_tac p_sub=\"p_sub\" and ?cl2.0=\"semi_disj_crn r_m2 r_x1 d @ semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in sol_sat_append2)\n apply (simp)\n apply (cut_tac p_sub=\"p_sub\" and ?cl2.0=\"semi_disj_crn r_m1 r_s2 d @ cl1 @ cl2\" in sol_sat_append2)\n apply (simp)\n apply (cut_tac p_sub=\"p_sub\" and ?cl2.0=\"cl1 @ cl2\" in sol_sat_append2)\n apply (simp)\n (* - prelim: disjointness constraints *)\n apply (cut_tac p_sub=\"p_sub\" in sol_sat_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n (* - prelim: semi-disjointness constraint 1 *)\n apply (cut_tac r_x=\"r_m2\" and r_s=\"r_x1\" and p_sub=\"p_sub\" in sol_sat_mini_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac infer_m_sub_dom)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac id_sub_dom)\n (* - prelim: semi-disjointness constraint 2 *)\n apply (cut_tac r_x=\"r_m1\" and r_s=\"r_s2\" and p_sub=\"p_sub\" in sol_sat_mini_disj_use_env)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac infer_m_sub_dom)\n apply (simp)\n apply (rule_tac r_s=\"comp_var_env (comp_var_env r_s1 r_x1) (comp_var_env r_s2 (lift_var_env r_x2 (SVar p)))\" in finite_sub_dom)\n apply (simp)\n apply (rule_tac comp_sub_dom2)\n apply (rule_tac comp_sub_dom1)\n apply (rule_tac id_sub_dom) \n (* - prelim: inequalities *)(*\n apply (cut_tac c_list=\"cl1\" and r_m=\"r_m1\" and r_s=\"r_s1\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" in infer_m_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"r_m2\" and r_s=\"r_s2\" and r=\"SVar p\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" in lift_leq_var_env)\n apply (rule_tac c_list=\"cl2\" in infer_m_leq_use_env)\n apply (simp)*)\n apply (cut_tac c_list=\"cl1\" and r_x=\"r_x1\" and r_s=\"r_s1\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" in infer_x_leq_use_env)\n apply (simp)\n apply (cut_tac c_list=\"cl2\" and r_x=\"r_x2\" and r_s=\"r_s2\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" in infer_x_leq_use_env)\n apply (simp)\n apply (cut_tac r_x=\"r_x2\" and r_s=\"r_s2\" and r=\"SVar p\" in lift_leq_var_env)\n apply (simp)\n (* - existentials *)\n apply (rule_tac x=\"full_subst_type t_sub p_sub tau_n t1\" in exI)\n apply (rule_tac x=\"sol_subst_perm p_sub (SVar p)\" in exI)\n apply (rule_tac x=\"sol_subst_aff p_sub (AffVar q)\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub (comp_var_env (comp_var_env r_s1 r_x1)\n (comp_var_env r_s2 (lift_var_env r_x2 (SVar p))))) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x1) (dir_subst_penv t_sub p_sub r_m1)\" in exI)\n apply (auto)\n (* - induction for e1. *)\n apply (simp add: comp_sol_subst_penv)\n apply (cut_tac env=\"env\" and ds=\"ds\" and e=\"e1\" and tau=\"tau_f\" and r_s=\"r_s1\" and r_x=\"r_x1\" and r_m=\"r_m1\" and\n c_list=\"cl1\" and ds'=\"ds2\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_app_ih)\n apply (auto)\n apply (rule_tac sol_sat_append1)\n apply (simp)\n apply (rule_tac well_typed_comp_perms_prec)\n apply (rule_tac well_typed_comp_perms_prec)\n apply (simp add: dir_subst_type_eq)\n (* - induction for e2. *)\n apply (rule_tac x=\"diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub r_m2)\" in exI)\n apply (rule_tac x=\"diff_use_env (diff_use_env (dir_subst_penv t_sub p_sub (comp_var_env (comp_var_env r_s1 r_x1)\n (comp_var_env r_s2 (lift_var_env r_x2 (SVar p))))) (dir_subst_penv t_sub p_sub r_m1)) (dir_subst_penv t_sub p_sub r_m2)\" in exI)\n apply (auto)\n apply (simp add: comp_sol_subst_penv)\n apply (cut_tac env=\"env\" and ds=\"ds2\" and e=\"e2\" and tau=\"t1\" and r_s=\"r_s2\" and r_x=\"r_x2\" and r_m=\"r_m2\" and\n c_list=\"cl2\" and ds'=\"ds3\" and t_sub=\"t_sub\" and p_sub=\"p_sub\" and tau_n=\"tau_n\" in ivl_app_ih)\n apply (auto)\n apply (rule_tac sol_sat_append2)\n apply (simp) \n apply (rule_tac r_c=\"diff_use_env (comp_use_env (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_x1))\n (dir_subst_penv t_sub p_sub r_m1)) (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p)))))\n (dir_subst_penv t_sub p_sub r_m2)\" in well_typed_decr_end_perm)\n apply (rule_tac ?r_s1.0=\"comp_use_env (diff_use_env (comp_use_env (dir_subst_penv t_sub p_sub r_s1) (dir_subst_penv t_sub p_sub r_x1))\n (dir_subst_penv t_sub p_sub r_m1)) (comp_use_env (dir_subst_penv t_sub p_sub r_s2) (dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))))\" in well_typed_incr_start_perm)\n apply (rule_tac well_typed_comp_perms_prec2)\n apply (rule_tac well_typed_comp_perms_prec)\n apply (simp)\n apply (rule_tac rhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac mini_disj_comp_use_env_alt)\n apply (simp)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac mini_disj_lift_use_env_rev)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" in mini_disj_leq_use_env2)\n apply (simp_all)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" in mini_disj_leq_use_env2)\n apply (simp_all)\n (* - final existentials. *)\n apply (rule_tac x=\"dir_subst_penv t_sub p_sub (comp_var_env (comp_var_env r_m1 r_x1) (comp_var_env r_m2 (lift_var_env r_x2 (SVar p))))\" in exI)\n apply (simp add: comp_sol_subst_penv)\n apply (auto)\n (* - end permission bound *)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* - subtractability bound *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_x1\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac t=\"lift_use_env (diff_use_env (dir_subst_penv t_sub p_sub r_x2) (dir_subst_penv t_sub p_sub r_m2)) (p_sub p)\"\n and s=\"diff_use_env (lift_use_env (dir_subst_penv t_sub p_sub r_x2) (p_sub p)) (dir_subst_penv t_sub p_sub r_m2)\" in subst)\n apply (rule_tac lift_diff_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (auto)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac mini_disj_lift_use_env_rev)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_s2\" in mini_disj_leq_use_env2)\n apply (simp)\n apply (rule_tac infer_x_leq_use_env)\n apply (simp)\n (* - disjointness *)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub r_x1\" in disj_leq_use_env1)\n apply (rule_tac r_s=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x2 (SVar p))\" and\n s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x2) (sol_subst_perm p_sub (SVar p))\" in subst)\n apply (rule_tac lift_sol_subst_penv)\n apply (auto)\n apply (rule_tac dist_lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n (* - relative bound *)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac if_zero_leq_var_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n (* - subtractant bound *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl1\" in infer_m_leq_use_env)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac c_list=\"cl2\" in infer_m_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n (* - requirements bound *)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (case_tac \"dir_subst_permx t_sub p_sub (XType a) = NoPerm\")\n apply (case_tac \"req_type (full_subst_type t_sub p_sub tau_n (VarScheme a))\")\n apply (auto)\n apply (simp add: full_subst_type_def)\n apply (simp add: full_subst_type_def)\n apply (simp add: if_zero_pos_var_env)\n apply (simp add: comp_sol_subst_penv)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac lift_leq_var_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2) \n done\n\nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/InferSound.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4339814648038986, "lm_q1q2_score": 0.2717262875826749}} {"text": "(* Title: Isabelle Collections Library\n Author: Andreas Lochbihler \n Maintainer: Andreas Lochbihler \n*)\nheader {* \\isaheader{Array-based hash map implementation} *}\ntheory ArrayHashMap_Impl imports \n \"../../Lib/HashCode\"\n \"../../Lib/Diff_Array\"\n \"../gen_algo/ListGA\"\n \"ListMapImpl\"\n \"../../Iterator/Array_Iterator\"\nbegin\n\ntext {* Misc. *}\n\nsetup Locale_Code.open_block\ninterpretation a_idx_it!: \n idx_iteratei_loc list_of_array \"\\_. True\" array_length array_get\n apply unfold_locales\n apply (case_tac [!] s) [2]\n apply auto\n done\nsetup Locale_Code.close_block\n\n(*\nlemma idx_iteratei_aux_array_get_Array_conv_nth:\n \"idx_iteratei_aux array_get sz i (Array xs) c f \\ = idx_iteratei_aux op ! sz i xs c f \\\"\napply(induct get\\\"op ! :: 'b list \\ nat \\ 'b\" sz i xs c f \\ rule: idx_iteratei_aux.induct)\napply(subst (1 2) idx_iteratei_aux.simps)\napply simp\ndone\n\nlemma idx_iteratei_array_get_Array_conv_nth:\n \"idx_iteratei array_get array_length (Array xs) = idx_iteratei nth length xs\"\nby(simp add: idx_iteratei_def fun_eq_iff idx_iteratei_aux_array_get_Array_conv_nth)\n\nlemma idx_iteratei_aux_nth_conv_foldli_drop:\n fixes xs :: \"'b list\"\n assumes \"i \\ length xs\"\n shows \"idx_iteratei_aux op ! (length xs) i xs c f \\ = foldli (drop (length xs - i) xs) c f \\\"\nusing assms\nproof(induct get\\\"op ! :: 'b list \\ nat \\ 'b\" sz\\\"length xs\" i xs c f \\ rule: idx_iteratei_aux.induct)\n case (1 i l c f \\)\n show ?case\n proof(cases \"i = 0 \\ \\ c \\\")\n case True thus ?thesis\n by(subst idx_iteratei_aux.simps)(auto)\n next\n case False\n hence i: \"i > 0\" and c: \"c \\\" by auto\n hence \"idx_iteratei_aux op ! (length l) i l c f \\ = idx_iteratei_aux op ! (length l) (i - 1) l c f (f (l ! (length l - i)) \\)\"\n by(subst idx_iteratei_aux.simps) simp\n also have \"\\ = foldli (drop (length l - (i - 1)) l) c f (f (l ! (length l - i)) \\)\"\n using `i \\ length l` i c by -(rule 1, auto)\n also from `i \\ length l` i\n have \"drop (length l - i) l = (l ! (length l - i)) # drop (length l - (i - 1)) l\"\n by(subst Cons_nth_drop_Suc[symmetric])(simp_all, metis Suc_eq_plus1_left add_diff_assoc)\n hence \"foldli (drop (length l - (i - 1)) l) c f (f (l ! (length l - i)) \\) = foldli (drop (length l - i) l) c f \\\"\n using c by simp\n finally show ?thesis .\n qed\nqed\n\nlemma idx_iteratei_nth_length_conv_foldli: \"idx_iteratei nth length = foldli\"\nby(rule ext)+(simp add: idx_iteratei_def idx_iteratei_aux_nth_conv_foldli_drop)\n*)\n\nsubsection {* Type definition and primitive operations *}\n\ndefinition load_factor :: nat -- \"in percent\"\n where \"load_factor = 75\"\n\ntext {*\n We do not use @{typ \"('k, 'v) assoc_list\"} for the buckets but plain lists of key-value pairs.\n This speeds up rehashing because we then do not have to go through the abstract operations.\n*}\n\ndatatype ('key, 'val) hashmap =\n HashMap \"('key \\ 'val) list array\" \"nat\"\n\nsubsection {* Operations *}\n\ndefinition new_hashmap_with :: \"nat \\ ('key :: hashable, 'val) hashmap\"\nwhere \"\\size. new_hashmap_with size = HashMap (new_array [] size) 0\"\n\ndefinition ahm_empty :: \"unit \\ ('key :: hashable, 'val) hashmap\"\nwhere \"ahm_empty \\ \\_. new_hashmap_with (def_hashmap_size TYPE('key))\"\n\ndefinition bucket_ok :: \"nat \\ nat \\ (('key :: hashable) \\ 'val) list \\ bool\"\nwhere \"bucket_ok len h kvs = (\\k \\ fst ` set kvs. bounded_hashcode_nat len k = h)\"\n\ndefinition ahm_invar_aux :: \"nat \\ (('key :: hashable) \\ 'val) list array \\ bool\"\nwhere\n \"ahm_invar_aux n a \\\n (\\h. h < array_length a \\ bucket_ok (array_length a) h (array_get a h) \\ distinct (map fst (array_get a h))) \\\n array_foldl (\\_ n kvs. n + size kvs) 0 a = n \\\n array_length a > 1\"\n\n\nprimrec ahm_invar :: \"('key :: hashable, 'val) hashmap \\ bool\"\nwhere \"ahm_invar (HashMap a n) = ahm_invar_aux n a\"\n\ndefinition ahm_\\_aux :: \"(('key :: hashable) \\ 'val) list array \\ 'key \\ 'val option\"\nwhere [simp]: \"ahm_\\_aux a k = map_of (array_get a (bounded_hashcode_nat (array_length a) k)) k\"\n\nprimrec ahm_\\ :: \"('key :: hashable, 'val) hashmap \\ 'key \\ 'val option\"\nwhere\n \"ahm_\\ (HashMap a _) = ahm_\\_aux a\"\n\ndefinition ahm_lookup :: \"'key \\ ('key :: hashable, 'val) hashmap \\ 'val option\"\nwhere \"ahm_lookup k hm = ahm_\\ hm k\"\n\nprimrec ahm_iteratei_aux :: \"((('key :: hashable) \\ 'val) list array) \\ ('key \\ 'val, '\\) set_iterator\"\nwhere \"ahm_iteratei_aux (Array xs) c f = foldli (concat xs) c f\"\n\nprimrec ahm_iteratei :: \"(('key :: hashable, 'val) hashmap) \\ (('key \\ 'val), '\\) set_iterator\"\nwhere\n \"ahm_iteratei (HashMap a n) = ahm_iteratei_aux a\"\n\ndefinition ahm_rehash_aux' :: \"nat \\ 'key \\ 'val \\ (('key :: hashable) \\ 'val) list array \\ ('key \\ 'val) list array\"\nwhere\n \"ahm_rehash_aux' n kv a =\n (let h = bounded_hashcode_nat n (fst kv)\n in array_set a h (kv # array_get a h))\"\n\ndefinition ahm_rehash_aux :: \"(('key :: hashable) \\ 'val) list array \\ nat \\ ('key \\ 'val) list array\"\nwhere\n \"ahm_rehash_aux a sz = ahm_iteratei_aux a (\\x. True) (ahm_rehash_aux' sz) (new_array [] sz)\"\n\nprimrec ahm_rehash :: \"('key :: hashable, 'val) hashmap \\ nat \\ ('key, 'val) hashmap\"\nwhere \"ahm_rehash (HashMap a n) sz = HashMap (ahm_rehash_aux a sz) n\"\n\nprimrec hm_grow :: \"('key :: hashable, 'val) hashmap \\ nat\"\nwhere \"hm_grow (HashMap a n) = 2 * array_length a + 3\"\n\nprimrec ahm_filled :: \"('key :: hashable, 'val) hashmap \\ bool\"\nwhere \"ahm_filled (HashMap a n) = (array_length a * load_factor \\ n * 100)\"\n\nprimrec ahm_update_aux :: \"('key :: hashable, 'val) hashmap \\ 'key \\ 'val \\ ('key, 'val) hashmap\"\nwhere\n \"ahm_update_aux (HashMap a n) k v = \n (let h = bounded_hashcode_nat (array_length a) k;\n m = array_get a h;\n insert = map_of m k = None\n in HashMap (array_set a h (AList.update k v m)) (if insert then n + 1 else n))\"\n\ndefinition ahm_update :: \"'key \\ 'val \\ ('key :: hashable, 'val) hashmap \\ ('key, 'val) hashmap\"\nwhere\n \"ahm_update k v hm = \n (let hm' = ahm_update_aux hm k v\n in (if ahm_filled hm' then ahm_rehash hm' (hm_grow hm') else hm'))\"\n\nprimrec ahm_delete :: \"'key \\ ('key :: hashable, 'val) hashmap \\ ('key, 'val) hashmap\"\nwhere\n \"ahm_delete k (HashMap a n) =\n (let h = bounded_hashcode_nat (array_length a) k;\n m = array_get a h;\n deleted = (map_of m k \\ None)\n in HashMap (array_set a h (AList.delete k m)) (if deleted then n - 1 else n))\"\n\n\nlemma hm_grow_gt_1 [iff]:\n \"Suc 0 < hm_grow hm\"\nby(cases hm)(simp)\n\nlemma bucket_ok_Nil [simp]: \"bucket_ok len h [] = True\"\nby(simp add: bucket_ok_def)\n\nlemma bucket_okD:\n \"\\ bucket_ok len h xs; (k, v) \\ set xs \\\n \\ bounded_hashcode_nat len k = h\"\nby(auto simp add: bucket_ok_def)\n\nlemma bucket_okI:\n \"(\\k. k \\ fst ` set kvs \\ bounded_hashcode_nat len k = h) \\ bucket_ok len h kvs\"\nby(simp add: bucket_ok_def)\n\n\nsubsection {* @{term ahm_invar} *}\n\nlemma ahm_invar_auxE:\n assumes \"ahm_invar_aux n a\"\n obtains \"\\h. h < array_length a \\ bucket_ok (array_length a) h (array_get a h) \\ distinct (map fst (array_get a h))\"\n and \"n = array_foldl (\\_ n kvs. n + length kvs) 0 a\" and \"array_length a > 1\"\nusing assms unfolding ahm_invar_aux_def by blast\n\nlemma ahm_invar_auxI:\n \"\\ \\h. h < array_length a \\ bucket_ok (array_length a) h (array_get a h);\n \\h. h < array_length a \\ distinct (map fst (array_get a h));\n n = array_foldl (\\_ n kvs. n + length kvs) 0 a; array_length a > 1 \\\n \\ ahm_invar_aux n a\"\nunfolding ahm_invar_aux_def by blast\n\nlemma ahm_invar_distinct_fst_concatD:\n assumes inv: \"ahm_invar_aux n (Array xs)\"\n shows \"distinct (map fst (concat xs))\"\nproof -\n { fix h\n assume \"h < length xs\"\n with inv have \"bucket_ok (length xs) h (xs ! h)\" \"distinct (map fst (xs ! h))\"\n by(simp_all add: ahm_invar_aux_def) }\n note no_junk = this\n\n show ?thesis unfolding map_concat\n proof(rule distinct_concat')\n have \"distinct [x\\xs . x \\ []]\" unfolding distinct_conv_nth\n proof(intro allI ballI impI)\n fix i j\n assume \"i < length [x\\xs . x \\ []]\" \"j < length [x\\xs . x \\ []]\" \"i \\ j\"\n from filter_nth_ex_nth[OF `i < length [x\\xs . x \\ []]`]\n obtain i' where \"i' \\ i\" \"i' < length xs\" and ith: \"[x\\xs . x \\ []] ! i = xs ! i'\" \n and eqi: \"[x\\take i' xs . x \\ []] = take i [x\\xs . x \\ []]\" by blast\n from filter_nth_ex_nth[OF `j < length [x\\xs . x \\ []]`]\n obtain j' where \"j' \\ j\" \"j' < length xs\" and jth: \"[x\\xs . x \\ []] ! j = xs ! j'\"\n and eqj: \"[x\\take j' xs . x \\ []] = take j [x\\xs . x \\ []]\" by blast\n show \"[x\\xs . x \\ []] ! i \\ [x\\xs . x \\ []] ! j\"\n proof\n assume \"[x\\xs . x \\ []] ! i = [x\\xs . x \\ []] ! j\"\n hence eq: \"xs ! i' = xs ! j'\" using ith jth by simp\n from `i < length [x\\xs . x \\ []]`\n have \"[x\\xs . x \\ []] ! i \\ set [x\\xs . x \\ []]\" by(rule nth_mem)\n with ith have \"xs ! i' \\ []\" by simp\n then obtain kv where \"kv \\ set (xs ! i')\" by(fastforce simp add: neq_Nil_conv)\n with no_junk[OF `i' < length xs`] have \"bounded_hashcode_nat (length xs) (fst kv) = i'\"\n by(simp add: bucket_ok_def)\n moreover from eq `kv \\ set (xs ! i')` have \"kv \\ set (xs ! j')\" by simp\n with no_junk[OF `j' < length xs`] have \"bounded_hashcode_nat (length xs) (fst kv) = j'\"\n by(simp add: bucket_ok_def)\n ultimately have [simp]: \"i' = j'\" by simp\n from `i < length [x\\xs . x \\ []]` have \"i = length (take i [x\\xs . x \\ []])\" by simp\n also from eqi eqj have \"take i [x\\xs . x \\ []] = take j [x\\xs . x \\ []]\" by simp\n finally show False using `i \\ j` `j < length [x\\xs . x \\ []]` by simp\n qed\n qed\n moreover have \"inj_on (map fst) {x \\ set xs. x \\ []}\"\n proof(rule inj_onI)\n fix x y\n assume \"x \\ {x \\ set xs. x \\ []}\" \"y \\ {x \\ set xs. x \\ []}\" \"map fst x = map fst y\"\n hence \"x \\ set xs\" \"y \\ set xs\" \"x \\ []\" \"y \\ []\" by auto\n from `x \\ set xs` obtain i where \"xs ! i = x\" \"i < length xs\" unfolding set_conv_nth by fastforce\n from `y \\ set xs` obtain j where \"xs ! j = y\" \"j < length xs\" unfolding set_conv_nth by fastforce\n from `x \\ []` obtain k v x' where \"x = (k, v) # x'\" by(cases x) auto\n with no_junk[OF `i < length xs`] `xs ! i = x`\n have \"bounded_hashcode_nat (length xs) k = i\" by(auto simp add: bucket_ok_def)\n moreover from `map fst x = map fst y` `x = (k, v) # x'` obtain v' where \"(k, v') \\ set y\" by fastforce\n with no_junk[OF `j < length xs`] `xs ! j = y`\n have \"bounded_hashcode_nat (length xs) k = j\" by(auto simp add: bucket_ok_def)\n ultimately have \"i = j\" by simp\n with `xs ! i = x` `xs ! j = y` show \"x = y\" by simp\n qed\n ultimately show \"distinct [ys\\map (map fst) xs . ys \\ []]\"\n by(simp add: filter_map o_def distinct_map)\n next\n fix ys\n assume \"ys \\ set (map (map fst) xs)\"\n thus \"distinct ys\" by(clarsimp simp add: set_conv_nth)(rule no_junk)\n next\n fix ys zs\n assume \"ys \\ set (map (map fst) xs)\" \"zs \\ set (map (map fst) xs)\" \"ys \\ zs\"\n then obtain ys' zs' where [simp]: \"ys = map fst ys'\" \"zs = map fst zs'\" \n and \"ys' \\ set xs\" \"zs' \\ set xs\" by auto\n have \"fst ` set ys' \\ fst ` set zs' = {}\"\n proof(rule equals0I)\n fix k\n assume \"k \\ fst ` set ys' \\ fst ` set zs'\"\n then obtain v v' where \"(k, v) \\ set ys'\" \"(k, v') \\ set zs'\" by(auto)\n from `ys' \\ set xs` obtain i where \"xs ! i = ys'\" \"i < length xs\" unfolding set_conv_nth by fastforce\n with `(k, v) \\ set ys'` have \"bounded_hashcode_nat (length xs) k = i\" by(auto dest: no_junk bucket_okD)\n moreover\n from `zs' \\ set xs` obtain j where \"xs ! j = zs'\" \"j < length xs\" unfolding set_conv_nth by fastforce\n with `(k, v') \\ set zs'` have \"bounded_hashcode_nat (length xs) k = j\" by(auto dest: no_junk bucket_okD)\n ultimately have \"i = j\" by simp\n with `xs ! i = ys'` `xs ! j = zs'` have \"ys' = zs'\" by simp\n with `ys \\ zs` show False by simp\n qed\n thus \"set ys \\ set zs = {}\" by simp\n qed\nqed\n\nsubsection {* @{term \"ahm_\\\"} *}\n\nlemma finite_dom_ahm_\\_aux:\n assumes \"ahm_invar_aux n a\"\n shows \"finite (dom (ahm_\\_aux a))\"\nproof -\n have \"dom (ahm_\\_aux a) \\ (\\h \\ range (bounded_hashcode_nat (array_length a) :: 'a \\ nat). dom (map_of (array_get a h)))\"\n by(force simp add: dom_map_of_conv_image_fst ahm_\\_aux_def dest: map_of_SomeD)\n moreover have \"finite \\\"\n proof(rule finite_UN_I)\n from `ahm_invar_aux n a` have \"array_length a > 1\" by(simp add: ahm_invar_aux_def)\n hence \"range (bounded_hashcode_nat (array_length a) :: 'a \\ nat) \\ {0.. nat))\"\n by(rule finite_subset) simp\n qed(rule finite_dom_map_of)\n ultimately show ?thesis by(rule finite_subset)\nqed\n\nlemma ahm_\\_aux_conv_map_of_concat:\n assumes inv: \"ahm_invar_aux n (Array xs)\"\n shows \"ahm_\\_aux (Array xs) = map_of (concat xs)\"\nproof\n fix k\n show \"ahm_\\_aux (Array xs) k = map_of (concat xs) k\"\n proof(cases \"map_of (concat xs) k\")\n case None\n hence \"k \\ fst ` set (concat xs)\" by(simp add: map_of_eq_None_iff)\n hence \"k \\ fst ` set (xs ! bounded_hashcode_nat (length xs) k)\"\n proof(rule contrapos_nn)\n assume \"k \\ fst ` set (xs ! bounded_hashcode_nat (length xs) k)\"\n then obtain v where \"(k, v) \\ set (xs ! bounded_hashcode_nat (length xs) k)\" by auto\n moreover from inv have \"bounded_hashcode_nat (length xs) k < length xs\"\n by(simp add: bounded_hashcode_nat_bounds ahm_invar_aux_def)\n ultimately show \"k \\ fst ` set (concat xs)\"\n by(force intro: rev_image_eqI)\n qed\n thus ?thesis unfolding None by(simp add: map_of_eq_None_iff)\n next\n case (Some v)\n hence \"(k, v) \\ set (concat xs)\" by(rule map_of_SomeD)\n then obtain ys where \"ys \\ set xs\" \"(k, v) \\ set ys\"\n unfolding set_concat by blast\n from `ys \\ set xs` obtain i j where \"i < length xs\" \"xs ! i = ys\"\n unfolding set_conv_nth by auto\n with inv `(k, v) \\ set ys`\n show ?thesis unfolding Some\n by(force dest: bucket_okD simp add: ahm_invar_aux_def)\n qed\nqed\n\nlemma ahm_invar_aux_card_dom_ahm_\\_auxD:\n assumes inv: \"ahm_invar_aux n a\"\n shows \"card (dom (ahm_\\_aux a)) = n\"\nproof(cases a)\n case (Array xs)[simp]\n from inv have \"card (dom (ahm_\\_aux (Array xs))) = card (dom (map_of (concat xs)))\"\n by(simp add: ahm_\\_aux_conv_map_of_concat)\n also from inv have \"distinct (map fst (concat xs))\"\n by(simp add: ahm_invar_distinct_fst_concatD)\n hence \"card (dom (map_of (concat xs))) = length (concat xs)\"\n by(rule card_dom_map_of)\n also have \"length (concat xs) = foldl op + 0 (map length xs)\"\n by (simp add: length_concat foldl_conv_fold add.commute fold_plus_listsum_rev)\n also from inv\n have \"\\ = n\" unfolding foldl_map by(simp add: ahm_invar_aux_def array_foldl_foldl)\n finally show ?thesis by(simp)\nqed\n\nlemma finite_dom_ahm_\\:\n \"ahm_invar hm \\ finite (dom (ahm_\\ hm))\"\nby(cases hm)(auto intro: finite_dom_ahm_\\_aux)\n\nlemma finite_map_ahm_\\_aux:\n \"finite_map ahm_\\_aux (ahm_invar_aux n)\"\nby(unfold_locales)(rule finite_dom_ahm_\\_aux)\n\nlemma finite_map_ahm_\\:\n \"finite_map ahm_\\ ahm_invar\"\nby(unfold_locales)(rule finite_dom_ahm_\\)\n\nsubsection {* @{term ahm_empty} *}\n\nlemma ahm_invar_aux_new_array:\n assumes \"n > 1\"\n shows \"ahm_invar_aux 0 (new_array [] n)\"\nproof -\n have \"foldl (\\b (k, v). b + length v) 0 (zip [0.. 1 \\ ahm_invar (new_hashmap_with n)\"\nby(auto simp add: ahm_invar_def new_hashmap_with_def intro: ahm_invar_aux_new_array)\n\nlemma ahm_\\_new_hashmap_with:\n \"n > 1 \\ ahm_\\ (new_hashmap_with n) = empty\"\nby(simp add: new_hashmap_with_def bounded_hashcode_nat_bounds fun_eq_iff)\n\nlemma ahm_invar_ahm_empty [simp]: \"ahm_invar (ahm_empty ())\"\nusing def_hashmap_size[where ?'a = 'a]\nby(auto intro: ahm_invar_new_hashmap_with simp add: ahm_empty_def)\n\nlemma ahm_empty_correct [simp]: \"ahm_\\ (ahm_empty ()) = Map.empty\"\nusing def_hashmap_size[where ?'a = 'a]\nby(auto intro: ahm_\\_new_hashmap_with simp add: ahm_empty_def)\n\nlemma ahm_empty_impl: \"map_empty ahm_\\ ahm_invar ahm_empty\"\nby(unfold_locales)(auto)\n\nsubsection {* @{term \"ahm_lookup\"} *}\n\nlemma ahm_lookup_impl: \"map_lookup ahm_\\ ahm_invar ahm_lookup\"\nby(unfold_locales)(simp add: ahm_lookup_def)\n\nsubsection {* @{term \"ahm_iteratei\"} *}\n\nlemma ahm_iteratei_aux_impl:\n assumes invar_m: \"ahm_invar_aux n m\"\n shows \"map_iterator (ahm_iteratei_aux m) (ahm_\\_aux m)\"\nproof -\n obtain ms where m_eq[simp]: \"m = Array ms\" by (cases m)\n\n from ahm_invar_distinct_fst_concatD[of n ms] invar_m\n have dist: \"distinct (map fst (concat ms))\" by simp\n\n show \"map_iterator (ahm_iteratei_aux m) (ahm_\\_aux m)\" \n using set_iterator_foldli_correct[of \"concat ms\"] dist\n by (simp add: ahm_\\_aux_conv_map_of_concat[OF invar_m[unfolded m_eq]]\n ahm_iteratei_aux_def map_to_set_map_of[OF dist] distinct_map)\nqed \n\nlemma ahm_iteratei_correct:\n assumes invar_hm: \"ahm_invar hm\"\n shows \"map_iterator (ahm_iteratei hm) (ahm_\\ hm)\"\nproof -\n obtain A n where hm_eq [simp]: \"hm = HashMap A n\" by(cases hm)\n\n from ahm_iteratei_aux_impl[of n A] invar_hm\n show map_it: \"map_iterator (ahm_iteratei hm) (ahm_\\ hm)\" by simp \nqed\n\nlemma ahm_iteratei_aux_code [code]:\n \"ahm_iteratei_aux a c f \\ = a_idx_it.idx_iteratei a c (\\x. foldli x c f) \\\"\nproof(cases a)\n case (Array xs)[simp]\n\n have \"ahm_iteratei_aux a c f \\ = foldli (concat xs) c f \\\" by simp\n also have \"\\ = foldli xs c (\\x. foldli x c f) \\\" by (simp add: foldli_concat)\n thm a_idx_it.idx_iteratei_correct\n also have \"\\ = a_idx_it.idx_iteratei a c (\\x. foldli x c f) \\\"\n by (simp add: a_idx_it.idx_iteratei_correct)\n finally show ?thesis .\nqed\nsubsection {* @{term \"ahm_rehash\"} *}\n\nlemma array_length_ahm_rehash_aux':\n \"array_length (ahm_rehash_aux' n kv a) = array_length a\"\nby(simp add: ahm_rehash_aux'_def Let_def)\n\nlemma ahm_rehash_aux'_preserves_ahm_invar_aux:\n assumes inv: \"ahm_invar_aux n a\"\n and fresh: \"k \\ fst ` set (array_get a (bounded_hashcode_nat (array_length a) k))\"\n shows \"ahm_invar_aux (Suc n) (ahm_rehash_aux' (array_length a) (k, v) a)\"\n (is \"ahm_invar_aux _ ?a\")\nproof(rule ahm_invar_auxI)\n fix h\n assume \"h < array_length ?a\"\n hence hlen: \"h < array_length a\" by(simp add: array_length_ahm_rehash_aux')\n with inv have bucket: \"bucket_ok (array_length a) h (array_get a h)\"\n and dist: \"distinct (map fst (array_get a h))\"\n by(auto elim: ahm_invar_auxE)\n let ?h = \"bounded_hashcode_nat (array_length a) k\"\n from hlen bucket show \"bucket_ok (array_length ?a) h (array_get ?a h)\"\n by(cases \"h = ?h\")(auto simp add: ahm_rehash_aux'_def Let_def array_length_ahm_rehash_aux' array_get_array_set_other dest: bucket_okD intro!: bucket_okI)\n from dist hlen fresh\n show \"distinct (map fst (array_get ?a h))\"\n by(cases \"h = ?h\")(auto simp add: ahm_rehash_aux'_def Let_def array_get_array_set_other)\nnext\n let ?f = \"\\n kvs. n + length kvs\"\n { fix n :: nat and xs :: \"('a \\ 'b) list list\"\n have \"foldl ?f n xs = n + foldl ?f 0 xs\"\n by(induct xs arbitrary: rule: rev_induct) simp_all }\n note fold = this\n let ?h = \"bounded_hashcode_nat (array_length a) k\"\n\n obtain xs where a [simp]: \"a = Array xs\" by(cases a)\n from inv have [simp]: \"bounded_hashcode_nat (length xs) k < length xs\"\n by(simp add: ahm_invar_aux_def bounded_hashcode_nat_bounds)\n have xs: \"xs = take ?h xs @ (xs ! ?h) # drop (Suc ?h) xs\" by(simp add: Cons_nth_drop_Suc)\n from inv have \"n = array_foldl (\\_ n kvs. n + length kvs) 0 a\"\n by(auto elim: ahm_invar_auxE)\n hence \"n = foldl ?f 0 (take ?h xs) + length (xs ! ?h) + foldl ?f 0 (drop (Suc ?h) xs)\"\n by(simp add: array_foldl_foldl)(subst xs, simp, subst (1 2 3 4) fold, simp)\n thus \"Suc n = array_foldl (\\_ n kvs. n + length kvs) 0 ?a\"\n by(simp add: ahm_rehash_aux'_def Let_def array_foldl_foldl foldl_list_update)(subst (1 2 3 4) fold, simp)\nnext\n from inv have \"1 < array_length a\" by(auto elim: ahm_invar_auxE)\n thus \"1 < array_length ?a\" by(simp add: array_length_ahm_rehash_aux')\nqed\n\ndeclare [[coercion_enabled = false]]\n\nlemma ahm_rehash_aux_correct:\n fixes a :: \"(('key :: hashable) \\ 'val) list array\"\n assumes inv: \"ahm_invar_aux n a\"\n and \"sz > 1\"\n shows \"ahm_invar_aux n (ahm_rehash_aux a sz)\" (is \"?thesis1\")\n and \"ahm_\\_aux (ahm_rehash_aux a sz) = ahm_\\_aux a\" (is \"?thesis2\")\nproof -\n (*interpret ahm!: map_iterator \"ahm_\\_aux\" \"ahm_invar_aux n\" \"ahm_iteratei_aux\"\n by(rule ahm_iteratei_aux_impl)*)\n let ?a = \"ahm_rehash_aux a sz\"\n let ?I = \"\\it a'. ahm_invar_aux (n - card it) a' \\ array_length a' = sz \\ (\\k. if k \\ it then ahm_\\_aux a' k = None else ahm_\\_aux a' k = ahm_\\_aux a k)\"\n have \"?I {} ?a \\ (\\it\\dom (ahm_\\_aux a). it \\ {} \\ \\ True \\ ?I it ?a)\"\n unfolding ahm_rehash_aux_def\n\n proof (rule map_iterator_rule_P[OF ahm_iteratei_aux_impl[OF inv], where\n c = \"\\_. True\" and f=\"ahm_rehash_aux' sz\" and ?\\0.0 = \"new_array [] sz\"\n and I=\"?I\"]\n )\n\n from inv have \"card (dom (ahm_\\_aux a)) = n\" by(rule ahm_invar_aux_card_dom_ahm_\\_auxD)\n moreover from `1 < sz` have \"ahm_invar_aux 0 (new_array ([] :: ('key \\ 'val) list) sz)\"\n by(rule ahm_invar_aux_new_array)\n moreover {\n fix k\n assume \"k \\ dom (ahm_\\_aux a)\"\n hence \"ahm_\\_aux a k = None\" by auto\n moreover have \"bounded_hashcode_nat sz k < sz\" using `1 < sz`\n by(simp add: bounded_hashcode_nat_bounds)\n ultimately have \"ahm_\\_aux (new_array [] sz) k = ahm_\\_aux a k\" by simp }\n ultimately show \"?I (dom (ahm_\\_aux a)) (new_array [] sz)\"\n by(auto simp add: bounded_hashcode_nat_bounds[OF `1 < sz`])\n next\n fix k :: 'key\n and v :: 'val\n and it a'\n assume \"k \\ it\" \"ahm_\\_aux a k = Some v\" \n and it_sub: \"it \\ dom (ahm_\\_aux a)\"\n and I: \"?I it a'\"\n from I have inv': \"ahm_invar_aux (n - card it) a'\" \n and a'_eq_a: \"\\k. k \\ it \\ ahm_\\_aux a' k = ahm_\\_aux a k\" \n and a'_None: \"\\k. k \\ it \\ ahm_\\_aux a' k = None\"\n and [simp]: \"sz = array_length a'\" by(auto split: split_if_asm)\n from it_sub finite_dom_ahm_\\_aux[OF inv] have \"finite it\" by(rule finite_subset)\n moreover with `k \\ it` have \"card it > 0\" by(auto simp add: card_gt_0_iff)\n moreover from finite_dom_ahm_\\_aux[OF inv] it_sub\n have \"card it \\ card (dom (ahm_\\_aux a))\" by(rule card_mono)\n moreover have \"\\ = n\" using inv\n by(simp add: ahm_invar_aux_card_dom_ahm_\\_auxD)\n ultimately have \"n - card (it - {k}) = (n - card it) + 1\" using `k \\ it` by auto\n moreover from `k \\ it` have \"ahm_\\_aux a' k = None\" by(rule a'_None)\n hence \"k \\ fst ` set (array_get a' (bounded_hashcode_nat (array_length a') k))\"\n by(simp add: map_of_eq_None_iff)\n ultimately have \"ahm_invar_aux (n - card (it - {k})) (ahm_rehash_aux' sz (k, v) a')\"\n using inv' by(auto intro: ahm_rehash_aux'_preserves_ahm_invar_aux)\n moreover have \"array_length (ahm_rehash_aux' sz (k, v) a') = sz\"\n by(simp add: array_length_ahm_rehash_aux')\n moreover {\n fix k'\n assume \"k' \\ it - {k}\"\n with bounded_hashcode_nat_bounds[OF `1 < sz`, of k'] a'_None[of k']\n have \"ahm_\\_aux (ahm_rehash_aux' sz (k, v) a') k' = None\"\n by(cases \"bounded_hashcode_nat sz k = bounded_hashcode_nat sz k'\")(auto simp add: array_get_array_set_other ahm_rehash_aux'_def Let_def)\n } moreover {\n fix k'\n assume \"k' \\ it - {k}\"\n with bounded_hashcode_nat_bounds[OF `1 < sz`, of k'] bounded_hashcode_nat_bounds[OF `1 < sz`, of k] a'_eq_a[of k'] `k \\ it`\n have \"ahm_\\_aux (ahm_rehash_aux' sz (k, v) a') k' = ahm_\\_aux a k'\"\n unfolding ahm_rehash_aux'_def Let_def using `ahm_\\_aux a k = Some v`\n by(cases \"bounded_hashcode_nat sz k = bounded_hashcode_nat sz k'\")(case_tac [!] \"k' = k\", simp_all add: array_get_array_set_other) }\n ultimately show \"?I (it - {k}) (ahm_rehash_aux' sz (k, v) a')\" by simp\n qed auto\n thus ?thesis1 ?thesis2 unfolding ahm_rehash_aux_def\n by(auto intro: ext)\nqed\n\nlemma ahm_rehash_correct:\n fixes hm :: \"('key :: hashable, 'val) hashmap\"\n assumes inv: \"ahm_invar hm\"\n and \"sz > 1\"\n shows \"ahm_invar (ahm_rehash hm sz)\" \"ahm_\\ (ahm_rehash hm sz) = ahm_\\ hm\"\nusing assms\nby -(case_tac [!] hm, auto intro: ahm_rehash_aux_correct)\n\nsubsection {* @{term ahm_update} *}\n\nlemma ahm_update_aux_correct:\n assumes inv: \"ahm_invar hm\"\n shows \"ahm_invar (ahm_update_aux hm k v)\" (is ?thesis1)\n and \"ahm_\\ (ahm_update_aux hm k v) = (ahm_\\ hm)(k \\ v)\" (is ?thesis2)\nproof -\n obtain a n where [simp]: \"hm = HashMap a n\" by(cases hm)\n\n let ?h = \"bounded_hashcode_nat (array_length a) k\"\n let ?a' = \"array_set a ?h (AList.update k v (array_get a ?h))\"\n let ?n' = \"if map_of (array_get a ?h) k = None then n + 1 else n\"\n\n have \"ahm_invar (HashMap ?a' ?n')\" unfolding ahm_invar.simps\n proof(rule ahm_invar_auxI)\n fix h\n assume \"h < array_length ?a'\"\n hence \"h < array_length a\" by simp\n with inv have \"bucket_ok (array_length a) h (array_get a h)\"\n by(auto elim: ahm_invar_auxE)\n thus \"bucket_ok (array_length ?a') h (array_get ?a' h)\"\n using `h < array_length a`\n apply(cases \"h = bounded_hashcode_nat (array_length a) k\")\n apply(fastforce intro!: bucket_okI simp add: dom_update array_get_array_set_other dest: bucket_okD del: imageE elim: imageE)+\n done\n from `h < array_length a` inv have \"distinct (map fst (array_get a h))\"\n by(auto elim: ahm_invar_auxE)\n with `h < array_length a`\n show \"distinct (map fst (array_get ?a' h))\"\n by(cases \"h = bounded_hashcode_nat (array_length a) k\")(auto simp add: array_get_array_set_other intro: distinct_update)\n next\n obtain xs where a [simp]: \"a = Array xs\" by(cases a)\n\n let ?f = \"\\n kvs. n + length kvs\"\n { fix n :: nat and xs :: \"('a \\ 'b) list list\"\n have \"foldl ?f n xs = n + foldl ?f 0 xs\"\n by(induct xs arbitrary: rule: rev_induct) simp_all }\n note fold = this\n\n from inv have [simp]: \"bounded_hashcode_nat (length xs) k < length xs\"\n by(simp add: ahm_invar_aux_def bounded_hashcode_nat_bounds)\n have xs: \"xs = take ?h xs @ (xs ! ?h) # drop (Suc ?h) xs\" by(simp add: Cons_nth_drop_Suc)\n from inv have \"n = array_foldl (\\_ n kvs. n + length kvs) 0 a\"\n by(auto elim: ahm_invar_auxE)\n hence \"n = foldl ?f 0 (take ?h xs) + length (xs ! ?h) + foldl ?f 0 (drop (Suc ?h) xs)\"\n by(simp add: array_foldl_foldl)(subst xs, simp, subst (1 2 3 4) fold, simp)\n thus \"?n' = array_foldl (\\_ n kvs. n + length kvs) 0 ?a'\"\n apply(simp add: ahm_rehash_aux'_def Let_def array_foldl_foldl foldl_list_update map_of_eq_None_iff)\n apply(subst (1 2 3 4 5 6 7 8) fold)\n apply(simp add: length_update)\n done\n next\n from inv have \"1 < array_length a\" by(auto elim: ahm_invar_auxE)\n thus \"1 < array_length ?a'\" by simp\n qed\n moreover have \"ahm_\\ (ahm_update_aux hm k v) = ahm_\\ hm(k \\ v)\"\n proof\n fix k'\n from inv have \"1 < array_length a\" by(auto elim: ahm_invar_auxE)\n with bounded_hashcode_nat_bounds[OF this, of k]\n show \"ahm_\\ (ahm_update_aux hm k v) k' = (ahm_\\ hm(k \\ v)) k'\"\n by(cases \"bounded_hashcode_nat (array_length a) k = bounded_hashcode_nat (array_length a) k'\")(auto simp add: Let_def update_conv array_get_array_set_other)\n qed\n ultimately show ?thesis1 ?thesis2 by(simp_all add: Let_def)\nqed\n\nlemma ahm_update_correct:\n assumes inv: \"ahm_invar hm\"\n shows \"ahm_invar (ahm_update k v hm)\"\n and \"ahm_\\ (ahm_update k v hm) = (ahm_\\ hm)(k \\ v)\"\nusing assms\nby(simp_all add: ahm_update_def Let_def ahm_rehash_correct ahm_update_aux_correct)\n\nlemma ahm_update_impl:\n \"map_update ahm_\\ ahm_invar ahm_update\"\nby(unfold_locales)(simp_all add: ahm_update_correct)\n\nsubsection {* @{term \"ahm_delete\"} *}\n\nlemma ahm_delete_correct:\n assumes inv: \"ahm_invar hm\"\n shows \"ahm_invar (ahm_delete k hm)\" (is \"?thesis1\")\n and \"ahm_\\ (ahm_delete k hm) = (ahm_\\ hm) |` (- {k})\" (is \"?thesis2\")\nproof -\n obtain a n where hm [simp]: \"hm = HashMap a n\" by(cases hm)\n\n let ?h = \"bounded_hashcode_nat (array_length a) k\"\n let ?a' = \"array_set a ?h (AList.delete k (array_get a ?h))\"\n let ?n' = \"if map_of (array_get a (bounded_hashcode_nat (array_length a) k)) k = None then n else n - 1\"\n \n have \"ahm_invar_aux ?n' ?a'\"\n proof(rule ahm_invar_auxI)\n fix h\n assume \"h < array_length ?a'\"\n hence \"h < array_length a\" by simp\n with inv have \"bucket_ok (array_length a) h (array_get a h)\"\n and \"1 < array_length a\" \n and \"distinct (map fst (array_get a h))\" by(auto elim: ahm_invar_auxE)\n thus \"bucket_ok (array_length ?a') h (array_get ?a' h)\"\n and \"distinct (map fst (array_get ?a' h))\"\n using bounded_hashcode_nat_bounds[of \"array_length a\" k] \n by-(case_tac [!] \"h = bounded_hashcode_nat (array_length a) k\", auto simp add: array_get_array_set_other set_delete_conv intro!: bucket_okI dest: bucket_okD intro: distinct_delete)\n next\n obtain xs where a [simp]: \"a = Array xs\" by(cases a)\n\n let ?f = \"\\n kvs. n + length kvs\"\n { fix n :: nat and xs :: \"('a \\ 'b) list list\"\n have \"foldl ?f n xs = n + foldl ?f 0 xs\"\n by(induct xs arbitrary: rule: rev_induct) simp_all }\n note fold = this\n\n from inv have [simp]: \"bounded_hashcode_nat (length xs) k < length xs\"\n by(simp add: ahm_invar_aux_def bounded_hashcode_nat_bounds)\n from inv have \"distinct (map fst (array_get a ?h))\" by(auto elim: ahm_invar_auxE)\n moreover\n have xs: \"xs = take ?h xs @ (xs ! ?h) # drop (Suc ?h) xs\" by(simp add: Cons_nth_drop_Suc)\n from inv have \"n = array_foldl (\\_ n kvs. n + length kvs) 0 a\"\n by(auto elim: ahm_invar_auxE)\n hence \"n = foldl ?f 0 (take ?h xs) + length (xs ! ?h) + foldl ?f 0 (drop (Suc ?h) xs)\"\n by(simp add: array_foldl_foldl)(subst xs, simp, subst (1 2 3 4) fold, simp)\n ultimately show \"?n' = array_foldl (\\_ n kvs. n + length kvs) 0 ?a'\"\n apply(simp add: array_foldl_foldl foldl_list_update map_of_eq_None_iff)\n apply(subst (1 2 3 4 5 6 7 8) fold)\n apply(auto simp add: length_distinct in_set_conv_nth)\n done\n next\n from inv show \"1 < array_length ?a'\" by(auto elim: ahm_invar_auxE)\n qed\n thus \"?thesis1\" by(auto simp add: Let_def)\n\n have \"ahm_\\_aux ?a' = ahm_\\_aux a |` (- {k})\"\n proof\n fix k' :: 'a\n from inv have \"bounded_hashcode_nat (array_length a) k < array_length a\"\n by(auto elim: ahm_invar_auxE simp add: bounded_hashcode_nat_bounds)\n thus \"ahm_\\_aux ?a' k' = (ahm_\\_aux a |` (- {k})) k'\"\n by(cases \"?h = bounded_hashcode_nat (array_length a) k'\")(auto simp add: restrict_map_def array_get_array_set_other delete_conv)\n qed\n thus ?thesis2 by(simp add: Let_def)\nqed\n\nlemma ahm_delete_impl:\n \"map_delete ahm_\\ ahm_invar ahm_delete\"\nby(unfold_locales)(blast intro: ahm_delete_correct)+\n\nhide_const (open) HashMap ahm_empty bucket_ok ahm_invar ahm_\\ ahm_lookup\n ahm_iteratei ahm_rehash hm_grow ahm_filled ahm_update ahm_delete\nhide_type (open) hashmap\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/impl/ArrayHashMap_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.2716676956608397}} {"text": "theory Post_Visibility_Traceback\n imports Traceback_Intro\nbegin\n\nconsts PID :: postID\nconsts VIS :: vis\n\nsubsection \\Tracing Back Post Visibility Status\\\n\ntext \\We prove the following traceback property:\nIf, at some point \\t\\ on a system trace, the visibility of a post \\PID\\\nhas a value \\VIS\\, then one of the following holds:\n\\begin{itemize}\n\\item Either \\VIS\\ is \\FriendV\\ (i.e., friends-only) which is the default at post creation\n\\item Or the post's owner had issued a successful ``update visibility'' action setting the visibility to \\VIS\\,\nand no other successful update actions to \\PID\\'s visibility occur\nbetween the time of that action and \\t\\.\n\\end{itemize}\n\nThis will be captured in the predicate \\proper\\, and the main theorem states that \\proper tr\\\nholds for any trace \\tr\\ that leads to post \\PID\\ acquiring visibility \\VIS\\.\n\\\n\n\ntext \\\\SNC uidd trn\\ means\n``The transaction \\trn\\ is a successful post creation by user \\uidd\\'' \\\n\nfun SNC :: \"userID \\ (state,act,out) trans \\ bool\" where\n\"SNC uidd (Trans s (Cact (cPost uid p pid tit)) ou s') = (ou = outOK \\ (uid,pid) = (uidd,PID))\"\n|\n\"SNC uidd _ = False\"\n\n\ntext \\\\SNVU uidd vvs trn\\ means\n\"The transaction \\trn\\ is a successful post visibility update for \\PID\\, by user \\uidd\\, to value \\vvs\\'' \\\n\nfun SNVU :: \"userID \\ vis \\ (state,act,out) trans \\ bool\" where\n\"SNVU uidd vvs (Trans s (Uact (uVisPost uid p pid vs)) ou s') =\n (ou = outOK \\ (uid,pid) = (uidd,PID) \\ vs = vvs)\"\n|\n\"SNVU uidd vvis _ = False\"\n\ndefinition proper :: \"(state,act,out) trans trace \\ bool\" where\n\"proper tr \\\n VIS = FriendV\n \\\n (\\ uid tr1 trn tr2 trnn tr3.\n tr = tr1 @ trn # tr2 @ trnn # tr3 \\\n SNC uid trn \\ SNVU uid VIS trnn \\ (\\ vis. never (SNVU uid vis) tr3))\"\n\n(* *)\n\ndefinition proper1 :: \"(state,act,out) trans trace \\ bool\" where\n\"proper1 tr \\\n \\ tr2 trnn tr3.\n tr = tr2 @ trnn # tr3 \\\n SNVU (owner (srcOf trnn) PID) VIS trnn\"\n\nlemma not_never_ex:\nassumes \"\\ never P xs\"\nshows \"\\ xs1 x xs2. xs = xs1 @ x # xs2 \\ P x \\ never P xs2\"\nusing assms proof(induct xs rule: rev_induct)\n case (Nil)\n thus ?case unfolding list_all_iff empty_iff by auto\nnext\n case (snoc y ys)\n show ?case\n proof(cases \"P y\")\n case True thus ?thesis using snoc\n apply(intro exI[of _ ys]) apply(intro exI[of _ y] exI[of _ \"[]\"]) by auto\n next\n case False then obtain xs1 x xs2 where \"ys = xs1 @ x # xs2 \\ P x \\ never P xs2\"\n using snoc by auto\n thus ?thesis using snoc False\n apply(intro exI[of _ xs1]) apply(intro exI[of _ x] exI[of _ \"xs2 ## y\"]) by auto\n qed\nqed\n\nlemma SNVU_postIDs:\nassumes \"validTrans trn\" and \"SNVU uid vs trn\"\nshows \"PID \\\\ postIDs (srcOf trn)\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma SNVU_visib:\nassumes \"validTrans trn\" and \"SNVU uid vs trn\"\nshows \"vis (tgtOf trn) PID = vs\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma owner_validTrans:\nassumes \"validTrans trn\" and \"PID \\\\ postIDs (srcOf trn)\"\nshows \"owner (srcOf trn) PID = owner (tgtOf trn) PID\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma owner_valid:\nassumes \"valid tr\" and \"PID \\\\ postIDs (srcOf (hd tr))\"\nshows \"owner (srcOf (hd tr)) PID = owner (tgtOf (last tr)) PID\"\nusing assms using owner_validTrans IDs_mono validTrans by induct auto\n\nlemma SNVU_vis_validTrans:\nassumes \"validTrans trn\" and \"PID \\\\ postIDs (srcOf trn)\"\nand \"\\ vs. \\ SNVU (owner (srcOf trn) PID) vs trn\"\nshows \"vis (srcOf trn) PID = vis (tgtOf trn) PID\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma SNVU_vis_valid:\nassumes \"valid tr\" and \"PID \\\\ postIDs (srcOf (hd tr))\"\nand \"\\ vis. never (SNVU (owner (srcOf (hd tr)) PID) vis) tr\"\nshows \"vis (srcOf (hd tr)) PID = vis (tgtOf (last tr)) PID\"\nusing assms proof induct\n case (Singl)\n thus ?case using SNVU_vis_validTrans by auto\nnext\n case (Cons trn tr)\n have n: \"PID \\\\ postIDs (srcOf (hd tr))\"\n using Cons by (simp add: IDs_mono(2) validTrans)\n have v: \"\\ vis. never (SNVU (owner (srcOf (hd tr)) PID) vis) tr\"\n using Cons by (simp add: owner_validTrans)\n have \"vis (srcOf trn) PID = vis (srcOf (hd tr)) PID\"\n using Cons SNVU_vis_validTrans by auto\n also have \"... = vis (tgtOf (last tr)) PID\"\n using n v Cons(4) by auto\n finally show ?case using Cons by auto\nqed\n\nlemma proper1_never:\nassumes vtr: \"valid tr\" and PID: \"PID \\\\ postIDs (srcOf (hd tr))\"\nand tr: \"proper1 tr\" and v: \"vis (tgtOf (last tr)) PID = VIS\"\nshows \"\\ tr2 trnn tr3.\n tr = tr2 @ trnn # tr3 \\\n SNVU (owner (srcOf trnn) PID) VIS trnn \\ (\\ vis. never (SNVU (owner (srcOf trnn) PID) vis) tr3)\"\nproof-\n obtain tr2 trnn tr3 where\n tr: \"tr = tr2 @ trnn # tr3\" and SNVU: \"SNVU (owner (srcOf trnn) PID) VIS trnn\"\n using tr unfolding proper1_def by auto\n define uid where \"uid \\ owner (srcOf trnn) PID\"\n show ?thesis\n proof(cases \"never (\\ trn. \\ vis. SNVU uid vis trn) tr3\")\n case True thus ?thesis using tr SNVU unfolding uid_def list_all_iff by blast\n next\n case False\n from not_never_ex[OF this] obtain tr3a tr3n tr3b vs where tr3: \"tr3 = tr3a @ tr3n # tr3b\"\n and SNVUtr3n: \"SNVU uid vs tr3n\" and n: \"\\ vs. never (SNVU uid vs) tr3b\"\n unfolding list_all_iff by blast\n have trnn: \"validTrans trnn\" and\n tr3n: \"validTrans tr3n\" and vtr3: \"valid tr3\" using tr unfolding tr tr3\n by (metis Nil_is_append_conv append_self_conv2 list.distinct(1) tr tr3 valid_ConsE valid_append vtr)+\n hence PID_trnn: \"PID \\\\ postIDs (srcOf trnn)\" and\n PID_tr3n: \"PID \\\\ postIDs (srcOf tr3n)\" using SNVU_postIDs SNVU SNVUtr3n by auto\n have vvv: \"valid (trnn # tr3a @ [tr3n])\"\n using vtr unfolding tr tr3\n by (smt Nil_is_append_conv append_self_conv2 hd_append2 list.distinct(1) list.sel(1)\n valid_Cons_iff valid_append)\n hence PID_tr3n': \"PID \\\\ postIDs (tgtOf tr3n)\" using tr3n SNVUtr3n\n by (simp add: IDs_mono(2) PID_tr3n validTrans)\n from owner_valid[OF vvv] PID_trnn\n have 000: \"owner (tgtOf tr3n) PID = uid\" unfolding uid_def by simp\n hence 0: \"owner (srcOf tr3n) PID = uid\" using PID_tr3n owner_validTrans tr3n by blast\n have 00: \"vs = vis (tgtOf tr3n) PID\" using SNVUtr3n tr3n SNVU_visib by auto\n have vis: \"vs = VIS\"\n proof(cases \"tr3b = []\")\n case True\n thus ?thesis using v 00 unfolding tr tr3 by simp\n next\n case False\n hence tgt: \"tgtOf tr3n = srcOf (hd tr3b)\" and tr3b: \"valid tr3b\" using vtr3 unfolding tr3\n apply (metis valid_append list.distinct(2) self_append_conv2 valid_ConsE)\n by (metis False append_self_conv2 list.distinct(1) tr3 valid_Cons_iff valid_append vtr3)\n show ?thesis unfolding 00 tgt\n using v False PID_tr3n'\n using SNVU_vis_valid[OF tr3b _ n[unfolded 000[symmetric] tgt]]\n unfolding tr tr3 tgt by simp\n qed\n show ?thesis apply(intro exI[of _ \"tr2 @ trnn # tr3a\"])\n apply(intro exI[of _ tr3n] exI[of _ tr3b])\n using SNVUtr3n n unfolding tr tr3 0 vis by simp\n qed\nqed\n\n\n(* *)\n\nlemma SNVU_validTrans:\nassumes \"validTrans trn\"\nand \"PID \\\\ postIDs (srcOf trn)\"\nand \"vis (srcOf trn) PID \\ VIS\"\nand \"vis (tgtOf trn) PID = VIS\"\nshows \"SNVU (owner (srcOf trn) PID) VIS trn\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma valid_mono_postID:\nassumes \"valid tr\"\nand \"PID \\\\ postIDs (srcOf (hd tr))\"\nshows \"PID \\\\ postIDs (tgtOf (last tr))\"\nusing assms proof induct\n case (Singl trn)\n then show ?case using IDs_mono(2) by (cases trn) auto\nnext\n case (Cons trn tr)\n then show ?case using IDs_mono(2) by (cases trn) auto\nqed\n\nlemma proper1_valid:\nassumes V: \"VIS \\ FriendV\"\nand a: \"valid tr\"\n\"PID \\\\ postIDs (srcOf (hd tr))\"\n\"vis (srcOf (hd tr)) PID \\ VIS\"\n\"vis (tgtOf (last tr)) PID = VIS\"\nshows \"proper1 tr\"\nusing a unfolding valid_valid2 proof induct\n case (Singl trn)\n then show ?case unfolding proper1_def using SNVU_validTrans\n by (intro exI[of _ \"owner (srcOf trn) PID\"] exI[of _ \"[]\"] exI[of _ trn]) auto\nnext\n case (Rcons tr trn)\n hence \"PID \\\\ postIDs (srcOf (hd tr))\" using Rcons by simp\n from valid_mono_postID[OF \\valid2 tr\\[unfolded valid2_valid] this]\n have \"PID \\\\ postIDs (tgtOf (last tr))\" by simp\n hence 0: \"PID \\\\ postIDs (srcOf trn)\" using Rcons by simp\n show ?case\n proof(cases \"vis (srcOf trn) PID = VIS\")\n case False\n hence \"SNVU (owner (srcOf trn) PID) VIS trn\"\n apply (intro SNVU_validTrans) using 0 Rcons by auto\n thus ?thesis unfolding proper1_def\n by (intro exI[of _ tr] exI[of _ trn] exI[of _ \"[]\"]) auto\n next\n case True\n hence \"proper1 tr\" using Rcons by auto\n then obtain trr trnn tr3 where\n tr: \"tr = trr @ trnn # tr3\" and SNVU: \"SNVU (owner (srcOf trnn) PID) VIS trnn\"\n unfolding proper1_def using V by auto\n have \"vis (tgtOf trn) PID = VIS\" using Rcons.prems by auto\n thus ?thesis\n using SNVU V unfolding proper1_def tr\n by(intro exI[of _ trr] exI[of _ trnn] exI[of _ \"tr3 ## trn\"]) auto\n qed\nqed\n\nlemma istate_postIDs:\n\"\\ PID \\\\ postIDs istate\"\nunfolding istate_def by simp\n\n\n(* *)\n\ndefinition proper2 :: \"(state,act,out) trans trace \\ bool\" where\n\"proper2 tr \\\n \\ uid tr1 trn tr2.\n tr = tr1 @ trn # tr2 \\ SNC uid trn\"\n\nlemma SNC_validTrans:\nassumes \"VIS \\ FriendV\" and \"validTrans trn\"\nand \"\\ PID \\\\ postIDs (srcOf trn)\"\nand \"PID \\\\ postIDs (tgtOf trn)\"\nshows \"\\ uid. SNC uid trn\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma proper2_valid:\nassumes V: \"VIS \\ FriendV\"\nand a: \"valid tr\"\n\"\\ PID \\\\ postIDs (srcOf (hd tr))\"\n\"PID \\\\ postIDs (tgtOf (last tr))\"\nshows \"proper2 tr\"\nusing a unfolding valid_valid2 proof induct\n case (Singl trn)\n then obtain uid where \"SNC uid trn\" using SNC_validTrans V by auto\n thus ?case unfolding proper2_def using SNC_validTrans\n by (intro exI[of _ uid] exI[of _ \"[]\"] exI[of _ trn]) auto\nnext\n case (Rcons tr trn)\n show ?case\n proof(cases \"PID \\\\ postIDs (srcOf trn)\")\n case False\n then obtain uid where \"SNC uid trn\"\n using Rcons SNC_validTrans V by auto\n thus ?thesis unfolding proper2_def\n apply - apply (intro exI[of _ uid] exI[of _ tr]) by (intro exI[of _ trn] exI[of _ \"[]\"]) auto\n next\n case True\n hence \"proper2 tr\" using Rcons by auto\n then obtain uid tr1 trnn tr2 where\n tr: \"tr = tr1 @ trnn # tr2\" and SFRC: \"SNC uid trnn\"\n unfolding proper2_def by auto\n have \"PID \\\\ postIDs (tgtOf trn)\" using V Rcons.prems by auto\n show ?thesis using SFRC unfolding proper2_def tr\n apply - apply (intro exI[of _ uid] exI[of _ tr1])\n by (intro exI[of _ trnn] exI[of _ \"tr2 ## trn\"]) simp\n qed\nqed\n\nlemma proper2_valid_istate:\nassumes V: \"VIS \\ FriendV\"\nand a: \"valid tr\"\n\"srcOf (hd tr) = istate\"\n\"PID \\\\ postIDs (tgtOf (last tr))\"\nshows \"proper2 tr\"\nusing proper2_valid assms istate_postIDs by auto\n\n(* *)\n\nlemma SNC_visPost:\nassumes \"VIS \\ FriendV\"\nand \"validTrans trn\" \"SNC uid trn\" and \"reach (srcOf trn)\"\nshows \"vis (tgtOf trn) PID \\ VIS\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n apply (cases \"a\") apply (auto simp: all_defs elim: step_elims)\n subgoal for x2 apply(cases x2)\n using reach_not_postIDs_vis_FriendV\n by (auto simp: all_defs elim: step_elims) .\nqed\n\nlemma SNC_postIDs:\nassumes \"validTrans trn\" and \"SNC uid trn\"\nshows \"PID \\\\ postIDs (tgtOf trn)\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\nlemma SNC_owner:\nassumes \"validTrans trn\" and \"SNC uid trn\"\nshows \"uid = owner (tgtOf trn) PID\"\nproof(cases trn)\n case (Trans s a ou s')\n then show ?thesis\n using assms\n by (cases \"a\") (auto simp: all_defs elim: step_elims)\nqed\n\ntheorem post_accountability:\nassumes v: \"valid tr\" and i: \"srcOf (hd tr) = istate\"\nand PIDin: \"PID \\\\ postIDs (tgtOf (last tr))\"\nand PID: \"vis (tgtOf (last tr)) PID = VIS\"\nshows \"proper tr\"\nproof(cases \"VIS = FriendV\")\n case True thus ?thesis unfolding proper_def by auto\nnext\n case False\n have \"proper2 tr\" using proper2_valid_istate[OF False v i PIDin] .\n then obtain uid tr1 trn trr where\n tr: \"tr = tr1 @ trn # trr\" and SNC: \"SNC uid trn\" unfolding proper2_def by auto\n hence trn: \"validTrans trn\" and r: \"reach (srcOf trn)\" using v unfolding tr\n apply (metis list.distinct(2) self_append_conv2 valid_ConsE valid_append)\n by (metis (mono_tags, lifting) append_Cons hd_append i list.sel(1) reach.simps tr v valid_append valid_init_reach)\n hence N: \"PID \\\\ postIDs (tgtOf trn)\" \"vis (tgtOf trn) PID \\ VIS\"\n using SNC_postIDs SNC_visPost False SNC by auto\n hence trrNE: \"trr \\ []\" and 1: \"last tr = last trr\" using PID unfolding tr by auto\n hence trr_v: \"valid trr\" using v unfolding tr\n by (metis valid_Cons_iff append_self_conv2 list.distinct(1) valid_append)\n have 0: \"tgtOf trn = srcOf (hd trr)\" using v trrNE unfolding tr\n by (metis valid_append list.distinct(2) self_append_conv2 valid_ConsE)\n have \"proper1 trr\" using proper1_valid[OF False trr_v N[unfolded 0] PID[unfolded 1]] .\n from proper1_never[OF trr_v N(1)[unfolded 0] this PID[unfolded 1]] obtain tr2 trnn tr3 where\n trr: \"trr = tr2 @ trnn # tr3\" and SNVU: \"SNVU (owner (srcOf trnn) PID) VIS trnn\"\n and vis: \"\\ vis. never (SNVU (owner (srcOf trnn) PID) vis) tr3\" by auto\n have 00: \"srcOf (hd (tr2 @ [trnn])) = tgtOf trn\" using v unfolding tr trr\n by (metis \"0\" append_self_conv2 hd_append2 list.sel(1) trr)\n have trnn: \"validTrans trnn\" using trr_v unfolding trr\n by (metis valid_Cons_iff append_self_conv2 list.distinct(1) valid_append)\n have vv: \"valid (tr2 @ [trnn])\"\n using v unfolding tr trr\n by (smt Nil_is_append_conv append_self_conv2 hd_append2 list.distinct(1) list.sel(1)\n valid_Cons_iff valid_append)\n have \"uid = owner (tgtOf trn) PID\" using SNC trn SNC_owner by auto\n also have \"... = owner (tgtOf trnn) PID\"\n using owner_valid[OF vv] N(1) unfolding 00 by simp\n also have \"... = owner (srcOf trnn) PID\"\n using SNVU trnn SNVU_postIDs owner_validTrans by auto\n finally have uid: \"uid = owner (srcOf trnn) PID\" .\n show ?thesis unfolding proper_def\n apply(rule disjI2)\n apply(intro exI[of _ uid] exI[of _ tr1])\n apply(rule exI[of _ trn], rule exI[of _ tr2])\n apply(intro exI[of _ trnn] exI[of _ tr3])\n using SNC SNVU vis unfolding tr trr uid by auto\nqed\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMed/Traceback_Properties/Post_Visibility_Traceback.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2715969781793041}} {"text": "section {* Reactive designs *}\n\ntheory utp_rea_designs\n imports utp_reactive\nbegin\n\nsubsection {* Preliminaries *} \n\ntext {* R3 as presented in the UTP book and related publications is not sensitive to state, although\n reactive designs often need this property. Thus is is necessary to use a modification of R3\n from Butterfield et al. (2009) that explicitly states that intermediate\n waiting states do not propogate final state variables. In order to do this we need an additional\n observational variable that capture the program state that we call $st$. *}\n\nalphabet 's rsp_vars = \"'t rp_vars\" +\n st :: 's\n\ntype_synonym ('s,'t,'\\) rsp = \"('t, ('s, '\\) rsp_vars_scheme) rp\"\ntype_synonym ('s,'t,'\\,'\\) rel_rsp = \"(('s,'t,'\\) rsp, ('s,'t,'\\) rsp) rel\"\ntype_synonym ('s,'t,'\\) hrel_rsp = \"('s,'t,'\\) rsp hrel\"\n\ntranslations\n (type) \"('s,'t,'\\) rsp\" <= (type) \"('t, ('s, '\\) rsp_vars_scheme) rp_vars_ext des\"\n (type) \"('s,'t,'\\,'\\) rel_rp\" <= (type) \"(('s,'t,'\\) rsp, (_,_,'\\) rsp) rel\"\n\nnotation rsp_vars_child_lens\\<^sub>a (\"\\\\<^sub>s\")\nnotation rsp_vars_child_lens (\"\\\\<^sub>S\")\n\nabbreviation lift_state_rel (\"\\_\\\\<^sub>S\")\nwhere \"\\P\\\\<^sub>S \\ P \\\\<^sub>p (st \\\\<^sub>L st)\"\n\nabbreviation lift_state_pre (\"\\_\\\\<^sub>S\\<^sub><\")\nwhere \"\\p\\\\<^sub>S\\<^sub>< \\ \\\\p\\\\<^sub><\\\\<^sub>S\"\n\nsyntax\n \"_svid_st_alpha\" :: \"svid\" (\"\\\\<^sub>S\")\n\ntranslations\n \"_svid_st_alpha\" => \"CONST rsp_vars_child_lens\"\n\ninterpretation alphabet_state:\n lens_interp \"\\(ok, wait, tr, r). (ok, wait, tr, st\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation alphabet_state_rel: lens_interp \"\\(ok, ok', wait, wait', tr, tr', r, r').\n (ok, ok', wait, wait', tr, tr', st\\<^sub>v r, st\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nlemma st'_unrest_st_lift_pred [unrest]:\n \"$st\\ \\ \\a\\\\<^sub>S\\<^sub><\"\n by (pred_auto)\n\nsubsection {* Healthiness conditions *}\n\ntext {* The fundamental healthiness conditions of reactive designs are $RD1$ and $RD2$ which\n are essentially modifications of H1 and H2 from the theory of designs, viewed through\n the prism of reactive processes. *}\n\ndefinition [upred_defs]: \"RD1(P) = (P \\ (\\ $ok \\ $tr \\\\<^sub>u $tr\\))\"\ndefinition [upred_defs]: \"RD2(P) = H2(P)\"\n\ntext {* RD2 is just H2 since the type system will automatically have J identifying the reactive\n variables as required. *}\n\nlemma RD1_idem: \"RD1(RD1(P)) = RD1(P)\"\n by (rel_auto)\n\nlemma RD1_Idempotent: \"Idempotent RD1\"\n by (simp add: Idempotent_def RD1_idem)\n\nlemma RD1_mono: \"P \\ Q \\ RD1(P) \\ RD1(Q)\"\n by (rel_auto)\n\nlemma RD1_Monotonic: \"Monotonic RD1\"\n using Monotonic_def RD1_mono by blast\n \nlemma RD1_Continuous: \"Continuous RD1\"\n unfolding Continuous_def SUP_def apply rel_simp\n unfolding SUP_def \n apply transfer apply auto \ndone\n\n\nlemma RD2_idem: \"RD2(RD2(P)) = RD2(P)\"\n by (simp add: H2_idem RD2_def)\n\nlemma RD2_Idempotent: \"Idempotent RD2\"\n by (simp add: Idempotent_def RD2_idem)\n\nlemma RD2_mono: \"P \\ Q \\ RD2(P) \\ RD2(Q)\"\n by (simp add: H2_def RD2_def seqr_mono)\n\nlemma RD2_Monotonic: \"Monotonic RD2\"\n using Monotonic_def RD2_mono by blast\n\nlemma RD2_Continuous: \"Continuous RD2\"\n apply (rel_auto)\n unfolding SUP_def apply rel_simp\n unfolding SUP_def INF_def\n apply transfer apply force \n apply rel_simp\n unfolding SUP_def INF_def\n apply transfer apply force\n apply rel_simp\n unfolding SUP_def INF_def\n apply transfer \n apply rel_simp\n unfolding SUP_def INF_def\n apply transfer apply force\ndone\n\n\nlemma RD1_RD2_commute: \"RD1(RD2(P)) = RD2(RD1(P))\"\n by (rel_auto)\n\nlemma RD1_R1_commute: \"RD1(R1(P)) = R1(RD1(P))\"\n by (rel_auto)\n\nlemma RD1_R2c_commute: \"RD1(R2c(P)) = R2c(RD1(P))\"\n by (rel_auto)\n\nlemma RD1_via_R1: \"R1(H1(P)) = RD1(R1(P))\"\n by (rel_auto)\n \ndefinition skip_rea :: \"('t::ordered_cancel_monoid_diff, '\\) hrel_rp\" (\"II\\<^sub>r\") where\nskip_rea_def [urel_defs]: \"II\\<^sub>r = (II \\ (\\ $ok \\ $tr \\\\<^sub>u $tr\\))\"\n\ndefinition skip_srea :: \"('s, 't::ordered_cancel_monoid_diff, '\\) hrel_rsp\" (\"II\\<^sub>R\") where\nskip_srea_def [urel_defs]: \"II\\<^sub>R = ((\\ $st \\ II\\<^sub>r) \\ $wait \\ II\\<^sub>r)\"\n \ndefinition R3c_def [upred_defs]: \"R3c(P) = (II\\<^sub>r \\ $wait \\ P)\"\n\ndefinition R3h_def [upred_defs]: \"R3h(P) = ((\\ $st \\ II\\<^sub>r) \\ $wait \\ P)\"\n\nlemma R3c_idem: \"R3c(R3c(P)) = R3c(P)\"\n by (rel_auto)\n\nlemma R3c_Idempotent: \"Idempotent R3c\"\n by (simp add: Idempotent_def R3c_idem)\n\nlemma R3c_mono: \"P \\ Q \\ R3c(P) \\ R3c(Q)\"\n by (rel_auto)\n\nlemma R3c_Monotonic: \"Monotonic R3c\"\n by (simp add: Monotonic_def R3c_mono)\n\nlemma R3c_Continuous: \"Continuous R3c\"\n unfolding Continuous_def SUP_def\n apply rel_simp+ \n unfolding SUP_def \n apply transfer apply auto\ndone\n\nlemma R3h_idem: \"R3h(R3h(P)) = R3h(P)\"\n by (rel_auto)\n\nlemma R3h_Idempotent: \"Idempotent R3h\"\n by (simp add: Idempotent_def R3h_idem)\n\nlemma R3h_mono: \"P \\ Q \\ R3h(P) \\ R3h(Q)\"\n by (rel_auto)\n\nlemma R3h_Monotonic: \"Monotonic R3h\"\n by (simp add: Monotonic_def R3h_mono)\n\nlemma R3h_Continuous: \"Continuous R3h\"\n by (rel_auto)\n\nlemma R3h_inf: \"R3h(P \\ Q) = R3h(P) \\ R3h(Q)\"\n by (rel_auto)\n\nlemma R3h_UINF:\n \"A \\ {} \\ R3h(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ R3h(P(i)))\"\n by (rel_auto)\n\nlemma R3h_cond: \"R3h(P \\ b \\ Q) = (R3h(P) \\ b \\ R3h(Q))\"\n by (rel_auto)\n\nlemma R3c_via_RD1_R3: \"RD1(R3(P)) = R3c(RD1(P))\"\n by (rel_auto)\n\nlemma R3c_RD1_def: \"P is RD1 \\ R3c(P) = RD1(R3(P))\"\n by (simp add: Healthy_if R3c_via_RD1_R3)\n\nlemma RD1_R3c_commute: \"RD1(R3c(P)) = R3c(RD1(P))\"\n by (rel_auto)\n\nlemma RD2_R3c_commute: \"RD2(R3c(P)) = R3c(RD2(P))\"\n by (rel_auto)\n\nlemma R1_R3c_commute: \"R1(R3c(P)) = R3c(R1(P))\"\n by (rel_auto)\n\nlemma R2c_R3c_commute: \"R2c(R3c(P)) = R3c(R2c(P))\"\n apply (rel_auto) using minus_zero_eq by blast+\n\nlemma R1_R3h_commute: \"R1(R3h(P)) = R3h(R1(P))\"\n by (rel_auto)\n\nlemma R2c_R3h_commute: \"R2c(R3h(P)) = R3h(R2c(P))\"\n apply (rel_auto) using minus_zero_eq by blast+\n\nlemma RD1_R3h_commute: \"RD1(R3h(P)) = R3h(RD1(P))\"\n by (rel_auto)\n\nlemma RD2_R3h_commute: \"RD2(R3h(P)) = R3h(RD2(P))\"\n by (rel_auto)\n\nlemma R3c_cancels_R3: \"R3c(R3(P)) = R3c(P)\"\n by (rel_auto)\n\nlemma R3_cancels_R3c: \"R3(R3c(P)) = R3(P)\"\n by (rel_auto)\n\nlemma R3h_cancels_R3c: \"R3h(R3c(P)) = R3h(P)\"\n by (rel_auto)\n\nlemma skip_rea_RD1_skip: \"II\\<^sub>r = RD1(II)\"\n by (rel_auto)\n\nlemma R1_skip_rea: \"R1(II\\<^sub>r) = II\\<^sub>r\"\n by (rel_auto)\n\nlemma skip_rea_form: \"II\\<^sub>r = (II \\ $ok \\ R1(true))\"\n by (rel_auto)\n\nlemma R2c_skip_rea: \"R2c II\\<^sub>r = II\\<^sub>r\"\n by (simp add: skip_rea_def R2c_and R2c_disj R2c_skip_r R2c_not R2c_ok R2c_tr'_ge_tr)\n\ndefinition RH :: \"('t::ordered_cancel_monoid_diff,'\\) hrel_rp \\ ('t,'\\) hrel_rp\" (\"\\<^bold>R\")\nwhere [upred_defs]: \"RH(P) = R1(R2c(R3c(P)))\"\n\ndefinition RHS :: \"('s,'t::ordered_cancel_monoid_diff,'\\) hrel_rsp \\ ('s,'t,'\\) hrel_rsp\" (\"\\<^bold>R\\<^sub>s\")\nwhere [upred_defs]: \"RHS(P) = R1(R2c(R3h(P)))\"\n\ndefinition RD :: \"('t::ordered_cancel_monoid_diff,'\\) hrel_rp \\ ('t,'\\) hrel_rp\"\nwhere [upred_defs]: \"RD(P) = RD1(RD2(RP(P)))\"\n\ndefinition SRD :: \"('s,'t::ordered_cancel_monoid_diff,'\\) hrel_rsp \\ ('s,'t,'\\) hrel_rsp\"\nwhere [upred_defs]: \"SRD(P) = RD1(RD2(RHS(P)))\"\n\nlemma RH_comp: \"RH = R1 \\ R2c \\ R3c\"\n by (auto simp add: RH_def)\n\nlemma RHS_comp: \"RHS = R1 \\ R2c \\ R3h\"\n by (auto simp add: RHS_def)\n\nlemma RD_comp: \"RD = RD1 \\ RD2 \\ RP\"\n by (auto simp add: RD_def)\n\nlemma SRD_comp: \"SRD = RD1 \\ RD2 \\ RHS\"\n by (auto simp add: SRD_def)\n\nlemma RH_idem: \"\\<^bold>R(\\<^bold>R(P)) = \\<^bold>R(P)\"\n by (simp add: R1_R2c_commute R1_R3c_commute R1_idem R2c_R3c_commute R2c_idem R3c_idem RH_def)\n\nlemma RH_Idempotent: \"Idempotent \\<^bold>R\"\n by (simp add: Idempotent_def RH_idem)\n\nlemma RH_Monotonic: \"Monotonic \\<^bold>R\"\n by (metis Monotonic_def R1_Monotonic R2c_Monotonic R3c_mono RH_def)\n\nlemma RH_Continuous: \"Continuous \\<^bold>R\"\n by (simp add: Continuous_comp R1_Continuous R2c_Continuous R3c_Continuous RH_comp)\n\nlemma RHS_idem: \"\\<^bold>R\\<^sub>s(\\<^bold>R\\<^sub>s(P)) = \\<^bold>R\\<^sub>s(P)\"\n by (simp add: R1_R2c_is_R2 R1_R3h_commute R2_idem R2c_R3h_commute R3h_idem RHS_def)\n\nlemma RHS_Idempotent: \"Idempotent \\<^bold>R\\<^sub>s\"\n by (simp add: Idempotent_def RHS_idem)\n\nlemma RHS_Monotonic: \"Monotonic \\<^bold>R\\<^sub>s\"\n by (simp add: Monotonic_def R1_R2c_is_R2 R2_mono R3h_mono RHS_def)\n\nlemma RHS_mono: \"P \\ Q \\ \\<^bold>R\\<^sub>s(P) \\ \\<^bold>R\\<^sub>s(Q)\"\n using Monotonic_def RHS_Monotonic by blast\n\nlemma RHS_Continuous: \"Continuous \\<^bold>R\\<^sub>s\"\n by (simp add: Continuous_comp R1_Continuous R2c_Continuous R3h_Continuous RHS_comp)\n\nlemma RHS_inf: \"\\<^bold>R\\<^sub>s(P \\ Q) = \\<^bold>R\\<^sub>s(P) \\ \\<^bold>R\\<^sub>s(Q)\"\n using Continuous_Disjunctous Disjunctuous_def RHS_Continuous by auto\n\nlemma RHS_INF:\n \"A \\ {} \\ \\<^bold>R\\<^sub>s(\\ i \\ A \\ P(i)) = (\\ i \\ A \\ \\<^bold>R\\<^sub>s(P(i)))\"\n by (simp add: RHS_def R3h_UINF R2c_USUP R1_USUP)\n\nlemma RHS_cond: \"\\<^bold>R\\<^sub>s(P \\ b \\ Q) = (\\<^bold>R\\<^sub>s(P) \\ R2c b \\ \\<^bold>R\\<^sub>s(Q))\"\n by (simp add: RHS_def R3h_cond R2c_condr R1_cond)\n\nlemma RD_alt_def: \"RD(P) = RD1(RD2(\\<^bold>R(P)))\"\n by (simp add: R3c_via_RD1_R3 RD1_R1_commute RD1_R2c_commute RD1_R3c_commute RD1_RD2_commute RH_def RD_def RP_def)\n\nlemma RD1_RH_commute: \"RD1(\\<^bold>R(P)) = \\<^bold>R(RD1(P))\"\n by (simp add: RD1_R1_commute RD1_R2c_commute RD1_R3c_commute RH_def)\n\nlemma RD2_RH_commute: \"RD2(\\<^bold>R(P)) = \\<^bold>R(RD2(P))\"\n by (metis R1_H2_commute R2c_H2_commute RD2_R3c_commute RD2_def RH_def)\n\nlemma RD_idem: \"RD(RD(P)) = RD(P)\"\n by (simp add: RD_alt_def RD1_RH_commute RD2_RH_commute RD1_RD2_commute RD2_idem RD1_idem RH_idem)\n\nlemma RD_Monotonic: \"Monotonic RD\"\n by (metis Monotonic_def RD1_mono RD2_Monotonic RD_alt_def RH_Monotonic)\n\nlemma RD_Continuous: \"Continuous RD\"\n by (simp add: Continuous_comp RD1_Continuous RD2_Continuous RD_comp RP_Continuous)\n\nlemma R3_RD_RP: \"R3(RD(P)) = RP(RD1(RD2(P)))\"\n by (metis (no_types, lifting) R1_R2c_is_R2 R2_R3_commute R3_cancels_R3c RD1_RH_commute RD2_RH_commute RD_alt_def RH_def RP_def)\n\nlemma RD1_RHS_commute: \"RD1(\\<^bold>R\\<^sub>s(P)) = \\<^bold>R\\<^sub>s(RD1(P))\"\n by (simp add: RD1_R1_commute RD1_R2c_commute RD1_R3h_commute RHS_def)\n\nlemma RD2_RHS_commute: \"RD2(\\<^bold>R\\<^sub>s(P)) = \\<^bold>R\\<^sub>s(RD2(P))\"\n by (metis R1_H2_commute R2c_H2_commute RD2_R3h_commute RD2_def RHS_def)\n\nlemma SRD_idem: \"SRD(SRD(P)) = SRD(P)\"\n by (simp add: RD1_RD2_commute RD1_RHS_commute RD1_idem RD2_RHS_commute RD2_idem RHS_idem SRD_def)\n\nlemma SRD_Monotonic: \"Monotonic SRD\"\n by (metis Monotonic_def RD1_mono RD2_Monotonic RHS_Monotonic SRD_def)\n\nlemma SRD_Continuous: \"Continuous SRD\"\n by (simp add: Continuous_comp RD1_Continuous RD2_Continuous RHS_Continuous SRD_comp)\n\ntypedecl RDES\ntypedecl SRDES\n\nabbreviation \"RDES \\ UTHY(RDES, ('t::ordered_cancel_monoid_diff,'\\) rp)\"\nabbreviation \"SRDES \\ UTHY(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp)\"\n\noverloading\n rdes_hcond == \"utp_hcond :: (RDES, ('t::ordered_cancel_monoid_diff,'\\) rp) uthy \\ (('t,'\\) rp \\ ('t,'\\) rp) health\"\n srdes_hcond == \"utp_hcond :: (SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ (('s,'t,'\\) rsp \\ ('s,'t,'\\) rsp) health\"\nbegin\n definition rdes_hcond :: \"(RDES, ('t::ordered_cancel_monoid_diff,'\\) rp) uthy \\ (('t,'\\) rp \\ ('t,'\\) rp) health\" where\n [upred_defs]: \"rdes_hcond T = RD\"\n definition srdes_hcond :: \"(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ (('s,'t,'\\) rsp \\ ('s,'t,'\\) rsp) health\" where\n [upred_defs]: \"srdes_hcond T = SRD\"\nend\n\ninterpretation rdes_theory: utp_theory \"UTHY(RDES, ('t::ordered_cancel_monoid_diff,'\\) rp)\"\n by (unfold_locales, simp_all add: rdes_hcond_def RD_idem)\n\ninterpretation rdes_theory_continuous: utp_theory_continuous \"UTHY(RDES, ('t::ordered_cancel_monoid_diff,'\\) rp)\"\n rewrites \"\\ P. P \\ carrier (uthy_order RDES) \\ P is RD\"\n and \"carrier (uthy_order RDES) \\ carrier (uthy_order RDES) \\ \\RD\\\\<^sub>H \\ \\RD\\\\<^sub>H\"\n and \"le (uthy_order RDES) = op \\\"\n and \"eq (uthy_order RDES) = op =\"\n by (unfold_locales, simp_all add: rdes_hcond_def RD_Continuous)\n\ninterpretation rdes_rea_galois:\n galois_connection \"(RDES \\\\RD1 \\ RD2,R3\\\\ REA)\"\nproof (simp add: mk_conn_def, rule galois_connectionI', simp_all add: utp_partial_order rdes_hcond_def rea_hcond_def)\n show \"R3 \\ \\RD\\\\<^sub>H \\ \\RP\\\\<^sub>H\"\n by (metis (no_types, lifting) Healthy_def' Pi_I R3_RD_RP RP_idem mem_Collect_eq)\n show \"RD1 \\ RD2 \\ \\RP\\\\<^sub>H \\ \\RD\\\\<^sub>H\"\n by (simp add: Pi_iff Healthy_def, metis RD_def RD_idem)\n show \"isotone (utp_order RD) (utp_order RP) R3\"\n by (simp add: R3_Monotonic isotone_utp_orderI)\n show \"isotone (utp_order RP) (utp_order RD) (RD1 \\ RD2)\"\n by (simp add: Monotonic_comp RD1_Monotonic RD2_Monotonic isotone_utp_orderI)\n fix P :: \"('a, 'b) hrel_rp\"\n assume \"P is RD\"\n thus \"P \\ RD1 (RD2 (R3 P))\"\n by (metis Healthy_if R3_RD_RP RD_def RP_idem eq_iff)\nnext\n fix P :: \"('a, 'b) hrel_rp\"\n assume a: \"P is RP\"\n thus \"R3 (RD1 (RD2 P)) \\ P\"\n proof -\n have \"R3 (RD1 (RD2 P)) = RP (RD1 (RD2(P)))\"\n by (metis Healthy_if R3_RD_RP RD_def a)\n moreover have \"RD1(RD2(P)) \\ P\"\n by (rel_auto)\n ultimately show ?thesis\n by (metis Healthy_if RP_mono a)\n qed\nqed\n\ninterpretation rdes_rea_retract:\n retract \"(RDES \\\\RD1 \\ RD2,R3\\\\ REA)\"\n by (unfold_locales, simp_all add: mk_conn_def utp_partial_order rdes_hcond_def rea_hcond_def)\n (metis Healthy_if R3_RD_RP RD_def RP_idem eq_refl)\n\ninterpretation srdes_theory: utp_theory \"UTHY(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp)\"\n by (unfold_locales, simp_all add: srdes_hcond_def SRD_idem)\n\ninterpretation srdes_theory_continuous: utp_theory_continuous \"UTHY(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp)\"\n rewrites \"\\ P. P \\ carrier (uthy_order SRDES) \\ P is SRD\"\n and \"P is \\\\<^bsub>SRDES\\<^esub> \\ P is SRD\"\n and \"carrier (uthy_order SRDES) \\ carrier (uthy_order SRDES) \\ \\SRD\\\\<^sub>H \\ \\SRD\\\\<^sub>H\"\n and \"le (uthy_order SRDES) = op \\\"\n and \"eq (uthy_order SRDES) = op =\"\n by (unfold_locales, simp_all add: srdes_hcond_def SRD_Continuous)\n\nlemma SRD_healths:\n assumes \"P is SRD\"\n shows \"P is R1\" \"P is R2\" \"P is R3h\" \"P is RD1\" \"P is RD2\"\n apply (metis Healthy_def R1_idem RD1_RHS_commute RD2_RHS_commute RHS_def SRD_def assms)\n apply (metis Healthy_def R1_R2c_is_R2 R2_idem RD1_RHS_commute RD2_RHS_commute RHS_def SRD_def assms)\n apply (metis Healthy_def R1_R3h_commute R2c_R3h_commute R3h_idem RD1_R3h_commute RD2_R3h_commute RHS_def SRD_def assms)\n apply (metis Healthy_def' RD1_idem SRD_def assms)\n apply (metis Healthy_def' RD1_RD2_commute RD2_idem SRD_def assms)\ndone\n\nlemma SRD_intro:\n assumes \"P is R1\" \"P is R2\" \"P is R3h\" \"P is RD1\" \"P is RD2\"\n shows \"P is SRD\"\n by (metis Healthy_def R1_R2c_is_R2 RHS_def SRD_def assms(2) assms(3) assms(4) assms(5))\n\nlemma R2_skip_rea: \"R2(II\\<^sub>r) = II\\<^sub>r\"\n by (metis R1_R2c_is_R2 R1_skip_rea R2c_skip_rea)\n\nlemma skip_srea_form: \"II\\<^sub>R = ((\\ $st \\ II) \\ $wait \\ II) \\ $ok \\ R1(true)\"\n by (rel_auto)\n \nlemma R2c_skip_srea: \"R2c(II\\<^sub>R) = II\\<^sub>R\"\n apply (rel_auto) using minus_zero_eq by blast+\n\nlemma R3h_form: \"R3h(P) = II\\<^sub>R \\ $wait \\ P\"\n by (rel_auto)\n \nlemma R3c_semir_form:\n \"(R3c(P) ;; R3c(R1(Q))) = R3c(P ;; R3c(R1(Q)))\"\n by (rel_simp, safe, auto intro: order_trans)\n\nlemma R3h_semir_form:\n \"(R3h(P) ;; R3h(R1(Q))) = R3h(P ;; R3h(R1(Q)))\"\n by (rel_simp, safe, auto intro: order_trans, blast+)\n\nlemma R3c_seq_closure:\n assumes \"P is R3c\" \"Q is R3c\" \"Q is R1\"\n shows \"(P ;; Q) is R3c\"\n by (metis Healthy_def' R3c_semir_form assms)\n\nlemma R3h_seq_closure:\n assumes \"P is R3h\" \"Q is R3h\" \"Q is R1\"\n shows \"(P ;; Q) is R3h\"\n by (metis Healthy_def' R3h_semir_form assms)\n\nlemma R3c_R3_left_seq_closure:\n assumes \"P is R3\" \"Q is R3c\"\n shows \"(P ;; Q) is R3c\"\nproof -\n have \"(P ;; Q) = ((P ;; Q)\\true/$wait\\ \\ $wait \\ (P ;; Q))\"\n by (metis cond_var_split cond_var_subst_right in_var_uvar wait_vwb_lens)\n also have \"... = (((II \\ $wait \\ P) ;; Q)\\true/$wait\\ \\ $wait \\ (P ;; Q))\"\n by (metis Healthy_def' R3_def assms(1))\n also have \"... = ((II\\true/$wait\\ ;; Q) \\ $wait \\ (P ;; Q))\"\n by (subst_tac)\n also have \"... = (((II \\ $wait\\) ;; Q) \\ $wait \\ (P ;; Q))\"\n by (metis (no_types, lifting) cond_def conj_pos_var_subst seqr_pre_var_out skip_var utp_pred.inf_left_idem wait_vwb_lens)\n also have \"... = ((II\\true/$wait\\\\ ;; Q\\true/$wait\\) \\ $wait \\ (P ;; Q))\"\n by (metis seqr_pre_transfer seqr_right_one_point true_alt_def uovar_convr upred_eq_true utp_rel.unrest_ouvar vwb_lens_mwb wait_vwb_lens)\n also have \"... = ((II\\true/$wait\\\\ ;; (II\\<^sub>r \\ $wait \\ Q)\\true/$wait\\) \\ $wait \\ (P ;; Q))\"\n by (metis Healthy_def' R3c_def assms(2))\n also have \"... = ((II\\true/$wait\\\\ ;; II\\<^sub>r\\true/$wait\\) \\ $wait \\ (P ;; Q))\"\n by (subst_tac)\n also have \"... = (((II \\ $wait\\) ;; II\\<^sub>r) \\ $wait \\ (P ;; Q))\"\n by (metis seqr_pre_transfer seqr_right_one_point true_alt_def uovar_convr upred_eq_true utp_rel.unrest_ouvar vwb_lens_mwb wait_vwb_lens)\n also have \"... = ((II ;; II\\<^sub>r) \\ $wait \\ (P ;; Q))\"\n by (simp add: cond_def seqr_pre_transfer utp_rel.unrest_ouvar)\n also have \"... = (II\\<^sub>r \\ $wait \\ (P ;; Q))\"\n by simp\n also have \"... = R3c(P ;; Q)\"\n by (simp add: R3c_def)\n finally show ?thesis\n by (simp add: Healthy_def')\nqed\n\nlemma R3c_cases: \"R3c(P) = ((II \\ $ok \\ R1(true)) \\ $wait \\ P)\"\n by (rel_auto)\n\nlemma R3h_cases: \"R3h(P) = (((\\ $st \\ II) \\ $ok \\ R1(true)) \\ $wait \\ P)\"\n by (rel_auto)\n\nlemma R3c_subst_wait: \"R3c(P) = R3c(P \\<^sub>f)\"\n by (simp add: R3c_def cond_var_subst_right)\n\nlemma R3h_subst_wait: \"R3h(P) = R3h(P \\<^sub>f)\"\n by (simp add: R3h_cases cond_var_subst_right)\n\nlemma skip_rea_R1_lemma: \"II\\<^sub>r = R1($ok \\ II)\"\n by (rel_auto)\n\nsubsection {* Reactive design form *}\n\nlemma RD1_algebraic_intro:\n assumes\n \"P is R1\" \"(R1(true\\<^sub>h) ;; P) = R1(true\\<^sub>h)\" \"(II\\<^sub>r ;; P) = P\"\n shows \"P is RD1\"\nproof -\n have \"P = (II\\<^sub>r ;; P)\"\n by (simp add: assms(3))\n also have \"... = (R1($ok \\ II) ;; P)\"\n by (simp add: skip_rea_R1_lemma)\n also have \"... = (((\\ $ok \\ R1(true)) ;; P) \\ P)\"\n by (metis (no_types, lifting) R1_def seqr_left_unit seqr_or_distl skip_rea_R1_lemma skip_rea_def utp_pred.inf_top_left utp_pred.sup_commute)\n also have \"... = (((R1(\\ $ok) ;; R1(true\\<^sub>h)) ;; P) \\ P)\"\n by (rel_auto, metis order.trans)\n also have \"... = ((R1(\\ $ok) ;; (R1(true\\<^sub>h) ;; P)) \\ P)\"\n by (simp add: seqr_assoc)\n also have \"... = ((R1(\\ $ok) ;; R1(true\\<^sub>h)) \\ P)\"\n by (simp add: assms(2))\n also have \"... = (R1(\\ $ok) \\ P)\"\n by (rel_auto)\n also have \"... = RD1(P)\"\n by (rel_auto)\n finally show ?thesis\n by (simp add: Healthy_def)\nqed\n\ntheorem RD1_left_zero:\n assumes \"P is R1\" \"P is RD1\"\n shows \"(R1(true) ;; P) = R1(true)\"\nproof -\n have \"(R1(true) ;; R1(RD1(P))) = R1(true)\"\n by (rel_auto)\n thus ?thesis\n by (simp add: Healthy_if assms(1) assms(2))\nqed\n\ntheorem RD1_left_unit:\n assumes \"P is R1\" \"P is RD1\"\n shows \"(II\\<^sub>r ;; P) = P\"\nproof -\n have \"(II\\<^sub>r ;; R1(RD1(P))) = R1(RD1(P))\"\n by (rel_auto)\n thus ?thesis\n by (simp add: Healthy_if assms(1) assms(2))\nqed\n\nlemma RD1_alt_def:\n assumes \"P is R1\"\n shows \"RD1(P) = (P \\ $ok \\ R1(true))\"\nproof -\n have \"RD1(R1(P)) = (R1(P) \\ $ok \\ R1(true))\"\n by (rel_auto)\n thus ?thesis\n by (simp add: Healthy_if assms)\nqed\n\ntheorem RD1_algebraic:\n assumes \"P is R1\"\n shows \"P is RD1 \\ (R1(true\\<^sub>h) ;; P) = R1(true\\<^sub>h) \\ (II\\<^sub>r ;; P) = P\"\n using RD1_algebraic_intro RD1_left_unit RD1_left_zero assms by blast\n\nlemma RD1_reactive_design: \"RD1(\\<^bold>R(P \\ Q)) = \\<^bold>R(P \\ Q)\"\n by (rel_auto)\n\nlemma RD2_reactive_design:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"RD2(\\<^bold>R(P \\ Q)) = \\<^bold>R(P \\ Q)\"\n using assms\n by (metis H2_design RD2_RH_commute RD2_def)\n\nlemma RD1_st_reactive_design: \"RD1(\\<^bold>R\\<^sub>s(P \\ Q)) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (rel_auto)\n\nlemma RD2_st_reactive_design:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"RD2(\\<^bold>R\\<^sub>s(P \\ Q)) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n using assms\n by (metis H2_design RD2_RHS_commute RD2_def)\n\nlemma wait_false_design:\n \"(P \\ Q) \\<^sub>f = ((P \\<^sub>f) \\ (Q \\<^sub>f))\"\n by (rel_auto)\n\nlemma RD_RH_design_form:\n \"RD(P) = \\<^bold>R((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f)\"\nproof -\n have \"RD(P) = RD1(RD2(R1(R2c(R3c(P)))))\"\n by (simp add: RD_alt_def RH_def)\n also have \"... = RD1(H2(R1(R2s(R3c(P)))))\"\n by (simp add: R1_R2s_R2c RD2_def)\n also have \"... = RD1(R1(H2(R2s(R3c(P)))))\"\n by (simp add: R1_H2_commute)\n also have \"... = R1(H1(R1(H2(R2s(R3c(P))))))\"\n by (simp add: R1_idem RD1_via_R1)\n also have \"... = R1(H1(H2(R2s(R3c(R1(P))))))\"\n by (simp add: R1_H2_commute R1_R2c_commute R1_R2s_R2c R1_R3c_commute RD1_via_R1)\n also have \"... = R1(R2s(H1(H2(R3c(R1(P))))))\"\n by (simp add: R2s_H1_commute R2s_H2_commute)\n also have \"... = R1(R2s(H1(R3c(H2(R1(P))))))\"\n by (metis RD2_R3c_commute RD2_def)\n also have \"... = R2(R1(H1(R3c(H2(R1(P))))))\"\n by (metis R1_R2_commute R1_idem R2_def)\n also have \"... = R2(R3c(R1(\\<^bold>H(R1(P)))))\"\n by (simp add: R1_R3c_commute RD1_R3c_commute RD1_via_R1)\n also have \"... = RH(\\<^bold>H(R1(P)))\"\n by (metis R1_R2s_R2c R1_R3c_commute R2_R1_form RH_def)\n also have \"... = RH(\\<^bold>H(P))\"\n by (simp add: R1_H2_commute R1_R2c_commute R1_R3c_commute R1_idem RD1_via_R1 RH_def)\n also have \"... = RH((\\ P\\<^sup>f) \\ P\\<^sup>t)\"\n by (simp add: H1_H2_eq_design)\n also have \"... = \\<^bold>R((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f)\"\n by (metis (no_types, lifting) R3c_subst_wait RH_def subst_not wait_false_design)\n finally show ?thesis .\nqed\n\nlemma RD_reactive_design:\n assumes \"P is RD\"\n shows \"\\<^bold>R((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f) = P\"\n by (metis RD_RH_design_form Healthy_def' assms)\n\nlemma RD_RH_design:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"RD(\\<^bold>R(P \\ Q)) = \\<^bold>R(P \\ Q)\"\n by (simp add: RD1_reactive_design RD2_reactive_design RD_alt_def RH_idem assms(1) assms(2))\n\nlemma RH_design_is_RD:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"\\<^bold>R(P \\ Q) is RD\"\n by (simp add: RD_RH_design Healthy_def' assms(1) assms(2))\n\nlemma SRD_RH_design_form:\n \"SRD(P) = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f)\"\nproof -\n have \"SRD(P) = R1(R2c(R3h(RD1(RD2(R1(P))))))\"\n by (metis (no_types, lifting) R1_H2_commute R1_R2c_commute R1_R3h_commute R1_idem R2c_H2_commute RD1_R1_commute RD1_R2c_commute RD1_R3h_commute RD2_R3h_commute RD2_def RHS_def SRD_def)\n also have \"... = R1(R2s(R3h(\\<^bold>H(P))))\"\n by (metis (no_types, lifting) R1_H2_commute R1_R2c_is_R2 R1_R3h_commute R2_R1_form RD1_via_R1 RD2_def)\n also have \"... = \\<^bold>R\\<^sub>s(\\<^bold>H(P))\"\n by (simp add: R1_R2s_R2c RHS_def)\n also have \"... = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f) \\ P\\<^sup>t)\"\n by (simp add: H1_H2_eq_design)\n also have \"... = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f)\"\n by (metis (no_types, lifting) R3h_subst_wait RHS_def subst_not wait_false_design)\n finally show ?thesis .\nqed\n\nlemma SRD_reactive_design:\n assumes \"P is SRD\"\n shows \"\\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f) = P\"\n by (metis SRD_RH_design_form Healthy_def' assms)\n\nlemma SRD_RH_design:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"SRD(\\<^bold>R\\<^sub>s(P \\ Q)) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (simp add: RD1_st_reactive_design RD2_st_reactive_design RHS_idem SRD_def assms(1) assms(2))\n\nlemma RHS_design_is_SRD:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q) is SRD\"\n by (simp add: Healthy_def' SRD_RH_design assms(1) assms(2))\n\nlemma SRD_RHS_H1_H2: \"SRD(P) = \\<^bold>R\\<^sub>s(\\<^bold>H(P))\"\n by (metis (no_types, lifting) H1_H2_eq_design R3h_subst_wait RHS_def SRD_RH_design_form subst_not wait_false_design)\n\nsubsection {* Reactive design composition laws *}\n\ntheorem R1_design_composition:\n fixes P Q :: \"('t::ordered_cancel_monoid_diff,'\\,'\\) rel_rp\"\n and R S :: \"('t,'\\,'\\) rel_rp\"\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows\n \"(R1(P \\ Q) ;; R1(R \\ S)) =\n R1((\\ (R1(\\ P) ;; R1(true)) \\ \\ (R1(Q) ;; R1(\\ R))) \\ (R1(Q) ;; R1(S)))\"\nproof -\n have \"(R1(P \\ Q) ;; R1(R \\ S)) = (\\<^bold>\\ ok\\<^sub>0 \\ (R1(P \\ Q))\\\\ok\\<^sub>0\\/$ok\\\\ ;; (R1(R \\ S))\\\\ok\\<^sub>0\\/$ok\\)\"\n using seqr_middle ok_vwb_lens by blast\n also from assms have \"... = (\\<^bold>\\ ok\\<^sub>0 \\ R1(($ok \\ P) \\ (\\ok\\<^sub>0\\ \\ Q)) ;; R1((\\ok\\<^sub>0\\ \\ R) \\ ($ok\\ \\ S)))\"\n by (simp add: design_def R1_def usubst unrest)\n also from assms have \"... = ((R1(($ok \\ P) \\ (true \\ Q)) ;; R1((true \\ R) \\ ($ok\\ \\ S)))\n \\ (R1(($ok \\ P) \\ (false \\ Q)) ;; R1((false \\ R) \\ ($ok\\ \\ S))))\"\n by (simp add: false_alt_def true_alt_def)\n also from assms have \"... = ((R1(($ok \\ P) \\ Q) ;; R1(R \\ ($ok\\ \\ S)))\n \\ (R1(\\ ($ok \\ P)) ;; R1(true)))\"\n by simp\n also from assms have \"... = ((R1(\\ $ok \\ \\ P \\ Q) ;; R1(\\ R \\ ($ok\\ \\ S)))\n \\ (R1(\\ $ok \\ \\ P) ;; R1(true)))\"\n by (simp add: impl_alt_def utp_pred.sup.assoc)\n also from assms have \"... = (((R1(\\ $ok \\ \\ P) \\ R1(Q)) ;; R1(\\ R \\ ($ok\\ \\ S)))\n \\ (R1(\\ $ok \\ \\ P) ;; R1(true)))\"\n by (simp add: R1_disj utp_pred.disj_assoc)\n also from assms have \"... = ((R1(\\ $ok \\ \\ P) ;; R1(\\ R \\ ($ok\\ \\ S)))\n \\ (R1(Q) ;; R1(\\ R \\ ($ok\\ \\ S)))\n \\ (R1(\\ $ok \\ \\ P) ;; R1(true)))\"\n by (simp add: seqr_or_distl utp_pred.sup.assoc)\n also from assms have \"... = ((R1(Q) ;; R1(\\ R \\ ($ok\\ \\ S)))\n \\ (R1(\\ $ok \\ \\ P) ;; R1(true)))\"\n by (rel_blast)\n also from assms have \"... = ((R1(Q) ;; (R1(\\ R) \\ R1(S) \\ $ok\\))\n \\ (R1(\\ $ok \\ \\ P) ;; R1(true)))\"\n by (simp add: R1_disj R1_extend_conj utp_pred.inf_commute)\n also have \"... = ((R1(Q) ;; (R1(\\ R) \\ R1(S) \\ $ok\\))\n \\ ((R1(\\ $ok) :: ('t,'\\,'\\) rel_rp) ;; R1(true))\n \\ (R1(\\ P) ;; R1(true)))\"\n by (simp add: R1_disj seqr_or_distl)\n also have \"... = ((R1(Q) ;; (R1(\\ R) \\ R1(S) \\ $ok\\))\n \\ (R1(\\ $ok))\n \\ (R1(\\ P) ;; R1(true)))\"\n proof -\n have \"((R1(\\ $ok) :: ('t,'\\,'\\) rel_rp) ;; R1(true)) =\n (R1(\\ $ok) :: ('t,'\\,'\\) rel_rp)\"\n by (rel_auto)\n thus ?thesis\n by simp\n qed\n also have \"... = ((R1(Q) ;; (R1(\\ R) \\ (R1(S \\ $ok\\))))\n \\ R1(\\ $ok)\n \\ (R1(\\ P) ;; R1(true)))\"\n by (simp add: R1_extend_conj)\n also have \"... = ( (R1(Q) ;; (R1 (\\ R)))\n \\ (R1(Q) ;; (R1(S \\ $ok\\)))\n \\ R1(\\ $ok)\n \\ (R1(\\ P) ;; R1(true)))\"\n by (simp add: seqr_or_distr utp_pred.sup.assoc)\n also have \"... = R1( (R1(Q) ;; (R1 (\\ R)))\n \\ (R1(Q) ;; (R1(S \\ $ok\\)))\n \\ (\\ $ok)\n \\ (R1(\\ P) ;; R1(true)))\"\n by (simp add: R1_disj R1_seqr)\n also have \"... = R1( (R1(Q) ;; (R1 (\\ R)))\n \\ ((R1(Q) ;; R1(S)) \\ $ok\\)\n \\ (\\ $ok)\n \\ (R1(\\ P) ;; R1(true)))\"\n by (rel_blast)\n also have \"... = R1(\\($ok \\ \\ (R1(\\ P) ;; R1(true)) \\ \\ (R1(Q) ;; (R1 (\\ R))))\n \\ ((R1(Q) ;; R1(S)) \\ $ok\\))\"\n by (rel_blast)\n also have \"... = R1(($ok \\ \\ (R1(\\ P) ;; R1(true)) \\ \\ (R1(Q) ;; (R1 (\\ R))))\n \\ ($ok\\ \\ (R1(Q) ;; R1(S))))\"\n by (simp add: impl_alt_def utp_pred.inf_commute)\n also have \"... = R1((\\ (R1(\\ P) ;; R1(true)) \\ \\ (R1(Q) ;; R1(\\ R))) \\ (R1(Q) ;; R1(S)))\"\n by (simp add: design_def)\n finally show ?thesis .\nqed\n\ndefinition [upred_defs]: \"R3c_pre(P) = (true \\ $wait \\ P)\"\n\ndefinition [upred_defs]: \"R3c_post(P) = (\\II\\\\<^sub>D \\ $wait \\ P)\"\n\ndefinition [upred_defs]: \"R3h_post(P) = ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ P)\"\n\nlemma R3c_pre_conj: \"R3c_pre(P \\ Q) = (R3c_pre(P) \\ R3c_pre(Q))\"\n by (rel_auto)\n\nlemma R3c_pre_seq:\n \"(true ;; Q) = true \\ R3c_pre(P ;; Q) = (R3c_pre(P) ;; Q)\"\n by (rel_auto)\n\nlemma R2s_st'_eq_st:\n \"R2s($st\\ =\\<^sub>u $st) = ($st\\ =\\<^sub>u $st)\"\n by (rel_auto)\n\nlemma R2c_st'_eq_st:\n \"R2c($st\\ =\\<^sub>u $st) = ($st\\ =\\<^sub>u $st)\"\n by (rel_auto)\n\nlemma R2s_design: \"R2s(P \\ Q) = (R2s(P) \\ R2s(Q))\"\n by (simp add: R2s_def design_def usubst)\n\nlemma R2c_design: \"R2c(P \\ Q) = (R2c(P) \\ R2c(Q))\"\n by (simp add: design_def impl_alt_def R2c_disj R2c_not R2c_ok R2c_and R2c_ok')\n\nlemma R1_R3c_design:\n \"R1(R3c(P \\ Q)) = R1(R3c_pre(P) \\ R3c_post(Q))\"\n by (rel_auto)\n\nlemma R1_R3h_design:\n \"R1(R3h(P \\ Q)) = R1(R3c_pre(P) \\ R3h_post(Q))\"\n by (rel_auto)\n\nlemma unrest_ok_R2s [unrest]: \"$ok \\ P \\ $ok \\ R2s(P)\"\n by (simp add: R2s_def unrest)\n\nlemma unrest_ok'_R2s [unrest]: \"$ok\\ \\ P \\ $ok\\ \\ R2s(P)\"\n by (simp add: R2s_def unrest)\n\nlemma unrest_ok_R2c [unrest]: \"$ok \\ P \\ $ok \\ R2c(P)\"\n by (simp add: R2c_def unrest)\n\nlemma unrest_ok'_R2c [unrest]: \"$ok\\ \\ P \\ $ok\\ \\ R2c(P)\"\n by (simp add: R2c_def unrest)\n\nlemma unrest_ok_R3c_pre [unrest]: \"$ok \\ P \\ $ok \\ R3c_pre(P)\"\n by (simp add: R3c_pre_def cond_def unrest)\n\nlemma unrest_ok'_R3c_pre [unrest]: \"$ok\\ \\ P \\ $ok\\ \\ R3c_pre(P)\"\n by (simp add: R3c_pre_def cond_def unrest)\n\nlemma unrest_ok_R3c_post [unrest]: \"$ok \\ P \\ $ok \\ R3c_post(P)\"\n by (simp add: R3c_post_def cond_def unrest)\n\nlemma unrest_ok_R3c_post' [unrest]: \"$ok\\ \\ P \\ $ok\\ \\ R3c_post(P)\"\n by (simp add: R3c_post_def cond_def unrest)\n\nlemma unrest_ok_R3h_post [unrest]: \"$ok \\ P \\ $ok \\ R3h_post(P)\"\n by (simp add: R3h_post_def cond_def unrest)\n\nlemma unrest_ok_R3h_post' [unrest]: \"$ok\\ \\ P \\ $ok\\ \\ R3h_post(P)\"\n by (simp add: R3h_post_def cond_def unrest)\n\nlemma R3c_R1_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows \"(R3c(R1(P \\ Q)) ;; R3c(R1(R \\ S))) =\n R3c(R1((\\ (R1(\\ P) ;; R1(true)) \\ \\ ((R1(Q) \\ \\ $wait\\) ;; R1(\\ R)))\n \\ (R1(Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1(S)))))\"\nproof -\n have 1:\"(\\ (R1 (\\ R3c_pre P) ;; R1 true)) = (R3c_pre (\\ (R1 (\\ P) ;; R1 true)))\"\n by (rel_auto)\n have 2:\"(\\ (R1 (R3c_post Q) ;; R1 (\\ R3c_pre R))) = R3c_pre(\\ ((R1 Q \\ \\ $wait\\) ;; R1 (\\ R)))\"\n by (rel_auto)\n have 3:\"(R1 (R3c_post Q) ;; R1 (R3c_post S)) = R3c_post (R1 Q ;; (\\II\\\\<^sub>D \\ $wait \\ R1 S))\"\n by (rel_auto)\n show ?thesis\n apply (simp add: R3c_semir_form R1_R3c_commute[THEN sym] R1_R3c_design unrest )\n apply (subst R1_design_composition)\n apply (simp_all add: unrest assms R3c_pre_conj 1 2 3)\n done\nqed\n\nlemma R3h_R1_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows \"(R3h(R1(P \\ Q)) ;; R3h(R1(R \\ S))) =\n R3h(R1((\\ (R1(\\ P) ;; R1(true)) \\ \\ ((R1(Q) \\ \\ $wait\\) ;; R1(\\ R)))\n \\ (R1(Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1(S)))))\"\nproof -\n have 1:\"(\\ (R1 (\\ R3c_pre P) ;; R1 true)) = (R3c_pre (\\ (R1 (\\ P) ;; R1 true)))\"\n by (rel_auto, blast+)\n have 2:\"(\\ (R1 (R3h_post Q) ;; R1 (\\ R3c_pre R))) = R3c_pre(\\ ((R1 Q \\ \\ $wait\\) ;; R1 (\\ R)))\"\n by (rel_auto, blast+)\n have 3:\"(R1 (R3h_post Q) ;; R1 (R3h_post S)) = R3h_post (R1 Q ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 S))\"\n by (rel_auto, blast+)\n show ?thesis\n apply (simp add: R3h_semir_form R1_R3h_commute[THEN sym] R1_R3h_design unrest )\n apply (subst R1_design_composition)\n apply (simp_all add: unrest assms R3c_pre_conj 1 2 3)\n done\nqed\n\nlemma R1_des_lift_skip: \"R1(\\II\\\\<^sub>D) = \\II\\\\<^sub>D\"\n by (rel_auto)\n\nlemma R2s_subst_wait_true [usubst]:\n \"(R2s(P))\\true/$wait\\ = R2s(P\\true/$wait\\)\"\n by (simp add: R2s_def usubst unrest)\n\nlemma R2s_subst_wait'_true [usubst]:\n \"(R2s(P))\\true/$wait\\\\ = R2s(P\\true/$wait\\\\)\"\n by (simp add: R2s_def usubst unrest)\n\nlemma R2_subst_wait_true [usubst]:\n \"(R2(P))\\true/$wait\\ = R2(P\\true/$wait\\)\"\n by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait'_true [usubst]:\n \"(R2(P))\\true/$wait\\\\ = R2(P\\true/$wait\\\\)\"\n by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait_false [usubst]:\n \"(R2(P))\\false/$wait\\ = R2(P\\false/$wait\\)\"\n by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait'_false [usubst]:\n \"(R2(P))\\false/$wait\\\\ = R2(P\\false/$wait\\\\)\"\n by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_des_lift_skip:\n \"R2(\\II\\\\<^sub>D) = \\II\\\\<^sub>D\"\n apply (rel_auto) using minus_zero_eq by blast\n\nlemma R2c_R2s_absorb: \"R2c(R2s(P)) = R2s(P)\"\n by (rel_auto)\n\nlemma R2_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows \"(R2(P \\ Q) ;; R2(R \\ S)) =\n R2((\\ (R1 (\\ R2c P) ;; R1 true) \\ \\ (R1 (R2c Q) ;; R1 (\\ R2c R))) \\ (R1 (R2c Q) ;; R1 (R2c S)))\"\n apply (simp add: R2_R2c_def R2c_design R1_design_composition assms unrest R2c_not R2c_and R2c_disj R1_R2c_commute[THEN sym] R2c_idem R2c_R1_seq)\n apply (metis (no_types, lifting) R2c_R1_seq R2c_not R2c_true)\ndone\n\nlemma RH_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows \"(RH(P \\ Q) ;; RH(R \\ S)) =\n RH((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ (\\ $wait\\)) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))))\"\nproof -\n have 1: \"R2c (R1 (\\ R2s P) ;; R1 true) = (R1 (\\ R2s P) ;; R1 true)\"\n proof -\n have 1:\"(R1 (\\ R2s P) ;; R1 true) = (R1(R2 (\\ P) ;; R2 true))\"\n by (rel_auto)\n have \"R2c(R1(R2 (\\ P) ;; R2 true)) = R2c(R1(R2 (\\ P) ;; R2 true))\"\n using R2c_not by blast\n also have \"... = R2(R2 (\\ P) ;; R2 true)\"\n by (metis R1_R2c_commute R1_R2c_is_R2)\n also have \"... = (R2 (\\ P) ;; R2 true)\"\n by (simp add: R2_seqr_distribute)\n also have \"... = (R1 (\\ R2s P) ;; R1 true)\"\n by (simp add: R2_def R2s_not R2s_true)\n finally show ?thesis\n by (simp add: 1)\n qed\n\n have 2:\"R2c ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))\"\n proof -\n have \"((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = R1 (R2 (Q \\ \\ $wait\\) ;; R2 (\\ R))\"\n by (rel_auto)\n hence \"R2c ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = (R2 (Q \\ \\ $wait\\) ;; R2 (\\ R))\"\n by (metis R1_R2c_commute R1_R2c_is_R2 R2_seqr_distribute)\n also have \"... = ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))\"\n by (rel_auto)\n finally show ?thesis .\n qed\n\n have 3:\"R2c((R1 (R2s Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S)))) = (R1 (R2s Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S)))\"\n proof -\n have \"R2c(((R1 (R2s Q))\\true/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\true/$wait\\))\n = ((R1 (R2s Q))\\true/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\true/$wait\\)\"\n proof -\n have \"R2c(((R1 (R2s Q))\\true/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\true/$wait\\)) =\n R2c(R1 (R2s (Q\\true/$wait\\\\)) ;; \\II\\\\<^sub>D\\true/$wait\\)\"\n by (simp add: usubst cond_unit_T R1_def R2s_def)\n also have \"... = R2c(R2(Q\\true/$wait\\\\) ;; R2(\\II\\\\<^sub>D\\true/$wait\\))\"\n by (metis R2_def R2_des_lift_skip R2_subst_wait_true)\n also have \"... = (R2(Q\\true/$wait\\\\) ;; R2(\\II\\\\<^sub>D\\true/$wait\\))\"\n using R2c_seq by blast\n also have \"... = ((R1 (R2s Q))\\true/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\true/$wait\\)\"\n apply (simp add: usubst R2_des_lift_skip)\n apply (metis R2_def R2_des_lift_skip R2_subst_wait'_true R2_subst_wait_true)\n done\n finally show ?thesis .\n qed\n moreover have \"R2c(((R1 (R2s Q))\\false/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\false/$wait\\))\n = ((R1 (R2s Q))\\false/$wait\\\\ ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))\\false/$wait\\)\"\n by (simp add: usubst cond_unit_F)\n (metis (no_types, hide_lams) R1_wait'_false R1_wait_false R2_def R2_subst_wait'_false R2_subst_wait_false R2c_seq)\n ultimately show ?thesis\n proof -\n have \"\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S) = R2 (\\II\\\\<^sub>D \\ $wait \\ S)\"\n by (simp add: R1_R2c_is_R2 R1_R2s_R2c R2_condr' R2_des_lift_skip R2s_wait)\n then show ?thesis\n by (simp add: R1_R2c_is_R2 R1_R2s_R2c R2c_seq)\n qed\n qed\n\n have \"(R1(R2s(R3c(P \\ Q))) ;; R1(R2s(R3c(R \\ S)))) =\n ((R3c(R1(R2s(P) \\ R2s(Q)))) ;; R3c(R1(R2s(R) \\ R2s(S))))\"\n by (metis (no_types, hide_lams) R1_R2s_R2c R1_R3c_commute R2c_R3c_commute R2s_design)\n also have \"... = R3c (R1 ((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S)))))\"\n by (simp add: R3c_R1_design_composition assms unrest)\n also have \"... = R3c(R1(R2c((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S))))))\"\n by (simp add: R2c_design R2c_and R2c_not 1 2 3)\n finally show ?thesis\n by (simp add: R1_R2s_R2c R1_R3c_commute R2c_R3c_commute RH_def)\nqed\n\nlemma R2_st_ex: \"R2 (\\ $st \\ P) = (\\ $st \\ R2(P))\"\n by (rel_auto)\n\nlemma RHS_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n shows \"(\\<^bold>R\\<^sub>s(P \\ Q) ;; \\<^bold>R\\<^sub>s(R \\ S)) =\n \\<^bold>R\\<^sub>s((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ (\\ $wait\\)) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))))\"\nproof -\n have 1: \"R2c (R1 (\\ R2s P) ;; R1 true) = (R1 (\\ R2s P) ;; R1 true)\"\n proof -\n have 1:\"(R1 (\\ R2s P) ;; R1 true) = (R1(R2 (\\ P) ;; R2 true))\"\n by (rel_auto, blast)\n have \"R2c(R1(R2 (\\ P) ;; R2 true)) = R2c(R1(R2 (\\ P) ;; R2 true))\"\n using R2c_not by blast\n also have \"... = R2(R2 (\\ P) ;; R2 true)\"\n by (metis R1_R2c_commute R1_R2c_is_R2)\n also have \"... = (R2 (\\ P) ;; R2 true)\"\n by (simp add: R2_seqr_distribute)\n also have \"... = (R1 (\\ R2s P) ;; R1 true)\"\n by (simp add: R2_def R2s_not R2s_true)\n finally show ?thesis\n by (simp add: 1)\n qed\n\n have 2:\"R2c ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))\"\n proof -\n have \"((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = R1 (R2 (Q \\ \\ $wait\\) ;; R2 (\\ R))\"\n by (rel_auto, blast+)\n hence \"R2c ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R)) = (R2 (Q \\ \\ $wait\\) ;; R2 (\\ R))\"\n by (metis (no_types, lifting) R1_R2c_commute R1_R2c_is_R2 R2_seqr_distribute)\n also have \"... = ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))\"\n by (rel_auto, blast+)\n finally show ?thesis .\n qed\n\n have 3:\"R2c((R1 (R2s Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S)))) =\n (R1 (R2s Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S)))\"\n proof -\n have \"R2c(((R1 (R2s Q))\\true/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\true/$wait\\))\n = ((R1 (R2s Q))\\true/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\true/$wait\\)\"\n proof -\n have \"R2c(((R1 (R2s Q))\\true/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\true/$wait\\)) =\n R2c(R1 (R2s (Q\\true/$wait\\\\)) ;; (\\ $st \\ \\II\\\\<^sub>D)\\true/$wait\\)\"\n by (simp add: usubst cond_unit_T R1_def R2s_def)\n also have \"... = R2c(R2(Q\\true/$wait\\\\) ;; R2((\\ $st \\ \\II\\\\<^sub>D)\\true/$wait\\))\"\n by (metis (no_types, lifting) R2_def R2_des_lift_skip R2_subst_wait_true R2_st_ex)\n also have \"... = (R2(Q\\true/$wait\\\\) ;; R2((\\ $st \\ \\II\\\\<^sub>D)\\true/$wait\\))\"\n using R2c_seq by blast\n also have \"... = ((R1 (R2s Q))\\true/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\true/$wait\\)\"\n apply (simp add: usubst R2_des_lift_skip)\n apply (metis (no_types) R2_def R2_des_lift_skip R2_st_ex R2_subst_wait'_true R2_subst_wait_true)\n done\n finally show ?thesis .\n qed\n moreover have \"R2c(((R1 (R2s Q))\\false/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\false/$wait\\))\n = ((R1 (R2s Q))\\false/$wait\\\\ ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))\\false/$wait\\)\"\n by (simp add: usubst)\n (metis (no_types, lifting) R1_wait'_false R1_wait_false R2_R1_form R2_subst_wait'_false R2_subst_wait_false R2c_seq)\n ultimately show ?thesis\n by (smt R2_R1_form R2_condr' R2_des_lift_skip R2_st_ex R2c_seq R2s_wait)\n qed\n\n have \"(R1(R2s(R3h(P \\ Q))) ;; R1(R2s(R3h(R \\ S)))) =\n ((R3h(R1(R2s(P) \\ R2s(Q)))) ;; R3h(R1(R2s(R) \\ R2s(S))))\"\n by (metis (no_types, hide_lams) R1_R2s_R2c R1_R3h_commute R2c_R3h_commute R2s_design)\n also have \"... = R3h (R1 ((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S)))))\"\n by (simp add: R3h_R1_design_composition assms unrest)\n also have \"... = R3h(R1(R2c((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q) \\ \\ $wait\\) ;; R1 (\\ R2s R))) \\\n (R1 (R2s Q) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S))))))\"\n by (simp add: R2c_design R2c_and R2c_not 1 2 3)\n finally show ?thesis\n by (simp add: R1_R2s_R2c R1_R3h_commute R2c_R3h_commute RHS_def)\nqed\n\nlemma RHS_R2s_design_composition:\n assumes\n \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok \\ R\" \"$ok \\ S\"\n \"P is R2s\" \"Q is R2s\" \"R is R2s\" \"S is R2s\"\n shows \"(\\<^bold>R\\<^sub>s(P \\ Q) ;; \\<^bold>R\\<^sub>s(R \\ S)) =\n \\<^bold>R\\<^sub>s((\\ (R1 (\\ P) ;; R1 true) \\ \\ ((R1 Q \\ \\ $wait\\) ;; R1 (\\ R))) \\\n (R1 Q ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 S)))\"\nproof -\n have f1: \"R2s P = P\"\n by (meson Healthy_def assms(5))\n have f2: \"R2s Q = Q\"\n by (meson Healthy_def assms(6))\n have f3: \"R2s R = R\"\n by (meson Healthy_def assms(7))\n have \"R2s S = S\"\n by (meson Healthy_def assms(8))\n then show ?thesis\n using f3 f2 f1 by (simp add: RHS_design_composition assms(1) assms(2) assms(3) assms(4))\nqed\n\nlemma RH_design_export_R1: \"\\<^bold>R(P \\ Q) = \\<^bold>R(P \\ R1(Q))\"\n by (rel_auto)\n\nlemma RH_design_export_R2s: \"\\<^bold>R(P \\ Q) = \\<^bold>R(P \\ R2s(Q))\"\n by (rel_auto)\n\nlemma RH_design_export_R2c: \"\\<^bold>R(P \\ Q) = \\<^bold>R(P \\ R2c(Q))\"\n by (rel_auto)\n\nlemma RHS_design_export_R1: \"\\<^bold>R\\<^sub>s(P \\ Q) = \\<^bold>R\\<^sub>s(P \\ R1(Q))\"\n by (rel_auto)\n\nlemma RHS_design_export_R2s: \"\\<^bold>R\\<^sub>s(P \\ Q) = \\<^bold>R\\<^sub>s(P \\ R2s(Q))\"\n by (rel_auto)\n\nlemma RHS_design_export_R2c: \"\\<^bold>R\\<^sub>s(P \\ Q) = \\<^bold>R\\<^sub>s(P \\ R2c(Q))\"\n by (rel_auto)\n\nlemma RHS_design_export_R2: \"\\<^bold>R\\<^sub>s(P \\ Q) = \\<^bold>R\\<^sub>s(P \\ R2(Q))\"\n by (rel_auto)\n\nlemma RHS_design_ok_wait: \"\\<^bold>R\\<^sub>s(P\\true,false/$ok,$wait\\ \\ Q\\true,false/$ok,$wait\\) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (rel_auto)\n\nsubsection {* Reactive design triples *}\n\ndefinition wait'_cond ::\n \"('t::ordered_cancel_monoid_diff,'\\,'\\) rel_rp \\ ('t,'\\,'\\) rel_rp \\ ('t,'\\,'\\) rel_rp\" (infixr \"\\\" 65) where\n[upred_defs]: \"P \\ Q = (P \\ $wait\\ \\ Q)\"\n\nlemma wait'_cond_unrest [unrest]:\n \"\\ out_var wait \\ x; x \\ P; x \\ Q \\ \\ x \\ (P \\ Q)\"\n by (simp add: wait'_cond_def unrest)\n\nlemma wait'_cond_subst [usubst]:\n \"$wait\\ \\ \\ \\ \\ \\ (P \\ Q) = (\\ \\ P) \\ (\\ \\ Q)\"\n by (simp add: wait'_cond_def usubst unrest)\n\nlemma wait'_cond_left_false: \"false \\ P = (\\ $wait\\ \\ P)\"\n by (rel_auto)\n\nlemma wait'_cond_seq: \"((P \\ Q) ;; R) = ((P ;; ($wait \\ R)) \\ (Q ;; (\\$wait \\ R)))\"\n by (simp add: wait'_cond_def cond_def seqr_or_distl, rel_blast)\n\nlemma wait'_cond_true: \"(P \\ Q \\ $wait\\) = (P \\ $wait\\)\"\n by (rel_auto)\n\nlemma wait'_cond_false: \"(P \\ Q \\ (\\$wait\\)) = (Q \\ (\\$wait\\))\"\n by (rel_auto)\n\nlemma wait'_cond_idem: \"P \\ P = P\"\n by (rel_auto)\n\nlemma wait'_cond_conj_exchange:\n \"((P \\ Q) \\ (R \\ S)) = (P \\ R) \\ (Q \\ S)\"\n by (rel_auto)\n\nlemma subst_wait'_cond_true [usubst]: \"(P \\ Q)\\true/$wait\\\\ = P\\true/$wait\\\\\"\n by (rel_auto)\n\nlemma subst_wait'_cond_false [usubst]: \"(P \\ Q)\\false/$wait\\\\ = Q\\false/$wait\\\\\"\n by (rel_auto)\n\nlemma subst_wait'_left_subst: \"(P\\true/$wait\\\\ \\ Q) = (P \\ Q)\"\n by (rel_auto)\n\nlemma subst_wait'_right_subst: \"(P \\ Q\\false/$wait\\\\) = (P \\ Q)\"\n by (rel_auto)\n\nlemma wait'_cond_split: \"P\\true/$wait\\\\ \\ P\\false/$wait\\\\ = P\"\n by (simp add: wait'_cond_def cond_var_split)\n\nlemma wait_cond'_assoc: \"P \\ Q \\ R = P \\ R\"\n by (rel_auto)\n\nlemma wait_cond'_shadow: \"(P \\ Q) \\ R = P \\ Q \\ R\"\n by (rel_auto)\n\nlemma wait_cond'_conj: \"P \\ (Q \\ (R \\ S)) = P \\ (Q \\ S)\"\n by (rel_auto)\n\nlemma R1_wait'_cond: \"R1(P \\ Q) = R1(P) \\ R1(Q)\"\n by (rel_auto)\n\nlemma R2s_wait'_cond: \"R2s(P \\ Q) = R2s(P) \\ R2s(Q)\"\n by (simp add: wait'_cond_def R2s_def R2s_def usubst)\n\nlemma R2_wait'_cond: \"R2(P \\ Q) = R2(P) \\ R2(Q)\"\n by (simp add: R2_def R2s_wait'_cond R1_wait'_cond)\n\nlemma RH_design_peri_R1: \"\\<^bold>R(P \\ R1(Q) \\ R) = \\<^bold>R(P \\ Q \\ R)\"\n by (metis (no_types, lifting) R1_idem R1_wait'_cond RH_design_export_R1)\n\nlemma RH_design_post_R1: \"\\<^bold>R(P \\ Q \\ R1(R)) = \\<^bold>R(P \\ Q \\ R)\"\n by (metis R1_wait'_cond RH_design_export_R1 RH_design_peri_R1)\n\nlemma RH_design_peri_R2s: \"\\<^bold>R(P \\ R2s(Q) \\ R) = \\<^bold>R(P \\ Q \\ R)\"\n by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s)\n\nlemma RH_design_post_R2s: \"\\<^bold>R(P \\ Q \\ R2s(R)) = \\<^bold>R(P \\ Q \\ R)\"\n by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s)\n\nlemma RH_design_peri_R2c: \"\\<^bold>R(P \\ R2c(Q) \\ R) = \\<^bold>R(P \\ Q \\ R)\"\n by (metis R1_R2s_R2c RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_peri_R1: \"\\<^bold>R\\<^sub>s(P \\ R1(Q) \\ R) = \\<^bold>R\\<^sub>s(P \\ Q \\ R)\"\n by (metis (no_types, lifting) R1_idem R1_wait'_cond RHS_design_export_R1)\n\nlemma RHS_design_post_R1: \"\\<^bold>R\\<^sub>s(P \\ Q \\ R1(R)) = \\<^bold>R\\<^sub>s(P \\ Q \\ R)\"\n by (metis R1_wait'_cond RHS_design_export_R1 RHS_design_peri_R1)\n\nlemma RHS_design_peri_R2s: \"\\<^bold>R\\<^sub>s(P \\ R2s(Q) \\ R) = \\<^bold>R\\<^sub>s(P \\ Q \\ R)\"\n by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RHS_design_export_R2s)\n\nlemma RHS_design_post_R2s: \"\\<^bold>R\\<^sub>s(P \\ Q \\ R2s(R)) = \\<^bold>R\\<^sub>s(P \\ Q \\ R)\"\n by (metis R2s_wait'_cond RHS_design_export_R2s RHS_design_peri_R2s)\n\nlemma RHS_design_peri_R2c: \"\\<^bold>R\\<^sub>s(P \\ R2c(Q) \\ R) = \\<^bold>R\\<^sub>s(P \\ Q \\ R)\"\n by (metis R1_R2s_R2c RHS_design_peri_R1 RHS_design_peri_R2s)\n\nlemma RH_design_lemma1:\n \"RH(P \\ (R1(R2c(Q)) \\ R) \\ S) = RH(P \\ (Q \\ R) \\ S)\"\n by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_lemma1:\n \"RHS(P \\ (R1(R2c(Q)) \\ R) \\ S) = RHS(P \\ (Q \\ R) \\ S)\"\n by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RHS_design_peri_R1 RHS_design_peri_R2s)\n\ntheorem RH_tri_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\\<^sub>1\" \"$ok\\ \\ Q\\<^sub>2\" \"$ok \\ R\" \"$ok \\ S\\<^sub>1\" \"$ok \\ S\\<^sub>2\"\n \"$wait\\ \\ Q\\<^sub>2\" \"$wait \\ S\\<^sub>1\" \"$wait \\ S\\<^sub>2\"\n shows \"(RH(P \\ Q\\<^sub>1 \\ Q\\<^sub>2) ;; RH(R \\ S\\<^sub>1 \\ S\\<^sub>2)) =\n RH((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ ((R1 (R2s Q\\<^sub>2) \\ \\ $wait\\) ;; R1 (\\ R2s R))) \\\n ((Q\\<^sub>1 \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n have 1:\"(\\ ((R1 (R2s (Q\\<^sub>1 \\ Q\\<^sub>2)) \\ \\ $wait\\) ;; R1 (\\ R2s R))) =\n (\\ ((R1 (R2s Q\\<^sub>2) \\ \\ $wait\\) ;; R1 (\\ R2s R)))\"\n by (metis (no_types, hide_lams) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n have 2: \"(R1 (R2s (Q\\<^sub>1 \\ Q\\<^sub>2)) ;; (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s (S\\<^sub>1 \\ S\\<^sub>2)))) =\n ((R1 (R2s Q\\<^sub>1) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n proof -\n have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\ (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>1) \\ $wait\\)\"\n proof -\n have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\ (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>1) ;; ($wait \\ \\II\\\\<^sub>D))\"\n by (rel_auto)\n also have \"... = ((R1 (R2s Q\\<^sub>1) ;; \\II\\\\<^sub>D) \\ $wait\\)\"\n by (rel_auto)\n also from assms(2) have \"... = ((R1 (R2s Q\\<^sub>1)) \\ $wait\\)\"\n by (simp add: lift_des_skip_dr_unit_unrest unrest)\n finally show ?thesis .\n qed\n\n moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2)))\"\n proof -\n have \"(R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ (\\II\\\\<^sub>D \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\"\n by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred.double_compl utp_pred.inf.left_idem utp_pred.sup_assoc utp_pred.sup_inf_absorb)\n\n also have \"... = ((R1 (R2s Q\\<^sub>2))\\false/$wait\\\\ ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))\\false/$wait\\)\"\n by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2)))\"\n by (simp add: wait'_cond_def usubst unrest assms)\n\n finally show ?thesis .\n qed\n\n moreover\n have \"((R1 (R2s Q\\<^sub>1) \\ $wait\\) \\ ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>1) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n ultimately show ?thesis\n by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq)\n qed\n\n show ?thesis\n apply (subst RH_design_composition)\n apply (simp_all add: assms)\n apply (simp add: assms wait'_cond_def unrest)\n apply (simp add: assms wait'_cond_def unrest)\n apply (simp add: 1 2)\n apply (simp add: R1_R2s_R2c RH_design_lemma1)\n done\nqed\n\nlemma ex_conj_contr_left: \"x \\ P \\ (\\ x \\ P \\ Q) = (P \\ (\\ x \\ Q))\"\n by (pred_auto)\n\nlemma ex_conj_contr_right: \"x \\ Q \\ (\\ x \\ P \\ Q) = ((\\ x \\ P) \\ Q)\"\n by (pred_auto)\n\nlemma R1_R2c_ex_st: \"R1 (R2c (\\ $st\\ \\ Q\\<^sub>1)) = (\\ $st\\ \\ R1 (R2c Q\\<^sub>1))\"\n by (rel_auto)\n\ndefinition wpR (infix \"wp\\<^sub>R\" 60)\nwhere [upred_defs]: \"P wp\\<^sub>R Q = (\\ (P ;; R1(\\ Q)))\"\n\nlemma wpR_true [wp]: \"P wp\\<^sub>R true = true\"\n by (rel_auto)\n\nlemma wpR_seq [wp]:\n \"Q is R1 \\(P ;; Q) wp\\<^sub>R R = P wp\\<^sub>R (Q wp\\<^sub>R R)\"\n by (simp add: wpR_def, metis (no_types, hide_lams) Healthy_def' R1_seqr seqr_assoc)\n\ntheorem RHS_tri_design_composition:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\\<^sub>1\" \"$ok\\ \\ Q\\<^sub>2\" \"$ok \\ R\" \"$ok \\ S\\<^sub>1\" \"$ok \\ S\\<^sub>2\"\n \"$wait \\ R\" \"$wait\\ \\ Q\\<^sub>2\" \"$wait \\ S\\<^sub>1\" \"$wait \\ S\\<^sub>2\"\n shows \"(\\<^bold>R\\<^sub>s(P \\ Q\\<^sub>1 \\ Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\ S\\<^sub>1 \\ S\\<^sub>2)) =\n \\<^bold>R\\<^sub>s((\\ (R1 (\\ R2s P) ;; R1 true) \\ \\ (R1(R2s Q\\<^sub>2) ;; R1 (\\ R2s R))) \\\n (((\\ $st\\ \\ Q\\<^sub>1) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n have 1:\"(\\ ((R1 (R2s (Q\\<^sub>1 \\ Q\\<^sub>2)) \\ \\ $wait\\) ;; R1 (\\ R2s R))) =\n (\\ ((R1 (R2s Q\\<^sub>2) \\ \\ $wait\\) ;; R1 (\\ R2s R)))\"\n by (metis (no_types, hide_lams) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n have 2: \"(R1 (R2s (Q\\<^sub>1 \\ Q\\<^sub>2)) ;; ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s (S\\<^sub>1 \\ S\\<^sub>2)))) =\n (((\\ $st\\ \\ R1 (R2s Q\\<^sub>1)) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n proof -\n have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\ ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (\\ $st\\ \\ ((R1 (R2s Q\\<^sub>1)) \\ $wait\\))\"\n proof -\n have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\ ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>1) ;; ($wait \\ (\\ $st \\ \\II\\\\<^sub>D)))\"\n by (rel_auto, blast)\n also have \"... = ((R1 (R2s Q\\<^sub>1) ;; (\\ $st \\ \\II\\\\<^sub>D)) \\ $wait\\)\"\n by (rel_auto)\n also from assms(2) have \"... = (\\ $st\\ \\ ((R1 (R2s Q\\<^sub>1)) \\ $wait\\))\"\n by (rel_auto, blast)\n finally show ?thesis .\n qed\n\n moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2)))\"\n proof -\n have \"(R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ ((\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>2) ;; (\\ $wait \\ (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\"\n by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred.double_compl utp_pred.inf.left_idem utp_pred.sup_assoc utp_pred.sup_inf_absorb)\n\n also have \"... = ((R1 (R2s Q\\<^sub>2))\\false/$wait\\\\ ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))\\false/$wait\\)\"\n by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2)))\"\n by (simp add: wait'_cond_def usubst unrest assms)\n\n finally show ?thesis .\n qed\n\n moreover\n have \"((R1 (R2s Q\\<^sub>1) \\ $wait\\) \\ ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\ R1 (R2s S\\<^sub>2))))\n = (R1 (R2s Q\\<^sub>1) \\ (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\ ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n ultimately show ?thesis\n by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq ex_conj_contr_right unrest)\n (simp add: cond_and_T_integrate cond_seq_right_distr unrest_var wait'_cond_def)\n qed\n\n from assms(7,8) have 3: \"(R1 (R2s Q\\<^sub>2) \\ \\ $wait\\) ;; R1 (\\ R2s R) = R1 (R2s Q\\<^sub>2) ;; R1 (\\ R2s R)\"\n by (rel_auto, blast, meson)\n\n show ?thesis\n apply (subst RHS_design_composition)\n apply (simp_all add: assms)\n apply (simp add: assms wait'_cond_def unrest)\n apply (simp add: assms wait'_cond_def unrest)\n apply (simp add: 1 2 3)\n apply (simp add: R1_R2s_R2c RHS_design_lemma1)\n apply (metis R1_R2c_ex_st RHS_design_lemma1)\n done\nqed\n\nlemma R1_R2s_R1_true_lemma:\n \"R1(R2s(R1 (\\ R2s P) ;; R1 true)) = R1(R2s((\\ P) ;; R1 true))\"\n by (rel_auto)\n\nlemma R2c_healthy_R2s: \"P is R2c \\ R1(R2s(P)) = R1(P)\"\n by (simp add: Healthy_def R1_R2s_R2c)\n\ntheorem RHS_tri_design_composition_wp:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\\<^sub>1\" \"$ok\\ \\ Q\\<^sub>2\" \"$ok \\ R\" \"$ok \\ S\\<^sub>1\" \"$ok \\ S\\<^sub>2\"\n \"$wait \\ R\" \"$wait\\ \\ Q\\<^sub>2\" \"$wait \\ S\\<^sub>1\" \"$wait \\ S\\<^sub>2\"\n \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q\\<^sub>1 \\ Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\ S\\<^sub>1 \\ S\\<^sub>2) =\n \\<^bold>R\\<^sub>s((R1(\\ P) wp\\<^sub>R false \\ Q\\<^sub>2 wp\\<^sub>R R) \\ (((\\ $st\\ \\ Q\\<^sub>1) \\ (Q\\<^sub>2 ;; S\\<^sub>1)) \\ (Q\\<^sub>2 ;; S\\<^sub>2)))\"\n apply (simp add: RHS_tri_design_composition assms wpR_def Healthy_if R2c_healthy_R2s disj_upred_def)\n apply (metis (no_types, hide_lams) Healthy_if R1_R2c_is_R2 R1_negate_R1 R2_def assms(11) assms(16))\ndone\n\ntext {* Syntax for pre-, post-, and periconditions *}\n\nabbreviation \"pre\\<^sub>s \\ [$ok \\\\<^sub>s true, $ok\\ \\\\<^sub>s false, $wait \\\\<^sub>s false]\"\nabbreviation \"cmt\\<^sub>s \\ [$ok \\\\<^sub>s true, $ok\\ \\\\<^sub>s true, $wait \\\\<^sub>s false]\"\nabbreviation \"peri\\<^sub>s \\ [$ok \\\\<^sub>s true, $ok\\ \\\\<^sub>s true, $wait \\\\<^sub>s false, $wait\\ \\\\<^sub>s true]\"\nabbreviation \"post\\<^sub>s \\ [$ok \\\\<^sub>s true, $ok\\ \\\\<^sub>s true, $wait \\\\<^sub>s false, $wait\\ \\\\<^sub>s false]\"\n\nabbreviation \"npre\\<^sub>R(P) \\ pre\\<^sub>s \\ P\"\n\ndefinition [upred_defs]: \"pre\\<^sub>R(P) = (\\ (npre\\<^sub>R(P)))\"\ndefinition [upred_defs]: \"cmt\\<^sub>R(P) = (cmt\\<^sub>s \\ P)\"\ndefinition [upred_defs]: \"peri\\<^sub>R(P) = (peri\\<^sub>s \\ P)\"\ndefinition [upred_defs]: \"post\\<^sub>R(P) = (post\\<^sub>s \\ P)\"\n\nlemma ok_pre_unrest [unrest]: \"$ok \\ pre\\<^sub>R P\"\n by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma ok_peri_unrest [unrest]: \"$ok \\ peri\\<^sub>R P\"\n by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma ok_post_unrest [unrest]: \"$ok \\ post\\<^sub>R P\"\n by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma ok_cmt_unrest [unrest]: \"$ok \\ cmt\\<^sub>R P\"\n by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma ok'_pre_unrest [unrest]: \"$ok\\ \\ pre\\<^sub>R P\"\n by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma ok'_peri_unrest [unrest]: \"$ok\\ \\ peri\\<^sub>R P\"\n by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma ok'_post_unrest [unrest]: \"$ok\\ \\ post\\<^sub>R P\"\n by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma ok'_cmt_unrest [unrest]: \"$ok\\ \\ cmt\\<^sub>R P\"\n by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma wait_pre_unrest [unrest]: \"$wait \\ pre\\<^sub>R P\"\n by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma wait_peri_unrest [unrest]: \"$wait \\ peri\\<^sub>R P\"\n by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma wait_post_unrest [unrest]: \"$wait \\ post\\<^sub>R P\"\n by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma wait_cmt_unrest [unrest]: \"$wait \\ cmt\\<^sub>R P\"\n by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma wait'_peri_unrest [unrest]: \"$wait\\ \\ peri\\<^sub>R P\"\n by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma wait'_post_unrest [unrest]: \"$wait\\ \\ post\\<^sub>R P\"\n by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma pre\\<^sub>s_design: \"pre\\<^sub>s \\ (P \\ Q) = (\\ pre\\<^sub>s \\ P)\"\n by (simp add: design_def pre\\<^sub>R_def usubst)\n\nlemma peri\\<^sub>s_design: \"peri\\<^sub>s \\ (P \\ Q \\ R) = peri\\<^sub>s \\ (P \\ Q)\"\n by (simp add: design_def usubst wait'_cond_def)\n\nlemma post\\<^sub>s_design: \"post\\<^sub>s \\ (P \\ Q \\ R) = post\\<^sub>s \\ (P \\ R)\"\n by (simp add: design_def usubst wait'_cond_def)\n\nlemma cmt\\<^sub>s_design: \"cmt\\<^sub>s \\ (P \\ Q) = cmt\\<^sub>s \\ (P \\ Q)\"\n by (simp add: design_def usubst wait'_cond_def)\n\nlemma pre\\<^sub>s_R1 [usubst]: \"pre\\<^sub>s \\ R1(P) = R1(pre\\<^sub>s \\ P)\"\n by (simp add: R1_def usubst)\n\nlemma pre\\<^sub>s_R2c [usubst]: \"pre\\<^sub>s \\ R2c(P) = R2c(pre\\<^sub>s \\ P)\"\n by (simp add: R2c_def R2s_def usubst)\n\nlemma peri\\<^sub>s_R1 [usubst]: \"peri\\<^sub>s \\ R1(P) = R1(peri\\<^sub>s \\ P)\"\n by (simp add: R1_def usubst)\n\nlemma peri\\<^sub>s_R2c [usubst]: \"peri\\<^sub>s \\ R2c(P) = R2c(peri\\<^sub>s \\ P)\"\n by (simp add: R2c_def R2s_def usubst)\n\nlemma post\\<^sub>s_R1 [usubst]: \"post\\<^sub>s \\ R1(P) = R1(post\\<^sub>s \\ P)\"\n by (simp add: R1_def usubst)\n\nlemma post\\<^sub>s_R2c [usubst]: \"post\\<^sub>s \\ R2c(P) = R2c(post\\<^sub>s \\ P)\"\n by (simp add: R2c_def R2s_def usubst)\n\nlemma cmt\\<^sub>s_R1 [usubst]: \"cmt\\<^sub>s \\ R1(P) = R1(cmt\\<^sub>s \\ P)\"\n by (simp add: R1_def usubst)\n\nlemma cmt\\<^sub>s_R2c [usubst]: \"cmt\\<^sub>s \\ R2c(P) = R2c(cmt\\<^sub>s \\ P)\"\n by (simp add: R2c_def R2s_def usubst)\n\nlemma pre_wait_false:\n \"pre\\<^sub>R(P\\false/$wait\\) = pre\\<^sub>R(P)\"\n by (rel_auto)\n\nlemma cmt_wait_false:\n \"cmt\\<^sub>R(P\\false/$wait\\) = cmt\\<^sub>R(P)\"\n by (rel_auto)\n\nlemma subst_tr_pre [usubst]:\n \"\\ $ok \\ v; $ok\\ \\ v; $wait \\ v \\ \\ (pre\\<^sub>R P)\\v/$tr\\ = pre\\<^sub>R (P\\v/$tr\\)\"\n by (rel_auto)\n\nlemma subst_tr_peri [usubst]:\n \"\\ $ok \\ v; $ok\\ \\ v; $wait \\ v; $wait\\ \\ v \\ \\ (peri\\<^sub>R P)\\v/$tr\\ = peri\\<^sub>R (P\\v/$tr\\)\"\n by (rel_auto)\n\nlemma subst_tr_post [usubst]:\n \"\\ $ok \\ v; $ok\\ \\ v; $wait \\ v; $wait\\ \\ v \\ \\ (post\\<^sub>R P)\\v/$tr\\ = post\\<^sub>R (P\\v/$tr\\)\"\n by (rel_auto)\n\nlemma rea_pre_RHS_design: \"pre\\<^sub>R(\\<^bold>R\\<^sub>s(P \\ Q)) = (\\ R1(R2c(pre\\<^sub>s \\ (\\ P))))\"\n by (simp add: RHS_def usubst R3h_def pre\\<^sub>R_def pre\\<^sub>s_design)\n\nlemma rea_cmt_RHS_design: \"cmt\\<^sub>R(\\<^bold>R\\<^sub>s(P \\ Q)) = R1(R2c(cmt\\<^sub>s \\ (P \\ Q)))\"\n by (simp add: RHS_def usubst R3h_def cmt\\<^sub>R_def cmt\\<^sub>s_design)\n\nlemma rea_peri_RHS_design: \"peri\\<^sub>R(\\<^bold>R\\<^sub>s(P \\ Q \\ R)) = R1(R2c(peri\\<^sub>s \\ (P \\ Q)))\"\n by (simp add:RHS_def usubst peri\\<^sub>R_def R3h_def peri\\<^sub>s_design)\n\nlemma rea_post_RHS_design: \"post\\<^sub>R(\\<^bold>R\\<^sub>s(P \\ Q \\ R)) = R1(R2c(post\\<^sub>s \\ (P \\ R)))\"\n by (simp add:RHS_def usubst post\\<^sub>R_def R3h_def post\\<^sub>s_design)\n\nlemma wait'_cond_peri_post_cmt:\n \"peri\\<^sub>R P \\ post\\<^sub>R P = cmt\\<^sub>R P\"\n by (rel_auto, (metis (full_types))+)\n\nlemma rdes_export_cmt: \"\\<^bold>R\\<^sub>s(P \\ cmt\\<^sub>s \\ Q) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (rel_auto)\n\nlemma rdes_export_pre: \"\\<^bold>R\\<^sub>s((P\\true,false/$ok,$wait\\) \\ Q) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (rel_auto)\n\nlemma RHS_design_pre_post_form:\n \"\\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\nproof -\n have \"\\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f)\\true/$ok\\ \\ P\\<^sup>t\\<^sub>f\\true/$ok\\)\"\n by (simp add: design_subst_ok)\n also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\n by (simp add: pre\\<^sub>R_def cmt\\<^sub>R_def usubst)\n finally show ?thesis .\nqed\n\nlemma SRD_as_reactive_design:\n \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\n by (simp add: RHS_design_pre_post_form SRD_RH_design_form)\n\nlemma SRD_reactive_design_alt:\n assumes \"P is SRD\"\n shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P)) = P\"\nproof -\n have \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P)) = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f)\"\n by (simp add: RHS_design_pre_post_form)\n thus ?thesis\n by (simp add: SRD_reactive_design assms)\nqed\n\nlemma SRD_reactive_tri_design_lemma:\n \"SRD(P) = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f\\true/$wait\\\\ \\ P\\<^sup>t\\<^sub>f\\false/$wait\\\\)\"\n by (simp add: SRD_RH_design_form wait'_cond_split)\n\nlemma SRD_as_reactive_tri_design:\n \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P))\"\nproof -\n have \"SRD(P) = \\<^bold>R\\<^sub>s((\\ P\\<^sup>f\\<^sub>f) \\ P\\<^sup>t\\<^sub>f\\true/$wait\\\\ \\ P\\<^sup>t\\<^sub>f\\false/$wait\\\\)\"\n by (simp add: SRD_RH_design_form wait'_cond_split)\n also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P))\"\n apply (simp add: usubst)\n apply (subst design_subst_ok_ok'[THEN sym])\n apply (simp add: pre\\<^sub>R_def peri\\<^sub>R_def post\\<^sub>R_def usubst unrest)\n done\n finally show ?thesis .\nqed\n\nlemma SRD_reactive_tri_design:\n assumes \"P is SRD\"\n shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)) = P\"\n by (metis Healthy_if SRD_as_reactive_tri_design assms)\n\nlemma RHS_tri_design_is_SRD:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok\\ \\ R\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q \\ R) is SRD\"\n by (rule RHS_design_is_SRD, simp_all add: unrest assms)\n\nlemma R1_neg_R2s_pre_RHS:\n assumes \"P is SRD\"\n shows \"R1 (\\ R2s(pre\\<^sub>R(P))) = (\\ (pre\\<^sub>R(P)))\"\nproof -\n have \"(\\ pre\\<^sub>R(P)) = (\\ pre\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P))))\"\n by (simp add: SRD_reactive_tri_design assms)\n also have \"... = R1(R2s(\\ pre\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)))))\"\n by (rel_auto)\n also have \"... = R1 (\\ R2s(pre\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)))))\"\n by (simp add: R2s_not)\n also have \"... = R1 (\\ R2s(pre\\<^sub>R(P)))\"\n by (simp add: SRD_reactive_tri_design assms)\n finally show ?thesis ..\nqed\n\nlemma R1_R2s_cmt_SRD:\n assumes \"P is SRD\"\n shows \"R1(R2s(cmt\\<^sub>R(P))) = cmt\\<^sub>R(P)\"\n by (metis (no_types, hide_lams) Healthy_def R1_R2s_R2c R2_def R2_idem SRD_as_reactive_design assms rea_cmt_RHS_design)\n\nlemma R1_R2s_peri_SRD:\n assumes \"P is SRD\"\n shows \"R1(R2s(peri\\<^sub>R(P))) = peri\\<^sub>R(P)\"\n by (metis (no_types, hide_lams) Healthy_def R1_R2s_R2c R2_def R2_idem RHS_def SRD_RH_design_form assms peri\\<^sub>R_def peri\\<^sub>s_R1 peri\\<^sub>s_R2c)\n\nlemma R1_R2s_post_SRD:\n assumes \"P is SRD\"\n shows \"R1(R2s(post\\<^sub>R(P))) = post\\<^sub>R(P)\"\n by (metis (no_types, hide_lams) Healthy_def R1_R2s_R2c R2_def R2_idem RHS_def SRD_RH_design_form assms post\\<^sub>R_def post\\<^sub>s_R1 post\\<^sub>s_R2c)\n\nlemma RHS_pre_lemma: \"(\\<^bold>R\\<^sub>s P)\\<^sup>f\\<^sub>f = R1(R2c(P\\<^sup>f\\<^sub>f))\"\n by (rel_auto)\n\nlemma RHS_design_neg_R1_pre:\n \"\\<^bold>R\\<^sub>s ((\\ R1 P) \\ R) = \\<^bold>R\\<^sub>s ((\\ P) \\ R)\"\n by (rel_auto)\n\nlemma RHS_design_conj_neg_R1_pre:\n \"\\<^bold>R\\<^sub>s (((\\ R1 P) \\ Q) \\ R) = \\<^bold>R\\<^sub>s (((\\ P) \\ Q) \\ R)\"\n by (rel_auto)\n\nlemma RHS_design_R2c_pre:\n \"\\<^bold>R\\<^sub>s(R2c(P) \\ Q) = \\<^bold>R\\<^sub>s(P \\ Q)\"\n by (rel_auto)\n\nlemma UINF_R1_neg_R2s_pre_RHS:\n assumes \"A \\ \\SRD\\\\<^sub>H\"\n shows \"(\\ P \\ A \\ R1 (\\ R2s (pre\\<^sub>R P))) = (\\ P \\ A \\ \\ (pre\\<^sub>R P))\"\n by (rule UINF_cong[of A], metis (no_types, lifting) Ball_Collect R1_neg_R2s_pre_RHS assms)\n\nlemma USUP_R1_R2s_cmt_SRD:\n assumes \"A \\ \\SRD\\\\<^sub>H\"\n shows \"(\\ P \\ A \\ R1 (R2s (cmt\\<^sub>R P))) = (\\ P \\ A \\ cmt\\<^sub>R P)\"\n by (rule USUP_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n\nlemma UINF_R1_R2s_cmt_SRD:\n assumes \"A \\ \\SRD\\\\<^sub>H\"\n shows \"(\\ P \\ A \\ R1 (R2s (cmt\\<^sub>R P))) = (\\ P \\ A \\ cmt\\<^sub>R P)\"\n by (rule UINF_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n\nlemma SRD_composition:\n assumes \"P is SRD\" \"Q is SRD\"\n shows \"(P ;; Q) = \\<^bold>R\\<^sub>s ((\\ ((\\ pre\\<^sub>R P) ;; R1 true) \\ \\ (post\\<^sub>R P ;; (\\ pre\\<^sub>R Q))) \\\n ((\\ $st\\ \\ peri\\<^sub>R P) \\ (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\ (post\\<^sub>R P ;; post\\<^sub>R Q))\"\nproof -\n have \"(P ;; Q) = (\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\ peri\\<^sub>R(Q) \\ post\\<^sub>R(Q)))\"\n by (simp add: SRD_reactive_tri_design assms(1) assms(2))\n also from assms have \"... = \\<^bold>R\\<^sub>s ((\\ ((\\ pre\\<^sub>R P) ;; R1 true) \\ \\ (post\\<^sub>R P ;; (\\ pre\\<^sub>R Q))) \\\n ((\\ $st\\ \\ peri\\<^sub>R P) \\ (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\ (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n by (simp add: RHS_tri_design_composition unrest R1_R2s_peri_SRD R1_R2s_post_SRD R1_neg_R2s_pre_RHS)\n finally show ?thesis .\nqed\n\nlemma SRD_composition_wp:\n assumes \"P is SRD\" \"Q is SRD\"\n shows \"(P ;; Q) = \\<^bold>R\\<^sub>s (((\\ pre\\<^sub>R P) wp\\<^sub>R false \\ post\\<^sub>R P wp\\<^sub>R pre\\<^sub>R Q) \\\n ((\\ $st\\ \\ peri\\<^sub>R P) \\ (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\ (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n using assms\n by (simp add: SRD_composition wpR_def, metis (no_types, lifting) R1_idem R1_neg_R2s_pre_RHS)\n\nlemma SRD_seqr_closure:\n assumes \"P is SRD\" \"Q is SRD\"\n shows \"(P ;; Q) is SRD\"\nproof -\n have \"(P ;; Q) = \\<^bold>R\\<^sub>s ((\\ ((\\ pre\\<^sub>R P) ;; R1 true) \\ \\ (post\\<^sub>R P ;; (\\ pre\\<^sub>R Q))) \\\n ((\\ $st\\ \\ peri\\<^sub>R P) \\ (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\ (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n by (simp add: SRD_composition assms(1) assms(2))\n also have \"... is SRD\"\n by (simp add: RHS_design_is_SRD add: unrest)\n finally show ?thesis .\nqed\n\nsubsection {* Reactive design signature *}\n \nlemma srdes_skip_def: \"II\\<^sub>R = \\<^bold>R\\<^sub>s(true \\ ($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R))\"\n apply (rel_auto) using minus_zero_eq by blast+\n\ntext {* This additional healthiness condition is analogous to H3 *}\n\ndefinition [upred_defs]: \"RD3(P) = P ;; II\\<^sub>R\"\n\ndefinition assigns_rea :: \"'s usubst \\ ('s, 't::ordered_cancel_monoid_diff, '\\) hrel_rsp\" (\"\\_\\\\<^sub>R\") where\n[upred_defs]: \"assigns_rea \\ = \\<^bold>R\\<^sub>s(true \\ ($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\\\\\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S))\"\n\nabbreviation Chaos :: \"('s,'t::ordered_cancel_monoid_diff,'\\) hrel_rsp\" where\n\"Chaos \\ \\<^bold>\\\\<^bsub>SRDES\\<^esub>\"\n\nabbreviation Miracle :: \"('s,'t::ordered_cancel_monoid_diff,'\\) hrel_rsp\" where\n\"Miracle \\ \\<^bold>\\\\<^bsub>SRDES\\<^esub>\"\n\nlemma Chaos_def: \"Chaos = \\<^bold>R\\<^sub>s(false \\ true)\"\nproof -\n have \"Chaos = SRD(true)\"\n by (metis srdes_hcond_def srdes_theory_continuous.healthy_bottom)\n also have \"... = \\<^bold>R\\<^sub>s(\\<^bold>H(true))\"\n by (simp add: SRD_RHS_H1_H2)\n also have \"... = \\<^bold>R\\<^sub>s(false \\ true)\"\n by (metis H1_design H2_true design_false_pre)\n finally show ?thesis .\nqed\n\nlemma Miracle_def: \"Miracle = \\<^bold>R\\<^sub>s(true \\ false)\"\nproof -\n have \"Miracle = SRD(false)\"\n by (metis srdes_hcond_def srdes_theory_continuous.healthy_top)\n also have \"... = \\<^bold>R\\<^sub>s(\\<^bold>H(false))\"\n by (simp add: SRD_RHS_H1_H2)\n also have \"... = \\<^bold>R\\<^sub>s(true \\ false)\"\n by (metis (no_types, lifting) H1_H2_eq_design p_imp_p subst_impl subst_not utp_pred.compl_bot_eq utp_pred.compl_top_eq)\n finally show ?thesis .\nqed\n\nthm srdes_theory_continuous.weak.bottom_lower\nthm srdes_theory_continuous.weak.top_higher\nthm srdes_theory_continuous.meet_bottom\nthm srdes_theory_continuous.meet_top\n\nlemma Miracle_left_zero:\n assumes \"P is SRD\"\n shows \"Miracle ;; P = Miracle\"\nproof -\n have \"Miracle ;; P = \\<^bold>R\\<^sub>s(true \\ false) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\n by (simp add: Miracle_def SRD_reactive_design_alt assms)\n also have \"... = \\<^bold>R\\<^sub>s(true \\ false)\"\n by (simp add: RHS_design_composition unrest R1_false R2s_false R2s_true)\n also have \"... = Miracle\"\n by (simp add: Miracle_def)\n finally show ?thesis .\nqed\n\nlemma Chaos_left_zero:\n assumes \"P is SRD\"\n shows \"(Chaos ;; P) = Chaos\"\nproof -\n have \"Chaos ;; P = \\<^bold>R\\<^sub>s(false \\ true) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\n by (simp add: Chaos_def SRD_reactive_design_alt assms)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ R1 true \\ \\ (R1 true \\ \\ $wait\\) ;; R1 (\\ R2s (pre\\<^sub>R P))) \\\n (R1 true ;; (\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s (cmt\\<^sub>R P))))\"\n by (simp add: RHS_design_composition unrest R2s_false R2s_true R1_false R1_true_comp)\n also have \"... = \\<^bold>R\\<^sub>s ((false \\ \\ (R1 true \\ \\ $wait\\) ;; R1 (\\ R2s (pre\\<^sub>R P))) \\\n (R1 true ;; (\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ R1 (R2s (cmt\\<^sub>R P))))\"\n by (simp add: RHS_design_conj_neg_R1_pre)\n also have \"... = \\<^bold>R\\<^sub>s(true)\"\n by (simp add: design_false_pre)\n also have \"... = \\<^bold>R\\<^sub>s(false \\ true)\"\n by (simp add: design_def)\n also have \"... = Chaos\"\n by (simp add: Chaos_def)\n finally show ?thesis .\nqed\n\nlemma assigns_rea_RHS_tri_des:\n \"\\\\\\\\<^sub>R = \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S))\"\n by (rel_auto)\n\nlemma preR_Miracle: \"pre\\<^sub>R(Miracle) = true\"\n by (simp add: Miracle_def, rel_auto)\n\nlemma periR_Miracle: \"peri\\<^sub>R(Miracle) = false\"\n by (simp add: Miracle_def, rel_auto)\n\nlemma postR_Miracle: \"post\\<^sub>R(Miracle) = false\"\n by (simp add: Miracle_def, rel_auto)\n\nlemma preR_srdes_skip: \"pre\\<^sub>R(II\\<^sub>R) = true\"\n by (rel_auto)\n\nlemma periR_srdes_skip: \"peri\\<^sub>R(II\\<^sub>R) = false\"\n by (rel_auto)\n\nlemma postR_srdes_skip: \"post\\<^sub>R(II\\<^sub>R) = ($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R)\"\n by (rel_auto) \n\nlemma preR_assigns_rea: \"pre\\<^sub>R(\\\\\\\\<^sub>R) = true\"\n by (simp add: assigns_rea_def rea_pre_RHS_design usubst R2c_false R1_false)\n\nlemma periR_assigns_rea: \"peri\\<^sub>R(\\\\\\\\<^sub>R) = false\"\n by (simp add: assigns_rea_RHS_tri_des rea_peri_RHS_design usubst R2c_false R1_false)\n\nlemma postR_assigns_rea: \"post\\<^sub>R(\\\\\\\\<^sub>R) = ($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S)\"\n apply (rel_auto) using minus_zero_eq by blast\n\nlemma RHS_design_choice: \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\ Q\\<^sub>1) \\ \\<^bold>R\\<^sub>s(P\\<^sub>2 \\ Q\\<^sub>2) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ (Q\\<^sub>1 \\ Q\\<^sub>2))\"\n by (metis RHS_inf design_choice)\n\nlemma RHS_tri_design_choice: \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\ P\\<^sub>2 \\ P\\<^sub>3) \\ \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\ Q\\<^sub>2 \\ Q\\<^sub>3) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ Q\\<^sub>1) \\ (P\\<^sub>2 \\ Q\\<^sub>2) \\ (P\\<^sub>3 \\ Q\\<^sub>3))\"\n apply (simp add: RHS_design_choice)\n apply (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"])\n apply (simp)\n apply (rel_auto)\ndone\n\nlemma RHS_design_USUP:\n assumes \"A \\ {}\"\n shows \"(\\ i \\ A \\ \\<^bold>R\\<^sub>s(P(i) \\ Q(i))) = \\<^bold>R\\<^sub>s((\\ i \\ A \\ P(i)) \\ (\\ i \\ A \\ Q(i)))\"\n by (subst RHS_INF[OF assms, THEN sym], simp add: design_USUP assms)\n\nlemma SRD_left_unit:\n assumes \"P is SRD\"\n shows \"II\\<^sub>R ;; P = P\"\nproof -\n have \"II\\<^sub>R ;; P = \\<^bold>R\\<^sub>s(true \\ ($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R)) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P))\"\n by (simp add: SRD_reactive_design_alt assms srdes_skip_def)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R) \\ \\ $wait\\) ;; (\\ pre\\<^sub>R P)) \\\n (($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R) ;; (\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ cmt\\<^sub>R P))\"\n by (simp add: RHS_design_composition unrest R2s_true R1_false R1_R2s_cmt_SRD R2s_wait' R2s_not\n R1_neg_R2s_pre_RHS assms R2s_conj R1_extend_conj R1_R2s_tr'_eq_tr R2s_lift_rea)\n also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\\n (($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R) ;; (\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ cmt\\<^sub>R P))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\ (($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R) ;; cmt\\<^sub>R P))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\ cmt\\<^sub>R P)\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis\n by (simp add: SRD_reactive_design_alt assms)\nqed\n\nlemma SRD_right_unit_lemma:\n assumes \"P is SRD\"\n shows \"P ;; II\\<^sub>R = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\ \\ cmt\\<^sub>R P))\"\nproof -\n have \"P ;; II\\<^sub>R = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(true \\ ($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R))\"\n by (simp add: SRD_reactive_design_alt assms srdes_skip_def)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\\n (cmt\\<^sub>R P ;; (\\ $st \\ \\II\\\\<^sub>D) \\ $wait \\ ($tr\\ =\\<^sub>u $tr \\ \\ $wait\\ \\ \\II\\\\<^sub>R)))\"\n by (simp add: RHS_design_composition unrest R2s_true R1_false R1_R2s_cmt_SRD R2s_wait' R2s_not\n R1_neg_R2s_pre_RHS assms R2s_conj R1_extend_conj R1_R2s_tr'_eq_tr R2s_lift_rea)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\ \\ cmt\\<^sub>R P))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis .\nqed\n\nlemma SRD_right_unit_tri_lemma:\n assumes \"P is SRD\"\n shows \"P ;; II\\<^sub>R = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R P))\"\nproof -\n have \"((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\ \\ cmt\\<^sub>R P) = (\\ $st\\ \\ peri\\<^sub>R P) \\ post\\<^sub>R P\"\n by (rel_auto)\n thus ?thesis\n by (simp add: SRD_right_unit_lemma assms)\nqed\n\nlemma SRD_srdes_skip: \"II\\<^sub>R is SRD\"\n by (simp add: srdes_skip_def RHS_design_is_SRD unrest)\n\nlemma srdes_skip_tri_design: \"II\\<^sub>R = \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R))\"\n by (simp add: srdes_skip_def, rel_auto)\n \nlemma SRD_right_Chaos_lemma:\n assumes \"P is SRD\"\n shows \"P ;; Chaos = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true \\ \\ (cmt\\<^sub>R P \\ \\ $wait\\) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\))\"\nproof -\n have \"P ;; Chaos = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(false \\ false)\"\n by (simp add: Chaos_def SRD_reactive_design_alt assms design_false_pre)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true \\ \\ (cmt\\<^sub>R P \\ \\ $wait\\) ;; R1 true) \\ (cmt\\<^sub>R P ;; ($wait \\ (\\ $st \\ \\II\\\\<^sub>D))))\"\n by (simp add: RHS_design_composition unrest R2s_true R1_false R1_R2s_cmt_SRD R2s_wait' R2s_false R2s_not\n R1_neg_R2s_pre_RHS assms R2s_conj R1_extend_conj R1_R2s_tr'_eq_tr R2s_lift_rea)\n (simp add: cond_def)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true \\ \\ (cmt\\<^sub>R P \\ \\ $wait\\) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis .\nqed\n\nlemma SRD_right_Chaos_tri_lemma:\n assumes \"P is SRD\"\n shows \"P ;; Chaos = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true \\ \\ (post\\<^sub>R P ;; R1 true)) \\ ((\\ $st\\ \\ peri\\<^sub>R P) \\ false))\"\nproof -\n have \"(\\ (cmt\\<^sub>R P \\ \\ $wait\\) ;; R1 true) = (\\ (post\\<^sub>R P ;; R1 true\\<^sub>h))\"\n by (rel_auto, blast)\n moreover have \"((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\) = (\\ $st\\ \\ peri\\<^sub>R P) \\ false\"\n by (rel_auto)\n ultimately show ?thesis\n by (simp add: SRD_right_Chaos_lemma[OF assms])\nqed\n \nlemma SRD_right_Miracle_lemma:\n assumes \"P is SRD\"\n shows \"P ;; Miracle = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\))\"\nproof -\n have \"P ;; Miracle = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ cmt\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(true \\ false)\"\n by (simp add: Miracle_def SRD_reactive_design_alt assms design_false_pre)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ (cmt\\<^sub>R P ;; ($wait \\ (\\ $st \\ \\II\\\\<^sub>D))))\"\n by (simp add: RHS_design_composition unrest R2s_true R1_false R1_R2s_cmt_SRD R2s_wait' R2s_false R2s_not\n R1_neg_R2s_pre_RHS assms R2s_conj R1_extend_conj R1_R2s_tr'_eq_tr R2s_lift_rea)\n (simp add: cond_def)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ ((\\ $st\\ \\ cmt\\<^sub>R P) \\ $wait\\))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis .\nqed\n\nlemma SRD_right_Miracle_tri_lemma:\n assumes \"P is SRD\"\n shows \"P ;; Miracle = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ (\\ $st\\ \\ peri\\<^sub>R P) \\ false)\"\n by (simp add: SRD_right_Miracle_lemma[OF assms], rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n \ntext {* Properties about healthiness condition RD3 *}\n\nlemma RD3_idem: \"RD3(RD3(P)) = RD3(P)\"\nproof -\n have a: \"II\\<^sub>R ;; II\\<^sub>R = II\\<^sub>R\"\n by (simp add: SRD_left_unit SRD_srdes_skip)\n show ?thesis\n by (simp add: RD3_def seqr_assoc[THEN sym] a)\nqed\n\nlemma RD3_Idempotent: \"Idempotent RD3\"\n by (simp add: Idempotent_def RD3_idem)\n\nlemma RD3_continuous: \"RD3(\\A) = (\\P\\A. RD3(P))\"\n by (simp add: RD3_def seq_Sup_distr)\n\nlemma RD3_Continuous: \"Continuous RD3\"\n by (simp add: Continuous_def RD3_continuous)\n\nlemma RD3_right_subsumes_RD2: \"RD2(RD3(P)) = RD3(P)\"\nproof -\n have a:\"II\\<^sub>R ;; J = II\\<^sub>R\"\n by (rel_auto)\n show ?thesis\n by (metis (no_types, hide_lams) H2_def RD2_def RD3_def a seqr_assoc)\nqed\n\nlemma RD3_left_subsumes_RD2: \"RD3(RD2(P)) = RD3(P)\"\nproof -\n have a:\"J ;; II\\<^sub>R = II\\<^sub>R\"\n by (rel_simp, safe, blast+)\n show ?thesis\n by (metis (no_types, hide_lams) H2_def RD2_def RD3_def a seqr_assoc)\nqed\n\nlemma RD3_implies_RD2: \"P is RD3 \\ P is RD2\"\n by (metis Healthy_def RD3_right_subsumes_RD2)\n\nlemma RD3_intro_pre:\n assumes \"P is SRD\" \"(\\ pre\\<^sub>R(P)) ;; R1(true) = (\\ pre\\<^sub>R(P))\" \"$st\\ \\ peri\\<^sub>R(P)\"\n shows \"P is RD3\"\nproof -\n have \"RD3(P) = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ (\\ $st\\ \\ peri\\<^sub>R P) \\ post\\<^sub>R P)\"\n by (simp add: RD3_def SRD_right_unit_tri_lemma assms)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ peri\\<^sub>R P \\ post\\<^sub>R P)\"\n by (simp add: assms(3) ex_unrest)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ (\\ pre\\<^sub>R P) ;; R1 true) \\ cmt\\<^sub>R P)\"\n by (simp add: wait'_cond_peri_post_cmt)\n also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\ cmt\\<^sub>R P)\"\n by (simp add: assms(2))\n finally show ?thesis\n by (metis Healthy_def SRD_as_reactive_design assms(1))\nqed\n\nlemma RHS_tri_design_right_unit_lemma:\n assumes \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok\\ \\ R\" \"$wait\\ \\ R\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q \\ R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s((\\ (\\ P) ;; R1 true) \\ ((\\ $st\\ \\ Q) \\ R))\"\nproof -\n have \"\\<^bold>R\\<^sub>s(P \\ Q \\ R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s(P \\ Q \\ R) ;; \\<^bold>R\\<^sub>s(true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R))\"\n by (simp add: srdes_skip_tri_design)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ R1 (\\ R2s P) ;; R1 true) \\ (\\ $st\\ \\ Q) \\ (R1 (R2s R) ;; R1 (R2s ($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R))))\"\n by (simp_all add: RHS_tri_design_composition assms unrest R2s_true R1_false R2s_false)\n also have \"... = \\<^bold>R\\<^sub>s ((\\ R1 (\\ R2s P) ;; R1 true) \\ (\\ $st\\ \\ Q) \\ R1 (R2s R))\"\n proof -\n from assms(3,4) have \"(R1 (R2s R) ;; R1 (R2s ($tr\\ =\\<^sub>u $tr \\ \\II\\\\<^sub>R))) = R1 (R2s R)\"\n by (rel_auto, metis (no_types, lifting) minus_zero_eq, meson order_refl ordered_cancel_monoid_diff_class.diff_cancel)\n thus ?thesis\n by simp\n qed\n also have \"... = \\<^bold>R\\<^sub>s((\\ (\\ P) ;; R1 true) \\ ((\\ $st\\ \\ Q) \\ R))\"\n by (metis (no_types, lifting) R1_R2s_R1_true_lemma R1_R2s_R2c R2c_not RHS_design_R2c_pre RHS_design_neg_R1_pre RHS_design_post_R1 RHS_design_post_R2s)\n finally show ?thesis .\nqed\n\nlemma RHS_tri_design_RD3_intro:\n assumes\n \"$ok\\ \\ P\" \"$ok\\ \\ Q\" \"$ok\\ \\ R\" \"$st\\ \\ Q\" \"$wait\\ \\ R\"\n \"(\\ P) ;; R1(true) = (\\ P)\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q \\ R) is RD3\"\n apply (simp add: Healthy_def RD3_def)\n apply (subst RHS_tri_design_right_unit_lemma)\n apply (simp_all add:assms ex_unrest)\ndone\n\ntext {* RD3 reactive designs are those whose assumption can be written as a conjunction of a\n precondition on (undashed) program variables, and a negated statement about the trace. The latter\n allows us to state that certain events must not occur in the trace -- which are effectively safety\n properties. *}\n\nlemma R1_right_unit_lemma:\n \"\\ out\\ \\ b; out\\ \\ e \\ \\ (b \\ $tr ^\\<^sub>u e \\\\<^sub>u $tr\\) ;; R1(true) = (b \\ $tr ^\\<^sub>u e \\\\<^sub>u $tr\\)\"\n by (rel_auto, blast, metis (no_types, lifting) dual_order.trans)\n\nlemma RHS_tri_design_RD3_intro_form:\n assumes\n \"out\\ \\ b\" \"out\\ \\ e\" \"$ok\\ \\ Q\" \"$st\\ \\ Q\" \"$ok\\ \\ R\" \"$wait\\ \\ R\"\n shows \"\\<^bold>R\\<^sub>s((b \\ \\ $tr ^\\<^sub>u e \\\\<^sub>u $tr\\) \\ Q \\ R) is RD3\"\n apply (rule RHS_tri_design_RD3_intro)\n apply (simp_all add: assms unrest)\n apply (simp add: R1_right_unit_lemma assms(1) assms(2) unrest_not)\ndone\n\ndefinition NSRD :: \"('s,'t::ordered_cancel_monoid_diff,'\\) hrel_rsp \\ ('s,'t,'\\) hrel_rsp\"\nwhere [upred_defs]: \"NSRD = RD1 \\ RD3 \\ RHS\"\n\nlemma RD1_RD3_commute: \"RD1(RD3(P)) = RD3(RD1(P))\"\n by (rel_auto, blast+)\n\nlemma NSRD_is_SRD: \"P is NSRD \\ P is SRD\"\n by (simp add: Healthy_def NSRD_def SRD_def, metis Healthy_def RD1_RD3_commute RD2_RHS_commute RD3_def RD3_right_subsumes_RD2 SRD_def SRD_idem SRD_seqr_closure SRD_srdes_skip)\n\nlemma NSRD_Idempotent: \"Idempotent NSRD\"\n by (clarsimp simp add: Idempotent_def NSRD_def, metis (no_types, hide_lams) Healthy_def RD1_RD3_commute RD3_def RD3_idem RD3_left_subsumes_RD2 SRD_def SRD_idem SRD_seqr_closure SRD_srdes_skip)\n\nlemma NSRD_Continuous: \"Continuous NSRD\"\n by (simp add: Continuous_comp NSRD_def RD1_Continuous RD3_Continuous RHS_Continuous)\n\nlemma NSRD_form:\n \"NSRD(P) = \\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P)))\"\nproof -\n have \"NSRD(P) = RD3(SRD(P))\"\n by (metis (no_types, lifting) NSRD_def RD1_RD3_commute RD3_left_subsumes_RD2 SRD_def comp_def)\n also have \"... = RD3(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)))\"\n by (simp add: SRD_as_reactive_tri_design)\n also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\ peri\\<^sub>R(P) \\ post\\<^sub>R(P)) ;; II\\<^sub>R\"\n by (simp add: RD3_def)\n also have \"... = \\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P)))\"\n by (simp add: RHS_tri_design_right_unit_lemma unrest)\n finally show ?thesis .\nqed\n\nlemma NSRD_healthy_form:\n assumes \"P is NSRD\"\n shows \"\\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P))) = P\"\n by (metis Healthy_def NSRD_form assms)\n\nlemma NSRD_intro:\n assumes \"P is SRD\" \"(\\ pre\\<^sub>R(P)) ;; R1(true) = (\\ pre\\<^sub>R(P))\" \"$st\\ \\ peri\\<^sub>R(P)\"\n shows \"P is NSRD\"\nproof -\n have \"NSRD(P) = \\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P)))\"\n by (simp add: NSRD_form)\n also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R P \\ peri\\<^sub>R P \\ post\\<^sub>R P)\"\n by (simp add: assms ex_unrest)\n also have \"... = P\"\n by (simp add: SRD_reactive_tri_design assms(1))\n finally show ?thesis\n using Healthy_def by blast\nqed\n\nlemma SRD_RD3_implies_NSRD:\n \"\\ P is SRD; P is RD3 \\ \\ P is NSRD\"\n by (metis (no_types, lifting) Healthy_def NSRD_def RHS_idem SRD_healths(4) SRD_reactive_design comp_apply)\n\nlemma NSRD_neg_pre_unit:\n assumes \"P is NSRD\"\n shows \"(\\ pre\\<^sub>R(P)) ;; R1(true) = (\\ pre\\<^sub>R(P))\"\nproof -\n have \"(\\ pre\\<^sub>R(P)) = (\\ pre\\<^sub>R(\\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P)))))\"\n by (simp add: NSRD_healthy_form assms)\n also have \"... = R1 (R2c ((\\ pre\\<^sub>R P) ;; R1 true))\"\n by (simp add: rea_pre_RHS_design usubst unrest)\n also have \"... = ((\\ pre\\<^sub>R P) ;; R1 true)\"\n by (metis R1_seqr R2_R2c_def R2_def R2c_seq R2s_true calculation)\n finally show ?thesis ..\nqed\n\nlemma NSRD_st'_unrest_peri:\n assumes \"P is NSRD\"\n shows \"$st\\ \\ peri\\<^sub>R(P)\"\nproof -\n have \"peri\\<^sub>R(P) = peri\\<^sub>R(\\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P))))\"\n by (simp add: NSRD_healthy_form assms)\n also have \"... = R1 (R2c (\\ (\\ pre\\<^sub>R P) ;; R1 true \\ (\\ $st\\ \\ peri\\<^sub>R P)))\"\n by (simp add: rea_peri_RHS_design usubst unrest)\n also have \"$st\\ \\ ...\"\n by (simp add: R1_def R2c_def unrest)\n finally show ?thesis .\nqed\n\nlemma NSRD_wait'_unrest_pre:\n assumes \"P is NSRD\"\n shows \"$wait\\ \\ pre\\<^sub>R(P)\"\nproof -\n have \"pre\\<^sub>R(P) = pre\\<^sub>R(\\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P))))\"\n by (simp add: NSRD_healthy_form assms)\n also have \"... = (\\ R1 (R2c ((\\ pre\\<^sub>R P) ;; R1 true)))\"\n by (simp add: rea_pre_RHS_design usubst unrest)\n also have \"$wait\\ \\ ...\"\n by (simp add: R1_def R2c_def unrest)\n finally show ?thesis .\nqed\n\nlemma NSRD_st'_unrest_pre:\n assumes \"P is NSRD\"\n shows \"$st\\ \\ pre\\<^sub>R(P)\"\nproof -\n have \"pre\\<^sub>R(P) = pre\\<^sub>R(\\<^bold>R\\<^sub>s((\\ (\\ pre\\<^sub>R(P)) ;; R1 true) \\ ((\\ $st\\ \\ peri\\<^sub>R(P)) \\ post\\<^sub>R(P))))\"\n by (simp add: NSRD_healthy_form assms)\n also have \"... = (\\ R1 (R2c ((\\ pre\\<^sub>R P) ;; R1 true)))\"\n by (simp add: rea_pre_RHS_design usubst unrest)\n also have \"$st\\ \\ ...\"\n by (simp add: R1_def R2c_def unrest)\n finally show ?thesis .\nqed\n\nlemma NSRD_iff:\n \"P is NSRD \\ ((P is SRD) \\ (\\ pre\\<^sub>R(P)) ;; R1(true) = (\\ pre\\<^sub>R(P)) \\ ($st\\ \\ peri\\<^sub>R(P)))\"\n by (meson NSRD_intro NSRD_is_SRD NSRD_neg_pre_unit NSRD_st'_unrest_peri)\n\nlemma NSRD_composition_wp:\n assumes \"P is NSRD\" \"Q is SRD\"\n shows \"P ;; Q =\n \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\ post\\<^sub>R P wp\\<^sub>R pre\\<^sub>R Q) \\ (peri\\<^sub>R P \\ (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\ (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n by (simp add: SRD_composition_wp assms NSRD_is_SRD wpR_def NSRD_neg_pre_unit NSRD_st'_unrest_peri ex_unrest)\n\nlemma RHS_tri_normal_design_composition:\n assumes\n \"$ok\\ \\ P\" \"$ok\\ \\ Q\\<^sub>1\" \"$ok\\ \\ Q\\<^sub>2\" \"$ok \\ R\" \"$ok \\ S\\<^sub>1\" \"$ok \\ S\\<^sub>2\"\n \"$wait \\ R\" \"$wait\\ \\ Q\\<^sub>2\" \"$wait \\ S\\<^sub>1\" \"$wait \\ S\\<^sub>2\"\n \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n \"R1 (\\ P) ;; R1(true) = (\\ P)\" \"$st\\ \\ Q\\<^sub>1\"\n shows \"\\<^bold>R\\<^sub>s(P \\ Q\\<^sub>1 \\ Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\ S\\<^sub>1 \\ S\\<^sub>2)\n = \\<^bold>R\\<^sub>s((P \\ Q\\<^sub>2 wp\\<^sub>R R) \\ (Q\\<^sub>1 \\ (Q\\<^sub>2 ;; S\\<^sub>1)) \\ (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n have \"\\<^bold>R\\<^sub>s(P \\ Q\\<^sub>1 \\ Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\ S\\<^sub>1 \\ S\\<^sub>2) =\n \\<^bold>R\\<^sub>s ((R1 (\\ P) wp\\<^sub>R false \\ Q\\<^sub>2 wp\\<^sub>R R) \\ ((\\ $st\\ \\ Q\\<^sub>1) \\ (Q\\<^sub>2 ;; S\\<^sub>1)) \\ (Q\\<^sub>2 ;; S\\<^sub>2))\"\n by (simp_all add: RHS_tri_design_composition_wp assms unrest)\n also have \"... = \\<^bold>R\\<^sub>s((P \\ Q\\<^sub>2 wp\\<^sub>R R) \\ (Q\\<^sub>1 \\ (Q\\<^sub>2 ;; S\\<^sub>1)) \\ (Q\\<^sub>2 ;; S\\<^sub>2))\"\n by (simp add: assms wpR_def ex_unrest)\n finally show ?thesis .\nqed\n\nlemma NSRD_right_Miracle_tri_lemma:\n assumes \"P is NSRD\"\n shows \"P ;; Miracle = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\ peri\\<^sub>R P \\ false)\"\n by (metis (no_types, lifting) Healthy_if NSRD_iff RD3_def RHS_tri_design_RD3_intro \n RHS_tri_design_right_unit_lemma SRD_right_Miracle_tri_lemma assms ok'_peri_unrest \n ok'_pre_unrest periR_srdes_skip postR_Miracle wait'_post_unrest)\n\nlemma Miracle_right_zero_law:\n assumes \"$ok\\ \\ P\"\n shows \"\\<^bold>R\\<^sub>s(true \\ false \\ P) ;; Miracle = Miracle\"\nproof -\n have \"\\<^bold>R\\<^sub>s(true \\ false \\ P) is SRD\"\n by (simp add: RHS_tri_design_is_SRD assms unrest_false unrest_true)\n hence \"\\<^bold>R\\<^sub>s(true \\ false \\ P) is NSRD\"\n by (rule NSRD_intro, (rel_auto)+)\n thus ?thesis\n by (simp add: NSRD_right_Miracle_tri_lemma rea_pre_RHS_design rea_peri_RHS_design usubst R2c_false R1_false)\n (simp add: Miracle_def wait'_cond_idem)\nqed\n\nlemma NSRD_right_Chaos_tri_lemma:\n assumes \"P is NSRD\"\n shows \"P ;; Chaos = \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\ \\ (post\\<^sub>R P ;; R1 true)) \\ peri\\<^sub>R P \\ false)\"\n by (simp add: SRD_right_Chaos_tri_lemma[OF NSRD_is_SRD[OF assms]] \n NSRD_neg_pre_unit NSRD_st'_unrest_peri assms ex_unrest)\n \nlemma assigns_rea_id: \"\\id\\\\<^sub>R = II\\<^sub>R\"\n by (simp add: srdes_skip_def, rel_auto)\n \nlemma SRD_assigns_rea [closure]: \"\\\\\\\\<^sub>R is SRD\"\n by (simp add: assigns_rea_def RHS_design_is_SRD unrest)\n\nlemma RD3_assigns_rea: \"\\\\\\\\<^sub>R is RD3\"\n by (rule RD3_intro_pre, simp_all add: SRD_assigns_rea preR_assigns_rea periR_assigns_rea unrest)\n\nlemma NSRD_assigns_rea [closure]: \"\\\\\\\\<^sub>R is NSRD\"\n by (simp add: NSRD_iff SRD_assigns_rea periR_assigns_rea preR_assigns_rea unrest_false)\n\nlemma assigns_rea_comp: \"\\\\\\\\<^sub>R ;; \\\\\\\\<^sub>R = \\\\ \\ \\\\\\<^sub>R\"\nproof -\n have a: \"(($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S) ;; ($tr\\ =\\<^sub>u $tr \\ \\\\\\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S)) =\n ($tr\\ =\\<^sub>u $tr \\ \\\\\\ \\ \\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S)\"\n by (rel_auto)\n have \"\\\\\\\\<^sub>R ;; \\\\\\\\<^sub>R = \\<^bold>R\\<^sub>s (true \\ false \\ ($tr\\ =\\<^sub>u $tr \\ \\\\\\ \\ \\\\\\<^sub>a\\\\<^sub>S \\ $\\\\<^sub>S\\ =\\<^sub>u $\\\\<^sub>S))\"\n by (simp add: NSRD_composition_wp closure preR_assigns_rea periR_assigns_rea postR_assigns_rea wp a)\n also have \"... = \\\\ \\ \\\\\\<^sub>R\"\n by (simp add: assigns_rea_RHS_tri_des)\n finally show ?thesis .\nqed\n\ntext {* Stateful reactive designs are left unital *}\n\noverloading\n srdes_unit == \"utp_unit :: (SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ ('s,'t,'\\) hrel_rsp\"\nbegin\n definition srdes_unit :: \"(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ ('s,'t,'\\) hrel_rsp\" where\n \"srdes_unit T = II\\<^sub>R\"\nend\n\ninterpretation srdes_left_unital: utp_theory_left_unital SRDES\n by (unfold_locales, simp_all add: srdes_hcond_def srdes_unit_def SRD_seqr_closure SRD_srdes_skip SRD_left_unit)\n\ntext {* Stateful reactive designs and assignment *}\n\noverloading\n srdes_pvar == \"pvar :: (SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ 's \\ ('s,'t,'\\) rsp\"\n srdes_pvar_assigns == \"pvar_assigns :: (SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ 's usubst \\ ('s,'t,'\\) hrel_rsp\"\nbegin\n definition srdes_pvar ::\n \"(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ 's \\ ('s,'t,'\\) rsp\" where\n [upred_defs]: \"srdes_pvar T = st\"\n definition srdes_pvar_assigns ::\n \"(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp) uthy \\ 's usubst \\ ('s,'t,'\\) hrel_rsp\" where\n [upred_defs]: \"srdes_pvar_assigns T \\ = \\\\\\\\<^sub>R\"\nend\n\ninterpretation srdes_local_var: utp_local_var \"UTHY(SRDES, ('s,'t::ordered_cancel_monoid_diff,'\\) rsp)\" \"TYPE('s)\"\nproof -\n interpret vw: vwb_lens \"pvar SRDES :: 's \\ ('s,'t,'\\) rsp\"\n by (simp add: srdes_pvar_def)\n show \"utp_local_var TYPE('s) UTHY(SRDES, ('s,'t,'\\) rsp)\"\n proof\n show \"\\\\::'s \\ 's. \\<^bold>\\\\\\<^bold>\\\\<^bsub>UTHY(SRDES, ('s,'t,'\\) rsp)\\<^esub> is \\\\<^bsub>SRDES\\<^esub>\"\n by (simp add: srdes_pvar_assigns_def srdes_hcond_def SRD_assigns_rea)\n show \"\\(\\::'s \\ 's) \\. \\<^bold>\\\\\\<^bold>\\\\<^bsub>UTHY(SRDES, ('s,'t,'\\) rsp)\\<^esub> ;; \\<^bold>\\\\\\<^bold>\\\\<^bsub>SRDES\\<^esub> = \\<^bold>\\\\ \\ \\\\<^bold>\\\\<^bsub>SRDES\\<^esub>\"\n by (simp add: srdes_pvar_assigns_def assigns_rea_comp)\n show \"\\<^bold>\\id::'s \\ 's\\<^bold>\\\\<^bsub>UTHY(SRDES, ('s,'t,'\\) rsp)\\<^esub> = \\\\\\<^bsub>SRDES\\<^esub>\"\n by (simp add: srdes_pvar_assigns_def srdes_unit_def assigns_rea_id)\n qed\nqed\n\nsubsection {* Reactive design parallel-by-merge *}\n\ndefinition [upred_defs]: \"nil\\<^sub>r\\<^sub>m = (nil\\<^sub>m \\ $0-ok \\ $1-ok \\ ($tr\\<^sub>< \\\\<^sub>u $tr\\))\"\n\ntext {* @{term \"nil\\<^sub>r\\<^sub>m\"} is the parallel system which does nothing if the parallel predicates have both\n terminated ($0.ok \\wedge 1.ok$), and otherwise guarantees only the merged trace gets longer. *}\n\ndefinition [upred_defs]: \"div\\<^sub>m = ($tr \\\\<^sub>u $0-tr\\ \\ $tr \\\\<^sub>u $1-tr\\ \\ $\\\\<^sub><\\ =\\<^sub>u $\\)\"\n\ntext {* @{term \"div\\<^sub>m\"} is the parallel system where both sides traces get longer than the initial\n trace and identifies the before values of the variables. *}\n\ndefinition [upred_defs]: \"wait\\<^sub>m = (((\\ $st \\ \\II\\\\<^sub>0) \\ (\\ $st \\ \\II\\\\<^sub>1) \\ $\\\\<^sub><\\ =\\<^sub>u $\\)\\true,true/$ok,$wait\\)\"\n\ntext {* @{term \"wait\\<^sub>m\"} is the parallel system where ok and wait are both true and all other variables\n are identified, except for the state which is hidden in both the left and right.*}\n\ntext {* R3h implicitly depends on RD1, and therefore it requires that both sides be RD1. We also\n require that both sides are R3c, and that @{term \"wait\\<^sub>m\"} is a quasi-unit, and @{term \"div\\<^sub>m\"} yields\n divergence. *}\n\nlemma st_U0_alpha: \"\\\\ $st \\ II\\\\<^sub>0 = (\\ $st \\ \\II\\\\<^sub>0)\"\n by (rel_auto)\n\nlemma st_U1_alpha: \"\\\\ $st \\ II\\\\<^sub>1 = (\\ $st \\ \\II\\\\<^sub>1)\"\n by (rel_auto)\n\nlemma U0_skip: \"\\II\\\\<^sub>0 = ($0-\\\\ =\\<^sub>u $\\)\"\n by (rel_auto)\n\nlemma U1_skip: \"\\II\\\\<^sub>1 = ($1-\\\\ =\\<^sub>u $\\)\"\n by (rel_auto)\n\nlemma R3h_par_by_merge:\n assumes\n \"P is R1\" \"Q is R1\" \"P is RD1\" \"Q is RD1\" \"P is R3h\" \"Q is R3h\"\n \"(wait\\<^sub>m ;; M) = ((\\ $st \\ II)\\true,true/$ok,$wait\\)\" \"(div\\<^sub>m ;; M) = R1(true)\"\n shows \"(P \\\\<^bsub>M\\<^esub> Q) is R3h\"\nproof -\n have \"(P \\\\<^bsub>M\\<^esub> Q) = (((P \\\\<^bsub>M\\<^esub> Q)\\true/$ok\\ \\ $ok \\ (P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\)\\true/$wait\\ \\ $wait \\ (P \\\\<^bsub>M\\<^esub> Q))\"\n by (simp add: cond_idem cond_var_subst_left cond_var_subst_right)\n also have \"... = (((P \\\\<^bsub>M\\<^esub> Q)\\true,true/$ok,$wait\\ \\ $ok \\ (P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\)\\true/$wait\\ \\ $wait \\ (P \\\\<^bsub>M\\<^esub> Q))\"\n by (rel_auto)\n also have \"... = (((P \\\\<^bsub>M\\<^esub> Q)\\true,true/$ok,$wait\\ \\ $ok \\ (P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\) \\ $wait \\ (P \\\\<^bsub>M\\<^esub> Q))\"\n by (simp add: cond_var_subst_left)\n also have \"... = (((\\ $st \\ II)\\true,true/$ok,$wait\\ \\ $ok \\ R1(true)) \\ $wait \\ (P \\\\<^bsub>M\\<^esub> Q))\"\n proof -\n have \"(P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\ = R1(true)\"\n proof -\n have \"(P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\ = ((P \\ $ok \\ R1(true)) \\\\<^bsub>M\\<^esub> (Q \\ $ok \\ R1(true)))\\false/$ok\\\"\n by (metis RD1_alt_def Healthy_if assms)\n also have \"... = (R1(true) \\\\<^bsub>M\\false/$ok\\<^sub><\\\\<^esub> R1(true))\"\n by (rel_auto, metis, metis)\n also have \"... = (div\\<^sub>m ;; M)\\false/$ok\\\"\n by (rel_auto, metis, metis)\n also have \"... = (R1(true))\\false/$ok\\\"\n by (simp add: assms(8))\n also have \"... = (R1(true))\"\n by (rel_auto)\n finally show ?thesis\n by simp\n qed\n moreover have \"(P \\\\<^bsub>M\\<^esub> Q)\\true,true/$ok,$wait\\ = (\\ $st \\ II)\\true,true/$ok,$wait\\\"\n proof -\n have \"(P \\\\<^bsub>M\\<^esub> Q)\\true,true/$ok,$wait\\ = (P\\true,true/$ok,$wait\\ \\\\<^bsub>M\\<^esub> Q\\true,true/$ok,$wait\\)\\true,true/$ok,$wait\\\"\n by (rel_auto)\n also have \"... = ((((\\ $st \\ II) \\ $ok \\ R1(true)) \\ $wait \\ P)\\true,true/$ok,$wait\\ \\\\<^bsub>M\\<^esub> (((\\ $st \\ II) \\ $ok \\ R1(true)) \\ $wait \\ Q)\\true,true/$ok,$wait\\)\\true,true/$ok,$wait\\\"\n by (metis Healthy_def' R3h_cases assms(5) assms(6))\n also have \"... = ((\\ $st \\ II)\\true,true/$ok,$wait\\ \\\\<^bsub>M\\<^esub> (\\ $st \\ II)\\true,true/$ok,$wait\\)\\true,true/$ok,$wait\\\"\n by (subst_tac)\n also have \"... = ((\\ $st \\ II) \\\\<^bsub>M\\<^esub> (\\ $st \\ II))\\true,true/$ok,$wait\\\"\n by (simp add: par_by_merge_def usubst)\n also have \"... = (((\\ $st \\ \\II\\\\<^sub>0) \\ (\\ $st \\ \\II\\\\<^sub>1) \\ $\\\\<^sub><\\ =\\<^sub>u $\\) ;; M)\\true,true/$ok,$wait\\\"\n by (simp add: par_by_merge_def U0_as_alpha U1_as_alpha alpha st_U0_alpha st_U1_alpha skip\\<^sub>m_def)\n also have \"... = (wait\\<^sub>m ;; M)\\true,true/$ok,$wait\\\"\n by (rel_auto)\n also have \"... = (\\ $st \\ II)\\true,true/$ok,$wait\\\"\n by (simp add: assms usubst)\n finally show ?thesis .\n qed\n ultimately show ?thesis by simp\n qed\n also have \"... = (((\\ $st \\ II) \\ $ok \\ R1(true)) \\ $wait \\ (P \\\\<^bsub>M\\<^esub> Q))\"\n by (rel_auto)\n also have \"... = R3h(P \\\\<^bsub>M\\<^esub> Q)\"\n by (simp add: R3h_cases)\n finally show ?thesis\n by (simp add: Healthy_def')\nqed\n\nlemma RD1_par_by_merge:\n assumes \"P is R1\" \"Q is R1\" \"P is RD1\" \"Q is RD1\" \"M is R1m\" \"(div\\<^sub>m ;; M) = R1(true)\"\n shows \"(P \\\\<^bsub>M\\<^esub> Q) is RD1\"\nproof -\n have \"(P \\\\<^bsub>M\\<^esub> Q) = ((P \\\\<^bsub>M\\<^esub> Q) \\ $ok \\ (P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\)\"\n by (simp add: cond_idem cond_var_subst_right)\n also have \"... = ((P \\\\<^bsub>M\\<^esub> Q) \\ $ok \\ R1(true))\"\n proof -\n have \"(P \\\\<^bsub>M\\<^esub> Q)\\false/$ok\\ = ((P \\ $ok \\ R1(true)) \\\\<^bsub>M\\<^esub> (Q \\ $ok \\ R1(true)))\\false/$ok\\\"\n by (metis RD1_alt_def Healthy_if assms)\n also have \"... = (R1(true) \\\\<^bsub>M\\false/$ok\\<^sub><\\\\<^esub> R1(true))\"\n by (rel_auto, metis, metis)\n also have \"... = (div\\<^sub>m ;; M)\\false/$ok\\\"\n by (rel_auto, metis, metis)\n also have \"... = (R1(true))\\false/$ok\\\"\n by (simp add: assms(6))\n also have \"... = (R1(true))\"\n by (rel_auto)\n finally show ?thesis\n by simp\n qed\n finally show ?thesis\n by (metis RD1_alt_def Healthy_def R1_par_by_merge assms(5))\nqed\n\nlemma RD2_par_by_merge:\n assumes \"M is RD2\"\n shows \"(P \\\\<^bsub>M\\<^esub> Q) is RD2\"\nproof -\n have \"(P \\\\<^bsub>M\\<^esub> Q) = ((P \\\\<^sub>s Q) ;; M)\"\n by (simp add: par_by_merge_def)\n also from assms have \"... = ((P \\\\<^sub>s Q) ;; (M ;; J))\"\n by (simp add: Healthy_def' RD2_def H2_def)\n also from assms have \"... = (((P \\\\<^sub>s Q) ;; M) ;; J)\"\n by (meson seqr_assoc)\n also from assms have \"... = RD2(P \\\\<^bsub>M\\<^esub> Q)\"\n by (simp add: RD2_def H2_def par_by_merge_def)\n finally show ?thesis\n by (simp add: Healthy_def')\nqed\n\nsubsection {* Simple parallel composition *}\n\ndefinition rea_design_par ::\n \"('s, 't::ordered_cancel_monoid_diff, '\\) hrel_rsp \\ ('s, 't, '\\) hrel_rsp \\ ('s, 't, '\\) hrel_rsp\" (infixr \"\\\\<^sub>R\" 85)\nwhere [upred_defs]: \"P \\\\<^sub>R Q = \\<^bold>R\\<^sub>s((pre\\<^sub>R(P) \\ pre\\<^sub>R(Q)) \\ (cmt\\<^sub>R(P) \\ cmt\\<^sub>R(Q)))\"\n\nlemma RHS_design_par:\n assumes\n \"$ok\\ \\ P\\<^sub>1\" \"$ok\\ \\ P\\<^sub>2\"\n shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\ Q\\<^sub>1) \\\\<^sub>R \\<^bold>R\\<^sub>s(P\\<^sub>2 \\ Q\\<^sub>2) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ (Q\\<^sub>1 \\ Q\\<^sub>2))\"\nproof -\n have \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\ Q\\<^sub>1) \\\\<^sub>R \\<^bold>R\\<^sub>s(P\\<^sub>2 \\ Q\\<^sub>2) =\n \\<^bold>R\\<^sub>s(P\\<^sub>1\\true,false/$ok,$wait\\ \\ Q\\<^sub>1\\true,false/$ok,$wait\\) \\\\<^sub>R \\<^bold>R\\<^sub>s(P\\<^sub>2\\true,false/$ok,$wait\\ \\ Q\\<^sub>2\\true,false/$ok,$wait\\)\"\n by (simp add: RHS_design_ok_wait)\n\n also from assms\n have \"... =\n \\<^bold>R\\<^sub>s((\\ R1 (R2c (\\ P\\<^sub>1)) \\ \\ R1 (R2c (\\ P\\<^sub>2)))\\true,false/$ok,$wait\\ \\\n (R1 (R2c (P\\<^sub>1 \\ Q\\<^sub>1)) \\ R1 (R2c (P\\<^sub>2 \\ Q\\<^sub>2)))\\true,false/$ok,$wait\\)\"\n apply (simp add: rea_design_par_def rea_pre_RHS_design rea_cmt_RHS_design usubst unrest assms)\n apply (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp)\n using assms apply (rel_auto)\n done\n also have \"... =\n \\<^bold>R\\<^sub>s((\\ R2c (\\ P\\<^sub>1) \\ \\ R2c (\\ P\\<^sub>2)) \\\n (R1 (R2s (P\\<^sub>1 \\ Q\\<^sub>1)) \\ R1 (R2s (P\\<^sub>2 \\ Q\\<^sub>2))))\"\n by (metis (no_types, lifting) R1_R2s_R2c R1_disj RHS_design_neg_R1_pre RHS_design_ok_wait utp_pred.compl_sup)\n also have \"... =\n \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ (R1 (R2s (P\\<^sub>1 \\ Q\\<^sub>1)) \\ R1 (R2s (P\\<^sub>2 \\ Q\\<^sub>2))))\"\n by (simp add: R2c_R3h_commute R2c_and R2c_design R2c_idem R2c_not RHS_def)\n also have \"... = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ ((P\\<^sub>1 \\ Q\\<^sub>1) \\ (P\\<^sub>2 \\ Q\\<^sub>2)))\"\n by (metis (no_types, lifting) R1_conj R2s_conj RHS_design_export_R1 RHS_design_export_R2s)\n also have \"... = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ (Q\\<^sub>1 \\ Q\\<^sub>2))\"\n by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n finally show ?thesis .\nqed\n\nlemma RHS_tri_design_par:\n assumes \"$ok\\ \\ P\\<^sub>1\" \"$ok\\ \\ P\\<^sub>2\"\n shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\ Q\\<^sub>1 \\ R\\<^sub>1) \\\\<^sub>R \\<^bold>R\\<^sub>s(P\\<^sub>2 \\ Q\\<^sub>2 \\ R\\<^sub>2) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\ P\\<^sub>2) \\ (Q\\<^sub>1 \\ Q\\<^sub>2) \\ (R\\<^sub>1 \\ R\\<^sub>2))\"\n by (simp add: RHS_design_par assms unrest wait'_cond_conj_exchange)\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/theories/utp_rea_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.2715969707161612}} {"text": "(* Title: Isabelle Collections Library\n Author: Peter Lammich \n Maintainer: Peter Lammich \n*)\nsection \\\\isaheader{Map Implementation by Associative Lists}\\\ntheory ListMapImpl\nimports \n \"../spec/MapSpec\" \n \"../../Lib/Assoc_List\" \n \"../gen_algo/MapGA\"\nbegin\ntext_raw \\\\label{thy:ListMapImpl}\\\n\n(*@impl Map\n @type 'a lm\n @abbrv lm,l\n Maps implemented by associative lists. If you need efficient \n @{text \"insert_dj\"} operation, you should use list sets with explicit \n invariants (lmi).\n*)\n\ntype_synonym ('k,'v) lm = \"('k,'v) assoc_list\"\n\ndefinition [icf_rec_def]: \"lm_basic_ops \\ \\\n bmap_op_\\ = Assoc_List.lookup,\n bmap_op_invar = \\_. True,\n bmap_op_empty = (\\_::unit. Assoc_List.empty),\n bmap_op_lookup = (\\k m. Assoc_List.lookup m k),\n bmap_op_update = Assoc_List.update,\n bmap_op_update_dj = Assoc_List.update,\n bmap_op_delete = Assoc_List.delete,\n bmap_op_list_it = Assoc_List.iteratei\n\\\"\n\nsetup Locale_Code.open_block\ninterpretation lm_basic: StdBasicMapDefs lm_basic_ops .\ninterpretation lm_basic: StdBasicMap lm_basic_ops\n apply unfold_locales\n apply (simp_all add: icf_rec_unf \n Assoc_List.lookup_empty' Assoc_List.iteratei_correct map_upd_eq_restrict)\n done\nsetup Locale_Code.close_block\n\ndefinition [icf_rec_def]: \"lm_ops \\ lm_basic.dflt_ops\"\nsetup Locale_Code.open_block\ninterpretation lm: StdMapDefs lm_ops .\ninterpretation lm: StdMap lm_ops \n unfolding lm_ops_def\n by (rule lm_basic.dflt_ops_impl)\ninterpretation lm: StdMap_no_invar lm_ops \n by unfold_locales (simp add: icf_rec_unf)\nsetup Locale_Code.close_block\n\nsetup \\ICF_Tools.revert_abbrevs \"lm\"\\\n\nlemma pi_lm[proper_it]: \n \"proper_it' Assoc_List.iteratei Assoc_List.iteratei\"\n unfolding Assoc_List.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm: proper_it_loc Assoc_List.iteratei Assoc_List.iteratei\n apply unfold_locales\n apply (rule pi_lm)\n done\n\nlemma pi_lm'[proper_it]: \n \"proper_it' lm.iteratei lm.iteratei\"\n unfolding lm.iteratei_def[abs_def]\n by (intro icf_proper_iteratorI proper_it'I)\n\ninterpretation pi_lm': proper_it_loc lm.iteratei lm.iteratei\n apply unfold_locales\n apply (rule pi_lm')\n done\n\n\ntext \\Code generator test\\\ndefinition \"test_codegen \\ (\n lm.add ,\n lm.add_dj ,\n lm.ball ,\n lm.bex ,\n lm.delete ,\n lm.empty ,\n lm.isEmpty ,\n lm.isSng ,\n lm.iterate ,\n lm.iteratei ,\n lm.list_it ,\n lm.lookup ,\n lm.restrict ,\n lm.sel ,\n lm.size ,\n lm.size_abort ,\n lm.sng ,\n lm.to_list ,\n lm.to_map ,\n lm.update ,\n lm.update_dj)\"\n\nexport_code test_codegen checking SML\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/impl/ListMapImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2715969707161611}} {"text": "section \\Array of Array Lists\\\ntheory Array_of_Array_List\nimports LLVM_DS_Array_List\nbegin\n\n\nsubsection \\Arrays that own their Elements\\\n\n\n definition \"idxe_map l i \\ if i m \\\\<^sub>m idxe_map l \\ m(i\\l!i) \\\\<^sub>m idxe_map l\"\n unfolding idxe_map_def map_le_def by (auto split: if_splits)\n \n lemma le_idxe_map_delD: \"m \\\\<^sub>m idxe_map l \\ m(i:=None) \\\\<^sub>m idxe_map (l[i:=x])\"\n unfolding idxe_map_def map_le_def by (auto split: if_splits)\n \n lemma le_idxe_map_delD': \"m \\\\<^sub>m idxe_map l \\ m(i:=None) \\\\<^sub>m idxe_map l\"\n unfolding idxe_map_def map_le_def by (auto split: if_splits)\n \n lemma le_idxe_mapD: \"m \\\\<^sub>m idxe_map l \\ i m i = Some xi \\ l!i = xi\" \n unfolding idxe_map_def map_le_def \n apply (clarsimp split: if_splits) by (metis domI option.inject)\n \n \n definition \"nao_assn A R \\ mk_assn (\\xss a. EXS xs. \n \\narray_assn xs a \n ** \\(length xs = length xss) \n ** \\(R \\\\<^sub>m idxe_map xs)\n ** (\\*i\\{0..A (xss!i) (xs!i)) \n )\"\n\n definition [llvm_inline]: \"nao_new TYPE('a::llvm_rep) n \\ narray_new TYPE('a) n\"\n\n \n lemma nao_repl_init_aux: \n assumes [fri_rules]: \"\\ \\ \\A x init\"\n shows \"\\ \\ (\\*i\\{0..A x init)\" \n unfolding vcg_tag_defs\n apply (induction n)\n subgoal by simp\n subgoal for n \n proof (simp add: atLeast0_lessThan_Suc del: replicate_Suc, goal_cases)\n case 1 note [fri_rules] = 1(1)\n show ?case by (rule ENTAILSD) vcg\n qed \n done\n \n \n lemma nao_new_init_rl:\n assumes \"\\ \\ \\A x init\"\n shows \"llvm_htriple (\\snat.assn n ni) (nao_new TYPE('a::llvm_rep) ni) (\\a. \\(nao_assn A Map.empty) (replicate n x) a)\"\n unfolding nao_assn_def nao_new_def\n supply [fri_rules] = nao_repl_init_aux[OF assms]\n by vcg\n\n definition [llvm_code, llvm_inline]: \"nao_nth a i \\ array_nth a i\" \n \n lemma nao_nth_aux: \n assumes \"iR\" \n shows \"sep_set_img ({0..dom m \\ m i = None\" by auto\n \n lemma nao_nth_rule[vcg_rules]: \"llvm_htriple \n (\\(nao_assn A R) xs a ** \\snat.assn i ii ** \\(i i\\dom R)) \n (nao_nth a ii) \n (\\xi. \\(nao_assn A (R(i\\xi))) xs a ** \\A (xs!i) xi)\"\n unfolding nao_assn_def nao_nth_def\n supply fri_red_img[fri_red_rules]\n supply nao_nth_aux[simp]\n supply ndomIff[simp] le_idxe_map_updI[simp]\n by vcg\n \n \n definition [llvm_code, llvm_inline]: \"nao_upd a i x \\ array_upd a i x\" \n\n lemma nao_upd_aux: \n fixes I xs\n defines \"I \\ {0..I\" \"i\\R\" and [simp]: \"length xsi = length xs\"\n shows \"(\\*j\\I - (R - {i}). \\A (xs[i := x] ! j) (xsi[i := xi] ! j)) = (\\A x xi ** (\\*j\\I - R. \\A (xs ! j) (xsi ! j)))\"\n proof -\n from assms have 1: \"I - (R - {i}) = insert i (I-R)\" by auto\n from assms have [simplified,simp]: \"i\\I-R\" by auto\n have [simp]: \"ii\\I\\ unfolding I_def by auto\n have [simp]: \"j\\I-R \\ i\\j\" for j using \\i\\R\\ by auto\n show ?thesis apply (subst 1) by simp\n qed \n \n term restrict_map\n \n lemma nao_upd_rule[vcg_rules]: \"llvm_htriple\n (\\(nao_assn A R) xs a ** \\A x xi ** \\snat.assn i ii ** \\(i i\\dom R))\n (nao_upd a ii xi)\n (\\a'. \\(a'=a) ** \\(nao_assn A (R(i:=None))) (xs[i:=x]) a)\"\n unfolding nao_assn_def nao_upd_def\n supply nao_upd_aux[simp] le_idxe_map_delD[simp] domI[simp]\n by vcg\n \n definition [llvm_code, llvm_inline]: \"nao_rejoin a i \\ return ()\" \n \n lemma nao_rejoin_aux: \"i {0..(nao_assn A R) xs a ** \\A x xi ** \\(x=xs!i) ** \\snat.assn i ii ** \\(i R i = Some xi))\n (nao_rejoin a ii)\n (\\_. \\(nao_assn A (R(i:=None))) xs a)\"\n unfolding nao_rejoin_def nao_assn_def\n supply [simp] = le_idxe_map_delD' nao_rejoin_aux domI le_idxe_mapD\n by vcg\n \n \n definition [llvm_inline]: \"nao_open a \\ return ()\" \n \n lemma nao_open_rl[vcg_rules]: \"llvm_htriple (\\(nao_assn A R) xss a) (nao_open a) (\\_. \n EXS xs. \n \\narray_assn xs a \n ** \\(length xs = length xss) \n ** \\(R \\\\<^sub>m idxe_map xs)\n ** (\\*i\\{0..A (xss!i) (xs!i)) \n )\"\n unfolding nao_open_def nao_assn_def by vcg\n \n \n \n definition [llvm_inline]: \"nao_free free a len \\ doM {\n llc_while \n (\\i. ll_icmp_slt i len)\n (\\i. doM {\n x \\ nao_nth a i;\n free x;\n i \\ ll_add i (signed_nat 1);\n return i\n })\n (signed_nat 0);\n \n nao_open a;\n narray_free a\n }\"\n \n definition \"iseg_map n f (i::nat) \\ if i x) = iseg_map (Suc n) (f(n:=x))\" \n apply (intro ext)\n by (auto simp: iseg_map_def restrict_map_def)\n \n lemma iseg_map_dom[simp]: \"dom (iseg_map n f) = {0..x xi. llvm_htriple (\\A x xi) (free xi) (\\_. \\)\"\n shows \"llvm_htriple \n (\\(nao_assn A Map.empty) xs a ** \\snat.assn l li ** \\(l = length xs)) \n (nao_free free a li) \n (\\_. \\)\" \n unfolding nao_free_def\n apply (rewrite annotate_llc_while[where \n I=\"\\ii t. EXS f i. \\snat.assn i ii ** \\(nao_assn A (iseg_map i f)) xs a ** \\(i\\length xs) ** \\\\<^sub>!(t = length xs - i)\"\n and R=\"less_than\"]\n )\n supply [simp] = iseg_map_upd_end_eq \n apply vcg_monadify\n by vcg\n\n\n subsection \\Array of Array Lists\\ \n\n type_synonym ('ll,'a,'l) array_array_list = \"'ll word \\ ('a,'l) array_list ptr\"\n\n definition \"aal_assn \\ mk_assn (\\xs (ni,a). \n \\snat.assn (length xs) ni ** \\(nao_assn arl_assn Map.empty) xs a)\"\n\n abbreviation \"aal_assn' TYPE('ll::len2) TYPE('a::llvm_rep) TYPE('l::len2) \\ aal_assn :: (_,('ll,'a,'l) array_array_list) dr_assn\"\n \n \n definition [llvm_code,llvm_inline]: \"aal_new_raw n \\ doM {\n a\\nao_new TYPE(('a::llvm_rep,'l::len2) array_list) n;\n return (n,a)\n }\"\n \n (*abbreviation \"aal_new TYPE('ll::len2) TYPE('a::llvm_rep) TYPE('l::len2) n \\ aal_new_raw n :: ('ll,'a,'l) array_array_list llM\"*)\n\n lemma snat_z_z_init[fri_rules]: \"\\ \\ \\\\<^sub>psnat.assn 0 0\"\n unfolding snat.assn_def \n by (auto simp: snat_invar_def sep_algebra_simps) \n \n lemma narray_assn_null_init[fri_rules]: \"\\ \\ \\narray_assn [] null\" \n unfolding narray_assn_def\n by (auto simp: sep_algebra_simps)\n \n thm fri_rules \n \n lemma arl_init: \"PRECOND (SOLVE_AUTO (4 \\ \\ \\arl_assn [] (init::('a::llvm_rep,'l::len2) array_list)\" \n unfolding arl_assn_def arl_assn'_def vcg_tag_defs\n apply simp \n apply (rule ENTAILSD)\n apply vcg\n done\n\n lemma aal_new_rl[vcg_rules]: \"llvm_htriple \n (\\snat.assn n ni ** \\(4p. \\(aal_assn' TYPE('ll::len2) TYPE('a::llvm_rep) TYPE('l::len2)) (replicate n []) p)\n \"\n unfolding aal_assn_def aal_new_raw_def\n supply [vcg_rules] = nao_new_init_rl[OF arl_init]\n by vcg\n \n definition aal_push_back :: \"('l::len2,'a::llvm_rep,'ll::len2) array_array_list \\ 'li::len word \\ 'a \\ ('l,'a,'ll) array_array_list llM\"\n where [llvm_code, llvm_inline]: \"aal_push_back na i x \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n aa \\ arl_push_back aa x;\n a \\ nao_upd a i aa;\n return (n,a)\n }\" \n\n lemma aal_push_back_rl[vcg_rules]:\n fixes a :: \"('ll::len2,'a::llvm_rep,'l::len2) array_array_list\"\n shows \"llvm_htriple \n (\\aal_assn xss a ** \\snat.assn i ii ** \\(i length (xss!i) + 1 < max_snat LENGTH('l)))\n (aal_push_back a ii x)\n (\\a. \\aal_assn (xss[i:=(xss!i) @ [x]]) a)\n \"\n unfolding aal_assn_def aal_push_back_def\n by vcg\n \n definition [llvm_code, llvm_inline]: \"aal_pop_back na i \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n (r,aa) \\ arl_pop_back aa;\n a \\ nao_upd a i aa;\n return (r,(n,a))\n }\"\n\n lemma aal_pop_back_rl[vcg_rules]:\n fixes a :: \"('ll::len2,'a::llvm_rep,'l::len2) array_array_list\"\n shows \"llvm_htriple \n (\\aal_assn xss a ** \\snat.assn i ii ** \\(i xss!i \\ []))\n (aal_pop_back a ii)\n (\\(x,a). \\aal_assn (xss[i:=butlast (xss!i)]) a ** \\(x = last (xss!i)))\n \"\n unfolding aal_assn_def aal_pop_back_def\n by vcg\n \n \n definition [llvm_code, llvm_inline]: \"aal_idx na i j \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n r \\ arl_nth aa j;\n nao_rejoin a i;\n return r\n }\" \n \n lemma aal_idx_rl[vcg_rules]: \"llvm_htriple \n (\\aal_assn xss a ** \\snat.assn i ii ** \\snat.assn j jj ** \\(i jx. \\aal_assn xss a ** \\(x = xss!i!j))\"\n unfolding aal_assn_def aal_idx_def\n by vcg\n \n definition [llvm_code, llvm_inline]: \"aal_upd na i j x \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n aa \\ arl_upd aa j x;\n a \\ nao_upd a i aa;\n return (n,a)\n }\"\n\n lemma aal_upd_rl[vcg_rules]:\n fixes a :: \"('ll::len2,'a::llvm_rep,'l::len2) array_array_list\"\n shows \"llvm_htriple \n (\\aal_assn xss a ** \\snat.assn i ii ** \\snat.assn j jj ** \\(i j < length (xss!i)))\n (aal_upd a ii jj x)\n (\\a. \\aal_assn (xss[i:=(xss!i)[j:=x]]) a)\n \"\n unfolding aal_assn_def aal_upd_def\n by vcg\n \n \n \n \n \n definition [llvm_code, llvm_inline]: \"aal_llen na i \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n r \\ arl_len aa;\n nao_rejoin a i;\n return r\n }\" \n \n lemma aal_llen_rl[vcg_rules]: \"llvm_htriple \n (\\aal_assn xss a ** \\snat.assn i ii ** \\(ixi. EXS x. \\aal_assn xss a **\\snat.assn x xi ** \\(x = length (xss!i)))\"\n unfolding aal_assn_def aal_llen_def\n by vcg\n \n definition [llvm_code, llvm_inline]: \"aal_len na \\ doM {\n let (n,a) = na;\n return n\n }\" \n \n lemma aal_len_rl[vcg_rules]: \"llvm_htriple\n (\\aal_assn xss a)\n (aal_len a)\n (\\ni. \\aal_assn xss a ** \\snat.assn (length xss) ni)\"\n unfolding aal_len_def aal_assn_def \n by vcg\n\n definition [llvm_code, llvm_inline]: \"aal_take na i l \\ doM {\n let (n,a) = na;\n aa \\ nao_nth a i;\n aa \\ arl_take l aa;\n a \\ nao_upd a i aa;\n return (n,a)\n }\" \n\n lemma aal_take_rl[vcg_rules]: \"llvm_htriple\n (\\aal_assn xss a ** \\snat.assn i ii ** \\snat.assn l li ** \\(i l \\ length (xss!i)))\n (aal_take a ii li)\n (\\a. \\aal_assn (xss[i := take l (xss!i)]) a)\"\n unfolding aal_assn_def aal_take_def\n by vcg\n \n \n definition [llvm_code]: \"aal_free na \\ doM {\n let (n,a) = na;\n nao_free arl_free a n\n }\"\n \n \n lemma aal_free_rl[vcg_rules]: \"llvm_htriple \n (\\aal_assn xss a) \n (aal_free a) \n (\\_. \\)\"\n unfolding aal_assn_def aal_free_def\n supply [vcg_rules] = nao_free_rl[OF arl_free_rule] \n by vcg\n \n \n \n export_llvm\n \"aal_new_raw :: 64 word \\ (64,8 word,64) array_array_list llM\"\n \"aal_push_back :: (64,8 word,64) array_array_list \\ 64 word \\ 8 word \\ (64,8 word,64) array_array_list llM\" \n \"aal_pop_back :: (64,8 word,64) array_array_list \\ 64 word \\ (8 word \\ (64,8 word,64) array_array_list) llM\" \n \"aal_idx :: (64,8 word,64) array_array_list \\ 64 word \\ 64 word \\ 8 word llM\" \n \"aal_upd :: (64,8 word,64) array_array_list \\ 64 word \\ 64 word \\ 8 word \\ (64,8 word,64) array_array_list llM\" \n \"aal_llen :: (64,8 word,64) array_array_list \\ 64 word \\ 64 word llM\" \n \"aal_len :: (64,8 word,64) array_array_list \\ 64 word llM\" \n \"aal_free :: (64,8 word,64) array_array_list \\ unit llM\" \n \"aal_take :: (64,8 word,64) array_array_list \\ 64 word \\ 64 word \\ ((64,8 word,64) array_array_list) llM\" \n \n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/ds/Array_of_Array_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2715801847316539}} {"text": "(* Title: BDD\n\n Author: Veronika Ortner and Norbert Schirmer, 2004\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* \nShareRepProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {*Proof of Procedure ShareRep*}\ntheory ShareRepProof imports ProcedureSpecs \"../Simpl/HeapList\" begin\n\nlemma (in ShareRep_impl) ShareRep_modifies:\n shows \"\\\\. \\\\{\\} PROC ShareRep (\\nodeslist, \\p) \n {t. t may_only_modify_globals \\ in [rep]}\"\n apply (hoare_rule HoarePartial.ProcRec1)\n apply (vcg spec=modifies)\n done\n\n\nlemma hd_filter_cons: \n\"\\ i. \\ P (xs ! i) p; i < length xs; \\ no \\ set (take i xs). \\ P no p; \\ a b. P a b = P b a\\\n \\ xs ! i = hd (filter (P p) xs)\"\napply (induct xs)\napply simp\napply (case_tac \"P a p\")\napply simp\napply (case_tac i)\napply simp\napply simp\napply (case_tac i)\napply simp\napply auto\ndone\n\nlemma (in ShareRep_impl) ShareRep_spec_total:\nshows \n \"\\\\ ns. \\,\\\\\\<^sub>t \n \\\\. List \\nodeslist \\next ns \\\n (\\no \\ set ns. no \\ Null \\ \n ((no\\\\low = Null) = (no\\\\high = Null)) \\\n (isLeaf_pt \\p \\low \\high \\ isLeaf_pt no \\low \\high) \\\n no\\\\var = \\p\\\\var) \\ \n \\p \\ set ns\\ \n PROC ShareRep (\\nodeslist, \\p)\n \\ (\\<^bsup>\\\\<^esup>p \\ \\rep = hd (filter (\\ sn. repNodes_eq sn \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\<^bsup>\\\\<^esup>rep) ns)) \\\n (\\pt. pt \\ \\<^bsup>\\\\<^esup>p \\ pt\\\\<^bsup>\\\\<^esup>rep = pt\\\\rep) \\ \n (\\<^bsup>\\\\<^esup>p\\\\rep\\\\<^bsup>\\\\<^esup>var = \\<^bsup>\\\\<^esup>p \\ \\<^bsup>\\\\<^esup>var)\\\"\napply (hoare_rule HoareTotal.ProcNoRec1)\napply (hoare_rule anno= \n \"IF (isLeaf_pt \\p \\low \\high) \n THEN \\p \\ \\rep :== \\nodeslist\n ELSE\n WHILE (\\nodeslist \\ Null) \n INV \\\\prx sfx. List \\nodeslist \\next sfx \\ ns=prx@sfx \\ \n \\ isLeaf_pt \\p \\low \\high \\\n (\\no \\ set ns. no \\ Null \\ \n ((no\\\\<^bsup>\\\\<^esup>low = Null) = (no\\\\<^bsup>\\\\<^esup>high = Null)) \\\n (isLeaf_pt \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\ isLeaf_pt no \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high) \\\n no\\\\<^bsup>\\\\<^esup>var = \\<^bsup>\\\\<^esup>p\\\\<^bsup>\\\\<^esup>var) \\ \n \\<^bsup>\\\\<^esup>p \\ set ns \\ \n ((\\pt \\ set prx. repNodes_eq pt \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\<^bsup>\\\\<^esup>rep) \n \\ \\rep \\<^bsup>\\\\<^esup>p = hd (filter (\\ sn. repNodes_eq sn \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\<^bsup>\\\\<^esup>rep) prx) \\\n (\\pt. pt \\ \\<^bsup>\\\\<^esup>p \\ pt\\\\<^bsup>\\\\<^esup>rep = pt\\\\rep)) \\\n ((\\pt \\ set prx. \\ repNodes_eq pt \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\<^bsup>\\\\<^esup>rep) \\ \\<^bsup>\\\\<^esup>rep = \\rep) \\\n (\\nodeslist \\ Null \\ \n (\\pt \\ set prx. \\ repNodes_eq pt \\<^bsup>\\\\<^esup>p \\<^bsup>\\\\<^esup>low \\<^bsup>\\\\<^esup>high \\<^bsup>\\\\<^esup>rep)) \\ \n (\\p = \\<^bsup>\\\\<^esup>p \\ \\high = \\<^bsup>\\\\<^esup>high \\ \\low = \\<^bsup>\\\\<^esup>low)\\\n VAR MEASURE (length (list \\nodeslist \\next)) \n DO\n IF (repNodes_eq \\nodeslist \\p \\low \\high \\rep)\n THEN \\p\\\\rep :== \\nodeslist;; \\nodeslist :== Null\n ELSE \\nodeslist :== \\nodeslist\\\\next\n FI\n OD\n FI\" in HoareTotal.annotateI)\napply vcg\nusing [[simp_depth_limit = 2]]\napply (rule conjI)\napply clarify\napply (simp (no_asm_use))\nprefer 2\napply clarify\napply (rule_tac x=\"[]\" in exI)\napply (rule_tac x=ns in exI)\napply (simp (no_asm_use))\nprefer 2\napply clarify\napply (rule conjI)\napply clarify\napply (rule conjI)\napply (clarsimp simp add: List_list) (* solving termination contraint *)\napply (simp (no_asm_use))\napply (rule conjI)\napply assumption\nprefer 2\napply clarify\napply (simp (no_asm_use))\napply (rule conjI)\napply (clarsimp simp add: List_list) (* solving termination constraint *)\napply (simp only: List_not_Null simp_thms triv_forall_equality)\napply clarify\napply (simp only: triv_forall_equality)\napply (rename_tac sfx)\napply (rule_tac x=\"prx@[nodeslist]\" in exI)\napply (rule_tac x=\"sfx\" in exI)\napply (rule conjI)\napply assumption\napply (rule conjI)\napply simp\nprefer 4\napply (elim exE conjE)\napply (simp (no_asm_use))\napply hypsubst\nusing [[simp_depth_limit = 100]]\nproof -\n (* IF-THEN to postcondition *)\n fix ns var low high rep \"next\" p nodeslist\n assume ns: \"List nodeslist next ns\"\n assume no_prop: \"\\no\\set ns.\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n (isLeaf_pt p low high \\ isLeaf_pt no low high) \\ var no = var p\"\n assume p_in_ns: \"p \\ set ns\" \n assume p_Leaf: \"isLeaf_pt p low high\"\n show \"nodeslist = hd [sn\\ns . repNodes_eq sn p low high rep] \\\n var nodeslist = var p\"\n proof -\n from p_in_ns no_prop have p_not_Null: \"p\\Null\"\n using [[simp_depth_limit=2]]\n by auto\n from p_in_ns have \"ns \\ []\"\n by (cases ns) auto\n with ns obtain ns' where ns': \"ns = nodeslist#ns'\" \n by (cases \"nodeslist=Null\") auto\n with no_prop p_Leaf obtain \n \"isLeaf_pt nodeslist low high\" and\n var_eq: \"var nodeslist = var p\" and\n \"nodeslist\\Null\"\n using [[simp_depth_limit=2]]\n by auto\n with p_not_Null p_Leaf have \"repNodes_eq nodeslist p low high rep\"\n by (simp add: repNodes_eq_def isLeaf_pt_def null_comp_def)\n with ns' var_eq\n show ?thesis\n by simp\n qed\nnext\n (* From invariant to postcondition *)\n fix var::\"ref\\nat\" and low high rep repa p prx sfx \"next\"\n assume sfx: \"List Null next sfx\"\n assume p_in_ns: \"p \\ set (prx @ sfx)\"\n assume no_props: \"\\no\\set (prx @ sfx).\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n (isLeaf_pt p low high \\ isLeaf_pt no low high) \\ var no = var p\"\n assume match_prx: \"(\\pt\\set prx. repNodes_eq pt p low high rep) \\\n repa p = hd [sn\\prx . repNodes_eq sn p low high rep] \\\n (\\pt. pt \\ p \\ rep pt = repa pt)\"\n show \"repa p = hd [sn\\prx @ sfx . repNodes_eq sn p low high rep] \\\n (\\pt. pt \\ p \\ rep pt = repa pt) \\ var (repa p) = var p\"\n proof -\n from sfx\n have sfx_Nil: \"sfx=[]\"\n by simp\n with p_in_ns have ex_match: \"(\\pt\\set prx. repNodes_eq pt p low high rep)\"\n apply -\n apply (rule_tac x=p in bexI)\n apply (simp add: repNodes_eq_def)\n apply simp\n done\n hence not_empty: \"[sn\\prx . repNodes_eq sn p low high rep] \\ []\"\n apply -\n apply (erule bexE)\n apply (rule filter_not_empty)\n apply auto\n done\n from ex_match match_prx obtain\n found: \"repa p = hd [sn\\prx . repNodes_eq sn p low high rep]\" and\n unmodif: \"\\pt. pt \\ p \\ rep pt = repa pt\"\n by blast\n from hd_filter_in_list [OF not_empty] found\n have \"repa p \\ set prx\"\n by simp\n with no_props\n have \"var (repa p) = var p\"\n using [[simp_depth_limit=2]]\n by simp\n with found unmodif sfx_Nil\n show ?thesis\n by simp\n qed\nnext\n (* Invariant to invariant; ELSE part *)\n fix var low high p repa \"next\" nodeslist prx sfx\n assume nodeslist_not_Null: \"nodeslist \\ Null\" \n assume p_no_Leaf: \"\\ isLeaf_pt p low high\"\n assume no_props: \"\\no\\set prx \\ set (nodeslist # sfx).\n no \\ Null \\ (low no = Null) = (high no = Null) \\ var no = var p\"\n assume p_in_ns: \"p \\ set prx \\ p \\ set (nodeslist # sfx)\"\n assume match_prx: \"(\\pt\\set prx. repNodes_eq pt p low high repa) \\\n repa p = hd [sn\\prx . repNodes_eq sn p low high repa]\"\n assume nomatch_prx: \"\\pt\\set prx. \\ repNodes_eq pt p low high repa\"\n assume nomatch_nodeslist: \"\\ repNodes_eq nodeslist p low high repa\"\n assume sfx: \"List (next nodeslist) next sfx\"\n show \"(\\no\\set prx \\ set (nodeslist # sfx).\n no \\ Null \\ (low no = Null) = (high no = Null) \\ var no = var p) \\\n ((\\pt\\set (prx @ [nodeslist]). repNodes_eq pt p low high repa) \\\n repa p = hd [sn\\prx @ [nodeslist] . repNodes_eq sn p low high repa]) \\\n (next nodeslist \\ Null \\\n (\\pt\\set (prx @ [nodeslist]). \\ repNodes_eq pt p low high repa))\"\n proof -\n from nomatch_prx nomatch_nodeslist\n have \"((\\pt\\set (prx @ [nodeslist]). repNodes_eq pt p low high repa) \\\n repa p = hd [sn\\prx @ [nodeslist] . repNodes_eq sn p low high repa])\" \n by auto\n moreover\n from nomatch_prx nomatch_nodeslist\n have \"(next nodeslist \\ Null \\\n (\\pt\\set (prx @ [nodeslist]). \\ repNodes_eq pt p low high repa))\"\n by auto\n ultimately show ?thesis\n using no_props\n by (intro conjI)\n qed\nnext\n (* Invariant to invariant: THEN part *)\n fix var low high p repa \"next\" nodeslist prx sfx\n assume nodeslist_not_Null: \"nodeslist \\ Null\" \n assume sfx: \"List nodeslist next sfx\" \n assume p_not_Leaf: \"\\ isLeaf_pt p low high\"\n assume no_props: \"\\no\\set prx \\ set sfx.\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n (isLeaf_pt p low high \\ isLeaf_pt no low high) \\ var no = var p\"\n assume p_in_ns: \"p \\ set prx \\ p \\ set sfx\"\n assume match_prx: \"(\\pt\\set prx. repNodes_eq pt p low high repa) \\\n repa p = hd [sn\\prx . repNodes_eq sn p low high repa]\"\n assume nomatch_prx: \"\\pt\\set prx. \\ repNodes_eq pt p low high repa\"\n assume match: \"repNodes_eq nodeslist p low high repa\"\n show \"(\\no\\set prx \\ set sfx.\n no \\ Null \\\n (low no = Null) = (high no = Null) \\\n (isLeaf_pt p low high \\ isLeaf_pt no low high) \\ var no = var p) \\\n (p \\ set prx \\ p \\ set sfx) \\\n ((\\pt\\set prx \\ set sfx. repNodes_eq pt p low high repa) \\\n nodeslist =\n hd ([sn\\prx . repNodes_eq sn p low high repa] @\n [sn\\sfx . repNodes_eq sn p low high repa])) \\\n ((\\pt\\set prx \\ set sfx. \\ repNodes_eq pt p low high repa) \\\n repa = repa(p := nodeslist))\"\n proof -\n from nodeslist_not_Null sfx\n obtain sfx' where sfx': \"sfx=nodeslist#sfx'\"\n by (cases \"nodeslist=Null\") auto\n from nomatch_prx match sfx'\n have hd: \"hd ([sn\\prx . repNodes_eq sn p low high repa] @\n [sn\\sfx . repNodes_eq sn p low high repa]) = nodeslist\"\n by simp\n from match sfx'\n have triv: \"((\\pt\\set prx \\ set sfx. \\ repNodes_eq pt p low high repa) \\\n repa = repa(p := nodeslist))\" \n by simp\n show ?thesis\n apply (rule conjI)\n apply (rule no_props)\n apply (intro conjI)\n apply (rule p_in_ns)\n apply (simp add: hd)\n apply (rule triv)\n done\n qed\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/BDD/ShareRepProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.2715801777686696}} {"text": "(* Title: JinjaDCI/J/TypeSafe.thy\n\n Author: Tobias Nipkow, Susannah Mansky\n Copyright 2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory J/TypeSafe.thy by Tobias Nipkow\n*)\n\nsection \\ Type Safety Proof \\\n\ntheory TypeSafe\nimports Progress BigStep SmallStep JWellForm\nbegin\n\n(* here because it requires well-typing def *)\nlemma red_shext_incr: \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\\n \\ (\\E T. P,E,h,sh \\ e : T \\ sh \\\\<^sub>s sh')\"\n and reds_shext_incr: \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\\n \\ (\\E Ts. P,E,h,sh \\ es [:] Ts \\ sh \\\\<^sub>s sh')\"\n(*<*)\nproof(induct rule:red_reds_inducts) qed(auto simp: shext_def)\n(*>*)\n\nlemma wf_types_clinit:\nassumes wf:\"wf_prog wf_md P\" and ex: \"class P C = Some a\" and proc: \"sh C = \\(sfs, Processing)\\\"\nshows \"P,E,h,sh \\ C\\\\<^sub>sclinit([]) : Void\"\nproof -\n from ex obtain D fs ms where \"a = (D,fs,ms)\" by(cases a)\n then have sP: \"(C, D, fs, ms) \\ set P\" using ex map_of_SomeD[of P C a] by(simp add: class_def)\n then have \"wf_clinit ms\" using assms by(unfold wf_prog_def wf_cdecl_def, auto)\n then obtain pns body where sm: \"(clinit, Static, [], Void, pns, body) \\ set ms\"\n by(unfold wf_clinit_def) auto\n then have \"P \\ C sees clinit,Static:[] \\ Void = (pns,body) in C\"\n using mdecl_visible[OF wf sP sm] by simp\n then show ?thesis using WTrtSCall proc by simp\nqed\n\nsubsection\\Basic preservation lemmas\\\n\ntext\\ First some easy preservation lemmas. \\\n\ntheorem red_preserves_hconf:\n \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\ (\\T E. \\ P,E,h,sh \\ e : T; P \\ h \\ \\ \\ P \\ h' \\)\"\nand reds_preserves_hconf:\n \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\ (\\Ts E. \\ P,E,h,sh \\ es [:] Ts; P \\ h \\ \\ \\ P \\ h' \\)\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case (RedNew h a C FDTs h' l sh es)\n have new: \"new_Addr h = Some a\" and fields: \"P \\ C has_fields FDTs\"\n and h': \"h' = h(a\\blank P C)\"\n and hconf: \"P \\ h \\\" by fact+\n from new have None: \"h a = None\" by(rule new_Addr_SomeD)\n moreover have \"P,h \\ blank P C \\\"\n using fields by(rule oconf_blank)\n ultimately show \"P \\ h' \\\" using h' by(fast intro: hconf_new[OF hconf])\nnext\n case (RedFAss C F t D h a fs v l sh b')\n let ?fs' = \"fs((F,D)\\v)\"\n have hconf: \"P \\ h \\\" and ha: \"h a = Some(C,fs)\"\n and wt: \"P,E,h,sh \\ addr a\\F{D}:=Val v : T\" by fact+\n from wt ha obtain TF Tv where typeofv: \"typeof\\<^bsub>h\\<^esub> v = Some Tv\"\n and has: \"P \\ C has F,NonStatic:TF in D\"\n and sub: \"P \\ Tv \\ TF\" by auto\n have \"P,h \\ (C, ?fs') \\\"\n proof (rule oconf_fupd[OF has])\n show \"P,h \\ (C, fs) \\\" using hconf ha by(simp add:hconf_def)\n show \"P,h \\ v :\\ TF\" using sub typeofv by(simp add:conf_def)\n qed\n with hconf ha show \"P \\ h(a\\(C, ?fs')) \\\" by (rule hconf_upd_obj)\nqed(auto elim: WTrt.cases)\n(*>*)\n\n\ntheorem red_preserves_lconf:\n \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\\n (\\T E. \\ P,E,h,sh \\ e:T; P,h \\ l (:\\) E \\ \\ P,h' \\ l' (:\\) E)\"\nand reds_preserves_lconf:\n \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\\n (\\Ts E. \\ P,E,h,sh \\ es[:]Ts; P,h \\ l (:\\) E \\ \\ P,h' \\ l' (:\\) E)\"\n(*<*)\nproof(induct rule:red_reds_inducts)\n case RedNew thus ?case\n by(fast intro:lconf_hext red_hext_incr[OF red_reds.RedNew])\nnext\n case RedLAss thus ?case by(fastforce elim: lconf_upd simp:conf_def)\nnext\n case RedFAss thus ?case\n by(fast intro:lconf_hext red_hext_incr[OF red_reds.RedFAss])\nnext\n case (InitBlockRed e h l V v sh b e' h' l' sh' b' v' T T')\n have red: \"P \\ \\e, (h, l(V\\v),sh),b\\ \\ \\e',(h', l',sh'),b'\\\"\n and IH: \"\\T E . \\ P,E,h,sh \\ e:T; P,h \\ l(V\\v) (:\\) E \\\n \\ P,h' \\ l' (:\\) E\"\n and l'V: \"l' V = Some v'\" and lconf: \"P,h \\ l (:\\) E\"\n and wt: \"P,E,h,sh \\ {V:T := Val v; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover from IH lconf wt have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(auto simp del: fun_upd_apply simp: fun_upd_same lconf_upd2 conf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:if_split_asm)\nnext\n case (BlockRedNone e h l V sh b e' h' l' sh' b' T T')\n have red: \"P \\ \\e,(h, l(V := None),sh),b\\ \\ \\e',(h', l',sh'),b'\\\"\n and IH: \"\\E T. \\ P,E,h,sh \\ e : T; P,h \\ l(V:=None) (:\\) E \\\n \\ P,h' \\ l' (:\\) E\"\n and lconf: \"P,h \\ l (:\\) E\" and wt: \"P,E,h,sh \\ {V:T; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(rule IH, insert lconf wt, auto simp:lconf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:if_split_asm)\nnext\n case (BlockRedSome e h l V sh b e' h' l' sh' b' v T T')\n have red: \"P \\ \\e,(h, l(V := None),sh),b\\ \\ \\e',(h', l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E,h,sh \\ e : T; P,h \\ l(V:=None) (:\\) E\\\n \\ P,h' \\ l' (:\\) E\"\n and lconf: \"P,h \\ l (:\\) E\" and wt: \"P,E,h,sh \\ {V:T; e} : T'\" by fact+\n from lconf_hext[OF lconf red_hext_incr[OF red]]\n have \"P,h' \\ l (:\\) E\" .\n moreover have \"P,h' \\ l' (:\\) E(V\\T)\"\n by(rule IH, insert lconf wt, auto simp:lconf_def)\n ultimately show \"P,h' \\ l'(V := l V) (:\\) E\"\n by (fastforce simp:lconf_def split:if_split_asm)\nqed(auto elim: WTrt.cases)\n(*>*)\n\n\ntheorem red_preserves_shconf:\n \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\ (\\T E. \\ P,E,h,sh \\ e : T; P,h \\\\<^sub>s sh \\ \\ \\ P,h' \\\\<^sub>s sh' \\)\"\nand reds_preserves_shconf:\n \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\ (\\Ts E. \\ P,E,h,sh \\ es [:] Ts; P,h \\\\<^sub>s sh \\ \\ \\ P,h' \\\\<^sub>s sh' \\)\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case (RedNew h a C FDTs h' l sh es)\n have new: \"new_Addr h = Some a\"\n and h': \"h' = h(a\\blank P C)\"\n and shconf: \"P,h \\\\<^sub>s sh \\\" by fact+\n from new have None: \"h a = None\" by(rule new_Addr_SomeD)\n then show \"P,h' \\\\<^sub>s sh \\\" using h' by(fast intro: shconf_hnew[OF shconf])\nnext\n case (RedFAss C F t D h a fs v l sh b)\n let ?fs' = \"fs((F,D)\\v)\"\n have shconf: \"P,h \\\\<^sub>s sh \\\" and ha: \"h a = Some(C,fs)\" by fact+\n then show \"P,h(a\\(C, ?fs')) \\\\<^sub>s sh \\\" by (rule shconf_hupd_obj)\nnext\n case (RedSFAss C F t D sh sfs i sfs' v sh' h l)\n let ?sfs' = \"sfs(F\\v)\"\n have shconf: \"P,h \\\\<^sub>s sh \\\" and shD: \"sh D = \\(sfs, i)\\\"\n and wt: \"P,E,h,sh \\ C\\\\<^sub>sF{D} := Val v : T\" by fact+\n from wt obtain TF Tv where typeofv: \"typeof\\<^bsub>h\\<^esub> v = Some Tv\"\n and has: \"P \\ C has F,Static:TF in D\"\n and sub: \"P \\ Tv \\ TF\" by (auto elim: WTrt.cases)\n have has': \"P \\ D has F,Static:TF in D\" using has by(rule has_field_idemp)\n have \"P,h,D \\\\<^sub>s ?sfs' \\\"\n proof (rule soconf_fupd[OF has'])\n show \"P,h,D \\\\<^sub>s sfs \\\" using shconf shD by(simp add:shconf_def)\n show \"P,h \\ v :\\ TF\" using sub typeofv by(simp add:conf_def)\n qed\n with shconf have \"P,h \\\\<^sub>s sh(D\\(?sfs',i)) \\\" by (rule shconf_upd_obj)\n then show ?case using RedSFAss.hyps(3) RedSFAss.hyps(4) by blast\nnext\n case (InitNoneRed sh C C' Cs e h l)\n let ?sfs' = \"sblank P C\"\n have \"P,h \\\\<^sub>s sh(C \\ (?sfs', Prepared)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using InitNoneRed by simp\n show \"P,h,C \\\\<^sub>s sblank P C \\\" by (metis has_field_def soconf_def soconf_sblank)\n qed\n then show ?case by blast\nnext\n case (InitObjectRed sh C sfs sh' C' Cs e h l)\n have sh': \"sh' = sh(C \\ (sfs, Processing))\" by fact\n have \"P,h \\\\<^sub>s sh(C \\ (sfs, Processing)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using InitObjectRed by simp\n moreover have \"sh C = \\(sfs, Prepared)\\\" using InitObjectRed by simp\n ultimately show \"P,h,C \\\\<^sub>s sfs \\\" using shconfD by blast\n qed\n then show ?case using sh' by blast\nnext\n case (InitNonObjectSuperRed sh C sfs D a b sh' C' Cs e h l)\n have sh': \"sh' = sh(C \\ (sfs, Processing))\" by fact\n have \"P,h \\\\<^sub>s sh(C \\ (sfs, Processing)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using InitNonObjectSuperRed by simp\n moreover have \"sh C = \\(sfs, Prepared)\\\" using InitNonObjectSuperRed by simp\n ultimately show \"P,h,C \\\\<^sub>s sfs \\\" using shconfD by blast\n qed\n then show ?case using sh' by blast\nnext\n case (RedRInit sh C sfs i sh' C' Cs e v h l)\n have sh': \"sh' = sh(C \\ (sfs, Done))\" by fact\n have \"P,h \\\\<^sub>s sh(C \\ (sfs, Done)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using RedRInit by simp\n moreover have \"sh C = \\(sfs, i)\\\" using RedRInit by simp\n ultimately show \"P,h,C \\\\<^sub>s sfs \\\" using shconfD by blast\n qed\n then show ?case using sh' by blast\nnext\n case (RInitInitThrow sh C sfs i sh' a D Cs e h l)\n have sh': \"sh' = sh(C \\ (sfs, Error))\" by fact\n have \"P,h \\\\<^sub>s sh(C \\ (sfs, Error)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using RInitInitThrow by simp\n moreover have \"sh C = \\(sfs, i)\\\" using RInitInitThrow by simp\n ultimately show \"P,h,C \\\\<^sub>s sfs \\\" using shconfD by blast\n qed\n then show ?case using sh' by blast\nnext\n case (RInitThrow sh C sfs i sh' a e' h l)\n have sh': \"sh' = sh(C \\ (sfs, Error))\" by fact\n have \"P,h \\\\<^sub>s sh(C \\ (sfs, Error)) \\\"\n proof(rule shconf_upd_obj)\n show \"P,h \\\\<^sub>s sh \\\" using RInitThrow by simp\n moreover have \"sh C = \\(sfs, i)\\\" using RInitThrow by simp\n ultimately show \"P,h,C \\\\<^sub>s sfs \\\" using shconfD by blast\n qed\n then show ?case using sh' by blast\nqed(auto elim: WTrt.cases)\n(*>*)\n\n\n\n\nlemma Seq_bconf_preserve_aux:\nassumes \"P \\ \\e,(h, l, sh),b\\ \\ \\e',(h', l', sh'),b'\\\" and \"P,sh \\\\<^sub>b (e;; e\\<^sub>2,b) \\\"\n and \"P,sh \\\\<^sub>b (e::expr,b) \\ \\ P,sh' \\\\<^sub>b (e'::expr,b') \\\"\nshows \"P,sh' \\\\<^sub>b (e';;e\\<^sub>2,b') \\\"\nproof(cases \"val_of e\")\n case None show ?thesis\n proof(cases \"lass_val_of e\")\n case lNone: None show ?thesis\n proof(cases \"lass_val_of e'\")\n case lNone': None\n then show ?thesis using None assms lNone\n by(auto dest: val_of_spec simp: bconf_def option.distinct(1))\n next\n case (Some a)\n then show ?thesis using None assms lNone by(auto dest: lass_val_of_spec simp: bconf_def)\n qed\n next\n case (Some a)\n then show ?thesis using None assms by(auto dest: lass_val_of_spec)\n qed\nnext\n case (Some a)\n then show ?thesis using assms by(auto dest: val_of_spec)\nqed\n\ntheorem red_preserves_bconf:\n \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\ iconf sh e \\ P,sh \\\\<^sub>b (e,b) \\ \\ P,sh' \\\\<^sub>b (e',b') \\\"\nand reds_preserves_bconf:\n \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\ iconfs sh es \\ P,sh \\\\<^sub>b (es,b) \\ \\ P,sh' \\\\<^sub>b (es',b') \\\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case (CastRed e a a b b e' a a b b' C) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (BinOpRed1 e h l sh b e' h' l' sh' b' bop e\\<^sub>2) show ?case\n proof(cases b')\n case True with BinOpRed1 val_of_spec show ?thesis\n proof(cases \"val_of e\") qed(simp,fast)\n next\n case False then show ?thesis by (simp add: bconf_def)\n qed\nnext\ncase (BinOpRed2 e a a b b e' a a b b' v\\<^sub>1 bop) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (LAssRed e a a b b e' a a b b' V) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (FAccRed e a a b b e' a a b b' F D) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (RedSFAccNonStatic C F t D h l sh b) then show ?case\n using has_field_fun[of P C F NonStatic] by (auto simp: bconf_def)\nnext\n case (FAssRed1 e h l sh b e' h' l' sh' b' F D e\\<^sub>2) show ?case\n proof(cases b')\n case True with FAssRed1 val_of_spec show ?thesis\n proof(cases \"val_of e'\")qed((simp,fast)+)\n next\n case False then show ?thesis by(simp add: bconf_def)\n qed\nnext\n case (FAssRed2 e a a b b e' a a b b' v F D) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (SFAssRed e h l sh b e' h' l' sh' b' C F D) then show ?case\n proof(cases b') qed(fastforce simp: bconf_def val_no_step)+\nnext\n case (RedSFAssNonStatic C F t D v a a b b) then show ?case\n using has_field_fun[of P C F NonStatic] by (auto simp: bconf_def)\nnext\n case (CallObj e h l sh b e' h' l' sh' b' M es) show ?case\n proof(cases b')\n case True with CallObj val_of_spec show ?thesis\n proof(cases \"val_of e'\")qed((simp,fast)+)\n next\n case False then show ?thesis by(simp add: bconf_def)\n qed\nnext\n case (CallParams es a a b b es' a a b b' v M) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (SCallParams es h l sh b es' h' l' sh' b' C M) show ?case\n proof(cases b')\n case b': True show ?thesis\n proof(cases \"map_vals_of es'\")\n case None\n then show ?thesis using SCallParams b' vals_no_step\n proof(cases \"map_vals_of es\")qed(clarsimp,fast)\n next\n case f: Some\n then show ?thesis using SCallParams b' vals_no_step\n proof(cases \"map_vals_of es\")qed(clarsimp,fast)\n qed\n next\n case False then show ?thesis by(simp add: bconf_def)\n qed\nnext\n case (SCallInitDoneRed C M Ts T pns body D sh sfs vs h l)\n then show ?case by(auto simp: bconf_def initPD_def) (rule_tac x=D in exI, auto)+\nnext\n case (RedSCallNonStatic C M Ts T a b D vs h l sh b) then show ?case\n using sees_method_fun[of P C M NonStatic] by (auto simp: bconf_def)\nnext\n case (BlockRedNone e h l V sh b e' h' l' sh' b' T) show ?case\n proof(cases \"assigned V e'\")\n case True\n then obtain v e2 where \"e' = V := Val v;;e2\" by(clarsimp simp: assigned_def)\n then show ?thesis using BlockRedNone by(clarsimp simp: bconf_def)\n next\n case False then show ?thesis using BlockRedNone by simp\n qed\nnext\n case (BlockRedSome e h l V sh b e' h' l' sh' b' v T) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (InitBlockRed e h l V v sh b e' h' l' sh' b' v' T) show ?case\n proof(cases b')\n case True\n then show ?thesis using InitBlockRed by (simp add: assigned_def)\n next\n case False then show ?thesis by(simp add: bconf_def)\n qed\nnext\n case (RedBlock V T u)\n then have \"\\assigned V (Val u)\" by(clarsimp simp: assigned_def)\n then show ?case using RedBlock by(simp add: bconf_def)\nnext\n case (SeqRed e h l sh b e' h' l' sh' b' e\\<^sub>2)\n have \"iconf sh e\"\n proof(cases \"lass_val_of e\")\n case (Some a) show ?thesis by(rule lass_val_of_iconf[OF Some])\n next\n case None then show ?thesis using SeqRed by(auto dest: val_of_spec)\n qed\n then show ?case using SeqRed Seq_bconf_preserve_aux by simp\nnext\n case (CondRed e a a b b e' a a b b' e\\<^sub>1 e\\<^sub>2) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (ThrowRed e a a b b e' a a b b') then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (TryRed e a a b b e' a a b b' C V e\\<^sub>2) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (ListRed1 e h l sh b e' h' l' sh' b' es)\n with val_of_spec show ?case\n proof(cases b') qed((clarsimp,fast),simp add: bconfs_def)\nnext\n case (RedInit C b' e X Y b b'')\n then show ?case\n by(auto simp: bconf_def icheck_ss_exp icheck_init_class icheck_curr_init)\nnext\n case (RInitRed e a a b b e' a a b b' C Cs e\\<^sub>0) then show ?case\n proof(cases b') qed(simp, simp add: bconf_def)\nnext\n case (BlockThrow V T a)\n then have \"\\assigned V (Throw a)\" by(simp add: assigned_def)\n then show ?case using BlockThrow by simp\nqed(simp_all, auto simp: bconf_def initPD_def)\n(*>*)\n\ntext\\ Preservation of definite assignment more complex and requires a\nfew lemmas first. \\\n\n\n\n\nlemma red_lA_incr: \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\\n \\ \\dom l\\ \\ \\ e \\ \\dom l'\\ \\ \\ e'\"\nand reds_lA_incr: \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\\n \\ \\dom l\\ \\ \\s es \\ \\dom l'\\ \\ \\s es'\"\n(*<*)\nproof(induct rule:red_reds_inducts)\n case TryRed then show ?case\n by(simp del:fun_upd_apply add:hyperset_defs)\n (blast dest:red_lcl_incr)+\nnext\n case BinOpRed1 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case BinOpRed2 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case LAssRed then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case FAssRed1 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case FAssRed2 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case CallObj then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case CallParams then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case BlockRedNone then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case BlockRedSome then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case InitBlockRed then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case SeqRed then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case CondRed then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case RedCondT then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case RedCondF then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case ListRed1 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nnext\n case ListRed2 then show ?case\n by(auto simp del:fun_upd_apply simp:hyperset_defs)\nqed (simp_all del:fun_upd_apply add:hyperset_defs)\n(*>*)\n\ntext\\ Now preservation of definite assignment. \\\n\nlemma assumes wf: \"wf_J_prog P\"\nshows red_preserves_defass:\n \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\ \\ e \\dom l\\ \\ \\ e' \\dom l'\\\"\nand \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\ \\s es \\dom l\\ \\ \\s es' \\dom l'\\\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case BinOpRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case FAssRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case CallObj thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n case RedCall thus ?case\n by (auto dest!:sees_wf_mdecl[OF wf] simp:wf_mdecl_def hyperset_defs elim!:D_mono')\nnext\n case RedSCall thus ?case\n by (auto dest!:sees_wf_mdecl[OF wf] simp:wf_mdecl_def hyperset_defs elim!:D_mono')\nnext\n case SCallInitRed\n then show ?case by(auto simp:hyperset_defs Ds_Vals)\nnext\n case InitBlockRed thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case BlockRedNone thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case BlockRedSome thus ?case\n by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply)\nnext\n case SeqRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case CondRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n case TryRed thus ?case\n by (fastforce dest:red_lcl_incr intro:D_mono' simp:hyperset_defs)\nnext\n case ListRed1 thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n case RedWhile thus ?case by(auto simp:hyperset_defs elim!:D_mono')\nnext\n case RedInit then show ?case by (auto intro: D_mono' simp: hyperset_defs)\nnext\n case (RInitRed e h l sh b e' h' l' sh' b' C Cs e\\<^sub>0)\n then show ?case by(auto simp:hyperset_defs dest:red_lcl_incr elim!:D_mono')\nqed(auto simp:hyperset_defs)\n(*>*)\n\n\ntext\\ Combining conformance of heap, static heap, and local variables: \\\n\ndefinition sconf :: \"J_prog \\ env \\ state \\ bool\" (\"_,_ \\ _ \\\" [51,51,51]50)\nwhere\n \"P,E \\ s \\ \\ let (h,l,sh) = s in P \\ h \\ \\ P,h \\ l (:\\) E \\ P,h \\\\<^sub>s sh \\\"\n\nlemma red_preserves_sconf:\n \"\\ P \\ \\e,s,b\\ \\ \\e',s',b'\\; P,E,hp s,shp s \\ e : T; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nby(fastforce intro:red_preserves_hconf red_preserves_lconf red_preserves_shconf\n simp add:sconf_def)\n(*>*)\n\nlemma reds_preserves_sconf:\n \"\\ P \\ \\es,s,b\\ [\\] \\es',s',b'\\; P,E,hp s,shp s \\ es [:] Ts; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nby(fastforce intro:reds_preserves_hconf reds_preserves_lconf reds_preserves_shconf\n simp add:sconf_def)\n(*>*)\n\n\nsubsection \"Subject reduction\"\n\nlemma wt_blocks:\n \"\\E. \\ length Vs = length Ts; length vs = length Ts \\ \\\n (P,E,h,sh \\ blocks(Vs,Ts,vs,e) : T) =\n (P,E(Vs[\\]Ts),h,sh \\ e:T \\ (\\Ts'. map (typeof\\<^bsub>h\\<^esub>) vs = map Some Ts' \\ P \\ Ts' [\\] Ts))\"\n(*<*)\nproof(induct Vs Ts vs e rule:blocks_induct)\n case (1 V Vs T Ts v vs e)\n then show ?case by(force simp add:rel_list_all2_Cons2)\nqed simp_all\n(*>*)\n\ntheorem assumes wf: \"wf_J_prog P\"\nshows subject_reduction2: \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\ \\\n (\\E T. \\ P,E \\ (h,l,sh) \\; iconf sh e; P,E,h,sh \\ e:T \\\n \\ \\T'. P,E,h',sh' \\ e':T' \\ P \\ T' \\ T)\"\nand subjects_reduction2: \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\ \\\n (\\E Ts. \\ P,E \\ (h,l,sh) \\; iconfs sh es; P,E,h,sh \\ es [:] Ts \\\n \\ \\Ts'. P,E,h',sh' \\ es' [:] Ts' \\ P \\ Ts' [\\] Ts)\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case RedNew then show ?case by (auto simp: blank_def)\nnext\n case RedNewFail thus ?case\n by (unfold sconf_def hconf_def) (fastforce elim!:typeof_OutOfMemory)\nnext\n case CastRed thus ?case\n by(clarsimp simp:is_refT_def)\n (blast intro: widens_trans dest!:widen_Class[THEN iffD1])\nnext\n case RedCastFail thus ?case\n by (unfold sconf_def hconf_def) (fastforce elim!:typeof_ClassCast)\nnext\n case (BinOpRed1 e\\<^sub>1 h l sh b e\\<^sub>1' h' l' sh' b' bop e\\<^sub>2)\n have red: \"P \\ \\e\\<^sub>1,(h,l,sh),b\\ \\ \\e\\<^sub>1',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e\\<^sub>1; P,E,h,sh \\ e\\<^sub>1:T\\\n \\ \\U. P,E,h',sh' \\ e\\<^sub>1' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (e\\<^sub>1 \\bop\\ e\\<^sub>2)\"\n and wt: \"P,E,h,sh \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\" by fact+\n have val: \"val_of e\\<^sub>1 = None\" using red iconf val_no_step by auto\n then have iconf1: \"iconf sh e\\<^sub>1\" and nsub_RI2: \"\\sub_RI e\\<^sub>2\" using iconf by simp+\n have \"P,E,h',sh' \\ e\\<^sub>1' \\bop\\ e\\<^sub>2 : T\"\n proof (cases bop)\n assume [simp]: \"bop = Eq\"\n from wt obtain T\\<^sub>1 T\\<^sub>2 where [simp]: \"T = Boolean\"\n and wt\\<^sub>1: \"P,E,h,sh \\ e\\<^sub>1 : T\\<^sub>1\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2\" by auto\n show ?thesis\n using WTrt_hext_shext_mono[OF wt\\<^sub>2 red_hext_incr[OF red] red_shext_incr[OF red wt\\<^sub>1] nsub_RI2]\n IH[OF conf iconf1 wt\\<^sub>1] by auto\n next\n assume [simp]: \"bop = Add\"\n from wt have [simp]: \"T = Integer\"\n and wt\\<^sub>1: \"P,E,h,sh \\ e\\<^sub>1 : Integer\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : Integer\"\n by auto\n show ?thesis\n using WTrt_hext_shext_mono[OF wt\\<^sub>2 red_hext_incr[OF red] red_shext_incr[OF red wt\\<^sub>1] nsub_RI2]\n IH[OF conf iconf1 wt\\<^sub>1] by auto\n qed\n thus ?case by auto\nnext\n case (BinOpRed2 e\\<^sub>2 h l sh b e\\<^sub>2' h' l' sh' b' v\\<^sub>1 bop)\n have red: \"P \\ \\e\\<^sub>2,(h,l,sh),b\\ \\ \\e\\<^sub>2',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e\\<^sub>2; P,E,h,sh \\ e\\<^sub>2:T\\\n \\ \\U. P,E,h',sh' \\ e\\<^sub>2' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (Val v\\<^sub>1 \\bop\\ e\\<^sub>2)\"\n and wt: \"P,E,h,sh \\ (Val v\\<^sub>1) \\bop\\ e\\<^sub>2 : T\" by fact+\n have iconf2: \"iconf sh e\\<^sub>2\" using iconf by simp\n have \"P,E,h',sh' \\ (Val v\\<^sub>1) \\bop\\ e\\<^sub>2' : T\"\n proof (cases bop)\n assume [simp]: \"bop = Eq\"\n from wt obtain T\\<^sub>1 T\\<^sub>2 where [simp]: \"T = Boolean\"\n and wt\\<^sub>1: \"P,E,h,sh \\ Val v\\<^sub>1 : T\\<^sub>1\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2:T\\<^sub>2\" by auto\n show ?thesis\n using IH[OF conf iconf2 wt\\<^sub>2] WTrt_hext_mono[OF wt\\<^sub>1 red_hext_incr[OF red]]\n by auto\n next\n assume [simp]: \"bop = Add\"\n from wt have [simp]: \"T = Integer\"\n and wt\\<^sub>1: \"P,E,h,sh \\ Val v\\<^sub>1 : Integer\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : Integer\"\n by auto\n show ?thesis\n using IH[OF conf iconf2 wt\\<^sub>2] WTrt_hext_mono[OF wt\\<^sub>1 red_hext_incr[OF red]]\n by auto\n qed\n thus ?case by auto\nnext\n case (RedBinOp bop) thus ?case\n proof (cases bop)\n case Eq thus ?thesis using RedBinOp by auto\n next\n case Add thus ?thesis using RedBinOp by auto\n qed\nnext\n case RedVar thus ?case by (fastforce simp:sconf_def lconf_def conf_def)\nnext\n case (LAssRed e h l sh b e' h' l' sh' b' V)\n obtain Te where Te: \"P,E,h,sh \\ e : Te \\ P \\ Te \\ the(E V)\" using LAssRed.prems(3) by auto\n then have wide: \"P \\ Te \\ the(E V)\" using LAssRed by simp\n then have \"\\T'. P,E,h',sh' \\ e' : T' \\ P \\ T' \\ Te\"\n using LAssRed.hyps(2) LAssRed.prems(1,2) Te widen_trans[OF _ wide] by auto\n then obtain T' where wt: \"P,E,h',sh' \\ e' : T' \\ P \\ T' \\ Te\" by clarsimp\n have \"P,E,h',sh' \\ V:=e' : Void\" using LAssRed wt widen_trans[OF _ wide] by auto\n then show ?case using LAssRed by(rule_tac x = Void in exI) auto\nnext\n case (FAccRed e h l sh b e' h' l' sh' b' F D)\n have IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\U. P,E,h',sh' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (e\\F{D})\"\n and wt: \"P,E,h,sh \\ e\\F{D} : T\" by fact+\n have iconf': \"iconf sh e\" using iconf by simp+\n \\ \\The goal: ?case = @{prop ?case}\\\n \\ \\Now distinguish the two cases how wt can have arisen.\\\n { fix C assume wte: \"P,E,h,sh \\ e : Class C\"\n and has: \"P \\ C has F,NonStatic:T in D\"\n from IH[OF conf iconf' wte]\n obtain U where wte': \"P,E,h',sh' \\ e' : U\" and UsubC: \"P \\ U \\ Class C\"\n by auto\n \\ \\Now distinguish what @{term U} can be.\\\n { assume \"U = NT\" hence ?case using wte'\n by(blast intro:WTrtFAccNT widen_refl) }\n moreover\n { fix C' assume U: \"U = Class C'\" and C'subC: \"P \\ C' \\\\<^sup>* C\"\n from has_field_mono[OF has C'subC] wte' U\n have ?case by(blast intro:WTrtFAcc) }\n ultimately have ?case using UsubC by(simp add: widen_Class) blast }\n moreover\n { assume \"P,E,h,sh \\ e : NT\"\n hence \"P,E,h',sh' \\ e' : NT\" using IH[OF conf iconf'] by fastforce\n hence ?case by(fastforce intro:WTrtFAccNT widen_refl) }\n ultimately show ?case using wt by blast\nnext\n case RedFAcc thus ?case\n by(fastforce simp:sconf_def hconf_def oconf_def conf_def has_field_def\n dest:has_fields_fun)\nnext\n case RedFAccNull thus ?case\n by(fastforce intro: widen_refl WTThrow[OF WTVal] elim!: typeof_NullPointer\n simp: sconf_def hconf_def)\nnext\n case RedSFAccNone then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_NoSuchFieldError\n simp: sconf_def hconf_def)\nnext\n case RedFAccStatic then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case (RedSFAcc C F t D sh sfs i v h l es)\n then have \"P \\ C has F,Static:T in D\" by fast\n then have dM: \"P \\ D has F,Static:T in D\" by(rule has_field_idemp)\n then show ?case using RedSFAcc by(fastforce simp:sconf_def shconf_def soconf_def conf_def)\nnext\n case SFAccInitDoneRed then show ?case by (meson widen_refl)\nnext\n case (SFAccInitRed C F t D sh h l E T)\n have \"is_class P D\" using SFAccInitRed.hyps(1) by(rule has_field_is_class')\n then have \"P,E,h,sh \\ INIT D ([D],False) \\ C\\\\<^sub>sF{D} : T \\ P \\ T \\ T\"\n using SFAccInitRed WTrtInit[OF SFAccInitRed.prems(3)] by clarsimp\n then show ?case by(rule exI)\nnext\n case RedSFAccNonStatic then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case (FAssRed1 e h l sh b e' h' l' sh' b' F D e\\<^sub>2)\n have red: \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\U. P,E,h',sh' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (e\\F{D} := e\\<^sub>2)\"\n and wt: \"P,E,h,sh \\ e\\F{D}:=e\\<^sub>2 : T\" by fact+\n have val: \"val_of e = None\" using red iconf val_no_step by auto\n then have iconf': \"iconf sh e\" and nsub_RI2: \"\\sub_RI e\\<^sub>2\" using iconf by simp+\n from wt have void: \"T = Void\" by blast\n \\ \\We distinguish if @{term e} has type @{term NT} or a Class type\\\n \\ \\Remember ?case = @{term ?case}\\\n { assume wt':\"P,E,h,sh \\ e : NT\"\n hence \"P,E,h',sh' \\ e' : NT\" using IH[OF conf iconf'] by fastforce\n moreover obtain T\\<^sub>2 where \"P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2\" using wt by auto\n from this red_hext_incr[OF red] red_shext_incr[OF red wt'] nsub_RI2 have \"P,E,h',sh' \\ e\\<^sub>2 : T\\<^sub>2\"\n by(rule WTrt_hext_shext_mono)\n ultimately have ?case using void by(blast intro!:WTrtFAssNT)\n }\n moreover\n { fix C TF T\\<^sub>2 assume wt\\<^sub>1: \"P,E,h,sh \\ e : Class C\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2\"\n and has: \"P \\ C has F,NonStatic:TF in D\" and sub: \"P \\ T\\<^sub>2 \\ TF\"\n obtain U where wt\\<^sub>1': \"P,E,h',sh' \\ e' : U\" and UsubC: \"P \\ U \\ Class C\"\n using IH[OF conf iconf' wt\\<^sub>1] by blast\n have wt\\<^sub>2': \"P,E,h',sh' \\ e\\<^sub>2 : T\\<^sub>2\"\n by(rule WTrt_hext_shext_mono[OF wt\\<^sub>2 red_hext_incr[OF red] red_shext_incr[OF red wt\\<^sub>1] nsub_RI2])\n \\ \\Is @{term U} the null type or a class type?\\\n { assume \"U = NT\" with wt\\<^sub>1' wt\\<^sub>2' void have ?case\n by(blast intro!:WTrtFAssNT) }\n moreover\n { fix C' assume UClass: \"U = Class C'\" and \"subclass\": \"P \\ C' \\\\<^sup>* C\"\n have \"P,E,h',sh' \\ e' : Class C'\" using wt\\<^sub>1' UClass by auto\n moreover have \"P \\ C' has F,NonStatic:TF in D\"\n by(rule has_field_mono[OF has \"subclass\"])\n ultimately have ?case using wt\\<^sub>2' sub void by(blast intro:WTrtFAss) }\n ultimately have ?case using UsubC by(auto simp add:widen_Class) }\n ultimately show ?case using wt by blast\nnext\n case (FAssRed2 e\\<^sub>2 h l sh b e\\<^sub>2' h' l' sh' b' v F D)\n have red: \"P \\ \\e\\<^sub>2,(h,l,sh),b\\ \\ \\e\\<^sub>2',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e\\<^sub>2; P,E,h,sh \\ e\\<^sub>2 : T\\\n \\ \\U. P,E,h',sh' \\ e\\<^sub>2' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (Val v\\F{D} := e\\<^sub>2)\"\n and wt: \"P,E,h,sh \\ Val v\\F{D}:=e\\<^sub>2 : T\" by fact+\n have iconf2: \"iconf sh e\\<^sub>2\" using iconf by simp\n from wt have [simp]: \"T = Void\" by auto\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix C TF T\\<^sub>2\n assume wt\\<^sub>1: \"P,E,h,sh \\ Val v : Class C\"\n and has: \"P \\ C has F,NonStatic:TF in D\"\n and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2\" and TsubTF: \"P \\ T\\<^sub>2 \\ TF\"\n have wt\\<^sub>1': \"P,E,h',sh' \\ Val v : Class C\"\n using WTrt_hext_mono[OF wt\\<^sub>1 red_hext_incr[OF red]] by auto\n obtain T\\<^sub>2' where wt\\<^sub>2': \"P,E,h',sh' \\ e\\<^sub>2' : T\\<^sub>2'\" and T'subT: \"P \\ T\\<^sub>2' \\ T\\<^sub>2\"\n using IH[OF conf iconf2 wt\\<^sub>2] by blast\n have \"P,E,h',sh' \\ Val v\\F{D}:=e\\<^sub>2' : Void\"\n by(rule WTrtFAss[OF wt\\<^sub>1' has wt\\<^sub>2' widen_trans[OF T'subT TsubTF]])\n thus ?case by auto\n next\n fix T\\<^sub>2 assume null: \"P,E,h,sh \\ Val v : NT\" and wt\\<^sub>2: \"P,E,h,sh \\ e\\<^sub>2 : T\\<^sub>2\"\n from null have \"v = Null\" by simp\n moreover\n obtain T\\<^sub>2' where \"P,E,h',sh' \\ e\\<^sub>2' : T\\<^sub>2' \\ P \\ T\\<^sub>2' \\ T\\<^sub>2\"\n using IH[OF conf iconf2 wt\\<^sub>2] by blast\n ultimately show ?thesis by(fastforce intro:WTrtFAssNT)\n qed\nnext\n case RedFAss thus ?case by(auto simp del:fun_upd_apply)\nnext\n case RedFAssNull thus ?case\n by(fastforce intro: WTThrow[OF WTVal] elim!:typeof_NullPointer simp:sconf_def hconf_def)\nnext\n case RedFAssStatic then show ?case \n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case (SFAssRed e h l sh b e' h' l' sh' b' C F D E T)\n have IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\U. P,E,h',sh' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (C\\\\<^sub>sF{D} := e)\"\n and wt: \"P,E,h,sh \\ C\\\\<^sub>sF{D}:=e : T\" by fact+\n have iconf': \"iconf sh e\" using iconf by simp\n from wt have [simp]: \"T = Void\" by auto\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix TF T1\n assume has: \"P \\ C has F,Static:TF in D\"\n and wt1: \"P,E,h,sh \\ e : T1\" and TsubTF: \"P \\ T1 \\ TF\"\n obtain T' where wt1': \"P,E,h',sh' \\ e' : T'\" and T'subT: \"P \\ T' \\ T1\"\n using IH[OF conf iconf' wt1] by blast\n have \"P,E,h',sh' \\ C\\\\<^sub>sF{D}:=e' : Void\"\n by(rule WTrtSFAss[OF wt1' has widen_trans[OF T'subT TsubTF]])\n thus ?case by auto\n qed\nnext\n case SFAssInitDoneRed then show ?case by (meson widen_refl)\nnext\n case (SFAssInitRed C F t D sh v h l E T)\n have \"is_class P D\" using SFAssInitRed.hyps(1) by(rule has_field_is_class')\n then have \"P,E,h,sh \\ INIT D ([D],False) \\ C\\\\<^sub>sF{D} := Val v : T \\ P \\ T \\ T\"\n using SFAssInitRed WTrtInit[OF SFAssInitRed.prems(3)] by clarsimp\n then show ?case by(rule exI)\nnext\n case RedSFAssNone then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_NoSuchFieldError\n simp: sconf_def hconf_def)\nnext\n case RedSFAssNonStatic then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case (CallObj e h l sh b e' h' l' sh' b' M es)\n have red: \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l,sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\U. P,E,h',sh' \\ e' : U \\ P \\ U \\ T\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (e\\M(es))\"\n and wt: \"P,E,h,sh \\ e\\M(es) : T\" by fact+\n have val: \"val_of e = None\" using red iconf val_no_step by auto\n then have iconf': \"iconf sh e\" and nsub_RIs: \"\\sub_RIs es\" using iconf by simp+\n \\ \\We distinguish if @{term e} has type @{term NT} or a Class type\\\n \\ \\Remember ?case = @{term ?case}\\\n { assume wt':\"P,E,h,sh \\ e:NT\"\n hence \"P,E,h',sh' \\ e' : NT\" using IH[OF conf iconf'] by fastforce\n moreover\n fix Ts assume wtes: \"P,E,h,sh \\ es [:] Ts\"\n have \"P,E,h',sh' \\ es [:] Ts\"\n by(rule WTrts_hext_shext_mono[OF wtes red_hext_incr[OF red] red_shext_incr[OF red wt'] nsub_RIs])\n ultimately have ?case by(blast intro!:WTrtCallNT) }\n moreover\n { fix C D Ts Us pns body\n assume wte: \"P,E,h,sh \\ e : Class C\"\n and \"method\": \"P \\ C sees M,NonStatic:Ts\\T = (pns,body) in D\"\n and wtes: \"P,E,h,sh \\ es [:] Us\" and subs: \"P \\ Us [\\] Ts\"\n obtain U where wte': \"P,E,h',sh' \\ e' : U\" and UsubC: \"P \\ U \\ Class C\"\n using IH[OF conf iconf' wte] by blast\n \\ \\Is @{term U} the null type or a class type?\\\n { assume \"U = NT\"\n moreover have \"P,E,h',sh' \\ es [:] Us\"\n by(rule WTrts_hext_shext_mono[OF wtes red_hext_incr[OF red] red_shext_incr[OF red wte] nsub_RIs])\n ultimately have ?case using wte' by(blast intro!:WTrtCallNT) }\n moreover\n { fix C' assume UClass: \"U = Class C'\" and \"subclass\": \"P \\ C' \\\\<^sup>* C\"\n have \"P,E,h',sh' \\ e' : Class C'\" using wte' UClass by auto\n moreover obtain Ts' T' pns' body' D'\n where method': \"P \\ C' sees M,NonStatic:Ts'\\T' = (pns',body') in D'\"\n and subs': \"P \\ Ts [\\] Ts'\" and sub': \"P \\ T' \\ T\"\n using Call_lemma[OF \"method\" \"subclass\" wf] by fast\n moreover have \"P,E,h',sh' \\ es [:] Us\"\n by(rule WTrts_hext_shext_mono[OF wtes red_hext_incr[OF red] red_shext_incr[OF red wte] nsub_RIs])\n ultimately have ?case\n using subs by(blast intro:WTrtCall rtrancl_trans widens_trans) }\n ultimately have ?case using UsubC by(auto simp add:widen_Class) }\n ultimately show ?case using wt by auto\nnext\n case (CallParams es h l sh b es' h' l' sh' b' v M)\n have reds: \"P \\ \\es,(h,l,sh),b\\ [\\] \\es',(h',l',sh'),b'\\\"\n and IH: \"\\E Ts. \\P,E \\ (h,l,sh) \\; iconfs sh es; P,E,h,sh \\ es [:] Ts\\\n \\ \\Us. P,E,h',sh' \\ es' [:] Us \\ P \\ Us [\\] Ts\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (Val v\\M(es))\"\n and wt: \"P,E,h,sh \\ Val v\\M(es) : T\" by fact+\n have iconfs: \"iconfs sh es\" using iconf by simp\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix C D Ts Us pns body\n assume wte: \"P,E,h,sh \\ Val v : Class C\"\n and \"P \\ C sees M,NonStatic:Ts\\T = (pns,body) in D\"\n and wtes: \"P,E,h,sh \\ es [:] Us\" and \"P \\ Us [\\] Ts\"\n moreover have \"P,E,h',sh' \\ Val v : Class C\"\n using WTrt_hext_mono[OF wte reds_hext_incr[OF reds]] by auto\n moreover\n obtain Us' where \"P,E,h',sh' \\ es' [:] Us' \\ P \\ Us' [\\] Us\"\n using IH[OF conf iconfs wtes] by blast\n ultimately show ?thesis by(blast intro:WTrtCall widens_trans)\n next\n fix Us\n assume null: \"P,E,h,sh \\ Val v : NT\" and wtes: \"P,E,h,sh \\ es [:] Us\"\n from null have \"v = Null\" by simp\n moreover\n obtain Us' where \"P,E,h',sh' \\ es' [:] Us' \\ P \\ Us' [\\] Us\"\n using IH[OF conf iconfs wtes] by blast\n ultimately show ?thesis by(fastforce intro:WTrtCallNT)\n qed\nnext\n case (RedCall h a C fs M Ts T pns body D vs l sh b E T')\n have hp: \"h a = Some(C,fs)\"\n and \"method\": \"P \\ C sees M,NonStatic: Ts\\T = (pns,body) in D\"\n and wt: \"P,E,h,sh \\ addr a\\M(map Val vs) : T'\" by fact+\n obtain Ts' where wtes: \"P,E,h,sh \\ map Val vs [:] Ts'\"\n and subs: \"P \\ Ts' [\\] Ts\" and T'isT: \"T' = T\"\n using wt \"method\" hp by (auto dest:sees_method_fun)\n from wtes subs have length_vs: \"length vs = length Ts\"\n by(fastforce simp:list_all2_iff dest!:WTrts_same_length)\n from sees_wf_mdecl[OF wf \"method\"] obtain T''\n where wtabody: \"P,[this#pns [\\] Class D#Ts] \\ body :: T''\"\n and T''subT: \"P \\ T'' \\ T\" and length_pns: \"length pns = length Ts\"\n by(fastforce simp:wf_mdecl_def simp del:map_upds_twist)\n from wtabody have \"P,Map.empty(this#pns [\\] Class D#Ts),h,sh \\ body : T''\"\n by(rule WT_implies_WTrt)\n hence \"P,E(this#pns [\\] Class D#Ts),h,sh \\ body : T''\"\n by(rule WTrt_env_mono) simp\n hence \"P,E,h,sh \\ blocks(this#pns, Class D#Ts, Addr a#vs, body) : T''\"\n using wtes subs hp sees_method_decl_above[OF \"method\"] length_vs length_pns\n by(fastforce simp add:wt_blocks rel_list_all2_Cons2)\n with T''subT T'isT show ?case by blast\nnext\n case RedCallNull thus ?case\n by(fastforce intro: WTThrow[OF WTVal] elim!:typeof_NullPointer simp: sconf_def hconf_def)\nnext\n case RedCallStatic then show ?case \n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case (SCallParams es h l sh b es' h' l' sh' b' C M)\n have IH: \"\\E Ts. \\P,E \\ (h,l,sh) \\; iconfs sh es; P,E,h,sh \\ es [:] Ts\\\n \\ \\Us. P,E,h',sh' \\ es' [:] Us \\ P \\ Us [\\] Ts\"\n and conf: \"P,E \\ (h,l,sh) \\\" and iconf: \"iconf sh (C\\\\<^sub>sM(es))\"\n and wt: \"P,E,h,sh \\ C\\\\<^sub>sM(es) : T\" by fact+\n have iconfs: \"iconfs sh es\" using iconf by simp\n from wt show ?case\n proof (rule WTrt_elim_cases)\n fix D Ts Us pns body sfs vs\n assume method: \"P \\ C sees M,Static:Ts\\T = (pns,body) in D\"\n and wtes: \"P,E,h,sh \\ es [:] Us\" and us: \"P \\ Us [\\] Ts\"\n and clinit: \"M = clinit \\ sh D = \\(sfs,Processing)\\ \\ es = map Val vs\"\n obtain Us' where es': \"P,E,h',sh' \\ es' [:] Us'\" and us': \"P \\ Us' [\\] Us\"\n using IH[OF conf iconfs wtes] by blast\n show ?thesis\n proof(cases \"M = clinit\")\n case True then show ?thesis using clinit SCallParams.hyps(1) by blast\n next\n case False\n then show ?thesis using es' method us us' by(blast intro:WTrtSCall widens_trans)\n qed\n qed\nnext\n case (RedSCall C M Ts T pns body D vs h l sh E T')\n have \"method\": \"P \\ C sees M,Static: Ts\\T = (pns,body) in D\"\n and wt: \"P,E,h,sh \\ C\\\\<^sub>sM(map Val vs) : T'\" by fact+\n obtain Ts' where wtes: \"P,E,h,sh \\ map Val vs [:] Ts'\"\n and subs: \"P \\ Ts' [\\] Ts\" and T'isT: \"T' = T\"\n using wt \"method\" map_Val_eq by(auto dest:sees_method_fun)+\n from wtes subs have length_vs: \"length vs = length Ts\"\n by(fastforce simp:list_all2_iff dest!:WTrts_same_length)\n from sees_wf_mdecl[OF wf \"method\"] obtain T''\n where wtabody: \"P,[pns [\\] Ts] \\ body :: T''\"\n and T''subT: \"P \\ T'' \\ T\" and length_pns: \"length pns = length Ts\"\n by(fastforce simp:wf_mdecl_def simp del:map_upds_twist)\n from wtabody have \"P,Map.empty(pns [\\] Ts),h,sh \\ body : T''\"\n by(rule WT_implies_WTrt)\n hence \"P,E(pns [\\] Ts),h,sh \\ body : T''\"\n by(rule WTrt_env_mono) simp\n hence \"P,E,h,sh \\ blocks(pns, Ts, vs, body) : T''\"\n using wtes subs sees_method_decl_above[OF \"method\"] length_vs length_pns\n by(fastforce simp add:wt_blocks rel_list_all2_Cons2)\n with T''subT T'isT show ?case by blast\nnext\n case SCallInitDoneRed then show ?case by (meson widen_refl)\nnext\n case (SCallInitRed C F Ts t pns body D sh v h l E T)\n have \"is_class P D\" using SCallInitRed.hyps(1) by(rule sees_method_is_class')\n then have \"P,E,h,sh \\ INIT D ([D],False) \\ C\\\\<^sub>sF(map Val v) : T \\ P \\ T \\ T\"\n using SCallInitRed WTrtInit[OF SCallInitRed.prems(3)] by clarsimp\n then show ?case by(rule exI)\nnext\n case RedSCallNone then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_NoSuchMethodError\n simp: sconf_def hconf_def)\nnext\n case RedSCallNonStatic then show ?case \n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_IncompatibleClassChangeError\n simp: sconf_def hconf_def)\nnext\n case BlockRedNone thus ?case\n by(auto simp del:fun_upd_apply)(fastforce simp:sconf_def lconf_def)\nnext\n case (BlockRedSome e h l V sh b e' h' l' sh' b' v T E Te)\n have red: \"P \\ \\e,(h,l(V:=None),sh),b\\ \\ \\e',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l(V:=None),sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\T'. P,E,h',sh' \\ e' : T' \\ P \\ T' \\ T\"\n and Some: \"l' V = Some v\" and conf: \"P,E \\ (h,l,sh) \\\"\n and iconf: \"iconf sh {V:T; e}\"\n and wt: \"P,E,h,sh \\ {V:T; e} : Te\" by fact+\n obtain Te' where IH': \"P,E(V\\T),h',sh' \\ e' : Te' \\ P \\ Te' \\ Te\"\n using IH conf iconf wt by(fastforce simp:sconf_def lconf_def)\n have \"P,h' \\ l' (:\\) E(V\\T)\" using conf wt\n by(fastforce intro:red_preserves_lconf[OF red] simp:sconf_def lconf_def)\n hence \"P,h' \\ v :\\ T\" using Some by(fastforce simp:lconf_def)\n with IH' show ?case\n by(fastforce simp:sconf_def conf_def fun_upd_same simp del:fun_upd_apply)\nnext\n case (InitBlockRed e h l V v sh b e' h' l' sh' b' v' T E T')\n have red: \"P \\ \\e, (h,l(V\\v),sh),b\\ \\ \\e',(h',l',sh'),b'\\\"\n and IH: \"\\E T. \\P,E \\ (h,l(V\\v),sh) \\; iconf sh e; P,E,h,sh \\ e : T\\\n \\ \\U. P,E,h',sh' \\ e' : U \\ P \\ U \\ T\"\n and v': \"l' V = Some v'\" and conf: \"P,E \\ (h,l,sh) \\\"\n and iconf: \"iconf sh {V:T; V:=Val v;; e}\"\n and wt: \"P,E,h,sh \\ {V:T := Val v; e} : T'\" by fact+\n from wt obtain T\\<^sub>1 where wt\\<^sub>1: \"typeof\\<^bsub>h\\<^esub> v = Some T\\<^sub>1\"\n and T1subT: \"P \\ T\\<^sub>1 \\ T\" and wt\\<^sub>2: \"P,E(V\\T),h,sh \\ e : T'\" by auto\n have lconf\\<^sub>2: \"P,h \\ l(V\\v) (:\\) E(V\\T)\" using conf wt\\<^sub>1 T1subT\n by(simp add:sconf_def lconf_upd2 conf_def)\n have \"\\T\\<^sub>1'. typeof\\<^bsub>h'\\<^esub> v' = Some T\\<^sub>1' \\ P \\ T\\<^sub>1' \\ T\"\n using v' red_preserves_lconf[OF red wt\\<^sub>2 lconf\\<^sub>2]\n by(fastforce simp:lconf_def conf_def)\n with IH conf iconf lconf\\<^sub>2 wt\\<^sub>2 show ?case by (fastforce simp add:sconf_def)\nnext\n case (SeqRed e h l sh b e' h' l' sh' b' e\\<^sub>2)\n then have val: \"val_of e = None\" by (simp add: val_no_step)\n show ?case\n proof(cases \"lass_val_of e\")\n case None\n then show ?thesis\n using SeqRed val by(auto elim: WTrt_hext_shext_mono[OF _ red_hext_incr red_shext_incr])\n next\n case (Some a)\n have \"sh = sh'\" using SeqRed lass_val_of_spec[OF Some] by auto\n then show ?thesis using SeqRed val Some\n by(auto intro: lass_val_of_iconf[OF Some] elim: WTrt_hext_mono[OF _ red_hext_incr])\n qed\nnext\n case CondRed thus ?case\n by auto (blast intro:WTrt_hext_shext_mono[OF _ red_hext_incr red_shext_incr])+\nnext\n case ThrowRed thus ?case\n by(auto simp:is_refT_def)(blast dest:widen_Class[THEN iffD1])+\nnext\n case RedThrowNull thus ?case\n by(fastforce intro: WTThrow[OF WTVal] elim!:typeof_NullPointer simp:sconf_def hconf_def)\nnext\n case TryRed thus ?case\n by auto (blast intro:widen_trans WTrt_hext_shext_mono[OF _ red_hext_incr red_shext_incr])\nnext\n case RedTryFail thus ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] simp:sconf_def hconf_def)\nnext\n case (ListRed1 e h l sh b e' h' l' sh' b' es)\n then have val: \"val_of e = None\" by(simp add: val_no_step)\n obtain U Us where Ts: \"Ts = U # Us\" using ListRed1 by auto\n then have nsub_RI: \"\\ sub_RIs es\" and wts: \"P,E,h,sh \\ es [:] Us\" and wt: \"P,E,h,sh \\ e : U\"\n and IH: \"\\E T. \\P,E \\ (h, l, sh) \\; P,E,h,sh \\ e : T\\ \\ \\T'. P,E,h',sh' \\ e' : T' \\ P \\ T' \\ T\"\n using ListRed1 val by auto\n obtain T' where\n \"\\E0 E1. (\\T2. P,E1,h',sh' \\ e' : T2 \\ P \\ T2 \\ E0) = (P,E1,h',sh' \\ e' : T' E0 E1 \\ P \\ T' E0 E1 \\ E0)\"\n by moura\n then have disj: \"\\E t. \\ P,E \\ (h, l, sh) \\ \\ \\ P,E,h,sh \\ e : t \\ P,E,h',sh' \\ e' : T' t E \\ P \\ T' t E \\ t\"\n using IH by presburger\n have \"P,E,h',sh' \\ es [:] Us\"\n using nsub_RI wts wt by (metis (no_types) ListRed1.hyps(1) WTrts_hext_shext_mono red_hext_incr red_shext_incr)\n then have \"\\ts. (\\t tsa. ts = t # tsa \\ P,E,h',sh' \\ e' : t \\ P,E,h',sh' \\ es [:] tsa) \\ P \\ ts [\\] (U # Us)\"\n using disj wt ListRed1.prems(1) by blast\n then show ?case using Ts by auto\nnext\n case ListRed2 thus ?case\n by(fastforce dest: hext_typeof_mono[OF reds_hext_incr])\nnext\n case (InitNoneRed sh C C' Cs e h l b)\n then have sh: \"sh \\\\<^sub>s sh(C \\ (sblank P C, Prepared))\" by(simp add: shext_def)\n have wt: \"P,E,h,sh(C \\ (sblank P C, Prepared)) \\ INIT C' (C # Cs,False) \\ e : T\"\n using InitNoneRed WTrt_shext_mono[OF _ sh] by fastforce\n then show ?case by(rule_tac x = T in exI) (simp add: fun_upd_def)\nnext\n case (RedInitDone sh C sfs C' Cs e h l b)\n then have \"P,E,h,sh \\ INIT C' (Cs,True) \\ e : T\" by auto (metis Nil_tl list.set_sel(2))\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case (RedInitProcessing sh C sfs C' Cs e h l b)\n then have \"P,E,h,sh \\ INIT C' (Cs,True) \\ e : T\" by auto (metis Nil_tl list.set_sel(2))+\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case RedInitError then show ?case\n by(fastforce intro: WTrtThrow[OF WTrtVal] elim!: typeof_NoClassDefFoundError\n simp: sconf_def hconf_def)\nnext\n case (InitObjectRed sh C sfs sh' C' Cs e h l b)\n then have sh: \"sh \\\\<^sub>s sh(Object \\ (sfs, Processing))\" by(simp add: shext_def)\n have \"P,E,h,sh' \\ INIT C' (C # Cs,True) \\ e : T\"\n using InitObjectRed WTrt_shext_mono[OF _ sh] by auto\n then show ?case by(rule_tac x = T in exI) (simp add: fun_upd_def)\nnext\n case (InitNonObjectSuperRed sh C sfs D fs ms sh' C' Cs e h l b)\n then have sh: \"sh \\\\<^sub>s sh(C \\ (sfs, Processing))\" by(simp add: shext_def)\n then have cd: \"is_class P D\" using InitNonObjectSuperRed class_wf wf wf_cdecl_supD by blast\n have sup': \"supercls_lst P (C # Cs)\" using InitNonObjectSuperRed.prems(3) by auto\n then have sup: \"supercls_lst P (D # C # Cs)\"\n using supercls_lst_app[of P C Cs D] subcls1I[OF InitNonObjectSuperRed.hyps(3,2)] by auto\n have \"distinct (C # Cs)\" using InitNonObjectSuperRed.prems(3) by auto\n then have dist: \"distinct (D # C # Cs)\"\n using wf_supercls_distinct_app[OF wf InitNonObjectSuperRed.hyps(2-3) sup'] by simp\n have \"P,E,h,sh' \\ INIT C' (D # C # Cs,False) \\ e : T\"\n using InitNonObjectSuperRed WTrt_shext_mono[OF _ sh] cd sup dist by auto\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case (RedInitRInit C' C Cs e' h l sh b E T)\n then obtain a sfs where C: \"class P C = \\a\\\" and proc: \"sh C = \\(sfs, Processing)\\\"\n using WTrtInit by(auto simp: is_class_def)\n then have T': \"P,E,h,sh \\ C\\\\<^sub>sclinit([]) : Void\" using wf_types_clinit[OF wf C] by simp\n have \"P,E,h,sh \\ RI (C,C\\\\<^sub>sclinit([])) ; Cs \\ e' : T\"\n using RedInitRInit by(auto intro: T')\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case (RInitRed e h l sh b e' h' l' sh' b' C Cs e\\<^sub>0 E T)\n then have \"(\\E T. P,E \\ (h, l, sh) \\ \\ P,E,h,sh \\ e : T \\ \\T'. P,E,h',sh' \\ e' : T' \\ P \\ T' \\ T)\"\n by auto\n then have \"\\T'. P,E,h',sh' \\ e' : T'\" using RInitRed by blast\n then obtain T' where e': \"P,E,h',sh' \\ e' : T'\" by auto\n have wt\\<^sub>0: \"P,E,h',sh' \\ e\\<^sub>0 : T\"\n using RInitRed by simp (auto intro: WTrt_hext_shext_mono[OF _ red_hext_incr red_shext_incr])\n have nip: \"\\C' \\ set (C#Cs). not_init C' e' \\ (\\sfs. sh' C' = \\(sfs, Processing)\\)\"\n using RInitRed red_proc_pres[OF wf_prog_wwf_prog[OF wf]] by auto\n have shC: \"\\sfs. sh' C = \\(sfs, Processing)\\ \\ sh' C = \\(sfs, Error)\\ \\ e' = THROW NoClassDefFoundError\"\n using RInitRed red_proc_pres[OF wf_prog_wwf_prog[OF wf] RInitRed.hyps(1)] by blast\n have \"P,E,h',sh' \\ RI (C,e') ; Cs \\ e\\<^sub>0 : T\" using RInitRed e' wt\\<^sub>0 nip shC by auto\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case (RedRInit sh C sfs i sh' C' Cs v e h l b)\n then have sh: \"sh \\\\<^sub>s sh(C \\ (sfs, Done))\" by(auto simp: shext_def)\n have wt: \"P,E,h,sh(C \\ (sfs, Done)) \\ e : T\"\n using RedRInit WTrt_shext_mono[OF _ sh] by auto\n have shC: \"\\C' \\ set(tl Cs). \\sfs. sh C' = \\(sfs, Processing)\\\" using RedRInit by(cases Cs, auto)\n have \"P,E,h,sh' \\ INIT C' (Cs,True) \\ e : T\" using RedRInit wt shC by(cases Cs, auto)\n then show ?case by(rule_tac x = T in exI) simp\nnext\n case (SCallThrowParams es vs e es' C M h l sh b)\n then show ?case using map_Val_nthrow_neq[of _ vs e es'] by fastforce\nnext\n case (RInitInitThrow sh C sfs i sh' a D Cs e h l b)\n then have sh: \"sh \\\\<^sub>s sh(C \\ (sfs, Error))\" by(auto simp: shext_def)\n have wt: \"P,E,h,sh(C \\ (sfs, Error)) \\ e : T\"\n using RInitInitThrow WTrt_shext_mono[OF _ sh] by clarsimp\n then have \"P,E,h,sh' \\ RI (D,Throw a) ; Cs \\ e : T\" using RInitInitThrow by auto\n then show ?case by(rule_tac x = T in exI) simp\nqed fastforce+ (* esp all Throw propagation rules except RInitInit are dealt with here *)\n(*>*)\n\n\ncorollary subject_reduction:\n \"\\ wf_J_prog P; P \\ \\e,s,b\\ \\ \\e',s',b'\\; P,E \\ s \\; iconf (shp s) e; P,E,hp s,shp s \\ e:T \\\n \\ \\T'. P,E,hp s',shp s' \\ e':T' \\ P \\ T' \\ T\"\n(*<*)by(cases s, cases s', fastforce dest:subject_reduction2)(*>*)\n\ncorollary subjects_reduction:\n \"\\ wf_J_prog P; P \\ \\es,s,b\\ [\\] \\es',s',b'\\; P,E \\ s \\; iconfs (shp s) es; P,E,hp s,shp s \\ es[:]Ts \\\n \\ \\Ts'. P,E,hp s',shp s' \\ es'[:]Ts' \\ P \\ Ts' [\\] Ts\"\n(*<*)by(cases s, cases s', fastforce dest:subjects_reduction2)(*>*)\n\n\nsubsection \\ Lifting to @{text\"\\*\"} \\\n\ntext\\ Now all these preservation lemmas are first lifted to the transitive\nclosure \\dots \\\n\nlemma Red_preserves_sconf:\nassumes wf: \"wf_J_prog P\" and Red: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"\\T. \\ P,E,hp s,shp s \\ e : T; iconf (shp s) e; P,E \\ s \\ \\ \\ P,E \\ s' \\\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl show ?case by fact\nnext\n case (step e s b e' s' b')\n obtain h l sh h' l' sh' where s:\"s = (h,l,sh)\" and s':\"s' = (h',l',sh')\"\n by(cases s, cases s')\n then have \"P \\ \\e,(h,l,sh),b\\ \\ \\e',(h',l',sh'),b'\\\" using step.hyps(1) by simp\n then have iconf': \"iconf (shp s') e'\" using red_preserves_iconf[OF wf_prog_wwf_prog[OF wf]]\n step.prems(2) s s' by simp\n thus ?case using step\n by(blast intro:red_preserves_sconf dest: subject_reduction[OF wf])\nqed\n(*>*)\n\nlemma Red_preserves_iconf:\nassumes wf: \"wwf_J_prog P\" and Red: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"iconf (shp s) e \\ iconf (shp s') e'\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl show ?case by fact\nnext\n case (step e s b e' s' b')\n thus ?case using wf step by(cases s, cases s', simp) (blast intro:red_preserves_iconf)\nqed\n(*>*)\n\nlemma Reds_preserves_iconf:\nassumes wf: \"wwf_J_prog P\" and Red: \"P \\ \\es,s,b\\ [\\]* \\es',s',b'\\\"\nshows \"iconfs (shp s) es \\ iconfs (shp s') es'\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl show ?case by fact\nnext\n case (step e s b e' s' b')\n thus ?case using wf step by(cases s, cases s', simp) (blast intro:reds_preserves_iconf)\nqed\n(*>*)\n\nlemma Red_preserves_bconf:\nassumes wf: \"wwf_J_prog P\" and Red: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"iconf (shp s) e \\ P,(shp s) \\\\<^sub>b (e,b) \\ \\ P,(shp s') \\\\<^sub>b (e'::expr,b') \\\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl show ?case by fact\nnext\n case (step e s1 b e' s2 b')\n then have \"iconf (shp s2) e'\" using step red_preserves_iconf[OF wf]\n by(cases s1, cases s2) auto\n thus ?case using step by(cases s1, cases s2, simp) (blast intro:red_preserves_bconf)\nqed\n(*>*)\n\nlemma Reds_preserves_bconf:\nassumes wf: \"wwf_J_prog P\" and Red: \"P \\ \\es,s,b\\ [\\]* \\es',s',b'\\\"\nshows \"iconfs (shp s) es \\ P,(shp s) \\\\<^sub>b (es,b) \\ \\ P,(shp s') \\\\<^sub>b (es'::expr list,b') \\\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl show ?case by fact\nnext\n case (step es s1 b es' s2 b')\n then have \"iconfs (shp s2) es'\" using step reds_preserves_iconf[OF wf]\n by(cases s1, cases s2) auto\n thus ?case using step by(cases s1, cases s2, simp) (blast intro:reds_preserves_bconf)\nqed\n(*>*)\n\nlemma Red_preserves_defass:\nassumes wf: \"wf_J_prog P\" and reds: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"\\ e \\dom(lcl s)\\ \\ \\ e' \\dom(lcl s')\\\"\nusing reds\nproof (induct rule:converse_rtrancl_induct3)\n case refl thus ?case .\nnext\n case (step e s b e' s' b') thus ?case\n by(cases s,cases s')(auto dest:red_preserves_defass[OF wf])\nqed\n\n\nlemma Red_preserves_type:\nassumes wf: \"wf_J_prog P\" and Red: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"!!T. \\ P,E \\ s\\; iconf (shp s) e; P,E,hp s,shp s \\ e:T \\\n \\ \\T'. P \\ T' \\ T \\ P,E,hp s',shp s' \\ e':T'\"\n(*<*)\nusing Red\nproof (induct rule:converse_rtrancl_induct3)\n case refl thus ?case by blast\nnext\n case step thus ?case\n by(blast intro:widen_trans red_preserves_sconf Red_preserves_iconf[OF wf_prog_wwf_prog[OF wf]]\n dest:subject_reduction[OF wf])\nqed\n(*>*)\n\n\nsubsection \"The final polish\"\n\ntext\\ The above preservation lemmas are now combined and packed nicely. \\\n\ndefinition wf_config :: \"J_prog \\ env \\ state \\ expr \\ ty \\ bool\" (\"_,_,_ \\ _ : _ \\\" [51,0,0,0,0]50)\nwhere\n \"P,E,s \\ e:T \\ \\ P,E \\ s \\ \\ iconf (shp s) e \\ P,E,hp s,shp s \\ e:T\"\n\ntheorem Subject_reduction: assumes wf: \"wf_J_prog P\"\nshows \"P \\ \\e,s,b\\ \\ \\e',s',b'\\ \\ P,E,s \\ e : T \\\n \\ \\T'. P,E,s' \\ e' : T' \\ \\ P \\ T' \\ T\"\n(*<*)\nby(cases s, cases s')\n (force simp: wf_config_def\n elim:red_preserves_sconf red_preserves_iconf[OF wf_prog_wwf_prog[OF wf]]\n dest:subject_reduction[OF wf])\n(*>*)\n\n\ntheorem Subject_reductions:\nassumes wf: \"wf_J_prog P\" and reds: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\nshows \"\\T. P,E,s \\ e:T \\ \\ \\T'. P,E,s' \\ e':T' \\ \\ P \\ T' \\ T\"\n(*<*)\nusing reds\nproof (induct rule:converse_rtrancl_induct3)\n case refl thus ?case by blast\nnext\n case step thus ?case\n by(blast dest:Subject_reduction[OF wf] intro:widen_trans)\nqed\n(*>*)\n\n\ncorollary Progress: assumes wf: \"wf_J_prog P\"\nshows \"\\ P,E,s \\ e : T \\; \\ e \\dom(lcl s)\\; P,shp s \\\\<^sub>b (e,b) \\; \\ final e \\\n \\ \\e' s' b'. P \\ \\e,s,b\\ \\ \\e',s',b'\\\"\n(*<*)\nusing progress[OF wf_prog_wwf_prog[OF wf]]\nby(cases b) (auto simp:wf_config_def sconf_def)\n(*>*)\n\ncorollary TypeSafety:\nfixes s::state and e::expr\nassumes wf: \"wf_J_prog P\" and sconf: \"P,E \\ s \\\" and wt: \"P,E \\ e::T\"\n and \\: \"\\ e \\dom(lcl s)\\\"\n and iconf: \"iconf (shp s) e\" and bconf: \"P,(shp s) \\\\<^sub>b (e,b) \\\"\n and steps: \"P \\ \\e,s,b\\ \\* \\e',s',b'\\\"\n and nstep: \"\\(\\e'' s'' b''. P \\ \\e',s',b'\\ \\ \\e'',s'',b''\\)\"\nshows \"(\\v. e' = Val v \\ P,hp s' \\ v :\\ T) \\\n (\\a. e' = Throw a \\ a \\ dom(hp s'))\"\n(*<*)\nproof -\n have wwf: \"wwf_J_prog P\" by(rule wf_prog_wwf_prog[OF wf])\n have wfc: \"P,E,s \\ e:T \\\" using WT_implies_WTrt[OF wt] sconf iconf\n by(simp add:wf_config_def)\n obtain T' where wfc': \"P,E,s' \\ e' : T' \\\" and T': \"P \\ T' \\ T\"\n using Subject_reductions[OF wf steps wfc] by clarsimp\n have \\': \"\\ e' \\dom (lcl s')\\\"\n by(rule Red_preserves_defass[OF wf steps \\])\n have bconf': \"P,(shp s') \\\\<^sub>b (e',b') \\\"\n by(rule Red_preserves_bconf[OF wwf steps iconf bconf])\n have fin': \"final e'\" using Progress[OF wf wfc' \\' bconf'] nstep by blast\n then show ?thesis using wfc wfc' T'\n by(fastforce simp:wf_config_def final_def conf_def)\nqed\n(*>*)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/J/TypeSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.27158017776866955}} {"text": "theory TickTock_UntimedPrefix\n imports TickTock_Prefix TickTock_ExtChoice TickTock_Basic_Ops\nbegin\n\nsubsection \\Instantaneous (Untimed) Prefix\\\n\ndefinition UntimedPrefixTT :: \"'e \\ 'e ttprocess \\ 'e ttprocess\" (infixr \"\\\\<^sub>U\" 61) where\n \"e \\\\<^sub>U P = (e \\\\<^sub>C P \\\\<^sub>C STOP\\<^sub>U)\"\n\nlemma UntimedPrefixTT_def2:\n \"e \\\\<^sub>U P = {t. t = [] \\ (\\ X. Event e \\ X \\ t = [[X]\\<^sub>R]) \\ (\\ \\\\P. t = [[Event e]\\<^sub>E] @ \\)}\"\n unfolding UntimedPrefixTT_def PrefixTT_def ExtChoiceTT_def UntimedStopTT_def\nproof (safe, simp_all)\n fix \\\n assume \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ \\ \\' \\\\<^sub>C []\" \"\\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n then show \"\\ = []\"\n by (erule_tac x=\\ in ballE, simp_all add: tt_prefix_antisym tt_prefix_refl tocks_tt_subset2 tt_subset_refl)\nnext\n fix \\\n assume \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ \\ \\' \\\\<^sub>C []\" \"\\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n then show \"\\ = []\"\n by (erule_tac x=\\ in ballE, simp_all add: tt_prefix_antisym tt_prefix_refl tocks_tt_subset2 tt_subset_refl)\nnext\n fix sa X\n assume \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C sa @ [[X]\\<^sub>R] \\ \\' \\\\<^sub>C []\" \"sa \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n then show \"sa \\ [] \\ False\"\n apply (erule_tac x=sa in ballE, simp add: tt_prefix_antisym tt_prefix_concat)\n using tocks_tt_subset2 tt_subset_refl by blast\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then show \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_\\_in_tocks: \"\\ @ \\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_longest_tocks_sigma: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\\"\n assume \"\\ @ \\ = [[X]\\<^sub>R]\" \"\\ \\ tocks UNIV\"\n then have \"\\ = []\"\n by (cases \\ rule:ttWF.cases, auto simp add: notin_tocks)\n then have \"\\ \\ tocks {x. x \\ Tock \\ x \\ Event e} \\ \\ = []\"\n using \\_\\_in_tocks by auto\n then show \"\\ = []\"\n by (metis (full_types) \\_longest_tocks_sigma append_Nil self_extension_tt_prefix tocks_tt_subset2 tt_prefix_refl tt_subset_refl)\nnext\n fix \\ \\ \\ s :: \"'a tttrace\" and X Xa :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C s @ [[Xa]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and s_in_tocks: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\" and \\_\\_def: \"\\ @ \\ = s @ [[Xa]\\<^sub>R]\"\n\n have \"\\ = []\"\n using \\_in_tocks \\_\\_def by (induct \\ rule:ttWF.induct, auto simp add: notin_tocks)\n then have \"s = []\"\n by (metis (full_types) \\_longest_tocks_\\ neq_Nil_conv s_in_tocks tocks_subset top_greatest tt_prefix.simps(3) tt_prefix_concat)\n then show \"s \\ [] \\ \\ = []\"\n by auto\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [[X]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n assume \\_refusal_imp_\\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\_\\_in_tocks: \"\\ @ \\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\"\n\n have \\_empty: \"\\ = []\"\n using \\_\\_def \\_in_tocks append_eq_Cons_conv in_tocks_last by fastforce\n then have \\_refusal: \"\\ = [[X]\\<^sub>R]\"\n using \\_\\_def by auto\n then obtain Y where \\_refusal: \"\\ = [[Y]\\<^sub>R]\"\n using \\_refusal_imp_\\_refusal by auto\n then have \"[[X]\\<^sub>R] \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n using \\_\\_in_tocks end_refusal_notin_tocks by blast\n then have False\n using refusal_notin_tocks by blast\n then show \"\\ = []\"\n by auto\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [[X]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n assume \\_refusal_imp_\\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\_\\_in_tocks: \"\\ @ \\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\"\n\n have \\_empty: \"\\ = []\"\n using \\_\\_def \\_in_tocks append_eq_Cons_conv in_tocks_last by fastforce\n then have \\_refusal: \"\\ = [[X]\\<^sub>R]\"\n using \\_\\_def by auto\n then obtain Y where \\_refusal: \"\\ = [[Y]\\<^sub>R]\"\n using \\_refusal_imp_\\_refusal by auto\n then have \"[[X]\\<^sub>R] \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n using \\_\\_in_tocks end_refusal_notin_tocks by blast\n then have False\n using refusal_notin_tocks by blast\n then show \"\\ = []\"\n by auto\nnext\n fix \\ \\ \\ :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [[X]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n assume \\_refusal_imp_\\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\_\\_in_tocks: \"\\ @ \\ \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\"\n\n have \\_empty: \"\\ = []\"\n using \\_\\_def \\_in_tocks append_eq_Cons_conv in_tocks_last by fastforce\n then have \\_refusal: \"\\ = [[X]\\<^sub>R]\"\n using \\_\\_def by auto\n then obtain Y where \\_refusal: \"\\ = [[Y]\\<^sub>R]\"\n using \\_refusal_imp_\\_refusal by auto\n then have \"[[X]\\<^sub>R] \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n using \\_\\_in_tocks end_refusal_notin_tocks by blast\n then have False\n using refusal_notin_tocks by blast\n then show \"\\ = []\"\n by auto\nnext\n fix \\ \\ \\ s :: \"'a tttrace\" and X Xa :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C [[X]\\<^sub>R] \\ \\' \\\\<^sub>C \\\"\n assume \\_refusal_imp_\\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and \\_\\_in_tocks: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\" and \\_\\_def: \"\\ @ \\ = s @ [[Xa]\\<^sub>R]\"\n assume e_in_X: \"Event e \\ X\" and e_in_Xa: \"Event e \\ Xa\"\n\n have \\_empty: \"\\ = []\"\n using \\_\\_def \\_in_tocks append_eq_Cons_conv in_tocks_last by fastforce\n have \\_refusal: \"\\ = [[X]\\<^sub>R]\"\n using \\_empty \\_\\_def by auto\n have \\_refusal: \"\\ = [[Xa]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Xa) \\ e = Tock)\"\n using \\_\\_def \\_refusal \\_refusal_imp_\\_refusal by auto\n then have \"Event e \\ Xa\"\n using e_in_X by blast\n then have \"False\"\n using e_in_Xa by blast\n then show \"\\ = []\"\n by auto\nnext\n fix \\ s \\' :: \"'a tttrace\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C s @ [Event e]\\<^sub>E # \\' \\ \\' \\\\<^sub>C []\"\n assume s_in_tocks: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_assm: \"\\\\\\P. s @ [Event e]\\<^sub>E # \\' \\ [Event e]\\<^sub>E # \\\"\n assume \\'_in_P: \"\\' \\ P\"\n\n have \"s = []\"\n by (meson \\_longest_tocks_\\ s_in_tocks tocks_subset top_greatest tt_prefix.simps(1) tt_prefix_antisym tt_prefix_concat)\n then show \"False\"\n using \\_\\_assm \\'_in_P by blast\nnext\n fix \\ \\ \\ s \\' :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C s @ [Event e]\\<^sub>E # \\' \\ \\' \\\\<^sub>C \\\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and s_in_tocks: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\"\n assume \\_\\_assm: \"\\\\\\P. s @ [Event e]\\<^sub>E # \\' \\ [Event e]\\<^sub>E # \\\"\n assume \\'_in_P: \"\\' \\ P\"\n\n have \"\\ = []\"\n by (metis Cons_eq_append_conv \\_\\_def \\_in_tocks append_Nil2 append_is_Nil_conv refusal_notin_tocks)\n then have \"s = []\"\n by (metis (mono_tags) \\_longest_tocks_\\ s_in_tocks tocks_subset top_greatest tt_prefix.simps(1) tt_prefix_antisym tt_prefix_concat)\n then show \" \\ = []\"\n using \\_\\_assm \\'_in_P by blast\nnext\n fix \\ \\ \\ s \\' :: \"'a tttrace\" and X :: \"'a ttevent set\"\n assume \\_longest_tocks_\\: \"\\\\'\\tocks UNIV. \\' \\\\<^sub>C s @ [Event e]\\<^sub>E # \\' \\ \\' \\\\<^sub>C \\\"\n assume \\_in_tocks: \"\\ \\ tocks UNIV\" and s_in_tocks: \"s \\ tocks {x. x \\ Tock \\ x \\ Event e}\"\n assume \\_refusal_imp_\\_refusal: \"\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))\"\n assume \\_\\_def: \"\\ @ \\ = [[X]\\<^sub>R]\" and \\_\\_def: \"\\ @ \\ = s @ [Event e]\\<^sub>E # \\'\" \n assume \\'_in_P: \"\\' \\ P\"\n\n have \\_empty: \"\\ = []\"\n by (metis Cons_eq_append_conv \\_\\_def \\_in_tocks append_Nil2 append_is_Nil_conv refusal_notin_tocks)\n then have \"s = []\"\n by (metis (mono_tags) \\_longest_tocks_\\ s_in_tocks tocks_subset top_greatest tt_prefix.simps(1) tt_prefix_antisym tt_prefix_concat)\n also have \"\\Y. \\ = [[Y]\\<^sub>R]\"\n using \\_\\_def \\_empty \\_refusal_imp_\\_refusal by auto\n then have False\n using calculation \\_\\_def by (simp add: \\_empty)\n then show \"\\ = []\"\n by blast\nnext\n show \"\\\\\\tocks UNIV.\n \\\\. ((\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\ = s \\ (\\X. Tock \\ X \\ Event e \\ X \\ \\ @ \\ = s @ [[X]\\<^sub>R])) \\\n (\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\ = s \\ (\\\\'\\P. \\ @ \\ = s @ [Event e]\\<^sub>E # \\'))) \\\n (\\\\. (\\ = [] \\ \\ = [] \\ (\\X. \\ @ \\ = [[X]\\<^sub>R])) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\ (\\ = [] \\ \\ = [] \\ \\ = [] \\ \\ = []))\"\n by (rule_tac x=\"[]\" in bexI, rule_tac x=\"[]\" in exI, auto simp add: tocks.intros)\nnext\n fix X\n assume \"Event e \\ X\"\n then show \"\\\\\\tocks UNIV.\n \\\\. ((\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\ = s \\ (\\X. Tock \\ X \\ Event e \\ X \\ \\ @ \\ = s @ [[X]\\<^sub>R])) \\\n (\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\ = s \\ (\\\\'\\P. \\ @ \\ = s @ [Event e]\\<^sub>E # \\'))) \\\n (\\\\. (\\ = [] \\ \\ = [] \\ (\\X. \\ @ \\ = [[X]\\<^sub>R])) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\ ([[X]\\<^sub>R] = \\ @ \\ \\ [[X]\\<^sub>R] = \\ @ \\))\"\n apply (rule_tac x=\"[]\" in bexI, auto)\n apply (rule_tac x=\"[[{x\\X. x \\ Tock}]\\<^sub>R]\" in exI, safe, simp_all add: tocks.intros)\n apply (rule_tac x=\"[[X]\\<^sub>R]\" in exI, auto)\n using refusal_notin_tocks tt_prefix_notfront_is_whole by force+\nnext\n fix \\\n assume \"\\ \\ P\"\n then show \"\\\\\\tocks UNIV.\n \\\\'. ((\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\' = s \\ (\\X. Tock \\ X \\ Event e \\ X \\ \\ @ \\' = s @ [[X]\\<^sub>R])) \\\n (\\s\\tocks {x. x \\ Tock \\ x \\ Event e}. \\ @ \\' = s \\ (\\\\\\P. \\ @ \\' = s @ [Event e]\\<^sub>E # \\))) \\\n (\\\\. (\\ = [] \\ \\ = [] \\ (\\X. \\ @ \\ = [[X]\\<^sub>R])) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\' \\ \\' \\\\<^sub>C \\) \\\n (\\\\'\\tocks UNIV. \\' \\\\<^sub>C \\ @ \\ \\ \\' \\\\<^sub>C \\) \\\n (\\X. \\' = [[X]\\<^sub>R] \\ (\\Y. \\ = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n (\\X. \\ = [[X]\\<^sub>R] \\ (\\Y. \\' = [[Y]\\<^sub>R] \\ (\\e. (e \\ X) = (e \\ Y) \\ e = Tock))) \\\n ([Event e]\\<^sub>E # \\ = \\ @ \\' \\ [Event e]\\<^sub>E # \\ = \\ @ \\))\"\n apply (rule_tac x=\"[]\" in bexI, auto)\n apply (rule_tac x=\"[Event e]\\<^sub>E # \\\" in exI, safe, simp_all add: tocks.intros)\n apply (erule_tac x=\"[]\" in ballE, safe, simp_all add: tocks.intros, blast)\n by (rule_tac x=\"[]\" in exI, auto, metis tocks.simps tt_prefix.simps(2) tt_prefix_refl ttobs.simps(4))\nqed\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/TickTock/TickTock_UntimedPrefix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.4263215925474903, "lm_q1q2_score": 0.27157998280467}} {"text": "theory GeneralKnowledge imports ValueOntology (** Benzmüller, Fuenmayor & Lomfeld, 2021 **) \nbegin (*** General Legal and World Knowledge (LWK) ***)\n(*LWK: kinds of situations addressed*)\nconsts appObject::\\ appAnimal::\\ (*appropriation of objects/animals in general*)\n appWildAnimal::\\ appDomAnimal::\\ (*appropriation of wild/domestic animals*)\n(*LWK: postulates for kinds of situations*)\naxiomatization where \n W1: \"\\appAnimal \\<^bold>\\ appObject\\\" and\n W2: \"\\\\<^bold>\\(appWildAnimal \\<^bold>\\ appDomAnimal)\\\" and \n W3: \"\\appWildAnimal \\<^bold>\\ appAnimal\\\" and\n W4: \"\\appDomAnimal \\<^bold>\\ appAnimal\\\"\n(*LWK: (prima facie) value preferences for kinds of situations*)\naxiomatization where \n R1: \"\\appAnimal \\<^bold>\\ ([STAB\\<^sup>p] \\<^bold>\\ [STAB\\<^sup>d])\\\" and \n R2: \"\\appWildAnimal \\<^bold>\\ ([WILL\\<^sup>x\\] \\<^bold>\\ [STAB\\<^sup>x])\\\" and \n R3: \"\\appDomAnimal \\<^bold>\\ ([STAB\\<^sup>x\\] \\<^bold>\\ [RELI\\<^sup>x\\<^bold>\\RESP\\<^sup>x])\\\"\n(*LWK: domain vocabulary*)\ntypedecl e (*declares new type for 'entities'*)\nconsts \n Animal::\"e\\\\\" Domestic::\"e\\\\\" Fox::\"e\\\\\" Parrot::\"e\\\\\" Pet::\"e\\\\\" FreeRoaming::\"e\\\\\" \n(*LWK: domain knowledge (about animals)*)\naxiomatization where \n W5: \"\\\\<^bold>\\a. Fox a \\<^bold>\\ Animal a\\\" and \n W6: \"\\\\<^bold>\\a. Parrot a \\<^bold>\\ Animal a\\\" and\n W7: \"\\\\<^bold>\\a. (Animal a \\<^bold>\\ FreeRoaming a \\<^bold>\\ \\<^bold>\\Pet a) \\<^bold>\\ \\<^bold>\\Domestic a\\\" and\n W8: \"\\\\<^bold>\\a. Animal a \\<^bold>\\ Pet a \\<^bold>\\ Domestic a\\\"\n(*LWK: legally-relevant, situational 'factors'*)\nconsts Own::\"c\\\\\" (*object is owned by party c*)\n Poss::\"c\\\\\" (*party c has actual possession of object*)\n Intent::\"c\\\\\" (*party c has intention to possess object*)\n Mal::\"c\\\\\" (*party c acts out of malice*)\n Mtn::\"c\\\\\" (*party c respons. for maintenance of object*)\n(*LWK: meaning postulates for general notions*)\naxiomatization where\n W9: \"\\Poss x \\<^bold>\\ (\\<^bold>\\Poss x\\)\\\" and \n W10: \"\\Own x \\<^bold>\\ (\\<^bold>\\Own x\\)\\\"\n(*LWK: conditional value preferences, e.g. from precedents*)\naxiomatization where \n R4: \"\\(Mal x\\ \\<^bold>\\ Own x) \\<^bold>\\ ([STAB\\<^sup>x\\] \\<^bold>\\ [RESP\\<^sup>x\\<^bold>\\RELI\\<^sup>x])\\\"\n(*LWK: relate values, outcomes and situational 'factors'*)\naxiomatization where \n F1: \"Promotes (Intent x) (For x) WILL\\<^sup>x\" and\n F2: \"Promotes (Mal x) (For x\\) RESP\\<^sup>x\" and \n F3: \"Promotes (Poss x) (For x) STAB\\<^sup>x\" and\n F4: \"Promotes (Mtn x) (For x) RESP\\<^sup>x\" and \n F5: \"Promotes (Own x) (For x) RELI\\<^sup>x\"\n(*Theory is consistent, (non-trivial) model found*)\nlemma True nitpick[satisfy,card \\=4] oops\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/EncodingLegalBalancing/GeneralKnowledge.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.2714025177952416}} {"text": "(* Title: HOL/HOLCF/IOA/NTP/Abschannel.thy\n Author: Olaf Müller\n*)\n\nsection {* The (faulty) transmission channel (both directions) *}\n\ntheory Abschannel\nimports IOA Action\nbegin\n\ndatatype 'a abs_action = S 'a | R 'a\n\ndefinition\n ch_asig :: \"'a abs_action signature\" where\n \"ch_asig = (UN b. {S(b)}, UN b. {R(b)}, {})\"\n\ndefinition\n ch_trans :: \"('a abs_action, 'a multiset)transition set\" where\n \"ch_trans =\n {tr. let s = fst(tr);\n t = snd(snd(tr))\n in\n case fst(snd(tr))\n of S(b) => t = addm s b |\n R(b) => count s b ~= 0 & t = delm s b}\"\n\ndefinition\n ch_ioa :: \"('a abs_action, 'a multiset)ioa\" where\n \"ch_ioa = (ch_asig, {{|}}, ch_trans,{},{})\"\n\ndefinition\n rsch_actions :: \"'m action => bool abs_action option\" where\n \"rsch_actions (akt) =\n (case akt of\n S_msg(m) => None |\n R_msg(m) => None |\n S_pkt(packet) => None |\n R_pkt(packet) => None |\n S_ack(b) => Some(S(b)) |\n R_ack(b) => Some(R(b)) |\n C_m_s => None |\n C_m_r => None |\n C_r_s => None |\n C_r_r(m) => None)\"\n\ndefinition\n srch_actions :: \"'m action =>(bool * 'm) abs_action option\" where\n \"srch_actions (akt) =\n (case akt of\n S_msg(m) => None |\n R_msg(m) => None |\n S_pkt(p) => Some(S(p)) |\n R_pkt(p) => Some(R(p)) |\n S_ack(b) => None |\n R_ack(b) => None |\n C_m_s => None |\n C_m_r => None |\n C_r_s => None |\n C_r_r(m) => None)\"\n\ndefinition\n srch_ioa :: \"('m action, 'm packet multiset)ioa\" where\n \"srch_ioa = rename ch_ioa srch_actions\"\n\ndefinition\n rsch_ioa :: \"('m action, bool multiset)ioa\" where\n \"rsch_ioa = rename ch_ioa rsch_actions\"\n\ndefinition\n srch_asig :: \"'m action signature\" where\n \"srch_asig = asig_of(srch_ioa)\"\n\ndefinition\n rsch_asig :: \"'m action signature\" where\n \"rsch_asig = asig_of(rsch_ioa)\"\n\ndefinition\n srch_wfair :: \"('m action)set set\" where\n \"srch_wfair = wfair_of(srch_ioa)\"\ndefinition\n srch_sfair :: \"('m action)set set\" where\n \"srch_sfair = sfair_of(srch_ioa)\"\ndefinition\n rsch_sfair :: \"('m action)set set\" where\n \"rsch_sfair = sfair_of(rsch_ioa)\"\ndefinition\n rsch_wfair :: \"('m action)set set\" where\n \"rsch_wfair = wfair_of(rsch_ioa)\"\n\ndefinition\n srch_trans :: \"('m action, 'm packet multiset)transition set\" where\n \"srch_trans = trans_of(srch_ioa)\"\ndefinition\n rsch_trans :: \"('m action, bool multiset)transition set\" where\n \"rsch_trans = trans_of(rsch_ioa)\"\n\n\nlemmas unfold_renaming =\n srch_asig_def rsch_asig_def rsch_ioa_def srch_ioa_def ch_ioa_def\n ch_asig_def srch_actions_def rsch_actions_def rename_def rename_set_def asig_of_def\n actions_def srch_trans_def rsch_trans_def ch_trans_def starts_of_def\n trans_of_def asig_projections\n\nlemma in_srch_asig: \n \"S_msg(m) ~: actions(srch_asig) & \n R_msg(m) ~: actions(srch_asig) & \n S_pkt(pkt) : actions(srch_asig) & \n R_pkt(pkt) : actions(srch_asig) & \n S_ack(b) ~: actions(srch_asig) & \n R_ack(b) ~: actions(srch_asig) & \n C_m_s ~: actions(srch_asig) & \n C_m_r ~: actions(srch_asig) & \n C_r_s ~: actions(srch_asig) & C_r_r(m) ~: actions(srch_asig)\"\n by (simp add: unfold_renaming)\n\nlemma in_rsch_asig: \n \"S_msg(m) ~: actions(rsch_asig) & \n R_msg(m) ~: actions(rsch_asig) & \n S_pkt(pkt) ~: actions(rsch_asig) & \n R_pkt(pkt) ~: actions(rsch_asig) & \n S_ack(b) : actions(rsch_asig) & \n R_ack(b) : actions(rsch_asig) & \n C_m_s ~: actions(rsch_asig) & \n C_m_r ~: actions(rsch_asig) & \n C_r_s ~: actions(rsch_asig) & \n C_r_r(m) ~: actions(rsch_asig)\"\n by (simp add: unfold_renaming)\n\nlemma srch_ioa_thm: \"srch_ioa = \n (srch_asig, {{|}}, srch_trans,srch_wfair,srch_sfair)\"\napply (simp (no_asm) add: srch_asig_def srch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def srch_wfair_def srch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nlemma rsch_ioa_thm: \"rsch_ioa = \n (rsch_asig, {{|}}, rsch_trans,rsch_wfair,rsch_sfair)\"\napply (simp (no_asm) add: rsch_asig_def rsch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def rsch_wfair_def rsch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/NTP/Abschannel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.27140251779524155}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory ArrayAssertion\n\nimports\n \"$L4V_ARCH/ArchArraysMemInstance\"\n \"StructSupport\"\n\nbegin\n\nlemma array_tag_n_eq:\n \"(array_tag_n n :: ('a :: c_type['b :: finite]) field_desc typ_desc) =\n TypDesc (TypAggregate\n (map (\\n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..<(card (UNIV :: 'b :: finite set))]))\n (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @ nat_to_bin_string (card (UNIV :: 'b :: finite set)))\"\n by (simp add: typ_info_array array_tag_def array_tag_n_eq)\n\ndefinition\n \"uinfo_array_tag_n_m (v :: 'a itself) n m = TypDesc\n (TypAggregate (map (\\i. DTPair (typ_uinfo_t TYPE('a)) (replicate i CHR ''1'')) [0 ..< n]))\n (typ_name (typ_uinfo_t TYPE('a :: c_type)) @ ''_array_'' @ nat_to_bin_string m)\"\n\nlemma map_td_list_map:\n \"map_td_list f = map (map_td_pair f)\"\n by (rule ext, rename_tac x) (induct_tac x, simp_all)\n\nlemma uinfo_array_tag_n_m_eq:\n \"n \\ CARD('b)\n \\ export_uinfo (array_tag_n n :: (('a :: wf_type)['b :: finite]) field_desc typ_desc)\n = uinfo_array_tag_n_m TYPE ('a) n (CARD('b))\"\n apply (clarsimp simp: uinfo_array_tag_n_m_def array_tag_n_eq map_td_list_map\n o_def adjust_ti_def map_td_map typ_uinfo_t_def export_uinfo_def)\n apply (fastforce intro: map_td_extI simp: field_norm_blah)\n done\n\nlemma typ_uinfo_array_tag_n_m_eq:\n \"typ_uinfo_t TYPE (('a :: wf_type)['b :: finite])\n = uinfo_array_tag_n_m TYPE ('a) (CARD('b)) (CARD('b))\"\n by (simp add: typ_uinfo_t_def typ_info_array array_tag_def uinfo_array_tag_n_m_eq)\n\ntext \\Alternative to h_t_valid for arrays. This allows reasoning\nabout arrays of variable width.\\\ndefinition h_t_array_valid :: \"heap_typ_desc \\ ('a :: c_type) ptr \\ nat \\ bool\" where\n \"h_t_array_valid htd ptr n = valid_footprint htd (ptr_val ptr) (uinfo_array_tag_n_m TYPE ('a) n n)\"\n\ntext \\Assertion that pointer p is within an array that continues for at least n more elements.\\\ndefinition\n \"array_assertion (p :: ('a :: c_type) ptr) n htd\n = (\\q i j. h_t_array_valid htd q j\n \\ p = CTypesDefs.ptr_add q (int i) \\ i < j \\ i + n \\ j)\"\n\nlemma array_assertion_shrink_right:\n \"array_assertion p n htd \\ n' \\ n \\ array_assertion p n' htd\"\n by (fastforce simp: array_assertion_def)\n\nlemma array_assertion_shrink_leftD:\n \"array_assertion p n htd \\ j < n \\ array_assertion (CTypesDefs.ptr_add p (int j)) (n - j) htd\"\n apply (clarsimp simp: array_assertion_def)\n apply (rule exI, rule_tac x=\"i + j\" in exI, rule exI, erule conjI)\n apply (simp add: CTypesDefs.ptr_add_def field_simps)\n done\n\nlemma array_assertion_shrink_leftI:\n \"array_assertion (CTypesDefs.ptr_add p (- (int j))) (n + j) htd\n \\ n \\ 0 \\ array_assertion p n htd\"\n apply (drule_tac j=j in array_assertion_shrink_leftD, simp)\n apply (simp add: CTypesDefs.ptr_add_def)\n done\n\nlemma h_t_array_valid:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ h_t_array_valid htd (ptr_coerce p :: 'a ptr) (CARD('b))\"\n by (clarsimp simp: h_t_valid_def h_t_array_valid_def typ_uinfo_array_tag_n_m_eq)\n\nlemma array_ptr_valid_array_assertionD:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n \\ array_assertion (ptr_coerce p :: 'a ptr) (CARD('b)) htd\"\n apply (clarsimp simp: array_assertion_def dest!: h_t_array_valid)\n apply (fastforce intro: exI[where x=0])\n done\n\nlemma array_ptr_valid_array_assertionI:\n \"h_t_valid htd gd (q :: (('a :: wf_type)['b :: finite]) ptr)\n \\ q = ptr_coerce p\n \\ n \\ CARD('b)\n \\ array_assertion (p :: 'a ptr) n htd\"\n by (auto dest: array_ptr_valid_array_assertionD\n simp: array_assertion_shrink_right)\n\ntext \\Derived from array_assertion, an appropriate assertion for performing\na pointer addition, or for dereferencing a pointer addition (the strong case).\n\nIn either case, there must be an array connecting the two ends of the pointer\ntransition, with the caveat that the last address can be just out of the array\nif the pointer is not dereferenced, thus the strong/weak distinction.\n\nIf the pointer doesn't actually move, nothing is learned.\n\\\ndefinition ptr_add_assertion :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\" where\n \"ptr_add_assertion ptr offs strong htd \\\n offs = 0 \\\n array_assertion (if offs < 0 then CTypesDefs.ptr_add ptr offs else ptr)\n (if offs < 0 then nat (- offs) else if strong then Suc (nat offs) else nat offs)\n htd\"\n\nlemma ptr_add_assertion_positive:\n \"offs \\ 0 \\ ptr_add_assertion ptr offs strong htd\n = (offs = 0 \\ array_assertion ptr (case strong of True \\ Suc (nat offs)\n | False \\ nat offs) htd)\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_negative:\n \"offs < 0 \\ ptr_add_assertion ptr offs strong htd\n = array_assertion (CTypesDefs.ptr_add ptr offs) (nat (- offs)) htd\"\n by (simp add: ptr_add_assertion_def)\n\nlemma ptr_add_assertion_uint[simp]:\n \"ptr_add_assertion ptr (uint offs) strong htd\n = (offs = 0 \\ array_assertion ptr\n (case strong of True \\ Suc (unat offs) | False \\ unat offs) htd)\"\n by (simp add: ptr_add_assertion_positive uint_0_iff unat_def\n split: bool.split)\n\ntext \\Ignore char and void pointers. The C standard specifies that arithmetic on\nchar and void pointers doesn't create any special checks.\\\n\ndefinition ptr_add_assertion' :: \"('a :: c_type) ptr \\ int \\ bool \\ heap_typ_desc \\ bool\" where\n \"ptr_add_assertion' ptr offs strong htd =\n (typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE(word8)\n \\ typ_uinfo_t TYPE ('a) = typ_uinfo_t TYPE(unit)\n \\ ptr_add_assertion ptr offs strong htd)\"\n\n(* Useful for clearing away these assumptions. *)\nlemma td_diff_from_typ_name:\n \"typ_name td \\ typ_name td' \\ td \\ td'\"\n by clarsimp\n\nlemma typ_name_void:\n \"typ_name (typ_uinfo_t TYPE(unit)) = ''unit''\"\n by (simp add: typ_uinfo_t_def)\n\nlemmas ptr_add_assertion' = ptr_add_assertion'_def td_diff_from_typ_name typ_name_void\n\ntext \\Mechanism for retyping a range of memory to a non-constant array size.\\\n\ndefinition ptr_arr_retyps :: \"nat \\ ('a :: c_type) ptr \\ heap_typ_desc \\ heap_typ_desc\" where\n \"ptr_arr_retyps n p \\\n htd_update_list (ptr_val p)\n (map (\\i. list_map (typ_slice_t (uinfo_array_tag_n_m TYPE('a) n n) i))\n [0.. ptr_arr_retyps n (p :: ('c :: wf_type) ptr) = ptr_retyp (ptr_coerce p :: ('c['b]) ptr)\"\n by (auto simp: ptr_arr_retyps_def ptr_retyp_def typ_slices_def typ_uinfo_array_tag_n_m_eq)\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/ArrayAssertion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.271402511388106}} {"text": "theory combine2\n imports combine1\nbegin\n\ndefinition proper' :: \"estate \\ bool \" where\n\"proper' schs = ((properp (run_now schs) (run_prior schs)) \\ (pool schs) = [])\"\n\ndefinition propc' :: \"nat \\ estate \\ estate \\ bool\" where\n\"propc' k schs task_es = (k>0 \\(status task_es = RUNNING \\ run_now schs = 2))\"\n\n\n\nfun combine2 :: \"nat \\ nat \\ nat \\ estate ext_state \\ estate ext_state \\ estate ext_state \\ estate tassn\" where\n \"combine2 0 k1 k2 (Sch p rn rp,ss) (Task st1 ent1 tp1,ts1) (Task st2 ent2 tp2,ts2) = emp\\<^sub>t\"\n| \"combine2 (Suc k) 0 0 (Sch p rn rp, ss) (Task st1 ent1 tp1, ts1) (Task st2 ent2 tp2, ts2) = false\\<^sub>A\"\n| \"combine2 (Suc k) 0 (Suc k2) (Sch p rn rp, ss) (Task st1 ent1 tp1, ts1) (Task WAIT ent2 tp2, ts2) = \n (\\ (9 / 200 - ts2 T = 0) \\\\<^sub>t combine2 (Suc k) 0 k2 (Sch p rn rp, ss) (Task st1 ent1 tp1, ts1) (Task READY ezero tp2, ts2(T:=0)))\"\n| \"combine2 (Suc k) 0 (Suc k2) (Sch p rn rp, ss) (Task st1 ent1 tp1, ts1) (Task READY ent2 tp2, ts2) = (\n (\\ (rn = -1) \\\\<^sub>t (combine2 k 0 k2 (Sch p 2 1, ss(Pr := 1)) (Task st1 ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2(T := ts2 T, F := 0))))\n \\\\<^sub>t (\\ (k > 0 \\ 9 / 200 - ts2 T = 0) \\\\<^sub>t (combine2 (k-1) 0 k2 (Sch p rn rp, ss(Pr := 1, G := 0)) (Task st1 ent1 tp1, ts1) (Task WAIT ent2 tp2, ts2(T := 9 / 200)))))\"\n| \"combine2 (Suc k) 0 (Suc k2) (Sch p rn rp, ss) (Task st1 ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2) = \n combine2 k 0 k2 (Sch [] (- 1) (- 1), ss(G := 0)) (Task st1 ent1 tp1, ts1) (Task WAIT eone tp2, ts2(C := C_upd ent2 (ts2 C)))\"\n| \"combine2 (Suc k) (Suc k1) 0 (Sch p rn rp, ss) (Task WAIT ent1 tp1, ts1) (Task st2 ent2 tp2, ts2) = \n (\\ (9 / 200 - ts1 T = 0) \\\\<^sub>t combine2 (Suc k) k1 0 (Sch p rn rp, ss) (Task READY ezero tp1, ts1(T:=0)) (Task st2 ent2 tp2, ts2))\"\n| \"combine2 (Suc k) (Suc k1) 0 (Sch p rn rp, ss) (Task READY ent1 tp1, ts1) (Task st2 ent2 tp2, ts2) = \n (\\ (rn = -1) \\\\<^sub>t combine2 k k1 0 (Sch p 1 2, ss(Pr := 2)) (Task RUNNING ent1 tp1, ts1(F := 0)) (Task st2 ent2 tp2, ts2))\"\n| \"combine2 (Suc k) (Suc k1) 0 (Sch p rn rp, ss) (Task RUNNING ent1 tp1, ts1) (Task st2 ent2 tp2, ts2) = \n combine2 k k1 0 (Sch [] (- 1) (- 1), ss(G := 0)) (Task WAIT eone tp1, ts1(C := C_upd ent1 (ts1 C))) (Task st2 ent2 tp2, ts2)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task WAIT ent1 tp1, ts1) (Task WAIT ent2 tp2, ts2) = (\n (\\ (ts1 T = ts2 T) \\\\<^sub>t Wait\\<^sub>t (9 / 200 - ts1 T)\n (\\t. ParState (ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 tp1, ts1(T := ts1 T + t))))\n (EState (Task WAIT ent2 tp2, ts2(T := ts2 T + t))))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n (combine2 (Suc k) k1 k2 (Sch p rn rp, ss) (Task READY ezero tp1, ts1(T := 0)) (Task READY ezero tp2, ts2(T := 0))))\n\\\\<^sub>t (\\ (ts2 T < ts1 T) \\\\<^sub>t Wait\\<^sub>t (9 / 200 - ts1 T)\n (\\t. ParState (ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + t))))\n (EState (Task WAIT ent2 1, ts2(T := ts2 T + t))))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n (combine2 (Suc k) k1 (Suc k2) (Sch p rn rp, ss) (Task READY ezero 2, ts1(T := 0)) (Task WAIT ent2 tp2, ts2(T:=ts2 T + (0.045 - ts1 T)))))\n\\\\<^sub>t (\\ (ts1 T < ts2 T) \\\\<^sub>t Wait\\<^sub>t (9 / 200 - ts2 T)\n (\\t. ParState (ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + t))))\n (EState (Task WAIT ent2 1, ts2(T := ts2 T + t))))\n ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n (combine2 (Suc k) (Suc k1) k2 (Sch p rn rp, ss) (Task WAIT ent1 tp1, ts1(T:=ts1 T + (0.045 - ts2 T))) (Task READY ezero tp2, ts2(T := 0))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task WAIT ent1 tp1, ts1) (Task READY ent2 tp2, ts2) = (\n (\\ (9 / 200 - ts1 T = 0) \\\\<^sub>t (combine2 (Suc k) k1 (Suc k2) (Sch p rn rp, ss) (Task READY ezero tp1, ts1(T := 0)) (Task READY ent2 tp2, ts2)))\n\\\\<^sub>t(\\ (9 / 200 - ts1 T > 0) \\\\<^sub>t (combine2 k (Suc k1) k2 (Sch p 2 1, ss(Pr := 1)) (Task WAIT ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2(F := 0))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task WAIT ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2) = (\n (\\ (min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) \\ (9 / 200 - ts1 T))\n \\\\<^sub>t Wait\\<^sub>t (9 / 200 - ts1 T)\n (\\t. ParState (ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 tp1, ts1(T := ts1 T + t))))\n (EState (Task RUNNING eone tp2, ts2(T := ts2 T + t, C := C_upd ent2 (ts2 C) + t))))\n ({},{preempt_ch 2, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1,exit_ch 2}) @\\<^sub>t \n combine2 (Suc k) k1 (Suc k2) (Sch p rn rp, ss) (Task READY ezero tp1, ts1(T := 0)) (Task RUNNING eone tp2, ts2(T:= ts2 T + (9 / 200 - ts1 T), C:= C_upd ent2 (ts2 C) + (9 / 200 - ts1 T))))\n\\\\<^sub>t(\\ (min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) < (9 / 200 - ts1 T))\n \\\\<^sub>t Wait\\<^sub>t (min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)))\n (\\t. ParState(ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 tp1, ts1(T := ts1 T + t))))\n (EState(Task RUNNING eone tp2, ts2(T := ts2 T + t, C := C_upd ent2 (ts2 C) + t))))\n ({},{preempt_ch 2, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t \n (combine2 k (Suc k1) k2 (Sch [] (- 1) (- 1), ss(G := 0)) \n (Task WAIT ent1 tp1, ts1(T := ts1 T + min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C))))\n (Task WAIT eone tp2, ts2(T := ts2 T + min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)),\n C := C_upd ent2 (ts2 C) + min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C))))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task READY ent1 tp1, ts1) (Task WAIT ent2 tp2, ts2) = (\n (\\ (9 / 200 - ts2 T = 0) \\\\<^sub>t (combine2 (Suc k) (Suc k1) k2 (Sch p rn rp, ss) (Task READY ent1 tp1, ts1) (Task READY ezero tp2, ts2(T := 0))))\n\\\\<^sub>t(\\ (9 / 200 - ts2 T > 0) \\\\<^sub>t (combine2 k k1 (Suc k2) (Sch p 1 2, ss(Pr := 2)) (Task RUNNING ent1 tp1, ts1(F := 0)) (Task WAIT ent2 tp2, ts2)))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task READY ent1 tp1, ts1) (Task READY ent2 tp2, ts2) = (\n combine2 k k1 (Suc k2) (Sch p 1 2, ss(Pr := 2)) (Task RUNNING ent1 tp1, ts1(F := 0)) (Task READY ent2 tp2, ts2)\n\\\\<^sub>t combine2 k (Suc k1) k2 (Sch p 2 1, ss(Pr := 1)) (Task READY ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2(F := 0))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task READY ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2) = (\n (combine2 k k1 k2 (Sch p 1 2, ss(Pr := 2)) (Task RUNNING ent1 tp1, ts1(F := 0)) (Task READY eone tp2, ts2(C := C_upd ent2 (ts2 C), F := 0)))\n\\\\<^sub>t(\\ (min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)) = 0) \\\\<^sub>t\n combine2 k k1 k2 (Sch p 1 2, ss(Pr := 2)) (Task RUNNING ent1 tp1, ts1(F := 0))(Task WAIT eone tp2, ts2(C := C_upd ent2 (ts2 C), F := 0)))\n\\\\<^sub>t(\\ (min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)) = 0) \\\\<^sub>t \n combine2 k (Suc k1) k2 (Sch [] (- 1) (- 1), ss(G := 0)) (Task READY ent1 tp1, ts1) (Task WAIT eone tp2, ts2(C := C_upd ent2 (ts2 C))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task RUNNING ent1 tp1, ts1) (Task WAIT ent2 tp2, ts2) = (\n (\\ (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) \\ (9 / 200 - ts2 T)) \n \\\\<^sub>t Wait\\<^sub>t (9 / 200 - ts2 T)\n (\\t. ParState(ParState (EState (Sch p rn rp, ss))\n (EState(Task RUNNING eone tp1, ts1(T := ts1 T + t, C := C_upd ent1 (ts1 C) + t))))\n (EState (Task WAIT ent2 tp2, ts2(T := ts2 T + t))))\n ({},{preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n combine2 (Suc k) (Suc k1) k2 (Sch p rn rp, ss) (Task RUNNING eone tp1, ts1(T:= ts1 T + (9 / 200 - ts2 T), C:= C_upd ent1 (ts1 C) + (9 / 200 - ts2 T))) (Task READY ezero tp2, ts2(T := 0)))\n\\\\<^sub>t(\\ ((9 / 200 - ts2 T) > min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C))) \n \\\\<^sub>t Wait\\<^sub>t (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)))\n (\\t. ParState(ParState (EState (Sch p rn rp, ss))\n (EState(Task RUNNING eone tp1, ts1(T := ts1 T + t, C := C_upd ent1 (ts1 C) + t))))\n (EState (Task WAIT ent2 tp2, ts2(T := ts2 T + t))))\n ({},{preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n(combine2 k k1 (Suc k2) (Sch [] (- 1) (- 1), ss(G := 0))\n (Task WAIT eone tp1, ts1(T := ts1 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)),\n C := C_upd ent1 (ts1 C) + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C))))\n (Task WAIT ent2 tp2, ts2(T:= ts2 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C))))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task RUNNING ent1 tp1, ts1) (Task READY ent2 tp2, ts2) = (\n (\\ (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) = 0) \\\\<^sub>t\n (combine2 k k1 (Suc k2) (Sch [] (- 1) (- 1), ss(G := 0)) (Task WAIT eone tp1, ts1(C := C_upd ent1 (ts1 C))) (Task READY ent2 tp2, ts2)))\n\\\\<^sub>t (\\ (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) \\ 9 / 200 - ts2 T \\ k > 0) \\\\<^sub>t\n Wait\\<^sub>t (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)))\n (\\t. ParState(ParState (EState (Sch [(1, 2)] 1 2, ss(Pr := 1)))\n (EState (Task RUNNING eone tp1, ts1(T := ts1 T + t, C := C_upd ent1 (ts1 C) + t))))\n (EState (Task READY ent2 tp2, ts2(T := ts2 T + t))))\n ({}, {run_ch 2, preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t \n (combine2 (k-1) k1 k2 (Sch [] 2 1, ss(Pr := 1, G := 0))\n (Task WAIT eone tp1, ts1\n (T := ts1 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)),\n C := C_upd ent1 (ts1 C) + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C))))\n (Task RUNNING ent2 tp2, ts2(T := ts2 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)), F := 0))))\n\\\\<^sub>t (\\ (min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) \\ 9 / 200 - ts2 T \\ k > 0) \\\\<^sub>t\n Wait\\<^sub>t (9 / 200 - ts2 T)\n (\\t. ParState\n (ParState (EState (Sch [(1, 2)] 1 2, ss(Pr := 1)))\n (EState (Task RUNNING eone tp1, ts1(T := ts1 T + t, C := C_upd ent1 (ts1 C) + t))))\n (EState (Task READY ent2 tp2, ts2(T := ts2 T + t))))\n ({}, {run_ch 2, preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n (combine2 (k-1) (Suc k1) k2 (Sch [] 1 2, ss(Pr := 1, G := 0))\n (Task RUNNING eone tp1, ts1(T := ts1 T + (9 / 200 - ts2 T), C := C_upd ent1 (ts1 C) + (9 / 200 - ts2 T)))\n (Task WAIT ent2 tp2, ts2(T := 9 / 200))))\n)\"\n| \"combine2 (Suc k) (Suc k1) (Suc k2) (Sch p rn rp, ss) (Task RUNNING ent1 tp1, ts1) (Task RUNNING ent2 tp2, ts2) = false\\<^sub>A\"\n\n\nlemma combine_assn_in0_emp:\n \"ch \\ chs \\ combine_assn chs (in_0assn ch v @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: in_0assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_in0_wait:\n \"ch \\ chs \\ combine_assn chs (in_0assn ch v @\\<^sub>t P) (wait_assn d p rdy @\\<^sub>t Q) \\\\<^sub>t\n \\(d\\0) \\\\<^sub>t combine_assn chs (in_0assn ch v @\\<^sub>t P) Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:in_0assn.cases[of ch v])\n apply auto\n apply(cases rule:wait_assn.cases[of d p rdy])\n apply auto\n subgoal by (auto elim: sync_elims)\n apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n by auto\n done\n\nlemma combine_assn_in0_out:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (in_0assn ch1 v1 @\\<^sub>t P) (out_assn s ch2 v2 @\\<^sub>t Q) \\\\<^sub>t\n\\(ch1=ch2 \\ v1 =v2) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: in_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: out_assn.cases[of s ch2 v2 tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n by (auto elim: sync_elims)\n done\n\nlemma combine_assn_in0_outrdy:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (in_0assn ch1 v1 @\\<^sub>t P) (outrdy_assn s ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t\n\\(ch1=ch2 \\ v1 =v2) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: in_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: outrdy_assn.cases[of s ch2 v2 rdy tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n by (auto elim: sync_elims)\n done\n\nlemma combine_assn_in0_inrdy:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (in_0assn ch1 v1 @\\<^sub>t P) (inrdy_assn s ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t R\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: in_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: inrdy_assn.cases[of s ch2 v2 rdy tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n by (auto elim: sync_elims)\n done\n\n\nlemma combine_assn_in0_waitin:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (in_0assn ch1 v1 @\\<^sub>t P) (waitin_assn d p ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t R\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: in_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: waitin_assn.cases[of d p ch2 v2 rdy tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n done\n done\n\nlemma combine_assn_out0_emp:\n \"ch \\ chs \\ combine_assn chs (out_0assn ch v @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n unfolding combine_assn_def\n apply (rule ext)\n apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: out_0assn.cases)\n by (auto elim: sync_elims)\n\nlemma combine_assn_out0_inrdy:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (out_0assn ch1 v1 @\\<^sub>t P) (inrdy_assn s ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t\n\\(ch1=ch2 \\ v1 =v2) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: out_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: inrdy_assn.cases[of s ch2 v2 rdy tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n by (auto elim: sync_elims)\n done\n\n\nlemma combine_assn_out0_outrdy:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (out_0assn ch1 v1 @\\<^sub>t P) (outrdy_assn s ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t R\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: out_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: outrdy_assn.cases[of s ch2 v2 rdy tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n by (auto elim: sync_elims)\n done\n\nlemma combine_assn_out0_waitin:\n\"ch1\\chs \\ ch2\\chs \\\ncombine_assn chs (out_0assn ch1 v1 @\\<^sub>t P) (waitin_assn d p ch2 v2 rdy @\\<^sub>t Q) \\\\<^sub>t \n \\(ch1=ch2 \\ v1 =v2 \\ d\\0) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: out_0assn.cases[of ch1 v1 tr1a])\n apply auto\n apply(cases rule: waitin_assn.cases[of d p ch2 v2 rdy tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n done\n done\n\n\nlemma combine_assn_wait_wait2:\n\"compat_rdy rdy1 rdy2 \\ d1 = d2 \\ d1\\0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\nwait_assn d1 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P Q\"\nunfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:wait_assn.cases[of d2 p1 rdy1 tr1a])\n apply auto\n subgoal\n apply(cases rule:wait_assn.cases[of d2 p2 rdy2 tr1b])\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(rule exI[where x=\"[WaitBlk d2 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n apply auto\n apply(rule) by auto\n by(auto simp add:emp_assn_def)\n done\n\n\nlemma combine_assn_wait_wait3:\n\"compat_rdy rdy1 rdy2 \\ d1 < d2 \\ d1\\0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\nwait_assn d1 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P (wait_assn (d2-d1) (\\ t. p2(t+d1)) rdy2 @\\<^sub>t Q)\"\nunfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:wait_assn.cases[of d1 p1 rdy1 tr1a])\n apply auto\n subgoal\n apply(cases rule:wait_assn.cases[of d2 p2 rdy2 tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_waitE3)\n apply auto\n apply(rule exI[where x=\"[WaitBlk d1 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n apply auto\n apply(rule) \n apply auto\n apply(rule exI[where x= tr2a])\n apply auto\n apply(rule exI[where x=\"(WaitBlk (d2 - d1) (\\t. p2 (t + d1)) rdy2 # tr2b)\"])\n apply auto\n apply(rule exI[where x=\"[WaitBlk (d2 - d1) (\\t. p2 (t + d1)) rdy2]\"])\n apply auto\n apply(rule) by auto\n done\n by(auto simp add:emp_assn_def)\n done\n\nlemma combine_assn_wait_wait3':\n\"compat_rdy rdy1 rdy2 \\ d1 \\ d2 \\ d1\\0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\nwait_assn d1 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P (wait_assn (d2-d1) (\\ t. p2(t+d1)) rdy2 @\\<^sub>t Q)\"\n apply(cases \"d1=d2\")\n subgoal \n apply auto\n apply(rule combine_assn_wait_wait2)\n by auto\n apply(rule combine_assn_wait_wait3)\n by auto\n\n\nlemma combine_assn_wait_wait4:\n\"compat_rdy rdy1 rdy2 \\ d1 > d2 \\ d2\\0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\nwait_assn d2 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs (wait_assn (d1-d2) (\\ t. p1(t+d2)) rdy1 @\\<^sub>t P) Q\"\nunfolding combine_assn_def entails_tassn_def join_assn_def\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:wait_assn.cases[of d2 p2 rdy2 tr1b])\n apply auto\n subgoal\n apply(cases rule:wait_assn.cases[of d1 p1 rdy1 tr1a])\n apply auto\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n apply(rule exI[where x=\"[WaitBlk d2 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n apply auto\n apply(rule) \n apply auto\n apply(rule exI[where x=\"(WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # tr2a)\"])\n apply auto\n apply(rule exI[where x=\"[WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1]\"])\n apply auto\n apply(rule) by auto\n done\n by(auto simp add:emp_assn_def)\n done\n\nlemma combine_assn_wait_wait4':\n\"compat_rdy rdy1 rdy2 \\ d1 \\ d2 \\ d2\\0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\nwait_assn d2 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs (wait_assn (d1-d2) (\\ t. p1(t+d2)) rdy1 @\\<^sub>t P) Q\"\n apply(cases \"d1=d2\")\n subgoal\n apply auto\n apply(rule combine_assn_wait_wait2)\n by auto\n apply(rule combine_assn_wait_wait4)\n by auto\n\nlemma combine_assn_wait_wait5:\n\"compat_rdy rdy1 rdy2 \\ d1 \\ 0 \\ d2\\ 0 \\\ncombine_assn chs (wait_assn d1 p1 rdy1 @\\<^sub>t P) (wait_assn d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t\n (\\(d1=d2) \\\\<^sub>t wait_assn d1 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P Q)\n\\\\<^sub>t (\\(d1\\<^sub>t wait_assn d1 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P (wait_assn (d2-d1) (\\ t. p2(t+d1)) rdy2 @\\<^sub>t Q))\n\\\\<^sub>t (\\(d1>d2) \\\\<^sub>t wait_assn d2 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs (wait_assn (d1-d2) (\\ t. p1(t+d2)) rdy1 @\\<^sub>t P) Q)\"\n apply(cases \"d1>d2\")\n subgoal apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule combine_assn_wait_wait4)\n by auto\n apply(cases \"d1 chs \\ compat_rdy rdy1 rdy2 \\ d1\\0 \\ d2\\0\"\n shows \"combine_assn chs (waitin_assn d1 p1 ch v rdy1 @\\<^sub>t P)(Wait\\<^sub>t d2 p2 rdy2 @\\<^sub>t Q) \\\\<^sub>t \n \\(d2\\d1) \\\\<^sub>t Wait\\<^sub>t d2 (\\ t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) \n @\\<^sub>t (combine_assn chs (waitin_assn (d1-d2) (\\ t. p1(t+d2)) ch v rdy1 @\\<^sub>t P) Q)\"\n unfolding combine_assn_def\n using assms\n apply (auto simp add: entails_tassn_def join_assn_def)\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: waitin_assn.cases[of d1 p1 ch v rdy1 tr1a])\n apply auto\n subgoal\n apply(cases rule: wait_assn.cases[of d2 p2 rdy2 tr1b])\n apply auto\n subgoal using assms\n apply(cases \"d2t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n apply auto\n subgoal apply rule by auto\n apply(rule exI[where x=\"(WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # InBlock ch v # tr2a)\"])\n apply auto\n apply(rule exI[where x=\"WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # [InBlock ch v]\"])\n apply auto\n apply(rule )\n by auto\n apply(cases \"d2>d1\")\n subgoal\n apply (auto elim!: combine_blocks_waitE3)\n by (auto elim:combine_blocks_pairE2)\n apply(cases \"d2=d1\")\n subgoal\n apply (auto elim!: combine_blocks_waitE2)\n apply(rule exI[where x=\"[WaitBlk d1 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n apply auto\n subgoal apply(rule) by auto\n apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n apply auto\n apply(rule exI[where x=\"[InBlock ch v]\"])\n apply auto\n apply(rule)\n by auto\n by auto\n subgoal\n apply(auto simp add:emp_assn_def)\n apply(rule exI[where x=\"(WaitBlk d1 p1 rdy1 # InBlock ch v # tr2a)\"])\n by auto\n done\n subgoal\n apply(cases rule: wait_assn.cases[of d2 p2 rdy2 tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n subgoal\n apply(auto simp add:emp_assn_def)\n apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n by auto\n done\n done\n done\n\nlemma combine_assn_wait_waitin:\n assumes \"ch \\ chs \\ compat_rdy rdy2 rdy1 \\ d1\\0 \\ d2\\0\"\n shows \"combine_assn chs (Wait\\<^sub>t d2 p2 rdy2 @\\<^sub>t Q) (waitin_assn d1 p1 ch v rdy1 @\\<^sub>t P) \\\\<^sub>t \n \\(d2\\d1) \\\\<^sub>t Wait\\<^sub>t d2 (\\ t. ParState (p2 t) (p1 t)) (merge_rdy rdy2 rdy1) \n @\\<^sub>t (combine_assn chs Q (waitin_assn (d1-d2) (\\ t. p1(t+d2)) ch v rdy1 @\\<^sub>t P))\"\n unfolding combine_assn_def\n using assms\n apply (auto simp add: entails_tassn_def join_assn_def)\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: waitin_assn.cases[of d1 p1 ch v rdy1 tr1b])\n apply auto\n subgoal\n apply(cases rule: wait_assn.cases[of d2 p2 rdy2 tr1a])\n apply auto\n subgoal using assms\n apply(cases \"d2t. ParState (p2 t) (p1 t)) (merge_rdy rdy2 rdy1)]\"])\n apply auto\n subgoal apply rule by auto\n apply(rule exI[where x=tr2a])\n apply auto\n apply(rule exI[where x=\"(WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # InBlock ch v # tr2b)\"])\n apply auto\n apply(rule exI[where x=\"WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # [InBlock ch v]\"])\n apply auto\n apply(rule )\n by auto\n apply(cases \"d2>d1\")\n subgoal\n apply (auto elim!: combine_blocks_waitE4)\n by (auto elim:combine_blocks_pairE2')\n apply(cases \"d2=d1\")\n subgoal\n apply (auto elim!: combine_blocks_waitE2)\n apply(rule exI[where x=\"[WaitBlk d1 (\\t. ParState (p2 t) (p1 t)) (merge_rdy rdy2 rdy1)]\"])\n apply auto\n subgoal apply(rule) by auto\n apply(rule exI[where x=tr2a])\n apply auto\n apply(rule exI[where x=\"(InBlock ch v # tr2b)\"])\n apply auto\n apply(rule exI[where x=\"[InBlock ch v]\"])\n apply auto\n apply(rule)\n by auto\n by auto\n subgoal\n apply(auto simp add:emp_assn_def)\n apply(rule exI[where x=\"tr2a\"])\n apply auto\n apply(rule exI[where x=\"(WaitBlk d1 p1 rdy1 # InBlock ch v # tr2b)\"])\n by auto\n done\n subgoal\n apply(cases rule: wait_assn.cases[of d2 p2 rdy2 tr1a])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n subgoal\n apply(auto simp add:emp_assn_def)\n apply(rule exI[where x=\"tr2a\"])\n apply auto\n apply(rule exI[where x=\"(InBlock ch v # tr2b)\"])\n by auto\n done\n done\n done\n\n\nlemma combine_assn_wait_out:\n assumes \"ch\\chs \\ ch \\ snd rdy\"\n shows \"combine_assn chs (wait_assn d p rdy @\\<^sub>t P) (out_assn s ch v @\\<^sub>t Q)\n \\\\<^sub>t \\(d\\0) \\\\<^sub>t combine_assn chs P (out_assn s ch v @\\<^sub>t Q)\"\n unfolding combine_assn_def\n using assms\n apply (auto simp add: entails_tassn_def join_assn_def)\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: wait_assn.cases[of d p rdy tr1a])\n apply auto\n apply(cases rule:out_assn.cases[of s ch v tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n done\n\nlemma combine_assn_wait_outrdy:\n assumes \"ch\\chs \\ \\ compat_rdy rdy rdy'\"\n shows \"combine_assn chs (wait_assn d p rdy @\\<^sub>t P) (outrdy_assn s ch v rdy'@\\<^sub>t Q)\n \\\\<^sub>t \\(d\\0) \\\\<^sub>t combine_assn chs P (outrdy_assn s ch v rdy' @\\<^sub>t Q)\"\n unfolding combine_assn_def\n using assms\n apply (auto simp add: entails_tassn_def join_assn_def)\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: wait_assn.cases[of d p rdy tr1a])\n apply auto\n apply(cases rule:outrdy_assn.cases[of s ch v rdy' tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n apply(elim combine_blocks_waitE1)\n by auto\n done\n\nlemma combine_assn_wait_inrdy:\n assumes \"ch\\chs \\ \\ compat_rdy rdy rdy'\"\n shows \"combine_assn chs (wait_assn d p rdy @\\<^sub>t P) (inrdy_assn s ch v rdy'@\\<^sub>t Q)\n \\\\<^sub>t \\(d\\0) \\\\<^sub>t combine_assn chs P (inrdy_assn s ch v rdy' @\\<^sub>t Q)\"\n unfolding combine_assn_def\n using assms\n apply (auto simp add: entails_tassn_def join_assn_def)\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule: wait_assn.cases[of d p rdy tr1a])\n apply auto\n apply(cases rule:inrdy_assn.cases[of s ch v rdy' tr1b])\n apply auto\n subgoal\n by (auto elim: sync_elims)\n apply(elim combine_blocks_waitE1)\n by auto\n done\n\nlemma combine_assn_waitin_out:\n assumes \"ch\\chs \\ ch \\ snd rdy\"\n shows \"combine_assn chs (waitin_assn d p ch v rdy @\\<^sub>t P) (out_assn s' ch v' @\\<^sub>t Q) \\\\<^sub>t\n \\(v=v' \\ d\\0) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:waitin_assn.cases[of d p ch v rdy tr1a])\n apply auto\n subgoal \n apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n apply auto\n subgoal\n by(auto elim:combine_blocks_pairE2')\n subgoal for d\n apply(elim combine_blocks_waitE1)\n apply(cases rdy)\n by auto\n done\n subgoal\n apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n apply auto\n subgoal\n apply (auto elim!: combine_blocks_pairE)\n by blast\n subgoal for d\n by(auto elim:combine_blocks_pairE2)\n done\n done\n done\n\n\nlemma combine_assn_waitin_out'':\n assumes \"ch1\\chs \\ ch2\\chs \\ ch1\\ch2\"\n shows \"combine_assn chs (waitin_assn d p ch1 v rdy @\\<^sub>t P) (out_assn s' ch2 v' @\\<^sub>t Q) \\\\<^sub>t\n R\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:waitin_assn.cases[of d p ch1 v rdy tr1a])\n apply auto\n subgoal \n apply(cases rule:out_assn.cases[of s' ch2 v' tr1b])\n apply auto\n subgoal\n by (auto elim!: sync_elims)\n subgoal for d2\n apply(cases \"\\ compat_rdy rdy ({ch2}, {})\")\n subgoal by (auto elim!: sync_elims)\n apply(cases \"dd2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n by (auto elim!: sync_elims)\n apply auto\n apply(elim combine_blocks_waitE2)\n by (auto elim!: combine_blocks_pairE)\n done\n subgoal\n apply(cases rule:out_assn.cases[of s' ch2 v' tr1b])\n apply auto\n subgoal\n by (auto elim!: combine_blocks_pairE)\n subgoal\n by (auto elim!: sync_elims)\n done\n done\n done\n\n\nlemma combine_assn_out0_waitin1:\n assumes \"ch2\\chs \\ ch1\\chs\"\n shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(waitin_assn d p ch1 v1 rdy @\\<^sub>t Q) \\\\<^sub>t\n \\(ch1 = ch2 \\ v1 = v2 \\ d\\0) \\\\<^sub>t combine_assn chs P Q\"\n unfolding combine_assn_def entails_tassn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n apply auto\n apply(cases rule:waitin_assn.cases[of d p ch1 v1 rdy tr1b])\n apply auto\n subgoal \n by(auto elim!: combine_blocks_pairE2)\n subgoal\n apply(auto elim!: combine_blocks_pairE)\n by blast\n done\n done\n\n\nlemma combine_assn_waitp_waitin':\n assumes \"ch1\\chs \\ \\compat_rdy rdy1 rdy2\"\n shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(waitin_assn d p ch1 v1 rdy2 @\\<^sub>t Q) \\\\<^sub>t\n R\"\n unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n apply auto\n subgoal for dd pp\n apply(cases rule:waitin_assn.cases[of d p ch1 v1 rdy2 tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_waitE1)\n by auto\n subgoal\n by (auto elim!: sync_elims)\n done\n done\n done\n\n\nlemma combine_assn_waitin_waitin:\n assumes \"ch1\\chs \\ ch2\\chs\"\n shows \"combine_assn chs (waitin_assn d1 p1 ch1 v1 rdy1 @\\<^sub>t P) (waitin_assn d2 p2 ch2 v2 rdy2 @\\<^sub>t Q) \\\\<^sub>t R\"\n unfolding entails_tassn_def combine_assn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:waitin_assn.cases[of d1 p1 ch1 v1 rdy1])\n apply auto\n subgoal \n apply(cases rule:waitin_assn.cases[of d2 p2 ch2 v2 rdy2])\n apply auto\n subgoal \n apply(cases \"\\ compat_rdy rdy1 rdy2\")\n subgoal by (auto elim!: sync_elims)\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n by (auto elim!: sync_elims)\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(elim combine_blocks_pairE)\n by auto\n subgoal\n by (auto elim!: sync_elims)\n done\n subgoal\n apply(cases rule:waitin_assn.cases[of d2 p2 ch2 v2 rdy2])\n apply auto\n subgoal\n by (auto elim!: sync_elims)\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n done\n done\n done\n\n\n\nlemma combine_assn_waitin_outrdy:\n assumes \"ch1\\chs \\ ch2\\chs \\ \\compat_rdy rdy1 rdy2\"\n shows \"combine_assn chs (waitin_assn d p ch1 v1 rdy1 @\\<^sub>t P)(outrdy_assn s2 ch2 v2 rdy2 @\\<^sub>t Q)\n \\\\<^sub>t \\(ch1 = ch2 \\ v1= v2 \\ d \\ 0) \\\\<^sub>t combine_assn chs P Q\"\n unfolding entails_tassn_def combine_assn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:waitin_assn.cases[of d p ch1 v1 rdy1 tr1a])\n apply auto\n subgoal\n apply(cases rule:outrdy_assn.cases[of s2 ch2 v2 rdy2 tr1b])\n apply auto\n by (auto elim!: sync_elims)\n subgoal\n apply(cases rule:outrdy_assn.cases[of s2 ch2 v2 rdy2 tr1b])\n apply auto\n subgoal\n apply(auto elim!: combine_blocks_pairE)\n by blast\n by (auto elim!: sync_elims)\n done\n done\n\n\nlemma combine_assn_waitin_inrdy:\n assumes \"ch1\\chs \\ ch2\\chs\"\n shows \"combine_assn chs (waitin_assn d1 p1 ch1 v1 rdy1 @\\<^sub>t P) (inrdy_assn s ch2 v2 rdy2 @\\<^sub>t Q) \\\\<^sub>t R\"\n unfolding entails_tassn_def combine_assn_def join_assn_def\n using assms\n apply auto\n subgoal for tr tr1a tr2a tr1b tr2b\n apply(cases rule:waitin_assn.cases[of d1 p1 ch1 v1 rdy1])\n apply auto\n subgoal \n apply(cases rule:inrdy_assn.cases[of s ch2 v2 rdy2])\n apply auto\n subgoal\n by (auto elim!: sync_elims)\n subgoal for d2\n apply(cases \"\\ compat_rdy rdy1 rdy2\")\n subgoal by (auto elim!: sync_elims)\n apply(cases \"d1d2\")\n subgoal\n apply(elim combine_blocks_waitE4)\n apply auto\n by (auto elim!: sync_elims)\n apply auto\n apply(elim combine_blocks_waitE2)\n apply auto\n apply(elim combine_blocks_pairE)\n by auto\n done\n subgoal\n apply(cases rule:inrdy_assn.cases[of s ch2 v2 rdy2 tr1b])\n apply auto\n subgoal\n apply(elim combine_blocks_pairE)\n by auto\n subgoal\n by (auto elim!: sync_elims)\n done\n done\n done\n\n\nlemma combine_SCH_T1_T2:\n\"propc k1 (Sch p rn rp) (Task st1 ent1 2) \\\n propc' k2 (Sch p rn rp) (Task st2 ent2 1) \\\n proper' (Sch p rn rp) \\\n inv_s ts1 \\\n inv_s' ts2 \\\n combine_assn {req_ch 2, preempt_ch 2, run_ch 2, free_ch 2, exit_ch 2} \n (combine1 k k1 (Sch p rn rp,ss) (Task st1 ent1 2,ts1)) (T2_tr k2 (Task st2 ent2 1,ts2)) \\\\<^sub>t\n combine2 k k1 k2 (Sch p rn rp,ss) (Task st1 ent1 2,ts1) (Task st2 ent2 1,ts2)\"\nproof(induction \" k+k1+k2\" arbitrary: k1 k2 k p rn rp ss ts1 st1 ent1 ts2 st2 ent2 rule: less_induct)\n case less\n then show ?case \n apply(cases k)\n subgoal\n apply(cases k1)\n subgoal\n apply(cases k2)\n subgoal\n by auto\n subgoal for k2'\n apply auto\n apply(cases st2)\n apply simp\n subgoal premises pre\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_emp_wait')\n apply(rule entails_tassn_trans[where Q =\"combine2 0 0 k2' (Sch p rn rp,ss) (Task st1 ent1 2,ts1) (Task READY ezero 1, ts2(T := 0))\"])\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply simp\n subgoal premises pre\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n by(simp add:combine_assn_emp_out)\n by(simp add:combine_assn_emp_out)\n apply simp\n subgoal premises pre\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(simp add: combine_assn_emp_waitin)\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_emp_wait')\n apply(rule combine_or_right)\n subgoal\n by(simp add: combine_assn_emp_outrdy)\n apply(rule combine_assn_ex_pre_right')\n by(simp add: combine_assn_emp_inrdy)\n done\n done\n done\n subgoal for k1'\n apply(cases k2)\n subgoal\n apply(cases st1)\n apply simp\n subgoal premises pre\n apply(rule entails_tassn_trans[where Q=\"combine2 0 k1' 0 (Sch p rn rp, ss) (Task READY ezero 2, ts1(T := 0)) (Task st2 ent2 1,ts2)\"])\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply simp\n subgoal premises pre\n by(auto simp add: combine_assn_def entails_tassn_def false_assn_def)\n apply simp\n subgoal premises pre\n by(auto simp add: combine_assn_def entails_tassn_def false_assn_def)\n done\n subgoal for k2'\n apply simp\n apply(cases st1)\n subgoal\n apply(cases st2)\n apply simp\n subgoal premises pre\n apply(cases k1')\n subgoal apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_emp_wait')\n apply(rule entails_tassn_trans[where Q=\"combine2 0 k1' k2' (Sch p rn rp, ss) (Task READY ezero 2, ts1(T := 0)) (Task READY ezero 1, ts2(T := 0))\"])\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n using pre(6) unfolding inv_s'_def by auto\n subgoal for k1''\n by (auto simp add:combine_assn_def entails_tassn_def false_assn_def)\n done\n apply simp\n subgoal premises pre\n apply(cases \"k1'\")\n subgoal apply simp\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n by(simp add: combine_assn_emp_out)\n by(simp add: combine_assn_emp_out)\n subgoal for nt1''\n apply simp\n by (auto simp add:combine_assn_def entails_tassn_def false_assn_def)\n done\n apply simp\n subgoal premises pre\n apply(cases k1')\n subgoal apply simp\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(simp add: combine_assn_emp_waitin)\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_emp_wait')\n apply(rule combine_or_right)\n subgoal\n by(simp add: combine_assn_emp_outrdy)\n apply(rule combine_assn_ex_pre_right')\n by(simp add: combine_assn_emp_inrdy)\n done\n subgoal for nt1''\n apply simp\n by (auto simp add:combine_assn_def entails_tassn_def false_assn_def)\n done\n done\n apply simp\n subgoal\n by (auto simp add:combine_assn_def entails_tassn_def false_assn_def)\n apply simp\n subgoal\n by (auto simp add:combine_assn_def entails_tassn_def false_assn_def)\n done\n done\n done\n subgoal for k'\n apply(cases k1)\n subgoal\n apply(cases k2)\n subgoal\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n by(simp add: combine_assn_in0_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(simp add: combine_assn_in0_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(simp add: combine_assn_in0_emp)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(simp add: combine_assn_in0_emp)\n done\n done\n subgoal for k2'\n apply(simp only:combine1.simps)\n apply(cases st2)\n apply(simp only:T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_conj)\n subgoal\n apply auto\n using pre(6) unfolding inv_s'_def by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI1)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_conj)\n subgoal\n apply auto\n using pre(6) unfolding inv_s'_def by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for v\n apply(rule entails_tassn_exI[where x= v])\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_conj)\n subgoal\n apply auto\n using pre(6) unfolding inv_s'_def by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for v\n apply(rule entails_tassn_exI[where x= v])\n by auto\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_conj)\n subgoal\n apply auto\n using pre(6) unfolding inv_s'_def by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto\n subgoal using pre(4) unfolding proper'_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n subgoal for v\n apply(rule entails_tassn_exI[where x= v])\n by auto\n done\n done\n apply(simp only:T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n subgoal by auto\n apply(cases \"rp\\1\")\n subgoal for v tt \n apply auto\n apply(cases k')\n subgoal apply simp\n by(simp add: combine_assn_emp_waitin)\n subgoal for ns''\n apply(simp only: combine1.simps)\n apply(rule combine_or_left)\n subgoal\n apply simp\n by(simp add: combine_assn_in0_waitin)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(simp add: combine_assn_in0_waitin)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(simp add: combine_assn_in0_waitin)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(simp add: combine_assn_in0_waitin)\n done\n done\n subgoal for v tt \n apply simp\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_waitin)\n subgoal by auto\n apply auto\n apply(subgoal_tac\"rn =-1\")\n prefer 2\n subgoal\n using pre(4) unfolding proper'_def properp_def by auto\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n subgoal by auto\n apply(cases \"1\\rp\")\n subgoal \n apply auto\n apply(cases k')\n subgoal\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_emp_wait')\n apply(rule combine_or_right)\n subgoal\n by(auto simp add:combine_assn_emp_outrdy)\n subgoal\n apply(rule combine_assn_ex_pre_right')\n by(auto simp add:combine_assn_emp_inrdy)\n done\n subgoal for k''\n apply simp\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply auto\n apply(rule combine_or_right)\n subgoal for v\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(subgoal_tac\"9 \\ ts2 T * 200 \\ p = []\")\n prefer 2\n subgoal\n using pre(6,4) unfolding inv_s'_def proper'_def\n by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n done\n apply auto\n subgoal\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_wait'')\n subgoal by auto\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_out0_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_inrdy)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(subgoal_tac\"rn =-1 \\ 9 \\ ts2 T * 200\")\n prefer 2\n subgoal\n using pre(4,6) unfolding proper'_def properp_def inv_s'_def by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply(subgoal_tac\"ts2(F := 0) = ts2(T := 9 / 200, F := 0)\")\n by(auto simp add:T_def F_def)\n done\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def) \n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def) \n done\n done\n apply(simp only:T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal for v\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n apply(subgoal_tac\"p=[]\")\n prefer 2\n subgoal using pre(4) unfolding proper'_def by auto\n apply auto\n apply(subgoal_tac\"min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)) = 0\")\n prefer 2\n subgoal using pre(6) unfolding inv_s'_def C_upd_def\n apply(cases ent2) by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n done\n done\n done\n subgoal for k1'\n apply(cases k2)\n subgoal\n apply(simp only:T2_tr.simps)\n apply(cases st1)\n apply(simp only:combine1.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_emp'')\n apply auto\n apply(subgoal_tac\"9 \\ ts1 T * 200\")\n prefer 2\n subgoal using pre(5) unfolding inv_s_def by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(auto simp add: combine_assn_waitin_emp)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(auto simp add: combine_assn_waitin_emp)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(auto simp add: combine_assn_waitin_emp)\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(auto simp add: combine_assn_waitin_emp)\n done\n done\n apply(simp only:combine1.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(cases \"rn = 2\")\n subgoal\n apply auto\n apply(rule combine_or_left)\n subgoal\n by(auto simp add: combine_assn_out0_emp)\n apply(rule combine_or_left)\n subgoal\n by(auto simp add: combine_assn_waitp_emp)\n subgoal\n by(auto simp add: combine_assn_waitp_emp)\n done\n apply auto\n apply(subgoal_tac \"rn=-1\")\n prefer 2\n subgoal using pre(2,4) unfolding proper'_def propc_def properp_def by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply(rule combine_or_left)\n subgoal\n by(auto simp add: combine_assn_in0_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(auto simp add: combine_assn_in0_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(auto simp add: combine_assn_in0_emp)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n by(auto simp add: combine_assn_in0_emp)\n done\n apply(simp only:combine1.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac\"p = [] \\ min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C)) \\0\")\n prefer 2\n subgoal using pre(4,5) unfolding proper'_def inv_s_def C_upd_def \n apply(cases ent1) by auto\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_emp'')\n apply auto\n apply(subgoal_tac \"min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) = 0\")\n prefer 2\n subgoal using pre(4,5) unfolding proper'_def inv_s_def C_upd_def \n apply(cases ent1) by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(auto simp add: combine_assn_waitin_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(auto simp add: combine_assn_waitin_emp)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(auto simp add: combine_assn_waitin_emp)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by(auto simp add: combine_assn_waitin_emp)\n done\n done\n\n\n\n subgoal for k2'\n apply(cases st1)\n subgoal\n apply(cases st2)\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait5)\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def\n by auto\n apply auto\n apply(rule entails_tassn_disjE)\n subgoal\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(6) unfolding inv_s'_def by auto\n by auto\n apply(rule entails_tassn_disjE)\n subgoal\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply auto\n apply(subgoal_tac\"(\\t. EState (Task WAIT ent2 1, ts2(T := ts2 T + (9 / 200 - ts1 T) + t))) = (\\t. EState (Task WAIT ent2 1, ts2(T := ts2 T + (t + (9 / 200 - ts1 T)))))\")\n apply auto\n apply(rule ext)\n by auto\n subgoal\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding T2_tr.simps\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(subgoal_tac\"(\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (9 / 200 - ts2 T) + t)))) =\n (\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (t + (9 / 200 - ts2 T))))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac\"0 \\ 9 / 200 - ts1 T \\ 0 \\ 9 / 200 - ts2 T\")\n prefer 2\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def by auto\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)+\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal for tt by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for tt\n apply(rule entails_tassn_exI[where x=\"(tt - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal \n apply(subgoal_tac \"(\\t. ParState (EState (Sch p rn rp, ss))\n (EState\n (Task WAIT ent1 2, ts1\n (T := ts1 T + (45 / 10 ^ 3 - ts2 T),\n T := (ts1(T := ts1 T + (45 / 10 ^ 3 - ts2 T))) T + t)))) = \n (\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (t + (9 / 200 - ts2 T))))))\")\n apply auto\n apply(rule ext)\n apply auto\n done\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac\"0 \\ 9 / 200 - ts1 T \\ 0 \\ 9 / 200 - ts2 T\")\n prefer 2\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def by auto\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)+\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal for tt by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for tt v\n apply(rule entails_tassn_exI[where x=\"(tt - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal \n apply(subgoal_tac \"(\\t. ParState (EState (Sch p rn rp, ss))\n (EState\n (Task WAIT ent1 2, ts1\n (T := ts1 T + (45 / 10 ^ 3 - ts2 T),\n T := (ts1(T := ts1 T + (45 / 10 ^ 3 - ts2 T))) T + t)))) = \n (\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (t + (9 / 200 - ts2 T))))))\")\n apply auto\n apply(rule ext)\n apply auto\n done\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac\"0 \\ 9 / 200 - ts1 T \\ 0 \\ 9 / 200 - ts2 T\")\n prefer 2\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def by auto\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)+\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal for tt by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for tt v\n apply(rule entails_tassn_exI[where x=\"(tt - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal \n apply(subgoal_tac \"(\\t. ParState (EState (Sch p rn rp, ss))\n (EState\n (Task WAIT ent1 2, ts1\n (T := ts1 T + (45 / 10 ^ 3 - ts2 T),\n T := (ts1(T := ts1 T + (45 / 10 ^ 3 - ts2 T))) T + t)))) = \n (\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (t + (9 / 200 - ts2 T))))))\")\n apply auto\n apply(rule ext)\n apply auto\n done\n by auto\n done\n subgoal\n apply(subgoal_tac\"0 \\ 9 / 200 - ts1 T \\ 0 \\ 9 / 200 - ts2 T\")\n prefer 2\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def by auto\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)+\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal for tt by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n subgoal for tt v\n apply(rule entails_tassn_exI[where x=\"(tt - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal \n apply(subgoal_tac \"(\\t. ParState (EState (Sch p rn rp, ss))\n (EState\n (Task WAIT ent1 2, ts1\n (T := ts1 T + (45 / 10 ^ 3 - ts2 T),\n T := (ts1(T := ts1 T + (45 / 10 ^ 3 - ts2 T))) T + t)))) = \n (\\t. ParState (EState (Sch p rn rp, ss))\n (EState (Task WAIT ent1 2, ts1(T := ts1 T + (t + (9 / 200 - ts2 T))))))\")\n apply auto\n apply(rule ext)\n apply auto\n done\n by auto\n done\n done\n\n\n\n\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(cases \"(9 / 200 - ts1 T) = 0\")\n subgoal\n apply simp\n apply(rule entails_tassn_disjI1)\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n by auto\n done\n apply(subgoal_tac\"9 / 200 - ts1 T >0\")\n prefer 2\n subgoal using pre(5) unfolding inv_s_def by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_out)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_out)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac\"rp = -1\")\n prefer 2\n subgoal\n using pre(2,3,4) unfolding propc_def propc'_def proper'_def properp_def by auto\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n subgoal by auto\n apply auto\n apply(rule combine_or_left)\n subgoal for v tta\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_waitin1)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n subgoal for v tta\n apply(rule combine_assn_waitp_waitin')\n by auto\n done\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n subgoal by auto\n apply auto\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_wait'')\n subgoal by auto\n apply auto\n apply(subgoal_tac\"9 = ts2 T * 200\")\n prefer 2\n subgoal using pre(6) unfolding inv_s'_def by auto\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_out0_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_inrdy)\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(subgoal_tac\"ts2(F := 0) = ts2(T := 9 / 200, F := 0)\")\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitp_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n done\n\n\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(subgoal_tac\"(9 / 200 - ts1 T)\\0 \\ min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) \\0\")\n prefer 2\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def C_upd_def C_def T_def\n apply(cases ent2) by auto\n apply(cases \"min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) \\ (9 / 200 - ts1 T)\")\n subgoal\n unfolding combine2.simps\n apply(rule entails_tassn_disjI1)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_waitin)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply(rule entails_tassn_disjI1)\n subgoal for v tt\n apply(rule entails_tassn_exI[where x=v])\n apply(rule entails_tassn_exI[where x=\"tt - (9 / 200 - ts1 T)\"])\n apply (auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_right)\n apply(subgoal_tac\"(\\t. EState\n (Task RUNNING eone 1, ts2\n (CHR ''t'' := ts2 CHR ''t'' + (9 / 200 - ts1 CHR ''t'') + t,\n CHR ''c'' := C_upd ent2 (ts2 CHR ''c'') + (9 / 200 - ts1 CHR ''t'') + t))) =\n (\\t. EState\n (Task RUNNING eone 1, ts2\n (CHR ''t'' := ts2 CHR ''t'' + (t + (9 / 200 - ts1 CHR ''t'')),\n CHR ''c'' := C_upd ent2 (ts2 CHR ''c'') + (t + (9 / 200 - ts1 CHR ''t'')))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait3')\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply(rule entails_tassn_disjI2)\n apply(auto simp add:C_def T_def)\n apply(rule entails_tassn_cancel_both)\n subgoal premises pre'\n proof-\n have 1:\"(min (ts1 CHR ''t'' - ts2 CHR ''t'')\n (ts1 CHR ''t'' - C_upd ent2 (ts2 CHR ''c'') - 1 / 40)) =\n (min (9 / 200 - ts2 CHR ''t'') (1 / 50 - C_upd ent2 (ts2 CHR ''c'')) -\n (9 / 200 - ts1 CHR ''t''))\"\n by auto\n have 2:\"(\\\\. EState\n (Task RUNNING eone 1, ts2\n (CHR ''t'' := ts2 CHR ''t'' + (9 / 200 - ts1 CHR ''t'') + \\,\n CHR ''c'' := C_upd ent2 (ts2 CHR ''c'') + (9 / 200 - ts1 CHR ''t'') + \\))) =\n (\\t. EState\n (Task RUNNING eone 1, ts2\n (CHR ''t'' := ts2 CHR ''t'' + (t + (9 / 200 - ts1 CHR ''t'')),\n CHR ''c'' := C_upd ent2 (ts2 CHR ''c'') + (t + (9 / 200 - ts1 CHR ''t'')))))\"\n apply(rule ext)\n by auto\n show ?thesis\n by(simp add:1 2)\n qed\n apply(subgoal_tac \"ts2\n (CHR ''t'' :=\n ts2 CHR ''t'' + (9 / 200 - ts1 CHR ''t'') +\n min (ts1 CHR ''t'' - ts2 CHR ''t'')\n (ts1 CHR ''t'' - C_upd ent2 (ts2 CHR ''c'') - 1 / 40),\n CHR ''c'' :=\n C_upd ent2 (ts2 CHR ''c'') + (9 / 200 - ts1 CHR ''t'') +\n min (ts1 CHR ''t'' - ts2 CHR ''t'')\n (ts1 CHR ''t'' - C_upd ent2 (ts2 CHR ''c'') - 1 / 40)) = \nts2\n (CHR ''t'' :=\n ts2 CHR ''t'' +\n min (9 / 200 - ts2 CHR ''t'') (1 / 50 - C_upd ent2 (ts2 CHR ''c'')),\n CHR ''c'' :=\n C_upd ent2 (ts2 CHR ''c'') +\n min (9 / 200 - ts2 CHR ''t'') (1 / 50 - C_upd ent2 (ts2 CHR ''c'')))\")\n apply auto\n apply(rule ext)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n by auto\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for tt\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n by auto\n done\n done\n subgoal\n apply(subgoal_tac\"min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) < 9 / 200 - ts1 T\")\n prefer 2\n subgoal by auto\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_waitin)\n by auto\n subgoal \n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait4)\n subgoal by auto\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by auto\n done\n done \n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal \n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt v\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n subgoal by auto\n apply(subgoal_tac\"p=[]\")\n prefer 2\n subgoal using pre(4) unfolding proper'_def by auto\n apply simp\n apply(rule impI)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(subgoal_tac\"min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)) = tt\")\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by auto\n done\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal for tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by auto\n done\n done\n done\n done\n done\n\n\n\n subgoal\n apply(cases st2) \n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(cases \"(9 / 200 - ts2 T) = 0\")\n subgoal\n unfolding combine2.simps\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_conj)\n subgoal by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_both_tran)\n apply auto\n done\n subgoal\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)\n apply(subgoal_tac \"0 < 9 / 200 - ts2 T \\ rn = -1 \\ rp = -1 \\ p =[]\")\n prefer 2\n subgoal using pre(2,3,4,6) unfolding propc_def propc'_def proper'_def properp_def inv_s'_def \n by auto\n apply auto\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n by auto\n done\n done\n\n\n\n\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(subgoal_tac \"rn = -1 \\ rp = -1 \\ p =[]\")\n prefer 2\n subgoal using pre(2,3,4,6) unfolding propc_def propc'_def proper'_def properp_def inv_s'_def \n by auto\n apply auto\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_disjI2)\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n subgoal by auto\n apply auto\n apply(rule combine_or_left)\n subgoal for v tt\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_waitin)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n subgoal for v tt\n apply(rule combine_assn_waitp_waitin')\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n subgoal by auto\n apply auto\n apply(rule combine_or_left)\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_out0_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_inrdy)\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(subgoal_tac\"ts2(F := 0) = ts2(T := 9 / 200, F := 0)\")\n apply auto\n using pre(6) unfolding inv_s'_def T_def F_def\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitp_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal for v\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n done\n\n\n\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(rule combine_or_left)\n subgoal\n apply(subgoal_tac \"rn = 2\")\n prefer 2 \n subgoal using pre(3) unfolding propc'_def by auto\n apply(rule combine_or_right)\n subgoal\n apply simp\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_or_left)\n subgoal for v tt\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_waitin)\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n apply(rule combine_or_left)\n subgoal for v tt\n apply(rule combine_assn_waitp_waitin')\n by auto\n subgoal for v tt\n apply(rule combine_assn_waitp_waitin')\n by auto\n done\n apply simp\n subgoal\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_out0_outrdy)\n by auto\n subgoal\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n apply(rule combine_assn_ex_pre_right')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_inrdy)\n apply auto\n apply(subgoal_tac\"min (9 / 200 - ts2 T) (1 / 50 - C_upd ent2 (ts2 C)) = 0\")\n prefer 2\n subgoal using pre(6) unfolding inv_s'_def C_upd_def C_def T_def\n apply(cases ent2) by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitp_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitp_wait'')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal for v\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n subgoal by auto\n apply(subgoal_tac\"p = [] \\ min (45 / 10 ^ 3 - ts2 T) (2 / 10\\<^sup>2 - C_upd ent2 (ts2 C)) = 0\")\n prefer 2\n subgoal using pre(4,6) unfolding proper'_def inv_s'_def C_upd_def C_def T_def\n apply(cases ent2) by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule combine_assn_in0_waitin)\n by auto\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_wait)\n subgoal by auto\n apply(simp only:pure_assn_entails)\n apply(rule impI)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_in0_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_in0_inrdy)\n by auto\n done\n done\n done\n done\n\n \n \n \n \n \n \n apply(cases st2)\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(subgoal_tac \"(min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C))) \\0 \\ (9 / 200 - ts2 T) \\ 0 \\ p=[]\")\n prefer 2\n subgoal using pre(4,5,6) unfolding inv_s_def inv_s'_def C_upd_def T_def C_def proper'_def\n apply(cases ent1) by auto\n apply(cases \"(min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C))) \\ (9 / 200 - ts2 T)\")\n subgoal\n unfolding combine2.simps\n apply(rule entails_tassn_disjI1)\n apply(rule combine_or_left)\n subgoal\n apply simp\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait4')\n subgoal by auto\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI1)\n apply(auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_both)\n subgoal premises pre'\n proof-\n have 1:\"(min (ts2 CHR ''t'' - ts1 CHR ''t'')\n (ts2 CHR ''t'' - C_upd ent1 (ts1 CHR ''c'') - 7 / 200)) = \n (min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')) -\n (9 / 200 - ts2 CHR ''t''))\"\n by auto\n have 2:\" (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') + t,\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') + t)))) =\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (t + (9 / 200 - ts2 CHR ''t'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (t + (9 / 200 - ts2 CHR ''t''))))))\"\n apply(rule ext)\n by auto\n show ?thesis\n by(simp add: 1 2)\n qed\n subgoal premises pre'\n proof-\n have \"ts1\n (CHR ''t'' :=\n ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') +\n min (ts2 CHR ''t'' - ts1 CHR ''t'')\n (ts2 CHR ''t'' - C_upd ent1 (ts1 CHR ''c'') - 7 / 200),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') +\n min (ts2 CHR ''t'' - ts1 CHR ''t'')\n (ts2 CHR ''t'' - C_upd ent1 (ts1 CHR ''c'') - 7 / 200)) = ts1\n (CHR ''t'' :=\n ts1 CHR ''t'' +\n min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') +\n min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')))\"\n apply (rule ext)\n by auto\n then show ?thesis\n by auto\n qed\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for t\n apply(rule entails_tassn_exI[where x=\"(t - (9 / 200 - ts2 T))\"])\n apply(auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_right)\n apply(subgoal_tac\"\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') + t,\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') + t)))) =\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (t + (9 / 200 - ts2 CHR ''t'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (t + (9 / 200 - ts2 CHR ''t''))))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for t v\n apply(rule entails_tassn_exI[where x= \"(t - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply (auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_right)\n apply(subgoal_tac\"\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') + t,\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') + t)))) =\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (t + (9 / 200 - ts2 CHR ''t'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (t + (9 / 200 - ts2 CHR ''t''))))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n subgoal for t v\n apply(rule entails_tassn_exI[where x= \"(t - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply (auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_right)\n apply(subgoal_tac\"\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') + t,\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') + t)))) =\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (t + (9 / 200 - ts2 CHR ''t'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (t + (9 / 200 - ts2 CHR ''t''))))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n apply auto\n apply(rule entails_tassn_cancel_left)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5) unfolding inv_s_def by (auto simp add:T_def C_def)\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_left_tran)\n unfolding combine1.simps\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n subgoal for t v\n apply(rule entails_tassn_exI[where x= \"(t - (9 / 200 - ts2 T))\"])\n apply(rule entails_tassn_exI[where x=v])\n apply (auto simp add:T_def C_def)\n apply(rule entails_tassn_cancel_right)\n apply(subgoal_tac\"\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (9 / 200 - ts2 CHR ''t'') + t,\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (9 / 200 - ts2 CHR ''t'') + t)))) =\n (\\t. ParState (EState (Sch [] rn rp, ss))\n (EState\n (Task RUNNING eone 2, ts1\n (CHR ''t'' := ts1 CHR ''t'' + (t + (9 / 200 - ts2 CHR ''t'')),\n CHR ''c'' :=\n C_upd ent1 (ts1 CHR ''c'') + (t + (9 / 200 - ts2 CHR ''t''))))))\")\n apply auto\n apply(rule ext)\n by auto\n done\n done\n subgoal\n unfolding combine2.simps\n apply(rule entails_tassn_disjI2)\n apply(subgoal_tac\"9 / 200 - ts2 T > min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C))\")\n prefer 2 subgoal by auto\n apply simp\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait3)\n subgoal by auto\n apply(rule entails_tassn_cancel_both)\n subgoal by auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply(rule entails_tassn_cancel_both)\n subgoal premises pre'\n proof-\n have 1:\"(9 / 200 - (ts2 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)))) = (9 / 200 - ts2 T - min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)))\"\n by auto\n have 2:\"(\\t. EState\n (Task WAIT ent2 1, ts2\n (T := ts2 T + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C)) + t)))\n = (\\t. EState\n (Task WAIT ent2 1, ts2\n (T := ts2 T + (t + min (9 / 200 - ts1 T) (1 / 100 - C_upd ent1 (ts1 C))))))\"\n apply (rule ext)\n by auto\n show ?thesis \n by (auto simp add:1 2)\n qed\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n by auto\n done\n done\n\n\n\n\n\n\n\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal premises pre\n apply(subgoal_tac\"p=[] \\ min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C)) \\ 0 \\ (9 / 200 - ts2 T) \\0\")\n prefer 2 \n subgoal using pre(4,5,6) unfolding proper'_def inv_s_def inv_s'_def C_upd_def by auto\n apply simp\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_out)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(subgoal_tac\"min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C)) = 0\")\n prefer 2 subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply(rule entails_tassn_disjI1)\n subgoal for v tt\n apply(rule entails_tassn_exI[where x=v]) \n apply(rule entails_tassn_exI[where x=tt])\n by auto\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_out)\n subgoal by auto\n apply auto\n apply(subgoal_tac\"min (45 / 10 ^ 3 - ts1 T) (1 / 10\\<^sup>2 - C_upd ent1 (ts1 C)) = 0\")\n prefer 2 subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(rule combine_assn_right_tran)\n unfolding T2_tr.simps\n apply(rule entails_tassn_disjI2)\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_or_right)\n subgoal for t\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n subgoal by auto\n apply auto\n apply(cases k')\n subgoal apply simp unfolding false_assn_def combine_assn_def entails_tassn_def\n by auto\n subgoal for v tt k''\n apply (simp add: T_def C_def)\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_waitin)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_left)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_waitin)\n subgoal by auto\n apply auto\n apply(subgoal_tac\"min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')) = tt\")\n prefer 2 subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def \n apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") \n unfolding T_def C_def by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_waitp_waitin')\n by auto\n subgoal\n apply(rule combine_assn_waitp_waitin')\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_assn_waitin_waitin)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_assn_waitin_waitin)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_assn_waitin_waitin)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_assn_waitin_waitin)\n by auto\n done\n done\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n subgoal by auto\n apply auto\n apply(cases k')\n subgoal apply simp unfolding false_assn_def combine_assn_def entails_tassn_def\n by auto\n subgoal for k''\n apply(auto simp add: T_def C_def)\n apply(rule combine_or_left)\n subgoal\n apply(cases \"(min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c''))) < (9 / 200 - ts2 CHR ''t'')\")\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait3)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_left)\n subgoal \n apply(rule combine_assn_out0_wait)\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_waitp_wait')\n by auto\n subgoal\n apply(rule combine_assn_waitp_wait')\n by auto\n done\n apply(cases \" (9 / 200 - ts2 CHR ''t'') = (min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')))\")\n subgoal\n apply simp\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait2)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI1)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_left)\n subgoal \n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_out0_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_out0_inrdy)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def \n apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") \n unfolding T_def C_def by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n apply(subgoal_tac \"ts2(CHR ''t'' := ts2 CHR ''t'' + min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c'')), F := 0) = ts2(CHR ''t'' := 9 / 200, F := 0)\")\n by auto\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n subgoal\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_waitp_outrdy')\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitp_inrdy')\n by auto\n done\n done\n apply(cases \"(min (9 / 200 - ts1 CHR ''t'') (1 / 100 - C_upd ent1 (ts1 CHR ''c''))) > (9 / 200 - ts2 CHR ''t'')\")\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_wait4)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_outrdy)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_wait_inrdy)\n by auto\n done\n by auto\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_right)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_wait)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_disjI2)\n apply(rule entails_tassn_cancel_left)\n apply(rule combine_or_right)\n subgoal for tt v\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_outrdy)\n subgoal by auto\n apply auto\n apply(rule entails_tassn_trans)\n prefer 2\n apply(rule pre(1))\n subgoal by auto\n subgoal using pre(2) unfolding propc_def by auto\n subgoal using pre(3) unfolding propc'_def by auto \n subgoal using pre(4) unfolding proper'_def properp_def by auto\n subgoal using pre(5,6) unfolding inv_s_def inv_s'_def \n apply(cases \"(9 / 200 - ts1 T) \\(1 / 100 - C_upd ent1 (ts1 C))\") \n unfolding T_def C_def by auto\n subgoal using pre(5,6) unfolding inv_s'_def inv_s_def by(auto simp add:T_def C_def)\n by auto\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_waitin_inrdy)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n done\n done\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply auto\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule entails_tassn_trans)\n apply(rule combine_assn_waitin_out)\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n apply(rule combine_or_left)\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply auto\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n subgoal\n apply(rule combine_assn_ex_pre_left')+\n apply(rule combine_assn_pure_pre_left')\n apply auto\n apply(rule combine_or_right)\n subgoal\n apply(rule combine_assn_ex_pre_right')+\n apply(rule combine_assn_pure_pre_right')\n apply auto\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n subgoal\n apply(rule combine_assn_waitin_out'')\n by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n done\n done\n\n apply(simp only:combine1.simps T2_tr.simps)\n subgoal \n unfolding propc_def propc'_def by auto\n done\n done\n done\n done\n qed\n\n\n\n\n\n\n\n\n\n\n\nend", "meta": {"author": "AgHHL", "repo": "lics2023", "sha": "e2ea9c15a8c0e1bf658679274ee87f30baf4abc3", "save_path": "github-repos/isabelle/AgHHL-lics2023", "path": "github-repos/isabelle/AgHHL-lics2023/lics2023-e2ea9c15a8c0e1bf658679274ee87f30baf4abc3/case2/combine2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.40356685373537454, "lm_q1q2_score": 0.2713307885043428}} {"text": "section {* Independence of IMAP Commands *}\n\ntext\\In this section we show that two concurrent operations that reference to the same tag must be \nidentical.\\\n\ntheory\n \"IMAP-proof-independent\"\n imports\n \"IMAP-def\"\n \"IMAP-proof-helpers\" \nbegin\n\nlemma (in imap) Broadcast_Expunge_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (i, Expunge e mo i)] prefix of j\"\n shows \"Deliver (mo, Append mo e) \\ set xs \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"mo \\ snd (y e)\"\n using broadcast_only_valid_msgs[of xs \"(i, Expunge e mo i)\" j] \n valid_behaviours_def[of y \"(i, Expunge e mo i)\"] assms by auto\n ultimately show ?thesis\n using assms Deliver_added_files apply_operations_added_files by blast\nqed\n\nlemma (in imap) Broadcast_Store_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (i, Store e mo i)] prefix of j\"\n shows \"Deliver (mo, Append mo e) \\ set xs \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"mo \\ snd (y e)\"\n using broadcast_only_valid_msgs[of xs \"(i, Store e mo i)\" j] \n valid_behaviours_def[of y \"(i, Store e mo i)\"] assms by auto\n ultimately show ?thesis\n using assms Deliver_added_files apply_operations_added_files by blast\nqed\n\nlemma (in imap) Deliver_added_ids:\n assumes \"xs prefix of j\"\n and \"i \\ set (added_ids xs e)\"\n shows \"Deliver (i, Create i e) \\ set xs \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set xs)\"\n using assms proof (induct xs rule: rev_induct, clarsimp)\n case (snoc x xs) thus ?case\n proof (cases x, force)\n case X: (Deliver e')\n moreover obtain a b where \"e' = (a, b)\" by force\n ultimately show ?thesis\n using snoc apply (case_tac b; clarify)\n apply (simp, metis added_ids_Deliver_Create_diff_collapse \n added_ids_Deliver_Create_same_collapse empty_iff list.set(1) set_ConsD create_id_valid \n in_set_conv_decomp prefix_of_appendD, force)\n using append_id_valid apply (simp, metis (no_types, lifting) prefix_of_appendD, simp, metis \n Un_iff added_ids_Deliver_Expunge_diff_collapse added_ids_Deliver_Expunge_same_collapse \n empty_iff expunge_id_valid list.set(1) list.set_intros(1) prefix_of_appendD set_ConsD \n set_append)\n by (simp, blast)\n qed\nqed\n\nlemma (in imap) Broadcast_Deliver_prefix_closed:\n assumes \"xs @ [Broadcast (r, Delete ix e)] prefix of j\"\n and \"i \\ ix\"\n shows \"Deliver (i, Create i e) \\ set xs \\ \n Deliver (i, Append i e) \\ set xs \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set xs) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set xs)\"\nproof - \n obtain y where \"apply_operations xs = Some y\"\n using assms broadcast_only_valid_msgs by blast\n moreover hence \"ix = fst (y e) \\ snd (y e)\"\n by (metis (mono_tags, lifting) assms(1) broadcast_only_valid_msgs operation.case(2)\n option.simps(1) valid_behaviours_def case_prodD)\n ultimately show ?thesis\n using assms Deliver_added_ids apply_operations_added_ids\n by (metis Deliver_added_files Un_iff apply_operations_added_files le_iff_sup prefix_of_appendD)\nqed\n\nlemma (in imap) concurrent_create_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Create i e) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Create i e) (ir, Delete is e)\"\nproof -\n have f1: \"Deliver (i, Create i e) \\ set (history j)\"\n using assms prefix_msg_in_history by blast\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f2: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms by auto\n have f3: \"Deliver (i, Append i e) \\ set pre\" using f1 P \n by (metis (full_types) Pair_inject fst_conv network.delivery_has_a_cause network.msg_id_unique \n network_axioms operation.simps(9) prefix_elem_to_carriers prefix_of_appendD)\n have f4: \"\\ mo . Deliver (i, Expunge e mo i) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.simps(11)\n prefix_elem_to_carriers prefix_of_appendD)\n have \"\\ mo . Deliver (i, Store e mo i) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.simps(13)\n prefix_elem_to_carriers prefix_of_appendD) \n thus ?thesis using f2 f3 f4 P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_store_expunge_independent_technical:\n assumes \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e i r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (r, Expunge e i r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence f1: \"Deliver (i, Append i e) \\ set pre \\ \n (\\ mo2 . Deliver (i, Store e mo2 i) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) by auto\n hence f2: \"Deliver (i, Append i e) \\ set (history k)\"\n by (metis Pair_inject assms(1) assms(2) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.distinct(17) prefix_msg_in_history)\n from f1 obtain mo2 :: 'a where\n \"Deliver (i, Store e mo2 i) \\ set (history k)\" using f2\n using calculation prefix_elem_to_carriers by blast \n hence \"Deliver (i, Store e mo i) \\ set (history k)\" using assms f1 f2 P \n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n prefix_msg_in_history) \n then show ?thesis\n using hb.intros(2) events_in_local_order f1 f2 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_store_expunge_independent_technical2:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo2 i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e mo r) \\ set (node_deliver_messages xs)\"\n shows \"mo2 \\ r\"\nproof -\n obtain oid :: \"'a \\ ('a, 'b) operation \\ nat\" where\n oid: \"\\p n. Deliver p \\ set (history n) \\ Broadcast p \\ set (history (oid p))\"\n by (metis (no_types) delivery_has_a_cause)\n hence f1: \"Broadcast (r, Expunge e mo r) \\ set (history (oid (r, Expunge e mo r)))\"\n using assms(1) assms(3) prefix_msg_in_history by blast\n obtain k :: \"'a \\ 'b \\ ('a \\ ('a, 'b) operation) event list \\ 'a\" where k: \n \"\\i e pre. (\\mo. Deliver (i, Store e mo i) \\ set pre) = \n (Deliver (i, Store e (k i e pre) i) \\ set pre)\"\n by moura\n obtain pre :: \"nat \\ ('a \\ ('a, 'b) operation) event \\ ('a \\ ('a, 'b) operation) event list\" \n where pre: \"\\k op1. (\\op2. op2 @ [op1] prefix of k) = (pre k op1 @ [op1] prefix of k)\"\n by moura\n hence f2: \"\\e n. e \\ set (history n) \\ pre n e @ [e] prefix of n\"\n using events_before_exist by simp\n hence f3: \"pre (oid (i, Store e1 mo2 i)) (Broadcast (i, Store e1 mo2 i))\n prefix of oid (i, Store e1 mo2 i)\"\n using oid assms(1) assms(2) prefix_msg_in_history by blast\n have f4: \"Deliver (r, Append r e1) \\ set (history (oid (i, Store e1 mo2 i)))\"\n by (metis (no_types) oid f1 fst_conv msg_id_unique old.prod.inject operation.distinct(15))\n have \"Deliver (r, Store e1 (k r e1 (pre (oid (i, Store e1 mo2 i)) \n (Broadcast (i, Store e1 mo2 i)))) r) \\ set (history (oid (i, Store e1 mo2 i)))\"\n by (metis (no_types) oid f1 fst_conv msg_id_unique old.prod.inject operation.distinct(19))\n thus ?thesis using oid k f2 f3 f4 assms\n by (metis (no_types, lifting) Broadcast_Store_Deliver_prefix_closed \n network.prefix_msg_in_history network_axioms prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_store_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (ir, Delete is e)\"\nproof -\n have f1: \"Deliver (i, Store e mo i) \\ set (history j)\" using assms prefix_msg_in_history by auto\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f2: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\\n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\" \n using Broadcast_Deliver_prefix_closed assms(1) by auto \n have f3: \"Deliver (i, Create i e) \\ set pre\" using f1 P \n by (metis Pair_inject delivery_has_a_cause fst_conv msg_id_unique operation.distinct(7) \n prefix_elem_to_carriers prefix_of_appendD)\n have f4: \"Deliver (i, Append i e) \\ set pre\" using f1 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique operation.distinct(17) \n prefix_elem_to_carriers prefix_of_appendD prod.inject)\n have \"\\ mo . Deliver (i, Expunge e mo i) \\ set pre\" using f1 P\n by (metis Pair_inject delivery_has_a_cause fst_conv msg_id_unique operation.simps(25) \n prefix_elem_to_carriers prefix_of_appendD)\n hence \"Deliver (i, Store e mo i) \\ set pre\" using f1 f2 f3 f4 P\n by (metis delivery_has_a_cause fst_conv msg_id_unique node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers) \n thus ?thesis using P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_append_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (ir, Delete is e)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms(1) by auto\n hence \"Deliver (i, Append i e) \\ set pre\" using assms P f1\n by (metis (no_types, hide_lams) delivery_has_a_cause events_in_local_order fst_conv \n hb_broadcast_exists1 hb_deliver msg_id_unique prefix_msg_in_history)\n thus ?thesis using P events_in_local_order hb_deliver by blast\nqed\n\nlemma (in imap) concurrent_append_expunge_independent_technical:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e mo r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (r, Expunge e mo r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"Deliver (mo, Append mo e) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) by auto\n hence \"(\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\" using P assms \n proof -\n have \"Deliver (mo, Append mo e) \\ set (history j)\"\n using assms(1) assms(2) assms(3) prefix_msg_in_history by blast\n thus ?thesis\n by (metis (no_types) P Pair_inject delivery_has_a_cause fst_conv msg_id_unique \n operation.simps(23) prefix_elem_to_carriers prefix_of_appendD)\n qed\n thus ?thesis\n using hb.intros(2) events_in_local_order assms(1) P f1 by blast\nqed\n\nlemma (in imap) concurrent_append_store_independent_technical:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e mo r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Append i e) (r, Store e mo r)\"\nproof -\n obtain pre k where \"pre@[Broadcast (r, Store e mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence f1: \"Deliver (mo, Append mo e) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e mo2 mo) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) by auto\n have f2: \"Deliver (i, Append i e) \\ set (history j)\"\n by (meson assms network.prefix_msg_in_history network_axioms)\n then show ?thesis using assms f1 \n by (metis calculation delivery_has_a_cause events_in_local_order fst_conv hb_deliver \n msg_id_unique node_histories.prefix_of_appendD node_histories_axioms \n prefix_elem_to_carriers)\nqed\n\nlemma (in imap) concurrent_expunge_delete_independent_technical:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Expunge e mo i) (ir, Delete is e)\"\nproof -\n obtain pre k where \"pre@[Broadcast (ir, Delete is e)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n moreover hence A: \"Deliver (i, Create i e) \\ set pre \\ \n Deliver (i, Append i e) \\ set pre \\ \n (\\ mo . Deliver (i, Expunge e mo i) \\ set pre) \\ \n (\\ mo . Deliver (i, Store e mo i) \\ set pre)\"\n using Broadcast_Deliver_prefix_closed assms(1) by auto \n hence \"Deliver (i, Expunge e mo i) \\ set pre\" using assms\n proof -\n have f1: \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using calculation prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Expunge e mo i) \\ set (history j)\"\n by (meson assms network.prefix_msg_in_history network_axioms)\n then show ?thesis using f1 A \n by (metis (no_types, lifting) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms)\n qed \n ultimately show ?thesis\n using hb.intros(2) events_in_local_order by blast\nqed\n\nlemma (in imap) concurrent_store_store_independent_technical:\n assumes \"xs prefix of j\"\n and \"(i, Store e mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e i r) \\ set (node_deliver_messages xs)\"\n shows \"hb (i, Store e mo i) (r, Store e i r)\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n hence f1: \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Append i e) \\ set pre \\ (\\ mo2 . Deliver (i, Store e mo2 i) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) P by auto \n hence \"Deliver (i, Store e mo i) \\ set pre\" using assms f1 \n by (metis delivery_has_a_cause fst_conv msg_id_unique prefix_msg_in_history)\n then show ?thesis\n using hb.intros(2) events_in_local_order P by blast\nqed\n\nlemma (in imap) expunge_delete_tag_causality:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\" \n and \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n shows \"Deliver (i, Expunge e2 mo i) \\ set (history k)\"\nproof- \n have f1: \"Deliver (i, Append i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(15) prefix_msg_in_history)\n have f2: \"Deliver (i, Create i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(5) prefix_msg_in_history)\n have f3: \"\\ mo. Deliver (i, Store e2 mo i) \\ set (history k)\" using assms\n by (metis Pair_inject fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n operation.simps(25) prefix_msg_in_history)\n hence \"\\ mo1. Deliver (i, Expunge e2 mo1 i) \\ set (history k)\" using assms f1 f2 \n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms node_histories.prefix_of_appendD \n node_histories_axioms prefix_elem_to_carriers)\n then obtain mo1 :: 'a where\n \"Deliver (i, Expunge e2 mo1 i) \\ set (history k)\" by blast\n then show ?thesis using assms f1 f2 f3\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(4) prefix_msg_in_history)\nqed\n\nlemma (in imap) expunge_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Expunge e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence \"Deliver (i, Expunge e2 mo i) \\ set (history k)\" using assms expunge_delete_tag_causality\n by blast\n then show ?thesis using assms\n by (metis delivery_has_a_cause fst_conv network.msg_id_unique network_axioms \n operation.inject(4) prefix_msg_in_history prod.inject)\nqed\n\nlemma (in imap) store_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n have f1: \"Deliver (i, Append i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(17) prefix_msg_in_history)\n have f2: \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set (history k)\" using assms\n by (metis Pair_inject fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n operation.distinct(19) prefix_msg_in_history)\n have f3: \"Deliver (i, Create i e2) \\ set (history k)\" using assms\n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.distinct(8) prefix_msg_in_history)\n hence \"(\\ mo1. Deliver (i, Store e2 mo1 i) \\ set pre)\" using assms P f1 f2 imap_axioms \n by (meson imap.Broadcast_Deliver_prefix_closed prefix_elem_to_carriers prefix_of_appendD)\n then obtain mo1 :: 'a where\n f3: \"Deliver (i, Store e2 mo1 i) \\ set pre\" by blast\n then have f4: \"Deliver (i, Store e2 mo1 i) \\ set (history k)\"\n using P prefix_elem_to_carriers by blast \n hence \"Deliver (i, Store e2 mo i) \\ set pre\" using f2 f3 assms \n by (metis fst_conv msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(5) prefix_msg_in_history)\n moreover have \"Deliver(i, Store e1 mo i) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast \n ultimately show ?thesis using f4\n by (metis delivery_has_a_cause fst_conv msg_id_unique old.prod.inject operation.inject(5))\nqed\n\nlemma (in imap) create_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Create i e1) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast\n have f1: \"Deliver (i, Append i e2) \\ set (history k)\"\n by (metis assms(2) assms(3) delivery_has_a_cause fst_conv network.msg_id_unique \n network.prefix_msg_in_history network_axioms operation.distinct(3) prod.inject)\n have f2: \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set (history k)\"\n by (metis assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n old.prod.inject operation.distinct(5) prefix_msg_in_history)\n have f3: \"\\ mo. Deliver (i, Store e2 mo i) \\ set (history k)\"\n by (metis Pair_inject assms(2) assms(3) delivery_has_a_cause fst_conv msg_id_unique \n operation.distinct(7) prefix_msg_in_history)\n hence \"Deliver (i, Create i e2) \\ set pre\" using assms P f2 f1 imap_axioms\n by (meson imap.Broadcast_Deliver_prefix_closed prefix_elem_to_carriers prefix_of_appendD)\n then show ?thesis using f1 f2 f3\n by (metis (no_types, lifting) P assms(2) assms(3) delivery_has_a_cause fst_conv msg_id_unique \n node_histories.prefix_of_appendD node_histories_axioms old.prod.inject operation.inject(1) \n prefix_elem_to_carriers prefix_msg_in_history)\nqed\n\nlemma (in imap) append_delete_ids_imply_messages_same:\n assumes \"i \\ is\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(ir, Delete is e2) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (ir, Delete is e2)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence f1: \"\\e. e \\ set pre \\ e \\ set (history k)\" using prefix_elem_to_carriers by blast\n have f2: \"Deliver (i, Create i e2) \\ set pre\" using P f1\n by (metis assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause network_axioms \n old.prod.inject operation.distinct(3) prefix_msg_in_history)\n moreover have \"\\ mo. Deliver (i, Expunge e2 mo i) \\ set pre\" using P f1\n by (metis Pair_inject assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.distinct(15) prefix_msg_in_history)\n moreover have \"\\ mo. Deliver (i, Store e2 mo i) \\ set pre\" using P f1\n by (metis Pair_inject assms(2) assms(3) fst_conv msg_id_unique network.delivery_has_a_cause \n network_axioms operation.simps(23) prefix_msg_in_history)\n moreover hence \"Deliver (i, Append i e2) \\ set pre\" \n using P calculation(3) f2 assms(1) calculation(2) Broadcast_Deliver_prefix_closed by blast\n moreover have \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n ultimately show ?thesis using assms \n by (metis f1 msg_id_unique network.delivery_has_a_cause network_axioms old.prod.inject \n operation.inject(3) prod.sel(1))\nqed\n\nlemma (in imap) append_expunge_ids_imply_messages_same:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e2 mo r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where \"pre@[Broadcast (r, Expunge e2 mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence \"Deliver (mo, Append mo e2) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e2 mo2 mo) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1)\n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms) \n hence \"Deliver (i, Append i e2) \\ set pre\" using assms\n by (metis (no_types, lifting) calculation delivery_has_a_cause fst_conv hb_broadcast_exists1 \n msg_id_unique network.hb_deliver network.prefix_msg_in_history network_axioms \n node_histories.events_in_local_order node_histories_axioms operation.distinct(17) \n prod.inject) \n moreover have \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n ultimately show ?thesis\n by (metis (no_types, lifting) fst_conv network.delivery_has_a_cause network.msg_id_unique \n network_axioms operation.inject(3) prefix_elem_to_carriers prefix_of_appendD prod.inject)\nqed\n\nlemma (in imap) append_store_ids_imply_messages_same:\n assumes \"i = mo\"\n and \"xs prefix of j\"\n and \"(i, Append i e1) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e2 mo r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e2 mo r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence A: \"Deliver (mo, Append mo e2) \\ set pre \\ \n (\\ mo2 . Deliver (mo, Store e2 mo2 mo) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1)\n by (meson imap.Broadcast_Deliver_prefix_closed imap_axioms)\n have f1: \"Deliver (i, Append i e1) \\ set (history j)\"\n using assms(2) assms(3) prefix_msg_in_history by blast\n hence \"Deliver (i, Append i e2) \\ set pre\" using assms P A\n by (metis Pair_inject assms(1) calculation delivery_has_a_cause fst_conv msg_id_unique \n operation.simps(23) prefix_elem_to_carriers prefix_of_appendD)\n then show ?thesis using f1\n by (metis calculation delivery_has_a_cause fst_conv msg_id_unique \n node_histories.prefix_of_appendD node_histories_axioms operation.inject(3) \n prefix_elem_to_carriers prod.inject)\nqed\n\nlemma (in imap) expunge_store_ids_imply_messages_same:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Expunge e2 i r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Expunge e2 i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n hence pprefix: \"pre prefix of k\"\n using P by blast\n have A: \"Deliver (i, Append i e2) \\ set pre \\ \n (\\ mo2 . Deliver (i, Store e2 mo2 i) \\ set pre)\"\n using Broadcast_Expunge_Deliver_prefix_closed assms(1) P by blast \n have \"Deliver (i, Store e2 mo i) \\ set pre\" using assms A P\n proof -\n obtain op1 :: \"'a \\ ('a, 'b) operation \\ nat\" where\n f1: \"Broadcast (i, Store e1 mo i) \\ set (history (op1 (i, Store e1 mo i)))\"\n by (meson assms(1) assms(2) delivery_has_a_cause prefix_msg_in_history)\n then show ?thesis \n using f1 A pprefix delivery_has_a_cause network.msg_id_unique network_axioms \n node_histories.prefix_to_carriers node_histories_axioms \n by fastforce\n qed\n moreover have \"Deliver (i, Store e1 mo i) \\ set (history j)\"\n using assms(1) assms(2) prefix_msg_in_history by auto\n ultimately show ?thesis using assms P\n by (metis delivery_has_a_cause fst_conv msg_id_unique operation.inject(5) \n prefix_elem_to_carriers prefix_of_appendD prod.inject) \nqed\n\nlemma (in imap) store_store_ids_imply_messages_same:\n assumes \"xs prefix of j\"\n and \"(i, Store e1 mo i) \\ set (node_deliver_messages xs)\" \n and \"(r, Store e2 i r) \\ set (node_deliver_messages xs)\"\n shows \"e1 = e2\"\nproof -\n obtain pre k where P: \"pre@[Broadcast (r, Store e2 i r)] prefix of k\"\n using assms delivery_has_a_cause events_before_exist prefix_msg_in_history by blast \n moreover hence A: \"Deliver (i, Append i e2) \\ set pre \\\n (\\ mo2 . Deliver (i, Store e2 mo2 i) \\ set pre)\"\n using Broadcast_Store_Deliver_prefix_closed assms(1) by blast\n have \"\\e. e \\ set pre \\ e \\ set (history k)\"\n using calculation prefix_elem_to_carriers by auto\n hence \"Deliver (i, Store e2 mo i) \\ set pre\" \n by (metis A assms(1) assms(2) delivery_has_a_cause fst_conv msg_id_unique \n operation.distinct(17) operation.inject(5) prefix_msg_in_history prod.inject)\n moreover have \"Deliver (i, Store e1 mo i) \\ set (history j)\"\n using assms(1) assms(2) prefix_msg_in_history by auto\n ultimately show ?thesis using assms\n by (metis Pair_inject delivery_has_a_cause msg_id_unique operation.simps(5) \n prefix_elem_to_carriers prefix_of_appendD prod.sel(1))\nqed \n\nend\n", "meta": {"author": "go-pluto", "repo": "verification", "sha": "db28e53a61b1522752473372a9f013ff0694464b", "save_path": "github-repos/isabelle/go-pluto-verification", "path": "github-repos/isabelle/go-pluto-verification/verification-db28e53a61b1522752473372a9f013ff0694464b/thys/IMAP-CRDT/IMAP-proof-independent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2712334235359007}} {"text": "(* Title: Abstract Rewriting\n Author: Christian Sternagel \n Rene Thiemann \n Maintainer: Christian Sternagel and Rene Thiemann\n License: LGPL\n*)\n\n(*\nCopyright 2010 Christian Sternagel and René Thiemann\n\nThis file is part of IsaFoR/CeTA.\n\nIsaFoR/CeTA is free software: you can redistribute it and/or modify it under the\nterms of the GNU Lesser General Public License as published by the Free Software\nFoundation, either version 3 of the License, or (at your option) any later\nversion.\n\nIsaFoR/CeTA is distributed in the hope that it will be useful, but WITHOUT ANY\nWARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A\nPARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public License along\nwith IsaFoR/CeTA. If not, see .\n*)\n\nheader {* Relative Rewriting *}\n\ntheory Relative_Rewriting\nimports Abstract_Rewriting\nbegin\n\ntext {*Considering a relation @{term R} relative to another relation @{term S}, i.e.,\n@{term R}-steps may be preceded and followd by arbitrary many @{term S}-steps.*}\nabbreviation (input) relto :: \"'a rel \\ 'a rel \\ 'a rel\" where\n \"relto R S \\ S^* O R O S^*\"\n\ndefinition SN_rel_on :: \"'a rel \\ 'a rel \\ 'a set \\ bool\" where\n \"SN_rel_on R S \\ SN_on (relto R S)\"\n\ndefinition SN_rel_on_alt :: \"'a rel \\ 'a rel \\ 'a set \\ bool\" where\n \"SN_rel_on_alt R S T = (\\f. chain (R \\ S) f \\ f 0 \\ T \\ \\ (INFM j. (f j, f (Suc j)) \\ R))\"\n\nabbreviation SN_rel :: \"'a rel \\ 'a rel \\ bool\" where\n \"SN_rel R S \\ SN_rel_on R S UNIV\"\n\nabbreviation SN_rel_alt :: \"'a rel \\ 'a rel \\ bool\" where\n \"SN_rel_alt R S \\ SN_rel_on_alt R S UNIV\"\n\n\nlemma steps_preserve_SN_on_relto:\n assumes steps: \"(a, b) \\ (R \\ S)^*\"\n and SN: \"SN_on (relto R S) {a}\"\n shows \"SN_on (relto R S) {b}\"\nproof -\n let ?RS = \"relto R S\"\n have \"(R \\ S)^* \\ S^* \\ ?RS^*\" by regexp\n with steps have \"(a,b) \\ S^* \\ (a,b) \\ ?RS^*\" by auto\n thus ?thesis\n proof\n assume \"(a,b) \\ ?RS^*\"\n from steps_preserve_SN_on[OF this SN] show ?thesis .\n next\n assume Ssteps: \"(a,b) \\ S^*\"\n show ?thesis\n proof\n fix f\n assume \"f 0 \\ {b}\" and \"chain ?RS f\"\n hence f0: \"f 0 = b\" and steps: \"\\i. (f i, f (Suc i)) \\ ?RS\" by auto\n let ?g = \"\\ i. if i = 0 then a else f i\"\n have \"\\ SN_on ?RS {a}\" unfolding SN_on_def not_not\n proof (rule exI[of _ ?g], intro conjI allI)\n fix i\n show \"(?g i, ?g (Suc i)) \\ ?RS\"\n proof (cases i)\n case (Suc j)\n show ?thesis using steps[of i] unfolding Suc by simp\n next\n case 0\n from steps[of 0, unfolded f0] Ssteps have steps: \"(a,f (Suc 0)) \\ S^* O ?RS\" by auto\n have \"(a,f (Suc 0)) \\ ?RS\" \n by (rule set_mp[OF _ steps], regexp)\n thus ?thesis unfolding 0 by simp\n qed\n qed simp\n with SN show False by simp\n qed\n qed\nqed\n\nlemma SN_rel_on_imp_SN_rel_on_alt: \"SN_rel_on R S T \\ SN_rel_on_alt R S T\"\nproof (unfold SN_rel_on_def)\n assume SN: \"SN_on (relto R S) T\"\n show ?thesis\n proof (unfold SN_rel_on_alt_def, intro allI impI)\n fix f\n assume steps: \"chain (R \\ S) f \\ f 0 \\ T\"\n with SN have SN: \"SN_on (relto R S) {f 0}\" \n and steps: \"\\ i. (f i, f (Suc i)) \\ R \\ S\" unfolding SN_defs by auto\n obtain r where r: \"\\ j. r j \\ (f j, f (Suc j)) \\ R\" by auto\n show \"\\ (INFM j. (f j, f (Suc j)) \\ R)\"\n proof (rule ccontr)\n assume \"\\ ?thesis\"\n hence ih: \"infinitely_many r\" unfolding infinitely_many_def r by blast\n obtain r_index where \"r_index = infinitely_many.index r\" by simp\n with infinitely_many.index_p[OF ih] infinitely_many.index_ordered[OF ih] infinitely_many.index_not_p_between[OF ih] \n have r_index: \"\\ i. r (r_index i) \\ r_index i < r_index (Suc i) \\ (\\ j. r_index i < j \\ j < r_index (Suc i) \\ \\ r j)\" by auto\n obtain g where g: \"\\ i. g i \\ f (r_index i)\" ..\n {\n fix i\n let ?ri = \"r_index i\"\n let ?rsi = \"r_index (Suc i)\"\n from r_index have isi: \"?ri < ?rsi\" by auto\n obtain ri rsi where ri: \"ri = ?ri\" and rsi: \"rsi = ?rsi\" by auto\n with r_index[of i] steps have inter: \"\\ j. ri < j \\ j < rsi \\ (f j, f (Suc j)) \\ S\" unfolding r by auto\n from ri isi rsi have risi: \"ri < rsi\" by simp \n {\n fix n\n assume \"Suc n \\ rsi - ri\"\n hence \"(f (Suc ri), f (Suc (n + ri))) \\ S^*\"\n proof (induct n, simp)\n case (Suc n)\n hence stepps: \"(f (Suc ri), f (Suc (n+ri))) \\ S^*\" by simp\n have \"(f (Suc (n+ri)), f (Suc (Suc n + ri))) \\ S\"\n using inter[of \"Suc n + ri\"] Suc(2) by auto\n with stepps show ?case by simp\n qed\n }\n from this[of \"rsi - ri - 1\"] risi have \n \"(f (Suc ri), f rsi) \\ S^*\" by simp\n with ri rsi have ssteps: \"(f (Suc ?ri), f ?rsi) \\ S^*\" by simp\n with r_index[of i] have \"(f ?ri, f ?rsi) \\ R O S^*\" unfolding r by auto\n hence \"(g i, g (Suc i)) \\ S^* O R O S^*\" using rtrancl_refl unfolding g by auto \n } \n hence nSN: \"\\ SN_on (S^* O R O S^*) {g 0}\" unfolding SN_defs by blast\n have SN: \"SN_on (S^* O R O S^*) {f (r_index 0)}\"\n proof (rule steps_preserve_SN_on_relto[OF _ SN])\n show \"(f 0, f (r_index 0)) \\ (R \\ S)^*\"\n unfolding rtrancl_fun_conv\n by (rule exI[of _ f], rule exI[of _ \"r_index 0\"], insert steps, auto)\n qed\n with nSN show False unfolding g ..\n qed\n qed\nqed\n \nlemma SN_rel_on_alt_imp_SN_rel_on: \"SN_rel_on_alt R S T \\ SN_rel_on R S T\"\nproof (unfold SN_rel_on_def)\n assume SN: \"SN_rel_on_alt R S T\"\n show \"SN_on (relto R S) T\"\n proof\n fix f\n assume start: \"f 0 \\ T\" and \"chain (relto R S) f\"\n hence steps: \"\\ i. (f i, f (Suc i)) \\ S^* O R O S^*\" by auto\n let ?prop = \"\\ i ai bi. (f i, bi) \\ S^* \\ (bi, ai) \\ R \\ (ai, f (Suc (i))) \\ S^*\"\n {\n fix i\n from steps obtain bi ai where \"?prop i ai bi\" by blast\n hence \"\\ ai bi. ?prop i ai bi\" by blast\n }\n hence \"\\ i. \\ bi ai. ?prop i ai bi\" by blast\n from choice[OF this] obtain b where \"\\ i. \\ ai. ?prop i ai (b i)\" by blast\n from choice[OF this] obtain a where steps: \"\\ i. ?prop i (a i) (b i)\" by blast\n from steps[of 0] have fa0: \"(f 0, a 0) \\ S^* O R\" by auto\n let ?prop = \"\\ i li. (b i, a i) \\ R \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S) \\ last (a i # li) = b (Suc i)\"\n {\n fix i\n from steps[of i] steps[of \"Suc i\"] have \"(a i, f (Suc i)) \\ S^*\" and \"(f (Suc i), b (Suc i)) \\ S^*\" by auto\n from rtrancl_trans[OF this] steps[of i] have R: \"(b i, a i) \\ R\" and S: \"(a i, b (Suc i)) \\ S^*\" by blast+\n from S[unfolded rtrancl_list_conv] obtain li where \"last (a i # li) = b (Suc i) \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S)\" ..\n with R have \"?prop i li\" by blast\n hence \"\\ li. ?prop i li\" ..\n }\n hence \"\\ i. \\ li. ?prop i li\" ..\n from choice[OF this] obtain l where steps: \"\\ i. ?prop i (l i)\" by auto\n let ?p = \"\\ i. ?prop i (l i)\"\n from steps have steps: \"\\ i. ?p i\" by blast\n let ?l = \"\\ i. a i # l i\" \n let ?l' = \"\\ i. length (?l i)\"\n let ?g = \"\\ i. inf_concat_simple ?l' i\"\n obtain g where g: \"\\ i. g i = (let (ii,jj) = ?g i in ?l ii ! jj)\" by auto \n have g0: \"g 0 = a 0\" unfolding g Let_def by simp\n with fa0 have fg0: \"(f 0, g 0) \\ S^* O R\" by auto\n have fg0: \"(f 0, g 0) \\ (R \\ S)^*\"\n by (rule set_mp[OF _ fg0], regexp)\n have len: \"\\ i j n. ?g n = (i,j) \\ j < length (?l i)\"\n proof -\n fix i j n\n assume n: \"?g n = (i,j)\"\n show \"j < length (?l i)\" \n proof (cases n)\n case 0\n with n have \"j = 0\" by auto\n thus ?thesis by simp\n next\n case (Suc nn)\n obtain ii jj where nn: \"?g nn = (ii,jj)\" by (cases \"?g nn\", auto)\n show ?thesis \n proof (cases \"Suc jj < length (?l ii)\")\n case True\n with nn Suc have \"?g n = (ii, Suc jj)\" by auto\n with n True show ?thesis by simp\n next\n case False \n with nn Suc have \"?g n = (Suc ii, 0)\" by auto\n with n show ?thesis by simp\n qed\n qed\n qed \n have gsteps: \"\\ i. (g i, g (Suc i)) \\ R \\ S\"\n proof -\n fix n\n obtain i j where n: \"?g n = (i, j)\" by (cases \"?g n\", auto)\n show \"(g n, g (Suc n)) \\ R \\ S\"\n proof (cases \"Suc j < length (?l i)\")\n case True\n with n have \"?g (Suc n) = (i, Suc j)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = ?l i ! (Suc j)\" unfolding g by auto\n thus ?thesis using steps[of i] True by auto\n next\n case False\n with n have \"?g (Suc n) = (Suc i, 0)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = a (Suc i)\" unfolding g by auto\n from gn len[OF n] False have \"j = length (?l i) - 1\" by auto\n with gn have gn: \"g n = last (?l i)\" using last_conv_nth[of \"?l i\"] by auto\n from gn gsn show ?thesis using steps[of i] steps[of \"Suc i\"] by auto\n qed\n qed\n have infR: \"INFM j. (g j, g (Suc j)) \\ R\" unfolding INFM_nat_le\n proof\n fix n\n obtain i j where n: \"?g n = (i,j)\" by (cases \"?g n\", auto)\n from len[OF n] have j: \"j < ?l' i\" .\n let ?k = \"?l' i - 1 - j\"\n obtain k where k: \"k = j + ?k\" by auto\n from j k have k2: \"k = ?l' i - 1\" and k3: \"j + ?k < ?l' i\" by auto\n from inf_concat_simple_add[OF n, of ?k, OF k3] \n have gnk: \"?g (n + ?k) = (i, k)\" by (simp only: k)\n hence \"g (n + ?k) = ?l i ! k\" unfolding g by auto\n hence gnk2: \"g (n + ?k) = last (?l i)\" using last_conv_nth[of \"?l i\"] k2 by auto\n from k2 gnk have \"?g (Suc (n+?k)) = (Suc i, 0)\" by auto\n hence gnsk2: \"g (Suc (n+?k)) = a (Suc i)\" unfolding g by auto\n from steps[of i] steps[of \"Suc i\"] have main: \"(g (n+?k), g (Suc (n+?k))) \\ R\" \n by (simp only: gnk2 gnsk2)\n show \"\\ j \\ n. (g j, g (Suc j)) \\ R\" \n by (rule exI[of _ \"n + ?k\"], auto simp: main[simplified])\n qed\n from fg0[unfolded rtrancl_fun_conv] obtain gg n where start: \"gg 0 = f 0\" \n and n: \"gg n = g 0\" and steps: \"\\ i. i < n \\ (gg i, gg (Suc i)) \\ R \\ S\" by auto\n let ?h = \"\\ i. if i < n then gg i else g (i - n)\"\n obtain h where h: \"h = ?h\" by auto\n {\n fix i\n assume i: \"i \\ n\"\n have \"h i = gg i\" using i unfolding h\n by (cases \"i < n\", auto simp: n)\n } note gg = this\n from gg[of 0] `f 0 \\ T` have h0: \"h 0 \\ T\" unfolding start by auto\n {\n fix i\n have \"(h i, h (Suc i)) \\ R \\ S\"\n proof (cases \"i < n\")\n case True\n from steps[of i] gg[of i] gg[of \"Suc i\"] True show ?thesis by auto\n next\n case False\n hence \"i = n + (i - n)\" by auto\n then obtain k where i: \"i = n + k\" by auto\n from gsteps[of k] show ?thesis unfolding h i by simp\n qed\n } note hsteps = this\n from SN[unfolded SN_rel_on_alt_def, rule_format, OF conjI[OF allI[OF hsteps] h0]]\n have \"\\ (INFM j. (h j, h (Suc j)) \\ R)\" .\n moreover have \"INFM j. (h j, h (Suc j)) \\ R\" unfolding INFM_nat_le\n proof (rule)\n fix m\n from infR[unfolded INFM_nat_le, rule_format, of m]\n obtain i where i: \"i \\ m\" and g: \"(g i, g (Suc i)) \\ R\" by auto\n show \"\\ n \\ m. (h n , h (Suc n)) \\ R\"\n by (rule exI[of _ \"i + n\"], unfold h, insert g i, auto)\n qed\n ultimately show False ..\n qed\nqed\n\n\nlemma SN_rel_on_conv: \"SN_rel_on = SN_rel_on_alt\"\n by (intro ext) (blast intro: SN_rel_on_imp_SN_rel_on_alt SN_rel_on_alt_imp_SN_rel_on)\n\nlemmas SN_rel_defs = SN_rel_on_def SN_rel_on_alt_def\n\nlemma SN_rel_on_alt_r_empty : \"SN_rel_on_alt {} S T\"\n unfolding SN_rel_defs by auto\n\nlemma SN_rel_on_alt_s_empty : \"SN_rel_on_alt R {} = SN_on R\"\n by (intro ext, unfold SN_rel_defs SN_defs, auto)\n\nlemma SN_rel_on_mono':\n assumes R: \"R \\ R'\" and S: \"S \\ R' \\ S'\" and SN: \"SN_rel_on R' S' T\"\n shows \"SN_rel_on R S T\"\nproof -\n note conv = SN_rel_on_conv SN_rel_on_alt_def INFM_nat_le\n show ?thesis unfolding conv\n proof(intro allI impI)\n fix f\n assume \"chain (R \\ S) f \\ f 0 \\ T\"\n with R S have \"chain (R' \\ S') f \\ f 0 \\ T\" by auto\n from SN[unfolded conv, rule_format, OF this]\n show \"\\ (\\ m. \\ n \\ m. (f n, f (Suc n)) \\ R)\" using R by auto\n qed\nqed\n\nlemma relto_mono:\n assumes \"R \\ R'\" and \"S \\ S'\"\n shows \"relto R S \\ relto R' S'\"\n using assms rtrancl_mono by blast\n\nlemma SN_rel_on_mono:\n assumes R: \"R \\ R'\" and S: \"S \\ S'\"\n and SN: \"SN_rel_on R' S' T\"\n shows \"SN_rel_on R S T\"\n using SN\n unfolding SN_rel_on_def using SN_on_mono[OF _ relto_mono[OF R S]] by blast\n\nlemmas SN_rel_on_alt_mono = SN_rel_on_mono[unfolded SN_rel_on_conv]\n\nlemma SN_rel_on_imp_SN_on:\n assumes \"SN_rel_on R S T\" shows \"SN_on R T\"\nproof\n fix f\n assume \"chain R f\"\n and f0: \"f 0 \\ T\"\n hence \"\\i. (f i, f (Suc i)) \\ relto R S\" by blast\n thus False using assms f0 unfolding SN_rel_on_def SN_defs by blast\nqed\n\n\n\nlemma SN_rel_on_Id:\n shows \"SN_rel_on R (S \\ Id) T = SN_rel_on R S T\"\n unfolding SN_rel_on_def by (simp only: relto_Id)\n\nlemma SN_rel_on_empty[simp]: \"SN_rel_on R {} T = SN_on R T\"\n unfolding SN_rel_on_def by auto\n\nlemma SN_rel_on_ideriv: \"SN_rel_on R S T = (\\ (\\ as. ideriv R S as \\ as 0 \\ T))\" (is \"?L = ?R\")\nproof\n assume ?L\n show ?R\n proof\n assume \"\\ as. ideriv R S as \\ as 0 \\ T\"\n then obtain as where id: \"ideriv R S as\" and T: \"as 0 \\ T\" by auto\n note id = id[unfolded ideriv_def]\n from `?L`[unfolded SN_rel_on_conv SN_rel_on_alt_def, THEN spec[of _ as]]\n id T obtain i where i: \"\\ j. j \\ i \\ (as j, as (Suc j)) \\ R\" by auto\n with id[unfolded INFM_nat, THEN conjunct2, THEN spec[of _ \"Suc i\"]] show False by auto\n qed\nnext\n assume ?R\n show ?L\n unfolding SN_rel_on_conv SN_rel_on_alt_def\n proof(intro allI impI)\n fix as\n assume \"chain (R \\ S) as \\ as 0 \\ T\"\n with `?R`[unfolded ideriv_def] have \"\\ (INFM i. (as i, as (Suc i)) \\ R)\" by auto\n from this[unfolded INFM_nat] obtain i where i: \"\\j. i < j \\ (as j, as (Suc j)) \\ R\" by auto\n show \"\\ (INFM j. (as j, as (Suc j)) \\ R)\" unfolding INFM_nat using i by blast\n qed\nqed\n\nlemma SN_rel_to_SN_rel_alt: \"SN_rel R S \\ SN_rel_alt R S\"\nproof (unfold SN_rel_on_def)\n assume SN: \"SN (relto R S)\"\n show ?thesis\n proof (unfold SN_rel_on_alt_def, intro allI impI)\n fix f\n presume steps: \"chain (R \\ S) f\"\n obtain r where r: \"\\j. r j \\ (f j, f (Suc j)) \\ R\" by auto\n show \"\\ (INFM j. (f j, f (Suc j)) \\ R)\"\n proof (rule ccontr)\n assume \"\\ ?thesis\"\n hence ih: \"infinitely_many r\" unfolding infinitely_many_def r by blast\n obtain r_index where \"r_index = infinitely_many.index r\" by simp\n with infinitely_many.index_p[OF ih] infinitely_many.index_ordered[OF ih] infinitely_many.index_not_p_between[OF ih] \n have r_index: \"\\ i. r (r_index i) \\ r_index i < r_index (Suc i) \\ (\\ j. r_index i < j \\ j < r_index (Suc i) \\ \\ r j)\" by auto\n obtain g where g: \"\\ i. g i \\ f (r_index i)\" ..\n {\n fix i\n let ?ri = \"r_index i\"\n let ?rsi = \"r_index (Suc i)\"\n from r_index have isi: \"?ri < ?rsi\" by auto\n obtain ri rsi where ri: \"ri = ?ri\" and rsi: \"rsi = ?rsi\" by auto\n with r_index[of i] steps have inter: \"\\ j. ri < j \\ j < rsi \\ (f j, f (Suc j)) \\ S\" unfolding r by auto\n from ri isi rsi have risi: \"ri < rsi\" by simp \n {\n fix n\n assume \"Suc n \\ rsi - ri\"\n hence \"(f (Suc ri), f (Suc (n + ri))) \\ S^*\"\n proof (induct n, simp)\n case (Suc n)\n hence stepps: \"(f (Suc ri), f (Suc (n+ri))) \\ S^*\" by simp\n have \"(f (Suc (n+ri)), f (Suc (Suc n + ri))) \\ S\"\n using inter[of \"Suc n + ri\"] Suc(2) by auto\n with stepps show ?case by simp\n qed\n }\n from this[of \"rsi - ri - 1\"] risi have \n \"(f (Suc ri), f rsi) \\ S^*\" by simp\n with ri rsi have ssteps: \"(f (Suc ?ri), f ?rsi) \\ S^*\" by simp\n with r_index[of i] have \"(f ?ri, f ?rsi) \\ R O S^*\" unfolding r by auto\n hence \"(g i, g (Suc i)) \\ S^* O R O S^*\" using rtrancl_refl unfolding g by auto \n } \n hence \"\\ SN (S^* O R O S^*)\" unfolding SN_defs by blast\n with SN show False by simp\n qed\n qed simp\nqed\n\nlemma SN_rel_alt_to_SN_rel : \"SN_rel_alt R S \\ SN_rel R S\"\nproof (unfold SN_rel_on_def)\n assume SN: \"SN_rel_alt R S\"\n show \"SN (relto R S)\"\n proof\n fix f\n assume \"chain (relto R S) f\"\n hence steps: \"\\i. (f i, f (Suc i)) \\ S^* O R O S^*\" by auto\n let ?prop = \"\\ i ai bi. (f i, bi) \\ S^* \\ (bi, ai) \\ R \\ (ai, f (Suc (i))) \\ S^*\"\n {\n fix i\n from steps obtain bi ai where \"?prop i ai bi\" by blast\n hence \"\\ ai bi. ?prop i ai bi\" by blast\n }\n hence \"\\ i. \\ bi ai. ?prop i ai bi\" by blast\n from choice[OF this] obtain b where \"\\ i. \\ ai. ?prop i ai (b i)\" by blast\n from choice[OF this] obtain a where steps: \"\\ i. ?prop i (a i) (b i)\" by blast\n let ?prop = \"\\ i li. (b i, a i) \\ R \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S) \\ last (a i # li) = b (Suc i)\"\n {\n fix i\n from steps[of i] steps[of \"Suc i\"] have \"(a i, f (Suc i)) \\ S^*\" and \"(f (Suc i), b (Suc i)) \\ S^*\" by auto\n from rtrancl_trans[OF this] steps[of i] have R: \"(b i, a i) \\ R\" and S: \"(a i, b (Suc i)) \\ S^*\" by blast+\n from S[unfolded rtrancl_list_conv] obtain li where \"last (a i # li) = b (Suc i) \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S)\" ..\n with R have \"?prop i li\" by blast\n hence \"\\ li. ?prop i li\" ..\n }\n hence \"\\ i. \\ li. ?prop i li\" ..\n from choice[OF this] obtain l where steps: \"\\ i. ?prop i (l i)\" by auto\n let ?p = \"\\ i. ?prop i (l i)\"\n from steps have steps: \"\\ i. ?p i\" by blast\n let ?l = \"\\ i. a i # l i\" \n let ?l' = \"\\ i. length (?l i)\"\n let ?g = \"\\ i. inf_concat_simple ?l' i\"\n obtain g where g: \"\\ i. g i = (let (ii,jj) = ?g i in ?l ii ! jj)\" by auto \n have len: \"\\ i j n. ?g n = (i,j) \\ j < length (?l i)\"\n proof -\n fix i j n\n assume n: \"?g n = (i,j)\"\n show \"j < length (?l i)\" \n proof (cases n)\n case 0\n with n have \"j = 0\" by auto\n thus ?thesis by simp\n next\n case (Suc nn)\n obtain ii jj where nn: \"?g nn = (ii,jj)\" by (cases \"?g nn\", auto)\n show ?thesis \n proof (cases \"Suc jj < length (?l ii)\")\n case True\n with nn Suc have \"?g n = (ii, Suc jj)\" by auto\n with n True show ?thesis by simp\n next\n case False \n with nn Suc have \"?g n = (Suc ii, 0)\" by auto\n with n show ?thesis by simp\n qed\n qed\n qed \n have gsteps: \"\\ i. (g i, g (Suc i)) \\ R \\ S\"\n proof -\n fix n\n obtain i j where n: \"?g n = (i, j)\" by (cases \"?g n\", auto)\n show \"(g n, g (Suc n)) \\ R \\ S\"\n proof (cases \"Suc j < length (?l i)\")\n case True\n with n have \"?g (Suc n) = (i, Suc j)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = ?l i ! (Suc j)\" unfolding g by auto\n thus ?thesis using steps[of i] True by auto\n next\n case False\n with n have \"?g (Suc n) = (Suc i, 0)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = a (Suc i)\" unfolding g by auto\n from gn len[OF n] False have \"j = length (?l i) - 1\" by auto\n with gn have gn: \"g n = last (?l i)\" using last_conv_nth[of \"?l i\"] by auto\n from gn gsn show ?thesis using steps[of i] steps[of \"Suc i\"] by auto\n qed\n qed\n have infR: \"INFM j. (g j, g (Suc j)) \\ R\" unfolding INFM_nat_le\n proof\n fix n\n obtain i j where n: \"?g n = (i,j)\" by (cases \"?g n\", auto)\n from len[OF n] have j: \"j < ?l' i\" .\n let ?k = \"?l' i - 1 - j\"\n obtain k where k: \"k = j + ?k\" by auto\n from j k have k2: \"k = ?l' i - 1\" and k3: \"j + ?k < ?l' i\" by auto\n from inf_concat_simple_add[OF n, of ?k, OF k3] \n have gnk: \"?g (n + ?k) = (i, k)\" by (simp only: k)\n hence \"g (n + ?k) = ?l i ! k\" unfolding g by auto\n hence gnk2: \"g (n + ?k) = last (?l i)\" using last_conv_nth[of \"?l i\"] k2 by auto\n from k2 gnk have \"?g (Suc (n+?k)) = (Suc i, 0)\" by auto\n hence gnsk2: \"g (Suc (n+?k)) = a (Suc i)\" unfolding g by auto\n from steps[of i] steps[of \"Suc i\"] have main: \"(g (n+?k), g (Suc (n+?k))) \\ R\" \n by (simp only: gnk2 gnsk2)\n show \"\\ j \\ n. (g j, g (Suc j)) \\ R\" \n by (rule exI[of _ \"n + ?k\"], auto simp: main[simplified])\n qed\n from SN[unfolded SN_rel_on_alt_def] gsteps infR show False by blast\n qed\nqed\n\nlemma SN_rel_alt_r_empty : \"SN_rel_alt {} S\"\n unfolding SN_rel_defs by auto\n\nlemma SN_rel_alt_s_empty : \"SN_rel_alt R {} = SN R\"\n unfolding SN_rel_defs SN_defs by auto\n\nlemma SN_rel_mono':\n \"R \\ R' \\ S \\ R' \\ S' \\ SN_rel R' S' \\ SN_rel R S\"\n unfolding SN_rel_on_conv SN_rel_defs INFM_nat_le by fast\n\nlemma SN_rel_mono:\n assumes R: \"R \\ R'\" and S: \"S \\ S'\" and SN: \"SN_rel R' S'\"\n shows \"SN_rel R S\"\n using SN unfolding SN_rel_defs using SN_subset[OF _ relto_mono[OF R S]] by blast\n\nlemmas SN_rel_alt_mono = SN_rel_mono[unfolded SN_rel_on_conv]\n\nlemma SN_rel_imp_SN : assumes \"SN_rel R S\" shows \"SN R\"\nproof\n fix f\n assume \"\\ i. (f i, f (Suc i)) \\ R\"\n hence \"\\ i. (f i, f (Suc i)) \\ relto R S\" by blast \n thus False using assms unfolding SN_rel_defs SN_defs by fast\nqed\n\nlemma relto_trancl_conv : \"(relto R S)^+ = ((R \\ S))^* O R O ((R \\ S))^*\" by regexp\n\nlemma SN_rel_Id:\n shows \"SN_rel R (S \\ Id) = SN_rel R S\"\n unfolding SN_rel_defs by (simp only: relto_Id)\n\nlemma relto_rtrancl: \"relto R (S^*) = relto R S\" by regexp\n\nlemma SN_rel_empty[simp]: \"SN_rel R {} = SN R\"\n unfolding SN_rel_defs by auto\n\nlemma SN_rel_ideriv: \"SN_rel R S = (\\ (\\ as. ideriv R S as))\" (is \"?L = ?R\")\nproof\n assume ?L\n show ?R\n proof\n assume \"\\ as. ideriv R S as\"\n then obtain as where id: \"ideriv R S as\" by auto\n note id = id[unfolded ideriv_def]\n from `?L`[unfolded SN_rel_on_conv SN_rel_defs, THEN spec[of _ as]]\n id obtain i where i: \"\\ j. j \\ i \\ (as j, as (Suc j)) \\ R\" by auto\n with id[unfolded INFM_nat, THEN conjunct2, THEN spec[of _ \"Suc i\"]] show False by auto\n qed\nnext\n assume ?R\n show ?L\n unfolding SN_rel_on_conv SN_rel_defs\n proof (intro allI impI)\n fix as\n presume \"chain (R \\ S) as\"\n with `?R`[unfolded ideriv_def] have \"\\ (INFM i. (as i, as (Suc i)) \\ R)\" by auto\n from this[unfolded INFM_nat] obtain i where i: \"\\ j. i < j \\ (as j, as (Suc j)) \\ R\" by auto\n show \"\\ (INFM j. (as j, as (Suc j)) \\ R)\" unfolding INFM_nat using i by blast\n qed simp\nqed\n\nlemma SN_rel_map:\n fixes R Rw R' Rw' :: \"'a rel\" \n defines A: \"A \\ R' \\ Rw'\"\n assumes SN: \"SN_rel R' Rw'\" \n and R: \"\\s t. (s,t) \\ R \\ (f s, f t) \\ A^* O R' O A^*\"\n and Rw: \"\\s t. (s,t) \\ Rw \\ (f s, f t) \\ A^*\"\n shows \"SN_rel R Rw\"\n unfolding SN_rel_defs\nproof\n fix g\n assume steps: \"chain (relto R Rw) g\"\n let ?f = \"\\i. (f (g i))\"\n obtain h where h: \"h = ?f\" by auto\n {\n fix i\n let ?m = \"\\ (x,y). (f x, f y)\"\n {\n fix s t\n assume \"(s,t) \\ Rw^*\"\n hence \"?m (s,t) \\ A^*\"\n proof (induct)\n case base show ?case by simp\n next\n case (step t u)\n from Rw[OF step(2)] step(3)\n show ?case by auto\n qed\n } note Rw = this\n from steps have \"(g i, g (Suc i)) \\ relto R Rw\" ..\n from this\n obtain s t where gs: \"(g i,s) \\ Rw^*\" and st: \"(s,t) \\ R\" and tg: \"(t, g (Suc i)) \\ Rw^*\" by auto\n from Rw[OF gs] R[OF st] Rw[OF tg]\n have step: \"(?f i, ?f (Suc i)) \\ A^* O (A^* O R' O A^*) O A^*\"\n by auto\n have \"(?f i, ?f (Suc i)) \\ A^* O R' O A^*\"\n by (rule set_mp[OF _ step], regexp)\n hence \"(h i, h (Suc i)) \\ (relto R' Rw')^+\"\n unfolding A h relto_trancl_conv .\n }\n hence \"\\ SN ((relto R' Rw')^+)\" by auto\n with SN_imp_SN_trancl[OF SN[unfolded SN_rel_on_def]]\n show False by simp\nqed\n\ndatatype SN_rel_ext_type = top_s | top_ns | normal_s | normal_ns\n\nfun SN_rel_ext_step :: \"'a rel \\ 'a rel \\ 'a rel \\ 'a rel \\ SN_rel_ext_type \\ 'a rel\" where\n \"SN_rel_ext_step P Pw R Rw top_s = P\"\n| \"SN_rel_ext_step P Pw R Rw top_ns = Pw\"\n| \"SN_rel_ext_step P Pw R Rw normal_s = R\"\n| \"SN_rel_ext_step P Pw R Rw normal_ns = Rw\"\n\n(* relative termination with four relations as required in DP-framework *)\ndefinition SN_rel_ext :: \"'a rel \\ 'a rel \\ 'a rel \\ 'a rel \\ ('a \\ bool) \\ bool\" where\n \"SN_rel_ext P Pw R Rw M \\ (\\ (\\f t. \n (\\ i. (f i, f (Suc i)) \\ SN_rel_ext_step P Pw R Rw (t i))\n \\ (\\ i. M (f i))\n \\ (INFM i. t i \\ {top_s,top_ns})\n \\ (INFM i. t i \\ {top_s,normal_s})))\"\n\nlemma SN_rel_ext_trans:\n fixes P Pw R Rw :: \"'a rel\" and M :: \"'a \\ bool\"\n defines M': \"M' \\ {(s,t). M t}\"\n defines A: \"A \\ (P \\ Pw \\ R \\ Rw) \\ M'\"\n assumes \"SN_rel_ext P Pw R Rw M\" \n shows \"SN_rel_ext (A^* O (P \\ M') O A^*) (A^* O ((P \\ Pw) \\ M') O A^*) (A^* O ((P \\ R) \\ M') O A^*) (A^*) M\" (is \"SN_rel_ext ?P ?Pw ?R ?Rw M\")\nproof (rule ccontr)\n let ?relt = \"SN_rel_ext_step ?P ?Pw ?R ?Rw\"\n let ?rel = \"SN_rel_ext_step P Pw R Rw\" \n assume \"\\ ?thesis\"\n from this[unfolded SN_rel_ext_def]\n obtain f ty\n where steps: \"\\ i. (f i, f (Suc i)) \\ ?relt (ty i)\" \n and min: \"\\ i. M (f i)\"\n and inf1: \"INFM i. ty i \\ {top_s, top_ns}\"\n and inf2: \"INFM i. ty i \\ {top_s, normal_s}\"\n by auto\n let ?Un = \"\\ tt. \\ (?rel ` tt)\"\n let ?UnM = \"\\ tt. (\\ (?rel ` tt)) \\ M'\"\n let ?A = \"?UnM {top_s,top_ns,normal_s,normal_ns}\"\n let ?P' = \"?UnM {top_s}\"\n let ?Pw' = \"?UnM {top_s,top_ns}\"\n let ?R' = \"?UnM {top_s,normal_s}\"\n let ?Rw' = \"?UnM {top_s,top_ns,normal_s,normal_ns}\"\n have A: \"A = ?A\" unfolding A by auto\n have P: \"(P \\ M') = ?P'\" by auto\n have Pw: \"(P \\ Pw) \\ M' = ?Pw'\" by auto\n have R: \"(P \\ R) \\ M' = ?R'\" by auto\n have Rw: \"A = ?Rw'\" unfolding A ..\n {\n fix s t tt\n assume m: \"M s\" and st: \"(s,t) \\ ?UnM tt\"\n hence \"\\ typ \\ tt. (s,t) \\ ?rel typ \\ M s \\ M t\" unfolding M' by auto\n } note one_step = this\n let ?seq = \"\\ s t g n ty. s = g 0 \\ t = g n \\ (\\ i < n. (g i, g (Suc i)) \\ ?rel (ty i)) \\ (\\ i \\ n. M (g i))\"\n {\n fix s t\n assume m: \"M s\" and st: \"(s,t) \\ A^*\"\n from st[unfolded rtrancl_fun_conv]\n obtain g n where g0: \"g 0 = s\" and gn: \"g n = t\" and steps: \"\\ i. i < n \\ (g i, g (Suc i)) \\ ?A\" unfolding A by auto\n {\n fix i\n assume \"i \\ n\"\n have \"M (g i)\"\n proof (cases i)\n case 0\n show ?thesis unfolding 0 g0 by (rule m)\n next\n case (Suc j)\n with `i \\ n` have \"j < n\" by auto\n from steps[OF this] show ?thesis unfolding Suc M' by auto\n qed\n } note min = this\n {\n fix i\n assume i: \"i < n\" hence i': \"i \\ n\" by auto\n from i' one_step[OF min steps[OF i]]\n have \"\\ ty. (g i, g (Suc i)) \\ ?rel ty\" by blast\n }\n hence \"\\ i. (\\ ty. i < n \\ (g i, g (Suc i)) \\ ?rel ty)\" by auto\n from choice[OF this]\n obtain tt where steps: \"\\ i. i < n \\ (g i, g (Suc i)) \\ ?rel (tt i)\" by auto\n from g0 gn steps min\n have \"?seq s t g n tt\" by auto\n hence \"\\ g n tt. ?seq s t g n tt\" by blast\n } note A_steps = this\n let ?seqtt = \"\\ s t tt g n ty. s = g 0 \\ t = g n \\ n > 0 \\ (\\ i ?rel (ty i)) \\ (\\ i \\ n. M (g i)) \\ (\\ i < n. ty i \\ tt)\"\n {\n fix s t tt\n assume m: \"M s\" and st: \"(s,t) \\ A^* O ?UnM tt O A^*\"\n then obtain u v where su: \"(s,u) \\ A^*\" and uv: \"(u,v) \\ ?UnM tt\" and vt: \"(v,t) \\ A^*\"\n by auto\n from A_steps[OF m su] obtain g1 n1 ty1 where seq1: \"?seq s u g1 n1 ty1\" by auto\n from uv have \"M v\" unfolding M' by auto\n from A_steps[OF this vt] obtain g2 n2 ty2 where seq2: \"?seq v t g2 n2 ty2\" by auto\n from seq1 have \"M u\" by auto\n from one_step[OF this uv] obtain ty where ty: \"ty \\ tt\" and uv: \"(u,v) \\ ?rel ty\" by auto\n let ?g = \"\\ i. if i \\ n1 then g1 i else g2 (i - (Suc n1))\"\n let ?ty = \"\\ i. if i < n1 then ty1 i else if i = n1 then ty else ty2 (i - (Suc n1))\"\n let ?n = \"Suc (n1 + n2)\"\n have ex: \"\\ i < ?n. ?ty i \\ tt\"\n by (rule exI[of _ n1], simp add: ty)\n have steps: \"\\ i < ?n. (?g i, ?g (Suc i)) \\ ?rel (?ty i)\"\n proof (intro allI impI)\n fix i\n assume \"i < ?n\"\n show \"(?g i, ?g (Suc i)) \\ ?rel (?ty i)\"\n proof (cases \"i \\ n1\")\n case True\n with seq1 seq2 uv show ?thesis by auto\n next\n case False\n hence \"i = Suc n1 + (i - Suc n1)\" by auto\n then obtain k where i: \"i = Suc n1 + k\" by auto\n with `i < ?n` have \"k < n2\" by auto\n thus ?thesis using seq2 unfolding i by auto\n qed\n qed\n from steps seq1 seq2 ex \n have seq: \"?seqtt s t tt ?g ?n ?ty\" by auto\n have \"\\ g n ty. ?seqtt s t tt g n ty\" \n by (intro exI, rule seq)\n } note A_tt_A = this\n let ?tycon = \"\\ ty1 ty2 tt ty' n. ty1 = ty2 \\ (\\i < n. ty' i \\ tt)\"\n let ?seqt = \"\\ i ty g n ty'. f i = g 0 \\ f (Suc i) = g n \\ (\\ j < n. (g j, g (Suc j)) \\ ?rel (ty' j)) \\ (\\ j \\ n. M (g j)) \n \\ (?tycon (ty i) top_s {top_s} ty' n)\n \\ (?tycon (ty i) top_ns {top_s,top_ns} ty' n)\n \\ (?tycon (ty i) normal_s {top_s,normal_s} ty' n)\"\n {\n fix i\n have \"\\ g n ty'. ?seqt i ty g n ty'\"\n proof (cases \"ty i\")\n case top_s\n from steps[of i, unfolded top_s] \n have \"(f i, f (Suc i)) \\ ?P\" by auto\n from A_tt_A[OF min this[unfolded P]]\n show ?thesis unfolding top_s by auto\n next\n case top_ns\n from steps[of i, unfolded top_ns] \n have \"(f i, f (Suc i)) \\ ?Pw\" by auto\n from A_tt_A[OF min this[unfolded Pw]]\n show ?thesis unfolding top_ns by auto\n next\n case normal_s\n from steps[of i, unfolded normal_s] \n have \"(f i, f (Suc i)) \\ ?R\" by auto\n from A_tt_A[OF min this[unfolded R]]\n show ?thesis unfolding normal_s by auto\n next\n case normal_ns\n from steps[of i, unfolded normal_ns] \n have \"(f i, f (Suc i)) \\ ?Rw\" by auto\n from A_steps[OF min this]\n show ?thesis unfolding normal_ns by auto\n qed\n }\n hence \"\\ i. \\ g n ty'. ?seqt i ty g n ty'\" by auto\n from choice[OF this] obtain g where \"\\ i. \\ n ty'. ?seqt i ty (g i) n ty'\" by auto\n from choice[OF this] obtain n where \"\\ i. \\ ty'. ?seqt i ty (g i) (n i) ty'\" by auto\n from choice[OF this] obtain ty' where \"\\ i. ?seqt i ty (g i) (n i) (ty' i)\" by auto\n hence partial: \"\\ i. ?seqt i ty (g i) (n i) (ty' i)\" ..\n (* it remains to concatenate all these finite sequences to an infinite one *)\n let ?ind = \"inf_concat n\"\n let ?g = \"\\ k. (\\ (i,j). g i j) (?ind k)\"\n let ?ty = \"\\ k. (\\ (i,j). ty' i j) (?ind k)\"\n have inf: \"INFM i. 0 < n i\"\n unfolding INFM_nat_le\n proof (intro allI)\n fix m\n from inf1[unfolded INFM_nat_le]\n obtain k where k: \"k \\ m\" and ty: \"ty k \\ {top_s, top_ns}\" by auto\n show \"\\ k \\ m. 0 < n k\"\n proof (intro exI conjI, rule k)\n from partial[of k] ty show \"0 < n k\" by (cases \"n k\", auto)\n qed\n qed\n note bounds = inf_concat_bounds[OF inf]\n note inf_Suc = inf_concat_Suc[OF inf]\n note inf_mono = inf_concat_mono[OF inf]\n have \"\\ SN_rel_ext P Pw R Rw M\"\n unfolding SN_rel_ext_def simp_thms\n proof (rule exI[of _ ?g], rule exI[of _ ?ty], intro conjI allI)\n fix k\n obtain i j where ik: \"?ind k = (i,j)\" by force\n from bounds[OF this] have j: \"j < n i\" by auto\n show \"M (?g k)\" unfolding ik using partial[of i] j by auto\n next\n fix k\n obtain i j where ik: \"?ind k = (i,j)\" by force\n from bounds[OF this] have j: \"j < n i\" by auto\n from partial[of i] j have step: \"(g i j, g i (Suc j)) \\ ?rel (ty' i j)\" by auto\n obtain i' j' where isk: \"?ind (Suc k) = (i',j')\" by force\n have i'j': \"g i' j' = g i (Suc j)\"\n proof (rule inf_Suc[OF _ ik isk])\n fix i\n from partial[of i]\n have \"g i (n i) = f (Suc i)\" by simp\n also have \"... = g (Suc i) 0\" using partial[of \"Suc i\"] by simp\n finally show \"g i (n i) = g (Suc i) 0\" .\n qed\n show \"(?g k, ?g (Suc k)) \\ ?rel (?ty k)\"\n unfolding ik isk split i'j'\n by (rule step)\n next\n show \"INFM i. ?ty i \\ {top_s, top_ns}\"\n unfolding INFM_nat_le\n proof (intro allI)\n fix k\n obtain i j where ik: \"?ind k = (i,j)\" by force \n from inf1[unfolded INFM_nat] obtain i' where i': \"i' > i\" and ty: \"ty i' \\ {top_s, top_ns}\" by auto\n from partial[of i'] ty obtain j' where j': \"j' < n i'\" and ty': \"ty' i' j' \\ {top_s, top_ns}\" by auto \n from inf_concat_surj[of _ n, OF j'] obtain k' where ik': \"?ind k' = (i',j')\" .. \n from inf_mono[OF ik ik' i'] have k: \"k \\ k'\" by simp\n show \"\\ k' \\ k. ?ty k' \\ {top_s, top_ns}\"\n by (intro exI conjI, rule k, unfold ik' split, rule ty')\n qed\n next\n show \"INFM i. ?ty i \\ {top_s, normal_s}\"\n unfolding INFM_nat_le\n proof (intro allI)\n fix k\n obtain i j where ik: \"?ind k = (i,j)\" by force \n from inf2[unfolded INFM_nat] obtain i' where i': \"i' > i\" and ty: \"ty i' \\ {top_s, normal_s}\" by auto\n from partial[of i'] ty obtain j' where j': \"j' < n i'\" and ty': \"ty' i' j' \\ {top_s, normal_s}\" by auto\n from inf_concat_surj[of _ n, OF j'] obtain k' where ik': \"?ind k' = (i',j')\" ..\n from inf_mono[OF ik ik' i'] have k: \"k \\ k'\" by simp\n show \"\\ k' \\ k. ?ty k' \\ {top_s, normal_s}\"\n by (intro exI conjI, rule k, unfold ik' split, rule ty')\n qed\n qed\n with assms show False by auto\nqed\n\n\nlemma SN_rel_ext_map: fixes P Pw R Rw P' Pw' R' Rw' :: \"'a rel\" and M M' :: \"'a \\ bool\"\n defines Ms: \"Ms \\ {(s,t). M' t}\"\n defines A: \"A \\ (P' \\ Pw' \\ R' \\ Rw') \\ Ms\"\n assumes SN: \"SN_rel_ext P' Pw' R' Rw' M'\" \n and P: \"\\ s t. M s \\ M t \\ (s,t) \\ P \\ (f s, f t) \\ (A^* O (P' \\ Ms) O A^*) \\ I t\"\n and Pw: \"\\ s t. M s \\ M t \\ (s,t) \\ Pw \\ (f s, f t) \\ (A^* O ((P' \\ Pw') \\ Ms) O A^*) \\ I t\"\n and R: \"\\ s t. I s \\ M s \\ M t \\ (s,t) \\ R \\ (f s, f t) \\ (A^* O ((P' \\ R') \\ Ms) O A^*) \\ I t\"\n and Rw: \"\\ s t. I s \\ M s \\ M t \\ (s,t) \\ Rw \\ (f s, f t) \\ A^* \\ I t\"\n shows \"SN_rel_ext P Pw R Rw M\" \nproof -\n note SN = SN_rel_ext_trans[OF SN]\n let ?P = \"(A^* O (P' \\ Ms) O A^*)\"\n let ?Pw = \"(A^* O ((P' \\ Pw') \\ Ms) O A^*)\"\n let ?R = \"(A^* O ((P' \\ R') \\ Ms) O A^*)\"\n let ?Rw = \"A^*\"\n let ?relt = \"SN_rel_ext_step ?P ?Pw ?R ?Rw\"\n let ?rel = \"SN_rel_ext_step P Pw R Rw\" \n show ?thesis \n proof (rule ccontr)\n assume \"\\ ?thesis\"\n from this[unfolded SN_rel_ext_def]\n obtain g ty\n where steps: \"\\ i. (g i, g (Suc i)) \\ ?rel (ty i)\" \n and min: \"\\ i. M (g i)\"\n and inf1: \"INFM i. ty i \\ {top_s, top_ns}\"\n and inf2: \"INFM i. ty i \\ {top_s, normal_s}\"\n by auto\n from inf1[unfolded INFM_nat] obtain k where k: \"ty k \\ {top_s, top_ns}\" by auto\n let ?k = \"Suc k\"\n let ?i = \"shift id ?k\"\n let ?f = \"\\ i. f (shift g ?k i)\"\n let ?ty = \"shift ty ?k\"\n {\n fix i\n assume ty: \"ty i \\ {top_s,top_ns}\"\n note m = min[of i] \n note ms = min[of \"Suc i\"]\n from P[OF m ms]\n Pw[OF m ms]\n steps[of i]\n ty\n have \"(f (g i), f (g (Suc i))) \\ ?relt (ty i) \\ I (g (Suc i))\"\n by (cases \"ty i\", auto)\n } note stepsP = this\n {\n fix i\n assume I: \"I (g i)\"\n note m = min[of i] \n note ms = min[of \"Suc i\"]\n from P[OF m ms]\n Pw[OF m ms]\n R[OF I m ms]\n Rw[OF I m ms]\n steps[of i]\n have \"(f (g i), f (g (Suc i))) \\ ?relt (ty i) \\ I (g (Suc i))\"\n by (cases \"ty i\", auto)\n } note stepsI = this\n {\n fix i\n have \"I (g (?i i))\"\n proof (induct i)\n case 0\n show ?case using stepsP[OF k] by simp\n next\n case (Suc i)\n from stepsI[OF Suc] show ?case by simp\n qed\n } note I = this\n have \"\\ SN_rel_ext ?P ?Pw ?R ?Rw M'\"\n unfolding SN_rel_ext_def simp_thms\n proof (rule exI[of _ ?f], rule exI[of _ ?ty], intro allI conjI)\n fix i\n show \"(?f i, ?f (Suc i)) \\ ?relt (?ty i)\"\n using stepsI[OF I[of i]] by auto\n next\n show \"INFM i. ?ty i \\ {top_s, top_ns}\"\n unfolding Infm_shift[of \"\\i. i \\ {top_s,top_ns}\" ty ?k]\n by (rule inf1)\n next\n show \"INFM i. ?ty i \\ {top_s, normal_s}\"\n unfolding Infm_shift[of \"\\i. i \\ {top_s,normal_s}\" ty ?k]\n by (rule inf2)\n next\n fix i\n have A: \"A \\ Ms\" unfolding A by auto\n from rtrancl_mono[OF this] have As: \"A^* \\ Ms^*\" by auto\n have PM: \"?P \\ Ms^* O Ms O Ms^*\" using As by auto\n have PwM: \"?Pw \\ Ms^* O Ms O Ms^*\" using As by auto\n have RM: \"?R \\ Ms^* O Ms O Ms^*\" using As by auto\n have RwM: \"?Rw \\ Ms^*\" using As by auto\n from PM PwM RM have \"?P \\ ?Pw \\ ?R \\ Ms^* O Ms O Ms^*\" (is \"?PPR \\ _\") by auto\n also have \"... \\ Ms^+\" by regexp\n also have \"... = Ms\"\n proof\n have \"Ms^+ \\ Ms^* O Ms\" by regexp\n also have \"... \\ Ms\" unfolding Ms by auto\n finally show \"Ms^+ \\ Ms\" .\n qed regexp\n finally have PPR: \"?PPR \\ Ms\" .\n show \"M' (?f i)\"\n proof (induct i)\n case 0\n from stepsP[OF k] k\n have \"(f (g k), f (g (Suc k))) \\ ?PPR\" by (cases \"ty k\", auto)\n with PPR show ?case unfolding Ms by simp blast\n next\n case (Suc i)\n show ?case\n proof (cases \"?ty i = normal_ns\")\n case False\n hence \"?ty i \\ {top_s,top_ns,normal_s}\"\n by (cases \"?ty i\", auto)\n with stepsI[OF I[of i]] have \"(?f i, ?f (Suc i)) \\ ?PPR\"\n by auto\n from set_mp[OF PPR this] have \"(?f i, ?f (Suc i)) \\ Ms\" .\n thus ?thesis unfolding Ms by auto\n next\n case True\n with stepsI[OF I[of i]] have \"(?f i, ?f (Suc i)) \\ ?Rw\" by auto\n with RwM have mem: \"(?f i, ?f (Suc i)) \\ Ms^*\" by auto\n thus ?thesis\n proof (cases)\n case base\n with Suc show ?thesis by simp\n next\n case step\n thus ?thesis unfolding Ms by simp\n qed\n qed\n qed\n qed\n with SN\n show False unfolding A Ms by simp\n qed\nqed\n\n(* and a version where it is assumed that f always preserves M and that R' and Rw' preserve M' *)\nlemma SN_rel_ext_map_min: fixes P Pw R Rw P' Pw' R' Rw' :: \"'a rel\" and M M' :: \"'a \\ bool\"\n defines Ms: \"Ms \\ {(s,t). M' t}\"\n defines A: \"A \\ P' \\ Ms \\ Pw' \\ Ms \\ R' \\ Rw'\"\n assumes SN: \"SN_rel_ext P' Pw' R' Rw' M'\" \n and M: \"\\ t. M t \\ M' (f t)\"\n and M': \"\\ s t. M' s \\ (s,t) \\ R' \\ Rw' \\ M' t\"\n and P: \"\\ s t. M s \\ M t \\ M' (f s) \\ M' (f t) \\ (s,t) \\ P \\ (f s, f t) \\ (A^* O (P' \\ Ms) O A^*) \\ I t\"\n and Pw: \"\\ s t. M s \\ M t \\ M' (f s) \\ M' (f t) \\ (s,t) \\ Pw \\ (f s, f t) \\ (A^* O (P' \\ Ms \\ Pw' \\ Ms) O A^*) \\ I t\"\n and R: \"\\ s t. I s \\ M s \\ M t \\ M' (f s) \\ M' (f t) \\ (s,t) \\ R \\ (f s, f t) \\ (A^* O (P' \\ Ms \\ R') O A^*) \\ I t\"\n and Rw: \"\\ s t. I s \\ M s \\ M t \\ M' (f s) \\ M' (f t) \\ (s,t) \\ Rw \\ (f s, f t) \\ A^* \\ I t\"\n shows \"SN_rel_ext P Pw R Rw M\" \nproof -\n let ?Ms = \"{(s,t). M' t}\"\n let ?A = \"(P' \\ Pw' \\ R' \\ Rw') \\ ?Ms\"\n {\n fix s t\n assume s: \"M' s\" and \"(s,t) \\ A\" \n with M'[OF s, of t] have \"(s,t) \\ ?A \\ M' t\" unfolding Ms A by auto\n } note Aone = this\n {\n fix s t\n assume s: \"M' s\" and steps: \"(s,t) \\ A^*\"\n from steps have \"(s,t) \\ ?A^* \\ M' t\"\n proof (induct)\n case base from s show ?case by simp\n next\n case (step t u)\n note one = Aone[OF step(3)[THEN conjunct2] step(2)] \n from step(3) one\n have steps: \"(s,u) \\ ?A^* O ?A\" by blast \n have \"(s,u) \\ ?A^*\" \n by (rule set_mp[OF _ steps], regexp)\n with one show ?case by simp\n qed\n } note Amany = this \n let ?P = \"(A^* O (P' \\ Ms) O A^*)\"\n let ?Pw = \"(A^* O (P' \\ Ms \\ Pw' \\ Ms) O A^*)\"\n let ?R = \"(A^* O (P' \\ Ms \\ R') O A^*)\"\n let ?Rw = \"A^*\"\n let ?P' = \"(?A^* O (P' \\ ?Ms) O ?A^*)\"\n let ?Pw' = \"(?A^* O ((P' \\ Pw') \\ ?Ms) O ?A^*)\"\n let ?R' = \"(?A^* O ((P' \\ R') \\ ?Ms) O ?A^*)\"\n let ?Rw' = \"?A^*\"\n show ?thesis \n proof (rule SN_rel_ext_map[OF SN])\n fix s t\n assume s: \"M s\" and t: \"M t\" and step: \"(s,t) \\ P\"\n from P[OF s t M[OF s] M[OF t] step]\n have \"(f s, f t) \\ ?P\" and I: \"I t\" by auto\n then obtain u v where su: \"(f s, u) \\ A^*\" and uv: \"(u,v) \\ P' \\ Ms\"\n and vt: \"(v,f t) \\ A^*\" by auto\n from Amany[OF M[OF s] su] have su: \"(f s, u) \\ ?A^*\" and u: \"M' u\" by auto\n from uv have v: \"M' v\" unfolding Ms by auto\n from Amany[OF v vt] have vt: \"(v, f t) \\ ?A^*\" by auto\n from su uv vt I \n show \"(f s, f t) \\ ?P' \\ I t\" unfolding Ms by auto\n next\n fix s t\n assume s: \"M s\" and t: \"M t\" and step: \"(s,t) \\ Pw\"\n from Pw[OF s t M[OF s] M[OF t] step]\n have \"(f s, f t) \\ ?Pw\" and I: \"I t\" by auto\n then obtain u v where su: \"(f s, u) \\ A^*\" and uv: \"(u,v) \\ P' \\ Ms \\ Pw' \\ Ms\"\n and vt: \"(v,f t) \\ A^*\" by auto\n from Amany[OF M[OF s] su] have su: \"(f s, u) \\ ?A^*\" and u: \"M' u\" by auto\n from uv have uv: \"(u,v) \\ (P' \\ Pw') \\ ?Ms\" and v: \"M' v\" unfolding Ms \n by auto\n from Amany[OF v vt] have vt: \"(v, f t) \\ ?A^*\" by auto\n from su uv vt I \n show \"(f s, f t) \\ ?Pw' \\ I t\" by auto\n next\n fix s t\n assume I: \"I s\" and s: \"M s\" and t: \"M t\" and step: \"(s,t) \\ R\"\n from R[OF I s t M[OF s] M[OF t] step]\n have \"(f s, f t) \\ ?R\" and I: \"I t\" by auto\n then obtain u v where su: \"(f s, u) \\ A^*\" and uv: \"(u,v) \\ P' \\ Ms \\ R'\"\n and vt: \"(v,f t) \\ A^*\" by auto\n from Amany[OF M[OF s] su] have su: \"(f s, u) \\ ?A^*\" and u: \"M' u\" by auto\n from uv M'[OF u, of v] have uv: \"(u,v) \\ (P' \\ R') \\ ?Ms\" and v: \"M' v\" unfolding Ms \n by auto\n from Amany[OF v vt] have vt: \"(v, f t) \\ ?A^*\" by auto\n from su uv vt I \n show \"(f s, f t) \\ ?R' \\ I t\" by auto\n next\n fix s t\n assume I: \"I s\" and s: \"M s\" and t: \"M t\" and step: \"(s,t) \\ Rw\"\n from Rw[OF I s t M[OF s] M[OF t] step]\n have steps: \"(f s, f t) \\ ?Rw\" and I: \"I t\" by auto\n from Amany[OF M[OF s] steps] I\n show \"(f s, f t) \\ ?Rw' \\ I t\" by auto\n qed\nqed\n\n(*OLD PART*)\nlemma SN_relto_imp_SN_rel: \"SN (relto R S) \\ SN_rel R S\"\nproof -\n assume SN: \"SN (relto R S)\"\n show ?thesis\n proof (simp only: SN_rel_on_conv SN_rel_defs, intro allI impI)\n fix f\n presume steps: \"chain (R \\ S) f\"\n obtain r where r: \"\\ j. r j \\ (f j, f (Suc j)) \\ R\" by auto\n show \"\\ (INFM j. (f j, f (Suc j)) \\ R)\"\n proof (rule ccontr)\n assume \"\\ ?thesis\"\n hence ih: \"infinitely_many r\" unfolding infinitely_many_def r INFM_nat_le by blast\n obtain r_index where \"r_index = infinitely_many.index r\" by simp\n with infinitely_many.index_p[OF ih] infinitely_many.index_ordered[OF ih] infinitely_many.index_not_p_between[OF ih] \n have r_index: \"\\ i. r (r_index i) \\ r_index i < r_index (Suc i) \\ (\\ j. r_index i < j \\ j < r_index (Suc i) \\ \\ r j)\" by auto\n obtain g where g: \"\\ i. g i \\ f (r_index i)\" ..\n {\n fix i\n let ?ri = \"r_index i\"\n let ?rsi = \"r_index (Suc i)\"\n from r_index have isi: \"?ri < ?rsi\" by auto\n obtain ri rsi where ri: \"ri = ?ri\" and rsi: \"rsi = ?rsi\" by auto\n with r_index[of i] steps have inter: \"\\ j. ri < j \\ j < rsi \\ (f j, f (Suc j)) \\ S\" unfolding r by auto\n from ri isi rsi have risi: \"ri < rsi\" by simp \n {\n fix n\n assume \"Suc n \\ rsi - ri\"\n hence \"(f (Suc ri), f (Suc (n + ri))) \\ S^*\"\n proof (induct n, simp)\n case (Suc n)\n hence stepps: \"(f (Suc ri), f (Suc (n+ri))) \\ S^*\" by simp\n have \"(f (Suc (n+ri)), f (Suc (Suc n + ri))) \\ S\"\n using inter[of \"Suc n + ri\"] Suc(2) by auto\n with stepps show ?case by simp\n qed\n }\n from this[of \"rsi - ri - 1\"] risi have \n \"(f (Suc ri), f rsi) \\ S^*\" by simp\n with ri rsi have ssteps: \"(f (Suc ?ri), f ?rsi) \\ S^*\" by simp\n with r_index[of i] have \"(f ?ri, f ?rsi) \\ R O S^*\" unfolding r by auto\n hence \"(g i, g (Suc i)) \\ S^* O R O S^*\" using rtrancl_refl unfolding g by auto \n } \n hence \"\\ SN (S^* O R O S^*)\" unfolding SN_defs by blast\n with SN show False by simp\n qed\n qed simp\nqed\n\n(*FIXME: move*)\n\n\nfun choice :: \"(nat \\ 'a list) \\ nat \\ (nat \\ nat)\" where\n \"choice f 0 = (0,0)\"\n| \"choice f (Suc n) = (let (i, j) = choice f n in \n if Suc j < length (f i) \n then (i, Suc j)\n else (Suc i, 0))\"\n \nlemma SN_rel_imp_SN_relto : \"SN_rel R S \\ SN (relto R S)\"\nproof -\n assume SN: \"SN_rel R S\"\n show \"SN (relto R S)\"\n proof\n fix f\n assume \"\\ i. (f i, f (Suc i)) \\ relto R S\"\n hence steps: \"\\ i. (f i, f (Suc i)) \\ S^* O R O S^*\" by auto\n let ?prop = \"\\ i ai bi. (f i, bi) \\ S^* \\ (bi, ai) \\ R \\ (ai, f (Suc (i))) \\ S^*\"\n {\n fix i\n from steps obtain bi ai where \"?prop i ai bi\" by blast\n hence \"\\ ai bi. ?prop i ai bi\" by blast\n }\n hence \"\\ i. \\ bi ai. ?prop i ai bi\" by blast\n from choice[OF this] obtain b where \"\\ i. \\ ai. ?prop i ai (b i)\" by blast\n from choice[OF this] obtain a where steps: \"\\ i. ?prop i (a i) (b i)\" by blast\n let ?prop = \"\\ i li. (b i, a i) \\ R \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S) \\ last (a i # li) = b (Suc i)\"\n {\n fix i\n from steps[of i] steps[of \"Suc i\"] have \"(a i, f (Suc i)) \\ S^*\" and \"(f (Suc i), b (Suc i)) \\ S^*\" by auto\n from rtrancl_trans[OF this] steps[of i] have R: \"(b i, a i) \\ R\" and S: \"(a i, b (Suc i)) \\ S^*\" by blast+\n from S[unfolded rtrancl_list_conv] obtain li where \"last (a i # li) = b (Suc i) \\ (\\ j < length li. ((a i # li) ! j, (a i # li) ! Suc j) \\ S)\" ..\n with R have \"?prop i li\" by blast\n hence \"\\ li. ?prop i li\" ..\n }\n hence \"\\ i. \\ li. ?prop i li\" ..\n from choice[OF this] obtain l where steps: \"\\ i. ?prop i (l i)\" by auto\n let ?p = \"\\ i. ?prop i (l i)\"\n from steps have steps: \"\\ i. ?p i\" by blast\n let ?l = \"\\ i. a i # l i\"\n let ?g = \"\\ i. choice (\\ j. ?l j) i\"\n obtain g where g: \"\\ i. g i = (let (ii,jj) = ?g i in ?l ii ! jj)\" by auto\n have len: \"\\ i j n. ?g n = (i,j) \\ j < length (?l i)\"\n proof -\n fix i j n\n assume n: \"?g n = (i,j)\"\n show \"j < length (?l i)\" \n proof (cases n)\n case 0\n with n have \"j = 0\" by auto\n thus ?thesis by simp\n next\n case (Suc nn)\n obtain ii jj where nn: \"?g nn = (ii,jj)\" by (cases \"?g nn\", auto)\n show ?thesis \n proof (cases \"Suc jj < length (?l ii)\")\n case True\n with nn Suc have \"?g n = (ii, Suc jj)\" by auto\n with n True show ?thesis by simp\n next\n case False \n with nn Suc have \"?g n = (Suc ii, 0)\" by auto\n with n show ?thesis by simp\n qed\n qed\n qed \n have gsteps: \"\\ i. (g i, g (Suc i)) \\ R \\ S\"\n proof -\n fix n\n obtain i j where n: \"?g n = (i, j)\" by (cases \"?g n\", auto)\n show \"(g n, g (Suc n)) \\ R \\ S\"\n proof (cases \"Suc j < length (?l i)\")\n case True\n with n have \"?g (Suc n) = (i, Suc j)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = ?l i ! (Suc j)\" unfolding g by auto\n thus ?thesis using steps[of i] True by auto\n next\n case False\n with n have \"?g (Suc n) = (Suc i, 0)\" by auto\n with n have gn: \"g n = ?l i ! j\" and gsn: \"g (Suc n) = a (Suc i)\" unfolding g by auto\n from gn len[OF n] False have \"j = length (?l i) - 1\" by auto\n with gn have gn: \"g n = last (?l i)\" using last_conv_nth[of \"?l i\"] by auto\n from gn gsn show ?thesis using steps[of i] steps[of \"Suc i\"] by auto\n qed\n qed\n have infR: \"\\ n. \\ j \\ n. (g j, g (Suc j)) \\ R\" \n proof\n fix n\n obtain i j where n: \"?g n = (i,j)\" by (cases \"?g n\", auto)\n from len[OF n] have j: \"j \\ length (?l i) - 1\" by simp\n let ?k = \"length (?l i) - 1 - j\"\n obtain k where k: \"k = j + ?k\" by auto\n from j k have k2: \"k = length (?l i) - 1\" and k3: \"j + ?k < length (?l i)\" by auto\n {\n fix n i j k l\n assume n: \"choice l n = (i,j)\" and \"j + k < length (l i)\"\n hence \"choice l (n + k) = (i, j + k)\"\n by (induct k arbitrary: j, simp, auto)\n }\n from this[OF n, of ?k, OF k3]\n have gnk: \"?g (n + ?k) = (i, k)\" by (simp only: k)\n hence \"g (n + ?k) = ?l i ! k\" unfolding g by auto\n hence gnk2: \"g (n + ?k) = last (?l i)\" using last_conv_nth[of \"?l i\"] k2 by auto\n from k2 gnk have \"?g (Suc (n+?k)) = (Suc i, 0)\" by auto\n hence gnsk2: \"g (Suc (n+?k)) = a (Suc i)\" unfolding g by auto\n from steps[of i] steps[of \"Suc i\"] have main: \"(g (n+?k), g (Suc (n+?k))) \\ R\" \n by (simp only: gnk2 gnsk2)\n show \"\\ j \\ n. (g j, g (Suc j)) \\ R\" \n by (rule exI[of _ \"n + ?k\"], auto simp: main[simplified])\n qed \n from SN[simplified SN_rel_on_conv SN_rel_defs] gsteps infR show False\n unfolding INFM_nat_le by fast\n qed\nqed\n\nhide_const choice\n\nlemma SN_relto_SN_rel_conv: \"SN (relto R S) = SN_rel R S\"\n by (blast intro: SN_relto_imp_SN_rel SN_rel_imp_SN_relto)\n\nlemma SN_rel_empty1: \"SN_rel {} S\"\n unfolding SN_rel_defs by auto\n\nlemma SN_rel_empty2: \"SN_rel R {} = SN R\"\n unfolding SN_rel_defs SN_defs by auto\n\nlemma SN_relto_mono:\n assumes R: \"R \\ R'\" and S: \"S \\ S'\"\n and SN: \"SN (relto R' S')\"\n shows \"SN (relto R S)\"\n using SN SN_subset[OF _ relto_mono[OF R S]] by blast\n\nlemma SN_relto_imp_SN:\n assumes \"SN (relto R S)\" shows \"SN R\"\nproof\n fix f\n assume \"\\i. (f i, f (Suc i)) \\ R\"\n hence \"\\i. (f i, f (Suc i)) \\ relto R S\" by blast\n thus False using assms unfolding SN_defs by force\nqed\n\nlemma SN_relto_Id:\n \"SN (relto R (S \\ Id)) = SN (relto R S)\"\n by (simp only: relto_Id)\n\n\ntext {*Termination inheritance by transitivity (see, e.g., Geser's thesis).*}\n\nlemma trans_subset_SN:\n assumes \"trans R\" and \"R \\ (r \\ s)\" and \"SN r\" and \"SN s\"\n shows \"SN R\"\nproof\n fix f :: \"nat \\ 'a\"\n assume \"f 0 \\ UNIV\"\n and chain: \"chain R f\"\n have *: \"\\i j. i < j \\ (f i, f j) \\ r \\ s\"\n using assms and chain_imp_trancl [OF chain] by auto\n let ?M = \"{i. \\j>i. (f i, f j) \\ r}\"\n show False\n proof (cases \"finite ?M\")\n let ?n = \"Max ?M\"\n assume \"finite ?M\"\n with Max_ge have \"\\i\\?M. i \\ ?n\" by simp\n then have \"\\k\\Suc ?n. \\k'>k. (f k, f k') \\ r\" by auto\n with steps_imp_chainp [of \"Suc ?n\" \"\\x y. (x, y) \\ r\"] and assms\n show False by auto\n next\n assume \"infinite ?M\"\n then have \"INFM j. j \\ ?M\" by (simp add: Inf_many_def)\n then interpret infinitely_many \"\\i. i \\ ?M\" by (unfold_locales) assumption\n def [simp]: g \\ \"index\"\n have \"\\i. (f (g i), f (g (Suc i))) \\ s\"\n proof\n fix i\n have less: \"g i < g (Suc i)\" using index_ordered_less [of i \"Suc i\"] by simp\n have \"g i \\ ?M\" using index_p by simp\n then have \"(f (g i), f (g (Suc i))) \\ r\" using less by simp\n moreover have \"(f (g i), f (g (Suc i))) \\ r \\ s\" using * [OF less] by simp\n ultimately show \"(f (g i), f (g (Suc i))) \\ s\" by blast\n qed\n with `SN s` show False by (auto simp: SN_defs)\n qed\nqed\n\nlemma SN_Un_conv:\n assumes \"trans (r \\ s)\"\n shows \"SN (r \\ s) \\ SN r \\ SN s\"\n (is \"SN ?r \\ ?rhs\")\nproof\n assume \"SN (r \\ s)\" thus \"SN r \\ SN s\"\n using SN_subset[of ?r] by blast\nnext\n assume \"SN r \\ SN s\"\n with trans_subset_SN[OF assms subset_refl] show \"SN ?r\" by simp\nqed\n\nlemma SN_relto_Un:\n \"SN (relto (R \\ S) Q) \\ SN (relto R (S \\ Q)) \\ SN (relto S Q)\"\n (is \"SN ?a \\ SN ?b \\ SN ?c\")\nproof -\n have eq: \"?a^+ = ?b^+ \\ ?c^+\" by regexp\n from SN_Un_conv[of \"?b^+\" \"?c^+\", unfolded eq[symmetric]]\n show ?thesis unfolding SN_trancl_SN_conv by simp\nqed\n\nlemma SN_relto_split:\n assumes \"SN (relto r (s \\ q2) \\ relto q1 (s \\ q2))\" (is \"SN ?a\")\n and \"SN (relto s q2)\" (is \"SN ?b\")\n shows \"SN (relto r (q1 \\ q2) \\ relto s (q1 \\ q2))\" (is \"SN ?c\")\nproof -\n have \"?c^+ \\ ?a^+ \\ ?b^+\" by regexp\n from trans_subset_SN[OF _ this, unfolded SN_trancl_SN_conv, OF _ assms]\n show ?thesis by simp\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Abstract-Rewriting/Relative_Rewriting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2712334235359007}} {"text": "(*\n Title: Theory Secrecy.thy\n Author: Maria Spichkova , 2014\n*)\n\nsection \\Secrecy: Definitions and properties\\\n\ntheory Secrecy\nimports Secrecy_types inout ListExtras\nbegin\n\n\\ \\Encryption, decryption, signature creation and signature verification functions\\\n\\ \\For these functions we define only their signatures and general axioms,\\\n\\ \\because in order to reason effectively, we view them as abstract functions and\\\n\\ \\abstract from their implementation details\\ \nconsts \n Enc :: \"Keys \\ Expression list \\ Expression list\"\n Decr :: \"Keys \\ Expression list \\ Expression list\"\n Sign :: \"Keys \\ Expression list \\ Expression list\"\n Ext :: \"Keys \\ Expression list \\ Expression list\"\n\n\\ \\Axioms on relations between encription and decription keys\\\naxiomatization\n EncrDecrKeys :: \"Keys \\ Keys \\ bool\"\nwhere\nExtSign: \n \"EncrDecrKeys K1 K2 \\ (Ext K1 (Sign K2 E)) = E\" and\nDecrEnc:\n \"EncrDecrKeys K1 K2 \\ (Decr K2 (Enc K1 E)) = E\"\n\n\\ \\Set of private keys of a component\\\nconsts\n specKeys :: \"specID \\ Keys set\"\n\\ \\Set of unguessable values used by a component\\\nconsts \n specSecrets :: \"specID \\ Secrets set\"\n\n\\ \\Join set of private keys and unguessable values used by a component\\\ndefinition\n specKeysSecrets :: \"specID \\ KS set\"\nwhere\n \"specKeysSecrets C \\\n {y . \\ x. y = (kKS x) \\ (x \\ (specKeys C))} \\\n {z . \\ s. z = (sKS s) \\ (s \\ (specSecrets C))}\"\n\n\\ \\Predicate defining that a list of expression items does not contain\\\n\\ \\any private key or unguessable value used by a component\\\ndefinition\n notSpecKeysSecretsExpr :: \"specID \\ Expression list \\ bool\"\nwhere\n \"notSpecKeysSecretsExpr P e \\\n (\\ x. (kE x) mem e \\ (kKS x) \\ specKeysSecrets P) \\\n (\\ y. (sE y) mem e \\ (sKS y) \\ specKeysSecrets P)\"\n\n\\ \\If a component is a composite one, the set of its private keys\\ \n\\ \\is a union of the subcomponents' sets of the private keys\\\ndefinition\n correctCompositionKeys :: \"specID \\ bool\"\nwhere\n \"correctCompositionKeys x \\\n subcomponents x \\ {} \\ \n specKeys x = \\ (specKeys ` (subcomponents x))\" \n\n\\ \\If a component is a composite one, the set of its unguessable values\\ \n\\ \\is a union of the subcomponents' sets of the unguessable values\\\ndefinition\n correctCompositionSecrets :: \"specID \\ bool\"\nwhere\n \"correctCompositionSecrets x \\\n subcomponents x \\ {} \\ \n specSecrets x = \\ (specSecrets ` (subcomponents x))\" \n\n\\ \\If a component is a composite one, the set of its private keys and\\ \n\\ \\unguessable values is a union of the corresponding sets of its subcomponents\\\ndefinition\n correctCompositionKS :: \"specID \\ bool\"\nwhere\n \"correctCompositionKS x \\\n subcomponents x \\ {} \\ \n specKeysSecrets x = \\ (specKeysSecrets ` (subcomponents x))\" \n\n\\ \\Predicate defining set of correctness properties of the component's\\\n\\ \\interface and relations on its private keys and unguessable values\\\ndefinition\n correctComponentSecrecy :: \"specID \\ bool\"\nwhere \n \"correctComponentSecrecy x \\ \n correctCompositionKS x \\ \n correctCompositionSecrets x \\ \n correctCompositionKeys x \\ \n correctCompositionLoc x \\\n correctCompositionIn x \\\n correctCompositionOut x \\ \n correctInOutLoc x\"\n\n\\ \\Predicate exprChannel I E defines whether the expression item E can be sent via the channel I\\ \nconsts\n exprChannel :: \"chanID \\ Expression \\ bool\"\n\n\\ \\Predicate eoutM sP M E defines whether the component sP may eventually\\\n\\ \\output an expression E if there exists a time interval t of\\ \n\\ \\an output channel which contains this expression E\\\ndefinition\n eout :: \"specID \\ Expression \\ bool\"\nwhere\n \"eout sP E \\ \n \\ (ch :: chanID). ((ch \\ (out sP)) \\ (exprChannel ch E))\"\n\n\\ \\Predicate eout sP E defines whether the component sP may eventually\\\n\\ \\output an expression E via subset of channels M,\\\n\\ \\which is a subset of output channels of sP,\\\n\\ \\and if there exists a time interval t of\\ \n\\ \\an output channel which contains this expression E\\\ndefinition\n eoutM :: \"specID \\ chanID set \\ Expression \\ bool\"\nwhere\n \"eoutM sP M E \\ \n \\ (ch :: chanID). ((ch \\ (out sP)) \\ (ch \\ M) \\ (exprChannel ch E))\"\n\n\\ \\Predicate ineM sP M E defines whether a component sP may eventually\\\n\\ \\get an expression E if there exists a time interval t of\\ \n\\ \\an input stream which contains this expression E\\\ndefinition\n ine :: \"specID \\ Expression \\ bool\"\nwhere\n \"ine sP E \\ \n \\ (ch :: chanID). ((ch \\ (ins sP)) \\ (exprChannel ch E))\"\n\n\\ \\Predicate ine sP E defines whether a component sP may eventually\\\n\\ \\get an expression E via subset of channels M,\\\n\\ \\which is a subset of input channels of sP,\\\n\\ \\and if there exists a time interval t of\\ \n\\ \\an input stream which contains this expression E\\\ndefinition\n ineM :: \"specID \\ chanID set \\ Expression \\ bool\"\nwhere\n \"ineM sP M E \\ \n \\ (ch :: chanID). ((ch \\ (ins sP)) \\ (ch \\ M) \\ (exprChannel ch E))\"\n\n\\ \\This predicate defines whether an input channel ch of a component sP\\\n\\ \\is the only one input channel of this component\\\n\\ \\via which it may eventually output an expression E\\\ndefinition\n out_exprChannelSingle :: \"specID \\ chanID \\ Expression \\ bool\"\nwhere\n \"out_exprChannelSingle sP ch E \\ \n (ch \\ (out sP)) \\ \n (exprChannel ch E) \\\n (\\ (x :: chanID) (t :: nat). ((x \\ (out sP)) \\ (x \\ ch) \\ \\ exprChannel x E))\"\n\n\\ \\This predicate yields true if only the channels from the set chSet,\\\n\\ \\which is a subset of input channels of the component sP,\\\n\\ \\may eventually output an expression E\\\ndefinition\n out_exprChannelSet :: \"specID \\ chanID set \\ Expression \\ bool\"\nwhere\n \"out_exprChannelSet sP chSet E \\ \n ((\\ (x ::chanID). ((x \\ chSet) \\ ((x \\ (out sP)) \\ (exprChannel x E))))\n \\\n (\\ (x :: chanID). ((x \\ chSet) \\ (x \\ (out sP)) \\ \\ exprChannel x E)))\"\n\n\\ \\This redicate defines whether\\\n\\ \\an input channel ch of a component sP is the only one input channel\\\n\\ \\of this component via which it may eventually get an expression E\\\ndefinition\n ine_exprChannelSingle :: \"specID \\ chanID \\ Expression \\ bool\"\nwhere\n \"ine_exprChannelSingle sP ch E \\ \n (ch \\ (ins sP)) \\\n (exprChannel ch E) \\\n (\\ (x :: chanID) (t :: nat). (( x \\ (ins sP)) \\ (x \\ ch) \\ \\ exprChannel x E))\"\n\n\\ \\This predicate yields true if the component sP may eventually\\\n\\ \\get an expression E only via the channels from the set chSet,\\\n\\ \\which is a subset of input channels of sP\\\ndefinition\n ine_exprChannelSet :: \"specID \\ chanID set \\ Expression \\ bool\"\nwhere\n \"ine_exprChannelSet sP chSet E \\ \n ((\\ (x ::chanID). ((x \\ chSet) \\ ((x \\ (ins sP)) \\ (exprChannel x E))))\n \\\n (\\ (x :: chanID). ((x \\ chSet) \\ ( x \\ (ins sP)) \\ \\ exprChannel x E)))\"\n\n\\ \\If a list of expression items does not contain any private key\\\n\\ \\or unguessable value of a component P, then the first element\\ \n\\ \\of the list is neither a private key nor unguessable value of P\\\nlemma notSpecKeysSecretsExpr_L1:\nassumes \"notSpecKeysSecretsExpr P (a # l)\"\nshows \"notSpecKeysSecretsExpr P [a]\"\nusing assms by (simp add: notSpecKeysSecretsExpr_def)\n\n\\ \\If a list of expression items does not contain any private key\\\n\\ \\or unguessable value of a component P, then this list without its first\\ \n\\ \\element does not contain them too\\\nlemma notSpecKeysSecretsExpr_L2:\nassumes \"notSpecKeysSecretsExpr P (a # l)\"\nshows \"notSpecKeysSecretsExpr P l\" \nusing assms by (simp add: notSpecKeysSecretsExpr_def)\n\n\\ \\If a channel belongs to the set of input channels of a component P\\\n\\ \\and does not belong to the set of local channels of the compositon of P and Q\\ \n\\ \\then it belongs to the set of input channels of this composition\\\nlemma correctCompositionIn_L1:\nassumes \"subcomponents PQ = {P,Q}\" \n and \"correctCompositionIn PQ\" \n and \"ch \\ loc PQ\"\n and \"ch \\ ins P\" \nshows \"ch \\ ins PQ\"\nusing assms by (simp add: correctCompositionIn_def)\n\n\\ \\If a channel belongs to the set of input channels of the compositon of P and Q\\\n\\ \\then it belongs to the set of input channels either of P or of Q\\\nlemma correctCompositionIn_L2:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\" \n and \"ch \\ ins PQ\" \nshows \"(ch \\ ins P) \\ (ch \\ ins Q)\" \nusing assms by (simp add: correctCompositionIn_def)\n\nlemma ineM_L1:\nassumes \"ch \\ M\" \n and \"ch \\ ins P\"\n and \"exprChannel ch E\"\nshows \"ineM P M E\"\nusing assms by (simp add: ineM_def, blast)\n\nlemma ineM_ine:\nassumes \"ineM P M E\"\nshows \"ine P E\"\nusing assms by (simp add: ineM_def ine_def, blast)\n\nlemma not_ine_ineM:\nassumes \"\\ ine P E\"\nshows \"\\ ineM P M E\"\nusing assms by (simp add: ineM_def ine_def)\n\nlemma eoutM_eout:\nassumes \"eoutM P M E\"\nshows \"eout P E\"\nusing assms by (simp add: eoutM_def eout_def, blast)\n\nlemma not_eout_eoutM:\nassumes \"\\ eout P E\"\nshows \"\\ eoutM P M E\"\nusing assms by (simp add: eoutM_def eout_def)\n\nlemma correctCompositionKeys_subcomp1:\nassumes \"correctCompositionKeys C\"\n and \"x \\ subcomponents C\" \n and \"xb \\ specKeys C\"\nshows \"\\ x \\ subcomponents C. (xb \\ specKeys x)\"\nusing assms by (simp add: correctCompositionKeys_def, auto)\n\nlemma correctCompositionSecrets_subcomp1:\nassumes \"correctCompositionSecrets C\" \n and \"x \\ subcomponents C\"\n and \"s \\ specSecrets C\"\nshows \"\\ x \\ subcomponents C. (s \\ specSecrets x)\"\nusing assms by (simp add: correctCompositionSecrets_def, auto)\n\nlemma correctCompositionKeys_subcomp2:\nassumes \"correctCompositionKeys C\"\n and \"xb \\ subcomponents C\"\n and \"xc \\ specKeys xb\"\nshows \"xc \\ specKeys C\"\nusing assms by (simp add: correctCompositionKeys_def, auto)\n\nlemma correctCompositionSecrets_subcomp2:\nassumes \"correctCompositionSecrets C\"\n and \"xb \\ subcomponents C\"\n and \"xc \\ specSecrets xb\"\nshows \"xc \\ specSecrets C\"\nusing assms by (simp add: correctCompositionSecrets_def, auto)\n\nlemma correctCompKS_Keys:\nassumes \"correctCompositionKS C\"\nshows \"correctCompositionKeys C\"\nproof (cases \"subcomponents C = {}\")\n assume \"subcomponents C = {}\"\n from this and assms show ?thesis\n by (simp add: correctCompositionKeys_def)\nnext\n assume \"subcomponents C \\ {}\"\n from this and assms show ?thesis \n by (simp add: correctCompositionKS_def \n correctCompositionKeys_def\n specKeysSecrets_def, blast)\nqed\n\nlemma correctCompKS_Secrets:\nassumes \"correctCompositionKS C\"\nshows \"correctCompositionSecrets C\"\nproof (cases \"subcomponents C = {}\")\n assume \"subcomponents C = {}\"\n from this and assms show ?thesis\n by (simp add: correctCompositionSecrets_def)\nnext\n assume \"subcomponents C \\ {}\"\n from this and assms show ?thesis \n by (simp add: correctCompositionKS_def \n correctCompositionSecrets_def\n specKeysSecrets_def, blast)\nqed\n\nlemma correctCompKS_KeysSecrets:\nassumes \"correctCompositionKeys C\"\n and \"correctCompositionSecrets C\"\nshows \"correctCompositionKS C\"\nproof (cases \"subcomponents C = {}\")\n assume \"subcomponents C = {}\"\n from this and assms show ?thesis\n by (simp add: correctCompositionKS_def)\nnext\n assume \"subcomponents C \\ {}\"\n from this and assms show ?thesis \n by (simp add: correctCompositionKS_def \n correctCompositionKeys_def \n correctCompositionSecrets_def\n specKeysSecrets_def, blast)\nqed \n\nlemma correctCompositionKS_subcomp1:\nassumes \"correctCompositionKS C\"\n and h1:\"x \\ subcomponents C\"\n and \"xa \\ specKeys C\"\nshows \"\\ y \\ subcomponents C. (xa \\ specKeys y)\"\nproof (cases \"subcomponents C = {}\")\n assume \"subcomponents C = {}\"\n from this and h1 show ?thesis by simp \nnext\n assume \"subcomponents C \\ {}\"\n from this and assms show ?thesis \n by (simp add: correctCompositionKS_def specKeysSecrets_def, blast) \nqed\n\nlemma correctCompositionKS_subcomp2:\nassumes \"correctCompositionKS C\"\n and h1:\"x \\ subcomponents C\"\n and \"xa \\ specSecrets C\"\nshows \"\\ y \\ subcomponents C. xa \\ specSecrets y\"\nproof (cases \"subcomponents C = {}\")\n assume \"subcomponents C = {}\"\n from this and h1 show ?thesis by simp \nnext\n assume \"subcomponents C \\ {}\"\n from this and assms show ?thesis \n by (simp add: correctCompositionKS_def specKeysSecrets_def, blast)\nqed\n\nlemma correctCompositionKS_subcomp3:\nassumes \"correctCompositionKS C\"\n and \"x \\ subcomponents C\"\n and \"xa \\ specKeys x\"\nshows \"xa \\ specKeys C\"\nusing assms \nby (simp add: correctCompositionKS_def specKeysSecrets_def, auto)\n\nlemma correctCompositionKS_subcomp4:\nassumes \"correctCompositionKS C\"\n and \"x \\ subcomponents C\"\n and \"xa \\ specSecrets x\" \nshows \"xa \\ specSecrets C\"\nusing assms \nby (simp add: correctCompositionKS_def specKeysSecrets_def, auto)\n\nlemma correctCompositionKS_PQ:\nassumes \"subcomponents PQ = {P, Q}\"\n and \"correctCompositionKS PQ\" \n and \"ks \\ specKeysSecrets PQ\"\nshows \"ks \\ specKeysSecrets P \\ ks \\ specKeysSecrets Q\"\nusing assms by (simp add: correctCompositionKS_def)\n\nlemma correctCompositionKS_neg1:\nassumes \"subcomponents PQ = {P, Q}\"\n and \"correctCompositionKS PQ\" \n and \"ks \\ specKeysSecrets P\"\n and \"ks \\ specKeysSecrets Q\"\nshows \"ks \\ specKeysSecrets PQ\"\nusing assms by (simp add: correctCompositionKS_def)\n\nlemma correctCompositionKS_negP:\nassumes \"subcomponents PQ = {P, Q}\"\n and \"correctCompositionKS PQ\" \n and \"ks \\ specKeysSecrets PQ\" \nshows \"ks \\ specKeysSecrets P\"\nusing assms by (simp add: correctCompositionKS_def)\n\nlemma correctCompositionKS_negQ:\nassumes \"subcomponents PQ = {P, Q}\"\n and \"correctCompositionKS PQ\" \n and \"ks \\ specKeysSecrets PQ\" \nshows \"ks \\ specKeysSecrets Q\"\nusing assms by (simp add: correctCompositionKS_def)\n\nlemma out_exprChannelSingle_Set:\nassumes \"out_exprChannelSingle P ch E\"\nshows \"out_exprChannelSet P {ch} E\"\nusing assms \nby (simp add: out_exprChannelSingle_def out_exprChannelSet_def)\n\nlemma out_exprChannelSet_Single:\nassumes \"out_exprChannelSet P {ch} E\"\nshows \"out_exprChannelSingle P ch E\"\nusing assms\nby (simp add: out_exprChannelSingle_def out_exprChannelSet_def)\n\nlemma ine_exprChannelSingle_Set:\nassumes \"ine_exprChannelSingle P ch E\"\n shows \"ine_exprChannelSet P {ch} E\"\nusing assms \nby (simp add: ine_exprChannelSingle_def ine_exprChannelSet_def)\n\nlemma ine_exprChannelSet_Single:\nassumes \"ine_exprChannelSet P {ch} E\"\nshows \"ine_exprChannelSingle P ch E\"\nusing assms \nby (simp add: ine_exprChannelSingle_def ine_exprChannelSet_def)\n\nlemma ine_ins_neg1:\nassumes \"\\ ine P m\" \n and \"exprChannel x m\"\nshows \"x \\ ins P\"\nusing assms by (simp add: ine_def, auto)\n\ntheorem TBtheorem1a:\nassumes \"ine PQ E\" \n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\nshows \"ine P E \\ ine Q E\"\nusing assms \nby (simp add: ine_def correctCompositionIn_def, auto)\n\ntheorem TBtheorem1b:\nassumes \"ineM PQ M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\" \nshows \"ineM P M E \\ ineM Q M E\"\nusing assms by (simp add: ineM_def correctCompositionIn_def, auto)\n\ntheorem TBtheorem2a:\nassumes \"eout PQ E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\nshows \"eout P E \\ eout Q E\"\nusing assms by (simp add: eout_def correctCompositionOut_def, auto)\n\ntheorem TBtheorem2b:\nassumes \"eoutM PQ M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\nshows \"eoutM P M E \\ eoutM Q M E\"\nusing assms by (simp add: eoutM_def correctCompositionOut_def, auto)\n\nlemma correctCompositionIn_prop1:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"x \\ (ins PQ)\"\nshows \"(x \\ (ins P)) \\ (x \\ (ins Q))\" \nusing assms by (simp add: correctCompositionIn_def)\n\nlemma correctCompositionOut_prop1:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"x \\ (out PQ)\"\nshows \"(x \\ (out P)) \\ (x \\ (out Q))\" \nusing assms by (simp add: correctCompositionOut_def)\n\ntheorem TBtheorem3a:\nassumes \"\\ (ine P E)\"\n and \"\\ (ine Q E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\nshows \"\\ (ine PQ E)\"\nusing assms by (simp add: ine_def correctCompositionIn_def, auto )\n\ntheorem TBlemma3b:\nassumes h1:\"\\ (ineM P M E)\"\n and h2:\"\\ (ineM Q M E)\"\n and subPQ:\"subcomponents PQ = {P,Q}\"\n and cCompI:\"correctCompositionIn PQ\"\n and chM:\"ch \\ M\" \n and chPQ:\"ch \\ ins PQ\"\n and eCh:\"exprChannel ch E\"\nshows \"False\"\nproof (cases \"ch \\ ins P\")\n assume a1:\"ch \\ ins P\"\n from a1 and chM and eCh have \"ineM P M E\" by (simp add: ineM_L1)\n from this and h1 show ?thesis by simp\nnext\n assume a2:\"ch \\ ins P\" \n from subPQ and cCompI and chPQ have \"(ch \\ ins P) \\ (ch \\ ins Q)\"\n by (simp add: correctCompositionIn_L2)\n from this and a2 have \"ch \\ ins Q\" by simp \n from this and chM and eCh have \"ineM Q M E\" by (simp add: ineM_L1)\n from this and h2 show ?thesis by simp\nqed\n\ntheorem TBtheorem3b:\nassumes \"\\ (ineM P M E)\"\n and \"\\ (ineM Q M E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\nshows \"\\ (ineM PQ M E)\"\nusing assms by (metis TBtheorem1b) \n\ntheorem TBtheorem4a_empty:\nassumes \"(ine P E) \\ (ine Q E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"loc PQ = {}\"\nshows \"ine PQ E\"\nusing assms by (simp add: ine_def correctCompositionIn_def, auto)\n\ntheorem TBtheorem4a_P:\nassumes \"ine P E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"\\ ch. (ch \\ (ins P) \\ exprChannel ch E \\ ch \\ (loc PQ))\"\nshows \"ine PQ E\"\nusing assms by (simp add: ine_def correctCompositionIn_def, auto) \n\ntheorem TBtheorem4b_P:\nassumes \"ineM P M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"\\ ch. ((ch \\ (ins Q)) \\ (exprChannel ch E) \\ \n (ch \\ (loc PQ)) \\ (ch \\ M))\"\nshows \"ineM PQ M E\"\nusing assms by (simp add: ineM_def correctCompositionIn_def, auto) \n\ntheorem TBtheorem4a_PQ:\nassumes \"(ine P E) \\ (ine Q E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"\\ ch. (((ch \\ (ins P)) \\ (ch \\ (ins Q) )) \\ \n (exprChannel ch E) \\ (ch \\ (loc PQ)))\"\nshows \"ine PQ E\"\nusing assms by (simp add: ine_def correctCompositionIn_def, auto) \n\ntheorem TBtheorem4b_PQ:\nassumes \"(ineM P M E) \\ (ineM Q M E)\" \n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"\\ ch. (((ch \\ (ins P)) \\ (ch \\ (ins Q) )) \\ \n (ch \\ M) \\ (exprChannel ch E) \\ (ch \\ (loc PQ)))\"\nshows \"ineM PQ M E\"\nusing assms by (simp add: ineM_def correctCompositionIn_def, auto) \n\ntheorem TBtheorem4a_notP1:\nassumes \"ine P E\"\n and \"\\ ine Q E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\" \n and \"\\ ch. ((ine_exprChannelSingle P ch E) \\ (ch \\ (loc PQ)))\"\nshows \"\\ ine PQ E\"\nusing assms \nby (simp add: ine_def correctCompositionIn_def \n ine_exprChannelSingle_def, auto) \n\ntheorem TBtheorem4b_notP1:\nassumes \"ineM P M E\"\n and \"\\ ineM Q M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\" \n and \"\\ ch. ((ine_exprChannelSingle P ch E) \\ (ch \\ M) \n \\ (ch \\ (loc PQ)))\"\nshows \"\\ ineM PQ M E\"\nusing assms\nby (simp add: ineM_def correctCompositionIn_def \n ine_exprChannelSingle_def, auto) \n\ntheorem TBtheorem4a_notP2:\nassumes \"\\ ine Q E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\" \n and \"ine_exprChannelSet P ChSet E\"\n and \"\\ (x ::chanID). ((x \\ ChSet) \\ (x \\ (loc PQ)))\" \nshows \"\\ ine PQ E\"\nusing assms \nby (simp add: ine_def correctCompositionIn_def \n ine_exprChannelSet_def, auto) \n\ntheorem TBtheorem4b_notP2:\nassumes \"\\ ineM Q M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"ine_exprChannelSet P ChSet E\"\n and \"\\ (x ::chanID). ((x \\ ChSet) \\ (x \\ (loc PQ)))\"\nshows \"\\ ineM PQ M E\"\nusing assms \nby (simp add: ineM_def correctCompositionIn_def \n ine_exprChannelSet_def, auto) \n\ntheorem TBtheorem4a_notPQ:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionIn PQ\"\n and \"ine_exprChannelSet P ChSetP E\"\n and \"ine_exprChannelSet Q ChSetQ E\"\n and \"\\ (x ::chanID). ((x \\ ChSetP) \\ (x \\ (loc PQ)))\"\n and \"\\ (x ::chanID). ((x \\ ChSetQ) \\ (x \\ (loc PQ)))\"\nshows \"\\ ine PQ E\"\nusing assms \nby (simp add: ine_def correctCompositionIn_def \n ine_exprChannelSet_def, auto)\n\nlemma ineM_Un1:\nassumes \"ineM P A E\"\nshows \"ineM P (A Un B) E\"\nusing assms by (simp add: ineM_def, auto)\n\n\n\nlemma ine_nonempty_exprChannelSet:\nassumes \"ine_exprChannelSet P ChSet E\"\n and \"ChSet \\ {}\"\nshows \"ine P E \"\nusing assms by (simp add: ine_def ine_exprChannelSet_def, auto)\n\nlemma ine_empty_exprChannelSet:\nassumes \"ine_exprChannelSet P ChSet E\"\n and \"ChSet = {}\"\nshows \"\\ ine P E\"\nusing assms by (simp add: ine_def ine_exprChannelSet_def)\n\ntheorem TBtheorem5a_empty:\nassumes \"(eout P E) \\ (eout Q E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"loc PQ = {}\"\nshows \"eout PQ E\"\nusing assms by (simp add: eout_def correctCompositionOut_def, auto)\n\ntheorem TBtheorem45a_P:\nassumes \"eout P E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"\\ ch. ((ch \\ (out P)) \\ (exprChannel ch E) \\ \n (ch \\ (loc PQ)))\"\nshows \"eout PQ E\"\nusing assms by (simp add: eout_def correctCompositionOut_def, auto)\n\ntheorem TBtheore54b_P:\nassumes \"eoutM P M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\" \n and \"\\ ch. ((ch \\ (out Q)) \\ (exprChannel ch E) \\ \n (ch \\ (loc PQ)) \\ (ch \\ M) )\"\nshows \"eoutM PQ M E\"\nusing assms by (simp add: eoutM_def correctCompositionOut_def, auto)\n\ntheorem TBtheorem5a_PQ:\nassumes \"(eout P E) \\ (eout Q E)\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"\\ ch. (((ch \\ (out P)) \\ (ch \\ (out Q) )) \\ \n (exprChannel ch E) \\ (ch \\ (loc PQ)))\"\nshows \"eout PQ E\"\nusing assms by (simp add: eout_def correctCompositionOut_def, auto)\n\ntheorem TBtheorem5b_PQ:\nassumes \"(eoutM P M E) \\ (eoutM Q M E)\" \n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"\\ ch. (((ch \\ (out P)) \\ (ch \\ (out Q) )) \\ (ch \\ M) \n \\ (exprChannel ch E) \\ (ch \\ (loc PQ)))\"\nshows \"eoutM PQ M E\"\nusing assms by (simp add: eoutM_def correctCompositionOut_def, auto) \n\ntheorem TBtheorem5a_notP1:\nassumes \"eout P E\"\n and \"\\ eout Q E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"\\ ch. ((out_exprChannelSingle P ch E) \\ (ch \\ (loc PQ)))\"\nshows \"\\ eout PQ E\"\nusing assms \nby (simp add: eout_def correctCompositionOut_def \n out_exprChannelSingle_def, auto) \n\ntheorem TBtheorem5b_notP1:\nassumes \"eoutM P M E\"\n and \"\\ eoutM Q M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"\\ ch. ((out_exprChannelSingle P ch E) \\ (ch \\ M) \n \\ (ch \\ (loc PQ)))\"\nshows \"\\ eoutM PQ M E\"\nusing assms \nby (simp add: eoutM_def correctCompositionOut_def \n out_exprChannelSingle_def, auto) \n\ntheorem TBtheorem5a_notP2:\nassumes \"\\ eout Q E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\" \n and \"out_exprChannelSet P ChSet E\"\n and \"\\ (x ::chanID). ((x \\ ChSet) \\ (x \\ (loc PQ)))\"\nshows \"\\ eout PQ E\"\nusing assms\nby (simp add: eout_def correctCompositionOut_def \n out_exprChannelSet_def, auto)\n\ntheorem TBtheorem5b_notP2:\nassumes \"\\ eoutM Q M E\"\n and \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"out_exprChannelSet P ChSet E\"\n and \"\\ (x ::chanID). ((x \\ ChSet) \\ (x \\ (loc PQ)))\" \nshows \"\\ eoutM PQ M E\"\nusing assms\nby (simp add: eoutM_def correctCompositionOut_def \n out_exprChannelSet_def, auto)\n\ntheorem TBtheorem5a_notPQ:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"out_exprChannelSet P ChSetP E\"\n and \"out_exprChannelSet Q ChSetQ E\"\n and \"\\ (x ::chanID). ((x \\ ChSetP) \\ (x \\ (loc PQ)))\"\n and \"\\ (x ::chanID). ((x \\ ChSetQ) \\ (x \\ (loc PQ)))\"\nshows \"\\ eout PQ E\"\nusing assms\nby (simp add: eout_def correctCompositionOut_def \n out_exprChannelSet_def, auto) \n\ntheorem TBtheorem5b_notPQ:\nassumes \"subcomponents PQ = {P,Q}\"\n and \"correctCompositionOut PQ\"\n and \"out_exprChannelSet P ChSetP E\"\n and \"out_exprChannelSet Q ChSetQ E\"\n and \"M = ChSetP \\ ChSetQ\"\n and \"\\ (x ::chanID). ((x \\ ChSetP) \\ (x \\ (loc PQ)))\"\n and \"\\ (x ::chanID). ((x \\ ChSetQ) \\ (x \\ (loc PQ)))\"\nshows \"\\ eoutM PQ M E\"\nusing assms \nby (simp add: eoutM_def correctCompositionOut_def \n out_exprChannelSet_def, auto) \n\nend \n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CryptoBasedCompositionalProperties/Secrecy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4186969093556866, "lm_q1q2_score": 0.27123111174267006}} {"text": "(* Title: Mapping_Exts.thy\n Author: Denis Lohner, Sebastian Ullrich\n*)\n\nsubsection \"Mapping Extensions\"\n\ntext {* Some lifted definition on mapping and efficient implementations. *}\n\ntheory Mapping_Exts\nimports \"~~/src/HOL/Library/Mapping\" FormalSSA_Misc\nbegin\n\nlift_definition mapping_delete_all :: \"('a \\ bool) \\ ('a,'b) mapping \\ ('a,'b) mapping\"\n is \"\\P m x. if (P x) then None else m x\" .\nlift_definition map_keys :: \"('a \\ 'b) \\ ('a,'c) mapping \\ ('b,'c) mapping\"\n is \"\\f m x. if f -` {x} \\ {} then m (THE k. f -` {x} = {k}) else None\" .\nlift_definition map_values :: \"('a \\ 'b \\ 'c option) \\ ('a,'b) mapping \\ ('a,'c) mapping\"\n is \"\\f m x. Option.bind (m x) (f x)\" .\nlift_definition restrict_mapping :: \"('a \\ 'b) \\ 'a set \\ ('a, 'b) mapping\"\n is \"\\f. restrict_map (Some \\ f)\" .\nlift_definition mapping_add :: \"('a, 'b) mapping \\ ('a, 'b) mapping \\ ('a, 'b) mapping\"\n is \"op ++\" .\n\ndefinition \"mmap = Mapping.map id\"\n\nlemma lookup_map_keys: \"Mapping.lookup (map_keys f m) x = (if f -` {x} \\ {} then Mapping.lookup m (THE k. f -` {x} = {k}) else None)\"\napply transfer ..\n\nlemma Mapping_Mapping_lookup [simp, code_unfold]: \"Mapping.Mapping (Mapping.lookup m) = m\" by transfer simp\ndeclare Mapping.lookup.abs_eq[simp]\n\nlemma Mapping_eq_lookup: \"m = m' \\ Mapping.lookup m = Mapping.lookup m'\" by transfer simp\n\nlemma map_of_map_if_conv:\n \"map_of (map (\\k. (k, f k)) xs) x = (if (x \\ set xs) then Some (f x) else None)\"\n by (clarsimp simp: map_of_map_restrict)\n\nlemma Mapping_lookup_map: \"Mapping.lookup (Mapping.map f g m) a = map_option g (Mapping.lookup m (f a))\"\n by transfer simp\n\nlemma Mapping_lookup_map_default: \"Mapping.lookup (Mapping.map_default k d f m) k' = (if k = k'\n then (Some \\ f) (case Mapping.lookup m k of None \\ d | Some x \\ x)\n else Mapping.lookup m k')\"\n unfolding Mapping.map_default_def Mapping.default_def\n by transfer auto\n\nlemma Mapping_lookup_mapping_add: \"Mapping.lookup (mapping_add m1 m2) k =\n case_option (Mapping.lookup m1 k) Some (Mapping.lookup m2 k)\"\n by transfer (simp add: map_add_def)\n\nlemma Mapping_lookup_map_values: \"Mapping.lookup (map_values f m) k =\n Option.bind (Mapping.lookup m k) (f k)\"\n by transfer simp\n\nlemma lookup_fold_update [simp]: \"Mapping.lookup (fold (\\n. Mapping.update n (g n)) xs m) x\n = (if (x \\ set xs) then Some (g x) else Mapping.lookup m x)\"\n by transfer (rule fold_update_conv)\n\nlemma mapping_eq_iff: \"m1 = m2 \\ (\\k. Mapping.lookup m1 k = Mapping.lookup m2 k)\"\n by transfer auto\n\nlemma lookup_delete: \"Mapping.lookup (Mapping.delete k m) k' = (if k = k' then None else Mapping.lookup m k')\"\n by transfer auto\n\nlemma keys_map_values: \"Mapping.keys (map_values f m) = Mapping.keys m - {k\\Mapping.keys m. f k (the (Mapping.lookup m k)) = None}\"\n by transfer (auto simp: Option.bind_def split: option.splits)\n\nlemma map_default_eq: \"Mapping.map_default k v f m = m \\ (\\v. Mapping.lookup m k = Some v \\ f v = v)\"\n apply (clarsimp simp: Mapping.map_default_def Mapping.default_def)\n by transfer' (auto simp: fun_eq_iff split: if_splits)\n\nlemma lookup_update_cases: \"Mapping.lookup (Mapping.update k v m) k' = (if k=k' then Some v else Mapping.lookup m k')\"\nby (cases \"k=k'\", simp_all add: Mapping.lookup_update Mapping.lookup_update_neq)\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/Mapping_Exts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525098, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.27116830409672554}} {"text": "section \\Verification Condition Testing\\\n\ntheory utp_hoare_total\n imports algebraic_laws_designs\nbegin\nnamed_theorems hoare_total\n\nsubsection {*Hoare triple definition*}\n\ndefinition hoare_rd :: \"'\\ cond \\ ('f,'\\) hrel_cp \\ '\\ cond \\ bool\" (\"\\_\\_\\_\\\\<^sub>D\") where\n[upred_defs]:\"\\p\\Q\\r\\\\<^sub>D = \n ((\\p\\\\<^sub>C\\<^sub>< \\ $ok \\ \\$abrupt \\ \\$stuck \\ \\$fault \\ $fault_tr =\\<^sub>u \\None\\ \\ \n \\r\\\\<^sub>C\\<^sub>> \\ $ok\\ \\ \\$abrupt\\ \\ \\$stuck\\ \\ \\$fault\\ \\ $fault_tr\\ =\\<^sub>u \\None\\) \\ Q)\"\n\nlemma hoare_true_t [hoare_total]:\n assumes \"$ok \\ C\" \"$abrupt \\ C\" \"$stuck \\ C\" \"$fault \\ C\" \"$fault_tr \\ C\"\n \"$ok\\ \\ C\" \"$abrupt\\ \\ C\" \"$stuck\\ \\ C\" \"$fault\\ \\ C\" \"$fault_tr\\ \\ C\"\n shows \"\\p\\C\\true\\\\<^sub>D\"\n oops\n\nlemma hoare_false_t [hoare_total]: \"\\false\\C\\q\\\\<^sub>D\"\n by rel_auto\n\nsubsection {*Precondition strengthening*}\n\nlemma hoare_pre_str_t[hoare_total]:\n assumes \"`p\\<^sub>1 \\ p\\<^sub>2`\" and \"\\p\\<^sub>2\\C\\q\\\\<^sub>D\"\n shows \"\\p\\<^sub>1\\C\\q\\\\<^sub>D\" \n by (insert assms) rel_auto\n\nsubsection {*Post-condition weakening*}\n\nlemma hoare_post_weak_t[hoare_total]:\n assumes \"\\p\\C\\q\\<^sub>2\\\\<^sub>D\" and \"`q\\<^sub>2 \\ q\\<^sub>1`\"\n shows \"\\p\\C\\q\\<^sub>1\\\\<^sub>D\" \n by (insert assms) rel_auto\n\nsubsection {*Hoare and assertion logic*}\n\nlemma hoare_r_conj_t [hoare_total]: \n assumes\"\\p\\C\\r\\\\<^sub>D\" and \"\\p\\C\\s\\\\<^sub>D\" \n shows \"\\p\\C\\r \\ s\\\\<^sub>D\"\n by (insert assms) rel_auto\n\nsubsection {*Hoare SKIP*}\n\nlemma skip_hoare_r_t [hoare_total]: \"\\p\\SKIP\\p\\\\<^sub>D\"\n by rel_auto\n\nsubsection {*Hoare for assignment*}\n\nlemma assigns_hoare_r_t [hoare_total]: \n assumes\"`p \\ \\ \\ q`\" \n shows \"\\p\\\\\\\\\\<^sub>C\\q\\\\<^sub>D\"\n by (insert assms) rel_auto\n\nlemma assigns_hoare_r'_t [hoare_total]: \"\\\\ \\ p\\\\\\\\\\<^sub>C\\p\\\\<^sub>D\"\n by rel_auto\n\nsubsection {*Hoare for Sequential Composition*}\n\nlemma seq_hoare_r_t [hoare_total]: \n assumes\"\\p\\C\\<^sub>1\\s\\\\<^sub>D\" and \"\\s\\C\\<^sub>2\\r\\\\<^sub>D\" \n shows\"\\p\\C\\<^sub>1 ;; C\\<^sub>2\\r\\\\<^sub>D\"\n by (insert assms, rel_auto) metis+ \n\nsubsection {*Hoare for Conditional*}\n\nlemma cond_hoare_r_t [hoare_total]: \n assumes \"\\b \\ p\\C\\<^sub>1\\q\\\\<^sub>D\" and \"\\\\b \\ p\\C\\<^sub>2\\q\\\\<^sub>D\" \n shows \"\\p\\C\\<^sub>1 \\ \\b\\\\<^sub>C\\<^sub>< \\ C\\<^sub>2\\q\\\\<^sub>D\"\n by (insert assms, rel_auto) metis+ \n\nsubsection {*Hoare for assert*}\n\nlemma assert_hoare_r_t [hoare_total]: \n assumes \"\\c \\ p\\SKIP\\q\\\\<^sub>D\" and \"\\\\c \\ p\\\\\\<^sub>D\\q\\\\<^sub>D\" \n shows \"\\p\\ c\\<^sub>\\\\<^sub>C \\q\\\\<^sub>D\"\n by (insert assms) rel_blast\n\nsubsection {*Hoare for assume*}\n\nlemma assume_hoare_r_t [hoare_total]: \n assumes \"\\c \\ p\\SKIP\\q\\\\<^sub>D\" and \"\\\\c \\ p\\\\\\<^sub>D\\q\\\\<^sub>D\" \n shows \"\\p\\c\\<^sup>\\\\<^sup>C\\q\\\\<^sub>D\"\n by (insert assms) rel_blast\n\nsubsection {*Hoare for While-loop*}\n\nlemma while_hoare_r_t [hoare_total]:\n assumes \"\\p \\ b \\ C\\p\\\\<^sub>D\"\n shows \"\\p\\while b do C od\\\\b \\ p\\\\<^sub>D\"\n using assms\n by (simp add: While_def hoare_rd_def, rule_tac lfp_lowerbound)(rel_blast) \n\n\nlemma while_hoare_r'_t [hoare_total]:\n assumes \"\\p \\ b\\C\\p\\\\<^sub>D\" and \"`p \\ \\b \\ q`\"\n shows \"\\p\\while b do C od\\q\\\\<^sub>D\"\n using assms\n by (metis hoare_post_weak_t while_hoare_r_t inf_commute)\n\nlemma while_invr_hoare_r_t [hoare_total]:\n assumes \"\\p \\ b\\C\\p\\\\<^sub>D\" and \"`pre \\ p`\" and \"`(\\b \\ p) \\ post`\"\n shows \"\\pre\\while b invr p do C od\\post\\\\<^sub>D\"\n by (metis assms hoare_pre_str_t while_hoare_r'_t While_inv_def inf_commute)\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/orca/hoare/utp_hoare_total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2710024127569286}} {"text": "theory MDEAK_examples_completeness\nimports Main MDEAK_Core_SE MDEAK_SE MDEAK_examples\nbegin\n\nlemma c1_f: \"\\d (a \\\\<^sub>0 ((p)\\<^sub>F) )\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F ((p)\\<^sub>F))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: Atom)\n then have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S I\\<^sub>S \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: Fdiam0_R Id_fa Top_R)\n then have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (I\\<^sub>S ;\\<^sub>S ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M) \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F ((p)\\<^sub>F))\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: And_R Mon_fdiam0 \\\\d a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S p \\<^sub>F \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M p \\<^sub>F \\<^sub>S\\<^sub>F\\<^sub>M\\)\n then have \"\\d ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((a \\\\<^sub>0 \\) \\\\<^sub>F ((p)\\<^sub>F))\\<^sub>S\\<^sub>F\\<^sub>M\"\n using DH_fdiam0_f D_IL1_f I_1L_b by blast\n then show ?thesis\n by (simp add: DH_fdiam0_b Fdiam0_L)\nqed\n\nlemma c1_b: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M) ;\\<^sub>S (\\)\\<^sub>S\\<^sub>F\\<^sub>M ) \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: Atom D_IR1_b Fdiam0_R Id_fa W_2L)\n then show ?thesis\n using And_L Conj_fdiam0 D_IR1_b D_IR1_f E_L Fdiam0_L by blast\nqed\n\nlemma c2_f: \"\\d (a \\\\<^sub>0 (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: Atom DH_bdiam0_b Fbox0_L Id_fa)\n then show ?thesis\n by (simp add: DH_fdiam0_b D_IR1_b D_IR1_f E_L FS_bbox0 Fdiam0_L ImpR_R W_2L)\nqed\n\nlemma c2_b: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M\"\nsledgehammer\nproof - \n have \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F (p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (I\\<^sub>S \\\\<^sub>S ((p)\\<^sub>F)\\<^sub>S\\<^sub>F\\<^sub>M)\"\n by (simp add: Atom FS_fbox0 Fdiam0_R Id_fa ImpR_L Top_R)\n then show ?thesis\n using DH_bdiam0_b DH_bdiam0_f D_IL1_f D_IR1_b Fbox0_R I_1L_b by blast\nqed\n\nlemma c3: \"\\d (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nby (simp add: AderivesA)\n\nlemma c4_f: \"\\d (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have f1: \"\\f fa. \\ \\d f \\\\<^sub>F\\<^sub>M I\\<^sub>S \\ \\d f \\\\<^sub>F\\<^sub>M fa\"\n by (metis IW_R)\n have f2: \"\\f fa fb. \\ \\d f \\\\<^sub>F\\<^sub>M fa \\\\<^sub>S fb \\ \\d fa ;\\<^sub>S f \\\\<^sub>F\\<^sub>M fb\"\n by (metis D_IR1_b)\n have f3: \"\\f fa fb. \\ \\d f ;\\<^sub>S fa \\\\<^sub>F\\<^sub>M fb \\ \\d fa ;\\<^sub>S f \\\\<^sub>F\\<^sub>M fb\"\n by (metis E_L)\n have f4: \"\\f fa fb. \\ \\d f ;\\<^sub>S fa \\\\<^sub>F\\<^sub>M fb \\ \\d fa \\\\<^sub>F\\<^sub>M f \\\\<^sub>S fb\"\n by (metis D_IR1_f)\n have \"\\d (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S I\\<^sub>S\"\n by (meson Bot_L Fbox0_L Id_fa)\n then have \"\\d a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M I\\<^sub>S\"\n by (metis DH_bdiam0_b)\n then have \"\\d \\ \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S \\ \\<^sub>S\\<^sub>F\\<^sub>M)\"\n using f4 f3 f2 f1 by (meson FS_bbox0)\n then have \"\\d a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S \\ \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S \\ \\<^sub>S\\<^sub>F\\<^sub>M\"\n by (metis DH_fdiam0_b)\n then have \"\\d (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S \\ \\<^sub>S\\<^sub>F\\<^sub>M\"\n by (metis Fdiam0_L)\n then have \"\\d (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M ;\\<^sub>S (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M \\ \\<^sub>S\\<^sub>F\\<^sub>M\"\n using f2 by metis\n then have \"\\d (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M ;\\<^sub>S (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M \\ \\<^sub>S\\<^sub>F\\<^sub>M\"\n using f3 by meson\n then have \"\\d (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\) \\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S \\ \\<^sub>S\\<^sub>F\\<^sub>M\"\n using f4 by metis\n then show ?thesis\n by (metis ImpR_R)\nqed\n(*by (meson Bot_L DH_bdiam2_b DH_fdiam2_b D_IR1_b D_IR1_f E_L FS_bbox2 Fbox2_L Fdiam2_L IW_R Id_ag ImpR_R)*)\n\nlemma c4_b: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (I\\<^sub>S \\\\<^sub>S (\\)\\<^sub>S\\<^sub>F\\<^sub>M)\"\n using Bot_L FS_fbox0 Fdiam0_R IW_R Id_fa ImpR_L Top_R by blast\n then show ?thesis\n using DH_bdiam0_b DH_bdiam0_f D_IL1_f D_IR1_b Fbox0_R I_1L_b by blast\nqed\n\nlemma c5_f: \"\\d (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (\\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nusing Bot_L DH_fdiam0_b Fdiam0_L IW_R by blast\n\nlemma c5_b: \"\\d (\\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nusing [[simp_trace_new mode=full]] \nby (simp add: Bot_L IW_R)\n\nlemma c6_f: \"\\d (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (\\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nusing [[simp_trace_new mode=full]] \nby (simp add: IW_L Top_R)\n\nlemma c6_b: \"\\d (\\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M\"\nusing [[simp_trace_new mode=full]] \nby (simp add: DH_bdiam0_f Fbox0_R IW_L Top_R)\n\nlemma c7_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have f1: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA And_L D_IR1_b Fbox0_L Fbox0_R Id_fa W_2L)\n have f2: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 B)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA And_L D_IL1_b Fbox0_L Fbox0_R Id_fa W_1L)\n show ?thesis\n using And_R C_L f1 f2 by blast\nqed \n\nlemma c7_b: \"\\d ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 A)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA DH_bdiam0_b Fbox0_L Id_fa)\n then show ?thesis\n by (simp add: AderivesA And_L And_R DH_bdiam0_b DH_bdiam0_f Fbox0_L Fbox0_R Id_fa Mon_bdiam0)\nqed\n\nlemma c8_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nby (metis And_L And_R C_L D_IL1_b D_IR1_b Fdiam0_L Fdiam0_R Id_fa W_1L W_2L AderivesA)\n\n(*lemma c8_f_simple: \"\\d (a \\\\<^sub>2 ((A)\\<^sub>F \\\\<^sub>F (B)\\<^sub>F))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>2 (A)\\<^sub>F) \\\\<^sub>F (a \\\\<^sub>2 (B)\\<^sub>F) )\\<^sub>S\\<^sub>F\\<^sub>M\"\nby (metis And_L And_R C_L D_IL1_b D_IR1_b Fdiam2_L Fdiam2_R Id_ag Id_fm W_1L W_2L)*)\n\nlemma c8_b: \"\\d ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (A)\\<^sub>S\\<^sub>F\\<^sub>M) ;\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (B)\\<^sub>S\\<^sub>F\\<^sub>M)) \\\\<^sub>F\\<^sub>M (A \\\\<^sub>F B)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA And_R Balance Conj_fdiam0 DH_bdiam0_b)\n then show ?thesis\n by (simp add: And_L Conj_bdiam0 Conj_fdiam0 D_IL1_b D_IL1_f E_L Fdiam0_L Fdiam0_R Id_fa)\nqed\n\nlemma c9_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (A)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA DH_fdiam0_f Fdiam0_R Id_fa)\n then show ?thesis\n by (simp add: AderivesA DH_fdiam0_b DH_fdiam0_f Fdiam0_L Fdiam0_R Id_fa Mon_bbox0 Or_L Or_R)\nqed\n\nlemma c9_b: \"\\d ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have f1: \"\\d (a \\\\<^sub>0 A)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \"\n by (simp add: AderivesA D_IR2_b Fdiam0_L Fdiam0_R Id_fa Or_R W_2R)\n have f2: \"\\d (a \\\\<^sub>0 B)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \"\n by (simp add: AderivesA D_IL2_b Fdiam0_L Fdiam0_R Id_fa Or_R W_1R)\n show ?thesis\n using C_R Or_L f1 f2 by blast\nqed\n \nlemma c10_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nsledgehammer\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (A \\\\<^sub>F B)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \"\n by (simp add: AderivesA DH_fdiam0_b DH_fdiam0_f Fdiam0_R Id_fa Mon_bbox0 Or_L Or_R)\n then show ?thesis\n by (simp add: DH_bdiam0_b DH_fdiam0_b DH_fdiam0_f D_IR1_b D_IR1_f E_L FS_bbox0 Fbox0_L Fdiam0_L W_2L derivable.intros(3))\nqed\n\nlemma c10_b: \"\\d (a \\\\<^sub>0 \\)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>S ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nby (meson DH_bdiam0_f DH_fdiam0_f FS_bdiam0 Fbox0_R Fdiam0_R IW_L Id_fa Top_R W_2R)\n\nlemma c11_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B)))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (A \\\\<^sub>F B)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B)))\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA Balance Conj_fdiam0 DH_bdiam0_b D_IR1_b D_IR1_f Fdiam0_L Fdiam0_R Id_fa ImpR_L ImpR_R)\n then show ?thesis\n by (meson And_R C_L Fdiam0_L Fdiam0_R IW_L Id_fa Top_R)\nqed\n\nlemma c11_b: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B)))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M) \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA Balance DH_bdiam0_b FS_fbox0 Fdiam0_L Fdiam0_R Id_fa ImpR_L ImpR_R)\n then show ?thesis\n by (simp add: And_L DH_fdiam0_b DH_fdiam0_f D_IR1_b E_L FS_bbox0 Fdiam0_L W_2L)\nqed\n\nlemma c12_f: \"\\d (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (A)\\<^sub>S\\<^sub>F\\<^sub>M) \\\\<^sub>S (a \\\\<^sub>0 B)\\<^sub>S\\<^sub>F\\<^sub>M)\"\n by (simp add: AderivesA Balance DH_bdiam0_b DH_fdiam0_f FS_bbox0 Fbox0_L Fdiam0_R Id_fa ImpR_L)\n then show ?thesis\n by (simp add: Conj_fdiam0 DH_fdiam0_b D_IR1_b D_IR1_f E_L Fdiam0_L ImpR_R Mon_fdiam0)\nqed\n\nlemma c12_b: \"\\d ((a \\\\<^sub>0 A) \\\\<^sub>F (a \\\\<^sub>0 B))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (A \\\\<^sub>F B))\\<^sub>S\\<^sub>F\\<^sub>M\"\nby (simp add: AderivesA Balance DH_bdiam0_b DH_bdiam0_f FS_fbox0 Fbox0_R Fdiam0_L Fdiam0_R Id_fa ImpR_L ImpR_R)\n\nlemma c13: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F (ag \\\\<^sub>2 ((ag \\\\<^sub>3 a) \\\\<^sub>1 A)))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M \"\nproof - \n have \"\\d (A)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\\\<^sub>0 ( ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M)\"\n by (simp add: AderivesA DH_fdiam0_f DH_fdiam2_f Fdiam0_R Fdiam2_R Id_ag Id_fa)\n then have \"\\d ((ag \\\\<^sub>3 a) \\\\<^sub>1 A)\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S I\\<^sub>S) \\\\<^sub>S (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M)\"\n using Bdiam3_L DH_bla1_b DH_bla1_f DH_fdiam1_b Fdiam1_L Swapin_R by blast\n then show ?thesis\n by (meson And_L DH_fdiam0_b DH_fdiam0_f DH_fdiam2_b D_IL1_b D_IL1_f D_IR1_b Fdiam0_L Fdiam2_L IW_L)\nqed\n\nlemma c14: \"\\d (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F (ag \\\\<^sub>2 ((ag \\\\<^sub>3 a) \\\\<^sub>1 A )))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof - \n have \"\\d ((ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>3\\<^sub>S (a)\\<^sub>S\\<^sub>F\\<^sub>A) \\\\<^sub>1\\<^sub>S ((ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S I\\<^sub>S) ;\\<^sub>S (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M)) \\\\<^sub>F\\<^sub>M (A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA DH_bdiam0_b DH_bdiam2_b Fbox0_L Fbox2_L Id_ag Id_fa Swapin_L)\n then show ?thesis\n by (meson Bdiam3_L DH_bdiam1_f DH_bdiam2_f DH_fdiam0_b DH_fdiam0_f DH_wla1_b DH_wla1_f D_IL1_b D_IL1_f D_IR1_f Fbox1_R Fbox2_R Fdiam0_L IW_L ImpR_R)\nqed\n\nlemma c15: \"\\d (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M ((a \\\\<^sub>0 \\) \\\\<^sub>F (ag \\\\<^sub>2 ((ag \\\\<^sub>3 a) \\\\<^sub>1 A )))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (ag \\\\<^sub>2 A)\\<^sub>S\\<^sub>F\\<^sub>M)) \\\\<^sub>F\\<^sub>M (A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (simp add: AderivesA Balance DH_bdiam0_b DH_bdiam2_b Fbox2_L Id_ag)\n then have \"\\d (ag \\\\<^sub>3 a)\\<^sub>S\\<^sub>A\\<^sub>C \\\\<^sub>1\\<^sub>S ((ag)\\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S (((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S I\\<^sub>S) ;\\<^sub>S ((a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (ag \\\\<^sub>2 A)\\<^sub>S\\<^sub>F\\<^sub>M))) \\\\<^sub>F\\<^sub>M (A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n using Bdiam3_L DH_wla1_b DH_wla1_f Swapin_L \\\\d ag \\<^sub>S\\<^sub>A\\<^sub>G \\\\<^sub>2\\<^sub>S (a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (a \\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (ag \\\\<^sub>2 A) \\<^sub>S\\<^sub>F\\<^sub>M)) \\\\<^sub>F\\<^sub>M A \\<^sub>S\\<^sub>F\\<^sub>M\\ by blast\n then show ?thesis\n by (metis And_R DH_bdiam1_f DH_bdiam2_f DH_fdiam0_b DH_fdiam0_f D_IL1_f Fbox1_R Fbox2_R Fdiam0_L Fdiam0_R I_1L_b Id_fa Mon_fdiam0 Top_R)\nqed\n\nlemma c16: \"\\d ((a \\\\<^sub>0 \\) \\\\<^sub>F (ag \\\\<^sub>2 ((ag \\\\<^sub>3 a) \\\\<^sub>1 A)))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (a \\\\<^sub>0 (ag \\\\<^sub>2 A))\\<^sub>S\\<^sub>F\\<^sub>M\"\nproof -\n have \"\\d (a)\\<^sub>S\\<^sub>F\\<^sub>A \\\\<^sub>0\\<^sub>S (ag \\\\<^sub>2 ((ag \\\\<^sub>3 a) \\\\<^sub>1 A ))\\<^sub>S\\<^sub>F\\<^sub>M \\\\<^sub>F\\<^sub>M (ag \\\\<^sub>2 A)\\<^sub>S\\<^sub>F\\<^sub>M\"\n by (meson AderivesA Bdiam3_R DH_bdiam1_b DH_bdiam2_b DH_bdiam2_f Fbox1_L Fbox2_L Fbox2_R Id_ag Id_fa Swapout_L)\n then show ?thesis\n by (simp add: And_L DH_fdiam0_b DH_fdiam0_f D_IR1_b E_L FS_bbox0 Fdiam0_L Fdiam0_R Id_fa W_2L)\nqed", "meta": {"author": "NikolasTzimoulis", "repo": "MultitypeDEL", "sha": "073462621e6c6b94a97141c7fbc1554544f2d554", "save_path": "github-repos/isabelle/NikolasTzimoulis-MultitypeDEL", "path": "github-repos/isabelle/NikolasTzimoulis-MultitypeDEL/MultitypeDEL-073462621e6c6b94a97141c7fbc1554544f2d554/MDEAK_examples_completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926666143433998, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.2709296702542089}} {"text": "(* Title: ZF/UNITY/ClientImpl.thy\n Author: Sidi O Ehmety, Cambridge University Computer Laboratory\n Copyright 2002 University of Cambridge\n\nDistributed Resource Management System: Client Implementation.\n*)\n\ntheory ClientImpl imports AllocBase Guar begin\n\nabbreviation \"ask \\ Var(Nil)\" (* input history: tokens requested *)\nabbreviation \"giv \\ Var([0])\" (* output history: tokens granted *)\nabbreviation \"rel \\ Var([1])\" (* input history: tokens released *)\nabbreviation \"tok \\ Var([2])\" (* the number of available tokens *)\n\naxiomatization where\n type_assumes:\n \"type_of(ask) = list(tokbag) \\ type_of(giv) = list(tokbag) \\\n type_of(rel) = list(tokbag) \\ type_of(tok) = nat\" and\n default_val_assumes:\n \"default_val(ask) = Nil \\ default_val(giv) = Nil \\\n default_val(rel) = Nil \\ default_val(tok) = 0\"\n\n\n(*Array indexing is translated to list indexing as A[n] \\ nth(n-1,A). *)\n\ndefinition\n (** Release some client_tokens **)\n \"client_rel_act \\\n {\\s,t\\ \\ state*state.\n \\nrel \\ nat. nrel = length(s`rel) \\\n t = s(rel:=(s`rel)@[nth(nrel, s`giv)]) \\\n nrel < length(s`giv) \\\n nth(nrel, s`ask) \\ nth(nrel, s`giv)}\"\n\n (** Choose a new token requirement **)\n (** Including t=s suppresses fairness, allowing the non-trivial part\n of the action to be ignored **)\ndefinition\n \"client_tok_act \\ {\\s,t\\ \\ state*state. t=s |\n t = s(tok:=succ(s`tok mod NbT))}\"\n\ndefinition\n \"client_ask_act \\ {\\s,t\\ \\ state*state. t=s | (t=s(ask:=s`ask@[s`tok]))}\"\n\ndefinition\n \"client_prog \\\n mk_program({s \\ state. s`tok \\ NbT \\ s`giv = Nil \\\n s`ask = Nil \\ s`rel = Nil},\n {client_rel_act, client_tok_act, client_ask_act},\n \\G \\ preserves(lift(rel)) Int\n preserves(lift(ask)) Int\n preserves(lift(tok)). Acts(G))\"\n\n\ndeclare type_assumes [simp] default_val_assumes [simp]\n(* This part should be automated *)\n\nlemma ask_value_type [simp,TC]: \"s \\ state \\ s`ask \\ list(nat)\"\n unfolding state_def\napply (drule_tac a = ask in apply_type, auto)\ndone\n\nlemma giv_value_type [simp,TC]: \"s \\ state \\ s`giv \\ list(nat)\"\n unfolding state_def\napply (drule_tac a = giv in apply_type, auto)\ndone\n\nlemma rel_value_type [simp,TC]: \"s \\ state \\ s`rel \\ list(nat)\"\n unfolding state_def\napply (drule_tac a = rel in apply_type, auto)\ndone\n\nlemma tok_value_type [simp,TC]: \"s \\ state \\ s`tok \\ nat\"\n unfolding state_def\napply (drule_tac a = tok in apply_type, auto)\ndone\n\n(** The Client Program **)\n\nlemma client_type [simp,TC]: \"client_prog \\ program\"\n unfolding client_prog_def\napply (simp (no_asm))\ndone\n\ndeclare client_prog_def [THEN def_prg_Init, simp]\ndeclare client_prog_def [THEN def_prg_AllowedActs, simp]\ndeclare client_prog_def [program]\n\ndeclare client_rel_act_def [THEN def_act_simp, simp]\ndeclare client_tok_act_def [THEN def_act_simp, simp]\ndeclare client_ask_act_def [THEN def_act_simp, simp]\n\nlemma client_prog_ok_iff:\n \"\\G \\ program. (client_prog ok G) \\\n (G \\ preserves(lift(rel)) \\ G \\ preserves(lift(ask)) \\\n G \\ preserves(lift(tok)) \\ client_prog \\ Allowed(G))\"\nby (auto simp add: ok_iff_Allowed client_prog_def [THEN def_prg_Allowed])\n\nlemma client_prog_preserves:\n \"client_prog:(\\x \\ var-{ask, rel, tok}. preserves(lift(x)))\"\napply (rule Inter_var_DiffI, force)\napply (rule ballI)\napply (rule preservesI, safety, auto)\ndone\n\n\nlemma preserves_lift_imp_stable:\n \"G \\ preserves(lift(ff)) \\ G \\ stable({s \\ state. P(s`ff)})\"\napply (drule preserves_imp_stable)\napply (simp add: lift_def)\ndone\n\nlemma preserves_imp_prefix:\n \"G \\ preserves(lift(ff))\n \\ G \\ stable({s \\ state. \\k, s`ff\\ \\ prefix(nat)})\"\nby (erule preserves_lift_imp_stable)\n\n(*Safety property 1 \\ ask, rel are increasing: (24) *)\nlemma client_prog_Increasing_ask_rel:\n\"client_prog: program guarantees Incr(lift(ask)) \\ Incr(lift(rel))\"\n unfolding guar_def\napply (auto intro!: increasing_imp_Increasing\n simp add: client_prog_ok_iff Increasing.increasing_def preserves_imp_prefix)\napply (safety, force, force)+\ndone\n\ndeclare nth_append [simp] append_one_prefix [simp]\n\nlemma NbT_pos2: \"0 the client never requests too many tokens.\nWith no Substitution Axiom, we must prove the two invariants simultaneously. *)\n\nlemma ask_Bounded_lemma:\n\"\\client_prog ok G; G \\ program\\\n \\ client_prog \\ G \\\n Always({s \\ state. s`tok \\ NbT} \\\n {s \\ state. \\elt \\ set_of_list(s`ask). elt \\ NbT})\"\napply (rotate_tac -1)\napply (auto simp add: client_prog_ok_iff)\napply (rule invariantI [THEN stable_Join_Always2], force)\n prefer 2\n apply (fast intro: stable_Int preserves_lift_imp_stable, safety)\napply (auto dest: ActsD)\napply (cut_tac NbT_pos)\napply (rule NbT_pos2 [THEN mod_less_divisor])\napply (auto dest: ActsD preserves_imp_eq simp add: set_of_list_append)\ndone\n\n(* Export version, with no mention of tok in the postcondition, but\n unfortunately tok must be declared local.*)\nlemma client_prog_ask_Bounded:\n \"client_prog \\ program guarantees\n Always({s \\ state. \\elt \\ set_of_list(s`ask). elt \\ NbT})\"\napply (rule guaranteesI)\napply (erule ask_Bounded_lemma [THEN Always_weaken], auto)\ndone\n\n(*** Towards proving the liveness property ***)\n\nlemma client_prog_stable_rel_le_giv:\n \"client_prog \\ stable({s \\ state. \\ prefix(nat)})\"\nby (safety, auto)\n\nlemma client_prog_Join_Stable_rel_le_giv:\n\"\\client_prog \\ G \\ Incr(lift(giv)); G \\ preserves(lift(rel))\\\n \\ client_prog \\ G \\ Stable({s \\ state. \\ prefix(nat)})\"\napply (rule client_prog_stable_rel_le_giv [THEN Increasing_preserves_Stable])\napply (auto simp add: lift_def)\ndone\n\nlemma client_prog_Join_Always_rel_le_giv:\n \"\\client_prog \\ G \\ Incr(lift(giv)); G \\ preserves(lift(rel))\\\n \\ client_prog \\ G \\ Always({s \\ state. \\ prefix(nat)})\"\nby (force intro!: AlwaysI client_prog_Join_Stable_rel_le_giv)\n\nlemma def_act_eq:\n \"A \\ {\\s, t\\ \\ state*state. P(s, t)} \\ A={\\s, t\\ \\ state*state. P(s, t)}\"\nby auto\n\nlemma act_subset: \"A={\\s,t\\ \\ state*state. P(s, t)} \\ A<=state*state\"\nby auto\n\nlemma transient_lemma:\n\"client_prog \\\n transient({s \\ state. s`rel = k \\ \\k, h\\ \\ strict_prefix(nat)\n \\ \\ prefix(nat) \\ h pfixGe s`ask})\"\napply (rule_tac act = client_rel_act in transientI)\napply (simp (no_asm) add: client_prog_def [THEN def_prg_Acts])\napply (simp (no_asm) add: client_rel_act_def [THEN def_act_eq, THEN act_subset])\napply (auto simp add: client_prog_def [THEN def_prg_Acts] domain_def)\napply (rule ReplaceI)\napply (rule_tac x = \"x (rel:= x`rel @ [nth (length (x`rel), x`giv) ]) \" in exI)\napply (auto intro!: state_update_type app_type length_type nth_type, auto)\napply (blast intro: lt_trans2 prefix_length_le strict_prefix_length_lt)\napply (blast intro: lt_trans2 prefix_length_le strict_prefix_length_lt)\napply (simp (no_asm_use) add: gen_prefix_iff_nth)\napply (subgoal_tac \"h \\ list(nat)\")\n apply (simp_all (no_asm_simp) add: prefix_type [THEN subsetD, THEN SigmaD1])\napply (auto simp add: prefix_def Ge_def)\napply (drule strict_prefix_length_lt)\napply (drule_tac x = \"length (x`rel) \" in spec)\napply auto\napply (simp (no_asm_use) add: gen_prefix_iff_nth)\napply (auto simp add: id_def lam_def)\ndone\n\nlemma strict_prefix_is_prefix:\n \"\\xs, ys\\ \\ strict_prefix(A) \\ \\xs, ys\\ \\ prefix(A) \\ xs\\ys\"\n unfolding strict_prefix_def id_def lam_def\napply (auto dest: prefix_type [THEN subsetD])\ndone\n\nlemma induct_lemma:\n\"\\client_prog \\ G \\ Incr(lift(giv)); client_prog ok G; G \\ program\\\n \\ client_prog \\ G \\\n {s \\ state. s`rel = k \\ \\k,h\\ \\ strict_prefix(nat)\n \\ \\ prefix(nat) \\ h pfixGe s`ask}\n \\w {s \\ state. \\ strict_prefix(nat)\n \\ \\ prefix(nat) \\\n \\ prefix(nat) \\\n h pfixGe s`ask}\"\napply (rule single_LeadsTo_I)\n prefer 2 apply simp\napply (frule client_prog_Increasing_ask_rel [THEN guaranteesD])\napply (rotate_tac [3] 2)\napply (auto simp add: client_prog_ok_iff)\napply (rule transient_lemma [THEN Join_transient_I1, THEN transient_imp_leadsTo, THEN leadsTo_imp_LeadsTo, THEN PSP_Stable, THEN LeadsTo_weaken])\napply (rule Stable_Int [THEN Stable_Int, THEN Stable_Int])\napply (erule_tac f = \"lift (giv) \" and a = \"s`giv\" in Increasing_imp_Stable)\napply (simp (no_asm_simp))\napply (erule_tac f = \"lift (ask) \" and a = \"s`ask\" in Increasing_imp_Stable)\napply (simp (no_asm_simp))\napply (erule_tac f = \"lift (rel) \" and a = \"s`rel\" in Increasing_imp_Stable)\napply (simp (no_asm_simp))\napply (erule client_prog_Join_Stable_rel_le_giv, blast, simp_all)\n prefer 2\n apply (blast intro: sym strict_prefix_is_prefix [THEN iffD2] prefix_trans prefix_imp_pfixGe pfixGe_trans)\napply (auto intro: strict_prefix_is_prefix [THEN iffD1, THEN conjunct1]\n prefix_trans)\ndone\n\nlemma rel_progress_lemma:\n\"\\client_prog \\ G \\ Incr(lift(giv)); client_prog ok G; G \\ program\\\n \\ client_prog \\ G \\\n {s \\ state. \\ strict_prefix(nat)\n \\ \\ prefix(nat) \\ h pfixGe s`ask}\n \\w {s \\ state. \\ prefix(nat)}\"\napply (rule_tac f = \"\\x \\ state. length(h) #- length(x`rel)\"\n in LessThan_induct)\napply (auto simp add: vimage_def)\n prefer 2 apply (force simp add: lam_def)\napply (rule single_LeadsTo_I)\n prefer 2 apply simp\napply (subgoal_tac \"h \\ list(nat)\")\n prefer 2 apply (blast dest: prefix_type [THEN subsetD])\napply (rule induct_lemma [THEN LeadsTo_weaken])\n apply (simp add: length_type lam_def)\napply (auto intro: strict_prefix_is_prefix [THEN iffD2]\n dest: common_prefix_linear prefix_type [THEN subsetD])\napply (erule swap)\napply (rule imageI)\n apply (force dest!: simp add: lam_def)\napply (simp add: length_type lam_def, clarify)\napply (drule strict_prefix_length_lt)+\napply (drule less_imp_succ_add, simp)+\napply clarify\napply simp\napply (erule diff_le_self [THEN ltD])\ndone\n\nlemma progress_lemma:\n\"\\client_prog \\ G \\ Incr(lift(giv)); client_prog ok G; G \\ program\\\n \\ client_prog \\ G\n \\ {s \\ state. \\ prefix(nat) \\ h pfixGe s`ask}\n \\w {s \\ state. \\ prefix(nat)}\"\napply (rule client_prog_Join_Always_rel_le_giv [THEN Always_LeadsToI],\n assumption)\napply (force simp add: client_prog_ok_iff)\napply (rule LeadsTo_weaken_L)\napply (rule LeadsTo_Un [OF rel_progress_lemma\n subset_refl [THEN subset_imp_LeadsTo]])\napply (auto intro: strict_prefix_is_prefix [THEN iffD2]\n dest: common_prefix_linear prefix_type [THEN subsetD])\ndone\n\n(*Progress property: all tokens that are given will be released*)\nlemma client_prog_progress:\n\"client_prog \\ Incr(lift(giv)) guarantees\n (\\h \\ list(nat). {s \\ state. \\ prefix(nat) \\\n h pfixGe s`ask} \\w {s \\ state. \\ prefix(nat)})\"\napply (rule guaranteesI)\napply (blast intro: progress_lemma, auto)\ndone\n\nlemma client_prog_Allowed:\n \"Allowed(client_prog) =\n preserves(lift(rel)) \\ preserves(lift(ask)) \\ preserves(lift(tok))\"\napply (cut_tac v = \"lift (ask)\" in preserves_type)\napply (auto simp add: Allowed_def client_prog_def [THEN def_prg_Allowed]\n cons_Int_distrib safety_prop_Acts_iff)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/UNITY/ClientImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.2709296636763177}} {"text": "section{*HBD Translation Algorithms that use Feedback Composition*}\n\n(* Was: AlgorithmFeedback.thy *)\n\ntheory HBDTranslationsUsingFeedback imports HBDTranslationProperties \"Refinement\"\nbegin\n \ncontext BaseOperationVars\nbegin\n\n (*The nondeterministic Algorithm that uses the feedback, serial, and parallel operations*)\n definition \"TranslateHBD = \n while_stm (\\ As . length As > 1)(\n [:As \\ As' . \\ Bs Cs . 1 < length Bs \\ perm As (Bs @ Cs) \\ As' = FB (Parallel_list Bs) # Cs:]\n \\\n [:As \\ As' . \\ A B Bs . perm As (A # B # Bs) \\ As' = (FB (FB A ;; FB B)) # Bs:]\n )\n o [-(\\ As . FB(As ! 0))-]\"\n\n\n \n\n definition \"invariant As_init n As = (length As = n \\ io_distinct As \\ in_out_equiv (FB (Parallel_list As)) (FB (Parallel_list As_init)) \\ n \\ 1)\"\n\n lemma io_diagram_Parallel_list: \"\\ A \\ set As . io_diagram A \\ distinct (concat (map Out As)) \\ io_diagram (Parallel_list As)\"\n proof (induction As)\n case Nil\n from Nil show ?case by simp\n next\n case (Cons A As)\n show ?case\n apply (simp)\n apply (rule io_diagram_Parallel)\n using Cons(2) apply simp\n using Cons apply simp\n using Cons(3) apply auto\n by (simp add: Out_Parallel)\n qed\n\n lemma io_diagram_Parallel_list_a: \"io_distinct As \\ io_diagram (Parallel_list As)\"\n apply (rule_tac io_diagram_Parallel_list)\n by (simp_all add: io_distinct_def)\n\n\n thm Parallel_list_cons\n\n thm Parallel_assoc_gen\n\n thm ParallelId_left\n thm io_diagram_Parallel_list\n\nlemma Parallel_list_append: \"\\ A \\ set As . io_diagram A \\ distinct (concat (map Out As)) \\ \\ A \\ set Bs . io_diagram A \n \\ distinct (concat (map Out Bs))\\ \n Parallel_list (As @ Bs) = Parallel_list As ||| Parallel_list Bs\"\n proof (induction As)\n case Nil\n from Nil show ?case\n apply (simp )\n apply (subst ParallelId_left, simp_all)\n by (rule io_diagram_Parallel_list, simp_all)\n next\n case (Cons A As)\n from Cons show ?case\n apply simp\n apply (subst Parallel_assoc_gen, simp_all)\n apply (rule io_diagram_Parallel_list, simp_all)\n by (rule io_diagram_Parallel_list, simp_all)\n qed\n \n primrec sequence :: \"nat \\ nat list\" where\n \"sequence 0 = []\" |\n \"sequence (Suc n) = sequence n @ [n]\"\n\n lemma \"sequence (Suc (Suc 0)) = [0,1]\"\n by auto\n\n lemma in_out_equiv_io_diagram[simp]: \"in_out_equiv A B \\ io_diagram B \\ io_diagram A\"\n apply (unfold io_diagram_def)\n apply (simp add: in_out_equiv_def, safe)\n using dist_perm perm_sym apply blast\n using dist_perm perm_sym by blast\n\n thm comp_parallel_distrib\n\n lemma in_out_equiv_Parallel_cong_right: \"io_diagram A \\ io_diagram C \\ set (Out A) \\ set (Out B) = {} \\ in_out_equiv B C \n \\ in_out_equiv (A ||| B) (A ||| C)\"\n proof -\n assume \"io_diagram A\"\n from this have [simp]: \"TVs (In A) = TI (Trs A)\" and [simp]: \" TVs (Out A) = TO (Trs A)\" and [simp]: \"distinct (In A)\" and [simp]: \"distinct (Out A)\"\n by (unfold io_diagram_def, simp_all)\n assume A: \"io_diagram C\"\n from this have [simp]: \"TVs (In C) = TI (Trs C)\" and [simp]: \" TVs (Out C) = TO (Trs C)\" and [simp]: \"distinct (In C)\" and [simp]: \"distinct (Out C)\"\n by (unfold io_diagram_def, simp_all)\n assume \"set (Out A) \\ set (Out B) = {}\"\n assume B: \"in_out_equiv B C\"\n from this have [simp]: \"perm (In B) (In C)\" and [simp]: \"perm (Out B) (Out C)\" and [simp]: \"Trs B = [In B \\ In C] oo Trs C oo [Out C \\ Out B]\"\n by (simp_all add: in_out_equiv_def)\n\n from A and B have \"io_diagram B\"\n by simp\n from this have [simp]: \"TVs (In B) = TI (Trs B)\" and [simp]: \" TVs (Out B) = TO (Trs B)\" and [simp]: \"distinct (In B)\" and [simp]: \"distinct (Out B)\"\n by (unfold io_diagram_def, simp_all)\n\n have [simp]: \"[In A \\ In B \\ In A \\ In C] oo ([In A \\ In C \\ In A @ In C] oo (parallel (Trs A) (Trs C))) oo [Out A @ Out C \\ Out A @ Out B] = \n [In A \\ In B \\ In A \\ In C] oo [In A \\ In C \\ In A @ In C] oo parallel (Trs A) (Trs C) oo [Out A @ Out C \\ Out A @ Out B]\"\n by (simp add: comp_assoc)\n have [simp]: \"... = [In A \\ In B \\ In A @ In C] oo parallel (Trs A) (Trs C) oo [Out A @ Out C \\ Out A @ Out B]\"\n by (subst switch_comp, simp_all)\n have \"[In A \\ In B \\ In A @ In B] oo parallel (Trs A) ([In B \\ In C] oo Trs C oo [Out C \\ Out B]) \n = [In A \\ In B \\ In A @ In B] oo parallel ([In A \\ In A] oo Trs A oo [Out A \\ Out A]) ([In B \\ In C] oo Trs C oo [Out C \\ Out B])\"\n by simp\n also have \"... = [In A \\ In B \\ In A @ In B] oo (\n parallel [In A \\ In A] [In B \\ In C] oo parallel (Trs A) (Trs C) oo parallel [Out A \\ Out A] [Out C \\ Out B])\"\n apply (subst comp_parallel_distrib [THEN sym])\n apply simp_all [2]\n apply (subst comp_parallel_distrib [THEN sym])\n by simp_all\n also have \" ... = [In A \\ In B \\ In A @ In B] oo (\n parallel [In A \\ In A] [In B \\ In C] oo parallel (Trs A) (Trs C) oo[Out A @ Out C \\ Out A @ Out B])\"\n by (metis \\distinct (Out A)\\ \\distinct (Out C)\\ \\perm (Out B) (Out C)\\ \\set (Out A) \\ set (Out B) = {}\\ distinct_append order_refl par_switch perm_set_eq)\n also have \"... = [In A \\ In B \\ In A @ In B] oo parallel [In A \\ In A] [In B \\ In C] \n oo parallel (Trs A) (Trs C) oo[Out A @ Out C \\ Out A @ Out B]\"\n apply (subst comp_assoc, simp_all)\n apply (subst comp_assoc)\n apply (subst TI_par)\n using TI_switch TO_switch TVs_append apply presburger\n apply simp\n apply (subst comp_assoc)\n using TI_comp TI_par TI_switch TO_par TO_switch TVs_append \\TVs (In A) = TI (Trs A)\\ \\TVs (In C) = TI (Trs C)\\ apply presburger\n apply simp\n by (subst comp_assoc, simp_all)\n\n also have \"... = [In A \\ In B \\ In A @ In C] oo parallel (Trs A) (Trs C) oo[Out A @ Out C \\ Out A @ Out B]\"\n by (simp add: Trs_Parallel_list_aux_b)\n \n finally show \"in_out_equiv (A ||| B) (A ||| C)\"\n by (simp add: in_out_equiv_def Parallel_def)\n qed\n\n lemma perm_map: \"perm x y \\ perm (map f x) (map f y)\"\n by (simp add: perm_mset)\n\n\n lemma distinct_concat_perm: \"\\ Y . distinct (concat X) \\ perm X Y \\ distinct (concat Y)\"\n proof (induction X)\n case Nil\n from Nil show ?case by simp\n next\n case (Cons a X)\n from Cons(3) obtain A B where [simp]: \"Y = A @ a #B\" and [simp]: \"perm X (A @ B)\"\n by (simp add: split_perm, blast)\n from Cons(1) have \"distinct (concat X) \\ perm X (A @ B) \\ distinct (concat (A @ B)) \"\n by blast\n from this and Cons(2) have A: \"distinct (concat (A @ B))\" by simp\n from Cons(2) have \"distinct (concat X)\" by simp\n from Cons(2) have [simp]: \"distinct a\" by simp\n have \"set (X) = set (A @ B)\"\n using \\perm X (A @ B)\\ perm_set_eq by blast\n from this and Cons(2) show ?case\n using A apply simp\n by auto\n qed\n\n lemma distinct_Par_equiv_a: \"\\ Bs . \\ A \\ set As . io_diagram A \\ distinct (concat (map Out As)) \\ perm As Bs \\\n in_out_equiv (Parallel_list As) (Parallel_list Bs)\"\n \n proof (induction As)\n case Nil\n from \\perm [] Bs\\ show ?case\n apply (simp)\n by (rule in_out_equiv_refl, simp)\n next\n case (Cons A As)\n have \"A \\ set Bs\"\n using Cons.prems(3) perm_set_eq by fastforce\n from this obtain Cs Ds where A: \"Bs = Cs @ A # Ds\"\n by (metis split_list)\n\n have [simp]: \" perm As (Ds @ Cs)\"\n using Cons(4) and A\n by (simp add: perm_mset)\n\n have [simp]: \"\\ A \\ set Cs . io_diagram A\"\n using A Cons.prems(1) Cons.prems(3) perm_set_eq by fastforce\n have [simp]: \"\\ A \\ set Ds . io_diagram A\"\n using A Cons.prems(1) Cons.prems(3) perm_set_eq by fastforce\n have B: \"distinct (concat (map Out Bs))\"\n apply (rule distinct_concat_perm)\n apply (rule Cons(3))\n apply (rule perm_map)\n using Cons(4) by simp\n from this and A have [simp]: \"distinct (concat (map Out Cs))\"\n by simp\n from B and A have [simp]: \"distinct (concat (map Out Ds))\"\n by simp\n have [simp]: \"io_diagram A\"\n using Cons(2) by simp\n from this have [simp]: \"distinct (Out A)\"\n by (unfold io_diagram_def, simp)\n have [simp]: \" io_diagram (Parallel_list Ds)\"\n by (rule io_diagram_Parallel_list, simp_all)\n have [simp]: \"io_diagram (Parallel_list Cs)\"\n by (rule io_diagram_Parallel_list, simp_all)\n have [simp]: \"set (Out A) \\ set (Out (Parallel_list As)) = {}\"\n using Cons(3) by (simp add: Out_Parallel)\n have [simp]: \"\\ A \\ set As . io_diagram A\"\n using Cons(2) by simp\n have [simp]:\"distinct (concat (map Out As))\"\n using Cons(3) by simp\n\n from B and A have [simp]: \"set (Out A) \\ (\\a\\set Ds. set (Out a)) = {}\"\n by simp\n have [simp]: \"set (Out A) \\ set (Out (Parallel_list Ds)) = {}\"\n by (simp add: Out_Parallel)\n\n from B and A have [simp]: \"set (Out (Parallel_list Ds)) \\ set (Out (Parallel_list Cs)) = {}\"\n by (simp add: Out_Parallel, auto)\n\n from B and A have [simp]: \"set (Out (Parallel_list Cs)) \\ set (Out A) = {}\"\n by (simp add: Out_Parallel)\n\n from B and A have [simp]: \"set (Out (Parallel_list Cs)) \\ set (Out (Parallel_list Ds)) = {}\"\n by (simp add: Out_Parallel)\n\n from B and A have [simp]:\"(set (Out A) \\ set (Out (Parallel_list Ds))) \\ set (Out (Parallel_list Cs)) = {}\"\n by (simp add: Out_Parallel, auto)\n have [simp]:\"io_diagram (A ||| Parallel_list Ds)\"\n by (rule io_diagram_Parallel, simp_all)\n from Cons(1)\n have \"in_out_equiv (Parallel_list As) (Parallel_list (Ds @ Cs))\"\n by simp\n from this have [simp]: \"in_out_equiv (Parallel_list As) (Parallel_list Ds ||| (Parallel_list Cs))\"\n by (simp add: Parallel_list_append)\n have [simp]:\"io_diagram (Parallel_list Ds ||| Parallel_list Cs)\"\n by (rule io_diagram_Parallel, simp_all)\n have [simp]: \"io_diagram (Parallel_list As)\"\n by (rule io_diagram_Parallel_list, simp_all)\n have [simp]: \"io_diagram (A ||| Parallel_list As)\"\n by (rule io_diagram_Parallel, simp_all)\n have [simp]: \"io_diagram (A ||| Parallel_list Ds ||| Parallel_list Cs)\"\n by (rule io_diagram_Parallel, simp_all)\n have [simp]: \"io_diagram (Parallel_list Cs ||| (A ||| Parallel_list Ds))\"\n by (rule io_diagram_Parallel, simp_all)\n\n from A show ?case\n apply (simp_all add: Parallel_list_append)\n apply (rule_tac B = \"(A ||| Parallel_list Ds) ||| Parallel_list Cs\" in in_out_equiv_tran, simp_all)\n apply (subst Parallel_assoc_gen, simp_all)\n apply (rule in_out_equiv_Parallel_cong_right, simp_all)\n by (rule in_out_equiv_Parallel, simp_all)\n qed\n\n thm distinct_concat_perm\n thm perm_map\n\n lemma distinct_FB: \"distinct (In A) \\ distinct (In (FB A))\"\n by (simp add: FB_def Let_def)\n\n lemma io_distinct_FB_cat: \"io_distinct (A # Cs) \\ io_distinct (FB A # Cs)\"\n apply (simp add: io_distinct_def)\n apply safe\n apply (simp_all add: FB_def Let_def set_diff) [4]\n apply auto [2]\n by (rule Type_ok_FB, simp)\n\n lemma io_distinct_perm: \"io_distinct As \\ perm As Bs \\ io_distinct Bs\"\n apply (simp add: io_distinct_def)\n apply safe\n apply (rule distinct_concat_perm)\n apply (simp_all)\n apply (rule perm_map, simp)\n apply (rule_tac X = \"map Out As\" in distinct_concat_perm, simp_all)\n apply (rule perm_map, simp)\n using perm_set_eq by blast\n\n lemma [simp]: \"distinct (concat X) \\ op_list [] (\\) (X) = concat X\"\n apply (induction X, simp_all)\n by (simp add: addvars_distinct)\n\n lemma [simp]: \"io_distinct As \\ perm As (Bs @ Cs) \\ io_distinct (FB (Parallel_list Bs) # Cs)\"\n apply (rule io_distinct_FB_cat)\n apply (drule_tac Bs = \"Bs @ Cs\" in io_distinct_perm, simp_all)\n apply (simp add: io_distinct_def In_Parallel Out_Parallel)\n apply safe\n by (rule io_diagram_Parallel_list, simp_all)\n\n lemma io_distinct_append_a: \"io_distinct As \\ perm As (Bs @ Cs) \\ io_distinct Bs\"\n apply (drule_tac Bs = \"Bs @ Cs\" in io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n\n lemma io_distinct_append_b: \"io_distinct As \\ perm As (Bs @ Cs) \\ io_distinct Cs\"\n apply (drule_tac Bs = \"Bs @ Cs\" in io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n\n lemma [simp]: \"io_distinct As \\ perm As (Bs @ Cs) \\ io_diagram (FB (FB (Parallel_list Bs) ||| Parallel_list Cs))\"\n apply (rule Type_ok_FB)\n apply (rule io_diagram_Parallel)\n apply (rule Type_ok_FB)\n apply (drule io_distinct_append_a, simp_all)\n apply (simp add: io_diagram_Parallel_list_a)\n apply (drule io_distinct_append_b, simp_all)\n apply (simp add: io_diagram_Parallel_list_a)\n apply (subgoal_tac \" set (Out ((Parallel_list Bs))) \\ set (Out (Parallel_list Cs)) = {}\")\n apply (subgoal_tac \"set (Out (FB (Parallel_list Bs))) \\ set (Out ((Parallel_list Bs)))\")\n apply auto [1]\n apply (simp add: FB_def Let_def)\n apply (simp add: Out_Parallel)\n apply (drule io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n\n lemma [simp]: \"io_distinct As \\ io_diagram (FB (Parallel_list As))\"\n apply (rule Type_ok_FB)\n by (simp add: io_diagram_Parallel_list_a)\n\n lemma io_distinct_set_In[simp]: \" io_distinct x \\ perm x (A # B # Bs) \\ set (In A) \\ set (In B) = {}\"\n apply (drule io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n\n lemma io_distinct_set_Out[simp]: \" io_distinct x \\ perm x (A # B # Bs) \\ set (Out A) \\ set (Out B) = {}\"\n apply (drule io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n\n lemma distinct_Par_equiv_b: \"io_distinct As \\ perm As (Bs @ Cs) \\ in_out_equiv (FB (FB (Parallel_list Bs) ||| Parallel_list Cs)) (FB (Parallel_list As))\"\n proof -\n assume [simp]: \"io_distinct As\"\n assume [simp]: \"perm As (Bs @ Cs)\"\n have [simp]: \"io_diagram (Parallel_list Bs)\"\n apply (rule io_diagram_Parallel_list_a)\n by (rule_tac As = As and Cs = Cs in io_distinct_append_a, simp_all)\n have [simp]: \"io_diagram (FB (Parallel_list Bs))\"\n by (rule Type_ok_FB, simp)\n have [simp]: \"io_diagram (Parallel_list Cs)\"\n apply (rule io_diagram_Parallel_list_a)\n by (rule_tac As = As and Bs = Bs in io_distinct_append_b, simp_all)\n have [simp]: \"(\\a\\set Bs. set (Out a)) \\ (\\a\\set Cs. set (Out a)) = {}\"\n apply (cut_tac As = As and Bs = \"Bs @ Cs\" in io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n have Aa[simp]: \"set (In (Parallel_list Bs)) \\ set (In (Parallel_list Cs)) = {}\"\n apply (simp add: In_Parallel)\n apply (cut_tac As = As and Bs = \"Bs @ Cs\" in io_distinct_perm, simp_all)\n by (simp add: io_distinct_def)\n have Ab[simp]: \"set (Out (Parallel_list Bs)) \\ set (Out (Parallel_list Cs)) = {}\"\n by (simp add: Out_Parallel)\n have [simp]: \"set (In (FB (Parallel_list Bs))) \\ set (In (Parallel_list Cs)) = {}\"\n apply (subgoal_tac \"set (In ((Parallel_list Bs))) \\ set (In (Parallel_list Cs)) = {}\")\n apply (subgoal_tac \"set (In (FB (Parallel_list Bs))) \\ set (In ((Parallel_list Bs)))\")\n apply (auto simp del: Aa) [1]\n by (auto simp add: FB_def Let_def set_diff)\n \n have [simp]: \"set (Out (FB (Parallel_list Bs))) \\ set (Out (Parallel_list Cs)) = {}\"\n apply (subgoal_tac \"set (Out ((Parallel_list Bs))) \\ set (Out (Parallel_list Cs)) = {}\")\n apply (subgoal_tac \"set (Out (FB (Parallel_list Bs))) \\ set (Out ((Parallel_list Bs)))\")\n apply (auto simp del: Ab) [1]\n by (auto simp add: FB_def Let_def set_diff)\n\n have [simp]:\"Ball (set Bs) io_diagram\"\n apply (cut_tac As = As and Bs = Bs and Cs = Cs in io_distinct_append_a, simp_all)\n by (simp add: io_distinct_def)\n have [simp]:\"Ball (set Cs) io_diagram\"\n apply (cut_tac As = As and Bs = Bs and Cs = Cs in io_distinct_append_b, simp_all)\n by (simp add: io_distinct_def)\n have [simp]:\" distinct (concat (map Out Bs))\"\n apply (cut_tac As = As and Bs = Bs and Cs = Cs in io_distinct_append_a, simp_all)\n by (simp add: io_distinct_def)\n have [simp]:\"distinct (concat (map Out Cs))\"\n apply (cut_tac As = As and Bs = Bs and Cs = Cs in io_distinct_append_b, simp_all)\n by (simp add: io_distinct_def)\n have [simp]:\"io_diagram (Parallel_list As)\"\n by (simp add: io_diagram_Parallel_list_a)\n have A: \"FB (FB (Parallel_list Bs) ;; FB (Parallel_list Cs)) = FB (Parallel_list Bs ||| Parallel_list Cs)\"\n by (subst FeedbackSerial, simp_all)\n show ?thesis\n apply (subst FeedbackSerial, simp_all)\n apply (subst FB_idemp, simp_all)\n apply (simp add: A)\n apply (subst Parallel_list_append [THEN sym], simp_all)\n apply (rule in_out_equiv_FB, simp_all)\n apply (rule distinct_Par_equiv_a, simp_all)\n apply auto [1]\n by (simp add: perm_sym)\n qed\n\n\n lemma distinct_Par_equiv: \"io_distinct As_init \\ Suc 0 \\ length As_init \\\n length As = w \\ io_distinct As \\ in_out_equiv (FB (Parallel_list As)) (FB (Parallel_list As_init)) \\\n Suc 0 < w \\ Suc 0 < length Bs \\ perm As (Bs @ Cs) \\ \n io_distinct (FB (Parallel_list Bs) # Cs) \\ in_out_equiv (FB (FB (Parallel_list Bs) ||| Parallel_list Cs)) (FB (Parallel_list As_init))\"\n apply simp\n apply (rule_tac B = \"FB (Parallel_list As)\" in in_out_equiv_tran, simp_all)\n by (rule distinct_Par_equiv_b, simp_all)\n\nlemma AAAA_x[simp]: \"io_distinct As_init \\ Suc 0 \\ length As_init \\ invariant As_init w x \\ Suc 0 < length x \\ Suc 0 < length Bs \n \\ perm x (Bs @ Cs) \n \\ invariant As_init (Suc (length Cs)) (FB (Parallel_list Bs) # Cs)\"\n by (simp add: invariant_def, safe, simp_all add: distinct_Par_equiv)\n\n term \"{1,2,3} - {2,3}\"\n\n thm ParallelId_right\n\n lemma [simp]: \"io_distinct As_init \\\n Suc 0 \\ length As_init \\ invariant As_init w x \\ Suc 0 < length x \\ perm x (A # B # Bs) \n \\ invariant As_init (Suc (length Bs)) (FB (FB A ;; FB B) # Bs)\"\n apply (subst FeedbackSerial [THEN sym])\n apply (simp_all add: invariant_def)\n apply (drule perm_set_eq, simp add: io_distinct_def) \n apply (drule perm_set_eq, simp add: io_distinct_def)\n apply (rule io_distinct_set_In, simp_all)\n apply (rule io_distinct_set_Out, simp_all)\n apply (cut_tac Bs = \"[A,B]\" and Cs = Bs and w = w in AAAA_x, simp_all)\n apply (simp add: invariant_def)\n apply (simp add: invariant_def)\n apply (subst (asm) ParallelId_right, simp_all)\n apply (drule perm_set_eq, simp add: io_distinct_def) \n apply (subst (asm) ParallelId_right, simp_all)\n by (drule perm_set_eq, simp add: io_distinct_def) \n\n lemma [simp]: \"io_distinct As_init \\ Suc 0 \\ length As_init \\\n Hoare (invariant As_init w \\ (\\As. Suc 0 < length As)) \n [:As\\As'.\\Bs. Suc 0 < length Bs \\ (\\Cs. perm As (Bs @ Cs) \\ As' = FB (Parallel_list Bs) # Cs):] (Sup_less (invariant As_init) w)\"\n apply (rule hoare_demonic, safe)\n apply (simp add: Sup_less_def)\n apply (rule_tac x = \"invariant As_init (Suc (length Cs))\" in exI, safe)\n apply (rule_tac x = \"(Suc (length Cs))\" in exI, simp_all)\n apply (simp add: invariant_def, safe)\n by (drule perm_length, simp)\n\n lemma [simp]: \"io_distinct As_init \\ Suc 0 \\ length As_init \\\n Hoare (invariant As_init w \\ (\\As. Suc 0 < length As)) \n [:As\\As'.\\A B Bs. perm As (A # B # Bs) \\ As' = FB (FB A ;; FB B) # Bs:] (Sup_less (invariant As_init) w)\"\n apply (rule hoare_demonic, safe)\n apply (simp add: Sup_less_def)\n apply (rule_tac x = \"invariant As_init (Suc (length Bs))\" in exI, safe)\n apply (rule_tac x = \"(Suc (length Bs))\" in exI, simp_all)\n apply (simp add: invariant_def, safe)\n apply (drule perm_length, simp)\n done\n\n theorem CorrectnessTranslateHBD: \"io_distinct As_init \\ length As_init \\ 1 \\ \n Hoare (io_distinct \\ (\\ As . As = As_init)) TranslateHBD (\\ S . in_out_equiv S (FB (Parallel_list As_init)))\"\n apply (simp add: TranslateHBD_def)\n apply (simp add: hoare_sequential)\n apply (rule_tac x = \"\\ As . in_out_equiv (FB (As ! 0)) (FB (Parallel_list As_init))\" in exI)\n apply simp\n apply (rule_tac p = \"invariant As_init\" in hoare_while_a, simp_all)\n apply (simp add: hoare_choice, safe)\n apply (simp_all add: invariant_def, safe)\n apply (rule in_out_equiv_refl)\n apply (rule Type_ok_FB)\n apply (rule io_diagram_Parallel_list_a, simp)\n apply (case_tac x, simp)\n apply clarify\n proof -\n fix a list\n assume B: \"in_out_equiv (FB (Parallel_list (a # list))) (FB (Parallel_list As_init))\"\n assume A: \"io_distinct (a # list)\"\n assume \"Suc 0 = length (a # list)\"\n from this have [simp]: \"list = []\"\n by simp\n from A have [simp]: \"io_diagram a\"\n by (simp add: io_distinct_def)\n have [simp]: \"FB (Parallel_list (a # list)) = FB a\"\n by simp\n from B show \"in_out_equiv (FB ((a # list) ! 0)) (FB (Parallel_list As_init))\"\n by simp\n qed\n end\n \nend", "meta": {"author": "hbd-translation", "repo": "TranslateHBD", "sha": "c040d1ce04e4eb163832adea9a7f66566519ffd9", "save_path": "github-repos/isabelle/hbd-translation-TranslateHBD", "path": "github-repos/isabelle/hbd-translation-TranslateHBD/TranslateHBD-c040d1ce04e4eb163832adea9a7f66566519ffd9/HBDTranslationsUsingFeedback.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.270916614685136}} {"text": "header {* \\isaheader{CFG well-formedness} *}\n\ntheory CFG_wf imports CFG begin\n\nlocale CFG_wf = CFG sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\" +\n fixes Def::\"'node \\ 'var set\"\n fixes Use::\"'node \\ 'var set\"\n fixes ParamDefs::\"'node \\ 'var list\"\n fixes ParamUses::\"'node \\ 'var set list\"\n assumes Entry_empty:\"Def (_Entry_) = {} \\ Use (_Entry_) = {}\"\n and ParamUses_call_source_length:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs; (p,ins,outs) \\ set procs\\\n \\ length(ParamUses (sourcenode a)) = length ins\"\n and distinct_ParamDefs:\"valid_edge a \\ distinct (ParamDefs (targetnode a))\"\n and ParamDefs_return_target_length:\n \"\\valid_edge a; kind a = Q'\\\\<^bsub>p\\<^esub>f'; (p,ins,outs) \\ set procs\\\n \\ length(ParamDefs (targetnode a)) = length outs\"\n and ParamDefs_in_Def:\n \"\\valid_node n; V \\ set (ParamDefs n)\\ \\ V \\ Def n\"\n and ins_in_Def:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs; (p,ins,outs) \\ set procs; V \\ set ins\\\n \\ V \\ Def (targetnode a)\"\n and call_source_Def_empty:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\ Def (sourcenode a) = {}\"\n and ParamUses_in_Use:\n \"\\valid_node n; V \\ Union (set (ParamUses n))\\ \\ V \\ Use n\"\n and outs_in_Use:\n \"\\valid_edge a; kind a = Q\\\\<^bsub>p\\<^esub>f; (p,ins,outs) \\ set procs; V \\ set outs\\ \n \\ V \\ Use (sourcenode a)\"\n and CFG_intra_edge_no_Def_equal:\n \"\\valid_edge a; V \\ Def (sourcenode a); intra_kind (kind a); pred (kind a) s\\\n \\ state_val (transfer (kind a) s) V = state_val s V\"\n and CFG_intra_edge_transfer_uses_only_Use:\n \"\\valid_edge a; \\V \\ Use (sourcenode a). state_val s V = state_val s' V;\n intra_kind (kind a); pred (kind a) s; pred (kind a) s'\\\n \\ \\V \\ Def (sourcenode a). state_val (transfer (kind a) s) V =\n state_val (transfer (kind a) s') V\"\n and CFG_edge_Uses_pred_equal:\n \"\\valid_edge a; pred (kind a) s; snd (hd s) = snd (hd s');\n \\V \\ Use (sourcenode a). state_val s V = state_val s' V; length s = length s'\\\n \\ pred (kind a) s'\"\n and CFG_call_edge_length:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs; (p,ins,outs) \\ set procs\\\n \\ length fs = length ins\"\n and CFG_call_determ:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs; valid_edge a'; kind a' = Q':r'\\\\<^bsub>p'\\<^esub>fs';\n sourcenode a = sourcenode a'; pred (kind a) s; pred (kind a') s\\\n \\ a = a'\"\n and CFG_call_edge_params:\n \"\\valid_edge a; kind a = Q:r\\\\<^bsub>p\\<^esub>fs; i < length ins; \n (p,ins,outs) \\ set procs; pred (kind a) s; pred (kind a) s';\n \\V \\ (ParamUses (sourcenode a))!i. state_val s V = state_val s' V\\\n \\ (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\" \n and CFG_return_edge_fun:\n \"\\valid_edge a; kind a = Q'\\\\<^bsub>p\\<^esub>f'; (p,ins,outs) \\ set procs\\\n \\ f' vmap vmap' = vmap'(ParamDefs (targetnode a) [:=] map vmap outs)\"\n and deterministic:\"\\valid_edge a; valid_edge a'; sourcenode a = sourcenode a';\n targetnode a \\ targetnode a'; intra_kind (kind a); intra_kind (kind a')\\ \n \\ \\Q Q'. kind a = (Q)\\<^sub>\\ \\ kind a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n\nbegin\n\n\nlemma CFG_equal_Use_equal_call:\n assumes \"valid_edge a\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\" and \"valid_edge a'\"\n and \"kind a' = Q':r'\\\\<^bsub>p'\\<^esub>fs'\" and \"sourcenode a = sourcenode a'\"\n and \"pred (kind a) s\" and \"pred (kind a') s'\" \n and \"snd (hd s) = snd (hd s')\" and \"length s = length s'\"\n and \"\\V \\ Use (sourcenode a). state_val s V = state_val s' V\"\n shows \"a = a'\"\nproof -\n from `valid_edge a` `pred (kind a) s` `snd (hd s) = snd (hd s')`\n `\\V \\ Use (sourcenode a). state_val s V = state_val s' V` `length s = length s'`\n have \"pred (kind a) s'\" by(rule CFG_edge_Uses_pred_equal)\n with `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `valid_edge a'` `kind a' = Q':r'\\\\<^bsub>p'\\<^esub>fs'`\n `sourcenode a = sourcenode a'` `pred (kind a') s'`\n show ?thesis by -(rule CFG_call_determ)\nqed\n\n\nlemma CFG_call_edge_param_in:\n assumes \"valid_edge a\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\" and \"i < length ins\"\n and \"(p,ins,outs) \\ set procs\" and \"pred (kind a) s\" and \"pred (kind a) s'\"\n and \"\\V \\ (ParamUses (sourcenode a))!i. state_val s V = state_val s' V\"\n shows \"state_val (transfer (kind a) s) (ins!i) = \n state_val (transfer (kind a) s') (ins!i)\"\nproof -\n from assms have params:\"(params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\"\n by(rule CFG_call_edge_params)\n from `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `(p,ins,outs) \\ set procs`\n have [simp]:\"(THE ins. \\outs. (p,ins,outs) \\ set procs) = ins\"\n by(rule formal_in_THE)\n from `pred (kind a) s` obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s) auto\n from `pred (kind a) s'` obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n by(cases s') auto\n from `kind a = Q:r\\\\<^bsub>p\\<^esub>fs`\n have eqs:\"fst (hd (transfer (kind a) s)) = (empty(ins [:=] params fs (fst cf)))\"\n \"fst (hd (transfer (kind a) s')) = (empty(ins [:=] params fs (fst cf')))\"\n by simp_all\n from `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `(p,ins,outs) \\ set procs`\n have \"length fs = length ins\" by(rule CFG_call_edge_length)\n from `(p,ins,outs) \\ set procs` have \"distinct ins\" by(rule distinct_formal_ins)\n with `i < length ins` `length fs = length ins`\n have \"(empty(ins [:=] params fs (fst cf))) (ins!i) = (params fs (fst cf))!i\"\n \"(empty(ins [:=] params fs (fst cf'))) (ins!i) = (params fs (fst cf'))!i\"\n by(fastforce intro:fun_upds_nth)+\n with eqs `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` params\n show ?thesis by simp\nqed\n\n\nlemma CFG_call_edge_no_param:\n assumes \"valid_edge a\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\" and \"V \\ set ins\"\n and \"(p,ins,outs) \\ set procs\" and \"pred (kind a) s\"\n shows \"state_val (transfer (kind a) s) V = None\"\nproof -\n from `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `(p,ins,outs) \\ set procs`\n have [simp]:\"(THE ins. \\outs. (p,ins,outs) \\ set procs) = ins\"\n by(rule formal_in_THE)\n from `pred (kind a) s` obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s) auto\n from `V \\ set ins` have \"(empty(ins [:=] params fs (fst cf))) V = None\"\n by(auto dest:fun_upds_notin)\n with `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` show ?thesis by simp\nqed\n\n\n\nlemma CFG_return_edge_param_out:\n assumes \"valid_edge a\" and \"kind a = Q\\\\<^bsub>p\\<^esub>f\" and \"i < length outs\"\n and \"(p,ins,outs) \\ set procs\" and \"state_val s (outs!i) = state_val s' (outs!i)\"\n and \"s = cf#cfx#cfs\" and \"s' = cf'#cfx'#cfs'\"\n shows \"state_val (transfer (kind a) s) ((ParamDefs (targetnode a))!i) =\n state_val (transfer (kind a) s') ((ParamDefs (targetnode a))!i)\"\nproof -\n from `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\ set procs`\n have [simp]:\"(THE outs. \\ins. (p,ins,outs) \\ set procs) = outs\"\n by(rule formal_out_THE)\n from `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\ set procs` `s = cf#cfx#cfs`\n have transfer:\"fst (hd (transfer (kind a) s)) = \n (fst cfx)(ParamDefs (targetnode a) [:=] map (fst cf) outs)\"\n by(fastforce intro:CFG_return_edge_fun)\n from `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\ set procs` `s' = cf'#cfx'#cfs'`\n have transfer':\"fst (hd (transfer (kind a) s')) = \n (fst cfx')(ParamDefs (targetnode a) [:=] map (fst cf') outs)\"\n by(fastforce intro:CFG_return_edge_fun)\n from `state_val s (outs!i) = state_val s' (outs!i)` `i < length outs`\n `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n have \"(fst cf) (outs!i) = (fst cf') (outs!i)\" by simp\n from `valid_edge a` have \"distinct (ParamDefs (targetnode a))\"\n by(fastforce intro:distinct_ParamDefs)\n from `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\ set procs`\n have \"length(ParamDefs (targetnode a)) = length outs\"\n by(fastforce intro:ParamDefs_return_target_length)\n with `i < length outs` `distinct (ParamDefs (targetnode a))`\n have \"(fst cfx)(ParamDefs (targetnode a) [:=] map (fst cf) outs)\n ((ParamDefs (targetnode a))!i) = (map (fst cf) outs)!i\" \n and \"(fst cfx')(ParamDefs (targetnode a) [:=] map (fst cf') outs)\n ((ParamDefs (targetnode a))!i) = (map (fst cf') outs)!i\"\n by(fastforce intro:fun_upds_nth)+\n with transfer transfer' `(fst cf) (outs!i) = (fst cf') (outs!i)` `i < length outs`\n show ?thesis by simp\nqed\n\n\nlemma CFG_slp_no_Def_equal:\n assumes \"n -as\\\\<^bsub>sl\\<^esub>* n'\" and \"valid_edge a\" and \"a' \\ get_return_edges a\"\n and \"V \\ set (ParamDefs (targetnode a'))\" and \"preds (kinds (a#as@[a'])) s\"\n shows \"state_val (transfers (kinds (a#as@[a'])) s) V = state_val s V\"\nproof -\n from `valid_edge a` `a' \\ get_return_edges a` \n obtain Q r p fs where \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce dest!:only_call_get_return_edges)\n with `valid_edge a` `a' \\ get_return_edges a` obtain Q' f' where \"kind a' = Q'\\\\<^bsub>p\\<^esub>f'\"\n by(fastforce dest!:call_return_edges)\n from `valid_edge a` `a' \\ get_return_edges a` have \"valid_edge a'\"\n by(rule get_return_edges_valid)\n from `preds (kinds (a#as@[a'])) s` obtain cf cfs where [simp]:\"s = cf#cfs\"\n by(cases s,auto simp:kinds_def)\n from `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` obtain ins outs \n where \"(p,ins,outs) \\ set procs\" by(fastforce dest!:callee_in_procs)\n from `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` obtain cfx where \"transfer (kind a) s = cfx#cf#cfs\"\n by simp\n moreover\n from `n -as\\\\<^bsub>sl\\<^esub>* n'` obtain cfx' \n where \"transfers (kinds as) (cfx#cf#cfs) = cfx'#cf#cfs\"\n by(fastforce elim:slp_callstack_length_equal)\n moreover\n from `kind a' = Q'\\\\<^bsub>p\\<^esub>f'` `valid_edge a'` `(p,ins,outs) \\ set procs`\n have \"fst (hd (transfer (kind a') (cfx'#cf#cfs))) = \n (fst cf)(ParamDefs (targetnode a') [:=] map (fst cfx') outs)\"\n by(simp,simp only:formal_out_THE,fastforce intro:CFG_return_edge_fun)\n ultimately have \"fst (hd (transfers (kinds (a#as@[a'])) s)) = \n (fst cf)(ParamDefs (targetnode a') [:=] map (fst cfx') outs)\"\n by(simp add:kinds_def transfers_split)\n with `V \\ set (ParamDefs (targetnode a'))` show ?thesis\n by(simp add:fun_upds_notin)\nqed\n\n\n\nlemma [dest!]: \"V \\ Use (_Entry_) \\ False\"\nby(simp add:Entry_empty)\n\nlemma [dest!]: \"V \\ Def (_Entry_) \\ False\"\nby(simp add:Entry_empty)\n\n\nlemma CFG_intra_path_no_Def_equal:\n assumes \"n -as\\\\<^sub>\\* n'\" and \"\\n \\ set (sourcenodes as). V \\ Def n\"\n and \"preds (kinds as) s\"\n shows \"state_val (transfers (kinds as) s) V = state_val s V\"\nproof -\n from `n -as\\\\<^sub>\\* n'` have \"n -as\\* n'\" and \"\\a \\ set as. intra_kind (kind a)\"\n by(simp_all add:intra_path_def)\n from this `\\n \\ set (sourcenodes as). V \\ Def n` `preds (kinds as) s`\n have \"state_val (transfers (kinds as) s) V = state_val s V\"\n proof(induct arbitrary:s rule:path.induct)\n case (empty_path n)\n thus ?case by(simp add:sourcenodes_def kinds_def)\n next\n case (Cons_path n'' as n' a n)\n note IH = `\\s. \\\\a\\set as. intra_kind (kind a); \n \\n\\set (sourcenodes as). V \\ Def n; preds (kinds as) s\\ \n \\ state_val (transfers (kinds as) s) V = state_val s V`\n from `preds (kinds (a#as)) s` have \"pred (kind a) s\"\n and \"preds (kinds as) (transfer (kind a) s)\" by(simp_all add:kinds_def)\n from `\\n\\set (sourcenodes (a#as)). V \\ Def n`\n have noDef:\"V \\ Def (sourcenode a)\" \n and all:\"\\n\\set (sourcenodes as). V \\ Def n\"\n by(auto simp:sourcenodes_def)\n from `\\a\\set (a#as). intra_kind (kind a)`\n have \"intra_kind (kind a)\" and all':\"\\a\\set as. intra_kind (kind a)\"\n by auto\n from `valid_edge a` noDef `intra_kind (kind a)` `pred (kind a) s`\n have \"state_val (transfer (kind a) s) V = state_val s V\"\n by -(rule CFG_intra_edge_no_Def_equal)\n with IH[OF all' all `preds (kinds as) (transfer (kind a) s)`] show ?case\n by(simp add:kinds_def)\n qed\n thus ?thesis by blast\nqed\n\n\nlemma slpa_preds:\n \"\\same_level_path_aux cs as; s = cfsx@cf#cfs; s' = cfsx@cf#cfs'; \n length cfs = length cfs'; \\a \\ set as. valid_edge a; length cs = length cfsx; \n preds (kinds as) s\\\n \\ preds (kinds as) s'\"\nproof(induct arbitrary:s s' cf cfsx rule:slpa_induct)\n case (slpa_empty cs) thus ?case by(simp add:kinds_def)\nnext\n case (slpa_intra cs a as)\n note IH = `\\s s' cf cfsx. \\s = cfsx@cf#cfs; s' = cfsx@cf#cfs';\n length cfs = length cfs'; \\a \\ set as. valid_edge a; length cs = length cfsx; \n preds (kinds as) s\\ \\ preds (kinds as) s'`\n from `\\a\\set (a#as). valid_edge a` have \"valid_edge a\"\n and \"\\a \\ set as. valid_edge a\" by simp_all\n from `preds (kinds (a#as)) s` have \"pred (kind a) s\"\n and \"preds (kinds as) (transfer (kind a) s)\" by(simp_all add:kinds_def)\n show ?case\n proof(cases cfsx)\n case Nil\n with `length cs = length cfsx` have \"length cs = length []\" by simp\n from Nil `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'` `intra_kind (kind a)` \n obtain cfx where \"transfer (kind a) s = []@cfx#cfs\"\n and \"transfer (kind a) s' = []@cfx#cfs'\"\n by(cases \"kind a\",auto simp:kinds_def intra_kind_def)\n from IH[OF this `length cfs = length cfs'` `\\a \\ set as. valid_edge a`\n `length cs = length []` `preds (kinds as) (transfer (kind a) s)`]\n have \"preds (kinds as) (transfer (kind a) s')\" .\n moreover\n from Nil `valid_edge a` `pred (kind a) s` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cfs = length cfs'`\n have \"pred (kind a) s'\" by(fastforce intro:CFG_edge_Uses_pred_equal)\n ultimately show ?thesis by(simp add:kinds_def)\n next\n case (Cons x xs)\n with `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'` `intra_kind (kind a)`\n obtain cfx where \"transfer (kind a) s = (cfx#xs)@cf#cfs\"\n and \"transfer (kind a) s' = (cfx#xs)@cf#cfs'\"\n by(cases \"kind a\",auto simp:kinds_def intra_kind_def)\n from IH[OF this `length cfs = length cfs'` `\\a \\ set as. valid_edge a` _ \n `preds (kinds as) (transfer (kind a) s)`] `length cs = length cfsx` Cons\n have \"preds (kinds as) (transfer (kind a) s')\" by simp\n moreover\n from Cons `valid_edge a` `pred (kind a) s` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cfs = length cfs'` \n have \"pred (kind a) s'\" by(fastforce intro:CFG_edge_Uses_pred_equal)\n ultimately show ?thesis by(simp add:kinds_def)\n qed\nnext\n case (slpa_Call cs a as Q r p fs)\n note IH = `\\s s' cf cfsx. \\s = cfsx@cf#cfs; s' = cfsx@cf#cfs';\n length cfs = length cfs'; \\a \\ set as. valid_edge a; length (a#cs) = length cfsx;\n preds (kinds as) s\\ \\ preds (kinds as) s'`\n from `\\a\\set (a#as). valid_edge a` have \"valid_edge a\"\n and \"\\a \\ set as. valid_edge a\" by simp_all\n from `preds (kinds (a#as)) s` have \"pred (kind a) s\"\n and \"preds (kinds as) (transfer (kind a) s)\" by(simp_all add:kinds_def)\n from `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'` obtain cfx\n where \"transfer (kind a) s = (cfx#cfsx)@cf#cfs\"\n and \"transfer (kind a) s' = (cfx#cfsx)@cf#cfs'\" by(cases cfsx) auto\n from IH[OF this `length cfs = length cfs'` `\\a \\ set as. valid_edge a` _ \n `preds (kinds as) (transfer (kind a) s)`] `length cs = length cfsx`\n have \"preds (kinds as) (transfer (kind a) s')\" by simp\n moreover\n from `valid_edge a` `pred (kind a) s` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cfs = length cfs'` have \"pred (kind a) s'\" \n by(cases cfsx)(auto intro:CFG_edge_Uses_pred_equal)\n ultimately show ?case by(simp add:kinds_def)\nnext\n case (slpa_Return cs a as Q p f c' cs')\n note IH = `\\s s' cf cfsx. \\s = cfsx@cf#cfs; s' = cfsx@cf#cfs';\n length cfs = length cfs'; \\a \\ set as. valid_edge a; length cs' = length cfsx; \n preds (kinds as) s\\ \\ preds (kinds as) s'`\n from `\\a\\set (a#as). valid_edge a` have \"valid_edge a\"\n and \"\\a \\ set as. valid_edge a\" by simp_all\n from `preds (kinds (a#as)) s` have \"pred (kind a) s\"\n and \"preds (kinds as) (transfer (kind a) s)\" by(simp_all add:kinds_def)\n show ?case\n proof(cases cs')\n case Nil\n with `cs = c'#cs'` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cs = length cfsx` \n obtain cf' where \"s = cf'#cf#cfs\" and \"s' = cf'#cf#cfs'\" by(cases cfsx) auto\n with `kind a = Q\\\\<^bsub>p\\<^esub>f` obtain cf'' where \"transfer (kind a) s = []@cf''#cfs\"\n and \"transfer (kind a) s' = []@cf''#cfs'\" by auto\n from IH[OF this `length cfs = length cfs'` `\\a \\ set as. valid_edge a` _ \n `preds (kinds as) (transfer (kind a) s)`] Nil\n have \"preds (kinds as) (transfer (kind a) s')\" by simp\n moreover\n from `valid_edge a` `pred (kind a) s` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cfs = length cfs'` have \"pred (kind a) s'\" \n by(cases cfsx)(auto intro:CFG_edge_Uses_pred_equal)\n ultimately show ?thesis by(simp add:kinds_def)\n next\n case (Cons cx csx)\n with `cs = c'#cs'` `length cs = length cfsx` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n obtain x x' xs where \"s = (x#x'#xs)@cf#cfs\" and \"s' = (x#x'#xs)@cf#cfs'\"\n and \"length xs = length csx\"\n by(cases cfsx,auto,case_tac list,fastforce+)\n with `kind a = Q\\\\<^bsub>p\\<^esub>f` obtain cf' where \"transfer (kind a) s = (cf'#xs)@cf#cfs\"\n and \"transfer (kind a) s' = (cf'#xs)@cf#cfs'\"\n by fastforce\n from IH[OF this `length cfs = length cfs'` `\\a \\ set as. valid_edge a` _ \n `preds (kinds as) (transfer (kind a) s)`] Cons `length xs = length csx`\n have \"preds (kinds as) (transfer (kind a) s')\" by simp\n moreover\n from `valid_edge a` `pred (kind a) s` `s = cfsx@cf#cfs` `s' = cfsx@cf#cfs'`\n `length cfs = length cfs'` have \"pred (kind a) s'\" \n by(cases cfsx)(auto intro:CFG_edge_Uses_pred_equal)\n ultimately show ?thesis by(simp add:kinds_def)\n qed\nqed\n\n\nlemma slp_preds:\n assumes \"n -as\\\\<^bsub>sl\\<^esub>* n'\" and \"preds (kinds as) (cf#cfs)\" \n and \"length cfs = length cfs'\"\n shows \"preds (kinds as) (cf#cfs')\"\nproof -\n from `n -as\\\\<^bsub>sl\\<^esub>* n'` have \"n -as\\* n'\" and \"same_level_path_aux [] as\"\n by(simp_all add:slp_def same_level_path_def)\n from `n -as\\* n'` have \"\\a \\ set as. valid_edge a\" by(rule path_valid_edges)\n with `same_level_path_aux [] as` `preds (kinds as) (cf#cfs)` \n `length cfs = length cfs'`\n show ?thesis by(fastforce elim!:slpa_preds)\nqed\nend\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/StaticInter/CFG_wf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.270916614685136}} {"text": "(*<*)\ntheory Paxos_Proofs\nimports Three_Step_MRU \"../HO_Transition_System\" Heard_Of.Majorities \"../Quorums\" Paxos_Defs\nbegin\n(*>*)\n\nsubsection \\Proofs\\\n\ntype_synonym p_TS_state = \"(nat \\ (process \\ (val pstate)))\"\n\ndefinition Paxos_TS ::\n \"(round \\ process HO)\n \\ (round \\ process HO)\n \\ (round \\ process)\n \\ p_TS_state TS\"\nwhere\n \"Paxos_TS HOs SHOs crds = CHO_to_TS Paxos_Alg HOs SHOs (K o crds)\"\n\nlemmas Paxos_TS_defs = Paxos_TS_def CHO_to_TS_def Paxos_Alg_def CHOinitConfig_def\n Paxos_initState_def\n\ndefinition Paxos_trans_step where\n \"Paxos_trans_step HOs SHOs crds nxt_f snd_f stp \\ \\r \\.\n {((r, cfg), (Suc r, cfg'))|cfg cfg'. three_step r = stp \\ (\\p.\n \\ p \\ get_msgs (snd_f r) cfg (HOs r) (SHOs r) p\n \\ nxt_f r p (cfg p) (\\ p) (crds r) (cfg' p)\n )}\"\n\nlemma three_step_less_D:\n \"0 < three_step r \\ three_step r = 1 \\ three_step r = 2\"\n by(unfold three_step_def, arith)\n\nlemma Paxos_trans:\n \"CSHO_trans_alt Paxos_sendMsg Paxos_nextState HOs SHOs (K \\ crds) = \n Paxos_trans_step HOs SHOs crds next0 send0 0\n \\ Paxos_trans_step HOs SHOs crds next1 send1 1\n \\ Paxos_trans_step HOs SHOs crds next2 send2 2\n \"\nproof(rule equalityI)\n show \"CSHO_trans_alt Paxos_sendMsg Paxos_nextState HOs SHOs (K \\ crds)\n \\ Paxos_trans_step HOs SHOs crds next0 send0 0 \\\n Paxos_trans_step HOs SHOs crds next1 send1 1 \\\n Paxos_trans_step HOs SHOs crds next2 send2 2\"\n by(force simp add: CSHO_trans_alt_def Paxos_sendMsg_def Paxos_nextState_def \n Paxos_trans_step_def K_def dest!: three_step_less_D)\nnext\n show \"Paxos_trans_step HOs SHOs crds next0 send0 0 \\\n Paxos_trans_step HOs SHOs crds next1 send1 1 \\\n Paxos_trans_step HOs SHOs crds next2 send2 2\n \\ CSHO_trans_alt Paxos_sendMsg Paxos_nextState HOs SHOs (K \\ crds)\"\n by(force simp add: CSHO_trans_alt_def Paxos_sendMsg_def Paxos_nextState_def \n Paxos_trans_step_def K_def)\nqed\n\ntype_synonym rHO = \"nat \\ process HO\"\n\nsubsubsection \\Refinement\\\n(******************************************************************************)\n\ndefinition coord_vote_to_set :: \"nat \\ (process \\ (val pstate)) \\ val set\" where\n \"coord_vote_to_set r sc \\ (let v = pstate.commt (sc (coord r)) in \n if v = None \n then {}\n else {the v})\"\n\ndefinition paxos_ref_rel :: \"(three_step_mru_state \\ p_TS_state)set\" where\n \"paxos_ref_rel = {(sa, (r, sc)).\n opt_mru_state.next_round sa = r\n \\ opt_mru_state.decisions sa = pstate.decide o sc\n \\ opt_mru_state.mru_vote sa = pstate.mru_vote o sc\n \\ (three_step r = Suc 0 \\ three_step_mru_state.candidates sa = coord_vote_to_set r sc)\n }\"\n\nlemma mru_vote_evolution0:\n \"\\p. next0 r p (s p) (msgs p) (crd p) (s' p) \\ mru_vote o s' = mru_vote o s\"\n apply(rule_tac[!] ext, rename_tac x, erule_tac[!] x=x in allE)\n by(auto simp add: next0_def next2_def Let_def)\n\nlemma mru_vote_evolution2:\n \"\\p. next2 r p (s p) (msgs p) (crd p) (s' p) \\ mru_vote o s' = mru_vote o s\"\n apply(rule_tac[!] ext, rename_tac x, erule_tac[!] x=x in allE)\n by(auto simp add: next0_def next2_def Let_def)\n\nlemma decide_evolution:\n \"\\p. next0 r p (s p) (msgs p) (crd p) (s' p) \\ decide o s = decide o s'\"\n \"\\p. next1 r p (s p) (msgs p) (crd p) (s' p) \\ decide o s = decide o s'\"\n apply(rule_tac[!] ext, rename_tac x, erule_tac[!] x=x in allE)\n by(auto simp add: next0_def next1_def Let_def)\n\nlemma msgs_mru_vote: \n assumes\n \"\\ (coord r) \\ get_msgs (send0 r) cfg (HOs r) (HOs r) (coord r)\" (is \"\\ ?p \\ _\")\n shows \"((msgs_to_lvs (\\ ?p)) |` HOs r ?p) = (mru_vote o cfg) |` HOs r ?p\" using assms\n by(auto simp add: get_msgs_benign send0_def restrict_map_def msgs_to_lvs_def\n mru_vote_to_msg_def map_comp_def intro!: ext split: option.split)\n\nlemma step0_ref:\n \"{paxos_ref_rel} \n (\\r C. majorities.opt_mru_step0 r C), \n Paxos_trans_step HOs HOs crds next0 send0 0 {> paxos_ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs Paxos_trans_step_def all_conj_distrib)\n fix r sa sc sc' \\\n assume R: \"(sa, (r, sc)) \\ paxos_ref_rel\"\n and r: \"three_step r = 0\"\n and \\: \"\\p. \\ p \\ get_msgs (send0 r) sc (HOs r) (HOs r) p\"\n and nxt: \"\\p. next0 r p (sc p) (\\ p) (crds r) (sc' p)\"\n note \\nxt = \\ nxt\n from r have same_coord: \"coord (Suc r) = coord r\"\n by(auto simp add: three_step_phase_Suc intro: coord_phase)\n define C where \"C = coord_vote_to_set (Suc r) sc'\"\n have guard: \"\\cand\\C. \\Q. majorities.opt_mru_guard (mru_vote \\ sc) Q cand\"\n proof\n fix cand\n assume cand: \"cand \\ C\"\n hence Some: \"commt (sc' (coord r)) = Some cand\" using nxt[THEN spec, where x=\"coord r\"]\n by(auto simp add: C_def coord_vote_to_set_def Let_def same_coord)\n\n let ?Q = \"HOs r (coord r)\"\n let ?lvs0 = \"mru_vote o sc\"\n\n have \"?Q \\ majs\" using Some \\nxt[THEN spec, where x=\"coord r\"]\n by(auto simp add: Let_def majs_def next0_def same_coord get_msgs_dom)\n moreover have\n \"map_option snd (option_Max_by fst (ran (?lvs |` ?Q))) \\ {None, Some cand}\"\n using Some nxt[THEN spec, where x=\"coord r\"]\n msgs_mru_vote[where HOs=HOs and \\=\\, OF \\[THEN spec, where x=\"coord r\"]] \n get_msgs_dom[OF \\[THEN spec, of \"coord r\"]]\n by(auto simp add: next0_def Let_def split: option.split_asm)\n ultimately have \"majorities.opt_mru_guard ?lvs0 ?Q cand\"\n by(auto simp add: majorities.opt_mru_guard_def Let_def majorities.opt_mru_vote_def)\n thus \"\\Q. majorities.opt_mru_guard ?lvs0 Q cand\"\n by blast\n qed\n\n define sa' where \"sa' = sa\\\n next_round := Suc r,\n candidates := C\n \\\"\n have \"(sa, sa') \\ majorities.opt_mru_step0 r C\" using R r nxt guard\n by(auto simp add: majorities.opt_mru_step0_def sa'_def paxos_ref_rel_def)\n moreover have \"(sa', (Suc r, sc')) \\ paxos_ref_rel\" using R nxt\n apply(auto simp add: sa'_def paxos_ref_rel_def intro!:\n mru_vote_evolution0[OF nxt, symmetric] decide_evolution(1)[OF nxt])\n apply(auto simp add: Let_def C_def o_def intro!: ext)\n done\n ultimately show \n \"\\sa'. (\\r C. (sa, sa') \\ majorities.opt_mru_step0 r C) \n \\ (sa', Suc r, sc') \\ paxos_ref_rel\"\n by blast\nqed\n\nlemma step1_ref:\n \"{paxos_ref_rel} \n (\\r S v. majorities.opt_mru_step1 r S v), \n Paxos_trans_step HOs HOs crds next1 send1 (Suc 0) {> paxos_ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs Paxos_trans_step_def all_conj_distrib)\n fix r sa sc sc' \\\n assume R: \"(sa, (r, sc)) \\ paxos_ref_rel\"\n and r: \"three_step r = Suc 0\"\n and \\: \"\\p. \\ p \\ get_msgs (send1 r) sc (HOs r) (HOs r) p\"\n and nxt: \"\\p. next1 r p (sc p) (\\ p) (crds r) (sc' p)\"\n note \\nxt = \\ nxt\n\n define v where \"v = the (commt (sc (coord r)))\"\n define S where \"S = {p. coord r \\ HOs r p \\ commt (sc (coord r)) \\ None}\"\n define sa' where \"sa' = sa\\ next_round := Suc r, \n opt_mru_state.mru_vote := opt_mru_state.mru_vote sa ++ const_map (three_phase r, v) S\n \\\"\n have \"(sa, sa') \\ majorities.opt_mru_step1 r S v\" using r R \n by(clarsimp simp add: majorities.opt_mru_step1_def sa'_def S_def v_def \n coord_vote_to_set_def paxos_ref_rel_def)\n moreover have \"(sa', (Suc r, sc')) \\ paxos_ref_rel\" using r R\n proof-\n have \"mru_vote o sc' = ((mru_vote \\ sc) ++ const_map (three_phase r, v) S)\"\n proof(rule ext, simp)\n fix p\n show \"mru_vote (sc' p) = ((mru_vote \\ sc) ++ const_map (three_phase r, v) S) p\"\n using \\nxt[THEN spec, of p]\n by(auto simp add: get_msgs_benign next1_def send1_def S_def v_def map_add_def \n const_map_is_None const_map_is_Some restrict_map_def isVote_def split: option.split)\n qed\n thus ?thesis using R r nxt\n by(force simp add: paxos_ref_rel_def sa'_def three_step_Suc intro: decide_evolution)\n qed \n ultimately show \n \"\\sa'. (\\r S v. (sa, sa') \\ majorities.opt_mru_step1 r S v) \n \\ (sa', Suc r, sc') \\ paxos_ref_rel\"\n by blast\nqed\n\n\n\n define dec_f\n where \"dec_f p = (if decide (sc' p) \\ decide (sc p) then decide (sc' p) else None)\" for p\n\n have dec_f: \"(decide \\ sc) ++ dec_f = decide \\ sc'\"\n proof\n fix p\n show \"((decide \\ sc) ++ dec_f) p = (decide \\ sc') p\" using nxt[THEN spec, of p]\n by(auto simp add: map_add_def dec_f_def next2_def split: option.split intro!: ext)\n qed\n\n define sa' where \"sa' = sa\\\n next_round := Suc r,\n decisions := decisions sa ++ dec_f\n \\\"\n\n have \"(sa', (Suc r, sc')) \\ paxos_ref_rel\" using R r nxt\n by(auto simp add: paxos_ref_rel_def sa'_def dec_f three_step_Suc \n mru_vote_evolution2[OF nxt])\n moreover have \"(sa, sa') \\ majorities.opt_mru_step2 r dec_f\" using r R\n proof-\n define sc_r_votes where \"sc_r_votes p = (if (\\v. mru_vote (sc p) = Some (three_phase r, v))\n then map_option snd (mru_vote (sc p))\n else None)\" for p\n have sc_r_votes: \"sc_r_votes = majorities.r_votes sa r\" using R r\n by(auto simp add: paxos_ref_rel_def sc_r_votes_def majorities.r_votes_def intro!: ext)\n have \"majorities.step2_d_guard dec_f sc_r_votes\"\n proof(clarsimp simp add: majorities.step2_d_guard_def)\n fix p v\n assume d_f_p: \"dec_f p = Some v\"\n let ?Qv = \"votes_rcvd (\\ p)\"\n have Qv: \"card ?Qv > N div 2\" \n \"v = the_rcvd_vote (\\ p)\" using nxt[THEN spec, of p] d_f_p\n by(auto simp add: next2_def dec_f_def)\n\n hence \"v \\ snd ` votes_rcvd (\\ p)\"\n by(fastforce simp add: the_rcvd_vote_def ex_in_conv[symmetric]\n dest!: card_gt_0_iff[THEN iffD1, OF le_less_trans[OF le0]] elim!: imageI intro: someI)\n moreover have \"?Qv = map_graph (sc_r_votes) \\ (HOs r p \\ UNIV)\" using \\[THEN spec, of p]\n by(auto simp add: get_msgs_benign send2_def restrict_map_def votes_rcvd_def\n sc_r_votes_def image_def split: option.split_asm)\n ultimately show \"v \\ ran sc_r_votes \\ dom sc_r_votes \\ majs\" using Qv(1)\n by(auto simp add: majs_def inj_on_def map_graph_def fun_graph_def sc_r_votes_def\n the_rcvd_vote_def majs_def intro: ranI\n elim!: less_le_trans intro!: card_inj_on_le[where f=fst])\n qed\n\n thus ?thesis using r R\n by(auto simp add: majorities.opt_mru_step2_def sa'_def paxos_ref_rel_def sc_r_votes)\n qed\n\n ultimately show \n \"\\sa'. (\\r dec_f. (sa, sa') \\ majorities.opt_mru_step2 r dec_f) \n \\ (sa', Suc r, sc') \\ paxos_ref_rel\"\n by blast\n\nqed\n\nlemma Paxos_Refines_ThreeStep_MRU:\n \"PO_refines paxos_ref_rel \n majorities.ts_mru_TS (Paxos_TS HOs HOs crds)\"\nproof(rule refine_basic)\n show \"init (Paxos_TS HOs HOs crds) \\ paxos_ref_rel `` init majorities.ts_mru_TS\"\n by(auto simp add: Paxos_TS_defs majorities.ts_mru_TS_def paxos_ref_rel_def \n majorities.ts_mru_init_def)\nnext\n show \n \"{paxos_ref_rel} TS.trans majorities.ts_mru_TS, \n TS.trans (Paxos_TS HOs HOs crds) {> paxos_ref_rel}\"\n apply(simp add: majorities.ts_mru_TS_defs Paxos_TS_defs)\n apply(auto simp add: CHO_trans_alt Paxos_trans intro!: step0_ref step1_ref step2_ref)\n done\nqed\n\nsubsubsection \\Termination\\\n(******************************************************************************)\n\ntheorem Paxos_termination:\n assumes run: \"CHORun Paxos_Alg rho HOs crds\"\n and commR: \"\\r. CHOcommPerRd Paxos_M r (HOs r) (crds r)\"\n and commG: \"CHOcommGlobal Paxos_M HOs crds\"\n shows \"\\r v. decide (rho r p) = Some v\"\nproof -\n from commG obtain ph c where \n HOs:\n \"coord (nr_steps*ph) = c\n \\ card (HOs (nr_steps*ph) c) > N div 2\n \\ (\\p. c \\ HOs (nr_steps*ph+1) p)\n \\ (\\p. card (HOs (nr_steps*ph+2) p) > N div 2)\"\n by(auto simp add: Paxos_CHOMachine_def Paxos_commGlobal_def)\n\n \\ \\The tedious bit: obtain three consecutive rounds linked by send/next functions\\\n define r0 where \"r0 = nr_steps * ph\"\n define cfg0 where \"cfg0 = rho r0\"\n define r1 where \"r1 = Suc r0\"\n define cfg1 where \"cfg1 = rho r1\"\n define r2 where \"r2 = Suc r1\"\n define cfg2 where \"cfg2 = rho r2\"\n define cfg3 where \"cfg3 = rho (Suc r2)\"\n\n from \n run[simplified CHORun_def, THEN CSHORun_step, THEN spec, where x=\"r0\"] \n run[simplified CHORun_def, THEN CSHORun_step, THEN spec, where x=\"r1\"]\n run[simplified CHORun_def, THEN CSHORun_step, THEN spec, where x=\"r2\"] \n obtain \\0 \\1 \\2 where\n send0: \"\\p. \\0 p \\ get_msgs (send0 r0) cfg0 (HOs r0) (HOs r0) p\"\n and three_step0: \"\\p. next0 r0 p (cfg0 p) (\\0 p) (crds (Suc r0) p) (cfg1 p)\"\n and send1: \"\\p. \\1 p \\ get_msgs (send1 r1) cfg1 (HOs r1) (HOs r1) p\"\n and three_step1: \"\\p. next1 r1 p (cfg1 p) (\\1 p) (crds (Suc r1) p) (cfg2 p)\"\n and send2: \"\\p. \\2 p \\ get_msgs (send2 r2) cfg2 (HOs r2) (HOs r2) p\"\n and three_step2: \"\\p. next2 r2 p (cfg2 p) (\\2 p) (crds (Suc r2) p) (cfg3 p)\"\n apply(auto simp add: Paxos_Alg_def three_step_def Paxos_nextState_def Paxos_sendMsg_def all_conj_distrib\n r0_def r1_def r2_def\n cfg0_def cfg1_def cfg2_def cfg3_def mod_Suc\n )\n done\n \n \\ \\The proof: the coordinator hears enough messages in r0 and thus selects a value.\\\n\n from HOs three_step0[THEN spec, of c] send0[THEN spec, of c]\n have \n \"commt (cfg1 c) \\ None\"\n by(auto simp add: next0_def Let_def r0_def get_msgs_dom)\n\n then obtain dec_v where dec_v: \"commt (cfg1 c) = Some dec_v\"\n by (metis option.collapse)\n\n have step_r0: \"three_step r0 = 0\"\n by(auto simp add: r0_def three_step_def)\n hence same_coord: \n \"coord r1 = coord r0\"\n \"coord r2 = coord r0\"\n by(auto simp add: three_step_phase_Suc r2_def r1_def r0_def intro!: coord_phase)\n\n \\ \\All processes hear from the coordinator, and thus set their vote to @{term dec_v}.\\ \n hence all_vote: \"\\p. mru_vote (cfg2 p) = Some (three_phase r2, dec_v)\"\n using HOs three_step1 send1 step_r0 dec_v\n by(auto simp add: next1_def Let_def get_msgs_benign send1_def restrict_map_def isVote_def\n r2_def r1_def r0_def[symmetric] same_coord[simplified r2_def r1_def] three_step_phase_Suc)\n\n \\ \\And finally, everybody will also decide @{term dec_v}.\\\n have all_decide: \"\\p. decide (cfg3 p) = Some dec_v\"\n proof\n fix p\n have \"votes_rcvd (\\2 p) = HOs r2 p \\ {dec_v}\" using send2[THEN spec, where x=p] all_vote\n by(auto simp add: send2_def get_msgs_benign votes_rcvd_def restrict_map_def image_def o_def)\n\n moreover from HOs have \"N div 2 < card (HOs r2 p)\"\n by(auto simp add: r2_def r1_def r0_def)\n\n moreover then have \"HOs r2 p \\ {}\"\n by (metis card_empty less_nat_zero_code)\n ultimately show \"decide (cfg3 p) = Some dec_v\" \n using three_step2[THEN spec, where x=p] send2[THEN spec, where x=p] all_vote\n by(auto simp add: next2_def send2_def Let_def get_msgs_benign \n the_rcvd_vote_def restrict_map_def image_def o_def)\n qed\n \n thus ?thesis \n by(auto simp add: cfg3_def)\n\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Consensus_Refined/MRU/Paxos_Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.27089587758169853}} {"text": "theory Events\n imports\nMain\nIntegers\nFloats\nAST\nGlobalenvs\nbegin\n\nsection \\Events and traces\\\n\n(** The observable behaviour of programs is stated in terms of\n input/output events, which represent the actions of the program\n that the external world can observe. CompCert leaves much flexibility as to\n the exact content of events: the only requirement is that they\n do not expose memory states nor pointer values\n (other than pointers to global variables), because these\n are not preserved literally during compilation. For concreteness,\n we use the following type for events. Each event represents either:\n\n- A system call (e.g. an input/output operation), recording the\n name of the system call, its parameters, and its result.\n\n- A volatile load from a global memory location, recording the chunk\n and address being read and the value just read.\n\n- A volatile store to a global memory location, recording the chunk\n and address being written and the value stored there.\n\n- An annotation, recording the text of the annotation and the values\n of the arguments.\n\n The values attached to these events are of the following form.\n As mentioned above, we do not expose pointer values directly.\n Pointers relative to a global variable are shown with the name\n of the variable instead of the block identifier.\n*)\n\ndatatype eventval =\n EVint m_int\n| EVlong m_int64\n| EVfloat float64\n| EVsingle float32\n| EVptr_global AST.ident m_ptrofs\n\ndatatype event =\n Event_syscall string \"eventval list\" eventval\n| Event_vload memory_chunk AST.ident m_ptrofs eventval\n| Event_vstore memory_chunk AST.ident m_ptrofs eventval\n| Event_annot string \"eventval list\"\n\n(** The dynamic semantics for programs collect traces of events.\n Traces are of two kinds: finite (type [trace]) or infinite (type [traceinf]). *)\n\ntype_synonym trace = \"event list\"\nabbreviation E0 :: trace where \"E0 \\ []\"\n\ncodatatype traceinf = Econsinf event traceinf\n\nfun Eappinf :: \"trace \\ traceinf \\ traceinf\" where\n \"Eappinf [] T = T\"\n| \"Eappinf (ev # evs) T = Econsinf ev (Eappinf evs T)\"\n\nsection \\Relating values and event values\\\n\ncontext\n fixes ge :: Senv_t\nbegin\n\n(** Validity *)\n\nfun eventval_valid :: \"eventval \\ bool\" where\n \"eventval_valid (EVint _) = True\"\n| \"eventval_valid (EVlong _) = True\"\n| \"eventval_valid (EVfloat _) = True\"\n| \"eventval_valid (EVsingle _) = True\"\n| \"eventval_valid (EVptr_global ident ofs) = (Senv.public_symbol ge ident = True)\"\n\nfun eventval_type :: \"eventval \\ type\" where\n \"eventval_type (EVint _) = Tint\"\n| \"eventval_type (EVlong _) = Tlong\"\n| \"eventval_type (EVfloat _) = Tfloat\"\n| \"eventval_type (EVsingle _) = Tsingle\"\n| \"eventval_type (EVptr_global ident ofs) = Tptr\"\n\nend\n\n(** Compatibility with memory injections *)\n\ndefinition symbols_inject :: \"(block \\ (block * Z) option) \\ Senv_t \\ Senv_t \\ bool\" where\n \"symbols_inject f ge1 ge2 \\\n (\\ ident. Senv.public_symbol ge2 ident = Senv.public_symbol ge1 ident)\n \\ (\\ ident b1 b2 delta.\n f b1 = Some(b2, delta) \\ Senv.find_symbol ge1 ident = Some b1 \\\n delta = 0 \\ Senv.find_symbol ge2 ident = Some b2)\n \\ (\\ ident b1.\n Senv.public_symbol ge1 ident = True \\ Senv.find_symbol ge1 ident = Some b1 \\\n (\\ b2. f b1 = Some(b2, 0) \\ Senv.find_symbol ge2 ident = Some b2))\n \\ (\\ b1 b2 delta.\n f b1 = Some(b2, delta) \\\n Senv.block_is_volatile ge2 b2 = Senv.block_is_volatile ge1 b1)\"\n\nsection \\Matching traces\\\n\ncontext\n fixes ge :: Senv_t\nbegin\n\n(** Matching between traces corresponding to single transitions.\n Arguments (provided by the program) must be equal.\n Results (provided by the outside world) can vary as long as they\n can be converted safely to values. *)\n\ninductive match_traces :: \"trace \\ trace \\ bool\" where\n match_traces_E0:\n \"match_traces [] []\"\n | match_traces_syscall:\n \"eventval_valid ge res1 \\ eventval_valid ge res2 \\ eventval_type res1 = eventval_type res2 \\\n match_traces (Event_syscall ident args res1 # []) (Event_syscall ident args res2 # [])\"\n | match_traces_vload:\n \"eventval_valid ge res1 \\ eventval_valid ge res2 \\ eventval_type res1 = eventval_type res2 \\\n match_traces (Event_vload chunk ident ofs res1 # []) (Event_vload chunk ident ofs res2 # [])\"\n | match_traces_vstore:\n \"match_traces (Event_vstore chunk ident ofs a # []) (Event_vstore chunk ident ofs a # [])\"\n | match_traces_annot:\n \"match_traces (Event_annot ident args # []) (Event_annot ident args # [])\"\n\nend\n\nsection \\Semantics of external functions\\\n\n(** For each external function, its behavior is defined by a predicate relating:\n- the global symbol environment\n- the values of the arguments passed to this function\n- the memory state before the call\n- the result value of the call\n- the memory state after the call\n- the trace generated by the call (can be empty).\n*)\n\ntype_synonym extcall_sem = \"Senv_t \\ val list \\ mem \\ trace \\ val \\ mem \\ bool\"\n\n(** We now specify the expected properties of this predicate. *)\n\ndefinition loc_out_of_bounds :: \"mem \\ block \\ Z \\ bool\" where\n \"loc_out_of_bounds m b ofs \\ ~Mem.perm m b ofs Max Nonempty\"\n\ndefinition loc_not_writable :: \"mem \\ block \\ Z \\ bool\" where\n \"loc_not_writable m b ofs \\ ~Mem.perm m b ofs Max Writable\"\n\ndefinition loc_unmapped :: \"meminj \\ block \\ Z \\ bool\" where\n \"loc_unmapped f b ofs \\ f b = None\"\n\ndefinition loc_out_of_reach :: \"meminj \\ mem \\ block \\ Z \\ bool\" where\n \"loc_out_of_reach f m b ofs \\\n \\ b0 delta.\n f b0 = Some(b, delta) \\ ~Mem.perm m b0 (ofs - delta) Max Nonempty\"\n\ndefinition inject_separated :: \"meminj \\ meminj \\ mem \\ mem \\ bool\" where\n \"inject_separated f f' m1 m2 \\\n \\ b1 b2 delta.\n f b1 = None \\ f' b1 = Some(b2, delta) \\\n ~Mem.valid_block m1 b1 \\ ~Mem.valid_block m2 b2\"\n\ncontext\n fixes sem :: extcall_sem\n fixes sg :: signature\nbegin\n\nnamed_theorems extcall_properties_defs'\n\n(** The return value of an external call must agree with its signature. *)\ndefinition [extcall_properties_defs']: \"ec_well_typed \\\n (\\ ge vargs m1 t vres m2.\n sem ge vargs m1 t vres m2 \\\n Val.has_rettype vres (sig_res sg))\"\n\n(** The semantics is invariant under change of global environment that preserves symbols. *)\ndefinition [extcall_properties_defs']: \"ec_symbols_preserved \\\n (\\ ge1 ge2 vargs m1 t vres m2.\n Senv.equiv ge1 ge2 \\\n sem ge1 vargs m1 t vres m2 \\\n sem ge2 vargs m1 t vres m2)\"\n\n(** External calls cannot invalidate memory blocks. (Remember that\n freeing a block does not invalidate its block identifier.) *)\ndefinition [extcall_properties_defs']: \"ec_valid_block \\\n (\\ ge vargs m1 t vres m2 b.\n sem ge vargs m1 t vres m2 \\\n Mem.valid_block m1 b \\ Mem.valid_block m2 b)\"\n\n(** External calls cannot increase the max permissions of a valid block.\n They can decrease the max permissions, e.g. by freeing. *)\ndefinition [extcall_properties_defs']: \"ec_max_perm \\\n (\\ ge vargs m1 t vres m2 b ofs p.\n sem ge vargs m1 t vres m2 \\\n Mem.valid_block m1 b \\ Mem.perm m2 b ofs Max p \\ Mem.perm m1 b ofs Max p)\"\n\n(** External call cannot modify memory unless they have [Max, Writable]\n permissions. *)\ndefinition [extcall_properties_defs']: \"ec_readonly \\\n (\\ ge vargs m1 t vres m2 b ofs n bytes.\n sem ge vargs m1 t vres m2 \\\n Mem.valid_block m1 b \\\n Mem.loadbytes m2 b ofs n = Some bytes \\\n (\\ i ofs. ofs <= i \\ i < ofs + n \\ ~Mem.perm m1 b i Max Writable) \\\n Mem.loadbytes m1 b ofs n = Some bytes)\"\n\n(** External calls must commute with memory extensions, in the\n following sense. *)\ndefinition [extcall_properties_defs']: \"ec_mem_extends \\\n (\\ ge vargs m1 t vres m2 m1' vargs'.\n sem ge vargs m1 t vres m2 \\\n Mem.extends m1 m1' \\\n Val.lessdef_list vargs vargs' \\\n (\\ vres'. \\ m2'.\n sem ge vargs' m1' t vres' m2'\n \\ Val.lessdef vres vres'\n \\ Mem.extends m2 m2'\n \\ Mem.unchanged_on (loc_out_of_bounds m1) m1' m2'))\"\n\n(** External calls must commute with memory injections,\n in the following sense. *)\ndefinition [extcall_properties_defs']: \"ec_mem_inject \\\n (\\ ge1 ge2 vargs m1 t vres m2 f m1' vargs'.\n symbols_inject f ge1 ge2 \\\n sem ge1 vargs m1 t vres m2 \\\n Mem.inject f m1 m1' \\\n Val.inject_list f vargs vargs' \\\n (\\ f' vres' m2'.\n sem ge2 vargs' m1' t vres' m2'\n \\ Val.inject f' vres vres'\n \\ Mem.inject f' m2 m2'\n \\ Mem.unchanged_on (loc_unmapped f) m1 m2\n \\ Mem.unchanged_on (loc_out_of_reach f m1) m1' m2'\n \\ inject_incr f f'\n \\ inject_separated f f' m1 m1'))\"\n\n(** External calls produce at most one event. *)\ndefinition [extcall_properties_defs']: \"ec_trace_length \\\n (\\ ge vargs m t vres m'.\n sem ge vargs m t vres m' \\ (length t \\ 1))\"\n\n(** External calls must be receptive to changes of traces by another, matching trace. *)\ndefinition [extcall_properties_defs']: \"ec_receptive \\\n (\\ ge vargs m t1 vres1 m1 t2.\n sem ge vargs m t1 vres1 m1 \\ match_traces ge t1 t2 \\\n (\\ vres2. \\ m2. sem ge vargs m t2 vres2 m2))\"\n\n(** External calls must be deterministic up to matching between traces. *)\ndefinition [extcall_properties_defs']: \"ec_determ \\\n (\\ ge vargs m t1 vres1 m1 t2 vres2 m2.\n sem ge vargs m t1 vres1 m1 \\ sem ge vargs m t2 vres2 m2 \\\n match_traces ge t1 t2 \\ (t1 = t2 \\ vres1 = vres2 \\ m1 = m2))\"\n\ninductive extcall_properties where\n \"\\ ec_well_typed;\n ec_symbols_preserved;\n ec_valid_block;\n ec_max_perm;\n ec_readonly;\n ec_mem_extends;\n ec_mem_inject;\n ec_trace_length;\n ec_receptive;\n ec_determ \\ \\\n extcall_properties\"\n\nlemmas extcall_properties_def = extcall_properties_defs' extcall_properties.simps[simplified]\nend\n\nsubsection \\Semantics of dynamic memory allocation (malloc)\\\n\ninductive extcall_malloc_sem :: \"Senv_t \\ val list \\ mem \\ trace \\ val \\ mem \\ bool\" where\n extcall_malloc_sem_intro:\n \"Mem.alloc m (- size_chunk Mptr) (Int64.unsigned sz) = (m', b) \\\n Mem.store Mptr m' b (- size_chunk Mptr) (Vptrofs sz) = Some m'' \\\n extcall_malloc_sem ge [Vptrofs sz] m E0 (Vptr b 0) m''\"\n\nlemma extcall_malloc_unchanged_on:\n assumes \"Mem.mem_invariants m\"\n assumes \"extcall_malloc_sem ge vargs m t vres m''\"\n shows \"extcall_malloc_sem ge vargs m t vres m'' \\ Mem.unchanged_on P m m''\"\n apply (simp add: assms(2))\n using assms(2)\nproof (cases rule: extcall_malloc_sem.cases)\n case (extcall_malloc_sem_intro sz m' b)\n\n from \\Mem.alloc m (- size_chunk Mptr) (Int64.unsigned sz) = (m', b)\\\n have b'b: \"\\b'. Mem.valid_block m b' \\ b' \\ b\"\n using Mem.alloc_valid_block(2) by auto\n\n have unchanged1: \"Mem.unchanged_on P m m'\"\n using Mem.alloc_unchanged_on assms(1) local.extcall_malloc_sem_intro(4) by auto\n\n from \\Mem.store Mptr m' b (- size_chunk Mptr) (Vptrofs sz) = Some m''\\\n have unchanged2: \"Mem.unchanged_on (\\b ofs. P b ofs \\ Mem.valid_block m b) m' m''\"\n apply (rule Mem.store_unchanged_on)\n using b'b by simp\n\n note rule = Mem.unchanged_on_trans[OF assms(1), OF unchanged1 unchanged2]\n\n then show \"Mem.unchanged_on P m m''\"\n by simp\nqed\n\nlemma extcall_malloc_ok:\n \"extcall_properties extcall_malloc_sem\n (mksignature (Tptr # []) (Tret Tptr) cc_default)\"\n unfolding extcall_properties_def\n apply (safe elim!: extcall_malloc_sem.cases intro: extcall_malloc_sem_intro)\nproof (goal_cases)\n case (1 ge vargs m1 t vres m2 m sz m' b m'' gea)\n then show ?case\n by (simp add: signature.defs)\nnext\n case (2 ge1 ge2 vargs m1 t vres m2 m sz m' b m'' ge)\n then show ?case\n using \"2\"(2) \"2\"(3) extcall_malloc_sem_intro by blast\nnext\n case (3 ge vargs m1 t vres m2 b m sz m' ba m'' gea)\n\n then show ?case\n by (meson Mem'.alloc_valid_block(1) Mem'.store_valid_block)\nnext\n case (4 ge vargs m1 t vres m2 b ofs p m sz m' ba m'' gea)\n\n then show ?case\n by (meson Mem.alloc_max_perm Mem.store_max_perm)\nnext\n case (5 ge vargs m1 t vres m2 b ofs n bytes m sz m' ba m'' gea)\n then show ?case sorry\nnext\n case (6 ge vargs m1 t vres m2 m1' vargs' m sz m' b m'' gea)\n then show ?case sorry\nnext\n case (7 ge1 ge2 vargs m1 t vres m2 f m1' vargs' m sz m' b m'' ge)\n then show ?case sorry\nnext\n case (8 ge vargs m t vres m' ma sz m'a b m'' gea)\nthen show ?case sorry\nnext\n case (9 ge vargs m t1 vres1 m1 t2 ma sz m' b m'' gea)\n then show ?case sorry\nnext\n case (10 ge vargs m t1 vres1 m1 t2 vres2 m2 ma sz m' b m'' gea mb sza m'a ba m''a geb)\n then show ?case sorry\nnext\n case (11 ge vargs m t1 vres1 m1 t2 vres2 m2 ma sz m' b m'' gea mb sza m'a ba m''a geb)\n then show ?case sorry\nnext\n case (12 ge vargs m t1 vres1 m1 t2 vres2 m2 ma sz m' b m'' gea mb sza m'a ba m''a geb)\n then show ?case sorry\nqed\n\nsubsection \\Semantics of dynamic memory deallocation (free)\\\n\ninductive extcall_free_sem :: \"Senv_t \\ val list \\ mem \\ trace \\ val \\ mem \\ bool\" where\n extcall_free_sem_ptr:\n \"Mem.load Mptr m b (Int64.unsigned lo - size_chunk Mptr) = Some (Vptrofs sz) \\\n Int64.unsigned sz > 0 \\\n Mem.free m b (Int64.unsigned lo - size_chunk Mptr) (Int64.unsigned lo + Int64.unsigned sz) = Some m' \\\n extcall_free_sem ge (Vptr b lo # []) m E0 Vundef m'\"\n | extcall_free_sem_null:\n \"extcall_free_sem ge (Vnullptr # []) m E0 Vundef m\"\n\nlemma extcall_free_ok:\n \"extcall_properties extcall_free_sem\n (mksignature (Tptr # []) (Tvoid) cc_default)\"\n sorry\n\nsubsection \\Semantics of [memcpy] operations\\\n\ninductive extcall_memcpy_sem :: \"Z \\ Z \\ Senv_t \\ val list \\ mem \\ trace \\ val \\ mem \\ bool\" where\n extcall_memcpy_sem_intro:\n \"al = 1 \\ al = 2 \\ al = 4 \\ al = 8 \\ sz \\ 0 \\ (al dvd sz) \\\n (sz > 0 \\ (al dvd Int64.unsigned osrc)) \\\n (sz > 0 \\ (al dvd Int64.unsigned odst)) \\\n bsrc \\ bdst \\ Int64.unsigned osrc = Int64.unsigned odst\n \\ Int64.unsigned osrc + sz <= Int64.unsigned odst\n \\ Int64.unsigned odst + sz <= Int64.unsigned osrc \\\n Mem.loadbytes m bsrc (Int64.unsigned osrc) sz = Some bytes \\\n Mem.storebytes m bdst (Int64.unsigned odst) bytes = Some m' \\\n extcall_memcpy_sem sz al ge (Vptr bdst odst # Vptr bsrc osrc # []) m E0 Vundef m'\"\n\nlemma extcall_memcpy_ok:\n \"extcall_properties (extcall_memcpy_sem sz al)\n (mksignature (Tptr # Tptr # []) (Tvoid) cc_default)\"\n sorry\n\n(** Combining the semantics given above for the various kinds of external calls,\n we define the predicate [external_call] that relates:\n- the external function being invoked\n- the values of the arguments passed to this function\n- the memory state before the call\n- the result value of the call\n- the memory state after the call\n- the trace generated by the call (can be empty).\n\nThis predicate is used in the semantics of all CompCert languages. *)\n\ninductive extcall_dummy_sem :: \"extcall_sem\" where\n extcall_dummy_sem_intro: \"extcall_dummy_sem ge args m E0 sp m\"\n\nfun external_call :: \"external_function \\ extcall_sem\" where\n(* TODO: not implemented for now\n \"external_call (EF_external name sg) = external_functions_sem name sg\"\n| \"external_call (EF_builtin name sg) = builtin_or_external_sem name sg\"\n| \"external_call (EF_runtime name sg) = builtin_or_external_sem name sg\"\n| \"external_call (EF_vload chunk) = volatile_load_sem chunk\"\n| \"external_call (EF_vstore chunk) = volatile_store_sem chunk\" *)\n \"external_call EF_malloc = extcall_malloc_sem\"\n| \"external_call EF_free = extcall_free_sem\"\n| \"external_call (EF_memcpy sz al) = extcall_memcpy_sem sz al\"\n(* TODO: not implemented for now\n| \"external_call (EF_annot kind txt targs) = extcall_annot_sem txt targs\"\n| \"external_call (EF_annot_val kind txt targ) = extcall_annot_val_sem txt targ\"\n| \"external_call (EF_inline_asm txt sg clb) = inline_assembly_sem txt sg\"\n| \"external_call (EF_debug kind txt targs) = extcall_debug_sem\" *)\n\nlemmas extcall_simps =\n extcall_malloc_sem.simps extcall_free_sem.simps extcall_memcpy_sem.simps\nlemmas extcall_intros =\n extcall_malloc_sem.intros extcall_free_sem.intros extcall_memcpy_sem.intros\n\nlemmas external_call_intros = extcall_intros[folded external_call.simps]\n\nlemma external_call_spec:\n \"extcall_properties (external_call ef) (ef_sig ef)\"\n apply (cases ef)\n using extcall_malloc_ok extcall_free_ok extcall_memcpy_ok\n by auto\n\ndefinition \"external_call_well_typed_gen ef \\ ec_well_typed (external_call ef) (ef_sig ef)\"\ndefinition \"external_call_symbols_preserved ef \\ ec_symbols_preserved (external_call ef)\"\ndefinition \"external_call_valid_block ef \\ ec_valid_block (external_call ef)\"\ndefinition \"external_call_max_perm ef \\ ec_max_perm (external_call ef)\"\ndefinition \"external_call_readonly ef \\ ec_readonly (external_call ef)\"\ndefinition \"external_call_mem_extends ef \\ ec_mem_extends (external_call ef)\"\ndefinition \"external_call_mem_inject_gen ef \\ ec_mem_inject (external_call ef)\"\ndefinition \"external_call_trace_length ef \\ ec_trace_length (external_call ef)\"\ndefinition \"external_call_receptive ef \\ ec_receptive (external_call ef)\"\ndefinition \"external_call_determ ef \\ ec_determ (external_call ef)\"\n\n(** Corollaries of [external_call_determ]. *)\n\nlemma external_call_match_traces:\n assumes \"external_call ef ge vargs m t1 vres1 m1\"\n assumes \"external_call ef ge vargs m t2 vres2 m2\"\n shows \"match_traces ge t1 t2\"\nproof -\n have \"external_call_determ ef\"\n unfolding external_call_determ_def\n using extcall_properties.cases external_call_spec by auto\n\n then show ?thesis\n unfolding external_call_determ_def ec_determ_def\n using assms by simp\nqed\n\nlemma external_call_deterministic:\n assumes \"external_call ef ge vargs m t vres1 m1\"\n assumes \"external_call ef ge vargs m t vres2 m2\"\n shows \"vres1 = vres2 \\ m1 = m2\"\nproof -\n have \"external_call_determ ef\"\n unfolding external_call_determ_def\n using extcall_properties.cases external_call_spec by auto\n\n then show ?thesis\n unfolding external_call_determ_def ec_determ_def\n using assms by simp\nqed\n\nsection \\Additions\\\n\n(* modeling results of deterministic external_calls *)\ndefinition external_call_result :: \"external_function \\ Senv_t \\ val list \\ mem \\ (event list \\ val \\ mem) option\" where\n \"external_call_result ef ge vargs m \\\n if \\t vres m'. external_call ef ge vargs m t vres m'\n then Some (THE (t, vres, m'). external_call ef ge vargs m t vres m')\n else None\"\n\ndeclare external_call_result_def[code del]\n\nlemma external_call_resultI:\n assumes \"\\t vres m'. external_call ef ge vargs m t vres m' \\ res_fun ge vargs m = Some (t, vres, m')\"\n assumes \"(\\t vres m'. \\external_call ef ge vargs m t vres m') \\ res_fun ge vargs m = None\"\n shows \"external_call_result ef ge vargs m = res_fun ge vargs m\"\n unfolding external_call_result_def\n apply (split if_splits)\n by (smt (z3) Collect_cong The_split_eq assms(1) assms(2) case_prodE case_prodI in_rel_Collect_case_prod_eq option.inject)\n\nprint_statement extcall_malloc_sem.simps[simplified]\n\nlemma extcall_malloc_result:\n notes align_Mptr = align_dvd_size_mult[of Mptr \"-1\"]\n notes store_valid = Mem.store_after_alloc[OF _ _ _ align_Mptr]\n shows\n \"external_call_result EF_malloc ge [Vptrofs sz] m =\n (case Mem.alloc m (- size_chunk Mptr) (Int64.unsigned sz) of (m', b) \\\n (case Mem.store Mptr m' b (- size_chunk Mptr) (Vptrofs sz) of Some m'' \\\n Some (E0, Vptr b 0, m'') | _ \\ None))\"\n apply (rule external_call_resultI; split prod.splits; split option.splits)\n apply (simp)\n apply (erule extcall_malloc_sem.cases)\n unfolding Vptrofs_def\n apply force\n using Vptrofs_def extcall_malloc_sem_intro by fastforce\n\nprint_statement extcall_free_sem.simps[simplified]\n\nlemma extcall_free_result:\n shows\n \"external_call_result EF_free ge vargs m =\n (if vargs = [Vnullptr] then Some (E0, Vundef, m) else\n (case vargs of [Vptr b lo] \\\n (case Mem.load Mptr m b (Int64.unsigned lo - size_chunk Mptr) of Some (Vlong sz) \\\n (if Int64.unsigned sz = 0 then None else\n (case Mem.free m b (Int64.unsigned lo - size_chunk Mptr) (Int64.unsigned lo + Int64.unsigned sz) of Some m' \\\n Some (E0, Vundef, m') | _ \\ None)) | _ \\ None) | _ \\ None))\"\n apply (rule external_call_resultI)\n apply (auto elim!: extcall_free_sem.cases split: option.splits val.splits if_splits list.splits simp: Vptrofs_def Vnullptr_def)\n apply (metis Vnullptr_def extcall_free_sem_null)\n apply (simp add: extcall_free_sem.simps)\n unfolding Vptrofs_def Vnullptr_def\n by (metis linorder_neqE_linordered_idom uint_lt_0)\n\nprint_statement extcall_memcpy_sem.simps[simplified]\n\nlemma extcall_memcpy_result:\n shows\n \"external_call_result (EF_memcpy sz al) ge vargs m =\n (case vargs of [Vptr bdst odst, Vptr bsrc osrc] \\\n (if a2 = 1 \\ a2 = 2 \\ a2 = 4 \\ a2 = 8 then\n (if 0 \\ sz \\ (al dvd sz) then\n (if 0 < a1 \\ a2 dvd Int64.unsigned osrc then\n (if 0 < a1 \\ a2 dvd Int64.unsigned odst then\n (if bsrc = bdst \\\n Int64.unsigned osrc = Int64.unsigned odst \\\n Int64.unsigned osrc + a1 \\ Int64.unsigned odst \\\n Int64.unsigned odst + a1 \\ Int64.unsigned osrc then\n (case Mem.loadbytes m bsrc (Int64.unsigned osrc) sz of Some bytes \\\n (case Mem.storebytes m bdst (Int64.unsigned odst) bytes of Some m' \\\n Some (E0, Vundef, m') | _ \\ None) | _ \\ None) else None) else None) else None) else None) else None) | _ \\ None)\"\nproof -\n {\n fix osrc odst bsrc bdst bytes m'\n\n assume [simp]: \"vargs = [Vptr bdst odst, Vptr bsrc osrc]\"\n assume [iff]: \"a2 = 1 \\ a2 = 2 \\ a2 = 4 \\ a2 = 8\"\n assume sz[iff]: \"0 \\ sz \\ (al dvd sz)\"\n assume [iff]: \"0 < a1 \\ a2 dvd Int64.unsigned osrc\"\n assume [iff]: \"0 < a1 \\ a2 dvd Int64.unsigned odst\"\n assume [iff]: \"bsrc = bdst \\\n Int64.unsigned osrc = Int64.unsigned odst \\\n Int64.unsigned osrc + a1 \\ Int64.unsigned odst \\\n Int64.unsigned odst + a1 \\ Int64.unsigned osrc\"\n\n assume bytes[simp]: \"Mem.loadbytes m bsrc (Int64.unsigned osrc) sz = Some bytes\"\n assume m'[simp]: \"Mem.storebytes m bdst (Int64.unsigned odst) bytes = Some m'\"\n\n have bytes_len[simp]: \"length bytes = nat sz\"\n using Mem.loadbytes_len[OF bytes]\n by simp\n\n have sz_0[iff]: \"sz = 0 \\ m' = m\"\n using Mem.storebytes_0 Mem.loadbytes_0 bytes m' by auto\n\n then have ?thesis\n apply (simp)\n sorry\n }\n\n then show ?thesis\n sorry\n\nqed\n\nsubsection \\Determinism\\\n\n(*\n all external calls are guaranteed to be deterministic modulo their trace;\n so extcalls not generating a trace are fully deterministic\n*)\n\ndefinition \"determ_extfun ef \\\n \\ge vargs m t vres m'. (external_call ef ge vargs m t vres m' \\ t = E0)\"\n\n(* for now, all the external functions we implement are deterministic *)\nlemma determ_extfun[iff]: \"determ_extfun ef\"\n unfolding determ_extfun_def\n apply (cases ef)\n by (auto elim: extcall_malloc_sem.cases extcall_free_sem.cases extcall_memcpy_sem.cases)\n\nlemma determ_extfun_notrace:\n \"determ_extfun ef \\ external_call ef ge vargs m t vres m' \\ t = E0\"\n unfolding determ_extfun_def\n by blast\n\nlemma extcall_determ:\n assumes \"determ_extfun ef\"\n assumes \"external_call ef ge vargs m t vres m'\"\n shows \"external_call ef ge vargs m t' vres' m'' \\ t' = t \\ vres' = vres \\ m'' = m'\"\n using determ_extfun_notrace[OF assms]\n using assms(1) assms(2) determ_extfun_notrace external_call_deterministic by blast\n\nsubsection \\Equivalance\\\n\nlemma extcall_result_equiv:\n assumes \"determ_extfun ef\"\n shows\n \"external_call ef ge vargs m t vres m' \\ external_call_result ef ge vargs m = Some (t, vres, m')\"\n unfolding external_call_result_def\n apply standard\n using extcall_determ apply auto[1]\n apply (auto split: if_splits)\n by (smt (verit, ccfv_threshold) assms case_prodD case_prodE case_prodI extcall_determ theI')\n\nsubsection \\Deterministic world\\\n\nlocale deterministic_world\nbegin\nlemmas extcall_determ = extcall_determ[OF determ_extfun]\nlemmas extcall_result_equiv = extcall_result_equiv[OF determ_extfun]\nend\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/compcert/Events.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.27073872122213755}} {"text": "theory Simple_Network_Language_Model_Checking\n imports TA_Library.Temporal_Logics Simple_Network_Language_Impl_Refine\n Uppaal_Networks.UPPAAL_Model_Checking TA_Library.Abstract_Term\nbegin\n\nsection \\Product Bisimulation\\\n\nno_notation State_Networks.step_sn (\"_ \\ \\_, _, _\\ \\\\<^bsub>_\\<^esub> \\_, _, _\\\" [61,61,61,61,61] 61)\n\ntext \\\n We have proved the necessary theorems already but we need to lift it to\n the case where delay and action transitions are strictly alternating.\n\\\ninductive step_u' ::\n \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval\n \\ 's list \\ ('x \\ 'v) \\ ('c, 't) cval \\ bool\"\n(\"_ \\ \\_, _, _\\ \\ \\_, _, _\\\" [61,61,61,61] 61) where\n \"A \\ \\L, s, u\\ \\ \\L'', s'', u''\\\" if\n \"A \\ \\L, s, u\\ \\\\<^bsub>Del\\<^esub> \\L', s', u'\\\"\n \"a \\ Del\"\n \"A \\ \\L', s', u'\\ \\\\<^bsub>a\\<^esub> \\L'', s'', u''\\\"\n\ninductive_cases step'_elims: \"A \\' \\(L, s), u\\ \\ \\(L', s'), u'\\\"\n\ninductive_cases step_u'_elims: \"A \\ \\L, s, u\\ \\ \\L', s', u'\\\"\n\ntheorem Bisimulation_Invariant_strong_intro:\n fixes A :: \"'a \\ 'a \\ bool\"\n and P :: \"'a \\ bool\"\n and B :: \"'a \\ 'a \\ bool\"\n assumes \"\\a b. A a b \\ P a \\ B a b\"\n and \"\\a b. B a b \\ P a \\ A a b\"\n and \"\\a b. P a \\ A a b \\ P b\"\n shows \"Bisimulation_Invariant A B (=) P P\"\n apply standard\n subgoal A for a b a'\n by (blast intro: assms)\n subgoal B for a b a'\n by (blast intro: assms)\n subgoal C for a b\n by (rule assms)\n subgoal D for a b\n by (rule C, assumption) (rule assms)\n done\n\ncontext Prod_TA_Defs\nbegin\n\ndefinition\n \"all_prop L s = (L \\ states \\ bounded bounds s)\"\n\nlemma all_prop_boundedD[dest]:\n \"bounded bounds s\" if \"all_prop L s\"\n using that unfolding all_prop_def ..\n\nlemma all_prop_statesD[dest]:\n \"L \\ states\" if \"all_prop L s\"\n using that unfolding all_prop_def ..\n\nend (* Prod TA Defs *)\n\n\ncontext Prod_TA\nbegin\n\nlemma prod_action_step_not_eq_delay:\n \"a \\ Del\" if \"prod_ta \\ \\(L, s), u\\ \\\\<^bsub>a\\<^esub> \\(L', s'), u'\\\"\n using that\n apply cases\n unfolding trans_of_def\n unfolding prod_ta_def trans_prod_def\n by (auto simp: trans_int_def trans_bin_def trans_broad_def)\n\nend\n\nlocale Prod_TA_urge =\n Prod_TA + assumes urgency_removed: \"\\N \\ set (fst (snd A)). urgent N = {}\"\nbegin\n\nlemma prod_all_prop_inv:\n \"all_prop L' s'\" if \"all_prop L s\" \"prod_ta \\ \\(L, s), u\\ \\ \\(L', s'), u'\\\"\n using that unfolding all_prop_def\n by (auto elim: bounded_inv states_inv simp: step_iff[symmetric, OF _ _ urgency_removed])\n\nlemma prod_all_prop_inv':\n \"all_prop L' s'\" if \"all_prop L s\" \"prod_ta \\' \\(L, s), u\\ \\ \\(L', s'), u'\\\"\n using that by (auto intro: prod_all_prop_inv elim!: step'_elims)\n\ninterpretation prod_bisim:\n Bisimulation_Invariant\n \"(\\ (L, s, u) (L', s', u'). prod_ta \\' \\(L, s), u\\ \\ \\(L', s'), u'\\)\"\n \"(\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\"\n \"(=)\"\n \"(\\ (L, s, u). all_prop L s)\"\n \"(\\ (L, s, u). all_prop L s)\"\n apply (rule Bisimulation_Invariant_strong_intro; clarsimp)\n subgoal\n by (auto intro: step_u'.intros simp: all_prop_def\n dest: action_sound prod_action_step_not_eq_delay delay_sound[OF _ _ _ urgency_removed]\n elim!: step'_elims)\n subgoal\n by (auto 4 4 dest: prod_all_prop_inv action_complete elim: delay_complete elim!: step_u'_elims)\n subgoal\n by (rule prod_all_prop_inv')\n done\n\nlemmas prod_bisim_intro = prod_bisim.Bisimulation_Invariant_axioms\n\nend (* Prod TA *)\n\n\nsection \\The final semantics\\\n\ntext \\State formulas\\\ndatatype ('n, 's, 'a, 'b) sexp =\n true |\n \\ \\Boolean connectives\\\n not \"('n, 's, 'a, 'b) sexp\" | \"and\" \"('n, 's, 'a, 'b) sexp\" \"('n, 's, 'a, 'b) sexp\" |\n or \"('n, 's, 'a, 'b) sexp\" \"('n, 's, 'a, 'b) sexp\" | imply \"('n, 's, 'a, 'b) sexp\" \"('n, 's, 'a, 'b) sexp\" |\n \\ \\Does var \\a\\ equal \\x\\?\\\n eq 'a 'b |\n le 'a 'b |\n lt 'a 'b |\n ge 'a 'b |\n gt 'a 'b |\n \\ \\Is procces \\i\\ in location \\l\\?\\\n loc 'n 's\n\ndatatype ('n, 's, 'a, 'b) formula =\n EX \"('n, 's, 'a, 'b) sexp\" | EG \"('n, 's, 'a, 'b) sexp\"\n| AX \"('n, 's, 'a, 'b) sexp\" | AG \"('n, 's, 'a, 'b) sexp\"\n| Leadsto \"('n, 's, 'a, 'b) sexp\" \"('n, 's, 'a, 'b) sexp\"\n\nfun check_sexp :: \"(nat, 's, 'a, 'b :: linorder) sexp \\ 's list \\ ('a \\ 'b) \\ bool\" where\n \"check_sexp sexp.true _ _ \\ True\" |\n \"check_sexp (not e) L s \\ \\ check_sexp e L s\" |\n \"check_sexp (and e1 e2) L s \\ check_sexp e1 L s \\ check_sexp e2 L s\" |\n \"check_sexp (sexp.or e1 e2) L s \\ check_sexp e1 L s \\ check_sexp e2 L s\" |\n \"check_sexp (imply e1 e2) L s \\ check_sexp e1 L s \\ check_sexp e2 L s\" |\n \"check_sexp (eq i x) L s \\ s i = x\" |\n \"check_sexp (le i x) L s \\ s i \\ x\" |\n \"check_sexp (lt i x) L s \\ s i < x\" |\n \"check_sexp (ge i x) L s \\ s i \\ x\" |\n \"check_sexp (gt i x) L s \\ s i > x\" |\n \"check_sexp (loc i x) L s \\ L ! i = x\"\n\nfun locs_of_sexp :: \"('n, 's, 'a, 'b) sexp \\ 'n set\" where\n \"locs_of_sexp (not e) = locs_of_sexp e\" |\n \"locs_of_sexp (and e1 e2) = locs_of_sexp e1 \\ locs_of_sexp e2\" |\n \"locs_of_sexp (sexp.or e1 e2) = locs_of_sexp e1 \\ locs_of_sexp e2\" |\n \"locs_of_sexp (imply e1 e2) = locs_of_sexp e1 \\ locs_of_sexp e2\" |\n \"locs_of_sexp (loc i x) = {i}\" |\n \"locs_of_sexp _ = {}\"\n\nfun vars_of_sexp :: \"('n, 's, 'a, 'b) sexp \\ 'a set\" where\n \"vars_of_sexp (not e) = vars_of_sexp e\" |\n \"vars_of_sexp (and e1 e2) = vars_of_sexp e1 \\ vars_of_sexp e2\" |\n \"vars_of_sexp (sexp.or e1 e2) = vars_of_sexp e1 \\ vars_of_sexp e2\" |\n \"vars_of_sexp (imply e1 e2) = vars_of_sexp e1 \\ vars_of_sexp e2\" |\n \"vars_of_sexp (eq i x) = {i}\" |\n \"vars_of_sexp (lt i x) = {i}\" |\n \"vars_of_sexp (le i x) = {i}\" |\n \"vars_of_sexp (ge i x) = {i}\" |\n \"vars_of_sexp (gt i x) = {i}\" |\n \"vars_of_sexp _ = {}\"\n\nfun locs_of_formula :: \"('n, 's, 'a, 'b) formula \\ 'n set\" where\n \"locs_of_formula (formula.EX \\) = locs_of_sexp \\\" |\n \"locs_of_formula (EG \\) = locs_of_sexp \\\" |\n \"locs_of_formula (AX \\) = locs_of_sexp \\\" |\n \"locs_of_formula (AG \\) = locs_of_sexp \\\" |\n \"locs_of_formula (Leadsto \\ \\) = locs_of_sexp \\ \\ locs_of_sexp \\\"\n\nfun vars_of_formula :: \"('n, 's, 'a, 'b) formula \\ 'a set\" where\n \"vars_of_formula (formula.EX \\) = vars_of_sexp \\\" |\n \"vars_of_formula (EG \\) = vars_of_sexp \\\" |\n \"vars_of_formula (AX \\) = vars_of_sexp \\\" |\n \"vars_of_formula (AG \\) = vars_of_sexp \\\" |\n \"vars_of_formula (Leadsto \\ \\) = vars_of_sexp \\ \\ vars_of_sexp \\\"\n\nfun hd_of_formula :: \"(nat, 's, 'a, 'b) formula \\ 's list \\ ('a \\ 'b :: linorder) \\ bool\" where\n \"hd_of_formula (formula.EX \\) L s = check_sexp \\ L s\" |\n \"hd_of_formula (EG \\) L s = check_sexp \\ L s\" |\n \"hd_of_formula (AX \\) L s = Not (check_sexp \\ L s)\" |\n \"hd_of_formula (AG \\) L s = Not (check_sexp \\ L s)\" |\n \"hd_of_formula (Leadsto \\ _) L s = check_sexp \\ L s\"\n\ndefinition models (\"_,_ \\ _\" [61,61] 61) where\n \"A,a\\<^sub>0 \\ \\ \\ (case \\ of\n formula.EX \\ \\\n Graph_Defs.Ex_ev\n (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\ (L, s, _). check_sexp \\ L (the o s))\n | formula.EG \\ \\\n Graph_Defs.Ex_alw\n (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\ (L, s, _). check_sexp \\ L (the o s))\n | formula.AX \\ \\\n Graph_Defs.Alw_ev\n (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\ (L, s, _). check_sexp \\ L (the o s))\n | formula.AG \\ \\\n Graph_Defs.Alw_alw\n (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\ (L, s, _). check_sexp \\ L (the o s))\n | formula.Leadsto \\ \\ \\\n Graph_Defs.leadsto\n (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\)\n (\\ (L, s, _). check_sexp \\ L (the o s))\n (\\ (L, s, _). check_sexp \\ L (the o s))\n ) a\\<^sub>0\"\n\nlemmas models_iff = models_def[unfolded Graph_Defs.Ex_alw_iff Graph_Defs.Alw_alw_iff]\n\ndefinition prop_of where\n \"prop_of \\ = PropC (\\(L, s, _). check_sexp \\ L (the o s))\"\n\nfun ctl_of where\n \"ctl_of (formula.EX \\) = ctl_formula.EX (prop_of \\)\"\n| \"ctl_of (formula.EG \\) = ctl_formula.EG (prop_of \\)\"\n| \"ctl_of (formula.AX \\) = ctl_formula.AX (prop_of \\)\"\n| \"ctl_of (formula.AG \\) = ctl_formula.AG (prop_of \\)\"\n| \"ctl_of (formula.Leadsto \\ \\) =\n ctl_formula.AG (ctl_formula.ImpliesC (prop_of \\) (ctl_formula.AX (prop_of \\)))\"\n\ncontext\n fixes A :: \"('a, 's, 'c, 't :: time, 'x, 'v :: linorder) nta\"\nbegin\n\ninterpretation Graph_Defs \"\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\\" .\n\nlemma models_ctl_iff:\n \"A,a\\<^sub>0 \\ \\ \\ models_ctl (ctl_of \\) a\\<^sub>0\"\n by (cases \\) (simp_all add: models_def prop_of_def leadsto_def)\n\nend\n\nfun check_sexpi :: \"(nat, 's, nat, int) sexp \\ 's list \\ int list \\ bool\" where\n \"check_sexpi sexp.true _ _ \\ True\" |\n \"check_sexpi (not e) L s \\ \\ check_sexpi e L s\" |\n \"check_sexpi (and e1 e2) L s \\ check_sexpi e1 L s \\ check_sexpi e2 L s\" |\n \"check_sexpi (sexp.or e1 e2) L s \\ check_sexpi e1 L s \\ check_sexpi e2 L s\" |\n \"check_sexpi (imply e1 e2) L s \\ check_sexpi e1 L s \\ check_sexpi e2 L s\" |\n \"check_sexpi (eq i x) L s \\ s ! i = x\" |\n \"check_sexpi (le i x) L s \\ s ! i \\ x\" |\n \"check_sexpi (lt i x) L s \\ s ! i < x\" |\n \"check_sexpi (ge i x) L s \\ s ! i \\ x\" |\n \"check_sexpi (gt i x) L s \\ s ! i > x\" |\n \"check_sexpi (loc i x) L s \\ L ! i = x\"\n\nfun hd_of_formulai :: \"(nat, 's, nat, int) formula \\ 's list \\ int list \\ bool\" where\n \"hd_of_formulai (formula.EX \\) L s = check_sexpi \\ L s\" |\n \"hd_of_formulai (EG \\) L s = check_sexpi \\ L s\" |\n \"hd_of_formulai (AX \\) L s = Not (check_sexpi \\ L s)\" |\n \"hd_of_formulai (AG \\) L s = Not (check_sexpi \\ L s)\" |\n \"hd_of_formulai (Leadsto \\ _) L s = check_sexpi \\ L s\"\n\n\n\n(* XXX Stop locale constant unfolding in simplifier *)\nlemma all_prop_weak_cong[cong]:\n \"Prod_TA_Defs.all_prop A = Prod_TA_Defs.all_prop A\" for A\n by(rule HOL.refl)\nlemma equiv'_weak_cong[cong]:\n \"Bisimulation_Invariant.equiv' R P Q = Bisimulation_Invariant.equiv' R P Q\" for R P Q\n by (rule HOL.refl)\nlemma equiv'_weak_cong2[cong]:\n \"Simulation_Invariant.equiv' R P Q = Simulation_Invariant.equiv' R P Q\" for R P Q\n by (rule HOL.refl)\nlemma models_ctl_weak_cong[cong]:\n \"Graph_Defs.models_ctl E = Graph_Defs.models_ctl E\" for E\n by (rule HOL.refl)\nlemma models_path_weak_cong[cong]:\n \"Graph_Defs.models_path E = Graph_Defs.models_path E\" for E\n by (rule HOL.refl)\nlemma models_state_weak_cong[cong]:\n \"Graph_Defs.models_state E = Graph_Defs.models_state E\" for E\n by (rule HOL.refl)\nlemma models_ltl_weak_cong[cong]:\n \"Graph_Defs.models_ltlc E = Graph_Defs.models_ltlc E\" for E\n by (rule HOL.refl)\nlemma models_weak_cong[cong]:\n \"models E = models E\"\n for E by (rule HOL.refl)\n\n\n\n\nsection \\Instantiating the Model Checking Locale\\\n\nlocale Simple_Network_Impl_nat_urge =\n Simple_Network_Impl_nat + assumes no_urgency: \"\\ (_, U, _, _) \\ set automata. U = []\"\n\ntext \\\n This locale certifies that a given local clock ceiling is correct.\n Moreover, we certify that the vector of initial locations has outgoing transitions for\n each automaton, and that all variables of the initial state are in bounds.\n\\\nlocale Simple_Network_Impl_nat_ceiling_start_state =\n Simple_Network_Impl_nat_urge +\n fixes k :: \"nat list list list\"\n and L\\<^sub>0 :: \"nat list\"\n and s\\<^sub>0 :: \"(nat \\ int) list\"\n and formula :: \"(nat, nat, nat, int) formula\"\n and show_clock :: \"nat \\ string\"\n and show_state :: \"nat list \\ int list \\ string\"\n assumes k_ceiling:\n \"\\i < n_ps. \\(l, g) \\ set ((snd o snd o snd) (automata ! i)).\n \\(x, m) \\ collect_clock_pairs g. m \\ int (k ! i ! l ! x)\"\n \"\\i < n_ps. \\(l, _, g, _) \\ set ((fst o snd o snd) (automata ! i)).\n (\\(x, m) \\ collect_clock_pairs g. m \\ int (k ! i ! l ! x))\"\n and k_resets:\n \"\\i < n_ps. \\ (l, b, g, a, upd, r, l') \\ set ((fst o snd o snd) (automata ! i)).\n \\c \\ {0.. k ! i ! l ! c\"\n and k_length:\n \"length k = n_ps\" \"\\ i < n_ps. length (k ! i) = num_states i\"\n \"\\ xs \\ set k. \\ xxs \\ set xs. length xxs = m + 1\"\n and k_0:\n \"\\i < n_ps. \\l < num_states i. k ! i ! l ! 0 = 0\"\n and inv_unambiguous:\n \"\\(_, _, _, inv) \\ set automata. distinct (map fst inv)\"\n and s\\<^sub>0_bounded: \"bounded bounds (map_of s\\<^sub>0)\"\n and L\\<^sub>0_len: \"length L\\<^sub>0 = n_ps\"\n and L\\<^sub>0_has_trans: \"\\i < n_ps. L\\<^sub>0 ! i \\ fst ` set ((fst o snd o snd) (automata ! i))\"\n and vars_of_formula: \"vars_of_formula formula \\ {0..i\nThe ceiling \\k\\ is correct for each individual automaton in the network.\nWe now construct a ceiling for the product automaton:\n\\\ndefinition\n \"k_fun l c \\\n if (c > 0 \\ c \\ m) \\ fst l \\ states then Max {k ! i ! (fst l ! i) ! c | i . i < n_ps} else 0\"\n\nlemma (in -) default_map_of_distinct:\n \"(k, default_map_of x xs k) \\ set xs \\ {(k, x)}\" if \"distinct (map fst xs)\"\n unfolding default_map_of_alt_def by clarsimp (simp add: map_of_eq_Some_iff[OF that])\n\nlemma N_inv:\n \"(L ! i, inv (N i) (L ! i)) \\ set ((snd o snd o snd) (automata ! i)) \\ {(L ! i, [])}\"\n if \"i < n_ps\"\n unfolding N_def comp_def fst_conv snd_conv inv_def\n using that\n apply (subst nth_map)\n apply (simp add: n_ps_def; fail)\n apply (clarsimp split: prod.split simp: automaton_of_def)\n subgoal for _ _ _ xs\n using default_map_of_distinct[of xs \"L ! i\" \"[]\"] inv_unambiguous that\n by (auto dest!: nth_mem simp: n_ps_def)\n done\n\nlemma (in -) subset_nat_0_atLeastLessThan_conv:\n \"S \\ {0.. (\\ x \\ S. x < n)\"\n by auto\n\nlemma k_ceiling_rule:\n \"m \\ int (k ! i ! l ! x)\"\n if \"i < n_ps\" \"(l, b, g, xx) \\ set ((fst o snd o snd) (automata ! i))\"\n \"(x, m) \\ collect_clock_pairs g\"\n for i l x g xx\n using that k_ceiling(2) by fastforce\n\nlemma k_ceiling_1:\n \"\\s. \\L \\ states. \\(x,m) \\ clkp_set prod_ta (L, s). m \\ k_fun (L, s) x\"\nproof safe\n fix L s c x\n assume \\L \\ states\\ \\(c, x) \\ Closure.clkp_set prod_ta (L, s)\\\n have \"0 < c\" \"c \\ m\"\n proof -\n from \\(c, x) \\ _\\ have \"(c, x) \\ Timed_Automata.clkp_set prod_ta\"\n unfolding TA_clkp_set_unfold by auto\n with clock_range show \"0 < c\" \"c \\ m\"\n by auto\n qed\n with \\L \\ _\\ have \"k_fun (L, s) c = Max {k ! i ! (L ! i) ! c | i . i < n_ps}\"\n unfolding k_fun_def by auto\n have Max_aux: \"x \\ int (Max {k ! i ! (L ! i) ! c |i. i < n_ps})\"\n if \"x \\ int (k ! p ! (L ! p) ! c)\" \"p < n_ps\" for p\n proof -\n from \\p < n_ps \\ have \"k ! p ! (L ! p) ! c \\ Max {k ! i ! (L ! i) ! c |i. i < n_ps}\"\n by (intro Max_ge) auto\n with \\x \\ _\\ show ?thesis\n by simp\n qed\n from \\(c, x) \\ _\\ show \\x \\ k_fun (L, s) c\\\n unfolding clkp_set_def\n proof safe\n assume \\(c, x) \\ Closure.collect_clki (inv_of prod_ta) (L, s)\\\n then show \\x \\ k_fun (L, s) c\\\n using k_ceiling(1) unfolding collect_clki_def \\k_fun (L, s) c = _\\\n by (force intro: Max_aux dest: N_inv simp: prod_inv_def collect_clock_pairs_def k_fun_def)\n next\n assume \\(c, x) \\ Closure.collect_clkt (trans_of prod_ta) (L, s)\\\n then show \\x \\ k_fun (L, s) c\\\n unfolding collect_clkt_def \\k_fun (L, s) c = _\\\n apply (clarsimp simp: trans_prod_def collect_clock_pairs_def k_fun_def)\n apply safe\n subgoal\n using k_ceiling(2) unfolding trans_int_def\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n apply (fastforce intro!: Max_aux simp: collect_clock_pairs_def)\n done\n subgoal\n using k_ceiling(2) unfolding trans_bin_def\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n apply (erule disjE)\n apply (force intro!: Max_aux simp: collect_clock_pairs_def)+\n done\n subgoal\n using k_ceiling(2) unfolding trans_broad_def\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n apply (erule disjE)\n apply (fastforce intro!: Max_aux simp: collect_clock_pairs_def)\n apply (erule bexE)\n apply (force intro!: Max_aux simp: collect_clock_pairs_def)\n done\n done\n qed\nqed\n\nlemma k_fun_mono':\n \"k_fun (L, s) c \\ k_fun (L', s') c\" if\n \"\\i < n_ps. k ! i ! (L ! i) ! c \\ k ! i ! (L' ! i) ! c\" \"L \\ states\" \"L' \\ states\"\n using that unfolding k_fun_def\n apply clarsimp\n apply (cases \"n_ps = 0\")\n apply (simp; fail)\n apply (rule Max.boundedI)\n apply (simp; fail)\n apply blast\n apply safe\n subgoal for _ i\n by - (rule order.trans[where b = \"k ! i ! (L' ! i) ! c\"], auto intro: Max_ge)\n done\n\nlemma k_fun_mono:\n \\Max {k ! i ! (L ! i) ! c | i . i < n_ps} \\ Max {k ! i ! (L' ! i) ! c | i . i < n_ps}\\\n if \\\\i < n_ps. k ! i ! (L ! i) ! c \\ k ! i ! (L' ! i) ! c\\\n apply (cases \"n_ps = 0\")\n apply (simp; fail)\n apply (rule Max.boundedI)\n apply (simp; fail)\n apply blast\n apply safe\n subgoal for _ i\n using that by - (rule order.trans[where b = \"k ! i ! (L' ! i) ! c\"], auto intro: Max_ge)\n done\n\nlemma (in -) fold_upds_aux1:\n \"fold (\\p L. L[p := g p]) ps xs ! i = xs ! i\" if \\i \\ set ps\\\n using that by (induction ps arbitrary: xs) auto\n\nlemma (in -) fold_upds_aux2:\n \"fold (\\p L. L[p := g p]) ps xs ! i = g i\" if \\distinct ps\\ \\i \\ set ps\\ \\i < length xs\\\n using that by (induction ps arbitrary: xs) (auto simp: fold_upds_aux1)\n\nlemma (in -) fold_upds_aux_length:\n \"length (fold (\\p L. L[p := g p]) ps xs) = length xs\"\n by (induction ps arbitrary: xs) auto\n\n(* XXX Duplication *)\nlemma (in -) state_set_eq[simp]:\n \"Simulation_Graphs_TA.state_set A = state_set (trans_of A)\"\n unfolding Simulation_Graphs_TA.state_set_def state_set_def trans_of_def ..\n\nlemma prod_ta_step_statesD:\n assumes \"prod_ta \\ (L, s) \\\\<^bsup>g,a,r\\<^esup> (L', s')\"\n shows \"L \\ states\" \"L' \\ states\"\n using assms state_set_states by (fastforce dest: state_setI1 state_setI2)+\n\nlemma k_ceiling_2:\n \"\\l g a r l'. \\ c \\ m. prod_ta \\ l \\\\<^bsup>g,a,r\\<^esup> l' \\ c \\ set r \\ k_fun l' c \\ k_fun l c\"\nproof safe\n fix L s g a r L' s' c\n assume A: \\c \\ m\\ \\prod_ta \\ (L, s) \\\\<^bsup>g,a,r\\<^esup> (L', s')\\ \\c \\ set r\\\n then have \"L \\ states\" \"L' \\ states\"\n by - (rule prod_ta_step_statesD, assumption)+\n from A have \\Max {k ! i ! (L' ! i) ! c | i . i < n_ps} \\ Max {k ! i ! (L ! i) ! c | i . i < n_ps}\\\n apply simp\n unfolding trans_prod_def\n apply auto\n subgoal\n using k_resets\n unfolding trans_int_def\n apply clarsimp\n apply (rule k_fun_mono)\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n subgoal for b f p aa l' i\n by (cases \"p = i\"; force simp add: L_len)\n done\n subgoal\n using k_resets\n unfolding trans_bin_def\n apply clarsimp\n apply (rule k_fun_mono)\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n subgoal for _ _ p q b1 g1 f1 r1 l1' b2 g2 f2 r2 l2' i\n by (cases \"p = i\"; cases \"q = i\"; force simp add: L_len)\n done\n subgoal\n using k_resets\n unfolding trans_broad_def\n apply clarsimp\n apply (rule k_fun_mono)\n apply (clarsimp simp: mem_trans_N_iff L_len subset_nat_0_atLeastLessThan_conv)\n subgoal premises prems for s'a aa p b ga f ra l' bs gs fs rs ls' ps i\n proof (cases \"p = i\")\n case True\n with \\p \\ _\\ \\i < _\\ \\L \\ states\\ have \"(fold (\\p L. L[p := ls' p]) ps L)[p := l'] ! i = l'\"\n by (simp add: L_len fold_upds_aux_length)\n with prems \\p = i\\ show ?thesis\n by (fastforce simp add: L_len)\n next\n case False\n then have *: \"(fold (\\p L. L[p := ls' p]) ps L)[p := l'] ! i\n = fold (\\p L. L[p := ls' p]) ps L ! i\"\n by simp\n show ?thesis\n proof (cases \"i \\ set ps\")\n case True\n then have **: \"fold (\\p L. L[p := ls' p]) ps L ! i = ls' i\"\n using \\distinct ps\\ \\i < n_ps\\ \\L \\ states\\ by (auto simp: fold_upds_aux2)\n moreover have\n \"(L ! i, bs i, gs i, In aa, fs i, rs i, ls' i) \\ set (fst (snd (snd (automata ! i))))\"\n using \\p \\ i\\ True prems by fast\n moreover have \"c\\{0..p \\ i\\ True prems by force\n ultimately show ?thesis\n using prems(2) \\i < n_ps\\ by (auto 4 3 simp add: *)\n next\n case False\n with \\p \\ i\\ show ?thesis\n by (simp add: fold_upds_aux1)\n qed\n qed\n done\n done\n with \\L \\ states\\ \\L' \\ states\\ \\c \\ m\\ show \"k_fun (L', s') c \\ k_fun (L, s) c\"\n by (auto simp: k_fun_def)\nqed\n\n\n\nabbreviation F where \"F \\ \\(L, s). hd_of_formula formula L (the o s)\"\nabbreviation \"Fi \\ \\(L, s). hd_of_formulai formula L s\"\n\nlemma (in Simple_Network_Impl_nat) check_sexp_check_sexpi:\n \"check_sexp e L (the o s) \\ check_sexpi e L s'\"\n if \"state_rel s s'\" \"vars_of_sexp e \\ {0.. L (the o s) \\ hd_of_formulai \\ L s'\"\n if \"state_rel s s'\" \"vars_of_formula \\ \\ {0..) (auto simp: check_sexp_check_sexpi)\n\nlemma F_Fi:\n \"F l \\ Fi l'\" if \"(l', l) \\ loc_rel\"\n using vars_of_formula that unfolding loc_rel_def by clarsimp (erule hd_of_formula_hd_of_formulai)\n\n\nabbreviation \"l\\<^sub>0 \\ (L\\<^sub>0, map_of s\\<^sub>0)\"\nabbreviation \"s\\<^sub>0i \\ map (the o map_of s\\<^sub>0) [0..0i \\ (L\\<^sub>0, s\\<^sub>0i)\"\n\nlemma state_rel_start:\n \"state_rel (map_of s\\<^sub>0) s\\<^sub>0i\"\n using s\\<^sub>0_bounded unfolding state_rel_def bounded_def dom_bounds_eq by auto\n\nlemma statesI:\n \"L \\ states\" if \"length L = n_ps\" \"\\i fst ` set (fst (snd (snd (automata ! i))))\"\n using that unfolding states_def by (auto 4 3 simp: mem_trans_N_iff[symmetric])\n\nlemma L\\<^sub>0_states[simp, intro]:\n \"L\\<^sub>0 \\ states\"\n using L\\<^sub>0_has_trans L\\<^sub>0_len by (auto intro: statesI)\n\nlemma l\\<^sub>0_states'[simp, intro]:\n \"l\\<^sub>0 \\ states'\"\n using state_rel_start s\\<^sub>0_bounded unfolding states'_def state_rel_def by auto\n\nprint_locale Reachability_Problem_Defs\n\nsublocale reach: Reachability_Problem_Defs\n prod_ta\n l\\<^sub>0\n m\n k_fun\n F\n .\n\nlemma (in -) collect_clkt_state_setI:\n assumes \"(x, d) \\ Closure.collect_clkt (trans_of A) l\"\n shows \"l \\ state_set (trans_of A)\" \"l \\ Simulation_Graphs_TA.state_set A\"\n using assms unfolding collect_clkt_def by (auto simp: state_set_def)\n\nlemma clkp_set_statesD:\n fixes x d\n assumes \"(x, d)\\Closure.clkp_set prod_ta (L, s)\"\n shows \"L \\ states\"\n using assms\n unfolding clkp_set_def collect_clki_def\n apply safe\n subgoal\n apply simp\n unfolding prod_inv_def\n unfolding collect_clock_pairs_def\n apply auto\n done\n apply (drule collect_clkt_state_setI)\n using state_set_states by auto\n\nsublocale reach1: Reachability_Problem\n prod_ta\n l\\<^sub>0\n m\n k_fun\n F\n apply standard\n subgoal\n apply safe\n using k_ceiling_1\n subgoal for L s x m\n apply (cases \"L \\ states\")\n apply blast\n apply (auto dest: clkp_set_statesD simp: k_fun_def)\n done\n done\n subgoal\n apply safe\n subgoal for L s g a r L' s' c\n apply (cases \"c \\ m\")\n using k_ceiling_2\n apply force\n apply (auto simp: k_fun_def)\n done\n done\n subgoal\n by (simp add: k_fun_def)\n subgoal\n by (simp add: k_fun_def)\n done\n\nlemma states'_superset:\n \"{l\\<^sub>0} \\ Normalized_Zone_Semantics_Impl_Refine.state_set trans_prod \\ states'\"\n (is \"{l\\<^sub>0} \\ ?S \\ states'\")\nproof -\n have \"?S \\ states'\"\n proof clarsimp\n fix L s\n assume \"(L, s) \\ ?S\"\n then have \"L \\ states\"\n using state_set_states[unfolded trans_of_prod state_set_eq] by blast\n moreover have \"bounded bounds s\"\n using \\(L, s) \\ _\\\n unfolding state_set_def\n unfolding trans_prod_def\n unfolding trans_int_def trans_bin_def trans_broad_def\n by auto\n ultimately show \"(L, s) \\ states'\"\n by (auto simp: states'_alt_def)\n qed\n then show ?thesis\n by simp\nqed\n\n\n\ndefinition \"k_i \\ IArray (map (IArray o (map (IArray o map int))) k)\"\n\ndefinition\n \"k_impl \\ \\(l, _). IArray (map (\\ c. Max {k_i !! i !! (l ! i) !! c | i. i < n_ps}) [0.. {}\"\n apply (rule mono_Max_commute)\n apply rule\n using that by auto\n\nlemma (in Simple_Network_Impl_nat) n_ps_gt_0: \"n_ps > 0\"\n using length_automata_eq_n_ps non_empty by auto\n\nlemma statesD:\n \"L ! i \\ fst ` set (fst (snd (snd (automata ! i))))\n \\ L ! i \\ (snd o snd o snd o snd o snd o snd) ` set (fst (snd (snd (automata ! i))))\"\n if \"L \\ states\" \"length L = n_ps\" \"i < n_ps\"\n using that unfolding states_def\n apply auto\n apply -\n apply (elim allE impE, assumption)\n apply auto\n apply (force simp: mem_trans_N_iff)+\n done\n\nlemma k_impl_k_fun:\n \"k_impl (L, s) = IArray (map (k_fun (L, s)) [0.. states\"\nproof -\n define k_i2 where \"k_i2 i c = k_i !! i !! (L ! i) !! c\" for i c\n have k_i2_k: \"k_i2 i c = k ! i ! (L ! i) ! c\" if \"i < n_ps\" \"c \\ m\" for i c\n proof -\n have \"i < length k\"\n by (simp add: k_length(1) that(1))\n moreover have \"L ! i < length (k ! i)\"\n using L_i_len[OF _ \\L \\ states\\] k_length(2) \\i < n_ps\\ by auto\n moreover have \"c < length (k ! i ! (L ! i))\"\n using k_length(3) \\c \\ m\\ \\i < length k\\ \\L ! i < length (k ! i)\\ by (auto dest: nth_mem)\n ultimately show ?thesis\n unfolding k_i2_def k_i_def by simp\n qed\n have k_impl_alt_def: \"k_impl (L, s) = IArray (map (\\ c. Max {k_i2 i c | i. i < n_ps}) [0.. i. i < n_ps \\ f i = g i\" for f g :: \"nat \\ int\"\n by (rule arg_cong[where f = Max]) (force simp: that)\n from that n_ps_gt_0 show ?thesis\n unfolding k_impl_alt_def\n unfolding k_i2_def[symmetric]\n apply (clarsimp simp: k_fun_def k_i2_k cong: Max_cong)\n apply safe\n subgoal\n by (subst Max_int_commute; force simp: setcompr_eq_image image_comp comp_def)\n subgoal\n using k_0 L_i_len[OF _ \\L \\ states\\] by (intro linorder_class.Max_eqI) auto\n subgoal\n by (subst Max_int_commute; force simp: setcompr_eq_image image_comp comp_def)\n done\nqed\n\n\nsublocale impl: Reachability_Problem_Impl\n where trans_fun = trans_from\n and inv_fun = inv_fun\n and F_fun = Fi\n and ceiling = k_impl\n and A = prod_ta\n and l\\<^sub>0 = l\\<^sub>0\n and l\\<^sub>0i = l\\<^sub>0i\n and F = \"PR_CONST F\"\n and n = m\n and k = k_fun\n and trans_impl = trans_impl\n and states' = states'\n and loc_rel = loc_rel\n apply standard\n\n(* trans_from *)\n subgoal\n unfolding trans_of_prod by (rule trans_from_correct)\n\n(* trans_impl *)\n subgoal\n apply (rule trans_from_refine)\n done\n\n(* inv_fun *)\n subgoal\n unfolding trans_of_prod\n by (rule set_mp[OF _ inv_fun_inv_of'[where R = loc_rel and S = \"{(s, s'). state_rel s' s}\"]])\n (auto simp: loc_rel_def)\n\n(* state set *)\n subgoal\n using states'_superset by simp\n\n(* loc_rel l\\<^sub>0 l\\<^sub>0i*)\n subgoal\n using state_rel_start unfolding loc_rel_def by auto\n\n(* loc_rel left unique *)\n subgoal for l li li'\n unfolding trans_of_prod by (rule state_rel_left_unique)\n\n(* loc_rel right unique *)\n subgoal for l l' li\n unfolding trans_of_prod by (rule state_rel_right_unique)\n\n(* ceiling *)\n subgoal\n unfolding inv_rel_def using L\\<^sub>0_states\n by (auto simp: loc_rel_def state_rel_def reach.k'_def k_fun_def k_impl_k_fun)\n\n(* F_fun *)\n subgoal\n unfolding inv_rel_def by (clarsimp dest!: F_Fi)\n\n done\n\nend (* Simple_Network_Impl_nat_ceiling_start_state *)\n\nno_notation UPPAAL_Model_Checking.models (\"_,_ \\\\<^sub>_ _\" [61,61] 61)\n\n\ncontext Reachability_Problem_Impl\nbegin\n\nlemma F_reachable_correct:\n \"op.F_reachable\n \\ (\\l'. \\u\\<^sub>0. (\\c \\ {1..n}. u\\<^sub>0 c = 0) \\ (\\ u'. conv_A A \\' \\l\\<^sub>0, u\\<^sub>0\\ \\* \\l', u'\\ \\ F l'))\"\n using E_op''.E_from_op_reachability_check[symmetric] reachability_check_new\n unfolding E_op_F_reachable E_op''.F_reachable_def E_op''.reachable_def\n unfolding F_rel_def by auto\n\nlemma E_op''_F_reachable_correct:\n \"E_op''.F_reachable\n \\ (\\l'. \\u\\<^sub>0. (\\c \\ {1..n}. u\\<^sub>0 c = 0) \\ (\\ u'. conv_A A \\' \\l\\<^sub>0, u\\<^sub>0\\ \\* \\l', u'\\ \\ F l'))\"\n using E_op''.E_from_op_reachability_check[symmetric] reachability_check_new\n unfolding E_op_F_reachable E_op''.F_reachable_def E_op''.reachable_def\n unfolding F_rel_def by auto\n\nlemma Ex_ev_impl_hnr:\n assumes \"\\u\\<^sub>0. (\\c \\ {1..n}. u\\<^sub>0 c = 0) \\ \\ deadlock (l\\<^sub>0, u\\<^sub>0)\"\n shows\n \"\n (uncurry0\n (pw_impl (return \\ fst) state_copy_impl tracei subsumes_impl a\\<^sub>0_impl F_impl succs_impl\n emptiness_check_impl),\n uncurry0 (SPEC (\\r. (r \\ (\\u\\<^sub>0. (\\c \\ {1..n}. u\\<^sub>0 c = 0) \\ Ex_ev (\\(l, _). F l) (l\\<^sub>0, u\\<^sub>0))))))\n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\nproof -\n interpret Bisimulation_Invariant\n \"(\\(l, u) (l', u'). conv_A A \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). conv_A A \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). l' = l \\ (\\ c. c \\ clk_set (conv_A A) \\ u c = u' c))\"\n \"(\\_. True)\" \"(\\_. True)\"\n apply (rule ta_bisimulation)\n done\n define spec where \"spec = (\\u\\<^sub>0. (\\c \\ {1..n}. u\\<^sub>0 c = 0) \\ Ex_ev (\\(l, _). F l) (l\\<^sub>0, u\\<^sub>0))\"\n have *: \"E_op''.F_reachable \\ spec\"\n unfolding spec_def\n unfolding E_op''_F_reachable_correct\n proof safe\n fix l' :: \\'s\\ and u\\<^sub>0 :: \\nat \\ real\\\n assume\n \\\\u\\<^sub>0. (\\c\\{1..n}. u\\<^sub>0 c = 0) \\ (\\u'. conv_A A \\' \\l\\<^sub>0, u\\<^sub>0\\ \\* \\l', u'\\ \\ F l')\\ and\n \\\\c\\{1..n}. u\\<^sub>0 c = 0\\\n then show \\Ex_ev (\\(l, _). F l) (l\\<^sub>0, u\\<^sub>0)\\\n using assms by (subst Ex_ev; unfold reaches_steps'[symmetric]) blast+\n next\n assume \\\\u\\<^sub>0. (\\c\\{1..n}. u\\<^sub>0 c = 0) \\ Ex_ev (\\(l, _). F l) (l\\<^sub>0, u\\<^sub>0)\\\n then have \"Ex_ev (\\(l, _). F l) (l\\<^sub>0, \\_. 0)\"\n by auto\n then obtain l' u' where \"conv_A A \\' \\l\\<^sub>0, (\\_. 0)\\ \\* \\l', u'\\ \\ F l'\"\n apply (subst (asm) Ex_ev)\n using assms\n unfolding reaches_steps'[symmetric]\n by auto\n then show \\\\l'. \\u\\<^sub>0. (\\c\\{1..n}. u\\<^sub>0 c = 0) \\ (\\u'. conv_A A \\' \\l\\<^sub>0, u\\<^sub>0\\ \\* \\l', u'\\ \\ F l')\\\n proof (inst_existentials l', clarsimp, unfold reaches_steps'[symmetric])\n fix u\\<^sub>0 :: \\nat \\ real\\\n assume \\reaches (l\\<^sub>0, \\_. 0) (l', u')\\ and \\F l'\\ and \\\\c\\{Suc 0..n}. u\\<^sub>0 c = 0\\\n then have \"equiv' (l\\<^sub>0, \\_. 0) (l\\<^sub>0, u\\<^sub>0)\"\n unfolding equiv'_def using clocks_I[of \"\\_. 0\" u\\<^sub>0] by auto\n with \\reaches _ _\\ show \\\\u'. reaches (l\\<^sub>0, u\\<^sub>0) (l', u')\\\n by - (drule (1) bisim.A_B.simulation_reaches, unfold equiv'_def, auto)\n qed\n qed\n show ?thesis\n unfolding spec_def[symmetric] using pw_impl_hnr_F_reachable[to_hnr, unfolded hn_refine_def]\n by sepref_to_hoare (sep_auto simp: *)\nqed\n\nend (* Reachability Problem Impl *)\n\n\n\n\n\n\n\n\n\n\n\ncontext Simple_Network_Impl_nat_urge\nbegin\n\nsublocale conv: Prod_TA_urge\n \"(set broadcast, map (Simple_Network_Language.conv_A o automaton_of) automata, map_of bounds')\"\n by standard\n (use no_urgency in \\auto simp: Simple_Network_Language.conv_A_def automaton_of_def urgent_def\\)\n\nabbreviation \"A \\ (set broadcast, map automaton_of automata, map_of bounds')\"\n\ninterpretation conv_eq_bisim:\n Bisimulation_Invariant\n \"(\\(l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(L, s, u) (L', s', u'). conv.prod_ta \\' \\(L, s), u\\ \\ \\(L', s'), u'\\)\"\n \"(\\((L, s), u) (L', s', u'). L = L' \\ u = u' \\ s = s')\"\n \"(\\((L, s), u). conv.all_prop L s)\"\n \"(\\(L, s, u). conv.all_prop L s)\"\nproof goal_cases\n case 1\n interpret Bisimulation_Invariant\n \"(\\(L, s, u) (L', s', u'). conv_A prod_ta \\' \\(L, s), u\\ \\ \\(L', s'), u'\\)\"\n \"(\\(L, s, u) (L', s', u'). conv.prod_ta \\' \\(L, s), u\\ \\ \\(L', s'), u'\\)\"\n \"(=)\"\n \"(\\(L, s, u). conv.all_prop L s)\"\n \"(\\(L, s, u). conv.all_prop L s)\"\n by (rule Bisimulation_Invariant_strong_intro)\n (auto simp: conv_prod_ta elim: conv.prod_all_prop_inv')\n show ?case\n by standard (auto simp: conv_prod_ta elim: conv.prod_all_prop_inv')\nqed\n\ninterpretation Bisimulation_Invariant\n \"(\\(l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(L, s, u) (L', s', u'). Simple_Network_Language.conv A \\ \\L, s, u\\ \\ \\L', s', u'\\)\"\n \"(\\((L, s), u) (L', s', u'). L = L' \\ u = u' \\ s = s')\"\n \"(\\((L, s), u). conv.all_prop L s)\"\n \"(\\(L, s, u). conv.all_prop L s)\"\n unfolding conv_alt_def\n apply (rule Bisimulation_Invariant_sim_replace, rule Bisimulation_Invariant_composition)\n apply (rule conv_eq_bisim.Bisimulation_Invariant_axioms conv.prod_bisim_intro)+\n apply auto\n done\n\nlemmas prod_bisim = Bisimulation_Invariant_axioms\n\nlemmas deadlock_iff = deadlock_iff\n\nlemma conv_all_prop:\n \"conv.all_prop = all_prop\"\n unfolding conv.all_prop_def all_prop_def by simp\n\nthm Ex_ev_iff\nthm CTL_compatible[THEN rel_funD, symmetric]\n\ndefinition prop_of2 where\n \"prop_of2 \\ = PropC (\\((L, s), _). check_sexp \\ L (the o s))\"\n\nfun ctl_of2 where\n \"ctl_of2 (formula.EX \\) = ctl_formula.EX (prop_of2 \\)\"\n| \"ctl_of2 (formula.EG \\) = ctl_formula.EG (prop_of2 \\)\"\n| \"ctl_of2 (formula.AX \\) = ctl_formula.AX (prop_of2 \\)\"\n| \"ctl_of2 (formula.AG \\) = ctl_formula.AG (prop_of2 \\)\"\n| \"ctl_of2 (formula.Leadsto \\ \\) =\n ctl_formula.AG (ctl_formula.ImpliesC (prop_of2 \\) (ctl_formula.AX (prop_of2 \\)))\"\n\nlemma models_correct:\n \"Simple_Network_Language.conv A,(L\\<^sub>0, s\\<^sub>0, u\\<^sub>0) \\ \\ = (case \\ of\n formula.EX \\ \\\n Graph_Defs.Ex_ev\n (\\ (l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\n (\\ ((L, s), _). check_sexp \\ L (the o s))\n | formula.EG \\ \\\n Not o Graph_Defs.Alw_ev\n (\\ (l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\n (\\ ((L, s), _). \\ check_sexp \\ L (the o s))\n | formula.AX \\ \\\n Graph_Defs.Alw_ev\n (\\ (l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\n (\\ ((L, s), _). check_sexp \\ L (the o s))\n | formula.AG \\ \\\n Not o Graph_Defs.Ex_ev\n (\\ (l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\n (\\ ((L, s), _). \\ check_sexp \\ L (the o s))\n | formula.Leadsto \\ \\ \\\n Graph_Defs.leadsto\n (\\ (l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\n (\\ ((L, s), _). check_sexp \\ L (the o s))\n (\\ ((L, s), _). check_sexp \\ L (the o s))\n ) ((L\\<^sub>0, s\\<^sub>0), u\\<^sub>0)\n \" if \"L\\<^sub>0 \\ states\" \"Simple_Network_Language.bounded bounds s\\<^sub>0\"\nproof -\n have *: \"((Not \\\\ case_prod) (\\(L, s) _. check_sexp \\ L (the o s)))\n = (\\((L, s), _). \\ check_sexp \\ L (the o s))\"\n for \\ by (auto simp: comp_def)\n have \"rel_ctl_formula compatible (ctl_of2 \\) (ctl_of \\)\"\n by (cases \\; simp add: prop_of_def prop_of2_def rel_fun_def A_B.equiv'_def)\n moreover have \"A_B.equiv' ((L\\<^sub>0, s\\<^sub>0), u\\<^sub>0) (L\\<^sub>0, s\\<^sub>0, u\\<^sub>0)\"\n unfolding A_B.equiv'_def unfolding conv_all_prop all_prop_def using that by simp\n ultimately show ?thesis\n apply (subst models_ctl_iff)\n apply (subst CTL_compatible[THEN rel_funD, symmetric])\n apply assumption+\n apply (cases \\; simp add:\n Graph_Defs.models_ctl.simps prop_of2_def\n Graph_Defs.Ex_alw_iff Graph_Defs.Alw_alw_iff Graph_Defs.leadsto_def *)\n done\nqed\n\nend (* Simple_Network_Impl_nat *)\n\ncontext Simple_Network_Impl_nat_ceiling_start_state\nbegin\n\ndefinition Alw_ev_checker where\n \"Alw_ev_checker = dfs_map_impl'\n (impl.succs_P_impl' Fi) impl.a\\<^sub>0_impl impl.subsumes_impl (return \\ fst)\n impl.state_copy_impl\"\n\ndefinition leadsto_checker where\n \"leadsto_checker \\ = do {\n r \\ leadsto_impl\n impl.state_copy_impl (impl.succs_P_impl' (\\ (L, s). \\ check_sexpi \\ L s))\n impl.a\\<^sub>0_impl impl.subsumes_impl (return \\ fst)\n impl.succs_impl' impl.emptiness_check_impl impl.F_impl\n (impl.Q_impl (\\ (L, s). \\ check_sexpi \\ L s))\n impl.tracei;\n return (\\ r)\n }\"\n\ndefinition\n \"reachability_checker \\\n pw_impl\n (return o fst) impl.state_copy_impl impl.tracei impl.subsumes_impl impl.a\\<^sub>0_impl impl.F_impl\n impl.succs_impl impl.emptiness_check_impl\"\n\ndefinition model_checker where\n \"model_checker = (\n case formula of\n formula.EX _ \\ reachability_checker |\n formula.AG _ \\ do {\n r \\ reachability_checker;\n return (\\ r)\n } |\n formula.AX _ \\ do {\n r \\ if PR_CONST F l\\<^sub>0\n then Alw_ev_checker\n else return False;\n return (\\ r)\n } |\n formula.EG _ \\\n if PR_CONST F l\\<^sub>0\n then Alw_ev_checker\n else return False |\n formula.Leadsto _ \\ \\ leadsto_checker \\\n )\n \"\n\nabbreviation \"u\\<^sub>0 \\ (\\ _. 0 :: real)\"\n\nlemma all_prop_start:\n \"all_prop L\\<^sub>0 (map_of s\\<^sub>0)\"\n using L\\<^sub>0_states s\\<^sub>0_bounded unfolding all_prop_def ..\n\nlemma deadlock_start_iff:\n \"Graph_Defs.deadlock\n (\\(L, s, u) (L', s', u'). Simple_Network_Language.conv A \\ \\L, s, u\\ \\ \\L', s', u'\\) (L\\<^sub>0, (map_of s\\<^sub>0), u\\<^sub>0)\n \\ reach.deadlock (l\\<^sub>0, u\\<^sub>0)\"\n using all_prop_start by (subst deadlock_iff[symmetric]) (auto simp: conv_all_prop)\n\nlemma F_Fi':\n \"check_sexp \\ L (the o s) \\ check_sexpi \\ L' s'\"\n if \"((L', s'), (L, s)) \\ loc_rel\" \"formula = Leadsto \\ \\\"\n using vars_of_formula that unfolding loc_rel_def by (auto elim!: check_sexp_check_sexpi)\n\ntheorem model_check':\n \"(uncurry0 model_checker,\n uncurry0 (\n SPEC (\\r.\n \\ Graph_Defs.deadlock\n (\\(L, s, u) (L', s', u').\n Simple_Network_Language.conv A \\ \\L, s, u\\ \\ \\L', s', u'\\) (L\\<^sub>0, (map_of s\\<^sub>0), u\\<^sub>0)\n \\ r = (Simple_Network_Language.conv A,(L\\<^sub>0, (map_of s\\<^sub>0), u\\<^sub>0) \\ formula)\n )\n )\n )\n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\nproof -\n define protect where\n \"protect = ((\\(l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\))\"\n\n have start: \"l\\<^sub>0 \\ Normalized_Zone_Semantics_Impl_Refine.state_set trans_prod\"\n if \"\\ Graph_Defs.deadlock protect (l\\<^sub>0, \\_. 0)\"\n using that unfolding protect_def by (rule impl.init_state_in_state_set[simplified])\n\n interpret ta_bisim: Bisimulation_Invariant\n \"(\\(l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). conv_A prod_ta \\' \\l, u\\ \\ \\l', u'\\)\"\n \"(\\(l, u) (l', u'). l' = l \\ (\\ c. c \\ clk_set (conv_A prod_ta) \\ u c = u' c))\"\n \"(\\_. True)\" \"(\\_. True)\"\n by (rule ta_bisimulation[of \"conv_A prod_ta\"])\n\n let ?\\1 = \"\\\\. \\(p, _). case p of (L, s) \\ \\ check_sexp \\ L (the \\ s)\"\n let ?\\2 = \"\\\\. \\(p, _). case p of (L, s) \\ check_sexp \\ L (the \\ s)\"\n\n have start_sim:\n \"ta_bisim.A_B.equiv' (l\\<^sub>0, u) (l\\<^sub>0, \\_. 0)\" \"ta_bisim.A_B.equiv' (l\\<^sub>0, \\_. 0) (l\\<^sub>0, u)\"\n if \"\\c\\{Suc 0..m}. u c = 0\" for u\n using impl.clocks_I[of u \"\\_. 0\"] that unfolding ta_bisim.A_B.equiv'_def by auto\n\n have compatibleI: \"\\ a = \\ b\"\n if \"ta_bisim.A_B.equiv' a b\" \"\\ l u u'. \\ (l, u) = \\ (l, u')\" for a b \\\n using that unfolding ta_bisim.A_B.equiv'_def by auto\n\n have bisims:\n \"(\\u\\<^sub>0. (\\c\\{Suc 0..m}. u\\<^sub>0 c = 0) \\ reach.Ex_ev (?\\1 \\) (l\\<^sub>0, u\\<^sub>0))\n \\ reach.Ex_ev (?\\1 \\) (l\\<^sub>0, u\\<^sub>0)\"\n \"(\\u\\<^sub>0. (\\c\\{Suc 0..m}. u\\<^sub>0 c = 0) \\ reach.Ex_ev (?\\2 \\) (l\\<^sub>0, u\\<^sub>0))\n \\ reach.Ex_ev (?\\2 \\) (l\\<^sub>0, u\\<^sub>0)\"\n \"(\\u\\<^sub>0. (\\c\\{Suc 0..m}. u\\<^sub>0 c = 0) \\ reach.Alw_ev (?\\1 \\) (l\\<^sub>0, u\\<^sub>0))\n \\ reach.Alw_ev (?\\1 \\) (l\\<^sub>0, u\\<^sub>0)\"\n \"(\\u\\<^sub>0. (\\c\\{Suc 0..m}. u\\<^sub>0 c = 0) \\ reach.Alw_ev (?\\2 \\) (l\\<^sub>0, u\\<^sub>0))\n \\ reach.Alw_ev (?\\2 \\) (l\\<^sub>0, u\\<^sub>0)\"\n \"(\\u\\<^sub>0. (\\c\\{Suc 0..m}. u\\<^sub>0 c = 0) \\ reach.leadsto (?\\2 \\) (?\\2 \\) (l\\<^sub>0, u\\<^sub>0))\n \\ reach.leadsto (?\\2 \\) (?\\2 \\) (l\\<^sub>0, u\\<^sub>0)\"\n for \\ \\\n apply auto\n subgoal for u\n using start_sim\n by (subst (asm) ta_bisim.Ex_ev_iff[of \"?\\1 \\\" \"?\\1 \\\"]) (erule compatibleI, auto)\n subgoal for u\n using start_sim\n by (subst (asm) ta_bisim.Ex_ev_iff[of \"?\\2 \\\" \"?\\2 \\\"]) (erule compatibleI, auto)\n subgoal for u\n using start_sim\n by (subst (asm) ta_bisim.Alw_ev_iff[of \"?\\1 \\\" \"?\\1 \\\"]) (erule compatibleI, auto)\n subgoal for u\n using start_sim\n by (subst (asm) ta_bisim.Alw_ev_iff[of \"?\\2 \\\" \"?\\2 \\\"]) (erule compatibleI, auto)\n subgoal for u\n using start_sim\n by (subst (asm) ta_bisim.Leadsto_iff[of \"?\\2 \\\" \"?\\2 \\\" \"?\\2 \\\" \"?\\2 \\\"])\n ((erule compatibleI)?; auto)+\n done\n\n have deadlock_bisim:\n \"(\\u\\<^sub>0. (\\c\\{1..m}. u\\<^sub>0 c = 0) \\ \\ reach.deadlock (l\\<^sub>0, u\\<^sub>0))\n \\ \\ Graph_Defs.deadlock protect (l\\<^sub>0, \\_. 0)\"\n unfolding protect_def\n apply (safe; clarsimp)\n apply (drule start_sim(2))\n apply (subst (asm) ta_bisim.deadlock_iff)\n unfolding ta_bisim.A_B.equiv'_def\n by auto\n\n have *****:\n \"return True = (return False \\ return o Not)\"\n by auto\n\n show ?thesis\n unfolding deadlock_start_iff\n using models_correct[OF L\\<^sub>0_states s\\<^sub>0_bounded]\n unfolding protect_def[symmetric]\n apply (simp split del: if_split)\n apply sepref_to_hoare\n apply sep_auto\n unfolding model_checker_def Alw_ev_checker_def leadsto_checker_def reachability_checker_def\n apply (cases formula; simp)\n\n subgoal\n apply (cases \"Graph_Defs.deadlock protect (l\\<^sub>0, \\_. 0)\")\n subgoal\n using impl.pw_impl_hnr_F_reachable[to_hnr, unfolded hn_refine_def]\n by (sep_auto elim!: cons_post_rule)\n subgoal\n using impl.Ex_ev_impl_hnr[unfolded deadlock_bisim, to_hnr, unfolded hn_refine_def]\n by (sep_auto simp: pure_def protect_def bisims)\n done\n\n subgoal premises prems for \\\n proof -\n have *: \"(\\(l, u). \\ F l) = ((\\(p, _). case p of (L, s) \\ \\ check_sexp \\ L (the \\ s)))\"\n using prems by auto\n show ?thesis\n using impl.Alw_ev_impl_hnr[to_hnr, unfolded hn_refine_def] prems start\n unfolding PR_CONST_def * protect_def\n by (sep_auto elim!: cons_post_rule simp: pure_def bisims)\n qed\n\n subgoal premises prems for \\\n proof -\n have *: \"(\\(l, u). \\ F l) = ((\\(p, _). case p of (L, s) \\ check_sexp \\ L (the \\ s)))\"\n using prems by auto\n show ?thesis\n apply intros\n subgoal\n using impl.Alw_ev_impl_hnr[to_hnr, unfolded hn_refine_def] prems start\n unfolding PR_CONST_def * protect_def\n apply simp\n unfolding *****\n apply (erule bind_rule)\n apply (sep_auto simp: pure_def bisims(2-))\n done\n subgoal\n using impl.Alw_ev_impl_hnr[to_hnr, unfolded hn_refine_def] prems start\n unfolding PR_CONST_def * protect_def\n apply (sep_auto elim!: cons_post_rule simp: pure_def bisims(2-))\n done\n done\n qed\n\n subgoal\n apply (cases \"Graph_Defs.deadlock protect (l\\<^sub>0, \\_. 0)\")\n subgoal\n using impl.pw_impl_hnr_F_reachable[to_hnr, unfolded hn_refine_def]\n by (sep_auto elim!: cons_post_rule)\n subgoal\n using impl.Ex_ev_impl_hnr[unfolded deadlock_bisim, to_hnr, unfolded hn_refine_def]\n apply (sep_auto simp: pure_def protect_def bisims)\n done\n done\n\n subgoal premises prems for \\ \\\n proof -\n have *: \"(\\(l, u). F l) = ((\\(p, _). case p of (L, s) \\ check_sexp \\ L (the \\ s)))\"\n using prems by auto\n have **:\"(\\(L, s). \\ check_sexpi \\ L s, \\(L, s). \\ check_sexp \\ L (the \\ s))\n \\ inv_rel loc_rel states'\"\n unfolding trans_of_prod using prems by (auto simp: F_Fi' inv_rel_def)\n have ****: \"(\\(l, u). \\ (case l of (L, s) \\ \\ check_sexp \\ L (the \\ s)))\n = (\\(l, u). (case l of (L, s) \\ check_sexp \\ L (the \\ s)))\"\n by auto\n show ?thesis\n apply (cases \"reach.deadlock (l\\<^sub>0, \\_. 0)\")\n subgoal\n using impl.leadsto_impl_hnr'[OF **, to_hnr, unfolded hn_refine_def]\n unfolding protect_def \\formula = _\\ by (sep_auto simp: pure_def)\n using impl.leadsto_impl_hnr[unfolded deadlock_bisim, to_hnr, unfolded hn_refine_def, OF **]\n prems start\n unfolding PR_CONST_def * protect_def by (sep_auto simp: pure_def bisims ****)\n qed\n done\nqed\n\n\nsubsection \\Extracting an efficient implementation\\\n\nlemma reachability_checker_alt_def':\n \"reachability_checker \\\n do {\n x \\ do {\n let key = return \\ fst;\n let sub = impl.subsumes_impl;\n let copy = impl.state_copy_impl;\n let start = impl.a\\<^sub>0_impl;\n let final = impl.F_impl;\n let succs = impl.succs_impl;\n let empty = impl.emptiness_check_impl;\n let trace = impl.tracei;\n pw_impl key copy trace sub start final succs empty\n };\n _ \\ return ();\n return x\n }\"\n unfolding reachability_checker_def by simp\n\nlemma Alw_ev_checker_alt_def':\n \"Alw_ev_checker \\\n do {\n x \\ let\n key = return \\ fst;\n sub = impl.subsumes_impl;\n copy = impl.state_copy_impl;\n start = impl.a\\<^sub>0_impl;\n succs = impl.succs_P_impl' Fi\n in dfs_map_impl' succs start sub key copy;\n _ \\ return ();\n return x\n }\"\n unfolding Alw_ev_checker_def by simp\n\nlemma leadsto_checker_alt_def':\n \"leadsto_checker \\ \\\n do {\n r \\ let\n key = return \\ fst;\n sub = impl.subsumes_impl;\n copy = impl.state_copy_impl;\n start = impl.a\\<^sub>0_impl;\n final = impl.F_impl;\n final' = (impl.Q_impl (\\(L, s). \\ check_sexpi \\ L s));\n succs = impl.succs_P_impl' (\\(L, s). \\ check_sexpi \\ L s);\n succs' = impl.succs_impl';\n empty = impl.emptiness_check_impl;\n trace = impl.tracei\n in\n leadsto_impl copy succs start sub key succs' empty final final' trace;\n return (\\ r)\n }\"\n unfolding leadsto_checker_def by simp\n\ntheorem k_impl_alt_def:\n \"k_impl = (\\(l, s). IArray (map (\\c. MAX i \\ {0.. map (\\i. union_map_of (fst (snd (snd (automata ! i))))) [0.. [] | Some xs \\ xs)\"\n if \"i < n_ps\"\n using that unfolding trans_map_inner_def trans_map_def by (auto simp: n_ps_def)\n\nschematic_goal succs_impl_alt_def:\n \"impl.succs_impl \\ ?impl\"\n unfolding impl.succs_impl_def\n apply (abstract_let impl.E_op''_impl E_op''_impl)\n unfolding impl.E_op''_impl_def fw_impl'_int\n apply (abstract_let trans_impl trans_impl)\n unfolding trans_impl_def\n apply (abstract_let int_trans_impl int_trans_impl)\n apply (abstract_let bin_trans_from_impl bin_trans_impl)\n apply (abstract_let broad_trans_from_impl broad_trans_impl)\n unfolding int_trans_impl_def bin_trans_from_impl_def broad_trans_from_impl_def\n apply (abstract_let trans_in_broad_grouped trans_in_broad_grouped)\n apply (abstract_let trans_out_broad_grouped trans_out_broad_grouped)\n apply (abstract_let trans_in_map trans_in_map)\n apply (abstract_let trans_out_map trans_out_map)\n apply (abstract_let int_trans_from_all_impl int_trans_from_all_impl)\n unfolding int_trans_from_all_impl_def\n apply (abstract_let int_trans_from_vec_impl int_trans_from_vec_impl)\n unfolding int_trans_from_vec_impl_def\n apply (abstract_let int_trans_from_loc_impl int_trans_from_loc_impl)\n unfolding int_trans_from_loc_impl_def\n apply (abstract_let trans_i_map trans_i_map)\n unfolding trans_out_broad_grouped_def trans_out_broad_map_def\n unfolding trans_in_broad_grouped_def trans_in_broad_map_def\n unfolding trans_in_map_def trans_out_map_def\n unfolding trans_i_map_def\n apply (abstract_let trans_map trans_map)\n apply (abstract_let \"inv_fun :: nat list \\ int list \\ _\" inv_fun)\n unfolding inv_fun_alt_def\n apply (abstract_let invs2 invs)\n unfolding invs2_def\n unfolding k_impl_alt_def\n apply (abstract_let k_i k_i) (* Could be killed *)\n apply (abstract_let n_ps n_ps)\n by (rule Pure.reflexive)\n\nschematic_goal succs_P_impl_alt_def:\n \"impl.succs_P_impl Pi \\ ?impl\"\n if \"(Pi, P) \\ inv_rel loc_rel states'\"\n for P Pi\n unfolding impl.succs_P_impl_def[OF that]\n apply (abstract_let impl.E_op''_impl E_op''_impl)\n unfolding impl.E_op''_impl_def fw_impl'_int\n apply (abstract_let \"trans_impl\" trans_impl)\n unfolding trans_impl_def\n apply (abstract_let \"int_trans_impl\" int_trans_impl)\n apply (abstract_let \"bin_trans_from_impl\" bin_trans_impl)\n apply (abstract_let \"broad_trans_from_impl\" broad_trans_impl)\n unfolding int_trans_impl_def bin_trans_from_impl_def broad_trans_from_impl_def\n apply (abstract_let trans_in_broad_grouped trans_in_broad_grouped)\n apply (abstract_let trans_out_broad_grouped trans_out_broad_grouped)\n apply (abstract_let trans_in_map trans_in_map)\n apply (abstract_let trans_out_map trans_out_map)\n apply (abstract_let int_trans_from_all_impl int_trans_from_all_impl)\n unfolding int_trans_from_all_impl_def\n apply (abstract_let int_trans_from_vec_impl int_trans_from_vec_impl)\n unfolding int_trans_from_vec_impl_def\n apply (abstract_let int_trans_from_loc_impl int_trans_from_loc_impl)\n unfolding int_trans_from_loc_impl_def\n apply (abstract_let trans_i_map trans_i_map)\n unfolding trans_out_broad_grouped_def trans_out_broad_map_def\n unfolding trans_in_broad_grouped_def trans_in_broad_map_def\n unfolding trans_in_map_def trans_out_map_def\n unfolding trans_i_map_def\n apply (abstract_let trans_map trans_map)\n apply (abstract_let \"inv_fun :: nat list \\ int list \\ _\" inv_fun)\n unfolding inv_fun_alt_def\n apply (abstract_let invs2 invs)\n unfolding invs2_def\n unfolding k_impl_alt_def\n apply (abstract_let k_i k_i) (* Could be killed *)\n apply (abstract_let n_ps n_ps)\n by (rule Pure.reflexive)\n\n\n(* XXX These implementations contain unnecessary list reversals *)\nlemmas succs_P'_impl_alt_def =\n impl.succs_P_impl'_def[OF impl.F_fun, unfolded succs_P_impl_alt_def[OF impl.F_fun]]\n\nschematic_goal Alw_ev_checker_alt_def:\n \"Alw_ev_checker \\ ?impl\"\n unfolding Alw_ev_checker_alt_def'\n unfolding succs_P'_impl_alt_def\n unfolding k_impl_alt_def k_i_def\n (* The following are just to unfold things that should have been defined in a defs locale *)\n unfolding impl.E_op''_impl_def impl.abstr_repair_impl_def impl.abstra_repair_impl_def\n unfolding\n impl.start_inv_check_impl_def impl.unbounded_dbm_impl_def\n impl.unbounded_dbm'_def\n unfolding impl.init_dbm_impl_def impl.a\\<^sub>0_impl_def\n unfolding impl.F_impl_def\n unfolding impl.subsumes_impl_def\n unfolding impl.emptiness_check_impl_def\n unfolding impl.state_copy_impl_def\n by (rule Pure.reflexive)\n\nlemma \\_compatibleI:\n \"(\\(L, s). \\ check_sexpi \\ L s, \\(L, s). \\ check_sexp \\ L (the \\ s)) \\ inv_rel loc_rel states'\"\n if \"formula = Leadsto \\ \\\"\n using F_Fi'[OF _ that] unfolding inv_rel_def by auto\n\nlemma Q_impl_alt_def:\n \"impl.Q_impl (\\(L, s). \\ check_sexpi \\ L s) \\\n \\xi. return (case xi of (a1, a2) \\ (\\(L, s). \\ check_sexpi \\ L s) a1)\"\n if \"formula = Leadsto \\ \\\"\n by (intro impl.Q_impl_def[where Q = \"\\(L, s). \\ check_sexp \\ L (the o s)\"] \\_compatibleI[OF that])\n\nschematic_goal leadsto_checker_alt_def:\n \"leadsto_checker \\ \\ ?impl\" if \"formula = Leadsto \\ \\\"\n unfolding leadsto_checker_alt_def'\n unfolding Q_impl_alt_def[OF that] impl.F_impl_def\n unfolding impl.succs_P_impl'_def[OF \\_compatibleI[OF that]]\n unfolding succs_P_impl_alt_def[OF \\_compatibleI[OF that]]\n unfolding impl.succs_impl'_def succs_impl_alt_def\n unfolding k_impl_alt_def k_i_def\n (* The following are just to unfold things that should have been defined in a defs locale *)\n unfolding impl.E_op''_impl_def impl.abstr_repair_impl_def impl.abstra_repair_impl_def\n unfolding\n impl.start_inv_check_impl_def impl.unbounded_dbm_impl_def\n impl.unbounded_dbm'_def\n unfolding impl.init_dbm_impl_def impl.a\\<^sub>0_impl_def\n unfolding impl.F_impl_def\n unfolding impl.subsumes_impl_def\n unfolding impl.emptiness_check_impl_def\n unfolding impl.state_copy_impl_def\n by (rule Pure.reflexive)\n\nschematic_goal reachability_checker_alt_def:\n \"reachability_checker \\ ?impl\"\n unfolding reachability_checker_alt_def'\n unfolding succs_impl_alt_def\n unfolding k_impl_alt_def k_i_def\n (* The following are just to unfold things that should have been defined in a defs locale *)\n unfolding impl.E_op''_impl_def impl.abstr_repair_impl_def impl.abstra_repair_impl_def\n unfolding\n impl.start_inv_check_impl_def impl.unbounded_dbm_impl_def\n impl.unbounded_dbm'_def\n unfolding impl.init_dbm_impl_def impl.a\\<^sub>0_impl_def\n unfolding impl.F_impl_def\n unfolding impl.subsumes_impl_def\n unfolding impl.emptiness_check_impl_def\n unfolding impl.state_copy_impl_def\n by (rule Pure.reflexive)\n\nend (* Simple_Network_Impl_nat_ceiling_start_state *)\n\nconcrete_definition reachability_checker\n uses Simple_Network_Impl_nat_ceiling_start_state.reachability_checker_alt_def\n\nconcrete_definition Alw_ev_checker\n uses Simple_Network_Impl_nat_ceiling_start_state.Alw_ev_checker_alt_def\n\nconcrete_definition leadsto_checker\n uses Simple_Network_Impl_nat_ceiling_start_state.leadsto_checker_alt_def\n\ncontext Simple_Network_Impl_nat_ceiling_start_state\nbegin\n\nlemma model_checker_unfold_leadsto:\n \"model_checker = (\n case formula of Simple_Network_Language_Model_Checking.formula.EX xa \\ reachability_checker\n | Simple_Network_Language_Model_Checking.formula.EG xa \\\n if PR_CONST F l\\<^sub>0 then Alw_ev_checker else return False\n | Simple_Network_Language_Model_Checking.formula.AX xa \\\n (if PR_CONST F l\\<^sub>0 then Alw_ev_checker else return False) \\ (\\r. return (\\ r))\n | Simple_Network_Language_Model_Checking.formula.AG xa \\\n reachability_checker \\ (\\r. return (\\ r))\n | Simple_Network_Language_Model_Checking.formula.Leadsto \\ \\ \\\n Simple_Network_Language_Model_Checking.leadsto_checker\n broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula \\ show_clock show_state)\n\"\n unfolding model_checker_def\n using leadsto_checker.refine[OF Simple_Network_Impl_nat_ceiling_start_state_axioms]\n by (simp split: formula.split)\n\nlemmas model_checker_def_refined = model_checker_unfold_leadsto[unfolded\n reachability_checker.refine[OF Simple_Network_Impl_nat_ceiling_start_state_axioms]\n Alw_ev_checker.refine[OF Simple_Network_Impl_nat_ceiling_start_state_axioms]\n ]\n\nend (* Simple_Network_Impl_nat_ceiling_start_state *)\n\nconcrete_definition model_checker uses\n Simple_Network_Impl_nat_ceiling_start_state.model_checker_def_refined\n\ndefinition precond_mc where\n \"precond_mc\n show_clock show_state broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula \\\n if Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula\n then\n model_checker\n broadcast bounds' automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula show_clock show_state\n \\ (\\ x. return (Some x))\n else return None\"\n\n\nabbreviation N where\n \"N broadcast automata bounds \\\n Simple_Network_Language.conv\n (set broadcast, map automaton_of automata, map_of bounds)\"\n\ndefinition has_deadlock where\n \"has_deadlock A a\\<^sub>0 \\\n Graph_Defs.deadlock (\\ (L, s, u) (L', s', u'). A \\ \\L, s, u\\ \\ \\L', s', u'\\) a\\<^sub>0\"\n\ntheorem model_check:\n \" precond_mc\n show_clock show_state broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula\n <\\ Some r \\ \\(\n Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula \\\n (\\ has_deadlock (N broadcast automata bounds) (L\\<^sub>0, map_of s\\<^sub>0, \\_ . 0) \\\n r = N broadcast automata bounds,(L\\<^sub>0, map_of s\\<^sub>0, \\_ . 0) \\ formula\n ))\n | None \\ \\(\\ Simple_Network_Impl_nat_ceiling_start_state\n broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula)\n >\\<^sub>t\"\nproof -\n define A where \"A \\ N broadcast automata bounds\"\n define check where \"check \\ A,(L\\<^sub>0, map_of s\\<^sub>0, \\_ . 0) \\ formula\"\n note [sep_heap_rules] =\n Simple_Network_Impl_nat_ceiling_start_state.model_check'[\n to_hnr, unfolded hn_refine_def,\n of broadcast bounds automata m num_states num_actions k L\\<^sub>0 s\\<^sub>0 formula,\n unfolded UPPAAL_Reachability_Problem_precompiled_defs.init_def,\n folded A_def check_def has_deadlock_def,\n simplified\n ]\n show ?thesis\n unfolding A_def[symmetric] check_def[symmetric]\n unfolding precond_mc_def\n by (sep_auto simp: model_checker.refine[symmetric] pure_def)\nqed\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/Simple_Network_Language_Model_Checking.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.2707318958474127}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_invs_on_rules imports n_mutualEx_lemma_inv__1_on_rules n_mutualEx_lemma_inv__2_on_rules n_mutualEx_lemma_inv__3_on_rules n_mutualEx_lemma_inv__4_on_rules n_mutualEx_lemma_inv__5_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.27073188951632116}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Step_Sim_Pres\n imports Weak_Early_Step_Sim\nbegin\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"\\.(P) \\\\Rel\\ \\.(Q)\"\nproof(induct rule: simCases)\n case(Bound a x Q')\n have \"\\.(Q) \\a<\\x> \\ Q'\" by fact\n hence False by(induct rule: tauCases', auto)\n thus ?case by simp\nnext\n case(Free \\ Q')\n have \"\\.(Q) \\(\\ \\ Q')\" by fact\n thus ?case\n proof(induct rule: tauCases', auto simp add: pi.inject residual.inject)\n have \"\\.(P) \\ \\ \\ P\" by(rule Weak_Early_Step_Semantics.Tau)\n with PRelQ show \"\\P'. \\.(P) \\ \\ \\ P' \\ (P', Q) \\ Rel\" by blast\n qed\nqed\n\nlemma inputPres:\n fixes P :: pi\n and x :: name\n and Q :: pi\n and a :: name\n and Rel :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"\\y. (P[x::=y], Q[x::=y]) \\ Rel\"\n and Eqvt: \"eqvt Rel\"\n\n shows \"a.P \\\\Rel\\ a.Q\"\nusing Eqvt\nproof(induct rule: simCasesCont[where C=\"(x, a, P, Q)\"])\n case(Bound b y Q')\n from `y \\ (x, a, P, Q)` have \"y \\ x\" \"y \\ a\" \"y \\ P\" \"y \\ Q\" by simp+\n from `a.Q \\b<\\y> \\ Q'` `y \\ a` `y \\ x` `y \\ Q` show ?case\n by(erule_tac inputCases') auto\nnext\n case(Free \\ Q')\n from `a.Q \\ \\ \\ Q'`\n show ?case\n proof(induct rule: inputCases)\n case(cInput u)\n have \"a.P \\(a) \\ (P[x::=u])\"\n by(rule Weak_Early_Step_Semantics.Input)\n moreover from PRelQ have \"(P[x::=u], Q[x::=u]) \\ Rel\" by auto\n ultimately show ?case by blast\n qed\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n\n assumes PRelQ: \"(P, Q) \\ Rel\"\n\n shows \"a{b}.P \\\\Rel\\ a{b}.Q\"\nproof(induct rule: simCases)\n case(Bound c x Q')\n have \"a{b}.Q \\c<\\x> \\ Q'\" by fact\n hence False by(induct rule: outputCases', auto)\n thus ?case by simp\nnext\n case(Free \\ Q')\n have \"a{b}.Q \\\\ \\ Q'\" by fact\n thus \"\\P'. a{b}.P \\ \\ \\ P' \\ (P', Q') \\ Rel\"\n proof(induct rule: outputCases', auto simp add: pi.inject residual.inject)\n have \"a{b}.P \\ a[b] \\ P\" by(rule Weak_Early_Step_Semantics.Output)\n with PRelQ show \"\\P'. a{b}.P \\ a[b] \\ P' \\ (P', Q) \\ Rel\" by blast\n qed\nqed\n\n\n\n assumes PSimQ: \"P \\\\Rel\\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n\n shows \"[a\\b]P \\\\Rel'\\ [a\\b]Q\"\nproof(induct rule: simCases)\n case(Bound c x Q')\n have \"x \\ [a\\b]P\" by fact\n hence xFreshP: \"(x::name) \\ P\" by simp\n have \"[a\\b]Q \\c<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: matchCases)\n case Match\n have \"Q \\c<\\x> \\ Q'\" by fact\n with PSimQ xFreshP obtain P' where PTrans: \"P \\c<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have \"[a\\a]P \\c<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Match)\n moreover from P'RelQ' RelRel' have \"(P', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nnext\n case(Free \\ Q')\n have \"[a\\b]Q \\\\ \\ Q'\" by fact\n thus ?case\n proof(induct rule: matchCases)\n case Match\n have \"Q \\ \\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\\\ \\ P'\" and PRel: \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have \"[a\\a]P \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Match)\n with RelRel' PRel show ?case by blast\n qed\nqed\n\nlemma mismatchPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n\n assumes PSimQ: \"P \\\\Rel\\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n\n shows \"[a\\b]P \\\\Rel'\\ [a\\b]Q\"\nproof(induct rule: simCases)\n case(Bound c x Q')\n have \"x \\ [a\\b]P\" by fact\n hence xFreshP: \"(x::name) \\ P\" by simp\n have \"[a\\b]Q \\c<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: mismatchCases)\n case Mismatch\n have aineqb: \"a \\ b\" by fact\n have \"Q \\c<\\x> \\ Q'\" by fact\n with PSimQ xFreshP obtain P' where PTrans: \"P \\c<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans aineqb have \"[a\\b]P \\c<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n moreover from P'RelQ' RelRel' have \"(P', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nnext\n case(Free \\ Q')\n have \"[a\\b]Q \\\\ \\ Q'\" by fact\n thus ?case\n proof(induct rule: mismatchCases)\n case Mismatch\n have \"Q \\\\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\\\ \\ P'\" and PRel: \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans `a \\ b` have \"[a\\b]P \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n with RelRel' PRel show ?case by blast\n qed\nqed\n\nlemma sumPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes PSimQ: \"P \\\\Rel\\ Q\"\n and RelRel': \"Rel \\ Rel'\"\n and C: \"Id \\ Rel'\"\n\n shows \"P \\ R \\\\Rel'\\ Q \\ R\"\nproof(induct rule: simCases)\n case(Bound a x Q')\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"(x::name) \\ P\" and xFreshR: \"x \\ R\" by simp+\n have \"Q \\ R \\a<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: sumCases)\n case Sum1\n have \"Q \\a<\\x> \\ Q'\" by fact\n with xFreshP PSimQ obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have \"P \\ R \\a<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Sum1)\n moreover from P'RelQ' RelRel' have \"(P', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n next\n case Sum2\n from `R \\a<\\x> \\ Q'` have \"P \\ R \\a<\\x> \\ Q'\" by(rule Early_Semantics.Sum2)\n hence \"P \\ R \\a<\\x> \\ Q'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n moreover from C have \"(Q', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nnext\n case(Free \\ Q')\n have \"Q \\ R \\\\ \\ Q'\" by fact\n thus ?case\n proof(induct rule: sumCases)\n case Sum1\n have \"Q \\\\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\\\ \\ P'\" and PRel: \"(P', Q') \\ Rel\" \n by(blast dest: simE)\n from PTrans have \"P \\ R \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Sum1)\n with RelRel' PRel show ?case by blast\n next\n case Sum2\n from `R \\\\ \\ Q'` have \"P \\ R \\\\ \\ Q'\" by(rule Early_Semantics.Sum2)\n hence \"P \\ R \\\\ \\ Q'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n moreover from C have \"(Q', Q') \\ Rel'\" by blast\n ultimately show ?case by blast\n qed\nqed\n \nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n and T :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n and Rel'' :: \"(pi \\ pi) set\"\n \n assumes PSimQ: \"P \\\\Rel\\ Q\"\n and PRelQ: \"(P, Q) \\ Rel\"\n and Par: \"\\S T U. (S, T) \\ Rel \\ (S \\ U, T \\ U) \\ Rel'\"\n and Res: \"\\S T x. (S, T) \\ Rel' \\ (<\\x>S, <\\x>T) \\ Rel'\"\n\n shows \"P \\ R \\\\Rel'\\ Q \\ R\"\nproof -\n show ?thesis\n proof(induct rule: simCases)\n case(Bound a x Q')\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n have \"Q \\ R \\a<\\x> \\ Q'\" by fact\n thus ?case\n proof(induct rule: parCasesB)\n case(cPar1 Q')\n have QTrans: \"Q \\ a<\\x> \\ Q'\" by fact\n from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\ a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans xFreshR have \"P \\ R \\ a<\\x> \\ (P' \\ R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' have \"(P' \\ R, Q' \\ R) \\ Rel'\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cPar2 R')\n from `R \\ a<\\x> \\ R'` `x \\ P` have \"P \\ R \\a<\\x> \\ (P \\ R')\"\n by(rule Early_Semantics.Par2B)\n hence \"P \\ R \\ a<\\x> \\ (P \\ R')\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n moreover from PRelQ have \"(P \\ R', Q \\ R') \\ Rel'\" by(rule Par)\n ultimately show ?case by blast\n qed\n next\n case(Free \\ QR')\n have \"Q \\ R \\ \\ \\ QR'\" by fact\n thus ?case\n proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n case(cPar1 Q')\n have \"Q \\ \\ \\ Q'\" by fact\n with PSimQ obtain P' where PTrans: \"P \\ \\ \\ P'\" and PRel: \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans have Trans: \"P \\ R \\ \\ \\ P' \\ R\" by(rule Weak_Early_Step_Semantics.Par1F)\n moreover from PRel have \"(P' \\ R, Q' \\ R) \\ Rel'\" by(blast intro: Par)\n ultimately show ?case by blast\n next\n case(cPar2 R')\n from `R \\\\ \\ R'` have \"P \\ R \\\\ \\ (P \\ R')\"\n by(rule Early_Semantics.Par2F)\n hence \"P \\ R \\\\ \\ (P \\ R')\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n moreover from PRelQ have \"(P \\ R', Q \\ R') \\ Rel'\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cComm1 Q' R' a b)\n have QTrans: \"Q \\ a \\ Q'\" and RTrans: \"R \\ a[b] \\ R'\" by fact+\n\n from PSimQ QTrans obtain P' where PTrans: \"P \\a \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from RTrans have \"R \\a[b] \\ R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n with PTrans have \"P \\ R \\ \\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n moreover from P'RelQ' have \"(P' \\ R', Q' \\ R') \\ Rel'\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cComm2 Q' R' a b)\n have QTrans: \"Q \\a[b] \\ Q'\" and RTrans: \"R \\a \\ R'\" by fact+\n \n from PSimQ QTrans obtain P' where PTrans: \"P \\a[b] \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from RTrans have \"R \\a \\ R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n with PTrans have \"P \\ R \\ \\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n moreover from P'RelQ' have \"(P' \\ R', Q' \\ R') \\ Rel'\" by(rule Par)\n ultimately show ?case by blast\n next\n case(cClose1 Q' R' a x)\n have QTrans: \"Q \\a \\ Q'\" and RTrans: \"R \\a<\\x> \\ R'\" by fact+\n have \"x \\ (P, R)\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by(simp add: fresh_prod)+\n \n from PSimQ QTrans obtain P' where PTrans: \"P \\a \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from RTrans have \"R \\a<\\x> \\ R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n with PTrans have Trans: \"P \\ R \\ \\ \\ <\\x>(P' \\ R')\" using `x \\ P`\n by(rule Weak_Early_Step_Semantics.Close1)\n moreover from P'RelQ' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ R')) \\ Rel'\"\n by(blast intro: Par Res)\n ultimately show ?case by blast\n next\n case(cClose2 Q' R' a x)\n have QTrans: \"Q \\a<\\x> \\ Q'\" and RTrans: \"R \\a \\ R'\" by fact+\n have \"x \\ (P, R)\" by fact\n hence xFreshR: \"x \\ R\" and xFreshP: \"x \\ P\" by(simp add: fresh_prod)+\n\n from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n \n from RTrans have \"R \\a \\ R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n with PTrans have Trans: \"P \\ R \\\\ \\ <\\x>(P' \\ R')\" using `x \\ R`\n by(rule Weak_Early_Step_Semantics.Close2)\n moreover from P'RelQ' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ R')) \\ Rel'\"\n by(blast intro: Par Res)\n ultimately show ?case by blast\n qed\n qed\nqed\n\n\n\n assumes PSimQ: \"P \\\\Rel\\ Q\"\n and C1: \"\\R S x. (R, S) \\ Rel \\ (<\\x>R, <\\x>S) \\ Rel'\"\n and RelRel': \"Rel \\ Rel'\"\n and EqvtRel: \"eqvt Rel\"\n and EqvtRel': \"eqvt Rel'\"\n\n shows \"<\\x>P \\\\Rel'\\ <\\x>Q\"\nproof -\n from EqvtRel' show ?thesis\n proof(induct rule: simCasesCont[of _ \"(P, x)\"])\n case(Bound a y Q')\n have Trans: \"<\\x>Q \\a<\\y> \\ Q'\" by fact\n have \"y \\ (P, x)\" by fact\n hence yineqx: \"y \\ x\" and yFreshP: \"y \\ P\" by(simp add: fresh_prod)+\n from Trans yineqx show ?case\n proof(induct rule: resCasesB)\n case(Open Q')\n have QTrans: \"Q \\a[x] \\ Q'\" and aineqx: \"a \\ x\" by fact+\n\n from PSimQ QTrans obtain P' where PTrans: \"P \\a[x] \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n\n from PTrans aineqx have \"<\\x>P \\a<\\x> \\ P'\" by(rule Weak_Early_Step_Semantics.Open)\n hence \"<\\x>P \\a<\\y> \\ ([(y, x)] \\ P')\" using `y \\ P` `y \\ x`\n by(force simp add: weakTransitionAlpha abs_fresh name_swap)\n\n moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\ P', [(y, x)] \\ Q') \\ Rel'\"\n by(blast intro: eqvtRelI)\n ultimately show ?case by blast\n next\n case(Res Q')\n have QTrans: \"Q \\a<\\y> \\ Q'\" and xineqa: \"x \\ a\" by fact+\n\n from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\a<\\y> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel\"\n by(blast dest: simE)\n from PTrans xineqa yineqx yFreshP have ResTrans: \"<\\x>P \\a<\\y> \\ (<\\x>P')\"\n by(blast intro: Weak_Early_Step_Semantics.ResB)\n moreover from P'RelQ' have \"((<\\x>P'), (<\\x>Q')) \\ Rel'\"\n by(rule C1)\n ultimately show ?case by blast\n qed\n next\n case(Free \\ Q')\n have QTrans: \"<\\x>Q \\ \\ \\ Q'\" by fact\n have \"\\c::name. c \\ (P, Q, Q', \\)\" by(blast intro: name_exists_fresh)\n then obtain c::name where cFreshQ: \"c \\ Q\" and cFreshAlpha: \"c \\ \\\" and cFreshQ': \"c \\ Q'\" and cFreshP: \"c \\ P\"\n by(force simp add: fresh_prod)\n from cFreshP have \"<\\x>P = <\\c>([(x, c)] \\ P)\" by(simp add: alphaRes)\n moreover have \"\\P'.<\\c>([(x, c)] \\ P) \\ \\ \\ P' \\ (P', Q') \\ Rel'\"\n proof -\n from QTrans cFreshQ have \"<\\c>([(x, c)] \\ Q) \\\\ \\ Q'\" by(simp add: alphaRes)\n moreover have \"c \\ \\\" by(rule cFreshAlpha)\n moreover from PSimQ EqvtRel have \"([(x, c)] \\ P) \\\\Rel\\ ([(x, c)] \\ Q)\"\n by(blast intro: eqvtI)\n ultimately show ?thesis\n apply(induct rule: resCasesF, auto simp add: residual.inject pi.inject name_abs_eq)\n by(blast intro: Weak_Early_Step_Semantics.ResF C1 dest: simE)\n qed\n\n ultimately show ?case by force\n qed\nqed\n\nlemma resChainI:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and lst :: \"name list\"\n\n assumes eqvtRel: \"eqvt Rel\"\n and Res: \"\\R S x. (R, S) \\ Rel \\ (<\\x>R, <\\x>S) \\ Rel\"\n and PRelQ: \"P \\\\Rel\\ Q\"\n\n shows \"(resChain lst) P \\\\Rel\\ (resChain lst) Q\"\nproof -\n show ?thesis\n proof(induct lst) (* Base case *)\n from PRelQ show \"resChain [] P \\\\Rel\\ resChain [] Q\" by simp\n next (* Inductive step *)\n fix a lst\n assume IH: \"(resChain lst P) \\\\Rel\\ (resChain lst Q)\"\n moreover from Res have \"\\P Q a. (P, Q) \\ Rel \\ (<\\a>P, <\\a>Q) \\ Rel\"\n by simp\n moreover have \"Rel \\ Rel\" by simp\n ultimately have \"<\\a>(resChain lst P) \\\\Rel\\ <\\a>(resChain lst Q)\" using eqvtRel\n by(rule_tac resPres)\n\n thus \"resChain (a # lst) P \\\\Rel\\ resChain (a # lst) Q\"\n by simp\n qed\nqed\n\n\n\n shows \"!P \\\\bangRel Rel'\\ !Q\"\nproof -\n let ?Sim = \"\\P Rs. (\\a x Q'. Rs = a<\\x> \\ Q' \\ x \\ P \\ (\\P'. P \\a<\\x> \\ P' \\ (P', Q') \\ bangRel Rel')) \\\n (\\\\ Q'. Rs = \\ \\ Q' \\ (\\P'. P \\\\ \\ P' \\ (P', Q') \\ bangRel Rel'))\"\n from eqvtRel have EqvtBangRel: \"eqvt(bangRel Rel')\" by(rule eqvtBangRel)\n from C1 have BRelRel': \"\\P Q. (P, Q) \\ bangRel Rel \\ (P, Q) \\ bangRel Rel'\"\n by(auto intro: bangRelSubset)\n\n {\n fix Pa Rs\n assume \"!Q \\ Rs\" and \"(Pa, !Q) \\ bangRel Rel\"\n hence \"?Sim Pa Rs\" using PRelQ \n proof(nominal_induct avoiding: Pa P rule: bangInduct)\n case(Par1B a x Q' Pa P)\n have QTrans: \"Q \\ a<\\x> \\ Q'\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" and \"x \\ Pa\" by fact+\n thus \"?Sim Pa (a<\\x> \\ (Q' \\ !Q))\"\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" by fact\n have PBRQ: \"(R, !Q) \\ bangRel Rel\" by fact\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case \n proof(auto simp add: residual.inject alpha')\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n\n with QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from PTrans xFreshR have \"P \\ R \\a<\\x> \\ (P' \\ R)\"\n by(force intro: Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' PBRQ BRelRel' have \"(P' \\ R, Q' \\ !Q) \\ bangRel Rel'\" by(blast intro: Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\a<\\x> \\ P' \\ (P', Q' \\ !Q) \\ bangRel Rel'\" by blast\n next\n fix y\n assume \"(y::name) \\ Q'\" and \"y \\ P\" and \"y \\ R\" and \"y \\ Q\"\n from QTrans `y \\ Q'` have \"Q \\a<\\y> \\ ([(x, y)] \\ Q')\"\n by(simp add: alphaBoundOutput)\n moreover from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n ultimately obtain P' where PTrans: \"P \\a<\\y> \\ P'\" and P'RelQ': \"(P', [(x, y)] \\ Q') \\ Rel'\"\n using `y \\ P`\n by(blast dest: simE)\n from PTrans `y \\ R` have \"P \\ R \\a<\\y> \\ (P' \\ R)\" by(force intro: Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' PBRQ BRelRel' have \"(P' \\ R, ([(x, y)] \\ Q') \\ !Q) \\ bangRel Rel'\" by(metis Rel.BRPar)\n with `x \\ Q` `y \\ Q` have \"(P' \\ R, ([(y, x)] \\ Q') \\ !([(y, x)] \\ Q)) \\ bangRel Rel'\"\n by(simp add: name_fresh_fresh name_swap)\n ultimately show \"\\P'. P \\ R \\a<\\y> \\ P' \\ (P', ([(y, x)] \\ Q') \\ !([(y, x)] \\ Q)) \\ bangRel Rel'\"\n by blast\n qed\n qed\n next\n case(Par1F \\ Q' Pa P)\n have QTrans: \"Q \\\\ \\ Q'\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and BR: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\\\ \\ P'\" and RRel: \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n \n from PTrans have \"P \\ R \\\\ \\ P' \\ R\" by(rule Weak_Early_Step_Semantics.Par1F)\n moreover from RRel BR BRelRel' have \"(P' \\ R, Q' \\ !Q) \\ bangRel Rel'\" by(metis Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\\\ \\ P' \\ (P', Q' \\ !Q) \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Par2B a x Q' Pa P)\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (a<\\x> \\ Q')\" by simp\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" and \"x \\ Pa\" by fact+\n thus \"?Sim Pa (a<\\x> \\ (Q \\ Q'))\"\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n\n from EqvtBangRel show \"?Sim (P \\ R) (a<\\x> \\ (Q \\ Q'))\"\n proof(auto simp add: residual.inject alpha')\n from RBRQ have \"?Sim R (a<\\x> \\ Q')\" by(rule IH)\n with xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\" and R'BRQ': \"(R', Q') \\ (bangRel Rel')\"\n by(metis simE)\n from RTrans xFreshP have \"P \\ R \\a<\\x> \\ (P \\ R')\" by(auto intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'BRQ' C1 have \"(P \\ R', Q \\ Q') \\ (bangRel Rel')\" by(blast dest: Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\a<\\x> \\ P' \\ (P', Q \\ Q') \\ bangRel Rel'\" by blast\n next\n fix y\n assume \"(y::name) \\ Q\" and \"y \\ Q'\" and \"y \\ P\" and \"y \\ R\"\n from RBRQ have \"?Sim R (a<\\x> \\ Q')\" by(rule IH)\n with `y \\ Q'` have \"?Sim R (a<\\y> \\ ([(x, y)] \\ Q'))\" by(simp add: alphaBoundOutput)\n with `y \\ R` obtain R' where RTrans: \"R \\a<\\y> \\ R'\" and R'BRQ': \"(R', ([(x, y)] \\ Q')) \\ (bangRel Rel')\"\n by(metis simE)\n from RTrans `y \\ P` have \"P \\ R \\a<\\y> \\ (P \\ R')\" by(auto intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'BRQ' C1 have \"(P \\ R', Q \\ ([(x, y)] \\ Q')) \\ (bangRel Rel')\" by(blast dest: Rel.BRPar)\n with `y \\ Q` `x \\ Q` have \"(P \\ R', ([(y, x)] \\ Q) \\ ([(y, x)] \\ Q')) \\ (bangRel Rel')\"\n by(simp add: name_swap name_fresh_fresh)\n ultimately show \"\\P'. P \\ R \\a<\\y> \\ P' \\ (P', ([(y, x)] \\ Q) \\ ([(y, x)] \\ Q')) \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Par2F \\ Q' Pa P)\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (\\ \\ Q')\" by simp\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from RBRQ IH have \"\\R'. R \\\\ \\ R' \\ (R', Q') \\ bangRel Rel'\"\n by(metis simE)\n then obtain R' where RTrans: \"R \\\\ \\ R'\" and R'RelQ': \"(R', Q') \\ bangRel Rel'\"\n by blast\n\n from RTrans have \"P \\ R \\\\ \\ P \\ R'\" by(rule Weak_Early_Step_Semantics.Par2F)\n moreover from PRelQ R'RelQ' C1 have \"(P \\ R', Q \\ Q') \\ bangRel Rel'\" by(blast dest: Rel.BRPar)\n ultimately show \" \\P'. P \\ R \\\\ \\ P' \\ (P', Q \\ Q') \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Comm1 a Q' b Q'' Pa P)\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (a[b] \\ Q'')\" by simp\n have QTrans: \"Q \\a \\ Q'\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n \n from IH RBRQ have RTrans: \"\\R'. R \\a[b] \\ R' \\ (R', Q'') \\ bangRel Rel'\"\n by(metis simE)\n then obtain R' where RTrans: \"R \\a[b] \\ R'\" and R'RelQ'': \"(R', Q'') \\ bangRel Rel'\"\n by blast\n \n from PTrans RTrans have \"P \\ R \\\\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n moreover from P'RelQ' R'RelQ'' have \"(P' \\ R', Q' \\ Q'') \\ bangRel Rel'\" by(rule Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\\\ \\ P' \\ (P', Q' \\ Q'') \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Comm2 a b Q' Q'')\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (a \\ Q'')\" by simp\n have QTrans: \"Q \\ a[b] \\ Q'\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a[b] \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from IH RBRQ have RTrans: \"\\R'. R \\a \\ R' \\ (R', Q'') \\ bangRel Rel'\"\n by(metis simE)\n then obtain R' where RTrans: \"R \\a \\ R'\" and R'RelQ'': \"(R', Q'') \\ bangRel Rel'\"\n by blast\n\n from PTrans RTrans have \"P \\ R \\\\ \\ P' \\ R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n moreover from P'RelQ' R'RelQ'' have \"(P' \\ R', Q' \\ Q'') \\ bangRel Rel'\" by(rule Rel.BRPar)\n ultimately show \"\\P'. P \\ R \\\\ \\ P' \\ (P', Q' \\ Q'') \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Close1 a x Q' Q'' Pa P)\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (a<\\x> \\ Q'')\" by simp\n have QTrans: \"Q \\ a \\ Q'\" by fact\n have xFreshQ: \"x \\ Q\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" by fact\n moreover have xFreshPa: \"x \\ Pa\" by fact\n ultimately show ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n with QTrans xFreshP obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from RBRQ xFreshR IH have \"\\R'. R \\a<\\x> \\ R' \\ (R', Q'') \\ bangRel Rel'\"\n by(metis simE)\n then obtain R' where RTrans: \"R \\a<\\x> \\ R'\" and R'RelQ'': \"(R', Q'') \\ bangRel Rel'\"\n by blast\n\n from PTrans RTrans xFreshP have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close1) \n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ bangRel Rel'\"\n by(force intro: Rel.BRPar BRRes)\n ultimately show \"\\P'. P \\ R \\\\ \\ P' \\ (P', <\\x>(Q' \\ Q'')) \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Close2 a x Q' Q'' Pa P)\n hence IH: \"\\Pa. (Pa, !Q) \\ bangRel Rel \\ ?Sim Pa (a \\ Q'')\" by simp\n have QTrans: \"Q \\ a<\\x> \\ Q'\" by fact\n have xFreshQ: \"x \\ Q\" by fact\n have \"(Pa, Q \\ !Q) \\ bangRel Rel\" and \"x \\ Pa\" by fact+\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBRQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case\n proof(auto simp add: residual.inject)\n from PRelQ have \"P \\\\Rel'\\ Q\" by(rule Sim)\n with QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from RBRQ IH have \"\\R'. R \\a \\ R' \\ (R', Q'') \\ bangRel Rel'\"\n by auto\n then obtain R' where RTrans: \"R \\a \\ R'\" and R'RelQ'': \"(R', Q'') \\ bangRel Rel'\"\n by blast\n\n from PTrans RTrans xFreshR have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close2) \n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ bangRel Rel'\"\n by(force intro: Rel.BRPar BRRes)\n ultimately show \"\\P'. P \\ R \\\\ \\ P' \\ (P', <\\x>(Q' \\ Q'')) \\ bangRel Rel'\" by blast\n qed\n qed\n next\n case(Bang Rs Pa P)\n hence IH: \"\\Pa. (Pa, Q \\ !Q) \\ bangRel Rel \\ ?Sim Pa Rs\" by simp\n have \"(Pa, !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRBangCases)\n case(BRBang P)\n have PRelQ: \"(P, Q) \\ Rel\" by fact\n hence \"(!P, !Q) \\ bangRel Rel\" by(rule Rel.BRBang)\n with PRelQ have \"(P \\ !P, Q \\ !Q) \\ bangRel Rel\" by(rule BRPar)\n with IH have \"?Sim (P \\ !P) Rs\" by simp\n thus ?case by(force intro: Weak_Early_Step_Semantics.Bang)\n qed\n qed\n }\n\n moreover from PRelQ have \"(!P, !Q) \\ bangRel Rel\" by(rule BRBang) \n ultimately show ?thesis by(auto simp add: weakStepSimulation_def)\nqed\n(*\nlemma bangPres:\n fixes P :: pi\n and Q :: pi\n and Rel :: \"(pi \\ pi) set\"\n and Rel' :: \"(pi \\ pi) set\"\n \n assumes PRelQ: \"(P, Q) \\ Rel\"\n and Sim: \"\\P Q. (P, Q) \\ Rel \\ P \\ Q\"\n and RelRel': \"\\P Q. (P, Q) \\ Rel \\ (P, Q) \\ Rel'\"\n and eqvtRel': \"eqvt Rel'\"\n\n shows \"!P \\ !Q\"\nproof -\n from eqvtRel' have EqvtBangRel': \"eqvt (bangRel Rel')\" by(rule eqvtBangRel)\n from RelRel' have BRelRel': \"\\P Q. (P, Q) \\ bangRel Rel \\ (P, Q) \\ bangRel Rel'\"\n by(auto intro: bangRelSubset)\n have \"\\Rs P. \\!Q \\ Rs; (P, !Q) \\ bangRel Rel\\ \\ weakSimStepAct P Rs P (bangRel Rel')\"\n proof -\n fix Rs P\n assume \"!Q \\ Rs\" and \"(P, !Q) \\ bangRel Rel\"\n thus \"weakSimStepAct P Rs P (bangRel Rel')\"\n proof(nominal_induct avoiding: P rule: bangInduct)\n case(Par1B a x Q')\n have QTrans: \"Q \\a<\\x> \\ Q'\" and xFreshQ: \"x \\ Q\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelT: \"(R, !Q) \\ bangRel Rel\" by fact\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n from PRelQ have PSimQ: \"P \\ Q\" by(rule Sim)\n from EqvtBangRel' show ?case\n proof(induct rule: simActBoundCases)\n case BoundOutput\n with PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n from PTrans xFreshR have \"P \\ R \\a<\\x>\\ (P' \\ R)\"\n by(rule Weak_Early_Step_Semantics.Par1B)\n moreover from P'RelQ' RBangRelT have \"(P' \\ R, Q' \\ !Q) \\ bangRel Rel'\"\n by(blast intro: Rel.BRPar BRelRel')\n ultimately show ?case by blast\n qed\n qed\n next\n case(Par1F \\ Q' P)\n have QTrans: \"Q \\\\ \\ Q'\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\\\ \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from PTrans have \"P \\ R \\\\ \\ P' \\ R\" by(rule Weak_Early_Step_Semantics.Par1F)\n moreover from P'RelQ' RBangRelQ have \"(P' \\ R, Q' \\ !Q) \\ bangRel Rel'\"\n by(blast intro: Rel.BRPar BRelRel')\n ultimately show ?case by blast\n qed\n qed\n next\n case(Par2B a x Q' P)\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (a<\\x> \\ Q') P (bangRel Rel')\" by fact\n have xFreshQ: \"x \\ Q\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n from EqvtBangRel' show ?case\n proof(induct rule: simActBoundCases)\n case BoundOutput\n with IH RBangRelQ have \"weakSimStepAct R (a<\\x> \\ Q') R (bangRel Rel')\" by blast\n with xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\"\n and R'BangRelQ': \"(R', Q') \\ bangRel Rel'\"\n by(simp add: weakSimStepAct_def, blast)\n \n from RTrans xFreshP have \"P \\ R \\a<\\x> \\ (P \\ R')\"\n by(auto intro: Weak_Early_Step_Semantics.Par2B)\n moreover from PRelQ R'BangRelQ' have \"(P \\ R', Q \\ Q') \\ (bangRel Rel')\"\n by(blast intro: Rel.BRPar RelRel')\n ultimately show ?case by blast\n qed\n qed\n next\n case(Par2F \\ Q' P)\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (\\ \\ Q') P (bangRel Rel')\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from RBangRelQ have \"weakSimStepAct R (\\ \\ Q') R (bangRel Rel')\" by(rule IH)\n then obtain R' where RTrans: \"R \\\\ \\ R'\" and R'RelQ': \"(R', Q') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n\n from RTrans have \"P \\ R \\\\ \\ P \\ R'\" by(rule Weak_Early_Step_Semantics.Par2F)\n moreover from PRelQ R'RelQ' have \"(P \\ R', Q \\ Q') \\ (bangRel Rel')\" \n by(blast intro: Rel.BRPar RelRel')\n ultimately show ?case by blast\n qed\n qed\n next\n case(Comm1 a Q' b Q'' P)\n have QTrans: \"Q \\ a \\ Q'\" by fact\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (a[b] \\ Q'') P (bangRel Rel')\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from RBangRelQ have \"weakSimStepAct R (a[b] \\ Q'') R (bangRel Rel')\" by(rule IH)\n then obtain R' where RTrans: \"R \\a[b] \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n \n from PTrans RTrans have \"P \\ R \\\\ \\ (P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Comm1)\n moreover from P'RelQ' R'RelQ'' have \"(P' \\ R', Q' \\ Q'') \\ (bangRel Rel')\"\n by(rule Rel.BRPar)\n ultimately show ?case by blast\n qed\n qed\n next\n case(Comm2 a b Q' Q'' P)\n have QTrans: \"Q \\a[b] \\ Q'\" by fact\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (a \\ Q'') P (bangRel Rel')\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact+\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a[b] \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from RBangRelQ have \"weakSimStepAct R (a \\ Q'') R (bangRel Rel')\" by(rule IH)\n then obtain R' where RTrans: \"R \\a \\ R'\" and R'BangRelQ'': \"(R', Q'') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n \n from PTrans RTrans have \"P \\ R \\\\ \\ (P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Comm2)\n moreover from P'RelQ' R'BangRelQ'' have \"(P' \\ R', Q' \\ Q'') \\ (bangRel Rel')\"\n by(rule Rel.BRPar)\n ultimately show ?case by blast\n qed\n qed\n next\n case(Close1 a x Q' Q'' P)\n have QTrans: \"Q \\ a \\ Q'\" by fact\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (a<\\x> \\ Q'') P (bangRel Rel')\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n have \"x \\ P \\ R\" by fact\n hence xFreshR: \"x \\ R\" and xFreshP: \"x \\ P\" by simp+\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans obtain P' where PTrans: \"P \\a \\ P'\" and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n \n from RBangRelQ have \"weakSimStepAct R (a<\\x> \\ Q'') R (bangRel Rel')\" by(rule IH)\n with xFreshR obtain R' where RTrans: \"R \\a<\\x> \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n \n from PTrans RTrans xFreshP xFreshR have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close1)\n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ (bangRel Rel')\"\n by(force intro: Rel.BRPar Rel.BRRes)\n ultimately show ?case by blast\n qed\n qed\n next\n case(Close2 a x Q' Q'' P)\n have QTrans: \"Q \\ a<\\x> \\ Q'\" by fact\n have IH: \"\\P. (P, !Q) \\ bangRel Rel \\ weakSimStepAct P (a \\ Q'') P (bangRel Rel')\" by fact\n have \"(P, Q \\ !Q) \\ bangRel Rel\" and \"x \\ P\" by fact\n thus ?case\n proof(induct rule: BRParCases)\n case(BRPar P R)\n have PRelQ: \"(P, Q) \\ Rel\" and RBangRelQ: \"(R, !Q) \\ bangRel Rel\" by fact\n have \"x \\ P \\ R\" by fact\n hence xFreshP: \"x \\ P\" and xFreshR: \"x \\ R\" by simp+\n show ?case\n proof(induct rule: simActFreeCases)\n case Der\n from PRelQ have \"P \\ Q\" by(rule Sim)\n with QTrans xFreshP obtain P' where PTrans: \"P \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ Rel'\"\n by(blast dest: simE)\n\n from RBangRelQ have \"weakSimStepAct R (a \\ Q'') R (bangRel Rel')\" by(rule IH)\n with xFreshR obtain R' where RTrans: \"R \\a \\ R'\"\n and R'RelQ'': \"(R', Q'') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n \n from PTrans RTrans xFreshP xFreshR have \"P \\ R \\\\ \\ <\\x>(P' \\ R')\"\n by(rule Weak_Early_Step_Semantics.Close2)\n moreover from P'RelQ' R'RelQ'' have \"(<\\x>(P' \\ R'), <\\x>(Q' \\ Q'')) \\ (bangRel Rel')\"\n by(force intro: Rel.BRPar Rel.BRRes)\n ultimately show ?case by blast\n qed\n qed\n next\n case(Bang Rs)\n have IH: \"\\P. (P, Q \\ !Q) \\ bangRel Rel \\ weakSimStepAct P Rs P (bangRel Rel')\" by fact\n have \"(P, !Q) \\ bangRel Rel\" by fact\n thus ?case\n proof(induct rule: BRBangCases)\n case(BRBang P)\n have PRelQ: \"(P, Q) \\ Rel\" by fact\n hence \"(!P, !Q) \\ bangRel Rel\" by(rule Rel.BRBang)\n with PRelQ have \"(P \\ !P, Q \\ !Q) \\ bangRel Rel\" by(rule Rel.BRPar)\n hence \"weakSimStepAct (P \\ !P) Rs (P \\ !P) (bangRel Rel')\" by(rule IH)\n thus ?case\n proof(simp (no_asm) add: weakSimStepAct_def, auto)\n fix Q' a x\n assume \"weakSimStepAct (P \\ !P) (a<\\x> \\ Q') (P \\ !P) (bangRel Rel')\" and \"x \\ P\"\n then obtain P' where PTrans: \"(P \\ !P) \\a<\\x> \\ P'\"\n and P'RelQ': \"(P', Q') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n from PTrans have \"!P \\a<\\x> \\ P'\"\n by(force intro: Weak_Early_Step_Semantics.Bang simp add: weakTransition_def)\n with P'RelQ' show \"\\P'. !P \\a<\\x> \\ P' \\ (P', Q') \\ (bangRel Rel')\" by blast\n next\n fix Q' \\\n assume \"weakSimStepAct (P \\ !P) (\\ \\ Q') (P \\ !P) (bangRel Rel')\"\n then obtain P' where PTrans: \"(P \\ !P) \\\\ \\ P'\"\n and P'RelQ': \"(P', Q') \\ (bangRel Rel')\"\n by(simp add: weakSimStepAct_def, blast)\n from PTrans have \"!P \\\\ \\ P'\" by(rule Weak_Early_Step_Semantics.Bang)\n with P'RelQ' show \"\\P'. !P \\\\ \\ P' \\ (P', Q') \\ (bangRel Rel')\" by blast\n qed\n qed\n qed\n qed\n moreover from PRelQ have \"(!P, !Q) \\ bangRel Rel\" by(rule Rel.BRBang)\n ultimately show ?thesis by(simp add: simDef)\nqed\n*)\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Early_Step_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.27072442093692567}} {"text": "theory SNS_IAS_Eduroam_Spoofing\nimports \n \"../../Primitive_Matchers/Parser\"\nbegin\n\n\nsection\\Example: Eduroam and sns.ias Firewall Script\\\n\ndefinition \"everything_but_my_ip = all_but_those_ips [(ipv4addr_of_dotdecimal (131,159,207,206), 32)]\"\n\n\ntext\\Incoming: everything but my IP\\\ndefinition \"ipassignment_incoming = [(Iface ''wlan0'', everything_but_my_ip), (Iface ''lo'', [(0,0)])]\"\n\nlemma \"ipassmt_sanity_nowildcards (map_of ipassignment_incoming)\" by eval\n\ntext\\Outgoing: only my IP\\\ndefinition \"ipassignment_outgoing = [(Iface ''wlan0'', [(ipv4addr_of_dotdecimal (131,159,207,206), 32)]), (Iface ''lo'', [(0,0)])]\"\n\nlemma \"ipassmt_sanity_nowildcards (map_of ipassignment_outgoing)\" by eval\n\nparse_iptables_save eduroam_fw=\"eduroam_iptables-save\"\n\nthm eduroam_fw_def\nthm eduroam_fw_INPUT_default_policy_def\n\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_incoming (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\nvalue[code] \"unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)\"\n\nvalue[code] \"collect_ifaces (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\n\nlemma \"ipassmt_sanity_defined (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) (map_of_ipassmt ipassignment_incoming)\" by eval\nlemma \"ipassmt_sanity_defined (unfold_ruleset_OUTPUT eduroam_fw_OUTPUT_default_policy (map_of_string_ipv4 eduroam_fw)) (map_of_ipassmt ipassignment_outgoing)\" by eval\n\n\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_incoming (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\nvalue[code] \"debug_ipassmt_ipv4 ipassignment_outgoing (unfold_ruleset_OUTPUT eduroam_fw_OUTPUT_default_policy (map_of_string_ipv4 eduroam_fw))\"\n\n\ntext\\The ruleset\\\nlemma \"check_simple_fw_preconditions (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))))\" by eval\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\"\nlemma \"simple_fw_valid (to_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall (lower_closure (packet_assume_new (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)))))\" by eval\n\n\ntext\\We do not need to call things such as @{const transform_optimize_dnf_strict} because the\n firewall already is in @{const normalized_nnf_match} (required for @{const no_spoofing_iface})\\\nlemma \"transform_optimize_dnf_strict (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) =\n unfold_ruleset_INPUT action.Drop (map_of_string_ipv4 eduroam_fw)\" by eval\n\ntext\\The ruleset prevents spoofed incoming packets\\\nlemma \"no_spoofing_iface (Iface ''wlan0'')\n (map_of_ipassmt ipassignment_incoming) (unfold_ruleset_INPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\" by eval\n\n\ntext\\Ruleset does not prevent that I'm spoofing (which is not necessary anyways since I need root right to spoof, which \n would also enable me to deactivate the firewall). This is only a one-user laptop!\\\n\nlemma \"transform_optimize_dnf_strict (unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)) =\n unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw)\" by eval\n\nlemma \"\\ no_spoofing_iface (Iface ''wlan0'')\n (map_of_ipassmt ipassignment_outgoing) (unfold_ruleset_OUTPUT eduroam_fw_INPUT_default_policy (map_of_string_ipv4 eduroam_fw))\" by eval\n\n\nend", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Examples/sns.ias.edu/SNS_IAS_Eduroam_Spoofing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.27072441411920817}} {"text": "section \\Two-Step Observing Quorums Model\\\n\ntheory Two_Step_Observing\nimports \"../Observing_Quorums_Opt\" \"../Two_Steps\"\nbegin\n\ntext \\To make the coming proofs of concrete algorithms easier, in this model we split \n the @{term olv_round} into two steps.\\\n\nsubsection \\Model definition\\\n(******************************************************************************)\nrecord tso_state = opt_obsv_state +\n r_votes :: \"process \\ val option\"\n\ncontext mono_quorum\nbegin\n\ndefinition tso_round0 \n :: \"round \\ process set \\ val \\ (tso_state \\ tso_state)set\"\n where\n \"tso_round0 r S v \\ {(s, s').\n \\ \\guards\\\n r = next_round s\n \\ two_step r = 0\n \\ (S \\ {} \\ opt_obs_safe (last_obs s) v)\n \\ \\actions\\\n \\ s' = s\\\n next_round := Suc r\n , r_votes := const_map v S\n \\\n }\"\n\ndefinition obs_guard :: \"(process, val)map \\ (process, val)map \\ bool\" where\n \"obs_guard r_obs r_v \\ \\p.\n (\\v. r_obs p = Some v \\ (\\q. r_v q = Some v))\n \\ (dom r_v \\ Quorum \\ (\\q \\ dom r_v. r_obs p = r_v q))\"\n\ndefinition tso_round1 \n :: \"round \\ (process, val)map \\ (process, val)map \\ (tso_state \\ tso_state)set\" \n where\n \"tso_round1 r r_decisions r_obs \\ {(s, s').\n \\ \\guards\\\n r = next_round s\n \\ two_step r = 1\n \\ d_guard r_decisions (r_votes s)\n \\ obs_guard r_obs (r_votes s)\n \\ \\actions\\\n \\ s' = s\\\n next_round := Suc r\n , decisions := decisions s ++ r_decisions\n , last_obs := last_obs s ++ r_obs\n \\\n }\"\n\ndefinition tso_init where\n \"tso_init = { \\ next_round = 0, decisions = Map.empty, last_obs = Map.empty, r_votes = Map.empty \\ }\"\n\ndefinition tso_trans :: \"(tso_state \\ tso_state) set\" where\n \"tso_trans = (\\r S v. tso_round0 r S v) \\ (\\r d_f o_f. tso_round1 r d_f o_f) \\ Id\"\n\ndefinition tso_TS :: \"tso_state TS\" where\n \"tso_TS = \\ init = tso_init, trans = tso_trans \\\"\n\nlemmas tso_TS_defs = tso_TS_def tso_init_def tso_trans_def\n\nsubsection \\Refinement\\\n(******************************************************************************)\n\ndefinition basic_rel :: \"(opt_obsv_state \\ tso_state)set\" where\n \"basic_rel = {(sa, sc).\n next_round sa = two_phase (next_round sc)\n \\ last_obs sc = last_obs sa\n \\ decisions sc = decisions sa\n }\"\n\ndefinition step0_rel :: \"(opt_obsv_state \\ tso_state)set\" where\n \"step0_rel = basic_rel\"\n\ndefinition step1_add_rel :: \"(opt_obsv_state \\ tso_state)set\" where\n \"step1_add_rel = {(sa, sc). \\S v.\n r_votes sc = const_map v S\n \\ (S \\ {} \\ opt_obs_safe (last_obs sc) v)\n }\"\n\ndefinition step1_rel :: \"(opt_obsv_state \\ tso_state)set\" where\n \"step1_rel = basic_rel \\ step1_add_rel\"\n\ndefinition tso_ref_rel :: \"(opt_obsv_state \\ tso_state)set\" where\n \"tso_ref_rel \\ {(sa, sc).\n (two_step (next_round sc) = 0 \\ (sa, sc) \\ step0_rel)\n \\ (two_step (next_round sc) = 1 \\ \n (sa, sc) \\ step1_rel\n \\ (\\sc' r S v. (sc', sc) \\ tso_round0 r S v \\ (sa, sc') \\ step0_rel))\n }\"\n\nlemma const_map_equality:\n \"(const_map v S = const_map v' S') = (S = S' \\ (S = {} \\ v = v'))\"\n apply(simp add: const_map_def restrict_map_def)\n by (metis equals0D option.distinct(2) option.inject subsetI subset_antisym)\n\nlemma rhoare_skipI:\n \"\\ \\sa sc sc'. \\ (sa, sc) \\ Pre; (sc, sc') \\ Tc \\ \\ (sa, sc') \\ Post \\ \\ {Pre} Id, Tc {>Post}\"\n by(auto simp add: PO_rhoare_defs)\n\nlemma tso_round0_refines:\n \"{tso_ref_rel} Id, tso_round0 r S v {>tso_ref_rel}\"\n apply(rule rhoare_skipI)\n apply(auto simp add: tso_ref_rel_def basic_rel_def step1_rel_def \n step1_add_rel_def step0_rel_def tso_round0_def const_map_equality conj_disj_distribR\n ex_disj_distrib two_step_phase_Suc)\n done\n\nlemma tso_round1_refines:\n \"{tso_ref_rel} \\r S v dec_f Ob. olv_round r S v dec_f Ob, tso_round1 r dec_f o_f {>tso_ref_rel}\"\nproof(clarsimp simp add: PO_rhoare_defs)\n fix sa sc and sc'\n assume\n R: \"(sa, sc) \\ tso_ref_rel\" \n and step1: \"(sc, sc') \\ tso_round1 r dec_f o_f\"\n\n hence step_r: \"two_step r = 1\" and r_next: \"next_round sc = r\" by (auto simp add: tso_round1_def)\n then obtain r0 sc0 S0 v0 where \n R0: \"(sa, sc0) \\ step0_rel\" and step0: \"(sc0, sc) \\ tso_round0 r0 S0 v0\"\n using R\n by(auto simp add: tso_ref_rel_def) \n\n from step_r r_next R obtain S v where\n v: \"r_votes sc = const_map v S\"\n and safe: \"S \\ {} \\ opt_obs_safe (last_obs sc) v\"\n by(auto simp add: tso_ref_rel_def step1_rel_def step1_add_rel_def)\n\n define sa' where \"sa' = sa\\ \n next_round := Suc (next_round sa)\n , decisions := decisions sa ++ dec_f\n , last_obs := last_obs sa ++ const_map v (dom o_f)\n \\\"\n\n have \"S \\ Quorum \\ dom o_f = UNIV\" using step1 v\n by(auto simp add: tso_round1_def obs_guard_def const_map_def)\n moreover have \"o_f \\ Map.empty \\ S \\ {}\" using step1 v\n by(auto simp add: tso_round1_def obs_guard_def dom_const_map)\n ultimately have \n abs_step: \n \"(sa, sa') \\ olv_round (next_round sa) S v dec_f (dom o_f)\" using R safe v step_r r_next step1\n by(clarsimp simp add: tso_ref_rel_def step1_rel_def basic_rel_def sa'_def \n olv_round_def tso_round1_def)\n\n from v have post_rel: \"(sa', sc') \\ tso_ref_rel\" using R step1\n apply(clarsimp simp add: tso_round0_def tso_round1_def \n step0_rel_def basic_rel_def sa'_def tso_ref_rel_def two_step_phase_Suc o_def\n const_map_is_Some const_map_is_None const_map_equality obs_guard_def \n intro!: arg_cong2[where f=map_add, OF refl])\n apply(auto simp add: const_map_def restrict_map_def intro!: ext)\n done\n\n from abs_step post_rel show \n \"\\sa'. (\\r' S' w dec_f' Ob'. (sa, sa') \\ olv_round r' S' w dec_f' Ob') \\ (sa', sc') \\ tso_ref_rel\"\n by blast\nqed\n \nlemma TS_Observing_Refines:\n \"PO_refines tso_ref_rel olv_TS tso_TS\"\n apply(auto simp add: PO_refines_def olv_TS_defs tso_TS_defs \n intro!: tso_round0_refines tso_round1_refines)\n apply(auto simp add: tso_ref_rel_def step0_rel_def basic_rel_def tso_init_def quorum_for_def \n dest: empty_not_quorum)\n done\n\nsubsection \\Invariants\\\n(******************************************************************************)\n\ndefinition TSO_inv1 where\n \"TSO_inv1 = {s. two_step (next_round s) = Suc 0 \\\n (\\v. \\p w. r_votes s p = Some w \\ w = v)}\"\n\nlemmas TSO_inv1I = TSO_inv1_def [THEN setc_def_to_intro, rule_format]\nlemmas TSO_inv1E [elim] = TSO_inv1_def [THEN setc_def_to_elim, rule_format]\nlemmas TSO_inv1D = TSO_inv1_def [THEN setc_def_to_dest, rule_format]\n\ndefinition TSO_inv2 where\n \"TSO_inv2 = {s. two_step (next_round s) = Suc 0 \\\n (\\p v. (r_votes s p = Some v \\ (\\q. last_obs s q \\ {None, Some v})))}\"\n\nlemmas TSO_inv2I = TSO_inv2_def [THEN setc_def_to_intro, rule_format]\nlemmas TSO_inv2E [elim] = TSO_inv2_def [THEN setc_def_to_elim, rule_format]\nlemmas TSO_inv2D = TSO_inv2_def [THEN setc_def_to_dest, rule_format]\n\nsubsubsection \\Proofs of invariants\\\n(******************************************************************************)\n\nlemma TSO_inv1_inductive:\n \"init tso_TS \\ TSO_inv1\"\n \"{TSO_inv1} TS.trans tso_TS {> TSO_inv1}\"\n by(auto simp add: TSO_inv1_def tso_TS_defs PO_hoare_def \n tso_round0_def tso_round1_def const_map_is_Some two_step_phase_Suc)\n \nlemma TSO_inv1_invariant:\n \"reach tso_TS \\ TSO_inv1\"\n by(intro inv_rule_basic TSO_inv1_inductive)\n\nlemma TSO_inv2_inductive:\n \"init tso_TS \\ TSO_inv2\"\n \"{TSO_inv2} TS.trans tso_TS {> TSO_inv2}\"\n by(auto simp add: TSO_inv2_def tso_TS_defs PO_hoare_def \n opt_obs_safe_def tso_round0_def tso_round1_def const_map_is_Some two_step_phase_Suc)\n \nlemma TSO_inv2_invariant:\n \"reach tso_TS \\ TSO_inv2\"\n by(intro inv_rule_basic TSO_inv2_inductive)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Consensus_Refined/Observing/Two_Step_Observing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.2707244141192081}} {"text": "theory DataRefinementMore\nimports AbstractSepreftime\nbegin\n\nsubsection \\Data Refinement\\\n\n\nlemma \"{(1,2),(2,4)}``{1,2}={2,4}\" by auto\n\n\ndefinition conc_fun (\"\\\") where\n \"conc_fun R m \\ case m of FAILi \\ FAILT | REST X \\ REST (\\c. Sup {X a| a. (c,a)\\R})\"\n (* ^- not so sure here *)\ndefinition abs_fun (\"\\\") where\n \"abs_fun R m \\ case m of FAILi \\ FAILT \n | REST X \\ if dom X\\Domain R then REST (\\a. Sup {X c| c. (c,a)\\R}) else FAILT\"\n (* ^- not so sure here *)\nlemma \n conc_fun_FAIL[simp]: \"\\R FAILT = FAILT\" and\n conc_fun_RES: \"\\R (REST X) = REST (\\c. Sup {X a| a. (c,a)\\R})\"\n unfolding conc_fun_def by (auto split: nrest.split)\n\n(* \nlemma conc_fun_RES_sv: \"single_valued R \\ \n \\R (REST X) = REST (\\c. if c\\Dom R then Some (X Sup {X a| a. (c,a)\\R})\"\n*)\n\nlemma nrest_Rel_mono:\n fixes A :: \"('a,'b::complete_lattice) nrest\"\n shows \"A \\ B \\ \\ R A \\ \\ R B\"\n unfolding conc_fun_def\n apply (auto split: nrest.split simp: le_fun_def) \n by (smt complete_lattice_class.Sup_mono mem_Collect_eq) \n\n\n\nlemma datarefine_timerefine_commute1:\n assumes \"wfR R'\"\n shows \"\\ R (timerefine R' m) \\ timerefine R' (\\ R m)\"\n unfolding conc_fun_def timerefine_def\n apply(cases m) apply auto apply(rule le_funI)\n apply(rule Sup_least)\n apply (auto split: option.splits)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper less_eq_option_Some_None mem_Collect_eq)\n apply(rule le_funI)\n apply(rule Sum_any_mono)\n apply(rule mult_right_mono)\n subgoal \n by (metis (mono_tags, lifting) Sup_upper le_funE less_eq_option_Some mem_Collect_eq) \n apply simp\n apply(rule wfR_finite_mult_left )\n using assms by simp\n\n\n\nlemma datarefine_timerefine_commute2: \n assumes \"wfR R'\" and sv: \"single_valued R\"\n shows \"\\ R (timerefine R' m) \\ timerefine R' (\\ R m)\"\n unfolding conc_fun_def timerefine_def\n apply(cases m) apply auto apply(rule le_funI)\n subgoal for x2 x\n proof (cases \"\\a. (x, a) \\ R\")\n case True\n from sv have k: \"\\a. (x, a) \\ R \\ (a = (THE a. (x,a)\\R))\"\n unfolding single_valued_def apply auto \n subgoal by (simp add: the_equality) \n subgoal apply(rule theI') using True by auto \n done \n show ?thesis apply(subst k) apply simp\n apply(subst (2) k) by simp\n next\n case False\n then show ?thesis by (auto split: option.splits simp: bot_option_def) \n qed \n done \n\nexperiment\nbegin\n\ndefinition \"m = REST [0\\(\\_.0)(1:=1), 1\\(\\_.0)(0:=1)]\"\n\ndefinition \"R = {(0::nat,1::nat),(1,1),(1,0),(1,0)}\"\n\nterm \"(\\_.0)(x:=y)\"\n\ndefinition \"R' = (\\_.0)(0::nat:=(\\_.0)(0:=1),1:=(\\_.0)(0:=1::enat))\"\n\nlemma *: \"Sum_any (\\ac. (if ac = Suc 0 then 1 else 0) * R' ac cc)\n = R' 1 cc\" sorry \nlemma **: \"Sum_any (\\ac. (if ac = 0 then 1 else 0) * R' ac cc)\n = R' 0 cc\" sorry \n\nlemma \"\\ R (timerefine R' m) = SPECT G\"\n unfolding conc_fun_def timerefine_def m_def R_def apply auto\n apply(rule ext) unfolding ** * apply auto\n unfolding R'_def apply auto sorry\n \n\nlemma \" (timerefine R' (\\ R m)) = SPECT G2\"\n unfolding conc_fun_def timerefine_def m_def R_def apply auto\n apply(rule ext) unfolding ** * \n unfolding R'_def oops\n\nend\n\n \nlemma datarefine_timerefine_commute: \n assumes \"wfR R'\" and sv: \"single_valued R\"\n shows \"\\ R (timerefine R' m) = timerefine R' (\\ R m)\"\n apply(rule antisym)\n subgoal using assms datarefine_timerefine_commute1 by metis\n subgoal using assms datarefine_timerefine_commute2 by metis\n done\n\n\nlemma pw_conc_nofail[refine_pw_simps]: \n \"nofailT (\\R S) = nofailT S\"\n by (cases S) (auto simp: conc_fun_RES)\n\nlemma \"single_valued A \\ single_valued B \\ single_valued (A O B)\"\n by (simp add: single_valued_relcomp)\n\nlemma Sup_enatoption_less2: \" Sup X = Some \\ \\ (\\x. Some x \\ X \\ enat t < x)\"\n using Sup_enat_less2\n by (metis Sup_option_def in_these_eq option.distinct(1) option.sel)\n\nlemma pw_conc_inres[refine_pw_simps]:\n \"inresT (\\R S') s t = (nofailT S' \n \\ ((\\s'. (s,s')\\R \\ inresT S' s' t) \\ \\ \\ (\\s' t'. (s,s')\\R \\ inresT S' s' t' \\ t' \\ t )\\ ))\"\n apply (cases S')\n subgoal by simp\n subgoal for m'\n apply rule\n subgoal \n apply (auto simp: conc_fun_RES )\n subgoal for t' \n apply(cases t')\n apply auto\n subgoal for n apply(auto dest!: Sup_finite_enat) \n subgoal for a apply(rule exI[where x=a]) apply auto\n apply(rule exI[where x=\"enat n\"]) by auto \n done\n subgoal apply(drule Sup_enatoption_less2[where t=t])\n apply auto subgoal for x a apply(rule exI[where x=a]) apply auto\n apply(rule exI[where x=x]) by auto \n done\n done\n done\n subgoal \n apply (auto simp: conc_fun_RES)\n by (smt Sup_upper dual_order.trans le_some_optE mem_Collect_eq)\n done\n done \n\nlemma bindT_refine':\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' M'\"\n assumes R2: \"\\x x' t . \\ (x,x')\\R'; inresT M x t; inresT M' x' t;\n nofailT M; nofailT M'\n \\ \\ f x \\ \\ R (f' x')\"\n shows \"bindT M (\\x. f x) \\ \\ R (bindT M' (\\x'. f' x'))\"\n using assms\n apply (simp add: pw_le_iff refine_pw_simps)\n by blast \n\nexperiment\nbegin\n\n\n\n\nlemma bindT_refine'':\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' M'\"\n assumes R2: \"\\x x' t . \\ (x,x')\\R' \n \\ \\ f x \\ \\ R (f' x')\"\n shows \"bindT M (\\x. f x) \\ \\ R (bindT M' (\\x'. f' x'))\" \n sorry\n\n\nthm bindT_refine'' bindT_mono_under_timerefine\n\nlemma \n assumes \"wfR tR\" and sv: \"single_valued R\" and sv: \"single_valued R'\"\n assumes R1: \"M \\ (timerefine tR (\\ R' M'))\"\n assumes R2: \"\\x x' t . \\ (x,x')\\R' \\ \\ f x \\ (timerefine tR ( \\ R (f' x')))\"\n shows \"bindT M (\\x. f x) \\ (timerefine tR (\\ R (bindT M' (\\x'. f' x'))))\"\n apply(subst datarefine_timerefine_commute[symmetric, OF assms(1,2)])\n\n apply(rule order.trans)\n defer apply(rule nrest_Rel_mono) apply(subst timerefine_bindT_ge[OF assms(1)]) apply simp\n apply(rule bindT_refine''[where R'=R'])\n apply(rule order.trans[OF R1])\n apply(subst datarefine_timerefine_commute[ OF assms(1,3)]) apply simp\n apply(rule order.trans[OF R2]) apply simp\n apply(subst datarefine_timerefine_commute[ OF assms(1,2)]) apply simp\n done\n\n\nlemma \n assumes \"wfR tR\" \n assumes R1: \"M \\ (\\ R'(timerefine tR M'))\"\n assumes R2: \"\\x x' t . \\ (x,x')\\R' \\ \\ f x \\ ( \\ R (timerefine tR (f' x')))\"\n shows \"bindT M (\\x. f x) \\ (\\ R (timerefine tR (bindT M' (\\x'. f' x'))))\" \n apply(rule order.trans)\n defer apply(rule nrest_Rel_mono) apply(subst timerefine_bindT_ge[OF assms(1)]) apply simp\n apply(rule bindT_refine''[where R'=R'])\n apply(rule R1) \n apply(rule R2) by simp \n\n\n\n \n \n\n \n\n\nend\n\n\n\n\n\nsubsubsection \\Examples\\\n\ndefinition Rset where \"Rset = { (c,a)| c a. set c = a}\"\n \nlemma \"RETURNT [1,2,3] \\ \\Rset (RETURNT {1,2,3})\"\n unfolding conc_fun_def RETURNT_def Rset_def\n apply simp unfolding le_fun_def by auto\n\nlemma \"RETURNT [1,2,3] \\ \\Rset (RETURNT {1,2,3})\"\n unfolding conc_fun_def RETURNT_def Rset_def\n apply simp unfolding le_fun_def by auto\n\n\ndefinition Reven where \"Reven = { (c,a)| c a. even c = a}\"\n\nlemma \"RETURNT 3 \\ \\Reven (RETURNT False)\"\n unfolding conc_fun_def RETURNT_def Reven_def\n apply simp unfolding le_fun_def by auto\n\nlemma \"m \\ \\Id m\"\n unfolding conc_fun_def RETURNT_def \n apply (cases m) by auto\n\n\nlemma \"m \\ \\{} m \\ (m=FAILT \\ m = SPECT bot)\"\n unfolding conc_fun_def RETURNT_def \n apply (cases m) apply auto by (metis bot.extremum dual_order.antisym le_funI)\n\n\nlemma abs_fun_simps[simp]: \n \"\\R FAILT = FAILT\"\n \"dom X\\Domain R \\ \\R (REST X) = REST (\\a. Sup {X c| c. (c,a)\\R})\"\n \"\\(dom X\\Domain R) \\ \\R (REST X) = FAILT\"\n unfolding abs_fun_def by (auto split: nrest.split)\n\nterm single_valued\n \ncontext fixes R assumes SV: \"single_valued R\" begin\n\n\nlemma \n fixes m :: \"'b \\ enat option\"\n shows\n Sup_sv: \"(c, a') \\ R \\ Sup {m a| a. (c,a) \\ R} = m a'\"\nproof -\n assume \"(c,a') \\ R\"\n with SV have singleton: \"{m a| a. (c,a) \\ R} = {m a'}\" by(auto dest: single_valuedD) \n show ?thesis unfolding singleton by simp\nqed \n\nlemma indomD: \" M c = Some y \\ dom M \\ Domain R \\ (\\a. (c,a)\\R)\"\n by auto\n\nlemma conc_abs_swap: \"m' \\ \\R m \\ \\R m' \\ m\"\n apply rule\n subgoal (* <-- *)\n unfolding conc_fun_def abs_fun_def using SV\n apply (auto split: nrest.splits) \n subgoal for M M'\n apply (auto simp add: le_fun_def) \n sorry (* by (smt Sup_least antisym le_cases mem_Collect_eq single_valuedD) *)\n subgoal \n by (smt Collect_cong Domain.DomainI domI domIff empty_Sup empty_def le_map_dom_mono set_rev_mp) \n done\n\n subgoal (* \\ *)\n unfolding conc_fun_def abs_fun_def using SV\n apply(auto split: nrest.splits if_splits)\n apply (auto simp add: le_fun_def)\n subgoal for M M' c\n apply(cases \"M c = None\")\n apply auto apply(frule indomD) apply simp\n apply(auto) sorry(*\n apply(simp only: Sup_sv)\n \n by (me tis (mono_tags, lifting) Sup_le_iff mem_Collect_eq) *)\n done\n done\n\nlemma \n fixes m :: \"'b \\ enat option\"\n shows\n Inf_sv: \"(c, a') \\ R \\ Inf {m a| a. (c,a) \\ R} = m a'\"\nproof -\n assume \"(c,a') \\ R\"\n with SV have singleton: \"{m a| a. (c,a) \\ R} = {m a'}\" by(auto dest: single_valuedD) \n show ?thesis unfolding singleton by simp\nqed \n\nlemma ac_galois: \"galois_connection (\\R) (\\R)\"\n apply (unfold_locales)\n by (rule conc_abs_swap)\n\n\nlemma \n fixes m :: \"'b \\ enat option\"\n shows \n Sup_some_svD: \"Sup {m a |a. (c, a) \\ R} = Some t' \\ (\\a. (c,a)\\R \\ m a = Some t')\"\n using SV by (smt Sup_le_iff dual_order.antisym less_eq_option_Some_None mem_Collect_eq order_refl single_valued_def)\n \n\nend \n\n\nlemma pw_abs_nofail[refine_pw_simps]: \n \"nofailT (\\R M) \\ (nofailT M \\ (\\x. (\\t. inresT M x t) \\ x\\Domain R))\"\n apply (cases M)\n apply simp\n apply (auto simp: abs_fun_simps abs_fun_def)\n by (metis zero_enat_def zero_le)\n\n(*\nlemma pw_abs_inres[refine_pw_simps]: \n \"(\\t. inresT (\\R M) a t) \\ (nofailT (\\R M) \\ (\\c. (\\t. inresT M c t) \\ (c,a)\\R))\"\n apply (cases M)\n apply simp\n apply rule\n subgoal for m\n apply (auto simp: abs_fun_def) (* *)\n sorry\n subgoal for m\n sorry\n done\n*)\n\nlemma pw_conc_nofail[refine_pw_simps]: \n \"nofailT (\\R S) = nofailT S\"\n by (cases S) (auto simp: conc_fun_RES)\n\nlemma \"single_valued A \\ single_valued B \\ single_valued (A O B)\"\n by (simp add: single_valued_relcomp)\n\nlemma Sup_enatoption_less2: \" Sup X = Some \\ \\ (\\x. Some x \\ X \\ enat t < x)\"\n using Sup_enat_less2\n by (metis Sup_option_def in_these_eq option.distinct(1) option.sel)\n\nlemma pw_conc_inres[refine_pw_simps]:\n \"inresT (\\R S') s t = (nofailT S' \n \\ ((\\s'. (s,s')\\R \\ inresT S' s' t) \\ \\ \\ (\\s' t'. (s,s')\\R \\ inresT S' s' t' \\ t' \\ t ) \\ ))\"\n apply (cases S')\n subgoal by simp\n subgoal for m'\n apply rule\n subgoal \n apply (auto simp: conc_fun_RES )\n subgoal for t' \n apply(cases t')\n apply auto\n subgoal for n apply(auto dest!: Sup_finite_enat) \n subgoal for a apply(rule exI[where x=a]) apply auto\n apply(rule exI[where x=\"enat n\"]) by auto \n done\n subgoal apply(drule Sup_enatoption_less2[where t=t])\n apply auto subgoal for x a apply(rule exI[where x=a]) apply auto\n apply(rule exI[where x=x]) by auto \n done\n done\n done\n subgoal \n apply (auto simp: conc_fun_RES)\n by (smt Sup_upper dual_order.trans le_some_optE mem_Collect_eq)\n done\n done \n(*\nlemma pw_conc_inres_sv:\n \"single_valued R \\ inresT (\\R S') s t = (nofailT S' \n \\ (\\s'. (s,s')\\R \\ inresT S' s' t))\"\n apply (cases S')\n subgoal by simp\n subgoal for m'\n apply rule\n subgoal \n by (auto simp: conc_fun_RES dest!: Sup_some_svD) \n subgoal \n by (auto simp: conc_fun_RES Sup_sv ) \n done\n done *)\n\nlemma \n fixes m :: \"'a \\ enat option\"\n shows\n \"single_valued R \\ Sup {m a| a. (c,a) \\ R} = None \\ c \\ Domain R\"\n apply rule\n subgoal oops\n\n(*\nlemma pw_abs_inre: \n \"inresT (\\R M) a t \\ (nofailT (\\R M) \\ (\\c. inresT M c t \\ (c,a)\\R))\"\n apply (cases M)\n apply simp\n apply (auto simp: abs_fun_def)\n done*)\n\n(*\nlemma pw_conc_inres:\n \"inresT (\\R S') s t = (nofailT S' \n \\ (\\s'. (s,s')\\R \\ inresT S' s' t))\"\n apply (cases S')\n subgoal by simp\n subgoal for m'\n apply rule\n subgoal \n apply (auto simp: conc_fun_RES) sorry\n subgoal \n apply (auto simp: conc_fun_RES) sorry\n done\n oops *)\n\nlemma sv_the: \"single_valued R \\ (c,a) \\ R \\ (THE a. (c, a) \\ R) = a\"\n by (simp add: single_valued_def the_equality)\n\nlemma\n conc_fun_RES_sv:\n assumes SV: \"single_valued R\"\n shows \"\\R (REST X) = REST (\\c. if c\\Domain R then X (THE a. (c,a)\\R) else None )\"\n unfolding conc_fun_def\n apply(auto split: nrest.split)\n apply(rule ext)\n apply auto\n subgoal using SV by (auto simp: Sup_sv sv_the)\n subgoal by (smt Collect_cong Domain.DomainI empty_Sup empty_def)\n done\n\n\nlemma conc_fun_mono[simp, intro!]: \n shows \"mono (\\R)\"\n apply rule \n apply (simp add: pw_le_iff)\n by (auto simp: refine_pw_simps) \n\n\nlemma conc_fun_R_mono:\n assumes \"R \\ R'\" \n shows \"\\R M \\ \\R' M\"\n using assms\n by (auto simp: pw_le_iff refine_pw_simps)\n\n\n\nlemma SupSup_2: \"Sup {m a |a. (c, a) \\ R O S} = Sup {m a |a b. (b,a)\\S \\ (c,b)\\R }\"\nproof -\n have i: \"\\a. (c,a) \\ R O S \\ (\\b. (b,a)\\S \\ (c,b)\\R)\" by auto\n have \"Sup {m a |a. (c, a) \\ R O S} = Sup {m a |a. (\\b. (b,a)\\S \\ (c,b)\\R)}\" \n unfolding i by auto\n also have \"... = Sup {m a |a b. (b,a)\\S \\ (c,b)\\R}\" by auto\n finally show ?thesis .\n qed\n\nlemma \n fixes m :: \"'a \\ enat option\"\n shows SupSup: \"Sup {Sup {m aa |aa. P a aa c} |a. Q a c} = Sup {m aa |a aa. P a aa c \\ Q a c}\"\n apply(rule antisym)\n subgoal apply(rule Sup_least)\n by (auto intro: Sup_subset_mono)\n subgoal \n unfolding Sup_le_iff apply auto\n by (smt Sup_upper Sup_upper2 mem_Collect_eq)\n done \n\nlemma \n fixes m :: \"'a \\ enat option\"\n shows \n SupSup_1: \"Sup {Sup {m aa |aa. (a, aa) \\ S} |a. (c, a) \\ R} = Sup {m aa |a aa. (a,aa)\\S \\ (c,a)\\R}\"\n by(rule SupSup)\n\n\nlemma conc_fun_chain:\n shows \"\\R (\\S M) = \\(R O S) M\"\n apply(cases M)\n subgoal by simp\n apply simp\n apply(simp only: conc_fun_RES)\n apply auto apply (rule ext) unfolding SupSup_1 SupSup_2 by meson \n\nlemma conc_fun_chain_sv:\n assumes SVR: \"single_valued R\" and SVS: \"single_valued S\"\n shows \"\\R (\\S M) = \\(R O S) M\"\n apply(cases M)\n subgoal by simp\n apply simp\n using SVS apply(simp only: conc_fun_RES_sv)\n using SVR apply(simp only: conc_fun_RES_sv)\n using single_valued_relcomp[OF SVR SVS] apply(simp only: conc_fun_RES_sv)\n apply (auto split: nrest.split)\n apply (rule ext) apply auto\n apply(auto simp add: sv_the) \n apply(subst sv_the) by auto\n\n\nlemma conc_Id[simp]: \"\\Id = id\"\n unfolding conc_fun_def [abs_def] by (auto split: nrest.split)\n\n \nlemma conc_fun_fail_iff[simp]: \n \"\\R S = FAILT \\ S=FAILT\"\n \"FAILT = \\R S \\ S=FAILT\"\n by (auto simp add: pw_eq_iff refine_pw_simps)\n\nlemma conc_trans[trans]:\n assumes A: \"C \\ \\R B\" and B: \"B \\ \\R' A\" \n shows \"C \\ \\R (\\R' A)\"\n using assms by (fastforce simp: pw_le_iff refine_pw_simps)\n\nlemma conc_trans_sv:\n assumes SV: \"single_valued R\" \"single_valued R'\"\n and A: \"C \\ \\R B\" and B: \"B \\ \\R' A\" \n shows \"C \\ \\R (\\R' A)\"\n using assms by (fastforce simp: pw_le_iff refine_pw_simps)\n\ntext \\WARNING: The order of the single statements is important here!\\\nlemma conc_trans_additional[trans]:\n assumes \"single_valued R\"\n shows\n \"\\A B C. A\\\\R B \\ B\\ C \\ A\\\\R C\"\n \"\\A B C. A\\\\Id B \\ B\\\\R C \\ A\\\\R C\"\n \"\\A B C. A\\\\R B \\ B\\\\Id C \\ A\\\\R C\"\n\n \"\\A B C. A\\\\Id B \\ B\\\\Id C \\ A\\ C\"\n \"\\A B C. A\\\\Id B \\ B\\ C \\ A\\ C\"\n \"\\A B C. A\\ B \\ B\\\\Id C \\ A\\ C\"\n using assms conc_trans[where R=R and R'=Id]\n by (auto intro: order_trans)\n\n\n\nlemma RETURNT_refine:\n assumes \"(x,x')\\R\"\n shows \"RETURNT x \\ \\R (RETURNT x')\"\n using assms\n by (auto simp: RETURNT_def conc_fun_RES le_fun_def Sup_upper) \n\n(*\nthm bindT_refine'\nlemma bindT_refine'2:\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' M'\"\n assumes R2: \"\\x x' t . \\ (x,x')\\R'; inresT M x t; inresT M' x' t;\n nofailT M; nofailT M'\n \\ \\ f x \\ \\ R (f' x')\"\n shows \"bindT M (\\x. f x) \\ \\ R (bindT M' (\\x'. f' x'))\"\n using assms\n apply (simp add: pw_le_iff refine_pw_simps) \n by blast*)\n\nlemma bindT_refine:\n fixes R' :: \"('a\\'b) set\" and R::\"('c\\'d) set\"\n assumes R1: \"M \\ \\ R' M'\"\n assumes R2: \"\\x x'. \\ (x,x')\\R' \\ \n \\ f x \\ \\ R (f' x')\"\n shows \"bindT M (\\x. f x) \\ \\ R (bind M' (\\x'. f' x'))\"\n apply (rule bindT_refine') using assms by auto\n\nsubsection \\WHILET refine\\\n\nlemma RECT_refine:\n assumes M: \"mono2 body\"\n assumes R0: \"(x,x')\\R\"\n assumes RS: \"\\f f' x x'. \\ \\x x'. (x,x')\\R \\ f x \\\\S (f' x'); (x,x')\\R \\ \n \\ body f x \\\\S (body' f' x')\"\n shows \"RECT (\\f x. body f x) x \\\\S (RECT (\\f' x'. body' f' x') x')\"\n unfolding RECT_flat_gfp_def\n apply (clarsimp simp add: M) \n apply (rule flatf_fixp_transfer[where \n fp'=\"flatf_gfp body\" \n and B'=body \n and P=\"\\x x'. (x',x)\\R\", \n OF _ _ flatf_ord.fixp_unfold[OF M[THEN trimonoD_flatf_ge]] R0])\n apply simp\n apply (simp add: trimonoD_flatf_ge)\n by (rule RS)\n\n \nlemma WHILET_refine:\n assumes R0: \"(x,x')\\R\"\n assumes COND_REF: \"\\x x'. \\ (x,x')\\R \\ \\ b x = b' x'\"\n assumes STEP_REF: \n \"\\x x'. \\ (x,x')\\R; b x; b' x' \\ \\ f x \\ \\R (f' x')\"\n shows \"whileT b f x \\ \\R (whileT b' f' x')\"\n unfolding whileT_def apply(rule RECT_refine)\n subgoal by(refine_mono) \n apply (fact R0)\n by(auto simp: COND_REF STEP_REF RETURNT_refine intro: bindT_refine[where R'=R]) \n\nlemma \n assumes a: \"\\m n c a. c\\Domain R \\ \\a. SPECT (n c) \\ SPECT (m a)\"\n shows \"(SPECT n) \\ \\ R (SPECT m)\"\n using a apply auto \n unfolding conc_fun_def apply (auto split: nrest.split) \n unfolding le_fun_def apply auto\n proof -\n fix c \n assume \"(\\c n m. c \\ Domain R \\ \\a. \\x. n c x \\ m a x)\"\n oops\n\nlemma SPECT_refines_conc_fun':\n assumes a: \"\\m c. M = SPECT m\n \\ c \\ dom n \\ (\\a. (c,a)\\R \\ n c \\ m a)\"\n shows \"SPECT n \\ \\ R M\"\nproof - \n show ?thesis\n unfolding conc_fun_def apply (auto split: nrest.split) \n subgoal for m unfolding le_fun_def apply auto\n proof -\n fix c\n assume m: \"M = SPECT m\"\n show \"n c \\ Sup {m a |a. (c, a) \\ R} \"\n proof (cases \"c \\ dom n\")\n case True\n with m a obtain a where k: \"(c,a)\\R\" \"n c \\ m a\" by blast \n show ?thesis apply(rule Sup_upper2) using k by auto\n next\n case False\n then show ?thesis \n by (simp add: domIff)\n qed \n qed\n done\nqed\n\nlemma SPECT_refines_conc_fun:\n assumes a: \"\\m c. (\\a. (c,a)\\R \\ n c \\ m a)\"\n shows \"SPECT n \\ \\ R (SPECT m)\"\n apply(rule SPECT_refines_conc_fun') using a by auto\n\n\nlemma SPECT_refines_conc_fun_sv:\n assumes \"single_valued R\" \n and a: \"dom n \\ Domain R\"\n and \"\\c. c \\ dom n \\ n c \\ (THE a. (c,a)\\R)\"\n shows \"SPECT n \\ \\ R (SPECT m)\"\n apply(rule SPECT_refines_conc_fun') using a\n using indomD[OF assms(1) _ a] domIff\n oops\n\n\n\n\nlemma conc_fun_br: \"\\ (br \\ I1) (SPECT (emb I2 t))\n = (SPECT (emb (\\x. I1 x \\ I2 (\\ x)) t))\"\n unfolding conc_fun_RES apply auto apply(rule ext) \n using Sup_Some by (auto simp: emb'_def br_def bot_option_def Sup_option_def) \n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/moreCurr/DataRefinementMore.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.270671612100282}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_inv__5_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__5_on_rules imports n_mutualEx_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i. i\\N\\r=n_Try i)\\\n (\\ i. i\\N\\r=n_Crit i)\\\n (\\ i. i\\N\\r=n_Exit i)\\\n (\\ i. i\\N\\r=n_Idle i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Try i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_TryVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Crit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_CritVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Exit i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_ExitVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_Idle i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_IdleVsinv__5) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6959583124210896, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.27046194604261653}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Christoph Sprenger, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze, Christoph Sprenger\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nchapter\\Abstract, and Concrete Parametrized Models\\\ntext\\This is the core of our verification -- the abstract and parametrized models that cover a wide\nrange of protocols.\\\nsection\\Network model\\\ntheory Network_Model\n imports\n \"infrastructure/Agents\"\n \"infrastructure/Tools\"\n \"infrastructure/Take_While\"\nbegin\n\ntext\\@{term \"as\"} is already defined as a type synonym for nat.\\\ntype_synonym ifs = nat\n\ntext\\The authenticated hop information consists of the interface identifiers UpIF, DownIF and an\nidentifier of the AS to which the hop information belongs. Furthermore, this record is extensible \nand can include additional authenticated hop information (aahi).\\\nrecord ahi = \n UpIF :: \"ifs option\"\n DownIF :: \"ifs option\"\n ASID :: as\n\ntype_synonym 'aahi ahis = \"'aahi ahi_scheme\"\n\nlocale network_model = compromised + \n fixes\n auth_seg0 :: \"('ainfo \\ 'aahi ahi_scheme list) set\" \n and tgtas :: \"as \\ ifs \\ as option\"\n and tgtif :: \"as \\ ifs \\ ifs option\"\nbegin\n\nsubsection \\Interface check\\\n(******************************************************************************)\n\ntext \\Check if the interfaces of two adjacent hop fields match. If both hops are compromised we also\ninterpret the link as valid.\\\nfun if_valid :: \"'aahi ahis option \\ 'aahi ahis => 'aahi ahis option \\ bool\" where\n \"if_valid None hf _ \\ \\this is the case for the leaf AS\\\n = True\"\n| \"if_valid (Some hf1) (hf2) _\n = ((\\downif . DownIF hf2 = Some downif \\ \n tgtas (ASID hf2) downif = Some (ASID hf1) \\\n tgtif (ASID hf2) downif = UpIF hf1)\n \\ ASID hf1 \\ bad \\ ASID hf2 \\ bad)\"\n\ntext \\makes sure that: the segment is terminated, i.e. the first AS's HF has Eo = None\\\nfun terminated :: \"'aahi ahis list \\ bool\" where\n \"terminated (hf#xs) \\ DownIF hf = None \\ ASID hf \\ bad\"\n| \"terminated [] = True\" (* we allow this as a special case*)\n\ntext \\makes sure that: the segment is rooted, i.e. the last HF has UpIF = None\\\nfun rooted :: \"'aahi ahis list \\ bool\" where\n \"rooted [hf] \\ UpIF hf = None \\ ASID hf \\ bad\"\n| \"rooted (hf#xs) = rooted xs\"\n| \"rooted [] = True\" (* we allow this as a special case*)\n\nabbreviation ifs_valid where \n \"ifs_valid pre l nxt \\ TW.holds if_valid pre l nxt\"\n\nabbreviation ifs_valid_prefix where \n \"ifs_valid_prefix pre l nxt \\ TW.takeW if_valid pre l nxt\"\n\nabbreviation ifs_valid_None where \n \"ifs_valid_None l \\ ifs_valid None l None\"\n\nabbreviation ifs_valid_None_prefix where \n \"ifs_valid_None_prefix l \\ ifs_valid_prefix None l None\"\n\nlemma strip_ifs_valid_prefix:\n \"pfragment ainfo l auth_seg0 \\ pfragment ainfo (ifs_valid_prefix pre l nxt) auth_seg0\"\n by (auto elim: pfragment_prefix' intro: TW.takeW_prefix)\n\n\ntext\\Given the AS and an interface identifier of a channel, obtain the AS and interface at the other\nend of the same channel.\\\nabbreviation rev_link :: \"as \\ ifs \\ as option \\ ifs option\" where \n \"rev_link a1 i1 \\ (tgtas a1 i1, tgtif a1 i1)\"\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/Network_Model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.2703403900935352}} {"text": "(* Author: Tobias Nipkow *)\n\nsection \"Completeness of Archive Test\"\n\ntheory ArchCompProps\nimports TameEnumProps ArchCompAux\nbegin\nlemma mgp_pre_iso_test: \"minGraphProps g \\ pre_iso_test(fgraph g)\"\napply(simp add:pre_iso_test_def fgraph_def image_def)\napply(rule conjI) apply(blast dest: mgp_vertices_nonempty[symmetric])\napply(rule conjI) apply(blast intro:minGraphProps)\napply(drule minGraphProps11)\napply(simp add:normFaces_def normFace_def verticesFrom_def minVertex_def\n rotate_min_def o_def)\ndone\n\ncorollary iso_test_correct:\n \"\\ pre_iso_test Fs\\<^sub>1; pre_iso_test Fs\\<^sub>2 \\ \\\n iso_test Fs\\<^sub>1 Fs\\<^sub>2 = (Fs\\<^sub>1 \\ Fs\\<^sub>2)\"\nby(simp add:pre_iso_test_def iso_correct inj_on_rotate_min_iff[symmetric]\n distinct_map nof_vertices_def length_remdups_concat)\n\nlemma trie_all_eq_set_of_trie:\n \"invar_trie t \\ all_trie (list_all P) t = (\\v \\ set_tries t. P v)\"\nby(simp add: all_trie_eq_ran set_tries_eq_ran)\n\nlemma samet_imp_iso_seteq:\nassumes pre1: \"\\gs g. gsopt = Some gs \\ g \\ set_tries gs \\ pre_iso_test g\"\nand pre2: \"\\g. g \\ set arch \\ pre_iso_test g\"\nand inv: \"\\gs. gsopt = Some gs \\ invar_trie gs\"\nand same: \"samet gsopt arch\"\nshows \"\\gs. gsopt = Some gs \\ set_tries gs =\\<^sub>\\ set arch\"\nproof -\n obtain gs where [simp]: \"gsopt = Some gs\" and test1: \"\\g. g \\ set_tries gs \\\n \\h \\ set arch. iso_test g h\" and test2: \"\\g. g \\ set arch \\\n \\h \\ set_tries gs. iso_test g h\"\n using same inv\n by(force simp: samet_def trie_all_eq_set_of_trie invar_of_list all_tries_def\n split:option.splits\n dest: in_set_lookup_of_listD in_set_lookup_set_triesD)\n have \"set_tries gs \\\\<^sub>\\ set arch\"\n proof (auto simp:qle_gr.defs)\n fix g assume g: \"g \\ set_tries gs\"\n obtain h where h: \"h \\ set arch\" and test: \"iso_test g h\"\n using test1[OF g] by blast\n thus \"\\h\\set arch. g \\ h\"\n using h pre1[OF _ g] pre2[OF h] by (auto simp:iso_test_correct)\n qed\n moreover\n have \"set arch \\\\<^sub>\\ set_tries gs\"\n proof (auto simp:qle_gr.defs)\n fix g assume g: \"g \\ set arch\"\n obtain h where h: \"h \\ set_tries gs\" and test: \"iso_test g h\"\n using test2[OF g] by blast\n thus \"\\h \\ set_tries gs. g \\ h\"\n using h pre1[OF _ h] pre2[OF g] by (auto simp:iso_test_correct)\n qed\n ultimately show ?thesis by (auto simp: qle_gr.seteq_qle_def)\nqed\n\nlemma samet_imp_iso_subseteq:\nassumes pre1: \"\\gs g. gsopt = Some gs \\ g \\ set_tries gs \\ pre_iso_test g\"\nand pre2: \"\\g. g \\ set arch \\ pre_iso_test g\"\nand inv: \"\\gs. gsopt = Some gs \\ invar_trie gs\"\nand same: \"samet gsopt arch\"\nshows \"\\gs. gsopt = Some gs \\ set_tries gs \\\\<^sub>\\ set arch\"\nusing qle_gr.seteq_qle_def assms samet_imp_iso_seteq by metis\n\nglobal_interpretation set_mod_trie:\n set_mod_maps \"Trie None []\" update_trie lookup_tries invar_trie \"(\\)\" iso_test pre_iso_test hash\n defines insert_mod_trie = \"set_mod_maps.insert_mod update_trie lookup_tries iso_test hash\"\n and worklist_tree_coll_trie = \"set_modulo.worklist_tree_coll (Trie None []) insert_mod_trie\"\n and worklist_tree_coll_aux_trie = \"set_modulo.worklist_tree_coll_aux insert_mod_trie\"\n and insert_mod2_trie = \"set_modulo.insert_mod2 insert_mod_trie\"\n by standard (simp_all add: iso_test_correct)\n\ndefinition enum_filter_finals ::\n \"(graph \\ graph list) \\ graph list\n \\ (nat,nat fgraph) tries option\" where\n\"enum_filter_finals succs = set_mod_trie.worklist_tree_coll succs final fgraph\"\n\ndefinition tameEnumFilter :: \"nat \\ (nat,nat fgraph)tries option\" where\n\"tameEnumFilter p = enum_filter_finals (next_tame p) [Seed p]\"\n\nlemma TameEnum_tameEnumFilter:\n \"tameEnumFilter p = Some t \\ set_tries t =\\<^sub>\\ fgraph ` TameEnum\\<^bsub>p\\<^esub>\"\napply(auto simp: tameEnumFilter_def TameEnumP_def enum_filter_finals_def)\napply(drule set_mod_trie.worklist_tree_coll_equiv[OF _ inv_inv_next_tame])\napply (auto simp: set_of_conv inv_Seed mgp_pre_iso_test RTranCl_conv)\ndone\n\nlemma tameEnumFilter_subseteq_TameEnum:\n \"tameEnumFilter p = Some t \\ set_tries t \\ fgraph ` TameEnum\\<^bsub>p\\<^esub>\"\nby(auto simp add:tameEnumFilter_def TameEnumP_def enum_filter_finals_def\n set_of_conv inv_Seed mgp_pre_iso_test RTranCl_conv\n dest!: set_mod_trie.worklist_tree_coll_subseteq[OF _ inv_inv_next_tame])\n\n\nlemma inv_tries_tameEnumFilter:\n \"tameEnumFilter p = Some t \\ invar_trie t\"\nunfolding tameEnumFilter_def enum_filter_finals_def\nby(erule set_mod_trie.worklist_tree_coll_inv)\n\ntheorem combine_evals_filter:\n \"\\g \\ set arch. pre_iso_test g \\ samet (tameEnumFilter p) arch\n \\ fgraph ` TameEnum\\<^bsub>p\\<^esub> \\\\<^sub>\\ set arch\"\napply(subgoal_tac \"\\t. tameEnumFilter p = Some t \\ set_tries t \\\\<^sub>\\ set arch\")\n apply(metis TameEnum_tameEnumFilter qle_gr.seteq_qle_def qle_gr.subseteq_qle_trans)\napply(fastforce intro!: samet_imp_iso_subseteq\n dest: inv_tries_tameEnumFilter tameEnumFilter_subseteq_TameEnum mgp_TameEnum mgp_pre_iso_test)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Flyspeck-Tame/ArchCompProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.27034039009353517}} {"text": "(* Title: JinjaThreads/Framework/FWLock.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{All about a managing a single lock} *}\n\ntheory FWLock\nimports\n FWState\nbegin\n\nfun has_locks :: \"'t lock \\ 't \\ nat\" where\n \"has_locks None t = 0\"\n| \"has_locks \\(t', n)\\ t = (if t = t' then Suc n else 0)\"\n\nlemma has_locks_iff: \n \"has_locks l t = n \\\n (l = None \\ n = 0) \\ \n (\\n'. l = \\(t, n')\\ \\ Suc n' = n) \\ (\\t' n'. l = \\(t', n')\\ \\ t' \\ t \\ n = 0)\"\nby(cases l, auto)\n\nlemma has_locksE:\n \"\\ has_locks l t = n;\n \\ l = None; n = 0 \\ \\ P;\n \\n'. \\ l = \\(t, n')\\; Suc n' = n \\ \\ P;\n \\t' n'. \\ l = \\(t', n')\\; t' \\ t; n = 0 \\ \\ P \\\n \\ P\"\nby(auto simp add: has_locks_iff split: split_if_asm prod.split_asm)\n\n\ninductive may_lock :: \"'t lock \\ 't \\ bool\" where\n \"may_lock None t\"\n| \"may_lock \\(t, n)\\ t\"\n\nlemma may_lock_iff [code]:\n \"may_lock l t = (case l of None \\ True | \\(t', n)\\ \\ t = t')\"\nby(auto intro: may_lock.intros elim: may_lock.cases)\n\nlemma may_lockI:\n \"l = None \\ (\\n. l = \\(t, n)\\) \\ may_lock l t\"\nby(cases l, auto intro: may_lock.intros)\n\nlemma may_lockE [consumes 1, case_names None Locked]:\n \"\\ may_lock l t; l = None \\ P; \\n. l = \\(t, n)\\ \\ P \\ \\ P\"\nby(auto elim: may_lock.cases)\n\nlemma may_lock_may_lock_t_eq:\n \"\\ may_lock l t; may_lock l t' \\ \\ (l = None) \\ (t = t')\"\nby(auto elim!: may_lockE)\n\nabbreviation has_lock :: \"'t lock \\ 't \\ bool\"\nwhere \"has_lock l t \\ 0 < has_locks l t\"\n\nlemma has_locks_Suc_has_lock:\n \"has_locks l t = Suc n \\ has_lock l t\"\nby(auto)\n\nlemmas has_lock_has_locks_Suc = gr0_implies_Suc[where n = \"has_locks l t\"]\n\nlemma has_lock_has_locks_conv:\n \"has_lock l t \\ (\\n. has_locks l t = (Suc n))\"\nby(auto intro: has_locks_Suc_has_lock has_lock_has_locks_Suc)\n\n\n\nlemma has_lock_may_lock_t_eq:\n \"\\ has_lock l t; may_lock l t' \\ \\ t = t'\"\nby(auto elim!: may_lockE split: split_if_asm)\n\nlemma has_locks_has_locks_t_eq: \n \"\\has_locks l t = Suc n; has_locks l t' = Suc n'\\ \\ t = t'\"\nby(auto elim: has_locksE)\n\nlemma has_lock_has_lock_t_eq:\n \"\\ has_lock l t; has_lock l t' \\ \\ t = t'\"\nunfolding has_lock_has_locks_conv\nby(auto intro: has_locks_has_locks_t_eq)\n\nlemma not_may_lock_conv:\n \"\\ may_lock l t \\ (\\t'. t' \\ t \\ has_lock l t')\"\nby(cases l, auto intro: may_lock.intros elim: may_lockE)\n\n\n\n(* State update functions for locking *)\n\nfun lock_lock :: \"'t lock \\ 't \\ 't lock\" where\n \"lock_lock None t = \\(t, 0)\\\"\n| \"lock_lock \\(t', n)\\ t = \\(t', Suc n)\\\"\n\nfun unlock_lock :: \"'t lock \\ 't lock\" where\n \"unlock_lock None = None\"\n| \"unlock_lock \\(t, n)\\ = (case n of 0 \\ None | Suc n' \\ \\(t, n')\\)\"\n\nfun release_all :: \"'t lock \\ 't \\ 't lock\" where\n \"release_all None t = None\"\n| \"release_all \\(t', n)\\ t = (if t = t' then None else \\(t', n)\\)\"\n\nfun acquire_locks :: \"'t lock \\ 't \\ nat \\ 't lock\" where\n \"acquire_locks L t 0 = L\"\n| \"acquire_locks L t (Suc m) = acquire_locks (lock_lock L t) t m\"\n\nlemma acquire_locks_conv:\n \"acquire_locks L t n = (case L of None \\ (case n of 0 \\ None | Suc m \\ \\(t, m)\\) | \\(t', m)\\ \\ \\(t', n + m)\\)\"\nby(induct n arbitrary: L)(auto)\n\nlemma lock_lock_ls_Some:\n \"\\t' n. lock_lock l t = \\(t', n)\\\"\nby(cases l, auto)\n\nlemma unlock_lock_SomeD:\n \"unlock_lock l = \\(t', n)\\ \\ l = \\(t', Suc n)\\\"\nby(cases l, auto split: nat.split_asm)\n\nlemma has_locks_Suc_lock_lock_has_locks_Suc_Suc:\n \"has_locks l t = Suc n \\ has_locks (lock_lock l t) t = Suc (Suc n)\"\nby(auto elim!: has_locksE)\n\nlemma has_locks_lock_lock_conv [simp]:\n \"may_lock l t \\ has_locks (lock_lock l t) t = Suc (has_locks l t)\"\nby(auto elim: may_lockE)\n\nlemma has_locks_release_all_conv [simp]:\n \"has_locks (release_all l t) t = 0\"\nby(cases l, auto split: split_if_asm)\n\nlemma may_lock_lock_lock_conv [simp]: \"may_lock (lock_lock l t) t = may_lock l t\"\nby(cases l, auto elim!: may_lock.cases intro: may_lock.intros)\n\nlemma has_locks_acquire_locks_conv [simp]:\n \"may_lock l t \\ has_locks (acquire_locks l t n) t = has_locks l t + n\"\nby(induct n arbitrary: l, auto)\n\nlemma may_lock_unlock_lock_conv [simp]:\n \"has_lock l t \\ may_lock (unlock_lock l) t = may_lock l t\"\nby(cases l)(auto split: split_if_asm nat.splits elim!: may_lock.cases intro: may_lock.intros)\n\nlemma may_lock_release_all_conv [simp]:\n \"may_lock (release_all l t) t = may_lock l t\"\nby(cases l, auto split: split_if_asm intro!: may_lockI elim: may_lockE)\n\nlemma may_lock_t_may_lock_unlock_lock_t: \n \"may_lock l t \\ may_lock (unlock_lock l) t\"\nby(auto intro: may_lock.intros elim!: may_lockE split: nat.split)\n\n\nlemma may_lock_has_locks_lock_lock_0: \n \"\\may_lock l t'; t \\ t'\\ \\ has_locks (lock_lock l t') t = 0\"\nby(auto elim!: may_lock.cases)\n\n\n\nlemma has_lock_lock_lock_unlock_lock_id [simp]:\n \"has_lock l t \\ lock_lock (unlock_lock l) t = l\"\nby(cases l)(auto split: split_if_asm nat.split)\n\nlemma may_lock_unlock_lock_lock_lock_id [simp]:\n \"may_lock l t \\ unlock_lock (lock_lock l t) = l\"\nby(cases l) auto\n\n\nlemma may_lock_has_locks_0:\n \"\\ may_lock l t; t \\ t' \\ \\ has_locks l t' = 0\"\nby(auto elim!: may_lockE)\n\n\nfun upd_lock :: \"'t lock \\ 't \\ lock_action \\ 't lock\"\nwhere\n \"upd_lock l t Lock = lock_lock l t\"\n| \"upd_lock l t Unlock = unlock_lock l\"\n| \"upd_lock l t UnlockFail = l\"\n| \"upd_lock l t ReleaseAquire = release_all l t\"\n\nfun upd_locks :: \"'t lock \\ 't \\ lock_action list \\ 't lock\"\nwhere\n \"upd_locks l t [] = l\"\n| \"upd_locks l t (L # Ls) = upd_locks (upd_lock l t L) t Ls\"\n\nlemma upd_locks_append [simp]:\n \"upd_locks l t (Ls @ Ls') = upd_locks (upd_locks l t Ls) t Ls'\"\nby(induct Ls arbitrary: l, auto)\n\nlemma upd_lock_Some_thread_idD:\n assumes ul: \"upd_lock l t L = \\(t', n)\\\"\n and tt': \"t \\ t'\"\n shows \"\\n. l = \\(t', n)\\\"\nproof(cases L)\n case Lock\n with ul tt' show ?thesis\n by(cases l, auto)\nnext\n case Unlock\n with ul tt' show ?thesis\n by(auto dest: unlock_lock_SomeD)\nnext\n case UnlockFail\n with ul show ?thesis by(simp)\nnext\n case ReleaseAcquire\n with ul show ?thesis\n by(cases l, auto split: split_if_asm)\nqed\n\n\nlemma has_lock_upd_lock_implies_has_lock:\n \"\\ has_lock (upd_lock l t L) t'; t \\ t' \\ \\ has_lock l t'\"\nby(cases l L rule: option.exhaust[case_product lock_action.exhaust])(auto split: split_if_asm nat.split_asm)\n\nlemma has_lock_upd_locks_implies_has_lock:\n \"\\ has_lock (upd_locks l t Ls) t'; t \\ t' \\ \\ has_lock l t'\"\nby(induct l t Ls rule: upd_locks.induct)(auto intro: has_lock_upd_lock_implies_has_lock)\n\n(* Preconditions for lock actions *)\n\nfun lock_action_ok :: \"'t lock \\ 't \\ lock_action \\ bool\" where\n \"lock_action_ok l t Lock = may_lock l t\"\n| \"lock_action_ok l t Unlock = has_lock l t\"\n| \"lock_action_ok l t UnlockFail = (\\ has_lock l t)\"\n| \"lock_action_ok l t ReleaseAcquire = True\"\n\nfun lock_actions_ok :: \"'t lock \\ 't \\ lock_action list \\ bool\" where\n \"lock_actions_ok l t [] = True\"\n| \"lock_actions_ok l t (L # Ls) = (lock_action_ok l t L \\ lock_actions_ok (upd_lock l t L) t Ls)\"\n\nlemma lock_actions_ok_append [simp]:\n \"lock_actions_ok l t (Ls @ Ls') \\ lock_actions_ok l t Ls \\ lock_actions_ok (upd_locks l t Ls) t Ls'\"\nby(induct Ls arbitrary: l) auto\n\nlemma not_lock_action_okE [consumes 1, case_names Lock Unlock UnlockFail]:\n \"\\ \\ lock_action_ok l t L;\n \\ L = Lock; \\ may_lock l t \\ \\ Q;\n \\ L = Unlock; \\ has_lock l t \\ \\ Q;\n \\ L = UnlockFail; has_lock l t \\ \\ Q\\\n \\ Q\"\nby(cases L) auto\n\nlemma may_lock_upd_lock_conv [simp]:\n \"lock_action_ok l t L \\ may_lock (upd_lock l t L) t = may_lock l t\"\nby(cases L) auto\n\nlemma may_lock_upd_locks_conv [simp]:\n \"lock_actions_ok l t Ls \\ may_lock (upd_locks l t Ls) t = may_lock l t\"\nby(induct l t Ls rule: upd_locks.induct) simp_all\n\nlemma lock_actions_ok_Lock_may_lock:\n \"\\ lock_actions_ok l t Ls; Lock \\ set Ls \\ \\ may_lock l t\"\nby(induct l t Ls rule: lock_actions_ok.induct) auto\n\nlemma has_locks_lock_lock_conv' [simp]:\n \"\\ may_lock l t'; t \\ t' \\ \\ has_locks (lock_lock l t') t = has_locks l t\"\nby(cases l)(auto elim: may_lock.cases)\n\nlemma has_locks_unlock_lock_conv' [simp]:\n \"\\ has_lock l t'; t \\ t' \\ \\ has_locks (unlock_lock l) t = has_locks l t\"\nby(cases l)(auto split: split_if_asm nat.split)\n\nlemma has_locks_release_all_conv' [simp]:\n \"t \\ t' \\ has_locks (release_all l t') t = has_locks l t\"\nby(cases l) auto\n\nlemma has_locks_acquire_locks_conv' [simp]:\n \"\\ may_lock l t; t \\ t' \\ \\ has_locks (acquire_locks l t n) t' = has_locks l t'\"\nby(induct l t n rule: acquire_locks.induct) simp_all\n\nlemma lock_action_ok_has_locks_upd_lock_eq_has_locks [simp]:\n \"\\ lock_action_ok l t' L; t \\ t' \\ \\ has_locks (upd_lock l t' L) t = has_locks l t\"\nby(cases L) auto\n\nlemma lock_actions_ok_has_locks_upd_locks_eq_has_locks [simp]:\n \"\\ lock_actions_ok l t' Ls; t \\ t' \\ \\ has_locks (upd_locks l t' Ls) t = has_locks l t\"\nby(induct l t' Ls rule: upd_locks.induct) simp_all\n\nlemma has_lock_acquire_locks_implies_has_lock:\n \"\\ has_lock (acquire_locks l t n) t'; t \\ t' \\ \\ has_lock l t'\"\n unfolding acquire_locks_conv\n by(cases n)(auto split: split_if_asm)\n\nlemma has_lock_has_lock_acquire_locks:\n \"has_lock l T \\ has_lock (acquire_locks l t n) T\"\n unfolding acquire_locks_conv\n by(auto)\n\n\nfun lock_actions_ok' :: \"'t lock \\ 't \\ lock_action list \\ bool\" where\n \"lock_actions_ok' l t [] = True\"\n| \"lock_actions_ok' l t (L#Ls) = ((L = Lock \\ \\ may_lock l t) \\\n lock_action_ok l t L \\ lock_actions_ok' (upd_lock l t L) t Ls)\"\n\nlemma lock_actions_ok'_iff:\n \"lock_actions_ok' l t las \\ \n lock_actions_ok l t las \\ (\\xs ys. las = xs @ Lock # ys \\ lock_actions_ok l t xs \\ \\ may_lock (upd_locks l t xs) t)\"\nproof(induct l t las rule: lock_actions_ok.induct)\n case (2 L t LA LAS)\n show ?case\n proof(cases \"LA = Lock \\ \\ may_lock L t\")\n case True\n hence \"(\\ys. Lock # LAS = [] @ Lock # ys) \\ lock_actions_ok L t [] \\ \\ may_lock (upd_locks L t []) t\"\n by(simp)\n with True show ?thesis by(simp (no_asm))(blast)\n next\n case False\n with 2 show ?thesis\n by(fastforce simp add: Cons_eq_append_conv elim: allE[where x=\"LA # xs\" for xs])\n qed\nqed simp\n\nlemma lock_actions_ok'E[consumes 1, case_names ok Lock]:\n \"\\ lock_actions_ok' l t las;\n lock_actions_ok l t las \\ P;\n \\xs ys. \\ las = xs @ Lock # ys; lock_actions_ok l t xs; \\ may_lock (upd_locks l t xs) t \\ \\ P \\ \n \\ P\"\nby(auto simp add: lock_actions_ok'_iff)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Framework/FWLock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.2702487202847485}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\n(* Title: Confinement_S\n * Description: confinement proof of the security model\n *)\n\ntheory Confine_S\nimports System_S\nbegin\n\n(* These translate Create into all_rights *)\ndefinition\n extra_rights :: \"cap \\ cap\" where\n \"extra_rights c \\\n if (Create \\ rights c)\n then c\\rights := all_rights\\\n else c\"\n\n\nlemma extra_rights_idem [simp]:\n \"(extra_rights (extra_rights c)) = (extra_rights c)\"\n apply (clarsimp simp add: extra_rights_def)\n done\n\nlemma extra_rights_image_idem [simp]:\n \"(extra_rights ` (extra_rights ` S)) = (extra_rights ` S)\"\n by (rule set_eqI) (simp add: image_iff)\n\nlemma extra_rights_empty_rights_ident [simp]:\n \"extra_rights \\ target = e, rights = {} \\ = \\ target = e, rights = {} \\\"\n by (simp add: extra_rights_def)\n\nlemma entity_extra_rights [simp]:\n \"target (extra_rights c) = target c\"\n by (simp add: extra_rights_def)\n\nlemma rights_extra_rights:\n \"rights (extra_rights c) =\n (if Create \\ (rights c)\n then all_rights\n else rights c)\"\n by (simp add: extra_rights_def)\n\n(* The following two definitions both translate Create into all_rights *)\n\n(* A cap is in a set, or a cap with more access is. *)\ndefinition\n cap_in_caps :: \"cap \\ cap set \\ bool\" (infix \"\\cap\" 50) where\n \"c \\cap C \\ \\c' \\ C. target c = target c' \\ rights (extra_rights c) \\ rights (extra_rights c')\"\n\nabbreviation not_cap_in_caps where\n \"not_cap_in_caps x A \\ ~ (x \\cap A)\" -- \"non-membership\"\n\nnotation (input) cap_in_caps (infix \":cap\" 50)\nnotation (latex output) cap_in_caps (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\nnotation\n not_cap_in_caps (\"op \\cap\") and\n not_cap_in_caps (\"(_/ \\cap _)\" [51, 51] 50)\n\nnotation (latex output)\n not_cap_in_caps (\"op \\\\<^sub>c\\<^sub>a\\<^sub>p\") and\n not_cap_in_caps (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\n(* A set of caps \"caps\" have less (or equal) access to an entity as \"cap\" does. *)\ndefinition\n caps_dominated_by :: \"cap set \\ cap \\ bool\" (infix \"\\cap\" 50) where\n \"caps \\cap cap \\ \\cap' \\ caps. target cap' = target cap \\ rights (extra_rights cap') \\ rights (extra_rights cap)\"\n\nnotation (input) caps_dominated_by (infix \"<=cap\" 50)\nnotation (latex output) caps_dominated_by (infix \"\\\\<^sub>c\\<^sub>a\\<^sub>p\" 50)\n\ndefinition\n shares_caps :: \"state \\ entity_id \\ entity_id \\ bool\" where\n \"shares_caps s e\\<^sub>x e\\<^sub>y \\ \\e\\<^sub>i . (e\\<^sub>x, e\\<^sub>i) \\ store_connected s \\ (e\\<^sub>y, e\\<^sub>i) \\ store_connected s\"\n\ndefinition\n leak :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\ _\") where\n \"leak s e\\<^sub>x e\\<^sub>y \\ take_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\ grant_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\ shares_caps s e\\<^sub>x e\\<^sub>y\"\n\n\ndefinition\n directly_tgs_connected :: \"state \\ (entity_id \\ entity_id) set\" where\n \"directly_tgs_connected s \\ {(e\\<^sub>x, e\\<^sub>y). leak s e\\<^sub>x e\\<^sub>y \\ leak s e\\<^sub>y e\\<^sub>x}\"\n\nlemma directly_tgs_connected_def2:\n \"(e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s = (leak s e\\<^sub>x e\\<^sub>y \\ leak s e\\<^sub>y e\\<^sub>x)\"\n by (simp add: directly_tgs_connected_def)\n\nabbreviation\n in_directly_tgs_connected :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\ _\" [60,0,60] 61)\nwhere\n \"s \\ x \\ y \\ (x,y) \\ directly_tgs_connected s\"\n\ndefinition\n tgs_connected :: \"state \\ (entity_id \\ entity_id) set\" where\n \"tgs_connected s \\ (directly_tgs_connected s)\\<^sup>*\"\n\nabbreviation\n in_tgs_connected :: \"state \\ entity_id \\ entity_id \\ bool\" (\"_ \\ _ \\* _\" [60,0,60] 61)\nwhere\n \"s \\ x \\* y == (x,y) \\ tgs_connected s\"\n\nnotation (latex output)\n in_tgs_connected (\"_ \\ _ \\\\<^sup>* _\" [60,0,60] 61)\n\ntranslations\n \"\\ (s \\ x \\ y)\" <= \"(x,y) \\ CONST directly_tgs_connected s\"\n \"\\ (s \\ x \\* y)\" <= \"(x,y) \\ CONST tgs_connected s\"\n\nlemma shares_caps_sym [simp]:\n \"shares_caps s y x = shares_caps s x y\"\n by (auto simp: shares_caps_def)\n\nlemma directly_tgs_connected_def4:\n \"s \\ e\\<^sub>x \\ e\\<^sub>y = (take_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\ take_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\\n grant_cap e\\<^sub>y \\cap caps_of s e\\<^sub>x \\ grant_cap e\\<^sub>x \\cap caps_of s e\\<^sub>y \\\n shares_caps s e\\<^sub>x e\\<^sub>y)\"\n by (auto simp: directly_tgs_connected_def leak_def)\n\n(* Note: e\\<^sub>0 is unused. *)\ndefinition\n generalOperation ::\n \"entity_id \\ entity_id \\ cap \\ right set \\ modify_state\" where\n \"generalOperation e\\<^sub>0 e\\<^sub>1 c r s \\\n s (e\\<^sub>1 \\ Entity ( insert (diminish r (extra_rights c)) (direct_caps_of s e\\<^sub>1) ))\"\n\nlemma is_entity_general [simp]:\n \"is_entity s e\\<^sub>1 \\ is_entity (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) e' = is_entity s e'\"\n by (simp add: is_entity_def generalOperation_def)\n\ndefinition\n make_entity :: \"entity_id \\ modify_state\" where\n \"make_entity n s \\\n s (n \\ null_entity)\"\n\nlemma direct_caps_of_store_connected_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e\n \\ store_connected s = store_connected s'\"\n by (simp add: store_connected_def store_connected_direct_def\n direct_caps_of_def)\n\nlemma direct_caps_of_caps_of_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e \\ caps_of s e = caps_of s' e\"\n by (simp add: caps_of_def store_connected_def store_connected_direct_def\n direct_caps_of_def)\n\nlemma direct_caps_of_caps_of_eq2:\n \"\\\\ e. direct_caps_of s e = direct_caps_of s' e; c \\cap caps_of s e\\ \\ c \\cap caps_of s' e\"\n apply (drule direct_caps_of_caps_of_eq)\n apply (simp add: cap_in_caps_def)\n by auto\n\nlemma direct_caps_of_directly_tgs_connected_eq:\n \"\\ e. direct_caps_of s e = direct_caps_of s' e \\ s \\ x \\ y = s' \\ x \\ y\"\n apply (simp add: directly_tgs_connected_def4 shares_caps_def)\n apply rule\n apply (erule disjE, drule (1) direct_caps_of_caps_of_eq2, clarsimp)+\n apply (drule direct_caps_of_store_connected_eq, clarsimp)\n apply (erule disjE, drule direct_caps_of_caps_of_eq2 [rotated, where s=s' and s'=s], simp+)+\n apply (drule direct_caps_of_store_connected_eq, simp)\n done\n\nlemma direct_caps_of_make_entity:\n \"\\ is_entity s n \\ direct_caps_of (make_entity n s) e = direct_caps_of s e\"\n by (simp add: direct_caps_of_def make_entity_def is_entity_def\n null_entity_def)\n\nlemma caps_of_make_entity:\n \"\\ is_entity s n \\ caps_of (make_entity n s) e = caps_of s e\"\n apply (rule direct_caps_of_caps_of_eq)\n apply clarsimp\n apply (erule direct_caps_of_make_entity)\n done\n\nlemma caps_of_make_entity2:\n \"\\\\ is_entity s n; c \\ caps_of (make_entity n s) e\\ \\ c \\ caps_of s e\"\n apply (drule caps_of_make_entity)\n apply fastforce\n done\n\nlemma directly_tgs_connected_make_entity:\n \"\\ is_entity s n \\ make_entity n s \\ x \\ y = s \\ x \\ y\"\n apply (rule direct_caps_of_directly_tgs_connected_eq)\n apply clarsimp\n apply (drule (1) direct_caps_of_make_entity)\n done\n\nlemma directly_tgs_connected_make_entity2:\n \"\\\\ is_entity s n; make_entity n s \\ x \\ y\\ \\ s \\ x \\ y\"\n apply (drule directly_tgs_connected_make_entity)\n apply fastforce\n done\n\nlemma diminish_extra_rights [simp]:\n \"diminish (rights c) (extra_rights c) = c\"\n by (simp add: diminish_def all_rights_def rights_extra_rights)\n\nlemma diminish_extra_rights2 [simp]:\n \"diminish (r \\ rights c) (extra_rights c) = diminish r c\"\n apply (simp add: diminish_def extra_rights_def all_rights_def)\n apply (simp add: Int_commute)\n apply (subgoal_tac \"rights c \\ (r \\ rights c) = r \\ rights c\")\n apply simp\n apply fastforce\n done\n\nlemma create_general_helper:\n \"Create \\ rights c\\<^sub>2 \\\n \\target = target c\\<^sub>2, rights = UNIV\\ = c\\<^sub>2\\rights := UNIV\\\"\n by auto\n\nlemma extra_rights_full_cap [simp]:\n \"extra_rights (full_cap e) = full_cap e\"\n by (simp add: extra_rights_def)\n\nlemma create_general_alt:\n \"createOperation e c\\<^sub>1 c\\<^sub>2 s =\n make_entity (target c\\<^sub>2)\n (generalOperation e (target c\\<^sub>1) (full_cap (target c\\<^sub>2)) (all_rights) s)\"\n by (simp add: createOperation_def generalOperation_def make_entity_def)\n\nlemma create_general:\n \"Create \\ rights c\\<^sub>2 \\ createOperation e c\\<^sub>1 c\\<^sub>2 s =\n make_entity (target c\\<^sub>2)\n (generalOperation e (target c\\<^sub>1) c\\<^sub>2 (all_rights) s)\"\n by (simp add: createOperation_def generalOperation_def make_entity_def\n full_cap_def all_rights_def diminish_def\n extra_rights_def create_general_helper null_entity_def)\n\nlemma take_general:\n \"takeOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation (target c\\<^sub>1) e c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: takeOperation_def generalOperation_def)\n\nlemma grant_general:\n \"grantOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation e (target c\\<^sub>1) c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: grantOperation_def generalOperation_def)\n\nlemma copy_general:\n \"copyOperation e c\\<^sub>1 c\\<^sub>2 r s =\n generalOperation e (target c\\<^sub>1) c\\<^sub>2 (r \\ rights c\\<^sub>2) s\"\n by (simp add: copyOperation_def generalOperation_def)\n\n(* Lemmas on the directly_tgs_connected predicate *)\nlemma directly_tgs_connected_comm:\n \"s \\ x \\ y \\ s \\ y \\ x\"\n by(auto simp: directly_tgs_connected_def)\n\nlemma tgs_connected_refl [simp]:\n \"s \\ x \\* x\"\n by (metis tgs_connected_def rtrancl.rtrancl_refl)\n\nlemma tgs_connected_comm:\n \"s \\ x \\* y \\ s \\ y \\* x\"\n apply(simp add: tgs_connected_def)\n apply(erule rtrancl_induct, simp)\n apply(case_tac \"s \\ z \\ y\")\n apply(simp add: directly_tgs_connected_comm)\n apply(simp add: directly_tgs_connected_comm)\n done\n\nlemma tgs_connected_comm_eq:\n \"s \\ x \\* y = s \\ y \\* x\"\n by (metis tgs_connected_comm)\n\nlemmas tgs_connected_trans =\n rtrancl_trans [where r=\"directly_tgs_connected s\", simplified tgs_connected_def[symmetric]]\n\nlemmas directly_tgs_connected_rtrancl_into_rtrancl =\n rtrancl_into_rtrancl [where r=\"directly_tgs_connected s\", simplified tgs_connected_def[symmetric]]\n\nlemma take_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Take \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def take_cap_def cap_in_caps_def extra_rights_def all_rights_def)\n\nlemma grant_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Grant \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def grant_cap_def cap_in_caps_def extra_rights_def all_rights_def)\n\nlemma create_caps_directly_tgs_connected:\n \"\\c \\ caps_of s e; Create \\ rights c\\ \\ s \\ e \\ target c\"\n by (auto simp: directly_tgs_connected_def leak_def cap_in_caps_def rights_extra_rights all_rights_def)\n\nlemma store_connected_directly_tgs_connected:\n \"(x, y) \\ store_connected s \\ s \\ x \\ y\"\n by (auto simp: directly_tgs_connected_def leak_def shares_caps_def store_connected_def)\n\n(* Lemmas on caps *)\n\nlemma cap_in_caps_insert [simp]:\n \"c \\cap insert c' S = (target c = target c' \\\n rights (extra_rights c) \\ rights (extra_rights c') \\ c \\cap S)\"\n by (simp add: cap_in_caps_def)\n\nlemma cap_in_caps_singleton [simp]:\n \"c \\cap {c'} = (target c = target c' \\ rights (extra_rights c) \\ rights (extra_rights c'))\"\n by (simp add: cap_in_caps_def)\n\nlemma not_in [simp]:\n \"{} \\cap c\"\n by(simp add: caps_dominated_by_def)\n\nlemma extra_rights_diminish:\n \"x \\ rights (extra_rights (diminish r c))\n \\ x \\ rights (extra_rights c)\"\n by (auto simp: rights_extra_rights all_rights_def split:if_split_asm)\n\n(* Lemmas on system operations *)\n\ndefinition\n in_store_connected :: \"state \\ entity_id \\ entity_id \\ bool\" where\n \"in_store_connected s x y \\ (x, y) \\ store_connected s\"\n\n(* Lemmas about the general operation *)\n\nlemma direct_caps_of_generalOp:\n \"direct_caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) e =\n (if e = e\\<^sub>1\n then insert (diminish r (extra_rights c)) (direct_caps_of s (e\\<^sub>1))\n else direct_caps_of s e)\"\n by (clarsimp simp: generalOperation_def direct_caps_of_def split:option.splits)\n\nlemma direct_caps_of_generalOp2:\n \"\\c' \\ direct_caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x\\ \\\n c' \\ direct_caps_of s x \\ (c' \\cap {c} \\ x = e\\<^sub>1)\"\n apply (clarsimp simp: direct_caps_of_generalOp extra_rights_diminish\n split:if_split_asm)\n apply (drule extra_rights_diminish)\n by simp\n\nlemma store_connected_direct_generalOp:\n \"\\(x, y) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s)\\ \\\n (x, y) \\ store_connected_direct s \\\n (x = e\\<^sub>1 \\ y = target c \\ Store \\ rights (extra_rights c))\"\n by (auto simp: store_connected_direct_def direct_caps_of_generalOp all_rights_def\n split: if_split_asm)\n\nlemma store_connected_generalOp:\n \"\\(x, y) \\ store_connected (generalOperation e\\<^sub>0 e\\<^sub>1 c r s)\\ \\\n (x, y) \\ store_connected s \\\n ((x, e\\<^sub>1) \\ store_connected s \\\n (e\\<^sub>1, target c) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) \\\n (target c, y) \\ store_connected s)\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply clarsimp\n apply (clarsimp)\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y, z) \\ store_connected_direct s\")\n apply (clarsimp simp: store_connected_def)\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (erule notE)\n apply fastforce\n apply (frule store_connected_direct_generalOp)\n apply (clarsimp simp: store_connected_def)\n done\n\n\nlemma store_connected_generalOp_not_new:\n \"\\(e\\<^sub>1, target c) \\ store_connected_direct (generalOperation e\\<^sub>0 e\\<^sub>1 c r s);\n c \\ caps_of s e\\<^sub>0\\ \\\n (e\\<^sub>1, target c) \\ store_connected_direct s \\\n (e\\<^sub>0, target c) \\ store_connected s \\\n Create \\ rights c\"\n apply (drule store_connected_direct_generalOp)\n apply (clarsimp simp: rights_extra_rights split:if_split_asm)\n apply (drule (1) store_caps_store_connected, simp)\n done\n\nlemma store_connected_generalOp2:\n \"\\(x, y) \\ store_connected (generalOperation e\\<^sub>0 e\\<^sub>1 c r s);\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\ \\\n s \\ x \\* y\"\n apply (drule store_connected_generalOp)\n apply (erule disjE)\n apply (simp add: tgs_connected_def)\n apply (drule store_connected_directly_tgs_connected, simp)\n apply clarsimp\n apply (drule store_connected_directly_tgs_connected [where x=x and y=e\\<^sub>1])\n apply (drule store_connected_directly_tgs_connected [where x=\"target c\" and y=y])\n apply (drule (1) store_connected_generalOp_not_new)\n apply (erule disjE)\n apply (drule store_connected_direct_in_store_connected)\n apply (drule store_connected_directly_tgs_connected [where x=e\\<^sub>1 and y=\"target c\"])\n apply (simp add: tgs_connected_def)\n apply (drule directly_tgs_connected_comm [where x=\"e\\<^sub>0\" and y=\"e\\<^sub>1\"])\n apply (erule disjE)\n apply (drule store_connected_directly_tgs_connected [where x=e\\<^sub>0 and y=\"target c\"])\n apply (simp add: tgs_connected_def)\n apply (drule (1) create_caps_directly_tgs_connected)\n apply (simp add: tgs_connected_def)\n done\n\nlemma shares_caps_of_generalOp:\n \"\\shares_caps (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x y;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ s \\ x \\* y\"\n apply (clarsimp simp: shares_caps_def)\n apply (frule (2) store_connected_generalOp2 [where x=x])\n apply (drule (2) store_connected_generalOp2 [where x=y])\n apply (drule tgs_connected_comm [where x=y])\n apply (simp add: tgs_connected_def)\n done\n\nlemma caps_of_generalOp:\n \"\\c' \\ caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (simp add: caps_of_def[where e=x])\n apply clarsimp\n apply (frule (2) store_connected_generalOp2)\n apply (drule direct_caps_of_generalOp2)\n apply (erule disjE)\n apply (drule direct_cap_in_cap)\n apply (fastforce simp: cap_in_caps_def)\n apply (subgoal_tac \"s \\ x \\* e\\<^sub>0\")\n apply (subgoal_tac \"c' \\cap caps_of s e\\<^sub>0\")\n apply fastforce\n apply (fastforce simp: cap_in_caps_def)\n apply clarsimp\n apply (drule directly_tgs_connected_comm [where x=\"e\\<^sub>0\" and y=\"e\\<^sub>1\"])\n apply (simp add: tgs_connected_def)\n done\n\nlemma take_cap_generalOp:\n \"\\take_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. s \\ x \\* z \\ take_cap y \\cap caps_of s z\"\n apply (simp add: cap_in_caps_def)\n apply clarsimp\n apply (drule (2) caps_of_generalOp)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma grant_cap_generalOp:\n \"\\grant_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ \\z. s \\ x \\* z \\ grant_cap y \\cap caps_of s z\"\n apply (simp add: cap_in_caps_def)\n apply clarsimp\n apply (drule (2) caps_of_generalOp)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma take_cap_generalOp2:\n \"\\take_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ (x, y) \\ tgs_connected s\"\n apply (drule (2) take_cap_generalOp)\n apply clarsimp\n apply (subgoal_tac \"s \\ z \\ y\")\n apply (simp add: tgs_connected_def)\n apply (simp add: directly_tgs_connected_def leak_def)\n done\n\nlemma grant_cap_generalOp2:\n \"\\grant_cap y \\cap caps_of (generalOperation e\\<^sub>0 e\\<^sub>1 c r s) x;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ (x, y) \\ tgs_connected s\"\n apply (drule (2) grant_cap_generalOp)\n apply clarsimp\n apply (subgoal_tac \"s \\ z \\ y\")\n apply (simp add: tgs_connected_def)\n apply (simp add: directly_tgs_connected_def leak_def)\n done\n\nlemma generalOp_directly_tgs_connected:\n \"\\generalOperation e\\<^sub>0 e\\<^sub>1 c r s \\ x \\ y;\n c \\ caps_of s e\\<^sub>0; s \\ e\\<^sub>0 \\ e\\<^sub>1\\\n \\ s \\ x \\* y\"\n apply (simp add: directly_tgs_connected_def [where s=\"generalOperation e\\<^sub>0 e\\<^sub>1 c r s\"] leak_def)\n apply safe\n apply (rule tgs_connected_comm)\n apply (drule (3) take_cap_generalOp2)\n apply (drule (3) grant_cap_generalOp2)\n apply (erule (2) shares_caps_of_generalOp)\n apply (drule (3) take_cap_generalOp2)\n apply (rule tgs_connected_comm)\n apply (drule (3) grant_cap_generalOp2)\n apply (erule (2) shares_caps_of_generalOp)\n done\n\n\n\n(* results from general operation *)\n\nlemma create_legal_directly_tgs_connected:\n \"legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s \\ s \\ target c\\<^sub>1 \\ e\"\n apply clarsimp\n apply (rule directly_tgs_connected_comm)\n apply (drule (1) create_caps_directly_tgs_connected)\n apply (drule (1) store_caps_store_connected)\n apply (drule (1) store_connected_directly_tgs_connected)\n done\n\nlemma take_legal_directly_tgs_connected:\n \"legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ target c\\<^sub>1 \\ e\"\n apply clarsimp\n apply (rule directly_tgs_connected_comm)\n apply (drule (2) take_caps_directly_tgs_connected)\n done\n\nlemma grant_legal_directly_tgs_connected:\n \"legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ e \\ target c\\<^sub>1\"\n apply clarsimp\n apply (drule (2) grant_caps_directly_tgs_connected)\n done\n\nlemma copy_legal_directly_tgs_connected:\n \"legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s \\ s \\ e \\ target c\\<^sub>1\"\n apply clarsimp\n apply (drule (1) store_caps_store_connected)\n apply (drule (1) store_connected_directly_tgs_connected)\n done\n\nlemma caps_of_create:\n \"\\c' \\ caps_of (createOperation e c\\<^sub>1 c\\<^sub>2 s) x; legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule create_legal_directly_tgs_connected)\n apply (clarsimp simp: create_general)\n apply (drule caps_of_make_entity2 [rotated], clarsimp)\n apply (drule (1) caps_of_generalOp)\n apply (drule (2) directly_tgs_connected_comm)\n done\n\nlemma caps_of_take:\n \"\\c' \\ caps_of (takeOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule take_legal_directly_tgs_connected)\n apply (clarsimp simp: take_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma caps_of_grant:\n \"\\c' \\ caps_of (grantOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule grant_legal_directly_tgs_connected)\n apply (clarsimp simp: grant_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma caps_of_copy:\n \"\\c' \\ caps_of (copyOperation e c\\<^sub>1 c\\<^sub>2 r s) x; legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ \\z. (x,z) \\ tgs_connected s \\ c' \\cap caps_of s z\"\n apply (frule copy_legal_directly_tgs_connected)\n apply (clarsimp simp: copy_general)\n apply (drule (2) caps_of_generalOp)\n apply (drule (1) directly_tgs_connected_comm)\n done\n\nlemma create_directly_tgs_connected:\n \"\\createOperation e c\\<^sub>1 c\\<^sub>2 s \\ x \\ y; legal (SysCreate e c\\<^sub>1 c\\<^sub>2) s\\\n \\ s \\ x \\* y\"\n apply (frule create_legal_directly_tgs_connected)\n apply (clarsimp simp: create_general)\n apply (drule directly_tgs_connected_make_entity2 [rotated], clarsimp)\n apply (drule (1) generalOp_directly_tgs_connected)\n apply (drule (2) directly_tgs_connected_comm)\n done\n\nlemma take_directly_tgs_connected:\n \"\\takeOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysTake e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule take_legal_directly_tgs_connected)\n apply (clarsimp simp: take_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\nlemma grant_directly_tgs_connected:\n \"\\grantOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysGrant e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule grant_legal_directly_tgs_connected)\n apply (clarsimp simp: grant_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\nlemma copy_directly_tgs_connected:\n \"\\copyOperation e c\\<^sub>1 c\\<^sub>2 r s \\ x \\ y; legal (SysCopy e c\\<^sub>1 c\\<^sub>2 r) s\\\n \\ s \\ x \\* y\"\n apply (frule copy_legal_directly_tgs_connected)\n apply (clarsimp simp: copy_general)\n apply (drule (3) generalOp_directly_tgs_connected)\n done\n\n\n\nlemma create_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysCreate e c\\<^sub>1 c\\<^sub>2)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule create_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma take_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysTake e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule take_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma grant_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysGrant e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule grant_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\nlemma copy_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysCopy e c\\<^sub>1 c\\<^sub>2 r)\\\n \\ (x, y) \\ tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply (erule disjE, fastforce simp: tgs_connected_def, clarsimp)\n apply (drule copy_directly_tgs_connected, clarsimp, assumption)\n apply (simp add: tgs_connected_def)\n done\n\n(* Lemmas about destroy *)\n\nlemma direct_caps_of_destroy:\n \"c \\ direct_caps_of (s(e := None)) x \\ c \\ direct_caps_of s x\"\n by (simp add: direct_caps_of_def split: option.splits split: if_split_asm)\n\nlemma store_connected_destroy:\n \"(x, y) \\ store_connected (s(e := None)) \\ (x, y) \\ store_connected s\"\n apply (simp add: store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (fastforce simp: store_connected_def)\n apply (simp add: store_connected_direct_def)\n apply clarsimp\n by (metis direct_caps_of_destroy)\n\nlemma shares_caps_destroy:\n \"shares_caps (destroyOperation e c s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def destroyOperation_def)\n apply (frule store_connected_destroy [where x=x])\n apply (drule store_connected_destroy [where x=y])\n by auto\n\nlemma caps_of_destroy:\n \"c \\ caps_of (destroyOperation e' c' s) e \\\n c \\ caps_of s e\"\n apply (clarsimp simp add: destroyOperation_def caps_of_def)\n apply (rule_tac x=x in exI)\n apply (drule direct_caps_of_destroy)\n apply simp\n apply (erule store_connected_destroy)\n done\n\nlemma destroy_directly_tgs_connected:\n \"\\s' \\ step (SysDestroy e c) s; (x, y) \\ directly_tgs_connected s'\\ \\\n (x, y) \\ directly_tgs_connected s\"\n apply(clarsimp simp: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply (drule shares_caps_destroy, simp)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (erule disjE)\n apply(fastforce simp add: cap_in_caps_def dest!: caps_of_destroy)\n apply (drule shares_caps_destroy, simp)\n done\n\nlemma destroy_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysDestroy e c)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: destroy_directly_tgs_connected)\n\n\n(* lemmas about remove *)\n\nlemma direct_caps_of_remove:\n \"c \\ direct_caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\\n c \\ direct_caps_of s x\"\n by (clarsimp simp: removeOperation_simpler direct_caps_of_def\n split: option.splits if_split_asm)\n\nlemma direct_caps_of_remove_eq:\n \"direct_caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x =\n ( if is_entity s (target c\\<^sub>1) \\ x = target c\\<^sub>1\n then direct_caps_of s (target c\\<^sub>1) - {c\\<^sub>2}\n else direct_caps_of s x )\"\n by(simp add: direct_caps_of_def is_entity_def removeOperation_def)\n\nlemma store_connected_remove [rule_format]:\n \"(x, y) \\ store_connected (s(e \\ Entity C')) \\\n s e = Some (Entity C) \\ C' \\ C \\ (x, y) \\ store_connected s\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply clarsimp\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (erule rtrancl_trans)\n apply fastforce\n apply (fold store_connected_def)\n apply (clarsimp simp add: store_connected_direct_def)\n apply (fastforce simp: direct_caps_of_def\n split: option.splits if_split_asm)\n done\n\nlemma caps_of_remove:\n \"c \\ caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\\n c \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_remove)\n apply (simp add: removeOperation_simpler\n split: option.splits)\n apply (erule (1) store_connected_remove)\n apply blast\n done\n\n(* Might equal either \"caps s (target c\\<^sub>1) - {c\\<^sub>2}\" or \"caps s x\" depending if the caps are duplicated.*)\nlemma caps_of_remove2:\n \"caps_of (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x \\ caps_of s x\"\n apply(simp add: caps_of_def is_entity_def removeOperation_def direct_caps_of_def)\n apply (clarsimp split: if_split_asm)\n apply (auto dest!: store_connected_remove)\n done\n\nlemma shares_caps_remove:\n \"shares_caps (removeOperation e c\\<^sub>1 c\\<^sub>2 s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def removeOperation_simpler\n split:option.splits)\n apply (frule (1) store_connected_remove [where x=x], clarsimp)\n apply (drule (1) store_connected_remove [where x=y], clarsimp)\n by auto\n\nlemma remove_directly_tgs_connected:\n \"\\s' \\ step (SysRemove e c\\<^sub>1 c\\<^sub>2) s; (x, y) \\ directly_tgs_connected s'\\ \\\n (x, y) \\ directly_tgs_connected s\"\n apply(simp add: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply(simp add: cap_in_caps_def)\n apply(clarsimp)\n apply safe\n prefer 3\n apply (drule shares_caps_remove, simp)\n prefer 5\n apply (drule shares_caps_remove, simp)\n apply(auto dest!: caps_of_remove)\n done\n\nlemma remove_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysRemove e c\\<^sub>1 c\\<^sub>2)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: remove_directly_tgs_connected)\n\nlemma direct_caps_of_removeSet:\n \"c' \\ direct_caps_of (removeSetOperation e c C s) x \\\n c' \\ direct_caps_of s x\"\n by (clarsimp simp: removeSetOperation_simpler direct_caps_of_def\n split: option.splits if_split_asm)\n\nlemma caps_of_removeSet:\n \"c' \\ caps_of (removeSetOperation e c C s) x \\\n c' \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_removeSet)\n apply (simp add: removeSetOperation_simpler split: option.splits)\n apply (erule (1) store_connected_remove)\n apply blast\n done\n\nlemma shares_caps_removeSet:\n \"shares_caps (removeSetOperation e c C s) x y\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def removeSetOperation_simpler split:option.splits)\n apply (frule (1) store_connected_remove [where x=x], clarsimp)\n apply (drule (1) store_connected_remove [where x=y], clarsimp)\n by auto\n\nlemma removeSet_connected:\n \" \\s' \\ step (SysRemoveSet e c C) s; s' \\ x \\ y\\ \\ s \\ x \\ y\"\n apply(simp add: step_def split: if_split_asm)\n apply(erule disjE, simp)\n apply(simp add: directly_tgs_connected_def leak_def)\n apply(simp add: cap_in_caps_def)\n apply(clarsimp)\n apply safe\n prefer 3\n apply (drule shares_caps_removeSet, simp)\n prefer 5\n apply (drule shares_caps_removeSet, simp)\n apply (auto dest!: caps_of_removeSet)\n done\n\nlemma removeSet_conTrans:\n \"\\s' \\ step cmd s; s' \\ x \\ y; cmd = (SysRemoveSet n c C)\\\n \\ s \\ x \\ y\"\n by(auto dest!: removeSet_connected)\n\n(* lemmas about revoke *)\nlemma direct_caps_of_removeSetOfCaps:\n \"c' \\ direct_caps_of (removeSetOfCaps cap_map s) x \\\n c' \\ direct_caps_of s x\"\n by (clarsimp simp: removeSetOfCaps_def direct_caps_of_def\n split: option.splits if_split_asm)\nthm store_connected_remove\n\nlemma store_connected_removeSetOfCaps:\n \"(x, y) \\ store_connected (\\e. if is_entity s e\n then Some (Entity (direct_caps_of s e - cap_map e))\n else None) \\\n (x, y) \\ store_connected s\"\n apply (unfold store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (erule rtrancl_trans)\n apply fastforce\n apply (fold store_connected_def)\n apply (clarsimp simp add: store_connected_direct_def)\n apply (fastforce simp: direct_caps_of_def\n split: option.splits if_split_asm)\n done\n\nlemma caps_of_removeSetOfCaps:\n \"c' \\ caps_of (removeSetOfCaps cap_map s) x \\\n c' \\ caps_of s x\"\n apply (clarsimp simp: caps_of_def)\n apply (rule_tac x=xa in exI)\n apply (drule direct_caps_of_removeSetOfCaps)\n apply (simp add: removeSetOfCaps_def split: option.splits)\n apply (erule store_connected_removeSetOfCaps)\n done\n\nlemma caps_of_revoke:\n \"\\s' \\ revokeOperation sub c\\<^sub>1 s ; c \\ caps_of s' e \\\n \\ c \\ caps_of s e\"\n apply (clarsimp simp: revokeOperation_def\n split: if_split_asm)\n apply (drule (1) caps_of_removeSetOfCaps)\n done\n\nlemma direct_caps_of_revoke:\n \"\\s' \\ revokeOperation e c s; c' \\ direct_caps_of s' x\\\n \\ c' \\ direct_caps_of s x\"\n apply (clarsimp simp: revokeOperation_def\n split: if_split_asm)\n apply (drule (1) direct_caps_of_removeSetOfCaps)\n done\n\nlemma store_connected_revoke:\n \"\\(x, y) \\ store_connected s'; s' \\ revokeOperation e c s\\\n \\ (x, y) \\ store_connected s\"\n apply (simp add: store_connected_def)\n apply (erule rtrancl_induct)\n apply simp\n apply (fold store_connected_def)\n apply (subgoal_tac \"(y,z) \\ store_connected_direct s\")\n apply (fastforce simp: store_connected_def)\n apply (clarsimp simp: store_connected_direct_def)\n apply (metis direct_caps_of_revoke)\n done\n\nlemma shares_caps_revoke:\n \"\\shares_caps s' x y; s' \\ revokeOperation e c s\\\n \\ shares_caps s x y\"\n apply (clarsimp simp: shares_caps_def)\n apply (frule (1) store_connected_revoke [where x=x])\n apply (drule (1) store_connected_revoke [where x=y])\n by auto\n\nlemma removeOperation_entity_ids [simp]:\n \"is_entity (removeOperation e c c' s) e' = is_entity s e'\"\n by (simp add: is_entity_def removeOperation_def)\n\nlemma removeSetOfCaps_entity_ids [simp]:\n \"is_entity (removeSetOfCaps cap_map s) e' = is_entity s e'\"\n by (simp add: is_entity_def removeSetOfCaps_def)\n\nlemma revoke_entities:\n \"s' \\ revokeOperation sub c\\<^sub>1 s \\ is_entity s' e = is_entity s e\"\n by (clarsimp simp: revokeOperation_def split: if_split_asm)\n\nlemma revoke_directly_tgs_connected:\n \"\\s' \\ step (SysRevoke n c\\<^sub>1) s; (x, y) \\ directly_tgs_connected s'\\\n \\ (x, y) \\ directly_tgs_connected s\"\n apply (simp add: step_def split: if_split_asm)\n apply (erule disjE, simp)\n apply (simp add: directly_tgs_connected_def leak_def)\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply (drule (1) shares_caps_revoke, simp)\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (erule disjE)\n apply(auto simp add: cap_in_caps_def dest!: caps_of_revoke)[1]\n apply (drule (1) shares_caps_revoke, simp)\n done\n\nlemma revoke_conTrans:\n \"\\s' \\ step cmd s; (x, y) \\ directly_tgs_connected s'; cmd = (SysRevoke n c\\<^sub>1)\\\n \\ (x, y) \\ directly_tgs_connected s\"\n by(auto dest!: revoke_directly_tgs_connected)\n\n\n\n(* lemmas about grant *)\n\nlemma is_entity_grant [simp]:\n \"is_entity s (target c\\<^sub>1) \\\n is_entity (grantOperation e c\\<^sub>1 c\\<^sub>2 r s) e' = is_entity s e'\"\n by (simp add: is_entity_def grantOperation_def)\n\nlemma is_entity_destroy:\n \"is_entity (destroyOperation e' c s) e \\ is_entity s e\"\n by (simp add: destroyOperation_def is_entity_def split: if_split_asm)\n\n\n(********************************************\n ********************************************\n ***** Connected transitively preserved *****\n ********************************************\n ********************************************)\n\nlemma connected_tgs_connected:\n \"\\s' \\ step cmd s; (e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s'\\ \\\n (e\\<^sub>x, e\\<^sub>y) \\ tgs_connected s\"\n apply(case_tac \"(e\\<^sub>x, e\\<^sub>y) \\ directly_tgs_connected s\")\n apply(simp add: tgs_connected_def)\n apply(case_tac cmd)\n apply(rule create_conTrans, fastforce+)\n apply(rule take_conTrans, fastforce+)\n apply(rule grant_conTrans, fastforce+)\n apply(frule copy_conTrans, fastforce+)\n apply(frule remove_conTrans, fastforce+)\n apply(frule removeSet_conTrans, fastforce+)\n apply(frule revoke_conTrans, fastforce+)\n apply(frule destroy_conTrans, fastforce+)\n done\n\nlemma tgs_connected_preserved_step:\n \"\\s' \\ step cmd s; s' \\ x \\* z\\ \\ s \\ x \\* z\"\n thm rtrancl_induct [where r=\"directly_tgs_connected s'\" and a=x and b=z and P=\"\\z. (x, z) \\ (directly_tgs_connected s)\\<^sup>*\", simplified,\n simplified tgs_connected_def [symmetric]]\n apply(erule rtrancl_induct [where r=\"directly_tgs_connected s'\",\n simplified tgs_connected_def [symmetric]], simp)\n apply(case_tac \"s \\ y \\* z\")\n apply (erule (1) tgs_connected_trans)\n apply (simp add: connected_tgs_connected)\n done\n\nlemma leakImplyConnected:\n \"leak s\\<^sub>i e\\<^sub>x e\\<^sub>i \\ (e\\<^sub>x, e\\<^sub>i) \\ directly_tgs_connected s\\<^sub>i\"\n by(simp add: directly_tgs_connected_def)\n\nlemma leakImplyConnectedTrans:\n \"leak s\\<^sub>i e\\<^sub>x e\\<^sub>i \\ (e\\<^sub>x, e\\<^sub>i) \\ tgs_connected s\\<^sub>i\"\n by(simp add: tgs_connected_def, frule leakImplyConnected, auto)\n\n\nlemma tgs_connected_preserved [rule_format]:\n \"\\s'. s' \\ execute cmds s \\\n s' \\ x \\* y \\\n s \\ x \\* y\"\n apply(induct_tac cmds, simp)\n apply clarsimp\n apply(rename_tac cmd cmds s'' s')\n apply(erule_tac x=s' in allE)\n apply(simp add: tgs_connected_preserved_step)\n done\n\nlemma leak_conTrans [rule_format]:\n \"\\s \\ execute cmds s\\<^sub>0; leak s x y\\\n \\ (x, y) \\ tgs_connected s\\<^sub>0\"\n by (auto intro: leakImplyConnectedTrans tgs_connected_preserved)\n\nlemma leakage_rule:\n \"\\s' \\ execute cmds s; \\ s \\ x \\* y\\ \\ \\ (s' \\ x \\ y)\"\n by(auto simp add: leak_conTrans)\n\n\n\n\n(*******************************************\n *******************************************\n ***** Authority confinement *****\n *******************************************\n *******************************************)\n\nlemma caps_of_op:\n \"\\s' \\ step cmd s; c' \\ caps_of s' x\\\n \\ \\z. s \\ x \\* z \\ c' \\cap caps_of s z\"\n apply (simp add: step_def split:if_split_asm)\n prefer 2\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (erule disjE)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (case_tac cmd)\n apply (simp add: caps_of_create)\n apply (simp add: caps_of_take)\n apply (simp add: caps_of_grant)\n apply (simp add: caps_of_copy)\n apply (clarsimp, drule caps_of_remove)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule caps_of_removeSet)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule (1) caps_of_revoke)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n apply (clarsimp, drule caps_of_destroy)\n apply (fastforce simp: cap_in_caps_def tgs_connected_def rights_extra_rights)\n done\n\nlemma authority_confinement_induct_step:\n \"\\s' \\ step cmd s;\n \\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c\\\n \\ caps_of s' e\\<^sub>x \\cap c\"\n apply (clarsimp simp: caps_dominated_by_def)\n apply (drule (1) caps_of_op)\n apply (fastforce simp: cap_in_caps_def)\n done\n\nlemma authority_confinement_helper:\n \"s' \\ execute cmds s \\\n (\\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c) \\\n (\\e\\<^sub>i. s' \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s' e\\<^sub>i \\cap c)\"\nproof (induct cmds arbitrary: s')\ncase Nil\n show ?case by clarsimp\nnext\ncase (Cons cmd cmds s')\nshow ?case\n apply clarsimp\n apply (rule authority_confinement_induct_step, assumption)\n apply clarsimp\n apply (rule Cons.hyps[rule_format], simp_all)\n apply (drule(1) tgs_connected_preserved_step)\n apply (simp add: tgs_connected_def)\n done\nqed\n\nlemma authority_confinement:\n \"\\s' \\ execute cmds s;\n \\e\\<^sub>i. s \\ e\\<^sub>x \\* e\\<^sub>i \\ caps_of s e\\<^sub>i \\cap c\\\n \\ caps_of s' e\\<^sub>x \\cap c\"\n by (erule authority_confinement_helper [rule_format, where e\\<^sub>x=e\\<^sub>x], simp_all)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/spec/take-grant/Confine_S.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646140788307, "lm_q2_score": 0.399811640739795, "lm_q1q2_score": 0.2701785591087517}} {"text": "theory proof_state_facts\nimports program_proof_rules_loops\nbegin\n\n\nlemma ps_wellFormed_to_wf:\n assumes wf: \"proof_state_wellFormed S\"\n obtains CS where \"proof_state_rel S CS\" and \"state_wellFormed CS\"\n using local.wf proof_state_rel_wf proof_state_wellFormed_def by blast\n\n\nlemma ps_wellFormed_state_causality:\n assumes wf: \"proof_state_wellFormed S\"\n shows \"causallyConsistent (happensBefore S) (ps_vis S)\"\n by (smt FieldI1 FieldI2 Un_iff causallyConsistent_def disjoint_iff_not_equal local.wf proof_state_rel_facts(1) proof_state_rel_hb proof_state_rel_vis proof_state_wellFormed_def proof_state_wellFormed_disjoint_happensBefore_localCalls updateHb_simp2 wf_vis_downwards_closed2)\n\n\nlemma ps_wellFormed_state_hb_trans:\n assumes wf: \"proof_state_wellFormed S\"\n shows \"trans (happensBefore S)\"\n by (smt FieldI2 disjoint_iff_not_equal happensBefore_transitive local.wf proof_state_rel_facts(1) proof_state_rel_hb proof_state_wellFormed_def proof_state_wellFormed_disjoint_happensBefore_localCalls trans_def updateHb_simp2)\n\nlemma ps_localCalls_no_origin:\n assumes wf: \"proof_state_wellFormed S\"\n and \"c \\ set (ps_localCalls S)\"\n shows \"callOrigin S c = None\"\n by (meson assms(2) disjoint_iff_not_equal domIff local.wf proof_state_rel_callOrigin_localCalls_disjoint ps_wellFormed_to_wf)\n\nlemma ps_not_localCalls_not_tx:\n assumes wf: \"proof_state_wellFormed S\"\n and \"c \\ set (ps_localCalls S)\"\n and \"ps_tx S \\ tx\"\n shows \"callOrigin S c \\ Some tx\"\n by (metis (mono_tags, lifting) assms(2) assms(3) local.wf map_update_all_get mem_Collect_eq option.simps(5) proof_state_rel_callOrigin proof_state_rel_localCalls ps_wellFormed_to_wf)\n\n\nlemma rel_callOrigin_vis:\n assumes rel: \"proof_state_rel S CS\"\n and \"c \\ ps_vis S\"\n shows \"callOrigin CS c = callOrigin S c\" \nproof -\n have co: \"callOrigin CS = map_update_all (callOrigin S) (ps_localCalls S) (the (ps_tx S))\"\n using proof_state_rel_def rel by blast\n show ?thesis\n using `c \\ ps_vis S`\n by (metis Set.set_insert co disjoint_insert(1) map_update_all_get proof_state_rel_vis_localCalls_disjoint rel)\nqed\n\nlemma rel_callOrigin_ls:\n assumes rel: \"proof_state_rel S CS\"\n and \"c \\ set (ps_localCalls S)\"\n shows \"callOrigin CS c = ps_tx S\"\n using assms(2) map_update_all_Some_same proof_state_rel_callOrigin proof_state_wellFormed_localCalls rel show_proof_state_wellFormed by fastforce \n\nlemma rel_callOrigin_ls_rev:\n assumes rel: \"proof_state_rel S CS\"\n and \"callOrigin CS c \\ tx\"\n and \"ps_tx S \\ tx\"\n shows \"c \\ set (ps_localCalls S)\"\n by (metis (no_types, lifting) assms(2) assms(3) map_update_all_get proof_state_rel_callOrigin ps_not_localCalls_not_tx rel show_proof_state_wellFormed)\n\n\n\nlemma rel_callOrigin_vis2:\n assumes rel: \"proof_state_rel S CS\"\n and sameOrigin: \"callOrigin S c = callOrigin S c'\"\n and \\c \\ ps_vis S\\\n shows \"callOrigin CS c = callOrigin CS c'\"\n by (metis (no_types, lifting) assms(3) map_update_all_get option.distinct(1) proof_state_rel_callOrigin proof_state_rel_calls proof_state_rel_wf proof_state_wellFormed_vis_subset_calls' ps_localCalls_no_origin rel rel_callOrigin_vis sameOrigin show_proof_state_wellFormed wf_callOrigin_and_calls)\n\n\nlemma ps_wellFormed_state_transaction_consistent1:\n assumes wf: \"proof_state_wellFormed S\"\n and c_vis: \"c\\ps_vis S\"\n and sameOrigin: \"callOrigin S c = callOrigin S c'\"\n shows \"c'\\ps_vis S\"\nproof (rule ps_wellFormed_to_wf[OF wf])\n fix CS\n assume rel: \"proof_state_rel S CS\"\n and CS_wf: \"state_wellFormed CS\"\n\n have vis: \"visibleCalls CS (ps_i S) \\ (ps_vis S \\ set (ps_localCalls S))\"\n by (simp add: proof_state_rel_vis rel)\n\n have \"c' \\ (ps_vis S \\ set (ps_localCalls S))\"\n using CS_wf vis\n proof (rule wellFormed_state_transaction_consistent(2))\n show \"c \\ ps_vis S \\ set (ps_localCalls S)\"\n by (simp add: c_vis)\n show \"callOrigin CS c = callOrigin CS c'\"\n by (smt CS_wf \\c \\ ps_vis S \\ set (ps_localCalls S)\\ c_vis disjoint_iff_not_equal in_dom local.wf map_update_all_None map_update_all_get proof_state_rel_callOrigin proof_state_rel_vis_localCalls_disjoint ps_localCalls_no_origin rel sameOrigin vis wellFormed_callOrigin_dom wellFormed_visibleCallsSubsetCalls_h(2))\n qed\n\n show \"c' \\ ps_vis S\"\n by (metis CS_wf UnE \\c' \\ ps_vis S \\ set (ps_localCalls S)\\ c_vis local.wf ps_localCalls_no_origin rel rel_callOrigin_vis rel_callOrigin_vis2 sameOrigin vis wellFormed_callOrigin_dom3 wellFormed_visibleCallsSubsetCalls2)\n\nqed\n\n\nlemma rel_callOrigin_different:\n assumes a0: \"callOrigin S x \\ callOrigin S y\"\n and wf: \"proof_state_wellFormed S\"\n and rel: \"proof_state_rel S CS\"\n shows \"callOrigin CS x \\ callOrigin CS y\"\n by (smt a0 empty_iff empty_set local.wf map_update_all_get option.exhaust_sel proof_state_rel_callOrigin proof_state_wellFormed_localCalls ps_localCalls_no_origin ps_not_localCalls_not_tx rel)\n\nlemma rel_callOrigin_same:\n assumes \"callOrigin S x \\ xtx\"\n and a1: \"callOrigin S x = callOrigin S x'\"\n and wf: \"proof_state_wellFormed S\"\n and rel: \"proof_state_rel S CS\"\n shows \"callOrigin CS x = callOrigin CS x'\"\n by (metis (no_types, lifting) \\callOrigin S x \\ xtx\\ a1 local.wf map_update_all_get option.simps(3) proof_state_rel_callOrigin ps_localCalls_no_origin rel)\n\nlemma rel_noCallOrigin_noHappensBefore:\n assumes \"callOrigin S x = None\"\n and rel: \"proof_state_rel S CS\"\n and wf: \"proof_state_wellFormed S\"\n shows \"(x,y) \\ happensBefore S\"\n by (metis (no_types, lifting) FieldI1 assms(1) disjoint_iff_not_equal domIff local.wf map_update_all_None proof_state_rel_calls proof_state_rel_facts(4) proof_state_rel_happensBefore_localCalls_disjoint proof_state_rel_wf proof_state_wellFormed_happensBefore_subset_calls rel subsetD wellFormed_callOrigin_dom)\n\nlemma rel_noCallOrigin_noHappensBefore_r:\n assumes \"callOrigin S x = None\"\n and rel: \"proof_state_rel S CS\"\n and wf: \"proof_state_wellFormed S\"\n shows \"(y,x) \\ happensBefore S\"\n by (metis (no_types, lifting) FieldI2 assms(1) disjoint_iff_not_equal domIff local.wf map_update_all_None proof_state_rel_calls proof_state_rel_facts(4) proof_state_rel_wf proof_state_wellFormed_disjoint_happensBefore_localCalls proof_state_wellFormed_happensBefore_subset_calls rel subsetD wellFormed_callOrigin_dom)\n\n\nlemma ps_wellFormed_state_transaction_consistent_hb:\n assumes wf: \"proof_state_wellFormed S\"\n and a0: \"callOrigin S x \\ callOrigin S y\"\n and a1: \"callOrigin S x = callOrigin S x'\"\n and a2: \"callOrigin S y = callOrigin S y'\"\n shows \"(x,y) \\ happensBefore S \\ (x', y') \\ happensBefore S\"\nproof (rule ps_wellFormed_to_wf[OF wf])\n fix CS\n assume rel: \"proof_state_rel S CS\"\n and CS_wf: \"state_wellFormed CS\"\n\n {\n fix xtx ytx\n assume \"callOrigin S x \\ xtx\" \n and \"callOrigin S y \\ ytx\"\n\n\n have \"((x, y) \\ happensBefore CS) = ((x', y') \\ happensBefore CS)\"\n using CS_wf\n proof (rule wellFormed_state_transaction_consistent(3))\n show \"callOrigin CS x \\ callOrigin CS y\"\n using a0 local.wf rel rel_callOrigin_different by blast\n show \"callOrigin CS x = callOrigin CS x'\"\n using \\callOrigin S x \\ xtx\\ a1 local.wf rel rel_callOrigin_same by blast\n show \"callOrigin CS y = callOrigin CS y'\"\n using \\callOrigin S y \\ ytx\\ a2 local.wf rel rel_callOrigin_same by blast\n qed\n\n\n hence \"((x, y) \\ happensBefore S) \\ ((x', y') \\ happensBefore S)\"\n by (metis \\callOrigin S y \\ ytx\\ a2 local.wf option.simps(3) proof_state_rel_hb ps_localCalls_no_origin rel updateHb_simp2)\n }\n moreover\n {\n assume \"callOrigin S x = None\" \n hence \"(x,y) \\ happensBefore S\"\n using local.wf rel rel_noCallOrigin_noHappensBefore by blast\n have \"callOrigin S x' = None\"\n using \\callOrigin S x = None\\ a1 by auto \n hence \"(x',y') \\ happensBefore S\"\n using local.wf rel rel_noCallOrigin_noHappensBefore by blast\n hence \"((x, y) \\ happensBefore S) \\ ((x', y') \\ happensBefore S)\"\n using \\(x, y) \\ happensBefore S\\ by blast\n }\n moreover\n {\n assume \"callOrigin S y = None\" \n hence \"(x,y) \\ happensBefore S\"\n using local.wf rel rel_noCallOrigin_noHappensBefore_r by blast\n have \"callOrigin S y' = None\"\n using \\callOrigin S y = None\\ a2 by auto \n hence \"(x',y') \\ happensBefore S\"\n using local.wf rel rel_noCallOrigin_noHappensBefore_r by blast\n hence \"((x, y) \\ happensBefore S) \\ ((x', y') \\ happensBefore S)\"\n using \\(x, y) \\ happensBefore S\\ by blast\n }\n ultimately show ?thesis\n by blast\nqed\n\n\n\n\nlemma ps_wellFormed_state_consistent_snapshot:\nassumes wf: \"proof_state_wellFormed S\"\nassumes noTx: \"\\c tx. ps_tx S \\ tx \\ callOrigin S c \\ Some tx\" \nshows \"consistentSnapshotH (calls S) (happensBefore S) (callOrigin S) (\\x. Some Committed) (ps_vis S)\"\n by (simp add: local.wf proof_state_wellFormed_vis_subset_calls ps_wellFormed_state_causality ps_wellFormed_state_transaction_consistent1 show_consistentSnapshot show_transactionConsistent)\n\n\nlemma ps_wf_happensBefore_irrefl:\nassumes wf: \"proof_state_wellFormed S\"\nshows \"irrefl (happensBefore S)\"\n by (metis (no_types, hide_lams) happensBefore_irrefl irrefl_def local.wf proof_state_rel_hb ps_wellFormed_to_wf updateHb_simp_distinct2)\n\n\nlemma ps_wf_happensBefore_acyclic:\nassumes wf: \"proof_state_wellFormed S\"\nshows \"acyclic (happensBefore S)\"\n by (simp add: acyclic_irrefl local.wf ps_wf_happensBefore_irrefl ps_wellFormed_state_hb_trans)\n\n\n\n\nlemma ps_wf_vis_downwards_closed:\n assumes wf: \"proof_state_wellFormed S\"\n and \"(x,y) \\ happensBefore S\"\n and \"y\\ps_vis S\"\n shows \"x\\ps_vis S\"\n by (meson assms(2) assms(3) causallyConsistent_def local.wf ps_wellFormed_state_causality)\n\n\n\n\n\nlemma ps_wf_happensBefore_txns_left: \n assumes wf: \"proof_state_wellFormed S\"\n assumes \"(x,y) \\ happensBefore S\"\n and \"callOrigin S x = callOrigin S x'\"\n and \"callOrigin S x \\ callOrigin S y\"\n shows \"(x',y) \\ happensBefore S\"\n using assms(2) assms(3) assms(4) local.wf ps_wellFormed_state_transaction_consistent_hb by blast\n\n\n\n\nlemma causallyConsistent_downwards_closure:\nassumes wf: \"proof_state_wellFormed S\"\nshows \"causallyConsistent (happensBefore S) (cs \\ happensBefore S)\"\n by (smt causallyConsistent_def downwardsClosure_in local.wf ps_wellFormed_state_hb_trans transD)\n\n\n\n\nlemma ps_wf_current_tx_not_before_others: \n assumes wf: \"proof_state_wellFormed S\"\n and \"ps_tx S \\ tx\"\n and \"callOrigin S x \\ tx\"\n and \"callOrigin S y \\ Some tx\"\n shows \"(x,y) \\ happensBefore S\"\n by (meson assms(2) assms(3) domI domIff local.wf ps_localCalls_no_origin ps_not_localCalls_not_tx)\n\n\n\n(*\nlemma ps_i_callOriginI_notI1:\n assumes \"proof_state_wellFormed S_pre\" \n and \"invocOp S_pre i = None\" \n shows \"i_callOriginI S_pre c \\ Some i\"\n\n by (metis (no_types, lifting) assms(1) assms(2) i_callOriginI_h_def option.case_eq_if option.simps(3) proof_state_rel_invocOp proof_state_rel_txOrigin proof_state_rel_wf proof_state_wellFormed_def wf_no_invocation_no_origin)\n*)\n(*\nlemma ps_i_callOriginI_notI2:\n assumes \"proof_state_wellFormed S_pre\" \n and \"i_callOriginI S_pre c = Some i\" \n shows \"invocOp S_pre i \\ None\"\n using assms(1) assms(2) ps_i_callOriginI_notI1 by auto\n*)\n\nlemma ps_wellFormed_current_transaction_origin: \n assumes \"proof_state_wellFormed S\"\n and \"ps_tx S \\ tx\"\n shows \"txOrigin S tx = None\"\n using assms(1) assms(2) proof_state_rel_txOriginNone proof_state_wellFormed_def by blast\n\n\nlemma ps_wellFormed_ls_visibleCalls_callOrigin: \n assumes \"proof_state_wellFormed S\"\n and \"callOrigin S c \\ tx\"\n and \"txOrigin S tx \\ ps_i S\"\n shows \"c \\ ps_vis S\"\n by (metis assms(1) assms(2) assms(3) i_callOriginI_h_simp proof_state_rel_see_my_updates ps_wellFormed_to_wf)\n\n\n\n\nlemma ps_wf_queryspec:\n assumes wf: \"proof_state_wellFormed S\"\n and \"calls S c \\ Call op r\"\n and \"prevCalls = {c'. (c',c)\\updateHb (happensBefore S) (ps_vis S) (ps_localCalls S)}\"\n and \"ctxt = getContextH (calls S |` prevCalls) (updateHb (happensBefore S) (ps_vis S) (ps_localCalls S) |r prevCalls) (Some prevCalls)\"\n shows \"querySpec (ps_prog S) op ctxt r\"\nproof (rule ps_wellFormed_to_wf[OF wf])\n fix CS\n assume rel: \"proof_state_rel S CS\"\n and CS_wf: \"state_wellFormed CS\"\n\n have \"querySpec (prog CS) op ctxt r\"\n using CS_wf\n proof (rule wf_queryspec)\n show \"calls CS c \\ Call op r\"\n using assms(2) proof_state_rel_calls rel by fastforce\n show \"prevCalls = {c'. (c', c) \\ happensBefore CS}\"\n using assms(3) proof_state_rel_hb rel by force\n show \"ctxt = getContextH (calls CS |` prevCalls) (happensBefore CS |r prevCalls) (Some prevCalls)\"\n using assms(4) proof_state_rel_calls proof_state_rel_hb rel by fastforce\n qed\n\n\n thus \"querySpec (ps_prog S) op ctxt r\"\n using proof_state_rel_prog rel by force\nqed\n \nlemma ps_growing_no_localCalls1:\n assumes \"ps_growing S S' t\"\n shows \"ps_localCalls S = []\"\n using assms by (auto simp add: ps_growing_def)\n\nlemma ps_growing_no_localCalls2:\n assumes \"ps_growing S S' t\"\n shows \"ps_localCalls S' = []\"\n using assms by (auto simp add: ps_growing_def)\n\nlemma ps_growing_no_tx1:\n assumes \"ps_growing S S' t\"\n shows \"ps_tx S = None\"\n using assms by (auto simp add: ps_growing_def)\n\nlemma ps_growing_no_tx2:\n assumes \"ps_growing S S' t\"\n shows \"ps_tx S' \\ t\"\n using assms by (auto simp add: ps_growing_def)\n\n\nlemma ps_growing_rule:\n assumes \"ps_growing S S' t\"\n and \"\\CS CS'.\n \\proof_state_rel S CS; proof_state_rel S' CS';\n state_monotonicGrowth (ps_i S) CS\n (CS'\\txStatus := (txStatus CS')(t := None),\n txOrigin := (txOrigin CS')(t := None),\n currentTx := (currentTx CS')(ps_i S := None),\n localState := (localState CS')(ps_i S := localState CS (ps_i S)),\n visibleCalls := (visibleCalls CS')(ps_i S := visibleCalls CS (ps_i S))\\)\\\n \\ P\"\n shows P\n using assms by (auto simp add: ps_growing_def)\n\n\nlemma ps_monotonicGrowth_txOrigin_i:\n assumes \"ps_growing S S' tx\"\n and \"t \\ tx\"\n shows \"txOrigin S' t \\ ps_i S \\ txOrigin S t \\ ps_i S\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S CS\"\n and rel2: \"proof_state_rel S' CS'\"\n and g: \"state_monotonicGrowth (ps_i S) CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S := None), localState := (localState CS')(ps_i S := localState CS (ps_i S)), visibleCalls := (visibleCalls CS')(ps_i S := visibleCalls CS (ps_i S))\\)\"\n\n from state_monotonicGrowth_txOrigin_i[OF g, where t=t, simplified]\n have \"txOrigin CS' t \\ ps_i S \\ txOrigin CS t \\ ps_i S\"\n by (simp add: `t \\ tx`)\n\n thus \"txOrigin S' t \\ ps_i S = txOrigin S t \\ ps_i S\"\n unfolding proof_state_rel_txOrigin[OF rel1] proof_state_rel_txOrigin[OF rel2]\n by (metis (no_types, lifting) assms(1) assms(2) fun_upd_other option.case_eq_if option.sel ps_growing_no_tx1 ps_growing_no_tx2)\nqed\n\n\nlemma ps_monotonicGrowth_no_new_calls_before_existing1:\n assumes \"ps_growing S' S t\"\n and \"c2\\dom (calls S')\"\n and \"ps_vis S' = ps_vis S\"\n shows \"(c1,c2)\\happensBefore S \\ (c1,c2)\\happensBefore S'\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(t := None), txOrigin := (txOrigin CS')(t := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n from state_monotonicGrowth_no_new_calls_before_existing1[OF g, simplified, of c2 c1]\n have \"((c1, c2) \\ happensBefore CS') \\ ((c1, c2) \\ happensBefore CS)\"\n using assms(2) proof_state_rel_calls rel1 by fastforce\n\n hence \"((c1, c2) \\ updateHb (happensBefore S) (ps_vis S) (ps_localCalls S)) \n \\ ((c1, c2) \\ updateHb (happensBefore S') (ps_vis S') (ps_localCalls S'))\"\n unfolding proof_state_rel_hb[OF rel1] proof_state_rel_hb[OF rel2] .\n\n thus \"((c1, c2) \\ happensBefore S) = ((c1, c2) \\ happensBefore S')\"\n by (metis assms(1) ps_growing_no_localCalls1 ps_growing_no_localCalls2 single_invocation_correctness.updateHb_nil)\nqed\n\nlemma ps_monotonicGrowth_no_new_calls_before_existing: \n assumes \"ps_growing S' S t\"\n and \"calls S' c = None\"\n and \"calls S c \\ x\"\n and \"calls S' c' \\ y\"\n shows \"(c,c') \\ happensBefore S'\"\n using assms\n by (meson FieldI1 domIff proof_state_wellFormed_happensBefore_subset_calls ps_growing_rule show_proof_state_wellFormed subset_h1)\n\n\nlemma ps_monotonicGrowth_txOrigin: \n assumes \"ps_growing S' S tx\" \n and \"txOrigin S' t \\ i'\"\n and \"tx \\ t\"\n shows \"txOrigin S t \\ i'\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"txOrigin CS t \\ i'\"\n using assms(1) assms(2) proof_state_rel_txOrigin ps_growing_no_tx1 rel1 by fastforce\n\n\n from state_monotonicGrowth_txOrigin[OF g `txOrigin CS t \\ i'`]\n have \"txOrigin CS' t \\ i'\"\n using assms(3) by auto\n\n\n thus \"txOrigin S t \\ i'\"\n using assms(1) assms(3) proof_state_rel_txOrigin ps_growing_no_tx2 rel2 by fastforce\nqed\n\n\nlemma ps_monotonicGrowth_calls:\n assumes \"ps_growing S' S tx\"\n and \"calls S' c \\ info\"\n shows \"calls S c \\ info\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"calls CS c \\ info\"\n using assms(2) proof_state_rel_calls rel1 by force\n\n\n from state_monotonicGrowth_calls[OF g `calls CS c \\ info`]\n show \"calls S c \\ info\"\n using proof_state_rel_calls rel2 by fastforce\nqed\n\nlemma ps_monotonicGrowth_happensBefore:\n assumes \"ps_growing S' S tx\"\n and \"c2\\dom (calls S')\"\nshows \"((c1,c2)\\happensBefore S \\ (c1,c2)\\happensBefore S')\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"c2 \\ dom (calls CS)\"\n using assms(2) proof_state_rel_calls rel1 by fastforce\n\n have \"ps_localCalls S' = []\"\n using assms(1) ps_growing_no_localCalls1 by blast\n\n\n from state_monotonicGrowth_happensBefore[OF g `c2 \\ dom (calls CS)`, simplified]\n have \"((c1, c2) \\ happensBefore CS') = ((c1, c2) \\ happensBefore CS)\" .\n\n thus ?thesis\n using \\ps_localCalls S' = []\\ assms(1) proof_state_rel_facts(3) ps_growing_no_localCalls2 rel1 rel2 by fastforce\nqed\n\nlemma ps_monotonicGrowth_callOrigin:\n assumes \"ps_growing S' S tx\"\n and \"callOrigin S' c \\ t\"\n shows \"callOrigin S c \\ t\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"callOrigin CS c \\ t\"\n using assms(1) assms(2) proof_state_rel_callOrigin ps_growing_no_localCalls1 rel1 by fastforce\n\n\n from state_monotonicGrowth_callOrigin[OF g `callOrigin CS c \\ t`]\n show \"callOrigin S c \\ t\"\n using assms(1) proof_state_rel_callOrigin ps_growing_no_localCalls2 rel2 by fastforce\nqed\n\nlemma ps_monotonicGrowth_callOrigin2:\n assumes \"ps_growing S' S t\"\n shows \"callOrigin S c = None \\ callOrigin S' c = None\"\n by (metis assms option.exhaust ps_monotonicGrowth_callOrigin)\n \n\nlemma ps_monotonicGrowth_knownIds:\n assumes \"ps_growing S' S tx\"\n shows \"knownIds S' \\ knownIds S\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n from state_monotonicGrowth_knownIds[OF g, simplified]\n have \"knownIds CS \\ knownIds CS'\" .\n\n thus \"knownIds S' \\ knownIds S\"\n using proof_state_rel_knownIds rel1 rel2 by auto\nqed\n\n\n\nlemma ps_monotonicGrowth_invocOp:\n assumes \"ps_growing S' S tx\"\n and \"invocOp S' s \\ info\"\n shows \"invocOp S s \\ info\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"invocOp CS s \\ info\"\n using assms(2) proof_state_rel_invocOp rel1 by force\n\n\n from state_monotonicGrowth_invocOp[OF g `invocOp CS s \\ info`, simplified]\n show ?thesis\n using proof_state_rel_invocOp rel2 by fastforce\nqed\n\nlemma ps_growing_same_i:\nassumes \"ps_growing S' S tx\"\nshows \"ps_i S = ps_i S'\"\n using assms ps_growing_def by blast\n\n\n\nlemma ps_monotonicGrowth_invocOp_i:\n assumes \"ps_growing S' S tx\"\n shows \"invocOp S (ps_i S) = invocOp S' (ps_i S)\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n from state_monotonicGrowth_invocOp_i[OF g]\n have \"invocOp CS' (ps_i S') = invocOp CS (ps_i S')\" by simp\n thus ?thesis\n by (metis (no_types, lifting) assms proof_state_rel_invocOp ps_growing_same_i rel1 rel2)\nqed\n\nlemma ps_monotonicGrowth_invocRes:\n assumes \"ps_growing S' S tx\"\n and \"invocRes S' s \\ info\"\n shows \"invocRes S s \\ info\"\n using assms(1) proof (rule ps_growing_rule)\n fix CS CS'\n assume rel1: \"proof_state_rel S' CS\"\n and rel2: \"proof_state_rel S CS'\"\n and g: \"state_monotonicGrowth (ps_i S') CS (CS'\\txStatus := (txStatus CS')(tx := None), txOrigin := (txOrigin CS')(tx := None), currentTx := (currentTx CS')(ps_i S' := None), localState := (localState CS')(ps_i S' := localState CS (ps_i S')), visibleCalls := (visibleCalls CS')(ps_i S' := visibleCalls CS (ps_i S'))\\)\"\n\n have \"invocRes CS s \\ info\"\n using assms(2) proof_state_rel_invocRes rel1 by fastforce\n\n\n from state_monotonicGrowth_invocRes[OF g `invocRes CS s \\ info`, simplified]\n have \"invocRes CS' s \\ info\" .\n thus ?thesis\n using proof_state_rel_invocRes rel2 by force\nqed\n\n\n\nlemma ps_monotonicGrowth_invocRes_i:\n assumes \"ps_growing S' S t\"\n shows \"invocRes S' (ps_i S') = invocRes S (ps_i S')\"\n by (smt assms proof_state_rel_invocRes proof_state_rel_ls proof_state_rel_wf ps_growing_rule ps_growing_same_i wf_localState_noReturn)\n\n\n\nlemma ps_monotonicGrowth_prog:\n assumes \"ps_growing S' S t\"\n shows \"ps_prog S = ps_prog S'\"\n using assms ps_growing_def by blast\n\nlemma ps_monotonicGrowth_invocOp2:\n assumes \"ps_growing S' S t\"\n shows \"(invocOp S' \\\\<^sub>m invocOp S) \"\n using assms map_le_def ps_monotonicGrowth_invocOp by fastforce\n\n \n\n\nlemma ps_monotonicGrowth_current_transactions_fixed:\n assumes \"ps_growing S S' t\"\n and \"ps_tx S \\ tx\"\n shows \"callOrigin S c \\ tx \\ callOrigin S' c \\ tx\"\n using assms(1) assms(2) ps_growing_no_tx1 by force\n\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/proof_state_facts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.2701358123358359}} {"text": ";;; -*- syntax: common-lisp; package: KEIM; base: 10; mode: LISP -*-\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n;; ;;\n;; Copyright (C) 1996 by AG Siekmann, Fachbereich Informatik, ;;\n;; Universitaet des Saarlandes, Saarbruecken, Germany. ;;\n;; All rights reserved. ;;\n;; For information about this program, write to: ;;\n;; OMEGA Project ;;\n;; AG Siekmann/FB Informatik ;;\n;; Universitaet des Saarlandes ;;\n;; Postfach 1150 ;;\n;; D-66041 Saarbruecken ;;\n;; Germany ;;\n;; electronic mail: keim@cs.uni-sb.de ;;\n;; ;;\n;; The author makes no representations about the suitability of this ;;\n;; software for any purpose. It is provided \"AS IS\" without express or ;;\n;; implied warranty. In particular, it must be understood that this ;;\n;; software is an experimental version, and is not suitable for use in ;;\n;; any safety-critical application, and the author denies a license for ;;\n;; such use. ;;\n;; ;;\n;; You may use, copy, modify and distribute this software for any ;;\n;; noncommercial and non-safety-critical purpose. Use of this software ;;\n;; in a commercial product is not included under this license. You must ;;\n;; maintain this copyright statement in all copies of this software that ;;\n;; you modify or distribute. ;;\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n\n(in-package :omega)\n\n\n(th~deftheorem submodule-property\n\t (in module)\n\t (conclusion\n\t\t(all-types aa bb\n\t\t (forall (lam (M (o bb))\n\t\t (forall (lam (madd (bb bb bb))\n\t\t (forall (lam (R (o aa))\n\t\t (forall (lam (radd (aa aa aa))\n\t\t (forall (lam (rmul (aa aa aa))\n\t\t (forall (lam (rmmul (bb bb aa))\n\t\t (forall (lam (A (o bb))\n\t\t\t (implies (and (and (module M madd R radd rmul rmmul)\n\t\t\t\t\t (subset A M))\n\t\t\t\t (and (closed-under A madd)\n\t\t\t\t\t (and (in (group-unit M madd) A)\n\t\t\t\t\t\t (and (forall-sort (lam (m1 bb)\n\t\t\t\t\t\t (forall-sort (lam (m2 bb)\n\t\t\t\t\t\t\t(in (madd m1 ((group-inverse M madd) m2)) A))\n\t\t\t\t\t\t\t\t A))\n\t\t\t\t\t\t\t\t A)\n\t\t\t\t\t\t (forall-sort (lam (r1 aa)\n\t\t\t\t\t\t (forall-sort (lam (m1 bb)\n\t\t\t\t\t\t\t(in (rmmul r1 m1) A))\n\t\t\t\t\t\t\t\t A))\n\t\t\t\t\t\t\t\t R)))))\n\t\t\t\t (submodule A M madd R radd rmul rmmul)))))))))))))))))))\n", "meta": {"author": "theoremprover-museum", "repo": "OMEGA", "sha": "b95b25f8bb16847a2e18d106510446a175f7145a", "save_path": "github-repos/isabelle/theoremprover-museum-OMEGA", "path": "github-repos/isabelle/theoremprover-museum-OMEGA/OMEGA-b95b25f8bb16847a2e18d106510446a175f7145a/theories/module/module-theorems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.27013581233583583}} {"text": "section \"A simpler version with no clock parameter and factored-out matching\"\n\ntheory Big_Step_Unclocked\nimports\n Semantic_Extras\n Big_Step_Determ\nbegin\n\ninductive\n\nevaluate_list :: \" (v)sem_env \\ 'ffi state \\(exp)list \\ 'ffi state*(((v)list),(v))result \\ bool \"\n and\nevaluate :: \" (v)sem_env \\ 'ffi state \\ exp \\ 'ffi state*((v),(v))result \\ bool \" where\n\n\"lit\" : \" \\ env l s.\n\nevaluate env s (Lit l) (s, Rval (Litv l))\"\n\n|\n\n\"raise1\" : \" \\ env e s1 s2 v1.\nevaluate s1 env e (s2, Rval v1)\n==>\nevaluate s1 env (Raise e) (s2, Rerr (Rraise v1))\"\n\n|\n\n\"raise2\" : \" \\ env e s1 s2 err.\nevaluate s1 env e (s2, Rerr err)\n==>\nevaluate s1 env (Raise e) (s2, Rerr err)\"\n\n|\n\n\"handle1\" : \" \\ s1 s2 env e v1 pes.\nevaluate s1 env e (s2, Rval v1)\n==>\nevaluate s1 env (Handle e pes) (s2, Rval v1)\"\n\n|\n\n\"handle2\" : \" \\ s1 s2 env e pes v1 bv.\nevaluate env s1 e (s2, Rerr (Rraise v1)) \\\nmatch_result env s2 v1 pes v1 = Rval (e', env') \\\nevaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s2 e' bv\n==>\nevaluate env s1 (Handle e pes) bv \"\n\n|\n\n\"handle2b\" : \" \\ s1 s2 env e pes v1.\nevaluate env s1 e (s2, Rerr (Rraise v1)) \\\nmatch_result env s2 v1 pes v1 = Rerr err\n==>\nevaluate env s1 (Handle e pes) (s2, Rerr err)\"\n\n|\n\n\"handle3\" : \" \\ s1 s2 env e pes a.\nevaluate env s1 e (s2, Rerr (Rabort a))\n==>\nevaluate env s1 (Handle e pes) (s2, Rerr (Rabort a))\"\n\n|\n\n\"con1\" : \" \\ env cn es vs s s' v1.\ndo_con_check(c env) cn (List.length es) \\\nbuild_conv(c env) cn (List.rev vs) = Some v1 \\\nevaluate_list env s (List.rev es) (s', Rval vs)\n==>\nevaluate env s (Con cn es) (s', Rval v1)\"\n\n|\n\n\"con2\" : \" \\ env cn es s.\n\\ (do_con_check(c env) cn (List.length es))\n==>\nevaluate env s (Con cn es) (s, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"con3\" : \" \\ env cn es err s s'.\ndo_con_check(c env) cn (List.length es) \\\nevaluate_list env s (List.rev es) (s', Rerr err)\n==>\nevaluate env s (Con cn es) (s', Rerr err)\"\n\n|\n\n\"var1\" : \" \\ env n v1 s.\nnsLookup(sem_env.v env) n = Some v1\n==>\nevaluate env s (Var n) (s, Rval v1)\"\n\n|\n\n\"var2\" : \" \\ env n s.\nnsLookup(sem_env.v env) n = None\n==>\nevaluate env s (Var n) (s, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"fn\" : \" \\ env n e s.\n\nevaluate env s (Fun n e) (s, Rval (Closure env n e))\"\n\n|\n\n\"app1\" : \" \\ env es vs env' e bv s1 s2.\nevaluate_list env s1 (List.rev es) (s2, Rval vs) \\\ndo_opapp (List.rev vs) = Some (env', e) \\\nevaluate env' s2 e bv\n==>\nevaluate env s1 (App Opapp es) bv \"\n\n|\n\n\"app3\" : \" \\ env es vs s1 s2.\nevaluate_list env s1 (List.rev es) (s2, Rval vs) \\\n(do_opapp (List.rev vs) = None)\n==>\nevaluate env s1 (App Opapp es) (s2, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"app4\" : \" \\ env op0 es vs res s1 s2 refs' ffi'.\nevaluate_list env s1 (List.rev es) (s2, Rval vs) \\\ndo_app ((refs s2),(ffi s2)) op0 (List.rev vs) = Some ((refs',ffi'), res) \\\nop0 \\ Opapp\n==>\nevaluate env s1 (App op0 es) (( s2 (| refs := refs', ffi :=ffi' |)), res)\"\n\n|\n\n\"app5\" : \" \\ env op0 es vs s1 s2.\nevaluate_list env s1 (List.rev es) (s2, Rval vs) \\\ndo_app ((refs s2),(ffi s2)) op0 (List.rev vs) = None \\\nop0 \\ Opapp\n==>\nevaluate env s1 (App op0 es) (s2, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"app6\" : \" \\ env op0 es err s1 s2.\nevaluate_list env s1 (List.rev es) (s2, Rerr err)\n==>\nevaluate env s1 (App op0 es) (s2, Rerr err)\"\n\n|\n\n\"log1\" : \" \\ env op0 e1 e2 v1 e' bv s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\ndo_log op0 v1 e2 = Some (Exp e') \\\nevaluate env s2 e' bv\n==>\nevaluate env s1 (Log op0 e1 e2) bv \"\n\n|\n\n\"log2\" : \" \\ env op0 e1 e2 v1 bv s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\n(do_log op0 v1 e2 = Some (Val bv))\n==>\nevaluate env s1 (Log op0 e1 e2) (s2, Rval bv)\"\n\n|\n\n\"log3\" : \" \\ env op0 e1 e2 v1 s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\n(do_log op0 v1 e2 = None)\n==>\nevaluate env s1 (Log op0 e1 e2) (s2, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"log4\" : \" \\ env op0 e1 e2 err s s'.\nevaluate env s e1 (s', Rerr err)\n==>\nevaluate env s (Log op0 e1 e2) (s', Rerr err)\"\n\n|\n\n\"if1\" : \" \\ env e1 e2 e3 v1 e' bv s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\ndo_if v1 e2 e3 = Some e' \\\nevaluate env s2 e' bv\n==>\nevaluate env s1 (If e1 e2 e3) bv \"\n\n|\n\n\"if2\" : \" \\ env e1 e2 e3 v1 s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\n(do_if v1 e2 e3 = None)\n==>\nevaluate env s1 (If e1 e2 e3) (s2, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"if3\" : \" \\ env e1 e2 e3 err s s'.\nevaluate env s e1 (s', Rerr err)\n==>\nevaluate env s (If e1 e2 e3) (s', Rerr err)\"\n\n|\n\n\"mat1\" : \" \\ env e pes v1 bv s1 s2.\nevaluate env s1 e (s2, Rval v1) \\\nmatch_result env s2 v1 pes Bindv = Rval (e', env') \\\nevaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s2 e' bv\n==>\nevaluate env s1 (Mat e pes) bv \"\n\n|\n\n\"mat1b\" : \" \\ env e pes v1 s1 s2.\nevaluate env s1 e (s2, Rval v1) \\\nmatch_result env s2 v1 pes Bindv = Rerr err\n==>\nevaluate env s1 (Mat e pes) (s2, Rerr err)\"\n\n|\n\n\"mat2\" : \" \\ env e pes err s s'.\nevaluate env s e (s', Rerr err)\n==>\nevaluate env s (Mat e pes) (s', Rerr err)\"\n\n|\n\n\"let1\" : \" \\ env n e1 e2 v1 bv s1 s2.\nevaluate env s1 e1 (s2, Rval v1) \\\nevaluate ( env (| sem_env.v := (nsOptBind n v1(sem_env.v env)) |)) s2 e2 bv\n==>\nevaluate env s1 (Let n e1 e2) bv \"\n\n|\n\n\"let2\" : \" \\ env n e1 e2 err s s'.\nevaluate env s e1 (s', Rerr err)\n==>\nevaluate env s (Let n e1 e2) (s', Rerr err)\"\n\n|\n\n\"letrec1\" : \" \\ env funs e bv s.\ndistinct (List.map ( \\x .\n (case x of (x,y,z) => x )) funs) \\\nevaluate ( env (| sem_env.v := (build_rec_env funs env(sem_env.v env)) |)) s e bv\n==>\nevaluate env s (Letrec funs e) bv \"\n\n|\n\n\"letrec2\" : \" \\ env funs e s.\n\\ (distinct (List.map ( \\x .\n (case x of (x,y,z) => x )) funs))\n==>\nevaluate env s (Letrec funs e) (s, Rerr (Rabort Rtype_error))\"\n\n|\n\n\"tannot\" : \" \\ env e t0 s bv.\nevaluate env s e bv\n==>\nevaluate env s (Tannot e t0) bv \"\n\n|\n\n\"locannot\" : \" \\ env e l s bv.\nevaluate env s e bv\n==>\nevaluate env s (Lannot e l) bv \"\n\n|\n\n\"empty\" : \" \\ env s.\n\nevaluate_list env s [] (s, Rval [])\"\n\n|\n\n\"cons1\" : \" \\ env e es v1 vs s1 s2 s3.\nevaluate env s1 e (s2, Rval v1) \\\nevaluate_list env s2 es (s3, Rval vs)\n==>\nevaluate_list env s1 (e # es) (s3, Rval (v1 # vs))\"\n\n|\n\n\"cons2\" : \" \\ env e es err s s'.\nevaluate env s e (s', Rerr err)\n==>\nevaluate_list env s (e # es) (s', Rerr err)\"\n\n|\n\n\"cons3\" : \" \\ env e es v1 err s1 s2 s3.\nevaluate env s1 e (s2, Rval v1) \\\nevaluate_list env s2 es (s3, Rerr err)\n==>\nevaluate_list env s1 (e # es) (s3, Rerr err)\"\n\nlemma unclocked_sound:\n \"evaluate_list v s es bv \\ BigStep.evaluate_list False v s es bv\"\n \"evaluate v s e bv' \\ BigStep.evaluate False v s e bv'\"\nproof (induction rule: evaluate_list_evaluate.inducts)\n case (handle2 e' env' s1 s2 env e pes v1 bv)\n show ?case\n apply (rule BigStep.handle2, intro conjI)\n apply fact\n apply (rule match_result_sound_val)\n apply fact+\n done\nnext\n case (handle2b err s1 s2 env e pes v1)\n show ?case\n apply (rule BigStep.handle2, intro conjI)\n apply fact\n apply (rule match_result_sound_err)\n apply fact\n done\nnext\n case (mat1 e' env' env e pes v1 bv s1 s2)\n show ?case\n apply (rule BigStep.mat1, fold Bindv_def, intro conjI)\n apply fact\n apply (rule match_result_sound_val)\n apply fact+\n done\nnext\n case (mat1b err env e pes v1 s1 s2)\n show ?case\n apply (rule BigStep.mat1, fold Bindv_def, intro conjI)\n apply fact\n apply (rule match_result_sound_err)\n apply fact\n done\nqed (fastforce simp: all_distinct_alt_def[symmetric] intro: evaluate_match_evaluate_list_evaluate.intros)+\n\ncontext begin\n\nprivate lemma unclocked_complete0:\n \"BigStep.evaluate_match ck env s v0 pes err_v (s', bv) \\ \\ ck \\ (\n case bv of\n Rval v \\\n \\e env'.\n match_result env s v0 pes err_v = Rval (e, env') \\\n evaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s e (s', Rval v)\n | Rerr err \\\n (match_result env s v0 pes err_v = Rerr err) \\\n (\\e env'.\n match_result env s v0 pes err_v = Rval (e, env') \\\n evaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s e (s', Rerr err)))\"\n \"BigStep.evaluate_list ck v s es (s', bv0) \\ \\ ck \\ evaluate_list v s es (s', bv0)\"\n \"BigStep.evaluate ck v s e (s', bv) \\ \\ ck \\ evaluate v s e (s', bv)\"\nproof (induction rule: evaluate_induct)\n case (handle2 ck s1 s2 env e pes v1 s3 bv)\n show ?case\n proof (cases bv)\n case (Rval v)\n with handle2 obtain e env' where\n \"match_result env s2 v1 pes v1 = Rval (e, env')\"\n \"evaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s2 e (s3, Rval v)\"\n by auto\n\n show ?thesis\n unfolding \\bv = _\\\n apply (rule evaluate_list_evaluate.handle2)\n using handle2 apply blast\n by fact+\n next\n case (Rerr err)\n with handle2 consider\n (match_err) \"match_result env s2 v1 pes v1 = Rerr err\" |\n (eval_err) e env' where\n \"match_result env s2 v1 pes v1 = Rval (e, env')\"\n \"evaluate (env \\ sem_env.v := nsAppend (alist_to_ns env') (sem_env.v env) \\) s2 e (s3, Rerr err)\"\n by auto\n then show ?thesis\n proof cases\n case match_err\n then have \"evaluate_match ck env s2 v1 pes v1 (s2, Rerr err)\"\n by (metis match_result_sound_err)\n moreover have \"evaluate_match ck env s2 v1 pes v1 (s3, Rerr err)\"\n using handle2 unfolding \\bv = _\\ by blast\n ultimately have \"s2 = s3\"\n by (metis evaluate_determ fst_conv)\n\n show ?thesis\n unfolding \\bv = _\\\n apply (rule evaluate_list_evaluate.handle2b)\n using handle2 unfolding \\s2 = _\\ apply blast\n using match_err unfolding \\s2 = _\\ .\n next\n case eval_err\n show ?thesis\n unfolding \\bv = _\\\n apply (rule evaluate_list_evaluate.handle2)\n using handle2 apply blast\n by fact+\n qed\n qed\nnext\n case (mat1 ck env e pes v1 s3 v' s1 s2)\n then show ?case\n (* this is the same proof as above, but with less Isar and more apply *)\n apply (auto split: result.splits simp: Bindv_def[symmetric])\n subgoal by (rule evaluate_list_evaluate.mat1) auto\n subgoal\n apply (frule match_result_sound_err)\n apply (subgoal_tac \"s2 = s3\")\n apply (rule evaluate_list_evaluate.mat1b)\n apply force\n apply force\n apply (drule evaluate_determ)\n apply assumption\n by auto\n subgoal by (rule evaluate_list_evaluate.mat1) auto\n done\nnext\n case (mat_cons1 ck env env' v1 p pes e a b err_v s)\n then show ?case\n by (auto split: result.splits)\nnext\n case (mat_cons2 ck env v1 p e pes a b s err_v)\n then show ?case\n by (auto split: result.splits)\nqed (fastforce simp: all_distinct_alt_def intro: evaluate_list_evaluate.intros)+\n\nlemma unclocked_complete:\n \"BigStep.evaluate_list False v s es bv' \\ evaluate_list v s es bv'\"\n \"BigStep.evaluate False v s e bv \\ evaluate v s e bv\"\napply (cases bv'; metis unclocked_complete0)\napply (cases bv; metis unclocked_complete0)\ndone\n\nend\n\nlemma unclocked_eq:\n \"evaluate_list = BigStep.evaluate_list False\"\n \"evaluate = BigStep.evaluate False\"\nby (auto intro: unclocked_sound unclocked_complete intro!: ext)\n\n\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML/Big_Step_Unclocked.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.2701138219752063}} {"text": "(* Title: HOL/Auth/Guard/P2.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n\nFrom G. Karjoth, N. Asokan and C. Gulcu\n\"Protecting the computation results of free-roaming agents\"\nMobiles Agents 1998, LNCS 1477.\n*)\n\nsection\\Protocol P2\\\n\ntheory P2 imports Guard_Public List_Msg begin\n\nsubsection\\Protocol Definition\\\n\n\ntext\\Like P1 except the definitions of \\chain\\, \\shop\\,\n \\next_shop\\ and \\nonce\\\\\n\nsubsubsection\\offer chaining:\nB chains his offer for A with the head offer of L for sending it to C\\\n\ndefinition chain :: \"agent => nat => agent => msg => agent => msg\" where\n\"chain B ofr A L C ==\nlet m1= sign B (Nonce ofr) in\nlet m2= Hash \\head L, Agent C\\ in\n\\Crypt (pubK A) m1, m2\\\"\n\ndeclare Let_def [simp]\n\nlemma chain_inj [iff]: \"(chain B ofr A L C = chain B' ofr' A' L' C')\n= (B=B' & ofr=ofr' & A=A' & head L = head L' & C=C')\"\nby (auto simp: chain_def Let_def)\n\nlemma Nonce_in_chain [iff]: \"Nonce ofr:parts {chain B ofr A L C}\"\nby (auto simp: chain_def sign_def)\n\nsubsubsection\\agent whose key is used to sign an offer\\\n\nfun shop :: \"msg => msg\" where\n\"shop \\Crypt K \\B,ofr,Crypt K' H\\,m2\\ = Agent (agt K')\"\n\nlemma shop_chain [simp]: \"shop (chain B ofr A L C) = Agent B\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\nonce used in an offer\\\n\nfun nonce :: \"msg => msg\" where\n\"nonce \\Crypt K \\B,ofr,CryptH\\,m2\\ = ofr\"\n\nlemma nonce_chain [simp]: \"nonce (chain B ofr A L C) = Nonce ofr\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\next shop\\\n\nfun next_shop :: \"msg => agent\" where\n\"next_shop \\m1,Hash \\headL,Agent C\\\\ = C\"\n\nlemma \"next_shop (chain B ofr A L C) = C\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\anchor of the offer list\\\n\ndefinition anchor :: \"agent => nat => agent => msg\" where\n\"anchor A n B == chain A n A (cons nil nil) B\"\n\nlemma anchor_inj [iff]:\n \"(anchor A n B = anchor A' n' B') = (A=A' & n=n' & B=B')\"\nby (auto simp: anchor_def)\n\nlemma Nonce_in_anchor [iff]: \"Nonce n:parts {anchor A n B}\"\nby (auto simp: anchor_def)\n\nlemma shop_anchor [simp]: \"shop (anchor A n B) = Agent A\"\nby (simp add: anchor_def)\n\nsubsubsection\\request event\\\n\ndefinition reqm :: \"agent => nat => nat => msg => agent => msg\" where\n\"reqm A r n I B == \\Agent A, Number r, cons (Agent A) (cons (Agent B) I),\ncons (anchor A n B) nil\\\"\n\nlemma reqm_inj [iff]: \"(reqm A r n I B = reqm A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: reqm_def)\n\nlemma Nonce_in_reqm [iff]: \"Nonce n:parts {reqm A r n I B}\"\nby (auto simp: reqm_def)\n\ndefinition req :: \"agent => nat => nat => msg => agent => event\" where\n\"req A r n I B == Says A B (reqm A r n I B)\"\n\nlemma req_inj [iff]: \"(req A r n I B = req A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: req_def)\n\nsubsubsection\\propose event\\\n\ndefinition prom :: \"agent => nat => agent => nat => msg => msg =>\nmsg => agent => msg\" where\n\"prom B ofr A r I L J C == \\Agent A, Number r,\napp (J, del (Agent B, I)), cons (chain B ofr A L C) L\\\"\n\nlemma prom_inj [dest]: \"prom B ofr A r I L J C = prom B' ofr' A' r' I' L' J' C'\n==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: prom_def)\n\nlemma Nonce_in_prom [iff]: \"Nonce ofr:parts {prom B ofr A r I L J C}\"\nby (auto simp: prom_def)\n\ndefinition pro :: \"agent => nat => agent => nat => msg => msg =>\n msg => agent => event\" where\n\"pro B ofr A r I L J C == Says B C (prom B ofr A r I L J C)\"\n\nlemma pro_inj [dest]: \"pro B ofr A r I L J C = pro B' ofr' A' r' I' L' J' C'\n==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: pro_def dest: prom_inj)\n\nsubsubsection\\protocol\\\n\ninductive_set p2 :: \"event list set\"\nwhere\n\n Nil: \"[]:p2\"\n\n| Fake: \"[| evsf:p2; X:synth (analz (spies evsf)) |] ==> Says Spy B X # evsf : p2\"\n\n| Request: \"[| evsr:p2; Nonce n ~:used evsr; I:agl |] ==> req A r n I B # evsr : p2\"\n\n| Propose: \"[| evsp:p2; Says A' B \\Agent A,Number r,I,cons M L\\:set evsp;\n I:agl; J:agl; isin (Agent C, app (J, del (Agent B, I)));\n Nonce ofr ~:used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp : p2\"\n\nsubsubsection\\valid offer lists\\\n\ninductive_set\n valid :: \"agent => nat => agent => msg set\"\n for A :: agent and n :: nat and B :: agent\nwhere\n Request [intro]: \"cons (anchor A n B) nil:valid A n B\"\n\n| Propose [intro]: \"L:valid A n B\n ==> cons (chain (next_shop (head L)) ofr A L C) L:valid A n B\"\n\nsubsubsection\\basic properties of valid\\\n\nlemma valid_not_empty: \"L:valid A n B ==> EX M L'. L = cons M L'\"\nby (erule valid.cases, auto)\n\nlemma valid_pos_len: \"L:valid A n B ==> 0 < len L\"\nby (erule valid.induct, auto)\n\nsubsubsection\\list of offers\\\n\nfun offers :: \"msg => msg\"\nwhere\n \"offers (cons M L) = cons \\shop M, nonce M\\ (offers L)\"\n| \"offers other = nil\"\n\n\nsubsection\\Properties of Protocol P2\\\n\ntext\\same as \\P1_Prop\\ except that publicly verifiable forward\nintegrity is replaced by forward privacy\\\n\nsubsection\\strong forward integrity:\nexcept the last one, no offer can be modified\\\n\nlemma strong_forward_integrity: \"ALL L. Suc i < len L\n--> L:valid A n B --> repl (L,Suc i,M):valid A n B --> M = ith (L,Suc i)\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,xa,l'a\\:valid A n B\" for x xa l'a)\napply (ind_cases \"\\x,M,l'a\\:valid A n B\" for x l'a)\napply (simp add: chain_def)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,repl(l',Suc na,M)\\:valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,l'\\:valid A n B\" for x l')\nby (drule_tac x=l' in spec, simp, blast)\n\nsubsection\\insertion resilience:\nexcept at the beginning, no offer can be inserted\\\n\nlemma chain_isnt_head [simp]: \"L:valid A n B ==>\nhead L ~= chain (next_shop (head L)) ofr A L C\"\nby (erule valid.induct, auto simp: chain_def sign_def anchor_def)\n\nlemma insertion_resilience: \"ALL L. L:valid A n B --> Suc i < len L\n--> ins (L,Suc i,M) ~:valid A n B\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,l'\\:valid A n B\" for x l', simp)\napply (ind_cases \"\\x,M,l'\\:valid A n B\" for x l', clarsimp)\napply (ind_cases \"\\head l',l'\\:valid A n B\" for l', simp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,l'\\:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,ins(l',Suc na,M)\\:valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsection\\truncation resilience:\nonly shop i can truncate at offer i\\\n\nlemma truncation_resilience: \"ALL L. L:valid A n B --> Suc i < len L\n--> cons M (trunc (L,Suc i)):valid A n B --> shop M = shop (ith (L,i))\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,l'\\:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\M,l'\\:valid A n B\" for l')\napply (frule len_not_empty, clarsimp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\x,l'\\:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsection\\declarations for tactics\\\n\ndeclare knows_Spy_partsEs [elim]\ndeclare Fake_parts_insert [THEN subsetD, dest]\ndeclare initState.simps [simp del]\n\nsubsection\\get components of a message\\\n\nlemma get_ML [dest]: \"Says A' B \\A,R,I,M,L\\:set evs ==>\nM:parts (spies evs) & L:parts (spies evs)\"\nby blast\n\nsubsection\\general properties of p2\\\n\nlemma reqm_neq_prom [iff]:\n\"reqm A r n I B ~= prom B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: reqm_def prom_def)\n\nlemma prom_neq_reqm [iff]:\n\"prom B' ofr A' r' I' (cons M L) J C ~= reqm A r n I B\"\nby (auto simp: reqm_def prom_def)\n\nlemma req_neq_pro [iff]: \"req A r n I B ~= pro B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: req_def pro_def)\n\nlemma pro_neq_req [iff]: \"pro B' ofr A' r' I' (cons M L) J C ~= req A r n I B\"\nby (auto simp: req_def pro_def)\n\nlemma p2_has_no_Gets: \"evs:p2 ==> ALL A X. Gets A X ~:set evs\"\nby (erule p2.induct, auto simp: req_def pro_def)\n\nlemma p2_is_Gets_correct [iff]: \"Gets_correct p2\"\nby (auto simp: Gets_correct_def dest: p2_has_no_Gets)\n\nlemma p2_is_one_step [iff]: \"one_step p2\"\nby (unfold one_step_def, clarify, ind_cases \"ev#evs:p2\" for ev evs, auto)\n\nlemma p2_has_only_Says' [rule_format]: \"evs:p2 ==>\nev:set evs --> (EX A B X. ev=Says A B X)\"\nby (erule p2.induct, auto simp: req_def pro_def)\n\nlemma p2_has_only_Says [iff]: \"has_only_Says p2\"\nby (auto simp: has_only_Says_def dest: p2_has_only_Says')\n\nlemma p2_is_regular [iff]: \"regular p2\"\napply (simp only: regular_def, clarify)\napply (erule_tac p2.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\nreq_def reqm_def anchor_def chain_def sign_def)\nby (auto dest: no_Key_in_agl no_Key_in_appdel parts_trans)\n\nsubsection\\private keys are safe\\\n\nlemma priK_parts_Friend_imp_bad [rule_format,dest]:\n \"[| evs:p2; Friend B ~= A |]\n ==> (Key (priK A):parts (knows (Friend B) evs)) --> (A:bad)\"\napply (erule p2.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\n req_def reqm_def anchor_def chain_def sign_def) \napply (blast dest: no_Key_in_agl)\napply (auto del: parts_invKey disjE dest: parts_trans\n simp add: no_Key_in_appdel)\ndone\n\nlemma priK_analz_Friend_imp_bad [rule_format,dest]:\n \"[| evs:p2; Friend B ~= A |]\n==> (Key (priK A):analz (knows (Friend B) evs)) --> (A:bad)\"\nby auto\n\nlemma priK_notin_knows_max_Friend:\n \"[| evs:p2; A ~:bad; A ~= Friend C |]\n ==> Key (priK A) ~:analz (knows_max (Friend C) evs)\"\napply (rule not_parts_not_analz, simp add: knows_max_def, safe)\napply (drule_tac H=\"spies' evs\" in parts_sub)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\napply (drule_tac H=\"spies evs\" in parts_sub)\nby (auto dest: knows'_sub_knows [THEN subsetD] priK_notin_initState_Friend)\n\nsubsection\\general guardedness properties\\\n\nlemma agl_guard [intro]: \"I:agl ==> I:guard n Ks\"\nby (erule agl.induct, auto)\n\nlemma Says_to_knows_max'_guard: \"[| Says A' C \\A'',r,I,L\\:set evs;\nGuard n Ks (knows_max' C evs) |] ==> L:guard n Ks\"\nby (auto dest: Says_to_knows_max')\n\nlemma Says_from_knows_max'_guard: \"[| Says C A' \\A'',r,I,L\\:set evs;\nGuard n Ks (knows_max' C evs) |] ==> L:guard n Ks\"\nby (auto dest: Says_from_knows_max')\n\nlemma Says_Nonce_not_used_guard: \"[| Says A' B \\A'',r,I,L\\:set evs;\nNonce n ~:used evs |] ==> L:guard n Ks\"\nby (drule not_used_not_parts, auto)\n\nsubsection\\guardedness of messages\\\n\nlemma chain_guard [iff]: \"chain B ofr A L C:guard n {priK A}\"\nby (case_tac \"ofr=n\", auto simp: chain_def sign_def)\n\nlemma chain_guard_Nonce_neq [intro]: \"n ~= ofr\n==> chain B ofr A' L C:guard n {priK A}\"\nby (auto simp: chain_def sign_def)\n\nlemma anchor_guard [iff]: \"anchor A n' B:guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: anchor_def)\n\nlemma anchor_guard_Nonce_neq [intro]: \"n ~= n'\n==> anchor A' n' B:guard n {priK A}\"\nby (auto simp: anchor_def)\n\nlemma reqm_guard [intro]: \"I:agl ==> reqm A r n' I B:guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: reqm_def)\n\nlemma reqm_guard_Nonce_neq [intro]: \"[| n ~= n'; I:agl |]\n==> reqm A' r n' I B:guard n {priK A}\"\nby (auto simp: reqm_def)\n\nlemma prom_guard [intro]: \"[| I:agl; J:agl; L:guard n {priK A} |]\n==> prom B ofr A r I L J C:guard n {priK A}\"\nby (auto simp: prom_def)\n\nlemma prom_guard_Nonce_neq [intro]: \"[| n ~= ofr; I:agl; J:agl;\nL:guard n {priK A} |] ==> prom B ofr A' r I L J C:guard n {priK A}\"\nby (auto simp: prom_def)\n\nsubsection\\Nonce uniqueness\\\n\nlemma uniq_Nonce_in_chain [dest]: \"Nonce k:parts {chain B ofr A L C} ==> k=ofr\"\nby (auto simp: chain_def sign_def)\n\nlemma uniq_Nonce_in_anchor [dest]: \"Nonce k:parts {anchor A n B} ==> k=n\"\nby (auto simp: anchor_def chain_def sign_def)\n\nlemma uniq_Nonce_in_reqm [dest]: \"[| Nonce k:parts {reqm A r n I B};\nI:agl |] ==> k=n\"\nby (auto simp: reqm_def dest: no_Nonce_in_agl)\n\nlemma uniq_Nonce_in_prom [dest]: \"[| Nonce k:parts {prom B ofr A r I L J C};\nI:agl; J:agl; Nonce k ~:parts {L} |] ==> k=ofr\"\nby (auto simp: prom_def dest: no_Nonce_in_agl no_Nonce_in_appdel)\n\nsubsection\\requests are guarded\\\n\nlemma req_imp_Guard [rule_format]: \"[| evs:p2; A ~:bad |] ==>\nreq A r n I B:set evs --> Guard n {priK A} (spies evs)\"\napply (erule p2.induct, simp)\napply (simp add: req_def knows.simps, safe)\napply (erule in_synth_Guard, erule Guard_analz, simp)\nby (auto simp: req_def pro_def dest: Says_imp_knows_Spy)\n\nlemma req_imp_Guard_Friend: \"[| evs:p2; A ~:bad; req A r n I B:set evs |]\n==> Guard n {priK A} (knows_max (Friend C) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule req_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsection\\propositions are guarded\\\n\nlemma pro_imp_Guard [rule_format]: \"[| evs:p2; B ~:bad; A ~:bad |] ==>\npro B ofr A r I (cons M L) J C:set evs --> Guard ofr {priK A} (spies evs)\"\napply (erule p2.induct) (* +3 subgoals *)\n(* Nil *)\napply simp\n(* Fake *)\napply (simp add: pro_def, safe) (* +4 subgoals *)\n(* 1 *)\napply (erule in_synth_Guard, drule Guard_analz, simp, simp)\n(* 2 *)\napply simp\n(* 3 *)\napply (simp, simp add: req_def pro_def, blast)\n(* 4 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* 5 *)\napply simp\napply safe (* +1 subgoal *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 6 *)\napply (simp add: pro_def)\napply (blast dest: Says_imp_knows_Spy)\n(* Request *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* Propose *)\napply simp\napply safe (* +1 subgoal *)\n(* 1 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 2 *)\napply (simp add: pro_def)\nby (blast dest: Says_imp_knows_Spy)\n\nlemma pro_imp_Guard_Friend: \"[| evs:p2; B ~:bad; A ~:bad;\npro B ofr A r I (cons M L) J C:set evs |]\n==> Guard ofr {priK A} (knows_max (Friend D) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule pro_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsection\\data confidentiality:\nno one other than the originator can decrypt the offers\\\n\nlemma Nonce_req_notin_spies: \"[| evs:p2; req A r n I B:set evs; A ~:bad |]\n==> Nonce n ~:analz (spies evs)\"\nby (frule req_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_req_notin_knows_max_Friend: \"[| evs:p2; req A r n I B:set evs;\nA ~:bad; A ~= Friend C |] ==> Nonce n ~:analz (knows_max (Friend C) evs)\"\napply (clarify, frule_tac C=C in req_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nlemma Nonce_pro_notin_spies: \"[| evs:p2; B ~:bad; A ~:bad;\npro B ofr A r I (cons M L) J C:set evs |] ==> Nonce ofr ~:analz (spies evs)\"\nby (frule pro_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_pro_notin_knows_max_Friend: \"[| evs:p2; B ~:bad; A ~:bad;\nA ~= Friend D; pro B ofr A r I (cons M L) J C:set evs |]\n==> Nonce ofr ~:analz (knows_max (Friend D) evs)\"\napply (clarify, frule_tac A=A in pro_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nsubsection\\forward privacy:\nonly the originator can know the identity of the shops\\\n\nlemma forward_privacy_Spy: \"[| evs:p2; B ~:bad; A ~:bad;\npro B ofr A r I (cons M L) J C:set evs |]\n==> sign B (Nonce ofr) ~:analz (spies evs)\"\nby (auto simp:sign_def dest: Nonce_pro_notin_spies)\n\nlemma forward_privacy_Friend: \"[| evs:p2; B ~:bad; A ~:bad; A ~= Friend D;\npro B ofr A r I (cons M L) J C:set evs |]\n==> sign B (Nonce ofr) ~:analz (knows_max (Friend D) evs)\"\nby (auto simp:sign_def dest:Nonce_pro_notin_knows_max_Friend )\n\nsubsection\\non repudiability: an offer signed by B has been sent by B\\\n\nlemma Crypt_reqm: \"[| Crypt (priK A) X:parts {reqm A' r n I B}; I:agl |] ==> A=A'\"\nby (auto simp: reqm_def anchor_def chain_def sign_def dest: no_Crypt_in_agl)\n\nlemma Crypt_prom: \"[| Crypt (priK A) X:parts {prom B ofr A' r I L J C};\nI:agl; J:agl |] ==> A=B | Crypt (priK A) X:parts {L}\"\napply (simp add: prom_def anchor_def chain_def sign_def)\nby (blast dest: no_Crypt_in_agl no_Crypt_in_appdel)\n\nlemma Crypt_safeness: \"[| evs:p2; A ~:bad |] ==> Crypt (priK A) X:parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & Crypt (priK A) X:parts {Y})\"\napply (erule p2.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (frule Crypt_reqm, simp, clarify)\napply (rule_tac x=B in exI, rule_tac x=\"reqm A r n I B\" in exI, simp, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (rotate_tac -1, erule disjE)\napply (frule Crypt_prom, simp, simp)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI, blast)\napply (subgoal_tac \"cons M L:parts (spies evsp)\")\napply (drule_tac G=\"{cons M L}\" and H=\"spies evsp\" in parts_trans, blast, blast)\napply (drule Says_imp_spies, rotate_tac -1, drule parts.Inj)\napply (drule parts.Snd, drule parts.Snd, drule parts.Snd)\nby auto\n\nlemma Crypt_Hash_imp_sign: \"[| evs:p2; A ~:bad |] ==>\nCrypt (priK A) (Hash X):parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})\"\napply (erule p2.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (frule Crypt_reqm, simp+)\napply (rule_tac x=B in exI, rule_tac x=\"reqm Aa r n I B\" in exI)\napply (simp add: reqm_def sign_def anchor_def no_Crypt_in_agl)\napply (simp add: chain_def sign_def, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (rotate_tac -1, erule disjE)\napply (simp add: prom_def sign_def no_Crypt_in_agl no_Crypt_in_appdel)\napply (simp add: chain_def sign_def)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI)\napply (simp add: prom_def chain_def sign_def)\napply (erule impE) \napply (blast dest: get_ML parts_sub) \napply (blast del: MPair_parts)+\ndone\n\nlemma sign_safeness: \"[| evs:p2; A ~:bad |] ==> sign A X:parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})\"\napply (clarify, simp add: sign_def, frule parts.Snd)\napply (blast dest: Crypt_Hash_imp_sign [unfolded sign_def])\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/P2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.2701138219752063}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory KHeapPre_AI\nimports \"./$L4V_ARCH/Machine_AI\"\nbegin\n\nprimrec\n same_caps :: \"Structures_A.kernel_object \\ Structures_A.kernel_object \\ bool\"\nwhere\n \"same_caps val (CNode sz cs) = (val = CNode sz cs)\"\n| \"same_caps val (TCB tcb) = (\\tcb'. val = TCB tcb'\n \\ (\\(getF, t) \\ ran tcb_cap_cases. getF tcb' = getF tcb))\"\n| \"same_caps val (Endpoint ep) = is_ep val\"\n| \"same_caps val (Notification ntfn) = is_ntfn val\"\n| \"same_caps val (ArchObj ao) = (\\ao'. val = ArchObj ao')\"\n\n\nlemma same_caps_more_simps[simp]:\n \"same_caps (CNode sz cs) val = (val = CNode sz cs)\"\n \"same_caps (TCB tcb) val = (\\tcb'. val = TCB tcb'\n \\ (\\(getF, t) \\ ran tcb_cap_cases. getF tcb' = getF tcb))\"\n \"same_caps (Endpoint ep) val = is_ep val\"\n \"same_caps (Notification ntfn) val = is_ntfn val\"\n \"same_caps (ArchObj ao) val = (\\ao'. val = ArchObj ao')\"\n by (cases val, (fastforce simp: is_obj_defs)+)+\n\nlemma dmo_return [simp]:\n \"do_machine_op (return x) = return x\"\n by (simp add: do_machine_op_def select_f_def return_def gets_def get_def\n bind_def modify_def put_def)\n\nlemma get_object_sp:\n \"\\P\\ get_object p \\\\r. P and ko_at r p\\\"\n apply (simp add: get_object_def)\n apply wp\n apply (auto simp add: obj_at_def)\n done\n\ndefinition non_arch_obj :: \"kernel_object \\ bool\" where\n \"non_arch_obj \\ \\ko. \\ako. ko \\ ArchObj ako\"\n\nlemma non_arch_objs[intro]:\n \"non_arch_obj (Endpoint ep)\"\n \"non_arch_obj (CNode sz cnode_contents)\"\n \"non_arch_obj (TCB tcb)\"\n \"non_arch_obj (Notification notification)\"\n by (auto simp add: non_arch_obj_def)\n\ndefinition arch_obj_pred :: \"(kernel_object \\ bool) \\ bool\" where\n \"arch_obj_pred P \\\n \\ko ko'. non_arch_obj ko \\ non_arch_obj ko' \\\n P ko = P ko'\"\n\nlemma arch_obj_predE:\n \"\\arch_obj_pred P; non_arch_obj ko; non_arch_obj ko'\\ \\ P ko = P ko'\"\n apply (unfold arch_obj_pred_def)\n apply (erule allE[where ?x=\"ko\"])\n apply (erule allE[where ?x=\"ko'\"])\n by blast\n\nlemmas arch_obj_pred_defs = non_arch_obj_def arch_obj_pred_def\n\nlemma arch_obj_pred_a_type[intro, simp]: \"arch_obj_pred (\\ko. a_type ko = AArch T)\"\n by (auto simp add: arch_obj_pred_defs a_type_def split: kernel_object.splits)\n\nlemma\n arch_obj_pred_arch_obj_l[intro, simp]: \"arch_obj_pred (\\ko. ArchObj ako = ko)\" and\n arch_obj_pred_arch_obj_r[intro, simp]: \"arch_obj_pred (\\ko. ko = ArchObj ako)\"\n by (auto simp add: arch_obj_pred_defs)\n\nlemma arch_obj_pred_fun_lift: \"arch_obj_pred (\\ko. F (arch_obj_fun_lift P N ko))\"\n by (simp add: arch_obj_pred_defs)\n\nlemmas arch_obj_pred_fun_lift_id[simp]\n = arch_obj_pred_fun_lift[where F=id, simplified]\n\nlemmas arch_obj_pred_fun_lift_k[intro]\n = arch_obj_pred_fun_lift[where F=\"K R\" for R, simplified]\n\nlemmas arch_obj_pred_fun_lift_el[simp]\n = arch_obj_pred_fun_lift[where F=\"\\ S. x \\ S\" for x, simplified]\n\nlemma arch_obj_pred_const_conjI[intro]:\n \"arch_obj_pred P \\\n arch_obj_pred P' \\\n arch_obj_pred (\\ko. P ko \\ P' ko)\"\n apply (simp only: arch_obj_pred_def)\n apply blast\n done\n\nlemma arch_obj_pred_fI:\n \"(\\x. arch_obj_pred (P x)) \\ arch_obj_pred (\\ko. f (\\x :: 'a :: type. P x ko))\"\n apply (simp only: arch_obj_pred_def)\n apply (intro allI impI)\n apply (rule arg_cong[where f=f])\n by blast\n\ndeclare\n arch_obj_pred_fI[where f=All, intro]\n arch_obj_pred_fI[where f=Ex, intro]\n\nlocale arch_only_obj_pred =\n fixes P :: \"kernel_object \\ bool\"\n assumes arch_only: \"arch_obj_pred P\"\n\nlemma set_object_typ_at [wp]:\n \"\\\\s. P (typ_at T p' s)\\\n set_object p ko \\\\rv s. P (typ_at T p' s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma set_object_neg_ko:\n \"\\not ko_at ko' p' and K (p = p' \\ ko \\ ko')\\\n set_object p ko\n \\\\_ s. \\ ko_at ko' p' s\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply (simp add: pred_neg_def obj_at_def)\n done\n\nlemma get_tcb_SomeD: \"get_tcb t s = Some v \\ kheap s t = Some (TCB v)\"\n apply (case_tac \"kheap s t\", simp_all add: get_tcb_def)\n apply (case_tac a, simp_all)\n done\n\nlemma get_tcb_at: \"tcb_at t s \\ (\\tcb. get_tcb t s = Some tcb)\"\n by (simp add: tcb_at_def)\n\nlemma typ_at_same_type:\n assumes \"typ_at T p s\" \"a_type k = a_type ko\" \"kheap s p' = Some ko\"\n shows \"typ_at T p (s\\kheap := kheap s(p' \\ k)\\)\"\n using assms\n by (clarsimp simp: obj_at_def)\n\n\nlemma hoare_to_pure_kheap_upd:\n assumes hoare[rule_format]:\n \"\\f. (\\P p T. \\\\s. P (typ_at (AArch T) p s)\\\n f \\\\r s. P (typ_at (AArch T) p s)\\) \\ \\P\\ f \\\\_. P\\\"\n assumes typ_eq: \"a_type k = a_type ko\"\n assumes valid: \"P (s :: ('z :: state_ext) state)\"\n assumes at: \"ko_at ko p s\"\n shows \"P (s\\kheap := kheap s(p \\ k)\\)\"\n apply (rule use_valid[where f=\"\n do\n s' <- get;\n assert (s' = s);\n (modify (\\s. s\\kheap := kheap s(p \\ k)\\));\n return undefined\n od\", OF _ hoare valid])\n apply (fastforce simp add: simpler_modify_def get_def bind_def\n assert_def return_def[abs_def] fail_def)[1]\n apply wp\n apply (insert typ_eq at)\n apply clarsimp\n apply (erule_tac P=P in rsubst)\n by (auto simp add: obj_at_def a_type_def split: kernel_object.splits if_splits)\n\nlemma set_object_wp:\n \"\\\\s. Q (s\\ kheap := kheap s (p \\ v)\\) \\ set_object p v \\\\_. Q\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply blast\n done\n\nlemma get_object_wp:\n \"\\\\s. \\ko. ko_at ko p s \\ Q ko s\\ get_object p \\Q\\\"\n apply (clarsimp simp: get_object_def)\n apply wp\n apply (clarsimp simp: obj_at_def)\n done\n\n(* FIXME: move *)\nlemma hoare_strengthen_pre_via_assert_forward:\n assumes pos: \"\\ P \\ f \\ Q \\\"\n assumes rel: \"\\s. S s \\ P s \\ N s\"\n assumes neg: \"\\ N \\ f \\ \\\\ \\\"\n shows \"\\ S \\ f \\ Q \\\"\n apply (rule hoare_weaken_pre)\n apply (rule hoare_strengthen_post)\n apply (rule hoare_vcg_disj_lift[OF pos neg])\n apply simp\n apply (erule rel)\n done\n\nlemma hoare_set_object_weaken_pre:\n assumes \"\\P\\ set_object p v \\\\_. Q\\\"\n shows \"\\\\s. \\ko. ko_at ko p s \\ (a_type v = a_type ko) \\ P s\\\n set_object p v\n \\\\_. Q\\\"\n apply (rule hoare_strengthen_pre_via_assert_forward\n [OF assms, where N=\"\\s. \\ko. ko_at ko p s \\ a_type ko \\ a_type v\"])\n apply fastforce\n apply (simp add: set_object_def)\n apply (rule hoare_seq_ext[OF _ get_object_sp])\n apply (rule hoare_seq_ext[OF _ assert_sp])\n apply (fastforce intro: hoare_weaken_pre[OF hoare_pre_cont])\n done\n\nlemmas set_object_wp_strong = hoare_set_object_weaken_pre[OF set_object_wp]\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/KHeapPre_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341024983754, "lm_q2_score": 0.42632159254749025, "lm_q1q2_score": 0.27003646644664375}} {"text": "(* Title: Jive Data and Store Model\n Author: Norbert Schirmer and \n Nicole Rauch , 2005\n Maintainer: Nicole Rauch \n License: LGPL\n*)\n\nsection \\The Direct Subtype Relation of Java Types\\\n\ntheory DirectSubtypes\nimports \"../Isabelle/JavaType\"\nbegin\n\ntext \\\nIn this theory, we formalize the direct subtype relations of the Java types (as defined\nin Sec. \\ref{java_typeid_definitions}) that appear in the program to be verified. Thus, this\ntheory has to be generated for each program.\n\\label{direct_subtype_relations}\n\\\n\ntext \\We have the following type hierarchy:\n\\begin{center}\n\\includegraphics[width=13cm]{TypeHierarchy}\n\\end{center}\nWe need to describe all direct subtype relations of this type hierarchy.\nAs you can see in the picture, all unnecessary direct subtype relations can be\nignored, e.g. the subclass relation between CounterImpl and Object, because it is \nadded\ntransitively by the widening relation of types (see Sec. \\ref{widening_subtypes}).\n\\\n\ntext \\\nWe have to specify the direct subtype relation between\n\\begin{itemize}\n\\item each ``leaf'' class or interface and its subtype \\texttt{NullT}\n\\item each ``root'' class or interface and its supertype \\texttt{Object}\n\\item each two types that are direct subtypes as specified in the code by\n\\texttt{extends} or \\texttt{implements}\n\\item each array type of a primitive type and its subtype \\texttt{NullT}\n\\item each array type of a primitive type and its supertype \\texttt{Object}\n\\item each array type of a ``leaf'' class or interface and its subtype \\texttt{NullT}\n\\item the array type \\texttt{Object[]} and its supertype \\texttt{Object}\n\\item two array types if their element types are in a subtype hierarchy\n\\end{itemize}\n\\\n\ndefinition direct_subtype :: \"(Javatype * Javatype) set\" where\n\"direct_subtype =\n{ (NullT, AClassT Dummy),\n (NullT, CClassT UndoCounter), \n (NullT, CClassT NullPointerException),\n (NullT, CClassT ClassCastException),\n\n (AClassT Dummy, CClassT Object),\n (InterfaceT Counter, CClassT Object),\n (CClassT Exception, CClassT Object), \n\n (CClassT UndoCounter, CClassT CounterImpl), \n (CClassT CounterImpl, InterfaceT Counter),\n (CClassT NullPointerException, CClassT Exception),\n (CClassT ClassCastException, CClassT Exception),\n\n (NullT, ArrT BoolAT),\n (NullT, ArrT IntgAT),\n (NullT, ArrT ShortAT),\n (NullT, ArrT ByteAT),\n (ArrT BoolAT, CClassT Object),\n (ArrT IntgAT, CClassT Object),\n (ArrT ShortAT, CClassT Object),\n (ArrT ByteAT, CClassT Object),\n\n (NullT, ArrT (AClassAT Dummy)),\n (NullT, ArrT (CClassAT UndoCounter)),\n (NullT, ArrT (CClassAT NullPointerException)),\n (NullT, ArrT (CClassAT ClassCastException)),\n\n (ArrT (CClassAT Object), CClassT Object),\n\n (ArrT (AClassAT Dummy), ArrT (CClassAT Object)),\n (ArrT (CClassAT CounterImpl), ArrT (InterfaceAT Counter)), \n (ArrT (InterfaceAT Counter), ArrT (CClassAT Object)),\n (ArrT (CClassAT Exception), ArrT (CClassAT Object)), \n (ArrT (CClassAT UndoCounter), ArrT (CClassAT CounterImpl)), \n (ArrT (CClassAT NullPointerException), ArrT (CClassAT Exception)),\n (ArrT (CClassAT ClassCastException), ArrT (CClassAT Exception))\n}\"\n\ntext \\This lemma is used later in the Simplifier.\\\n\nlemma direct_subtype:\n \"(NullT, AClassT Dummy) \\ direct_subtype\"\n \"(NullT, CClassT UndoCounter) \\ direct_subtype\" \n \"(NullT, CClassT NullPointerException) \\ direct_subtype\"\n \"(NullT, CClassT ClassCastException) \\ direct_subtype\"\n\n \"(AClassT Dummy, CClassT Object) \\ direct_subtype\"\n \"(InterfaceT Counter, CClassT Object) \\ direct_subtype\"\n \"(CClassT Exception, CClassT Object) \\ direct_subtype\" \n\n \"(CClassT UndoCounter, CClassT CounterImpl) \\ direct_subtype\" \n \"(CClassT CounterImpl, InterfaceT Counter) \\ direct_subtype\"\n \"(CClassT NullPointerException, CClassT Exception) \\ direct_subtype\"\n \"(CClassT ClassCastException, CClassT Exception) \\ direct_subtype\"\n\n \"(NullT, ArrT BoolAT) \\ direct_subtype\"\n \"(NullT, ArrT IntgAT) \\ direct_subtype\"\n \"(NullT, ArrT ShortAT) \\ direct_subtype\"\n \"(NullT, ArrT ByteAT) \\ direct_subtype\"\n \"(ArrT BoolAT, CClassT Object) \\ direct_subtype\"\n \"(ArrT IntgAT, CClassT Object) \\ direct_subtype\"\n \"(ArrT ShortAT, CClassT Object) \\ direct_subtype\"\n \"(ArrT ByteAT, CClassT Object) \\ direct_subtype\"\n\n \"(NullT, ArrT (AClassAT Dummy)) \\ direct_subtype\"\n \"(NullT, ArrT (CClassAT UndoCounter)) \\ direct_subtype\"\n \"(NullT, ArrT (CClassAT NullPointerException)) \\ direct_subtype\"\n \"(NullT, ArrT (CClassAT ClassCastException)) \\ direct_subtype\"\n\n \"(ArrT (CClassAT Object), CClassT Object) \\ direct_subtype\"\n\n \"(ArrT (AClassAT Dummy), ArrT (CClassAT Object)) \\ direct_subtype\"\n \"(ArrT (CClassAT CounterImpl), ArrT (InterfaceAT Counter)) \\ direct_subtype\" \n \"(ArrT (InterfaceAT Counter), ArrT (CClassAT Object)) \\ direct_subtype\"\n \"(ArrT (CClassAT Exception), ArrT (CClassAT Object)) \\ direct_subtype\" \n \"(ArrT (CClassAT UndoCounter), ArrT (CClassAT CounterImpl)) \\ direct_subtype\" \n \"(ArrT (CClassAT NullPointerException), ArrT (CClassAT Exception)) \\ direct_subtype\"\n \"(ArrT (CClassAT ClassCastException), ArrT (CClassAT Exception)) \\ direct_subtype\"\n by (simp_all add: direct_subtype_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JiveDataStoreModel/Isa_Counter/DirectSubtypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27003092000884227}} {"text": "theory MMU_Instants_TLB\nimports\n TLBJ.Simp_Lemmas\n TLBJ.ARM_Monadic\n \nbegin\n\nrecord non_det_tlb_state = state + \n non_det_tlb :: \"unit tlb\"\n\nrecord det_tlb_state = state + \n det_tlb :: \"unit tlb\"\n\nrecord sat_tlb_state = state + \n sat_tlb :: \"unit tlb\"\n\nrecord set_tlb_state = state + \n set_tlb :: \"vaddr set\"\n\n\ndefinition \n typ_non_det_tlb :: \"'a non_det_tlb_state_scheme \\ unit tlb state_scheme\"\nwhere\n \"typ_non_det_tlb s = state.extend (state.truncate s) (non_det_tlb s)\"\n\ndefinition \n typ_det_tlb :: \"'a det_tlb_state_scheme \\ unit tlb state_scheme\"\nwhere\n \"typ_det_tlb s = state.extend (state.truncate s) (det_tlb s)\"\n\ndefinition \n typ_sat_tlb :: \"'a sat_tlb_state_scheme \\ unit tlb state_scheme\"\nwhere\n \"typ_sat_tlb s = state.extend (state.truncate s) (sat_tlb s)\"\n\ndefinition \n typ_set_tlb :: \"'a set_tlb_state_scheme \\ vaddr set state_scheme\"\nwhere\n \"typ_set_tlb s = state.extend (state.truncate s) (set_tlb s)\"\n\n\nlemma non_det_tlb_more [simp]:\n \"state.more (typ_non_det_tlb s) = non_det_tlb s\"\n by (clarsimp simp: typ_non_det_tlb_def state.defs)\n\n\nlemma det_tlb_more [simp]:\n \"state.more (typ_det_tlb s) = det_tlb s\"\n by (clarsimp simp: typ_det_tlb_def state.defs)\n\n\nlemma sat_tlb_more [simp]:\n \"state.more (typ_sat_tlb s) = sat_tlb s\"\n by (clarsimp simp: typ_sat_tlb_def state.defs)\n\n\nlemma set_tlb_more [simp]:\n \"state.more (typ_set_tlb s) = set_tlb s\"\n by (clarsimp simp: typ_set_tlb_def state.defs)\n\n\nlemma non_det_tlb_truncate [simp]:\n \"state.truncate (typ_non_det_tlb s') = state.truncate s'\"\n by (clarsimp simp: typ_non_det_tlb_def state.defs)\n\nlemma det_tlb_truncate [simp]:\n \"state.truncate (typ_det_tlb s') = state.truncate s'\"\n by (clarsimp simp: typ_det_tlb_def state.defs)\n\nlemma sat_tlb_truncate [simp]:\n \"state.truncate (typ_sat_tlb s') = state.truncate s'\"\n by (clarsimp simp: typ_sat_tlb_def state.defs)\n\nlemma set_tlb_truncate [simp]:\n \"state.truncate (typ_set_tlb s') = state.truncate s'\"\n by (clarsimp simp: typ_set_tlb_def state.defs)\n\nlemma typ_non_det_prim_parameter [simp]:\n \"TTBR0 (typ_non_det_tlb s) = TTBR0 s \\ MEM (typ_non_det_tlb s) = MEM s \\ exception (typ_non_det_tlb s) = exception s\"\n by (clarsimp simp: typ_non_det_tlb_def state.defs)\n\n\nlemma typ_det_prim_parameter [simp]:\n \"TTBR0 (typ_det_tlb s) = TTBR0 s \\ MEM (typ_det_tlb s) = MEM s \\ exception (typ_det_tlb s) = exception s\"\n by (clarsimp simp: typ_det_tlb_def state.defs)\n\n\nlemma typ_sat_prim_parameter [simp]:\n \"TTBR0 (typ_sat_tlb s) = TTBR0 s \\ MEM (typ_sat_tlb s) = MEM s \\ exception (typ_sat_tlb s) = exception s\"\n by (clarsimp simp: typ_sat_tlb_def state.defs)\n\n\nlemma typ_set_prim_parameter [simp]:\n \"TTBR0 (typ_set_tlb s) = TTBR0 s \\ MEM (typ_set_tlb s) = MEM s \\ exception (typ_set_tlb s) = exception s\"\n by (clarsimp simp: typ_set_tlb_def state.defs)\n\n\nabbreviation\n \"consistent (s:: unit tlb_entry set state_scheme) \\\n consistent0 (lookup' (state.more s)) (pt_walk () (MEM s) (TTBR0 s))\"\n\n\ndefinition\n saturated :: \"unit tlb_entry set state_scheme \\ bool\"\nwhere\n \"saturated s \\ the ` {e\\pt_walk () (MEM s) (TTBR0 s) ` UNIV. \\is_fault e} \\ state.more s\"\n\n\ndefinition \n tlb_rel_det :: \"unit tlb_entry set state_scheme \\ unit tlb_entry set state_scheme \\ bool\"\nwhere \n \"tlb_rel_det s t \\ state.truncate s = state.truncate t \\ state.more s \\ state.more t\"\n\ndefinition \n tlb_rel_sat :: \"unit tlb_entry set state_scheme \\ unit tlb_entry set state_scheme \\ bool\"\nwhere \n \"tlb_rel_sat s t \\ state.truncate s = state.truncate t \\ state.more s \\ state.more t \\ saturated t\"\n\n\ndefinition \n inconsistent_vaddrs :: \"unit tlb_entry set state_scheme \\ vaddr set\"\nwhere \n \"inconsistent_vaddrs s \\ {va. lookup' (state.more s) va = Incon}\"\n\n\n\ndefinition \n incoherrent_vaddrs :: \"unit tlb_entry set state_scheme \\ vaddr set\"\nwhere \n \"incoherrent_vaddrs s \\ {va. \\x. lookup' (state.more s) va = Hit x \\ is_fault (pt_walk () (MEM s) (TTBR0 s) va)} \"\n\n\ndefinition \n incon_addrs :: \"unit tlb_entry set state_scheme \\ vaddr set\"\nwhere \n \"incon_addrs s \\ inconsistent_vaddrs s \\ incoherrent_vaddrs s\"\n\n\ndefinition \n tlb_rel_abs :: \"unit tlb_entry set state_scheme \\ vaddr set state_scheme \\ bool\"\nwhere \n\"tlb_rel_abs s t \\ state.truncate s = state.truncate t \\ incon_addrs s \\ state.more t \\ saturated s\" \n\n\ndeclare return_def [simp add]\ndeclare bind_def [simp add]\ndeclare read_state_def [simp add]\ndeclare update_state_def [simp add]\ndeclare extend_state_def [simp add]\ndeclare trim_state_def [simp add]\n\nlemma tlb_rel_detD:\n \"tlb_rel_det s t \\ MEM t = MEM s \\ TTBR0 t = TTBR0 s \\ state.more s \\ state.more t \\ exception t = exception s\"\n by (clarsimp simp: tlb_rel_det_def state.defs)\n\nlemma tlb_rel_satD:\n \"tlb_rel_sat s t \\ MEM t = MEM s \\ TTBR0 t = TTBR0 s \\ state.more s \\ state.more t \\ exception t = exception s \\ saturated t\"\n by (clarsimp simp: tlb_rel_sat_def state.defs)\n\nlemma tlb_rel_det_consistent:\n \"\\ tlb_rel_det s t; consistent t va \\ \\ consistent s va\"\n by (insert tlb_rel_detD [of s t] , clarsimp ,drule tlb_mono [of _ _ \"va\"] ,auto simp: consistent0_def less_eq_lookup_type)\n\n\nlemma tlb_rel_sat_consistent:\n \"\\ tlb_rel_sat s t; consistent t va \\ \\ consistent s va\"\n by (insert tlb_rel_satD [of s t] , clarsimp ,drule tlb_mono [of _ _ \"va\"] ,auto simp: consistent0_def less_eq_lookup_type)\n\nlemma sat_state_tlb:\n \"saturated s \\ state.more s = state.more s \\ the ` {e \\ range (pt_walk () (MEM s) (TTBR0 s)). \\ is_fault e}\"\n by (fastforce simp: saturated_def)\n\n\nlemma saturated_tlb_pde:\n \"saturated (typ_sat_tlb s) \\ (sat_tlb s) = sat_tlb s \\ the ` {e\\pt_walk () (MEM s) (TTBR0 s) ` UNIV. \\is_fault e}\"\n apply (clarsimp simp: saturated_def fst_def) apply (cases s ; clarsimp) by blast\n\n\nlemma sat_miss_fault:\n \"\\ saturated (typ_sat_tlb s); lookup' (sat_tlb s) va = Miss \\ \\ \n is_fault (pt_walk () (MEM s) (TTBR0 s) va)\"\n apply (subgoal_tac \" lookup' ((sat_tlb s) \\ the ` {e \\ range (pt_walk () (MEM s) (TTBR0 s)). \\ is_fault e}) va = Miss\")\n apply (thin_tac \"lookup' ((sat_tlb s)) va = Miss\")\n apply (drule lookup_miss_union)\n apply clarsimp\n apply (drule lookup_miss_is_fault)\n apply clarsimp\n using sat_state_tlb by force\n\n\nlemma saturatd_lookup_hit_no_fault:\n \"\\saturated (typ_sat_tlb s); \n lookup' (sat_tlb s) b = Hit x; \\ is_fault (pt_walk () (MEM s) (TTBR0 s) b)\\ \\\n x = the (pt_walk () (MEM s) (TTBR0 s) b)\"\n apply (subgoal_tac \"lookup'(sat_tlb s \\ \n the ` {e \\ range (pt_walk () (MEM s) (TTBR0 s)). \\ is_fault e}) ( b) = Hit x\")\n prefer 2\n apply (drule sat_state_tlb, clarsimp simp: state.defs)\n apply (drule lookup_hit_miss_or_hit')\n apply (erule disjE)\n apply (clarsimp simp: lookup_range_pt_walk_hit)\n apply (frule lookup_range_fault_pt_walk)\n apply (drule_tac x = b in bspec; clarsimp simp: lookup_hit_entry_range)\n done\n\nlemma saturated_tlb:\n \"saturated (typ_sat_tlb s) \\ sat_tlb s = sat_tlb s \\ the ` {e\\pt_walk () (MEM s) (TTBR0 s) ` UNIV. \\is_fault e} \"\n apply (clarsimp simp: saturated_def fst_def) apply (cases s ; clarsimp) by blast\n\n\nlemma write_mem_eq_TLB:\n \"\\ write'mem1 (val, va, sz) s = ((), s') \\ \\ state.more s' = state.more s\"\n by (clarsimp simp: write'mem1_def raise'exception_def split: if_split_asm)\n\n\nlemma write_same_mem:\n \"\\ write'mem1 (val, va, sz) s = ((), s') ; write'mem1 (val, va, sz) t = ((), t') ;\n MEM s = MEM t\\ \\ MEM s' = MEM t'\"\n by (clarsimp simp: write'mem1_def raise'exception_def split:if_split_asm)\n\nlemma write_same_mem_excep:\n \"\\ write'mem1 (val, pa, sz) s = ((), s') ; write'mem1 (val, pa, sz) t = ((), t') ;\n MEM s = MEM t ; exception s = exception t \\ \\ exception s' = exception t'\"\n by (clarsimp simp: write'mem1_def raise'exception_def split:if_split_asm)\n\n\nlemma write_mem_rel:\n \"\\ write'mem1 (val, va, sz) s = ((), s') \\ \\ s' = s \\ MEM:= MEM s' , exception:= exception s' \\\"\n by (clarsimp simp: write'mem1_def raise'exception_def split: if_split_asm)\n\nlemma not_member_incon_consistent:\n \"\\va \\ incon_addrs (typ_sat_tlb s) ; saturated (typ_sat_tlb s) \\ \\ \n consistent (typ_sat_tlb s) va\"\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def consistent0_def)\n apply (erule disjE)\n apply (rule conjI)\n apply (meson lookup_type.exhaust )\n apply (meson lookup_type.exhaust) \n using not_miss_incon_hit saturatd_lookup_hit_no_fault by blast\n \n\nlemma tlb_rel_abs_consistent [simp]:\n \"\\va \\ set_tlb t ; tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t) \\ \\ \n consistent (typ_sat_tlb s) va \" \n apply (rule not_member_incon_consistent ; clarsimp simp: tlb_rel_abs_def) \n by blast\n\n\nlemma tlb_rel_absD:\n \"tlb_rel_abs s t \\ MEM t = MEM s \\ TTBR0 t = TTBR0 s \\ saturated s \\ \n incon_addrs s \\ state.more t \\ exception t = exception s\"\n by (clarsimp simp: tlb_rel_abs_def state.defs)\n\n\n(* ARM Monadic Simplification Lemmas *)\n\nlemma mem1_exception:\n \"mem1 p s = (val, t) \\ t = s\\exception := exception t\\\"\n apply (clarsimp simp: mem1_def)\n apply (cases \"MEM s p\")\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply clarsimp\ndone\n\n\nlemma mem1_read_exception:\n \"mem_read1 (a, sz) b = (val, r) \\ r = b \\exception := exception r\\\"\n apply (clarsimp simp: mem_read1_def)\n apply (clarsimp split: if_split_asm)\n apply (case_tac \"mem1 (a r+ 0) b\" , clarsimp)\n apply (clarsimp simp: mem1_exception)\n apply (case_tac \"mem1 (a r+ 1) b\" , clarsimp)\n apply (case_tac \"mem1 (a r+ 0) ba\", clarsimp)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (cases b, case_tac ba, cases r ,clarsimp)\n apply (case_tac \"mem1 (a r+ 3) b\" , clarsimp)\n apply (case_tac \"mem1 (a r+ 2) ba\", clarsimp)\n apply (case_tac \"mem1 (a r+ 1) baa\", clarsimp)\n apply (case_tac \"mem1 (a r+ 0) bb\", clarsimp)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (cases b, case_tac ba, case_tac baa, case_tac bb , cases r ,clarsimp)\n apply (case_tac \"mem1 (a r+ 7) b\" , clarsimp)\n apply (case_tac \"mem1 (a r+ 6) ba\", clarsimp)\n apply (case_tac \"mem1 (a r+ 5) baa\", clarsimp)\n apply (case_tac \"mem1 (a r+ 4) bb\", clarsimp)\n apply (case_tac \"mem1 (a r+ 3) bc\", clarsimp)\n apply (case_tac \"mem1 (a r+ 2) bd\", clarsimp)\n apply (case_tac \"mem1 (a r+ 1) be\", clarsimp)\n apply (case_tac \"mem1 (a r+ 0) bf\", clarsimp)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (drule mem1_exception)\n apply (cases b, case_tac ba, case_tac baa, case_tac bb ,case_tac bc ,\n case_tac bd , case_tac be , case_tac bf , cases r ,clarsimp)\n apply (clarsimp simp: raise'exception_def split:if_split_asm)\ndone\n\nlemma write_mem_state_trun_equal:\n \"\\ write'mem1 (val, pa, sz) s = ((), s'); write'mem1 (val, pa, sz) t = ((), t'); \n state.truncate s = state.truncate t \\ \\ state.truncate s' = state.truncate t'\"\n apply (frule write_mem_rel)\n apply rotate_tac\n apply (frule write_mem_rel)\n apply (subgoal_tac \"MEM s' = MEM t' \\ exception s' = exception t'\")\n apply clarsimp\n apply (cases s, cases t, cases s', cases t', clarsimp simp: state.defs)\n apply (cases s, cases t, cases s', cases t', clarsimp simp: state.defs)\n apply (clarsimp simp: write'mem1_def Let_def state.defs raise'exception_def split:if_split_asm)\n done\n\nlemma write_mem1_eq_ASID_TTBR0:\n \"\\ write'mem1 (val, va, sz) s = ((), s') \\ \\ TTBR0 s' = TTBR0 s\"\n by (clarsimp simp: write'mem1_def raise'exception_def split: if_split_asm)\n\nlemma tlb_sat_set_mem1 [simp]:\n \"sat_tlb (snd (mem1 ps s)) = sat_tlb s\"\n by (simp add: mem1_def raise'exception_def split: option.splits)\n\n\n\nconsts tlb_evict :: \"'a state_scheme \\ 'a\"\n\n\ninstantiation non_det_tlb_state_ext :: (type) mmu \nbegin\n definition \n \"(mmu_translate va :: ('a non_det_tlb_state_scheme \\ _))\n = do {\n update_state (\\s. s\\ non_det_tlb := non_det_tlb s - tlb_evict (typ_non_det_tlb s) \\);\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n tlb <- read_state non_det_tlb;\n case lookup' tlb va of \n Hit entry \\ return (va_to_pa va entry)\n | Miss \\ \n do { \n let entry = pt_walk () mem ttbr0 va;\n if is_fault entry \n then raise'exception (PAGE_FAULT ''more info'')\n else do {\n update_state (\\s. s\\ non_det_tlb := non_det_tlb s \\ {the entry} \\);\n return (va_to_pa va (the entry)) } }\n | Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'') \n }\"\n\nthm mmu_translate_non_det_tlb_state_ext_def \n\ndefinition\n \"(mmu_read_size :: (vaddr \\ nat \\ 'a non_det_tlb_state_scheme \\ bool list \\ 'a non_det_tlb_state_scheme))\n \\ \\(va,size). do {\n pa \\ mmu_translate va :: ('a non_det_tlb_state_scheme \\ _);\n mem_read1 (pa , size)\n }\"\n\ndefinition \n \"(mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a non_det_tlb_state_scheme \\ unit \\ 'a non_det_tlb_state_scheme))\n \\ \\(value, va, size). do {\n pa <- mmu_translate va :: ('a non_det_tlb_state_scheme \\ _);\n exception <- read_state exception;\n if exception = NoException \n then write'mem1 (value, pa, size)\n else return ()\n }\"\n(* print_context *) \n\n\ndefinition\n \"(update_TTBR0 r :: ('a non_det_tlb_state_scheme \\ _)) = \ndo {\n update_state (\\s. s\\ TTBR0 := r \\)\n } \"\n\ndefinition \n \"(flush f :: ('a non_det_tlb_state_scheme \\ _)) \\ \n case f of FlushTLB \\ update_state (\\s. s\\ non_det_tlb := {} \\)\n | Flushvarange vset \\ do {\n update_state (\\s. s\\ non_det_tlb := flush_tlb_vset (non_det_tlb s) vset \\)}\"\n \n instance ..\nend\n\n \ninstantiation det_tlb_state_ext :: (_) mmu \nbegin\n definition \n \"(mmu_translate va :: ('a det_tlb_state_scheme \\ _))\n = do {\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n tlb <- read_state det_tlb;\n case lookup' tlb va of \n Hit entry \\ return (va_to_pa va entry)\n | Miss \\ \n do { \n let entry = pt_walk () mem ttbr0 va;\n if is_fault entry \n then raise'exception (PAGE_FAULT ''more info'')\n else do {\n update_state (\\s. s\\ det_tlb := det_tlb s \\ {the entry} \\);\n return (va_to_pa va (the entry)) } }\n | Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'') \n }\"\n\nthm mmu_translate_non_det_tlb_state_ext_def \n\ndefinition\n \"(mmu_read_size :: (vaddr \\ nat \\ 'a det_tlb_state_scheme \\ bool list \\ 'a det_tlb_state_scheme))\n \\ \\(va,size). do {\n pa \\ mmu_translate va :: ('a det_tlb_state_scheme \\ _);\n mem_read1 (pa , size)\n }\"\n\ndefinition \n \"(mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a det_tlb_state_scheme \\ unit \\ 'a det_tlb_state_scheme))\n \\ \\(value, va, size). do {\n pa <- mmu_translate va :: ('a det_tlb_state_scheme \\ _);\n exception <- read_state exception;\n if exception = NoException \n then write'mem1 (value, pa, size)\n else return ()\n }\"\n(* print_context *) \n\n\ndefinition\n \"(update_TTBR0 r :: ('a det_tlb_state_scheme \\ _)) = \ndo {\n update_state (\\s. s\\ TTBR0 := r \\)\n } \"\n\ndefinition \n \"(flush f :: ('a det_tlb_state_scheme \\ _)) \\ \n case f of FlushTLB \\ update_state (\\s. s\\ det_tlb := {} \\)\n | Flushvarange vset \\ do {\n update_state (\\s. s\\ det_tlb := flush_tlb_vset (det_tlb s) vset \\)}\"\n \n instance ..\nend\n\n\n\ninstantiation sat_tlb_state_ext :: (_) mmu \nbegin\n definition \n \"(mmu_translate va :: ('a sat_tlb_state_scheme \\ _))\n = do {\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n let tlb_new = the ` {e\\pt_walk () mem ttbr0 ` UNIV. \\is_fault e};\n tlb <- read_state sat_tlb;\n let sat_tlb' = tlb \\ tlb_new;\n update_state (\\s. s\\ sat_tlb := sat_tlb' \\);\n case lookup' sat_tlb' va of \n Hit entry \\ return (va_to_pa va entry)\n | Miss \\ raise'exception (PAGE_FAULT ''more info'') \n | Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'') \n }\"\n\nthm mmu_translate_non_det_tlb_state_ext_def \n\ndefinition\n \"(mmu_read_size :: (vaddr \\ nat \\ 'a sat_tlb_state_scheme \\ bool list \\ 'a sat_tlb_state_scheme))\n \\ \\(va,size). do {\n pa \\ mmu_translate va :: ('a sat_tlb_state_scheme \\ _);\n mem_read1 (pa , size)\n }\"\n\ndefinition \n \"(mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a sat_tlb_state_scheme \\ unit \\ 'a sat_tlb_state_scheme))\n \\ \\(value, va, size). do {\n ttbr0 <- read_state TTBR0;\n pa <- mmu_translate va :: ('a sat_tlb_state_scheme \\ _);\n tlb <- read_state sat_tlb;\n exception <- read_state exception;\n if exception = NoException \n then do {\n write'mem1 (value, pa, size);\n mem' <- read_state MEM;\n let tlb_new = the ` {e\\pt_walk () mem' ttbr0 ` UNIV. \\is_fault e};\n update_state (\\s. s\\ sat_tlb := tlb \\ tlb_new \\) }\n else return ()\n }\"\n(* print_context *) \n\n\ndefinition\n \"(update_TTBR0 r :: ('a sat_tlb_state_scheme \\ _)) = \ndo {\n update_state (\\s. s\\ TTBR0 := r \\);\n mem <- read_state MEM;\n let all_entries = the ` {e\\pt_walk () mem r ` UNIV. \\is_fault e};\n tlb <- read_state sat_tlb;\n update_state (\\s. s\\ sat_tlb := tlb \\ all_entries \\)}\"\n\ndefinition \n \"(flush f :: ('a sat_tlb_state_scheme \\ _)) \\ \n case f of FlushTLB \\ do {update_state (\\s. s\\ sat_tlb := {} \\);\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n let tlb_new = the ` {e\\pt_walk () mem ttbr0 ` UNIV. \\is_fault e};\n update_state (\\s. s\\ sat_tlb := tlb_new \\)}\n | Flushvarange vset \\ do {\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n let tlb_new = the ` {e\\pt_walk () mem ttbr0 ` UNIV. \\is_fault e};\n tlb_pde <- read_state sat_tlb;\n update_state (\\s. s\\ sat_tlb := flush_tlb_vset tlb_pde vset \\ tlb_new \\)}\"\n\n instance ..\nend\n\n(*definition\n ptable_comp :: \"(vaddr \\ pt_walk_typ) \\ (vaddr \\ pt_walk_typ) \\ vaddr set\"\nwhere\n \"ptable_comp walk walk' \\ {va. \\(walk va \\ walk' va)}\"\n*)\n\ndefinition\n ptable_comp :: \"(vaddr \\ unit tlb_entry option) \\ (vaddr \\ unit tlb_entry option) \\ vaddr set\"\nwhere\n \"ptable_comp wlk wlk' \\ {va. \\ is_fault (wlk va) \\ \\ is_fault (wlk' va) \\ wlk va \\ wlk' va \\ \n \\ is_fault (wlk va) \\ is_fault (wlk' va)}\"\n\n\ndefinition\n incon_comp :: \" heap \\ heap \\ paddr \\ paddr \\ vaddr set\"\nwhere\n \"incon_comp hp hp' rt rt' \\ ptable_comp (pt_walk () hp rt) (pt_walk () hp' rt')\"\n\n\ninstantiation set_tlb_state_ext :: (_) mmu \nbegin\n definition \n \"(mmu_translate va :: ('a set_tlb_state_scheme \\ _))\n = do {\n mem <- read_state MEM;\n ttbr0 <- read_state TTBR0;\n incon_vaddrs <- read_state set_tlb;\n if va \\ incon_vaddrs\n then raise'exception (IMPLEMENTATION_DEFINED ''set on fire'')\n else let entry = pt_walk () mem ttbr0 va in \n if is_fault entry\n then raise'exception (PAGE_FAULT ''more info'')\n else return (va_to_pa va (the entry))\n }\"\n\n \n\ndefinition\n \"(mmu_read_size :: (vaddr \\ nat \\ 'a set_tlb_state_scheme \\ bool list \\ 'a set_tlb_state_scheme))\n \\ \\(va,size). do {\n pa \\ mmu_translate va :: ('a set_tlb_state_scheme \\ _);\n mem_read1 (pa , size)\n }\"\n\ndefinition \n \"(mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a set_tlb_state_scheme \\ unit \\ 'a set_tlb_state_scheme))\n \\ \\(value, va, size). do {\n ttbr0 <- read_state TTBR0;\n mem <- read_state MEM; \n paddr <- mmu_translate va :: ('a set_tlb_state_scheme \\ _);\n incon_vaddrs <- read_state set_tlb; \n exception <- read_state exception;\n if exception = NoException \n then do {\n write'mem1 (value, paddr, size);\n mem' <- read_state MEM; \n let ptable_comp = incon_comp mem mem' ttbr0 ttbr0;\n let incon_vaddrs_new = incon_vaddrs \\ ptable_comp;\n update_state (\\s. s\\ set_tlb := incon_vaddrs_new \\)\n }\n else return ()\n }\"\n \n\ndefinition\n \"(update_TTBR0 r :: ('a set_tlb_state_scheme \\ _)) = \ndo {\n ttbr0 <- read_state TTBR0;\n update_state (\\s. s\\ TTBR0 := r \\);\n incon_vaddrs <- read_state set_tlb;\n mem <- read_state MEM;\n let ptable_comp = incon_comp mem mem ttbr0 r; \n let incon_vaddrs_new = incon_vaddrs \\ ptable_comp;\n update_state (\\s. s\\ set_tlb := incon_vaddrs_new \\)\n}\"\n\n\ndefinition \n \"(flush f :: ('a set_tlb_state_scheme \\ _)) \\ \n case f of FlushTLB \\ update_state (\\s. s\\ set_tlb := {} \\)\n | Flushvarange vset \\ do {\n incon_vaddrs <- read_state set_tlb;\n update_state (\\s. s\\ set_tlb := incon_vaddrs -vset\\)}\"\n\n instance ..\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_No_ASID/MMU_Instants_TLB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.27003091375399757}} {"text": "theory IICF_MS_Array_List\nimports \n \"../Intf/IICF_List\" \n Separation_Logic_Imperative_HOL.Array_Blit\n \"../../../Separation_Logic_Imperative_HOL/Examples/Default_Insts\"\nbegin\n\n type_synonym 'a ms_array_list = \"'a Heap.array \\ nat\"\n\n definition \"is_ms_array_list ms l \\ \\(a,n). \\\\<^sub>Al'. a \\\\<^sub>a l' * \\(n \\ length l' \\ l = take n l' \\ ms=length l')\"\n\n lemma is_ms_array_list_prec[safe_constraint_rules]: \"precise (is_ms_array_list ms)\"\n unfolding is_ms_array_list_def[abs_def]\n apply(rule preciseI)\n apply(simp split: prod.splits) \n \tusing preciseD snga_prec by fastforce\n\n definition \"marl_empty_sz maxsize \\ do {\n a \\ Array.new maxsize default;\n return (a,0)\n }\"\n\n definition \"marl_append \\ \\(a,n) x. do {\n a \\ Array.upd n x a;\n return (a,n+1)\n }\"\n\n definition marl_length :: \"'a::heap ms_array_list \\ nat Heap\" where\n \"marl_length \\ \\(a,n). return (n)\"\n\n definition marl_is_empty :: \"'a::heap ms_array_list \\ bool Heap\" where\n \"marl_is_empty \\ \\(a,n). return (n=0)\"\n\n definition marl_last :: \"'a::heap ms_array_list \\ 'a Heap\" where\n \"marl_last \\ \\(a,n). do {\n Array.nth a (n - 1)\n }\"\n\n definition marl_butlast :: \"'a::heap ms_array_list \\ 'a ms_array_list Heap\" where\n \"marl_butlast \\ \\(a,n). do {\n return (a,n - 1)\n }\"\n\n definition marl_get :: \"'a::heap ms_array_list \\ nat \\ 'a Heap\" where\n \"marl_get \\ \\(a,n) i. Array.nth a i\"\n\n definition marl_set :: \"'a::heap ms_array_list \\ nat \\ 'a \\ 'a ms_array_list Heap\" where\n \"marl_set \\ \\(a,n) i x. do { a \\ Array.upd i x a; return (a,n)}\"\n\n lemma marl_empty_sz_rule[sep_heap_rules]: \"< emp > marl_empty_sz N \"\n by (sep_auto simp: marl_empty_sz_def is_ms_array_list_def)\n\n lemma marl_append_rule[sep_heap_rules]: \"length l < N \\\n < is_ms_array_list N l a > \n marl_append a x \n <\\a. is_ms_array_list N (l@[x]) a >\\<^sub>t\" \n by (sep_auto \n simp: marl_append_def is_ms_array_list_def take_update_last \n split: prod.splits)\n \n lemma marl_length_rule[sep_heap_rules]: \"\n \n marl_length a\n <\\r. is_ms_array_list N l a * \\(r=length l)>\"\n by (sep_auto simp: marl_length_def is_ms_array_list_def)\n \n lemma marl_is_empty_rule[sep_heap_rules]: \"\n \n marl_is_empty a\n <\\r. is_ms_array_list N l a * \\(r\\(l=[]))>\"\n by (sep_auto simp: marl_is_empty_def is_ms_array_list_def)\n\n lemma marl_last_rule[sep_heap_rules]: \"\n l\\[] \\\n \n marl_last a\n <\\r. is_ms_array_list N l a * \\(r=last l)>\"\n by (sep_auto simp: marl_last_def is_ms_array_list_def last_take_nth_conv)\n \n lemma marl_butlast_rule[sep_heap_rules]: \"\n l\\[] \\\n \n marl_butlast a\n \\<^sub>t\"\n by (sep_auto \n split: prod.splits\n simp: marl_butlast_def is_ms_array_list_def butlast_take)\n\n lemma marl_get_rule[sep_heap_rules]: \"\n i\n \n marl_get a i\n <\\r. is_ms_array_list N l a * \\(r=l!i)>\"\n by (sep_auto simp: marl_get_def is_ms_array_list_def split: prod.split)\n\n lemma marl_set_rule[sep_heap_rules]: \"\n i\n \n marl_set a i x\n \"\n by (sep_auto simp: marl_set_def is_ms_array_list_def split: prod.split)\n\n definition \"marl_assn N A \\ hr_comp (is_ms_array_list N) (\\the_pure A\\list_rel)\"\n lemmas [safe_constraint_rules] = CN_FALSEI[of is_pure \"marl_assn N A\" for N A]\n\ncontext \n notes [fcomp_norm_unfold] = marl_assn_def[symmetric]\n notes [intro!] = hfrefI hn_refineI[THEN hn_refine_preI]\n notes [simp] = pure_def hn_ctxt_def invalid_assn_def\nbegin \n\n definition [simp]: \"op_marl_empty_sz (N::nat) \\ op_list_empty\"\n context fixes N :: nat begin\n sepref_register \"PR_CONST (op_marl_empty_sz N)\"\n end\n\n \n\n lemma marl_fold_custom_empty_sz: \n \"op_list_empty = op_marl_empty_sz N\"\n \"mop_list_empty = RETURN (op_marl_empty_sz N)\"\n \"[] = op_marl_empty_sz N\"\n by auto\n\n lemma marl_empty_hnr_aux: \"(uncurry0 (marl_empty_sz N), uncurry0 (RETURN op_list_empty)) \\ unit_assn\\<^sup>k \\\\<^sub>a is_ms_array_list N\"\n by sep_auto\n lemmas marl_empty_hnr = marl_empty_hnr_aux[FCOMP op_list_empty.fref[of \"the_pure A\" for A]]\n lemmas marl_empty_hnr_mop = marl_empty_hnr[FCOMP mk_mop_rl0_np[OF mop_list_empty_alt]]\n\n lemma marl_empty_sz_hnr[sepref_fr_rules]:\n \"(uncurry0 (marl_empty_sz N), uncurry0 (RETURN (PR_CONST (op_marl_empty_sz N)))) \\ unit_assn\\<^sup>k \\\\<^sub>a marl_assn N A\"\n using marl_empty_hnr\n by simp\n\n lemma marl_append_hnr_aux: \"(uncurry marl_append,uncurry (RETURN oo op_list_append)) \\ [\\(l,_). length la ((is_ms_array_list N)\\<^sup>d *\\<^sub>a id_assn\\<^sup>k) \\ is_ms_array_list N\"\n by sep_auto\n lemmas marl_append_hnr[sepref_fr_rules] = marl_append_hnr_aux[FCOMP op_list_append.fref]\n lemmas marl_append_hnr_mop[sepref_fr_rules] = marl_append_hnr[FCOMP mk_mop_rl2_np[OF mop_list_append_alt]]\n\n lemma marl_length_hnr_aux: \"(marl_length,RETURN o op_list_length) \\ (is_ms_array_list N)\\<^sup>k \\\\<^sub>a nat_assn\"\n by sep_auto\n lemmas marl_length_hnr[sepref_fr_rules] = marl_length_hnr_aux[FCOMP op_list_length.fref[of \"the_pure A\" for A]]\n lemmas marl_length_hnr_mop[sepref_fr_rules] = marl_length_hnr[FCOMP mk_mop_rl1_np[OF mop_list_length_alt]]\n\n lemma marl_is_empty_hnr_aux: \"(marl_is_empty,RETURN o op_list_is_empty) \\ (is_ms_array_list N)\\<^sup>k \\\\<^sub>a bool_assn\"\n by sep_auto\n lemmas marl_is_empty_hnr[sepref_fr_rules] = marl_is_empty_hnr_aux[FCOMP op_list_is_empty.fref[of \"the_pure A\" for A]]\n lemmas marl_is_empty_hnr_mop[sepref_fr_rules] = marl_is_empty_hnr[FCOMP mk_mop_rl1_np[OF mop_list_is_empty_alt]]\n\n lemma marl_last_hnr_aux: \"(marl_last,RETURN o op_list_last) \\ [\\x. x\\[]]\\<^sub>a (is_ms_array_list N)\\<^sup>k \\ id_assn\"\n by sep_auto\n lemmas marl_last_hnr[sepref_fr_rules] = marl_last_hnr_aux[FCOMP op_list_last.fref]\n lemmas marl_last_hnr_mop[sepref_fr_rules] = marl_last_hnr[FCOMP mk_mop_rl1[OF mop_list_last_alt]]\n\n lemma marl_butlast_hnr_aux: \"(marl_butlast,RETURN o op_list_butlast) \\ [\\x. x\\[]]\\<^sub>a (is_ms_array_list N)\\<^sup>d \\ (is_ms_array_list N)\"\n by sep_auto\n lemmas marl_butlast_hnr[sepref_fr_rules] = marl_butlast_hnr_aux[FCOMP op_list_butlast.fref[of \"the_pure A\" for A]]\n lemmas marl_butlast_hnr_mop[sepref_fr_rules] = marl_butlast_hnr[FCOMP mk_mop_rl1[OF mop_list_butlast_alt]]\n\n lemma marl_get_hnr_aux: \"(uncurry marl_get,uncurry (RETURN oo op_list_get)) \\ [\\(l,i). ia ((is_ms_array_list N)\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k) \\ id_assn\"\n by sep_auto\n lemmas marl_get_hnr[sepref_fr_rules] = marl_get_hnr_aux[FCOMP op_list_get.fref]\n lemmas marl_get_hnr_mop[sepref_fr_rules] = marl_get_hnr[FCOMP mk_mop_rl2[OF mop_list_get_alt]]\n\n lemma marl_set_hnr_aux: \"(uncurry2 marl_set,uncurry2 (RETURN ooo op_list_set)) \\ [\\((l,i),_). ia ((is_ms_array_list N)\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k) \\ (is_ms_array_list N)\"\n by sep_auto\n lemmas marl_set_hnr[sepref_fr_rules] = marl_set_hnr_aux[FCOMP op_list_set.fref]\n lemmas marl_set_hnr_mop[sepref_fr_rules] = marl_set_hnr[FCOMP mk_mop_rl3[OF mop_list_set_alt]]\n\nend\n\ncontext\n fixes N :: nat\n assumes N_sz: \"N>10\"\nbegin\n\nschematic_goal \"hn_refine (emp) (?c::?'c Heap) ?\\' ?R (do {\n let x = op_marl_empty_sz N;\n RETURN (x@[1::nat])\n})\" \n using N_sz\n by sepref\n\nend\n\nschematic_goal \"hn_refine (emp) (?c::?'c Heap) ?\\' ?R (do {\n let x = op_list_empty;\n RETURN (x@[1::nat])\n})\" \n apply (subst marl_fold_custom_empty_sz[where N=10])\n apply sepref\n done\n\nend\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/IICF/Impl/IICF_MS_Array_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.2699024039628502}} {"text": "(* \n Title: The pi-calculus \n Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Bisim_Pres\n imports Strong_Early_Bisim_Pres Weak_Early_Sim_Pres Weak_Early_Bisim_SC Weak_Early_Bisim\nbegin\n\n(************ Preservation rules ************)\n\nlemma tauPres:\n fixes P :: pi\n and Q :: pi\n\n assumes \"P \\ Q\"\n\n shows \"\\.(P) \\ \\.(Q)\"\nproof -\n let ?X = \"{(\\.(P), \\.(Q)) | P Q. P \\ Q}\"\n from `P \\ Q` have \"(\\.(P), \\.(Q)) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim P Q)\n thus ?case\n by(force intro: Weak_Early_Sim_Pres.tauPres)\n next\n case(cSym P Q)\n thus ?case by(force dest: Weak_Early_Bisim.symetric simp add: pi.inject)\n qed\nqed\n\nlemma outputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n\n assumes \"P \\ Q\"\n\n shows \"a{b}.P \\ a{b}.Q\"\nproof -\n let ?X = \"{(a{b}.(P), a{b}.(Q)) | P Q a b. P \\ Q}\"\n from `P \\ Q` have \"(a{b}.(P), a{b}.(Q)) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim P Q)\n thus ?case\n by(force intro: Weak_Early_Sim_Pres.outputPres)\n next\n case(cSym P Q)\n thus ?case by(force dest: Weak_Early_Bisim.symetric simp add: pi.inject)\n qed\nqed\n\nlemma inputPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and x :: name\n\n assumes PSimQ: \"\\y. P[x::=y] \\ Q[x::=y]\"\n \n shows \"a.P \\ a.Q\"\nproof -\n let ?X = \"{(a.P, a.Q) | a x P Q. \\y. P[x::=y] \\ Q[x::=y]}\"\n {\n fix axP axQ p\n assume \"(axP, axQ) \\ ?X\"\n then obtain a x P Q where A: \"\\y. P[x::=y] \\ Q[x::=y]\" and B: \"axP = a.P\" and C: \"axQ = a.Q\"\n by auto\n have \"\\y. ((p::name prm) \\ P)[(p \\ x)::=y] \\ (p \\ Q)[(p \\ x)::=y]\"\n proof -\n fix y\n from A have \"P[x::=(rev p \\ y)] \\ Q[x::=(rev p \\ y)]\"\n by blast\n hence \"(p \\ (P[x::=(rev p \\ y)])) \\ p \\ (Q[x::=(rev p \\ y)])\"\n by(rule eqvts)\n thus \"(p \\ P)[(p \\ x)::=y] \\ (p \\ Q)[(p \\ x)::=y]\"\n by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n qed\n hence \"((p::name prm) \\ axP, p \\ axQ) \\ ?X\" using B C\n by auto\n }\n hence \"eqvt ?X\" by(simp add: eqvt_def)\n\n from PSimQ have \"(a.P, a.Q) \\ ?X\" by auto\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim P Q)\n thus ?case using `eqvt ?X`\n by(force intro: Weak_Early_Sim_Pres.inputPres)\n next\n case(cSym P Q)\n thus ?case\n by(blast dest: weakBisimE)\n qed\nqed\n\n\n\n shows \"<\\x>P \\ <\\x>Q\"\nproof -\n let ?X = \"{(<\\x>P, <\\x>Q) | x P Q. P \\ Q}\"\n from `P \\ Q` have \"(<\\x>P, <\\x>Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim xP xQ)\n {\n fix P Q x\n assume \"P \\ Q\"\n hence \"P \\ Q\" by(rule weakBisimE)\n moreover have \"\\P Q x. P \\ Q \\ (<\\x>P, <\\x>Q) \\ ?X \\ weakBisim\" by blast\n moreover have \"weakBisim \\ ?X \\ weakBisim\" by blast\n moreover have \"eqvt weakBisim\" by simp\n moreover have \"eqvt (?X \\ weakBisim)\"\n by(auto simp add: eqvt_def dest: Weak_Early_Bisim.eqvtI)+\n ultimately have \"<\\x>P \\<(?X \\ weakBisim)> <\\x>Q\"\n by(rule Weak_Early_Sim_Pres.resPres)\n }\n with `(xP, xQ) \\ ?X` show ?case by blast\n next\n case(cSym xP xQ)\n thus ?case by(blast dest: Weak_Early_Bisim.symetric)\n qed\nqed\n\n\n\n assumes \"P \\ Q\"\n\n shows \"[a\\b]P \\ [a\\b]Q\"\nproof -\n let ?X = \"{([a\\b]P, [a\\b]Q) | a b P Q. P \\ Q}\"\n from `P \\ Q` have \"([a\\b]P, [a\\b]Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim abP abQ)\n {\n fix P Q a b\n assume \"P \\ Q\"\n hence \"P \\ Q\" by(rule weakBisimE)\n moreover have \"weakBisim \\ (?X \\ weakBisim)\" by blast\n moreover have \"\\P Q a. P \\ Q \\ [a\\a]P \\ Q\"\n by (metis (full_types) strongBisimWeakBisim Strong_Early_Bisim_SC.matchId Weak_Early_Bisim.transitive)\n ultimately have\"[a\\b]P \\<(?X \\ weakBisim)> [a\\b]Q\" \n by(rule Weak_Early_Sim_Pres.matchPres)\n }\n with `(abP, abQ) \\ ?X` show ?case by blast\n next\n case(cSym abP abQ)\n thus ?case by(blast dest: Weak_Early_Bisim.symetric)\n qed\nqed\n\nlemma mismatchPres:\n fixes P :: pi\n and Q :: pi\n and a :: name\n and b :: name\n\n assumes \"P \\ Q\"\n\n shows \"[a\\b]P \\ [a\\b]Q\"\nproof -\n let ?X = \"{([a\\b]P, [a\\b]Q)| a b P Q. P \\ Q}\"\n from `P \\ Q` have \"([a\\b]P, [a\\b]Q) \\ ?X\" by blast\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSim abP abQ)\n {\n fix P Q a b\n assume \"P \\ Q\"\n hence \"P \\ Q\" by(rule weakBisimE)\n moreover have \"weakBisim \\ (?X \\ weakBisim)\" by blast\n moreover have \"\\P Q a b. \\P \\ Q; a \\ b\\ \\ [a\\b]P \\ Q\"\n by (metis (full_types) strongBisimWeakBisim Strong_Early_Bisim_SC.mismatchId Weak_Early_Bisim.transitive)\n ultimately have \"[a\\b]P \\<(?X \\ weakBisim)> [a\\b]Q\"\n by(rule Weak_Early_Sim_Pres.mismatchPres) \n }\n with `(abP, abQ) \\ ?X` show ?case by blast\n next\n case(cSym abP abQ)\n thus ?case by(blast dest: Weak_Early_Bisim.symetric)\n qed\nqed\n\nlemma parPres:\n fixes P :: pi\n and Q :: pi\n and R :: pi\n\n assumes \"P \\ Q\"\n\n shows \"P \\ R \\ Q \\ R\"\nproof -\n let ?X = \"{(resChain lst (P \\ R), resChain lst (Q \\ R)) | lst P R Q. P \\ Q}\"\n have BC: \"\\P Q. P \\ Q = resChain [] (P \\ Q)\" by auto\n from `P \\ Q` have \"(P \\ R, Q \\ R) \\ ?X\" by(blast intro: BC)\n thus ?thesis\n proof(coinduct rule: weakBisimCoinduct)\n case(cSym PR QR)\n {\n fix P Q R lst\n assume \"P \\ Q\"\n moreover hence \"P \\ Q\" by(rule weakBisimE)\n moreover have \"\\P Q R. P \\ Q \\ (P \\ R, Q \\ R) \\ ?X\" using BC\n by blast\n moreover {\n fix PR QR x\n assume \"(PR, QR) \\ ?X\"\n then obtain lst P Q R where \"P \\ Q\" and A: \"PR = resChain lst (P \\ R)\" and B: \"QR = resChain lst (Q \\ R)\"\n by auto\n from A have \"<\\x>PR = resChain (x#lst) (P \\ R)\" by auto\n moreover from B have \"<\\x>QR = resChain (x#lst) (Q \\ R)\" by auto\n ultimately have \"(<\\x>PR, <\\x>QR) \\ ?X\" using `P \\ Q`\n by blast\n }\n note Res = this\n ultimately have \"P \\ R \\ Q \\ R\"\n by(rule_tac Weak_Early_Sim_Pres.parPres)\n moreover have \"eqvt ?X\"\n by(auto simp add: eqvt_def) (blast intro: eqvts)\n ultimately have \"resChain lst (P \\ R) \\ resChain lst (Q \\ R)\" using Res\n by(rule_tac Weak_Early_Sim_Pres.resChainI)\n hence \"resChain lst (P \\ R) \\<(?X \\ weakBisim)> resChain lst (Q \\ R)\"\n by(force intro: Weak_Early_Sim.monotonic)\n }\n with `(PR, QR) \\ ?X` show \"PR \\<(?X \\ weakBisim)> QR\"\n by blast\n next\n case(cSym PR QR)\n thus ?case by(blast dest: Weak_Early_Bisim.symetric)\n qed\nqed\n\n\n\n assumes PBisimQ: \"P \\ Q\"\n\n shows \"!P \\ !Q\"\nproof -\n let ?X = \"(bangRel weakBisim)\"\n let ?Y = \"Strong_Early_Bisim.bisim O (bangRel weakBisim) O Strong_Early_Bisim.bisim\"\n\n from Weak_Early_Bisim.eqvt Strong_Early_Bisim.eqvt have eqvtY: \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n have XsubY: \"?X \\ ?Y\" by(auto intro: Strong_Early_Bisim.reflexive)\n\n have RelStay: \"\\P Q. (P \\ !P, Q) \\ ?Y \\ (!P, Q) \\ ?Y\"\n proof(auto)\n fix P Q R T\n assume PBisimQ: \"P \\ !P \\\\<^sub>e Q\" \n and QBRR: \"(Q, R) \\ bangRel weakBisim\"\n and RBisimT: \"R \\\\<^sub>e T\"\n have \"!P \\\\<^sub>e Q\" \n proof -\n have \"!P \\\\<^sub>e P \\ !P\" by(rule Strong_Early_Bisim_SC.bangSC)\n thus ?thesis using PBisimQ by(rule Strong_Early_Bisim.transitive)\n qed\n with QBRR RBisimT show \"(!P, T) \\ ?Y\" by blast\n qed\n \n have ParCompose: \"\\P Q R T. \\P \\ Q; (R, T) \\ ?Y\\ \\ (P \\ R, Q \\ T) \\ ?Y\"\n proof -\n fix P Q R T\n assume PBisimQ: \"P \\ Q\"\n and RYT: \"(R, T) \\ ?Y\"\n thus \"(P \\ R, Q \\ T) \\ ?Y\"\n proof(auto)\n fix T' R'\n assume T'BisimT: \"T' \\\\<^sub>e T\" and RBisimR': \"R \\\\<^sub>e R'\"\n and R'BRT': \"(R', T') \\ bangRel weakBisim\"\n have \"P \\ R \\\\<^sub>e P \\ R'\"\n proof -\n from RBisimR' have \"R \\ P \\\\<^sub>e R' \\ P\" by(rule Strong_Early_Bisim_Pres.parPres)\n moreover have \"P \\ R \\\\<^sub>e R \\ P\" and \"R' \\ P \\\\<^sub>e P \\ R'\" by(rule Strong_Early_Bisim_SC.parSym)+\n ultimately show ?thesis by(blast intro: Strong_Early_Bisim.transitive)\n qed\n moreover from PBisimQ R'BRT' have \"(P \\ R', Q \\ T') \\ bangRel weakBisim\" by(rule BRPar)\n moreover have \"Q \\ T' \\\\<^sub>e Q \\ T\"\n proof -\n from T'BisimT have \"T' \\ Q \\\\<^sub>e T \\ Q\" by(rule Strong_Early_Bisim_Pres.parPres)\n moreover have \"Q \\ T' \\\\<^sub>e T' \\ Q\" and \"T \\ Q \\\\<^sub>e Q \\ T\" by(rule Strong_Early_Bisim_SC.parSym)+\n ultimately show ?thesis by(blast intro: Strong_Early_Bisim.transitive)\n qed\n ultimately show ?thesis by blast\n qed\n qed\n\n have ResCong: \"\\P Q x. (P, Q) \\ ?Y \\ (<\\x>P, <\\x>Q) \\ ?Y\"\n by(auto intro: BRRes Strong_Early_Bisim_Pres.resPres transitive)\n\n have Sim: \"\\P Q. (P, Q) \\ ?X \\ P \\ Q\"\n proof -\n fix P Q\n assume \"(P, Q) \\ ?X\"\n thus \"P \\ Q\"\n proof(induct)\n case(BRBang P Q)\n have \"P \\ Q\" by fact\n moreover hence \"P \\ Q\" by(blast dest: weakBisimE)\n moreover have \"\\P Q. P \\ Q \\ P \\ Q\" by(blast dest: weakBisimE)\n moreover from Strong_Early_Bisim.eqvt Weak_Early_Bisim.eqvt have \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n\n ultimately show \"!P \\ !Q\" using ParCompose ResCong RelStay XsubY\n by(rule_tac Weak_Early_Sim_Pres.bangPres, simp_all)\n next\n case(BRPar P Q R T)\n have PBiSimQ: \"P \\ Q\" by fact\n moreover have RBangRelT: \"(R, T) \\ ?X\" by fact\n have RSimT: \"R \\ T\" by fact\n moreover from PBiSimQ have \"P \\ Q\" by(blast dest: weakBisimE)\n moreover from RBangRelT have \"(R, T) \\ ?Y\" by(blast intro: Strong_Early_Bisim.reflexive)\n ultimately show \"P \\ R \\ Q \\ T\" using ParCompose ResCong eqvt eqvtY\n by(rule_tac Weak_Early_Sim_Pres.parCompose)\n next\n case(BRRes P Q x)\n have \"P \\ Q\" by fact\n thus \"<\\x>P \\ <\\x>Q\" using ResCong eqvtY XsubY\n by(rule_tac Weak_Early_Sim_Pres.resPres, simp_all)\n qed\n qed\n\n from PBisimQ have \"(!P, !Q) \\ ?X\" by(rule BRBang)\n moreover from Weak_Early_Bisim.eqvt have \"eqvt (bangRel weakBisim)\" by(rule eqvtBangRel)\n ultimately show ?thesis\n apply(coinduct rule: Weak_Early_Bisim.transitive_coinduct_weak)\n apply(blast intro: Sim)\n by(blast dest: bangRelSymetric Weak_Early_Bisim.symetric intro: Strong_Early_Bisim.reflexive)\nqed\n\n\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Early_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.2699024039628502}} {"text": "(* Title: L3_Lib.thy\n Original author: Anthony Fox, University of Cambridge\n Contributions by: Kyndylan Nienhuis \n\nL3 operations.\n*)\n\ntheory L3_Lib\nimports \"$ISABELLE_HOME/src/HOL/Word/Word\"\n \"$ISABELLE_HOME/src/HOL/Library/Code_Target_Numeral\"\n \"$ISABELLE_HOME/src/HOL/Library/Code_Char\"\nbegin\n\n(* basic state Monad *)\n\ndefinition \"return = Pair\"\n\ndefinition bind :: \"('state \\ ('a \\ 'state)) \\\n ('a \\ 'state \\ ('b \\ 'state)) \\\n ('state \\ ('b \\ 'state))\" where\n \"bind f g = (\\s. let (a, s') = f s in g a s')\"\n\ndefinition read_state :: \"('state \\ 'a) \\ 'state \\ 'a \\ 'state\" where\n \"read_state f = (\\s. (f s, s))\"\n\ndefinition update_state :: \"('state \\ 'state) \\ 'state \\ unit \\ 'state\" where\n \"update_state f = (\\s. ((), f s))\"\n\ndefinition extend_state :: \"'b \\ ('b \\ 'state \\ 'a \\ 'b \\ 'state) \\ 'state \\ 'a \\ 'state\" where\n \"extend_state v f = (\\s. let (a, s') = f (v, s) in (a, snd s'))\"\n\ndefinition trim_state :: \"('state \\ 'a \\ 'state) \\ 'b \\ 'state \\ 'a \\ 'b \\ 'state\" where\n \"trim_state f = (\\(s1, s2). let (a, s') = f s2 in (a, s1, s'))\"\n\nfun foreach_loop :: \"'a list \\ ('a \\ 'state \\ unit \\ 'state) \\ 'state \\ unit \\ 'state\" where\n \"foreach_loop ([], _) = return ()\" |\n \"foreach_loop (h # t, a) = bind (a h) (\\u. foreach_loop (t, a))\"\n\nfunction for_loop :: \"nat \\ nat \\ (nat \\ 'state \\ unit \\ 'state) \\ 'state \\ unit \\ 'state\" where\n \"for_loop (i, j, a) =\n (if i = j then\n a i\n else\n bind (a i) (\\u. for_loop ((if i < j then i + 1 else i - 1), j, a)))\"\n by auto\n termination by (relation \"measure (\\(i, j, _). if i < j then j - i else i - j)\") auto\n\n(* Because there are no constraints on i, j and a on the left-hand side of the definition, every\noccurrence of for_loop can be simplified by for_loop.simps, and since the definition is recursive\nthe simplifier might diverge. For this reason we remove for_loop.simps from the simp set. *)\n\ndeclare for_loop.simps [simp del]\n\n(* Monad laws *)\n\nlemma bind_left_identity [simp]:\n shows \"bind (return a) f = f a\"\nunfolding return_def bind_def\nby auto\n\nlemma bind_right_identity [simp]:\n shows \"bind m return = m\"\nunfolding return_def bind_def\nby auto\n\nlemma bind_associativity:\n shows \"bind (bind m f) g = bind m (\\a. bind (f a) g)\" \n (is \"?l = ?r\")\nproof\n fix s\n show \"?l s = ?r s\"\n unfolding return_def bind_def \n by (cases \"m s\") auto\nqed\n\n(* Projections *)\n\nlemma project_return [simp]:\n shows \"fst (return a s) = a\"\n and \"snd (return a s) = s\"\nunfolding return_def\nby auto\n\nlemma project_read_state [simp]:\n shows \"fst (read_state f s) = f s\"\n and \"snd (read_state f s) = s\"\nunfolding read_state_def\nby auto\n\nlemma project_update_state [simp]:\n shows \"fst (update_state f s) = ()\"\n and \"snd (update_state f s) = f s\"\nunfolding update_state_def\nby auto\n\n(* Other monad simplifications *)\n\nlemma read_state_constant [simp]:\n shows \"read_state (\\s. a) = return a\" \nunfolding read_state_def return_def\n..\n\nlemma update_state_id [simp]:\n shows \"update_state (\\s. s) = return ()\" \nunfolding update_state_def return_def\n..\n\nlemma foreach_loop_return [simp]:\n shows \"foreach_loop (l, \\_. return a) = return ()\"\nby (induct l) simp_all\n\nlemma extend_state_return [simp]:\n shows \"extend_state v (return a) = return a\"\nunfolding extend_state_def return_def\nby simp\n\nlemma extend_state_trim_state [simp]:\n shows \"extend_state v (trim_state m) = m\" \n (is \"?l = ?r\")\nproof\n fix s\n show \"?l s = ?r s\"\n unfolding extend_state_def trim_state_def\n by (cases \"m s\") auto\nqed\n\n(* extra character operations *)\n\ndefinition Ord :: \"char \\ nat\" where\n \"Ord c = (case c of Char nh nl \\ \n nat_of_nibble nh * 16 + nat_of_nibble nl)\"\n\ndefinition Chr :: \"nat \\ char\" where\n \"Chr n = Char (nibble_of_nat (n div 16)) (nibble_of_nat n)\"\n\ndefinition is_lower :: \"char \\ bool\" where\n \"is_lower c = (Ord (CHR ''a'') \\ Ord c \\ Ord c \\ Ord (CHR ''z''))\"\n\ndefinition is_upper :: \"char \\ bool\" where\n \"is_upper c = (Ord (CHR ''A'') \\ Ord c \\ Ord c \\ Ord (CHR ''Z''))\"\n\ndefinition is_space :: \"char \\ bool\" where\n \"is_space c = (Ord (CHR '' '') = Ord c \\ 9 \\ Ord c \\ Ord c \\ 13)\"\n\ndefinition is_digit :: \"char \\ bool\" where\n \"is_digit c = (Ord (CHR ''0'') \\ Ord c \\ Ord c \\ Ord (CHR ''9''))\"\n\ndefinition is_hex_digit :: \"char \\ bool\" where\n \"is_hex_digit c = (is_digit c \\ Ord (CHR ''a'') \\ Ord c \\ Ord c \\ Ord (CHR ''f'') \\\n Ord (CHR ''A'') \\ Ord c \\ Ord c \\ Ord (CHR ''F''))\"\n\ndefinition is_alpha :: \"char \\ bool\" where\n \"is_alpha c = (is_lower c \\ is_upper c)\"\n\ndefinition is_alpha_num :: \"char \\ bool\" where\n \"is_alpha_num c = (is_alpha c \\ is_digit c)\"\n\ndefinition to_lower :: \"char \\ char\" where\n \"to_lower c = (if is_upper c then Chr (Ord c + 32) else c)\"\n\ndefinition to_upper :: \"char \\ char\" where\n \"to_upper c = (if is_lower c then Chr (Ord c - 32) else c)\"\n\n(* numeric strings *)\n\nfun list_to_nat :: \"nat \\ nat list \\ nat\" where\n \"list_to_nat _ [] = 0\" |\n \"list_to_nat base (h # t) = h mod base + base * list_to_nat base t\"\n\nfun nat_to_list :: \"nat \\ nat \\ nat list\" where\n \"nat_to_list base n =\n (if n < base \\ base < 2 then [n mod base] else n mod base # nat_to_list base (n div base))\"\n\n(* Because there are no constraints on n on the left-hand side of the definition, every occurrence\nof nat_to_list can be simplified by nat_to_list.simps, and since the definition is recursive the\nsimplifier might diverge. For this reason we remove nat_to_list.simps from the simp set. *)\n\ndeclare nat_to_list.simps [simp del]\n\ndefinition hex :: \"nat \\ char\" where\n \"hex n = (if n = 0 then CHR ''0''\n else if n = 1 then CHR ''1''\n else if n = 2 then CHR ''2''\n else if n = 3 then CHR ''3''\n else if n = 4 then CHR ''4''\n else if n = 5 then CHR ''5''\n else if n = 6 then CHR ''6''\n else if n = 7 then CHR ''7''\n else if n = 8 then CHR ''8''\n else if n = 9 then CHR ''9''\n else if n = 10 then CHR ''A''\n else if n = 11 then CHR ''B''\n else if n = 12 then CHR ''C''\n else if n = 13 then CHR ''D''\n else if n = 14 then CHR ''E''\n else if n = 15 then CHR ''F''\n else undefined)\"\n\ndefinition unhex :: \"char \\ nat\" where\n \"unhex c = (if c = CHR ''0'' then 0\n else if c = CHR ''1'' then 1\n else if c = CHR ''2'' then 2\n else if c = CHR ''3'' then 3\n else if c = CHR ''4'' then 4\n else if c = CHR ''5'' then 5\n else if c = CHR ''6'' then 6\n else if c = CHR ''7'' then 7\n else if c = CHR ''8'' then 8\n else if c = CHR ''9'' then 9\n else if c = CHR ''a'' \\ c = CHR ''A'' then 10\n else if c = CHR ''b'' \\ c = CHR ''B'' then 11\n else if c = CHR ''c'' \\ c = CHR ''C'' then 12\n else if c = CHR ''d'' \\ c = CHR ''D'' then 13\n else if c = CHR ''e'' \\ c = CHR ''E'' then 14\n else if c = CHR ''f'' \\ c = CHR ''F'' then 15\n else undefined)\"\n\ndefinition string_to_nat :: \"nat \\ string \\ nat\" where\n \"string_to_nat base s = list_to_nat base (map unhex (rev s))\"\n\ndefinition nat_to_string :: \"nat \\ nat \\ string\" where\n \"nat_to_string base n = rev (map hex (nat_to_list base n))\"\n\ndefinition \"bin_string_to_nat \\ string_to_nat 2\"\ndefinition \"nat_to_bin_string \\ nat_to_string 2\"\ndefinition \"dec_string_to_nat \\ string_to_nat 10\"\ndefinition \"nat_to_dec_string \\ nat_to_string 10\"\ndefinition \"hex_string_to_nat \\ string_to_nat 16\"\ndefinition \"nat_to_hex_string \\ nat_to_string 16\"\n\ndefinition nat_from_bin_string :: \"string \\ nat option\" where\n \"nat_from_bin_string s =\n (if s \\ '''' \\ list_all (\\c. c = CHR ''0'' \\ c = CHR ''1'') s then\n Some (bin_string_to_nat s)\n else None)\"\n\ndefinition nat_from_dec_string :: \"string \\ nat option\" where\n \"nat_from_dec_string s =\n (if s \\ '''' \\ list_all is_digit s then Some (dec_string_to_nat s) else None)\"\n\ndefinition nat_from_hex_string :: \"string \\ nat option\" where\n \"nat_from_hex_string s =\n (if s \\ '''' \\ list_all is_hex_digit s then Some (hex_string_to_nat s) else None)\"\n\ndefinition dec_string_to_int :: \"string \\ int\" where\n \"dec_string_to_int r = \n (case r of [] \\ 0 |\n h # t \\ (if h = CHR ''-'' \\ h = CHR ''~'' \n then -int (dec_string_to_nat t)\n else int (dec_string_to_nat r)))\"\n\ndefinition int_to_dec_string :: \"int \\ string\" where\n \"int_to_dec_string i =\n (if i < 0 then CHR ''~'' # nat_to_dec_string (nat (-i)) else nat_to_dec_string (nat i))\"\n\ndefinition string_to_bool :: \"string \\ bool\" where\n \"string_to_bool s = (if s = ''true'' then True\n else if s = ''false'' then False\n else undefined)\"\n\ndefinition string_to_char :: \"string \\ char\" where\n \"string_to_char s = (case s of [c] \\ c | _ \\ undefined)\"\n\n(* extra Nat operation *)\n\nfun log2 :: \"nat \\ nat\" where\n \"log2 n = (if n = 0 then undefined else if n = 1 then 0 else Suc (log2 (n div 2)))\"\n\n(* Because there are no constraints on n on the left-hand side of the definition, every occurrence\nof log2 can be simplified by log2.simps, and since the definition is recursive the simplifier might\ndiverge. For this reason we remove log2.simps from the simp set. *)\n\ndeclare log2.simps [simp del]\n\nlemma log2_bounds:\n assumes \"n \\ 0\"\n shows \"2 ^ (log2 n) \\ n\"\n and \"n < 2 ^ (Suc (log2 n))\"\nproof -\n -- \"The induction works better if we prove one goal instead of two goals\"\n have \"2 ^ (log2 n) \\ n \\ n < 2 ^ (Suc (log2 n))\"\n using assms\n proof (induct \"log2 n\" arbitrary: n)\n case 0\n hence \"n = 1\" \n by (simp add: log2.simps) (meson nat.simps(3))\n thus ?case by (simp add: log2.simps)\n next\n case (Suc k)\n show ?case\n proof (cases \"n = 1\")\n case True\n thus ?thesis by (simp add: log2.simps)\n next\n case False\n hence \"1 < n\" using Suc(3) by simp\n hence \"(n div 2) \\ 0\" by auto\n have log2: \"log2 n = Suc (log2 (n div 2))\"\n using `1 < n` by (simp add: log2.simps)\n hence \"k = log2 (n div 2)\" using Suc(2) by simp\n note Suc(1)[OF this `(n div 2) \\ 0`]\n thus ?thesis\n using log2 by auto\n qed\n qed\n thus \"2 ^ (log2 n) \\ n\" \"n < 2 ^ (Suc (log2 n))\" by auto\nqed\n\nlemma log2_unat_bounds:\n fixes x :: \"('a :: len) word\"\n assumes \"x \\ 0\"\n shows \"log2 (unat x) < len_of TYPE('a)\"\nproof -\n have \"unat x \\ 0\" \n using assms \n by (simp add: unat_eq_zero)\n have \"unat x < 2 ^ len_of TYPE('a)\"\n by simp\n note le_less_trans[OF log2_bounds(1)[OF `unat x \\ 0`] this]\n thus ?thesis by auto\nqed\n\n(* extra int operations *)\n\ndefinition quot :: \"int \\ int \\ int\" (infixl \"quot\" 70) where\n \"i quot j = (if j = 0 then undefined\n else if 0 < j then if 0 \\ i then i div j else -(-i div j)\n else if 0 \\ i then -(i div -j)\n else -i div -j)\"\n\ndefinition rem :: \"int \\ int \\ int\" (infixl \"rem\" 70) where\n \"i rem j = (if j = 0 then undefined else i - i quot j * j)\"\n\ndefinition quot_rem :: \"int * int \\ int * int\" where\n \"quot_rem p = (case p of (i, j) \\ (i div j, i rem j))\"\n\n(* extra option operations *)\n\ndefinition is_some :: \"'a option \\ bool\" where\n \"is_some x = (case x of Some _ \\ True | _ \\ False)\"\n\nlemma is_some_alt:\n shows \"is_some x = (x \\ None)\"\nunfolding is_some_def \nusing option.disc_eq_case(2) \nby auto\n\nlemma is_some_simps [simp]:\n shows \"\\ (is_some None)\"\n and \"is_some (Some x)\"\nunfolding is_some_def by simp_all\n\n(* extra list operations *)\n\nfun splitl :: \"('a \\ bool) \\ 'a list \\ 'a list \\ 'a list\" where\n \"splitl _ [] = ([], [])\" |\n \"splitl P (h # t) = (if P h then let (l, r) = splitl P t in (h # l, r) else ([], h # t))\"\n\ndefinition splitr :: \"('a \\ bool) \\ 'a list \\ 'a list \\ 'a list\" where\n \"splitr P x = (let (l, r) = splitl P (rev x) in (rev r, rev l))\"\n\ndefinition pad_left :: \"'a \\ nat \\ 'a list \\ 'a list\" where\n \"pad_left c n s = replicate (n - length s) c @ s\"\n\ndefinition pad_right :: \"'a \\ nat \\ 'a list \\ 'a list\" where\n \"pad_right c n s = s @ replicate (n - length s) c\"\n\nfun index_find :: \"nat \\ 'a \\ 'a list \\ nat option\" where\n \"index_find _ (_, []) = None\" |\n \"index_find i (v, h # t) = (if v = h then Some i else index_find (Suc i) (v, t))\"\n\ndefinition \"index_of = index_find 0\"\n\ndefinition remove :: \"'a list * 'a list \\ 'a list\" where\n \"remove p = (case p of (l1, l2) \\ filter (\\x. x \\ set l1) l2)\"\n\ndefinition remove_except :: \"'a list * 'a list \\ 'a list\" where\n \"remove_except p = (case p of (l1, l2) \\ filter (\\x. x \\ set l1) l2)\"\n\nfun remove_duplicates :: \"'a list \\ 'a list\" where\n \"remove_duplicates [] = []\" |\n \"remove_duplicates (h # t) = (if h \\ set t then remove_duplicates t else h # remove_duplicates t)\"\n\nlemma splitl_length:\n shows \"length (fst (splitl P l)) + length (snd (splitl P l)) = length l\"\nby (induct l, auto simp add: case_prod_beta)\n\nlemma splitl_fst_length [simp]:\n shows \"length (fst (splitl P x)) \\ length x\"\nusing splitl_length \nby (metis order_refl trans_le_add1)\n\nlemma splitl_snd_length [simp]:\n shows \"length (snd (splitl P x)) \\ length x\"\nusing splitl_length \nby (metis order_refl trans_le_add2)\n\nlemma pad_left_length [simp]:\n shows \"length (pad_left e n l) = max (length l) n\"\nunfolding pad_left_def\nby auto \n\nlemma pad_right_length [simp]:\n shows \"length (pad_right e n l) = max (length l) n\"\nunfolding pad_right_def\nby auto\n\nlemma pad_left_nth:\n shows \"pad_left e n l ! m = \n (if m < n - List.length l \n then e \n else l ! (m - (n - List.length l)))\"\nunfolding pad_left_def nth_append\nby simp\n\n(* extra string operations *)\n\nlemma fields_termination_lem [simp]:\n assumes \"a \\ []\" and \"length a \\ length c\"\n shows \"length a - b < Suc (length c)\"\n by (simp add: assms(2) le_imp_less_Suc less_imp_diff_less)\n\nfunction (sequential) tokens :: \"(char \\ bool) \\ string \\ string list\" where\n \"tokens _ '''' = []\" |\n \"tokens P x =\n (let (l, r) = splitl (\\e. ~P e) x in if l = [] then tokens P (tl r) else l # tokens P r)\"\n by pat_completeness auto\n termination tokens\n apply (relation \"measure (length o snd)\")\n apply auto\n apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n done\n\nfunction (sequential) fields :: \"(char \\ bool) \\ string \\ string list\" where\n \"fields _ '''' = [[]]\" |\n \"fields P x =\n (let (l, r) = splitl (\\e. ~P e) x in if l = [] then [] # fields P (tl r)\n else if r = [] then [l]\n else l # fields P (tl r))\"\n by pat_completeness auto\n termination fields\n apply (relation \"measure (length o snd)\")\n apply auto\n apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n apply (case_tac \"~ P v\", auto simp add: case_prod_beta)\n done\n\n(* bit-string operations - extends Bool_List_Representation.thy *)\n\ndefinition nat_to_bitstring :: \"nat \\ bool list\" where\n \"nat_to_bitstring n = \n (if n = 0 then [False] else bin_to_bl (log2 n + 1) (int n))\"\n\ndefinition \"bitstring_to_nat = nat o bl_to_bin\"\n\ndefinition fixwidth :: \"nat \\ bool list \\ bool list\" where\n \"fixwidth n v = (let l = length v in if l < n then pad_left False n v else drop (l - n) v)\"\n\ndefinition bitwise :: \"(bool \\ bool \\ bool) \\ bool list \\ bool list \\ bool list\" where\n \"bitwise f v1 v2 =\n (let m = max (length v1) (length v2) in map (case_prod f) (zip (fixwidth m v1) (fixwidth m v2)))\"\n\ndefinition \"bor = bitwise (op \\)\"\ndefinition \"band = bitwise (op \\)\"\ndefinition \"bxor = bitwise (op \\)\"\n\ndefinition bitstring_shiftl :: \"bool list \\ nat \\ bool list\" where\n \"bitstring_shiftl v m = pad_right False (length v + m) v\"\n\ndefinition bitstring_shiftr :: \"bool list \\ nat \\ bool list\" where\n \"bitstring_shiftr v m = take (length v - m) v\"\n\ndefinition bitstring_field :: \"nat \\ nat \\ bool list \\ bool list\" where\n \"bitstring_field h l v = fixwidth (Suc h - l) (bitstring_shiftr v l)\"\n\ndefinition bitstring_rotate :: \"bool list \\ nat \\ bool list\" where\n \"bitstring_rotate v m =\n (let l = length v in\n let x = m mod l in\n if l = 0 \\ x = 0 then v else bitstring_field (x - 1) 0 v @ bitstring_field (l - 1) x v)\"\n\ndefinition bitstring_test_bit :: \"bool list \\ nat \\ bool\" where\n \"bitstring_test_bit v n = (bitstring_field n n v = [True])\"\n\ndefinition bitstring_modify :: \"(nat \\ bool \\ bool) \\ bool list \\ bool list\" where\n \"bitstring_modify p = (case p of (f, l) \\ map f (zip (rev (upt 0 (length l))) l))\"\n\ndefinition bitstring_field_insert :: \"nat \\ nat \\ bool list \\ bool list \\ bool list\" where\n \"bitstring_field_insert h l v1 v2 =\n bitstring_modify (\\(i, b). if l \\ i \\ i \\ h then bitstring_test_bit v1 (i - l) else b, v2)\"\n\nlemma nat_to_bitstring_zero [simp]:\n shows \"nat_to_bitstring 0 = [False]\"\nunfolding nat_to_bitstring_def by simp\n\n(* We do not add the following rule to the simp set, because n occurs twice at the right hand side,\nand therefore the state might not become simpler when applying this rule. *)\n\nlemma nat_to_bitstring_length:\n shows \"length (nat_to_bitstring n) = (if n = 0 then 1 else log2 n + 1)\"\nunfolding nat_to_bitstring_def\nby (simp del: bin_to_bl_def)\n\nlemma fixwidth_length [simp]:\n shows \"length (fixwidth n l) = n\"\nunfolding fixwidth_def Let_def\nby auto\n\nlemma bitwise_length [simp]:\n shows \"length (bitwise f v1 v2) = max (length v1) (length v2)\"\nunfolding bitwise_def Let_def\nby auto\n\n(* extra word operations *)\n\ndefinition unsigned_min :: \"'a::len word \\ 'a::len word \\ 'a::len word\" where\n \"unsigned_min p = (case p of (w1, w2) \\ (if w1 \\ w2 then w1 else w2))\"\n\ndefinition unsigned_max :: \"'a::len word \\ 'a::len word \\ 'a::len word\" where\n \"unsigned_max p = (case p of (w1, w2) \\ (if w1 \\ w2 then w2 else w1))\"\n\ndefinition word_log2 :: \"'a::len word \\ 'a::len word\" where\n \"word_log2 w = of_nat (log2 (unat w))\"\n\ndefinition word_quot :: \"'a::len word \\ 'a::len word \\ 'a::len word\" where\n \"word_quot i j = of_int (sint i quot sint j)\"\n\ndefinition word_rem :: \"'a::len word \\ 'a::len word \\ 'a::len word\" where\n \"word_rem i j = of_int (sint i rem sint j)\"\n\ndefinition word_modify :: \"(nat \\ bool \\ bool) \\ 'a::len word \\ 'a::len word\" where\n \"word_modify p = (case p of (f, w) \\ of_bl (bitstring_modify (f, to_bl w)))\"\n\ndefinition word_bit_field_insert :: \"nat \\ nat \\ 'a::len word \\ 'b::len word \\ 'b::len word\" where\n \"word_bit_field_insert h l w1 w2 =\n word_modify (\\(i, b). if l \\ i \\ i \\ h then test_bit w1 (i - l) else b, w2)\"\n\ndefinition word_bits :: \"nat \\ nat \\ 'a::len word \\ 'a::len word\" where\n \"word_bits h l w = (w >> l) AND mask (Suc h - l)\"\n\ndefinition word_extract :: \"nat \\ nat \\ 'a::len word \\ 'b::len word\" where\n \"word_extract h l w = ucast (word_bits h l w)\"\n\ndefinition word_replicate :: \"nat \\ 'a::len word \\ 'b::len word\" where\n \"word_replicate n a = word_rcat (replicate n a)\"\n\n(* floating-point stubs *)\n\ndatatype ieee_rounding =\n roundTiesToEven | roundTowardPositive | roundTowardNegative | roundTowardZero\n\ndatatype ieee_compare = LT | EQ | GT | UN\n\nconsts\n fp32_abs :: \"32 word \\ 32 word\"\n fp32_add :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word\"\n fp32_compare :: \"32 word \\ 32 word \\ ieee_compare\"\n fp32_div :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word\"\n fp32_equal :: \"32 word \\ 32 word \\ bool\"\n fp32_from_int :: \"ieee_rounding \\ int \\ 32 word\"\n fp32_greater :: \"32 word \\ 32 word \\ bool\"\n fp32_greater_equal :: \"32 word \\ 32 word \\ bool\"\n fp32_is_finite :: \"32 word \\ bool\"\n fp32_is_nan :: \"32 word \\ bool\"\n fp32_is_normal :: \"32 word \\ bool\"\n fp32_is_subnormal :: \"32 word \\ bool\"\n fp32_less :: \"32 word \\ 32 word \\ bool\"\n fp32_less_equal :: \"32 word \\ 32 word \\ bool\"\n fp32_mul :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word\"\n fp32_mul_add :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word \\ 32 word\"\n fp32_mul_sub :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word \\ 32 word\"\n fp32_neg_inf :: \"32 word\"\n fp32_neg_zero :: \"32 word\"\n fp32_negate :: \"32 word \\ 32 word\"\n fp32_pos_inf :: \"32 word\"\n fp32_pos_zero :: \"32 word\"\n fp32_sqrt :: \"ieee_rounding \\ 32 word \\ 32 word\"\n fp32_sub :: \"ieee_rounding \\ 32 word \\ 32 word \\ 32 word\"\n fp32_to_int :: \"ieee_rounding \\ 32 word \\ int option\"\n\nconsts\n fp64_abs :: \"64 word \\ 64 word\"\n fp64_add :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word\"\n fp64_compare :: \"64 word \\ 64 word \\ ieee_compare\"\n fp64_div :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word\"\n fp64_equal :: \"64 word \\ 64 word \\ bool\"\n fp64_from_int :: \"ieee_rounding \\ int \\ 64 word\"\n fp64_greater :: \"64 word \\ 64 word \\ bool\"\n fp64_greater_equal :: \"64 word \\ 64 word \\ bool\"\n fp64_is_finite :: \"64 word \\ bool\"\n fp64_is_nan :: \"64 word \\ bool\"\n fp64_is_normal :: \"64 word \\ bool\"\n fp64_is_subnormal :: \"64 word \\ bool\"\n fp64_less :: \"64 word \\ 64 word \\ bool\"\n fp64_less_equal :: \"64 word \\ 64 word \\ bool\"\n fp64_mul :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word\"\n fp64_mul_add :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word \\ 64 word\"\n fp64_mul_sub :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word \\ 64 word\"\n fp64_neg_inf :: \"64 word\"\n fp64_neg_zero :: \"64 word\"\n fp64_negate :: \"64 word \\ 64 word\"\n fp64_pos_inf :: \"64 word\"\n fp64_pos_zero :: \"64 word\"\n fp64_sqrt :: \"ieee_rounding \\ 64 word \\ 64 word\"\n fp64_sub :: \"ieee_rounding \\ 64 word \\ 64 word \\ 64 word\"\n fp64_to_int :: \"ieee_rounding \\ 64 word \\ int option\"\n\nconsts\n fp32_to_fp64 :: \"32 word \\ 64 word\"\n fp64_to_fp32 :: \"ieee_rounding \\ 64 word \\ 32 word\"\n\ncode_printing\n constant \"fp32_abs\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_abs\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_abs\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_abs\\\")\"\n | constant \"fp32_add\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_add\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_add\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_add\\\")\"\n | constant \"fp32_compare\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_compare\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_compare\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_compare\\\")\"\n | constant \"fp32_div\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_div\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_div\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_div\\\")\"\n | constant \"fp32_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_equal\\\")\"\n | constant \"fp32_from_int\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_from'_int\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_from'_int\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_from'_int\\\")\"\n | constant \"fp32_greater\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_greater\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_greater\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_greater\\\")\"\n | constant \"fp32_greater_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_greater'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_greater'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_greater'_equal\\\")\"\n | constant \"fp32_is_finite\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_finite\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_finite\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_finite\\\")\"\n | constant \"fp32_is_nan\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_nan\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_nan\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_nan\\\")\"\n | constant \"fp32_is_normal\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_normal\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_normal\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_normal\\\")\"\n | constant \"fp32_is_subnormal\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_subnormal\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_subnormal\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_subnormal\\\")\"\n | constant \"fp32_less\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_less\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_less\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_less\\\")\"\n | constant \"fp32_less_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_less'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_less'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_less'_equal\\\")\"\n | constant \"fp32_mul\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_mul\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_mul\\\")\"\n | constant \"fp32_mul_add\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_add\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp32'_mul'_add\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp32'_mul'_add\\\")\"\n | constant \"fp32_mul_sub\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_sub\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp32'_mul'_sub\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp32'_mul'_sub\\\")\"\n | constant \"fp32_neg_inf\" \\\n (SML) \"!(raise Fail \\\"fp32'_neg'_inf\\\")\"\n and (OCaml) \"!(failwith \\\"fp32'_neg'_inf\\\")\"\n and (Haskell) \"!(error \\\"fp32'_neg'_inf\\\")\"\n | constant \"fp32_neg_zero\" \\\n (SML) \"!(raise Fail \\\"fp32'_neg'_zero\\\")\"\n and (OCaml) \"!(failwith \\\"fp32'_neg'_zero\\\")\"\n and (Haskell) \"!(error \\\"fp32'_neg'_zero\\\")\"\n | constant \"fp32_negate\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_negate\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_negate\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_negate\\\")\"\n | constant \"fp32_pos_inf\" \\\n (SML) \"!(raise Fail \\\"fp32'_pos'_inf\\\")\"\n and (OCaml) \"!(failwith \\\"fp32'_pos'_inf\\\")\"\n and (Haskell) \"!(error \\\"fp32'_pos'_inf\\\")\"\n | constant \"fp32_pos_zero\" \\\n (SML) \"!(raise Fail \\\"fp32'_pos'_zero\\\")\"\n and (OCaml) \"!(failwith \\\"fp32'_pos'_zero\\\")\"\n and (Haskell) \"!(error \\\"fp32'_pos'_zero\\\")\"\n | constant \"fp32_sqrt\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_sqrt\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_sqrt\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_sqrt\\\")\"\n | constant \"fp32_sub\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_sub\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_sub\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_sub\\\")\"\n | constant \"fp32_to_int\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_to'_int\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_to'_int\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_to'_int\\\")\"\n | constant \"fp64_abs\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_abs\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_abs\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_abs\\\")\"\n | constant \"fp64_add\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_add\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_add\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_add\\\")\"\n | constant \"fp64_compare\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_compare\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_compare\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_compare\\\")\"\n | constant \"fp64_div\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_div\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_div\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_div\\\")\"\n | constant \"fp64_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_equal\\\")\"\n | constant \"fp64_from_int\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_from'_int\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_from'_int\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_from'_int\\\")\"\n | constant \"fp64_greater\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_greater\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_greater\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_greater\\\")\"\n | constant \"fp64_greater_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_greater'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_greater'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_greater'_equal\\\")\"\n | constant \"fp64_is_finite\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_finite\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_finite\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_finite\\\")\"\n | constant \"fp64_is_nan\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_nan\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_nan\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_nan\\\")\"\n | constant \"fp64_is_normal\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_normal\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_normal\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_normal\\\")\"\n | constant \"fp64_is_subnormal\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_subnormal\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_subnormal\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_subnormal\\\")\"\n | constant \"fp64_less\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_less\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_less\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_less\\\")\"\n | constant \"fp64_less_equal\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_less'_equal\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_less'_equal\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_less'_equal\\\")\"\n | constant \"fp64_mul\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_mul\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_mul\\\")\"\n | constant \"fp64_mul_add\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_add\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp64'_mul'_add\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp64'_mul'_add\\\")\"\n | constant \"fp64_mul_sub\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_sub\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp64'_mul'_sub\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp64'_mul'_sub\\\")\"\n | constant \"fp64_neg_inf\" \\\n (SML) \"!(raise Fail \\\"fp64'_neg'_inf\\\")\"\n and (OCaml) \"!(failwith \\\"fp64'_neg'_inf\\\")\"\n and (Haskell) \"!(error \\\"fp64'_neg'_inf\\\")\"\n | constant \"fp64_neg_zero\" \\\n (SML) \"!(raise Fail \\\"fp64'_neg'_zero\\\")\"\n and (OCaml) \"!(failwith \\\"fp64'_neg'_zero\\\")\"\n and (Haskell) \"!(error \\\"fp64'_neg'_zero\\\")\"\n | constant \"fp64_negate\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp64'_negate\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_negate\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_negate\\\")\"\n | constant \"fp64_pos_inf\" \\\n (SML) \"!(raise Fail \\\"fp64'_pos'_inf\\\")\"\n and (OCaml) \"!(failwith \\\"fp64'_pos'_inf\\\")\"\n and (Haskell) \"!(error \\\"fp64'_pos'_inf\\\")\"\n | constant \"fp64_pos_zero\" \\\n (SML) \"!(raise Fail \\\"fp64'_pos'_zero\\\")\"\n and (OCaml) \"!(failwith \\\"fp64'_pos'_zero\\\")\"\n and (Haskell) \"!(error \\\"fp64'_pos'_zero\\\")\"\n | constant \"fp64_sqrt\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_sqrt\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_sqrt\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_sqrt\\\")\"\n | constant \"fp64_sub\" \\\n (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_sub\\\")\"\n and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_sub\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_sub\\\")\"\n | constant \"fp64_to_int\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_to'_int\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_to'_int\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_to'_int\\\")\"\n | constant \"fp32_to_fp64\" \\\n (SML) \"!(fn '_ => raise Fail \\\"fp32'_to'_fp64\\\")\"\n and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_to'_fp64\\\")\"\n and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_to'_fp64\\\")\"\n | constant \"fp64_to_fp32\" \\\n (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_to'_fp32\\\")\"\n and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_to'_fp32\\\")\"\n and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_to'_fp32\\\")\"\n\nend\n", "meta": {"author": "acjf3", "repo": "acjf3.github.io", "sha": "6e5713c36c4fb0a87a2c366ca4f6a15acb710195", "save_path": "github-repos/isabelle/acjf3-acjf3.github.io", "path": "github-repos/isabelle/acjf3-acjf3.github.io/acjf3.github.io-6e5713c36c4fb0a87a2c366ca4f6a15acb710195/l3/isabelle/2015/L3_Lib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521307073646, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.26990239623317974}} {"text": "theory Typeclass_Hierarchy\nimports Setup\nbegin\n\nsection \\Introduction\\\n\ntext \\\n The {Isabelle/HOL} type-class hierarchy entered the stage\n in a quite ancient era -- first related \\<^emph>\\NEWS\\ entries date\n back to release {Isabelle99-1}. Since then, there have been\n ongoing modifications and additions, leading to ({Isabelle2016})\n more than 180 type-classes. This sheer complexity makes access\n and understanding of that type-class hierarchy difficult and\n involved, let alone maintenance.\n\n The purpose of this primer is to shed some light on this,\n not only on the mere ingredients, but also on the design\n principles which have evolved and proven useful over time.\n\\\n\nsection \\Foundations\\\n\nsubsection \\Locales and type classes\\\n\ntext \\\n Some familiarity with the Isabelle module system is assumed:\n defining locales and type-classes, interpreting locales and\n instantiating type-classes, adding relationships between\n locales (@{command sublocale}) and type-classes\n (@{command subclass}). Handy introductions are the\n respective tutorials \\cite{isabelle-locale}\n \\cite{isabelle-classes}.\n\\\n\nsubsection \\Strengths and restrictions of type classes\\\n\ntext \\\n The primary motivation for using type classes in {Isabelle/HOL}\n always have been numerical types, which form an inclusion chain:\n \n \\begin{center}\n @{typ nat} @{text \\} @{typ int} @{text \\} @{typ rat}\n @{text \\} @{typ real} @{text \\} @{typ complex}\n \\end{center}\n\n \\noindent The inclusion @{text \\} means that any value of the numerical\n type to the left hand side mathematically can be transferred\n to the numerical type on the right hand side.\n\n How to accomplish this given the quite restrictive type system\n of {Isabelle/HOL}? Paulson \\cite{paulson-numerical} explains\n that each numerical type has some characteristic properties\n which define an characteristic algebraic structure; @{text \\}\n then corresponds to specialization of the corresponding\n characteristic algebraic structures. These algebraic structures\n are expressed using algebraic type classes and embeddings\n of numerical types into them:\n\n \\begin{center}\\begin{tabular}{lccc}\n @{term of_nat} @{text \"::\"} & @{typ nat} & @{text \\} & @{typ [source] \"'a::semiring_1\"} \\\\\n & @{text \\} & & @{text \\} \\\\\n @{term of_int} @{text \"::\"} & @{typ int} & @{text \\} & @{typ [source] \"'a::ring_1\"} \\\\\n & @{text \\} & & @{text \\} \\\\\n @{term of_rat} @{text \"::\"} & @{typ rat} & @{text \\} & @{typ [source] \"'a::field_char_0\"} \\\\\n & @{text \\} & & @{text \\} \\\\\n @{term of_real} @{text \"::\"} & @{typ real} & @{text \\} & @{typ [source] \"'a::real_algebra_1\"} \\\\\n & @{text \\} \\\\\n & @{typ complex}\n \\end{tabular}\\end{center}\n\n \\noindent @{text \"d \\ c\"} means that @{text c} is subclass of @{text d}.\n Hence each characteristic embedding @{text of_num} can transform\n any value of type @{text num} to any numerical type further\n up in the inclusion chain.\n\n This canonical example exhibits key strengths of type classes:\n\n \\<^item> Sharing of operations and facts among different\n types, hence also sharing of notation and names: there\n is only one plus operation using infix syntax @{text \"+\"},\n only one zero written @{text 0}, and neutrality\n (@{thm (frugal_sorts) add_0_left [all, no_vars]} and\n @{thm (frugal_sorts) add_0_right [all, no_vars]})\n is referred to\n uniformly by names @{fact add_0_left} and @{fact add_0_right}.\n\n \\<^item> Proof tool setups are shared implicitly:\n @{fact add_0} and @{fact add_0_right} are simplification\n rules by default.\n\n \\<^item> Hence existing proofs about particular numerical\n types are often easy to generalize to algebraic structures,\n given that they do not depend on specific properties of\n those numerical types.\n\n Considerable restrictions include:\n\n \\<^item> Type class operations are restricted to one\n type parameter; this is insufficient e.g. for expressing\n a unified power operation adequately (see \\secref{sec:power}).\n\n \\<^item> Parameters are fixed over the whole type class\n hierarchy and cannot be refined in specific situations:\n think of integral domains with a predicate @{term is_unit};\n for natural numbers, this degenerates to the much simpler\n @{term [source] \"HOL.equal (1::nat)\"} but facts\n refer to @{term is_unit} nonetheless.\n\n \\<^item> Type classes are not apt for meta-theory. There\n is no practically usable way to express that the units\n of an integral domain form a multiplicative group using\n type classes. But see session @{text \"HOL-Algebra\"}\n which provides locales with an explicit carrier.\n\\\n\n\nsubsection \\Navigating the hierarchy\\\n\ntext \\\n An indispensable tool to inspect the class hierarchy is\n @{command class_deps} which displays the graph of classes,\n optionally showing the logical content for each class also.\n Optional parameters restrict the graph to a particular segment\n which is useful to get a graspable view. See\n the Isar reference manual \\cite{isabelle-isar-ref} for details.\n\\\n\n\nsection \\The hierarchy\\\n\nsubsection \\Syntactic type classes \\label{sec:syntactic-type-class}\\\n\ntext \\\n At the top of the hierarchy there are a couple of syntactic type\n classes, ie. classes with operations but with no axioms,\n most notably:\n\n \\<^item> @{command class} @{class plus} with @{term [source] \"(a::'a::plus) + b\"}\n\n \\<^item> @{command class} @{class zero} with @{term [source] \"0::'a::zero\"}\n\n \\<^item> @{command class} @{class times} with @{term [source] \"(a::'a::times) * b\"}\n\n \\<^item> @{command class} @{class one} with @{term [source] \"1::'a::one\"}\n\n \\noindent Before the introduction of the @{command class} statement in\n Isabelle \\cite{Haftmann-Wenzel:2006:classes} it was impossible\n to define operations with associated axioms in the same class,\n hence there were always pairs of syntactic and logical type\n classes. This restriction is lifted nowadays, but there are\n still reasons to maintain syntactic type classes:\n\n \\<^item> Syntactic type classes allow generic notation to be used\n regardless of a particular logical interpretation; e.g.\n although multiplication @{text \"*\"} is usually associative,\n there are examples where it is not (e.g. octonions), and\n leaving @{text \"*\"} without axioms allows to re-use this\n syntax by means of type class instantiation also for such\n exotic examples.\n\n \\<^item> Type classes might share operations but not necessarily\n axioms on them, e.g. @{term gcd} (see \\secref{sec:gcd}).\n Hence their common base is a syntactic type class.\n\n \\noindent However syntactic type classes should only be used with striking\n cause. Otherwise there is risk for confusion if the notation\n suggests properties which do not hold without particular\n constraints. This can be illustrated using numerals\n (see \\secref{sec:numerals}): @{lemma \"2 + 2 = 4\" by simp} is\n provable without further ado, and this also meets the typical\n expectation towards a numeral notation; in more ancient releases\n numerals were purely syntactic and @{prop \"2 + 2 = 4\"} was\n not provable without particular type constraints.\n\\\n\n\nsubsection \\Additive and multiplicative semigroups and monoids\\\n\ntext \\\n In common literature, notation for semigroups and monoids\n is either multiplicative @{text \"(*, 1)\"} or additive\n @{text \"(+, 0)\"} with underlying properties isomorphic.\n In {Isabelle/HOL}, this is accomplished using the following\n abstract setup:\n\n \\<^item> A @{locale semigroup} introduces an abstract binary\n associative operation.\n\n \\<^item> A @{locale monoid} is an extension of @{locale semigroup}\n with a neutral element.\n\n \\<^item> Both @{locale semigroup} and @{locale monoid} provide\n dedicated syntax for their operations @{text \"(\\<^bold>*, \\<^bold>1)\"}.\n This syntax is not visible on the global theory level\n but only for abstract reasoning inside the respective\n locale.\n\n \\<^item> Concrete global syntax is added building on existing\n syntactic type classes \\secref{sec:syntactic-type-class}\n using the following classes:\n\n \\<^item> @{command class} @{class semigroup_mult} = @{class times}\n\n \\<^item> @{command class} @{class monoid_mult} = @{class one} + @{class semigroup_mult}\n\n \\<^item> @{command class} @{class semigroup_add} = @{class plus}\n\n \\<^item> @{command class} @{class monoid_add} = @{class zero} + @{class semigroup_add}\n\n Locales @{locale semigroup} and @{locale monoid} are\n interpreted (using @{command sublocale}) into their\n corresponding type classes, with prefixes @{text add}\n and @{text mult}; hence facts derived in @{locale semigroup}\n and @{locale monoid} are propagated simultaneously to\n \\<^emph>\\both\\ using a consistent naming policy, ie.\n\n \\<^item> @{fact semigroup.assoc}: @{thm (frugal_sorts) semigroup.assoc [all, no_vars]}\n\n \\<^item> @{fact mult.assoc}: @{thm (frugal_sorts) mult.assoc [all, no_vars]}\n\n \\<^item> @{fact add.assoc}: @{thm (frugal_sorts) add.assoc [all, no_vars]}\n\n \\<^item> @{fact monoid.right_neutral}: @{thm (frugal_sorts) monoid.right_neutral [all, no_vars]}\n\n \\<^item> @{fact mult.right_neutral}: @{thm (frugal_sorts) mult.right_neutral [all, no_vars]}\n\n \\<^item> @{fact add.right_neutral}: @{thm (frugal_sorts) add.right_neutral [all, no_vars]}\n\n \\<^item> Note that the syntax in @{locale semigroup} and @{locale monoid}\n is bold; this avoids clashes when writing properties\n inside one of these locales in presence of that global\n concrete type class syntax.\n\n \\noindent That hierarchy extends in a straightforward manner\n to abelian semigroups and commutative monoids\\footnote{The\n designation \\<^emph>\\abelian\\ is quite standard concerning\n (semi)groups, but not for monoids}:\n\n \\<^item> Locales @{locale abel_semigroup} and @{locale comm_monoid}\n add commutativity as property.\n\n \\<^item> Concrete syntax emerges through\n\n \\<^item> @{command class} @{class ab_semigroup_add} = @{class semigroup_add}\n\n \\<^item> @{command class} @{class ab_semigroup_mult} = @{class semigroup_mult}\n\n \\<^item> @{command class} @{class comm_monoid_add} = @{class zero} + @{class ab_semigroup_add}\n\n \\<^item> @{command class} @{class comm_monoid_mult} = @{class one} + @{class ab_semigroup_mult}\n \n and corresponding interpretation of the locales above, yielding\n\n \\<^item> @{fact abel_semigroup.commute}: @{thm (frugal_sorts) abel_semigroup.commute [all, no_vars]}\n\n \\<^item> @{fact mult.commute}: @{thm (frugal_sorts) mult.commute [all, no_vars]}\n\n \\<^item> @{fact add.commute}: @{thm (frugal_sorts) add.commute [all, no_vars]}\n\\\n\nparagraph \\Named collection of theorems\\\n\ntext \\\n Locale interpretation interacts smoothly with named collections of\n theorems as introduced by command @{command named_theorems}. In our\n example, rules concerning associativity and commutativity are no\n simplification rules by default since they desired orientation may\n vary depending on the situation. However, there is a collection\n @{fact ac_simps} where facts @{fact abel_semigroup.assoc},\n @{fact abel_semigroup.commute} and @{fact abel_semigroup.left_commute}\n are declared as members. Due to interpretation, also\n @{fact mult.assoc}, @{fact mult.commute} and @{fact mult.left_commute}\n are also members of @{fact ac_simps}, as any corresponding facts\n stemming from interpretation of @{locale abel_semigroup}.\n Hence adding @{fact ac_simps} to the simplification rules for\n a single method call uses all associativity and commutativity\n rules known by means of interpretation.\n\\\n\n\nsubsection \\Additive and multiplicative groups\\\n\ntext \\\n The hierarchy for inverse group operations takes into account\n that there are weaker algebraic structures with only a partially\n inverse operation. E. g. the natural numbers have bounded\n subtraction @{term \"m - (n::nat)\"} which is only an inverse\n operation if @{term \"m \\ (n::nat)\"}; unary minus @{text \"-\"}\n is pointless on the natural numbers.\n\n Hence for both additive and multiplicative notation there\n are syntactic classes for inverse operations, both unary\n and binary:\n\n \\<^item> @{command class} @{class minus} with @{term [source] \"(a::'a::minus) - b\"}\n\n \\<^item> @{command class} @{class uminus} with @{term [source] \"- a::'a::uminus\"}\n\n \\<^item> @{command class} @{class divide} with @{term [source] \"(a::'a::divide) div b\"}\n\n \\<^item> @{command class} @{class inverse} = @{class divide} with @{term [source] \"inverse a::'a::inverse\"}\n \\\\ and @{term [source] \"(a::'a::inverse) / b\"}\n\n \\noindent Here @{class inverse} specializes the ``partial'' syntax\n @{term [source] \"a div b\"} to the more specific\n @{term [source] \"a / b\"}. \n\n Semantic properties are added by\n\n \\<^item> @{command class} @{class cancel_ab_semigroup_add} = @{class ab_semigroup_add} + @{class minus}\n\n \\<^item> @{command class} @{class cancel_comm_monoid_add} = @{class cancel_ab_semigroup_add} + @{class comm_monoid_add}\n\n \\noindent which specify a minimal binary partially inverse operation as\n\n \\<^item> @{fact add_diff_cancel_left'}: @{thm (frugal_sorts) add_diff_cancel_left' [all, no_vars]}\n\n \\<^item> @{fact diff_diff_add}: @{thm (frugal_sorts) diff_diff_add [all, no_vars]}\n\n \\noindent which in turn allow to derive facts like\n\n \\<^item> @{fact add_left_imp_eq}: @{thm (frugal_sorts) add_left_imp_eq [all, no_vars]}\n\n \\noindent The total inverse operation is established as follows:\n\n \\<^item> Locale @{locale group} extends the abstract hierarchy with\n the inverse operation.\n\n \\<^item> The concrete additive inverse operation emerges through\n\n \\<^item> @{command class} @{class group_add} = @{class minus} + @{class uminus} + @{class monoid_add} (in @{theory Groups}) \\\\\n\n \\<^item> @{command class} @{class ab_group_add} = @{class minus} + @{class uminus} + @{class comm_monoid_add} (in @{theory Groups})\n\n and corresponding interpretation of locale @{locale group}, yielding e.g.\n\n \\<^item> @{fact group.left_inverse}: @{thm (frugal_sorts) group.left_inverse [all, no_vars]}\n\n \\<^item> @{fact add.left_inverse}: @{thm (frugal_sorts) add.left_inverse [all, no_vars]}\n\n \\noindent There is no multiplicative counterpart. Why? In rings,\n the multiplicative group excludes the zero element, hence\n the inverse operation is not total. See further \\secref{sec:rings}.\n\\\n\nparagraph \\Mitigating against redundancy by default simplification rules\\\n\ntext \\\n Inverse operations imposes some redundancy on the type class\n hierarchy: in a group with a total inverse operation, the\n unary operation is simpler and more primitive than the binary\n one; but we cannot eliminate the binary one in favour of\n a mere syntactic abbreviation since the binary one is vital\n to express a partial inverse operation.\n\n This is mitigated by providing suitable default simplification\n rules: expression involving the unary inverse operation are\n simplified to binary inverse operation whenever appropriate.\n The rationale is that simplification is a central device in\n explorative proving, where proof obligation remaining after certain\n default proof steps including simplification are inspected\n to get an idea what is missing to finish a proof. When\n preferable normal forms are encoded into\n default simplification rules, proof obligations after simplification\n are normalized and hence more proof-friendly.\n\\\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.2698859562062589}} {"text": "section \\Implementation of Heaps by Arrays\\\ntheory IICF_Impl_Heapmap\nimports \n IICF_Abs_Heapmap \n \"../IICF_Array\" \n \"../IICF_Array_List\" \n \"../IICF_Indexed_Array_List\"\nbegin\n\n term hfref\n\n \n find_theorems INTF_OF_REL\n\n lemma intf_of_b_rel[synth_rules]: \"INTF_OF_REL R I \\ INTF_OF_REL (b_rel R P) I\" by simp\n\n lemma b_assn_intf[intf_of_assn]: \"intf_of_assn V I \\ intf_of_assn (b_assn V P) I\"\n by simp\n \n \n (* TODO: Move *)\n lemma mk_free_b_assn[sepref_frame_free_rules]:\n assumes \"MK_FREE A f\" \n shows \"MK_FREE (b_assn A P) f\" \n proof -\n note [vcg_rules] = assms[THEN MK_FREED]\n show ?thesis by rule vcg\n qed\n \n \n (* TODO: Move *)\n \n \n (* \n type_synonym 'a iam1 = \"'a list\"\n\n definition iam1_rel :: \"nat \\ ('a iam1 \\ (nat\\'a)) set\"\n where \"iam1_rel N \\ br (\\xs i. if ixs. length xs = N)\"\n\n definition iam1_init :: \"nat \\ 'a \\ 'a iam1 nres\" where \"iam1_init N v \\ RETURN (replicate N v)\"\n definition iam1_lookup :: \"nat \\ 'a iam1 \\ 'a nres\" \n where \"iam1_lookup k m \\ mop_list_get m k\"\n \n definition iam1_update :: \"nat \\ 'a \\ 'a iam1 \\ 'a iam1 nres\"\n where \"iam1_update k v m \\ mop_list_set m k v\"\n \n (*definition abs_iam_empty :: \"nat \\ (nat \\ 'a) nres\" \n where \"abs_iam_empty (N::nat) \\ RETURN Map.empty\"\n *)\n \n sepref_decl_op iam_init: \"\\(N::nat) (v::'a). \\k. if k V \\ \\nat_rel,V\\ map_rel\"\n apply (rule frefI)\n apply parametricity\n by (auto simp: map_rel_def)\n \n lemma iam1_empty_refine: \"(uncurry iam1_init,uncurry mop_iam_init) \n \\ [\\(N',v). N'=N]\\<^sub>f nat_rel \\\\<^sub>r Id \\ \\iam1_rel N\\nres_rel\"\n unfolding iam1_init_def \n by (auto intro!: frefI nres_relI simp: iam1_rel_def in_br_conv fun_eq_iff)\n \n lemma iam1_lookup_refine: \n \"(iam1_lookup, mop_map_the_lookup) \\ nbn_rel N \\ iam1_rel N \\ \\Id\\nres_rel\"\n unfolding iam1_lookup_def \n apply (refine_vcg frefI)\n by (auto simp: iam1_rel_def in_br_conv)\n \n lemma iam1_update_refine:\n \"(iam1_update, mop_map_update) \n \\ nbn_rel N \\Id \\ iam1_rel N \\ \\iam1_rel N\\nres_rel\"\n unfolding iam1_update_def \n apply (refine_vcg frefI)\n by (auto simp: iam1_rel_def in_br_conv fun_eq_iff)\n \n \n \n \n context\n fixes L :: \"'l::len2 itself\" \n (*notes [fcomp_norm_unfold] = snatb_rel_def[symmetric]*)\n begin\n \n private abbreviation (input) \"iam2_assn \\ array_assn id_assn\"\n \n definition \"iam_assn N V \\ hr_comp \n (hr_comp iam2_assn (iam1_rel N))\n (\\nat_rel, the_pure V\\map_rel)\"\n lemmas [fcomp_norm_unfold] = iam_assn_def[symmetric]\n \n\n lemma iam_assn_intf[intf_of_assn]: \"intf_of_assn V TYPE('v) \\ intf_of_assn (iam_assn N V) (TYPE((nat,'v)i_map))\"\n by simp\n \n sepref_definition iam_init_impl is \"uncurry iam1_init\"\n :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a iam2_assn\"\n unfolding iam1_init_def\n apply (subst array_fold_custom_replicate)\n by sepref\n sepref_decl_impl (ismop) iam_init_impl.refine[FCOMP iam1_empty_refine] by auto\n\n sepref_definition iam_lookup_impl is \"uncurry iam1_lookup\" \n :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a iam2_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding iam1_lookup_def\n by sepref\n sepref_decl_impl (ismop) iam_lookup_impl.refine[FCOMP iam1_lookup_refine] \n uses mop_map_the_lookup.fref[where K=Id] .\n \n sepref_definition iam_update_impl is \"uncurry2 iam1_update\" \n :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k *\\<^sub>a iam2_assn\\<^sup>d \\\\<^sub>a iam2_assn\"\n unfolding iam1_update_def\n by sepref\n sepref_decl_impl (ismop) iam_update_impl.refine[FCOMP iam1_update_refine] \n uses mop_map_update.fref[where K=Id] .\n \n end \n\n *)\n\n type_synonym 'a iam1 = \"'a list\"\n\n definition iam1_rel :: \"nat \\ ('a iam1 \\ (nat\\'a)) set\"\n where \"iam1_rel N \\ {(xs,m). length xs = N \\ dom m \\ {0.. (\\k v. m k = Some v \\ v=xs!k)}\"\n\n definition iam1_init :: \"nat \\ 'a::llvm_rep iam1 nres\" where \"iam1_init N \\ RETURN (replicate N init)\"\n definition iam1_lookup :: \"nat \\ 'a iam1 \\ 'a nres\" \n where \"iam1_lookup k m \\ mop_list_get m k\"\n \n definition iam1_update :: \"nat \\ 'a \\ 'a iam1 \\ 'a iam1 nres\"\n where \"iam1_update k v m \\ mop_list_set m k v\"\n \n sepref_decl_op iam_empty: \"\\(N::nat). Map.empty :: nat \\ _\" :: \"nat_rel \\ \\nat_rel,V\\ map_rel\" .\n \n lemma iam_fold_custom_empty:\n \"op_map_empty = op_iam_empty N\"\n \"Map.empty = op_iam_empty N\"\n \"mop_map_empty = mop_iam_empty N\"\n by auto\n \n \n lemma iam1_empty_refine: \"(iam1_init,mop_iam_empty) \n \\ [\\N'. N'=N]\\<^sub>f nat_rel \\ \\iam1_rel N\\nres_rel\"\n unfolding iam1_init_def\n by (auto intro!: frefI nres_relI simp: iam1_rel_def in_br_conv fun_eq_iff)\n \n lemma iam1_lookup_refine: \n \"(iam1_lookup, mop_map_the_lookup) \\ nbn_rel N \\ iam1_rel N \\ \\Id\\nres_rel\"\n apply (clarsimp simp: iam1_lookup_def)\n apply (refine_vcg)\n apply (auto simp: iam1_rel_def in_br_conv)\n done\n \n lemma iam1_update_refine:\n \"(iam1_update, mop_map_update) \n \\ nbn_rel N \\Id \\ iam1_rel N \\ \\iam1_rel N\\nres_rel\"\n unfolding iam1_update_def \n apply (refine_vcg frefI)\n by (auto simp: iam1_rel_def in_br_conv fun_eq_iff)\n \n \n \n context\n fixes L :: \"'l::len2 itself\" \n (*notes [fcomp_norm_unfold] = snatb_rel_def[symmetric]*)\n begin\n \n private abbreviation (input) \"iam2_assn \\ array_assn id_assn\"\n \n definition \"iam_assn N V \\ hr_comp \n (hr_comp iam2_assn (iam1_rel N))\n (\\nat_rel, the_pure V\\map_rel)\"\n lemmas [fcomp_norm_unfold] = iam_assn_def[symmetric]\n \n\n lemma iam_assn_intf[intf_of_assn]: \"intf_of_assn V TYPE('v) \\ intf_of_assn (iam_assn N V) (TYPE((nat,'v)i_map))\"\n by simp\n \n sepref_definition iam_init_impl [llvm_inline] is \"iam1_init\"\n :: \"(snat_assn' TYPE('l))\\<^sup>k \\\\<^sub>a iam2_assn\"\n unfolding iam1_init_def\n supply [sepref_import_param] = IdI[of init]\n apply (subst array_fold_custom_replicate)\n by sepref\n \n sepref_decl_impl (ismop,no_register) iam_empty: iam_init_impl.refine[FCOMP iam1_empty_refine] by auto\n \n sepref_definition iam_lookup_impl [llvm_inline] is \"uncurry iam1_lookup\" \n :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a iam2_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding iam1_lookup_def\n by sepref\n sepref_decl_impl (ismop) iam_lookup_impl.refine[FCOMP iam1_lookup_refine] \n uses mop_map_the_lookup.fref[where K=Id] .\n \n sepref_definition iam_update_impl [llvm_inline] is \"uncurry2 iam1_update\" \n :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k *\\<^sub>a iam2_assn\\<^sup>d \\\\<^sub>a iam2_assn\"\n unfolding iam1_update_def\n by sepref\n sepref_decl_impl (ismop) iam_update_impl.refine[FCOMP iam1_update_refine] \n uses mop_map_update.fref[where K=Id] .\n \n end \n \n \n find_theorems \"?x[_:=_] = ?x\"\n\n \n type_synonym ('v) iam = \"'v ptr\"\n \n schematic_goal [sepref_frame_free_rules]: \"MK_FREE (iam_assn N V) (?fr)\"\n unfolding iam_assn_def\n by sepref_dbg_side\n \n xxx, ctd here: Explicit parameterization on N. Use dependent relation for constructors! \n \n\n locale hm_impl = hmstruct prio for prio :: \"'e \\ 'p::linorder\" +\n fixes prio_assn :: \"'p \\ 'pi::llvm_rep \\ assn\"\n and elem_assn :: \"'e \\ 'ei::llvm_rep \\ assn\"\n and prio_impl le_prio_impl lt_prio_impl\n and ltype :: \"'l::len2 itself\"\n assumes prio_is_pure[safe_constraint_rules]: \"is_pure prio_assn\"\n assumes elem_is_pure[safe_constraint_rules]: \"is_pure elem_assn\" \n assumes prio_impl_refine[sepref_fr_rules]: \"(prio_impl, RETURN o prio)\\elem_assn\\<^sup>k \\\\<^sub>a prio_assn\"\n assumes le_prio_impl_refine[sepref_fr_rules]: \n \"(uncurry le_prio_impl, uncurry (RETURN oo (\\))) \\ prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n assumes lt_prio_impl_refine[sepref_fr_rules]: \n \"(uncurry lt_prio_impl, uncurry (RETURN oo (<))) \\ prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n \n fixes N :: nat \n (* \n fixes N :: nat (*defines \"N\\LENGTH('l)\"*)\n assumes N_bound: \"N snatb_assn' TYPE('l) N\"\n abbreviation \"idx1_assn \\ snatb_assn' TYPE('l) (Suc N)\"\n\n sepref_register prio\n\n sepref_register \"(\\) :: 'p \\ 'p \\ bool\"\n sepref_register \"(<) :: 'p \\ 'p \\ bool\"\n \n lemma l_len_bound[simp,arith]: \"4 16 \\ max_snat LENGTH('l)\"\n unfolding max_snat_def\n proof -\n assume \"4LENGTH('l)-1\" by simp\n hence \"(2::nat)^4 \\ 2^(LENGTH('l)-1)\" \n by (rule power_increasing) auto\n thus \"(16::nat) \\ 2^(LENGTH('l)-1)\" by auto\n qed\n \n lemmas [sepref_frame_free_rules] = \n mk_free_is_pure[OF prio_is_pure]\n mk_free_is_pure[OF elem_is_pure]\n \n definition \"hm2_assn \\ b_assn (ial_assn' TYPE('l) N \\\\<^sub>a iam_assn N elem_assn) (\\_. 4 N 4 Nd*\\<^sub>aidx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k \\\\<^sub>a hm2_assn\"\n apply (rule hfref_with_rdomI)\n unfolding hm_append_op_def hm2_assn_def\n by sepref\n \n lemmas [sepref_fr_rules] = hm_append_impl.refine\n \n sepref_definition hm_length_impl is \"RETURN o hm_length\" :: \"hm2_assn\\<^sup>k \\\\<^sub>a snatb_assn' TYPE('l) (N+1)\"\n apply (rule hfref_with_rdomI)\n unfolding hm_length_def hm2_assn_def\n by sepref\n \n lemmas [sepref_fr_rules] = hm_length_impl.refine\n \n term hm2_assn \n sepref_register hm_key_of_op \n sepref_definition hm_key_of_impl is \"uncurry hm_key_of_op\" :: \"hm2_assn\\<^sup>k *\\<^sub>a idx1_assn\\<^sup>d \\\\<^sub>a idx_assn\"\n apply (rule hfref_with_rdomI)\n unfolding hm_key_of_op_def hm2_assn_def\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_key_of_impl.refine\n \n (* Optimization *)\n definition \"hm_the_lookup_op' k hm \\ do {\n let (pq,ml) = hm;\n (*ASSERT (heapmap_\\ (hm_impl1_\\ hm) k \\ None \\ hm_impl1_invar hm);*)\n v \\ mop_map_the_lookup k ml;\n RETURN v\n }\"\n lemma hm_the_lookup_op'_refine: \n \"(hm_the_lookup_op', hm_the_lookup_op) \\ nat_rel \\ Id \\ \\Id\\nres_rel\"\n apply (intro fun_relI nres_relI)\n unfolding hm_the_lookup_op'_def hm_the_lookup_op_def\n apply refine_vcg\n apply (auto)\n apply (auto simp: heapmap_\\_def hmr_invar_def restrict_map_def split: if_split_asm)\n done\n\n sepref_definition hm_the_lookup_impl is \"uncurry hm_the_lookup_op'\" :: \"idx_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>k \\\\<^sub>a elem_assn\"\n apply (rule hfref_with_rdomI)\n unfolding hm_the_lookup_op'_def hm2_assn_def Let_def\n by sepref\n lemmas hm_the_lookup_impl_refine[sepref_fr_rules] \n = hm_the_lookup_impl.refine[FCOMP hm_the_lookup_op'_refine]\n\n sepref_definition hm_val_of_impl is \"uncurry hm_val_of_op\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>k \\\\<^sub>a elem_assn\" \n unfolding hm_val_of_op_def\n by sepref\n lemmas [sepref_fr_rules] = hm_val_of_impl.refine\n \n sepref_register hm_prio_of_op\n sepref_definition hm_prio_of_impl is \"uncurry (PR_CONST hm_prio_of_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>k \\\\<^sub>a prio_assn\" \n unfolding hm_prio_of_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_prio_of_impl.refine\n \n definition \"parent_valid h i \\ hm_valid h (h.parent i)\"\n definition \"parent_valid' h i \\ i>(1::nat)\"\n \n lemma valid_parent_pat[def_pat_rules]: \"hm_valid$h$(h.parent$i) \\ parent_valid$h$i\"\n unfolding parent_valid_def autoref_tag_defs by simp\n \n lemma parent_valid'_refine: \"(uncurry parent_valid',uncurry parent_valid) \\ [\\(h,i). hm_valid h i]\\<^sub>f Id\\\\<^sub>rId\\Id\"\n apply rule\n unfolding hm_valid_def parent_valid_def parent_valid'_def hm_length_def h.parent_def \n by auto\n \n sepref_definition parent_valid_impl is \"uncurry (RETURN oo parent_valid')\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\\\<^sub>a bool1_assn\" \n unfolding parent_valid'_def\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = parent_valid_impl.refine[FCOMP parent_valid'_refine]\n \n sepref_definition hm_exch_impl is \"uncurry2 hm_exch_op\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d \\\\<^sub>a hm2_assn\"\n apply (rule hfref_with_rdomI)\n unfolding hm_exch_op_def hm2_assn_def\n apply (annot_snat_const \"TYPE('l)\")\n supply [simp] = hm_valid_def\n by sepref\n lemmas [sepref_fr_rules] = hm_exch_impl.refine\n \n (* TODO: Move *)\n lemma hfref_bassn_resI:\n assumes \"\\xs. \\rdomp (fst As) xs; C xs\\ \\ a xs \\\\<^sub>n SPEC P\"\n assumes \"(c,a)\\[C]\\<^sub>a As \\ R\"\n shows \"(c,a)\\[C]\\<^sub>a As \\ b_assn R P\"\n apply rule\n apply (rule hn_refine_preI)\n apply (rule hn_refine_cons[rotated])\n apply (rule hn_refine_augment_res)\n apply (rule assms(2)[to_hnr, unfolded hn_ctxt_def autoref_tag_defs])\n apply simp\n apply (rule assms(1))\n apply (auto simp: rdomp_def sep_algebra_simps)\n done\n \n sepref_definition parent_impl is \"RETURN o h.parent\" :: \"[\\_. 4aidx1_assn\\<^sup>d \\ idx1_assn\"\n unfolding h.parent_def\n apply (rule hfref_bassn_resI)\n subgoal by auto\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n \n lemmas [sepref_fr_rules] = parent_impl.refine \n \n find_theorems hm_swim_op\n sepref_register h.parent hm_exch_op\n \n (* TODO: Very specialized workaround lemma, to work around invalid-recombination\n problem for case that B is pure. DUP in IICF_Heap_Impl.thy\n *) \n lemma workaround_invalid_recombine_pure3: \"is_pure B \\ hn_ctxt (invalid_assn A \\\\<^sub>a invalid_assn B) ax px \\ hn_invalid (A \\\\<^sub>a B) ax px\"\n unfolding hn_ctxt_def invalid_assn_def prod_assn_def entails_def\n by (auto split: prod.split elim!: is_pureE \n simp: sep_algebra_simps pure_part_pure_conj_eq)\n argo\n \n find_theorems is_pure b_assn \n \n sepref_register hm_swim_op\n sepref_definition hm_swim_impl is \"uncurry (PR_CONST hm_swim_op)\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>k \\\\<^sub>a hm2_assn\"\n unfolding hm_swim_op_def PR_CONST_def\n (* TODO: Workaround/Hack *)\n supply X[sepref_frame_match_rules] = workaround_invalid_recombine_pure3[where B=\"snatb_assn _\", simplified]\n supply [simp] = hm2_assn_rdomp_boundsI\n by sepref\n lemmas [sepref_fr_rules] = hm_swim_impl.refine\n \n sepref_register hm_insert_op\n sepref_definition hm_insert_impl is \"uncurry2 (PR_CONST hm_insert_op)\" \n :: \"idx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>d \\\\<^sub>a hm2_assn\"\n unfolding hm_insert_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_insert_impl.refine\n \n lemma rewr_2kleN: \"2*k \\ n \\ k \\ n div 2\" for k :: nat by auto\n \n sepref_definition hm_has_child_impl is \"uncurry (RETURN oo hm_has_child_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\\\<^sub>a bool1_assn\"\n unfolding hm_has_child_op_def\n apply (rewrite rewr_2kleN)\n supply [simp,dest] = hm2_assn_rdomp_boundsI\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n \n lemmas [sepref_fr_rules] = hm_has_child_impl.refine \n\n sepref_definition hm_left_child_impl is \"RETURN o hm_left_child_op\" :: \"[\\i. 2*i\\N \\ N 4a idx1_assn\\<^sup>d \\ idx1_assn\"\n unfolding hm_left_child_op_def\n apply (rule hfref_bassn_resI)\n subgoal by auto\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_left_child_impl.refine \n\n lemma rewr_kp1len: \"k+1 \\ n \\ k<(n::nat)\" by auto\n \n sepref_definition hm_has_next_child_impl is \"uncurry (RETURN oo hm_has_next_child_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\\\<^sub>a bool1_assn\"\n unfolding hm_has_next_child_op_def\n apply (rewrite rewr_kp1len)\n by sepref\n lemmas [sepref_fr_rules] = hm_has_next_child_impl.refine \n\n sepref_definition hm_next_child_impl is \"RETURN o hm_next_child_op\" :: \"[\\i. i N 4a idx1_assn\\<^sup>d \\ idx1_assn\"\n unfolding hm_next_child_op_def\n apply (rule hfref_bassn_resI)\n subgoal by auto\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_next_child_impl.refine \n \n lemma sink_sepref_aux1: \"\\ a2' \\ l div 2; (ae, l) \\ snat_rel' TYPE('l)\\\n \\ 2 * a2' < max_snat LENGTH('l)\"\n by (simp add: le_less_trans rewr_2kleN snat_rel_imp_less_max_snat)\n \n (* TODO: Move *) \n lemma rdomp_ial_len: \"rdomp (ial_assn N) xs \\ length xs \\ N\" \n unfolding ial_assn_def\n apply (auto simp: rdomp_hrcomp_conv ial_rel1_def in_br_conv)\n by (metis (full_types) ial_invar.l_len ial_invar_def list_rel_imp_same_length)\n \n lemma sink_sepref_aux2: \"\\hm_has_child_op (ag, bq) a2'; rdomp hm2_assn (ag, bq)\\\n \\ 2 * a2' \\ N\" \n unfolding hm_has_child_op_def hm2_assn_def hm_length_def \n by (auto dest: rdomp_ial_len)\n \n lemma sink_sepref_aux3: \"\\hm_has_next_child_op (ag, bq) i; rdomp hm2_assn (ag, bq)\\ \\ id*\\<^sub>aidx1_assn\\<^sup>k \\\\<^sub>a hm2_assn\"\n unfolding hm_sink_op_def PR_CONST_def\n supply [simp] = hm_length_def\n supply [simp] = snat_rel_imp_less_max_snat \n sink_sepref_aux1 sink_sepref_aux2 sink_sepref_aux3\n supply X[sepref_frame_match_rules] = workaround_invalid_recombine_pure3[where B=\"snatb_assn _\", simplified]\n supply [simp,dest] = hm2_assn_rdomp_boundsI\n by sepref\n lemmas [sepref_fr_rules] = hm_sink_impl.refine\n \n sepref_register hm_repair_op \n sepref_definition hm_repair_impl is \"uncurry (PR_CONST hm_repair_op)\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>k \\\\<^sub>a hm2_assn\"\n unfolding hm_repair_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_repair_impl.refine\n \n sepref_definition hm_is_empty_impl is \"hm_is_empty_op\" :: \"hm2_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n unfolding hm_is_empty_op_def\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n \n (* Cannot do lookup, unless we have option type! \n \\ Do contains_key and the_lookup instead!\n sepref_definition hm_lookup_impl is \"uncurry hm_lookup\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx_assn\\<^sup>k \\\\<^sub>a elem_assn\"\n *) \n \n sepref_register hm_contains_key_op\n sepref_definition hm_contains_key_impl is \"uncurry (PR_CONST hm_contains_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>k \\\\<^sub>a bool1_assn\"\n apply (rule hfref_with_rdomI)\n unfolding hm_contains_key_op_def hm2_assn_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_contains_key_impl.refine \n \n lemma hm_index_impl_aux1: \"\\b \\ set a1'; rdomp (ial_assn N) a1'; N\n \\ Suc (index a1' b) < max_snat LENGTH('l)\" \n by (meson index_less less_trans_Suc rdomp_ial_len)\n \n sepref_definition hm_index_impl is \"uncurry hm_index_op\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx_assn\\<^sup>d\\\\<^sub>aidx1_assn\" \n unfolding hm_index_op_def hm2_assn_def\n apply (rule hfref_bassn_resI)\n subgoal \n apply (clarsimp simp: uncurry_def) \n apply refine_vcg \n by (auto simp: heapmap_\\_def restrict_map_eq rdomp_ial_len)\n supply [simp] = heapmap_\\_def restrict_map_eq hm_index_impl_aux1\n apply (rule hfref_with_rdomI)\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_index_impl.refine \n \n term hm_update_op\n sepref_definition hm_update_impl is \"uncurry2 hm_update_op\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d*\\<^sub>aelem_assn\\<^sup>k \\\\<^sub>a hm2_assn\"\n unfolding hm_update_op_def hm2_assn_def\n apply (rule hfref_with_rdomI)\n supply [simp] = hm_valid_def\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_update_impl.refine\n \n sepref_register hm_decrease_key_op\n sepref_definition hm_decrease_key_impl is \"uncurry2 (PR_CONST hm_decrease_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\\\<^sub>a hm2_assn \"\n unfolding hm_decrease_key_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_decrease_key_impl.refine\n \n sepref_register hm_increase_key_op\n sepref_definition hm_increase_key_impl is \"uncurry2 (PR_CONST hm_increase_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\\\<^sub>a hm2_assn \"\n unfolding hm_increase_key_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_increase_key_impl.refine\n\n sepref_register hm_change_key_op\n sepref_definition hm_change_key_impl is \"uncurry2 (PR_CONST hm_change_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\\\<^sub>a hm2_assn \"\n unfolding hm_change_key_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_change_key_impl.refine\n \n sepref_register hm_set_op\n sepref_definition hm_set_impl is \"uncurry2 (PR_CONST hm_set_op)\" :: \"idx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>d \\\\<^sub>a hm2_assn\"\n unfolding hm_set_op_def PR_CONST_def\n by sepref\n lemmas [sepref_fr_rules] = hm_set_impl.refine\n \n lemma hm_pop_min_impl_aux1: \n \"\\hm_valid (pq, m) (Suc 0); rdomp hm2_assn (pq, m)\\ \\ 0d \\\\<^sub>a hm2_assn\"\n unfolding hm_butlast_op_def hm2_assn_def\n apply (rule hfref_with_rdomI)\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_butlast_impl.refine \n \n sepref_register hm_pop_min_op\n sepref_definition hm_pop_min_impl is \"PR_CONST hm_pop_min_op\" :: \"hm2_assn\\<^sup>d \\\\<^sub>a (idx_assn \\\\<^sub>a elem_assn) \\\\<^sub>a hm2_assn\"\n unfolding hm_pop_min_op_def PR_CONST_def\n supply [simp] = hm_pop_min_impl_aux1\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_pop_min_impl.refine \n \n sepref_register hm_remove_op \n sepref_definition hm_remove_impl is \"uncurry (PR_CONST hm_remove_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\\\<^sub>a hm2_assn\"\n unfolding hm_remove_op_def PR_CONST_def\n (* TODO Hack/Workaround: Prevents b_assn to be degraded when comparing.\n Deeper problem to fix: Do not degrade b_assn, even if operation is on basic assn!\n *)\n apply (rewrite at \"if \\\\_ then _ else _\" fold_COPY)\n by sepref\n lemmas [sepref_fr_rules] = hm_remove_impl.refine\n \n sepref_register hm_peek_min_op\n sepref_definition hm_peek_min_impl is \"hm_peek_min_op\" :: \"hm2_assn\\<^sup>k \\\\<^sub>a idx_assn\\\\<^sub>aelem_assn\"\n unfolding hm_peek_min_op_def hm_kv_of_op_def\n supply [simp] = hm_pop_min_impl_aux1\n apply (annot_snat_const \"TYPE('l)\")\n by sepref\n lemmas [sepref_fr_rules] = hm_peek_min_impl.refine\n\n \n (* sepref_decl_op hm_empty: \"op_map_empty\" :: \"\\Id,Id\\map_rel\" .*)\n \n definition [simp]: \"mop_hm_empty (NN::nat) \\ mop_map_empty\"\n sepref_register \"mop_hm_empty N\" :: \"('a,'b) i_map nres\"\n\n lemma fold_custom_hm_empty:\n \"RETURN Map.empty = mop_hm_empty N\"\n \"mop_map_empty = mop_hm_empty N\"\n by auto\n \n context\n fixes Ni\n assumes NiREF: \"(Ni,N)\\snat_rel' TYPE('l)\"\n assumes BOUND: \"4k \\\\<^sub>a hm2_assn\"\n unfolding hm_empty_op_def hm_empty_op_def hm2_assn_def\n apply (rule hfref_with_rdomI)\n apply (rewrite iam_fold_custom_empty[where N=N])\n apply (rewrite ial_fold_custom_empty[where N=N])\n supply [sepref_fr_rules] = iam_empty_hnr_mop[where N=N]\n supply [sepref_fr_rules] = ial_empty_hnr[where N=N]\n supply [simp] = hm_empty_impl_aux BOUND\n by sepref\n end \n \n lemma hm_empty_op_aref': \"(hm_empty_op, PR_CONST (mop_hm_empty N))\\\\heapmap_rel\\nres_rel\"\n using hm_empty_op_aref by auto\n \n lemma mop_hm_empty_fref: \n \"(uncurry0 (PR_CONST (mop_hm_empty N)), uncurry0 (PR_CONST (mop_hm_empty N)))\\unit_rel \\\\<^sub>f \\\\Id,Id\\map_rel\\nres_rel\" \n by (auto intro!: frefI nres_relI)\n \n \n (* \n sepref_decl_op hm_empty: \"\\_::nat. op_map_empty\" :: \"nat_rel \\ \\Id,Id\\map_rel\" .\n definition \"hm_empty' (NN::nat) \\ hm_empty_op\"\n sepref_register hm_empty'\n\n lemma fold_custom_hm_empty:\n \"RETURN Map.empty = mop_hm_empty N\"\n \"mop_map_empty = mop_hm_empty N\"\n by auto\n \n lemma hm_empty'_aref: \"(hm_empty',mop_hm_empty)\\nat_rel \\ \\heapmap_rel\\nres_rel\"\n unfolding hm_empty'_def mop_hm_empty_def\n using hm_empty_op_aref by auto\n \n sepref_definition hm_empty_impl is \"hm_empty'\" :: \"[\\NN. NN=N]\\<^sub>a idx_assn\\<^sup>k \\ hm2_assn\"\n unfolding hm_empty'_def hm_empty_op_def hm2_assn_def\n apply (rule hfref_with_rdomI)\n apply (rewrite iam_fold_custom_empty[where N=N])\n apply (rewrite ial_fold_custom_empty[where N=N])\n supply [sepref_fr_rules] = iam_empty_hnr_mop[where N=N]\n supply [sepref_fr_rules] = ial_empty_hnr[where N=N]\n supply [[sepref_register_adhoc N]]\n by sepref\n \n end \n *)\n \n \n definition \"hm12_assn \\ hr_comp hm2_assn heapmap_rel\"\n \n context \n notes [fcomp_norm_unfold] = hm12_assn_def[symmetric]\n begin\n \n lemmas hm_empty_ref12 = hm_empty_impl.refine[FCOMP hm_empty_op_aref']\n lemmas hm_insert_ref12 = hm_insert_impl.refine[unfolded PR_CONST_def, FCOMP hm_insert_op_aref]\n lemmas hm_is_empty_ref12 = hm_is_empty_impl.refine[FCOMP hm_is_empty_op_aref]\n lemmas hm_the_lookup_ref12 = hm_the_lookup_impl_refine[FCOMP hm_the_lookup_op_aref]\n lemmas hm_contains_key_ref12 = hm_contains_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_contains_key_op_aref]\n lemmas hm_decrease_key_ref12 = hm_decrease_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_decrease_key_op_aref]\n lemmas hm_increase_key_ref12 = hm_increase_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_increase_key_op_aref]\n lemmas hm_change_key_ref12 = hm_change_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_change_key_op_aref]\n lemmas hm_set_ref12 = hm_set_impl.refine[unfolded PR_CONST_def, FCOMP hm_set_op_aref]\n lemmas hm_pop_min_ref12 = hm_pop_min_impl.refine[unfolded PR_CONST_def, FCOMP hm_pop_min_op_aref]\n lemmas hm_remove_ref12 = hm_remove_impl.refine[unfolded PR_CONST_def, FCOMP hm_remove_op_aref]\n lemmas hm_peek_min_ref12 = hm_peek_min_impl.refine[FCOMP hm_peek_min_op_aref]\n \n end\n\n definition \"hm_assn \\ hr_comp hm12_assn (\\nat_rel, Id\\map_rel)\"\n context\n notes [fcomp_norm_unfold] = hm_assn_def[symmetric]\n begin\n lemmas hm_empty_hnr = hm_empty_ref12[FCOMP mop_hm_empty_fref]\n \n sepref_decl_impl (ismop) hm_insert_ref12 uses mop_map_update_new.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_is_empty_ref12 uses mop_map_is_empty.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_the_lookup_ref12 uses mop_map_the_lookup.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_contains_key_ref12 uses mop_map_contains_key.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_decrease_key_ref12 uses mop_pm_decrease_key.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_increase_key_ref12 uses mop_pm_increase_key.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_change_key_ref12 uses mop_map_update_ex.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_set_ref12 uses mop_map_update.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_pop_min_ref12 uses mop_pm_pop_min.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_remove_ref12 uses mop_map_delete_ex.fref[where K=Id and V=Id] .\n sepref_decl_impl (ismop) hm_peek_min_ref12 uses mop_pm_peek_min.fref[where K=Id and V=Id] .\n end \n \n end \n\n \n global_interpretation \n HM: hm_impl id \"snat_assn' TYPE('l)\" \"snat_assn' TYPE('l)\" return ll_icmp_sle ll_icmp_slt \"TYPE('l::len2)\" N for N\n defines \n hm_empty_impl = HM.hm_empty_impl\n and hm_append_impl = HM.hm_append_impl\n and hm_insert_impl = HM.hm_insert_impl\n and hm_length_impl = HM.hm_length_impl\n and hm_swim_impl = HM.hm_swim_impl\n and hm_sink_impl = HM.hm_sink_impl\n and hm_is_empty_impl = HM.hm_is_empty_impl\n and hm_the_lookup_impl = HM.hm_the_lookup_impl\n and hm_contains_key_impl = HM.hm_contains_key_impl\n and hm_decrease_key_impl = HM.hm_decrease_key_impl\n and hm_increase_key_impl = HM.hm_increase_key_impl\n and hm_change_key_impl = HM.hm_change_key_impl\n and hm_parent_impl = HM.parent_impl\n and hm_parent_valid_impl = HM.parent_valid_impl\n and hm_next_child_impl = HM.hm_next_child_impl\n and hm_has_next_child_impl = HM.hm_has_next_child_impl\n and hm_left_child_impl = HM.hm_left_child_impl\n and hm_has_child_impl = HM.hm_has_child_impl\n and hm_repair_impl = HM.hm_repair_impl\n and hm_set_impl = HM.hm_set_impl\n and hm_pop_min_impl = HM.hm_pop_min_impl\n and hm_remove_impl = HM.hm_remove_impl\n and hm_peek_min_impl = HM.hm_peek_min_impl\n \n and hm_exch_impl = HM.hm_exch_impl\n and hm_update_impl = HM.hm_update_impl\n and hm_index_impl = HM.hm_index_impl\n and hm_prio_of_impl = HM.hm_prio_of_impl\n and hm_val_of_impl = HM.hm_val_of_impl\n and hm_key_of_impl = HM.hm_key_of_impl\n and hm_butlast_impl = HM.hm_butlast_impl\n \n \n apply unfold_locales\n apply (rule pure_pure)\n apply sepref\n apply sepref\n apply sepref\n done\n\n type_synonym 'l heapmap = \"'l ial \\ 'l word iam\" \n\n schematic_goal [sepref_frame_free_rules]: \"MK_FREE (HM.hm_assn N) (?fr)\"\n unfolding HM.hm_assn_def HM.hm12_assn_def HM.hm2_assn_def\n by sepref_dbg_side_keep\n \n \n \n concrete_definition hm_empty_impl' is HM.hm_empty_impl_def\n \n lemma hm_empty_hnr: \"\\(Ni, N) \\ snat_rel' TYPE('l); 4 < LENGTH('l::len2)\\\n \\ (uncurry0 (hm_empty_impl' Ni), uncurry0 (PR_CONST (HM.mop_hm_empty N)))\n \\ unit_assn\\<^sup>k \\\\<^sub>a HM.hm_assn N\"\n using hm_empty_impl'.refine HM.hm_empty_hnr by metis\n \n lemmas [llvm_code,llvm_inline] = \n HM.hm_append_impl_def\n HM.hm_is_empty_impl_def\n HM.hm_length_impl_def\n HM.hm_the_lookup_impl_def\n HM.hm_contains_key_impl_def\n HM.parent_impl_def\n HM.parent_valid_impl_def\n HM.hm_prio_of_impl_def\n HM.hm_val_of_impl_def\n HM.hm_key_of_impl_def\n HM.hm_next_child_impl_def\n HM.hm_has_next_child_impl_def\n HM.hm_left_child_impl_def\n HM.hm_has_child_impl_def\n HM.hm_butlast_impl_def\n\n \n lemmas [llvm_code] = \n HM.hm_insert_impl_def\n HM.hm_decrease_key_impl_def\n HM.hm_increase_key_impl_def\n HM.hm_change_key_impl_def\n HM.hm_swim_impl_def\n HM.hm_sink_impl_def\n HM.hm_exch_impl_def\n HM.hm_update_impl_def\n HM.hm_index_impl_def\n HM.hm_repair_impl_def\n HM.hm_set_impl_def\n HM.hm_pop_min_impl_def\n HM.hm_remove_impl_def\n HM.hm_peek_min_impl_def\n hm_empty_impl'_def\n \n\n term HM.hm_prio_of_impl \n thm HM.hm_prio_of_impl_def\n \n \n export_llvm\n \"hm_empty_impl' :: _ \\ 32 heapmap llM\"\n \"hm_append_impl:: _ \\ 32 word \\ _\"\n \"hm_is_empty_impl :: 32 heapmap \\ _\"\n \"hm_the_lookup_impl :: _ \\ 32 heapmap \\ _\"\n \"hm_contains_key_impl :: _ \\ 32 heapmap \\ _\"\n \"hm_decrease_key_impl :: _ \\ _ \\ 32 heapmap \\ _\"\n \"hm_increase_key_impl :: _ \\ _ \\ 32 heapmap \\ _\"\n \"hm_change_key_impl :: _ \\ _ \\ 32 heapmap \\ _\"\n \"hm_set_impl :: _ \\ _ \\ 32 heapmap \\ _\"\n \"hm_pop_min_impl :: 32 heapmap \\ _\"\n \"hm_remove_impl :: _ \\ 32 heapmap \\ _\"\n \"hm_peek_min_impl :: 32 heapmap \\ _\"\n file \"heapmap.ll\"\n \n \n\n context \n fixes N Ni\n assumes NiREF: \"(Ni,N)\\snat_rel' TYPE(32)\"\n notes [sepref_import_param] = NiREF\n notes [[sepref_register_adhoc N]]\n begin\n \n definition \"snatb (x::nat) \\ x\"\n lemma snatb_hnr: \"(return,RETURN o snatb) \\ [\\x. xa snat_assn\\<^sup>k \\ snatb_assn N\"\n unfolding snatb_def\n by sepref_to_hoare vcg\n \n definition \"heapmap_test \\ do {\n ASSERT (42 HM.mop_hm_empty N;\n m \\ mop_map_update (snatb 7) (snatb 3) m;\n m \\ mop_map_update (snatb 6) (snatb 2) m;\n m \\ mop_map_update (snatb 16) (snatb 1) m;\n (k,v) \\ mop_pm_peek_min id m;\n RETURN k\n }\"\n \n sepref_definition heapmap_test_impl_aux is \"uncurry0 heapmap_test\" :: \"unit_assn\\<^sup>k \\\\<^sub>a snat_assn' TYPE(32)\"\n unfolding heapmap_test_def\n supply [simp] = max_snat_def\n supply [sepref_fr_rules] = hm_empty_hnr[OF NiREF] snatb_hnr\n apply (annot_snat_const \"TYPE(32)\")\n by sepref\n \n end\n\n concrete_definition heapmap_test_impl is heapmap_test_impl_aux_def\n declare heapmap_test_impl_def[llvm_code]\n \n export_llvm heapmap_test_impl\n \n lemma \"(heapmap_test_impl_aux, heapmap_test) \\ snat_assn\\<^sup>k \\\\<^sub>a snat_assn\"\n apply rule\n apply (rule hn_refine_preI)\n using heapmap_test_impl_aux.refine[to_hnr]\n by (simp add: pure_def pred_lift_extract_simps sep_algebra_simps)\n \n \n xxx, ctd here: Just added support for dependent result relation.\n \n Test this first on simple data structure, e.g., MS_Array_List!\n \n \n \nend \n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/IICF/Impl/Heaps/IICF_Impl_Heapmap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.2698366209481967}} {"text": "theory ITree_Iteration\n imports ITree_Divergence ITree_Deadlock\nbegin\n\nsubsection \\ Iteration \\\n\ntext \\ For now we support only basic tail-recursive iteration. \\\n\ncorec iterate :: \"('s \\ bool) \\ ('e, 's) htree \\ ('e, 's) htree\" where\n\"iterate b P s = (if (b s) then (P s \\ (\\ \\ (iterate b P))) else Ret s)\"\n\nabbreviation \"loop \\ iterate (\\ s. True)\"\n\nabbreviation \"iter P \\ loop (\\ _. P) ()\"\n\nlemma iterate_cond_false [simp]:\n \"\\ (b s) \\ iterate b P s = Ret s\"\n by (simp add: iterate.code)\n\nlemma iterate_body_nonterminates:\n assumes \"nonterminating (P s)\" \"b s\"\n shows \"nonterminating (iterate b P s)\"\n by (simp add: assms iterate.code)\n\nlemma loop_unfold: \"loop P = P ;; (\\ \\ loop P)\"\n by (simp add: seq_itree_def kleisli_comp_def fun_eq_iff iterate.code)\n\nlemma loop_Ret: \"loop Ret = (\\ s. diverge)\"\n by (metis Sil_nfp_stabilises bind_Ret comp_apply diverges_then_diverge iterate.code)\n\nlemma iterate_Ret_dest:\n \"Ret x = iterate b P s \\ (\\ (b s) \\ x = s)\"\n apply (cases \"P s\")\n apply (metis bind_Ret comp_apply iterate.code itree.distinct(1) itree.sel(1))\n apply (metis bind_itree.disc_iff(1) iterate.code itree.disc(2) itree.discI(1) itree.inject(1))\n apply (metis bind_Vis iterate.code itree.distinct(3) itree.inject(1))\n done\n\nlemma iterate_RetE:\n assumes \"iterate b P s = Ret x\" \"\\ \\ (b s); x = s \\ \\ Q\"\n shows Q\n by (metis assms iterate_Ret_dest)\n\nlemma iterate_RetE':\n assumes \"Ret x = iterate b P s\" \"\\ \\ (b s); x = s \\ \\ Q\"\n shows Q\n by (metis assms iterate_Ret_dest)\n\nlemma iterate_Sil_dest: \n \"\\ P' = iterate b P s \\ (b s \\ ((\\ s'. P s = Ret s' \\ P' = iterate b P s') \\ (\\ P''. P s = \\ P'' \\ P' = (P'' \\ \\ \\ iterate b P))))\"\n apply (cases \"P s\")\n apply (simp_all)\n apply (metis bind_Ret comp_apply iterate.code itree.distinct(1) itree.sel(2))\n apply (metis bind_Sil iterate.code itree.distinct(1) itree.inject(2))\n apply (metis bind_Vis iterate.code itree.distinct(1) itree.distinct(5))\n done\n\nlemma iterate_SilE [elim, consumes 1, case_names initial continue]:\n assumes \"\\ P = iterate b Q s\"\n \"\\ P'. \\ b s; Q s = \\ P'; P = (P' \\ \\ \\ iterate b Q) \\ \\ R\"\n \"\\ s'. \\ b s; Q s = Ret s'; P = iterate b Q s' \\ \\ R\"\n shows R\n by (metis assms iterate_Sil_dest)\n\nlemma iterate_Vis_dest:\n \"Vis F = iterate b Q s \\ b s \\ (\\ G. Q s = Vis G \\ F = (map_pfun (\\ x. bind_itree x (\\ \\ iterate b Q)) G))\"\n apply (cases \"Q s\")\n apply (simp_all)\n apply (metis bind_Ret comp_apply iterate.code itree.simps(7) itree.simps(9))\n apply (metis bind_Sil iterate.code itree.distinct(3) itree.distinct(5))\n apply (metis bind_Vis iterate.code itree.inject(3) itree.simps(7))\n done\n\nlemma iterate_VisE:\n assumes \"Vis F = iterate b Q s\"\n \"\\ G. \\ b s; Q s = Vis G; F = (map_pfun (\\ x. bind_itree x (\\ \\ iterate b Q)) G) \\ \\ R\"\n shows R\n by (metis assms(1) assms(2) iterate_Vis_dest)\n\nlemma iterate_VisE'[consumes 1, case_names body]:\n assumes \"iterate b Q s = Vis F\"\n \"\\ G. \\ b s; Q s = Vis G; F = (map_pfun (\\ x. bind_itree x (\\ \\ iterate b Q)) G) \\ \\ R\"\n shows R\n by (metis assms(1) assms(2) iterate_Vis_dest)\n\nlemma iterate_trace_to:\n assumes \"P s \\es \\ Ret s'\" \"b s\"\n shows \"iterate b P s \\es\\ iterate b P s'\"\nproof -\n have \"(P s \\ \\ \\ iterate b P) \\es\\ (Ret s' \\ \\ \\ iterate b P)\"\n by (meson assms(1) trace_to_bind_left)\n thus ?thesis\n by (auto simp add: iterate.code assms)\nqed\n\nlemma iterate_term_once:\n assumes \"P s \\es \\ Ret s'\" \"b s\" \"\\ b s'\"\n shows \"iterate b P s \\es\\ Ret s'\"\n by (metis assms(1) assms(2) assms(3) iterate.code iterate_trace_to)\n\nsubsection \\ Power \\\n\noverloading\n itreepow \\ \"compow :: nat \\ ('e, 's) htree \\ ('e, 's) htree\"\nbegin\n\nfun itreepow :: \"nat \\ ('e, 's) htree \\ ('e, 's) htree\" where\n\"itreepow 0 P = Ret\" |\n\"itreepow (Suc n) P = P ;; itreepow n P\"\n\nend\n\nsubsection \\ Chains \\\n\ntype_synonym ('e, 's) chain = \"('e list \\ 's) list\"\n\ninductive itree_chain :: \"'s \\ ('e, 's) htree \\ ('e list \\ 's) list \\ 's \\ bool\" (\"_ \\ _ \\_\\\\<^sup>* _\" [55, 0, 0, 55] 55) where\nchain_Nil [intro]: \"s \\ P \\[]\\\\<^sup>* s\" |\nchain_step [intro]: \"\\ P(s) \\tr\\ \\ s\\<^sub>0; s\\<^sub>0 \\ P \\chn\\\\<^sup>* s\\<^sub>1 \\ \\ s \\ P \\(tr, s\\<^sub>0) # chn\\\\<^sup>* s\\<^sub>1\"\n\ninductive_cases\n chain_stepE [elim]: \"s \\ P \\(tr, s\\<^sub>0) # chn\\\\<^sup>* s\\<^sub>1\"\n\nlemma chain_last: \"\\ s \\ P \\chn\\\\<^sup>* s'; chn \\ [] \\ \\ snd (last chn) = s'\"\n by (induct rule: itree_chain.induct, auto)\n (metis itree_chain.simps list.discI)\n\nlemma chain_appendI: \"\\ s \\ P \\tr\\<^sub>1\\\\<^sup>* s\\<^sub>0; s\\<^sub>0 \\ P \\tr\\<^sub>2\\\\<^sup>* s' \\ \\ s \\ P \\tr\\<^sub>1 @ tr\\<^sub>2\\\\<^sup>* s'\"\n by (induct rule: itree_chain.induct, auto simp add: chain_step)\n\nlemma chain_appendD: \"s \\ P \\tr\\<^sub>1 @ tr\\<^sub>2\\\\<^sup>* s' \\ \\ s\\<^sub>0. s \\ P \\tr\\<^sub>1\\\\<^sup>* s\\<^sub>0 \\ s\\<^sub>0 \\ P \\tr\\<^sub>2\\\\<^sup>* s'\"\n apply (induct tr\\<^sub>1 arbitrary: s s')\n apply (simp)\n using chain_Nil apply fastforce\n apply (simp)\n apply (case_tac a)\n apply (meson chain_step chain_stepE)\n done \n\nlemma chain_append_iff: \"s \\ P \\tr\\<^sub>1 @ tr\\<^sub>2\\\\<^sup>* s' \\ (\\ s\\<^sub>0. s \\ P \\tr\\<^sub>1\\\\<^sup>* s\\<^sub>0 \\ s\\<^sub>0 \\ P \\tr\\<^sub>2\\\\<^sup>* s')\"\n by (meson chain_appendD chain_appendI)\n\ndefinition chain_states :: \"('e, 's) chain \\ 's set\" where\n\"chain_states chn = set (map snd chn)\"\n\nlemma chain_states_Nil [simp]: \"chain_states [] = {}\" by (simp add: chain_states_def)\nlemma chain_states_Cons [simp]: \"chain_states ((tr, s) # chn) = insert s (chain_states chn)\"\n by (auto simp add: chain_states_def)\n\ndefinition chain_trace :: \"('e, 's) chain \\ 'e list\" where\n\"chain_trace chn = concat (map fst chn)\"\n\nlemma chain_trace_Nil [simp]: \"chain_trace [] = []\" by (simp add: chain_trace_def)\nlemma chain_trace_Cons [simp]: \"chain_trace ((tr, s) # chn) = tr @ chain_trace chn\"\n by (simp add: chain_trace_def)\n\nlemma chain_first_step: \"\\ s \\ P \\chn\\\\<^sup>* s'; chn \\ [] \\ \\ P s \\fst (hd chn)\\ \\ (snd (hd chn))\"\n by (metis chain_stepE list.collapse prod.collapse)\n\nlemma chain_steps: \"\\ s \\ P \\chn\\\\<^sup>* s'; length chn > 1; i < length chn - 1 \\ \\ P (snd (chn ! i)) \\fst (chn ! Suc i)\\ \\ (snd (chn ! Suc i))\"\nproof (induct arbitrary: i rule: itree_chain.induct)\n case (chain_Nil s P)\n then show ?case by simp\nnext\n case (chain_step P s tr s\\<^sub>0 chn s\\<^sub>1)\n then show ?case\n proof (cases \"i = 0\")\n case True\n with chain_step show ?thesis\n by (simp, metis chain_first_step hd_conv_nth)\n next\n case False\n with chain_step gr0_conv_Suc show ?thesis\n by fastforce\n qed\nqed\n\nlemma chain_stated_indexed: \"(\\s\\chain_states chn. B s) \\ (\\ i 's \\ ('e, 's) htree \\ 'e list \\ 's \\ bool\" (\"_ \\ _ \\_\\\\<^sub>\\ _\" [55, 0, 0, 55] 55)\n where \"(b, s) \\ P \\tr\\\\<^sub>\\ s' \\ (\\ chn s\\<^sub>0 tr\\<^sub>0. b s \\ s \\ P \\chn\\\\<^sup>* s\\<^sub>0 \\ (\\s\\chain_states chn. b s) \\ P s\\<^sub>0 \\tr\\<^sub>0\\ \\ s' \\ tr = chain_trace chn @ tr\\<^sub>0)\"\n\ndeclare itree_term_chain.simps [simp del]\n\nlemma term_chain_step:\n assumes \"b s\" \"P(s) \\tr\\<^sub>0\\ \\ s\\<^sub>0\" \"(b, s\\<^sub>0) \\ P \\tr\\<^sub>1\\\\<^sub>\\ s'\"\n shows \"(b, s) \\ P \\tr\\<^sub>0 @ tr\\<^sub>1\\\\<^sub>\\ s'\"\nproof -\n obtain chn s\\<^sub>1 tr\\<^sub>2 where chn: \"b s\\<^sub>0\" \"s\\<^sub>0 \\ P \\chn\\\\<^sup>* s\\<^sub>1\" \"\\s\\chain_states chn. b s\" \"P s\\<^sub>1 \\tr\\<^sub>2\\ \\ s'\" \"tr\\<^sub>1 = chain_trace chn @ tr\\<^sub>2\"\n by (metis assms(3) itree_term_chain.simps)\n have chn': \"s \\ P \\(tr\\<^sub>0, s\\<^sub>0) # chn\\\\<^sup>* s\\<^sub>1\"\n by (simp add: assms(2) chain_step chn(2))\n show ?thesis\n apply (simp add: itree_term_chain.simps assms)\n apply (rule_tac x=\"(tr\\<^sub>0, s\\<^sub>0) # chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>1\" in exI)\n apply (simp_all add: chn chn')\n done\nqed\n\nlemma iterate_transition_chain:\n assumes \"s \\ P \\chn\\\\<^sup>* s'\" \"b s\" \"\\ s\\<^sub>0\\chain_states chn. b s\\<^sub>0\"\n shows \"iterate b P s \\chain_trace chn\\ iterate b P s'\"\nusing assms\nproof (induct s P chn s' rule: itree_chain.induct)\n case (chain_Nil s P)\n then show ?case by auto\nnext\n case (chain_step P s tr s\\<^sub>0 chn s\\<^sub>1)\n then show ?case \n by simp\n (meson iterate_trace_to trace_to_trans)\nqed\n\nlemma final_state_in_chain: \"\\ s \\ P \\chn\\\\<^sup>* s'; chn \\ [] \\ \\ s' \\ chain_states chn\"\n by (drule chain_last, simp, auto simp add: chain_states_def)\n\nlemma iterate_chain_terminates:\n assumes \"b s\" \"(b, s) \\ P \\tr\\\\<^sub>\\ s'\" \"\\ b s'\"\n shows \"iterate b P s \\tr\\ \\ s'\"\nproof -\n obtain chn s\\<^sub>0 tr\\<^sub>0 where P: \"s \\ P \\chn\\\\<^sup>* s\\<^sub>0\" \"\\s\\chain_states chn. b s\" \"P s\\<^sub>0 \\tr\\<^sub>0\\ \\ s'\" \"tr = chain_trace chn @ tr\\<^sub>0\"\n using assms\n by (simp add: itree_term_chain.simps, auto)\n\n have 1: \"iterate b P s \\chain_trace chn\\ iterate b P s\\<^sub>0\"\n by (simp add: P(1) P(2) assms(1) iterate_transition_chain)\n have 2: \"iterate b P s\\<^sub>0 \\tr\\<^sub>0\\ \\ s'\"\n proof -\n have \"b s\\<^sub>0\"\n by (metis P(1) P(2) assms(1) final_state_in_chain itree_chain.cases list.discI)\n thus ?thesis\n by (simp add: P(3) assms(3) iterate_term_once)\n qed\n show ?thesis\n using \"1\" \"2\" P(4) trace_to_trans by blast\nqed\n\n\nlemmas disj_cases[consumes 1, case_names disj1 disj2] = disjE\n\nlemma bind_extra_tauE:\n assumes \n \"(P \\ \\ \\ \\) \\tr\\ P'\"\n \"\\P\\<^sub>0. \\ P \\tr\\ P\\<^sub>0; P' = P\\<^sub>0 \\ \\ \\ \\ \\ \\ thesis\"\n \"\\x. \\ P \\tr\\ Ret x; P' = Ret x \\ \\ thesis\"\n shows thesis\n using assms\n by (auto elim!: trace_to_bindE)\n (metis Ret_trns bind_Ret comp_apply self_append_conv trace_to_SilE)\n\ntext \\ The next theorem states is a general law for extracting chains from prefixed iterations. \n We adopt the prefixed pattern (@{term \"Q \\ iterate b B\"} so that the inductive proof goes through.\n Whenever @{term \"(Q \\ iterate b B) \\tr\\ R\"} there are two possibilities. (1) The prefix @{term Q}\n performs the transition, and @{term \"iterate b B\"} is the continuation. (2) The prefix @{term Q}\n terminates in a state @{term \"s\"}, having done a prefix of the trace, and then there is a chain of \n iterations of the loop body. Finally, it is possible that the body makes partial progress, leading\n to another continuation. The overall trace is consists of (a) the trace contributed by @{term Q};\n (b) the trace contributed in the chain; and (c) the trace contributed by partial execution of\n they body @{term B}.\n \\\n\ntheorem prefixed_iterate_chain:\n fixes B :: \"('e, 's) htree\"\n assumes \"(Q \\ iterate b B) \\tr\\ R\"\n shows \"(\\ Q'. Q \\tr\\ Q' \\ R = Q' \\ iterate b B)\n \\ (\\ s chn s\\<^sub>0 tr\\<^sub>0 tr\\<^sub>1 P' n. \n Q \\tr\\<^sub>0\\ \\ s \\ b s \\ s \\ B \\chn\\\\<^sup>* s\\<^sub>0 \\ (\\ s\\chain_states chn. b s) \\ B s\\<^sub>0 \\tr\\<^sub>1\\ P' \n \\ tr = tr\\<^sub>0 @ chain_trace chn @ tr\\<^sub>1 \n \\ R = P' \\ Sils n \\ iterate b B \\ n \\ 1)\"\n using assms\n\\ \\ We begin the proof by induction on the transition relation. This leads to three top-level\n cases corresponding to the three possible ways a transition is constructed in the inductive predicate. \\\nproof (induct \"Q \\ iterate b B\" tr R arbitrary: Q rule: trace_to.induct)\n \\ \\ If the transition is empty, and so @{term \"R = Q \\ iterate b B\"}, then the proof is trivial. \\\n case trace_to_Nil\n then show ?case\n by blast\nnext\n text \\ If the transition is a @{term \"\\\"} then we need to further determine whether it originates\n in @{term Q} or in the loop @{term \"iterate b B\"}. \\\n case (trace_to_Sil P tr P')\n have \"\\ P = Q \\ iterate b B\"\n by (simp add: trace_to_Sil.hyps(3))\n thus ?case\n \\ \\ We split on these two possibilities below. \\\n proof (cases rule: bind_SilE')\n case (initial Q\\<^sub>0)\n note Q_def = this(1) and P_def = this(2)\n from trace_to_Sil.hyps(2)[of Q\\<^sub>0, OF initial(2)] show ?thesis\n \\ \\ If it originates in @{term Q}, we need to further split the inductive hypotheses. Either\n the remainder of @{term Q} (@{term Q\\<^sub>0}) can reach @{term R}, or else the loop body has\n executed, and so there is a chain. \\\n proof (cases rule: disj_cases)\n case disj1\n then show ?thesis\n using trace_to_Sil P_def Q_def by blast\n next\n case disj2\n then obtain s s\\<^sub>0 ::\"'s\" and chn::\"('e,'s) chain\" and tr\\<^sub>0 tr\\<^sub>1 :: \"'e list\" and B' :: \"('e, 's) itree\" and n :: nat\n where steps: \"Q\\<^sub>0 \\tr\\<^sub>0\\ \\ s\" \"b s\" \"s \\ B \\chn\\\\<^sup>* s\\<^sub>0\" \"\\ s\\chain_states chn. b s\" \"B s\\<^sub>0 \\tr\\<^sub>1\\ B'\" \n \"tr = tr\\<^sub>0 @ chain_trace chn @ tr\\<^sub>1\" \"P' = B' \\ Sils n \\ iterate b B\" \"n \\ 1\"\n by blast\n \n show ?thesis\n apply (simp add: Q_def P_def)\n apply (rule_tac disjI2)\n apply (rule_tac x=\"s\" in exI)\n apply (rule_tac x=\"chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>0\" in exI)\n apply (rule_tac x=\"tr\\<^sub>0\" in exI)\n apply (simp add: steps)\n using steps(5) steps(8) apply auto\n done\n qed\n next\n case (continue s)\n note defs = this\n with defs(2) show ?thesis\n \\ \\ If the @{term \\} originates in the loop, then again we need two cases: (1) it originates\n in the first execution of body, or (2) some further iterations. \\\n proof (cases rule: iterate_SilE)\n case (continue s') \n with trace_to_Sil(2)[of \"Ret s' :: ('e, 's) itree\", simplified, OF continue(3)] show ?thesis\n proof (cases rule: disj_cases)\n case disj1\n with continue show ?thesis\n apply (simp add: defs)\n apply (rule_tac disjI2)\n apply (rule_tac x=\"[]\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (auto)\n apply (metis Sils.simps(1) bot_nat_0.extremum)\n done\n next\n case disj2\n then obtain chn s\\<^sub>0 tr\\<^sub>1 P'' n where P'': \"b s'\" \"s' \\ B \\chn\\\\<^sup>* s\\<^sub>0\" \"\\ s\\chain_states chn. b s\" \"B s\\<^sub>0 \\tr\\<^sub>1\\ P''\" \"tr = chain_trace chn @ tr\\<^sub>1\" \"P' = P'' \\ Sils n \\ iterate b B\" \"n \\ 1\"\n by auto\n with continue show ?thesis\n apply (simp add: defs)\n apply (rule_tac disjI2)\n apply (rule_tac x=\"([], s') # chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>0\" in exI)\n apply auto\n done\n qed\n next\n \\ \\ The prefix terminated in state @{term s}, and body @{term B} made partial progress. \\\n case (initial P\\<^sub>0)\n hence P: \"P = P\\<^sub>0 \\ \\ \\ \\ \\ iterate b B\"\n by (simp add: bind_itree_assoc[THEN sym] comp_def)\n from trace_to_Sil(2)[of \"P\\<^sub>0 \\ Sil \\ Ret\", OF P] initial(1)\n show ?thesis\n proof (cases rule: disj_cases)\n case disj1\n with initial(1,2) show ?thesis \n apply (simp add: defs)\n apply (rule disjI2)\n apply (rule_tac x=\"[]\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (auto)\n apply (erule bind_extra_tauE)\n apply (simp)\n apply (rule_tac x=\"P\\<^sub>0'\" in exI)\n apply (auto simp add: bind_itree_assoc[THEN sym] comp_def)\n apply (rule_tac x=\"1\" in exI)\n apply simp\n apply (metis Sils.simps(1) bind_Ret bot_nat_0.extremum trace_to.trace_to_Sil)\n done\n next\n case disj2\n then obtain s\\<^sub>0 chn s\\<^sub>1 tr\\<^sub>0 tr\\<^sub>1 P'' n\n where P\\<^sub>0: \"(P\\<^sub>0 \\ \\ \\ \\) \\tr\\<^sub>0\\ \\ s\\<^sub>0\" \"b s\\<^sub>0\" \"s\\<^sub>0 \\ B \\chn\\\\<^sup>* s\\<^sub>1\" \"\\ s\\chain_states chn. b s\"\n \"B s\\<^sub>1 \\tr\\<^sub>1\\ P''\" \"tr = tr\\<^sub>0 @ chain_trace chn @ tr\\<^sub>1\" \"P' = P'' \\ Sils n \\ iterate b B\" \"n \\ 1\"\n by auto\n then show ?thesis\n apply (simp add: defs)\n apply (rule_tac disjI2)\n apply auto\n using initial(1) apply fastforce\n apply (rule_tac x=\"(tr\\<^sub>0, s\\<^sub>0) # chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>1\" in exI)\n apply auto\n apply (simp add: chain_step initial(2) trace_to_post_Sil_iff)\n done\n qed\n qed\n qed\nnext\n case (trace_to_Vis e F tr P')\n hence \"Vis F = Q \\ iterate b B\" by simp\n thus ?case\n proof (cases rule: bind_VisE')\n case (initial F')\n have F: \"F(e)\\<^sub>p = F'(e)\\<^sub>p \\ iterate b B\"\n using initial(2) trace_to_Vis.hyps(1) by auto\n\n from trace_to_Vis(3)[of \"F'(e)\\<^sub>p\", OF F] show ?thesis\n proof (cases rule: disj_cases)\n case disj1\n then show ?thesis\n using initial(1) initial(2) trace_to_Vis.hyps(1) by auto\n next\n case disj2\n then show ?thesis\n by (metis append_Cons initial(1) initial(2) pdom_map_pfun trace_to.trace_to_Vis trace_to_Vis.hyps(1)) \n qed\n next\n case (continue s)\n from continue(2) show ?thesis\n proof (cases rule: iterate_VisE')\n case (body G)\n hence \"F(e)\\<^sub>p = G(e)\\<^sub>p \\ \\ \\ iterate b B\"\n using trace_to_Vis.hyps(1) by auto\n hence F: \"F(e)\\<^sub>p = G(e)\\<^sub>p \\ \\ \\ \\ \\ iterate b B\"\n by (simp add: bind_itree_assoc[THEN sym] comp_def)\n from trace_to_Vis(3)[of \"G(e)\\<^sub>p \\ Sil \\ Ret\", OF F] show ?thesis\n proof (cases rule: disj_cases)\n case disj1\n then obtain Q' where \"(G(e)\\<^sub>p \\ \\ \\ \\) \\tr\\ Q'\" \"P' = Q' \\ iterate b B\"\n by auto\n with trace_to_Vis(1) continue(1) body show ?thesis\n apply (simp)\n apply (rule_tac x=\"[]\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply auto\n apply (erule bind_extra_tauE)\n apply (rule_tac x=\"P\\<^sub>0\" in exI)\n apply auto\n apply (rule_tac x=\"1\" in exI)\n apply (simp add: bind_itree_assoc[THEN sym] comp_def)\n apply (metis Sils.simps(1) bind_Ret bot_nat_0.extremum comp_eq_dest_lhs)\n done\n next\n case disj2\n then obtain s\\<^sub>0 chn s\\<^sub>1 tr\\<^sub>0 tr\\<^sub>1 P'' n \n where G: \"(G(e)\\<^sub>p \\ \\ \\ \\) \\tr\\<^sub>0\\ \\ s\\<^sub>0\" \"b s\\<^sub>0\" \n and chn: \"s\\<^sub>0 \\ B \\chn\\\\<^sup>* s\\<^sub>1\" \"\\ s\\chain_states chn. b s\" \"B s\\<^sub>1 \\tr\\<^sub>1\\ P''\" \"tr = tr\\<^sub>0 @ chain_trace chn @ tr\\<^sub>1\" and P': \"P' = P'' \\ Sils n \\ iterate b B\" \"n \\ 1\"\n by auto\n from G trace_to_Vis(1,2) continue(1) body P' chn show ?thesis\n apply (simp)\n apply (erule bind_extra_tauE)\n apply (rule_tac x=\"(e # tr, s\\<^sub>0) # chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>1\" in exI)\n apply auto\n apply (rule_tac x=\"(e # tr\\<^sub>0, s\\<^sub>0) # chn\" in exI)\n apply (rule_tac x=\"s\\<^sub>1\" in exI)\n apply auto\n done\n qed \n qed\n qed\nqed\n\nlemma iterate_chain [consumes 1, case_names iterates terms]:\n assumes \n \"iterate b B s \\tr\\ R\"\n \"\\ chn s\\<^sub>0 tr\\<^sub>0 P' n. \n \\ b s;\n s \\ B \\chn\\\\<^sup>* s\\<^sub>0; \n \\ s\\chain_states chn. b s;\n B s\\<^sub>0 \\tr\\<^sub>0\\ P';\n tr = chain_trace chn @ tr\\<^sub>0; \n R = P' \\ Sils n \\ iterate b B; \n n \\ 1\n \\ \\ P\"\n \"\\ \\ b s; tr = []; R = \\ s \\ \\ P\"\n shows P\nproof (cases \"b s\")\n case True\n show ?thesis\n using prefixed_iterate_chain[of \"\\ s\", simplified, OF assms(1)]\n proof (cases rule: disj_cases)\n case disj1\n then show ?thesis\n by (rule_tac assms(2)[of \"[]\" s \"[]\" \"B s\" 1, simplified], auto simp add: iterate.code comp_def assms True)\n next\n case disj2\n then show ?thesis\n using assms(2) by force\n qed \nnext\n case False\n thus ?thesis\n using assms(1) assms(3) by force\nqed\n\nlemma iterate_terminates_chain:\n assumes \n \"iterate b B s \\tr\\ \\ s'\"\n \"\\ b s; (b, s) \\ B \\tr\\\\<^sub>\\ s'; \\ b s' \\ \\ P\"\n \"\\ \\ b s; tr = []; s' = s \\ \\ P\"\n shows P\n using assms\nproof (cases rule: iterate_chain)\n case (iterates chn s\\<^sub>0 tr\\<^sub>0 P' n)\n hence P': \"P' = \\ s'\" \"\\ b s'\"\n by (auto elim!: bind_RetE', metis Ret_Sils_iff iterate_RetE')+\n then show ?thesis\n by (metis assms(2) iterates(1-5) itree_term_chain.simps)\nnext\n case terms\n then show ?thesis\n using assms(3) by fastforce\nqed\n\nlemma iterate_term_chain_iff:\n \"iterate b B s \\tr\\ \\ s' \\ \n ((\\ b s \\ s = s' \\ tr = []) \\ (b s \\ (b, s) \\ B \\tr\\\\<^sub>\\ s' \\ \\ b s'))\"\nproof (cases \"b s\")\n case True\n then show ?thesis\n by (metis iterate_chain_terminates iterate_terminates_chain)\nnext\n case False\n then show ?thesis\n by force \nqed\n\ntext \\ If @{term P} is an invariant of a chain for process @{term C}, then the invariant holds\n for every element of the looped process @{term C}. \\\n\nlemma chain_invariant:\n assumes \n \"B s\" \"P s\"\n \"\\ s s'. \\ B s; P s; s' \\ \\<^bold>R(C s) \\ \\ P s'\"\n \"s \\ C \\chn\\\\<^sup>* s'\"\n \"\\ s\\<^sub>0\\chain_states chn. B s\\<^sub>0\"\n shows \"\\ s\\<^sub>0\\chain_states chn. P s\\<^sub>0\"\nproof -\n have \"\\ifst (chn ! 0)\\ \\ (snd (chn ! 0))\"\n by (metis assms(4) chain_first_step hd_conv_nth length_greater_0_conv)\n thus ?case\n by (meson assms(1) assms(2) assms(3) retvals_traceI)\n next\n case (Suc i)\n hence \"C (snd (chn ! i)) \\fst (chn ! Suc i)\\ \\ (snd (chn ! Suc i))\"\n using assms(4) chain_steps by fastforce \n moreover have \"P (snd (chn ! i))\"\n by (simp add: Suc.hyps Suc.prems Suc_lessD)\n moreover have \"B (snd (chn ! i))\"\n by (simp add: Suc.prems Suc_lessD assms(5) chain_states_def)\n ultimately show ?case\n by (meson assms(3) retvals_traceI)\n qed\n qed\n thus ?thesis\n by (simp add: chain_stated_indexed)\nqed\n\nlemma chain_invariant_simple:\n assumes \n \"P s\"\n \"\\ s s'. \\ P s; s' \\ \\<^bold>R(C s) \\ \\ P s'\"\n \"s \\ C \\chn\\\\<^sup>* s'\"\n shows \"\\ s\\<^sub>0\\chain_states chn. P s\\<^sub>0\"\n using assms\n by (rule_tac chain_invariant[of \"\\ s. True\" s P C chn s'], auto)\n\ntext \\ We can establish termination, as usual, with an variant function. Here, ``terminates'' means \n that an ITree may terminate. \\\n\ndefinition terminates :: \"('e, 's) itree \\ bool\" where\n\"terminates P = (\\ tr s'. P \\tr\\ \\ s')\"\n\nlemma terminates_Ret: \"terminates (\\ s')\"\n by (simp add: terminates_def)\n\nlemma terminates_Sil: \"terminates (Sil P) = terminates P\"\n by (simp add: terminates_def)\n\nlemma terminates_Sils: \"terminates (Sils n P) = terminates P\"\n by (simp add: terminates_def)\n\nlemma terminates_bind:\n assumes \"terminates P\" \"\\ v. v \\ \\<^bold>R(P) \\ terminates(Q v)\"\n shows \"terminates (P \\ Q)\"\n by (meson assms(1) assms(2) retvals_traceI terminates_def trace_to_bind)\n\nlemma not_terminates_diverge:\n \"terminates diverge = False\"\n by (meson diverge_no_Ret_trans terminates_def)\n\ntext \\ A terminating pure ITree is divergence free \\\n\nlemma terminates_pure_implies_div_free:\n assumes \"pure_itree P\" \"terminates P\"\n shows \"div_free P\"\n by (metis Sils_diverge assms div_free_is_no_divergence no_divergence_def not_terminates_diverge pure_itree_def trace_to_Nil_Sils)\n\ntext \\ The following theorem using both a variant @{term V} and invariant @{term I} to establish\n termination. \\\n\nlemma wellorder_variant_term_chain:\n fixes V :: \"'s \\ 'a::wellorder\" and I :: \"'s \\ bool\"\n assumes \n \"\\ s\\<^sub>0. \\ b s\\<^sub>0; I s\\<^sub>0 \\ \\ terminates (B s\\<^sub>0)\"\n \"\\ s\\<^sub>0 s\\<^sub>1 tr. \\ b s\\<^sub>0; I s\\<^sub>0; B(s\\<^sub>0) \\tr\\ \\ s\\<^sub>1 \\ \\ I s\\<^sub>1\"\n \"\\ s\\<^sub>0 s\\<^sub>1 tr. \\ b s\\<^sub>0; I s\\<^sub>0; B(s\\<^sub>0) \\tr\\ \\ s\\<^sub>1 \\ \\ V(s\\<^sub>1) < V(s\\<^sub>0)\"\n shows \"\\ I s; b s \\ \\ \\ tr s'. (b, s) \\ B \\tr\\\\<^sub>\\ s' \\ \\ b s'\"\nproof (induct \"V(s)\" arbitrary: s rule: less_induct)\n case (less s\\<^sub>0)\n obtain s\\<^sub>1 tr\\<^sub>0 where B_next: \"B(s\\<^sub>0) \\tr\\<^sub>0\\ \\ s\\<^sub>1\"\n by (meson assms(1) less.prems(1) less.prems(2) terminates_def)\n have inv: \"I s\\<^sub>1\"\n using B_next assms(2) less.prems(1) less.prems(2) by presburger\n have dec: \"V(s\\<^sub>1) < V(s\\<^sub>0)\"\n using B_next assms(3) less.prems(1) less.prems(2) by force\n show ?case\n proof (cases \"b s\\<^sub>1\")\n case True\n obtain tr\\<^sub>1 s' where chain: \"(b, s\\<^sub>1) \\ B \\tr\\<^sub>1\\\\<^sub>\\ s' \\ \\ b s'\"\n using True dec inv less.hyps by presburger\n then show ?thesis\n by (meson B_next less.prems term_chain_step) \n next\n case False\n then show ?thesis\n by (metis B_next iterate_term_chain_iff iterate_term_once less.prems(2)) \n qed \nqed\n\nlemma terminates_iterate_wellorder_variant:\n fixes V :: \"'s \\ 'a::wellorder\" and I :: \"'s \\ bool\"\n assumes \n \"\\ s\\<^sub>0. \\ b s\\<^sub>0; I s\\<^sub>0 \\ \\ terminates (B s\\<^sub>0)\"\n \"\\ s\\<^sub>0 s\\<^sub>1 tr. \\ b s\\<^sub>0; I s\\<^sub>0; B(s\\<^sub>0) \\tr\\ \\ s\\<^sub>1 \\ \\ I s\\<^sub>1\"\n \"\\ s\\<^sub>0 s\\<^sub>1 tr. \\ b s\\<^sub>0; I s\\<^sub>0; B(s\\<^sub>0) \\tr\\ \\ s\\<^sub>1 \\ \\ V(s\\<^sub>1) < V(s\\<^sub>0)\"\n \"I s\"\n shows \"terminates (iterate b B s)\"\nproof (cases \"b s\")\n case True\n have \"\\ tr s'. (b, s) \\ B \\tr\\\\<^sub>\\ s' \\ \\ b s'\"\n by (rule wellorder_variant_term_chain[of b I B V], simp_all add: assms True)\n then show ?thesis\n by (metis iterate_term_chain_iff terminates_def)\n next\n case False\n then show ?thesis\n by (simp add: terminates_def)\nqed\n\ntext \\ Generalised deadlock freedom check for loops. If @{term P} is sufficient establish deadlock\n freedom of @{term C}, and @{term P} is an invariant of @{term C}, which holds also in the initial\n state @{term s}, then @{term \"loop C s\"} is also deadlock free. \\\n\nlemma deadlock_free_loop:\n assumes cond_dlockf: \"\\ s. P s \\ deadlock_free (C s)\" \n and invariant: \"\\ s s'. \\ P s; s' \\ \\<^bold>R(C s) \\ \\ P s'\"\n and initial: \"P s\"\n shows \"deadlock_free (loop C s)\"\nproof (simp add: deadlock_free_def deadlock_def, clarify)\n fix tr \n assume \"loop C s \\tr\\ Vis {\\}\"\n thus False\n proof (cases rule: iterate_chain)\n case (iterates chn s\\<^sub>0 tr\\<^sub>0 P' n)\n with initial invariant have \"\\ s\\chain_states chn. P s\"\n by (rule_tac chain_invariant_simple[where s=\"s\" and C=\"C\" and s'=\"s\\<^sub>0\"], auto)\n hence dlckf_C_s\\<^sub>0: \"deadlock_free (C s\\<^sub>0)\"\n by (metis cond_dlockf final_state_in_chain initial iterates(2) itree_chain.cases list.distinct(1))\n with iterates(6) show False\n proof (cases rule: bind_VisE')\n case (initial F')\n then show ?thesis\n by (metis deadlock_def deadlock_free_def dlckf_C_s\\<^sub>0 iterates(4) pdom_empty_iff_dom_empty pdom_map_pfun)\n next\n case (continue s')\n have \"loop C s' = Vis {\\}\"\n by (metis comp_apply continue(2) deadlock_def deadlock_trace_to trace_of_Sils)\n then show ?thesis\n by (metis (no_types, lifting) \\\\s\\chain_states chn. P s\\ cond_dlockf continue(1) deadlock_def deadlock_free_def deadlock_trace_to final_state_in_chain initial invariant iterate_VisE iterates(2) iterates(4) itree_chain.simps list.distinct(1) pdom_empty_iff_dom_empty pdom_map_pfun pdom_zero retvals_traceI)\n qed\n next\n case terms\n then show ?thesis\n by blast\n qed\nqed\n \n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/ITree_Iteration.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.2698366209481967}} {"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\Comma categories\\\ntheory CZH_ECAT_Comma\n imports \n CZH_ECAT_NTCF\n CZH_ECAT_Simple\nbegin\n\n\n\nsubsection\\Background\\\n\nnamed_theorems cat_comma_cs_simps\nnamed_theorems cat_comma_cs_intros\n\n\n\nsubsection\\Comma category\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\\nSee Exercise 1.3.vi in \\<^cite>\\\"riehl_category_2016\"\\ or \nChapter II-6 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\n\\\n\ndefinition cat_comma_Obj :: \"V \\ V \\ V\"\n where \"cat_comma_Obj \\ \\ \\ set\n {\n [a, b, f]\\<^sub>\\ | a b f.\n a \\\\<^sub>\\ \\\\HomDom\\\\Obj\\ \\\n b \\\\<^sub>\\ \\\\HomDom\\\\Obj\\ \\\n f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\HomCod\\\\<^esub> \\\\ObjMap\\\\b\\\n }\"\n\nlemma small_cat_comma_Obj[simp]: \n \"small\n {\n [a, b, f]\\<^sub>\\ | a b f.\n a \\\\<^sub>\\ \\\\Obj\\ \\ b \\\\<^sub>\\ \\\\Obj\\ \\ f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\n }\"\n (is \\small ?abfs\\)\nproof-\n define Q where\n \"Q i = (if i = 0 then \\\\Obj\\ else if i = 1\\<^sub>\\ then \\\\Obj\\ else \\\\Arr\\)\" \n for i\n have \"?abfs \\ elts (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n unfolding Q_def\n proof\n (\n intro subsetI, \n unfold mem_Collect_eq, \n elim exE conjE, \n intro vproductI; \n simp only:\n )\n fix a b f show \"\\\\<^sub>\\ [a, b, f]\\<^sub>\\ = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: three nat_omega_simps)\n qed (force simp: nat_omega_simps)+\n then show \"small ?abfs\" by (rule down)\nqed\n\ndefinition cat_comma_Hom :: \"V \\ V \\ V \\ V \\ V\"\n where \"cat_comma_Hom \\ \\ A B \\ set\n {\n [A, B, [g, h]\\<^sub>\\]\\<^sub>\\ | g h.\n A \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n B \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n g : A\\0\\ \\\\<^bsub>\\\\HomDom\\\\<^esub> B\\0\\ \\\n h : A\\1\\<^sub>\\\\ \\\\<^bsub>\\\\HomDom\\\\<^esub> B\\1\\<^sub>\\\\ \\\n B\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> \\\\ArrMap\\\\g\\ =\n \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> A\\2\\<^sub>\\\\\n }\"\n\nlemma small_cat_comma_Hom[simp]: \"small\n {\n [A, B, [g, h]\\<^sub>\\]\\<^sub>\\ | g h.\n A \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n B \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n g : A\\0\\ \\\\<^bsub>\\\\<^esub> B\\0\\ \\\n h : A\\1\\<^sub>\\\\ \\\\<^bsub>\\\\<^esub> B\\1\\<^sub>\\\\ \\\n B\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> A\\2\\<^sub>\\\\\n }\"\n (is \\small ?abf_a'b'f'_gh\\)\nproof-\n define Q where\n \"Q i =\n (\n if i = 0\n then cat_comma_Obj \\ \\ \n else if i = 1\\<^sub>\\ then cat_comma_Obj \\ \\ else \\\\Arr\\ \\\\<^sub>\\ \\\\Arr\\\n )\"\n for i\n have \"?abf_a'b'f'_gh \\ elts (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n unfolding Q_def\n proof\n (\n intro subsetI, \n unfold mem_Collect_eq, \n elim exE conjE,\n intro vproductI; \n simp only:\n )\n fix a b f show \"\\\\<^sub>\\ [a, b, f]\\<^sub>\\ = ZFC_in_HOL.set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: three nat_omega_simps)\n qed (force simp : nat_omega_simps)+\n then show \"small ?abf_a'b'f'_gh\" by (rule down)\nqed\n\ndefinition cat_comma_Arr :: \"V \\ V \\ V\"\n where \"cat_comma_Arr \\ \\ \\\n (\n \\\\<^sub>\\A\\\\<^sub>\\cat_comma_Obj \\ \\. \\\\<^sub>\\B\\\\<^sub>\\cat_comma_Obj \\ \\.\n cat_comma_Hom \\ \\ A B\n )\"\n\ndefinition cat_comma_composable :: \"V \\ V \\ V\"\n where \"cat_comma_composable \\ \\ \\ set\n {\n [[B, C, G]\\<^sub>\\, [A, B, F]\\<^sub>\\]\\<^sub>\\ | A B C G F.\n [B, C, G]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Arr \\ \\ \\ [A, B, F]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Arr \\ \\\n }\"\n\nlemma small_cat_comma_composable[simp]:\n shows \"small\n {\n [[B, C, G]\\<^sub>\\, [A, B, F]\\<^sub>\\]\\<^sub>\\ | A B C G F.\n [B, C, G]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Arr \\ \\ \\ [A, B, F]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Arr \\ \\\n }\"\n (is \\small ?S\\)\nproof(rule down)\n show \"?S \\ elts (cat_comma_Arr \\ \\ \\\\<^sub>\\ cat_comma_Arr \\ \\)\" by auto\nqed\n\ndefinition cat_comma :: \"V \\ V \\ V\" (\\(_ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F _)\\ [1000, 1000] 999)\n where \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ =\n [\n cat_comma_Obj \\ \\,\n cat_comma_Arr \\ \\,\n (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\0\\),\n (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\1\\<^sub>\\\\),\n (\n \\GF\\\\<^sub>\\cat_comma_composable \\ \\.\n [\n GF\\1\\<^sub>\\\\\\0\\,\n GF\\0\\\\1\\<^sub>\\\\,\n [\n GF\\0\\\\2\\<^sub>\\\\\\0\\ \\\\<^sub>A\\<^bsub>\\\\HomDom\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\0\\,\n GF\\0\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomDom\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\\n ]\\<^sub>\\\n ]\\<^sub>\\\n ),\n (\n \\A\\\\<^sub>\\cat_comma_Obj \\ \\.\n [A, A, [\\\\HomDom\\\\CId\\\\A\\0\\\\, \\\\HomDom\\\\CId\\\\A\\1\\<^sub>\\\\\\]\\<^sub>\\]\\<^sub>\\\n )\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma cat_comma_components:\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\ = cat_comma_Obj \\ \\\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\ = cat_comma_Arr \\ \\\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\ = (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\0\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\ = (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\1\\<^sub>\\\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Comp\\ =\n (\n \\GF\\\\<^sub>\\cat_comma_composable \\ \\.\n [\n GF\\1\\<^sub>\\\\\\0\\,\n GF\\0\\\\1\\<^sub>\\\\,\n [\n GF\\0\\\\2\\<^sub>\\\\\\0\\ \\\\<^sub>A\\<^bsub>\\\\HomDom\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\0\\,\n GF\\0\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomDom\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\\n ]\\<^sub>\\\n ]\\<^sub>\\\n )\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\ =\n (\n \\A\\\\<^sub>\\cat_comma_Obj \\ \\.\n [A, A, [\\\\HomDom\\\\CId\\\\A\\0\\\\, \\\\HomDom\\\\CId\\\\A\\1\\<^sub>\\\\\\]\\<^sub>\\]\\<^sub>\\\n )\"\n unfolding cat_comma_def dg_field_simps by (simp_all add: nat_omega_simps)\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nlemma cat_comma_Obj_def':\n \"cat_comma_Obj \\ \\ \\ set\n {\n [a, b, f]\\<^sub>\\ | a b f.\n a \\\\<^sub>\\ \\\\Obj\\ \\ b \\\\<^sub>\\ \\\\Obj\\ \\ f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\n }\"\n unfolding cat_comma_Obj_def cat_cs_simps by simp\n\nlemma cat_comma_Hom_def':\n \"cat_comma_Hom \\ \\ A B \\ set\n {\n [A, B, [g, h]\\<^sub>\\]\\<^sub>\\ | g h.\n A \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n B \\\\<^sub>\\ cat_comma_Obj \\ \\ \\\n g : A\\0\\ \\\\<^bsub>\\\\<^esub> B\\0\\ \\\n h : A\\1\\<^sub>\\\\ \\\\<^bsub>\\\\<^esub> B\\1\\<^sub>\\\\ \\\n B\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> A\\2\\<^sub>\\\\\n }\"\n unfolding cat_comma_Hom_def cat_cs_simps by simp\n\nlemma cat_comma_components':\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\ = cat_comma_Obj \\ \\\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\ = cat_comma_Arr \\ \\\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\ = (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\0\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\ = (\\F\\\\<^sub>\\cat_comma_Arr \\ \\. F\\1\\<^sub>\\\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Comp\\ =\n (\n \\GF\\\\<^sub>\\cat_comma_composable \\ \\.\n [\n GF\\1\\<^sub>\\\\\\0\\,\n GF\\0\\\\1\\<^sub>\\\\,\n [\n GF\\0\\\\2\\<^sub>\\\\\\0\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\0\\,\n GF\\0\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> GF\\1\\<^sub>\\\\\\2\\<^sub>\\\\\\1\\<^sub>\\\\\n ]\\<^sub>\\\n ]\\<^sub>\\\n )\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\ =\n (\\A\\\\<^sub>\\cat_comma_Obj \\ \\. [A, A, [\\\\CId\\\\A\\0\\\\, \\\\CId\\\\A\\1\\<^sub>\\\\\\]\\<^sub>\\]\\<^sub>\\)\"\n unfolding cat_comma_components cat_cs_simps by simp_all\n\nend\n\n\nsubsubsection\\Objects\\\n\nlemma cat_comma_ObjI[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n shows \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n using assms(4-6) \n unfolding cat_comma_Obj_def'[OF assms(1,2)] assms(3) cat_comma_components \n by simp\n\nlemma cat_comma_ObjD[dest]:\n assumes \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n using assms\n unfolding \n cat_comma_components'[OF assms(2,3)] cat_comma_Obj_def'[OF assms(2,3)] \n by auto\n\nlemma cat_comma_ObjE[elim]:\n assumes \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains a b f where \"A = [a, b, f]\\<^sub>\\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n using assms\n unfolding \n cat_comma_components'[OF assms(2,3)] cat_comma_Obj_def'[OF assms(2,3)] \n by auto\n\n\nsubsubsection\\Arrows\\\n\nlemma cat_comma_HomI[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"F = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n shows \"F \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n using assms(1,2,6-10)\n unfolding cat_comma_Hom_def'[OF assms(1,2)] assms(3-5)\n by \n (\n intro in_set_CollectI exI conjI small_cat_comma_Hom, \n unfold cat_comma_components'(1,2)[OF assms(1,2), symmetric],\n (\n cs_concl \n cs_simp: cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n )\n (clarsimp simp: nat_omega_simps)+\n\nlemma cat_comma_HomE[elim]:\n assumes \"F \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains a b f a' b' f' g h\n where \"F = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n using assms(1) \n by \n (\n unfold\n cat_comma_components'[OF assms(2,3)] cat_comma_Hom_def'[OF assms(2,3)],\n elim in_small_setE; \n (unfold mem_Collect_eq, elim exE conjE cat_comma_ObjE[OF _ assms(2,3)])?,\n insert that,\n all\\\n (unfold cat_comma_components'(1,2)[OF assms(2,3), symmetric],\n elim cat_comma_ObjE[OF _ assms(2,3)]) | -\n \\\n )\n (auto simp: nat_omega_simps)\n\nlemma cat_comma_HomD[dest]:\n assumes \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n using assms(1) by (force elim!: cat_comma_HomE[OF _ assms(2,3)])+\n\nlemma cat_comma_ArrI[cat_comma_cs_intros]: \n assumes \"F \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n using assms \n unfolding cat_comma_components cat_comma_Arr_def \n by (intro vifunionI)\n\nlemma cat_comma_ArrE[elim]:\n assumes \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n obtains A B \n where \"F \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n using assms unfolding cat_comma_components cat_comma_Arr_def by auto\n\nlemma cat_comma_ArrD[dest]: \n assumes \"[A, B, F]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"[A, B, F]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof-\n from assms obtain C D \n where \"[A, B, F]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Hom \\ \\ C D\"\n and \"C \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"D \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (elim cat_comma_ArrE)\n moreover from cat_comma_HomE[OF this(1) assms(2,3)] have \"A = C\" and \"B = D\"\n by auto\n ultimately show \"[A, B, F]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by auto\nqed\n\n\nsubsubsection\\Domain\\\n\nlemma cat_comma_Dom_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\)\"\n unfolding cat_comma_components by simp\n\nlemma cat_comma_Dom_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_comma_components by simp\n\nlemma cat_comma_Dom_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\\\ABF\\ = A\"\n using assms(2) unfolding assms(1) cat_comma_components by simp\n\nlemma cat_comma_Dom_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof(rule vsv.vsv_vrange_vsubset)\n fix ABF assume \"ABF \\\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\)\"\n then have \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\" \n by (cs_prems cs_shallow cs_simp: cat_comma_cs_simps)\n then obtain A B \n where ABF: \"ABF \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and A: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and B: \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by auto\n from this(1) obtain a b f a' b' f' g h\n where \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_HomE[OF _ assms(1,2)])\n from ABF this A B show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\\\ABF\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\nqed (auto intro: cat_comma_cs_intros)\n\n\nsubsubsection\\Codomain\\\n\nlemma cat_comma_Cod_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\)\"\n unfolding cat_comma_components by simp\n\nlemma cat_comma_Cod_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_comma_components by simp\n\nlemma cat_comma_Cod_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\\\ABF\\ = B\"\n using assms(2)\n unfolding assms(1) cat_comma_components\n by (simp add: nat_omega_simps)\n\nlemma cat_comma_Cod_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof(rule vsv.vsv_vrange_vsubset)\n fix ABF assume \"ABF \\\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\)\"\n then have \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\" \n by (cs_prems cs_shallow cs_simp: cat_comma_cs_simps)\n then obtain A B \n where F: \"ABF \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n and A: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and B: \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by auto\n from this(1) obtain a b f a' b' f' g h\n where \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_HomE[OF _ assms(1,2)])\n from F this A B show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\\\ABF\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\nqed (auto intro: cat_comma_cs_intros)\n\n\nsubsubsection\\Arrow with a domain and a codomain\\\n\nlemma cat_comma_is_arrI[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"ABF = [A, B, F]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"F = [g, h]\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n shows \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\nproof(intro is_arrI)\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n from assms(7-11) show \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding assms(3-6)\n by \n (\n cs_concl \n cs_simp: cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n with assms(7-11) show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\\\ABF\\ = A\" \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\\\ABF\\ = B\"\n unfolding assms(3-6) by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)+\nqed\n\nlemma cat_comma_is_arrD[dest]:\n assumes \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ :\n [a, b, f]\\<^sub>\\ \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> [a', b', f']\\<^sub>\\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\nproof-\n note F_is_arrD = is_arrD[OF assms(1)]\n note F_cat_comma_ArrD = cat_comma_ArrD[OF F_is_arrD(1) assms(2,3)]\n show \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (intro cat_comma_HomD[OF F_cat_comma_ArrD(1) assms(2,3)])+ \nqed\n\nlemma cat_comma_is_arrE[elim]:\n assumes \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains a b f a' b' f' g h\n where \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\nproof-\n note F_is_arrD = is_arrD[OF assms(1)]\n from F_is_arrD(1) obtain C D \n where \"ABF \\\\<^sub>\\ cat_comma_Hom \\ \\ C D\"\n and \"C \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n and \"D \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by auto\n from this(1) obtain a b f a' b' f' g h\n where F_def: \"ABF = [C, D, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"C = [a, b, f]\\<^sub>\\\"\n and \"D = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_HomE[OF _ assms(2,3)])\n with that show ?thesis \n by (metis F_is_arrD(1,2,3) cat_comma_Cod_app cat_comma_Dom_app)\nqed\n\n\nsubsubsection\\Composition\\\n\nlemma cat_comma_composableI:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"ABCGF = [BCG, ABF]\\<^sub>\\\"\n and \"BCG : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"ABCGF \\\\<^sub>\\ cat_comma_composable \\ \\\"\nproof-\n from assms(1,2,5) obtain a b f a' b' f' gh \n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, gh]\\<^sub>\\\"\n and \"A = [a, b, f]\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n by auto\n with assms(1,2,4) obtain a'' b'' f'' g'h' \n where BCG_def: \"BCG = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, g'h']\\<^sub>\\\"\n and \"B = [a', b', f']\\<^sub>\\\"\n and \"C = [a'', b'', f'']\\<^sub>\\\"\n by auto\n from is_arrD(1)[OF assms(4)] have \"BCG \\\\<^sub>\\ cat_comma_Arr \\ \\\"\n unfolding cat_comma_components'(2)[OF assms(1,2)].\n moreover from is_arrD(1)[OF assms(5)] have \"ABF \\\\<^sub>\\ cat_comma_Arr \\ \\\"\n unfolding cat_comma_components'(2)[OF assms(1,2)].\n ultimately show ?thesis \n unfolding assms(3) ABF_def BCG_def cat_comma_composable_def \n by simp\nqed\n\nlemma cat_comma_composableE[elim]:\n assumes \"ABCGF \\\\<^sub>\\ cat_comma_composable \\ \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n obtains BCG ABF A B C\n where \"ABCGF = [BCG, ABF]\\<^sub>\\\"\n and \"BCG : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\nproof-\n from assms(1) obtain A B C G F \n where ABCGF_def: \"ABCGF = [[B, C, G]\\<^sub>\\, [A, B, F]\\<^sub>\\]\\<^sub>\\\"\n and BCG: \"[B, C, G]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n and ABF: \"[A, B, F]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_comma_composable_def\n by (auto simp: cat_comma_components'[OF assms(2,3)]) \n note BCG = cat_comma_ArrD[OF BCG assms(2,3)]\n and ABF = cat_comma_ArrD[OF ABF assms(2,3)]\n from ABF(1) assms(2,3) obtain a b f a' b' f' g h\n where \"[A, B, F]\\<^sub>\\ = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and F_def: \"F = [g, h]\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [cat_comma_cs_simps]: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with BCG(1) assms(2,3) obtain a'' b'' f'' g' h'\n where g'h'_def: \"[B, C, G]\\<^sub>\\ = [B, C, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', b'', f'']\\<^sub>\\\"\n and G_def: \"G = [g', h']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_comma_cs_simps]: \n \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto \n from F_def have \"F = [g, h]\\<^sub>\\\" by simp\n from assms(2,3) g h f f' g' h' f'' have \n \"[B, C, G]\\<^sub>\\ : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\n unfolding ABCGF_def F_def G_def A_def B_def C_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_is_arrI\n )+\n moreover from assms(2,3) g h f f' g' h' f'' have \n \"[A, B, F]\\<^sub>\\ : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n unfolding ABCGF_def F_def G_def A_def B_def C_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_is_arrI\n )+\n ultimately show ?thesis using that ABCGF_def by auto\nqed\n\nlemma cat_comma_Comp_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Comp\\)\"\n unfolding cat_comma_components by auto\n\nlemma cat_comma_Comp_vdomain[cat_comma_cs_simps]: \n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Comp\\) = cat_comma_composable \\ \\\"\n unfolding cat_comma_components by auto\n\nlemma cat_comma_Comp_app[cat_comma_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"G = [B, C, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and \"F = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" \n and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F = [A, C, [g' \\\\<^sub>A\\<^bsub>\\\\<^esub> g, h' \\\\<^sub>A\\<^bsub>\\\\<^esub> h]\\<^sub>\\]\\<^sub>\\\"\n using assms(1,2,5,6)\n unfolding cat_comma_components'[OF assms(1,2)] assms(3,4)\n by (*slow*)\n (\n cs_concl \n cs_simp: omega_of_set V_cs_simps vfsequence_simps\n cs_intro: nat_omega_intros V_cs_intros cat_comma_composableI TrueI\n )\n\nlemma cat_comma_Comp_is_arr[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"BCG : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" \n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"BCG \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n from assms(1,2,4) obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [symmetric, cat_cs_simps]: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with assms(1,2,3) obtain a'' b'' f'' g' h'\n where BCG_def: \"BCG = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', b'', f'']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_cs_simps]: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto (*slow*)\n from g' have \\g': \"\\\\ArrMap\\\\g'\\ : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a''\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n note [cat_cs_simps] = \n category.cat_assoc_helper[\n where \\=\\ and h=f'' and g=\\\\\\ArrMap\\\\g'\\\\ and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n category.cat_assoc_helper[\n where \\=\\ and h=f and g=\\\\\\ArrMap\\\\h\\\\ and q=\\f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\\\\n ]\n from assms(1,2,3,4) g h f f' g' h' f'' show ?thesis\n unfolding ABF_def BCG_def A_def B_def C_def\n by (intro cat_comma_is_arrI[OF assms(1,2)])\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cs_intro: cat_cs_intros\n )+\nqed\n\n\nsubsubsection\\Identity\\\n\nlemma cat_comma_CId_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\)\"\n unfolding cat_comma_components by simp\n\nlemma cat_comma_CId_vdomain[cat_comma_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n unfolding cat_comma_components'[OF assms(1,2)] by simp\n\nlemma cat_comma_CId_app[cat_comma_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"A = [a, b ,f]\\<^sub>\\\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\A\\ = [A, A, [\\\\CId\\\\a\\, \\\\CId\\\\b\\]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(4)[unfolded assms(3), unfolded cat_comma_components'[OF assms(1,2)]]\n have \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ cat_comma_Obj \\ \\\".\n then show ?thesis\n unfolding cat_comma_components'(6)[OF assms(1,2)] assms(3)\n by (simp add: nat_omega_simps)\nqed\n\n\nsubsubsection\\\\Hom\\-set\\\n\nlemma cat_comma_Hom:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"Hom (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) A B = cat_comma_Hom \\ \\ A B\"\nproof(intro vsubset_antisym vsubsetI, unfold in_Hom_iff)\n fix ABF assume \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n with assms(1,2) show \"ABF \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n by (elim cat_comma_is_arrE[OF _ assms(1,2)], intro cat_comma_HomI) force+\nnext\n fix ABF assume \"ABF \\\\<^sub>\\ cat_comma_Hom \\ \\ A B\"\n with assms(1,2) show \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n by (elim cat_comma_HomE[OF _ assms(1,2)], intro cat_comma_is_arrI) force+\nqed\n\n\nsubsubsection\\Comma category is a category\\\n\nlemma category_cat_comma[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"category \\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\"\nproof-\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n\n show ?thesis\n proof(rule categoryI')\n\n show \"vfsequence (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\" unfolding cat_comma_def by auto\n show \"vcard (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) = 6\\<^sub>\\\"\n unfolding cat_comma_def by (simp add: nat_omega_simps)\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Dom\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (rule cat_comma_Dom_vrange[OF assms])\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Cod\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (rule cat_comma_Cod_vrange[OF assms])\n show \"(GF \\\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Comp\\)) \\\n (\\g f b c a. GF = [g, f]\\<^sub>\\ \\ g : b \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> c \\ f : a \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> b)\"\n for GF\n proof(intro iffI; (elim exE conjE)?; (simp only: cat_comma_Comp_vdomain)?)\n assume prems: \"GF \\\\<^sub>\\ cat_comma_composable \\ \\\"\n with assms obtain G F abf a'b'f' a''b''f'' \n where \"GF = [G, F]\\<^sub>\\\"\n and \"G : a'b'f' \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> a''b''f''\"\n and \"F : abf \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> a'b'f'\"\n by auto\n with assms show \"\\g f b c a.\n GF = [g, f]\\<^sub>\\ \\ g : b \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> c \\ f : a \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> b\"\n by auto\n qed (use assms in \\cs_concl cs_shallow cs_intro: cat_comma_composableI\\)\n from assms show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n from assms show \"G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\n if \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n for B C G A F\n using that by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n from assms show \n \"H \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F =\n H \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> (G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F)\"\n if \"H : C \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> D\"\n and \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\n and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n for C D H B G A F\n using assms that\n proof-\n from that(3) assms obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [cat_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with that(2) assms obtain a'' b'' f'' g' h'\n where G_def: \"G = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', b'', f'']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_cs_simps]: \n \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto (*slow*)\n with that(1) assms obtain a''' b''' f''' g'' h''\n where H_def: \"H = [[a'', b'', f'']\\<^sub>\\, [a''', b''', f''']\\<^sub>\\, [g'', h'']\\<^sub>\\]\\<^sub>\\\"\n and D_def: \"D = [a''', b''', f''']\\<^sub>\\\"\n and g'': \"g'' : a'' \\\\<^bsub>\\\\<^esub> a'''\"\n and h'': \"h'' : b'' \\\\<^bsub>\\\\<^esub> b'''\"\n and f''': \"f''' : \\\\ObjMap\\\\a'''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'''\\\"\n and [cat_cs_simps]: \n \"f''' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g''\\ = \\\\ArrMap\\\\h''\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f''\"\n by auto (*slow*) \n note [cat_cs_simps] =\n category.cat_assoc_helper[\n where \\=\\\n and h=f''\n and g=\\\\\\ArrMap\\\\g'\\\\\n and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n category.cat_assoc_helper[\n where \\=\\\n and h=f''\n and g=\\\\\\ArrMap\\\\g'\\\\\n and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n category.cat_assoc_helper[\n where \\=\\ \n and h=f''' \n and g=\\\\\\ArrMap\\\\g''\\\\ \n and q=\\\\\\ArrMap\\\\h''\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f''\\\n ]\n from assms that g h f f' g' h' f'' g'' h'' f''' show ?thesis\n unfolding F_def G_def H_def A_def B_def C_def D_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\A\\ : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> A\"\n if \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" for A\n using that\n by (elim cat_comma_ObjE[OF _ assms(1)]; (simp only:)?) \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\B\\ \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F = F\"\n if \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for A B F\n using that \n by (elim cat_comma_is_arrE[OF _ assms]; (simp only:)?)\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n\n show \"F \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\B\\ = F\"\n if \"F : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" for B C F\n using that \n by (elim cat_comma_is_arrE[OF _ assms]; (simp only:)?)\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\ \\\\<^sub>\\ Vset \\\"\n proof(intro vsubsetI, elim cat_comma_ObjE[OF _ assms])\n fix F a b f assume prems: \n \"F = [a, b, f]\\<^sub>\\\" \n \"a \\\\<^sub>\\ \\\\Obj\\\" \n \"b \\\\<^sub>\\ \\\\Obj\\\"\n \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n from prems(2-4) show \"F \\\\<^sub>\\ Vset \\\"\n unfolding prems(1) by (cs_concl cs_intro: cat_cs_intros V_cs_intros) \n qed\n\n show \"(\\\\<^sub>\\a\\\\<^sub>\\A. \\\\<^sub>\\b\\\\<^sub>\\B. Hom (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) a b) \\\\<^sub>\\ Vset \\\"\n if \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"A \\\\<^sub>\\ Vset \\\"\n and \"B \\\\<^sub>\\ Vset \\\"\n for A B\n proof-\n\n define A0 where \"A0 = \\\\<^sub>\\ (\\F\\\\<^sub>\\A. F\\0\\)\"\n define A1 where \"A1 = \\\\<^sub>\\ (\\F\\\\<^sub>\\A. F\\1\\<^sub>\\\\)\"\n define B0 where \"B0 = \\\\<^sub>\\ (\\F\\\\<^sub>\\B. F\\0\\)\"\n define B1 where \"B1 = \\\\<^sub>\\ (\\F\\\\<^sub>\\B. F\\1\\<^sub>\\\\)\"\n\n define A0B0 where \"A0B0 = (\\\\<^sub>\\a\\\\<^sub>\\A0. \\\\<^sub>\\b\\\\<^sub>\\B0. Hom \\ a b)\"\n define A1B1 where \"A1B1 = (\\\\<^sub>\\a\\\\<^sub>\\A1. \\\\<^sub>\\b\\\\<^sub>\\B1. Hom \\ a b)\"\n\n have A0B0: \"A0B0 \\\\<^sub>\\ Vset \\\"\n unfolding A0B0_def\n proof(rule \\.HomDom.cat_Hom_vifunion_in_Vset; (intro vsubsetI)?)\n show \"A0 \\\\<^sub>\\ Vset \\\"\n unfolding A0_def\n proof(intro vrange_vprojection_in_VsetI that(3))\n fix F assume \"F \\\\<^sub>\\ A\"\n with that(1) have \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" by auto\n with assms obtain a b f where F_def: \"F = [a, b, f]\\<^sub>\\\" by auto\n show \"vsv F\" unfolding F_def by auto\n show \"0 \\\\<^sub>\\ \\\\<^sub>\\ F\" unfolding F_def by simp\n qed auto\n show \"B0 \\\\<^sub>\\ Vset \\\"\n unfolding B0_def\n proof(intro vrange_vprojection_in_VsetI that(4))\n fix F assume \"F \\\\<^sub>\\ B\"\n with that(2) have \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" by auto\n with assms obtain a b f where F_def: \"F = [a, b, f]\\<^sub>\\\" by auto\n show \"vsv F\" unfolding F_def by auto\n show \"0 \\\\<^sub>\\ \\\\<^sub>\\ F\" unfolding F_def by simp\n qed auto\n next\n fix a assume \"a \\\\<^sub>\\ A0\"\n with that(1) obtain F \n where a_def: \"a = F\\0\\\" and \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n unfolding A0_def by force\n with assms obtain b f where \"F = [a, b, f]\\<^sub>\\\" and \"a \\\\<^sub>\\ \\\\Obj\\\" by auto\n then show \"a \\\\<^sub>\\ \\\\Obj\\\" unfolding a_def by simp\n next\n fix a assume \"a \\\\<^sub>\\ B0\"\n with that(2) obtain F \n where a_def: \"a = F\\0\\\" and \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n unfolding B0_def by force\n with assms obtain b f where \"F = [a, b, f]\\<^sub>\\\" and \"a \\\\<^sub>\\ \\\\Obj\\\" by auto\n then show \"a \\\\<^sub>\\ \\\\Obj\\\" unfolding a_def by simp\n qed\n\n have A1B1: \"A1B1 \\\\<^sub>\\ Vset \\\"\n unfolding A1B1_def\n proof(rule \\.HomDom.cat_Hom_vifunion_in_Vset; (intro vsubsetI)?)\n show \"A1 \\\\<^sub>\\ Vset \\\"\n unfolding A1_def\n proof(intro vrange_vprojection_in_VsetI that(3))\n fix F assume \"F \\\\<^sub>\\ A\"\n with that(1) have \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" by auto\n with assms obtain a b f where F_def: \"F = [a, b, f]\\<^sub>\\\" by auto\n show \"vsv F\" unfolding F_def by auto\n show \"1\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ F\" unfolding F_def by (simp add: nat_omega_simps)\n qed auto\n show \"B1 \\\\<^sub>\\ Vset \\\"\n unfolding B1_def\n proof(intro vrange_vprojection_in_VsetI that(4))\n fix F assume \"F \\\\<^sub>\\ B\"\n with that(2) have \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" by auto\n with assms obtain a b f where F_def: \"F = [a, b, f]\\<^sub>\\\" by auto\n show \"vsv F\" unfolding F_def by auto\n show \"1\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ F\" unfolding F_def by (simp add: nat_omega_simps)\n qed auto\n next\n fix b assume \"b \\\\<^sub>\\ A1\"\n with that(1) obtain F \n where b_def: \"b = F\\1\\<^sub>\\\\\" and \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n unfolding A1_def by force\n with assms obtain a f where \"F = [a, b, f]\\<^sub>\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\" \n by (auto simp: nat_omega_simps)\n then show \"b \\\\<^sub>\\ \\\\Obj\\\" unfolding b_def by simp\n next\n fix b assume \"b \\\\<^sub>\\ B1\"\n with that(2) obtain F \n where b_def: \"b = F\\1\\<^sub>\\\\\" and \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n unfolding B1_def by force\n with assms obtain a f where \"F = [a, b, f]\\<^sub>\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\" \n by (auto simp: nat_omega_simps)\n then show \"b \\\\<^sub>\\ \\\\Obj\\\" unfolding b_def by simp\n qed\n \n define Q where \n \"Q i = (if i = 0 then A else if i = 1\\<^sub>\\ then B else (A0B0 \\\\<^sub>\\ A1B1))\" \n for i\n have \n \"(\\\\<^sub>\\a\\\\<^sub>\\A. \\\\<^sub>\\b\\\\<^sub>\\B.\n Hom (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) a b) \\\\<^sub>\\ (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n proof\n (\n intro vsubsetI,\n elim vifunionE,\n unfold in_Hom_iff,\n intro vproductI ballI\n )\n fix abf a'b'f' F assume prems: \n \"abf \\\\<^sub>\\ A\" \"a'b'f' \\\\<^sub>\\ B\" \"F : abf \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> a'b'f'\"\n from prems(3) assms obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and abf_def: \"abf = [a, b, f]\\<^sub>\\\"\n and a'b'f'_def: \"a'b'f' = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n have gh: \"[g, h]\\<^sub>\\ \\\\<^sub>\\ A0B0 \\\\<^sub>\\ A1B1\"\n unfolding A0B0_def A1B1_def \n proof\n (\n intro ftimesI2 vifunionI, \n unfold in_Hom_iff A0_def B0_def A1_def B1_def\n )\n from prems(1) show \"a \\\\<^sub>\\ \\\\<^sub>\\ (\\F\\\\<^sub>\\A. F\\0\\)\"\n by (intro vsv.vsv_vimageI2'[where a=abf]) (simp_all add: abf_def)\n from prems(2) show \"a' \\\\<^sub>\\ \\\\<^sub>\\ (\\F\\\\<^sub>\\B. F\\0\\)\"\n by (intro vsv.vsv_vimageI2'[where a=a'b'f']) \n (simp_all add: a'b'f'_def)\n from prems(1) show \"b \\\\<^sub>\\ \\\\<^sub>\\ (\\F\\\\<^sub>\\A. F\\1\\<^sub>\\\\)\"\n by (intro vsv.vsv_vimageI2'[where a=abf]) \n (simp_all add: nat_omega_simps abf_def)\n from prems(2) show \"b' \\\\<^sub>\\ \\\\<^sub>\\ (\\F\\\\<^sub>\\B. F\\1\\<^sub>\\\\)\"\n by (intro vsv.vsv_vimageI2'[where a=a'b'f']) \n (simp_all add: nat_omega_simps a'b'f'_def)\n qed (intro g h)+\n show \"vsv F\" unfolding F_def by auto\n show \"\\\\<^sub>\\ F = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: F_def three nat_omega_simps)\n fix i assume \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n then consider \\i = 0\\ | \\i = 1\\<^sub>\\\\ | \\i = 2\\<^sub>\\\\ by auto\n from this prems show \"F\\i\\ \\\\<^sub>\\ Q i\" \n by cases\n (simp_all add: F_def Q_def gh abf_def a'b'f'_def nat_omega_simps)\n qed\n moreover have \"(\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i) \\\\<^sub>\\ Vset \\\"\n proof(rule Limit_vproduct_in_VsetI)\n show \"set {0, 1\\<^sub>\\, 2\\<^sub>\\} \\\\<^sub>\\ Vset \\\" \n by (cs_concl cs_shallow cs_intro: V_cs_intros)\n from A0B0 A1B1 assms(1,2) that(3,4) show \n \"Q i \\\\<^sub>\\ Vset \\\" if \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\" \n for i \n by (simp_all add: Q_def Limit_ftimes_in_VsetI nat_omega_simps)\n qed auto\n ultimately show \"(\\\\<^sub>\\a\\\\<^sub>\\A. \\\\<^sub>\\b\\\\<^sub>\\B. Hom (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) a b) \\\\<^sub>\\ Vset \\\" by auto\n qed\n qed (auto simp: cat_comma_cs_simps intro: cat_comma_cs_intros)\n\nqed\n\n\nsubsubsection\\Tiny comma category\\\n\nlemma tiny_category_cat_comma[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n shows \"tiny_category \\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\"\nproof-\n\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(2))\n note \\ = \\.is_functor_axioms \n and \\ = \\.is_functor_axioms\n interpret category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n\n show ?thesis\n proof(intro tiny_categoryI' category_cat_comma)\n have vrange_\\: \"\\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n by (simp add: vrange_in_VsetI \\.tm_cf_ObjMap_in_Vset)\n moreover have vrange_\\: \"\\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n by (simp add: vrange_in_VsetI \\.tm_cf_ObjMap_in_Vset)\n ultimately have UU_Hom_in_Vset:\n \"(\\\\<^sub>\\a\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). \\\\<^sub>\\b\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). Hom \\ a b) \\\\<^sub>\\ Vset \\\"\n using \\.cf_ObjMap_vrange \\.cf_ObjMap_vrange \n by (auto intro: \\.HomCod.cat_Hom_vifunion_in_Vset) \n define Q where\n \"Q i =\n (\n if i = 0\n then \\\\Obj\\\n else\n if i = 1\\<^sub>\\\n then \\\\Obj\\\n else (\\\\<^sub>\\a\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). \\\\<^sub>\\b\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). Hom \\ a b)\n )\" \n for i\n have \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\ \\\\<^sub>\\ (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n proof(intro vsubsetI)\n fix A assume \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n then obtain a b f\n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by (elim cat_comma_ObjE[OF _ \\ \\])\n from f have f:\n \"f \\\\<^sub>\\ (\\\\<^sub>\\a\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). \\\\<^sub>\\b\\\\<^sub>\\\\\\<^sub>\\ (\\\\ObjMap\\). Hom \\ a b)\"\n by (intro vifunionI, unfold in_Hom_iff)\n (\n simp_all add: \n a b \n \\.ObjMap.vsv_vimageI2 \n \\.cf_ObjMap_vdomain \n \\.ObjMap.vsv_vimageI2 \n \\.cf_ObjMap_vdomain\n )\n show \"A \\\\<^sub>\\ (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n proof(intro vproductI, unfold Ball_def; (intro allI impI)?)\n show \"\\\\<^sub>\\ A = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n unfolding A_def by (simp add: three nat_omega_simps)\n fix i assume \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n then consider \\i = 0\\ | \\i = 1\\<^sub>\\\\ | \\i = 2\\<^sub>\\\\ by auto\n from this a b f show \"A\\i\\ \\\\<^sub>\\ Q i\"\n unfolding A_def Q_def by cases (simp_all add: nat_omega_simps)\n qed (auto simp: A_def)\n qed\n moreover have \"(\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i) \\\\<^sub>\\ Vset \\\"\n proof(rule Limit_vproduct_in_VsetI)\n show \"set {0, 1\\<^sub>\\, 2\\<^sub>\\} \\\\<^sub>\\ Vset \\\"\n unfolding three[symmetric] by simp\n from this show \"Q i \\\\<^sub>\\ Vset \\\" if \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\" for i\n using that assms(1,2) UU_Hom_in_Vset \n by \n (\n simp_all add:\n Q_def \n \\.HomDom.tiny_cat_Obj_in_Vset \n \\.HomDom.tiny_cat_Obj_in_Vset \n nat_omega_simps\n )\n qed auto\n ultimately show [simp]: \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\ \\\\<^sub>\\ Vset \\\" by auto \n define Q where\n \"Q i =\n (\n if i = 0\n then \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\n else\n if i = 1\\<^sub>\\\n then \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\n else \\\\Arr\\ \\\\<^sub>\\ \\\\Arr\\\n )\" \n for i\n have \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\ \\\\<^sub>\\ (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n proof(intro vsubsetI)\n fix F assume \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain abf a'b'f' where F: \"F : abf \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> a'b'f'\"\n by (auto intro: is_arrI)\n with assms obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and abf_def: \"abf = [a, b, f]\\<^sub>\\\"\n and a'b'f'_def: \"a'b'f' = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n from g h have \"[g, h]\\<^sub>\\ \\\\<^sub>\\ \\\\Arr\\ \\\\<^sub>\\ \\\\Arr\\\" by auto \n show \"F \\\\<^sub>\\ (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n proof(intro vproductI, unfold Ball_def; (intro allI impI)?)\n show \"\\\\<^sub>\\ F = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: F_def three nat_omega_simps)\n fix i assume \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n then consider \\i = 0\\ | \\i = 1\\<^sub>\\\\ | \\i = 2\\<^sub>\\\\ by auto\n from this F g h show \"F\\i\\ \\\\<^sub>\\ Q i\"\n unfolding Q_def F_def abf_def[symmetric] a'b'f'_def[symmetric]\n by cases (auto simp: nat_omega_simps)\n qed (auto simp: F_def)\n qed\n moreover have \"(\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i) \\\\<^sub>\\ Vset \\\"\n proof(rule Limit_vproduct_in_VsetI)\n show \"set {0, 1\\<^sub>\\, 2\\<^sub>\\} \\\\<^sub>\\ Vset \\\"\n by (simp add: three[symmetric] nat_omega_simps)\n moreover have \"\\\\Arr\\ \\\\<^sub>\\ \\\\Arr\\ \\\\<^sub>\\ Vset \\\"\n by \n (\n auto intro!: \n Limit_ftimes_in_VsetI \n \\.\\_\\ \\_def \n \\.HomDom.tiny_cat_Arr_in_Vset \n \\.HomDom.tiny_cat_Arr_in_Vset\n )\n ultimately show \"Q i \\\\<^sub>\\ Vset \\\" if \"i \\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}\" for i\n using that assms(1,2) UU_Hom_in_Vset \n by \n (\n simp_all add:\n Q_def\n \\.HomDom.tiny_cat_Obj_in_Vset \n \\.HomDom.tiny_cat_Obj_in_Vset \n nat_omega_simps\n )\n qed auto\n ultimately show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\ \\\\<^sub>\\ Vset \\\" by auto\n qed (rule \\, rule \\)\n\nqed\n\n\n\nsubsection\\Opposite comma category functor\\\n\n\nsubsubsection\\Background\\\n\n\ntext\\\nSee \\<^cite>\\\"noauthor_wikipedia_2001\"\\\\footnote{\n\\url{https://en.wikipedia.org/wiki/Opposite_category}\n} for background information.\n\\\n\n\nsubsubsection\\Object flip\\\n\ndefinition op_cf_commma_obj_flip :: \"V \\ V \\ V\"\n where \"op_cf_commma_obj_flip \\ \\ =\n (\\A\\\\<^sub>\\(\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\. [A\\1\\<^sub>\\\\, A\\0\\, A\\2\\<^sub>\\\\]\\<^sub>\\)\"\n\n\ntext\\Elementary properties.\\\n\nmk_VLambda op_cf_commma_obj_flip_def\n |vsv op_cf_commma_obj_flip_vsv[cat_comma_cs_intros]|\n |vdomain op_cf_commma_obj_flip_vdomain[cat_comma_cs_simps]|\n |app op_cf_commma_obj_flip_app'|\n\nlemma op_cf_commma_obj_flip_app[cat_comma_cs_simps]:\n assumes \"A = [a, b, f]\\<^sub>\\\" and \"A \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\"\n shows \"op_cf_commma_obj_flip \\ \\\\A\\ = [b, a, f]\\<^sub>\\\"\n using assms unfolding op_cf_commma_obj_flip_def by (simp add: nat_omega_simps)\n\nlemma op_cf_commma_obj_flip_v11[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"v11 (op_cf_commma_obj_flip \\ \\)\"\nproof(rule vsv.vsv_valeq_v11I, unfold op_cf_commma_obj_flip_vdomain)\n fix A B assume prems:\n \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n \"op_cf_commma_obj_flip \\ \\\\A\\ = op_cf_commma_obj_flip \\ \\\\B\\\"\n from prems(1,2) assms obtain a b f a' b' f' \n where A_def: \"A = [a, b, f]\\<^sub>\\\" \n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n by (elim cat_comma_ObjE[OF _ assms])\n from prems(3,1,2) show \"A = B\"\n by (simp_all add: A_def B_def op_cf_commma_obj_flip_app nat_omega_simps)\nqed (auto intro: op_cf_commma_obj_flip_vsv)\n\nlemma op_cf_commma_obj_flip_vrange[cat_comma_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (op_cf_commma_obj_flip \\ \\) = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Obj\\\"\nproof(intro vsubset_antisym)\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n show \"\\\\<^sub>\\ (op_cf_commma_obj_flip \\ \\) \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Obj\\\"\n proof\n (\n intro vsv.vsv_vrange_vsubset op_cf_commma_obj_flip_vsv, \n unfold cat_comma_cs_simps\n )\n fix A assume \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n then obtain a b f\n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by (elim cat_comma_ObjE[OF _ assms])\n from a b f show \n \"op_cf_commma_obj_flip \\ \\\\A\\ \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Obj\\\"\n unfolding A_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps cat_op_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n show \"(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Obj\\ \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_commma_obj_flip \\ \\)\"\n proof(intro vsubsetI)\n fix B assume \"B \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Obj\\\"\n then obtain a b f\n where B_def: \"B = [b, a, f]\\<^sub>\\\"\n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by \n (\n elim cat_comma_ObjE[\n OF _ \\.is_functor_op \\.is_functor_op, unfolded cat_op_simps\n ]\n )\n from a b f have B_def: \"B = op_cf_commma_obj_flip \\ \\\\a, b, f\\\\<^sub>\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps B_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from a b f have \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_commma_obj_flip \\ \\)\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n with op_cf_commma_obj_flip_vsv show \"B \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_commma_obj_flip \\ \\)\"\n unfolding B_def by auto\n qed\nqed\n\n\nsubsubsection\\Definition and elementary properties\\\n\ndefinition op_cf_comma :: \"V \\ V \\ V\"\n where \"op_cf_comma \\ \\ =\n [\n op_cf_commma_obj_flip \\ \\,\n (\n \\ABF\\\\<^sub>\\(\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Arr\\.\n [\n op_cf_commma_obj_flip \\ \\\\ABF\\1\\<^sub>\\\\\\,\n op_cf_commma_obj_flip \\ \\\\ABF\\0\\\\,\n [ABF\\2\\<^sub>\\\\\\1\\<^sub>\\\\, ABF\\2\\<^sub>\\\\\\0\\<^sub>\\\\]\\<^sub>\\\n ]\\<^sub>\\\n ),\n op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\),\n (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma op_cf_comma_components:\n shows [cat_comma_cs_simps]: \n \"op_cf_comma \\ \\\\ObjMap\\ = op_cf_commma_obj_flip \\ \\\"\n and \"op_cf_comma \\ \\\\ArrMap\\ =\n (\n \\ABF\\\\<^sub>\\(\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Arr\\.\n [\n op_cf_commma_obj_flip \\ \\\\ABF\\1\\<^sub>\\\\\\,\n op_cf_commma_obj_flip \\ \\\\ABF\\0\\\\,\n [ABF\\2\\<^sub>\\\\\\1\\<^sub>\\\\, ABF\\2\\<^sub>\\\\\\0\\<^sub>\\\\]\\<^sub>\\\n ]\\<^sub>\\\n )\"\n and [cat_comma_cs_simps]: \n \"op_cf_comma \\ \\\\HomDom\\ = op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\"\n and [cat_comma_cs_simps]: \n \"op_cf_comma \\ \\\\HomCod\\ = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\"\n unfolding op_cf_comma_def dghm_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\Arrow map\\\n\nmk_VLambda op_cf_comma_components(2)\n |vsv op_cf_comma_ArrMap_vsv[cat_comma_cs_intros]|\n |vdomain op_cf_comma_ArrMap_vdomain[cat_comma_cs_simps]|\n |app op_cf_comma_ArrMap_app'|\n\nlemma op_cf_comma_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ =\n [\n op_cf_commma_obj_flip \\ \\\\a', b', f'\\\\<^sub>\\,\n op_cf_commma_obj_flip \\ \\\\a, b, f\\\\<^sub>\\,\n [h, g]\\<^sub>\\\n ]\\<^sub>\\\"\n using assms(2) by (simp add: assms(1) op_cf_comma_ArrMap_app' nat_omega_simps)\n\nlemma op_cf_comma_ArrMap_v11[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"v11 (op_cf_comma \\ \\\\ArrMap\\)\"\nproof\n (\n rule vsv.vsv_valeq_v11I, \n unfold op_cf_comma_ArrMap_vdomain,\n intro op_cf_comma_ArrMap_vsv\n )\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n fix ABF ABF' assume prems:\n \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n \"ABF' \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ = op_cf_comma \\ \\\\ArrMap\\\\ABF'\\\"\n from prems(1) obtain A B where ABF: \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n from prems(2) obtain A' B' where ABF': \"ABF' : A' \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B'\" by auto\n from ABF obtain a b f a' b' f' g h \n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_is_arrE[OF _ assms])\n from ABF' obtain a'' b'' f'' a''' b''' f''' g' h' \n where ABF'_def: \"ABF' = [[a'', b'', f'']\\<^sub>\\, [a''', b''', f''']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and A'_def: \"A' = [a'', b'', f'']\\<^sub>\\\"\n and B'_def: \"B' = [a''', b''', f''']\\<^sub>\\\"\n and \"g' : a'' \\\\<^bsub>\\\\<^esub> a'''\"\n and \"h' : b'' \\\\<^bsub>\\\\<^esub> b'''\"\n and \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and \"f''' : \\\\ObjMap\\\\a'''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'''\\\"\n and \"f''' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f''\"\n by (elim cat_comma_is_arrE[OF _ assms])\n from ABF ABF' have abf:\n \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\"\n \"[a', b', f']\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\"\n \"[a'', b'', f'']\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\"\n \"[a''', b''', f''']\\<^sub>\\ \\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\"\n unfolding ABF_def ABF'_def A_def B_def A'_def B'_def by auto\n note v11_injective = v11.v11_injective[\n OF op_cf_commma_obj_flip_v11, OF assms, unfolded cat_comma_cs_simps\n ]\n from \n prems(3,1,2) assms \n op_cf_commma_obj_flip_v11 \n v11_injective[OF abf(1,3)] \n v11_injective[OF abf(2,4)] \n show \"ABF = ABF'\"\n by \n (\n simp_all add: \n ABF_def ABF'_def op_cf_comma_ArrMap_app' nat_omega_simps \n )\nqed\n\nlemma op_cf_comma_ArrMap_is_arr:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ :\n op_cf_commma_obj_flip \\ \\\\B\\ \\\\<^bsub>(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\<^esub> \n op_cf_commma_obj_flip \\ \\\\A\\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms(3) obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and f'g_hf: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_is_arrE[OF _ assms(1,2)])\n from g h f f' f'g_hf show ?thesis\n unfolding ABF_def A_def B_def\n by \n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\nqed\n\nlemma op_cf_comma_ArrMap_is_arr':\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n and \"A' = op_cf_commma_obj_flip \\ \\\\B\\\"\n and \"B' = op_cf_commma_obj_flip \\ \\\\A\\\"\n shows \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ : A' \\\\<^bsub>(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\<^esub> B'\"\n using assms(1-3) unfolding assms(4,5) by (intro op_cf_comma_ArrMap_is_arr)\n\nlemma op_cf_comma_ArrMap_vrange[cat_comma_cs_simps]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (op_cf_comma \\ \\\\ArrMap\\) = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Arr\\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n interpret op_\\\\: category \\ \\(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros cat_op_intros)\n show ?thesis\n proof(intro vsubset_antisym)\n show \"\\\\<^sub>\\ (op_cf_comma \\ \\\\ArrMap\\) \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Arr\\\"\n proof\n (\n intro vsv.vsv_vrange_vsubset op_cf_comma_ArrMap_vsv, \n unfold cat_comma_cs_simps\n )\n fix ABF assume prems: \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where ABF: \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n from op_cf_comma_ArrMap_is_arr[OF assms this] show \n \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Arr\\\"\n by auto\n qed\n show \"(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Arr\\ \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_comma \\ \\\\ArrMap\\)\"\n proof(intro vsubsetI)\n fix ABF assume prems: \"ABF \\\\<^sub>\\ (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\Arr\\\"\n then obtain A B where ABF: \"ABF : A \\\\<^bsub>(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\<^esub> B\" \n by auto\n then obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a' \\\\<^bsub>\\\\<^esub> a\"\n and h: \"h : b' \\\\<^bsub>\\\\<^esub> b\"\n and f: \"f : \\\\ObjMap\\\\b\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and f': \"f' : \\\\ObjMap\\\\b'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\" \n and f'g_hf: \"f' \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>op_cat \\\\<^esub> f\"\n by \n (\n elim cat_comma_is_arrE[\n OF _ \\.is_functor_op \\.is_functor_op, unfolded cat_op_simps\n ]\n )\n from f'g_hf g h f f' have gf'_fh:\n \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f' = f \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\h\\\"\n by \n (\n cs_prems cs_shallow \n cs_simp: cat_op_simps cs_intro: cat_cs_intros cat_op_intros\n )\n with g h f f' have \n \"[[b', a', f']\\<^sub>\\, [b, a, f]\\<^sub>\\, [h, g]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_comma \\ \\\\ArrMap\\)\"\n \"ABF = op_cf_comma \\ \\\\ArrMap\\\\[b', a', f']\\<^sub>\\, [b, a, f]\\<^sub>\\, [h, g]\\<^sub>\\\\\\<^sub>\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps ABF_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n with op_cf_comma_ArrMap_vsv show \"ABF \\\\<^sub>\\ \\\\<^sub>\\ (op_cf_comma \\ \\\\ArrMap\\)\"\n by auto\n qed\n qed\nqed\n\n\nsubsubsection\\Opposite comma category functor is an isomorphism of categories\\\n\nlemma op_cf_comma_is_iso_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_cf_comma \\ \\ : \n op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n show ?thesis\n proof(intro is_iso_functorI' is_functorI')\n show \"vfsequence (op_cf_comma \\ \\)\"\n unfolding op_cf_comma_def by simp\n show \"vcard (op_cf_comma \\ \\) = 4\\<^sub>\\\"\n unfolding op_cf_comma_def by (simp add: nat_omega_simps)\n from assms show \"op_cf_comma \\ \\\\ArrMap\\\\ABF\\ :\n op_cf_comma \\ \\\\ObjMap\\\\A\\ \\\\<^bsub>(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\<^esub>\n op_cf_comma \\ \\\\ObjMap\\\\B\\\"\n if \"ABF : A \\\\<^bsub>op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\<^esub> B\" for A B ABF\n using that\n unfolding cat_op_simps\n by \n (\n cs_concl cs_shallow\n cs_intro: op_cf_comma_ArrMap_is_arr' cs_simp: cat_comma_cs_simps\n )\n show\n \"op_cf_comma \\ \\\\ArrMap\\\\G \\\\<^sub>A\\<^bsub>op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\<^esub> F\\ =\n op_cf_comma \\ \\\\ArrMap\\\\G\\ \\\\<^sub>A\\<^bsub>(op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\<^esub>\n op_cf_comma \\ \\\\ArrMap\\\\F\\\"\n if \"G : B \\\\<^bsub>op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\<^esub> C\" \n and \"F : A \\\\<^bsub>op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\<^esub> B\"\n for B C G A F\n proof-\n note G = that(1)[unfolded cat_op_simps]\n note F = that(2)[unfolded cat_op_simps]\n from assms G obtain a b f a' b' f' g h\n where G_def: \"G = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [symmetric, cat_comma_cs_simps]: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with assms F obtain a'' b'' f'' g' h'\n where F_def: \"F = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a'', b'', f'']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_comma_cs_simps]: \n \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto (*slow*)\n note [cat_comma_cs_simps] = \n category.cat_assoc_helper[\n where \\=\\ and h=f'' and g=\\\\\\ArrMap\\\\g'\\\\ and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n from assms that g h f f' g' h' f' f'' show ?thesis\n unfolding cat_op_simps G_def C_def B_def F_def A_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n show \n \"op_cf_comma \\ \\\\ArrMap\\\\op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\CId\\\\C\\\\ =\n (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\\CId\\\\op_cf_comma \\ \\\\ObjMap\\\\C\\\\\"\n if \"C \\\\<^sub>\\ op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\\Obj\\\" for C\n proof-\n from that[unfolded cat_op_simps] assms obtain a b f \n where C_def: \"C = [a, b, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by auto\n from a b f that show ?thesis\n unfolding cat_op_simps C_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n qed\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: V_cs_intros cat_cs_intros cat_comma_cs_intros cat_op_intros\n )+\nqed\n\nlemma op_cf_comma_is_iso_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\"\n and \"\\' = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\"\n shows \"op_cf_comma \\ \\ : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> \\'\"\n using assms(1,2) unfolding assms(3,4) by (rule op_cf_comma_is_iso_functor)\n\nlemma op_cf_comma_is_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_cf_comma \\ \\ :\n op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\"\n by (rule is_iso_functorD(1)[OF op_cf_comma_is_iso_functor[OF assms]])\n\nlemma op_cf_comma_is_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\)\"\n and \"\\' = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (op_cf \\)\"\n shows \"op_cf_comma \\ \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n using assms(1,2) unfolding assms(3,4) by (rule op_cf_comma_is_functor)\n\n\n\nsubsection\\Projections for a comma category\\\n\n\nsubsubsection\\Definitions and elementary properties\\\n\n\ntext\\See Chapter II-6 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cf_comma_proj_left :: \"V \\ V \\ V\" (\\(_ \\<^sub>C\\<^sub>F\\ _)\\ [1000, 1000] 999)\n where \"\\ \\<^sub>C\\<^sub>F\\ \\ =\n [\n (\\a\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\. a\\0\\),\n (\\f\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\. f\\2\\<^sub>\\\\\\0\\),\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\,\n \\\\HomDom\\\n ]\\<^sub>\\\"\n\ndefinition cf_comma_proj_right :: \"V \\ V \\ V\" (\\(_ \\\\<^sub>C\\<^sub>F _)\\ [1000, 1000] 999)\n where \"\\ \\\\<^sub>C\\<^sub>F \\ =\n [\n (\\a\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\. a\\1\\<^sub>\\\\),\n (\\f\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\. f\\2\\<^sub>\\\\\\1\\<^sub>\\\\),\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\,\n \\\\HomDom\\\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma cf_comma_proj_left_components:\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ = (\\a\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\. a\\0\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ = (\\f\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\. f\\2\\<^sub>\\\\\\0\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\ \\\\HomDom\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n and \"\\ \\<^sub>C\\<^sub>F\\ \\\\HomCod\\ = \\\\HomDom\\\"\n unfolding cf_comma_proj_left_def dghm_field_simps\n by (simp_all add: nat_omega_simps)\n\nlemma cf_comma_proj_right_components:\n shows \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ = (\\a\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\. a\\1\\<^sub>\\\\)\"\n and \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ = (\\f\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\. f\\2\\<^sub>\\\\\\1\\<^sub>\\\\)\"\n and \"\\ \\\\<^sub>C\\<^sub>F \\\\HomDom\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n and \"\\ \\\\<^sub>C\\<^sub>F \\\\HomCod\\ = \\\\HomDom\\\"\n unfolding cf_comma_proj_right_def dghm_field_simps\n by (simp_all add: nat_omega_simps)\n\ncontext\n fixes \\ \\ \\ \\ \\ \\\n assumes \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \\: \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nbegin\n\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\ninterpretation \\: is_functor \\ \\ \\ \\ by (rule \\)\n\nlemmas cf_comma_proj_left_components' = \n cf_comma_proj_left_components[of \\ \\, unfolded \\.cf_HomDom]\n\nlemmas cf_comma_proj_right_components' = \n cf_comma_proj_right_components[of \\ \\, unfolded \\.cf_HomDom]\n\nlemmas [cat_comma_cs_simps] = \n cf_comma_proj_left_components'(3,4)\n cf_comma_proj_right_components'(3,4)\n\nend\n\n\nsubsubsection\\Object map\\\n\nmk_VLambda cf_comma_proj_left_components(1)\n |vsv cf_comma_proj_left_ObjMap_vsv[cat_comma_cs_intros]|\n |vdomain cf_comma_proj_left_ObjMap_vdomain[cat_comma_cs_simps]|\n\nmk_VLambda cf_comma_proj_right_components(1)\n |vsv cf_comma_proj_right_ObjMap_vsv[cat_comma_cs_intros]|\n |vdomain cf_comma_proj_right_ObjMap_vdomain[cat_comma_cs_simps]|\n\nlemma cf_comma_proj_left_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a, b, f]\\<^sub>\\\" and \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\A\\ = a\"\n using assms(2) unfolding assms(1) cf_comma_proj_left_components by simp\n\nlemma cf_comma_proj_right_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a, b, f]\\<^sub>\\\" and \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ = b\"\n using assms(2)\n unfolding assms(1) cf_comma_proj_right_components \n by (simp add: nat_omega_simps)\n\nlemma cf_comma_proj_left_ObjMap_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\) \\\\<^sub>\\ \\\\Obj\\\"\nproof(rule vsv.vsv_vrange_vsubset, unfold cat_comma_cs_simps)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain a b f where A_def: \"A = [a, b, f]\\<^sub>\\\" and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n by auto\n from assms prems a show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\A\\ \\\\<^sub>\\ \\\\Obj\\\"\n unfolding A_def by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\nqed (auto intro: cat_comma_cs_intros) \n\nlemma cf_comma_proj_right_ObjMap_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\) \\\\<^sub>\\ \\\\Obj\\\"\nproof(rule vsv.vsv_vrange_vsubset, unfold cat_comma_cs_simps)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain a b f where A_def: \"A = [a, b, f]\\<^sub>\\\" and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n by auto\n from assms prems b show \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ \\\\<^sub>\\ \\\\Obj\\\"\n unfolding A_def by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\nqed (auto intro: cat_comma_cs_intros) \n\n\nsubsubsection\\Arrow map\\\n\nmk_VLambda cf_comma_proj_left_components(2)\n |vsv cf_comma_proj_left_ArrMap_vsv[cat_comma_cs_intros]|\n |vdomain cf_comma_proj_left_ArrMap_vdomain[cat_comma_cs_simps]|\n\nmk_VLambda cf_comma_proj_right_components(2)\n |vsv cf_comma_proj_right_ArrMap_vsv[cat_comma_cs_intros]|\n |vdomain cf_comma_proj_right_ArrMap_vdomain[cat_comma_cs_simps]|\n\nlemma cf_comma_proj_left_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\" and \"[A, B, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\ABF\\ = g\"\n using assms(2)\n unfolding assms(1) cf_comma_proj_left_components \n by (simp add: nat_omega_simps)\n\nlemma cf_comma_proj_right_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\" \n and \"[A, B, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\ABF\\ = h\"\n using assms(2)\n unfolding assms(1) cf_comma_proj_right_components \n by (simp add: nat_omega_simps)\n\nlemma cf_comma_proj_left_ArrMap_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\) \\\\<^sub>\\ \\\\Arr\\\"\nproof(rule vsv.vsv_vrange_vsubset, unfold cat_comma_cs_simps)\n from assms interpret category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n fix F assume prems: \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n by auto\n from assms prems g show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\F\\ \\\\<^sub>\\ \\\\Arr\\\"\n unfolding F_def \n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\nqed (auto intro: cat_comma_cs_intros) \n\nlemma cf_comma_proj_right_ArrMap_vrange:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\) \\\\<^sub>\\ \\\\Arr\\\"\nproof(rule vsv.vsv_vrange_vsubset, unfold cat_comma_cs_simps)\n from assms interpret category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n fix F assume prems: \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n by auto\n from assms prems h show \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\ \\\\<^sub>\\ \\\\Arr\\\"\n unfolding F_def \n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\nqed (auto intro: cat_comma_cs_intros) \n\n\nsubsubsection\\Projections for a comma category are functors\\\n\nlemma cf_comma_proj_left_is_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n from assms interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n show ?thesis\n proof(rule is_functorI')\n show \"vfsequence (\\ \\<^sub>C\\<^sub>F\\ \\)\"\n unfolding cf_comma_proj_left_def by auto\n show \"vcard (\\ \\<^sub>C\\<^sub>F\\ \\) = 4\\<^sub>\\\"\n unfolding cf_comma_proj_left_def by (simp add: nat_omega_simps)\n from assms show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\) \\\\<^sub>\\ \\\\Obj\\\"\n by (rule cf_comma_proj_left_ObjMap_vrange)\n show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\F\\ : \\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\A\\ \\\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\B\\\"\n if \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for A B F\n proof-\n from assms that obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n by auto\n from that g show \n \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\F\\ : \\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\A\\ \\\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\B\\\"\n unfolding F_def A_def B_def\n by (cs_concl cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n qed\n show \n \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F\\ =\n \\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\G\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\F\\\"\n if \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for B C G A F\n proof-\n from assms that(2) obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [cat_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with that(1) assms obtain a'' b'' f'' g' h'\n where G_def: \"G = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', b'', f'']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_cs_simps]: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto (*slow*)\n note [cat_cs_simps] = \n category.cat_assoc_helper\n [\n where \\=\\ \n and h=f'' \n and g=\\\\\\ArrMap\\\\g'\\\\ \n and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n category.cat_assoc_helper\n [\n where \\=\\ \n and h=f \n and g=\\\\\\ArrMap\\\\h\\\\ \n and q=\\f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\\\\n ]\n from assms that g g' h h' f f' f'' show ?thesis\n unfolding F_def G_def A_def B_def C_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_comma_cs_intros cat_cs_intros\n )\n qed\n show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\A\\\\ = \\\\CId\\\\\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\A\\\\\"\n if \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" for A\n proof-\n from assms that obtain a b f \n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by auto\n from assms that this(2-4) show ?thesis\n unfolding A_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_comma_cs_intros cat_cs_intros\n )\n qed\n qed \n (\n use assms in \n \\\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n \\\n )+\nqed\n\nlemma cf_comma_proj_left_is_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3) by (rule cf_comma_proj_left_is_functor)\n\nlemma cf_comma_proj_right_is_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n from assms interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n show ?thesis\n proof(rule is_functorI')\n show \"vfsequence (\\ \\\\<^sub>C\\<^sub>F \\)\"\n unfolding cf_comma_proj_right_def by auto\n show \"vcard (\\ \\\\<^sub>C\\<^sub>F \\) = 4\\<^sub>\\\"\n unfolding cf_comma_proj_right_def by (simp add: nat_omega_simps)\n from assms show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\) \\\\<^sub>\\ \\\\Obj\\\"\n by (rule cf_comma_proj_right_ObjMap_vrange)\n show \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\ : \\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ \\\\<^bsub>\\\\<^esub> \\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\B\\\"\n if \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for A B F\n proof-\n from assms that obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n by auto\n from that h show \n \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\ : \\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ \\\\<^bsub>\\\\<^esub> \\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\B\\\"\n unfolding F_def A_def B_def\n by (cs_concl cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n qed\n show \n \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> F\\ =\n \\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\G\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> \\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\\"\n if \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> C\" and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for B C G A F\n proof-\n from assms that(2) obtain a b f a' b' f' g h\n where F_def: \"F = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [cat_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n with that(1) assms obtain a'' b'' f'' g' h'\n where G_def: \"G = [[a', b', f']\\<^sub>\\, [a'', b'', f'']\\<^sub>\\, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', b'', f'']\\<^sub>\\\"\n and g': \"g' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and h': \"h' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and [cat_cs_simps]: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g'\\ = \\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\"\n by auto (*slow*)\n note [cat_cs_simps] = \n category.cat_assoc_helper\n [\n where \\=\\ \n and h=f'' \n and g=\\\\\\ArrMap\\\\g'\\\\ \n and q=\\\\\\ArrMap\\\\h'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f'\\\n ]\n category.cat_assoc_helper\n [\n where \\=\\ \n and h=f \n and g=\\\\\\ArrMap\\\\h\\\\ \n and q=\\f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\\\\n ]\n from assms that g g' h h' f f' f'' show ?thesis\n unfolding F_def G_def A_def B_def C_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_comma_cs_intros cat_cs_intros\n )\n qed\n show \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\CId\\\\A\\\\ = \\\\CId\\\\\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\\\\"\n if \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" for A\n proof-\n from assms that obtain a b f \n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by auto\n from assms that this(2-4) show ?thesis\n unfolding A_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_comma_cs_intros cat_cs_intros\n )\n qed\n qed \n (\n use assms in\n \\\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n \\\n )+\nqed\n\nlemma cf_comma_proj_right_is_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\' = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3) by (rule cf_comma_proj_right_is_functor)\n\n\nsubsubsection\\Opposite projections for a comma category\\\n\nlemma op_cf_comma_proj_left: \n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\) = (op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n show \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\) = (op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\\"\n proof(rule cf_eqI)\n show \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\) : op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by \n (\n cs_concl cs_shallow \n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n then have ObjMap_dom_lhs: \"\\\\<^sub>\\ (op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and ArrMap_dom_lhs: \"\\\\<^sub>\\ (op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cat_op_simps)+\n show \"(op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\ :\n op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros)\n then have ObjMap_dom_rhs:\n \"\\\\<^sub>\\ (((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\) =\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and ArrMap_dom_rhs: \n \"\\\\<^sub>\\ (((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\) =\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_simp: cat_cs_simps cat_op_simps)+\n show\n \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ObjMap\\ =\n ((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n fix A assume \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain a b f \n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by auto\n from a b f show \n \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ObjMap\\\\A\\ =\n ((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\\\A\\\"\n unfolding A_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n (\n cs_concl cs_shallow\n cs_simp: cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )+\n show \n \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ArrMap\\ =\n ((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix ABF assume \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [symmetric, cat_cs_simps]: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n from g h f f' show \"op_cf (\\ \\<^sub>C\\<^sub>F\\ \\)\\ArrMap\\\\ABF\\ =\n ((op_cf \\) \\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\\\ABF\\\"\n unfolding ABF_def A_def B_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed \n (\n cs_concl cs_shallow\n cs_simp: cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )+\n qed simp_all\nqed\n\nlemma op_cf_comma_proj_right:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n shows \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\) = (op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\\\: category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n show \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\) = (op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\\"\n proof(rule cf_eqI)\n show \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\) : op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by \n (\n cs_concl cs_shallow \n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n then have ObjMap_dom_lhs: \"\\\\<^sub>\\ (op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and ArrMap_dom_lhs: \"\\\\<^sub>\\ (op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cat_op_simps)+\n show \"(op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\ :\n op_cat (\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> op_cat \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros)\n then have ObjMap_dom_rhs:\n \"\\\\<^sub>\\ (((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\) =\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and ArrMap_dom_rhs:\n \"\\\\<^sub>\\ (((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\) =\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_simp: cat_cs_simps cat_op_simps)+\n show\n \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\ =\n ((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain a b f \n where A_def: \"A = [a, b, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and b: \"b \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n by auto\n from a b f show\n \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\A\\ =\n ((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ObjMap\\\\A\\\"\n unfolding A_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n (\n cs_concl cs_shallow\n cs_simp: cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )+\n show \n \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\ =\n ((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix ABF assume prems: \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where ABF: \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b, f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and [symmetric, cat_cs_simps]: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = \\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by auto\n from g h f f' show \"op_cf (\\ \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\ABF\\ =\n ((op_cf \\) \\<^sub>C\\<^sub>F\\ (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_comma \\ \\)\\ArrMap\\\\ABF\\\"\n unfolding ABF_def A_def B_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed \n (\n cs_concl cs_shallow\n cs_simp: cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )+\n qed simp_all\nqed\n\n\nsubsubsection\\Projections for a tiny comma category\\\n\nlemma cf_comma_proj_left_is_tm_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_functorI')\n\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(2))\n\n show \\_\\\\: \"\\ \\<^sub>C\\<^sub>F\\ \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n\n interpret \\_\\\\: is_functor \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ \\\\ \\<^sub>C\\<^sub>F\\ \\\\\n by (rule \\_\\\\)\n interpret \\\\: tiny_category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \n by (cs_concl cs_shallow cs_intro: cat_small_cs_intros cat_comma_cs_intros)\n\n show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ \\\\<^sub>\\ Vset \\\"\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n proof-\n note \\_\\\\.cf_ObjMap_vrange\n moreover have \"\\\\Obj\\ \\\\<^sub>\\ Vset \\\" by (intro cat_small_cs_intros)\n ultimately show ?thesis by auto\n qed\n qed (auto simp: cf_comma_proj_left_components intro: cat_small_cs_intros)\n\n show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ \\\\<^sub>\\ Vset \\\"\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n proof-\n note \\_\\\\.cf_ArrMap_vrange\n moreover have \"\\\\Arr\\ \\\\<^sub>\\ Vset \\\" by (intro cat_small_cs_intros)\n ultimately show ?thesis by auto\n qed\n qed (auto simp: cf_comma_proj_left_components intro: cat_small_cs_intros)\n\nqed\n\nlemma cf_comma_proj_left_is_tm_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n and \"\\\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\ : \\\\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3) by (rule cf_comma_proj_left_is_tm_functor)\n\nlemma cf_comma_proj_right_is_tm_functor:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_functorI')\n\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_tm_functor \\ \\ \\ \\ by (rule assms(2))\n\n show \\_\\\\: \"\\ \\\\<^sub>C\\<^sub>F \\ : \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n\n interpret \\_\\\\: is_functor \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ \\\\ \\\\<^sub>C\\<^sub>F \\\\\n by (rule \\_\\\\)\n interpret \\\\: tiny_category \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \n by (cs_concl cs_shallow cs_intro: cat_small_cs_intros cat_comma_cs_intros)\n\n show \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ \\\\<^sub>\\ Vset \\\"\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n proof-\n note \\_\\\\.cf_ObjMap_vrange\n moreover have \"\\\\Obj\\ \\\\<^sub>\\ Vset \\\" by (intro cat_small_cs_intros)\n ultimately show ?thesis by auto\n qed\n qed (auto simp: cf_comma_proj_right_components intro: cat_small_cs_intros)\n\n show \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ \\\\<^sub>\\ Vset \\\"\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n proof-\n note \\_\\\\.cf_ArrMap_vrange\n moreover have \"\\\\Arr\\ \\\\<^sub>\\ Vset \\\" by (intro cat_small_cs_intros)\n ultimately show ?thesis by auto\n qed\n qed (auto simp: cf_comma_proj_right_components intro: cat_small_cs_intros)\n\nqed\n\nlemma cf_comma_proj_right_is_tm_functor'[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n and \"\\\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\ : \\\\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n using assms(1,2) unfolding assms(3) by (rule cf_comma_proj_right_is_tm_functor)\n\n\nlemma cf_comp_cf_comma_proj_left_is_tm_functor[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_functorI')\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_tm_functor \\ \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ by (rule assms(3))\n interpret \\\\: is_functor \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ \\\\ \\<^sub>C\\<^sub>F\\ \\\\\n by (rule cf_comma_proj_left_is_functor[OF assms(1-2)])\n\n show \"\\ \\<^sub>C\\<^sub>F\\ \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n\n show \"(\\ \\<^sub>C\\<^sub>F\\ \\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\ \\\\<^sub>\\ Vset \\\"\n unfolding dghm_comp_components\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"vbrelation (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\)\" by auto\n show \"Limit \\\" by auto\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n by\n (\n cs_concl \n cs_simp: V_cs_simps cat_cs_simps\n cs_intro: \\.cf_ObjMap_vrange cat_small_cs_intros\n )\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n unfolding vrange_vcomp\n proof-\n have \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\))))\"\n proof(intro vsubsetI)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n then obtain abf \n where abf_in_\\: \"abf \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n and \\\\_abf: \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\\\abf\\ = A\"\n by auto\n with \\.ObjMap.vrange_atD obtain j \n where \"j \\\\<^sub>\\ \\\\Obj\\\" and \\j: \"\\\\ObjMap\\\\j\\ = abf\"\n by (force simp: \\.cf_ObjMap_vdomain)\n from abf_in_\\ \\.cf_ObjMap_vrange have abf_in_\\\\: \n \"abf \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n by auto\n then obtain a b f where abf_def: \"abf = [a, b, f]\\<^sub>\\\"\n by (elim cat_comma_ObjE[OF _ assms(1,2)])\n have \"a \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\))))\"\n proof(intro VUnionI)\n from abf_in_\\ show \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n unfolding abf_def by auto\n show \"\\0, a\\ \\\\<^sub>\\ [a, b, f]\\<^sub>\\\" by auto\n show \"set {0, a} \\\\<^sub>\\ \\0, a\\\" unfolding vpair_def by simp\n qed auto\n with abf_in_\\\\ show \"A \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\ObjMap\\))))\"\n unfolding \\\\_abf[symmetric] abf_def\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n qed\n moreover have \"\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\)))) \\\\<^sub>\\ Vset \\\"\n by (intro VUnion_in_VsetI vrange_in_VsetI[OF \\.tm_cf_ObjMap_in_Vset])\n ultimately show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ Vset \\\" by auto\n qed\n qed\n\n show \"(\\ \\<^sub>C\\<^sub>F\\ \\ \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\ \\\\<^sub>\\ Vset \\\"\n unfolding dghm_comp_components\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"vbrelation (\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\)\" by auto\n show \"Limit \\\" by auto\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n by\n (\n cs_concl\n cs_simp: V_cs_simps cat_cs_simps\n cs_intro: \\.cf_ArrMap_vrange cat_small_cs_intros\n )\n show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n unfolding vrange_vcomp\n proof-\n have \n \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\) \\\\<^sub>\\ \n \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n proof(intro vsubsetI)\n fix F assume prems: \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n then obtain ABF \n where ABF_in_\\: \"ABF \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n and \\\\_ABF: \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\\\ABF\\ = F\"\n by auto\n with \\.ArrMap.vrange_atD obtain k \n where \"k \\\\<^sub>\\ \\\\Arr\\\" and \\j: \"\\\\ArrMap\\\\k\\ = ABF\"\n by (force simp: \\.cf_ArrMap_vdomain)\n then obtain i j where \"k : i \\\\<^bsub>\\\\<^esub> j\" by auto\n from ABF_in_\\ \\.cf_ArrMap_vrange have ABF_in_\\\\: \n \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\" \n by auto\n then obtain A B where \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_comma_is_arrE[OF _ assms(1,2)])\n have \"g \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n proof(intro VUnionI)\n from ABF_in_\\ show \n \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n unfolding ABF_def by auto\n show \"\\2\\<^sub>\\, [g, h]\\<^sub>\\\\ \\\\<^sub>\\ [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n by (auto simp: nat_omega_simps)\n show \"set {2\\<^sub>\\, [g, h]\\<^sub>\\} \\\\<^sub>\\ \\2\\<^sub>\\, [g, h]\\<^sub>\\\\\"\n unfolding vpair_def by auto\n show \"[g, h]\\<^sub>\\ \\\\<^sub>\\ set {2\\<^sub>\\, [g, h]\\<^sub>\\}\" by simp\n show \"\\0, g\\ \\\\<^sub>\\ [g, h]\\<^sub>\\\" by auto\n show \"set {0, g} \\\\<^sub>\\ \\0, g\\\" unfolding vpair_def by auto\n qed auto\n with ABF_in_\\\\ show \"F \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n unfolding \\\\_ABF[symmetric] ABF_def\n by (cs_concl cs_simp: cat_cs_simps cat_comma_cs_simps)\n qed\n moreover have \"\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\))))))) \\\\<^sub>\\ Vset \\\"\n by (intro VUnion_in_VsetI vrange_in_VsetI[OF \\.tm_cf_ArrMap_in_Vset])\n ultimately show \"\\ \\<^sub>C\\<^sub>F\\ \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\) \\\\<^sub>\\ Vset \\\" by auto\n qed\n qed\n\nqed\n\nlemma cf_comp_cf_comma_proj_right_is_tm_functor[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n shows \"\\ \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof(intro is_tm_functorI')\n\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(2))\n interpret \\: is_tm_functor \\ \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ by (rule assms(3))\n interpret \\\\: is_functor \\ \\\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\ \\ \\\\ \\\\<^sub>C\\<^sub>F \\\\\n by (rule cf_comma_proj_right_is_functor[OF assms(1-2)])\n\n show \"\\ \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n\n show \"(\\ \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\ \\\\<^sub>\\ Vset \\\"\n unfolding dghm_comp_components\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"vbrelation (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\)\" by auto\n show \"Limit \\\" by auto\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n by\n (\n cs_concl \n cs_simp: V_cs_simps cat_cs_simps\n cs_intro: \\.cf_ObjMap_vrange cat_small_cs_intros\n )\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ \\\\<^sub>\\ \\\\ObjMap\\) \\\\<^sub>\\ Vset \\\"\n unfolding vrange_vcomp\n proof-\n have \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\))))\"\n proof(intro vsubsetI)\n fix A assume prems: \"A \\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n then obtain abf \n where abf_in_\\: \"abf \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n and \\\\_abf: \"(\\ \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\abf\\ = A\"\n by (auto simp: cf_comma_proj_right_ObjMap_vsv)\n with \\.ObjMap.vrange_atD obtain j \n where \"j \\\\<^sub>\\ \\\\Obj\\\" and \\j: \"\\\\ObjMap\\\\j\\ = abf\"\n by (force simp: \\.cf_ObjMap_vdomain)\n from abf_in_\\ \\.cf_ObjMap_vrange have abf_in_\\\\: \n \"abf \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n by auto\n then obtain a b f where abf_def: \"abf = [a, b, f]\\<^sub>\\\"\n by (elim cat_comma_ObjE[OF _ assms(1,2)])\n have \"b \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\))))\"\n proof(intro VUnionI)\n from abf_in_\\ show \"[a, b, f]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\)\"\n unfolding abf_def by auto\n show \"\\1\\<^sub>\\, b\\ \\\\<^sub>\\ [a, b, f]\\<^sub>\\\" by (auto simp: nat_omega_simps)\n show \"set {1\\<^sub>\\, b} \\\\<^sub>\\ \\1\\<^sub>\\, b\\\" unfolding vpair_def by simp\n qed auto\n with abf_in_\\\\ show \"A \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\ObjMap\\))))\"\n unfolding \\\\_abf[symmetric] abf_def\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n qed\n moreover have \"\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ObjMap\\)))) \\\\<^sub>\\ Vset \\\"\n by (intro VUnion_in_VsetI vrange_in_VsetI[OF \\.tm_cf_ObjMap_in_Vset])\n ultimately show \"\\ \\\\<^sub>C\\<^sub>F \\\\ObjMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ObjMap\\) \\\\<^sub>\\ Vset \\\" by auto\n qed\n qed\n\n show \"(\\ \\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\ \\\\<^sub>\\ Vset \\\"\n unfolding dghm_comp_components\n proof(rule vbrelation.vbrelation_Limit_in_VsetI)\n show \"vbrelation (\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\)\" by auto\n show \"Limit \\\" by auto\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n by\n (\n cs_concl \n cs_simp: V_cs_simps cat_cs_simps\n cs_intro: \\.cf_ArrMap_vrange cat_small_cs_intros\n )\n show \"\\\\<^sub>\\ (\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ \\\\<^sub>\\ \\\\ArrMap\\) \\\\<^sub>\\ Vset \\\"\n unfolding vrange_vcomp\n proof-\n have \n \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\) \\\\<^sub>\\ \n \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n proof(intro vsubsetI)\n fix F assume prems: \"F \\\\<^sub>\\ \\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n then obtain ABF \n where ABF_in_\\: \"ABF \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n and \\\\_ABF: \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\ABF\\ = F\"\n by (auto simp: cf_comma_proj_right_ArrMap_vsv)\n with \\.ArrMap.vrange_atD obtain k \n where \"k \\\\<^sub>\\ \\\\Arr\\\" and \\j: \"\\\\ArrMap\\\\k\\ = ABF\"\n by (force simp: \\.cf_ArrMap_vdomain)\n then obtain i j where \"k : i \\\\<^bsub>\\\\<^esub> j\" by auto\n from ABF_in_\\ \\.cf_ArrMap_vrange have ABF_in_\\\\: \n \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Arr\\\" \n by auto\n then obtain A B where \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by auto\n with assms obtain a b f a' b' f' g h\n where ABF_def: \"ABF = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_comma_is_arrE[OF _ assms(1,2)])\n have \"h \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n proof(intro VUnionI)\n from ABF_in_\\ show \n \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\)\"\n unfolding ABF_def by auto\n show \"\\2\\<^sub>\\, [g, h]\\<^sub>\\\\ \\\\<^sub>\\ [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\\"\n by (auto simp: nat_omega_simps)\n show \"set {2\\<^sub>\\, [g, h]\\<^sub>\\} \\\\<^sub>\\ \\2\\<^sub>\\, [g, h]\\<^sub>\\\\\"\n unfolding vpair_def by auto\n show \"[g, h]\\<^sub>\\ \\\\<^sub>\\ set {2\\<^sub>\\, [g, h]\\<^sub>\\}\" by simp\n show \"\\1\\<^sub>\\, h\\ \\\\<^sub>\\ [g, h]\\<^sub>\\\" by (auto simp: nat_omega_simps)\n show \"set {1\\<^sub>\\, h} \\\\<^sub>\\ \\1\\<^sub>\\, h\\\" unfolding vpair_def by auto\n qed auto\n with ABF_in_\\\\ show \"F \\\\<^sub>\\ \\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\)))))))\"\n unfolding \\\\_ABF[symmetric] ABF_def\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cat_comma_cs_simps)\n qed\n moreover have \"\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\(\\\\<^sub>\\ (\\\\ArrMap\\))))))) \\\\<^sub>\\ Vset \\\"\n by (intro VUnion_in_VsetI vrange_in_VsetI[OF \\.tm_cf_ArrMap_in_Vset])\n ultimately show \"\\ \\\\<^sub>C\\<^sub>F \\\\ArrMap\\ `\\<^sub>\\ \\\\<^sub>\\ (\\\\ArrMap\\) \\\\<^sub>\\ Vset \\\" by auto\n qed\n qed\n\nqed\n\n\n\nsubsection\\Comma categories constructed from a functor and an object\\\n\n\nsubsubsection\\Definitions and elementary properties\\\n\n\ntext\\See Chapter II-6 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cat_cf_obj_comma :: \"V \\ V \\ V\" (\\(_ \\<^sub>C\\<^sub>F\\ _)\\ [1000, 1000] 999)\n where \"\\ \\<^sub>C\\<^sub>F\\ b \\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) (\\\\HomCod\\) b)\"\n\ndefinition cat_obj_cf_comma :: \"V \\ V \\ V\" (\\(_ \\\\<^sub>C\\<^sub>F _)\\ [1000, 1000] 999)\n where \"b \\\\<^sub>C\\<^sub>F \\ \\ (cf_const (cat_1 0 0) (\\\\HomCod\\) b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\"\n\n\ntext\\Alternative forms of the definitions.\\\n\nlemma (in is_functor) cat_cf_obj_comma_def:\n \"\\ \\<^sub>C\\<^sub>F\\ b = \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) \\ b)\" \n unfolding cat_cf_obj_comma_def cf_HomCod ..\n\nlemma (in is_functor) cat_obj_cf_comma_def:\n \"b \\\\<^sub>C\\<^sub>F \\ = (cf_const (cat_1 0 0) \\ b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\" \n unfolding cat_obj_cf_comma_def cf_HomCod ..\n\n\ntext\\Size.\\\n\nlemma small_cat_cf_obj_comma_Obj[simp]: \n \"small {[a, 0, f]\\<^sub>\\ | a f. a \\\\<^sub>\\ \\\\Obj\\ \\ f : x \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\}\"\n (is \\small ?afs\\)\nproof-\n define Q where \n \"Q i = (if i = 0 then \\\\Obj\\ else if i = 1\\<^sub>\\ then set {0} else \\\\Arr\\)\" \n for i\n have \"?afs \\ elts (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n unfolding Q_def\n proof\n (\n intro subsetI, \n unfold mem_Collect_eq, \n elim exE conjE, \n intro vproductI; \n simp only:\n )\n fix a f show \"\\\\<^sub>\\ [a, 0, f]\\<^sub>\\ = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: three nat_omega_simps)\n qed (force simp: nat_omega_simps)+\n then show \"small ?afs\" by (rule down)\nqed\n\nlemma small_cat_obj_cf_comma_Obj[simp]: \n \"small {[0, b, f]\\<^sub>\\ | b f. b \\\\<^sub>\\ \\\\Obj\\ \\ f : x \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\}\"\n (is \\small ?bfs\\)\nproof-\n define Q where\n \"Q i = (if i = 0 then set {0} else if i = 1\\<^sub>\\ then \\\\Obj\\ else \\\\Arr\\)\" \n for i\n have \"?bfs \\ elts (\\\\<^sub>\\i\\\\<^sub>\\ set {0, 1\\<^sub>\\, 2\\<^sub>\\}. Q i)\"\n unfolding Q_def\n proof\n (\n intro subsetI, \n unfold mem_Collect_eq, \n elim exE conjE, \n intro vproductI; \n simp only:\n )\n fix a b f show \"\\\\<^sub>\\ [0, b, f]\\<^sub>\\ = set {0, 1\\<^sub>\\, 2\\<^sub>\\}\"\n by (simp add: three nat_omega_simps)\n qed (force simp: nat_omega_simps)+\n then show \"small ?bfs\" by (rule down)\nqed\n\n\n\nsubsubsection\\Objects\\\n\nlemma (in is_functor) cat_cf_obj_comma_ObjI[cat_comma_cs_intros]:\n assumes \"A = [a, 0, f]\\<^sub>\\\" and \"a \\\\<^sub>\\ \\\\Obj\\\" and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n shows \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n using assms(2,3)\n unfolding assms(1)\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_cf_obj_comma_def \n cs_intro: cat_cs_intros vempty_is_zet cat_comma_ObjI\n )\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_cf_obj_comma_ObjI\n\nlemma (in is_functor) cat_obj_cf_comma_ObjI[cat_comma_cs_intros]:\n assumes \"A = [0, a, f]\\<^sub>\\\" and \"a \\\\<^sub>\\ \\\\Obj\\\" and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n shows \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n using assms(2,3)\n unfolding assms(1)\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_obj_cf_comma_def \n cs_intro: vempty_is_zet cat_cs_intros cat_comma_ObjI\n )\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_obj_cf_comma_ObjI\n\nlemma (in is_functor) cat_cf_obj_comma_ObjD[dest]:\n assumes \"[a, b', f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"a \\\\<^sub>\\ \\\\Obj\\\" and \"b' = 0\" and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\nproof-\n from assms(2) have \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n note obj = cat_comma_ObjD[\n OF assms(1)[unfolded cat_cf_obj_comma_def] is_functor_axioms this\n ]\n from obj[unfolded cat_1_components] have [cat_cs_simps]: \"b' = 0\" by simp\n moreover have \"cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ = b\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n ultimately show \"a \\\\<^sub>\\ \\\\Obj\\\" \"b' = 0\" \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n using obj by auto\nqed\n\nlemmas [dest] = is_functor.cat_cf_obj_comma_ObjD[rotated 1]\n\nlemma (in is_functor) cat_obj_cf_comma_ObjD[dest]:\n assumes \"[b', a, f]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"a \\\\<^sub>\\ \\\\Obj\\\" and \"b' = 0\" and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\nproof-\n from assms(2) have \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n note obj = cat_comma_ObjD[\n OF assms(1)[unfolded cat_obj_cf_comma_def] this is_functor_axioms\n ]\n from obj[unfolded cat_1_components] have [cat_cs_simps]: \"b' = 0\" by simp\n moreover have \"cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ = b\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n ultimately show \"a \\\\<^sub>\\ \\\\Obj\\\" \"b' = 0\" \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n using obj by auto\nqed\n\nlemmas [dest] = is_functor.cat_obj_cf_comma_ObjD[rotated 1]\n\nlemma (in is_functor) cat_cf_obj_comma_ObjE[elim]:\n assumes \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains a f \n where \"A = [a, 0, f]\\<^sub>\\\" \n and \"a \\\\<^sub>\\ \\\\Obj\\\" \n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\nproof-\n from assms(2) have \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(1)[unfolded cat_cf_obj_comma_def] is_functor_axioms this \n obtain a b' f \n where \"A = [a, b', f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and b': \"b' \\\\<^sub>\\ cat_1 0 0\\Obj\\\" \n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\\"\n by auto\n moreover from b' have [cat_cs_simps]: \"b' = 0\"\n unfolding cat_1_components by auto\n moreover have \"cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ = b\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n ultimately show ?thesis using that by auto\nqed\n\nlemmas [elim] = is_functor.cat_cf_obj_comma_ObjE[rotated 1]\n\nlemma (in is_functor) cat_obj_cf_comma_ObjE[elim]:\n assumes \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains a f \n where \"A = [0, a, f]\\<^sub>\\\"\n and \"a \\\\<^sub>\\ \\\\Obj\\\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\nproof-\n from assms(2) have \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(1)[unfolded cat_obj_cf_comma_def] is_functor_axioms this \n obtain a b' f \n where A_def: \"A = [b', a, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and b': \"b' \\\\<^sub>\\ cat_1 0 0\\Obj\\\" \n and f: \"f : cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by auto\n moreover from b' have [cat_cs_simps]: \"b' = 0\" \n unfolding cat_1_components by auto\n moreover have \"cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ = b\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n ultimately show ?thesis using that by auto\nqed\n\nlemmas [elim] = is_functor.cat_obj_cf_comma_ObjE[rotated 1]\n\n\nsubsubsection\\Arrows\\\n\nlemma (in is_functor) cat_cf_obj_comma_ArrI[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"F = [A, B, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, 0, f]\\<^sub>\\\"\n and \"B = [a', 0, f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n shows \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n unfolding cat_cf_obj_comma_def\nproof(intro cat_comma_ArrI cat_comma_HomI)\n show \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n from assms(1) show const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from vempty_is_zet show 0: \"0 : 0 \\\\<^bsub>cat_1 0 0\\<^esub> 0\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_cs_simps cat_1_CId_app cs_intro: cat_cs_intros\n )\n from assms(6) show \n \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ObjMap\\\\0\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from assms(7) show \n \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ObjMap\\\\0\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from 0 assms(6) show \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = cf_const (cat_1 0 0) \\ b\\ArrMap\\\\0\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_cs_simps assms(8) cs_intro: cat_cs_intros\n )\n from const assms(5,6) show \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) \\ b)\\Obj\\\"\n by (fold cat_cf_obj_comma_def)\n (cs_concl cs_simp: assms(3) cs_intro: cat_cs_intros cat_comma_cs_intros)\n from const assms(5,7) show \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) \\ b)\\Obj\\\"\n by (fold cat_cf_obj_comma_def)\n (\n cs_concl cs_shallow \n cs_simp: assms(4) cs_intro: cat_cs_intros cat_comma_cs_intros\n )\nqed (intro assms)+\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_cf_obj_comma_ArrI\n\nlemma (in is_functor) cat_obj_cf_comma_ArrI[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"F = [A, B, [0, g]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [0, a, f]\\<^sub>\\\"\n and \"B = [0, a', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\ \"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n shows \"F \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_obj_cf_comma_def\nproof(intro cat_comma_ArrI cat_comma_HomI)\n show \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n from assms(1) show const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from vempty_is_zet show 0: \"0 : 0 \\\\<^bsub>cat_1 0 0\\<^esub> 0\"\n by (cs_concl cs_shallow cs_simp: cat_1_CId_app cs_intro: cat_cs_intros)\n from assms(6) show \n \"f : cf_const (cat_1 0 0) \\ b\\ObjMap\\\\0\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from assms(7) show \n \"f' : cf_const (cat_1 0 0) \\ b\\ObjMap\\\\0\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from 0 assms(7) show \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ArrMap\\\\0\\ = \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_cs_simps assms(8) cs_intro: cat_cs_intros\n )\n from const assms(5,6) show \"A \\\\<^sub>\\ (cf_const (cat_1 0 0) \\ b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (fold cat_obj_cf_comma_def)\n (cs_concl cs_simp: assms(3) cs_intro: cat_cs_intros cat_comma_cs_intros)\n from const assms(5,7) show \"B \\\\<^sub>\\ (cf_const (cat_1 0 0) \\ b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (fold cat_obj_cf_comma_def)\n (\n cs_concl cs_shallow \n cs_simp: assms(4) cs_intro: cat_cs_intros cat_comma_cs_intros\n )\nqed (intro assms)+\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_obj_cf_comma_ArrI\n\nlemma (in is_functor) cat_cf_obj_comma_ArrE[elim]:\n assumes \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains A B a f a' f' g\n where \"F = [A, B, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, 0, f]\\<^sub>\\\"\n and \"B = [a', 0, f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\nproof-\n from cat_comma_ArrE[OF assms(1)[unfolded cat_cf_obj_comma_def]] \n obtain A B \n where F: \"F \\\\<^sub>\\ cat_comma_Hom \\ (cf_const (cat_1 0 0) \\ b) A B\"\n and A: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) \\ b)\\Obj\\\"\n and B: \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F (cf_const (cat_1 0 0) \\ b)\\Obj\\\"\n by auto\n from assms(2) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from F obtain a b'' f a' b' f' g h\n where F_def: \"F = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, b'', f]\\<^sub>\\\"\n and B_def: \"B = [a', b', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and h: \"h : b'' \\\\<^bsub>cat_1 0 0\\<^esub> b'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b''\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\\"\n and f_def: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = cf_const (cat_1 0 0) \\ b\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_HomE[OF _ is_functor_axioms const]) blast\n note hb'b'' = cat_1_is_arrD[OF h]\n from F_def have F_def: \"F = [A, B, [g, 0]\\<^sub>\\]\\<^sub>\\\" \n unfolding hb'b'' by simp\n from A_def have A_def: \"A = [a, 0, f]\\<^sub>\\\"\n unfolding hb'b'' by simp\n from B_def have B_def: \"B = [a', 0, f']\\<^sub>\\\"\n unfolding hb'b'' by simp\n from f have f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from f' have f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from f_def f f' g h have f_def: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from \n that F_def A_def B_def g f f' f_def \n B[folded cat_cf_obj_comma_def] A[folded cat_cf_obj_comma_def]\n show ?thesis\n by blast\nqed\n\nlemmas [elim] = is_functor.cat_cf_obj_comma_ArrE[rotated 1]\n\nlemma (in is_functor) cat_obj_cf_comma_ArrE[elim]:\n assumes \"F \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains A B a f a' f' g\n where \"F = [A, B, [0, g]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [0, a, f]\\<^sub>\\\"\n and \"B = [0, a', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n and \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof-\n from cat_comma_ArrE[OF assms(1)[unfolded cat_obj_cf_comma_def]] \n obtain A B \n where F: \"F \\\\<^sub>\\ cat_comma_Hom (cf_const (cat_1 0 0) \\ b) \\ A B\"\n and A: \"A \\\\<^sub>\\ (cf_const (cat_1 0 0) \\ b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and B: \"B \\\\<^sub>\\ (cf_const (cat_1 0 0) \\ b) \\<^sub>C\\<^sub>F\\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by auto\n from assms(2) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from F obtain a b'' f a' b' f' h g \n where F_def: \"F = [A, B, [h, g]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [b', a, f]\\<^sub>\\\"\n and B_def: \"B = [b'', a', f']\\<^sub>\\\"\n and h: \"h : b' \\\\<^bsub>cat_1 0 0\\<^esub> b''\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b'\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and f': \"f' : cf_const (cat_1 0 0) \\ b\\ObjMap\\\\b''\\ \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and f'_def: \n \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> cf_const (cat_1 0 0) \\ b\\ArrMap\\\\h\\ = \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n by (elim cat_comma_HomE[OF _ const is_functor_axioms]) blast\n note hb'b'' = cat_1_is_arrD[OF h]\n from F_def have F_def: \"F = [A, B, [0, g]\\<^sub>\\]\\<^sub>\\\" \n unfolding hb'b'' by simp\n from A_def have A_def: \"A = [0, a, f]\\<^sub>\\\" unfolding hb'b'' by simp\n from B_def have B_def: \"B = [0, a', f']\\<^sub>\\\" unfolding hb'b'' by simp\n from f have f: \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from f' have f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from f'_def f f' g h have f'_def[symmetric]: \"f' = \\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f\"\n unfolding hb'b'' \n by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n from \n that F_def A_def B_def g f f' f'_def \n A[folded cat_obj_cf_comma_def] B[folded cat_obj_cf_comma_def] \n show ?thesis\n by blast\nqed\n\nlemmas [elim] = is_functor.cat_obj_cf_comma_ArrE\n\nlemma (in is_functor) cat_cf_obj_comma_ArrD[dest]: \n assumes \"[[a, b', f]\\<^sub>\\, [a', b'', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b' = 0\"\n and \"b'' = 0\"\n and \"h = 0\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n and \"[a, b', f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n and \"[a', b'', f']\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n using cat_cf_obj_comma_ArrE[OF assms] by auto\n\nlemmas [dest] = is_functor.cat_cf_obj_comma_ArrD[rotated 1]\n\nlemma (in is_functor) cat_obj_cf_comma_ArrD[dest]: \n assumes \"[[b', a, f]\\<^sub>\\, [b'', a', f']\\<^sub>\\, [h, g]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b' = 0\"\n and \"b'' = 0\"\n and \"h = 0\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n and \"[b', a, f]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"[b'', a', f']\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n using cat_obj_cf_comma_ArrE[OF assms] by auto\n\nlemmas [dest] = is_functor.cat_obj_cf_comma_ArrD\n\n\nsubsubsection\\Domain\\\n\nlemma cat_cf_obj_comma_Dom_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\ b\\Dom\\)\"\n unfolding cat_cf_obj_comma_def cat_comma_components by simp\n\nlemma cat_cf_obj_comma_Dom_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ b\\Dom\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n unfolding cat_cf_obj_comma_def cat_comma_components by simp\n\nlemma cat_cf_obj_comma_Dom_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ b\\Dom\\\\ABF\\ = A\"\n using assms(2) \n unfolding assms(1) cat_cf_obj_comma_def cat_comma_components \n by simp\n\nlemma (in is_functor) cat_cf_obj_comma_Dom_vrange:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ b\\Dom\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\nproof- \n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Dom_vrange[\n OF is_functor_axioms const, folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma cat_obj_cf_comma_Dom_vsv[cat_comma_cs_intros]: \"vsv (b \\\\<^sub>C\\<^sub>F \\\\Dom\\)\"\n unfolding cat_obj_cf_comma_def cat_comma_components by simp\n\nlemma cat_obj_cf_comma_Dom_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\Dom\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_obj_cf_comma_def cat_comma_components by simp\n\nlemma cat_obj_cf_comma_Dom_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"b \\\\<^sub>C\\<^sub>F \\\\Dom\\\\ABF\\ = A\"\n using assms(2)\n unfolding assms(1) cat_obj_cf_comma_def cat_comma_components \n by simp\n\nlemma (in is_functor) cat_obj_cf_comma_Dom_vrange:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\Dom\\) \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof- \n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Dom_vrange[\n OF const is_functor_axioms, folded cat_obj_cf_comma_def\n ]\n )\nqed\n\n\nsubsubsection\\Codomain\\\n\nlemma cat_cf_obj_comma_Cod_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\ b\\Cod\\)\"\n unfolding cat_cf_obj_comma_def cat_comma_components by simp\n\nlemma cat_cf_obj_comma_Cod_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ b\\Cod\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n unfolding cat_cf_obj_comma_def cat_comma_components by simp\n\nlemma cat_cf_obj_comma_Cod_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ b\\Cod\\\\ABF\\ = B\"\n using assms(2) \n unfolding assms(1) cat_cf_obj_comma_def cat_comma_components \n by (simp add: nat_omega_simps)\n\nlemma (in is_functor) cat_cf_obj_comma_Cod_vrange:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ b\\Cod\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\nproof- \n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Cod_vrange[\n OF is_functor_axioms const, folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma cat_obj_cf_comma_Cod_vsv[cat_comma_cs_intros]: \"vsv (b \\\\<^sub>C\\<^sub>F \\\\Cod\\)\"\n unfolding cat_obj_cf_comma_def cat_comma_components by simp\n\nlemma cat_obj_cf_comma_Cod_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\Cod\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cat_obj_cf_comma_def cat_comma_components by simp\n\nlemma cat_obj_cf_comma_Cod_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, F]\\<^sub>\\\" and \"ABF \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"b \\\\<^sub>C\\<^sub>F \\\\Cod\\\\ABF\\ = B\"\n using assms(2)\n unfolding assms(1) cat_obj_cf_comma_def cat_comma_components \n by (simp add: nat_omega_simps)\n\nlemma (in is_functor) cat_obj_cf_comma_Cod_vrange:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\Dom\\) \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof- \n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Dom_vrange[\n OF const is_functor_axioms, folded cat_obj_cf_comma_def\n ]\n )\nqed\n\n\nsubsubsection\\Arrow with a domain and a codomain\\\n\nlemma (in is_functor) cat_cf_obj_comma_is_arrI[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"ABF = [A, B, F]\\<^sub>\\\"\n and \"A = [a, 0, f]\\<^sub>\\\"\n and \"B = [a', 0, f']\\<^sub>\\\"\n and \"F = [g, 0]\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n shows \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> B\"\nproof(intro is_arrI)\n from assms(1,6,7,8) show \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: assms(2,3,4,5,9) cs_intro: cat_comma_cs_intros\n )\n with assms(2) show \"\\ \\<^sub>C\\<^sub>F\\ b\\Dom\\\\ABF\\ = A\" \"\\ \\<^sub>C\\<^sub>F\\ b\\Cod\\\\ABF\\ = B\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)+\nqed\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_cf_obj_comma_is_arrI\n\nlemma (in is_functor) cat_obj_cf_comma_is_arrI[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"ABF = [A, B, F]\\<^sub>\\\"\n and \"A = [0, a, f]\\<^sub>\\\"\n and \"B = [0, a', f']\\<^sub>\\\"\n and \"F = [0, g]\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n shows \"ABF : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\nproof(intro is_arrI)\n from assms(1,6,7,8) show \"ABF \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by \n (\n cs_concl cs_shallow \n cs_simp: assms(2,3,4,5,9) cs_intro: cat_comma_cs_intros\n )\n with assms(2) show \"b \\\\<^sub>C\\<^sub>F \\\\Dom\\\\ABF\\ = A\" \"b \\\\<^sub>C\\<^sub>F \\\\Cod\\\\ABF\\ = B\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)+\nqed\n\nlemmas [cat_comma_cs_intros] = is_functor.cat_obj_cf_comma_is_arrI\n\nlemma (in is_functor) cat_cf_obj_comma_is_arrD[dest]:\n assumes \"[[a, b', f]\\<^sub>\\, [a', b'', f']\\<^sub>\\, [g, h]\\<^sub>\\]\\<^sub>\\ :\n [a, b', f]\\<^sub>\\ \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> [a', b'', f']\\<^sub>\\\"\n and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b' = 0\"\n and \"b'' = 0\"\n and \"h = 0\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n and \"[a, b', f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n and \"[a', b'', f']\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n by (intro cat_cf_obj_comma_ArrD[OF is_arrD(1)[OF assms(1)] assms(2)])+\n\nlemma (in is_functor) cat_obj_cf_comma_is_arrD[dest]:\n assumes \"[[b', a, f]\\<^sub>\\, [b'', a', f']\\<^sub>\\, [h, g]\\<^sub>\\]\\<^sub>\\ :\n [b', a, f]\\<^sub>\\ \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> [b'', a', f']\\<^sub>\\\"\n and \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b' = 0\"\n and \"b'' = 0\"\n and \"h = 0\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n and \"[b', a, f]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"[b'', a', f']\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (intro cat_obj_cf_comma_ArrD[OF is_arrD(1)[OF assms(1)] assms(2)])+\n\nlemmas [dest] = is_functor.cat_obj_cf_comma_is_arrD\n\nlemma (in is_functor) cat_cf_obj_comma_is_arrE[elim]:\n assumes \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> B\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains a f a' f' g \n where \"ABF = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [a, 0, f]\\<^sub>\\\"\n and \"B = [a', 0, f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n and \"B \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\nproof-\n note ABF = is_arrD[OF assms(1)]\n from ABF(1) obtain C D a f a' f' g \n where ABF_def: \"ABF = [C, D, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a, 0, f]\\<^sub>\\\"\n and D_def: \"D = [a', 0, f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and f_def: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\" \n and C: \"C \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\" \n and D: \"D \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n by (elim cat_cf_obj_comma_ArrE[OF _ assms(2)])\n from ABF(2) assms(2) C_def D_def g f f' f_def have [simp]: \"C = A\"\n unfolding ABF_def \n by \n ( \n cs_prems cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n from ABF(3) assms(2) C_def D_def g f f' f_def have [simp]: \"D = B\"\n unfolding ABF_def \n by \n (\n cs_prems cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n from that ABF_def C_def D_def g f f' f_def C D show ?thesis by auto\nqed\n\nlemmas [elim] = is_functor.cat_cf_obj_comma_is_arrE\n\nlemma (in is_functor) cat_obj_cf_comma_is_arrE[elim]:\n assumes \"ABF : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\" and \"b \\\\<^sub>\\ \\\\Obj\\\"\n obtains a f a' f' g\n where \"ABF = [[0, a, f]\\<^sub>\\, [0, a', f']\\<^sub>\\, [0, g]\\<^sub>\\]\\<^sub>\\\"\n and \"A = [0, a, f]\\<^sub>\\\"\n and \"B = [0, a', f']\\<^sub>\\\"\n and \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n and \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n and \"B \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof-\n note ABF = is_arrD[OF assms(1)]\n from ABF(1) obtain C D a f a' f' g \n where ABF_def: \"ABF = [C, D, [0, g]\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [0, a, f]\\<^sub>\\\"\n and D_def: \"D = [0, a', f']\\<^sub>\\\"\n and g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and f'_def: \"\\\\ArrMap\\\\g\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\" \n and C: \"C \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\" \n and D: \"D \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (elim cat_obj_cf_comma_ArrE[OF _ assms(2)])\n from ABF(2) assms(2) C_def D_def g f f' f'_def have [simp]: \"C = A\"\n unfolding ABF_def \n by \n (\n cs_prems cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n from ABF(3) assms(2) C_def D_def g f f' f'_def have [simp]: \"D = B\"\n unfolding ABF_def \n by \n (\n cs_prems cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n from that ABF_def C_def D_def g f f' f'_def C D show ?thesis by auto\nqed\n\nlemmas [elim] = is_functor.cat_obj_cf_comma_is_arrE\n\n\nsubsubsection\\Composition\\\n\nlemma cat_cf_obj_comma_Comp_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\ b\\Comp\\)\"\n unfolding cat_cf_obj_comma_def \n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma cat_obj_cf_comma_Comp_vsv[cat_comma_cs_intros]: \"vsv (b \\\\<^sub>C\\<^sub>F \\\\Comp\\)\"\n unfolding cat_obj_cf_comma_def \n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma (in is_functor) cat_cf_obj_comma_Comp_app[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"BCG = [B, C, [g', h']\\<^sub>\\]\\<^sub>\\\"\n and \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\"\n and \"BCG : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> C\" \n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> B\"\n shows \"BCG \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> ABF = [A, C, [g' \\\\<^sub>A\\<^bsub>\\\\<^esub> g, 0]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(4) obtain a f a' f' g\n where BCG_def: \"BCG = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_cf_obj_comma_is_arrE[OF _ assms(1)])\n from assms(5) obtain a f a' f' g\n where ABF_def: \"ABF = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [g, 0]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_cf_obj_comma_is_arrE[OF _ assms(1)])\n from assms(2)[unfolded BCG_def] assms(3)[unfolded ABF_def] have [cat_cs_simps]:\n \"h' = 0\" \"h = 0\"\n by simp_all\n have \"h' \\\\<^sub>A\\<^bsub>cat_1 0 0\\<^esub> h = 0\" by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n show ?thesis\n by \n (\n rule cat_comma_Comp_app\n [\n OF \n is_functor_axioms \n const \n assms(2,3) \n assms(4)[unfolded cat_cf_obj_comma_def] \n assms(5)[unfolded cat_cf_obj_comma_def],\n folded cat_cf_obj_comma_def,\n unfolded cat_cs_simps\n ]\n )\nqed\n\nlemma (in is_functor) cat_obj_cf_comma_Comp_app[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"BCG = [B, C, [h', g']\\<^sub>\\]\\<^sub>\\\"\n and \"ABF = [A, B, [h, g]\\<^sub>\\]\\<^sub>\\\"\n and \"BCG : B \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> C\" \n and \"ABF : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"BCG \\\\<^sub>A\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> ABF = [A, C, [0, g' \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(4) obtain a f a' f' g\n where BCG_def: \"BCG = [[0, a, f]\\<^sub>\\, [0, a', f']\\<^sub>\\, [0, g]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_obj_cf_comma_is_arrE[OF _ assms(1)])\n from assms(5) obtain a f a' f' g\n where ABF_def: \"ABF = [[0, a, f]\\<^sub>\\, [0, a', f']\\<^sub>\\, [0, g]\\<^sub>\\]\\<^sub>\\\"\n by (elim cat_obj_cf_comma_is_arrE[OF _ assms(1)])\n from assms(2)[unfolded BCG_def] assms(3)[unfolded ABF_def] have [cat_cs_simps]:\n \"h' = 0\" \"h = 0\"\n by simp_all\n have \"h' \\\\<^sub>A\\<^bsub>cat_1 0 0\\<^esub> h = 0\" by (cs_concl cs_shallow cs_simp: cat_cs_simps) \n show ?thesis\n by \n (\n rule cat_comma_Comp_app\n [\n OF \n const \n is_functor_axioms\n assms(2,3) \n assms(4)[unfolded cat_obj_cf_comma_def] \n assms(5)[unfolded cat_obj_cf_comma_def],\n folded cat_obj_cf_comma_def,\n unfolded cat_cs_simps\n ]\n )\nqed\n\nlemma (in is_functor) cat_cf_obj_comma_Comp_is_arr[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"BCG : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> C\" \n and \"ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> B\"\n shows \"BCG \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> ABF : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> C\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Comp_is_arr\n [\n OF \n is_functor_axioms \n const \n assms(2)[unfolded cat_cf_obj_comma_def]\n assms(3)[unfolded cat_cf_obj_comma_def],\n folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) cat_obj_cf_comma_Comp_is_arr[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"BCG : B \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> C\" \n and \"ABF : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n shows \"BCG \\\\<^sub>A\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> ABF : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> C\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_Comp_is_arr\n [\n OF \n const \n is_functor_axioms \n assms(2)[unfolded cat_obj_cf_comma_def]\n assms(3)[unfolded cat_obj_cf_comma_def],\n folded cat_obj_cf_comma_def\n ]\n )\nqed\n\n\nsubsubsection\\Identity\\\n\nlemma cat_cf_obj_comma_CId_vsv[cat_comma_cs_intros]: \"vsv (\\ \\<^sub>C\\<^sub>F\\ b\\CId\\)\"\n unfolding cat_cf_obj_comma_def \n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma cat_obj_cf_comma_CId_vsv[cat_comma_cs_intros]: \"vsv (b \\\\<^sub>C\\<^sub>F \\\\CId\\)\"\n unfolding cat_obj_cf_comma_def \n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma (in is_functor) cat_cf_obj_comma_CId_vdomain[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\ b\\CId\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule cat_comma_CId_vdomain[\n OF is_functor_axioms const, folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) cat_obj_cf_comma_CId_vdomain[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\CId\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show \"\\\\<^sub>\\ (b \\\\<^sub>C\\<^sub>F \\\\CId\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by \n (\n rule cat_comma_CId_vdomain[\n OF const is_functor_axioms, folded cat_obj_cf_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) cat_cf_obj_comma_CId_app[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"A = [a, b', f]\\<^sub>\\\" and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\ b\\CId\\\\A\\ = [A, A, [\\\\CId\\\\a\\, 0]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(3,2) have b'_def: \"b' = 0\"\n by (auto elim: cat_cf_obj_comma_ObjE[OF _ assms(1)])\n have [cat_cs_simps]: \"cat_1 0 0\\CId\\\\b'\\ = 0\" \n unfolding cat_1_components b'_def by simp\n show ?thesis\n by \n ( \n rule cat_comma_CId_app\n [\n OF \n is_functor_axioms \n const\n assms(2,3)[unfolded cat_cf_obj_comma_def], \n unfolded cat_cf_obj_comma_def[symmetric] cat_cs_simps\n ]\n )\nqed\n\nlemma (in is_functor) cat_obj_cf_comma_CId_app[cat_comma_cs_simps]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"A = [b', a, f]\\<^sub>\\\" and \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"b \\\\<^sub>C\\<^sub>F \\\\CId\\\\A\\ = [A, A, [0, \\\\CId\\\\a\\]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n from assms(3,2) have b'_def: \"b' = 0\"\n by (auto elim: cat_obj_cf_comma_ObjE[OF _ assms(1)])\n have [cat_cs_simps]: \"cat_1 0 0\\CId\\\\b'\\ = 0\" \n unfolding cat_1_components b'_def by simp\n show ?thesis\n by \n ( \n rule cat_comma_CId_app\n [\n OF \n const\n is_functor_axioms \n assms(2,3)[unfolded cat_obj_cf_comma_def], \n unfolded cat_obj_cf_comma_def[symmetric] cat_cs_simps\n ]\n )\nqed\n\n\nsubsubsection\\\nComma categories constructed from a functor and an object are categories\n\\\n\nlemma (in is_functor) category_cat_cf_obj_comma[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"category \\ (\\ \\<^sub>C\\<^sub>F\\ b)\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule category_cat_comma[\n OF is_functor_axioms const, folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemmas [cat_comma_cs_intros] = is_functor.category_cat_cf_obj_comma\n\nlemma (in is_functor) category_cat_obj_cf_comma[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"category \\ (b \\\\<^sub>C\\<^sub>F \\)\"\nproof-\n from assms(1) have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_cs_intros)\n show ?thesis\n by \n (\n rule category_cat_comma[\n OF const is_functor_axioms, folded cat_obj_cf_comma_def\n ]\n )\nqed\n\nlemmas [cat_comma_cs_intros] = is_functor.category_cat_obj_cf_comma\n\n\nsubsubsection\\Tiny comma categories constructed from a functor and an object\\\n\nlemma (in is_tm_functor) tiny_category_cat_cf_obj_comma[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"tiny_category \\ (\\ \\<^sub>C\\<^sub>F\\ b)\"\nproof-\n from assms(1) have const: \n \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_small_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule tiny_category_cat_comma[\n OF is_tm_functor_axioms const, folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_tm_functor) tiny_category_cat_obj_cf_comma[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"tiny_category \\ (b \\\\<^sub>C\\<^sub>F \\)\"\nproof-\n from assms(1) have const: \n \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: vempty_is_zet cat_small_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule tiny_category_cat_comma[\n OF const is_tm_functor_axioms, folded cat_obj_cf_comma_def\n ]\n )\nqed\n\n\n\nsubsection\\\nOpposite comma category functors for the comma categories\nconstructed from a functor and an object\n\\\n\n\nsubsubsection\\Definitions and elementary properties\\\n\ndefinition op_cf_obj_comma :: \"V \\ V \\ V\"\n where \"op_cf_obj_comma \\ b =\n op_cf_comma \\ (cf_const (cat_1 0 0) (\\\\HomCod\\) b)\"\n\ndefinition op_obj_cf_comma :: \"V \\ V \\ V\"\n where \"op_obj_cf_comma b \\ =\n op_cf_comma (cf_const (cat_1 0 0) (\\\\HomCod\\) b) \\\"\n\n\ntext\\Alternative forms of the definitions.\\\n\nlemma (in is_functor) op_cf_obj_comma_def: \n \"op_cf_obj_comma \\ b = op_cf_comma \\ (cf_const (cat_1 0 0) \\ b)\"\n unfolding op_cf_obj_comma_def cat_cs_simps by simp\n\nlemma (in is_functor) op_obj_cf_comma_def:\n \"op_obj_cf_comma b \\ = op_cf_comma (cf_const (cat_1 0 0) \\ b) \\\"\n unfolding op_obj_cf_comma_def cat_cs_simps by simp\n\n\nsubsubsection\\Object map\\\n\nlemma op_cf_obj_comma_ObjMap_vsv[cat_comma_cs_intros]:\n \"vsv (op_cf_obj_comma \\ b\\ObjMap\\)\"\n unfolding op_cf_obj_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n\nlemma op_obj_cf_comma_ObjMap_vsv[cat_comma_cs_intros]:\n \"vsv (op_obj_cf_comma b \\\\ObjMap\\)\"\n unfolding op_obj_cf_comma_def\n by\n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n\nlemma (in is_functor) op_cf_obj_comma_ObjMap_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (op_cf_obj_comma \\ b\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n unfolding op_cf_obj_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cat_cf_obj_comma_def[symmetric]\n )\n\nlemma (in is_functor) op_obj_cf_comma_ObjMap_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (op_obj_cf_comma b \\\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n unfolding op_obj_cf_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cat_obj_cf_comma_def[symmetric]\n )\n\nlemma (in is_functor) op_cf_obj_comma_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a, 0, f]\\<^sub>\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\" and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n shows \"op_cf_obj_comma \\ b\\ObjMap\\\\A\\ = [0, a, f]\\<^sub>\\\"\nproof-\n have a: \"a \\\\<^sub>\\ \\\\Obj\\\" and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n by (intro cat_cf_obj_comma_ObjD[OF assms(3)[unfolded assms(1)] assms(2)])+\n from assms(2) a f show ?thesis\n using assms(2)\n unfolding assms(1) op_cf_obj_comma_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: V_cs_intros cat_cs_intros cat_comma_cs_intros\n )\nqed\n\nlemma (in is_functor) op_obj_cf_comma_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [0, a, f]\\<^sub>\\\" and \"b \\\\<^sub>\\ \\\\Obj\\\" and \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"op_obj_cf_comma b \\ \\ObjMap\\\\A\\ = [a, 0, f]\\<^sub>\\\"\nproof-\n have a: \"a \\\\<^sub>\\ \\\\Obj\\\" and f: \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by (intro cat_obj_cf_comma_ObjD[OF assms(3)[unfolded assms(1)] assms(2)])+\n from assms(2) a f show ?thesis\n using assms(2)\n unfolding assms(1) op_obj_cf_comma_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: V_cs_intros cat_cs_intros cat_comma_cs_intros\n )\nqed\n\n\nsubsubsection\\Arrow map\\\n\nlemma op_cf_obj_comma_ArrMap_vsv[cat_comma_cs_intros]:\n \"vsv (op_cf_obj_comma \\ b\\ArrMap\\)\"\n unfolding op_cf_obj_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n\nlemma op_obj_cf_comma_ArrMap_vsv[cat_comma_cs_intros]:\n \"vsv (op_obj_cf_comma b \\\\ArrMap\\)\"\n unfolding op_obj_cf_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cs_intro: cat_comma_cs_intros\n )\n\nlemma (in is_functor) op_cf_obj_comma_ArrMap_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (op_cf_obj_comma \\ b\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n unfolding op_cf_obj_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cat_cf_obj_comma_def[symmetric]\n )\n\nlemmas [cat_comma_cs_simps] = is_functor.op_cf_obj_comma_ArrMap_vdomain\n\nlemma (in is_functor) op_obj_cf_comma_ArrMap_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (op_obj_cf_comma b \\\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding op_obj_cf_comma_def\n by \n (\n cs_concl cs_shallow \n cs_simp: cat_comma_cs_simps cat_obj_cf_comma_def[symmetric] \n )\n\nlemmas [cat_comma_cs_simps] = is_functor.op_obj_cf_comma_ArrMap_vdomain\n\nlemma (in is_functor) op_cf_obj_comma_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [g, 0]\\<^sub>\\]\\<^sub>\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"ABF \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n shows \"op_cf_obj_comma \\ b\\ArrMap\\\\ABF\\ = [[0, a', f']\\<^sub>\\, [0, a, f]\\<^sub>\\, [0, g]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(3) have g: \"g : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> b\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and [cat_comma_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\g\\ = f\"\n by (intro cat_cf_obj_comma_ArrD[OF assms(3)[unfolded assms(1)] assms(2)])+\n from assms(2) g f f' show ?thesis\n unfolding assms(1) op_cf_obj_comma_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_1_CId_app\n cs_intro: V_cs_intros cat_cs_intros cat_comma_cs_intros cat_1_is_arrI\n )\nqed\n\nlemmas [cat_comma_cs_simps] = is_functor.op_cf_obj_comma_ArrMap_app\n\nlemma (in is_functor) op_obj_cf_comma_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [[0, a, f]\\<^sub>\\, [0, a', f']\\<^sub>\\, [0, h]\\<^sub>\\]\\<^sub>\\\" \n and \"b \\\\<^sub>\\ \\\\Obj\\\" \n and \"ABF \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"op_obj_cf_comma b \\\\ArrMap\\\\ABF\\ = [[a', 0, f']\\<^sub>\\, [a, 0, f]\\<^sub>\\, [h, 0]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(3) have h: \"h : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n and [cat_comma_cs_simps]: \"\\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n by (intro cat_obj_cf_comma_ArrD[OF assms(3)[unfolded assms(1)] assms(2)])+\n from assms(2) h f f' show ?thesis\n unfolding assms(1) op_obj_cf_comma_def\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps cat_1_CId_app\n cs_intro: V_cs_intros cat_cs_intros cat_comma_cs_intros cat_1_is_arrI\n )\nqed\n\nlemmas [cat_comma_cs_simps] = is_functor.op_obj_cf_comma_ArrMap_app\n\n\nsubsubsection\\\nOpposite comma category functors for the comma categories\nconstructed from a functor and an object are isomorphisms of categories\n\\\n\nlemma (in is_functor) op_cf_obj_comma_is_iso_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_cf_obj_comma \\ b : op_cat (\\ \\<^sub>C\\<^sub>F\\ b) \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> b \\\\<^sub>C\\<^sub>F (op_cf \\)\"\nproof-\n from assms have cf_const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n note cat_obj_cf_comma_def = \n is_functor.cat_obj_cf_comma_def[\n OF is_functor_op, unfolded cat_op_simps\n ]\n show ?thesis\n by \n (\n rule op_cf_comma_is_iso_functor\n [\n OF is_functor_axioms cf_const, \n folded cat_cf_obj_comma_def op_cf_obj_comma_def,\n unfolded cat_op_simps, \n folded cat_obj_cf_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) op_cf_obj_comma_is_iso_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\' = op_cat (\\ \\<^sub>C\\<^sub>F\\ b)\"\n and \"\\' = b \\\\<^sub>C\\<^sub>F (op_cf \\)\"\n shows \"op_cf_obj_comma \\ b : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule op_cf_obj_comma_is_iso_functor)\n\nlemmas [cat_comma_cs_intros] = is_functor.op_cf_obj_comma_is_iso_functor'\n\nlemma (in is_functor) op_cf_obj_comma_is_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_cf_obj_comma \\ b : op_cat (\\ \\<^sub>C\\<^sub>F\\ b) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> b \\\\<^sub>C\\<^sub>F (op_cf \\)\"\n by (rule is_iso_functorD(1)[OF op_cf_obj_comma_is_iso_functor[OF assms]])\n\nlemma (in is_functor) op_cf_obj_comma_is_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\' = op_cat (\\ \\<^sub>C\\<^sub>F\\ b)\"\n and \"\\' = b \\\\<^sub>C\\<^sub>F (op_cf \\)\"\n shows \"op_cf_obj_comma \\ b : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule op_cf_obj_comma_is_functor)\n\nlemmas [cat_comma_cs_intros] = is_functor.op_cf_obj_comma_is_functor'\n\nlemma (in is_functor) op_obj_cf_comma_is_iso_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_obj_cf_comma b \\ : op_cat (b \\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> (op_cf \\) \\<^sub>C\\<^sub>F\\ b\"\nproof-\n from assms have cf_const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n note cat_cf_obj_comma_def = \n is_functor.cat_cf_obj_comma_def[\n OF is_functor_op, unfolded cat_op_simps\n ]\n show ?thesis\n by\n (\n rule op_cf_comma_is_iso_functor\n [\n OF cf_const is_functor_axioms,\n folded cat_obj_cf_comma_def op_obj_cf_comma_def,\n unfolded cat_op_simps,\n folded cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) op_obj_cf_comma_is_iso_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\' = op_cat (b \\\\<^sub>C\\<^sub>F \\)\"\n and \"\\' = (op_cf \\) \\<^sub>C\\<^sub>F\\ b\"\n shows \"op_obj_cf_comma b \\ : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule op_obj_cf_comma_is_iso_functor)\n \nlemmas [cat_comma_cs_intros] = is_functor.op_obj_cf_comma_is_iso_functor'\n\nlemma (in is_functor) op_obj_cf_comma_is_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_obj_cf_comma b \\ : op_cat (b \\\\<^sub>C\\<^sub>F \\) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> (op_cf \\) \\<^sub>C\\<^sub>F\\ b\"\n by (rule is_iso_functorD(1)[OF op_obj_cf_comma_is_iso_functor[OF assms]])\n\nlemma (in is_functor) op_obj_cf_comma_is_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n and \"\\' = op_cat (b \\\\<^sub>C\\<^sub>F \\)\"\n and \"\\' = (op_cf \\) \\<^sub>C\\<^sub>F\\ b\"\n shows \"op_obj_cf_comma b \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule op_obj_cf_comma_is_functor)\n\n\n\nsubsection\\\nProjections for comma categories constructed from a functor and an object\n\\\n\n\nsubsubsection\\Definitions and elementary properties\\\n\ndefinition cf_cf_obj_comma_proj :: \"V \\ V \\ V\" (\\(_ \\<^sub>C\\<^sub>F\\\\<^sub>O _)\\ [1000, 1000] 999)\n where \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\ \\ \\<^sub>C\\<^sub>F\\ (cf_const (cat_1 0 0) (\\\\HomCod\\) b)\"\n\ndefinition cf_obj_cf_comma_proj :: \"V \\ V \\ V\" (\\(_ \\<^sub>O\\\\<^sub>C\\<^sub>F _)\\ [1000, 1000] 999)\n where \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\ (cf_const (cat_1 0 0) (\\\\HomCod\\) b) \\\\<^sub>C\\<^sub>F \\\"\n\n\ntext\\Alternative forms of the definitions.\\\n\nlemma (in is_functor) cf_cf_obj_comma_proj_def:\n \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b = \\ \\<^sub>C\\<^sub>F\\ (cf_const (cat_1 0 0) \\ b)\" \n unfolding cf_cf_obj_comma_proj_def cf_HomCod..\n\nlemma (in is_functor) cf_obj_cf_comma_proj_def: \n \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ = (cf_const (cat_1 0 0) \\ b) \\\\<^sub>C\\<^sub>F \\\" \n unfolding cf_obj_cf_comma_proj_def cf_HomCod..\n\n\ntext\\Components.\\\n\nlemma (in is_functor) cf_cf_obj_comma_proj_components[cat_comma_cs_simps]: \n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\HomDom\\ = \\ \\<^sub>C\\<^sub>F\\ b\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\HomCod\\ = \\\"\n unfolding \n cf_cf_obj_comma_proj_def \n cf_comma_proj_left_components \n cat_cf_obj_comma_def[symmetric]\n cat_cs_simps \n by simp_all\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_obj_comma_proj_components\n\nlemma (in is_functor) cf_obj_cf_comma_proj_components[cat_comma_cs_simps]: \n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\HomDom\\ = b \\\\<^sub>C\\<^sub>F \\\"\n and \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\HomCod\\ = \\\"\n unfolding \n cf_obj_cf_comma_proj_def \n cf_comma_proj_right_components \n cat_obj_cf_comma_def[symmetric]\n cat_cs_simps \n by simp_all\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_obj_cf_comma_proj_components\n\n\nsubsubsection\\Object map\\\n\nlemma cf_cf_obj_comma_proj_ObjMap_vsv[cat_comma_cs_intros]: \n \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ObjMap\\)\"\n unfolding cf_cf_obj_comma_proj_def\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma cf_obj_cf_comma_proj_ObjMap_vsv[cat_comma_cs_intros]: \n \"vsv (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\)\"\n unfolding cf_obj_cf_comma_proj_def\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma (in is_functor) cf_cf_obj_comma_proj_ObjMap_vdomain[cat_comma_cs_simps]: \n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n unfolding cf_cf_obj_comma_proj_def cf_comma_proj_left_ObjMap_vdomain\n unfolding \n cf_cf_obj_comma_proj_def[symmetric] \n cf_comma_proj_left_components[symmetric]\n cat_comma_cs_simps\n by simp\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_obj_comma_proj_ObjMap_vdomain\n\nlemma (in is_functor) cf_obj_cf_comma_proj_ObjMap_vdomain[cat_comma_cs_simps]: \n \"\\\\<^sub>\\ (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n unfolding cf_obj_cf_comma_proj_def cf_comma_proj_right_ObjMap_vdomain\n unfolding \n cf_obj_cf_comma_proj_def[symmetric] \n cf_comma_proj_right_components[symmetric]\n cat_comma_cs_simps\n by simp\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_obj_cf_comma_proj_ObjMap_vdomain\n\nlemma (in is_functor) cf_cf_obj_comma_proj_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a, b', f]\\<^sub>\\\" and \"[a, b', f]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ObjMap\\\\A\\ = a\"\n by \n (\n rule cf_comma_proj_left_ObjMap_app[\n OF assms(1) assms(2)[unfolded cat_cf_obj_comma_def], \n folded cf_cf_obj_comma_proj_def\n ]\n )\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_obj_comma_proj_ObjMap_app\n\nlemma (in is_functor) cf_obj_cf_comma_proj_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [b', a, f]\\<^sub>\\\" and \"[b', a, f]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ = a\"\n by \n (\n rule cf_comma_proj_right_ObjMap_app[\n OF assms(1) assms(2)[unfolded cat_obj_cf_comma_def], \n folded cf_obj_cf_comma_proj_def\n ]\n )\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_obj_cf_comma_proj_ObjMap_app\n\n\nsubsubsection\\Arrow map\\\n\nlemma cf_cf_obj_comma_proj_ArrMap_vsv[cat_comma_cs_intros]: \n \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ArrMap\\)\"\n unfolding cf_cf_obj_comma_proj_def\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma cf_obj_cf_comma_proj_ArrMap_vsv[cat_comma_cs_intros]: \n \"vsv (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\)\"\n unfolding cf_obj_cf_comma_proj_def\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma (in is_functor) cf_cf_obj_comma_proj_ArrMap_vdomain[cat_comma_cs_simps]: \n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n unfolding cf_cf_obj_comma_proj_def cf_comma_proj_left_ArrMap_vdomain\n unfolding \n cf_cf_obj_comma_proj_def[symmetric] \n cf_comma_proj_left_components[symmetric]\n cat_comma_cs_simps\n by simp\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_obj_comma_proj_ObjMap_vdomain\n\nlemma (in is_functor) cf_obj_cf_comma_proj_ArrMap_vdomain[cat_comma_cs_simps]:\n \"\\\\<^sub>\\ (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n unfolding cf_obj_cf_comma_proj_def cf_comma_proj_right_ArrMap_vdomain\n unfolding \n cf_obj_cf_comma_proj_def[symmetric] \n cf_comma_proj_right_components[symmetric]\n cat_comma_cs_simps\n by simp\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_obj_cf_comma_proj_ArrMap_vdomain\n\nlemma (in is_functor) cf_cf_obj_comma_proj_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\" \n and \"[A, B, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b\\ArrMap\\\\ABF\\ = g\"\n by \n (\n rule cf_comma_proj_left_ArrMap_app[\n OF assms(1) assms(2)[unfolded cat_cf_obj_comma_def], \n folded cf_cf_obj_comma_proj_def\n ]\n )\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_obj_comma_proj_ArrMap_app\n\nlemma (in is_functor) cf_obj_cf_comma_proj_ArrMap_app[cat_comma_cs_simps]:\n assumes \"ABF = [A, B, [g, h]\\<^sub>\\]\\<^sub>\\\" \n and \"[A, B, [g, h]\\<^sub>\\]\\<^sub>\\ \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\ABF\\ = h\"\n by \n (\n rule cf_comma_proj_right_ArrMap_app[\n OF assms(1) assms(2)[unfolded cat_obj_cf_comma_def], \n folded cf_obj_cf_comma_proj_def\n ]\n )\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_obj_cf_comma_proj_ArrMap_app\n\n\nsubsubsection\\Projections for a comma category are functors\\\n\nlemma (in is_functor) cf_cf_obj_comma_proj_is_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b : \\ \\<^sub>C\\<^sub>F\\ b \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comma_proj_left_is_functor[\n OF is_functor_axioms const,\n folded cf_cf_obj_comma_proj_def cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) cf_cf_obj_comma_proj_is_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"\\' = \\ \\<^sub>C\\<^sub>F\\ b\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1) unfolding assms(2) by (rule cf_cf_obj_comma_proj_is_functor)\n\nlemmas [cat_comma_cs_intros] = is_functor.cf_cf_obj_comma_proj_is_functor'\n\nlemma (in is_functor) cf_obj_cf_comma_proj_is_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\nproof-\n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comma_proj_right_is_functor[\n OF const is_functor_axioms,\n folded cf_obj_cf_comma_proj_def cat_obj_cf_comma_def\n ]\n )\nqed\n\nlemma (in is_functor) cf_obj_cf_comma_proj_is_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"\\' = b \\\\<^sub>C\\<^sub>F \\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n using assms(1) unfolding assms(2) by (rule cf_obj_cf_comma_proj_is_functor)\n\nlemmas [cat_comma_cs_intros] = is_functor.cf_obj_cf_comma_proj_is_functor'\n\n\nsubsubsection\\\nOpposite projections for comma categories constructed from a functor \nand an object\n\\\n\nlemma (in is_functor) op_cf_cf_obj_comma_proj: \n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b) = b \\<^sub>O\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ b\"\nproof-\n from assms have cf_const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by\n (\n rule op_cf_comma_proj_left\n [\n OF is_functor_axioms cf_const,\n unfolded cat_op_simps,\n folded \n cf_cf_obj_comma_proj_def\n op_cf_obj_comma_def\n is_functor.cf_obj_cf_comma_proj_def[\n OF is_functor_op, unfolded cat_op_simps\n ]\n ]\n )\nqed\n\nlemma (in is_functor) op_cf_obj_cf_comma_proj:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"op_cf (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\) = (op_cf \\) \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F op_obj_cf_comma b \\\"\nproof-\n from assms have cf_const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule op_cf_comma_proj_right\n [\n OF cf_const is_functor_axioms,\n unfolded cat_op_simps,\n folded\n cf_obj_cf_comma_proj_def\n op_obj_cf_comma_def\n is_functor.cf_cf_obj_comma_proj_def[\n OF is_functor_op, unfolded cat_op_simps\n ]\n ]\n )\nqed\n\n\nsubsubsection\\Projections for a tiny comma category\\\n\nlemma (in is_tm_functor) cf_cf_obj_comma_proj_is_tm_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b : \\ \\<^sub>C\\<^sub>F\\ b \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: V_cs_intros cat_small_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comma_proj_left_is_tm_functor[\n OF is_tm_functor_axioms const,\n folded cf_cf_obj_comma_proj_def cat_cf_obj_comma_def\n ]\n )\nqed\n\nlemma (in is_tm_functor) cf_cf_obj_comma_proj_is_tm_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"\\b = \\ \\<^sub>C\\<^sub>F\\ b\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b : \\b \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n using assms(1) unfolding assms(2) by (rule cf_cf_obj_comma_proj_is_tm_functor)\n\nlemmas [cat_comma_cs_intros] = is_tm_functor.cf_cf_obj_comma_proj_is_tm_functor'\n\nlemma (in is_tm_functor) cf_obj_cf_comma_proj_is_tm_functor:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n from assms have const: \"cf_const (cat_1 0 0) \\ b : cat_1 0 0 \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: V_cs_intros cat_small_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comma_proj_right_is_tm_functor[\n OF const is_tm_functor_axioms,\n folded cf_obj_cf_comma_proj_def cat_obj_cf_comma_def\n ]\n )\nqed\n\nlemma (in is_tm_functor) cf_obj_cf_comma_proj_is_tm_functor'[cat_comma_cs_intros]:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\" and \"\\' = b \\\\<^sub>C\\<^sub>F \\\"\n shows \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ : \\' \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\n using assms(1) unfolding assms(2) by (rule cf_obj_cf_comma_proj_is_tm_functor)\n\nlemmas [cat_comma_cs_intros] = is_tm_functor.cf_obj_cf_comma_proj_is_tm_functor'\n\nlemma cf_comp_cf_cf_obj_comma_proj_is_tm_functor[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ c\"\n and \"c \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O c \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n from assms(3) have cf_const: \"cf_const (cat_1 0 0) \\ c : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comp_cf_comma_proj_left_is_tm_functor\n [\n OF assms(1) _ assms(2)[unfolded cat_cf_obj_comma_def],\n unfolded cat_cs_simps,\n OF cf_const, \n folded \\.cf_cf_obj_comma_proj_def\n ]\n )\nqed\n\nlemma cf_comp_cf_obj_cf_comma_proj_is_tm_functor[cat_comma_cs_intros]:\n assumes \"\\ : \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\" \n and \"\\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> c \\\\<^sub>C\\<^sub>F \\\"\n and \"c \\\\<^sub>\\ \\\\Obj\\\"\n shows \"c \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F \\ : \\ \\\\\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\\\<^esub> \\\"\nproof-\n interpret \\: is_functor \\ \\ \\ \\ by (rule assms(1))\n from assms(3) have cf_const: \"cf_const (cat_1 0 0) \\ c : cat_1 0 0 \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros)\n show ?thesis\n by \n (\n rule cf_comp_cf_comma_proj_right_is_tm_functor\n [\n OF _ assms(1) assms(2)[unfolded cat_obj_cf_comma_def], \n unfolded cat_cs_simps,\n OF cf_const, \n folded \\.cf_obj_cf_comma_proj_def\n ]\n )\nqed\n\n\n\nsubsection\\Comma functors\\\n\n\nsubsubsection\\Definition and elementary properties\\\n\n\ntext\\See Theorem 1 in Chapter X-3 in \\<^cite>\\\"mac_lane_categories_2010\"\\.\\\n\ndefinition cf_arr_cf_comma :: \"V \\ V \\ V\" \n (\\(_ \\<^sub>A\\\\<^sub>C\\<^sub>F _)\\ [1000, 1000] 999)\n where \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\ =\n [\n (\\A\\\\<^sub>\\(\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\\\Obj\\. [0, A\\1\\<^sub>\\\\, A\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\),\n (\n \\F\\\\<^sub>\\(\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\\\Arr\\.\n [\n [0, F\\0\\\\1\\<^sub>\\\\, F\\0\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\,\n [0, F\\1\\<^sub>\\\\\\1\\<^sub>\\\\, F\\1\\<^sub>\\\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n ),\n (\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\,\n (\\\\HomCod\\\\Dom\\\\g\\) \\\\<^sub>C\\<^sub>F \\\n ]\\<^sub>\\\"\n\ndefinition cf_cf_arr_comma :: \"V \\ V \\ V\" \n (\\(_ \\<^sub>C\\<^sub>F\\\\<^sub>A _)\\ [1000, 1000] 999)\n where \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g =\n [\n (\\A\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\)\\Obj\\. [A\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> A\\2\\<^sub>\\\\]\\<^sub>\\),\n (\n \\F\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\)\\Arr\\.\n [\n [F\\0\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> F\\0\\\\2\\<^sub>\\\\]\\<^sub>\\,\n [F\\1\\<^sub>\\\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> F\\1\\<^sub>\\\\\\2\\<^sub>\\\\]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n ),\n \\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\),\n \\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Cod\\\\g\\)\n ]\\<^sub>\\\"\n\n\ntext\\Components.\\\n\nlemma cf_arr_cf_comma_components:\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\ =\n (\\A\\\\<^sub>\\(\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\\\Obj\\. [0, A\\1\\<^sub>\\\\, A\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\)\"\n and \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\ =\n (\n \\F\\\\<^sub>\\(\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\\\Arr\\.\n [\n [0, F\\0\\\\1\\<^sub>\\\\, F\\0\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\,\n [0, F\\1\\<^sub>\\\\\\1\\<^sub>\\\\, F\\1\\<^sub>\\\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> g]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n )\"\n and \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\HomDom\\ = (\\\\HomCod\\\\Cod\\\\g\\) \\\\<^sub>C\\<^sub>F \\\"\n and \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\HomCod\\ = (\\\\HomCod\\\\Dom\\\\g\\) \\\\<^sub>C\\<^sub>F \\\"\n unfolding cf_arr_cf_comma_def dghm_field_simps \n by (simp_all add: nat_omega_simps)\n\nlemma cf_cf_arr_comma_components:\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\ =\n (\\A\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\)\\Obj\\. [A\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> A\\2\\<^sub>\\\\]\\<^sub>\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\ =\n (\n \\F\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\)\\Arr\\.\n [\n [F\\0\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> F\\0\\\\2\\<^sub>\\\\]\\<^sub>\\,\n [F\\1\\<^sub>\\\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\HomCod\\\\<^esub> F\\1\\<^sub>\\\\\\2\\<^sub>\\\\]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n )\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\HomDom\\ = \\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Dom\\\\g\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\HomCod\\ = \\ \\<^sub>C\\<^sub>F\\ (\\\\HomCod\\\\Cod\\\\g\\)\"\n unfolding cf_cf_arr_comma_def dghm_field_simps \n by (simp_all add: nat_omega_simps)\n\ncontext is_functor\nbegin\n\nlemma cf_arr_cf_comma_components':\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\ = (\\A\\\\<^sub>\\c' \\\\<^sub>C\\<^sub>F \\\\Obj\\. [0, A\\1\\<^sub>\\\\, A\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\)\"\n and \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\ =\n (\n \\F\\\\<^sub>\\c' \\\\<^sub>C\\<^sub>F \\\\Arr\\.\n [\n [0, F\\0\\\\1\\<^sub>\\\\, F\\0\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\,\n [0, F\\1\\<^sub>\\\\\\1\\<^sub>\\\\, F\\1\\<^sub>\\\\\\2\\<^sub>\\\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n )\"\n and [cat_comma_cs_simps]: \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\HomDom\\ = c' \\\\<^sub>C\\<^sub>F \\\"\n and [cat_comma_cs_simps]: \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\HomCod\\ = c \\\\<^sub>C\\<^sub>F \\\"\n using assms\n unfolding cf_arr_cf_comma_components\n by (simp_all add: cat_cs_simps)\n\nlemma cf_cf_arr_comma_components':\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\ = (\\A\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ c\\Obj\\. [A\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\<^esub> A\\2\\<^sub>\\\\]\\<^sub>\\)\"\n and \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\ =\n (\n \\F\\\\<^sub>\\\\ \\<^sub>C\\<^sub>F\\ c\\Arr\\.\n [\n [F\\0\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\<^esub> F\\0\\\\2\\<^sub>\\\\]\\<^sub>\\,\n [F\\1\\<^sub>\\\\\\0\\, 0, g \\\\<^sub>A\\<^bsub>\\\\<^esub> F\\1\\<^sub>\\\\\\2\\<^sub>\\\\]\\<^sub>\\,\n F\\2\\<^sub>\\\\\n ]\\<^sub>\\\n )\"\n and [cat_comma_cs_simps]: \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\HomDom\\ = \\ \\<^sub>C\\<^sub>F\\ c\"\n and [cat_comma_cs_simps]: \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\HomCod\\ = \\ \\<^sub>C\\<^sub>F\\ c'\"\n using assms\n unfolding cf_cf_arr_comma_components\n by (simp_all add: cat_cs_simps)\n\nend\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_arr_cf_comma_components'(3,4)\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_arr_comma_components'(3,4)\n\n\nsubsubsection\\Object map\\\n\nmk_VLambda cf_arr_cf_comma_components(1)[unfolded VLambda_vid_on[symmetric]]\n |vsv cf_arr_cf_comma_ObjMap_vsv[cat_comma_cs_intros]|\n\nmk_VLambda cf_cf_arr_comma_components(1)[unfolded VLambda_vid_on[symmetric]]\n |vsv cf_cf_arr_comma_ObjMap_vsv[cat_comma_cs_intros]|\n\ncontext is_functor\nbegin\n\ncontext \n fixes g c c'\n assumes g: \"g : c \\\\<^bsub>\\\\<^esub> c'\"\nbegin\n\nmk_VLambda \n cf_arr_cf_comma_components'(1)[OF g, unfolded VLambda_vid_on[symmetric]]\n |vdomain cf_arr_cf_comma_ObjMap_vdomain[cat_comma_cs_simps]|\n\nmk_VLambda\n cf_cf_arr_comma_components'(1)[OF g, unfolded VLambda_vid_on[symmetric]]\n |vdomain cf_cf_arr_comma_ObjMap_vdomain[cat_comma_cs_simps]|\n\nend\n\nend\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_arr_cf_comma_ObjMap_vdomain\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_arr_comma_ObjMap_vdomain\n\nlemma (in is_functor) cf_arr_cf_comma_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a', b', f']\\<^sub>\\\" and \"A \\\\<^sub>\\ c' \\\\<^sub>C\\<^sub>F \\\\Obj\\\" and \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ = [a', b', f' \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\\"\nproof-\n from assms have b': \"b' \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f' : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and a'_def: \"a' = 0\"\n by auto\n from assms(2) show ?thesis\n unfolding cf_arr_cf_comma_components'[OF assms(3)] assms(1)\n by (simp add: nat_omega_simps a'_def)\nqed\n\nlemma (in is_functor) cf_cf_arr_comma_ObjMap_app[cat_comma_cs_simps]:\n assumes \"A = [a', b', f']\\<^sub>\\\" and \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c\\Obj\\\" and \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\\\A\\ = [a', b', g \\\\<^sub>A\\<^bsub>\\\\<^esub> f']\\<^sub>\\\"\nproof-\n from assms have b'_def: \"b' = 0\"\n and f: \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> c\"\n and a': \"a' \\\\<^sub>\\ \\\\Obj\\\"\n by auto\n from assms(2) show ?thesis\n unfolding cf_cf_arr_comma_components'[OF assms(3)] assms(1)\n by (simp add: nat_omega_simps b'_def)\nqed\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_arr_cf_comma_ObjMap_app\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_arr_comma_ObjMap_app\n\nlemma (in is_functor) cf_arr_cf_comma_ObjMap_vrange: \n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\\\<^sub>\\ (g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) \\\\<^sub>\\ c \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\nproof\n (\n rule vsv.vsv_vrange_vsubset, \n unfold cf_arr_cf_comma_ObjMap_vdomain[OF assms]\n )\n fix A assume \"A \\\\<^sub>\\ c' \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms is_functor_axioms obtain a f \n where A_def: \"A = [0, a, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\" \n by auto\n from assms a f show \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ \\\\<^sub>\\ c \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps A_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\nqed (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\nlemma (in is_functor) cf_cf_arr_comma_ObjMap_vrange: \n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c'\\Obj\\\"\nproof\n (\n rule vsv.vsv_vrange_vsubset, \n unfold cf_cf_arr_comma_ObjMap_vdomain[OF assms]\n )\n fix A assume \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c\\Obj\\\"\n with assms is_functor_axioms obtain a f \n where A_def: \"A = [a, 0, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\" \n by auto\n from assms a f show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\\\A\\ \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c'\\Obj\\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps A_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\nqed (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n\n\nsubsubsection\\Arrow map\\\n\nmk_VLambda cf_arr_cf_comma_components(2)\n |vsv cf_arr_cf_comma_ArrMap_vsv[cat_comma_cs_intros]|\n\nmk_VLambda cf_cf_arr_comma_components(2)\n |vsv cf_cf_arr_comma_ArrMap_vsv[cat_comma_cs_intros]|\n\ncontext is_functor\nbegin\n\ncontext \n fixes g c c'\n assumes g: \"g : c \\\\<^bsub>\\\\<^esub> c'\"\nbegin\n\nmk_VLambda \n cf_arr_cf_comma_components'(2)[OF g, unfolded VLambda_vid_on[symmetric]]\n |vdomain cf_arr_cf_comma_ArrMap_vdomain[cat_comma_cs_simps]|\n\nmk_VLambda \n cf_cf_arr_comma_components'(2)[OF g, unfolded VLambda_vid_on[symmetric]]\n |vdomain cf_cf_arr_comma_ArrMap_vdomain[cat_comma_cs_simps]|\n\nend\n\nend\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_arr_cf_comma_ArrMap_vdomain\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_arr_comma_ArrMap_vdomain\n\nlemma (in is_functor) cf_arr_cf_comma_ArrMap_app[cat_comma_cs_simps]:\n assumes \"A = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\\"\n and \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\ :\n [a, b, f]\\<^sub>\\ \\\\<^bsub>c' \\\\<^sub>C\\<^sub>F \\\\<^esub> [a', b', f']\\<^sub>\\\" \n and \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\A\\ =\n [[a, b, f \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\, [a', b', f' \\\\<^sub>A\\<^bsub>\\\\<^esub> g]\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(3) have c': \"c' \\\\<^sub>\\ \\\\Obj\\\" by auto\n from \n cat_obj_cf_comma_is_arrD(1,2)[OF assms(2)[unfolded cat_comma_cs_simps] c'] \n is_arrD(1)[OF assms(2)] \n show ?thesis\n unfolding assms(1) cf_arr_cf_comma_components'[OF assms(3)]\n by (simp_all add: nat_omega_simps)\nqed\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_arr_cf_comma_ArrMap_app\n\nlemma (in is_functor) cf_cf_arr_comma_ArrMap_app[cat_comma_cs_simps]:\n assumes \"A = [[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\\"\n and \"[[a, b, f]\\<^sub>\\, [a', b', f']\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\ :\n [a, b, f]\\<^sub>\\ \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> [a', b', f']\\<^sub>\\\" \n and \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\A\\ =\n [[a, b, g \\\\<^sub>A\\<^bsub>\\\\<^esub> f]\\<^sub>\\, [a', b', g \\\\<^sub>A\\<^bsub>\\\\<^esub> f']\\<^sub>\\, [h, k]\\<^sub>\\]\\<^sub>\\\"\nproof-\n from assms(3) have c: \"c \\\\<^sub>\\ \\\\Obj\\\" by auto\n from \n cat_cf_obj_comma_is_arrD(1,2)[OF assms(2)[unfolded cat_comma_cs_simps] c] \n is_arrD(1)[OF assms(2)] \n show ?thesis\n unfolding assms(1) cf_cf_arr_comma_components'[OF assms(3)]\n by (simp_all add: nat_omega_simps)\nqed\n\nlemmas [cat_comma_cs_simps] = is_functor.cf_cf_arr_comma_ArrMap_app\n\n\nsubsubsection\\Comma functors are functors\\\n\nlemma (in is_functor) cf_arr_cf_comma_is_functor:\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\ : c' \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> c \\\\<^sub>C\\<^sub>F \\\"\nproof(rule is_functorI')\n show \"vfsequence (g \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\" unfolding cf_arr_cf_comma_def by simp\n from assms show \"category \\ (c' \\\\<^sub>C\\<^sub>F \\)\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms show \"category \\ (c \\\\<^sub>C\\<^sub>F \\)\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n show \"vcard (g \\<^sub>A\\\\<^sub>C\\<^sub>F \\) = 4\\<^sub>\\\"\n unfolding cf_arr_cf_comma_def by (simp_all add: nat_omega_simps)\n from assms show \"\\\\<^sub>\\ (g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) \\\\<^sub>\\ c \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (intro cf_arr_cf_comma_ObjMap_vrange)\n show \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\ :\n g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ \\\\<^bsub>c \\\\<^sub>C\\<^sub>F \\\\<^esub> g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\B\\\"\n if \"F : A \\\\<^bsub>c' \\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for A B F\n proof-\n from assms that obtain b f b' f' k \n where F_def: \"F = [[0, b, f]\\<^sub>\\, [0, b', f']\\<^sub>\\, [0, k]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [0, b, f]\\<^sub>\\\"\n and B_def: \"B = [0, b', f']\\<^sub>\\\"\n and k: \"k : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and f'_def: \"\\\\ArrMap\\\\k\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n by auto\n from assms that k f f' show ?thesis\n unfolding F_def A_def B_def\n by \n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps f'_def[symmetric]\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n show \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\G \\\\<^sub>A\\<^bsub>c' \\\\<^sub>C\\<^sub>F \\\\<^esub> F\\ =\n g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\G\\ \\\\<^sub>A\\<^bsub>c \\\\<^sub>C\\<^sub>F \\\\<^esub> g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\\"\n if \"G : B \\\\<^bsub>c' \\\\<^sub>C\\<^sub>F \\\\<^esub> C\" and \"F : A \\\\<^bsub>c' \\\\<^sub>C\\<^sub>F \\\\<^esub> B\" for B C G A F\n proof-\n from that(2) assms obtain b f b' f' k \n where F_def: \"F = [[0, b, f]\\<^sub>\\, [0, b', f']\\<^sub>\\, [0, k]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [0, b, f]\\<^sub>\\\"\n and B_def: \"B = [0, b', f']\\<^sub>\\\"\n and k: \"k : b \\\\<^bsub>\\\\<^esub> b'\"\n and f: \"f : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b\\\"\n and f': \"f' : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and f'_def: \"\\\\ArrMap\\\\k\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f = f'\"\n by auto\n with that(1) assms obtain b'' f'' k' \n where G_def: \"G = [[0, b', f']\\<^sub>\\, [0, b'', f'']\\<^sub>\\, [0, k']\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [0, b'', f'']\\<^sub>\\\"\n and k': \"k' : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f'': \"f'' : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and f''_def: \"\\\\ArrMap\\\\k'\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f' = f''\"\n by auto (*slow*)\n from assms that k f f' f'' k' show ?thesis\n unfolding F_def G_def A_def B_def C_def \n by (*slow*)\n (\n cs_concl \n cs_simp:\n cat_cs_simps cat_comma_cs_simps\n f''_def[symmetric] f'_def[symmetric]\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n show \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\c' \\\\<^sub>C\\<^sub>F \\\\CId\\\\C\\\\ = c \\\\<^sub>C\\<^sub>F \\\\CId\\\\g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\C\\\\\"\n if \"C \\\\<^sub>\\ c' \\\\<^sub>C\\<^sub>F \\\\Obj\\\" for C\n proof-\n from that assms obtain a f \n where C_def: \"C = [0, a, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and f: \"f : c' \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a\\\"\n by auto\n from a assms f show\n \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\c' \\\\<^sub>C\\<^sub>F \\\\CId\\\\C\\\\ = c \\\\<^sub>C\\<^sub>F \\\\CId\\\\g \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\C\\\\\"\n unfolding C_def \n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\nqed\n (\n use assms in\n \\\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n \\\n )+\n\nlemma (in is_functor) cf_cf_arr_comma_is_functor:\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g : \\ \\<^sub>C\\<^sub>F\\ c \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ c'\"\nproof(rule is_functorI')\n from assms have c: \"c \\\\<^sub>\\ \\\\Obj\\\" by auto\n show \"vfsequence (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g)\" unfolding cf_cf_arr_comma_def by simp\n from assms show \"category \\ (\\ \\<^sub>C\\<^sub>F\\ c')\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms show \"category \\ (\\ \\<^sub>C\\<^sub>F\\ c)\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n show \"vcard (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g) = 4\\<^sub>\\\"\n unfolding cf_cf_arr_comma_def by (simp_all add: nat_omega_simps)\n from assms show \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\) \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c'\\Obj\\\"\n by (intro cf_cf_arr_comma_ObjMap_vrange)\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\F\\ :\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\\\A\\ \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c'\\<^esub> \\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\\\B\\\"\n if \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> B\" for A B F\n proof-\n from assms that obtain a f a' f' h \n where F_def: \"F = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [h, 0]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, 0, f]\\<^sub>\\\"\n and B_def: \"B = [a', 0, f']\\<^sub>\\\"\n and h: \"h : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> c\"\n and f'_def: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\h\\ = f\"\n by auto\n from assms that h f f' show ?thesis\n unfolding F_def A_def B_def\n by \n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps f'_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\G \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> F\\ =\n \\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\G\\ \\\\<^sub>A\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c'\\<^esub> \\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\F\\\"\n if \"G : B \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> C\" and \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> B\" for B C G A F\n proof-\n from that(2) assms obtain a f a' f' h \n where F_def: \"F = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [h, 0]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, 0, f]\\<^sub>\\\"\n and B_def: \"B = [a', 0, f']\\<^sub>\\\"\n and h: \"h : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> c\"\n and [cat_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\h\\ = f\"\n by auto\n with that(1) assms obtain a'' f'' h' \n where G_def: \"G = [[a', 0, f']\\<^sub>\\, [a'', 0, f'']\\<^sub>\\, [h', 0]\\<^sub>\\]\\<^sub>\\\"\n and C_def: \"C = [a'', 0, f'']\\<^sub>\\\"\n and h': \"h' : a' \\\\<^bsub>\\\\<^esub> a''\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> c\"\n and [cat_cs_simps]: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\h'\\ = f'\"\n by auto (*slow*)\n note [cat_cs_simps] = category.cat_assoc_helper[\n where \\=\\, where h=f'' and g=\\\\\\ArrMap\\\\h'\\\\ and q=f'\n ]\n from assms that c h f f' f'' h' show ?thesis\n unfolding F_def G_def A_def B_def C_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ArrMap\\\\\\ \\<^sub>C\\<^sub>F\\ c\\CId\\\\C\\\\ = \\ \\<^sub>C\\<^sub>F\\ c'\\CId\\\\\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g\\ObjMap\\\\C\\\\\"\n if \"C \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c\\Obj\\\" for C\n proof-\n from that assms obtain a f \n where C_def: \"C = [a, 0, f]\\<^sub>\\\"\n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\"\n by auto\n from a c assms f show ?thesis\n unfolding C_def \n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\nqed\n (\n use assms in\n \\\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros\n \\\n )+\n\nlemma (in is_functor) cf_arr_cf_comma_is_functor'[cat_comma_cs_intros]:\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\" and \"\\' = c' \\\\<^sub>C\\<^sub>F \\\" and \"\\' = c \\\\<^sub>C\\<^sub>F \\\"\n shows \"g \\<^sub>A\\\\<^sub>C\\<^sub>F \\ : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule cf_arr_cf_comma_is_functor(1))\n\nlemmas [cat_comma_cs_intros] = is_functor.cf_arr_cf_comma_is_functor'\n\nlemma (in is_functor) cf_cf_arr_comma_is_functor'[cat_comma_cs_intros]:\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\" and \"\\' = \\ \\<^sub>C\\<^sub>F\\ c\" and \"\\' = \\ \\<^sub>C\\<^sub>F\\ c'\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g : \\' \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\'\"\n using assms(1) unfolding assms(2,3) by (rule cf_cf_arr_comma_is_functor(1))\n\nlemmas [cat_comma_cs_intros] = is_functor.cf_cf_arr_comma_is_functor'\n\nlemma (in is_functor) cf_arr_cf_comma_CId:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\ = cf_id (b \\\\<^sub>C\\<^sub>F \\)\"\nproof(rule cf_eqI)\n from vempty_is_zet assms show \"cf_id (b \\\\<^sub>C\\<^sub>F \\) : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> b \\\\<^sub>C\\<^sub>F \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n from vempty_is_zet assms show \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\ : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> b \\\\<^sub>C\\<^sub>F \\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms have ObjMap_dom_lhs: \n \"\\\\<^sub>\\ ((\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n from assms have ObjMap_dom_rhs: \n \"\\\\<^sub>\\ (cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n show \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\ = cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n fix A assume prems: \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain a' f' \n where A_def: \"A = [0, a', f']\\<^sub>\\\"\n and a': \"a' \\\\<^sub>\\ \\\\Obj\\\" \n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\a'\\\"\n by auto\n from prems assms vempty_is_zet a' f' show \n \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\ = cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\A\\\"\n unfolding A_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros\n )\n qed (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)+\n from assms have ArrMap_dom_lhs: \n \"\\\\<^sub>\\ ((\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n from assms have ArrMap_dom_rhs: \n \"\\\\<^sub>\\ (cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n show \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\ = cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix F assume prems: \"F \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\" by (auto dest: is_arrI)\n from assms F obtain b' f' b'' f'' h\n where F_def: \"F = [[0, b', f']\\<^sub>\\, [0, b'', f'']\\<^sub>\\, [0, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [0, b', f']\\<^sub>\\\"\n and B_def: \"B = [0, b'', f'']\\<^sub>\\\"\n and h: \"h : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and f'': \"f'' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and \"\\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f' = f''\"\n by auto\n from assms prems F h f' f'' show \n \"(\\\\CId\\\\b\\) \\<^sub>A\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\ = cf_id (b \\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\F\\\"\n unfolding F_def A_def B_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps cat_cs_simps cs_intro: cat_cs_intros\n )\n qed (cs_concl cs_shallow cs_intro: cat_comma_cs_intros cat_cs_intros)+\nqed simp_all\n\nlemma (in is_functor) cf_cf_arr_comma_CId:\n assumes \"b \\\\<^sub>\\ \\\\Obj\\\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\) = cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\"\nproof(rule cf_eqI)\n from vempty_is_zet assms show \"cf_id (\\ \\<^sub>C\\<^sub>F\\ b) : \\ \\<^sub>C\\<^sub>F\\ b \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ b\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n from vempty_is_zet assms show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\) : \\ \\<^sub>C\\<^sub>F\\ b \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\ \\<^sub>C\\<^sub>F\\ b\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms have ObjMap_dom_lhs: \n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n from assms have ObjMap_dom_rhs:\n \"\\\\<^sub>\\ (cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ObjMap\\ = cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Obj\\\"\n with assms obtain a' f' \n where A_def: \"A = [a', 0, f']\\<^sub>\\\"\n and a': \"a' \\\\<^sub>\\ \\\\Obj\\\" \n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n by auto\n from prems assms vempty_is_zet a' f' show \n \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ObjMap\\\\A\\ = cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\\ObjMap\\\\A\\\"\n unfolding A_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cs_intro: cat_cs_intros\n )\n qed (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)+\n from assms have ArrMap_dom_lhs: \n \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cs_intro: cat_cs_intros)\n from assms have ArrMap_dom_rhs: \n \"\\\\<^sub>\\ (cf_id (\\ \\\\<^sub>C\\<^sub>F b)\\ArrMap\\) = \\ \\\\<^sub>C\\<^sub>F b\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ArrMap\\ = cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix F assume prems: \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ b\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ b\\<^esub> B\" by (auto dest: is_arrI)\n from assms F obtain a' f' a'' f'' k\n where F_def: \"F = [[a', 0, f']\\<^sub>\\, [a'', 0, f'']\\<^sub>\\, [k, 0]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a', 0, f']\\<^sub>\\\"\n and B_def: \"B = [a'', 0, f'']\\<^sub>\\\"\n and k: \"k : a' \\\\<^bsub>\\\\<^esub> a''\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> b\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> b\"\n and [cat_cs_simps]: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\k\\ = f'\"\n by auto\n from assms prems F k f' f'' show \n \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>A (\\\\CId\\\\b\\)\\ArrMap\\\\F\\ = cf_id (\\ \\<^sub>C\\<^sub>F\\ b)\\ArrMap\\\\F\\\"\n unfolding F_def A_def B_def\n by \n (\n cs_concl cs_shallow\n cs_simp: cat_comma_cs_simps cat_cs_simps cs_intro: cat_cs_intros\n )\n qed\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cs_intro: cat_comma_cs_intros cat_cs_intros\n )+\nqed simp_all\n\n\nsubsubsection\\Comma functors and projections\\\n\nlemma (in is_functor) \n cf_cf_comp_cf_obj_cf_comma_proj_cf_arr_cf_comma[cat_comma_cs_simps]: \n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\ = b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\"\nproof(rule cf_eqI)\n from assms vempty_is_zet show \"b \\<^sub>O\\\\<^sub>C\\<^sub>F \\ : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms show \"a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\ : b \\\\<^sub>C\\<^sub>F \\ \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms have ObjMap_dom_lhs:\n \"\\\\<^sub>\\ ((a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by \n ( \n cs_concl \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms have ObjMap_dom_rhs: \"\\\\<^sub>\\ (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n show \"(a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ObjMap\\ = b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n from assms show \"vsv (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\)\"\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n fix A assume prems: \"A \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n with assms obtain b' f' \n where A_def: \"A = [0, b', f']\\<^sub>\\\"\n and b': \"b' \\\\<^sub>\\ \\\\Obj\\\" \n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n by auto\n from prems assms b' f' show \n \"(a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ObjMap\\\\A\\ = b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\\\A\\\"\n unfolding A_def\n by \n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n (\n use assms vempty_is_zet in\n \\cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros\\\n )\n from assms have ArrMap_dom_lhs:\n \"\\\\<^sub>\\ ((a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms vempty_is_zet have ArrMap_dom_rhs:\n \"\\\\<^sub>\\ (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ObjMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n from assms vempty_is_zet have ArrMap_dom_lhs:\n \"\\\\<^sub>\\ ((a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms have ArrMap_dom_rhs: \"\\\\<^sub>\\ (b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\) = b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n show \"(a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ArrMap\\ = b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix F assume \"F \\\\<^sub>\\ b \\\\<^sub>C\\<^sub>F \\\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>b \\\\<^sub>C\\<^sub>F \\\\<^esub> B\"\n by (auto dest: is_arrI)\n with assms obtain b' f' b'' f'' h\n where F_def: \"F = [[0, b', f']\\<^sub>\\, [0, b'', f'']\\<^sub>\\, [0, h]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [0, b', f']\\<^sub>\\\"\n and B_def: \"B = [0, b'', f'']\\<^sub>\\\"\n and h: \"h : b' \\\\<^bsub>\\\\<^esub> b''\"\n and f': \"f' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b'\\\"\n and f'': \"f'' : b \\\\<^bsub>\\\\<^esub> \\\\ObjMap\\\\b''\\\"\n and f''_def: \"\\\\ArrMap\\\\h\\ \\\\<^sub>A\\<^bsub>\\\\<^esub> f' = f''\"\n by auto\n from vempty_is_zet h assms f' f'' F show\n \"(a \\<^sub>O\\\\<^sub>C\\<^sub>F \\ \\\\<^sub>C\\<^sub>F f \\<^sub>A\\\\<^sub>C\\<^sub>F \\)\\ArrMap\\\\F\\ = b \\<^sub>O\\\\<^sub>C\\<^sub>F \\\\ArrMap\\\\F\\\"\n unfolding F_def A_def B_def \n by (*slow*)\n (\n cs_concl \n cs_simp: cat_cs_simps cat_comma_cs_simps f''_def[symmetric]\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n qed\n (\n use assms vempty_is_zet in\n \\cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros\\\n )\nqed simp_all\n\nlemma (in is_functor) \n cf_cf_comp_cf_cf_obj_comma_proj_cf_cf_arr_comma[cat_comma_cs_simps]: \n assumes \"f : a \\\\<^bsub>\\\\<^esub> b\"\n shows \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f = \\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\"\nproof(rule cf_eqI)\n from assms vempty_is_zet show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O a : \\ \\<^sub>C\\<^sub>F\\ a \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms show \"\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f : \\ \\<^sub>C\\<^sub>F\\ a \\\\\\<^sub>C\\<^bsub>\\\\<^esub> \\\"\n by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n from assms have ObjMap_dom_lhs:\n \"\\\\<^sub>\\ ((\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ a\\Obj\\\"\n by \n ( \n cs_concl cs_shallow \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms have ObjMap_dom_rhs: \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ObjMap\\) = \\ \\<^sub>C\\<^sub>F\\ a\\Obj\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n show \"(\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ObjMap\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n from assms show \"vsv (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ObjMap\\)\"\n by (cs_concl cs_shallow cs_intro: cat_comma_cs_intros)\n fix A assume prems: \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ a\\Obj\\\"\n with assms obtain a' f' \n where A_def: \"A = [a', 0, f']\\<^sub>\\\"\n and b': \"a' \\\\<^sub>\\ \\\\Obj\\\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> a\"\n by auto\n from prems assms b' f' show\n \"(\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ObjMap\\\\A\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ObjMap\\\\A\\\"\n unfolding A_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps \n cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n qed\n (\n use assms vempty_is_zet in\n \\cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros\\\n )\n from assms vempty_is_zet have ArrMap_dom_lhs:\n \"\\\\<^sub>\\ ((\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\ a\\Arr\\\"\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms have ArrMap_dom_rhs: \"\\\\<^sub>\\ (\\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ArrMap\\) = \\ \\<^sub>C\\<^sub>F\\ a\\Arr\\\"\n by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps)\n show \"(\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ArrMap\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n fix F assume \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ a\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ a\\<^esub> B\" by (auto dest: is_arrI)\n with assms obtain a' f' a'' f'' k\n where F_def: \"F = [[a', 0, f']\\<^sub>\\, [a'', 0, f'']\\<^sub>\\, [k, 0]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a', 0, f']\\<^sub>\\\"\n and B_def: \"B = [a'', 0, f'']\\<^sub>\\\"\n and k: \"k : a' \\\\<^bsub>\\\\<^esub> a''\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> a\"\n and f'': \"f'' : \\\\ObjMap\\\\a''\\ \\\\<^bsub>\\\\<^esub> a\"\n and f'_def: \"f'' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\k\\ = f'\"\n by auto\n from vempty_is_zet k assms f' f'' F show\n \"(\\ \\<^sub>C\\<^sub>F\\\\<^sub>O b \\\\<^sub>C\\<^sub>F \\ \\<^sub>C\\<^sub>F\\\\<^sub>A f)\\ArrMap\\\\F\\ = \\ \\<^sub>C\\<^sub>F\\\\<^sub>O a\\ArrMap\\\\F\\\"\n unfolding F_def A_def B_def \n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps f'_def\n cs_intro: cat_cs_intros cat_comma_cs_intros\n )+\n qed\n (\n use assms vempty_is_zet in\n \\cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros\\\n )\nqed simp_all\n\n\nsubsubsection\\Opposite comma functors\\\n\nlemma (in is_functor) cf_op_cf_obj_comma_cf_arr_cf_comma:\n assumes \"g : c \\\\<^bsub>\\\\<^esub> c'\"\n shows \n \"op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g) =\n g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c\"\nproof(rule cf_eqI)\n from assms interpret \\c: category \\ \\\\ \\<^sub>C\\<^sub>F\\ c\\\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_comma_cs_intros\n )\n from assms have c: \"c \\\\<^sub>\\ \\\\Obj\\\" by auto\n from assms show \"op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g) :\n op_cat (\\ \\<^sub>C\\<^sub>F\\ c) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> c' \\\\<^sub>C\\<^sub>F (op_cf \\)\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n then have ObjMap_dom_lhs:\n \"\\\\<^sub>\\ ((op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ObjMap\\) =\n (op_cat (\\ \\<^sub>C\\<^sub>F\\ c))\\Obj\\\"\n and ArrMap_dom_lhs:\n \"\\\\<^sub>\\ ((op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ArrMap\\) =\n (op_cat (\\ \\<^sub>C\\<^sub>F\\ c))\\Arr\\\"\n by (cs_concl cs_simp: cat_cs_simps)+\n from assms show \n \"g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c :\n op_cat (\\ \\<^sub>C\\<^sub>F\\ c) \\\\\\<^sub>C\\<^bsub>\\\\<^esub> c' \\\\<^sub>C\\<^sub>F (op_cf \\)\"\n by\n (\n cs_concl \n cs_simp: cat_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n then have ObjMap_dom_rhs:\n \"\\\\<^sub>\\ ((g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ObjMap\\) =\n (op_cat (\\ \\<^sub>C\\<^sub>F\\ c))\\Obj\\\"\n and ArrMap_dom_rhs:\n \"\\\\<^sub>\\ ((g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ArrMap\\) =\n (op_cat (\\ \\<^sub>C\\<^sub>F\\ c))\\Arr\\\"\n by (cs_concl cs_simp: cat_cs_simps)+\n show\n \"(op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ObjMap\\ =\n (g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ObjMap\\\"\n proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs cat_op_simps)\n fix A assume \"A \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c\\Obj\\\"\n with assms obtain a f\n where A_def: \"A = [a, 0, f]\\<^sub>\\\" \n and a: \"a \\\\<^sub>\\ \\\\Obj\\\" \n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\"\n by auto\n from assms a f show \n \"(op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ObjMap\\\\A\\ =\n (g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ObjMap\\\\A\\\"\n unfolding A_def \n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed \n (\n use assms in \n \\cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\\\n )+\n show \n \"(op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ArrMap\\ =\n (g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ArrMap\\\"\n proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs cat_op_simps)\n fix F assume \"F \\\\<^sub>\\ \\ \\<^sub>C\\<^sub>F\\ c\\Arr\\\"\n then obtain A B where F: \"F : A \\\\<^bsub>\\ \\<^sub>C\\<^sub>F\\ c\\<^esub> B\" by auto\n with assms c obtain a f a' f' h\n where F_def: \"F = [[a, 0, f]\\<^sub>\\, [a', 0, f']\\<^sub>\\, [h, 0]\\<^sub>\\]\\<^sub>\\\"\n and A_def: \"A = [a, 0, f]\\<^sub>\\\"\n and B_def: \"B = [a', 0, f']\\<^sub>\\\"\n and h: \"h : a \\\\<^bsub>\\\\<^esub> a'\"\n and f: \"f : \\\\ObjMap\\\\a\\ \\\\<^bsub>\\\\<^esub> c\"\n and f': \"f' : \\\\ObjMap\\\\a'\\ \\\\<^bsub>\\\\<^esub> c\"\n and [cat_comma_cs_simps]: \"f' \\\\<^sub>A\\<^bsub>\\\\<^esub> \\\\ArrMap\\\\h\\ = f\"\n by auto\n from F assms h f f' c show \n \"(op_cf_obj_comma \\ c' \\\\<^sub>C\\<^sub>F op_cf (\\ \\<^sub>C\\<^sub>F\\\\<^sub>A g))\\ArrMap\\\\F\\ =\n (g \\<^sub>A\\\\<^sub>C\\<^sub>F (op_cf \\) \\\\<^sub>C\\<^sub>F op_cf_obj_comma \\ c)\\ArrMap\\\\F\\\"\n unfolding F_def A_def B_def\n by\n (\n cs_concl cs_shallow\n cs_simp: cat_cs_simps cat_comma_cs_simps cat_op_simps\n cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\n )\n qed\n (\n use assms in\n \\cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros cat_op_intros\\\n )+\nqed simp_all\n\ntext\\\\newpage\\\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Elementary_Categories/czh_ecategories/CZH_ECAT_Comma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.2697544222155151}} {"text": "(*\n * Copyright 2021, Proofcraft Pty Ltd\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Architecture-independent lemmas constraining Kernel_Config definitions *)\n\ntheory Kernel_Config_Lemmas\nimports \"$L4V_ARCH/Kernel_Config\"\nbegin\n\ntext \\\n seL4's build system allows configuration of some architecture-independent constants, such as the\n number of domains.\n\n The long-term goal is to make the proofs resilient in the face of changes of these configuration\n options. To this end this theory contains properties of these constants, to avoid unfolding\n their values later in the proofs.\\\n\nlemma numDomains_not_zero:\n \"numDomains > 0\"\n unfolding Kernel_Config.numDomains_def\n by simp\n\nlemma numDomains_machine_word_safe:\n \"unat (of_nat numDomains :: machine_word) = numDomains\"\n unfolding Kernel_Config.numDomains_def by simp\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/machine/Kernel_Config_Lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.2697529159993311}} {"text": "theory flash88Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n have allCases:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s \\formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s \" \n\t by auto \n\n moreover\n {assume b1:\"formEval (neg ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) ) s\"\nhave \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Dirty'') ) ( Const true )) s\"\n\n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_InvAck_1VsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_InvAck_2VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_GetXVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak2VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_Nak3VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_GetX_PutX1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 a5 a6 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak2VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Nak3VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Local_Get_Put2VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_Nak_ClearVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_HomeVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3 a4 a5 a6,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv88: \n (*Rule2VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iInv2 \\ N\" and a5:\"iInv1~=iInv2 \" and a6:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\iRule2=iInv2) \\(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\(iRule1=iInv2\\iRule2=iInv1) \\(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 a5 a6 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\iRule2=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 )\\(iRule2~=iInv1 \\iRule2~=iInv2 ))\"\n\n have \"?P1 s \\ ?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 a5 a6 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n have allCases:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s \\formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s \" \n\t by auto \n\n moreover\n {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n\n moreover\n {assume c1:\"formEval (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) ) ( Const true )) ) s\"\n\n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 c1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n }\n ultimately have \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) ) ( Const UNI_PutX )) ) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_GetX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ReplaceHomeVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeShrVldVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceShrVldVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma NI_ShWbVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_WbVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_GetX1VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') ) (Const iInv1)) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv2) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''CacheState'' Home) ) ( Const CACHE_S )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX2VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX3VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_GetX_PutX4VsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_Get_GetVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n fix s \n \n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_PutXVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Local_ReplaceVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_GetXVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma PI_Remote_PutXVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\(iRule1=iInv2) \\((iRule1~=iInv1 \\iRule1~=iInv2 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"(iRule1=iInv2)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 \\iRule1~=iInv2 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_ReplaceVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreVsInv88: \n (*Rule1VsPInv2*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" and a3:\"iInv2 \\ N\" and a4:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 a3 a4 , auto)\n lemma StoreHomeVsInv88: \n (*Rule0VsPInv2*)\n assumes a1:\"iInv1 \\ N\" and a2:\"iInv2 \\ N\" and a3:\"iInv1~=iInv2 \" \n\n shows \"invHoldForRule' s (inv88 iInv1 iInv2 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3, auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash88Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.26975291599933104}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory BufferT\nimports\n \"BilbyFsConsts.BilbyFs_Shallow_Desugar_Tuples\"\n \"BilbyFsConsts.BilbyFs_ShallowConsts_Desugar_Tuples\"\n \"../adt/WordArrayT\"\nbegin\n\n\ndefinition\n buf_slice :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 list\"\nwhere\n \"buf_slice buf frm to \\ slice (unat frm) (unat to) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_sub_slice :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 list \\ U8 list\"\nwhere\n \"buf_sub_slice buf frm to xs \\\n take (length (\\wa $ data\\<^sub>f buf)) (take (unat frm) (\\wa $ data\\<^sub>f buf) @ \n (take (unat to - unat frm) (xs@replicate (unat to - unat frm) 0)) @\n drop (max (unat to) (unat frm)) (\\wa $ data\\<^sub>f buf))\"\n \n\nlemma buf_sub_slice_length:\n \"length (buf_sub_slice buf frm to xs) = length (\\wa (data\\<^sub>f buf))\"\n apply (simp add: buf_sub_slice_def)\n apply(subst min_def)+\nusing [[linarith_split_limit=20]]\napply clarsimp (* take a while *)\napply safe\napply unat_arith+\ndone\n\ndefinition\n buf_drop :: \"Buffer\\<^sub>T \\ U32 \\ U8 list\"\nwhere\n \"buf_drop buf offs \\ drop (unat offs) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_take :: \"Buffer\\<^sub>T \\ U32 \\ U8 list\"\nwhere\n \"buf_take buf offs \\ take (unat offs) (\\wa $ data\\<^sub>f buf)\"\n\ndefinition\n buf_update_bounded :: \"Buffer\\<^sub>T \\ U8 list \\ U8 list\"\nwhere\n \"buf_update_bounded buf buf_updated \\\n take (min (unat $ bound\\<^sub>f buf) (length $ \\wa $ data\\<^sub>f buf)) buf_updated @\n drop (min (unat $ bound\\<^sub>f buf) (length buf_updated)) (\\wa $ data\\<^sub>f buf) \"\n\ndefinition\n buf_memset' :: \"Buffer\\<^sub>T \\ U32 \\ U32 \\ U8 \\ U8 list\"\nwhere\n \"buf_memset' buf offs len v \\\n buf_update_bounded buf $ buf_take buf offs @ replicate (min (unat len) (unat (bound\\<^sub>f buf) - unat offs)) v @ buf_drop buf (offs+len)\"\n\n\nlemma buf_update_bounded_length:\n \"length (buf_update_bounded buf upd) = length (\\wa $ data\\<^sub>f buf)\"\n by (simp add: buf_bound_def buf_update_bounded_def buf_length_def)\n\nlemmas buf_simps = buf_take_def buf_drop_def buf_slice_def \n buf_bound_def buf_update_bounded_def buf_length_def\n buf_memset'_def buf_update_bounded_length\n slice_def\n\nlemma drop_take_drop:\n \"n \\ m \\ drop n (take m xs) @ drop m xs = drop n xs\"\n by (metis add.commute atd_lem drop_drop drop_take le_add_diff_inverse)\n\nlemma buf_memset_bound_assm_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n unat offs \\ unat (bound\\<^sub>f buf) \\\n offs + len \\ bound\\<^sub>f buf \\\n wordarray_set (data\\<^sub>f buf, offs, len, v) = WordArrayT.make (buf_memset' buf offs len v)\"\n unfolding buf_memset_def[unfolded tuple_simps sanitizers]\n apply (simp add: Let_def wordarray_set_ret buf_simps min_absorb1)\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (subgoal_tac \"(unat (bound\\<^sub>f buf) - unat offs) \\ (unat len)\")\n prefer 2\n apply unat_arith\n apply (simp add: min_absorb1 )\n apply (subgoal_tac \"(unat (bound\\<^sub>f buf)) \\\n (unat offs + (unat len + (length (\\wa (data\\<^sub>f buf)) - unat (offs + len))))\")\n prefer 2\n apply (unat_arith)\n apply (simp add: min_absorb1 take_drop)\n apply (subgoal_tac \" (unat offs + unat len) = unat (offs + len)\")\n apply (simp add: drop_take_drop)\n apply unat_arith\n done\n\nlemma take_prefix_length:\n \"take n xs = take n ys \\\n n \\ length xs \\ n \\ length ys\"\nby (metis length_take min.absorb_iff2)\n\nlemma buf_bounded_update_bounded_prefix:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n take (unat (bound\\<^sub>f buf)) xs = take (unat (bound\\<^sub>f buf)) ys \\\n buf_update_bounded buf xs = buf_update_bounded buf ys\"\n apply (simp add: buf_simps)\n apply (case_tac \"(unat (bound\\<^sub>f buf)) \\ (length xs)\")\n apply (frule (1) take_prefix_length)\n apply (simp add: min_absorb1)\n apply simp\ndone\n\nlemma buf_memset_bound:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n offs < bound\\<^sub>f buf \\\n \\ offs + len < bound\\<^sub>f buf \\\n buf_memset' buf offs (bound\\<^sub>f buf - offs) v = buf_memset' buf offs len v\"\n apply (simp add: buf_memset'_def)\n apply (subgoal_tac \"unat (bound\\<^sub>f buf - offs) = unat (bound\\<^sub>f buf) - unat offs\")\n apply (simp add: min_absorb2)\n apply (subgoal_tac \"(unat len) \\ (unat (bound\\<^sub>f buf) - unat offs)\")\n apply simp\n apply (rule buf_bounded_update_bounded_prefix)\n apply ((simp add: buf_simps)+)[2]\n apply unat_arith\n apply unat_arith\n done\n\nlemma take_n_m_double_append:\n \"n \\ m \\ n \\ length xs \\\n take n (take m xs @ ys ) = take n xs\"\n by simp\n\nlemma buf_memset_offs_bound:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n \\ offs < bound\\<^sub>f buf \\\n buf_memset' buf (bound\\<^sub>f buf) len' v =\n buf_memset' buf offs len v\"\n apply (simp add: buf_memset'_def)\n apply (rule buf_bounded_update_bounded_prefix)\n apply simp\n apply (simp only: buf_take_def )\n apply (subst take_n_m_double_append)\n apply simp\n apply unat_arith\n apply unat_arith\n apply simp\n done\n\n\nlemma buf_memset_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\n buf_memset (buf, offs, len, v) = buf\\data\\<^sub>f:=WordArrayT.make (buf_memset' buf offs len v)\\\"\n unfolding buf_memset_def[unfolded tuple_simps sanitizers]\n apply (simp only: Let_def prod.case_eq_if prod.sel take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n apply (subst buf_memset_bound_assm_eq)\n apply simp\n apply ((case_tac \" offs < bound\\<^sub>f buf\", ((simp, unat_arith)+)[2])+)[3]\n apply (rule arg_cong[where f=\"\\v. data\\<^sub>f_update v buf\"])\n apply (rule ext)\n apply (rule arg_cong[where f=WordArrayT.make])\n apply (case_tac \"offs < bound\\<^sub>f buf\")\n apply (simp add: buf_memset_bound)\n apply (simp add: buf_memset_offs_bound)\n done\n\nlemma buf_memset_length_eq:\n \"unat (bound\\<^sub>f buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\\nbuf_length (buf_memset (buf, offs, len, v)) = buf_length buf\"\n by (simp add: buf_length_def wordarray_length_ofnat[OF wordarray_length_ret] \n buf_memset_eq wordarray_make buf_update_bounded_length buf_memset'_def)\n\nlemma buf_take_buf_slice_adjacent:\n \"st \\ end \\ buf_take b st @ buf_slice b st end = buf_take b end\"\nby (simp add: buf_simps word_le_nat_alt) \n (metis (no_types, lifting) append_take_drop_id min_def take_take)\n\nlemma length_buf_memset:\n \"unat (bound\\<^sub>f wbuf) \\ length (\\wa (data\\<^sub>f wbuf)) \\\n n < n + m \\\nlength (\\wa (data\\<^sub>f (buf_memset (wbuf, n, m, v)))) = length (\\wa (data\\<^sub>f wbuf))\"\n by (simp add: buf_memset_eq buf_memset'_def wordarray_make buf_update_bounded_length)\n\nlemma buf_slice_n_n:\n \"buf_slice buf n n = []\"\n by (simp add: buf_simps)\n\nlemma buf_slice_0_eq_buf_take:\n \"buf_slice buf 0 n = buf_take buf n\"\n by (simp add: buf_simps)\n\n\nlemma buf_slice_out_of_buf_memset:\n \"frm \\ to \\ to \\ st \\ st \\ st + len \\ st \\ bound\\<^sub>f b \\ unat (bound\\<^sub>f b) = length (\\wa (data\\<^sub>f b)) \\\n buf_slice (buf_memset (b, st, len, v)) frm to = buf_slice b frm to\"\n apply (subst buf_memset_eq)\n apply simp+\n apply (simp add: buf_simps wordarray_make min_absorb1 min_absorb2)\n apply (simp only: unat_arith_simps)\n apply (simp add: min_absorb1 min_absorb2)\n done\n\nlemma buf_update_boundedI:\n \"unat (buf_bound wbuf) \\ length (\\wa (data\\<^sub>f wbuf)) \\\n length xs = length (\\wa (data\\<^sub>f wbuf)) \\\n drop (unat (bound\\<^sub>f wbuf)) (\\wa (data\\<^sub>f wbuf)) = drop (unat (bound\\<^sub>f wbuf)) xs \\\n P xs \\\n P (buf_update_bounded wbuf xs)\"\nby (simp add: buf_bound_def buf_update_bounded_def min_absorb1)\n\nlemma take_n_buf_sub_slice_n:\n \"unat n \\ length (\\wa (data\\<^sub>f b)) \\ take (unat n) (buf_sub_slice b n t xs) = take (unat n) (\\wa (data\\<^sub>f b))\"\n by (simp add: buf_sub_slice_def min_absorb1)\n\n lemma take_n_buf_sub_slice_m:\n \"unat m \\ length (\\wa (data\\<^sub>f b)) \\ n \\ m \\ take (unat n) (buf_sub_slice b m t xs) = take (unat n) (\\wa (data\\<^sub>f b))\"\n by (simp add: buf_sub_slice_def min_absorb1 word_le_nat_alt) \n \n\nlemma slice_buf_sub_slice:\n \"frm \\ mid \\ mid \\ to \\ unat to \\ length (\\wa (data\\<^sub>f b)) \\\n unat (to - mid) = length xs \\\n slice (unat frm) (unat to) (buf_sub_slice b mid to xs) = buf_slice b frm mid @ take (unat to - unat mid) xs\"\n apply (simp add: buf_simps buf_sub_slice_def min_absorb1 min_absorb2)\n apply (subgoal_tac \"unat mid \\ length (\\wa (data\\<^sub>f b))\")\n apply (subgoal_tac \"unat frm \\ length (\\wa (data\\<^sub>f b))\")\n apply (subgoal_tac \"unat frm \\ unat mid\")\n apply (simp add: buf_simps buf_sub_slice_def min_absorb1 min_absorb2 word_le_nat_alt)\n apply unat_arith+\n done\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/adt/BufferT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.26973506101518113}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory fncall\nimports \"../CTranslation\"\nbegin\n\ndeclare sep_conj_ac [simp add]\n\nprimrec\n fac :: \"nat \\ nat\"\nwhere\n \"fac 0 = 1\"\n| \"fac (Suc n) = (Suc n) * fac n\"\n\nML {*\n\nval ast = IsarInstall.get_Csyntax @{theory} \"fncall.c\"\n\n*}\n\ninstall_C_file \"fncall.c\"\n\ncontext fncall\nbegin\n\n\nthm \"\\_def\"\nthm has_bogus_spec_'proc_def\nthm has_bogus_spec_impl\nthm f_impl\nthm g_impl\nthm h_impl\nthm i_impl\nthm calls_bogus_impl\nthm f_body_def\nthm g_body_def\nthm fact_body_def\n\nthm fact_'proc_def\n\nthm has_bogus_spec_modifies\nthm g_modifies\nthm f_modifies\nthm fact_modifies\n\nterm \"f_body\"\nterm \"\\\"\nterm \"fact_body\"\nterm \"f_'proc\"\n\nend\n\nprint_locale fncall_global_addresses\n\nprint_locale g_modifies\nthm g_modifies_def\n\nprint_locale f_spec\nthm f_spec_def\n\nlemma (in g_modifies)\n shows \"\\ \\ \\ \\t_hrs = t \\ \\ret__int :== PROC g() \\ \\t_hrs = t \\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in fncall_global_addresses) f_impl_result:\n \"\\ f_'proc = Some f_body\"\n apply (rule f_impl)\n done\n\nlemma (in fncall_global_addresses) g_spec:\n shows\n \"\\ \\ \\ True \\ \\ret__int :== PROC g() \\ \\ret__int = 257 \\\"\n apply vcg\n done\n\nlemma (in fncall_global_addresses) foo:\n shows\n \"\\ \\ \\ True \\ \\ret__int :== PROC f(n) \\ \\ret__int = 1 \\\"\napply vcg\napply (simp )\ndone\n\nlemma (in f_spec) foo :\nshows\n \"\\ \\ \\ True \\ \\ret__int :== CALL f(\\n) \\ \\ret__int = 1 \\\"\n\napply vcg\ndone\n\nlemma (in fncall_global_addresses) bar:\nshows \"\\ \\ \\ 1\\ \\n & \\n \\ 12 \\ \\ret__int :== CALL fact(\\n) \\ \\ret__int = of_nat (fac (unat \\n)) \\\"\napply vcg\napply unat_arith\noops\n\nlemma (in fncall_global_addresses) baz:\nshows \"\\ \\\\<^bsub>/UNIV\\<^esub> \\ \\t_hrs = t \\ \\ret__int :== PROC i() \\ \\t_hrs = t \\\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\nlocale ih = i_modifies + h_modifies\nlemma (in ih) qux:\nshows \"\\t. \\ \\ \\\\t_hrs = t\\ \\ret__int :== CALL i() \\ t = \\t_hrs \\\"\napply vcg\noops\n\nlocale ff = f_spec + f_modifies\n(* this lemma is bogus, because f does actually modify the globals *)\nlemma (in ff) bogus1:\nshows \"\\t. \\ \\ \\ \\t_hrs = t \\ \\ret__int :== CALL f(\\n) \\ t = \\t_hrs \\\"\napply vcg\napply simp\ndone\n\nlemma (in has_bogus_spec_spec) bogus2:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL has_bogus_spec() \\ \\ret__int = 4 \\\"\napply vcg\ndone\n\nlemma (in fncall_global_addresses) toldyou:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL has_bogus_spec() \\ \\ret__int = 3 \\\"\napply vcg\ndone\n\nlemma (in has_bogus_spec_spec) bogus3:\nshows \"\\ \\ \\ \\n = 42 \\ \\ret__int :== CALL calls_bogus() \\ \\ret__int = 4 \\\"\napply vcg\ndone\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/testfiles/fncall.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2696394000253643}} {"text": "theory Typeclass_Hierarchy\nimports Setup\nbegin\n\nsection \\Introduction\\\n\ntext \\\n The {Isabelle/HOL} type-class hierarchy entered the stage\n in a quite ancient era -- first related \\<^emph>\\NEWS\\ entries date\n back to release {Isabelle99-1}. Since then, there have been\n ongoing modifications and additions, leading to ({Isabelle2016})\n more than 180 type-classes. This sheer complexity makes access\n and understanding of that type-class hierarchy difficult and\n involved, let alone maintenance.\n\n The purpose of this primer is to shed some light on this,\n not only on the mere ingredients, but also on the design\n principles which have evolved and proven useful over time.\n\\\n\nsection \\Foundations\\\n\nsubsection \\Locales and type classes\\\n\ntext \\\n Some familiarity with the Isabelle module system is assumed:\n defining locales and type-classes, interpreting locales and\n instantiating type-classes, adding relationships between\n locales (@{command sublocale}) and type-classes\n (@{command subclass}). Handy introductions are the\n respective tutorials @{cite \"isabelle-locale\"}\n @{cite \"isabelle-classes\"}.\n\\\n\nsubsection \\Strengths and restrictions of type classes\\\n\ntext \\\n The primary motivation for using type classes in {Isabelle/HOL}\n always have been numerical types, which form an inclusion chain:\n \n \\begin{center}\n \\<^typ>\\nat\\ \\\\\\ \\<^typ>\\int\\ \\\\\\ \\<^typ>\\rat\\\n \\\\\\ \\<^typ>\\real\\ \\\\\\ \\<^typ>\\complex\\\n \\end{center}\n\n \\noindent The inclusion \\\\\\ means that any value of the numerical\n type to the left hand side mathematically can be transferred\n to the numerical type on the right hand side.\n\n How to accomplish this given the quite restrictive type system\n of {Isabelle/HOL}? Paulson @{cite \"paulson-numerical\"} explains\n that each numerical type has some characteristic properties\n which define an characteristic algebraic structure; \\\\\\\n then corresponds to specialization of the corresponding\n characteristic algebraic structures. These algebraic structures\n are expressed using algebraic type classes and embeddings\n of numerical types into them:\n\n \\begin{center}\\begin{tabular}{lccc}\n \\<^term>\\of_nat\\ \\::\\ & \\<^typ>\\nat\\ & \\\\\\ & @{typ [source] \"'a::semiring_1\"} \\\\\n & \\\\\\ & & \\\\\\ \\\\\n \\<^term>\\of_int\\ \\::\\ & \\<^typ>\\int\\ & \\\\\\ & @{typ [source] \"'a::ring_1\"} \\\\\n & \\\\\\ & & \\\\\\ \\\\\n \\<^term>\\of_rat\\ \\::\\ & \\<^typ>\\rat\\ & \\\\\\ & @{typ [source] \"'a::field_char_0\"} \\\\\n & \\\\\\ & & \\\\\\ \\\\\n \\<^term>\\of_real\\ \\::\\ & \\<^typ>\\real\\ & \\\\\\ & @{typ [source] \"'a::real_algebra_1\"} \\\\\n & \\\\\\ \\\\\n & \\<^typ>\\complex\\\n \\end{tabular}\\end{center}\n\n \\noindent \\d \\ c\\ means that \\c\\ is subclass of \\d\\.\n Hence each characteristic embedding \\of_num\\ can transform\n any value of type \\num\\ to any numerical type further\n up in the inclusion chain.\n\n This canonical example exhibits key strengths of type classes:\n\n \\<^item> Sharing of operations and facts among different\n types, hence also sharing of notation and names: there\n is only one plus operation using infix syntax \\+\\,\n only one zero written \\0\\, and neutrality\n (@{thm (frugal_sorts) add_0_left [all, no_vars]} and\n @{thm (frugal_sorts) add_0_right [all, no_vars]})\n is referred to\n uniformly by names @{fact add_0_left} and @{fact add_0_right}.\n\n \\<^item> Proof tool setups are shared implicitly:\n @{fact add_0} and @{fact add_0_right} are simplification\n rules by default.\n\n \\<^item> Hence existing proofs about particular numerical\n types are often easy to generalize to algebraic structures,\n given that they do not depend on specific properties of\n those numerical types.\n\n Considerable restrictions include:\n\n \\<^item> Type class operations are restricted to one\n type parameter; this is insufficient e.g. for expressing\n a unified power operation adequately (see \\secref{sec:power}).\n\n \\<^item> Parameters are fixed over the whole type class\n hierarchy and cannot be refined in specific situations:\n think of integral domains with a predicate \\<^term>\\is_unit\\;\n for natural numbers, this degenerates to the much simpler\n @{term [source] \"HOL.equal (1::nat)\"} but facts\n refer to \\<^term>\\is_unit\\ nonetheless.\n\n \\<^item> Type classes are not apt for meta-theory. There\n is no practically usable way to express that the units\n of an integral domain form a multiplicative group using\n type classes. But see session \\HOL-Algebra\\\n which provides locales with an explicit carrier.\n\\\n\n\nsubsection \\Navigating the hierarchy\\\n\ntext \\\n An indispensable tool to inspect the class hierarchy is\n @{command class_deps} which displays the graph of classes,\n optionally showing the logical content for each class also.\n Optional parameters restrict the graph to a particular segment\n which is useful to get a graspable view. See\n the Isar reference manual @{cite \"isabelle-isar-ref\"} for details.\n\\\n\n\nsection \\The hierarchy\\\n\nsubsection \\Syntactic type classes \\label{sec:syntactic-type-class}\\\n\ntext \\\n At the top of the hierarchy there are a couple of syntactic type\n classes, ie. classes with operations but with no axioms,\n most notably:\n\n \\<^item> @{command class} \\<^class>\\plus\\ with @{term [source] \"(a::'a::plus) + b\"}\n\n \\<^item> @{command class} \\<^class>\\zero\\ with @{term [source] \"0::'a::zero\"}\n\n \\<^item> @{command class} \\<^class>\\times\\ with @{term [source] \"(a::'a::times) * b\"}\n\n \\<^item> @{command class} \\<^class>\\one\\ with @{term [source] \"1::'a::one\"}\n\n \\noindent Before the introduction of the @{command class} statement in\n Isabelle @{cite \"Haftmann-Wenzel:2006:classes\"} it was impossible\n to define operations with associated axioms in the same class,\n hence there were always pairs of syntactic and logical type\n classes. This restriction is lifted nowadays, but there are\n still reasons to maintain syntactic type classes:\n\n \\<^item> Syntactic type classes allow generic notation to be used\n regardless of a particular logical interpretation; e.g.\n although multiplication \\*\\ is usually associative,\n there are examples where it is not (e.g. octonions), and\n leaving \\*\\ without axioms allows to re-use this\n syntax by means of type class instantiation also for such\n exotic examples.\n\n \\<^item> Type classes might share operations but not necessarily\n axioms on them, e.g. \\<^term>\\gcd\\ (see \\secref{sec:gcd}).\n Hence their common base is a syntactic type class.\n\n \\noindent However syntactic type classes should only be used with striking\n cause. Otherwise there is risk for confusion if the notation\n suggests properties which do not hold without particular\n constraints. This can be illustrated using numerals\n (see \\secref{sec:numerals}): @{lemma \"2 + 2 = 4\" by simp} is\n provable without further ado, and this also meets the typical\n expectation towards a numeral notation; in more ancient releases\n numerals were purely syntactic and \\<^prop>\\2 + 2 = 4\\ was\n not provable without particular type constraints.\n\\\n\n\nsubsection \\Additive and multiplicative semigroups and monoids\\\n\ntext \\\n In common literature, notation for semigroups and monoids\n is either multiplicative \\(*, 1)\\ or additive\n \\(+, 0)\\ with underlying properties isomorphic.\n In {Isabelle/HOL}, this is accomplished using the following\n abstract setup:\n\n \\<^item> A \\<^locale>\\semigroup\\ introduces an abstract binary\n associative operation.\n\n \\<^item> A \\<^locale>\\monoid\\ is an extension of \\<^locale>\\semigroup\\\n with a neutral element.\n\n \\<^item> Both \\<^locale>\\semigroup\\ and \\<^locale>\\monoid\\ provide\n dedicated syntax for their operations \\(\\<^bold>*, \\<^bold>1)\\.\n This syntax is not visible on the global theory level\n but only for abstract reasoning inside the respective\n locale.\n\n \\<^item> Concrete global syntax is added building on existing\n syntactic type classes \\secref{sec:syntactic-type-class}\n using the following classes:\n\n \\<^item> @{command class} \\<^class>\\semigroup_mult\\ = \\<^class>\\times\\\n\n \\<^item> @{command class} \\<^class>\\monoid_mult\\ = \\<^class>\\one\\ + \\<^class>\\semigroup_mult\\\n\n \\<^item> @{command class} \\<^class>\\semigroup_add\\ = \\<^class>\\plus\\\n\n \\<^item> @{command class} \\<^class>\\monoid_add\\ = \\<^class>\\zero\\ + \\<^class>\\semigroup_add\\\n\n Locales \\<^locale>\\semigroup\\ and \\<^locale>\\monoid\\ are\n interpreted (using @{command sublocale}) into their\n corresponding type classes, with prefixes \\add\\\n and \\mult\\; hence facts derived in \\<^locale>\\semigroup\\\n and \\<^locale>\\monoid\\ are propagated simultaneously to\n \\<^emph>\\both\\ using a consistent naming policy, ie.\n\n \\<^item> @{fact semigroup.assoc}: @{thm (frugal_sorts) semigroup.assoc [all, no_vars]}\n\n \\<^item> @{fact mult.assoc}: @{thm (frugal_sorts) mult.assoc [all, no_vars]}\n\n \\<^item> @{fact add.assoc}: @{thm (frugal_sorts) add.assoc [all, no_vars]}\n\n \\<^item> @{fact monoid.right_neutral}: @{thm (frugal_sorts) monoid.right_neutral [all, no_vars]}\n\n \\<^item> @{fact mult.right_neutral}: @{thm (frugal_sorts) mult.right_neutral [all, no_vars]}\n\n \\<^item> @{fact add.right_neutral}: @{thm (frugal_sorts) add.right_neutral [all, no_vars]}\n\n \\<^item> Note that the syntax in \\<^locale>\\semigroup\\ and \\<^locale>\\monoid\\\n is bold; this avoids clashes when writing properties\n inside one of these locales in presence of that global\n concrete type class syntax.\n\n \\noindent That hierarchy extends in a straightforward manner\n to abelian semigroups and commutative monoids\\footnote{The\n designation \\<^emph>\\abelian\\ is quite standard concerning\n (semi)groups, but not for monoids}:\n\n \\<^item> Locales \\<^locale>\\abel_semigroup\\ and \\<^locale>\\comm_monoid\\\n add commutativity as property.\n\n \\<^item> Concrete syntax emerges through\n\n \\<^item> @{command class} \\<^class>\\ab_semigroup_add\\ = \\<^class>\\semigroup_add\\\n\n \\<^item> @{command class} \\<^class>\\ab_semigroup_mult\\ = \\<^class>\\semigroup_mult\\\n\n \\<^item> @{command class} \\<^class>\\comm_monoid_add\\ = \\<^class>\\zero\\ + \\<^class>\\ab_semigroup_add\\\n\n \\<^item> @{command class} \\<^class>\\comm_monoid_mult\\ = \\<^class>\\one\\ + \\<^class>\\ab_semigroup_mult\\\n \n and corresponding interpretation of the locales above, yielding\n\n \\<^item> @{fact abel_semigroup.commute}: @{thm (frugal_sorts) abel_semigroup.commute [all, no_vars]}\n\n \\<^item> @{fact mult.commute}: @{thm (frugal_sorts) mult.commute [all, no_vars]}\n\n \\<^item> @{fact add.commute}: @{thm (frugal_sorts) add.commute [all, no_vars]}\n\\\n\nparagraph \\Named collection of theorems\\\n\ntext \\\n Locale interpretation interacts smoothly with named collections of\n theorems as introduced by command @{command named_theorems}. In our\n example, rules concerning associativity and commutativity are no\n simplification rules by default since they desired orientation may\n vary depending on the situation. However, there is a collection\n @{fact ac_simps} where facts @{fact abel_semigroup.assoc},\n @{fact abel_semigroup.commute} and @{fact abel_semigroup.left_commute}\n are declared as members. Due to interpretation, also\n @{fact mult.assoc}, @{fact mult.commute} and @{fact mult.left_commute}\n are also members of @{fact ac_simps}, as any corresponding facts\n stemming from interpretation of \\<^locale>\\abel_semigroup\\.\n Hence adding @{fact ac_simps} to the simplification rules for\n a single method call uses all associativity and commutativity\n rules known by means of interpretation.\n\\\n\n\nsubsection \\Additive and multiplicative groups\\\n\ntext \\\n The hierarchy for inverse group operations takes into account\n that there are weaker algebraic structures with only a partially\n inverse operation. E. g. the natural numbers have bounded\n subtraction \\<^term>\\m - (n::nat)\\ which is only an inverse\n operation if \\<^term>\\m \\ (n::nat)\\; unary minus \\-\\\n is pointless on the natural numbers.\n\n Hence for both additive and multiplicative notation there\n are syntactic classes for inverse operations, both unary\n and binary:\n\n \\<^item> @{command class} \\<^class>\\minus\\ with @{term [source] \"(a::'a::minus) - b\"}\n\n \\<^item> @{command class} \\<^class>\\uminus\\ with @{term [source] \"- a::'a::uminus\"}\n\n \\<^item> @{command class} \\<^class>\\divide\\ with @{term [source] \"(a::'a::divide) div b\"}\n\n \\<^item> @{command class} \\<^class>\\inverse\\ = \\<^class>\\divide\\ with @{term [source] \"inverse a::'a::inverse\"}\n \\\\ and @{term [source] \"(a::'a::inverse) / b\"}\n\n \\noindent Here \\<^class>\\inverse\\ specializes the ``partial'' syntax\n @{term [source] \"a div b\"} to the more specific\n @{term [source] \"a / b\"}. \n\n Semantic properties are added by\n\n \\<^item> @{command class} \\<^class>\\cancel_ab_semigroup_add\\ = \\<^class>\\ab_semigroup_add\\ + \\<^class>\\minus\\\n\n \\<^item> @{command class} \\<^class>\\cancel_comm_monoid_add\\ = \\<^class>\\cancel_ab_semigroup_add\\ + \\<^class>\\comm_monoid_add\\\n\n \\noindent which specify a minimal binary partially inverse operation as\n\n \\<^item> @{fact add_diff_cancel_left'}: @{thm (frugal_sorts) add_diff_cancel_left' [all, no_vars]}\n\n \\<^item> @{fact diff_diff_add}: @{thm (frugal_sorts) diff_diff_add [all, no_vars]}\n\n \\noindent which in turn allow to derive facts like\n\n \\<^item> @{fact add_left_imp_eq}: @{thm (frugal_sorts) add_left_imp_eq [all, no_vars]}\n\n \\noindent The total inverse operation is established as follows:\n\n \\<^item> Locale \\<^locale>\\group\\ extends the abstract hierarchy with\n the inverse operation.\n\n \\<^item> The concrete additive inverse operation emerges through\n\n \\<^item> @{command class} \\<^class>\\group_add\\ = \\<^class>\\minus\\ + \\<^class>\\uminus\\ + \\<^class>\\monoid_add\\ (in \\<^theory>\\HOL.Groups\\) \\\\\n\n \\<^item> @{command class} \\<^class>\\ab_group_add\\ = \\<^class>\\minus\\ + \\<^class>\\uminus\\ + \\<^class>\\comm_monoid_add\\ (in \\<^theory>\\HOL.Groups\\)\n\n and corresponding interpretation of locale \\<^locale>\\group\\, yielding e.g.\n\n \\<^item> @{fact group.left_inverse}: @{thm (frugal_sorts) group.left_inverse [all, no_vars]}\n\n \\<^item> @{fact add.left_inverse}: @{thm (frugal_sorts) add.left_inverse [all, no_vars]}\n\n \\noindent There is no multiplicative counterpart. Why? In rings,\n the multiplicative group excludes the zero element, hence\n the inverse operation is not total. See further \\secref{sec:rings}.\n\\\n\nparagraph \\Mitigating against redundancy by default simplification rules\\\n\ntext \\\n Inverse operations imposes some redundancy on the type class\n hierarchy: in a group with a total inverse operation, the\n unary operation is simpler and more primitive than the binary\n one; but we cannot eliminate the binary one in favour of\n a mere syntactic abbreviation since the binary one is vital\n to express a partial inverse operation.\n\n This is mitigated by providing suitable default simplification\n rules: expression involving the unary inverse operation are\n simplified to binary inverse operation whenever appropriate.\n The rationale is that simplification is a central device in\n explorative proving, where proof obligation remaining after certain\n default proof steps including simplification are inspected\n to get an idea what is missing to finish a proof. When\n preferable normal forms are encoded into\n default simplification rules, proof obligations after simplification\n are normalized and hence more proof-friendly.\n\\\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2696394000253643}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\ntheory Datatype_Schematic\n\nimports\n \"../ml-helpers/MLUtils\"\n \"../ml-helpers/TermPatternAntiquote\"\nbegin\n\ntext \\\n Introduces a method for improving unification outcomes for schematics with\n datatype expressions as parameters.\n\n There are two variants:\n 1. In cases where a schematic is applied to a constant like @{term True},\n we wrap the constant to avoid some undesirable unification candidates.\n\n 2. In cases where a schematic is applied to a constructor expression like\n @{term \"Some x\"} or @{term \"(x, y)\"}, we supply selector expressions\n like @{term \"the\"} or @{term \"fst\"} to provide more unification\n candidates. This is only done if parameter that would be selected (e.g.\n @{term x} in @{term \"Some x\"}) contains bound variables which the\n schematic does not have as parameters.\n\n In the \"constructor expression\" case, we let users supply additional\n constructor handlers via the `datatype_schematic` attribute. The method uses\n rules of the following form:\n\n @{term \"\\x1 x2 x3. getter (constructor x1 x2 x3) = x2\"}\n\n These are essentially simp rules for simple \"accessor\" primrec functions,\n which are used to turn schematics like\n\n @{text \"?P (constructor x1 x2 x3)\"}\n\n into\n\n @{text \"?P' x2 (constructor x1 x2 x3)\"}.\n\\\n\nML \\\n \\ \\\n Anchor used to link error messages back to the documentation above.\n \\\n val usage_pos = @{here};\n\\\n\ndefinition\n ds_id :: \"'a \\ 'a\"\nwhere\n \"ds_id = (\\x. x)\"\n\nlemma wrap_ds_id:\n \"x = ds_id x\"\n by (simp add: ds_id_def)\n\nML \\\nstructure Datatype_Schematic = struct\n\nfun eq ((idx1, name1, thm1), (idx2, name2, thm2)) =\n idx1 = idx2 andalso\n name1 = name2 andalso\n (Thm.full_prop_of thm1) aconv (Thm.full_prop_of thm2);\n\nstructure Datatype_Schematic_Data = Generic_Data\n(\n \\ \\\n Keys are names of datatype constructors (like @{const Cons}), values are\n `(index, function_name, thm)`.\n\n - `function_name` is the name of an \"accessor\" function that accesses part\n of the constructor specified by the key (so the accessor @{const hd} is\n related to the constructor/key @{const Cons}).\n\n - `thm` is a theorem showing that the function accesses one of the\n arguments to the constructor (like @{thm list.sel(1)}).\n\n - `idx` is the index of the constructor argument that the accessor\n accesses. (eg. since `hd` accesses the first argument, `idx = 0`; since\n `tl` accesses the second argument, `idx = 1`).\n \\\n type T = ((int * string * thm) list) Symtab.table;\n val empty = Symtab.empty;\n val extend = I;\n val merge = Symtab.merge_list eq;\n);\n\nfun gen_att m =\n Thm.declaration_attribute (fn thm => fn context =>\n Datatype_Schematic_Data.map (m (Context.proof_of context) thm) context);\n\n(* gathers schematic applications from the goal. no effort is made\n to normalise bound variables here, since we'll always be comparing\n elements within a compound application which will be at the same\n level as regards lambdas. *)\nfun gather_schem_apps (f $ x) insts = let\n val (f, xs) = strip_comb (f $ x)\n val insts = fold (gather_schem_apps) (f :: xs) insts\n in if is_Var f then (f, xs) :: insts else insts end\n | gather_schem_apps (Abs (_, _, t)) insts\n = gather_schem_apps t insts\n | gather_schem_apps _ insts = insts\n\nfun sfirst xs f = get_first f xs\n\nfun get_action ctxt prop = let\n val schem_insts = gather_schem_apps prop [];\n val actions = Datatype_Schematic_Data.get (Context.Proof ctxt);\n fun mk_sel selname T i = let\n val (argTs, resT) = strip_type T\n in Const (selname, resT --> nth argTs i) end\n in\n sfirst schem_insts\n (fn (var, xs) => sfirst (Library.tag_list 0 xs)\n (try (fn (idx, x) => let\n val (c, ys) = strip_comb x\n val (fname, T) = dest_Const c\n val acts = Symtab.lookup_list actions fname\n fun interesting arg = not (member Term.aconv_untyped xs arg)\n andalso exists (fn i => not (member (=) xs (Bound i)))\n (Term.loose_bnos arg)\n in the (sfirst acts (fn (i, selname, thms) => if interesting (nth ys i)\n then SOME (var, idx, mk_sel selname T i, thms) else NONE))\n end)))\n end\n\nfun get_bound_tac ctxt = SUBGOAL (fn (t, i) => case get_action ctxt t of\n SOME (Var ((nm, ix), T), idx, sel, thm) => (fn t => let\n val (argTs, _) = strip_type T\n val ix2 = Thm.maxidx_of t + 1\n val xs = map (fn (i, T) => Free (\"x\" ^ string_of_int i, T))\n (Library.tag_list 1 argTs)\n val nx = sel $ nth xs idx\n val v' = Var ((nm, ix2), fastype_of nx --> T)\n val inst_v = fold lambda (rev xs) (betapplys (v' $ nx, xs))\n val t' = Drule.infer_instantiate ctxt\n [((nm, ix), Thm.cterm_of ctxt inst_v)] t\n val t'' = Conv.fconv_rule (Thm.beta_conversion true) t'\n in safe_full_simp_tac (clear_simpset ctxt addsimps [thm]) i t'' end)\n | _ => no_tac)\n\nfun id_applicable (f $ x) = let\n val (f, xs) = strip_comb (f $ x)\n val here = is_Var f andalso exists is_Const xs\n in here orelse exists id_applicable (f :: xs) end\n | id_applicable (Abs (_, _, t)) = id_applicable t\n | id_applicable _ = false\n\nfun combination_conv cv1 cv2 ct =\n let\n val (ct1, ct2) = Thm.dest_comb ct\n val r1 = SOME (cv1 ct1) handle Option => NONE\n val r2 = SOME (cv2 ct2) handle Option => NONE\n fun mk _ (SOME res) = res\n | mk ct NONE = Thm.reflexive ct\n in case (r1, r2) of\n (NONE, NONE) => raise Option\n | _ => Thm.combination (mk ct1 r1) (mk ct2 r2)\n end\n\nval wrap = mk_meta_eq @{thm wrap_ds_id}\n\nfun wrap_const_conv _ ct = if is_Const (Thm.term_of ct)\n andalso fastype_of (Thm.term_of ct) <> @{typ unit}\n then Conv.rewr_conv wrap ct\n else raise Option\n\nfun combs_conv conv ctxt ct = case Thm.term_of ct of\n _ $ _ => combination_conv (combs_conv conv ctxt) (conv ctxt) ct\n | _ => conv ctxt ct\n\nfun wrap_conv ctxt ct = case Thm.term_of ct of\n Abs _ => Conv.sub_conv wrap_conv ctxt ct\n | f $ x => if is_Var (head_of f) then combs_conv wrap_const_conv ctxt ct\n else if not (id_applicable (f $ x)) then raise Option\n else combs_conv wrap_conv ctxt ct\n | _ => raise Option\n\nfun CONVERSION_opt conv i t = CONVERSION conv i t\n handle Option => no_tac t\n\nexception Datatype_Schematic_Error of Pretty.T;\n\nfun apply_pos_markup pos text =\n let\n val props = Position.def_properties_of pos;\n val markup = Markup.properties props (Markup.entity \"\" \"\");\n in Pretty.mark_str (markup, text) end;\n\nfun invalid_accessor ctxt thm : exn =\n Datatype_Schematic_Error ([\n Pretty.str \"Bad input theorem '\",\n Syntax.pretty_term ctxt (Thm.full_prop_of thm),\n Pretty.str \"'. Click \",\n apply_pos_markup usage_pos \"*here*\",\n Pretty.str \" for info on the required rule format.\" ] |> Pretty.paragraph);\n\nlocal\n fun dest_accessor' thm =\n case (thm |> Thm.full_prop_of |> HOLogic.dest_Trueprop) of\n @{term_pat \"?fun_name ?data_pat = ?rhs\"} =>\n let\n val fun_name = Term.dest_Const fun_name |> fst;\n val (data_const, data_args) = Term.strip_comb data_pat;\n val data_vars = data_args |> map (Term.dest_Var #> fst);\n val rhs_var = rhs |> Term.dest_Var |> fst;\n val data_name = Term.dest_Const data_const |> fst;\n val rhs_idx = ListExtras.find_index (curry op = rhs_var) data_vars |> the;\n in (fun_name, data_name, rhs_idx) end;\nin\n fun dest_accessor ctxt thm =\n case try dest_accessor' thm of\n SOME x => x\n | NONE => raise invalid_accessor ctxt thm;\nend\n\nfun add_rule ctxt thm data =\n let\n val (fun_name, data_name, idx) = dest_accessor ctxt thm;\n val entry = (data_name, (idx, fun_name, thm));\n in Symtab.insert_list eq entry data end;\n\nfun del_rule ctxt thm data =\n let\n val (fun_name, data_name, idx) = dest_accessor ctxt thm;\n val entry = (data_name, (idx, fun_name, thm));\n in Symtab.remove_list eq entry data end;\n\nval add = gen_att add_rule;\nval del = gen_att del_rule;\n\nfun wrap_tac ctxt = CONVERSION_opt (wrap_conv ctxt)\n\nfun tac1 ctxt = REPEAT_ALL_NEW (get_bound_tac ctxt) THEN' (TRY o wrap_tac ctxt)\n\nfun tac ctxt = tac1 ctxt ORELSE' wrap_tac ctxt\n\nval add_section =\n Args.add -- Args.colon >> K (Method.modifier add @{here});\n\nval method =\n Method.sections [add_section] >> (fn _ => fn ctxt => Method.SIMPLE_METHOD' (tac ctxt));\n\nend\n\\\n\nsetup \\\n Attrib.setup\n @{binding \"datatype_schematic\"}\n (Attrib.add_del Datatype_Schematic.add Datatype_Schematic.del)\n \"Accessor rules to fix datatypes in schematics\"\n\\\n\nmethod_setup datatype_schem = \\\n Datatype_Schematic.method\n\\\n\ndeclare prod.sel[datatype_schematic]\ndeclare option.sel[datatype_schematic]\ndeclare list.sel(1,3)[datatype_schematic]\n\nlocale datatype_schem_demo begin\n\nlemma handles_nested_constructors:\n \"\\f. \\y. f True (Some [x, (y, z)]) = y\"\n apply (rule exI, rule allI)\n apply datatype_schem\n apply (rule refl)\n done\n\ndatatype foo =\n basic nat int\n | another nat\n\nprimrec get_basic_0 where\n \"get_basic_0 (basic x0 x1) = x0\"\n\nprimrec get_nat where\n \"get_nat (basic x _) = x\"\n | \"get_nat (another z) = z\"\n\nlemma selectively_exposing_datatype_arugments:\n notes get_basic_0.simps[datatype_schematic]\n shows \"\\x. \\a b. x (basic a b) = a\"\n apply (rule exI, (rule allI)+)\n apply datatype_schem \\ \\Only exposes `a` to the schematic.\\\n by (rule refl)\n\nlemma method_handles_primrecs_with_two_constructors:\n shows \"\\x. \\a b. x (basic a b) = a\"\n apply (rule exI, (rule allI)+)\n apply (datatype_schem add: get_nat.simps)\n by (rule refl)\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Monad_WP/Datatype_Schematic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.2696394000253643}} {"text": "(* Title: OAWN_Convert.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke\n*)\n\nsection \"Transfer standard invariants into open invariants\"\n\ntheory OAWN_Convert\nimports AWN_SOS_Labels AWN_Invariants\n OAWN_SOS OAWN_Invariants\nbegin\n\ndefinition initiali :: \"'i \\ (('i \\ 'g) \\ 'l) set \\ ('g \\ 'l) set \\ bool\"\nwhere \"initiali i OI CI \\ ({(\\ i, p)|\\ p. (\\, p) \\ OI} = CI)\"\n\nlemma initialiI [intro]:\n assumes OICI: \"\\\\ p. (\\, p) \\ OI \\ (\\ i, p) \\ CI\"\n and CIOI: \"\\\\ p. (\\, p) \\ CI \\ \\\\. \\ = \\ i \\ (\\, p) \\ OI\"\n shows \"initiali i OI CI\"\n unfolding initiali_def\n by (intro set_eqI iffI) (auto elim!: OICI CIOI)\n\nlemma open_from_initialiD [dest]:\n assumes \"initiali i OI CI\"\n and \"(\\, p) \\ OI\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ CI\"\n using assms unfolding initiali_def by auto\n\nlemma closed_from_initialiD [dest]:\n assumes \"initiali i OI CI\"\n and \"(\\, p) \\ CI\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ OI\"\n using assms unfolding initiali_def by auto\n\ndefinition\n seql :: \"'i \\ (('s \\ 'l) \\ bool) \\ (('i \\ 's) \\ 'l) \\ bool\"\nwhere\n \"seql i P \\ (\\(\\, p). P (\\ i, p))\"\n\nlemma seqlI [intro]:\n \"P (fst s i, snd s) \\ seql i P s\"\n by (clarsimp simp: seql_def)\n\nlemma same_seql [elim]:\n assumes \"\\j\\{i}. \\' j = \\ j\"\n and \"seql i P (\\', s)\"\n shows \"seql i P (\\, s)\"\n using assms unfolding seql_def by (clarsimp)\n\nlemma seqlsimp:\n \"seql i P (\\, p) = P (\\ i, p)\"\n unfolding seql_def by simp\n\nlemma other_steps_resp_local [intro!, simp]: \"other_steps (other A I) I\"\n by (clarsimp elim!: otherE)\n\nlemma seql_onl_swap:\n \"seql i (onl \\ P) = onl \\ (seql i P)\"\n unfolding seql_def onl_def by simp\n\nlemma oseqp_sos_resp_local_steps [intro!, simp]:\n fixes \\ :: \"'p \\ ('s, 'm, 'p, 'l) seqp\"\n shows \"local_steps (oseqp_sos \\ i) {i}\"\n proof\n fix \\ \\' \\ \\' :: \"nat \\ 's\" and s a s'\n assume tr: \"((\\, s), a, \\', s') \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, s), a, (\\', s')) \\ oseqp_sos \\ i\"\n proof induction\n fix \\ \\' l ms p\n assume \"\\' i = \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n hence \"((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ oseqp_sos \\ i\"\n by (metis obroadcastT singleton_iff)\n with \\\\j\\{i}. \\ j = \\ j\\ show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\\n ((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ \\' :: \"nat \\ 's\" and fmsg :: \"'m \\ 's \\ 's\" and msg l p\n assume *: \"\\' i = fmsg msg (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (\\(i := fmsg msg (\\ i))) j = \\' j\" by clarsimp\n moreover from * **\n have \"((\\, {l}receive(fmsg).p), receive msg, (\\(i := fmsg msg (\\ i)), p)) \\ oseqp_sos \\ i\"\n by (metis fun_upd_same oreceiveT)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\\n ((\\, {l}receive(fmsg).p), receive msg, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\' \\ l p and fas :: \"'s \\ 's\"\n assume *: \"\\' i = fas (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (\\(i := fas (\\ i))) j = \\' j\" by clarsimp\n moreover from * ** have \"((\\, {l}\\fas\\ p), \\, (\\(i := fas (\\ i)), p)) \\ oseqp_sos \\ i\"\n by (metis fun_upd_same oassignT)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, {l}\\fas\\ p), \\, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix g :: \"'s \\ 's set\" and \\ \\' l p\n assume *: \"\\' i \\ g (\\ i)\"\n and **: \"\\j\\{i}. \\ j = \\ j\"\n hence \"\\j\\{i}. (SOME \\'. \\' i = \\' i) j = \\' j\" by simp (metis (lifting, full_types) some_eq_ex)\n moreover with * ** have \"((\\, {l}\\g\\ p), \\, (SOME \\'. \\' i = \\' i, p)) \\ oseqp_sos \\ i\"\n by simp (metis oguardT step_seq_tau)\n ultimately show \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, {l}\\g\\ p), \\, (\\', p)) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ pn a \\' p'\n assume \"((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n and IH: \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, \\ pn), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, call(pn)), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ p a \\' p' q\n assume \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p \\ q), a, (\\', p')) \\ oseqp_sos \\ i\"\n by blast\n next\n fix \\ p a \\' q q'\n assume \"((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j \\ \\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n and \"\\j\\{i}. \\ j = \\ j\"\n then obtain \\' where \"\\j\\{i}. \\' j = \\' j\"\n and \"((\\, q), a, (\\', q')) \\ oseqp_sos \\ i\"\n by blast\n thus \"\\\\'. (\\j\\{i}. \\' j = \\' j) \\ ((\\, p \\ q), a, (\\', q')) \\ oseqp_sos \\ i\"\n by blast\n qed (simp_all, (metis ogroupcastT ounicastT onotunicastT osendT odeliverT)+)\n qed\n\nlemma oseqp_sos_subreachable [intro!, simp]:\n assumes \"trans OA = oseqp_sos \\ i\"\n shows \"subreachable OA (other ANY {i}) {i}\"\n by rule (clarsimp simp add: assms(1))+\n\nlemma oseq_step_is_seq_step:\n fixes \\ :: \"ip \\ 's\"\n assumes \"((\\, p), a :: 'm seq_action, (\\', p')) \\ oseqp_sos \\ i\"\n and \"\\ i = \\\"\n shows \"\\\\'. \\' i = \\' \\ ((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n using assms proof induction\n fix \\ \\' l ms p\n assume \"\\' i = \\ i\"\n and \"\\ i = \\\"\n hence \"\\' i = \\\" by simp\n have \"((\\, {l}broadcast(ms).p), broadcast (ms \\), (\\, p)) \\ seqp_sos \\\"\n by auto\n with \\\\ i = \\\\ and \\\\' i = \\\\ show \"\\\\'. \\' i = \\'\n \\ ((\\, {l}broadcast(ms).p), broadcast (ms (\\ i)), (\\', p)) \\ seqp_sos \\\"\n by clarsimp\n next\n fix fmsg :: \"'m \\ 's \\ 's\" and msg :: 'm and \\' \\ l p\n assume \"\\' i = fmsg msg (\\ i)\"\n and \"\\ i = \\\"\n have \"((\\, {l}receive(fmsg).p), receive msg, (fmsg msg \\, p)) \\ seqp_sos \\\"\n by auto\n with \\\\' i = fmsg msg (\\ i)\\ and \\\\ i = \\\\\n show \"\\\\'. \\' i = \\' \\ ((\\, {l}receive(fmsg).p), receive msg, (\\', p)) \\ seqp_sos \\\"\n by clarsimp\n qed (simp_all, (metis assignT choiceT1 choiceT2 groupcastT guardT\n callT unicastT notunicastT sendT deliverT step_seq_tau)+)\n\nlemma reachable_oseq_seqp_sos:\n assumes \"(\\, p) \\ reachable OA I\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n using assms(1) proof (induction rule: reachable_pair_induct)\n fix \\ p\n assume \"(\\, p) \\ init OA\"\n with \\initiali i (init OA) (init A)\\ obtain \\ where \"\\ i = \\\"\n and \"(\\, p) \\ init A\"\n by auto\n from \\(\\, p) \\ init A\\ have \"(\\, p) \\ reachable A I\" ..\n with \\\\ i = \\\\ show \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n by auto\n next\n fix \\ p \\' p' a\n assume \"(\\, p) \\ reachable OA I\"\n and IH: \"\\\\. \\ i = \\ \\ (\\, p) \\ reachable A I\"\n and otr: \"((\\, p), a, (\\', p')) \\ trans OA\"\n and \"I a\"\n from IH obtain \\ where \"\\ i = \\\"\n and cr: \"(\\, p) \\ reachable A I\"\n by clarsimp\n from otr and spo have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n with \\\\ i = \\\\ obtain \\' where \"\\' i = \\'\"\n and \"((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n by (auto dest!: oseq_step_is_seq_step)\n from this(2) and sp have ctr: \"((\\, p), a, (\\', p')) \\ trans A\" by simp\n from \\(\\, p) \\ reachable A I\\ and ctr and \\I a\\\n have \"(\\', p') \\ reachable A I\" ..\n with \\\\' i = \\'\\ show \"\\\\. \\' i = \\ \\ (\\, p') \\ reachable A I\"\n by blast\n qed\n\nlemma reachable_oseq_seqp_sos':\n assumes \"s \\ reachable OA I\"\n and \"initiali i (init OA) (init A)\"\n and \"trans OA = oseqp_sos \\ i\"\n and \"trans A = seqp_sos \\\"\n shows \"\\\\. (fst s) i = \\ \\ (\\, snd s) \\ reachable A I\"\n using assms\n by - (cases s, auto dest: reachable_oseq_seqp_sos)\n\ntext \\\n Any invariant shown in the (simpler) closed semantics can be transferred to an invariant in\n the open semantics.\n\\\n\ntheorem open_seq_invariant [intro]:\n assumes \"A \\ (I \\) P\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"OA \\ (act I, other ANY {i} \\) (seql i P)\"\n proof -\n have \"OA \\ (I \\) (seql i P)\"\n proof (rule invariant_arbitraryI)\n fix s \n assume \"s \\ reachable OA I\"\n with \\initiali i (init OA) (init A)\\ obtain \\ where \"(fst s) i = \\\"\n and \"(\\, snd s) \\ reachable A I\"\n by (auto dest: reachable_oseq_seqp_sos' [OF _ _ spo sp])\n with \\A \\ (I \\) P\\ have \"P (\\, snd s)\" by auto\n with \\(fst s) i = \\\\ show \"seql i P s\" by auto\n qed\n moreover from spo have \"subreachable OA (other ANY {i}) {i}\" ..\n ultimately show ?thesis\n proof (rule open_closed_invariant)\n fix \\ \\' s\n assume \"\\j\\{i}. \\' j = \\ j\"\n and \"seql i P (\\', s)\"\n thus \"seql i P (\\, s)\" ..\n qed\n qed\n\ndefinition\n seqll :: \"'i \\ ((('s \\ 'l) \\ 'a \\ ('s \\ 'l)) \\ bool)\n \\ ((('i \\ 's) \\ 'l) \\ 'a \\ (('i \\ 's) \\ 'l)) \\ bool\"\nwhere\n \"seqll i P \\ (\\((\\, p), a, (\\', p')). P ((\\ i, p), a, (\\' i, p')))\"\n\nlemma same_seqll [elim]:\n assumes \"\\j\\{i}. \\\\<^sub>1' j = \\\\<^sub>1 j\"\n and \"\\j\\{i}. \\\\<^sub>2' j = \\\\<^sub>2 j\"\n and \"seqll i P ((\\\\<^sub>1', s), a, (\\\\<^sub>2', s'))\"\n shows \"seqll i P ((\\\\<^sub>1, s), a, (\\\\<^sub>2, s'))\"\n using assms unfolding seqll_def by (clarsimp)\n\nlemma seqllI [intro!]:\n assumes \"P ((\\ i, p), a, (\\' i, p'))\"\n shows \"seqll i P ((\\, p), a, (\\', p'))\"\n using assms unfolding seqll_def by simp\n\nlemma seqllD [dest]:\n assumes \"seqll i P ((\\, p), a, (\\', p'))\"\n shows \"P ((\\ i, p), a, (\\' i, p'))\"\n using assms unfolding seqll_def by simp\n\nlemma seqllsimp:\n \"seqll i P ((\\, p), a, (\\', p')) = P ((\\ i, p), a, (\\' i, p'))\"\n unfolding seqll_def by simp\n\nlemma seqll_onll_swap:\n \"seqll i (onll \\ P) = onll \\ (seqll i P)\"\n unfolding seqll_def onll_def by simp\n\ntheorem open_seq_step_invariant [intro]:\n assumes \"A \\\\<^sub>A (I \\) P\"\n and \"initiali i (init OA) (init A)\"\n and spo: \"trans OA = oseqp_sos \\ i\"\n and sp: \"trans A = seqp_sos \\\"\n shows \"OA \\\\<^sub>A (act I, other ANY {i} \\) (seqll i P)\"\n proof -\n have \"OA \\\\<^sub>A (I \\) (seqll i P)\"\n proof (rule step_invariant_arbitraryI)\n fix \\ p a \\' p'\n assume or: \"(\\, p) \\ reachable OA I\"\n and otr: \"((\\, p), a, (\\', p')) \\ trans OA\"\n and \"I a\"\n from or \\initiali i (init OA) (init A)\\ spo sp obtain \\ where \"\\ i = \\\"\n and cr: \"(\\, p) \\ reachable A I\"\n by - (drule(3) reachable_oseq_seqp_sos', auto)\n from otr and spo have \"((\\, p), a, (\\', p')) \\ oseqp_sos \\ i\" by simp\n with \\\\ i = \\\\ obtain \\' where \"\\' i = \\'\"\n and ctr: \"((\\, p), a, (\\', p')) \\ seqp_sos \\\"\n by (auto dest!: oseq_step_is_seq_step)\n with sp have \"((\\, p), a, (\\', p')) \\ trans A\" by simp\n with \\A \\\\<^sub>A (I \\) P\\ cr have \"P ((\\, p), a, (\\', p'))\" using \\I a\\ ..\n with \\\\ i = \\\\ and \\\\' i = \\'\\ have \"P ((\\ i, p), a, (\\' i, p'))\" by simp\n thus \"seqll i P ((\\, p), a, (\\', p'))\" ..\n qed\n moreover from spo have \"local_steps (trans OA) {i}\" by simp\n moreover have \"other_steps (other ANY {i}) {i}\" ..\n ultimately show ?thesis\n proof (rule open_closed_step_invariant)\n fix \\ \\ a \\' \\' s s'\n assume \"\\j\\{i}. \\ j = \\ j\"\n and \"\\j\\{i}. \\' j = \\' j\"\n and \"seqll i P ((\\, s), a, (\\', s'))\"\n thus \"seqll i P ((\\, s), a, (\\', s'))\" ..\n qed\n qed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AWN/OAWN_Convert.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.2696393925535775}} {"text": "(* Title: HOL/Auth/Guard/Proto.thy\n Author: Frederic Blanqui, University of Cambridge Computer Laboratory\n Copyright 2002 University of Cambridge\n*)\n\nsection\\Other Protocol-Independent Results\\\n\ntheory Proto imports Guard_Public begin\n\nsubsection\\protocols\\\n\ntype_synonym rule = \"event set * event\"\n\nabbreviation\n msg' :: \"rule => msg\" where\n \"msg' R == msg (snd R)\"\n\ntype_synonym proto = \"rule set\"\n\ndefinition wdef :: \"proto => bool\" where\n\"wdef p \\ \\R k. R \\ p \\ Number k \\ parts {msg' R}\n\\ Number k \\ parts (msg`(fst R))\"\n\nsubsection\\substitutions\\\n\nrecord subs =\n agent :: \"agent => agent\"\n nonce :: \"nat => nat\"\n nb :: \"nat => msg\"\n key :: \"key => key\"\n\nprimrec apm :: \"subs => msg => msg\" where\n \"apm s (Agent A) = Agent (agent s A)\"\n| \"apm s (Nonce n) = Nonce (nonce s n)\"\n| \"apm s (Number n) = nb s n\"\n| \"apm s (Key K) = Key (key s K)\"\n| \"apm s (Hash X) = Hash (apm s X)\"\n| \"apm s (Crypt K X) = (\nif (\\A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)\nelse if (\\A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)\nelse Crypt (key s K) (apm s X))\"\n| \"apm s \\X,Y\\ = \\apm s X, apm s Y\\\"\n\nlemma apm_parts: \"X \\ parts {Y} \\ apm s X \\ parts {apm s Y}\"\napply (erule parts.induct, simp_all, blast)\napply (erule parts.Fst)\napply (erule parts.Snd)\nby (erule parts.Body)+\n\nlemma Nonce_apm [rule_format]: \"Nonce n \\ parts {apm s X} \\\n(\\k. Number k \\ parts {X} \\ Nonce n \\ parts {nb s k}) \\\n(\\k. Nonce k \\ parts {X} \\ nonce s k = n)\"\nby (induct X, simp_all, blast)\n\nlemma wdef_Nonce: \"[| Nonce n \\ parts {apm s X}; R \\ p; msg' R = X; wdef p;\nNonce n \\ parts (apm s `(msg `(fst R))) |] ==>\n(\\k. Nonce k \\ parts {X} \\ nonce s k = n)\"\napply (erule Nonce_apm, unfold wdef_def)\napply (drule_tac x=R in spec, drule_tac x=k in spec, clarsimp)\napply (drule_tac x=x in bspec, simp)\napply (drule_tac Y=\"msg x\" and s=s in apm_parts, simp)\nby (blast dest: parts_parts)\n\nprimrec ap :: \"subs \\ event \\ event\" where\n \"ap s (Says A B X) = Says (agent s A) (agent s B) (apm s X)\"\n| \"ap s (Gets A X) = Gets (agent s A) (apm s X)\"\n| \"ap s (Notes A X) = Notes (agent s A) (apm s X)\"\n\nabbreviation\n ap' :: \"subs \\ rule \\ event\" where\n \"ap' s R \\ ap s (snd R)\"\n\nabbreviation\n apm' :: \"subs \\ rule \\ msg\" where\n \"apm' s R \\ apm s (msg' R)\"\n\nabbreviation\n priK' :: \"subs \\ agent \\ key\" where\n \"priK' s A \\ priK (agent s A)\"\n\nabbreviation\n pubK' :: \"subs \\ agent \\ key\" where\n \"pubK' s A \\ pubK (agent s A)\"\n\nsubsection\\nonces generated by a rule\\\n\ndefinition newn :: \"rule \\ nat set\" where\n\"newn R \\ {n. Nonce n \\ parts {msg (snd R)} \\ Nonce n \\ parts (msg`(fst R))}\"\n\nlemma newn_parts: \"n \\ newn R \\ Nonce (nonce s n) \\ parts {apm' s R}\"\nby (auto simp: newn_def dest: apm_parts)\n\nsubsection\\traces generated by a protocol\\\n\ndefinition ok :: \"event list \\ rule \\ subs \\ bool\" where\n\"ok evs R s \\ ((\\x. x \\ fst R \\ ap s x \\ set evs)\n\\ (\\n. n \\ newn R \\ Nonce (nonce s n) \\ used evs))\"\n\ninductive_set\n tr :: \"proto => event list set\"\n for p :: proto\nwhere\n\n Nil [intro]: \"[] \\ tr p\"\n\n| Fake [intro]: \"[| evsf \\ tr p; X \\ synth (analz (spies evsf)) |]\n ==> Says Spy B X # evsf \\ tr p\"\n\n| Proto [intro]: \"[| evs \\ tr p; R \\ p; ok evs R s |] ==> ap' s R # evs \\ tr p\"\n\nsubsection\\general properties\\\n\nlemma one_step_tr [iff]: \"one_step (tr p)\"\napply (unfold one_step_def, clarify)\nby (ind_cases \"ev # evs \\ tr p\" for ev evs, auto)\n\ndefinition has_only_Says' :: \"proto => bool\" where\n\"has_only_Says' p \\ \\R. R \\ p \\ is_Says (snd R)\"\n\nlemma has_only_Says'D: \"[| R \\ p; has_only_Says' p |]\n==> (\\A B X. snd R = Says A B X)\"\nby (unfold has_only_Says'_def is_Says_def, blast)\n\nlemma has_only_Says_tr [simp]: \"has_only_Says' p ==> has_only_Says (tr p)\"\napply (unfold has_only_Says_def)\napply (rule allI, rule allI, rule impI)\napply (erule tr.induct)\napply (auto simp: has_only_Says'_def ok_def)\nby (drule_tac x=a in spec, auto simp: is_Says_def)\n\nlemma has_only_Says'_in_trD: \"[| has_only_Says' p; list @ ev # evs1 \\ tr p |]\n==> (\\A B X. ev = Says A B X)\"\nby (drule has_only_Says_tr, auto)\n\nlemma ok_not_used: \"[| Nonce n \\ used evs; ok evs R s;\n\\x. x \\ fst R \\ is_Says x |] ==> Nonce n \\ parts (apm s `(msg `(fst R)))\"\napply (unfold ok_def, clarsimp)\napply (drule_tac x=x in spec, drule_tac x=x in spec)\nby (auto simp: is_Says_def dest: Says_imp_spies not_used_not_spied parts_parts)\n\nlemma ok_is_Says: \"[| evs' @ ev # evs \\ tr p; ok evs R s; has_only_Says' p;\nR \\ p; x \\ fst R |] ==> is_Says x\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=x in spec, simp)\napply (subgoal_tac \"one_step (tr p)\")\napply (drule trunc, simp, drule one_step_Cons, simp)\napply (drule has_only_SaysD, simp+)\nby (clarify, case_tac x, auto)\n\nsubsection\\types\\\n\ntype_synonym keyfun = \"rule \\ subs \\ nat \\ event list \\ key set\"\n\ntype_synonym secfun = \"rule \\ nat \\ subs \\ key set \\ msg\"\n\nsubsection\\introduction of a fresh guarded nonce\\\n\ndefinition fresh :: \"proto \\ rule \\ subs \\ nat \\ key set \\ event list\n\\ bool\" where\n\"fresh p R s n Ks evs \\ (\\evs1 evs2. evs = evs2 @ ap' s R # evs1\n\\ Nonce n \\ used evs1 \\ R \\ p \\ ok evs1 R s \\ Nonce n \\ parts {apm' s R}\n\\ apm' s R \\ guard n Ks)\"\n\nlemma freshD: \"fresh p R s n Ks evs \\ (\\evs1 evs2.\nevs = evs2 @ ap' s R # evs1 \\ Nonce n \\ used evs1 \\ R \\ p \\ ok evs1 R s\n\\ Nonce n \\ parts {apm' s R} \\ apm' s R \\ guard n Ks)\"\nby (unfold fresh_def, blast)\n\nlemma freshI [intro]: \"[| Nonce n \\ used evs1; R \\ p; Nonce n \\ parts {apm' s R};\nok evs1 R s; apm' s R \\ guard n Ks |]\n==> fresh p R s n Ks (list @ ap' s R # evs1)\"\nby (unfold fresh_def, blast)\n\nlemma freshI': \"[| Nonce n \\ used evs1; (l,r) \\ p;\nNonce n \\ parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r) \\ guard n Ks |]\n==> fresh p (l,r) s n Ks (evs2 @ ap s r # evs1)\"\nby (drule freshI, simp+)\n\nlemma fresh_used: \"[| fresh p R' s' n Ks evs; has_only_Says' p |]\n==> Nonce n \\ used evs\"\napply (unfold fresh_def, clarify)\napply (drule has_only_Says'D)\nby (auto intro: parts_used_app)\n\nlemma fresh_newn: \"[| evs' @ ap' s R # evs \\ tr p; wdef p; has_only_Says' p;\nNonce n \\ used evs; R \\ p; ok evs R s; Nonce n \\ parts {apm' s R} |]\n==> \\k. k \\ newn R \\ nonce s k = n\"\napply (drule wdef_Nonce, simp+)\napply (frule ok_not_used, simp+)\napply (clarify, erule ok_is_Says, simp+)\napply (clarify, rule_tac x=k in exI, simp add: newn_def)\napply (clarify, drule_tac Y=\"msg x\" and s=s in apm_parts)\napply (drule ok_not_used, simp+)\nby (clarify, erule ok_is_Says, simp_all)\n\nlemma fresh_rule: \"[| evs' @ ev # evs \\ tr p; wdef p; Nonce n \\ used evs;\nNonce n \\ parts {msg ev} |] ==> \\R s. R \\ p \\ ap' s R = ev\"\napply (drule trunc, simp, ind_cases \"ev # evs \\ tr p\", simp)\nby (drule_tac x=X in in_sub, drule parts_sub, simp, simp, blast+)\n\nlemma fresh_ruleD: \"[| fresh p R' s' n Ks evs; keys R' s' n evs \\ Ks; wdef p;\nhas_only_Says' p; evs \\ tr p; \\R k s. nonce s k = n \\ Nonce n \\ used evs \\\nR \\ p \\ k \\ newn R \\ Nonce n \\ parts {apm' s R} \\ apm' s R \\ guard n Ks \\\napm' s R \\ parts (spies evs) \\ keys R s n evs \\ Ks \\ P |] ==> P\"\napply (frule fresh_used, simp)\napply (unfold fresh_def, clarify)\napply (drule_tac x=R' in spec)\napply (drule fresh_newn, simp+, clarify)\napply (drule_tac x=k in spec)\napply (drule_tac x=s' in spec)\napply (subgoal_tac \"apm' s' R' \\ parts (spies (evs2 @ ap' s' R' # evs1))\")\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (rule_tac Y=\"apm s' X\" in parts_parts, blast)\nby (rule parts.Inj, rule Says_imp_spies, simp, blast)\n\nsubsection\\safe keys\\\n\ndefinition safe :: \"key set \\ msg set \\ bool\" where\n\"safe Ks G \\ \\K. K \\ Ks \\ Key K \\ analz G\"\n\nlemma safeD [dest]: \"[| safe Ks G; K \\ Ks |] ==> Key K \\ analz G\"\nby (unfold safe_def, blast)\n\nlemma safe_insert: \"safe Ks (insert X G) ==> safe Ks G\"\nby (unfold safe_def, blast)\n\nlemma Guard_safe: \"[| Guard n Ks G; safe Ks G |] ==> Nonce n \\ analz G\"\nby (blast dest: Guard_invKey)\n\nsubsection\\guardedness preservation\\\n\ndefinition preserv :: \"proto \\ keyfun \\ nat \\ key set \\ bool\" where\n\"preserv p keys n Ks \\ (\\evs R' s' R s. evs \\ tr p \\\nGuard n Ks (spies evs) \\ safe Ks (spies evs) \\ fresh p R' s' n Ks evs \\\nkeys R' s' n evs \\ Ks \\ R \\ p \\ ok evs R s \\ apm' s R \\ guard n Ks)\"\n\nlemma preservD: \"[| preserv p keys n Ks; evs \\ tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; R \\ p; ok evs R s;\nkeys R' s' n evs \\ Ks |] ==> apm' s R \\ guard n Ks\"\nby (unfold preserv_def, blast)\n\nlemma preservD': \"[| preserv p keys n Ks; evs \\ tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X) \\ p;\nok evs (l,Says A B X) s; keys R' s' n evs \\ Ks |] ==> apm s X \\ guard n Ks\"\nby (drule preservD, simp+)\n\nsubsection\\monotonic keyfun\\\n\ndefinition monoton :: \"proto => keyfun => bool\" where\n\"monoton p keys \\ \\R' s' n ev evs. ev # evs \\ tr p \\\nkeys R' s' n evs \\ keys R' s' n (ev # evs)\"\n\nlemma monotonD [dest]: \"[| keys R' s' n (ev # evs) \\ Ks; monoton p keys;\nev # evs \\ tr p |] ==> keys R' s' n evs \\ Ks\"\nby (unfold monoton_def, blast)\n\nsubsection\\guardedness theorem\\\n\nlemma Guard_tr [rule_format]: \"[| evs \\ tr p; has_only_Says' p;\npreserv p keys n Ks; monoton p keys; Guard n Ks (initState Spy) |] ==>\nsafe Ks (spies evs) \\ fresh p R' s' n Ks evs \\ keys R' s' n evs \\ Ks \\\nGuard n Ks (spies evs)\"\napply (erule tr.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply (clarify, drule freshD, clarsimp)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, blast)\n(* evs2 = aa # list *)\napply (clarsimp, rule conjI)\napply (blast dest: safe_insert)\n(* X:guard n Ks *)\napply (rule in_synth_Guard, simp, rule Guard_analz)\napply (blast dest: safe_insert)\napply (drule safe_insert, simp add: safe_def)\n(* Proto *)\napply (clarify, drule freshD, clarify)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (frule_tac R=R' in has_only_Says'D, simp)\napply (case_tac R', clarsimp, blast)\n(* evs2 = ab # list *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, rule conjI)\napply (drule Proto, simp+, blast dest: safe_insert)\n(* apm s X:guard n Ks *)\napply (frule Proto, simp+)\napply (erule preservD', simp+)\napply (blast dest: safe_insert)\napply (blast dest: safe_insert)\nby (blast, simp, simp, blast)\n\nsubsection\\useful properties for guardedness\\\n\nlemma newn_neq_used: \"[| Nonce n \\ used evs; ok evs R s; k \\ newn R |]\n==> n \\ nonce s k\"\nby (auto simp: ok_def)\n\nlemma ok_Guard: \"[| ok evs R s; Guard n Ks (spies evs); x \\ fst R; is_Says x |]\n==> apm s (msg x) \\ parts (spies evs) \\ apm s (msg x) \\ guard n Ks\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=\"Says A B X\" in spec, simp)\nby (drule Says_imp_spies, auto intro: parts_parts)\n\nlemma ok_parts_not_new: \"[| Y \\ parts (spies evs); Nonce (nonce s n) \\ parts {Y};\nok evs R s |] ==> n \\ newn R\"\nby (auto simp: ok_def dest: not_used_not_spied parts_parts)\n\nsubsection\\unicity\\\n\ndefinition uniq :: \"proto \\ secfun \\ bool\" where\n\"uniq p secret \\ \\evs R R' n n' Ks s s'. R \\ p \\ R' \\ p \\\nn \\ newn R \\ n' \\ newn R' \\ nonce s n = nonce s' n' \\\nNonce (nonce s n) \\ parts {apm' s R} \\ Nonce (nonce s n) \\ parts {apm' s' R'} \\\napm' s R \\ guard (nonce s n) Ks \\ apm' s' R' \\ guard (nonce s n) Ks \\\nevs \\ tr p \\ Nonce (nonce s n) \\ analz (spies evs) \\\nsecret R n s Ks \\ parts (spies evs) \\ secret R' n' s' Ks \\ parts (spies evs) \\\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniqD: \"[| uniq p secret; evs \\ tr p; R \\ p; R' \\ p; n \\ newn R; n' \\ newn R';\nnonce s n = nonce s' n'; Nonce (nonce s n) \\ analz (spies evs);\nNonce (nonce s n) \\ parts {apm' s R}; Nonce (nonce s n) \\ parts {apm' s' R'};\nsecret R n s Ks \\ parts (spies evs); secret R' n' s' Ks \\ parts (spies evs);\napm' s R \\ guard (nonce s n) Ks; apm' s' R' \\ guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq_def, blast)\n\ndefinition ord :: \"proto \\ (rule \\ rule \\ bool) \\ bool\" where\n\"ord p inff \\ \\R R'. R \\ p \\ R' \\ p \\ \\ inff R R' \\ inff R' R\"\n\nlemma ordD: \"[| ord p inff; \\ inff R R'; R \\ p; R' \\ p |] ==> inff R' R\"\nby (unfold ord_def, blast)\n\ndefinition uniq' :: \"proto \\ (rule \\ rule \\ bool) \\ secfun \\ bool\" where\n\"uniq' p inff secret \\ \\evs R R' n n' Ks s s'. R \\ p \\ R' \\ p \\\ninff R R' \\ n \\ newn R \\ n' \\ newn R' \\ nonce s n = nonce s' n' \\\nNonce (nonce s n) \\ parts {apm' s R} \\ Nonce (nonce s n) \\ parts {apm' s' R'} \\\napm' s R \\ guard (nonce s n) Ks \\ apm' s' R' \\ guard (nonce s n) Ks \\\nevs \\ tr p \\ Nonce (nonce s n) \\ analz (spies evs) \\\nsecret R n s Ks \\ parts (spies evs) \\ secret R' n' s' Ks \\ parts (spies evs) \\\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniq'D: \"[| uniq' p inff secret; evs \\ tr p; inff R R'; R \\ p; R' \\ p; n \\ newn R;\nn' \\ newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) \\ analz (spies evs);\nNonce (nonce s n) \\ parts {apm' s R}; Nonce (nonce s n) \\ parts {apm' s' R'};\nsecret R n s Ks \\ parts (spies evs); secret R' n' s' Ks \\ parts (spies evs);\napm' s R \\ guard (nonce s n) Ks; apm' s' R' \\ guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq'_def, blast)\n\nlemma uniq'_imp_uniq: \"[| uniq' p inff secret; ord p inff |] ==> uniq p secret\"\napply (unfold uniq_def)\napply (rule allI)+\napply (case_tac \"inff R R'\")\napply (blast dest: uniq'D)\nby (auto dest: ordD uniq'D intro: sym)\n\nsubsection\\Needham-Schroeder-Lowe\\\n\ndefinition a :: agent where \"a == Friend 0\"\ndefinition b :: agent where \"b == Friend 1\"\ndefinition a' :: agent where \"a' == Friend 2\"\ndefinition b' :: agent where \"b' == Friend 3\"\ndefinition Na :: nat where \"Na == 0\"\ndefinition Nb :: nat where \"Nb == 1\"\n\nabbreviation\n ns1 :: rule where\n \"ns1 == ({}, Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\))\"\n\nabbreviation\n ns2 :: rule where\n \"ns2 == ({Says a' b (Crypt (pubK b) \\Nonce Na, Agent a\\)},\n Says b a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\))\"\n\nabbreviation\n ns3 :: rule where\n \"ns3 == ({Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\),\n Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)},\n Says a b (Crypt (pubK b) (Nonce Nb)))\"\n\ninductive_set ns :: proto where\n [iff]: \"ns1 \\ ns\"\n| [iff]: \"ns2 \\ ns\"\n| [iff]: \"ns3 \\ ns\"\n\nabbreviation (input)\n ns3a :: event where\n \"ns3a == Says a b (Crypt (pubK b) \\Nonce Na, Agent a\\)\"\n\nabbreviation (input)\n ns3b :: event where\n \"ns3b == Says b' a (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\"\n\ndefinition keys :: \"keyfun\" where\n\"keys R' s' n evs == {priK' s' a, priK' s' b}\"\n\nlemma \"monoton ns keys\"\nby (simp add: keys_def monoton_def)\n\ndefinition secret :: \"secfun\" where\n\"secret R n s Ks ==\n(if R=ns1 then apm s (Crypt (pubK b) \\Nonce Na, Agent a\\)\nelse if R=ns2 then apm s (Crypt (pubK a) \\Nonce Na, Nonce Nb, Agent b\\)\nelse Number 0)\"\n\ndefinition inf :: \"rule => rule => bool\" where\n\"inf R R' == (R=ns1 | (R=ns2 & R'~=ns1) | (R=ns3 & R'=ns3))\"\n\nlemma inf_is_ord [iff]: \"ord ns inf\"\napply (unfold ord_def inf_def)\napply (rule allI)+\napply (rule impI)\napply (simp add: split_paired_all)\nby (rule impI, erule ns.cases, simp_all)+\n\nsubsection\\general properties\\\n\nlemma ns_has_only_Says' [iff]: \"has_only_Says' ns\"\napply (unfold has_only_Says'_def)\napply (rule allI, rule impI)\napply (simp add: split_paired_all)\nby (erule ns.cases, auto)\n\nlemma newn_ns1 [iff]: \"newn ns1 = {Na}\"\nby (simp add: newn_def)\n\nlemma newn_ns2 [iff]: \"newn ns2 = {Nb}\"\nby (auto simp: newn_def Na_def Nb_def)\n\nlemma newn_ns3 [iff]: \"newn ns3 = {}\"\nby (auto simp: newn_def)\n\nlemma ns_wdef [iff]: \"wdef ns\"\nby (auto simp: wdef_def elim: ns.cases)\n\nsubsection\\guardedness for NSL\\\n\nlemma \"uniq ns secret ==> preserv ns keys n Ks\"\napply (unfold preserv_def)\napply (rule allI)+\napply (rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule fresh_ruleD, simp, simp, simp, simp)\napply (rule allI)+\napply (rule impI, rule impI, rule impI)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* fresh with NS1 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Na = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Na = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* fresh with NS2 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Nb = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Nb = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* fresh with NS3 *)\nby simp\n\nsubsection\\unicity for NSL\\\n\nlemma \"uniq' ns inf secret\"\napply (unfold uniq'_def)\napply (rule allI)+\napply (simp add: split_paired_all)\napply (rule impI, erule ns.cases)\n(* R = ns1 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp)\napply (drule ok_parts_not_new, simp, simp, simp)\napply (clarify, drule ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (simp add: secret_def)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Na in ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns3 *)\napply simp\n(* R = ns2 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (simp only: inf_def, blast)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (simp add: secret_def)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\napply (erule disjE, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\nby (simp_all add: secret_def)\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Guard/Proto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5, "lm_q1q2_score": 0.26949161034384206}} {"text": "theory RB\nimports LTS ArcExt SubExt\nbegin\n\nsection \\Red-Black Graphs\\\n\ntext \\In this section we define red\\hyp{}black graphs and the five operators that perform over \nthem. Then, we state and prove a number of intermediate lemmas about red\\hyp{}black graphs \nbuilt using only these five operators, in other words: invariants about our method of transformation \nof red\\hyp{}black graphs.\n\nThen, we define the notion of red\\hyp{}black paths and state and prove the main properties of our \nmethod, namely its correctness and the fact that it preserves the set of feasible paths of the \nprogram under analysis.\\\n\nsubsection \\Basic Definitions\\\n\nsubsubsection \\The type of Red-Black Graphs\\\n\ntext \\We represent red-black graph with the following record. We detail its fields:\n\\begin{itemize}\n \\item @{term \"red\"} is the red graph, called \\emph{red part}, which represents the unfolding of \nthe black part. Its vertices are indexed black vertices,\n \\item @{term \"black\"} is the original LTS, the \\emph{black part},\n \\item @{term \"subs\"} is the subsumption relation over the vertices of @{term \"red\"},\n \\item @{term \"init_conf\"} is the initial configuration,\n \\item @{term \"confs\"} is a function associating configurations to the vertices of @{term \"red\"},\n \\item @{term \"marked\"} is a function associating truth values to the vertices of @{term \"red\"}. \nWe use it to represent the fact that a particular configuration (associated to a red location) is \nknown to be unsatisfiable,\n \\item @{term \"strengthenings\"} is a function associating boolean expressions over program \nvariables to vertices of the red graph. Those boolean expressions can be seen as invariants that \nthe configuration associated to the ``strengthened'' red vertex has to model.\n\\end{itemize}\n\nWe are only interested by red-black graphs obtained by the inductive relation \n@{term \"RedBlack\"}. From now on, we call ``red-black graphs\" the @{term pre_RedBlack}'s \nobtained by @{term \"RedBlack\"} and ``pre-red-black graphs\" all other ones.\\\n\nrecord ('vert,'var,'d) pre_RedBlack =\n red :: \"('vert \\ nat) rgraph\"\n black :: \"('vert,'var,'d) lts\"\n subs :: \"'vert sub_rel_t\"\n init_conf :: \"('var,'d) conf\"\n confs :: \"('vert \\ nat) \\ ('var,'d) conf\"\n marked :: \"('vert \\ nat) \\ bool\"\n strengthenings :: \"('vert \\ nat) \\ ('var,'d) bexp\"\n\n\ntext\\We call \\emph{red vertices} the set of vertices of the red graph.\\\n\n\nabbreviation red_vertices :: \n \"('vert,'var,'d,'x) pre_RedBlack_scheme \\ ('vert \\ nat) set\" \nwhere\n \"red_vertices lts \\ Graph.vertices (red lts)\"\n\n\ntext\\@{term \"ui_edge\"} is the operation of ``unindexing'' the ends of a red edge, thus giving the \ncorresponding black edge.\\\n\n\nabbreviation ui_edge :: \n \"('vert \\ nat) edge \\ 'vert edge\" \nwhere\n \"ui_edge e \\ \\ src = fst (src e), tgt = fst (tgt e) \\\"\n\n\ntext \\We extend this idea to sequences of edges.\\\n\n\nabbreviation ui_es ::\n \"('vert \\ nat) edge list \\ 'vert edge list\"\nwhere\n \"ui_es es \\ map ui_edge es\"\n\n\n\nsubsubsection \\Well-formed and finite red-black graphs\\\n\nlocale pre_RedBlack =\n fixes prb :: \"('vert,'var,'d) pre_RedBlack\" (structure)\n\n\ntext \\A pre-red-black graph is well-formed if :\n\\begin{itemize}\n \\item its red and black parts are well-formed,\n \\item the root of its red part is an indexed version of the root of its black part,\n \\item all red edges are indexed versions of black edges. \n\\end{itemize}\\\n\nlocale wf_pre_RedBlack = pre_RedBlack +\n assumes red_wf : \"wf_rgraph (red prb)\"\n assumes black_wf : \"wf_lts (black prb)\"\n assumes consistent_roots : \"fst (root (red prb)) = root (black prb)\"\n assumes ui_re_are_be : \"e \\ edges (red prb) \\ ui_edge e \\ edges (black prb)\"\nbegin\n lemmas wf_pre_RedBlack = red_wf black_wf consistent_roots ui_re_are_be\nend\n\n\ntext\\We say that a pre-red-black graph is finite if :\n\\begin{itemize}\n \\item the path predicate of its initial configuration contains a finite number of constraints,\n \\item each of these constraints contains a finite number of variables,\n \\item its black part is finite (cf. definition of @{term \"finite_lts\"}.).\n\\end{itemize}\\\n\n\nlocale finite_RedBlack = pre_RedBlack +\n assumes finite_init_pred : \"finite (pred (init_conf prb))\"\n assumes finite_init_pred_symvars : \"\\ e \\ pred (init_conf prb). finite (Bexp.vars e)\"\n assumes finite_lts : \"finite_lts (black prb)\"\nbegin\n lemmas finite_RedBlack = finite_init_pred finite_init_pred_symvars finite_lts\nend\n\n\n\n\n\n\nsubsection \\Extensions of Red-Black Graphs\\\n\ntext \\We now define the five basic operations that can be performed over red-black graphs. Since \nwe do not want to model the heuristics part of our prototype, a number of conditions must be met \nfor each operator to apply. For example, in our prototype abstractions are performed at nodes that \nactually have successors, and these abstractions must be propagated to these successors in order to \nkeep the symbolic execution graph consistent. Propagation is a complex task, and it is hard to model \nin Isabelle/HOL. This is partially due to the fact that we model the red part as a graph, in which \npropagation might not terminate. Instead, we suppose that abstraction must be performed only at \nleaves of the red part. This is equivalent to implicitly assume the existence of an oracle that \nwould tell that we will need to abstract some red vertex and how to abstract it, as soon as this red \nvertex is added to the red part.\\\n\ntext \\As in the previous theories, we use predicates instead of functions to model these \ntransformations to ease writing and reading definitions, proofs, etc.\\\n\nsubsubsection \\Extension by symbolic execution\\\n\ntext\\The core abstract operation of symbolic execution: take a black edge and\nturn it red, by symbolic execution of its label. In the following abbreviation, @{term re} is the \nred edge obtained from the (hypothetical) black edge @{term e} that we want to symbolically execute \nand @{term c} the configuration obtained by symbolic execution of the label of @{term e}. Note that \nthis extension could have been defined as a \npredicate that takes only two @{term pre_RedBlack}s and evaluates to \\emph{true} if and only if \nthe second has been obtained by adding a red edge as a result of symbolic execution. However, \nmaking the red edge and the configuration explicit allows for lighter definitions, lemmas and proofs \nin the following.\\\n\nabbreviation se_extends :: \n \"('vert,'var,'d) pre_RedBlack \n \\ ('vert \\ nat) edge \n \\ ('var,'d) conf \n \\ ('vert,'var,'d) pre_RedBlack \\ bool\"\nwhere\n \"se_extends prb re c prb' \\ \n ui_edge re \\ edges (black prb) \n \\ ArcExt.extends (red prb) re (red prb') \n \\ src re \\ subsumees (subs prb)\n \\ se (confs prb (src re)) (labelling (black prb) (ui_edge re)) c\n \\ prb' = \\ red = red prb',\n black = black prb,\n subs = subs prb,\n init_conf = init_conf prb,\n confs = (confs prb) (tgt re := c),\n marked = (marked prb)(tgt re := marked prb (src re)),\n strengthenings = strengthenings prb \\\"\n\n\ntext \\Hiding the new red edge (using an existential quantifier) and the new configuration makes \nthe following abbreviation more \nintuitive. However, this would require using \\verb?obtain? or \\verb?let ... = ... in ...? constructs \nin the following lemmas and proofs, making them harder to read and write.\\\n\nabbreviation se_extends2 :: \n \"('vert,'var,'d) pre_RedBlack \\ ('vert,'var,'d) pre_RedBlack \\ bool\"\nwhere\n \"se_extends2 prb prb' \\ \n \\ re \\ edges (red prb'). \n ui_edge re \\ edges (black prb)\n \\ ArcExt.extends (red prb) re (red prb') \n \\ src re \\ subsumees (subs prb)\n \\ se (confs prb (src re)) (labelling (black prb) (ui_edge re)) (confs prb' (tgt re))\n \\ black prb' = black prb\n \\ subs prb' = subs prb\n \\ init_conf prb' = init_conf prb\n \\ confs prb' = (confs prb) (tgt re := confs prb' (tgt re))\n \\ marked prb' = (marked prb)(tgt re := marked prb (src re))\n \\ strengthenings prb' = strengthenings prb\"\n\n\nsubsubsection \\Extension by marking\\\n\ntext\\The abstract operation of mark-as-unsat. It manages the information\n- provided, for example, by an external automated prover -, that the \nconfiguration of the red vertex @{term rv} has been proved unsatisfiable.\\\n\nabbreviation mark_extends ::\n \"('vert,'var,'d) pre_RedBlack \\ ('vert \\ nat) \\ ('vert,'var,'d) pre_RedBlack \\ bool\"\nwhere\n \"mark_extends prb rv prb' \\ \n rv \\ red_vertices prb\n \\ out_edges (red prb) rv = {}\n \\ rv \\ subsumees (subs prb)\n \\ rv \\ subsumers (subs prb)\n \\ \\ sat (confs prb rv)\n \\ prb' = \\ red = red prb,\n black = black prb,\n subs = subs prb,\n init_conf = init_conf prb,\n confs = confs prb,\n marked = (\\ rv'. if rv' = rv then True else marked prb rv'),\n strengthenings = strengthenings prb,\n \\ = more prb \\ \"\n\n\nsubsubsection \\Extension by subsumption\\\n\ntext\\The abstract operation of introducing a subsumption link.\\\n\nabbreviation subsum_extends ::\n \"('vert,'var,'d) pre_RedBlack \\ 'vert sub_t \\ ('vert,'var,'d) pre_RedBlack \\ bool\"\nwhere\n \"subsum_extends prb sub prb' \\\n SubExt.extends (red prb) (subs prb) sub (subs prb')\n \\ \\ marked prb (subsumer sub)\n \\ \\ marked prb (subsumee sub)\n \\ confs prb (subsumee sub) \\ confs prb (subsumer sub)\n \\ prb' = \\ red = red prb,\n black = black prb,\n subs = insert sub (subs prb),\n init_conf = init_conf prb,\n confs = confs prb,\n marked = marked prb,\n strengthenings = strengthenings prb,\n \\ = more prb \\\"\n\n\nsubsubsection \\Extension by abstraction\\\n\ntext\\This operation replaces the configuration of a red vertex @{term rv} by an abstraction of \nthis configuration. The way the abstraction is computed is not specified. However, besides a number \nof side conditions, it must subsume the former configuration of @{term rv} and must entail its \nsafeguard condition, if any.\\\n\nabbreviation abstract_extends ::\n \"('vert,'var,'d) pre_RedBlack \n \\ ('vert \\ nat) \n \\ ('var,'d) conf \n \\ ('vert,'var,'d) pre_RedBlack \n \\ bool\"\nwhere\n \"abstract_extends prb rv c\\<^sub>a prb' \\ \n rv \\ red_vertices prb\n \\ \\ marked prb rv \n \\ out_edges (red prb) rv = {} \n \\ rv \\ subsumees (subs prb)\n \\ abstract (confs prb rv) c\\<^sub>a\n \\ c\\<^sub>a \\\\<^sub>c (strengthenings prb rv)\n \\ finite (pred c\\<^sub>a)\n \\ (\\ e \\ pred c\\<^sub>a. finite (vars e))\n \\ prb' = \\ red = red prb, \n black = black prb, \n subs = subs prb, \n init_conf = init_conf prb,\n confs = (confs prb)(rv := c\\<^sub>a),\n marked = marked prb,\n strengthenings = strengthenings prb,\n \\ = more prb \\\"\n \n\nsubsubsection \\Extension by strengthening\\\n\ntext \\This operation consists in labeling a red vertex with a safeguard condition. It does not \nactually change the red part, but model the mechanism of preventing too crude abstractions.\\\n\nabbreviation strengthen_extends ::\n \"('vert,'var,'d) pre_RedBlack \n \\ ('vert \\ nat) \n \\ ('var,'d) bexp \n \\ ('vert,'var,'d) pre_RedBlack \n \\ bool\"\nwhere\n \"strengthen_extends prb rv e prb' \\ \n rv \\ red_vertices prb\n \\ rv \\ subsumees (subs prb)\n \\ confs prb rv \\\\<^sub>c e\n \\ prb' = \\ red = red prb, \n black = black prb, \n subs = subs prb, \n init_conf = init_conf prb,\n confs = confs prb,\n marked = marked prb,\n strengthenings = (strengthenings prb)(rv := (\\ \\. (strengthenings prb rv) \\ \\ e \\)),\n \\ = more prb \\\"\n\n\n\nsubsection \\Building Red-Black Graphs using Extensions\\\n\n\ntext\\Red-black graphs are pre-red-black graphs built with the following inductive relation, i.e.\\ \nusing only the five previous pre-red-black graphs transformation operators, starting from an \nempty red part.\\\n\ninductive RedBlack ::\n \"('vert,'var,'d) pre_RedBlack \\ bool\"\nwhere\n base : \n \"fst (root (red prb)) = init (black prb) \\\n edges (red prb) = {} \\\n subs prb = {} \\\n (confs prb) (root (red prb)) = init_conf prb \\\n marked prb = (\\ rv. False) \\ \n strengthenings prb = (\\ rv. (\\ \\. True)) \\ RedBlack prb\"\n\n| se_step : \n \"RedBlack prb \\\n se_extends prb re p' prb' \\ RedBlack prb'\"\n\n| mark_step : \n \"RedBlack prb \\\n mark_extends prb rv prb' \\ RedBlack prb'\"\n \n| subsum_step : \n \"RedBlack prb \\\n subsum_extends prb sub prb' \\ RedBlack prb'\"\n \n| abstract_step : \n \"RedBlack prb \\ \n abstract_extends prb rv c\\<^sub>a prb' \\ RedBlack prb'\"\n\n| strengthen_step :\n \"RedBlack prb \\ \n strengthen_extends prb rv e prb' \\ RedBlack prb'\"\n\n\nsubsection \\Properties of Red-Black-Graphs\\\n\nsubsubsection\\Invariants of the Red\\hyp{}Black Graphs\\\n\n\ntext\\The red part of a red-black graph is loop free.\\\n\nlemma\n assumes \"RedBlack prb\"\n shows \"loop_free (red prb)\"\nusing assms by (induct prb) auto\n\n\ntext\\A red edge can not lead to the (red) root.\\\n\n\nlemma \n assumes \"RedBlack prb\"\n assumes \"re \\ edges (red prb)\"\n shows \"tgt re \\ root (red prb)\"\nusing assms by (induct prb) (auto simp add : vertices_def)\n\n\ntext\\Red edges are specific versions of black edges.\\\n\nlemma ui_re_is_be :\n assumes \"RedBlack prb\"\n assumes \"re \\ edges (red prb)\"\n shows \"ui_edge re \\ edges (black prb)\"\nusing assms by (induct rule : RedBlack.induct) auto\n\n\ntext\\The set of out-going edges from a red vertex is a subset of the set of out-going edges from \nthe black location it represents.\\\n\nlemma red_OA_subset_black_OA :\n assumes \"RedBlack prb\"\n shows \"ui_edge ` out_edges (red prb) rv \\ out_edges (black prb) (fst rv)\"\nusing assms by (induct prb) (fastforce simp add : vertices_def)+\n\n\ntext \\The red root is an indexed version of the black initial location.\\\n\nlemma consistent_roots :\n assumes \"RedBlack prb\"\n shows \"fst (root (red prb)) = init (black prb)\"\nusing assms by (induct prb) auto\n\n\n\ntext\\The red part of a red-black graph is a tree.\\\n\nlemma \n assumes \"RedBlack prb\"\n shows \"is_tree (red prb)\"\nusing assms \nby (induct prb) (auto simp add : empty_graph_is_tree ArcExt.extends_is_tree)\n\n \ntext \\A red-black graph whose black part is well-formed is also well-formed.\\\n\nlemma\n assumes \"RedBlack prb\"\n assumes \"wf_lts (black prb)\"\n shows \"wf_pre_RedBlack prb\"\nproof -\n have \"wf_rgraph (red prb)\"\n using assms by (induct prb) (force simp add : vertices_def)+\n\n thus ?thesis \n using assms consistent_roots ui_re_is_be \n by (auto simp add : wf_pre_RedBlack_def)\nqed\n\n\ntext \\Red locations of a red-black graph are indexed versions of its black locations.\\\n\nlemma ui_rv_is_bv :\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"fst rv \\ Graph.vertices (black prb)\"\nusing assms consistent_roots ui_re_is_be \nby (auto simp add : vertices_def image_def Bex_def) fastforce+\n\n\n\ntext \\The subsumption of a red-black graph is a sub-relation of its red part.\\\n\nlemma subs_sub_rel_of :\n assumes \"RedBlack prb\"\n shows \"sub_rel_of (red prb) (subs prb)\"\nusing assms unfolding sub_rel_of_def\nproof (induct prb)\n case base thus ?case by simp\nnext\n case se_step thus ?case by (elim conjE) (auto simp add : vertices_def)\nnext \n case mark_step thus ?case by auto\nnext\n case subsum_step thus ?case by auto\nnext\n case abstract_step thus ?case by simp\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\n\ntext\\The subsumption relation of red-black graph is well-formed.\\\n\nlemma subs_wf_sub_rel :\n assumes \"RedBlack prb\"\n shows \"wf_sub_rel (subs prb)\"\nusing assms\nproof (induct prb)\n case base thus ?case by (simp add : wf_sub_rel_def)\nnext\n case se_step thus ?case by force\nnext\n case mark_step thus ?case by (auto simp add : wf_sub_rel_def)\nnext\n case subsum_step thus ?case by (auto simp add : wf_sub_rel.extends_imp_wf_sub_rel)\nnext\n case abstract_step thus ?case by simp\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\ntext \\Using the two previous lemmas, we have that the subsumption relation of a red-black graph \nis a well-formed sub-relation of its red-part.\\\n\nlemma subs_wf_sub_rel_of :\n assumes \"RedBlack prb\"\n shows \"wf_sub_rel_of (red prb) (subs prb)\"\nusing assms subs_sub_rel_of subs_wf_sub_rel by (simp add : wf_sub_rel_of_def) fast\n\n\ntext\\Subsumptions only involve red locations representing the same black location.\\\n\nlemma subs_to_same_BL :\n assumes \"RedBlack prb\"\n assumes \"sub \\ subs prb\"\n shows \"fst (subsumee sub) = fst (subsumer sub)\"\nusing assms subs_wf_sub_rel unfolding wf_sub_rel_def by fast\n\n\ntext\\If a red edge sequence @{term \"res\"} is consistent between red locations @{term \"rv1\"} and \n@{term \"rv2\"} with respect to the subsumption relation of a red-black graph, then its unindexed \nversion is consistent between the black locations represented by @{term \"rv1\"} and @{term \"rv2\"}.\\\n\nlemma rces_imp_bces :\n assumes \"RedBlack prb\"\n assumes \"SubRel.ces rv1 res rv2 (subs prb)\" \n shows \"Graph.ces (fst rv1) (ui_es res) (fst rv2)\"\nusing assms\nproof (induct res arbitrary : rv1)\n case (Nil rv1) thus ?case \n using wf_sub_rel.in_trancl_imp[OF subs_wf_sub_rel] subs_to_same_BL\n by fastforce\nnext\n case (Cons re res rv1)\n\n hence 1 : \"rv1 = src re \\ (rv1, src re) \\ (subs prb)\\<^sup>+\"\n and 2 : \"ces (tgt re) res rv2 (subs prb)\" by simp_all\n\n have \"src (ui_edge re) = fst rv1\"\n using 1 wf_sub_rel.in_trancl_imp[OF subs_wf_sub_rel[OF assms(1)], of rv1 \"src re\"]\n subs_to_same_BL[OF assms(1), of \"(rv1,src re)\"]\n by auto\n \n moreover \n have \"Graph.ces (tgt (ui_edge re)) (ui_es res) (fst rv2)\" \n using assms(1) Cons(1) 2 by simp\n\n ultimately\n show ?case by simp\nqed\n\n\ntext\\The unindexed version of a subpath in the red part of a red-black graph is a subpath in its \nblack part. This is an important fact: in the end, it helps proving that set of paths we consider \nin red-black graphs are paths of the original LTS. Thus, the same states are computed along \nthese paths.\\\n\ntheorem red_sp_imp_black_sp :\n assumes \"RedBlack prb\"\n assumes \"subpath (red prb) rv1 res rv2 (subs prb)\"\n shows \"Graph.subpath (black prb) (fst rv1) (ui_es res) (fst rv2)\"\nusing assms rces_imp_bces ui_rv_is_bv ui_re_is_be\nunfolding subpath_def Graph.subpath_def by (intro conjI) (fast, fast, fastforce)\n\n\ntext\\Any constraint in the path predicate of a configuration associated to a red location of a \nred-black graph contains a finite number of variables.\\\n\nlemma finite_pred_constr_symvars :\n assumes \"RedBlack prb\"\n assumes \"finite_RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"\\ e \\ pred (confs prb rv). finite (Bexp.vars e)\"\nusing assms\nproof (induct prb arbitrary : rv)\n case base thus ?case by (simp add : vertices_def finite_RedBlack_def)\nnext\n case (se_step prb re c' prb') \n\n hence \"rv \\ red_vertices prb \\ rv = tgt re\" by (auto simp add : vertices_def)\n \n thus ?case \n proof (elim disjE)\n assume \"rv \\ red_vertices prb\"\n\n moreover\n have \"finite_RedBlack prb\" \n using se_step(3,4) by (auto simp add : finite_RedBlack_def)\n\n ultimately\n show ?thesis \n using se_step(2,3) by (elim conjE) (auto simp add : vertices_def)\n next\n assume \"rv = tgt re\"\n\n moreover\n have \"finite_label (labelling (black prb) (ui_edge re))\"\n using se_step by (auto simp add : finite_RedBlack_def)\n\n moreover\n have \"\\ e \\ pred (confs prb (src re)). finite (Bexp.vars e)\"\n using se_step se_step(2)[of \"src re\"] unfolding finite_RedBlack_def \n by (elim conjE) auto\n\n moreover\n have \"se (confs prb (src re)) (labelling (black prb) (ui_edge re)) c'\"\n using se_step by auto\n\n ultimately\n show ?thesis using se_step se_preserves_finiteness1 by fastforce\n qed\nnext\n case mark_step thus ?case by (simp add : finite_RedBlack_def)\nnext\n case subsum_step thus ?case by (simp add : finite_RedBlack_def)\nnext\n case abstract_step thus ?case by (auto simp add : finite_RedBlack_def)\nnext\n case strengthen_step thus ?case by (simp add : finite_RedBlack_def)\nqed\n\n\ntext \\The path predicate of a configuration associated to a red location of a \nred-black graph contains a finite number of constraints.\\\n\nlemma finite_pred :\n assumes \"RedBlack prb\"\n assumes \"finite_RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"finite (pred (confs prb rv))\"\nusing assms\nproof (induct prb arbitrary : rv)\n case base thus ?case by (simp add : vertices_def finite_RedBlack_def)\nnext\n case (se_step prb re c' prb')\n\n hence \"rv \\ red_vertices prb \\ rv = tgt re\" \n by (auto simp add : vertices_def)\n\n thus ?case \n proof (elim disjE, goal_cases)\n case 1 thus ?thesis \n using se_step(2)[of rv] se_step(3,4) \n by (auto simp add : finite_RedBlack_def)\n next\n case 2\n moreover\n hence \"src re \\ red_vertices prb\"\n and \"finite (pred (confs prb (src re)))\" \n using se_step(2)[of \"src re\"] se_step(3,4) \n by (auto simp add : finite_RedBlack_def)\n \n ultimately\n show ?thesis\n using se_step(3) se_preserves_finiteness2 by auto\n qed\nnext\n case mark_step thus ?case by (simp add : finite_RedBlack_def)\nnext\n case subsum_step thus ?case by (simp add : finite_RedBlack_def)\nnext\n case abstract_step thus ?case by (simp add : finite_RedBlack_def)\nnext\n case strengthen_step thus ?case by (simp add : finite_RedBlack_def)\nqed\n\n\ntext\\Hence, for a red location @{term \"rv\"} of a red-black graph and any label @{term \"l\"}, \nthere exists a configuration that can be obtained by symbolic execution of @{term \"l\"} from the \nconfiguration associated to @{term \"rv\"}.\\\n\nlemma (in finite_RedBlack) ex_se_succ :\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"\\ c'. se (confs prb rv) l c'\"\nusing finite_RedBlack assms \n finite_imp_ex_se_succ[of \"confs prb rv\"]\n finite_pred[of prb rv ]\n finite_pred_constr_symvars[of prb rv]\nunfolding finite_RedBlack_def by fast\n\n\n\ntext\\Generalization of the previous lemma to a list of labels.\\\n\nlemma (in finite_RedBlack) ex_se_star_succ :\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n assumes \"finite_labels ls\"\n shows \"\\ c'. se_star (confs prb rv) ls c'\"\nusing finite_RedBlack assms \n finite_imp_ex_se_star_succ[of \"confs prb rv\" ls]\n finite_pred[OF assms(1), of rv] \n finite_pred_constr_symvars[OF assms(1), of rv]\nunfolding finite_RedBlack_def by simp\n\n\ntext\\Hence, for any red sub-path, there exists a configuration that can be obtained by symbolic \nexecution of its trace from the configuration associated to its source.\\\n\nlemma (in finite_RedBlack) sp_imp_ex_se_star_succ :\n assumes \"RedBlack prb\"\n assumes \"subpath (red prb) rv1 res rv2 (subs prb)\"\n shows \"\\ c. se_star \n (confs prb rv1) \n (trace (ui_es res) (labelling (black prb))) \n c\"\nusing finite_RedBlack assms ex_se_star_succ \nby (simp add : subpath_def finite_RedBlack_def)\n\n\ntext\\The configuration associated to a red location @{term \"rl\"} is update-able.\\\n\nlemma (in finite_RedBlack)\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"updatable (confs prb rv)\"\nusing finite_RedBlack assms \n finite_conj[OF finite_pred[OF assms(1)] \n finite_pred_constr_symvars[OF assms(1)]]\n finite_pred_imp_se_updatable\nunfolding finite_RedBlack_def by fast\n\n\ntext\\The configuration associated to the first member of a subsumption is subsumed by the \nconfiguration at its second member.\\\n\nlemma sub_subsumed :\n assumes \"RedBlack prb\"\n assumes \"sub \\ subs prb\"\n shows \"confs prb (subsumee sub) \\ confs prb (subsumer sub)\"\nusing assms\nproof (induct prb)\n case base thus ?case by simp \nnext\n case (se_step prb re c' prb')\n\n moreover\n hence \"sub \\ subs prb\" by auto\n\n hence \"subsumee sub \\ red_vertices prb\" \n and \"subsumer sub \\ red_vertices prb\"\n using se_step(1) subs_sub_rel_of \n unfolding sub_rel_of_def by fast+\n\n moreover\n have \"tgt re \\ red_vertices prb\" using se_step by auto\n\n ultimately\n show ?case by auto\nnext\n case mark_step thus ?case by simp\nnext\n case (subsum_step prb sub prb') thus ?case by auto\nnext\n case (abstract_step prb rv c\\<^sub>a prb')\n\n hence \"rv \\ subsumee sub\" by auto\n\n show ?case \n proof (case_tac \"rv = subsumer sub\")\n assume \"rv = subsumer sub\"\n\n moreover\n hence \"confs prb (subsumer sub) \\ confs prb' (subsumer sub)\" \n using abstract_step abstract_def by auto\n \n ultimately\n show ?thesis \n using abstract_step\n subsums_trans[of \"confs prb (subsumee sub)\" \n \"confs prb (subsumer sub)\" \n \"confs prb' (subsumer sub)\"]\n by (simp add : subsums_refl)\n next\n assume \"rv \\ subsumer sub\" thus ?thesis using abstract_step \\rv \\ subsumee sub\\ by simp\n qed\nnext\n case strengthen_step thus ?case by simp\nqed\n\nsubsubsection\\Simplification lemmas for sub-paths of the red part.\\\n\nlemma rb_Nil_sp :\n assumes \"RedBlack prb\"\n shows \"subpath (red prb) rv1 [] rv2 (subs prb) = \n (rv1 \\ red_vertices prb \\ (rv1 = rv2 \\ (rv1,rv2) \\ (subs prb)))\"\nusing assms subs_wf_sub_rel subs_sub_rel_of wf_sub_rel.Nil_sp by fast\n\n\nlemma rb_sp_one :\n assumes \"RedBlack prb\"\n shows \"subpath (red prb) rv1 [re] rv2 (subs prb) = \n ( sub_rel_of (red prb) (subs prb)\n \\ (rv1 = src re \\ (rv1, src re) \\ (subs prb)) \n \\ re \\ edges (red prb) \\ (tgt re = rv2 \\ (tgt re, rv2) \\ (subs prb)))\"\nusing assms subs_wf_sub_rel_of wf_sub_rel_of.sp_one by fast\n\n\nlemma rb_sp_Cons :\n assumes \"RedBlack prb\"\n shows \"subpath (red prb) rv1 (re # res) rv2 (subs prb) =\n ( sub_rel_of (red prb) (subs prb)\n \\ (rv1 = src re \\ (rv1, src re) \\ subs prb) \n \\ re \\ edges (red prb) \n \\ subpath (red prb) (tgt re) res rv2 (subs prb))\"\nusing assms subs_wf_sub_rel_of wf_sub_rel_of.sp_Cons by fast\n\n\nlemma rb_sp_append_one :\n assumes \"RedBlack prb\"\n shows \"subpath (red prb) rv1 (res @ [re]) rv2 (subs prb) =\n ( subpath (red prb) rv1 res (src re) (subs prb) \n \\ re \\ edges (red prb) \n \\ (tgt re = rv2 \\ (tgt re, rv2) \\ subs prb))\"\nusing assms subs_wf_sub_rel wf_sub_rel.sp_append_one sp_append_one by fast\n\n\nsubsection \\Relation between red-vertices\\\n\ntext\\The following key-theorem describes the relation between two red locations that are linked by \na red sub-path. In a classical symbolic execution tree, the configuration at the end should be the \nresult of symbolic execution of the trace of the sub-path from the configuration at its source. \nHere, due to the facts that abstractions might have occurred and that we consider sub-paths going \nthrough subsumption links, the configuration at the end subsumes the configuration one would obtain \nby symbolic execution of the trace. Note however that this is only true for configurations computed \nduring the analysis: concrete execution of the sub-paths would yield the same program states \nthan their counterparts in the original LTS.\\ \n\nthm RedBlack.induct[of x P]\n\ntheorem (in finite_RedBlack) SE_rel :\n assumes \"RedBlack prb\"\n assumes \"subpath (red prb) rv1 res rv2 (subs prb)\"\n assumes \"se_star (confs prb rv1) (trace (ui_es res) (labelling (black prb))) c\"\n shows \"c \\ (confs prb rv2)\"\nusing assms finite_RedBlack\nproof (induct arbitrary : rv1 res rv2 c rule : RedBlack.induct) \n (* If the red part is empty, then @{term \"rv1 = rv2 = root (red prb)\"}, and \n @{term \"confs prb rv1 = confs prb rv2\"} which prooves the goal, subsumption \n being reflexive. *) \n case (base prb rv1 res rv2 c) thus ?case \n by (force simp add : subpath_def Nil_sp subsums_refl)\n\nnext\n (* We split the goal into four cases :\n - rv1 and rv2 are vertices of the old red part,\n - rv1 is a vertex in the old red part, rv2 is the target of ra,\n - rv1 is the target of ra, rv2 is a vertex of the old red part,\n - rv1 are rv2 both equal to the target of ra. *)\n case (se_step prb re c' prb' rv1 res rv2 c)\n\n have \"rv1 \\ red_vertices prb'\"\n and \"rv2 \\ red_vertices prb'\"\n using fst_of_sp_is_vert[OF se_step(4)]\n lst_of_sp_is_vert[OF se_step(4)]\n by simp_all\n \n hence \"rv1 \\ red_vertices prb \\ rv1 \\ tgt re \\ rv1 = tgt re\"\n and \"rv2 \\ red_vertices prb \\ rv2 \\ tgt re \\ rv2 = tgt re\"\n using se_step by (auto simp add : vertices_def) \n\n thus ?case\n proof (elim disjE conjE, goal_cases)\n (* rv1 are rv2 vertices of the old red part *)\n case 1\n\n (* hence res is also a subpath from rv1 to rv2 in the old red part *)\n moreover\n hence \"subpath (red prb) rv1 res rv2 (subs prb)\"\n using se_step(1,3,4)\n sub_rel_of.sp_from_old_verts_imp_sp_in_old \n [OF subs_sub_rel_of, of prb re \"red prb'\" rv1 rv2 res]\n by auto\n\n (* thus, the IH can be used to conclude. *)\n ultimately\n show ?thesis using se_step \n by (fastforce simp add : finite_RedBlack_def)\n\n next \n (* rv1 is a vertex of the old red part, rv2 is the target of ra. *)\n case 2 \n\n (* hence res is empty or ra occurs only one time in res : at its end. *)\n hence \"\\ res'. res = res' @ [re]\n \\ re \\ set res'\n \\ subpath (red prb) rv1 res' (src re) (subs prb)\"\n using se_step \n sub_rel_of.sp_to_new_edge_tgt_imp[OF subs_sub_rel_of, of prb re \"red prb'\" rv1 res]\n by auto \n\n thus ?thesis\n proof (elim exE conjE)\n (* If res = res'@[ra], then there exists a configuration c' such that :\n - c' is obtained from (confs prb rv1) by symbolic execution of (the trace of) res,\n - c' is subsumed by (confs prb (src ra)) (by IH),\n - c is obtained from c' by symbolic execution of (the label of) ra.\n\n Moreover, we have :\n - (confs prb rv2) is obtained from (confs prb (src ra) by symbolic execution \n of (the label of) ra.\n\n Ultimately, we proof the goal by monotonicity of symbolic execution wrt subsumption. *) \n fix res'\n\n assume \"res = res' @ [re]\"\n and \"re \\ set res'\"\n and \"subpath (red prb) rv1 res' (src re) (subs prb)\"\n\n moreover\n then obtain c'\n where \"se_star (confs prb rv1) (trace (ui_es res') (labelling (black prb))) c'\"\n and \"se c' (labelling (black prb) (ui_edge re)) c\"\n using se_step 2 se_star_append_one by auto blast\n \n ultimately\n have \"c' \\ (confs prb (src re))\" using se_step by fastforce\n\n thus ?thesis \n using se_step \\rv1 \\ tgt re\\ 2 \n \\se c' (labelling (black prb) (ui_edge re)) c\\\n by (auto simp add : se_mono_for_sub)\n qed\n next\n (* rv1 is the target of ra. Hence res is empty and rv2 also equals (tgt ra), \n which contradicts our hypothesis. *) \n case 3 \n\n moreover\n have \"rv1 = rv2\"\n proof - \n have \"(rv1,rv2) \\ (subs prb')\"\n using se_step 3 \n sub_rel_of.sp_from_tgt_in_extends_is_Nil\n [OF subs_sub_rel_of[OF se_step(1)], of re \"red prb'\" res rv2]\n rb_Nil_sp[OF RedBlack.se_step[OF se_step(1,3)], of rv1 rv2] \n by auto\n\n hence \"rv1 \\ subsumees (subs prb)\" using se_step(3) by force\n\n thus ?thesis \n using se_step \\rv1 = tgt re\\ subs_sub_rel_of[OF se_step(1)] \n by (auto simp add : sub_rel_of_def)\n qed\n\n ultimately\n show ?thesis by simp\n next\n (* Finally, if rv1 and rv2 both equal (tgt ra), then we conclude using the fact that \n the subsumption is reflexive. *)\n case 4\n\n moreover\n hence \"res = []\"\n using se_step \n sub_rel_of.sp_from_tgt_in_extends_is_Nil \n [OF subs_sub_rel_of[OF se_step(1)], of re \"red prb'\" res rv2]\n by auto\n\n ultimately\n show ?thesis using se_step by (simp add : subsums_refl)\n qed\n\nnext\n (* Marking a red vertex does not affect the configurations associated to red vertices,\n hence this case is trivial when observing that a subpath after marking is a subpath \n before marking (which allows to apply the IH). *)\n case (mark_step prb rv prb') thus ?case by simp\n\nnext\n case (subsum_step prb sub prb' rv1 res rv2 c)\n\n (* The fact that prb' is also red-black will be needed several times in the following. *)\n have RB' : \"RedBlack prb'\" by (rule RedBlack.subsum_step[OF subsum_step(1,3)])\n\n (* First, we suppose that res starts at the newly subsumed red vertex. *)\n show ?case \n proof (case_tac \"rv1 = subsumee sub\")\n\n (* In this case, res is either empty, or a subpath starting at the subsumer of the new \n subsumption. *)\n\n assume \"rv1 = subsumee sub\"\n\n hence \"res = [] \\ subpath (red prb') (subsumer sub) res rv2 (subs prb')\"\n using subsum_step(3,4) \n wf_sub_rel_of.sp_in_extends_imp1 [ OF subs_wf_sub_rel_of[OF subsum_step(1)], \n of \"subsumee sub\" \"subsumer sub\" ]\n by simp\n\n thus ?thesis\n proof (elim disjE)\n (* If res is empty, then rv1 equals rv2 or (rv1,rv2) is in the new subsumption relation. *)\n assume \"res = []\"\n\n hence \"rv1 = rv2 \\ (rv1,rv2) \\ (subs prb')\" \n using subsum_step rb_Nil_sp[OF RB'] by fast\n\n thus ?thesis \n proof (elim disjE)\n (* If rv1 = rv2, \"their\" configurations are also equal. Moreover, res being empty, c is the \n configuration at rv1. We conclude using reflexivity of subsumption. *)\n assume \"rv1 = rv2\" \n thus ?thesis \n using subsum_step(5) \\res = []\\ \n by (simp add : subsums_refl)\n next\n (* If (rv1, rv2) is in the new subsumption relation, then the configuration at rv1 is \n subsumed by the configuration at rv2. We conclude using the fact c is the configuration \n at rv1. *) \n assume \"(rv1, rv2) \\ (subs prb')\" \n thus ?thesis \n using subsum_step(5) \\res = []\\ \n sub_subsumed[OF RB', of \"(rv1,rv2)\"] \n by simp\n qed\n \n next\n (* If res is also a subpath from the subsumer of the new subsumption, we show the goal \n by (backward) induction on res *)\n assume \"subpath (red prb') (subsumer sub) res rv2 (subs prb')\"\n\n thus ?thesis \n using subsum_step(5)\n proof (induct res arbitrary : rv2 c rule : rev_induct, goal_cases)\n (* If the red subpath is empty, then (rv1,rv2) is the new subsumption, which gives the goal \n by definition of subsum_extends. *)\n case (1 rv2 c)\n\n have \"rv2 = subsumer sub\" \n proof -\n have \"(subsumer sub,rv2) \\ subs prb'\"\n proof (intro notI)\n assume \"(subsumer sub,rv2) \\ subs prb'\"\n\n hence \"subsumer sub \\ subsumees (subs prb')\" by force\n\n moreover\n have \"subsumer sub \\ subsumers (subs prb')\" \n using subsum_step(3) by force\n\n ultimately\n show False \n using subs_wf_sub_rel[OF RB'] \n unfolding wf_sub_rel_def \n by auto\n qed\n\n thus ?thesis using 1(1) rb_Nil_sp[OF RB'] by auto\n qed\n\n thus ?case \n using subsum_step(3) 1(2) \\rv1 = subsumee sub\\ by simp\n\n next\n (* Inductive case : the red subpath has the form res@[ra]. *)\n case (2 re res rv2 c)\n\n (* We call :\n - c' the configuration obtained by symbolic execution of res from the configuration at \n rv1,\n - c'' the configuration obtained by symbolic execution of ra from the configuration at \n the source of ra.\n\n We show that c' is subsumed by the configuration at the source of ra (using \"internal\" \n IH), hence c is subsumed by c'', by monotonicity of symbolic execution for subsumption.\n \n Moreover, we show that c'' is subsumed by the configuration at the target of ra, \n using the fact that [ra] is subpath from the source of ra to its target in the old \n red part with the \"external\" IH. \n\n Finally, we show that the configuration at the target of ra is subsumed by the \n configuration at rv2 by observing that the target of ra is either rv2, either subsumed \n by rv2. \n \n We conclude using transitivity of subsumption. *)\n\n hence A : \"subpath (red prb') (subsumer sub) res (src re) (subs prb')\"\n and B : \"subpath (red prb') (src re) [re] (tgt re) (subs prb')\"\n using subs_sub_rel_of[OF RB'] by (auto simp add : sp_append_one sp_one)\n\n obtain c' \n where C : \"se_star (confs prb' rv1) (trace (ui_es res) (labelling (black prb'))) c'\"\n and D : \"se c' (labelling (black prb') (ui_edge re)) c\"\n using 2 by (simp add : se_star_append_one) blast\n\n obtain c''\n where E : \"se (confs prb' (src re)) (labelling (black prb') (ui_edge re)) c''\"\n using subsum_step(6-8)\n \\subpath (red prb') (src re) [re] (tgt re) (subs prb')\\\n RB' finite_RedBlack.ex_se_succ[of prb' \"src re\"]\n unfolding finite_RedBlack_def\n by (simp add : se_star_one fst_of_sp_is_vert) blast \n\n have \"c \\ c''\"\n proof -\n have \"c' \\ confs prb' (src re)\" using 2(1) A B C D by fast\n thus ?thesis using D E se_mono_for_sub by fast\n qed\n\n moreover\n have \"c'' \\ confs prb' (tgt re)\" \n proof -\n have \"subpath (red prb) (src re) [re] (tgt re) (subs prb)\"\n proof -\n have \"src re \\ red_vertices prb'\"\n and \"tgt re \\ red_vertices prb'\" \n and \"re \\ edges (red prb')\"\n using B by (auto simp add : vertices_def sp_one)\n\n hence \"src re \\ red_vertices prb\"\n and \"tgt re \\ red_vertices prb\"\n and \"re \\ edges (red prb)\"\n using subsum_step(3) by auto\n\n thus ?thesis \n using subs_sub_rel_of[OF subsum_step(1)] \n by (simp add : sp_one)\n qed\n\n thus ?thesis \n using subsum_step(2,3,6-8) E \n by (simp add : se_star_one)\n qed\n\n moreover\n have \"confs prb' (tgt re) \\ confs prb' rv2\"\n proof -\n have \"tgt re = rv2 \\ (tgt re,rv2) \\ subs prb'\" \n using 2(2) rb_sp_append_one[OF RB'] by auto\n\n thus ?thesis \n proof (elim disjE)\n assume \"tgt re = rv2\" \n thus ?thesis by (simp add : subsums_refl)\n next\n assume \"(tgt re, rv2) \\ (subs prb')\" \n thus ?thesis using sub_subsumed RB' by fastforce\n qed\n qed\n \n ultimately\n show ?case using subsums_trans subsums_trans by fast\n qed\n qed\n\n next\n \n (* If res does not start at the newly subsumed red vertex, then either res is a subpath in \n the old red part, either it can be splitted into two parts res1 and res2 such that :\n - res1 is a subpath in the old red part from rv1 to the newly subsumed vertex, \n - res2 is a subpath in the new red part from the newly subsumed vertex to rv2. *)\n\n assume \"rv1 \\ subsumee sub\"\n\n hence \"subpath (red prb) rv1 res rv2 (subs prb) \\ \n (\\ res1 res2. res = res1 @ res2 \n \\ res1 \\ [] \n \\ subpath (red prb) rv1 res1 (subsumee sub) (subs prb) \n \\ subpath (red prb') (subsumee sub) res2 rv2 (subs prb'))\"\n using subsum_step(3,4) \n wf_sub_rel_of.sp_in_extends_imp2 [OF subs_wf_sub_rel_of[OF subsum_step(1)], \n of \"subsumee sub\" \"subsumer sub\"]\n by auto\n \n thus ?thesis\n proof (elim disjE exE conjE)\n (* In the first case, we conclude by \"external\" IH. *)\n assume \"subpath (red prb) rv1 res rv2 (subs prb)\" \n thus ?thesis using subsum_step by simp\n\n next\n (* We call :\n - c1 the configuration obtained from the configuration at rv1 by symbolic execution \n of res1 and such that c is obtained from c1 by symbolic execution of res2,\n - c2 the configuration obtained from the configuration at the newly subsumed red vertex \n by symbolic execution of res2.\n\n We show that c is subsumed by c2 and that c2 is subsumed by the configuration at rv2.\n We conclude by transitivity of subsumption. *)\n fix res1 res2\n \n define t_res1 where \"t_res1 = trace (ui_es res1) (labelling (black prb'))\"\n define t_res2 where \"t_res2 = trace (ui_es res2) (labelling (black prb'))\"\n \n assume \"res = res1 @ res2\"\n and \"res1 \\ []\"\n and \"subpath (red prb) rv1 res1 (subsumee sub) (subs prb)\"\n and \"subpath (red prb') (subsumee sub) res2 rv2 (subs prb')\"\n \n then obtain c1 c2\n where \"se_star (confs prb' rv1) t_res1 c1\"\n and \"se_star c1 t_res2 c\"\n and \"se_star (confs prb' (subsumee sub)) t_res2 c2\"\n using subsum_step(1,3,5,6-8) RB'\n finite_RedBlack.ex_se_star_succ[of prb rv1 t_res1]\n finite_RedBlack.ex_se_star_succ[of prb' \"subsumee sub\" t_res2]\n unfolding finite_RedBlack_def t_res1_def t_res2_def\n by (simp add : fst_of_sp_is_vert se_star_append) blast\n\n then have \"c \\ c2\"\n proof -\n have \"c1 \\ confs prb' (subsumee sub)\" \n using subsum_step(2,3,6-8) \n \\subpath (red prb) rv1 res1 (subsumee sub) (subs prb)\\\n \\se_star (confs prb' rv1) t_res1 c1\\\n by (auto simp add : t_res1_def t_res2_def)\n \n thus ?thesis\n using \\se_star c1 t_res2 c\\ \n \\se_star (confs prb' (subsumee sub)) t_res2 c2\\\n se_star_mono_for_sub\n by fast\n qed\n\n moreover\n (* Here we have to proceed by beckward induction on res2. *)\n have \"c2 \\ confs prb' rv2\"\n using \\subpath (red prb') (subsumee sub) res2 rv2 (subs prb')\\\n \\se_star (confs prb' (subsumee sub)) t_res2 c2\\\n unfolding t_res2_def\n proof (induct res2 arbitrary : rv2 c2 rule : rev_induct, goal_cases)\n (* If the suffix is empty, then either subsumee sub equals rv2, either \n (subsumee sub,rv2) is in the new subsumption relation. *)\n case (1 rv2 c2) \n\n hence \"subsumee sub = rv2 \\ (subsumee sub, rv2)\\subs prb'\" \n using rb_Nil_sp[OF RB'] by simp\n\n thus ?case \n proof (elim disjE)\n (* In the first case, we have : \n c = confs prb' (subsumee sub) = confs prb' rv2.\n We conclude by reflexivity of the subsumption. *)\n assume \"subsumee sub = rv2\" \n thus ?thesis \n using 1(2) by (simp add : subsums_refl)\n next\n (* In the second case, we have : \n c = confs prb' (subsumee sub) \\ confs prb' rv2, \n qed. *)\n assume \"(subsumee sub, rv2) \\ subs prb'\" \n thus ?thesis \n using 1(2) \n sub_subsumed[OF RB', of \"(subsumee sub, rv2)\"] \n by simp\n qed\n\n next \n (* Inductive case : the suffix has the form res2@[ra]. *)\n case (2 re res2 rv2 c2)\n\n (* We call : \n - c3 the configuration obtained from the configuration at the newly subsumed red \n vertex. c2 is obtained from c3 by symbolic execution of ra,\n - c4 the configuration obtained from the configuration at the source of ra by \n symbolic execution of ra.\n\n By internal IH, we first show that c3 is subsumed by the configuration at the source of \n ra. Thus c2 is subsumed by c4, by monotonicity of symbolic execution for the \n subsumption. \n\n Then we show that c4 is subsumed by the configuration at the target of ra, using the \n external IH.\n\n Finally, we show that the configuration at the target of ra is subsumed by the \n configuration at rv2, by observing that either tgt ra = rv2, either (tgt ra,rv2) \n is in the new subsumption relation. \n\n We conclude by transitivity of the subsumption relation. *)\n\n have A : \"subpath (red prb') (subsumee sub) res2 (src re) (subs prb')\"\n and B : \"subpath (red prb') (src re) [re] rv2 (subs prb')\"\n using 2(2) subs_wf_sub_rel[OF RB'] subs_wf_sub_rel_of[OF RB']\n by (simp_all only: wf_sub_rel.sp_append_one)\n (simp add : wf_sub_rel_of.sp_one wf_sub_rel_of_def)\n\n obtain c3\n where C : \"se_star (confs prb' (subsumee sub)) \n (trace (ui_es res2) (labelling (black prb'))) \n (c3)\"\n and D : \"se c3 (labelling (black prb') (ui_edge re)) c2\"\n using 2(3) subsum_step(6-8) RB' \n finite_RedBlack.ex_se_succ[of prb' \"src re\"]\n by (simp add : se_star_append_one) blast\n\n obtain c4 \n where E : \"se (confs prb' (src re)) (labelling (black prb') (ui_edge re)) c4\"\n using subsum_step(6-8) RB' B \n finite_RedBlack.ex_se_succ[of prb' \"src re\"]\n unfolding finite_RedBlack_def\n by (simp add : fst_of_sp_is_vert se_star_append) blast\n\n have \"c2 \\ c4\" \n proof -\n have \"c3 \\ confs prb' (src re)\" using 2(1) A C by fast\n\n thus ?thesis using D E se_mono_for_sub by fast\n qed\n \n moreover\n have \"c4 \\ confs prb' (tgt re)\"\n proof -\n have \"subpath (red prb) (src re) [re] (tgt re) (subs prb)\"\n proof -\n have \"src re \\ red_vertices prb'\"\n and \"tgt re \\ red_vertices prb'\" \n and \"re \\ edges (red prb')\"\n using B by (auto simp add : vertices_def sp_one)\n\n hence \"src re \\ red_vertices prb\"\n and \"tgt re \\ red_vertices prb\"\n and \"re \\ edges (red prb)\"\n using subsum_step(3) by auto\n\n thus ?thesis \n using subs_sub_rel_of[OF subsum_step(1)] \n by (simp add : sp_one)\n qed\n\n thus ?thesis \n using subsum_step(2,3,6-8) E \n by (simp add : se_star_one)\n qed\n\n moreover\n have \"confs prb' (tgt re) \\ confs prb' rv2\"\n proof -\n have \"tgt re = rv2 \\ (tgt re, rv2) \\ (subs prb')\"\n using subsum_step 2 rb_sp_append_one[OF RB', of \"subsumee sub\" res2 re]\n by (auto simp add : vertices_def subpath_def)\n\n thus ?thesis \n proof (elim disjE)\n assume \"tgt re = rv2\" \n thus ?thesis by (simp add : subsums_refl)\n next\n assume \"(tgt re, rv2) \\ (subs prb')\" \n thus ?thesis \n using sub_subsumed RB' \n by fastforce\n qed\n qed\n\n ultimately\n show ?case using subsums_trans subsums_trans by fast\n qed\n\n ultimately\n show ?thesis by (rule subsums_trans)\n qed\n qed\n\nnext\n case (abstract_step prb rv c\\<^sub>a prb' rv1 res rv2 c) \n\n show ?case\n proof (case_tac \"rv1 = rv\", goal_cases) \n (* We first suppose that rv1 is the red vertex where the abstraction took place. In this case, \n we have that res is empty and rv2 = rv1. Hence c is the configuration at rv2 (after \n abstraction). We conclude using reflexivity of subsumption. *)\n case 1\n\n moreover\n hence \"res = []\" \n using abstract_step\n sp_from_de_empty[of rv1 \"subs prb\" \"red prb\" res rv2]\n by simp\n\n moreover\n have \"rv2 = rv\" \n proof -\n have \"rv1 = rv2 \\ (rv1, rv2) \\ (subs prb)\"\n using abstract_step \\res = []\\ \n rb_Nil_sp[OF RedBlack.abstract_step[OF abstract_step(1,3)]]\n by simp \n\n moreover\n have \"(rv1, rv2) \\ (subs prb)\"\n using abstract_step 1 \n unfolding Ball_def subsumees_conv\n by (intro notI) blast\n \n ultimately\n show ?thesis using 1 by simp\n qed\n\n ultimately\n show ?thesis using abstract_step(5) by (simp add : subsums_refl)\n next\n (* Suppose that rv1 is not the red vertex where the subsumption took place. *) \n case 2\n\n show ?thesis\n proof (case_tac \"rv2 = rv\")\n (* We first suppose that rv2 is the newly abstracted red vertex. Then we have that the new \n configuration at rv2 subsums the old configuration at this red vertex. We conclude \n by use of IH and transitivity of subsumption. *)\n assume \"rv2 = rv\"\n\n hence \"confs prb rv2 \\ confs prb' rv2\" \n using abstract_step by (simp add : abstract_def)\n\n moreover\n have \"c \\ confs prb rv2\" \n using abstract_step 2 by auto\n\n ultimately\n show ?thesis using subsums_trans by fast\n next\n assume \"rv2 \\ rv\" thus ?thesis using abstract_step 2 by simp \n qed\n qed\n\nnext\n (* Strengthening a red vertex does not affect the red part, thus this case is trivial. *)\n case strengthen_step thus ?case by simp\nqed\n\n\n\n\n\n\n\n\n\nsubsection\\Properties about marking.\\\n\ntext \\A configuration which is indeed satisfiable can not be marked.\\\n\nlemma sat_not_marked :\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n assumes \"sat (confs prb rv)\"\n shows \"\\ marked prb rv\"\nusing assms\nproof (induct prb arbitrary : rv)\n case base thus ?case by simp\nnext\n case (se_step prb re c prb')\n\n hence \"rv \\ red_vertices prb \\ rv = tgt re\" by (auto simp add : vertices_def)\n\n thus ?case\n proof (elim disjE, goal_cases)\n case 1 \n moreover\n hence \"rv \\ tgt re\" using se_step(3) by (auto simp add : vertices_def)\n ultimately\n show ?thesis using se_step by (elim conjE) auto\n next\n case 2\n\n moreover\n hence \"sat (confs prb (src re))\" using se_step(3,5) se_sat_imp_sat by auto\n \n ultimately\n show ?thesis using se_step(2,3) by (elim conjE) auto\n qed\nnext\n case (mark_step prb rv' prb') \n\n moreover\n hence \"rv \\ rv'\" and \"(rv,rv') \\ subs prb\"\n using sub_subsumed[OF mark_step(1), of \"(rv,rv')\"] unsat_subs_unsat by auto\n \n ultimately\n show ?case by auto\nnext\n case subsum_step thus ?case by auto\n\nnext\n case (abstract_step prb rv' c\\<^sub>a prb') thus ?case by (case_tac \"rv' = rv\") simp+\n\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\ntext\\On the other hand, a red-location which is marked unsat is indeed logically unsatisfiable.\\\n\nlemma\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n assumes \"marked prb rv\"\n shows \"\\ sat (confs prb rv)\"\nusing assms\nproof (induct prb arbitrary : rv)\n case base thus ?case by simp\nnext\n case (se_step prb re c prb')\n\n hence \"rv \\ red_vertices prb \\ rv = tgt re\" by (auto simp add : vertices_def)\n\n thus ?case \n proof (elim disjE, goal_cases)\n case 1\n\n moreover\n hence \"rv \\ tgt re\" using se_step(3) by auto\n hence \"marked prb rv\" using se_step by auto\n\n ultimately\n have \"\\ sat (confs prb rv)\" by (rule se_step(2))\n\n thus ?thesis using se_step(3) \\rv \\ tgt re\\ by auto\n next\n case 2\n\n moreover\n hence \"marked prb (src re)\" using se_step(3,5) by auto\n\n ultimately\n have \"\\ sat (confs prb (src re))\" using se_step(2,3) by auto\n\n thus ?thesis using se_step(3) \\rv = tgt re\\ unsat_imp_se_unsat by (elim conjE) auto\n qed\nnext\n case (mark_step prb rv' prb') thus ?case by (case_tac \"rv' = rv\") auto\nnext\n case subsum_step thus ?case by simp\n\nnext\n case (abstract_step _ rv' _) thus ?case by (case_tac \"rv' = rv\") simp+\n\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\n\n\ntext\\Red vertices involved in subsumptions are not marked.\\\n\n\nlemma subsumee_not_marked :\n assumes \"RedBlack prb\"\n assumes \"sub \\ subs prb\"\n shows \"\\ marked prb (subsumee sub)\"\nusing assms\nproof (induct prb)\n case base thus ?case by simp\nnext\n case (se_step prb re c prb')\n \n moreover\n hence \"subsumee sub \\ tgt re\"\n using subs_wf_sub_rel_of[OF se_step(1)]\n by (elim conjE, auto simp add : wf_sub_rel_of_def sub_rel_of_def)\n\n ultimately\n show ?case by auto\nnext\n case mark_step thus ?case by auto\nnext\n case subsum_step thus ?case by auto\n\nnext\n case abstract_step thus ?case by auto\n\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\nlemma subsumer_not_marked :\n assumes \"RedBlack prb\"\n assumes \"sub \\ subs prb\"\n shows \"\\ marked prb (subsumer sub)\"\nusing assms\nproof (induct prb)\n case base thus ?case by simp\nnext\n case (se_step prb re c prb')\n\n moreover\n hence \"subsumer sub \\ tgt re\"\n using subs_wf_sub_rel_of[OF se_step(1)]\n by (elim conjE, auto simp add : wf_sub_rel_of_def sub_rel_of_def)\n\n ultimately\n show ?case by auto\nnext\n case (mark_step prb rv prb') thus ?case by auto\nnext\n case (subsum_step prb sub' prb') thus ?case by auto\n\nnext\n case abstract_step thus ?case by simp\n\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\n\ntext\\If the target of a red edge is not marked, then its source is also not marked.\\\n\nlemma tgt_not_marked_imp :\n assumes \"RedBlack prb\"\n assumes \"re \\ edges (red prb)\"\n assumes \"\\ marked prb (tgt re)\"\n shows \"\\ marked prb (src re)\"\nusing assms\nproof (induct prb arbitrary : re)\n case base thus ?case by simp\nnext\n case se_step thus ?case by (force simp add : vertices_def image_def)\nnext\n case (mark_step prb rv prb' re) thus ?case by (case_tac \"tgt re = rv\") auto\nnext\n case subsum_step thus ?case by simp\n\nnext\n case abstract_step thus ?case by simp\n\nnext\n case strengthen_step thus ?case by simp\nqed\n\ntext\\Given a red subpath leading from red location @{term \"rv1\"} to red location @{term \"rv2\"},\nif @{term \"rv2\"} is not marked, then @{term \"rv1\"} is also not marked (this\nlemma is not used).\\\n\nlemma\n assumes \"RedBlack prb\"\n assumes \"subpath (red prb) rv1 res rv2 (subs prb)\"\n assumes \"\\ marked prb rv2\"\n shows \"\\ marked prb rv1\"\nusing assms\nproof (induct res arbitrary : rv1)\n case Nil \n \n hence \"rv1 = rv2 \\ (rv1,rv2) \\ subs prb\" by (simp add : rb_Nil_sp)\n \n thus ?case \n proof (elim disjE, goal_cases)\n case 1 thus ?case using Nil by simp\n next\n case 2 show ?case using Nil subsumee_not_marked[OF Nil(1) 2] by simp\n qed\nnext\n case (Cons re res) \n \n thus ?case \n unfolding rb_sp_Cons[OF Cons(2), of rv1 re res rv2]\n proof (elim conjE disjE, goal_cases)\n case 1\n\n moreover\n hence \"\\ marked prb (tgt re)\" by simp\n\n moreover\n have \"re \\ edges (red prb)\" using Cons(3) rb_sp_Cons[OF Cons(2), of rv1 re res rv2] by fast\n \n ultimately\n show ?thesis using tgt_not_marked_imp[OF Cons(2)] by fast\n next\n case 2 thus ?thesis using subsumee_not_marked[OF Cons(2)] by fastforce\n qed\nqed\n\n\nsubsection\\Fringe of a red-black graph\\\n\ntext \\We have stated and proved a number of properties of red-black graphs. In the end, we are \nmainly interested in proving that the set of paths of such red-black graphs are subsets of the set \nof feasible paths of their black part. Before defining the set of paths of red-black graphs, we \nfirst introduce the intermediate concept of \\emph{fringe} of the red part. Intuitively, the fringe \nis the set of red vertices from which we can approximate more precisely the set of feasible paths of \nthe black part. This includes red vertices that have not been subsumed yet, that are not marked and \nfrom which some black edges have not been yet symbolically executed (i.e.\\ that have no red \ncounterpart from these red vertices).\\\n\nsubsubsection \\Definition\\\n\ntext\\The fringe is the set of red locations from which there exist black edges that have not \nbeen followed yet.\\\n\ndefinition fringe :: \n \"('vert, 'var, 'd, 'x) pre_RedBlack_scheme \\ ('vert \\ nat) set\"\nwhere\n \"fringe prb \\ {rv \\ red_vertices prb. \n rv \\ subsumees (subs prb) \\ \n \\ marked prb rv \\\n ui_edge ` out_edges (red prb) rv \\ out_edges (black prb) (fst rv)}\"\n\n\nsubsubsection \\Fringe of an empty red-part\\\n\ntext\\At the beginning of the analysis, i.e.\\ when the red part is empty, the fringe consists of the \nred root.\\\n\nlemma fringe_of_empty_red1 :\n assumes \"edges (red prb) = {}\"\n assumes \"subs prb = {}\"\n assumes \"marked prb = (\\ rv. False)\"\n assumes \"out_edges (black prb) (fst (root (red prb))) \\ {}\"\n shows \"fringe prb = {root (red prb)}\"\nusing assms by (auto simp add : fringe_def vertices_def)\n\n\nsubsubsection \\Evolution of the fringe after extension\\\n\ntext\\Simplification lemmas for the fringe of the new red-black graph after adding an edge by \nsymbolic execution. If the configuration from which symbolic execution is performed is not marked \nyet, and if there exists black edges going out of the target of the executed edge, the target of \nthe new red edge enters the fringe. Moreover, if there still exist black edges that have no red \ncounterpart yet at the source of the new edge, then its source was and stays in the fringe.\\\n\nlemma seE_fringe1 :\n assumes \"sub_rel_of (red prb) (subs prb)\"\n assumes \"se_extends prb re c' prb'\"\n assumes \"\\ marked prb (src re)\"\n assumes \"ui_edge ` (out_edges (red prb') (src re)) \\ out_edges (black prb) (fst (src re))\"\n assumes \"out_edges (black prb) (fst (tgt re)) \\ {}\"\n shows \"fringe prb' = fringe prb \\ {tgt re}\"\nunfolding set_eq_iff Un_iff singleton_iff\nproof (intro allI iffI, goal_cases)\n case (1 rv)\n\n moreover\n hence \"rv \\ red_vertices prb \\ rv = tgt re\"\n using assms(2) by (auto simp add : fringe_def vertices_def) \n\n ultimately\n show ?case using assms(2) by (auto simp add : fringe_def)\nnext \n case (2 rv)\n\n hence \"rv \\ red_vertices prb'\" using assms(2) by (auto simp add : fringe_def vertices_def)\n\n moreover\n have \"rv \\ subsumees (subs prb')\"\n using 2\n proof (elim disjE)\n assume \"rv \\ fringe prb\" thus ?thesis using assms(2) by (auto simp add : fringe_def)\n next\n assume \"rv = tgt re\" thus ?thesis \n using assms(1,2) unfolding sub_rel_of_def by force\n qed\n\n moreover\n have \"ui_edge ` (out_edges (red prb') rv) \\ out_edges (black prb') (fst rv)\"\n using 2\n proof (elim disjE)\n assume \"rv \\ fringe prb\" \n \n thus ?thesis \n proof (case_tac \"rv = src re\")\n assume \"rv = src re\" thus ?thesis using assms(2,4) by auto\n next\n assume \"rv \\ src re\" thus ?thesis \n using assms(2) \\rv \\ fringe prb\\\n by (auto simp add : fringe_def)\n qed\n next\n assume \"rv = tgt re\" thus ?thesis \n using assms(2,5) extends_tgt_out_edges[of re \"red prb\" \"red prb'\"] by (elim conjE) auto\n qed\n\n moreover\n have \"\\ marked prb' rv\" \n using 2\n proof (elim disjE, goal_cases)\n case 1 \n\n moreover\n hence \"rv \\ tgt re\" using assms(2) by (auto simp add : fringe_def)\n\n ultimately\n show ?thesis using assms(2) by (auto simp add : fringe_def)\n next\n case 2 thus ?thesis using assms(2,3) by auto\n qed\n\n ultimately\n show ?case by (simp add : fringe_def)\nqed\n\ntext \\On the other hand, if all possible black edges have been executed from the source of the new \nedge after the extension, then the source is removed from the fringe.\\\n\nlemma seE_fringe4 :\n assumes \"sub_rel_of (red prb) (subs prb)\"\n assumes \"se_extends prb re c' prb'\"\n assumes \"\\ marked prb (src re)\"\n assumes \"\\ (ui_edge ` (out_edges (red prb') (src re)) \\ out_edges (black prb) (fst (src re)))\"\n assumes \"out_edges (black prb) (fst (tgt re)) \\ {}\"\n shows \"fringe prb' = fringe prb - {src re} \\ {tgt re}\"\nunfolding set_eq_iff Un_iff singleton_iff Diff_iff\nproof (intro allI iffI, goal_cases)\n case (1 rv)\n\n hence \"rv \\ red_vertices prb \\ rv = tgt re\" \n and \"rv \\ src re\" \n using assms(2,3,4,5) by (auto simp add : fringe_def vertices_def) \n\n with 1 show ?case using assms(2) by (auto simp add : fringe_def)\n\nnext\n case (2 rv)\n\n hence \"rv \\ red_vertices prb'\" using assms(2) by (auto simp add : fringe_def vertices_def)\n\n moreover\n have \"rv \\ subsumees (subs prb')\"\n using 2\n proof (elim disjE)\n assume \"rv \\ fringe prb \\ rv \\ src re\" \n thus ?thesis using assms(2) by (auto simp add : fringe_def)\n next\n assume \"rv = tgt re\" thus ?thesis \n using assms(1,2) unfolding sub_rel_of_def by fastforce\n qed\n\n moreover\n have \"ui_edge ` (out_edges (red prb') rv) \\ out_edges (black prb') (fst rv)\"\n using 2\n proof (elim disjE)\n assume \"rv \\ fringe prb \\ rv \\ src re\" thus ?thesis \n using assms(2) by (auto simp add : fringe_def)\n next\n assume \"rv = tgt re\" thus ?thesis \n using assms(2,5) extends_tgt_out_edges[of re \"red prb\" \"red prb'\"] by (elim conjE) auto\n qed\n\n moreover\n have \"\\ marked prb' rv\"\n using 2\n proof (elim disjE, goal_cases)\n case 1 \n\n moreover\n hence \"rv \\ tgt re\" using assms by (auto simp add : fringe_def)\n\n ultimately\n show ?thesis\n using assms 1 by (auto simp add : fringe_def)\n next\n case 2 thus ?thesis using assms by auto\n qed\n\n ultimately\n show ?case by (simp add : fringe_def)\nqed\n\ntext \\If the source of the new edge is marked, then its target does not enter the fringe (and the \nsource was not part of it in the first place).\\\n\nlemma seE_fringe2 :\n assumes \"se_extends prb re c prb'\"\n assumes \"marked prb (src re)\"\n shows \"fringe prb' = fringe prb\"\nunfolding set_eq_iff Un_iff singleton_iff\nproof (intro allI iffI, goal_cases)\n case (1 rv)\n\n thus ?case \n unfolding fringe_def mem_Collect_eq\n using assms\n proof (intro conjI, goal_cases)\n case 1 thus ?case by (auto simp add : fringe_def vertices_def)\n next\n case 2 thus ?case by auto\n next\n case 3 \n\n moreover\n hence \"rv \\ tgt re\" by auto\n\n ultimately\n show ?case by auto\n next\n case 4 thus ?case by auto\n qed\nnext\n case (2 rv)\n\n thus ?case unfolding fringe_def mem_Collect_eq\n using assms\n proof (intro conjI, goal_cases)\n case 1 thus ?case by (auto simp add : vertices_def)\n next\n case 2 thus ?case by auto\n next\n case 3 \n moreover\n hence \"rv \\ tgt re\" by auto\n ultimately\n show ?case by auto\n next\n case 4 thus ?case by auto\n qed\nqed\n\ntext \\If there exists no black edges going out of the target of the new edge, then this target \ndoes not enter the fringe.\\\n\nlemma seE_fringe3 :\n assumes \"se_extends prb re c' prb'\"\n assumes \"ui_edge ` (out_edges (red prb') (src re)) \\ out_edges (black prb) (fst (src re))\"\n assumes \"out_edges (black prb) (fst (tgt re)) = {}\"\n shows \"fringe prb' = fringe prb\"\nunfolding set_eq_iff Un_iff singleton_iff\nproof (intro allI iffI, goal_cases)\n case (1 rv)\n\n thus ?case using assms(1,3)\n unfolding fringe_def mem_Collect_eq\n proof (intro conjI, goal_cases)\n case 1 thus ?case by (auto simp add : fringe_def vertices_def) \n next\n case 2 thus ?case by (auto simp add : fringe_def)\n next\n case 3 thus ?case by (case_tac \"rv = tgt re\") (auto simp add : fringe_def)\n next\n case 4 thus ?case by (auto simp add : fringe_def)\n qed\n\nnext \n case (2 rv)\n\n moreover\n hence \"rv \\ red_vertices prb'\"\n and \"rv \\ tgt re\" \n using assms(1) by (auto simp add : fringe_def vertices_def)\n\n moreover\n have \"ui_edge ` (out_edges (red prb') rv) \\ out_edges (black prb) (fst rv)\"\n proof (case_tac \"rv = src re\")\n assume \"rv = src re\" thus ?thesis using assms(2) by simp\n next\n assume \"rv \\ src re\" \n thus ?thesis using assms(1) 2\n by (auto simp add : fringe_def)\n qed\n\n ultimately\n show ?case using assms(1) by (auto simp add : fringe_def)\nqed\n\n\ntext \\Moreover, if all possible black edges have been executed from the source of the new edge \nafter the extension, then this source is removed from the fringe.\\\n\nlemma seE_fringe5 :\n assumes \"se_extends prb re c' prb'\"\n assumes \"\\ (ui_edge ` (out_edges (red prb') (src re)) \\ out_edges (black prb) (fst (src re)))\"\n assumes \"out_edges (black prb) (fst (tgt re)) = {}\"\n shows \"fringe prb' = fringe prb - {src re}\"\nunfolding set_eq_iff Un_iff singleton_iff Diff_iff\nproof (intro allI iffI, goal_cases)\n case (1 rv)\n\n moreover\n have \"rv \\ red_vertices prb\" and \"rv \\ src re\"\n using 1 assms by (auto simp add : fringe_def vertices_def) (* slow *)\n\n moreover\n have \"\\ marked prb rv\"\n proof (intro notI)\n assume \"marked prb rv\"\n\n have \"marked prb' rv\"\n proof -\n have \"rv \\ tgt re\" using assms(1) \\rv \\ red_vertices prb\\ by auto\n \n thus ?thesis using assms(1) \\marked prb rv\\ by auto\n qed\n \n thus False using 1 by (auto simp add : fringe_def)\n qed\n\n ultimately\n show ?case using assms(1) by (auto simp add : fringe_def)\n\nnext\n case (2 rv)\n\n hence \"rv \\ red_vertices prb'\" using assms(1) by (auto simp add : fringe_def vertices_def)\n\n moreover\n have \"rv \\ subsumees (subs prb')\" using 2 assms(1) by (auto simp add : fringe_def)\n\n moreover\n have \"ui_edge ` (out_edges (red prb') rv) \\ out_edges (black prb') (fst rv)\"\n using 2 assms(1) by (auto simp add : fringe_def)\n\n moreover\n have \"\\ marked prb' rv\"\n proof -\n have \"rv \\ tgt re\" using assms(1) 2 by (auto simp add : fringe_def)\n \n thus ?thesis using assms(1) 2 by (auto simp add : fringe_def)\n qed\n\n ultimately\n show ?case by (simp add : fringe_def)\nqed\n\n\ntext\\Adding a subsumption to the subsumption relation removes the first member of the \nsubsumption from the fringe.\\\n\nlemma subsumE_fringe :\n assumes \"subsum_extends prb sub prb'\"\n shows \"fringe prb' = fringe prb - {subsumee sub}\"\nusing assms by (auto simp add : fringe_def)\n\n\n\nsubsection\\Red-Black Sub-Paths and Paths\\\n\ntext\\The set of red-black subpaths starting in red location @{term \"rv\"} is the union of :\n\\begin{itemize}\n \\item the set of black sub-paths that have a red counterpart starting at @{term \"rv\"} and leading \nto a non-marked red location,\n \\item the set of black sub-paths that have a prefix represented in the red part starting \nat @{term \"rv\"} and leading to an element of the fringe. Moreover, the remainings of these black \nsub-paths must have no non-empty counterpart in the red part. Otherwise, the set of red-black paths \nwould simply be the set of paths of the black part.\n\\end{itemize}\n\\\n\ndefinition RedBlack_subpaths_from ::\n \"('vert, 'var, 'd, 'x) pre_RedBlack_scheme \\ ('vert \\ nat) \\ 'vert edge list set\"\nwhere\n \"RedBlack_subpaths_from prb rv \\ \n ui_es ` {res. \\ rv'. subpath (red prb) rv res rv' (subs prb) \\ \\ marked prb rv'}\n \\ {ui_es res1 @ bes2 \n | res1 bes2. \\ rv1. rv1 \\ fringe prb \n \\ subpath (red prb) rv res1 rv1 (subs prb)\n \\ \\ (\\ res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv1 res21 (subs prb))\n \\ Graph.subpath_from (black prb) (fst rv1) bes2}\"\n\n\n\ntext\\Red-black paths are red-black subpaths starting at the root of the red part.\\\n\nabbreviation RedBlack_paths :: \n \"('vert, 'var, 'd, 'x) pre_RedBlack_scheme \\ 'vert edge list set\"\nwhere \n \"RedBlack_paths prb \\ RedBlack_subpaths_from prb (root (red prb))\"\n\n\ntext\\When the red part is empty, the set of red-black subpaths starting at the red root is the set \nof black paths.\\\n\nlemma (in finite_RedBlack) base_RedBlack_paths :\n assumes \"fst (root (red prb)) = init (black prb)\"\n assumes \"edges (red prb) = {}\"\n assumes \"subs prb = {}\"\n assumes \"confs prb (root (red prb)) = init_conf prb\"\n assumes \"marked prb = (\\ rv. False)\"\n assumes \"strengthenings prb = (\\ rv. (\\ \\. True))\"\n \n shows \"RedBlack_paths prb = Graph.paths (black prb)\"\n\nproof -\n show ?thesis\n unfolding set_eq_iff\n proof (intro allI iffI)\n\n fix bes \n assume \"bes \\ RedBlack_subpaths_from prb (root (red prb))\" \n thus \"bes \\ Graph.paths (black prb)\" \n unfolding RedBlack_subpaths_from_def Un_iff\n proof (elim disjE exE conjE, goal_cases)\n case 1\n \n hence \"bes = []\" using assms by (auto simp add: subpath_def)\n \n thus ?thesis \n by (auto simp add : Graph.subpath_def vertices_def)\n next\n case 2\n \n then obtain res1 bes2 rv where \"bes = ui_es res1 @ bes2\"\n and \"rv \\ fringe prb\"\n and \"subpath (red prb) (root (red prb)) res1 rv (subs prb)\"\n and \"Graph.subpath_from (black prb) (fst rv) bes2\"\n by blast\n \n moreover\n hence \"res1 = []\" using assms by (simp add : subpath_def)\n \n ultimately\n show ?thesis using assms \\rv \\ fringe prb\\ by (simp add : fringe_def vertices_def)\n qed\n next\n fix bes\n assume \"bes \\ Graph.paths (black prb)\"\n show \"bes \\ RedBlack_subpaths_from prb (root (red prb))\" \n proof (case_tac \"out_edges (black prb) (init (black prb)) = {}\")\n assume \"out_edges (black prb) (init (black prb)) = {}\"\n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"[]\" in exI)\n apply (intro conjI)\n apply (rule_tac ?x=\"root (red prb)\" in exI)\n proof (intro conjI)\n show \"subpath (red prb) (root (red prb)) [] (root (red prb)) (subs prb)\" \n using assms(3) by (simp add : sub_rel_of_def subpath_def vertices_def)\n next\n show \"\\ marked prb (root (red prb))\" using assms(5) by simp\n next\n show \"bes = ui_es []\" \n using \\bes \\ Graph.paths (black prb)\\ \n \\out_edges (black prb) (init (black prb)) = {}\\\n by (cases bes) (auto simp add : Graph.sp_Cons)\n qed\n next\n assume \"out_edges (black prb) (init (black prb)) \\ {}\"\n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n proof (intro disjI2, rule_tac ?x=\"[]\" in exI, rule_tac ?x=\"bes\" in exI, \n intro conjI, goal_cases)\n case 1 show ?case by simp\n next\n case 2 show ?case\n unfolding Bex_def\n proof (rule_tac ?x=\"root (red prb)\" in exI, intro conjI, goal_cases) \n show \"root (red prb) \\ fringe prb\"\n using assms(1-3,5) \\out_edges (black prb) (init (black prb)) \\ {}\\ \n fringe_of_empty_red1 \n by fastforce\n next\n show \"subpath (red prb)(root (red prb))([])(root (red prb))(subs prb)\"\n using subs_sub_rel_of[OF RedBlack.base[OF assms(1-6)]]\n by (simp add : subpath_def vertices_def sub_rel_of_def)\n next \n case 3 show ?case\n proof (intro notI, elim exE conjE)\n fix res21 bes22 rv\n assume \"bes = ui_es res21 @ bes22\"\n and \"res21 \\ []\" \n and \"subpath (red prb) (root (red prb)) res21 rv (subs prb)\"\n moreover\n hence \"res21 = []\" using assms by (simp add : subpath_def)\n ultimately show False by (elim notE)\n qed\n next\n case 4 show ?case \n using assms \\bes \\ Graph.paths (black prb)\\ by simp\n qed\n qed\n qed \n qed\nqed\n\n\n\n\n\n\n\n\n\n\n\n\ntext \\Red-black sub-paths and paths are sub-paths and paths of the black part.\\\n\nlemma RedBlack_subpaths_are_black_subpaths :\n assumes \"RedBlack prb\"\n shows \"RedBlack_subpaths_from prb rv \\ Graph.subpaths_from (black prb) (fst rv)\"\nunfolding subset_iff mem_Collect_eq RedBlack_subpaths_from_def Un_iff image_def Bex_def\nproof (intro allI impI, elim disjE exE conjE, goal_cases)\n case (1 bes res rv') thus ?case using assms red_sp_imp_black_sp by blast\nnext\n case (2 bes res1 bes2 rv1 bv2) thus ?case \n using red_sp_imp_black_sp[OF assms, of rv res1 rv1]\n by (rule_tac ?x=\"bv2\" in exI) (auto simp add : Graph.sp_append)\nqed\n\nlemma RedBlack_paths_are_black_paths : \n assumes \"RedBlack prb\"\n shows \"RedBlack_paths prb \\ Graph.paths (black prb)\"\nusing assms \n RedBlack_subpaths_are_black_subpaths[of prb \"root (red prb)\"]\n consistent_roots[of prb]\nby simp\n\n\n\n\nsubsection \\Preservation of feasible paths\\\n\n\ntext\\The following theorem states that we do not loose feasible paths using\nour five operators,\nand moreover, configurations @{term \"c\"} at the end of feasible red paths in\nsome graph @{term \"prb\"} will have corresponding feasible red paths in\nsuccessors that\nlead to configurations that subsume @{term \"c\"}. As a corollary, our calculus is correct\nwrt. to execution.\\\n\n\n\ntheorem (in finite_RedBlack) feasible_subpaths_preserved :\n assumes \"RedBlack prb\"\n assumes \"rv \\ red_vertices prb\"\n shows \"feasible_subpaths_from (black prb) (confs prb rv) (fst rv) \n \\ RedBlack_subpaths_from prb rv\"\nusing assms finite_RedBlack\nproof (induct prb arbitrary : rv)\n\n (* Base case : the red part is empty. In this case, rl is the root of the red part. Hence, the \n set of feasible subpaths starting at (fst rl) is the set of feasible paths of the black part.\n We conclude using the fact that when the red part is empty, the set of red-black subpaths is \n the set of paths of the black part, which includes feasible paths. *)\n\n case (base prb rv) \n\n moreover\n hence \"rv = root (red prb)\" by (simp add : vertices_def)\n\n moreover\n hence \"feasible_subpaths_from (black prb) (confs prb rv) (fst rv) \n = feasible_paths (black prb) (confs prb (root (red prb)))\"\n using base by simp\n\n moreover\n have \"out_edges (black prb) (fst (root (red prb))) = {} \\\n ui_edge `out_edges(red prb)(root (red prb)) \\ out_edges(black prb)(fst (root (red prb)))\"\n using base by auto\n\n ultimately\n show ?case \n using finite_RedBlack.base_RedBlack_paths[of prb]\n by (auto simp only : finite_RedBlack_def)\n\nnext\n\n (* Adding an edge by symbolic execution. *)\n \n case (se_step prb re c prb' rv)\n\n have RB' : \"RedBlack prb'\" by (rule RedBlack.se_step[OF se_step(1,3)])\n\n show ?case\n unfolding subset_iff\n proof (intro allI impI)\n \n fix bes \n\n assume \"bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\"\n\n have \"rv \\ red_vertices prb \\ rv = tgt re\" \n using se_step(3,4) by (auto simp add : vertices_def)\n\n thus \"bes \\ RedBlack_subpaths_from prb' rv\" \n proof (elim disjE)\n (* We first suppose that bes does not start at the target of the new edge. In this case, we \n can use the IH to show that bes is a red-black subpath in the old red-black graph. We then \n proceed by case distinction. *)\n assume \"rv \\ red_vertices prb\"\n\n moreover\n hence \"rv \\ tgt re\" using se_step by auto\n\n ultimately\n have \"bes \\ RedBlack_subpaths_from prb rv\"\n using se_step \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n by fastforce\n\n thus ?thesis \n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE)\n (* Suppose that bes is entirely represented in the old red part. Then it is also entirely \n represented in the new red part, qed. *)\n fix res rv'\n \n assume \"bes = ui_es res\"\n and \"subpath (red prb) rv res rv' (subs prb)\"\n and \"\\ marked prb rv'\"\n \n moreover\n hence \"\\ marked prb' rv'\" \n using se_step(3) lst_of_sp_is_vert[of \"red prb\" rv res rv' \"subs prb\"]\n by (elim conjE) auto\n \n ultimately\n show ?thesis \n using se_step(3) sp_in_extends_w_subs[of re \"red prb\" \"red prb'\" rv res rv' \"subs prb\"]\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n by (intro disjI1, rule_tac ?x=\"res\" in exI, intro conjI) \n (rule_tac ?x=\"rv'\" in exI, auto)\n \n next\n (* Suppose that bes is not entirely represented in the old red part, ie bes is of the form \n ui_es res1 @ bes2 where res1 is a (maximal) red subpath (leading to a non-marked element \n rv1 of the old fringe) and bes2 is black subpath (starting at the black vertex \n represented by rv1. We then proceed by distinguishing the cases where the rv1 is the \n source of the new edge or is an \"old\" red vertex. *)\n fix res1 bes2 rv1 bl\n \n assume A : \"bes = ui_es res1 @ bes2\"\n and B : \"rv1 \\ fringe prb\"\n and C : \"subpath (red prb) rv res1 rv1 (subs prb)\"\n (*and D : \"\\ marked prb rv1\"*)\n and E : \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv1 res21 (subs prb))\"\n and F : \"Graph.subpath (black prb) (fst rv1) bes2 bl\"\n \n hence \"rv1 \\ tgt re\" using se_step by (auto simp add : fringe_def)\n \n show ?thesis \n proof (case_tac \"rv1 = src re\")\n (* If rv1 is the source of the new edge, we proceed by cases on the black suffix. *)\n assume \"rv1 = src re\"\n \n show ?thesis \n proof (case_tac \"bes2 = []\")\n (* If the black suffix is empty, then bes is in fact entirely represented in the old \n red part and also in the new red part, qed. *)\n assume \"bes2 = []\" \n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (intro conjI)\n apply (rule_tac ?x=\"rv1\" in exI)\n apply (intro conjI)\n proof -\n show \"subpath (red prb') rv res1 rv1 (subs prb')\" \n using se_step(3) C by (auto simp add : sp_in_extends_w_subs)\n next\n have \"rv1 \\ tgt re\" using se_step(3) \\rv1 = src re\\ by auto\n thus \"\\ marked prb' rv1\" using se_step(3) B by (auto simp add : fringe_def)\n next\n show \"bes = ui_es res1\" using A \\bes2 = []\\ by simp\n qed\n \n next\n (* If the black suffix is not empty, we first suppose that its first edge is the new \n edge. *)\n assume \"bes2 \\ []\" \n then obtain be bes2' where \"bes2 = be # bes2'\" unfolding neq_Nil_conv by blast \n show ?thesis \n proof (case_tac \"be = ui_edge re\")\n (* If the first edge of the black suffix is represented by the new edge, then \n res1@[ra] is a red subpath leading to the target of the new edge, which is the \n fringe and not marked. Moreover, it is maximal, as there are no out-going edges \n from the target of the new edge in the new red part yet. Moreover, the tail of \n the black suffix is a suitable \"new\" black suffix, qed. *)\n assume \"be = ui_edge re\" \n \n show ?thesis \n proof (case_tac \"out_edges (black prb) (fst (tgt re)) = {}\")\n \n assume \"out_edges (black prb) (fst (tgt re)) = {}\" \n show ?thesis\n\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res1@[re]\" in exI)\n apply (intro conjI)\n apply (rule_tac ?x=\"tgt re\" in exI)\n proof (intro conjI)\n show \"subpath (red prb') rv (res1 @ [re]) (tgt re) (subs prb')\"\n using se_step(3) \\rv1 = src re\\ C\n sp_in_extends_w_subs[of re \"red prb\" \"red prb'\" rv res1 rv1 \"subs prb\"]\n rb_sp_append_one[OF RB', of rv res1 re \"tgt re\"]\n by auto\n next\n show \"\\ marked prb' (tgt re)\" \n using se_step(3) \\rv1 = src re\\ B \n by (auto simp add : fringe_def)\n next\n have \"bes2' = []\"\n using F \\bes2 = be # bes2'\\ \n \\be = ui_edge re\\ \\out_edges (black prb) (fst (tgt re)) = {}\\\n by (cases bes2') (auto simp add: Graph.sp_Cons)\n \n thus \"bes = ui_es (res1 @ [re])\"\n using \\bes = ui_es res1 @ bes2\\ \\bes2 = be # bes2'\\ \\be = ui_edge re\\ by simp\n qed\n \n next\n \n assume \"out_edges (black prb) (fst (tgt re)) \\ {}\" \n show ?thesis\n\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1@[re]\" in exI)\n apply (rule_tac ?x=\"bes2'\" in exI)\n proof (intro conjI, goal_cases)\n show \"bes = ui_es (res1 @ [re]) @ bes2'\"\n using \\bes = ui_es res1 @ bes2\\ \\bes2 = be # bes2'\\ \\be = ui_edge re\\ \n by simp\n next\n case 2 show ?case \n proof (rule_tac ?x=\"tgt re\" in exI, intro conjI)\n have \"\\ marked prb (src re)\" \n using B \\rv1 = src re\\ by (simp add : fringe_def) \n thus \"tgt re \\ fringe prb'\" \n using se_step(3) \\out_edges (black prb) (fst (tgt re)) \\ {}\\ \n seE_fringe1[OF subs_sub_rel_of[OF se_step(1)] se_step(3)] \n seE_fringe4[OF subs_sub_rel_of[OF se_step(1)] se_step(3)] \n by auto\n next\n show \"subpath (red prb') rv (res1 @ [re]) (tgt re) (subs prb')\" \n using se_step(3) \\rv1 = src re\\ C\n sp_in_extends_w_subs[of re \"red prb\" \"red prb'\" \n rv res1 rv1 \"subs prb\"]\n rb_sp_append_one[OF RB', of rv res1 re \"tgt re\"]\n by auto\n next\n show \"\\ (\\res21 bes22. bes2' = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') (tgt re) res21 (subs prb'))\"\n proof (intro notI, elim exE conjE)\n fix res21 bes22 rv2\n assume \"bes2' = ui_es res21 @ bes22\"\n and \"res21 \\ []\"\n and \"subpath (red prb') (tgt re) res21 rv2 (subs prb')\" \n thus False \n using se_step(3) \n sub_rel_of.sp_from_tgt_in_extends_is_Nil\n [OF subs_sub_rel_of[OF se_step(1)], of re \"red prb'\" res21 rv2]\n by auto\n qed\n next\n show \"Graph.subpath_from (black prb') (fst (tgt re)) bes2'\" \n using se_step(3) F \\bes2 = be # bes2'\\ \\be = ui_edge re\\ \n by (auto simp add : Graph.sp_Cons) \n qed\n qed \n qed\n \n next\n (* If the first edge of the black suffix is not represented by the new edge, then \n this first edge is still not represented in the new red part. Hence, the source \n of the new edge is in the fringe of the new red part (and not marked). We \n conclude by showing that res1 is a suitable red prefix, and bes2 a suitable \n black suffix. *)\n assume \"be \\ ui_edge re\" \n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n apply (intro conjI)\n apply (rule \\bes = ui_es res1 @ bes2\\)\n apply (rule_tac ?x=\"rv1\" in exI)\n proof (intro conjI)\n \n show \"rv1 \\ fringe prb'\"\n unfolding fringe_def mem_Collect_eq\n proof (intro conjI)\n show \"rv1 \\ red_vertices prb'\" \n using se_step(3) B by (auto simp add : fringe_def vertices_def)\n next\n show \"rv1 \\ subsumees (subs prb')\" \n using se_step(3) B by (auto simp add : fringe_def)\n next\n show \"\\ marked prb' rv1\" \n using B se_step(3) \\rv1 \\ tgt re\\ \\rv1 = src re\\\n by (auto simp add : fringe_def)\n next\n have \"be \\ ui_edge ` out_edges (red prb') rv1\"\n proof (intro notI)\n assume \"be \\ ui_edge ` out_edges (red prb') rv1\"\n \n then obtain re' where \"be = ui_edge re'\"\n and \"re' \\ out_edges (red prb') rv1\"\n by blast\n \n show False \n using E\n apply (elim notE)\n apply (rule_tac ?x=\"[re']\" in exI)\n apply (rule_tac ?x=\"bes2'\" in exI)\n proof (intro conjI)\n show \"bes2 = ui_es [re'] @ bes2'\"\n using \\bes2 = be # bes2'\\ \\be = ui_edge re'\\ by simp\n next\n show \"[re'] \\ []\" by simp\n next\n have \"re' \\ edges (red prb)\" \n using se_step(3) \\rv1 = src re\\ \\re' \\ out_edges (red prb') rv1\\ \n \\be \\ ui_edge re\\ \\be = ui_edge re'\\ \n by (auto simp add : vertices_def)\n \n thus \"subpath_from (red prb) rv1 [re'] (subs prb)\"\n using \\re' \\ out_edges (red prb') rv1\\ \n subs_sub_rel_of[OF se_step(1)]\n by (rule_tac ?x=\"tgt re'\" in exI) \n (simp add : rb_sp_one[OF se_step(1)])\n qed\n qed\n \n moreover\n have \"be \\ out_edges (black prb) (fst rv1)\" \n using F \\bes2 = be # bes2'\\ by (simp add : Graph.sp_Cons)\n \n ultimately\n show \"ui_edge ` out_edges (red prb') rv1 \\ out_edges (black prb') (fst rv1)\"\n using se_step(3) red_OA_subset_black_OA[OF RB', of rv1] by auto\n qed\n next\n show \"subpath (red prb') rv res1 rv1 (subs prb')\" \n using se_step(3) C by (auto simp add : sp_in_extends_w_subs)\n (*next show \"\\ marked prb' rv1\" using se_step(3) D `rv1 \\ tgt ra` by auto*)\n next\n show \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv1 res21 (subs prb'))\"\n apply (intro notI)\n apply (elim exE conjE)\n proof -\n fix res21 bes22 rv3 \n assume \"bes2 = ui_es res21 @ bes22\"\n and \"res21 \\ []\"\n and \"subpath (red prb') rv1 res21 rv3 (subs prb')\" \n moreover\n then obtain re' res21' where \"res21 = re' # res21'\" \n and \"be = ui_edge re'\"\n using \\bes2 = be # bes2'\\ unfolding neq_Nil_conv by (elim exE) simp \n ultimately\n have \"re' \\ edges (red prb')\" by (simp add : sp_Cons) \n moreover\n have \"re' \\ edges (red prb)\" \n using E\n apply (intro notI)\n apply (elim notE)\n apply (rule_tac ?x=\"[re']\" in exI)\n apply (rule_tac ?x=\"bes2'\" in exI)\n proof (intro conjI)\n show \"bes2 = ui_es [re'] @ bes2'\" \n using \\bes2 = be # bes2'\\ \\be = ui_edge re'\\ by simp\n next\n show \"[re'] \\ []\" by simp\n next\n assume \"re' \\ edges (red prb)\" \n thus \"subpath_from (red prb) rv1 [re'] (subs prb)\"\n using subs_sub_rel_of[OF se_step(1)]\n \\subpath (red prb') rv1 res21 rv3 (subs prb')\\ \n \\res21 = re' # res21'\\\n apply (rule_tac ?x=\"tgt re'\" in exI)\n apply (simp add: rb_sp_Cons[OF RB'])\n apply (simp add : rb_sp_one[OF se_step(1)])\n using se_step(3) by auto\n qed\n \n ultimately\n show False \n using se_step(3) \\be \\ ui_edge re\\ \\be = ui_edge re'\\ by auto\n qed \n next\n show \"Graph.subpath_from (black prb') (fst rv1) bes2\" \n using se_step(3) F by auto\n qed\n qed\n qed \n next\n (* If rv1 is not the source of the new edge, then the out-going red edges of rv1 in the \n new red part are the same as in the old red part. Thus res1 is a suitable red prefix, \n and bes2 a suitable black suffix. *)\n assume \"rv1 \\ src re\"\n \n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n apply (intro conjI, goal_cases)\n proof -\n show \"bes = ui_es res1 @ bes2\" by (rule \\bes = ui_es res1 @ bes2\\)\n next\n case 2 show ?case \n apply (rule_tac ?x=\"rv1\" in exI)\n proof (intro conjI, goal_cases) \n show \"rv1 \\ fringe prb'\" \n using se_step(3) B \\rv1 \\ src re\\ \\rv1 \\ tgt re\\\n seE_fringe1[OF subs_sub_rel_of[OF se_step(1)] se_step(3)]\n seE_fringe2[OF se_step(3)]\n seE_fringe3[OF se_step(3)]\n seE_fringe4[OF subs_sub_rel_of[OF se_step(1)] se_step(3)] \n seE_fringe5[OF se_step(3)]\n apply (case_tac \"marked prb (src re)\")\n apply simp\n apply (case_tac \"ui_edge ` out_edges (red prb') (src re) \\ \n out_edges (black prb) (fst (src re))\") \n apply (case_tac \"out_edges (black prb) (fst (tgt re)) = {}\")\n apply simp\n apply simp \n apply (case_tac \"out_edges (black prb) (fst (tgt re)) = {}\")\n apply simp\n apply simp\n done\n next\n show \"subpath (red prb') rv res1 rv1 (subs prb')\"\n using se_step(3) C by (auto simp add :sp_in_extends_w_subs)\n (*next\n show \"\\ marked prb' rv1\" \n using se_step(3) B D by (elim conjE) (auto simp add : fringe_def)*)\n next\n show \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv1 res21 (subs prb'))\" \n proof (intro notI, elim exE conjE)\n fix res21 bes22 rv2 \n assume \"bes2 = ui_es res21 @ bes22\"\n and \"res21 \\ []\"\n and \"subpath (red prb') rv1 res21 rv2 (subs prb')\" \n then obtain re' res21' where \"res21 = re' # res21'\" \n using \\res21 \\ []\\ unfolding neq_Nil_conv by blast\n \n have \"rv1 = src re' \\ (rv1,src re') \\ subs prb\"\n and \"re' \\ edges (red prb')\"\n using se_step(3) rb_sp_Cons[OF RB']\n \\subpath (red prb') rv1 res21 rv2 (subs prb')\\ \\res21 = re' # res21'\\\n by auto\n \n moreover\n have \"re' \\ edges (red prb)\"\n proof -\n have \"re' \\ re\"\n using \\rv1 = src re' \\ (rv1,src re') \\ subs prb\\\n proof (elim disjE, goal_cases)\n case 1 thus ?thesis using \\rv1 \\ src re\\ by auto\n next\n case 2 thus ?case \n using B unfolding fringe_def subsumees_conv by fast\n qed \n thus ?thesis using se_step(3) \\re' \\ edges (red prb')\\ by simp\n qed\n \n show False \n using E\n apply (elim notE)\n apply (rule_tac ?x=\"[re']\" in exI)\n apply (rule_tac ?x=\"ui_es res21' @ bes22\" in exI)\n proof (intro conjI)\n show \"bes2 = ui_es [re'] @ ui_es res21' @ bes22\"\n using \\bes2 = ui_es res21 @ bes22\\ \\res21 = re' # res21'\\ by simp\n next\n show \"[re'] \\ []\" by simp\n next\n show \"subpath_from (red prb) rv1 [re'] (subs prb)\"\n using se_step(1) \n \\rv1 = src re' \\ (rv1,src re') \\ subs prb\\ \n \\re' \\ edges (red prb)\\\n rb_sp_one subs_sub_rel_of \n by fast\n qed\n qed\n next\n case 4 show ?case using se_step(3) F by auto\n qed\n qed\n qed\n \n qed\n\n next \n (* If rl is the target of the new red edge, then we show that the empty (red) subpath is \n suitable prefix and bes a suitable suffix, using the fact that the target of the new edge \n is in the new fringe and can not be marked. *)\n assume \"rv = tgt re\"\n\n show ?thesis \n proof (case_tac \"out_edges (black prb) (fst (tgt re)) = {}\")\n \n assume \"out_edges (black prb) (fst (tgt re)) = {}\"\n show ?thesis\n\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"[]\" in exI)\n proof (intro conjI, rule_tac ?x=\"tgt re\" in exI, intro conjI)\n show \"subpath (red prb') rv [] (tgt re) (subs prb')\"\n using se_step(3) \\rv = tgt re\\ rb_Nil_sp[OF RB'] by (auto simp add : vertices_def)\n next\n have \"sat (confs prb' (tgt re))\" \n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n \\rv = tgt re\\ se_star_sat_imp_sat\n by (auto simp add : feasible_def)\n \n thus \"\\ marked prb' (tgt re)\" \n using se_step(3) sat_not_marked[OF RB', of \"tgt re\"]\n by (auto simp add : vertices_def)\n next\n show \"bes = ui_es []\" \n using se_step(3) \\rv = tgt re\\ \\out_edges (black prb) (fst (tgt re)) = {}\\\n \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n by (cases bes) (auto simp add : Graph.sp_Cons)\n qed\n\n next\n assume \"out_edges (black prb) (fst (tgt re)) \\ {}\"\n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"[]\" in exI)\n apply (rule_tac ?x=\"bes\" in exI)\n proof (intro conjI, goal_cases) \n show \"bes = ui_es [] @ bes\" by simp\n next\n case 2 \n show ?case \n apply (rule_tac ?x=\"rv\" in exI)\n proof (intro conjI)\n have \"\\ marked prb (src re)\" \n proof -\n have \"sat (confs prb' (tgt re))\" \n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n \\rv = tgt re\\ se_star_sat_imp_sat\n by (auto simp add : feasible_def)\n\n hence \"sat (confs prb' (src re))\" \n using se_step se_sat_imp_sat by auto\n\n moreover\n have \"src re \\ tgt re\" using se_step by auto\n\n ultimately\n have \"sat (confs prb (src re))\" \n using se_step(3) by (auto simp add : vertices_def)\n\n thus ?thesis \n using se_step sat_not_marked[OF se_step(1), of \"src re\"] by fast\n qed\n \n thus \"rv \\ fringe prb'\" \n using se_step(3) \\rv = tgt re\\ \\out_edges (black prb) (fst (tgt re)) \\ {}\\ \n seE_fringe1[OF subs_sub_rel_of[OF se_step(1)] se_step(3)] \n seE_fringe4[OF subs_sub_rel_of[OF se_step(1)] se_step(3)] \n by auto\n \n next\n \n show \"subpath (red prb') rv [] rv (subs prb')\" \n using se_step(3) \\rv = tgt re\\ subs_sub_rel_of[OF RB']\n by (auto simp add : subpath_def vertices_def)\n \n next\n \n show \"\\ (\\res21 bes22. bes = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv res21 (subs prb'))\"\n \n proof (intro notI, elim exE conjE)\n fix res1 bes22 rv'\n \n assume \"bes = ui_es res1 @ bes22\"\n and \"res1 \\ []\"\n and \"subpath (red prb') rv res1 rv' (subs prb')\"\n \n have \"out_edges (red prb') (tgt re) \\ {} \\ tgt re \\ subsumees (subs prb')\"\n proof -\n obtain re' res2 where \"res1 = re'#res2\" \n using \\res1 \\ []\\ unfolding neq_Nil_conv by blast\n \n hence \"rv = src re' \\ (rv,src re') \\ subs prb\"\n using se_step(3) \\subpath (red prb') rv res1 rv' (subs prb')\\\n rb_sp_Cons[OF RB', of rv re' res2 rv']\n by auto\n \n thus ?thesis\n proof (elim disjE) \n assume \"rv = src re'\"\n \n moreover\n hence \"re' \\ out_edges (red prb') (tgt re)\" \n using \\subpath (red prb') rv res1 rv' (subs prb')\\ \n \\res1 = re'#res2\\ \\rv = tgt re\\ \n by (auto simp add : sp_Cons)\n \n ultimately\n show ?thesis using se_step(3) by auto\n next\n assume \"(rv,src re') \\ subs prb\"\n \n hence \"tgt re \\ red_vertices prb\" \n using se_step(3) \\rv = tgt re\\ subs_sub_rel_of[OF se_step(1)]\n unfolding sub_rel_of_def by force\n \n thus ?thesis using se_step(3) by auto\n qed\n qed\n \n thus False \n proof (elim disjE)\n assume \"out_edges (red prb') (tgt re) \\ {}\" \n thus ?thesis using se_step(3) \n by (auto simp add : vertices_def image_def)\n next\n assume \"tgt re \\ subsumees (subs prb')\"\n \n hence \"tgt re \\ red_vertices prb\" \n using se_step(3) subs_sub_rel_of[OF se_step(1)]\n unfolding subsumees_conv sub_rel_of_def by fastforce\n \n thus ?thesis using se_step(3) by (auto simp add : vertices_def)\n qed\n qed\n next\n show \"Graph.subpath_from (black prb') (fst rv) bes\" \n using se_step(3) \n \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n by simp\n qed\n qed\n qed\n qed\n qed\n\nnext\n \n case (mark_step prb rv2 prb' rv1)\n have \"finite_RedBlack prb\" using mark_step by (auto simp add : finite_RedBlack_def)\n show ?case \n unfolding subset_iff\n proof (intro allI impI) \n (* Suppose that bes is a (black) feasible subpath starting at the black vertex represented by \n red vertex rv1. Hence, by IH, bes is a red-black subpath starting at rv1 in the old red-black \n graph. We proceed by case distinction. *)\n fix bes \n assume \"bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\"\n then obtain c where \"se_star (confs prb rv1) (trace bes (labelling (black prb))) c\"\n and \"sat c\"\n using mark_step(3) \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\\n by (simp add : feasible_def) blast\n\n have \"bes \\ RedBlack_subpaths_from prb rv1\" \n using mark_step(2)[of rv1] mark_step(3-7) \n \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\ \n by auto\n \n thus \"bes \\ RedBlack_subpaths_from prb' rv1\" \n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE)\n (* Suppose that bes is entirely represented in the old red part and let us call rv3 the red \n vertex where it ends. We show that it is still fully represented in the new red-part and \n that rv3 is still not marked in the new red-black graph. We call res the red subpath \n representing bes in the old red part. *)\n fix res rv3\n assume \"bes = ui_es res\" \n and \"subpath (red prb) rv1 res rv3 (subs prb)\"\n and \"\\ marked prb rv3\"\n show ?thesis \n\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n proof (intro disjI1,rule_tac ?x=\"res\" in exI,intro conjI)\n\n show \"\\rv'. subpath (red prb') rv1 res rv' (subs prb') \\ \\ marked prb' rv'\" \n apply (rule_tac ?x=\"rv3\" in exI)\n proof (intro conjI) \n show \"subpath (red prb') rv1 res rv3 (subs prb')\"\n using mark_step(3) \\subpath (red prb) rv1 res rv3 (subs prb)\\\n by auto\n next\n (* We then show that rv3 is not marked. *)\n show \"\\ marked prb' rv3\" \n proof -\n (* res being a red subpath from rv1 to rv3, and c being the configuration obtained \n from the configuration at rv1 by symbolic execution of the trace of bes (and hence \n res), we have that c is subsumed by the configuration at rv3. Hence, this \n configuration is satisfiable, c being satisfiable. Thus, rv3 can not be marked. *)\n have \"sat (confs prb rv3)\"\n proof -\n have \"c \\ confs prb rv3\"\n using mark_step(1) \n \\subpath (red prb) rv1 res rv3 (subs prb)\\ \n \\bes = ui_es res\\\n \\se_star (confs prb rv1) (trace bes (labelling (black prb))) c\\\n \\finite_RedBlack prb\\\n finite_RedBlack.SE_rel\n by simp\n \n thus ?thesis \n using \\se_star (confs prb rv1) (trace bes (labelling (black prb))) c\\ \n \\sat c\\\n sat_sub_by_sat\n by fast\n qed \n thus ?thesis \n using mark_step(3) \\subpath (red prb) rv1 res rv3 (subs prb)\\\n lst_of_sp_is_vert[of \"red prb\" rv1 res rv3 \"subs prb\"]\n sat_not_marked[OF RedBlack.mark_step[OF mark_step(1,3)]]\n by auto\n qed\n qed\n\n next\n (* By construction, res represents bes. *)\n show \"bes = ui_es res\" by (rule \\bes = ui_es res\\)\n qed\n\n next\n (* Suppose that bes has a maximal red prefix res1 leading to non-marked element rv3 of the old \n fringe, and a black suffix bes2. We show that res1 and bes2 are still suitable red prefix \n and black prefix, respectively, in the new red part. *)\n fix res1 bes2 rv3 bl\n\n assume A : \"bes = ui_es res1 @ bes2\"\n and B : \"rv3 \\ fringe prb\"\n and C : \"subpath (red prb) rv1 res1 rv3 (subs prb)\" (*and D : \"\\ marked prb rv3\"*)\n and E : \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv3 res21 (subs prb))\"\n and F : \"Graph.subpath (black prb) (fst rv3) bes2 bl\"\n\n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n proof (intro conjI, goal_cases) \n show \"bes = ui_es res1 @ bes2\" by (rule \\bes = ui_es res1 @ bes2\\)\n next\n case 2 show ?case\n apply (rule_tac ?x=\"rv3\" in exI)\n proof (intro conjI)\n (* Marking a red vertex does not change the fringe, so rv3 is in the new fringe. *)\n have \"sat (confs prb rv3)\" \n proof -\n obtain c'\n where \"se_star (confs prb rv1) (trace (ui_es res1) (labelling (black prb))) c'\"\n and \"se_star c' (trace bes2 (labelling (black prb))) c\"\n and \"sat c'\"\n using A \\se_star (confs prb rv1) (trace bes (labelling (black prb))) c\\ \\sat c\\\n by (simp add : se_star_append se_star_sat_imp_sat) blast\n \n moreover\n hence \"c' \\ confs prb rv3\"\n using \\finite_RedBlack prb\\ mark_step(1) C finite_RedBlack.SE_rel by fast\n \n ultimately\n show ?thesis by (simp add : sat_sub_by_sat)\n qed\n\n thus \"rv3 \\ fringe prb'\" using mark_step(3) B by (auto simp add : fringe_def) \n next\n show \"subpath (red prb') rv1 res1 rv3 (subs prb')\"\n using mark_step(3) \\subpath (red prb) rv1 res1 rv3 (subs prb)\\\n by auto\n next\n (* We show that res1 is a maximal prefix, which is trivial because the new red part \n contains less subpaths than the old, and res1 was already maximal. *)\n show \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv3 res21 (subs prb'))\"\n proof (intro notI, elim exE conjE)\n \n fix res21 bes22 rv4\n \n assume \"bes2 = ui_es res21 @ bes22\"\n and \"res21 \\ []\"\n and \"subpath (red prb') rv3 res21 rv4 (subs prb')\"\n \n show False \n using E\n proof (elim notE,rule_tac ?x=\"res21\" in exI,\n rule_tac ?x=\"bes22\" in exI,intro conjI)\n show \"bes2 = ui_es res21 @ bes22\" by (rule \\bes2 = ui_es res21 @ bes22\\)\n next\n show \"res21 \\ []\" by (rule \\res21 \\ []\\)\n next\n show \"subpath_from (red prb) rv3 res21 (subs prb)\"\n using mark_step(3) \n \\subpath (red prb') rv3 res21 rv4 (subs prb')\\\n by (simp del : split_paired_Ex) blast\n qed\n qed\n\n next\n show \"Graph.subpath_from (black prb') (fst rv3) bes2\" using mark_step(3) F by simp blast \n qed\n qed\n qed \n qed\n\nnext\n\n case (subsum_step prb sub prb' rv)\n\n hence \"finite_RedBlack prb\" by (auto simp add : finite_RedBlack_def)\n \n have RB' : \"RedBlack prb'\" by (rule RedBlack.subsum_step[OF subsum_step(1,3)])\n\n show ?case \n unfolding subset_iff\n proof (intro allI impI)\n (* Let bes be a feasible subpath starting at a black vertex represented by rl. By IH, bes is \n a red-black subpath in the old red-black graph. We proceed by case distinction. *)\n fix bes\n assume \"bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\"\n\n hence \"bes \\ RedBlack_subpaths_from prb rv\" \n using subsum_step(2)[of rv] subsum_step(3-7) by auto\n \n thus \"bes \\ RedBlack_subpaths_from prb' rv\"\n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE)\n (* Suppose that bes is entirely represented in the old red part, then it is also entirely \n represented in the new red part, qed. *)\n fix res rv'\n assume \"bes = ui_es res\"\n and \"subpath (red prb) rv res rv' (subs prb)\"\n and \"\\ marked prb rv'\"\n thus \"bes \\ RedBlack_subpaths_from prb' rv\" \n using subsum_step(3) sp_in_extends[of sub \"red prb\"]\n by (simp (no_asm) only : RedBlack_subpaths_from_def Un_iff image_def \n Bex_def mem_Collect_eq,\n intro disjI1, rule_tac ?x=\"res\" in exI, intro conjI)\n (rule_tac ?x=\"rv'\" in exI, auto)\n\n next\n (* Suppose that bes was of the form ui_es res1 @ bes2, with res1 ending in a red vertex that \n we call rv'. *)\n fix res1 bes2 rv' bl\n assume A : \"bes = ui_es res1 @ bes2\"\n and B : \"rv' \\ fringe prb\"\n and C : \"subpath (red prb) rv res1 rv' (subs prb)\"\n (*and D : \"\\ marked prb rv'\"*)\n and E : \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv' res21 (subs prb))\"\n and F : \"Graph.subpath (black prb) (fst rv') bes2 bl\" \n show \"bes \\ RedBlack_subpaths_from prb' rv\" \n proof (case_tac \"rv' = subsumee sub\")\n (* Suppose that rv' is the newly subsumed red vertex. The idea here is to show that \n either bes2 is a suitable black suffix from the new subsumer, either it is of the form \n ui_es res21 @ bes22 such that res21 is maximal and ends in a non-marked element of the \n (new) fringe, making res1@res21 a suitable red prefix and bes22 a suitable black suffix \n for bes to be a red-black subpath of the new red-black graph (note that bes2 and bes22 \n might be empty).\n\n However, assumptions from subsum_step and facts 1 to 6 are not sufficient to \n to conclude. We proceed by beckward induction on bes2. *)\n\n assume \"rv' = subsumee sub\" \n\n show ?thesis\n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\ A C F\n proof (induct bes2 arbitrary : bes bl rule : rev_induct, goal_cases)\n (* Suppose that the black suffix is empty, then bes is entirely representend by res1 in \n the new red part and ends in rv' which is not marked, qed. *)\n case (1 bes bl) thus ?case\n using subsum_step(3) B sp_in_extends[of sub \"red prb\"]\n by (simp (no_asm) only : \n RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq,\n intro disjI1, rule_tac ?x=\"res1\" in exI, intro conjI)\n (rule_tac ?x=\"rv'\" in exI, auto simp add : fringe_def)\n \n next\n (* Suppose that the black subpath is not empty. We call bes2 the prefix obtained from this\n subpath by removing its last edge, which we call be. \n\n We first show that ui_es res1 @ bes2 is a red-black subpath in the old new-black graph.\n using our \"internal\" induction hypothesis. We then proceed by case distinction. *)\n case (2 be bes2 bes bl)\n then obtain c1 c2 c3 \n where \"se_star (confs prb' rv) (trace (ui_es res1) (labelling (black prb))) c1\"\n and \"se_star c1 (trace bes2 (labelling (black prb))) c2\"\n and \"se c2 (labelling (black prb) be) c3\"\n and \"sat c3\"\n using subsum_step(3)\n by (simp add : feasible_def se_star_append se_star_append_one se_star_one) blast\n \n have \"ui_es res1 @ bes2 \\ RedBlack_subpaths_from prb' rv\" \n proof -\n have \"ui_es res1 @ bes2 \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\" \n proof -\n \n have \"Graph.subpath_from (black prb') (fst rv) (ui_es res1 @ bes2)\"\n using subsum_step 2(5) red_sp_imp_black_sp[OF subsum_step(1) C]\n by (simp add : Graph.sp_append) blast\n \n moreover\n have \"feasible (confs prb' rv) \n (trace (ui_es res1 @ bes2) (labelling (black prb')))\"\n proof -\n have \"se_star (confs prb' rv) \n (trace (ui_es res1@bes2) (labelling (black prb'))) \n c2\"\n using subsum_step \n \\se_star (confs prb' rv) (trace (ui_es res1) \n (labelling (black prb))) (c1)\\\n \\se_star c1 (trace bes2 (labelling (black prb))) c2\\\n by (simp add : se_star_append) blast\n \n moreover\n have \"sat c2\" \n using \\se c2 (labelling (black prb) be) c3\\ \\sat c3\\ \n by (simp add : se_sat_imp_sat)\n \n ultimately\n show ?thesis by (simp add : feasible_def) blast\n qed\n \n ultimately\n show ?thesis by simp\n qed\n \n moreover\n have \"Graph.subpath_from (black prb) (fst rv') bes2\"\n using 2(5) by (auto simp add : Graph.sp_append_one)\n \n ultimately\n show ?thesis using 2(1,4) by(auto simp add : Graph.sp_append_one)\n qed\n\n thus ?case \n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE, goal_cases)\n (* Suppose that ui_es res1 @ bes2 is entirely represented in the new red part by \n a red subpath that we call res, and ends in a red vertex that we call rv''. \n We conclude depending on the fact that be is represented by an out-going \n (red edge) from rv'' or not. *)\n case (1 res rv'') \n show ?thesis \n proof (case_tac \"be \\ ui_edge ` out_edges (red prb') rv''\")\n (* If this is the case, then bes = ui_es res1 @ bes2 @ [be] is entirely \n represented in the new red part. We call ra the red edge representing be from \n rv''. \n \n Moreover, we showed earlier that the configuration c3 that is obtained from the \n configuration at rl by symbolic execution of (the trace of) \n bes = ui_es res1 @ bes2 @ [be] is satisfiable. As c3 is subsumed by the \n configuration at the target of ra, this last configuration is also satisfiable, \n and thus not marked, qed. *)\n assume \"be \\ ui_edge ` out_edges (red prb') rv''\"\n then obtain re where \"be = ui_edge re\"\n and \"re \\ out_edges (red prb') rv''\"\n by blast\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res@[re]\" in exI)\n proof (intro conjI,rule_tac ?x=\"tgt re\" in exI,intro conjI)\n show \"subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\" \n using 1(2) \\re \\ out_edges (red prb') rv''\\ \n by (simp add : sp_append_one)\n next\n show \"\\ marked prb' (tgt re)\" \n proof -\n have \"sat (confs prb' (tgt re))\"\n proof -\n have \"subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\" \n using 1(2) \\re \\ out_edges (red prb') rv''\\ \n by (simp add : sp_append_one)\n \n then obtain c \n where \"se_star (confs prb' rv) \n (trace (ui_es (res@[re])) (labelling (black prb))) \n c\"\n using subsum_step(3,5,6,7) RB'\n finite_RedBlack.sp_imp_ex_se_star_succ\n [of prb' rv \"res@[re]\" \"tgt re\"]\n unfolding finite_RedBlack_def \n by simp blast\n \n hence \"sat c\" \n using 1(1)\n \\se_star (confs prb' rv) (trace (ui_es res1) \n (labelling (black prb))) (c1)\\\n \\se_star c1 (trace bes2 (labelling (black prb))) c2\\\n \\se c2 (labelling (black prb) be) c3\\ \n \\sat c3\\ \\be = ui_edge re\\\n se_star_succs_states\n [of \"confs prb' rv\" \n \"trace(ui_es(res@[re]))(labelling(black prb))\" \n c3]\n apply (subst (asm) eq_commute)\n by (auto simp add : se_star_append_one se_star_append \n se_star_one sat_eq)\n \n moreover\n have \"c \\ confs prb' (tgt re)\" \n using subsum_step(3,5,6,7) \n \\subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\\ \n \\se_star (confs prb' rv)(trace (ui_es (res@[re])) \n (labelling (black prb)))(c)\\\n finite_RedBlack.SE_rel[of prb'] RB'\n by (simp add : finite_RedBlack_def)\n \n ultimately\n show ?thesis by (simp add: sat_sub_by_sat)\n qed\n \n thus ?thesis \n using \\re \\ out_edges (red prb') rv''\\ \n sat_not_marked[OF RB', of \"tgt re\"]\n by (auto simp add : vertices_def)\n qed\n next\n show \"bes = ui_es (res@[re])\" using 1(1) 2(3) \\be = ui_edge re\\ by simp\n qed\n \n next\n (* Suppose that be is not represented from rv''. We cannot conclude that [be] is \n a suitable suffix starting from rv'' for proving the goal, because rv'' might \n have been subsumed earlier. If this is the case, we have to show that [be] is \n a suitable suffix from the red vertex that subsums rv''. *)\n assume \"be \\ ui_edge ` out_edges (red prb') rv''\"\n \n show ?thesis\n proof (case_tac \"rv'' \\ subsumees (subs prb')\")\n (* We suppose that rv'' is subsumed by a red vertex arv''. We conclude depen-\n ding on the fact that be is represented in the out-going edges of arv'' or \n not. *)\n assume \"rv'' \\ subsumees (subs prb')\"\n \n then obtain arv'' where \"(rv'',arv'') \\ (subs prb')\" by auto\n \n hence \"subpath (red prb') rv res arv'' (subs prb')\" \n using \\subpath (red prb') rv res rv'' (subs prb')\\\n by (simp add : sp_append_sub)\n \n show ?thesis\n proof (case_tac \"be \\ ui_edge ` out_edges (red prb') arv''\")\n (* If be is represented in the out-going edges of arv'', then bes is entirely \n represented in the new red part, from rl to tgt ra. Moreover, the \n configuration at the target of ra subsums c, which is satisfiable, thus \n tgt ra can not be marked, qed. *)\n assume \"be \\ ui_edge ` out_edges (red prb') arv''\"\n \n then obtain re where \"re \\ out_edges (red prb') arv''\"\n and \"be = ui_edge re\"\n by blast\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff image_def \n Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res@[re]\" in exI)\n proof (intro conjI,rule_tac ?x=\"tgt re\" in exI,intro conjI)\n \n show \"subpath (red prb') rv (res @ [re]) (tgt re) (subs prb')\"\n using \\subpath (red prb') rv res arv'' (subs prb')\\ \n \\re \\ out_edges (red prb') arv''\\\n by (simp add : sp_append_one)\n \n next\n \n have \"sat (confs prb' (tgt re))\"\n proof -\n have \"subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\" \n using \\subpath (red prb') rv res arv'' (subs prb')\\ \n \\re \\ out_edges (red prb') arv''\\\n by (simp add : sp_append_one)\n \n then obtain c \n where se : \"se_star (confs prb' rv) (trace (ui_es (res@[re])) \n (labelling (black prb))) (c)\"\n using subsum_step(3,5,6,7) RB'\n finite_RedBlack.sp_imp_ex_se_star_succ\n [of prb' rv \"res@[re]\" \"tgt re\"]\n unfolding finite_RedBlack_def \n by simp blast\n \n hence \"sat c\" \n using 1(1)\n \\se_star (confs prb' rv) (trace (ui_es res1) \n (labelling (black prb))) (c1)\\\n \\se_star c1 (trace bes2 (labelling (black prb))) c2\\\n \\se c2 (labelling (black prb) be) c3\\ \\sat c3\\ \n \\be = ui_edge re\\\n se_star_succs_states\n [of \"confs prb' rv\" \n \"trace (ui_es(res@[re]))\n (labelling (black prb))\" \n \"c3\"]\n apply (subst (asm) eq_commute)\n by (auto simp add : se_star_append_one se_star_append \n se_star_one sat_eq)\n \n moreover\n have \"c \\ confs prb' (tgt re)\" \n using subsum_step(3,5,6,7) se RB' \n finite_RedBlack.SE_rel[of prb']\n \\subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\\ \n by (simp add : finite_RedBlack_def)\n \n ultimately\n show ?thesis by (simp add: sat_sub_by_sat)\n qed\n \n thus \"\\ marked prb' (tgt re)\" \n using \\re \\ out_edges (red prb') arv''\\ \n sat_not_marked[OF RB', of \"tgt re\"]\n by (auto simp add : vertices_def)\n \n next\n \n show \"bes = ui_es (res @ [re])\" \n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res\\\n \\be = ui_edge re\\\n by simp\n \n qed\n \n next\n (* Suppose that be is not represented in the out-going edges of arv''. We \n show that res is a suitable red prefix and [be] a suitable black prefix.*)\n assume A : \"be \\ ui_edge ` out_edges (red prb') arv''\"\n \n have \"src be = fst arv''\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) (ui_es res1 @ bes2) (fst arv'')\"\n using \\ui_es res1 @ bes2 = ui_es res\\ \n \\subpath (red prb') rv res arv'' (subs prb')\\ \n red_sp_imp_black_sp[OF RB']\n by auto\n \n moreover\n have \"Graph.subpath (black prb') (fst rv) (ui_es res1 @ bes2) (src be)\"\n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv) (fst rv)\\\n \\bes = ui_es res1 @ bes2 @ [be]\\\n by (auto simp add : Graph.sp_append Graph.sp_append_one Graph.sp_one)\n \n ultimately\n show ?thesis \n using sp_same_src_imp_same_tgt by fast\n qed\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res\" in exI)\n apply (rule_tac ?x=\"[be]\" in exI)\n proof (intro conjI, goal_cases)\n \n show \"bes = ui_es res @ [be]\" \n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res\\\n by simp\n \n next\n \n case 2 show ?case \n apply (rule_tac ?x=\"arv''\" in exI)\n proof (intro conjI) \n \n show \"arv'' \\ fringe prb'\" \n unfolding fringe_def mem_Collect_eq\n proof (intro conjI)\n show \"arv'' \\ red_vertices prb'\" \n using \\subpath (red prb') rv res arv'' (subs prb')\\\n by (simp add : lst_of_sp_is_vert)\n next\n show \"arv'' \\ subsumees (subs prb')\" \n using \\(rv'',arv'') \\ subs prb'\\ subs_wf_sub_rel[OF RB']\n unfolding wf_sub_rel_def Ball_def\n by (force simp del : split_paired_All)\n next\n show \"\\ marked prb' arv''\"\n using \\(rv'',arv'') \\ (subs prb')\\ subsumer_not_marked[OF RB']\n by fastforce\n next\n have \"be \\ edges (black prb')\" \n using subsum_step(3)\n \\Graph.subpath (black prb) (fst rv') (bes2 @ [be]) bl\\\n by (simp add : Graph.sp_append_one)\n \n thus \"ui_edge ` out_edges (red prb') arv'' \\ out_edges (black prb') \n (fst arv'')\"\n using \\src be = fst arv''\\ A red_OA_subset_black_OA[OF RB', of arv'']\n by auto\n qed\n \n next\n \n show \"subpath (red prb') rv res arv'' (subs prb')\"\n by (rule \\subpath (red prb') rv res arv'' (subs prb')\\)\n \n next\n \n show \"\\ (\\res21 bes22. [be] = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') arv'' res21 (subs prb'))\"\n proof (intro notI, elim exE conjE, goal_cases)\n case (1 res21 bes22 rv''')\n \n have \"be \\ ui_edge ` out_edges (red prb') arv''\" \n proof -\n obtain re res21' where \"res21 = re # res21'\"\n using 1(2) unfolding neq_Nil_conv by blast\n \n have \"be = ui_edge re\" and \"re \\ out_edges (red prb') arv''\" \n proof -\n show \"be = ui_edge re\" using 1(1) \\res21 = re # res21'\\ by simp\n next\n have \"re \\ edges (red prb')\"\n using 1(3) \\res21 = re # res21'\\ by (simp add : sp_Cons)\n \n moreover\n have \"src re = arv''\"\n proof -\n have \"(arv'',src re) \\ subs prb'\" \n using \\(rv'',arv'') \\ subs prb'\\ subs_wf_sub_rel[OF RB']\n unfolding wf_sub_rel_def Ball_def \n by (force simp del : split_paired_All)\n \n thus ?thesis\n using 1(3) \\res21 = re # res21'\\\n by (simp add : rb_sp_Cons[OF RB'])\n qed\n \n ultimately\n show \"re \\ out_edges (red prb') arv''\" by simp\n qed\n \n thus ?thesis by auto\n qed\n \n thus False using A by (elim notE)\n qed\n \n next\n \n show \"Graph.subpath_from (black prb') (fst arv'') [be]\" \n using subsum_step(3)\n \\Graph.subpath (black prb) (fst rv') (bes2 @ [be]) bl\\\n \\(rv'',arv'') \\ subs prb'\\\n \\subpath (red prb') rv res arv'' (subs prb')\\\n \\src be = fst arv''\\\n RB' red_sp_imp_black_sp subs_to_same_BL\n by (simp add : Graph.sp_append_one Graph.sp_one)\n qed\n qed\n qed\n \n next\n (* Now suppose that rv'' is not subsumed in the new red-black graph. If be is \n represented in the out-going edges pf rv'', then ui_es res1 @ bes2 @ [be] \n is entirely represented in the new red part. Otherwise, res is a suitable \n red prefix and [be] a suitable black prefix. *)\n assume \"rv'' \\ subsumees (subs prb')\"\n \n show ?thesis\n proof (case_tac \"be \\ ui_edge ` out_edges (red prb') rv''\")\n \n assume \"be \\ ui_edge ` out_edges (red prb') rv''\"\n \n then obtain re where \"be = ui_edge re\"\n and \"re \\ out_edges (red prb') rv''\"\n by blast\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff image_def \n Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res @ [re]\" in exI)\n apply (intro conjI)\n proof (rule_tac ?x=\"tgt re\" in exI,intro conjI)\n show \"subpath (red prb') rv (res @ [re]) (tgt re) (subs prb')\"\n using \\subpath (red prb') rv res rv'' (subs prb')\\\n \\re \\ out_edges (red prb') rv''\\\n by (simp add : sp_append_one)\n next\n show \"\\ marked prb' (tgt re)\"\n proof -\n have \"sat (confs prb' (tgt re))\"\n proof -\n have \"subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\" \n using \\subpath (red prb') rv res rv'' (subs prb')\\ \n \\re \\ out_edges (red prb') rv''\\\n by (simp add : sp_append_one)\n \n then obtain c \n where se : \"se_star (confs prb' rv)(trace (ui_es (res@[re])) \n (labelling (black prb)))(c)\"\n using subsum_step(3,5,6,7) RB'\n finite_RedBlack.sp_imp_ex_se_star_succ\n [of prb' rv \"res@[re]\" \"tgt re\"]\n unfolding finite_RedBlack_def \n by simp blast\n \n hence \"sat c\" \n using 1(1)\n \\se_star (confs prb' rv) (trace (ui_es res1) \n (labelling (black prb))) (c1)\\\n \\se_star c1 (trace bes2 (labelling (black prb))) c2\\\n \\se c2 (labelling (black prb) be) c3\\ \\sat c3\\ \n \\be = ui_edge re\\ \n se_star_succs_states\n [of \"confs prb' rv\" \n \"trace (ui_es (res@[re])) (labelling (black prb))\" \n \"c3\"]\n apply (subst (asm) eq_commute)\n by (auto simp add : se_star_append_one se_star_append \n se_star_one sat_eq)\n \n moreover\n have \"c \\ confs prb' (tgt re)\" \n using subsum_step(3,5,6,7) se RB' \n finite_RedBlack.SE_rel[of prb']\n \\subpath (red prb') rv (res@[re]) (tgt re) (subs prb')\\ \n by (simp add : finite_RedBlack_def)\n \n ultimately\n show ?thesis by (simp add: sat_sub_by_sat)\n qed\n \n thus ?thesis\n using \\re \\ out_edges (red prb') rv''\\ \n sat_not_marked[OF RB', of \"tgt re\"]\n by (auto simp add : vertices_def)\n qed\n next\n show \"bes = ui_es (res @ [re])\" \n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res\\\n \\be = ui_edge re\\\n by simp\n qed\n \n next\n assume A : \"be \\ ui_edge ` out_edges (red prb') rv''\"\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff Bex_def mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res\" in exI)\n apply (rule_tac ?x=\"[be]\" in exI)\n proof (intro conjI, goal_cases)\n show \"bes = ui_es res @ [be]\" \n using \\ui_es res1 @ bes2 = ui_es res\\ \n \\bes = ui_es res1 @ bes2 @ [be]\\\n by simp\n next\n \n case 2 \n \n have \"src be = fst rv''\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) (ui_es res) (src be)\"\n using \\bes \\ feasible_subpaths_from (black prb') \n (confs prb' rv) (fst rv)\\\n \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res\\\n red_sp_imp_black_sp\n [OF RB' \\subpath (red prb') rv res rv'' (subs prb')\\]\n by (subst (asm)(2) eq_commute) \n (auto simp add : Graph.sp_append Graph.sp_one)\n \n thus ?thesis \n using red_sp_imp_black_sp\n [OF RB' \\subpath (red prb') rv res rv'' (subs prb')\\]\n by (rule sp_same_src_imp_same_tgt)\n qed\n \n show ?case\n apply (rule_tac ?x=\"rv''\" in exI)\n proof (intro conjI)\n \n show \"rv'' \\ fringe prb'\" \n unfolding fringe_def mem_Collect_eq\n proof (intro conjI)\n show \"rv'' \\ red_vertices prb'\" \n using \\subpath (red prb') rv res rv'' (subs prb')\\\n by (simp add : lst_of_sp_is_vert)\n next\n show \"rv'' \\ subsumees (subs prb')\" \n by (rule \\rv'' \\ subsumees (subs prb')\\)\n next\n show \"\\ marked prb' rv''\" by (rule \\\\ marked prb' rv''\\)\n next\n have \"be \\ edges (black prb')\" \n using subsum_step(3)\n \\Graph.subpath (black prb) (fst rv') (bes2 @ [be]) bl\\\n by (simp add : Graph.sp_append_one)\n \n thus \"ui_edge ` out_edges (red prb') rv'' \\ \n out_edges (black prb') (fst rv'')\"\n using \\src be = fst rv''\\ A \n red_OA_subset_black_OA[OF RB', of rv'']\n by auto\n qed\n \n next\n \n show \"subpath (red prb') rv res rv'' (subs prb')\"\n by (rule \\subpath (red prb') rv res rv'' (subs prb')\\)\n \n next\n \n show \"\\ (\\res21 bes22. [be] = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ SubRel.subpath_from (red prb') (rv'') \n (res21) (subs prb'))\"\n proof (intro notI, elim exE conjE, goal_cases)\n case (1 res21 bes22 rv''')\n \n have \"be \\ ui_edge ` out_edges (red prb') rv''\" \n proof -\n obtain re res21' where \"res21 = re # res21'\"\n using 1(2) unfolding neq_Nil_conv by blast\n \n have \"be = ui_edge re\"\n and \"re \\ out_edges (red prb') rv''\" \n proof -\n show \"be = ui_edge re\" using 1(1) \\res21 = re#res21'\\ by simp\n next\n have \"re \\ edges (red prb')\"\n using 1(3) \\res21 = re # res21'\\ by (simp add : sp_Cons)\n \n moreover\n have \"src re = rv''\"\n proof -\n have \"(rv'',src re) \\ subs prb'\" \n using \\rv'' \\ subsumees (subs prb')\\ by force\n \n thus ?thesis\n using 1(3) \\res21 = re # res21'\\\n by (simp add : rb_sp_Cons[OF RB'])\n qed\n \n ultimately\n show \"re \\ out_edges (red prb') rv''\" by simp\n qed\n \n thus ?thesis by auto\n qed\n \n thus False using A by (elim notE)\n qed\n \n next\n \n show \"Graph.subpath_from (black prb') (fst rv'') [be]\"\n using subsum_step(3) \n \\Graph.subpath (black prb) (fst rv') (bes2 @ [be]) bl\\ \n \\src be = fst rv''\\\n by (rule_tac ?x=\"tgt be\" in exI) \n (simp add : Graph.sp_append_one Graph.sp_one)\n \n qed\n qed\n qed\n qed\n qed\n \n next\n (* Now suppose that ui_es res1 @ bes2 is of the form ui_es res1' @ bes2'.\n Then there exists a red vertex rv'' such that :\n - res1' is a maximal red prefix ending in rv'', which is not marked and \n in the new fringe,\n - bes2' starts at the black vertex represented by rv''. \n \n Note that bes2' can be empty. If this is the case, then we conclude depending \n on the fact that be is represented or not in the out-going edges of rv''.\n \n If this is not the case, we show that bes2'@[be] is also a suitable black \n suffix. *)\n case (2 res1' bes2' rv'' bl')\n \n show ?thesis\n proof (case_tac \"bes2' = []\")\n (* Suppose that bes2' is empty. Then either be is represented in the \n out-going edges of rv'', either it is not. *)\n assume \"bes2' = []\"\n \n have \"Graph.subpath (black prb') (fst rv) (ui_es res1' @ [be]) bl\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) (ui_es res1') (src be)\" \n proof -\n have \"Graph.subpath (black prb') (fst rv') bes2 (src be)\"\n using subsum_step(3) \n \\Graph.subpath (black prb) (fst rv') (bes2@[be]) bl\\\n by (simp add : Graph.sp_append_one)\n \n moreover\n have \"subpath (red prb') rv res1 rv' (subs prb')\"\n using subsum_step(3) \\subpath (red prb) rv res1 rv' (subs prb)\\\n by (auto simp add : sp_in_extends)\n \n hence \"Graph.subpath (black prb') (fst rv) (ui_es res1) (fst rv')\"\n using RB' by (simp add : red_sp_imp_black_sp)\n \n ultimately\n show ?thesis \n using \\ui_es res1 @ bes2 = ui_es res1' @ bes2'\\ \\bes2' = []\\\n by (subst (asm) eq_commute) (auto simp add : Graph.sp_append)\n qed\n \n moreover\n have \"Graph.subpath (black prb') (src be) [be] bl\" \n using subsum_step(3) \\Graph.subpath (black prb) (fst rv') (bes2@[be]) bl\\\n by (simp add : Graph.sp_append_one Graph.sp_one)\n \n ultimately\n show ?thesis by (auto simp add : Graph.sp_append)\n qed\n \n hence \"Graph.subpath (black prb') (fst rv) (ui_es res1') (src be)\"\n and \"be \\ edges (black prb')\"\n and \"tgt be = bl\"\n by (simp_all add : Graph.sp_append_one)\n \n have \"fst rv'' = src be\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) (ui_es res1') (fst rv'')\"\n using \\subpath (red prb') rv res1' rv'' (subs prb')\\ \n red_sp_imp_black_sp[OF RB']\n by fast\n \n thus ?thesis \n using \\Graph.subpath (black prb') (fst rv) (ui_es res1') (src be)\\\n by (simp add : sp_same_src_imp_same_tgt)\n qed\n \n show ?thesis \n proof (case_tac \"be \\ ui_edge ` out_edges (red prb') rv''\") \n (* If be is represented in the out-going edges of rv'' by a red edge that \n we call ra. Then ui_es res1'@[be] is entirely represented in the new \n red part. Moreover, the configuration at the target of ra subsums c \n which is satisfiable, and is in turn also satisfiable and thus not marked, \n qed. *)\n assume \"be \\ ui_edge ` out_edges (red prb') rv''\"\n \n then obtain re where \"be = ui_edge re\"\n and \"re \\ out_edges (red prb') rv''\"\n by blast\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff \n image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"res1'@[re]\" in exI)\n apply (intro conjI)\n apply (rule_tac ?x=\"tgt re\" in exI)\n proof (intro conjI)\n show \"subpath (red prb') rv (res1' @ [re]) (tgt re) (subs prb')\"\n using \\subpath (red prb') rv res1' rv'' (subs prb')\\ \n \\re \\ out_edges (red prb') rv''\\\n by (simp add : sp_append_one)\n next\n show \"\\ marked prb' (tgt re)\" \n proof - \n have \"sat (confs prb' (tgt re))\" \n proof -\n have \"subpath (red prb') rv (res1'@[re]) (tgt re) (subs prb')\" \n using \\subpath (red prb') rv res1' rv'' (subs prb')\\ \n \\re \\ out_edges (red prb') rv''\\\n by (simp add : sp_append_one)\n \n then obtain c \n where se : \"se_star (confs prb' rv) (trace (ui_es (res1'@[re])) \n (labelling (black prb))) (c)\"\n using subsum_step(3,5,6,7) RB'\n finite_RedBlack.sp_imp_ex_se_star_succ\n [of prb' rv \"res1'@[re]\" \"tgt re\"]\n unfolding finite_RedBlack_def \n by simp blast\n \n hence \"sat c\"\n proof -\n have \"bes = ui_es (res1'@[re])\" \n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\be = ui_edge re\\ \\bes2' = []\\\n \\ui_es res1 @ bes2 = ui_es res1' @ bes2'\\ \n by simp\n \n thus ?thesis \n using subsum_step(3) se_star_succs_states[OF se]\n \\bes \\ feasible_subpaths_from (black prb') \n (confs prb' rv) \n (fst rv)\\ \n by (auto simp add : feasible_def sat_eq)\n qed\n \n moreover\n have \"c \\ confs prb' (tgt re)\" \n using subsum_step(3,5,6,7) se \n finite_RedBlack.SE_rel[of prb'] RB'\n \\subpath (red prb') (rv) (res1'@[re]) \n (tgt re) (subs prb')\\ \n by (simp add : finite_RedBlack_def)\n \n ultimately\n show ?thesis by (simp add: sat_sub_by_sat)\n qed\n \n thus ?thesis \n using \\re \\ out_edges (red prb') rv''\\ \n sat_not_marked[OF RB', of \"tgt re\"]\n by (auto simp add : vertices_def)\n qed\n next\n show \"bes = ui_es (res1' @ [re])\"\n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res1' @ bes2'\\\n \\bes2' = []\\ \\be = ui_edge re\\\n by simp\n qed\n \n next\n (* If be is not represented in the out-going edges of rv'', then we show that \n [be] is a suitable black suffix, res1' being known to be a suitable red \n prefix. *)\n assume A : \"be \\ ui_edge ` out_edges (red prb') rv''\"\n show ?thesis \n \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1'\" in exI)\n apply (rule_tac ?x=\"[be]\" in exI)\n proof (intro conjI, goal_cases)\n \n show \"bes = ui_es res1' @ [be]\"\n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res1' @ bes2'\\\n \\bes2' = []\\ \n by simp\n \n next\n \n case 2 show ?case \n apply (rule_tac ?x=\"rv''\" in exI)\n proof (intro conjI)\n \n show \"rv'' \\ fringe prb'\" by (rule \\rv'' \\ fringe prb'\\)\n \n next\n \n show \"subpath (red prb') rv res1' rv'' (subs prb')\"\n by (rule \\subpath (red prb') rv res1' rv'' (subs prb')\\)\n \n (*next\n \n show \"\\ marked prb' rv''\" by (rule `\\ marked prb' rv''`)*)\n \n next\n \n show \"\\ (\\res21 bes22. [be] = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') (rv'') \n (res21) (subs prb'))\"\n proof (intro notI, elim exE conjE, goal_cases)\n case (1 res21 bes22 rv''')\n \n then obtain re res21' where \"be = ui_edge re\"\n and \"res21 = re # res21'\"\n unfolding neq_Nil_conv by auto\n \n moreover\n hence \"re \\ out_edges (red prb') rv''\"\n using 1(3) \\rv'' \\ fringe prb'\\ RB'\n unfolding subsumees_conv by (force simp add : fringe_def \n rb_sp_Cons)\n \n ultimately\n show False using A by auto\n qed\n \n next\n \n show \"Graph.subpath_from (black prb') (fst rv'') [be]\"\n using \\Graph.subpath (black prb') (fst rv)(ui_es res1'@[be]) bl\\ \n \\fst rv'' = src be\\ \n by (auto simp add : Graph.sp_append_one Graph.sp_one)\n \n qed\n qed\n qed\n \n next\n (* Suppose that bes2' is not empty. Then appending be at the end of bes2' gives a \n suitable black suffix, qed. *)\n assume \"bes2' \\ []\"\n \n then obtain be' bes2'' where \"bes2' = be' # bes2''\"\n unfolding neq_Nil_conv by blast\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1'\" in exI)\n apply (rule_tac ?x=\"bes2'@[be]\" in exI)\n proof (intro conjI, goal_cases)\n \n show \"bes = ui_es res1' @ bes2' @ [be]\"\n using \\bes = ui_es res1 @ bes2 @ [be]\\ \n \\ui_es res1 @ bes2 = ui_es res1' @ bes2'\\\n by simp\n \n next\n \n case 2 show ?case \n apply (rule_tac ?x=\"rv''\" in exI)\n proof (intro conjI)\n \n show \" rv'' \\ fringe prb'\" by (rule \\ rv'' \\ fringe prb'\\)\n \n next\n \n show \"subpath (red prb') rv res1' rv'' (subs prb')\"\n by (rule \\subpath (red prb') rv res1' rv'' (subs prb')\\)\n \n next\n \n show \"\\ (\\res21 bes22. bes2' @ [be] = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') (rv'') \n (res21) (subs prb'))\"\n proof (intro notI, elim exE conjE, goal_cases)\n case (1 res21 bes22 rv''')\n \n then obtain re res21' where \"res21 = re # res21'\"\n and \"be' = ui_edge re\"\n using \\bes2' = be' # bes2''\\ unfolding neq_Nil_conv by auto\n \n show False \n using \\\\ (\\res21 bes22. bes2' = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') (rv'') \n (res21) (subs prb'))\\\n apply (elim notE)\n apply (rule_tac ?x=\"[re]\" in exI)\n apply (rule_tac ?x=\"bes2''\" in exI)\n proof (intro conjI)\n show \"bes2' = ui_es [re] @ bes2''\"\n using \\bes2' @ [be] = ui_es res21 @ bes22\\ \n \\bes2' = be' # bes2''\\\n \\be' = ui_edge re\\\n by simp\n next\n show \"[re] \\ []\" by simp\n next\n show \"subpath_from (red prb') rv'' [re] (subs prb')\"\n using \\subpath (red prb') rv'' res21 rv'''(subs prb')\\ \n \\res21 = re # res21'\\\n by (fastforce simp add : sp_Cons Nil_sp vertices_def)\n qed\n qed\n \n next\n \n show \"Graph.subpath_from (black prb') (fst rv'') (bes2' @ [be])\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) \n (ui_es res1' @ bes2') (src be)\"\n proof -\n have \"Graph.subpath (black prb') (fst rv) \n (ui_es res1 @ bes2) (src be)\"\n using \\bes \\ feasible_subpaths_from (black prb') \n (confs prb' rv) \n (fst rv)\\\n \\bes = ui_es res1 @ bes2 @ [be]\\\n by (auto simp add : Graph.sp_append Graph.sp_one)\n \n thus ?thesis using \\ui_es res1 @ bes2 = ui_es res1'@bes2'\\ \n by simp\n qed\n \n moreover\n have \"Graph.subpath (black prb')(fst rv)(ui_es res1' @ bes2') bl'\"\n using \\Graph.subpath (black prb') (fst rv'') bes2' bl'\\\n red_sp_imp_black_sp[OF RB' \n \\subpath (red prb')(rv)(res1') \n (rv'') (subs prb')\\]\n by (auto simp add : Graph.sp_append)\n \n ultimately\n have \"src be = bl'\" by (rule sp_same_src_imp_same_tgt)\n \n moreover\n have \"Graph.subpath (black prb') (src be) [be] (tgt be)\" \n using subsum_step(3) \n \\Graph.subpath (black prb) (fst rv') (bes2@[be]) bl\\ \n by (auto simp add : Graph.sp_append_one Graph.sp_one)\n \n ultimately\n show ?thesis \n using \\Graph.subpath (black prb') (fst rv'') bes2' bl'\\\n by (simp add : Graph.sp_append_one Graph.sp_one)\n qed\n qed\n qed\n qed\n qed\n qed\n \n next\n (* Suppose that rv' is not the newly subsumed red vertex. Hence, rv' is still not marked \n and in the fringe and res1 is still maximal, which makes res1 and bes2 suitable red \n prefix and black suffix in the new red part. *)\n assume \"rv' \\ subsumee sub\"\n \n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n proof (intro conjI, goal_cases)\n show \"bes = ui_es res1 @ bes2\" by (rule \\bes = ui_es res1 @ bes2\\)\n next\n \n case 2 show ?case\n apply (rule_tac ?x=\"rv'\" in exI)\n proof (intro conjI)\n show \"rv'\\ fringe prb'\" \n using subsum_step(3) subsumE_fringe[OF subsum_step(3)] B \\rv' \\ subsumee sub\\ \n by simp\n next\n show \"subpath (red prb') rv res1 rv' (subs prb')\" \n using subsum_step(3) C by (auto simp add : sp_in_extends)\n (*next\n show \"\\ marked prb' rv'\" using subsum_step(3) D by auto*)\n next\n show \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv' res21 (subs prb'))\"\n proof (intro notI, elim exE conjE)\n fix res21 bes22 rv''\n \n assume \"bes2 = ui_es res21 @ bes22\"\n and \"res21 \\ []\"\n and \"subpath (red prb') rv' res21 rv'' (subs prb')\"\n \n then obtain re res21' where \"res21 = re # res21'\" \n unfolding neq_Nil_conv by blast\n \n have \"subpath (red prb) rv' [re] (tgt re) (subs prb)\"\n proof -\n have \"\\ uses_sub rv' [re] (tgt re) sub\" using \\rv' \\ subsumee sub\\ by auto\n \n thus ?thesis \n using subsum_step(3)\n \\subpath (red prb') rv' res21 rv'' (subs prb')\\ \\res21 = re # res21'\\\n wf_sub_rel_of.sp_in_extends_not_using_sub\n [OF subs_wf_sub_rel_of[OF subsum_step(1)],\n of \"subsumee sub\" \"subsumer sub\" \"subs prb'\" rv' \"[re]\" \"tgt re\"]\n rb_sp_Cons[OF RB', of rv' re res21' rv'']\n rb_sp_one[OF subsum_step(1), of rv' re \"tgt re\"]\n subs_sub_rel_of[OF subsum_step(1)]\n by auto\n qed\n \n show False\n using E\n apply (elim notE)\n apply (rule_tac ?x=\"[re]\" in exI)\n apply (rule_tac ?x=\"ui_es res21'@bes22\" in exI)\n proof (intro conjI)\n show \"bes2 = ui_es [re] @ ui_es res21' @ bes22\"\n using \\bes2 = ui_es res21 @ bes22\\ \\res21 = re # res21'\\ by simp\n next\n show \"[re] \\ []\" by simp\n next\n show \"subpath_from (red prb) rv' [re] (subs prb)\"\n apply (rule_tac ?x=\"tgt re\" in exI)\n using subsum_step(3)\n \\rv' \\ subsumee sub\\ \\subpath (red prb') rv' res21 rv'' (subs prb')\\\n \\res21 = re # res21'\\\n rb_sp_Cons[OF RB', of rv' re res21' rv'']\n rb_sp_one[OF subsum_step(1), of rv' re \"tgt re\"]\n subs_sub_rel_of[OF subsum_step(1)] subs_sub_rel_of[OF RB']\n by fastforce\n qed\n qed\n next\n show \"Graph.subpath_from (black prb') (fst rv') bes2\" \n using subsum_step(3) F by simp blast\n qed\n qed\n qed\n qed\n qed\n\nnext \n\n case (abstract_step prb rv2 c\\<^sub>a prb' rv1)\n have RB' : \"RedBlack prb'\" by (rule RedBlack.abstract_step[OF abstract_step(1,3)])\n have \"finite_RedBlack prb\" using abstract_step by (auto simp add : finite_RedBlack_def)\n show ?case\n unfolding subset_iff\n proof (intro allI impI)\n (* Suppose that bes is a feasible subpath starting at the black vertex represented by the red \n vertex rv1. We proceed depending on the fact that rv1 is the red vertex where the abstrac-\n tion took place or not. We have to make this distinction to be able to use our IH, in the \n case where rv1 \\ rv2. *)\n fix bes\n \n assume \"bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\"\n \n show \"bes \\ RedBlack_subpaths_from prb' rv1\" \n proof (case_tac \"rv2 = rv1\")\n (* If this is the case, then the only possible red prefix is the empty edge sequence. By \n definition of the abstraction operator, we have that the empty sequence is indeed a \n suitable red prefix and that bes is suitable black prefix. *)\n assume \"rv2 = rv1\"\n \n show ?thesis \n proof (case_tac \"out_edges (black prb') (fst rv1) = {}\")\n assume \"out_edges (black prb') (fst rv1) = {}\"\n show ?thesis\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n apply (intro disjI1)\n apply (rule_tac ?x=\"[]\" in exI)\n apply (intro conjI)\n apply (rule_tac ?x=\"rv1\" in exI)\n proof (intro conjI)\n show \"subpath (red prb') rv1 [] rv1 (subs prb')\"\n using abstract_step(4) rb_Nil_sp[OF RB'] by fast\n next\n show \"\\ marked prb' rv1\" using abstract_step(3) \\rv2 = rv1\\ by simp\n next\n show \"bes = ui_es []\"\n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\\n \\out_edges (black prb') (fst rv1) = {}\\\n by (cases bes) (auto simp add : Graph.sp_Cons)\n qed\n \n next\n assume \"out_edges (black prb') (fst rv1) \\ {}\"\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"[]\" in exI)\n apply (rule_tac ?x=\"bes\" in exI)\n proof (intro conjI, goal_cases)\n \n show \"bes = ui_es [] @ bes\" by simp\n \n next\n \n case 2 show ?case \n apply (rule_tac ?x=\"rv1\" in exI)\n proof (intro conjI)\n \n show \"rv1 \\ fringe prb'\" \n using abstract_step(1,3) \\rv2 = rv1\\ \\out_edges (black prb') (fst rv1) \\ {}\\\n by (auto simp add : fringe_def)\n \n next\n \n show \"subpath (red prb') rv1 [] rv1 (subs prb')\" \n using abstract_step(3) \\rv2 = rv1\\ \n rb_Nil_sp[OF RedBlack.abstract_step[OF abstract_step(1,3)]]\n by auto\n \n (*next\n \n show \"\\ marked prb' rv1\" using abstract_step(3) `rv2 = rv1` by simp*)\n \n next\n \n show \"\\ (\\res21 bes22. bes = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb') rv1 res21 (subs prb'))\"\n proof (intro notI, elim exE conjE)\n fix res21 rv3\n \n assume \"res21 \\ []\" \n and \"subpath (red prb') rv1 res21 rv3 (subs prb')\"\n \n moreover\n then obtain re res21' where \"res21 = re # res21'\" \n unfolding neq_Nil_conv by blast\n \n ultimately\n have \"re \\ out_edges (red prb') rv1\"\n using abstract_step(3) \\rv2 = rv1\\\n rb_sp_Cons[OF RedBlack.abstract_step[OF abstract_step(1,3)], \n of rv1 re res21' rv3]\n unfolding subsumees_conv by fastforce\n \n thus False using abstract_step(3) \\rv2 = rv1\\ by auto\n qed\n \n next\n \n show \"Graph.subpath_from (black prb') (fst rv1) bes\"\n using \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\\n by simp\n \n qed\n qed\n qed\n \n next\n (* Suppose that rv1 is not the red vertex where the abstraction took place. Then, as \n abstracting a configuration has no effect on the rest of the red tree, we can show by IH \n that bes is red-black supbeth of the old red-black graph. We conclude by case \n distinction. *)\n assume \"rv2 \\ rv1\"\n \n moreover\n hence \"feasible (confs prb rv1) (trace bes (labelling (black prb)))\"\n using abstract_step(3) \n \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\\n by simp \n \n ultimately\n have \"bes \\ RedBlack_subpaths_from prb rv1\"\n using abstract_step(2)[of rv1] abstract_step(3-7)\n \\bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\\\n by auto\n \n thus ?thesis \n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE)\n \n fix res rv3\n \n assume \" bes = ui_es res\"\n and \"subpath (red prb) rv1 res rv3 (subs prb)\"\n and \"\\ marked prb rv3\"\n \n thus ?thesis \n using abstract_step(3)\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n by (intro disjI1, rule_tac ?x=\"res\" in exI, intro conjI)\n (rule_tac ?x=\"rv3\" in exI, simp_all)\n next\n \n fix res1 bes2 rv3 bl\n assume A : \"bes = ui_es res1 @ bes2\"\n and B : \"rv3 \\ fringe prb\"\n and C : \"subpath (red prb) rv1 res1 rv3 (subs prb)\"\n and E : \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv3 res21 (subs prb))\"\n and F : \"Graph.subpath (black prb) (fst rv3) bes2 bl\"\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n proof (intro conjI, goal_cases)\n show \"bes = ui_es res1 @ bes2\" by (rule \\bes = ui_es res1 @ bes2\\)\n next\n case 2 show ?case\n using abstract_step(3) B C E F unfolding fringe_def\n by (rule_tac ?x=\"rv3\" in exI) auto\n qed\n qed\n qed\n qed\n\nnext\n (* Strengthening a configuration with an invariant will help refuse \"brutal\" abstractions. As \n all abstractions preserves the set of feasible paths, we conclude. *)\n case (strengthen_step prb rv2 e prb' rv1)\n show?case\n unfolding subset_iff\n proof (intro allI impI)\n \n fix bes \n assume \"bes \\ feasible_subpaths_from (black prb') (confs prb' rv1) (fst rv1)\"\n hence \"bes \\ RedBlack_subpaths_from prb rv1\"\n using strengthen_step(2)[of rv1] strengthen_step(3-7) by auto\n \n thus \"bes \\ RedBlack_subpaths_from prb' rv1\"\n apply (subst (asm) RedBlack_subpaths_from_def)\n unfolding Un_iff image_def Bex_def mem_Collect_eq\n proof (elim disjE exE conjE)\n \n fix res rv2\n assume \"bes = ui_es res\"\n and \"subpath (red prb) rv1 res rv2 (subs prb)\"\n and \"\\ marked prb rv2\"\n thus ?thesis \n using strengthen_step(3)\n unfolding RedBlack_subpaths_from_def Un_iff image_def Bex_def mem_Collect_eq\n by (intro disjI1) fastforce\n \n next\n \n fix res1 bes2 rv3 bl\n \n assume A : \"bes = ui_es res1 @ bes2\"\n and B : \"rv3 \\ fringe prb\"\n and C : \"subpath (red prb) rv1 res1 rv3 (subs prb)\"\n (*and D : \"\\ marked prb rv3\"*)\n and E : \"\\ (\\res21 bes22. bes2 = ui_es res21 @ bes22 \n \\ res21 \\ [] \n \\ subpath_from (red prb) rv3 res21 (subs prb))\"\n and F : \"Graph.subpath (black prb) (fst rv3) bes2 bl\"\n \n show ?thesis \n unfolding RedBlack_subpaths_from_def Un_iff mem_Collect_eq\n apply (intro disjI2)\n apply (rule_tac ?x=\"res1\" in exI)\n apply (rule_tac ?x=\"bes2\" in exI)\n proof (intro conjI, goal_cases)\n show \"bes = ui_es res1 @ bes2\" by (rule \\bes = ui_es res1 @ bes2\\)\n next\n case 2 \n show ?case\n using strengthen_step(3) B C E F unfolding fringe_def \n by (rule_tac ?x=\"rv3\" in exI) auto\n qed\n \n qed\n qed\nqed\n\n\ntext \\Red-black paths being red-black sub-path starting from the red root, and feasible paths \nbeing feasible sub-paths starting at the black initial location, it follows from the previous \ntheorem that the set of feasible paths when considering the configuration of the root is a \nsubset of the set of red-black paths.\\\n\ntheorem (in finite_RedBlack) feasible_path_inclusion :\n assumes \"RedBlack prb\"\n shows \"feasible_paths (black prb) (confs prb (root (red prb))) \\ RedBlack_paths prb\"\nusing feasible_subpaths_preserved[OF assms, of \"root (red prb)\"] consistent_roots[OF assms]\nby (simp add : vertices_def)\n\ntext \\The configuration at the red root might have been abstracted. In this case, the initial \nconfiguration is subsumed by the current configuration at the root. Thus the set of feasible paths \nwhen considering the initial configuration is also a subset of the set of red-black paths.\\\n\nlemma init_subsumed :\n assumes \"RedBlack prb\"\n shows \"init_conf prb \\ confs prb (root (red prb))\"\nusing assms\nproof (induct prb)\n case base thus ?case by (simp add: subsums_refl)\nnext\n case se_step thus ?case by (force simp add : vertices_def)\nnext\n case mark_step thus ?case by simp\nnext\n case subsum_step thus ?case by simp\nnext\n case (abstract_step prb rv c\\<^sub>a prb')\n thus ?case by (auto simp add : abstract_def subsums_trans)\nnext\n case strengthen_step thus ?case by simp\nqed\n\n\ntheorem (in finite_RedBlack) feasible_path_inclusion_from_init :\n assumes \"RedBlack prb\"\n shows \"feasible_paths (black prb) (init_conf prb) \\ RedBlack_paths prb\"\nunfolding subset_iff mem_Collect_eq\nproof (intro allI impI, elim exE conjE, goal_cases)\n case (1 es bl)\n\n hence \"es \\ feasible_subpaths_from (black prb) (init_conf prb) (fst (root (red prb)))\"\n using consistent_roots[OF assms] by simp blast\n\n hence \"es \\ feasible_subpaths_from (black prb) (confs prb (root (red prb))) (fst(root(red prb)))\"\n unfolding mem_Collect_eq\n proof (elim exE conjE, goal_cases)\n case (1 bl')\n \n show ?case \n proof (rule_tac ?x=\"bl'\" in exI, intro conjI)\n show \"Graph.subpath (black prb) (fst (root (red prb))) es bl'\" by (rule 1(1))\n next\n have \"finite_labels (trace es (labelling (black prb)))\"\n using finite_RedBlack by auto\n \n moreover\n have \"finite (pred (confs prb (root (red prb))))\"\n using finite_RedBlack finite_pred[OF assms]\n by (auto simp add : vertices_def finite_RedBlack_def)\n \n moreover\n have \"finite (pred (init_conf prb))\"\n using assms by (intro finite_init_pred)\n \n moreover\n have \"\\e\\pred (confs prb (root (red prb))). finite (Bexp.vars e)\"\n using finite_RedBlack finite_pred_constr_symvars[OF assms]\n by (fastforce simp add : finite_RedBlack_def vertices_def)\n \n moreover\n have \"\\e\\pred (init_conf prb). finite (Bexp.vars e)\"\n using assms by (intro finite_init_pred_symvars)\n \n moreover\n have \"init_conf prb \\ confs prb (root (red prb))\"\n using assms by (rule init_subsumed)\n \n ultimately\n show \"feasible (confs prb (root (red prb))) (trace es (labelling (black prb)))\" \n using 1(2) by (rule subsums_imp_feasible)\n qed\n qed\n \n thus ?case \n using feasible_subpaths_preserved[OF assms, of \"root (red prb)\"]\n by (auto simp add : vertices_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/InfPathElimination/RB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.2693599255257554}} {"text": "(* Title: Lightweight Java, the equivalence functions\n Authors: Rok Strnisa , 2006\n Matthew Parkinson , 2006\n Maintainer: \n*)\n\ntheory Lightweight_Java_Equivalence imports Lightweight_Java_Definition begin\n\n(* BEGIN: HELPER FUNCTIONS *)\n\nlemma map_id[simp]: \"map id list = list\" by (induct list) auto\n\nlemma id_map_two[simp]: \"map (\\(x,y). (x,y)) list = list\" by (induct list) auto\n\nlemma id_image_two[simp]: \"(\\(x,y). (x,y)) ` set list = set list\" by (induct list) auto\n\nlemma map_fst[simp]: \"map (\\(x, y). x) list = map fst list\" by (induct list) auto\n\nlemma map_snd[simp]: \"map (\\(x, y). y) list = map snd list\" by (induct list) auto\n\nlemma zip_map_map_two [simp]: \"zip (map fst list) (map snd list) = list\"\nby (induct list) auto\n\nlemma concat_map_singlton [simp]: \"concat (map (\\e. [e]) list) = list\"\nby (induct list) simp_all\n\nlemma list_all_map_P [simp]: \"list_all (\\b. b) (map (\\x. P x) list) = (\\x \\ set list. P x)\"\nby (induct list) simp_all\n\nlemma dom_single[simp]: \"a : dom (empty(k \\ v)) = (a = k)\"\nby (simp add: dom_def)\n\nlemma predicted_lu[rule_format, simp]:\n \"x \\ set list \\ map_of (map (\\key. (key, value)) list) x = Some value\"\nby (induct list) auto\n\nlemma key_in_map1[simp]: \"k \\ dom M' \\ (M ++ M') k = M k\"\napply (subgoal_tac \"M' k = None\")\napply (simp add: map_add_def, force simp add: domI)\ndone\n\nlemma forall_cons [rule_format]: \"(\\x \\ set (s#S). P x) \\ y \\ set S \\ P y\"\nby (induct_tac S) simp_all\n\nlemma mem_cong[rule_format]:\n \"x \\ set list \\ (f x \\ set (map f list))\"\nby (induct list) auto\n\nlemma forall_union: \"\\\\a \\ dom A. P (A a); \\b \\ dom B. P (B b)\\ \\ \\x \\ dom A \\ dom B. P ((B ++ A) x)\"\napply(safe)\n apply(force)\napply(drule_tac x = x in bspec, simp add: domI)\napply(case_tac \"A x = None\")\n apply(force simp add: map_add_def)\nby (force)\n\n(* END: HELPER FUNCTIONS *)\n\ndefinition\nclass_name_f :: \"cld \\ dcl\"\nwhere\n\"class_name_f cld =\n (case cld of cld_def dcl cl fds mds \\ dcl)\"\n\n\ndefinition\nsuperclass_name_f :: \"cld \\ cl\"\nwhere\n\"superclass_name_f cld =\n (case cld of cld_def dcl cl fds mds \\ cl)\"\nlemma [simp]: \"(superclass_name cld cl) = (superclass_name_f cld = cl)\"\nby (force simp add: superclass_name_f_def split: cld.splits\n intro: superclass_nameI elim: superclass_name.cases)\n\ndefinition\nclass_fields_f :: \"cld \\ fds\"\nwhere\n\"class_fields_f cld =\n (case cld of cld_def dcl cl fds mds \\ fds)\"\nlemma [simp]: \"(class_fields cld fds) = (class_fields_f cld = fds)\"\nby (force simp add: class_fields_f_def split: cld.splits\n intro: class_fieldsI elim: class_fields.cases)\n\ndefinition\nclass_methods_f :: \"cld \\ meth_defs\"\nwhere\n\"class_methods_f cld =\n (case cld of cld_def dcl cl fds mds \\ mds)\"\nlemma [simp]: \"(class_methods cld fds) = (class_methods_f cld = fds)\"\nby (force simp add: class_methods_f_def split: cld.splits\n intro: class_methodsI elim: class_methods.cases)\n\ndefinition\nmethod_name_f :: \"meth_def \\ meth\"\nwhere\n\"method_name_f md =\n (case md of meth_def_def meth_sig meth_body \\\n (case meth_sig of meth_sig_def cl meth vds \\ meth))\"\nlemma [simp]: \"(method_name md m) = (method_name_f md = m)\"\nby (force simp add: method_name_f_def split: meth_def.splits meth_sig.splits\n intro: method_nameI elim: method_name.cases)\n\ndefinition\ndistinct_names_f :: \"P \\ bool\"\nwhere\n\"distinct_names_f P =\n (distinct (map class_name_f P))\"\nlemma distinct_names_map[rule_format]:\n \"(\\x\\set cld_dcl_list. split (\\cld. op = (class_name_f cld)) x) \\ distinct (map snd cld_dcl_list)\n \\ distinct_names_f (map fst cld_dcl_list)\"\napply(induct cld_dcl_list)\n apply(clarsimp simp add: distinct_names_f_def)+ apply(force)\ndone\nlemma [simp]: \"(distinct_names P) = (distinct_names_f P)\"\napply(rule)\n apply(erule distinct_names.cases) apply(clarsimp simp add: distinct_names_map)\napply(simp add: distinct_names_f_def)\napply(rule_tac cld_dcl_list = \"map (\\cld. (cld, class_name_f cld)) P\" in dn_defI)\n apply(simp) apply(induct P) apply(simp) apply(simp)\n apply(clarsimp)\napply(clarsimp) apply(induct P) apply(simp) apply(force)\ndone\n\nprimrec\nfind_cld_f :: \"P \\ ctx \\ fqn \\ ctxcld_opt\"\nwhere\n\"find_cld_f [] ctx fqn = None\" |\n\"find_cld_f (cld#clds) ctx fqn =\n (case cld of cld_def dcl cl fds mds \\\n (case fqn of fqn_def dcl' \\\n (if dcl = dcl' then Some (ctx, cld) else find_cld_f clds ctx fqn)))\"\nlemma [simp]: \"(find_cld P ctx fqn ctxcld_opt) = (find_cld_f P ctx fqn = ctxcld_opt)\"\napply(rule)\n apply(induct rule: find_cld.induct) apply(simp+)\n apply(clarsimp)\napply(induct P)\n apply(simp add: fc_emptyI)\napply(case_tac fqn) apply(rename_tac cld clds dcl) apply(case_tac cld)\napply(clarsimp) apply(rename_tac dcl' cl' vds' mds') apply(rule)\napply(clarsimp) apply(rule fc_cons_trueI) apply(simp) apply(force)\napply(force intro: fc_cons_falseI[simplified])\ndone\n\nlemma find_to_mem[rule_format]:\n \"find_cld_f P ctx fqn = Some (ctx', cld) \\ cld : set P\"\napply(induct P) by (clarsimp split: cld.splits fqn.splits)+\n\nlemma find_cld_name_eq[rule_format]:\n \"\\ctxcld. find_cld_f P ctx (fqn_def dcl) = Some ctxcld \\ (\\cl fds mds. (ctx, cld_def dcl cl fds mds) = ctxcld)\"\napply(induct P) apply(simp) apply(clarsimp split: cld.splits fqn.splits) done\n\nprimrec\nfind_type_f :: \"P \\ ctx \\ cl \\ ty_opt\"\nwhere\n\"find_type_f P ctx cl_object = Some ty_top\" |\n\"find_type_f P ctx (cl_fqn fqn) =\n (case fqn of fqn_def dcl \\\n (case find_cld_f P ctx fqn of None \\ None | Some (ctx', cld) \\\n Some (ty_def ctx' dcl)))\"\nlemma [simp]: \"(find_type P ctx cl ty_opt) = (find_type_f P ctx cl = ty_opt)\"\napply(rule)\n apply(force elim: find_type.cases split: fqn.splits)\napply(case_tac cl) apply(force intro: ft_objI)\napply(rename_tac fqn)\napply(case_tac fqn) apply(clarsimp)\napply(split option.splits) apply(rule)\n apply(force intro: ft_nullI)\nby (force intro: ft_dclI)\n\nlemma mem_remove: \"cld : set P \\ length (remove1 cld P) < length P\"\napply(induct P) by(simp, force split: split_if_asm)\n\nlemma finite_program[rule_format, intro]:\n \"\\P cld. (\\ctx ctx' fqn. find_cld_f P ctx fqn = Some (ctx', cld)) \\\n length (remove1 cld P) < length P\"\napply(clarsimp) apply(drule find_to_mem) by (simp add: mem_remove)\n\nlemma path_length_eq[rule_format]:\n \"path_length P ctx cl nn \\ \\nn'. path_length P ctx cl nn' \\ nn = nn'\"\napply(erule path_length.induct)\n apply(clarsimp) apply(erule path_length.cases) apply(simp) apply(simp)\napply(rule) apply(rule)\napply(erule_tac ?a4.0 = nn' in path_length.cases) apply(clarify)\napply(clarsimp)\ndone\n\nlemma fpr_termination[iff]:\n \"\\P cld ctx ctx' fqn. find_cld_f P ctx fqn = Some (ctx', cld) \\ acyclic_clds P\n \\ The (path_length P ctx' (superclass_name_f cld)) < The (path_length P ctx (cl_fqn fqn))\"\napply(clarsimp)\napply(erule acyclic_clds.cases) apply(clarsimp) apply(rename_tac P)\napply(erule_tac x = ctx in allE)\napply(erule_tac x = fqn in allE)\napply(clarsimp)\napply(rule theI2) apply(simp) apply(simp add: path_length_eq)\napply(erule path_length.cases) apply(simp) apply(clarsimp)\napply(rule theI2) apply(simp) apply(simp add: path_length_eq)\napply(drule_tac path_length_eq, simp)\napply(erule path_length.cases) apply(simp) apply(clarsimp)\napply(drule_tac path_length_eq, simp) apply(simp)\ndone\n\nfunction\nfind_path_rec_f :: \"P \\ ctx \\ cl \\ ctxclds \\ ctxclds_opt\"\nwhere\n\"find_path_rec_f P ctx cl_object path = Some path\" |\n\"find_path_rec_f P ctx (cl_fqn fqn) path =\n (if ~(acyclic_clds P) then None else\n (case find_cld_f P ctx fqn of None \\ None | Some (ctx', cld) \\\n find_path_rec_f P ctx'\n (superclass_name_f cld) (path @ [(ctx',cld)])))\"\nby pat_completeness auto\ntermination\nby (relation \"measure (\\(P, ctx, cl, path). (THE nn. path_length P ctx cl nn))\") auto\n\nlemma [simp]: \"(find_path_rec P ctx cl path path_opt) = (find_path_rec_f P ctx cl path = path_opt)\"\napply(rule)\n apply(erule find_path_rec.induct) apply(simp)+\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp simp add: fpr_objI)\napply(clarsimp) apply(rule)\n apply(simp add: fpr_nullI)\napply(clarsimp split: option.splits)\napply(rule fpr_nullI)\n apply(simp add: fpr_nullI)\napply(rule fpr_fqnI) apply(force)+\ndone\n\ndefinition\nfind_path_f :: \"P \\ ctx \\ cl \\ ctxclds_opt\"\nwhere\n\"find_path_f P ctx cl = find_path_rec_f P ctx cl []\"\nlemma [simp]: \"(find_path P ctx cl path_opt) = (find_path_f P ctx cl = path_opt)\"\napply(rule)\n apply(erule find_path.cases) apply(unfold find_path_f_def) apply(simp)\napply(simp add: fp_defI)\ndone\n\nprimrec\nfind_path_ty_f :: \"P \\ ty \\ ctxclds_opt\"\nwhere\n\"find_path_ty_f P ty_top = Some []\" |\n\"find_path_ty_f P (ty_def ctx dcl) =\n find_path_f P ctx (cl_fqn (fqn_def dcl))\"\nlemma [simp]: \"(find_path_ty P ty ctxclds_opt) = (find_path_ty_f P ty = ctxclds_opt)\"\napply(rule)\n apply(force elim: find_path_ty.cases)\napply(case_tac ty)\n apply(clarsimp simp add: fpty_objI)\napply(clarsimp simp add: fpty_dclI)\ndone\n\nprimrec\nfields_in_path_f :: \"ctxclds \\ fs\"\nwhere\n\"fields_in_path_f [] = []\" |\n\"fields_in_path_f (ctxcld#ctxclds) =\n (map (\\fd. case fd of fd_def cl f \\ f) (class_fields_f (snd ctxcld)))\n @ fields_in_path_f ctxclds\"\nlemma cl_f_list_map: \"map (case_fd (\\cl f. f)) (map (\\(x, y). fd_def x y) cl_f_list) = map (\\(cl_XXX, f_XXX). f_XXX) cl_f_list\"\nby (induct cl_f_list, auto)\n\nlemma fip_ind_to_f: \"\\fs. fields_in_path clds fs \\ fields_in_path_f clds = fs\"\napply(induct clds)\n apply(clarsimp, erule fields_in_path.cases) apply(simp) apply(clarsimp)\napply(clarsimp)\napply(erule fields_in_path.cases) apply(simp) by(clarsimp simp add: cl_f_list_map)\n\nlemma fd_map_split: \"map (case_fd (\\cl f. f)) (map (\\(x, y). fd_def x y) list) = map (\\(cl, f). f) list\"\napply(induct list) apply(simp) apply(clarsimp) done\n\nlemma fd_map_split': \"map (\\(x, y). fd_def x y) (map (case_fd Pair) list) = list\"\napply(induct list) apply(simp split: fd.splits)+ done\n\nlemma fd_map_split'': \"map ((\\(x, y). fd_def x y) \\ case_fd Pair) list = list\"\napply(induct list) apply(simp split: fd.splits)+ done\n\nlemma [simp]: \"\\fs. (fields_in_path ctxclds fs) = (fields_in_path_f ctxclds = fs)\"\napply(induct ctxclds)\n apply(rule) apply(rule)\n apply(force elim: fields_in_path.cases)\n apply(simp add: fip_emptyI)\napply(clarsimp)\napply(rule)\n apply(erule fields_in_path.cases)\n apply(simp)\n apply(simp add: fip_ind_to_f fd_map_split)\napply(clarsimp)\napply(rule_tac cld = b and ctxcld_list = ctxclds\n and cl_f_list = \"map (case_fd (\\cl f. (cl, f))) (class_fields_f b)\" in fip_consI[simplified])\n apply(simp add: fd_map_split'')\n apply(simp add: fd_map_split')\napply(clarsimp split: fd.splits)\ndone\n\ndefinition\nfields_f :: \"P \\ ty \\ fs option\"\nwhere\n\"fields_f P ty =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n Some (fields_in_path_f ctxclds))\"\nlemma [simp]: \"\\fs_opt. (fields P ty fs_opt) = (fields_f P ty = fs_opt)\"\napply(rule) apply(rule)\n apply(case_tac fs_opt)\n apply(clarsimp) apply(erule fields.cases)\n apply(clarsimp) apply(simp add: fields_f_def)\n apply(clarsimp)\n apply(erule fields.cases)\n apply(simp)\n apply(clarsimp) apply(simp add: fields_f_def)\n apply(simp add: fields_f_def) apply(case_tac \"find_path_ty_f P ty\") apply(simp) apply(simp add: fields_noneI[simplified])\napply(clarsimp) apply(case_tac \"find_path_ty_f P ty\") apply(simp) apply(simp) apply(clarsimp)\napply(rule fields_someI) apply(simp) apply(simp)\ndone\n\nprimrec\nmethods_in_path_f :: \"clds \\ meths\"\nwhere\n\"methods_in_path_f [] = []\" |\n\"methods_in_path_f (cld#clds) =\n map (\\md. case md of meth_def_def meth_sig meth_body \\\n case meth_sig of meth_sig_def cl meth vds \\ meth)\n (class_methods_f cld) @ methods_in_path_f clds\"\n\nlemma meth_def_map[THEN mp]:\n \"(\\x \\ set list. (\\(md, cl, m, vds, mb). md = meth_def_def (meth_sig_def cl m vds) mb) x)\n \\ map (case_meth_def (\\ms mb. case ms of meth_sig_def cl m vds \\ m)) (map (\\(md, cl, m, vds, mb). md) list) = map (\\(md, cl, m, vds, mb). m) list\"\nby (induct list, auto)\n\nlemma meth_def_map':\n \"map ((\\(md, cl, m, vds, mb). md) \\ (\\md. case md of meth_def_def (meth_sig_def cl m vds) mb \\ (md, cl, m, vds, mb))) list = list\"\napply(induct list) by (auto split: meth_def.splits meth_sig.splits)\n\nlemma [simp]: \"\\meths. (methods_in_path clds meths) = (methods_in_path_f clds = meths)\"\napply(induct clds)\n apply(clarsimp) apply(rule)\n apply(erule methods_in_path.cases) apply(simp) apply(clarsimp)\n apply(clarsimp) apply(rule mip_emptyI)\napply(clarsimp) apply(rule)\n apply(erule methods_in_path.cases) apply(simp)\n apply(force)\n\napply(rule_tac\n meth_def_cl_meth_vds_meth_body_list =\n \"(case a of cld_def dcl cl fds mds \\\n (map (\\md. (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m vds \\ (md, cl, m, vds, mb)))) mds))\" in\n mip_consI[simplified])\n apply(clarsimp) apply(case_tac a) apply(simp add: class_methods_f_def meth_def_map')\n apply(clarsimp) apply(clarsimp split: meth_def.splits meth_sig.splits)\n apply(simp)\napply(clarsimp) apply(case_tac a) apply(clarsimp simp add: class_methods_f_def split: meth_def.splits meth_sig.splits)\ndone\n\ndefinition\nmethods_f :: \"P \\ ty \\ meths option\"\nwhere\n\"methods_f P ty =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n Some (methods_in_path_f (map (\\(ctx, cld). cld) ctxclds)))\"\nlemma [simp]: \"(methods P ty meths) = (methods_f P ty = Some meths)\"\napply(rule)\n apply(erule methods.cases) apply(clarsimp simp add: methods_f_def)\napply(simp add: methods_f_def) apply(split option.splits) apply(simp)\napply(clarsimp) apply(rule methods_methodsI) apply(simp) apply(clarsimp)\ndone\n\nprimrec\nftype_in_fds_f :: \"P \\ ctx \\ fds \\ f \\ ty_opt_bot\"\nwhere\n\"ftype_in_fds_f P ctx [] f = ty_opt_bot_opt None\" |\n\"ftype_in_fds_f P ctx (fd#fds) f =\n (case fd of fd_def cl f' \\ (if f = f' then\n (case find_type_f P ctx cl of None \\ ty_opt_bot_bot | Some ty \\\n ty_opt_bot_opt (Some ty)) else ftype_in_fds_f P ctx fds f))\"\nlemma [simp]: \"(ftype_in_fds P ctx fds f ty_opt) = (ftype_in_fds_f P ctx fds f = ty_opt)\"\napply(rule)\n apply(induct fds) apply(erule ftype_in_fds.cases) apply(simp) apply(simp) apply(simp) apply(simp)\n apply(erule ftype_in_fds.cases) apply(simp) apply(simp) apply(simp) apply(clarsimp)\napply(induct fds)\n apply(clarsimp) apply(rule ftif_emptyI)\napply(rename_tac fd fds) apply(case_tac fd, rename_tac cl f', clarsimp) apply(rule)\n apply(clarsimp) apply(case_tac \"find_type_f P ctx cl\")\n apply(simp add: ftif_cons_botI[simplified])\n apply(simp add: ftif_cons_trueI[simplified])\napply(force intro: ftif_cons_falseI[simplified])\ndone\n\nprimrec\nftype_in_path_f :: \"P \\ ctxclds \\ f \\ ty_opt\"\nwhere\n\"ftype_in_path_f P [] f = None\" |\n\"ftype_in_path_f P (ctxcld#ctxclds) f =\n (case ctxcld of (ctx, cld) \\\n (case ftype_in_fds_f P ctx (class_fields_f cld) f of\n ty_opt_bot_bot \\ None | ty_opt_bot_opt ty_opt \\\n (case ty_opt of Some ty \\ Some ty | None \\\n ftype_in_path_f P ctxclds f)))\"\nlemma [simp]: \"(ftype_in_path P ctxclds f ty_opt) = (ftype_in_path_f P ctxclds f = ty_opt)\"\napply(rule)\n apply(induct rule: ftype_in_path.induct) apply(simp+)\napply(induct ctxclds) apply(simp) apply(rule ftip_emptyI)\napply(hypsubst_thin)\napply(clarsimp) apply(case_tac \"ftype_in_fds_f P a (class_fields_f b) f\")\n apply(rename_tac ty_opt) apply(case_tac ty_opt)\n apply(simp add: ftip_cons_falseI[simplified])\n apply(simp add: ftip_cons_trueI[simplified])\napply(simp add: ftip_cons_botI[simplified])\ndone\n\ndefinition\nftype_f :: \"P \\ ty \\ f \\ ty_opt\"\nwhere\n\"ftype_f P ty f =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n ftype_in_path_f P ctxclds f)\"\nlemma [simp]: \"(ftype P ty f ty') = (ftype_f P ty f = Some ty')\"\napply(rule)\n apply(induct rule: ftype.induct) apply(clarsimp simp add: ftype_f_def)\napply(clarsimp simp add: ftype_f_def split: option.splits) apply(rule ftypeI) apply(simp+)\ndone\n\nprimrec\nfind_meth_def_in_list_f :: \"meth_defs \\ meth \\ meth_def_opt\"\nwhere\n\"find_meth_def_in_list_f [] m = None\" |\n\"find_meth_def_in_list_f (md#mds) m =\n (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m' vds \\\n (if m = m' then Some md else find_meth_def_in_list_f mds m)))\"\nlemma [simp]: \"(find_meth_def_in_list mds m md_opt) = (find_meth_def_in_list_f mds m = md_opt)\"\napply(rule)\n apply(induct rule: find_meth_def_in_list.induct) apply(simp+)\napply(induct mds) apply(simp) apply(rule fmdil_emptyI)\napply(clarsimp) apply(clarsimp split: meth_def.split meth_sig.split) apply(rule)\n apply(clarsimp) apply(rule fmdil_cons_trueI[simplified]) apply(force)\napply(clarsimp) apply(rule fmdil_cons_falseI[simplified]) apply(force+)\ndone\n\nprimrec\nfind_meth_def_in_path_f :: \"ctxclds \\ meth \\ ctxmeth_def_opt\"\nwhere\nfmdip_empty: \"find_meth_def_in_path_f [] m = None\" |\nfmdip_cons: \"find_meth_def_in_path_f (ctxcld#ctxclds) m =\n (case ctxcld of (ctx, cld) \\\n (case find_meth_def_in_list_f (class_methods_f cld) m of\n Some md \\ Some (ctx, md) |\n None \\ find_meth_def_in_path_f ctxclds m))\"\nlemma [simp]: \"(find_meth_def_in_path ctxclds m ctxmeth_def_opt) = (find_meth_def_in_path_f ctxclds m = ctxmeth_def_opt)\"\napply(rule)\n apply(induct rule: find_meth_def_in_path.induct) apply(simp+)\napply(induct ctxclds) apply(simp) apply(rule fmdip_emptyI)\napply(clarsimp) apply(case_tac \"find_meth_def_in_list_f (class_methods_f b) m\") apply(clarsimp)\napply(simp add: fmdip_cons_falseI[simplified])\napply(simp add: fmdip_cons_trueI[simplified])\ndone\n\ndefinition\nfind_meth_def_f :: \"P \\ ty \\ meth \\ ctxmeth_def_opt\"\nwhere\n\"find_meth_def_f P ty m =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n find_meth_def_in_path_f ctxclds m)\"\nlemma [simp]: \"(find_meth_def P ty m ctxmd_opt) = (find_meth_def_f P ty m = ctxmd_opt)\"\napply(rule)\n apply(induct rule: find_meth_def.induct) apply(simp add: find_meth_def_f_def)+\napply(clarsimp simp add: find_meth_def_f_def split: option.splits)\napply(simp add: fmd_nullI)\napply(simp add: fmd_optI)\ndone\n\nprimrec\nlift_opts :: \"'a option list \\ 'a list option\"\nwhere\n\"lift_opts [] = Some []\" |\n\"lift_opts (opt#opts) =\n (case opt of None \\ None | Some v \\\n (case lift_opts opts of None \\ None | Some vs \\ Some (v#vs)))\"\n\ndefinition\nmtype_f :: \"P \\ ty \\ meth \\ mty option\"\nwhere\n\"mtype_f P ty m =\n (case find_meth_def_f P ty m of None \\ None | Some (ctx, md) \\\n (case md of meth_def_def ms mb \\\n (case ms of meth_sig_def cl m' vds \\\n (case find_type_f P ctx cl of None \\ None | Some ty' \\\n (case lift_opts (map (\\vd. case vd of vd_def clk vark \\\n find_type_f P ctx clk) vds) of None \\ None | Some tys \\\n Some (mty_def tys ty'))))))\"\n\nlemma lift_opts_ind[rule_format]:\n \"(\\x\\set list. (\\(cl, var, ty). find_type_f P ctx cl = Some ty) x)\n \\ lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk) \\ (\\(cl, var, ty). vd_def cl var)) list) = Some (map (\\(cl, var, ty). ty) list)\"\nby (induct list, auto)\n\nlemma find_md_m_match'[rule_format]:\n \"find_meth_def_in_list_f mds m = Some (meth_def_def (meth_sig_def cl m' vds) mb) \\ m' = m\"\napply(induct mds) apply(simp) apply(clarsimp split: meth_def.splits meth_sig.splits) done\n\nlemma find_md_m_match:\n \"find_meth_def_in_path_f path m = Some (ctx, meth_def_def (meth_sig_def cl m' vds) mb) \\ m' = m\"\napply(induct path) apply(simp) apply(clarsimp split: option.splits) by(rule find_md_m_match')\n\nlemma vds_map_length:\n \"length (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = length vds\"\nby (induct vds, auto)\n\nlemma lift_opts_length[rule_format]:\n \"\\tys. lift_opts ty_opts = Some tys \\ length ty_opts = length tys\"\napply(induct ty_opts) apply(simp) by(clarsimp split: option.splits)\n\nlemma vds_tys_length_eq[rule_format]:\n \"lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = Some tys \\ length vds = length tys\"\napply(rule) apply(drule lift_opts_length) apply(simp add: vds_map_length) done\n\nlemma vds_tys_length_eq'[rule_format]:\n \"\\tys. length vds = length tys \\ vds = map (\\(cl, var, ty). vd_def cl var) (map (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty)) (zip vds tys))\"\napply(induct vds) apply(simp) apply(clarsimp) apply(case_tac a) apply(clarsimp)\napply(case_tac tys) apply(simp) apply(clarsimp) done\n\nlemma vds_tys_length_eq''[rule_format]:\n \"\\vds. length vds = length tys \\ tys = map ((\\(cl, var, ty). ty) \\ (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty))) (zip vds tys)\"\napply(induct tys) apply(simp) apply(clarsimp) apply(case_tac vds) apply(clarsimp) apply(clarsimp)\napply(split vd.splits) apply(simp) done\n\nlemma lift_opts_find_type[rule_format]:\n \"\\tys. lift_opts (map (case_vd (\\clk vark. find_type_f P ctx clk)) vds) = Some tys\n \\ (\\(vd, ty) \\ set (zip vds tys). case vd of vd_def cl var \\ find_type_f P ctx cl = Some ty)\"\napply(induct vds) apply(simp) apply(clarsimp split: vd.splits option.splits) apply(rename_tac cl' var)\napply(drule_tac x = \"(vd_def cl' var, b)\" in bspec, simp) apply(force) done\n\nlemma [simp]: \"(mtype P ty m mty) = (mtype_f P ty m = Some mty)\"\napply(rule)\n apply(induct rule: mtype.induct) apply(clarsimp simp add: mtype_f_def)\n apply(split option.splits) apply(rule) apply(clarsimp)\n apply(rule_tac x = \"map (\\(cl, var, ty). ty) cl_var_ty_list\" in exI)\n apply(simp add: lift_opts_ind) apply(clarsimp) apply(simp add: lift_opts_ind)\napply(clarsimp simp add: mtype_f_def split: option.splits meth_def.splits meth_sig.splits)\napply(rename_tac ctx mb cl m' vds ty' tys)\napply(rule_tac ctx = ctx and cl = cl and meth_body = mb and ty' = ty'\n and cl_var_ty_list = \"map (\\(vd, ty). case vd of vd_def cl var \\ (cl, var, ty)) (zip vds tys)\"\n and meth_def = \"meth_def_def (meth_sig_def cl m' vds) mb\" in mtypeI[simplified])\n apply(simp) apply(clarsimp) apply(rule) apply(clarsimp simp add: find_meth_def_f_def split: option.splits)\n apply(simp add: find_md_m_match) apply(drule vds_tys_length_eq) apply(frule vds_tys_length_eq') apply(clarsimp)\n apply(simp) apply(clarsimp) apply(split vd.splits) apply(clarsimp) apply(drule lift_opts_find_type) apply(simp)\n apply(clarsimp)\napply(clarsimp) apply(drule vds_tys_length_eq) apply(simp add: vds_tys_length_eq'')\ndone\n\ndefinition\nis_sty_one :: \"P \\ ty \\ ty \\ bool option\"\nwhere\n\"is_sty_one P ty ty' =\n (case find_path_ty_f P ty of None \\ None | Some ctxclds \\\n (case ty' of ty_top \\ Some True | ty_def ctx' dcl' \\\n Some ((ctx', dcl') : set (map (\\(ctx, cld). (ctx, class_name_f cld)) ctxclds)) ))\"\n\nlemma class_name_mem_map[rule_format]:\n\"(ctx, cld, class_name_f cld) \\ set ctx_cld_dcl_list\n \\ (ctx, class_name_f cld)\n \\ ((\\(ctx, cld). (ctx, class_name_f cld)) \\ (\\(ctx, cld, dcl). (ctx, cld))) `\n set ctx_cld_dcl_list\"\nby (induct ctx_cld_dcl_list, auto)\n\nlemma map_map_three:\n \" ctxclds = map ((\\(ctx, cld, dcl). (ctx, cld)) \\ (\\(ctx, cld). (ctx, cld, class_name_f cld))) ctxclds\"\nby (induct ctxclds, auto)\n\nlemma mem_el_map[rule_format]:\n \"(ctx, dcl) \\ set ctxclds\n \\ (ctx, class_name_f dcl)\n \\ (\\(ctx_XXX, cld_XXX, y). (ctx_XXX, y)) `\n set (map (\\(ctx, cld). (ctx, cld, class_name_f cld)) ctxclds)\"\nby (induct ctxclds, auto)\n\nlemma [simp]: \"(sty_one P ty ty') = (is_sty_one P ty ty' = Some True)\"\napply(rule)\n apply(induct rule: sty_one.induct)\n apply(simp add: is_sty_one_def)\n apply(clarsimp simp add: is_sty_one_def) apply(rename_tac ctx cld dcl)\n apply(drule_tac x = \"(ctx, cld, dcl)\" in bspec, simp) apply(clarsimp)\n apply(simp add: class_name_mem_map)\napply(clarsimp simp add: is_sty_one_def split: option.splits ty.splits)\n apply(simp add: sty_objI)\napply(rename_tac ctxclds ctx dcl)\napply(rule_tac ctx_cld_dcl_list = \"map (\\(ctx, cld). (ctx, cld, class_name_f cld)) ctxclds\" in sty_dclI[simplified])\n apply(clarsimp) apply(rule map_map_three)\n apply(force)\napply(rule mem_el_map, assumption)\ndone\n\nlemma path_append[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\ \\path''. path = path' @ path''\"\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(force split: split_if_asm option.splits)\ndone\n\nlemma all_in_path_found'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\ctxcld \\ set path. ctxcld \\ set path' \\ (\\ctx' fqn'. find_cld_f P ctx' fqn' = Some ctxcld))\"\napply(induct rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(rule)\napply(force split: split_if_asm option.splits)\ndone\n\nlemma all_in_path_found:\n \"\\find_path_f P ctx cl = Some path; ctxcld \\ set path\\ \\ \\ctx' fqn'. find_cld_f P ctx' fqn' = Some ctxcld\"\nby (unfold find_path_f_def, simp only: all_in_path_found'[of _ _ _ \"[]\", simplified])\n\nlemma fpr_target_is_head':\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld. cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\\n (\\path''. path = path' @ ctxcld # path''))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: split_if_asm option.splits)\napply(case_tac \"superclass_name_f b\") apply(clarsimp)\napply(clarsimp split: split_if_asm option.splits)\napply(force)\ndone\n\nlemma fpr_target_is_head:\n \"find_path_f P ctx (cl_fqn fqn) = Some path \\ \\ctxcld. find_cld_f P ctx fqn = Some ctxcld \\ (\\path''. path = ctxcld # path'')\"\napply(unfold find_path_f_def) apply(frule fpr_target_is_head'[of _ _ _ \"[]\", THEN mp]) apply(clarsimp split: option.splits) done\n\nlemma fpr_sub_path':\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld path'' path_fqn.\n cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\\n find_path_rec_f P (fst ctxcld) (superclass_name_f (snd ctxcld)) path'' = Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ path = path' @ ctxcld # path'''))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: split_if_asm option.splits)\napply(case_tac \"superclass_name_f b\") apply(simp add: find_path_f_def)\napply(clarsimp split: split_if_asm option.splits)\napply(frule_tac path = path in path_append) apply(clarsimp) apply(force)\ndone\n\nlemma fpr_sub_path:\n \"\\find_path_f P ctx (cl_fqn fqn) = Some path; find_cld_f P ctx fqn = Some ctxcld;\n find_path_f P (fst ctxcld) (superclass_name_f (snd ctxcld)) = Some path'\\\n \\ path = ctxcld # path'\"\nby (unfold find_path_f_def, force intro: fpr_sub_path'[rule_format, of _ _ _ \"[]\" _ _ _ \"[]\", simplified])\n\nlemma fpr_sub_path_simp:\n \"\\find_path_rec_f P ctx (superclass_name_f cld) path'' = Some path_fqn; find_cld_f P ctx fqn = Some (ctx, cld); acyclic_clds P;\n find_path_rec_f P ctx (superclass_name_f cld) (path' @ [(ctx, cld)]) = Some path\\\n \\ \\path'''. path_fqn = path'' @ path''' \\ path = path' @ (ctx, cld) # path'''\"\napply(cut_tac P = P and ctx = ctx and cl = \"cl_fqn fqn\" and path' = path' and path = path in fpr_sub_path')\napply(clarsimp split: option.splits split_if_asm)\ndone\n\nlemma fpr_same_suffix'[rule_format]:\n \"find_path_rec_f P ctx cl prefix = Some path \\\n (\\suffix prefix'. path = prefix @ suffix \\\n find_path_rec_f P ctx cl prefix' = Some (prefix' @ suffix))\"\napply(induct_tac P ctx cl prefix rule: find_path_rec_f.induct)\n apply(clarsimp)\napply(clarsimp split: option.splits)\napply(frule path_append) apply(force)\ndone\n\nlemma fpr_same_suffix:\n \"find_path_rec_f P ctx cl prefix = Some path \\\n (\\suffix prefix' suffix'. path = prefix @ suffix \\\n find_path_rec_f P ctx cl prefix' = Some (prefix' @ suffix')\n \\ suffix = suffix')\"\napply(induct_tac P ctx cl prefix rule: find_path_rec_f.induct)\n apply(clarsimp)\nby (metis fpr_same_suffix' option.inject same_append_eq)\n\nlemma fpr_mid_path'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\ctxcld \\ set path.\n ctxcld \\ set path' \\\n (\\path_fqn. find_path_rec_f P (fst ctxcld) (cl_fqn (fqn_def (class_name_f (snd ctxcld)))) path'' = Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ (\\path_rest. path = path_rest @ path'''))))\"\napply(induct_tac P ctx cl path' rule: find_path_rec_f.induct)\n apply(simp)\napply(clarsimp split: option.splits)\napply(frule find_cld_name_eq) apply(clarsimp)\napply(rename_tac path' ctx' cld' cld'' ctx'' path''' cl fds mds)\napply(subgoal_tac \"find_path_rec_f P ctx' (superclass_name_f cld') (path' @ [(ctx', cld')]) = Some path \\\n (\\ctxcld\\set path.\n ctxcld = (ctx', cld') \\\n ctxcld \\ set path' \\\n (\\path_fqn. case_option None (case_prod (\\ctx' cld. find_path_rec_f P ctx' (superclass_name_f cld) (path'' @ [(ctx', cld)])))\n (find_cld_f P (fst ctxcld) (fqn_def (class_name_f (snd ctxcld)))) =\n Some path_fqn \\\n (\\path'''. path_fqn = path'' @ path''' \\ (\\path_rest. path = path_rest @ path'''))))\")\n apply(erule impE) apply simp\n apply(drule_tac x = \"(ctx'', cld'')\" in bspec, simp) apply(clarsimp)\n apply(simp add: superclass_name_f_def)\n apply(case_tac cld') apply(rename_tac dcl' cl' fds' mds') apply(clarsimp simp add: class_name_f_def)\n apply(case_tac fqn) apply(rename_tac dcl'') apply(clarsimp)\n apply(frule find_cld_name_eq) apply(clarsimp)\n apply(frule path_append) apply(frule_tac path = \"path'' @ path'''\" in path_append) apply(clarsimp)\n apply(rule_tac x = path' in exI) apply(clarsimp)\n apply(frule_tac suffix = path''a and prefix' = \"path'' @ [(ctx', cld_def dcl' cl' fds' mds')]\" and\n suffix' = path''aa in fpr_same_suffix[rule_format]) apply(simp)\n apply(force)\napply(simp)\ndone\n\nlemma fpr_mid_path:\n \"\\find_path_f P ctx cl = Some path; (ctx', cld') \\ set path;\n find_path_f P ctx' (cl_fqn (fqn_def (class_name_f cld'))) = Some path'\\\n \\ \\path''. path = path'' @ path'\"\napply(cut_tac P = P and ctx = ctx and cl = cl and path' = \"[]\" and path = path and ctxcld = \"(ctx', cld')\" and path'' = \"[]\" in fpr_mid_path')\napply(unfold find_path_f_def, assumption) apply(assumption) apply(simp)\ndone\n\nlemma fpr_first_in_path'[rule_format]:\n \"find_path_rec_f P ctx cl path' = Some path \\\n (\\fqn ctxcld. cl = cl_fqn fqn \\ find_cld_f P ctx fqn = Some ctxcld \\ ctxcld \\ set path)\"\napply(case_tac cl)\n apply(simp)\napply(clarsimp) apply(drule path_append) apply(force)\ndone\n\nlemma fpr_first_in_path:\n \"\\find_path_f P ctx (cl_fqn fqn) = Some path; find_cld_f P ctx fqn = Some ctxcld\\ \\ ctxcld \\ set path\"\nby (unfold find_path_f_def, force intro: fpr_first_in_path'[of _ _ _ \"[]\", simplified])\n\nlemma cld_for_path:\n \"find_path_f P ctx (cl_fqn fqn) = Some path \\ \\ctxcld. find_cld_f P ctx fqn = Some ctxcld\"\napply(unfold find_path_f_def) apply(clarsimp split: split_if_asm option.splits) done\n\nlemma ctx_cld_ctx_dcl[rule_format]:\n \"(ctx, cld_def dcl cl fds mds) \\ set path \\ (ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path\"\nby (induct path, auto simp add: class_name_f_def)\n\nlemma ctx_dcl_ctx_cld[rule_format]:\n \"(ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path \\ (\\cl fds mds. (ctx, cld_def dcl cl fds mds) \\ set path)\"\napply(induct path) apply(simp)\napply(auto) apply(case_tac b) apply(force simp add: class_name_f_def)\ndone\n\nlemma ctx_dcl_mem_path:\n \"find_path_f P ctx (cl_fqn (fqn_def dcl)) = Some path \\ (ctx, dcl) \\ (\\(ctx, cld). (ctx, class_name_f cld)) ` set path\"\napply(frule cld_for_path) apply(erule exE)\napply(frule fpr_first_in_path) apply(assumption)\napply(frule find_cld_name_eq) apply(elim exE)\napply(clarsimp simp add: ctx_cld_ctx_dcl)\ndone\n\nlemma sty_reflexiveI:\n \"is_sty_one P ty ty' = Some True \\ is_sty_one P ty ty = Some True\"\napply(simp add: is_sty_one_def split: option.splits) apply(case_tac ty) apply(simp) apply(clarsimp)\napply(drule ctx_dcl_mem_path) apply(force)\ndone\n\nlemma sty_transitiveI:\n \"\\is_sty_one P ty ty' = Some True; is_sty_one P ty' ty'' = Some True\\\n \\ is_sty_one P ty ty'' = Some True\"\napply(clarsimp simp add: is_sty_one_def split: ty.splits option.splits)\napply(rename_tac path ctx dcl path' ctx' dcl')\napply(case_tac ty) apply(simp) apply(clarsimp) apply(rename_tac ctx dcl ctx' cld' ctx'' cld'')\napply(frule fpr_mid_path) apply(simp) apply(simp) apply(force)\ndone\n\ndefinition\nis_sty_many :: \"P \\ tys \\ tys \\ bool option\"\nwhere\n\"is_sty_many P tys tys' =\n (if length tys \\ length tys' then None else\n (case lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') (zip tys tys'))\n of None \\ None | Some bools \\ Some (list_all id bools)))\"\n\nlemma lift_opts_exists:\n \"\\x\\set ty_ty'_list. (\\(ty, ty'). is_sty_one P ty ty' = Some True) x \\ \\bools. lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') ty_ty'_list) = Some bools\"\nby (induct ty_ty'_list, auto)\n\nlemma lift_opts_all_true[rule_format]:\n \"\\bools. (\\x\\set ty_ty'_list. (\\(ty, ty'). is_sty_one P ty ty' = Some True) x) \\\n lift_opts (map (\\(ty, ty'). is_sty_one P ty ty') ty_ty'_list) = Some bools\n \\ list_all id bools\"\nby (induct ty_ty'_list, auto split: option.splits)\n\nlemma tys_tys'_list: \"\\bools ty ty'. \\lift_opts (map (\\(x, y). is_sty_one P x y) tys_tys'_list) = Some bools; length tys = length tys'; list_all id bools; (ty, ty') \\ set tys_tys'_list\\ \\ is_sty_one P ty ty' = Some True\"\napply(induct tys_tys'_list)\n apply(simp)\napply(clarsimp split: option.splits)\nby force\n\nlemma [simp]: \"(sty_many P tys tys') = (is_sty_many P tys tys' = Some True)\"\napply(rule)\n apply(erule sty_many.cases) apply(clarsimp simp add: is_sty_many_def split: option.splits) apply(rule)\n apply(simp add: lift_opts_exists)\n apply(force intro: lift_opts_all_true)\napply(clarsimp simp add: is_sty_many_def split: option.splits split_if_asm)\napply(rule_tac ty_ty'_list = \"zip tys tys'\" in sty_manyI)\n apply(simp add: map_fst_zip[THEN sym])\n apply(simp add: map_snd_zip[THEN sym])\napply(clarsimp)\napply(simp add: tys_tys'_list)\ndone\n\n(* TODO: here will go all the other definitions for functions equivalent to\n relations concerning well-formedness *)\n\ndefinition\ntr_x :: \"T \\ x \\ x\"\nwhere\n\"tr_x T x = (case T x of None \\ x | Some x' \\ x')\"\n\ndefinition\ntr_var :: \"T \\ var \\ var\"\nwhere\n\"tr_var T var = (case tr_x T (x_var var) of x_this \\ var | x_var var' \\ var')\"\n\nprimrec\ntr_s_f :: \"T \\ s \\ s\" and\ntr_ss_f :: \"T \\ s list \\ s list\"\nwhere\n\"tr_s_f T (s_block ss) = s_block (tr_ss_f T ss)\" |\n\"tr_s_f T (s_ass var x) = s_ass (tr_var T var) (tr_x T x)\" |\n\"tr_s_f T (s_read var x f) = s_read (tr_var T var) (tr_x T x) f\" |\n\"tr_s_f T (s_write x f y) = s_write (tr_x T x) f (tr_x T y)\" |\n\"tr_s_f T (s_if x y s1 s2) = s_if (tr_x T x) (tr_x T y) (tr_s_f T s1) (tr_s_f T s2)\" |\n\"tr_s_f T (s_call var x m ys) = s_call (tr_var T var) (tr_x T x) m (map (tr_x T) ys)\" |\n\"tr_s_f T (s_new var ctx cl) = s_new (tr_var T var) ctx cl\" |\n\n\"tr_ss_f T [] = []\" |\n\"tr_ss_f T (s#ss) = tr_s_f T s # tr_ss_f T ss\"\n\nlemma [simp]: \"(\\x\\set s_s'_list. case x of (s_XXX, s_') \\ tr_s T s_XXX s_' \\ tr_s_f T s_XXX = s_') \\\n tr_ss_f T (map fst s_s'_list) = map snd s_s'_list\"\nby (induct s_s'_list, auto)\n\nlemma [simp]: \"(\\x\\set y_y'_list. split (\\y_XXX. op = (case T y_XXX of None \\ y_XXX | Some x' \\ x')) x) \\ map (tr_x T) (map fst y_y'_list) = map snd y_y'_list\"\napply(induct y_y'_list) apply(simp) apply(clarsimp) apply(simp only: tr_x_def) done\n\nlemma set_zip_tr[simp]: \"(s, s') \\ set (zip ss (tr_ss_f T ss)) \\ s' = tr_s_f T s\" by (induct ss, auto)\n\n\n\nlemma tr_ss_map:\n \"tr_ss_f T (map fst s_s'_list) = map snd s_s'_list \\ (\\x\\set s_s'_list. case_prod (tr_s T) x) \\\n (a, b) \\ set s_s'_list \\ tr_s T a (tr_s_f T a)\"\napply(induct s_s'_list) by auto\n\nlemma tr_f_to_rel: \"\\s'. tr_s_f T s = s' \\ tr_s T s s'\"\napply(induct s rule: tr_s_f.induct)\napply(simp)\napply(clarsimp) apply(rule tr_s_var_assignI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp add: tr_x_def)\napply(clarsimp) apply(rule tr_s_field_readI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp add: tr_x_def)\napply(clarsimp) apply(rule tr_s_field_writeI)\napply(simp add: tr_x_def) apply(simp add: tr_x_def)\napply(clarsimp simp only: tr_s_f.simps) apply(rule tr_s_ifI)\napply(simp only: tr_x_def) apply(simp only: tr_x_def) apply(simp) apply(simp)\napply(clarsimp) apply(rule tr_s_newI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(clarsimp)\napply(rename_tac var x m ys)\napply(cut_tac T = T and var = var and var' = \"tr_var T var\" and x = x and\n x' = \"tr_x T x\" and y_y'_list = \"zip ys (map (tr_x T) ys)\" and\n meth = m in tr_s_mcallI)\napply(clarsimp simp add: tr_x_def tr_var_def split: option.splits)\napply(simp only: tr_x_def) apply(clarsimp simp add: set_zip tr_x_def) apply(simp)\napply(simp)\napply(cut_tac T = T and s_s'_list = \"[]\" in tr_s_blockI[simplified])\n apply(simp)\napply(clarsimp)\napply(clarsimp) apply(rename_tac s ss)\napply(cut_tac T = T and s_s'_list = \"zip (s # ss) (tr_s_f T s # tr_ss_f T ss)\" in tr_s_blockI[simplified])\n apply(clarsimp) apply(rename_tac x x')\n apply(frule set_zip_tr[THEN mp]) apply(clarsimp)\n apply(erule in_set_zipE)\n apply(erule_tac ?a1.0=\"T\" and ?a2.0=\"s_block ss\" and ?a3.0=\"s_block (tr_ss_f T ss)\" in tr_s.cases)\n apply(clarsimp)\n apply(rule tr_ss_map[THEN mp], force)\n apply(clarsimp)+\ndone\n\nlemma tr_rel_f_eq: \"((tr_s T s s') = (tr_s_f T s = s'))\"\napply(rule)\n apply(erule tr_s.induct)\n apply(force simp add: tr_x_def tr_var_def split: option.splits)+\napply(cut_tac T = T and s = s in tr_f_to_rel) apply(simp)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/LightweightJava/Lightweight_Java_Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.269325660722098}} {"text": "(* Title: Jinja/J/Equivalence.thy\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nsection \\Equivalence of Big Step and Small Step Semantics\\\n\ntheory Equivalence imports BigStep SmallStep WWellForm begin\n\nsubsection\\Small steps simulate big step\\\n\nsubsubsection \"Cast\"\n\nlemma CastReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\Cast C e,s\\ \\* \\Cast C e',s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) CastRed[OF step(2)]])\nqed\n(*>*)\n\nlemma CastRedsNull:\n \"P \\ \\e,s\\ \\* \\null,s'\\ \\ P \\ \\Cast C e,s\\ \\* \\null,s'\\\"\n(*<*)by(rule CastReds[THEN rtrancl_into_rtrancl, OF _ RedCastNull])(*>*)\n\nlemma CastRedsAddr:\n \"\\ P \\ \\e,s\\ \\* \\addr a,s'\\; hp s' a = Some(D,fs); P \\ D \\\\<^sup>* C \\ \\\n P \\ \\Cast C e,s\\ \\* \\addr a,s'\\\"\n(*<*)by(rule CastReds[THEN rtrancl_into_rtrancl, OF _ RedCast])(*>*)\n\nlemma CastRedsFail:\n \"\\ P \\ \\e,s\\ \\* \\addr a,s'\\; hp s' a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\ \\\n P \\ \\Cast C e,s\\ \\* \\THROW ClassCast,s'\\\"\n(*<*)by(rule CastReds[THEN rtrancl_into_rtrancl, OF _ RedCastFail])(*>*)\n\nlemma CastRedsThrow:\n \"\\ P \\ \\e,s\\ \\* \\throw a,s'\\ \\ \\ P \\ \\Cast C e,s\\ \\* \\throw a,s'\\\"\n(*<*)by(rule CastReds[THEN rtrancl_into_rtrancl, OF _ red_reds.CastThrow])(*>*)\n\nsubsubsection \"LAss\"\n\nlemma LAssReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\ V:=e,s\\ \\* \\ V:=e',s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) LAssRed[OF step(2)]])\nqed\n(*>*)\n\nlemma LAssRedsVal:\n \"\\ P \\ \\e,s\\ \\* \\Val v,(h',l')\\ \\ \\ P \\ \\ V:=e,s\\ \\* \\unit,(h',l'(V\\v))\\\"\n(*<*)by(rule LAssReds[THEN rtrancl_into_rtrancl, OF _ RedLAss])(*>*)\n\n\n\nsubsubsection \"BinOp\"\n\nlemma BinOp1Reds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\ e \\bop\\ e\\<^sub>2, s\\ \\* \\e' \\bop\\ e\\<^sub>2, s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) BinOpRed1[OF step(2)]])\nqed\n(*>*)\n\nlemma BinOp2Reds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\(Val v) \\bop\\ e, s\\ \\* \\(Val v) \\bop\\ e', s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) BinOpRed2[OF step(2)]])\nqed\n(*>*)\n\nlemma BinOpRedsVal:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\Val v\\<^sub>1,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\Val v\\<^sub>2,s\\<^sub>2\\\"\n and op: \"binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v\"\nshows \"P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\* \\Val v,s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(Val v\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>1)\"\n let ?y' = \"(Val v\\<^sub>1 \\bop\\ Val v\\<^sub>2, s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule BinOp1Reds[OF e\\<^sub>1_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule BinOp2Reds[OF e\\<^sub>2_steps])\n also have \"(?y', ?z) \\ (red P)\" by(rule RedBinOp[OF op])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma BinOpRedsThrow1:\n \"P \\ \\e,s\\ \\* \\throw e',s'\\ \\ P \\ \\e \\bop\\ e\\<^sub>2, s\\ \\* \\throw e', s'\\\"\n(*<*)by(rule BinOp1Reds[THEN rtrancl_into_rtrancl, OF _ red_reds.BinOpThrow1])(*>*)\n\nlemma BinOpRedsThrow2:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\Val v\\<^sub>1,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\throw e,s\\<^sub>2\\\"\nshows \"P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\* \\throw e,s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(Val v\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>1)\"\n let ?y' = \"(Val v\\<^sub>1 \\bop\\ throw e, s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule BinOp1Reds[OF e\\<^sub>1_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule BinOp2Reds[OF e\\<^sub>2_steps])\n also have \"(?y', ?z) \\ (red P)\" by(rule red_reds.BinOpThrow2)\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nsubsubsection \"FAcc\"\n\nlemma FAccReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\e\\F{D}, s\\ \\* \\e'\\F{D}, s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) FAccRed[OF step(2)]])\nqed\n(*>*)\n\nlemma FAccRedsVal:\n \"\\P \\ \\e,s\\ \\* \\addr a,s'\\; hp s' a = Some(C,fs); fs(F,D) = Some v \\\n \\ P \\ \\e\\F{D},s\\ \\* \\Val v,s'\\\"\n(*<*)by(rule FAccReds[THEN rtrancl_into_rtrancl, OF _ RedFAcc])(*>*)\n\nlemma FAccRedsNull:\n \"P \\ \\e,s\\ \\* \\null,s'\\ \\ P \\ \\e\\F{D},s\\ \\* \\THROW NullPointer,s'\\\"\n(*<*)by(rule FAccReds[THEN rtrancl_into_rtrancl, OF _ RedFAccNull])(*>*)\n\nlemma FAccRedsThrow:\n \"P \\ \\e,s\\ \\* \\throw a,s'\\ \\ P \\ \\e\\F{D},s\\ \\* \\throw a,s'\\\"\n(*<*)by(rule FAccReds[THEN rtrancl_into_rtrancl, OF _ red_reds.FAccThrow])(*>*)\n\nsubsubsection \"FAss\"\n\nlemma FAssReds1:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\e\\F{D}:=e\\<^sub>2, s\\ \\* \\e'\\F{D}:=e\\<^sub>2, s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) FAssRed1[OF step(2)]])\nqed\n(*>*)\n\nlemma FAssReds2:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\Val v\\F{D}:=e, s\\ \\* \\Val v\\F{D}:=e', s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) FAssRed2[OF step(2)]])\nqed\n(*>*)\n\nlemma FAssRedsVal:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\addr a,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\Val v,(h\\<^sub>2,l\\<^sub>2)\\\"\n and hC: \"Some(C,fs) = h\\<^sub>2 a\"\nshows \"P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2, s\\<^sub>0\\ \\* \\unit, (h\\<^sub>2(a\\(C,fs((F,D)\\v))),l\\<^sub>2)\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(addr a\\F{D}:=e\\<^sub>2, s\\<^sub>1)\"\n let ?y' = \"(addr a\\F{D}:=Val v::expr,(h\\<^sub>2,l\\<^sub>2))\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule FAssReds1[OF e\\<^sub>1_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule FAssReds2[OF e\\<^sub>2_steps])\n also have \"(?y', ?z) \\ (red P)\" using RedFAss hC by simp\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma FAssRedsNull:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\null,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\Val v,s\\<^sub>2\\\"\nshows \"P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2, s\\<^sub>0\\ \\* \\THROW NullPointer, s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(null\\F{D}:=e\\<^sub>2, s\\<^sub>1)\"\n let ?y' = \"(null\\F{D}:=Val v::expr,s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule FAssReds1[OF e\\<^sub>1_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule FAssReds2[OF e\\<^sub>2_steps])\n also have \"(?y', ?z) \\ (red P)\" by(rule RedFAssNull)\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma FAssRedsThrow1:\n \"P \\ \\e,s\\ \\* \\throw e',s'\\ \\ P \\ \\e\\F{D}:=e\\<^sub>2, s\\ \\* \\throw e', s'\\\"\n(*<*)by(rule FAssReds1[THEN rtrancl_into_rtrancl, OF _ red_reds.FAssThrow1])(*>*)\n\nlemma FAssRedsThrow2:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\Val v,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\throw e,s\\<^sub>2\\\"\nshows \"P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\* \\throw e,s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(Val v\\F{D}:=e\\<^sub>2,s\\<^sub>1)\"\n let ?y' = \"(Val v\\F{D}:=throw e,s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule FAssReds1[OF e\\<^sub>1_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule FAssReds2[OF e\\<^sub>2_steps])\n also have \"(?y', ?z) \\ (red P)\" by(rule red_reds.FAssThrow2)\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nsubsubsection\";;\"\n\nlemma SeqReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\e;;e\\<^sub>2, s\\ \\* \\e';;e\\<^sub>2, s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) SeqRed[OF step(2)]])\nqed\n(*>*)\n\nlemma SeqRedsThrow:\n \"P \\ \\e,s\\ \\* \\throw e',s'\\ \\ P \\ \\e;;e\\<^sub>2, s\\ \\* \\throw e', s'\\\"\n(*<*)by(rule SeqReds[THEN rtrancl_into_rtrancl, OF _ red_reds.SeqThrow])(*>*)\n\nlemma SeqReds2:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\Val v\\<^sub>1,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\* \\e\\<^sub>2',s\\<^sub>2\\\"\nshows \"P \\ \\e\\<^sub>1;;e\\<^sub>2, s\\<^sub>0\\ \\* \\e\\<^sub>2',s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(Val v\\<^sub>1;; e\\<^sub>2,s\\<^sub>1)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule SeqReds[OF e\\<^sub>1_steps])\n also have \"(?y, ?z) \\ (red P)\\<^sup>*\"\n by(rule RedSeq[THEN converse_rtrancl_into_rtrancl, OF e\\<^sub>2_steps])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\n\nsubsubsection\"If\"\n\nlemma CondReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\ \\* \\if (e') e\\<^sub>1 else e\\<^sub>2,s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) CondRed[OF step(2)]])\nqed\n(*>*)\n\nlemma CondRedsThrow:\n \"P \\ \\e,s\\ \\* \\throw a,s'\\ \\ P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\ \\* \\throw a,s'\\\"\n(*<*)by(rule CondReds[THEN rtrancl_into_rtrancl, OF _ red_reds.CondThrow])(*>*)\n\nlemma CondReds2T:\nassumes e_steps: \"P \\ \\e,s\\<^sub>0\\ \\* \\true,s\\<^sub>1\\\"\n and e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1, s\\<^sub>1\\ \\* \\e',s\\<^sub>2\\\"\nshows \"P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\* \\e',s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(if (true) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>1)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule CondReds[OF e_steps])\n also have \"(?y, ?z) \\ (red P)\\<^sup>*\"\n by(rule RedCondT[THEN converse_rtrancl_into_rtrancl, OF e\\<^sub>1_steps])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma CondReds2F:\nassumes e_steps: \"P \\ \\e,s\\<^sub>0\\ \\* \\false,s\\<^sub>1\\\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2, s\\<^sub>1\\ \\* \\e',s\\<^sub>2\\\"\nshows \"P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\* \\e',s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(if (false) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>1)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule CondReds[OF e_steps])\n also have \"(?y, ?z) \\ (red P)\\<^sup>*\"\n by(rule RedCondF[THEN converse_rtrancl_into_rtrancl, OF e\\<^sub>2_steps])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\n\nsubsubsection \"While\"\n\nlemma WhileFReds:\nassumes b_steps: \"P \\ \\b,s\\ \\* \\false,s'\\\"\nshows \"P \\ \\while (b) c,s\\ \\* \\unit,s'\\\"\n(*<*)\nby(rule RedWhile[THEN converse_rtrancl_into_rtrancl,\n OF CondReds[THEN rtrancl_into_rtrancl,\n OF b_steps RedCondF]])\n(*>*)\n\nlemma WhileRedsThrow:\nassumes b_steps: \"P \\ \\b,s\\ \\* \\throw e,s'\\\"\nshows \"P \\ \\while (b) c,s\\ \\* \\throw e,s'\\\"\n(*<*)\nby(rule RedWhile[THEN converse_rtrancl_into_rtrancl,\n OF CondReds[THEN rtrancl_into_rtrancl,\n OF b_steps red_reds.CondThrow]])\n(*>*)\n\nlemma WhileTReds:\nassumes b_steps: \"P \\ \\b,s\\<^sub>0\\ \\* \\true,s\\<^sub>1\\\"\n and c_steps: \"P \\ \\c,s\\<^sub>1\\ \\* \\Val v\\<^sub>1,s\\<^sub>2\\\"\n and while_steps: \"P \\ \\while (b) c,s\\<^sub>2\\ \\* \\e,s\\<^sub>3\\\"\nshows \"P \\ \\while (b) c,s\\<^sub>0\\ \\* \\e,s\\<^sub>3\\\"\n(*<*)(is \"(?a, ?c) \\ (red P)\\<^sup>*\")\nproof -\n let ?b = \"(if (b) (c;; while (b) c) else unit,s\\<^sub>0)\"\n let ?y = \"(if (true) (c;; while (b) c) else unit,s\\<^sub>1)\"\n let ?b' = \"(c;; while (b) c,s\\<^sub>1)\"\n let ?y' = \"(Val v\\<^sub>1;; while (b) c,s\\<^sub>2)\"\n have \"(?a, ?b) \\ (red P)\\<^sup>*\"\n using RedWhile[THEN converse_rtrancl_into_rtrancl] by simp\n also have \"(?b, ?y) \\ (red P)\\<^sup>*\" by(rule CondReds[OF b_steps])\n also have \"(?y, ?b') \\ (red P)\\<^sup>*\"\n using RedCondT[THEN converse_rtrancl_into_rtrancl] by simp\n also have \"(?b', ?y') \\ (red P)\\<^sup>*\" by(rule SeqReds[OF c_steps])\n also have \"(?y', ?c) \\ (red P)\\<^sup>*\"\n by(rule RedSeq[THEN converse_rtrancl_into_rtrancl, OF while_steps])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma WhileTRedsThrow:\nassumes b_steps: \"P \\ \\b,s\\<^sub>0\\ \\* \\true,s\\<^sub>1\\\"\n and c_steps: \"P \\ \\c,s\\<^sub>1\\ \\* \\throw e,s\\<^sub>2\\\"\nshows \"P \\ \\while (b) c,s\\<^sub>0\\ \\* \\throw e,s\\<^sub>2\\\"\n(*<*)(is \"(?a, ?c) \\ (red P)\\<^sup>*\")\nproof -\n let ?b = \"(if (b) (c;; while (b) c) else unit,s\\<^sub>0)\"\n let ?y = \"(if (true) (c;; while (b) c) else unit,s\\<^sub>1)\"\n let ?b' = \"(c;; while (b) c,s\\<^sub>1)\"\n let ?y' = \"(throw e;; while (b) c,s\\<^sub>2)\"\n have \"(?a, ?b) \\ (red P)\\<^sup>*\"\n using RedWhile[THEN converse_rtrancl_into_rtrancl] by simp\n also have \"(?b, ?y) \\ (red P)\\<^sup>*\" by(rule CondReds[OF b_steps])\n also have \"(?y, ?b') \\ (red P)\\<^sup>*\"\n using RedCondT[THEN converse_rtrancl_into_rtrancl] by simp\n also have \"(?b', ?y') \\ (red P)\\<^sup>*\" by(rule SeqReds[OF c_steps])\n also have \"(?y', ?c) \\ (red P)\" by(rule red_reds.SeqThrow)\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nsubsubsection\"Throw\"\n\nlemma ThrowReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\throw e,s\\ \\* \\throw e',s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) ThrowRed[OF step(2)]])\nqed\n(*>*)\n\nlemma ThrowRedsNull:\n \"P \\ \\e,s\\ \\* \\null,s'\\ \\ P \\ \\throw e,s\\ \\* \\THROW NullPointer,s'\\\"\n(*<*)by(rule ThrowReds[THEN rtrancl_into_rtrancl, OF _ RedThrowNull])(*>*)\n\nlemma ThrowRedsThrow:\n \"P \\ \\e,s\\ \\* \\throw a,s'\\ \\ P \\ \\throw e,s\\ \\* \\throw a,s'\\\"\n(*<*)by(rule ThrowReds[THEN rtrancl_into_rtrancl, OF _ red_reds.ThrowThrow])(*>*)\n\nsubsubsection \"InitBlock\"\n\nlemma InitBlockReds_aux:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\\n \\h l h' l' v. s = (h,l(V\\v)) \\ s' = (h',l') \\\n P \\ \\{V:T := Val v; e},(h,l)\\ \\* \\{V:T := Val(the(l' V)); e'},(h',l'(V:=(l V)))\\\"\n(*<*)\nproof(induct rule: converse_rtrancl_induct2)\n case refl then show ?case\n by(fastforce simp: fun_upd_same simp del:fun_upd_apply)\nnext\n case (step e0 s0 e1 s1)\n obtain h1 l1 where s1[simp]: \"s1 = (h1, l1)\" by(cases s1) simp\n { fix h0 l0 h2 l2 v0\n assume [simp]: \"s0 = (h0, l0(V \\ v0))\" and s'[simp]: \"s' = (h2, l2)\" \n then have \"V \\ dom l1\" using step(1) by(auto dest!: red_lcl_incr)\n then obtain v1 where l1V[simp]: \"l1 V = \\v1\\\" by blast\n\n let ?a = \"({V:T; V:=Val v0;; e0},(h0, l0))\"\n let ?b = \"({V:T; V:=Val v1;; e1},(h1, l1(V := l0 V)))\"\n let ?c = \"({V:T; V:=Val (the (l2 V));; e'},(h2, l2(V := l0 V)))\"\n let ?l = \"l1(V := l0 V)\" and ?v = v1\n\n have e0_steps: \"P \\ \\e0,(h0, l0(V \\ v0))\\ \\ \\e1,(h1, l1)\\\"\n using step(1) by simp\n\n have lv: \"\\l v. l1 = l(V \\ v) \\\n P \\ \\{V:T; V:=Val v;; e1},(h1, l)\\ \\*\n \\{V:T; V:=Val (the (l2 V));; e'},(h2, l2(V := l V))\\\"\n using step(3) s' s1 by blast\n moreover have \"l1 = ?l(V \\ ?v)\" by(rule ext) (simp add:fun_upd_def)\n ultimately have \"(?b, ?c) \\ (red P)\\<^sup>*\" using lv[of ?l ?v] by simp\n then have \"(?a, ?c) \\ (red P)\\<^sup>*\"\n by(rule InitBlockRed[THEN converse_rtrancl_into_rtrancl, OF e0_steps l1V])\n }\n then show ?case by blast\nqed\n(*>*)\n\nlemma InitBlockReds:\n \"P \\ \\e, (h,l(V\\v))\\ \\* \\e', (h',l')\\ \\\n P \\ \\{V:T := Val v; e}, (h,l)\\ \\* \\{V:T := Val(the(l' V)); e'}, (h',l'(V:=(l V)))\\\"\n(*<*)by(blast dest:InitBlockReds_aux)(*>*)\n\nlemma InitBlockRedsFinal:\n \"\\ P \\ \\e,(h,l(V\\v))\\ \\* \\e',(h',l')\\; final e' \\ \\\n P \\ \\{V:T := Val v; e},(h,l)\\ \\* \\e',(h', l'(V := l V))\\\"\n(*<*)\nby(fast elim!:InitBlockReds[THEN rtrancl_into_rtrancl] finalE\n intro:RedInitBlock InitBlockThrow)\n(*>*)\n\n\nsubsubsection \"Block\"\n\nlemma BlockRedsFinal:\nassumes reds: \"P \\ \\e\\<^sub>0,s\\<^sub>0\\ \\* \\e\\<^sub>2,(h\\<^sub>2,l\\<^sub>2)\\\" and fin: \"final e\\<^sub>2\"\nshows \"\\h\\<^sub>0 l\\<^sub>0. s\\<^sub>0 = (h\\<^sub>0,l\\<^sub>0(V:=None)) \\ P \\ \\{V:T; e\\<^sub>0},(h\\<^sub>0,l\\<^sub>0)\\ \\* \\e\\<^sub>2,(h\\<^sub>2,l\\<^sub>2(V:=l\\<^sub>0 V))\\\"\n(*<*)\nusing reds\nproof (induct rule:converse_rtrancl_induct2)\n case refl thus ?case\n by(fastforce intro:finalE[OF fin] RedBlock BlockThrow\n simp del:fun_upd_apply)\nnext\n case (step e\\<^sub>0 s\\<^sub>0 e\\<^sub>1 s\\<^sub>1)\n have red: \"P \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\e\\<^sub>1,s\\<^sub>1\\\"\n and reds: \"P \\ \\e\\<^sub>1,s\\<^sub>1\\ \\* \\e\\<^sub>2,(h\\<^sub>2,l\\<^sub>2)\\\"\n and IH: \"\\h l. s\\<^sub>1 = (h,l(V := None))\n \\ P \\ \\{V:T; e\\<^sub>1},(h,l)\\ \\* \\e\\<^sub>2,(h\\<^sub>2, l\\<^sub>2(V := l V))\\\"\n and s\\<^sub>0: \"s\\<^sub>0 = (h\\<^sub>0, l\\<^sub>0(V := None))\" by fact+\n obtain h\\<^sub>1 l\\<^sub>1 where s\\<^sub>1: \"s\\<^sub>1 = (h\\<^sub>1,l\\<^sub>1)\" by fastforce\n show ?case\n proof cases\n assume \"assigned V e\\<^sub>0\"\n then obtain v e where e\\<^sub>0: \"e\\<^sub>0 = V := Val v;; e\"\n by (unfold assigned_def)blast\n from red e\\<^sub>0 s\\<^sub>0 have e\\<^sub>1: \"e\\<^sub>1 = unit;;e\" and s\\<^sub>1: \"s\\<^sub>1 = (h\\<^sub>0, l\\<^sub>0(V \\ v))\"\n by auto\n from e\\<^sub>1 fin have \"e\\<^sub>1 \\ e\\<^sub>2\" by (auto simp:final_def)\n then obtain e' s' where red1: \"P \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e',s'\\\"\n and reds': \"P \\ \\e',s'\\ \\* \\e\\<^sub>2,(h\\<^sub>2,l\\<^sub>2)\\\"\n using converse_rtranclE2[OF reds] by blast\n from red1 e\\<^sub>1 have es': \"e' = e\" \"s' = s\\<^sub>1\" by auto\n show ?case using e\\<^sub>0 s\\<^sub>1 es' reds'\n by(fastforce intro!: InitBlockRedsFinal[OF _ fin] simp del:fun_upd_apply)\n next\n assume unass: \"\\ assigned V e\\<^sub>0\"\n show ?thesis\n proof (cases \"l\\<^sub>1 V\")\n assume None: \"l\\<^sub>1 V = None\"\n hence \"P \\ \\{V:T; e\\<^sub>0},(h\\<^sub>0,l\\<^sub>0)\\ \\ \\{V:T; e\\<^sub>1},(h\\<^sub>1, l\\<^sub>1(V := l\\<^sub>0 V))\\\"\n using s\\<^sub>0 s\\<^sub>1 red by(simp add: BlockRedNone[OF _ _ unass])\n moreover\n have \"P \\ \\{V:T; e\\<^sub>1},(h\\<^sub>1, l\\<^sub>1(V := l\\<^sub>0 V))\\ \\* \\e\\<^sub>2,(h\\<^sub>2, l\\<^sub>2(V := l\\<^sub>0 V))\\\"\n using IH[of _ \"l\\<^sub>1(V := l\\<^sub>0 V)\"] s\\<^sub>1 None by(simp add:fun_upd_idem)\n ultimately show ?case by(rule converse_rtrancl_into_rtrancl)\n next\n fix v assume Some: \"l\\<^sub>1 V = Some v\"\n hence \"P \\ \\{V:T;e\\<^sub>0},(h\\<^sub>0,l\\<^sub>0)\\ \\ \\{V:T := Val v; e\\<^sub>1},(h\\<^sub>1,l\\<^sub>1(V := l\\<^sub>0 V))\\\"\n using s\\<^sub>0 s\\<^sub>1 red by(simp add: BlockRedSome[OF _ _ unass])\n moreover\n have \"P \\ \\{V:T := Val v; e\\<^sub>1},(h\\<^sub>1,l\\<^sub>1(V:= l\\<^sub>0 V))\\ \\*\n \\e\\<^sub>2,(h\\<^sub>2,l\\<^sub>2(V:=l\\<^sub>0 V))\\\"\n using InitBlockRedsFinal[OF _ fin,of _ _ \"l\\<^sub>1(V:=l\\<^sub>0 V)\" V]\n Some reds s\\<^sub>1 by(simp add:fun_upd_idem)\n ultimately show ?case by(rule converse_rtrancl_into_rtrancl)\n qed\n qed\nqed\n(*>*)\n\n\nsubsubsection \"try-catch\"\n\nlemma TryReds:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\try e catch(C V) e\\<^sub>2,s\\ \\* \\try e' catch(C V) e\\<^sub>2,s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) TryRed[OF step(2)]])\nqed\n(*>*)\n\nlemma TryRedsVal:\n \"P \\ \\e,s\\ \\* \\Val v,s'\\ \\ P \\ \\try e catch(C V) e\\<^sub>2,s\\ \\* \\Val v,s'\\\"\n(*<*)by(rule TryReds[THEN rtrancl_into_rtrancl, OF _ RedTry])(*>*)\n\nlemma TryCatchRedsFinal:\nassumes e\\<^sub>1_steps: \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\* \\Throw a,(h\\<^sub>1,l\\<^sub>1)\\\"\n and h\\<^sub>1a: \"h\\<^sub>1 a = Some(D,fs)\" and sub: \"P \\ D \\\\<^sup>* C\"\n and e\\<^sub>2_steps: \"P \\ \\e\\<^sub>2, (h\\<^sub>1, l\\<^sub>1(V \\ Addr a))\\ \\* \\e\\<^sub>2', (h\\<^sub>2,l\\<^sub>2)\\\"\n and final: \"final e\\<^sub>2'\"\nshows \"P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2, s\\<^sub>0\\ \\* \\e\\<^sub>2', (h\\<^sub>2, (l\\<^sub>2::locals)(V := l\\<^sub>1 V))\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(try Throw a catch(C V) e\\<^sub>2,(h\\<^sub>1, l\\<^sub>1))\"\n let ?b = \"({V:Class C; V:=addr a;; e\\<^sub>2},(h\\<^sub>1, l\\<^sub>1))\"\n have bz: \"(?b, ?z) \\ (red P)\\<^sup>*\"\n by(rule InitBlockRedsFinal[OF e\\<^sub>2_steps final])\n have hp: \"hp (h\\<^sub>1, l\\<^sub>1) a = \\(D, fs)\\\" using h\\<^sub>1a by simp\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule TryReds[OF e\\<^sub>1_steps])\n also have \"(?y, ?z) \\ (red P)\\<^sup>*\"\n by(rule RedTryCatch[THEN converse_rtrancl_into_rtrancl, OF hp sub bz])\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nlemma TryRedsFail:\n \"\\ P \\ \\e\\<^sub>1,s\\ \\* \\Throw a,(h,l)\\; h a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\ \\* \\Throw a,(h,l)\\\"\n(*<*)by(fastforce intro!: TryReds[THEN rtrancl_into_rtrancl, OF _ RedTryFail])(*>*)\n\nsubsubsection \"List\"\n\nlemma ListReds1:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\e#es,s\\ [\\]* \\e' # es,s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) ListRed1[OF step(2)]])\nqed\n(*>*)\n\nlemma ListReds2:\n \"P \\ \\es,s\\ [\\]* \\es',s'\\ \\ P \\ \\Val v # es,s\\ [\\]* \\Val v # es',s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) ListRed2[OF step(2)]])\nqed\n(*>*)\n\nlemma ListRedsVal:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\* \\Val v,s\\<^sub>1\\; P \\ \\es,s\\<^sub>1\\ [\\]* \\es',s\\<^sub>2\\ \\\n \\ P \\ \\e#es,s\\<^sub>0\\ [\\]* \\Val v # es',s\\<^sub>2\\\"\n(*<*)by(rule rtrancl_trans[OF ListReds1 ListReds2])(*>*)\n\nsubsubsection\"Call\"\n\ntext\\First a few lemmas on what happens to free variables during redction.\\\n\nlemma assumes wf: \"wwf_J_prog P\"\nshows Red_fv: \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ fv e' \\ fv e\"\n and \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ fvs es' \\ fvs es\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case (RedCall h l a C fs M Ts T pns body D vs)\n hence \"fv body \\ {this} \\ set pns\"\n using assms by(fastforce dest!:sees_wf_mdecl simp:wf_mdecl_def)\n with RedCall.hyps show ?case by fastforce\nqed auto\n(*>*)\n\n\nlemma Red_dom_lcl:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ dom l' \\ dom l \\ fv e\" and\n \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ dom l' \\ dom l \\ fvs es\"\n(*<*)\nproof (induct rule:red_reds_inducts)\n case RedLAss thus ?case by(force split:if_splits)\nnext\n case CallParams thus ?case by(force split:if_splits)\nnext\n case BlockRedNone thus ?case by clarsimp (fastforce split:if_splits)\nnext\n case BlockRedSome thus ?case by clarsimp (fastforce split:if_splits)\nnext\n case InitBlockRed thus ?case by clarsimp (fastforce split:if_splits)\nqed auto\n(*>*)\n\nlemma Reds_dom_lcl:\nassumes wf: \"wwf_J_prog P\"\nshows \"P \\ \\e,(h,l)\\ \\* \\e',(h',l')\\ \\ dom l' \\ dom l \\ fv e\"\n(*<*)\nproof(induct rule: converse_rtrancl_induct_red)\n case 1 then show ?case by blast\nnext\n case 2 then show ?case using wf by(blast dest: Red_fv Red_dom_lcl)\nqed\n(*>*)\n\ntext\\Now a few lemmas on the behaviour of blocks during reduction.\\\n\n(* If you want to avoid the premise \"distinct\" further down \\\nconsts upd_vals :: \"locals \\ vname list \\ val list \\ val list\"\nprimrec\n\"upd_vals l [] vs = []\"\n\"upd_vals l (V#Vs) vs = (if V \\ set Vs then hd vs else the(l V)) #\n upd_vals l Vs (tl vs)\"\n\n\n\ndeclare fun_upd_apply[simp del] map_upds_twist[simp del]\n(*>*)\n\n\nlemma blocksReds:\n \"\\l. \\ length Vs = length Ts; length vs = length Ts; distinct Vs;\n P \\ \\e, (h,l(Vs [\\] vs))\\ \\* \\e', (h',l')\\ \\\n \\ P \\ \\blocks(Vs,Ts,vs,e), (h,l)\\ \\* \\blocks(Vs,Ts,map (the \\ l') Vs,e'), (h',override_on l' l (set Vs))\\\"\n(*<*)\nproof(induct Vs Ts vs e rule:blocks_induct)\n case (1 V Vs T Ts v vs e) show ?case\n using InitBlockReds[OF \"1.hyps\"[of \"l(V\\v)\"]] \"1.prems\"\n by(auto simp:override_on_upd_lemma)\nqed auto\n(*>*)\n\n\nlemma blocksFinal:\n \"\\l. \\ length Vs = length Ts; length vs = length Ts; final e \\ \\\n P \\ \\blocks(Vs,Ts,vs,e), (h,l)\\ \\* \\e, (h,l)\\\"\n(*<*)\nproof(induct Vs Ts vs e rule:blocks_induct)\n case 1\n show ?case using \"1.prems\" InitBlockReds[OF \"1.hyps\"]\n by(fastforce elim!:finalE elim: rtrancl_into_rtrancl[OF _ RedInitBlock]\n rtrancl_into_rtrancl[OF _ InitBlockThrow])\nqed auto\n(*>*)\n\n\nlemma blocksRedsFinal:\nassumes wf: \"length Vs = length Ts\" \"length vs = length Ts\" \"distinct Vs\"\n and reds: \"P \\ \\e, (h,l(Vs [\\] vs))\\ \\* \\e', (h',l')\\\"\n and fin: \"final e'\" and l'': \"l'' = override_on l' l (set Vs)\"\nshows \"P \\ \\blocks(Vs,Ts,vs,e), (h,l)\\ \\* \\e', (h',l'')\\\"\n(*<*)\nproof -\n let ?bv = \"blocks(Vs,Ts,map (the o l') Vs,e')\"\n have \"P \\ \\blocks(Vs,Ts,vs,e), (h,l)\\ \\* \\?bv, (h',l'')\\\"\n using l'' by simp (rule blocksReds[OF wf reds])\n also have \"P \\ \\?bv, (h',l'')\\ \\* \\e', (h',l'')\\\"\n using wf by(fastforce intro:blocksFinal fin)\n finally show ?thesis .\nqed\n(*>*)\n\ntext\\An now the actual method call reduction lemmas.\\\n\nlemma CallRedsObj:\n \"P \\ \\e,s\\ \\* \\e',s'\\ \\ P \\ \\e\\M(es),s\\ \\* \\e'\\M(es),s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) CallObj[OF step(2)]])\nqed\n(*>*)\n\n\nlemma CallRedsParams:\n \"P \\ \\es,s\\ [\\]* \\es',s'\\ \\ P \\ \\(Val v)\\M(es),s\\ \\* \\(Val v)\\M(es'),s'\\\"\n(*<*)\nproof(induct rule: rtrancl_induct2)\n case refl show ?case by blast\nnext\n case step show ?case\n by(rule rtrancl_into_rtrancl[OF step(3) CallParams[OF step(2)]])\nqed\n(*>*)\n\n\nlemma CallRedsFinal:\nassumes wwf: \"wwf_J_prog P\"\nand \"P \\ \\e,s\\<^sub>0\\ \\* \\addr a,s\\<^sub>1\\\"\n \"P \\ \\es,s\\<^sub>1\\ [\\]* \\map Val vs,(h\\<^sub>2,l\\<^sub>2)\\\"\n \"h\\<^sub>2 a = Some(C,fs)\" \"P \\ C sees M:Ts\\T = (pns,body) in D\"\n \"size vs = size pns\"\nand l\\<^sub>2': \"l\\<^sub>2' = [this \\ Addr a, pns[\\]vs]\"\nand body: \"P \\ \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\* \\ef,(h\\<^sub>3,l\\<^sub>3)\\\"\nand \"final ef\"\nshows \"P \\ \\e\\M(es), s\\<^sub>0\\ \\* \\ef,(h\\<^sub>3,l\\<^sub>2)\\\"\n(*<*)\nproof -\n have wf: \"size Ts = size pns \\ distinct pns \\ this \\ set pns\"\n and wt: \"fv body \\ {this} \\ set pns\"\n using assms by(fastforce dest!:sees_wf_mdecl simp:wf_mdecl_def)+\n from body[THEN Red_lcl_add, of l\\<^sub>2]\n have body': \"P \\ \\body,(h\\<^sub>2,l\\<^sub>2(this\\ Addr a, pns[\\]vs))\\ \\* \\ef,(h\\<^sub>3,l\\<^sub>2++l\\<^sub>3)\\\"\n by (simp add:l\\<^sub>2')\n have \"dom l\\<^sub>3 \\ {this} \\ set pns\"\n using Reds_dom_lcl[OF wwf body] wt l\\<^sub>2' set_take_subset by force\n hence eql\\<^sub>2: \"override_on (l\\<^sub>2++l\\<^sub>3) l\\<^sub>2 ({this} \\ set pns) = l\\<^sub>2\"\n by(fastforce simp add:map_add_def override_on_def fun_eq_iff)\n have \"P \\ \\e\\M(es),s\\<^sub>0\\ \\* \\(addr a)\\M(es),s\\<^sub>1\\\" by(rule CallRedsObj)(rule assms(2))\n also have \"P \\ \\(addr a)\\M(es),s\\<^sub>1\\ \\*\n \\(addr a)\\M(map Val vs),(h\\<^sub>2,l\\<^sub>2)\\\"\n by(rule CallRedsParams)(rule assms(3))\n also have \"P \\ \\(addr a)\\M(map Val vs), (h\\<^sub>2,l\\<^sub>2)\\ \\\n \\blocks(this#pns, Class D#Ts, Addr a#vs, body), (h\\<^sub>2,l\\<^sub>2)\\\"\n by(rule RedCall)(auto simp: assms wf, rule assms(5))\n also (rtrancl_into_rtrancl) have \"P \\ \\blocks(this#pns, Class D#Ts, Addr a#vs, body), (h\\<^sub>2,l\\<^sub>2)\\\n \\* \\ef,(h\\<^sub>3,override_on (l\\<^sub>2++l\\<^sub>3) l\\<^sub>2 ({this} \\ set pns))\\\"\n by(rule blocksRedsFinal, insert assms wf body', simp_all)\n finally show ?thesis using eql\\<^sub>2 by simp\nqed\n(*>*)\n\n\nlemma CallRedsThrowParams:\nassumes e_steps: \"P \\ \\e,s\\<^sub>0\\ \\* \\Val v,s\\<^sub>1\\\"\n and es_steps: \"P \\ \\es,s\\<^sub>1\\ [\\]* \\map Val vs\\<^sub>1 @ throw a # es\\<^sub>2,s\\<^sub>2\\\"\nshows \"P \\ \\e\\M(es),s\\<^sub>0\\ \\* \\throw a,s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(Val v\\M(es),s\\<^sub>1)\"\n let ?y' = \"(Val v\\M(map Val vs\\<^sub>1 @ throw a # es\\<^sub>2),s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule CallRedsObj[OF e_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule CallRedsParams[OF es_steps])\n also have \"(?y', ?z) \\ (red P)\\<^sup>*\" using CallThrowParams by fast\n ultimately show ?thesis by simp\nqed\n(*>*)\n\n\nlemma CallRedsThrowObj:\n \"P \\ \\e,s0\\ \\* \\throw a,s\\<^sub>1\\ \\ P \\ \\e\\M(es),s0\\ \\* \\throw a,s\\<^sub>1\\\"\n(*<*)by(rule CallRedsObj[THEN rtrancl_into_rtrancl, OF _ CallThrowObj])(*>*)\n\n\nlemma CallRedsNull:\nassumes e_steps: \"P \\ \\e,s\\<^sub>0\\ \\* \\null,s\\<^sub>1\\\"\n and es_steps: \"P \\ \\es,s\\<^sub>1\\ [\\]* \\map Val vs,s\\<^sub>2\\\"\nshows \"P \\ \\e\\M(es),s\\<^sub>0\\ \\* \\THROW NullPointer,s\\<^sub>2\\\"\n(*<*)(is \"(?x, ?z) \\ (red P)\\<^sup>*\")\nproof -\n let ?y = \"(null\\M(es),s\\<^sub>1)\"\n let ?y' = \"(null\\M(map Val vs),s\\<^sub>2)\"\n have \"(?x, ?y) \\ (red P)\\<^sup>*\" by(rule CallRedsObj[OF e_steps])\n also have \"(?y, ?y') \\ (red P)\\<^sup>*\" by(rule CallRedsParams[OF es_steps])\n also have \"(?y', ?z) \\ (red P)\" by(rule RedCallNull)\n ultimately show ?thesis by simp\nqed\n(*>*)\n\nsubsubsection \"The main Theorem\"\n\nlemma assumes wwf: \"wwf_J_prog P\"\nshows big_by_small: \"P \\ \\e,s\\ \\ \\e',s'\\ \\ P \\ \\e,s\\ \\* \\e',s'\\\"\nand bigs_by_smalls: \"P \\ \\es,s\\ [\\] \\es',s'\\ \\ P \\ \\es,s\\ [\\]* \\es',s'\\\"\n(*<*)\nproof (induct rule: eval_evals.inducts)\n case New thus ?case by (auto simp:RedNew)\nnext\n case NewFail thus ?case by (auto simp:RedNewFail)\nnext\n case Cast thus ?case by(fastforce intro:CastRedsAddr)\nnext\n case CastNull thus ?case by(simp add:CastRedsNull)\nnext\n case CastFail thus ?case by(fastforce intro!:CastRedsFail)\nnext\n case CastThrow thus ?case by(auto dest!:eval_final simp:CastRedsThrow)\nnext\n case Val thus ?case by simp\nnext\n case BinOp thus ?case by(auto simp:BinOpRedsVal)\nnext\n case BinOpThrow1 thus ?case by(auto dest!:eval_final simp: BinOpRedsThrow1)\nnext\n case BinOpThrow2 thus ?case by(auto dest!:eval_final simp: BinOpRedsThrow2)\nnext\n case Var thus ?case by (auto simp:RedVar)\nnext\n case LAss thus ?case by(auto simp: LAssRedsVal)\nnext\n case LAssThrow thus ?case by(auto dest!:eval_final simp: LAssRedsThrow)\nnext\n case FAcc thus ?case by(auto intro:FAccRedsVal)\nnext\n case FAccNull thus ?case by(simp add:FAccRedsNull)\nnext\n case FAccThrow thus ?case by(auto dest!:eval_final simp:FAccRedsThrow)\nnext\n case FAss thus ?case by(auto simp:FAssRedsVal)\nnext\n case FAssNull thus ?case by(auto simp:FAssRedsNull)\nnext\n case FAssThrow1 thus ?case by(auto dest!:eval_final simp:FAssRedsThrow1)\nnext\n case FAssThrow2 thus ?case by(auto dest!:eval_final simp:FAssRedsThrow2)\nnext\n case CallObjThrow thus ?case by(auto dest!:eval_final simp:CallRedsThrowObj)\nnext\n case CallNull thus ?case by(simp add:CallRedsNull)\nnext\n case CallParamsThrow thus ?case\n by(auto dest!:evals_final simp:CallRedsThrowParams)\nnext\n case (Call e s\\<^sub>0 a s\\<^sub>1 ps vs h\\<^sub>2 l\\<^sub>2 C fs M Ts T pns body D l\\<^sub>2' e' h\\<^sub>3 l\\<^sub>3)\n have IHe: \"P \\ \\e,s\\<^sub>0\\ \\* \\addr a,s\\<^sub>1\\\"\n and IHes: \"P \\ \\ps,s\\<^sub>1\\ [\\]* \\map Val vs,(h\\<^sub>2,l\\<^sub>2)\\\"\n and h\\<^sub>2a: \"h\\<^sub>2 a = Some(C,fs)\"\n and \"method\": \"P \\ C sees M:Ts\\T = (pns,body) in D\"\n and same_length: \"length vs = length pns\"\n and l\\<^sub>2': \"l\\<^sub>2' = [this \\ Addr a, pns[\\]vs]\"\n and eval_body: \"P \\ \\body,(h\\<^sub>2, l\\<^sub>2')\\ \\ \\e',(h\\<^sub>3, l\\<^sub>3)\\\"\n and IHbody: \"P \\ \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\* \\e',(h\\<^sub>3,l\\<^sub>3)\\\" by fact+\n show \"P \\ \\e\\M(ps),s\\<^sub>0\\ \\* \\e',(h\\<^sub>3, l\\<^sub>2)\\\"\n using \"method\" same_length l\\<^sub>2' h\\<^sub>2a IHbody eval_final[OF eval_body]\n by(fastforce intro:CallRedsFinal[OF wwf IHe IHes])\nnext\n case Block thus ?case by(auto simp: BlockRedsFinal dest:eval_final)\nnext\n case Seq thus ?case by(auto simp:SeqReds2)\nnext\n case SeqThrow thus ?case by(auto dest!:eval_final simp: SeqRedsThrow)\nnext\n case CondT thus ?case by(auto simp:CondReds2T)\nnext\n case CondF thus ?case by(auto simp:CondReds2F)\nnext\n case CondThrow thus ?case by(auto dest!:eval_final simp:CondRedsThrow)\nnext\n case WhileF thus ?case by(auto simp:WhileFReds)\nnext\n case WhileT thus ?case by(auto simp: WhileTReds)\nnext\n case WhileCondThrow thus ?case by(auto dest!:eval_final simp: WhileRedsThrow)\nnext\n case WhileBodyThrow thus ?case by(auto dest!:eval_final simp: WhileTRedsThrow)\nnext\n case Throw thus ?case by(auto simp:ThrowReds)\nnext\n case ThrowNull thus ?case by(auto simp:ThrowRedsNull)\nnext\n case ThrowThrow thus ?case by(auto dest!:eval_final simp:ThrowRedsThrow)\nnext\n case Try thus ?case by(simp add:TryRedsVal)\nnext\n case TryCatch thus ?case by(fast intro!: TryCatchRedsFinal dest!:eval_final)\nnext\n case TryThrow thus ?case by(fastforce intro!:TryRedsFail)\nnext\n case Nil thus ?case by simp\nnext\n case Cons thus ?case\n by(fastforce intro!:Cons_eq_appendI[OF refl refl] ListRedsVal)\nnext\n case ConsThrow thus ?case by(fastforce elim: ListReds1)\nqed\n(*>*)\n\n\nsubsection\\Big steps simulates small step\\\n\ntext\\This direction was carried out by Norbert Schirmer and Daniel\nWasserrab.\\\n\ntext \\The big step equivalent of \\RedWhile\\:\\ \n\nlemma unfold_while: \n \"P \\ \\while(b) c,s\\ \\ \\e',s'\\ = P \\ \\if(b) (c;;while(b) c) else (unit),s\\ \\ \\e',s'\\\"\n(*<*)\nproof\n assume \"P \\ \\while (b) c,s\\ \\ \\e',s'\\\"\n thus \"P \\ \\if (b) (c;; while (b) c) else unit,s\\ \\ \\e',s'\\\"\n by cases (fastforce intro: eval_evals.intros)+\nnext\n assume \"P \\ \\if (b) (c;; while (b) c) else unit,s\\ \\ \\e',s'\\\"\n thus \"P \\ \\while (b) c,s\\ \\ \\e',s'\\\"\n proof (cases)\n fix a\n assume e': \"e' = throw a\"\n assume \"P \\ \\b,s\\ \\ \\throw a,s'\\\" \n hence \"P \\ \\while(b) c,s\\ \\ \\throw a,s'\\\" by (rule WhileCondThrow)\n with e' show ?thesis by simp\n next\n fix s\\<^sub>1\n assume eval_false: \"P \\ \\b,s\\ \\ \\false,s\\<^sub>1\\\"\n and eval_unit: \"P \\ \\unit,s\\<^sub>1\\ \\ \\e',s'\\\"\n with eval_unit have \"s' = s\\<^sub>1\" \"e' = unit\" by (auto elim: eval_cases)\n moreover from eval_false have \"P \\ \\while (b) c,s\\ \\ \\unit,s\\<^sub>1\\\"\n by - (rule WhileF, simp)\n ultimately show ?thesis by simp\n next\n fix s\\<^sub>1\n assume eval_true: \"P \\ \\b,s\\ \\ \\true,s\\<^sub>1\\\"\n and eval_rest: \"P \\ \\c;; while (b) c,s\\<^sub>1\\\\\\e',s'\\\"\n from eval_rest show ?thesis\n proof (cases)\n fix s\\<^sub>2 v\\<^sub>1\n assume \"P \\ \\c,s\\<^sub>1\\ \\ \\Val v\\<^sub>1,s\\<^sub>2\\\" \"P \\ \\while (b) c,s\\<^sub>2\\ \\ \\e',s'\\\"\n with eval_true show \"P \\ \\while(b) c,s\\ \\ \\e',s'\\\" by (rule WhileT)\n next\n fix a\n assume \"P \\ \\c,s\\<^sub>1\\ \\ \\throw a,s'\\\" \"e' = throw a\"\n with eval_true show \"P \\ \\while(b) c,s\\ \\ \\e',s'\\\" \n by (iprover intro: WhileBodyThrow)\n qed\n qed\nqed\n(*>*)\n\n\nlemma blocksEval:\n \"\\Ts vs l l'. \\size ps = size Ts; size ps = size vs; P \\ \\blocks(ps,Ts,vs,e),(h,l)\\ \\ \\e',(h',l')\\ \\\n \\ \\ l''. P \\ \\e,(h,l(ps[\\]vs))\\ \\ \\e',(h',l'')\\\"\n(*<*)\nproof (induct ps)\n case Nil then show ?case by fastforce\nnext\n case (Cons p ps')\n have length_eqs: \"length (p # ps') = length Ts\" \n \"length (p # ps') = length vs\" by fact+\n then obtain T Ts' where Ts: \"Ts = T#Ts'\" by (cases \"Ts\") simp\n obtain v vs' where vs: \"vs = v#vs'\" using length_eqs by (cases \"vs\") simp\n have \"P \\ \\blocks (p # ps', Ts, vs, e),(h,l)\\ \\ \\e',(h', l')\\\" by fact\n with Ts vs \n have \"P \\ \\{p:T := Val v; blocks (ps', Ts', vs', e)},(h,l)\\ \\ \\e',(h', l')\\\"\n by simp\n then obtain l''' where\n eval_ps': \"P \\ \\blocks (ps', Ts', vs', e),(h, l(p\\v))\\ \\ \\e',(h', l''')\\\"\n and l''': \"l'=l'''(p:=l p)\"\n by (auto elim!: eval_cases)\n then obtain l'' where \n hyp: \"P \\ \\e,(h, l(p\\v, ps'[\\]vs'))\\ \\ \\e',(h', l'')\\\"\n using length_eqs Ts vs Cons.hyps [OF _ _ eval_ps'] by auto\n from hyp\n show \"\\l''. P \\ \\e,(h, l(p # ps'[\\]vs))\\ \\ \\e',(h', l'')\\\"\n using Ts vs by auto\nqed\n(*>*)\n(* FIXME exercise: show precise relationship between l' and l'':\nlemma blocksEval:\n \"\\ Ts vs l l'. \\length ps = length Ts; length ps = length vs; \n P\\ \\blocks(ps,Ts,vs,e),(h,l)\\ \\ \\e',(h',l')\\ \\\n \\ \\ l''. P \\ \\e,(h,l(ps[\\]vs))\\ \\ \\e',(h',l'')\\ \\ l'=l''(l|set ps)\"\nproof (induct ps)\n case Nil then show ?case by simp\nnext\n case (Cons p ps')\n have length_eqs: \"length (p # ps') = length Ts\" \n \"length (p # ps') = length vs\" .\n then obtain T Ts' where Ts: \"Ts=T#Ts'\" by (cases \"Ts\") simp\n obtain v vs' where vs: \"vs=v#vs'\" using length_eqs by (cases \"vs\") simp\n have \"P \\ \\blocks (p # ps', Ts, vs, e),(h,l)\\ \\ \\e',(h', l')\\\".\n with Ts vs \n have \"P \\ \\{p:T := Val v; blocks (ps', Ts', vs', e)},(h,l)\\ \\ \\e',(h', l')\\\"\n by simp\n then obtain l''' where\n eval_ps': \"P \\ \\blocks (ps', Ts', vs', e),(h, l(p\\v))\\ \\ \\e',(h', l''')\\\"\n and l''': \"l'=l'''(p:=l p)\"\n by (cases) (auto elim: eval_cases)\n \n then obtain l'' where \n hyp: \"P \\ \\e,(h, l(p\\v)(ps'[\\]vs'))\\ \\ \\e',(h', l'')\\\" and\n l'': \"l''' = l''(l(p\\v)|set ps')\"\n using length_eqs Ts vs Cons.hyps [OF _ _ eval_ps'] by auto\n have \"l' = l''(l|set (p # ps'))\"\n proof -\n have \"(l''(l(p\\v)|set ps'))(p := l p) = l''(l|insert p (set ps'))\"\n by (induct ps') (auto intro: ext simp add: fun_upd_def override_on_def)\n with l''' l'' show ?thesis by simp\n qed\n with hyp\n show \"\\l''. P \\ \\e,(h, l(p # ps'[\\]vs))\\ \\ \\e',(h', l'')\\ \\\n l' = l''(l|set (p # ps'))\"\n using Ts vs by auto\nqed\n*)\n\nlemma\nassumes wf: \"wwf_J_prog P\"\nshows eval_restrict_lcl:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ (\\W. fv e \\ W \\ P \\ \\e,(h,l|`W)\\ \\ \\e',(h',l'|`W)\\)\"\nand \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ (\\W. fvs es \\ W \\ P \\ \\es,(h,l|`W)\\ [\\] \\es',(h',l'|`W)\\)\"\n(*<*)\nproof(induct rule:eval_evals_inducts)\n case (Block e\\<^sub>0 h\\<^sub>0 l\\<^sub>0 V e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 T)\n have IH: \"\\W. fv e\\<^sub>0 \\ W \\ P \\ \\e\\<^sub>0,(h\\<^sub>0,l\\<^sub>0(V:=None)|`W)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,l\\<^sub>1|`W)\\\" by fact\n have \"fv({V:T; e\\<^sub>0}) \\ W\" by fact+\n hence \"fv e\\<^sub>0 - {V} \\ W\" by simp_all\n hence \"fv e\\<^sub>0 \\ insert V W\" by fast\n from IH[OF this]\n have \"P \\ \\e\\<^sub>0,(h\\<^sub>0, (l\\<^sub>0|`W)(V := None))\\ \\ \\e\\<^sub>1,(h\\<^sub>1, l\\<^sub>1|`insert V W)\\\"\n by fastforce\n from eval_evals.Block[OF this] show ?case by fastforce\nnext\n case Seq thus ?case by simp (blast intro:eval_evals.Seq)\nnext\n case New thus ?case by(simp add:eval_evals.intros)\nnext\n case NewFail thus ?case by(simp add:eval_evals.intros)\nnext\n case Cast thus ?case by simp (blast intro:eval_evals.Cast)\nnext\n case CastNull thus ?case by simp (blast intro:eval_evals.CastNull)\nnext\n case CastFail thus ?case by simp (blast intro:eval_evals.CastFail)\nnext\n case CastThrow thus ?case by(simp add:eval_evals.intros)\nnext\n case Val thus ?case by(simp add:eval_evals.intros)\nnext\n case BinOp thus ?case by simp (blast intro:eval_evals.BinOp)\nnext\n case BinOpThrow1 thus ?case by simp (blast intro:eval_evals.BinOpThrow1)\nnext\n case BinOpThrow2 thus ?case by simp (blast intro:eval_evals.BinOpThrow2)\nnext\n case Var thus ?case by(simp add:eval_evals.intros)\nnext\n case (LAss e h\\<^sub>0 l\\<^sub>0 v h l l' V)\n have IH: \"\\W. fv e \\ W \\ P \\ \\e,(h\\<^sub>0,l\\<^sub>0|`W)\\ \\ \\Val v,(h,l|`W)\\\"\n and [simp]: \"l' = l(V \\ v)\" by fact+\n have \"fv (V:=e) \\ W\" by fact\n hence fv: \"fv e \\ W\" and VinW: \"V \\ W\" by auto\n from eval_evals.LAss[OF IH[OF fv] refl, of V] VinW\n show ?case by simp\nnext\n case LAssThrow thus ?case by(fastforce intro: eval_evals.LAssThrow)\nnext\n case FAcc thus ?case by simp (blast intro: eval_evals.FAcc)\nnext\n case FAccNull thus ?case by(fastforce intro: eval_evals.FAccNull)\nnext\n case FAccThrow thus ?case by(fastforce intro: eval_evals.FAccThrow)\nnext\n case FAss thus ?case by simp (blast intro: eval_evals.FAss)\nnext\n case FAssNull thus ?case by simp (blast intro: eval_evals.FAssNull)\nnext\n case FAssThrow1 thus ?case by simp (blast intro: eval_evals.FAssThrow1)\nnext\n case FAssThrow2 thus ?case by simp (blast intro: eval_evals.FAssThrow2)\nnext\n case CallObjThrow thus ?case by simp (blast intro: eval_evals.intros)\nnext\n case CallNull thus ?case by simp (blast intro: eval_evals.CallNull)\nnext\n case CallParamsThrow thus ?case\n by simp (blast intro: eval_evals.CallParamsThrow)\nnext\n case (Call e h\\<^sub>0 l\\<^sub>0 a h\\<^sub>1 l\\<^sub>1 ps vs h\\<^sub>2 l\\<^sub>2 C fs M Ts T pns body\n D l\\<^sub>2' e' h\\<^sub>3 l\\<^sub>3)\n have IHe: \"\\W. fv e \\ W \\ P \\ \\e,(h\\<^sub>0,l\\<^sub>0|`W)\\ \\ \\addr a,(h\\<^sub>1,l\\<^sub>1|`W)\\\"\n and IHps: \"\\W. fvs ps \\ W \\ P \\ \\ps,(h\\<^sub>1,l\\<^sub>1|`W)\\ [\\] \\map Val vs,(h\\<^sub>2,l\\<^sub>2|`W)\\\"\n and IHbd: \"\\W. fv body \\ W \\ P \\ \\body,(h\\<^sub>2,l\\<^sub>2'|`W)\\ \\ \\e',(h\\<^sub>3,l\\<^sub>3|`W)\\\"\n and h\\<^sub>2a: \"h\\<^sub>2 a = Some (C, fs)\"\n and \"method\": \"P \\ C sees M: Ts\\T = (pns, body) in D\"\n and same_len: \"size vs = size pns\"\n and l\\<^sub>2': \"l\\<^sub>2' = [this \\ Addr a, pns [\\] vs]\" by fact+\n have \"fv (e\\M(ps)) \\ W\" by fact\n hence fve: \"fv e \\ W\" and fvps: \"fvs(ps) \\ W\" by auto\n have wfmethod: \"size Ts = size pns \\ this \\ set pns\" and\n fvbd: \"fv body \\ {this} \\ set pns\"\n using \"method\" wf by(fastforce dest!:sees_wf_mdecl simp:wf_mdecl_def)+\n show ?case\n using IHbd[OF fvbd] l\\<^sub>2' same_len wfmethod h\\<^sub>2a\n eval_evals.Call[OF IHe[OF fve] IHps[OF fvps] _ \"method\" same_len l\\<^sub>2']\n by (simp add:subset_insertI)\nnext\n case SeqThrow thus ?case by simp (blast intro: eval_evals.SeqThrow)\nnext\n case CondT thus ?case by simp (blast intro: eval_evals.CondT)\nnext\n case CondF thus ?case by simp (blast intro: eval_evals.CondF)\nnext\n case CondThrow thus ?case by simp (blast intro: eval_evals.CondThrow)\nnext\n case WhileF thus ?case by simp (blast intro: eval_evals.WhileF)\nnext\n case WhileT thus ?case by simp (blast intro: eval_evals.WhileT)\nnext\n case WhileCondThrow thus ?case by simp (blast intro: eval_evals.WhileCondThrow)\nnext\n case WhileBodyThrow thus ?case by simp (blast intro: eval_evals.WhileBodyThrow)\nnext\n case Throw thus ?case by simp (blast intro: eval_evals.Throw)\nnext\n case ThrowNull thus ?case by simp (blast intro: eval_evals.ThrowNull)\nnext\n case ThrowThrow thus ?case by simp (blast intro: eval_evals.ThrowThrow)\nnext\n case Try thus ?case by simp (blast intro: eval_evals.Try)\nnext\n case (TryCatch e\\<^sub>1 h\\<^sub>0 l\\<^sub>0 a h\\<^sub>1 l\\<^sub>1 D fs C e\\<^sub>2 V e\\<^sub>2' h\\<^sub>2 l\\<^sub>2)\n have IH\\<^sub>1: \"\\W. fv e\\<^sub>1 \\ W \\ P \\ \\e\\<^sub>1,(h\\<^sub>0,l\\<^sub>0|`W)\\ \\ \\Throw a,(h\\<^sub>1,l\\<^sub>1|`W)\\\"\n and IH\\<^sub>2: \"\\W. fv e\\<^sub>2 \\ W \\ P \\ \\e\\<^sub>2,(h\\<^sub>1,l\\<^sub>1(V\\Addr a)|`W)\\ \\ \\e\\<^sub>2',(h\\<^sub>2,l\\<^sub>2|`W)\\\"\n and lookup: \"h\\<^sub>1 a = Some(D, fs)\" and subtype: \"P \\ D \\\\<^sup>* C\" by fact+\n have \"fv (try e\\<^sub>1 catch(C V) e\\<^sub>2) \\ W\" by fact\n hence fv\\<^sub>1: \"fv e\\<^sub>1 \\ W\" and fv\\<^sub>2: \"fv e\\<^sub>2 \\ insert V W\" by auto\n have IH\\<^sub>2': \"P \\ \\e\\<^sub>2,(h\\<^sub>1,(l\\<^sub>1|`W)(V \\ Addr a))\\ \\ \\e\\<^sub>2',(h\\<^sub>2,l\\<^sub>2|`insert V W)\\\"\n using IH\\<^sub>2[OF fv\\<^sub>2] fun_upd_restrict[of l\\<^sub>1 W] (*FIXME just l|W instead of l|(W-V) in simp rule??*) by simp\n with eval_evals.TryCatch[OF IH\\<^sub>1[OF fv\\<^sub>1] _ subtype IH\\<^sub>2'] lookup\n show ?case by fastforce\nnext\n case TryThrow thus ?case by simp (blast intro: eval_evals.TryThrow)\nnext\n case Nil thus ?case by (simp add: eval_evals.Nil)\nnext\n case Cons thus ?case by simp (blast intro: eval_evals.Cons)\nnext\n case ConsThrow thus ?case by simp (blast intro: eval_evals.ConsThrow)\nqed\n(*>*)\n\n\nlemma eval_notfree_unchanged:\n \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ (\\V. V \\ fv e \\ l' V = l V)\"\nand \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ (\\V. V \\ fvs es \\ l' V = l V)\"\n(*<*)\nproof(induct rule:eval_evals_inducts)\n case LAss thus ?case by(simp add:fun_upd_apply)\nnext\n case Block thus ?case\n by (simp only:fun_upd_apply split:if_splits) fastforce\nnext\n case TryCatch thus ?case\n by (simp only:fun_upd_apply split:if_splits) fastforce\nqed simp_all\n(*>*)\n\n\nlemma eval_closed_lcl_unchanged:\n \"\\ P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\; fv e = {} \\ \\ l' = l\"\n(*<*)by(fastforce dest:eval_notfree_unchanged simp add:fun_eq_iff [where 'b=\"val option\"])(*>*)\n\n\nlemma list_eval_Throw: \nassumes eval_e: \"P \\ \\throw x,s\\ \\ \\e',s'\\\"\nshows \"P \\ \\map Val vs @ throw x # es',s\\ [\\] \\map Val vs @ e' # es',s'\\\"\n(*<*)\nproof -\n from eval_e \n obtain a where e': \"e' = Throw a\"\n by (cases) (auto dest!: eval_final)\n {\n fix es\n have \"\\vs. es = map Val vs @ throw x # es' \n \\ P \\ \\es,s\\[\\]\\map Val vs @ e' # es',s'\\\"\n proof (induct es type: list)\n case Nil thus ?case by simp\n next\n case (Cons e es vs)\n have e_es: \"e # es = map Val vs @ throw x # es'\" by fact\n show \"P \\ \\e # es,s\\ [\\] \\map Val vs @ e' # es',s'\\\"\n proof (cases vs)\n case Nil\n with e_es obtain \"e=throw x\" \"es=es'\" by simp\n moreover from eval_e e'\n have \"P \\ \\throw x # es,s\\ [\\] \\Throw a # es,s'\\\"\n by (iprover intro: ConsThrow)\n ultimately show ?thesis using Nil e' by simp\n next\n case (Cons v vs')\n have vs: \"vs = v # vs'\" by fact\n with e_es obtain \n e: \"e=Val v\" and es:\"es= map Val vs' @ throw x # es'\"\n by simp\n from e \n have \"P \\ \\e,s\\ \\ \\Val v,s\\\"\n by (iprover intro: eval_evals.Val)\n moreover from es \n have \"P \\ \\es,s\\ [\\] \\map Val vs' @ e' # es',s'\\\"\n by (rule Cons.hyps)\n ultimately show \n \"P \\ \\e#es,s\\ [\\] \\map Val vs @ e' # es',s'\\\"\n using vs by (auto intro: eval_evals.Cons)\n qed\n qed\n }\n thus ?thesis\n by simp\nqed\n(*>*)\n(* Hiermit kann man die ganze pair-Splitterei in den automatischen Taktiken\nabschalten. Wieder anschalten siehe nach dem Beweis. *)\n(*<*)\ndeclare split_paired_All [simp del] split_paired_Ex [simp del]\n(*>*)\n(* FIXME\n exercise 1: define a big step semantics where the body of a procedure can\n access not juts this and pns but all of the enclosing l. What exactly is fed\n in? What exactly is returned at the end? Notion: \"dynamic binding\"\n\n excercise 2: the semantics of exercise 1 is closer to the small step\n semantics. Reformulate equivalence proof by modifying call lemmas.\n*)\ntext \\The key lemma:\\\n\nlemma\nassumes wf: \"wwf_J_prog P\"\nshows extend_1_eval:\n \"P \\ \\e,s\\ \\ \\e'',s''\\ \\ (\\s' e'. P \\ \\e'',s''\\ \\ \\e',s'\\ \\ P \\ \\e,s\\ \\ \\e',s'\\)\"\nand extend_1_evals:\n \"P \\ \\es,t\\ [\\] \\es'',t''\\ \\ (\\t' es'. P \\ \\es'',t''\\ [\\] \\es',t'\\ \\ P \\ \\es,t\\ [\\] \\es',t'\\)\"\n(*<*)\nproof (induct rule: red_reds.inducts)\n case (RedCall s a C fs M Ts T pns body D vs s' e')\n have \"P \\ \\addr a,s\\ \\ \\addr a,s\\\" by (rule eval_evals.intros)\n moreover\n have finals: \"finals(map Val vs)\" by simp\n obtain h\\<^sub>2 l\\<^sub>2 where s: \"s = (h\\<^sub>2,l\\<^sub>2)\" by (cases s)\n with finals have \"P \\ \\map Val vs,s\\ [\\] \\map Val vs,(h\\<^sub>2,l\\<^sub>2)\\\"\n by (iprover intro: eval_finalsId)\n moreover from s have \"h\\<^sub>2 a = Some (C, fs)\" using RedCall by simp\n moreover have \"method\": \"P \\ C sees M: Ts\\T = (pns, body) in D\" by fact\n moreover have same_len\\<^sub>1: \"length Ts = length pns\"\n and this_distinct: \"this \\ set pns\" and fv: \"fv body \\ {this} \\ set pns\"\n using \"method\" wf by (fastforce dest!:sees_wf_mdecl simp:wf_mdecl_def)+\n have same_len: \"length vs = length pns\" by fact\n moreover\n obtain l\\<^sub>2' where l\\<^sub>2': \"l\\<^sub>2' = [this\\Addr a,pns[\\]vs]\" by simp\n moreover\n obtain h\\<^sub>3 l\\<^sub>3 where s': \"s' = (h\\<^sub>3,l\\<^sub>3)\" by (cases s')\n have eval_blocks:\n \"P \\ \\blocks (this # pns, Class D # Ts, Addr a # vs, body),s\\ \\ \\e',s'\\\" by fact\n hence id: \"l\\<^sub>3 = l\\<^sub>2\" using fv s s' same_len\\<^sub>1 same_len\n by(fastforce elim: eval_closed_lcl_unchanged)\n from eval_blocks obtain l\\<^sub>3' where \"P \\ \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,l\\<^sub>3')\\\"\n proof -\n from same_len\\<^sub>1 have \"length(this#pns) = length(Class D#Ts)\" by simp\n moreover from same_len\\<^sub>1 same_len\n have \"length (this#pns) = length (Addr a#vs)\" by simp\n moreover from eval_blocks\n have \"P \\ \\blocks (this#pns,Class D#Ts,Addr a#vs,body),(h\\<^sub>2,l\\<^sub>2)\\\n \\\\e',(h\\<^sub>3,l\\<^sub>3)\\\" using s s' by simp\n ultimately obtain l''\n where \"P \\ \\body,(h\\<^sub>2,l\\<^sub>2(this # pns[\\]Addr a # vs))\\\\\\e',(h\\<^sub>3, l'')\\\"\n by (blast dest:blocksEval)\n from eval_restrict_lcl[OF wf this fv] this_distinct same_len\\<^sub>1 same_len\n have \"P \\ \\body,(h\\<^sub>2,[this # pns[\\]Addr a # vs])\\ \\\n \\e',(h\\<^sub>3, l''|`(set(this#pns)))\\\"\n by(simp add:subset_insert_iff insert_Diff_if)\n thus ?thesis by(fastforce intro!:that simp add: l\\<^sub>2')\n qed\n ultimately\n have \"P \\ \\(addr a)\\M(map Val vs),s\\ \\ \\e',(h\\<^sub>3,l\\<^sub>2)\\\" by (rule Call)\n with s' id show ?case by simp\nnext\n case RedNew\n thus ?case\n by (iprover elim: eval_cases intro: eval_evals.intros)\nnext\n case RedNewFail\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (CastRed e s e'' s'' C s' e')\n thus ?case\n by(cases s, cases s') (erule eval_cases, auto intro: eval_evals.intros)\nnext\n case RedCastNull\n thus ?case\n by (iprover elim: eval_cases intro: eval_evals.intros)\nnext\n case (RedCast s a D fs C s'' e'')\n thus ?case\n by (cases s) (auto elim: eval_cases intro: eval_evals.intros)\nnext\n case (RedCastFail s a D fs C s'' e'')\n thus ?case\n by (cases s) (auto elim!: eval_cases intro: eval_evals.intros)\nnext\n case (BinOpRed1 e s e' s' bop e\\<^sub>2 s'' e')\n thus ?case\n by (cases s'')(erule eval_cases,auto intro: eval_evals.intros)\nnext\n case BinOpRed2\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros eval_finalId)\nnext\n case RedBinOp\n thus ?case\n by (iprover elim: eval_cases intro: eval_evals.intros)\nnext\n case (RedVar s V v s' e')\n thus ?case\n by (cases s)(fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (LAssRed e s e' s' V s'')\n thus ?case\n by (cases s'')(erule eval_cases,auto intro: eval_evals.intros)\nnext\n case RedLAss\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (FAccRed e s e' s' F D s'')\n thus ?case\n by (cases s'')(erule eval_cases,auto intro: eval_evals.intros)\nnext\n case (RedFAcc s a C fs F D v s' e')\n thus ?case\n by (cases s)(fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedFAccNull\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros)\nnext\n case (FAssRed1 e s e' s'' F D e\\<^sub>2 s' e')\n thus ?case\n by (cases s')(erule eval_cases, auto intro: eval_evals.intros)\nnext\n case (FAssRed2 e s e' s'' v F D s' e')\n thus ?case\n by (cases s)\n (fastforce elim!: eval_cases intro: eval_evals.intros eval_finalId)\nnext\n case RedFAss\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros)\nnext\n case RedFAssNull\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros)\nnext\n case CallObj\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros)\nnext\n case CallParams\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros eval_finalId)\nnext\n case RedCallNull\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros eval_finalsId)\nnext\n case InitBlockRed\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros eval_finalId\n simp add: map_upd_triv fun_upd_same)\nnext\n case (RedInitBlock V T v u s s' e')\n have \"P \\ \\Val u,s\\ \\ \\e',s'\\\" by fact\n then obtain s': \"s'=s\" and e': \"e'=Val u\" by cases simp\n obtain h l where s: \"s=(h,l)\" by (cases s)\n have \"P \\ \\{V:T :=Val v; Val u},(h,l)\\ \\ \\Val u,(h, (l(V\\v))(V:=l V))\\\"\n by (fastforce intro!: eval_evals.intros)\n thus \"P \\ \\{V:T := Val v; Val u},s\\ \\ \\e',s'\\\"\n using s s' e' by simp\nnext\n case BlockRedNone\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros \n simp add: fun_upd_same fun_upd_idem)\nnext\n case BlockRedSome\n thus ?case\n by (fastforce elim!: eval_cases intro: eval_evals.intros \n simp add: fun_upd_same fun_upd_idem)\nnext\n case (RedBlock V T v s s' e') \n have \"P \\ \\Val v,s\\ \\ \\e',s'\\\" by fact\n then obtain s': \"s'=s\" and e': \"e'=Val v\" \n by cases simp\n obtain h l where s: \"s=(h,l)\" by (cases s)\n have \"P \\ \\Val v,(h,l(V:=None))\\ \\ \\Val v,(h,l(V:=None))\\\" \n by (rule eval_evals.intros)\n hence \"P \\ \\{V:T;Val v},(h,l)\\ \\ \\Val v,(h,(l(V:=None))(V:=l V))\\\"\n by (rule eval_evals.Block)\n thus \"P \\ \\{V:T; Val v},s\\ \\ \\e',s'\\\"\n using s s' e'\n by simp\nnext\n case SeqRed\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedSeq\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case CondRed\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedCondT\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedCondF\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedWhile\n thus ?case\n by (auto simp add: unfold_while intro:eval_evals.intros elim:eval_cases)\nnext\n case ThrowRed\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedThrowNull\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (TryRed e s e' s' C V e\\<^sub>2 s'' e')\n thus ?case\n by (cases s, cases s'', auto elim!: eval_cases intro: eval_evals.intros)\nnext\n case RedTry\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case RedTryCatch\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (RedTryFail s a D fs C V e\\<^sub>2 s' e')\n thus ?case\n by (cases s)(auto elim!: eval_cases intro: eval_evals.intros)\nnext\n case ListRed1\n thus ?case\n by (fastforce elim: evals_cases intro: eval_evals.intros)\nnext\n case ListRed2\n thus ?case\n by (fastforce elim!: evals_cases eval_cases \n intro: eval_evals.intros eval_finalId)\nnext\n case CastThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case BinOpThrow1\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case BinOpThrow2\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case LAssThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case FAccThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case FAssThrow1\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case FAssThrow2\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case CallThrowObj\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case (CallThrowParams es vs e es' v M s s' e')\n have \"P \\ \\Val v,s\\ \\ \\Val v,s\\\" by (rule eval_evals.intros)\n moreover\n have es: \"es = map Val vs @ throw e # es'\" by fact\n have eval_e: \"P \\ \\throw e,s\\ \\ \\e',s'\\\" by fact\n then obtain xa where e': \"e' = Throw xa\" by (cases) (auto dest!: eval_final)\n with list_eval_Throw [OF eval_e] es\n have \"P \\ \\es,s\\ [\\] \\map Val vs @ Throw xa # es',s'\\\" by simp\n ultimately have \"P \\ \\Val v\\M(es),s\\ \\ \\Throw xa,s'\\\"\n by (rule eval_evals.CallParamsThrow)\n thus ?case using e' by simp\nnext\n case (InitBlockThrow V T v a s s' e')\n have \"P \\ \\Throw a,s\\ \\ \\e',s'\\\" by fact\n then obtain s': \"s' = s\" and e': \"e' = Throw a\"\n by cases (auto elim!:eval_cases)\n obtain h l where s: \"s = (h,l)\" by (cases s)\n have \"P \\ \\{V:T :=Val v; Throw a},(h,l)\\ \\ \\Throw a, (h, (l(V\\v))(V:=l V))\\\"\n by(fastforce intro:eval_evals.intros)\n thus \"P \\ \\{V:T := Val v; Throw a},s\\ \\ \\e',s'\\\" using s s' e' by simp\nnext\n case (BlockThrow V T a s s' e')\n have \"P \\ \\Throw a, s\\ \\ \\e',s'\\\" by fact\n then obtain s': \"s' = s\" and e': \"e' = Throw a\"\n by cases (auto elim!:eval_cases)\n obtain h l where s: \"s=(h,l)\" by (cases s)\n have \"P \\ \\Throw a, (h,l(V:=None))\\ \\ \\Throw a, (h,l(V:=None))\\\"\n by (simp add:eval_evals.intros eval_finalId)\n hence \"P\\\\{V:T;Throw a},(h,l)\\\\\\Throw a, (h,(l(V:=None))(V:=l V))\\\"\n by (rule eval_evals.Block)\n thus \"P \\ \\{V:T; Throw a},s\\ \\ \\e',s'\\\" using s s' e' by simp\nnext\n case SeqThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case CondThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nnext\n case ThrowThrow\n thus ?case\n by (fastforce elim: eval_cases intro: eval_evals.intros)\nqed\n(*>*)\n(*<*)\n(* ... und wieder anschalten: *)\ndeclare split_paired_All [simp] split_paired_Ex [simp]\n(*>*)\n\ntext \\Its extension to \\\\*\\:\\ \n\nlemma extend_eval:\nassumes wf: \"wwf_J_prog P\"\nand reds: \"P \\ \\e,s\\ \\* \\e'',s''\\\" and eval_rest: \"P \\ \\e'',s''\\ \\ \\e',s'\\\"\nshows \"P \\ \\e,s\\ \\ \\e',s'\\\"\n(*<*)\nusing reds eval_rest\nproof (induct rule: converse_rtrancl_induct2)\n case refl then show ?case by simp\nnext\n case step\n show ?case using step extend_1_eval[OF wf step.hyps(1)] by simp\nqed\n(*>*)\n\n\nlemma extend_evals:\nassumes wf: \"wwf_J_prog P\"\nand reds: \"P \\ \\es,s\\ [\\]* \\es'',s''\\\" and eval_rest: \"P \\ \\es'',s''\\ [\\] \\es',s'\\\"\nshows \"P \\ \\es,s\\ [\\] \\es',s'\\\"\n(*<*)\nusing reds eval_rest\nproof (induct rule: converse_rtrancl_induct2)\n case refl then show ?case by simp\nnext\n case step\n show ?case using step extend_1_evals[OF wf step.hyps(1)] by simp\nqed\n(*>*)\n\ntext \\Finally, small step semantics can be simulated by big step semantics:\n\\\n\ntheorem\nassumes wf: \"wwf_J_prog P\"\nshows small_by_big: \"\\P \\ \\e,s\\ \\* \\e',s'\\; final e'\\ \\ P \\ \\e,s\\ \\ \\e',s'\\\"\nand \"\\P \\ \\es,s\\ [\\]* \\es',s'\\; finals es'\\ \\ P \\ \\es,s\\ [\\] \\es',s'\\\"\n(*<*)\nproof -\n note wf \n moreover assume \"P \\ \\e,s\\ \\* \\e',s'\\\"\n moreover assume \"final e'\"\n then have \"P \\ \\e',s'\\ \\ \\e',s'\\\"\n by (rule eval_finalId)\n ultimately show \"P \\ \\e,s\\\\\\e',s'\\\"\n by (rule extend_eval)\nnext\n note wf \n moreover assume \"P \\ \\es,s\\ [\\]* \\es',s'\\\"\n moreover assume \"finals es'\"\n then have \"P \\ \\es',s'\\ [\\] \\es',s'\\\"\n by (rule eval_finalsId)\n ultimately show \"P \\ \\es,s\\ [\\] \\es',s'\\\"\n by (rule extend_evals)\nqed\n(*>*)\n\nsubsection \"Equivalence\"\n\ntext\\And now, the crowning achievement:\\\n\ncorollary big_iff_small:\n \"wwf_J_prog P \\\n P \\ \\e,s\\ \\ \\e',s'\\ = (P \\ \\e,s\\ \\* \\e',s'\\ \\ final e')\"\n(*<*)by(blast dest: big_by_small eval_final small_by_big)(*>*)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Jinja/J/Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.2693111250282043}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Recycle_C\nimports Delete_C Retype_C\nbegin\n\ncontext kernel_m\nbegin\n\ndefinition\n \"replicateHider \\ replicate\"\n\nlemma collapse_foldl_replicate:\n \"replicate (length xs) v = xs \\\n foldl (@) [] (map (\\_. xs) ys)\n = replicateHider (length xs * length ys) v\"\n apply (induct ys rule: rev_induct)\n apply (simp add: replicateHider_def)\n apply (simp add: replicateHider_def)\n apply (subst add.commute, simp add: replicate_add)\n done\n\nlemma coerce_memset_to_heap_update_user_data:\n \"heap_update_list x (replicateHider 4096 0)\n = heap_update (Ptr x :: user_data_C ptr)\n (user_data_C (FCP (\\_. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps user_data_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps\n user_context_C_tag_def thread_state_C_tag_def seL4_Fault_C_tag_def\n lookup_fault_C_tag_def update_ti_t_ptr_0s\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n align_td_array' size_td_array)\n apply (simp add: typ_info_array')\n apply (subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: typ_info_word typ_info_ptr word_rsplit_0)\n apply fastforce\n apply (simp add: collapse_foldl_replicate word_bits_def)\n done\n\nlemma clift_foldl_hrs_mem_update:\n \"\\ \\x \\ set xs. hrs_htd s \\\\<^sub>t f x;\n \\x s. hrs_htd s \\\\<^sub>t f x \\ clift (hrs_mem_update (heap_update (f x) v) s)\n = g (clift s :: ('a :: c_type) ptr \\ 'a) x \\\n \\\n clift (hrs_mem_update (\\s. foldl (\\s x. heap_update (f x) v s) s xs) s)\n = foldl g (clift s :: 'a ptr \\ 'a) xs\"\n using [[hypsubst_thin]]\n apply (cases s, clarsimp)\n apply (induct xs arbitrary: a b)\n apply (simp add: hrs_mem_update_def)\n apply (clarsimp simp add: hrs_mem_update_def split_def hrs_htd_def)\n done\n\nlemma map_to_user_data_aligned:\n \"\\ map_to_user_data (ksPSpace s) x = Some y; pspace_aligned' s \\\n \\ is_aligned x pageBits\"\n apply (clarsimp simp: map_comp_eq projectKOs split: option.split_asm)\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps)\n done\n\nlemma help_force_intvl_range_conv:\n \"\\ is_aligned (p::word32) n; v = 2 ^ n; n < word_bits \\\n \\ {p ..+ v} = {p .. p + 2 ^ n - 1}\"\n by (simp add: intvl_range_conv word_bits_def)\n\nlemma cmap_relation_If_upd:\n \"\\ cmap_relation f g ptrfun rel; rel v v'; ptrfun ` S = S'; inj ptrfun \\\n \\ cmap_relation (\\x. if x \\ S then Some v else f x)\n (\\y. if y \\ S' then Some v' else g y)\n ptrfun rel\"\n apply (simp add: cmap_relation_def dom_If_Some)\n apply (rule context_conjI)\n apply blast\n apply clarsimp\n apply (case_tac \"x \\ S\")\n apply simp\n apply clarsimp\n apply (subst if_not_P)\n apply (clarsimp simp: inj_eq)\n apply (drule bspec, erule domI)\n apply simp\n done\n\nlemma length_replicateHider [simp]:\n \"length (replicateHider n x) = n\"\n by (simp add: replicateHider_def)\n\nlemma coerce_heap_update_to_heap_updates':\n \"n = chunk * m \\\n heap_update_list x (replicateHider n 0)\n = (\\s. foldl (\\s x. heap_update_list x (replicateHider chunk 0) s) s\n (map (\\n. x + (of_nat n * of_nat chunk)) [0 ..< m]))\"\n using [[hypsubst_thin]]\n apply clarsimp\n apply (induct m arbitrary: x)\n apply (rule ext, simp)\n apply (simp add: replicateHider_def)\n apply (rule ext)\n apply (simp only: map_upt_unfold map_Suc_upt[symmetric])\n apply (simp add: replicate_add[folded replicateHider_def]\n heap_update_list_concat_unfold\n o_def field_simps\n length_replicate[folded replicateHider_def])\n done\n\nlemma h_t_valid_dom_s:\n \"\\ h_t_valid htd c_guard p; x = ptr_val (p :: ('a :: mem_type) ptr);\n n = size_of TYPE ('a) \\\n \\ {x ..+ n} \\ {SIndexVal, SIndexTyp 0} \\ dom_s htd\"\n apply (clarsimp simp: h_t_valid_def valid_footprint_def Let_def\n intvl_def)\n apply (drule_tac x=k in spec, simp add: size_of_def)\n apply (clarsimp simp: dom_s_def)\n apply (drule_tac x=0 in map_leD, simp_all)\n done\n\nlemma user_data_at_rf_sr_dom_s:\n \"\\ typ_at' UserDataT x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (drule rf_sr_heap_user_data_relation)\n apply (drule user_data_at_ko)\n apply (erule_tac x=x in cmap_relationE1)\n apply (simp only: heap_to_user_data_def Let_def ko_at_projectKO_opt)\n apply simp\n apply (drule h_t_valid_clift)\n apply (simp add: h_t_valid_dom_s pageBits_def)\n done\n\nlemma intvl_2_power_times_decomp:\n \"\\y < 2 ^ (n - m). {x + y * 2 ^ m ..+ 2 ^ m} \\ S \\ T\n \\ m \\ n \\ n < word_bits\n \\ {(x :: word32) ..+ 2 ^ n} \\ S \\ T\"\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"of_nat k >> m\" in spec)\n apply (drule mp)\n apply (rule shiftr_less_t2n)\n apply (rule word_of_nat_less)\n apply (simp add: word_of_nat_less)\n apply (erule subsetD)\n apply (clarsimp simp: shiftl_t2n[simplified mult.commute mult.left_commute, symmetric]\n shiftr_shiftl1)\n apply (rule_tac x=\"unat (of_nat k && mask m :: word32)\" in exI)\n apply (simp add: field_simps word_plus_and_or_coroll2)\n apply (simp add: word_bits_def unat_less_power and_mask_less')\n done\n\nlemma flex_user_data_at_rf_sr_dom_s:\n \"\\ (\\p<2 ^ (pageBitsForSize sz - pageBits).\n typ_at' UserDataT (x + p * 2 ^ pageBits) s); (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBitsForSize sz} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=pageBits in intvl_2_power_times_decomp,\n simp_all add: pbfs_atleast_pageBits pbfs_less_wb')\n apply (erule allEI, clarsimp)\n apply (drule(1) user_data_at_rf_sr_dom_s)\n apply (erule subsetD)\n apply simp\n done\n\nlemma hrs_mem_update_fold_eq:\n \"hrs_mem_update (fold f xs)\n = fold (hrs_mem_update o f) xs\"\n apply (rule sym, induct xs)\n apply (simp add: hrs_mem_update_def)\n apply (simp add: hrs_mem_update_def fun_eq_iff)\n done\n\nlemma power_user_page_foldl_zero_ranges:\n \" \\p<2 ^ (pageBitsForSize sz - pageBits).\n hrs_htd hrs \\\\<^sub>t (Ptr (ptr + of_nat p * 0x1000) :: user_data_C ptr)\n \\ zero_ranges_are_zero rngs hrs\n \\ zero_ranges_are_zero rngs\n (hrs_mem_update (\\s. foldl (\\s x. heap_update (Ptr x) (user_data_C (arr x)) s) s\n (map (\\n. ptr + of_nat n * 0x1000) [0..<2 ^ (pageBitsForSize sz - pageBits)]))\n hrs)\"\n apply (simp add: foldl_conv_fold hrs_mem_update_fold_eq)\n apply (rule conjunct1)\n apply (rule fold_invariant[where P=\"\\hrs'. zero_ranges_are_zero rngs hrs'\n \\ hrs_htd hrs' = hrs_htd hrs\"\n and xs=xs and Q=\"\\x. x \\ set xs\" for xs], simp_all)\n apply (subst zero_ranges_are_zero_update, simp_all)\n apply clarsimp\n done\n\ndeclare replicate_numeral [simp]\n\nlemma coerce_memset_to_heap_update_pte:\n \"heap_update_list x (replicateHider 4 0)\n = heap_update (Ptr x :: pte_C ptr)\n (pte_C.pte_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pte_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: replicateHider_def word_bits_def)\n done\n\nlemma objBits_eq_by_type:\n fixes x :: \"'a :: pspace_storable\" and y :: 'a\n shows \"objBits x = objBits y\"\n apply (simp add: objBits_def)\n apply (rule objBits_type)\n apply (simp add: koTypeOf_injectKO)\n done\n\nlemma mapM_x_store_memset_ccorres_assist:\n fixes val :: \"'a :: pspace_storable\"\n assumes nofail: \"\\ snd (mapM_x (\\slot. setObject slot val) slots \\)\"\n assumes slots1: \"\\n < length slots. slots ! n = hd slots + (of_nat n << objBits val)\"\n assumes slots2: \"n = length slots * (2 ^ objBits val)\"\n assumes ptr: \"ptr = hd slots\"\n assumes ko: \"\\ko :: 'a. updateObject ko = updateObject_default ko\"\n \"\\ko :: 'a. (1 :: word32) < 2 ^ objBits ko\"\n assumes restr: \"set slots \\ S\"\n assumes worker: \"\\ptr s s' (ko :: 'a). \\ (s, s') \\ rf_sr; ko_at' ko ptr s; ptr \\ S \\\n \\ (s \\ ksPSpace := ksPSpace s (ptr \\ injectKO val)\\,\n globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr\n (replicateHider (2 ^ objBits val) (ucast c))))) s') \\ rf_sr\"\n assumes rf_sr: \"(\\, s) \\ rf_sr\"\n shows\n \"\\(rv, \\') \\ fst (mapM_x (\\slot. setObject slot val) slots \\).\n (\\', globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr (replicateHider n c)))) s) \\ rf_sr\"\n unfolding slots2 ptr using rf_sr slots1 nofail restr\nproof (induct slots arbitrary: s \\)\n case Nil\n show ?case\n using Nil.prems\n apply (simp add: mapM_x_def sequence_x_def return_def replicateHider_def)\n apply (simp add: rf_sr_def hrs_mem_update_def cstate_relation_def Let_def\n carch_state_relation_def cmachine_state_relation_def\n h_t_valid_clift_Some_iff)\n done\nnext\n case (Cons x xs tPre sPre)\n\n note nofail_bind = Cons.prems(3)[unfolded mapM_x_Cons K_bind_def]\n\n have obj_at: \"obj_at' (\\x :: 'a. True) x sPre\"\n using not_snd_bindI1[OF nofail_bind]\n apply (subst(asm) setObject_obj_at_pre, simp_all add: ko snd_bind)\n apply (clarsimp simp: stateAssert_def exec_get return_def)\n apply (simp add: koTypeOf_injectKO typ_at_to_obj_at')\n done\n\n note in_setObject = setObject_eq[OF _ _ objBits_eq_by_type obj_at,\n where ko=val, simplified ko, simplified]\n\n note nofail_mapM = not_snd_bindI2[OF nofail_bind, OF in_setObject]\n\n have hd_xs: \"xs \\ [] \\ hd xs = x + (2 ^ objBits val)\"\n using Cons.prems(2)[rule_format, where n=1]\n by (simp add: hd_conv_nth)\n\n show ?case\n using obj_at_ko_at'[OF obj_at] Cons.prems(4)\n apply (clarsimp simp add: mapM_x_Cons bind_def split_def)\n apply (rule rev_bexI, rule in_setObject)\n apply (cut_tac Cons.hyps[OF _ _ nofail_mapM])\n defer\n apply (rule worker, rule Cons.prems, assumption+)\n apply clarsimp\n apply (case_tac \"xs = []\", simp_all)[1]\n apply (insert Cons.prems, simp)[1]\n apply (frule_tac x=\"Suc n\" in spec)\n apply (simp add: hd_xs shiftl_t2n field_simps)\n apply assumption\n apply clarsimp\n apply (rule rev_bexI, assumption)\n apply (simp add: o_def)\n apply (case_tac \"xs = []\")\n apply (simp add: hrs_mem_update_def split_def replicateHider_def)\n apply (subst(asm) heap_update_list_concat_fold_hrs_mem)\n apply (simp add: hd_xs replicateHider_def)\n apply (simp add: replicateHider_def replicate_add)\n done\nqed\n\nlemma invalidateTLBByASID_ccorres:\n \"ccorres dc xfdc (valid_pde_mappings' and (\\_. asid \\ mask asid_bits))\n (UNIV \\ {s. asid_' s = asid}) []\n (invalidateTLBByASID asid) (Call invalidateTLBByASID_'proc)\"\n apply (cinit lift: asid_')\n apply (ctac(no_vcg) add: loadHWASID_ccorres)\n apply csymbr\n apply (simp add: case_option_If2 del: Collect_const)\n apply (rule ccorres_if_cond_throws2[where Q=\\ and Q'=\\])\n apply (clarsimp simp: pde_stored_asid_def to_bool_def split: if_split)\n apply (rule ccorres_return_void_C[unfolded dc_def])\n apply (simp add: dc_def[symmetric])\n apply csymbr\n apply (ctac add: invalidateTranslationASID_ccorres)\n apply vcg\n apply (wp hoare_drop_imps)\n apply (clarsimp simp: pde_stored_asid_def to_bool_def)\n done\n\nend\n\nlemma option_to_0_user_mem':\n \"option_to_0 \\ user_mem' as =(\\x. if x \\ {y. \\ pointerInUserData y as} then 0\n else underlying_memory (ksMachineState as) x) \"\n apply (rule ext)\n apply (simp add:user_mem'_def option_to_0_def split:if_splits)\n done\n\nlemma heap_to_user_data_in_user_mem'[simp]:\n \"\\pspace_aligned' as;pspace_distinct' as\\ \\ heap_to_user_data (ksPSpace as) (option_to_0 \\ user_mem' as) =\n heap_to_user_data (ksPSpace as)(underlying_memory (ksMachineState as))\"\n apply (rule ext)+\n apply (clarsimp simp: heap_to_user_data_def option_map_def\n split: option.splits)\n apply (subst option_to_0_user_mem')\n apply (subst map_option_byte_to_word_heap)\n apply (clarsimp simp: projectKO_opt_user_data map_comp_def\n split: option.split_asm kernel_object.split_asm)\n apply (frule(1) pspace_alignedD')\n apply (frule(1) pspace_distinctD')\n apply (subgoal_tac \"x + ucast off * 4 + xa && ~~ mask pageBits = x\" )\n apply (clarsimp simp: pointerInUserData_def typ_at'_def ko_wp_at'_def)\n apply (simp add: ARM.pageBits_def)\n apply (subst mask_lower_twice2[where n = 2 and m = 12,simplified,symmetric])\n apply (subst is_aligned_add_helper[THEN conjunct2,where n1 = 2])\n apply (erule aligned_add_aligned)\n apply (simp add: is_aligned_mult_triv2[where n = 2,simplified])\n apply (clarsimp simp: objBits_simps ARM.pageBits_def)\n apply simp\n apply (rule is_aligned_add_helper[THEN conjunct2])\n apply (simp add: ARM.pageBits_def objBits_simps)\n apply (rule word_less_power_trans2[where k = 2,simplified])\n apply (rule less_le_trans[OF ucast_less])\n apply simp+\n done\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ncrunch pde_mappings'[wp]: invalidateTLBByASID \"valid_pde_mappings'\"\ncrunch ksArchState[wp]: invalidateTLBByASID \"\\s. P (ksArchState s)\"\n\ncrunch gsMaxObjectSize[wp]: invalidateTLBByASID \"\\s. P (gsMaxObjectSize s)\"\ncrunch gsMaxObjectSize[wp]: deleteASIDPool \"\\s. P (gsMaxObjectSize s)\"\n (wp: crunch_wps getObject_inv loadObject_default_inv\n simp: crunch_simps)\nend\n\ncontext kernel_m begin\n\nlemma page_table_at_rf_sr_dom_s:\n \"\\ page_table_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ ptBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=2 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps ptBits_def pageBits_def\n word_bits_def pteBits_def)\n apply (clarsimp simp: page_table_at'_def intvl_def)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpte_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\nlemma clearMemory_PT_setObject_PTE_ccorres:\n \"ccorres dc xfdc (page_table_at' ptr\n and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\n and (\\_. is_aligned ptr ptBits \\ ptr \\ 0 \\ pstart = addrFromPPtr ptr))\n (UNIV \\ {s. ptr___ptr_to_unsigned_long_' s = Ptr ptr} \\ {s. bits_' s = of_nat ptBits}) []\n (do x \\ mapM_x (\\a. setObject a ARM_H.InvalidPTE)\n [ptr , ptr + 2 ^ pteBits .e. ptr + 2 ^ ptBits - 1];\n doMachineOp (cleanCacheRange_PoU ptr (ptr + 2 ^ ptBits - 1) pstart)\n od)\n (Call clearMemory_PT_'proc)\"\n apply (rule ccorres_gen_asm)+\n apply (cinit' lift: ptr___ptr_to_unsigned_long_' bits_')\n apply (rule ccorres_Guard_Seq)\n apply (rule ccorres_split_nothrow_novcg_dc)\n apply (rule_tac P=\"page_table_at' ptr and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\"\n in ccorres_from_vcg_nofail[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (subst ghost_assertion_size_logic[unfolded o_def])\n apply (simp add: ptBits_def pageBits_def pteBits_def)\n apply simp\n apply (clarsimp simp: replicateHider_def[symmetric])\n apply (frule is_aligned_no_overflow')\n apply (intro conjI)\n apply (clarsimp simp add: ptBits_def pageBits_def pteBits_def\n cong: StateSpace.state.fold_congs globals.fold_congs)\n apply (erule is_aligned_weaken, simp add: ptBits_def pageBits_def)\n apply (clarsimp simp: is_aligned_def ptBits_def pageBits_def pteBits_def)\n apply (simp add: unat_of_nat32 order_less_le_trans[OF pt_bits_stuff(2)]\n word_bits_def page_table_at_rf_sr_dom_s)\n apply (clarsimp simp add: ptBits_def pageBits_def pteBits_def\n cong: StateSpace.state.fold_congs globals.fold_congs)\n apply (simp only: field_simps)\n apply (simp add: upto_enum_step_def objBits_simps ptBits_def pageBits_def\n linorder_not_less[symmetric] archObjSize_def\n upto_enum_word split_def pteBits_def)\n apply (erule mapM_x_store_memset_ccorres_assist\n [unfolded split_def, OF _ _ _ _ _ _ subset_refl],\n simp_all add: shiftl_t2n hd_map objBits_simps archObjSize_def pteBits_def)[1]\n apply (rule cmap_relationE1, erule rf_sr_cpte_relation, erule ko_at_projectKO_opt)\n apply (subst coerce_memset_to_heap_update_pte)\n apply (clarsimp simp: rf_sr_def Let_def cstate_relation_def typ_heap_simps)\n apply (rule conjI)\n apply (simp add: cpspace_relation_def typ_heap_simps update_pte_map_tos\n update_pte_map_to_ptes carray_map_relation_upd_triv)\n apply (rule cmap_relation_updI, simp_all)[1]\n apply (simp add: cpte_relation_def Let_def pte_lift_def\n pte_get_tag_def pte_tag_defs)\n apply (simp add: carch_state_relation_def cmachine_state_relation_def\n typ_heap_simps update_pte_map_tos)\n apply csymbr\n apply (rule ccorres_Guard)\n apply (ctac add: cleanCacheRange_PoU_ccorres)\n apply (wp mapM_x_wp' setObject_ksPSpace_only updateObject_default_inv | simp)+\n apply (clarsimp simp: guard_is_UNIV_def ptBits_def pageBits_def pteBits_def)\n apply (clarsimp simp: ptBits_def pageBits_def pteBits_def)\n apply (frule is_aligned_addrFromPPtr_n, simp)\n apply (clarsimp simp: is_aligned_no_overflow'[where n=10, simplified] pageBits_def\n field_simps is_aligned_mask[symmetric] mask_AND_less_0)\n done\n\nlemma modify_gets_helper:\n \"do y \\ modify (ksPSpace_update (\\_. ps)); ps' \\ gets ksPSpace; f ps' od\n = do y \\ modify (ksPSpace_update (\\_. ps)); f ps od\"\n by (simp add: bind_def simpler_modify_def simpler_gets_def)\n\nlemma snd_lookupAround2_update:\n \"ps y \\ None \\\n snd (lookupAround2 x (ps (y \\ v'))) = snd (lookupAround2 x ps)\"\n apply (clarsimp simp: lookupAround2_def lookupAround_def Let_def\n dom_fun_upd2\n simp del: dom_fun_upd cong: if_cong option.case_cong)\n apply (clarsimp split: option.split if_split cong: if_cong)\n apply auto\n done\n\nlemma double_setEndpoint:\n \"do y \\ setEndpoint epptr v1; setEndpoint epptr v2 od\n = setEndpoint epptr v2\"\n apply (simp add: setEndpoint_def setObject_def bind_assoc split_def\n modify_gets_helper)\n apply (simp add: updateObject_default_def bind_assoc objBits_simps)\n apply (rule ext)\n apply (rule bind_apply_cong, rule refl)+\n apply (clarsimp simp add: in_monad projectKOs magnitudeCheck_assert\n snd_lookupAround2_update)\n apply (simp add: lookupAround2_known1 assert_opt_def projectKO_def projectKO_opt_ep\n alignCheck_assert)\n apply (simp add: bind_def simpler_modify_def)\n done\n\nlemma ccorres_inst_voodoo:\n \"\\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\n \\ \\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\"\n by simp\n\nlemma cpspace_relation_ep_update_ep2:\n \"\\ ko_at' (ep :: endpoint) epptr s;\n cmap_relation (map_to_eps (ksPSpace s))\n (cslift t) ep_Ptr (cendpoint_relation (cslift t));\n cendpoint_relation (cslift t') ep' endpoint;\n (cslift t' :: tcb_C ptr \\ tcb_C) = cslift t \\\n \\ cmap_relation (map_to_eps (ksPSpace s(epptr \\ KOEndpoint ep')))\n (cslift t(ep_Ptr epptr \\ endpoint))\n ep_Ptr (cendpoint_relation (cslift t'))\"\n apply (rule cmap_relationE1, assumption, erule ko_at_projectKO_opt)\n apply (rule_tac P=\"\\a. cmap_relation a b c d\" for b c d in rsubst,\n erule cmap_relation_upd_relI, assumption+)\n apply simp+\n apply (rule ext, simp add: map_comp_def projectKO_opt_ep split: if_split)\n done\n\nend\n\ncontext kernel_m begin\n\nlemma ccorres_subst_basic_helper:\n \"\\ \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ f s' = f' s';\n \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ (s, f' s') \\ rf_sr;\n \\s'. xf' (f' s') = v; \\rv' t t'. ceqv \\ xf' rv' t t' c (c' rv');\n ccorres rrel xf Q Q' hs a (c' v) \\\n \\ ccorres rrel xf (P and Q) {s. s \\ P' \\ f' s \\ Q'} hs a (Basic f ;; c)\"\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_add_return)\n apply (rule ccorres_split_nothrow[where xf'=xf' and r'=\"\\rv rv'. rv' = v\"])\n apply (rule ccorres_from_vcg[where P=P and P'=P'])\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: return_def)\n apply assumption\n apply simp\n apply wp\n apply vcg\n apply clarsimp\n done\n\nlemma ctcb_relation_blocking_ipc_badge:\n \"\\ ctcb_relation tcb ctcb; isBlockedOnSend (tcbState tcb) \\ \\\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend\"\n \"\\ ctcb_relation tcb ctcb;\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend \\\n \\ blockingIPCBadge (tcbState tcb)\n = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\"\n apply (clarsimp simp add: ctcb_relation_def)\n apply (simp add: isBlockedOnSend_def split: Structures_H.thread_state.split_asm)\n apply (clarsimp simp: cthread_state_relation_def)\n apply (clarsimp simp add: ctcb_relation_def cthread_state_relation_def)\n apply (cases \"tcbState tcb\", simp_all add: \"StrictC'_thread_state_defs\")\n done\n\nlemma cendpoint_relation_q_cong:\n \"\\ \\t rf. (t, rf) \\ ep_q_refs_of' ep \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t) \\\n \\ cendpoint_relation hp ep ep' = cendpoint_relation hp' ep ep'\"\n apply (cases ep, simp_all add: cendpoint_relation_def Let_def)\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n done\n\nlemma cnotification_relation_q_cong:\n \"\\\\t rf. (t, rf) \\ ntfn_q_refs_of' (ntfnObj ntfn) \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t)\\\n \\ cnotification_relation hp ntfn ntfn' = cnotification_relation hp' ntfn ntfn'\"\n apply (cases \"ntfnObj ntfn\", simp_all add: cnotification_relation_def Let_def)\n apply (auto intro: iffD1[OF tcb_queue_relation'_cong[OF refl refl refl]])\n done\n\nlemma tcbSchedEnqueue_ep_at:\n \"\\obj_at' (P :: endpoint \\ bool) ep\\\n tcbSchedEnqueue t\n \\\\rv. obj_at' P ep\\\"\n including no_pre\n apply (simp add: tcbSchedEnqueue_def unless_def null_def)\n apply (wp threadGet_wp, clarsimp, wp+)\n apply (clarsimp split: if_split, wp)\n done\n\nlemma ccorres_duplicate_guard:\n \"ccorres r xf (P and P) Q hs f f' \\ ccorres r xf P Q hs f f'\"\n by (erule ccorres_guard_imp, auto)\n\n\nlemma ep_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ep_q_refs_of' ep\"\n by (auto simp: ep_q_refs_of'_def split: endpoint.splits)\n\n\nlemma ntfn_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ntfn_q_refs_of' ntfn\"\n by (auto simp: ntfn_q_refs_of'_def split: ntfn.splits)\n\nlemma cancelBadgedSends_ccorres:\n \"ccorres dc xfdc (invs' and ep_at' ptr)\n (UNIV \\ {s. epptr_' s = Ptr ptr} \\ {s. badge_' s = bdg}) []\n (cancelBadgedSends ptr bdg) (Call cancelBadgedSends_'proc)\"\n apply (cinit lift: epptr_' badge_' simp: whileAnno_def)\n apply (simp add: list_case_return\n cong: list.case_cong Structures_H.endpoint.case_cong call_ignore_cong\n del: Collect_const)\n apply (rule ccorres_pre_getEndpoint)\n apply (rule_tac R=\"ko_at' rv ptr\" and xf'=\"ret__unsigned_'\"\n and val=\"case rv of RecvEP q \\ scast EPState_Recv | IdleEP \\ scast EPState_Idle\n | SendEP q \\ scast EPState_Send\"\n in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV])\n apply vcg\n apply clarsimp\n apply (erule cmap_relationE1 [OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def\n split: Structures_H.endpoint.split_asm)\n apply ceqv\n apply wpc\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (rename_tac list)\n apply (simp add: Collect_True Collect_False endpoint_state_defs\n ccorres_cond_iffs dc_def[symmetric]\n del: Collect_const cong: call_ignore_cong)\n apply (rule ccorres_rhs_assoc)+\n apply (csymbr, csymbr)\n apply (drule_tac s = rv in sym, simp only:)\n apply (rule_tac P=\"ko_at' rv ptr and invs'\" in ccorres_cross_over_guard)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2)\n apply (rule ccorres_split_nothrow[where r'=dc and xf'=xfdc, OF _ ceqv_refl])\n apply (rule_tac P=\"ko_at' rv ptr\"\n in ccorres_from_vcg[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps setEndpoint_def)\n apply (rule rev_bexI)\n apply (rule setObject_eq; simp add: objBits_simps')[1]\n apply (clarsimp simp: rf_sr_def cstate_relation_def\n Let_def carch_state_relation_def\n cmachine_state_relation_def\n )\n apply (clarsimp simp: cpspace_relation_def\n update_ep_map_tos\n typ_heap_simps')\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def endpoint_state_defs)\n subgoal by simp\n apply (rule ccorres_symb_exec_r)\n apply (rule_tac xs=list in filterM_voodoo)\n apply (rule_tac P=\"\\xs s. (\\x \\ set xs \\ set list.\n st_tcb_at' (\\st. isBlockedOnSend st \\ blockingObject st = ptr) x s)\n \\ distinct (xs @ list) \\ ko_at' IdleEP ptr s\n \\ (\\p. \\x \\ set (xs @ list). \\rf. (x, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s\n \\ sch_act_wf (ksSchedulerAction s) s \\ valid_objs' s\"\n and P'=\"\\xs. {s. ep_queue_relation' (cslift s) (xs @ list)\n (head_C (queue_' s)) (end_C (queue_' s))}\n \\ {s. thread_' s = (case list of [] \\ tcb_Ptr 0\n | x # xs \\ tcb_ptr_to_ctcb_ptr x)}\"\n in ccorres_inst_voodoo)\n apply (induct_tac list)\n apply (rule allI)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_tmp_lift2 [OF _ _ Int_lower1])\n apply ceqv\n apply (simp add: ccorres_cond_iffs)\n apply (rule ccorres_rhs_assoc2)\n apply (rule ccorres_duplicate_guard, rule ccorres_split_nothrow_novcg_dc)\n apply (rule ccorres_from_vcg, rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (drule obj_at_ko_at', clarsimp)\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps tcb_queue_relation'_def)\n apply (case_tac x)\n apply (clarsimp simp: setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n carch_state_relation_def\n cmachine_state_relation_def\n cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n subgoal by (simp add: cendpoint_relation_def Let_def)\n subgoal by simp\n apply (clarsimp simp: tcb_at_not_NULL[OF pred_tcb_at']\n setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n carch_state_relation_def\n cmachine_state_relation_def\n cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def Let_def)\n apply (subgoal_tac \"tcb_at' (last (a # list)) \\ \\ tcb_at' a \\\")\n apply (clarsimp simp: is_aligned_neg_mask_weaken[\n OF is_aligned_tcb_ptr_to_ctcb_ptr[where P=\\]])\n subgoal by (simp add: tcb_queue_relation'_def EPState_Send_def mask_def)\n subgoal by (auto split: if_split)\n subgoal by simp\n apply (ctac add: rescheduleRequired_ccorres[unfolded dc_def])\n apply (rule hoare_pre, wp weak_sch_act_wf_lift_linear set_ep_valid_objs')\n apply (clarsimp simp: weak_sch_act_wf_def sch_act_wf_def)\n apply (fastforce simp: valid_ep'_def pred_tcb_at' split: list.splits)\n apply (simp add: guard_is_UNIV_def)\n apply (rule allI)\n apply (rename_tac a lista x)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_init_tmp_lift2, ceqv)\n apply (rule ccorres_guard_imp2)\n apply (simp add: bind_assoc dc_def[symmetric]\n del: Collect_const)\n apply (rule ccorres_cond_true)\n apply (rule ccorres_rhs_assoc)+\n apply (rule ccorres_pre_threadGet[where f=tcbState, folded getThreadState_def])\n apply (rule ccorres_move_c_guard_tcb)\n apply csymbr\n apply (rule ccorres_abstract_cleanup)\n apply csymbr\n apply (rule ccorres_move_c_guard_tcb)\n apply (rule_tac P=\\\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n and f'=\"\\s. s \\ next___ptr_to_struct_tcb_C_' := (case lista of [] \\ tcb_Ptr 0\n | v # vs \\ tcb_ptr_to_ctcb_ptr v) \\\"\n and xf'=\"next___ptr_to_struct_tcb_C_'\"\n in ccorres_subst_basic_helper)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule myvars.fold_congs, (rule refl)+)\n apply (clarsimp simp: tcb_queue_relation'_def use_tcb_queue_relation2\n tcb_queue_relation2_concat)\n apply (clarsimp simp: typ_heap_simps split: list.split)\n subgoal by (simp add: rf_sr_def)\n apply simp\n apply ceqv\n apply (rule_tac P=\"ret__unsigned=blockingIPCBadge rva\" in ccorres_gen_asm2)\n apply (rule ccorres_if_bind, rule ccorres_if_lhs)\n apply (simp add: bind_assoc dc_def[symmetric])\n apply (rule ccorres_rhs_assoc)+\n apply (ctac add: setThreadState_ccorres)\n apply (ctac add: tcbSchedEnqueue_ccorres)\n apply (rule_tac P=\"\\s. \\t \\ set (x @ a # lista). tcb_at' t s\"\n in ccorres_cross_over_guard)\n apply (rule ccorres_add_return, rule ccorres_split_nothrow[OF _ ceqv_refl])\n apply (rule_tac rrel=dc and xf=xfdc\n and P=\"\\s. (\\t \\ set (x @ a # lista). tcb_at' t s)\n \\ (\\p. \\t \\ set (x @ a # lista). \\rf. (t, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ distinct (x @ a # lista)\n \\ pspace_aligned' s \\ pspace_distinct' s\"\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n in ccorres_from_vcg)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: ball_Un)\n apply (rule exI, rule conjI)\n apply (rule exI, erule conjI)\n apply (intro conjI[rotated])\n apply (assumption)\n apply (fold_subgoals (prefix))[3]\n subgoal premises prems using prems by (fastforce intro: pred_tcb_at')+\n apply (clarsimp simp: return_def rf_sr_def cstate_relation_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def)\n apply (rule conjI, erule ctcb_relation_null_queue_ptrs)\n apply (rule null_ep_queue)\n subgoal by (simp add: o_def)\n apply (rule conjI)\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (rule cendpoint_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule(2) map_to_ko_atI)\n apply (drule ko_at_state_refs_ofD')\n apply clarsimp\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (drule(2) map_to_ko_atI, drule ko_at_state_refs_ofD')\n\n apply (rule cnotification_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n apply (rule conjI)\n apply (erule cready_queues_relation_not_queue_ptrs,\n auto dest: null_ep_schedD[unfolded o_def] simp: o_def)[1]\n apply (simp add: carch_state_relation_def\n cmachine_state_relation_def\n h_t_valid_clift_Some_iff)\n apply (rule ccorres_symb_exec_r2)\n apply (erule spec)\n apply vcg\n apply (vcg spec=modifies)\n apply wp\n apply simp\n apply vcg\n apply (wp hoare_vcg_const_Ball_lift tcbSchedEnqueue_ep_at\n sch_act_wf_lift)\n apply simp\n apply (vcg exspec=tcbSchedEnqueue_cslift_spec)\n apply (wp hoare_vcg_const_Ball_lift sts_st_tcb_at'_cases\n sts_sch_act sts_valid_queues setThreadState_oa_queued)\n apply (vcg exspec=setThreadState_cslift_spec)\n apply (simp add: ccorres_cond_iffs dc_def[symmetric])\n apply (rule ccorres_symb_exec_r2)\n apply (drule_tac x=\"x @ [a]\" in spec, simp add: dc_def[symmetric])\n apply vcg\n apply (vcg spec=modifies)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: pred_tcb_at' ball_Un)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n subgoal by (fastforce simp: valid_tcb_state'_def valid_objs'_maxDomain\n valid_objs'_maxPriority dest: pred_tcb_at')\n apply (clarsimp simp: tcb_at_not_NULL [OF pred_tcb_at'])\n apply (clarsimp simp: typ_heap_simps st_tcb_at'_def)\n apply (drule(1) obj_at_cslift_tcb)\n apply (clarsimp simp: ctcb_relation_blocking_ipc_badge)\n apply (rule conjI, simp add: \"StrictC'_thread_state_defs\" mask_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule rf_sr_cscheduler_relation)\n apply (clarsimp simp: cscheduler_action_relation_def st_tcb_at'_def\n split: scheduler_action.split_asm)\n apply (rename_tac word)\n apply (frule_tac x=word in tcbSchedEnqueue_cslift_precond_discharge)\n apply simp\n subgoal by clarsimp\n subgoal by clarsimp\n subgoal by clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (frule(3) tcbSchedEnqueue_cslift_precond_discharge)\n subgoal by clarsimp\n apply clarsimp\n apply (rule context_conjI)\n apply (clarsimp simp: tcb_queue_relation'_def)\n apply (erule iffD2[OF ep_queue_relation_shift[rule_format], rotated -1])\n subgoal by simp\n apply (rule_tac x=\"x @ a # lista\" in exI)\n apply (clarsimp simp: ball_Un)\n apply (rule conjI, fastforce)\n subgoal by (clarsimp simp: remove1_append)\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp obj_at_setObject3[where 'a=endpoint, folded setEndpoint_def])\n apply (simp add: objBits_simps')+\n apply (wp set_ep_valid_objs')\n apply vcg\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (clarsimp simp: guard_is_UNIV_def)\n apply (erule cmap_relationE1[OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps)\n apply (clarsimp simp: cendpoint_relation_def Let_def)\n subgoal by (clarsimp simp: tcb_queue_relation'_def neq_Nil_conv\n split: if_split_asm)\n apply clarsimp\n apply (frule ko_at_valid_objs', clarsimp)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_obj'_def valid_ep'_def)\n apply (frule sym_refs_ko_atD', clarsimp)\n apply (clarsimp simp: st_tcb_at_refs_of_rev')\n apply (rule conjI)\n subgoal by (auto simp: isBlockedOnSend_def elim!: pred_tcb'_weakenE)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n apply (drule sym_refsD, clarsimp)\n apply (drule(1) bspec)+\n by (auto simp: obj_at'_def projectKOs state_refs_of'_def pred_tcb_at'_def tcb_bound_refs'_def\n dest!: symreftype_inverse')\n\ndeclare Kernel_C.tcb_C_size [simp del]\n\nlemma cte_lift_ccte_relation:\n \"cte_lift cte' = Some ctel'\n \\ c_valid_cte cte'\n \\ ccte_relation (cte_to_H ctel') cte'\"\n by (simp add: ccte_relation_def)\n\nlemma updateFreeIndex_ccorres:\n \"\\s. \\ \\ ({s} \\ {s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'})\n c\n {t. \\cap. cap_untyped_cap_lift cap = (cap_untyped_cap_lift\n (cte_C.cap_C (the (cslift s (cte_Ptr srcSlot)))))\n \\ cap_untyped_cap_CL.capFreeIndex_CL := ((of_nat idx') >> 4) \\\n \\ cap_get_tag cap = scast cap_untyped_cap\n \\ t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr srcSlot)\n (cte_C.cap_C_update (\\_. cap) (the (cslift s (cte_Ptr srcSlot)))))\n (t_hrs_' (globals s))\n \\ t may_only_modify_globals s in [t_hrs]\n }\n \\ ccorres dc xfdc\n (valid_objs' and cte_wp_at' (\\cte. isUntypedCap (cteCap cte)\n \\ cap' = (cteCap cte)) srcSlot\n and untyped_ranges_zero'\n and (\\_. is_aligned (of_nat idx' :: word32) 4 \\ idx' \\ 2 ^ (capBlockSize cap')))\n {s. \\ capIsDevice cap'\n \\ region_actually_is_zero_bytes (capPtr cap' + of_nat idx') (capFreeIndex cap' - idx') s} hs\n (updateFreeIndex srcSlot idx') c\"\n (is \"_ \\ ccorres dc xfdc (valid_objs' and ?cte_wp_at' and _ and _) ?P' hs ?a c\")\n apply (rule ccorres_gen_asm)\n apply (simp add: updateFreeIndex_def getSlotCap_def updateCap_def)\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_split_noop_lhs, rule_tac cap'=cap' in updateTrackedFreeIndex_noop_ccorres)\n apply (rule ccorres_pre_getCTE)+\n apply (rename_tac cte cte2)\n apply (rule_tac P = \"\\s. ?cte_wp_at' s \\ cte2 = cte \\ cte_wp_at' ((=) cte) srcSlot s\"\n and P'=\"{s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'} \\ ?P'\" in ccorres_from_vcg)\n apply (rule allI, rule HoarePartial.conseq_exploit_pre, clarify)\n apply (drule_tac x=s in spec, rule conseqPre, erule conseqPost)\n defer\n apply clarsimp\n apply clarsimp\n apply (simp add: cte_wp_at_ctes_of)\n apply wp\n apply (clarsimp simp: isCap_simps cte_wp_at_ctes_of)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (frule(1) cte_lift_ccte_relation)\n apply (rule exI, intro conjI[rotated], assumption, simp_all)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule(1) rf_sr_ctes_of_cliftE)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (subgoal_tac \"ccap_relation (capFreeIndex_update (\\_. idx')\n (cteCap (the (ctes_of \\ srcSlot)))) cap\")\n apply (rule fst_setCTE [OF ctes_of_cte_at], assumption)\n apply (erule bexI [rotated])\n apply (clarsimp simp add: rf_sr_def cstate_relation_def Let_def\n cvariable_array_map_const_add_map_option[where f=\"tcb_no_ctes_proj\"]\n isCap_simps)\n apply (simp add:cpspace_relation_def)\n apply (clarsimp simp:typ_heap_simps' modify_map_def mex_def meq_def)\n apply (rule conjI)\n apply (rule cpspace_cte_relation_upd_capI, assumption+)\n apply (rule conjI)\n apply (rule setCTE_tcb_case, assumption+)\n apply (case_tac s', clarsimp)\n subgoal by (simp add: carch_state_relation_def cmachine_state_relation_def\n typ_heap_simps')\n\n apply (clarsimp simp: isCap_simps)\n apply (drule(1) cte_lift_ccte_relation,\n drule ccte_relation_ccap_relation)\n apply (simp add: cte_to_H_def)\n apply (frule cap_get_tag_isCap_unfolded_H_cap)\n apply (clarsimp simp: ccap_relation_def cap_lift_untyped_cap\n cap_to_H_simps cap_untyped_cap_lift_def\n is_aligned_shiftr_shiftl\n dest!: ccte_relation_ccap_relation)\n apply (rule unat_of_nat_eq unat_of_nat_eq[symmetric],\n erule order_le_less_trans,\n rule power_strict_increasing, simp_all)\n apply (rule unat_less_helper, rule order_le_less_trans[OF word_and_le1], simp add: mask_def)\n done\n\nend\n\nlemma ccap_relation_isDeviceCap2:\n \"\\ccap_relation cp cap; isUntypedCap cp\n \\ \\ (capIsDevice_CL (cap_untyped_cap_lift cap) = 0) = (\\ (capIsDevice cp))\"\n apply (frule cap_get_tag_UntypedCap)\n apply (simp add:cap_get_tag_isCap to_bool_def)\n done\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/ARM/Recycle_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.4378234991142019, "lm_q1q2_score": 0.26929991098626754}} {"text": "section \\Preprocessor and Code-Generator User Interface\\\ntheory LLVM_Codegen_Preproc\nimports \n \"../kernel/LLVM_Codegen\"\n \"Monadify\"\n \"../../lib/Definition_Utils\" \nkeywords \"export_llvm\" \"llvm_deps\" :: thy_decl\nbegin\n\n subsection \\Fixed-Point Unfolding Setup\\\n\n lemma llc_while_mono[partial_function_mono]: \n assumes \"\\x. M_mono (\\f. b f x)\"\n assumes \"\\x. M_mono (\\f. c f x)\"\n shows \"M_mono (\\D. llc_while (b D) (c D) \\)\"\n using assms unfolding llc_while_def by pf_mono_prover\n \n declaration \\fn _ => Definition_Utils.declare_extraction_group @{binding LLVM} #> snd\\\n declaration \\fn _ => Definition_Utils.declare_extraction_group @{binding LLVM_while} #> snd\\\n \n declaration {* fn _ =>\n Definition_Utils.add_extraction (@{extraction_group LLVM_while},\\<^here>) {\n pattern = Logic.varify_global @{term \"llc_while b body\"},\n gen_thm = @{thm gen_code_thm_llc_while},\n gen_tac = K (K no_tac)\n }\n *}\n\n declaration {*fn _ =>\n Definition_Utils.add_extraction (@{extraction_group LLVM},\\<^here>) {\n pattern = Logic.varify_global @{term \"REC (B::('a \\ 'b llM) \\ 'a \\ 'b llM)\"},\n gen_thm = @{thm REC_unfold},\n gen_tac = Partial_Function.mono_tac\n }\n *}\n\nsubsection \\Preprocessor\\ \n text \\\n The actual code generator expects a set of monomorphic, well-shaped equations.\n The preprocessor processes user specified equations, monomorphizes them and \n brings them into the right shape.\n \\\n \n named_theorems llvm_code \\Isabelle-LLVM code theorems\\\n named_theorems llvm_inline\n\n lemma llvm_inline_bind_laws[llvm_inline]:\n \"bind m return = m\"\n \"bind (bind m (\\x. f x)) g = bind m (\\x. bind (f x) g)\"\n by auto\n \n lemma unit_meta_eq: \"x \\ ()\" by simp\n \n lemma pull_lambda_case: \"(case x of (a,b) \\ \\y. t a b y) = (\\y. case x of (a,b) \\ t a b y)\"\n apply (rule ext) apply (cases x) by auto\n\n ML \\ structure LLC_Preprocessor = \n struct\n open LLC_Lib\n \n structure Monadify = Gen_Monadify (\n \n fun mk_return x = @{mk_term \"return ?x ::_ llM\"}\n fun mk_bind m f = @{mk_term \"bind ?m ?f ::_ llM\"}\n \n fun dest_return @{mpat \"return ?x ::_ llM\"} = SOME x | dest_return _ = NONE\n fun dest_bind @{mpat \"bind ?m ?f ::_ llM\"} = SOME (m,f) | dest_bind _ = NONE\n \n fun dest_monadT (Type (@{type_name M},[T,@{typ unit},@{typ llvm_memory},@{typ err}])) = SOME T | dest_monadT _ = NONE\n\n val strip_op = K strip_comb\n \n val bind_return_thm = @{lemma \"bind m return = m\" by simp}\n val return_bind_thm = @{lemma \"bind (return x) f = f x\" by simp}\n val bind_bind_thm = @{lemma \"bind (bind m (\\x. f x)) g = bind m (\\x. bind (f x) g)\" by simp}\n \n )\n \n (********* Normalization of code theorems *)\n \n \n fun cthm_inline ctxt thm = let\n val inline_thms = Named_Theorems.get ctxt @{named_theorems llvm_inline}\n val ctxt = put_simpset HOL_ss ctxt addsimps inline_thms\n in\n Conv.fconv_rule (rhs_conv (Simplifier.rewrite ctxt)) thm\n end\n \n val cthm_monadify = Conv.fconv_rule o (rhs_conv o Monadify.monadify_conv)\n \n val inline_iteration_limit =\n Config.int (Config.declare (\"inline_iteration_limit\", \\<^here>) (fn _ => Config.Int ~1));\n \n \n fun monadify_inline_cthm ctxt thm = let\n fun rpt 0 thm' = raise THM (\"inline_iteration_limit exceeded\",~1,[thm,thm'])\n | rpt n thm = let\n val thm' = thm |> cthm_monadify ctxt |> cthm_inline ctxt\n in\n if Thm.eq_thm_prop (thm,thm') then thm \n else rpt (n-1) thm'\n end\n \n val it_limit = Config.get ctxt inline_iteration_limit\n in\n thm \n |> cthm_inline ctxt\n |> rpt it_limit\n end \n \n (*\n Bring code theorem into parseable format. To be applied after inlining, \n immediately before parsing.\n \n Applies eta-expansion, return-expansion, and converts \\ to =.\n Finally, it will replace unit-binds by () constants and anonymous bind.\n \n May fail on non-well-formed theorems.\n *)\n fun cthm_format ctxt thm = let\n fun normalize_bind1 t = let\n val (f,args) = strip_comb t\n val _ = check_valid_head f\n \n val args_is_M = fastype_of f |> binder_types |> map (is_llM o body_type)\n \n val _ = length args_is_M = length args orelse raise TYPE (\"cthm_format: All arguments must be explicit\", [fastype_of f], [t])\n \n val args = map2 (fn isM => isM?(normalize o expand_eta_all)) args_is_M args\n \n in\n list_comb (f, args)\n end \n \n and normalize @{mpat \"bind ?m ?f\"} = let\n val m = normalize_bind1 m\n val f = (*ensure_abs f*) expand_eta_all f |> normalize\n in @{mk_term \"bind ?m ?f\"} end\n | normalize (Abs (x,T,t)) = Abs (x,T,normalize t)\n | normalize (t as @{mpat \"return _\"}) = t\n | normalize t = let val t = normalize_bind1 t in @{mk_term \"bind ?t (\\x. return x)\"} end\n \n fun normalize_eq @{mpat \"Trueprop (?a = ?b)\"} = let val b = normalize b in @{mk_term \"Trueprop (?a = ?b)\"} end\n | normalize_eq @{mpat \"?a \\ ?b\"} = let val b = normalize b in @{mk_term \"?a \\ ?b\"} end\n | normalize_eq t = raise TERM (\"format_code_thm: normalize_eq\", [t])\n \n fun norm_tac ctxt = ALLGOALS (simp_tac (put_simpset HOL_ss ctxt addsimps @{thms bind_laws}))\n \n fun cthm_norm_lambda ctxt thm = let\n val thm = Local_Defs.unfold ctxt @{thms pull_lambda_case} thm\n \n fun r thm = case Thm.concl_of thm of\n @{mpat \"Trueprop (_ = (\\_. _))\"} => r (thm RS @{thm fun_cong})\n | @{mpat \"_ \\ (\\_. _)\"} => r (thm RS @{thm meta_fun_cong})\n | _ => thm\n \n in\n r thm\n end\n \n in\n thm \n |> (simplify (put_simpset HOL_ss ctxt addsimps @{thms Monad.bind_laws atomize_eq}))\n |> (Conv.fconv_rule (Refine_Util.f_tac_conv ctxt normalize_eq (norm_tac ctxt)))\n |> cthm_norm_lambda ctxt\n |> (Conv.fconv_rule (Conv.top_sweep_conv (K (Conv.rewr_conv @{thm unit_meta_eq})) ctxt))\n end\n \n (********* Gathering of code equations *)\n (* TODO: Use net *)\n\n \n fun dep_prep_code_thm thm = let\n val c = head_of_eqn_thm thm\n val _ = check_valid_head c\n in\n (c,thm)\n end\n \n fun dep_try_instantiate_code_thm c (l,thm) = let\n val thy = Thm.theory_of_thm thm\n in\n case SOME (Pattern.match thy (l,c) (Vartab.empty,Vartab.empty)) handle Pattern.MATCH => NONE of\n NONE => NONE\n | SOME m => SOME (instantiate_uc m thm)\n end\n \n fun dep_find_code_thm pthms c = \n case get_first (dep_try_instantiate_code_thm c) pthms of\n SOME eqn => eqn\n | NONE => raise TERM (\"No code equation\",[c])\n \n val cmd_name_prefix = Long_Name.qualify (Long_Name.qualifier @{const_name ll_add}) \"ll_\"\n val comb_name_prefix = Long_Name.qualify (Long_Name.qualifier @{const_name llc_while}) \"llc_\"\n \n fun dep_is_ll_comb_name name =\n name = @{const_name bind}\n orelse name = @{const_name return}\n orelse String.isPrefix cmd_name_prefix name\n orelse String.isPrefix comb_name_prefix name\n \n \n fun dep_is_call_const t = case try dest_head t of\n NONE => false\n | SOME (name,T) => \n not (dep_is_ll_comb_name name) (* Not an internal name *)\n andalso is_llM (body_type T) (* Yields a monadic result *)\n andalso not (exists (exists_subtype is_llM) (binder_types T)) (* No monadic parameters *)\n \n fun calls_of_cthm thm = Term.fold_aterms \n (fn t => dep_is_call_const t?cons t) \n (rhs_of_eqn (Thm.prop_of thm))\n []\n \n fun default_extractions ctxt = \n Definition_Utils.get_extraction_group ctxt @{extraction_group LLVM}\n |> (not (Config.get ctxt llc_compile_while) ? \n append (Definition_Utils.get_extraction_group ctxt @{extraction_group LLVM_while})) \n \n fun gather_code_thms roots lthy = let\n val thy = Proof_Context.theory_of lthy\n val pthms = Named_Theorems.get lthy @{named_theorems llvm_code}\n |> map dep_prep_code_thm\n |> Refine_Util.subsume_sort fst thy\n \n fun process_root c (ctab, lthy) = let\n val _ = check_valid_head c\n val basename = name_of_head c |> Long_Name.base_name\n in\n case Termtab.lookup ctab c of\n SOME _ => (ctab, lthy)\n | NONE => let\n val _ = assert_monomorphic_const c\n (* Get code theorem and inline it *)\n val teqn = dep_find_code_thm pthms c |> monadify_inline_cthm lthy\n\n (* Extract recursion equations *)\n val exs = default_extractions lthy\n \n val ((teqn,add_eqns,_),lthy) = Definition_Utils.extract_recursion_eqs exs basename teqn lthy\n val teqns = teqn::add_eqns\n \n (* Inline and format again *)\n val teqns = map (monadify_inline_cthm lthy #> cthm_format lthy) teqns\n\n (* Update table *)\n val ctab = fold Termtab.update_new (map dep_prep_code_thm teqns) ctab\n \n (* Find calls *)\n val calls = map calls_of_cthm teqns |> flat\n \n (* Recurse *)\n val (ctab,lthy) = fold process_root calls (ctab,lthy)\n in\n (ctab, lthy)\n end\n end \n\n val (ctab,lthy) = fold process_root roots (Termtab.empty,lthy)\n val thms = Termtab.dest ctab |> map snd\n \n in\n (thms,lthy)\n end\n \n end\n \\\n \nsubsection \\Code Generator Driver\\ \n text \\\n The driver combines preeprocessing and code generation, \n and defines the user interface of the code generator, namely the commands\n @{command export_llvm} and @{command llvm_deps}.\n \\\n \n ML \\ structure LLC_Driver \n = struct\n \n val cfg_llvm_debug = Attrib.setup_config_bool @{binding llvm_debug} (K false)\n \n fun pretty_cthms ctxt cthms = let \n val ctxt = Config.put Syntax_Trans.eta_contract_raw (Config.Bool false) ctxt \n in Pretty.big_list \"Code Theorems\" (map (Thm.pretty_thm ctxt) cthms) end\n\n fun pretty_ftab_entry ctxt (t,n) = Pretty.block [\n Syntax.pretty_term ctxt t, Pretty.brk 1, Pretty.str \":: \", Syntax.pretty_typ ctxt (fastype_of t), \n Pretty.brk 1,Pretty.str \"\\\",Pretty.brk 1, Pretty.str n\n ]\n \n fun pretty_ftab ctxt ftab = Pretty.big_list \"Symbol table:\" \n (map (pretty_ftab_entry ctxt) (Termtab.dest ftab))\n \n fun consts_to_llvm cns lthy = let\n val dbg = Config.get lthy cfg_llvm_debug\n \n fun trace s = if dbg then Pretty.string_of (s ()) |> tracing else ()\n \n val _ = trace (fn () => Pretty.str \"Gathering code theorems\")\n val (cthms,lthy) = LLC_Preprocessor.gather_code_thms (map fst cns) lthy\n val _ = trace (fn () => pretty_cthms lthy cthms)\n \n val _ = trace (fn () => Pretty.str \"Computing symbol table\")\n val fixes = map_filter (fn (_,NONE) => NONE | (cn,SOME name) => SOME (cn,name)) cns\n val ftab = LLC_Compiler.compute_fun_names fixes cthms\n val _ = trace (fn () => pretty_ftab lthy ftab)\n \n \n val _ = trace (fn () => Pretty.str \"Translating code theorems to IL\")\n val tysxeqns = LLC_Compiler.parse_cthms ftab cthms lthy\n val _ = trace (fn () => LLC_Intermediate.pretty_llc tysxeqns)\n \n val _ = trace (fn () => Pretty.str \"Writing LLVM\")\n val res = LLC_Backend.compile_to_llvm lthy tysxeqns\n in\n ((cthms,res), lthy)\n end\n \n local\n val using_master_directory =\n File.full_path o Resources.master_directory o Proof_Context.theory_of;\n \n fun prepare_path ctxt (s,pos) = let\n val _ = Position.report pos Markup.language_path;\n val path = Path.explode s;\n val _ = Position.report pos (Markup.path (Path.smart_implode path));\n val path = using_master_directory ctxt path\n in path end\n \n fun write_out NONE s = writeln s\n | write_out (SOME path) s = File.write path s\n in\n fun export_llvm cns path lthy = let\n val lthy = Config.put Syntax_Trans.eta_contract_raw (Config.Bool false) lthy\n val ((cthms,llvm_code),lthy) = consts_to_llvm cns lthy\n val _ = write_out path llvm_code \n in\n (cthms,lthy)\n end\n \n val export_llvm_cmd = (Args.mode \"debug\" -- Args.mode \"no_while\" -- Parse_Spec.opt_thm_name \":\" -- (Scan.repeat1 (Parse.term -- Scan.option (@{keyword \"is\"} |-- Parse.name )) -- Scan.option ((@{keyword \"file\"} |-- Parse.position Parse.path))) \n >> (fn (((dbg,nowhile),bnd),(cns,path)) => fn lthy => let \n \n local\n val lthy = (dbg?Config.put cfg_llvm_debug true) lthy\n val lthy = (nowhile?Config.put LLC_Lib.llc_compile_while false) lthy\n in\n val cns = map (apfst (Syntax.read_term lthy)) cns\n val path = Option.map (prepare_path lthy) path \n \n val (cthms,lthy) = export_llvm cns path lthy\n end\n \n val (_,lthy) = Local_Theory.note (bnd,cthms) lthy \n \n in lthy end))\n \n val llvm_deps_cmd = Parse_Spec.opt_thm_name \":\" -- Scan.repeat1 Parse.term\n >> (fn (bnd,cns) => fn lthy => let\n val cns = map (Syntax.read_term lthy) cns\n val (cthms,lthy) = LLC_Preprocessor.gather_code_thms cns lthy\n val (_,lthy) = Local_Theory.note (bnd,cthms) lthy \n \n val _ = pretty_cthms lthy cthms |> Pretty.string_of |> writeln\n \n in lthy end \n )\n \n \n end\n\n val _ = Outer_Syntax.local_theory @{command_keyword export_llvm} \"generate LLVM code for constants\" export_llvm_cmd\n val _ = Outer_Syntax.local_theory @{command_keyword llvm_deps} \"Print LLVM code theorems for constants\" llvm_deps_cmd\n end\n \\ \n \n subsection \\Setup for Product Type\\\n text \\We prepare a setup to compile product types to anonymous 2-element structures\\\n \n lemma ll_prod_is_pair[ll_is_pair_type_thms]: \n \"ll_is_pair_type True TYPE('a::llvm_rep \\'b::llvm_rep) TYPE('a) TYPE('b)\"\n by (simp add: ll_is_pair_type_def)\n \n definition [llvm_inline]: \"prod_insert_fst \\ ll_insert_fst :: ('a::llvm_rep \\ 'b::llvm_rep) \\ 'a \\ ('a\\'b) llM\"\n definition [llvm_inline]: \"prod_insert_snd \\ ll_insert_snd :: ('a::llvm_rep \\ 'b::llvm_rep) \\ 'b \\ ('a\\'b) llM\"\n definition [llvm_inline]: \"prod_extract_fst \\ ll_extract_fst :: ('a::llvm_rep \\ 'b::llvm_rep) \\ 'a llM\"\n definition [llvm_inline]: \"prod_extract_snd \\ ll_extract_snd :: ('a::llvm_rep \\ 'b::llvm_rep) \\ 'b llM\"\n definition [llvm_inline]: \"prod_gep_fst \\ ll_gep_fst :: ('a::llvm_rep \\ 'b::llvm_rep) ptr \\ 'a ptr llM\"\n definition [llvm_inline]: \"prod_gep_snd \\ ll_gep_snd :: ('a::llvm_rep \\ 'b::llvm_rep) ptr \\ 'b ptr llM\"\n\n \n lemma prod_ops_simp:\n \"prod_insert_fst = (\\(_,b) a. return (a,b))\"\n \"prod_insert_snd = (\\(a,_) b. return (a,b))\"\n \"prod_extract_fst = (\\(a,b). return a)\"\n \"prod_extract_snd = (\\(a,b). return b)\"\n unfolding \n prod_insert_fst_def ll_insert_fst_def \n prod_insert_snd_def ll_insert_snd_def\n prod_extract_fst_def ll_extract_fst_def \n prod_extract_snd_def ll_extract_snd_def \n apply (all \\intro ext\\ )\n apply (auto \n simp: checked_split_pair_def to_val_prod_def from_val_prod_def checked_from_val_def\n split: prod.splits\n )\n done\n \n \n subsection \\Ad-Hoc Regression Tests\\\n \nexperiment begin \n \n definition exp :: \"64 word \\ 64 word llM\" where [llvm_code]: \"exp i \\ doM {\n s \\ prod_insert_fst init 1;\n s \\ prod_insert_snd s i;\n s \\ llc_while\n (\\s. doM {\n i \\ prod_extract_snd s;\n ll_icmp_ne i 0\n })\n (\\s. doM {\n c \\ prod_extract_fst s;\n i \\ prod_extract_snd s;\n \n c \\ ll_mul c 2;\n i \\ ll_sub i 1;\n \n s \\ prod_insert_fst init c;\n s \\ prod_insert_snd s i;\n \n return s\n })\n s;\n \n prod_extract_fst s\n }\"\n \n \n definition streq :: \"8 word ptr \\ 8 word ptr \\ 1 word llM\" where [llvm_code]: \"streq s\\<^sub>1 s\\<^sub>2 = doM {\n x \\ ll_load s\\<^sub>1;\n ll_load s\\<^sub>2 \\ ll_icmp_eq x\n }\"\n \n export_llvm streq \n \n definition [llvm_code]: \"test2 (n::32 word) \\ doM {\n n \\ ll_add n 42;\n p \\ ll_malloc TYPE(16 word) n;\n p \\ ll_ofs_ptr p (5::32 word);\n ll_store 42 p;\n r \\ ll_load p; \n return r \n }\"\n \n definition [llvm_code]: \"add_add (a::_ word) \\ doM {\n x \\ ll_add a a;\n x \\ ll_add x x;\n return x\n }\"\n\n definition [llvm_code]: \"add_add_driver (a::32 word) (b::64 word) \\ doM {\n a \\ add_add a;\n b \\ add_add b;\n a \\ ll_zext a TYPE(64 word);\n b \\ ll_add a b;\n return b\n }\"\n \n export_llvm (debug) add_add_driver\n \n definition [llvm_code]: \"main (argc::32 word) (argv::8 word ptr ptr) \\ doM {\n r \\ test2 argc;\n r \\ ll_zext r TYPE(32 word);\n return r\n }\" \n\n definition [llvm_code]: \"main_exp (argc::32 word) (argv::8 word ptr ptr) \\ doM {\n argc \\ ll_zext argc TYPE(64 word);\n r \\ exp argc;\n r \\ ll_trunc r TYPE(32 word);\n return r\n }\" \n\n \ndefinition [llvm_code]: \"testx (a::64 word) \\ llc_while (\\a. ll_icmp_ult 0 a) (\\a. ll_sub a 1) a\"\n \ndeclare [[eta_contract = false]]\nexport_llvm (debug) testx\nexport_llvm (debug) exp_thms1: exp \nexport_llvm (debug) (no_while) exp_thms2: exp \nexport_llvm (debug) (no_while) exp_thms3: exp \n\nthm exp_thms1\nthm exp_thms2\nthm exp_thms3\n\n\nexport_llvm (debug) foobar: main_exp is main\nexport_llvm (debug) main is main\n\n\n\ndefinition [llvm_code]: \n \"test_if_names (n::32 word) \\ doM {\n tmp \\ ll_icmp_eq n 0;\n a \\ llc_if tmp (return null) (doM {\n x \\ ll_malloc TYPE(8 word) n;\n return x\n });\n p \\ ll_ofs_ptr a (1::32 word);\n ll_store 0x2A p;\n ll_free a;\n return ()\n }\"\n \nexport_llvm test_if_names\n\ndefinition fib :: \"64 word \\ 64 word llM\" \n where [llvm_code]: \"fib n \\ REC (\\fib n. doM { \n t\\ll_icmp_ule n 1; \n llc_if t \n (return n) \n (doM { \n n\\<^sub>1 \\ ll_sub n 1; \n a\\fib n\\<^sub>1; \n n\\<^sub>2 \\ ll_sub n 2; \n b\\fib n\\<^sub>2; \n c\\ll_add a b; \n return c })} ) n\"\n\nexport_llvm fib is fib\n\n\nend\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/basic/preproc/LLVM_Codegen_Preproc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.26920284381460396}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m1_nssk.thy (Isabelle/HOL 2016-1)\n ID: $Id: m1_nssk.thy 133856 2017-03-20 18:05:54Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n \n Key distribution protocols\n First refinement: abstract server-based key transport protocol with \n initiator and responder roles.\n\n Copyright (c) 2009-2016 Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Abstract Needham-Schroeder Shared Key (L1)\\\n\ntheory m1_nssk imports m1_keydist_iirn \nbegin\n\ntext \\We add augment the basic abstract key distribution model such that \nthe server reads and stores the initiator's nonce. We show three refinements, \nnamley that this model refines\n\\begin{enumerate}\n\\item the basic key distribution model \\m1a\\, and\n\\item the injective agreement model \\a0i\\, instantiated such that \nthe initiator agrees with the server on the session key and its nonce.\n\\item the non-injective agreement model \\a0n\\, instantiated such that \nthe responder agrees with the server on the session key.\n\\end{enumerate}\n\\\n\nconsts\n nb :: \"nat\" \\ \\responder nonce constant\\\n END :: \"atom\" \\ \\run end marker for responder\\\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\We extend the basic key distribution by adding nonces. The frames, \nthe state, and the observations remain the same as in the previous model, but \nwe will use the @{typ \"nat list\"}'s to store nonces.\\\n\nrecord m1_state = m1r_state + \n leak :: \"(key \\ fresh_t \\ fresh_t) set\" \\ \\keys leaked plus session context\\\n\ntype_synonym m1_obs = \"m1_state\"\n\ntype_synonym 'x m1_pred = \"'x m1_state_scheme set\"\ntype_synonym 'x m1_trans = \"('x m1_state_scheme \\ 'x m1_state_scheme) set\"\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ndefinition \\ \\by @{term \"A\"}, refines @{term \"m1a_step1\"}\\\n m1_step1 :: \"[rid_t, agent, agent, nonce] \\ 'x m1r_trans\"\nwhere\n \"m1_step1 Ra A B Na \\ m1a_step1 Ra A B Na\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{text \"m1a_step2\"}\\\n m1_step2 :: \"[rid_t, agent, agent] \\ 'x m1r_trans\"\nwhere\n \"m1_step2 Rb A B \\ m1a_step2 Rb A B\"\n\ndefinition \\ \\by @{term \"Server\"}, refines @{term m1a_step3}\\\n m1_step3 :: \"[rid_t, agent, agent, nonce, key] \\ 'x m1r_trans\"\nwhere\n \"m1_step3 Rs A B Na Kab \\ m1a_step3 Rs A B Kab Na []\"\n\ndefinition \\ \\by @{text \"A\"}, refines @{term m1a_step4}\\\n m1_step4 :: \"[rid_t, agent, agent, nonce, key] \\ 'x m1_trans\"\nwhere\n \"m1_step4 Ra A B Na Kab \\ {(s, s').\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\\n Na = Ra$na \\ \\ \\fix parameter\\\n (Kab \\ Domain (leak s) \\ (Kab, A) \\ azC (runs s)) \\ \\ \\authorization guard\\\n\n \\ \\new guard for agreement with server on \\(Kab, B, Na)\\,\\\n \\ \\injectiveness by including \\Na\\\\\n (A \\ bad \\ (\\Rs. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], [aNon Na]))) \\\n\n \\ \\actions:\\\n s' = s\\ runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab])) \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term m1a_step5}\\\n m1_step5 :: \"[rid_t, agent, agent, nonce, key] \\ 'x m1_trans\"\nwhere\n \"m1_step5 Rb A B Nb Kab \\ {(s, s'). \n \\ \\new guards:\\\n Nb = Rb$nb \\ \\ \\generate Nb\\\n\n \\ \\prev guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \n (Kab \\ Domain (leak s) \\ (Kab, B) \\ azC (runs s)) \\ \\ \\authorization guard\\\n\n \\ \\guard for showing agreement with server on \\(Kab, A)\\,\\\n \\ \\this agreement is non-injective\\\n (B \\ bad \\ (\\Rs Na. Kab = sesK (Rs$sk) \\\n runs s Rs = Some (Serv, [A, B], [aNon Na]))) \\\n\n \\ \\actions:\\\n s' = s\\ runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab])) \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term skip}\\\n m1_step6 :: \"[rid_t, agent, agent, nonce, nonce, key] \\ 'x m1_trans\"\nwhere\n \"m1_step6 Ra A B Na Nb Kab \\ {(s, s'). \n runs s Ra = Some (Init, [A, B], [aKey Kab]) \\ \\ \\key recv'd before\\\n Na = Ra$na \\\n\n \\ \\guard for showing agreement with \\B\\ on \\Kab\\ and \\Nb\\\\\n (A \\ bad \\ B \\ bad \\ \n (\\Nb'. (Kab, Na, Nb') \\ leak s) \\ \\ \\NEW: weaker condition\\\n (\\Rb nl. Nb = Rb$nb \\ runs s Rb = Some (Resp, [A, B], aKey Kab # nl))) \\ \n\n \\ \\actions:\\\n s' = s\\\n runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab, aNon Nb])) \n \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines @{term skip}\\\n m1_step7 :: \"[rid_t, agent, agent, nonce, key] \\ 'x m1_trans\"\nwhere\n \"m1_step7 Rb A B Nb Kab \\ {(s, s').\n runs s Rb = Some (Resp, [A, B], [aKey Kab]) \\ \\ \\key recv'd before\\\n Nb = Rb$nb \\\n\n \\ \\guard for showing agreement with \\A\\ on \\Kab\\ and \\Nb\\\\\n (A \\ bad \\ B \\ bad \\ Kab \\ Domain (leak s) \\ \n \\ \\\\(\\Na'. (Kab, Na', Nb) \\ leak s) \\\\ too strong, does not work\\\n (\\Ra. runs s Ra = Some (Init, [A, B], [aKey Kab, aNon Nb]))) \\ \n \n \\ \\actions: (redundant) update local state marks successful termination\\\n s' = s\\\n runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab, END]))\n \\\n }\"\n\ndefinition \\ \\by attacker, refines @{term s0g_leak}\\\n m1_leak :: \"[rid_t, rid_t, rid_t, agent, agent] \\ 'x m1_trans\"\nwhere\n \"m1_leak Rs Ra Rb A B \\ {(s, s1). \n \\ \\guards:\\\n runs s Rs = Some (Serv, [A, B], [aNon (Ra$na)]) \\\n runs s Ra = Some (Init, [A, B], [aKey (sesK (Rs$sk)), aNon (Rb$nb)]) \\ \n runs s Rb = Some (Resp, [A, B], [aKey (sesK (Rs$sk)), END]) \\ \n\n \\ \\actions:\\\n s1 = s\\ leak := insert (sesK (Rs$sk), Ra$na, Rb$nb) (leak s) \\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Specification\\\n(******************************************************************************)\n\nabbreviation\n m1_init :: \"m1_state set\"\nwhere\n \"m1_init \\ { \\\n runs = Map.empty,\n leak = corrKey \\ {undefined} \\ {undefined} \\ \\initial leakage\\\n \\ }\" \n\ndefinition \n m1_trans :: \"'x m1_trans\" where\n \"m1_trans \\ (\\A B Ra Rb Rs Na Nb Kab.\n m1_step1 Ra A B Na \\\n m1_step2 Rb A B \\\n m1_step3 Rs A B Na Kab \\\n m1_step4 Ra A B Na Kab \\\n m1_step5 Rb A B Nb Kab \\\n m1_step6 Ra A B Na Nb Kab \\\n m1_step7 Rb A B Nb Kab \\\n m1_leak Rs Ra Rb A B \\\n Id\n )\"\n\ndefinition \n m1 :: \"(m1_state, m1_obs) spec\" where\n \"m1 \\ \\\n init = m1_init,\n trans = m1_trans,\n obs = id\n \\\" \n\nlemmas m1_loc_defs = \n m1_def m1_trans_def\n m1_step1_def m1_step2_def m1_step3_def m1_step4_def m1_step5_def \n m1_step6_def m1_step7_def m1_leak_def\n\nlemmas m1_defs = m1_loc_defs m1a_defs \n\nlemma m1_obs_id [simp]: \"obs m1 = id\"\nby (simp add: m1_def)\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv0: Finite domain\\\n(*inv**************************************************************************)\n\ntext \\There are only finitely many runs. This is needed to establish the \nresponder/initiator agreements. This is already defined in the previous model,\nwe just need to show that it still holds in the current model.\\\n\nabbreviation\n m1_inv0_fin :: \"'x m1_pred\" where\n \"m1_inv0_fin \\ m1a_inv0_fin\"\n\nlemmas m1_inv0_finI = m1a_inv0_finI\nlemmas m1_inv0_finE = m1a_inv0_finE\nlemmas m1_inv0_finD = m1a_inv0_finD\n\n\ntext \\Invariance proofs.\\\n\nlemma PO_m1_inv0_fin_init [iff]:\n \"init m1 \\ m1_inv0_fin\"\nby (auto simp add: m1_defs intro!: m1_inv0_finI)\n\nlemma PO_m1_inv0_fin_trans [iff]:\n \"{m1_inv0_fin} trans m1 {> m1_inv0_fin}\"\nby (auto simp add: PO_hoare_defs m1_defs intro!: m1_inv0_finI)\n\nlemma PO_m1_inv0_fin [iff]: \"reach m1 \\ m1_inv0_fin\"\nby (rule inv_rule_incr, auto del: subsetI)\n\ndeclare PO_m1_inv0_fin [THEN subsetD, intro]\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\m1a\\\\\n(******************************************************************************)\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\med1a1: The mediator function maps a concrete observation (i.e., run) \nto an abstract one.\\\n\n\ntext \\Instantiate parameters regarding list of freshness identifiers stored\nat server.\\\n\noverloading is_len' \\ \"is_len\" rs_len' \\ \"rs_len\" begin\ndefinition is_len_def [simp]: \"is_len' \\ 0::nat\"\ndefinition rs_len_def [simp]: \"rs_len' \\ 0::nat\"\nend\n\nfun \n rm1a1 :: \"role_t \\ atom list \\ atom list\"\nwhere\n \"rm1a1 Init = take (Suc is_len)\" \\ \\take \\Kab\\\\\n| \"rm1a1 Resp = take (Suc rs_len)\" \\ \\take \\Kab\\\\\n| \"rm1a1 Serv = id\" \\ \\take all\\\n\nabbreviation \n runs1a1 :: \"runs_t \\ runs_t\" where\n \"runs1a1 \\ map_runs rm1a1\" \n\nlemmas runs1a1_def = map_runs_def\n\nlemma knC_runs1a1 [simp]:\n \"knC (runs1a1 runz) = knC runz\"\napply (auto simp add: map_runs_def elim!: knC.cases)\napply (rename_tac b, case_tac b, auto)\napply (rename_tac b, case_tac b, auto)\napply (rule knC_init, auto simp add: runs1a1_def)\napply (rule knC_resp, auto simp add: runs1a1_def)\napply (rule_tac knC_serv, auto simp add: runs1a1_def)\ndone\n\n\ntext \\R1a1: The simulation relation is defined in terms of the mediator\nfunction.\\\n\ndefinition\n med1a1 :: \"m1_obs \\ m1a_obs\" where\n \"med1a1 s \\ \\ runs = runs1a1 (runs s), m1x_state.leak = Domain (leak s) \\\"\n \ndefinition\n R1a1 :: \"(m1a_state \\ m1_state) set\" where\n \"R1a1 \\ {(s, t). s = med1a1 t}\"\n\nlemmas R1a1_defs = R1a1_def med1a1_def \n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_m1a_step1:\n \"{R1a1} \n (m1a_step1 Ra A B Na), (m1_step1 Ra A B Na) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step2_refines_m1a_step2:\n \"{R1a1} \n (m1a_step2 Rb A B), (m1_step2 Rb A B) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step3_refines_m1a_step3:\n \"{R1a1} \n (m1a_step3 Rs A B Kab Na []), (m1_step3 Rs A B Na Kab)\n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step4_refines_m1a_step4:\n \"{R1a1} \n (m1a_step4 Ra A B Na Kab []), (m1_step4 Ra A B Na Kab) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs runs1a1_def)\n\nlemma PO_m1_step5_refines_m1a_step5:\n \"{R1a1} \n (m1a_step5 Rb A B Kab []), (m1_step5 Rb A B Nb Kab) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs runs1a1_def)\n\nlemma PO_m1_step6_refines_m1a_skip:\n \"{R1a1} \n Id, (m1_step6 Ra A B Na Nb Kab) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs runs1a1_def)\n\nlemma PO_m1_step7_refines_m1a_skip:\n \"{R1a1} \n Id, (m1_step7 Rb A B Nb Kab) \n {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs runs1a1_def)\n\n\n\n\ntext \\All together now...\\\n\nlemmas PO_m1_trans_refines_m1a_trans = \n PO_m1_step1_refines_m1a_step1 PO_m1_step2_refines_m1a_step2\n PO_m1_step3_refines_m1a_step3 PO_m1_step4_refines_m1a_step4\n PO_m1_step5_refines_m1a_step5 PO_m1_step6_refines_m1a_skip \n PO_m1_step7_refines_m1a_skip PO_m1_leak_refines_m1a_leak\n\nlemma PO_m1_refines_init_m1a [iff]:\n \"init m1 \\ R1a1``(init m1a)\"\nby (auto simp add: R1a1_defs m1a_defs m1_loc_defs)\n\nlemma PO_m1_refines_trans_m1a [iff]:\n \"{R1a1} \n (trans m1a), (trans m1) \n {> R1a1}\"\napply (auto simp add: m1_def m1_trans_def m1a_def m1a_trans_def\n intro!: PO_m1_trans_refines_m1a_trans)\napply (force intro!: PO_m1_trans_refines_m1a_trans)+\ndone\n\n\ntext \\Observation consistency.\\\n\nlemma obs_consistent_med1a1 [iff]: \n \"obs_consistent R1a1 med1a1 m1a m1\"\nby (auto simp add: obs_consistent_def R1a1_def med1a1_def m1a_def m1_def)\n\n\ntext \\Refinement result.\\\n\nlemma PO_m1_refines_m1a [iff]: \n \"refines R1a1 med1a1 m1a m1\"\nby (rule Refinement_basic) (auto del: subsetI)\n\nlemma m1_implements_m1a [iff]: \"implements med1a1 m1a m1\"\nby (rule refinement_soundness) (fast)\n\n\n\nsubsubsection \\inv (inherited): Key secrecy\\\n(*invh**************************************************************************)\n\ntext \\Secrecy, as external and internal invariant\\\n\ndefinition \n m1_secrecy :: \"'x m1_pred\" where\n \"m1_secrecy \\ {s. knC (runs s) \\ azC (runs s) \\ Domain (leak s) \\ UNIV}\"\n\nlemmas m1_secrecyI = m1_secrecy_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_secrecyE [elim] = m1_secrecy_def [THEN setc_def_to_elim, rule_format]\n\n\nlemma PO_m1_obs_secrecy [iff]: \"oreach m1 \\ m1_secrecy\"\napply (rule_tac Q=m1x_secrecy in external_invariant_translation)\napply (auto del: subsetI)\napply (fastforce simp add: med1a1_def intro!: m1_secrecyI)\ndone\n\nlemma PO_m1_secrecy [iff]: \"reach m1 \\ m1_secrecy\"\nby (rule external_to_internal_invariant) (auto del: subsetI)\n\n(*\nsubsubsection {* inv (inherited): Disjointness of session and static keys *}\n(******************************************************************************)\n\nlemma PO_m1_inv0b_key [iff]: \"reach m1 \\ m1a_inv0b_key\"\napply (rule_tac Pa=m1a_inv0b_key and Qa=m1a_inv0b_key and Q=m1a_inv0b_key\n in internal_invariant_translation)\napply (auto del: subsetI)\napply (force simp add: med1a1_def runs1a1_def vimage_def m1a_inv0b_key_def)\ndone\n*)\n\nsubsubsection \\inv (inherited): Initiator auth server.\\\n(*invh*************************************************************************)\n\ntext \\Simplified version of invariant \\m1a_inv2i_serv\\.\\\n\ndefinition \n m1_inv2i_serv :: \"'x m1r_pred\" \nwhere\n \"m1_inv2i_serv \\ {s. \\A B Ra Na Kab nla.\n A \\ bad \\ \n runs s Ra = Some (Init, [A, B], aKey Kab # nla) \\\n Na = Ra$na \\\n (\\Rs. Kab = sesK (Rs$sk) \\ runs s Rs = Some (Serv, [A, B], [aNon Na]))\n }\"\n\nlemmas m1_inv2i_servI = m1_inv2i_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv2i_servE [elim] = m1_inv2i_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv2i_servD = m1_inv2i_serv_def [THEN setc_def_to_dest, rule_format, rotated 2]\n\n\ntext \\Proof of invariance.\\\n\nlemma PO_m1_inv2i_serv [iff]: \"reach m1 \\ m1_inv2i_serv\"\napply (rule_tac Pa=m1a_inv2i_serv and Qa=m1a_inv2i_serv and Q=m1_inv2i_serv\n in internal_invariant_translation)\napply (auto del: subsetI)\napply (auto simp add: m1a_inv2i_serv_def med1a1_def vimage_def \n intro!: m1_inv2i_servI)\napply (rename_tac s A B Ra Kab nla)\napply (drule_tac x=A in spec, clarsimp)\napply (drule_tac x=B in spec) \napply (drule_tac x=Ra in spec) \napply (drule_tac x=Kab in spec) \napply (clarsimp simp add: runs1a1_def)\ndone\n\ndeclare PO_m1_inv2i_serv [THEN subsetD, intro]\n\n\nsubsubsection \\inv (inherited): Responder auth server.\\\n(*invh*************************************************************************)\n\ntext \\Simplified version of invarant \\m1a_inv2r_serv\\.\\\n\ndefinition \n m1_inv2r_serv :: \"'x m1r_pred\"\nwhere\n \"m1_inv2r_serv \\ {s. \\A B Rb Kab nlb.\n B \\ bad \\ \n runs s Rb = Some (Resp, [A, B], aKey Kab # nlb) \\\n (\\Rs Na. Kab = sesK (Rs$sk) \\ runs s Rs = Some (Serv, [A, B], [aNon Na]))\n }\"\n\nlemmas m1_inv2r_servI = m1_inv2r_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv2r_servE [elim] = m1_inv2r_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv2r_servD = m1_inv2r_serv_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Proof of invariance.\\\n\nlemma PO_m1_inv2r_serv [iff]: \"reach m1 \\ m1_inv2r_serv\"\napply (rule_tac Pa=m1a_inv2r_serv and Qa=m1a_inv2r_serv and Q=m1_inv2r_serv\n in internal_invariant_translation)\napply (auto del: subsetI)\napply (auto simp add: simp add: m1a_inv2r_serv_def med1a1_def vimage_def \n intro!: m1_inv2r_servI)\napply (rename_tac s A B Rb Kab nlb)\napply (drule_tac x=A in spec)\napply (drule_tac x=B in spec, clarsimp) \napply (drule_tac x=Rb in spec)\napply (drule_tac x=Kab in spec) \napply (clarsimp simp add: runs1a1_def)\ndone\n\ndeclare PO_m1_inv2r_serv [THEN subsetD, intro]\n\n\nsubsubsection \\inv (inherited): Initiator key freshness\\\n(*invh*************************************************************************)\n\ndefinition \n m1_inv3_ifresh :: \"'x m1_pred\"\nwhere\n \"m1_inv3_ifresh \\ {s. \\A A' B B' Ra Ra' Kab nl nl'.\n runs s Ra = Some (Init, [A, B], aKey Kab # nl) \\\n runs s Ra' = Some (Init, [A', B'], aKey Kab # nl') \\\n A \\ bad \\ B \\ bad \\ Kab \\ Domain (leak s) \\\n Ra = Ra'\n }\"\n\nlemmas m1_inv3_ifreshI = m1_inv3_ifresh_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv3_ifreshE [elim] = m1_inv3_ifresh_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv3_ifreshD = m1_inv3_ifresh_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m1_inv3_ifresh [iff]: \"reach m1 \\ m1_inv3_ifresh\"\napply (rule_tac Pa=m1a_inv1_ifresh and Qa=m1a_inv1_ifresh and Q=m1_inv3_ifresh \n in internal_invariant_translation)\napply (auto del: subsetI)\napply (auto simp add: med1a1_def runs1a1_def vimage_def m1_inv3_ifresh_def)\ndone\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\a0i\\ for initiator/responder\\\n(******************************************************************************)\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed initiator and responder runs. For the initiator, \nwe get an injective agreement with the responder on Kab and Nb.\\\n\ntype_synonym\n irsig = \"key \\ nonce\"\n\nabbreviation\n ir_commit :: \"[runs_t, agent, agent, key, nonce] \\ rid_t set\" \nwhere\n \"ir_commit runz A B Kab Nb \\ {Ra. \n runz Ra = Some (Init, [A, B], [aKey Kab, aNon Nb])\n }\"\n\nfun\n ir_runs2sigs :: \"runs_t \\ irsig signal \\ nat\"\nwhere\n \"ir_runs2sigs runz (Commit [A, B] (Kab, Nb)) =\n card (ir_commit runz A B Kab Nb)\"\n\n| \"ir_runs2sigs runz (Running [A, B] (Kab, Nb)) =\n (if \\Rb nl. Nb = Rb$nb \\ runz Rb = Some (Resp, [A, B], aKey Kab # nl) \n then 1 else 0)\"\n\n| \"ir_runs2sigs runz _ = 0\"\n\n\ntext \\Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\\n\ndefinition \n med_a0im1_ir :: \"m1_obs \\ irsig a0i_obs\" where\n \"med_a0im1_ir o1 \\ \\ signals = ir_runs2sigs (runs o1), corrupted = Domain (leak o1) \\ UNIV \\\"\n\ndefinition\n R_a0im1_ir :: \"(irsig a0i_state \\ m1_state) set\" where\n \"R_a0im1_ir \\ {(s, t). signals s = ir_runs2sigs (runs t) \\ corrupted s = Domain (leak t) \\ UNIV}\"\n\nlemmas R_a0im1_ir_defs = R_a0im1_ir_def med_a0im1_ir_def \n\n\nsubsubsection \\Lemmas about the abstraction function\\\n(******************************************************************************)\n\nlemma ir_runs2sigs_empty [simp]: \n \"runz = Map.empty \\ ir_runs2sigs runz = (\\s. 0)\"\nby (rule ext, erule rev_mp) \n (rule ir_runs2sigs.induct, auto)\n\nlemma finite_ir_commit [simp, intro!]: \n \"finite (dom runz) \\ finite (ir_commit runz A B Kab Nb)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\Update lemmas\\\n\nlemma ir_runs2sigs_upd_init_none [simp]:\n \"\\ Ra \\ dom runz \\\n \\ ir_runs2sigs (runz(Ra \\ (Init, [A, B], []))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_resp_none [simp]:\n \"\\ Rb \\ dom runz \\\n \\ ir_runs2sigs (runz(Rb \\ (Resp, [A, B], []))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_serv_none [simp]:\n \"\\ Rs \\ dom runz \\\n \\ ir_runs2sigs (runz(Rs \\ (Serv, [A, B], nl))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_init_some [simp]:\n \"\\ runz Ra = Some (Init, [A, B], []) \\\n \\ ir_runs2sigs (runz(Ra \\ (Init, [A, B], [aKey Kab]))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ir_runs2sigs.induct, auto)\n\nlemma ir_runs2sigs_upd_resp [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], []) \\\n \\ ir_runs2sigs (runz(Rb \\ (Resp, [A, B], [aKey Kab]))) =\n (ir_runs2sigs runz)(Running [A, B] (Kab, Rb$nb) := 1)\"\napply (rule ext, erule rev_mp) \napply (rule ir_runs2sigs.induct, fastforce+) \ndone\n\nlemma ir_runs2sigs_upd_init [simp]:\n \"\\ runz Ra = Some (Init, [A, B], [aKey Kab]); finite (dom runz) \\\n \\ ir_runs2sigs (runz(Ra \\ (Init, [A, B], [aKey Kab, aNon Nb]))) = \n (ir_runs2sigs runz)\n (Commit [A, B] (Kab, Nb) := Suc (card (ir_commit runz A B Kab Nb)))\"\napply (rule ext, erule rev_mp, erule rev_mp) \napply (rule_tac ?a0.0=runz in ir_runs2sigs.induct, auto)\n\\ \\1 subgoal, solved using @{thm \"card_insert_disjoint\"}\\\napply (rename_tac runz)\napply (rule_tac \n s=\"card (insert Ra (ir_commit runz A B Kab Nb))\" \n in trans, fast, auto)\ndone\n\nlemma ir_runs2sigs_upd_resp_some [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], [aKey K]) \\\n \\ ir_runs2sigs (runz(Rb \\ (Resp, [A, B], [aKey K, END]))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n (rule ir_runs2sigs.induct, fastforce+)\n\n\ntext \\Needed for injectiveness of agreement.\\\n\nlemma m1_inv2i_serv_lemma:\n \"\\ runs t Ra = Some (Init, [A, B], [aKey Kab, aNon Nb]);\n runs t Ra' = Some (Init, [A, B], [aKey Kab]); \n A \\ bad; t \\ m1_inv2i_serv \\\n \\ P\"\napply (frule m1_inv2i_servD, auto)\napply (rotate_tac 1)\napply (frule m1_inv2i_servD, auto) \ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_ir_a0i_skip:\n \"{R_a0im1_ir} \n Id, (m1_step1 Ra A B Na) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step2_refines_ir_a0i_skip:\n \"{R_a0im1_ir} \n Id, (m1_step2 Rb A B) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step3_refines_ir_a0i_skip:\n \"{R_a0im1_ir} \n Id, (m1_step3 Rs A B Na Kab) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step4_refines_ir_a0i_skip:\n \"{R_a0im1_ir} \n Id, (m1_step4 Ra A B Na Kab) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step5_refines_ir_a0i_running:\n \"{R_a0im1_ir} \n (a0i_running [A, B] (Kab, Nb)), (m1_step5 Rb A B Nb Kab) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step6_refines_ir_a0i_commit:\n \"{R_a0im1_ir \\ UNIV \\ (m1_inv2i_serv \\ m1_inv0_fin)} \n (a0i_commit [A, B] (Kab, Nb)), (m1_step6 Ra A B Na Nb Kab) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs a0i_defs m1_defs, safe, auto)\n (auto dest: m1_inv2i_serv_lemma)\n\nlemma PO_m1_step7_refines_ir_a0i_skip:\n \"{R_a0im1_ir} \n Id, (m1_step7 Rb A B Nb Kab) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_leak_refines_ir_a0i_corrupt:\n \"{R_a0im1_ir} \n (a0i_corrupt ({sesK (Rs$sk)} \\ UNIV)), (m1_leak Rs Ra Rb A B) \n {> R_a0im1_ir}\"\nby (simp add: PO_rhoare_defs R_a0im1_ir_defs a0i_defs m1_defs, safe, auto)\n\n\ntext \\All together now...\\\n\nlemmas PO_m1_trans_refines_ir_a0i_trans = \n PO_m1_step1_refines_ir_a0i_skip PO_m1_step2_refines_ir_a0i_skip\n PO_m1_step3_refines_ir_a0i_skip PO_m1_step4_refines_ir_a0i_skip\n PO_m1_step5_refines_ir_a0i_running PO_m1_step6_refines_ir_a0i_commit\n PO_m1_step7_refines_ir_a0i_skip PO_m1_leak_refines_ir_a0i_corrupt \n\nlemma PO_m1_refines_ir_init_a0i [iff]:\n \"init m1 \\ R_a0im1_ir``(init a0i)\"\nby (auto simp add: R_a0im1_ir_defs a0i_defs m1_defs\n intro!: exI [where x=\"\\signals = \\s. 0, corrupted = corrKey \\ UNIV \\\"])\n\nlemma PO_m1_refines_ir_trans_a0i [iff]:\n \"{R_a0im1_ir \\ reach a0i \\ reach m1} \n (trans a0i), (trans m1) \n {> R_a0im1_ir}\"\napply (rule_tac pre'=\"R_a0im1_ir \\ UNIV \\ (m1_inv2i_serv \\ m1_inv0_fin)\" \n in relhoare_conseq_left, auto)\napply (auto simp add: m1_def m1_trans_def a0i_def a0i_trans_def\n intro!: PO_m1_trans_refines_ir_a0i_trans)\ndone\n\n\ntext \\Observation consistency.\\\n\nlemma obs_consistent_med_a0im1_ir [iff]: \n \"obs_consistent R_a0im1_ir med_a0im1_ir a0i m1\"\nby (auto simp add: obs_consistent_def R_a0im1_ir_def med_a0im1_ir_def \n a0i_def m1_def)\n\ntext \\Refinement result.\\\n\nlemma PO_m1_refines_ir_a0i [iff]: \n \"refines \n (R_a0im1_ir \\ reach a0i \\ reach m1)\n med_a0im1_ir a0i m1\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m1_implements_ir_a0i: \"implements med_a0im1_ir a0i m1\"\nby (rule refinement_soundness) (fast)\n\n\n(******************************************************************************)\nsubsection \\Refinement of \\a0i\\ for responder/initiator\\\n(******************************************************************************)\n\nsubsubsection \\Simulation relation\\\n(******************************************************************************)\n\ntext \\We define two auxiliary functions to reconstruct the signals of the\ninitial model from initiator and responder runs. For the responder, we get an \ninjective agreement with the initiator on Kab and Nb.\\\n\ntype_synonym\n risig = \"key \\ nonce\"\n\nabbreviation\n ri_running :: \"[runs_t, agent, agent, key, nonce] \\ rid_t set\"\nwhere\n \"ri_running runz A B Kab Nb \\ {Ra. \n runz Ra = Some (Init, [A, B], [aKey Kab, aNon Nb])\n }\"\n\nfun\n ri_runs2sigs :: \"runs_t \\ risig signal \\ nat\"\nwhere\n \"ri_runs2sigs runz (Commit [B, A] (Kab, Nb)) = \n (if \\Rb. Nb = Rb$nb \\ runz Rb = Some (Resp, [A, B], [aKey Kab, END]) \n then 1 else 0)\"\n\n| \"ri_runs2sigs runz (Running [B, A] (Kab, Nb)) = \n card (ri_running runz A B Kab Nb)\"\n\n| \"ri_runs2sigs runz _ = 0\"\n\n\ntext \\Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\\n\ndefinition \n med_a0im1_ri :: \"m1_obs \\ risig a0i_obs\" where\n \"med_a0im1_ri o1 \\ \\ signals = ri_runs2sigs (runs o1), corrupted = Domain (leak o1) \\ UNIV \\\"\n\ndefinition\n R_a0im1_ri :: \"(risig a0i_state \\ m1_state) set\" where\n \"R_a0im1_ri \\ {(s, t). signals s = ri_runs2sigs (runs t) \\ corrupted s = Domain (leak t) \\ UNIV}\"\n\nlemmas R_a0im1_ri_defs = R_a0im1_ri_def med_a0im1_ri_def \n\n\nsubsubsection \\Lemmas about the auxiliary functions\\\n(******************************************************************************)\n\nlemma ri_runs2sigs_empty [simp]: \n \"runz = Map.empty \\ ri_runs2sigs runz = (\\s. 0)\"\nby (rule ext, erule rev_mp) \n (rule ri_runs2sigs.induct, auto)\n\nlemma finite_inv_ri_running [simp, intro!]: \n \"finite (dom runz) \\ finite (ri_running runz A B Kab Nb)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\Update lemmas\\\n\nlemma ri_runs2sigs_upd_init_none [simp]:\n \"\\ Na \\ dom runz \\\n \\ ri_runs2sigs (runz(Na \\ (Init, [A, B], []))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ri_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_resp_none [simp]:\n \"\\ Rb \\ dom runz \\\n \\ ri_runs2sigs (runz(Rb \\ (Resp, [A, B], []))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ri_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_serv_none [simp]:\n \"\\ Rs \\ dom runz \\\n \\ ri_runs2sigs (runz(Rs \\ (Serv, [A, B], nl))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ri_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_init [simp]:\n \"\\ runz Ra = Some (Init, [A, B], [aKey Kab]); finite (dom runz) \\\n \\ ri_runs2sigs (runz(Ra \\ (Init, [A, B], [aKey Kab, aNon Nb]))) =\n (ri_runs2sigs runz)\n (Running [B, A] (Kab, Nb) := Suc (card (ri_running runz A B Kab Nb)))\"\napply (rule ext, erule rev_mp, erule rev_mp)\napply (rule_tac ?a0.0=runz in ri_runs2sigs.induct, auto)\n\\ \\1 subgoal, solved using @{thm \"card_insert_disjoint\"}\\\napply (rename_tac runz)\napply (rule_tac \n s=\"card (insert Ra (ri_running runz A B Kab Nb))\" \n in trans, fast, auto)\ndone\n\nlemma ri_runs2sigs_upd_init_some [simp]:\n \"\\ runz Ra = Some (Init, [A, B], []) \\\n \\ ri_runs2sigs (runz(Ra \\ (Init, [A, B], [aKey Kab]))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ri_runs2sigs.induct, auto)\n\nlemma ri_runs2sigs_upd_resp_some [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], [])\\\n \\ ri_runs2sigs (runz(Rb \\ (Resp, [A, B], [aKey K]))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp)\n (rule ri_runs2sigs.induct, auto)\n\nlemma ri_runs2sigs_upd_resp_some2 [simp]:\n \"\\ runz Rb = Some (Resp, [A, B], [aKey Kab]) \\\n \\ ri_runs2sigs (runz(Rb \\ (Resp, [A, B], [aKey Kab, END]))) = \n (ri_runs2sigs runz)(Commit [B, A] (Kab, Rb$nb) := 1)\"\napply (rule ext, erule rev_mp)\napply (rule ri_runs2sigs.induct, fastforce+)\ndone\n\n\nsubsubsection \\Refinement proof\\\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_ri_a0i_skip:\n \"{R_a0im1_ri} \n Id, (m1_step1 Ra A B Na) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs m1_defs, safe, auto)\n\nlemma PO_m1_step2_refines_ri_a0i_skip:\n \"{R_a0im1_ri} \n Id, (m1_step2 Rb A B) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs m1_defs, safe, auto)\n\nlemma PO_m1_step3_refines_ri_a0i_skip:\n \"{R_a0im1_ri} \n Id, (m1_step3 Rs A B Na Kab) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step4_refines_ri_a0i_skip:\n \"{R_a0im1_ri} \n Id, (m1_step4 Ra A B Nb Kab) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step5_refines_ri_a0i_skip:\n \"{R_a0im1_ri} \n Id, (m1_step5 Rb A B Nb Kab) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs a0i_defs m1_defs, safe, auto)\n\n\n\nlemma PO_m1_step7_refines_ri_a0i_commit:\n \"{R_a0im1_ri \\ UNIV \\ m1_inv0_fin} \n (a0i_commit [B, A] (Kab, Nb)), (m1_step7 Rb A B Nb Kab) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_leak_refines_ri_a0i_corrupt:\n \"{R_a0im1_ri} \n (a0i_corrupt ({sesK (Rs$sk)} \\ UNIV)), (m1_leak Rs Ra Rb A B) \n {> R_a0im1_ri}\"\nby (simp add: PO_rhoare_defs R_a0im1_ri_defs a0i_defs m1_defs, safe, auto)\n\n\ntext \\All together now...\\\n\nlemmas PO_m1_trans_refines_ri_a0i_trans = \n PO_m1_step1_refines_ri_a0i_skip PO_m1_step2_refines_ri_a0i_skip\n PO_m1_step3_refines_ri_a0i_skip PO_m1_step4_refines_ri_a0i_skip\n PO_m1_step5_refines_ri_a0i_skip PO_m1_step6_refines_ri_a0i_running\n PO_m1_step7_refines_ri_a0i_commit PO_m1_leak_refines_ri_a0i_corrupt\n\nlemma PO_m1_refines_ri_init_a0i [iff]:\n \"init m1 \\ R_a0im1_ri``(init a0i)\"\nby (auto simp add: R_a0im1_ri_defs a0i_defs m1_defs\n intro!: exI [where x=\"\\signals = \\s. 0, corrupted = corrKey \\ UNIV \\\"])\n\nlemma PO_m1_refines_ri_trans_a0i [iff]:\n \"{R_a0im1_ri \\ a0i_inv1_iagree \\ m1_inv0_fin} \n (trans a0i), (trans m1) \n {> R_a0im1_ri}\"\nby (auto simp add: m1_def m1_trans_def a0i_def a0i_trans_def)\n (blast intro!: PO_m1_trans_refines_ri_a0i_trans)+\n\n\ntext \\Observation consistency.\\\n\nlemma obs_consistent_med_a0im1_ri [iff]: \n \"obs_consistent R_a0im1_ri med_a0im1_ri a0i m1\"\nby (auto simp add: obs_consistent_def R_a0im1_ri_def med_a0im1_ri_def a0i_def m1_def)\n\n\ntext \\Refinement result.\\\n\nlemma PO_m1_refines_ri_a0i [iff]: \n \"refines (R_a0im1_ri \\ a0i_inv1_iagree \\ m1_inv0_fin) med_a0im1_ri a0i m1\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma m1_implements_ri_a0i: \"implements med_a0im1_ri a0i m1\"\nby (rule refinement_soundness) (fast)\n\n\nsubsubsection \\inv3 (inherited): Responder and initiator\\\n(*invh*************************************************************************)\n\ntext \\This is a translation of the agreement property to Level 1. It\nfollows from the refinement and is needed to prove inv4.\\\n\ndefinition \n m1_inv3r_init :: \"'x m1_pred\"\nwhere\n \"m1_inv3r_init \\ {s. \\A B Rb Kab.\n B \\ bad \\ A \\ bad \\ Kab \\ Domain (leak s) \\\n runs s Rb = Some (Resp, [A, B], [aKey Kab, END]) \\\n (\\Ra nla. runs s Ra = Some (Init, [A, B], aKey Kab # aNon (Rb$nb) # nla))\n }\"\n\nlemmas m1_inv3r_initI = \n m1_inv3r_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv3r_initE [elim] = \n m1_inv3r_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv3r_initD = \n m1_inv3r_init_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m1_inv3r_init [iff]: \"reach m1 \\ m1_inv3r_init\"\napply (rule INV_from_Refinement_basic [OF PO_m1_refines_ri_a0i])\napply (auto simp add: R_a0im1_ri_def a0i_inv1_iagree_def\n intro!: m1_inv3r_initI)\napply (rename_tac s A B Rb Kab a)\napply (drule_tac x=\"[B, A]\" in spec, clarsimp)\napply (drule_tac x=\"Kab\" in spec)\n(* apply (drule_tac x=\"Rb$nb\" in spec, auto) *)\napply (subgoal_tac \"card (ri_running (runs s) A B Kab (Rb$nb)) > 0\", auto) \ndone\n\n\nsubsubsection \\inv4: Key freshness for responder\\\n(*inv**************************************************************************)\n\ndefinition \n m1_inv4_rfresh :: \"'x m1_pred\"\nwhere\n \"m1_inv4_rfresh \\ {s. \\Rb Rb' A A' B B' Kab.\n runs s Rb = Some (Resp, [A, B ], [aKey Kab, END]) \\ \n runs s Rb' = Some (Resp, [A', B'], [aKey Kab, END]) \\ \n B \\ bad \\ A \\ bad \\ Kab \\ Domain (leak s) \\\n Rb = Rb'\n }\"\n\nlemmas m1_inv4_rfreshI = m1_inv4_rfresh_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv4_rfreshE [elim] = m1_inv4_rfresh_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv4_rfreshD = m1_inv4_rfresh_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Proof of key freshness for responder\\\n\nlemma PO_m1_inv4_rfresh_init [iff]:\n \"init m1 \\ m1_inv4_rfresh\"\nby (auto simp add: m1_defs intro!: m1_inv4_rfreshI)\n\nlemma PO_m1_inv4_rfresh_trans [iff]:\n \"{m1_inv4_rfresh \\ m1_inv3r_init \\ m1_inv2r_serv \\ m1_inv3_ifresh \\ m1_secrecy} \n trans m1 \n {> m1_inv4_rfresh}\"\napply (simp add: PO_hoare_defs m1_defs, safe intro!: m1_inv4_rfreshI, simp_all)\napply (auto dest: m1_inv4_rfreshD) \n\n\\ \\4 subgoals, from responder's final step 7\\ \n apply (rename_tac Rb A A' B B' Kab xa xe)\n apply (frule_tac B=B in m1_inv2r_servD, fast, fast, clarsimp)\n apply (case_tac \"B' \\ bad\", auto dest: m1_inv2r_servD)\n apply (subgoal_tac \"(sesK (Rs$sk), B') \\ azC (runs xa)\")\n prefer 2 apply (erule m1_secrecyE, auto)\n apply (erule azC.cases, auto)\n\n apply (rename_tac Rb A A' B B' Kab xa xe)\n apply (frule_tac B=B in m1_inv2r_servD, fast, fast, clarify)\n apply (subgoal_tac \"(sesK (Rs$sk), B') \\ azC (runs xa)\")\n prefer 2 apply (erule m1_secrecyE, auto)\n apply (erule azC.cases, auto)\n\n apply (rename_tac Rb' A A' B B' Kab xa xe Ra)\n apply (case_tac \"A' \\ bad \\ B' \\ bad\", auto)\n apply (frule m1_inv3r_initD, auto)\n apply (rename_tac Raa nla)\n apply (frule_tac Ra=Ra in m1_inv3_ifreshD, auto)\n apply (subgoal_tac \"Ra = Raa\", auto)\n\n \\ \\@{text \"A' \\ bad\"}\\\n apply (frule_tac B=B in m1_inv2r_servD, fast, fast, clarify) \n apply (rename_tac Rs Na) \n apply (case_tac \"B' \\ bad\", auto dest: m1_inv2r_servD) \n apply (subgoal_tac \"(sesK (Rs$sk), B') \\ azC (runs xa)\")\n prefer 2 apply (erule m1_secrecyE, auto)\n apply (erule azC.cases, auto)\n\n \\ \\@{text \"B' \\ bad\"}\\\n apply (frule_tac B=B in m1_inv2r_servD, fast, fast, clarify)\n apply (rename_tac Rs Na) \n apply (subgoal_tac \"(sesK (Rs$sk), B') \\ azC (runs xa)\")\n prefer 2 apply (erule m1_secrecyE, auto)\n apply (erule azC.cases, auto)\n\n apply (frule m1_inv3r_initD, auto)\n apply (rename_tac Raa nla)\n apply (subgoal_tac \"Raa = Ra\", auto)\ndone\n\nlemma PO_m1_inv4_rfresh [iff]: \"reach m1 \\ m1_inv4_rfresh\"\napply (rule_tac \n J=\"m1_inv3r_init \\ m1_inv2r_serv \\ m1_inv3_ifresh \\ m1_secrecy\" \n in inv_rule_incr) \napply (auto simp add: Int_assoc del: subsetI)\ndone\n\nlemma PO_m1_obs_inv4_rfresh [iff]: \"oreach m1 \\ m1_inv4_rfresh\"\nby (rule external_from_internal_invariant)\n (auto del: subsetI)\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m1_nssk.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.2690980317527401}} {"text": "theory IICF_Array\nimports \"../Intf/IICF_List\" \nbegin\n\n\n\n\nsection \\Plain Arrays Implementing List Interface\\\n\nsubsection \\Abstract Replicate-Init Operation\\\n definition [simp]: \"replicate_init_raw n \\ replicate n init\"\n\n locale replicate_init = \n fixes repl :: \"'a \\ nat \\ 'a list\" \n assumes repl_def[simp]: \"repl i n = replicate n i\"\n begin\n \n context fixes i::'a begin\n sepref_register \"repl i\" \n end\n \n lemma replicate_init_param:\n fixes A :: \"'a \\ 'c::llvm_rep \\ assn\"\n assumes INIT: \"GEN_ALGO i (is_init A)\"\n shows \"(RETURN o replicate_init_raw, RETURN o PR_CONST (repl i)) \\ nat_rel \\\\<^sub>f \\\\the_pure A\\list_rel\\nres_rel\"\n proof -\n from INIT have [param]: \"(init,i) \\ the_pure A\" unfolding is_init_def GEN_ALGO_def by simp\n show ?thesis\n unfolding repl_def replicate_init_raw_def PR_CONST_def \n apply (rule frefI)\n apply (parametricity)\n done\n \n qed\n \n lemma fold_replicate_init: \"replicate n i = repl i n\" by simp\n end\n \n \n sepref_decl_op list_free: \"\\_::_ list. ()\" :: \"\\A\\list_rel \\ unit_rel\" .\n\n \n\nsubsection \\Definition of Assertion\\\n\n text \\Lists of fixed length are directly implemented with arrays. \\\n \n hide_const (open) LLVM_DS_Array.array_assn\n \n abbreviation \"raw_array_assn \\ \\LLVM_DS_NArray.narray_assn\"\n\n definition array_assn where \"array_assn A \\ hr_comp raw_array_assn (\\the_pure A\\list_rel)\"\n lemmas [safe_constraint_rules] = CN_FALSEI[of is_pure \"array_assn A\" for A]\n\nsubsection \\Interface Implementation\\ \n \ndefinition [simp]: \"array_replicate_init i n \\ replicate n i\"\ninterpretation array: replicate_init array_replicate_init by unfold_locales simp\n\ncontext \n notes [fcomp_norm_unfold] = array_assn_def[symmetric]\n (*notes [simp] = pure_def hn_ctxt_def is_array_def invalid_assn_def*)\nbegin \n\n lemma array_get_hnr_aux: \"(uncurry array_nth,uncurry (RETURN oo op_list_get)) \n \\ [\\(l,i). ia raw_array_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\ id_assn\" \n unfolding snat_rel_def snat.assn_is_rel[symmetric]\n apply sepref_to_hoare\n apply vcg'\n done\n \n sepref_decl_impl array_get: array_get_hnr_aux . \n\n lemma array_set_hnr_aux: \"(uncurry2 array_upd,uncurry2 (RETURN ooo op_list_set)) \n \\ [\\((l,i),_). ia raw_array_assn\\<^sup>d *\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\ raw_array_assn\" \n unfolding snat_rel_def snat.assn_is_rel[symmetric] \n apply sepref_to_hoare\n apply (clarsimp simp: invalid_assn_def)\n apply (rule htriple_pure_preI, ((determ \\drule pure_part_split_conj|erule conjE\\)+)?)\n apply vcg\n done\n \n sepref_decl_impl array_set: array_set_hnr_aux .\n \n lemma hn_array_repl_init_raw:\n shows \"(narray_new TYPE('c::llvm_rep),RETURN o replicate_init_raw) \\ snat_assn\\<^sup>k \\\\<^sub>a raw_array_assn\"\n unfolding snat_rel_def snat.assn_is_rel[symmetric]\n apply sepref_to_hoare\n apply vcg'\n done\n\n sepref_decl_impl (no_mop) hn_array_repl_init_raw uses array.replicate_init_param . \n \n \n term op_list_replicate\n \n sepref_decl_op array_custom_replicate: op_list_replicate :: \"nat_rel \\ A \\ \\A\\list_rel\" .\n \n lemma hn_array_replicate_new_raw:\n \"(uncurry narray_new_init, uncurry (RETURN oo op_array_custom_replicate)) \\ snat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a raw_array_assn\"\n unfolding snat_rel_def snat.assn_is_rel[symmetric]\n apply sepref_to_hoare\n by vcg\n \n sepref_decl_impl hn_array_replicate_new_raw .\n \n lemma array_fold_custom_replicate: \n \"replicate = op_array_custom_replicate\"\n \"op_list_replicate = op_array_custom_replicate\"\n \"mop_list_replicate = mop_array_custom_replicate\"\n by (auto del: ext intro!: ext)\n \n lemma hn_array_free_raw: \"(narray_free,RETURN o op_list_free) \\ raw_array_assn\\<^sup>d \\\\<^sub>a unit_assn\"\n by sepref_to_hoare vcg\n \n sepref_decl_impl array_free: hn_array_free_raw .\n lemmas array_mk_free[sepref_frame_free_rules] = hn_MK_FREEI[OF array_free_hnr]\n \nend \n \n \n \nsection \\Arrays with Length\\\n\ndefinition \"larray1_rel = br snd (\\(n,xs). n = length xs)\"\nabbreviation \"larray_impl_assn' TYPE('b::len2) \\ snat_assn' TYPE('b) \\\\<^sub>a array_assn id_assn\"\ndefinition \"raw_larray_assn \\ hr_comp (larray_impl_assn' TYPE(_)) larray1_rel\"\n\ndefinition \"larray_assn A \\ hr_comp raw_larray_assn (\\the_pure A\\list_rel)\"\n\nabbreviation larray_assn' \n :: \"'b itself \\ ('a \\ 'c \\ llvm_amemory \\ bool) \\ 'a list \\ 'b::len2 word \\ 'c::llvm_rep ptr \\ llvm_amemory \\ bool\" \n where\n \"larray_assn' _ == larray_assn\"\n\n\nlemma larray1_rel_prenorm: \"((n, xs), ys) \\ larray1_rel \\ n = length ys \\ xs=ys\" \n by (auto simp: larray1_rel_def in_br_conv)\n\n\ndefinition [simp]: \"larray_replicate_init i n \\ replicate n i\"\ninterpretation larray: replicate_init larray_replicate_init by unfold_locales simp\n \n\ncontext \n notes [fcomp_norm_unfold] = raw_larray_assn_def[symmetric] larray_assn_def[symmetric]\n notes [fcomp_prenorm_simps] = larray1_rel_prenorm\nbegin\n\nsepref_decl_op larray_custom_replicate: op_list_replicate :: \"nat_rel \\ A \\ \\A\\list_rel\" .\n\ndefinition \"la_replicate1 n i \\ (n, replicate n i)\"\nlemma la_replicate1_refine: \"(la_replicate1,op_larray_custom_replicate) \\ nat_rel \\ Id \\ larray1_rel\"\n by (auto simp: larray1_rel_def in_br_conv la_replicate1_def)\n \nsepref_definition la_replicate_impl [llvm_inline] is \"uncurry (RETURN oo la_replicate1)\" \n :: \"(snat_assn' TYPE('b::len2))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a larray_impl_assn' TYPE('b::len2)\"\n unfolding la_replicate1_def \n apply (rewrite array_fold_custom_replicate)\n apply sepref_dbg_keep\n done\n \nsepref_decl_impl la_replicate_impl.refine[FCOMP la_replicate1_refine] . \n\nlemma larray_fold_custom_replicate: \n \"replicate = op_larray_custom_replicate\"\n \"op_list_replicate = op_larray_custom_replicate\"\n \"mop_list_replicate = mop_larray_custom_replicate\"\n by (auto del: ext intro!: ext)\n\n\n\ndefinition \"la_replicate_init1 n \\ (n, array_replicate_init init n)\"\nlemma la_replicate_init1_refine: \"(la_replicate_init1, replicate_init_raw) \\ nat_rel \\ larray1_rel\"\n by (auto simp: larray1_rel_def in_br_conv la_replicate_init1_def)\n \n \nsepref_definition la_replicate_init_impl [llvm_inline] is \"(RETURN o la_replicate_init1)\" \n :: \"(snat_assn' TYPE('b::len2))\\<^sup>k \\\\<^sub>a larray_impl_assn' TYPE('b::len2)\"\n unfolding la_replicate_init1_def \n apply sepref_dbg_keep\n done\n\nsepref_decl_impl (no_mop) la_replicate_init_impl.refine[FCOMP la_replicate_init1_refine] uses larray.replicate_init_param .\n \n\ndefinition \"la_length1 nxs \\ case nxs of (n,_) \\ id n\"\nlemma la_length1_refine: \"(la_length1,op_list_length) \\ larray1_rel \\ nat_rel\"\n by (auto simp: larray1_rel_def in_br_conv la_length1_def)\n\nsepref_definition la_length_impl [llvm_inline] is \"RETURN o la_length1\" :: \"(larray_impl_assn' TYPE('b::len2))\\<^sup>k \\\\<^sub>a snat_assn' TYPE('b)\"\n unfolding la_length1_def \n apply sepref_dbg_keep\n done\n \nsepref_decl_impl la_length_impl.refine[FCOMP la_length1_refine] . \n\n\n \ndefinition \"la_is_empty1 nxs \\ case nxs of (n,_) \\ n=0\"\nlemma la_is_empty1_refine: \"(la_is_empty1,op_list_is_empty) \\ larray1_rel \\ bool_rel\"\n by (auto simp: larray1_rel_def in_br_conv la_is_empty1_def)\n \nsepref_definition la_is_empty_impl [llvm_inline] is \"RETURN o la_is_empty1\" :: \"(larray_impl_assn' TYPE('b::len2))\\<^sup>k \\\\<^sub>a bool1_assn\"\n unfolding la_is_empty1_def \n apply (annot_snat_const \"TYPE('b)\")\n apply sepref_dbg_keep\n done\n\nsepref_decl_impl la_is_empty_impl.refine[FCOMP la_is_empty1_refine] . \n \n\n \ndefinition \"la_get1 nxs i \\ case nxs of (n,xs) \\ xs!i\"\nlemma la_get1_refine: \"(la_get1,op_list_get) \\ larray1_rel \\ nat_rel \\ Id\"\n by (auto simp: larray1_rel_def in_br_conv la_get1_def)\n \nsepref_definition la_get_impl [llvm_inline] is \"uncurry (RETURN oo la_get1)\" :: \"[\\(la,i). ia (larray_impl_assn' TYPE('b::len2))\\<^sup>k *\\<^sub>a (snat_assn' TYPE('b))\\<^sup>k \\ id_assn\"\n unfolding la_get1_def la_length1_def\n apply sepref_dbg_keep\n done\n \nsepref_decl_impl la_get_impl.refine[FCOMP la_get1_refine] .\n \n\ndefinition \"la_set1 nxs i x \\ case nxs of (n,xs) \\ (n,xs[i:=x])\"\nlemma la_set1_refine: \"(la_set1,op_list_set) \\ larray1_rel \\ nat_rel \\ Id \\ larray1_rel\"\n by (auto simp: larray1_rel_def in_br_conv la_set1_def)\n \nsepref_definition la_set_impl [llvm_inline] is \"uncurry2 (RETURN ooo la_set1)\" \n :: \"[\\((la,i),_). ia (larray_impl_assn' TYPE('b::len2))\\<^sup>d *\\<^sub>a (snat_assn' TYPE('b))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\ larray_impl_assn' TYPE('b::len2)\"\n unfolding la_set1_def\n apply sepref_dbg_keep\n done\n \nsepref_decl_impl la_set_impl.refine[FCOMP la_set1_refine] .\n\ndefinition \"la_free1 nxs \\ case nxs of (_,xs) \\ op_list_free xs\"\nlemma la_free1_refine: \"(la_free1,op_list_free) \\ larray1_rel \\ unit_rel\" by auto\n\nsepref_definition la_free_impl [llvm_inline] is \"RETURN o la_free1\" :: \"(larray_impl_assn' TYPE(_))\\<^sup>d \\\\<^sub>a unit_assn\"\n unfolding la_free1_def\n by sepref\n\nsepref_decl_impl larray_free: la_free_impl.refine[FCOMP la_free1_refine] .\nlemmas larray_mk_free[sepref_frame_free_rules] = hn_MK_FREEI[OF larray_free_hnr]\n \nend\n \n\n\nsubsection \\Ad-Hoc Regression Tests\\\n \nsepref_definition example1 [llvm_code] is \"\\n. RETURN (replicate (n+1) (snat_init TYPE(32)))\" \n :: \"[\\n. n\\{1..<150}]\\<^sub>a (snat_assn' TYPE(32))\\<^sup>k \\ array_assn (snat_assn' TYPE(32))\"\n supply [simp] = max_snat_def\n apply (annot_snat_const \"TYPE(32)\")\n apply (rewrite array.fold_replicate_init)\n apply sepref_dbg_keep\n done\n \nsepref_definition example2 [llvm_code] is \\\\n. do {\n ASSERT (n>10);\n let a = replicate n (snat_const TYPE(64) 42);\n let a = a[snat_const TYPE(32) 3:=0];\n ASSERT (a!1=42 \\ a!2=42);\n RETURN (a!snat_const TYPE(32) 1 + a!snat_const TYPE(32) 2)\n}\\ :: \"(snat_assn' TYPE(32))\\<^sup>k \\\\<^sub>a snat_assn' TYPE(64)\"\n supply [simp] = max_snat_def\n apply (annot_snat_const \"TYPE(64)\")\n apply (rewrite array_fold_custom_replicate)\n apply sepref_dbg_keep\n done\n \n \nsepref_definition example1n [llvm_code] is \"\\n. RETURN (replicate (n+1) (snat_init TYPE(8)))\" \n :: \"[\\n. n\\{1..<150}]\\<^sub>a (snat_assn' TYPE(32))\\<^sup>k \\ larray_assn' TYPE(32) (snat_assn' TYPE(8))\"\n supply [simp] = max_snat_def\n apply (rewrite larray.fold_replicate_init)\n apply (annot_snat_const \"TYPE(32)\")\n apply sepref_dbg_keep\n done\n \n \nsepref_definition example2n [llvm_code] is \\\\n. do {\n ASSERT (n>10);\n let a = replicate n (snat_const TYPE(64) 42);\n let a = a[snat_const TYPE(32) 3:=0];\n ASSERT (a!1=42 \\ a!2=42);\n RETURN (a!snat_const TYPE(32) 1 + a!snat_const TYPE(32) 2)\n}\\ :: \"(snat_assn' TYPE(32))\\<^sup>k \\\\<^sub>a snat_assn' TYPE(64)\"\n supply [simp] = max_snat_def\n apply (annot_snat_const \"TYPE(64)\")\n apply (rewrite larray_fold_custom_replicate)\n apply sepref_dbg_keep\n done\n\n \nexport_llvm example1 example2 example1n example2n\n \n \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/IICF/Impl/IICF_Array.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.26909803175274005}} {"text": "section\\Simple Firewall Syntax\\\ntheory SimpleFw_Syntax\nimports IP_Addresses.Hs_Compat\n Firewall_Common_Decision_State\n \"Primitives/Iface\"\n \"Primitives/L4_Protocol\"\n Simple_Packet\nbegin\n\n text\\For for IP addresses of arbitrary length\\\n\n datatype simple_action = Accept | Drop\n \n text\\Simple match expressions do not allow negated expressions.\n However, Most match expressions can still be transformed into simple match expressions.\n \n A negated IP address range can be represented as a set of non-negated IP ranges.\n For example \\!8 = {0..7} \\ {8 .. ipv4max}\\.\n Using CIDR notation (i.e. the \\a.b.c.d/n\\ notation), we can represent negated IP\n ranges as a set of non-negated IP ranges with only fair blowup.\n Another handy result is that the conjunction of two IP ranges in CIDR notation is \n either the smaller of the two ranges or the empty set.\n An empty IP range cannot be represented.\n If one wants to represent the empty range, then the complete rule needs to be removed.\n\n The same holds for layer 4 ports.\n In addition, there exists an empty port range, e.g. \\(1,0)\\.\n The conjunction of two port ranges is again just one port range.\n \n But negation of interfaces is not supported. Since interfaces support a wildcard character,\n transforming a negated interface would either result in an infeasible blowup or requires\n knowledge about the existing interfaces (e.g. there only is eth0, eth1, wlan3, and vbox42)\n An empirical test shows that negated interfaces do not occur in our data sets.\n Negated interfaces can also be considered bad style: What is !eth0? Everything that is\n not eth0, experience shows that interfaces may come up randomly, in particular in combination \n with virtual machines, so !eth0 might not be the desired match.\n At the moment, if an negated interface occurs which prevents translation to a simple match,\n we recommend to abstract the negated interface to unknown and remove it (upper or lower closure\n rule set) before translating to a simple match.\n The same discussion holds for negated protocols.\n\n Noteworthy, simple match expressions are both expressive and support conjunction:\n \\simple-match1 \\ simple-match2 = simple-match3\\\n\\\n (*It took very long to design the simple match such that it can represent everything we need\n and that you can calculate with it. Disjunction is easy: just have two consecutive rules with the same action.\n Conjunction was a tough fight! It is needed to translate:\n common_primitive_match_to_simple_match (MatchAny e1 e2) =\n simple_match_and (common_primitive_match_to_simple_match e1) (common_primitive_match_to_simple_match e2)\n This is key to translate common_primitive_match to simple_match\n\n It may seem a simple enhancement to support iiface :: \"iface negation_type\", but then you\n can no longer form the conjunction of two simple_matches.\n *)\n\n record (overloaded) 'i simple_match =\n iiface :: \"iface\" \\ \\in-interface\\\n (*we cannot (and don't want to) express negated interfaces*)\n (*We could also drop interface wildcard support and try negated interfaces again \\*)\n oiface :: \"iface\" \\ \\out-interface\\\n src :: \"('i::len word \\ nat) \" \\ \\source IP address\\\n dst :: \"('i::len word \\ nat) \" \\ \\destination\\\n proto :: \"protocol\"\n sports :: \"(16 word \\ 16 word)\" \\ \\source-port first:last\\\n dports :: \"(16 word \\ 16 word)\" \\ \\destination-port first:last\\\n\n \n context\n notes [[typedef_overloaded]]\n begin\n datatype 'i simple_rule = SimpleRule (match_sel: \"'i simple_match\") (action_sel: simple_action)\n end\n\n\n\ntext\\Simple rule destructor. Removes the @{typ \"'a simple_rule\"} type, returns a tuple with the match and action.\\\n definition simple_rule_dtor :: \"'a simple_rule \\ 'a simple_match \\ simple_action\" where\n \"simple_rule_dtor r \\ (case r of SimpleRule m a \\ (m,a))\"\n \n lemma simple_rule_dtor_ids:\n \"uncurry SimpleRule \\ simple_rule_dtor = id\"\n \"simple_rule_dtor \\ uncurry SimpleRule = id\" \n unfolding simple_rule_dtor_def comp_def fun_eq_iff\n by(simp_all split: simple_rule.splits)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Simple_Firewall/SimpleFw_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.26909803175274005}} {"text": "(*\n * Copyright 2018-2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Femto_VHDL\n imports Main\n \"HOL-Library.Poly_Mapping\"\n \"HOL-Library.Finite_Map\"\n \"Polynomials.Poly_Mapping_Finite_Map\"\n \"Femto_VHDL_raw\"\nbegin\n\nsection \"Syntax and Semantics\"\n\nlemma zero_map:\n \"(0 :: 'a \\ 'b) x = None\"\n by (auto simp add:zero_option_def zero_fun_def)\n\nsubsection \"Operational Semantics\"\n\n(* ADD an introduction text *)\ntype_synonym 'signal transaction = \"(nat, 'signal valuation) poly_mapping\"\n\nabbreviation empty_trans :: \"'signal transaction\" where\n \"empty_trans \\ 0\"\n\ntype_synonym 'signal transaction_sig = \"'signal \\ nat \\\\<^sub>0 val option\"\n\nlift_definition to_transaction_sig :: \"'signal transaction \\ 'signal transaction_sig\"\n is to_trans_raw_sig\n by (metis (mono_tags, lifting) finite_subset mem_Collect_eq subsetI to_trans_raw_sig_def\n zero_fun_def)\n\nlift_definition to_transaction_sig_bit :: \"val \\ 'signal transaction \\ nat \\ 'signal \\ 'signal transaction\"\n is to_trans_raw_bit\n unfolding to_trans_raw_bit_def sym[OF eventually_cofinite] zero_fun_def zero_option_def \n using zero_map\nproof -\n fix val\n fix \"fun\" :: \"nat \\ 'signal \\ val option\" and nat :: nat and signal :: 'signal\n assume a1: \"\\\\<^sub>\\x. fun x = Map.empty\"\n obtain nn :: \"(nat \\ bool) \\ (nat \\ bool) \\ nat\" where\n f2: \"\\p f pa fa. (\\ eventually p f \\ eventually pa f \\ p (nn p pa)) \\ (\\ eventually p fa \\ \\ pa (nn p pa) \\ eventually pa fa)\"\n by (metis (no_types) eventually_mono)\n then have f3: \"\\p. Alm_all p \\ (\\s. fun (nn (\\n. \\s. fun n s = None) p) s = None)\"\n using a1 by (metis (mono_tags, lifting))\n have f4: \"\\n. (\\s. fun n s \\ None) \\ (\\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None))\"\n by force\n { assume \"(\\\\<^sub>\\n. \\s. fun n s = None) \\ \\ (\\\\<^sub>\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None))\"\n then have \"\\p. (\\s. (s = signal \\ fun (nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None))) s = None) \\ (s \\ signal \\ (case fun (nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None))) s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None)) \\ Alm_all p\"\n using f4 f3 by meson\n then have \"\\\\<^sub>\\n. (\\s. if s \\ signal then fun n s else case fun n s of None \\ None | Some (Bv xa) \\ Map.empty xa | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = Map.empty\"\n using f2\n by (smt \\(\\\\<^sub>\\n. \\s. fun n s = None) \\ \\ (\\\\<^sub>\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some (Bv x) \\ Map.empty x | Some (Lv s bs) \\ (Some \\ Bv) (bs ! nat)) = None))\\) }\n then show \"\\\\<^sub>\\x. (\\sig. if sig \\ signal then fun x sig\n else case fun x sig of None \\ None\n | Some v \\\n if 0 < x \\ to_bit nat (signal_of val fun sig (x - 1)) = to_bit nat v then None\n else if x = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) =\n Map.empty\"\n proof -\n have f1: \"\\p. Alm_all p \\ (\\s. fun (nn (\\n. \\s. fun n s = None) p) s = None)\"\n by (simp add: f3)\n { assume \"\\ (\\\\<^sub>\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))\"\n then have \"(\\\\<^sub>\\n. \\s. fun n s = None) \\ \\ (\\\\<^sub>\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))\"\n by (metis a1)\n then have \"\\p. Alm_all p \\ (\\s. (s = signal \\ fun (nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))) s = None) \\ (s \\ signal \\ (case fun (nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))) s of None \\ None | Some v \\ if 0 < nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None)) \\ to_bit nat (signal_of val fun s (nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None)) - 1)) = to_bit nat v then None else if nn p (\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None)) = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))\"\n using f1 by fastforce\n then have ?thesis\n by (smt MOST_mono \\(\\\\<^sub>\\n. \\s. fun n s = None) \\ \\ (\\\\<^sub>\\n. \\s. (s \\ signal \\ fun n s = None) \\ (s = signal \\ (case fun n s of None \\ None | Some v \\ if 0 < n \\ to_bit nat (signal_of val fun s (n - 1)) = to_bit nat v then None else if n = 0 \\ to_bit nat val = to_bit nat v then None else Some (to_bit nat v)) = None))\\ option.simps(4)) }\n then show ?thesis\n by meson\n qed\nqed\n\nlemma finite_keys_to_transaction_sig:\n \"finite (Poly_Mapping.keys (to_transaction_sig \\ s))\"\n by auto\n\nsubsection \\From transaction to function of time (signal)\\\n\nlemma list_split3:\n assumes \"sorted xs\" and \"distinct xs\" and \"xs \\ []\"\n assumes \"hd xs \\ x\" and \"x < last xs\"\n shows \"\\ys y zs. xs = ys @ y # zs \\ (\\k \\ set ys. k \\ x) \\ x < y\"\nproof -\n obtain ys where \"takeWhile (\\n. n \\ x) xs = ys\"\n by auto\n moreover obtain y zs where \"dropWhile (\\n. n \\ x) xs = y # zs\"\n by (metis append_Nil2 assms(3) assms(5) last_in_set le_less not_less_iff_gr_or_eq set_takeWhileD\n sorted.cases takeWhile_dropWhile_id)\n ultimately have \"xs = ys @ y # zs \\ x < y\"\n using dropWhile_eq_Cons_conv by fastforce\n moreover have \"(\\k\\set ys. k \\ x)\"\n using `takeWhile (\\n. n \\ x) xs = ys` by (meson set_takeWhileD)\n ultimately show ?thesis\n by auto\nqed\n\nlemma takeWhile_last:\n fixes maxtime :: nat\n assumes \"sorted ys\" and \"ys \\ []\" and \"last ys \\ maxtime\"\n shows \"takeWhile (\\k. k \\ maxtime) ys = ys\"\n unfolding takeWhile_eq_all_conv\nproof\n fix k\n assume \"k \\ set ys\"\n hence \"k \\ last ys\"\n using `sorted ys` `ys \\ []`\n by (metis insertE last_appendR last_in_set less_or_eq_imp_le list.distinct(1) list.set(2)\n sorted.simps(2) sorted_append split_list)\n thus \"k \\ maxtime\"\n using assms by auto\nqed\n\nlemma takeWhile_last_strict:\n fixes maxtime :: nat\n assumes \"sorted ys\" and \"ys \\ []\" and \"last ys < maxtime\"\n shows \"takeWhile (\\k. k < maxtime) ys = ys\"\n using assms\n by (metis nat_less_le not_less takeWhile_eq_all_conv takeWhile_last)\n\nfun inf_key :: \"nat list \\ nat \\ nat option\" where\n \"inf_key ks n = (case takeWhile (\\k. k \\ n) ks of [] \\ None | ks' \\ Some (last ks'))\"\n\nlemma inf_key_alt_def:\n assumes \"sorted (a # ks)\"\n shows \"inf_key (a # ks) n = (if a \\ n \\ inf_key ks n = None then Some a else inf_key ks n)\"\nproof -\n have \"a \\ n \\ n < a\" by auto\n moreover\n { assume \"a \\ n\"\n hence \"takeWhile (\\k. k \\ n) (a # ks) = a # takeWhile (\\k. k \\ n) ks\"\n by auto\n hence \"inf_key (a # ks) n =\n (case a # takeWhile (\\k. k \\ n) ks of [] \\ None | ks' \\ Some (last ks'))\"\n by auto\n also have \"... =\n (if takeWhile (\\k. k \\ n) ks = [] then Some a else Some (last (takeWhile (\\k. k \\ n) ks)))\"\n by auto\n also have \"... = (if inf_key ks n = None then Some a else inf_key ks n)\"\n by (auto split:list.splits)\n finally have \"inf_key (a # ks) n = (if inf_key ks n = None then Some a else inf_key ks n)\"\n by auto\n hence ?thesis using `a \\ n` by auto }\n moreover\n { assume \"n < a\"\n hence \"takeWhile (\\k. k \\ n) (a # ks) = []\"\n by auto\n hence \"inf_key (a # ks) n = None\"\n by auto\n moreover have \"inf_key ks n = None\"\n using `sorted (a # ks)`\n by (metis \\n < a\\ inf_key.simps list.simps(4) neq_Nil_conv not_le order.strict_trans2 sorted2\n takeWhile.simps(1) takeWhile.simps(2))\n ultimately have ?thesis using `n < a` by auto }\n ultimately show ?thesis by auto\nqed\n\nlift_definition inf_time :: \"'a transaction_sig \\ 'a \\ nat \\ nat option\" is\n Femto_VHDL_raw.inf_time .\n\nlemma dropWhileD2:\n assumes \"sorted xs\" and \"distinct xs\"\n shows \"x \\ set (dropWhile (\\k. k \\ n) xs) \\ n < x\"\n using assms\nproof (induction xs)\n case Nil\n then show ?case by auto\nnext\n case (Cons a xs)\n have \"a \\ n \\ n < a\"\n by auto\n moreover\n { assume \"a \\ n\"\n hence \"dropWhile (\\k. k \\ n) (a # xs) = dropWhile (\\k. k \\ n) xs\"\n by auto\n with Cons have ?case\n by auto }\n moreover\n { assume \"n < a\"\n hence \"dropWhile (\\k. k \\ n) (a # xs) = a # xs\"\n by auto\n hence \"x \\ set (a # xs)\"\n using Cons by auto\n with Cons have ?case\n using \\n < a\\ order.strict_trans2 by auto }\n ultimately show ?case by auto\nqed\n\nlemma inf_time_inf_key [code]:\n \"inf_time \\ sig n = inf_key (sorted_list_of_set (Poly_Mapping.keys (\\ sig))) n\"\nproof transfer\n fix \\ :: \"'a \\ nat \\ val option\"\n fix sig\n fix n\n assume \"pred_fun top (\\f. finite {x. f x \\ 0}) \\\"\n hence \"finite {k. \\ sig k \\ 0}\"\n unfolding pred_fun_def by auto\n define ks where \"ks = sorted_list_of_set {k. \\ sig k \\ 0}\"\n have \"(\\k\\ keys(\\ sig). k \\ n) \\ \\ (\\k\\ keys(\\ sig). k \\ n)\"\n by auto\n moreover\n { assume not: \"\\ (\\k\\ keys(\\ sig). k \\ n)\"\n have \"takeWhile (\\k. k \\ n) ks = []\"\n using ks_def unfolding keys_def\n by (induction ks, simp)\n (metis Femto_VHDL_raw.keys_def \\finite {k. \\ sig k \\ 0}\\ insertI1 list.simps(15) not\n set_sorted_list_of_set takeWhile.simps(2))\n hence \"inf_key ks n = None\"\n by (simp add: ks_def)\n also have \"... = Femto_VHDL_raw.inf_time \\ sig n\"\n by (auto simp add: not Femto_VHDL_raw.inf_time_def)\n finally have \"Femto_VHDL_raw.inf_time \\ sig n = inf_key ks n\"\n by auto }\n moreover\n { assume exi: \"\\k\\ keys(\\ sig). k \\ n\"\n hence *: \"Femto_VHDL_raw.inf_time \\ sig n = Some (GREATEST k. k \\ keys (\\ sig) \\ k \\ n)\"\n by (auto simp add: Femto_VHDL_raw.inf_time_def)\n have \"ks \\ []\"\n using exi by (auto simp add: \\finite {k. \\ sig k \\ 0}\\ ks_def keys_def)\n hence \"takeWhile (\\k. k \\ n) ks \\ []\"\n using ks_def exi unfolding keys_def\n proof (induction ks)\n case (Cons a ks)\n have \"a \\ n \\ n < a\"\n by auto\n moreover\n { assume \"a \\ n\"\n hence \"takeWhile (\\k. k \\ n) (a # ks) = a # takeWhile (\\k. k \\ n) ks\"\n by auto\n hence ?case\n by auto }\n moreover\n { assume \"n < a\"\n with Cons.prems have \"\\ sig a \\ 0\"\n by (metis \\finite {k. \\ sig k \\ 0}\\ domIff dom_def insertI1 list.simps(15)\n set_sorted_list_of_set zero_option_def)\n have \"sorted (a # ks)\" and \"distinct (a # ks)\"\n using Cons.prems(2) by auto\n hence \"\\k' \\ set ks. a < k'\"\n using nat_less_le by auto\n with `n < a` have \"\\k' \\ set (a # ks). n < k'\"\n by auto\n with Cons have \"False\"\n using \\finite {k. \\ sig k \\ 0}\\ by auto\n hence ?case by auto }\n ultimately show ?case by auto\n qed (auto)\n define ks' where \"ks' = takeWhile (\\k. k \\ n) ks\"\n hence \"ks' \\ []\"\n using `takeWhile (\\k. k \\ n) ks \\ []` by auto\n have \"(GREATEST k. k \\ keys (\\ sig) \\ k \\ n) = last ks'\"\n proof (rule Greatest_equality)\n have \"last ks' \\ Femto_VHDL_raw.keys (\\ sig)\"\n using `ks' \\ []` unfolding keys_def ks'_def ks_def\n by (metis \\finite {k. \\ sig k \\ 0}\\ last_in_set set_sorted_list_of_set set_takeWhileD)\n moreover have \"last ks' \\ n\"\n using `ks' \\ []` unfolding ks'_def by (meson last_in_set set_takeWhileD)\n ultimately show \"last ks' \\ Femto_VHDL_raw.keys (\\ sig) \\ last ks' \\ n\"\n by auto\n next\n { fix y\n assume \"\\ y \\ last ks'\" hence \"last ks' < y\" by auto\n have \"y \\ set ks \\ y \\ set ks\"\n by auto\n moreover\n { assume \"y \\ set ks\"\n hence \"y \\ Femto_VHDL_raw.keys (\\ sig)\"\n unfolding keys_def ks_def by (simp add: \\finite {k. \\ sig k \\ 0}\\)\n hence \"\\ (y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n)\"\n by auto }\n moreover\n { assume \"y \\ set ks\"\n hence \"y \\ set (takeWhile (\\k. k \\ n) ks) \\ y \\ set (dropWhile (\\k. k \\ n) ks)\"\n by (metis Un_iff set_append takeWhile_dropWhile_id)\n moreover\n { assume \"y \\ set (dropWhile (\\k. k \\ n) ks)\"\n hence \"n < y\"\n using dropWhileD2 distinct_sorted_list_of_set ks_def sorted_sorted_list_of_set\n by blast\n hence \"\\ (y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n)\"\n by auto }\n moreover\n { assume \"y \\ set (takeWhile (\\k. k \\ n) ks)\"\n hence \"y \\ last ks'\"\n using `ks' \\ []`\n by (metis ks'_def ks_def linorder_not_le order_refl sorted_list_of_set(2)\n sorted_takeWhile takeWhile_eq_all_conv takeWhile_last_strict)\n with `last ks' < y` have False by auto\n hence \"\\ (y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n)\"\n by auto }\n ultimately have \"\\ (y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n)\"\n by auto }\n ultimately have \"\\ (y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n)\"\n by auto }\n thus \"\\y. y \\ Femto_VHDL_raw.keys (\\ sig) \\ y \\ n \\ y \\ last ks'\"\n by auto\n qed\n moreover have \"inf_key ks n = Some (last ks')\"\n proof -\n obtain x xs where \"ks' = x # xs\"\n using `ks' \\ []` by (meson neq_Nil_conv)\n hence \"inf_key ks n = Some (last (x # xs))\"\n using `ks' \\[]` unfolding ks'_def by auto\n thus ?thesis\n using `ks' = x # xs` by auto\n qed\n ultimately have \"Femto_VHDL_raw.inf_time \\ sig n = inf_key ks n\"\n using * by auto }\n ultimately show \"Femto_VHDL_raw.inf_time \\ sig n = inf_key ks n\"\n by auto\nqed\n\nlift_definition to_signal :: \"val \\ 'signal transaction_sig \\ 'signal \\ nat \\ val\" is\n Femto_VHDL_raw.to_signal .\n\n\n\nabbreviation \"signal_of2 def \\ to_signal def o to_transaction_sig\"\n\nlift_definition beval ::\n \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\ 'signal bexp \\ val \\ bool\"\n is beval_raw .\n\ninductive beval_ind :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\ 'signal bexp \\ val \\ bool\"\n where\n \"beval_ind now \\ \\ \\ def (Bsig sig) (\\ sig)\"\n| \"beval_ind now \\ \\ \\ def (Btrue) (Bv True)\"\n| \"beval_ind now \\ \\ \\ def (Bfalse) (Bv False)\"\n| \"beval_ind now \\ \\ \\ def (Bsig_delayed sig t) (signal_of2 (def sig) \\ sig (now - t))\"\n| \"beval_ind now \\ \\ \\ def (Bsig_event sig) (Bv (sig \\ \\))\"\n| \"beval_ind now \\ \\ \\ def e (Bv bool) \\ beval_ind now \\ \\ \\ def (Bnot e) (Bv (\\ bool))\"\n| \"beval_ind now \\ \\ \\ def e (Lv ki bs) \\ beval_ind now \\ \\ \\ def (Bnot e) (Lv ki (map Not bs))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Band e1 e2) (Bv ( val1 \\ val2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Band e1 e2) (Lv ki (map2 (\\) bs1 bs2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Bor e1 e2) (Bv ( val1 \\ val2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Bor e1 e2) (Lv ki (map2 (\\) bs1 bs2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Bnand e1 e2) (Bv (\\(val1 \\ val2)))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Bnand e1 e2) (Lv ki (map2 (\\x y. \\ (x \\ y)) bs1 bs2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Bnor e1 e2) (Bv (\\(val1 \\ val2)))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Bnor e1 e2) (Lv ki (map2 (\\x y. \\ (x \\ y)) bs1 bs2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Bxor e1 e2) (Bv (xor val1 val2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Bxor e1 e2) (Lv ki (map2 xor bs1 bs2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Bv val1); beval_ind now \\ \\ \\ def e2 (Bv val2)\\ \\\n beval_ind now \\ \\ \\ def (Bxnor e1 e2) (Bv (\\ xor val1 val2))\"\n| \"\\beval_ind now \\ \\ \\ def e1 (Lv ki bs1); beval_ind now \\ \\ \\ def e2 (Lv ki bs2); length bs1 = length bs2\\\n \\ beval_ind now \\ \\ \\ def (Bxnor e1 e2) (Lv ki (map2 (\\x y. \\ xor x y) bs1 bs2))\"\n| \"beval_ind now \\ \\ \\ def (Bsig sig) (Lv ki bs) \\ length bs = len \\\n beval_ind now \\ \\ \\ def (Bslice sig l r) (Lv ki (nths bs {len - l - 1 .. len - r - 1}))\"\n| \"beval_ind now \\ \\ \\ def (Bsig sig) (Lv ki bs) \\ beval_ind now \\ \\ \\ def (Bindex sig idx) (Bv (bs ! idx))\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Uns bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Uns bs2) \\\n len = max (length bs1) (length bs2) \\ bs = bin_to_bl len (bl_to_bin bs1 + bl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Badd e1 e2) (Lv Uns bs)\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Sig bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Sig bs2) \\\n len = max (length bs1) (length bs2) \\ bs = bin_to_bl len (sbl_to_bin bs1 + sbl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Badd e1 e2) (Lv Sig bs)\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Uns bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Uns bs2) \\\n len = (length bs1) + (length bs2) \\ bs = bin_to_bl len (bl_to_bin bs1 * bl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Bmult e1 e2) (Lv Uns bs)\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Sig bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Sig bs2) \\\n len = (length bs1) + (length bs2) \\ bs = bin_to_bl len (sbl_to_bin bs1 * sbl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Bmult e1 e2) (Lv Sig bs)\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Uns bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Uns bs2) \\\n len = max (length bs1) (length bs2) \\ bs = bin_to_bl len (bl_to_bin bs1 - bl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Bsub e1 e2) (Lv Uns bs)\"\n\n| \"beval_ind now \\ \\ \\ def e1 (Lv Sig bs1) \\ beval_ind now \\ \\ \\ def e2 (Lv Sig bs2) \\\n len = max (length bs1) (length bs2) \\ bs = bin_to_bl len (sbl_to_bin bs1 - sbl_to_bin bs2) \\\n beval_ind now \\ \\ \\ def (Bsub e1 e2) (Lv Sig bs)\"\n\n| \"\\beval_ind now \\ \\ \\ def e (Lv Uns bs); bs' = drop n (bs @ replicate n False)\\\n \\ beval_ind now \\ \\ \\ def (Bshiftl e n) (Lv Uns bs')\"\n\n| \"\\beval_ind now \\ \\ \\ def e (Lv Sig bs); bs' = drop n (bs @ replicate n False)\\\n \\ beval_ind now \\ \\ \\ def (Bshiftl e n) (Lv Sig bs')\"\n\n| \"\\beval_ind now \\ \\ \\ def e (Lv Uns bs); bs' = take (length bs) (replicate n False @ bs)\\\n \\ beval_ind now \\ \\ \\ def (Bshiftr e n) (Lv Uns bs')\"\n\n| \"\\beval_ind now \\ \\ \\ def e (Lv Sig bs); bs' = take (length bs) (replicate n (hd bs) @ bs)\\\n \\ beval_ind now \\ \\ \\ def (Bshiftr e n) (Lv Sig bs')\"\n\n| \"\\beval_ind now \\ \\ \\ def g (Bv True); beval_ind now \\ \\ \\ def th res\\\n \\ beval_ind now \\ \\ \\ def (Bwhen th g el) res\"\n\n| \"\\beval_ind now \\ \\ \\ def g (Bv False); beval_ind now \\ \\ \\ def el res\\\n \\ beval_ind now \\ \\ \\ def (Bwhen th g el) res\"\n\n| \"beval_ind now \\ \\ \\ def (Bliteral sign val) (Lv sign val)\"\n\nlemma beval_eq_beval_ind:\n \"beval t \\ \\ \\ def exp res = beval_ind t \\ \\ \\ def exp res\"\nproof\n assume \"beval t \\ \\ \\ def exp res\"\n hence \"beval_ind t \\ \\ (Abs_poly_mapping (lookup \\)) def exp res\"\n proof transfer\n fix t \\ \\\n fix \\ :: \"nat \\ 'a \\ val option\"\n fix def exp res\n assume \"finite {x. \\ x \\ 0}\"\n assume \"t , \\ , \\ , \\, def \\ exp \\\\<^sub>b res\"\n thus \"beval_ind t \\ \\ (Abs_poly_mapping \\) def exp res\"\n using `finite {x. \\ x \\ 0}`\n proof (induction rule: beval_raw.induct)\n case (4 now \\ \\ \\ def sig t)\n have \"signal_of2 (def sig) (Abs_poly_mapping \\) sig (now - t) = signal_of (def sig) \\ sig (now - t)\"\n unfolding Femto_VHDL.to_signal.rep_eq comp_def to_transaction_sig.rep_eq\n lookup_Abs_poly_mapping[OF 4] by auto\n then show ?case by (metis beval_ind.intros(4))\n qed (metis beval_ind.intros)+\n qed\n thus \"beval_ind t \\ \\ \\ def exp res\"\n unfolding lookup_inverse by auto\nnext\n assume \"beval_ind t \\ \\ \\ def exp res\"\n thus \"beval t \\ \\ \\ def exp res\"\n unfolding beval.rep_eq\n proof (induction rule: beval_ind.inducts)\n case (4 now \\ \\ \\ def sig t)\n have \"signal_of2 (def sig) \\ sig (now - t) = signal_of (def sig) (lookup \\) sig (now - t)\"\n by transfer' auto\n then show ?case\n using beval_raw.intros(4) by force\n qed (metis beval_raw.intros)+\nqed\n\nlemma beval_ind_deterministic:\n assumes \"beval_ind t \\ \\ \\ def exp res1\"\n assumes \"beval_ind t \\ \\ \\ def exp res2\"\n shows \"res2 = res1\"\n using assms unfolding sym[OF beval_eq_beval_ind]\n by transfer' (simp add: beval_raw_deterministic)\n\nlift_definition transtyping :: \"'s tyenv \\ 's transaction \\ bool\" is ttyping .\n\nlemma beval_ind_progress_unique:\n assumes \"bexp_wt \\ exp type\" and \"styping \\ \\\" and \"transtyping \\ \\\" and \"styping \\ def\"\n shows \"\\!v. beval_ind t \\ \\ \\ def exp v\"\n unfolding sym[OF beval_eq_beval_ind] using assms\n by transfer' (auto simp add: beval_raw_progress beval_raw_deterministic)\n\nlift_definition post :: \"'signal \\ val \\ 'signal transaction \\ nat \\ 'signal transaction\" is\n post_raw unfolding post_raw_def sym[OF eventually_cofinite]\n by (smt MOST_mono MOST_neq(2) MOST_rev_mp fun_upd_idem_iff zero_fun_def zero_option_def)\n\nlift_definition preempt :: \"'signal \\ 'signal transaction \\ nat \\ 'signal transaction\" is\n preempt_raw unfolding preempt_raw_def sym[OF eventually_cofinite]\n by (smt MOST_mono fun_upd_idem_iff zero_map)\n\nlift_definition post_necessary:: \"nat \\ 'signal transaction \\ nat \\ 'signal \\ val \\ val \\ bool\"\n is post_necessary_raw .\n\nlift_definition trans_post ::\n \"'signal \\ val \\ val \\ 'signal transaction \\ nat \\ nat \\ 'signal transaction\"\n is trans_post_raw\n unfolding sym[OF eventually_cofinite] using trans_post_raw_almost_all_zero\n by metis\n\nlemma [code]:\n \"trans_post s val def \\ t dly =\n (if post_necessary (dly - 1) \\ t s val def then post s val \\ (t + dly) else preempt s \\ (t + dly))\"\n by (transfer', auto simp add: trans_post_raw_def)\n\nlift_definition purge :: \"'signal transaction \\ nat \\ nat \\ 'signal \\ val \\ val \\ 'signal transaction\" is\n purge_raw unfolding purge_raw_def sym[OF eventually_cofinite]\n by (metis purge_raw_almost_all_zero purge_raw_def)\n\nlift_definition purge' :: \"'signal transaction \\ nat \\ nat \\ 'signal \\ val \\ val \\ 'signal transaction\" is\n purge_raw' unfolding purge_raw'_def sym[OF eventually_cofinite]\n by (metis (no_types) purge_raw'_def purge_raw_almost_all_zero')\n\n(* TODO: remove the following proof since it is duplicated from Femto_VHDL_raw.thy *)\n\nlift_definition combine_trans_bit_lifted :: \"'signal transaction \\ (val \\ 'signal transaction) list \\ signedness \\ 'signal \\ nat \\ nat \\ 'signal transaction\" is\n combine_trans_bit unfolding combine_trans_bit_def Let_def \nproof -\n fix f :: \"nat \\ 'signal \\ val option\"\n fix list :: \"(val \\ (nat \\ 'signal \\ val option)) list\" \n fix signedness signal now dly\n assume *: \"list_all (pred_prod top (\\f. finite {x. f x \\ 0})) list\"\n assume \"finite {x. f x \\ 0}\"\n hence \"\\\\<^sub>\\x. f x = 0\"\n unfolding sym[OF eventually_cofinite] by auto\n assume \"list_all (pred_prod top (\\f. finite {x. f x \\ 0})) list\" \n have \"(\\x sig. if x \\ now \\ now + dly < x \\ sig \\ signal then f x sig\n else if x \\ fold (\\) (map (Femto_VHDL_raw.keys \\ (\\\\. to_trans_raw_sig \\ signal) \\ snd) list) {}\n then Some (Lv signedness (map (\\p. bval_of (signal_of (get_time p) (snd p) sig x)) list)) else None) = \n (override_on (\\x. if x \\ now \\ now + dly < x then f x else (f x)(signal := None)) \n (\\x. \\sig. if x \\ now \\ now + dly < x \\ sig \\ signal then f x sig else \n Some (Lv signedness (map (\\p. bval_of (signal_of (get_time p) (snd p) sig x)) list))) \n (fold (\\) (map (Femto_VHDL_raw.keys \\ (\\\\. to_trans_raw_sig \\ signal) \\ snd) list) {}))\"\n (is \"?fun = ?fun'\") by (auto intro!: ext)\n have \"finite {x. ?fun' x \\ 0}\"\n unfolding sym[OF eventually_cofinite] \n proof (intro upd_eventually_cofinite_override_on_finite)\n have \"\\init. finite init \\ finite (fold (\\) (map (\\x. {k. to_trans_raw_sig (snd x) signal k \\ 0}) list) init)\"\n using *\n proof (induction list)\n case Nil\n then show ?case by auto\n next\n case (Cons a ps)\n have \"pred_prod (\\a. True) (\\f. finite {x. f x \\ 0}) a\"\n using Cons(3) by auto\n hence \"finite {x. snd a x \\ 0}\"\n using pred_prod_inject surjective_pairing[of \"a\"] by metis\n have **: \" (fold (\\) (map (\\x. {k. to_trans_raw_sig (snd x) signal k \\ 0}) (a # ps)) init) = \n fold (\\) (map (\\x. {k. to_trans_raw_sig (snd x) signal k \\ 0}) ps) ({k. to_trans_raw_sig (snd a) signal k \\ 0} \\ init)\"\n unfolding list.map(2) fold_Cons comp_def Un_empty_right by auto\n have \"finite ({k. to_trans_raw_sig (snd a) signal k \\ 0} \\ init)\"\n using `finite init` `finite {x. snd a x \\ 0}` unfolding finite_Un \n to_trans_raw_sig_def\n by (metis (mono_tags, lifting) finite_nat_iff_bounded mem_Collect_eq subset_eq zero_map zero_option_def)\n thus ?case\n using Cons by auto\n qed\n hence fin: \"finite (fold (\\) (map (\\x. {k. to_trans_raw_sig (snd x) signal k \\ 0}) list) {})\"\n by auto\n thus \" finite (fold (\\) (map (Femto_VHDL_raw.keys \\ (\\\\. to_trans_raw_sig \\ signal) \\ snd) list) {})\"\n unfolding keys_def comp_def by auto\n next\n show \" \\\\<^sub>\\x. (if x \\ now \\ now + dly < x then f x else (f x)(signal := None)) = 0\"\n using `\\\\<^sub>\\x. f x = 0` by (smt MOST_mono fun_upd_idem zero_map)\n qed\n thus \"finite \n {x. (\\sig. if x \\ now \\ now + dly < x \\ sig \\ signal then f x sig\n else if x \\ fold (\\) (map (Femto_VHDL_raw.keys \\ (\\\\. to_trans_raw_sig \\ signal) \\ snd) list) {}\n then Some (Lv signedness (map (\\p. bval_of (signal_of (get_time p) (snd p) sig x)) list)) else None) \\\n 0}\"\n using `?fun = ?fun'` by metis\nqed\n\nlift_definition inr_post ::\n \"'signal \\ val \\ val \\ 'signal transaction \\ nat \\ delay \\ 'signal transaction\"\n is inr_post_raw'\n unfolding sym[OF eventually_cofinite] using inr_post_raw_almost_all_zero'\n by metis\n\nlemma [code]:\n \"inr_post sig val def \\ now dly =\n trans_post sig val def (purge' \\ now dly sig def val) now dly\"\n by (transfer', auto simp add: Femto_VHDL_raw.inr_post_raw'_def)\n\nlift_definition seq_exec :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal seq_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\" is\n b_seq_exec .\n\ndeclare seq_exec.rep_eq[code_abbrev]\n\ninductive seq_exec_ind :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal seq_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\" where\n \"seq_exec_ind t \\ \\ \\ def Bnull \\ \\\"\n\n| \"seq_exec_ind t \\ \\ \\ def ss1 \\ \\'' \\ seq_exec_ind t \\ \\ \\ def ss2 \\'' \\' \\\n seq_exec_ind t \\ \\ \\ def (Bcomp ss1 ss2) \\ \\'\"\n\n| \"beval_ind t \\ \\ \\ def guard (Bv True) \\ seq_exec_ind t \\ \\ \\ def ss1 \\ \\' \\\n seq_exec_ind t \\ \\ \\ def (Bguarded guard ss1 ss2) \\ \\'\"\n\n\n| \"beval_ind t \\ \\ \\ def guard (Bv False) \\ seq_exec_ind t \\ \\ \\ def ss2 \\ \\' \\\n seq_exec_ind t \\ \\ \\ def (Bguarded guard ss1 ss2) \\ \\'\"\n\n| \"beval_ind t \\ \\ \\ def e x \\ trans_post sig x (\\ sig) \\ t dly = \\' \\\n seq_exec_ind t \\ \\ \\ def (Bassign_trans sig e dly) \\ \\'\"\n\n| \"beval_ind t \\ \\ \\ def e x \\ inr_post sig x (\\ sig) \\ t dly = \\' \\\n seq_exec_ind t \\ \\ \\ def (Bassign_inert sig e dly) \\ \\'\"\n\n| \"beval_ind t \\ \\ \\ def exp x \\ beval_ind t \\ \\ \\ def exp' x \\ seq_exec_ind t \\ \\ \\ def ss \\ \\'\n \\ seq_exec_ind t \\ \\ \\ def (Bcase exp ((Explicit exp', ss) # choices)) \\ \\'\"\n\n| \"beval_ind t \\ \\ \\ def exp x \\ beval_ind t \\ \\ \\ def exp' x' \\ x \\ x' \\\n seq_exec_ind t \\ \\ \\ def (Bcase exp choices) \\ \\' \\\n seq_exec_ind t \\ \\ \\ def (Bcase exp ((Explicit exp', ss) # choices)) \\ \\'\"\n\n| \"seq_exec_ind t \\ \\ \\ def ss \\ \\' \\\n seq_exec_ind t \\ \\ \\ def (Bcase exp ((Others, ss) # choices)) \\ \\'\"\n\n| \"seq_exec_ind t \\ \\ \\ def (Bcase exp []) \\ \\\"\n\nlemma seq_exec_eq_seq_exec_ind:\n \"seq_exec t \\ \\ \\ def cs \\ \\' = seq_exec_ind t \\ \\ \\ def cs \\ \\'\"\nproof\n assume \"seq_exec t \\ \\ \\ def cs \\ \\'\"\n hence \"seq_exec_ind t \\ \\ (Abs_poly_mapping (lookup \\)) def cs (Abs_poly_mapping (lookup \\)) (Abs_poly_mapping (lookup \\'))\"\n proof transfer\n fix t \\ \\\n fix \\ :: \"nat \\ 'a \\ val option\"\n fix def cs\n fix \\ \\' :: \"nat \\ 'a \\ val option\"\n assume \"finite {x. \\ x \\ 0}\"\n assume \"finite {x. \\ x \\ 0}\"\n assume \"finite {x. \\' x \\ 0}\"\n assume \"t , \\ , \\ , \\ , def \\ > \\\\<^sub>s \\'\"\n thus \"seq_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using `finite {x. \\ x \\ 0}` `finite {x. \\ x \\ 0}` `finite {x. \\' x \\ 0}`\n proof (induction rule:b_seq_exec.induct)\n case (1 t \\ \\ \\ def \\)\n then show ?case by (auto intro!: seq_exec_ind.intros)\n next\n case (2 t \\ \\ \\ def ss1 \\ \\'' ss2 \\')\n hence \"finite {x. \\'' x \\ 0}\"\n using b_seq_exec_almost_all_zero[OF 2(1)] by (simp add: eventually_cofinite)\n hence \"seq_exec_ind t \\ \\ (Abs_poly_mapping \\) def ss1 (Abs_poly_mapping \\) (Abs_poly_mapping \\'')\"\n using 2(3)[OF 2(5-6)] by auto\n moreover have \" seq_exec_ind t \\ \\ (Abs_poly_mapping \\) def ss2 (Abs_poly_mapping \\'') (Abs_poly_mapping \\')\"\n using 2(4)[OF 2(5) `finite {x. \\'' x \\ 0}` 2(7)] by auto\n ultimately show ?case\n by (auto intro!: seq_exec_ind.intros)\n next\n case (3 t \\ \\ \\ def guard ss1 \\ \\' ss2)\n hence \"finite {x. \\' x \\ 0}\"\n using b_seq_exec_almost_all_zero by blast\n moreover have \"beval t \\ \\ (Abs_poly_mapping \\) def guard (Bv True)\"\n using 3(1) unfolding beval.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n by auto\n ultimately show ?case\n by (simp add: beval_eq_beval_ind \"3.IH\" \"3.prems\"(1) \"3.prems\"(2) seq_exec_ind.intros(3))\n next\n case (4 t \\ \\ \\ def guard ss2 \\ \\' ss1)\n hence \"finite {x. \\' x \\ 0}\"\n using b_seq_exec_almost_all_zero by blast\n moreover have \"beval t \\ \\ (Abs_poly_mapping \\) def guard (Bv False)\"\n using 4(1) unfolding beval.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n by auto\n ultimately show ?case\n by (simp add: beval_eq_beval_ind \"4.IH\" \"4.prems\"(1) \"4.prems\"(2) seq_exec_ind.intros(4))\n next\n case (5 t \\ \\ \\ def e x sig \\ dly \\')\n have \"beval t \\ \\ (Abs_poly_mapping \\) def e x\"\n using 5(1) unfolding beval.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n by auto\n have \"lookup (trans_post sig x (\\ sig) (Abs_poly_mapping \\) t dly) = lookup (Abs_poly_mapping \\')\"\n using 5(2) unfolding trans_post.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`] by auto\n hence \"trans_post sig x (\\ sig) (Abs_poly_mapping \\) t dly = Abs_poly_mapping \\'\"\n unfolding lookup_inject by auto\n then show ?case\n using `beval t \\ \\ (Abs_poly_mapping \\) def e x`\n by (simp add: beval_eq_beval_ind seq_exec_ind.intros(5))\n next\n case (6 t \\ \\ \\ def e x sig \\ dly \\')\n have \"beval t \\ \\ (Abs_poly_mapping \\) def e x\"\n using 6(1) unfolding beval.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n by auto\n have \"lookup (inr_post sig x (\\ sig) (Abs_poly_mapping \\) t dly) = lookup (Abs_poly_mapping \\')\"\n using 6(2) unfolding inr_post.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`] by auto\n hence \"inr_post sig x (\\ sig) (Abs_poly_mapping \\) t dly = Abs_poly_mapping \\'\"\n unfolding lookup_inject by auto\n then show ?case\n using `beval t \\ \\ (Abs_poly_mapping \\) def e x`\n by (auto simp add: seq_exec_ind.intros(6) beval_eq_beval_ind)\n next\n case (7 t \\ \\ \\ def exp x exp' ss \\ \\' choices)\n have \"beval_ind t \\ \\ (Abs_poly_mapping \\) def exp x\"\n by (metis (mono_tags, lifting) \"7.hyps\"(1) \"7.prems\"(1) beval.abs_eq beval_eq_beval_ind\n eq_onp_same_args)\n moreover have \"beval_ind t \\ \\ (Abs_poly_mapping \\) def exp' x\"\n by (metis \"7.hyps\"(2) \"7.prems\"(1) beval.rep_eq beval_eq_beval_ind lookup_Abs_poly_mapping)\n moreover have \" seq_exec_ind t \\ \\ (Abs_poly_mapping \\) def ss (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 7 by auto\n ultimately show ?case\n by (intro seq_exec_ind.intros) auto\n next\n case (8 t \\ \\ \\ def exp x exp' x' choices \\ \\' ss)\n have \"beval_ind t \\ \\ (Abs_poly_mapping \\) def exp x\"\n by (metis (mono_tags, lifting) \"8.hyps\"(1) \"8.prems\"(1) beval.abs_eq beval_eq_beval_ind\n eq_onp_same_args)\n moreover have \"beval_ind t \\ \\ (Abs_poly_mapping \\) def exp' x'\"\n by (metis (mono_tags) \"8.hyps\"(2) \"8.prems\"(1) beval.rep_eq beval_eq_beval_ind\n lookup_Abs_poly_mapping)\n moreover have \"seq_exec_ind t \\ \\ (Abs_poly_mapping \\) def (Bcase exp choices) (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 8 by auto\n ultimately show ?case\n using 8(3) by (intro seq_exec_ind.intros(8)) auto\n qed (auto simp add: seq_exec_ind.intros)\n qed\n thus \"seq_exec_ind t \\ \\ \\ def cs \\ \\'\"\n unfolding lookup_inverse by auto\nnext\n assume \"seq_exec_ind t \\ \\ \\ def cs \\ \\'\"\n thus \"seq_exec t \\ \\ \\ def cs \\ \\'\"\n unfolding seq_exec.rep_eq\n proof (induction rule:seq_exec_ind.inducts)\n case (3 t \\ \\ \\ def guard ss1 \\ \\' ss2)\n have \"beval_raw t \\ \\ (lookup \\) def guard (Bv True)\"\n using 3(1) unfolding sym[OF beval_eq_beval_ind]\n by transfer' auto\n then show ?case\n using 3(3) by (simp add: b_seq_exec.intros(3))\n next\n case (4 t \\ \\ \\ def guard ss2 \\ \\' ss1)\n have \"beval_raw t \\ \\ (lookup \\) def guard (Bv False)\"\n using 4(1) unfolding sym[OF beval_eq_beval_ind] by transfer' auto\n then show ?case\n using 4(3) by (simp add: b_seq_exec.intros(4))\n next\n case (5 t \\ \\ \\ def e x sig \\ dly \\')\n have \"beval_raw t \\ \\ (lookup \\) def e x\"\n using 5(1) unfolding sym[OF beval_eq_beval_ind] by transfer' auto\n have \"trans_post_raw sig x (\\ sig) (lookup \\) t dly = lookup \\'\"\n using 5(2) by transfer' auto\n then show ?case\n by (metis \\t , \\ , \\ , lookup \\, def \\ e \\\\<^sub>b x\\ b_seq_exec.intros(5))\n next\n case (6 t \\ \\ \\ def e x sig \\ dly \\')\n have \"beval_raw t \\ \\ (lookup \\) def e x\"\n using 6(1) unfolding sym[OF beval_eq_beval_ind] by transfer' auto\n have \"inr_post_raw' sig x (\\ sig) (lookup \\) t dly = lookup \\'\"\n using 6(2) by transfer' auto\n then show ?case\n by (metis \\t , \\ , \\ , lookup \\, def \\ e \\\\<^sub>b x\\ b_seq_exec.intros(6))\n next\n case (7 t \\ \\ \\ def exp x exp' ss \\ \\' choices)\n have \"t, \\ , \\ , lookup \\ , def \\ exp \\\\<^sub>b x\"\n by (metis \"7.hyps\"(1) beval.rep_eq beval_eq_beval_ind)\n moreover have \"t, \\ , \\ , lookup \\ , def \\ exp' \\\\<^sub>b x\"\n by (metis \"7.hyps\"(2) beval.rep_eq beval_eq_beval_ind)\n moreover have \"b_seq_exec t \\ \\ (lookup \\) def ss (lookup \\) (lookup \\')\"\n using 7(3) by (simp add: \"7.IH\")\n ultimately show ?case\n by (intro b_seq_exec.intros) auto\n next\n case (8 t \\ \\ \\ def exp x exp' x' choices \\ \\' ss)\n have \"t, \\ , \\ , lookup \\ , def \\ exp \\\\<^sub>b x\"\n by (metis \"8.hyps\"(1) beval.rep_eq beval_eq_beval_ind)\n moreover have \"t, \\ , \\ , lookup \\ , def \\ exp' \\\\<^sub>b x'\"\n by (metis \"8.hyps\"(2) beval.rep_eq beval_eq_beval_ind)\n moreover have \"b_seq_exec t \\ \\ (lookup \\) def (Bcase exp choices) (lookup \\) (lookup \\')\"\n using 8 by auto\n ultimately show ?case\n using 8(3) by (intro b_seq_exec.intros(8)) auto\n qed (auto intro!: b_seq_exec.intros)\nqed\n\nlemma seq_exec_ind_deterministic:\n assumes \"seq_exec_ind t \\ \\ \\ def cs \\ \\1\"\n assumes \"seq_exec_ind t \\ \\ \\ def cs \\ \\2\"\n shows \"\\2 = \\1\"\n using assms unfolding sym[OF seq_exec_eq_seq_exec_ind]\n by transfer' (auto simp add: b_seq_exec_deterministic)\n\nlemma seq_exec_ind_progress:\n assumes \"seq_wt \\ ss\" and \"styping \\ \\\" and \"transtyping \\ \\\" and \"styping \\ def\" and \"transtyping \\ \\\"\n shows \"\\\\'. seq_exec_ind t \\ \\ \\ def ss \\ \\'\"\n unfolding sym[OF seq_exec_eq_seq_exec_ind] using assms\nproof transfer\n fix \\ :: \"'a tyenv\"\n fix ss \\\n fix \\ \\ :: \"nat \\ 'a \\ val\"\n fix def t \\\n assume \"seq_wt \\ ss\"\n assume \"styping \\ \\\"\n assume \"finite {x. \\ x \\ 0}\"\n assume \"ttyping \\ \\\"\n assume \"styping \\ def\"\n assume \"finite {x. \\ x \\ 0}\"\n assume \"ttyping \\ \\\"\n hence \"\\\\'. t, \\, \\, \\, def \\ < ss, \\> \\\\<^sub>s \\'\"\n using seq_stmts_progress[OF `seq_wt \\ ss` `styping \\ \\` `ttyping \\ \\` `styping \\ def` `ttyping \\ \\`]\n by auto\n then obtain \\' where \"t, \\, \\, \\, def \\ < ss, \\> \\\\<^sub>s \\'\"\n by auto\n hence \"finite {x. \\' x \\ 0}\"\n using b_seq_exec_almost_all_zero\n by (metis (mono_tags) \\finite {x. \\ x \\ 0}\\ \\finite {x. \\ x \\ 0}\\ eventually_cofinite map_diff_fin_variability)\n thus \"Bex {f. finite {x. f x \\ 0}} (b_seq_exec t \\ \\ \\ def ss \\)\"\n using \\t , \\ , \\ , \\ , def \\ < ss , \\> \\\\<^sub>s \\'\\ by blast\nqed\n\nlemma seq_exec_ind_unique_progress:\n assumes \"seq_wt \\ ss\" and \"styping \\ \\\" and \"transtyping \\ \\\" and \"styping \\ def\" and \"transtyping \\ \\\"\n shows \"\\!\\'. seq_exec_ind t \\ \\ \\ def ss \\ \\'\"\n using assms\n by (auto simp add: seq_exec_ind_progress seq_exec_ind_deterministic)\n\nlift_definition map_diff_trans :: \"'signal transaction \\ 'signal transaction \\ 'signal transaction\"\n is map_diff_trans_raw unfolding sym[OF eventually_cofinite]\n by (simp add: map_diff_fin_variability)\n\nlift_definition map_add_trans :: \"'signal transaction \\ 'signal transaction \\ 'signal transaction\"\n is \"\\\\1 \\2 n. map_add (\\1 n) (\\2 n)\" unfolding sym[OF eventually_cofinite]\n by (simp add: map_add_fin_variability)\n\nlemma dom_map_diff_trans_post:\n \"dom (lookup (map_diff_trans (trans_post sig x def \\ t dly) \\) n) \\ {sig}\"\n by (transfer', simp add: dom_map_diff_trans_post)\n\nlemma dom_map_diff_purge:\n \"\\n. dom (lookup (map_diff_trans (purge \\ t dly sig def val) \\) n) \\ {sig}\"\n by (transfer', simp add: dom_map_diff_purge)\n\nlift_definition clean_zip ::\n \"'signal transaction \\ 'signal transaction \\ 'signal set \\ 'signal transaction \\ 'signal set \\\n 'signal transaction\"\n is clean_zip_raw unfolding sym[OF eventually_cofinite]\nproof (auto split:prod.splits)\n fix f x1 x1a:: \"nat \\ 'signal \\ val option\"\n fix x2 x2a\n assume assm1: \"\\\\<^sub>\\x. f x = 0\"\n assume assm2: \"\\\\<^sub>\\x. x1 x = 0\"\n assume assm3: \"\\\\<^sub>\\x. x1a x = 0\"\n thus \"\\\\<^sub>\\x. clean_zip_raw f (x1, x2) (x1a, x2a) x = 0\"\n using clean_zip_raw_almost_all_zero[OF assm1 assm2 assm3] by auto\nqed\n\nlift_definition conc_exec :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal conc_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\" is\n b_conc_exec .\n\ndeclare conc_exec.rep_eq[code_abbrev]\n\ninductive conc_exec_ind :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal conc_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\"\n where\n \"disjnt sl \\ \\ conc_exec_ind t \\ \\ \\ def (process sl : ss) \\ \\\"\n\n| \"seq_exec_ind t \\ \\ \\ def ss \\ \\' \\ \\ disjnt sl \\ \\\n conc_exec_ind t \\ \\ \\ def (process sl : ss) \\ \\'\"\n\n| \"conc_exec_ind t \\ \\ \\ def cs1 \\ \\1 \\ conc_exec_ind t \\ \\ \\ def cs2 \\ \\2 \\\n clean_zip \\ (\\1, set (signals_from cs1)) (\\2, set (signals_from cs2)) = \\'\n \\ conc_exec_ind t \\ \\ \\ def (cs1 || cs2) \\ \\'\"\n\nlemma conc_exec_eq_conc_exec_ind:\n \"conc_exec t \\ \\ \\ def cs \\ \\' = conc_exec_ind t \\ \\ \\ def cs \\ \\'\"\nproof\n assume \"conc_exec t \\ \\ \\ def cs \\ \\'\"\n hence \"conc_exec_ind t \\ \\ (Abs_poly_mapping (lookup \\)) def cs (Abs_poly_mapping (lookup \\)) (Abs_poly_mapping (lookup \\'))\"\n proof transfer\n fix t \\ \\\n fix \\ \\ \\':: \"nat \\ 'a \\ val option\"\n fix def cs\n assume 1: \"finite {x. \\ x \\ 0}\"\n assume 2: \"finite {x. \\ x \\ 0}\"\n assume 3: \"finite {x. \\' x \\ 0}\"\n assume \"t, \\, \\, \\, def \\ > \\\\<^sub>c \\'\"\n thus \"conc_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 1 2 3\n proof (induction rule: b_conc_exec.inducts)\n case (1 sl \\ t \\ \\ def ss \\)\n then show ?case by (auto intro!: conc_exec_ind.intros)\n next\n case (2 t \\ \\ \\ def ss \\ \\' sl)\n have \"seq_exec t \\ \\ (Abs_poly_mapping \\) def ss (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 2(1) unfolding seq_exec.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`] lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`]\n by auto\n then show ?case\n using 2(2) unfolding seq_exec_eq_seq_exec_ind\n by (auto intro!: conc_exec_ind.intros)\n next\n case (3 t \\ \\ \\ def cs1 \\ \\1 cs2 \\2 \\')\n hence \"finite {x. \\1 x \\ 0}\" and \"finite {x. \\2 x \\ 0}\"\n using b_conc_exec_almost_all_zero by blast+\n hence \" conc_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs1 (Abs_poly_mapping \\) (Abs_poly_mapping \\1)\"\n and \" conc_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs2 (Abs_poly_mapping \\) (Abs_poly_mapping \\2)\"\n using 3 by blast+\n have \"lookup (clean_zip (Abs_poly_mapping \\) (Abs_poly_mapping \\1, set (signals_from cs1)) (Abs_poly_mapping \\2, set (signals_from cs2))) =\n lookup (Abs_poly_mapping \\')\"\n using 3(3) unfolding clean_zip.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`]\n by (simp add: \\finite {x. \\1 x \\ 0}\\ \\finite {x. \\2 x \\ 0}\\)\n hence \"clean_zip (Abs_poly_mapping \\) (Abs_poly_mapping \\1, set (signals_from cs1)) (Abs_poly_mapping \\2, set (signals_from cs2)) =\n Abs_poly_mapping \\'\"\n unfolding lookup_inject by auto\n then show ?case\n using \\conc_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs1 (Abs_poly_mapping \\)\n (Abs_poly_mapping \\1)\\ \\conc_exec_ind t \\ \\ (Abs_poly_mapping \\) def cs2 (Abs_poly_mapping\n \\) (Abs_poly_mapping \\2)\\ conc_exec_ind.intros(3) by blast\n qed\n qed\n thus \"conc_exec_ind t \\ \\ \\ def cs \\ \\'\"\n unfolding lookup_inverse by auto\nnext\n assume \"conc_exec_ind t \\ \\ \\ def cs \\ \\'\"\n thus \"conc_exec t \\ \\ \\ def cs \\ \\'\"\n unfolding conc_exec.rep_eq\n proof (induction rule: conc_exec_ind.inducts)\n case (1 sl \\ t \\ \\ def ss \\)\n then show ?case by transfer' (auto intro!: b_conc_exec.intros)\n next\n case (2 t \\ \\ \\ def ss \\ \\' sl)\n then show ?case\n unfolding sym[OF seq_exec_eq_seq_exec_ind] by transfer' (auto intro!: b_conc_exec.intros)\n next\n case (3 t \\ \\ \\ def cs1 \\ \\1 cs2 \\2 \\')\n hence \"b_conc_exec t \\ \\ (lookup \\) def cs1 (lookup \\) (lookup \\1)\" and\n \"b_conc_exec t \\ \\ (lookup \\) def cs2 (lookup \\) (lookup \\2)\"\n using 3(1-2) by (transfer', auto)+\n then show ?case\n by (metis \"3.hyps\"(3) b_conc_exec.intros(3) clean_zip.rep_eq id_apply map_prod_simp)\n qed\nqed\n\nlemma conc_exec_ind_deterministic:\n assumes \"conc_exec_ind t \\ \\ \\ def cs \\ \\1\"\n assumes \"conc_exec_ind t \\ \\ \\ def cs \\ \\2\"\n shows \"\\2 = \\1\"\n using assms unfolding sym[OF conc_exec_eq_conc_exec_ind]\n by transfer' (simp add: b_conc_exec_deterministic)\n\nlemma conc_exec_ind_progress:\n assumes \"conc_wt \\ cs\" and \"styping \\ \\\" and \"transtyping \\ \\\" and \"styping \\ def\" and \"transtyping \\ \\\"\n shows \"\\\\'. conc_exec_ind t \\ \\ \\ def cs \\ \\'\"\n unfolding sym[OF conc_exec_eq_conc_exec_ind] using assms\nproof transfer\n fix \\ :: \"'a tyenv\"\n fix cs \\\n fix \\ \\ :: \"nat \\ 'a \\ val\"\n fix def t \\\n assume 1: \"conc_wt \\ cs\"\n assume 2: \"styping \\ \\\"\n assume 3: \"finite {x. \\ x \\ 0}\"\n assume 4: \"ttyping \\ \\\"\n assume 5: \"styping \\ def\"\n assume 6: \"finite {x. \\ x \\ 0}\"\n assume 7: \"ttyping \\ \\\"\n then obtain \\' where \"t, \\, \\, \\, def \\ > \\\\<^sub>c \\'\"\n using conc_stmts_progress[OF 1 2 4 5 7] by blast\n moreover hence \"finite {x. \\' x \\ 0}\"\n using b_conc_exec_almost_all_zero 3 6 by blast\n ultimately show \" Bex {f. finite {x. f x \\ 0}} (b_conc_exec t \\ \\ \\ def cs \\)\"\n by auto\nqed\n\nlemma conc_exec_ind_unique_progress:\n assumes \"conc_wt \\ cs\" and \"styping \\ \\\" and \"transtyping \\ \\\" and \"styping \\ def\" and \"transtyping \\ \\\"\n shows \"\\!\\'. conc_exec_ind t \\ \\ \\ def cs \\ \\'\"\n using assms conc_exec_ind_deterministic conc_exec_ind_progress\n by auto\n\nlift_definition init' :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal conc_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\"\n is Femto_VHDL_raw.init' .\n\ninductive init'_ind :: \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal conc_stmt \\ 'signal transaction \\ 'signal transaction \\ bool\" where\n \"seq_exec_ind t \\ \\ \\ def ss \\ \\' \\ init'_ind t \\ \\ \\ def (process sl : ss) \\ \\'\"\n| \"init'_ind t \\ \\ \\ def cs1 \\ \\1 \\ init'_ind t \\ \\ \\ def cs2 \\ \\2 \\\n clean_zip \\ (\\1, set (signals_from cs1)) (\\2, set (signals_from cs2)) = \\'\n \\ init'_ind t \\ \\ \\ def (cs1 || cs2) \\ \\'\"\n\nlemma init'_eq_init'_ind:\n \"init' t \\ \\ \\ def cs \\ \\' = init'_ind t \\ \\ \\ def cs \\ \\'\"\nproof\n assume \"init' t \\ \\ \\ def cs \\ \\'\"\n hence \"init'_ind t \\ \\ (Abs_poly_mapping (lookup \\)) def cs (Abs_poly_mapping (lookup \\)) (Abs_poly_mapping (lookup \\'))\"\n proof transfer\n fix t \\ \\\n fix \\ \\ \\' :: \"nat \\ 'a \\ val\"\n fix def cs\n assume 1: \"finite {x. \\ x \\ 0}\"\n assume 2: \"finite {x. \\ x \\ 0}\"\n assume 3: \"finite {x. \\' x \\ 0}\"\n assume \"Femto_VHDL_raw.init' t \\ \\ \\ def cs \\ \\' \"\n thus \"init'_ind t \\ \\ (Abs_poly_mapping \\) def cs (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 1 2 3\n proof (induction rule:Femto_VHDL_raw.init'.inducts)\n case (1 t \\ \\ \\ def ss \\ \\' sl)\n have \" seq_exec t \\ \\ (Abs_poly_mapping \\) def ss (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n using 1 by (simp add: seq_exec.rep_eq)\n then show ?case\n unfolding seq_exec_eq_seq_exec_ind\n by (simp add: init'_ind.intros(1))\n next\n case (2 t \\ \\ \\ def cs1 \\ \\1 cs2 \\2 \\')\n hence \"finite {x. \\1 x \\ 0}\" and \"finite {x. \\2 x \\ 0}\"\n using init'_raw_almost_all_zero by blast+\n hence \"init'_ind t \\ \\ (Abs_poly_mapping \\) def cs1 (Abs_poly_mapping \\) (Abs_poly_mapping \\1)\"\n and \"init'_ind t \\ \\ (Abs_poly_mapping \\) def cs2 (Abs_poly_mapping \\) (Abs_poly_mapping \\2)\"\n using 2 by auto\n have \"lookup (clean_zip (Abs_poly_mapping \\) (Abs_poly_mapping \\1, set (signals_from cs1)) (Abs_poly_mapping \\2, set (signals_from cs2))) =\n lookup (Abs_poly_mapping \\')\"\n using 2(3) unfolding clean_zip.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`]\n lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`]\n by (simp add: \\finite {x. \\1 x \\ 0}\\ \\finite {x. \\2 x \\ 0}\\)\n hence \"clean_zip (Abs_poly_mapping \\) (Abs_poly_mapping \\1, set (signals_from cs1)) (Abs_poly_mapping \\2, set (signals_from cs2)) = Abs_poly_mapping \\'\"\n unfolding lookup_inject by auto\n then show ?case\n using \\init'_ind t \\ \\ (Abs_poly_mapping \\) def cs1 (Abs_poly_mapping \\) (Abs_poly_mapping\n \\1)\\ \\init'_ind t \\ \\ (Abs_poly_mapping \\) def cs2 (Abs_poly_mapping \\) (Abs_poly_mapping\n \\2)\\ init'_ind.intros(2) by blast\n qed\n qed\n thus \"init'_ind t \\ \\ \\ def cs \\ \\'\"\n unfolding lookup_inverse by auto\nnext\n assume \"init'_ind t \\ \\ \\ def cs \\ \\'\"\n thus \"init' t \\ \\ \\ def cs \\ \\'\"\n unfolding init'.rep_eq\n proof (induction rule: init'_ind.inducts)\n case (1 t \\ \\ \\ def ss \\ \\' sl)\n then show ?case\n unfolding sym[OF seq_exec_eq_seq_exec_ind]\n by (transfer', auto intro!: Femto_VHDL_raw.init'.intros)\n next\n case (2 t \\ \\ \\ def cs1 \\ \\1 cs2 \\2 \\')\n have \"clean_zip_raw (lookup \\) (lookup \\1, set (signals_from cs1)) (lookup \\2, set (signals_from cs2)) = lookup \\'\"\n using 2(3) by transfer' auto\n then show ?case\n using \"2.IH\"(1) \"2.IH\"(2) init'.intros(2) by blast\n qed\nqed\n\ndefinition rem_curr_trans :: \"nat \\ 'signal transaction \\ 'signal transaction\" where\n \"rem_curr_trans t \\ = Poly_Mapping.update t 0 \\\"\n\nsubsection \\Semantics of simulation\\\n\nlift_definition next_time :: \"nat \\ 'signal transaction \\ nat\"\n is Femto_VHDL_raw.next_time .\n\ndeclare next_time.rep_eq[code_abbrev]\n\nlift_definition quiet :: \"'signal transaction \\ 'signal event \\ bool\"\n is Femto_VHDL_raw.quiet .\n\ndeclare quiet.rep_eq[code_abbrev]\n\nlemma [code]:\n \"quiet \\ \\ = (if \\ = 0 \\ \\ = {} then True else False)\"\n by (transfer', auto simp add: Femto_VHDL_raw.quiet_def zero_fun_def zero_option_def)\n\nlift_definition next_state :: \"nat \\ 'signal transaction \\ 'signal state \\ 'signal state\"\n is Femto_VHDL_raw.next_state .\n\ndeclare next_state.rep_eq[code_abbrev]\n\nlemma [code]:\n \"next_state t \\' \\ = (let m = lookup \\' (next_time t \\') in override_on \\ (the o m) (dom m))\"\n by (transfer', auto simp add: Femto_VHDL_raw.next_state_def)\n\nlift_definition next_event :: \"nat \\ 'signal transaction \\ 'signal state \\ 'signal event\"\n is Femto_VHDL_raw.next_event .\n\ndeclare next_event.rep_eq[code_abbrev]\n\nlemma [code]:\n \"next_event t \\' \\ = (let m = lookup \\' (next_time t \\') in\n {sig. if sig \\ dom m then (the o m) sig \\ \\ sig else False})\"\n by (transfer', auto simp add: Femto_VHDL_raw.next_event_def Let_def)\n\nlift_definition add_to_beh ::\n \"'signal state \\ 'signal transaction \\ nat \\ nat \\ 'signal transaction\"\n is Femto_VHDL_raw.add_to_beh unfolding add_to_beh_def sym[OF eventually_cofinite]\n by (metis (mono_tags) upd_eventually_cofinite)\n\nlemma [code]:\n \"add_to_beh \\ \\ st fi = (if st < fi then Poly_Mapping.update st (Some o \\) \\ else \\)\"\n by (transfer', auto simp add: Femto_VHDL_raw.add_to_beh_def)\n\nlift_definition simulate_fin :: \"nat \\ nat \\ 'a state \\ 'a event \\ 'a transaction \\ 'a state \\\n 'a conc_stmt \\ 'a transaction \\ nat \\ 'a state \\ 'a transaction \\ 'a transaction \\ bool\"\n is b_simulate_fin .\n\ninductive simulate_fin_ind :: \"nat \\ nat \\ 'signal state \\ 'signal event \\ 'signal transaction \\ 'signal state \\\n 'signal conc_stmt \\ 'signal transaction \\ nat \\ 'signal state \\ 'signal transaction \\ 'signal transaction \\ bool\"\n where\n\n \\ \\Business as usual: not quiesced yet and there is still time\\\n \" (t < maxtime)\n \\ (\\ quiet \\ \\)\n \\ (conc_exec_ind t \\ \\ \\ def cs \\ \\')\n \\ next_time t \\' \\ maxtime\n \\ simulate_fin_ind\n maxtime\n (next_time t \\')\n (next_state t \\' \\)\n (next_event t \\' \\)\n (add_to_beh \\ \\ t (next_time t \\')) def cs (rem_curr_trans (next_time t \\') \\') res\n \\ simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res\"\n\n \\ \\Business as usual: not quiesced yet and there is still time --- case 2\\\n| \" (t < maxtime)\n \\ (\\ quiet \\ \\)\n \\ (conc_exec_ind t \\ \\ \\ def cs \\ \\')\n \\ (maxtime < next_time t \\')\n \\ simulate_fin_ind maxtime t \\ \\ \\ def cs \\ (maxtime, \\, Poly_Mapping.update t (Some o \\) \\, \\')\"\n\n \\ \\The simulation has quiesced and there is still time\\\n| \" (t < maxtime)\n \\ (quiet \\ \\)\n \\ simulate_fin_ind maxtime t \\ \\ \\ def cs \\ (maxtime, \\, Poly_Mapping.update t (Some o \\) \\, 0)\"\n\n \\ \\Time is up\\\n| \" t = maxtime\n \\ simulate_fin_ind maxtime t \\ \\ \\ def cs \\ (maxtime, \\, \\, \\)\"\n\nthm b_simulate_fin_deterministic\n\nlemma simulate_fin_deterministic:\n assumes \"simulate_fin maxtime t \\ \\ \\ def cs \\ res1\"\n assumes \"simulate_fin maxtime t \\ \\ \\ def cs \\ res2\"\n shows \"res2 = res1\"\n using assms\n by (transfer', auto simp add: b_simulate_fin_deterministic)\n\ninductive_cases bau2: \"simulate_fin_ind maxtime t \\ \\ def \\ cs \\ res\"\n\nlemma simulate_fin_eq_simulate_fin_ind:\n \"simulate_fin maxtime t \\ \\ \\ def cs \\ res = simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res\"\nproof\n assume \"simulate_fin maxtime t \\ \\ \\ def cs \\ res\"\n hence \"simulate_fin_ind maxtime t \\ \\ (Abs_poly_mapping (lookup \\)) def cs (Abs_poly_mapping (lookup \\))\n (get_time res, get_state res, (Abs_poly_mapping (lookup (get_beh res))), (Abs_poly_mapping (lookup (get_trans res))))\"\n proof transfer\n fix maxtime t :: nat\n fix \\ :: \"'a state \"\n fix \\ def cs\n fix \\ \\ :: \"'a trans_raw\"\n fix res :: \"nat \\ 'a state \\ 'a trans_raw \\ 'a trans_raw\"\n assume fin_trans: \"finite {x. \\ x \\ 0}\"\n assume fin_hist: \"finite {x. \\ x \\ 0}\"\n assume fin_res: \"pred_prod top (pred_prod (pred_fun top top) (pred_prod (\\f. finite {x. f x \\ 0}) (\\f. finite {x. f x \\ 0}))) res\"\n hence fin_res1: \"finite {x. get_beh res x \\ 0}\" and fin_res2: \"finite {x. get_trans res x \\ 0}\"\n by (metis (no_types, lifting) Collect_cong comp_eq_dest_lhs pred_prod_beta)+\n assume \"maxtime, t , \\ , \\ , \\, def \\ > \\ res\"\n thus \"simulate_fin_ind maxtime t \\ \\ (Abs_poly_mapping \\) def cs (Abs_poly_mapping \\) (get_time res, get_state res, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n using fin_res1 fin_res2 fin_hist fin_trans\n proof (induction rule:b_simulate_fin.induct)\n case (1 t maxtime \\ \\ \\ \\ def cs \\' res)\n have \"\\ quiet (Abs_poly_mapping \\) \\\"\n using 1(2) unfolding quiet.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`] by auto\n\n \\ \\several abbreviations for simplifying the proof notation\\\n let ?\\ = \"Abs_poly_mapping \\\"\n let ?\\ = \"Abs_poly_mapping \\\"\n let ?res = \"(t, \\, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n obtain q\\' where qt_def: \"conc_exec t \\ \\ ?\\ def cs ?\\ q\\'\"\n by (metis (no_types, lifting) \"1.hyps\"(3) \"1.prems\"(3) \"1.prems\"(4) Collect_cong b_conc_exec_almost_all_zero conc_exec.abs_eq eq_onp_same_args)\n note fin_res1 = `finite {x. get_beh res x \\ 0}`\n note fin_res2 = `finite {x. get_trans res x \\ 0}`\n note fin_trans = `finite {x. \\ x \\ 0}`\n note fin_hist = `finite {x. \\ x \\ 0}`\n\n \\ \\obtaining inductive hypothesis\\\n have \"finite {x. Femto_VHDL_raw.add_to_beh \\ \\ t (Femto_VHDL_raw.next_time t \\') x \\ 0}\"\n using add_to_beh_almost_all_zero[OF fin_hist] by auto\n moreover have \"finite {x. \\' x \\ 0}\"\n using b_conc_exec_almost_all_zero[OF `t , \\ , \\ , \\, def \\ > \\\\<^sub>c \\'` fin_trans fin_hist]\n by auto\n moreover hence \"finite {x. (\\'(Femto_VHDL_raw.next_time t \\' := 0)) x \\ 0}\"\n using rem_next_time_almost_all_zero by metis\n ultimately have IH: \"simulate_fin_ind maxtime (Femto_VHDL_raw.next_time t \\')\n (Femto_VHDL_raw.next_state t \\' \\)\n (Femto_VHDL_raw.next_event t \\' \\)\n (Abs_poly_mapping (Femto_VHDL_raw.add_to_beh \\ \\ t (Femto_VHDL_raw.next_time t \\')))\n def cs\n (Abs_poly_mapping (\\'(Femto_VHDL_raw.next_time t \\' := 0)))\n (get_time res, get_state res, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n using 1(6)[OF fin_res1 fin_res2] by metis \n\n \\ \\continuing the proof\\\n have nt: \"Femto_VHDL_raw.next_time t \\' = next_time t q\\'\" and\n ns: \"Femto_VHDL_raw.next_state t \\' \\ = next_state t q\\' \\\" and\n ne: \"Femto_VHDL_raw.next_event t \\' \\ = next_event t q\\' \\\" and\n nb: \"Femto_VHDL_raw.add_to_beh \\ \\ t (Femto_VHDL_raw.next_time t \\') =\n lookup (add_to_beh \\ ?\\ t (next_time t q\\'))\"\n unfolding next_time.rep_eq next_state.rep_eq next_event.rep_eq add_to_beh.rep_eq\n conc_exec.rep_eq lookup_Abs_poly_mapping[OF fin_hist] lookup_Abs_poly_mapping[OF fin_trans]\n using `t , \\ , \\ , \\, def \\ > \\\\<^sub>c \\'` qt_def\n by (metis \\lookup (Abs_poly_mapping \\) = \\\\ \\lookup (Abs_poly_mapping \\) = \\\\ b_conc_exec_deterministic conc_exec.rep_eq)+\n have ntr: \"\\'(Femto_VHDL_raw.next_time t \\' := 0) = lookup (rem_curr_trans (next_time t q\\') q\\')\"\n unfolding rem_curr_trans_def Poly_Mapping.update.rep_eq conc_exec.rep_eq next_time.rep_eq\n lookup_Abs_poly_mapping[OF fin_hist] lookup_Abs_poly_mapping[OF fin_trans]\n using `t , \\ , \\ , \\, def \\ > \\\\<^sub>c \\'` qt_def\n by (metis \\lookup (Abs_poly_mapping \\) = \\\\ \\lookup (Abs_poly_mapping \\) = \\\\ b_conc_exec_deterministic conc_exec.rep_eq)+\n have sim: \"simulate_fin_ind maxtime (next_time t q\\') (next_state t q\\' \\) (next_event t q\\' \\)\n (add_to_beh \\ ?\\ t (next_time t q\\')) def cs (rem_curr_trans (next_time t q\\') q\\')\n (get_time res, get_state res, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n using IH by (metis lookup_inverse nt ns ne nb nt ntr)\n show ?case\n using simulate_fin_ind.intros(1)[OF `t < maxtime` `\\ quiet ?\\ \\` _ _ sim] qt_def \n \\Femto_VHDL_raw.next_time t \\' \\ maxtime\\\n unfolding conc_exec_eq_conc_exec_ind using nt by linarith\n next\n case (2 t maxtime \\ \\ \\ \\ def cs \\')\n hence \"\\ quiet (Abs_poly_mapping \\) \\\"\n using 2(2) unfolding quiet.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`] by auto\n\n \\ \\several abbreviations for simplifying the proof notation\\\n let ?\\ = \"Abs_poly_mapping \\\"\n let ?\\ = \"Abs_poly_mapping \\\"\n let ?res = \"(t, \\, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n obtain q\\' where qt_def: \"conc_exec t \\ \\ ?\\ def cs ?\\ q\\'\"\n by (metis (no_types, lifting) 2 Collect_cong b_conc_exec_almost_all_zero conc_exec.abs_eq eq_onp_same_args)\n note fin_res1 = `finite {x. get_beh res x \\ 0}`\n note fin_res2 = `finite {x. get_trans res x \\ 0}`\n note fin_trans = `finite {x. \\ x \\ 0}`\n note fin_hist = `finite {x. \\ x \\ 0}`\n have qt_def': \"conc_exec_ind t \\ \\ ?\\ def cs ?\\ q\\'\"\n using qt_def unfolding conc_exec_eq_conc_exec_ind by auto\n have nt: \"Femto_VHDL_raw.next_time t \\' = next_time t q\\'\" and\n ns: \"Femto_VHDL_raw.next_state t \\' \\ = next_state t q\\' \\\" and\n ne: \"Femto_VHDL_raw.next_event t \\' \\ = next_event t q\\' \\\" and\n nb: \"Femto_VHDL_raw.add_to_beh \\ \\ t (Femto_VHDL_raw.next_time t \\') =\n lookup (add_to_beh \\ ?\\ t (next_time t q\\'))\"\n unfolding next_time.rep_eq next_state.rep_eq next_event.rep_eq add_to_beh.rep_eq\n conc_exec.rep_eq lookup_Abs_poly_mapping[OF fin_hist] lookup_Abs_poly_mapping[OF fin_trans]\n using `t , \\ , \\ , \\, def \\ > \\\\<^sub>c \\'` qt_def\n by (metis \\lookup (Abs_poly_mapping \\) = \\\\ \\lookup (Abs_poly_mapping \\) = \\\\ b_conc_exec_deterministic conc_exec.rep_eq)+\n hence \"maxtime < Femto_VHDL.next_time t q\\'\"\n using 2(4) by auto\n have \"lookup (Poly_Mapping.update t (Some \\ \\) (Abs_poly_mapping \\)) = (\\(t := Some \\ \\))\"\n unfolding Poly_Mapping.update.rep_eq lookup_Abs_poly_mapping[OF 2(5)]\n by (simp add: \"2.prems\"(3))\n hence \"Abs_poly_mapping (\\(t := Some \\ \\)) = Poly_Mapping.update t (Some \\ \\) (Abs_poly_mapping \\)\"\n by (metis lookup_inverse)\n have \"lookup (Abs_poly_mapping \\) = \\\"\n using fin_hist by auto\n moreover have \"lookup (Abs_poly_mapping \\) = \\\" \n by (simp add: \"2.prems\"(4))\n ultimately have \"lookup q\\' = \\'\"\n using qt_def \\t , \\ , \\ , \\, def \\ > \\\\<^sub>c \\'\\ unfolding conc_exec.rep_eq\n using b_conc_exec_deterministic by fastforce\n hence \"Abs_poly_mapping \\' = q\\'\"\n using lookup_inverse by blast\n show ?case \n using simulate_fin_ind.intros(2)[OF `t < maxtime` \\\\ quiet (Abs_poly_mapping \\) \\\\ qt_def' \\maxtime < Femto_VHDL.next_time t q\\'\\]\n by (metis \\Abs_poly_mapping (\\(t := Some \\ \\)) = Poly_Mapping.update t (Some \\ \\)\n (Abs_poly_mapping \\)\\ \\Abs_poly_mapping \\' = q\\'\\ comp_apply fst_conv snd_conv)\n next\n case (3 t maxtime \\ \\ \\ \\ def cs)\n have *: \"quiet (Abs_poly_mapping \\) \\\"\n using 3 unfolding quiet.rep_eq lookup_Abs_poly_mapping[OF `finite {x. \\ x \\ 0}`] by auto\n have \"lookup (Poly_Mapping.update t (Some \\ \\) (Abs_poly_mapping \\)) = (\\(t := Some \\ \\))\"\n unfolding Poly_Mapping.update.rep_eq lookup_Abs_poly_mapping[OF 3(4)]\n by (simp add: \"3.prems\"(3))\n hence \"Abs_poly_mapping (\\(t := Some \\ \\)) = Poly_Mapping.update t (Some \\ \\) (Abs_poly_mapping \\)\"\n by (metis lookup_inverse)\n thus ?case\n using simulate_fin_ind.intros(3)[OF 3(1) *]\n proof -\n have \"lookup (Abs_poly_mapping (0::nat \\ 'a \\ val option)) = 0\"\n using \"3.prems\"(2) by force\n then show ?thesis\n by (metis (no_types) \\Abs_poly_mapping (\\(t := Some \\ \\)) = Poly_Mapping.update t (Some \\\n \\) (Abs_poly_mapping \\)\\ \\\\def cs \\ \\. simulate_fin_ind maxtime t \\ \\ \\ def cs\n (Abs_poly_mapping \\) (maxtime, \\, Poly_Mapping.update t (Some \\ \\) \\, empty_trans)\\\n comp_apply fst_conv lookup_zero poly_mapping_eqI snd_conv zero_fun_def)\n qed\n next\n case (4 t maxtime \\ \\ \\ def cs \\)\n then show ?case\n using simulate_fin_ind.intros(4)[OF 4(1)] by auto\n qed\n qed\n thus \"simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res\"\n unfolding lookup_inverse by auto\nnext\n assume \"simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res\"\n thus \"simulate_fin maxtime t \\ \\ \\ def cs \\ res\"\n unfolding simulate_fin.rep_eq\n proof (induction rule: simulate_fin_ind.induct)\n case (1 t maxtime \\ \\ \\ \\ def cs \\' res)\n then show ?case \n unfolding sym[OF conc_exec_eq_conc_exec_ind]\n by (metis Femto_VHDL.rem_curr_trans_def add_to_beh.rep_eq b_simulate_fin.intros(1)\n conc_exec.rep_eq next_event.rep_eq next_state.rep_eq next_time.rep_eq quiet.rep_eq\n update.rep_eq)\n next\n case (2 t maxtime \\ \\ \\ \\ def cs \\')\n then show ?case \n unfolding sym[OF conc_exec_eq_conc_exec_ind]\n by (simp add: b_simulate_fin.intros(2) conc_exec.rep_eq next_time.rep_eq quiet.rep_eq update.rep_eq)\n next\n case (3 t maxtime \\ \\ \\ \\ def cs)\n then show ?case \n unfolding sym[OF conc_exec_eq_conc_exec_ind]\n by (smt Femto_VHDL_raw.quiet_def apsnd_conv apsnd_def b_simulate_fin.intros(3) lookup_zero\n map_prod_def old.prod.case poly_mapping_eqI quiet.rep_eq update.rep_eq zero_fun_def)\n qed (simp add: b_simulate_fin.intros(4))\nqed\n\nlemma simulate_fin_ind_deterministic:\n assumes \"simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res1\"\n assumes \"simulate_fin_ind maxtime t \\ \\ \\ def cs \\ res2\"\n shows \"res2 = res1\"\n using assms unfolding sym[OF simulate_fin_eq_simulate_fin_ind]\n by (auto simp add: simulate_fin_deterministic)\n\nlift_definition simulate :: \"nat \\ 'a state \\ 'a conc_stmt \\ 'a transaction \\ nat \\ 'a state \\ 'a transaction \\ 'a transaction \\ bool\"\n is b_simulate .\n\ninductive simulate_ind :: \"nat \\ 'a state \\ 'a conc_stmt \\ 'a transaction \\ nat \\ 'a state \\ 'a transaction \\ 'a transaction \\ bool\" where\n \" init'_ind 0 def {} 0 def cs \\ \\'\n \\ next_time 0 \\' = t'\n \\ next_state 0 \\' def = \\'\n \\ next_event 0 \\' def = \\'\n \\ add_to_beh def 0 0 t' = beh'\n \\ simulate_fin_ind maxtime t' \\' \\' beh' def cs (rem_curr_trans t' \\') res\n \\ simulate_ind maxtime def cs \\ res\"\n\nlemma simulate_eq_simulate_ind:\n \"simulate maxtime def cs \\ res = simulate_ind maxtime def cs \\ res\"\nproof\n assume \"simulate maxtime def cs \\ res\"\n hence \"simulate_ind maxtime def cs (Abs_poly_mapping (lookup \\))\n (get_time res, get_state res, (Abs_poly_mapping (lookup (get_beh res))), (Abs_poly_mapping (lookup (get_trans res))))\"\n proof transfer\n fix maxtime :: nat\n fix def\n fix \\ :: \"'a trans_raw\"\n fix res :: \"nat \\ 'a state \\ 'a trans_raw \\ 'a trans_raw\"\n fix cs :: \"'a conc_stmt\"\n assume fin_trans: \"finite {x. \\ x \\ 0}\"\n assume fin_hist: \"pred_prod top (pred_prod (pred_fun top top) (pred_prod (\\f. finite {x. f x \\ 0}) (\\f. finite {x. f x \\ 0}))) res\"\n hence fin_hist1: \"finite {x. get_beh res x \\ 0}\" and fin_hist2: \"finite {x. get_trans res x \\ 0}\"\n by (simp add: pred_prod_beta)+\n assume \"b_simulate maxtime def cs \\ res\"\n thus \"simulate_ind maxtime def cs (Abs_poly_mapping \\)\n (get_time res, get_state res, (Abs_poly_mapping (get_beh res)), Abs_poly_mapping (get_trans res))\"\n using fin_trans fin_hist1 fin_hist2\n proof (induction rule: b_simulate.induct)\n case (1 def cs \\ \\' t' \\' \\' beh' maxtime res)\n note fin_trans = `finite {x. \\ x \\ 0}`\n note fin_hist1 = `finite {x. get_beh res x \\ 0}`\n note fin_hist2 = `finite {x. get_trans res x \\ 0}`\n have fin_next_trans: \"finite {x. \\' x \\ 0}\"\n using init'_raw_almost_all_zero[OF 1(1) _ fin_trans]\n by (simp add: zero_fun_def)\n \\ \\obtaining the first premise in the proof rule of @{term \"simulate_ind\"}\\\n have look_abs_trans: \"lookup (Abs_poly_mapping \\) = \\\"\n using lookup_Abs_poly_mapping[OF fin_trans] by auto\n have \"lookup (Abs_poly_mapping \\') = \\'\"\n using lookup_Abs_poly_mapping[OF `finite {x. \\' x \\ 0}`] by auto\n have \"lookup empty_trans = 0\"\n by (transfer', auto simp add: zero_fun_def)\n have prem1: \"init' 0 def {} 0 def cs (Abs_poly_mapping \\) (Abs_poly_mapping \\')\"\n unfolding init'.rep_eq `lookup empty_trans = 0` using 1(1)\n by (simp add: \\lookup (Abs_poly_mapping \\') = \\'\\ look_abs_trans)\n\n \\ \\obtaining the 2nd and 3rd premise in the proof rule of @{term \"simulate_ind\"}\\\n have prem2: \"next_time 0 (Abs_poly_mapping \\') = t'\" and\n prem3: \"next_state 0 (Abs_poly_mapping \\') def = \\'\"\n using 1(2) 1(3) unfolding next_time.rep_eq next_state.rep_eq\n lookup_Abs_poly_mapping[OF fin_next_trans] by auto\n\n \\ \\obtaining the 4th premise in the proof rule of @{term \"simulate_ind\"}\\\n have prem4: \"next_event 0 (Abs_poly_mapping \\') def = \\'\"\n using 1(4) unfolding next_event.rep_eq\n lookup_Abs_poly_mapping[OF fin_next_trans] by auto\n\n \\ \\obtaining the 5th premise in the proof rule of @{term \"simulate_ind\"}\\\n have \"lookup (add_to_beh def 0 0 t') = beh'\" (is \"?lhs0 = ?rhs0\")\n using 1(5) by (transfer', auto simp add: zero_fun_def)\n hence \"Abs_poly_mapping ?lhs0 = Abs_poly_mapping ?rhs0\"\n by auto\n hence prem5: \"add_to_beh def 0 0 t' = Abs_poly_mapping beh'\"\n unfolding lookup_inverse by auto\n\n \\ \\obtaining the 6th premise in the proof rule of @{term \"simulate_ind\"}\\\n let ?beh' = \"Abs_poly_mapping beh'\"\n let ?res = \"(get_time res, get_state res, (Abs_poly_mapping (get_beh res)), Abs_poly_mapping (get_trans res))\"\n let ?\\' = \"Abs_poly_mapping \\'\"\n have lookup_res: \"(get_time res, get_state res, lookup (Abs_poly_mapping (get_beh res)), lookup (Abs_poly_mapping (get_trans res))) = res\"\n using lookup_Abs_poly_mapping[OF fin_hist1] lookup_Abs_poly_mapping[OF fin_hist2]\n by auto\n have \"finite {x. beh' x \\ 0}\"\n using 1(5) unfolding Femto_VHDL_raw.add_to_beh_def by (auto simp add: zero_fun_def)\n hence lookup_beh: \"lookup ?beh' = beh'\"\n by (auto intro!: lookup_Abs_poly_mapping)\n have lookup_rem: \"lookup (rem_curr_trans t' ?\\') = \\'(t':=0)\"\n unfolding rem_curr_trans_def update.rep_eq lookup_Abs_poly_mapping[OF fin_next_trans]\n by auto\n have \"simulate_fin maxtime t' \\' \\' ?beh' def cs (rem_curr_trans t' ?\\') ?res\"\n using 1(6) unfolding simulate_fin.rep_eq lookup_beh lookup_rem\n using lookup_res by auto\n hence prem6: \"simulate_fin_ind maxtime t' \\' \\' ?beh' def cs (rem_curr_trans t' ?\\') ?res\"\n using simulate_fin_eq_simulate_fin_ind by metis\n show \"simulate_ind maxtime def cs (Abs_poly_mapping \\)\n (get_time res, get_state res, Abs_poly_mapping (get_beh res), Abs_poly_mapping (get_trans res))\"\n using prem1 prem2 prem3 prem4 prem5 prem6\n unfolding init'_eq_init'_ind by (auto intro!:simulate_ind.intros)\n qed\n qed\n thus \"simulate_ind maxtime def cs \\ res\"\n unfolding lookup_inverse by auto\nnext\n assume \"simulate_ind maxtime def cs \\ res\"\n thus \"simulate maxtime def cs \\ res\"\n unfolding simulate.rep_eq\n proof (induction rule:simulate_ind.induct)\n case (1 def cs \\ \\' t' \\' \\' beh' maxtime res)\n have prem1: \"Femto_VHDL_raw.init' 0 def {} 0 def cs (lookup \\) (lookup \\')\"\n using 1(1) unfolding sym[OF init'_eq_init'_ind] by (transfer', auto simp add: zero_fun_def)\n have prem2: \"Femto_VHDL_raw.next_time 0 (lookup \\') = t'\"\n using 1(2) by transfer'\n have prem3: \"Femto_VHDL_raw.next_state 0 (lookup \\') def = \\'\"\n using 1(3) by transfer'\n have prem4: \"Femto_VHDL_raw.next_event 0 (lookup \\') def = \\'\"\n using 1(4) by transfer'\n have prem5: \"Femto_VHDL_raw.add_to_beh def 0 0 t' = (lookup beh')\"\n using 1(5) by (transfer', auto simp add: zero_fun_def)\n have prem6: \"maxtime, t', \\', \\', (lookup beh'), def \\ ')(t' := 0)> \\ (get_time res, get_state res, lookup (get_beh res), lookup (get_trans res))\"\n using 1(6) unfolding sym[OF simulate_fin_eq_simulate_fin_ind] rem_curr_trans_def\n by (transfer', auto)\n have helper: \"map_prod id (map_prod id (map_prod lookup lookup)) res = (get_time res, get_state res, lookup (get_beh res), lookup (get_trans res))\"\n by (metis (no_types, hide_lams) apsnd_conv apsnd_def comp_apply fst_map_prod prod.exhaust_sel snd_map_prod)\n show ?case\n using prem1 prem2 prem3 prem4 prem5 prem6 unfolding helper\n by(auto intro!: b_simulate.intros)\n qed\nqed\n\ntype_synonym 'signal configuration = \"nat \\ 'signal state \\ 'signal event \\ 'signal transaction\"\n\nlift_definition update_config :: \"'signal configuration \\ 'signal transaction \\ 'signal configuration\"\n is update_config_raw unfolding sym[OF eventually_cofinite]\nproof -\n fix config :: \"nat \\ 'signal state \\ 'signal event \\ 'signal trans_raw\"\n fix \\' :: \"'signal trans_raw\"\n assume *: \"pred_prod top (pred_prod top (pred_prod top (\\f. \\\\<^sub>\\x. f x = 0))) config\"\n obtain t \\ \\ \\ where \"config = (t, \\, \\, \\)\"\n using prod_cases4 by blast\n hence \"\\\\<^sub>\\x. \\ x = 0\"\n using * by auto\n assume \"\\\\<^sub>\\x. \\' x = 0\"\n obtain t' \\' \\' \\' where \"update_config_raw config \\' = (t', \\', \\', \\')\" and\n \"t' = Femto_VHDL_raw.next_time t \\'\" and \"\\' = Femto_VHDL_raw.next_state t \\' \\\" and\n \"\\' = Femto_VHDL_raw.next_event t \\' \\\" and \"\\' = Femto_VHDL_raw.add_to_beh \\ \\ t t'\"\n using `config = (t, \\, \\, \\)` by (metis update_config_raw.simps)\n have \"\\\\<^sub>\\x. Femto_VHDL_raw.add_to_beh \\ \\ t t' x = 0\"\n unfolding Femto_VHDL_raw.add_to_beh_def using `\\\\<^sub>\\x. \\ x = 0`\n by (metis (mono_tags) upd_eventually_cofinite)\n thus \"pred_prod top (pred_prod top (pred_prod top (\\f. \\\\<^sub>\\x. f x = 0))) (update_config_raw config \\')\"\n by (simp add: \\\\' = Femto_VHDL_raw.add_to_beh \\ \\ t t'\\ \\update_config_raw config \\' = (t', \\', \\', \\')\\)\nqed\n\nlift_definition simulate_fin_ss :: \"nat \\ 'signal state \\ 'signal conc_stmt \\\n 'signal transaction \\ 'signal configuration \\ 'signal transaction \\ 'signal configuration \\ bool\"\n is b_simulate_fin_ss .\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Femto_VHDL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.44552953503957277, "lm_q1q2_score": 0.26906946907552276}} {"text": "(* Title: HOL/HOLCF/IOA/SimCorrectness.thy\n Author: Olaf Müller\n*)\n\nsection \\Correctness of Simulations in HOLCF/IOA\\\n\ntheory SimCorrectness\nimports Simulations\nbegin\n\n(*Note: s2 instead of s1 in last argument type!*)\ndefinition corresp_ex_simC ::\n \"('a, 's2) ioa \\ ('s1 \\ 's2) set \\ ('a, 's1) pairs \\ ('s2 \\ ('a, 's2) pairs)\"\n where \"corresp_ex_simC A R =\n (fix \\ (LAM h ex. (\\s. case ex of\n nil \\ nil\n | x ## xs \\\n (flift1\n (\\pr.\n let\n a = fst pr;\n t = snd pr;\n T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s a t'\n in (SOME cex. move A cex s a T') @@ ((h \\ xs) T')) \\ x))))\"\n\ndefinition corresp_ex_sim ::\n \"('a, 's2) ioa \\ ('s1 \\ 's2) set \\ ('a, 's1) execution \\ ('a, 's2) execution\"\n where \"corresp_ex_sim A R ex \\\n let S' = SOME s'. (fst ex, s') \\ R \\ s' \\ starts_of A\n in (S', (corresp_ex_simC A R \\ (snd ex)) S')\"\n\n\nsubsection \\\\corresp_ex_sim\\\\\n\nlemma corresp_ex_simC_unfold:\n \"corresp_ex_simC A R =\n (LAM ex. (\\s. case ex of\n nil \\ nil\n | x ## xs \\\n (flift1\n (\\pr.\n let\n a = fst pr;\n t = snd pr;\n T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s a t'\n in (SOME cex. move A cex s a T') @@ ((corresp_ex_simC A R \\ xs) T')) \\ x)))\"\n apply (rule trans)\n apply (rule fix_eq2)\n apply (simp only: corresp_ex_simC_def)\n apply (rule beta_cfun)\n apply (simp add: flift1_def)\n done\n\nlemma corresp_ex_simC_UU [simp]: \"(corresp_ex_simC A R \\ UU) s = UU\"\n apply (subst corresp_ex_simC_unfold)\n apply simp\n done\n\nlemma corresp_ex_simC_nil [simp]: \"(corresp_ex_simC A R \\ nil) s = nil\"\n apply (subst corresp_ex_simC_unfold)\n apply simp\n done\n\nlemma corresp_ex_simC_cons [simp]:\n \"(corresp_ex_simC A R \\ ((a, t) \\ xs)) s =\n (let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s a t'\n in (SOME cex. move A cex s a T') @@ ((corresp_ex_simC A R \\ xs) T'))\"\n apply (rule trans)\n apply (subst corresp_ex_simC_unfold)\n apply (simp add: Consq_def flift1_def)\n apply simp\n done\n\n\nsubsection \\Properties of move\\\n\nlemma move_is_move_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in (t, T') \\ R \\ move A (SOME ex2. move A ex2 s' a T') s' a T'\"\n supply Let_def [simp del]\n apply (unfold is_simulation_def)\n (* Does not perform conditional rewriting on assumptions automatically as\n usual. Instantiate all variables per hand. Ask Tobias?? *)\n apply (subgoal_tac \"\\t' ex. (t, t') \\ R \\ move A ex s' a t'\")\n prefer 2\n apply simp\n apply (erule conjE)\n apply (erule_tac x = \"s\" in allE)\n apply (erule_tac x = \"s'\" in allE)\n apply (erule_tac x = \"t\" in allE)\n apply (erule_tac x = \"a\" in allE)\n apply simp\n (* Go on as usual *)\n apply (erule exE)\n apply (drule_tac x = \"t'\" and P = \"\\t'. \\ex. (t, t') \\ R \\ move A ex s' a t'\" in someI)\n apply (erule exE)\n apply (erule conjE)\n apply (simp add: Let_def)\n apply (rule_tac x = \"ex\" in someI)\n apply assumption\n done\n\nlemma move_subprop1_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in is_exec_frag A (s', SOME x. move A x s' a T')\"\n apply (cut_tac move_is_move_sim)\n defer\n apply assumption+\n apply (simp add: move_def)\n done\n\nlemma move_subprop2_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in Finite (SOME x. move A x s' a T')\"\n apply (cut_tac move_is_move_sim)\n defer\n apply assumption+\n apply (simp add: move_def)\n done\n\nlemma move_subprop3_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in laststate (s', SOME x. move A x s' a T') = T'\"\n apply (cut_tac move_is_move_sim)\n defer\n apply assumption+\n apply (simp add: move_def)\n done\n\nlemma move_subprop4_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in mk_trace A \\ (SOME x. move A x s' a T') = (if a \\ ext A then a \\ nil else nil)\"\n apply (cut_tac move_is_move_sim)\n defer\n apply assumption+\n apply (simp add: move_def)\n done\n\nlemma move_subprop5_sim:\n \"is_simulation R C A \\ reachable C s \\ s \\a\\C\\ t \\ (s, s') \\ R \\\n let T' = SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\n in (t, T') \\ R\"\n apply (cut_tac move_is_move_sim)\n defer\n apply assumption+\n apply (simp add: move_def)\n done\n\n\nsubsection \\TRACE INCLUSION Part 1: Traces coincide\\\n\nsubsubsection \"Lemmata for <==\"\n\ntext \\Lemma 1: Traces coincide\\\n\nlemma traces_coincide_sim [rule_format (no_asm)]:\n \"is_simulation R C A \\ ext C = ext A \\\n \\s s'. reachable C s \\ is_exec_frag C (s, ex) \\ (s, s') \\ R \\\n mk_trace C \\ ex = mk_trace A \\ ((corresp_ex_simC A R \\ ex) s')\"\n supply if_split [split del]\n apply (pair_induct ex simp: is_exec_frag_def)\n text \\cons case\\\n apply auto\n apply (rename_tac ex a t s s')\n apply (simp add: mk_traceConc)\n apply (frule reachable.reachable_n)\n apply assumption\n apply (erule_tac x = \"t\" in allE)\n apply (erule_tac x = \"SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\" in allE)\n apply (simp add: move_subprop5_sim [unfolded Let_def]\n move_subprop4_sim [unfolded Let_def] split: if_split)\n done\n\ntext \\Lemma 2: \\corresp_ex_sim\\ is execution\\\n\nlemma correspsim_is_execution [rule_format]:\n \"is_simulation R C A \\\n \\s s'. reachable C s \\ is_exec_frag C (s, ex) \\ (s, s') \\ R\n \\ is_exec_frag A (s', (corresp_ex_simC A R \\ ex) s')\"\n apply (pair_induct ex simp: is_exec_frag_def)\n text \\main case\\\n apply auto\n apply (rename_tac ex a t s s')\n apply (rule_tac t = \"SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\" in lemma_2_1)\n\n text \\Finite\\\n apply (erule move_subprop2_sim [unfolded Let_def])\n apply assumption+\n apply (rule conjI)\n\n text \\\\is_exec_frag\\\\\n apply (erule move_subprop1_sim [unfolded Let_def])\n apply assumption+\n apply (rule conjI)\n\n text \\Induction hypothesis\\\n text \\\\reachable_n\\ looping, therefore apply it manually\\\n apply (erule_tac x = \"t\" in allE)\n apply (erule_tac x = \"SOME t'. \\ex1. (t, t') \\ R \\ move A ex1 s' a t'\" in allE)\n apply simp\n apply (frule reachable.reachable_n)\n apply assumption\n apply (simp add: move_subprop5_sim [unfolded Let_def])\n text \\laststate\\\n apply (erule move_subprop3_sim [unfolded Let_def, symmetric])\n apply assumption+\n done\n\n\nsubsection \\Main Theorem: TRACE - INCLUSION\\\n\ntext \\\n Generate condition \\(s, S') \\ R \\ S' \\ starts_of A\\, the first being\n interesting for the induction cases concerning the two lemmas\n \\correpsim_is_execution\\ and \\traces_coincide_sim\\, the second for the start\n state case.\n \\S' := SOME s'. (s, s') \\ R \\ s' \\ starts_of A\\, where \\s \\ starts_of C\\\n\\\n\nlemma simulation_starts:\n \"is_simulation R C A \\ s\\starts_of C \\\n let S' = SOME s'. (s, s') \\ R \\ s' \\ starts_of A\n in (s, S') \\ R \\ S' \\ starts_of A\"\n apply (simp add: is_simulation_def corresp_ex_sim_def Int_non_empty Image_def)\n apply (erule conjE)+\n apply (erule ballE)\n prefer 2 apply blast\n apply (erule exE)\n apply (rule someI2)\n apply assumption\n apply blast\n done\n\nlemmas sim_starts1 = simulation_starts [unfolded Let_def, THEN conjunct1]\nlemmas sim_starts2 = simulation_starts [unfolded Let_def, THEN conjunct2]\n\n\nlemma trace_inclusion_for_simulations:\n \"ext C = ext A \\ is_simulation R C A \\ traces C \\ traces A\"\n apply (unfold traces_def)\n apply (simp add: has_trace_def2)\n apply auto\n\n text \\give execution of abstract automata\\\n apply (rule_tac x = \"corresp_ex_sim A R ex\" in bexI)\n\n text \\Traces coincide, Lemma 1\\\n apply (pair ex)\n apply (rename_tac s ex)\n apply (simp add: corresp_ex_sim_def)\n apply (rule_tac s = \"s\" in traces_coincide_sim)\n apply assumption+\n apply (simp add: executions_def reachable.reachable_0 sim_starts1)\n\n text \\\\corresp_ex_sim\\ is execution, Lemma 2\\\n apply (pair ex)\n apply (simp add: executions_def)\n apply (rename_tac s ex)\n\n text \\start state\\\n apply (rule conjI)\n apply (simp add: sim_starts2 corresp_ex_sim_def)\n\n text \\\\is_execution-fragment\\\\\n apply (simp add: corresp_ex_sim_def)\n apply (rule_tac s = s in correspsim_is_execution)\n apply assumption\n apply (simp add: reachable.reachable_0 sim_starts1)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/SimCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.2689350532777668}} {"text": "theory TelephoneExchange\n imports \"Z_Machines.Z_Machine\"\nbegin unbundle Z_Syntax\n\ntype_synonym digit = integer\ntype_synonym subs = \"digit list\"\n\ndefinition Digit :: \"\\ digit\" where \"Digit = integer_of_int ` {0..9}\"\n\nconsts \n Subs :: \"\\ (digit list)\" \n\ndefinition \"Valid = {n \\ blists 6 Digit. \\ s \\ Subs. n \\ s}\"\n\ndefinition \n \"TelephoneExchange_axioms = (Subs \\ \\ (seq Digit))\"\n\nenumtype Status = seize | dialling | unobtainable | connecting | ringing | speech | engaged | suspended\n\ndefinition \"Connected = {ringing , speech, suspended}\"\n\ndefinition \"Established = Connected \\ {connecting , engaged}\"\n\ntype_synonym subrec = \"Status \\ digit list\"\n\ndefinition SubRec :: \"Status \\ digit list\" where\n\"SubRec = {(s, n). (s = seize \\ n = []) \n \\ (s = dialling \\ n \\ Valid - Subs - {[]})\n \\ (s = unobtainable \\ n \\ Valid)\n \\ (s \\ Established \\ n \\ Subs)}\"\n\ndefinition st :: \"subrec \\ Status\" where [simp]: \"st = (\\ x \\ first x)\"\ndefinition num :: \"subrec \\ subs\" where [simp]: \"num = (\\ x \\ second x)\"\n\nno_syntax\n \"_kleisli_comp\" :: \"logic \\ logic \\ logic\" (infixl \"\\\" 54)\n\nschema Exchange =\n Free :: \"\\ subs\"\n Unavailable :: \"\\ subs\"\n Callers :: \"\\ subs\"\n cal :: \"subs \\ subrec\"\n connected :: \"subs \\ subs\"\nwhere\n \"[Free, Unavailable, dom cal \\ dom connected] partitions Subs\"\n \"Callers = dom ((cal \\ st) \\ Connected)\"\n \"connected = Callers \\ (cal \\ num)\"\n \"functional cal\"\n\nrecord_default Exchange\n\ndefinition \"InitExchange = [Free\\ = Subs, Unavailable\\ = {}, Callers\\ = {}, cal\\ = {}, connected\\ = {}]\"\n\nzoperation LiftFree =\n params s \\ Subs\n pre \"s \\ Free\"\n update \"[Free\\ = Free - {s}\n ,cal\\ = cal \\ {s \\ (seize, [])}]\"\n\ndeclare list_partitions_def [simp]\n\nlemma \"s \\ Subs \\ \\<^bold>{Exchange\\<^bold>}LiftFree s\\<^bold>{Exchange\\<^bold>}\"\n unfolding LiftFree_def Exchange_inv_def Connected_def\n apply (hoare_wlp_auto)\n apply (simp add: Domain_iff disjoint_iff rel_ranres_def)\n apply (simp_all add: Domain_iff disjoint_iff rel_ranres_def)\n apply (rule compatible_relI)\n apply (simp add: pfun_graph_domres[THEN sym])\n apply (subgoal_tac \"s \\ dom cal\")\n apply (auto)\n done\n\nzoperation LiftSuspended =\n params s \\ Subs\n pre \"(s, suspended) \\ connected\\<^sup>\\ \\ cal \\ st\" \n update \"[cal\\ = cal \\ {(connected\\<^sup>\\) s \\ (speech, s)}]\"\n\nzoperation Answer =\n params s \\ Subs\n pre \"(s, ringing) \\ connected\\<^sup>\\ \\ cal \\ st\"\n update \"[ Free\\ = Free - {s}\n , cal\\ = cal \\ {(connected\\<^sup>\\) s \\ (speech, s)}]\"\n\ndefinition \"nextstate n = \n (if n \\ Subs then connecting\n else if n \\ Valid - Subs then dialling\n else unobtainable)\"\n\nzoperation Dial =\n params s \\ Subs d \\ Digit\n pre \"(s, seize) \\ cal \\ st \\ (s, dialling) \\ cal \\ st\"\n update \"[cal\\ = (let newnum = (cal \\ num) s @ [d] in cal \\ {s \\ (nextstate newnum, newnum)})]\"\n\nzoperation ClearAttempt =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s \\ {seize, dialling , connecting , engaged, unobtainable}\"\n update \"[Free\\ = Free \\ {s}, cal\\ = {s} \\ cal]\"\n\nzoperation ClearLine =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s \\ {ringing , suspended}\"\n update \"[ Free\\ = Free \\ {s, connected s}, cal\\ = {s} \\ cal\n , Callers\\ = Callers - {s, connected s}\n , connected\\ = {s} \\ connected]\"\n\nzoperation ClearConnect =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s = speech\"\n update \"[ Free\\ = Free \\ {s}\n , cal\\ = ({s} \\ cal) \\ {connected s \\ (seize, [])}\n , Callers\\ = Callers - {s}\n , connected\\ = {s} \\ connected]\"\n\nzoperation ClearSuspend =\n params s \\ Subs\n pre \"s \\ ran connected\"\n update \"[cal\\ = cal \\ {(connected\\<^sup>\\) s \\ (suspended, s)}]\"\n\nzoperation ClearUnavail =\n params s \\ Subs\n pre \"s \\ Unavailable\"\n update \"[Free\\ = Free \\ {s}, Unavailable\\ = Unavailable - {s}]\"\n\nzoperation MakeUnavail =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s \\ {seize, dialling}\"\n update \"[Unavailable\\ = Unavailable \\ {s}, cal\\ = {s} \\ cal]\"\n\nzoperation Connect2Ringing =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s = connecting \\ s \\ dom connected \\ (cal \\ num) s \\ Free \\ (cal \\ num) s \\ ran connected\"\n update \"[ Free\\ = Free - {s}\n , cal\\ = cal \\ {s \\ (ringing, (cal \\ num) s)}\n , Callers\\ = Callers \\ {s}\n , connected\\ = connected \\ {s \\ (cal \\ num) s}]\"\n\nzoperation Connect2Engaged =\n params s \\ Subs\n pre \"s \\ dom cal \\ (cal \\ st) s = connecting \\ s \\ dom connected \\ (cal \\ num) s \\ Free\"\n update \"[ cal\\ = cal \\ {s \\ (engaged, (cal \\ num) s)} ]\"\n \n\nzmachine TelephoneExchange =\n over Exchange\n init \"InitExchange\"\n operations \n LiftFree LiftSuspended Answer Dial \n ClearAttempt ClearLine ClearConnect ClearSuspend ClearUnavail\n MakeUnavail\n Connect2Ringing Connect2Engaged\n \ndef_consts Subs = \"{[1,2,3], [3,4,5], [6,7,8]}\"\n\nanimate TelephoneExchange\n\n\n\nend", "meta": {"author": "isabelle-utp", "repo": "Z_Machines", "sha": "72ed0f7b198d8e9f34efd10f1bff5351bbcab1a7", "save_path": "github-repos/isabelle/isabelle-utp-Z_Machines", "path": "github-repos/isabelle/isabelle-utp-Z_Machines/Z_Machines-72ed0f7b198d8e9f34efd10f1bff5351bbcab1a7/examples/TelephoneExchange.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321842389469, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.2688966151771359}} {"text": "theory IICF_List_List\nimports \n \"../../Sepref\"\nbegin\n\n\n context begin\n private abbreviation (input) \"LR A \\ \\\\A\\list_rel\\list_rel\"\n\n sepref_decl_op list_list_lempty: \"\\n. replicate n []\" :: \"nat_rel \\ LR A\" .\n sepref_decl_op list_list_push_back: \"\\xss i x. xss[i:=xss!i@[x]]\" \n :: \"[\\((xss,i),_). if (LR A \\\\<^sub>r nat_rel) \\\\<^sub>r A \\ LR A\" .\n\n sepref_decl_op list_list_pop_back: \"\\xss i. (last (xss!i), xss[i:=butlast (xss!i)])\" \n :: \"[\\(xss,i). i xss!i\\[]]\\<^sub>f (LR A \\\\<^sub>r nat_rel)\\ A \\\\<^sub>r LR A\" \n unfolding conv_to_is_Nil short_circuit_conv\n by parametricity\n \n sepref_decl_op list_list_idx: \"\\xss i j. xss!i!j\" :: \"[\\((xss,i),j). i jf ((LR A \\\\<^sub>r nat_rel) \\\\<^sub>r nat_rel) \\ A\" \n unfolding short_circuit_conv\n by parametricity\n \n sepref_decl_op list_list_llen: \"\\xss i. length (xss!i)\" :: \"[\\(xss,i). if LR A \\\\<^sub>r nat_rel \\ nat_rel\" .\n sepref_decl_op list_list_len: \"length :: _ list list \\ _\" :: \"LR A \\ nat_rel\" .\n \n sepref_decl_op list_list_take: \"\\xss i l. (xss[i:=take l (xss!i)])\" \n :: \"[\\((xss,i),l). i l\\length (xss!i)]\\<^sub>f ((LR A \\\\<^sub>r nat_rel) \\\\<^sub>r nat_rel)\\ LR A\" \n unfolding conv_to_is_Nil short_circuit_conv\n by parametricity\n \n end\n\n locale list_list_custom_empty = \n fixes rel empty PRE and op_custom_empty :: \"nat \\ 'a list list\"\n assumes customize_hnr_aux: \"(empty,(RETURN o (op_list_list_lempty::nat \\ 'a list list))) \\ [PRE]\\<^sub>a snat_assn\\<^sup>k \\ rel\"\n assumes op_custom_empty_def: \"op_custom_empty = op_list_list_lempty\"\n begin\n sepref_register op_custom_empty :: \"nat \\ 'c list list\"\n \n lemma fold_custom_empty:\n \"replicate n [] = op_custom_empty n\"\n \"op_list_list_lempty = op_custom_empty\"\n \"mop_list_list_lempty n = RETURN (op_custom_empty n)\"\n unfolding op_custom_empty_def by simp_all\n \n lemmas custom_hnr[sepref_fr_rules] = customize_hnr_aux[folded op_custom_empty_def]\n end\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/IICF/Intf/IICF_List_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073802837477, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.2688524411198931}} {"text": "chapter \\Basic Control Flow\\\n\ntheory PhiSem_CF_Basic\n imports PhiSem_Generic_Boolean\nbegin\n\nsection \\Instructions\\\n\nsubsection \\Non-Branching Selection\\\n\ndefinition op_sel :: \"TY \\ (VAL \\ VAL \\ VAL, VAL) proc'\"\n where \"op_sel TY =\n \\M_caseV (\\vc. \\M_caseV (\\va vb.\n \\M_getV bool V_bool.dest vc (\\c.\n \\M_getV TY id va (\\a.\n \\M_getV TY id vb (\\b.\n Return (\\arg (if c then b else a)))))))\"\n\nsubsection \\Branch\\\n\ndefinition op_if :: \"'ret proc\n \\ 'ret proc\n \\ (VAL,'ret::VALs) proc'\"\n where \"op_if brT brF v =\n \\M_getV bool V_bool.dest v (\\c. (if c then brT else brF))\"\n\nsubsection \\While Loop\\\n\ninductive SemDoWhile :: \"VAL proc \\ resource \\ unit comp \\ bool\" where\n \"Success (\\arg (V_bool.mk False)) res \\ f s \\ SemDoWhile f s (Success (\\arg ()) res)\"\n| \"Success (\\arg (V_bool.mk True)) res \\ f s \\ SemDoWhile f res s'' \\ SemDoWhile f s s''\"\n| \"Abnormality v e \\ f s \\ SemDoWhile f s (Abnormality v e)\"\n| \"NonTerm \\ f s \\ SemDoWhile f s NonTerm\"\n| \"AssumptionBroken \\ f s \\ SemDoWhile f s AssumptionBroken\"\n| \"Invalid \\ f s \\ SemDoWhile f s Invalid\"\n\nlemma \"\\ y. SemDoWhile ((\\res. Return (\\arg (V_bool.mk True)) res) :: VAL proc) res y\"\n apply rule apply (elim exE) subgoal for y\n apply (induct \"((\\res. Return (\\arg (V_bool.mk True)) (res::resource)) :: VAL proc)\" res y\n rule: SemDoWhile.induct)\n apply (simp_all add: Return_def det_lift_def) . .\n\ndefinition op_do_while :: \" VAL proc \\ unit proc\"\n where \"op_do_while f s = Collect (SemDoWhile f s)\"\n\n(* lemma SemDoWhile_deterministic:\n assumes \"SemDoWhile c s s1\"\n and \"SemDoWhile c s s2\"\n shows \"s1 = s2\"\nproof -\n have \"SemDoWhile c s s1 \\ (\\s2. SemDoWhile c s s2 \\ s1 = s2)\"\n apply (induct rule: SemDoWhile.induct)\n by (subst SemDoWhile.simps, simp)+\n thus ?thesis\n using assms by simp\nqed\n\nlemma SemDoWhile_deterministic2:\n \"SemDoWhile body s x \\ The ( SemDoWhile body s) = x\"\n using SemDoWhile_deterministic by blast *)\n\n\nsubsection \\Recursion\\\n\ninductive SemRec :: \"(('a,'a) proc' \\ ('a,'a) proc')\n \\ 'a \\arg \\ resource \\ 'a comp set \\ bool\"\nwhere\n SemRec_I0: \"(\\g. F g x res = y) \\ SemRec F x res y\"\n| SemRec_IS: \"SemRec (F o F) x res y \\ SemRec F x res y\"\n\ndefinition op_fix_point :: \"(('a,'a) proc' \\ ('a,'a) proc')\n \\ ('a,'a) proc'\"\n where \"op_fix_point F x s = (if (\\t. SemRec F x s t) then The (SemRec F x s) else {})\"\n\n\n\nsubsubsection \\Simple Properties\\\n\nlemma SemRec_IR: \"SemRec F x r y \\ SemRec (F o F) x r y\"\n by (induct rule: SemRec.induct, rule SemRec_I0, simp)\n\nlemma SemRec_deterministic:\n assumes \"SemRec c s r s1\" and \"SemRec c s r s2\" shows \"s1 = s2\"\nproof -\n have \"SemRec c s r s1 \\ (\\s2. SemRec c s r s2 \\ s1 = s2)\"\n apply (induct rule: SemRec.induct)\n apply clarify\n subgoal for F a b y s2 apply (rotate_tac 1)\n apply (induct rule: SemRec.induct) by auto\n apply clarify apply (blast intro: SemRec_IR) done\n thus ?thesis using assms by simp\nqed\n\nlemma SemRec_deterministic2: \" SemRec body s r x \\ The (SemRec body s r) = x\"\n using SemRec_deterministic by (metis theI_unique)\n\n\n\nsection \\Abstraction of Procedures\\\n\nsubsubsection \\Syntax for Annotations\\\n\nconsts Invariant :: \\bool \\ bool\\ (\"Inv: _\" [100] 36)\nconsts Guard :: \\bool \\ bool\\ (\"Guard: _\" [100] 36)\nconsts End :: \\bool \\ bool\\ (\"End: _\" [100] 36)\n\nsubsection \\Branch-like\\\n\nlemma op_sel_\\app:\n \\ \\SemType (a \\ A) TY\n\\ \\SemType (b \\ B) TY\n\\ \\